From d57325bc28075cc79a3c942252548184a2fb3926 Mon Sep 17 00:00:00 2001
From: Yang Guo <yangguo@chromium.org>
Date: Wed, 11 Jul 2018 08:39:44 +0200
Subject: [PATCH 01/28] Update Node.js to 8174d0c8ca


From 456581b2c4715642b5a7f9400ed77ade90f398c4 Mon Sep 17 00:00:00 2001
From: Yang Guo <yangguo@chromium.org>
Date: Mon, 9 Jul 2018 07:39:50 +0200
Subject: [PATCH 02/28] Restore README.md

---
 README.md | 640 +-----------------------------------------------------
 1 file changed, 9 insertions(+), 631 deletions(-)

diff --git a/README.md b/README.md
index e81f6629ed342a..8a735770f9b310 100644
--- a/README.md
+++ b/README.md
@@ -1,638 +1,16 @@
-<p align="center">
-  <a href="https://nodejs.org/">
-    <img
-      alt="Node.js"
-      src="https://nodejs.org/static/images/logo-light.svg"
-      width="400"
-    />
-  </a>
-</p>
-
-Node.js is a JavaScript runtime built on Chrome's V8 JavaScript engine. For
-more information on using Node.js, see the
-[Node.js Website][].
-
-The Node.js project is supported by the
-[Node.js Foundation](https://nodejs.org/en/foundation/). Contributions,
-policies, and releases are managed under an
-[open governance model](./GOVERNANCE.md).
-
-**This project is bound by a [Code of Conduct][].**
-
-
-# Table of Contents
-
-* [Support](#support)
-* [Release Types](#release-types)
-  * [Download](#download)
-    * [Current and LTS Releases](#current-and-lts-releases)
-    * [Nightly Releases](#nightly-releases)
-    * [API Documentation](#api-documentation)
-  * [Verifying Binaries](#verifying-binaries)
-* [Building Node.js](#building-nodejs)
-* [Security](#security)
-* [Current Project Team Members](#current-project-team-members)
-  * [TSC (Technical Steering Committee)](#tsc-technical-steering-committee)
-  * [Collaborators](#collaborators)
-  * [Release Team](#release-team)
-* [Contributing to Node.js](#contributing-to-nodejs)
-
-## Support
-
-Node.js contributors have limited availability to address general support
-questions. Please make sure you are using a [currently-supported version of
-Node.js](https://github.com/nodejs/Release#release-schedule).
-
-When looking for support, please first search for your question in these venues:
-
-* [Node.js Website][]
-* [Node.js Help][]
-* [Open or closed issues in the Node.js GitHub organization](https://github.com/issues?utf8=%E2%9C%93&q=sort%3Aupdated-desc+org%3Anodejs+is%3Aissue)
-
-If you didn't find an answer in one of the official resources above, you can
-search these unofficial resources:
-
-* [Questions tagged 'node.js' on StackOverflow][]
-* [#node.js channel on chat.freenode.net][]. See <http://nodeirc.info/> for more
-  information.
-* [Node.js Discord Community](https://discordapp.com/invite/v7rrPdE)
-* [Node.js Slack Community](https://node-js.slack.com/): Visit
-  [nodeslackers.com](http://www.nodeslackers.com/) to register.
-
-GitHub issues are meant for tracking enhancements and bugs, not general support.
-
-Remember, libre != gratis; the open source license grants you the freedom to use
-and modify, but not commitments of other people's time. Please be respectful,
-and set your expectations accordingly.
-
-## Release Types
-
-The Node.js project maintains multiple types of releases:
-
-* **Current**: Released from active development branches of this repository,
-  versioned by [SemVer](https://semver.org) and signed by a member of the
-  [Release Team](#release-team).
-  Code for Current releases is organized in this repository by major version
-  number. For example: [v4.x](https://github.com/nodejs/node/tree/v4.x).
-  The major version number of Current releases will increment every 6 months
-  allowing for breaking changes to be introduced. This happens in April and
-  October every year. Current release lines beginning in October each year have
-  a maximum support life of 8 months. Current release lines beginning in April
-  each year will convert to LTS (see below) after 6 months and receive further
-  support for 30 months.
-* **LTS**: Releases that receive Long-term Support, with a focus on stability
-  and security. Every second Current release line (major version) will become an
-  LTS line and receive 18 months of _Active LTS_ support and a further 12
-  months of _Maintenance_. LTS release lines are given alphabetically
-  ordered codenames, beginning with v4 Argon. LTS releases are less frequent
-  and will attempt to maintain consistent major and minor version numbers,
-  only incrementing patch version numbers. There are no breaking changes or
-  feature additions, except in some special circumstances.
-* **Nightly**: Versions of code in this repository on the current Current
-  branch, automatically built every 24-hours where changes exist. Use with
-  caution.
-
-More information can be found in the [LTS README](https://github.com/nodejs/LTS/).
-
-### Download
-
-Binaries, installers, and source tarballs are available at
-<https://nodejs.org>.
-
-#### Current and LTS Releases
-**Current** and **LTS** releases are available at
-<https://nodejs.org/download/release/>, listed under their version strings.
-The [latest](https://nodejs.org/download/release/latest/) directory is an
-alias for the latest Current release. The latest LTS release from an LTS
-line is available in the form: latest-_codename_. For example:
-<https://nodejs.org/download/release/latest-argon>.
-
-#### Nightly Releases
-**Nightly** builds are available at
-<https://nodejs.org/download/nightly/>, listed under their version
-string which includes their date (in UTC time) and the commit SHA at
-the HEAD of the release.
-
-#### API Documentation
-**API documentation** is available in each release and nightly
-directory under _docs_. <https://nodejs.org/api/> points to the API
-documentation of the latest stable version.
-
-### Verifying Binaries
-
-Current, LTS, and Nightly download directories all contain a SHASUMS256.txt
-file that lists the SHA checksums for each file available for
-download.
-
-The SHASUMS256.txt can be downloaded using `curl`.
+This is the official [V8](https://github.com/v8/v8/wiki) fork of [Node.js](https://github.com/nodejs/node) with a recent V8 version.
 
+To build from source, run
 ```console
-$ curl -O https://nodejs.org/dist/vx.y.z/SHASUMS256.txt
+git clone https://github.com/v8/node v8-node
+cd v8-node
+./configure --build-v8-with-gn
+make -j4 node
 ```
 
-To check that a downloaded file matches the checksum, run
-it through `sha256sum` with a command such as:
+Or download the latest build for Ubuntu from this [build bot](https://build.chromium.org/p/client.v8.fyi/builders/V8%20-%20node.js%20integration). Select a build, then use *Archive link download*.
 
+To check the V8 version in Node, have a look at [`v8-version.h`](https://github.com/v8/node/blob/vee-eight-lkgr/deps/v8/include/v8-version.h) or run
 ```console
-$ grep node-vx.y.z.tar.gz SHASUMS256.txt | sha256sum -c -
-```
-
-Current and LTS releases (but not Nightlies) also have the GPG detached
-signature of SHASUMS256.txt available as SHASUMS256.txt.sig. You can use `gpg`
-to verify that SHASUMS256.txt has not been tampered with.
-
-To verify SHASUMS256.txt has not been altered, you will first need to import
-all of the GPG keys of individuals authorized to create releases. They are
-listed at the bottom of this README under [Release Team](#release-team).
-Use a command such as this to import the keys:
-
-```console
-$ gpg --keyserver pool.sks-keyservers.net --recv-keys DD8F2338BAE7501E3DD5AC78C273792F7D83545D
-```
-
-See the bottom of this README for a full script to import active release keys.
-
-Next, download the SHASUMS256.txt.sig for the release:
-
-```console
-$ curl -O https://nodejs.org/dist/vx.y.z/SHASUMS256.txt.sig
-```
-
-After downloading the appropriate SHASUMS256.txt and SHASUMS256.txt.sig files,
-you can then use `gpg --verify SHASUMS256.txt.sig SHASUMS256.txt` to verify
-that the file has been signed by an authorized member of the Node.js team.
-
-Once verified, use the SHASUMS256.txt file to get the checksum for
-the binary verification command above.
-
-## Building Node.js
-
-See [BUILDING.md](BUILDING.md) for instructions on how to build
-Node.js from source. The document also contains a list of
-officially supported platforms.
-
-## Security
-
-Security flaws in Node.js should be reported by emailing security@nodejs.org.
-Please do not disclose security bugs publicly until they have been handled by
-the security team.
-
-Your email will be acknowledged within 24 hours, and you will receive a more
-detailed response to your email within 48 hours indicating the next steps in
-handling your report.
-
-There are no hard and fast rules to determine if a bug is worth reporting as
-a security issue. The general rule is an issue worth reporting should allow an
-attacker to compromise the confidentiality, integrity, or availability of the
-Node.js application or its system for which the attacker does not already have
-the capability.
-
-To illustrate the point, here are some examples of past issues and what the
-Security Response Team thinks of them. When in doubt, however, please do send
-us a report nonetheless.
-
-
-### Public disclosure preferred
-
-- [#14519](https://github.com/nodejs/node/issues/14519): _Internal domain
-  function can be used to cause segfaults_. Causing program termination using
-  either the public JavaScript APIs or the private bindings layer APIs requires
-  the ability to execute arbitrary JavaScript code, which is already the highest
-  level of privilege possible.
-
-- [#12141](https://github.com/nodejs/node/pull/12141): _buffer: zero fill
-  Buffer(num) by default_. The buffer constructor behavior was documented,
-  but found to be prone to [mis-use](https://snyk.io/blog/exploiting-buffer/).
-  It has since been changed, but despite much debate, was not considered misuse
-  prone enough to justify fixing in older release lines and breaking our
-  API stability contract.
-
-### Private disclosure preferred
-
-- [CVE-2016-7099](https://nodejs.org/en/blog/vulnerability/september-2016-security-releases/):
-  _Fix invalid wildcard certificate validation check_. This is a high severity
-  defect that would allow a malicious TLS server to serve an invalid wildcard
-  certificate for its hostname and be improperly validated by a Node.js client.
-
-- [#5507](https://github.com/nodejs/node/pull/5507): _Fix a defect that makes
-  the CacheBleed Attack possible_. Many, though not all, OpenSSL vulnerabilities
-  in the TLS/SSL protocols also affect Node.js.
-
-- [CVE-2016-2216](https://nodejs.org/en/blog/vulnerability/february-2016-security-releases/):
-  _Fix defects in HTTP header parsing for requests and responses that can allow
-  response splitting_. While the impact of this vulnerability is application and
-  network dependent, it is remotely exploitable in the HTTP protocol.
-
-When in doubt, please do send us a report.
-
-
-## Current Project Team Members
-
-The Node.js project team comprises a group of core collaborators and a sub-group
-that forms the _Technical Steering Committee_ (TSC) which governs the project.
-For more information about the governance of the Node.js project, see
-[GOVERNANCE.md](./GOVERNANCE.md).
-
-### TSC (Technical Steering Committee)
-
-* [addaleax](https://github.com/addaleax) -
-**Anna Henningsen** &lt;anna@addaleax.net&gt; (she/her)
-* [ChALkeR](https://github.com/ChALkeR) -
-**Сковорода Никита Андреевич** &lt;chalkerx@gmail.com&gt; (he/him)
-* [cjihrig](https://github.com/cjihrig) -
-**Colin Ihrig** &lt;cjihrig@gmail.com&gt;
-* [danbev](https://github.com/danbev) -
-**Daniel Bevenius** &lt;daniel.bevenius@gmail.com&gt;
-* [fhinkel](https://github.com/fhinkel) -
-**Franziska Hinkelmann** &lt;franziska.hinkelmann@gmail.com&gt; (she/her)
-* [Fishrock123](https://github.com/Fishrock123) -
-**Jeremiah Senkpiel** &lt;fishrock123@rocketmail.com&gt;
-* [gibfahn](https://github.com/gibfahn) -
-**Gibson Fahnestock** &lt;gibfahn@gmail.com&gt; (he/him)
-* [jasnell](https://github.com/jasnell) -
-**James M Snell** &lt;jasnell@gmail.com&gt; (he/him)
-* [joyeecheung](https://github.com/joyeecheung) -
-**Joyee Cheung** &lt;joyeec9h3@gmail.com&gt; (she/her)
-* [mcollina](https://github.com/mcollina) -
-**Matteo Collina** &lt;matteo.collina@gmail.com&gt; (he/him)
-* [mhdawson](https://github.com/mhdawson) -
-**Michael Dawson** &lt;michael_dawson@ca.ibm.com&gt; (he/him)
-* [MylesBorins](https://github.com/MylesBorins) -
-**Myles Borins** &lt;myles.borins@gmail.com&gt; (he/him)
-* [ofrobots](https://github.com/ofrobots) -
-**Ali Ijaz Sheikh** &lt;ofrobots@google.com&gt; (he/him)
-* [rvagg](https://github.com/rvagg) -
-**Rod Vagg** &lt;rod@vagg.org&gt;
-* [targos](https://github.com/targos) -
-**Michaël Zasso** &lt;targos@protonmail.com&gt; (he/him)
-* [thefourtheye](https://github.com/thefourtheye) -
-**Sakthipriyan Vairamani** &lt;thechargingvolcano@gmail.com&gt; (he/him)
-* [TimothyGu](https://github.com/TimothyGu) -
-**Tiancheng "Timothy" Gu** &lt;timothygu99@gmail.com&gt; (he/him)
-* [Trott](https://github.com/Trott) -
-**Rich Trott** &lt;rtrott@gmail.com&gt; (he/him)
-
-### TSC Emeriti
-
-* [bnoordhuis](https://github.com/bnoordhuis) -
-**Ben Noordhuis** &lt;info@bnoordhuis.nl&gt;
-* [chrisdickinson](https://github.com/chrisdickinson) -
-**Chris Dickinson** &lt;christopher.s.dickinson@gmail.com&gt;
-* [evanlucas](https://github.com/evanlucas) -
-**Evan Lucas** &lt;evanlucas@me.com&gt; (he/him)
-* [indutny](https://github.com/indutny) -
-**Fedor Indutny** &lt;fedor.indutny@gmail.com&gt;
-* [isaacs](https://github.com/isaacs) -
-**Isaac Z. Schlueter** &lt;i@izs.me&gt;
-* [joshgav](https://github.com/joshgav) -
-**Josh Gavant** &lt;josh.gavant@outlook.com&gt;
-* [mscdex](https://github.com/mscdex) -
-**Brian White** &lt;mscdex@mscdex.net&gt;
-* [nebrius](https://github.com/nebrius) -
-**Bryan Hughes** &lt;bryan@nebri.us&gt;
-* [orangemocha](https://github.com/orangemocha) -
-**Alexis Campailla** &lt;orangemocha@nodejs.org&gt;
-* [piscisaureus](https://github.com/piscisaureus) -
-**Bert Belder** &lt;bertbelder@gmail.com&gt;
-* [shigeki](https://github.com/shigeki) -
-**Shigeki Ohtsu** &lt;ohtsu@ohtsu.org&gt; (he/him)
-* [trevnorris](https://github.com/trevnorris) -
-**Trevor Norris** &lt;trev.norris@gmail.com&gt;
-
-### Collaborators
-
-* [addaleax](https://github.com/addaleax) -
-**Anna Henningsen** &lt;anna@addaleax.net&gt; (she/her)
-* [ak239](https://github.com/ak239) -
-**Aleksei Koziatinskii** &lt;ak239spb@gmail.com&gt;
-* [andrasq](https://github.com/andrasq) -
-**Andras** &lt;andras@kinvey.com&gt;
-* [AndreasMadsen](https://github.com/AndreasMadsen) -
-**Andreas Madsen** &lt;amwebdk@gmail.com&gt; (he/him)
-* [AnnaMag](https://github.com/AnnaMag) -
-**Anna M. Kedzierska** &lt;anna.m.kedzierska@gmail.com&gt;
-* [apapirovski](https://github.com/apapirovski) -
-**Anatoli Papirovski** &lt;apapirovski@mac.com&gt; (he/him)
-* [aqrln](https://github.com/aqrln) -
-**Alexey Orlenko** &lt;eaglexrlnk@gmail.com&gt; (he/him)
-* [bcoe](https://github.com/bcoe) -
-**Ben Coe** &lt;bencoe@gmail.com&gt; (he/him)
-* [bengl](https://github.com/bengl) -
-**Bryan English** &lt;bryan@bryanenglish.com&gt; (he/him)
-* [benjamingr](https://github.com/benjamingr) -
-**Benjamin Gruenbaum** &lt;benjamingr@gmail.com&gt;
-* [BethGriggs](https://github.com/BethGriggs) -
-**Beth Griggs** &lt;Bethany.Griggs@uk.ibm.com&gt; (she/her)
-* [bmeck](https://github.com/bmeck) -
-**Bradley Farias** &lt;bradley.meck@gmail.com&gt;
-* [bmeurer](https://github.com/bmeurer) -
-**Benedikt Meurer** &lt;benedikt.meurer@gmail.com&gt;
-* [bnoordhuis](https://github.com/bnoordhuis) -
-**Ben Noordhuis** &lt;info@bnoordhuis.nl&gt;
-* [brendanashworth](https://github.com/brendanashworth) -
-**Brendan Ashworth** &lt;brendan.ashworth@me.com&gt;
-* [BridgeAR](https://github.com/BridgeAR) -
-**Ruben Bridgewater** &lt;ruben@bridgewater.de&gt;
-* [bzoz](https://github.com/bzoz) -
-**Bartosz Sosnowski** &lt;bartosz@janeasystems.com&gt;
-* [calvinmetcalf](https://github.com/calvinmetcalf) -
-**Calvin Metcalf** &lt;calvin.metcalf@gmail.com&gt;
-* [ChALkeR](https://github.com/ChALkeR) -
-**Сковорода Никита Андреевич** &lt;chalkerx@gmail.com&gt; (he/him)
-* [chrisdickinson](https://github.com/chrisdickinson) -
-**Chris Dickinson** &lt;christopher.s.dickinson@gmail.com&gt;
-* [cjihrig](https://github.com/cjihrig) -
-**Colin Ihrig** &lt;cjihrig@gmail.com&gt;
-* [claudiorodriguez](https://github.com/claudiorodriguez) -
-**Claudio Rodriguez** &lt;cjrodr@yahoo.com&gt;
-* [codebytere](https://github.com/codebytere) -
-**Shelley Vohr** &lt;codebytere@gmail.com&gt; (she/her)
-* [danbev](https://github.com/danbev) -
-**Daniel Bevenius** &lt;daniel.bevenius@gmail.com&gt;
-* [DavidCai1993](https://github.com/DavidCai1993) -
-**David Cai** &lt;davidcai1993@yahoo.com&gt; (he/him)
-* [davisjam](https://github.com/davisjam) -
-**Jamie Davis** &lt;davisjam@vt.edu&gt; (he/him)
-* [devsnek](https://github.com/devsnek) -
-**Gus Caplan** &lt;me@gus.host&gt; (he/him)
-* [edsadr](https://github.com/edsadr) -
-**Adrian Estrada** &lt;edsadr@gmail.com&gt; (he/him)
-* [eljefedelrodeodeljefe](https://github.com/eljefedelrodeodeljefe) -
-**Robert Jefe Lindstaedt** &lt;robert.lindstaedt@gmail.com&gt;
-* [estliberitas](https://github.com/estliberitas) -
-**Alexander Makarenko** &lt;estliberitas@gmail.com&gt;
-* [eugeneo](https://github.com/eugeneo) -
-**Eugene Ostroukhov** &lt;eostroukhov@google.com&gt;
-* [evanlucas](https://github.com/evanlucas) -
-**Evan Lucas** &lt;evanlucas@me.com&gt; (he/him)
-* [fhinkel](https://github.com/fhinkel) -
-**Franziska Hinkelmann** &lt;franziska.hinkelmann@gmail.com&gt; (she/her)
-* [firedfox](https://github.com/firedfox) -
-**Daniel Wang** &lt;wangyang0123@gmail.com&gt;
-* [Fishrock123](https://github.com/Fishrock123) -
-**Jeremiah Senkpiel** &lt;fishrock123@rocketmail.com&gt;
-* [gabrielschulhof](https://github.com/gabrielschulhof) -
-**Gabriel Schulhof** &lt;gabriel.schulhof@intel.com&gt;
-* [geek](https://github.com/geek) -
-**Wyatt Preul** &lt;wpreul@gmail.com&gt;
-* [gibfahn](https://github.com/gibfahn) -
-**Gibson Fahnestock** &lt;gibfahn@gmail.com&gt; (he/him)
-* [gireeshpunathil](https://github.com/gireeshpunathil) -
-**Gireesh Punathil** &lt;gpunathi@in.ibm.com&gt; (he/him)
-* [guybedford](https://github.com/guybedford) -
-**Guy Bedford** &lt;guybedford@gmail.com&gt; (he/him)
-* [hashseed](https://github.com/hashseed) -
-**Yang Guo** &lt;yangguo@chromium.org&gt; (he/him)
-* [hiroppy](https://github.com/hiroppy) -
-**Yuta Hiroto** &lt;hello@hiroppy.me&gt; (he/him)
-* [iarna](https://github.com/iarna) -
-**Rebecca Turner** &lt;me@re-becca.org&gt;
-* [imyller](https://github.com/imyller) -
-**Ilkka Myller** &lt;ilkka.myller@nodefield.com&gt;
-* [indutny](https://github.com/indutny) -
-**Fedor Indutny** &lt;fedor.indutny@gmail.com&gt;
-* [italoacasas](https://github.com/italoacasas) -
-**Italo A. Casas** &lt;me@italoacasas.com&gt; (he/him)
-* [JacksonTian](https://github.com/JacksonTian) -
-**Jackson Tian** &lt;shyvo1987@gmail.com&gt;
-* [jasnell](https://github.com/jasnell) -
-**James M Snell** &lt;jasnell@gmail.com&gt; (he/him)
-* [jasongin](https://github.com/jasongin) -
-**Jason Ginchereau** &lt;jasongin@microsoft.com&gt;
-* [jbergstroem](https://github.com/jbergstroem) -
-**Johan Bergström** &lt;bugs@bergstroem.nu&gt;
-* [jdalton](https://github.com/jdalton) -
-**John-David Dalton** &lt;john.david.dalton@gmail.com&gt;
-* [jhamhader](https://github.com/jhamhader) -
-**Yuval Brik** &lt;yuval@brik.org.il&gt;
-* [jkrems](https://github.com/jkrems) -
-**Jan Krems** &lt;jan.krems@gmail.com&gt; (he/him)
-* [joaocgreis](https://github.com/joaocgreis) -
-**João Reis** &lt;reis@janeasystems.com&gt;
-* [joshgav](https://github.com/joshgav) -
-**Josh Gavant** &lt;josh.gavant@outlook.com&gt;
-* [joyeecheung](https://github.com/joyeecheung) -
-**Joyee Cheung** &lt;joyeec9h3@gmail.com&gt; (she/her)
-* [julianduque](https://github.com/julianduque) -
-**Julian Duque** &lt;julianduquej@gmail.com&gt; (he/him)
-* [JungMinu](https://github.com/JungMinu) -
-**Minwoo Jung** &lt;minwoo@nodesource.com&gt; (he/him)
-* [kfarnung](https://github.com/kfarnung) -
-**Kyle Farnung** &lt;kfarnung@microsoft.com&gt; (he/him)
-* [kunalspathak](https://github.com/kunalspathak) -
-**Kunal Pathak** &lt;kunal.pathak@microsoft.com&gt;
-* [lance](https://github.com/lance) -
-**Lance Ball** &lt;lball@redhat.com&gt;
-* [Leko](https://github.com/Leko) -
-**Shingo Inoue** &lt;leko.noor@gmail.com&gt; (he/him)
-* [lpinca](https://github.com/lpinca) -
-**Luigi Pinca** &lt;luigipinca@gmail.com&gt; (he/him)
-* [lucamaraschi](https://github.com/lucamaraschi) -
-**Luca Maraschi** &lt;luca.maraschi@gmail.com&gt; (he/him)
-* [maclover7](https://github.com/maclover7) -
-**Jon Moss** &lt;me@jonathanmoss.me&gt; (he/him)
-* [mafintosh](https://github.com/mafintosh)
-**Mathias Buus** &lt;mathiasbuus@gmail.com&gt; (he/him)
-* [mcollina](https://github.com/mcollina) -
-**Matteo Collina** &lt;matteo.collina@gmail.com&gt; (he/him)
-* [mhdawson](https://github.com/mhdawson) -
-**Michael Dawson** &lt;michael_dawson@ca.ibm.com&gt; (he/him)
-* [misterdjules](https://github.com/misterdjules) -
-**Julien Gilli** &lt;jgilli@nodejs.org&gt;
-* [mmarchini](https://github.com/mmarchini) -
-**Matheus Marchini** &lt;matheus@sthima.com&gt;
-* [MoonBall](https://github.com/MoonBall) -
-**Chen Gang** &lt;gangc.cxy@foxmail.com&gt;
-* [mscdex](https://github.com/mscdex) -
-**Brian White** &lt;mscdex@mscdex.net&gt;
-* [MylesBorins](https://github.com/MylesBorins) -
-**Myles Borins** &lt;myles.borins@gmail.com&gt; (he/him)
-* [not-an-aardvark](https://github.com/not-an-aardvark) -
-**Teddy Katz** &lt;teddy.katz@gmail.com&gt;
-* [ofrobots](https://github.com/ofrobots) -
-**Ali Ijaz Sheikh** &lt;ofrobots@google.com&gt; (he/him)
-* [orangemocha](https://github.com/orangemocha) -
-**Alexis Campailla** &lt;orangemocha@nodejs.org&gt;
-* [othiym23](https://github.com/othiym23) -
-**Forrest L Norvell** &lt;ogd@aoaioxxysz.net&gt; (he/him)
-* [phillipj](https://github.com/phillipj) -
-**Phillip Johnsen** &lt;johphi@gmail.com&gt;
-* [pmq20](https://github.com/pmq20) -
-**Minqi Pan** &lt;pmq2001@gmail.com&gt;
-* [princejwesley](https://github.com/princejwesley) -
-**Prince John Wesley** &lt;princejohnwesley@gmail.com&gt;
-* [Qard](https://github.com/Qard) -
-**Stephen Belanger** &lt;admin@stephenbelanger.com&gt; (he/him)
-* [refack](https://github.com/refack) -
-**Refael Ackermann** &lt;refack@gmail.com&gt; (he/him)
-* [richardlau](https://github.com/richardlau) -
-**Richard Lau** &lt;riclau@uk.ibm.com&gt;
-* [ronkorving](https://github.com/ronkorving) -
-**Ron Korving** &lt;ron@ronkorving.nl&gt;
-* [RReverser](https://github.com/RReverser) -
-**Ingvar Stepanyan** &lt;me@rreverser.com&gt;
-* [rvagg](https://github.com/rvagg) -
-**Rod Vagg** &lt;rod@vagg.org&gt;
-* [ryzokuken](https://github.com/ryzokuken) -
-**Ujjwal Sharma** &lt;usharma1998@gmail.com&gt; (he/him)
-* [saghul](https://github.com/saghul) -
-**Saúl Ibarra Corretgé** &lt;saghul@gmail.com&gt;
-* [sam-github](https://github.com/sam-github) -
-**Sam Roberts** &lt;vieuxtech@gmail.com&gt;
-* [santigimeno](https://github.com/santigimeno) -
-**Santiago Gimeno** &lt;santiago.gimeno@gmail.com&gt;
-* [sebdeckers](https://github.com/sebdeckers) -
-**Sebastiaan Deckers** &lt;sebdeckers83@gmail.com&gt;
-* [seishun](https://github.com/seishun) -
-**Nikolai Vavilov** &lt;vvnicholas@gmail.com&gt;
-* [shigeki](https://github.com/shigeki) -
-**Shigeki Ohtsu** &lt;ohtsu@ohtsu.org&gt; (he/him)
-* [silverwind](https://github.com/silverwind) -
-**Roman Reiss** &lt;me@silverwind.io&gt;
-* [srl295](https://github.com/srl295) -
-**Steven R Loomis** &lt;srloomis@us.ibm.com&gt;
-* [starkwang](https://github.com/starkwang) -
-**Weijia Wang** &lt;starkwang@126.com&gt;
-* [stefanmb](https://github.com/stefanmb) -
-**Stefan Budeanu** &lt;stefan@budeanu.com&gt;
-* [targos](https://github.com/targos) -
-**Michaël Zasso** &lt;targos@protonmail.com&gt; (he/him)
-* [thefourtheye](https://github.com/thefourtheye) -
-**Sakthipriyan Vairamani** &lt;thechargingvolcano@gmail.com&gt; (he/him)
-* [thekemkid](https://github.com/thekemkid) -
-**Glen Keane** &lt;glenkeane.94@gmail.com&gt; (he/him)
-* [thlorenz](https://github.com/thlorenz) -
-**Thorsten Lorenz** &lt;thlorenz@gmx.de&gt;
-* [TimothyGu](https://github.com/TimothyGu) -
-**Tiancheng "Timothy" Gu** &lt;timothygu99@gmail.com&gt; (he/him)
-* [tniessen](https://github.com/tniessen) -
-**Tobias Nießen** &lt;tniessen@tnie.de&gt;
-* [trevnorris](https://github.com/trevnorris) -
-**Trevor Norris** &lt;trev.norris@gmail.com&gt;
-* [trivikr](https://github.com/trivikr) -
-**Trivikram Kamat** &lt;trivikr.dev@gmail.com&gt;
-* [Trott](https://github.com/Trott) -
-**Rich Trott** &lt;rtrott@gmail.com&gt; (he/him)
-* [vdeturckheim](https://github.com/vdeturckheim) -
-**Vladimir de Turckheim** &lt;vlad2t@hotmail.com&gt; (he/him)
-* [vkurchatkin](https://github.com/vkurchatkin) -
-**Vladimir Kurchatkin** &lt;vladimir.kurchatkin@gmail.com&gt;
-* [vsemozhetbyt](https://github.com/vsemozhetbyt) -
-**Vse Mozhet Byt** &lt;vsemozhetbyt@gmail.com&gt; (he/him)
-* [watilde](https://github.com/watilde) -
-**Daijiro Wachi** &lt;daijiro.wachi@gmail.com&gt; (he/him)
-* [watson](https://github.com/watson) -
-**Thomas Watson** &lt;w@tson.dk&gt;
-* [whitlockjc](https://github.com/whitlockjc) -
-**Jeremy Whitlock** &lt;jwhitlock@apache.org&gt;
-* [XadillaX](https://github.com/XadillaX) -
-**Khaidi Chu** &lt;i@2333.moe&gt; (he/him)
-* [yhwang](https://github.com/yhwang) -
-**Yihong Wang** &lt;yh.wang@ibm.com&gt;
-* [yorkie](https://github.com/yorkie) -
-**Yorkie Liu** &lt;yorkiefixer@gmail.com&gt;
-* [yosuke-furukawa](https://github.com/yosuke-furukawa) -
-**Yosuke Furukawa** &lt;yosuke.furukawa@gmail.com&gt;
-
-### Collaborator Emeriti
-
-* [imran-iq](https://github.com/imran-iq) -
-**Imran Iqbal** &lt;imran@imraniqbal.org&gt;
-* [isaacs](https://github.com/isaacs) -
-**Isaac Z. Schlueter** &lt;i@izs.me&gt;
-* [lxe](https://github.com/lxe) -
-**Aleksey Smolenchuk** &lt;lxe@lxe.co&gt;
-* [matthewloring](https://github.com/matthewloring) -
-**Matthew Loring** &lt;mattloring@google.com&gt;
-* [micnic](https://github.com/micnic) -
-**Nicu Micleușanu** &lt;micnic90@gmail.com&gt; (he/him)
-* [mikeal](https://github.com/mikeal) -
-**Mikeal Rogers** &lt;mikeal.rogers@gmail.com&gt;
-* [monsanto](https://github.com/monsanto) -
-**Christopher Monsanto** &lt;chris@monsan.to&gt;
-* [Olegas](https://github.com/Olegas) -
-**Oleg Elifantiev** &lt;oleg@elifantiev.ru&gt;
-* [petkaantonov](https://github.com/petkaantonov) -
-**Petka Antonov** &lt;petka_antonov@hotmail.com&gt;
-* [piscisaureus](https://github.com/piscisaureus) -
-**Bert Belder** &lt;bertbelder@gmail.com&gt;
-* [rlidwka](https://github.com/rlidwka) -
-**Alex Kocharin** &lt;alex@kocharin.ru&gt;
-* [rmg](https://github.com/rmg) -
-**Ryan Graham** &lt;r.m.graham@gmail.com&gt;
-* [robertkowalski](https://github.com/robertkowalski) -
-**Robert Kowalski** &lt;rok@kowalski.gd&gt;
-* [romankl](https://github.com/romankl) -
-**Roman Klauke** &lt;romaaan.git@gmail.com&gt;
-* [tellnes](https://github.com/tellnes) -
-**Christian Tellnes** &lt;christian@tellnes.no&gt;
-* [tunniclm](https://github.com/tunniclm) -
-**Mike Tunnicliffe** &lt;m.j.tunnicliffe@gmail.com&gt;
-
-Collaborators follow the [COLLABORATOR_GUIDE.md](./COLLABORATOR_GUIDE.md) in
-maintaining the Node.js project.
-
-### Release Team
-
-Node.js releases are signed with one of the following GPG keys:
-
-* **Colin Ihrig** &lt;cjihrig@gmail.com&gt;
-`94AE36675C464D64BAFA68DD7434390BDBE9B9C5`
-* **Evan Lucas** &lt;evanlucas@me.com&gt;
-`B9AE9905FFD7803F25714661B63B535A4C206CA9`
-* **Gibson Fahnestock** &lt;gibfahn@gmail.com&gt;
-`77984A986EBC2AA786BC0F66B01FBB92821C587A`
-* **James M Snell** &lt;jasnell@keybase.io&gt;
-`71DCFD284A79C3B38668286BC97EC7A07EDE3FC1`
-* **Jeremiah Senkpiel** &lt;fishrock@keybase.io&gt;
-`FD3A5288F042B6850C66B31F09FE44734EB7990E`
-* **Michaël Zasso** &lt;targos@protonmail.com&gt;
-`8FCCA13FEF1D0C2E91008E09770F7A9A5AE15600`
-* **Myles Borins** &lt;myles.borins@gmail.com&gt;
-`C4F0DFFF4E8C1A8236409D08E73BC641CC11F4C8`
-* **Rod Vagg** &lt;rod@vagg.org&gt;
-`DD8F2338BAE7501E3DD5AC78C273792F7D83545D`
-
-The full set of trusted release keys can be imported by running:
-
-```shell
-gpg --keyserver pool.sks-keyservers.net --recv-keys 94AE36675C464D64BAFA68DD7434390BDBE9B9C5
-gpg --keyserver pool.sks-keyservers.net --recv-keys B9AE9905FFD7803F25714661B63B535A4C206CA9
-gpg --keyserver pool.sks-keyservers.net --recv-keys 77984A986EBC2AA786BC0F66B01FBB92821C587A
-gpg --keyserver pool.sks-keyservers.net --recv-keys 71DCFD284A79C3B38668286BC97EC7A07EDE3FC1
-gpg --keyserver pool.sks-keyservers.net --recv-keys FD3A5288F042B6850C66B31F09FE44734EB7990E
-gpg --keyserver pool.sks-keyservers.net --recv-keys 8FCCA13FEF1D0C2E91008E09770F7A9A5AE15600
-gpg --keyserver pool.sks-keyservers.net --recv-keys C4F0DFFF4E8C1A8236409D08E73BC641CC11F4C8
-gpg --keyserver pool.sks-keyservers.net --recv-keys DD8F2338BAE7501E3DD5AC78C273792F7D83545D
+node -e "console.log(process.versions.v8)"
 ```
-
-See the section above on [Verifying Binaries](#verifying-binaries) for details
-on what to do with these keys to verify that a downloaded file is official.
-
-Previous releases may also have been signed with one of the following GPG keys:
-
-* **Chris Dickinson** &lt;christopher.s.dickinson@gmail.com&gt;
-`9554F04D7259F04124DE6B476D5A82AC7E37093B`
-* **Isaac Z. Schlueter** &lt;i@izs.me&gt;
-`93C7E9E91B49E432C2F75674B0A78B0A6C481CF6`
-* **Italo A. Casas** &lt;me@italoacasas.com&gt;
-`56730D5401028683275BD23C23EFEFE93C4CFFFE`
-* **Julien Gilli** &lt;jgilli@fastmail.fm&gt;
-`114F43EE0176B71C7BC219DD50A3051F888C628D`
-* **Timothy J Fontaine** &lt;tjfontaine@gmail.com&gt;
-`7937DFD2AB06298B2293C3187D33FF9D0246406D`
-
-## Contributing to Node.js
-
-* [Contributing to the project][]
-* [Working Groups][]
-* [Strategic Initiatives][]
-
-[Code of Conduct]: https://github.com/nodejs/admin/blob/master/CODE_OF_CONDUCT.md
-[Contributing to the project]: CONTRIBUTING.md
-[Node.js Help]: https://github.com/nodejs/help
-[Node.js Website]: https://nodejs.org/en/
-[Questions tagged 'node.js' on StackOverflow]: https://stackoverflow.com/questions/tagged/node.js
-[Working Groups]: https://github.com/nodejs/TSC/blob/master/WORKING_GROUPS.md
-[Strategic Initiatives]: https://github.com/nodejs/TSC/blob/master/Strategic-Initiatives.md
-[#node.js channel on chat.freenode.net]: https://webchat.freenode.net?channels=node.js&uio=d4

From 8fcc375b20f5d05c662713ad62053f66a7f2a4f1 Mon Sep 17 00:00:00 2001
From: Sergiy Byelozyorov <sergiyb@chromium.org>
Date: Tue, 14 Nov 2017 17:10:23 +0100
Subject: [PATCH 03/28] node-gyp: support for Chromium versions of Python

---
 deps/npm/node_modules/node-gyp/lib/configure.js | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/deps/npm/node_modules/node-gyp/lib/configure.js b/deps/npm/node_modules/node-gyp/lib/configure.js
index 1351576d12e8c8..e297e98d726a38 100644
--- a/deps/npm/node_modules/node-gyp/lib/configure.js
+++ b/deps/npm/node_modules/node-gyp/lib/configure.js
@@ -459,6 +459,10 @@ PythonFinder.prototype = {
         this.log.silly('stripping "rc" identifier from version')
         version = version.replace(/rc(.*)$/ig, '')
       }
+      if (~version.indexOf('chromium')) {
+        this.log.silly('stripping "chromium" identifier from version')
+        version = version.replace(/chromium(.*)$/ig, '')
+      }
       var range = semver.Range('>=2.5.0 <3.0.0')
       var valid = false
       try {

From 8076a08e49bb8df7b0cf95e538b64e0307492b4e Mon Sep 17 00:00:00 2001
From: Andrew Grieve <agrieve@chromium.org>
Date: Tue, 17 Apr 2018 15:25:19 +0200
Subject: [PATCH 04/28] Enhancements to --build-v8-with-gn

* Split "gn gen" and "ninja" invocations into two separate actions
* Make the ninja action use console pool so that progress is shown
* Set DEPOT_TOOLS_WIN_TOOLCHAIN=0 by default (to avoid non-googlers
being asked for credentials)
* Propagate depot_tools path to "gn gen" step (it runs vs_toolchain.py)
* Add flags for clang-cl, setting gn args, sub-ninja -j and -l parameters
---
 configure                          | 56 +++++++++++++++++++++++++++-
 deps/v8/gypfiles/v8-monolithic.gyp | 59 +++++++++++++++++++++++++++---
 2 files changed, 108 insertions(+), 7 deletions(-)

diff --git a/configure b/configure
index 094d8e09f745d9..9547f5973da7b6 100755
--- a/configure
+++ b/configure
@@ -561,6 +561,29 @@ parser.add_option('--build-v8-with-gn',
     dest='build_v8_with_gn',
     default=False,
     help='build V8 using GN instead of gyp')
+parser.add_option('--build-v8-with-gn-max-jobs',
+    dest='build_v8_with_gn_max_jobs',
+    default='',
+    help='Value for the -j parameter for the ninja invocation.')
+parser.add_option('--build-v8-with-gn-max-load',
+    dest='build_v8_with_gn_max_load',
+    default='',
+    help='Value for the -l parameter for the ninja invocation.')
+parser.add_option('--build-v8-with-gn-extra-gn-args',
+    dest='build_v8_with_gn_extra_gn_args',
+    default='',
+    help='Extra gn args to pass add to the "gn gen --args "..." invocation')
+parser.add_option('--use-clang-cl',
+    action='store_true',
+    dest='use_clang_cl',
+    default=False,
+    help='On Windows, build using clang-cl. By default, uses the copy of '
+         'clang-cl that is bundled with V8. Requires --ninja.')
+parser.add_option('--clang-cl-base-path',
+    dest='clang_cl_base_path',
+    help='Absolute path to a directory containing a bin\\clang-cl.exe '
+         '(requires --use-clang-cl).')
+
 
 # Create compile_commands.json in out/Debug and out/Release.
 parser.add_option('-C',
@@ -590,6 +613,22 @@ def warn(msg):
 # track if warnings occurred
 warn.warned = False
 
+if options.use_clang_cl:
+  if not options.use_ninja:
+    warn('--use-clang-cl requires --ninja')
+  if options.clang_cl_base_path:
+    clang_base_path = options.clang_cl_base_path
+  else:
+    clang_base_path = os.path.abspath(os.path.join(
+        'deps', 'v8', 'third_party', 'llvm-build', 'Release+Asserts'))
+  # CC sets the path for GYP-compiled files.
+  os.environ['CC'] = os.path.join(clang_base_path, 'bin', 'clang-cl.exe')
+  # GN arg sets the path for --build-v8-using-gn.
+  if options.build_v8_with_gn_extra_gn_args:
+    options.build_v8_with_gn_extra_gn_args += ' '
+  options.build_v8_with_gn_extra_gn_args += 'clang_base_path="{}"'.format(
+      clang_base_path)
+
 def b(value):
   """Returns the string 'true' if value is truthy, 'false' otherwise."""
   if value:
@@ -1077,11 +1116,24 @@ def configure_v8(o):
   if options.without_bundled_v8 and options.build_v8_with_gn:
     raise Exception(
         '--build-v8-with-gn is incompatible with --without-bundled-v8.')
+  o['variables']['build_v8_with_gn'] = b(options.build_v8_with_gn)
   if options.build_v8_with_gn:
     v8_path = os.path.join('deps', 'v8')
     print('Fetching dependencies to build V8 with GN')
-    options.build_v8_with_gn = FetchDeps(v8_path)
-  o['variables']['build_v8_with_gn'] = b(options.build_v8_with_gn)
+    # Default to non-Googler configuration.
+    if 'DEPOT_TOOLS_WIN_TOOLCHAIN' not in os.environ:
+      os.environ['DEPOT_TOOLS_WIN_TOOLCHAIN'] = '0'
+    depot_tools = FetchDeps(v8_path)
+
+    o['variables']['build_v8_with_gn_extra_gn_args'] = (
+        options.build_v8_with_gn_extra_gn_args)
+    o['variables']['build_v8_with_gn_max_jobs'] = (
+        options.build_v8_with_gn_max_jobs)
+    o['variables']['build_v8_with_gn_max_load'] = (
+        options.build_v8_with_gn_max_load)
+    o['variables']['build_v8_with_gn_bundled_win_toolchain'] = (
+        os.environ['DEPOT_TOOLS_WIN_TOOLCHAIN'])
+    o['variables']['build_v8_with_gn_depot_tools'] = depot_tools
 
 
 def configure_openssl(o):
diff --git a/deps/v8/gypfiles/v8-monolithic.gyp b/deps/v8/gypfiles/v8-monolithic.gyp
index b5ca0ad150b7a6..25ba42ba516dbf 100644
--- a/deps/v8/gypfiles/v8-monolithic.gyp
+++ b/deps/v8/gypfiles/v8-monolithic.gyp
@@ -26,16 +26,19 @@
       },
       'actions': [
         {
-          'action_name': 'build_with_gn',
+          'action_name': 'build_with_gn_generate_build_files',
+          # No need to list full set of inputs because after the initial
+          # generation, ninja (run by the next action), will check to see
+          # if build.ninja is stale.
           'inputs': [
-            '../tools//node/build_gn.py',
+            '../tools/node/build_gn.py',
           ],
           'outputs': [
-            '<(INTERMEDIATE_DIR)/gn/obj/libv8_monolith.a',
-            '<(INTERMEDIATE_DIR)/gn/args.gn',
+            '<(INTERMEDIATE_DIR)/gn/build.ninja',
           ],
           'action': [
-            '../tools//node/build_gn.py',
+            'python',
+            '../tools/node/build_gn.py',
             '--mode', '<(CONFIGURATION_NAME)',
             '--v8_path', '../',
             '--build_path', '<(INTERMEDIATE_DIR)/gn',
@@ -49,7 +52,53 @@
             '--flag', 'v8_optimized_debug=<(v8_optimized_debug)',
             '--flag', 'v8_enable_disassembler=<(v8_enable_disassembler)',
             '--flag', 'v8_postmortem_support=<(v8_postmortem_support)',
+            '--bundled-win-toolchain', '<(build_v8_with_gn_bundled_win_toolchain)',
+            '--depot-tools', '<(build_v8_with_gn_depot_tools)',
+          ],
+          'conditions': [
+            ['build_v8_with_gn_extra_gn_args != ""', {
+              'action': [
+                '--extra-gn-args', '<(build_v8_with_gn_extra_gn_args)',
+              ],
+            }],
+          ],
+        },
+        {
+          'action_name': 'build_with_gn',
+          'inputs': [
+            '../tools/node/build_gn.py',
+            '<(INTERMEDIATE_DIR)/gn/build.ninja',
+          ],
+          # Specify a non-existent output to make the target permanently dirty.
+          # Alternatively, a depfile could be used, but then two dirty checks
+          # would run: one by the outer build tool, and one by build_gn.py.
+          'outputs': [
+            '<(v8_base)',
+            'does-not-exist',
+          ],
+          'action': [
+            'python',
+            '../tools/node/build_gn.py',
+            '--build_path', '<(INTERMEDIATE_DIR)/gn',
+            '--v8_path', '../',
+            '--bundled-win-toolchain', '<(build_v8_with_gn_bundled_win_toolchain)',
+            '--depot-tools', '<(build_v8_with_gn_depot_tools)',
+            '--build',
+          ],
+          'conditions': [
+            ['build_v8_with_gn_max_jobs!=""', {
+              'action': [
+                '--max-jobs', '<(build_v8_with_gn_max_jobs)',
+              ],
+            }],
+            ['build_v8_with_gn_max_load!=""', {
+              'action': [
+                '--max-load', '<(build_v8_with_gn_max_load)',
+              ],
+            }],
           ],
+          # Allows sub-ninja's build progress to be printed.
+          'ninja_use_console': 1,
         },
       ],
     },

From 49c10f51b67abee0c901986a49161ebf24362e55 Mon Sep 17 00:00:00 2001
From: Andrew Grieve <agrieve@chromium.org>
Date: Tue, 17 Apr 2018 15:34:49 +0200
Subject: [PATCH 05/28] Fix ninja builds on Windows

 * Fixed several hardcoded paths to use <(STATIC_LIB_PREFIX) &
   <(STATIC_LIB_SUFFIX)
 * Added GENERATOR=='ninja' conditionals to /WHOLEARCHIVE flags (msbuild
   puts .lib files under separate directories).
 * Add missing link_settings for v8_monolith
 * Set use_sysroot=false only for non-windows builds.

To build using clang-cl:
    python configure --build-v8-with-gn --use-clang-cl --ninja
---
 common.gypi                        |  4 +--
 configure                          |  1 -
 deps/v8/gypfiles/v8-monolithic.gyp | 10 ++++++
 node.gyp                           | 15 ++++++--
 node.gypi                          | 56 ++++++++++++++++++++++++------
 5 files changed, 69 insertions(+), 17 deletions(-)

diff --git a/common.gypi b/common.gypi
index 65eb7caf575498..ae957786d43466 100644
--- a/common.gypi
+++ b/common.gypi
@@ -77,9 +77,9 @@
       ['build_v8_with_gn == "true"', {
         'conditions': [
           ['GENERATOR == "ninja"', {
-            'v8_base': '<(PRODUCT_DIR)/obj/deps/v8/gypfiles/v8_monolith.gen/gn/obj/libv8_monolith.a',
+            'v8_base': '<(PRODUCT_DIR)/obj/deps/v8/gypfiles/v8_monolith.gen/gn/obj/<(STATIC_LIB_PREFIX)v8_monolith<(STATIC_LIB_SUFFIX)',
           }, {
-            'v8_base': '<(PRODUCT_DIR)/obj.target/v8_monolith/geni/gn/obj/libv8_monolith.a',
+            'v8_base': '<(PRODUCT_DIR)/obj.target/v8_monolith/geni/gn/obj/<(STATIC_LIB_PREFIX)v8_monolith<(STATIC_LIB_SUFFIX)',
           }],
         ],
       }],
diff --git a/configure b/configure
index 9547f5973da7b6..1e4b6ba75308b7 100755
--- a/configure
+++ b/configure
@@ -584,7 +584,6 @@ parser.add_option('--clang-cl-base-path',
     help='Absolute path to a directory containing a bin\\clang-cl.exe '
          '(requires --use-clang-cl).')
 
-
 # Create compile_commands.json in out/Debug and out/Release.
 parser.add_option('-C',
     action='store_true',
diff --git a/deps/v8/gypfiles/v8-monolithic.gyp b/deps/v8/gypfiles/v8-monolithic.gyp
index 25ba42ba516dbf..a93e00752b2120 100644
--- a/deps/v8/gypfiles/v8-monolithic.gyp
+++ b/deps/v8/gypfiles/v8-monolithic.gyp
@@ -23,6 +23,16 @@
         'include_dirs': [
           '../include/',
         ],
+        'link_settings': {
+          'conditions': [
+            ['OS=="win"', {
+              'libraries': ['-ldbghelp.lib', '-lshlwapi.lib', '-lwinmm.lib', '-lws2_32.lib'],
+            }],
+            ['OS=="linux"', {
+              'libraries': ['-ldl', '-lrt'],
+            }],
+          ],
+        },
       },
       'actions': [
         {
diff --git a/node.gyp b/node.gyp
index 4b6bc4c108cfb5..566b2a226325ca 100644
--- a/node.gyp
+++ b/node.gyp
@@ -256,9 +256,18 @@
           },
           'msvs_settings': {
             'VCLinkerTool': {
-              'AdditionalOptions': [
-                '/WHOLEARCHIVE:<(PRODUCT_DIR)\\lib\\'
-                    '<(node_core_target_name)<(STATIC_LIB_SUFFIX)',
+              'conditions': [
+                ['GENERATOR=="ninja"', {
+                  'AdditionalOptions': [
+                    '/WHOLEARCHIVE:<(obj_dir)\\<(STATIC_LIB_PREFIX)'
+                        '<(node_core_target_name)<(STATIC_LIB_SUFFIX)',
+                  ],
+                }, {
+                  'AdditionalOptions': [
+                    '/WHOLEARCHIVE:<(LIB_DIR)\\<(STATIC_LIB_PREFIX)'
+                        '<(node_core_target_name)<(STATIC_LIB_SUFFIX)',
+                  ],
+                }],
               ],
             },
           },
diff --git a/node.gypi b/node.gypi
index acd9f83213021d..fa4afc9695c475 100644
--- a/node.gypi
+++ b/node.gypi
@@ -140,8 +140,16 @@
           },
           'msvs_settings': {
             'VCLinkerTool': {
-              'AdditionalOptions': [
-                '/WHOLEARCHIVE:<(PRODUCT_DIR)\\lib\\zlib<(STATIC_LIB_SUFFIX)',
+              'conditions': [
+                ['GENERATOR=="ninja"', {
+                  'AdditionalOptions': [
+                    '/WHOLEARCHIVE:<(obj_dir)\\deps\\zlib\\<(STATIC_LIB_PREFIX)zlib<(STATIC_LIB_SUFFIX)',
+                  ],
+                }, {
+                  'AdditionalOptions': [
+                    '/WHOLEARCHIVE:<(LIB_DIR)\\<(STATIC_LIB_PREFIX)zlib<(STATIC_LIB_SUFFIX)',
+                  ],
+                }],
               ],
             },
           },
@@ -178,8 +186,16 @@
           },
           'msvs_settings': {
             'VCLinkerTool': {
-              'AdditionalOptions': [
-                '/WHOLEARCHIVE:<(PRODUCT_DIR)\\lib\\libuv<(STATIC_LIB_SUFFIX)',
+              'conditions': [
+                ['GENERATOR=="ninja"', {
+                  'AdditionalOptions': [
+                    '/WHOLEARCHIVE:<(obj_dir)\\deps\\uv\\<(STATIC_LIB_PREFIX)libuv<(STATIC_LIB_SUFFIX)',
+                  ],
+                }, {
+                  'AdditionalOptions': [
+                    '/WHOLEARCHIVE:<(LIB_DIR)\\<(STATIC_LIB_PREFIX)libuv<(STATIC_LIB_SUFFIX)',
+                  ],
+                }],
               ],
             },
           },
@@ -258,11 +274,21 @@
         'NODE_PLATFORM="sunos"',
       ],
     }],
-    [ '(OS=="freebsd" or OS=="linux") and node_shared=="false"'
-        ' and force_load=="true"', {
-      'ldflags': [ '-Wl,-z,noexecstack',
-                   '-Wl,--whole-archive <(v8_base)',
-                   '-Wl,--no-whole-archive' ]
+    [ 'node_shared=="false" and force_load=="true"', {
+      'msvs_settings': {
+        'VCLinkerTool': {
+          'AdditionalOptions': [
+            '/WHOLEARCHIVE:<(v8_base)',
+          ],
+        },
+      },
+      'conditions': [
+        ['OS=="freebsd" or OS=="linux"', {
+          'ldflags': [ '-Wl,-z,noexecstack',
+                       '-Wl,--whole-archive <(v8_base)',
+                       '-Wl,--no-whole-archive' ],
+        }],
+      ],
     }],
     [ 'OS in "mac freebsd linux" and node_shared=="false"'
         ' and coverage=="true"', {
@@ -315,8 +341,16 @@
               },
               'msvs_settings': {
                 'VCLinkerTool': {
-                  'AdditionalOptions': [
-                    '/WHOLEARCHIVE:<(PRODUCT_DIR)\\lib\\<(openssl_product)',
+                  'conditions': [
+                    ['GENERATOR=="ninja"', {
+                      'AdditionalOptions': [
+                        '/WHOLEARCHIVE:<(obj_dir)\\deps\\openssl\\<(STATIC_LIB_PREFIX)<(openssl_product)',
+                      ],
+                    }, {
+                      'AdditionalOptions': [
+                        '/WHOLEARCHIVE:<(LIB_DIR)\\<(STATIC_LIB_PREFIX)<(openssl_product)',
+                      ],
+                    }],
                   ],
                 },
               },

From 124650a5496d89fa09a57ebeec580cbbbf3e2f3c Mon Sep 17 00:00:00 2001
From: Andrew Grieve <agrieve@chromium.org>
Date: Wed, 25 Apr 2018 15:15:06 +0200
Subject: [PATCH 06/28] Properly convert .gypi -> .json in js2c.py

It was breaking when .gypi strings had quotes in them. e.g.:
  'foo': 'bar="baz"'
---
 tools/js2c.py | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/tools/js2c.py b/tools/js2c.py
index 249df58085dd96..ada94eac2ca418 100755
--- a/tools/js2c.py
+++ b/tools/js2c.py
@@ -31,6 +31,8 @@
 # char arrays. It is used for embedded JavaScript code in the V8
 # library.
 
+import ast
+import json
 import os
 import re
 import sys
@@ -300,11 +302,11 @@ def JS2C(source, target):
         split = split[1:]
       name = '/'.join(split)
 
-    # if its a gypi file we're going to want it as json
-    # later on anyway, so get it out of the way now
+    # Convert gypi to json. This means line number will not match up to the
+    # original file, but is equired to properly escape strings.
     if name.endswith(".gypi"):
-      lines = re.sub(r'#.*?\n', '', lines)
-      lines = re.sub(r'\'', '"', lines)
+      obj = ast.literal_eval(lines)
+      lines = json.dumps(obj, indent=2)
     name = name.split('.', 1)[0]
     var = name.replace('-', '_').replace('/', '_')
     key = '%s_key' % var

From fd66b85770b8285ed4a99edc4bb8bc3d0c7218bf Mon Sep 17 00:00:00 2001
From: Andrew Grieve <agrieve@chromium.org>
Date: Wed, 25 Apr 2018 15:18:33 +0200
Subject: [PATCH 07/28] Fix --use-clang-cl flag.

It needed to be passed via "make_global_settings" rather than
environment variable.
---
 configure | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/configure b/configure
index 1e4b6ba75308b7..b127dd9737a9e4 100755
--- a/configure
+++ b/configure
@@ -620,8 +620,6 @@ if options.use_clang_cl:
   else:
     clang_base_path = os.path.abspath(os.path.join(
         'deps', 'v8', 'third_party', 'llvm-build', 'Release+Asserts'))
-  # CC sets the path for GYP-compiled files.
-  os.environ['CC'] = os.path.join(clang_base_path, 'bin', 'clang-cl.exe')
   # GN arg sets the path for --build-v8-using-gn.
   if options.build_v8_with_gn_extra_gn_args:
     options.build_v8_with_gn_extra_gn_args += ' '
@@ -1565,6 +1563,11 @@ if 'make_fips_settings' in output:
   write('config_fips.gypi', do_not_edit +
         pprint.pformat(config_fips, indent=2) + '\n')
 
+if options.use_clang_cl:
+  make_global_settings = output.setdefault('make_global_settings', [])
+  make_global_settings.append(
+      ['CC', os.path.join(clang_base_path, 'bin', 'clang-cl')])
+
 # make_global_settings should be a root level element too
 if 'make_global_settings' in output:
   make_global_settings = output['make_global_settings']

From 05d782b9011a0f8324d669b45a369046d040af6d Mon Sep 17 00:00:00 2001
From: Andrew Grieve <agrieve@chromium.org>
Date: Wed, 25 Apr 2018 16:12:11 +0200
Subject: [PATCH 08/28] Forward DEPOT_TOOLS_WIN_TOOLCHAIN_ROOT

---
 configure                          | 4 +++-
 deps/v8/gypfiles/v8-monolithic.gyp | 5 +++++
 2 files changed, 8 insertions(+), 1 deletion(-)

diff --git a/configure b/configure
index b127dd9737a9e4..ce451ffb90c7b6 100755
--- a/configure
+++ b/configure
@@ -1129,7 +1129,9 @@ def configure_v8(o):
     o['variables']['build_v8_with_gn_max_load'] = (
         options.build_v8_with_gn_max_load)
     o['variables']['build_v8_with_gn_bundled_win_toolchain'] = (
-        os.environ['DEPOT_TOOLS_WIN_TOOLCHAIN'])
+        os.environ.get('DEPOT_TOOLS_WIN_TOOLCHAIN', ''))
+    o['variables']['build_v8_with_gn_bundled_win_toolchain_root'] = (
+        os.environ.get('DEPOT_TOOLS_WIN_TOOLCHAIN_ROOT', ''))
     o['variables']['build_v8_with_gn_depot_tools'] = depot_tools
 
 
diff --git a/deps/v8/gypfiles/v8-monolithic.gyp b/deps/v8/gypfiles/v8-monolithic.gyp
index a93e00752b2120..c61f838b9b2b94 100644
--- a/deps/v8/gypfiles/v8-monolithic.gyp
+++ b/deps/v8/gypfiles/v8-monolithic.gyp
@@ -71,6 +71,11 @@
                 '--extra-gn-args', '<(build_v8_with_gn_extra_gn_args)',
               ],
             }],
+            ['build_v8_with_gn_bundled_win_toolchain_root != ""', {
+              'action': [
+                '--bundled-win-toolchain-root', '<(build_v8_with_gn_bundled_win_toolchain_root)',
+              ],
+            }],
           ],
         },
         {

From 570fd7eb862c01c6966f96c747c69bf3af722969 Mon Sep 17 00:00:00 2001
From: Michael Achenbach <machenbach@chromium.org>
Date: Mon, 30 Apr 2018 14:08:28 +0200
Subject: [PATCH 09/28] tools: properly convert .gypi in install.py

It was breaking during install when .gypi strings had quotes in
them. e.g.: 'foo': 'bar="baz"'
---
 tools/install.py | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/tools/install.py b/tools/install.py
index 2aeed773bb08b3..ce9ceeee1dd578 100755
--- a/tools/install.py
+++ b/tools/install.py
@@ -1,7 +1,7 @@
 #!/usr/bin/env python
 
+import ast
 import errno
-import json
 import os
 import re
 import shutil
@@ -20,9 +20,7 @@ def abspath(*args):
 
 def load_config():
   s = open('config.gypi').read()
-  s = re.sub(r'#.*?\n', '', s) # strip comments
-  s = re.sub(r'\'', '"', s) # convert quotes
-  return json.loads(s)
+  return ast.literal_eval(s)
 
 def try_unlink(path):
   try:

From 427afa478a14e161fdb5ac0d011d46d10c5041f5 Mon Sep 17 00:00:00 2001
From: Yang Guo <yangguo@chromium.org>
Date: Wed, 11 Jul 2018 08:50:18 +0200
Subject: [PATCH 10/28] Fix configure for build_v8_with_gn_depot_tools

---
 configure | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/configure b/configure
index ce451ffb90c7b6..ae6cc12ca94668 100755
--- a/configure
+++ b/configure
@@ -1132,7 +1132,7 @@ def configure_v8(o):
         os.environ.get('DEPOT_TOOLS_WIN_TOOLCHAIN', ''))
     o['variables']['build_v8_with_gn_bundled_win_toolchain_root'] = (
         os.environ.get('DEPOT_TOOLS_WIN_TOOLCHAIN_ROOT', ''))
-    o['variables']['build_v8_with_gn_depot_tools'] = depot_tools
+    o['variables']['build_v8_with_gn_depot_tools'] = b(depot_tools)
 
 
 def configure_openssl(o):

From a2f9a4c315a314b42fc1a357f9e82d8c072fa3fd Mon Sep 17 00:00:00 2001
From: Yang Guo <yangguo@chromium.org>
Date: Mon, 7 May 2018 13:24:56 +0200
Subject: [PATCH 11/28] Fix tests failures and propagate
 untrusted-code-mitigations flag

---
 deps/v8/gypfiles/v8-monolithic.gyp | 1 +
 test/parallel/test-v8-stats.js     | 1 +
 2 files changed, 2 insertions(+)

diff --git a/deps/v8/gypfiles/v8-monolithic.gyp b/deps/v8/gypfiles/v8-monolithic.gyp
index c61f838b9b2b94..81cc397a1c53b8 100644
--- a/deps/v8/gypfiles/v8-monolithic.gyp
+++ b/deps/v8/gypfiles/v8-monolithic.gyp
@@ -62,6 +62,7 @@
             '--flag', 'v8_optimized_debug=<(v8_optimized_debug)',
             '--flag', 'v8_enable_disassembler=<(v8_enable_disassembler)',
             '--flag', 'v8_postmortem_support=<(v8_postmortem_support)',
+            '--flag', 'v8_untrusted_code_mitigations=<(v8_untrusted_code_mitigations)',
             '--bundled-win-toolchain', '<(build_v8_with_gn_bundled_win_toolchain)',
             '--depot-tools', '<(build_v8_with_gn_depot_tools)',
           ],
diff --git a/test/parallel/test-v8-stats.js b/test/parallel/test-v8-stats.js
index 83689afc974e12..d8bee55c2b4b8f 100644
--- a/test/parallel/test-v8-stats.js
+++ b/test/parallel/test-v8-stats.js
@@ -23,6 +23,7 @@ keys.forEach(function(key) {
 const expectedHeapSpaces = [
   'new_space',
   'old_space',
+  'read_only_space',
   'code_space',
   'map_space',
   'large_object_space',

From 0c5c2c0f768d1da9204051b56ebe51ef665ccd38 Mon Sep 17 00:00:00 2001
From: Gabriel Charette <gab@chromium.org>
Date: Wed, 9 May 2018 12:20:04 -0400
Subject: [PATCH 12/28] src: use modern v8::Platform worker threads APIs

Precursor to removing deprecated APIs on the v8 side @
https://chromium-review.googlesource.com/c/v8/v8/+/1045310
---
 src/node.cc          |  2 +-
 src/node.h           |  2 +-
 src/node_platform.cc | 76 ++++++++++++++++++++++----------------------
 src/node_platform.h  | 30 ++++++++---------
 src/node_worker.cc   |  4 +--
 5 files changed, 56 insertions(+), 58 deletions(-)

diff --git a/src/node.cc b/src/node.cc
index f9ac48c0770221..86e41205e05805 100644
--- a/src/node.cc
+++ b/src/node.cc
@@ -308,7 +308,7 @@ static struct {
   }
 
   void DrainVMTasks(Isolate* isolate) {
-    platform_->DrainBackgroundTasks(isolate);
+    platform_->DrainTasks(isolate);
   }
 
   void CancelVMTasks(Isolate* isolate) {
diff --git a/src/node.h b/src/node.h
index ed2c074b922687..b7cacb4bb50ba2 100644
--- a/src/node.h
+++ b/src/node.h
@@ -229,7 +229,7 @@ class MultiIsolatePlatform : public v8::Platform {
   // posted during flushing of the queue are postponed until the next
   // flushing.
   virtual bool FlushForegroundTasks(v8::Isolate* isolate) = 0;
-  virtual void DrainBackgroundTasks(v8::Isolate* isolate) = 0;
+  virtual void DrainTasks(v8::Isolate* isolate) = 0;
   virtual void CancelPendingDelayedTasks(v8::Isolate* isolate) = 0;
 
   // These will be called by the `IsolateData` creation/destruction functions.
diff --git a/src/node_platform.cc b/src/node_platform.cc
index 947622a219cdef..ce9117ae38e7ee 100644
--- a/src/node_platform.cc
+++ b/src/node_platform.cc
@@ -15,50 +15,52 @@ using v8::Platform;
 using v8::Task;
 using v8::TracingController;
 
-static void BackgroundRunner(void* data) {
+namespace {
+
+static void WorkerThreadMain(void* data) {
   TRACE_EVENT_METADATA1("__metadata", "thread_name", "name",
                         "BackgroundTaskRunner");
-  TaskQueue<Task> *background_tasks = static_cast<TaskQueue<Task> *>(data);
-  while (std::unique_ptr<Task> task = background_tasks->BlockingPop()) {
+  TaskQueue<Task>* pending_worker_tasks = static_cast<TaskQueue<Task>*>(data);
+  while (std::unique_ptr<Task> task = pending_worker_tasks->BlockingPop()) {
     task->Run();
-    background_tasks->NotifyOfCompletion();
+    pending_worker_tasks->NotifyOfCompletion();
   }
 }
 
-BackgroundTaskRunner::BackgroundTaskRunner(int thread_pool_size) {
+}  // namespace
+
+WorkerThreadsTaskRunner::WorkerThreadsTaskRunner(int thread_pool_size) {
   for (int i = 0; i < thread_pool_size; i++) {
     std::unique_ptr<uv_thread_t> t { new uv_thread_t() };
-    if (uv_thread_create(t.get(), BackgroundRunner, &background_tasks_) != 0)
+    if (uv_thread_create(t.get(), WorkerThreadMain,
+                         &pending_worker_tasks_) != 0) {
       break;
+    }
     threads_.push_back(std::move(t));
   }
 }
 
-void BackgroundTaskRunner::PostTask(std::unique_ptr<Task> task) {
-  background_tasks_.Push(std::move(task));
-}
-
-void BackgroundTaskRunner::PostIdleTask(std::unique_ptr<v8::IdleTask> task) {
-  UNREACHABLE();
+void WorkerThreadsTaskRunner::PostTask(std::unique_ptr<Task> task) {
+  pending_worker_tasks_.Push(std::move(task));
 }
 
-void BackgroundTaskRunner::PostDelayedTask(std::unique_ptr<v8::Task> task,
-                                           double delay_in_seconds) {
+void WorkerThreadsTaskRunner::PostDelayedTask(std::unique_ptr<v8::Task> task,
+                                              double delay_in_seconds) {
   UNREACHABLE();
 }
 
-void BackgroundTaskRunner::BlockingDrain() {
-  background_tasks_.BlockingDrain();
+void WorkerThreadsTaskRunner::BlockingDrain() {
+  pending_worker_tasks_.BlockingDrain();
 }
 
-void BackgroundTaskRunner::Shutdown() {
-  background_tasks_.Stop();
+void WorkerThreadsTaskRunner::Shutdown() {
+  pending_worker_tasks_.Stop();
   for (size_t i = 0; i < threads_.size(); i++) {
     CHECK_EQ(0, uv_thread_join(threads_[i].get()));
   }
 }
 
-size_t BackgroundTaskRunner::NumberOfAvailableBackgroundThreads() const {
+int WorkerThreadsTaskRunner::NumberOfWorkerThreads() const {
   return threads_.size();
 }
 
@@ -131,8 +133,8 @@ NodePlatform::NodePlatform(int thread_pool_size,
     TracingController* controller = new TracingController();
     tracing_controller_.reset(controller);
   }
-  background_task_runner_ =
-      std::make_shared<BackgroundTaskRunner>(thread_pool_size);
+  worker_thread_task_runner_ =
+      std::make_shared<WorkerThreadsTaskRunner>(thread_pool_size);
 }
 
 void NodePlatform::RegisterIsolate(IsolateData* isolate_data, uv_loop_t* loop) {
@@ -160,7 +162,7 @@ void NodePlatform::UnregisterIsolate(IsolateData* isolate_data) {
 }
 
 void NodePlatform::Shutdown() {
-  background_task_runner_->Shutdown();
+  worker_thread_task_runner_->Shutdown();
 
   {
     Mutex::ScopedLock lock(per_isolate_mutex_);
@@ -168,8 +170,8 @@ void NodePlatform::Shutdown() {
   }
 }
 
-size_t NodePlatform::NumberOfAvailableBackgroundThreads() {
-  return background_task_runner_->NumberOfAvailableBackgroundThreads();
+int NodePlatform::NumberOfWorkerThreads() {
+  return worker_thread_task_runner_->NumberOfWorkerThreads();
 }
 
 void PerIsolatePlatformData::RunForegroundTask(std::unique_ptr<Task> task) {
@@ -201,15 +203,12 @@ void PerIsolatePlatformData::CancelPendingDelayedTasks() {
   scheduled_delayed_tasks_.clear();
 }
 
-void NodePlatform::DrainBackgroundTasks(Isolate* isolate) {
+void NodePlatform::DrainTasks(Isolate* isolate) {
   std::shared_ptr<PerIsolatePlatformData> per_isolate = ForIsolate(isolate);
 
   do {
-    // Right now, there is no way to drain only background tasks associated
-    // with a specific isolate, so this sometimes does more work than
-    // necessary. In the long run, that functionality is probably going to
-    // be available anyway, though.
-    background_task_runner_->BlockingDrain();
+    // Worker tasks aren't associated with an Isolate.
+    worker_thread_task_runner_->BlockingDrain();
   } while (per_isolate->FlushForegroundTasksInternal());
 }
 
@@ -249,11 +248,17 @@ bool PerIsolatePlatformData::FlushForegroundTasksInternal() {
   return did_work;
 }
 
-void NodePlatform::CallOnBackgroundThread(Task* task,
-                                          ExpectedRuntime expected_runtime) {
-  background_task_runner_->PostTask(std::unique_ptr<Task>(task));
+void NodePlatform::CallOnWorkerThread(std::unique_ptr<v8::Task> task) {
+  worker_thread_task_runner_->PostTask(std::move(task));
 }
 
+void NodePlatform::CallDelayedOnWorkerThread(std::unique_ptr<v8::Task> task,
+                                             double delay_in_seconds) {
+  worker_thread_task_runner_->PostDelayedTask(std::move(task),
+                                              delay_in_seconds);
+}
+
+
 std::shared_ptr<PerIsolatePlatformData>
 NodePlatform::ForIsolate(Isolate* isolate) {
   Mutex::ScopedLock lock(per_isolate_mutex_);
@@ -283,11 +288,6 @@ void NodePlatform::CancelPendingDelayedTasks(v8::Isolate* isolate) {
 
 bool NodePlatform::IdleTasksEnabled(Isolate* isolate) { return false; }
 
-std::shared_ptr<v8::TaskRunner>
-NodePlatform::GetBackgroundTaskRunner(Isolate* isolate) {
-  return background_task_runner_;
-}
-
 std::shared_ptr<v8::TaskRunner>
 NodePlatform::GetForegroundTaskRunner(Isolate* isolate) {
   return ForIsolate(isolate);
diff --git a/src/node_platform.h b/src/node_platform.h
index 77826e057771b0..62301a302b22e0 100644
--- a/src/node_platform.h
+++ b/src/node_platform.h
@@ -93,23 +93,22 @@ class PerIsolatePlatformData :
   std::vector<DelayedTaskPointer> scheduled_delayed_tasks_;
 };
 
-// This acts as the single background task runner for all Isolates.
-class BackgroundTaskRunner : public v8::TaskRunner {
+// This acts as the single worker thread task runner for all Isolates.
+class WorkerThreadsTaskRunner {
  public:
-  explicit BackgroundTaskRunner(int thread_pool_size);
+  explicit WorkerThreadsTaskRunner(int thread_pool_size);
 
-  void PostTask(std::unique_ptr<v8::Task> task) override;
-  void PostIdleTask(std::unique_ptr<v8::IdleTask> task) override;
+  void PostTask(std::unique_ptr<v8::Task> task);
   void PostDelayedTask(std::unique_ptr<v8::Task> task,
-                       double delay_in_seconds) override;
-  bool IdleTasksEnabled() override { return false; };
+                       double delay_in_seconds);
 
   void BlockingDrain();
   void Shutdown();
 
-  size_t NumberOfAvailableBackgroundThreads() const;
+  int NumberOfWorkerThreads() const;
+
  private:
-  TaskQueue<v8::Task> background_tasks_;
+  TaskQueue<v8::Task> pending_worker_tasks_;
   std::vector<std::unique_ptr<uv_thread_t>> threads_;
 };
 
@@ -118,14 +117,15 @@ class NodePlatform : public MultiIsolatePlatform {
   NodePlatform(int thread_pool_size, v8::TracingController* tracing_controller);
   virtual ~NodePlatform() {}
 
-  void DrainBackgroundTasks(v8::Isolate* isolate) override;
+  void DrainTasks(v8::Isolate* isolate) override;
   void CancelPendingDelayedTasks(v8::Isolate* isolate) override;
   void Shutdown();
 
   // v8::Platform implementation.
-  size_t NumberOfAvailableBackgroundThreads() override;
-  void CallOnBackgroundThread(v8::Task* task,
-                              ExpectedRuntime expected_runtime) override;
+  int NumberOfWorkerThreads() override;
+  void CallOnWorkerThread(std::unique_ptr<v8::Task> task) override;
+  void CallDelayedOnWorkerThread(std::unique_ptr<v8::Task> task,
+                                 double delay_in_seconds) override;
   void CallOnForegroundThread(v8::Isolate* isolate, v8::Task* task) override;
   void CallDelayedOnForegroundThread(v8::Isolate* isolate, v8::Task* task,
                                      double delay_in_seconds) override;
@@ -138,8 +138,6 @@ class NodePlatform : public MultiIsolatePlatform {
   void RegisterIsolate(IsolateData* isolate_data, uv_loop_t* loop) override;
   void UnregisterIsolate(IsolateData* isolate_data) override;
 
-  std::shared_ptr<v8::TaskRunner> GetBackgroundTaskRunner(
-      v8::Isolate* isolate) override;
   std::shared_ptr<v8::TaskRunner> GetForegroundTaskRunner(
       v8::Isolate* isolate) override;
 
@@ -151,7 +149,7 @@ class NodePlatform : public MultiIsolatePlatform {
                      std::shared_ptr<PerIsolatePlatformData>> per_isolate_;
 
   std::unique_ptr<v8::TracingController> tracing_controller_;
-  std::shared_ptr<BackgroundTaskRunner> background_task_runner_;
+  std::shared_ptr<WorkerThreadsTaskRunner> worker_thread_task_runner_;
 };
 
 }  // namespace node
diff --git a/src/node_worker.cc b/src/node_worker.cc
index 6f325668b86921..ed6264063c9dab 100644
--- a/src/node_worker.cc
+++ b/src/node_worker.cc
@@ -173,7 +173,7 @@ void Worker::Run() {
           uv_run(&loop_, UV_RUN_DEFAULT);
           if (is_stopped()) break;
 
-          platform->DrainBackgroundTasks(isolate_);
+          platform->DrainTasks(isolate_);
 
           more = uv_loop_alive(&loop_);
           if (more && !is_stopped())
@@ -232,7 +232,7 @@ void Worker::Run() {
       // This call needs to be made while the `Environment` is still alive
       // because we assume that it is available for async tracking in the
       // NodePlatform implementation.
-      platform->DrainBackgroundTasks(isolate_);
+      platform->DrainTasks(isolate_);
     }
 
     env_.reset();

From 625d8433d4efd23b67fe66d21867da9b84760d63 Mon Sep 17 00:00:00 2001
From: Andreas Haas <ahaas@google.com>
Date: Sun, 3 Jun 2018 17:35:25 +0200
Subject: [PATCH 13/28] src: initialize PerIsolateData eagerly

---
 src/env.cc                      |  4 ++--
 src/node.cc                     | 12 +++++++++---
 src/node.h                      |  7 ++++---
 src/node_platform.cc            |  6 ++----
 src/node_platform.h             |  4 ++--
 src/node_worker.cc              |  5 +++--
 test/cctest/node_test_fixture.h |  3 +++
 7 files changed, 25 insertions(+), 16 deletions(-)

diff --git a/src/env.cc b/src/env.cc
index f940c18d16eceb..e857f6dfcd3d46 100644
--- a/src/env.cc
+++ b/src/env.cc
@@ -39,7 +39,7 @@ IsolateData::IsolateData(Isolate* isolate,
     zero_fill_field_(zero_fill_field),
     platform_(platform) {
   if (platform_ != nullptr)
-    platform_->RegisterIsolate(this, event_loop);
+    platform_->RegisterIsolate(isolate_, event_loop);
 
   // Create string and private symbol properties as internalized one byte
   // strings after the platform is properly initialized.
@@ -90,7 +90,7 @@ IsolateData::IsolateData(Isolate* isolate,
 
 IsolateData::~IsolateData() {
   if (platform_ != nullptr)
-    platform_->UnregisterIsolate(this);
+    platform_->UnregisterIsolate(isolate_);
 }
 
 
diff --git a/src/node.cc b/src/node.cc
index 86e41205e05805..044598a483eb7e 100644
--- a/src/node.cc
+++ b/src/node.cc
@@ -3621,17 +3621,22 @@ bool AllowWasmCodeGenerationCallback(
   return wasm_code_gen->IsUndefined() || wasm_code_gen->IsTrue();
 }
 
-Isolate* NewIsolate(ArrayBufferAllocator* allocator) {
+Isolate* NewIsolate(ArrayBufferAllocator* allocator, uv_loop_t* event_loop) {
   Isolate::CreateParams params;
   params.array_buffer_allocator = allocator;
 #ifdef NODE_ENABLE_VTUNE_PROFILING
   params.code_event_handler = vTune::GetVtuneCodeEventHandler();
 #endif
 
-  Isolate* isolate = Isolate::New(params);
+  Isolate* isolate = Isolate::Allocate();
   if (isolate == nullptr)
     return nullptr;
 
+  // Register the isolate on the platform before the isolate gets initialized,
+  // so that the isolate can access the platform during initialization.
+  v8_platform.Platform()->RegisterIsolate(isolate, event_loop);
+  Isolate::Initialize(isolate, params);
+
   isolate->AddMessageListener(OnMessage);
   isolate->SetAbortOnUncaughtExceptionCallback(ShouldAbortOnUncaughtException);
   isolate->SetMicrotasksPolicy(v8::MicrotasksPolicy::kExplicit);
@@ -3646,7 +3651,7 @@ inline int Start(uv_loop_t* event_loop,
                  int exec_argc, const char* const* exec_argv) {
   std::unique_ptr<ArrayBufferAllocator, decltype(&FreeArrayBufferAllocator)>
       allocator(CreateArrayBufferAllocator(), &FreeArrayBufferAllocator);
-  Isolate* const isolate = NewIsolate(allocator.get());
+  Isolate* const isolate = NewIsolate(allocator.get(), event_loop);
   if (isolate == nullptr)
     return 12;  // Signal internal error.
 
@@ -3682,6 +3687,7 @@ inline int Start(uv_loop_t* event_loop,
   }
 
   isolate->Dispose();
+  v8_platform.Platform()->UnregisterIsolate(isolate);
 
   return exit_code;
 }
diff --git a/src/node.h b/src/node.h
index b7cacb4bb50ba2..c7f6f569764755 100644
--- a/src/node.h
+++ b/src/node.h
@@ -233,13 +233,14 @@ class MultiIsolatePlatform : public v8::Platform {
   virtual void CancelPendingDelayedTasks(v8::Isolate* isolate) = 0;
 
   // These will be called by the `IsolateData` creation/destruction functions.
-  virtual void RegisterIsolate(IsolateData* isolate_data,
+  virtual void RegisterIsolate(v8::Isolate* isolate,
                                struct uv_loop_s* loop) = 0;
-  virtual void UnregisterIsolate(IsolateData* isolate_data) = 0;
+  virtual void UnregisterIsolate(v8::Isolate* isolate) = 0;
 };
 
 // Creates a new isolate with Node.js-specific settings.
-NODE_EXTERN v8::Isolate* NewIsolate(ArrayBufferAllocator* allocator);
+NODE_EXTERN v8::Isolate* NewIsolate(ArrayBufferAllocator* allocator,
+                                    struct uv_loop_s* event_loop);
 
 // Creates a new context with Node.js-specific tweaks.
 NODE_EXTERN v8::Local<v8::Context> NewContext(
diff --git a/src/node_platform.cc b/src/node_platform.cc
index ce9117ae38e7ee..52b19714e00b32 100644
--- a/src/node_platform.cc
+++ b/src/node_platform.cc
@@ -137,8 +137,7 @@ NodePlatform::NodePlatform(int thread_pool_size,
       std::make_shared<WorkerThreadsTaskRunner>(thread_pool_size);
 }
 
-void NodePlatform::RegisterIsolate(IsolateData* isolate_data, uv_loop_t* loop) {
-  Isolate* isolate = isolate_data->isolate();
+void NodePlatform::RegisterIsolate(Isolate* isolate, uv_loop_t* loop) {
   Mutex::ScopedLock lock(per_isolate_mutex_);
   std::shared_ptr<PerIsolatePlatformData> existing = per_isolate_[isolate];
   if (existing) {
@@ -150,8 +149,7 @@ void NodePlatform::RegisterIsolate(IsolateData* isolate_data, uv_loop_t* loop) {
   }
 }
 
-void NodePlatform::UnregisterIsolate(IsolateData* isolate_data) {
-  Isolate* isolate = isolate_data->isolate();
+void NodePlatform::UnregisterIsolate(Isolate* isolate) {
   Mutex::ScopedLock lock(per_isolate_mutex_);
   std::shared_ptr<PerIsolatePlatformData> existing = per_isolate_[isolate];
   CHECK(existing);
diff --git a/src/node_platform.h b/src/node_platform.h
index 62301a302b22e0..b0730c57f14536 100644
--- a/src/node_platform.h
+++ b/src/node_platform.h
@@ -135,8 +135,8 @@ class NodePlatform : public MultiIsolatePlatform {
   v8::TracingController* GetTracingController() override;
   bool FlushForegroundTasks(v8::Isolate* isolate) override;
 
-  void RegisterIsolate(IsolateData* isolate_data, uv_loop_t* loop) override;
-  void UnregisterIsolate(IsolateData* isolate_data) override;
+  void RegisterIsolate(v8::Isolate* isolate, uv_loop_t* loop) override;
+  void UnregisterIsolate(v8::Isolate* isolate) override;
 
   std::shared_ptr<v8::TaskRunner> GetForegroundTaskRunner(
       v8::Isolate* isolate) override;
diff --git a/src/node_worker.cc b/src/node_worker.cc
index ed6264063c9dab..af7b3d7ab92fa5 100644
--- a/src/node_worker.cc
+++ b/src/node_worker.cc
@@ -67,9 +67,9 @@ Worker::Worker(Environment* env, Local<Object> wrap)
 
   array_buffer_allocator_.reset(CreateArrayBufferAllocator());
 
-  isolate_ = NewIsolate(array_buffer_allocator_.get());
-  CHECK_NE(isolate_, nullptr);
   CHECK_EQ(uv_loop_init(&loop_), 0);
+  isolate_ = NewIsolate(array_buffer_allocator_.get(), &loop_);
+  CHECK_NE(isolate_, nullptr);
 
   thread_exit_async_.reset(new uv_async_t);
   thread_exit_async_->data = this;
@@ -263,6 +263,7 @@ void Worker::DisposeIsolate() {
   platform->CancelPendingDelayedTasks(isolate_);
 
   isolate_data_.reset();
+  platform->UnregisterIsolate(isolate_);
 
   isolate_->Dispose();
   isolate_ = nullptr;
diff --git a/test/cctest/node_test_fixture.h b/test/cctest/node_test_fixture.h
index 8cba5d99ba3c64..4a729be09c2d0b 100644
--- a/test/cctest/node_test_fixture.h
+++ b/test/cctest/node_test_fixture.h
@@ -90,10 +90,13 @@ class NodeTestFixture : public ::testing::Test {
                                      &node::FreeArrayBufferAllocator);
     isolate_ = NewIsolate(allocator.get());
     CHECK_NE(isolate_, nullptr);
+    platform->RegisterIsolate(isolate_, &current_loop);
+    v8::Isolate::Initialize(isolate_, params);
   }
 
   virtual void TearDown() {
     isolate_->Dispose();
+    platform->UnregisterIsolate(isolate_);
     isolate_ = nullptr;
   }
 };

From d11dafac9f858591f975bed9c8748d03dcc71c4c Mon Sep 17 00:00:00 2001
From: Benedikt Meurer <bmeurer@chromium.org>
Date: Thu, 5 Jul 2018 09:42:52 +0200
Subject: [PATCH 14/28] v8: Prepare for swallowed rejection hook.

This is done in preparation for landing

  https://chromium-review.googlesource.com/c/v8/v8/+/1126099

on the V8 side, which extends the existing PromiseRejectEvent mechanism
with new hooks for reject/resolve after a Promise was previously
resolved already.

Refs: https://github.com/nodejs/promises-debugging/issues/8
Design: https://goo.gl/2stLUY
---
 src/bootstrapper.cc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/bootstrapper.cc b/src/bootstrapper.cc
index 8bcc0493f5be6d..5f40d62a82fdef 100644
--- a/src/bootstrapper.cc
+++ b/src/bootstrapper.cc
@@ -69,7 +69,7 @@ void PromiseRejectCallback(PromiseRejectMessage message) {
     callback = env->promise_reject_handled_function();
     value = Undefined(isolate);
   } else {
-    UNREACHABLE();
+    return;
   }
 
   Local<Value> args[] = { promise, value };

From eab77c7332c5bc01b72a8fe170e250e099b361d0 Mon Sep 17 00:00:00 2001
From: Yang Guo <yangguo@chromium.org>
Date: Fri, 15 Jun 2018 14:23:29 +0200
Subject: [PATCH 15/28] test: remove parallel/test-v8-stats.js

---
 test/parallel/test-v8-stats.js | 41 ----------------------------------
 1 file changed, 41 deletions(-)
 delete mode 100644 test/parallel/test-v8-stats.js

diff --git a/test/parallel/test-v8-stats.js b/test/parallel/test-v8-stats.js
deleted file mode 100644
index d8bee55c2b4b8f..00000000000000
--- a/test/parallel/test-v8-stats.js
+++ /dev/null
@@ -1,41 +0,0 @@
-'use strict';
-require('../common');
-const assert = require('assert');
-const v8 = require('v8');
-
-const s = v8.getHeapStatistics();
-const keys = [
-  'does_zap_garbage',
-  'heap_size_limit',
-  'malloced_memory',
-  'peak_malloced_memory',
-  'total_available_size',
-  'total_heap_size',
-  'total_heap_size_executable',
-  'total_physical_size',
-  'used_heap_size'];
-assert.deepStrictEqual(Object.keys(s).sort(), keys);
-keys.forEach(function(key) {
-  assert.strictEqual(typeof s[key], 'number');
-});
-
-
-const expectedHeapSpaces = [
-  'new_space',
-  'old_space',
-  'read_only_space',
-  'code_space',
-  'map_space',
-  'large_object_space',
-  'read_only_space'
-];
-const heapSpaceStatistics = v8.getHeapSpaceStatistics();
-const actualHeapSpaceNames = heapSpaceStatistics.map((s) => s.space_name);
-assert.deepStrictEqual(actualHeapSpaceNames.sort(), expectedHeapSpaces.sort());
-heapSpaceStatistics.forEach((heapSpace) => {
-  assert.strictEqual(typeof heapSpace.space_name, 'string');
-  assert.strictEqual(typeof heapSpace.space_size, 'number');
-  assert.strictEqual(typeof heapSpace.space_used_size, 'number');
-  assert.strictEqual(typeof heapSpace.space_available_size, 'number');
-  assert.strictEqual(typeof heapSpace.physical_space_size, 'number');
-});

From a2d3495dcfea479fcccb212c7b5d4210c2cda0af Mon Sep 17 00:00:00 2001
From: Yang Guo <yangguo@chromium.org>
Date: Wed, 11 Jul 2018 09:08:14 +0200
Subject: [PATCH 16/28] Update V8 to 80508f1457

---
 deps/v8/.gitattributes                        |    5 +
 deps/v8/.gitignore                            |   16 +-
 deps/v8/AUTHORS                               |    8 +
 deps/v8/BUILD.gn                              |  401 +-
 deps/v8/ChangeLog                             | 4120 +--------
 deps/v8/DEPS                                  |   43 +-
 deps/v8/OWNERS                                |    1 +
 deps/v8/PRESUBMIT.py                          |   11 +-
 deps/v8/WATCHLISTS                            |   52 +-
 deps/v8/custom_deps/.gitignore                |    4 +
 deps/v8/custom_deps/OWNERS                    |    2 +
 deps/v8/custom_deps/README.md                 |    2 +
 deps/v8/gni/v8.gni                            |   11 +-
 deps/v8/include/libplatform/libplatform.h     |    2 +-
 deps/v8/include/v8-inspector.h                |    1 +
 deps/v8/include/v8-platform.h                 |  114 +-
 deps/v8/include/v8-profiler.h                 |   45 +-
 deps/v8/include/v8-version.h                  |    8 +-
 deps/v8/include/v8.h                          |  524 +-
 deps/v8/infra/config/cq.cfg                   |   12 +-
 deps/v8/infra/mb/mb_config.pyl                |   94 +-
 deps/v8/infra/testing/PRESUBMIT.py            |  183 +
 deps/v8/infra/testing/README.md               |   63 +-
 deps/v8/infra/testing/builders.pyl            |  432 +
 deps/v8/infra/testing/client.v8.pyl           |   48 -
 deps/v8/infra/testing/tryserver.v8.pyl        |   30 -
 deps/v8/samples/hello-world.cc                |   73 +-
 deps/v8/src/DEPS                              |    3 +-
 deps/v8/src/accessors.cc                      |  390 +-
 deps/v8/src/accessors.h                       |   21 +-
 deps/v8/src/address-map.h                     |  189 +-
 deps/v8/src/allocation.cc                     |   33 +-
 deps/v8/src/allocation.h                      |   33 +-
 deps/v8/src/api-arguments-inl.h               |    4 +-
 deps/v8/src/api-arguments.h                   |   12 +-
 deps/v8/src/api-natives.cc                    |   27 +-
 deps/v8/src/api-natives.h                     |    2 +-
 deps/v8/src/api.cc                            | 1249 +--
 deps/v8/src/api.h                             |   32 +-
 deps/v8/src/arguments.h                       |    2 +-
 deps/v8/src/arm/assembler-arm-inl.h           |   87 +-
 deps/v8/src/arm/assembler-arm.cc              |  140 +-
 deps/v8/src/arm/assembler-arm.h               |  142 +-
 deps/v8/src/arm/code-stubs-arm.cc             |  722 +-
 deps/v8/src/arm/constants-arm.h               |   51 +-
 deps/v8/src/arm/deoptimizer-arm.cc            |    9 +-
 deps/v8/src/arm/disasm-arm.cc                 |    2 +-
 deps/v8/src/arm/frame-constants-arm.h         |   16 +
 deps/v8/src/arm/interface-descriptors-arm.cc  |  101 +-
 deps/v8/src/arm/interface-descriptors-arm.h   |   26 -
 deps/v8/src/arm/macro-assembler-arm.cc        |  311 +-
 deps/v8/src/arm/macro-assembler-arm.h         |   69 +-
 deps/v8/src/arm/simulator-arm.cc              |   32 +-
 deps/v8/src/arm/simulator-arm.h               |   14 +-
 deps/v8/src/arm64/assembler-arm64-inl.h       |  215 +-
 deps/v8/src/arm64/assembler-arm64.cc          |  171 +-
 deps/v8/src/arm64/assembler-arm64.h           |  178 +-
 deps/v8/src/arm64/code-stubs-arm64.cc         |  835 +-
 deps/v8/src/arm64/constants-arm64.h           |    6 +
 deps/v8/src/arm64/deoptimizer-arm64.cc        |   59 +-
 deps/v8/src/arm64/frame-constants-arm64.h     |   18 +
 deps/v8/src/arm64/instructions-arm64.cc       |   14 +-
 deps/v8/src/arm64/instructions-arm64.h        |   13 +-
 deps/v8/src/arm64/instrument-arm64.cc         |    1 +
 .../src/arm64/interface-descriptors-arm64.cc  |  104 +-
 .../src/arm64/interface-descriptors-arm64.h   |   26 -
 deps/v8/src/arm64/macro-assembler-arm64-inl.h |   63 +-
 deps/v8/src/arm64/macro-assembler-arm64.cc    |  444 +-
 deps/v8/src/arm64/macro-assembler-arm64.h     |  160 +-
 deps/v8/src/arm64/simulator-arm64.cc          |    8 +-
 deps/v8/src/arm64/simulator-arm64.h           |    4 +-
 deps/v8/src/asan.h                            |   30 +
 deps/v8/src/asmjs/asm-js.cc                   |    6 +-
 deps/v8/src/asmjs/asm-parser.cc               |   24 +-
 deps/v8/src/asmjs/asm-scanner.cc              |   19 +-
 deps/v8/src/assembler-arch.h                  |   30 +
 deps/v8/src/assembler.cc                      |  325 +-
 deps/v8/src/assembler.h                       |  355 +-
 deps/v8/src/ast/ast-traversal-visitor.h       |   22 +-
 deps/v8/src/ast/ast-value-factory.cc          |    3 -
 deps/v8/src/ast/ast.cc                        |  125 +-
 deps/v8/src/ast/ast.h                         |  263 +-
 deps/v8/src/ast/compile-time-value.cc         |   53 -
 deps/v8/src/ast/compile-time-value.h          |   46 -
 deps/v8/src/ast/modules.cc                    |    2 +-
 deps/v8/src/ast/prettyprinter.cc              |   23 +-
 deps/v8/src/ast/prettyprinter.h               |   16 +-
 deps/v8/src/ast/scopes.cc                     |  199 +-
 deps/v8/src/ast/scopes.h                      |   22 +-
 deps/v8/src/ast/variables.cc                  |    2 +-
 deps/v8/src/ast/variables.h                   |    9 +-
 deps/v8/src/async-hooks-wrapper.cc            |  259 +
 deps/v8/src/async-hooks-wrapper.h             |   95 +
 deps/v8/src/bailout-reason.h                  |    3 +-
 deps/v8/src/base/adapters.h                   |   12 +-
 deps/v8/src/base/atomic-utils.h               |    1 +
 deps/v8/src/base/flags.h                      |   40 +-
 deps/v8/src/base/ieee754.cc                   |    1 +
 deps/v8/src/base/list.h                       |  136 +
 deps/v8/src/base/logging.cc                   |    3 +-
 deps/v8/src/base/macros.h                     |   32 +-
 deps/v8/src/base/platform/mutex.h             |   16 +-
 deps/v8/src/base/platform/platform-cygwin.cc  |    2 +
 deps/v8/src/base/platform/platform-fuchsia.cc |    2 +
 deps/v8/src/base/platform/platform-posix.cc   |   14 +
 deps/v8/src/base/platform/platform-win32.cc   |    2 +
 deps/v8/src/base/platform/platform.h          |    5 +-
 deps/v8/src/base/platform/time.cc             |   31 +-
 deps/v8/src/base/template-utils.h             |    7 -
 deps/v8/src/bootstrapper.cc                   | 2893 +++---
 deps/v8/src/bootstrapper.h                    |    6 +-
 deps/v8/src/builtins/arm/builtins-arm.cc      |  931 +-
 deps/v8/src/builtins/arm64/builtins-arm64.cc  | 1025 ++-
 deps/v8/src/builtins/array-foreach.tq         |  173 +
 deps/v8/src/builtins/array-sort.tq            |    8 +
 deps/v8/src/builtins/array.tq                 |  309 +
 deps/v8/src/builtins/base.tq                  |  701 ++
 deps/v8/src/builtins/builtins-api.cc          |   13 +-
 .../v8/src/builtins/builtins-arguments-gen.cc |    4 +-
 deps/v8/src/builtins/builtins-array-gen.cc    |  876 +-
 deps/v8/src/builtins/builtins-array-gen.h     |   55 +-
 deps/v8/src/builtins/builtins-array.cc        |  212 +-
 deps/v8/src/builtins/builtins-arraybuffer.cc  |    3 +-
 .../builtins/builtins-async-function-gen.cc   |   99 +-
 deps/v8/src/builtins/builtins-async-gen.cc    |  122 +-
 deps/v8/src/builtins/builtins-async-gen.h     |   28 +
 .../builtins/builtins-async-generator-gen.cc  |   72 +-
 .../builtins/builtins-async-iterator-gen.cc   |  141 +
 deps/v8/src/builtins/builtins-bigint.cc       |    7 +-
 deps/v8/src/builtins/builtins-boolean.cc      |    4 +-
 deps/v8/src/builtins/builtins-call-gen.cc     |  210 +-
 deps/v8/src/builtins/builtins-call-gen.h      |   21 +-
 deps/v8/src/builtins/builtins-callsite.cc     |    6 +-
 .../src/builtins/builtins-collections-gen.cc  |  380 +-
 deps/v8/src/builtins/builtins-collections.cc  |    9 +-
 deps/v8/src/builtins/builtins-console-gen.cc  |   12 +-
 deps/v8/src/builtins/builtins-console.cc      |   47 +-
 .../src/builtins/builtins-constructor-gen.cc  |  159 +-
 .../src/builtins/builtins-constructor-gen.h   |    4 -
 .../src/builtins/builtins-conversion-gen.cc   |    2 +-
 deps/v8/src/builtins/builtins-data-view-gen.h |   67 +
 deps/v8/src/builtins/builtins-dataview.cc     |  294 -
 deps/v8/src/builtins/builtins-date-gen.cc     |    2 +-
 deps/v8/src/builtins/builtins-date.cc         |   62 +-
 deps/v8/src/builtins/builtins-definitions.h   |  760 +-
 deps/v8/src/builtins/builtins-descriptors.h   |   25 +-
 deps/v8/src/builtins/builtins-error.cc        |    3 +-
 deps/v8/src/builtins/builtins-function-gen.cc |   42 +-
 deps/v8/src/builtins/builtins-function.cc     |   15 +-
 .../v8/src/builtins/builtins-generator-gen.cc |   24 +-
 deps/v8/src/builtins/builtins-global.cc       |    2 +-
 deps/v8/src/builtins/builtins-ic-gen.cc       |    1 -
 deps/v8/src/builtins/builtins-internal-gen.cc |  311 +-
 deps/v8/src/builtins/builtins-internal.cc     |    2 +-
 deps/v8/src/builtins/builtins-intl-gen.cc     |    8 +-
 deps/v8/src/builtins/builtins-intl.cc         |  436 +-
 deps/v8/src/builtins/builtins-json.cc         |    2 +-
 deps/v8/src/builtins/builtins-lazy-gen.cc     |  203 +
 deps/v8/src/builtins/builtins-lazy-gen.h      |   37 +
 deps/v8/src/builtins/builtins-math-gen.cc     |   43 +-
 deps/v8/src/builtins/builtins-math.cc         |    2 +-
 deps/v8/src/builtins/builtins-number-gen.cc   |  101 +-
 deps/v8/src/builtins/builtins-number.cc       |   24 +-
 deps/v8/src/builtins/builtins-object-gen.cc   |  480 +-
 deps/v8/src/builtins/builtins-object.cc       |   72 +-
 deps/v8/src/builtins/builtins-promise-gen.cc  |  167 +-
 deps/v8/src/builtins/builtins-promise-gen.h   |    9 +-
 deps/v8/src/builtins/builtins-proxy-gen.cc    |   32 +-
 deps/v8/src/builtins/builtins-reflect.cc      |   18 +-
 deps/v8/src/builtins/builtins-regexp-gen.cc   |  477 +-
 deps/v8/src/builtins/builtins-regexp-gen.h    |   18 +-
 deps/v8/src/builtins/builtins-regexp.cc       |   18 +-
 .../builtins-sharedarraybuffer-gen.cc         |   14 +-
 .../builtins/builtins-sharedarraybuffer.cc    |    8 +-
 deps/v8/src/builtins/builtins-string-gen.cc   |  413 +-
 deps/v8/src/builtins/builtins-string-gen.h    |   18 +-
 deps/v8/src/builtins/builtins-string.cc       |   45 +-
 deps/v8/src/builtins/builtins-symbol-gen.cc   |   10 +
 deps/v8/src/builtins/builtins-symbol.cc       |    2 +-
 deps/v8/src/builtins/builtins-test-gen.h      |   22 +
 ...ray-gen.cc => builtins-typed-array-gen.cc} |  353 +-
 ...array-gen.h => builtins-typed-array-gen.h} |   33 +-
 ...-typedarray.cc => builtins-typed-array.cc} |   15 +-
 deps/v8/src/builtins/builtins-utils-gen.h     |    5 -
 deps/v8/src/builtins/builtins-wasm-gen.cc     |  106 +-
 deps/v8/src/builtins/builtins.cc              |  465 +-
 deps/v8/src/builtins/builtins.h               |   49 +-
 .../src/builtins/constants-table-builder.cc   |   46 +-
 .../v8/src/builtins/constants-table-builder.h |    6 +
 deps/v8/src/builtins/data-view.tq             |  886 ++
 deps/v8/src/builtins/ia32/builtins-ia32.cc    | 1023 ++-
 deps/v8/src/builtins/mips/builtins-mips.cc    | 1078 ++-
 .../v8/src/builtins/mips64/builtins-mips64.cc | 1090 +--
 deps/v8/src/builtins/ppc/builtins-ppc.cc      | 1011 ++-
 deps/v8/src/builtins/s390/builtins-s390.cc    | 1011 ++-
 .../src/builtins/setup-builtins-internal.cc   |   88 +-
 deps/v8/src/builtins/typed-array.tq           |  340 +
 deps/v8/src/builtins/x64/builtins-x64.cc      | 1121 +--
 deps/v8/src/checks.h                          |    5 +-
 deps/v8/src/code-events.h                     |    5 +-
 deps/v8/src/code-factory.cc                   |  301 +-
 deps/v8/src/code-factory.h                    |   34 +-
 deps/v8/src/code-reference.cc                 |   53 +
 deps/v8/src/code-reference.h                  |   62 +
 deps/v8/src/code-stub-assembler.cc            | 2373 +++--
 deps/v8/src/code-stub-assembler.h             | 1207 ++-
 deps/v8/src/code-stubs.cc                     |  282 +-
 deps/v8/src/code-stubs.h                      |  362 +-
 deps/v8/src/compilation-cache.cc              |   47 +-
 deps/v8/src/compilation-cache.h               |   10 +-
 deps/v8/src/compilation-dependencies.cc       |  153 -
 deps/v8/src/compilation-dependencies.h        |   74 -
 .../compiler-dispatcher.cc                    |    4 +-
 .../optimizing-compile-dispatcher.cc          |    2 +-
 .../unoptimized-compile-job.cc                |   56 +-
 .../unoptimized-compile-job.h                 |    1 -
 deps/v8/src/compiler.cc                       |  195 +-
 deps/v8/src/compiler.h                        |    4 +-
 deps/v8/src/compiler/OWNERS                   |    2 +
 deps/v8/src/compiler/access-builder.cc        |   83 +-
 deps/v8/src/compiler/access-builder.h         |   19 +-
 deps/v8/src/compiler/access-info.cc           |   88 +-
 deps/v8/src/compiler/access-info.h            |   14 +-
 deps/v8/src/compiler/allocation-builder.h     |   13 +-
 .../v8/src/compiler/arm/code-generator-arm.cc |  234 +-
 .../compiler/arm/instruction-selector-arm.cc  |   81 +-
 .../compiler/arm64/code-generator-arm64.cc    |  398 +-
 .../compiler/arm64/instruction-codes-arm64.h  |  639 +-
 .../arm64/instruction-scheduler-arm64.cc      |   18 +
 .../arm64/instruction-selector-arm64.cc       |  362 +-
 deps/v8/src/compiler/branch-elimination.cc    |   35 +-
 deps/v8/src/compiler/branch-elimination.h     |    1 +
 .../v8/src/compiler/bytecode-graph-builder.cc |  194 +-
 deps/v8/src/compiler/bytecode-graph-builder.h |    1 +
 .../v8/src/compiler/checkpoint-elimination.cc |    1 +
 deps/v8/src/compiler/code-assembler.cc        |  496 +-
 deps/v8/src/compiler/code-assembler.h         |  271 +-
 deps/v8/src/compiler/code-generator.cc        |  129 +-
 deps/v8/src/compiler/code-generator.h         |   32 +-
 .../src/compiler/common-operator-reducer.cc   |   20 +-
 .../v8/src/compiler/common-operator-reducer.h |    3 +
 deps/v8/src/compiler/common-operator.cc       |  108 +-
 deps/v8/src/compiler/common-operator.h        |   38 +-
 .../src/compiler/compilation-dependencies.cc  |  359 +
 .../src/compiler/compilation-dependencies.h   |   77 +
 .../compiler-source-position-table.cc         |    6 +-
 .../compiler/compiler-source-position-table.h |    2 +-
 .../src/compiler/constant-folding-reducer.cc  |   70 +
 .../src/compiler/constant-folding-reducer.h   |   42 +
 deps/v8/src/compiler/dead-code-elimination.cc |    5 +-
 deps/v8/src/compiler/diamond.h                |    4 +
 .../src/compiler/effect-control-linearizer.cc |  516 +-
 .../src/compiler/effect-control-linearizer.h  |    9 +-
 .../src/compiler/escape-analysis-reducer.cc   |    8 +-
 .../v8/src/compiler/escape-analysis-reducer.h |    3 +-
 deps/v8/src/compiler/escape-analysis.cc       |   19 +-
 deps/v8/src/compiler/escape-analysis.h        |    1 +
 deps/v8/src/compiler/frame.h                  |    3 -
 deps/v8/src/compiler/graph-assembler.cc       |   30 +-
 deps/v8/src/compiler/graph-assembler.h        |   17 +-
 deps/v8/src/compiler/graph-reducer.cc         |   12 +-
 deps/v8/src/compiler/graph-trimmer.cc         |    5 +-
 deps/v8/src/compiler/graph-visualizer.cc      |  193 +-
 deps/v8/src/compiler/graph-visualizer.h       |   72 +-
 deps/v8/src/compiler/graph.cc                 |    5 +-
 .../src/compiler/ia32/code-generator-ia32.cc  | 1085 ++-
 .../compiler/ia32/instruction-codes-ia32.h    |   69 +-
 .../ia32/instruction-scheduler-ia32.cc        |   65 +-
 .../ia32/instruction-selector-ia32.cc         |  560 +-
 deps/v8/src/compiler/instruction-codes.h      |    4 +-
 deps/v8/src/compiler/instruction-scheduler.cc |    4 +-
 .../src/compiler/instruction-selector-impl.h  |   26 +-
 deps/v8/src/compiler/instruction-selector.cc  |  410 +-
 deps/v8/src/compiler/instruction-selector.h   |  165 +-
 deps/v8/src/compiler/instruction.cc           |   38 +-
 deps/v8/src/compiler/int64-lowering.cc        |   45 +-
 deps/v8/src/compiler/int64-lowering.h         |   11 +-
 deps/v8/src/compiler/js-builtin-reducer.cc    |  449 -
 deps/v8/src/compiler/js-builtin-reducer.h     |   73 -
 deps/v8/src/compiler/js-call-reducer.cc       | 1141 ++-
 deps/v8/src/compiler/js-call-reducer.h        |   27 +-
 .../src/compiler/js-context-specialization.cc |   73 +-
 .../src/compiler/js-context-specialization.h  |    6 +-
 deps/v8/src/compiler/js-create-lowering.cc    |  875 +-
 deps/v8/src/compiler/js-create-lowering.h     |   24 +-
 deps/v8/src/compiler/js-generic-lowering.cc   |   64 +-
 deps/v8/src/compiler/js-generic-lowering.h    |    3 +-
 deps/v8/src/compiler/js-graph.cc              |  325 +-
 deps/v8/src/compiler/js-graph.h               |  193 +-
 deps/v8/src/compiler/js-heap-broker.cc        |  648 ++
 deps/v8/src/compiler/js-heap-broker.h         |  359 +
 deps/v8/src/compiler/js-inlining-heuristic.cc |   10 +-
 deps/v8/src/compiler/js-inlining-heuristic.h  |    1 +
 deps/v8/src/compiler/js-inlining.cc           |   73 +-
 deps/v8/src/compiler/js-inlining.h            |    1 +
 deps/v8/src/compiler/js-intrinsic-lowering.cc |    6 +-
 .../js-native-context-specialization.cc       |  273 +-
 .../js-native-context-specialization.h        |   13 +-
 deps/v8/src/compiler/js-operator.cc           |   85 +-
 deps/v8/src/compiler/js-operator.h            |   67 +-
 deps/v8/src/compiler/js-type-hint-lowering.cc |    3 +
 deps/v8/src/compiler/js-type-hint-lowering.h  |    1 +
 deps/v8/src/compiler/js-typed-lowering.cc     |  416 +-
 deps/v8/src/compiler/js-typed-lowering.h      |    9 +-
 deps/v8/src/compiler/linkage.cc               |  145 +-
 deps/v8/src/compiler/linkage.h                |   21 +-
 deps/v8/src/compiler/load-elimination.cc      |   23 +-
 deps/v8/src/compiler/load-elimination.h       |    1 +
 deps/v8/src/compiler/loop-peeling.cc          |    7 +-
 deps/v8/src/compiler/loop-peeling.h           |    8 +-
 .../src/compiler/loop-variable-optimizer.cc   |   19 +-
 .../v8/src/compiler/machine-graph-verifier.cc |   30 +-
 deps/v8/src/compiler/machine-graph.cc         |   99 +
 deps/v8/src/compiler/machine-graph.h          |   92 +
 .../src/compiler/machine-operator-reducer.cc  |   24 +-
 .../src/compiler/machine-operator-reducer.h   |    9 +-
 deps/v8/src/compiler/machine-operator.cc      |   53 +-
 deps/v8/src/compiler/machine-operator.h       |   52 +-
 deps/v8/src/compiler/memory-optimizer.cc      |   35 +-
 deps/v8/src/compiler/memory-optimizer.h       |    6 +-
 .../src/compiler/mips/code-generator-mips.cc  |  219 +-
 .../mips/instruction-scheduler-mips.cc        | 1713 +++-
 .../mips/instruction-selector-mips.cc         |   47 +-
 .../compiler/mips64/code-generator-mips64.cc  |  225 +-
 .../mips64/instruction-scheduler-mips64.cc    | 1666 +++-
 .../mips64/instruction-selector-mips64.cc     |   46 +-
 deps/v8/src/compiler/node-matchers.h          |  103 +-
 deps/v8/src/compiler/node-origin-table.cc     |   88 +
 deps/v8/src/compiler/node-origin-table.h      |  141 +
 deps/v8/src/compiler/node-properties.cc       |   31 +-
 deps/v8/src/compiler/node-properties.h        |   26 +-
 deps/v8/src/compiler/node.cc                  |   17 +-
 deps/v8/src/compiler/node.h                   |    9 +-
 deps/v8/src/compiler/opcodes.h                |   20 +-
 deps/v8/src/compiler/operation-typer.cc       |  743 +-
 deps/v8/src/compiler/operation-typer.h        |   78 +-
 deps/v8/src/compiler/operator-properties.cc   |    4 +
 deps/v8/src/compiler/pipeline-statistics.cc   |    9 +-
 deps/v8/src/compiler/pipeline-statistics.h    |    5 +-
 deps/v8/src/compiler/pipeline.cc              |  923 +-
 deps/v8/src/compiler/pipeline.h               |   53 +-
 .../v8/src/compiler/ppc/code-generator-ppc.cc |  318 +-
 .../compiler/ppc/instruction-selector-ppc.cc  |  123 +-
 .../src/compiler/property-access-builder.cc   |   33 +-
 .../v8/src/compiler/property-access-builder.h |   10 +-
 deps/v8/src/compiler/raw-machine-assembler.cc |   18 +-
 deps/v8/src/compiler/raw-machine-assembler.h  |   41 +-
 .../v8/src/compiler/redundancy-elimination.cc |    2 +-
 .../compiler/register-allocator-verifier.cc   |    2 +-
 deps/v8/src/compiler/register-allocator.cc    |  138 +-
 deps/v8/src/compiler/register-allocator.h     |   33 +-
 deps/v8/src/compiler/representation-change.cc |  147 +-
 deps/v8/src/compiler/representation-change.h  |   20 +-
 .../src/compiler/s390/code-generator-s390.cc  |  573 +-
 .../s390/instruction-selector-s390.cc         |  133 +-
 deps/v8/src/compiler/schedule.cc              |   17 +-
 deps/v8/src/compiler/scheduler.cc             |    8 +-
 deps/v8/src/compiler/simd-scalar-lowering.cc  |  363 +-
 deps/v8/src/compiler/simd-scalar-lowering.h   |   29 +-
 deps/v8/src/compiler/simplified-lowering.cc   |  594 +-
 deps/v8/src/compiler/simplified-lowering.h    |   13 +-
 .../compiler/simplified-operator-reducer.cc   |   15 +-
 .../compiler/simplified-operator-reducer.h    |    8 +-
 deps/v8/src/compiler/simplified-operator.cc   |  127 +-
 deps/v8/src/compiler/simplified-operator.h    |   87 +-
 .../src/compiler/store-store-elimination.cc   |    1 +
 deps/v8/src/compiler/type-cache.h             |  119 +-
 .../v8/src/compiler/type-narrowing-reducer.cc |   88 +
 deps/v8/src/compiler/type-narrowing-reducer.h |   45 +
 deps/v8/src/compiler/typed-optimization.cc    |  325 +-
 deps/v8/src/compiler/typed-optimization.h     |   20 +-
 deps/v8/src/compiler/typer.cc                 | 1665 ++--
 deps/v8/src/compiler/typer.h                  |   14 +-
 deps/v8/src/compiler/types.cc                 |  553 +-
 deps/v8/src/compiler/types.h                  |  519 +-
 .../src/compiler/value-numbering-reducer.cc   |    8 +-
 deps/v8/src/compiler/verifier.cc              |  123 +-
 deps/v8/src/compiler/wasm-compiler.cc         | 3798 ++++----
 deps/v8/src/compiler/wasm-compiler.h          |  292 +-
 deps/v8/src/compiler/wasm-linkage.cc          |  367 -
 .../v8/src/compiler/x64/code-generator-x64.cc |  311 +-
 .../compiler/x64/instruction-selector-x64.cc  |  450 +-
 deps/v8/src/contexts-inl.h                    |   12 +-
 deps/v8/src/contexts.cc                       |  112 +-
 deps/v8/src/contexts.h                        |   72 +-
 deps/v8/src/conversions-inl.h                 |   21 +-
 deps/v8/src/conversions.cc                    |    9 +-
 deps/v8/src/conversions.h                     |   10 +-
 deps/v8/src/counters.cc                       |    2 +-
 deps/v8/src/counters.h                        |   39 +-
 deps/v8/src/d8.cc                             |  251 +-
 deps/v8/src/d8.h                              |  105 +-
 deps/v8/src/d8.js                             |    3 +-
 deps/v8/src/date.cc                           |   10 +-
 deps/v8/src/date.h                            |    2 +
 deps/v8/src/debug/arm/debug-arm.cc            |    4 +-
 deps/v8/src/debug/arm64/debug-arm64.cc        |    4 +-
 deps/v8/src/debug/debug-coverage.cc           |    4 +-
 deps/v8/src/debug/debug-evaluate.cc           |  256 +-
 deps/v8/src/debug/debug-evaluate.h            |   30 +-
 deps/v8/src/debug/debug-frames.cc             |  119 +-
 deps/v8/src/debug/debug-frames.h              |   34 +-
 deps/v8/src/debug/debug-interface.h           |  112 +-
 deps/v8/src/debug/debug-scope-iterator.cc     |   68 +-
 deps/v8/src/debug/debug-scope-iterator.h      |    9 +-
 deps/v8/src/debug/debug-scopes.cc             | 1252 ++-
 deps/v8/src/debug/debug-scopes.h              |  126 +-
 .../src/debug/debug-stack-trace-iterator.cc   |    8 +-
 .../v8/src/debug/debug-stack-trace-iterator.h |    2 +-
 deps/v8/src/debug/debug-type-profile.cc       |    2 +-
 deps/v8/src/debug/debug.cc                    |  886 +-
 deps/v8/src/debug/debug.h                     |  178 +-
 deps/v8/src/debug/debug.js                    |  379 -
 deps/v8/src/debug/ia32/debug-ia32.cc          |    4 +-
 deps/v8/src/debug/interface-types.h           |   43 +-
 deps/v8/src/debug/liveedit.cc                 | 1768 ++--
 deps/v8/src/debug/liveedit.h                  |  343 +-
 deps/v8/src/debug/liveedit.js                 | 1058 ---
 deps/v8/src/debug/mips/debug-mips.cc          |    4 +-
 deps/v8/src/debug/mips64/debug-mips64.cc      |    4 +-
 deps/v8/src/debug/mirrors.js                  | 2439 ------
 deps/v8/src/debug/ppc/debug-ppc.cc            |    4 +-
 deps/v8/src/debug/s390/debug-s390.cc          |    2 +-
 deps/v8/src/debug/x64/debug-x64.cc            |    2 +-
 deps/v8/src/deoptimizer.cc                    | 1062 +--
 deps/v8/src/deoptimizer.h                     |  107 +-
 deps/v8/src/disassembler.cc                   |  124 +-
 deps/v8/src/disassembler.h                    |    4 +-
 deps/v8/src/eh-frame.cc                       |   13 +-
 deps/v8/src/eh-frame.h                        |   14 +-
 deps/v8/src/elements-kind.cc                  |    3 +
 deps/v8/src/elements-kind.h                   |    2 +
 deps/v8/src/elements.cc                       |  424 +-
 deps/v8/src/elements.h                        |    7 +-
 deps/v8/src/execution.cc                      |   93 +-
 deps/v8/src/execution.h                       |   23 +-
 .../externalize-string-extension.cc           |    8 -
 deps/v8/src/external-reference-table.cc       |   18 +-
 deps/v8/src/external-reference-table.h        |   18 +-
 deps/v8/src/external-reference.cc             |  635 +-
 deps/v8/src/external-reference.h              |  316 +-
 deps/v8/src/feedback-vector-inl.h             |   89 +-
 deps/v8/src/feedback-vector.cc                |  421 +-
 deps/v8/src/feedback-vector.h                 |   54 +-
 deps/v8/src/flag-definitions.h                |  123 +-
 deps/v8/src/flags.cc                          |   93 +-
 deps/v8/src/flags.h                           |   11 +-
 deps/v8/src/frame-constants.h                 |   14 +-
 deps/v8/src/frames-inl.h                      |    4 +
 deps/v8/src/frames.cc                         |  286 +-
 deps/v8/src/frames.h                          |   55 +-
 deps/v8/src/futex-emulation.cc                |  172 +-
 deps/v8/src/futex-emulation.h                 |   33 +
 deps/v8/src/gdb-jit.cc                        |   77 +-
 deps/v8/src/global-handles.cc                 |   95 +-
 deps/v8/src/global-handles.h                  |   15 +-
 deps/v8/src/globals.h                         |  175 +-
 deps/v8/src/handler-table.cc                  |    3 +-
 deps/v8/src/handles-inl.h                     |   74 +-
 deps/v8/src/handles.cc                        |    5 +-
 deps/v8/src/handles.h                         |   45 +-
 deps/v8/src/heap-symbols.h                    |   33 +-
 deps/v8/src/heap/array-buffer-collector.cc    |   11 +-
 deps/v8/src/heap/array-buffer-collector.h     |    4 +-
 deps/v8/src/heap/array-buffer-tracker-inl.h   |   42 +-
 deps/v8/src/heap/array-buffer-tracker.cc      |   62 +-
 deps/v8/src/heap/array-buffer-tracker.h       |   24 +-
 deps/v8/src/heap/code-stats.cc                |   49 +-
 deps/v8/src/heap/concurrent-marking.cc        |  111 +-
 deps/v8/src/heap/concurrent-marking.h         |   11 +-
 deps/v8/src/heap/embedder-tracing.cc          |    9 +-
 deps/v8/src/heap/embedder-tracing.h           |    4 +-
 deps/v8/src/heap/factory-inl.h                |   37 +-
 deps/v8/src/heap/factory.cc                   |  881 +-
 deps/v8/src/heap/factory.h                    |  171 +-
 deps/v8/src/heap/gc-tracer.cc                 |   32 +-
 deps/v8/src/heap/gc-tracer.h                  |    5 +
 deps/v8/src/heap/heap-controller.cc           |  160 +
 deps/v8/src/heap/heap-controller.h            |   55 +
 deps/v8/src/heap/heap-inl.h                   |  117 +-
 deps/v8/src/heap/heap.cc                      | 1038 +--
 deps/v8/src/heap/heap.h                       |  814 +-
 deps/v8/src/heap/incremental-marking-inl.h    |    6 +-
 deps/v8/src/heap/incremental-marking.cc       |  169 +-
 deps/v8/src/heap/incremental-marking.h        |   16 +-
 deps/v8/src/heap/local-allocator.h            |    4 +-
 deps/v8/src/heap/mark-compact-inl.h           |   78 +-
 deps/v8/src/heap/mark-compact.cc              |  732 +-
 deps/v8/src/heap/mark-compact.h               |  177 +-
 deps/v8/src/heap/marking.h                    |   20 +-
 deps/v8/src/heap/memory-reducer.cc            |   24 +-
 deps/v8/src/heap/memory-reducer.h             |    9 +-
 deps/v8/src/heap/object-stats.cc              |  231 +-
 deps/v8/src/heap/object-stats.h               |  109 +-
 deps/v8/src/heap/objects-visiting-inl.h       |   14 +
 deps/v8/src/heap/objects-visiting.cc          |   15 +-
 deps/v8/src/heap/objects-visiting.h           |   79 +-
 deps/v8/src/heap/remembered-set.h             |   17 +-
 deps/v8/src/heap/scavenger-inl.h              |   24 +-
 deps/v8/src/heap/scavenger.cc                 |   12 +-
 deps/v8/src/heap/scavenger.h                  |    8 +-
 deps/v8/src/heap/setup-heap-internal.cc       |  367 +-
 deps/v8/src/heap/spaces-inl.h                 |   24 +-
 deps/v8/src/heap/spaces.cc                    |  924 +-
 deps/v8/src/heap/spaces.h                     |  508 +-
 deps/v8/src/heap/store-buffer.cc              |   14 +-
 deps/v8/src/heap/store-buffer.h               |   10 +-
 deps/v8/src/heap/sweeper.cc                   |   24 +-
 deps/v8/src/heap/sweeper.h                    |    2 +-
 deps/v8/src/heap/worklist.h                   |   43 +-
 deps/v8/src/ia32/assembler-ia32-inl.h         |   47 +-
 deps/v8/src/ia32/assembler-ia32.cc            |  154 +-
 deps/v8/src/ia32/assembler-ia32.h             |   83 +-
 deps/v8/src/ia32/code-stubs-ia32.cc           |  724 +-
 deps/v8/src/ia32/constants-ia32.h             |   23 +
 deps/v8/src/ia32/deoptimizer-ia32.cc          |   12 +-
 deps/v8/src/ia32/disasm-ia32.cc               |   48 +-
 deps/v8/src/ia32/frame-constants-ia32.h       |   16 +
 .../v8/src/ia32/interface-descriptors-ia32.cc |   98 +-
 deps/v8/src/ia32/macro-assembler-ia32.cc      |  286 +-
 deps/v8/src/ia32/macro-assembler-ia32.h       |  163 +-
 deps/v8/src/ia32/sse-instr.h                  |   19 +-
 deps/v8/src/ic/accessor-assembler.cc          |  638 +-
 deps/v8/src/ic/accessor-assembler.h           |   71 +-
 deps/v8/src/ic/binary-op-assembler.cc         |   56 +-
 deps/v8/src/ic/call-optimization.cc           |   33 +-
 deps/v8/src/ic/call-optimization.h            |   10 +-
 deps/v8/src/ic/handler-configuration-inl.h    |   13 +-
 deps/v8/src/ic/handler-configuration.cc       |   57 +-
 deps/v8/src/ic/handler-configuration.h        |   14 +-
 deps/v8/src/ic/ic-inl.h                       |   16 +-
 deps/v8/src/ic/ic.cc                          |  308 +-
 deps/v8/src/ic/ic.h                           |   47 +-
 deps/v8/src/ic/keyed-store-generic.cc         |  170 +-
 deps/v8/src/ic/keyed-store-generic.h          |   14 +-
 deps/v8/src/ic/stub-cache.cc                  |   23 +-
 deps/v8/src/ic/stub-cache.h                   |    6 +-
 deps/v8/src/identity-map.cc                   |   41 +-
 deps/v8/src/identity-map.h                    |   17 +-
 deps/v8/src/inspector/DEPS                    |    1 +
 deps/v8/src/inspector/PRESUBMIT.py            |    3 +-
 deps/v8/src/inspector/injected-script.cc      |    1 +
 deps/v8/src/inspector/inspected-context.cc    |    2 +-
 deps/v8/src/inspector/js_protocol.json        |  113 +
 deps/v8/src/inspector/js_protocol.pdl         |   60 +
 deps/v8/src/inspector/v8-console-message.cc   |    8 +
 deps/v8/src/inspector/v8-console-message.h    |    3 +
 deps/v8/src/inspector/v8-console.cc           |  111 +-
 deps/v8/src/inspector/v8-console.h            |   10 +-
 .../src/inspector/v8-debugger-agent-impl.cc   |  188 +-
 .../v8/src/inspector/v8-debugger-agent-impl.h |    4 +
 deps/v8/src/inspector/v8-debugger-script.cc   |   83 +-
 deps/v8/src/inspector/v8-debugger-script.h    |    2 +-
 deps/v8/src/inspector/v8-debugger.cc          |  147 +-
 deps/v8/src/inspector/v8-debugger.h           |   15 +-
 deps/v8/src/inspector/v8-inspector-impl.cc    |   49 +
 deps/v8/src/inspector/v8-inspector-impl.h     |   16 +
 .../v8/src/inspector/v8-runtime-agent-impl.cc |  125 +-
 deps/v8/src/inspector/v8-runtime-agent-impl.h |   12 +
 deps/v8/src/inspector/v8-stack-trace-impl.cc  |   24 +-
 deps/v8/src/inspector/v8-stack-trace-impl.h   |   14 +-
 deps/v8/src/instruction-stream.cc             |   27 +-
 deps/v8/src/instruction-stream.h              |    2 -
 deps/v8/src/interface-descriptors.cc          |  562 +-
 deps/v8/src/interface-descriptors.h           |  877 +-
 .../interpreter/bytecode-array-accessor.cc    |   38 +-
 .../src/interpreter/bytecode-array-accessor.h |    6 +-
 .../src/interpreter/bytecode-array-builder.cc |   62 +-
 .../src/interpreter/bytecode-array-builder.h  |   38 +-
 .../src/interpreter/bytecode-array-writer.cc  |    9 +-
 deps/v8/src/interpreter/bytecode-decoder.cc   |   20 +-
 deps/v8/src/interpreter/bytecode-decoder.h    |    8 +-
 deps/v8/src/interpreter/bytecode-generator.cc |  385 +-
 deps/v8/src/interpreter/bytecode-generator.h  |   20 +-
 deps/v8/src/interpreter/bytecode-node.h       |   83 +-
 .../interpreter/bytecode-register-optimizer.h |    2 +-
 deps/v8/src/interpreter/bytecodes.h           |   21 +-
 .../src/interpreter/constant-array-builder.h  |   16 +-
 .../src/interpreter/interpreter-assembler.cc  |  235 +-
 .../src/interpreter/interpreter-assembler.h   |   39 +-
 .../src/interpreter/interpreter-generator.cc  |  229 +-
 .../interpreter-intrinsics-generator.cc       |   12 -
 .../src/interpreter/interpreter-intrinsics.h  |    2 -
 deps/v8/src/interpreter/interpreter.cc        |   12 +-
 deps/v8/src/interpreter/interpreter.h         |    2 +-
 .../interpreter/setup-interpreter-internal.cc |    9 +-
 deps/v8/src/intl.cc                           |    2 +-
 deps/v8/src/intl.h                            |    8 +
 deps/v8/src/isolate-inl.h                     |   11 +-
 deps/v8/src/isolate.cc                        |  680 +-
 deps/v8/src/isolate.h                         |  350 +-
 deps/v8/src/js/array.js                       |  246 +-
 deps/v8/src/js/intl.js                        |  161 +-
 deps/v8/src/js/macros.py                      |    8 +
 deps/v8/src/js/typedarray.js                  |   22 -
 deps/v8/src/json-parser.cc                    |   20 +-
 deps/v8/src/json-parser.h                     |   11 +-
 deps/v8/src/json-stringifier.cc               |   15 +-
 deps/v8/src/json-stringifier.h                |   38 +-
 deps/v8/src/keys.cc                           |   44 +-
 deps/v8/src/keys.h                            |    1 +
 deps/v8/src/label.h                           |   14 +-
 deps/v8/src/layout-descriptor-inl.h           |   13 +-
 deps/v8/src/layout-descriptor.cc              |   22 +-
 deps/v8/src/layout-descriptor.h               |    6 +-
 deps/v8/src/libplatform/default-platform.cc   |   13 +-
 deps/v8/src/libplatform/default-platform.h    |    4 +-
 .../default-worker-threads-task-runner.cc     |    8 +-
 deps/v8/src/log-utils.cc                      |    2 +-
 deps/v8/src/log.cc                            |  338 +-
 deps/v8/src/log.h                             |   62 +-
 deps/v8/src/lookup.cc                         |  102 +-
 deps/v8/src/lookup.h                          |   12 +-
 deps/v8/src/lsan.h                            |   31 +
 deps/v8/src/machine-type.h                    |    8 +-
 deps/v8/src/macro-assembler.h                 |   22 +-
 deps/v8/src/managed.h                         |  104 -
 deps/v8/src/map-updater.cc                    |   96 +-
 deps/v8/src/map-updater.h                     |    6 +-
 deps/v8/src/messages.cc                       |   84 +-
 deps/v8/src/messages.h                        |   14 +-
 deps/v8/src/mips/assembler-mips-inl.h         |   52 +-
 deps/v8/src/mips/assembler-mips.cc            |   77 +-
 deps/v8/src/mips/assembler-mips.h             |   65 +-
 deps/v8/src/mips/code-stubs-mips.cc           |  852 +-
 deps/v8/src/mips/constants-mips.h             |   20 +-
 deps/v8/src/mips/deoptimizer-mips.cc          |   23 +-
 deps/v8/src/mips/frame-constants-mips.h       |   16 +
 .../v8/src/mips/interface-descriptors-mips.cc |   95 +-
 deps/v8/src/mips/macro-assembler-mips.cc      |  511 +-
 deps/v8/src/mips/macro-assembler-mips.h       |  120 +-
 deps/v8/src/mips/simulator-mips.cc            |   36 +-
 deps/v8/src/mips/simulator-mips.h             |   12 +-
 deps/v8/src/mips64/assembler-mips64-inl.h     |   48 +-
 deps/v8/src/mips64/assembler-mips64.cc        |   71 +-
 deps/v8/src/mips64/assembler-mips64.h         |   63 +-
 deps/v8/src/mips64/code-stubs-mips64.cc       |  858 +-
 deps/v8/src/mips64/constants-mips64.h         |   23 +-
 deps/v8/src/mips64/deoptimizer-mips64.cc      |   23 +-
 deps/v8/src/mips64/frame-constants-mips64.h   |   16 +
 .../mips64/interface-descriptors-mips64.cc    |   95 +-
 deps/v8/src/mips64/macro-assembler-mips64.cc  |  467 +-
 deps/v8/src/mips64/macro-assembler-mips64.h   |  139 +-
 deps/v8/src/mips64/simulator-mips64.cc        |   36 +-
 deps/v8/src/mips64/simulator-mips64.h         |   12 +-
 deps/v8/src/msan.h                            |   35 +-
 deps/v8/src/objects-body-descriptors-inl.h    |  161 +-
 deps/v8/src/objects-debug.cc                  | 1017 ++-
 deps/v8/src/objects-definitions.h             |  343 +
 deps/v8/src/objects-inl.h                     |  884 +-
 deps/v8/src/objects-printer.cc                |  846 +-
 deps/v8/src/objects.cc                        | 3606 ++++----
 deps/v8/src/objects.h                         | 1438 +--
 deps/v8/src/objects/api-callbacks-inl.h       |  139 +
 deps/v8/src/objects/api-callbacks.h           |  215 +
 deps/v8/src/objects/arguments-inl.h           |    2 -
 deps/v8/src/objects/arguments.h               |    2 +-
 deps/v8/src/objects/bigint.cc                 |  510 +-
 deps/v8/src/objects/bigint.h                  |   63 +-
 deps/v8/src/objects/code-inl.h                |  100 +-
 deps/v8/src/objects/code.h                    |  139 +-
 deps/v8/src/objects/compilation-cache-inl.h   |    2 +-
 deps/v8/src/objects/compilation-cache.h       |    8 +-
 deps/v8/src/objects/data-handler-inl.h        |    4 +-
 deps/v8/src/objects/data-handler.h            |    4 +-
 deps/v8/src/objects/debug-objects-inl.h       |   26 +-
 deps/v8/src/objects/debug-objects.cc          |  117 +-
 deps/v8/src/objects/debug-objects.h           |   90 +-
 deps/v8/src/objects/descriptor-array.h        |   39 +-
 deps/v8/src/objects/dictionary.h              |    3 +-
 deps/v8/src/objects/fixed-array-inl.h         |  154 +-
 deps/v8/src/objects/fixed-array.h             |   98 +-
 deps/v8/src/objects/hash-table-inl.h          |   45 +-
 deps/v8/src/objects/hash-table.h              |  590 +-
 deps/v8/src/objects/intl-objects-inl.h        |   27 +
 deps/v8/src/objects/intl-objects.cc           |  396 +-
 deps/v8/src/objects/intl-objects.h            |  146 +-
 deps/v8/src/objects/js-array-inl.h            |   23 +-
 deps/v8/src/objects/js-array.h                |   23 +-
 deps/v8/src/objects/js-collection-inl.h       |    8 +-
 deps/v8/src/objects/js-collection.h           |   33 +-
 deps/v8/src/objects/js-locale-inl.h           |   41 +
 deps/v8/src/objects/js-locale.cc              |  287 +
 deps/v8/src/objects/js-locale.h               |   79 +
 deps/v8/src/objects/js-promise-inl.h          |    1 -
 deps/v8/src/objects/js-promise.h              |    6 +-
 deps/v8/src/objects/js-regexp-inl.h           |    4 +-
 .../objects/js-regexp-string-iterator-inl.h   |    2 -
 .../src/objects/js-regexp-string-iterator.h   |    2 +-
 deps/v8/src/objects/js-regexp.h               |    2 +-
 .../src/objects/js-relative-time-format-inl.h |   62 +
 .../v8/src/objects/js-relative-time-format.cc |  227 +
 deps/v8/src/objects/js-relative-time-format.h |  105 +
 deps/v8/src/objects/literal-objects-inl.h     |   20 +
 deps/v8/src/objects/literal-objects.cc        |   49 +-
 deps/v8/src/objects/literal-objects.h         |   48 +-
 deps/v8/src/objects/managed.cc                |   38 +
 deps/v8/src/objects/managed.h                 |  129 +
 deps/v8/src/objects/map-inl.h                 |   73 +-
 deps/v8/src/objects/map.h                     |  294 +-
 deps/v8/src/objects/maybe-object-inl.h        |   30 +
 deps/v8/src/objects/maybe-object.h            |   34 +-
 deps/v8/src/objects/module-inl.h              |   19 +-
 deps/v8/src/objects/module.cc                 |  239 +-
 deps/v8/src/objects/module.h                  |   67 +-
 deps/v8/src/objects/name-inl.h                |    6 +-
 deps/v8/src/objects/name.h                    |   11 +-
 deps/v8/src/objects/object-macros-undef.h     |    1 -
 deps/v8/src/objects/object-macros.h           |  188 +-
 deps/v8/src/objects/ordered-hash-table-inl.h  |   53 +
 deps/v8/src/objects/ordered-hash-table.cc     |  760 ++
 deps/v8/src/objects/ordered-hash-table.h      |  676 ++
 deps/v8/src/objects/promise-inl.h             |    1 +
 deps/v8/src/objects/scope-info.cc             |  336 +-
 deps/v8/src/objects/scope-info.h              |   87 +-
 deps/v8/src/objects/script-inl.h              |    4 +-
 deps/v8/src/objects/script.h                  |   13 +-
 .../v8/src/objects/shared-function-info-inl.h |  400 +-
 deps/v8/src/objects/shared-function-info.h    |  306 +-
 deps/v8/src/objects/string-inl.h              |   17 +-
 deps/v8/src/objects/string-table.h            |    4 +-
 deps/v8/src/objects/string.h                  |   32 +-
 deps/v8/src/objects/template-objects.cc       |    4 +-
 deps/v8/src/objects/template-objects.h        |    2 +-
 deps/v8/src/objects/templates-inl.h           |  135 +
 deps/v8/src/objects/templates.h               |  223 +
 deps/v8/src/optimized-compilation-info.cc     |   29 +-
 deps/v8/src/optimized-compilation-info.h      |   93 +-
 deps/v8/src/ostreams.cc                       |   35 +-
 deps/v8/src/ostreams.h                        |   61 +-
 .../parsing/expression-scope-reparenter.cc    |    4 +-
 deps/v8/src/parsing/parse-info.cc             |  163 +-
 deps/v8/src/parsing/parse-info.h              |   31 +-
 deps/v8/src/parsing/parser-base.h             |  151 +-
 deps/v8/src/parsing/parser.cc                 |  378 +-
 deps/v8/src/parsing/parser.h                  |  124 +-
 deps/v8/src/parsing/parsing.cc                |   14 +-
 deps/v8/src/parsing/pattern-rewriter.cc       |   21 +-
 deps/v8/src/parsing/preparsed-scope-data.cc   |   14 +-
 deps/v8/src/parsing/preparsed-scope-data.h    |    3 +-
 deps/v8/src/parsing/preparser.cc              |    6 +-
 deps/v8/src/parsing/preparser.h               |   87 +-
 deps/v8/src/parsing/rewriter.cc               |   11 +-
 .../src/parsing/scanner-character-streams.cc  |  756 +-
 .../src/parsing/scanner-character-streams.h   |    6 +-
 deps/v8/src/parsing/scanner.cc                |  287 +-
 deps/v8/src/parsing/scanner.h                 |   29 +-
 deps/v8/src/perf-jit.cc                       |   76 +-
 deps/v8/src/ppc/assembler-ppc-inl.h           |   49 +-
 deps/v8/src/ppc/assembler-ppc.cc              |   88 +-
 deps/v8/src/ppc/assembler-ppc.h               |   86 +-
 deps/v8/src/ppc/code-stubs-ppc.cc             |  798 +-
 deps/v8/src/ppc/constants-ppc.h               |    8 +
 deps/v8/src/ppc/deoptimizer-ppc.cc            |   11 +-
 deps/v8/src/ppc/frame-constants-ppc.h         |   14 +
 deps/v8/src/ppc/interface-descriptors-ppc.cc  |   87 +-
 deps/v8/src/ppc/macro-assembler-ppc.cc        |  301 +-
 deps/v8/src/ppc/macro-assembler-ppc.h         |   81 +-
 deps/v8/src/ppc/simulator-ppc.cc              |   30 +-
 deps/v8/src/ppc/simulator-ppc.h               |   17 +-
 deps/v8/src/profiler/allocation-tracker.cc    |    6 +-
 deps/v8/src/profiler/cpu-profiler-inl.h       |    6 +-
 deps/v8/src/profiler/cpu-profiler.cc          |   81 +-
 deps/v8/src/profiler/cpu-profiler.h           |   30 +-
 deps/v8/src/profiler/heap-profiler.cc         |   32 +-
 deps/v8/src/profiler/heap-profiler.h          |   12 +-
 .../src/profiler/heap-snapshot-generator.cc   |  453 +-
 .../v8/src/profiler/heap-snapshot-generator.h |   78 +-
 deps/v8/src/profiler/profile-generator-inl.h  |   23 +-
 deps/v8/src/profiler/profile-generator.cc     |  323 +-
 deps/v8/src/profiler/profile-generator.h      |  214 +-
 deps/v8/src/profiler/profiler-listener.cc     |  164 +-
 deps/v8/src/profiler/profiler-listener.h      |   38 +-
 .../v8/src/profiler/sampling-heap-profiler.cc |    4 +-
 deps/v8/src/profiler/strings-storage.cc       |   34 +-
 deps/v8/src/profiler/strings-storage.h        |   24 +-
 deps/v8/src/profiler/tick-sample.cc           |   67 +-
 deps/v8/src/profiler/tracing-cpu-profiler.cc  |    7 +-
 deps/v8/src/profiler/unbound-queue.h          |   10 +-
 deps/v8/src/property-descriptor.cc            |   36 +-
 deps/v8/src/property-details.h                |   13 +-
 deps/v8/src/property.cc                       |   22 +-
 deps/v8/src/property.h                        |   19 +-
 deps/v8/src/prototype.h                       |    5 +-
 deps/v8/src/regexp/jsregexp-inl.h             |   17 +-
 deps/v8/src/regexp/jsregexp.cc                |  187 +-
 deps/v8/src/regexp/jsregexp.h                 |   61 +-
 .../regexp/regexp-macro-assembler-irregexp.cc |    3 +-
 .../regexp/regexp-macro-assembler-irregexp.h  |    2 +-
 deps/v8/src/regexp/regexp-macro-assembler.cc  |    8 +-
 deps/v8/src/regexp/regexp-macro-assembler.h   |    2 +-
 deps/v8/src/regexp/regexp-parser.cc           |   47 +-
 deps/v8/src/regexp/regexp-stack.cc            |   16 +-
 deps/v8/src/regexp/regexp-stack.h             |   10 +-
 deps/v8/src/regexp/regexp-utils.cc            |    8 +-
 .../regexp/x64/regexp-macro-assembler-x64.h   |    2 +-
 deps/v8/src/register-configuration.cc         |    6 +
 deps/v8/src/register-configuration.h          |    2 +
 deps/v8/src/roots-inl.h                       |   90 +
 deps/v8/src/roots.h                           |  347 +
 deps/v8/src/runtime/runtime-array.cc          |  349 +-
 deps/v8/src/runtime/runtime-bigint.cc         |   48 +-
 deps/v8/src/runtime/runtime-classes.cc        |   27 +-
 deps/v8/src/runtime/runtime-collections.cc    |   86 +-
 deps/v8/src/runtime/runtime-compiler.cc       |   39 +-
 deps/v8/src/runtime/runtime-debug.cc          | 1321 +--
 deps/v8/src/runtime/runtime-error.cc          |   30 -
 deps/v8/src/runtime/runtime-forin.cc          |    7 +-
 deps/v8/src/runtime/runtime-function.cc       |   44 +-
 deps/v8/src/runtime/runtime-futex.cc          |    2 +-
 deps/v8/src/runtime/runtime-generator.cc      |   41 +-
 deps/v8/src/runtime/runtime-internal.cc       |   46 +-
 deps/v8/src/runtime/runtime-interpreter.cc    |   30 +-
 deps/v8/src/runtime/runtime-intl.cc           |  258 +-
 deps/v8/src/runtime/runtime-literals.cc       |  129 +-
 deps/v8/src/runtime/runtime-liveedit.cc       |   86 +-
 deps/v8/src/runtime/runtime-module.cc         |   10 +-
 deps/v8/src/runtime/runtime-numbers.cc        |   32 +-
 deps/v8/src/runtime/runtime-object.cc         |  189 +-
 deps/v8/src/runtime/runtime-operators.cc      |   24 +-
 deps/v8/src/runtime/runtime-promise.cc        |   65 +-
 deps/v8/src/runtime/runtime-proxy.cc          |   16 +-
 deps/v8/src/runtime/runtime-regexp.cc         |  134 +-
 deps/v8/src/runtime/runtime-scopes.cc         |  235 +-
 deps/v8/src/runtime/runtime-strings.cc        |   56 +-
 deps/v8/src/runtime/runtime-symbol.cc         |    8 -
 deps/v8/src/runtime/runtime-test.cc           |  298 +-
 deps/v8/src/runtime/runtime-typedarray.cc     |    8 +-
 deps/v8/src/runtime/runtime-wasm.cc           |  110 +-
 deps/v8/src/runtime/runtime.cc                |   40 +-
 deps/v8/src/runtime/runtime.h                 |  121 +-
 deps/v8/src/s390/assembler-s390-inl.h         |   64 +-
 deps/v8/src/s390/assembler-s390.cc            | 1520 +---
 deps/v8/src/s390/assembler-s390.h             | 1134 +--
 deps/v8/src/s390/code-stubs-s390.cc           |  851 +-
 deps/v8/src/s390/constants-s390.h             |   34 +-
 deps/v8/src/s390/deoptimizer-s390.cc          |   11 +-
 deps/v8/src/s390/disasm-s390.cc               |   10 +-
 deps/v8/src/s390/frame-constants-s390.h       |   20 +
 .../v8/src/s390/interface-descriptors-s390.cc |   83 +-
 deps/v8/src/s390/macro-assembler-s390.cc      |  405 +-
 deps/v8/src/s390/macro-assembler-s390.h       |   98 +-
 deps/v8/src/s390/simulator-s390.cc            |  122 +-
 deps/v8/src/s390/simulator-s390.h             |   17 +-
 deps/v8/src/safepoint-table.cc                |    1 +
 deps/v8/src/setup-isolate-deserialize.cc      |    8 +-
 deps/v8/src/signature.h                       |    3 +
 deps/v8/src/simulator-base.cc                 |   14 +-
 deps/v8/src/simulator-base.h                  |   23 +-
 deps/v8/src/simulator.h                       |    9 +-
 .../builtin-deserializer-allocator.cc         |   12 +-
 .../snapshot/builtin-deserializer-allocator.h |    2 +-
 deps/v8/src/snapshot/builtin-deserializer.cc  |   50 +-
 .../snapshot/builtin-serializer-allocator.cc  |   18 +-
 .../snapshot/builtin-serializer-allocator.h   |    6 +-
 deps/v8/src/snapshot/code-serializer.cc       |   78 +-
 deps/v8/src/snapshot/code-serializer.h        |    9 +-
 .../default-deserializer-allocator.cc         |   11 +-
 .../snapshot/default-serializer-allocator.cc  |   35 +-
 .../snapshot/default-serializer-allocator.h   |   10 +-
 deps/v8/src/snapshot/deserializer.cc          |  135 +-
 deps/v8/src/snapshot/embedded-empty.cc        |    3 -
 deps/v8/src/snapshot/mksnapshot.cc            |   53 +-
 deps/v8/src/snapshot/object-deserializer.cc   |   39 +-
 deps/v8/src/snapshot/object-deserializer.h    |    5 -
 deps/v8/src/snapshot/partial-deserializer.cc  |    2 +-
 deps/v8/src/snapshot/partial-serializer.cc    |   15 +-
 deps/v8/src/snapshot/references.h             |  197 +
 deps/v8/src/snapshot/serializer-common.cc     |   16 +-
 deps/v8/src/snapshot/serializer-common.h      |   14 +-
 deps/v8/src/snapshot/serializer.cc            |  239 +-
 deps/v8/src/snapshot/serializer.h             |   23 +-
 deps/v8/src/snapshot/snapshot-common.cc       |  140 +-
 deps/v8/src/snapshot/snapshot.h               |   33 +-
 deps/v8/src/snapshot/startup-deserializer.cc  |   14 +-
 deps/v8/src/snapshot/startup-serializer.cc    |   17 +-
 deps/v8/src/source-position-table.cc          |   45 +-
 deps/v8/src/source-position-table.h           |    1 +
 deps/v8/src/source-position.cc                |   32 +-
 deps/v8/src/source-position.h                 |    3 +-
 deps/v8/src/splay-tree.h                      |   16 +-
 deps/v8/src/string-builder.cc                 |    3 +-
 deps/v8/src/string-builder.h                  |   32 +-
 deps/v8/src/string-hasher-inl.h               |    5 +
 deps/v8/src/string-hasher.h                   |   29 +-
 deps/v8/src/string-search.h                   |    6 +-
 deps/v8/src/torque/Torque.g4                  |  295 +
 deps/v8/src/torque/TorqueBaseListener.cpp     |    7 +
 deps/v8/src/torque/TorqueBaseListener.h       |  343 +
 deps/v8/src/torque/TorqueBaseVisitor.cpp      |    7 +
 deps/v8/src/torque/TorqueBaseVisitor.h        |  359 +
 deps/v8/src/torque/TorqueLexer.cpp            |  976 +++
 deps/v8/src/torque/TorqueLexer.h              |  137 +
 deps/v8/src/torque/TorqueListener.cpp         |    7 +
 deps/v8/src/torque/TorqueListener.h           |  321 +
 deps/v8/src/torque/TorqueParser.cpp           | 7731 +++++++++++++++++
 deps/v8/src/torque/TorqueParser.h             | 1516 ++++
 deps/v8/src/torque/TorqueVisitor.cpp          |    7 +
 deps/v8/src/torque/TorqueVisitor.h            |  231 +
 deps/v8/src/torque/ast-generator.cc           |  778 ++
 deps/v8/src/torque/ast-generator.h            |  189 +
 deps/v8/src/torque/ast.h                      |  701 ++
 deps/v8/src/torque/contextual.h               |   87 +
 deps/v8/src/torque/declarable.cc              |   74 +
 deps/v8/src/torque/declarable.h               |  355 +
 deps/v8/src/torque/declaration-visitor.cc     |  596 ++
 deps/v8/src/torque/declaration-visitor.h      |  181 +
 deps/v8/src/torque/declarations.cc            |  353 +
 deps/v8/src/torque/declarations.h             |  225 +
 deps/v8/src/torque/file-visitor.cc            |   76 +
 deps/v8/src/torque/file-visitor.h             |  101 +
 deps/v8/src/torque/global-context.h           |  159 +
 deps/v8/src/torque/implementation-visitor.cc  | 1769 ++++
 deps/v8/src/torque/implementation-visitor.h   |  255 +
 deps/v8/src/torque/parameter-difference.h     |   77 +
 deps/v8/src/torque/scope.cc                   |   51 +
 deps/v8/src/torque/scope.h                    |  167 +
 deps/v8/src/torque/torque.cc                  |  138 +
 deps/v8/src/torque/type-oracle.h              |  110 +
 deps/v8/src/torque/types.cc                   |  262 +
 deps/v8/src/torque/types.h                    |  381 +
 deps/v8/src/torque/utils.cc                   |   69 +
 deps/v8/src/torque/utils.h                    |   86 +
 deps/v8/src/tracing/trace-event.h             |   28 +-
 deps/v8/src/transitions-inl.h                 |  125 +-
 deps/v8/src/transitions.cc                    |  283 +-
 deps/v8/src/transitions.h                     |  102 +-
 .../src/trap-handler/handler-inside-linux.cc  |  133 +
 deps/v8/src/trap-handler/handler-inside.cc    |  107 +-
 .../src/trap-handler/handler-outside-linux.cc |   73 +
 .../src/trap-handler/handler-outside-win.cc   |   35 +
 deps/v8/src/trap-handler/handler-outside.cc   |   61 +-
 .../src/trap-handler/trap-handler-internal.h  |    2 +-
 deps/v8/src/trap-handler/trap-handler.h       |    4 +-
 deps/v8/src/turbo-assembler.cc                |  122 +
 deps/v8/src/turbo-assembler.h                 |  114 +
 deps/v8/src/type-hints.cc                     |    8 -
 deps/v8/src/type-hints.h                      |   13 +-
 deps/v8/src/unicode-inl.h                     |    5 +-
 deps/v8/src/unicode.h                         |   12 +-
 deps/v8/src/uri.cc                            |    8 +-
 deps/v8/src/utils.cc                          |   47 +
 deps/v8/src/utils.h                           |   86 +-
 deps/v8/src/v8.cc                             |    4 +-
 deps/v8/src/v8memory.h                        |    9 +-
 deps/v8/src/value-serializer.cc               |   75 +-
 deps/v8/src/value-serializer.h                |    2 +
 deps/v8/src/vector.h                          |   66 +-
 deps/v8/src/visitors.h                        |    5 +
 deps/v8/src/vm-state.h                        |    2 +-
 .../wasm/baseline/arm/liftoff-assembler-arm.h |  156 +-
 .../baseline/arm64/liftoff-assembler-arm64.h  |  973 ++-
 .../baseline/ia32/liftoff-assembler-ia32.h    |  729 +-
 .../wasm/baseline/liftoff-assembler-defs.h    |   41 +
 .../v8/src/wasm/baseline/liftoff-assembler.cc |   58 +-
 deps/v8/src/wasm/baseline/liftoff-assembler.h |  183 +-
 deps/v8/src/wasm/baseline/liftoff-compiler.cc | 1059 ++-
 deps/v8/src/wasm/baseline/liftoff-compiler.h  |   39 +
 deps/v8/src/wasm/baseline/liftoff-register.h  |   17 +-
 .../baseline/mips/liftoff-assembler-mips.h    |  773 +-
 .../mips64/liftoff-assembler-mips64.h         |  733 +-
 .../wasm/baseline/ppc/liftoff-assembler-ppc.h |  160 +-
 .../baseline/s390/liftoff-assembler-s390.h    |  160 +-
 .../wasm/baseline/x64/liftoff-assembler-x64.h |  592 +-
 deps/v8/src/wasm/compilation-manager.cc       |   62 -
 deps/v8/src/wasm/compilation-manager.h        |   62 -
 deps/v8/src/wasm/decoder.h                    |    2 +-
 deps/v8/src/wasm/function-body-decoder-impl.h |  824 +-
 deps/v8/src/wasm/function-body-decoder.cc     |  185 +-
 deps/v8/src/wasm/function-body-decoder.h      |   19 +-
 deps/v8/src/wasm/function-compiler.cc         |  149 +
 deps/v8/src/wasm/function-compiler.h          |  112 +
 deps/v8/src/wasm/jump-table-assembler.cc      |  210 +
 deps/v8/src/wasm/jump-table-assembler.h       |   76 +
 deps/v8/src/wasm/local-decl-encoder.cc        |    3 +-
 deps/v8/src/wasm/memory-tracing.cc            |   12 +-
 deps/v8/src/wasm/module-compiler.cc           | 2347 +++--
 deps/v8/src/wasm/module-compiler.h            |   88 +-
 deps/v8/src/wasm/module-decoder.cc            |  251 +-
 deps/v8/src/wasm/module-decoder.h             |   17 +-
 deps/v8/src/wasm/signature-map.cc             |    2 +
 deps/v8/src/wasm/signature-map.h              |    9 +-
 deps/v8/src/wasm/streaming-decoder.cc         |    9 +-
 deps/v8/src/wasm/streaming-decoder.h          |    3 +-
 deps/v8/src/wasm/value-type.h                 |  346 +
 deps/v8/src/wasm/wasm-code-manager.cc         | 1389 ++-
 deps/v8/src/wasm/wasm-code-manager.h          |  405 +-
 deps/v8/src/wasm/wasm-code-specialization.cc  |  226 -
 deps/v8/src/wasm/wasm-code-specialization.h   |   54 -
 deps/v8/src/wasm/wasm-constants.h             |    2 +-
 deps/v8/src/wasm/wasm-debug.cc                |  188 +-
 deps/v8/src/wasm/wasm-engine.cc               |  135 +-
 deps/v8/src/wasm/wasm-engine.h                |   71 +-
 deps/v8/src/wasm/wasm-external-refs.cc        |  197 +-
 deps/v8/src/wasm/wasm-external-refs.h         |   60 +-
 deps/v8/src/wasm/wasm-interpreter.cc          |  995 ++-
 deps/v8/src/wasm/wasm-interpreter.h           |   17 +-
 deps/v8/src/wasm/wasm-js.cc                   |  400 +-
 deps/v8/src/wasm/wasm-linkage.h               |  182 +
 deps/v8/src/wasm/wasm-memory.cc               |  139 +-
 deps/v8/src/wasm/wasm-memory.h                |   53 +-
 deps/v8/src/wasm/wasm-module-builder.cc       |   10 +-
 deps/v8/src/wasm/wasm-module-builder.h        |    6 +-
 deps/v8/src/wasm/wasm-module.cc               |  144 +-
 deps/v8/src/wasm/wasm-module.h                |   80 +-
 deps/v8/src/wasm/wasm-objects-inl.h           |  178 +-
 deps/v8/src/wasm/wasm-objects.cc              | 2352 +++--
 deps/v8/src/wasm/wasm-objects.h               |  490 +-
 deps/v8/src/wasm/wasm-opcodes.cc              |   46 +-
 deps/v8/src/wasm/wasm-opcodes.h               |  346 +-
 deps/v8/src/wasm/wasm-serialization.cc        |  859 +-
 deps/v8/src/wasm/wasm-serialization.h         |    9 +-
 deps/v8/src/wasm/wasm-text.cc                 |   73 +-
 deps/v8/src/wasm/wasm-value.h                 |   88 +-
 deps/v8/src/x64/assembler-x64-inl.h           |   70 +-
 deps/v8/src/x64/assembler-x64.cc              |  111 +-
 deps/v8/src/x64/assembler-x64.h               |   38 +-
 deps/v8/src/x64/code-stubs-x64.cc             |  726 +-
 deps/v8/src/x64/constants-x64.h               |   21 +
 deps/v8/src/x64/deoptimizer-x64.cc            |   12 +-
 deps/v8/src/x64/disasm-x64.cc                 |    4 +-
 deps/v8/src/x64/frame-constants-x64.h         |   16 +
 deps/v8/src/x64/interface-descriptors-x64.cc  |   90 +-
 deps/v8/src/x64/macro-assembler-x64.cc        |  548 +-
 deps/v8/src/x64/macro-assembler-x64.h         |  144 +-
 deps/v8/src/zone/zone-containers.h            |   11 +
 deps/v8/src/zone/zone-segment.cc              |    6 +-
 deps/v8/src/zone/zone-segment.h               |    4 +-
 deps/v8/src/zone/zone.cc                      |   53 +-
 deps/v8/src/zone/zone.h                       |   27 +-
 deps/v8/test/cctest/BUILD.gn                  |   13 +-
 deps/v8/test/cctest/DEPS                      |    1 +
 deps/v8/test/cctest/assembler-helper-arm.cc   |    4 +-
 deps/v8/test/cctest/cctest.h                  |   15 +-
 deps/v8/test/cctest/cctest.status             |   89 +-
 deps/v8/test/cctest/compiler/call-tester.h    |    6 +-
 .../cctest/compiler/code-assembler-tester.h   |   17 +-
 deps/v8/test/cctest/compiler/codegen-tester.h |   21 +-
 .../test/cctest/compiler/function-tester.cc   |   27 +-
 .../cctest/compiler/graph-builder-tester.h    |   12 +-
 .../cctest/compiler/test-code-assembler.cc    |   10 +-
 .../cctest/compiler/test-code-generator.cc    |   28 +-
 .../cctest/compiler/test-graph-visualizer.cc  |   34 +-
 .../compiler/test-instruction-scheduler.cc    |    2 +-
 .../test/cctest/compiler/test-instruction.cc  |    6 +
 .../cctest/compiler/test-js-constant-cache.cc |   23 +-
 .../test-js-context-specialization.cc         |   79 +-
 .../cctest/compiler/test-js-typed-lowering.cc |   92 +-
 .../cctest/compiler/test-jump-threading.cc    |    4 +
 deps/v8/test/cctest/compiler/test-linkage.cc  |    9 +-
 .../cctest/compiler/test-loop-analysis.cc     |    3 +-
 .../cctest/compiler/test-multiple-return.cc   |   62 +-
 .../compiler/test-representation-change.cc    |   16 +-
 .../test-run-bytecode-graph-builder.cc        |   37 +-
 .../test-run-calls-to-external-references.cc  |  340 +-
 .../test/cctest/compiler/test-run-jscalls.cc  |    6 +-
 .../cctest/compiler/test-run-load-store.cc    |    4 +-
 .../test/cctest/compiler/test-run-machops.cc  |   53 +-
 .../cctest/compiler/test-run-native-calls.cc  |    7 +-
 .../v8/test/cctest/compiler/test-run-stubs.cc |   13 +-
 deps/v8/test/cctest/compiler/value-helper.h   |   59 +-
 deps/v8/test/cctest/heap/heap-tester.h        |    9 +-
 deps/v8/test/cctest/heap/heap-utils.cc        |    2 +-
 deps/v8/test/cctest/heap/test-alloc.cc        |   16 +-
 .../cctest/heap/test-array-buffer-tracker.cc  |   67 +-
 deps/v8/test/cctest/heap/test-compaction.cc   |   14 +-
 .../cctest/heap/test-concurrent-marking.cc    |   36 +-
 .../test/cctest/heap/test-embedder-tracing.cc |    2 +-
 deps/v8/test/cctest/heap/test-heap.cc         |  541 +-
 deps/v8/test/cctest/heap/test-lab.cc          |    2 +-
 deps/v8/test/cctest/heap/test-mark-compact.cc |   11 +-
 .../test/cctest/heap/test-page-promotion.cc   |   45 +-
 deps/v8/test/cctest/heap/test-spaces.cc       |   79 +-
 deps/v8/test/cctest/heap/test-unmapper.cc     |   66 +
 .../test/cctest/heap/test-weak-references.cc  |  189 +-
 .../bytecode-expectations-printer.cc          |   10 +-
 .../ArrayLiterals.golden                      |   12 +-
 .../AsyncGenerators.golden                    |  117 +-
 .../bytecode_expectations/BasicLoops.golden   |    7 +-
 .../BreakableBlocks.golden                    |   15 +-
 .../CallAndSpread.golden                      |    8 +-
 .../CallLookupSlot.golden                     |   15 +-
 .../ClassAndSuperClass.golden                 |   20 +-
 .../ClassDeclarations.golden                  |   30 +-
 .../CompoundExpressions.golden                |   11 +-
 .../ConstVariableContextSlot.golden           |   30 +-
 .../ContextParameters.golden                  |   28 +-
 .../ContextVariables.golden                   | 1521 ++--
 .../CountOperators.golden                     |   24 +-
 .../CreateArguments.golden                    |   10 +-
 .../DeclareGlobals.golden                     |    8 +-
 .../bytecode_expectations/Delete.golden       |   17 +-
 .../bytecode_expectations/Eval.golden         |    9 +-
 .../bytecode_expectations/ForAwaitOf.golden   |  192 +-
 .../bytecode_expectations/ForIn.golden        |   14 +-
 .../bytecode_expectations/ForOf.golden        |   92 +-
 .../bytecode_expectations/ForOfLoop.golden    |  652 +-
 .../GenerateTestUndetectable.golden           |   16 +-
 .../bytecode_expectations/Generators.golden   |   26 +-
 .../LetVariableContextSlot.golden             |   30 +-
 .../bytecode_expectations/LoadGlobal.golden   |  654 +-
 .../bytecode_expectations/LookupSlot.golden   |   55 +-
 .../bytecode_expectations/Modules.golden      |  110 +-
 .../bytecode_expectations/NewAndSpread.golden |    8 +-
 .../ObjectLiterals.golden                     |   28 +-
 .../PrivateClassFields.golden                 |    9 +-
 .../bytecode_expectations/PropertyCall.golden |  657 +-
 .../PropertyLoads.golden                      |  778 +-
 .../PropertyStores.golden                     | 1556 ++--
 .../PublicClassFields.golden                  |    9 +-
 .../StandardForLoop.golden                    |   66 +-
 .../StaticClassFields.golden                  |   81 +-
 .../bytecode_expectations/StoreGlobal.golden  | 1312 +--
 .../SuperCallAndSpread.golden                 |   78 +-
 .../TopLevelObjectLiterals.golden             |    4 +-
 .../bytecode_expectations/TryCatch.golden     |   24 +-
 .../bytecode_expectations/TryFinally.golden   |   33 +-
 .../WithStatement.golden                      |    5 +-
 .../interpreter/test-bytecode-generator.cc    |   61 +-
 .../cctest/interpreter/test-interpreter.cc    |  109 +-
 .../interpreter/test-source-positions.cc      |    2 +-
 .../cctest/log-eq-of-logging-and-traversal.js |   12 +-
 .../cctest/parsing/test-parse-decision.cc     |    5 +-
 deps/v8/test/cctest/parsing/test-preparser.cc |   18 +-
 .../cctest/parsing/test-scanner-streams.cc    |   43 +-
 deps/v8/test/cctest/scope-test-helper.h       |    5 +-
 .../v8/test/cctest/test-accessor-assembler.cc |   18 +-
 deps/v8/test/cctest/test-accessors.cc         |    3 +-
 deps/v8/test/cctest/test-api-accessors.cc     |   93 +-
 deps/v8/test/cctest/test-api-interceptors.cc  |    9 +-
 deps/v8/test/cctest/test-api.cc               |  979 ++-
 deps/v8/test/cctest/test-array-list.cc        |    4 +-
 deps/v8/test/cctest/test-assembler-arm.cc     |  249 +-
 deps/v8/test/cctest/test-assembler-arm64.cc   |   16 +-
 deps/v8/test/cctest/test-assembler-ia32.cc    |  106 +-
 deps/v8/test/cctest/test-assembler-mips.cc    |   58 +-
 deps/v8/test/cctest/test-assembler-mips64.cc  |   52 +-
 deps/v8/test/cctest/test-assembler-ppc.cc     |   50 +-
 deps/v8/test/cctest/test-assembler-s390.cc    |  159 +-
 deps/v8/test/cctest/test-assembler-x64.cc     |  138 +-
 deps/v8/test/cctest/test-code-layout.cc       |   23 +-
 .../test/cctest/test-code-stub-assembler.cc   |  328 +-
 deps/v8/test/cctest/test-code-stubs-arm.cc    |    6 +-
 deps/v8/test/cctest/test-code-stubs-arm64.cc  |    8 +-
 deps/v8/test/cctest/test-code-stubs-ia32.cc   |    5 +-
 deps/v8/test/cctest/test-code-stubs-mips.cc   |    6 +-
 deps/v8/test/cctest/test-code-stubs-mips64.cc |    6 +-
 deps/v8/test/cctest/test-code-stubs-x64.cc    |    5 +-
 deps/v8/test/cctest/test-code-stubs.cc        |   10 +-
 deps/v8/test/cctest/test-compiler.cc          |   40 +-
 deps/v8/test/cctest/test-cpu-profiler.cc      |  198 +-
 deps/v8/test/cctest/test-debug.cc             | 4411 +++-------
 deps/v8/test/cctest/test-deoptimization.cc    |    2 -
 deps/v8/test/cctest/test-dictionary.cc        |   16 +-
 deps/v8/test/cctest/test-disasm-arm.cc        |  110 +-
 deps/v8/test/cctest/test-disasm-arm64.cc      |   74 +-
 deps/v8/test/cctest/test-disasm-ia32.cc       |   51 +-
 deps/v8/test/cctest/test-disasm-mips.cc       |   13 +-
 deps/v8/test/cctest/test-disasm-mips64.cc     |   13 +-
 deps/v8/test/cctest/test-disasm-ppc.cc        |    3 +-
 deps/v8/test/cctest/test-disasm-s390.cc       |   10 +-
 deps/v8/test/cctest/test-disasm-x64.cc        |   35 +-
 deps/v8/test/cctest/test-elements-kind.cc     |   85 +-
 deps/v8/test/cctest/test-feedback-vector.cc   |   34 +-
 .../test/cctest/test-field-type-tracking.cc   |  786 +-
 deps/v8/test/cctest/test-flags.cc             |    1 -
 .../test/cctest/test-func-name-inference.cc   |   19 +-
 deps/v8/test/cctest/test-global-handles.cc    |   35 +-
 deps/v8/test/cctest/test-hashcode.cc          |    7 +-
 deps/v8/test/cctest/test-heap-profiler.cc     |  202 +-
 deps/v8/test/cctest/test-identity-map.cc      |   50 +-
 .../cctest/test-inobject-slack-tracking.cc    |   26 +-
 deps/v8/test/cctest/test-inspector.cc         |   65 +
 deps/v8/test/cctest/test-intl.cc              |  197 +-
 .../test-isolate-independent-builtins.cc      |   90 +-
 deps/v8/test/cctest/test-liveedit.cc          |  520 +-
 deps/v8/test/cctest/test-log-stack-tracer.cc  |   29 +-
 deps/v8/test/cctest/test-log.cc               |   71 +-
 .../test/cctest/test-macro-assembler-arm.cc   |    8 +-
 .../test/cctest/test-macro-assembler-mips.cc  |  128 +-
 .../cctest/test-macro-assembler-mips64.cc     |  105 +-
 .../test/cctest/test-macro-assembler-x64.cc   |   71 +-
 deps/v8/test/cctest/test-managed.cc           |  185 +-
 deps/v8/test/cctest/test-mementos.cc          |    4 +-
 deps/v8/test/cctest/test-object.cc            |   14 +-
 deps/v8/test/cctest/test-orderedhashtable.cc  |  704 +-
 deps/v8/test/cctest/test-parsing.cc           |  160 +-
 deps/v8/test/cctest/test-profile-generator.cc |  164 +-
 deps/v8/test/cctest/test-regexp.cc            |   40 +-
 deps/v8/test/cctest/test-roots.cc             |  121 +
 deps/v8/test/cctest/test-serialize.cc         |  423 +-
 deps/v8/test/cctest/test-strings.cc           |   79 +-
 deps/v8/test/cctest/test-symbols.cc           |    6 +-
 .../v8/test/cctest/test-thread-termination.cc |  178 +
 deps/v8/test/cctest/test-trace-event.cc       |   10 +-
 deps/v8/test/cctest/test-transitions.cc       |   81 +-
 deps/v8/test/cctest/test-transitions.h        |    9 +-
 deps/v8/test/cctest/test-types.cc             |  758 +-
 deps/v8/test/cctest/test-unboxed-doubles.cc   |  175 +-
 deps/v8/test/cctest/test-weakmaps.cc          |   37 +-
 deps/v8/test/cctest/test-weaksets.cc          |   39 +-
 deps/v8/test/cctest/torque/test-torque.cc     |  205 +
 deps/v8/test/cctest/trace-extension.cc        |   25 +-
 deps/v8/test/cctest/types-fuzz.h              |   91 +-
 deps/v8/test/cctest/wasm/test-c-wasm-entry.cc |   16 +-
 deps/v8/test/cctest/wasm/test-run-wasm-64.cc  |   40 +-
 .../test/cctest/wasm/test-run-wasm-atomics.cc |   38 +-
 .../cctest/wasm/test-run-wasm-atomics64.cc    |  125 +-
 .../test/cctest/wasm/test-run-wasm-module.cc  |  356 +-
 .../wasm/test-run-wasm-sign-extension.cc      |   17 +-
 .../v8/test/cctest/wasm/test-run-wasm-simd.cc |  998 ++-
 deps/v8/test/cctest/wasm/test-run-wasm.cc     |  297 +-
 .../cctest/wasm/test-streaming-compilation.cc |   57 +-
 .../test/cctest/wasm/test-wasm-breakpoints.cc |   41 +-
 deps/v8/test/cctest/wasm/test-wasm-codegen.cc |    8 +-
 .../cctest/wasm/test-wasm-serialization.cc    |  319 +
 .../cctest/wasm/test-wasm-shared-engine.cc    |  198 +
 deps/v8/test/cctest/wasm/test-wasm-stack.cc   |    3 +-
 .../cctest/wasm/test-wasm-trap-position.cc    |    8 +-
 deps/v8/test/cctest/wasm/wasm-atomics-utils.h |    1 -
 deps/v8/test/cctest/wasm/wasm-run-utils.cc    |  251 +-
 deps/v8/test/cctest/wasm/wasm-run-utils.h     |  102 +-
 deps/v8/test/common/wasm/wasm-macro-gen.h     |   20 +-
 .../v8/test/common/wasm/wasm-module-runner.cc |   12 +-
 deps/v8/test/common/wasm/wasm-module-runner.h |    5 +-
 .../test/debugger/debug/debug-break-native.js |    1 -
 .../test/debugger/debug/debug-break-return.js |   40 +
 .../debug/debug-live-edit-recursion.js        |   40 +
 .../test/debugger/debug/debug-liveedit-1.js   |    9 +-
 .../test/debugger/debug/debug-liveedit-2.js   |   14 +-
 .../test/debugger/debug/debug-liveedit-3.js   |   13 +-
 .../test/debugger/debug/debug-liveedit-4.js   |    9 +-
 .../debug/debug-liveedit-check-stack.js       |   34 +-
 .../debug/debug-liveedit-compile-error.js     |   18 +-
 .../debugger/debug/debug-liveedit-diff.js     |  110 -
 .../debug/debug-liveedit-double-call.js       |    5 +-
 .../debug/debug-liveedit-exceptions.js        |    7 +-
 .../debugger/debug/debug-liveedit-inline.js   |   14 +-
 .../debugger/debug/debug-liveedit-literals.js |   12 +-
 .../debug/debug-liveedit-newsource.js         |   10 +-
 .../debug-liveedit-patch-positions-replace.js |   19 +-
 .../debug/debug-liveedit-replace-code.js      |   10 +-
 .../debugger/debug/debug-liveedit-stepin.js   |    8 +-
 .../debugger/debug/debug-liveedit-utils.js    |   93 -
 .../debug/debug-modules-set-variable-value.js |    2 +-
 deps/v8/test/debugger/debug/debug-scopes.js   |   89 +-
 deps/v8/test/debugger/debug/debug-script.js   |  112 -
 .../debugger/debug/debug-setbreakpoint.js     |  139 -
 .../test/debugger/debug/debug-sourceinfo.js   |  203 -
 .../debug/debug-step-end-of-script.js         |    2 +-
 .../debugger/debug/debug-step-microtask.js    |    2 +-
 .../debugger/debug/deserialize-script-id.js   |    8 +-
 .../debug/es6/debug-liveedit-new-target-1.js  |   12 +-
 .../debug/es6/debug-liveedit-new-target-2.js  |   12 +-
 .../debug/es6/debug-liveedit-new-target-3.js  |    9 +-
 .../debug/es6/generators-debug-liveedit.js    |   28 +-
 .../debug/es8/debug-async-liveedit.js         |   37 +-
 .../debugger/debug/es8/promise-finally.js     |    2 -
 .../debug/harmony/modules-debug-scopes1.js    |    6 +-
 .../debug/harmony/modules-debug-scopes2.js    |    6 +-
 .../debugger/debug/regress/regress-1853.js    |  100 -
 .../debugger/debug/regress/regress-2825.js    |    2 +-
 .../debugger/debug/regress/regress-419663.js  |   32 -
 .../debugger/debug/regress/regress-5164.js    |   12 +-
 .../debug/regress/regress-crbug-424142.js     |   38 -
 .../debug/regress/regress-crbug-481896.js     |   55 -
 .../debug/regress/regress-crbug-517592.js     |   34 -
 ...ebug-evaluate-no-side-effect-builtins-2.js |   10 +-
 .../debug-evaluate-no-side-effect-builtins.js |   22 +-
 .../debug-evaluate-no-side-effect-control.js  |   12 +-
 .../debug-evaluate-no-side-effect-ops.js      |    4 +-
 .../debug-evaluate-no-side-effect-regexp.js   |   28 +
 ...g-evaluate-no-side-effect-runtime-check.js |  133 +-
 .../debug-evaluate-no-side-effect.js          |    1 +
 deps/v8/test/debugger/debugger.status         |   21 +-
 .../debugger/regress/regress-crbug-840288.js  |   25 +
 deps/v8/test/debugger/test-api.js             |  126 +-
 deps/v8/test/fuzzer/multi-return.cc           |   33 +-
 deps/v8/test/fuzzer/parser.cc                 |    2 +-
 deps/v8/test/fuzzer/regexp.cc                 |    5 +-
 deps/v8/test/fuzzer/wasm-async.cc             |   73 +-
 deps/v8/test/fuzzer/wasm-compile.cc           |    2 +-
 deps/v8/test/fuzzer/wasm-fuzzer-common.cc     |   37 +-
 deps/v8/test/fuzzer/wasm-fuzzer-common.h      |    3 +
 deps/v8/test/fuzzer/wasm.cc                   |   14 +-
 deps/v8/test/inspector/BUILD.gn               |    1 -
 deps/v8/test/inspector/PRESUBMIT.py           |   25 +
 ...nc-for-await-of-promise-stack-expected.txt |   42 +-
 .../async-for-await-of-promise-stack.js       |   15 +-
 .../async-function-step-out-expected.txt      |  209 +
 ...c-function-step-out-optimized-expected.txt |  215 +
 .../async-function-step-out-optimized.js      |  187 +
 .../debugger/async-function-step-out.js       |  185 +
 .../debugger/async-stack-await-expected.txt   |   10 +-
 .../inspector/debugger/async-stack-await.js   |    5 +-
 ...-locations-var-init-optimized-expected.txt |  200 +
 .../break-locations-var-init-optimized.js     |   76 +
 .../break-on-exception-and-step-expected.txt  |  145 +
 .../debugger/break-on-exception-and-step.js   |   69 +
 ...-on-exception-compiler-errors-expected.txt |   91 +
 .../break-on-exception-compiler-errors.js     |   52 +
 .../debugger/break-on-exception-expected.txt  |  162 +-
 .../inspector/debugger/break-on-exception.js  |  175 +-
 ...o-location-target-call-frames-expected.txt |    4 +-
 .../disable-agent-on-pause-expected.txt       |    4 +
 .../debugger/disable-agent-on-pause.js        |   27 +
 ...snt-step-into-injected-script-expected.txt |    4 +-
 .../evaluate-on-call-frame-expected.txt       |   78 +
 ...luate-on-call-frame-in-module-expected.txt |   76 +-
 ...valuate-on-call-frame-timeout-expected.txt |    7 +
 .../evaluate-on-call-frame-timeout.js         |   40 +
 .../debugger/evaluate-on-call-frame.js        |  113 +
 .../debugger/external-stack-trace.js          |    1 +
 .../debugger/for-of-loops-expected.txt        |    2 +-
 ...mework-nested-scheduled-break-expected.txt |    2 +-
 .../framework-precise-ranges-expected.txt     |   19 -
 ...ble-breakpoints-array-literal-expected.txt |    6 -
 .../get-possible-breakpoints-expected.txt     |   49 +-
 ...ssible-breakpoints-lazy-error-expected.txt |   18 +
 ...t-possible-breakpoints-master-expected.txt |    2 +-
 .../debugger/get-possible-breakpoints.js      |    3 +-
 .../inspector/debugger/pause-expected.txt     |   16 +-
 ...e-inside-blackboxed-optimized-expected.txt |    4 +
 .../pause-inside-blackboxed-optimized.js      |   38 +
 .../debugger/pause-on-async-call-expected.txt |   22 +-
 .../inspector/debugger/pause-on-async-call.js |    1 +
 .../regress-crbug-481896-expected.txt         |   20 +
 .../debugger/regress-crbug-481896.js          |   57 +
 .../debugger/regression-1853-expected.txt     |   22 +
 .../inspector/debugger/regression-1853.js     |   59 +
 .../debugger/regression-419663-expected.txt   |    6 +
 .../inspector/debugger/regression-419663.js   |   28 +
 .../debugger/regression-424142-expected.txt   |    6 +
 .../inspector/debugger/regression-424142.js   |   37 +
 ...move-breakpoint-at-breakpoint-expected.txt |    8 +
 .../remove-breakpoint-at-breakpoint.js        |   28 +
 .../return-break-locations-expected.txt       |    4 +-
 .../schedule-step-into-async-expected.txt     |   14 +-
 ...e-step-into-async-set-timeout-expected.txt |    4 +-
 .../debugger/schedule-step-into-async.js      |    1 +
 ...set-breakpoint-after-liveedit-expected.txt |   19 +
 .../debugger/set-breakpoint-after-liveedit.js |   39 +
 .../set-breakpoint-at-last-line-expected.txt  |    9 +-
 .../debugger/set-breakpoint-expected.txt      |   48 +
 ...t-breakpoint-on-function-call-expected.txt |   36 +
 .../set-breakpoint-on-function-call.js        |   66 +
 .../test/inspector/debugger/set-breakpoint.js |  124 +
 .../debugger/set-script-source-2-expected.txt |   20 +-
 .../inspector/debugger/set-script-source-2.js |   10 +-
 .../set-script-source-exception-expected.txt  |    6 +-
 .../debugger/set-script-source-exception.js   |   25 +-
 .../debugger/set-script-source-expected.txt   |   25 +-
 ...t-script-source-stack-padding-expected.txt |   15 +
 .../set-script-source-stack-padding.js        |   54 +
 .../inspector/debugger/set-script-source.js   |  176 +-
 ...step-into-break-on-async-call-expected.txt |    4 +-
 .../debugger/step-into-break-on-async-call.js |    4 +
 .../inspector/debugger/step-into-expected.txt |    6 +-
 ...step-into-external-async-task-expected.txt |    2 +-
 ...ernal-async-task-same-context-expected.txt |    2 +-
 .../step-into-nested-arrow-expected.txt       |    2 +-
 .../step-into-next-script-expected.txt        |   14 +-
 .../debugger/step-into-out-expected.txt       |  169 +
 .../test/inspector/debugger/step-into-out.js  |   89 +
 .../debugger/step-snapshot-expected.txt       |    2 +-
 .../debugger/stepping-tail-call-expected.txt  |   21 +-
 ...g-with-natives-and-frameworks-expected.txt |   34 +-
 .../suspended-generator-scopes-expected.txt   |   24 +-
 .../terminate-execution-on-pause-expected.txt |    5 +
 .../debugger/terminate-execution-on-pause.js  |   43 +
 .../debugger/wasm-set-breakpoint-expected.txt |   62 +
 .../inspector/debugger/wasm-set-breakpoint.js |  158 +
 deps/v8/test/inspector/inspector-test.cc      |   47 +-
 deps/v8/test/inspector/inspector.status       |   20 +-
 deps/v8/test/inspector/isolate-data.cc        |    1 +
 deps/v8/test/inspector/protocol-test.js       |    9 +-
 .../runtime/add-binding-expected.txt          |   99 +
 deps/v8/test/inspector/runtime/add-binding.js |   82 +
 ...line-api-without-side-effects-expected.txt |  134 +
 .../command-line-api-without-side-effects.js  |   83 +
 .../runtime/console-context-expected.txt      |   12 +-
 .../console-deprecated-methods-expected.txt   |    4 -
 .../runtime/console-deprecated-methods.js     |   28 -
 .../runtime/console-methods-expected.txt      |  128 +
 .../test/inspector/runtime/console-methods.js |    7 +
 .../runtime/enable-async-stack-expected.txt   |   31 +
 .../inspector/runtime/enable-async-stack.js   |   19 +
 .../runtime/evaluate-timeout-expected.txt     |    7 +
 .../inspector/runtime/evaluate-timeout.js     |   34 +
 ...evaluate-without-side-effects-expected.txt |    2 +-
 .../runtime/function-location-expected.txt    |   16 +
 .../inspector/runtime/function-location.js    |   56 +
 .../set-max-call-stack-size-expected.txt      |   97 +
 .../runtime/set-max-call-stack-size.js        |   37 +
 ...gger-stepping-and-breakpoints-expected.txt |    3 +
 .../debugger-stepping-and-breakpoints.js      |    9 +
 .../type-profiler/type-profile-expected.txt   |    3 +-
 .../type-profile-with-classes-expected.txt    |    3 +-
 ...pe-profile-with-to-string-tag-expected.txt |    3 +-
 .../test/intl/date-format/month-far-future.js |    6 +-
 .../language_tags_with_preferred_values.js    |   29 +
 .../test/intl/general/supported-locales-of.js |   42 +-
 deps/v8/test/intl/intl.status                 |   10 +-
 .../intl/locale/locale-canonicalization.js    |   24 +
 .../v8/test/intl/locale/locale-constructor.js |  176 +
 deps/v8/test/intl/locale/locale-properties.js |   35 +
 .../intl/relative-time-format/constructor.js  |  103 +
 .../default-locale-fr-CA.js                   |   14 +
 .../default-locale-pt-BR.js                   |   14 +
 .../relative-time-format/resolved-options.js  |  162 +
 deps/v8/test/intl/testcfg.py                  |   17 +
 deps/v8/test/js-perf-test/Array/from.js       |  293 +-
 deps/v8/test/js-perf-test/Array/join.js       |    8 +-
 deps/v8/test/js-perf-test/Array/of.js         |  224 +-
 deps/v8/test/js-perf-test/Array/run.js        |   10 +-
 deps/v8/test/js-perf-test/Array/slice.js      |   83 +
 deps/v8/test/js-perf-test/Array/to-string.js  |    9 +-
 deps/v8/test/js-perf-test/ArraySort/run.js    |    9 +-
 .../test/js-perf-test/ArraySort/sort-base.js  |  145 +
 .../ArraySort/sort-cmpfn-kindchange.js        |   43 +
 .../test/js-perf-test/ArraySort/sort-cmpfn.js |   20 +
 .../js-perf-test/ArraySort/sort-lengths.js    |   40 +
 .../ArraySort/sort-megamorphic.js             |   20 +
 .../js-perf-test/ArraySort/sort-presorted.js  |  108 +
 deps/v8/test/js-perf-test/ArraySort/sort.js   |   99 +-
 .../js-perf-test/DataView/dataviewtest.js     |  210 +
 deps/v8/test/js-perf-test/DataView/run.js     |   24 +
 .../test/js-perf-test/Inspector/debugger.js   |  120 +-
 deps/v8/test/js-perf-test/JSTests.json        |  186 +-
 deps/v8/test/js-perf-test/RegExp.json         |    5 +-
 .../test/js-perf-test/RegExp/RegExpTests.json |    4 +-
 .../test/js-perf-test/RegExp/inline_test.js   |   17 +
 deps/v8/test/js-perf-test/RegExp/run.js       |    1 +
 deps/v8/test/js-perf-test/SixSpeed.json       |    1 +
 deps/v8/test/js-perf-test/Strings/run.js      |    1 -
 .../test/js-perf-test/Strings/string-split.js |   81 +
 .../Strings/string-startsendswith-comp.js     |   47 +
 .../Strings/string-stringat-comp.js           |   18 +-
 .../js-perf-test/Strings/string-substring.js  |   46 +-
 .../js-perf-test/TypedArrays/sort-bigint.js   |    8 +
 .../TypedArrays/sort-cmpfn-bigint.js          |    9 +
 deps/v8/test/js-perf-test/TypedArrays/sort.js |   23 +-
 deps/v8/test/js-perf-test/base.js             |   10 +-
 deps/v8/test/memory/Memory.json               |   19 +-
 .../assert-promise-result-rejects-empty.js    |   11 +
 .../assert-promise-result-rejects-empty.out   |   12 +
 ...promise-result-rejects-with-throw-empty.js |   14 +
 ...romise-result-rejects-with-throw-empty.out |   10 +
 .../fail/assert-promise-result-rejects.js     |   11 +
 .../fail/assert-promise-result-rejects.out    |   12 +
 .../fail/assert-promise-result-resolves.js    |   11 +
 .../fail/assert-promise-result-resolves.out   |   13 +
 .../success/assert-promise-result-rejects.js  |   12 +
 .../success/assert-promise-result-rejects.out |    1 +
 .../assert-promise-result-resolves-empty.js   |   16 +
 .../assert-promise-result-resolves-empty.out  |    0
 .../success/assert-promise-result-resolves.js |   11 +
 .../assert-promise-result-resolves.out        |    1 +
 .../test/message/regress/fail/regress-73.js   |   12 +-
 .../regress/fail/regress-crbug-842101.js      |   18 +
 .../regress/fail/regress-crbug-842101.out     |   10 +
 .../test/message/wasm-function-name-async.out |    2 +-
 .../message/wasm-function-name-streaming.out  |    2 +-
 .../wasm-module-and-function-name-async.out   |    2 +-
 ...asm-module-and-function-name-streaming.out |    2 +-
 .../test/message/wasm-module-name-async.out   |    2 +-
 .../message/wasm-module-name-streaming.out    |    2 +-
 deps/v8/test/message/wasm-no-name-async.out   |    2 +-
 .../test/message/wasm-no-name-streaming.out   |    2 +-
 .../test/message/wasm-trace-memory-liftoff.js |    3 +-
 deps/v8/test/message/wasm-trace-memory.js     |    3 +-
 deps/v8/test/mjsunit/allocation-site-info.js  |    6 +
 deps/v8/test/mjsunit/apply.js                 |    1 +
 deps/v8/test/mjsunit/array-constructor.js     |   51 +-
 deps/v8/test/mjsunit/array-sort.js            |  311 +-
 .../test/mjsunit/async-hooks/api-methods.js   |   76 +
 .../mjsunit/async-hooks/async-await-tree.js   |   74 +
 .../chained-promises.js}                      |   33 +-
 .../mjsunit/async-hooks/execution-order.js    |   65 +
 .../async-hooks/promises-async-await.js       |   70 +
 deps/v8/test/mjsunit/code-comments.js         |   26 +
 deps/v8/test/mjsunit/code-coverage-utils.js   |    2 +-
 deps/v8/test/mjsunit/compiler/alloc-number.js |   35 +-
 .../v8/test/mjsunit/compiler/array-species.js |   33 +
 ...-no-harmony-restrict-constructor-return.js |   12 -
 .../mjsunit/compiler/constructor-inlining.js  |   27 +-
 deps/v8/test/mjsunit/compiler/dataview-get.js |  173 +
 deps/v8/test/mjsunit/compiler/dataview-set.js |  133 +
 .../v8/test/mjsunit/compiler/object-create.js |   27 +
 deps/v8/test/mjsunit/compiler/osr-nested.js   |   11 +-
 deps/v8/test/mjsunit/compiler/osr-one.js      |   36 +-
 deps/v8/test/mjsunit/compiler/osr-two.js      |   38 +-
 .../test/mjsunit/compiler/promise-species.js  |   29 +
 .../test/mjsunit/compiler/regress-841117.js   |   11 +
 .../mjsunit/compiler/string-concat-deopt.js   |   12 +-
 deps/v8/test/mjsunit/date.js                  |    5 +
 deps/v8/test/mjsunit/es6/dataview-length.js   |    7 +
 deps/v8/test/mjsunit/es6/reflect.js           |    2 -
 .../test/mjsunit/es6/regress/regress-7706.js  |   16 +
 .../es6/typedarray-construct-by-array-like.js |    4 +-
 .../es6/typedarray-keyedstore-tonumber.js     |   69 +
 deps/v8/test/mjsunit/es6/typedarray-sort.js   |   56 +
 .../es8/async-await-interleaved.js}           |   85 +-
 .../es8/constructor-returning-primitive.js    |  318 -
 deps/v8/test/mjsunit/fast-literal.js          |    2 +-
 .../test/mjsunit/generated-transition-stub.js |   67 +-
 .../mjsunit/harmony/array-flat-species.js     |   31 +
 deps/v8/test/mjsunit/harmony/array-flat.js    |   65 +
 .../mjsunit/harmony/array-flatMap-species.js  |   31 +
 deps/v8/test/mjsunit/harmony/array-flatMap.js |  174 +-
 deps/v8/test/mjsunit/harmony/array-flatten.js |   38 -
 .../mjsunit/harmony/async-generators-basic.js |   25 +-
 deps/v8/test/mjsunit/harmony/bigint/basics.js |    6 +-
 .../mjsunit/harmony/bigint/comparisons.js     |    8 +-
 .../test/mjsunit/harmony/bigint/dataview.js   |   10 +
 .../bigintarray-keyedstore-tobigint.js        |   64 +
 .../test/mjsunit/harmony/function-tostring.js |   24 +
 .../test/mjsunit/harmony/modules-import-9.js  |    2 +-
 .../harmony/optional-catch-binding-breaks.js  |    2 -
 .../mjsunit/harmony/optional-catch-binding.js |    2 -
 .../harmony/promise-prototype-finally.js      |    2 +-
 .../harmony/public-instance-class-fields.js   |   22 +-
 .../mjsunit/harmony/regexp-named-captures.js  |    2 +-
 .../mjsunit/harmony/regexp-property-binary.js |    2 -
 .../harmony/regexp-property-char-class.js     |    2 -
 .../harmony/regexp-property-disabled.js       |   18 -
 .../harmony/regexp-property-enumerated.js     |    2 -
 .../harmony/regexp-property-exact-match.js    |    2 -
 .../regexp-property-general-category.js       |    2 -
 .../harmony/regexp-property-invalid.js        |    2 -
 .../mjsunit/harmony/regexp-property-lu-ui0.js |    1 -
 .../mjsunit/harmony/regexp-property-lu-ui1.js |    1 -
 .../mjsunit/harmony/regexp-property-lu-ui2.js |    1 -
 .../mjsunit/harmony/regexp-property-lu-ui3.js |    1 -
 .../mjsunit/harmony/regexp-property-lu-ui4.js |    1 -
 .../mjsunit/harmony/regexp-property-lu-ui5.js |    1 -
 .../mjsunit/harmony/regexp-property-lu-ui6.js |    1 -
 .../mjsunit/harmony/regexp-property-lu-ui7.js |    1 -
 .../mjsunit/harmony/regexp-property-lu-ui8.js |    1 -
 .../mjsunit/harmony/regexp-property-lu-ui9.js |    1 -
 .../regexp-property-script-extensions.js      | 3010 +------
 .../harmony/regexp-property-scripts.js        |    2 -
 .../harmony/regexp-property-special.js        |    2 -
 .../mjsunit/harmony/symbol-description.js     |   53 +
 .../v8/test/mjsunit/ignition/throw-if-hole.js |    2 +-
 .../mjsunit/ignition/throw-if-not-hole.js     |    6 +-
 .../ignition/throw-super-not-called.js        |    2 +-
 .../intl-numberformat-formattoparts.js        |    3 -
 .../{harmony => }/intl-pluralrules-select.js  |    2 -
 deps/v8/test/mjsunit/lexicographic-compare.js |   62 +
 deps/v8/test/mjsunit/linecontinuation.js      |   40 +
 deps/v8/test/mjsunit/messages.js              |   21 +-
 deps/v8/test/mjsunit/mjsunit.js               |   78 +-
 deps/v8/test/mjsunit/mjsunit.status           |   92 +-
 deps/v8/test/mjsunit/object-keys.js           |   58 +
 .../proto-elements-add-during-foreach.js      |   40 +-
 .../regexp-modifiers-autogenerated-i18n.js    |    2 +-
 .../mjsunit/regexp-modifiers-autogenerated.js |    2 +-
 .../v8/test/mjsunit/regress/regress-165637.js |   51 +-
 .../v8/test/mjsunit/regress/regress-2185-2.js |  145 -
 .../v8/test/mjsunit/regress/regress-298269.js |   35 +-
 .../v8/test/mjsunit/regress/regress-373283.js |   18 -
 .../v8/test/mjsunit/regress/regress-484544.js |    2 +-
 .../v8/test/mjsunit/regress/regress-705934.js |    4 +-
 .../v8/test/mjsunit/regress/regress-707410.js |    3 +-
 .../v8/test/mjsunit/regress/regress-747075.js |    9 +-
 deps/v8/test/mjsunit/regress/regress-7642.js  |   58 +
 deps/v8/test/mjsunit/regress/regress-7652.js  |   26 +
 deps/v8/test/mjsunit/regress/regress-7677.js  |   63 +
 deps/v8/test/mjsunit/regress/regress-7716.js  |   51 +
 deps/v8/test/mjsunit/regress/regress-7791.js  |  120 +
 deps/v8/test/mjsunit/regress/regress-7893.js  |   18 +
 .../v8/test/mjsunit/regress/regress-793588.js |    2 -
 .../v8/test/mjsunit/regress/regress-793793.js |    2 -
 .../v8/test/mjsunit/regress/regress-800651.js |    8 +-
 .../v8/test/mjsunit/regress/regress-829889.js |   17 -
 .../v8/test/mjsunit/regress/regress-838766.js |   14 +
 .../v8/test/mjsunit/regress/regress-840106.js |   17 +
 .../v8/test/mjsunit/regress/regress-842078.js |   14 +
 .../test/mjsunit/regress/regress-843062-1.js  |   18 +
 .../test/mjsunit/regress/regress-843062-2.js  |    8 +
 .../test/mjsunit/regress/regress-843062-3.js  |   10 +
 .../v8/test/mjsunit/regress/regress-849663.js |    7 +
 .../v8/test/mjsunit/regress/regress-852258.js |   11 +
 .../test/mjsunit/regress/regress-854066-2.js  |   14 +
 .../v8/test/mjsunit/regress/regress-854066.js |   13 +
 .../mjsunit/regress/regress-crbug-217858.js   |   32 +-
 .../mjsunit/regress/regress-crbug-347903.js   |    2 +-
 .../mjsunit/regress/regress-crbug-410033.js   |    7 -
 .../mjsunit/regress/regress-crbug-469480.js   |   13 -
 .../mjsunit/regress/regress-crbug-491062.js   |    2 +-
 .../mjsunit/regress/regress-crbug-505007-1.js |   18 -
 .../mjsunit/regress/regress-crbug-506443.js   |   89 -
 .../mjsunit/regress/regress-crbug-582703.js   |    8 -
 .../mjsunit/regress/regress-crbug-724153.js   |    2 +-
 .../mjsunit/regress/regress-crbug-743154.js   |    2 +
 .../mjsunit/regress/regress-crbug-779344.js   |    4 +-
 .../mjsunit/regress/regress-crbug-7907.js     |    9 +
 .../mjsunit/regress/regress-crbug-823130.js   |   40 +
 .../mjsunit/regress/regress-crbug-840220.js   |   12 +
 .../mjsunit/regress/regress-crbug-841592.js   |   21 +
 .../mjsunit/regress/regress-crbug-848165.js   |    9 +
 .../mjsunit/regress/regress-crbug-849024.js   |   43 +
 .../mjsunit/regress/regress-crbug-850005.js   |   11 +
 .../mjsunit/regress/regress-crbug-851393.js   |    7 +
 .../mjsunit/regress/regress-crbug-852592.js   |   25 +
 .../mjsunit/regress/regress-crbug-854299.js   |   27 +
 .../mjsunit/regress/regress-crbug-856095.js   |   14 +
 .../mjsunit/regress/regress-crbug-859809.js   |   21 +
 .../mjsunit/regress/regress-crbug-860788.js   |   30 +
 .../mjsunit/regress/regress-deep-proto.js     |   16 +-
 .../test/mjsunit/regress/regress-v8-7682.js   |   22 +
 .../test/mjsunit/regress/regress-v8-7725.js   |   11 +
 .../test/mjsunit/regress/wasm/regress-7785.js |   44 +
 .../test/mjsunit/regress/wasm/regress-7914.js |   18 +
 .../mjsunit/regress/wasm/regress-799952.js    |   23 +
 .../mjsunit/regress/wasm/regress-834624.js    |   30 +
 .../mjsunit/regress/wasm/regress-834693.js    |   20 +
 .../mjsunit/regress/wasm/regress-837417.js    |   15 +-
 .../mjsunit/regress/wasm/regress-840757.js    |   21 +
 .../mjsunit/regress/wasm/regress-842501.js    |   35 +
 .../mjsunit/regress/wasm/regress-843563.js    |   20 +
 .../mjsunit/regress/wasm/regress-853453.js    |   18 +
 .../mjsunit/regress/wasm/regress-854011.js    |   47 +
 .../mjsunit/regress/wasm/regress-854050.js    |   28 +
 deps/v8/test/mjsunit/stack-traces-2.js        |   17 -
 deps/v8/test/mjsunit/string-split.js          |    9 +
 .../mjsunit/tools/compiler-trace-flags.js     |   36 +
 .../test/mjsunit/tools/profviz-test.default   |   20 +-
 deps/v8/test/mjsunit/wasm/async-compile.js    |    4 +-
 .../wasm/compiled-module-management.js        |   28 +-
 .../wasm/compiled-module-serialization.js     |  141 +
 .../mjsunit/wasm/default-liftoff-setting.js   |   21 -
 deps/v8/test/mjsunit/wasm/export-global.js    |   34 -
 .../mjsunit/wasm/export-mutable-global.js     |  101 +
 deps/v8/test/mjsunit/wasm/globals.js          |    8 +-
 deps/v8/test/mjsunit/wasm/import-function.js  |   96 +-
 .../mjsunit/wasm/import-mutable-global.js     |  201 +
 deps/v8/test/mjsunit/wasm/indirect-tables.js  |   38 -
 deps/v8/test/mjsunit/wasm/interpreter.js      |   25 +
 deps/v8/test/mjsunit/wasm/liftoff.js          |    1 +
 deps/v8/test/mjsunit/wasm/module-memory.js    |   14 +-
 deps/v8/test/mjsunit/wasm/mutable-globals.js  |   65 +-
 deps/v8/test/mjsunit/wasm/print-code.js       |   32 +
 .../mjsunit/wasm/serialize-lazy-module.js     |   68 +
 deps/v8/test/mjsunit/wasm/start-function.js   |   21 +-
 .../mjsunit/wasm/trap-handler-fallback.js     |  202 +
 .../test/mjsunit/wasm/wasm-module-builder.js  |    4 +-
 deps/v8/test/mjsunit/wasm/worker-memory.js    |   16 +
 deps/v8/test/mjsunit/wasm/worker-module.js    |   34 +
 deps/v8/test/mkgrokdump/BUILD.gn              |    1 -
 deps/v8/test/mkgrokdump/mkgrokdump.cc         |   32 +-
 deps/v8/test/mozilla/mozilla.status           |    4 +-
 deps/v8/test/test262/harness-agent.js         |   12 +-
 deps/v8/test/test262/test262.status           |  412 +-
 deps/v8/test/test262/testcfg.py               |   11 +-
 deps/v8/test/torque/test-torque.tq            |  231 +
 deps/v8/test/unittests/BUILD.gn               |    7 +-
 deps/v8/test/unittests/allocation-unittest.cc |    1 +
 deps/v8/test/unittests/base/list-unittest.cc  |   92 +
 .../unittests/base/platform/time-unittest.cc  |    9 +
 .../unittests/code-stub-assembler-unittest.cc |    6 +-
 .../compiler-dispatcher-unittest.cc           |   33 +-
 .../optimizing-compile-dispatcher-unittest.cc |    4 +-
 .../unoptimized-compile-job-unittest.cc       |   25 +-
 .../arm/instruction-selector-arm-unittest.cc  |   48 +
 .../instruction-selector-arm64-unittest.cc    |   89 +
 .../compiler/code-assembler-unittest.cc       |    6 +-
 .../common-operator-reducer-unittest.cc       |    4 +-
 .../constant-folding-reducer-unittest.cc      |  234 +
 .../compiler/control-equivalence-unittest.cc  |    5 +-
 .../effect-control-linearizer-unittest.cc     |   12 +-
 .../test/unittests/compiler/graph-unittest.cc |   12 +-
 .../test/unittests/compiler/graph-unittest.h  |    7 +-
 .../instruction-selector-ia32-unittest.cc     |   52 +
 .../compiler/instruction-selector-unittest.cc |  280 +-
 .../compiler/instruction-selector-unittest.h  |    2 +-
 .../compiler/instruction-sequence-unittest.cc |    5 +
 .../compiler/int64-lowering-unittest.cc       |   21 +-
 .../compiler/js-builtin-reducer-unittest.cc   |  242 -
 .../compiler/js-call-reducer-unittest.cc      |  100 +-
 .../compiler/js-create-lowering-unittest.cc   |   44 +-
 .../compiler/js-typed-lowering-unittest.cc    |   10 +-
 .../compiler/loop-peeling-unittest.cc         |   18 +-
 .../machine-operator-reducer-unittest.cc      |    3 +-
 .../unittests/compiler/node-test-utils.cc     |    7 +-
 .../test/unittests/compiler/node-test-utils.h |    4 +
 .../regalloc/move-optimizer-unittest.cc       |   12 +-
 .../unittests/compiler/scheduler-unittest.cc  |    8 +-
 .../compiler/simplified-lowering-unittest.cc  |    6 +-
 .../simplified-operator-reducer-unittest.cc   |    4 +-
 .../compiler/typed-optimization-unittest.cc   |  170 +-
 .../test/unittests/compiler/typer-unittest.cc |  165 +-
 .../x64/instruction-selector-x64-unittest.cc  |   52 +
 .../heap/embedder-tracing-unittest.cc         |   12 +-
 .../test/unittests/heap/gc-tracer-unittest.cc |   59 +
 .../heap/heap-controller-unittest.cc          |  118 +
 deps/v8/test/unittests/heap/heap-unittest.cc  |   57 -
 .../test/unittests/heap/slot-set-unittest.cc  |   16 +-
 .../v8/test/unittests/heap/spaces-unittest.cc |    1 -
 .../test/unittests/heap/unmapper-unittest.cc  |    4 +-
 .../test/unittests/heap/worklist-unittest.cc  |   22 +-
 .../bytecode-array-builder-unittest.cc        |   20 +-
 .../interpreter-assembler-unittest.cc         |   43 +-
 .../libplatform/default-platform-unittest.cc  |   32 +-
 deps/v8/test/unittests/object-unittest.cc     |   20 +
 .../unittests/parser/preparser-unittest.cc    |    3 +-
 .../unittests/strings-storage-unittest.cc     |  112 +
 deps/v8/test/unittests/test-helpers.cc        |    5 +-
 deps/v8/test/unittests/unittests.status       |    2 +
 deps/v8/test/unittests/utils-unittest.cc      |   23 +
 .../wasm/function-body-decoder-unittest.cc    |   39 +-
 .../unittests/wasm/module-decoder-unittest.cc |  118 +-
 .../wasm/streaming-decoder-unittest.cc        |   11 +-
 .../wasm/wasm-code-manager-unittest.cc        |  247 +-
 .../v8/test/wasm-spec-tests/tests.tar.gz.sha1 |    2 +-
 deps/v8/test/webkit/webkit.status             |   15 +-
 deps/v8/third_party/antlr4/BUILD.gn           |  339 +
 .../Cpp/runtime/src/atn/ATNSimulator.cpp      |    3 +-
 .../Cpp/runtime/src/atn/ATNSimulator.h        |    2 +-
 .../Cpp/runtime/src/atn/LexerATNSimulator.cpp |    6 +-
 .../runtime/src/atn/ParserATNSimulator.cpp    |    8 +-
 .../runtime/src/atn/ProfilingATNSimulator.cpp |    2 +-
 deps/v8/third_party/eu-strip/README.v8        |   24 +
 deps/v8/third_party/eu-strip/bin/eu-strip     |  Bin 0 -> 105120 bytes
 deps/v8/third_party/googletest/BUILD.gn       |   11 +-
 .../src/googletest/include/gtest/gtest_prod.h |    2 +-
 deps/v8/third_party/jinja2/LICENSE            |   62 +-
 deps/v8/tools/avg.py                          |  210 +
 deps/v8/tools/clusterfuzz/v8_foozzie.py       |    1 +
 deps/v8/tools/codemap.js                      |   14 +-
 deps/v8/tools/collect_deprecation_stats.sh    |   35 +
 deps/v8/tools/dev/gm.py                       |    4 +-
 deps/v8/tools/dumpcpp.js                      |    2 +-
 deps/v8/tools/gcmole/BUILD.gn                 |    6 +
 deps/v8/tools/gcmole/gcmole.lua               |    1 +
 deps/v8/tools/gcmole/run-gcmole.py            |    6 +
 deps/v8/tools/gdbinit                         |   37 -
 deps/v8/tools/gen-postmortem-metadata.py      |   23 +-
 deps/v8/tools/grokdump.py                     |    4 +-
 deps/v8/tools/heap-stats/categories.js        |    6 +-
 .../tools/heap-stats/details-selection.html   |   14 +-
 deps/v8/tools/heap-stats/details-selection.js |   35 +-
 deps/v8/tools/heap-stats/global-timeline.js   |   91 +-
 deps/v8/tools/heap-stats/histogram-viewer.js  |   37 +-
 deps/v8/tools/heap-stats/trace-file-reader.js |   23 +
 deps/v8/tools/ic-processor.js                 |    7 +-
 deps/v8/tools/lldb_commands.py                |   76 +-
 deps/v8/tools/lldbinit                        |   31 -
 deps/v8/tools/logreader.js                    |   35 +-
 deps/v8/tools/map-processor.js                |   11 +-
 deps/v8/tools/node/build_gn.py                |  103 +-
 deps/v8/tools/node/fetch_deps.py              |   21 +-
 deps/v8/tools/node/node_common.py             |    6 +-
 deps/v8/tools/parse-processor                 |    3 +-
 deps/v8/tools/parse-processor.html            |   96 +-
 deps/v8/tools/parse-processor.js              |  580 +-
 deps/v8/tools/parser-shell.cc                 |  162 -
 deps/v8/tools/presubmit.py                    |    4 +-
 deps/v8/tools/profviz/composer.js             |   26 +-
 deps/v8/tools/release/auto_roll.py            |    2 +-
 deps/v8/tools/release/common_includes.py      |   26 +-
 deps/v8/tools/release/git_recipes.py          |    4 +-
 deps/v8/tools/release/releases.py             |  576 --
 deps/v8/tools/release/test_scripts.py         |  526 +-
 deps/v8/tools/run-tests.py.vpython            |   32 +
 deps/v8/tools/run_perf.py                     |    7 +
 deps/v8/tools/testrunner/base_runner.py       |   10 +-
 deps/v8/tools/testrunner/local/variants.py    |    5 +-
 deps/v8/tools/testrunner/num_fuzzer.py        |    8 +
 deps/v8/tools/testrunner/objects/testcase.py  |    7 +-
 deps/v8/tools/testrunner/standard_runner.py   |    9 +-
 deps/v8/tools/tickprocessor.js                |   31 +-
 deps/v8/tools/torque/format-torque.py         |   36 +
 deps/v8/tools/torque/make-torque-parser.py    |   71 +
 deps/v8/tools/torque/vscode-torque/README.md  |   14 +
 .../vscode-torque/language-configuration.json |   25 +
 .../tools/torque/vscode-torque/package.json   |   26 +
 .../syntaxes/torque.tmLanguage.json           |   88 +
 deps/v8/tools/try_perf.py                     |    1 +
 deps/v8/tools/turbolizer/README.md            |   17 +-
 deps/v8/tools/turbolizer/code-view.js         |  170 -
 deps/v8/tools/turbolizer/constants.js         |   30 -
 deps/v8/tools/turbolizer/deploy.sh            |   18 +
 deps/v8/tools/turbolizer/edge.js              |   79 -
 deps/v8/tools/turbolizer/empty-view.js        |   19 -
 deps/v8/tools/turbolizer/graph-view.js        | 1063 ---
 deps/v8/tools/turbolizer/index.html           |   51 +-
 deps/v8/tools/turbolizer/lang-disassembly.js  |   14 -
 deps/v8/tools/turbolizer/package-lock.json    |  613 ++
 deps/v8/tools/turbolizer/package.json         |   26 +
 deps/v8/tools/turbolizer/schedule-view.js     |  128 -
 deps/v8/tools/turbolizer/selection-broker.js  |   99 -
 deps/v8/tools/turbolizer/selection.js         |  108 -
 deps/v8/tools/turbolizer/src/code-view.ts     |  267 +
 deps/v8/tools/turbolizer/src/constants.ts     |   29 +
 .../disassembly-view.ts}                      |  157 +-
 deps/v8/tools/turbolizer/src/edge.ts          |   92 +
 .../{graph-layout.js => src/graph-layout.ts}  |   74 +-
 deps/v8/tools/turbolizer/src/graph-view.ts    |  943 ++
 .../v8/tools/turbolizer/src/graphmultiview.ts |  105 +
 .../tools/turbolizer/src/lang-disassembly.ts  |   14 +
 .../turbolizer/{monkey.js => src/monkey.ts}   |    8 +-
 .../tools/turbolizer/{node.js => src/node.ts} |  145 +-
 deps/v8/tools/turbolizer/src/schedule-view.ts |  191 +
 .../tools/turbolizer/src/selection-broker.ts  |   77 +
 .../tools/turbolizer/src/selection-handler.ts |   24 +
 deps/v8/tools/turbolizer/src/selection.ts     |   63 +
 .../tools/turbolizer/src/source-resolver.ts   |  526 ++
 deps/v8/tools/turbolizer/src/text-view.ts     |  279 +
 .../tools/turbolizer/src/turbo-visualizer.ts  |  294 +
 deps/v8/tools/turbolizer/src/util.ts          |  110 +
 deps/v8/tools/turbolizer/src/view.ts          |   38 +
 deps/v8/tools/turbolizer/text-view.js         |  296 -
 deps/v8/tools/turbolizer/tsconfig.json        |   29 +
 deps/v8/tools/turbolizer/tsfmt.json           |   16 +
 deps/v8/tools/turbolizer/turbo-visualizer.css |  268 +-
 deps/v8/tools/turbolizer/turbo-visualizer.js  |  320 -
 deps/v8/tools/turbolizer/turbolizer.png       |  Bin 0 -> 79281 bytes
 deps/v8/tools/turbolizer/util.js              |   80 -
 deps/v8/tools/turbolizer/view.js              |   33 -
 deps/v8/tools/ubsan/blacklist.txt             |    2 +
 deps/v8/tools/v8heapconst.py                  |  501 +-
 deps/v8/tools/whitespace.txt                  |    4 +-
 1824 files changed, 140941 insertions(+), 101177 deletions(-)
 create mode 100644 deps/v8/.gitattributes
 create mode 100644 deps/v8/custom_deps/.gitignore
 create mode 100644 deps/v8/custom_deps/OWNERS
 create mode 100644 deps/v8/custom_deps/README.md
 create mode 100644 deps/v8/infra/testing/PRESUBMIT.py
 create mode 100644 deps/v8/infra/testing/builders.pyl
 delete mode 100644 deps/v8/infra/testing/client.v8.pyl
 delete mode 100644 deps/v8/infra/testing/tryserver.v8.pyl
 delete mode 100644 deps/v8/src/arm/interface-descriptors-arm.h
 delete mode 100644 deps/v8/src/arm64/interface-descriptors-arm64.h
 create mode 100644 deps/v8/src/asan.h
 create mode 100644 deps/v8/src/assembler-arch.h
 delete mode 100644 deps/v8/src/ast/compile-time-value.cc
 delete mode 100644 deps/v8/src/ast/compile-time-value.h
 create mode 100644 deps/v8/src/async-hooks-wrapper.cc
 create mode 100644 deps/v8/src/async-hooks-wrapper.h
 create mode 100644 deps/v8/src/base/list.h
 create mode 100644 deps/v8/src/builtins/array-foreach.tq
 create mode 100644 deps/v8/src/builtins/array-sort.tq
 create mode 100644 deps/v8/src/builtins/array.tq
 create mode 100644 deps/v8/src/builtins/base.tq
 create mode 100644 deps/v8/src/builtins/builtins-data-view-gen.h
 create mode 100644 deps/v8/src/builtins/builtins-lazy-gen.cc
 create mode 100644 deps/v8/src/builtins/builtins-lazy-gen.h
 create mode 100644 deps/v8/src/builtins/builtins-test-gen.h
 rename deps/v8/src/builtins/{builtins-typedarray-gen.cc => builtins-typed-array-gen.cc} (88%)
 rename deps/v8/src/builtins/{builtins-typedarray-gen.h => builtins-typed-array-gen.h} (84%)
 rename deps/v8/src/builtins/{builtins-typedarray.cc => builtins-typed-array.cc} (95%)
 create mode 100644 deps/v8/src/builtins/data-view.tq
 create mode 100644 deps/v8/src/builtins/typed-array.tq
 create mode 100644 deps/v8/src/code-reference.cc
 create mode 100644 deps/v8/src/code-reference.h
 delete mode 100644 deps/v8/src/compilation-dependencies.cc
 delete mode 100644 deps/v8/src/compilation-dependencies.h
 create mode 100644 deps/v8/src/compiler/compilation-dependencies.cc
 create mode 100644 deps/v8/src/compiler/compilation-dependencies.h
 create mode 100644 deps/v8/src/compiler/constant-folding-reducer.cc
 create mode 100644 deps/v8/src/compiler/constant-folding-reducer.h
 delete mode 100644 deps/v8/src/compiler/js-builtin-reducer.cc
 delete mode 100644 deps/v8/src/compiler/js-builtin-reducer.h
 create mode 100644 deps/v8/src/compiler/js-heap-broker.cc
 create mode 100644 deps/v8/src/compiler/js-heap-broker.h
 create mode 100644 deps/v8/src/compiler/machine-graph.cc
 create mode 100644 deps/v8/src/compiler/machine-graph.h
 create mode 100644 deps/v8/src/compiler/node-origin-table.cc
 create mode 100644 deps/v8/src/compiler/node-origin-table.h
 create mode 100644 deps/v8/src/compiler/type-narrowing-reducer.cc
 create mode 100644 deps/v8/src/compiler/type-narrowing-reducer.h
 delete mode 100644 deps/v8/src/compiler/wasm-linkage.cc
 delete mode 100644 deps/v8/src/debug/debug.js
 delete mode 100644 deps/v8/src/debug/liveedit.js
 delete mode 100644 deps/v8/src/debug/mirrors.js
 create mode 100644 deps/v8/src/heap/heap-controller.cc
 create mode 100644 deps/v8/src/heap/heap-controller.h
 create mode 100644 deps/v8/src/ia32/constants-ia32.h
 create mode 100644 deps/v8/src/lsan.h
 delete mode 100644 deps/v8/src/managed.h
 create mode 100644 deps/v8/src/objects-definitions.h
 create mode 100644 deps/v8/src/objects/api-callbacks-inl.h
 create mode 100644 deps/v8/src/objects/api-callbacks.h
 create mode 100644 deps/v8/src/objects/intl-objects-inl.h
 create mode 100644 deps/v8/src/objects/js-locale-inl.h
 create mode 100644 deps/v8/src/objects/js-locale.cc
 create mode 100644 deps/v8/src/objects/js-locale.h
 create mode 100644 deps/v8/src/objects/js-relative-time-format-inl.h
 create mode 100644 deps/v8/src/objects/js-relative-time-format.cc
 create mode 100644 deps/v8/src/objects/js-relative-time-format.h
 create mode 100644 deps/v8/src/objects/managed.cc
 create mode 100644 deps/v8/src/objects/managed.h
 create mode 100644 deps/v8/src/objects/ordered-hash-table-inl.h
 create mode 100644 deps/v8/src/objects/ordered-hash-table.cc
 create mode 100644 deps/v8/src/objects/ordered-hash-table.h
 create mode 100644 deps/v8/src/objects/templates-inl.h
 create mode 100644 deps/v8/src/objects/templates.h
 create mode 100644 deps/v8/src/roots-inl.h
 create mode 100644 deps/v8/src/roots.h
 delete mode 100644 deps/v8/src/runtime/runtime-error.cc
 create mode 100644 deps/v8/src/snapshot/references.h
 create mode 100644 deps/v8/src/torque/Torque.g4
 create mode 100644 deps/v8/src/torque/TorqueBaseListener.cpp
 create mode 100644 deps/v8/src/torque/TorqueBaseListener.h
 create mode 100644 deps/v8/src/torque/TorqueBaseVisitor.cpp
 create mode 100644 deps/v8/src/torque/TorqueBaseVisitor.h
 create mode 100644 deps/v8/src/torque/TorqueLexer.cpp
 create mode 100644 deps/v8/src/torque/TorqueLexer.h
 create mode 100644 deps/v8/src/torque/TorqueListener.cpp
 create mode 100644 deps/v8/src/torque/TorqueListener.h
 create mode 100644 deps/v8/src/torque/TorqueParser.cpp
 create mode 100644 deps/v8/src/torque/TorqueParser.h
 create mode 100644 deps/v8/src/torque/TorqueVisitor.cpp
 create mode 100644 deps/v8/src/torque/TorqueVisitor.h
 create mode 100644 deps/v8/src/torque/ast-generator.cc
 create mode 100644 deps/v8/src/torque/ast-generator.h
 create mode 100644 deps/v8/src/torque/ast.h
 create mode 100644 deps/v8/src/torque/contextual.h
 create mode 100644 deps/v8/src/torque/declarable.cc
 create mode 100644 deps/v8/src/torque/declarable.h
 create mode 100644 deps/v8/src/torque/declaration-visitor.cc
 create mode 100644 deps/v8/src/torque/declaration-visitor.h
 create mode 100644 deps/v8/src/torque/declarations.cc
 create mode 100644 deps/v8/src/torque/declarations.h
 create mode 100644 deps/v8/src/torque/file-visitor.cc
 create mode 100644 deps/v8/src/torque/file-visitor.h
 create mode 100644 deps/v8/src/torque/global-context.h
 create mode 100644 deps/v8/src/torque/implementation-visitor.cc
 create mode 100644 deps/v8/src/torque/implementation-visitor.h
 create mode 100644 deps/v8/src/torque/parameter-difference.h
 create mode 100644 deps/v8/src/torque/scope.cc
 create mode 100644 deps/v8/src/torque/scope.h
 create mode 100644 deps/v8/src/torque/torque.cc
 create mode 100644 deps/v8/src/torque/type-oracle.h
 create mode 100644 deps/v8/src/torque/types.cc
 create mode 100644 deps/v8/src/torque/types.h
 create mode 100644 deps/v8/src/torque/utils.cc
 create mode 100644 deps/v8/src/torque/utils.h
 create mode 100644 deps/v8/src/trap-handler/handler-inside-linux.cc
 create mode 100644 deps/v8/src/trap-handler/handler-outside-linux.cc
 create mode 100644 deps/v8/src/trap-handler/handler-outside-win.cc
 create mode 100644 deps/v8/src/turbo-assembler.cc
 create mode 100644 deps/v8/src/turbo-assembler.h
 create mode 100644 deps/v8/src/wasm/baseline/liftoff-compiler.h
 delete mode 100644 deps/v8/src/wasm/compilation-manager.cc
 delete mode 100644 deps/v8/src/wasm/compilation-manager.h
 create mode 100644 deps/v8/src/wasm/function-compiler.cc
 create mode 100644 deps/v8/src/wasm/function-compiler.h
 create mode 100644 deps/v8/src/wasm/jump-table-assembler.cc
 create mode 100644 deps/v8/src/wasm/jump-table-assembler.h
 create mode 100644 deps/v8/src/wasm/value-type.h
 delete mode 100644 deps/v8/src/wasm/wasm-code-specialization.cc
 delete mode 100644 deps/v8/src/wasm/wasm-code-specialization.h
 create mode 100644 deps/v8/src/wasm/wasm-linkage.h
 create mode 100644 deps/v8/src/x64/constants-x64.h
 create mode 100644 deps/v8/test/cctest/heap/test-unmapper.cc
 create mode 100644 deps/v8/test/cctest/test-inspector.cc
 create mode 100644 deps/v8/test/cctest/test-roots.cc
 create mode 100644 deps/v8/test/cctest/torque/test-torque.cc
 create mode 100644 deps/v8/test/cctest/wasm/test-wasm-serialization.cc
 create mode 100644 deps/v8/test/cctest/wasm/test-wasm-shared-engine.cc
 create mode 100644 deps/v8/test/debugger/debug/debug-break-return.js
 create mode 100644 deps/v8/test/debugger/debug/debug-live-edit-recursion.js
 delete mode 100644 deps/v8/test/debugger/debug/debug-liveedit-diff.js
 delete mode 100644 deps/v8/test/debugger/debug/debug-liveedit-utils.js
 delete mode 100644 deps/v8/test/debugger/debug/debug-script.js
 delete mode 100644 deps/v8/test/debugger/debug/debug-setbreakpoint.js
 delete mode 100644 deps/v8/test/debugger/debug/debug-sourceinfo.js
 delete mode 100644 deps/v8/test/debugger/debug/regress/regress-1853.js
 delete mode 100644 deps/v8/test/debugger/debug/regress/regress-419663.js
 delete mode 100644 deps/v8/test/debugger/debug/regress/regress-crbug-424142.js
 delete mode 100644 deps/v8/test/debugger/debug/regress/regress-crbug-481896.js
 delete mode 100644 deps/v8/test/debugger/debug/regress/regress-crbug-517592.js
 create mode 100644 deps/v8/test/debugger/debug/side-effect/debug-evaluate-no-side-effect-regexp.js
 create mode 100644 deps/v8/test/debugger/regress/regress-crbug-840288.js
 create mode 100644 deps/v8/test/inspector/PRESUBMIT.py
 create mode 100644 deps/v8/test/inspector/debugger/async-function-step-out-expected.txt
 create mode 100644 deps/v8/test/inspector/debugger/async-function-step-out-optimized-expected.txt
 create mode 100644 deps/v8/test/inspector/debugger/async-function-step-out-optimized.js
 create mode 100644 deps/v8/test/inspector/debugger/async-function-step-out.js
 create mode 100644 deps/v8/test/inspector/debugger/break-locations-var-init-optimized-expected.txt
 create mode 100644 deps/v8/test/inspector/debugger/break-locations-var-init-optimized.js
 create mode 100644 deps/v8/test/inspector/debugger/break-on-exception-and-step-expected.txt
 create mode 100644 deps/v8/test/inspector/debugger/break-on-exception-and-step.js
 create mode 100644 deps/v8/test/inspector/debugger/break-on-exception-compiler-errors-expected.txt
 create mode 100644 deps/v8/test/inspector/debugger/break-on-exception-compiler-errors.js
 create mode 100644 deps/v8/test/inspector/debugger/disable-agent-on-pause-expected.txt
 create mode 100644 deps/v8/test/inspector/debugger/disable-agent-on-pause.js
 create mode 100644 deps/v8/test/inspector/debugger/evaluate-on-call-frame-expected.txt
 create mode 100644 deps/v8/test/inspector/debugger/evaluate-on-call-frame-timeout-expected.txt
 create mode 100644 deps/v8/test/inspector/debugger/evaluate-on-call-frame-timeout.js
 create mode 100644 deps/v8/test/inspector/debugger/evaluate-on-call-frame.js
 create mode 100644 deps/v8/test/inspector/debugger/pause-inside-blackboxed-optimized-expected.txt
 create mode 100644 deps/v8/test/inspector/debugger/pause-inside-blackboxed-optimized.js
 create mode 100644 deps/v8/test/inspector/debugger/regress-crbug-481896-expected.txt
 create mode 100644 deps/v8/test/inspector/debugger/regress-crbug-481896.js
 create mode 100644 deps/v8/test/inspector/debugger/regression-1853-expected.txt
 create mode 100644 deps/v8/test/inspector/debugger/regression-1853.js
 create mode 100644 deps/v8/test/inspector/debugger/regression-419663-expected.txt
 create mode 100644 deps/v8/test/inspector/debugger/regression-419663.js
 create mode 100644 deps/v8/test/inspector/debugger/regression-424142-expected.txt
 create mode 100644 deps/v8/test/inspector/debugger/regression-424142.js
 create mode 100644 deps/v8/test/inspector/debugger/remove-breakpoint-at-breakpoint-expected.txt
 create mode 100644 deps/v8/test/inspector/debugger/remove-breakpoint-at-breakpoint.js
 create mode 100644 deps/v8/test/inspector/debugger/set-breakpoint-after-liveedit-expected.txt
 create mode 100644 deps/v8/test/inspector/debugger/set-breakpoint-after-liveedit.js
 create mode 100644 deps/v8/test/inspector/debugger/set-breakpoint-expected.txt
 create mode 100644 deps/v8/test/inspector/debugger/set-breakpoint-on-function-call-expected.txt
 create mode 100644 deps/v8/test/inspector/debugger/set-breakpoint-on-function-call.js
 create mode 100644 deps/v8/test/inspector/debugger/set-breakpoint.js
 create mode 100644 deps/v8/test/inspector/debugger/set-script-source-stack-padding-expected.txt
 create mode 100644 deps/v8/test/inspector/debugger/set-script-source-stack-padding.js
 create mode 100644 deps/v8/test/inspector/debugger/step-into-out-expected.txt
 create mode 100644 deps/v8/test/inspector/debugger/step-into-out.js
 create mode 100644 deps/v8/test/inspector/debugger/terminate-execution-on-pause-expected.txt
 create mode 100644 deps/v8/test/inspector/debugger/terminate-execution-on-pause.js
 create mode 100644 deps/v8/test/inspector/debugger/wasm-set-breakpoint-expected.txt
 create mode 100644 deps/v8/test/inspector/debugger/wasm-set-breakpoint.js
 create mode 100644 deps/v8/test/inspector/runtime/add-binding-expected.txt
 create mode 100644 deps/v8/test/inspector/runtime/add-binding.js
 create mode 100644 deps/v8/test/inspector/runtime/command-line-api-without-side-effects-expected.txt
 create mode 100644 deps/v8/test/inspector/runtime/command-line-api-without-side-effects.js
 delete mode 100644 deps/v8/test/inspector/runtime/console-deprecated-methods-expected.txt
 delete mode 100644 deps/v8/test/inspector/runtime/console-deprecated-methods.js
 create mode 100644 deps/v8/test/inspector/runtime/enable-async-stack-expected.txt
 create mode 100644 deps/v8/test/inspector/runtime/enable-async-stack.js
 create mode 100644 deps/v8/test/inspector/runtime/evaluate-timeout-expected.txt
 create mode 100644 deps/v8/test/inspector/runtime/evaluate-timeout.js
 create mode 100644 deps/v8/test/inspector/runtime/function-location-expected.txt
 create mode 100644 deps/v8/test/inspector/runtime/function-location.js
 create mode 100644 deps/v8/test/inspector/runtime/set-max-call-stack-size-expected.txt
 create mode 100644 deps/v8/test/inspector/runtime/set-max-call-stack-size.js
 create mode 100644 deps/v8/test/intl/general/language_tags_with_preferred_values.js
 create mode 100644 deps/v8/test/intl/locale/locale-canonicalization.js
 create mode 100644 deps/v8/test/intl/locale/locale-constructor.js
 create mode 100644 deps/v8/test/intl/locale/locale-properties.js
 create mode 100644 deps/v8/test/intl/relative-time-format/constructor.js
 create mode 100644 deps/v8/test/intl/relative-time-format/default-locale-fr-CA.js
 create mode 100644 deps/v8/test/intl/relative-time-format/default-locale-pt-BR.js
 create mode 100644 deps/v8/test/intl/relative-time-format/resolved-options.js
 create mode 100644 deps/v8/test/js-perf-test/Array/slice.js
 create mode 100644 deps/v8/test/js-perf-test/ArraySort/sort-base.js
 create mode 100644 deps/v8/test/js-perf-test/ArraySort/sort-cmpfn-kindchange.js
 create mode 100644 deps/v8/test/js-perf-test/ArraySort/sort-cmpfn.js
 create mode 100644 deps/v8/test/js-perf-test/ArraySort/sort-lengths.js
 create mode 100644 deps/v8/test/js-perf-test/ArraySort/sort-megamorphic.js
 create mode 100644 deps/v8/test/js-perf-test/ArraySort/sort-presorted.js
 create mode 100644 deps/v8/test/js-perf-test/DataView/dataviewtest.js
 create mode 100644 deps/v8/test/js-perf-test/DataView/run.js
 create mode 100644 deps/v8/test/js-perf-test/RegExp/inline_test.js
 create mode 100644 deps/v8/test/js-perf-test/Strings/string-split.js
 create mode 100644 deps/v8/test/js-perf-test/Strings/string-startsendswith-comp.js
 create mode 100644 deps/v8/test/js-perf-test/TypedArrays/sort-bigint.js
 create mode 100644 deps/v8/test/js-perf-test/TypedArrays/sort-cmpfn-bigint.js
 create mode 100644 deps/v8/test/message/mjsunit/fail/assert-promise-result-rejects-empty.js
 create mode 100644 deps/v8/test/message/mjsunit/fail/assert-promise-result-rejects-empty.out
 create mode 100644 deps/v8/test/message/mjsunit/fail/assert-promise-result-rejects-with-throw-empty.js
 create mode 100644 deps/v8/test/message/mjsunit/fail/assert-promise-result-rejects-with-throw-empty.out
 create mode 100644 deps/v8/test/message/mjsunit/fail/assert-promise-result-rejects.js
 create mode 100644 deps/v8/test/message/mjsunit/fail/assert-promise-result-rejects.out
 create mode 100644 deps/v8/test/message/mjsunit/fail/assert-promise-result-resolves.js
 create mode 100644 deps/v8/test/message/mjsunit/fail/assert-promise-result-resolves.out
 create mode 100644 deps/v8/test/message/mjsunit/success/assert-promise-result-rejects.js
 create mode 100644 deps/v8/test/message/mjsunit/success/assert-promise-result-rejects.out
 create mode 100644 deps/v8/test/message/mjsunit/success/assert-promise-result-resolves-empty.js
 create mode 100644 deps/v8/test/message/mjsunit/success/assert-promise-result-resolves-empty.out
 create mode 100644 deps/v8/test/message/mjsunit/success/assert-promise-result-resolves.js
 create mode 100644 deps/v8/test/message/mjsunit/success/assert-promise-result-resolves.out
 create mode 100644 deps/v8/test/message/regress/fail/regress-crbug-842101.js
 create mode 100644 deps/v8/test/message/regress/fail/regress-crbug-842101.out
 create mode 100644 deps/v8/test/mjsunit/async-hooks/api-methods.js
 create mode 100644 deps/v8/test/mjsunit/async-hooks/async-await-tree.js
 rename deps/v8/test/mjsunit/{regress/regress-2988.js => async-hooks/chained-promises.js} (66%)
 create mode 100644 deps/v8/test/mjsunit/async-hooks/execution-order.js
 create mode 100644 deps/v8/test/mjsunit/async-hooks/promises-async-await.js
 create mode 100644 deps/v8/test/mjsunit/code-comments.js
 create mode 100644 deps/v8/test/mjsunit/compiler/array-species.js
 delete mode 100644 deps/v8/test/mjsunit/compiler/constructor-inlining-no-harmony-restrict-constructor-return.js
 create mode 100644 deps/v8/test/mjsunit/compiler/dataview-get.js
 create mode 100644 deps/v8/test/mjsunit/compiler/dataview-set.js
 create mode 100644 deps/v8/test/mjsunit/compiler/object-create.js
 create mode 100644 deps/v8/test/mjsunit/compiler/promise-species.js
 create mode 100644 deps/v8/test/mjsunit/compiler/regress-841117.js
 create mode 100644 deps/v8/test/mjsunit/es6/dataview-length.js
 create mode 100644 deps/v8/test/mjsunit/es6/regress/regress-7706.js
 create mode 100644 deps/v8/test/mjsunit/es6/typedarray-keyedstore-tonumber.js
 rename deps/v8/test/{debugger/debug/debug-liveedit-stack-padding.js => mjsunit/es8/async-await-interleaved.js} (55%)
 delete mode 100644 deps/v8/test/mjsunit/es8/constructor-returning-primitive.js
 create mode 100644 deps/v8/test/mjsunit/harmony/array-flat-species.js
 create mode 100644 deps/v8/test/mjsunit/harmony/array-flat.js
 create mode 100644 deps/v8/test/mjsunit/harmony/array-flatMap-species.js
 delete mode 100644 deps/v8/test/mjsunit/harmony/array-flatten.js
 create mode 100644 deps/v8/test/mjsunit/harmony/bigintarray-keyedstore-tobigint.js
 delete mode 100644 deps/v8/test/mjsunit/harmony/regexp-property-disabled.js
 create mode 100644 deps/v8/test/mjsunit/harmony/symbol-description.js
 rename deps/v8/test/mjsunit/{harmony => }/intl-numberformat-formattoparts.js (99%)
 rename deps/v8/test/mjsunit/{harmony => }/intl-pluralrules-select.js (97%)
 create mode 100644 deps/v8/test/mjsunit/lexicographic-compare.js
 create mode 100644 deps/v8/test/mjsunit/linecontinuation.js
 delete mode 100644 deps/v8/test/mjsunit/regress/regress-2185-2.js
 delete mode 100644 deps/v8/test/mjsunit/regress/regress-373283.js
 create mode 100644 deps/v8/test/mjsunit/regress/regress-7642.js
 create mode 100644 deps/v8/test/mjsunit/regress/regress-7652.js
 create mode 100644 deps/v8/test/mjsunit/regress/regress-7677.js
 create mode 100644 deps/v8/test/mjsunit/regress/regress-7716.js
 create mode 100644 deps/v8/test/mjsunit/regress/regress-7791.js
 create mode 100644 deps/v8/test/mjsunit/regress/regress-7893.js
 delete mode 100644 deps/v8/test/mjsunit/regress/regress-829889.js
 create mode 100644 deps/v8/test/mjsunit/regress/regress-838766.js
 create mode 100644 deps/v8/test/mjsunit/regress/regress-840106.js
 create mode 100644 deps/v8/test/mjsunit/regress/regress-842078.js
 create mode 100644 deps/v8/test/mjsunit/regress/regress-843062-1.js
 create mode 100644 deps/v8/test/mjsunit/regress/regress-843062-2.js
 create mode 100644 deps/v8/test/mjsunit/regress/regress-843062-3.js
 create mode 100644 deps/v8/test/mjsunit/regress/regress-849663.js
 create mode 100644 deps/v8/test/mjsunit/regress/regress-852258.js
 create mode 100644 deps/v8/test/mjsunit/regress/regress-854066-2.js
 create mode 100644 deps/v8/test/mjsunit/regress/regress-854066.js
 delete mode 100644 deps/v8/test/mjsunit/regress/regress-crbug-410033.js
 delete mode 100644 deps/v8/test/mjsunit/regress/regress-crbug-469480.js
 delete mode 100644 deps/v8/test/mjsunit/regress/regress-crbug-505007-1.js
 delete mode 100644 deps/v8/test/mjsunit/regress/regress-crbug-506443.js
 delete mode 100644 deps/v8/test/mjsunit/regress/regress-crbug-582703.js
 create mode 100644 deps/v8/test/mjsunit/regress/regress-crbug-7907.js
 create mode 100644 deps/v8/test/mjsunit/regress/regress-crbug-823130.js
 create mode 100644 deps/v8/test/mjsunit/regress/regress-crbug-840220.js
 create mode 100644 deps/v8/test/mjsunit/regress/regress-crbug-841592.js
 create mode 100644 deps/v8/test/mjsunit/regress/regress-crbug-848165.js
 create mode 100644 deps/v8/test/mjsunit/regress/regress-crbug-849024.js
 create mode 100644 deps/v8/test/mjsunit/regress/regress-crbug-850005.js
 create mode 100644 deps/v8/test/mjsunit/regress/regress-crbug-851393.js
 create mode 100644 deps/v8/test/mjsunit/regress/regress-crbug-852592.js
 create mode 100644 deps/v8/test/mjsunit/regress/regress-crbug-854299.js
 create mode 100644 deps/v8/test/mjsunit/regress/regress-crbug-856095.js
 create mode 100644 deps/v8/test/mjsunit/regress/regress-crbug-859809.js
 create mode 100644 deps/v8/test/mjsunit/regress/regress-crbug-860788.js
 create mode 100644 deps/v8/test/mjsunit/regress/regress-v8-7682.js
 create mode 100644 deps/v8/test/mjsunit/regress/regress-v8-7725.js
 create mode 100644 deps/v8/test/mjsunit/regress/wasm/regress-7785.js
 create mode 100644 deps/v8/test/mjsunit/regress/wasm/regress-7914.js
 create mode 100644 deps/v8/test/mjsunit/regress/wasm/regress-799952.js
 create mode 100644 deps/v8/test/mjsunit/regress/wasm/regress-834624.js
 create mode 100644 deps/v8/test/mjsunit/regress/wasm/regress-834693.js
 create mode 100644 deps/v8/test/mjsunit/regress/wasm/regress-840757.js
 create mode 100644 deps/v8/test/mjsunit/regress/wasm/regress-842501.js
 create mode 100644 deps/v8/test/mjsunit/regress/wasm/regress-843563.js
 create mode 100644 deps/v8/test/mjsunit/regress/wasm/regress-853453.js
 create mode 100644 deps/v8/test/mjsunit/regress/wasm/regress-854011.js
 create mode 100644 deps/v8/test/mjsunit/regress/wasm/regress-854050.js
 create mode 100644 deps/v8/test/mjsunit/tools/compiler-trace-flags.js
 delete mode 100644 deps/v8/test/mjsunit/wasm/default-liftoff-setting.js
 create mode 100644 deps/v8/test/mjsunit/wasm/export-mutable-global.js
 create mode 100644 deps/v8/test/mjsunit/wasm/import-mutable-global.js
 create mode 100644 deps/v8/test/mjsunit/wasm/print-code.js
 create mode 100644 deps/v8/test/mjsunit/wasm/serialize-lazy-module.js
 create mode 100644 deps/v8/test/mjsunit/wasm/trap-handler-fallback.js
 create mode 100644 deps/v8/test/mjsunit/wasm/worker-module.js
 create mode 100644 deps/v8/test/torque/test-torque.tq
 create mode 100644 deps/v8/test/unittests/base/list-unittest.cc
 create mode 100644 deps/v8/test/unittests/compiler/constant-folding-reducer-unittest.cc
 delete mode 100644 deps/v8/test/unittests/compiler/js-builtin-reducer-unittest.cc
 create mode 100644 deps/v8/test/unittests/heap/heap-controller-unittest.cc
 create mode 100644 deps/v8/test/unittests/strings-storage-unittest.cc
 create mode 100644 deps/v8/third_party/antlr4/BUILD.gn
 create mode 100644 deps/v8/third_party/eu-strip/README.v8
 create mode 100755 deps/v8/third_party/eu-strip/bin/eu-strip
 create mode 100755 deps/v8/tools/avg.py
 create mode 100755 deps/v8/tools/collect_deprecation_stats.sh
 delete mode 100755 deps/v8/tools/lldbinit
 delete mode 100644 deps/v8/tools/parser-shell.cc
 delete mode 100755 deps/v8/tools/release/releases.py
 create mode 100644 deps/v8/tools/run-tests.py.vpython
 create mode 100755 deps/v8/tools/torque/format-torque.py
 create mode 100755 deps/v8/tools/torque/make-torque-parser.py
 create mode 100644 deps/v8/tools/torque/vscode-torque/README.md
 create mode 100644 deps/v8/tools/torque/vscode-torque/language-configuration.json
 create mode 100644 deps/v8/tools/torque/vscode-torque/package.json
 create mode 100644 deps/v8/tools/torque/vscode-torque/syntaxes/torque.tmLanguage.json
 delete mode 100644 deps/v8/tools/turbolizer/code-view.js
 delete mode 100644 deps/v8/tools/turbolizer/constants.js
 create mode 100755 deps/v8/tools/turbolizer/deploy.sh
 delete mode 100644 deps/v8/tools/turbolizer/edge.js
 delete mode 100644 deps/v8/tools/turbolizer/empty-view.js
 delete mode 100644 deps/v8/tools/turbolizer/graph-view.js
 delete mode 100644 deps/v8/tools/turbolizer/lang-disassembly.js
 create mode 100644 deps/v8/tools/turbolizer/package-lock.json
 create mode 100644 deps/v8/tools/turbolizer/package.json
 delete mode 100644 deps/v8/tools/turbolizer/schedule-view.js
 delete mode 100644 deps/v8/tools/turbolizer/selection-broker.js
 delete mode 100644 deps/v8/tools/turbolizer/selection.js
 create mode 100644 deps/v8/tools/turbolizer/src/code-view.ts
 create mode 100644 deps/v8/tools/turbolizer/src/constants.ts
 rename deps/v8/tools/turbolizer/{disassembly-view.js => src/disassembly-view.ts} (65%)
 create mode 100644 deps/v8/tools/turbolizer/src/edge.ts
 rename deps/v8/tools/turbolizer/{graph-layout.js => src/graph-layout.ts} (88%)
 create mode 100644 deps/v8/tools/turbolizer/src/graph-view.ts
 create mode 100644 deps/v8/tools/turbolizer/src/graphmultiview.ts
 create mode 100644 deps/v8/tools/turbolizer/src/lang-disassembly.ts
 rename deps/v8/tools/turbolizer/{monkey.js => src/monkey.ts} (57%)
 rename deps/v8/tools/turbolizer/{node.js => src/node.ts} (60%)
 create mode 100644 deps/v8/tools/turbolizer/src/schedule-view.ts
 create mode 100644 deps/v8/tools/turbolizer/src/selection-broker.ts
 create mode 100644 deps/v8/tools/turbolizer/src/selection-handler.ts
 create mode 100644 deps/v8/tools/turbolizer/src/selection.ts
 create mode 100644 deps/v8/tools/turbolizer/src/source-resolver.ts
 create mode 100644 deps/v8/tools/turbolizer/src/text-view.ts
 create mode 100644 deps/v8/tools/turbolizer/src/turbo-visualizer.ts
 create mode 100644 deps/v8/tools/turbolizer/src/util.ts
 create mode 100644 deps/v8/tools/turbolizer/src/view.ts
 delete mode 100644 deps/v8/tools/turbolizer/text-view.js
 create mode 100644 deps/v8/tools/turbolizer/tsconfig.json
 create mode 100644 deps/v8/tools/turbolizer/tsfmt.json
 delete mode 100644 deps/v8/tools/turbolizer/turbo-visualizer.js
 create mode 100644 deps/v8/tools/turbolizer/turbolizer.png
 delete mode 100644 deps/v8/tools/turbolizer/util.js
 delete mode 100644 deps/v8/tools/turbolizer/view.js
 create mode 100644 deps/v8/tools/ubsan/blacklist.txt

diff --git a/deps/v8/.gitattributes b/deps/v8/.gitattributes
new file mode 100644
index 00000000000000..7ef1e1b74b01e0
--- /dev/null
+++ b/deps/v8/.gitattributes
@@ -0,0 +1,5 @@
+# Automatically normalize line endings (to LF) for all text-based files.
+* text=auto eol=lf
+# Do not modify line endings for binary files (which are sometimes auto
+# detected as text files by git).
+*.png binary
diff --git a/deps/v8/.gitignore b/deps/v8/.gitignore
index 630c3f2a09d3f8..a6339d7e6fe693 100644
--- a/deps/v8/.gitignore
+++ b/deps/v8/.gitignore
@@ -33,6 +33,7 @@
 .pydevproject
 .settings
 .vscode
+/Default/
 /_*
 /build
 /buildtools
@@ -47,6 +48,7 @@
 /test/benchmarks/data
 /test/fuzzer/wasm_corpus
 /test/fuzzer/wasm_corpus.tar.gz
+!/test/mjsunit/d8
 /test/mozilla/data
 /test/test262/data
 /test/test262/harness
@@ -56,10 +58,13 @@
 /third_party/*
 !/third_party/antlr4
 !/third_party/binutils
-!/third_party/inspector_protocol
 !/third_party/colorama
 /third_party/colorama/src
+!/third_party/eu-strip
 !/third_party/googletest
+/third_party/googletest/*
+!/third_party/googletest/BUILD.gn
+!/third_party/googletest/src
 /third_party/googletest/src/*
 !/third_party/googletest/src/googletest
 /third_party/googletest/src/googletest/*
@@ -68,6 +73,9 @@
 !/third_party/googletest/src/googletest/include/gtest
 /third_party/googletest/src/googletest/include/gtest/*
 !/third_party/googletest/src/googletest/include/gtest/gtest_prod.h
+!/third_party/inspector_protocol
+!/third_party/jinja2
+!/third_party/markupsafe
 /tools/clang
 /tools/gcmole/gcmole-tools
 /tools/gcmole/gcmole-tools.tar.gz
@@ -92,18 +100,16 @@ TAGS
 bsuite
 compile_commands.json
 d8
-!/test/mjsunit/d8
 d8_g
 gccauses
 gcsuspects
 gtags.files
+node_modules
 shell
 shell_g
 tags
+tools/turbolizer/build
 turbo*.cfg
 turbo*.dot
 turbo*.json
 v8.ignition_dispatches_table.json
-/Default/
-!/third_party/jinja2
-!/third_party/markupsafe
diff --git a/deps/v8/AUTHORS b/deps/v8/AUTHORS
index 4b5163961d282e..6f4b3fe6aeae70 100644
--- a/deps/v8/AUTHORS
+++ b/deps/v8/AUTHORS
@@ -32,6 +32,7 @@ Facebook, Inc. <*@fb.com>
 Facebook, Inc. <*@oculus.com>
 Vewd Software AS <*@vewd.com>
 Groupon <*@groupon.com>
+Cloudflare, Inc. <*@cloudflare.com>
 
 Aaron Bieber <deftly@gmail.com>
 Abdulla Kamar <abdulla.kamar@gmail.com>
@@ -41,6 +42,7 @@ Alexander Botero-Lowry <alexbl@FreeBSD.org>
 Alexander Karpinsky <homm86@gmail.com>
 Alexandre Vassalotti <avassalotti@gmail.com>
 Alexis Campailla <alexis@janeasystems.com>
+Amos Lim <eui-sang.lim@samsung.com>
 Andreas Anyuru <andreas.anyuru@gmail.com>
 Andrew Paprocki <andrew@ishiboo.com>
 Andrei Kashcha <anvaka@gmail.com>
@@ -61,6 +63,7 @@ Daniel Andersson <kodandersson@gmail.com>
 Daniel Bevenius <daniel.bevenius@gmail.com>
 Daniel James <dnljms@gmail.com>
 Deon Dior <diaoyuanjie@gmail.com>
+Dominic Farolini <domfarolino@gmail.com>
 Douglas Crosher <dtc-v8@scieneer.com>
 Dusan Milosavljevic <dusan.m.milosavljevic@gmail.com>
 Erich Ocean <erich.ocean@me.com>
@@ -70,11 +73,13 @@ Felix Geisendörfer <haimuiba@gmail.com>
 Filipe David Manana <fdmanana@gmail.com>
 Franziska Hinkelmann <franziska.hinkelmann@gmail.com>
 Geoffrey Garside <ggarside@gmail.com>
+Gergely Nagy <ngg@ngg.hu>
 Gus Caplan <me@gus.host>
 Gwang Yoon Hwang <ryumiel@company100.net>
 Henrique Ferreiro <henrique.ferreiro@gmail.com>
 Hirofumi Mako <mkhrfm@gmail.com>
 Honggyu Kim <honggyu.kp@gmail.com>
+Ingvar Stepanyan <me@rreverser.com>
 Ioseb Dzmanashvili <ioseb.dzmanashvili@gmail.com>
 Isiah Meadows <impinball@gmail.com>
 Jaime Bernardo <jaime@janeasystems.com>
@@ -125,8 +130,10 @@ Paul Lind <plind44@gmail.com>
 Qingyan Li <qingyan.liqy@alibaba-inc.com>
 Qiuyi Zhang <qiuyi.zqy@alibaba-inc.com>
 Rafal Krypa <rafal@krypa.net>
+Ray Glover <ray@rayglover.net>
 Refael Ackermann <refack@gmail.com>
 Rene Rebe <rene@exactcode.de>
+Rick Waldron <waldron.rick@gmail.com>
 Rob Wu <rob@robwu.nl>
 Robert Mustacchi <rm@fingolfin.org>
 Robert Nagy <robert.nagy@gmail.com>
@@ -142,6 +149,7 @@ Taketoshi Aono <brn@b6n.ch>
 Teddy Katz <teddy.katz@gmail.com>
 Tiancheng "Timothy" Gu <timothygu99@gmail.com>
 Tobias Burnus <burnus@net-b.de>
+Tobias Nießen <tniessen@tnie.de>
 Victor Costan <costan@gmail.com>
 Vlad Burlik <vladbph@gmail.com>
 Vladimir Krivosheev <develar@gmail.com>
diff --git a/deps/v8/BUILD.gn b/deps/v8/BUILD.gn
index 4b48f7d6874df9..e76866f9d5c0e9 100644
--- a/deps/v8/BUILD.gn
+++ b/deps/v8/BUILD.gn
@@ -22,6 +22,13 @@ declare_args() {
   # Print to stdout on Android.
   v8_android_log_stdout = false
 
+  # Dynamically set an additional dependency from v8/custom_deps.
+  v8_custom_deps = ""
+
+  # Turns on deprecation warnings for HeapObject::GetIsolate,
+  # HeapObject::GetHeap, Handle(T* obj) and handle(T* obj).
+  v8_deprecate_get_isolate = false
+
   # Turns on all V8 debug features. Enables running V8 in a pseudo debug mode
   # within a release Chrome.
   v8_enable_debugging_features = is_debug
@@ -60,7 +67,7 @@ declare_args() {
   v8_enable_vtunejit = false
 
   # Sets -dENABLE_HANDLE_ZAPPING.
-  v8_enable_handle_zapping = is_debug
+  v8_enable_handle_zapping = true
 
   # Enable slow dchecks.
   v8_enable_slow_dchecks = false
@@ -70,12 +77,15 @@ declare_args() {
 
   # Enable embedded builtins.
   # TODO(jgruber,v8:6666): Support ia32 and maybe MSVC.
-  # TODO(jgruber,v8:6666): Re-enable after the M67 branch point.
-  v8_enable_embedded_builtins = false
+  v8_enable_embedded_builtins =
+      v8_use_snapshot && v8_current_cpu != "x86" && (!is_win || is_clang)
 
   # Enable code-generation-time checking of types in the CodeStubAssembler.
   v8_enable_verify_csa = false
 
+  # Enable pointer compression (sets -dV8_COMPRESS_POINTERS).
+  v8_enable_pointer_compression = false
+
   # Interpreted regexp engine exists as platform-independent alternative
   # based where the regular expression is compiled to a bytecode.
   v8_interpreted_regexp = false
@@ -176,6 +186,9 @@ if (v8_check_microtasks_scopes_consistency == "") {
       v8_enable_debugging_features || dcheck_always_on
 }
 
+assert(!v8_enable_embedded_builtins || v8_use_snapshot,
+       "Embedded builtins only work with snapshots")
+
 # Specifies if the target build is a simulator build. Comparing target cpu
 # with v8 target cpu to not affect simulator builds for making cross-compile
 # snapshots.
@@ -190,17 +203,25 @@ v8_toolset_for_shell = "host"
 config("internal_config") {
   visibility = [ ":*" ]  # Only targets in this file can depend on this.
 
-  include_dirs = [ "." ]
+  include_dirs = [
+    ".",
+    "$target_gen_dir",
+  ]
+
+  defines = []
 
   if (is_component_build) {
-    defines = [ "BUILDING_V8_SHARED" ]
+    defines += [ "BUILDING_V8_SHARED" ]
   }
 }
 
 config("internal_config_base") {
   visibility = [ ":*" ]  # Only targets in this file can depend on this.
 
-  include_dirs = [ "." ]
+  include_dirs = [
+    ".",
+    "$target_gen_dir",
+  ]
 }
 
 # This config should be applied to code using the libplatform.
@@ -280,6 +301,9 @@ config("features") {
   if (v8_enable_minor_mc) {
     defines += [ "ENABLE_MINOR_MC" ]
   }
+  if (v8_enable_pointer_compression) {
+    defines += [ "V8_COMPRESS_POINTERS" ]
+  }
   if (v8_enable_object_print) {
     defines += [ "OBJECT_PRINT" ]
   }
@@ -314,6 +338,9 @@ config("features") {
   if (v8_imminent_deprecation_warnings) {
     defines += [ "V8_IMMINENT_DEPRECATION_WARNINGS" ]
   }
+  if (v8_deprecate_get_isolate) {
+    defines += [ "DEPRECATE_GET_ISOLATE" ]
+  }
   if (v8_enable_i18n_support) {
     defines += [ "V8_INTL_SUPPORT" ]
   }
@@ -557,6 +584,10 @@ config("toolchain") {
         v8_current_cpu == "mips64el") {
       cflags += [ "-Wshorten-64-to-32" ]
     }
+
+    if (v8_deprecate_get_isolate) {
+      cflags += [ "-Wno-error=deprecated" ]
+    }
   }
 
   if (is_win) {
@@ -569,7 +600,14 @@ config("toolchain") {
       "/wd4703",  # Potentially uninitialized local pointer variable.
       "/wd4709",  # Comma operator within array index expr (bugged).
       "/wd4714",  # Function marked forceinline not inlined.
+
+      # MSVC assumes that control can get past an exhaustive switch and then
+      # warns if there's no return there (see https://crbug.com/v8/7658)
+      "/wd4715",  # Not all control paths return a value.
+
       "/wd4718",  # Recursive call has no side-effect.
+      "/wd4723",  # https://crbug.com/v8/7771
+      "/wd4724",  # https://crbug.com/v8/7771
       "/wd4800",  # Forcing value to bool.
     ]
   }
@@ -580,6 +618,10 @@ config("toolchain") {
       # signed overflow does not occur. Generates false positives (see
       # http://crbug.com/v8/6341).
       "-Wno-strict-overflow",
+
+      # GCC assumes that control can get past an exhaustive switch and then
+      # warns if there's no return there (see https://crbug.com/v8/7658).
+      "-Wno-return-type",
     ]
   }
 }
@@ -619,9 +661,6 @@ action("js2c") {
     "src/js/prologue.js",
     "src/js/array.js",
     "src/js/typedarray.js",
-    "src/debug/mirrors.js",
-    "src/debug/debug.js",
-    "src/debug/liveedit.js",
   ]
 
   outputs = [
@@ -827,6 +866,109 @@ action("postmortem-metadata") {
          rebase_path(sources, root_build_dir)
 }
 
+torque_files = [
+  "src/builtins/base.tq",
+  "src/builtins/array.tq",
+  "src/builtins/array-foreach.tq",
+  "src/builtins/array-sort.tq",
+  "src/builtins/typed-array.tq",
+  "src/builtins/data-view.tq",
+  "test/torque/test-torque.tq",
+]
+
+torque_modules = [
+  "base",
+  "array",
+  "typed-array",
+  "data-view",
+  "test",
+]
+
+action("run_torque") {
+  visibility = [
+    ":*",
+    "tools/gcmole/:*",
+    "test/cctest/:*",
+  ]
+
+  # We reuse the snapshot toolchain for building torque to not build v8_libbase
+  # on the host more than once. On mips with big endian, the snapshot toolchain
+  # is the target toolchain and, hence, can't be used.
+  v8_torque_toolchain = v8_snapshot_toolchain
+  if (host_cpu == "x64" &&
+      (v8_current_cpu == "mips" || v8_current_cpu == "mips64")) {
+    v8_torque_toolchain = "//build/toolchain/linux:clang_x64"
+  }
+
+  deps = [
+    ":torque($v8_torque_toolchain)",
+  ]
+
+  script = "tools/run.py"
+
+  sources = torque_files
+
+  outputs = [
+    "$target_gen_dir/torque-generated/builtin-definitions-from-dsl.h",
+  ]
+  foreach(module, torque_modules) {
+    outputs += [
+      "$target_gen_dir/torque-generated/builtins-$module-from-dsl-gen.cc",
+      "$target_gen_dir/torque-generated/builtins-$module-from-dsl-gen.h",
+    ]
+  }
+
+  args = [
+    "./" + rebase_path(get_label_info(":torque($v8_torque_toolchain)",
+                                      "root_out_dir") + "/torque",
+                       root_build_dir),
+    "-o",
+    rebase_path("$target_gen_dir/torque-generated", root_build_dir),
+  ]
+
+  foreach(file, torque_files) {
+    args += [ rebase_path(file, root_build_dir) ]
+  }
+}
+
+v8_header_set("torque_generated_core") {
+  visibility = [ ":*" ]  # Only targets in this file can depend on this.
+
+  deps = [
+    ":run_torque",
+  ]
+
+  sources = [
+    "$target_gen_dir/torque-generated/builtin-definitions-from-dsl.h",
+  ]
+
+  configs = [ ":internal_config" ]
+}
+
+v8_source_set("torque_generated_initializers") {
+  visibility = [ ":*" ]  # Only targets in this file can depend on this.
+
+  deps = [
+    ":run_torque",
+  ]
+
+  if (v8_enable_i18n_support) {
+    public_deps = [
+      "//third_party/icu",
+    ]
+  }
+
+  sources = []
+  foreach(module, torque_modules) {
+    sources += [
+      "$target_gen_dir/torque-generated/builtins-$module-from-dsl-gen.cc",
+      "$target_gen_dir/torque-generated/builtins-$module-from-dsl-gen.h",
+    ]
+  }
+
+  configs = [ ":internal_config" ]
+}
+
 # Template to generate different V8 snapshots based on different runtime flags.
 # Can be invoked with run_mksnapshot(<name>). The target will resolve to
 # run_mksnapshot_<name>. If <name> is "default", no file suffixes will be used.
@@ -925,6 +1067,11 @@ template("run_mksnapshot") {
         "--no-turbo-rewrite-far-jumps",
         "--no-turbo-verify-allocation",
       ]
+
+      if (v8_enable_debugging_features && v8_enable_slow_dchecks) {
+        # mksnapshot only accepts this flag if ENABLE_SLOW_DCHECKS is defined.
+        args += [ "--no-enable-slow-asserts" ]
+      }
     }
   }
 }
@@ -1054,6 +1201,9 @@ if (v8_use_snapshot && !v8_use_external_startup_data) {
       ":run_mksnapshot_default",
     ]
 
+    # Do not publicize any header to remove build dependency.
+    public = []
+
     sources = [
       "$target_gen_dir/experimental-extras-libraries.cc",
       "$target_gen_dir/extras-libraries.cc",
@@ -1064,6 +1214,8 @@ if (v8_use_snapshot && !v8_use_external_startup_data) {
 
     if (v8_enable_embedded_builtins) {
       sources += [ "$target_gen_dir/embedded.cc" ]
+    } else {
+      sources += [ "src/snapshot/embedded-empty.cc" ]
     }
 
     if (use_jumbo_build == true) {
@@ -1104,6 +1256,9 @@ if (v8_use_snapshot && v8_use_external_startup_data) {
       "src/snapshot/snapshot-external.cc",
     ]
 
+    # Do not publicize any header to remove build dependency.
+    public = []
+
     if (v8_enable_embedded_builtins) {
       sources += [ "$target_gen_dir/embedded.cc" ]
 
@@ -1117,6 +1272,8 @@ if (v8_use_snapshot && v8_use_external_startup_data) {
           ]
         }
       }
+    } else {
+      sources += [ "src/snapshot/embedded-empty.cc" ]
     }
 
     configs = [ ":internal_config" ]
@@ -1130,6 +1287,7 @@ v8_source_set("v8_initializers") {
   ]
 
   deps = [
+    ":torque_generated_initializers",
     ":v8_base",
   ]
 
@@ -1153,6 +1311,7 @@ v8_source_set("v8_initializers") {
     "src/builtins/builtins-constructor-gen.h",
     "src/builtins/builtins-constructor.h",
     "src/builtins/builtins-conversion-gen.cc",
+    "src/builtins/builtins-data-view-gen.h",
     "src/builtins/builtins-date-gen.cc",
     "src/builtins/builtins-debug-gen.cc",
     "src/builtins/builtins-function-gen.cc",
@@ -1165,6 +1324,8 @@ v8_source_set("v8_initializers") {
     "src/builtins/builtins-intl-gen.cc",
     "src/builtins/builtins-iterator-gen.cc",
     "src/builtins/builtins-iterator-gen.h",
+    "src/builtins/builtins-lazy-gen.cc",
+    "src/builtins/builtins-lazy-gen.h",
     "src/builtins/builtins-math-gen.cc",
     "src/builtins/builtins-math-gen.h",
     "src/builtins/builtins-number-gen.cc",
@@ -1180,8 +1341,8 @@ v8_source_set("v8_initializers") {
     "src/builtins/builtins-string-gen.cc",
     "src/builtins/builtins-string-gen.h",
     "src/builtins/builtins-symbol-gen.cc",
-    "src/builtins/builtins-typedarray-gen.cc",
-    "src/builtins/builtins-typedarray-gen.h",
+    "src/builtins/builtins-typed-array-gen.cc",
+    "src/builtins/builtins-typed-array-gen.h",
     "src/builtins/builtins-utils-gen.h",
     "src/builtins/builtins-wasm-gen.cc",
     "src/builtins/growable-fixed-array-gen.cc",
@@ -1276,6 +1437,11 @@ v8_source_set("v8_init") {
     ### gcmole(all) ###
     "src/setup-isolate-full.cc",
   ]
+  if (v8_enable_i18n_support) {
+    public_deps = [
+      "//third_party/icu",
+    ]
+  }
 
   configs = [ ":internal_config" ]
 }
@@ -1340,6 +1506,7 @@ v8_source_set("v8_base") {
     "src/api.h",
     "src/arguments.cc",
     "src/arguments.h",
+    "src/asan.h",
     "src/asmjs/asm-js.cc",
     "src/asmjs/asm-js.h",
     "src/asmjs/asm-names.h",
@@ -1351,6 +1518,7 @@ v8_source_set("v8_base") {
     "src/asmjs/asm-types.h",
     "src/asmjs/switch-logic.cc",
     "src/asmjs/switch-logic.h",
+    "src/assembler-arch.h",
     "src/assembler-inl.h",
     "src/assembler.cc",
     "src/assembler.h",
@@ -1364,8 +1532,6 @@ v8_source_set("v8_base") {
     "src/ast/ast-value-factory.h",
     "src/ast/ast.cc",
     "src/ast/ast.h",
-    "src/ast/compile-time-value.cc",
-    "src/ast/compile-time-value.h",
     "src/ast/context-slot-cache.cc",
     "src/ast/context-slot-cache.h",
     "src/ast/modules.cc",
@@ -1420,7 +1586,7 @@ v8_source_set("v8_base") {
     "src/builtins/builtins-sharedarraybuffer.cc",
     "src/builtins/builtins-string.cc",
     "src/builtins/builtins-symbol.cc",
-    "src/builtins/builtins-typedarray.cc",
+    "src/builtins/builtins-typed-array.cc",
     "src/builtins/builtins-utils.h",
     "src/builtins/builtins.cc",
     "src/builtins/builtins.h",
@@ -1438,6 +1604,8 @@ v8_source_set("v8_base") {
     "src/code-events.h",
     "src/code-factory.cc",
     "src/code-factory.h",
+    "src/code-reference.cc",
+    "src/code-reference.h",
     "src/code-stub-assembler.cc",
     "src/code-stub-assembler.h",
     "src/code-stubs-utils.h",
@@ -1448,8 +1616,6 @@ v8_source_set("v8_base") {
     "src/collector.h",
     "src/compilation-cache.cc",
     "src/compilation-cache.h",
-    "src/compilation-dependencies.cc",
-    "src/compilation-dependencies.h",
     "src/compilation-statistics.cc",
     "src/compilation-statistics.h",
     "src/compiler-dispatcher/compiler-dispatcher-job.cc",
@@ -1495,8 +1661,12 @@ v8_source_set("v8_base") {
     "src/compiler/common-operator-reducer.h",
     "src/compiler/common-operator.cc",
     "src/compiler/common-operator.h",
+    "src/compiler/compilation-dependencies.cc",
+    "src/compiler/compilation-dependencies.h",
     "src/compiler/compiler-source-position-table.cc",
     "src/compiler/compiler-source-position-table.h",
+    "src/compiler/constant-folding-reducer.cc",
+    "src/compiler/constant-folding-reducer.h",
     "src/compiler/control-equivalence.cc",
     "src/compiler/control-equivalence.h",
     "src/compiler/control-flow-optimizer.cc",
@@ -1539,8 +1709,6 @@ v8_source_set("v8_base") {
     "src/compiler/instruction.h",
     "src/compiler/int64-lowering.cc",
     "src/compiler/int64-lowering.h",
-    "src/compiler/js-builtin-reducer.cc",
-    "src/compiler/js-builtin-reducer.h",
     "src/compiler/js-call-reducer.cc",
     "src/compiler/js-call-reducer.h",
     "src/compiler/js-context-specialization.cc",
@@ -1551,6 +1719,8 @@ v8_source_set("v8_base") {
     "src/compiler/js-generic-lowering.h",
     "src/compiler/js-graph.cc",
     "src/compiler/js-graph.h",
+    "src/compiler/js-heap-broker.cc",
+    "src/compiler/js-heap-broker.h",
     "src/compiler/js-inlining-heuristic.cc",
     "src/compiler/js-inlining-heuristic.h",
     "src/compiler/js-inlining.cc",
@@ -1581,6 +1751,8 @@ v8_source_set("v8_base") {
     "src/compiler/loop-variable-optimizer.h",
     "src/compiler/machine-graph-verifier.cc",
     "src/compiler/machine-graph-verifier.h",
+    "src/compiler/machine-graph.cc",
+    "src/compiler/machine-graph.h",
     "src/compiler/machine-operator-reducer.cc",
     "src/compiler/machine-operator-reducer.h",
     "src/compiler/machine-operator.cc",
@@ -1596,6 +1768,8 @@ v8_source_set("v8_base") {
     "src/compiler/node-marker.h",
     "src/compiler/node-matchers.cc",
     "src/compiler/node-matchers.h",
+    "src/compiler/node-origin-table.cc",
+    "src/compiler/node-origin-table.h",
     "src/compiler/node-properties.cc",
     "src/compiler/node-properties.h",
     "src/compiler/node.cc",
@@ -1647,6 +1821,8 @@ v8_source_set("v8_base") {
     "src/compiler/store-store-elimination.h",
     "src/compiler/type-cache.cc",
     "src/compiler/type-cache.h",
+    "src/compiler/type-narrowing-reducer.cc",
+    "src/compiler/type-narrowing-reducer.h",
     "src/compiler/typed-optimization.cc",
     "src/compiler/typed-optimization.h",
     "src/compiler/typer.cc",
@@ -1660,7 +1836,6 @@ v8_source_set("v8_base") {
     "src/compiler/verifier.h",
     "src/compiler/wasm-compiler.cc",
     "src/compiler/wasm-compiler.h",
-    "src/compiler/wasm-linkage.cc",
     "src/compiler/zone-stats.cc",
     "src/compiler/zone-stats.h",
     "src/contexts-inl.h",
@@ -1784,6 +1959,8 @@ v8_source_set("v8_base") {
     "src/heap/gc-idle-time-handler.h",
     "src/heap/gc-tracer.cc",
     "src/heap/gc-tracer.h",
+    "src/heap/heap-controller.cc",
+    "src/heap/heap-controller.h",
     "src/heap/heap-inl.h",
     "src/heap/heap.cc",
     "src/heap/heap.h",
@@ -1921,11 +2098,11 @@ v8_source_set("v8_base") {
     "src/lookup-cache.h",
     "src/lookup.cc",
     "src/lookup.h",
+    "src/lsan.h",
     "src/machine-type.cc",
     "src/machine-type.h",
     "src/macro-assembler-inl.h",
     "src/macro-assembler.h",
-    "src/managed.h",
     "src/map-updater.cc",
     "src/map-updater.h",
     "src/messages.cc",
@@ -1938,6 +2115,8 @@ v8_source_set("v8_base") {
     "src/objects-printer.cc",
     "src/objects.cc",
     "src/objects.h",
+    "src/objects/api-callbacks-inl.h",
+    "src/objects/api-callbacks.h",
     "src/objects/arguments-inl.h",
     "src/objects/arguments.h",
     "src/objects/bigint.cc",
@@ -1957,21 +2136,30 @@ v8_source_set("v8_base") {
     "src/objects/frame-array.h",
     "src/objects/hash-table-inl.h",
     "src/objects/hash-table.h",
+    "src/objects/intl-objects-inl.h",
     "src/objects/intl-objects.cc",
     "src/objects/intl-objects.h",
     "src/objects/js-array-inl.h",
     "src/objects/js-array.h",
     "src/objects/js-collection-inl.h",
     "src/objects/js-collection.h",
+    "src/objects/js-locale-inl.h",
+    "src/objects/js-locale.cc",
+    "src/objects/js-locale.h",
     "src/objects/js-promise-inl.h",
     "src/objects/js-promise.h",
     "src/objects/js-regexp-inl.h",
     "src/objects/js-regexp-string-iterator-inl.h",
     "src/objects/js-regexp-string-iterator.h",
     "src/objects/js-regexp.h",
+    "src/objects/js-relative-time-format-inl.h",
+    "src/objects/js-relative-time-format.cc",
+    "src/objects/js-relative-time-format.h",
     "src/objects/literal-objects-inl.h",
     "src/objects/literal-objects.cc",
     "src/objects/literal-objects.h",
+    "src/objects/managed.cc",
+    "src/objects/managed.h",
     "src/objects/map-inl.h",
     "src/objects/map.h",
     "src/objects/maybe-object-inl.h",
@@ -1985,6 +2173,9 @@ v8_source_set("v8_base") {
     "src/objects/name.h",
     "src/objects/object-macros-undef.h",
     "src/objects/object-macros.h",
+    "src/objects/ordered-hash-table-inl.h",
+    "src/objects/ordered-hash-table.cc",
+    "src/objects/ordered-hash-table.h",
     "src/objects/promise-inl.h",
     "src/objects/promise.h",
     "src/objects/property-descriptor-object-inl.h",
@@ -2001,6 +2192,8 @@ v8_source_set("v8_base") {
     "src/objects/string.h",
     "src/objects/template-objects.cc",
     "src/objects/template-objects.h",
+    "src/objects/templates-inl.h",
+    "src/objects/templates.h",
     "src/optimized-compilation-info.cc",
     "src/optimized-compilation-info.h",
     "src/ostreams.cc",
@@ -2019,7 +2212,6 @@ v8_source_set("v8_base") {
     "src/parsing/parsing.cc",
     "src/parsing/parsing.h",
     "src/parsing/pattern-rewriter.cc",
-    "src/parsing/preparse-data-format.h",
     "src/parsing/preparse-data.cc",
     "src/parsing/preparse-data.h",
     "src/parsing/preparsed-scope-data.cc",
@@ -2095,6 +2287,8 @@ v8_source_set("v8_base") {
     "src/register-configuration.cc",
     "src/register-configuration.h",
     "src/reglist.h",
+    "src/roots-inl.h",
+    "src/roots.h",
     "src/runtime-profiler.cc",
     "src/runtime-profiler.h",
     "src/runtime/runtime-array.cc",
@@ -2105,7 +2299,6 @@ v8_source_set("v8_base") {
     "src/runtime/runtime-compiler.cc",
     "src/runtime/runtime-date.cc",
     "src/runtime/runtime-debug.cc",
-    "src/runtime/runtime-error.cc",
     "src/runtime/runtime-forin.cc",
     "src/runtime/runtime-function.cc",
     "src/runtime/runtime-futex.cc",
@@ -2114,7 +2307,6 @@ v8_source_set("v8_base") {
     "src/runtime/runtime-interpreter.cc",
     "src/runtime/runtime-intl.cc",
     "src/runtime/runtime-literals.cc",
-    "src/runtime/runtime-liveedit.cc",
     "src/runtime/runtime-maths.cc",
     "src/runtime/runtime-module.cc",
     "src/runtime/runtime-numbers.cc",
@@ -2166,6 +2358,7 @@ v8_source_set("v8_base") {
     "src/snapshot/partial-deserializer.h",
     "src/snapshot/partial-serializer.cc",
     "src/snapshot/partial-serializer.h",
+    "src/snapshot/references.h",
     "src/snapshot/serializer-common.cc",
     "src/snapshot/serializer-common.h",
     "src/snapshot/serializer.cc",
@@ -2207,10 +2400,13 @@ v8_source_set("v8_base") {
     "src/transitions-inl.h",
     "src/transitions.cc",
     "src/transitions.h",
+    "src/trap-handler/handler-inside.cc",
     "src/trap-handler/handler-outside.cc",
     "src/trap-handler/handler-shared.cc",
     "src/trap-handler/trap-handler-internal.h",
     "src/trap-handler/trap-handler.h",
+    "src/turbo-assembler.cc",
+    "src/turbo-assembler.h",
     "src/type-hints.cc",
     "src/type-hints.h",
     "src/unicode-cache-inl.h",
@@ -2247,13 +2443,16 @@ v8_source_set("v8_base") {
     "src/wasm/baseline/liftoff-assembler.cc",
     "src/wasm/baseline/liftoff-assembler.h",
     "src/wasm/baseline/liftoff-compiler.cc",
+    "src/wasm/baseline/liftoff-compiler.h",
     "src/wasm/baseline/liftoff-register.h",
-    "src/wasm/compilation-manager.cc",
-    "src/wasm/compilation-manager.h",
     "src/wasm/decoder.h",
     "src/wasm/function-body-decoder-impl.h",
     "src/wasm/function-body-decoder.cc",
     "src/wasm/function-body-decoder.h",
+    "src/wasm/function-compiler.cc",
+    "src/wasm/function-compiler.h",
+    "src/wasm/jump-table-assembler.cc",
+    "src/wasm/jump-table-assembler.h",
     "src/wasm/leb-helper.h",
     "src/wasm/local-decl-encoder.cc",
     "src/wasm/local-decl-encoder.h",
@@ -2267,10 +2466,9 @@ v8_source_set("v8_base") {
     "src/wasm/signature-map.h",
     "src/wasm/streaming-decoder.cc",
     "src/wasm/streaming-decoder.h",
+    "src/wasm/value-type.h",
     "src/wasm/wasm-code-manager.cc",
     "src/wasm/wasm-code-manager.h",
-    "src/wasm/wasm-code-specialization.cc",
-    "src/wasm/wasm-code-specialization.h",
     "src/wasm/wasm-constants.h",
     "src/wasm/wasm-debug.cc",
     "src/wasm/wasm-engine.cc",
@@ -2282,6 +2480,7 @@ v8_source_set("v8_base") {
     "src/wasm/wasm-js.cc",
     "src/wasm/wasm-js.h",
     "src/wasm/wasm-limits.h",
+    "src/wasm/wasm-linkage.h",
     "src/wasm/wasm-memory.cc",
     "src/wasm/wasm-memory.h",
     "src/wasm/wasm-module-builder.cc",
@@ -2341,6 +2540,7 @@ v8_source_set("v8_base") {
       "src/ia32/assembler-ia32.h",
       "src/ia32/code-stubs-ia32.cc",
       "src/ia32/codegen-ia32.cc",
+      "src/ia32/constants-ia32.h",
       "src/ia32/cpu-ia32.cc",
       "src/ia32/deoptimizer-ia32.cc",
       "src/ia32/disasm-ia32.cc",
@@ -2374,6 +2574,7 @@ v8_source_set("v8_base") {
       "src/x64/assembler-x64.h",
       "src/x64/code-stubs-x64.cc",
       "src/x64/codegen-x64.cc",
+      "src/x64/constants-x64.h",
       "src/x64/cpu-x64.cc",
       "src/x64/deoptimizer-x64.cc",
       "src/x64/disasm-x64.cc",
@@ -2388,7 +2589,13 @@ v8_source_set("v8_base") {
       "src/x64/sse-instr.h",
     ]
     if (is_linux) {
-      sources += [ "src/trap-handler/handler-inside.cc" ]
+      sources += [
+        "src/trap-handler/handler-inside-linux.cc",
+        "src/trap-handler/handler-outside-linux.cc",
+      ]
+    }
+    if (is_win) {
+      sources += [ "src/trap-handler/handler-outside-win.cc" ]
     }
   } else if (v8_current_cpu == "arm") {
     sources += [  ### gcmole(arch:arm) ###
@@ -2407,7 +2614,6 @@ v8_source_set("v8_base") {
       "src/arm/frame-constants-arm.cc",
       "src/arm/frame-constants-arm.h",
       "src/arm/interface-descriptors-arm.cc",
-      "src/arm/interface-descriptors-arm.h",
       "src/arm/macro-assembler-arm.cc",
       "src/arm/macro-assembler-arm.h",
       "src/arm/simulator-arm.cc",
@@ -2448,7 +2654,6 @@ v8_source_set("v8_base") {
       "src/arm64/instrument-arm64.cc",
       "src/arm64/instrument-arm64.h",
       "src/arm64/interface-descriptors-arm64.cc",
-      "src/arm64/interface-descriptors-arm64.h",
       "src/arm64/macro-assembler-arm64-inl.h",
       "src/arm64/macro-assembler-arm64.cc",
       "src/arm64/macro-assembler-arm64.h",
@@ -2597,6 +2802,7 @@ v8_source_set("v8_base") {
 
   defines = []
   deps = [
+    ":torque_generated_core",
     ":v8_headers",
     ":v8_libbase",
     ":v8_libsampler",
@@ -2617,8 +2823,15 @@ v8_source_set("v8_base") {
       "src/char-predicates.cc",
       "src/intl.cc",
       "src/intl.h",
+      "src/objects/intl-objects-inl.h",
       "src/objects/intl-objects.cc",
       "src/objects/intl-objects.h",
+      "src/objects/js-locale-inl.h",
+      "src/objects/js-locale.cc",
+      "src/objects/js-locale.h",
+      "src/objects/js-relative-time-format-inl.h",
+      "src/objects/js-relative-time-format.cc",
+      "src/objects/js-relative-time-format.h",
       "src/runtime/runtime-intl.cc",
     ]
   }
@@ -2662,6 +2875,7 @@ v8_component("v8_libbase") {
     "src/base/ieee754.h",
     "src/base/iterator.h",
     "src/base/lazy-instance.h",
+    "src/base/list.h",
     "src/base/logging.cc",
     "src/base/logging.h",
     "src/base/macros.h",
@@ -2698,6 +2912,8 @@ v8_component("v8_libbase") {
 
   public_configs = [ ":libbase_config" ]
 
+  public_deps = []
+
   data = []
 
   data_deps = []
@@ -2872,6 +3088,10 @@ v8_source_set("fuzzer_support") {
     ":v8_libbase",
     ":v8_libplatform",
   ]
+
+  if (v8_enable_i18n_support) {
+    public_deps += [ "//third_party/icu" ]
+  }
 }
 
 ###############################################################################
@@ -2890,7 +3110,6 @@ if (v8_monolithic) {
       ":v8_libbase",
       ":v8_libplatform",
       ":v8_libsampler",
-      "//build/config:exe_and_shlib_deps",
       "//build/win:default_exe_manifest",
     ]
 
@@ -2918,12 +3137,77 @@ if (v8_use_snapshot && current_toolchain == v8_snapshot_toolchain) {
       ":v8_libbase",
       ":v8_libplatform",
       ":v8_nosnapshot",
-      "//build/config:exe_and_shlib_deps",
       "//build/win:default_exe_manifest",
     ]
   }
 }
 
+if (current_toolchain == v8_snapshot_toolchain) {
+  v8_executable("torque") {
+    visibility = [ ":*" ]  # Only targets in this file can depend on this.
+
+    defines = [ "ANTLR4CPP_STATIC" ]
+
+    include_dirs = [
+      "third_party/antlr4/runtime/Cpp/runtime/src",
+      "src/torque",
+    ]
+
+    sources = [
+      "src/torque/TorqueBaseVisitor.cpp",
+      "src/torque/TorqueBaseVisitor.h",
+      "src/torque/TorqueLexer.cpp",
+      "src/torque/TorqueLexer.h",
+      "src/torque/TorqueParser.cpp",
+      "src/torque/TorqueParser.h",
+      "src/torque/TorqueVisitor.cpp",
+      "src/torque/TorqueVisitor.h",
+      "src/torque/ast-generator.cc",
+      "src/torque/ast-generator.h",
+      "src/torque/ast.h",
+      "src/torque/contextual.h",
+      "src/torque/declarable.cc",
+      "src/torque/declarable.h",
+      "src/torque/declaration-visitor.cc",
+      "src/torque/declaration-visitor.h",
+      "src/torque/declarations.cc",
+      "src/torque/declarations.h",
+      "src/torque/file-visitor.cc",
+      "src/torque/file-visitor.h",
+      "src/torque/global-context.h",
+      "src/torque/implementation-visitor.cc",
+      "src/torque/implementation-visitor.h",
+      "src/torque/scope.cc",
+      "src/torque/scope.h",
+      "src/torque/torque.cc",
+      "src/torque/type-oracle.h",
+      "src/torque/types.cc",
+      "src/torque/types.h",
+      "src/torque/utils.cc",
+      "src/torque/utils.h",
+    ]
+
+    deps = [
+      ":v8_libbase",
+      "third_party/antlr4:antlr4",
+      "//build/win:default_exe_manifest",
+    ]
+
+    remove_configs = [
+      "//build/config/compiler:no_rtti",
+      "//build/config/compiler:no_exceptions",
+    ]
+
+    configs = [
+      "//build/config/compiler:rtti",
+      "//build/config/compiler:exceptions",
+      "third_party/antlr4:antlr-compatibility",
+      ":external_config",
+      ":internal_config_base",
+    ]
+  }
+}
+
 ###############################################################################
 # Public targets
 #
@@ -2941,12 +3225,16 @@ group("gn_all") {
     ":d8",
     ":v8_fuzzers",
     ":v8_hello_world",
-    ":v8_parser_shell",
     ":v8_sample_process",
     "test:gn_all",
     "tools:gn_all",
   ]
 
+  if (v8_custom_deps != "") {
+    # Custom dependency from directory under v8/custom_deps.
+    deps += [ v8_custom_deps ]
+  }
+
   if (want_v8_shell) {
     deps += [ ":v8_shell" ]
   }
@@ -3062,6 +3350,8 @@ if (is_component_build) {
 v8_executable("d8") {
   sources = [
     "$target_gen_dir/d8-js.cc",
+    "src/async-hooks-wrapper.cc",
+    "src/async-hooks-wrapper.h",
     "src/d8-console.cc",
     "src/d8-console.h",
     "src/d8.cc",
@@ -3080,7 +3370,6 @@ v8_executable("d8") {
     ":v8",
     ":v8_libbase",
     ":v8_libplatform",
-    "//build/config:exe_and_shlib_deps",
     "//build/win:default_exe_manifest",
   ]
 
@@ -3117,7 +3406,6 @@ v8_executable("v8_hello_world") {
     ":v8",
     ":v8_libbase",
     ":v8_libplatform",
-    "//build/config:exe_and_shlib_deps",
     "//build/win:default_exe_manifest",
   ]
 }
@@ -3138,27 +3426,6 @@ v8_executable("v8_sample_process") {
     ":v8",
     ":v8_libbase",
     ":v8_libplatform",
-    "//build/config:exe_and_shlib_deps",
-    "//build/win:default_exe_manifest",
-  ]
-}
-
-v8_executable("v8_parser_shell") {
-  sources = [
-    "tools/parser-shell.cc",
-    "tools/shell-utils.h",
-  ]
-
-  configs = [
-    ":external_config",
-    ":internal_config_base",
-  ]
-
-  deps = [
-    ":v8",
-    ":v8_libbase",
-    ":v8_libplatform",
-    "//build/config:exe_and_shlib_deps",
     "//build/win:default_exe_manifest",
   ]
 }
@@ -3180,7 +3447,6 @@ if (want_v8_shell) {
       ":v8",
       ":v8_libbase",
       ":v8_libplatform",
-      "//build/config:exe_and_shlib_deps",
       "//build/win:default_exe_manifest",
     ]
   }
@@ -3192,7 +3458,6 @@ template("v8_fuzzer") {
   v8_executable("v8_simple_" + name) {
     deps = [
       ":" + name,
-      "//build/config:exe_and_shlib_deps",
       "//build/win:default_exe_manifest",
     ]
 
@@ -3301,6 +3566,16 @@ v8_source_set("wasm_module_runner") {
     "test/common/wasm/wasm-module-runner.h",
   ]
 
+  deps = [
+    ":torque_generated_core",
+  ]
+
+  if (v8_enable_i18n_support) {
+    public_deps = [
+      "//third_party/icu",
+    ]
+  }
+
   configs = [
     ":external_config",
     ":internal_config_base",
@@ -3374,6 +3649,16 @@ v8_source_set("lib_wasm_fuzzer_common") {
     "test/fuzzer/wasm-fuzzer-common.h",
   ]
 
+  deps = [
+    ":torque_generated_core",
+  ]
+
+  if (v8_enable_i18n_support) {
+    public_deps = [
+      "//third_party/icu",
+    ]
+  }
+
   configs = [
     ":external_config",
     ":internal_config_base",
diff --git a/deps/v8/ChangeLog b/deps/v8/ChangeLog
index e6b825092c4a1d..375d57ebc897e3 100644
--- a/deps/v8/ChangeLog
+++ b/deps/v8/ChangeLog
@@ -1,4121 +1,7 @@
-2018-04-11: Version 6.7.288
+2017-12-19: Sentinel
 
-        Performance and stability improvements on all platforms.
-
-
-2018-04-11: Version 6.7.287
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-11: Version 6.7.286
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-11: Version 6.7.285
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-11: Version 6.7.284
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-10: Version 6.7.283
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-10: Version 6.7.282
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-10: Version 6.7.281
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-10: Version 6.7.280
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-10: Version 6.7.279
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-10: Version 6.7.278
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-10: Version 6.7.277
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-10: Version 6.7.276
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-10: Version 6.7.275
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-10: Version 6.7.274
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-10: Version 6.7.273
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-10: Version 6.7.272
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-10: Version 6.7.271
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-10: Version 6.7.270
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-10: Version 6.7.269
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-09: Version 6.7.268
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-09: Version 6.7.267
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-09: Version 6.7.266
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-09: Version 6.7.265
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-09: Version 6.7.264
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-09: Version 6.7.263
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-09: Version 6.7.262
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-09: Version 6.7.261
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-09: Version 6.7.260
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-09: Version 6.7.259
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-09: Version 6.7.258
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-09: Version 6.7.257
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-09: Version 6.7.256
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-09: Version 6.7.255
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-09: Version 6.7.254
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-09: Version 6.7.253
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-09: Version 6.7.252
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-09: Version 6.7.251
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-06: Version 6.7.250
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-06: Version 6.7.249
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-06: Version 6.7.248
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-06: Version 6.7.247
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-06: Version 6.7.246
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-06: Version 6.7.245
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-06: Version 6.7.244
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-06: Version 6.7.243
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-06: Version 6.7.242
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-06: Version 6.7.241
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-05: Version 6.7.240
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-05: Version 6.7.239
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-05: Version 6.7.238
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-05: Version 6.7.237
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-05: Version 6.7.236
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-05: Version 6.7.235
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-05: Version 6.7.234
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-05: Version 6.7.233
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-05: Version 6.7.232
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-05: Version 6.7.231
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-05: Version 6.7.230
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-05: Version 6.7.229
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-05: Version 6.7.228
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-04: Version 6.7.227
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-04: Version 6.7.226
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-04: Version 6.7.225
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-04: Version 6.7.224
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-04: Version 6.7.223
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-04: Version 6.7.222
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-04: Version 6.7.221
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-04: Version 6.7.220
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-04: Version 6.7.219
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-04: Version 6.7.218
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-04: Version 6.7.217
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-04: Version 6.7.216
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-03: Version 6.7.215
-
-        Performance and stability improvements on all platforms.
-
-
-2018-04-03: Version 6.7.214
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-30: Version 6.7.213
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-30: Version 6.7.212
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-29: Version 6.7.211
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-29: Version 6.7.210
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-29: Version 6.7.209
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-29: Version 6.7.208
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-29: Version 6.7.207
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-29: Version 6.7.206
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-29: Version 6.7.205
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-29: Version 6.7.204
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-28: Version 6.7.203
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-28: Version 6.7.202
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-28: Version 6.7.201
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-28: Version 6.7.200
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-28: Version 6.7.199
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-28: Version 6.7.198
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-28: Version 6.7.197
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-28: Version 6.7.196
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-28: Version 6.7.195
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-28: Version 6.7.194
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-27: Version 6.7.193
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-27: Version 6.7.192
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-27: Version 6.7.191
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-27: Version 6.7.190
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-27: Version 6.7.189
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-27: Version 6.7.188
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-27: Version 6.7.187
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-27: Version 6.7.186
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-27: Version 6.7.185
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-27: Version 6.7.184
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-26: Version 6.7.183
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-26: Version 6.7.182
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-26: Version 6.7.181
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-26: Version 6.7.180
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-26: Version 6.7.179
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-26: Version 6.7.178
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-26: Version 6.7.177
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-26: Version 6.7.176
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-26: Version 6.7.175
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-26: Version 6.7.174
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-26: Version 6.7.173
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-26: Version 6.7.172
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-26: Version 6.7.171
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-26: Version 6.7.170
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-26: Version 6.7.169
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-26: Version 6.7.168
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-26: Version 6.7.167
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-26: Version 6.7.166
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-24: Version 6.7.165
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-24: Version 6.7.164
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-24: Version 6.7.163
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-23: Version 6.7.162
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-23: Version 6.7.161
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-23: Version 6.7.160
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-23: Version 6.7.159
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-23: Version 6.7.158
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-23: Version 6.7.157
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-23: Version 6.7.156
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-23: Version 6.7.155
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-23: Version 6.7.154
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-23: Version 6.7.153
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-23: Version 6.7.152
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-23: Version 6.7.151
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-23: Version 6.7.150
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-23: Version 6.7.149
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-23: Version 6.7.148
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-23: Version 6.7.147
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-22: Version 6.7.146
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-22: Version 6.7.145
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-22: Version 6.7.144
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-22: Version 6.7.143
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-22: Version 6.7.142
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-22: Version 6.7.141
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-22: Version 6.7.140
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-21: Version 6.7.139
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-21: Version 6.7.138
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-21: Version 6.7.137
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-21: Version 6.7.136
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-21: Version 6.7.135
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-21: Version 6.7.134
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-21: Version 6.7.133
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-21: Version 6.7.132
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-21: Version 6.7.131
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-21: Version 6.7.130
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-21: Version 6.7.129
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-21: Version 6.7.128
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-21: Version 6.7.127
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-21: Version 6.7.126
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-21: Version 6.7.125
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-21: Version 6.7.124
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-21: Version 6.7.123
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-20: Version 6.7.122
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-20: Version 6.7.121
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-20: Version 6.7.120
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-20: Version 6.7.119
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-20: Version 6.7.118
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-20: Version 6.7.117
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-20: Version 6.7.116
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-20: Version 6.7.115
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-20: Version 6.7.114
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-20: Version 6.7.113
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-20: Version 6.7.112
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-20: Version 6.7.111
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-20: Version 6.7.110
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-19: Version 6.7.109
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-19: Version 6.7.108
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-19: Version 6.7.107
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-19: Version 6.7.106
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-19: Version 6.7.105
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-19: Version 6.7.104
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-19: Version 6.7.103
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-17: Version 6.7.102
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-16: Version 6.7.101
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-16: Version 6.7.100
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-16: Version 6.7.99
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-16: Version 6.7.98
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-16: Version 6.7.97
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-16: Version 6.7.96
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-16: Version 6.7.95
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-16: Version 6.7.94
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-16: Version 6.7.93
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-16: Version 6.7.92
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-16: Version 6.7.91
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-16: Version 6.7.90
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-16: Version 6.7.89
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-15: Version 6.7.88
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-15: Version 6.7.87
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-15: Version 6.7.86
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-15: Version 6.7.85
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-15: Version 6.7.84
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-15: Version 6.7.83
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-15: Version 6.7.82
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-15: Version 6.7.81
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-15: Version 6.7.80
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-15: Version 6.7.79
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-15: Version 6.7.78
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-15: Version 6.7.77
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-15: Version 6.7.76
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-15: Version 6.7.75
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-15: Version 6.7.74
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-15: Version 6.7.73
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-14: Version 6.7.72
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-14: Version 6.7.71
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-14: Version 6.7.70
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-14: Version 6.7.69
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-14: Version 6.7.68
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-14: Version 6.7.67
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-14: Version 6.7.66
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-14: Version 6.7.65
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-14: Version 6.7.64
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-14: Version 6.7.63
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-14: Version 6.7.62
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-14: Version 6.7.61
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-14: Version 6.7.60
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-14: Version 6.7.59
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-14: Version 6.7.58
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-14: Version 6.7.57
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-14: Version 6.7.56
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-14: Version 6.7.55
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-14: Version 6.7.54
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-13: Version 6.7.53
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-13: Version 6.7.52
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-13: Version 6.7.51
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-13: Version 6.7.50
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-13: Version 6.7.49
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-13: Version 6.7.48
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-13: Version 6.7.47
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-13: Version 6.7.46
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-13: Version 6.7.45
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-12: Version 6.7.44
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-12: Version 6.7.43
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-12: Version 6.7.42
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-12: Version 6.7.41
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-12: Version 6.7.40
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-12: Version 6.7.39
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-12: Version 6.7.38
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-12: Version 6.7.37
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-12: Version 6.7.36
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-12: Version 6.7.35
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-12: Version 6.7.34
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-12: Version 6.7.33
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-12: Version 6.7.32
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-10: Version 6.7.31
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-09: Version 6.7.30
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-09: Version 6.7.29
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-08: Version 6.7.28
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-08: Version 6.7.27
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-08: Version 6.7.26
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-07: Version 6.7.25
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-07: Version 6.7.24
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-07: Version 6.7.23
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-06: Version 6.7.22
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-06: Version 6.7.21
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-06: Version 6.7.20
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-06: Version 6.7.19
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-06: Version 6.7.18
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-06: Version 6.7.17
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-06: Version 6.7.16
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-05: Version 6.7.15
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-05: Version 6.7.14
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-05: Version 6.7.13
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-05: Version 6.7.12
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-05: Version 6.7.11
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-05: Version 6.7.10
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-05: Version 6.7.9
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-02: Version 6.7.8
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-02: Version 6.7.7
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-02: Version 6.7.6
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-02: Version 6.7.5
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-02: Version 6.7.4
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-02: Version 6.7.3
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-02: Version 6.7.2
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-02: Version 6.7.1
-
-        Performance and stability improvements on all platforms.
-
-
-2018-03-01: Version 6.6.356
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-28: Version 6.6.355
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-28: Version 6.6.354
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-28: Version 6.6.353
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-28: Version 6.6.352
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-28: Version 6.6.351
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-28: Version 6.6.350
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-28: Version 6.6.349
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-28: Version 6.6.348
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-28: Version 6.6.347
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-28: Version 6.6.346
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-28: Version 6.6.345
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-28: Version 6.6.344
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-28: Version 6.6.343
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-27: Version 6.6.342
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-27: Version 6.6.341
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-27: Version 6.6.340
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-27: Version 6.6.339
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-27: Version 6.6.338
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-27: Version 6.6.337
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-27: Version 6.6.336
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-26: Version 6.6.335
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-26: Version 6.6.334
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-26: Version 6.6.333
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-26: Version 6.6.332
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-26: Version 6.6.331
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-26: Version 6.6.330
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-26: Version 6.6.329
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-26: Version 6.6.328
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-26: Version 6.6.327
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-26: Version 6.6.326
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-26: Version 6.6.325
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-26: Version 6.6.324
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-26: Version 6.6.323
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-26: Version 6.6.322
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-26: Version 6.6.321
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-26: Version 6.6.320
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-26: Version 6.6.319
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-25: Version 6.6.318
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-25: Version 6.6.317
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-25: Version 6.6.316
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-25: Version 6.6.315
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-24: Version 6.6.314
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-24: Version 6.6.313
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-23: Version 6.6.312
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-23: Version 6.6.311
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-23: Version 6.6.310
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-23: Version 6.6.309
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-23: Version 6.6.308
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-23: Version 6.6.307
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-23: Version 6.6.306
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-23: Version 6.6.305
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-23: Version 6.6.304
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-23: Version 6.6.303
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-23: Version 6.6.302
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-23: Version 6.6.301
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-23: Version 6.6.300
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-23: Version 6.6.299
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-23: Version 6.6.298
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-22: Version 6.6.297
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-22: Version 6.6.296
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-22: Version 6.6.295
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-22: Version 6.6.294
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-22: Version 6.6.293
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-22: Version 6.6.292
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-22: Version 6.6.291
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-22: Version 6.6.290
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-22: Version 6.6.289
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-22: Version 6.6.288
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-22: Version 6.6.287
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-22: Version 6.6.286
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-22: Version 6.6.285
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-22: Version 6.6.284
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-22: Version 6.6.283
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-21: Version 6.6.282
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-21: Version 6.6.281
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-21: Version 6.6.280
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-20: Version 6.6.279
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-20: Version 6.6.278
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-20: Version 6.6.277
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-20: Version 6.6.276
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-20: Version 6.6.275
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-20: Version 6.6.274
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-20: Version 6.6.273
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-20: Version 6.6.272
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-20: Version 6.6.271
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-20: Version 6.6.270
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-20: Version 6.6.269
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-20: Version 6.6.268
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-20: Version 6.6.267
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-19: Version 6.6.266
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-19: Version 6.6.265
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-19: Version 6.6.264
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-19: Version 6.6.263
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-19: Version 6.6.262
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-19: Version 6.6.261
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-17: Version 6.6.260
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-17: Version 6.6.259
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-16: Version 6.6.258
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-16: Version 6.6.257
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-16: Version 6.6.256
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-16: Version 6.6.255
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-15: Version 6.6.254
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-15: Version 6.6.253
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-15: Version 6.6.252
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-14: Version 6.6.251
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-14: Version 6.6.250
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-14: Version 6.6.249
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-14: Version 6.6.248
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-14: Version 6.6.247
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-14: Version 6.6.246
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-14: Version 6.6.245
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-14: Version 6.6.244
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-14: Version 6.6.243
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-14: Version 6.6.242
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-14: Version 6.6.241
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-14: Version 6.6.240
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-13: Version 6.6.239
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-13: Version 6.6.238
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-13: Version 6.6.237
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-13: Version 6.6.236
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-13: Version 6.6.235
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-13: Version 6.6.234
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-12: Version 6.6.233
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-12: Version 6.6.232
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-12: Version 6.6.231
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-12: Version 6.6.230
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-12: Version 6.6.229
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-09: Version 6.6.228
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-09: Version 6.6.227
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-09: Version 6.6.226
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-09: Version 6.6.225
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-09: Version 6.6.224
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-09: Version 6.6.223
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-09: Version 6.6.222
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-09: Version 6.6.221
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-09: Version 6.6.220
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-09: Version 6.6.219
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-09: Version 6.6.218
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-09: Version 6.6.217
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-09: Version 6.6.216
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-09: Version 6.6.215
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-09: Version 6.6.214
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-09: Version 6.6.213
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-09: Version 6.6.212
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-08: Version 6.6.211
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-08: Version 6.6.210
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-08: Version 6.6.209
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-08: Version 6.6.208
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-08: Version 6.6.207
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-08: Version 6.6.206
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-08: Version 6.6.205
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-08: Version 6.6.204
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-08: Version 6.6.203
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-08: Version 6.6.202
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-08: Version 6.6.201
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-08: Version 6.6.200
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-08: Version 6.6.199
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-08: Version 6.6.198
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-08: Version 6.6.197
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-08: Version 6.6.196
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-07: Version 6.6.195
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-07: Version 6.6.194
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-07: Version 6.6.193
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-07: Version 6.6.192
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-07: Version 6.6.191
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-07: Version 6.6.190
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-07: Version 6.6.189
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-07: Version 6.6.188
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-07: Version 6.6.187
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-07: Version 6.6.186
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-07: Version 6.6.185
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-07: Version 6.6.184
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-07: Version 6.6.183
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-07: Version 6.6.182
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-07: Version 6.6.181
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-07: Version 6.6.180
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-06: Version 6.6.179
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-06: Version 6.6.178
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-06: Version 6.6.177
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-06: Version 6.6.176
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-06: Version 6.6.175
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-06: Version 6.6.174
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-06: Version 6.6.173
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-06: Version 6.6.172
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-06: Version 6.6.171
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-06: Version 6.6.170
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-06: Version 6.6.169
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-06: Version 6.6.168
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-06: Version 6.6.167
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-06: Version 6.6.166
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-05: Version 6.6.165
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-05: Version 6.6.164
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-05: Version 6.6.163
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-05: Version 6.6.162
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-05: Version 6.6.161
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-05: Version 6.6.160
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-05: Version 6.6.159
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-05: Version 6.6.158
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-05: Version 6.6.157
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-05: Version 6.6.156
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-02: Version 6.6.155
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-02: Version 6.6.154
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-02: Version 6.6.153
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-02: Version 6.6.152
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-02: Version 6.6.151
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-02: Version 6.6.150
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-02: Version 6.6.149
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-02: Version 6.6.148
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-02: Version 6.6.147
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-02: Version 6.6.146
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-02: Version 6.6.145
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-02: Version 6.6.144
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-02: Version 6.6.143
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-02: Version 6.6.142
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-02: Version 6.6.141
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-01: Version 6.6.140
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-01: Version 6.6.139
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-01: Version 6.6.138
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-01: Version 6.6.137
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-01: Version 6.6.136
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-01: Version 6.6.135
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-01: Version 6.6.134
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-01: Version 6.6.133
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-01: Version 6.6.132
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-01: Version 6.6.131
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-01: Version 6.6.130
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-01: Version 6.6.129
-
-        Performance and stability improvements on all platforms.
-
-
-2018-02-01: Version 6.6.128
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-31: Version 6.6.127
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-31: Version 6.6.126
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-31: Version 6.6.125
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-31: Version 6.6.124
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-31: Version 6.6.123
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-31: Version 6.6.122
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-31: Version 6.6.121
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-31: Version 6.6.120
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-31: Version 6.6.119
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-31: Version 6.6.118
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-31: Version 6.6.117
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-31: Version 6.6.116
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-30: Version 6.6.115
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-30: Version 6.6.114
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-30: Version 6.6.113
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-30: Version 6.6.112
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-30: Version 6.6.111
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-30: Version 6.6.110
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-30: Version 6.6.109
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-30: Version 6.6.108
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-30: Version 6.6.107
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-30: Version 6.6.106
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-29: Version 6.6.105
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-29: Version 6.6.104
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-29: Version 6.6.103
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-29: Version 6.6.102
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-29: Version 6.6.101
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-29: Version 6.6.100
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-29: Version 6.6.99
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-29: Version 6.6.98
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-29: Version 6.6.97
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-29: Version 6.6.96
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-29: Version 6.6.95
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-29: Version 6.6.94
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-29: Version 6.6.93
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-29: Version 6.6.92
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-29: Version 6.6.91
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-27: Version 6.6.90
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-27: Version 6.6.89
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-26: Version 6.6.88
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-26: Version 6.6.87
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-26: Version 6.6.86
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-26: Version 6.6.85
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-26: Version 6.6.84
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-26: Version 6.6.83
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-25: Version 6.6.82
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-25: Version 6.6.81
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-25: Version 6.6.80
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-25: Version 6.6.79
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-25: Version 6.6.78
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-25: Version 6.6.77
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-25: Version 6.6.76
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-25: Version 6.6.75
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-25: Version 6.6.74
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-25: Version 6.6.73
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-25: Version 6.6.72
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-25: Version 6.6.71
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-25: Version 6.6.70
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-25: Version 6.6.69
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-25: Version 6.6.68
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-25: Version 6.6.67
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-24: Version 6.6.66
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-24: Version 6.6.65
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-24: Version 6.6.64
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-24: Version 6.6.63
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-24: Version 6.6.62
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-24: Version 6.6.61
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-24: Version 6.6.60
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-24: Version 6.6.59
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-24: Version 6.6.58
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-24: Version 6.6.57
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-24: Version 6.6.56
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-24: Version 6.6.55
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-24: Version 6.6.54
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-24: Version 6.6.53
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-24: Version 6.6.52
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-23: Version 6.6.51
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-23: Version 6.6.50
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-23: Version 6.6.49
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-23: Version 6.6.48
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-23: Version 6.6.47
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-23: Version 6.6.46
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-23: Version 6.6.45
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-23: Version 6.6.44
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-23: Version 6.6.43
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-23: Version 6.6.42
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-23: Version 6.6.41
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-23: Version 6.6.40
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-23: Version 6.6.39
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-23: Version 6.6.38
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-23: Version 6.6.37
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-23: Version 6.6.36
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-23: Version 6.6.35
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-23: Version 6.6.34
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-23: Version 6.6.33
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-22: Version 6.6.32
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-22: Version 6.6.31
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-22: Version 6.6.30
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-22: Version 6.6.29
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-22: Version 6.6.28
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-22: Version 6.6.27
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-22: Version 6.6.26
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-22: Version 6.6.25
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-22: Version 6.6.24
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-22: Version 6.6.23
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-22: Version 6.6.22
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-22: Version 6.6.21
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-22: Version 6.6.20
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-22: Version 6.6.19
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-22: Version 6.6.18
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-22: Version 6.6.17
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-22: Version 6.6.16
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-22: Version 6.6.15
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-22: Version 6.6.14
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-22: Version 6.6.13
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-22: Version 6.6.12
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-21: Version 6.6.11
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-20: Version 6.6.10
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-20: Version 6.6.9
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-19: Version 6.6.8
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-19: Version 6.6.7
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-19: Version 6.6.6
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-19: Version 6.6.5
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-19: Version 6.6.4
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-19: Version 6.6.3
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-19: Version 6.6.2
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-19: Version 6.6.1
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-18: Version 6.5.257
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-18: Version 6.5.256
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-18: Version 6.5.255
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-17: Version 6.5.254
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-17: Version 6.5.253
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-17: Version 6.5.252
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-17: Version 6.5.251
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-17: Version 6.5.250
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-17: Version 6.5.249
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-17: Version 6.5.248
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-17: Version 6.5.247
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-17: Version 6.5.246
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-16: Version 6.5.245
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-16: Version 6.5.244
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-16: Version 6.5.243
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-16: Version 6.5.242
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-16: Version 6.5.241
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-16: Version 6.5.240
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-16: Version 6.5.239
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-16: Version 6.5.238
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-16: Version 6.5.237
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-16: Version 6.5.236
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-16: Version 6.5.235
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-16: Version 6.5.234
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-16: Version 6.5.233
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-16: Version 6.5.232
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-16: Version 6.5.231
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-16: Version 6.5.230
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-16: Version 6.5.229
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-16: Version 6.5.228
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-16: Version 6.5.227
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-16: Version 6.5.226
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-16: Version 6.5.225
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-16: Version 6.5.224
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-16: Version 6.5.223
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-16: Version 6.5.222
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-16: Version 6.5.221
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-16: Version 6.5.220
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-15: Version 6.5.219
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-15: Version 6.5.218
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-15: Version 6.5.217
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-15: Version 6.5.216
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-15: Version 6.5.215
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-15: Version 6.5.214
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-15: Version 6.5.213
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-15: Version 6.5.212
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-15: Version 6.5.211
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-15: Version 6.5.210
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-15: Version 6.5.209
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-15: Version 6.5.208
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-15: Version 6.5.207
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-15: Version 6.5.206
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-15: Version 6.5.205
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-15: Version 6.5.204
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-15: Version 6.5.203
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-15: Version 6.5.202
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-15: Version 6.5.201
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-15: Version 6.5.200
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-15: Version 6.5.199
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-14: Version 6.5.198
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-13: Version 6.5.197
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-12: Version 6.5.196
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-12: Version 6.5.195
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-12: Version 6.5.194
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-12: Version 6.5.193
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-12: Version 6.5.192
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-12: Version 6.5.191
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-12: Version 6.5.190
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-12: Version 6.5.189
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-11: Version 6.5.188
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-11: Version 6.5.187
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-11: Version 6.5.186
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-11: Version 6.5.185
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-11: Version 6.5.184
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-11: Version 6.5.183
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-11: Version 6.5.182
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-11: Version 6.5.181
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-11: Version 6.5.180
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-11: Version 6.5.179
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-11: Version 6.5.178
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-11: Version 6.5.177
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-11: Version 6.5.176
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-11: Version 6.5.175
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-11: Version 6.5.174
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-11: Version 6.5.173
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-10: Version 6.5.172
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-10: Version 6.5.171
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-10: Version 6.5.170
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-10: Version 6.5.169
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-10: Version 6.5.168
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-10: Version 6.5.167
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-10: Version 6.5.166
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-10: Version 6.5.165
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-10: Version 6.5.164
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-10: Version 6.5.163
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-09: Version 6.5.162
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-09: Version 6.5.161
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-09: Version 6.5.160
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-09: Version 6.5.159
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-09: Version 6.5.158
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-09: Version 6.5.157
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-09: Version 6.5.156
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-09: Version 6.5.155
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-09: Version 6.5.154
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-09: Version 6.5.153
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-09: Version 6.5.152
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-09: Version 6.5.151
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-08: Version 6.5.150
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-08: Version 6.5.149
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-08: Version 6.5.148
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-08: Version 6.5.147
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-05: Version 6.5.146
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-05: Version 6.5.145
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-05: Version 6.5.144
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-05: Version 6.5.143
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-05: Version 6.5.142
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-05: Version 6.5.141
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-05: Version 6.5.140
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-04: Version 6.5.139
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-04: Version 6.5.138
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-04: Version 6.5.137
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-04: Version 6.5.136
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-04: Version 6.5.135
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-04: Version 6.5.134
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-04: Version 6.5.133
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-04: Version 6.5.132
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-04: Version 6.5.131
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-04: Version 6.5.130
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-04: Version 6.5.129
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-04: Version 6.5.128
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-04: Version 6.5.127
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-04: Version 6.5.126
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-03: Version 6.5.125
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-03: Version 6.5.124
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-02: Version 6.5.123
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-02: Version 6.5.122
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-02: Version 6.5.121
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-02: Version 6.5.120
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-02: Version 6.5.119
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-02: Version 6.5.118
-
-        Performance and stability improvements on all platforms.
-
-
-2018-01-02: Version 6.5.117
-
-        Performance and stability improvements on all platforms.
-
-
-2017-12-29: Version 6.5.116
-
-        Performance and stability improvements on all platforms.
-
-
-2017-12-29: Version 6.5.115
-
-        Performance and stability improvements on all platforms.
-
-
-2017-12-29: Version 6.5.114
-
-        Performance and stability improvements on all platforms.
-
-
-2017-12-29: Version 6.5.113
-
-        Performance and stability improvements on all platforms.
-
-
-2017-12-29: Version 6.5.112
-
-        Performance and stability improvements on all platforms.
-
-
-2017-12-29: Version 6.5.111
-
-        Performance and stability improvements on all platforms.
-
-
-2017-12-28: Version 6.5.110
-
-        Performance and stability improvements on all platforms.
-
-
-2017-12-28: Version 6.5.109
-
-        Performance and stability improvements on all platforms.
-
-
-2017-12-27: Version 6.5.108
-
-        Performance and stability improvements on all platforms.
-
-
-2017-12-22: Version 6.5.107
-
-        Performance and stability improvements on all platforms.
-
-
-2017-12-22: Version 6.5.106
-
-        Performance and stability improvements on all platforms.
-
-
-2017-12-22: Version 6.5.105
-
-        Performance and stability improvements on all platforms.
-
-
-2017-12-22: Version 6.5.104
-
-        Performance and stability improvements on all platforms.
-
-
-2017-12-21: Version 6.5.103
-
-        Performance and stability improvements on all platforms.
-
-
-2017-12-21: Version 6.5.102
-
-        Performance and stability improvements on all platforms.
-
-
-2017-12-20: Version 6.5.101
-
-        Performance and stability improvements on all platforms.
-
-
-2017-12-20: Version 6.5.100
-
-        Performance and stability improvements on all platforms.
-
-
-2017-12-20: Version 6.5.99
-
-        Performance and stability improvements on all platforms.
-
-
-2017-12-20: Version 6.5.98
-
-        Performance and stability improvements on all platforms.
-
-
-2017-12-20: Version 6.5.97
-
-        Performance and stability improvements on all platforms.
-
-
-2017-12-20: Version 6.5.96
-
-        Performance and stability improvements on all platforms.
-
-
-2017-12-20: Version 6.5.95
-
-        Performance and stability improvements on all platforms.
-
-
-2017-12-20: Version 6.5.94
-
-        Performance and stability improvements on all platforms.
-
-
-2017-12-20: Version 6.5.93
-
-        Performance and stability improvements on all platforms.
-
-
-2017-12-20: Version 6.5.92
-
-        Performance and stability improvements on all platforms.
-
-
-2017-12-20: Version 6.5.91
-
-        Performance and stability improvements on all platforms.
-
-
-2017-12-20: Version 6.5.90
-
-        Performance and stability improvements on all platforms.
-
-
-2017-12-19: Version 6.5.89
-
-        Performance and stability improvements on all platforms.
-
-
-2017-12-19: Version 6.5.88
-
-        Performance and stability improvements on all platforms.
-
-
-2017-12-19: Version 6.5.87
-
-        Performance and stability improvements on all platforms.
-
-
-2017-12-19: Version 6.5.86
-
-        Performance and stability improvements on all platforms.
-
-
-2017-12-19: Version 6.5.85
-
-        Performance and stability improvements on all platforms.
-
-
-2017-12-19: Version 6.5.84
-
-        Performance and stability improvements on all platforms.
-
-
-2017-12-19: Version 6.5.83
-
-        Performance and stability improvements on all platforms.
-
-
-2017-12-19: Version 6.5.82
-
-        Performance and stability improvements on all platforms.
-
-
-2017-12-19: Version 6.5.81
-
-        Performance and stability improvements on all platforms.
-
-
-2017-12-19: Version 6.5.80
-
-        Performance and stability improvements on all platforms.
-
-
-2017-12-19: Version 6.5.79
-
-        Performance and stability improvements on all platforms.
-
-
-2017-12-19: Version 6.5.78
-
-        Performance and stability improvements on all platforms.
+        The ChangeLog file is no longer maintained on master. This
+        sentinel should stay on top of this list.
 
 
 2017-12-19: Version 6.5.77
diff --git a/deps/v8/DEPS b/deps/v8/DEPS
index 4a00478633793d..3054e957c96bdc 100644
--- a/deps/v8/DEPS
+++ b/deps/v8/DEPS
@@ -12,55 +12,61 @@ vars = {
 
 deps = {
   'v8/build':
-    Var('chromium_url') + '/chromium/src/build.git' + '@' + '73e352e758d90603e23bdc84734c12aa5817ab5f',
+    Var('chromium_url') + '/chromium/src/build.git' + '@' + '9b4b41368c26e443873813b0922d9e2fb02a9dd8',
   'v8/tools/gyp':
     Var('chromium_url') + '/external/gyp.git' + '@' + 'd61a9397e668fa9843c4aa7da9e79460fe590bfb',
+  'v8/third_party/depot_tools':
+    Var('chromium_url') + '/chromium/tools/depot_tools.git' + '@' + 'c3975e55e1465d9d9320ae67889f0b057c7d7ec3',
   'v8/third_party/icu':
-    Var('chromium_url') + '/chromium/deps/icu.git' + '@' + 'd888fd2a1be890f4d35e43f68d6d79f42519a357',
+    Var('chromium_url') + '/chromium/deps/icu.git' + '@' + '172d33141cd16df9d027cfd49bfe940b1dc66f1a',
   'v8/third_party/instrumented_libraries':
     Var('chromium_url') + '/chromium/src/third_party/instrumented_libraries.git' + '@' + '323cf32193caecbf074d1a0cb5b02b905f163e0f',
   'v8/buildtools':
-    Var('chromium_url') + '/chromium/buildtools.git' + '@' + 'e8aa02ea839e087f2db66100d02c3b5d47993852',
+    Var('chromium_url') + '/chromium/buildtools.git' + '@' + '0dd5c6f980d22be96b728155249df2da355989d9',
   'v8/base/trace_event/common':
     Var('chromium_url') + '/chromium/src/base/trace_event/common.git' + '@' + '211b3ed9d0481b4caddbee1322321b86a483ca1f',
   'v8/third_party/android_ndk': {
-    'url': Var('chromium_url') + '/android_ndk.git' + '@' + '635bc380968a76f6948fee65f80a0b28db53ae81',
+    'url': Var('chromium_url') + '/android_ndk.git' + '@' + '5cd86312e794bdf542a3685c6f10cbb96072990b',
     'condition': 'checkout_android',
   },
   'v8/third_party/android_tools': {
-    'url': Var('chromium_url') + '/android_tools.git' + '@' + 'c22a664c39af72dd8f89200220713dcad811300a',
+    'url': Var('chromium_url') + '/android_tools.git' + '@' + '130499e25286f4d56acafa252fee09f3cc595c49',
     'condition': 'checkout_android',
   },
   'v8/third_party/catapult': {
-    'url': Var('chromium_url') + '/catapult.git' + '@' + '2c59f678c7ede8a844fb687525d594b71aabe3dd',
+    'url': Var('chromium_url') + '/catapult.git' + '@' + '0c92958e3ed066e66cb0fc3882d023f15193e802',
     'condition': 'checkout_android',
   },
   'v8/third_party/colorama/src': {
     'url': Var('chromium_url') + '/external/colorama.git' + '@' + '799604a1041e9b3bc5d2789ecbd7e8db2e18e6b8',
     'condition': 'checkout_android',
   },
+  'v8/third_party/fuchsia-sdk': {
+    'url': Var('chromium_url') + '/chromium/src/third_party/fuchsia-sdk.git' + '@' + '272de12d87a80905fd2df2339644a8561e3c2c30',
+    'condition': 'checkout_fuchsia',
+  },
   'v8/third_party/googletest/src':
-    Var('chromium_url') + '/external/github.com/google/googletest.git' + '@' + '7e5f90d3780d553cb86771141fb81349f3a63508',
+    Var('chromium_url') + '/external/github.com/google/googletest.git' + '@' + 'ce468a17c434e4e79724396ee1b51d86bfc8a88b',
   'v8/third_party/jinja2':
-    Var('chromium_url') + '/chromium/src/third_party/jinja2.git' + '@' + '45571de473282bd1d8b63a8dfcb1fd268d0635d2',
+    Var('chromium_url') + '/chromium/src/third_party/jinja2.git' + '@' + 'b41863e42637544c2941b574c7877d3e1f663e25',
   'v8/third_party/markupsafe':
     Var('chromium_url') + '/chromium/src/third_party/markupsafe.git' + '@' + '8f45f5cfa0009d2a70589bcda0349b8cb2b72783',
   'v8/tools/swarming_client':
-    Var('chromium_url') + '/infra/luci/client-py.git' + '@' + '88229872dd17e71658fe96763feaa77915d8cbd6',
+    Var('chromium_url') + '/infra/luci/client-py.git' + '@' + '9a518d097dca20b7b00ce3bdfc5d418ccc79893a',
   'v8/test/benchmarks/data':
     Var('chromium_url') + '/v8/deps/third_party/benchmarks.git' + '@' + '05d7188267b4560491ff9155c5ee13e207ecd65f',
   'v8/test/mozilla/data':
     Var('chromium_url') + '/v8/deps/third_party/mozilla-tests.git' + '@' + 'f6c578a10ea707b1a8ab0b88943fe5115ce2b9be',
   'v8/test/test262/data':
-    Var('chromium_url') + '/external/github.com/tc39/test262.git' + '@' + '0192e0d70e2295fb590f14865da42f0f9dfa64bd',
+    Var('chromium_url') + '/external/github.com/tc39/test262.git' + '@' + 'a6c1d05ac4fed084fa047e4c52ab2a8c9c2a8aef',
   'v8/test/test262/harness':
     Var('chromium_url') + '/external/github.com/test262-utils/test262-harness-py.git' + '@' + '0f2acdd882c84cff43b9d60df7574a1901e2cdcd',
   'v8/tools/clang':
-    Var('chromium_url') + '/chromium/src/tools/clang.git' + '@' + 'd7c36b0ae001a5cc31f2da79a430154916a3def2',
+    Var('chromium_url') + '/chromium/src/tools/clang.git' + '@' + '2024df99f9388a126b750a14bd827bb2e946f5d3',
   'v8/tools/luci-go':
-    Var('chromium_url') + '/chromium/src/tools/luci-go.git' + '@' + 'ff0709d4283b1f233dcf0c9fec1672c6ecaed2f1',
+    Var('chromium_url') + '/chromium/src/tools/luci-go.git' + '@' + 'e3d4003364ba53f0db6e235609d8e7f5b7d7ab9d',
   'v8/test/wasm-js':
-    Var('chromium_url') + '/external/github.com/WebAssembly/spec.git' + '@' + '586d34770c6445bfb93c9bae8ac50baade7ee168',
+    Var('chromium_url') + '/external/github.com/WebAssembly/spec.git' + '@' + '2113ea7e106f8a964e0445ba38f289d2aa845edd',
 }
 
 recursedeps = [
@@ -82,6 +88,17 @@ skip_child_includes = [
 ]
 
 hooks = [
+  {
+    # Ensure that the DEPS'd "depot_tools" has its self-update capability
+    # disabled.
+    'name': 'disable_depot_tools_selfupdate',
+    'pattern': '.',
+    'action': [
+        'python',
+        'v8/third_party/depot_tools/update_depot_tools_toggle.py',
+        '--disable',
+    ],
+  },
   {
     # This clobbers when necessary (based on get_landmines.py). It must be the
     # first hook so that other things that get/generate into the output
diff --git a/deps/v8/OWNERS b/deps/v8/OWNERS
index f6726316f2af95..3e3eef5ff2bebf 100644
--- a/deps/v8/OWNERS
+++ b/deps/v8/OWNERS
@@ -24,6 +24,7 @@ leszeks@chromium.org
 machenbach@chromium.org
 marja@chromium.org
 mlippautz@chromium.org
+mslekova@chromium.org
 mstarzinger@chromium.org
 mvstanton@chromium.org
 mythria@chromium.org
diff --git a/deps/v8/PRESUBMIT.py b/deps/v8/PRESUBMIT.py
index e6dbb7939568fd..bd780ce62f7a78 100644
--- a/deps/v8/PRESUBMIT.py
+++ b/deps/v8/PRESUBMIT.py
@@ -96,7 +96,9 @@ def FilterFile(affected_file):
       input_api.AffectedFiles(include_deletes=True)):
     results.append(output_api.PresubmitError("Status file check failed"))
   results.extend(input_api.canned_checks.CheckAuthorizedAuthor(
-      input_api, output_api))
+      input_api, output_api, bot_whitelist=[
+        'v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com'
+      ]))
   return results
 
 
@@ -289,6 +291,13 @@ def FilterFile(affected_file):
 def _CommonChecks(input_api, output_api):
   """Checks common to both upload and commit."""
   results = []
+  # TODO(machenbach): Replace some of those checks, e.g. owners and copyright,
+  # with the canned PanProjectChecks. Need to make sure that the checks all
+  # pass on all existing files.
+  results.extend(input_api.canned_checks.CheckOwnersFormat(
+      input_api, output_api))
+  results.extend(input_api.canned_checks.CheckOwners(
+      input_api, output_api))
   results.extend(_CheckCommitMessageBugEntry(input_api, output_api))
   results.extend(input_api.canned_checks.CheckPatchFormatted(
       input_api, output_api))
diff --git a/deps/v8/WATCHLISTS b/deps/v8/WATCHLISTS
index bd07d318dadd55..d54695cca3b5d2 100644
--- a/deps/v8/WATCHLISTS
+++ b/deps/v8/WATCHLISTS
@@ -33,8 +33,9 @@
 
 {
   'WATCHLIST_DEFINITIONS': {
-    'public_api': {
-      'filepath': 'include/',
+    'api': {
+      'filepath': 'include/' \
+                  '|src/api\.(cc|h)$',
     },
     'snapshot': {
       'filepath': 'src/snapshot/',
@@ -62,12 +63,29 @@
     },
     'merges': {
       'filepath': '.',
-    }
+    },
+    'inspector': {
+      'filepath': 'inspector',
+    },
+    'wasm': {
+      'filepath': 'src/wasm/' \
+                  '|src/compiler/wasm',
+    },
+    'value_serializer': {
+      'filepath': 'src/value-serializer',
+    },
+    'parser': {
+      'filepath': 'src/ast/' \
+                  '|src/parsing/',
+    },
+    'tracing': {
+      'filepath': 'src/tracing/',
+    },
   },
 
   'WATCHLISTS': {
-    'public_api': [
-      'phajdan.jr@chromium.org',
+    'api': [
+      'adamk@chromium.org',
     ],
     'snapshot': [
       'yangguo@chromium.org',
@@ -77,25 +95,37 @@
     ],
     'interpreter': [
       'rmcilroy@chromium.org',
-      'oth@chromium.org',
     ],
     'feature_shipping_status': [
       'hablich@chromium.org',
     ],
     'gc_changes': [
       'hpayer@chromium.org',
-      'ulan@chromium.org',
     ],
     'arm': [
       'v8-mips-ports@googlegroups.com',
       'v8-ppc-ports@googlegroups.com',
     ],
-    'ia32': [
-      'v8-x87-ports@googlegroups.com',
-    ],
     'merges': [
       # Only enabled on branches created with tools/release/create_release.py
-      'v8-merges@googlegroups.com',
+      # 'v8-merges@googlegroups.com',
+    ],
+    'inspector': [
+      'devtools-reviews@chromium.org',
+    ],
+    'wasm': [
+      'wasm-v8@google.com',
+    ],
+    'value_serializer': [
+      'jbroman+watch@chromium.org',
+    ],
+    'parser': [
+      'adamk@chromium.org',
+      'marja+watch@chromium.org',
+    ],
+    'tracing': [
+      'lpy+v8tracing@chromium.org',
+      'fmeawad@chromium.org',
     ],
   },
 }
diff --git a/deps/v8/custom_deps/.gitignore b/deps/v8/custom_deps/.gitignore
new file mode 100644
index 00000000000000..83866b6690a22f
--- /dev/null
+++ b/deps/v8/custom_deps/.gitignore
@@ -0,0 +1,4 @@
+*
+!.gitignore
+!OWNERS
+!README.md
\ No newline at end of file
diff --git a/deps/v8/custom_deps/OWNERS b/deps/v8/custom_deps/OWNERS
new file mode 100644
index 00000000000000..76719caca0eccc
--- /dev/null
+++ b/deps/v8/custom_deps/OWNERS
@@ -0,0 +1,2 @@
+machenbach@chromium.org
+sergiyb@chromium.org
\ No newline at end of file
diff --git a/deps/v8/custom_deps/README.md b/deps/v8/custom_deps/README.md
new file mode 100644
index 00000000000000..f49930fb939d96
--- /dev/null
+++ b/deps/v8/custom_deps/README.md
@@ -0,0 +1,2 @@
+Common directory for custom dependencies pulled in via .gclient custom_deps.
+All subdirectories are ignored by git by default.
\ No newline at end of file
diff --git a/deps/v8/gni/v8.gni b/deps/v8/gni/v8.gni
index 211f15aab944d4..a5312f76acd9dd 100644
--- a/deps/v8/gni/v8.gni
+++ b/deps/v8/gni/v8.gni
@@ -38,7 +38,7 @@ declare_args() {
   v8_use_snapshot = !(is_win && host_os != "win" && target_cpu == "x64")
 
   # Enable several snapshots side-by-side (e.g. default and for trusted code).
-  v8_use_multi_snapshots = ""
+  v8_use_multi_snapshots = false
 
   # Use external files for startup data blobs:
   # the JS builtins sources and the start snapshot.
@@ -61,7 +61,10 @@ if (v8_use_external_startup_data == "") {
   v8_use_external_startup_data = v8_use_snapshot && !is_ios
 }
 
-if (v8_use_multi_snapshots == "") {
+if (v8_use_multi_snapshots) {
+  # Silently disable multi snapshots if they're incompatible with the current
+  # build configuration. This allows us to set v8_use_multi_snapshots=true on
+  # all bots, and e.g. no-snapshot bots will automatically do the right thing.
   v8_use_multi_snapshots =
       v8_use_external_startup_data && !build_with_chromium && !use_jumbo_build
 }
@@ -96,7 +99,7 @@ if (is_debug && !v8_optimized_debug) {
 
   # TODO(crbug.com/621335) Rework this so that we don't have the confusion
   # between "optimize_speed" and "optimize_max".
-  if (is_posix && !is_android && !using_sanitizer) {
+  if (((is_posix && !is_android) || is_fuchsia) && !using_sanitizer) {
     v8_add_configs += [ "//build/config/compiler:optimize_speed" ]
   } else {
     v8_add_configs += [ "//build/config/compiler:optimize_max" ]
@@ -110,7 +113,7 @@ if (v8_code_coverage && !is_clang) {
   ]
 }
 
-if (is_posix && (v8_enable_backtrace || v8_monolithic)) {
+if ((is_posix || is_fuchsia) && (v8_enable_backtrace || v8_monolithic)) {
   v8_remove_configs += [ "//build/config/gcc:symbol_visibility_hidden" ]
   v8_add_configs += [ "//build/config/gcc:symbol_visibility_default" ]
 }
diff --git a/deps/v8/include/libplatform/libplatform.h b/deps/v8/include/libplatform/libplatform.h
index 2c830bf834b786..a381b97f889749 100644
--- a/deps/v8/include/libplatform/libplatform.h
+++ b/deps/v8/include/libplatform/libplatform.h
@@ -62,7 +62,7 @@ V8_PLATFORM_EXPORT bool PumpMessageLoop(
     v8::Platform* platform, v8::Isolate* isolate,
     MessageLoopBehavior behavior = MessageLoopBehavior::kDoNotWait);
 
-V8_PLATFORM_EXPORT V8_DEPRECATE_SOON(
+V8_PLATFORM_EXPORT V8_DEPRECATED(
     "This function has become obsolete and is essentially a nop",
     void EnsureEventLoopInitialized(v8::Platform* platform,
                                     v8::Isolate* isolate));
diff --git a/deps/v8/include/v8-inspector.h b/deps/v8/include/v8-inspector.h
index 6de8234fb83bcf..d879a94373e427 100644
--- a/deps/v8/include/v8-inspector.h
+++ b/deps/v8/include/v8-inspector.h
@@ -99,6 +99,7 @@ class V8_EXPORT V8ContextInfo {
 
 class V8_EXPORT V8StackTrace {
  public:
+  virtual StringView firstNonEmptySourceURL() const = 0;
   virtual bool isEmpty() const = 0;
   virtual StringView topSourceURL() const = 0;
   virtual int topLineNumber() const = 0;
diff --git a/deps/v8/include/v8-platform.h b/deps/v8/include/v8-platform.h
index ddc200abab0dd9..cfeb13b65829f9 100644
--- a/deps/v8/include/v8-platform.h
+++ b/deps/v8/include/v8-platform.h
@@ -207,6 +207,7 @@ class PageAllocator {
    */
   enum Permission {
     kNoAccess,
+    kRead,
     kReadWrite,
     // TODO(hpayer): Remove this flag. Memory should never be rwx.
     kReadWriteExecute,
@@ -245,16 +246,6 @@ class PageAllocator {
  */
 class Platform {
  public:
-  /**
-   * This enum is used to indicate whether a task is potentially long running,
-   * or causes a long wait. The embedder might want to use this hint to decide
-   * whether to execute the task on a dedicated thread.
-   */
-  enum ExpectedRuntime {
-    kShortRunningTask,
-    kLongRunningTask
-  };
-
   virtual ~Platform() = default;
 
   /**
@@ -289,101 +280,25 @@ class Platform {
   virtual bool OnCriticalMemoryPressure(size_t length) { return false; }
 
   /**
-   * Gets the number of worker threads used by GetWorkerThreadsTaskRunner() and
-   * CallOnWorkerThread(). This can be used to estimate the number of tasks a
-   * work package should be split into. A return value of 0 means that there are
-   * no worker threads available. Note that a value of 0 won't prohibit V8 from
-   * posting tasks using |CallOnWorkerThread|.
-   */
-  virtual int NumberOfWorkerThreads() {
-    return static_cast<int>(NumberOfAvailableBackgroundThreads());
-  }
-
-  /**
-   * Deprecated. Use NumberOfWorkerThreads() instead.
-   * TODO(gab): Remove this when all embedders override
-   * NumberOfWorkerThreads() instead.
+   * Gets the number of worker threads used by
+   * Call(BlockingTask)OnWorkerThread(). This can be used to estimate the number
+   * of tasks a work package should be split into. A return value of 0 means
+   * that there are no worker threads available. Note that a value of 0 won't
+   * prohibit V8 from posting tasks using |CallOnWorkerThread|.
    */
-  V8_DEPRECATE_SOON(
-      "NumberOfAvailableBackgroundThreads() is deprecated, use "
-      "NumberOfAvailableBackgroundThreads() instead.",
-      virtual size_t NumberOfAvailableBackgroundThreads()) {
-    return 0;
-  }
+  virtual int NumberOfWorkerThreads() = 0;
 
   /**
    * Returns a TaskRunner which can be used to post a task on the foreground.
    * This function should only be called from a foreground thread.
    */
   virtual std::shared_ptr<v8::TaskRunner> GetForegroundTaskRunner(
-      Isolate* isolate) {
-    // TODO(ahaas): Make this function abstract after it got implemented on all
-    // platforms.
-    return {};
-  }
-
-  /**
-   * Returns a TaskRunner which can be used to post a task on a background.
-   * This function should only be called from a foreground thread.
-   */
-  V8_DEPRECATE_SOON(
-      "GetBackgroundTaskRunner() is deprecated, use "
-      "GetWorkerThreadsTaskRunner() "
-      "instead.",
-      virtual std::shared_ptr<v8::TaskRunner> GetBackgroundTaskRunner(
-          Isolate* isolate)) {
-    // TODO(gab): Remove this method when all embedders have moved to
-    // GetWorkerThreadsTaskRunner().
-
-    // An implementation needs to be provided here because this is called by the
-    // default GetWorkerThreadsTaskRunner() implementation below. In practice
-    // however, all code either:
-    //  - Overrides GetWorkerThreadsTaskRunner() (thus not making this call) --
-    //    i.e. all v8 code.
-    //  - Overrides this method (thus not making this call) -- i.e. all
-    //    unadapted embedders.
-    abort();
-  }
-
-  /**
-   * Returns a TaskRunner which can be used to post async tasks on a worker.
-   * This function should only be called from a foreground thread.
-   */
-  virtual std::shared_ptr<v8::TaskRunner> GetWorkerThreadsTaskRunner(
-      Isolate* isolate) {
-    // TODO(gab): Make this function abstract after it got implemented on all
-    // platforms.
-    return GetBackgroundTaskRunner(isolate);
-  }
-
-  /**
-   * Schedules a task to be invoked on a background thread. |expected_runtime|
-   * indicates that the task will run a long time. The Platform implementation
-   * takes ownership of |task|. There is no guarantee about order of execution
-   * of tasks wrt order of scheduling, nor is there a guarantee about the
-   * thread the task will be run on.
-   */
-  V8_DEPRECATE_SOON(
-      "ExpectedRuntime is deprecated, use CallOnWorkerThread() instead.",
-      virtual void CallOnBackgroundThread(Task* task,
-                                          ExpectedRuntime expected_runtime)) {
-    // An implementation needs to be provided here because this is called by the
-    // default implementation below. In practice however, all code either:
-    //  - Overrides the new method (thus not making this call) -- i.e. all v8
-    //    code.
-    //  - Overrides this method (thus not making this call) -- i.e. all
-    //    unadapted embedders.
-    abort();
-  }
+      Isolate* isolate) = 0;
 
   /**
    * Schedules a task to be invoked on a worker thread.
-   * TODO(gab): Make pure virtual when all embedders override this instead of
-   * CallOnBackgroundThread().
    */
-  virtual void CallOnWorkerThread(std::unique_ptr<Task> task) {
-    CallOnBackgroundThread(task.release(), kShortRunningTask);
-  }
+  virtual void CallOnWorkerThread(std::unique_ptr<Task> task) = 0;
 
   /**
    * Schedules a task that blocks the main thread to be invoked with
@@ -395,6 +310,13 @@ class Platform {
     CallOnWorkerThread(std::move(task));
   }
 
+  /**
+   * Schedules a task to be invoked on a worker thread after |delay_in_seconds|
+   * expires.
+   */
+  virtual void CallDelayedOnWorkerThread(std::unique_ptr<Task> task,
+                                         double delay_in_seconds) = 0;
+
   /**
    * Schedules a task to be invoked on a foreground thread wrt a specific
    * |isolate|. Tasks posted for the same isolate should be execute in order of
@@ -420,14 +342,14 @@ class Platform {
    * The definition of "foreground" is opaque to V8.
    */
   virtual void CallIdleOnForegroundThread(Isolate* isolate, IdleTask* task) {
-    // TODO(ulan): Make this function abstract after V8 roll in Chromium.
+    // This must be overriden if |IdleTasksEnabled()|.
+    abort();
   }
 
   /**
    * Returns true if idle tasks are enabled for the given |isolate|.
    */
   virtual bool IdleTasksEnabled(Isolate* isolate) {
-    // TODO(ulan): Make this function abstract after V8 roll in Chromium.
     return false;
   }
 
diff --git a/deps/v8/include/v8-profiler.h b/deps/v8/include/v8-profiler.h
index 5df9b2a217ea8e..a8a9b48333604b 100644
--- a/deps/v8/include/v8-profiler.h
+++ b/deps/v8/include/v8-profiler.h
@@ -54,7 +54,11 @@ namespace v8 {
  */
 class V8_EXPORT TracingCpuProfiler {
  public:
-  static std::unique_ptr<TracingCpuProfiler> Create(Isolate*);
+  V8_DEPRECATED(
+      "The profiler is created automatically with the isolate.\n"
+      "No need to create it explicitly.",
+      static std::unique_ptr<TracingCpuProfiler> Create(Isolate*));
+
   virtual ~TracingCpuProfiler() = default;
 
  protected:
@@ -273,6 +277,16 @@ class V8_EXPORT CpuProfile {
   void Delete();
 };
 
+enum CpuProfilingMode {
+  // In the resulting CpuProfile tree, intermediate nodes in a stack trace
+  // (from the root to a leaf) will have line numbers that point to the start
+  // line of the function, rather than the line of the callsite of the child.
+  kLeafNodeLineNumbers,
+  // In the resulting CpuProfile tree, nodes are separated based on the line
+  // number of their callsite in their parent.
+  kCallerLineNumbers,
+};
+
 /**
  * Interface for controlling CPU profiling. Instance of the
  * profiler can be created using v8::CpuProfiler::New method.
@@ -316,6 +330,13 @@ class V8_EXPORT CpuProfiler {
    * |record_samples| parameter controls whether individual samples should
    * be recorded in addition to the aggregated tree.
    */
+  void StartProfiling(Local<String> title, CpuProfilingMode mode,
+                      bool record_samples = false);
+  /**
+   * The same as StartProfiling above, but the CpuProfilingMode defaults to
+   * kLeafNodeLineNumbers mode, which was the previous default behavior of the
+   * profiler.
+   */
   void StartProfiling(Local<String> title, bool record_samples = false);
 
   /**
@@ -636,7 +657,7 @@ class V8_EXPORT AllocationProfile {
  * Usage:
  * 1) Define derived class of EmbedderGraph::Node for embedder objects.
  * 2) Set the build embedder graph callback on the heap profiler using
- *    HeapProfiler::SetBuildEmbedderGraphCallback.
+ *    HeapProfiler::AddBuildEmbedderGraphCallback.
  * 3) In the callback use graph->AddEdge(node1, node2) to add an edge from
  *    node1 to node2.
  * 4) To represent references from/to V8 object, construct V8 nodes using
@@ -736,7 +757,12 @@ class V8_EXPORT HeapProfiler {
    * The callback must not trigger garbage collection in V8.
    */
   typedef void (*BuildEmbedderGraphCallback)(v8::Isolate* isolate,
-                                             v8::EmbedderGraph* graph);
+                                             v8::EmbedderGraph* graph,
+                                             void* data);
+
+  /** TODO(addaleax): Remove */
+  typedef void (*LegacyBuildEmbedderGraphCallback)(v8::Isolate* isolate,
+                                                   v8::EmbedderGraph* graph);
 
   /** Returns the number of snapshots taken. */
   int GetSnapshotCount();
@@ -878,15 +904,22 @@ class V8_EXPORT HeapProfiler {
 
   /** Binds a callback to embedder's class ID. */
   V8_DEPRECATED(
-      "Use SetBuildEmbedderGraphCallback to provide info about embedder nodes",
+      "Use AddBuildEmbedderGraphCallback to provide info about embedder nodes",
       void SetWrapperClassInfoProvider(uint16_t class_id,
                                        WrapperInfoCallback callback));
 
   V8_DEPRECATED(
-      "Use SetBuildEmbedderGraphCallback to provide info about embedder nodes",
+      "Use AddBuildEmbedderGraphCallback to provide info about embedder nodes",
       void SetGetRetainerInfosCallback(GetRetainerInfosCallback callback));
 
-  void SetBuildEmbedderGraphCallback(BuildEmbedderGraphCallback callback);
+  V8_DEPRECATE_SOON(
+      "Use AddBuildEmbedderGraphCallback to provide info about embedder nodes",
+      void SetBuildEmbedderGraphCallback(
+          LegacyBuildEmbedderGraphCallback callback));
+  void AddBuildEmbedderGraphCallback(BuildEmbedderGraphCallback callback,
+                                     void* data);
+  void RemoveBuildEmbedderGraphCallback(BuildEmbedderGraphCallback callback,
+                                        void* data);
 
   /**
    * Default value of persistent handle class ID. Must not be used to
diff --git a/deps/v8/include/v8-version.h b/deps/v8/include/v8-version.h
index 440a6068699ef0..c1287c255add04 100644
--- a/deps/v8/include/v8-version.h
+++ b/deps/v8/include/v8-version.h
@@ -9,12 +9,12 @@
 // NOTE these macros are used by some of the tool scripts and the build
 // system so their names cannot be changed without changing the scripts.
 #define V8_MAJOR_VERSION 6
-#define V8_MINOR_VERSION 7
-#define V8_BUILD_NUMBER 288
-#define V8_PATCH_LEVEL 46
+#define V8_MINOR_VERSION 9
+#define V8_BUILD_NUMBER 0
+#define V8_PATCH_LEVEL 0
 
 // Use 1 for candidates and 0 otherwise.
 // (Boolean macro values are not supported by all preprocessors.)
-#define V8_IS_CANDIDATE_VERSION 0
+#define V8_IS_CANDIDATE_VERSION 1
 
 #endif  // V8_INCLUDE_VERSION_H_
diff --git a/deps/v8/include/v8.h b/deps/v8/include/v8.h
index fe8f5a383952f7..b29a0cb127060c 100644
--- a/deps/v8/include/v8.h
+++ b/deps/v8/include/v8.h
@@ -71,7 +71,6 @@ class BigIntObject;
 class Boolean;
 class BooleanObject;
 class Context;
-class CpuProfiler;
 class Data;
 class Date;
 class External;
@@ -156,6 +155,103 @@ class GlobalHandles;
 namespace wasm {
 class StreamingDecoder;
 }  // namespace wasm
+
+/**
+ * Configuration of tagging scheme.
+ */
+const int kApiPointerSize = sizeof(void*);  // NOLINT
+const int kApiDoubleSize = sizeof(double);  // NOLINT
+const int kApiIntSize = sizeof(int);        // NOLINT
+const int kApiInt64Size = sizeof(int64_t);  // NOLINT
+
+// Tag information for HeapObject.
+const int kHeapObjectTag = 1;
+const int kWeakHeapObjectTag = 3;
+const int kHeapObjectTagSize = 2;
+const intptr_t kHeapObjectTagMask = (1 << kHeapObjectTagSize) - 1;
+
+// Tag information for Smi.
+const int kSmiTag = 0;
+const int kSmiTagSize = 1;
+const intptr_t kSmiTagMask = (1 << kSmiTagSize) - 1;
+
+template <size_t tagged_ptr_size>
+struct SmiTagging;
+
+template <int kSmiShiftSize>
+V8_INLINE internal::Object* IntToSmi(int value) {
+  int smi_shift_bits = kSmiTagSize + kSmiShiftSize;
+  intptr_t tagged_value =
+      (static_cast<intptr_t>(value) << smi_shift_bits) | kSmiTag;
+  return reinterpret_cast<internal::Object*>(tagged_value);
+}
+
+// Smi constants for systems where tagged pointer is a 32-bit value.
+template <>
+struct SmiTagging<4> {
+  enum { kSmiShiftSize = 0, kSmiValueSize = 31 };
+  static int SmiShiftSize() { return kSmiShiftSize; }
+  static int SmiValueSize() { return kSmiValueSize; }
+  V8_INLINE static int SmiToInt(const internal::Object* value) {
+    int shift_bits = kSmiTagSize + kSmiShiftSize;
+    // Throw away top 32 bits and shift down (requires >> to be sign extending).
+    return static_cast<int>(reinterpret_cast<intptr_t>(value)) >> shift_bits;
+  }
+  V8_INLINE static internal::Object* IntToSmi(int value) {
+    return internal::IntToSmi<kSmiShiftSize>(value);
+  }
+  V8_INLINE static bool IsValidSmi(intptr_t value) {
+    // To be representable as an tagged small integer, the two
+    // most-significant bits of 'value' must be either 00 or 11 due to
+    // sign-extension. To check this we add 01 to the two
+    // most-significant bits, and check if the most-significant bit is 0
+    //
+    // CAUTION: The original code below:
+    // bool result = ((value + 0x40000000) & 0x80000000) == 0;
+    // may lead to incorrect results according to the C language spec, and
+    // in fact doesn't work correctly with gcc4.1.1 in some cases: The
+    // compiler may produce undefined results in case of signed integer
+    // overflow. The computation must be done w/ unsigned ints.
+    return static_cast<uintptr_t>(value) + 0x40000000U < 0x80000000U;
+  }
+};
+
+// Smi constants for systems where tagged pointer is a 64-bit value.
+template <>
+struct SmiTagging<8> {
+  enum { kSmiShiftSize = 31, kSmiValueSize = 32 };
+  static int SmiShiftSize() { return kSmiShiftSize; }
+  static int SmiValueSize() { return kSmiValueSize; }
+  V8_INLINE static int SmiToInt(const internal::Object* value) {
+    int shift_bits = kSmiTagSize + kSmiShiftSize;
+    // Shift down and throw away top 32 bits.
+    return static_cast<int>(reinterpret_cast<intptr_t>(value) >> shift_bits);
+  }
+  V8_INLINE static internal::Object* IntToSmi(int value) {
+    return internal::IntToSmi<kSmiShiftSize>(value);
+  }
+  V8_INLINE static bool IsValidSmi(intptr_t value) {
+    // To be representable as a long smi, the value must be a 32-bit integer.
+    return (value == static_cast<int32_t>(value));
+  }
+};
+
+#if V8_COMPRESS_POINTERS
+static_assert(
+    kApiPointerSize == kApiInt64Size,
+    "Pointer compression can be enabled only for 64-bit architectures");
+typedef SmiTagging<4> PlatformSmiTagging;
+#else
+typedef SmiTagging<kApiPointerSize> PlatformSmiTagging;
+#endif
+
+const int kSmiShiftSize = PlatformSmiTagging::kSmiShiftSize;
+const int kSmiValueSize = PlatformSmiTagging::kSmiValueSize;
+const int kSmiMinValue = (static_cast<unsigned int>(-1)) << (kSmiValueSize - 1);
+const int kSmiMaxValue = -(kSmiMinValue + 1);
+constexpr bool SmiValuesAre31Bits() { return kSmiValueSize == 31; }
+constexpr bool SmiValuesAre32Bits() { return kSmiValueSize == 32; }
+
 }  // namespace internal
 
 namespace debug {
@@ -933,6 +1029,11 @@ class V8_EXPORT EscapableHandleScope : public HandleScope {
     return Local<T>(reinterpret_cast<T*>(slot));
   }
 
+  template <class T>
+  V8_INLINE MaybeLocal<T> EscapeMaybe(MaybeLocal<T> value) {
+    return Escape(value.FromMaybe(Local<T>()));
+  }
+
   EscapableHandleScope(const EscapableHandleScope&) = delete;
   void operator=(const EscapableHandleScope&) = delete;
 
@@ -1123,6 +1224,13 @@ class V8_EXPORT UnboundScript {
   static const int kNoScriptId = 0;
 };
 
+/**
+ * A compiled JavaScript module, not yet tied to a Context.
+ */
+class V8_EXPORT UnboundModuleScript {
+  // Only used as a container for code caching.
+};
+
 /**
  * A location in JavaScript source.
  */
@@ -1222,6 +1330,14 @@ class V8_EXPORT Module {
    * The module's status must be at least kInstantiated.
    */
   Local<Value> GetModuleNamespace();
+
+  /**
+   * Returns the corresponding context-unbound module script.
+   *
+   * The module must be unevaluated, i.e. its status must not be kEvaluating,
+   * kEvaluated or kErrored.
+   */
+  Local<UnboundModuleScript> GetUnboundModuleScript();
 };
 
 /**
@@ -1364,6 +1480,10 @@ class V8_EXPORT ScriptCompiler {
      * more than two data chunks. The embedder can avoid this problem by always
      * returning at least 2 bytes of data.
      *
+     * When streaming UTF-16 data, V8 does not handle characters split between
+     * two data chunks. The embedder has to make sure that chunks have an even
+     * length.
+     *
      * If the embedder wants to cancel the streaming, they should make the next
      * GetMoreData call return 0. V8 will interpret it as end of data (and most
      * probably, parsing will fail). The streaming task will return as soon as
@@ -1547,7 +1667,9 @@ class V8_EXPORT ScriptCompiler {
    * ECMAScript specification.
    */
   static V8_WARN_UNUSED_RESULT MaybeLocal<Module> CompileModule(
-      Isolate* isolate, Source* source);
+      Isolate* isolate, Source* source,
+      CompileOptions options = kNoCompileOptions,
+      NoCacheReason no_cache_reason = kNoCacheNoReason);
 
   /**
    * Compile a function for a given context. This is equivalent to running
@@ -1580,9 +1702,17 @@ class V8_EXPORT ScriptCompiler {
    */
   static CachedData* CreateCodeCache(Local<UnboundScript> unbound_script);
 
-  // Deprecated.
-  static CachedData* CreateCodeCache(Local<UnboundScript> unbound_script,
-                                     Local<String> source);
+  /**
+   * Creates and returns code cache for the specified unbound_module_script.
+   * This will return nullptr if the script cannot be serialized. The
+   * CachedData returned by this function should be owned by the caller.
+   */
+  static CachedData* CreateCodeCache(
+      Local<UnboundModuleScript> unbound_module_script);
+
+  V8_DEPRECATED("Source string is no longer required",
+                static CachedData* CreateCodeCache(
+                    Local<UnboundScript> unbound_script, Local<String> source));
 
   /**
    * Creates and returns code cache for the specified function that was
@@ -1592,9 +1722,9 @@ class V8_EXPORT ScriptCompiler {
    */
   static CachedData* CreateCodeCacheForFunction(Local<Function> function);
 
-  // Deprecated.
-  static CachedData* CreateCodeCacheForFunction(Local<Function> function,
-                                                Local<String> source);
+  V8_DEPRECATED("Source string is no longer required",
+                static CachedData* CreateCodeCacheForFunction(
+                    Local<Function> function, Local<String> source));
 
  private:
   static V8_WARN_UNUSED_RESULT MaybeLocal<UnboundScript> CompileUnboundInternal(
@@ -1913,12 +2043,16 @@ class V8_EXPORT ValueSerializer {
      * If the memory cannot be allocated, nullptr should be returned.
      * |actual_size| will be ignored. It is assumed that |old_buffer| is still
      * valid in this case and has not been modified.
+     *
+     * The default implementation uses the stdlib's `realloc()` function.
      */
     virtual void* ReallocateBufferMemory(void* old_buffer, size_t size,
                                          size_t* actual_size);
 
     /**
      * Frees a buffer allocated with |ReallocateBufferMemory|.
+     *
+     * The default implementation uses the stdlib's `free()` function.
      */
     virtual void FreeBufferMemory(void* buffer);
   };
@@ -1946,9 +2080,9 @@ class V8_EXPORT ValueSerializer {
 
   /**
    * Returns the stored data (allocated using the delegate's
-   * AllocateBufferMemory) and its size. This serializer should not be used once
-   * the buffer is released. The contents are undefined if a previous write has
-   * failed.
+   * ReallocateBufferMemory) and its size. This serializer should not be used
+   * once the buffer is released. The contents are undefined if a previous write
+   * has failed. Ownership of the buffer is transferred to the caller.
    */
   V8_WARN_UNUSED_RESULT std::pair<uint8_t*, size_t> Release();
 
@@ -2538,8 +2672,9 @@ enum class NewStringType {
  */
 class V8_EXPORT String : public Name {
  public:
-  static constexpr int kMaxLength =
-      sizeof(void*) == 4 ? (1 << 28) - 16 : (1 << 30) - 1 - 24;
+  static constexpr int kMaxLength = internal::kApiPointerSize == 4
+                                        ? (1 << 28) - 16
+                                        : internal::kSmiMaxValue / 2 - 24;
 
   enum Encoding {
     UNKNOWN_ENCODING = 0x1,
@@ -3958,6 +4093,15 @@ class V8_EXPORT Function : public Object {
     return NewInstance(context, 0, nullptr);
   }
 
+  /**
+   * When side effect checks are enabled, passing kHasNoSideEffect allows the
+   * constructor to be invoked without throwing. Calls made within the
+   * constructor are still checked.
+   */
+  V8_WARN_UNUSED_RESULT MaybeLocal<Object> NewInstanceWithSideEffectType(
+      Local<Context> context, int argc, Local<Value> argv[],
+      SideEffectType side_effect_type = SideEffectType::kHasSideEffect) const;
+
   V8_DEPRECATE_SOON("Use maybe version",
                     Local<Value> Call(Local<Value> recv, int argc,
                                       Local<Value> argv[]));
@@ -4210,10 +4354,29 @@ class V8_EXPORT Proxy : public Object {
 class V8_EXPORT WasmCompiledModule : public Object {
  public:
   typedef std::pair<std::unique_ptr<const uint8_t[]>, size_t> SerializedModule;
-  /**
-   * A buffer that is owned by the caller.
-   */
-  typedef std::pair<const uint8_t*, size_t> CallerOwnedBuffer;
+
+// The COMMA macro allows us to use ',' inside of the V8_DEPRECATE_SOON macro.
+#define COMMA ,
+  V8_DEPRECATE_SOON(
+      "Use BufferReference.",
+      typedef std::pair<const uint8_t * COMMA size_t> CallerOwnedBuffer);
+#undef COMMA
+
+  /**
+   * A unowned reference to a byte buffer.
+   */
+  struct BufferReference {
+    const uint8_t* start;
+    size_t size;
+    BufferReference(const uint8_t* start, size_t size)
+        : start(start), size(size) {}
+    // Temporarily allow conversion to and from CallerOwnedBuffer.
+    V8_DEPRECATE_SOON(
+        "Use BufferReference directly.",
+        inline BufferReference(CallerOwnedBuffer));  // NOLINT(runtime/explicit)
+    V8_DEPRECATE_SOON("Use BufferReference directly.",
+                      inline operator CallerOwnedBuffer());
+  };
 
   /**
    * An opaque, native heap object for transferring wasm modules. It
@@ -4230,7 +4393,7 @@ class V8_EXPORT WasmCompiledModule : public Object {
    private:
     typedef std::pair<std::unique_ptr<const uint8_t[]>, size_t> OwnedBuffer;
     friend class WasmCompiledModule;
-    TransferrableModule(OwnedBuffer&& code, OwnedBuffer&& bytes)
+    TransferrableModule(OwnedBuffer code, OwnedBuffer bytes)
         : compiled_code(std::move(code)), wire_bytes(std::move(bytes)) {}
 
     OwnedBuffer compiled_code = {nullptr, 0};
@@ -4254,7 +4417,9 @@ class V8_EXPORT WasmCompiledModule : public Object {
   /**
    * Get the wasm-encoded bytes that were used to compile this module.
    */
-  Local<String> GetWasmWireBytes();
+  BufferReference GetWasmWireBytesRef();
+  V8_DEPRECATE_SOON("Use GetWasmWireBytesRef version.",
+                    Local<String> GetWasmWireBytes());
 
   /**
    * Serialize the compiled module. The serialized data does not include the
@@ -4267,18 +4432,18 @@ class V8_EXPORT WasmCompiledModule : public Object {
    * uncompiled bytes.
    */
   static MaybeLocal<WasmCompiledModule> DeserializeOrCompile(
-      Isolate* isolate, const CallerOwnedBuffer& serialized_module,
-      const CallerOwnedBuffer& wire_bytes);
+      Isolate* isolate, BufferReference serialized_module,
+      BufferReference wire_bytes);
   V8_INLINE static WasmCompiledModule* Cast(Value* obj);
 
  private:
   static MaybeLocal<WasmCompiledModule> Deserialize(
-      Isolate* isolate, const CallerOwnedBuffer& serialized_module,
-      const CallerOwnedBuffer& wire_bytes);
+      Isolate* isolate, BufferReference serialized_module,
+      BufferReference wire_bytes);
   static MaybeLocal<WasmCompiledModule> Compile(Isolate* isolate,
                                                 const uint8_t* start,
                                                 size_t length);
-  static CallerOwnedBuffer AsCallerOwned(
+  static BufferReference AsReference(
       const TransferrableModule::OwnedBuffer& buff) {
     return {buff.first.get(), buff.second};
   }
@@ -4287,6 +4452,15 @@ class V8_EXPORT WasmCompiledModule : public Object {
   static void CheckCast(Value* obj);
 };
 
+// TODO(clemensh): Remove after M69 branch.
+WasmCompiledModule::BufferReference::BufferReference(
+    WasmCompiledModule::CallerOwnedBuffer buf)
+    : BufferReference(buf.first, buf.second) {}
+WasmCompiledModule::BufferReference::
+operator WasmCompiledModule::CallerOwnedBuffer() {
+  return {start, size};
+}
+
 // TODO(mtrofin): when streaming compilation is done, we can rename this
 // to simply WasmModuleObjectBuilder
 class V8_EXPORT WasmModuleObjectBuilderStreaming final {
@@ -4308,8 +4482,6 @@ class V8_EXPORT WasmModuleObjectBuilderStreaming final {
   ~WasmModuleObjectBuilderStreaming();
 
  private:
-  typedef std::pair<std::unique_ptr<const uint8_t[]>, size_t> Buffer;
-
   WasmModuleObjectBuilderStreaming(const WasmModuleObjectBuilderStreaming&) =
       delete;
   WasmModuleObjectBuilderStreaming(WasmModuleObjectBuilderStreaming&&) =
@@ -4332,8 +4504,6 @@ class V8_EXPORT WasmModuleObjectBuilderStreaming final {
 #else
   Persistent<Promise> promise_;
 #endif
-  std::vector<Buffer> received_buffers_;
-  size_t total_size_ = 0;
   std::shared_ptr<internal::wasm::StreamingDecoder> streaming_decoder_;
 };
 
@@ -4584,8 +4754,7 @@ class V8_EXPORT TypedArray : public ArrayBufferView {
   /*
    * The largest typed array size that can be constructed using New.
    */
-  static constexpr size_t kMaxLength =
-      sizeof(void*) == 4 ? (1u << 30) - 1 : (1u << 31) - 1;
+  static constexpr size_t kMaxLength = internal::kSmiMaxValue;
 
   /**
    * Number of elements in this typed array
@@ -5170,22 +5339,25 @@ class V8_EXPORT Template : public Data {
       // TODO(dcarney): gcc can't handle Local below
       Local<Value> data = Local<Value>(), PropertyAttribute attribute = None,
       Local<AccessorSignature> signature = Local<AccessorSignature>(),
-      AccessControl settings = DEFAULT);
+      AccessControl settings = DEFAULT,
+      SideEffectType getter_side_effect_type = SideEffectType::kHasSideEffect);
   void SetNativeDataProperty(
       Local<Name> name, AccessorNameGetterCallback getter,
       AccessorNameSetterCallback setter = 0,
       // TODO(dcarney): gcc can't handle Local below
       Local<Value> data = Local<Value>(), PropertyAttribute attribute = None,
       Local<AccessorSignature> signature = Local<AccessorSignature>(),
-      AccessControl settings = DEFAULT);
+      AccessControl settings = DEFAULT,
+      SideEffectType getter_side_effect_type = SideEffectType::kHasSideEffect);
 
   /**
    * Like SetNativeDataProperty, but V8 will replace the native data property
    * with a real data property on first access.
    */
-  void SetLazyDataProperty(Local<Name> name, AccessorNameGetterCallback getter,
-                           Local<Value> data = Local<Value>(),
-                           PropertyAttribute attribute = None);
+  void SetLazyDataProperty(
+      Local<Name> name, AccessorNameGetterCallback getter,
+      Local<Value> data = Local<Value>(), PropertyAttribute attribute = None,
+      SideEffectType getter_side_effect_type = SideEffectType::kHasSideEffect);
 
   /**
    * During template instantiation, sets the value with the intrinsic property
@@ -5909,12 +6081,14 @@ class V8_EXPORT ObjectTemplate : public Template {
       Local<String> name, AccessorGetterCallback getter,
       AccessorSetterCallback setter = 0, Local<Value> data = Local<Value>(),
       AccessControl settings = DEFAULT, PropertyAttribute attribute = None,
-      Local<AccessorSignature> signature = Local<AccessorSignature>());
+      Local<AccessorSignature> signature = Local<AccessorSignature>(),
+      SideEffectType getter_side_effect_type = SideEffectType::kHasSideEffect);
   void SetAccessor(
       Local<Name> name, AccessorNameGetterCallback getter,
       AccessorNameSetterCallback setter = 0, Local<Value> data = Local<Value>(),
       AccessControl settings = DEFAULT, PropertyAttribute attribute = None,
-      Local<AccessorSignature> signature = Local<AccessorSignature>());
+      Local<AccessorSignature> signature = Local<AccessorSignature>(),
+      SideEffectType getter_side_effect_type = SideEffectType::kHasSideEffect);
 
   /**
    * Sets a named property handler on the object template.
@@ -6120,7 +6294,8 @@ class V8_EXPORT AccessorSignature : public Data {
 
 
 // --- Extensions ---
-
+V8_DEPRECATE_SOON("Implementation detail",
+                  class ExternalOneByteStringResourceImpl);
 class V8_EXPORT ExternalOneByteStringResourceImpl
     : public String::ExternalOneByteStringResource {
  public:
@@ -6147,7 +6322,7 @@ class V8_EXPORT Extension {  // NOLINT
             int dep_count = 0,
             const char** deps = 0,
             int source_length = -1);
-  virtual ~Extension() { }
+  virtual ~Extension() { delete source_; }
   virtual Local<FunctionTemplate> GetNativeFunctionTemplate(
       Isolate* isolate, Local<String> name) {
     return Local<FunctionTemplate>();
@@ -6156,7 +6331,8 @@ class V8_EXPORT Extension {  // NOLINT
   const char* name() const { return name_; }
   size_t source_length() const { return source_length_; }
   const String::ExternalOneByteStringResource* source() const {
-    return &source_; }
+    return source_;
+  }
   int dependency_count() { return dep_count_; }
   const char** dependencies() { return deps_; }
   void set_auto_enable(bool value) { auto_enable_ = value; }
@@ -6169,7 +6345,7 @@ class V8_EXPORT Extension {  // NOLINT
  private:
   const char* name_;
   size_t source_length_;  // expected to initialize before source_
-  ExternalOneByteStringResourceImpl source_;
+  String::ExternalOneByteStringResource* source_;
   int dep_count_;
   const char** deps_;
   bool auto_enable_;
@@ -6394,7 +6570,9 @@ typedef void (*PromiseHook)(PromiseHookType type, Local<Promise> promise,
 // --- Promise Reject Callback ---
 enum PromiseRejectEvent {
   kPromiseRejectWithNoHandler = 0,
-  kPromiseHandlerAddedAfterReject = 1
+  kPromiseHandlerAddedAfterReject = 1,
+  kPromiseRejectAfterResolved = 2,
+  kPromiseResolveAfterResolved = 3,
 };
 
 class PromiseRejectMessage {
@@ -6641,10 +6819,12 @@ class V8_EXPORT HeapCodeStatistics {
   HeapCodeStatistics();
   size_t code_and_metadata_size() { return code_and_metadata_size_; }
   size_t bytecode_and_metadata_size() { return bytecode_and_metadata_size_; }
+  size_t external_script_source_size() { return external_script_source_size_; }
 
  private:
   size_t code_and_metadata_size_;
   size_t bytecode_and_metadata_size_;
+  size_t external_script_source_size_;
 
   friend class Isolate;
 };
@@ -6858,6 +7038,12 @@ class V8_EXPORT EmbedderHeapTracer {
   virtual bool AdvanceTracing(double deadline_in_ms,
                               AdvanceTracingActions actions) = 0;
 
+  /*
+   * Returns true if there no more tracing work to be done (see AdvanceTracing)
+   * and false otherwise.
+   */
+  virtual bool IsTracingDone() { return NumberOfWrappersToTrace() == 0; }
+
   /**
    * Called at the end of a GC cycle.
    *
@@ -6882,7 +7068,8 @@ class V8_EXPORT EmbedderHeapTracer {
   /**
    * Returns the number of wrappers that are still to be traced by the embedder.
    */
-  virtual size_t NumberOfWrappersToTrace() { return 0; }
+  V8_DEPRECATE_SOON("Use IsTracingDone",
+                    virtual size_t NumberOfWrappersToTrace() { return 0; });
 
  protected:
   virtual ~EmbedderHeapTracer() = default;
@@ -6944,7 +7131,8 @@ class V8_EXPORT Isolate {
           add_histogram_sample_callback(nullptr),
           array_buffer_allocator(nullptr),
           external_references(nullptr),
-          allow_atomics_wait(true) {}
+          allow_atomics_wait(true),
+          only_terminate_in_safe_scope(false) {}
 
     /**
      * The optional entry_hook allows the host application to provide the
@@ -7007,6 +7195,11 @@ class V8_EXPORT Isolate {
      * this isolate. This can also be configured via SetAllowAtomicsWait.
      */
     bool allow_atomics_wait;
+
+    /**
+     * Termination is postponed when there is no active SafeForTerminationScope.
+     */
+    bool only_terminate_in_safe_scope;
   };
 
 
@@ -7091,6 +7284,24 @@ class V8_EXPORT Isolate {
     internal::Isolate* const isolate_;
   };
 
+  /**
+   * This scope allows terminations inside direct V8 API calls and forbid them
+   * inside any recursice API calls without explicit SafeForTerminationScope.
+   */
+  class V8_EXPORT SafeForTerminationScope {
+   public:
+    explicit SafeForTerminationScope(v8::Isolate* isolate);
+    ~SafeForTerminationScope();
+
+    // Prevent copying of Scope objects.
+    SafeForTerminationScope(const SafeForTerminationScope&) = delete;
+    SafeForTerminationScope& operator=(const SafeForTerminationScope&) = delete;
+
+   private:
+    internal::Isolate* isolate_;
+    bool prev_value_;
+  };
+
   /**
    * Types of garbage collections that can be requested via
    * RequestGarbageCollectionForTesting.
@@ -7154,6 +7365,8 @@ class V8_EXPORT Isolate {
     kErrorStackTraceLimit = 45,
     kWebAssemblyInstantiation = 46,
     kDeoptimizerDisableSpeculation = 47,
+    kArrayPrototypeSortJSArrayModifiedPrototype = 48,
+    kFunctionTokenOffsetTooLongForToString = 49,
 
     // If you add new values here, you'll also need to update Chromium's:
     // web_feature.mojom, UseCounterCallback.cpp, and enums.xml. V8 changes to
@@ -7174,6 +7387,26 @@ class V8_EXPORT Isolate {
   typedef void (*UseCounterCallback)(Isolate* isolate,
                                      UseCounterFeature feature);
 
+  /**
+   * Allocates a new isolate but does not initialize it. Does not change the
+   * currently entered isolate.
+   *
+   * Only Isolate::GetData() and Isolate::SetData(), which access the
+   * embedder-controlled parts of the isolate, are allowed to be called on the
+   * uninitialized isolate. To initialize the isolate, call
+   * Isolate::Initialize().
+   *
+   * When an isolate is no longer used its resources should be freed
+   * by calling Dispose().  Using the delete operator is not allowed.
+   *
+   * V8::Initialize() must have run prior to this.
+   */
+  static Isolate* Allocate();
+
+  /**
+   * Initialize an Isolate previously allocated by Isolate::Allocate().
+   */
+  static void Initialize(Isolate* isolate, const CreateParams& params);
 
   /**
    * Creates a new isolate.  Does not change the currently entered
@@ -7389,15 +7622,7 @@ class V8_EXPORT Isolate {
   HeapProfiler* GetHeapProfiler();
 
   /**
-   * Returns CPU profiler for this isolate. Will return NULL unless the isolate
-   * is initialized. It is the embedder's responsibility to stop all CPU
-   * profiling activities if it has started any.
-   */
-  V8_DEPRECATED("CpuProfiler should be created with CpuProfiler::New call.",
-                CpuProfiler* GetCpuProfiler());
-
-  /**
-   * Tells the CPU profiler whether the embedder is idle.
+   * Tells the VM whether the embedder is idle or not.
    */
   void SetIdle(bool is_idle);
 
@@ -7476,6 +7701,85 @@ class V8_EXPORT Isolate {
    */
   void SetEmbedderHeapTracer(EmbedderHeapTracer* tracer);
 
+  /**
+   * Use for |AtomicsWaitCallback| to indicate the type of event it receives.
+   */
+  enum class AtomicsWaitEvent {
+    /** Indicates that this call is happening before waiting. */
+    kStartWait,
+    /** `Atomics.wait()` finished because of an `Atomics.wake()` call. */
+    kWokenUp,
+    /** `Atomics.wait()` finished because it timed out. */
+    kTimedOut,
+    /** `Atomics.wait()` was interrupted through |TerminateExecution()|. */
+    kTerminatedExecution,
+    /** `Atomics.wait()` was stopped through |AtomicsWaitWakeHandle|. */
+    kAPIStopped,
+    /** `Atomics.wait()` did not wait, as the initial condition was not met. */
+    kNotEqual
+  };
+
+  /**
+   * Passed to |AtomicsWaitCallback| as a means of stopping an ongoing
+   * `Atomics.wait` call.
+   */
+  class V8_EXPORT AtomicsWaitWakeHandle {
+   public:
+    /**
+     * Stop this `Atomics.wait()` call and call the |AtomicsWaitCallback|
+     * with |kAPIStopped|.
+     *
+     * This function may be called from another thread. The caller has to ensure
+     * through proper synchronization that it is not called after
+     * the finishing |AtomicsWaitCallback|.
+     *
+     * Note that the ECMAScript specification does not plan for the possibility
+     * of wakeups that are neither coming from a timeout or an `Atomics.wake()`
+     * call, so this may invalidate assumptions made by existing code.
+     * The embedder may accordingly wish to schedule an exception in the
+     * finishing |AtomicsWaitCallback|.
+     */
+    void Wake();
+  };
+
+  /**
+   * Embedder callback for `Atomics.wait()` that can be added through
+   * |SetAtomicsWaitCallback|.
+   *
+   * This will be called just before starting to wait with the |event| value
+   * |kStartWait| and after finishing waiting with one of the other
+   * values of |AtomicsWaitEvent| inside of an `Atomics.wait()` call.
+   *
+   * |array_buffer| will refer to the underlying SharedArrayBuffer,
+   * |offset_in_bytes| to the location of the waited-on memory address inside
+   * the SharedArrayBuffer.
+   *
+   * |value| and |timeout_in_ms| will be the values passed to
+   * the `Atomics.wait()` call. If no timeout was used, |timeout_in_ms|
+   * will be `INFINITY`.
+   *
+   * In the |kStartWait| callback, |stop_handle| will be an object that
+   * is only valid until the corresponding finishing callback and that
+   * can be used to stop the wait process while it is happening.
+   *
+   * This callback may schedule exceptions, *unless* |event| is equal to
+   * |kTerminatedExecution|.
+   */
+  typedef void (*AtomicsWaitCallback)(AtomicsWaitEvent event,
+                                      Local<SharedArrayBuffer> array_buffer,
+                                      size_t offset_in_bytes, int32_t value,
+                                      double timeout_in_ms,
+                                      AtomicsWaitWakeHandle* stop_handle,
+                                      void* data);
+
+  /**
+   * Set a new |AtomicsWaitCallback|. This overrides an earlier
+   * |AtomicsWaitCallback|, if there was any. If |callback| is nullptr,
+   * this unsets the callback. |data| will be passed to the callback
+   * as its last parameter.
+   */
+  void SetAtomicsWaitCallback(AtomicsWaitCallback callback, void* data);
+
   /**
    * Enables the host application to receive a notification after a
    * garbage collection. Allocations are allowed in the callback function,
@@ -7729,6 +8033,18 @@ class V8_EXPORT Isolate {
    */
   void IsolateInBackgroundNotification();
 
+  /**
+   * Optional notification which will enable the memory savings mode.
+   * V8 uses this notification to guide heuristics which may result in a
+   * smaller memory footprint at the cost of reduced runtime performance.
+   */
+  void EnableMemorySavingsMode();
+
+  /**
+   * Optional notification which will disable the memory savings mode.
+   */
+  void DisableMemorySavingsMode();
+
   /**
    * Optional notification to tell V8 the current performance requirements
    * of the embedder based on RAIL.
@@ -8022,7 +8338,9 @@ class V8_EXPORT V8 {
    * Returns { NULL, 0 } on failure.
    * The caller acquires ownership of the data array in the return value.
    */
-  static StartupData CreateSnapshotDataBlob(const char* embedded_source = NULL);
+  V8_DEPRECATED("Use SnapshotCreator",
+                static StartupData CreateSnapshotDataBlob(
+                    const char* embedded_source = NULL));
 
   /**
    * Bootstrap an isolate and a context from the cold startup blob, run the
@@ -8032,8 +8350,9 @@ class V8_EXPORT V8 {
    * The caller acquires ownership of the data array in the return value.
    * The argument startup blob is untouched.
    */
-  static StartupData WarmUpSnapshotDataBlob(StartupData cold_startup_blob,
-                                            const char* warmup_source);
+  V8_DEPRECATED("Use SnapshotCreator",
+                static StartupData WarmUpSnapshotDataBlob(
+                    StartupData cold_startup_blob, const char* warmup_source));
 
   /** Set the callback to invoke in case of Dcheck failures. */
   static void SetDcheckErrorHandler(DcheckErrorCallback that);
@@ -8228,6 +8547,18 @@ class V8_EXPORT SnapshotCreator {
  public:
   enum class FunctionCodeHandling { kClear, kKeep };
 
+  /**
+   * Initialize and enter an isolate, and set it up for serialization.
+   * The isolate is either created from scratch or from an existing snapshot.
+   * The caller keeps ownership of the argument snapshot.
+   * \param existing_blob existing snapshot from which to create this one.
+   * \param external_references a null-terminated array of external references
+   *        that must be equivalent to CreateParams::external_references.
+   */
+  SnapshotCreator(Isolate* isolate,
+                  const intptr_t* external_references = nullptr,
+                  StartupData* existing_blob = nullptr);
+
   /**
    * Create and enter an isolate, and set it up for serialization.
    * The isolate is either created from scratch or from an existing snapshot.
@@ -8988,85 +9319,6 @@ class V8_EXPORT Locker {
 
 namespace internal {
 
-const int kApiPointerSize = sizeof(void*);  // NOLINT
-const int kApiIntSize = sizeof(int);  // NOLINT
-const int kApiInt64Size = sizeof(int64_t);  // NOLINT
-
-// Tag information for HeapObject.
-const int kHeapObjectTag = 1;
-const int kWeakHeapObjectTag = 3;
-const int kHeapObjectTagSize = 2;
-const intptr_t kHeapObjectTagMask = (1 << kHeapObjectTagSize) - 1;
-
-// Tag information for Smi.
-const int kSmiTag = 0;
-const int kSmiTagSize = 1;
-const intptr_t kSmiTagMask = (1 << kSmiTagSize) - 1;
-
-template <size_t ptr_size> struct SmiTagging;
-
-template<int kSmiShiftSize>
-V8_INLINE internal::Object* IntToSmi(int value) {
-  int smi_shift_bits = kSmiTagSize + kSmiShiftSize;
-  uintptr_t tagged_value =
-      (static_cast<uintptr_t>(value) << smi_shift_bits) | kSmiTag;
-  return reinterpret_cast<internal::Object*>(tagged_value);
-}
-
-// Smi constants for 32-bit systems.
-template <> struct SmiTagging<4> {
-  enum { kSmiShiftSize = 0, kSmiValueSize = 31 };
-  static int SmiShiftSize() { return kSmiShiftSize; }
-  static int SmiValueSize() { return kSmiValueSize; }
-  V8_INLINE static int SmiToInt(const internal::Object* value) {
-    int shift_bits = kSmiTagSize + kSmiShiftSize;
-    // Throw away top 32 bits and shift down (requires >> to be sign extending).
-    return static_cast<int>(reinterpret_cast<intptr_t>(value)) >> shift_bits;
-  }
-  V8_INLINE static internal::Object* IntToSmi(int value) {
-    return internal::IntToSmi<kSmiShiftSize>(value);
-  }
-  V8_INLINE static bool IsValidSmi(intptr_t value) {
-    // To be representable as an tagged small integer, the two
-    // most-significant bits of 'value' must be either 00 or 11 due to
-    // sign-extension. To check this we add 01 to the two
-    // most-significant bits, and check if the most-significant bit is 0
-    //
-    // CAUTION: The original code below:
-    // bool result = ((value + 0x40000000) & 0x80000000) == 0;
-    // may lead to incorrect results according to the C language spec, and
-    // in fact doesn't work correctly with gcc4.1.1 in some cases: The
-    // compiler may produce undefined results in case of signed integer
-    // overflow. The computation must be done w/ unsigned ints.
-    return static_cast<uintptr_t>(value + 0x40000000U) < 0x80000000U;
-  }
-};
-
-// Smi constants for 64-bit systems.
-template <> struct SmiTagging<8> {
-  enum { kSmiShiftSize = 31, kSmiValueSize = 32 };
-  static int SmiShiftSize() { return kSmiShiftSize; }
-  static int SmiValueSize() { return kSmiValueSize; }
-  V8_INLINE static int SmiToInt(const internal::Object* value) {
-    int shift_bits = kSmiTagSize + kSmiShiftSize;
-    // Shift down and throw away top 32 bits.
-    return static_cast<int>(reinterpret_cast<intptr_t>(value) >> shift_bits);
-  }
-  V8_INLINE static internal::Object* IntToSmi(int value) {
-    return internal::IntToSmi<kSmiShiftSize>(value);
-  }
-  V8_INLINE static bool IsValidSmi(intptr_t value) {
-    // To be representable as a long smi, the value must be a 32-bit integer.
-    return (value == static_cast<int32_t>(value));
-  }
-};
-
-typedef SmiTagging<kApiPointerSize> PlatformSmiTagging;
-const int kSmiShiftSize = PlatformSmiTagging::kSmiShiftSize;
-const int kSmiValueSize = PlatformSmiTagging::kSmiValueSize;
-V8_INLINE static bool SmiValuesAre31Bits() { return kSmiValueSize == 31; }
-V8_INLINE static bool SmiValuesAre32Bits() { return kSmiValueSize == 32; }
-
 /**
  * This class exports constants and functionality from within v8 that
  * is necessary to implement inline functions in the v8 api.  Don't
@@ -9080,7 +9332,7 @@ class Internals {
   static const int kMapInstanceTypeOffset = 1 * kApiPointerSize + kApiIntSize;
   static const int kStringResourceOffset = 3 * kApiPointerSize;
 
-  static const int kOddballKindOffset = 4 * kApiPointerSize + sizeof(double);
+  static const int kOddballKindOffset = 4 * kApiPointerSize + kApiDoubleSize;
   static const int kForeignAddressOffset = kApiPointerSize;
   static const int kJSObjectHeaderSize = 3 * kApiPointerSize;
   static const int kFixedArrayHeaderSize = 2 * kApiPointerSize;
diff --git a/deps/v8/infra/config/cq.cfg b/deps/v8/infra/config/cq.cfg
index 6159b3f1cdeca4..85fb595ae7e6c4 100644
--- a/deps/v8/infra/config/cq.cfg
+++ b/deps/v8/infra/config/cq.cfg
@@ -30,6 +30,11 @@ verifiers {
         name: "v8_linux64_asan_rel_ng_triggered"
         triggered_by: "v8_linux64_asan_rel_ng"
       }
+      builders { name: "v8_linux64_dbg_ng" }
+      builders {
+        name: "v8_linux64_dbg_ng_triggered"
+        triggered_by: "v8_linux64_dbg_ng"
+      }
       builders { name: "v8_linux64_gcc_compile_dbg" }
       builders { name: "v8_linux64_jumbo_compile_rel" }
       builders { name: "v8_linux64_rel_ng" }
@@ -61,11 +66,6 @@ verifiers {
         experiment_percentage: 100
       }
       builders { name: "v8_linux_chromium_gn_rel" }
-      builders { name: "v8_linux_dbg_ng" }
-      builders {
-        name: "v8_linux_dbg_ng_triggered"
-        triggered_by: "v8_linux_dbg_ng"
-      }
       builders { name: "v8_linux_gcc_compile_rel" }
       builders { name: "v8_linux_mips64el_compile_rel" }
       builders { name: "v8_linux_mipsel_compile_rel" }
@@ -111,7 +111,5 @@ verifiers {
       }
     }
   }
-
-  sign_cla {}
 }
 
diff --git a/deps/v8/infra/mb/mb_config.pyl b/deps/v8/infra/mb/mb_config.pyl
index 70a7ad5754e0cb..52d4fe90abe582 100644
--- a/deps/v8/infra/mb/mb_config.pyl
+++ b/deps/v8/infra/mb/mb_config.pyl
@@ -43,12 +43,6 @@
       'x64.optdebug': 'default_optdebug_x64',
       'x64.release': 'default_release_x64',
     },
-
-    'client.dart.fyi': {
-      'v8-linux-release': 'release_x86_disassembler',
-      'v8-win-release': 'release_x86_disassembler',
-      'v8-mac-release': 'release_x86_disassembler',
-    },
     'client.dynamorio': {
       'linux-v8-dr': 'release_x64',
     },
@@ -101,6 +95,7 @@
       'V8 Fuchsia': 'release_x64_fuchsia',
       'V8 Fuchsia - debug': 'debug_x64_fuchsia',
       'V8 Linux64 - cfi': 'release_x64_cfi',
+      'V8 Linux64 UBSan': 'release_x64_ubsan',
       'V8 Linux64 UBSanVptr': 'release_x64_ubsan_vptr',
       'V8 Linux - vtunejit': 'debug_x86_vtunejit',
       'V8 Linux64 - gcov coverage': 'release_x64_gcc_coverage',
@@ -110,37 +105,39 @@
       'V8 Random Deopt Fuzzer - debug': 'debug_x64',
     },
     'client.v8.clusterfuzz': {
-      'V8 Win64 ASAN - release builder':
+      'V8 Clusterfuzz Win64 ASAN - release builder':
         'release_x64_asan_no_lsan_verify_heap',
       # Note this is called a debug builder, but it uses a release build
       # configuration with dchecks (which enables DEBUG in V8), since win-asan
       # debug is not supported.
-      'V8 Win64 ASAN - debug builder':
+      'V8 Clusterfuzz Win64 ASAN - debug builder':
         'release_x64_asan_no_lsan_verify_heap_dchecks',
-      'V8 Mac64 ASAN - release builder':
+      'V8 Clusterfuzz Mac64 ASAN - release builder':
           'release_x64_asan_no_lsan_edge_verify_heap',
-      'V8 Mac64 ASAN - debug builder':
+      'V8 Clusterfuzz Mac64 ASAN - debug builder':
           'debug_x64_asan_no_lsan_static_edge',
-      'V8 Linux64 - release builder': 'release_x64_correctness_fuzzer',
-      'V8 Linux64 - debug builder': 'debug_x64',
-      'V8 Linux64 - nosnap release builder': 'release_x64_no_snap',
-      'V8 Linux64 - nosnap debug builder': 'debug_x64_no_snap',
-      'V8 Linux64 ASAN no inline - release builder':
+      'V8 Clusterfuzz Linux64 - release builder':
+          'release_x64_correctness_fuzzer',
+      'V8 Clusterfuzz Linux64 - debug builder': 'debug_x64',
+      'V8 Clusterfuzz Linux64 - nosnap release builder': 'release_x64_no_snap',
+      'V8 Clusterfuzz Linux64 - nosnap debug builder': 'debug_x64_no_snap',
+      'V8 Clusterfuzz Linux64 ASAN no inline - release builder':
           'release_x64_asan_symbolized_edge_verify_heap',
-      'V8 Linux64 ASAN - debug builder': 'debug_x64_asan_edge',
-      'V8 Linux64 ASAN arm64 - debug builder':
+      'V8 Clusterfuzz Linux64 ASAN - debug builder': 'debug_x64_asan_edge',
+      'V8 Clusterfuzz Linux64 ASAN arm64 - debug builder':
           'debug_simulate_arm64_asan_edge',
-      'V8 Linux ASAN arm - debug builder':
+      'V8 Clusterfuzz Linux ASAN arm - debug builder':
           'debug_simulate_arm_asan_edge',
-      'V8 Linux ASAN mipsel - debug builder':
+      'V8 Clusterfuzz Linux ASAN mipsel - debug builder':
           'debug_simulate_mipsel_asan_edge',
-      'V8 Linux64 CFI - release builder': 'release_x64_cfi_clusterfuzz',
-      'V8 Linux MSAN no origins':
+      'V8 Clusterfuzz Linux64 CFI - release builder':
+          'release_x64_cfi_clusterfuzz',
+      'V8 Clusterfuzz Linux MSAN no origins':
           'release_simulate_arm64_msan_no_origins_edge',
-      'V8 Linux MSAN chained origins':
+      'V8 Clusterfuzz Linux MSAN chained origins':
           'release_simulate_arm64_msan_edge',
-      'V8 Linux64 TSAN - release builder': 'release_x64_tsan',
-      'V8 Linux64 UBSanVptr - release builder':
+      'V8 Clusterfuzz Linux64 TSAN - release builder': 'release_x64_tsan',
+      'V8 Clusterfuzz Linux64 UBSanVptr - release builder':
           'release_x64_ubsan_vptr_recover_edge',
     },
     'client.v8.ports': {
@@ -207,6 +204,7 @@
       'v8_linux_gcc_compile_rel': 'release_x86_gcc_minimal_symbols',
       'v8_linux_gcc_rel': 'release_x86_gcc_minimal_symbols',
       'v8_linux_shared_compile_rel': 'release_x86_shared_verify_heap',
+      'v8_linux64_dbg_ng': 'debug_x64_trybot',
       'v8_linux64_gcc_compile_dbg': 'debug_x64_gcc',
       'v8_linux64_fyi_rel_ng': 'release_x64_test_features_trybot',
       'v8_linux64_rel_ng': 'release_x64_test_features_trybot',
@@ -238,6 +236,7 @@
       'v8_mac64_dbg': 'debug_x64',
       'v8_mac64_dbg_ng': 'debug_x64',
       'v8_mac64_asan_rel': 'release_x64_asan_no_lsan',
+      'v8_mips_compile_rel': 'release_mips_no_snap_no_i18n',
       'v8_linux_arm_rel_ng': 'release_simulate_arm_trybot',
       'v8_linux_arm_dbg': 'debug_simulate_arm',
       'v8_linux_arm_armv8a_rel': 'release_simulate_arm_trybot',
@@ -417,10 +416,9 @@
     'release_x64_fuchsia_trybot': [
       'release_trybot', 'x64', 'fuchsia'],
     'release_x64_gcc_coverage': [
-      'release_bot', 'x64', 'coverage', 'gcc'],
+      'release_bot', 'x64', 'coverage', 'gcc', 'no_custom_libcxx', 'no_sysroot'],
     'release_x64_internal': [
-      'release_bot', 'x64', 'v8_enable_embedded_builtins',
-      'v8_snapshot_internal'],
+      'release_bot', 'x64', 'v8_snapshot_internal'],
     'release_x64_jumbo': [
       'release_bot', 'x64', 'jumbo'],
     'release_x64_jumbo_trybot': [
@@ -446,6 +444,8 @@
       'minimal_symbols'],
     'release_x64_tsan_minimal_symbols': [
       'release_bot', 'x64', 'tsan', 'minimal_symbols'],
+    'release_x64_ubsan': [
+      'release_bot', 'x64', 'ubsan'],
     'release_x64_ubsan_vptr': [
       'release_bot', 'x64', 'ubsan_vptr'],
     'release_x64_ubsan_vptr_recover_edge': [
@@ -454,7 +454,7 @@
       'release_bot', 'x64', 'ubsan_vptr', 'minimal_symbols'],
     'release_x64_verify_csa': [
       'release_bot', 'x64', 'dcheck_always_on',
-      'v8_enable_slow_dchecks', 'v8_enable_embedded_builtins', 'v8_verify_csa'],
+      'v8_enable_slow_dchecks', 'v8_verify_csa'],
 
     # Debug configs for x64.
     'debug_x64': [
@@ -503,8 +503,6 @@
     # Release configs for x86.
     'release_x86': [
       'release_bot', 'x86'],
-    'release_x86_disassembler': [
-      'release_bot', 'x86', 'v8_enable_disassembler'],
     'release_x86_gcc': [
       'release_bot', 'x86', 'gcc'],
     'release_x86_gcc_minimal_symbols': [
@@ -566,14 +564,14 @@
 
     'cfi': {
       'mixins': ['v8_enable_test_features'],
-      'gn_args': ('is_cfi=true use_cfi_cast=true use_cfi_diag=true '
-                  'use_cfi_recover=false'),
+      'gn_args': ('is_cfi=true use_cfi_cast=true use_cfi_icall=true '
+                  'use_cfi_diag=true use_cfi_recover=false'),
     },
 
     'cfi_clusterfuzz': {
       'mixins': ['v8_enable_test_features'],
-      'gn_args': ('is_cfi=true use_cfi_cast=true use_cfi_diag=true '
-                  'use_cfi_recover=true'),
+      'gn_args': ('is_cfi=true use_cfi_cast=true use_cfi_icall=true '
+                  'use_cfi_diag=true use_cfi_recover=true'),
     },
 
     'clang': {
@@ -592,10 +590,14 @@
       'gn_args': 'is_debug=true v8_enable_backtrace=true',
     },
 
+    'v8_use_multi_snapshots': {
+      'gn_args': 'v8_use_multi_snapshots=true',
+    },
+
     'debug_bot': {
       'mixins': [
         'debug', 'shared', 'goma', 'v8_enable_slow_dchecks',
-        'v8_optimized_debug'],
+        'v8_use_multi_snapshots', 'v8_optimized_debug'],
     },
 
     'debug_trybot': {
@@ -669,6 +671,10 @@
       'gn_args': 'is_clang=false',
     },
 
+    'no_custom_libcxx': {
+      'gn_args': 'use_custom_libcxx=false',
+    },
+
     'no_sysroot': {
       'gn_args': 'use_sysroot=false',
     },
@@ -678,7 +684,7 @@
     },
 
     'release_bot': {
-      'mixins': ['release', 'static', 'goma'],
+      'mixins': ['release', 'static', 'goma', 'v8_use_multi_snapshots'],
     },
 
     'release_trybot': {
@@ -736,6 +742,14 @@
       'gn_args': 'is_tsan=true',
     },
 
+    'ubsan': {
+      'mixins': ['v8_enable_test_features'],
+      # TODO(krasin): Remove is_ubsan_no_recover=true when
+      # https://llvm.org/bugs/show_bug.cgi?id=25569 is fixed and just use
+      # ubsan instead.
+      'gn_args': 'is_ubsan=true is_ubsan_no_recover=true',
+    },
+
     'ubsan_vptr': {
       'mixins': ['v8_enable_test_features'],
       # TODO(krasin): Remove is_ubsan_no_recover=true when
@@ -763,14 +777,6 @@
       'gn_args': 'v8_correctness_fuzzer=true v8_multi_arch_build=true',
     },
 
-    'v8_enable_disassembler': {
-      'gn_args': 'v8_enable_disassembler=true',
-    },
-
-    'v8_enable_embedded_builtins': {
-      'gn_args': 'v8_enable_embedded_builtins=true',
-    },
-
     'v8_enable_slow_dchecks': {
       'gn_args': 'v8_enable_slow_dchecks=true',
     },
diff --git a/deps/v8/infra/testing/PRESUBMIT.py b/deps/v8/infra/testing/PRESUBMIT.py
new file mode 100644
index 00000000000000..9f242a929943af
--- /dev/null
+++ b/deps/v8/infra/testing/PRESUBMIT.py
@@ -0,0 +1,183 @@
+# Copyright 2018 the V8 project authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+"""
+Presubmit checks for the validity of V8-side test specifications in pyl files.
+
+For simplicity, we check all pyl files on any changes in this folder.
+"""
+
+import ast
+import os
+
+
+SUPPORTED_BUILDER_SPEC_KEYS = [
+  'swarming_dimensions',
+  'swarming_task_attrs',
+  'tests',
+]
+
+# This is not an exhaustive list. It only reflects what we currently use. If
+# there's need to specify a different dimension, just add it here.
+SUPPORTED_SWARMING_DIMENSIONS = [
+  'cores',
+  'cpu',
+  'os',
+]
+
+# This is not an exhaustive list. It only reflects what we currently use. If
+# there's need to specify a different property, just add it here.
+SUPPORTED_SWARMING_TASK_ATTRS = [
+  'expiration',
+  'hard_timeout',
+  'priority',
+]
+
+SUPPORTED_TEST_KEYS = [
+  'name',
+  'shards',
+  'suffix',
+  'swarming_dimensions',
+  'swarming_task_attrs',
+  'test_args',
+  'variant',
+]
+
+def check_keys(error_msg, src_dict, supported_keys):
+  errors = []
+  for key in src_dict.keys():
+    if key not in supported_keys:
+      errors += error_msg('Key "%s" must be one of %s' % (key, supported_keys))
+  return errors
+
+
+def _check_properties(error_msg, src_dict, prop_name, supported_keys):
+  properties = src_dict.get(prop_name, {})
+  if not isinstance(properties, dict):
+    return error_msg('Value for %s must be a dict' % prop_name)
+  return check_keys(error_msg, properties, supported_keys)
+
+
+def _check_int_range(error_msg, src_dict, prop_name, lower_bound=None,
+                     upper_bound=None):
+  if prop_name not in src_dict:
+    # All properties are optional.
+    return []
+  try:
+    value = int(src_dict[prop_name])
+  except ValueError:
+    return error_msg('If specified, %s must be an int' % prop_name)
+  if lower_bound is not None and value < lower_bound:
+    return error_msg('If specified, %s must be >=%d' % (prop_name, lower_bound))
+  if upper_bound is not None and value > upper_bound:
+    return error_msg('If specified, %s must be <=%d' % (prop_name, upper_bound))
+  return []
+
+
+def _check_swarming_task_attrs(error_msg, src_dict):
+  errors = []
+  task_attrs = src_dict.get('swarming_task_attrs', {})
+  errors += _check_int_range(
+      error_msg, task_attrs, 'priority', lower_bound=25, upper_bound=100)
+  errors += _check_int_range(
+      error_msg, task_attrs, 'expiration', lower_bound=1)
+  errors += _check_int_range(
+      error_msg, task_attrs, 'hard_timeout', lower_bound=1)
+  return errors
+
+
+def _check_swarming_config(error_msg, src_dict):
+  errors = []
+  errors += _check_properties(
+      error_msg, src_dict, 'swarming_dimensions',
+      SUPPORTED_SWARMING_DIMENSIONS)
+  errors += _check_properties(
+      error_msg, src_dict, 'swarming_task_attrs',
+      SUPPORTED_SWARMING_TASK_ATTRS)
+  errors += _check_swarming_task_attrs(error_msg, src_dict)
+  return errors
+
+
+def _check_test(error_msg, test):
+  if not isinstance(test, dict):
+    return error_msg('Each test must be specified with a dict')
+  errors = check_keys(error_msg, test, SUPPORTED_TEST_KEYS)
+  if not test.get('name'):
+    errors += error_msg('A test requires a name')
+  errors += _check_swarming_config(error_msg, test)
+
+  test_args = test.get('test_args', [])
+  if not isinstance(test_args, list):
+    errors += error_msg('If specified, test_args must be a list of arguments')
+  if not all(isinstance(x, basestring) for x in test_args):
+    errors += error_msg('If specified, all test_args must be strings')
+
+  # Limit shards to 10 to avoid erroneous resource exhaustion.
+  errors += _check_int_range(
+      error_msg, test, 'shards', lower_bound=1, upper_bound=10)
+
+  variant = test.get('variant', 'default')
+  if not variant or not isinstance(variant, basestring):
+    errors += error_msg('If specified, variant must be a non-empty string')
+
+  return errors
+
+
+def _check_test_spec(file_path, raw_pyl):
+  def error_msg(msg):
+    return ['Error in %s:\n%s' % (file_path, msg)]
+
+  try:
+    # Eval python literal file.
+    full_test_spec = ast.literal_eval(raw_pyl)
+  except SyntaxError as e:
+    return error_msg('Pyl parsing failed with:\n%s' % e)
+
+  if not isinstance(full_test_spec, dict):
+    return error_msg('Test spec must be a dict')
+
+  errors = []
+  for buildername, builder_spec in full_test_spec.iteritems():
+    def error_msg(msg):
+      return ['Error in %s for builder %s:\n%s' % (file_path, buildername, msg)]
+
+    if not isinstance(buildername, basestring) or not buildername:
+      errors += error_msg('Buildername must be a non-empty string')
+
+    if not isinstance(builder_spec, dict) or not builder_spec:
+      errors += error_msg('Value must be a non-empty dict')
+      continue
+
+    errors += check_keys(error_msg, builder_spec, SUPPORTED_BUILDER_SPEC_KEYS)
+    errors += _check_swarming_config(error_msg, builder_spec)
+
+    for test in builder_spec.get('tests', []):
+      errors += _check_test(error_msg, test)
+
+  return errors
+
+
+
+def CheckChangeOnCommit(input_api, output_api):
+  def file_filter(regexp):
+    return lambda f: input_api.FilterSourceFile(f, white_list=(regexp,))
+
+  # Calculate which files are affected.
+  if input_api.AffectedFiles(False, file_filter(r'.*PRESUBMIT\.py')):
+    # If PRESUBMIT.py itself was changed, check also the test spec.
+    affected_files = [
+      os.path.join(input_api.PresubmitLocalPath(), 'builders.pyl'),
+    ]
+  else:
+    # Otherwise, check test spec only when changed.
+    affected_files = [
+      f.AbsoluteLocalPath()
+      for f in input_api.AffectedFiles(False, file_filter(r'.*builders\.pyl'))
+    ]
+
+  errors = []
+  for file_path in affected_files:
+    with open(file_path) as f:
+      errors += _check_test_spec(file_path, f.read())
+  return [output_api.PresubmitError(r) for r in errors]
diff --git a/deps/v8/infra/testing/README.md b/deps/v8/infra/testing/README.md
index 8658768cac9102..438ba2e6d064c4 100644
--- a/deps/v8/infra/testing/README.md
+++ b/deps/v8/infra/testing/README.md
@@ -7,38 +7,65 @@ variants specified [here](https://chromium.googlesource.com/v8/v8/+/master/tools
 Changes to src-side test specifications go through CQ like any other CL and
 require tests added for specific trybots to pass.
 
-The test specifications are defined in a V8-side folder called infra/testing.
-Every master has an optional file named `<mastername>.pyl`. E.g.
-`tryserver.v8.pyl`.
+The test specifications are defined in a V8-side python-literal file
+`infra/testing/builders.pyl`.
 
-The structure of each file is:
+The structure of the file is:
 ```
 {
-  <buildername>: [
-    {
-      'name': <test-spec name>,
-      'variant': <variant name>,
-      'shards': <number of shards>,
-    },
-    ...
-  ],
+  <buildername>: {
+    'tests': [
+      {
+        'name': <test-spec name>,
+        'suffix': <step suffix>,
+        'variant': <variant name>,
+        'shards': <number of shards>,
+        'test_args': <list of flags>,
+        'swarming_task_attrs': {...},
+        'swarming_dimensions': {...},
+      },
+      ...
+    ],
+    'swarming_task_attrs': {...},
+    'swarming_dimensions': {...},
+  },
   ...
 }
 ```
 The `<buildername>` is a string name of the builder to execute the tests.
 `<test-spec name>` is a label defining a test specification matching the
 [infra-side](https://chromium.googlesource.com/chromium/tools/build/+/master/scripts/slave/recipe_modules/v8/testing.py#58).
-The `<variant name>` is a testing variant specified
+The optional `suffix` will be appended to test-step names for disambiguation.
+The optional `variant` is a testing variant specified
 [here](https://chromium.googlesource.com/v8/v8/+/master/tools/testrunner/local/variants.py).
-`<number of shards>` is optional (default 1), but can be provided to increase
-the swarming shards for long-running tests.
+The optional `shards` (default 1) can be provided to increase the swarming
+shards for long-running tests.
+The optional `test_args` is a list of string flags that will be passed to the
+V8 test driver.
+The optional `swarming_task_attrs` is a dict allowing to override the defaults
+for `priority`, `expiration` and `hard_timeout`.
+The optional `swarming_dimensions` is a dict allowing to override the defaults
+for `cpu`, `cores` and `os`.
+Both `swarming_task_attrs` and `swarming_dimensions` can be defined per builder
+and per test, whereas the latter takes precedence.
 
 Example:
 ```
 {
-  'v8_linux64_rel_ng_triggered': [
-    {'name': 'v8testing', 'variant': 'nooptimization', 'shards': 2},
-  ],
+  'v8_linux64_rel_ng_triggered': {
+    'tests': [
+      {
+        'name': 'v8testing',
+        'suffix': 'stress',
+        'variant': 'nooptimization',
+        'shards': 2,
+        'test_args': ['--gc-stress'],
+        'swarming_dimensions': {'os': 'Ubuntu-14.4'},
+      },
+    ],
+    'swarming_properties': {'priority': 35},
+    'swarming_dimensions': {'os': 'Ubuntu'},
+  },
 }
 ```
 
diff --git a/deps/v8/infra/testing/builders.pyl b/deps/v8/infra/testing/builders.pyl
new file mode 100644
index 00000000000000..f8fad69cb1aeca
--- /dev/null
+++ b/deps/v8/infra/testing/builders.pyl
@@ -0,0 +1,432 @@
+# Copyright 2018 The V8 project authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+#
+# Please keep builder names, builder configs and test definitions sorted.
+# Builder names should be sorted alphabetically. Builder configs should have
+# keys sorted in the alphabetical order except 'tests' key, which should always
+# come last. Test definitions must have keys in the following order, but omit
+# optional fields:
+#  * name (required)
+#  * variant
+#  * test_args
+#  * shards
+#  * suffix
+#  * swarming_dimensions
+#  * swarming_task_attrs
+#
+# Please also format test definitions as a single line with ', ' separating
+# fields, e.g.
+#
+#   {'name': 'v8testing', 'variant': 'extra', 'shards': 2}
+#
+# After formatting test definitions this way, please sort them alphabetically by
+# test name. For all variants of the test with the same name, the
+# least-qualified test (no variant, no test args) should come first. You may
+# also deviate from the alphabetical order if necessary and group tests
+# differently, but in this case please add a comment before each group and
+# continue to sort tests using the rules above within each group.
+
+{
+  ##############################################################################
+  ### luci.v8.try
+  ##############################################################################
+  # Linux32
+  'v8_linux_dbg_ng_triggered': {
+    'swarming_dimensions' : {
+      'cpu': 'x86-64-avx2',
+    },
+    'tests': [
+      {'name': 'benchmarks'},
+      {'name': 'benchmarks', 'variant': 'extra'},
+      {'name': 'mjsunit_sp_frame_access'},
+      {'name': 'mozilla'},
+      {'name': 'mozilla', 'variant': 'extra'},
+      {'name': 'test262'},
+      {'name': 'test262_variants', 'variant': 'extra', 'shards': 3},
+      {'name': 'v8testing', 'shards': 3},
+      {'name': 'v8testing', 'variant': 'extra', 'shards': 2},
+    ],
+  },
+  'v8_linux_gc_stress_dbg': {
+    'tests': [
+      {'name': 'mjsunit', 'variant': 'slow_path', 'test_args': ['--gc-stress'], 'shards': 2},
+      {'name': 'd8testing', 'test_args': ['--gc-stress'], 'shards': 5},
+    ],
+  },
+  'v8_linux_gcc_rel': {
+    'tests': [
+      {'name': 'v8testing'},
+    ],
+  },
+  'v8_linux_nodcheck_rel_ng_triggered': {
+    'swarming_dimensions' : {
+      'cpu': 'x86-64-avx2',
+    },
+    'tests': [
+      {'name': 'benchmarks'},
+      {'name': 'benchmarks', 'variant': 'extra'},
+      {'name': 'mozilla'},
+      {'name': 'mozilla', 'variant': 'extra'},
+      {'name': 'test262_variants', 'shards': 2},
+      {'name': 'test262_variants', 'variant': 'extra', 'shards': 2},
+      {'name': 'v8testing'},
+      {'name': 'v8testing', 'variant': 'extra'},
+    ],
+  },
+  'v8_linux_noi18n_rel_ng_triggered': {
+    'tests': [
+      {'name': 'mozilla', 'variant': 'default'},
+      {'name': 'test262', 'variant': 'default'},
+      {'name': 'v8testing', 'variant': 'default', 'shards': 2},
+    ],
+  },
+  'v8_linux_nosnap_rel': {
+    'tests': [
+      {'name': 'v8testing', 'variant': 'default', 'shards': 4},
+    ],
+  },
+  'v8_linux_nosnap_dbg': {
+    'swarming_task_attrs': {
+      'hard_timeout': 3600,
+    },
+    'tests': [
+      {'name': 'v8testing', 'variant': 'default', 'shards': 9},
+    ],
+  },
+  'v8_linux_rel_ng_triggered': {
+    'swarming_dimensions' : {
+      'cpu': 'x86-64-avx2',
+    },
+    'tests': [
+      {'name': 'benchmarks'},
+      {'name': 'benchmarks', 'variant': 'extra'},
+      {'name': 'gcmole'},
+      {'name': 'mjsunit_sp_frame_access'},
+      {'name': 'mozilla'},
+      {'name': 'mozilla', 'variant': 'extra'},
+      {'name': 'optimize_for_size'},
+      {'name': 'test262_variants', 'shards': 4},
+      {'name': 'test262_variants', 'variant': 'extra', 'shards': 2},
+      {'name': 'v8testing'},
+      {'name': 'v8testing', 'variant': 'extra'},
+    ],
+  },
+  'v8_linux_verify_csa_rel_ng_triggered': {
+    'tests': [
+      {'name': 'v8testing'},
+    ],
+  },
+  ##############################################################################
+  # Linux32 with arm simulators
+  'v8_linux_arm_dbg': {
+    'tests': [
+      {'name': 'mjsunit_sp_frame_access'},
+      {'name': 'mozilla'},
+      {'name': 'test262'},
+      {'name': 'v8testing', 'shards': 7},
+      {'name': 'v8testing', 'variant': 'extra', 'shards': 3},
+    ],
+  },
+  'v8_linux_arm_rel_ng_triggered': {
+    'tests': [
+      {'name': 'mjsunit_sp_frame_access'},
+      {'name': 'mozilla'},
+      {'name': 'test262'},
+      {'name': 'v8testing', 'shards': 7},
+      {'name': 'v8testing', 'variant': 'extra', 'shards': 3},
+    ],
+  },
+  ##############################################################################
+  # Linux64
+  'v8_linux64_asan_rel_ng_triggered': {
+    'tests': [
+      {'name': 'test262_variants', 'shards': 7},
+      {'name': 'v8testing', 'shards': 3},
+      {'name': 'v8testing', 'variant': 'extra', 'shards': 2},
+      {'name': 'v8testing', 'variant': 'slow_path'},
+    ],
+  },
+  'v8_linux64_cfi_rel_ng_triggered': {
+    'tests': [
+      {'name': 'benchmarks'},
+      {'name': 'mozilla'},
+      {'name': 'optimize_for_size'},
+      {'name': 'test262'},
+      {'name': 'v8testing', 'shards': 2},
+    ],
+  },
+  'v8_linux64_dbg_ng_triggered': {
+    'swarming_dimensions' : {
+      'cpu': 'x86-64-avx2',
+    },
+    'tests': [
+      {'name': 'benchmarks'},
+      {'name': 'benchmarks', 'variant': 'extra'},
+      {'name': 'mjsunit_sp_frame_access'},
+      {'name': 'mozilla'},
+      {'name': 'mozilla', 'variant': 'extra'},
+      {'name': 'test262'},
+      {'name': 'test262_variants', 'variant': 'extra', 'shards': 3},
+      {'name': 'v8testing', 'shards': 3},
+      {'name': 'v8testing', 'variant': 'extra', 'shards': 2},
+      {'name': 'v8testing', 'variant': 'minor_mc', 'shards': 1},
+    ],
+  },
+  'v8_linux64_fyi_rel_ng_triggered': {
+    'tests': [
+      # Stress sampling.
+      {'name': 'mjsunit', 'variant': 'stress_sampling'},
+      {'name': 'webkit', 'variant': 'stress_sampling'},
+      # Infra staging.
+      {'name': 'test262_variants', 'variant': 'infra_staging', 'shards': 2},
+      {'name': 'v8testing', 'variant': 'infra_staging', 'shards': 2},
+    ],
+  },
+  'v8_linux64_msan_rel': {
+    'tests': [
+      {'name': 'test262', 'shards': 2},
+      {'name': 'v8testing', 'shards': 5},
+    ],
+  },
+  'v8_linux64_rel_ng_triggered': {
+    'swarming_dimensions' : {
+      'cpu': 'x86-64-avx2',
+    },
+    'tests': [
+      # TODO(machenbach): Add benchmarks.
+      # TODO(machenbach): Add mozilla tests.
+      {'name': 'mjsunit_sp_frame_access'},
+      {'name': 'optimize_for_size'},
+      {'name': 'test262_variants', 'shards': 4},
+      {'name': 'test262_variants', 'variant': 'extra', 'shards': 2},
+      {'name': 'v8initializers'},
+      {'name': 'v8testing'},
+      {'name': 'v8testing', 'variant': 'extra'},
+      {'name': 'v8testing', 'variant': 'minor_mc'},
+      {'name': 'v8testing', 'variant': 'slow_path'},
+    ],
+  },
+  'v8_linux64_tsan_rel': {
+    'tests': [
+      {'name': 'benchmarks'},
+      {'name': 'mozilla'},
+      {'name': 'test262', 'shards': 3},
+      {'name': 'v8testing', 'shards': 5},
+      {'name': 'v8testing', 'variant': 'extra', 'shards': 3},
+      {'name': 'v8testing', 'variant': 'slow_path'},
+    ],
+  },
+  'v8_linux64_ubsan_rel_ng_triggered': {
+    'tests': [
+      {'name': 'v8testing', 'shards': 2},
+    ],
+  },
+  'v8_linux64_verify_csa_rel_ng_triggered': {
+    'tests': [
+      {'name': 'v8testing'},
+    ],
+  },
+  ##############################################################################
+  # Linux64 with arm64 simulators
+  'v8_linux_arm64_dbg': {
+    'tests': [
+      {'name': 'mjsunit_sp_frame_access'},
+      {'name': 'mozilla'},
+      {'name': 'test262'},
+      {'name': 'v8testing', 'shards': 7},
+      {'name': 'v8testing', 'variant': 'extra', 'shards': 3},
+    ],
+  },
+  'v8_linux_arm64_gc_stress_dbg': {
+    'tests': [
+      {'name': 'd8testing', 'test_args': ['--gc-stress'], 'shards': 8},
+    ],
+  },
+  'v8_linux_arm64_rel_ng_triggered': {
+    'tests': [
+      {'name': 'mjsunit_sp_frame_access'},
+      {'name': 'mozilla'},
+      {'name': 'test262'},
+      {'name': 'v8testing', 'shards': 9},
+      {'name': 'v8testing', 'variant': 'extra', 'shards': 3},
+    ],
+  },
+  ##############################################################################
+  # Win32
+  'v8_win_dbg': {
+    'swarming_dimensions' : {
+      'cpu': 'x86-64',
+      'os': 'Windows-7-SP1',
+    },
+    'tests': [
+      {'name': 'mozilla'},
+      {'name': 'v8testing', 'shards': 3},
+    ],
+  },
+  'v8_win_nosnap_shared_rel_ng_triggered': {
+    'swarming_dimensions' : {
+      'cpu': 'x86-64',
+      'os': 'Windows-7-SP1',
+    },
+    'tests': [
+      {'name': 'v8testing', 'variant': 'default', 'shards': 3},
+    ],
+  },
+  'v8_win_rel_ng_triggered': {
+    'swarming_dimensions' : {
+      'cpu': 'x86-64',
+      'os': 'Windows-7-SP1',
+    },
+    'tests': [
+      {'name': 'test262'},
+      {'name': 'v8testing'},
+    ],
+  },
+  ##############################################################################
+  # Win64
+  'v8_win64_asan_rel_ng_triggered': {
+    'swarming_dimensions' : {
+      'os': 'Windows-10',
+    },
+    'tests': [
+      {'name': 'v8testing', 'shards': 5},
+    ],
+  },
+  'v8_win64_dbg': {
+    'swarming_dimensions' : {
+      'cpu': 'x86-64',
+      'os': 'Windows-7-SP1',
+    },
+    'tests': [
+      {'name': 'mozilla'},
+      {'name': 'test262', 'shards': 2},
+      {'name': 'v8testing', 'shards': 3},
+      {'name': 'v8testing', 'variant': 'extra', 'shards': 2},
+    ],
+  },
+  'v8_win64_msvc_rel_ng_triggered': {
+    'swarming_dimensions' : {
+      'cpu': 'x86-64',
+      'os': 'Windows-7-SP1',
+    },
+    'tests': [
+      {'name': 'mozilla'},
+      {'name': 'test262'},
+      {'name': 'v8testing'},
+    ],
+  },
+  'v8_win64_rel_ng_triggered': {
+    'swarming_dimensions' : {
+      'cpu': 'x86-64',
+      'os': 'Windows-7-SP1',
+    },
+    'tests': [
+      {'name': 'test262'},
+      {'name': 'v8testing'},
+      {'name': 'v8testing', 'variant': 'extra'},
+    ],
+  },
+  ##############################################################################
+  # Mac64
+  'v8_mac64_asan_rel': {
+    'swarming_dimensions' : {
+      'cpu': 'x86-64',
+      'os': 'Mac-10.13',
+    },
+    'tests': [
+      {'name': 'v8testing', 'shards': 4},
+    ],
+  },
+  'v8_mac64_dbg_ng_triggered': {
+    'swarming_dimensions' : {
+      'cpu': 'x86-64',
+      'os': 'Mac-10.13',
+    },
+    'tests': [
+      {'name': 'mozilla'},
+      {'name': 'test262'},
+      {'name': 'v8testing', 'shards': 3},
+      {'name': 'v8testing', 'variant': 'extra', 'shards': 2},
+    ],
+  },
+  'v8_mac64_gc_stress_dbg': {
+    'swarming_dimensions' : {
+      'cpu': 'x86-64',
+      'os': 'Mac-10.13',
+    },
+    'tests': [
+      {'name': 'd8testing', 'test_args': ['--gc-stress'], 'shards': 4},
+    ],
+  },
+  'v8_mac64_rel_ng_triggered': {
+    'swarming_dimensions' : {
+      'cpu': 'x86-64',
+      'os': 'Mac-10.13',
+    },
+    'tests': [
+      {'name': 'mozilla'},
+      {'name': 'test262'},
+      {'name': 'v8testing'},
+      {'name': 'v8testing', 'variant': 'extra'},
+    ],
+  },
+  ##############################################################################
+  ### luci.v8.ci
+  ##############################################################################
+  # Linux32
+  'V8 Linux - debug': {
+    'tests': [
+      {'name': 'benchmarks', 'variant': 'code_serializer', 'shards': 1},
+      {'name': 'd8testing', 'variant': 'code_serializer', 'shards': 1},
+      {'name': 'mozilla', 'variant': 'code_serializer', 'shards': 1},
+      {'name': 'test262_variants', 'variant': 'code_serializer', 'shards': 1},
+    ],
+  },
+  'V8 Linux - gc stress': {
+    'tests': [
+      {'name': 'mjsunit', 'variant': 'slow_path', 'shards': 2},
+    ],
+  },
+  ##############################################################################
+  # Linux64
+  'V8 Linux64': {
+    'tests': [
+      {'name': 'v8testing', 'variant': 'minor_mc', 'shards': 1},
+    ],
+  },
+  'V8 Linux64 - debug': {
+    'tests': [
+      {'name': 'v8testing', 'variant': 'minor_mc', 'shards': 1},
+      {'name': 'v8testing', 'variant': 'slow_path', 'shards': 1},
+    ],
+  },
+  'V8 Linux64 - debug - fyi': {
+    'tests': [
+      # Infra staging.
+      {'name': 'test262_variants', 'variant': 'infra_staging', 'shards': 3},
+      {'name': 'v8testing', 'variant': 'infra_staging', 'shards': 2},
+      # Stress sampling.
+      {'name': 'mjsunit', 'variant': 'stress_sampling', 'shards': 1},
+      {'name': 'webkit', 'variant': 'stress_sampling', 'shards': 1},
+    ],
+  },
+  'V8 Linux64 - fyi': {
+    'tests': [
+      {'name': 'mjsunit', 'variant': 'stress_sampling', 'shards': 1},
+      {'name': 'test262_variants', 'variant': 'infra_staging', 'shards': 2},
+      {'name': 'v8testing', 'variant': 'infra_staging', 'shards': 1},
+      {'name': 'webkit', 'variant': 'stress_sampling', 'shards': 1},
+    ],
+  },
+  'V8 Linux64 ASAN': {
+    'tests': [
+      {'name': 'v8testing', 'variant': 'slow_path', 'shards': 1},
+    ],
+  },
+  'V8 Linux64 TSAN': {
+    'tests': [
+      {'name': 'v8testing', 'variant': 'slow_path', 'shards': 1},
+    ],
+  },
+}
diff --git a/deps/v8/infra/testing/client.v8.pyl b/deps/v8/infra/testing/client.v8.pyl
deleted file mode 100644
index ab1744fc78b33e..00000000000000
--- a/deps/v8/infra/testing/client.v8.pyl
+++ /dev/null
@@ -1,48 +0,0 @@
-# Copyright 2017 The V8 project authors. All rights reserved.
-# Use of this source code is governed by a BSD-style license that can be
-# found in the LICENSE file.
-
-{
-  ### Example configuration for CI bots (please keep as reference).
-  # 'V8 Linux64': [
-  #   {'name': 'benchmarks', 'variant': 'default', 'shards': 1},
-  # ],
-  # 'V8 Linux64 - debug': [
-  #   {'name': 'benchmarks', 'variant': 'default', 'shards': 1},
-  # ],
-
-  'V8 Linux - debug': [
-    {'name': 'd8testing', 'variant': 'code_serializer', 'shards': 1},
-    {'name': 'mozilla', 'variant': 'code_serializer', 'shards': 1},
-    {'name': 'test262_variants', 'variant': 'code_serializer', 'shards': 1},
-    {'name': 'benchmarks', 'variant': 'code_serializer', 'shards': 1},
-  ],
-  'V8 Linux - gc stress': [
-    {'name': 'mjsunit', 'variant': 'slow_path', 'shards': 2},
-  ],
-  'V8 Linux64': [
-    {'name': 'v8testing', 'variant': 'minor_mc', 'shards': 1},
-  ],
-  'V8 Linux64 - debug': [
-    {'name': 'v8testing', 'variant': 'minor_mc', 'shards': 1},
-    {'name': 'v8testing', 'variant': 'slow_path', 'shards': 1},
-  ],
-  'V8 Linux64 ASAN': [
-    {'name': 'v8testing', 'variant': 'slow_path', 'shards': 1},
-  ],
-  'V8 Linux64 TSAN': [
-    {'name': 'v8testing', 'variant': 'slow_path', 'shards': 1},
-  ],
-  'V8 Linux64 - fyi': [
-    {'name': 'v8testing', 'variant': 'infra_staging', 'shards': 1},
-    {'name': 'test262_variants', 'variant': 'infra_staging', 'shards': 2},
-    {'name': 'mjsunit', 'variant': 'stress_sampling', 'shards': 1},
-    {'name': 'webkit', 'variant': 'stress_sampling', 'shards': 1},
-  ],
-  'V8 Linux64 - debug - fyi': [
-    {'name': 'v8testing', 'variant': 'infra_staging', 'shards': 2},
-    {'name': 'test262_variants', 'variant': 'infra_staging', 'shards': 3},
-    {'name': 'mjsunit', 'variant': 'stress_sampling', 'shards': 1},
-    {'name': 'webkit', 'variant': 'stress_sampling', 'shards': 1},
-  ],
-}
diff --git a/deps/v8/infra/testing/tryserver.v8.pyl b/deps/v8/infra/testing/tryserver.v8.pyl
deleted file mode 100644
index ee6abae5d533d3..00000000000000
--- a/deps/v8/infra/testing/tryserver.v8.pyl
+++ /dev/null
@@ -1,30 +0,0 @@
-# Copyright 2017 The V8 project authors. All rights reserved.
-# Use of this source code is governed by a BSD-style license that can be
-# found in the LICENSE file.
-
-{
-  ### Example configuration for trybots (please keep as reference).
-  # 'v8_linux64_rel_ng_triggered': [
-  #   {'name': 'benchmarks', 'variant': 'default', 'shards': 1},
-  # ],
-
-  'v8_linux64_fyi_rel_ng_triggered': [
-    {'name': 'v8testing', 'variant': 'infra_staging', 'shards': 2},
-    {'name': 'test262_variants', 'variant': 'infra_staging', 'shards': 2},
-    {'name': 'mjsunit', 'variant': 'stress_sampling', 'shards': 1},
-    {'name': 'webkit', 'variant': 'stress_sampling', 'shards': 1},
-  ],
-  'v8_linux64_rel_ng_triggered': [
-    {'name': 'v8testing', 'variant': 'minor_mc', 'shards': 1},
-    {'name': 'v8testing', 'variant': 'slow_path', 'shards': 1},
-  ],
-  'v8_linux_gc_stress_dbg': [
-    {'name': 'mjsunit', 'variant': 'slow_path', 'shards': 2},
-  ],
-  'v8_linux64_asan_rel_ng_triggered': [
-    {'name': 'v8testing', 'variant': 'slow_path', 'shards': 1},
-  ],
-  'v8_linux64_tsan_rel': [
-    {'name': 'v8testing', 'variant': 'slow_path', 'shards': 1},
-  ],
-}
diff --git a/deps/v8/samples/hello-world.cc b/deps/v8/samples/hello-world.cc
index ab6f0dd8bf67ee..d75dcb3c3cc4ef 100644
--- a/deps/v8/samples/hello-world.cc
+++ b/deps/v8/samples/hello-world.cc
@@ -34,22 +34,63 @@ int main(int argc, char* argv[]) {
     // Enter the context for compiling and running the hello world script.
     v8::Context::Scope context_scope(context);
 
-    // Create a string containing the JavaScript source code.
-    v8::Local<v8::String> source =
-        v8::String::NewFromUtf8(isolate, "'Hello' + ', World!'",
-                                v8::NewStringType::kNormal)
-            .ToLocalChecked();
-
-    // Compile the source code.
-    v8::Local<v8::Script> script =
-        v8::Script::Compile(context, source).ToLocalChecked();
-
-    // Run the script to get the result.
-    v8::Local<v8::Value> result = script->Run(context).ToLocalChecked();
-
-    // Convert the result to an UTF8 string and print it.
-    v8::String::Utf8Value utf8(isolate, result);
-    printf("%s\n", *utf8);
+    {
+      // Create a string containing the JavaScript source code.
+      v8::Local<v8::String> source =
+          v8::String::NewFromUtf8(isolate, "'Hello' + ', World!'",
+                                  v8::NewStringType::kNormal)
+              .ToLocalChecked();
+
+      // Compile the source code.
+      v8::Local<v8::Script> script =
+          v8::Script::Compile(context, source).ToLocalChecked();
+
+      // Run the script to get the result.
+      v8::Local<v8::Value> result = script->Run(context).ToLocalChecked();
+
+      // Convert the result to an UTF8 string and print it.
+      v8::String::Utf8Value utf8(isolate, result);
+      printf("%s\n", *utf8);
+    }
+
+    {
+      // Use the JavaScript API to generate a WebAssembly module.
+      //
+      // |bytes| contains the binary format for the following module:
+      //
+      //     (func (export "add") (param i32 i32) (result i32)
+      //       get_local 0
+      //       get_local 1
+      //       i32.add)
+      //
+      const char* csource = R"(
+        let bytes = new Uint8Array([
+          0x00, 0x61, 0x73, 0x6d, 0x01, 0x00, 0x00, 0x00, 0x01, 0x07, 0x01,
+          0x60, 0x02, 0x7f, 0x7f, 0x01, 0x7f, 0x03, 0x02, 0x01, 0x00, 0x07,
+          0x07, 0x01, 0x03, 0x61, 0x64, 0x64, 0x00, 0x00, 0x0a, 0x09, 0x01,
+          0x07, 0x00, 0x20, 0x00, 0x20, 0x01, 0x6a, 0x0b
+        ]);
+        let module = new WebAssembly.Module(bytes);
+        let instance = new WebAssembly.Instance(module);
+        instance.exports.add(3, 4);
+      )";
+
+      // Create a string containing the JavaScript source code.
+      v8::Local<v8::String> source =
+          v8::String::NewFromUtf8(isolate, csource, v8::NewStringType::kNormal)
+              .ToLocalChecked();
+
+      // Compile the source code.
+      v8::Local<v8::Script> script =
+          v8::Script::Compile(context, source).ToLocalChecked();
+
+      // Run the script to get the result.
+      v8::Local<v8::Value> result = script->Run(context).ToLocalChecked();
+
+      // Convert the result to a uint32 and print it.
+      uint32_t number = result->Uint32Value(context).ToChecked();
+      printf("3 + 4 = %u\n", number);
+    }
   }
 
   // Dispose the isolate and tear down V8.
diff --git a/deps/v8/src/DEPS b/deps/v8/src/DEPS
index 050f91d6d6d990..275595d0d80481 100644
--- a/deps/v8/src/DEPS
+++ b/deps/v8/src/DEPS
@@ -27,7 +27,8 @@ include_rules = [
   "+src/trap-handler/trap-handler.h",
   "+testing/gtest/include/gtest/gtest_prod.h",
   "-src/libplatform",
-  "-include/libplatform"
+  "-include/libplatform",
+  "+torque-generated"
 ]
 
 specific_include_rules = {
diff --git a/deps/v8/src/accessors.cc b/deps/v8/src/accessors.cc
index f292988b8e1e5d..9057865ac3b564 100644
--- a/deps/v8/src/accessors.cc
+++ b/deps/v8/src/accessors.cc
@@ -12,6 +12,8 @@
 #include "src/heap/factory.h"
 #include "src/isolate-inl.h"
 #include "src/messages.h"
+#include "src/objects/api-callbacks.h"
+#include "src/objects/module-inl.h"
 #include "src/property-details.h"
 #include "src/prototype.h"
 
@@ -37,18 +39,18 @@ Handle<AccessorInfo> Accessors::MakeAccessor(
   info->set_getter(*get);
   info->set_setter(*set);
   Address redirected = info->redirected_getter();
-  if (redirected != nullptr) {
+  if (redirected != kNullAddress) {
     Handle<Object> js_get = v8::FromCData(isolate, redirected);
     info->set_js_getter(*js_get);
   }
   return info;
 }
 
-static V8_INLINE bool CheckForName(Handle<Name> name,
+static V8_INLINE bool CheckForName(Isolate* isolate, Handle<Name> name,
                                    Handle<String> property_name, int offset,
                                    FieldIndex::Encoding encoding,
                                    FieldIndex* index) {
-  if (Name::Equals(name, property_name)) {
+  if (Name::Equals(isolate, name, property_name)) {
     *index = FieldIndex::ForInObjectOffset(offset, encoding);
     return true;
   }
@@ -58,17 +60,15 @@ static V8_INLINE bool CheckForName(Handle<Name> name,
 
 // Returns true for properties that are accessors to object fields.
 // If true, *object_offset contains offset of object field.
-bool Accessors::IsJSObjectFieldAccessor(Handle<Map> map, Handle<Name> name,
-                                        FieldIndex* index) {
-  Isolate* isolate = name->GetIsolate();
-
+bool Accessors::IsJSObjectFieldAccessor(Isolate* isolate, Handle<Map> map,
+                                        Handle<Name> name, FieldIndex* index) {
   switch (map->instance_type()) {
     case JS_ARRAY_TYPE:
-      return CheckForName(name, isolate->factory()->length_string(),
+      return CheckForName(isolate, name, isolate->factory()->length_string(),
                           JSArray::kLengthOffset, FieldIndex::kTagged, index);
     default:
       if (map->instance_type() < FIRST_NONSTRING_TYPE) {
-        return CheckForName(name, isolate->factory()->length_string(),
+        return CheckForName(isolate, name, isolate->factory()->length_string(),
                             String::kLengthOffset, FieldIndex::kTagged, index);
       }
 
@@ -76,12 +76,12 @@ bool Accessors::IsJSObjectFieldAccessor(Handle<Map> map, Handle<Name> name,
   }
 }
 
-
-namespace {
-
-V8_WARN_UNUSED_RESULT MaybeHandle<Object> ReplaceAccessorWithDataProperty(
-    Isolate* isolate, Handle<Object> receiver, Handle<JSObject> holder,
-    Handle<Name> name, Handle<Object> value) {
+V8_WARN_UNUSED_RESULT MaybeHandle<Object>
+Accessors::ReplaceAccessorWithDataProperty(Isolate* isolate,
+                                           Handle<Object> receiver,
+                                           Handle<JSObject> holder,
+                                           Handle<Name> name,
+                                           Handle<Object> value) {
   LookupIterator it(receiver, name, holder,
                     LookupIterator::OWN_SKIP_INTERCEPTOR);
   // Skip any access checks we might hit. This accessor should never hit in a
@@ -96,7 +96,6 @@ V8_WARN_UNUSED_RESULT MaybeHandle<Object> ReplaceAccessorWithDataProperty(
   return value;
 }
 
-}  // namespace
 
 //
 // Accessors::ReconfigureToDataProperty
@@ -113,8 +112,8 @@ void Accessors::ReconfigureToDataProperty(
       Handle<JSObject>::cast(Utils::OpenHandle(*info.Holder()));
   Handle<Name> name = Utils::OpenHandle(*key);
   Handle<Object> value = Utils::OpenHandle(*val);
-  MaybeHandle<Object> result =
-      ReplaceAccessorWithDataProperty(isolate, receiver, holder, name, value);
+  MaybeHandle<Object> result = Accessors::ReplaceAccessorWithDataProperty(
+      isolate, receiver, holder, name, value);
   if (result.is_null()) {
     isolate->OptionalRescheduleException(false);
   } else {
@@ -122,17 +121,6 @@ void Accessors::ReconfigureToDataProperty(
   }
 }
 
-void Accessors::ReconfigureToDataPropertyGetter(
-    v8::Local<v8::Name> name, const v8::PropertyCallbackInfo<v8::Value>& info) {
-  UNREACHABLE();
-}
-
-Handle<AccessorInfo> Accessors::MakeReconfigureToDataPropertyInfo(
-    Isolate* isolate) {
-  Handle<Name> name = isolate->factory()->ReconfigureToDataProperty_string();
-  return MakeAccessor(isolate, name, &ReconfigureToDataPropertyGetter,
-                      &ReconfigureToDataProperty);
-}
 
 //
 // Accessors::ArgumentsIterator
@@ -180,7 +168,8 @@ void Accessors::ArrayLengthSetter(
                               RuntimeCallCounterId::kArrayLengthSetter);
   HandleScope scope(isolate);
 
-  DCHECK(Utils::OpenHandle(*name)->SameValue(isolate->heap()->length_string()));
+  DCHECK(Utils::OpenHandle(*name)->SameValue(
+      ReadOnlyRoots(isolate).length_string()));
 
   Handle<JSReceiver> object = Utils::OpenHandle(*info.Holder());
   Handle<JSArray> array = Handle<JSArray>::cast(object);
@@ -248,7 +237,8 @@ void Accessors::ModuleNamespaceEntryGetter(
   JSModuleNamespace* holder =
       JSModuleNamespace::cast(*Utils::OpenHandle(*info.Holder()));
   Handle<Object> result;
-  if (!holder->GetExport(Handle<String>::cast(Utils::OpenHandle(*name)))
+  if (!holder
+           ->GetExport(isolate, Handle<String>::cast(Utils::OpenHandle(*name)))
            .ToHandle(&result)) {
     isolate->OptionalRescheduleException(false);
   } else {
@@ -315,333 +305,6 @@ Handle<AccessorInfo> Accessors::MakeStringLengthInfo(Isolate* isolate) {
                       &StringLengthGetter, nullptr);
 }
 
-//
-// Accessors::ScriptColumnOffset
-//
-
-
-void Accessors::ScriptColumnOffsetGetter(
-    v8::Local<v8::Name> name,
-    const v8::PropertyCallbackInfo<v8::Value>& info) {
-  i::Isolate* isolate = reinterpret_cast<i::Isolate*>(info.GetIsolate());
-  DisallowHeapAllocation no_allocation;
-  HandleScope scope(isolate);
-  Object* object = *Utils::OpenHandle(*info.Holder());
-  Object* res = Smi::FromInt(
-      Script::cast(JSValue::cast(object)->value())->column_offset());
-  info.GetReturnValue().Set(Utils::ToLocal(Handle<Object>(res, isolate)));
-}
-
-Handle<AccessorInfo> Accessors::MakeScriptColumnOffsetInfo(Isolate* isolate) {
-  Handle<String> name(isolate->factory()->InternalizeOneByteString(
-      STATIC_CHAR_VECTOR("column_offset")));
-  return MakeAccessor(isolate, name, &ScriptColumnOffsetGetter, nullptr);
-}
-
-
-//
-// Accessors::ScriptId
-//
-
-
-void Accessors::ScriptIdGetter(
-    v8::Local<v8::Name> name,
-    const v8::PropertyCallbackInfo<v8::Value>& info) {
-  i::Isolate* isolate = reinterpret_cast<i::Isolate*>(info.GetIsolate());
-  DisallowHeapAllocation no_allocation;
-  HandleScope scope(isolate);
-  Object* object = *Utils::OpenHandle(*info.Holder());
-  Object* id = Smi::FromInt(Script::cast(JSValue::cast(object)->value())->id());
-  info.GetReturnValue().Set(Utils::ToLocal(Handle<Object>(id, isolate)));
-}
-
-Handle<AccessorInfo> Accessors::MakeScriptIdInfo(Isolate* isolate) {
-  Handle<String> name(
-      isolate->factory()->InternalizeOneByteString(STATIC_CHAR_VECTOR("id")));
-  return MakeAccessor(isolate, name, &ScriptIdGetter, nullptr);
-}
-
-
-//
-// Accessors::ScriptName
-//
-
-
-void Accessors::ScriptNameGetter(
-    v8::Local<v8::Name> name,
-    const v8::PropertyCallbackInfo<v8::Value>& info) {
-  i::Isolate* isolate = reinterpret_cast<i::Isolate*>(info.GetIsolate());
-  DisallowHeapAllocation no_allocation;
-  HandleScope scope(isolate);
-  Object* object = *Utils::OpenHandle(*info.Holder());
-  Object* source = Script::cast(JSValue::cast(object)->value())->name();
-  info.GetReturnValue().Set(Utils::ToLocal(Handle<Object>(source, isolate)));
-}
-
-Handle<AccessorInfo> Accessors::MakeScriptNameInfo(Isolate* isolate) {
-  return MakeAccessor(isolate, isolate->factory()->name_string(),
-                      &ScriptNameGetter, nullptr);
-}
-
-
-//
-// Accessors::ScriptSource
-//
-
-
-void Accessors::ScriptSourceGetter(
-    v8::Local<v8::Name> name,
-    const v8::PropertyCallbackInfo<v8::Value>& info) {
-  i::Isolate* isolate = reinterpret_cast<i::Isolate*>(info.GetIsolate());
-  DisallowHeapAllocation no_allocation;
-  HandleScope scope(isolate);
-  Object* object = *Utils::OpenHandle(*info.Holder());
-  Object* source = Script::cast(JSValue::cast(object)->value())->source();
-  info.GetReturnValue().Set(Utils::ToLocal(Handle<Object>(source, isolate)));
-}
-
-Handle<AccessorInfo> Accessors::MakeScriptSourceInfo(Isolate* isolate) {
-  return MakeAccessor(isolate, isolate->factory()->source_string(),
-                      &ScriptSourceGetter, nullptr);
-}
-
-
-//
-// Accessors::ScriptLineOffset
-//
-
-
-void Accessors::ScriptLineOffsetGetter(
-    v8::Local<v8::Name> name,
-    const v8::PropertyCallbackInfo<v8::Value>& info) {
-  i::Isolate* isolate = reinterpret_cast<i::Isolate*>(info.GetIsolate());
-  DisallowHeapAllocation no_allocation;
-  HandleScope scope(isolate);
-  Object* object = *Utils::OpenHandle(*info.Holder());
-  Object* res =
-      Smi::FromInt(Script::cast(JSValue::cast(object)->value())->line_offset());
-  info.GetReturnValue().Set(Utils::ToLocal(Handle<Object>(res, isolate)));
-}
-
-Handle<AccessorInfo> Accessors::MakeScriptLineOffsetInfo(Isolate* isolate) {
-  Handle<String> name(isolate->factory()->InternalizeOneByteString(
-      STATIC_CHAR_VECTOR("line_offset")));
-  return MakeAccessor(isolate, name, &ScriptLineOffsetGetter, nullptr);
-}
-
-
-//
-// Accessors::ScriptType
-//
-
-
-void Accessors::ScriptTypeGetter(
-    v8::Local<v8::Name> name,
-    const v8::PropertyCallbackInfo<v8::Value>& info) {
-  i::Isolate* isolate = reinterpret_cast<i::Isolate*>(info.GetIsolate());
-  DisallowHeapAllocation no_allocation;
-  HandleScope scope(isolate);
-  Object* object = *Utils::OpenHandle(*info.Holder());
-  Object* res =
-      Smi::FromInt(Script::cast(JSValue::cast(object)->value())->type());
-  info.GetReturnValue().Set(Utils::ToLocal(Handle<Object>(res, isolate)));
-}
-
-Handle<AccessorInfo> Accessors::MakeScriptTypeInfo(Isolate* isolate) {
-  Handle<String> name(
-      isolate->factory()->InternalizeOneByteString(STATIC_CHAR_VECTOR("type")));
-  return MakeAccessor(isolate, name, &ScriptTypeGetter, nullptr);
-}
-
-
-//
-// Accessors::ScriptCompilationType
-//
-
-
-void Accessors::ScriptCompilationTypeGetter(
-    v8::Local<v8::Name> name,
-    const v8::PropertyCallbackInfo<v8::Value>& info) {
-  i::Isolate* isolate = reinterpret_cast<i::Isolate*>(info.GetIsolate());
-  DisallowHeapAllocation no_allocation;
-  HandleScope scope(isolate);
-  Object* object = *Utils::OpenHandle(*info.Holder());
-  Object* res = Smi::FromInt(
-      Script::cast(JSValue::cast(object)->value())->compilation_type());
-  info.GetReturnValue().Set(Utils::ToLocal(Handle<Object>(res, isolate)));
-}
-
-Handle<AccessorInfo> Accessors::MakeScriptCompilationTypeInfo(
-    Isolate* isolate) {
-  Handle<String> name(isolate->factory()->InternalizeOneByteString(
-      STATIC_CHAR_VECTOR("compilation_type")));
-  return MakeAccessor(isolate, name, &ScriptCompilationTypeGetter, nullptr);
-}
-
-
-//
-// Accessors::ScriptSourceUrl
-//
-
-
-void Accessors::ScriptSourceUrlGetter(
-    v8::Local<v8::Name> name,
-    const v8::PropertyCallbackInfo<v8::Value>& info) {
-  i::Isolate* isolate = reinterpret_cast<i::Isolate*>(info.GetIsolate());
-  DisallowHeapAllocation no_allocation;
-  HandleScope scope(isolate);
-  Object* object = *Utils::OpenHandle(*info.Holder());
-  Object* url = Script::cast(JSValue::cast(object)->value())->source_url();
-  info.GetReturnValue().Set(Utils::ToLocal(Handle<Object>(url, isolate)));
-}
-
-Handle<AccessorInfo> Accessors::MakeScriptSourceUrlInfo(Isolate* isolate) {
-  Handle<String> name(isolate->factory()->InternalizeOneByteString(
-      STATIC_CHAR_VECTOR("source_url")));
-  return MakeAccessor(isolate, name, &ScriptSourceUrlGetter, nullptr);
-}
-
-
-//
-// Accessors::ScriptSourceMappingUrl
-//
-
-
-void Accessors::ScriptSourceMappingUrlGetter(
-    v8::Local<v8::Name> name,
-    const v8::PropertyCallbackInfo<v8::Value>& info) {
-  i::Isolate* isolate = reinterpret_cast<i::Isolate*>(info.GetIsolate());
-  DisallowHeapAllocation no_allocation;
-  HandleScope scope(isolate);
-  Object* object = *Utils::OpenHandle(*info.Holder());
-  Object* url =
-      Script::cast(JSValue::cast(object)->value())->source_mapping_url();
-  info.GetReturnValue().Set(Utils::ToLocal(Handle<Object>(url, isolate)));
-}
-
-Handle<AccessorInfo> Accessors::MakeScriptSourceMappingUrlInfo(
-    Isolate* isolate) {
-  Handle<String> name(isolate->factory()->InternalizeOneByteString(
-      STATIC_CHAR_VECTOR("source_mapping_url")));
-  return MakeAccessor(isolate, name, &ScriptSourceMappingUrlGetter, nullptr);
-}
-
-
-//
-// Accessors::ScriptGetContextData
-//
-
-
-void Accessors::ScriptContextDataGetter(
-    v8::Local<v8::Name> name,
-    const v8::PropertyCallbackInfo<v8::Value>& info) {
-  i::Isolate* isolate = reinterpret_cast<i::Isolate*>(info.GetIsolate());
-  DisallowHeapAllocation no_allocation;
-  HandleScope scope(isolate);
-  Object* object = *Utils::OpenHandle(*info.Holder());
-  Object* res = Script::cast(JSValue::cast(object)->value())->context_data();
-  info.GetReturnValue().Set(Utils::ToLocal(Handle<Object>(res, isolate)));
-}
-
-Handle<AccessorInfo> Accessors::MakeScriptContextDataInfo(Isolate* isolate) {
-  Handle<String> name(isolate->factory()->InternalizeOneByteString(
-      STATIC_CHAR_VECTOR("context_data")));
-  return MakeAccessor(isolate, name, &ScriptContextDataGetter, nullptr);
-}
-
-
-//
-// Accessors::ScriptGetEvalFromScript
-//
-
-
-void Accessors::ScriptEvalFromScriptGetter(
-    v8::Local<v8::Name> name,
-    const v8::PropertyCallbackInfo<v8::Value>& info) {
-  i::Isolate* isolate = reinterpret_cast<i::Isolate*>(info.GetIsolate());
-  HandleScope scope(isolate);
-  Handle<Object> object = Utils::OpenHandle(*info.Holder());
-  Handle<Script> script(
-      Script::cast(Handle<JSValue>::cast(object)->value()), isolate);
-  Handle<Object> result = isolate->factory()->undefined_value();
-  if (script->has_eval_from_shared()) {
-    Handle<SharedFunctionInfo> eval_from_shared(script->eval_from_shared());
-    if (eval_from_shared->script()->IsScript()) {
-      Handle<Script> eval_from_script(Script::cast(eval_from_shared->script()));
-      result = Script::GetWrapper(eval_from_script);
-    }
-  }
-
-  info.GetReturnValue().Set(Utils::ToLocal(result));
-}
-
-Handle<AccessorInfo> Accessors::MakeScriptEvalFromScriptInfo(Isolate* isolate) {
-  Handle<String> name(isolate->factory()->InternalizeOneByteString(
-      STATIC_CHAR_VECTOR("eval_from_script")));
-  return MakeAccessor(isolate, name, &ScriptEvalFromScriptGetter, nullptr);
-}
-
-
-//
-// Accessors::ScriptGetEvalFromScriptPosition
-//
-
-
-void Accessors::ScriptEvalFromScriptPositionGetter(
-    v8::Local<v8::Name> name,
-    const v8::PropertyCallbackInfo<v8::Value>& info) {
-  i::Isolate* isolate = reinterpret_cast<i::Isolate*>(info.GetIsolate());
-  HandleScope scope(isolate);
-  Handle<Object> object = Utils::OpenHandle(*info.Holder());
-  Handle<Script> script(
-      Script::cast(Handle<JSValue>::cast(object)->value()), isolate);
-  Handle<Object> result = isolate->factory()->undefined_value();
-  if (script->compilation_type() == Script::COMPILATION_TYPE_EVAL) {
-    result = Handle<Object>(Smi::FromInt(script->GetEvalPosition()), isolate);
-  }
-  info.GetReturnValue().Set(Utils::ToLocal(result));
-}
-
-Handle<AccessorInfo> Accessors::MakeScriptEvalFromScriptPositionInfo(
-    Isolate* isolate) {
-  Handle<String> name(isolate->factory()->InternalizeOneByteString(
-      STATIC_CHAR_VECTOR("eval_from_script_position")));
-  return MakeAccessor(isolate, name, &ScriptEvalFromScriptPositionGetter,
-                      nullptr);
-}
-
-
-//
-// Accessors::ScriptGetEvalFromFunctionName
-//
-
-
-void Accessors::ScriptEvalFromFunctionNameGetter(
-    v8::Local<v8::Name> name,
-    const v8::PropertyCallbackInfo<v8::Value>& info) {
-  i::Isolate* isolate = reinterpret_cast<i::Isolate*>(info.GetIsolate());
-  HandleScope scope(isolate);
-  Handle<Object> object = Utils::OpenHandle(*info.Holder());
-  Handle<Script> script(
-      Script::cast(Handle<JSValue>::cast(object)->value()), isolate);
-  Handle<Object> result = isolate->factory()->undefined_value();
-  if (script->has_eval_from_shared()) {
-    Handle<SharedFunctionInfo> shared(script->eval_from_shared());
-    // Find the name of the function calling eval.
-    result = Handle<Object>(shared->Name(), isolate);
-  }
-  info.GetReturnValue().Set(Utils::ToLocal(result));
-}
-
-Handle<AccessorInfo> Accessors::MakeScriptEvalFromFunctionNameInfo(
-    Isolate* isolate) {
-  Handle<String> name(isolate->factory()->InternalizeOneByteString(
-      STATIC_CHAR_VECTOR("eval_from_function_name")));
-  return MakeAccessor(isolate, name, &ScriptEvalFromFunctionNameGetter,
-                      nullptr);
-}
-
-
 //
 // Accessors::FunctionPrototype
 //
@@ -835,7 +498,7 @@ Handle<JSObject> GetFrameArguments(Isolate* isolate,
       // Generators currently use holes as dummy arguments when resuming.  We
       // must not leak those.
       DCHECK(IsResumableFunction(function->shared()->kind()));
-      value = isolate->heap()->undefined_value();
+      value = ReadOnlyRoots(isolate).undefined_value();
     }
     array->set(i, value);
   }
@@ -1163,7 +826,7 @@ void Accessors::ErrorStackGetter(
   Handle<Object> stack_trace;
   Handle<Symbol> stack_trace_symbol = isolate->factory()->stack_trace_symbol();
   MaybeHandle<Object> maybe_stack_trace =
-      JSObject::GetProperty(holder, stack_trace_symbol);
+      JSObject::GetProperty(isolate, holder, stack_trace_symbol);
   if (!maybe_stack_trace.ToHandle(&stack_trace) ||
       stack_trace->IsUndefined(isolate)) {
     Handle<Object> result = isolate->factory()->undefined_value();
@@ -1194,15 +857,16 @@ void Accessors::ErrorStackGetter(
       Utils::OpenHandle(*v8::Local<v8::Value>(info.This()));
   Handle<Name> name = Utils::OpenHandle(*key);
   if (IsAccessor(receiver, name, holder)) {
-    result = ReplaceAccessorWithDataProperty(isolate, receiver, holder, name,
-                                             formatted_stack_trace);
+    result = Accessors::ReplaceAccessorWithDataProperty(
+        isolate, receiver, holder, name, formatted_stack_trace);
     if (result.is_null()) {
       isolate->OptionalRescheduleException(false);
       return;
     }
   } else {
     // The stack property has been modified in the meantime.
-    if (!JSObject::GetProperty(holder, name).ToHandle(&formatted_stack_trace)) {
+    if (!JSObject::GetProperty(isolate, holder, name)
+             .ToHandle(&formatted_stack_trace)) {
       isolate->OptionalRescheduleException(false);
       return;
     }
diff --git a/deps/v8/src/accessors.h b/deps/v8/src/accessors.h
index 1911f92dbf93dd..301f830a9aba2b 100644
--- a/deps/v8/src/accessors.h
+++ b/deps/v8/src/accessors.h
@@ -33,20 +33,6 @@ class JavaScriptFrame;
   V(function_name, FunctionName)                                    \
   V(function_length, FunctionLength)                                \
   V(function_prototype, FunctionPrototype)                          \
-  V(reconfigure_to_data_property, ReconfigureToDataProperty)        \
-  V(script_column_offset, ScriptColumnOffset)                       \
-  V(script_compilation_type, ScriptCompilationType)                 \
-  V(script_context_data, ScriptContextData)                         \
-  V(script_eval_from_script, ScriptEvalFromScript)                  \
-  V(script_eval_from_script_position, ScriptEvalFromScriptPosition) \
-  V(script_eval_from_function_name, ScriptEvalFromFunctionName)     \
-  V(script_id, ScriptId)                                            \
-  V(script_line_offset, ScriptLineOffset)                           \
-  V(script_name, ScriptName)                                        \
-  V(script_source, ScriptSource)                                    \
-  V(script_type, ScriptType)                                        \
-  V(script_source_url, ScriptSourceUrl)                             \
-  V(script_source_mapping_url, ScriptSourceMappingUrl)              \
   V(string_length, StringLength)
 
 #define SIDE_EFFECT_FREE_ACCESSOR_INFO_LIST(V) \
@@ -107,9 +93,14 @@ class Accessors : public AllStatic {
 
   // Returns true for properties that are accessors to object fields.
   // If true, the matching FieldIndex is returned through |field_index|.
-  static bool IsJSObjectFieldAccessor(Handle<Map> map, Handle<Name> name,
+  static bool IsJSObjectFieldAccessor(Isolate* isolate, Handle<Map> map,
+                                      Handle<Name> name,
                                       FieldIndex* field_index);
 
+  static MaybeHandle<Object> ReplaceAccessorWithDataProperty(
+      Isolate* isolate, Handle<Object> receiver, Handle<JSObject> holder,
+      Handle<Name> name, Handle<Object> value);
+
   // Create an AccessorInfo. The setter is optional (can be nullptr).
   //
   // Note that the type of setter is AccessorNameBooleanSetterCallback instead
diff --git a/deps/v8/src/address-map.h b/deps/v8/src/address-map.h
index e2b815daff0aba..599e44724ab1d9 100644
--- a/deps/v8/src/address-map.h
+++ b/deps/v8/src/address-map.h
@@ -34,13 +34,21 @@ class PointerToIndexHashMap
   }
 
  private:
-  static uintptr_t Key(Type value) {
-    return reinterpret_cast<uintptr_t>(value);
-  }
+  static inline uintptr_t Key(Type value);
 
   static uint32_t Hash(uintptr_t key) { return static_cast<uint32_t>(key); }
 };
 
+template <>
+inline uintptr_t PointerToIndexHashMap<Address>::Key(Address value) {
+  return static_cast<uintptr_t>(value);
+}
+
+template <typename Type>
+inline uintptr_t PointerToIndexHashMap<Type>::Key(Type value) {
+  return reinterpret_cast<uintptr_t>(value);
+}
+
 class AddressToIndexHashMap : public PointerToIndexHashMap<Address> {};
 class HeapObjectToIndexHashMap : public PointerToIndexHashMap<HeapObject*> {};
 
@@ -61,181 +69,6 @@ class RootIndexMap {
   DISALLOW_COPY_AND_ASSIGN(RootIndexMap);
 };
 
-class SerializerReference {
- public:
-  SerializerReference() : bitfield_(Special(kInvalidValue)) {}
-
-  static SerializerReference FromBitfield(uint32_t bitfield) {
-    return SerializerReference(bitfield);
-  }
-
-  static SerializerReference BackReference(AllocationSpace space,
-                                           uint32_t chunk_index,
-                                           uint32_t chunk_offset) {
-    DCHECK(IsAligned(chunk_offset, kObjectAlignment));
-    DCHECK_NE(LO_SPACE, space);
-    return SerializerReference(
-        SpaceBits::encode(space) | ChunkIndexBits::encode(chunk_index) |
-        ChunkOffsetBits::encode(chunk_offset >> kObjectAlignmentBits));
-  }
-
-  static SerializerReference MapReference(uint32_t index) {
-    return SerializerReference(SpaceBits::encode(MAP_SPACE) |
-                               ValueIndexBits::encode(index));
-  }
-
-  static SerializerReference OffHeapBackingStoreReference(uint32_t index) {
-    return SerializerReference(SpaceBits::encode(kExternalSpace) |
-                               ValueIndexBits::encode(index));
-  }
-
-  static SerializerReference LargeObjectReference(uint32_t index) {
-    return SerializerReference(SpaceBits::encode(LO_SPACE) |
-                               ValueIndexBits::encode(index));
-  }
-
-  static SerializerReference AttachedReference(uint32_t index) {
-    return SerializerReference(SpaceBits::encode(kAttachedReferenceSpace) |
-                               ValueIndexBits::encode(index));
-  }
-
-  static SerializerReference DummyReference() {
-    return SerializerReference(Special(kDummyValue));
-  }
-
-  bool is_valid() const { return bitfield_ != Special(kInvalidValue); }
-
-  bool is_back_reference() const {
-    return SpaceBits::decode(bitfield_) <= LAST_SPACE;
-  }
-
-  AllocationSpace space() const {
-    DCHECK(is_back_reference());
-    return static_cast<AllocationSpace>(SpaceBits::decode(bitfield_));
-  }
-
-  uint32_t chunk_offset() const {
-    DCHECK(is_back_reference());
-    return ChunkOffsetBits::decode(bitfield_) << kObjectAlignmentBits;
-  }
-
-  uint32_t map_index() const {
-    DCHECK(is_back_reference());
-    return ValueIndexBits::decode(bitfield_);
-  }
-
-  bool is_off_heap_backing_store_reference() const {
-    return SpaceBits::decode(bitfield_) == kExternalSpace;
-  }
-
-  uint32_t off_heap_backing_store_index() const {
-    DCHECK(is_off_heap_backing_store_reference());
-    return ValueIndexBits::decode(bitfield_);
-  }
-
-  uint32_t large_object_index() const {
-    DCHECK(is_back_reference());
-    return ValueIndexBits::decode(bitfield_);
-  }
-
-  uint32_t chunk_index() const {
-    DCHECK(is_back_reference());
-    return ChunkIndexBits::decode(bitfield_);
-  }
-
-  uint32_t back_reference() const {
-    DCHECK(is_back_reference());
-    return bitfield_ & (ChunkOffsetBits::kMask | ChunkIndexBits::kMask);
-  }
-
-  bool is_attached_reference() const {
-    return SpaceBits::decode(bitfield_) == kAttachedReferenceSpace;
-  }
-
-  int attached_reference_index() const {
-    DCHECK(is_attached_reference());
-    return ValueIndexBits::decode(bitfield_);
-  }
-
- private:
-  explicit SerializerReference(uint32_t bitfield) : bitfield_(bitfield) {}
-
-  inline static uint32_t Special(int value) {
-    return SpaceBits::encode(kSpecialValueSpace) |
-           ValueIndexBits::encode(value);
-  }
-
-  // We use the 32-bit bitfield to encode either a back reference, a special
-  // value, or an attached reference index.
-  // Back reference:
-  //   [ Space index             ] [ Chunk index ] [ Chunk offset ]
-  //   [ LO_SPACE                ] [ large object index           ]
-  // Special value
-  //   [ kSpecialValueSpace      ] [ Special value index          ]
-  // Attached reference
-  //   [ kAttachedReferenceSpace ] [ Attached reference index     ]
-  // External
-  //   [ kExternalSpace          ] [ External reference index     ]
-
-  static const int kChunkOffsetSize = kPageSizeBits - kObjectAlignmentBits;
-  static const int kChunkIndexSize = 32 - kChunkOffsetSize - kSpaceTagSize;
-  static const int kValueIndexSize = kChunkOffsetSize + kChunkIndexSize;
-
-  static const int kSpecialValueSpace = LAST_SPACE + 1;
-  static const int kAttachedReferenceSpace = kSpecialValueSpace + 1;
-  static const int kExternalSpace = kAttachedReferenceSpace + 1;
-  STATIC_ASSERT(kExternalSpace < (1 << kSpaceTagSize));
-
-  static const int kInvalidValue = 0;
-  static const int kDummyValue = 1;
-
-  // The chunk offset can also be used to encode the index of special values.
-  class ChunkOffsetBits : public BitField<uint32_t, 0, kChunkOffsetSize> {};
-  class ChunkIndexBits
-      : public BitField<uint32_t, ChunkOffsetBits::kNext, kChunkIndexSize> {};
-  class ValueIndexBits : public BitField<uint32_t, 0, kValueIndexSize> {};
-  STATIC_ASSERT(ChunkIndexBits::kNext == ValueIndexBits::kNext);
-  class SpaceBits : public BitField<int, kValueIndexSize, kSpaceTagSize> {};
-  STATIC_ASSERT(SpaceBits::kNext == 32);
-
-  uint32_t bitfield_;
-
-  friend class SerializerReferenceMap;
-};
-
-// Mapping objects to their location after deserialization.
-// This is used during building, but not at runtime by V8.
-class SerializerReferenceMap {
- public:
-  SerializerReferenceMap()
-      : no_allocation_(), map_(), attached_reference_index_(0) {}
-
-  SerializerReference Lookup(void* obj) {
-    Maybe<uint32_t> maybe_index = map_.Get(obj);
-    return maybe_index.IsJust() ? SerializerReference(maybe_index.FromJust())
-                                : SerializerReference();
-  }
-
-  void Add(void* obj, SerializerReference b) {
-    DCHECK(b.is_valid());
-    DCHECK(map_.Get(obj).IsNothing());
-    map_.Set(obj, b.bitfield_);
-  }
-
-  SerializerReference AddAttachedReference(HeapObject* attached_reference) {
-    SerializerReference reference =
-        SerializerReference::AttachedReference(attached_reference_index_++);
-    Add(attached_reference, reference);
-    return reference;
-  }
-
- private:
-  DisallowHeapAllocation no_allocation_;
-  PointerToIndexHashMap<void*> map_;
-  int attached_reference_index_;
-  DISALLOW_COPY_AND_ASSIGN(SerializerReferenceMap);
-};
-
 }  // namespace internal
 }  // namespace v8
 
diff --git a/deps/v8/src/allocation.cc b/deps/v8/src/allocation.cc
index f63c2f292f5b00..55c68dea89482e 100644
--- a/deps/v8/src/allocation.cc
+++ b/deps/v8/src/allocation.cc
@@ -206,15 +206,15 @@ bool OnCriticalMemoryPressure(size_t length) {
   return true;
 }
 
-VirtualMemory::VirtualMemory() : address_(nullptr), size_(0) {}
+VirtualMemory::VirtualMemory() : address_(kNullAddress), size_(0) {}
 
 VirtualMemory::VirtualMemory(size_t size, void* hint, size_t alignment)
-    : address_(nullptr), size_(0) {
+    : address_(kNullAddress), size_(0) {
   size_t page_size = AllocatePageSize();
   size_t alloc_size = RoundUp(size, page_size);
-  address_ =
-      AllocatePages(hint, alloc_size, alignment, PageAllocator::kNoAccess);
-  if (address_ != nullptr) {
+  address_ = reinterpret_cast<Address>(
+      AllocatePages(hint, alloc_size, alignment, PageAllocator::kNoAccess));
+  if (address_ != kNullAddress) {
     size_ = alloc_size;
   }
 }
@@ -226,31 +226,29 @@ VirtualMemory::~VirtualMemory() {
 }
 
 void VirtualMemory::Reset() {
-  address_ = nullptr;
+  address_ = kNullAddress;
   size_ = 0;
 }
 
-bool VirtualMemory::SetPermissions(void* address, size_t size,
+bool VirtualMemory::SetPermissions(Address address, size_t size,
                                    PageAllocator::Permission access) {
   CHECK(InVM(address, size));
   bool result = v8::internal::SetPermissions(address, size, access);
   DCHECK(result);
-  USE(result);
   return result;
 }
 
-size_t VirtualMemory::Release(void* free_start) {
+size_t VirtualMemory::Release(Address free_start) {
   DCHECK(IsReserved());
-  DCHECK(IsAddressAligned(static_cast<Address>(free_start), CommitPageSize()));
+  DCHECK(IsAddressAligned(free_start, CommitPageSize()));
   // Notice: Order is important here. The VirtualMemory object might live
   // inside the allocated region.
-  const size_t free_size = size_ - (reinterpret_cast<size_t>(free_start) -
-                                    reinterpret_cast<size_t>(address_));
+  const size_t free_size = size_ - (free_start - address_);
   CHECK(InVM(free_start, free_size));
   DCHECK_LT(address_, free_start);
-  DCHECK_LT(free_start, reinterpret_cast<void*>(
-                            reinterpret_cast<size_t>(address_) + size_));
-  CHECK(ReleasePages(address_, size_, size_ - free_size));
+  DCHECK_LT(free_start, address_ + size_);
+  CHECK(ReleasePages(reinterpret_cast<void*>(address_), size_,
+                     size_ - free_size));
   size_ -= free_size;
   return free_size;
 }
@@ -259,13 +257,14 @@ void VirtualMemory::Free() {
   DCHECK(IsReserved());
   // Notice: Order is important here. The VirtualMemory object might live
   // inside the allocated region.
-  void* address = address_;
+  Address address = address_;
   size_t size = size_;
   CHECK(InVM(address, size));
   Reset();
   // FreePages expects size to be aligned to allocation granularity. Trimming
   // may leave size at only commit granularity. Align it here.
-  CHECK(FreePages(address, RoundUp(size, AllocatePageSize())));
+  CHECK(FreePages(reinterpret_cast<void*>(address),
+                  RoundUp(size, AllocatePageSize())));
 }
 
 void VirtualMemory::TakeControl(VirtualMemory* from) {
diff --git a/deps/v8/src/allocation.h b/deps/v8/src/allocation.h
index 13dc3e508f3d3c..8e17a35514e4bf 100644
--- a/deps/v8/src/allocation.h
+++ b/deps/v8/src/allocation.h
@@ -71,8 +71,8 @@ char* StrNDup(const char* str, int n);
 // and free. Used as the default policy for lists.
 class FreeStoreAllocationPolicy {
  public:
-  INLINE(void* New(size_t size)) { return Malloced::New(size); }
-  INLINE(static void Delete(void* p)) { Malloced::Delete(p); }
+  V8_INLINE void* New(size_t size) { return Malloced::New(size); }
+  V8_INLINE static void Delete(void* p) { Malloced::Delete(p); }
 };
 
 // Performs a malloc, with retry logic on failure. Returns nullptr on failure.
@@ -126,6 +126,10 @@ V8_WARN_UNUSED_RESULT bool ReleasePages(void* address, size_t size,
 V8_EXPORT_PRIVATE
 V8_WARN_UNUSED_RESULT bool SetPermissions(void* address, size_t size,
                                           PageAllocator::Permission access);
+inline bool SetPermissions(Address address, size_t size,
+                           PageAllocator::Permission access) {
+  return SetPermissions(reinterpret_cast<void*>(address), size, access);
+}
 
 // Convenience function that allocates a single system page with read and write
 // permissions. |address| is a hint. Returns the base address of the memory and
@@ -151,14 +155,15 @@ class V8_EXPORT_PRIVATE VirtualMemory {
 
   // Construct a virtual memory by assigning it some already mapped address
   // and size.
-  VirtualMemory(void* address, size_t size) : address_(address), size_(size) {}
+  VirtualMemory(Address address, size_t size)
+      : address_(address), size_(size) {}
 
   // Releases the reserved memory, if any, controlled by this VirtualMemory
   // object.
   ~VirtualMemory();
 
   // Returns whether the memory has been reserved.
-  bool IsReserved() const { return address_ != nullptr; }
+  bool IsReserved() const { return address_ != kNullAddress; }
 
   // Initialize or resets an embedded VirtualMemory object.
   void Reset();
@@ -167,15 +172,14 @@ class V8_EXPORT_PRIVATE VirtualMemory {
   // If the memory was reserved with an alignment, this address is not
   // necessarily aligned. The user might need to round it up to a multiple of
   // the alignment to get the start of the aligned block.
-  void* address() const {
+  Address address() const {
     DCHECK(IsReserved());
     return address_;
   }
 
-  void* end() const {
+  Address end() const {
     DCHECK(IsReserved());
-    return reinterpret_cast<void*>(reinterpret_cast<uintptr_t>(address_) +
-                                   size_);
+    return address_ + size_;
   }
 
   // Returns the size of the reserved memory. The returned value is only
@@ -186,11 +190,11 @@ class V8_EXPORT_PRIVATE VirtualMemory {
 
   // Sets permissions according to the access argument. address and size must be
   // multiples of CommitPageSize(). Returns true on success, otherwise false.
-  bool SetPermissions(void* address, size_t size,
+  bool SetPermissions(Address address, size_t size,
                       PageAllocator::Permission access);
 
   // Releases memory after |free_start|. Returns the number of bytes released.
-  size_t Release(void* free_start);
+  size_t Release(Address free_start);
 
   // Frees all memory.
   void Free();
@@ -199,15 +203,12 @@ class V8_EXPORT_PRIVATE VirtualMemory {
   // The old object is no longer functional (IsReserved() returns false).
   void TakeControl(VirtualMemory* from);
 
-  bool InVM(void* address, size_t size) {
-    return (reinterpret_cast<uintptr_t>(address_) <=
-            reinterpret_cast<uintptr_t>(address)) &&
-           ((reinterpret_cast<uintptr_t>(address_) + size_) >=
-            (reinterpret_cast<uintptr_t>(address) + size));
+  bool InVM(Address address, size_t size) {
+    return (address_ <= address) && ((address_ + size_) >= (address + size));
   }
 
  private:
-  void* address_;  // Start address of the virtual memory.
+  Address address_;  // Start address of the virtual memory.
   size_t size_;    // Size of the virtual memory.
 };
 
diff --git a/deps/v8/src/api-arguments-inl.h b/deps/v8/src/api-arguments-inl.h
index 1cf9662b94997b..4d91b68521bd02 100644
--- a/deps/v8/src/api-arguments-inl.h
+++ b/deps/v8/src/api-arguments-inl.h
@@ -7,6 +7,7 @@
 
 #include "src/api-arguments.h"
 
+#include "src/objects/api-callbacks.h"
 #include "src/tracing/trace-event.h"
 #include "src/vm-state-inl.h"
 
@@ -84,7 +85,8 @@ Handle<Object> FunctionCallbackArguments::Call(CallHandlerInfo* handler) {
   v8::FunctionCallback f =
       v8::ToCData<v8::FunctionCallback>(handler->callback());
   if (isolate->debug_execution_mode() == DebugInfo::kSideEffects &&
-      !isolate->debug()->PerformSideEffectCheckForCallback(handle(handler))) {
+      !isolate->debug()->PerformSideEffectCheckForCallback(
+          handle(handler, isolate))) {
     return Handle<Object>();
   }
   VMState<EXTERNAL> state(isolate);
diff --git a/deps/v8/src/api-arguments.h b/deps/v8/src/api-arguments.h
index 0abbcdcafa091d..bed1c123e0e297 100644
--- a/deps/v8/src/api-arguments.h
+++ b/deps/v8/src/api-arguments.h
@@ -93,9 +93,9 @@ class PropertyCallbackArguments
 
     // Here the hole is set as default value.
     // It cannot escape into js as it's removed in Call below.
-    values[T::kReturnValueDefaultValueIndex] =
-        isolate->heap()->the_hole_value();
-    values[T::kReturnValueIndex] = isolate->heap()->the_hole_value();
+    HeapObject* the_hole = ReadOnlyRoots(isolate).the_hole_value();
+    values[T::kReturnValueDefaultValueIndex] = the_hole;
+    values[T::kReturnValueIndex] = the_hole;
     DCHECK(values[T::kHolderIndex]->IsHeapObject());
     DCHECK(values[T::kIsolateIndex]->IsSmi());
   }
@@ -200,9 +200,9 @@ class FunctionCallbackArguments
     values[T::kIsolateIndex] = reinterpret_cast<internal::Object*>(isolate);
     // Here the hole is set as default value.
     // It cannot escape into js as it's remove in Call below.
-    values[T::kReturnValueDefaultValueIndex] =
-        isolate->heap()->the_hole_value();
-    values[T::kReturnValueIndex] = isolate->heap()->the_hole_value();
+    HeapObject* the_hole = ReadOnlyRoots(isolate).the_hole_value();
+    values[T::kReturnValueDefaultValueIndex] = the_hole;
+    values[T::kReturnValueIndex] = the_hole;
     DCHECK(values[T::kHolderIndex]->IsHeapObject());
     DCHECK(values[T::kIsolateIndex]->IsSmi());
   }
diff --git a/deps/v8/src/api-natives.cc b/deps/v8/src/api-natives.cc
index 981f592f5a08ed..8d564509c12f8d 100644
--- a/deps/v8/src/api-natives.cc
+++ b/deps/v8/src/api-natives.cc
@@ -8,6 +8,9 @@
 #include "src/isolate-inl.h"
 #include "src/lookup.h"
 #include "src/messages.h"
+#include "src/objects/api-callbacks.h"
+#include "src/objects/hash-table-inl.h"
+#include "src/objects/templates.h"
 
 namespace v8 {
 namespace internal {
@@ -119,18 +122,18 @@ MaybeHandle<Object> DefineDataProperty(Isolate* isolate,
 
 
 void DisableAccessChecks(Isolate* isolate, Handle<JSObject> object) {
-  Handle<Map> old_map(object->map());
+  Handle<Map> old_map(object->map(), isolate);
   // Copy map so it won't interfere constructor's initial map.
-  Handle<Map> new_map = Map::Copy(old_map, "DisableAccessChecks");
+  Handle<Map> new_map = Map::Copy(isolate, old_map, "DisableAccessChecks");
   new_map->set_is_access_check_needed(false);
   JSObject::MigrateToMap(Handle<JSObject>::cast(object), new_map);
 }
 
 
 void EnableAccessChecks(Isolate* isolate, Handle<JSObject> object) {
-  Handle<Map> old_map(object->map());
+  Handle<Map> old_map(object->map(), isolate);
   // Copy map so it won't interfere constructor's initial map.
-  Handle<Map> new_map = Map::Copy(old_map, "EnableAccessChecks");
+  Handle<Map> new_map = Map::Copy(isolate, old_map, "EnableAccessChecks");
   new_map->set_is_access_check_needed(true);
   new_map->set_may_have_interesting_symbols(true);
   JSObject::MigrateToMap(object, new_map);
@@ -199,7 +202,7 @@ MaybeHandle<JSObject> ConfigureInstance(Isolate* isolate, Handle<JSObject> obj,
     Handle<FixedArray> array =
         isolate->factory()->NewFixedArray(max_number_of_properties);
 
-    for (Handle<TemplateInfoT> temp(*data); *temp != nullptr;
+    for (Handle<TemplateInfoT> temp(*data, isolate); *temp != nullptr;
          temp = handle(temp->GetParent(isolate), isolate)) {
       // Accumulate accessors.
       Object* maybe_properties = temp->property_accessors();
@@ -211,7 +214,7 @@ MaybeHandle<JSObject> ConfigureInstance(Isolate* isolate, Handle<JSObject> obj,
 
     // Install accumulated accessors.
     for (int i = 0; i < valid_descriptors; i++) {
-      Handle<AccessorInfo> accessor(AccessorInfo::cast(array->get(i)));
+      Handle<AccessorInfo> accessor(AccessorInfo::cast(array->get(i)), isolate);
       Handle<Name> name(Name::cast(accessor->name()), isolate);
       JSObject::SetAccessor(obj, name, accessor,
                             accessor->initial_property_attributes())
@@ -440,7 +443,7 @@ MaybeHandle<Object> GetInstancePrototype(Isolate* isolate,
   // TODO(cbruni): decide what to do here.
   ASSIGN_RETURN_ON_EXCEPTION(
       isolate, instance_prototype,
-      JSObject::GetProperty(parent_instance,
+      JSObject::GetProperty(isolate, parent_instance,
                             isolate->factory()->prototype_string()),
       JSFunction);
   return scope.CloseAndEscape(instance_prototype);
@@ -541,8 +544,8 @@ MaybeHandle<JSFunction> ApiNatives::InstantiateFunction(
 }
 
 MaybeHandle<JSObject> ApiNatives::InstantiateObject(
-    Handle<ObjectTemplateInfo> data, Handle<JSReceiver> new_target) {
-  Isolate* isolate = data->GetIsolate();
+    Isolate* isolate, Handle<ObjectTemplateInfo> data,
+    Handle<JSReceiver> new_target) {
   InvokeScope invoke_scope(isolate);
   return ::v8::internal::InstantiateObject(isolate, data, new_target, false,
                                            false);
@@ -554,7 +557,7 @@ MaybeHandle<JSObject> ApiNatives::InstantiateRemoteObject(
   InvokeScope invoke_scope(isolate);
 
   Handle<FunctionTemplateInfo> constructor(
-      FunctionTemplateInfo::cast(data->constructor()));
+      FunctionTemplateInfo::cast(data->constructor()), isolate);
   Handle<Map> object_map = isolate->factory()->NewMap(
       JS_SPECIAL_API_OBJECT_TYPE,
       JSObject::kHeaderSize + data->embedder_field_count() * kPointerSize,
@@ -651,7 +654,7 @@ Handle<JSFunction> ApiNatives::CreateApiFunction(
   if (prototype->IsTheHole(isolate)) {
     prototype = isolate->factory()->NewFunctionPrototype(result);
   } else if (obj->prototype_provider_template()->IsUndefined(isolate)) {
-    JSObject::AddProperty(Handle<JSObject>::cast(prototype),
+    JSObject::AddProperty(isolate, Handle<JSObject>::cast(prototype),
                           isolate->factory()->constructor_string(), result,
                           DONT_ENUM);
   }
@@ -660,7 +663,7 @@ Handle<JSFunction> ApiNatives::CreateApiFunction(
   bool immutable_proto = false;
   if (!obj->instance_template()->IsUndefined(isolate)) {
     Handle<ObjectTemplateInfo> instance_template = Handle<ObjectTemplateInfo>(
-        ObjectTemplateInfo::cast(obj->instance_template()));
+        ObjectTemplateInfo::cast(obj->instance_template()), isolate);
     embedder_field_count = instance_template->embedder_field_count();
     immutable_proto = instance_template->immutable_proto();
   }
diff --git a/deps/v8/src/api-natives.h b/deps/v8/src/api-natives.h
index f73e7cee7ea28f..67a4b800609ed9 100644
--- a/deps/v8/src/api-natives.h
+++ b/deps/v8/src/api-natives.h
@@ -26,7 +26,7 @@ class ApiNatives {
       MaybeHandle<Name> maybe_name = MaybeHandle<Name>());
 
   V8_WARN_UNUSED_RESULT static MaybeHandle<JSObject> InstantiateObject(
-      Handle<ObjectTemplateInfo> data,
+      Isolate* isolate, Handle<ObjectTemplateInfo> data,
       Handle<JSReceiver> new_target = Handle<JSReceiver>());
 
   V8_WARN_UNUSED_RESULT static MaybeHandle<JSObject> InstantiateRemoteObject(
diff --git a/deps/v8/src/api.cc b/deps/v8/src/api.cc
index a7f6d00f6fabf7..ecd8e5d37976ff 100644
--- a/deps/v8/src/api.cc
+++ b/deps/v8/src/api.cc
@@ -5,10 +5,7 @@
 #include "src/api.h"
 
 #include <string.h>  // For memcpy, strlen.
-#ifdef V8_USE_ADDRESS_SANITIZER
-#include <sanitizer/asan_interface.h>
-#endif  // V8_USE_ADDRESS_SANITIZER
-#include <cmath>  // For isnan.
+#include <cmath>     // For isnan.
 #include <limits>
 #include <vector>
 #include "include/v8-profiler.h"
@@ -36,6 +33,7 @@
 #include "src/debug/debug-evaluate.h"
 #include "src/debug/debug-type-profile.h"
 #include "src/debug/debug.h"
+#include "src/debug/liveedit.h"
 #include "src/deoptimizer.h"
 #include "src/detachable-vector.h"
 #include "src/execution.h"
@@ -49,6 +47,13 @@
 #include "src/json-stringifier.h"
 #include "src/messages.h"
 #include "src/objects-inl.h"
+#include "src/objects/api-callbacks.h"
+#include "src/objects/js-collection-inl.h"
+#include "src/objects/js-promise-inl.h"
+#include "src/objects/js-regexp-inl.h"
+#include "src/objects/module-inl.h"
+#include "src/objects/ordered-hash-table-inl.h"
+#include "src/objects/templates.h"
 #include "src/parsing/parser.h"
 #include "src/parsing/scanner-character-streams.h"
 #include "src/pending-compilation-error-handler.h"
@@ -79,7 +84,6 @@
 #include "src/value-serializer.h"
 #include "src/version.h"
 #include "src/vm-state-inl.h"
-#include "src/wasm/compilation-manager.h"
 #include "src/wasm/streaming-decoder.h"
 #include "src/wasm/wasm-engine.h"
 #include "src/wasm/wasm-objects-inl.h"
@@ -233,10 +237,20 @@ template <bool do_callback>
 class CallDepthScope {
  public:
   explicit CallDepthScope(i::Isolate* isolate, Local<Context> context)
-      : isolate_(isolate), context_(context), escaped_(false) {
+      : isolate_(isolate),
+        context_(context),
+        escaped_(false),
+        safe_for_termination_(isolate->next_v8_call_is_safe_for_termination()),
+        interrupts_scope_(isolate_, i::StackGuard::TERMINATE_EXECUTION,
+                          isolate_->only_terminate_in_safe_scope()
+                              ? (safe_for_termination_
+                                     ? i::InterruptsScope::kRunInterrupts
+                                     : i::InterruptsScope::kPostponeInterrupts)
+                              : i::InterruptsScope::kNoop) {
     // TODO(dcarney): remove this when blink stops crashing.
     DCHECK(!isolate_->external_caught_exception());
     isolate_->handle_scope_implementer()->IncrementCallDepth();
+    isolate_->set_next_v8_call_is_safe_for_termination(false);
     if (!context.IsEmpty()) {
       i::Handle<i::Context> env = Utils::OpenHandle(*context);
       i::HandleScopeImplementer* impl = isolate->handle_scope_implementer();
@@ -261,6 +275,7 @@ class CallDepthScope {
 #ifdef V8_CHECK_MICROTASKS_SCOPES_CONSISTENCY
     if (do_callback) CheckMicrotasksScopesConsistency(isolate_);
 #endif
+    isolate_->set_next_v8_call_is_safe_for_termination(safe_for_termination_);
   }
 
   void Escape() {
@@ -277,6 +292,8 @@ class CallDepthScope {
   Local<Context> context_;
   bool escaped_;
   bool do_callback_;
+  bool safe_for_termination_;
+  i::InterruptsScope interrupts_scope_;
 };
 
 }  // namespace
@@ -288,8 +305,7 @@ static ScriptOrigin GetScriptOriginForScript(i::Isolate* isolate,
   i::Handle<i::Object> source_map_url(script->source_mapping_url(), isolate);
   i::Handle<i::FixedArray> host_defined_options(script->host_defined_options(),
                                                 isolate);
-  v8::Isolate* v8_isolate =
-      reinterpret_cast<v8::Isolate*>(script->GetIsolate());
+  v8::Isolate* v8_isolate = reinterpret_cast<v8::Isolate*>(isolate);
   ScriptOriginOptions options(script->origin_options());
   v8::ScriptOrigin origin(
       Utils::ToLocal(scriptName),
@@ -332,7 +348,9 @@ void i::V8::FatalProcessOutOfMemory(i::Isolate* isolate, const char* location,
     memset(&heap_stats, 0xBADC0DE, sizeof(heap_stats));
     // Note that the embedder's oom handler won't be called in this case. We
     // just crash.
-    FATAL("API fatal error handler returned after process out of memory");
+    FATAL(
+        "API fatal error handler returned after process out of memory on the "
+        "background thread");
     UNREACHABLE();
   }
 
@@ -341,6 +359,10 @@ void i::V8::FatalProcessOutOfMemory(i::Isolate* isolate, const char* location,
 
   intptr_t start_marker;
   heap_stats.start_marker = &start_marker;
+  size_t ro_space_size;
+  heap_stats.ro_space_size = &ro_space_size;
+  size_t ro_space_capacity;
+  heap_stats.ro_space_capacity = &ro_space_capacity;
   size_t new_space_size;
   heap_stats.new_space_size = &new_space_size;
   size_t new_space_capacity;
@@ -445,7 +467,7 @@ void Utils::ReportOOMFailure(i::Isolate* isolate, const char* location,
 static inline bool IsExecutionTerminatingCheck(i::Isolate* isolate) {
   if (isolate->has_scheduled_exception()) {
     return isolate->scheduled_exception() ==
-        isolate->heap()->termination_exception();
+           i::ReadOnlyRoots(isolate).termination_exception();
   }
   return false;
 }
@@ -539,14 +561,15 @@ struct SnapshotCreatorData {
 
 }  // namespace
 
-SnapshotCreator::SnapshotCreator(const intptr_t* external_references,
+SnapshotCreator::SnapshotCreator(Isolate* isolate,
+                                 const intptr_t* external_references,
                                  StartupData* existing_snapshot) {
-  i::Isolate* internal_isolate = new i::Isolate(true);
-  Isolate* isolate = reinterpret_cast<Isolate*>(internal_isolate);
   SnapshotCreatorData* data = new SnapshotCreatorData(isolate);
   data->isolate_ = isolate;
+  i::Isolate* internal_isolate = reinterpret_cast<i::Isolate*>(isolate);
   internal_isolate->set_array_buffer_allocator(&data->allocator_);
   internal_isolate->set_api_external_references(external_references);
+  internal_isolate->enable_serializer();
   isolate->Enter();
   const StartupData* blob = existing_snapshot
                                 ? existing_snapshot
@@ -560,6 +583,11 @@ SnapshotCreator::SnapshotCreator(const intptr_t* external_references,
   data_ = data;
 }
 
+SnapshotCreator::SnapshotCreator(const intptr_t* external_references,
+                                 StartupData* existing_snapshot)
+    : SnapshotCreator(reinterpret_cast<Isolate*>(new i::Isolate()),
+                      external_references, existing_snapshot) {}
+
 SnapshotCreator::~SnapshotCreator() {
   SnapshotCreatorData* data = SnapshotCreatorData::cast(data_);
   DCHECK(data->created_);
@@ -614,7 +642,7 @@ size_t SnapshotCreator::AddData(i::Object* object) {
     list = i::ArrayList::New(isolate, 1);
   } else {
     list = i::Handle<i::ArrayList>(
-        i::ArrayList::cast(isolate->heap()->serialized_objects()));
+        i::ArrayList::cast(isolate->heap()->serialized_objects()), isolate);
   }
   size_t index = static_cast<size_t>(list->Length());
   list = i::ArrayList::Add(list, obj);
@@ -633,8 +661,8 @@ size_t SnapshotCreator::AddData(Local<Context> context, i::Object* object) {
   if (!ctx->serialized_objects()->IsArrayList()) {
     list = i::ArrayList::New(isolate, 1);
   } else {
-    list =
-        i::Handle<i::ArrayList>(i::ArrayList::cast(ctx->serialized_objects()));
+    list = i::Handle<i::ArrayList>(
+        i::ArrayList::cast(ctx->serialized_objects()), isolate);
   }
   size_t index = static_cast<size_t>(list->Length());
   list = i::ArrayList::Add(list, obj);
@@ -647,9 +675,10 @@ void ConvertSerializedObjectsToFixedArray(Local<Context> context) {
   i::Handle<i::Context> ctx = Utils::OpenHandle(*context);
   i::Isolate* isolate = ctx->GetIsolate();
   if (!ctx->serialized_objects()->IsArrayList()) {
-    ctx->set_serialized_objects(isolate->heap()->empty_fixed_array());
+    ctx->set_serialized_objects(i::ReadOnlyRoots(isolate).empty_fixed_array());
   } else {
-    i::Handle<i::ArrayList> list(i::ArrayList::cast(ctx->serialized_objects()));
+    i::Handle<i::ArrayList> list(i::ArrayList::cast(ctx->serialized_objects()),
+                                 isolate);
     i::Handle<i::FixedArray> elements = i::ArrayList::Elements(list);
     ctx->set_serialized_objects(*elements);
   }
@@ -657,10 +686,11 @@ void ConvertSerializedObjectsToFixedArray(Local<Context> context) {
 
 void ConvertSerializedObjectsToFixedArray(i::Isolate* isolate) {
   if (!isolate->heap()->serialized_objects()->IsArrayList()) {
-    isolate->heap()->SetSerializedObjects(isolate->heap()->empty_fixed_array());
+    isolate->heap()->SetSerializedObjects(
+        i::ReadOnlyRoots(isolate).empty_fixed_array());
   } else {
     i::Handle<i::ArrayList> list(
-        i::ArrayList::cast(isolate->heap()->serialized_objects()));
+        i::ArrayList::cast(isolate->heap()->serialized_objects()), isolate);
     i::Handle<i::FixedArray> elements = i::ArrayList::Elements(list);
     isolate->heap()->SetSerializedObjects(*elements);
   }
@@ -710,6 +740,35 @@ StartupData SnapshotCreator::CreateBlob(
       i::GarbageCollectionReason::kSnapshotCreator);
   isolate->heap()->CompactFixedArraysOfWeakCells();
 
+  isolate->heap()->read_only_space()->ClearStringPaddingIfNeeded();
+
+  if (function_code_handling == FunctionCodeHandling::kClear) {
+    // Clear out re-compilable data from all shared function infos. Any
+    // JSFunctions using these SFIs will have their code pointers reset by the
+    // partial serializer.
+    //
+    // We have to iterate the heap and collect handles to each clearable SFI,
+    // before we disable allocation, since we have to allocate UncompiledDatas
+    // to be able to recompile them.
+    i::HandleScope scope(isolate);
+    std::vector<i::Handle<i::SharedFunctionInfo>> sfis_to_clear;
+
+    i::HeapIterator heap_iterator(isolate->heap());
+    while (i::HeapObject* current_obj = heap_iterator.next()) {
+      if (current_obj->IsSharedFunctionInfo()) {
+        i::SharedFunctionInfo* shared =
+            i::SharedFunctionInfo::cast(current_obj);
+        if (shared->CanDiscardCompiled()) {
+          sfis_to_clear.emplace_back(shared, isolate);
+        }
+      }
+    }
+    i::AllowHeapAllocation allocate_for_discard;
+    for (i::Handle<i::SharedFunctionInfo> shared : sfis_to_clear) {
+      i::SharedFunctionInfo::DiscardCompiled(isolate, shared);
+    }
+  }
+
   i::DisallowHeapAllocation no_gc_from_here_on;
 
   int num_contexts = num_additional_contexts + 1;
@@ -740,21 +799,18 @@ StartupData SnapshotCreator::CreateBlob(
       // Complete in-object slack tracking for all functions.
       fun->CompleteInobjectSlackTrackingIfActive();
 
-      // Also, clear out feedback vectors.
-      fun->feedback_cell()->set_value(isolate->heap()->undefined_value());
-    }
-
-    // Clear out re-compilable data from all shared function infos. Any
-    // JSFunctions using these SFIs will have their code pointers reset by the
-    // partial serializer.
-    if (current_obj->IsSharedFunctionInfo() &&
-        function_code_handling == FunctionCodeHandling::kClear) {
-      i::SharedFunctionInfo* shared = i::SharedFunctionInfo::cast(current_obj);
-      if (shared->CanFlushCompiled()) {
-        shared->FlushCompiled();
+      // Also, clear out feedback vectors, or any optimized code.
+      if (fun->has_feedback_vector()) {
+        fun->feedback_cell()->set_value(
+            i::ReadOnlyRoots(isolate).undefined_value());
+        fun->set_code(isolate->builtins()->builtin(i::Builtins::kCompileLazy));
+      }
+      if (function_code_handling == FunctionCodeHandling::kClear) {
+        DCHECK(fun->shared()->HasWasmExportedFunctionData() ||
+               fun->shared()->HasBuiltinId() ||
+               fun->shared()->IsApiFunction() ||
+               fun->shared()->HasUncompiledDataWithoutPreParsedScope());
       }
-      DCHECK(shared->HasCodeObject() || shared->HasBuiltinId() ||
-             shared->IsApiFunction());
     }
   }
 
@@ -909,6 +965,21 @@ void RegisteredExtension::UnregisterAll() {
   first_extension_ = nullptr;
 }
 
+namespace {
+class ExtensionResource : public String::ExternalOneByteStringResource {
+ public:
+  ExtensionResource() : data_(0), length_(0) {}
+  ExtensionResource(const char* data, size_t length)
+      : data_(data), length_(length) {}
+  const char* data() const { return data_; }
+  size_t length() const { return length_; }
+  virtual void Dispose() {}
+
+ private:
+  const char* data_;
+  size_t length_;
+};
+}  // anonymous namespace
 
 void RegisterExtension(Extension* that) {
   RegisteredExtension* extension = new RegisteredExtension(that);
@@ -925,10 +996,10 @@ Extension::Extension(const char* name,
       source_length_(source_length >= 0 ?
                      source_length :
                      (source ? static_cast<int>(strlen(source)) : 0)),
-      source_(source, source_length_),
       dep_count_(dep_count),
       deps_(deps),
       auto_enable_(false) {
+  source_ = new ExtensionResource(source, source_length_);
   CHECK(source != nullptr || source_length_ == 0);
 }
 
@@ -979,7 +1050,7 @@ i::Object** V8::GlobalizeReference(i::Isolate* isolate, i::Object** obj) {
   i::Handle<i::Object> result = isolate->global_handles()->Create(*obj);
 #ifdef VERIFY_HEAP
   if (i::FLAG_verify_heap) {
-    (*obj)->ObjectVerify();
+    (*obj)->ObjectVerify(isolate);
   }
 #endif  // VERIFY_HEAP
   return result.location();
@@ -1125,7 +1196,8 @@ i::Object** HandleScope::CreateHandle(i::HeapObject* heap_object,
 
 EscapableHandleScope::EscapableHandleScope(Isolate* v8_isolate) {
   i::Isolate* isolate = reinterpret_cast<i::Isolate*>(v8_isolate);
-  escape_slot_ = CreateHandle(isolate, isolate->heap()->the_hole_value());
+  escape_slot_ =
+      CreateHandle(isolate, i::ReadOnlyRoots(isolate).the_hole_value());
   Initialize(v8_isolate);
 }
 
@@ -1135,7 +1207,7 @@ i::Object** EscapableHandleScope::Escape(i::Object** escape_value) {
   Utils::ApiCheck((*escape_slot_)->IsTheHole(heap->isolate()),
                   "EscapableHandleScope::Escape", "Escape value set twice");
   if (escape_value == nullptr) {
-    *escape_slot_ = heap->undefined_value();
+    *escape_slot_ = i::ReadOnlyRoots(heap).undefined_value();
     return nullptr;
   }
   *escape_slot_ = *escape_value;
@@ -1238,7 +1310,7 @@ static i::Handle<i::FixedArray> EmbedderDataFor(Context* context,
                       "Not a native context") &&
       Utils::ApiCheck(index >= 0, location, "Negative index");
   if (!ok) return i::Handle<i::FixedArray>();
-  i::Handle<i::FixedArray> data(env->embedder_data());
+  i::Handle<i::FixedArray> data(env->embedder_data(), isolate);
   if (index < data->length()) return data;
   if (!Utils::ApiCheck(can_grow, location, "Index too large")) {
     return i::Handle<i::FixedArray>();
@@ -1427,7 +1499,7 @@ static Local<FunctionTemplate> FunctionTemplateNew(
   }
   obj->set_cached_property_name(
       cached_property_name.IsEmpty()
-          ? isolate->heap()->the_hole_value()
+          ? i::ReadOnlyRoots(isolate).the_hole_value()
           : *Utils::OpenHandle(*cached_property_name));
   return Utils::ToLocal(obj);
 }
@@ -1456,7 +1528,7 @@ MaybeLocal<FunctionTemplate> FunctionTemplate::FromSnapshot(Isolate* isolate,
     i::Object* info = serialized_objects->get(int_index);
     if (info->IsFunctionTemplateInfo()) {
       return Utils::ToLocal(i::Handle<i::FunctionTemplateInfo>(
-          i::FunctionTemplateInfo::cast(info)));
+          i::FunctionTemplateInfo::cast(info), i_isolate));
     }
   }
   return Local<FunctionTemplate>();
@@ -1484,10 +1556,10 @@ Local<AccessorSignature> AccessorSignature::New(
   return Utils::AccessorSignatureToLocal(Utils::OpenHandle(*receiver));
 }
 
-
-#define SET_FIELD_WRAPPED(obj, setter, cdata) do {                      \
-    i::Handle<i::Object> foreign = FromCData(obj->GetIsolate(), cdata); \
-    (obj)->setter(*foreign);                                            \
+#define SET_FIELD_WRAPPED(isolate, obj, setter, cdata)        \
+  do {                                                        \
+    i::Handle<i::Object> foreign = FromCData(isolate, cdata); \
+    (obj)->setter(*foreign);                                  \
   } while (false)
 
 void FunctionTemplate::SetCallHandler(FunctionCallback callback,
@@ -1500,8 +1572,8 @@ void FunctionTemplate::SetCallHandler(FunctionCallback callback,
   i::HandleScope scope(isolate);
   i::Handle<i::CallHandlerInfo> obj = isolate->factory()->NewCallHandlerInfo(
       side_effect_type == SideEffectType::kHasNoSideEffect);
-  SET_FIELD_WRAPPED(obj, set_callback, callback);
-  SET_FIELD_WRAPPED(obj, set_js_callback, obj->redirected_callback());
+  SET_FIELD_WRAPPED(isolate, obj, set_callback, callback);
+  SET_FIELD_WRAPPED(isolate, obj, set_js_callback, obj->redirected_callback());
   if (data.IsEmpty()) {
     data = v8::Undefined(reinterpret_cast<v8::Isolate*>(isolate));
   }
@@ -1519,15 +1591,17 @@ i::Handle<i::AccessorInfo> MakeAccessorInfo(
     v8::Local<AccessorSignature> signature, bool is_special_data_property,
     bool replace_on_access) {
   i::Handle<i::AccessorInfo> obj = isolate->factory()->NewAccessorInfo();
-  SET_FIELD_WRAPPED(obj, set_getter, getter);
+  SET_FIELD_WRAPPED(isolate, obj, set_getter, getter);
   DCHECK_IMPLIES(replace_on_access,
                  is_special_data_property && setter == nullptr);
   if (is_special_data_property && setter == nullptr) {
     setter = reinterpret_cast<Setter>(&i::Accessors::ReconfigureToDataProperty);
   }
-  SET_FIELD_WRAPPED(obj, set_setter, setter);
+  SET_FIELD_WRAPPED(isolate, obj, set_setter, setter);
   i::Address redirected = obj->redirected_getter();
-  if (redirected != nullptr) SET_FIELD_WRAPPED(obj, set_js_getter, redirected);
+  if (redirected != i::kNullAddress) {
+    SET_FIELD_WRAPPED(isolate, obj, set_js_getter, redirected);
+  }
   if (data.IsEmpty()) {
     data = v8::Undefined(reinterpret_cast<v8::Isolate*>(isolate));
   }
@@ -1566,7 +1640,7 @@ Local<ObjectTemplate> FunctionTemplate::InstanceTemplate() {
     handle->set_instance_template(*Utils::OpenHandle(*templ));
   }
   i::Handle<i::ObjectTemplateInfo> result(
-      i::ObjectTemplateInfo::cast(handle->instance_template()));
+      i::ObjectTemplateInfo::cast(handle->instance_template()), isolate);
   return Utils::ToLocal(result);
 }
 
@@ -1668,8 +1742,8 @@ MaybeLocal<ObjectTemplate> ObjectTemplate::FromSnapshot(Isolate* isolate,
   if (int_index < serialized_objects->length()) {
     i::Object* info = serialized_objects->get(int_index);
     if (info->IsObjectTemplateInfo()) {
-      return Utils::ToLocal(
-          i::Handle<i::ObjectTemplateInfo>(i::ObjectTemplateInfo::cast(info)));
+      return Utils::ToLocal(i::Handle<i::ObjectTemplateInfo>(
+          i::ObjectTemplateInfo::cast(info), i_isolate));
     }
   }
   return Local<ObjectTemplate>();
@@ -1694,13 +1768,11 @@ static i::Handle<i::FunctionTemplateInfo> EnsureConstructor(
 }
 
 template <typename Getter, typename Setter, typename Data, typename Template>
-static void TemplateSetAccessor(Template* template_obj, v8::Local<Name> name,
-                                Getter getter, Setter setter, Data data,
-                                AccessControl settings,
-                                PropertyAttribute attribute,
-                                v8::Local<AccessorSignature> signature,
-                                bool is_special_data_property,
-                                bool replace_on_access) {
+static void TemplateSetAccessor(
+    Template* template_obj, v8::Local<Name> name, Getter getter, Setter setter,
+    Data data, AccessControl settings, PropertyAttribute attribute,
+    v8::Local<AccessorSignature> signature, bool is_special_data_property,
+    bool replace_on_access, SideEffectType getter_side_effect_type) {
   auto info = Utils::OpenHandle(template_obj);
   auto isolate = info->GetIsolate();
   ENTER_V8_NO_SCRIPT_NO_EXCEPTION(isolate);
@@ -1710,40 +1782,38 @@ static void TemplateSetAccessor(Template* template_obj, v8::Local<Name> name,
                        is_special_data_property, replace_on_access);
   accessor_info->set_initial_property_attributes(
       static_cast<i::PropertyAttributes>(attribute));
+  accessor_info->set_has_no_side_effect(getter_side_effect_type ==
+                                        SideEffectType::kHasNoSideEffect);
   i::ApiNatives::AddNativeDataProperty(isolate, info, accessor_info);
 }
 
-
-void Template::SetNativeDataProperty(v8::Local<String> name,
-                                     AccessorGetterCallback getter,
-                                     AccessorSetterCallback setter,
-                                     v8::Local<Value> data,
-                                     PropertyAttribute attribute,
-                                     v8::Local<AccessorSignature> signature,
-                                     AccessControl settings) {
+void Template::SetNativeDataProperty(
+    v8::Local<String> name, AccessorGetterCallback getter,
+    AccessorSetterCallback setter, v8::Local<Value> data,
+    PropertyAttribute attribute, v8::Local<AccessorSignature> signature,
+    AccessControl settings, SideEffectType getter_side_effect_type) {
   TemplateSetAccessor(this, name, getter, setter, data, settings, attribute,
-                      signature, true, false);
+                      signature, true, false, getter_side_effect_type);
 }
 
-
-void Template::SetNativeDataProperty(v8::Local<Name> name,
-                                     AccessorNameGetterCallback getter,
-                                     AccessorNameSetterCallback setter,
-                                     v8::Local<Value> data,
-                                     PropertyAttribute attribute,
-                                     v8::Local<AccessorSignature> signature,
-                                     AccessControl settings) {
+void Template::SetNativeDataProperty(
+    v8::Local<Name> name, AccessorNameGetterCallback getter,
+    AccessorNameSetterCallback setter, v8::Local<Value> data,
+    PropertyAttribute attribute, v8::Local<AccessorSignature> signature,
+    AccessControl settings, SideEffectType getter_side_effect_type) {
   TemplateSetAccessor(this, name, getter, setter, data, settings, attribute,
-                      signature, true, false);
+                      signature, true, false, getter_side_effect_type);
 }
 
 void Template::SetLazyDataProperty(v8::Local<Name> name,
                                    AccessorNameGetterCallback getter,
                                    v8::Local<Value> data,
-                                   PropertyAttribute attribute) {
-  TemplateSetAccessor(
-      this, name, getter, static_cast<AccessorNameSetterCallback>(nullptr),
-      data, DEFAULT, attribute, Local<AccessorSignature>(), true, true);
+                                   PropertyAttribute attribute,
+                                   SideEffectType getter_side_effect_type) {
+  TemplateSetAccessor(this, name, getter,
+                      static_cast<AccessorNameSetterCallback>(nullptr), data,
+                      DEFAULT, attribute, Local<AccessorSignature>(), true,
+                      true, getter_side_effect_type);
 }
 
 void Template::SetIntrinsicDataProperty(Local<Name> name, Intrinsic intrinsic,
@@ -1757,26 +1827,28 @@ void Template::SetIntrinsicDataProperty(Local<Name> name, Intrinsic intrinsic,
                                  static_cast<i::PropertyAttributes>(attribute));
 }
 
-
 void ObjectTemplate::SetAccessor(v8::Local<String> name,
                                  AccessorGetterCallback getter,
                                  AccessorSetterCallback setter,
                                  v8::Local<Value> data, AccessControl settings,
                                  PropertyAttribute attribute,
-                                 v8::Local<AccessorSignature> signature) {
+                                 v8::Local<AccessorSignature> signature,
+                                 SideEffectType getter_side_effect_type) {
   TemplateSetAccessor(this, name, getter, setter, data, settings, attribute,
-                      signature, i::FLAG_disable_old_api_accessors, false);
+                      signature, i::FLAG_disable_old_api_accessors, false,
+                      getter_side_effect_type);
 }
 
-
 void ObjectTemplate::SetAccessor(v8::Local<Name> name,
                                  AccessorNameGetterCallback getter,
                                  AccessorNameSetterCallback setter,
                                  v8::Local<Value> data, AccessControl settings,
                                  PropertyAttribute attribute,
-                                 v8::Local<AccessorSignature> signature) {
+                                 v8::Local<AccessorSignature> signature,
+                                 SideEffectType getter_side_effect_type) {
   TemplateSetAccessor(this, name, getter, setter, data, settings, attribute,
-                      signature, i::FLAG_disable_old_api_accessors, false);
+                      signature, i::FLAG_disable_old_api_accessors, false,
+                      getter_side_effect_type);
 }
 
 template <typename Getter, typename Setter, typename Query, typename Descriptor,
@@ -1793,13 +1865,15 @@ static i::Handle<i::InterceptorInfo> CreateInterceptorInfo(
       isolate->factory()->NewStruct(i::INTERCEPTOR_INFO_TYPE, i::TENURED));
   obj->set_flags(0);
 
-  if (getter != 0) SET_FIELD_WRAPPED(obj, set_getter, getter);
-  if (setter != 0) SET_FIELD_WRAPPED(obj, set_setter, setter);
-  if (query != 0) SET_FIELD_WRAPPED(obj, set_query, query);
-  if (descriptor != 0) SET_FIELD_WRAPPED(obj, set_descriptor, descriptor);
-  if (remover != 0) SET_FIELD_WRAPPED(obj, set_deleter, remover);
-  if (enumerator != 0) SET_FIELD_WRAPPED(obj, set_enumerator, enumerator);
-  if (definer != 0) SET_FIELD_WRAPPED(obj, set_definer, definer);
+  if (getter != 0) SET_FIELD_WRAPPED(isolate, obj, set_getter, getter);
+  if (setter != 0) SET_FIELD_WRAPPED(isolate, obj, set_setter, setter);
+  if (query != 0) SET_FIELD_WRAPPED(isolate, obj, set_query, query);
+  if (descriptor != 0)
+    SET_FIELD_WRAPPED(isolate, obj, set_descriptor, descriptor);
+  if (remover != 0) SET_FIELD_WRAPPED(isolate, obj, set_deleter, remover);
+  if (enumerator != 0)
+    SET_FIELD_WRAPPED(isolate, obj, set_enumerator, enumerator);
+  if (definer != 0) SET_FIELD_WRAPPED(isolate, obj, set_definer, definer);
   obj->set_can_intercept_symbols(
       !(static_cast<int>(flags) &
         static_cast<int>(PropertyHandlerFlags::kOnlyInterceptStrings)));
@@ -1903,7 +1977,7 @@ void ObjectTemplate::SetAccessCheckCallback(AccessCheckCallback callback,
   i::Handle<i::AccessCheckInfo> info =
       i::Handle<i::AccessCheckInfo>::cast(struct_info);
 
-  SET_FIELD_WRAPPED(info, set_callback, callback);
+  SET_FIELD_WRAPPED(isolate, info, set_callback, callback);
   info->set_named_interceptor(nullptr);
   info->set_indexed_interceptor(nullptr);
 
@@ -1933,7 +2007,7 @@ void ObjectTemplate::SetAccessCheckCallbackAndHandler(
   i::Handle<i::AccessCheckInfo> info =
       i::Handle<i::AccessCheckInfo>::cast(struct_info);
 
-  SET_FIELD_WRAPPED(info, set_callback, callback);
+  SET_FIELD_WRAPPED(isolate, info, set_callback, callback);
   auto named_interceptor = CreateNamedInterceptorInfo(
       isolate, named_handler.getter, named_handler.setter, named_handler.query,
       named_handler.descriptor, named_handler.deleter, named_handler.enumerator,
@@ -1977,8 +2051,8 @@ void ObjectTemplate::SetCallAsFunctionHandler(FunctionCallback callback,
   auto cons = EnsureConstructor(isolate, this);
   EnsureNotInstantiated(cons, "v8::ObjectTemplate::SetCallAsFunctionHandler");
   i::Handle<i::CallHandlerInfo> obj = isolate->factory()->NewCallHandlerInfo();
-  SET_FIELD_WRAPPED(obj, set_callback, callback);
-  SET_FIELD_WRAPPED(obj, set_js_callback, obj->redirected_callback());
+  SET_FIELD_WRAPPED(isolate, obj, set_callback, callback);
+  SET_FIELD_WRAPPED(isolate, obj, set_js_callback, obj->redirected_callback());
   if (data.IsEmpty()) {
     data = v8::Undefined(reinterpret_cast<v8::Isolate*>(isolate));
   }
@@ -2076,8 +2150,9 @@ int UnboundScript::GetId() {
   LOG_API(isolate, UnboundScript, GetId);
   i::HandleScope scope(isolate);
   i::Handle<i::SharedFunctionInfo> function_info(
-      i::SharedFunctionInfo::cast(*obj));
-  i::Handle<i::Script> script(i::Script::cast(function_info->script()));
+      i::SharedFunctionInfo::cast(*obj), isolate);
+  i::Handle<i::Script> script(i::Script::cast(function_info->script()),
+                              isolate);
   return script->id();
 }
 
@@ -2088,7 +2163,7 @@ int UnboundScript::GetLineNumber(int code_pos) {
   i::Isolate* isolate = obj->GetIsolate();
   LOG_API(isolate, UnboundScript, GetLineNumber);
   if (obj->script()->IsScript()) {
-    i::Handle<i::Script> script(i::Script::cast(obj->script()));
+    i::Handle<i::Script> script(i::Script::cast(obj->script()), isolate);
     return i::Script::GetLineNumber(script, code_pos);
   } else {
     return -1;
@@ -2185,8 +2260,9 @@ Local<PrimitiveArray> ScriptOrModule::GetHostDefinedOptions() {
 
 Local<UnboundScript> Script::GetUnboundScript() {
   i::Handle<i::Object> obj = Utils::OpenHandle(this);
-  return ToApiHandle<UnboundScript>(
-      i::Handle<i::SharedFunctionInfo>(i::JSFunction::cast(*obj)->shared()));
+  i::SharedFunctionInfo* sfi = i::JSFunction::cast(*obj)->shared();
+  i::Isolate* isolate = sfi->GetIsolate();
+  return ToApiHandle<UnboundScript>(i::handle(sfi, isolate));
 }
 
 // static
@@ -2294,10 +2370,19 @@ Local<Value> Module::GetModuleNamespace() {
       "v8::Module::GetModuleNamespace must be used on an instantiated module");
   i::Handle<i::Module> self = Utils::OpenHandle(this);
   i::Handle<i::JSModuleNamespace> module_namespace =
-      i::Module::GetModuleNamespace(self);
+      i::Module::GetModuleNamespace(self->GetIsolate(), self);
   return ToApiHandle<Value>(module_namespace);
 }
 
+Local<UnboundModuleScript> Module::GetUnboundModuleScript() {
+  Utils::ApiCheck(
+      GetStatus() < kEvaluating, "v8::Module::GetUnboundScript",
+      "v8::Module::GetUnboundScript must be used on an unevaluated module");
+  i::Handle<i::Module> self = Utils::OpenHandle(this);
+  return ToApiHandle<UnboundModuleScript>(i::Handle<i::SharedFunctionInfo>(
+      self->GetSharedFunctionInfo(), self->GetIsolate()));
+}
+
 int Module::GetIdentityHash() const { return Utils::OpenHandle(this)->hash(); }
 
 Maybe<bool> Module::InstantiateModule(Local<Context> context,
@@ -2305,8 +2390,8 @@ Maybe<bool> Module::InstantiateModule(Local<Context> context,
   auto isolate = reinterpret_cast<i::Isolate*>(context->GetIsolate());
   ENTER_V8(isolate, context, Module, InstantiateModule, Nothing<bool>(),
            i::HandleScope);
-  has_pending_exception =
-      !i::Module::Instantiate(Utils::OpenHandle(this), context, callback);
+  has_pending_exception = !i::Module::Instantiate(
+      isolate, Utils::OpenHandle(this), context, callback);
   RETURN_ON_FAILED_EXECUTION_PRIMITIVE(bool);
   return Just(true);
 }
@@ -2325,7 +2410,7 @@ MaybeLocal<Value> Module::Evaluate(Local<Context> context) {
   CHECK_GE(self->status(), i::Module::kInstantiated);
 
   Local<Value> result;
-  has_pending_exception = !ToLocal(i::Module::Evaluate(self), &result);
+  has_pending_exception = !ToLocal(i::Module::Evaluate(isolate, self), &result);
   RETURN_ON_FAILED_EXECUTION(Value);
   RETURN_ESCAPED(result);
 }
@@ -2436,15 +2521,18 @@ MaybeLocal<Script> ScriptCompiler::Compile(Local<Context> context,
   return result->BindToCurrentContext();
 }
 
-MaybeLocal<Module> ScriptCompiler::CompileModule(Isolate* isolate,
-                                                 Source* source) {
+MaybeLocal<Module> ScriptCompiler::CompileModule(
+    Isolate* isolate, Source* source, CompileOptions options,
+    NoCacheReason no_cache_reason) {
+  CHECK(options == kNoCompileOptions || options == kConsumeCodeCache);
+
   i::Isolate* i_isolate = reinterpret_cast<i::Isolate*>(isolate);
 
   Utils::ApiCheck(source->GetResourceOptions().IsModule(),
                   "v8::ScriptCompiler::CompileModule",
                   "Invalid ScriptOrigin: is_module must be true");
-  auto maybe = CompileUnboundInternal(isolate, source, kNoCompileOptions,
-                                      kNoCacheBecauseModule);
+  auto maybe =
+      CompileUnboundInternal(isolate, source, options, no_cache_reason);
   Local<UnboundScript> unbound;
   if (!maybe.ToLocal(&unbound)) return MaybeLocal<Module>();
 
@@ -2505,8 +2593,10 @@ MaybeLocal<Function> ScriptCompiler::CompileFunctionInContext(
          options == CompileOptions::kNoCompileOptions);
 
   i::Handle<i::Context> context = Utils::OpenHandle(*v8_context);
-  i::Handle<i::SharedFunctionInfo> outer_info(context->closure()->shared(),
-                                              isolate);
+
+  DCHECK(context->IsNativeContext());
+  i::Handle<i::SharedFunctionInfo> outer_info(
+      context->empty_function()->shared(), isolate);
 
   i::Handle<i::JSFunction> fun;
   i::Handle<i::FixedArray> arguments_list =
@@ -2522,13 +2612,13 @@ MaybeLocal<Function> ScriptCompiler::CompileFunctionInContext(
     i::Handle<i::JSReceiver> extension =
         Utils::OpenHandle(*context_extensions[i]);
     if (!extension->IsJSObject()) return Local<Function>();
-    i::Handle<i::JSFunction> closure(context->closure(), isolate);
     context = isolate->factory()->NewWithContext(
-        closure, context,
+        context,
         i::ScopeInfo::CreateForWithScope(
-            isolate, context->IsNativeContext()
-                         ? i::Handle<i::ScopeInfo>::null()
-                         : i::Handle<i::ScopeInfo>(context->scope_info())),
+            isolate,
+            context->IsNativeContext()
+                ? i::Handle<i::ScopeInfo>::null()
+                : i::Handle<i::ScopeInfo>(context->scope_info(), isolate)),
         extension);
   }
 
@@ -2638,6 +2728,16 @@ ScriptCompiler::CachedData* ScriptCompiler::CreateCodeCache(
   return i::CodeSerializer::Serialize(shared);
 }
 
+// static
+ScriptCompiler::CachedData* ScriptCompiler::CreateCodeCache(
+    Local<UnboundModuleScript> unbound_module_script) {
+  i::Handle<i::SharedFunctionInfo> shared =
+      i::Handle<i::SharedFunctionInfo>::cast(
+          Utils::OpenHandle(*unbound_module_script));
+  DCHECK(shared->is_toplevel());
+  return i::CodeSerializer::Serialize(shared);
+}
+
 ScriptCompiler::CachedData* ScriptCompiler::CreateCodeCacheForFunction(
     Local<Function> function, Local<String> source) {
   return CreateCodeCacheForFunction(function);
@@ -2645,8 +2745,10 @@ ScriptCompiler::CachedData* ScriptCompiler::CreateCodeCacheForFunction(
 
 ScriptCompiler::CachedData* ScriptCompiler::CreateCodeCacheForFunction(
     Local<Function> function) {
-  i::Handle<i::SharedFunctionInfo> shared(
-      i::Handle<i::JSFunction>::cast(Utils::OpenHandle(*function))->shared());
+  auto js_function =
+      i::Handle<i::JSFunction>::cast(Utils::OpenHandle(*function));
+  i::Handle<i::SharedFunctionInfo> shared(js_function->shared(),
+                                          js_function->GetIsolate());
   CHECK(shared->is_wrapped());
   return i::CodeSerializer::Serialize(shared);
 }
@@ -2778,7 +2880,7 @@ MaybeLocal<Value> v8::TryCatch::StackTrace(Local<Context> context) const {
   if (!maybe.FromJust()) return v8::Local<Value>();
   Local<Value> result;
   has_pending_exception =
-      !ToLocal<Value>(i::JSReceiver::GetProperty(obj, name), &result);
+      !ToLocal<Value>(i::JSReceiver::GetProperty(isolate, obj, name), &result);
   RETURN_ON_FAILED_EXECUTION(Value);
   RETURN_ESCAPED(result);
 }
@@ -2813,7 +2915,7 @@ void v8::TryCatch::Reset() {
 
 
 void v8::TryCatch::ResetInternal() {
-  i::Object* the_hole = isolate_->heap()->the_hole_value();
+  i::Object* the_hole = i::ReadOnlyRoots(isolate_).the_hole_value();
   exception_ = the_hole;
   message_obj_ = the_hole;
 }
@@ -2848,9 +2950,7 @@ ScriptOrigin Message::GetScriptOrigin() const {
   i::Isolate* isolate = Utils::OpenHandle(this)->GetIsolate();
   ENTER_V8_NO_SCRIPT_NO_EXCEPTION(isolate);
   auto message = i::Handle<i::JSMessageObject>::cast(Utils::OpenHandle(this));
-  auto script_wraper = i::Handle<i::Object>(message->script(), isolate);
-  auto script_value = i::Handle<i::JSValue>::cast(script_wraper);
-  i::Handle<i::Script> script(i::Script::cast(script_value->value()));
+  i::Handle<i::Script> script(message->script(), isolate);
   return GetScriptOriginForScript(isolate, script);
 }
 
@@ -2938,10 +3038,8 @@ Maybe<int> Message::GetEndColumn(Local<Context> context) const {
 bool Message::IsSharedCrossOrigin() const {
   i::Isolate* isolate = Utils::OpenHandle(this)->GetIsolate();
   ENTER_V8_NO_SCRIPT_NO_EXCEPTION(isolate);
-  auto self = Utils::OpenHandle(this);
-  auto script = i::Handle<i::JSValue>::cast(
-      i::Handle<i::Object>(self->script(), isolate));
-  return i::Script::cast(script->value())
+  return Utils::OpenHandle(this)
+      ->script()
       ->origin_options()
       .IsSharedCrossOrigin();
 }
@@ -2949,10 +3047,7 @@ bool Message::IsSharedCrossOrigin() const {
 bool Message::IsOpaque() const {
   i::Isolate* isolate = Utils::OpenHandle(this)->GetIsolate();
   ENTER_V8_NO_SCRIPT_NO_EXCEPTION(isolate);
-  auto self = Utils::OpenHandle(this);
-  auto script = i::Handle<i::JSValue>::cast(
-      i::Handle<i::Object>(self->script(), isolate));
-  return i::Script::cast(script->value())->origin_options().IsOpaque();
+  return Utils::OpenHandle(this)->script()->origin_options().IsOpaque();
 }
 
 
@@ -3073,7 +3168,7 @@ bool StackFrame::IsWasm() const { return Utils::OpenHandle(this)->is_wasm(); }
 MaybeLocal<Value> JSON::Parse(Isolate* v8_isolate, Local<String> json_string) {
   PREPARE_FOR_EXECUTION(v8_isolate->GetCurrentContext(), JSON, Parse, Value);
   i::Handle<i::String> string = Utils::OpenHandle(*json_string);
-  i::Handle<i::String> source = i::String::Flatten(string);
+  i::Handle<i::String> source = i::String::Flatten(isolate, string);
   i::Handle<i::Object> undefined = isolate->factory()->undefined_value();
   auto maybe = source->IsSeqOneByteString()
                    ? i::JsonParser<true>::Parse(isolate, source, undefined)
@@ -3088,7 +3183,7 @@ MaybeLocal<Value> JSON::Parse(Local<Context> context,
                               Local<String> json_string) {
   PREPARE_FOR_EXECUTION(context, JSON, Parse, Value);
   i::Handle<i::String> string = Utils::OpenHandle(*json_string);
-  i::Handle<i::String> source = i::String::Flatten(string);
+  i::Handle<i::String> source = i::String::Flatten(isolate, string);
   i::Handle<i::Object> undefined = isolate->factory()->undefined_value();
   auto maybe = source->IsSeqOneByteString()
                    ? i::JsonParser<true>::Parse(isolate, source, undefined)
@@ -3377,10 +3472,7 @@ bool ValueDeserializer::ReadRawBytes(size_t length, const void** data) {
 
 bool Value::FullIsUndefined() const {
   i::Handle<i::Object> object = Utils::OpenHandle(this);
-  bool result = false;
-  if (!object->IsSmi()) {
-    result = object->IsUndefined(i::HeapObject::cast(*object)->GetIsolate());
-  }
+  bool result = object->IsUndefined();
   DCHECK_EQ(result, QuickIsUndefined());
   return result;
 }
@@ -3388,10 +3480,7 @@ bool Value::FullIsUndefined() const {
 
 bool Value::FullIsNull() const {
   i::Handle<i::Object> object = Utils::OpenHandle(this);
-  bool result = false;
-  if (!object->IsSmi()) {
-    result = object->IsNull(i::HeapObject::cast(*object)->GetIsolate());
-  }
+  bool result = object->IsNull();
   DCHECK_EQ(result, QuickIsNull());
   return result;
 }
@@ -3400,14 +3489,14 @@ bool Value::FullIsNull() const {
 bool Value::IsTrue() const {
   i::Handle<i::Object> object = Utils::OpenHandle(this);
   if (object->IsSmi()) return false;
-  return object->IsTrue(i::HeapObject::cast(*object)->GetIsolate());
+  return object->IsTrue();
 }
 
 
 bool Value::IsFalse() const {
   i::Handle<i::Object> object = Utils::OpenHandle(this);
   if (object->IsSmi()) return false;
-  return object->IsFalse(i::HeapObject::cast(*object)->GetIsolate());
+  return object->IsFalse();
 }
 
 
@@ -3522,7 +3611,10 @@ bool Value::IsBoolean() const {
 
 
 bool Value::IsExternal() const {
-  return Utils::OpenHandle(this)->IsExternal();
+  i::Handle<i::Object> obj = Utils::OpenHandle(this);
+  if (!obj->IsHeapObject()) return false;
+  i::Handle<i::HeapObject> heap_obj = i::Handle<i::HeapObject>::cast(obj);
+  return heap_obj->IsExternal(heap_obj->GetIsolate());
 }
 
 
@@ -3654,7 +3746,7 @@ MaybeLocal<Boolean> Value::ToBoolean(Local<Context> context) const {
   auto obj = Utils::OpenHandle(this);
   if (obj->IsBoolean()) return ToApiHandle<Boolean>(obj);
   auto isolate = reinterpret_cast<i::Isolate*>(context->GetIsolate());
-  auto val = isolate->factory()->ToBoolean(obj->BooleanValue());
+  auto val = isolate->factory()->ToBoolean(obj->BooleanValue(isolate));
   return ToApiHandle<Boolean>(val);
 }
 
@@ -3735,7 +3827,7 @@ void i::Internals::CheckInitializedImpl(v8::Isolate* external_isolate) {
 
 
 void External::CheckCast(v8::Value* that) {
-  Utils::ApiCheck(Utils::OpenHandle(that)->IsExternal(), "v8::External::Cast",
+  Utils::ApiCheck(that->IsExternal(), "v8::External::Cast",
                   "Could not convert to external");
 }
 
@@ -3968,12 +4060,17 @@ void v8::RegExp::CheckCast(v8::Value* that) {
 
 
 Maybe<bool> Value::BooleanValue(Local<Context> context) const {
-  return Just(Utils::OpenHandle(this)->BooleanValue());
+  i::Isolate* isolate = reinterpret_cast<i::Isolate*>(context->GetIsolate());
+  return Just(Utils::OpenHandle(this)->BooleanValue(isolate));
 }
 
 
 bool Value::BooleanValue() const {
-  return Utils::OpenHandle(this)->BooleanValue();
+  auto obj = Utils::OpenHandle(this);
+  if (obj->IsSmi()) return *obj != i::Smi::kZero;
+  DCHECK(obj->IsHeapObject());
+  i::Isolate* isolate = i::Handle<i::HeapObject>::cast(obj)->GetIsolate();
+  return obj->BooleanValue(isolate);
 }
 
 
@@ -4095,9 +4192,10 @@ MaybeLocal<Uint32> Value::ToArrayIndex(Local<Context> context) const {
 
 
 Maybe<bool> Value::Equals(Local<Context> context, Local<Value> that) const {
+  i::Isolate* isolate = Utils::OpenHandle(*context)->GetIsolate();
   auto self = Utils::OpenHandle(this);
   auto other = Utils::OpenHandle(*that);
-  return i::Object::Equals(self, other);
+  return i::Object::Equals(isolate, self, other);
 }
 
 
@@ -4739,7 +4837,7 @@ static Maybe<bool> ObjectSetAccessor(
       !i::JSObject::SetAccessor(obj, accessor_name, info, attrs)
            .ToHandle(&result);
   RETURN_ON_FAILED_EXECUTION_PRIMITIVE(bool);
-  if (result->IsUndefined(obj->GetIsolate())) return Just(false);
+  if (result->IsUndefined(isolate)) return Just(false);
   if (fast) {
     i::JSObject::MigrateSlowToFast(obj, 0, "APISetAccessor");
   }
@@ -5079,9 +5177,15 @@ Local<Function> Function::New(Isolate* v8_isolate, FunctionCallback callback,
       .FromMaybe(Local<Function>());
 }
 
-
 MaybeLocal<Object> Function::NewInstance(Local<Context> context, int argc,
                                          v8::Local<v8::Value> argv[]) const {
+  return NewInstanceWithSideEffectType(context, argc, argv,
+                                       SideEffectType::kHasSideEffect);
+}
+
+MaybeLocal<Object> Function::NewInstanceWithSideEffectType(
+    Local<Context> context, int argc, v8::Local<v8::Value> argv[],
+    SideEffectType side_effect_type) const {
   auto isolate = reinterpret_cast<i::Isolate*>(context->GetIsolate());
   TRACE_EVENT_CALL_STATS_SCOPED(isolate, "v8", "V8.Execute");
   ENTER_V8(isolate, context, Function, NewInstance, MaybeLocal<Object>(),
@@ -5089,10 +5193,39 @@ MaybeLocal<Object> Function::NewInstance(Local<Context> context, int argc,
   i::TimerEventScope<i::TimerEventExecute> timer_scope(isolate);
   auto self = Utils::OpenHandle(this);
   STATIC_ASSERT(sizeof(v8::Local<v8::Value>) == sizeof(i::Object**));
+  bool should_set_has_no_side_effect =
+      side_effect_type == SideEffectType::kHasNoSideEffect &&
+      isolate->debug_execution_mode() == i::DebugInfo::kSideEffects;
+  if (should_set_has_no_side_effect) {
+    CHECK(self->IsJSFunction() &&
+          i::JSFunction::cast(*self)->shared()->IsApiFunction());
+    i::Object* obj =
+        i::JSFunction::cast(*self)->shared()->get_api_func_data()->call_code();
+    if (obj->IsCallHandlerInfo()) {
+      i::CallHandlerInfo* handler_info = i::CallHandlerInfo::cast(obj);
+      if (!handler_info->IsSideEffectFreeCallHandlerInfo()) {
+        handler_info->SetNextCallHasNoSideEffect();
+      }
+    }
+  }
   i::Handle<i::Object>* args = reinterpret_cast<i::Handle<i::Object>*>(argv);
   Local<Object> result;
   has_pending_exception = !ToLocal<Object>(
       i::Execution::New(isolate, self, self, argc, args), &result);
+  if (should_set_has_no_side_effect) {
+    i::Object* obj =
+        i::JSFunction::cast(*self)->shared()->get_api_func_data()->call_code();
+    if (obj->IsCallHandlerInfo()) {
+      i::CallHandlerInfo* handler_info = i::CallHandlerInfo::cast(obj);
+      if (has_pending_exception) {
+        // Restore the map if an exception prevented restoration.
+        handler_info->NextCallHasNoSideEffect();
+      } else {
+        DCHECK(handler_info->IsSideEffectCallHandlerInfo() ||
+               handler_info->IsSideEffectFreeCallHandlerInfo());
+      }
+    }
+  }
   RETURN_ON_FAILED_EXECUTION(Object);
   RETURN_ESCAPED(result);
 }
@@ -5174,7 +5307,7 @@ Local<Value> Function::GetDebugName() const {
   }
   auto func = i::Handle<i::JSFunction>::cast(self);
   i::Handle<i::String> name = i::JSFunction::GetDebugName(func);
-  return Utils::ToLocal(i::Handle<i::Object>(*name, name->GetIsolate()));
+  return Utils::ToLocal(i::Handle<i::Object>(*name, self->GetIsolate()));
 }
 
 
@@ -5205,7 +5338,8 @@ ScriptOrigin Function::GetScriptOrigin() const {
   }
   auto func = i::Handle<i::JSFunction>::cast(self);
   if (func->shared()->script()->IsScript()) {
-    i::Handle<i::Script> script(i::Script::cast(func->shared()->script()));
+    i::Handle<i::Script> script(i::Script::cast(func->shared()->script()),
+                                func->GetIsolate());
     return GetScriptOriginForScript(func->GetIsolate(), script);
   }
   return v8::ScriptOrigin(Local<Value>());
@@ -5222,7 +5356,8 @@ int Function::GetScriptLineNumber() const {
   }
   auto func = i::Handle<i::JSFunction>::cast(self);
   if (func->shared()->script()->IsScript()) {
-    i::Handle<i::Script> script(i::Script::cast(func->shared()->script()));
+    i::Handle<i::Script> script(i::Script::cast(func->shared()->script()),
+                                func->GetIsolate());
     return i::Script::GetLineNumber(script, func->shared()->StartPosition());
   }
   return kLineOffsetNotFound;
@@ -5236,7 +5371,8 @@ int Function::GetScriptColumnNumber() const {
   }
   auto func = i::Handle<i::JSFunction>::cast(self);
   if (func->shared()->script()->IsScript()) {
-    i::Handle<i::Script> script(i::Script::cast(func->shared()->script()));
+    i::Handle<i::Script> script(i::Script::cast(func->shared()->script()),
+                                func->GetIsolate());
     return i::Script::GetColumnNumber(script, func->shared()->StartPosition());
   }
   return kLineOffsetNotFound;
@@ -5252,7 +5388,8 @@ int Function::ScriptId() const {
   if (!func->shared()->script()->IsScript()) {
     return v8::UnboundScript::kNoScriptId;
   }
-  i::Handle<i::Script> script(i::Script::cast(func->shared()->script()));
+  i::Handle<i::Script> script(i::Script::cast(func->shared()->script()),
+                              func->GetIsolate());
   return script->id();
 }
 
@@ -5402,203 +5539,29 @@ bool String::ContainsOnlyOneByte() const {
   return helper.Check(*str);
 }
 
-
-class Utf8LengthHelper : public i::AllStatic {
- public:
-  enum State {
-    kEndsWithLeadingSurrogate = 1 << 0,
-    kStartsWithTrailingSurrogate = 1 << 1,
-    kLeftmostEdgeIsCalculated = 1 << 2,
-    kRightmostEdgeIsCalculated = 1 << 3,
-    kLeftmostEdgeIsSurrogate = 1 << 4,
-    kRightmostEdgeIsSurrogate = 1 << 5
-  };
-
-  static const uint8_t kInitialState = 0;
-
-  static inline bool EndsWithSurrogate(uint8_t state) {
-    return state & kEndsWithLeadingSurrogate;
-  }
-
-  static inline bool StartsWithSurrogate(uint8_t state) {
-    return state & kStartsWithTrailingSurrogate;
-  }
-
-  class Visitor {
-   public:
-    Visitor() : utf8_length_(0), state_(kInitialState) {}
-
-    void VisitOneByteString(const uint8_t* chars, int length) {
-      int utf8_length = 0;
-      // Add in length 1 for each non-Latin1 character.
-      for (int i = 0; i < length; i++) {
-        utf8_length += *chars++ >> 7;
-      }
-      // Add in length 1 for each character.
-      utf8_length_ = utf8_length + length;
-      state_ = kInitialState;
-    }
-
-    void VisitTwoByteString(const uint16_t* chars, int length) {
-      int utf8_length = 0;
-      int last_character = unibrow::Utf16::kNoPreviousCharacter;
-      for (int i = 0; i < length; i++) {
-        uint16_t c = chars[i];
-        utf8_length += unibrow::Utf8::Length(c, last_character);
-        last_character = c;
-      }
-      utf8_length_ = utf8_length;
-      uint8_t state = 0;
-      if (unibrow::Utf16::IsTrailSurrogate(chars[0])) {
-        state |= kStartsWithTrailingSurrogate;
-      }
-      if (unibrow::Utf16::IsLeadSurrogate(chars[length-1])) {
-        state |= kEndsWithLeadingSurrogate;
-      }
-      state_ = state;
-    }
-
-    static i::ConsString* VisitFlat(i::String* string,
-                                    int* length,
-                                    uint8_t* state) {
-      Visitor visitor;
-      i::ConsString* cons_string = i::String::VisitFlat(&visitor, string);
-      *length = visitor.utf8_length_;
-      *state = visitor.state_;
-      return cons_string;
-    }
-
-   private:
-    int utf8_length_;
-    uint8_t state_;
-    DISALLOW_COPY_AND_ASSIGN(Visitor);
-  };
-
-  static inline void MergeLeafLeft(int* length,
-                                   uint8_t* state,
-                                   uint8_t leaf_state) {
-    bool edge_surrogate = StartsWithSurrogate(leaf_state);
-    if (!(*state & kLeftmostEdgeIsCalculated)) {
-      DCHECK(!(*state & kLeftmostEdgeIsSurrogate));
-      *state |= kLeftmostEdgeIsCalculated
-          | (edge_surrogate ? kLeftmostEdgeIsSurrogate : 0);
-    } else if (EndsWithSurrogate(*state) && edge_surrogate) {
-      *length -= unibrow::Utf8::kBytesSavedByCombiningSurrogates;
-    }
-    if (EndsWithSurrogate(leaf_state)) {
-      *state |= kEndsWithLeadingSurrogate;
-    } else {
-      *state &= ~kEndsWithLeadingSurrogate;
-    }
-  }
-
-  static inline void MergeLeafRight(int* length,
-                                    uint8_t* state,
-                                    uint8_t leaf_state) {
-    bool edge_surrogate = EndsWithSurrogate(leaf_state);
-    if (!(*state & kRightmostEdgeIsCalculated)) {
-      DCHECK(!(*state & kRightmostEdgeIsSurrogate));
-      *state |= (kRightmostEdgeIsCalculated
-                 | (edge_surrogate ? kRightmostEdgeIsSurrogate : 0));
-    } else if (edge_surrogate && StartsWithSurrogate(*state)) {
-      *length -= unibrow::Utf8::kBytesSavedByCombiningSurrogates;
-    }
-    if (StartsWithSurrogate(leaf_state)) {
-      *state |= kStartsWithTrailingSurrogate;
-    } else {
-      *state &= ~kStartsWithTrailingSurrogate;
-    }
-  }
-
-  static inline void MergeTerminal(int* length,
-                                   uint8_t state,
-                                   uint8_t* state_out) {
-    DCHECK((state & kLeftmostEdgeIsCalculated) &&
-           (state & kRightmostEdgeIsCalculated));
-    if (EndsWithSurrogate(state) && StartsWithSurrogate(state)) {
-      *length -= unibrow::Utf8::kBytesSavedByCombiningSurrogates;
+// TODO(v8:7786): Deprecate this function and pass the isolate in instead.
+int String::Utf8Length() const {
+  i::Handle<i::String> str = Utils::OpenHandle(this);
+  str = i::String::Flatten(str->GetIsolate(), str);
+  int length = str->length();
+  if (length == 0) return 0;
+  i::DisallowHeapAllocation no_gc;
+  i::String::FlatContent flat = str->GetFlatContent();
+  DCHECK(flat.IsFlat());
+  int utf8_length = 0;
+  if (flat.IsOneByte()) {
+    for (uint8_t c : flat.ToOneByteVector()) {
+      utf8_length += c >> 7;
     }
-    *state_out = kInitialState |
-        (state & kLeftmostEdgeIsSurrogate ? kStartsWithTrailingSurrogate : 0) |
-        (state & kRightmostEdgeIsSurrogate ? kEndsWithLeadingSurrogate : 0);
-  }
-
-  static int Calculate(i::ConsString* current, uint8_t* state_out) {
-    using internal::ConsString;
-    int total_length = 0;
-    uint8_t state = kInitialState;
-    while (true) {
-      i::String* left = current->first();
-      i::String* right = current->second();
-      uint8_t right_leaf_state;
-      uint8_t left_leaf_state;
-      int leaf_length;
-      ConsString* left_as_cons =
-          Visitor::VisitFlat(left, &leaf_length, &left_leaf_state);
-      if (left_as_cons == nullptr) {
-        total_length += leaf_length;
-        MergeLeafLeft(&total_length, &state, left_leaf_state);
-      }
-      ConsString* right_as_cons =
-          Visitor::VisitFlat(right, &leaf_length, &right_leaf_state);
-      if (right_as_cons == nullptr) {
-        total_length += leaf_length;
-        MergeLeafRight(&total_length, &state, right_leaf_state);
-        if (left_as_cons != nullptr) {
-          // 1 Leaf node. Descend in place.
-          current = left_as_cons;
-          continue;
-        } else {
-          // Terminal node.
-          MergeTerminal(&total_length, state, state_out);
-          return total_length;
-        }
-      } else if (left_as_cons == nullptr) {
-        // 1 Leaf node. Descend in place.
-        current = right_as_cons;
-        continue;
-      }
-      // Both strings are ConsStrings.
-      // Recurse on smallest.
-      if (left->length() < right->length()) {
-        total_length += Calculate(left_as_cons, &left_leaf_state);
-        MergeLeafLeft(&total_length, &state, left_leaf_state);
-        current = right_as_cons;
-      } else {
-        total_length += Calculate(right_as_cons, &right_leaf_state);
-        MergeLeafRight(&total_length, &state, right_leaf_state);
-        current = left_as_cons;
-      }
+    utf8_length += length;
+  } else {
+    int last_character = unibrow::Utf16::kNoPreviousCharacter;
+    for (uint16_t c : flat.ToUC16Vector()) {
+      utf8_length += unibrow::Utf8::Length(c, last_character);
+      last_character = c;
     }
-    UNREACHABLE();
-  }
-
-  static inline int Calculate(i::ConsString* current) {
-    uint8_t state = kInitialState;
-    return Calculate(current, &state);
   }
-
- private:
-  DISALLOW_IMPLICIT_CONSTRUCTORS(Utf8LengthHelper);
-};
-
-
-static int Utf8Length(i::String* str, i::Isolate* isolate) {
-  int length = str->length();
-  if (length == 0) return 0;
-  uint8_t state;
-  i::ConsString* cons_string =
-      Utf8LengthHelper::Visitor::VisitFlat(str, &length, &state);
-  if (cons_string == nullptr) return length;
-  return Utf8LengthHelper::Calculate(cons_string);
-}
-
-
-int String::Utf8Length() const {
-  i::Handle<i::String> str = Utils::OpenHandle(this);
-  str = i::String::Flatten(str);
-  i::Isolate* isolate = str->GetIsolate();
-  return v8::Utf8Length(*str, isolate);
+  return utf8_length;
 }
 
 
@@ -5810,7 +5773,7 @@ int String::WriteUtf8(char* buffer,
   i::Isolate* isolate = str->GetIsolate();
   LOG_API(isolate, String, WriteUtf8);
   ENTER_V8_NO_SCRIPT_NO_EXCEPTION(isolate);
-  str = i::String::Flatten(str);  // Flatten the string for efficiency.
+  str = i::String::Flatten(isolate, str);  // Flatten the string for efficiency.
   const int string_length = str->length();
   bool write_null = !(options & NO_NULL_TERMINATION);
   bool replace_invalid_utf8 = (options & REPLACE_INVALID_UTF8);
@@ -5823,7 +5786,7 @@ int String::WriteUtf8(char* buffer,
     if (success) return writer.CompleteWrite(write_null, nchars_ref);
   } else if (capacity >= string_length) {
     // First check that the buffer is large enough.
-    int utf8_bytes = v8::Utf8Length(*str, isolate);
+    int utf8_bytes = Utf8Length();
     if (utf8_bytes <= capacity) {
       // one-byte fast path.
       if (utf8_bytes == string_length) {
@@ -5843,8 +5806,6 @@ int String::WriteUtf8(char* buffer,
       return WriteUtf8(buffer, -1, nchars_ref, options);
     }
   }
-  // Recursive slow path can potentially be unreasonable slow. Flatten.
-  str = i::String::Flatten(str);
   Utf8WriterVisitor writer(buffer, capacity, false, replace_invalid_utf8);
   i::String::VisitFlat(&writer, *str);
   return writer.CompleteWrite(write_null, nchars_ref);
@@ -5862,7 +5823,7 @@ static inline int WriteHelper(const String* string,
   ENTER_V8_NO_SCRIPT_NO_EXCEPTION(isolate);
   DCHECK(start >= 0 && length >= -1);
   i::Handle<i::String> str = Utils::OpenHandle(string);
-  str = i::String::Flatten(str);
+  str = i::String::Flatten(isolate, str);
   int end = start + length;
   if ((length == -1) || (length > str->length() - start) )
     end = str->length();
@@ -5975,7 +5936,7 @@ double Number::Value() const {
 
 bool Boolean::Value() const {
   i::Handle<i::Object> obj = Utils::OpenHandle(this);
-  return obj->IsTrue(i::HeapObject::cast(*obj)->GetIsolate());
+  return obj->IsTrue();
 }
 
 
@@ -6078,12 +6039,11 @@ void v8::Object::SetAlignedPointerInInternalFields(int argc, int indices[],
 
 static void* ExternalValue(i::Object* obj) {
   // Obscure semantics for undefined, but somehow checked in our unit tests...
-  if (!obj->IsSmi() &&
-      obj->IsUndefined(i::HeapObject::cast(obj)->GetIsolate())) {
+  if (obj->IsUndefined()) {
     return nullptr;
   }
   i::Object* foreign = i::JSObject::cast(obj)->GetEmbedderField(0);
-  return i::Foreign::cast(foreign)->foreign_address();
+  return reinterpret_cast<void*>(i::Foreign::cast(foreign)->foreign_address());
 }
 
 
@@ -6120,7 +6080,7 @@ bool V8::TryHandleSignal(int signum, void* info, void* context) {
 #endif
 
 bool V8::RegisterDefaultSignalHandler() {
-  return v8::internal::trap_handler::RegisterDefaultSignalHandler();
+  return v8::internal::trap_handler::RegisterDefaultTrapHandler();
 }
 
 bool V8::EnableWebAssemblyTrapHandler(bool use_v8_signal_handler) {
@@ -6173,7 +6133,9 @@ HeapObjectStatistics::HeapObjectStatistics()
       object_size_(0) {}
 
 HeapCodeStatistics::HeapCodeStatistics()
-    : code_and_metadata_size_(0), bytecode_and_metadata_size_(0) {}
+    : code_and_metadata_size_(0),
+      bytecode_and_metadata_size_(0),
+      external_script_source_size_(0) {}
 
 bool v8::V8::InitializeICU(const char* icu_data_file) {
   return i::InitializeICU(icu_data_file);
@@ -6276,7 +6238,7 @@ static i::Handle<ObjectType> CreateEnvironment(
             global_constructor->needs_access_check());
         global_constructor->set_needs_access_check(false);
         global_constructor->set_access_check_info(
-            isolate->heap()->undefined_value());
+            i::ReadOnlyRoots(isolate).undefined_value());
       }
 
       // Same for other interceptors. If the global constructor has
@@ -6287,14 +6249,14 @@ static i::Handle<ObjectType> CreateEnvironment(
         named_interceptor =
             handle(global_constructor->named_property_handler(), isolate);
         global_constructor->set_named_property_handler(
-            isolate->heap()->noop_interceptor_info());
+            i::ReadOnlyRoots(isolate).noop_interceptor_info());
       }
       if (!global_constructor->indexed_property_handler()->IsUndefined(
               isolate)) {
         indexed_interceptor =
             handle(global_constructor->indexed_property_handler(), isolate);
         global_constructor->set_indexed_property_handler(
-            isolate->heap()->noop_interceptor_info());
+            i::ReadOnlyRoots(isolate).noop_interceptor_info());
       }
     }
 
@@ -6467,7 +6429,8 @@ void Context::AllowCodeGenerationFromStrings(bool allow) {
   i::Isolate* isolate = context->GetIsolate();
   ENTER_V8_NO_SCRIPT_NO_EXCEPTION(isolate);
   context->set_allow_code_gen_from_strings(
-      allow ? isolate->heap()->true_value() : isolate->heap()->false_value());
+      allow ? i::ReadOnlyRoots(isolate).true_value()
+            : i::ReadOnlyRoots(isolate).false_value());
 }
 
 
@@ -6492,10 +6455,12 @@ i::Object** GetSerializedDataFromFixedArray(i::Isolate* isolate,
     i::Object* object = list->get(int_index);
     if (!object->IsTheHole(isolate)) {
       list->set_the_hole(isolate, int_index);
-      // Shrink the list so that the last element is not the hole.
+      // Shrink the list so that the last element is not the hole (unless it's
+      // the first element, because we don't want to end up with a non-canonical
+      // empty FixedArray).
       int last = list->length() - 1;
       while (last >= 0 && list->is_the_hole(isolate, last)) last--;
-      list->Shrink(last + 1);
+      if (last != -1) list->Shrink(last + 1);
       return i::Handle<i::Object>(object, isolate).location();
     }
   }
@@ -6506,7 +6471,7 @@ i::Object** GetSerializedDataFromFixedArray(i::Isolate* isolate,
 i::Object** Context::GetDataFromSnapshotOnce(size_t index) {
   auto context = Utils::OpenHandle(this);
   i::Isolate* i_isolate = context->GetIsolate();
-  i::FixedArray* list = i::FixedArray::cast(context->serialized_objects());
+  i::FixedArray* list = context->serialized_objects();
   return GetSerializedDataFromFixedArray(i_isolate, list, index);
 }
 
@@ -6514,8 +6479,8 @@ MaybeLocal<v8::Object> ObjectTemplate::NewInstance(Local<Context> context) {
   PREPARE_FOR_EXECUTION(context, ObjectTemplate, NewInstance, Object);
   auto self = Utils::OpenHandle(this);
   Local<Object> result;
-  has_pending_exception =
-      !ToLocal<Object>(i::ApiNatives::InstantiateObject(self), &result);
+  has_pending_exception = !ToLocal<Object>(
+      i::ApiNatives::InstantiateObject(isolate, self), &result);
   RETURN_ON_FAILED_EXECUTION(Object);
   RETURN_ESCAPED(result);
 }
@@ -6775,7 +6740,6 @@ MaybeLocal<String> v8::String::NewExternalTwoByte(
     i::Handle<i::String> string = i_isolate->factory()
                                       ->NewExternalStringFromTwoByte(resource)
                                       .ToHandleChecked();
-    i_isolate->heap()->RegisterExternalString(*string);
     return Utils::ToLocal(string);
   } else {
     // The resource isn't going to be used, free it immediately.
@@ -6799,7 +6763,6 @@ MaybeLocal<String> v8::String::NewExternalOneByte(
     i::Handle<i::String> string = i_isolate->factory()
                                       ->NewExternalStringFromOneByte(resource)
                                       .ToHandleChecked();
-    i_isolate->heap()->RegisterExternalString(*string);
     return Utils::ToLocal(string);
   } else {
     // The resource isn't going to be used, free it immediately.
@@ -6832,7 +6795,6 @@ bool v8::String::MakeExternal(v8::String::ExternalStringResource* resource) {
   DCHECK(!CanMakeExternal() || result);
   if (result) {
     DCHECK(obj->IsExternalString());
-    isolate->heap()->RegisterExternalString(*obj);
   }
   return result;
 }
@@ -6856,7 +6818,6 @@ bool v8::String::MakeExternal(
   DCHECK(!CanMakeExternal() || result);
   if (result) {
     DCHECK(obj->IsExternalString());
-    isolate->heap()->RegisterExternalString(*obj);
   }
   return result;
 }
@@ -6866,9 +6827,10 @@ bool v8::String::CanMakeExternal() {
   i::Handle<i::String> obj = Utils::OpenHandle(this);
   if (obj->IsExternalString()) return false;
 
-  // Old space strings should be externalized.
-  i::Isolate* isolate = obj->GetIsolate();
-  return !isolate->heap()->new_space()->Contains(*obj);
+  // Only old space strings should be externalized.
+  i::MemoryChunk* chunk = i::MemoryChunk::FromHeapObject(*obj);
+  i::AllocationSpace space = chunk->owner()->identity();
+  return space != i::NEW_SPACE && space != i::RO_SPACE;
 }
 
 
@@ -6924,15 +6886,16 @@ Local<v8::BigInt> v8::BigIntObject::ValueOf() const {
   i::Isolate* isolate = jsvalue->GetIsolate();
   LOG_API(isolate, BigIntObject, BigIntValue);
   return Utils::ToLocal(
-      i::Handle<i::BigInt>(i::BigInt::cast(jsvalue->value())));
+      i::Handle<i::BigInt>(i::BigInt::cast(jsvalue->value()), isolate));
 }
 
 Local<v8::Value> v8::BooleanObject::New(Isolate* isolate, bool value) {
   i::Isolate* i_isolate = reinterpret_cast<i::Isolate*>(isolate);
   LOG_API(i_isolate, BooleanObject, New);
   ENTER_V8_NO_SCRIPT_NO_EXCEPTION(i_isolate);
-  i::Handle<i::Object> boolean(value ? i_isolate->heap()->true_value()
-                                     : i_isolate->heap()->false_value(),
+  i::Handle<i::Object> boolean(value
+                                   ? i::ReadOnlyRoots(i_isolate).true_value()
+                                   : i::ReadOnlyRoots(i_isolate).false_value(),
                                i_isolate);
   i::Handle<i::Object> obj =
       i::Object::ToObject(i_isolate, boolean).ToHandleChecked();
@@ -6966,7 +6929,7 @@ Local<v8::String> v8::StringObject::ValueOf() const {
   i::Isolate* isolate = jsvalue->GetIsolate();
   LOG_API(isolate, StringObject, StringValue);
   return Utils::ToLocal(
-      i::Handle<i::String>(i::String::cast(jsvalue->value())));
+      i::Handle<i::String>(i::String::cast(jsvalue->value()), isolate));
 }
 
 
@@ -6986,7 +6949,7 @@ Local<v8::Symbol> v8::SymbolObject::ValueOf() const {
   i::Isolate* isolate = jsvalue->GetIsolate();
   LOG_API(isolate, SymbolObject, SymbolValue);
   return Utils::ToLocal(
-      i::Handle<i::Symbol>(i::Symbol::cast(jsvalue->value())));
+      i::Handle<i::Symbol>(i::Symbol::cast(jsvalue->value()), isolate));
 }
 
 
@@ -7062,7 +7025,8 @@ Local<v8::RegExp> v8::RegExp::New(Local<String> pattern, Flags flags) {
 
 Local<v8::String> v8::RegExp::GetSource() const {
   i::Handle<i::JSRegExp> obj = Utils::OpenHandle(this);
-  return Utils::ToLocal(i::Handle<i::String>(obj->Pattern()));
+  return Utils::ToLocal(
+      i::Handle<i::String>(obj->Pattern(), obj->GetIsolate()));
 }
 
 
@@ -7128,7 +7092,7 @@ void Map::Clear() {
   i::Isolate* isolate = self->GetIsolate();
   LOG_API(isolate, Map, Clear);
   ENTER_V8_NO_SCRIPT_NO_EXCEPTION(isolate);
-  i::JSMap::Clear(self);
+  i::JSMap::Clear(isolate, self);
 }
 
 
@@ -7199,7 +7163,8 @@ enum class MapAsArrayKind {
 i::Handle<i::JSArray> MapAsArray(i::Isolate* isolate, i::Object* table_obj,
                                  int offset, MapAsArrayKind kind) {
   i::Factory* factory = isolate->factory();
-  i::Handle<i::OrderedHashMap> table(i::OrderedHashMap::cast(table_obj));
+  i::Handle<i::OrderedHashMap> table(i::OrderedHashMap::cast(table_obj),
+                                     isolate);
   if (offset >= table->NumberOfElements()) return factory->NewJSArray(0);
   int length = (table->NumberOfElements() - offset) *
                (kind == MapAsArrayKind::kEntries ? 2 : 1);
@@ -7208,7 +7173,7 @@ i::Handle<i::JSArray> MapAsArray(i::Isolate* isolate, i::Object* table_obj,
   {
     i::DisallowHeapAllocation no_gc;
     int capacity = table->UsedCapacity();
-    i::Oddball* the_hole = isolate->heap()->the_hole_value();
+    i::Oddball* the_hole = i::ReadOnlyRoots(isolate).the_hole_value();
     for (int i = 0; i < capacity; ++i) {
       i::Object* key = table->KeyAt(i);
       if (key == the_hole) continue;
@@ -7258,7 +7223,7 @@ void Set::Clear() {
   i::Isolate* isolate = self->GetIsolate();
   LOG_API(isolate, Set, Clear);
   ENTER_V8_NO_SCRIPT_NO_EXCEPTION(isolate);
-  i::JSSet::Clear(self);
+  i::JSSet::Clear(isolate, self);
 }
 
 
@@ -7306,7 +7271,8 @@ namespace {
 i::Handle<i::JSArray> SetAsArray(i::Isolate* isolate, i::Object* table_obj,
                                  int offset) {
   i::Factory* factory = isolate->factory();
-  i::Handle<i::OrderedHashSet> table(i::OrderedHashSet::cast(table_obj));
+  i::Handle<i::OrderedHashSet> table(i::OrderedHashSet::cast(table_obj),
+                                     isolate);
   int length = table->NumberOfElements() - offset;
   if (length <= 0) return factory->NewJSArray(0);
   i::Handle<i::FixedArray> result = factory->NewFixedArray(length);
@@ -7314,7 +7280,7 @@ i::Handle<i::JSArray> SetAsArray(i::Isolate* isolate, i::Object* table_obj,
   {
     i::DisallowHeapAllocation no_gc;
     int capacity = table->UsedCapacity();
-    i::Oddball* the_hole = isolate->heap()->the_hole_value();
+    i::Oddball* the_hole = i::ReadOnlyRoots(isolate).the_hole_value();
     for (int i = 0; i < capacity; ++i) {
       i::Object* key = table->KeyAt(i);
       if (key == the_hole) continue;
@@ -7506,13 +7472,19 @@ MaybeLocal<Proxy> Proxy::New(Local<Context> context, Local<Object> local_target,
   RETURN_ESCAPED(result);
 }
 
-Local<String> WasmCompiledModule::GetWasmWireBytes() {
+WasmCompiledModule::BufferReference WasmCompiledModule::GetWasmWireBytesRef() {
   i::Handle<i::WasmModuleObject> obj =
       i::Handle<i::WasmModuleObject>::cast(Utils::OpenHandle(this));
-  i::Handle<i::WasmCompiledModule> compiled_part =
-      i::handle(obj->compiled_module());
-  i::Handle<i::String> wire_bytes(compiled_part->shared()->module_bytes());
-  return Local<String>::Cast(Utils::ToLocal(wire_bytes));
+  i::Vector<const uint8_t> bytes_vec = obj->native_module()->wire_bytes();
+  return {bytes_vec.start(), bytes_vec.size()};
+}
+
+Local<String> WasmCompiledModule::GetWasmWireBytes() {
+  BufferReference ref = GetWasmWireBytesRef();
+  CHECK_LE(ref.size, String::kMaxLength);
+  return String::NewFromOneByte(GetIsolate(), ref.start, NewStringType::kNormal,
+                                static_cast<int>(ref.size))
+      .ToLocalChecked();
 }
 
 // Currently, wasm modules are bound, both to Isolate and to
@@ -7524,63 +7496,62 @@ WasmCompiledModule::GetTransferrableModule() {
   i::DisallowHeapAllocation no_gc;
   WasmCompiledModule::SerializedModule compiled_part = Serialize();
 
-  Local<String> wire_bytes = GetWasmWireBytes();
-  size_t wire_size = static_cast<size_t>(wire_bytes->Length());
-  uint8_t* bytes = new uint8_t[wire_size];
-  wire_bytes->WriteOneByte(bytes, 0, wire_bytes->Length());
+  BufferReference wire_bytes_ref = GetWasmWireBytesRef();
+  size_t wire_size = wire_bytes_ref.size;
+  std::unique_ptr<uint8_t[]> wire_bytes_copy(new uint8_t[wire_size]);
+  memcpy(wire_bytes_copy.get(), wire_bytes_ref.start, wire_size);
 
-  return TransferrableModule(
-      std::move(compiled_part),
-      std::make_pair(
-          std::unique_ptr<const uint8_t[]>(const_cast<const uint8_t*>(bytes)),
-          wire_size));
+  return TransferrableModule(std::move(compiled_part),
+                             {std::move(wire_bytes_copy), wire_size});
 }
 
 MaybeLocal<WasmCompiledModule> WasmCompiledModule::FromTransferrableModule(
     Isolate* isolate,
     const WasmCompiledModule::TransferrableModule& transferrable_module) {
   MaybeLocal<WasmCompiledModule> ret =
-      Deserialize(isolate, AsCallerOwned(transferrable_module.compiled_code),
-                  AsCallerOwned(transferrable_module.wire_bytes));
+      Deserialize(isolate, AsReference(transferrable_module.compiled_code),
+                  AsReference(transferrable_module.wire_bytes));
   return ret;
 }
 
 WasmCompiledModule::SerializedModule WasmCompiledModule::Serialize() {
   i::Handle<i::WasmModuleObject> obj =
       i::Handle<i::WasmModuleObject>::cast(Utils::OpenHandle(this));
-  i::Handle<i::WasmCompiledModule> compiled_part =
-      i::handle(i::WasmCompiledModule::cast(obj->compiled_module()));
-  return i::wasm::SerializeNativeModule(obj->GetIsolate(), compiled_part);
+  i::wasm::NativeModule* native_module = obj->native_module();
+  size_t buffer_size =
+      i::wasm::GetSerializedNativeModuleSize(obj->GetIsolate(), native_module);
+  std::unique_ptr<uint8_t[]> buffer(new uint8_t[buffer_size]);
+  if (i::wasm::SerializeNativeModule(obj->GetIsolate(), native_module,
+                                     {buffer.get(), buffer_size}))
+    return {std::move(buffer), buffer_size};
+  return {};
 }
 
 MaybeLocal<WasmCompiledModule> WasmCompiledModule::Deserialize(
-    Isolate* isolate,
-    const WasmCompiledModule::CallerOwnedBuffer& serialized_module,
-    const WasmCompiledModule::CallerOwnedBuffer& wire_bytes) {
+    Isolate* isolate, WasmCompiledModule::BufferReference serialized_module,
+    WasmCompiledModule::BufferReference wire_bytes) {
   i::Isolate* i_isolate = reinterpret_cast<i::Isolate*>(isolate);
-  i::MaybeHandle<i::WasmCompiledModule> maybe_compiled_module =
+  i::MaybeHandle<i::WasmModuleObject> maybe_module_object =
       i::wasm::DeserializeNativeModule(
-          i_isolate, {serialized_module.first, serialized_module.second},
-          {wire_bytes.first, wire_bytes.second});
-  i::Handle<i::WasmCompiledModule> compiled_module;
-  if (!maybe_compiled_module.ToHandle(&compiled_module)) {
+          i_isolate, {serialized_module.start, serialized_module.size},
+          {wire_bytes.start, wire_bytes.size});
+  i::Handle<i::WasmModuleObject> module_object;
+  if (!maybe_module_object.ToHandle(&module_object)) {
     return MaybeLocal<WasmCompiledModule>();
   }
   return Local<WasmCompiledModule>::Cast(
-      Utils::ToLocal(i::Handle<i::JSObject>::cast(
-          i::WasmModuleObject::New(i_isolate, compiled_module))));
+      Utils::ToLocal(i::Handle<i::JSObject>::cast(module_object)));
 }
 
 MaybeLocal<WasmCompiledModule> WasmCompiledModule::DeserializeOrCompile(
-    Isolate* isolate,
-    const WasmCompiledModule::CallerOwnedBuffer& serialized_module,
-    const WasmCompiledModule::CallerOwnedBuffer& wire_bytes) {
+    Isolate* isolate, WasmCompiledModule::BufferReference serialized_module,
+    WasmCompiledModule::BufferReference wire_bytes) {
   MaybeLocal<WasmCompiledModule> ret =
       Deserialize(isolate, serialized_module, wire_bytes);
   if (!ret.IsEmpty()) {
     return ret;
   }
-  return Compile(isolate, wire_bytes.first, wire_bytes.second);
+  return Compile(isolate, wire_bytes.start, wire_bytes.size);
 }
 
 MaybeLocal<WasmCompiledModule> WasmCompiledModule::Compile(Isolate* isolate,
@@ -7599,6 +7570,38 @@ MaybeLocal<WasmCompiledModule> WasmCompiledModule::Compile(Isolate* isolate,
       Utils::ToLocal(maybe_compiled.ToHandleChecked()));
 }
 
+// Resolves the result of streaming compilation.
+// TODO(ahaas): Refactor the streaming compilation API so that this class can
+// move to wasm-js.cc.
+class AsyncCompilationResolver : public i::wasm::CompilationResultResolver {
+ public:
+  AsyncCompilationResolver(Isolate* isolate, Handle<Promise> promise)
+      : promise_(
+            reinterpret_cast<i::Isolate*>(isolate)->global_handles()->Create(
+                *Utils::OpenHandle(*promise))) {}
+
+  ~AsyncCompilationResolver() {
+    i::GlobalHandles::Destroy(i::Handle<i::Object>::cast(promise_).location());
+  }
+
+  void OnCompilationSucceeded(i::Handle<i::WasmModuleObject> result) override {
+    i::MaybeHandle<i::Object> promise_result =
+        i::JSPromise::Resolve(promise_, result);
+    CHECK_EQ(promise_result.is_null(),
+             promise_->GetIsolate()->has_pending_exception());
+  }
+
+  void OnCompilationFailed(i::Handle<i::Object> error_reason) override {
+    i::MaybeHandle<i::Object> promise_result =
+        i::JSPromise::Reject(promise_, error_reason);
+    CHECK_EQ(promise_result.is_null(),
+             promise_->GetIsolate()->has_pending_exception());
+  }
+
+ private:
+  i::Handle<i::JSPromise> promise_;
+};
+
 WasmModuleObjectBuilderStreaming::WasmModuleObjectBuilderStreaming(
     Isolate* isolate)
     : isolate_(isolate) {
@@ -7607,15 +7610,10 @@ WasmModuleObjectBuilderStreaming::WasmModuleObjectBuilderStreaming(
   Local<Promise::Resolver> resolver = maybe_resolver.ToLocalChecked();
   promise_.Reset(isolate, resolver->GetPromise());
 
-  if (i::FLAG_wasm_stream_compilation) {
-    i::Handle<i::JSPromise> promise = Utils::OpenHandle(*GetPromise());
-    i::Isolate* i_isolate = reinterpret_cast<i::Isolate*>(isolate);
-    streaming_decoder_ =
-        i_isolate->wasm_engine()
-            ->compilation_manager()
-            ->StartStreamingCompilation(i_isolate, handle(i_isolate->context()),
-                                        promise);
-  }
+  i::Isolate* i_isolate = reinterpret_cast<i::Isolate*>(isolate);
+  streaming_decoder_ = i_isolate->wasm_engine()->StartStreamingCompilation(
+      i_isolate, handle(i_isolate->context(), i_isolate),
+      base::make_unique<AsyncCompilationResolver>(isolate, GetPromise()));
 }
 
 Local<Promise> WasmModuleObjectBuilderStreaming::GetPromise() {
@@ -7624,38 +7622,11 @@ Local<Promise> WasmModuleObjectBuilderStreaming::GetPromise() {
 
 void WasmModuleObjectBuilderStreaming::OnBytesReceived(const uint8_t* bytes,
                                                        size_t size) {
-  if (i::FLAG_wasm_stream_compilation) {
-    streaming_decoder_->OnBytesReceived(i::Vector<const uint8_t>(bytes, size));
-    return;
-  }
-  std::unique_ptr<uint8_t[]> cloned_bytes(new uint8_t[size]);
-  memcpy(cloned_bytes.get(), bytes, size);
-  received_buffers_.push_back(
-      Buffer(std::unique_ptr<const uint8_t[]>(
-                 const_cast<const uint8_t*>(cloned_bytes.release())),
-             size));
-  total_size_ += size;
+  streaming_decoder_->OnBytesReceived(i::Vector<const uint8_t>(bytes, size));
 }
 
 void WasmModuleObjectBuilderStreaming::Finish() {
-  if (i::FLAG_wasm_stream_compilation) {
-    streaming_decoder_->Finish();
-    return;
-  }
-  std::unique_ptr<uint8_t[]> wire_bytes(new uint8_t[total_size_]);
-  uint8_t* insert_at = wire_bytes.get();
-
-  for (size_t i = 0; i < received_buffers_.size(); ++i) {
-    const Buffer& buff = received_buffers_[i];
-    memcpy(insert_at, buff.first.get(), buff.second);
-    insert_at += buff.second;
-  }
-  // AsyncCompile makes its own copy of the wire bytes. This inefficiency
-  // will be resolved when we move to true streaming compilation.
-  auto i_isolate = reinterpret_cast<i::Isolate*>(isolate_);
-  i_isolate->wasm_engine()->AsyncCompile(
-      i_isolate, Utils::OpenHandle(*promise_.Get(isolate_)),
-      {wire_bytes.get(), wire_bytes.get() + total_size_}, false);
+  streaming_decoder_->Finish();
 }
 
 void WasmModuleObjectBuilderStreaming::Abort(MaybeLocal<Value> exception) {
@@ -7663,7 +7634,7 @@ void WasmModuleObjectBuilderStreaming::Abort(MaybeLocal<Value> exception) {
   // The promise has already been resolved, e.g. because of a compilation
   // error.
   if (promise->State() != v8::Promise::kPending) return;
-  if (i::FLAG_wasm_stream_compilation) streaming_decoder_->Abort();
+  streaming_decoder_->Abort();
 
   // If no exception value is provided, we do not reject the promise. This can
   // happen when streaming compilation gets aborted when no script execution is
@@ -7673,7 +7644,8 @@ void WasmModuleObjectBuilderStreaming::Abort(MaybeLocal<Value> exception) {
   Local<Promise::Resolver> resolver = promise.As<Promise::Resolver>();
   i::Isolate* i_isolate = reinterpret_cast<i::Isolate*>(isolate_);
   i::HandleScope scope(i_isolate);
-  Local<Context> context = Utils::ToLocal(handle(i_isolate->context()));
+  Local<Context> context =
+      Utils::ToLocal(handle(i_isolate->context(), i_isolate));
   auto maybe = resolver->Reject(context, exception.ToLocalChecked());
   CHECK_IMPLIES(!maybe.FromMaybe(false), i_isolate->has_scheduled_exception());
 }
@@ -7713,8 +7685,7 @@ v8::ArrayBuffer::Contents v8::ArrayBuffer::Externalize() {
     // longer track it.
     //
     // TODO(eholk): Find a way to track this across externalization
-    isolate->wasm_engine()->memory_tracker()->ReleaseAllocation(
-        self->backing_store());
+    self->StopTrackingWasmMemory(isolate);
   }
   isolate->heap()->UnregisterArrayBuffer(*self);
 
@@ -7794,9 +7765,11 @@ Local<ArrayBuffer> v8::ArrayBufferView::Buffer() {
   i::Handle<i::JSArrayBufferView> obj = Utils::OpenHandle(this);
   i::Handle<i::JSArrayBuffer> buffer;
   if (obj->IsJSDataView()) {
-    i::Handle<i::JSDataView> data_view(i::JSDataView::cast(*obj));
+    i::Handle<i::JSDataView> data_view(i::JSDataView::cast(*obj),
+                                       obj->GetIsolate());
     DCHECK(data_view->buffer()->IsJSArrayBuffer());
-    buffer = i::handle(i::JSArrayBuffer::cast(data_view->buffer()));
+    buffer = i::handle(i::JSArrayBuffer::cast(data_view->buffer()),
+                       data_view->GetIsolate());
   } else {
     DCHECK(obj->IsJSTypedArray());
     buffer = i::JSTypedArray::cast(*obj)->GetBuffer();
@@ -7812,13 +7785,16 @@ size_t v8::ArrayBufferView::CopyContents(void* dest, size_t byte_length) {
       i::Min(byte_length, i::NumberToSize(self->byte_length()));
   if (bytes_to_copy) {
     i::DisallowHeapAllocation no_gc;
-    i::Handle<i::JSArrayBuffer> buffer(i::JSArrayBuffer::cast(self->buffer()));
+    i::Isolate* isolate = self->GetIsolate();
+    i::Handle<i::JSArrayBuffer> buffer(i::JSArrayBuffer::cast(self->buffer()),
+                                       isolate);
     const char* source = reinterpret_cast<char*>(buffer->backing_store());
     if (source == nullptr) {
       DCHECK(self->IsJSTypedArray());
-      i::Handle<i::JSTypedArray> typed_array(i::JSTypedArray::cast(*self));
+      i::Handle<i::JSTypedArray> typed_array(i::JSTypedArray::cast(*self),
+                                             isolate);
       i::Handle<i::FixedTypedArrayBase> fixed_array(
-          i::FixedTypedArrayBase::cast(typed_array->elements()));
+          i::FixedTypedArrayBase::cast(typed_array->elements()), isolate);
       source = reinterpret_cast<char*>(fixed_array->DataPtr());
     }
     memcpy(dest, source + byte_offset, bytes_to_copy);
@@ -7829,7 +7805,8 @@ size_t v8::ArrayBufferView::CopyContents(void* dest, size_t byte_length) {
 
 bool v8::ArrayBufferView::HasBuffer() const {
   i::Handle<i::JSArrayBufferView> self = Utils::OpenHandle(this);
-  i::Handle<i::JSArrayBuffer> buffer(i::JSArrayBuffer::cast(self->buffer()));
+  i::Handle<i::JSArrayBuffer> buffer(i::JSArrayBuffer::cast(self->buffer()),
+                                     self->GetIsolate());
   return buffer->backing_store() != nullptr;
 }
 
@@ -7942,8 +7919,7 @@ v8::SharedArrayBuffer::Contents v8::SharedArrayBuffer::Externalize() {
     // longer track it.
     //
     // TODO(eholk): Find a way to track this across externalization
-    isolate->wasm_engine()->memory_tracker()->ReleaseAllocation(
-        self->backing_store());
+    self->StopTrackingWasmMemory(isolate);
   }
   isolate->heap()->UnregisterArrayBuffer(*self);
 
@@ -8182,13 +8158,6 @@ HeapProfiler* Isolate::GetHeapProfiler() {
   return reinterpret_cast<HeapProfiler*>(heap_profiler);
 }
 
-
-CpuProfiler* Isolate::GetCpuProfiler() {
-  i::CpuProfiler* cpu_profiler =
-      reinterpret_cast<i::Isolate*>(this)->cpu_profiler();
-  return reinterpret_cast<CpuProfiler*>(cpu_profiler);
-}
-
 void Isolate::SetIdle(bool is_idle) {
   i::Isolate* isolate = reinterpret_cast<i::Isolate*>(this);
   isolate->SetIdle(is_idle);
@@ -8206,7 +8175,7 @@ v8::Local<v8::Context> Isolate::GetCurrentContext() {
   if (context == nullptr) return Local<Context>();
   i::Context* native_context = context->native_context();
   if (native_context == nullptr) return Local<Context>();
-  return Utils::ToLocal(i::Handle<i::Context>(native_context));
+  return Utils::ToLocal(i::Handle<i::Context>(native_context, isolate));
 }
 
 
@@ -8251,7 +8220,7 @@ v8::Local<Value> Isolate::ThrowException(v8::Local<v8::Value> value) {
   // If we're passed an empty handle, we throw an undefined exception
   // to deal more gracefully with out of memory situations.
   if (value.IsEmpty()) {
-    isolate->ScheduleThrow(isolate->heap()->undefined_value());
+    isolate->ScheduleThrow(i::ReadOnlyRoots(isolate).undefined_value());
   } else {
     isolate->ScheduleThrow(*Utils::OpenHandle(*value));
   }
@@ -8363,22 +8332,22 @@ Isolate* Isolate::GetCurrent() {
   return reinterpret_cast<Isolate*>(isolate);
 }
 
-
-Isolate* Isolate::New(const Isolate::CreateParams& params) {
-  i::Isolate* isolate = new i::Isolate(false);
-  return IsolateNewImpl(isolate, params);
+// static
+Isolate* Isolate::Allocate() {
+  return reinterpret_cast<Isolate*>(new i::Isolate());
 }
 
+// static
 // This is separate so that tests can provide a different |isolate|.
-Isolate* IsolateNewImpl(internal::Isolate* isolate,
-                        const v8::Isolate::CreateParams& params) {
-  Isolate* v8_isolate = reinterpret_cast<Isolate*>(isolate);
+void Isolate::Initialize(Isolate* isolate,
+                         const v8::Isolate::CreateParams& params) {
+  i::Isolate* i_isolate = reinterpret_cast<i::Isolate*>(isolate);
   CHECK_NOT_NULL(params.array_buffer_allocator);
-  isolate->set_array_buffer_allocator(params.array_buffer_allocator);
+  i_isolate->set_array_buffer_allocator(params.array_buffer_allocator);
   if (params.snapshot_blob != nullptr) {
-    isolate->set_snapshot_blob(params.snapshot_blob);
+    i_isolate->set_snapshot_blob(params.snapshot_blob);
   } else {
-    isolate->set_snapshot_blob(i::Snapshot::DefaultSnapshotBlob());
+    i_isolate->set_snapshot_blob(i::Snapshot::DefaultSnapshotBlob());
   }
   if (params.entry_hook) {
 #ifdef V8_USE_SNAPSHOT
@@ -8387,7 +8356,7 @@ Isolate* IsolateNewImpl(internal::Isolate* isolate,
         false, "v8::Isolate::New",
         "Setting a FunctionEntryHook is only supported in no-snapshot builds.");
 #endif
-    isolate->set_function_entry_hook(params.entry_hook);
+    i_isolate->set_function_entry_hook(params.entry_hook);
   }
   auto code_event_handler = params.code_event_handler;
 #ifdef ENABLE_GDB_JIT_INTERFACE
@@ -8396,44 +8365,50 @@ Isolate* IsolateNewImpl(internal::Isolate* isolate,
   }
 #endif  // ENABLE_GDB_JIT_INTERFACE
   if (code_event_handler) {
-    isolate->InitializeLoggingAndCounters();
-    isolate->logger()->SetCodeEventHandler(kJitCodeEventDefault,
-                                           code_event_handler);
+    i_isolate->InitializeLoggingAndCounters();
+    i_isolate->logger()->SetCodeEventHandler(kJitCodeEventDefault,
+                                             code_event_handler);
   }
   if (params.counter_lookup_callback) {
-    v8_isolate->SetCounterFunction(params.counter_lookup_callback);
+    isolate->SetCounterFunction(params.counter_lookup_callback);
   }
 
   if (params.create_histogram_callback) {
-    v8_isolate->SetCreateHistogramFunction(params.create_histogram_callback);
+    isolate->SetCreateHistogramFunction(params.create_histogram_callback);
   }
 
   if (params.add_histogram_sample_callback) {
-    v8_isolate->SetAddHistogramSampleFunction(
+    isolate->SetAddHistogramSampleFunction(
         params.add_histogram_sample_callback);
   }
 
-  isolate->set_api_external_references(params.external_references);
-  isolate->set_allow_atomics_wait(params.allow_atomics_wait);
+  i_isolate->set_api_external_references(params.external_references);
+  i_isolate->set_allow_atomics_wait(params.allow_atomics_wait);
 
-  SetResourceConstraints(isolate, params.constraints);
+  SetResourceConstraints(i_isolate, params.constraints);
   // TODO(jochen): Once we got rid of Isolate::Current(), we can remove this.
-  Isolate::Scope isolate_scope(v8_isolate);
-  if (params.entry_hook || !i::Snapshot::Initialize(isolate)) {
+  Isolate::Scope isolate_scope(isolate);
+  if (params.entry_hook || !i::Snapshot::Initialize(i_isolate)) {
     // If snapshot data was provided and we failed to deserialize it must
     // have been corrupted.
-    CHECK_NULL(isolate->snapshot_blob());
+    CHECK_NULL(i_isolate->snapshot_blob());
     base::ElapsedTimer timer;
     if (i::FLAG_profile_deserialization) timer.Start();
-    isolate->Init(nullptr);
+    i_isolate->Init(nullptr);
     if (i::FLAG_profile_deserialization) {
       double ms = timer.Elapsed().InMillisecondsF();
       i::PrintF("[Initializing isolate from scratch took %0.3f ms]\n", ms);
     }
   }
-  return v8_isolate;
+  i_isolate->set_only_terminate_in_safe_scope(
+      params.only_terminate_in_safe_scope);
 }
 
+Isolate* Isolate::New(const Isolate::CreateParams& params) {
+  Isolate* isolate = Allocate();
+  Initialize(isolate, params);
+  return isolate;
+}
 
 void Isolate::Dispose() {
   i::Isolate* isolate = reinterpret_cast<i::Isolate*>(this);
@@ -8540,6 +8515,16 @@ Isolate::SuppressMicrotaskExecutionScope::~SuppressMicrotaskExecutionScope() {
   isolate_->handle_scope_implementer()->DecrementCallDepth();
 }
 
+Isolate::SafeForTerminationScope::SafeForTerminationScope(v8::Isolate* isolate)
+    : isolate_(reinterpret_cast<i::Isolate*>(isolate)),
+      prev_value_(isolate_->next_v8_call_is_safe_for_termination()) {
+  isolate_->set_next_v8_call_is_safe_for_termination(true);
+}
+
+Isolate::SafeForTerminationScope::~SafeForTerminationScope() {
+  isolate_->set_next_v8_call_is_safe_for_termination(prev_value_);
+}
+
 i::Object** Isolate::GetDataFromSnapshotOnce(size_t index) {
   i::Isolate* i_isolate = reinterpret_cast<i::Isolate*>(this);
   i::FixedArray* list = i_isolate->heap()->serialized_objects();
@@ -8556,10 +8541,15 @@ void Isolate::GetHeapStatistics(HeapStatistics* heap_statistics) {
   heap_statistics->total_available_size_ = heap->Available();
   heap_statistics->used_heap_size_ = heap->SizeOfObjects();
   heap_statistics->heap_size_limit_ = heap->MaxReserved();
+  // TODO(7424): There is no public API for the {WasmEngine} yet. Once such an
+  // API becomes available we should report the malloced memory separately. For
+  // now we just add the values, thereby over-approximating the peak slightly.
   heap_statistics->malloced_memory_ =
-      isolate->allocator()->GetCurrentMemoryUsage();
+      isolate->allocator()->GetCurrentMemoryUsage() +
+      isolate->wasm_engine()->allocator()->GetCurrentMemoryUsage();
   heap_statistics->peak_malloced_memory_ =
-      isolate->allocator()->GetMaxMemoryUsage();
+      isolate->allocator()->GetMaxMemoryUsage() +
+      isolate->wasm_engine()->allocator()->GetMaxMemoryUsage();
   heap_statistics->number_of_native_contexts_ = heap->NumberOfNativeContexts();
   heap_statistics->number_of_detached_contexts_ =
       heap->NumberOfDetachedContexts();
@@ -8635,6 +8625,8 @@ bool Isolate::GetHeapCodeAndMetadataStatistics(
   code_statistics->code_and_metadata_size_ = isolate->code_and_metadata_size();
   code_statistics->bytecode_and_metadata_size_ =
       isolate->bytecode_and_metadata_size();
+  code_statistics->external_script_source_size_ =
+      isolate->external_script_source_size();
   return true;
 }
 
@@ -8703,6 +8695,15 @@ void Isolate::RemoveCallCompletedCallback(
       reinterpret_cast<CallCompletedCallback>(callback));
 }
 
+void Isolate::AtomicsWaitWakeHandle::Wake() {
+  reinterpret_cast<i::AtomicsWaitWakeHandle*>(this)->Wake();
+}
+
+void Isolate::SetAtomicsWaitCallback(AtomicsWaitCallback callback, void* data) {
+  i::Isolate* isolate = reinterpret_cast<i::Isolate*>(this);
+  isolate->SetAtomicsWaitCallback(callback, data);
+}
+
 void Isolate::SetPromiseHook(PromiseHook hook) {
   i::Isolate* isolate = reinterpret_cast<i::Isolate*>(this);
   isolate->SetPromiseHook(hook);
@@ -8833,9 +8834,9 @@ void Isolate::LowMemoryNotification() {
 int Isolate::ContextDisposedNotification(bool dependant_context) {
   i::Isolate* isolate = reinterpret_cast<i::Isolate*>(this);
   if (!dependant_context) {
-    // We left the current context, we can abort all running WebAssembly
-    // compilations.
-    isolate->wasm_engine()->compilation_manager()->AbortAllJobs();
+    // We left the current context, we can abort all WebAssembly compilations on
+    // that isolate.
+    isolate->wasm_engine()->AbortCompileJobsOnIsolate(isolate);
   }
   // TODO(ahaas): move other non-heap activity out of the heap call.
   return isolate->heap()->NotifyContextDisposed(dependant_context);
@@ -8865,6 +8866,16 @@ void Isolate::MemoryPressureNotification(MemoryPressureLevel level) {
                                                              on_isolate_thread);
 }
 
+void Isolate::EnableMemorySavingsMode() {
+  i::Isolate* isolate = reinterpret_cast<i::Isolate*>(this);
+  isolate->EnableMemorySavingsMode();
+}
+
+void Isolate::DisableMemorySavingsMode() {
+  i::Isolate* isolate = reinterpret_cast<i::Isolate*>(this);
+  isolate->DisableMemorySavingsMode();
+}
+
 void Isolate::SetRAILMode(RAILMode rail_mode) {
   i::Isolate* isolate = reinterpret_cast<i::Isolate*>(this);
   return isolate->SetRAILMode(rail_mode);
@@ -8898,7 +8909,8 @@ void Isolate::SetStackLimit(uintptr_t stack_limit) {
 void Isolate::GetCodeRange(void** start, size_t* length_in_bytes) {
   i::Isolate* isolate = reinterpret_cast<i::Isolate*>(this);
   if (isolate->heap()->memory_allocator()->code_range()->valid()) {
-    *start = isolate->heap()->memory_allocator()->code_range()->start();
+    *start = reinterpret_cast<void*>(
+        isolate->heap()->memory_allocator()->code_range()->start());
     *length_in_bytes =
         isolate->heap()->memory_allocator()->code_range()->size();
   } else {
@@ -8959,7 +8971,7 @@ bool Isolate::AddMessageListenerWithErrorLevel(MessageCallback that,
   i::Handle<i::Foreign> foreign =
       isolate->factory()->NewForeign(FUNCTION_ADDR(that));
   listener->set(0, *foreign);
-  listener->set(1, data.IsEmpty() ? isolate->heap()->undefined_value()
+  listener->set(1, data.IsEmpty() ? i::ReadOnlyRoots(isolate).undefined_value()
                                   : *Utils::OpenHandle(*data));
   listener->set(2, i::Smi::FromInt(message_levels));
   list = i::TemplateList::Add(isolate, list, listener);
@@ -8979,7 +8991,7 @@ void Isolate::RemoveMessageListeners(MessageCallback that) {
     i::FixedArray* listener = i::FixedArray::cast(listeners->get(i));
     i::Foreign* callback_obj = i::Foreign::cast(listener->get(0));
     if (callback_obj->foreign_address() == FUNCTION_ADDR(that)) {
-      listeners->set(i, isolate->heap()->undefined_value());
+      listeners->set(i, i::ReadOnlyRoots(isolate).undefined_value());
     }
   }
 }
@@ -9095,8 +9107,7 @@ String::Utf8Value::Utf8Value(v8::Isolate* isolate, v8::Local<v8::Value> obj)
   TryCatch try_catch(isolate);
   Local<String> str;
   if (!obj->ToString(context).ToLocal(&str)) return;
-  i::Handle<i::String> i_str = Utils::OpenHandle(*str);
-  length_ = v8::Utf8Length(*i_str, i_isolate);
+  length_ = str->Utf8Length();
   str_ = i::NewArray<char>(length_ + 1);
   str->WriteUtf8(str_);
 }
@@ -9197,41 +9208,14 @@ v8_inspector::V8Inspector* debug::GetInspector(Isolate* isolate) {
   return reinterpret_cast<i::Isolate*>(isolate)->inspector();
 }
 
-Local<Context> debug::GetDebugContext(Isolate* isolate) {
-  i::Isolate* i_isolate = reinterpret_cast<i::Isolate*>(isolate);
-  ENTER_V8_NO_SCRIPT_NO_EXCEPTION(i_isolate);
-  return Utils::ToLocal(i_isolate->debug()->GetDebugContext());
+void debug::SetBreakOnNextFunctionCall(Isolate* isolate) {
+  reinterpret_cast<i::Isolate*>(isolate)->debug()->SetBreakOnNextFunctionCall();
 }
 
-MaybeLocal<Value> debug::Call(Local<Context> context,
-                              v8::Local<v8::Function> fun,
-                              v8::Local<v8::Value> data) {
-  PREPARE_FOR_EXECUTION(context, Debug, Call, Value);
-  i::Handle<i::Object> data_obj;
-  if (data.IsEmpty()) {
-    data_obj = isolate->factory()->undefined_value();
-  } else {
-    data_obj = Utils::OpenHandle(*data);
-  }
-  Local<Value> result;
-  has_pending_exception = !ToLocal<Value>(
-      isolate->debug()->Call(Utils::OpenHandle(*fun), data_obj), &result);
-  RETURN_ON_FAILED_EXECUTION(Value);
-  RETURN_ESCAPED(result);
-}
-
-void debug::SetLiveEditEnabled(Isolate* isolate, bool enable) {
-  i::Isolate* internal_isolate = reinterpret_cast<i::Isolate*>(isolate);
-  internal_isolate->debug()->set_live_edit_enabled(enable);
-}
-
-void debug::DebugBreak(Isolate* isolate) {
-  reinterpret_cast<i::Isolate*>(isolate)->stack_guard()->RequestDebugBreak();
-}
-
-void debug::CancelDebugBreak(Isolate* isolate) {
-  i::Isolate* internal_isolate = reinterpret_cast<i::Isolate*>(isolate);
-  internal_isolate->stack_guard()->ClearDebugBreak();
+void debug::ClearBreakOnNextFunctionCall(Isolate* isolate) {
+  reinterpret_cast<i::Isolate*>(isolate)
+      ->debug()
+      ->ClearBreakOnNextFunctionCall();
 }
 
 MaybeLocal<Array> debug::GetInternalProperties(Isolate* v8_isolate,
@@ -9259,11 +9243,6 @@ void debug::SetBreakPointsActive(Isolate* v8_isolate, bool is_active) {
   isolate->debug()->set_break_points_active(is_active);
 }
 
-void debug::SetOutOfMemoryCallback(Isolate* isolate,
-                                   OutOfMemoryCallback callback, void* data) {
-  // No-op.
-}
-
 void debug::PrepareStep(Isolate* v8_isolate, StepAction action) {
   i::Isolate* isolate = reinterpret_cast<i::Isolate*>(v8_isolate);
   ENTER_V8_DO_NOT_USE(isolate);
@@ -9308,7 +9287,8 @@ bool debug::Script::WasCompiled() const {
 
 bool debug::Script::IsEmbedded() const {
   i::Handle<i::Script> script = Utils::OpenHandle(this);
-  return script->context_data() == script->GetHeap()->uninitialized_symbol();
+  return script->context_data() ==
+         script->GetReadOnlyRoots().uninitialized_symbol();
 }
 
 int debug::Script::Id() const { return Utils::OpenHandle(this)->id(); }
@@ -9328,7 +9308,8 @@ std::vector<int> debug::Script::LineEnds() const {
   i::HandleScope scope(isolate);
   i::Script::InitLineEnds(script);
   CHECK(script->line_ends()->IsFixedArray());
-  i::Handle<i::FixedArray> line_ends(i::FixedArray::cast(script->line_ends()));
+  i::Handle<i::FixedArray> line_ends(i::FixedArray::cast(script->line_ends()),
+                                     isolate);
   std::vector<int> result(line_ends->length());
   for (int i = 0; i < line_ends->length(); ++i) {
     i::Smi* line_end = i::Smi::cast(line_ends->get(i));
@@ -9412,9 +9393,9 @@ bool debug::Script::GetPossibleBreakpoints(
   CHECK(!start.IsEmpty());
   i::Handle<i::Script> script = Utils::OpenHandle(this);
   if (script->type() == i::Script::TYPE_WASM) {
-    i::WasmSharedModuleData* shared =
-        i::WasmCompiledModule::cast(script->wasm_compiled_module())->shared();
-    return shared->GetPossibleBreakpoints(start, end, locations);
+    i::WasmModuleObject* module_object =
+        i::WasmModuleObject::cast(script->wasm_module_object());
+    return module_object->GetPossibleBreakpoints(start, end, locations);
   }
 
   i::Script::InitLineEnds(script);
@@ -9462,8 +9443,7 @@ bool debug::Script::GetPossibleBreakpoints(
 int debug::Script::GetSourceOffset(const debug::Location& location) const {
   i::Handle<i::Script> script = Utils::OpenHandle(this);
   if (script->type() == i::Script::TYPE_WASM) {
-    return i::WasmCompiledModule::cast(script->wasm_compiled_module())
-               ->shared()
+    return i::WasmModuleObject::cast(script->wasm_module_object())
                ->GetFunctionOffset(location.GetLineNumber()) +
            location.GetColumnNumber();
   }
@@ -9495,11 +9475,12 @@ v8::debug::Location debug::Script::GetSourceLocation(int offset) const {
 }
 
 bool debug::Script::SetScriptSource(v8::Local<v8::String> newSource,
-                                    bool preview, bool* stack_changed) const {
+                                    bool preview,
+                                    debug::LiveEditResult* result) const {
   i::Handle<i::Script> script = Utils::OpenHandle(this);
   i::Isolate* isolate = script->GetIsolate();
   return isolate->debug()->SetScriptSource(
-      script, Utils::OpenHandle(*newSource), preview, stack_changed);
+      script, Utils::OpenHandle(*newSource), preview, result);
 }
 
 bool debug::Script::SetBreakpoint(v8::Local<v8::String> condition,
@@ -9522,6 +9503,10 @@ void debug::RemoveBreakpoint(Isolate* v8_isolate, BreakpointId id) {
   isolate->debug()->RemoveBreakpoint(id);
 }
 
+v8::Platform* debug::GetCurrentPlatform() {
+  return i::V8::GetCurrentPlatform();
+}
+
 debug::WasmScript* debug::WasmScript::Cast(debug::Script* script) {
   CHECK(script->IsWasm());
   return static_cast<WasmScript*>(script);
@@ -9531,9 +9516,9 @@ int debug::WasmScript::NumFunctions() const {
   i::DisallowHeapAllocation no_gc;
   i::Handle<i::Script> script = Utils::OpenHandle(this);
   DCHECK_EQ(i::Script::TYPE_WASM, script->type());
-  i::WasmCompiledModule* compiled_module =
-      i::WasmCompiledModule::cast(script->wasm_compiled_module());
-  i::wasm::WasmModule* module = compiled_module->shared()->module();
+  i::WasmModuleObject* module_object =
+      i::WasmModuleObject::cast(script->wasm_module_object());
+  const i::wasm::WasmModule* module = module_object->module();
   DCHECK_GE(i::kMaxInt, module->functions.size());
   return static_cast<int>(module->functions.size());
 }
@@ -9542,9 +9527,9 @@ int debug::WasmScript::NumImportedFunctions() const {
   i::DisallowHeapAllocation no_gc;
   i::Handle<i::Script> script = Utils::OpenHandle(this);
   DCHECK_EQ(i::Script::TYPE_WASM, script->type());
-  i::WasmCompiledModule* compiled_module =
-      i::WasmCompiledModule::cast(script->wasm_compiled_module());
-  i::wasm::WasmModule* module = compiled_module->shared()->module();
+  i::WasmModuleObject* module_object =
+      i::WasmModuleObject::cast(script->wasm_module_object());
+  const i::wasm::WasmModule* module = module_object->module();
   DCHECK_GE(i::kMaxInt, module->num_imported_functions);
   return static_cast<int>(module->num_imported_functions);
 }
@@ -9554,12 +9539,12 @@ std::pair<int, int> debug::WasmScript::GetFunctionRange(
   i::DisallowHeapAllocation no_gc;
   i::Handle<i::Script> script = Utils::OpenHandle(this);
   DCHECK_EQ(i::Script::TYPE_WASM, script->type());
-  i::WasmCompiledModule* compiled_module =
-      i::WasmCompiledModule::cast(script->wasm_compiled_module());
-  i::wasm::WasmModule* module = compiled_module->shared()->module();
+  i::WasmModuleObject* module_object =
+      i::WasmModuleObject::cast(script->wasm_module_object());
+  const i::wasm::WasmModule* module = module_object->module();
   DCHECK_LE(0, function_index);
   DCHECK_GT(module->functions.size(), function_index);
-  i::wasm::WasmFunction& func = module->functions[function_index];
+  const i::wasm::WasmFunction& func = module->functions[function_index];
   DCHECK_GE(i::kMaxInt, func.code.offset());
   DCHECK_GE(i::kMaxInt, func.code.end_offset());
   return std::make_pair(static_cast<int>(func.code.offset()),
@@ -9570,15 +9555,14 @@ uint32_t debug::WasmScript::GetFunctionHash(int function_index) {
   i::DisallowHeapAllocation no_gc;
   i::Handle<i::Script> script = Utils::OpenHandle(this);
   DCHECK_EQ(i::Script::TYPE_WASM, script->type());
-  i::WasmCompiledModule* compiled_module =
-      i::WasmCompiledModule::cast(script->wasm_compiled_module());
-  i::wasm::WasmModule* module = compiled_module->shared()->module();
+  i::WasmModuleObject* module_object =
+      i::WasmModuleObject::cast(script->wasm_module_object());
+  const i::wasm::WasmModule* module = module_object->module();
   DCHECK_LE(0, function_index);
   DCHECK_GT(module->functions.size(), function_index);
-  i::wasm::WasmFunction& func = module->functions[function_index];
-  i::SeqOneByteString* module_bytes = compiled_module->shared()->module_bytes();
+  const i::wasm::WasmFunction& func = module->functions[function_index];
   i::wasm::ModuleWireBytes wire_bytes(
-      module_bytes->GetFlatContent().ToOneByteVector());
+      module_object->native_module()->wire_bytes());
   i::Vector<const i::byte> function_bytes = wire_bytes.GetFunctionBytes(&func);
   // TODO(herhut): Maybe also take module, name and signature into account.
   return i::StringHasher::HashSequentialString(function_bytes.start(),
@@ -9590,9 +9574,9 @@ debug::WasmDisassembly debug::WasmScript::DisassembleFunction(
   i::DisallowHeapAllocation no_gc;
   i::Handle<i::Script> script = Utils::OpenHandle(this);
   DCHECK_EQ(i::Script::TYPE_WASM, script->type());
-  i::WasmCompiledModule* compiled_module =
-      i::WasmCompiledModule::cast(script->wasm_compiled_module());
-  return compiled_module->shared()->DisassembleFunction(function_index);
+  i::WasmModuleObject* module_object =
+      i::WasmModuleObject::cast(script->wasm_module_object());
+  return module_object->DisassembleFunction(function_index);
 }
 
 debug::Location::Location(int line_number, int column_number)
@@ -9661,9 +9645,12 @@ MaybeLocal<UnboundScript> debug::CompileInspectorScript(Isolate* v8_isolate,
 void debug::SetDebugDelegate(Isolate* v8_isolate,
                              debug::DebugDelegate* delegate) {
   i::Isolate* isolate = reinterpret_cast<i::Isolate*>(v8_isolate);
-  // Might create the Debug context.
-  ENTER_V8_FOR_NEW_CONTEXT(isolate);
-  isolate->debug()->SetDebugDelegate(delegate, false);
+  isolate->debug()->SetDebugDelegate(delegate);
+}
+
+void debug::SetAsyncEventDelegate(Isolate* v8_isolate,
+                                  debug::AsyncEventDelegate* delegate) {
+  reinterpret_cast<i::Isolate*>(v8_isolate)->set_async_event_delegate(delegate);
 }
 
 void debug::ResetBlackboxedStateCache(Isolate* v8_isolate,
@@ -9671,9 +9658,12 @@ void debug::ResetBlackboxedStateCache(Isolate* v8_isolate,
   i::Isolate* isolate = reinterpret_cast<i::Isolate*>(v8_isolate);
   ENTER_V8_NO_SCRIPT_NO_EXCEPTION(isolate);
   i::DisallowHeapAllocation no_gc;
-  i::SharedFunctionInfo::ScriptIterator iter(Utils::OpenHandle(*script));
+  i::SharedFunctionInfo::ScriptIterator iter(isolate,
+                                             *Utils::OpenHandle(*script));
   while (i::SharedFunctionInfo* info = iter.Next()) {
-    info->set_computed_debug_is_blackboxed(false);
+    if (info->HasDebugInfo()) {
+      info->GetDebugInfo()->set_computed_debug_is_blackboxed(false);
+    }
   }
 }
 
@@ -9801,7 +9791,7 @@ MaybeLocal<debug::Script> debug::GeneratorObject::Script() {
 
 Local<Function> debug::GeneratorObject::Function() {
   i::Handle<i::JSGeneratorObject> obj = Utils::OpenHandle(this);
-  return Utils::ToLocal(handle(obj->function()));
+  return Utils::ToLocal(handle(obj->function(), obj->GetIsolate()));
 }
 
 debug::Location debug::GeneratorObject::SuspendedLocation() {
@@ -9853,17 +9843,19 @@ void debug::GlobalLexicalScopeNames(
     v8::Local<v8::Context> v8_context,
     v8::PersistentValueVector<v8::String>* names) {
   i::Handle<i::Context> context = Utils::OpenHandle(*v8_context);
+  i::Isolate* isolate = context->GetIsolate();
   i::Handle<i::ScriptContextTable> table(
-      context->global_object()->native_context()->script_context_table());
+      context->global_object()->native_context()->script_context_table(),
+      isolate);
   for (int i = 0; i < table->used(); i++) {
     i::Handle<i::Context> context = i::ScriptContextTable::GetContext(table, i);
     DCHECK(context->IsScriptContext());
-    i::Handle<i::ScopeInfo> scope_info(context->scope_info());
+    i::Handle<i::ScopeInfo> scope_info(context->scope_info(), isolate);
     int local_count = scope_info->ContextLocalCount();
     for (int j = 0; j < local_count; ++j) {
       i::String* name = scope_info->ContextLocalName(j);
       if (i::ScopeInfo::VariableIsSynthetic(name)) continue;
-      names->Append(Utils::ToLocal(handle(name)));
+      names->Append(Utils::ToLocal(handle(name, isolate)));
     }
   }
 }
@@ -9917,16 +9909,11 @@ int64_t debug::GetNextRandomInt64(v8::Isolate* v8_isolate) {
 }
 
 int debug::GetDebuggingId(v8::Local<v8::Function> function) {
-  i::JSReceiver* callable = *v8::Utils::OpenHandle(*function);
-  if (!callable->IsJSFunction()) return i::SharedFunctionInfo::kNoDebuggingId;
-  i::JSFunction* fun = i::JSFunction::cast(callable);
-  i::SharedFunctionInfo* shared = fun->shared();
-  int id = shared->debugging_id();
-  if (id == i::SharedFunctionInfo::kNoDebuggingId) {
-    id = shared->GetHeap()->NextDebuggingId();
-    shared->set_debugging_id(id);
-  }
-  DCHECK_NE(i::SharedFunctionInfo::kNoDebuggingId, id);
+  i::Handle<i::JSReceiver> callable = v8::Utils::OpenHandle(*function);
+  if (!callable->IsJSFunction()) return i::DebugInfo::kNoDebuggingId;
+  i::Handle<i::JSFunction> func = i::Handle<i::JSFunction>::cast(callable);
+  int id = func->GetIsolate()->debug()->GetFunctionDebuggingId(func);
+  DCHECK_NE(i::DebugInfo::kNoDebuggingId, id);
   return id;
 }
 
@@ -9945,21 +9932,20 @@ bool debug::SetFunctionBreakpoint(v8::Local<v8::Function> function,
                                                     condition_string, id);
 }
 
+debug::PostponeInterruptsScope::PostponeInterruptsScope(v8::Isolate* isolate)
+    : scope_(
+          new i::PostponeInterruptsScope(reinterpret_cast<i::Isolate*>(isolate),
+                                         i::StackGuard::API_INTERRUPT)) {}
+
+debug::PostponeInterruptsScope::~PostponeInterruptsScope() {}
+
 Local<String> CpuProfileNode::GetFunctionName() const {
   const i::ProfileNode* node = reinterpret_cast<const i::ProfileNode*>(this);
   i::Isolate* isolate = node->isolate();
   const i::CodeEntry* entry = node->entry();
   i::Handle<i::String> name =
       isolate->factory()->InternalizeUtf8String(entry->name());
-  if (!entry->has_name_prefix()) {
-    return ToApiHandle<String>(name);
-  } else {
-    // We do not expect this to fail. Change this if it does.
-    i::Handle<i::String> cons = isolate->factory()->NewConsString(
-        isolate->factory()->InternalizeUtf8String(entry->name_prefix()),
-        name).ToHandleChecked();
-    return ToApiHandle<String>(cons);
-  }
+  return ToApiHandle<String>(name);
 }
 
 int debug::Coverage::BlockData::StartOffset() const { return block_->start; }
@@ -10099,7 +10085,7 @@ const char* CpuProfileNode::GetScriptResourceNameStr() const {
 }
 
 int CpuProfileNode::GetLineNumber() const {
-  return reinterpret_cast<const i::ProfileNode*>(this)->entry()->line_number();
+  return reinterpret_cast<const i::ProfileNode*>(this)->line_number();
 }
 
 
@@ -10237,9 +10223,14 @@ void CpuProfiler::CollectSample() {
 
 void CpuProfiler::StartProfiling(Local<String> title, bool record_samples) {
   reinterpret_cast<i::CpuProfiler*>(this)->StartProfiling(
-      *Utils::OpenHandle(*title), record_samples);
+      *Utils::OpenHandle(*title), record_samples, kLeafNodeLineNumbers);
 }
 
+void CpuProfiler::StartProfiling(Local<String> title, CpuProfilingMode mode,
+                                 bool record_samples) {
+  reinterpret_cast<i::CpuProfiler*>(this)->StartProfiling(
+      *Utils::OpenHandle(*title), record_samples, mode);
+}
 
 CpuProfile* CpuProfiler::StopProfiling(Local<String> title) {
   return reinterpret_cast<CpuProfile*>(
@@ -10558,9 +10549,25 @@ void HeapProfiler::SetGetRetainerInfosCallback(
 }
 
 void HeapProfiler::SetBuildEmbedderGraphCallback(
-    BuildEmbedderGraphCallback callback) {
-  reinterpret_cast<i::HeapProfiler*>(this)->SetBuildEmbedderGraphCallback(
-      callback);
+    LegacyBuildEmbedderGraphCallback callback) {
+  reinterpret_cast<i::HeapProfiler*>(this)->AddBuildEmbedderGraphCallback(
+      [](v8::Isolate* isolate, v8::EmbedderGraph* graph, void* data) {
+        reinterpret_cast<LegacyBuildEmbedderGraphCallback>(data)(isolate,
+                                                                 graph);
+      },
+      reinterpret_cast<void*>(callback));
+}
+
+void HeapProfiler::AddBuildEmbedderGraphCallback(
+    BuildEmbedderGraphCallback callback, void* data) {
+  reinterpret_cast<i::HeapProfiler*>(this)->AddBuildEmbedderGraphCallback(
+      callback, data);
+}
+
+void HeapProfiler::RemoveBuildEmbedderGraphCallback(
+    BuildEmbedderGraphCallback callback, void* data) {
+  reinterpret_cast<i::HeapProfiler*>(this)->RemoveBuildEmbedderGraphCallback(
+      callback, data);
 }
 
 v8::Testing::StressType internal::Testing::stress_type_ =
@@ -10788,8 +10795,7 @@ void InvokeAccessorGetterCallback(
   Isolate* isolate = reinterpret_cast<Isolate*>(info.GetIsolate());
   RuntimeCallTimerScope timer(isolate,
                               RuntimeCallCounterId::kAccessorGetterCallback);
-  Address getter_address = reinterpret_cast<Address>(reinterpret_cast<intptr_t>(
-      getter));
+  Address getter_address = reinterpret_cast<Address>(getter);
   VMState<EXTERNAL> state(isolate);
   ExternalCallbackScope call_scope(isolate, getter_address);
   getter(property, info);
@@ -10801,8 +10807,7 @@ void InvokeFunctionCallback(const v8::FunctionCallbackInfo<v8::Value>& info,
   Isolate* isolate = reinterpret_cast<Isolate*>(info.GetIsolate());
   RuntimeCallTimerScope timer(isolate,
                               RuntimeCallCounterId::kInvokeFunctionCallback);
-  Address callback_address =
-      reinterpret_cast<Address>(reinterpret_cast<intptr_t>(callback));
+  Address callback_address = reinterpret_cast<Address>(callback);
   VMState<EXTERNAL> state(isolate);
   ExternalCallbackScope call_scope(isolate, callback_address);
   callback(info);
diff --git a/deps/v8/src/api.h b/deps/v8/src/api.h
index c67de0482df66c..4cc35bea6a82f4 100644
--- a/deps/v8/src/api.h
+++ b/deps/v8/src/api.h
@@ -12,6 +12,8 @@
 #include "src/heap/factory.h"
 #include "src/isolate.h"
 #include "src/objects/js-collection.h"
+#include "src/objects/js-promise.h"
+#include "src/objects/module.h"
 
 namespace v8 {
 
@@ -31,10 +33,14 @@ template <typename T> inline T ToCData(v8::internal::Object* obj) {
   STATIC_ASSERT(sizeof(T) == sizeof(v8::internal::Address));
   if (obj == v8::internal::Smi::kZero) return nullptr;
   return reinterpret_cast<T>(
-      reinterpret_cast<intptr_t>(
-          v8::internal::Foreign::cast(obj)->foreign_address()));
+      v8::internal::Foreign::cast(obj)->foreign_address());
 }
 
+template <>
+inline v8::internal::Address ToCData(v8::internal::Object* obj) {
+  if (obj == v8::internal::Smi::kZero) return v8::internal::kNullAddress;
+  return v8::internal::Foreign::cast(obj)->foreign_address();
+}
 
 template <typename T>
 inline v8::internal::Handle<v8::internal::Object> FromCData(
@@ -42,9 +48,17 @@ inline v8::internal::Handle<v8::internal::Object> FromCData(
   STATIC_ASSERT(sizeof(T) == sizeof(v8::internal::Address));
   if (obj == nullptr) return handle(v8::internal::Smi::kZero, isolate);
   return isolate->factory()->NewForeign(
-      reinterpret_cast<v8::internal::Address>(reinterpret_cast<intptr_t>(obj)));
+      reinterpret_cast<v8::internal::Address>(obj));
 }
 
+template <>
+inline v8::internal::Handle<v8::internal::Object> FromCData(
+    v8::internal::Isolate* isolate, v8::internal::Address obj) {
+  if (obj == v8::internal::kNullAddress) {
+    return handle(v8::internal::Smi::kZero, isolate);
+  }
+  return isolate->factory()->NewForeign(obj);
+}
 
 class ApiFunction {
  public:
@@ -100,6 +114,7 @@ class RegisteredExtension {
   V(String, String)                            \
   V(Symbol, Symbol)                            \
   V(Script, JSFunction)                        \
+  V(UnboundModuleScript, SharedFunctionInfo)   \
   V(UnboundScript, SharedFunctionInfo)         \
   V(Module, Module)                            \
   V(Function, JSReceiver)                      \
@@ -235,9 +250,7 @@ OPEN_HANDLE_LIST(DECLARE_OPEN_HANDLE)
 
   template<class From, class To>
   static inline Local<To> Convert(v8::internal::Handle<From> obj) {
-    DCHECK(obj.is_null() ||
-           (obj->IsSmi() ||
-            !obj->IsTheHole(i::HeapObject::cast(*obj)->GetIsolate())));
+    DCHECK(obj.is_null() || (obj->IsSmi() || !obj->IsTheHole()));
     return Local<To>(reinterpret_cast<To*>(obj.location()));
   }
 
@@ -365,9 +378,6 @@ OPEN_HANDLE_LIST(MAKE_OPEN_HANDLE)
 #undef MAKE_OPEN_HANDLE
 #undef OPEN_HANDLE_LIST
 
-extern Isolate* IsolateNewImpl(internal::Isolate* isolate,
-                               const Isolate::CreateParams& params);
-
 namespace internal {
 
 class V8_EXPORT_PRIVATE DeferredHandles {
@@ -625,7 +635,7 @@ bool HandleScopeImplementer::LastEnteredContextWas(Handle<Context> context) {
 
 Handle<Context> HandleScopeImplementer::LastEnteredContext() {
   if (entered_contexts_.empty()) return Handle<Context>::null();
-  return Handle<Context>(entered_contexts_.back());
+  return Handle<Context>(entered_contexts_.back(), isolate_);
 }
 
 void HandleScopeImplementer::EnterMicrotaskContext(Handle<Context> context) {
@@ -640,7 +650,7 @@ void HandleScopeImplementer::LeaveMicrotaskContext() {
 }
 
 Handle<Context> HandleScopeImplementer::MicrotaskContext() {
-  if (microtask_context_) return Handle<Context>(microtask_context_);
+  if (microtask_context_) return Handle<Context>(microtask_context_, isolate_);
   return Handle<Context>::null();
 }
 
diff --git a/deps/v8/src/arguments.h b/deps/v8/src/arguments.h
index d01e77314a8b88..bef9cba6988d16 100644
--- a/deps/v8/src/arguments.h
+++ b/deps/v8/src/arguments.h
@@ -81,7 +81,7 @@ double ClobberDoubleRegisters(double x1, double x2, double x3, double x4);
 // TODO(cbruni): add global flag to check whether any tracing events have been
 // enabled.
 #define RUNTIME_FUNCTION_RETURNS_TYPE(Type, Name)                             \
-  static INLINE(Type __RT_impl_##Name(Arguments args, Isolate* isolate));     \
+  static V8_INLINE Type __RT_impl_##Name(Arguments args, Isolate* isolate);   \
                                                                               \
   V8_NOINLINE static Type Stats_##Name(int args_length, Object** args_object, \
                                        Isolate* isolate) {                    \
diff --git a/deps/v8/src/arm/assembler-arm-inl.h b/deps/v8/src/arm/assembler-arm-inl.h
index 280e4ddfae7444..a432e44814986f 100644
--- a/deps/v8/src/arm/assembler-arm-inl.h
+++ b/deps/v8/src/arm/assembler-arm-inl.h
@@ -60,14 +60,17 @@ void RelocInfo::apply(intptr_t delta) {
     // absolute code pointer inside code object moves with the code object.
     int32_t* p = reinterpret_cast<int32_t*>(pc_);
     *p += delta;  // relocate entry
+  } else if (RelocInfo::IsRelativeCodeTarget(rmode_)) {
+    Instruction* branch = Instruction::At(pc_);
+    int32_t branch_offset = branch->GetBranchOffset() + delta;
+    branch->SetBranchOffset(branch_offset);
   }
-  // We do not use pc relative addressing on ARM, so there is
-  // nothing else to do.
 }
 
 
 Address RelocInfo::target_address() {
-  DCHECK(IsCodeTarget(rmode_) || IsRuntimeEntry(rmode_) || IsWasmCall(rmode_));
+  DCHECK(IsCodeTargetMode(rmode_) || IsRuntimeEntry(rmode_) ||
+         IsWasmCall(rmode_));
   return Assembler::target_address_at(pc_, constant_pool_);
 }
 
@@ -76,7 +79,7 @@ Address RelocInfo::target_address_address() {
          IsEmbeddedObject(rmode_) || IsExternalReference(rmode_) ||
          IsOffHeapTarget(rmode_));
   if (Assembler::IsMovW(Memory::int32_at(pc_))) {
-    return reinterpret_cast<Address>(pc_);
+    return pc_;
   } else {
     DCHECK(Assembler::IsLdrPcImmediateOffset(Memory::int32_at(pc_)));
     return constant_pool_entry_address();
@@ -101,12 +104,15 @@ HeapObject* RelocInfo::target_object() {
 }
 
 Handle<HeapObject> RelocInfo::target_object_handle(Assembler* origin) {
-  DCHECK(IsCodeTarget(rmode_) || rmode_ == EMBEDDED_OBJECT);
-  return Handle<HeapObject>(reinterpret_cast<HeapObject**>(
-      Assembler::target_address_at(pc_, constant_pool_)));
+  if (IsCodeTarget(rmode_) || rmode_ == EMBEDDED_OBJECT) {
+    return Handle<HeapObject>(reinterpret_cast<HeapObject**>(
+        Assembler::target_address_at(pc_, constant_pool_)));
+  }
+  DCHECK(IsRelativeCodeTarget(rmode_));
+  return origin->relative_code_target_object_handle_at(pc_);
 }
 
-void RelocInfo::set_target_object(HeapObject* target,
+void RelocInfo::set_target_object(Heap* heap, HeapObject* target,
                                   WriteBarrierMode write_barrier_mode,
                                   ICacheFlushMode icache_flush_mode) {
   DCHECK(IsCodeTarget(rmode_) || rmode_ == EMBEDDED_OBJECT);
@@ -114,9 +120,8 @@ void RelocInfo::set_target_object(HeapObject* target,
                                    reinterpret_cast<Address>(target),
                                    icache_flush_mode);
   if (write_barrier_mode == UPDATE_WRITE_BARRIER && host() != nullptr) {
-    host()->GetHeap()->incremental_marking()->RecordWriteIntoCode(host(), this,
-                                                                  target);
-    host()->GetHeap()->RecordWriteIntoCode(host(), this, target);
+    heap->incremental_marking()->RecordWriteIntoCode(host(), this, target);
+    heap->RecordWriteIntoCode(host(), this, target);
   }
 }
 
@@ -141,14 +146,7 @@ Address RelocInfo::target_internal_reference() {
 
 Address RelocInfo::target_internal_reference_address() {
   DCHECK(rmode_ == INTERNAL_REFERENCE);
-  return reinterpret_cast<Address>(pc_);
-}
-
-void RelocInfo::set_wasm_code_table_entry(Address target,
-                                          ICacheFlushMode icache_flush_mode) {
-  DCHECK(rmode_ == RelocInfo::WASM_CODE_TABLE_ENTRY);
-  Assembler::set_target_address_at(pc_, constant_pool_, target,
-                                   icache_flush_mode);
+  return pc_;
 }
 
 Address RelocInfo::target_runtime_entry(Assembler* origin) {
@@ -174,18 +172,25 @@ void RelocInfo::WipeOut() {
          IsRuntimeEntry(rmode_) || IsExternalReference(rmode_) ||
          IsInternalReference(rmode_));
   if (IsInternalReference(rmode_)) {
-    Memory::Address_at(pc_) = nullptr;
+    Memory::Address_at(pc_) = kNullAddress;
   } else {
-    Assembler::set_target_address_at(pc_, constant_pool_, nullptr);
+    Assembler::set_target_address_at(pc_, constant_pool_, kNullAddress);
   }
 }
 
+Handle<Code> Assembler::relative_code_target_object_handle_at(
+    Address pc) const {
+  Instruction* branch = Instruction::At(pc);
+  int code_target_index = branch->GetBranchOffset() / Instruction::kInstrSize;
+  return GetCodeTarget(code_target_index);
+}
+
 template <typename ObjectVisitor>
 void RelocInfo::Visit(ObjectVisitor* visitor) {
   RelocInfo::Mode mode = rmode();
   if (mode == RelocInfo::EMBEDDED_OBJECT) {
     visitor->VisitEmbeddedPointer(host(), this);
-  } else if (RelocInfo::IsCodeTarget(mode)) {
+  } else if (RelocInfo::IsCodeTargetMode(mode)) {
     visitor->VisitCodeTarget(host(), this);
   } else if (mode == RelocInfo::EXTERNAL_REFERENCE) {
     visitor->VisitExternalReference(host(), this);
@@ -206,7 +211,7 @@ Operand Operand::Zero() { return Operand(static_cast<int32_t>(0)); }
 
 Operand::Operand(const ExternalReference& f)
     : rmode_(RelocInfo::EXTERNAL_REFERENCE) {
-  value_.immediate = reinterpret_cast<int32_t>(f.address());
+  value_.immediate = static_cast<int32_t>(f.address());
 }
 
 Operand::Operand(Smi* value) : rmode_(RelocInfo::NONE) {
@@ -298,6 +303,10 @@ void Assembler::deserialization_set_special_target_at(
   Memory::Address_at(constant_pool_entry) = target;
 }
 
+int Assembler::deserialization_special_target_size(Address location) {
+  return kSpecialTargetSize;
+}
+
 void Assembler::deserialization_set_target_internal_reference_at(
     Address pc, Address target, RelocInfo::Mode mode) {
   Memory::Address_at(pc) = target;
@@ -313,7 +322,7 @@ Address Assembler::constant_pool_entry_address(Address pc,
                                                Address constant_pool) {
   DCHECK(Assembler::IsLdrPcImmediateOffset(Memory::int32_at(pc)));
   Instr instr = Memory::int32_at(pc);
-  return pc + GetLdrRegisterImmediateOffset(instr) + kPcLoadDelta;
+  return pc + GetLdrRegisterImmediateOffset(instr) + Instruction::kPcLoadDelta;
 }
 
 
@@ -321,16 +330,15 @@ Address Assembler::target_address_at(Address pc, Address constant_pool) {
   if (is_constant_pool_load(pc)) {
     // This is a constant pool lookup. Return the value in the constant pool.
     return Memory::Address_at(constant_pool_entry_address(pc, constant_pool));
-  } else if (CpuFeatures::IsSupported(ARMv7)) {
+  } else if (CpuFeatures::IsSupported(ARMv7) && IsMovW(Memory::int32_at(pc))) {
     // This is an movw / movt immediate load. Return the immediate.
     DCHECK(IsMovW(Memory::int32_at(pc)) &&
            IsMovT(Memory::int32_at(pc + kInstrSize)));
     Instruction* movw_instr = Instruction::At(pc);
     Instruction* movt_instr = Instruction::At(pc + kInstrSize);
-    return reinterpret_cast<Address>(
-        (movt_instr->ImmedMovwMovtValue() << 16) |
-         movw_instr->ImmedMovwMovtValue());
-  } else {
+    return static_cast<Address>((movt_instr->ImmedMovwMovtValue() << 16) |
+                                movw_instr->ImmedMovwMovtValue());
+  } else if (IsMovImmed(Memory::int32_at(pc))) {
     // This is an mov / orr immediate load. Return the immediate.
     DCHECK(IsMovImmed(Memory::int32_at(pc)) &&
            IsOrrImmed(Memory::int32_at(pc + kInstrSize)) &&
@@ -340,10 +348,14 @@ Address Assembler::target_address_at(Address pc, Address constant_pool) {
     Instr orr_instr_1 = instr_at(pc + kInstrSize);
     Instr orr_instr_2 = instr_at(pc + 2 * kInstrSize);
     Instr orr_instr_3 = instr_at(pc + 3 * kInstrSize);
-    Address ret = reinterpret_cast<Address>(
+    Address ret = static_cast<Address>(
         DecodeShiftImm(mov_instr) | DecodeShiftImm(orr_instr_1) |
         DecodeShiftImm(orr_instr_2) | DecodeShiftImm(orr_instr_3));
     return ret;
+  } else {
+    Instruction* branch = Instruction::At(pc);
+    int32_t delta = branch->GetBranchOffset();
+    return pc + delta + Instruction::kPcLoadDelta;
   }
 }
 
@@ -361,13 +373,13 @@ void Assembler::set_target_address_at(Address pc, Address constant_pool,
     // ldr   ip, [pp, #...]
     // since the instruction accessing this address in the constant pool remains
     // unchanged.
-  } else if (CpuFeatures::IsSupported(ARMv7)) {
+  } else if (CpuFeatures::IsSupported(ARMv7) && IsMovW(Memory::int32_at(pc))) {
     // This is an movw / movt immediate load. Patch the immediate embedded in
     // the instructions.
     DCHECK(IsMovW(Memory::int32_at(pc)));
     DCHECK(IsMovT(Memory::int32_at(pc + kInstrSize)));
     uint32_t* instr_ptr = reinterpret_cast<uint32_t*>(pc);
-    uint32_t immediate = reinterpret_cast<uint32_t>(target);
+    uint32_t immediate = static_cast<uint32_t>(target);
     instr_ptr[0] = PatchMovwImmediate(instr_ptr[0], immediate & 0xFFFF);
     instr_ptr[1] = PatchMovwImmediate(instr_ptr[1], immediate >> 16);
     DCHECK(IsMovW(Memory::int32_at(pc)));
@@ -375,7 +387,7 @@ void Assembler::set_target_address_at(Address pc, Address constant_pool,
     if (icache_flush_mode != SKIP_ICACHE_FLUSH) {
       Assembler::FlushICache(pc, 2 * kInstrSize);
     }
-  } else {
+  } else if (IsMovImmed(Memory::int32_at(pc))) {
     // This is an mov / orr immediate load. Patch the immediate embedded in
     // the instructions.
     DCHECK(IsMovImmed(Memory::int32_at(pc)) &&
@@ -383,7 +395,7 @@ void Assembler::set_target_address_at(Address pc, Address constant_pool,
            IsOrrImmed(Memory::int32_at(pc + 2 * kInstrSize)) &&
            IsOrrImmed(Memory::int32_at(pc + 3 * kInstrSize)));
     uint32_t* instr_ptr = reinterpret_cast<uint32_t*>(pc);
-    uint32_t immediate = reinterpret_cast<uint32_t>(target);
+    uint32_t immediate = static_cast<uint32_t>(target);
     instr_ptr[0] = PatchShiftImm(instr_ptr[0], immediate & kImm8Mask);
     instr_ptr[1] = PatchShiftImm(instr_ptr[1], immediate & (kImm8Mask << 8));
     instr_ptr[2] = PatchShiftImm(instr_ptr[2], immediate & (kImm8Mask << 16));
@@ -395,6 +407,13 @@ void Assembler::set_target_address_at(Address pc, Address constant_pool,
     if (icache_flush_mode != SKIP_ICACHE_FLUSH) {
       Assembler::FlushICache(pc, 4 * kInstrSize);
     }
+  } else {
+    intptr_t branch_offset = target - pc - Instruction::kPcLoadDelta;
+    Instruction* branch = Instruction::At(pc);
+    branch->SetBranchOffset(branch_offset);
+    if (icache_flush_mode != SKIP_ICACHE_FLUSH) {
+      Assembler::FlushICache(pc, kInstrSize);
+    }
   }
 }
 
diff --git a/deps/v8/src/arm/assembler-arm.cc b/deps/v8/src/arm/assembler-arm.cc
index 87acd59e84e997..cfd4078a14512b 100644
--- a/deps/v8/src/arm/assembler-arm.cc
+++ b/deps/v8/src/arm/assembler-arm.cc
@@ -43,6 +43,7 @@
 #include "src/base/bits.h"
 #include "src/base/cpu.h"
 #include "src/code-stubs.h"
+#include "src/deoptimizer.h"
 #include "src/macro-assembler.h"
 #include "src/objects-inl.h"
 
@@ -323,8 +324,8 @@ void CpuFeatures::PrintFeatures() {
 // Implementation of RelocInfo
 
 // static
-const int RelocInfo::kApplyMask = 0;
-
+const int RelocInfo::kApplyMask =
+    RelocInfo::ModeMask(RelocInfo::RELATIVE_CODE_TARGET);
 
 bool RelocInfo::IsCodedSpecially() {
   // The deserializer needs to know whether a pointer is specially coded.  Being
@@ -333,39 +334,31 @@ bool RelocInfo::IsCodedSpecially() {
   return false;
 }
 
-
 bool RelocInfo::IsInConstantPool() {
   return Assembler::is_constant_pool_load(pc_);
 }
 
-Address RelocInfo::embedded_address() const {
-  return Assembler::target_address_at(pc_, constant_pool_);
-}
-
-uint32_t RelocInfo::embedded_size() const {
-  return reinterpret_cast<uint32_t>(
-      Assembler::target_address_at(pc_, constant_pool_));
-}
-
-void RelocInfo::set_embedded_address(Address address,
-                                     ICacheFlushMode flush_mode) {
-  Assembler::set_target_address_at(pc_, constant_pool_, address, flush_mode);
-}
-
-void RelocInfo::set_embedded_size(uint32_t size, ICacheFlushMode flush_mode) {
-  Assembler::set_target_address_at(pc_, constant_pool_,
-                                   reinterpret_cast<Address>(size), flush_mode);
+int RelocInfo::GetDeoptimizationId(Isolate* isolate, DeoptimizeKind kind) {
+  DCHECK(IsRuntimeEntry(rmode_));
+  return Deoptimizer::GetDeoptimizationId(isolate, target_address(), kind);
 }
 
 void RelocInfo::set_js_to_wasm_address(Address address,
                                        ICacheFlushMode icache_flush_mode) {
   DCHECK_EQ(rmode_, JS_TO_WASM_CALL);
-  set_embedded_address(address, icache_flush_mode);
+  Assembler::set_target_address_at(pc_, constant_pool_, address,
+                                   icache_flush_mode);
 }
 
 Address RelocInfo::js_to_wasm_address() const {
   DCHECK_EQ(rmode_, JS_TO_WASM_CALL);
-  return embedded_address();
+  return Assembler::target_address_at(pc_, constant_pool_);
+}
+
+uint32_t RelocInfo::wasm_call_tag() const {
+  DCHECK(rmode_ == WASM_CALL || rmode_ == WASM_STUB_CALL);
+  return static_cast<uint32_t>(
+      Assembler::target_address_at(pc_, constant_pool_));
 }
 
 // -----------------------------------------------------------------------------
@@ -374,7 +367,7 @@ Address RelocInfo::js_to_wasm_address() const {
 
 Operand::Operand(Handle<HeapObject> handle) {
   rm_ = no_reg;
-  value_.immediate = reinterpret_cast<intptr_t>(handle.address());
+  value_.immediate = static_cast<intptr_t>(handle.address());
   rmode_ = RelocInfo::EMBEDDED_OBJECT;
 }
 
@@ -483,15 +476,15 @@ void Assembler::AllocateAndInstallRequestedHeapObjects(Isolate* isolate) {
     Handle<HeapObject> object;
     switch (request.kind()) {
       case HeapObjectRequest::kHeapNumber:
-        object = isolate->factory()->NewHeapNumber(request.heap_number(),
-                                                   IMMUTABLE, TENURED);
+        object =
+            isolate->factory()->NewHeapNumber(request.heap_number(), TENURED);
         break;
       case HeapObjectRequest::kCodeStub:
         request.code_stub()->set_isolate(isolate);
         object = request.code_stub()->GetCode();
         break;
     }
-    Address pc = buffer_ + request.offset();
+    Address pc = reinterpret_cast<Address>(buffer_) + request.offset();
     Memory::Address_at(constant_pool_entry_address(pc, 0 /* unused */)) =
         object.address();
   }
@@ -544,8 +537,9 @@ const Instr kLdrRegFpNegOffsetPattern =
 const Instr kStrRegFpNegOffsetPattern = al | B26 | NegOffset | fp.code() * B16;
 const Instr kLdrStrInstrTypeMask = 0xFFFF0000;
 
-Assembler::Assembler(IsolateData isolate_data, void* buffer, int buffer_size)
-    : AssemblerBase(isolate_data, buffer, buffer_size),
+Assembler::Assembler(const AssemblerOptions& options, void* buffer,
+                     int buffer_size)
+    : AssemblerBase(options, buffer, buffer_size),
       pending_32_bit_constants_(),
       pending_64_bit_constants_(),
       scratch_register_list_(ip.bit()) {
@@ -553,7 +547,6 @@ Assembler::Assembler(IsolateData isolate_data, void* buffer, int buffer_size)
   pending_64_bit_constants_.reserve(kMinNumPendingConstants);
   reloc_info_writer.Reposition(buffer_ + buffer_size_, pc_);
   next_buffer_check_ = 0;
-  code_target_sharing_blocked_nesting_ = 0;
   const_pool_blocked_nesting_ = 0;
   no_const_pool_before_ = 0;
   first_const_pool_32_use_ = -1;
@@ -576,7 +569,6 @@ Assembler::Assembler(IsolateData isolate_data, void* buffer, int buffer_size)
 
 Assembler::~Assembler() {
   DCHECK_EQ(const_pool_blocked_nesting_, 0);
-  DCHECK_EQ(code_target_sharing_blocked_nesting_, 0);
 }
 
 void Assembler::GetCode(Isolate* isolate, CodeDesc* desc) {
@@ -620,20 +612,6 @@ Condition Assembler::GetCondition(Instr instr) {
   return Instruction::ConditionField(instr);
 }
 
-
-bool Assembler::IsBranch(Instr instr) {
-  return (instr & (B27 | B25)) == (B27 | B25);
-}
-
-
-int Assembler::GetBranchOffset(Instr instr) {
-  DCHECK(IsBranch(instr));
-  // Take the jump offset in the lower 24 bits, sign extend it and multiply it
-  // with 4 to get the offset in bytes.
-  return ((instr & kImm24Mask) << 8) >> 6;
-}
-
-
 bool Assembler::IsLdrRegisterImmediate(Instr instr) {
   return (instr & (B27 | B26 | B25 | B22 | B20)) == (B26 | B20);
 }
@@ -851,7 +829,7 @@ int Assembler::target_at(int pos) {
     // blx uses bit 24 to encode bit 2 of imm26
     imm26 += 2;
   }
-  return pos + kPcLoadDelta + imm26;
+  return pos + Instruction::kPcLoadDelta + imm26;
 }
 
 
@@ -890,7 +868,7 @@ void Assembler::target_at_put(int pos, int target_pos) {
     if (is_uint8(target24)) {
       // If the target fits in a byte then only patch with a mov
       // instruction.
-      PatchingAssembler patcher(isolate_data(),
+      PatchingAssembler patcher(options(),
                                 reinterpret_cast<byte*>(buffer_ + pos), 1);
       patcher.mov(dst, Operand(target24));
     } else {
@@ -899,12 +877,12 @@ void Assembler::target_at_put(int pos, int target_pos) {
       if (CpuFeatures::IsSupported(ARMv7)) {
         // Patch with movw/movt.
         if (target16_1 == 0) {
-          PatchingAssembler patcher(isolate_data(),
+          PatchingAssembler patcher(options(),
                                     reinterpret_cast<byte*>(buffer_ + pos), 1);
           CpuFeatureScope scope(&patcher, ARMv7);
           patcher.movw(dst, target16_0);
         } else {
-          PatchingAssembler patcher(isolate_data(),
+          PatchingAssembler patcher(options(),
                                     reinterpret_cast<byte*>(buffer_ + pos), 2);
           CpuFeatureScope scope(&patcher, ARMv7);
           patcher.movw(dst, target16_0);
@@ -916,12 +894,12 @@ void Assembler::target_at_put(int pos, int target_pos) {
         uint8_t target8_1 = target16_0 >> 8;
         uint8_t target8_2 = target16_1 & kImm8Mask;
         if (target8_2 == 0) {
-          PatchingAssembler patcher(isolate_data(),
+          PatchingAssembler patcher(options(),
                                     reinterpret_cast<byte*>(buffer_ + pos), 2);
           patcher.mov(dst, Operand(target8_0));
           patcher.orr(dst, dst, Operand(target8_1 << 8));
         } else {
-          PatchingAssembler patcher(isolate_data(),
+          PatchingAssembler patcher(options(),
                                     reinterpret_cast<byte*>(buffer_ + pos), 3);
           patcher.mov(dst, Operand(target8_0));
           patcher.orr(dst, dst, Operand(target8_1 << 8));
@@ -931,7 +909,7 @@ void Assembler::target_at_put(int pos, int target_pos) {
     }
     return;
   }
-  int imm26 = target_pos - (pos + kPcLoadDelta);
+  int imm26 = target_pos - (pos + Instruction::kPcLoadDelta);
   DCHECK_EQ(5 * B25, instr & 7 * B25);  // b, bl, or blx imm24
   if (Instruction::ConditionField(instr) == kSpecialCondition) {
     // blx uses bit 24 to encode bit 2 of imm26
@@ -1105,9 +1083,9 @@ bool FitsShifter(uint32_t imm32, uint32_t* rotate_imm, uint32_t* immed_8,
 // space.  There is no guarantee that the relocated location can be similarly
 // encoded.
 bool MustOutputRelocInfo(RelocInfo::Mode rmode, const Assembler* assembler) {
-  if (rmode == RelocInfo::EXTERNAL_REFERENCE) {
-    if (assembler != nullptr && assembler->predictable_code_size()) return true;
-    return assembler->serializer_enabled();
+  if (RelocInfo::IsOnlyForSerializer(rmode)) {
+    if (assembler->predictable_code_size()) return true;
+    return assembler->options().record_reloc_info_for_serialization;
   } else if (RelocInfo::IsNone(rmode)) {
     return false;
   }
@@ -1167,6 +1145,7 @@ int Operand::InstructionsRequired(const Assembler* assembler,
 void Assembler::Move32BitImmediate(Register rd, const Operand& x,
                                    Condition cond) {
   if (UseMovImmediateLoad(x, this)) {
+    CpuFeatureScope scope(this, ARMv7);
     // UseMovImmediateLoad should return false when we need to output
     // relocation info, since we prefer the constant pool for values that
     // can be patched.
@@ -1174,12 +1153,9 @@ void Assembler::Move32BitImmediate(Register rd, const Operand& x,
     UseScratchRegisterScope temps(this);
     // Re-use the destination register as a scratch if possible.
     Register target = rd != pc ? rd : temps.Acquire();
-    if (CpuFeatures::IsSupported(ARMv7)) {
-      uint32_t imm32 = static_cast<uint32_t>(x.immediate());
-      CpuFeatureScope scope(this, ARMv7);
-      movw(target, imm32 & 0xFFFF, cond);
-      movt(target, imm32 >> 16, cond);
-    }
+    uint32_t imm32 = static_cast<uint32_t>(x.immediate());
+    movw(target, imm32 & 0xFFFF, cond);
+    movt(target, imm32 >> 16, cond);
     if (target.code() != rd.code()) {
       mov(rd, target, LeaveCC, cond);
     }
@@ -1436,12 +1412,13 @@ int Assembler::branch_offset(Label* L) {
   // be emitted at the pc offset recorded by the label.
   if (!is_const_pool_blocked()) BlockConstPoolFor(1);
 
-  return target_pos - (pc_offset() + kPcLoadDelta);
+  return target_pos - (pc_offset() + Instruction::kPcLoadDelta);
 }
 
 
 // Branch instructions.
-void Assembler::b(int branch_offset, Condition cond) {
+void Assembler::b(int branch_offset, Condition cond, RelocInfo::Mode rmode) {
+  RecordRelocInfo(rmode);
   DCHECK_EQ(branch_offset & 3, 0);
   int imm24 = branch_offset >> 2;
   CHECK(is_int24(imm24));
@@ -1453,8 +1430,8 @@ void Assembler::b(int branch_offset, Condition cond) {
   }
 }
 
-
-void Assembler::bl(int branch_offset, Condition cond) {
+void Assembler::bl(int branch_offset, Condition cond, RelocInfo::Mode rmode) {
+  RecordRelocInfo(rmode);
   DCHECK_EQ(branch_offset & 3, 0);
   int imm24 = branch_offset >> 2;
   CHECK(is_int24(imm24));
@@ -5147,28 +5124,26 @@ void Assembler::dq(uint64_t value) {
 void Assembler::RecordRelocInfo(RelocInfo::Mode rmode, intptr_t data) {
   if (RelocInfo::IsNone(rmode) ||
       // Don't record external references unless the heap will be serialized.
-      (rmode == RelocInfo::EXTERNAL_REFERENCE && !serializer_enabled() &&
-       !emit_debug_code())) {
+      (RelocInfo::IsOnlyForSerializer(rmode) &&
+       !options().record_reloc_info_for_serialization && !emit_debug_code())) {
     return;
   }
   DCHECK_GE(buffer_space(), kMaxRelocSize);  // too late to grow buffer here
-  RelocInfo rinfo(pc_, rmode, data, nullptr);
+  RelocInfo rinfo(reinterpret_cast<Address>(pc_), rmode, data, nullptr);
   reloc_info_writer.Write(&rinfo);
 }
 
 void Assembler::ConstantPoolAddEntry(int position, RelocInfo::Mode rmode,
                                      intptr_t value) {
   DCHECK(rmode != RelocInfo::COMMENT && rmode != RelocInfo::CONST_POOL);
-  bool sharing_ok = RelocInfo::IsNone(rmode) ||
-                    (rmode >= RelocInfo::FIRST_SHAREABLE_RELOC_MODE);
+  bool sharing_ok =
+      RelocInfo::IsNone(rmode) || RelocInfo::IsShareableRelocMode(rmode);
   DCHECK_LT(pending_32_bit_constants_.size(), kMaxNumPending32Constants);
   if (pending_32_bit_constants_.empty()) {
     first_const_pool_32_use_ = position;
   }
-  ConstantPoolEntry entry(position, value,
-                          sharing_ok || (rmode == RelocInfo::CODE_TARGET &&
-                                         IsCodeTargetSharingAllowed()),
-                          rmode);
+  ConstantPoolEntry entry(
+      position, value, sharing_ok || (rmode == RelocInfo::CODE_TARGET), rmode);
 
   bool shared = false;
   if (sharing_ok) {
@@ -5187,11 +5162,10 @@ void Assembler::ConstantPoolAddEntry(int position, RelocInfo::Mode rmode,
 
   // Share entries if allowed and possible.
   // Null-values are placeholders and must be ignored.
-  if (rmode == RelocInfo::CODE_TARGET && IsCodeTargetSharingAllowed() &&
-      value != 0) {
+  if (rmode == RelocInfo::CODE_TARGET && value != 0) {
     // Sharing entries here relies on canonicalized handles - without them, we
     // will miss the optimisation opportunity.
-    Address handle_address = reinterpret_cast<Address>(value);
+    Address handle_address = static_cast<Address>(value);
     auto existing = handle_to_index_map_.find(handle_address);
     if (existing != handle_to_index_map_.end()) {
       int index = existing->second;
@@ -5384,7 +5358,7 @@ void Assembler::CheckConstPool(bool force_emit, bool require_jump) {
       DCHECK((IsVldrDPcImmediateOffset(instr) &&
               GetVldrDRegisterImmediateOffset(instr) == 0));
 
-      int delta = pc_offset() - entry.position() - kPcLoadDelta;
+      int delta = pc_offset() - entry.position() - Instruction::kPcLoadDelta;
       DCHECK(is_uint10(delta));
 
       if (entry.is_merged()) {
@@ -5415,7 +5389,7 @@ void Assembler::CheckConstPool(bool force_emit, bool require_jump) {
       DCHECK(IsLdrPcImmediateOffset(instr) &&
              GetLdrRegisterImmediateOffset(instr) == 0);
 
-      int delta = pc_offset() - entry.position() - kPcLoadDelta;
+      int delta = pc_offset() - entry.position() - Instruction::kPcLoadDelta;
       DCHECK(is_uint12(delta));
       // 0 is the smallest delta:
       //   ldr rd, [pc, #0]
@@ -5460,9 +5434,9 @@ void Assembler::CheckConstPool(bool force_emit, bool require_jump) {
   next_buffer_check_ = pc_offset() + kCheckPoolInterval;
 }
 
-PatchingAssembler::PatchingAssembler(IsolateData isolate_data, byte* address,
-                                     int instructions)
-    : Assembler(isolate_data, address, instructions * kInstrSize + kGap) {
+PatchingAssembler::PatchingAssembler(const AssemblerOptions& options,
+                                     byte* address, int instructions)
+    : Assembler(options, address, instructions * kInstrSize + kGap) {
   DCHECK_EQ(reloc_info_writer.pos(), buffer_ + buffer_size_);
 }
 
@@ -5476,9 +5450,7 @@ PatchingAssembler::~PatchingAssembler() {
   DCHECK_EQ(reloc_info_writer.pos(), buffer_ + buffer_size_);
 }
 
-void PatchingAssembler::Emit(Address addr) {
-  emit(reinterpret_cast<Instr>(addr));
-}
+void PatchingAssembler::Emit(Address addr) { emit(static_cast<Instr>(addr)); }
 
 UseScratchRegisterScope::UseScratchRegisterScope(Assembler* assembler)
     : assembler_(assembler),
diff --git a/deps/v8/src/arm/assembler-arm.h b/deps/v8/src/arm/assembler-arm.h
index bbe0ba753e8639..2e71ce59e645c5 100644
--- a/deps/v8/src/arm/assembler-arm.h
+++ b/deps/v8/src/arm/assembler-arm.h
@@ -397,26 +397,26 @@ enum Coprocessor {
 class Operand BASE_EMBEDDED {
  public:
   // immediate
-  INLINE(explicit Operand(int32_t immediate,
-                          RelocInfo::Mode rmode = RelocInfo::NONE));
-  INLINE(static Operand Zero());
-  INLINE(explicit Operand(const ExternalReference& f));
+  V8_INLINE explicit Operand(int32_t immediate,
+                             RelocInfo::Mode rmode = RelocInfo::NONE);
+  V8_INLINE static Operand Zero();
+  V8_INLINE explicit Operand(const ExternalReference& f);
   explicit Operand(Handle<HeapObject> handle);
-  INLINE(explicit Operand(Smi* value));
+  V8_INLINE explicit Operand(Smi* value);
 
   // rm
-  INLINE(explicit Operand(Register rm));
+  V8_INLINE explicit Operand(Register rm);
 
   // rm <shift_op> shift_imm
   explicit Operand(Register rm, ShiftOp shift_op, int shift_imm);
-  INLINE(static Operand SmiUntag(Register rm)) {
+  V8_INLINE static Operand SmiUntag(Register rm) {
     return Operand(rm, ASR, kSmiTagSize);
   }
-  INLINE(static Operand PointerOffsetFromSmiKey(Register key)) {
+  V8_INLINE static Operand PointerOffsetFromSmiKey(Register key) {
     STATIC_ASSERT(kSmiTag == 0 && kSmiTagSize < kPointerSizeLog2);
     return Operand(key, LSL, kPointerSizeLog2 - kSmiTagSize);
   }
-  INLINE(static Operand DoubleOffsetFromSmiKey(Register key)) {
+  V8_INLINE static Operand DoubleOffsetFromSmiKey(Register key) {
     STATIC_ASSERT(kSmiTag == 0 && kSmiTagSize < kDoubleSizeLog2);
     return Operand(key, LSL, kDoubleSizeLog2 - kSmiTagSize);
   }
@@ -519,9 +519,9 @@ class MemOperand BASE_EMBEDDED {
   // [rn], +/- rm <shift_op> shift_imm     PostIndex/NegPostIndex
   explicit MemOperand(Register rn, Register rm,
                       ShiftOp shift_op, int shift_imm, AddrMode am = Offset);
-  INLINE(static MemOperand PointerAddressFromSmiKey(Register array,
-                                                    Register key,
-                                                    AddrMode am = Offset)) {
+  V8_INLINE static MemOperand PointerAddressFromSmiKey(Register array,
+                                                       Register key,
+                                                       AddrMode am = Offset) {
     STATIC_ASSERT(kSmiTag == 0 && kSmiTagSize < kPointerSizeLog2);
     return MemOperand(array, key, LSL, kPointerSizeLog2 - kSmiTagSize, am);
   }
@@ -628,9 +628,7 @@ class Assembler : public AssemblerBase {
   // buffer for code generation and assumes its size to be buffer_size. If the
   // buffer is too small, a fatal error occurs. No deallocation of the buffer is
   // done upon destruction of the assembler.
-  Assembler(Isolate* isolate, void* buffer, int buffer_size)
-      : Assembler(IsolateData(isolate), buffer, buffer_size) {}
-  Assembler(IsolateData isolate_data, void* buffer, int buffer_size);
+  Assembler(const AssemblerOptions& options, void* buffer, int buffer_size);
   virtual ~Assembler();
 
   // GetCode emits any pending (non-emitted) code and fills the descriptor
@@ -662,33 +660,36 @@ class Assembler : public AssemblerBase {
 
   // Returns true if the given pc address is the start of a constant pool load
   // instruction sequence.
-  INLINE(static bool is_constant_pool_load(Address pc));
+  V8_INLINE static bool is_constant_pool_load(Address pc);
 
   // Return the address in the constant pool of the code target address used by
   // the branch/call instruction at pc, or the object in a mov.
-  INLINE(static Address constant_pool_entry_address(Address pc,
-                                                    Address constant_pool));
+  V8_INLINE static Address constant_pool_entry_address(Address pc,
+                                                       Address constant_pool);
 
   // Read/Modify the code target address in the branch/call instruction at pc.
   // The isolate argument is unused (and may be nullptr) when skipping flushing.
-  INLINE(static Address target_address_at(Address pc, Address constant_pool));
-  INLINE(static void set_target_address_at(
+  V8_INLINE static Address target_address_at(Address pc, Address constant_pool);
+  V8_INLINE static void set_target_address_at(
       Address pc, Address constant_pool, Address target,
-      ICacheFlushMode icache_flush_mode = FLUSH_ICACHE_IF_NEEDED));
+      ICacheFlushMode icache_flush_mode = FLUSH_ICACHE_IF_NEEDED);
 
   // Return the code target address at a call site from the return address
   // of that call in the instruction stream.
-  INLINE(static Address target_address_from_return_address(Address pc));
+  V8_INLINE static Address target_address_from_return_address(Address pc);
 
   // Given the address of the beginning of a call, return the address
   // in the instruction stream that the call will return from.
-  INLINE(static Address return_address_from_call_start(Address pc));
+  V8_INLINE static Address return_address_from_call_start(Address pc);
 
   // This sets the branch destination (which is in the constant pool on ARM).
   // This is for calls and branches within generated code.
   inline static void deserialization_set_special_target_at(
       Address constant_pool_entry, Code* code, Address target);
 
+  // Get the size of the special target encoded at 'location'.
+  inline static int deserialization_special_target_size(Address location);
+
   // This sets the internal reference at the pc.
   inline static void deserialization_set_target_internal_reference_at(
       Address pc, Address target,
@@ -702,9 +703,6 @@ class Assembler : public AssemblerBase {
   // Size of an instruction.
   static constexpr int kInstrSize = sizeof(Instr);
 
-  // Difference between address of current opcode and value read from pc
-  // register.
-  static constexpr int kPcLoadDelta = 8;
   RegList* GetScratchRegisterList() { return &scratch_register_list_; }
   VfpRegList* GetScratchVfpRegisterList() {
     return &scratch_vfp_register_list_;
@@ -724,8 +722,10 @@ class Assembler : public AssemblerBase {
   void CodeTargetAlign();
 
   // Branch instructions
-  void b(int branch_offset, Condition cond = al);
-  void bl(int branch_offset, Condition cond = al);
+  void b(int branch_offset, Condition cond = al,
+         RelocInfo::Mode rmode = RelocInfo::NONE);
+  void bl(int branch_offset, Condition cond = al,
+          RelocInfo::Mode rmode = RelocInfo::NONE);
   void blx(int branch_offset);  // v5 and above
   void blx(Register target, Condition cond = al);  // v5 and above
   void bx(Register target, Condition cond = al);  // v5 and above, plus v4t
@@ -1424,36 +1424,6 @@ class Assembler : public AssemblerBase {
     DISALLOW_IMPLICIT_CONSTRUCTORS(BlockConstPoolScope);
   };
 
-  // Class for blocking sharing of code targets in constant pool.
-  class BlockCodeTargetSharingScope {
-   public:
-    explicit BlockCodeTargetSharingScope(Assembler* assem) : assem_(nullptr) {
-      Open(assem);
-    }
-    // This constructor does not initialize the scope. The user needs to
-    // explicitly call Open() before using it.
-    BlockCodeTargetSharingScope() : assem_(nullptr) {}
-    ~BlockCodeTargetSharingScope() {
-      Close();
-    }
-    void Open(Assembler* assem) {
-      DCHECK_NULL(assem_);
-      DCHECK_NOT_NULL(assem);
-      assem_ = assem;
-      assem_->StartBlockCodeTargetSharing();
-    }
-
-   private:
-    void Close() {
-      if (assem_ != nullptr) {
-        assem_->EndBlockCodeTargetSharing();
-      }
-    }
-    Assembler* assem_;
-
-    DISALLOW_COPY_AND_ASSIGN(BlockCodeTargetSharingScope);
-  };
-
   // Record a comment relocation entry that can be used by a disassembler.
   // Use --code-comments to enable.
   void RecordComment(const char* msg);
@@ -1496,13 +1466,11 @@ class Assembler : public AssemblerBase {
   void instr_at_put(int pos, Instr instr) {
     *reinterpret_cast<Instr*>(buffer_ + pos) = instr;
   }
-  static Instr instr_at(byte* pc) { return *reinterpret_cast<Instr*>(pc); }
-  static void instr_at_put(byte* pc, Instr instr) {
+  static Instr instr_at(Address pc) { return *reinterpret_cast<Instr*>(pc); }
+  static void instr_at_put(Address pc, Instr instr) {
     *reinterpret_cast<Instr*>(pc) = instr;
   }
   static Condition GetCondition(Instr instr);
-  static bool IsBranch(Instr instr);
-  static int GetBranchOffset(Instr instr);
   static bool IsLdrRegisterImmediate(Instr instr);
   static bool IsVldrDRegisterImmediate(Instr instr);
   static int GetLdrRegisterImmediateOffset(Instr instr);
@@ -1576,6 +1544,13 @@ class Assembler : public AssemblerBase {
     UNREACHABLE();
   }
 
+  // Move a 32-bit immediate into a register, potentially via the constant pool.
+  void Move32BitImmediate(Register rd, const Operand& x, Condition cond = al);
+
+  // Get the code target object for a pc-relative call or jump.
+  V8_INLINE Handle<Code> relative_code_target_object_handle_at(
+      Address pc_) const;
+
  protected:
   int buffer_space() const { return reloc_info_writer.pos() - pc_; }
 
@@ -1585,20 +1560,6 @@ class Assembler : public AssemblerBase {
   // Patch branch instruction at pos to branch to given branch target pos
   void target_at_put(int pos, int target_pos);
 
-  // Prevent sharing of code target constant pool entries until
-  // EndBlockCodeTargetSharing is called. Calls to this function can be nested
-  // but must be followed by an equal number of call to
-  // EndBlockCodeTargetSharing.
-  void StartBlockCodeTargetSharing() {
-    ++code_target_sharing_blocked_nesting_;
-  }
-
-  // Resume sharing of constant pool code target entries. Needs to be called
-  // as many times as StartBlockCodeTargetSharing to have an effect.
-  void EndBlockCodeTargetSharing() {
-    --code_target_sharing_blocked_nesting_;
-  }
-
   // Prevent contant pool emission until EndBlockConstPool is called.
   // Calls to this function can be nested but must be followed by an equal
   // number of call to EndBlockConstpool.
@@ -1706,12 +1667,6 @@ class Assembler : public AssemblerBase {
   static constexpr int kCheckPoolIntervalInst = 32;
   static constexpr int kCheckPoolInterval = kCheckPoolIntervalInst * kInstrSize;
 
-  // Sharing of code target entries may be blocked in some code sequences.
-  int code_target_sharing_blocked_nesting_;
-  bool IsCodeTargetSharingAllowed() const {
-    return code_target_sharing_blocked_nesting_ == 0;
-  }
-
   // Emission of the constant pool may be blocked in some code sequences.
   int const_pool_blocked_nesting_;  // Block emission if this is not zero.
   int no_const_pool_before_;  // Block emission before this pc offset.
@@ -1727,9 +1682,6 @@ class Assembler : public AssemblerBase {
   inline void CheckBuffer();
   void GrowBuffer();
 
-  // 32-bit immediate values
-  void Move32BitImmediate(Register rd, const Operand& x, Condition cond = al);
-
   // Instruction generation
   void AddrMode1(Instr instr, Register rd, Register rn, const Operand& x);
   // Attempt to encode operand |x| for instruction |instr| and return true on
@@ -1754,35 +1706,23 @@ class Assembler : public AssemblerBase {
   void ConstantPoolAddEntry(int position, RelocInfo::Mode rmode,
                             intptr_t value);
   void ConstantPoolAddEntry(int position, Double value);
+  void AllocateAndInstallRequestedHeapObjects(Isolate* isolate);
 
   friend class RelocInfo;
   friend class BlockConstPoolScope;
-  friend class BlockCodeTargetSharingScope;
   friend class EnsureSpace;
   friend class UseScratchRegisterScope;
-
-  // The following functions help with avoiding allocations of embedded heap
-  // objects during the code assembly phase. {RequestHeapObject} records the
-  // need for a future heap number allocation or code stub generation. After
-  // code assembly, {AllocateAndInstallRequestedHeapObjects} will allocate these
-  // objects and place them where they are expected (determined by the pc offset
-  // associated with each request). That is, for each request, it will patch the
-  // dummy heap object handle that we emitted during code assembly with the
-  // actual heap object handle.
-  void RequestHeapObject(HeapObjectRequest request);
-  void AllocateAndInstallRequestedHeapObjects(Isolate* isolate);
-
-  std::forward_list<HeapObjectRequest> heap_object_requests_;
 };
 
 class EnsureSpace BASE_EMBEDDED {
  public:
-  INLINE(explicit EnsureSpace(Assembler* assembler));
+  V8_INLINE explicit EnsureSpace(Assembler* assembler);
 };
 
 class PatchingAssembler : public Assembler {
  public:
-  PatchingAssembler(IsolateData isolate_data, byte* address, int instructions);
+  PatchingAssembler(const AssemblerOptions& options, byte* address,
+                    int instructions);
   ~PatchingAssembler();
 
   void Emit(Address addr);
diff --git a/deps/v8/src/arm/code-stubs-arm.cc b/deps/v8/src/arm/code-stubs-arm.cc
index 814d341f7e55db..26131ea305bacb 100644
--- a/deps/v8/src/arm/code-stubs-arm.cc
+++ b/deps/v8/src/arm/code-stubs-arm.cc
@@ -17,6 +17,7 @@
 #include "src/ic/ic.h"
 #include "src/ic/stub-cache.h"
 #include "src/isolate.h"
+#include "src/objects/api-callbacks.h"
 #include "src/objects/regexp-match-info.h"
 #include "src/regexp/jsregexp.h"
 #include "src/regexp/regexp-macro-assembler.h"
@@ -29,364 +30,6 @@ namespace internal {
 
 #define __ ACCESS_MASM(masm)
 
-void ArrayNArgumentsConstructorStub::Generate(MacroAssembler* masm) {
-  __ lsl(r5, r0, Operand(kPointerSizeLog2));
-  __ str(r1, MemOperand(sp, r5));
-  __ Push(r1);
-  __ Push(r2);
-  __ add(r0, r0, Operand(3));
-  __ TailCallRuntime(Runtime::kNewArray);
-}
-
-
-void DoubleToIStub::Generate(MacroAssembler* masm) {
-  Label negate, done;
-  Register result_reg = destination();
-
-  UseScratchRegisterScope temps(masm);
-  Register double_low = GetRegisterThatIsNotOneOf(result_reg);
-  Register double_high = GetRegisterThatIsNotOneOf(result_reg, double_low);
-  LowDwVfpRegister double_scratch = temps.AcquireLowD();
-
-  // Save the old values from these temporary registers on the stack.
-  __ Push(double_high, double_low);
-
-  // Account for saved regs.
-  const int kArgumentOffset = 2 * kPointerSize;
-
-  // Load double input.
-  __ vldr(double_scratch, MemOperand(sp, kArgumentOffset));
-  __ vmov(double_low, double_high, double_scratch);
-  // Try to convert with a FPU convert instruction. This handles all
-  // non-saturating cases.
-  __ TryInlineTruncateDoubleToI(result_reg, double_scratch, &done);
-
-  Register scratch = temps.Acquire();
-  __ Ubfx(scratch, double_high, HeapNumber::kExponentShift,
-          HeapNumber::kExponentBits);
-  // Load scratch with exponent - 1. This is faster than loading
-  // with exponent because Bias + 1 = 1024 which is an *ARM* immediate value.
-  STATIC_ASSERT(HeapNumber::kExponentBias + 1 == 1024);
-  __ sub(scratch, scratch, Operand(HeapNumber::kExponentBias + 1));
-  // If exponent is greater than or equal to 84, the 32 less significant
-  // bits are 0s (2^84 = 1, 52 significant bits, 32 uncoded bits),
-  // the result is 0.
-  // Compare exponent with 84 (compare exponent - 1 with 83). If the exponent is
-  // greater than this, the conversion is out of range, so return zero.
-  __ cmp(scratch, Operand(83));
-  __ mov(result_reg, Operand::Zero(), LeaveCC, ge);
-  __ b(ge, &done);
-
-  // If we reach this code, 30 <= exponent <= 83.
-  // `TryInlineTruncateDoubleToI` above will have truncated any double with an
-  // exponent lower than 30.
-  if (masm->emit_debug_code()) {
-    // Scratch is exponent - 1.
-    __ cmp(scratch, Operand(30 - 1));
-    __ Check(ge, AbortReason::kUnexpectedValue);
-  }
-
-  // We don't have to handle cases where 0 <= exponent <= 20 for which we would
-  // need to shift right the high part of the mantissa.
-  // Scratch contains exponent - 1.
-  // Load scratch with 52 - exponent (load with 51 - (exponent - 1)).
-  __ rsb(scratch, scratch, Operand(51), SetCC);
-
-  // 52 <= exponent <= 83, shift only double_low.
-  // On entry, scratch contains: 52 - exponent.
-  __ rsb(scratch, scratch, Operand::Zero(), LeaveCC, ls);
-  __ mov(result_reg, Operand(double_low, LSL, scratch), LeaveCC, ls);
-  __ b(ls, &negate);
-
-  // 21 <= exponent <= 51, shift double_low and double_high
-  // to generate the result.
-  __ mov(double_low, Operand(double_low, LSR, scratch));
-  // Scratch contains: 52 - exponent.
-  // We needs: exponent - 20.
-  // So we use: 32 - scratch = 32 - 52 + exponent = exponent - 20.
-  __ rsb(scratch, scratch, Operand(32));
-  __ Ubfx(result_reg, double_high, 0, HeapNumber::kMantissaBitsInTopWord);
-  // Set the implicit 1 before the mantissa part in double_high.
-  __ orr(result_reg, result_reg,
-         Operand(1 << HeapNumber::kMantissaBitsInTopWord));
-  __ orr(result_reg, double_low, Operand(result_reg, LSL, scratch));
-
-  __ bind(&negate);
-  // If input was positive, double_high ASR 31 equals 0 and
-  // double_high LSR 31 equals zero.
-  // New result = (result eor 0) + 0 = result.
-  // If the input was negative, we have to negate the result.
-  // Input_high ASR 31 equals 0xFFFFFFFF and double_high LSR 31 equals 1.
-  // New result = (result eor 0xFFFFFFFF) + 1 = 0 - result.
-  __ eor(result_reg, result_reg, Operand(double_high, ASR, 31));
-  __ add(result_reg, result_reg, Operand(double_high, LSR, 31));
-
-  __ bind(&done);
-
-  // Restore registers corrupted in this routine and return.
-  __ Pop(double_high, double_low);
-  __ Ret();
-}
-
-
-void MathPowStub::Generate(MacroAssembler* masm) {
-  const Register exponent = MathPowTaggedDescriptor::exponent();
-  DCHECK(exponent == r2);
-  const LowDwVfpRegister double_base = d0;
-  const LowDwVfpRegister double_exponent = d1;
-  const LowDwVfpRegister double_result = d2;
-  const LowDwVfpRegister double_scratch = d3;
-  const SwVfpRegister single_scratch = s6;
-  const Register scratch = r9;
-  const Register scratch2 = r4;
-
-  Label call_runtime, done, int_exponent;
-
-  // Detect integer exponents stored as double.
-  __ TryDoubleToInt32Exact(scratch, double_exponent, double_scratch);
-  __ b(eq, &int_exponent);
-
-  __ push(lr);
-  {
-    AllowExternalCallThatCantCauseGC scope(masm);
-    __ PrepareCallCFunction(0, 2);
-    __ MovToFloatParameters(double_base, double_exponent);
-    __ CallCFunction(ExternalReference::power_double_double_function(isolate()),
-                     0, 2);
-  }
-  __ pop(lr);
-  __ MovFromFloatResult(double_result);
-  __ b(&done);
-
-  // Calculate power with integer exponent.
-  __ bind(&int_exponent);
-
-  // Get two copies of exponent in the registers scratch and exponent.
-  // Exponent has previously been stored into scratch as untagged integer.
-  __ mov(exponent, scratch);
-
-  __ vmov(double_scratch, double_base);  // Back up base.
-  __ vmov(double_result, Double(1.0), scratch2);
-
-  // Get absolute value of exponent.
-  __ cmp(scratch, Operand::Zero());
-  __ rsb(scratch, scratch, Operand::Zero(), LeaveCC, mi);
-
-  Label while_true;
-  __ bind(&while_true);
-  __ mov(scratch, Operand(scratch, LSR, 1), SetCC);
-  __ vmul(double_result, double_result, double_scratch, cs);
-  __ vmul(double_scratch, double_scratch, double_scratch, ne);
-  __ b(ne, &while_true);
-
-  __ cmp(exponent, Operand::Zero());
-  __ b(ge, &done);
-  __ vmov(double_scratch, Double(1.0), scratch);
-  __ vdiv(double_result, double_scratch, double_result);
-  // Test whether result is zero.  Bail out to check for subnormal result.
-  // Due to subnormals, x^-y == (1/x)^y does not hold in all cases.
-  __ VFPCompareAndSetFlags(double_result, 0.0);
-  __ b(ne, &done);
-  // double_exponent may not containe the exponent value if the input was a
-  // smi.  We set it with exponent value before bailing out.
-  __ vmov(single_scratch, exponent);
-  __ vcvt_f64_s32(double_exponent, single_scratch);
-
-  // Returning or bailing out.
-  __ push(lr);
-  {
-    AllowExternalCallThatCantCauseGC scope(masm);
-    __ PrepareCallCFunction(0, 2);
-    __ MovToFloatParameters(double_base, double_exponent);
-    __ CallCFunction(ExternalReference::power_double_double_function(isolate()),
-                     0, 2);
-  }
-  __ pop(lr);
-  __ MovFromFloatResult(double_result);
-
-  __ bind(&done);
-  __ Ret();
-}
-
-Movability CEntryStub::NeedsImmovableCode() { return kImmovable; }
-
-void CodeStub::GenerateStubsAheadOfTime(Isolate* isolate) {
-  CEntryStub::GenerateAheadOfTime(isolate);
-  CommonArrayConstructorStub::GenerateStubsAheadOfTime(isolate);
-  StoreFastElementStub::GenerateAheadOfTime(isolate);
-}
-
-
-void CodeStub::GenerateFPStubs(Isolate* isolate) {
-  // Generate if not already in cache.
-  SaveFPRegsMode mode = kSaveFPRegs;
-  CEntryStub(isolate, 1, mode).GetCode();
-}
-
-
-void CEntryStub::GenerateAheadOfTime(Isolate* isolate) {
-  CEntryStub stub(isolate, 1, kDontSaveFPRegs);
-  stub.GetCode();
-}
-
-
-void CEntryStub::Generate(MacroAssembler* masm) {
-  // Called from JavaScript; parameters are on stack as if calling JS function.
-  // r0: number of arguments including receiver
-  // r1: pointer to builtin function
-  // fp: frame pointer  (restored after C call)
-  // sp: stack pointer  (restored as callee's sp after C call)
-  // cp: current context  (C callee-saved)
-  //
-  // If argv_in_register():
-  // r2: pointer to the first argument
-  ProfileEntryHookStub::MaybeCallEntryHook(masm);
-
-  __ mov(r5, Operand(r1));
-
-  if (argv_in_register()) {
-    // Move argv into the correct register.
-    __ mov(r1, Operand(r2));
-  } else {
-    // Compute the argv pointer in a callee-saved register.
-    __ add(r1, sp, Operand(r0, LSL, kPointerSizeLog2));
-    __ sub(r1, r1, Operand(kPointerSize));
-  }
-
-  // Enter the exit frame that transitions from JavaScript to C++.
-  FrameScope scope(masm, StackFrame::MANUAL);
-  __ EnterExitFrame(save_doubles(), 0, is_builtin_exit()
-                                           ? StackFrame::BUILTIN_EXIT
-                                           : StackFrame::EXIT);
-
-  // Store a copy of argc in callee-saved registers for later.
-  __ mov(r4, Operand(r0));
-
-  // r0, r4: number of arguments including receiver  (C callee-saved)
-  // r1: pointer to the first argument (C callee-saved)
-  // r5: pointer to builtin function  (C callee-saved)
-
-#if V8_HOST_ARCH_ARM
-  int frame_alignment = MacroAssembler::ActivationFrameAlignment();
-  int frame_alignment_mask = frame_alignment - 1;
-  if (FLAG_debug_code) {
-    if (frame_alignment > kPointerSize) {
-      Label alignment_as_expected;
-      DCHECK(base::bits::IsPowerOfTwo(frame_alignment));
-      __ tst(sp, Operand(frame_alignment_mask));
-      __ b(eq, &alignment_as_expected);
-      // Don't use Check here, as it will call Runtime_Abort re-entering here.
-      __ stop("Unexpected alignment");
-      __ bind(&alignment_as_expected);
-    }
-  }
-#endif
-
-  // Call C built-in.
-  // r0 = argc, r1 = argv, r2 = isolate
-  __ mov(r2, Operand(ExternalReference::isolate_address(isolate())));
-
-  // To let the GC traverse the return address of the exit frames, we need to
-  // know where the return address is. The CEntryStub is unmovable, so
-  // we can store the address on the stack to be able to find it again and
-  // we never have to restore it, because it will not change.
-  // Compute the return address in lr to return to after the jump below. Pc is
-  // already at '+ 8' from the current instruction but return is after three
-  // instructions so add another 4 to pc to get the return address.
-  {
-    // Prevent literal pool emission before return address.
-    Assembler::BlockConstPoolScope block_const_pool(masm);
-    __ add(lr, pc, Operand(4));
-    __ str(lr, MemOperand(sp));
-    __ Call(r5);
-  }
-
-  // Result returned in r0 or r1:r0 - do not destroy these registers!
-
-  // Check result for exception sentinel.
-  Label exception_returned;
-  __ CompareRoot(r0, Heap::kExceptionRootIndex);
-  __ b(eq, &exception_returned);
-
-  // Check that there is no pending exception, otherwise we
-  // should have returned the exception sentinel.
-  if (FLAG_debug_code) {
-    Label okay;
-    ExternalReference pending_exception_address(
-        IsolateAddressId::kPendingExceptionAddress, isolate());
-    __ mov(r3, Operand(pending_exception_address));
-    __ ldr(r3, MemOperand(r3));
-    __ CompareRoot(r3, Heap::kTheHoleValueRootIndex);
-    // Cannot use check here as it attempts to generate call into runtime.
-    __ b(eq, &okay);
-    __ stop("Unexpected pending exception");
-    __ bind(&okay);
-  }
-
-  // Exit C frame and return.
-  // r0:r1: result
-  // sp: stack pointer
-  // fp: frame pointer
-  Register argc = argv_in_register()
-                      // We don't want to pop arguments so set argc to no_reg.
-                      ? no_reg
-                      // Callee-saved register r4 still holds argc.
-                      : r4;
-  __ LeaveExitFrame(save_doubles(), argc);
-  __ mov(pc, lr);
-
-  // Handling of exception.
-  __ bind(&exception_returned);
-
-  ExternalReference pending_handler_context_address(
-      IsolateAddressId::kPendingHandlerContextAddress, isolate());
-  ExternalReference pending_handler_entrypoint_address(
-      IsolateAddressId::kPendingHandlerEntrypointAddress, isolate());
-  ExternalReference pending_handler_fp_address(
-      IsolateAddressId::kPendingHandlerFPAddress, isolate());
-  ExternalReference pending_handler_sp_address(
-      IsolateAddressId::kPendingHandlerSPAddress, isolate());
-
-  // Ask the runtime for help to determine the handler. This will set r0 to
-  // contain the current pending exception, don't clobber it.
-  ExternalReference find_handler(Runtime::kUnwindAndFindExceptionHandler,
-                                 isolate());
-  {
-    FrameScope scope(masm, StackFrame::MANUAL);
-    __ PrepareCallCFunction(3, 0);
-    __ mov(r0, Operand(0));
-    __ mov(r1, Operand(0));
-    __ mov(r2, Operand(ExternalReference::isolate_address(isolate())));
-    __ CallCFunction(find_handler, 3);
-  }
-
-  // Retrieve the handler context, SP and FP.
-  __ mov(cp, Operand(pending_handler_context_address));
-  __ ldr(cp, MemOperand(cp));
-  __ mov(sp, Operand(pending_handler_sp_address));
-  __ ldr(sp, MemOperand(sp));
-  __ mov(fp, Operand(pending_handler_fp_address));
-  __ ldr(fp, MemOperand(fp));
-
-  // If the handler is a JS frame, restore the context to the frame. Note that
-  // the context will be set to (cp == 0) for non-JS frames.
-  __ cmp(cp, Operand(0));
-  __ str(cp, MemOperand(fp, StandardFrameConstants::kContextOffset), ne);
-
-  // Reset the masking register. This is done independent of the underlying
-  // feature flag {FLAG_branch_load_poisoning} to make the snapshot work with
-  // both configurations. It is safe to always do this, because the underlying
-  // register is caller-saved and can be arbitrarily clobbered.
-  __ ResetSpeculationPoisonRegister();
-
-  // Compute the handler entry address and jump to it.
-  ConstantPoolUnavailableScope constant_pool_unavailable(masm);
-  __ mov(r1, Operand(pending_handler_entrypoint_address));
-  __ ldr(r1, MemOperand(r1));
-  __ Jump(r1);
-}
-
-
 void JSEntryStub::Generate(MacroAssembler* masm) {
   // r0: code entry
   // r1: function
@@ -396,19 +39,23 @@ void JSEntryStub::Generate(MacroAssembler* masm) {
 
   Label invoke, handler_entry, exit;
 
-  ProfileEntryHookStub::MaybeCallEntryHook(masm);
+  {
+    NoRootArrayScope no_root_array(masm);
 
-  // Called from C, so do not pop argc and args on exit (preserve sp)
-  // No need to save register-passed args
-  // Save callee-saved registers (incl. cp and fp), sp, and lr
-  __ stm(db_w, sp, kCalleeSaved | lr.bit());
+    ProfileEntryHookStub::MaybeCallEntryHook(masm);
 
-  // Save callee-saved vfp registers.
-  __ vstm(db_w, sp, kFirstCalleeSavedDoubleReg, kLastCalleeSavedDoubleReg);
-  // Set up the reserved register for 0.0.
-  __ vmov(kDoubleRegZero, Double(0.0));
+    // Called from C, so do not pop argc and args on exit (preserve sp)
+    // No need to save register-passed args
+    // Save callee-saved registers (incl. cp and fp), sp, and lr
+    __ stm(db_w, sp, kCalleeSaved | lr.bit());
 
-  __ InitializeRootRegister();
+    // Save callee-saved vfp registers.
+    __ vstm(db_w, sp, kFirstCalleeSavedDoubleReg, kLastCalleeSavedDoubleReg);
+    // Set up the reserved register for 0.0.
+    __ vmov(kDoubleRegZero, Double(0.0));
+
+    __ InitializeRootRegister();
+  }
 
   // Get address of argv, see stm above.
   // r0: code entry
@@ -430,8 +77,8 @@ void JSEntryStub::Generate(MacroAssembler* masm) {
   StackFrame::Type marker = type();
   __ mov(r7, Operand(StackFrame::TypeToMarker(marker)));
   __ mov(r6, Operand(StackFrame::TypeToMarker(marker)));
-  __ mov(r5, Operand(ExternalReference(IsolateAddressId::kCEntryFPAddress,
-                                       isolate())));
+  __ mov(r5, Operand(ExternalReference::Create(
+                 IsolateAddressId::kCEntryFPAddress, isolate())));
   __ ldr(r5, MemOperand(r5));
   {
     UseScratchRegisterScope temps(masm);
@@ -449,7 +96,8 @@ void JSEntryStub::Generate(MacroAssembler* masm) {
 
   // If this is the outermost JS call, set js_entry_sp value.
   Label non_outermost_js;
-  ExternalReference js_entry_sp(IsolateAddressId::kJSEntrySPAddress, isolate());
+  ExternalReference js_entry_sp =
+      ExternalReference::Create(IsolateAddressId::kJSEntrySPAddress, isolate());
   __ mov(r5, Operand(ExternalReference(js_entry_sp)));
   __ ldr(scratch, MemOperand(r5));
   __ cmp(scratch, Operand::Zero());
@@ -479,8 +127,8 @@ void JSEntryStub::Generate(MacroAssembler* masm) {
     // fp will be invalid because the PushStackHandler below sets it to 0 to
     // signal the existence of the JSEntry frame.
     __ mov(scratch,
-           Operand(ExternalReference(IsolateAddressId::kPendingExceptionAddress,
-                                     isolate())));
+           Operand(ExternalReference::Create(
+               IsolateAddressId::kPendingExceptionAddress, isolate())));
   }
   __ str(r0, MemOperand(scratch));
   __ LoadRoot(r0, Heap::kExceptionRootIndex);
@@ -523,8 +171,8 @@ void JSEntryStub::Generate(MacroAssembler* masm) {
 
   // Restore the top frame descriptors from the stack.
   __ pop(r3);
-  __ mov(scratch, Operand(ExternalReference(IsolateAddressId::kCEntryFPAddress,
-                                            isolate())));
+  __ mov(scratch, Operand(ExternalReference::Create(
+                      IsolateAddressId::kCEntryFPAddress, isolate())));
   __ str(r3, MemOperand(scratch));
 
   // Reset the stack to the callee saved registers.
@@ -554,6 +202,18 @@ void DirectCEntryStub::Generate(MacroAssembler* masm) {
 
 void DirectCEntryStub::GenerateCall(MacroAssembler* masm,
                                     Register target) {
+  if (FLAG_embedded_builtins) {
+    if (masm->root_array_available() &&
+        isolate()->ShouldLoadConstantsFromRootList()) {
+      // This is basically an inlined version of Call(Handle<Code>) that loads
+      // the code object into lr instead of ip.
+      __ Move(ip, target);
+      __ IndirectLoadConstant(lr, GetCode());
+      __ add(lr, lr, Operand(Code::kHeaderSize - kHeapObjectTag));
+      __ blx(lr);
+      return;
+    }
+  }
   intptr_t code =
       reinterpret_cast<intptr_t>(GetCode().location());
   __ Move(ip, target);
@@ -638,9 +298,8 @@ void ProfileEntryHookStub::Generate(MacroAssembler* masm) {
     __ mov(r2, Operand(ExternalReference::isolate_address(isolate())));
 
     ApiFunction dispatcher(FUNCTION_ADDR(EntryHookTrampoline));
-    __ mov(scratch,
-           Operand(ExternalReference(
-               &dispatcher, ExternalReference::BUILTIN_CALL, isolate())));
+    __ mov(scratch, Operand(ExternalReference::Create(
+                        &dispatcher, ExternalReference::BUILTIN_CALL)));
 #endif
     __ Call(scratch);
   }
@@ -654,280 +313,6 @@ void ProfileEntryHookStub::Generate(MacroAssembler* masm) {
   __ ldm(ia_w, sp, kSavedRegs | pc.bit());
 }
 
-
-template<class T>
-static void CreateArrayDispatch(MacroAssembler* masm,
-                                AllocationSiteOverrideMode mode) {
-  if (mode == DISABLE_ALLOCATION_SITES) {
-    T stub(masm->isolate(), GetInitialFastElementsKind(), mode);
-    __ TailCallStub(&stub);
-  } else if (mode == DONT_OVERRIDE) {
-    int last_index =
-        GetSequenceIndexFromFastElementsKind(TERMINAL_FAST_ELEMENTS_KIND);
-    for (int i = 0; i <= last_index; ++i) {
-      ElementsKind kind = GetFastElementsKindFromSequenceIndex(i);
-      __ cmp(r3, Operand(kind));
-      T stub(masm->isolate(), kind);
-      __ TailCallStub(&stub, eq);
-    }
-
-    // If we reached this point there is a problem.
-    __ Abort(AbortReason::kUnexpectedElementsKindInArrayConstructor);
-  } else {
-    UNREACHABLE();
-  }
-}
-
-
-static void CreateArrayDispatchOneArgument(MacroAssembler* masm,
-                                           AllocationSiteOverrideMode mode) {
-  // r2 - allocation site (if mode != DISABLE_ALLOCATION_SITES)
-  // r3 - kind (if mode != DISABLE_ALLOCATION_SITES)
-  // r0 - number of arguments
-  // r1 - constructor?
-  // sp[0] - last argument
-  STATIC_ASSERT(PACKED_SMI_ELEMENTS == 0);
-  STATIC_ASSERT(HOLEY_SMI_ELEMENTS == 1);
-  STATIC_ASSERT(PACKED_ELEMENTS == 2);
-  STATIC_ASSERT(HOLEY_ELEMENTS == 3);
-  STATIC_ASSERT(PACKED_DOUBLE_ELEMENTS == 4);
-  STATIC_ASSERT(HOLEY_DOUBLE_ELEMENTS == 5);
-
-  if (mode == DISABLE_ALLOCATION_SITES) {
-    ElementsKind initial = GetInitialFastElementsKind();
-    ElementsKind holey_initial = GetHoleyElementsKind(initial);
-
-    ArraySingleArgumentConstructorStub stub_holey(masm->isolate(),
-                                                  holey_initial,
-                                                  DISABLE_ALLOCATION_SITES);
-    __ TailCallStub(&stub_holey);
-  } else if (mode == DONT_OVERRIDE) {
-    // is the low bit set? If so, we are holey and that is good.
-    Label normal_sequence;
-    __ tst(r3, Operand(1));
-    __ b(ne, &normal_sequence);
-
-    // We are going to create a holey array, but our kind is non-holey.
-    // Fix kind and retry (only if we have an allocation site in the slot).
-    __ add(r3, r3, Operand(1));
-
-    if (FLAG_debug_code) {
-      __ ldr(r5, FieldMemOperand(r2, 0));
-      __ CompareRoot(r5, Heap::kAllocationSiteMapRootIndex);
-      __ Assert(eq, AbortReason::kExpectedAllocationSite);
-    }
-
-    // Save the resulting elements kind in type info. We can't just store r3
-    // in the AllocationSite::transition_info field because elements kind is
-    // restricted to a portion of the field...upper bits need to be left alone.
-    STATIC_ASSERT(AllocationSite::ElementsKindBits::kShift == 0);
-    __ ldr(r4, FieldMemOperand(
-                   r2, AllocationSite::kTransitionInfoOrBoilerplateOffset));
-    __ add(r4, r4, Operand(Smi::FromInt(kFastElementsKindPackedToHoley)));
-    __ str(r4, FieldMemOperand(
-                   r2, AllocationSite::kTransitionInfoOrBoilerplateOffset));
-
-    __ bind(&normal_sequence);
-    int last_index =
-        GetSequenceIndexFromFastElementsKind(TERMINAL_FAST_ELEMENTS_KIND);
-    for (int i = 0; i <= last_index; ++i) {
-      ElementsKind kind = GetFastElementsKindFromSequenceIndex(i);
-      __ cmp(r3, Operand(kind));
-      ArraySingleArgumentConstructorStub stub(masm->isolate(), kind);
-      __ TailCallStub(&stub, eq);
-    }
-
-    // If we reached this point there is a problem.
-    __ Abort(AbortReason::kUnexpectedElementsKindInArrayConstructor);
-  } else {
-    UNREACHABLE();
-  }
-}
-
-
-template<class T>
-static void ArrayConstructorStubAheadOfTimeHelper(Isolate* isolate) {
-  int to_index =
-      GetSequenceIndexFromFastElementsKind(TERMINAL_FAST_ELEMENTS_KIND);
-  for (int i = 0; i <= to_index; ++i) {
-    ElementsKind kind = GetFastElementsKindFromSequenceIndex(i);
-    T stub(isolate, kind);
-    stub.GetCode();
-    if (AllocationSite::ShouldTrack(kind)) {
-      T stub1(isolate, kind, DISABLE_ALLOCATION_SITES);
-      stub1.GetCode();
-    }
-  }
-}
-
-void CommonArrayConstructorStub::GenerateStubsAheadOfTime(Isolate* isolate) {
-  ArrayConstructorStubAheadOfTimeHelper<ArrayNoArgumentConstructorStub>(
-      isolate);
-  ArrayConstructorStubAheadOfTimeHelper<ArraySingleArgumentConstructorStub>(
-      isolate);
-  ArrayNArgumentsConstructorStub stub(isolate);
-  stub.GetCode();
-  ElementsKind kinds[2] = {PACKED_ELEMENTS, HOLEY_ELEMENTS};
-  for (int i = 0; i < 2; i++) {
-    // For internal arrays we only need a few things
-    InternalArrayNoArgumentConstructorStub stubh1(isolate, kinds[i]);
-    stubh1.GetCode();
-    InternalArraySingleArgumentConstructorStub stubh2(isolate, kinds[i]);
-    stubh2.GetCode();
-  }
-}
-
-
-void ArrayConstructorStub::GenerateDispatchToArrayStub(
-    MacroAssembler* masm,
-    AllocationSiteOverrideMode mode) {
-  Label not_zero_case, not_one_case;
-  __ tst(r0, r0);
-  __ b(ne, &not_zero_case);
-  CreateArrayDispatch<ArrayNoArgumentConstructorStub>(masm, mode);
-
-  __ bind(&not_zero_case);
-  __ cmp(r0, Operand(1));
-  __ b(gt, &not_one_case);
-  CreateArrayDispatchOneArgument(masm, mode);
-
-  __ bind(&not_one_case);
-  ArrayNArgumentsConstructorStub stub(masm->isolate());
-  __ TailCallStub(&stub);
-}
-
-
-void ArrayConstructorStub::Generate(MacroAssembler* masm) {
-  // ----------- S t a t e -------------
-  //  -- r0 : argc (only if argument_count() == ANY)
-  //  -- r1 : constructor
-  //  -- r2 : AllocationSite or undefined
-  //  -- r3 : new target
-  //  -- sp[0] : return address
-  //  -- sp[4] : last argument
-  // -----------------------------------
-
-  if (FLAG_debug_code) {
-    // The array construct code is only set for the global and natives
-    // builtin Array functions which always have maps.
-
-    // Initial map for the builtin Array function should be a map.
-    __ ldr(r4, FieldMemOperand(r1, JSFunction::kPrototypeOrInitialMapOffset));
-    // Will both indicate a nullptr and a Smi.
-    __ tst(r4, Operand(kSmiTagMask));
-    __ Assert(ne, AbortReason::kUnexpectedInitialMapForArrayFunction);
-    __ CompareObjectType(r4, r4, r5, MAP_TYPE);
-    __ Assert(eq, AbortReason::kUnexpectedInitialMapForArrayFunction);
-
-    // We should either have undefined in r2 or a valid AllocationSite
-    __ AssertUndefinedOrAllocationSite(r2, r4);
-  }
-
-  // Enter the context of the Array function.
-  __ ldr(cp, FieldMemOperand(r1, JSFunction::kContextOffset));
-
-  Label subclassing;
-  __ cmp(r3, r1);
-  __ b(ne, &subclassing);
-
-  Label no_info;
-  // Get the elements kind and case on that.
-  __ CompareRoot(r2, Heap::kUndefinedValueRootIndex);
-  __ b(eq, &no_info);
-
-  __ ldr(r3, FieldMemOperand(
-                 r2, AllocationSite::kTransitionInfoOrBoilerplateOffset));
-  __ SmiUntag(r3);
-  STATIC_ASSERT(AllocationSite::ElementsKindBits::kShift == 0);
-  __ and_(r3, r3, Operand(AllocationSite::ElementsKindBits::kMask));
-  GenerateDispatchToArrayStub(masm, DONT_OVERRIDE);
-
-  __ bind(&no_info);
-  GenerateDispatchToArrayStub(masm, DISABLE_ALLOCATION_SITES);
-
-  __ bind(&subclassing);
-  __ str(r1, MemOperand(sp, r0, LSL, kPointerSizeLog2));
-  __ add(r0, r0, Operand(3));
-  __ Push(r3, r2);
-  __ JumpToExternalReference(ExternalReference(Runtime::kNewArray, isolate()));
-}
-
-
-void InternalArrayConstructorStub::GenerateCase(
-    MacroAssembler* masm, ElementsKind kind) {
-  __ cmp(r0, Operand(1));
-
-  InternalArrayNoArgumentConstructorStub stub0(isolate(), kind);
-  __ TailCallStub(&stub0, lo);
-
-  ArrayNArgumentsConstructorStub stubN(isolate());
-  __ TailCallStub(&stubN, hi);
-
-  if (IsFastPackedElementsKind(kind)) {
-    // We might need to create a holey array
-    // look at the first argument
-    __ ldr(r3, MemOperand(sp, 0));
-    __ cmp(r3, Operand::Zero());
-
-    InternalArraySingleArgumentConstructorStub
-        stub1_holey(isolate(), GetHoleyElementsKind(kind));
-    __ TailCallStub(&stub1_holey, ne);
-  }
-
-  InternalArraySingleArgumentConstructorStub stub1(isolate(), kind);
-  __ TailCallStub(&stub1);
-}
-
-
-void InternalArrayConstructorStub::Generate(MacroAssembler* masm) {
-  // ----------- S t a t e -------------
-  //  -- r0 : argc
-  //  -- r1 : constructor
-  //  -- sp[0] : return address
-  //  -- sp[4] : last argument
-  // -----------------------------------
-
-  if (FLAG_debug_code) {
-    // The array construct code is only set for the global and natives
-    // builtin Array functions which always have maps.
-
-    // Initial map for the builtin Array function should be a map.
-    __ ldr(r3, FieldMemOperand(r1, JSFunction::kPrototypeOrInitialMapOffset));
-    // Will both indicate a nullptr and a Smi.
-    __ tst(r3, Operand(kSmiTagMask));
-    __ Assert(ne, AbortReason::kUnexpectedInitialMapForArrayFunction);
-    __ CompareObjectType(r3, r3, r4, MAP_TYPE);
-    __ Assert(eq, AbortReason::kUnexpectedInitialMapForArrayFunction);
-  }
-
-  // Figure out the right elements kind
-  __ ldr(r3, FieldMemOperand(r1, JSFunction::kPrototypeOrInitialMapOffset));
-  // Load the map's "bit field 2" into |result|. We only need the first byte,
-  // but the following bit field extraction takes care of that anyway.
-  __ ldr(r3, FieldMemOperand(r3, Map::kBitField2Offset));
-  // Retrieve elements_kind from bit field 2.
-  __ DecodeField<Map::ElementsKindBits>(r3);
-
-  if (FLAG_debug_code) {
-    Label done;
-    __ cmp(r3, Operand(PACKED_ELEMENTS));
-    __ b(eq, &done);
-    __ cmp(r3, Operand(HOLEY_ELEMENTS));
-    __ Assert(
-        eq,
-        AbortReason::kInvalidElementsKindForInternalArrayOrInternalPackedArray);
-    __ bind(&done);
-  }
-
-  Label fast_elements_case;
-  __ cmp(r3, Operand(PACKED_ELEMENTS));
-  __ b(eq, &fast_elements_case);
-  GenerateCase(masm, HOLEY_ELEMENTS);
-
-  __ bind(&fast_elements_case);
-  GenerateCase(masm, PACKED_ELEMENTS);
-}
-
 static int AddressOffset(ExternalReference ref0, ExternalReference ref1) {
   return ref0.address() - ref1.address();
 }
@@ -956,13 +341,13 @@ static void CallApiFunctionAndReturn(MacroAssembler* masm,
 
   Label profiler_disabled;
   Label end_profiler_check;
-  __ mov(r9, Operand(ExternalReference::is_profiling_address(isolate)));
+  __ Move(r9, ExternalReference::is_profiling_address(isolate));
   __ ldrb(r9, MemOperand(r9, 0));
   __ cmp(r9, Operand(0));
   __ b(eq, &profiler_disabled);
 
   // Additional parameter is the address of the actual callback.
-  __ mov(r3, Operand(thunk_ref));
+  __ Move(r3, thunk_ref);
   __ jmp(&end_profiler_check);
 
   __ bind(&profiler_disabled);
@@ -970,7 +355,7 @@ static void CallApiFunctionAndReturn(MacroAssembler* masm,
   __ bind(&end_profiler_check);
 
   // Allocate HandleScope in callee-save registers.
-  __ mov(r9, Operand(next_address));
+  __ Move(r9, next_address);
   __ ldr(r4, MemOperand(r9, kNextOffset));
   __ ldr(r5, MemOperand(r9, kLimitOffset));
   __ ldr(r6, MemOperand(r9, kLevelOffset));
@@ -981,9 +366,8 @@ static void CallApiFunctionAndReturn(MacroAssembler* masm,
     FrameScope frame(masm, StackFrame::MANUAL);
     __ PushSafepointRegisters();
     __ PrepareCallCFunction(1);
-    __ mov(r0, Operand(ExternalReference::isolate_address(isolate)));
-    __ CallCFunction(ExternalReference::log_enter_external_function(isolate),
-                     1);
+    __ Move(r0, ExternalReference::isolate_address(isolate));
+    __ CallCFunction(ExternalReference::log_enter_external_function(), 1);
     __ PopSafepointRegisters();
   }
 
@@ -997,9 +381,8 @@ static void CallApiFunctionAndReturn(MacroAssembler* masm,
     FrameScope frame(masm, StackFrame::MANUAL);
     __ PushSafepointRegisters();
     __ PrepareCallCFunction(1);
-    __ mov(r0, Operand(ExternalReference::isolate_address(isolate)));
-    __ CallCFunction(ExternalReference::log_leave_external_function(isolate),
-                     1);
+    __ Move(r0, ExternalReference::isolate_address(isolate));
+    __ CallCFunction(ExternalReference::log_leave_external_function(), 1);
     __ PopSafepointRegisters();
   }
 
@@ -1037,7 +420,7 @@ static void CallApiFunctionAndReturn(MacroAssembler* masm,
 
   // Check if the function scheduled an exception.
   __ LoadRoot(r4, Heap::kTheHoleValueRootIndex);
-  __ mov(r6, Operand(ExternalReference::scheduled_exception_address(isolate)));
+  __ Move(r6, ExternalReference::scheduled_exception_address(isolate));
   __ ldr(r5, MemOperand(r6));
   __ cmp(r4, r5);
   __ b(ne, &promote_scheduled_exception);
@@ -1053,9 +436,8 @@ static void CallApiFunctionAndReturn(MacroAssembler* masm,
   __ str(r5, MemOperand(r9, kLimitOffset));
   __ mov(r4, r0);
   __ PrepareCallCFunction(1);
-  __ mov(r0, Operand(ExternalReference::isolate_address(isolate)));
-  __ CallCFunction(ExternalReference::delete_handle_scope_extensions(isolate),
-                   1);
+  __ Move(r0, ExternalReference::isolate_address(isolate));
+  __ CallCFunction(ExternalReference::delete_handle_scope_extensions(), 1);
   __ mov(r0, r4);
   __ jmp(&leave_exit_frame);
 }
@@ -1101,8 +483,7 @@ void CallApiCallbackStub::Generate(MacroAssembler* masm) {
   // return value default
   __ push(scratch0);
   // isolate
-  __ mov(scratch1,
-         Operand(ExternalReference::isolate_address(masm->isolate())));
+  __ Move(scratch1, ExternalReference::isolate_address(masm->isolate()));
   __ push(scratch1);
   // holder
   __ push(holder);
@@ -1131,8 +512,7 @@ void CallApiCallbackStub::Generate(MacroAssembler* masm) {
   __ mov(scratch0, Operand(argc()));
   __ str(scratch0, MemOperand(r0, 2 * kPointerSize));
 
-  ExternalReference thunk_ref =
-      ExternalReference::invoke_function_callback(masm->isolate());
+  ExternalReference thunk_ref = ExternalReference::invoke_function_callback();
 
   AllowExternalCallThatCantCauseGC scope(masm);
   // Stores return the first js argument
@@ -1172,7 +552,7 @@ void CallApiGetterStub::Generate(MacroAssembler* masm) {
   __ push(scratch);
   __ LoadRoot(scratch, Heap::kUndefinedValueRootIndex);
   __ Push(scratch, scratch);
-  __ mov(scratch, Operand(ExternalReference::isolate_address(isolate())));
+  __ Move(scratch, ExternalReference::isolate_address(isolate()));
   __ Push(scratch, holder);
   __ Push(Smi::kZero);  // should_throw_on_error -> false
   __ ldr(scratch, FieldMemOperand(callback, AccessorInfo::kNameOffset));
@@ -1194,7 +574,7 @@ void CallApiGetterStub::Generate(MacroAssembler* masm) {
   __ add(r1, sp, Operand(1 * kPointerSize));  // r1 = v8::PropertyCallbackInfo&
 
   ExternalReference thunk_ref =
-      ExternalReference::invoke_accessor_getter_callback(isolate());
+      ExternalReference::invoke_accessor_getter_callback();
 
   __ ldr(scratch, FieldMemOperand(callback, AccessorInfo::kJsGetterOffset));
   __ ldr(api_function_address,
diff --git a/deps/v8/src/arm/constants-arm.h b/deps/v8/src/arm/constants-arm.h
index 4e52a91738398f..1d041e75be2d1c 100644
--- a/deps/v8/src/arm/constants-arm.h
+++ b/deps/v8/src/arm/constants-arm.h
@@ -11,6 +11,7 @@
 #include "src/base/macros.h"
 #include "src/boxed-float.h"
 #include "src/globals.h"
+#include "src/utils.h"
 
 // ARM EABI is required.
 #if defined(__arm__) && !defined(__ARM_EABI__)
@@ -51,6 +52,12 @@ const int kNoRegister = -1;
 const int kLdrMaxReachBits = 12;
 const int kVldrMaxReachBits = 10;
 
+// Actual value of root register is offset from the root array's start
+// to take advantage of negative displacement values. Loads allow a uint12
+// value with a separate sign bit (range [-4095, +4095]), so the first root
+// is still addressable with a single load instruction.
+constexpr int kRootRegisterBias = 4095;
+
 // -----------------------------------------------------------------------------
 // Conditions.
 
@@ -462,15 +469,19 @@ class Instruction {
     kPCReadOffset = 8
   };
 
-  // Helper macro to define static accessors.
-  // We use the cast to char* trick to bypass the strict anti-aliasing rules.
-  #define DECLARE_STATIC_TYPED_ACCESSOR(return_type, Name)                     \
-    static inline return_type Name(Instr instr) {                              \
-      char* temp = reinterpret_cast<char*>(&instr);                            \
-      return reinterpret_cast<Instruction*>(temp)->Name();                     \
-    }
+  // Difference between address of current opcode and value read from pc
+  // register.
+  static constexpr int kPcLoadDelta = 8;
 
-  #define DECLARE_STATIC_ACCESSOR(Name) DECLARE_STATIC_TYPED_ACCESSOR(int, Name)
+// Helper macro to define static accessors.
+// We use the cast to char* trick to bypass the strict anti-aliasing rules.
+#define DECLARE_STATIC_TYPED_ACCESSOR(return_type, Name) \
+  static inline return_type Name(Instr instr) {          \
+    char* temp = reinterpret_cast<char*>(&instr);        \
+    return reinterpret_cast<Instruction*>(temp)->Name(); \
+  }
+
+#define DECLARE_STATIC_ACCESSOR(Name) DECLARE_STATIC_TYPED_ACCESSOR(int, Name)
 
   // Get the raw instruction bits.
   inline Instr InstructionBits() const {
@@ -624,7 +635,25 @@ class Instruction {
 
   // Fields used in Branch instructions
   inline int LinkValue() const { return Bit(24); }
-  inline int SImmed24Value() const { return ((InstructionBits() << 8) >> 8); }
+  inline int SImmed24Value() const {
+    return signed_bitextract_32(23, 0, InstructionBits());
+  }
+
+  bool IsBranch() { return Bit(27) == 1 && Bit(25) == 1; }
+
+  int GetBranchOffset() {
+    DCHECK(IsBranch());
+    return SImmed24Value() * kInstrSize;
+  }
+
+  void SetBranchOffset(int32_t branch_offset) {
+    DCHECK(IsBranch());
+    DCHECK_EQ(branch_offset % kInstrSize, 0);
+    int32_t new_imm24 = branch_offset / kInstrSize;
+    CHECK(is_int24(new_imm24));
+    SetInstructionBits((InstructionBits() & ~(kImm24Mask)) |
+                       (new_imm24 & kImm24Mask));
+  }
 
   // Fields used in Software interrupt instructions
   inline SoftwareInterruptCodes SvcValue() const {
@@ -666,7 +695,7 @@ class Instruction {
   // reference to an instruction is to convert a pointer. There is no way
   // to allocate or create instances of class Instruction.
   // Use the At(pc) function to create references to Instruction.
-  static Instruction* At(byte* pc) {
+  static Instruction* At(Address pc) {
     return reinterpret_cast<Instruction*>(pc);
   }
 
@@ -729,6 +758,8 @@ class VFPRegisters {
   static const char* names_[kNumVFPRegisters];
 };
 
+// Relative jumps on ARM can address ±32 MB.
+constexpr size_t kMaxPCRelativeCodeRangeInMB = 32;
 
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/src/arm/deoptimizer-arm.cc b/deps/v8/src/arm/deoptimizer-arm.cc
index a4a540512d9dc2..032f610edcead2 100644
--- a/deps/v8/src/arm/deoptimizer-arm.cc
+++ b/deps/v8/src/arm/deoptimizer-arm.cc
@@ -58,7 +58,7 @@ void Deoptimizer::TableEntryGenerator::Generate() {
   {
     UseScratchRegisterScope temps(masm());
     Register scratch = temps.Acquire();
-    __ mov(scratch, Operand(ExternalReference(
+    __ mov(scratch, Operand(ExternalReference::Create(
                         IsolateAddressId::kCEntryFPAddress, isolate())));
     __ str(fp, MemOperand(scratch));
   }
@@ -86,7 +86,7 @@ void Deoptimizer::TableEntryGenerator::Generate() {
   __ JumpIfSmi(r1, &context_check);
   __ ldr(r0, MemOperand(fp, JavaScriptFrameConstants::kFunctionOffset));
   __ bind(&context_check);
-  __ mov(r1, Operand(type()));  // bailout type,
+  __ mov(r1, Operand(static_cast<int>(deopt_kind())));
   // r2: bailout id already loaded.
   // r3: code address or 0 already loaded.
   __ str(r4, MemOperand(sp, 0 * kPointerSize));  // Fp-to-sp delta.
@@ -95,7 +95,7 @@ void Deoptimizer::TableEntryGenerator::Generate() {
   // Call Deoptimizer::New().
   {
     AllowExternalCallThatCantCauseGC scope(masm());
-    __ CallCFunction(ExternalReference::new_deoptimizer_function(isolate()), 6);
+    __ CallCFunction(ExternalReference::new_deoptimizer_function(), 6);
   }
 
   // Preserve "deoptimizer" object in register r0 and get the input
@@ -164,8 +164,7 @@ void Deoptimizer::TableEntryGenerator::Generate() {
   // Call Deoptimizer::ComputeOutputFrames().
   {
     AllowExternalCallThatCantCauseGC scope(masm());
-    __ CallCFunction(
-        ExternalReference::compute_output_frames_function(isolate()), 1);
+    __ CallCFunction(ExternalReference::compute_output_frames_function(), 1);
   }
   __ pop(r0);  // Restore deoptimizer object (class Deoptimizer).
 
diff --git a/deps/v8/src/arm/disasm-arm.cc b/deps/v8/src/arm/disasm-arm.cc
index 9459a7e60de85a..5dab458889624c 100644
--- a/deps/v8/src/arm/disasm-arm.cc
+++ b/deps/v8/src/arm/disasm-arm.cc
@@ -2592,7 +2592,7 @@ int Decoder::ConstantPoolSizeAt(byte* instr_ptr) {
 
 // Disassemble the instruction at *instr_ptr into the output buffer.
 int Decoder::InstructionDecode(byte* instr_ptr) {
-  Instruction* instr = Instruction::At(instr_ptr);
+  Instruction* instr = Instruction::At(reinterpret_cast<Address>(instr_ptr));
   // Print raw instruction bytes.
   out_buffer_pos_ += SNPrintF(out_buffer_ + out_buffer_pos_,
                               "%08x       ",
diff --git a/deps/v8/src/arm/frame-constants-arm.h b/deps/v8/src/arm/frame-constants-arm.h
index 3d69f6dfd1d4bf..73e171009dc2f4 100644
--- a/deps/v8/src/arm/frame-constants-arm.h
+++ b/deps/v8/src/arm/frame-constants-arm.h
@@ -5,6 +5,9 @@
 #ifndef V8_ARM_FRAME_CONSTANTS_ARM_H_
 #define V8_ARM_FRAME_CONSTANTS_ARM_H_
 
+#include "src/base/macros.h"
+#include "src/frame-constants.h"
+
 namespace v8 {
 namespace internal {
 
@@ -30,6 +33,19 @@ class ExitFrameConstants : public TypedFrameConstants {
   static constexpr int kCallerSPDisplacement = 2 * kPointerSize;
 };
 
+class WasmCompileLazyFrameConstants : public TypedFrameConstants {
+ public:
+  static constexpr int kNumberOfSavedGpParamRegs = 4;
+  static constexpr int kNumberOfSavedFpParamRegs = 8;
+
+  // FP-relative.
+  static constexpr int kWasmInstanceOffset = TYPED_FRAME_PUSHED_VALUE_OFFSET(0);
+  static constexpr int kFixedFrameSizeFromFp =
+      TypedFrameConstants::kFixedFrameSizeFromFp +
+      kNumberOfSavedGpParamRegs * kPointerSize +
+      kNumberOfSavedFpParamRegs * kDoubleSize;
+};
+
 class JavaScriptFrameConstants : public AllStatic {
  public:
   // FP-relative.
diff --git a/deps/v8/src/arm/interface-descriptors-arm.cc b/deps/v8/src/arm/interface-descriptors-arm.cc
index 20ecef6c1cc5d7..b96826264a0f66 100644
--- a/deps/v8/src/arm/interface-descriptors-arm.cc
+++ b/deps/v8/src/arm/interface-descriptors-arm.cc
@@ -2,8 +2,6 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#include "src/arm/interface-descriptors-arm.h"
-
 #if V8_TARGET_ARCH_ARM
 
 #include "src/interface-descriptors.h"
@@ -34,7 +32,7 @@ void RecordWriteDescriptor::InitializePlatformSpecific(
   data->InitializePlatformSpecific(kParameterCount, default_stub_registers);
 }
 
-const Register FastNewFunctionContextDescriptor::FunctionRegister() {
+const Register FastNewFunctionContextDescriptor::ScopeInfoRegister() {
   return r1;
 }
 const Register FastNewFunctionContextDescriptor::SlotsRegister() { return r0; }
@@ -59,13 +57,6 @@ const Register StoreTransitionDescriptor::MapRegister() { return r5; }
 const Register ApiGetterDescriptor::HolderRegister() { return r0; }
 const Register ApiGetterDescriptor::CallbackRegister() { return r3; }
 
-const Register MathPowTaggedDescriptor::exponent() { return r2; }
-
-const Register MathPowIntegerDescriptor::exponent() {
-  return MathPowTaggedDescriptor::exponent();
-}
-
-
 const Register GrowArrayElementsDescriptor::ObjectRegister() { return r0; }
 const Register GrowArrayElementsDescriptor::KeyRegister() { return r3; }
 
@@ -179,24 +170,7 @@ void ConstructStubDescriptor::InitializePlatformSpecific(
   data->InitializePlatformSpecific(arraysize(registers), registers);
 }
 
-
-void ConstructTrampolineDescriptor::InitializePlatformSpecific(
-    CallInterfaceDescriptorData* data) {
-  // r0 : number of arguments
-  // r1 : the target to call
-  // r3 : the new target
-  Register registers[] = {r1, r3, r0};
-  data->InitializePlatformSpecific(arraysize(registers), registers);
-}
-
-
-void TransitionElementsKindDescriptor::InitializePlatformSpecific(
-    CallInterfaceDescriptorData* data) {
-  Register registers[] = {r0, r1};
-  data->InitializePlatformSpecific(arraysize(registers), registers);
-}
-
-void AbortJSDescriptor::InitializePlatformSpecific(
+void AbortDescriptor::InitializePlatformSpecific(
     CallInterfaceDescriptorData* data) {
   Register registers[] = {r1};
   data->InitializePlatformSpecific(arraysize(registers), registers);
@@ -204,41 +178,7 @@ void AbortJSDescriptor::InitializePlatformSpecific(
 
 void AllocateHeapNumberDescriptor::InitializePlatformSpecific(
     CallInterfaceDescriptorData* data) {
-  data->InitializePlatformSpecific(0, nullptr, nullptr);
-}
-
-void ArrayConstructorDescriptor::InitializePlatformSpecific(
-    CallInterfaceDescriptorData* data) {
-  // kTarget, kNewTarget, kActualArgumentsCount, kAllocationSite
-  Register registers[] = {r1, r3, r0, r2};
-  data->InitializePlatformSpecific(arraysize(registers), registers, nullptr);
-}
-
-void ArrayNoArgumentConstructorDescriptor::InitializePlatformSpecific(
-    CallInterfaceDescriptorData* data) {
-  // register state
-  // r0 -- number of arguments
-  // r1 -- function
-  // r2 -- allocation site with elements kind
-  Register registers[] = {r1, r2, r0};
-  data->InitializePlatformSpecific(arraysize(registers), registers, nullptr);
-}
-
-void ArraySingleArgumentConstructorDescriptor::InitializePlatformSpecific(
-    CallInterfaceDescriptorData* data) {
-  // register state
-  // r0 -- number of arguments
-  // r1 -- function
-  // r2 -- allocation site with elements kind
-  Register registers[] = {r1, r2, r0};
-  data->InitializePlatformSpecific(arraysize(registers), registers, nullptr);
-}
-
-void ArrayNArgumentsConstructorDescriptor::InitializePlatformSpecific(
-    CallInterfaceDescriptorData* data) {
-  // stack param count needs (constructor pointer, and single argument)
-  Register registers[] = {r1, r2, r0};
-  data->InitializePlatformSpecific(arraysize(registers), registers);
+  data->InitializePlatformSpecific(0, nullptr);
 }
 
 void CompareDescriptor::InitializePlatformSpecific(
@@ -247,47 +187,32 @@ void CompareDescriptor::InitializePlatformSpecific(
   data->InitializePlatformSpecific(arraysize(registers), registers);
 }
 
-
 void BinaryOpDescriptor::InitializePlatformSpecific(
     CallInterfaceDescriptorData* data) {
   Register registers[] = {r1, r0};
   data->InitializePlatformSpecific(arraysize(registers), registers);
 }
 
-void StringAddDescriptor::InitializePlatformSpecific(
-    CallInterfaceDescriptorData* data) {
-  Register registers[] = {r1, r0};
-  data->InitializePlatformSpecific(arraysize(registers), registers);
-}
-
 void ArgumentAdaptorDescriptor::InitializePlatformSpecific(
     CallInterfaceDescriptorData* data) {
-  static PlatformInterfaceDescriptor default_descriptor =
-      PlatformInterfaceDescriptor(CAN_INLINE_TARGET_ADDRESS);
-
   Register registers[] = {
       r1,  // JSFunction
       r3,  // the new target
       r0,  // actual number of arguments
       r2,  // expected number of arguments
   };
-  data->InitializePlatformSpecific(arraysize(registers), registers,
-                                   &default_descriptor);
+  data->InitializePlatformSpecific(arraysize(registers), registers);
 }
 
 void ApiCallbackDescriptor::InitializePlatformSpecific(
     CallInterfaceDescriptorData* data) {
-  static PlatformInterfaceDescriptor default_descriptor =
-      PlatformInterfaceDescriptor(CAN_INLINE_TARGET_ADDRESS);
-
   Register registers[] = {
       JavaScriptFrame::context_register(),  // callee context
       r4,                                   // call_data
       r2,                                   // holder
       r1,                                   // api_function_address
   };
-  data->InitializePlatformSpecific(arraysize(registers), registers,
-                                   &default_descriptor);
+  data->InitializePlatformSpecific(arraysize(registers), registers);
 }
 
 void InterpreterDispatchDescriptor::InitializePlatformSpecific(
@@ -320,7 +245,9 @@ void InterpreterPushArgsThenConstructDescriptor::InitializePlatformSpecific(
   data->InitializePlatformSpecific(arraysize(registers), registers);
 }
 
-void InterpreterCEntryDescriptor::InitializePlatformSpecific(
+namespace {
+
+void InterpreterCEntryDescriptor_InitializePlatformSpecific(
     CallInterfaceDescriptorData* data) {
   Register registers[] = {
       r0,  // argument count (argc)
@@ -330,6 +257,18 @@ void InterpreterCEntryDescriptor::InitializePlatformSpecific(
   data->InitializePlatformSpecific(arraysize(registers), registers);
 }
 
+}  // namespace
+
+void InterpreterCEntry1Descriptor::InitializePlatformSpecific(
+    CallInterfaceDescriptorData* data) {
+  InterpreterCEntryDescriptor_InitializePlatformSpecific(data);
+}
+
+void InterpreterCEntry2Descriptor::InitializePlatformSpecific(
+    CallInterfaceDescriptorData* data) {
+  InterpreterCEntryDescriptor_InitializePlatformSpecific(data);
+}
+
 void ResumeGeneratorDescriptor::InitializePlatformSpecific(
     CallInterfaceDescriptorData* data) {
   Register registers[] = {
diff --git a/deps/v8/src/arm/interface-descriptors-arm.h b/deps/v8/src/arm/interface-descriptors-arm.h
deleted file mode 100644
index a64927924e8800..00000000000000
--- a/deps/v8/src/arm/interface-descriptors-arm.h
+++ /dev/null
@@ -1,26 +0,0 @@
-// Copyright 2012 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef V8_ARM_INTERFACE_DESCRIPTORS_ARM_H_
-#define V8_ARM_INTERFACE_DESCRIPTORS_ARM_H_
-
-#include "src/interface-descriptors.h"
-
-namespace v8 {
-namespace internal {
-
-class PlatformInterfaceDescriptor {
- public:
-  explicit PlatformInterfaceDescriptor(TargetAddressStorageMode storage_mode)
-      : storage_mode_(storage_mode) {}
-
-  TargetAddressStorageMode storage_mode() { return storage_mode_; }
-
- private:
-  TargetAddressStorageMode storage_mode_;
-};
-}  // namespace internal
-}  // namespace v8
-
-#endif  // V8_ARM_INTERFACE_DESCRIPTORS_ARM_H_
diff --git a/deps/v8/src/arm/macro-assembler-arm.cc b/deps/v8/src/arm/macro-assembler-arm.cc
index e363e0ecfe9313..d02766791bb32d 100644
--- a/deps/v8/src/arm/macro-assembler-arm.cc
+++ b/deps/v8/src/arm/macro-assembler-arm.cc
@@ -12,6 +12,7 @@
 #include "src/base/utils/random-number-generator.h"
 #include "src/bootstrapper.h"
 #include "src/callable.h"
+#include "src/code-factory.h"
 #include "src/code-stubs.h"
 #include "src/counters.h"
 #include "src/debug/debug.h"
@@ -22,22 +23,25 @@
 #include "src/objects-inl.h"
 #include "src/register-configuration.h"
 #include "src/runtime/runtime.h"
+#include "src/snapshot/snapshot.h"
 
 #include "src/arm/macro-assembler-arm.h"
 
 namespace v8 {
 namespace internal {
 
-MacroAssembler::MacroAssembler(Isolate* isolate, void* buffer, int size,
-                               CodeObjectRequired create_code_object)
-    : TurboAssembler(isolate, buffer, size, create_code_object) {}
-
-TurboAssembler::TurboAssembler(Isolate* isolate, void* buffer, int buffer_size,
-                               CodeObjectRequired create_code_object)
-    : Assembler(isolate, buffer, buffer_size), isolate_(isolate) {
+MacroAssembler::MacroAssembler(Isolate* isolate,
+                               const AssemblerOptions& options, void* buffer,
+                               int size, CodeObjectRequired create_code_object)
+    : TurboAssembler(isolate, options, buffer, size, create_code_object) {
   if (create_code_object == CodeObjectRequired::kYes) {
-    code_object_ =
-        Handle<HeapObject>::New(isolate->heap()->undefined_value(), isolate);
+    // Unlike TurboAssembler, which can be used off the main thread and may not
+    // allocate, macro assembler creates its own copy of the self-reference
+    // marker in order to disambiguate between self-references during nested
+    // code generation (e.g.: codegen of the current object triggers stub
+    // compilation through CodeStub::GetCode()).
+    code_object_ = Handle<HeapObject>::New(
+        *isolate->factory()->NewSelfReferenceMarker(), isolate);
   }
 }
 
@@ -122,6 +126,48 @@ int TurboAssembler::PopCallerSaved(SaveFPRegsMode fp_mode, Register exclusion1,
   return bytes;
 }
 
+void TurboAssembler::LoadFromConstantsTable(Register destination,
+                                            int constant_index) {
+  DCHECK(isolate()->heap()->RootCanBeTreatedAsConstant(
+      Heap::kBuiltinsConstantsTableRootIndex));
+
+  // The ldr call below could end up clobbering ip when the offset does not fit
+  // into 12 bits (and thus needs to be loaded from the constant pool). In that
+  // case, we need to be extra-careful and temporarily use another register as
+  // the target.
+
+  const uint32_t offset =
+      FixedArray::kHeaderSize + constant_index * kPointerSize - kHeapObjectTag;
+  const bool could_clobber_ip = !is_uint12(offset);
+
+  Register reg = destination;
+  if (could_clobber_ip) {
+    Push(r7);
+    reg = r7;
+  }
+
+  LoadRoot(reg, Heap::kBuiltinsConstantsTableRootIndex);
+  ldr(destination, MemOperand(reg, offset));
+
+  if (could_clobber_ip) {
+    DCHECK_EQ(reg, r7);
+    Pop(r7);
+  }
+}
+
+void TurboAssembler::LoadRootRelative(Register destination, int32_t offset) {
+  ldr(destination, MemOperand(kRootRegister, offset));
+}
+
+void TurboAssembler::LoadRootRegisterOffset(Register destination,
+                                            intptr_t offset) {
+  if (offset == 0) {
+    Move(destination, kRootRegister);
+  } else {
+    add(destination, kRootRegister, Operand(offset));
+  }
+}
+
 void TurboAssembler::Jump(Register target, Condition cond) { bx(target, cond); }
 
 void TurboAssembler::Jump(intptr_t target, RelocInfo::Mode rmode,
@@ -133,14 +179,44 @@ void TurboAssembler::Jump(intptr_t target, RelocInfo::Mode rmode,
 void TurboAssembler::Jump(Address target, RelocInfo::Mode rmode,
                           Condition cond) {
   DCHECK(!RelocInfo::IsCodeTarget(rmode));
-  Jump(reinterpret_cast<intptr_t>(target), rmode, cond);
+  Jump(static_cast<intptr_t>(target), rmode, cond);
 }
 
 void TurboAssembler::Jump(Handle<Code> code, RelocInfo::Mode rmode,
                           Condition cond) {
   DCHECK(RelocInfo::IsCodeTarget(rmode));
+  if (FLAG_embedded_builtins) {
+    int builtin_index = Builtins::kNoBuiltinId;
+    bool target_is_isolate_independent_builtin =
+        isolate()->builtins()->IsBuiltinHandle(code, &builtin_index) &&
+        Builtins::IsIsolateIndependent(builtin_index);
+    if (target_is_isolate_independent_builtin &&
+        options().use_pc_relative_calls_and_jumps) {
+      int32_t code_target_index = AddCodeTarget(code);
+      b(code_target_index * Instruction::kInstrSize, cond,
+        RelocInfo::RELATIVE_CODE_TARGET);
+      return;
+    } else if (root_array_available_ && options().isolate_independent_code) {
+      UseScratchRegisterScope temps(this);
+      Register scratch = temps.Acquire();
+      IndirectLoadConstant(scratch, code);
+      add(scratch, scratch, Operand(Code::kHeaderSize - kHeapObjectTag));
+      Jump(scratch, cond);
+      return;
+    } else if (target_is_isolate_independent_builtin &&
+               options().inline_offheap_trampolines) {
+      // Inline the trampoline.
+      EmbeddedData d = EmbeddedData::FromBlob();
+      Address entry = d.InstructionStartOfBuiltin(builtin_index);
+      // Use ip directly instead of using UseScratchRegisterScope, as we do not
+      // preserve scratch registers across calls.
+      mov(ip, Operand(entry, RelocInfo::OFF_HEAP_TARGET));
+      Jump(ip, cond);
+      return;
+    }
+  }
   // 'code' is always generated ARM code, never THUMB code
-  Jump(reinterpret_cast<intptr_t>(code.address()), rmode, cond);
+  Jump(static_cast<intptr_t>(code.address()), rmode, cond);
 }
 
 int TurboAssembler::CallSize(Register target, Condition cond) {
@@ -159,7 +235,7 @@ void TurboAssembler::Call(Register target, Condition cond) {
 int TurboAssembler::CallSize(Address target, RelocInfo::Mode rmode,
                              Condition cond) {
   Instr mov_instr = cond | MOV | LeaveCC;
-  Operand mov_operand = Operand(reinterpret_cast<intptr_t>(target), rmode);
+  Operand mov_operand = Operand(target, rmode);
   return kInstrSize +
          mov_operand.InstructionsRequired(this, mov_instr) * kInstrSize;
 }
@@ -203,7 +279,7 @@ void TurboAssembler::Call(Address target, RelocInfo::Mode rmode, Condition cond,
   //  blx   ip
   //                      @ return address
 
-  mov(ip, Operand(reinterpret_cast<int32_t>(target), rmode));
+  mov(ip, Operand(target, rmode));
   blx(ip, cond);
 
   DCHECK_EQ(expected_size, SizeOfCodeGeneratedSince(&start));
@@ -221,6 +297,37 @@ void TurboAssembler::Call(Handle<Code> code, RelocInfo::Mode rmode,
                           Condition cond, TargetAddressStorageMode mode,
                           bool check_constant_pool) {
   DCHECK(RelocInfo::IsCodeTarget(rmode));
+  if (FLAG_embedded_builtins) {
+    int builtin_index = Builtins::kNoBuiltinId;
+    bool target_is_isolate_independent_builtin =
+        isolate()->builtins()->IsBuiltinHandle(code, &builtin_index) &&
+        Builtins::IsIsolateIndependent(builtin_index);
+    if (target_is_isolate_independent_builtin &&
+        options().use_pc_relative_calls_and_jumps) {
+      int32_t code_target_index = AddCodeTarget(code);
+      bl(code_target_index * Instruction::kInstrSize, cond,
+         RelocInfo::RELATIVE_CODE_TARGET);
+      return;
+    } else if (root_array_available_ && options().isolate_independent_code) {
+      // Use ip directly instead of using UseScratchRegisterScope, as we do not
+      // preserve scratch registers across calls.
+      IndirectLoadConstant(ip, code);
+      add(ip, ip, Operand(Code::kHeaderSize - kHeapObjectTag));
+      Call(ip, cond);
+      return;
+    } else if (target_is_isolate_independent_builtin &&
+               options().inline_offheap_trampolines) {
+      // Inline the trampoline.
+      DCHECK(Builtins::IsBuiltinId(builtin_index));
+      EmbeddedData d = EmbeddedData::FromBlob();
+      Address entry = d.InstructionStartOfBuiltin(builtin_index);
+      // Use ip directly instead of using UseScratchRegisterScope, as we do not
+      // preserve scratch registers across calls.
+      mov(ip, Operand(entry, RelocInfo::OFF_HEAP_TARGET));
+      Call(ip, cond);
+      return;
+    }
+  }
   // 'code' is always generated ARM code, never THUMB code
   Call(code.address(), rmode, cond, mode);
 }
@@ -261,9 +368,25 @@ void TurboAssembler::Push(Smi* smi) {
 void TurboAssembler::Move(Register dst, Smi* smi) { mov(dst, Operand(smi)); }
 
 void TurboAssembler::Move(Register dst, Handle<HeapObject> value) {
+  if (FLAG_embedded_builtins) {
+    if (root_array_available_ && options().isolate_independent_code) {
+      IndirectLoadConstant(dst, value);
+      return;
+    }
+  }
   mov(dst, Operand(value));
 }
 
+void TurboAssembler::Move(Register dst, ExternalReference reference) {
+  if (FLAG_embedded_builtins) {
+    if (root_array_available_ && options().isolate_independent_code) {
+      IndirectLoadExternalReference(dst, reference);
+      return;
+    }
+  }
+  mov(dst, Operand(reference));
+}
+
 void TurboAssembler::Move(Register dst, Register src, Condition cond) {
   if (dst != src) {
     mov(dst, src, LeaveCC, cond);
@@ -440,7 +563,7 @@ void MacroAssembler::Store(Register src,
 
 void TurboAssembler::LoadRoot(Register destination, Heap::RootListIndex index,
                               Condition cond) {
-  ldr(destination, MemOperand(kRootRegister, index << kPointerSizeLog2), cond);
+  ldr(destination, MemOperand(kRootRegister, RootRegisterOffset(index)), cond);
 }
 
 
@@ -539,8 +662,7 @@ void TurboAssembler::CallRecordWriteStub(
   Pop(slot_parameter);
   Pop(object_parameter);
 
-  Move(isolate_parameter,
-       Operand(ExternalReference::isolate_address(isolate())));
+  Move(isolate_parameter, ExternalReference::isolate_address(isolate()));
   Move(remembered_set_parameter, Smi::FromEnum(remembered_set_action));
   Move(fp_mode_parameter, Smi::FromEnum(fp_mode));
   Call(callable.code(), RelocInfo::CODE_TARGET);
@@ -558,10 +680,12 @@ void MacroAssembler::RecordWrite(Register object, Register address,
                                  SmiCheck smi_check) {
   DCHECK(object != value);
   if (emit_debug_code()) {
-    UseScratchRegisterScope temps(this);
-    Register scratch = temps.Acquire();
-    ldr(scratch, MemOperand(address));
-    cmp(scratch, value);
+    {
+      UseScratchRegisterScope temps(this);
+      Register scratch = temps.Acquire();
+      ldr(scratch, MemOperand(address));
+      cmp(scratch, value);
+    }
     Check(eq, AbortReason::kWrongAddressOrValuePassedToRecordWrite);
   }
 
@@ -1099,10 +1223,6 @@ void TurboAssembler::EnterFrame(StackFrame::Type type,
   Register scratch = temps.Acquire();
   mov(scratch, Operand(StackFrame::TypeToMarker(type)));
   PushCommonFrame(scratch);
-  if (type == StackFrame::INTERNAL) {
-    mov(scratch, Operand(CodeObject()));
-    push(scratch);
-  }
 }
 
 int TurboAssembler::LeaveFrame(StackFrame::Type type) {
@@ -1137,15 +1257,15 @@ void MacroAssembler::EnterExitFrame(bool save_doubles, int stack_space,
     mov(scratch, Operand::Zero());
     str(scratch, MemOperand(fp, ExitFrameConstants::kSPOffset));
   }
-  mov(scratch, Operand(CodeObject()));
+  Move(scratch, CodeObject());
   str(scratch, MemOperand(fp, ExitFrameConstants::kCodeOffset));
 
   // Save the frame pointer and the context in top.
-  mov(scratch, Operand(ExternalReference(IsolateAddressId::kCEntryFPAddress,
-                                         isolate())));
+  Move(scratch, ExternalReference::Create(IsolateAddressId::kCEntryFPAddress,
+                                          isolate()));
   str(fp, MemOperand(scratch));
-  mov(scratch,
-      Operand(ExternalReference(IsolateAddressId::kContextAddress, isolate())));
+  Move(scratch,
+       ExternalReference::Create(IsolateAddressId::kContextAddress, isolate()));
   str(cp, MemOperand(scratch));
 
   // Optionally save all double registers.
@@ -1204,18 +1324,18 @@ void MacroAssembler::LeaveExitFrame(bool save_doubles, Register argument_count,
 
   // Clear top frame.
   mov(r3, Operand::Zero());
-  mov(scratch, Operand(ExternalReference(IsolateAddressId::kCEntryFPAddress,
-                                         isolate())));
+  Move(scratch, ExternalReference::Create(IsolateAddressId::kCEntryFPAddress,
+                                          isolate()));
   str(r3, MemOperand(scratch));
 
   // Restore current context from top and clear it in debug mode.
-  mov(scratch,
-      Operand(ExternalReference(IsolateAddressId::kContextAddress, isolate())));
+  Move(scratch,
+       ExternalReference::Create(IsolateAddressId::kContextAddress, isolate()));
   ldr(cp, MemOperand(scratch));
 #ifdef DEBUG
   mov(r3, Operand(Context::kInvalidContext));
-  mov(scratch,
-      Operand(ExternalReference(IsolateAddressId::kContextAddress, isolate())));
+  Move(scratch,
+       ExternalReference::Create(IsolateAddressId::kContextAddress, isolate()));
   str(r3, MemOperand(scratch));
 #endif
 
@@ -1372,14 +1492,21 @@ void MacroAssembler::CheckDebugHook(Register fun, Register new_target,
                                     const ParameterCount& actual) {
   Label skip_hook;
 
-  ExternalReference debug_hook_avtive =
+  ExternalReference debug_hook_active =
       ExternalReference::debug_hook_on_function_call_address(isolate());
-  mov(r4, Operand(debug_hook_avtive));
+  Move(r4, debug_hook_active);
   ldrsb(r4, MemOperand(r4));
   cmp(r4, Operand(0));
   b(eq, &skip_hook);
 
   {
+    // Load receiver to pass it later to DebugOnFunctionCall hook.
+    if (actual.is_reg()) {
+      mov(r4, actual.reg());
+    } else {
+      mov(r4, Operand(actual.immediate()));
+    }
+    ldr(r4, MemOperand(sp, r4, LSL, kPointerSizeLog2));
     FrameScope frame(this,
                      has_frame() ? StackFrame::NONE : StackFrame::INTERNAL);
     if (expected.is_reg()) {
@@ -1395,6 +1522,7 @@ void MacroAssembler::CheckDebugHook(Register fun, Register new_target,
     }
     Push(fun);
     Push(fun);
+    Push(r4);
     CallRuntime(Runtime::kDebugOnFunctionCall);
     Pop(fun);
     if (new_target.is_valid()) {
@@ -1466,9 +1594,9 @@ void MacroAssembler::InvokeFunction(Register fun, Register new_target,
 
   ldr(temp_reg, FieldMemOperand(r1, JSFunction::kSharedFunctionInfoOffset));
   ldr(cp, FieldMemOperand(r1, JSFunction::kContextOffset));
-  ldr(expected_reg,
-      FieldMemOperand(temp_reg,
-                      SharedFunctionInfo::kFormalParameterCountOffset));
+  ldrh(expected_reg,
+       FieldMemOperand(temp_reg,
+                       SharedFunctionInfo::kFormalParameterCountOffset));
 
   ParameterCount expected(expected_reg);
   InvokeFunctionCode(fun, new_target, expected, actual, flag);
@@ -1494,7 +1622,7 @@ void MacroAssembler::MaybeDropFrames() {
   // Check whether we need to drop frames to restart a function on the stack.
   ExternalReference restart_fp =
       ExternalReference::debug_restart_fp_address(isolate());
-  mov(r1, Operand(restart_fp));
+  Move(r1, restart_fp);
   ldr(r1, MemOperand(r1));
   tst(r1, r1);
   Jump(BUILTIN_CODE(isolate(), FrameDropperTrampoline), RelocInfo::CODE_TARGET,
@@ -1508,8 +1636,8 @@ void MacroAssembler::PushStackHandler() {
 
   Push(Smi::kZero);  // Padding.
   // Link the current handler as the next handler.
-  mov(r6,
-      Operand(ExternalReference(IsolateAddressId::kHandlerAddress, isolate())));
+  mov(r6, Operand(ExternalReference::Create(IsolateAddressId::kHandlerAddress,
+                                            isolate())));
   ldr(r5, MemOperand(r6));
   push(r5);
   // Set this new handler as the current one.
@@ -1522,8 +1650,8 @@ void MacroAssembler::PopStackHandler() {
   Register scratch = temps.Acquire();
   STATIC_ASSERT(StackHandlerConstants::kNextOffset == 0);
   pop(r1);
-  mov(scratch,
-      Operand(ExternalReference(IsolateAddressId::kHandlerAddress, isolate())));
+  mov(scratch, Operand(ExternalReference::Create(
+                   IsolateAddressId::kHandlerAddress, isolate())));
   str(r1, MemOperand(scratch));
   add(sp, sp, Operand(StackHandlerConstants::kSize - kPointerSize));
 }
@@ -1639,8 +1767,10 @@ void TurboAssembler::TryInlineTruncateDoubleToI(Register result,
   b(lt, done);
 }
 
-void TurboAssembler::TruncateDoubleToIDelayed(Zone* zone, Register result,
-                                              DwVfpRegister double_input) {
+void TurboAssembler::TruncateDoubleToI(Isolate* isolate, Zone* zone,
+                                       Register result,
+                                       DwVfpRegister double_input,
+                                       StubCallMode stub_mode) {
   Label done;
 
   TryInlineTruncateDoubleToI(result, double_input, &done);
@@ -1650,7 +1780,12 @@ void TurboAssembler::TruncateDoubleToIDelayed(Zone* zone, Register result,
   sub(sp, sp, Operand(kDoubleSize));  // Put input on stack.
   vstr(double_input, MemOperand(sp, 0));
 
-  CallStubDelayed(new (zone) DoubleToIStub(nullptr, result));
+  if (stub_mode == StubCallMode::kCallWasmRuntimeStub) {
+    Call(wasm::WasmCode::kDoubleToI, RelocInfo::WASM_STUB_CALL);
+  } else {
+    Call(BUILTIN_CODE(isolate, DoubleToI), RelocInfo::CODE_TARGET);
+  }
+  ldr(result, MemOperand(sp, 0));
 
   add(sp, sp, Operand(kDoubleSize));
   pop(lr);
@@ -1658,16 +1793,18 @@ void TurboAssembler::TruncateDoubleToIDelayed(Zone* zone, Register result,
   bind(&done);
 }
 
-void TurboAssembler::CallRuntimeDelayed(Zone* zone, Runtime::FunctionId fid,
-                                        SaveFPRegsMode save_doubles) {
+void TurboAssembler::CallRuntimeWithCEntry(Runtime::FunctionId fid,
+                                           Register centry) {
   const Runtime::Function* f = Runtime::FunctionForId(fid);
   // TODO(1236192): Most runtime routines don't need the number of
   // arguments passed in because it is constant. At some point we
   // should remove this need and make the runtime routine entry code
   // smarter.
   mov(r0, Operand(f->nargs));
-  mov(r1, Operand(ExternalReference(f, isolate())));
-  CallStubDelayed(new (zone) CEntryStub(nullptr, 1, save_doubles));
+  Move(r1, ExternalReference::Create(f));
+  DCHECK(!AreAliased(centry, r0, r1));
+  add(centry, centry, Operand(Code::kHeaderSize - kHeapObjectTag));
+  Call(centry);
 }
 
 void MacroAssembler::CallRuntime(const Runtime::Function* f,
@@ -1685,9 +1822,10 @@ void MacroAssembler::CallRuntime(const Runtime::Function* f,
   // should remove this need and make the runtime routine entry code
   // smarter.
   mov(r0, Operand(num_arguments));
-  mov(r1, Operand(ExternalReference(f, isolate())));
-  CEntryStub stub(isolate(), 1, save_doubles);
-  CallStub(&stub);
+  Move(r1, ExternalReference::Create(f));
+  Handle<Code> code =
+      CodeFactory::CEntry(isolate(), f->result_size, save_doubles);
+  Call(code, RelocInfo::CODE_TARGET);
 }
 
 void MacroAssembler::TailCallRuntime(Runtime::FunctionId fid) {
@@ -1700,24 +1838,23 @@ void MacroAssembler::TailCallRuntime(Runtime::FunctionId fid) {
     // smarter.
     mov(r0, Operand(function->nargs));
   }
-  JumpToExternalReference(ExternalReference(fid, isolate()));
+  JumpToExternalReference(ExternalReference::Create(fid));
 }
 
 void MacroAssembler::JumpToExternalReference(const ExternalReference& builtin,
                                              bool builtin_exit_frame) {
 #if defined(__thumb__)
   // Thumb mode builtin.
-  DCHECK_EQ(reinterpret_cast<intptr_t>(builtin.address()) & 1, 1);
+  DCHECK_EQ(builtin.address() & 1, 1);
 #endif
-  mov(r1, Operand(builtin));
-  CEntryStub stub(isolate(), 1, kDontSaveFPRegs, kArgvOnStack,
-                  builtin_exit_frame);
-  Jump(stub.GetCode(), RelocInfo::CODE_TARGET);
+  Move(r1, builtin);
+  Handle<Code> code = CodeFactory::CEntry(isolate(), 1, kDontSaveFPRegs,
+                                          kArgvOnStack, builtin_exit_frame);
+  Jump(code, RelocInfo::CODE_TARGET);
 }
 
 void MacroAssembler::JumpToInstructionStream(Address entry) {
-  mov(kOffHeapTrampolineRegister,
-      Operand(reinterpret_cast<int32_t>(entry), RelocInfo::OFF_HEAP_TARGET));
+  mov(kOffHeapTrampolineRegister, Operand(entry, RelocInfo::OFF_HEAP_TARGET));
   Jump(kOffHeapTrampolineRegister);
 }
 
@@ -1733,7 +1870,7 @@ void MacroAssembler::IncrementCounter(StatsCounter* counter, int value,
                                       Register scratch1, Register scratch2) {
   DCHECK_GT(value, 0);
   if (FLAG_native_code_counters && counter->Enabled()) {
-    mov(scratch2, Operand(ExternalReference(counter)));
+    Move(scratch2, ExternalReference::Create(counter));
     ldr(scratch1, MemOperand(scratch2));
     add(scratch1, scratch1, Operand(value));
     str(scratch1, MemOperand(scratch2));
@@ -1745,7 +1882,7 @@ void MacroAssembler::DecrementCounter(StatsCounter* counter, int value,
                                       Register scratch1, Register scratch2) {
   DCHECK_GT(value, 0);
   if (FLAG_native_code_counters && counter->Enabled()) {
-    mov(scratch2, Operand(ExternalReference(counter)));
+    Move(scratch2, ExternalReference::Create(counter));
     ldr(scratch1, MemOperand(scratch2));
     sub(scratch1, scratch1, Operand(value));
     str(scratch1, MemOperand(scratch2));
@@ -1768,18 +1905,17 @@ void TurboAssembler::Check(Condition cond, AbortReason reason) {
 void TurboAssembler::Abort(AbortReason reason) {
   Label abort_start;
   bind(&abort_start);
-#ifdef DEBUG
   const char* msg = GetAbortReason(reason);
-  if (msg != nullptr) {
-    RecordComment("Abort message: ");
-    RecordComment(msg);
-  }
+#ifdef DEBUG
+  RecordComment("Abort message: ");
+  RecordComment(msg);
+#endif
 
-  if (FLAG_trap_on_abort) {
+  // Avoid emitting call to builtin if requested.
+  if (trap_on_abort()) {
     stop(msg);
     return;
   }
-#endif
 
   Move(r1, Smi::FromInt(static_cast<int>(reason)));
 
@@ -1816,6 +1952,7 @@ void TurboAssembler::InitializeRootRegister() {
   ExternalReference roots_array_start =
       ExternalReference::roots_array_start(isolate());
   mov(kRootRegister, Operand(roots_array_start));
+  add(kRootRegister, kRootRegister, Operand(kRootRegisterBias));
 }
 
 void MacroAssembler::SmiTag(Register reg, SBit s) {
@@ -1842,6 +1979,16 @@ void TurboAssembler::JumpIfSmi(Register value, Label* smi_label) {
   b(eq, smi_label);
 }
 
+void TurboAssembler::JumpIfEqual(Register x, int32_t y, Label* dest) {
+  cmp(x, Operand(y));
+  b(eq, dest);
+}
+
+void TurboAssembler::JumpIfLessThan(Register x, int32_t y, Label* dest) {
+  cmp(x, Operand(y));
+  b(lt, dest);
+}
+
 void MacroAssembler::JumpIfNotSmi(Register value, Label* not_smi_label) {
   tst(value, Operand(kSmiTagMask));
   b(ne, not_smi_label);
@@ -1873,18 +2020,6 @@ void MacroAssembler::AssertSmi(Register object) {
   }
 }
 
-void MacroAssembler::AssertFixedArray(Register object) {
-  if (emit_debug_code()) {
-    STATIC_ASSERT(kSmiTag == 0);
-    tst(object, Operand(kSmiTagMask));
-    Check(ne, AbortReason::kOperandIsASmiAndNotAFixedArray);
-    push(object);
-    CompareObjectType(object, object, object, FIXED_ARRAY_TYPE);
-    pop(object);
-    Check(eq, AbortReason::kOperandIsNotAFixedArray);
-  }
-}
-
 void MacroAssembler::AssertConstructor(Register object) {
   if (emit_debug_code()) {
     STATIC_ASSERT(kSmiTag == 0);
@@ -1957,7 +2092,7 @@ void MacroAssembler::AssertUndefinedOrAllocationSite(Register object,
     CompareRoot(object, Heap::kUndefinedValueRootIndex);
     b(eq, &done_checking);
     ldr(scratch, FieldMemOperand(object, HeapObject::kMapOffset));
-    CompareRoot(scratch, Heap::kAllocationSiteMapRootIndex);
+    CompareInstanceType(scratch, scratch, ALLOCATION_SITE_TYPE);
     Assert(eq, AbortReason::kExpectedUndefinedOrCell);
     bind(&done_checking);
   }
@@ -1965,7 +2100,7 @@ void MacroAssembler::AssertUndefinedOrAllocationSite(Register object,
 
 
 void TurboAssembler::CheckFor32DRegs(Register scratch) {
-  mov(scratch, Operand(ExternalReference::cpu_features(isolate())));
+  Move(scratch, ExternalReference::cpu_features());
   ldr(scratch, MemOperand(scratch));
   tst(scratch, Operand(1u << VFP32DREGS));
 }
@@ -2197,7 +2332,7 @@ void TurboAssembler::CallCFunction(ExternalReference function,
                                    int num_double_arguments) {
   UseScratchRegisterScope temps(this);
   Register scratch = temps.Acquire();
-  mov(scratch, Operand(function));
+  Move(scratch, function);
   CallCFunctionHelper(scratch, num_reg_arguments, num_double_arguments);
 }
 
@@ -2316,7 +2451,7 @@ bool AreAliased(Register reg1,
 
 void TurboAssembler::ComputeCodeStartAddress(Register dst) {
   // We can use the register pc - 8 for the address of the current instruction.
-  sub(dst, pc, Operand(pc_offset() + TurboAssembler::kPcLoadDelta));
+  sub(dst, pc, Operand(pc_offset() + Instruction::kPcLoadDelta));
 }
 
 void TurboAssembler::ResetSpeculationPoisonRegister() {
diff --git a/deps/v8/src/arm/macro-assembler-arm.h b/deps/v8/src/arm/macro-assembler-arm.h
index af8b449de6dbe7..87a8ff28349a66 100644
--- a/deps/v8/src/arm/macro-assembler-arm.h
+++ b/deps/v8/src/arm/macro-assembler-arm.h
@@ -9,6 +9,7 @@
 #include "src/assembler.h"
 #include "src/bailout-reason.h"
 #include "src/globals.h"
+#include "src/turbo-assembler.h"
 
 namespace v8 {
 namespace internal {
@@ -25,12 +26,17 @@ constexpr Register kInterpreterAccumulatorRegister = r0;
 constexpr Register kInterpreterBytecodeOffsetRegister = r5;
 constexpr Register kInterpreterBytecodeArrayRegister = r6;
 constexpr Register kInterpreterDispatchTableRegister = r8;
+
 constexpr Register kJavaScriptCallArgCountRegister = r0;
 constexpr Register kJavaScriptCallCodeStartRegister = r2;
+constexpr Register kJavaScriptCallTargetRegister = kJSFunctionRegister;
 constexpr Register kJavaScriptCallNewTargetRegister = r3;
-constexpr Register kOffHeapTrampolineRegister = r6;
+constexpr Register kJavaScriptCallExtraArg1Register = r2;
+
+constexpr Register kOffHeapTrampolineRegister = ip;
 constexpr Register kRuntimeCallFunctionRegister = r1;
 constexpr Register kRuntimeCallArgCountRegister = r0;
+constexpr Register kWasmInstanceRegister = r3;
 
 // ----------------------------------------------------------------------------
 // Static helper functions
@@ -84,20 +90,13 @@ enum TargetAddressStorageMode {
   NEVER_INLINE_TARGET_ADDRESS
 };
 
-class TurboAssembler : public Assembler {
+class TurboAssembler : public TurboAssemblerBase {
  public:
-  TurboAssembler(Isolate* isolate, void* buffer, int buffer_size,
-                 CodeObjectRequired create_code_object);
-
-  void set_has_frame(bool value) { has_frame_ = value; }
-  bool has_frame() const { return has_frame_; }
-
-  Isolate* isolate() const { return isolate_; }
-
-  Handle<HeapObject> CodeObject() {
-    DCHECK(!code_object_.is_null());
-    return code_object_;
-  }
+  TurboAssembler(Isolate* isolate, const AssemblerOptions& options,
+                 void* buffer, int buffer_size,
+                 CodeObjectRequired create_code_object)
+      : TurboAssemblerBase(isolate, options, buffer, buffer_size,
+                           create_code_object) {}
 
   // Activation support.
   void EnterFrame(StackFrame::Type type,
@@ -320,6 +319,11 @@ class TurboAssembler : public Assembler {
   void AsrPair(Register dst_low, Register dst_high, Register src_low,
                Register src_high, uint32_t shift);
 
+  void LoadFromConstantsTable(Register destination,
+                              int constant_index) override;
+  void LoadRootRegisterOffset(Register destination, intptr_t offset) override;
+  void LoadRootRelative(Register destination, int32_t offset) override;
+
   // Returns the size of a call in instructions. Note, the value returned is
   // only valid as long as no entries are added to the constant pool between
   // checking the call size and emitting the actual call.
@@ -331,8 +335,10 @@ class TurboAssembler : public Assembler {
   int CallStubSize();
 
   void CallStubDelayed(CodeStub* stub);
-  void CallRuntimeDelayed(Zone* zone, Runtime::FunctionId fid,
-                          SaveFPRegsMode save_doubles = kDontSaveFPRegs);
+
+  // Call a runtime routine. This expects {centry} to contain a fitting CEntry
+  // builtin for the target runtime function and uses an indirect call.
+  void CallRuntimeWithCEntry(Runtime::FunctionId fid, Register centry);
 
   // Jump, Call, and Ret pseudo instructions implementing inter-working.
   void Call(Register target, Condition cond = al);
@@ -347,7 +353,9 @@ class TurboAssembler : public Assembler {
 
   // This should only be used when assembling a deoptimizer call because of
   // the CheckConstPool invocation, which is only needed for deoptimization.
-  void CallForDeoptimization(Address target, RelocInfo::Mode rmode) {
+  void CallForDeoptimization(Address target, int deopt_id,
+                             RelocInfo::Mode rmode) {
+    USE(deopt_id);
     Call(target, rmode);
     CheckConstPool(false, false);
   }
@@ -465,6 +473,7 @@ class TurboAssembler : public Assembler {
   // Register move. May do nothing if the registers are identical.
   void Move(Register dst, Smi* smi);
   void Move(Register dst, Handle<HeapObject> value);
+  void Move(Register dst, ExternalReference reference);
   void Move(Register dst, Register src, Condition cond = al);
   void Move(Register dst, const Operand& src, SBit sbit = LeaveCC,
             Condition cond = al) {
@@ -502,12 +511,18 @@ class TurboAssembler : public Assembler {
   }
 
   // Load an object from the root table.
+  void LoadRoot(Register destination, Heap::RootListIndex index) override {
+    LoadRoot(destination, index, al);
+  }
   void LoadRoot(Register destination, Heap::RootListIndex index,
-                Condition cond = al);
+                Condition cond);
 
   // Jump if the register contains a smi.
   void JumpIfSmi(Register value, Label* smi_label);
 
+  void JumpIfEqual(Register x, int32_t y, Label* dest);
+  void JumpIfLessThan(Register x, int32_t y, Label* dest);
+
   // Performs a truncating conversion of a floating point number as used by
   // the JS bitwise operations. See ECMA-262 9.5: ToInt32. Goes to 'done' if it
   // succeeds, otherwise falls through if result is saturated. On return
@@ -520,8 +535,8 @@ class TurboAssembler : public Assembler {
   // Performs a truncating conversion of a floating point number as used by
   // the JS bitwise operations. See ECMA-262 9.5: ToInt32.
   // Exits with 'result' holding the answer.
-  void TruncateDoubleToIDelayed(Zone* zone, Register result,
-                                DwVfpRegister double_input);
+  void TruncateDoubleToI(Isolate* isolate, Zone* zone, Register result,
+                         DwVfpRegister double_input, StubCallMode stub_mode);
 
   // EABI variant for double arguments in use.
   bool use_eabi_hardfloat() {
@@ -541,11 +556,6 @@ class TurboAssembler : public Assembler {
   void ResetSpeculationPoisonRegister();
 
  private:
-  bool has_frame_ = false;
-  Isolate* const isolate_;
-  // This handle will be patched with the code object on installation.
-  Handle<HeapObject> code_object_;
-
   // Compare single values and then load the fpscr flags to a register.
   void VFPCompareAndLoadFlags(const SwVfpRegister src1,
                               const SwVfpRegister src2,
@@ -587,7 +597,11 @@ class TurboAssembler : public Assembler {
 class MacroAssembler : public TurboAssembler {
  public:
   MacroAssembler(Isolate* isolate, void* buffer, int size,
-                 CodeObjectRequired create_code_object);
+                 CodeObjectRequired create_code_object)
+      : MacroAssembler(isolate, AssemblerOptions::Default(isolate), buffer,
+                       size, create_code_object) {}
+  MacroAssembler(Isolate* isolate, const AssemblerOptions& options,
+                 void* buffer, int size, CodeObjectRequired create_code_object);
 
   void Mls(Register dst, Register src1, Register src2, Register srcA,
            Condition cond = al);
@@ -834,9 +848,6 @@ class MacroAssembler : public TurboAssembler {
   void AssertNotSmi(Register object);
   void AssertSmi(Register object);
 
-  // Abort execution if argument is not a FixedArray, enabled via --debug-code.
-  void AssertFixedArray(Register object);
-
   // Abort execution if argument is not a Constructor, enabled via --debug-code.
   void AssertConstructor(Register object);
 
diff --git a/deps/v8/src/arm/simulator-arm.cc b/deps/v8/src/arm/simulator-arm.cc
index 6a735fcef6f8cd..b254ab000c46c5 100644
--- a/deps/v8/src/arm/simulator-arm.cc
+++ b/deps/v8/src/arm/simulator-arm.cc
@@ -285,12 +285,12 @@ void ArmDebugger::Debug() {
                  || (strcmp(cmd, "printobject") == 0)) {
         if (argc == 2) {
           int32_t value;
-          OFStream os(stdout);
+          StdoutStream os;
           if (GetValue(arg1, &value)) {
             Object* obj = reinterpret_cast<Object*>(value);
             os << arg1 << ": \n";
 #ifdef DEBUG
-            obj->Print(os);
+            obj->Print(sim_->isolate_, os);
             os << "\n";
 #else
             os << Brief(obj) << "\n";
@@ -514,7 +514,7 @@ void ArmDebugger::Debug() {
         PrintF("    Stops are debug instructions inserted by\n");
         PrintF("    the Assembler::stop() function.\n");
         PrintF("    When hitting a stop, the Simulator will\n");
-        PrintF("    stop and and give control to the ArmDebugger.\n");
+        PrintF("    stop and give control to the ArmDebugger.\n");
         PrintF("    The first %d stop codes are watched:\n",
                Simulator::kNumOfWatchedStops);
         PrintF("    - They can be enabled / disabled: the Simulator\n");
@@ -1666,17 +1666,18 @@ void Simulator::SoftwareInterrupt(Instruction* instr) {
           case ExternalReference::BUILTIN_FP_FP_CALL:
           case ExternalReference::BUILTIN_COMPARE_CALL:
             PrintF("Call to host function at %p with args %f, %f",
-                   static_cast<void*>(FUNCTION_ADDR(generic_target)), dval0,
-                   dval1);
+                   reinterpret_cast<void*>(FUNCTION_ADDR(generic_target)),
+                   dval0, dval1);
             break;
           case ExternalReference::BUILTIN_FP_CALL:
             PrintF("Call to host function at %p with arg %f",
-                   static_cast<void*>(FUNCTION_ADDR(generic_target)), dval0);
+                   reinterpret_cast<void*>(FUNCTION_ADDR(generic_target)),
+                   dval0);
             break;
           case ExternalReference::BUILTIN_FP_INT_CALL:
             PrintF("Call to host function at %p with args %f, %d",
-                   static_cast<void*>(FUNCTION_ADDR(generic_target)), dval0,
-                   ival);
+                   reinterpret_cast<void*>(FUNCTION_ADDR(generic_target)),
+                   dval0, ival);
             break;
           default:
             UNREACHABLE();
@@ -1803,8 +1804,8 @@ void Simulator::SoftwareInterrupt(Instruction* instr) {
           PrintF(
               "Call to host function at %p "
               "args %08x, %08x, %08x, %08x, %08x, %08x, %08x, %08x, %08x",
-              static_cast<void*>(FUNCTION_ADDR(target)), arg0, arg1, arg2, arg3,
-              arg4, arg5, arg6, arg7, arg8);
+              reinterpret_cast<void*>(FUNCTION_ADDR(target)), arg0, arg1, arg2,
+              arg3, arg4, arg5, arg6, arg7, arg8);
           if (!stack_aligned) {
             PrintF(" with unaligned stack %08x\n", get_register(sp));
           }
@@ -3651,6 +3652,8 @@ int VFPConversionSaturate(double val, bool unsigned_res) {
 
 int32_t Simulator::ConvertDoubleToInt(double val, bool unsigned_integer,
                                       VFPRoundingMode mode) {
+  // TODO(jkummerow): These casts are undefined behavior if the integral
+  // part of {val} does not fit into the destination type.
   int32_t result =
       unsigned_integer ? static_cast<uint32_t>(val) : static_cast<int32_t>(val);
 
@@ -5731,13 +5734,12 @@ void Simulator::Execute() {
   }
 }
 
-
-void Simulator::CallInternal(byte* entry) {
+void Simulator::CallInternal(Address entry) {
   // Adjust JS-based stack limit to C-based stack limit.
   isolate_->stack_guard()->AdjustStackLimitForSimulator();
 
   // Prepare to execute the code at entry
-  set_register(pc, reinterpret_cast<int32_t>(entry));
+  set_register(pc, static_cast<int32_t>(entry));
   // Put down marker for end of simulation. The simulator will stop simulation
   // when the PC reaches this value. By saving the "end simulation" value into
   // the LR the simulation stops when returning to this call point.
@@ -5791,7 +5793,7 @@ void Simulator::CallInternal(byte* entry) {
   set_register(r11, r11_val);
 }
 
-intptr_t Simulator::CallImpl(byte* entry, int argument_count,
+intptr_t Simulator::CallImpl(Address entry, int argument_count,
                              const intptr_t* arguments) {
   // Set up arguments
 
@@ -5823,7 +5825,7 @@ intptr_t Simulator::CallImpl(byte* entry, int argument_count,
   return get_register(r0);
 }
 
-intptr_t Simulator::CallFPImpl(byte* entry, double d0, double d1) {
+intptr_t Simulator::CallFPImpl(Address entry, double d0, double d1) {
   if (use_eabi_hardfloat()) {
     set_d_register_from_double(0, d0);
     set_d_register_from_double(1, d1);
diff --git a/deps/v8/src/arm/simulator-arm.h b/deps/v8/src/arm/simulator-arm.h
index 46a84ff4b44ec4..6eb3cf6c6be595 100644
--- a/deps/v8/src/arm/simulator-arm.h
+++ b/deps/v8/src/arm/simulator-arm.h
@@ -148,9 +148,7 @@ class Simulator : public SimulatorBase {
   void set_pc(int32_t value);
   int32_t get_pc() const;
 
-  Address get_sp() const {
-    return reinterpret_cast<Address>(static_cast<intptr_t>(get_register(sp)));
-  }
+  Address get_sp() const { return static_cast<Address>(get_register(sp)); }
 
   // Accessor to the internal simulator stack area.
   uintptr_t StackLimit(uintptr_t c_limit) const;
@@ -159,13 +157,13 @@ class Simulator : public SimulatorBase {
   void Execute();
 
   template <typename Return, typename... Args>
-  Return Call(byte* entry, Args... args) {
+  Return Call(Address entry, Args... args) {
     return VariadicCall<Return>(this, &Simulator::CallImpl, entry, args...);
   }
 
   // Alternative: call a 2-argument double function.
   template <typename Return>
-  Return CallFP(byte* entry, double d0, double d1) {
+  Return CallFP(Address entry, double d0, double d1) {
     return ConvertReturn<Return>(CallFPImpl(entry, d0, d1));
   }
 
@@ -212,9 +210,9 @@ class Simulator : public SimulatorBase {
     end_sim_pc = -2
   };
 
-  V8_EXPORT_PRIVATE intptr_t CallImpl(byte* entry, int argument_count,
+  V8_EXPORT_PRIVATE intptr_t CallImpl(Address entry, int argument_count,
                                       const intptr_t* arguments);
-  intptr_t CallFPImpl(byte* entry, double d0, double d1);
+  intptr_t CallFPImpl(Address entry, double d0, double d1);
 
   // Unsupported instructions use Format to print an error and stop execution.
   void Format(Instruction* instr, const char* format);
@@ -344,7 +342,7 @@ class Simulator : public SimulatorBase {
   void SetSpecialRegister(SRegisterFieldMask reg_and_mask, uint32_t value);
   uint32_t GetFromSpecialRegister(SRegister reg);
 
-  void CallInternal(byte* entry);
+  void CallInternal(Address entry);
 
   // Architecture state.
   // Saturating instructions require a Q flag to indicate saturation.
diff --git a/deps/v8/src/arm64/assembler-arm64-inl.h b/deps/v8/src/arm64/assembler-arm64-inl.h
index 52f552270a7d9c..72674b87a3d118 100644
--- a/deps/v8/src/arm64/assembler-arm64-inl.h
+++ b/deps/v8/src/arm64/assembler-arm64-inl.h
@@ -18,12 +18,20 @@ bool CpuFeatures::SupportsOptimizer() { return true; }
 bool CpuFeatures::SupportsWasmSimd128() { return true; }
 
 void RelocInfo::apply(intptr_t delta) {
-  // On arm64 only internal references need extra work.
-  DCHECK(RelocInfo::IsInternalReference(rmode_));
-
-  // Absolute code pointer inside code object moves with the code object.
-  intptr_t* p = reinterpret_cast<intptr_t*>(pc_);
-  *p += delta;  // Relocate entry.
+  // On arm64 only internal references and immediate branches need extra work.
+  if (RelocInfo::IsInternalReference(rmode_)) {
+    // Absolute code pointer inside code object moves with the code object.
+    intptr_t* p = reinterpret_cast<intptr_t*>(pc_);
+    *p += delta;  // Relocate entry.
+  } else {
+    Instruction* instr = reinterpret_cast<Instruction*>(pc_);
+    if (instr->IsBranchAndLink() || instr->IsUnconditionalBranch()) {
+      Address old_target =
+          reinterpret_cast<Address>(instr->ImmPCOffsetTarget());
+      Address new_target = old_target - delta;
+      instr->SetBranchImmTarget(reinterpret_cast<Instruction*>(new_target));
+    }
+  }
 }
 
 
@@ -222,7 +230,7 @@ struct ImmediateInitializer<ExternalReference> {
     return RelocInfo::EXTERNAL_REFERENCE;
   }
   static inline int64_t immediate_for(ExternalReference t) {;
-    return reinterpret_cast<int64_t>(t.address());
+    return static_cast<int64_t>(t.address());
   }
 };
 
@@ -348,6 +356,10 @@ int64_t Operand::ImmediateValue() const {
   return immediate_.value();
 }
 
+RelocInfo::Mode Operand::ImmediateRMode() const {
+  DCHECK(IsImmediate() || IsHeapObjectRequest());
+  return immediate_.rmode();
+}
 
 Register Operand::reg() const {
   DCHECK(IsShiftedRegister() || IsExtendedRegister());
@@ -374,18 +386,16 @@ unsigned Operand::shift_amount() const {
 
 
 Operand Operand::UntagSmi(Register smi) {
-  STATIC_ASSERT(kXRegSizeInBits == static_cast<unsigned>(kSmiShift +
-                                                         kSmiValueSize));
   DCHECK(smi.Is64Bits());
+  DCHECK(SmiValuesAre32Bits() || SmiValuesAre31Bits());
   return Operand(smi, ASR, kSmiShift);
 }
 
 
 Operand Operand::UntagSmiAndScale(Register smi, int scale) {
-  STATIC_ASSERT(kXRegSizeInBits == static_cast<unsigned>(kSmiShift +
-                                                         kSmiValueSize));
   DCHECK(smi.Is64Bits());
   DCHECK((scale >= 0) && (scale <= (64 - kSmiValueSize)));
+  DCHECK(SmiValuesAre32Bits() || SmiValuesAre31Bits());
   if (scale > kSmiShift) {
     return Operand(smi, LSL, scale - kSmiShift);
   } else if (scale < kSmiShift) {
@@ -523,9 +533,36 @@ Address Assembler::target_pointer_address_at(Address pc) {
 
 // Read/Modify the code target address in the branch/call instruction at pc.
 Address Assembler::target_address_at(Address pc, Address constant_pool) {
-  return Memory::Address_at(target_pointer_address_at(pc));
+  Instruction* instr = reinterpret_cast<Instruction*>(pc);
+  if (instr->IsLdrLiteralX()) {
+    return Memory::Address_at(target_pointer_address_at(pc));
+  } else {
+    DCHECK(instr->IsBranchAndLink() || instr->IsUnconditionalBranch());
+    return reinterpret_cast<Address>(instr->ImmPCOffsetTarget());
+  }
 }
 
+Handle<Code> Assembler::code_target_object_handle_at(Address pc) {
+  Instruction* instr = reinterpret_cast<Instruction*>(pc);
+  if (instr->IsLdrLiteralX()) {
+    return Handle<Code>(reinterpret_cast<Code**>(
+        Assembler::target_address_at(pc, 0 /* unused */)));
+  } else {
+    DCHECK(instr->IsBranchAndLink() || instr->IsUnconditionalBranch());
+    DCHECK_EQ(instr->ImmPCOffset() % kInstructionSize, 0);
+    return GetCodeTarget(instr->ImmPCOffset() >> kInstructionSizeLog2);
+  }
+}
+
+Address Assembler::runtime_entry_at(Address pc) {
+  Instruction* instr = reinterpret_cast<Instruction*>(pc);
+  if (instr->IsLdrLiteralX()) {
+    return Assembler::target_address_at(pc, 0 /* unused */);
+  } else {
+    DCHECK(instr->IsBranchAndLink() || instr->IsUnconditionalBranch());
+    return instr->ImmPCOffset() + options().code_range_start;
+  }
+}
 
 Address Assembler::target_address_from_return_address(Address pc) {
   // Returns the address of the call target from the return address that will
@@ -540,45 +577,37 @@ Address Assembler::target_address_from_return_address(Address pc) {
   return candidate;
 }
 
-
-Address Assembler::return_address_from_call_start(Address pc) {
-  // The call, generated by MacroAssembler::Call, is one of two possible
-  // sequences:
-  //
-  // Without relocation:
-  //  movz  temp, #(target & 0x000000000000ffff)
-  //  movk  temp, #(target & 0x00000000ffff0000)
-  //  movk  temp, #(target & 0x0000ffff00000000)
-  //  blr   temp
-  //
-  // With relocation:
-  //  ldr   temp, =target
-  //  blr   temp
-  //
-  // The return address is immediately after the blr instruction in both cases,
-  // so it can be found by adding the call size to the address at the start of
-  // the call sequence.
-  STATIC_ASSERT(Assembler::kCallSizeWithoutRelocation == 4 * kInstructionSize);
-  STATIC_ASSERT(Assembler::kCallSizeWithRelocation == 2 * kInstructionSize);
-
-  Instruction* instr = reinterpret_cast<Instruction*>(pc);
-  if (instr->IsMovz()) {
-    // Verify the instruction sequence.
-    DCHECK(instr->following(1)->IsMovk());
-    DCHECK(instr->following(2)->IsMovk());
-    DCHECK(instr->following(3)->IsBranchAndLinkToRegister());
-    return pc + Assembler::kCallSizeWithoutRelocation;
+int Assembler::deserialization_special_target_size(Address location) {
+  Instruction* instr = reinterpret_cast<Instruction*>(location);
+  if (instr->IsBranchAndLink() || instr->IsUnconditionalBranch()) {
+    return kSpecialTargetSize;
   } else {
-    // Verify the instruction sequence.
-    DCHECK(instr->IsLdrLiteralX());
-    DCHECK(instr->following(1)->IsBranchAndLinkToRegister());
-    return pc + Assembler::kCallSizeWithRelocation;
+    DCHECK_EQ(instr->InstructionBits(), 0);
+    return kPointerSize;
   }
 }
 
-void Assembler::deserialization_set_special_target_at(
-    Address constant_pool_entry, Code* code, Address target) {
-  Memory::Address_at(constant_pool_entry) = target;
+void Assembler::deserialization_set_special_target_at(Address location,
+                                                      Code* code,
+                                                      Address target) {
+  Instruction* instr = reinterpret_cast<Instruction*>(location);
+  if (instr->IsBranchAndLink() || instr->IsUnconditionalBranch()) {
+    if (target == 0) {
+      // We are simply wiping the target out for serialization. Set the offset
+      // to zero instead.
+      target = location;
+    }
+    instr->SetBranchImmTarget(reinterpret_cast<Instruction*>(target));
+    Assembler::FlushICache(location, kInstructionSize);
+  } else {
+    DCHECK_EQ(instr->InstructionBits(), 0);
+    Memory::Address_at(location) = target;
+    // Intuitively, we would think it is necessary to always flush the
+    // instruction cache after patching a target address in the code. However,
+    // in this case, only the constant pool contents change. The instruction
+    // accessing the constant pool remains unchanged, so a flush is not
+    // required.
+  }
 }
 
 void Assembler::deserialization_set_target_internal_reference_at(
@@ -589,20 +618,35 @@ void Assembler::deserialization_set_target_internal_reference_at(
 void Assembler::set_target_address_at(Address pc, Address constant_pool,
                                       Address target,
                                       ICacheFlushMode icache_flush_mode) {
-  Memory::Address_at(target_pointer_address_at(pc)) = target;
-  // Intuitively, we would think it is necessary to always flush the
-  // instruction cache after patching a target address in the code as follows:
-  //   Assembler::FlushICache(pc, sizeof(target));
-  // However, on ARM, an instruction is actually patched in the case of
-  // embedded constants of the form:
-  // ldr   ip, [pc, #...]
-  // since the instruction accessing this address in the constant pool remains
-  // unchanged, a flush is not required.
+  Instruction* instr = reinterpret_cast<Instruction*>(pc);
+  if (instr->IsLdrLiteralX()) {
+    Memory::Address_at(target_pointer_address_at(pc)) = target;
+    // Intuitively, we would think it is necessary to always flush the
+    // instruction cache after patching a target address in the code. However,
+    // in this case, only the constant pool contents change. The instruction
+    // accessing the constant pool remains unchanged, so a flush is not
+    // required.
+  } else {
+    DCHECK(instr->IsBranchAndLink() || instr->IsUnconditionalBranch());
+    if (target == 0) {
+      // We are simply wiping the target out for serialization. Set the offset
+      // to zero instead.
+      target = pc;
+    }
+    instr->SetBranchImmTarget(reinterpret_cast<Instruction*>(target));
+    if (icache_flush_mode != SKIP_ICACHE_FLUSH) {
+      Assembler::FlushICache(pc, kInstructionSize);
+    }
+  }
 }
 
-
 int RelocInfo::target_address_size() {
-  return kPointerSize;
+  if (IsCodedSpecially()) {
+    return Assembler::kSpecialTargetSize;
+  } else {
+    DCHECK(reinterpret_cast<Instruction*>(pc_)->IsLdrLiteralX());
+    return kPointerSize;
+  }
 }
 
 
@@ -615,7 +659,26 @@ Address RelocInfo::target_address_address() {
   DCHECK(IsCodeTarget(rmode_) || IsRuntimeEntry(rmode_) || IsWasmCall(rmode_) ||
          IsEmbeddedObject(rmode_) || IsExternalReference(rmode_) ||
          IsOffHeapTarget(rmode_));
-  return Assembler::target_pointer_address_at(pc_);
+  Instruction* instr = reinterpret_cast<Instruction*>(pc_);
+  // Read the address of the word containing the target_address in an
+  // instruction stream.
+  // The only architecture-independent user of this function is the serializer.
+  // The serializer uses it to find out how many raw bytes of instruction to
+  // output before the next target.
+  // For an instruction like B/BL, where the target bits are mixed into the
+  // instruction bits, the size of the target will be zero, indicating that the
+  // serializer should not step forward in memory after a target is resolved
+  // and written.
+  // For LDR literal instructions, we can skip up to the constant pool entry
+  // address. We make sure that RelocInfo is ordered by the
+  // target_address_address so that we do not skip over any relocatable
+  // instruction sequences.
+  if (instr->IsLdrLiteralX()) {
+    return constant_pool_entry_address();
+  } else {
+    DCHECK(instr->IsBranchAndLink() || instr->IsUnconditionalBranch());
+    return reinterpret_cast<Address>(pc_);
+  }
 }
 
 
@@ -631,12 +694,16 @@ HeapObject* RelocInfo::target_object() {
 }
 
 Handle<HeapObject> RelocInfo::target_object_handle(Assembler* origin) {
-  DCHECK(IsCodeTarget(rmode_) || rmode_ == EMBEDDED_OBJECT);
-  return Handle<HeapObject>(reinterpret_cast<HeapObject**>(
-      Assembler::target_address_at(pc_, constant_pool_)));
+  if (rmode_ == EMBEDDED_OBJECT) {
+    return Handle<HeapObject>(reinterpret_cast<HeapObject**>(
+        Assembler::target_address_at(pc_, constant_pool_)));
+  } else {
+    DCHECK(IsCodeTarget(rmode_));
+    return origin->code_target_object_handle_at(pc_);
+  }
 }
 
-void RelocInfo::set_target_object(HeapObject* target,
+void RelocInfo::set_target_object(Heap* heap, HeapObject* target,
                                   WriteBarrierMode write_barrier_mode,
                                   ICacheFlushMode icache_flush_mode) {
   DCHECK(IsCodeTarget(rmode_) || rmode_ == EMBEDDED_OBJECT);
@@ -644,9 +711,8 @@ void RelocInfo::set_target_object(HeapObject* target,
                                    reinterpret_cast<Address>(target),
                                    icache_flush_mode);
   if (write_barrier_mode == UPDATE_WRITE_BARRIER && host() != nullptr) {
-    host()->GetHeap()->incremental_marking()->RecordWriteIntoCode(host(), this,
-                                                                  target);
-    host()->GetHeap()->RecordWriteIntoCode(host(), this, target);
+    heap->incremental_marking()->RecordWriteIntoCode(host(), this, target);
+    heap->RecordWriteIntoCode(host(), this, target);
   }
 }
 
@@ -671,19 +737,12 @@ Address RelocInfo::target_internal_reference() {
 
 Address RelocInfo::target_internal_reference_address() {
   DCHECK(rmode_ == INTERNAL_REFERENCE);
-  return reinterpret_cast<Address>(pc_);
-}
-
-void RelocInfo::set_wasm_code_table_entry(Address target,
-                                          ICacheFlushMode icache_flush_mode) {
-  DCHECK(rmode_ == RelocInfo::WASM_CODE_TABLE_ENTRY);
-  Assembler::set_target_address_at(pc_, constant_pool_, target,
-                                   icache_flush_mode);
+  return pc_;
 }
 
 Address RelocInfo::target_runtime_entry(Assembler* origin) {
   DCHECK(IsRuntimeEntry(rmode_));
-  return target_address();
+  return origin->runtime_entry_at(pc_);
 }
 
 void RelocInfo::set_target_runtime_entry(Address target,
@@ -705,9 +764,9 @@ void RelocInfo::WipeOut() {
          IsRuntimeEntry(rmode_) || IsExternalReference(rmode_) ||
          IsInternalReference(rmode_));
   if (IsInternalReference(rmode_)) {
-    Memory::Address_at(pc_) = nullptr;
+    Memory::Address_at(pc_) = kNullAddress;
   } else {
-    Assembler::set_target_address_at(pc_, constant_pool_, nullptr);
+    Assembler::set_target_address_at(pc_, constant_pool_, kNullAddress);
   }
 }
 
@@ -716,7 +775,7 @@ void RelocInfo::Visit(ObjectVisitor* visitor) {
   RelocInfo::Mode mode = rmode();
   if (mode == RelocInfo::EMBEDDED_OBJECT) {
     visitor->VisitEmbeddedPointer(host(), this);
-  } else if (RelocInfo::IsCodeTarget(mode)) {
+  } else if (RelocInfo::IsCodeTargetMode(mode)) {
     visitor->VisitCodeTarget(host(), this);
   } else if (mode == RelocInfo::EXTERNAL_REFERENCE) {
     visitor->VisitExternalReference(host(), this);
diff --git a/deps/v8/src/arm64/assembler-arm64.cc b/deps/v8/src/arm64/assembler-arm64.cc
index fe81147d768ad5..4c205229017bf0 100644
--- a/deps/v8/src/arm64/assembler-arm64.cc
+++ b/deps/v8/src/arm64/assembler-arm64.cc
@@ -157,14 +157,21 @@ CPURegList CPURegList::GetSafepointSavedRegisters() {
 // -----------------------------------------------------------------------------
 // Implementation of RelocInfo
 
-const int RelocInfo::kApplyMask = 1 << RelocInfo::INTERNAL_REFERENCE;
-
+const int RelocInfo::kApplyMask =
+    RelocInfo::ModeMask(RelocInfo::CODE_TARGET) |
+    RelocInfo::ModeMask(RelocInfo::RUNTIME_ENTRY) |
+    RelocInfo::ModeMask(RelocInfo::INTERNAL_REFERENCE);
 
 bool RelocInfo::IsCodedSpecially() {
   // The deserializer needs to know whether a pointer is specially coded. Being
-  // specially coded on ARM64 means that it is a movz/movk sequence. We don't
-  // generate those for relocatable pointers.
-  return false;
+  // specially coded on ARM64 means that it is an immediate branch.
+  Instruction* instr = reinterpret_cast<Instruction*>(pc_);
+  if (instr->IsLdrLiteralX()) {
+    return false;
+  } else {
+    DCHECK(instr->IsBranchAndLink() || instr->IsUnconditionalBranch());
+    return true;
+  }
 }
 
 
@@ -173,33 +180,39 @@ bool RelocInfo::IsInConstantPool() {
   return instr->IsLdrLiteralX();
 }
 
-Address RelocInfo::embedded_address() const {
-  return Memory::Address_at(Assembler::target_pointer_address_at(pc_));
-}
-
-uint32_t RelocInfo::embedded_size() const {
-  return Memory::uint32_at(Assembler::target_pointer_address_at(pc_));
-}
-
-void RelocInfo::set_embedded_address(Address address,
-                                     ICacheFlushMode flush_mode) {
-  Assembler::set_target_address_at(pc_, constant_pool_, address, flush_mode);
-}
+int RelocInfo::GetDeoptimizationId(Isolate* isolate, DeoptimizeKind kind) {
+  DCHECK(IsRuntimeEntry(rmode_));
+  Instruction* movz_instr = reinterpret_cast<Instruction*>(pc_)->preceding();
+  DCHECK(movz_instr->IsMovz());
+  uint64_t imm = static_cast<uint64_t>(movz_instr->ImmMoveWide())
+                 << (16 * movz_instr->ShiftMoveWide());
+  DCHECK_LE(imm, INT_MAX);
 
-void RelocInfo::set_embedded_size(uint32_t size, ICacheFlushMode flush_mode) {
-  Memory::uint32_at(Assembler::target_pointer_address_at(pc_)) = size;
-  // No icache flushing needed, see comment in set_target_address_at.
+  return static_cast<int>(imm);
 }
 
 void RelocInfo::set_js_to_wasm_address(Address address,
                                        ICacheFlushMode icache_flush_mode) {
   DCHECK_EQ(rmode_, JS_TO_WASM_CALL);
-  set_embedded_address(address, icache_flush_mode);
+  Assembler::set_target_address_at(pc_, constant_pool_, address,
+                                   icache_flush_mode);
 }
 
 Address RelocInfo::js_to_wasm_address() const {
   DCHECK_EQ(rmode_, JS_TO_WASM_CALL);
-  return embedded_address();
+  return Assembler::target_address_at(pc_, constant_pool_);
+}
+
+uint32_t RelocInfo::wasm_call_tag() const {
+  DCHECK(rmode_ == WASM_CALL || rmode_ == WASM_STUB_CALL);
+  Instruction* instr = reinterpret_cast<Instruction*>(pc_);
+  if (instr->IsLdrLiteralX()) {
+    return static_cast<uint32_t>(
+        Memory::Address_at(Assembler::target_pointer_address_at(pc_)));
+  } else {
+    DCHECK(instr->IsBranchAndLink() || instr->IsUnconditionalBranch());
+    return static_cast<uint32_t>(instr->ImmPCOffset() / kInstructionSize);
+  }
 }
 
 bool AreAliased(const CPURegister& reg1, const CPURegister& reg2,
@@ -290,7 +303,7 @@ bool AreConsecutive(const VRegister& reg1, const VRegister& reg2,
 }
 
 void Immediate::InitializeHandle(Handle<HeapObject> handle) {
-  value_ = reinterpret_cast<intptr_t>(handle.address());
+  value_ = static_cast<intptr_t>(handle.address());
   rmode_ = RelocInfo::EMBEDDED_OBJECT;
 }
 
@@ -298,8 +311,8 @@ void Immediate::InitializeHandle(Handle<HeapObject> handle) {
 bool Operand::NeedsRelocation(const Assembler* assembler) const {
   RelocInfo::Mode rmode = immediate_.rmode();
 
-  if (rmode == RelocInfo::EXTERNAL_REFERENCE) {
-    return assembler->serializer_enabled();
+  if (RelocInfo::IsOnlyForSerializer(rmode)) {
+    return assembler->options().record_reloc_info_for_serialization;
   }
 
   return !RelocInfo::IsNone(rmode);
@@ -336,8 +349,7 @@ bool ConstPool::RecordEntry(intptr_t data, RelocInfo::Mode mode) {
 
   if (CanBeShared(mode)) {
     write_reloc_info = AddSharedEntry(shared_entries_, raw_data, offset);
-  } else if (mode == RelocInfo::CODE_TARGET &&
-             assm_->IsCodeTargetSharingAllowed() && raw_data != 0) {
+  } else if (mode == RelocInfo::CODE_TARGET && raw_data != 0) {
     // A zero data value is a placeholder and must not be shared.
     write_reloc_info = AddSharedEntry(handle_to_index_map_, raw_data, offset);
   } else {
@@ -465,8 +477,7 @@ void ConstPool::Clear() {
 
 
 bool ConstPool::CanBeShared(RelocInfo::Mode mode) {
-  return RelocInfo::IsNone(mode) ||
-         (mode >= RelocInfo::FIRST_SHAREABLE_RELOC_MODE);
+  return RelocInfo::IsNone(mode) || RelocInfo::IsShareableRelocMode(mode);
 }
 
 
@@ -531,7 +542,7 @@ void ConstPool::EmitEntries() {
 
       // Instruction to patch must be 'ldr rd, [pc, #offset]' with offset == 0.
       DCHECK(instr->IsLdrLiteral() && instr->ImmLLiteral() == 0);
-      instr->SetImmPCOffsetTarget(assm_->isolate_data(), assm_->pc());
+      instr->SetImmPCOffsetTarget(assm_->options(), assm_->pc());
     }
 
     assm_->dc64(entry.first);
@@ -541,13 +552,13 @@ void ConstPool::EmitEntries() {
 
 
 // Assembler
-Assembler::Assembler(IsolateData isolate_data, void* buffer, int buffer_size)
-    : AssemblerBase(isolate_data, buffer, buffer_size),
+Assembler::Assembler(const AssemblerOptions& options, void* buffer,
+                     int buffer_size)
+    : AssemblerBase(options, buffer, buffer_size),
       constpool_(this),
       unresolved_branches_() {
   const_pool_blocked_nesting_ = 0;
   veneer_pool_blocked_nesting_ = 0;
-  code_target_sharing_blocked_nesting_ = 0;
   Reset();
 }
 
@@ -556,7 +567,6 @@ Assembler::~Assembler() {
   DCHECK(constpool_.IsEmpty());
   DCHECK_EQ(const_pool_blocked_nesting_, 0);
   DCHECK_EQ(veneer_pool_blocked_nesting_, 0);
-  DCHECK_EQ(code_target_sharing_blocked_nesting_, 0);
 }
 
 
@@ -565,13 +575,12 @@ void Assembler::Reset() {
   DCHECK((pc_ >= buffer_) && (pc_ < buffer_ + buffer_size_));
   DCHECK_EQ(const_pool_blocked_nesting_, 0);
   DCHECK_EQ(veneer_pool_blocked_nesting_, 0);
-  DCHECK_EQ(code_target_sharing_blocked_nesting_, 0);
   DCHECK(unresolved_branches_.empty());
   memset(buffer_, 0, pc_ - buffer_);
 #endif
   pc_ = buffer_;
-  reloc_info_writer.Reposition(reinterpret_cast<byte*>(buffer_ + buffer_size_),
-                               reinterpret_cast<byte*>(pc_));
+  ReserveCodeTargetSpace(64);
+  reloc_info_writer.Reposition(buffer_ + buffer_size_, pc_);
   constpool_.Clear();
   next_constant_pool_check_ = 0;
   next_veneer_pool_check_ = kMaxInt;
@@ -580,19 +589,24 @@ void Assembler::Reset() {
 
 void Assembler::AllocateAndInstallRequestedHeapObjects(Isolate* isolate) {
   for (auto& request : heap_object_requests_) {
-    Handle<HeapObject> object;
+    Address pc = reinterpret_cast<Address>(buffer_) + request.offset();
     switch (request.kind()) {
-      case HeapObjectRequest::kHeapNumber:
-        object = isolate->factory()->NewHeapNumber(request.heap_number(),
-                                                   IMMUTABLE, TENURED);
+      case HeapObjectRequest::kHeapNumber: {
+        Handle<HeapObject> object =
+            isolate->factory()->NewHeapNumber(request.heap_number(), TENURED);
+        set_target_address_at(pc, 0 /* unused */, object.address());
         break;
-      case HeapObjectRequest::kCodeStub:
+      }
+      case HeapObjectRequest::kCodeStub: {
         request.code_stub()->set_isolate(isolate);
-        object = request.code_stub()->GetCode();
+        Instruction* instr = reinterpret_cast<Instruction*>(pc);
+        DCHECK(instr->IsBranchAndLink() || instr->IsUnconditionalBranch());
+        DCHECK_EQ(instr->ImmPCOffset() % kInstructionSize, 0);
+        UpdateCodeTarget(instr->ImmPCOffset() >> kInstructionSizeLog2,
+                         request.code_stub()->GetCode());
         break;
+      }
     }
-    Address pc = buffer_ + request.offset();
-    Memory::Address_at(target_pointer_address_at(pc)) = object.address();
   }
 }
 
@@ -683,22 +697,22 @@ void Assembler::RemoveBranchFromLabelLinkChain(Instruction* branch,
 
   } else if (branch == next_link) {
     // The branch is the last (but not also the first) instruction in the chain.
-    prev_link->SetImmPCOffsetTarget(isolate_data(), prev_link);
+    prev_link->SetImmPCOffsetTarget(options(), prev_link);
 
   } else {
     // The branch is in the middle of the chain.
     if (prev_link->IsTargetInImmPCOffsetRange(next_link)) {
-      prev_link->SetImmPCOffsetTarget(isolate_data(), next_link);
+      prev_link->SetImmPCOffsetTarget(options(), next_link);
     } else if (label_veneer != nullptr) {
       // Use the veneer for all previous links in the chain.
-      prev_link->SetImmPCOffsetTarget(isolate_data(), prev_link);
+      prev_link->SetImmPCOffsetTarget(options(), prev_link);
 
       end_of_chain = false;
       link = next_link;
       while (!end_of_chain) {
         next_link = link->ImmPCOffsetTarget();
         end_of_chain = (link == next_link);
-        link->SetImmPCOffsetTarget(isolate_data(), label_veneer);
+        link->SetImmPCOffsetTarget(options(), label_veneer);
         link = next_link;
       }
     } else {
@@ -769,11 +783,10 @@ void Assembler::bind(Label* label) {
       // Internal references do not get patched to an instruction but directly
       // to an address.
       internal_reference_positions_.push_back(linkoffset);
-      PatchingAssembler patcher(isolate_data(), reinterpret_cast<byte*>(link),
-                                2);
+      PatchingAssembler patcher(options(), reinterpret_cast<byte*>(link), 2);
       patcher.dc64(reinterpret_cast<uintptr_t>(pc_));
     } else {
-      link->SetImmPCOffsetTarget(isolate_data(),
+      link->SetImmPCOffsetTarget(options(),
                                  reinterpret_cast<Instruction*>(pc_));
     }
 
@@ -4068,9 +4081,7 @@ void Assembler::EmitStringData(const char* string) {
 
 void Assembler::debug(const char* message, uint32_t code, Instr params) {
 #ifdef USE_SIMULATOR
-  // Don't generate simulator specific code if we are building a snapshot, which
-  // might be run on real hardware.
-  if (!serializer_enabled()) {
+  if (options().enable_simulator_code) {
     // The arguments to the debug marker need to be contiguous in memory, so
     // make sure we don't try to emit pools.
     BlockPoolsScope scope(this);
@@ -4722,7 +4733,7 @@ void Assembler::GrowBuffer() {
   DeleteArray(buffer_);
   buffer_ = desc.buffer;
   buffer_size_ = desc.buffer_size;
-  pc_ = reinterpret_cast<byte*>(pc_) + pc_delta;
+  pc_ = pc_ + pc_delta;
   reloc_info_writer.Reposition(reloc_info_writer.pos() + rc_delta,
                                reloc_info_writer.last_pc() + pc_delta);
 
@@ -4739,13 +4750,13 @@ void Assembler::GrowBuffer() {
   // Pending relocation entries are also relative, no need to relocate.
 }
 
-
-void Assembler::RecordRelocInfo(RelocInfo::Mode rmode, intptr_t data) {
+void Assembler::RecordRelocInfo(RelocInfo::Mode rmode, intptr_t data,
+                                ConstantPoolMode constant_pool_mode) {
   // Non-relocatable constants should not end up in the literal pool.
   DCHECK(!RelocInfo::IsNone(rmode));
 
   // We do not try to reuse pool constants.
-  RelocInfo rinfo(reinterpret_cast<byte*>(pc_), rmode, data, nullptr);
+  RelocInfo rinfo(reinterpret_cast<Address>(pc_), rmode, data, nullptr);
   bool write_reloc_info = true;
 
   if ((rmode == RelocInfo::COMMENT) ||
@@ -4760,17 +4771,19 @@ void Assembler::RecordRelocInfo(RelocInfo::Mode rmode, intptr_t data) {
            RelocInfo::IsInternalReference(rmode) ||
            RelocInfo::IsConstPool(rmode) || RelocInfo::IsVeneerPool(rmode));
     // These modes do not need an entry in the constant pool.
-  } else {
+  } else if (constant_pool_mode == NEEDS_POOL_ENTRY) {
     write_reloc_info = constpool_.RecordEntry(data, rmode);
     // Make sure the constant pool is not emitted in place of the next
     // instruction for which we just recorded relocation info.
     BlockConstPoolFor(1);
   }
+  // For modes that cannot use the constant pool, a different sequence of
+  // instructions will be emitted by this function's caller.
 
   if (!RelocInfo::IsNone(rmode) && write_reloc_info) {
     // Don't record external references unless the heap will be serialized.
-    if (rmode == RelocInfo::EXTERNAL_REFERENCE &&
-        !serializer_enabled() && !emit_debug_code()) {
+    if (RelocInfo::IsOnlyForSerializer(rmode) &&
+        !options().record_reloc_info_for_serialization && !emit_debug_code()) {
       return;
     }
     DCHECK_GE(buffer_space(), kMaxRelocSize);  // too late to grow buffer here
@@ -4778,6 +4791,22 @@ void Assembler::RecordRelocInfo(RelocInfo::Mode rmode, intptr_t data) {
   }
 }
 
+void Assembler::near_jump(int offset, RelocInfo::Mode rmode) {
+  if (!RelocInfo::IsNone(rmode)) RecordRelocInfo(rmode, offset, NO_POOL_ENTRY);
+  b(offset);
+}
+
+void Assembler::near_call(int offset, RelocInfo::Mode rmode) {
+  if (!RelocInfo::IsNone(rmode)) RecordRelocInfo(rmode, offset, NO_POOL_ENTRY);
+  bl(offset);
+}
+
+void Assembler::near_call(HeapObjectRequest request) {
+  RequestHeapObject(request);
+  int index = AddCodeTarget(Handle<Code>());
+  RecordRelocInfo(RelocInfo::CODE_TARGET, index, NO_POOL_ENTRY);
+  bl(index);
+}
 
 void Assembler::BlockConstPoolFor(int instructions) {
   int pc_limit = pc_offset() + instructions * kInstructionSize;
@@ -4858,8 +4887,8 @@ bool Assembler::ShouldEmitVeneer(int max_reachable_pc, int margin) {
 
 
 void Assembler::RecordVeneerPool(int location_offset, int size) {
-  RelocInfo rinfo(buffer_ + location_offset, RelocInfo::VENEER_POOL,
-                  static_cast<intptr_t>(size), nullptr);
+  RelocInfo rinfo(reinterpret_cast<Address>(buffer_) + location_offset,
+                  RelocInfo::VENEER_POOL, static_cast<intptr_t>(size), nullptr);
   reloc_info_writer.Write(&rinfo);
 }
 
@@ -4901,7 +4930,7 @@ void Assembler::EmitVeneers(bool force_emit, bool need_protection, int margin) {
       // to the label.
       Instruction* veneer = reinterpret_cast<Instruction*>(pc_);
       RemoveBranchFromLabelLinkChain(branch, label, veneer);
-      branch->SetImmPCOffsetTarget(isolate_data(), veneer);
+      branch->SetImmPCOffsetTarget(options(), veneer);
       b(label);
 #ifdef DEBUG
       DCHECK(SizeOfCodeGeneratedSince(&veneer_size_check) <=
@@ -4965,8 +4994,7 @@ void Assembler::CheckVeneerPool(bool force_emit, bool require_jump,
 
 
 int Assembler::buffer_space() const {
-  return static_cast<int>(reloc_info_writer.pos() -
-                          reinterpret_cast<byte*>(pc_));
+  return static_cast<int>(reloc_info_writer.pos() - pc_);
 }
 
 
@@ -5009,6 +5037,15 @@ void PatchingAssembler::PatchAdrFar(int64_t target_offset) {
   add(rd, rd, scratch);
 }
 
+void PatchingAssembler::PatchSubSp(uint32_t immediate) {
+  // The code at the current instruction should be:
+  //   sub sp, sp, #0
+
+  // Verify the expected code.
+  Instruction* expected_adr = InstructionAt(0);
+  CHECK(expected_adr->IsAddSubImmediate());
+  sub(sp, sp, immediate);
+}
 
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/src/arm64/assembler-arm64.h b/deps/v8/src/arm64/assembler-arm64.h
index 94122e3939119d..e2945d59999af4 100644
--- a/deps/v8/src/arm64/assembler-arm64.h
+++ b/deps/v8/src/arm64/assembler-arm64.h
@@ -124,10 +124,6 @@ class CPURegister : public RegisterBase<CPURegister, kRegAfterLast> {
   }
 
   RegisterType type() const { return reg_type_; }
-  RegList bit() const {
-    DCHECK(static_cast<size_t>(reg_code_) < (sizeof(RegList) * kBitsPerByte));
-    return IsValid() ? 1UL << reg_code_ : 0;
-  }
   int SizeInBits() const {
     DCHECK(IsValid());
     return reg_size_;
@@ -445,7 +441,7 @@ ALIAS_REGISTER(Register, ip1, x17);
 ALIAS_REGISTER(Register, wip0, w16);
 ALIAS_REGISTER(Register, wip1, w17);
 // Root register.
-ALIAS_REGISTER(Register, root, x26);
+ALIAS_REGISTER(Register, kRootRegister, x26);
 ALIAS_REGISTER(Register, rr, x26);
 // Context pointer register.
 ALIAS_REGISTER(Register, cp, x27);
@@ -485,14 +481,11 @@ bool AreAliased(const CPURegister& reg1,
 // same size, and are of the same type. The system stack pointer may be
 // specified. Arguments set to NoReg are ignored, as are any subsequent
 // arguments. At least one argument (reg1) must be valid (not NoCPUReg).
-bool AreSameSizeAndType(const CPURegister& reg1,
-                        const CPURegister& reg2,
-                        const CPURegister& reg3 = NoCPUReg,
-                        const CPURegister& reg4 = NoCPUReg,
-                        const CPURegister& reg5 = NoCPUReg,
-                        const CPURegister& reg6 = NoCPUReg,
-                        const CPURegister& reg7 = NoCPUReg,
-                        const CPURegister& reg8 = NoCPUReg);
+bool AreSameSizeAndType(
+    const CPURegister& reg1, const CPURegister& reg2 = NoCPUReg,
+    const CPURegister& reg3 = NoCPUReg, const CPURegister& reg4 = NoCPUReg,
+    const CPURegister& reg5 = NoCPUReg, const CPURegister& reg6 = NoCPUReg,
+    const CPURegister& reg7 = NoCPUReg, const CPURegister& reg8 = NoCPUReg);
 
 // AreSameFormat returns true if all of the specified VRegisters have the same
 // vector format. Arguments set to NoVReg are ignored, as are any subsequent
@@ -517,12 +510,12 @@ typedef VRegister Simd128Register;
 // Lists of registers.
 class CPURegList {
  public:
-  explicit CPURegList(CPURegister reg1, CPURegister reg2 = NoCPUReg,
-                      CPURegister reg3 = NoCPUReg, CPURegister reg4 = NoCPUReg)
-      : list_(reg1.bit() | reg2.bit() | reg3.bit() | reg4.bit()),
-        size_(reg1.SizeInBits()),
-        type_(reg1.type()) {
-    DCHECK(AreSameSizeAndType(reg1, reg2, reg3, reg4));
+  template <typename... CPURegisters>
+  explicit CPURegList(CPURegister reg0, CPURegisters... regs)
+      : list_(CPURegister::ListOf(reg0, regs...)),
+        size_(reg0.SizeInBits()),
+        type_(reg0.type()) {
+    DCHECK(AreSameSizeAndType(reg0, regs...));
     DCHECK(IsValid());
   }
 
@@ -646,8 +639,8 @@ class CPURegList {
   CPURegister::RegisterType type_;
 
   bool IsValid() const {
-    const RegList kValidRegisters = 0x8000000ffffffff;
-    const RegList kValidVRegisters = 0x0000000ffffffff;
+    constexpr RegList kValidRegisters{0x8000000ffffffff};
+    constexpr RegList kValidVRegisters{0x0000000ffffffff};
     switch (type_) {
       case CPURegister::kRegister:
         return (list_ & kValidRegisters) == list_;
@@ -751,6 +744,7 @@ class Operand {
 
   inline Immediate immediate() const;
   inline int64_t ImmediateValue() const;
+  inline RelocInfo::Mode ImmediateRMode() const;
   inline Register reg() const;
   inline Shift shift() const;
   inline Extend extend() const;
@@ -904,9 +898,7 @@ class Assembler : public AssemblerBase {
   // buffer for code generation and assumes its size to be buffer_size. If the
   // buffer is too small, a fatal error occurs. No deallocation of the buffer is
   // done upon destruction of the assembler.
-  Assembler(Isolate* isolate, void* buffer, int buffer_size)
-      : Assembler(IsolateData(isolate), buffer, buffer_size) {}
-  Assembler(IsolateData isolate_data, void* buffer, int buffer_size);
+  Assembler(const AssemblerOptions& options, void* buffer, int buffer_size);
 
   virtual ~Assembler();
 
@@ -950,7 +942,22 @@ class Assembler : public AssemblerBase {
   // RelocInfo and pools ------------------------------------------------------
 
   // Record relocation information for current pc_.
-  void RecordRelocInfo(RelocInfo::Mode rmode, intptr_t data = 0);
+  enum ConstantPoolMode { NEEDS_POOL_ENTRY, NO_POOL_ENTRY };
+  void RecordRelocInfo(RelocInfo::Mode rmode, intptr_t data = 0,
+                       ConstantPoolMode constant_pool_mode = NEEDS_POOL_ENTRY);
+
+  // Generate a B immediate instruction with the corresponding relocation info.
+  // 'offset' is the immediate to encode in the B instruction (so it is the
+  // difference between the target and the PC of the instruction, divided by
+  // the instruction size).
+  void near_jump(int offset, RelocInfo::Mode rmode);
+  // Generate a BL immediate instruction with the corresponding relocation info.
+  // As for near_jump, 'offset' is the immediate to encode in the BL
+  // instruction.
+  void near_call(int offset, RelocInfo::Mode rmode);
+  // Generate a BL immediate instruction with the corresponding relocation info
+  // for the input HeapObjectRequest.
+  void near_call(HeapObjectRequest request);
 
   // Return the address in the constant pool of the code target address used by
   // the branch/call instruction at pc.
@@ -963,42 +970,55 @@ class Assembler : public AssemblerBase {
       Address pc, Address constant_pool, Address target,
       ICacheFlushMode icache_flush_mode = FLUSH_ICACHE_IF_NEEDED);
 
+  // Returns the handle for the code object called at 'pc'.
+  // This might need to be temporarily encoded as an offset into code_targets_.
+  inline Handle<Code> code_target_object_handle_at(Address pc);
+
+  // Returns the target address for a runtime function for the call encoded
+  // at 'pc'.
+  // Runtime entries can be temporarily encoded as the offset between the
+  // runtime function entrypoint and the code range start (stored in the
+  // code_range_start field), in order to be encodable as we generate the code,
+  // before it is moved into the code space.
+  inline Address runtime_entry_at(Address pc);
+
   // Return the code target address at a call site from the return address of
   // that call in the instruction stream.
   inline static Address target_address_from_return_address(Address pc);
 
-  // Given the address of the beginning of a call, return the address in the
-  // instruction stream that call will return from.
-  inline static Address return_address_from_call_start(Address pc);
-
-  // This sets the branch destination (which is in the constant pool on ARM).
+  // This sets the branch destination. 'location' here can be either the pc of
+  // an immediate branch or the address of an entry in the constant pool.
   // This is for calls and branches within generated code.
-  inline static void deserialization_set_special_target_at(
-      Address constant_pool_entry, Code* code, Address target);
+  inline static void deserialization_set_special_target_at(Address location,
+                                                           Code* code,
+                                                           Address target);
+
+  // Get the size of the special target encoded at 'location'.
+  inline static int deserialization_special_target_size(Address location);
 
   // This sets the internal reference at the pc.
   inline static void deserialization_set_target_internal_reference_at(
       Address pc, Address target,
       RelocInfo::Mode mode = RelocInfo::INTERNAL_REFERENCE);
 
-  // All addresses in the constant pool are the same size as pointers.
-  static constexpr int kSpecialTargetSize = kPointerSize;
+  // This value is used in the serialization process and must be zero for
+  // ARM64, as the code target is split across multiple instructions and does
+  // not exist separately in the code, so the serializer should not step
+  // forwards in memory after a target is resolved and written.
+  static constexpr int kSpecialTargetSize = 0;
 
   // The sizes of the call sequences emitted by MacroAssembler::Call.
   // Wherever possible, use MacroAssembler::CallSize instead of these constants,
   // as it will choose the correct value for a given relocation mode.
   //
-  // Without relocation:
-  //  movz  temp, #(target & 0x000000000000ffff)
-  //  movk  temp, #(target & 0x00000000ffff0000)
-  //  movk  temp, #(target & 0x0000ffff00000000)
-  //  blr   temp
+  // A "near" call is encoded in a BL immediate instruction:
+  //  bl target
   //
-  // With relocation:
-  //  ldr   temp, =target
-  //  blr   temp
-  static constexpr int kCallSizeWithoutRelocation = 4 * kInstructionSize;
-  static constexpr int kCallSizeWithRelocation = 2 * kInstructionSize;
+  // whereas a "far" call will be encoded like this:
+  //  ldr temp, =target
+  //  blr temp
+  static constexpr int kNearCallSize = 1 * kInstructionSize;
+  static constexpr int kFarCallSize = 2 * kInstructionSize;
 
   // Size of the generated code in bytes
   uint64_t SizeOfGeneratedCode() const {
@@ -1021,7 +1041,7 @@ class Assembler : public AssemblerBase {
   // change things to be consistent.
   void AssertSizeOfCodeGeneratedSince(const Label* label, ptrdiff_t size) {
     DCHECK_GE(size, 0);
-    DCHECK(static_cast<uint64_t>(size) == SizeOfCodeGeneratedSince(label));
+    DCHECK_EQ(static_cast<uint64_t>(size), SizeOfCodeGeneratedSince(label));
   }
 
   // Return the number of instructions generated from label to the
@@ -2861,6 +2881,10 @@ class Assembler : public AssemblerBase {
     return reinterpret_cast<byte*>(instr) - buffer_;
   }
 
+  static const char* GetSpecialRegisterName(int code) {
+    return (code == kSPRegInternalCode) ? "sp" : "UNKNOWN";
+  }
+
   // Register encoding.
   static Instr Rd(CPURegister rd) {
     DCHECK_NE(rd.code(), kSPRegInternalCode);
@@ -3203,34 +3227,6 @@ class Assembler : public AssemblerBase {
     DISALLOW_IMPLICIT_CONSTRUCTORS(BlockPoolsScope);
   };
 
-  // Class for blocking sharing of code targets in constant pool.
-  class BlockCodeTargetSharingScope {
-   public:
-    explicit BlockCodeTargetSharingScope(Assembler* assem) : assem_(nullptr) {
-      Open(assem);
-    }
-    // This constructor does not initialize the scope. The user needs to
-    // explicitly call Open() before using it.
-    BlockCodeTargetSharingScope() : assem_(nullptr) {}
-    ~BlockCodeTargetSharingScope() { Close(); }
-    void Open(Assembler* assem) {
-      DCHECK_NULL(assem_);
-      DCHECK_NOT_NULL(assem);
-      assem_ = assem;
-      assem_->StartBlockCodeTargetSharing();
-    }
-
-   private:
-    void Close() {
-      if (assem_ != nullptr) {
-        assem_->EndBlockCodeTargetSharing();
-      }
-    }
-    Assembler* assem_;
-
-    DISALLOW_COPY_AND_ASSIGN(BlockCodeTargetSharingScope);
-  };
-
  protected:
   inline const Register& AppropriateZeroRegFor(const CPURegister& reg) const;
 
@@ -3315,16 +3311,6 @@ class Assembler : public AssemblerBase {
   void RemoveBranchFromLabelLinkChain(Instruction* branch, Label* label,
                                       Instruction* label_veneer = nullptr);
 
-  // Prevent sharing of code target constant pool entries until
-  // EndBlockCodeTargetSharing is called. Calls to this function can be nested
-  // but must be followed by an equal number of call to
-  // EndBlockCodeTargetSharing.
-  void StartBlockCodeTargetSharing() { ++code_target_sharing_blocked_nesting_; }
-
-  // Resume sharing of constant pool code target entries. Needs to be called
-  // as many times as StartBlockCodeTargetSharing to have an effect.
-  void EndBlockCodeTargetSharing() { --code_target_sharing_blocked_nesting_; }
-
  private:
   static uint32_t FPToImm8(double imm);
 
@@ -3431,8 +3417,6 @@ class Assembler : public AssemblerBase {
   // Verify that a label's link chain is intact.
   void CheckLabelLinkChain(Label const * label);
 
-  void RecordLiteral(int64_t imm, unsigned size);
-
   // Postpone the generation of the constant pool for the specified number of
   // instructions.
   void BlockConstPoolFor(int instructions);
@@ -3506,12 +3490,6 @@ class Assembler : public AssemblerBase {
   // Emission of the veneer pools may be blocked in some code sequences.
   int veneer_pool_blocked_nesting_;  // Block emission if this is not zero.
 
-  // Sharing of code target entries may be blocked in some code sequences.
-  int code_target_sharing_blocked_nesting_;
-  bool IsCodeTargetSharingAllowed() const {
-    return code_target_sharing_blocked_nesting_ == 0;
-  }
-
   // Relocation info generation
   // Each relocation is encoded as a variable size value
   static constexpr int kMaxRelocSize = RelocInfoWriter::kMaxSize;
@@ -3617,20 +3595,8 @@ class Assembler : public AssemblerBase {
   // the length of the label chain.
   void DeleteUnresolvedBranchInfoForLabelTraverse(Label* label);
 
-  // The following functions help with avoiding allocations of embedded heap
-  // objects during the code assembly phase. {RequestHeapObject} records the
-  // need for a future heap number allocation or code stub generation. After
-  // code assembly, {AllocateAndInstallRequestedHeapObjects} will allocate these
-  // objects and place them where they are expected (determined by the pc offset
-  // associated with each request). That is, for each request, it will patch the
-  // dummy heap object handle that we emitted during code assembly with the
-  // actual heap object handle.
-  void RequestHeapObject(HeapObjectRequest request);
   void AllocateAndInstallRequestedHeapObjects(Isolate* isolate);
 
-  std::forward_list<HeapObjectRequest> heap_object_requests_;
-
- private:
   friend class EnsureSpace;
   friend class ConstPool;
 };
@@ -3646,8 +3612,9 @@ class PatchingAssembler : public Assembler {
   // relocation information takes space in the buffer, the PatchingAssembler
   // will crash trying to grow the buffer.
   // Note that the instruction cache will not be flushed.
-  PatchingAssembler(IsolateData isolate_data, byte* start, unsigned count)
-      : Assembler(isolate_data, start, count * kInstructionSize + kGap) {
+  PatchingAssembler(const AssemblerOptions& options, byte* start,
+                    unsigned count)
+      : Assembler(options, start, count * kInstructionSize + kGap) {
     // Block constant pool emission.
     StartBlockPools();
   }
@@ -3666,6 +3633,7 @@ class PatchingAssembler : public Assembler {
   static constexpr int kAdrFarPatchableNNops = 2;
   static constexpr int kAdrFarPatchableNInstrs = kAdrFarPatchableNNops + 2;
   void PatchAdrFar(int64_t target_offset);
+  void PatchSubSp(uint32_t immediate);
 };
 
 
diff --git a/deps/v8/src/arm64/code-stubs-arm64.cc b/deps/v8/src/arm64/code-stubs-arm64.cc
index c1cb3025a1fcef..7a5f06c492131f 100644
--- a/deps/v8/src/arm64/code-stubs-arm64.cc
+++ b/deps/v8/src/arm64/code-stubs-arm64.cc
@@ -16,6 +16,7 @@
 #include "src/ic/ic.h"
 #include "src/ic/stub-cache.h"
 #include "src/isolate.h"
+#include "src/objects/api-callbacks.h"
 #include "src/objects/regexp-match-info.h"
 #include "src/regexp/jsregexp.h"
 #include "src/regexp/regexp-macro-assembler.h"
@@ -28,445 +29,6 @@ namespace internal {
 
 #define __ ACCESS_MASM(masm)
 
-void ArrayNArgumentsConstructorStub::Generate(MacroAssembler* masm) {
-  __ Mov(x5, Operand(x0, LSL, kPointerSizeLog2));
-  __ Poke(x1, Operand(x5));
-  __ Push(x1, x2);
-  __ Add(x0, x0, Operand(3));
-  __ TailCallRuntime(Runtime::kNewArray);
-}
-
-
-void DoubleToIStub::Generate(MacroAssembler* masm) {
-  Label done;
-  Register result = destination();
-
-  DCHECK(result.Is64Bits());
-
-  UseScratchRegisterScope temps(masm);
-  Register scratch1 = temps.AcquireX();
-  Register scratch2 = temps.AcquireX();
-  DoubleRegister double_scratch = temps.AcquireD();
-
-  __ Peek(double_scratch, 0);
-  // Try to convert with a FPU convert instruction.  This handles all
-  // non-saturating cases.
-  __ TryConvertDoubleToInt64(result, double_scratch, &done);
-  __ Fmov(result, double_scratch);
-
-  // If we reach here we need to manually convert the input to an int32.
-
-  // Extract the exponent.
-  Register exponent = scratch1;
-  __ Ubfx(exponent, result, HeapNumber::kMantissaBits,
-          HeapNumber::kExponentBits);
-
-  // It the exponent is >= 84 (kMantissaBits + 32), the result is always 0 since
-  // the mantissa gets shifted completely out of the int32_t result.
-  __ Cmp(exponent, HeapNumber::kExponentBias + HeapNumber::kMantissaBits + 32);
-  __ CzeroX(result, ge);
-  __ B(ge, &done);
-
-  // The Fcvtzs sequence handles all cases except where the conversion causes
-  // signed overflow in the int64_t target. Since we've already handled
-  // exponents >= 84, we can guarantee that 63 <= exponent < 84.
-
-  if (masm->emit_debug_code()) {
-    __ Cmp(exponent, HeapNumber::kExponentBias + 63);
-    // Exponents less than this should have been handled by the Fcvt case.
-    __ Check(ge, AbortReason::kUnexpectedValue);
-  }
-
-  // Isolate the mantissa bits, and set the implicit '1'.
-  Register mantissa = scratch2;
-  __ Ubfx(mantissa, result, 0, HeapNumber::kMantissaBits);
-  __ Orr(mantissa, mantissa, 1UL << HeapNumber::kMantissaBits);
-
-  // Negate the mantissa if necessary.
-  __ Tst(result, kXSignMask);
-  __ Cneg(mantissa, mantissa, ne);
-
-  // Shift the mantissa bits in the correct place. We know that we have to shift
-  // it left here, because exponent >= 63 >= kMantissaBits.
-  __ Sub(exponent, exponent,
-         HeapNumber::kExponentBias + HeapNumber::kMantissaBits);
-  __ Lsl(result, mantissa, exponent);
-
-  __ Bind(&done);
-  __ Ret();
-}
-
-
-void MathPowStub::Generate(MacroAssembler* masm) {
-  // Stack on entry:
-  // sp[0]: Exponent (as a tagged value).
-  // sp[1]: Base (as a tagged value).
-  //
-  // The (tagged) result will be returned in x0, as a heap number.
-
-  Register exponent_tagged = MathPowTaggedDescriptor::exponent();
-  DCHECK(exponent_tagged.is(x11));
-  Register exponent_integer = MathPowIntegerDescriptor::exponent();
-  DCHECK(exponent_integer.is(x12));
-  Register saved_lr = x19;
-  VRegister result_double = d0;
-  VRegister base_double = d0;
-  VRegister exponent_double = d1;
-  VRegister base_double_copy = d2;
-  VRegister scratch1_double = d6;
-  VRegister scratch0_double = d7;
-
-  // A fast-path for integer exponents.
-  Label exponent_is_smi, exponent_is_integer;
-  // Allocate a heap number for the result, and return it.
-  Label done;
-
-  // Unpack the inputs.
-
-  // Handle double (heap number) exponents.
-  // Detect integer exponents stored as doubles and handle those in the
-  // integer fast-path.
-  __ TryRepresentDoubleAsInt64(exponent_integer, exponent_double,
-                               scratch0_double, &exponent_is_integer);
-
-  {
-    AllowExternalCallThatCantCauseGC scope(masm);
-    __ Mov(saved_lr, lr);
-    __ CallCFunction(ExternalReference::power_double_double_function(isolate()),
-                     0, 2);
-    __ Mov(lr, saved_lr);
-    __ B(&done);
-  }
-
-  // Handle SMI exponents.
-  __ Bind(&exponent_is_smi);
-  //  x10   base_tagged       The tagged base (input).
-  //  x11   exponent_tagged   The tagged exponent (input).
-  //  d1    base_double       The base as a double.
-  __ SmiUntag(exponent_integer, exponent_tagged);
-
-  __ Bind(&exponent_is_integer);
-  //  x10   base_tagged       The tagged base (input).
-  //  x11   exponent_tagged   The tagged exponent (input).
-  //  x12   exponent_integer  The exponent as an integer.
-  //  d1    base_double       The base as a double.
-
-  // Find abs(exponent). For negative exponents, we can find the inverse later.
-  Register exponent_abs = x13;
-  __ Cmp(exponent_integer, 0);
-  __ Cneg(exponent_abs, exponent_integer, mi);
-  //  x13   exponent_abs      The value of abs(exponent_integer).
-
-  // Repeatedly multiply to calculate the power.
-  //  result = 1.0;
-  //  For each bit n (exponent_integer{n}) {
-  //    if (exponent_integer{n}) {
-  //      result *= base;
-  //    }
-  //    base *= base;
-  //    if (remaining bits in exponent_integer are all zero) {
-  //      break;
-  //    }
-  //  }
-  Label power_loop, power_loop_entry, power_loop_exit;
-  __ Fmov(scratch1_double, base_double);
-  __ Fmov(base_double_copy, base_double);
-  __ Fmov(result_double, 1.0);
-  __ B(&power_loop_entry);
-
-  __ Bind(&power_loop);
-  __ Fmul(scratch1_double, scratch1_double, scratch1_double);
-  __ Lsr(exponent_abs, exponent_abs, 1);
-  __ Cbz(exponent_abs, &power_loop_exit);
-
-  __ Bind(&power_loop_entry);
-  __ Tbz(exponent_abs, 0, &power_loop);
-  __ Fmul(result_double, result_double, scratch1_double);
-  __ B(&power_loop);
-
-  __ Bind(&power_loop_exit);
-
-  // If the exponent was positive, result_double holds the result.
-  __ Tbz(exponent_integer, kXSignBit, &done);
-
-  // The exponent was negative, so find the inverse.
-  __ Fmov(scratch0_double, 1.0);
-  __ Fdiv(result_double, scratch0_double, result_double);
-  // ECMA-262 only requires Math.pow to return an 'implementation-dependent
-  // approximation' of base^exponent. However, mjsunit/math-pow uses Math.pow
-  // to calculate the subnormal value 2^-1074. This method of calculating
-  // negative powers doesn't work because 2^1074 overflows to infinity. To
-  // catch this corner-case, we bail out if the result was 0. (This can only
-  // occur if the divisor is infinity or the base is zero.)
-  __ Fcmp(result_double, 0.0);
-  __ B(&done, ne);
-
-  AllowExternalCallThatCantCauseGC scope(masm);
-  __ Mov(saved_lr, lr);
-  __ Fmov(base_double, base_double_copy);
-  __ Scvtf(exponent_double, exponent_integer);
-  __ CallCFunction(ExternalReference::power_double_double_function(isolate()),
-                   0, 2);
-  __ Mov(lr, saved_lr);
-  __ Bind(&done);
-  __ Ret();
-}
-
-void CodeStub::GenerateStubsAheadOfTime(Isolate* isolate) {
-  // It is important that the following stubs are generated in this order
-  // because pregenerated stubs can only call other pregenerated stubs.
-  CEntryStub::GenerateAheadOfTime(isolate);
-  CommonArrayConstructorStub::GenerateStubsAheadOfTime(isolate);
-  StoreFastElementStub::GenerateAheadOfTime(isolate);
-}
-
-
-void CodeStub::GenerateFPStubs(Isolate* isolate) {
-  // Floating-point code doesn't get special handling in ARM64, so there's
-  // nothing to do here.
-  USE(isolate);
-}
-
-Movability CEntryStub::NeedsImmovableCode() {
-  // CEntryStub stores the return address on the stack before calling into
-  // C++ code. In some cases, the VM accesses this address, but it is not used
-  // when the C++ code returns to the stub because LR holds the return address
-  // in AAPCS64. If the stub is moved (perhaps during a GC), we could end up
-  // returning to dead code.
-  // TODO(jbramley): Whilst this is the only analysis that makes sense, I can't
-  // find any comment to confirm this, and I don't hit any crashes whatever
-  // this function returns. The anaylsis should be properly confirmed.
-  return kImmovable;
-}
-
-
-void CEntryStub::GenerateAheadOfTime(Isolate* isolate) {
-  CEntryStub stub(isolate, 1, kDontSaveFPRegs);
-  stub.GetCode();
-  CEntryStub stub_fp(isolate, 1, kSaveFPRegs);
-  stub_fp.GetCode();
-}
-
-
-void CEntryStub::Generate(MacroAssembler* masm) {
-  // The Abort mechanism relies on CallRuntime, which in turn relies on
-  // CEntryStub, so until this stub has been generated, we have to use a
-  // fall-back Abort mechanism.
-  //
-  // Note that this stub must be generated before any use of Abort.
-  MacroAssembler::NoUseRealAbortsScope no_use_real_aborts(masm);
-
-  ASM_LOCATION("CEntryStub::Generate entry");
-  ProfileEntryHookStub::MaybeCallEntryHook(masm);
-
-  // Register parameters:
-  //    x0: argc (including receiver, untagged)
-  //    x1: target
-  // If argv_in_register():
-  //    x11: argv (pointer to first argument)
-  //
-  // The stack on entry holds the arguments and the receiver, with the receiver
-  // at the highest address:
-  //
-  //    sp]argc-1]: receiver
-  //    sp[argc-2]: arg[argc-2]
-  //    ...           ...
-  //    sp[1]:      arg[1]
-  //    sp[0]:      arg[0]
-  //
-  // The arguments are in reverse order, so that arg[argc-2] is actually the
-  // first argument to the target function and arg[0] is the last.
-  const Register& argc_input = x0;
-  const Register& target_input = x1;
-
-  // Calculate argv, argc and the target address, and store them in
-  // callee-saved registers so we can retry the call without having to reload
-  // these arguments.
-  // TODO(jbramley): If the first call attempt succeeds in the common case (as
-  // it should), then we might be better off putting these parameters directly
-  // into their argument registers, rather than using callee-saved registers and
-  // preserving them on the stack.
-  const Register& argv = x21;
-  const Register& argc = x22;
-  const Register& target = x23;
-
-  // Derive argv from the stack pointer so that it points to the first argument
-  // (arg[argc-2]), or just below the receiver in case there are no arguments.
-  //  - Adjust for the arg[] array.
-  Register temp_argv = x11;
-  if (!argv_in_register()) {
-    __ SlotAddress(temp_argv, x0);
-    //  - Adjust for the receiver.
-    __ Sub(temp_argv, temp_argv, 1 * kPointerSize);
-  }
-
-  // Reserve three slots to preserve x21-x23 callee-saved registers.
-  int extra_stack_space = 3;
-  // Enter the exit frame.
-  FrameScope scope(masm, StackFrame::MANUAL);
-  __ EnterExitFrame(
-      save_doubles(), x10, extra_stack_space,
-      is_builtin_exit() ? StackFrame::BUILTIN_EXIT : StackFrame::EXIT);
-
-  // Poke callee-saved registers into reserved space.
-  __ Poke(argv, 1 * kPointerSize);
-  __ Poke(argc, 2 * kPointerSize);
-  __ Poke(target, 3 * kPointerSize);
-
-  // We normally only keep tagged values in callee-saved registers, as they
-  // could be pushed onto the stack by called stubs and functions, and on the
-  // stack they can confuse the GC. However, we're only calling C functions
-  // which can push arbitrary data onto the stack anyway, and so the GC won't
-  // examine that part of the stack.
-  __ Mov(argc, argc_input);
-  __ Mov(target, target_input);
-  __ Mov(argv, temp_argv);
-
-  // x21 : argv
-  // x22 : argc
-  // x23 : call target
-  //
-  // The stack (on entry) holds the arguments and the receiver, with the
-  // receiver at the highest address:
-  //
-  //         argv[8]:     receiver
-  // argv -> argv[0]:     arg[argc-2]
-  //         ...          ...
-  //         argv[...]:   arg[1]
-  //         argv[...]:   arg[0]
-  //
-  // Immediately below (after) this is the exit frame, as constructed by
-  // EnterExitFrame:
-  //         fp[8]:    CallerPC (lr)
-  //   fp -> fp[0]:    CallerFP (old fp)
-  //         fp[-8]:   Space reserved for SPOffset.
-  //         fp[-16]:  CodeObject()
-  //         sp[...]:  Saved doubles, if saved_doubles is true.
-  //         sp[32]:   Alignment padding, if necessary.
-  //         sp[24]:   Preserved x23 (used for target).
-  //         sp[16]:   Preserved x22 (used for argc).
-  //         sp[8]:    Preserved x21 (used for argv).
-  //   sp -> sp[0]:    Space reserved for the return address.
-  //
-  // After a successful call, the exit frame, preserved registers (x21-x23) and
-  // the arguments (including the receiver) are dropped or popped as
-  // appropriate. The stub then returns.
-  //
-  // After an unsuccessful call, the exit frame and suchlike are left
-  // untouched, and the stub either throws an exception by jumping to one of
-  // the exception_returned label.
-
-  // Prepare AAPCS64 arguments to pass to the builtin.
-  __ Mov(x0, argc);
-  __ Mov(x1, argv);
-  __ Mov(x2, ExternalReference::isolate_address(isolate()));
-
-  Label return_location;
-  __ Adr(x12, &return_location);
-  __ Poke(x12, 0);
-
-  if (__ emit_debug_code()) {
-    // Verify that the slot below fp[kSPOffset]-8 points to the return location
-    // (currently in x12).
-    UseScratchRegisterScope temps(masm);
-    Register temp = temps.AcquireX();
-    __ Ldr(temp, MemOperand(fp, ExitFrameConstants::kSPOffset));
-    __ Ldr(temp, MemOperand(temp, -static_cast<int64_t>(kXRegSize)));
-    __ Cmp(temp, x12);
-    __ Check(eq, AbortReason::kReturnAddressNotFoundInFrame);
-  }
-
-  // Call the builtin.
-  __ Blr(target);
-  __ Bind(&return_location);
-
-  // Result returned in x0 or x1:x0 - do not destroy these registers!
-
-  //  x0    result0      The return code from the call.
-  //  x1    result1      For calls which return ObjectPair.
-  //  x21   argv
-  //  x22   argc
-  //  x23   target
-  const Register& result = x0;
-
-  // Check result for exception sentinel.
-  Label exception_returned;
-  __ CompareRoot(result, Heap::kExceptionRootIndex);
-  __ B(eq, &exception_returned);
-
-  // The call succeeded, so unwind the stack and return.
-
-  // Restore callee-saved registers x21-x23.
-  __ Mov(x11, argc);
-
-  __ Peek(argv, 1 * kPointerSize);
-  __ Peek(argc, 2 * kPointerSize);
-  __ Peek(target, 3 * kPointerSize);
-
-  __ LeaveExitFrame(save_doubles(), x10, x9);
-  if (!argv_in_register()) {
-    // Drop the remaining stack slots and return from the stub.
-    __ DropArguments(x11);
-  }
-  __ AssertFPCRState();
-  __ Ret();
-
-  // Handling of exception.
-  __ Bind(&exception_returned);
-
-  ExternalReference pending_handler_context_address(
-      IsolateAddressId::kPendingHandlerContextAddress, isolate());
-  ExternalReference pending_handler_entrypoint_address(
-      IsolateAddressId::kPendingHandlerEntrypointAddress, isolate());
-  ExternalReference pending_handler_fp_address(
-      IsolateAddressId::kPendingHandlerFPAddress, isolate());
-  ExternalReference pending_handler_sp_address(
-      IsolateAddressId::kPendingHandlerSPAddress, isolate());
-
-  // Ask the runtime for help to determine the handler. This will set x0 to
-  // contain the current pending exception, don't clobber it.
-  ExternalReference find_handler(Runtime::kUnwindAndFindExceptionHandler,
-                                 isolate());
-  {
-    FrameScope scope(masm, StackFrame::MANUAL);
-    __ Mov(x0, 0);  // argc.
-    __ Mov(x1, 0);  // argv.
-    __ Mov(x2, ExternalReference::isolate_address(isolate()));
-    __ CallCFunction(find_handler, 3);
-  }
-
-  // Retrieve the handler context, SP and FP.
-  __ Mov(cp, Operand(pending_handler_context_address));
-  __ Ldr(cp, MemOperand(cp));
-  {
-    UseScratchRegisterScope temps(masm);
-    Register scratch = temps.AcquireX();
-    __ Mov(scratch, Operand(pending_handler_sp_address));
-    __ Ldr(scratch, MemOperand(scratch));
-    __ Mov(sp, scratch);
-  }
-  __ Mov(fp, Operand(pending_handler_fp_address));
-  __ Ldr(fp, MemOperand(fp));
-
-  // If the handler is a JS frame, restore the context to the frame. Note that
-  // the context will be set to (cp == 0) for non-JS frames.
-  Label not_js_frame;
-  __ Cbz(cp, &not_js_frame);
-  __ Str(cp, MemOperand(fp, StandardFrameConstants::kContextOffset));
-  __ Bind(&not_js_frame);
-
-  // Reset the masking register. This is done independent of the underlying
-  // feature flag {FLAG_branch_load_poisoning} to make the snapshot work with
-  // both configurations. It is safe to always do this, because the underlying
-  // register is caller-saved and can be arbitrarily clobbered.
-  __ ResetSpeculationPoisonRegister();
-
-  // Compute the handler entry address and jump to it.
-  __ Mov(x10, Operand(pending_handler_entrypoint_address));
-  __ Ldr(x10, MemOperand(x10));
-  __ Br(x10);
-}
-
 // This is the entry point from C++. 5 arguments are provided in x0-x4.
 // See use of the JSEntryFunction for example in src/execution.cc.
 // Input:
@@ -478,30 +40,35 @@ void CEntryStub::Generate(MacroAssembler* masm) {
 // Output:
 //   x0: result.
 void JSEntryStub::Generate(MacroAssembler* masm) {
+  Label invoke, handler_entry, exit;
+
   Register code_entry = x0;
 
-  // Enable instruction instrumentation. This only works on the simulator, and
-  // will have no effect on the model or real hardware.
-  __ EnableInstrumentation();
+  {
+    NoRootArrayScope no_root_array(masm);
 
-  Label invoke, handler_entry, exit;
+    // Enable instruction instrumentation. This only works on the simulator, and
+    // will have no effect on the model or real hardware.
+    __ EnableInstrumentation();
 
-  __ PushCalleeSavedRegisters();
+    __ PushCalleeSavedRegisters();
 
-  ProfileEntryHookStub::MaybeCallEntryHook(masm);
+    ProfileEntryHookStub::MaybeCallEntryHook(masm);
 
-  // Set up the reserved register for 0.0.
-  __ Fmov(fp_zero, 0.0);
+    // Set up the reserved register for 0.0.
+    __ Fmov(fp_zero, 0.0);
 
-  // Initialize the root array register
-  __ InitializeRootRegister();
+    // Initialize the root array register
+    __ InitializeRootRegister();
+  }
 
   // Build an entry frame (see layout below).
   StackFrame::Type marker = type();
   int64_t bad_frame_pointer = -1L;  // Bad frame pointer to fail if it is used.
   __ Mov(x13, bad_frame_pointer);
   __ Mov(x12, StackFrame::TypeToMarker(marker));
-  __ Mov(x11, ExternalReference(IsolateAddressId::kCEntryFPAddress, isolate()));
+  __ Mov(x11, ExternalReference::Create(IsolateAddressId::kCEntryFPAddress,
+                                        isolate()));
   __ Ldr(x10, MemOperand(x11));
 
   __ Push(x13, x12, xzr, x10);
@@ -511,8 +78,9 @@ void JSEntryStub::Generate(MacroAssembler* masm) {
   // Push the JS entry frame marker. Also set js_entry_sp if this is the
   // outermost JS call.
   Label non_outermost_js, done;
-  ExternalReference js_entry_sp(IsolateAddressId::kJSEntrySPAddress, isolate());
-  __ Mov(x10, ExternalReference(js_entry_sp));
+  ExternalReference js_entry_sp =
+      ExternalReference::Create(IsolateAddressId::kJSEntrySPAddress, isolate());
+  __ Mov(x10, js_entry_sp);
   __ Ldr(x11, MemOperand(x10));
 
   // Select between the inner and outermost frame marker, based on the JS entry
@@ -552,7 +120,7 @@ void JSEntryStub::Generate(MacroAssembler* masm) {
     // field in the JSEnv and return a failure sentinel. Coming in here the
     // fp will be invalid because the PushTryHandler below sets it to 0 to
     // signal the existence of the JSEntry frame.
-    __ Mov(x10, Operand(ExternalReference(
+    __ Mov(x10, Operand(ExternalReference::Create(
                     IsolateAddressId::kPendingExceptionAddress, isolate())));
   }
   __ Str(code_entry, MemOperand(x10));
@@ -569,7 +137,8 @@ void JSEntryStub::Generate(MacroAssembler* masm) {
                 "Unexpected offset for StackHandlerConstants::kNextOffset");
 
   // Link the current handler as the next handler.
-  __ Mov(x11, ExternalReference(IsolateAddressId::kHandlerAddress, isolate()));
+  __ Mov(x11, ExternalReference::Create(IsolateAddressId::kHandlerAddress,
+                                        isolate()));
   __ Ldr(x10, MemOperand(x11));
   __ Push(padreg, x10);
 
@@ -602,7 +171,8 @@ void JSEntryStub::Generate(MacroAssembler* masm) {
   static_assert(StackHandlerConstants::kNextOffset == 0 * kPointerSize,
                 "Unexpected offset for StackHandlerConstants::kNextOffset");
   __ Pop(x10, padreg);
-  __ Mov(x11, ExternalReference(IsolateAddressId::kHandlerAddress, isolate()));
+  __ Mov(x11, ExternalReference::Create(IsolateAddressId::kHandlerAddress,
+                                        isolate()));
   __ Drop(StackHandlerConstants::kSlotCount - 2);
   __ Str(x10, MemOperand(x11));
 
@@ -624,13 +194,13 @@ void JSEntryStub::Generate(MacroAssembler* masm) {
     __ PeekPair(x10, c_entry_fp, 1 * kPointerSize);
     __ Cmp(x10, StackFrame::OUTERMOST_JSENTRY_FRAME);
     __ B(ne, &non_outermost_js_2);
-    __ Mov(x12, ExternalReference(js_entry_sp));
+    __ Mov(x12, js_entry_sp);
     __ Str(xzr, MemOperand(x12));
     __ Bind(&non_outermost_js_2);
 
     // Restore the top frame descriptors from the stack.
-    __ Mov(x12,
-           ExternalReference(IsolateAddressId::kCEntryFPAddress, isolate()));
+    __ Mov(x12, ExternalReference::Create(IsolateAddressId::kCEntryFPAddress,
+                                          isolate()));
     __ Str(c_entry_fp, MemOperand(x12));
   }
 
@@ -643,9 +213,9 @@ void JSEntryStub::Generate(MacroAssembler* masm) {
   __ Ret();
 }
 
-// The entry hook is a Push (stp) instruction, followed by a call.
+// The entry hook is a Push (stp) instruction, followed by a near call.
 static const unsigned int kProfileEntryHookCallSize =
-    (1 * kInstructionSize) + Assembler::kCallSizeWithRelocation;
+    (1 * kInstructionSize) + Assembler::kNearCallSize;
 
 void ProfileEntryHookStub::MaybeCallEntryHookDelayed(TurboAssembler* tasm,
                                                      Zone* zone) {
@@ -700,9 +270,8 @@ void ProfileEntryHookStub::Generate(MacroAssembler* masm) {
   // Under the simulator we need to indirect the entry hook through a trampoline
   // function at a known address.
   ApiFunction dispatcher(FUNCTION_ADDR(EntryHookTrampoline));
-  __ Mov(x10, Operand(ExternalReference(&dispatcher,
-                                        ExternalReference::BUILTIN_CALL,
-                                        isolate())));
+  __ Mov(x10, Operand(ExternalReference::Create(
+                  &dispatcher, ExternalReference::BUILTIN_CALL)));
   // It additionally takes an isolate as a third parameter
   __ Mov(x2, ExternalReference::isolate_address(isolate()));
 #endif
@@ -735,328 +304,9 @@ void DirectCEntryStub::Generate(MacroAssembler* masm) {
 
 void DirectCEntryStub::GenerateCall(MacroAssembler* masm,
                                     Register target) {
-  intptr_t code =
-      reinterpret_cast<intptr_t>(GetCode().location());
-  __ Mov(lr, Operand(code, RelocInfo::CODE_TARGET));
-  __ Mov(x10, target);
   // Branch to the stub.
-  __ Blr(lr);
-}
-
-template<class T>
-static void CreateArrayDispatch(MacroAssembler* masm,
-                                AllocationSiteOverrideMode mode) {
-  ASM_LOCATION("CreateArrayDispatch");
-  if (mode == DISABLE_ALLOCATION_SITES) {
-    T stub(masm->isolate(), GetInitialFastElementsKind(), mode);
-     __ TailCallStub(&stub);
-
-  } else if (mode == DONT_OVERRIDE) {
-    Register kind = x3;
-    int last_index =
-        GetSequenceIndexFromFastElementsKind(TERMINAL_FAST_ELEMENTS_KIND);
-    for (int i = 0; i <= last_index; ++i) {
-      Label next;
-      ElementsKind candidate_kind = GetFastElementsKindFromSequenceIndex(i);
-      // TODO(jbramley): Is this the best way to handle this? Can we make the
-      // tail calls conditional, rather than hopping over each one?
-      __ CompareAndBranch(kind, candidate_kind, ne, &next);
-      T stub(masm->isolate(), candidate_kind);
-      __ TailCallStub(&stub);
-      __ Bind(&next);
-    }
-
-    // If we reached this point there is a problem.
-    __ Abort(AbortReason::kUnexpectedElementsKindInArrayConstructor);
-
-  } else {
-    UNREACHABLE();
-  }
-}
-
-
-// TODO(jbramley): If this needs to be a special case, make it a proper template
-// specialization, and not a separate function.
-static void CreateArrayDispatchOneArgument(MacroAssembler* masm,
-                                           AllocationSiteOverrideMode mode) {
-  ASM_LOCATION("CreateArrayDispatchOneArgument");
-  // x0 - argc
-  // x1 - constructor?
-  // x2 - allocation site (if mode != DISABLE_ALLOCATION_SITES)
-  // x3 - kind (if mode != DISABLE_ALLOCATION_SITES)
-  // sp[0] - last argument
-
-  Register allocation_site = x2;
-  Register kind = x3;
-
-  STATIC_ASSERT(PACKED_SMI_ELEMENTS == 0);
-  STATIC_ASSERT(HOLEY_SMI_ELEMENTS == 1);
-  STATIC_ASSERT(PACKED_ELEMENTS == 2);
-  STATIC_ASSERT(HOLEY_ELEMENTS == 3);
-  STATIC_ASSERT(PACKED_DOUBLE_ELEMENTS == 4);
-  STATIC_ASSERT(HOLEY_DOUBLE_ELEMENTS == 5);
-
-  if (mode == DISABLE_ALLOCATION_SITES) {
-    ElementsKind initial = GetInitialFastElementsKind();
-    ElementsKind holey_initial = GetHoleyElementsKind(initial);
-
-    ArraySingleArgumentConstructorStub stub_holey(masm->isolate(),
-                                                  holey_initial,
-                                                  DISABLE_ALLOCATION_SITES);
-    __ TailCallStub(&stub_holey);
-  } else if (mode == DONT_OVERRIDE) {
-    // Is the low bit set? If so, the array is holey.
-    Label normal_sequence;
-    __ Tbnz(kind, 0, &normal_sequence);
-
-    // We are going to create a holey array, but our kind is non-holey.
-    // Fix kind and retry (only if we have an allocation site in the slot).
-    __ Orr(kind, kind, 1);
-
-    if (FLAG_debug_code) {
-      __ Ldr(x10, FieldMemOperand(allocation_site, 0));
-      __ JumpIfNotRoot(x10, Heap::kAllocationSiteMapRootIndex,
-                       &normal_sequence);
-      __ Assert(eq, AbortReason::kExpectedAllocationSite);
-    }
-
-    // Save the resulting elements kind in type info. We can't just store 'kind'
-    // in the AllocationSite::transition_info field because elements kind is
-    // restricted to a portion of the field; upper bits need to be left alone.
-    STATIC_ASSERT(AllocationSite::ElementsKindBits::kShift == 0);
-    __ Ldr(x11,
-           FieldMemOperand(allocation_site,
-                           AllocationSite::kTransitionInfoOrBoilerplateOffset));
-    __ Add(x11, x11, Smi::FromInt(kFastElementsKindPackedToHoley));
-    __ Str(x11,
-           FieldMemOperand(allocation_site,
-                           AllocationSite::kTransitionInfoOrBoilerplateOffset));
-
-    __ Bind(&normal_sequence);
-    int last_index =
-        GetSequenceIndexFromFastElementsKind(TERMINAL_FAST_ELEMENTS_KIND);
-    for (int i = 0; i <= last_index; ++i) {
-      Label next;
-      ElementsKind candidate_kind = GetFastElementsKindFromSequenceIndex(i);
-      __ CompareAndBranch(kind, candidate_kind, ne, &next);
-      ArraySingleArgumentConstructorStub stub(masm->isolate(), candidate_kind);
-      __ TailCallStub(&stub);
-      __ Bind(&next);
-    }
-
-    // If we reached this point there is a problem.
-    __ Abort(AbortReason::kUnexpectedElementsKindInArrayConstructor);
-  } else {
-    UNREACHABLE();
-  }
-}
-
-
-template<class T>
-static void ArrayConstructorStubAheadOfTimeHelper(Isolate* isolate) {
-  int to_index =
-      GetSequenceIndexFromFastElementsKind(TERMINAL_FAST_ELEMENTS_KIND);
-  for (int i = 0; i <= to_index; ++i) {
-    ElementsKind kind = GetFastElementsKindFromSequenceIndex(i);
-    T stub(isolate, kind);
-    stub.GetCode();
-    if (AllocationSite::ShouldTrack(kind)) {
-      T stub1(isolate, kind, DISABLE_ALLOCATION_SITES);
-      stub1.GetCode();
-    }
-  }
-}
-
-void CommonArrayConstructorStub::GenerateStubsAheadOfTime(Isolate* isolate) {
-  ArrayConstructorStubAheadOfTimeHelper<ArrayNoArgumentConstructorStub>(
-      isolate);
-  ArrayConstructorStubAheadOfTimeHelper<ArraySingleArgumentConstructorStub>(
-      isolate);
-  ArrayNArgumentsConstructorStub stub(isolate);
-  stub.GetCode();
-  ElementsKind kinds[2] = {PACKED_ELEMENTS, HOLEY_ELEMENTS};
-  for (int i = 0; i < 2; i++) {
-    // For internal arrays we only need a few things
-    InternalArrayNoArgumentConstructorStub stubh1(isolate, kinds[i]);
-    stubh1.GetCode();
-    InternalArraySingleArgumentConstructorStub stubh2(isolate, kinds[i]);
-    stubh2.GetCode();
-  }
-}
-
-
-void ArrayConstructorStub::GenerateDispatchToArrayStub(
-    MacroAssembler* masm,
-    AllocationSiteOverrideMode mode) {
-  Register argc = x0;
-  Label zero_case, n_case;
-  __ Cbz(argc, &zero_case);
-  __ Cmp(argc, 1);
-  __ B(ne, &n_case);
-
-  // One argument.
-  CreateArrayDispatchOneArgument(masm, mode);
-
-  __ Bind(&zero_case);
-  // No arguments.
-  CreateArrayDispatch<ArrayNoArgumentConstructorStub>(masm, mode);
-
-  __ Bind(&n_case);
-  // N arguments.
-  ArrayNArgumentsConstructorStub stub(masm->isolate());
-  __ TailCallStub(&stub);
-}
-
-
-void ArrayConstructorStub::Generate(MacroAssembler* masm) {
-  ASM_LOCATION("ArrayConstructorStub::Generate");
-  // ----------- S t a t e -------------
-  //  -- x0 : argc (only if argument_count() is ANY or MORE_THAN_ONE)
-  //  -- x1 : constructor
-  //  -- x2 : AllocationSite or undefined
-  //  -- x3 : new target
-  //  -- sp[0] : last argument
-  // -----------------------------------
-  Register constructor = x1;
-  Register allocation_site = x2;
-  Register new_target = x3;
-
-  if (FLAG_debug_code) {
-    // The array construct code is only set for the global and natives
-    // builtin Array functions which always have maps.
-
-    Label unexpected_map, map_ok;
-    // Initial map for the builtin Array function should be a map.
-    __ Ldr(x10, FieldMemOperand(constructor,
-                                JSFunction::kPrototypeOrInitialMapOffset));
-    // Will both indicate a nullptr and a Smi.
-    __ JumpIfSmi(x10, &unexpected_map);
-    __ JumpIfObjectType(x10, x10, x11, MAP_TYPE, &map_ok);
-    __ Bind(&unexpected_map);
-    __ Abort(AbortReason::kUnexpectedInitialMapForArrayFunction);
-    __ Bind(&map_ok);
-
-    // We should either have undefined in the allocation_site register or a
-    // valid AllocationSite.
-    __ AssertUndefinedOrAllocationSite(allocation_site);
-  }
-
-  // Enter the context of the Array function.
-  __ Ldr(cp, FieldMemOperand(x1, JSFunction::kContextOffset));
-
-  Label subclassing;
-  __ Cmp(new_target, constructor);
-  __ B(ne, &subclassing);
-
-  Register kind = x3;
-  Label no_info;
-  // Get the elements kind and case on that.
-  __ JumpIfRoot(allocation_site, Heap::kUndefinedValueRootIndex, &no_info);
-
-  __ Ldrsw(kind, UntagSmiFieldMemOperand(
-                     allocation_site,
-                     AllocationSite::kTransitionInfoOrBoilerplateOffset));
-  __ And(kind, kind, AllocationSite::ElementsKindBits::kMask);
-  GenerateDispatchToArrayStub(masm, DONT_OVERRIDE);
-
-  __ Bind(&no_info);
-  GenerateDispatchToArrayStub(masm, DISABLE_ALLOCATION_SITES);
-
-  // Subclassing support.
-  __ Bind(&subclassing);
-  __ Poke(constructor, Operand(x0, LSL, kPointerSizeLog2));
-  __ Add(x0, x0, Operand(3));
-  __ Push(new_target, allocation_site);
-  __ JumpToExternalReference(ExternalReference(Runtime::kNewArray, isolate()));
-}
-
-
-void InternalArrayConstructorStub::GenerateCase(
-    MacroAssembler* masm, ElementsKind kind) {
-  Label zero_case, n_case;
-  Register argc = x0;
-
-  __ Cbz(argc, &zero_case);
-  __ CompareAndBranch(argc, 1, ne, &n_case);
-
-  // One argument.
-  if (IsFastPackedElementsKind(kind)) {
-    Label packed_case;
-
-    // We might need to create a holey array; look at the first argument.
-    __ Peek(x10, 0);
-    __ Cbz(x10, &packed_case);
-
-    InternalArraySingleArgumentConstructorStub
-        stub1_holey(isolate(), GetHoleyElementsKind(kind));
-    __ TailCallStub(&stub1_holey);
-
-    __ Bind(&packed_case);
-  }
-  InternalArraySingleArgumentConstructorStub stub1(isolate(), kind);
-  __ TailCallStub(&stub1);
-
-  __ Bind(&zero_case);
-  // No arguments.
-  InternalArrayNoArgumentConstructorStub stub0(isolate(), kind);
-  __ TailCallStub(&stub0);
-
-  __ Bind(&n_case);
-  // N arguments.
-  ArrayNArgumentsConstructorStub stubN(isolate());
-  __ TailCallStub(&stubN);
-}
-
-
-void InternalArrayConstructorStub::Generate(MacroAssembler* masm) {
-  // ----------- S t a t e -------------
-  //  -- x0 : argc
-  //  -- x1 : constructor
-  //  -- sp[0] : return address
-  //  -- sp[4] : last argument
-  // -----------------------------------
-
-  Register constructor = x1;
-
-  if (FLAG_debug_code) {
-    // The array construct code is only set for the global and natives
-    // builtin Array functions which always have maps.
-
-    Label unexpected_map, map_ok;
-    // Initial map for the builtin Array function should be a map.
-    __ Ldr(x10, FieldMemOperand(constructor,
-                                JSFunction::kPrototypeOrInitialMapOffset));
-    // Will both indicate a nullptr and a Smi.
-    __ JumpIfSmi(x10, &unexpected_map);
-    __ JumpIfObjectType(x10, x10, x11, MAP_TYPE, &map_ok);
-    __ Bind(&unexpected_map);
-    __ Abort(AbortReason::kUnexpectedInitialMapForArrayFunction);
-    __ Bind(&map_ok);
-  }
-
-  Register kind = w3;
-  // Figure out the right elements kind
-  __ Ldr(x10, FieldMemOperand(constructor,
-                              JSFunction::kPrototypeOrInitialMapOffset));
-
-  // Retrieve elements_kind from map.
-  __ LoadElementsKindFromMap(kind, x10);
-
-  if (FLAG_debug_code) {
-    Label done;
-    __ Cmp(x3, PACKED_ELEMENTS);
-    __ Ccmp(x3, HOLEY_ELEMENTS, ZFlag, ne);
-    __ Assert(
-        eq,
-        AbortReason::kInvalidElementsKindForInternalArrayOrInternalPackedArray);
-  }
-
-  Label fast_elements_case;
-  __ CompareAndBranch(kind, PACKED_ELEMENTS, eq, &fast_elements_case);
-  GenerateCase(masm, HOLEY_ELEMENTS);
-
-  __ Bind(&fast_elements_case);
-  GenerateCase(masm, PACKED_ELEMENTS);
+  __ Mov(x10, target);
+  __ Call(GetCode(), RelocInfo::CODE_TARGET);
 }
 
 // The number of register that CallApiFunctionAndReturn will need to save on
@@ -1131,8 +381,7 @@ static void CallApiFunctionAndReturn(MacroAssembler* masm,
     FrameScope frame(masm, StackFrame::MANUAL);
     __ PushSafepointRegisters();
     __ Mov(x0, ExternalReference::isolate_address(isolate));
-    __ CallCFunction(ExternalReference::log_enter_external_function(isolate),
-                     1);
+    __ CallCFunction(ExternalReference::log_enter_external_function(), 1);
     __ PopSafepointRegisters();
   }
 
@@ -1146,8 +395,7 @@ static void CallApiFunctionAndReturn(MacroAssembler* masm,
     FrameScope frame(masm, StackFrame::MANUAL);
     __ PushSafepointRegisters();
     __ Mov(x0, ExternalReference::isolate_address(isolate));
-    __ CallCFunction(ExternalReference::log_leave_external_function(isolate),
-                     1);
+    __ CallCFunction(ExternalReference::log_leave_external_function(), 1);
     __ PopSafepointRegisters();
   }
 
@@ -1203,8 +451,7 @@ static void CallApiFunctionAndReturn(MacroAssembler* masm,
   Register saved_result = x19;
   __ Mov(saved_result, x0);
   __ Mov(x0, ExternalReference::isolate_address(isolate));
-  __ CallCFunction(ExternalReference::delete_handle_scope_extensions(isolate),
-                   1);
+  __ CallCFunction(ExternalReference::delete_handle_scope_extensions(), 1);
   __ Mov(x0, saved_result);
   __ B(&leave_exit_frame);
 }
@@ -1275,8 +522,7 @@ void CallApiCallbackStub::Generate(MacroAssembler* masm) {
   __ Mov(x10, argc());
   __ Str(x10, MemOperand(x0, 2 * kPointerSize));
 
-  ExternalReference thunk_ref =
-      ExternalReference::invoke_function_callback(masm->isolate());
+  ExternalReference thunk_ref = ExternalReference::invoke_function_callback();
 
   AllowExternalCallThatCantCauseGC scope(masm);
   // Stores return the first js argument
@@ -1317,8 +563,7 @@ void CallApiGetterStub::Generate(MacroAssembler* masm) {
 
   __ Ldr(data, FieldMemOperand(callback, AccessorInfo::kDataOffset));
   __ LoadRoot(undef, Heap::kUndefinedValueRootIndex);
-  __ Mov(isolate_address,
-         Operand(ExternalReference::isolate_address(isolate())));
+  __ Mov(isolate_address, ExternalReference::isolate_address(isolate()));
   __ Ldr(name, FieldMemOperand(callback, AccessorInfo::kNameOffset));
 
   // PropertyCallbackArguments:
@@ -1354,7 +599,7 @@ void CallApiGetterStub::Generate(MacroAssembler* masm) {
   // x1 = v8::PropertyCallbackInfo&
 
   ExternalReference thunk_ref =
-      ExternalReference::invoke_accessor_getter_callback(isolate());
+      ExternalReference::invoke_accessor_getter_callback();
 
   Register api_function_address = x2;
   Register js_getter = x4;
diff --git a/deps/v8/src/arm64/constants-arm64.h b/deps/v8/src/arm64/constants-arm64.h
index 406b139a5040c6..1b87ce572c6f38 100644
--- a/deps/v8/src/arm64/constants-arm64.h
+++ b/deps/v8/src/arm64/constants-arm64.h
@@ -26,6 +26,7 @@ STATIC_ASSERT(sizeof(1L) == sizeof(int64_t));
 namespace v8 {
 namespace internal {
 
+constexpr size_t kMaxPCRelativeCodeRangeInMB = 128;
 
 const unsigned kInstructionSize = 4;
 const unsigned kInstructionSizeLog2 = 2;
@@ -140,6 +141,11 @@ const unsigned kFloat16MantissaBits = 10;
 const unsigned kFloat16ExponentBits = 5;
 const unsigned kFloat16ExponentBias = 15;
 
+// Actual value of root register is offset from the root array's start
+// to take advantage of negative displacement values.
+// TODO(sigurds): Choose best value.
+constexpr int kRootRegisterBias = 256;
+
 typedef uint16_t float16;
 
 #define INSTRUCTION_FIELDS_LIST(V_)                     \
diff --git a/deps/v8/src/arm64/deoptimizer-arm64.cc b/deps/v8/src/arm64/deoptimizer-arm64.cc
index a81621b6a9a2f1..b2f534ac457e29 100644
--- a/deps/v8/src/arm64/deoptimizer-arm64.cc
+++ b/deps/v8/src/arm64/deoptimizer-arm64.cc
@@ -115,8 +115,8 @@ void Deoptimizer::TableEntryGenerator::Generate() {
   DCHECK_EQ(saved_registers.Count() % 2, 0);
   __ PushCPURegList(saved_registers);
 
-  __ Mov(x3, Operand(ExternalReference(IsolateAddressId::kCEntryFPAddress,
-                                       isolate())));
+  __ Mov(x3, Operand(ExternalReference::Create(
+                 IsolateAddressId::kCEntryFPAddress, isolate())));
   __ Str(fp, MemOperand(x3));
 
   const int kSavedRegistersAreaSize =
@@ -155,7 +155,7 @@ void Deoptimizer::TableEntryGenerator::Generate() {
   __ Tst(x1, kSmiTagMask);
   __ CzeroX(x0, eq);
 
-  __ Mov(x1, type());
+  __ Mov(x1, static_cast<int>(deopt_kind()));
   // Following arguments are already loaded:
   //  - x2: bailout id
   //  - x3: code object address
@@ -165,7 +165,7 @@ void Deoptimizer::TableEntryGenerator::Generate() {
   {
     // Call Deoptimizer::New().
     AllowExternalCallThatCantCauseGC scope(masm());
-    __ CallCFunction(ExternalReference::new_deoptimizer_function(isolate()), 6);
+    __ CallCFunction(ExternalReference::new_deoptimizer_function(), 6);
   }
 
   // Preserve "deoptimizer" object in register x0.
@@ -212,8 +212,7 @@ void Deoptimizer::TableEntryGenerator::Generate() {
   {
     // Call Deoptimizer::ComputeOutputFrames().
     AllowExternalCallThatCantCauseGC scope(masm());
-    __ CallCFunction(
-        ExternalReference::compute_output_frames_function(isolate()), 1);
+    __ CallCFunction(ExternalReference::compute_output_frames_function(), 1);
   }
   __ Pop(x4, padreg);  // Restore deoptimizer object (class Deoptimizer).
 
@@ -276,50 +275,18 @@ void Deoptimizer::TableEntryGenerator::Generate() {
   __ Br(continuation);
 }
 
-// Size of an entry of the second level deopt table.
-// This is the code size generated by GeneratePrologue for one entry.
-const int Deoptimizer::table_entry_size_ = kInstructionSize;
+// Size of an entry of the second level deopt table. Since we do not generate
+// a table for ARM64, the size is zero.
+const int Deoptimizer::table_entry_size_ = 0 * kInstructionSize;
 
 void Deoptimizer::TableEntryGenerator::GeneratePrologue() {
   UseScratchRegisterScope temps(masm());
-  // The address at which the deopt table is entered should be in x16, the first
-  // temp register allocated. We can't assert that the address is in there, but
-  // we can check that it's the first allocated temp. Later, we'll also check
-  // the computed entry_id is in the expected range.
-  Register entry_addr = temps.AcquireX();
+  // The MacroAssembler will have put the deoptimization id in x16, the first
+  // temp register allocated. We can't assert that the id is in there, but we
+  // can check that x16 the first allocated temp and that the value it contains
+  // is in the expected range.
   Register entry_id = temps.AcquireX();
-  DCHECK(entry_addr.Is(x16));
-  DCHECK(entry_id.Is(x17));
-
-  // Create a sequence of deoptimization entries.
-  // Note that registers are still live when jumping to an entry.
-  {
-    InstructionAccurateScope scope(masm());
-
-    Label start_of_table, end_of_table;
-    __ bind(&start_of_table);
-    for (int i = 0; i < count(); i++) {
-      int start = masm()->pc_offset();
-      USE(start);
-      __ b(&end_of_table);
-      DCHECK(masm()->pc_offset() - start == table_entry_size_);
-    }
-    __ bind(&end_of_table);
-
-    // Get the address of the start of the table.
-    DCHECK(is_int21(table_entry_size_ * count()));
-    __ adr(entry_id, &start_of_table);
-
-    // Compute the gap in bytes between the entry address, which should have
-    // been left in entry_addr (x16) by CallForDeoptimization, and the start of
-    // the table.
-    __ sub(entry_id, entry_addr, entry_id);
-
-    // Shift down to obtain the entry_id.
-    DCHECK_EQ(table_entry_size_, kInstructionSize);
-    __ lsr(entry_id, entry_id, kInstructionSizeLog2);
-  }
-
+  DCHECK(entry_id.Is(x16));
   __ Push(padreg, entry_id);
 
   if (__ emit_debug_code()) {
diff --git a/deps/v8/src/arm64/frame-constants-arm64.h b/deps/v8/src/arm64/frame-constants-arm64.h
index 662f4260339a45..96fc72f126b8ad 100644
--- a/deps/v8/src/arm64/frame-constants-arm64.h
+++ b/deps/v8/src/arm64/frame-constants-arm64.h
@@ -5,6 +5,10 @@
 #ifndef V8_ARM64_FRAME_CONSTANTS_ARM64_H_
 #define V8_ARM64_FRAME_CONSTANTS_ARM64_H_
 
+#include "src/base/macros.h"
+#include "src/frame-constants.h"
+#include "src/globals.h"
+
 namespace v8 {
 namespace internal {
 
@@ -46,6 +50,20 @@ class ExitFrameConstants : public TypedFrameConstants {
   static constexpr int kConstantPoolOffset = 0;  // Not used
 };
 
+class WasmCompileLazyFrameConstants : public TypedFrameConstants {
+ public:
+  static constexpr int kNumberOfSavedGpParamRegs = 8;
+  static constexpr int kNumberOfSavedFpParamRegs = 8;
+
+  // FP-relative.
+  static constexpr int kWasmInstanceOffset = TYPED_FRAME_PUSHED_VALUE_OFFSET(1);
+  static constexpr int kFixedFrameSizeFromFp =
+      // Header is padded to 16 byte (see {MacroAssembler::EnterFrame}).
+      RoundUp<16>(TypedFrameConstants::kFixedFrameSizeFromFp) +
+      kNumberOfSavedGpParamRegs * kPointerSize +
+      kNumberOfSavedFpParamRegs * kDoubleSize;
+};
+
 class JavaScriptFrameConstants : public AllStatic {
  public:
   // FP-relative.
diff --git a/deps/v8/src/arm64/instructions-arm64.cc b/deps/v8/src/arm64/instructions-arm64.cc
index 272948a819597f..4a105945902308 100644
--- a/deps/v8/src/arm64/instructions-arm64.cc
+++ b/deps/v8/src/arm64/instructions-arm64.cc
@@ -227,21 +227,21 @@ bool Instruction::IsTargetInImmPCOffsetRange(Instruction* target) {
   return IsValidImmPCOffset(BranchType(), DistanceTo(target));
 }
 
-void Instruction::SetImmPCOffsetTarget(Assembler::IsolateData isolate_data,
+void Instruction::SetImmPCOffsetTarget(const AssemblerOptions& options,
                                        Instruction* target) {
   if (IsPCRelAddressing()) {
-    SetPCRelImmTarget(isolate_data, target);
+    SetPCRelImmTarget(options, target);
   } else if (BranchType() != UnknownBranchType) {
     SetBranchImmTarget(target);
   } else if (IsUnresolvedInternalReference()) {
-    SetUnresolvedInternalReferenceImmTarget(isolate_data, target);
+    SetUnresolvedInternalReferenceImmTarget(options, target);
   } else {
     // Load literal (offset from PC).
     SetImmLLiteral(target);
   }
 }
 
-void Instruction::SetPCRelImmTarget(Assembler::IsolateData isolate_data,
+void Instruction::SetPCRelImmTarget(const AssemblerOptions& options,
                                     Instruction* target) {
   // ADRP is not supported, so 'this' must point to an ADR instruction.
   DCHECK(IsAdr());
@@ -252,7 +252,7 @@ void Instruction::SetPCRelImmTarget(Assembler::IsolateData isolate_data,
     imm = Assembler::ImmPCRelAddress(static_cast<int>(target_offset));
     SetInstructionBits(Mask(~ImmPCRel_mask) | imm);
   } else {
-    PatchingAssembler patcher(isolate_data, reinterpret_cast<byte*>(this),
+    PatchingAssembler patcher(options, reinterpret_cast<byte*>(this),
                               PatchingAssembler::kAdrFarPatchableNInstrs);
     patcher.PatchAdrFar(target_offset);
   }
@@ -293,7 +293,7 @@ void Instruction::SetBranchImmTarget(Instruction* target) {
 }
 
 void Instruction::SetUnresolvedInternalReferenceImmTarget(
-    Assembler::IsolateData isolate_data, Instruction* target) {
+    const AssemblerOptions& options, Instruction* target) {
   DCHECK(IsUnresolvedInternalReference());
   DCHECK(IsAligned(DistanceTo(target), kInstructionSize));
   DCHECK(is_int32(DistanceTo(target) >> kInstructionSizeLog2));
@@ -302,7 +302,7 @@ void Instruction::SetUnresolvedInternalReferenceImmTarget(
   uint32_t high16 = unsigned_bitextract_32(31, 16, target_offset);
   uint32_t low16 = unsigned_bitextract_32(15, 0, target_offset);
 
-  PatchingAssembler patcher(isolate_data, reinterpret_cast<byte*>(this), 2);
+  PatchingAssembler patcher(options, reinterpret_cast<byte*>(this), 2);
   patcher.brk(high16);
   patcher.brk(low16);
 }
diff --git a/deps/v8/src/arm64/instructions-arm64.h b/deps/v8/src/arm64/instructions-arm64.h
index 499023ebb2b7b8..bb1791becb5f3f 100644
--- a/deps/v8/src/arm64/instructions-arm64.h
+++ b/deps/v8/src/arm64/instructions-arm64.h
@@ -354,6 +354,12 @@ class Instruction {
     return (high16 << 16) | low16;
   }
 
+  bool IsUnconditionalBranch() const {
+    return Mask(UnconditionalBranchMask) == B;
+  }
+
+  bool IsBranchAndLink() const { return Mask(UnconditionalBranchMask) == BL; }
+
   bool IsBranchAndLinkToRegister() const {
     return Mask(UnconditionalBranchToRegisterMask) == BLR;
   }
@@ -396,9 +402,9 @@ class Instruction {
   bool IsTargetInImmPCOffsetRange(Instruction* target);
   // Patch a PC-relative offset to refer to 'target'. 'this' may be a branch or
   // a PC-relative addressing instruction.
-  void SetImmPCOffsetTarget(AssemblerBase::IsolateData isolate_data,
+  void SetImmPCOffsetTarget(const AssemblerOptions& options,
                             Instruction* target);
-  void SetUnresolvedInternalReferenceImmTarget(AssemblerBase::IsolateData,
+  void SetUnresolvedInternalReferenceImmTarget(const AssemblerOptions& options,
                                                Instruction* target);
   // Patch a literal load instruction to load from 'source'.
   void SetImmLLiteral(Instruction* source);
@@ -435,8 +441,7 @@ class Instruction {
 
   static const int ImmPCRelRangeBitwidth = 21;
   static bool IsValidPCRelOffset(ptrdiff_t offset) { return is_int21(offset); }
-  void SetPCRelImmTarget(AssemblerBase::IsolateData isolate_data,
-                         Instruction* target);
+  void SetPCRelImmTarget(const AssemblerOptions& options, Instruction* target);
   void SetBranchImmTarget(Instruction* target);
 };
 
diff --git a/deps/v8/src/arm64/instrument-arm64.cc b/deps/v8/src/arm64/instrument-arm64.cc
index f9550782c132bd..10d8ee4bc72456 100644
--- a/deps/v8/src/arm64/instrument-arm64.cc
+++ b/deps/v8/src/arm64/instrument-arm64.cc
@@ -69,6 +69,7 @@ static const CounterDescriptor kCounterList[] = {
     {"Logical DP", Gauge},
     {"Other Int DP", Gauge},
     {"FP DP", Gauge},
+    {"NEON", Gauge},
 
     {"Conditional Select", Gauge},
     {"Conditional Compare", Gauge},
diff --git a/deps/v8/src/arm64/interface-descriptors-arm64.cc b/deps/v8/src/arm64/interface-descriptors-arm64.cc
index bcbe5d97dce3f5..357161d57fa771 100644
--- a/deps/v8/src/arm64/interface-descriptors-arm64.cc
+++ b/deps/v8/src/arm64/interface-descriptors-arm64.cc
@@ -2,8 +2,6 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#include "src/arm64/interface-descriptors-arm64.h"
-
 #if V8_TARGET_ARCH_ARM64
 
 #include "src/interface-descriptors.h"
@@ -34,7 +32,7 @@ void RecordWriteDescriptor::InitializePlatformSpecific(
   data->InitializePlatformSpecific(kParameterCount, default_stub_registers);
 }
 
-const Register FastNewFunctionContextDescriptor::FunctionRegister() {
+const Register FastNewFunctionContextDescriptor::ScopeInfoRegister() {
   return x1;
 }
 const Register FastNewFunctionContextDescriptor::SlotsRegister() { return x0; }
@@ -59,12 +57,6 @@ const Register StoreTransitionDescriptor::MapRegister() { return x5; }
 const Register ApiGetterDescriptor::HolderRegister() { return x0; }
 const Register ApiGetterDescriptor::CallbackRegister() { return x3; }
 
-const Register MathPowTaggedDescriptor::exponent() { return x11; }
-
-
-const Register MathPowIntegerDescriptor::exponent() { return x12; }
-
-
 const Register GrowArrayElementsDescriptor::ObjectRegister() { return x0; }
 const Register GrowArrayElementsDescriptor::KeyRegister() { return x3; }
 
@@ -179,26 +171,7 @@ void ConstructStubDescriptor::InitializePlatformSpecific(
   data->InitializePlatformSpecific(arraysize(registers), registers);
 }
 
-
-void ConstructTrampolineDescriptor::InitializePlatformSpecific(
-    CallInterfaceDescriptorData* data) {
-  // x3: new target
-  // x1: target
-  // x0: number of arguments
-  Register registers[] = {x1, x3, x0};
-  data->InitializePlatformSpecific(arraysize(registers), registers);
-}
-
-
-void TransitionElementsKindDescriptor::InitializePlatformSpecific(
-    CallInterfaceDescriptorData* data) {
-  // x0: value (js_array)
-  // x1: to_map
-  Register registers[] = {x0, x1};
-  data->InitializePlatformSpecific(arraysize(registers), registers);
-}
-
-void AbortJSDescriptor::InitializePlatformSpecific(
+void AbortDescriptor::InitializePlatformSpecific(
     CallInterfaceDescriptorData* data) {
   Register registers[] = {x1};
   data->InitializePlatformSpecific(arraysize(registers), registers);
@@ -206,41 +179,7 @@ void AbortJSDescriptor::InitializePlatformSpecific(
 
 void AllocateHeapNumberDescriptor::InitializePlatformSpecific(
     CallInterfaceDescriptorData* data) {
-  data->InitializePlatformSpecific(0, nullptr, nullptr);
-}
-
-void ArrayConstructorDescriptor::InitializePlatformSpecific(
-    CallInterfaceDescriptorData* data) {
-  // kTarget, kNewTarget, kActualArgumentsCount, kAllocationSite
-  Register registers[] = {x1, x3, x0, x2};
-  data->InitializePlatformSpecific(arraysize(registers), registers, nullptr);
-}
-
-void ArrayNoArgumentConstructorDescriptor::InitializePlatformSpecific(
-    CallInterfaceDescriptorData* data) {
-  // register state
-  // x1: function
-  // x2: allocation site with elements kind
-  // x0: number of arguments to the constructor function
-  Register registers[] = {x1, x2, x0};
-  data->InitializePlatformSpecific(arraysize(registers), registers, nullptr);
-}
-
-void ArraySingleArgumentConstructorDescriptor::InitializePlatformSpecific(
-    CallInterfaceDescriptorData* data) {
-  // register state
-  // x0: number of arguments
-  // x1: function
-  // x2: allocation site with elements kind
-  Register registers[] = {x1, x2, x0};
-  data->InitializePlatformSpecific(arraysize(registers), registers, nullptr);
-}
-
-void ArrayNArgumentsConstructorDescriptor::InitializePlatformSpecific(
-    CallInterfaceDescriptorData* data) {
-  // stack param count needs (constructor pointer, and single argument)
-  Register registers[] = {x1, x2, x0};
-  data->InitializePlatformSpecific(arraysize(registers), registers);
+  data->InitializePlatformSpecific(0, nullptr);
 }
 
 void CompareDescriptor::InitializePlatformSpecific(
@@ -251,7 +190,6 @@ void CompareDescriptor::InitializePlatformSpecific(
   data->InitializePlatformSpecific(arraysize(registers), registers);
 }
 
-
 void BinaryOpDescriptor::InitializePlatformSpecific(
     CallInterfaceDescriptorData* data) {
   // x1: left operand
@@ -260,42 +198,26 @@ void BinaryOpDescriptor::InitializePlatformSpecific(
   data->InitializePlatformSpecific(arraysize(registers), registers);
 }
 
-void StringAddDescriptor::InitializePlatformSpecific(
-    CallInterfaceDescriptorData* data) {
-  // x1: left operand
-  // x0: right operand
-  Register registers[] = {x1, x0};
-  data->InitializePlatformSpecific(arraysize(registers), registers);
-}
-
 void ArgumentAdaptorDescriptor::InitializePlatformSpecific(
     CallInterfaceDescriptorData* data) {
-  static PlatformInterfaceDescriptor default_descriptor =
-      PlatformInterfaceDescriptor(CAN_INLINE_TARGET_ADDRESS);
-
   Register registers[] = {
       x1,  // JSFunction
       x3,  // the new target
       x0,  // actual number of arguments
       x2,  // expected number of arguments
   };
-  data->InitializePlatformSpecific(arraysize(registers), registers,
-                                   &default_descriptor);
+  data->InitializePlatformSpecific(arraysize(registers), registers);
 }
 
 void ApiCallbackDescriptor::InitializePlatformSpecific(
     CallInterfaceDescriptorData* data) {
-  static PlatformInterfaceDescriptor default_descriptor =
-      PlatformInterfaceDescriptor(CAN_INLINE_TARGET_ADDRESS);
-
   Register registers[] = {
       JavaScriptFrame::context_register(),  // callee context
       x4,                                   // call_data
       x2,                                   // holder
       x1,                                   // api_function_address
   };
-  data->InitializePlatformSpecific(arraysize(registers), registers,
-                                   &default_descriptor);
+  data->InitializePlatformSpecific(arraysize(registers), registers);
 }
 
 void InterpreterDispatchDescriptor::InitializePlatformSpecific(
@@ -328,7 +250,9 @@ void InterpreterPushArgsThenConstructDescriptor::InitializePlatformSpecific(
   data->InitializePlatformSpecific(arraysize(registers), registers);
 }
 
-void InterpreterCEntryDescriptor::InitializePlatformSpecific(
+namespace {
+
+void InterpreterCEntryDescriptor_InitializePlatformSpecific(
     CallInterfaceDescriptorData* data) {
   Register registers[] = {
       x0,   // argument count (argc)
@@ -338,6 +262,18 @@ void InterpreterCEntryDescriptor::InitializePlatformSpecific(
   data->InitializePlatformSpecific(arraysize(registers), registers);
 }
 
+}  // namespace
+
+void InterpreterCEntry1Descriptor::InitializePlatformSpecific(
+    CallInterfaceDescriptorData* data) {
+  InterpreterCEntryDescriptor_InitializePlatformSpecific(data);
+}
+
+void InterpreterCEntry2Descriptor::InitializePlatformSpecific(
+    CallInterfaceDescriptorData* data) {
+  InterpreterCEntryDescriptor_InitializePlatformSpecific(data);
+}
+
 void ResumeGeneratorDescriptor::InitializePlatformSpecific(
     CallInterfaceDescriptorData* data) {
   Register registers[] = {
diff --git a/deps/v8/src/arm64/interface-descriptors-arm64.h b/deps/v8/src/arm64/interface-descriptors-arm64.h
deleted file mode 100644
index 20ab8cb61243bc..00000000000000
--- a/deps/v8/src/arm64/interface-descriptors-arm64.h
+++ /dev/null
@@ -1,26 +0,0 @@
-// Copyright 2012 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef V8_ARM64_INTERFACE_DESCRIPTORS_ARM64_H_
-#define V8_ARM64_INTERFACE_DESCRIPTORS_ARM64_H_
-
-#include "src/interface-descriptors.h"
-
-namespace v8 {
-namespace internal {
-
-class PlatformInterfaceDescriptor {
- public:
-  explicit PlatformInterfaceDescriptor(TargetAddressStorageMode storage_mode)
-      : storage_mode_(storage_mode) {}
-
-  TargetAddressStorageMode storage_mode() { return storage_mode_; }
-
- private:
-  TargetAddressStorageMode storage_mode_;
-};
-}  // namespace internal
-}  // namespace v8
-
-#endif  // V8_ARM64_INTERFACE_DESCRIPTORS_ARM64_H_
diff --git a/deps/v8/src/arm64/macro-assembler-arm64-inl.h b/deps/v8/src/arm64/macro-assembler-arm64-inl.h
index f96d4b20b8278a..b583d7ba14b384 100644
--- a/deps/v8/src/arm64/macro-assembler-arm64-inl.h
+++ b/deps/v8/src/arm64/macro-assembler-arm64-inl.h
@@ -24,17 +24,6 @@ MemOperand FieldMemOperand(Register object, int offset) {
 }
 
 
-MemOperand UntagSmiFieldMemOperand(Register object, int offset) {
-  return UntagSmiMemOperand(object, offset - kHeapObjectTag);
-}
-
-
-MemOperand UntagSmiMemOperand(Register object, int offset) {
-  // Assumes that Smis are shifted by 32 bits and little endianness.
-  STATIC_ASSERT(kSmiShift == 32);
-  return MemOperand(object, offset + (kSmiShift / kBitsPerByte));
-}
-
 void TurboAssembler::And(const Register& rd, const Register& rn,
                          const Operand& operand) {
   DCHECK(allow_macro_instructions());
@@ -297,6 +286,7 @@ void TurboAssembler::Asr(const Register& rd, const Register& rn,
 }
 
 void TurboAssembler::B(Label* label) {
+  DCHECK(allow_macro_instructions());
   b(label);
   CheckVeneerPool(false, false);
 }
@@ -1039,47 +1029,51 @@ void TurboAssembler::Uxtw(const Register& rd, const Register& rn) {
 void TurboAssembler::InitializeRootRegister() {
   ExternalReference roots_array_start =
       ExternalReference::roots_array_start(isolate());
-  Mov(root, Operand(roots_array_start));
+  Mov(kRootRegister, Operand(roots_array_start));
+  Add(kRootRegister, kRootRegister, kRootRegisterBias);
 }
 
 
 void MacroAssembler::SmiTag(Register dst, Register src) {
-  STATIC_ASSERT(kXRegSizeInBits ==
-                static_cast<unsigned>(kSmiShift + kSmiValueSize));
   DCHECK(dst.Is64Bits() && src.Is64Bits());
+  DCHECK(SmiValuesAre32Bits() || SmiValuesAre31Bits());
   Lsl(dst, src, kSmiShift);
 }
 
-
 void MacroAssembler::SmiTag(Register smi) { SmiTag(smi, smi); }
 
 void TurboAssembler::SmiUntag(Register dst, Register src) {
-  STATIC_ASSERT(kXRegSizeInBits ==
-                static_cast<unsigned>(kSmiShift + kSmiValueSize));
   DCHECK(dst.Is64Bits() && src.Is64Bits());
   if (FLAG_enable_slow_asserts) {
     AssertSmi(src);
   }
+  DCHECK(SmiValuesAre32Bits() || SmiValuesAre31Bits());
   Asr(dst, src, kSmiShift);
 }
 
-void TurboAssembler::SmiUntag(Register smi) { SmiUntag(smi, smi); }
+void TurboAssembler::SmiUntag(Register dst, const MemOperand& src) {
+  DCHECK(dst.Is64Bits());
+  if (SmiValuesAre32Bits()) {
+    if (src.IsImmediateOffset() && src.shift_amount() == 0) {
+      // Load value directly from the upper half-word.
+      // Assumes that Smis are shifted by 32 bits and little endianness.
+      DCHECK_EQ(kSmiShift, 32);
+      Ldrsw(dst,
+            MemOperand(src.base(), src.offset() + (kSmiShift / kBitsPerByte),
+                       src.addrmode()));
 
-void MacroAssembler::SmiUntagToDouble(VRegister dst, Register src) {
-  DCHECK(dst.Is64Bits() && src.Is64Bits());
-  if (FLAG_enable_slow_asserts) {
-    AssertSmi(src);
+    } else {
+      Ldr(dst, src);
+      SmiUntag(dst);
+    }
+  } else {
+    DCHECK(SmiValuesAre31Bits());
+    Ldr(dst, src);
+    SmiUntag(dst);
   }
-  Scvtf(dst, src, kSmiShift);
 }
 
-void MacroAssembler::SmiUntagToFloat(VRegister dst, Register src) {
-  DCHECK(dst.Is32Bits() && src.Is64Bits());
-  if (FLAG_enable_slow_asserts) {
-    AssertSmi(src);
-  }
-  Scvtf(dst, src, kSmiShift);
-}
+void TurboAssembler::SmiUntag(Register smi) { SmiUntag(smi, smi); }
 
 void TurboAssembler::JumpIfSmi(Register value, Label* smi_label,
                                Label* not_smi_label) {
@@ -1096,6 +1090,15 @@ void TurboAssembler::JumpIfSmi(Register value, Label* smi_label,
   }
 }
 
+void TurboAssembler::JumpIfEqual(Register x, int32_t y, Label* dest) {
+  Cmp(x, y);
+  B(eq, dest);
+}
+
+void TurboAssembler::JumpIfLessThan(Register x, int32_t y, Label* dest) {
+  Cmp(x, y);
+  B(lt, dest);
+}
 
 void MacroAssembler::JumpIfNotSmi(Register value, Label* not_smi_label) {
   JumpIfSmi(value, nullptr, not_smi_label);
diff --git a/deps/v8/src/arm64/macro-assembler-arm64.cc b/deps/v8/src/arm64/macro-assembler-arm64.cc
index 5bbf71e28cf030..96dff8fb45b457 100644
--- a/deps/v8/src/arm64/macro-assembler-arm64.cc
+++ b/deps/v8/src/arm64/macro-assembler-arm64.cc
@@ -9,6 +9,7 @@
 #include "src/base/division-by-constant.h"
 #include "src/bootstrapper.h"
 #include "src/callable.h"
+#include "src/code-factory.h"
 #include "src/code-stubs.h"
 #include "src/debug/debug.h"
 #include "src/external-reference-table.h"
@@ -18,6 +19,7 @@
 #include "src/instruction-stream.h"
 #include "src/register-configuration.h"
 #include "src/runtime/runtime.h"
+#include "src/snapshot/snapshot.h"
 
 #include "src/arm64/macro-assembler-arm64-inl.h"
 #include "src/arm64/macro-assembler-arm64.h"  // Cannot be the first include
@@ -25,10 +27,20 @@
 namespace v8 {
 namespace internal {
 
-MacroAssembler::MacroAssembler(Isolate* isolate, byte* buffer,
-                               unsigned buffer_size,
-                               CodeObjectRequired create_code_object)
-    : TurboAssembler(isolate, buffer, buffer_size, create_code_object) {}
+MacroAssembler::MacroAssembler(Isolate* isolate,
+                               const AssemblerOptions& options, void* buffer,
+                               int size, CodeObjectRequired create_code_object)
+    : TurboAssembler(isolate, options, buffer, size, create_code_object) {
+  if (create_code_object == CodeObjectRequired::kYes) {
+    // Unlike TurboAssembler, which can be used off the main thread and may not
+    // allocate, macro assembler creates its own copy of the self-reference
+    // marker in order to disambiguate between self-references during nested
+    // code generation (e.g.: codegen of the current object triggers stub
+    // compilation through CodeStub::GetCode()).
+    code_object_ = Handle<HeapObject>::New(
+        *isolate->factory()->NewSelfReferenceMarker(), isolate);
+  }
+}
 
 CPURegList TurboAssembler::DefaultTmpList() { return CPURegList(ip0, ip1); }
 
@@ -36,22 +48,6 @@ CPURegList TurboAssembler::DefaultFPTmpList() {
   return CPURegList(fp_scratch1, fp_scratch2);
 }
 
-TurboAssembler::TurboAssembler(Isolate* isolate, void* buffer, int buffer_size,
-                               CodeObjectRequired create_code_object)
-    : Assembler(isolate, buffer, buffer_size),
-      isolate_(isolate),
-#if DEBUG
-      allow_macro_instructions_(true),
-#endif
-      tmp_list_(DefaultTmpList()),
-      fptmp_list_(DefaultFPTmpList()),
-      use_real_aborts_(true) {
-  if (create_code_object == CodeObjectRequired::kYes) {
-    code_object_ =
-        Handle<HeapObject>::New(isolate->heap()->undefined_value(), isolate);
-  }
-}
-
 int TurboAssembler::RequiredStackSizeForCallerSaved(SaveFPRegsMode fp_mode,
                                                     Register exclusion) const {
   int bytes = 0;
@@ -310,7 +306,6 @@ void TurboAssembler::Mov(const Register& rd, const Operand& operand,
 
   if (operand.NeedsRelocation(this)) {
     Ldr(dst, operand);
-
   } else if (operand.IsImmediate()) {
     // Call the macro assembler for generic immediates.
     Mov(dst, operand.ImmediateValue());
@@ -352,6 +347,16 @@ void TurboAssembler::Mov(const Register& rd, const Operand& operand,
   }
 }
 
+void TurboAssembler::Mov(const Register& rd, ExternalReference reference) {
+  if (FLAG_embedded_builtins) {
+    if (root_array_available_ && options().isolate_independent_code) {
+      IndirectLoadExternalReference(rd, reference);
+      return;
+    }
+  }
+  Mov(rd, Operand(reference));
+}
+
 void TurboAssembler::Movi16bitHelper(const VRegister& vd, uint64_t imm) {
   DCHECK(is_uint16(imm));
   int byte1 = (imm & 0xFF);
@@ -1355,8 +1360,7 @@ void TurboAssembler::Poke(const CPURegister& src, const Operand& offset) {
   Str(src, MemOperand(sp, offset));
 }
 
-
-void MacroAssembler::Peek(const CPURegister& dst, const Operand& offset) {
+void TurboAssembler::Peek(const CPURegister& dst, const Operand& offset) {
   if (offset.IsImmediate()) {
     DCHECK_GE(offset.ImmediateValue(), 0);
   } else if (emit_debug_code()) {
@@ -1548,11 +1552,10 @@ void TurboAssembler::CanonicalizeNaN(const VRegister& dst,
   Fsub(dst, src, fp_zero);
 }
 
-void TurboAssembler::LoadRoot(CPURegister destination,
-                              Heap::RootListIndex index) {
+void TurboAssembler::LoadRoot(Register destination, Heap::RootListIndex index) {
   // TODO(jbramley): Most root values are constants, and can be synthesized
   // without a load. Refer to the ARM back end for details.
-  Ldr(destination, MemOperand(root, index << kPointerSizeLog2));
+  Ldr(destination, MemOperand(kRootRegister, RootRegisterOffset(index)));
 }
 
 
@@ -1566,7 +1569,17 @@ void MacroAssembler::LoadObject(Register result, Handle<Object> object) {
 }
 
 void TurboAssembler::Move(Register dst, Register src) { Mov(dst, src); }
-void TurboAssembler::Move(Register dst, Handle<HeapObject> x) { Mov(dst, x); }
+
+void TurboAssembler::Move(Register dst, Handle<HeapObject> value) {
+  if (FLAG_embedded_builtins) {
+    if (root_array_available_ && options().isolate_independent_code) {
+      IndirectLoadConstant(dst, value);
+      return;
+    }
+  }
+  Mov(dst, value);
+}
+
 void TurboAssembler::Move(Register dst, Smi* src) { Mov(dst, src); }
 
 void TurboAssembler::Swap(Register lhs, Register rhs) {
@@ -1613,18 +1626,6 @@ void MacroAssembler::AssertNotSmi(Register object, AbortReason reason) {
   }
 }
 
-void MacroAssembler::AssertFixedArray(Register object) {
-  if (emit_debug_code()) {
-    AssertNotSmi(object, AbortReason::kOperandIsASmiAndNotAFixedArray);
-
-    UseScratchRegisterScope temps(this);
-    Register temp = temps.AcquireX();
-
-    CompareObjectType(object, temp, temp, FIXED_ARRAY_TYPE);
-    Check(eq, AbortReason::kOperandIsNotAFixedArray);
-  }
-}
-
 void MacroAssembler::AssertConstructor(Register object) {
   if (emit_debug_code()) {
     AssertNotSmi(object, AbortReason::kOperandIsASmiAndNotAConstructor);
@@ -1695,7 +1696,7 @@ void MacroAssembler::AssertUndefinedOrAllocationSite(Register object) {
     AssertNotSmi(object);
     JumpIfRoot(object, Heap::kUndefinedValueRootIndex, &done_checking);
     Ldr(scratch, FieldMemOperand(object, HeapObject::kMapOffset));
-    CompareRoot(scratch, Heap::kAllocationSiteMapRootIndex);
+    CompareInstanceType(scratch, scratch, ALLOCATION_SITE_TYPE);
     Assert(eq, AbortReason::kExpectedUndefinedOrCell);
     Bind(&done_checking);
   }
@@ -1718,12 +1719,10 @@ void TurboAssembler::CallStubDelayed(CodeStub* stub) {
   Label start_call;
   Bind(&start_call);
 #endif
-  UseScratchRegisterScope temps(this);
-  Register temp = temps.AcquireX();
-  Ldr(temp, Operand::EmbeddedCode(stub));
-  Blr(temp);
+  Operand operand = Operand::EmbeddedCode(stub);
+  near_call(operand.heap_object_request());
 #ifdef DEBUG
-  AssertSizeOfCodeGeneratedSince(&start_call, kCallSizeWithRelocation);
+  AssertSizeOfCodeGeneratedSince(&start_call, kNearCallSize);
 #endif
 }
 
@@ -1736,16 +1735,18 @@ void MacroAssembler::TailCallStub(CodeStub* stub) {
   Jump(stub->GetCode(), RelocInfo::CODE_TARGET);
 }
 
-void TurboAssembler::CallRuntimeDelayed(Zone* zone, Runtime::FunctionId fid,
-                                        SaveFPRegsMode save_doubles) {
+void TurboAssembler::CallRuntimeWithCEntry(Runtime::FunctionId fid,
+                                           Register centry) {
   const Runtime::Function* f = Runtime::FunctionForId(fid);
   // TODO(1236192): Most runtime routines don't need the number of
   // arguments passed in because it is constant. At some point we
   // should remove this need and make the runtime routine entry code
   // smarter.
   Mov(x0, f->nargs);
-  Mov(x1, ExternalReference(f, isolate()));
-  CallStubDelayed(new (zone) CEntryStub(nullptr, 1, save_doubles));
+  Mov(x1, ExternalReference::Create(f));
+  DCHECK(!AreAliased(centry, x0, x1));
+  Add(centry, centry, Operand(Code::kHeaderSize - kHeapObjectTag));
+  Call(centry);
 }
 
 void MacroAssembler::CallRuntime(const Runtime::Function* f,
@@ -1760,23 +1761,23 @@ void MacroAssembler::CallRuntime(const Runtime::Function* f,
 
   // Place the necessary arguments.
   Mov(x0, num_arguments);
-  Mov(x1, ExternalReference(f, isolate()));
+  Mov(x1, ExternalReference::Create(f));
 
-  CEntryStub stub(isolate(), 1, save_doubles);
-  CallStub(&stub);
+  Handle<Code> code =
+      CodeFactory::CEntry(isolate(), f->result_size, save_doubles);
+  Call(code, RelocInfo::CODE_TARGET);
 }
 
 void MacroAssembler::JumpToExternalReference(const ExternalReference& builtin,
                                              bool builtin_exit_frame) {
   Mov(x1, builtin);
-  CEntryStub stub(isolate(), 1, kDontSaveFPRegs, kArgvOnStack,
-                  builtin_exit_frame);
-  Jump(stub.GetCode(), RelocInfo::CODE_TARGET);
+  Handle<Code> code = CodeFactory::CEntry(isolate(), 1, kDontSaveFPRegs,
+                                          kArgvOnStack, builtin_exit_frame);
+  Jump(code, RelocInfo::CODE_TARGET);
 }
 
 void MacroAssembler::JumpToInstructionStream(Address entry) {
-  Mov(kOffHeapTrampolineRegister,
-      Operand(reinterpret_cast<uint64_t>(entry), RelocInfo::OFF_HEAP_TARGET));
+  Mov(kOffHeapTrampolineRegister, Operand(entry, RelocInfo::OFF_HEAP_TARGET));
   Br(kOffHeapTrampolineRegister);
 }
 
@@ -1790,7 +1791,7 @@ void MacroAssembler::TailCallRuntime(Runtime::FunctionId fid) {
     // smarter.
     Mov(x0, function->nargs);
   }
-  JumpToExternalReference(ExternalReference(fid, isolate()));
+  JumpToExternalReference(ExternalReference::Create(fid));
 }
 
 int TurboAssembler::ActivationFrameAlignment() {
@@ -1852,30 +1853,118 @@ void TurboAssembler::CallCFunction(Register function, int num_of_reg_args,
   }
 }
 
-void TurboAssembler::Jump(Register target) { Br(target); }
+void TurboAssembler::LoadFromConstantsTable(Register destination,
+                                            int constant_index) {
+  DCHECK(isolate()->heap()->RootCanBeTreatedAsConstant(
+      Heap::kBuiltinsConstantsTableRootIndex));
+  LoadRoot(destination, Heap::kBuiltinsConstantsTableRootIndex);
+  Ldr(destination,
+      FieldMemOperand(destination,
+                      FixedArray::kHeaderSize + constant_index * kPointerSize));
+}
 
-void TurboAssembler::Jump(intptr_t target, RelocInfo::Mode rmode,
-                          Condition cond) {
+void TurboAssembler::LoadRootRelative(Register destination, int32_t offset) {
+  Ldr(destination, MemOperand(kRootRegister, offset));
+}
+
+void TurboAssembler::LoadRootRegisterOffset(Register destination,
+                                            intptr_t offset) {
+  if (offset == 0) {
+    Move(destination, kRootRegister);
+  } else {
+    Add(destination, kRootRegister, Operand(offset));
+  }
+}
+
+void TurboAssembler::Jump(Register target, Condition cond) {
+  if (cond == nv) return;
+  Label done;
+  if (cond != al) B(NegateCondition(cond), &done);
+  Br(target);
+  Bind(&done);
+}
+
+void TurboAssembler::JumpHelper(int64_t offset, RelocInfo::Mode rmode,
+                                Condition cond) {
   if (cond == nv) return;
-  UseScratchRegisterScope temps(this);
-  Register temp = temps.AcquireX();
   Label done;
   if (cond != al) B(NegateCondition(cond), &done);
-  Mov(temp, Operand(target, rmode));
-  Br(temp);
+  if (CanUseNearCallOrJump(rmode)) {
+    DCHECK(IsNearCallOffset(offset));
+    near_jump(static_cast<int>(offset), rmode);
+  } else {
+    UseScratchRegisterScope temps(this);
+    Register temp = temps.AcquireX();
+    uint64_t imm = reinterpret_cast<uint64_t>(pc_) + offset * kInstructionSize;
+    Mov(temp, Immediate(imm, rmode));
+    Br(temp);
+  }
   Bind(&done);
 }
 
+namespace {
+
+// The calculated offset is either:
+// * the 'target' input unmodified if this is a WASM call, or
+// * the offset of the target from the current PC, in instructions, for any
+//   other type of call.
+static int64_t CalculateTargetOffset(Address target, RelocInfo::Mode rmode,
+                                     byte* pc) {
+  int64_t offset = static_cast<int64_t>(target);
+  // The target of WebAssembly calls is still an index instead of an actual
+  // address at this point, and needs to be encoded as-is.
+  if (rmode != RelocInfo::WASM_CALL && rmode != RelocInfo::WASM_STUB_CALL) {
+    offset -= reinterpret_cast<int64_t>(pc);
+    DCHECK_EQ(offset % kInstructionSize, 0);
+    offset = offset / static_cast<int>(kInstructionSize);
+  }
+  return offset;
+}
+}  // namespace
+
 void TurboAssembler::Jump(Address target, RelocInfo::Mode rmode,
                           Condition cond) {
-  DCHECK(!RelocInfo::IsCodeTarget(rmode));
-  Jump(reinterpret_cast<intptr_t>(target), rmode, cond);
+  JumpHelper(CalculateTargetOffset(target, rmode, pc_), rmode, cond);
 }
 
 void TurboAssembler::Jump(Handle<Code> code, RelocInfo::Mode rmode,
                           Condition cond) {
   DCHECK(RelocInfo::IsCodeTarget(rmode));
-  Jump(reinterpret_cast<intptr_t>(code.address()), rmode, cond);
+  if (FLAG_embedded_builtins) {
+    if (root_array_available_ && options().isolate_independent_code &&
+        !Builtins::IsIsolateIndependentBuiltin(*code)) {
+      // Calls to embedded targets are initially generated as standard
+      // pc-relative calls below. When creating the embedded blob, call offsets
+      // are patched up to point directly to the off-heap instruction start.
+      // Note: It is safe to dereference {code} above since code generation
+      // for builtins and code stubs happens on the main thread.
+      UseScratchRegisterScope temps(this);
+      Register scratch = temps.AcquireX();
+      IndirectLoadConstant(scratch, code);
+      Add(scratch, scratch, Operand(Code::kHeaderSize - kHeapObjectTag));
+      Jump(scratch, cond);
+      return;
+    } else if (options().inline_offheap_trampolines) {
+      int builtin_index = Builtins::kNoBuiltinId;
+      if (isolate()->builtins()->IsBuiltinHandle(code, &builtin_index) &&
+          Builtins::IsIsolateIndependent(builtin_index)) {
+        // Inline the trampoline.
+        CHECK_NE(builtin_index, Builtins::kNoBuiltinId);
+        UseScratchRegisterScope temps(this);
+        Register scratch = temps.AcquireX();
+        EmbeddedData d = EmbeddedData::FromBlob();
+        Address entry = d.InstructionStartOfBuiltin(builtin_index);
+        Mov(scratch, Operand(entry, RelocInfo::OFF_HEAP_TARGET));
+        Jump(scratch, cond);
+        return;
+      }
+    }
+  }
+  if (CanUseNearCallOrJump(rmode)) {
+    JumpHelper(static_cast<int64_t>(AddCodeTarget(code)), rmode, cond);
+  } else {
+    Jump(code.address(), rmode, cond);
+  }
 }
 
 void TurboAssembler::Call(Register target) {
@@ -1892,20 +1981,6 @@ void TurboAssembler::Call(Register target) {
 #endif
 }
 
-void TurboAssembler::Call(Label* target) {
-  BlockPoolsScope scope(this);
-#ifdef DEBUG
-  Label start_call;
-  Bind(&start_call);
-#endif
-
-  Bl(target);
-
-#ifdef DEBUG
-  AssertSizeOfCodeGeneratedSince(&start_call, CallSize(target));
-#endif
-}
-
 // TurboAssembler::CallSize is sensitive to changes in this function, as it
 // requires to know how many instructions are used to branch to the target.
 void TurboAssembler::Call(Address target, RelocInfo::Mode rmode) {
@@ -1915,33 +1990,60 @@ void TurboAssembler::Call(Address target, RelocInfo::Mode rmode) {
   Bind(&start_call);
 #endif
 
-  UseScratchRegisterScope temps(this);
-  Register temp = temps.AcquireX();
-
-  if (RelocInfo::IsNone(rmode)) {
-    // Addresses are 48 bits so we never need to load the upper 16 bits.
-    uint64_t imm = reinterpret_cast<uint64_t>(target);
-    // If we don't use ARM tagged addresses, the 16 higher bits must be 0.
-    DCHECK_EQ((imm >> 48) & 0xFFFF, 0);
-    movz(temp, (imm >> 0) & 0xFFFF, 0);
-    movk(temp, (imm >> 16) & 0xFFFF, 16);
-    movk(temp, (imm >> 32) & 0xFFFF, 32);
+  if (CanUseNearCallOrJump(rmode)) {
+    int64_t offset = CalculateTargetOffset(target, rmode, pc_);
+    DCHECK(IsNearCallOffset(offset));
+    near_call(static_cast<int>(offset), rmode);
   } else {
-    Ldr(temp, Immediate(reinterpret_cast<intptr_t>(target), rmode));
+    IndirectCall(target, rmode);
   }
-  Blr(temp);
 #ifdef DEBUG
   AssertSizeOfCodeGeneratedSince(&start_call, CallSize(target, rmode));
 #endif
 }
 
 void TurboAssembler::Call(Handle<Code> code, RelocInfo::Mode rmode) {
+  BlockPoolsScope scope(this);
 #ifdef DEBUG
   Label start_call;
   Bind(&start_call);
 #endif
 
-  Call(code.address(), rmode);
+  if (FLAG_embedded_builtins) {
+    if (root_array_available_ && options().isolate_independent_code &&
+        !Builtins::IsIsolateIndependentBuiltin(*code)) {
+      // Calls to embedded targets are initially generated as standard
+      // pc-relative calls below. When creating the embedded blob, call offsets
+      // are patched up to point directly to the off-heap instruction start.
+      // Note: It is safe to dereference {code} above since code generation
+      // for builtins and code stubs happens on the main thread.
+      UseScratchRegisterScope temps(this);
+      Register scratch = temps.AcquireX();
+      IndirectLoadConstant(scratch, code);
+      Add(scratch, scratch, Operand(Code::kHeaderSize - kHeapObjectTag));
+      Call(scratch);
+      return;
+    } else if (options().inline_offheap_trampolines) {
+      int builtin_index = Builtins::kNoBuiltinId;
+      if (isolate()->builtins()->IsBuiltinHandle(code, &builtin_index) &&
+          Builtins::IsIsolateIndependent(builtin_index)) {
+        // Inline the trampoline.
+        CHECK_NE(builtin_index, Builtins::kNoBuiltinId);
+        UseScratchRegisterScope temps(this);
+        Register scratch = temps.AcquireX();
+        EmbeddedData d = EmbeddedData::FromBlob();
+        Address entry = d.InstructionStartOfBuiltin(builtin_index);
+        Mov(scratch, Operand(entry, RelocInfo::OFF_HEAP_TARGET));
+        Call(scratch);
+        return;
+      }
+    }
+  }
+  if (CanUseNearCallOrJump(rmode)) {
+    near_call(AddCodeTarget(code), rmode);
+  } else {
+    IndirectCall(code.address(), rmode);
+  }
 
 #ifdef DEBUG
   // Check the size of the code generated.
@@ -1954,11 +2056,22 @@ void TurboAssembler::Call(ExternalReference target) {
   Register temp = temps.AcquireX();
   // Immediate is in charge of setting the relocation mode to
   // EXTERNAL_REFERENCE.
-  Ldr(temp, Immediate(target));
+  Mov(temp, Immediate(target));
   Call(temp);
 }
 
-void TurboAssembler::CallForDeoptimization(Address target,
+void TurboAssembler::IndirectCall(Address target, RelocInfo::Mode rmode) {
+  UseScratchRegisterScope temps(this);
+  Register temp = temps.AcquireX();
+  Mov(temp, Immediate(target, rmode));
+  Blr(temp);
+}
+
+bool TurboAssembler::IsNearCallOffset(int64_t offset) {
+  return is_int26(offset);
+}
+
+void TurboAssembler::CallForDeoptimization(Address target, int deopt_id,
                                            RelocInfo::Mode rmode) {
   DCHECK_EQ(rmode, RelocInfo::RUNTIME_ENTRY);
 
@@ -1967,17 +2080,23 @@ void TurboAssembler::CallForDeoptimization(Address target,
   Label start_call;
   Bind(&start_call);
 #endif
+  // The deoptimizer requires the deoptimization id to be in x16.
   UseScratchRegisterScope temps(this);
   Register temp = temps.AcquireX();
-
-  // Deoptimisation table entries require the call address to be in x16, in
-  // order to compute the entry id.
   DCHECK(temp.Is(x16));
-  Ldr(temp, Immediate(reinterpret_cast<intptr_t>(target), rmode));
-  Blr(temp);
+  // Make sure that the deopt id can be encoded in 16 bits, so can be encoded
+  // in a single movz instruction with a zero shift.
+  DCHECK(is_uint16(deopt_id));
+  movz(temp, deopt_id);
+  int64_t offset = static_cast<int64_t>(target) -
+                   static_cast<int64_t>(options().code_range_start);
+  DCHECK_EQ(offset % kInstructionSize, 0);
+  offset = offset / static_cast<int>(kInstructionSize);
+  DCHECK(IsNearCallOffset(offset));
+  near_call(static_cast<int>(offset), RelocInfo::RUNTIME_ENTRY);
 
 #ifdef DEBUG
-  AssertSizeOfCodeGeneratedSince(&start_call, CallSize(target, rmode));
+  AssertSizeOfCodeGeneratedSince(&start_call, kNearCallSize + kInstructionSize);
 #endif
 }
 
@@ -1986,23 +2105,14 @@ int TurboAssembler::CallSize(Register target) {
   return kInstructionSize;
 }
 
-int TurboAssembler::CallSize(Label* target) {
-  USE(target);
-  return kInstructionSize;
-}
-
 int TurboAssembler::CallSize(Address target, RelocInfo::Mode rmode) {
   USE(target);
-
-  return RelocInfo::IsNone(rmode) ? kCallSizeWithoutRelocation
-                                  : kCallSizeWithRelocation;
+  return CanUseNearCallOrJump(rmode) ? kNearCallSize : kFarCallSize;
 }
 
 int TurboAssembler::CallSize(Handle<Code> code, RelocInfo::Mode rmode) {
   USE(code);
-
-  return RelocInfo::IsNone(rmode) ? kCallSizeWithoutRelocation
-                                  : kCallSizeWithRelocation;
+  return CanUseNearCallOrJump(rmode) ? kNearCallSize : kFarCallSize;
 }
 
 void MacroAssembler::TryRepresentDoubleAsInt(Register as_int, VRegister value,
@@ -2161,13 +2271,16 @@ void MacroAssembler::CheckDebugHook(Register fun, Register new_target,
                                     const ParameterCount& actual) {
   Label skip_hook;
 
-  ExternalReference debug_hook_active =
-      ExternalReference::debug_hook_on_function_call_address(isolate());
-  Mov(x4, Operand(debug_hook_active));
+  Mov(x4, ExternalReference::debug_hook_on_function_call_address(isolate()));
   Ldrsb(x4, MemOperand(x4));
   Cbz(x4, &skip_hook);
 
   {
+    // Load receiver to pass it later to DebugOnFunctionCall hook.
+    Operand actual_op = actual.is_immediate() ? Operand(actual.immediate())
+                                              : Operand(actual.reg());
+    Mov(x4, actual_op);
+    Ldr(x4, MemOperand(sp, x4, LSL, kPointerSizeLog2));
     FrameScope frame(this,
                      has_frame() ? StackFrame::NONE : StackFrame::INTERNAL);
 
@@ -2181,8 +2294,7 @@ void MacroAssembler::CheckDebugHook(Register fun, Register new_target,
     SmiTag(expected_reg);
     SmiTag(actual_reg);
     Push(expected_reg, actual_reg, new_target, fun);
-
-    PushArgument(fun);
+    Push(fun, x4);
     CallRuntime(Runtime::kDebugOnFunctionCall);
 
     // Restore values from stack.
@@ -2255,9 +2367,9 @@ void MacroAssembler::InvokeFunction(Register function, Register new_target,
   // extension to correctly handle it.
   Ldr(expected_reg, FieldMemOperand(function,
                                     JSFunction::kSharedFunctionInfoOffset));
-  Ldrsw(expected_reg,
-        FieldMemOperand(expected_reg,
-                        SharedFunctionInfo::kFormalParameterCountOffset));
+  Ldrh(expected_reg,
+       FieldMemOperand(expected_reg,
+                       SharedFunctionInfo::kFormalParameterCountOffset));
 
   ParameterCount expected(expected_reg);
   InvokeFunctionCode(function, new_target, expected, actual, flag);
@@ -2304,8 +2416,10 @@ void TurboAssembler::TryConvertDoubleToInt64(Register result,
   B(vc, done);
 }
 
-void TurboAssembler::TruncateDoubleToIDelayed(Zone* zone, Register result,
-                                              DoubleRegister double_input) {
+void TurboAssembler::TruncateDoubleToI(Isolate* isolate, Zone* zone,
+                                       Register result,
+                                       DoubleRegister double_input,
+                                       StubCallMode stub_mode) {
   Label done;
 
   // Try to convert the double to an int64. If successful, the bottom 32 bits
@@ -2315,9 +2429,13 @@ void TurboAssembler::TruncateDoubleToIDelayed(Zone* zone, Register result,
   // If we fell through then inline version didn't succeed - call stub instead.
   Push(lr, double_input);
 
-  auto stub = new (zone) DoubleToIStub(nullptr, result);
-  // DoubleToIStub preserves any registers it needs to clobber.
-  CallStubDelayed(stub);
+  // DoubleToI preserves any registers it needs to clobber.
+  if (stub_mode == StubCallMode::kCallWasmRuntimeStub) {
+    Call(wasm::WasmCode::kDoubleToI, RelocInfo::WASM_STUB_CALL);
+  } else {
+    Call(BUILTIN_CODE(isolate, DoubleToI), RelocInfo::CODE_TARGET);
+  }
+  Ldr(result, MemOperand(sp, 0));
 
   DCHECK_EQ(xzr.SizeInBytes(), double_input.SizeInBytes());
   Pop(xzr, lr);  // xzr to drop the double input on the stack.
@@ -2334,19 +2452,22 @@ void TurboAssembler::Prologue() {
 
 void TurboAssembler::EnterFrame(StackFrame::Type type) {
   UseScratchRegisterScope temps(this);
-  Register type_reg = temps.AcquireX();
-  Register code_reg = temps.AcquireX();
 
   if (type == StackFrame::INTERNAL) {
+    Register type_reg = temps.AcquireX();
     Mov(type_reg, StackFrame::TypeToMarker(type));
-    Mov(code_reg, Operand(CodeObject()));
-    Push(lr, fp, type_reg, code_reg);
-    Add(fp, sp, InternalFrameConstants::kFixedFrameSizeFromFp);
-    // sp[4] : lr
-    // sp[3] : fp
+    // type_reg pushed twice for alignment.
+    Push(lr, fp, type_reg, type_reg);
+    const int kFrameSize =
+        TypedFrameConstants::kFixedFrameSizeFromFp + kPointerSize;
+    Add(fp, sp, kFrameSize);
+    // sp[3] : lr
+    // sp[2] : fp
     // sp[1] : type
-    // sp[0] : [code object]
-  } else if (type == StackFrame::WASM_COMPILED) {
+    // sp[0] : for alignment
+  } else if (type == StackFrame::WASM_COMPILED ||
+             type == StackFrame::WASM_COMPILE_LAZY) {
+    Register type_reg = temps.AcquireX();
     Mov(type_reg, StackFrame::TypeToMarker(type));
     Push(lr, fp);
     Mov(fp, sp);
@@ -2357,6 +2478,7 @@ void TurboAssembler::EnterFrame(StackFrame::Type type) {
     // sp[0] : for alignment
   } else {
     DCHECK_EQ(type, StackFrame::CONSTRUCT);
+    Register type_reg = temps.AcquireX();
     Mov(type_reg, StackFrame::TypeToMarker(type));
 
     // Users of this frame type push a context pointer after the type field,
@@ -2374,15 +2496,10 @@ void TurboAssembler::EnterFrame(StackFrame::Type type) {
 }
 
 void TurboAssembler::LeaveFrame(StackFrame::Type type) {
-  if (type == StackFrame::WASM_COMPILED) {
-    Mov(sp, fp);
-    Pop(fp, lr);
-  } else {
-    // Drop the execution stack down to the frame pointer and restore
-    // the caller frame pointer and return address.
-    Mov(sp, fp);
-    Pop(fp, lr);
-  }
+  // Drop the execution stack down to the frame pointer and restore
+  // the caller frame pointer and return address.
+  Mov(sp, fp);
+  Pop(fp, lr);
 }
 
 
@@ -2418,7 +2535,7 @@ void MacroAssembler::EnterExitFrame(bool save_doubles, const Register& scratch,
   Mov(fp, sp);
   Mov(scratch, StackFrame::TypeToMarker(frame_type));
   Push(scratch, xzr);
-  Mov(scratch, Operand(CodeObject()));
+  Move(scratch, CodeObject());
   Push(scratch, padreg);
   //          fp[8]: CallerPC (lr)
   //    fp -> fp[0]: CallerFP (old fp)
@@ -2434,11 +2551,11 @@ void MacroAssembler::EnterExitFrame(bool save_doubles, const Register& scratch,
   STATIC_ASSERT((-4 * kPointerSize) == ExitFrameConstants::kPaddingOffset);
 
   // Save the frame pointer and context pointer in the top frame.
-  Mov(scratch, Operand(ExternalReference(IsolateAddressId::kCEntryFPAddress,
-                                         isolate())));
+  Mov(scratch,
+      ExternalReference::Create(IsolateAddressId::kCEntryFPAddress, isolate()));
   Str(fp, MemOperand(scratch));
   Mov(scratch,
-      Operand(ExternalReference(IsolateAddressId::kContextAddress, isolate())));
+      ExternalReference::Create(IsolateAddressId::kContextAddress, isolate()));
   Str(cp, MemOperand(scratch));
 
   STATIC_ASSERT((-4 * kPointerSize) == ExitFrameConstants::kLastExitFrameField);
@@ -2481,19 +2598,19 @@ void MacroAssembler::LeaveExitFrame(bool restore_doubles,
 
   // Restore the context pointer from the top frame.
   Mov(scratch,
-      Operand(ExternalReference(IsolateAddressId::kContextAddress, isolate())));
+      ExternalReference::Create(IsolateAddressId::kContextAddress, isolate()));
   Ldr(cp, MemOperand(scratch));
 
   if (emit_debug_code()) {
     // Also emit debug code to clear the cp in the top frame.
     Mov(scratch2, Operand(Context::kInvalidContext));
-    Mov(scratch, Operand(ExternalReference(IsolateAddressId::kContextAddress,
-                                           isolate())));
+    Mov(scratch, ExternalReference::Create(IsolateAddressId::kContextAddress,
+                                           isolate()));
     Str(scratch2, MemOperand(scratch));
   }
   // Clear the frame pointer from the top frame.
-  Mov(scratch, Operand(ExternalReference(IsolateAddressId::kCEntryFPAddress,
-                                         isolate())));
+  Mov(scratch,
+      ExternalReference::Create(IsolateAddressId::kCEntryFPAddress, isolate()));
   Str(xzr, MemOperand(scratch));
 
   // Pop the exit frame.
@@ -2515,7 +2632,7 @@ void MacroAssembler::IncrementCounter(StatsCounter* counter, int value,
                                       Register scratch1, Register scratch2) {
   DCHECK_NE(value, 0);
   if (FLAG_native_code_counters && counter->Enabled()) {
-    Mov(scratch2, ExternalReference(counter));
+    Mov(scratch2, ExternalReference::Create(counter));
     Ldr(scratch1.W(), MemOperand(scratch2));
     Add(scratch1.W(), scratch1.W(), value);
     Str(scratch1.W(), MemOperand(scratch2));
@@ -2530,9 +2647,7 @@ void MacroAssembler::DecrementCounter(StatsCounter* counter, int value,
 
 void MacroAssembler::MaybeDropFrames() {
   // Check whether we need to drop frames to restart a function on the stack.
-  ExternalReference restart_fp =
-      ExternalReference::debug_restart_fp_address(isolate());
-  Mov(x1, Operand(restart_fp));
+  Mov(x1, ExternalReference::debug_restart_fp_address(isolate()));
   Ldr(x1, MemOperand(x1));
   Tst(x1, x1);
   Jump(BUILTIN_CODE(isolate(), FrameDropperTrampoline), RelocInfo::CODE_TARGET,
@@ -2890,6 +3005,10 @@ void TurboAssembler::Assert(Condition cond, AbortReason reason) {
   }
 }
 
+void TurboAssembler::AssertUnreachable(AbortReason reason) {
+  if (emit_debug_code()) Abort(reason);
+}
+
 void MacroAssembler::AssertRegisterIsRoot(Register reg,
                                           Heap::RootListIndex index,
                                           AbortReason reason) {
@@ -2911,12 +3030,13 @@ void TurboAssembler::Abort(AbortReason reason) {
 #ifdef DEBUG
   RecordComment("Abort message: ");
   RecordComment(GetAbortReason(reason));
+#endif
 
-  if (FLAG_trap_on_abort) {
+  // Avoid emitting call to builtin if requested.
+  if (trap_on_abort()) {
     Brk(0);
     return;
   }
-#endif
 
   // We need some scratch registers for the MacroAssembler, so make sure we have
   // some. This is safe here because Abort never returns.
@@ -3115,7 +3235,7 @@ void TurboAssembler::CallPrintf(int arg_count, const CPURegister* args) {
     dc32(arg_pattern_list);   // kPrintfArgPatternListOffset
   }
 #else
-  Call(ExternalReference::printf_function(isolate()));
+  Call(ExternalReference::printf_function());
 #endif
 }
 
diff --git a/deps/v8/src/arm64/macro-assembler-arm64.h b/deps/v8/src/arm64/macro-assembler-arm64.h
index 6b1b8957cb5dcf..a73fc2f47b977b 100644
--- a/deps/v8/src/arm64/macro-assembler-arm64.h
+++ b/deps/v8/src/arm64/macro-assembler-arm64.h
@@ -11,6 +11,7 @@
 #include "src/bailout-reason.h"
 #include "src/base/bits.h"
 #include "src/globals.h"
+#include "src/turbo-assembler.h"
 
 // Simulator specific helpers.
 #if USE_SIMULATOR
@@ -41,23 +42,28 @@ namespace v8 {
 namespace internal {
 
 // Give alias names to registers for calling conventions.
-#define kReturnRegister0 x0
-#define kReturnRegister1 x1
-#define kReturnRegister2 x2
-#define kJSFunctionRegister x1
-#define kContextRegister cp
-#define kAllocateSizeRegister x1
-#define kSpeculationPoisonRegister x18
-#define kInterpreterAccumulatorRegister x0
-#define kInterpreterBytecodeOffsetRegister x19
-#define kInterpreterBytecodeArrayRegister x20
-#define kInterpreterDispatchTableRegister x21
-#define kJavaScriptCallArgCountRegister x0
-#define kJavaScriptCallCodeStartRegister x2
-#define kJavaScriptCallNewTargetRegister x3
-#define kOffHeapTrampolineRegister ip0
-#define kRuntimeCallFunctionRegister x1
-#define kRuntimeCallArgCountRegister x0
+constexpr Register kReturnRegister0 = x0;
+constexpr Register kReturnRegister1 = x1;
+constexpr Register kReturnRegister2 = x2;
+constexpr Register kJSFunctionRegister = x1;
+constexpr Register kContextRegister = cp;
+constexpr Register kAllocateSizeRegister = x1;
+constexpr Register kSpeculationPoisonRegister = x18;
+constexpr Register kInterpreterAccumulatorRegister = x0;
+constexpr Register kInterpreterBytecodeOffsetRegister = x19;
+constexpr Register kInterpreterBytecodeArrayRegister = x20;
+constexpr Register kInterpreterDispatchTableRegister = x21;
+
+constexpr Register kJavaScriptCallArgCountRegister = x0;
+constexpr Register kJavaScriptCallCodeStartRegister = x2;
+constexpr Register kJavaScriptCallTargetRegister = kJSFunctionRegister;
+constexpr Register kJavaScriptCallNewTargetRegister = x3;
+constexpr Register kJavaScriptCallExtraArg1Register = x2;
+
+constexpr Register kOffHeapTrampolineRegister = ip0;
+constexpr Register kRuntimeCallFunctionRegister = x1;
+constexpr Register kRuntimeCallArgCountRegister = x0;
+constexpr Register kWasmInstanceRegister = x7;
 
 #define LS_MACRO_LIST(V)                                     \
   V(Ldrb, Register&, rt, LDRB_w)                             \
@@ -96,11 +102,6 @@ namespace internal {
 
 // Generate a MemOperand for loading a field from an object.
 inline MemOperand FieldMemOperand(Register object, int offset);
-inline MemOperand UntagSmiFieldMemOperand(Register object, int offset);
-
-// Generate a MemOperand for loading a SMI from memory.
-inline MemOperand UntagSmiMemOperand(Register object, int offset);
-
 
 // ----------------------------------------------------------------------------
 // MacroAssembler
@@ -176,16 +177,19 @@ enum PreShiftImmMode {
   kAnyShift          // Allow any pre-shift.
 };
 
-class TurboAssembler : public Assembler {
+class TurboAssembler : public TurboAssemblerBase {
  public:
-  TurboAssembler(Isolate* isolate, void* buffer, int buffer_size,
-                 CodeObjectRequired create_code_object);
+  TurboAssembler(Isolate* isolate, const AssemblerOptions& options,
+                 void* buffer, int buffer_size,
+                 CodeObjectRequired create_code_object)
+      : TurboAssemblerBase(isolate, options, buffer, buffer_size,
+                           create_code_object) {}
 
   // The Abort method should call a V8 runtime function, but the CallRuntime
-  // mechanism depends on CEntryStub. If use_real_aborts is false, Abort will
-  // use a simpler abort mechanism that doesn't depend on CEntryStub.
+  // mechanism depends on CEntry. If use_real_aborts is false, Abort will
+  // use a simpler abort mechanism that doesn't depend on CEntry.
   //
-  // The purpose of this is to allow Aborts to be compiled whilst CEntryStub is
+  // The purpose of this is to allow Aborts to be compiled whilst CEntry is
   // being generated.
   bool use_real_aborts() const { return use_real_aborts_; }
 
@@ -202,16 +206,6 @@ class TurboAssembler : public Assembler {
     TurboAssembler* tasm_;
   };
 
-  void set_has_frame(bool value) { has_frame_ = value; }
-  bool has_frame() const { return has_frame_; }
-
-  Isolate* isolate() const { return isolate_; }
-
-  Handle<HeapObject> CodeObject() {
-    DCHECK(!code_object_.is_null());
-    return code_object_;
-  }
-
 #if DEBUG
   void set_allow_macro_instructions(bool value) {
     allow_macro_instructions_ = value;
@@ -219,6 +213,14 @@ class TurboAssembler : public Assembler {
   bool allow_macro_instructions() const { return allow_macro_instructions_; }
 #endif
 
+  // We should not use near calls or jumps for JS->WASM calls and calls to
+  // external references, since the code spaces are not guaranteed to be close
+  // to each other.
+  bool CanUseNearCallOrJump(RelocInfo::Mode rmode) {
+    return rmode != RelocInfo::JS_TO_WASM_CALL &&
+           rmode != RelocInfo::EXTERNAL_REFERENCE;
+  }
+
   // Activation support.
   void EnterFrame(StackFrame::Type type);
   void EnterFrame(StackFrame::Type type, bool load_constant_pool_pointer_reg) {
@@ -231,6 +233,7 @@ class TurboAssembler : public Assembler {
 
   void Mov(const Register& rd, const Operand& operand,
            DiscardMoveMode discard_mode = kDontDiscardForSameWReg);
+  void Mov(const Register& rd, ExternalReference reference);
   void Mov(const Register& rd, uint64_t imm);
   inline void Mov(const Register& rd, const Register& rm);
   void Mov(const VRegister& vd, int vd_index, const VRegister& vn,
@@ -254,7 +257,7 @@ class TurboAssembler : public Assembler {
   // This is required for compatibility with architecture independent code.
   // Remove if not needed.
   void Move(Register dst, Register src);
-  void Move(Register dst, Handle<HeapObject> x);
+  void Move(Register dst, Handle<HeapObject> value);
   void Move(Register dst, Smi* src);
 
   // Register swap. Note that the register operands should be distinct.
@@ -563,8 +566,10 @@ class TurboAssembler : public Assembler {
 
   bool AllowThisStubCall(CodeStub* stub);
   void CallStubDelayed(CodeStub* stub);
-  void CallRuntimeDelayed(Zone* zone, Runtime::FunctionId fid,
-                          SaveFPRegsMode save_doubles = kDontSaveFPRegs);
+
+  // Call a runtime routine. This expects {centry} to contain a fitting CEntry
+  // builtin for the target runtime function and uses an indirect call.
+  void CallRuntimeWithCEntry(Runtime::FunctionId fid, Register centry);
 
   // Removes current frame and its arguments from the stack preserving
   // the arguments and a return address pushed to the stack for the next call.
@@ -576,12 +581,17 @@ class TurboAssembler : public Assembler {
                           Register scratch1);
 
   inline void SmiUntag(Register dst, Register src);
+  inline void SmiUntag(Register dst, const MemOperand& src);
   inline void SmiUntag(Register smi);
 
   // Calls Abort(msg) if the condition cond is not satisfied.
   // Use --debug_code to enable.
   void Assert(Condition cond, AbortReason reason);
 
+  // Like Assert(), but without condition.
+  // Use --debug_code to enable.
+  void AssertUnreachable(AbortReason reason);
+
   void AssertSmi(Register object,
                  AbortReason reason = AbortReason::kOperandIsNotASmi);
 
@@ -847,6 +857,9 @@ class TurboAssembler : public Assembler {
   inline void JumpIfSmi(Register value, Label* smi_label,
                         Label* not_smi_label = nullptr);
 
+  inline void JumpIfEqual(Register x, int32_t y, Label* dest);
+  inline void JumpIfLessThan(Register x, int32_t y, Label* dest);
+
   inline void Fmov(VRegister fd, VRegister fn);
   inline void Fmov(VRegister fd, Register rn);
   // Provide explicit double and float interfaces for FP immediate moves, rather
@@ -867,26 +880,32 @@ class TurboAssembler : public Assembler {
             int shift_amount = 0);
   void Movi(const VRegister& vd, uint64_t hi, uint64_t lo);
 
-  void Jump(Register target);
+  void LoadFromConstantsTable(Register destination,
+                              int constant_index) override;
+  void LoadRootRegisterOffset(Register destination, intptr_t offset) override;
+  void LoadRootRelative(Register destination, int32_t offset) override;
+
+  void Jump(Register target, Condition cond = al);
   void Jump(Address target, RelocInfo::Mode rmode, Condition cond = al);
   void Jump(Handle<Code> code, RelocInfo::Mode rmode, Condition cond = al);
-  void Jump(intptr_t target, RelocInfo::Mode rmode, Condition cond = al);
 
   void Call(Register target);
-  void Call(Label* target);
   void Call(Address target, RelocInfo::Mode rmode);
   void Call(Handle<Code> code, RelocInfo::Mode rmode = RelocInfo::CODE_TARGET);
   void Call(ExternalReference target);
 
-  void CallForDeoptimization(Address target, RelocInfo::Mode rmode);
+  // Generate an indirect call (for when a direct call's range is not adequate).
+  void IndirectCall(Address target, RelocInfo::Mode rmode);
+
+  void CallForDeoptimization(Address target, int deopt_id,
+                             RelocInfo::Mode rmode);
 
   // For every Call variant, there is a matching CallSize function that returns
   // the size (in bytes) of the call sequence.
   static int CallSize(Register target);
-  static int CallSize(Label* target);
-  static int CallSize(Address target, RelocInfo::Mode rmode);
-  static int CallSize(Handle<Code> code,
-                      RelocInfo::Mode rmode = RelocInfo::CODE_TARGET);
+  int CallSize(Address target, RelocInfo::Mode rmode);
+  int CallSize(Handle<Code> code,
+               RelocInfo::Mode rmode = RelocInfo::CODE_TARGET);
 
   // Calls a C function.
   // The called function is not allowed to trigger a
@@ -902,8 +921,8 @@ class TurboAssembler : public Assembler {
   // Performs a truncating conversion of a floating point number as used by
   // the JS bitwise operations. See ECMA-262 9.5: ToInt32.
   // Exits with 'result' holding the answer.
-  void TruncateDoubleToIDelayed(Zone* zone, Register result,
-                                DoubleRegister double_input);
+  void TruncateDoubleToI(Isolate* isolate, Zone* zone, Register result,
+                         DoubleRegister double_input, StubCallMode stub_mode);
 
   inline void Mul(const Register& rd, const Register& rn, const Register& rm);
 
@@ -984,6 +1003,10 @@ class TurboAssembler : public Assembler {
   // be 16 byte aligned.
   void Poke(const CPURegister& src, const Operand& offset);
 
+  // Peek at a value on the stack, and put it in 'dst'. The offset is in bytes.
+  // The stack pointer must be aligned to 16 bytes.
+  void Peek(const CPURegister& dst, const Operand& offset);
+
   // Poke 'src1' and 'src2' onto the stack. The values written will be adjacent
   // with 'src2' at a higher address than 'src1'. The offset is in bytes. The
   // stack pointer must be 16 byte aligned.
@@ -1142,7 +1165,7 @@ class TurboAssembler : public Assembler {
 #undef DECLARE_FUNCTION
 
   // Load an object from the root table.
-  void LoadRoot(CPURegister destination, Heap::RootListIndex index);
+  void LoadRoot(Register destination, Heap::RootListIndex index) override;
 
   inline void Ret(const Register& xn = lr);
 
@@ -1239,22 +1262,19 @@ class TurboAssembler : public Assembler {
   void CallPrintf(int arg_count = 0, const CPURegister* args = nullptr);
 
  private:
-  bool has_frame_ = false;
-  Isolate* const isolate_;
 #if DEBUG
   // Tell whether any of the macro instruction can be used. When false the
   // MacroAssembler will assert if a method which can emit a variable number
   // of instructions is called.
-  bool allow_macro_instructions_;
+  bool allow_macro_instructions_ = true;
 #endif
-  // This handle will be patched with the code object on installation.
-  Handle<HeapObject> code_object_;
+
 
   // Scratch registers available for use by the MacroAssembler.
-  CPURegList tmp_list_;
-  CPURegList fptmp_list_;
+  CPURegList tmp_list_ = DefaultTmpList();
+  CPURegList fptmp_list_ = DefaultFPTmpList();
 
-  bool use_real_aborts_;
+  bool use_real_aborts_ = true;
 
   // Helps resolve branching to labels potentially out of range.
   // If the label is not bound, it registers the information necessary to later
@@ -1276,12 +1296,19 @@ class TurboAssembler : public Assembler {
 
   void LoadStorePairMacro(const CPURegister& rt, const CPURegister& rt2,
                           const MemOperand& addr, LoadStorePairOp op);
+
+  static bool IsNearCallOffset(int64_t offset);
+  void JumpHelper(int64_t offset, RelocInfo::Mode rmode, Condition cond = al);
 };
 
 class MacroAssembler : public TurboAssembler {
  public:
-  MacroAssembler(Isolate* isolate, byte* buffer, unsigned buffer_size,
-                 CodeObjectRequired create_code_object);
+  MacroAssembler(Isolate* isolate, void* buffer, int size,
+                 CodeObjectRequired create_code_object)
+      : MacroAssembler(isolate, AssemblerOptions::Default(isolate), buffer,
+                       size, create_code_object) {}
+  MacroAssembler(Isolate* isolate, const AssemblerOptions& options,
+                 void* buffer, int size, CodeObjectRequired create_code_object);
 
   // Instruction set functions ------------------------------------------------
   // Logical macros.
@@ -1606,10 +1633,6 @@ class MacroAssembler : public TurboAssembler {
     std::vector<CPURegister> queued_;
   };
 
-  // Peek at a value on the stack, and put it in 'dst'. The offset is in bytes.
-  // The stack pointer must be aligned to 16 bytes.
-  void Peek(const CPURegister& dst, const Operand& offset);
-
   // Peek at two values on the stack, and put them in 'dst1' and 'dst2'. The
   // values peeked will be adjacent, with the value in 'dst2' being from a
   // higher address than 'dst1'. The offset is in bytes. The stack pointer must
@@ -1686,8 +1709,6 @@ class MacroAssembler : public TurboAssembler {
 
   inline void SmiTag(Register dst, Register src);
   inline void SmiTag(Register smi);
-  inline void SmiUntagToDouble(VRegister dst, Register src);
-  inline void SmiUntagToFloat(VRegister dst, Register src);
 
   inline void JumpIfNotSmi(Register value, Label* not_smi_label);
   inline void JumpIfBothSmi(Register value1, Register value2,
@@ -1710,9 +1731,6 @@ class MacroAssembler : public TurboAssembler {
   inline void ObjectTag(Register tagged_obj, Register obj);
   inline void ObjectUntag(Register untagged_obj, Register obj);
 
-  // Abort execution if argument is not a FixedArray, enabled via --debug-code.
-  void AssertFixedArray(Register object);
-
   // Abort execution if argument is not a Constructor, enabled via --debug-code.
   void AssertConstructor(Register object);
 
diff --git a/deps/v8/src/arm64/simulator-arm64.cc b/deps/v8/src/arm64/simulator-arm64.cc
index 290be13cd6a86e..56b3da2331ddbf 100644
--- a/deps/v8/src/arm64/simulator-arm64.cc
+++ b/deps/v8/src/arm64/simulator-arm64.cc
@@ -117,7 +117,7 @@ Simulator* Simulator::current(Isolate* isolate) {
   return sim;
 }
 
-void Simulator::CallImpl(byte* entry, CallArgument* args) {
+void Simulator::CallImpl(Address entry, CallArgument* args) {
   int index_x = 0;
   int index_d = 0;
 
@@ -3184,12 +3184,12 @@ void Simulator::Debug() {
                  (strcmp(cmd, "po") == 0)) {
         if (argc == 2) {
           int64_t value;
-          OFStream os(stdout);
+          StdoutStream os;
           if (GetValue(arg1, &value)) {
             Object* obj = reinterpret_cast<Object*>(value);
             os << arg1 << ": \n";
 #ifdef DEBUG
-            obj->Print(os);
+            obj->Print(isolate_, os);
             os << "\n";
 #else
             os << Brief(obj) << "\n";
@@ -3246,7 +3246,7 @@ void Simulator::Debug() {
               current_heap->ContainsSlow(obj->address())) {
             PrintF(" (");
             if ((value & kSmiTagMask) == 0) {
-              STATIC_ASSERT(kSmiValueSize == 32);
+              DCHECK(SmiValuesAre32Bits() || SmiValuesAre31Bits());
               int32_t untagged = (value >> kSmiShift) & 0xFFFFFFFF;
               PrintF("smi %" PRId32, untagged);
             } else {
diff --git a/deps/v8/src/arm64/simulator-arm64.h b/deps/v8/src/arm64/simulator-arm64.h
index 8cd1e02b6f8723..4bd9294c2f27de 100644
--- a/deps/v8/src/arm64/simulator-arm64.h
+++ b/deps/v8/src/arm64/simulator-arm64.h
@@ -719,7 +719,7 @@ class Simulator : public DecoderVisitor, public SimulatorBase {
 
   // Call an arbitrary function taking an arbitrary number of arguments.
   template <typename Return, typename... Args>
-  Return Call(byte* entry, Args... args) {
+  Return Call(Address entry, Args... args) {
     // Convert all arguments to CallArgument.
     CallArgument call_args[] = {CallArgument(args)..., CallArgument::End()};
     CallImpl(entry, call_args);
@@ -2279,7 +2279,7 @@ class Simulator : public DecoderVisitor, public SimulatorBase {
  private:
   void Init(FILE* stream);
 
-  V8_EXPORT_PRIVATE void CallImpl(byte* entry, CallArgument* args);
+  V8_EXPORT_PRIVATE void CallImpl(Address entry, CallArgument* args);
 
   // Read floating point return values.
   template <typename T>
diff --git a/deps/v8/src/asan.h b/deps/v8/src/asan.h
new file mode 100644
index 00000000000000..fc0add016e1ca9
--- /dev/null
+++ b/deps/v8/src/asan.h
@@ -0,0 +1,30 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// AddressSanitizer support.
+
+#ifndef V8_ASAN_H_
+#define V8_ASAN_H_
+
+#include "src/base/macros.h"
+#include "src/globals.h"
+
+#ifdef V8_USE_ADDRESS_SANITIZER
+
+#include <sanitizer/asan_interface.h>
+
+#else  // !V8_USE_ADDRESS_SANITIZER
+
+#define ASAN_POISON_MEMORY_REGION(start, size)                         \
+  static_assert(                                                       \
+      (std::is_pointer<decltype(start)>::value ||                      \
+       std::is_same<v8::internal::Address, decltype(start)>::value) && \
+          std::is_convertible<decltype(size), size_t>::value,          \
+      "static type violation")
+#define ASAN_UNPOISON_MEMORY_REGION(start, size) \
+  ASAN_POISON_MEMORY_REGION(start, size)
+
+#endif  // V8_USE_ADDRESS_SANITIZER
+
+#endif  // V8_ASAN_H_
diff --git a/deps/v8/src/asmjs/asm-js.cc b/deps/v8/src/asmjs/asm-js.cc
index 3d835fb2cb8541..5579a3fab07752 100644
--- a/deps/v8/src/asmjs/asm-js.cc
+++ b/deps/v8/src/asmjs/asm-js.cc
@@ -338,10 +338,10 @@ MaybeHandle<Object> AsmJs::InstantiateAsmWasm(Isolate* isolate,
   base::ElapsedTimer instantiate_timer;
   instantiate_timer.Start();
   Handle<HeapNumber> uses_bitset(
-      HeapNumber::cast(wasm_data->get(kWasmDataUsesBitSet)));
+      HeapNumber::cast(wasm_data->get(kWasmDataUsesBitSet)), isolate);
   Handle<WasmModuleObject> module(
-      WasmModuleObject::cast(wasm_data->get(kWasmDataCompiledModule)));
-  Handle<Script> script(Script::cast(shared->script()));
+      WasmModuleObject::cast(wasm_data->get(kWasmDataCompiledModule)), isolate);
+  Handle<Script> script(Script::cast(shared->script()), isolate);
   // TODO(mstarzinger): The position currently points to the module definition
   // but should instead point to the instantiation site (more intuitive).
   int position = shared->StartPosition();
diff --git a/deps/v8/src/asmjs/asm-parser.cc b/deps/v8/src/asmjs/asm-parser.cc
index f210b42a62e0d0..1fca56b0fc8480 100644
--- a/deps/v8/src/asmjs/asm-parser.cc
+++ b/deps/v8/src/asmjs/asm-parser.cc
@@ -1345,7 +1345,8 @@ void AsmJsParser::ValidateCase() {
     FAIL("Numeric literal out of range");
   }
   int32_t value = static_cast<int32_t>(uvalue);
-  if (negate) {
+  DCHECK_IMPLIES(negate && uvalue == 0x80000000, value == kMinInt);
+  if (negate && value != kMinInt) {
     value = -value;
   }
   EXPECT_TOKEN(':');
@@ -1406,7 +1407,6 @@ AsmType* AsmJsParser::NumericLiteral() {
       current_function_builder_->EmitI32Const(static_cast<int32_t>(uvalue));
       return AsmType::FixNum();
     } else {
-      DCHECK_LE(uvalue, 0xFFFFFFFF);
       current_function_builder_->EmitI32Const(static_cast<int32_t>(uvalue));
       return AsmType::Unsigned();
     }
@@ -2501,18 +2501,16 @@ void AsmJsParser::GatherCases(ZoneVector<int32_t>* cases) {
       }
     } else if (depth == 1 && Peek(TOK(case))) {
       scanner_.Next();
-      int32_t value;
       uint32_t uvalue;
-      if (Check('-')) {
-        if (!CheckForUnsigned(&uvalue)) {
-          break;
-        }
-        value = -static_cast<int32_t>(uvalue);
-      } else {
-        if (!CheckForUnsigned(&uvalue)) {
-          break;
-        }
-        value = static_cast<int32_t>(uvalue);
+      bool negate = false;
+      if (Check('-')) negate = true;
+      if (!CheckForUnsigned(&uvalue)) {
+        break;
+      }
+      int32_t value = static_cast<int32_t>(uvalue);
+      DCHECK_IMPLIES(negate && uvalue == 0x80000000, value == kMinInt);
+      if (negate && value != kMinInt) {
+        value = -value;
       }
       cases->push_back(value);
     } else if (Peek(AsmJsScanner::kEndOfInput) ||
diff --git a/deps/v8/src/asmjs/asm-scanner.cc b/deps/v8/src/asmjs/asm-scanner.cc
index af41208eadd3e3..c7144e3be629ca 100644
--- a/deps/v8/src/asmjs/asm-scanner.cc
+++ b/deps/v8/src/asmjs/asm-scanner.cc
@@ -4,6 +4,7 @@
 
 #include "src/asmjs/asm-scanner.h"
 
+#include "src/char-predicates-inl.h"
 #include "src/conversions.h"
 #include "src/flags.h"
 #include "src/parsing/scanner.h"
@@ -273,17 +274,22 @@ void AsmJsScanner::ConsumeNumber(uc32 ch) {
   std::string number;
   number = ch;
   bool has_dot = ch == '.';
+  bool has_prefix = false;
   for (;;) {
     ch = stream_->Advance();
     if ((ch >= '0' && ch <= '9') || (ch >= 'a' && ch <= 'f') ||
         (ch >= 'A' && ch <= 'F') || ch == '.' || ch == 'b' || ch == 'o' ||
         ch == 'x' ||
-        ((ch == '-' || ch == '+') && (number[number.size() - 1] == 'e' ||
-                                      number[number.size() - 1] == 'E'))) {
+        ((ch == '-' || ch == '+') && !has_prefix &&
+         (number[number.size() - 1] == 'e' ||
+          number[number.size() - 1] == 'E'))) {
       // TODO(bradnelson): Test weird cases ending in -.
       if (ch == '.') {
         has_dot = true;
       }
+      if (ch == 'b' || ch == 'o' || ch == 'x') {
+        has_prefix = true;
+      }
       number.push_back(ch);
     } else {
       break;
@@ -413,16 +419,13 @@ void AsmJsScanner::ConsumeCompareOrShift(uc32 ch) {
 }
 
 bool AsmJsScanner::IsIdentifierStart(uc32 ch) {
-  return (ch >= 'A' && ch <= 'Z') || (ch >= 'a' && ch <= 'z') || ch == '_' ||
-         ch == '$';
+  return IsInRange(AsciiAlphaToLower(ch), 'a', 'z') || ch == '_' || ch == '$';
 }
 
-bool AsmJsScanner::IsIdentifierPart(uc32 ch) {
-  return IsIdentifierStart(ch) || (ch >= '0' && ch <= '9');
-}
+bool AsmJsScanner::IsIdentifierPart(uc32 ch) { return IsAsciiIdentifier(ch); }
 
 bool AsmJsScanner::IsNumberStart(uc32 ch) {
-  return ch == '.' || (ch >= '0' && ch <= '9');
+  return ch == '.' || IsDecimalDigit(ch);
 }
 
 }  // namespace internal
diff --git a/deps/v8/src/assembler-arch.h b/deps/v8/src/assembler-arch.h
new file mode 100644
index 00000000000000..5858907537c415
--- /dev/null
+++ b/deps/v8/src/assembler-arch.h
@@ -0,0 +1,30 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef V8_ASSEMBLER_ARCH_H_
+#define V8_ASSEMBLER_ARCH_H_
+
+#include "src/assembler.h"
+
+#if V8_TARGET_ARCH_IA32
+#include "src/ia32/assembler-ia32.h"
+#elif V8_TARGET_ARCH_X64
+#include "src/x64/assembler-x64.h"
+#elif V8_TARGET_ARCH_ARM64
+#include "src/arm64/assembler-arm64.h"
+#elif V8_TARGET_ARCH_ARM
+#include "src/arm/assembler-arm.h"
+#elif V8_TARGET_ARCH_PPC
+#include "src/ppc/assembler-ppc.h"
+#elif V8_TARGET_ARCH_MIPS
+#include "src/mips/assembler-mips.h"
+#elif V8_TARGET_ARCH_MIPS64
+#include "src/mips64/assembler-mips64.h"
+#elif V8_TARGET_ARCH_S390
+#include "src/s390/assembler-s390.h"
+#else
+#error Unknown architecture.
+#endif
+
+#endif  // V8_ASSEMBLER_ARCH_H_
diff --git a/deps/v8/src/assembler.cc b/deps/v8/src/assembler.cc
index 48d10418c0ac18..ecf8a8edcf4597 100644
--- a/deps/v8/src/assembler.cc
+++ b/deps/v8/src/assembler.cc
@@ -43,28 +43,40 @@
 #include "src/ostreams.h"
 #include "src/simulator.h"  // For flushing instruction cache.
 #include "src/snapshot/serializer-common.h"
+#include "src/snapshot/snapshot.h"
 
 namespace v8 {
 namespace internal {
 
 const char* const RelocInfo::kFillerCommentString = "DEOPTIMIZATION PADDING";
 
-// -----------------------------------------------------------------------------
-// Implementation of AssemblerBase
-
-AssemblerBase::IsolateData::IsolateData(Isolate* isolate)
-    : serializer_enabled_(isolate->serializer_enabled())
-#if V8_TARGET_ARCH_X64
-      ,
-      code_range_start_(
-          isolate->heap()->memory_allocator()->code_range()->start())
+AssemblerOptions AssemblerOptions::Default(
+    Isolate* isolate, bool explicitly_support_serialization) {
+  AssemblerOptions options;
+  bool serializer =
+      isolate->serializer_enabled() || explicitly_support_serialization;
+  options.record_reloc_info_for_serialization = serializer;
+  options.enable_root_array_delta_access = !serializer;
+#ifdef USE_SIMULATOR
+  // Don't generate simulator specific code if we are building a snapshot, which
+  // might be run on real hardware.
+  options.enable_simulator_code = !serializer;
+#endif
+  options.isolate_independent_code = isolate->ShouldLoadConstantsFromRootList();
+  options.inline_offheap_trampolines = !serializer;
+#if V8_TARGET_ARCH_X64 || V8_TARGET_ARCH_ARM64
+  options.code_range_start =
+      isolate->heap()->memory_allocator()->code_range()->start();
 #endif
-{
+  return options;
 }
 
-AssemblerBase::AssemblerBase(IsolateData isolate_data, void* buffer,
+// -----------------------------------------------------------------------------
+// Implementation of AssemblerBase
+
+AssemblerBase::AssemblerBase(const AssemblerOptions& options, void* buffer,
                              int buffer_size)
-    : isolate_data_(isolate_data),
+    : options_(options),
       enabled_cpu_features_(0),
       emit_debug_code_(FLAG_debug_code),
       predictable_code_size_(false),
@@ -95,8 +107,8 @@ void AssemblerBase::FlushICache(void* start, size_t size) {
 }
 
 void AssemblerBase::Print(Isolate* isolate) {
-  OFStream os(stdout);
-  v8::internal::Disassembler::Decode(isolate, &os, buffer_, pc_, nullptr);
+  StdoutStream os;
+  v8::internal::Disassembler::Decode(isolate, &os, buffer_, pc_);
 }
 
 // -----------------------------------------------------------------------------
@@ -164,8 +176,7 @@ unsigned CpuFeatures::dcache_line_size_ = 0;
 //
 //   01: code_target:          [6-bit pc delta] 01
 //
-//   10: short_data_record:    [6-bit pc delta] 10 followed by
-//                             [8-bit data delta]
+//   10: wasm_stub_call:       [6-bit pc delta] 10
 //
 //   11: long_record           [6 bit reloc mode] 11
 //                             followed by pc delta
@@ -189,7 +200,7 @@ const int kLongTagBits = 6;
 
 const int kEmbeddedObjectTag = 0;
 const int kCodeTargetTag = 1;
-const int kLocatableTag = 2;
+const int kWasmStubCallTag = 2;
 const int kDefaultTag = 3;
 
 const int kSmallPCDeltaBits = kBitsPerByte - kTagBits;
@@ -202,54 +213,6 @@ const int kLastChunkTagBits = 1;
 const int kLastChunkTagMask = 1;
 const int kLastChunkTag = 1;
 
-// static
-bool RelocInfo::OffHeapTargetIsCodedSpecially() {
-#if defined(V8_TARGET_ARCH_ARM) || defined(V8_TARGET_ARCH_ARM64) || \
-    defined(V8_TARGET_ARCH_X64) || defined(V8_TARGET_ARCH_IA32)
-  return false;
-#elif defined(V8_TARGET_ARCH_MIPS) || defined(V8_TARGET_ARCH_MIPS64) || \
-    defined(V8_TARGET_ARCH_PPC) || defined(V8_TARGET_ARCH_S390)
-  return true;
-#endif
-}
-
-void RelocInfo::set_global_handle(Address address,
-                                  ICacheFlushMode icache_flush_mode) {
-  DCHECK_EQ(rmode_, WASM_GLOBAL_HANDLE);
-  set_embedded_address(address, icache_flush_mode);
-}
-
-Address RelocInfo::wasm_call_address() const {
-  DCHECK_EQ(rmode_, WASM_CALL);
-  return Assembler::target_address_at(pc_, constant_pool_);
-}
-
-void RelocInfo::set_wasm_call_address(Address address,
-                                      ICacheFlushMode icache_flush_mode) {
-  DCHECK_EQ(rmode_, WASM_CALL);
-  Assembler::set_target_address_at(pc_, constant_pool_, address,
-                                   icache_flush_mode);
-}
-
-Address RelocInfo::global_handle() const {
-  DCHECK_EQ(rmode_, WASM_GLOBAL_HANDLE);
-  return embedded_address();
-}
-
-void RelocInfo::set_target_address(Address target,
-                                   WriteBarrierMode write_barrier_mode,
-                                   ICacheFlushMode icache_flush_mode) {
-  DCHECK(IsCodeTarget(rmode_) || IsRuntimeEntry(rmode_) || IsWasmCall(rmode_));
-  Assembler::set_target_address_at(pc_, constant_pool_, target,
-                                   icache_flush_mode);
-  if (write_barrier_mode == UPDATE_WRITE_BARRIER && host() != nullptr &&
-      IsCodeTarget(rmode_)) {
-    Code* target_code = Code::GetCodeFromTargetAddress(target);
-    host()->GetHeap()->incremental_marking()->RecordWriteIntoCode(host(), this,
-                                                                  target_code);
-  }
-}
-
 uint32_t RelocInfoWriter::WriteLongPCJump(uint32_t pc_delta) {
   // Return if the pc_delta can fit in kSmallPCDeltaBits bits.
   // Otherwise write a variable length PC jump for the bits that do
@@ -313,9 +276,10 @@ void RelocInfoWriter::Write(const RelocInfo* rinfo) {
   byte* begin_pos = pos_;
 #endif
   DCHECK(rinfo->rmode() < RelocInfo::NUMBER_OF_MODES);
-  DCHECK_GE(rinfo->pc() - last_pc_, 0);
+  DCHECK_GE(rinfo->pc() - reinterpret_cast<Address>(last_pc_), 0);
   // Use unsigned delta-encoding for pc.
-  uint32_t pc_delta = static_cast<uint32_t>(rinfo->pc() - last_pc_);
+  uint32_t pc_delta =
+      static_cast<uint32_t>(rinfo->pc() - reinterpret_cast<Address>(last_pc_));
 
   // The two most common modes are given small tags, and usually fit in a byte.
   if (rmode == RelocInfo::EMBEDDED_OBJECT) {
@@ -323,21 +287,22 @@ void RelocInfoWriter::Write(const RelocInfo* rinfo) {
   } else if (rmode == RelocInfo::CODE_TARGET) {
     WriteShortTaggedPC(pc_delta, kCodeTargetTag);
     DCHECK_LE(begin_pos - pos_, RelocInfo::kMaxCallSize);
-  } else if (rmode == RelocInfo::DEOPT_REASON) {
-    DCHECK(rinfo->data() < (1 << kBitsPerByte));
-    WriteShortTaggedPC(pc_delta, kLocatableTag);
-    WriteShortData(rinfo->data());
+  } else if (rmode == RelocInfo::WASM_STUB_CALL) {
+    WriteShortTaggedPC(pc_delta, kWasmStubCallTag);
   } else {
     WriteModeAndPC(pc_delta, rmode);
     if (RelocInfo::IsComment(rmode)) {
       WriteData(rinfo->data());
+    } else if (RelocInfo::IsDeoptReason(rmode)) {
+      DCHECK_LT(rinfo->data(), 1 << kBitsPerByte);
+      WriteShortData(rinfo->data());
     } else if (RelocInfo::IsConstPool(rmode) ||
                RelocInfo::IsVeneerPool(rmode) || RelocInfo::IsDeoptId(rmode) ||
                RelocInfo::IsDeoptPosition(rmode)) {
       WriteIntData(static_cast<int>(rinfo->data()));
     }
   }
-  last_pc_ = rinfo->pc();
+  last_pc_ = reinterpret_cast<byte*>(rinfo->pc());
 #ifdef DEBUG
   DCHECK_LE(begin_pos - pos_, kMaxSize);
 #endif
@@ -411,13 +376,9 @@ void RelocIterator::next() {
     } else if (tag == kCodeTargetTag) {
       ReadShortTaggedPC();
       if (SetMode(RelocInfo::CODE_TARGET)) return;
-    } else if (tag == kLocatableTag) {
+    } else if (tag == kWasmStubCallTag) {
       ReadShortTaggedPC();
-      Advance();
-      if (SetMode(RelocInfo::DEOPT_REASON)) {
-        ReadShortData();
-        return;
-      }
+      if (SetMode(RelocInfo::WASM_STUB_CALL)) return;
     } else {
       DCHECK_EQ(tag, kDefaultTag);
       RelocInfo::Mode rmode = GetMode();
@@ -431,6 +392,12 @@ void RelocIterator::next() {
             return;
           }
           Advance(kIntptrSize);
+        } else if (RelocInfo::IsDeoptReason(rmode)) {
+          Advance();
+          if (SetMode(rmode)) {
+            ReadShortData();
+            return;
+          }
         } else if (RelocInfo::IsConstPool(rmode) ||
                    RelocInfo::IsVeneerPool(rmode) ||
                    RelocInfo::IsDeoptId(rmode) ||
@@ -450,38 +417,45 @@ void RelocIterator::next() {
 }
 
 RelocIterator::RelocIterator(Code* code, int mode_mask)
-    : mode_mask_(mode_mask) {
-  rinfo_.host_ = code;
-  rinfo_.pc_ = code->raw_instruction_start();
-  rinfo_.data_ = 0;
-  rinfo_.constant_pool_ = code->constant_pool();
-  // Relocation info is read backwards.
-  pos_ = code->relocation_start() + code->relocation_size();
-  end_ = code->relocation_start();
-  if (mode_mask_ == 0) pos_ = end_;
-  next();
-}
+    : RelocIterator(code, code->raw_instruction_start(), code->constant_pool(),
+                    code->relocation_end(), code->relocation_start(),
+                    mode_mask) {}
+
+RelocIterator::RelocIterator(const CodeReference code_reference, int mode_mask)
+    : RelocIterator(nullptr, code_reference.instruction_start(),
+                    code_reference.constant_pool(),
+                    code_reference.relocation_end(),
+                    code_reference.relocation_start(), mode_mask) {}
+
+RelocIterator::RelocIterator(EmbeddedData* embedded_data, Code* code,
+                             int mode_mask)
+    : RelocIterator(
+          code, embedded_data->InstructionStartOfBuiltin(code->builtin_index()),
+          code->constant_pool(),
+          code->relocation_start() + code->relocation_size(),
+          code->relocation_start(), mode_mask) {}
 
 RelocIterator::RelocIterator(const CodeDesc& desc, int mode_mask)
-    : mode_mask_(mode_mask) {
-  rinfo_.pc_ = desc.buffer;
-  // Relocation info is read backwards.
-  pos_ = desc.buffer + desc.buffer_size;
-  end_ = pos_ - desc.reloc_size;
-  if (mode_mask_ == 0) pos_ = end_;
-  next();
-}
+    : RelocIterator(nullptr, reinterpret_cast<Address>(desc.buffer), 0,
+                    desc.buffer + desc.buffer_size,
+                    desc.buffer + desc.buffer_size - desc.reloc_size,
+                    mode_mask) {}
 
 RelocIterator::RelocIterator(Vector<byte> instructions,
                              Vector<const byte> reloc_info, Address const_pool,
                              int mode_mask)
-    : mode_mask_(mode_mask) {
-  rinfo_.pc_ = instructions.start();
-  rinfo_.constant_pool_ = const_pool;
-  rinfo_.flags_ = RelocInfo::kInNativeWasmCode;
+    : RelocIterator(nullptr, reinterpret_cast<Address>(instructions.start()),
+                    const_pool, reloc_info.start() + reloc_info.size(),
+                    reloc_info.start(), mode_mask) {}
+
+RelocIterator::RelocIterator(Code* host, Address pc, Address constant_pool,
+                             const byte* pos, const byte* end, int mode_mask)
+    : pos_(pos), end_(end), mode_mask_(mode_mask) {
   // Relocation info is read backwards.
-  pos_ = reloc_info.start() + reloc_info.size();
-  end_ = reloc_info.start();
+  DCHECK_GE(pos_, end_);
+  rinfo_.host_ = host;
+  rinfo_.pc_ = pc;
+  rinfo_.constant_pool_ = constant_pool;
   if (mode_mask_ == 0) pos_ = end_;
   next();
 }
@@ -489,12 +463,63 @@ RelocIterator::RelocIterator(Vector<byte> instructions,
 // -----------------------------------------------------------------------------
 // Implementation of RelocInfo
 
+// static
+bool RelocInfo::OffHeapTargetIsCodedSpecially() {
+#if defined(V8_TARGET_ARCH_ARM) || defined(V8_TARGET_ARCH_ARM64) || \
+    defined(V8_TARGET_ARCH_X64) || defined(V8_TARGET_ARCH_IA32)
+  return false;
+#elif defined(V8_TARGET_ARCH_MIPS) || defined(V8_TARGET_ARCH_MIPS64) || \
+    defined(V8_TARGET_ARCH_PPC) || defined(V8_TARGET_ARCH_S390)
+  return true;
+#endif
+}
+
+Address RelocInfo::wasm_call_address() const {
+  DCHECK_EQ(rmode_, WASM_CALL);
+  return Assembler::target_address_at(pc_, constant_pool_);
+}
+
+void RelocInfo::set_wasm_call_address(Address address,
+                                      ICacheFlushMode icache_flush_mode) {
+  DCHECK_EQ(rmode_, WASM_CALL);
+  Assembler::set_target_address_at(pc_, constant_pool_, address,
+                                   icache_flush_mode);
+}
+
+Address RelocInfo::wasm_stub_call_address() const {
+  DCHECK_EQ(rmode_, WASM_STUB_CALL);
+  return Assembler::target_address_at(pc_, constant_pool_);
+}
+
+void RelocInfo::set_wasm_stub_call_address(Address address,
+                                           ICacheFlushMode icache_flush_mode) {
+  DCHECK_EQ(rmode_, WASM_STUB_CALL);
+  Assembler::set_target_address_at(pc_, constant_pool_, address,
+                                   icache_flush_mode);
+}
+
+void RelocInfo::set_target_address(Address target,
+                                   WriteBarrierMode write_barrier_mode,
+                                   ICacheFlushMode icache_flush_mode) {
+  DCHECK(IsCodeTargetMode(rmode_) || IsRuntimeEntry(rmode_) ||
+         IsWasmCall(rmode_));
+  Assembler::set_target_address_at(pc_, constant_pool_, target,
+                                   icache_flush_mode);
+  if (write_barrier_mode == UPDATE_WRITE_BARRIER && host() != nullptr &&
+      IsCodeTargetMode(rmode_)) {
+    Code* target_code = Code::GetCodeFromTargetAddress(target);
+    host()->GetHeap()->incremental_marking()->RecordWriteIntoCode(host(), this,
+                                                                  target_code);
+  }
+}
+
 #ifdef DEBUG
 bool RelocInfo::RequiresRelocation(const CodeDesc& desc) {
   // Ensure there are no code targets or embedded objects present in the
   // deoptimization entries, they would require relocation after code
   // generation.
-  int mode_mask = RelocInfo::kCodeTargetMask |
+  int mode_mask = RelocInfo::ModeMask(RelocInfo::CODE_TARGET) |
+                  RelocInfo::ModeMask(RelocInfo::RELATIVE_CODE_TARGET) |
                   RelocInfo::ModeMask(RelocInfo::EMBEDDED_OBJECT) |
                   RelocInfo::kApplyMask;
   RelocIterator it(desc, mode_mask);
@@ -511,6 +536,8 @@ const char* RelocInfo::RelocModeName(RelocInfo::Mode rmode) {
       return "embedded object";
     case CODE_TARGET:
       return "code target";
+    case RELATIVE_CODE_TARGET:
+      return "relative code target";
     case RUNTIME_ENTRY:
       return "runtime entry";
     case COMMENT:
@@ -535,12 +562,10 @@ const char* RelocInfo::RelocModeName(RelocInfo::Mode rmode) {
       return "constant pool";
     case VENEER_POOL:
       return "veneer pool";
-    case WASM_GLOBAL_HANDLE:
-      return "global handle";
     case WASM_CALL:
       return "internal wasm call";
-    case WASM_CODE_TABLE_ENTRY:
-      return "wasm code table entry";
+    case WASM_STUB_CALL:
+      return "wasm stub call";
     case JS_TO_WASM_CALL:
       return "js to wasm call";
     case NUMBER_OF_MODES:
@@ -551,7 +576,7 @@ const char* RelocInfo::RelocModeName(RelocInfo::Mode rmode) {
 }
 
 void RelocInfo::Print(Isolate* isolate, std::ostream& os) {  // NOLINT
-  os << static_cast<const void*>(pc_) << "  " << RelocModeName(rmode_);
+  os << reinterpret_cast<const void*>(pc_) << "  " << RelocModeName(rmode_);
   if (IsComment(rmode_)) {
     os << "  (" << reinterpret_cast<char*>(data_) << ")";
   } else if (rmode_ == DEOPT_SCRIPT_OFFSET || rmode_ == DEOPT_INLINING_ID) {
@@ -562,33 +587,32 @@ void RelocInfo::Print(Isolate* isolate, std::ostream& os) {  // NOLINT
   } else if (rmode_ == EMBEDDED_OBJECT) {
     os << "  (" << Brief(target_object()) << ")";
   } else if (rmode_ == EXTERNAL_REFERENCE) {
-    ExternalReferenceEncoder ref_encoder(isolate);
-    os << " ("
-       << ref_encoder.NameOfAddress(isolate, target_external_reference())
-       << ")  (" << static_cast<const void*>(target_external_reference())
+    if (isolate) {
+      ExternalReferenceEncoder ref_encoder(isolate);
+      os << " ("
+         << ref_encoder.NameOfAddress(isolate, target_external_reference())
+         << ") ";
+    }
+    os << " (" << reinterpret_cast<const void*>(target_external_reference())
        << ")";
-  } else if (IsCodeTarget(rmode_)) {
+  } else if (IsCodeTargetMode(rmode_)) {
     const Address code_target = target_address();
-    if (flags_ & kInNativeWasmCode) {
-      os << " (wasm trampoline) ";
-    } else {
-      Code* code = Code::GetCodeFromTargetAddress(code_target);
-      DCHECK(code->IsCode());
-      os << " (" << Code::Kind2String(code->kind());
-      if (Builtins::IsBuiltin(code)) {
-        os << " " << Builtins::name(code->builtin_index());
-      } else if (code->kind() == Code::STUB) {
-        os << " " << CodeStub::MajorName(CodeStub::GetMajorKey(code));
-      }
-      os << ") ";
+    Code* code = Code::GetCodeFromTargetAddress(code_target);
+    DCHECK(code->IsCode());
+    os << " (" << Code::Kind2String(code->kind());
+    if (Builtins::IsBuiltin(code)) {
+      os << " " << Builtins::name(code->builtin_index());
+    } else if (code->kind() == Code::STUB) {
+      os << " " << CodeStub::MajorName(CodeStub::GetMajorKey(code));
     }
-    os << " (" << static_cast<const void*>(target_address()) << ")";
+    os << ")  (" << reinterpret_cast<const void*>(target_address()) << ")";
   } else if (IsRuntimeEntry(rmode_) && isolate->deoptimizer_data() != nullptr) {
-    // Depotimization bailouts are stored as runtime entries.
-    int id = Deoptimizer::GetDeoptimizationId(
-        isolate, target_address(), Deoptimizer::EAGER);
-    if (id != Deoptimizer::kNotDeoptimizationEntry) {
-      os << "  (deoptimization bailout " << id << ")";
+    // Deoptimization bailouts are stored as runtime entries.
+    DeoptimizeKind type;
+    if (Deoptimizer::IsDeoptimizationEntry(isolate, target_address(), &type)) {
+      int id = GetDeoptimizationId(isolate, type);
+      os << "  (" << Deoptimizer::MessageFor(type) << " deoptimization bailout "
+         << id << ")";
     }
   } else if (IsConstPool(rmode_)) {
     os << " (size " << static_cast<int>(data_) << ")";
@@ -604,10 +628,11 @@ void RelocInfo::Verify(Isolate* isolate) {
     case EMBEDDED_OBJECT:
       Object::VerifyPointer(target_object());
       break;
-    case CODE_TARGET: {
+    case CODE_TARGET:
+    case RELATIVE_CODE_TARGET: {
       // convert inline target address to code object
       Address addr = target_address();
-      CHECK_NOT_NULL(addr);
+      CHECK_NE(addr, kNullAddress);
       // Check that we can find the right code object.
       Code* code = Code::GetCodeFromTargetAddress(addr);
       Object* found = isolate->FindCodeObject(addr);
@@ -626,7 +651,7 @@ void RelocInfo::Verify(Isolate* isolate) {
     }
     case OFF_HEAP_TARGET: {
       Address addr = target_off_heap_target();
-      CHECK_NOT_NULL(addr);
+      CHECK_NE(addr, kNullAddress);
       CHECK_NOT_NULL(InstructionStream::TryLookupCode(isolate, addr));
       break;
     }
@@ -639,10 +664,9 @@ void RelocInfo::Verify(Isolate* isolate) {
     case DEOPT_ID:
     case CONST_POOL:
     case VENEER_POOL:
-    case WASM_GLOBAL_HANDLE:
     case WASM_CALL:
+    case WASM_STUB_CALL:
     case JS_TO_WASM_CALL:
-    case WASM_CODE_TABLE_ENTRY:
     case NONE:
       break;
     case NUMBER_OF_MODES:
@@ -886,10 +910,35 @@ void Assembler::DataAlign(int m) {
   }
 }
 
-void Assembler::RequestHeapObject(HeapObjectRequest request) {
+void AssemblerBase::RequestHeapObject(HeapObjectRequest request) {
   request.set_offset(pc_offset());
   heap_object_requests_.push_front(request);
 }
 
+int AssemblerBase::AddCodeTarget(Handle<Code> target) {
+  int current = static_cast<int>(code_targets_.size());
+  if (current > 0 && !target.is_null() &&
+      code_targets_.back().address() == target.address()) {
+    // Optimization if we keep jumping to the same code target.
+    return current - 1;
+  } else {
+    code_targets_.push_back(target);
+    return current;
+  }
+}
+
+Handle<Code> AssemblerBase::GetCodeTarget(intptr_t code_target_index) const {
+  DCHECK_LE(0, code_target_index);
+  DCHECK_LT(code_target_index, code_targets_.size());
+  return code_targets_[code_target_index];
+}
+
+void AssemblerBase::UpdateCodeTarget(intptr_t code_target_index,
+                                     Handle<Code> code) {
+  DCHECK_LE(0, code_target_index);
+  DCHECK_LT(code_target_index, code_targets_.size());
+  code_targets_[code_target_index] = code;
+}
+
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/src/assembler.h b/deps/v8/src/assembler.h
index e79f4cc8693332..92a6987d8d7530 100644
--- a/deps/v8/src/assembler.h
+++ b/deps/v8/src/assembler.h
@@ -40,6 +40,7 @@
 #include <map>
 
 #include "src/allocation.h"
+#include "src/code-reference.h"
 #include "src/contexts.h"
 #include "src/deoptimize-reason.h"
 #include "src/double.h"
@@ -59,6 +60,7 @@ class ApiFunction;
 namespace internal {
 
 // Forward declarations.
+class EmbeddedData;
 class InstructionStream;
 class Isolate;
 class SCTableReference;
@@ -77,12 +79,57 @@ class JumpOptimizationInfo {
   bool is_optimizable() const { return optimizable_; }
   void set_optimizable() { optimizable_ = true; }
 
+  // Used to verify the instruction sequence is always the same in two stages.
+  size_t hash_code() const { return hash_code_; }
+  void set_hash_code(size_t hash_code) { hash_code_ = hash_code; }
+
   std::vector<uint32_t>& farjmp_bitmap() { return farjmp_bitmap_; }
 
  private:
   enum { kCollection, kOptimization } stage_ = kCollection;
   bool optimizable_ = false;
   std::vector<uint32_t> farjmp_bitmap_;
+  size_t hash_code_ = 0u;
+};
+
+class HeapObjectRequest {
+ public:
+  explicit HeapObjectRequest(double heap_number, int offset = -1);
+  explicit HeapObjectRequest(CodeStub* code_stub, int offset = -1);
+
+  enum Kind { kHeapNumber, kCodeStub };
+  Kind kind() const { return kind_; }
+
+  double heap_number() const {
+    DCHECK_EQ(kind(), kHeapNumber);
+    return value_.heap_number;
+  }
+
+  CodeStub* code_stub() const {
+    DCHECK_EQ(kind(), kCodeStub);
+    return value_.code_stub;
+  }
+
+  // The code buffer offset at the time of the request.
+  int offset() const {
+    DCHECK_GE(offset_, 0);
+    return offset_;
+  }
+  void set_offset(int offset) {
+    DCHECK_LT(offset_, 0);
+    offset_ = offset;
+    DCHECK_GE(offset_, 0);
+  }
+
+ private:
+  Kind kind_;
+
+  union {
+    double heap_number;
+    CodeStub* code_stub;
+  } value_;
+
+  int offset_;
 };
 
 // -----------------------------------------------------------------------------
@@ -90,26 +137,42 @@ class JumpOptimizationInfo {
 
 enum class CodeObjectRequired { kNo, kYes };
 
+struct V8_EXPORT_PRIVATE AssemblerOptions {
+  // Recording reloc info and for external references and off-heap targets is
+  // needed whenever code is serialized, e.g. into the snapshot or as a WASM
+  // module. This flag allows this reloc info to be disabled for code that
+  // will not survive process destruction.
+  bool record_reloc_info_for_serialization = true;
+  // Enables access to exrefs by computing a delta from the root array.
+  // Only valid if code will not survive the process.
+  bool enable_root_array_delta_access = false;
+  // Enables specific assembler sequences only used for the simulator.
+  bool enable_simulator_code = false;
+  // Enables use of isolate-independent constants, indirected through the
+  // root array.
+  // (macro assembler feature).
+  bool isolate_independent_code = false;
+  // Enables the use of isolate-independent builtins through an off-heap
+  // trampoline. (macro assembler feature).
+  bool inline_offheap_trampolines = false;
+  // On some platforms, all code is within a given range in the process,
+  // and the start of this range is configured here.
+  Address code_range_start = 0;
+  // Enable pc-relative calls/jumps on platforms that support it. When setting
+  // this flag, the code range must be small enough to fit all offsets into
+  // the instruction immediates.
+  bool use_pc_relative_calls_and_jumps = false;
+
+  static AssemblerOptions Default(
+      Isolate* isolate, bool explicitly_support_serialization = false);
+};
 
-class AssemblerBase: public Malloced {
+class AssemblerBase : public Malloced {
  public:
-  struct IsolateData {
-    explicit IsolateData(Isolate* isolate);
-    IsolateData(const IsolateData&) = default;
-
-    bool serializer_enabled_;
-#if V8_TARGET_ARCH_X64
-    Address code_range_start_;
-#endif
-  };
-
-  AssemblerBase(IsolateData isolate_data, void* buffer, int buffer_size);
+  AssemblerBase(const AssemblerOptions& options, void* buffer, int buffer_size);
   virtual ~AssemblerBase();
 
-  IsolateData isolate_data() const { return isolate_data_; }
-
-  bool serializer_enabled() const { return isolate_data_.serializer_enabled_; }
-  void enable_serializer() { isolate_data_.serializer_enabled_ = true; }
+  const AssemblerOptions& options() const { return options_; }
 
   bool emit_debug_code() const { return emit_debug_code_; }
   void set_emit_debug_code(bool value) { emit_debug_code_ = value; }
@@ -162,13 +225,34 @@ class AssemblerBase: public Malloced {
   static const int kMinimalBufferSize = 4*KB;
 
   static void FlushICache(void* start, size_t size);
+  static void FlushICache(Address start, size_t size) {
+    return FlushICache(reinterpret_cast<void*>(start), size);
+  }
+
+  // Used to print the name of some special registers.
+  static const char* GetSpecialRegisterName(int code) { return "UNKNOWN"; }
 
  protected:
+  // Add 'target' to the {code_targets_} vector, if necessary, and return the
+  // offset at which it is stored.
+  int AddCodeTarget(Handle<Code> target);
+  Handle<Code> GetCodeTarget(intptr_t code_target_index) const;
+  // Update to the code target at {code_target_index} to {target}.
+  void UpdateCodeTarget(intptr_t code_target_index, Handle<Code> target);
+  // Reserves space in the code target vector.
+  void ReserveCodeTargetSpace(size_t num_of_code_targets) {
+    code_targets_.reserve(num_of_code_targets);
+  }
+
   // The buffer into which code and relocation info are generated. It could
   // either be owned by the assembler or be provided externally.
   byte* buffer_;
   int buffer_size_;
   bool own_buffer_;
+  std::forward_list<HeapObjectRequest> heap_object_requests_;
+  // The program counter, which points into the buffer above and moves forward.
+  // TODO(jkummerow): This should probably have type {Address}.
+  byte* pc_;
 
   void set_constant_pool_available(bool available) {
     if (FLAG_enable_embedded_constant_pool) {
@@ -179,11 +263,23 @@ class AssemblerBase: public Malloced {
     }
   }
 
-  // The program counter, which points into the buffer above and moves forward.
-  byte* pc_;
+  // {RequestHeapObject} records the need for a future heap number allocation or
+  // code stub generation. After code assembly, each platform's
+  // {Assembler::AllocateAndInstallRequestedHeapObjects} will allocate these
+  // objects and place them where they are expected (determined by the pc offset
+  // associated with each request).
+  void RequestHeapObject(HeapObjectRequest request);
 
  private:
-  IsolateData isolate_data_;
+  // Before we copy code into the code space, we sometimes cannot encode
+  // call/jump code targets as we normally would, as the difference between the
+  // instruction's location in the temporary buffer and the call target is not
+  // guaranteed to fit in the instruction's offset field. We keep track of the
+  // code handles we encounter in calls in this vector, and encode the index of
+  // the code handle in the vector instead.
+  std::vector<Handle<Code>> code_targets_;
+
+  const AssemblerOptions options_;
   uint64_t enabled_cpu_features_;
   bool emit_debug_code_;
   bool predictable_code_size_;
@@ -315,11 +411,6 @@ class CpuFeatures : public AllStatic {
   DISALLOW_COPY_AND_ASSIGN(CpuFeatures);
 };
 
-
-enum SaveFPRegsMode { kDontSaveFPRegs, kSaveFPRegs };
-
-enum ArgvMode { kArgvOnStack, kArgvInRegister };
-
 // Specifies whether to perform icache flush operations on RelocInfo updates.
 // If FLUSH_ICACHE_IF_NEEDED, the icache will always be flushed if an
 // instruction was modified. If SKIP_ICACHE_FLUSH the flush will always be
@@ -340,12 +431,6 @@ enum ICacheFlushMode { FLUSH_ICACHE_IF_NEEDED, SKIP_ICACHE_FLUSH };
 
 class RelocInfo {
  public:
-  enum Flag : uint8_t {
-    kNoFlags = 0,
-    kInNativeWasmCode = 1u << 0,  // Reloc info belongs to native wasm code.
-  };
-  typedef base::Flags<Flag> Flags;
-
   // This string is used to add padding comments to the reloc info in cases
   // where we are not sure to have enough space for patching in during
   // lazy deoptimization. This is the case if we have indirect calls for which
@@ -363,12 +448,16 @@ class RelocInfo {
   static const int kMaxSmallPCDelta;
 
   enum Mode : int8_t {
-    // Please note the order is important (see IsCodeTarget, IsGCRelocMode).
+    // Please note the order is important (see IsRealRelocMode, IsGCRelocMode,
+    // and IsShareableRelocMode predicates below).
+
     CODE_TARGET,
-    EMBEDDED_OBJECT,
-    WASM_GLOBAL_HANDLE,
-    WASM_CALL,
+    RELATIVE_CODE_TARGET,  // LAST_CODE_TARGET_MODE
+    EMBEDDED_OBJECT,       // LAST_GCED_ENUM
+
     JS_TO_WASM_CALL,
+    WASM_CALL,  // FIRST_SHAREABLE_RELOC_MODE
+    WASM_STUB_CALL,
 
     RUNTIME_ENTRY,
     COMMENT,
@@ -396,32 +485,43 @@ class RelocInfo {
     // cannot be encoded as part of another record.
     PC_JUMP,
 
-    // Points to a wasm code table entry.
-    WASM_CODE_TABLE_ENTRY,
-
     // Pseudo-types
     NUMBER_OF_MODES,
     NONE,  // never recorded value
 
+    LAST_CODE_TARGET_MODE = RELATIVE_CODE_TARGET,
     FIRST_REAL_RELOC_MODE = CODE_TARGET,
     LAST_REAL_RELOC_MODE = VENEER_POOL,
-    LAST_CODE_ENUM = CODE_TARGET,
     LAST_GCED_ENUM = EMBEDDED_OBJECT,
-    FIRST_SHAREABLE_RELOC_MODE = RUNTIME_ENTRY,
+    FIRST_SHAREABLE_RELOC_MODE = WASM_CALL,
   };
 
   STATIC_ASSERT(NUMBER_OF_MODES <= kBitsPerInt);
 
   RelocInfo() = default;
 
-  RelocInfo(byte* pc, Mode rmode, intptr_t data, Code* host)
-      : pc_(pc), rmode_(rmode), data_(data), host_(host) {}
+  RelocInfo(Address pc, Mode rmode, intptr_t data, Code* host,
+            Address constant_pool = kNullAddress)
+      : pc_(pc),
+        rmode_(rmode),
+        data_(data),
+        host_(host),
+        constant_pool_(constant_pool) {}
 
   static inline bool IsRealRelocMode(Mode mode) {
     return mode >= FIRST_REAL_RELOC_MODE && mode <= LAST_REAL_RELOC_MODE;
   }
-  static inline bool IsCodeTarget(Mode mode) {
-    return mode <= LAST_CODE_ENUM;
+  // Is the relocation mode affected by GC?
+  static inline bool IsGCRelocMode(Mode mode) { return mode <= LAST_GCED_ENUM; }
+  static inline bool IsShareableRelocMode(Mode mode) {
+    return mode >= RelocInfo::FIRST_SHAREABLE_RELOC_MODE;
+  }
+  static inline bool IsCodeTarget(Mode mode) { return mode == CODE_TARGET; }
+  static inline bool IsCodeTargetMode(Mode mode) {
+    return mode <= LAST_CODE_TARGET_MODE;
+  }
+  static inline bool IsRelativeCodeTarget(Mode mode) {
+    return mode == RELATIVE_CODE_TARGET;
   }
   static inline bool IsEmbeddedObject(Mode mode) {
     return mode == EMBEDDED_OBJECT;
@@ -430,9 +530,8 @@ class RelocInfo {
     return mode == RUNTIME_ENTRY;
   }
   static inline bool IsWasmCall(Mode mode) { return mode == WASM_CALL; }
-  // Is the relocation mode affected by GC?
-  static inline bool IsGCRelocMode(Mode mode) {
-    return mode <= LAST_GCED_ENUM;
+  static inline bool IsWasmStubCall(Mode mode) {
+    return mode == WASM_STUB_CALL;
   }
   static inline bool IsComment(Mode mode) {
     return mode == COMMENT;
@@ -469,28 +568,27 @@ class RelocInfo {
     return IsWasmPtrReference(mode);
   }
   static inline bool IsWasmPtrReference(Mode mode) {
-    return mode == WASM_GLOBAL_HANDLE || mode == WASM_CALL ||
-           mode == JS_TO_WASM_CALL;
+    return mode == WASM_CALL || mode == JS_TO_WASM_CALL;
+  }
+
+  static inline bool IsOnlyForSerializer(Mode mode) {
+    return mode == EXTERNAL_REFERENCE || mode == OFF_HEAP_TARGET;
   }
 
   static constexpr int ModeMask(Mode mode) { return 1 << mode; }
 
   // Accessors
-  byte* pc() const { return pc_; }
-  void set_pc(byte* pc) { pc_ = pc; }
+  Address pc() const { return pc_; }
   Mode rmode() const {  return rmode_; }
   intptr_t data() const { return data_; }
   Code* host() const { return host_; }
   Address constant_pool() const { return constant_pool_; }
-  void set_constant_pool(Address constant_pool) {
-    constant_pool_ = constant_pool;
-  }
 
   // Apply a relocation by delta bytes. When the code object is moved, PC
   // relative addresses have to be updated as well as absolute addresses
   // inside the code (internal references).
   // Do not forget to flush the icache afterwards!
-  INLINE(void apply(intptr_t delta));
+  V8_INLINE void apply(intptr_t delta);
 
   // Is the pointer this relocation info refers to coded like a plain pointer
   // or is it strange in some way (e.g. relative or patched into a series of
@@ -505,50 +603,55 @@ class RelocInfo {
   // constant pool, otherwise the pointer is embedded in the instruction stream.
   bool IsInConstantPool();
 
-  Address global_handle() const;
-  Address js_to_wasm_address() const;
+  // Returns the deoptimization id for the entry associated with the reloc info
+  // where {kind} is the deoptimization kind.
+  // This is only used for printing RUNTIME_ENTRY relocation info.
+  int GetDeoptimizationId(Isolate* isolate, DeoptimizeKind kind);
+
   Address wasm_call_address() const;
+  Address wasm_stub_call_address() const;
+  Address js_to_wasm_address() const;
 
-  void set_target_address(
-      Address target,
-      WriteBarrierMode write_barrier_mode = UPDATE_WRITE_BARRIER,
-      ICacheFlushMode icache_flush_mode = FLUSH_ICACHE_IF_NEEDED);
+  uint32_t wasm_call_tag() const;
 
-  void set_global_handle(Address address, ICacheFlushMode icache_flush_mode =
-                                              FLUSH_ICACHE_IF_NEEDED);
   void set_wasm_call_address(
       Address, ICacheFlushMode icache_flush_mode = FLUSH_ICACHE_IF_NEEDED);
+  void set_wasm_stub_call_address(
+      Address, ICacheFlushMode icache_flush_mode = FLUSH_ICACHE_IF_NEEDED);
   void set_js_to_wasm_address(
       Address, ICacheFlushMode icache_flush_mode = FLUSH_ICACHE_IF_NEEDED);
 
+  void set_target_address(
+      Address target,
+      WriteBarrierMode write_barrier_mode = UPDATE_WRITE_BARRIER,
+      ICacheFlushMode icache_flush_mode = FLUSH_ICACHE_IF_NEEDED);
+
   // this relocation applies to;
   // can only be called if IsCodeTarget(rmode_) || IsRuntimeEntry(rmode_)
-  INLINE(Address target_address());
-  INLINE(HeapObject* target_object());
-  INLINE(Handle<HeapObject> target_object_handle(Assembler* origin));
-  INLINE(void set_target_object(
-      HeapObject* target,
+  V8_INLINE Address target_address();
+  V8_INLINE HeapObject* target_object();
+  V8_INLINE Handle<HeapObject> target_object_handle(Assembler* origin);
+  V8_INLINE void set_target_object(
+      Heap* heap, HeapObject* target,
       WriteBarrierMode write_barrier_mode = UPDATE_WRITE_BARRIER,
-      ICacheFlushMode icache_flush_mode = FLUSH_ICACHE_IF_NEEDED));
-  INLINE(Address target_runtime_entry(Assembler* origin));
-  INLINE(void set_target_runtime_entry(
+      ICacheFlushMode icache_flush_mode = FLUSH_ICACHE_IF_NEEDED);
+  V8_INLINE Address target_runtime_entry(Assembler* origin);
+  V8_INLINE void set_target_runtime_entry(
       Address target,
       WriteBarrierMode write_barrier_mode = UPDATE_WRITE_BARRIER,
-      ICacheFlushMode icache_flush_mode = FLUSH_ICACHE_IF_NEEDED));
-  INLINE(Address target_off_heap_target());
-  INLINE(Cell* target_cell());
-  INLINE(Handle<Cell> target_cell_handle());
-  INLINE(void set_target_cell(
+      ICacheFlushMode icache_flush_mode = FLUSH_ICACHE_IF_NEEDED);
+  V8_INLINE Address target_off_heap_target();
+  V8_INLINE Cell* target_cell();
+  V8_INLINE Handle<Cell> target_cell_handle();
+  V8_INLINE void set_target_cell(
       Cell* cell, WriteBarrierMode write_barrier_mode = UPDATE_WRITE_BARRIER,
-      ICacheFlushMode icache_flush_mode = FLUSH_ICACHE_IF_NEEDED));
-  INLINE(void set_wasm_code_table_entry(
-      Address, ICacheFlushMode icache_flush_mode = FLUSH_ICACHE_IF_NEEDED));
-  INLINE(void set_target_external_reference(
-      Address, ICacheFlushMode icache_flush_mode = FLUSH_ICACHE_IF_NEEDED));
+      ICacheFlushMode icache_flush_mode = FLUSH_ICACHE_IF_NEEDED);
+  V8_INLINE void set_target_external_reference(
+      Address, ICacheFlushMode icache_flush_mode = FLUSH_ICACHE_IF_NEEDED);
 
   // Returns the address of the constant pool entry where the target address
   // is held.  This should only be called if IsInConstantPool returns true.
-  INLINE(Address constant_pool_entry_address());
+  V8_INLINE Address constant_pool_entry_address();
 
   // Read the address of the word containing the target_address in an
   // instruction stream.  What this means exactly is architecture-independent.
@@ -556,7 +659,7 @@ class RelocInfo {
   // The serializer uses it to find out how many raw bytes of instruction to
   // output before the next target.  Architecture-independent code shouldn't
   // dereference the pointer it gets back from this.
-  INLINE(Address target_address_address());
+  V8_INLINE Address target_address_address();
 
   // This indicates how much space a target takes up when deserializing a code
   // stream.  For most architectures this is just the size of a pointer.  For
@@ -567,23 +670,23 @@ class RelocInfo {
   // should return the end of the instructions to be patched, allowing the
   // deserializer to deserialize the instructions as raw bytes and put them in
   // place, ready to be patched with the target.
-  INLINE(int target_address_size());
+  V8_INLINE int target_address_size();
 
   // Read the reference in the instruction this relocation
   // applies to; can only be called if rmode_ is EXTERNAL_REFERENCE.
-  INLINE(Address target_external_reference());
+  V8_INLINE Address target_external_reference();
 
   // Read the reference in the instruction this relocation
   // applies to; can only be called if rmode_ is INTERNAL_REFERENCE.
-  INLINE(Address target_internal_reference());
+  V8_INLINE Address target_internal_reference();
 
   // Return the reference address this relocation applies to;
   // can only be called if rmode_ is INTERNAL_REFERENCE.
-  INLINE(Address target_internal_reference_address());
+  V8_INLINE Address target_internal_reference_address();
 
   // Wipe out a relocation to a fixed value, used for making snapshots
   // reproducible.
-  INLINE(void WipeOut());
+  V8_INLINE void WipeOut();
 
   template <typename ObjectVisitor>
   inline void Visit(ObjectVisitor* v);
@@ -603,26 +706,16 @@ class RelocInfo {
   void Verify(Isolate* isolate);
 #endif
 
-  static const int kCodeTargetMask = (1 << (LAST_CODE_ENUM + 1)) - 1;
   static const int kApplyMask;  // Modes affected by apply.  Depends on arch.
 
  private:
-  void set_embedded_address(Address address, ICacheFlushMode flush_mode);
-  void set_embedded_size(uint32_t size, ICacheFlushMode flush_mode);
-
-  uint32_t embedded_size() const;
-  Address embedded_address() const;
-
-  // On ARM, note that pc_ is the address of the constant pool entry
-  // to be relocated and not the address of the instruction
-  // referencing the constant pool entry (except when rmode_ ==
-  // comment).
-  byte* pc_;
+  // On ARM/ARM64, note that pc_ is the address of the instruction referencing
+  // the constant pool and not the address of the constant pool entry.
+  Address pc_;
   Mode rmode_;
   intptr_t data_ = 0;
   Code* host_;
-  Address constant_pool_ = nullptr;
-  Flags flags_;
+  Address constant_pool_ = kNullAddress;
   friend class RelocIterator;
 };
 
@@ -682,7 +775,11 @@ class RelocIterator: public Malloced {
   // Relocation information with mode k is included in the
   // iteration iff bit k of mode_mask is set.
   explicit RelocIterator(Code* code, int mode_mask = -1);
+  explicit RelocIterator(EmbeddedData* embedded_data, Code* code,
+                         int mode_mask);
   explicit RelocIterator(const CodeDesc& desc, int mode_mask = -1);
+  explicit RelocIterator(const CodeReference code_reference,
+                         int mode_mask = -1);
   explicit RelocIterator(Vector<byte> instructions,
                          Vector<const byte> reloc_info, Address const_pool,
                          int mode_mask = -1);
@@ -700,6 +797,9 @@ class RelocIterator: public Malloced {
   }
 
  private:
+  RelocIterator(Code* host, Address pc, Address constant_pool, const byte* pos,
+                const byte* end, int mode_mask);
+
   // Advance* moves the position before/after reading.
   // *Read* reads from current byte(s) into rinfo_.
   // *Get* just reads and returns info on current byte.
@@ -875,46 +975,6 @@ class ConstantPoolBuilder BASE_EMBEDDED {
   PerTypeEntryInfo info_[ConstantPoolEntry::NUMBER_OF_TYPES];
 };
 
-class HeapObjectRequest {
- public:
-  explicit HeapObjectRequest(double heap_number, int offset = -1);
-  explicit HeapObjectRequest(CodeStub* code_stub, int offset = -1);
-
-  enum Kind { kHeapNumber, kCodeStub };
-  Kind kind() const { return kind_; }
-
-  double heap_number() const {
-    DCHECK_EQ(kind(), kHeapNumber);
-    return value_.heap_number;
-  }
-
-  CodeStub* code_stub() const {
-    DCHECK_EQ(kind(), kCodeStub);
-    return value_.code_stub;
-  }
-
-  // The code buffer offset at the time of the request.
-  int offset() const {
-    DCHECK_GE(offset_, 0);
-    return offset_;
-  }
-  void set_offset(int offset) {
-    DCHECK_LT(offset_, 0);
-    offset_ = offset;
-    DCHECK_GE(offset_, 0);
-  }
-
- private:
-  Kind kind_;
-
-  union {
-    double heap_number;
-    CodeStub* code_stub;
-  } value_;
-
-  int offset_;
-};
-
 // Base type for CPU Registers.
 //
 // 1) We would prefer to use an enum for registers, but enum values are
@@ -958,8 +1018,8 @@ class RegisterBase {
   }
 
   template <RegisterCode reg_code>
-  static constexpr int bit() {
-    return 1 << code<reg_code>();
+  static constexpr RegList bit() {
+    return RegList{1} << code<reg_code>();
   }
 
   static SubType from_code(int code) {
@@ -968,11 +1028,18 @@ class RegisterBase {
     return SubType{code};
   }
 
+  // Constexpr version (pass registers as template parameters).
   template <RegisterCode... reg_codes>
   static constexpr RegList ListOf() {
     return CombineRegLists(RegisterBase::bit<reg_codes>()...);
   }
 
+  // Non-constexpr version (pass registers as method parameters).
+  template <typename... Register>
+  static RegList ListOf(Register... regs) {
+    return CombineRegLists(regs.bit()...);
+  }
+
   bool is_valid() const { return reg_code_ != kCode_no_reg; }
 
   int code() const {
@@ -980,7 +1047,7 @@ class RegisterBase {
     return reg_code_;
   }
 
-  int bit() const { return 1 << code(); }
+  RegList bit() const { return RegList{1} << code(); }
 
   inline constexpr bool operator==(SubType other) const {
     return reg_code_ == other.reg_code_;
diff --git a/deps/v8/src/ast/ast-traversal-visitor.h b/deps/v8/src/ast/ast-traversal-visitor.h
index 35432fa6476ea3..640de541b548cd 100644
--- a/deps/v8/src/ast/ast-traversal-visitor.h
+++ b/deps/v8/src/ast/ast-traversal-visitor.h
@@ -41,7 +41,7 @@ class AstTraversalVisitor : public AstVisitor<Subclass> {
 
   // Iteration left-to-right.
   void VisitDeclarations(Declaration::List* declarations);
-  void VisitStatements(ZoneList<Statement*>* statements);
+  void VisitStatements(ZonePtrList<Statement>* statements);
 
 // Individual nodes
 #define DECLARE_VISIT(type) void Visit##type(type* node);
@@ -112,7 +112,7 @@ void AstTraversalVisitor<Subclass>::VisitDeclarations(
 
 template <class Subclass>
 void AstTraversalVisitor<Subclass>::VisitStatements(
-    ZoneList<Statement*>* stmts) {
+    ZonePtrList<Statement>* stmts) {
   for (int i = 0; i < stmts->length(); ++i) {
     Statement* stmt = stmts->at(i);
     RECURSE(Visit(stmt));
@@ -198,14 +198,14 @@ void AstTraversalVisitor<Subclass>::VisitSwitchStatement(
   PROCESS_NODE(stmt);
   RECURSE(Visit(stmt->tag()));
 
-  ZoneList<CaseClause*>* clauses = stmt->cases();
+  ZonePtrList<CaseClause>* clauses = stmt->cases();
   for (int i = 0; i < clauses->length(); ++i) {
     CaseClause* clause = clauses->at(i);
     if (!clause->is_default()) {
       Expression* label = clause->label();
       RECURSE(Visit(label));
     }
-    ZoneList<Statement*>* stmts = clause->statements();
+    ZonePtrList<Statement>* stmts = clause->statements();
     RECURSE(VisitStatements(stmts));
   }
 }
@@ -330,7 +330,7 @@ void AstTraversalVisitor<Subclass>::VisitRegExpLiteral(RegExpLiteral* expr) {
 template <class Subclass>
 void AstTraversalVisitor<Subclass>::VisitObjectLiteral(ObjectLiteral* expr) {
   PROCESS_EXPRESSION(expr);
-  ZoneList<ObjectLiteralProperty*>* props = expr->properties();
+  ZonePtrList<ObjectLiteralProperty>* props = expr->properties();
   for (int i = 0; i < props->length(); ++i) {
     ObjectLiteralProperty* prop = props->at(i);
     RECURSE_EXPRESSION(Visit(prop->key()));
@@ -341,7 +341,7 @@ void AstTraversalVisitor<Subclass>::VisitObjectLiteral(ObjectLiteral* expr) {
 template <class Subclass>
 void AstTraversalVisitor<Subclass>::VisitArrayLiteral(ArrayLiteral* expr) {
   PROCESS_EXPRESSION(expr);
-  ZoneList<Expression*>* values = expr->values();
+  ZonePtrList<Expression>* values = expr->values();
   for (int i = 0; i < values->length(); ++i) {
     Expression* value = values->at(i);
     RECURSE_EXPRESSION(Visit(value));
@@ -404,7 +404,7 @@ template <class Subclass>
 void AstTraversalVisitor<Subclass>::VisitCall(Call* expr) {
   PROCESS_EXPRESSION(expr);
   RECURSE_EXPRESSION(Visit(expr->expression()));
-  ZoneList<Expression*>* args = expr->arguments();
+  ZonePtrList<Expression>* args = expr->arguments();
   for (int i = 0; i < args->length(); ++i) {
     Expression* arg = args->at(i);
     RECURSE_EXPRESSION(Visit(arg));
@@ -415,7 +415,7 @@ template <class Subclass>
 void AstTraversalVisitor<Subclass>::VisitCallNew(CallNew* expr) {
   PROCESS_EXPRESSION(expr);
   RECURSE_EXPRESSION(Visit(expr->expression()));
-  ZoneList<Expression*>* args = expr->arguments();
+  ZonePtrList<Expression>* args = expr->arguments();
   for (int i = 0; i < args->length(); ++i) {
     Expression* arg = args->at(i);
     RECURSE_EXPRESSION(Visit(arg));
@@ -425,7 +425,7 @@ void AstTraversalVisitor<Subclass>::VisitCallNew(CallNew* expr) {
 template <class Subclass>
 void AstTraversalVisitor<Subclass>::VisitCallRuntime(CallRuntime* expr) {
   PROCESS_EXPRESSION(expr);
-  ZoneList<Expression*>* args = expr->arguments();
+  ZonePtrList<Expression>* args = expr->arguments();
   for (int i = 0; i < args->length(); ++i) {
     Expression* arg = args->at(i);
     RECURSE_EXPRESSION(Visit(arg));
@@ -487,7 +487,7 @@ void AstTraversalVisitor<Subclass>::VisitClassLiteral(ClassLiteral* expr) {
   if (expr->instance_fields_initializer_function() != nullptr) {
     RECURSE_EXPRESSION(Visit(expr->instance_fields_initializer_function()));
   }
-  ZoneList<ClassLiteralProperty*>* props = expr->properties();
+  ZonePtrList<ClassLiteral::Property>* props = expr->properties();
   for (int i = 0; i < props->length(); ++i) {
     ClassLiteralProperty* prop = props->at(i);
     if (!prop->key()->IsLiteral()) {
@@ -501,7 +501,7 @@ template <class Subclass>
 void AstTraversalVisitor<Subclass>::VisitInitializeClassFieldsStatement(
     InitializeClassFieldsStatement* stmt) {
   PROCESS_NODE(stmt);
-  ZoneList<ClassLiteralProperty*>* props = stmt->fields();
+  ZonePtrList<ClassLiteral::Property>* props = stmt->fields();
   for (int i = 0; i < props->length(); ++i) {
     ClassLiteralProperty* prop = props->at(i);
     if (!prop->key()->IsLiteral()) {
diff --git a/deps/v8/src/ast/ast-value-factory.cc b/deps/v8/src/ast/ast-value-factory.cc
index 458afb8bc1d6c4..5efecc5375a33d 100644
--- a/deps/v8/src/ast/ast-value-factory.cc
+++ b/deps/v8/src/ast/ast-value-factory.cc
@@ -223,7 +223,6 @@ AstRawString* AstValueFactory::GetOneByteStringInternal(
   return GetString(hash_field, true, literal);
 }
 
-
 AstRawString* AstValueFactory::GetTwoByteStringInternal(
     Vector<const uint16_t> literal) {
   uint32_t hash_field = StringHasher::HashSequentialString<uint16_t>(
@@ -231,7 +230,6 @@ AstRawString* AstValueFactory::GetTwoByteStringInternal(
   return GetString(hash_field, false, Vector<const byte>::cast(literal));
 }
 
-
 const AstRawString* AstValueFactory::GetString(Handle<String> literal) {
   AstRawString* result = nullptr;
   DisallowHeapAllocation no_gc;
@@ -280,7 +278,6 @@ void AstValueFactory::Internalize(Isolate* isolate) {
   ResetStrings();
 }
 
-
 AstRawString* AstValueFactory::GetString(uint32_t hash_field, bool is_one_byte,
                                          Vector<const byte> literal_bytes) {
   // literal_bytes here points to whatever the user passed, and this is OK
diff --git a/deps/v8/src/ast/ast.cc b/deps/v8/src/ast/ast.cc
index 392af8a5013afb..5a4add60390970 100644
--- a/deps/v8/src/ast/ast.cc
+++ b/deps/v8/src/ast/ast.cc
@@ -7,7 +7,6 @@
 #include <cmath>  // For isfinite.
 #include <vector>
 
-#include "src/ast/compile-time-value.h"
 #include "src/ast/prettyprinter.h"
 #include "src/ast/scopes.h"
 #include "src/base/hashmap.h"
@@ -19,6 +18,7 @@
 #include "src/double.h"
 #include "src/elements.h"
 #include "src/objects-inl.h"
+#include "src/objects/literal-objects-inl.h"
 #include "src/objects/literal-objects.h"
 #include "src/objects/map.h"
 #include "src/property-details.h"
@@ -114,6 +114,13 @@ bool Expression::IsTheHoleLiteral() const {
   return IsLiteral() && AsLiteral()->type() == Literal::kTheHole;
 }
 
+bool Expression::IsCompileTimeValue() {
+  if (IsLiteral()) return true;
+  MaterializedLiteral* literal = AsMaterializedLiteral();
+  if (literal == nullptr) return false;
+  return literal->IsSimple();
+}
+
 bool Expression::IsUndefinedLiteral() const {
   if (IsLiteral() && AsLiteral()->type() == Literal::kUndefined) return true;
 
@@ -276,7 +283,9 @@ std::unique_ptr<char[]> FunctionLiteral::GetDebugName() const {
     AllowHandleDereference allow_deref;
     return inferred_name_->ToCString();
   } else {
-    return std::unique_ptr<char[]>(new char{'\0'});
+    char* empty_str = new char[1];
+    empty_str[0] = 0;
+    return std::unique_ptr<char[]>(empty_str);
   }
 
   // TODO(rmcilroy): Deal with two-character strings.
@@ -332,8 +341,7 @@ ClassLiteralProperty::ClassLiteralProperty(Expression* key, Expression* value,
 
 bool ObjectLiteral::Property::IsCompileTimeValue() const {
   return kind_ == CONSTANT ||
-      (kind_ == MATERIALIZED_LITERAL &&
-       CompileTimeValue::IsCompileTimeValue(value_));
+         (kind_ == MATERIALIZED_LITERAL && value_->IsCompileTimeValue());
 }
 
 
@@ -358,19 +366,37 @@ void ObjectLiteral::CalculateEmitStore(Zone* zone) {
     Literal* literal = property->key()->AsLiteral();
     DCHECK(!literal->IsNullLiteral());
 
-    // If there is an existing entry do not emit a store unless the previous
-    // entry was also an accessor.
     uint32_t hash = literal->Hash();
     ZoneHashMap::Entry* entry = table.LookupOrInsert(literal, hash, allocator);
-    if (entry->value != nullptr) {
-      auto previous_kind =
+    if (entry->value == nullptr) {
+      entry->value = property;
+    } else {
+      // We already have a later definition of this property, so we don't need
+      // to emit a store for the current one.
+      //
+      // There are two subtleties here.
+      //
+      // (1) Emitting a store might actually be incorrect. For example, in {get
+      // foo() {}, foo: 42}, the getter store would override the data property
+      // (which, being a non-computed compile-time valued property, is already
+      // part of the initial literal object.
+      //
+      // (2) If the later definition is an accessor (say, a getter), and the
+      // current definition is a complementary accessor (here, a setter), then
+      // we still must emit a store for the current definition.
+
+      auto later_kind =
           static_cast<ObjectLiteral::Property*>(entry->value)->kind();
-      if (!((property->kind() == GETTER && previous_kind == SETTER) ||
-            (property->kind() == SETTER && previous_kind == GETTER))) {
+      bool complementary_accessors =
+          (property->kind() == GETTER && later_kind == SETTER) ||
+          (property->kind() == SETTER && later_kind == GETTER);
+      if (!complementary_accessors) {
         property->set_emit_store(false);
+        if (later_kind == GETTER || later_kind == SETTER) {
+          entry->value = property;
+        }
       }
     }
-    entry->value = property;
   }
 }
 
@@ -425,7 +451,7 @@ int ObjectLiteral::InitDepthAndFlags() {
     Literal* key = property->key()->AsLiteral();
     Expression* value = property->value();
 
-    bool is_compile_time_value = CompileTimeValue::IsCompileTimeValue(value);
+    bool is_compile_time_value = value->IsCompileTimeValue();
     is_simple = is_simple && is_compile_time_value;
 
     // Keep track of the number of elements in the object literal and
@@ -452,8 +478,8 @@ int ObjectLiteral::InitDepthAndFlags() {
   return depth_acc;
 }
 
-void ObjectLiteral::BuildConstantProperties(Isolate* isolate) {
-  if (!constant_properties_.is_null()) return;
+void ObjectLiteral::BuildBoilerplateDescription(Isolate* isolate) {
+  if (!boilerplate_description_.is_null()) return;
 
   int index_keys = 0;
   bool has_seen_proto = false;
@@ -474,17 +500,17 @@ void ObjectLiteral::BuildConstantProperties(Isolate* isolate) {
     }
   }
 
-  Handle<BoilerplateDescription> constant_properties =
-      isolate->factory()->NewBoilerplateDescription(boilerplate_properties_,
-                                                    properties()->length(),
-                                                    index_keys, has_seen_proto);
+  Handle<ObjectBoilerplateDescription> boilerplate_description =
+      isolate->factory()->NewObjectBoilerplateDescription(
+          boilerplate_properties_, properties()->length(), index_keys,
+          has_seen_proto);
 
   int position = 0;
   for (int i = 0; i < properties()->length(); i++) {
     ObjectLiteral::Property* property = properties()->at(i);
     if (property->IsPrototype()) continue;
 
-    if (static_cast<uint32_t>(position) == boilerplate_properties_ * 2) {
+    if (static_cast<uint32_t>(position) == boilerplate_properties_) {
       DCHECK(property->is_computed_name());
       break;
     }
@@ -508,11 +534,12 @@ void ObjectLiteral::BuildConstantProperties(Isolate* isolate) {
     Handle<Object> value = GetBoilerplateValue(property->value(), isolate);
 
     // Add name, value pair to the fixed array.
-    constant_properties->set(position++, *key);
-    constant_properties->set(position++, *value);
+    boilerplate_description->set_key_value(position++, *key, *value);
   }
 
-  constant_properties_ = constant_properties;
+  boilerplate_description->set_flags(EncodeLiteralType());
+
+  boilerplate_description_ = boilerplate_description;
 }
 
 bool ObjectLiteral::IsFastCloningSupported() const {
@@ -526,8 +553,8 @@ bool ObjectLiteral::IsFastCloningSupported() const {
 
 bool ArrayLiteral::is_empty() const {
   DCHECK(is_initialized());
-  return values()->is_empty() &&
-         (constant_elements().is_null() || constant_elements()->is_empty());
+  return values()->is_empty() && (boilerplate_description().is_null() ||
+                                  boilerplate_description()->is_empty());
 }
 
 int ArrayLiteral::InitDepthAndFlags() {
@@ -548,7 +575,7 @@ int ArrayLiteral::InitDepthAndFlags() {
       if (subliteral_depth > depth_acc) depth_acc = subliteral_depth;
     }
 
-    if (!CompileTimeValue::IsCompileTimeValue(element)) {
+    if (!element->IsCompileTimeValue()) {
       is_simple = false;
     }
   }
@@ -561,8 +588,8 @@ int ArrayLiteral::InitDepthAndFlags() {
   return depth_acc;
 }
 
-void ArrayLiteral::BuildConstantElements(Isolate* isolate) {
-  if (!constant_elements_.is_null()) return;
+void ArrayLiteral::BuildBoilerplateDescription(Isolate* isolate) {
+  if (!boilerplate_description_.is_null()) return;
 
   int constants_length =
       first_spread_index_ >= 0 ? first_spread_index_ : values()->length();
@@ -604,7 +631,7 @@ void ArrayLiteral::BuildConstantElements(Isolate* isolate) {
   // elements array to a copy-on-write array.
   if (is_simple() && depth() == 1 && array_index > 0 &&
       IsSmiOrObjectElementsKind(kind)) {
-    fixed_array->set_map(isolate->heap()->fixed_cow_array_map());
+    fixed_array->set_map(ReadOnlyRoots(isolate).fixed_cow_array_map());
   }
 
   Handle<FixedArrayBase> elements = fixed_array;
@@ -613,14 +640,12 @@ void ArrayLiteral::BuildConstantElements(Isolate* isolate) {
     elements = isolate->factory()->NewFixedDoubleArray(constants_length);
     // We are copying from non-fast-double to fast-double.
     ElementsKind from_kind = TERMINAL_FAST_ELEMENTS_KIND;
-    accessor->CopyElements(fixed_array, from_kind, elements, constants_length);
+    accessor->CopyElements(isolate, fixed_array, from_kind, elements,
+                           constants_length);
   }
 
-  // Remember both the literal's constant values as well as the ElementsKind.
-  Handle<ConstantElementsPair> literals =
-      isolate->factory()->NewConstantElementsPair(kind, elements);
-
-  constant_elements_ = literals;
+  boilerplate_description_ =
+      isolate->factory()->NewArrayBoilerplateDescription(kind, elements);
 }
 
 bool ArrayLiteral::IsFastCloningSupported() const {
@@ -641,8 +666,17 @@ Handle<Object> MaterializedLiteral::GetBoilerplateValue(Expression* expression,
   if (expression->IsLiteral()) {
     return expression->AsLiteral()->BuildValue(isolate);
   }
-  if (CompileTimeValue::IsCompileTimeValue(expression)) {
-    return CompileTimeValue::GetValue(isolate, expression);
+  if (expression->IsCompileTimeValue()) {
+    if (expression->IsObjectLiteral()) {
+      ObjectLiteral* object_literal = expression->AsObjectLiteral();
+      DCHECK(object_literal->is_simple());
+      return object_literal->boilerplate_description();
+    } else {
+      DCHECK(expression->IsArrayLiteral());
+      ArrayLiteral* array_literal = expression->AsArrayLiteral();
+      DCHECK(array_literal->is_simple());
+      return array_literal->boilerplate_description();
+    }
   }
   return isolate->factory()->uninitialized_value();
 }
@@ -667,10 +701,12 @@ bool MaterializedLiteral::NeedsInitialAllocationSite() {
 
 void MaterializedLiteral::BuildConstants(Isolate* isolate) {
   if (IsArrayLiteral()) {
-    return AsArrayLiteral()->BuildConstantElements(isolate);
+    AsArrayLiteral()->BuildBoilerplateDescription(isolate);
+    return;
   }
   if (IsObjectLiteral()) {
-    return AsObjectLiteral()->BuildConstantProperties(isolate);
+    AsObjectLiteral()->BuildBoilerplateDescription(isolate);
+    return;
   }
   DCHECK(IsRegExpLiteral());
 }
@@ -696,7 +732,7 @@ Handle<TemplateObjectDescription> GetTemplateObject::GetOrBuildDescription(
       if (this->cooked_strings()->at(i) != nullptr) {
         cooked_strings->set(i, *this->cooked_strings()->at(i)->string());
       } else {
-        cooked_strings->set(i, isolate->heap()->undefined_value());
+        cooked_strings->set(i, ReadOnlyRoots(isolate).undefined_value());
       }
     }
   }
@@ -804,9 +840,10 @@ Call::CallType Call::GetCallType() const {
     if (proxy->var()->IsUnallocated()) {
       return GLOBAL_CALL;
     } else if (proxy->var()->IsLookupSlot()) {
-      // Calls going through 'with' always use DYNAMIC rather than DYNAMIC_LOCAL
-      // or DYNAMIC_GLOBAL.
-      return proxy->var()->mode() == DYNAMIC ? WITH_CALL : OTHER_CALL;
+      // Calls going through 'with' always use VariableMode::kDynamic rather
+      // than VariableMode::kDynamicLocal or VariableMode::kDynamicGlobal.
+      return proxy->var()->mode() == VariableMode::kDynamic ? WITH_CALL
+                                                            : OTHER_CALL;
     }
   }
 
@@ -829,7 +866,7 @@ Call::CallType Call::GetCallType() const {
   return OTHER_CALL;
 }
 
-CaseClause::CaseClause(Expression* label, ZoneList<Statement*>* statements)
+CaseClause::CaseClause(Expression* label, ZonePtrList<Statement>* statements)
     : label_(label), statements_(statements) {}
 
 bool Literal::IsPropertyName() const {
@@ -952,7 +989,7 @@ const char* CallRuntime::debug_name() {
   case k##NodeType:             \
     return static_cast<const NodeType*>(this)->labels();
 
-ZoneList<const AstRawString*>* BreakableStatement::labels() const {
+ZonePtrList<const AstRawString>* BreakableStatement::labels() const {
   switch (node_type()) {
     BREAKABLE_NODE_LIST(RETURN_LABELS)
     ITERATION_NODE_LIST(RETURN_LABELS)
diff --git a/deps/v8/src/ast/ast.h b/deps/v8/src/ast/ast.h
index b95d54abb9bd93..5a2346ad9f8658 100644
--- a/deps/v8/src/ast/ast.h
+++ b/deps/v8/src/ast/ast.h
@@ -241,6 +241,8 @@ class Expression : public AstNode {
   // that this also checks for loads of the global "undefined" variable.
   bool IsUndefinedLiteral() const;
 
+  bool IsCompileTimeValue();
+
  protected:
   Expression(int pos, NodeType type) : AstNode(pos, type) {}
 
@@ -255,7 +257,7 @@ class BreakableStatement : public Statement {
     TARGET_FOR_NAMED_ONLY
   };
 
-  ZoneList<const AstRawString*>* labels() const;
+  ZonePtrList<const AstRawString>* labels() const;
 
   // Testers.
   bool is_target_for_anonymous() const {
@@ -277,12 +279,12 @@ class BreakableStatement : public Statement {
 
 class Block : public BreakableStatement {
  public:
-  ZoneList<Statement*>* statements() { return &statements_; }
+  ZonePtrList<Statement>* statements() { return &statements_; }
   bool ignore_completion_value() const {
     return IgnoreCompletionField::decode(bit_field_);
   }
 
-  inline ZoneList<const AstRawString*>* labels() const;
+  inline ZonePtrList<const AstRawString>* labels() const;
 
   bool IsJump() const {
     return !statements_.is_empty() && statements_.last()->IsJump() &&
@@ -295,7 +297,7 @@ class Block : public BreakableStatement {
  private:
   friend class AstNodeFactory;
 
-  ZoneList<Statement*> statements_;
+  ZonePtrList<Statement> statements_;
   Scope* scope_;
 
   class IgnoreCompletionField
@@ -304,7 +306,7 @@ class Block : public BreakableStatement {
       : public BitField<bool, IgnoreCompletionField::kNext, 1> {};
 
  protected:
-  Block(Zone* zone, ZoneList<const AstRawString*>* labels, int capacity,
+  Block(Zone* zone, ZonePtrList<const AstRawString>* labels, int capacity,
         bool ignore_completion_value)
       : BreakableStatement(TARGET_FOR_NAMED_ONLY, kNoSourcePosition, kBlock),
         statements_(capacity, zone),
@@ -319,18 +321,18 @@ class LabeledBlock final : public Block {
   friend class AstNodeFactory;
   friend class Block;
 
-  LabeledBlock(Zone* zone, ZoneList<const AstRawString*>* labels, int capacity,
-               bool ignore_completion_value)
+  LabeledBlock(Zone* zone, ZonePtrList<const AstRawString>* labels,
+               int capacity, bool ignore_completion_value)
       : Block(zone, labels, capacity, ignore_completion_value),
         labels_(labels) {
     DCHECK_NOT_NULL(labels);
     DCHECK_GT(labels->length(), 0);
   }
 
-  ZoneList<const AstRawString*>* labels_;
+  ZonePtrList<const AstRawString>* labels_;
 };
 
-inline ZoneList<const AstRawString*>* Block::labels() const {
+inline ZonePtrList<const AstRawString>* Block::labels() const {
   if (IsLabeledField::decode(bit_field_)) {
     return static_cast<const LabeledBlock*>(this)->labels_;
   }
@@ -437,10 +439,10 @@ class IterationStatement : public BreakableStatement {
   Statement* body() const { return body_; }
   void set_body(Statement* s) { body_ = s; }
 
-  ZoneList<const AstRawString*>* labels() const { return labels_; }
+  ZonePtrList<const AstRawString>* labels() const { return labels_; }
 
  protected:
-  IterationStatement(ZoneList<const AstRawString*>* labels, int pos,
+  IterationStatement(ZonePtrList<const AstRawString>* labels, int pos,
                      NodeType type)
       : BreakableStatement(TARGET_FOR_ANONYMOUS, pos, type),
         labels_(labels),
@@ -451,7 +453,7 @@ class IterationStatement : public BreakableStatement {
       BreakableStatement::kNextBitFieldIndex;
 
  private:
-  ZoneList<const AstRawString*>* labels_;
+  ZonePtrList<const AstRawString>* labels_;
   Statement* body_;
 };
 
@@ -468,7 +470,7 @@ class DoWhileStatement final : public IterationStatement {
  private:
   friend class AstNodeFactory;
 
-  DoWhileStatement(ZoneList<const AstRawString*>* labels, int pos)
+  DoWhileStatement(ZonePtrList<const AstRawString>* labels, int pos)
       : IterationStatement(labels, pos, kDoWhileStatement), cond_(nullptr) {}
 
   Expression* cond_;
@@ -487,7 +489,7 @@ class WhileStatement final : public IterationStatement {
  private:
   friend class AstNodeFactory;
 
-  WhileStatement(ZoneList<const AstRawString*>* labels, int pos)
+  WhileStatement(ZonePtrList<const AstRawString>* labels, int pos)
       : IterationStatement(labels, pos, kWhileStatement), cond_(nullptr) {}
 
   Expression* cond_;
@@ -511,7 +513,7 @@ class ForStatement final : public IterationStatement {
  private:
   friend class AstNodeFactory;
 
-  ForStatement(ZoneList<const AstRawString*>* labels, int pos)
+  ForStatement(ZonePtrList<const AstRawString>* labels, int pos)
       : IterationStatement(labels, pos, kForStatement),
         init_(nullptr),
         cond_(nullptr),
@@ -537,7 +539,7 @@ class ForEachStatement : public IterationStatement {
   }
 
  protected:
-  ForEachStatement(ZoneList<const AstRawString*>* labels, int pos,
+  ForEachStatement(ZonePtrList<const AstRawString>* labels, int pos,
                    NodeType type)
       : IterationStatement(labels, pos, type) {}
 };
@@ -564,7 +566,7 @@ class ForInStatement final : public ForEachStatement {
  private:
   friend class AstNodeFactory;
 
-  ForInStatement(ZoneList<const AstRawString*>* labels, int pos)
+  ForInStatement(ZonePtrList<const AstRawString>* labels, int pos)
       : ForEachStatement(labels, pos, kForInStatement),
         each_(nullptr),
         subject_(nullptr) {
@@ -630,7 +632,7 @@ class ForOfStatement final : public ForEachStatement {
  private:
   friend class AstNodeFactory;
 
-  ForOfStatement(ZoneList<const AstRawString*>* labels, int pos)
+  ForOfStatement(ZonePtrList<const AstRawString>* labels, int pos)
       : ForEachStatement(labels, pos, kForOfStatement),
         iterator_(nullptr),
         assign_iterator_(nullptr),
@@ -757,40 +759,40 @@ class CaseClause final : public ZoneObject {
     DCHECK(!is_default());
     return label_;
   }
-  ZoneList<Statement*>* statements() const { return statements_; }
+  ZonePtrList<Statement>* statements() const { return statements_; }
 
  private:
   friend class AstNodeFactory;
 
-  CaseClause(Expression* label, ZoneList<Statement*>* statements);
+  CaseClause(Expression* label, ZonePtrList<Statement>* statements);
 
   Expression* label_;
-  ZoneList<Statement*>* statements_;
+  ZonePtrList<Statement>* statements_;
 };
 
 
 class SwitchStatement final : public BreakableStatement {
  public:
-  ZoneList<const AstRawString*>* labels() const { return labels_; }
+  ZonePtrList<const AstRawString>* labels() const { return labels_; }
 
   Expression* tag() const { return tag_; }
   void set_tag(Expression* t) { tag_ = t; }
 
-  ZoneList<CaseClause*>* cases() { return &cases_; }
+  ZonePtrList<CaseClause>* cases() { return &cases_; }
 
  private:
   friend class AstNodeFactory;
 
-  SwitchStatement(Zone* zone, ZoneList<const AstRawString*>* labels,
+  SwitchStatement(Zone* zone, ZonePtrList<const AstRawString>* labels,
                   Expression* tag, int pos)
       : BreakableStatement(TARGET_FOR_ANONYMOUS, pos, kSwitchStatement),
         labels_(labels),
         tag_(tag),
         cases_(4, zone) {}
 
-  ZoneList<const AstRawString*>* labels_;
+  ZonePtrList<const AstRawString>* labels_;
   Expression* tag_;
-  ZoneList<CaseClause*> cases_;
+  ZonePtrList<CaseClause> cases_;
 };
 
 
@@ -1120,8 +1122,8 @@ class MaterializedLiteral : public Expression {
   void BuildConstants(Isolate* isolate);
 
   // If the expression is a literal, return the literal value;
-  // if the expression is a materialized literal and is simple return a
-  // compile time value as encoded by CompileTimeValue::GetValue().
+  // if the expression is a materialized literal and is_simple
+  // then return an Array or Object Boilerplate Description
   // Otherwise, return undefined literal as the placeholder
   // in the object literal boilerplate.
   Handle<Object> GetBoilerplateValue(Expression* expression, Isolate* isolate);
@@ -1275,12 +1277,12 @@ class ObjectLiteral final : public AggregateLiteral {
  public:
   typedef ObjectLiteralProperty Property;
 
-  Handle<BoilerplateDescription> constant_properties() const {
-    DCHECK(!constant_properties_.is_null());
-    return constant_properties_;
+  Handle<ObjectBoilerplateDescription> boilerplate_description() const {
+    DCHECK(!boilerplate_description_.is_null());
+    return boilerplate_description_;
   }
   int properties_count() const { return boilerplate_properties_; }
-  ZoneList<Property*>* properties() const { return properties_; }
+  ZonePtrList<Property>* properties() const { return properties_; }
   bool has_elements() const { return HasElementsField::decode(bit_field_); }
   bool has_rest_property() const {
     return HasRestPropertyField::decode(bit_field_);
@@ -1303,17 +1305,17 @@ class ObjectLiteral final : public AggregateLiteral {
   // Populate the depth field and flags, returns the depth.
   int InitDepthAndFlags();
 
-  // Get the constant properties fixed array, populating it if necessary.
-  Handle<BoilerplateDescription> GetOrBuildConstantProperties(
+  // Get the boilerplate description, populating it if necessary.
+  Handle<ObjectBoilerplateDescription> GetOrBuildBoilerplateDescription(
       Isolate* isolate) {
-    if (constant_properties_.is_null()) {
-      BuildConstantProperties(isolate);
+    if (boilerplate_description_.is_null()) {
+      BuildBoilerplateDescription(isolate);
     }
-    return constant_properties();
+    return boilerplate_description();
   }
 
-  // Populate the constant properties fixed array.
-  void BuildConstantProperties(Isolate* isolate);
+  // Populate the boilerplate description.
+  void BuildBoilerplateDescription(Isolate* isolate);
 
   // Mark all computed expressions that are bound to a key that
   // is shadowed by a later occurrence of the same key. For the
@@ -1355,7 +1357,7 @@ class ObjectLiteral final : public AggregateLiteral {
  private:
   friend class AstNodeFactory;
 
-  ObjectLiteral(ZoneList<Property*>* properties,
+  ObjectLiteral(ZonePtrList<Property>* properties,
                 uint32_t boilerplate_properties, int pos,
                 bool has_rest_property)
       : AggregateLiteral(pos, kObjectLiteral),
@@ -1380,7 +1382,7 @@ class ObjectLiteral final : public AggregateLiteral {
   }
 
   uint32_t boilerplate_properties_;
-  Handle<BoilerplateDescription> constant_properties_;
+  Handle<ObjectBoilerplateDescription> boilerplate_description_;
   ZoneList<Property*>* properties_;
 
   class HasElementsField
@@ -1423,27 +1425,30 @@ class AccessorTable
 // for minimizing the work when constructing it at runtime.
 class ArrayLiteral final : public AggregateLiteral {
  public:
-  Handle<ConstantElementsPair> constant_elements() const {
-    return constant_elements_;
+  Handle<ArrayBoilerplateDescription> boilerplate_description() const {
+    return boilerplate_description_;
   }
 
-  ZoneList<Expression*>* values() const { return values_; }
+  ZonePtrList<Expression>* values() const { return values_; }
+
+  int first_spread_index() const { return first_spread_index_; }
 
   bool is_empty() const;
 
   // Populate the depth field and flags, returns the depth.
   int InitDepthAndFlags();
 
-  // Get the constant elements fixed array, populating it if necessary.
-  Handle<ConstantElementsPair> GetOrBuildConstantElements(Isolate* isolate) {
-    if (constant_elements_.is_null()) {
-      BuildConstantElements(isolate);
+  // Get the boilerplate description, populating it if necessary.
+  Handle<ArrayBoilerplateDescription> GetOrBuildBoilerplateDescription(
+      Isolate* isolate) {
+    if (boilerplate_description_.is_null()) {
+      BuildBoilerplateDescription(isolate);
     }
-    return constant_elements();
+    return boilerplate_description();
   }
 
-  // Populate the constant elements fixed array.
-  void BuildConstantElements(Isolate* isolate);
+  // Populate the boilerplate description.
+  void BuildBoilerplateDescription(Isolate* isolate);
 
   // Determines whether the {CreateShallowArrayLiteral} builtin can be used.
   bool IsFastCloningSupported() const;
@@ -1453,28 +1458,17 @@ class ArrayLiteral final : public AggregateLiteral {
     return AggregateLiteral::ComputeFlags(disable_mementos);
   }
 
-  // Provide a mechanism for iterating through values to rewrite spreads.
-  ZoneList<Expression*>::iterator FirstSpreadOrEndValue() const {
-    return (first_spread_index_ >= 0) ? values_->begin() + first_spread_index_
-                                      : values_->end();
-  }
-  ZoneList<Expression*>::iterator BeginValue() const {
-    return values_->begin();
-  }
-  ZoneList<Expression*>::iterator EndValue() const { return values_->end(); }
-
  private:
   friend class AstNodeFactory;
 
-  ArrayLiteral(ZoneList<Expression*>* values, int first_spread_index, int pos)
+  ArrayLiteral(ZonePtrList<Expression>* values, int first_spread_index, int pos)
       : AggregateLiteral(pos, kArrayLiteral),
         first_spread_index_(first_spread_index),
-        values_(values) {
-  }
+        values_(values) {}
 
   int first_spread_index_;
-  Handle<ConstantElementsPair> constant_elements_;
-  ZoneList<Expression*>* values_;
+  Handle<ArrayBoilerplateDescription> boilerplate_description_;
+  ZonePtrList<Expression>* values_;
 };
 
 enum class HoleCheckMode { kRequired, kElided };
@@ -1641,7 +1635,7 @@ class ResolvedProperty final : public Expression {
 class Call final : public Expression {
  public:
   Expression* expression() const { return expression_; }
-  ZoneList<Expression*>* arguments() const { return arguments_; }
+  ZonePtrList<Expression>* arguments() const { return arguments_; }
 
   bool is_possibly_eval() const {
     return IsPossiblyEvalField::decode(bit_field_);
@@ -1680,17 +1674,15 @@ class Call final : public Expression {
  private:
   friend class AstNodeFactory;
 
-  Call(Expression* expression, ZoneList<Expression*>* arguments, int pos,
+  Call(Expression* expression, ZonePtrList<Expression>* arguments, int pos,
        PossiblyEval possibly_eval)
-      : Expression(pos, kCall),
-        expression_(expression),
-        arguments_(arguments) {
+      : Expression(pos, kCall), expression_(expression), arguments_(arguments) {
     bit_field_ |=
         IsPossiblyEvalField::encode(possibly_eval == IS_POSSIBLY_EVAL) |
         IsTaggedTemplateField::encode(false);
   }
 
-  Call(Expression* expression, ZoneList<Expression*>* arguments, int pos,
+  Call(Expression* expression, ZonePtrList<Expression>* arguments, int pos,
        TaggedTemplateTag tag)
       : Expression(pos, kCall), expression_(expression), arguments_(arguments) {
     bit_field_ |= IsPossiblyEvalField::encode(false) |
@@ -1703,14 +1695,14 @@ class Call final : public Expression {
       : public BitField<bool, IsPossiblyEvalField::kNext, 1> {};
 
   Expression* expression_;
-  ZoneList<Expression*>* arguments_;
+  ZonePtrList<Expression>* arguments_;
 };
 
 
 class CallNew final : public Expression {
  public:
   Expression* expression() const { return expression_; }
-  ZoneList<Expression*>* arguments() const { return arguments_; }
+  ZonePtrList<Expression>* arguments() const { return arguments_; }
 
   bool only_last_arg_is_spread() {
     return !arguments_->is_empty() && arguments_->last()->IsSpread();
@@ -1719,14 +1711,13 @@ class CallNew final : public Expression {
  private:
   friend class AstNodeFactory;
 
-  CallNew(Expression* expression, ZoneList<Expression*>* arguments, int pos)
+  CallNew(Expression* expression, ZonePtrList<Expression>* arguments, int pos)
       : Expression(pos, kCallNew),
         expression_(expression),
-        arguments_(arguments) {
-  }
+        arguments_(arguments) {}
 
   Expression* expression_;
-  ZoneList<Expression*>* arguments_;
+  ZonePtrList<Expression>* arguments_;
 };
 
 // The CallRuntime class does not represent any official JavaScript
@@ -1735,7 +1726,7 @@ class CallNew final : public Expression {
 // implemented in JavaScript.
 class CallRuntime final : public Expression {
  public:
-  ZoneList<Expression*>* arguments() const { return arguments_; }
+  ZonePtrList<Expression>* arguments() const { return arguments_; }
   bool is_jsruntime() const { return function_ == nullptr; }
 
   int context_index() const {
@@ -1753,11 +1744,11 @@ class CallRuntime final : public Expression {
   friend class AstNodeFactory;
 
   CallRuntime(const Runtime::Function* function,
-              ZoneList<Expression*>* arguments, int pos)
+              ZonePtrList<Expression>* arguments, int pos)
       : Expression(pos, kCallRuntime),
         function_(function),
         arguments_(arguments) {}
-  CallRuntime(int context_index, ZoneList<Expression*>* arguments, int pos)
+  CallRuntime(int context_index, ZonePtrList<Expression>* arguments, int pos)
       : Expression(pos, kCallRuntime),
         context_index_(context_index),
         function_(nullptr),
@@ -1765,7 +1756,7 @@ class CallRuntime final : public Expression {
 
   int context_index_;
   const Runtime::Function* function_;
-  ZoneList<Expression*>* arguments_;
+  ZonePtrList<Expression>* arguments_;
 };
 
 
@@ -2198,7 +2189,7 @@ class FunctionLiteral final : public Expression {
   const AstConsString* raw_name() const { return raw_name_; }
   void set_raw_name(const AstConsString* name) { raw_name_ = name; }
   DeclarationScope* scope() const { return scope_; }
-  ZoneList<Statement*>* body() const { return body_; }
+  ZonePtrList<Statement>* body() const { return body_; }
   void set_function_token_position(int pos) { function_token_position_ = pos; }
   int function_token_position() const { return function_token_position_; }
   int start_position() const;
@@ -2318,7 +2309,7 @@ class FunctionLiteral final : public Expression {
 
   FunctionLiteral(
       Zone* zone, const AstRawString* name, AstValueFactory* ast_value_factory,
-      DeclarationScope* scope, ZoneList<Statement*>* body,
+      DeclarationScope* scope, ZonePtrList<Statement>* body,
       int expected_property_count, int parameter_count, int function_length,
       FunctionType function_type, ParameterFlag has_duplicate_parameters,
       EagerCompileHint eager_compile_hint, int position, bool has_braces,
@@ -2367,7 +2358,7 @@ class FunctionLiteral final : public Expression {
 
   const AstConsString* raw_name_;
   DeclarationScope* scope_;
-  ZoneList<Statement*>* body_;
+  ZonePtrList<Statement>* body_;
   const AstConsString* raw_inferred_name_;
   Handle<String> inferred_name_;
   ProducedPreParsedScopeData* produced_preparsed_scope_data_;
@@ -2415,15 +2406,16 @@ class ClassLiteralProperty final : public LiteralProperty {
 class InitializeClassFieldsStatement final : public Statement {
  public:
   typedef ClassLiteralProperty Property;
-  ZoneList<Property*>* fields() const { return fields_; }
+
+  ZonePtrList<Property>* fields() const { return fields_; }
 
  private:
   friend class AstNodeFactory;
 
-  InitializeClassFieldsStatement(ZoneList<Property*>* fields, int pos)
+  InitializeClassFieldsStatement(ZonePtrList<Property>* fields, int pos)
       : Statement(pos, kInitializeClassFieldsStatement), fields_(fields) {}
 
-  ZoneList<Property*>* fields_;
+  ZonePtrList<Property>* fields_;
 };
 
 class ClassLiteral final : public Expression {
@@ -2434,7 +2426,7 @@ class ClassLiteral final : public Expression {
   Variable* class_variable() const { return class_variable_; }
   Expression* extends() const { return extends_; }
   FunctionLiteral* constructor() const { return constructor_; }
-  ZoneList<Property*>* properties() const { return properties_; }
+  ZonePtrList<Property>* properties() const { return properties_; }
   int start_position() const { return position(); }
   int end_position() const { return end_position_; }
   bool has_name_static_property() const {
@@ -2463,7 +2455,7 @@ class ClassLiteral final : public Expression {
   friend class AstNodeFactory;
 
   ClassLiteral(Scope* scope, Variable* class_variable, Expression* extends,
-               FunctionLiteral* constructor, ZoneList<Property*>* properties,
+               FunctionLiteral* constructor, ZonePtrList<Property>* properties,
                FunctionLiteral* static_fields_initializer,
                FunctionLiteral* instance_fields_initializer_function,
                int start_position, int end_position,
@@ -2489,7 +2481,7 @@ class ClassLiteral final : public Expression {
   Variable* class_variable_;
   Expression* extends_;
   FunctionLiteral* constructor_;
-  ZoneList<Property*>* properties_;
+  ZonePtrList<Property>* properties_;
   FunctionLiteral* static_fields_initializer_;
   FunctionLiteral* instance_fields_initializer_function_;
   class HasNameStaticProperty
@@ -2644,10 +2636,10 @@ class GetIterator final : public Expression {
 // (defined at https://tc39.github.io/ecma262/#sec-gettemplateobject).
 class GetTemplateObject final : public Expression {
  public:
-  const ZoneList<const AstRawString*>* cooked_strings() const {
+  const ZonePtrList<const AstRawString>* cooked_strings() const {
     return cooked_strings_;
   }
-  const ZoneList<const AstRawString*>* raw_strings() const {
+  const ZonePtrList<const AstRawString>* raw_strings() const {
     return raw_strings_;
   }
 
@@ -2656,34 +2648,35 @@ class GetTemplateObject final : public Expression {
  private:
   friend class AstNodeFactory;
 
-  GetTemplateObject(const ZoneList<const AstRawString*>* cooked_strings,
-                    const ZoneList<const AstRawString*>* raw_strings, int pos)
+  GetTemplateObject(const ZonePtrList<const AstRawString>* cooked_strings,
+                    const ZonePtrList<const AstRawString>* raw_strings, int pos)
       : Expression(pos, kGetTemplateObject),
         cooked_strings_(cooked_strings),
         raw_strings_(raw_strings) {}
 
-  const ZoneList<const AstRawString*>* cooked_strings_;
-  const ZoneList<const AstRawString*>* raw_strings_;
+  const ZonePtrList<const AstRawString>* cooked_strings_;
+  const ZonePtrList<const AstRawString>* raw_strings_;
 };
 
 class TemplateLiteral final : public Expression {
  public:
-  using StringList = ZoneList<const AstRawString*>;
-  using ExpressionList = ZoneList<Expression*>;
-
-  const StringList* string_parts() const { return string_parts_; }
-  const ExpressionList* substitutions() const { return substitutions_; }
+  const ZonePtrList<const AstRawString>* string_parts() const {
+    return string_parts_;
+  }
+  const ZonePtrList<Expression>* substitutions() const {
+    return substitutions_;
+  }
 
  private:
   friend class AstNodeFactory;
-  TemplateLiteral(const StringList* parts, const ExpressionList* substitutions,
-                  int pos)
+  TemplateLiteral(const ZonePtrList<const AstRawString>* parts,
+                  const ZonePtrList<Expression>* substitutions, int pos)
       : Expression(pos, kTemplateLiteral),
         string_parts_(parts),
         substitutions_(substitutions) {}
 
-  const StringList* string_parts_;
-  const ExpressionList* substitutions_;
+  const ZonePtrList<const AstRawString>* string_parts_;
+  const ZonePtrList<Expression>* substitutions_;
 };
 
 // ----------------------------------------------------------------------------
@@ -2700,7 +2693,7 @@ class AstVisitor BASE_EMBEDDED {
     for (Declaration* decl : *declarations) Visit(decl);
   }
 
-  void VisitStatements(ZoneList<Statement*>* statements) {
+  void VisitStatements(ZonePtrList<Statement>* statements) {
     for (int i = 0; i < statements->length(); i++) {
       Statement* stmt = statements->at(i);
       Visit(stmt);
@@ -2708,7 +2701,7 @@ class AstVisitor BASE_EMBEDDED {
     }
   }
 
-  void VisitExpressions(ZoneList<Expression*>* expressions) {
+  void VisitExpressions(ZonePtrList<Expression>* expressions) {
     for (int i = 0; i < expressions->length(); i++) {
       // The variable statement visiting code may pass null expressions
       // to this code. Maybe this should be handled by introducing an
@@ -2802,7 +2795,7 @@ class AstNodeFactory final BASE_EMBEDDED {
   }
 
   Block* NewBlock(int capacity, bool ignore_completion_value,
-                  ZoneList<const AstRawString*>* labels = nullptr) {
+                  ZonePtrList<const AstRawString>* labels = nullptr) {
     return labels != nullptr
                ? new (zone_) LabeledBlock(zone_, labels, capacity,
                                           ignore_completion_value)
@@ -2810,22 +2803,22 @@ class AstNodeFactory final BASE_EMBEDDED {
                      Block(zone_, labels, capacity, ignore_completion_value);
   }
 
-#define STATEMENT_WITH_LABELS(NodeType)                                     \
-  NodeType* New##NodeType(ZoneList<const AstRawString*>* labels, int pos) { \
-    return new (zone_) NodeType(labels, pos);                               \
+#define STATEMENT_WITH_LABELS(NodeType)                                       \
+  NodeType* New##NodeType(ZonePtrList<const AstRawString>* labels, int pos) { \
+    return new (zone_) NodeType(labels, pos);                                 \
   }
   STATEMENT_WITH_LABELS(DoWhileStatement)
   STATEMENT_WITH_LABELS(WhileStatement)
   STATEMENT_WITH_LABELS(ForStatement)
 #undef STATEMENT_WITH_LABELS
 
-  SwitchStatement* NewSwitchStatement(ZoneList<const AstRawString*>* labels,
+  SwitchStatement* NewSwitchStatement(ZonePtrList<const AstRawString>* labels,
                                       Expression* tag, int pos) {
     return new (zone_) SwitchStatement(zone_, labels, tag, pos);
   }
 
   ForEachStatement* NewForEachStatement(ForEachStatement::VisitMode visit_mode,
-                                        ZoneList<const AstRawString*>* labels,
+                                        ZonePtrList<const AstRawString>* labels,
                                         int pos) {
     switch (visit_mode) {
       case ForEachStatement::ENUMERATE: {
@@ -2838,7 +2831,7 @@ class AstNodeFactory final BASE_EMBEDDED {
     UNREACHABLE();
   }
 
-  ForOfStatement* NewForOfStatement(ZoneList<const AstRawString*>* labels,
+  ForOfStatement* NewForOfStatement(ZonePtrList<const AstRawString>* labels,
                                     int pos) {
     return new (zone_) ForOfStatement(labels, pos);
   }
@@ -2929,7 +2922,7 @@ class AstNodeFactory final BASE_EMBEDDED {
   }
 
   CaseClause* NewCaseClause(Expression* label,
-                            ZoneList<Statement*>* statements) {
+                            ZonePtrList<Statement>* statements) {
     return new (zone_) CaseClause(label, statements);
   }
 
@@ -2969,7 +2962,7 @@ class AstNodeFactory final BASE_EMBEDDED {
   }
 
   ObjectLiteral* NewObjectLiteral(
-      ZoneList<ObjectLiteral::Property*>* properties,
+      ZonePtrList<ObjectLiteral::Property>* properties,
       uint32_t boilerplate_properties, int pos, bool has_rest_property) {
     return new (zone_) ObjectLiteral(properties, boilerplate_properties, pos,
                                      has_rest_property);
@@ -2994,12 +2987,11 @@ class AstNodeFactory final BASE_EMBEDDED {
     return new (zone_) RegExpLiteral(pattern, flags, pos);
   }
 
-  ArrayLiteral* NewArrayLiteral(ZoneList<Expression*>* values,
-                                int pos) {
+  ArrayLiteral* NewArrayLiteral(ZonePtrList<Expression>* values, int pos) {
     return new (zone_) ArrayLiteral(values, -1, pos);
   }
 
-  ArrayLiteral* NewArrayLiteral(ZoneList<Expression*>* values,
+  ArrayLiteral* NewArrayLiteral(ZonePtrList<Expression>* values,
                                 int first_spread_index, int pos) {
     return new (zone_) ArrayLiteral(values, first_spread_index, pos);
   }
@@ -3035,35 +3027,34 @@ class AstNodeFactory final BASE_EMBEDDED {
     return new (zone_) ResolvedProperty(obj, property, pos);
   }
 
-  Call* NewCall(Expression* expression, ZoneList<Expression*>* arguments,
+  Call* NewCall(Expression* expression, ZonePtrList<Expression>* arguments,
                 int pos, Call::PossiblyEval possibly_eval = Call::NOT_EVAL) {
     return new (zone_) Call(expression, arguments, pos, possibly_eval);
   }
 
   Call* NewTaggedTemplate(Expression* expression,
-                          ZoneList<Expression*>* arguments, int pos) {
+                          ZonePtrList<Expression>* arguments, int pos) {
     return new (zone_)
         Call(expression, arguments, pos, Call::TaggedTemplateTag::kTrue);
   }
 
   CallNew* NewCallNew(Expression* expression,
-                      ZoneList<Expression*>* arguments,
-                      int pos) {
+                      ZonePtrList<Expression>* arguments, int pos) {
     return new (zone_) CallNew(expression, arguments, pos);
   }
 
   CallRuntime* NewCallRuntime(Runtime::FunctionId id,
-                              ZoneList<Expression*>* arguments, int pos) {
+                              ZonePtrList<Expression>* arguments, int pos) {
     return new (zone_) CallRuntime(Runtime::FunctionForId(id), arguments, pos);
   }
 
   CallRuntime* NewCallRuntime(const Runtime::Function* function,
-                              ZoneList<Expression*>* arguments, int pos) {
+                              ZonePtrList<Expression>* arguments, int pos) {
     return new (zone_) CallRuntime(function, arguments, pos);
   }
 
   CallRuntime* NewCallRuntime(int context_index,
-                              ZoneList<Expression*>* arguments, int pos) {
+                              ZonePtrList<Expression>* arguments, int pos) {
     return new (zone_) CallRuntime(context_index, arguments, pos);
   }
 
@@ -3166,7 +3157,7 @@ class AstNodeFactory final BASE_EMBEDDED {
 
   FunctionLiteral* NewFunctionLiteral(
       const AstRawString* name, DeclarationScope* scope,
-      ZoneList<Statement*>* body, int expected_property_count,
+      ZonePtrList<Statement>* body, int expected_property_count,
       int parameter_count, int function_length,
       FunctionLiteral::ParameterFlag has_duplicate_parameters,
       FunctionLiteral::FunctionType function_type,
@@ -3184,7 +3175,7 @@ class AstNodeFactory final BASE_EMBEDDED {
   // result of an eval (top-level or otherwise), or the result of calling
   // the Function constructor.
   FunctionLiteral* NewScriptOrEvalFunctionLiteral(DeclarationScope* scope,
-                                                  ZoneList<Statement*>* body,
+                                                  ZonePtrList<Statement>* body,
                                                   int expected_property_count,
                                                   int parameter_count) {
     return new (zone_) FunctionLiteral(
@@ -3192,7 +3183,7 @@ class AstNodeFactory final BASE_EMBEDDED {
         body, expected_property_count, parameter_count, parameter_count,
         FunctionLiteral::kAnonymousExpression,
         FunctionLiteral::kNoDuplicateParameters,
-        FunctionLiteral::kShouldLazyCompile, 0, true,
+        FunctionLiteral::kShouldLazyCompile, 0, /* has_braces */ false,
         FunctionLiteral::kIdTypeTopLevel);
   }
 
@@ -3206,7 +3197,7 @@ class AstNodeFactory final BASE_EMBEDDED {
   ClassLiteral* NewClassLiteral(
       Scope* scope, Variable* variable, Expression* extends,
       FunctionLiteral* constructor,
-      ZoneList<ClassLiteral::Property*>* properties,
+      ZonePtrList<ClassLiteral::Property>* properties,
       FunctionLiteral* static_fields_initializer,
       FunctionLiteral* instance_fields_initializer_function, int start_position,
       int end_position, bool has_name_static_property,
@@ -3263,14 +3254,14 @@ class AstNodeFactory final BASE_EMBEDDED {
   }
 
   GetTemplateObject* NewGetTemplateObject(
-      const ZoneList<const AstRawString*>* cooked_strings,
-      const ZoneList<const AstRawString*>* raw_strings, int pos) {
+      const ZonePtrList<const AstRawString>* cooked_strings,
+      const ZonePtrList<const AstRawString>* raw_strings, int pos) {
     return new (zone_) GetTemplateObject(cooked_strings, raw_strings, pos);
   }
 
   TemplateLiteral* NewTemplateLiteral(
-      const ZoneList<const AstRawString*>* string_parts,
-      const ZoneList<Expression*>* substitutions, int pos) {
+      const ZonePtrList<const AstRawString>* string_parts,
+      const ZonePtrList<Expression>* substitutions, int pos) {
     return new (zone_) TemplateLiteral(string_parts, substitutions, pos);
   }
 
@@ -3279,7 +3270,7 @@ class AstNodeFactory final BASE_EMBEDDED {
   }
 
   InitializeClassFieldsStatement* NewInitializeClassFieldsStatement(
-      ZoneList<ClassLiteralProperty*>* args, int pos) {
+      ZonePtrList<ClassLiteral::Property>* args, int pos) {
     return new (zone_) InitializeClassFieldsStatement(args, pos);
   }
 
diff --git a/deps/v8/src/ast/compile-time-value.cc b/deps/v8/src/ast/compile-time-value.cc
deleted file mode 100644
index f21759ab7da80e..00000000000000
--- a/deps/v8/src/ast/compile-time-value.cc
+++ /dev/null
@@ -1,53 +0,0 @@
-// Copyright 2016 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "src/ast/compile-time-value.h"
-
-#include "src/ast/ast.h"
-#include "src/handles-inl.h"
-#include "src/heap/factory.h"
-#include "src/isolate.h"
-#include "src/objects-inl.h"
-
-namespace v8 {
-namespace internal {
-
-bool CompileTimeValue::IsCompileTimeValue(Expression* expression) {
-  if (expression->IsLiteral()) return true;
-  MaterializedLiteral* literal = expression->AsMaterializedLiteral();
-  if (literal == nullptr) return false;
-  return literal->IsSimple();
-}
-
-Handle<FixedArray> CompileTimeValue::GetValue(Isolate* isolate,
-                                              Expression* expression) {
-  Factory* factory = isolate->factory();
-  DCHECK(IsCompileTimeValue(expression));
-  Handle<FixedArray> result = factory->NewFixedArray(2, TENURED);
-  if (expression->IsObjectLiteral()) {
-    ObjectLiteral* object_literal = expression->AsObjectLiteral();
-    DCHECK(object_literal->is_simple());
-    int literalTypeFlag = object_literal->EncodeLiteralType();
-    DCHECK_NE(kArrayLiteralFlag, literalTypeFlag);
-    result->set(kLiteralTypeSlot, Smi::FromInt(literalTypeFlag));
-    result->set(kElementsSlot, *object_literal->constant_properties());
-  } else {
-    ArrayLiteral* array_literal = expression->AsArrayLiteral();
-    DCHECK(array_literal->is_simple());
-    result->set(kLiteralTypeSlot, Smi::FromInt(kArrayLiteralFlag));
-    result->set(kElementsSlot, *array_literal->constant_elements());
-  }
-  return result;
-}
-
-int CompileTimeValue::GetLiteralTypeFlags(Handle<FixedArray> value) {
-  return Smi::ToInt(value->get(kLiteralTypeSlot));
-}
-
-Handle<HeapObject> CompileTimeValue::GetElements(Handle<FixedArray> value) {
-  return Handle<HeapObject>(HeapObject::cast(value->get(kElementsSlot)));
-}
-
-}  // namespace internal
-}  // namespace v8
diff --git a/deps/v8/src/ast/compile-time-value.h b/deps/v8/src/ast/compile-time-value.h
deleted file mode 100644
index 874bc1b32f8cb5..00000000000000
--- a/deps/v8/src/ast/compile-time-value.h
+++ /dev/null
@@ -1,46 +0,0 @@
-// Copyright 2015 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef V8_AST_COMPILE_TIME_VALUE_H_
-#define V8_AST_COMPILE_TIME_VALUE_H_
-
-#include "src/allocation.h"
-#include "src/globals.h"
-
-namespace v8 {
-namespace internal {
-
-class Expression;
-
-// Support for handling complex values (array and object literals) that
-// can be fully handled at compile time.
-class CompileTimeValue : public AllStatic {
- public:
-  // This is a special marker used to encode array literals. The value has to be
-  // different from any value possibly returned by
-  // ObjectLiteral::EncodeLiteralType.
-  static const int kArrayLiteralFlag = -1;
-
-  static bool IsCompileTimeValue(Expression* expression);
-
-  // Get the value as a compile time value.
-  static Handle<FixedArray> GetValue(Isolate* isolate, Expression* expression);
-
-  // Get the encoded literal type. This can either be kArrayLiteralFlag or
-  // encoded properties of an ObjectLiteral returned by
-  // ObjectLiteral::EncodeLiteralType.
-  static int GetLiteralTypeFlags(Handle<FixedArray> value);
-
-  // Get the elements of a compile time value returned by GetValue().
-  static Handle<HeapObject> GetElements(Handle<FixedArray> value);
-
- private:
-  static const int kLiteralTypeSlot = 0;
-  static const int kElementsSlot = 1;
-};
-
-}  // namespace internal
-}  // namespace v8
-
-#endif  // V8_AST_COMPILE_TIME_VALUE_H_
diff --git a/deps/v8/src/ast/modules.cc b/deps/v8/src/ast/modules.cc
index b583f357938ece..065cffe93105fc 100644
--- a/deps/v8/src/ast/modules.cc
+++ b/deps/v8/src/ast/modules.cc
@@ -6,7 +6,7 @@
 #include "src/ast/ast-value-factory.h"
 #include "src/ast/scopes.h"
 #include "src/objects-inl.h"
-#include "src/objects/module.h"
+#include "src/objects/module-inl.h"
 #include "src/pending-compilation-error-handler.h"
 
 namespace v8 {
diff --git a/deps/v8/src/ast/prettyprinter.cc b/deps/v8/src/ast/prettyprinter.cc
index 2ca75e3c31e8ea..ef086bcefc2d55 100644
--- a/deps/v8/src/ast/prettyprinter.cc
+++ b/deps/v8/src/ast/prettyprinter.cc
@@ -498,16 +498,14 @@ void CallPrinter::VisitRewritableExpression(RewritableExpression* node) {
   Find(node->expression());
 }
 
-
-void CallPrinter::FindStatements(ZoneList<Statement*>* statements) {
+void CallPrinter::FindStatements(ZonePtrList<Statement>* statements) {
   if (statements == nullptr) return;
   for (int i = 0; i < statements->length(); i++) {
     Find(statements->at(i));
   }
 }
 
-
-void CallPrinter::FindArguments(ZoneList<Expression*>* arguments) {
+void CallPrinter::FindArguments(ZonePtrList<Expression>* arguments) {
   if (found_) return;
   for (int i = 0; i < arguments->length(); i++) {
     Find(arguments->at(i));
@@ -589,7 +587,7 @@ void AstPrinter::Print(const char* format, ...) {
   }
 }
 
-void AstPrinter::PrintLabels(ZoneList<const AstRawString*>* labels) {
+void AstPrinter::PrintLabels(ZonePtrList<const AstRawString>* labels) {
   if (labels != nullptr) {
     for (int i = 0; i < labels->length(); i++) {
       PrintLiteral(labels->at(i), false);
@@ -748,8 +746,7 @@ void AstPrinter::PrintLiteralWithModeIndented(const char* info, Variable* var,
   }
 }
 
-
-void AstPrinter::PrintLabelsIndented(ZoneList<const AstRawString*>* labels) {
+void AstPrinter::PrintLabelsIndented(ZonePtrList<const AstRawString>* labels) {
   if (labels == nullptr || labels->length() == 0) return;
   PrintIndented("LABELS ");
   PrintLabels(labels);
@@ -809,15 +806,13 @@ void AstPrinter::PrintParameters(DeclarationScope* scope) {
   }
 }
 
-
-void AstPrinter::PrintStatements(ZoneList<Statement*>* statements) {
+void AstPrinter::PrintStatements(ZonePtrList<Statement>* statements) {
   for (int i = 0; i < statements->length(); i++) {
     Visit(statements->at(i));
   }
 }
 
-
-void AstPrinter::PrintArguments(ZoneList<Expression*>* arguments) {
+void AstPrinter::PrintArguments(ZonePtrList<Expression>* arguments) {
   for (int i = 0; i < arguments->length(); i++) {
     Visit(arguments->at(i));
   }
@@ -1040,7 +1035,7 @@ void AstPrinter::VisitInitializeClassFieldsStatement(
 }
 
 void AstPrinter::PrintClassProperties(
-    ZoneList<ClassLiteral::Property*>* properties) {
+    ZonePtrList<ClassLiteral::Property>* properties) {
   for (int i = 0; i < properties->length(); i++) {
     ClassLiteral::Property* property = properties->at(i);
     const char* prop_kind = nullptr;
@@ -1119,7 +1114,7 @@ void AstPrinter::VisitObjectLiteral(ObjectLiteral* node) {
 }
 
 void AstPrinter::PrintObjectProperties(
-    ZoneList<ObjectLiteral::Property*>* properties) {
+    ZonePtrList<ObjectLiteral::Property>* properties) {
   for (int i = 0; i < properties->length(); i++) {
     ObjectLiteral::Property* property = properties->at(i);
     const char* prop_kind = nullptr;
@@ -1325,7 +1320,7 @@ void AstPrinter::VisitCompareOperation(CompareOperation* node) {
 
 
 void AstPrinter::VisitSpread(Spread* node) {
-  IndentedScope indent(this, "...", node->position());
+  IndentedScope indent(this, "SPREAD", node->position());
   Visit(node->expression());
 }
 
diff --git a/deps/v8/src/ast/prettyprinter.h b/deps/v8/src/ast/prettyprinter.h
index d93137b7cf10b1..cc29052c2d9783 100644
--- a/deps/v8/src/ast/prettyprinter.h
+++ b/deps/v8/src/ast/prettyprinter.h
@@ -56,8 +56,8 @@ class CallPrinter final : public AstVisitor<CallPrinter> {
  protected:
   void PrintLiteral(Handle<Object> value, bool quote);
   void PrintLiteral(const AstRawString* value, bool quote);
-  void FindStatements(ZoneList<Statement*>* statements);
-  void FindArguments(ZoneList<Expression*>* arguments);
+  void FindStatements(ZonePtrList<Statement>* statements);
+  void FindArguments(ZonePtrList<Expression>* arguments);
 };
 
 
@@ -88,17 +88,17 @@ class AstPrinter final : public AstVisitor<AstPrinter> {
 
   void Init();
 
-  void PrintLabels(ZoneList<const AstRawString*>* labels);
+  void PrintLabels(ZonePtrList<const AstRawString>* labels);
   void PrintLiteral(const AstRawString* value, bool quote);
   void PrintLiteral(const AstConsString* value, bool quote);
   void PrintLiteral(Literal* literal, bool quote);
   void PrintIndented(const char* txt);
   void PrintIndentedVisit(const char* s, AstNode* node);
 
-  void PrintStatements(ZoneList<Statement*>* statements);
+  void PrintStatements(ZonePtrList<Statement>* statements);
   void PrintDeclarations(Declaration::List* declarations);
   void PrintParameters(DeclarationScope* scope);
-  void PrintArguments(ZoneList<Expression*>* arguments);
+  void PrintArguments(ZonePtrList<Expression>* arguments);
   void PrintCaseClause(CaseClause* clause);
   void PrintLiteralIndented(const char* info, Literal* literal, bool quote);
   void PrintLiteralIndented(const char* info, const AstRawString* value,
@@ -107,9 +107,9 @@ class AstPrinter final : public AstVisitor<AstPrinter> {
                             bool quote);
   void PrintLiteralWithModeIndented(const char* info, Variable* var,
                                     const AstRawString* value);
-  void PrintLabelsIndented(ZoneList<const AstRawString*>* labels);
-  void PrintObjectProperties(ZoneList<ObjectLiteral::Property*>* properties);
-  void PrintClassProperties(ZoneList<ClassLiteral::Property*>* properties);
+  void PrintLabelsIndented(ZonePtrList<const AstRawString>* labels);
+  void PrintObjectProperties(ZonePtrList<ObjectLiteral::Property>* properties);
+  void PrintClassProperties(ZonePtrList<ClassLiteral::Property>* properties);
 
   void inc_indent() { indent_++; }
   void dec_indent() { indent_--; }
diff --git a/deps/v8/src/ast/scopes.cc b/deps/v8/src/ast/scopes.cc
index 2c1355ead1416b..6793edf0c0566f 100644
--- a/deps/v8/src/ast/scopes.cc
+++ b/deps/v8/src/ast/scopes.cc
@@ -13,7 +13,7 @@
 #include "src/counters.h"
 #include "src/messages.h"
 #include "src/objects-inl.h"
-#include "src/objects/module.h"
+#include "src/objects/module-inl.h"
 #include "src/objects/scope-info.h"
 #include "src/parsing/parse-info.h"
 #include "src/parsing/preparsed-scope-data.h"
@@ -75,8 +75,8 @@ Variable* VariableMap::DeclareName(Zone* zone, const AstRawString* name,
   if (p->value == nullptr) {
     // The variable has not been declared yet -> insert it.
     DCHECK_EQ(name, p->key);
-    p->value =
-        mode == VAR ? kDummyPreParserVariable : kDummyPreParserLexicalVariable;
+    p->value = mode == VariableMode::kVar ? kDummyPreParserVariable
+                                          : kDummyPreParserLexicalVariable;
   }
   return reinterpret_cast<Variable*>(p->value);
 }
@@ -199,11 +199,10 @@ ModuleScope::ModuleScope(DeclarationScope* script_scope,
   DeclareThis(ast_value_factory);
 }
 
-ModuleScope::ModuleScope(Handle<ScopeInfo> scope_info,
+ModuleScope::ModuleScope(Isolate* isolate, Handle<ScopeInfo> scope_info,
                          AstValueFactory* avfactory)
     : DeclarationScope(avfactory->zone(), MODULE_SCOPE, scope_info) {
   Zone* zone = avfactory->zone();
-  Isolate* isolate = scope_info->GetIsolate();
   Handle<ModuleInfo> module_info(scope_info->ModuleDescriptorInfo(), isolate);
 
   set_language_mode(LanguageMode::kStrict);
@@ -289,8 +288,9 @@ Scope::Scope(Zone* zone, const AstRawString* catch_variable_name,
   // Cache the catch variable, even though it's also available via the
   // scope_info, as the parser expects that a catch scope always has the catch
   // variable as first and only variable.
-  Variable* variable = Declare(zone, catch_variable_name, VAR, NORMAL_VARIABLE,
-                               kCreatedInitialized, maybe_assigned);
+  Variable* variable =
+      Declare(zone, catch_variable_name, VariableMode::kVar, NORMAL_VARIABLE,
+              kCreatedInitialized, maybe_assigned);
   AllocateHeapSlot(variable);
 }
 
@@ -389,7 +389,8 @@ bool Scope::ContainsAsmModule() const {
   return false;
 }
 
-Scope* Scope::DeserializeScopeChain(Zone* zone, ScopeInfo* scope_info,
+Scope* Scope::DeserializeScopeChain(Isolate* isolate, Zone* zone,
+                                    ScopeInfo* scope_info,
                                     DeclarationScope* script_scope,
                                     AstValueFactory* ast_value_factory,
                                     DeserializationMode deserialization_mode) {
@@ -400,7 +401,8 @@ Scope* Scope::DeserializeScopeChain(Zone* zone, ScopeInfo* scope_info,
   while (scope_info) {
     if (scope_info->scope_type() == WITH_SCOPE) {
       // For scope analysis, debug-evaluate is equivalent to a with scope.
-      outer_scope = new (zone) Scope(zone, WITH_SCOPE, handle(scope_info));
+      outer_scope =
+          new (zone) Scope(zone, WITH_SCOPE, handle(scope_info, isolate));
 
       // TODO(yangguo): Remove once debug-evaluate properly keeps track of the
       // function scope in which we are evaluating.
@@ -412,40 +414,40 @@ Scope* Scope::DeserializeScopeChain(Zone* zone, ScopeInfo* scope_info,
       // scope info of this script context onto the existing script scope to
       // avoid nesting script scopes.
       if (deserialization_mode == DeserializationMode::kIncludingVariables) {
-        script_scope->SetScriptScopeInfo(handle(scope_info));
+        script_scope->SetScriptScopeInfo(handle(scope_info, isolate));
       }
       DCHECK(!scope_info->HasOuterScopeInfo());
       break;
     } else if (scope_info->scope_type() == FUNCTION_SCOPE) {
-      outer_scope =
-          new (zone) DeclarationScope(zone, FUNCTION_SCOPE, handle(scope_info));
+      outer_scope = new (zone)
+          DeclarationScope(zone, FUNCTION_SCOPE, handle(scope_info, isolate));
       if (scope_info->IsAsmModule())
         outer_scope->AsDeclarationScope()->set_asm_module();
     } else if (scope_info->scope_type() == EVAL_SCOPE) {
-      outer_scope =
-          new (zone) DeclarationScope(zone, EVAL_SCOPE, handle(scope_info));
+      outer_scope = new (zone)
+          DeclarationScope(zone, EVAL_SCOPE, handle(scope_info, isolate));
     } else if (scope_info->scope_type() == BLOCK_SCOPE) {
       if (scope_info->is_declaration_scope()) {
-        outer_scope =
-            new (zone) DeclarationScope(zone, BLOCK_SCOPE, handle(scope_info));
+        outer_scope = new (zone)
+            DeclarationScope(zone, BLOCK_SCOPE, handle(scope_info, isolate));
       } else {
-        outer_scope = new (zone) Scope(zone, BLOCK_SCOPE, handle(scope_info));
+        outer_scope =
+            new (zone) Scope(zone, BLOCK_SCOPE, handle(scope_info, isolate));
       }
     } else if (scope_info->scope_type() == MODULE_SCOPE) {
-      outer_scope =
-          new (zone) ModuleScope(handle(scope_info), ast_value_factory);
+      outer_scope = new (zone)
+          ModuleScope(isolate, handle(scope_info, isolate), ast_value_factory);
     } else {
       DCHECK_EQ(scope_info->scope_type(), CATCH_SCOPE);
-      DCHECK_EQ(scope_info->LocalCount(), 1);
       DCHECK_EQ(scope_info->ContextLocalCount(), 1);
-      DCHECK_EQ(scope_info->ContextLocalMode(0), VAR);
+      DCHECK_EQ(scope_info->ContextLocalMode(0), VariableMode::kVar);
       DCHECK_EQ(scope_info->ContextLocalInitFlag(0), kCreatedInitialized);
       String* name = scope_info->ContextLocalName(0);
       MaybeAssignedFlag maybe_assigned =
           scope_info->ContextLocalMaybeAssignedFlag(0);
-      outer_scope =
-          new (zone) Scope(zone, ast_value_factory->GetString(handle(name)),
-                           maybe_assigned, handle(scope_info));
+      outer_scope = new (zone)
+          Scope(zone, ast_value_factory->GetString(handle(name, isolate)),
+                maybe_assigned, handle(scope_info, isolate));
     }
     if (deserialization_mode == DeserializationMode::kScopesOnly) {
       outer_scope->scope_info_ = Handle<ScopeInfo>::null();
@@ -605,12 +607,13 @@ void DeclarationScope::HoistSloppyBlockFunctions(AstNodeFactory* factory) {
       // Based on the preceding checks, it doesn't matter what we pass as
       // sloppy_mode_block_scope_function_redefinition.
       bool ok = true;
-      DeclareVariable(declaration, VAR,
-                      Variable::DefaultInitializationFlag(VAR), nullptr, &ok);
+      DeclareVariable(declaration, VariableMode::kVar,
+                      Variable::DefaultInitializationFlag(VariableMode::kVar),
+                      nullptr, &ok);
       DCHECK(ok);
     } else {
       DCHECK(is_being_lazily_parsed_);
-      Variable* var = DeclareVariableName(name, VAR);
+      Variable* var = DeclareVariableName(name, VariableMode::kVar);
       if (var != kDummyPreParserVariable &&
           var != kDummyPreParserLexicalVariable) {
         DCHECK(FLAG_preparser_scope_analysis);
@@ -633,7 +636,7 @@ void DeclarationScope::AttachOuterScopeInfo(ParseInfo* info, Isolate* isolate) {
           DeclarationScope(info->zone(), info->ast_value_factory());
       info->set_script_scope(script_scope);
       ReplaceOuterScope(Scope::DeserializeScopeChain(
-          info->zone(), *outer_scope_info, script_scope,
+          isolate, info->zone(), *outer_scope_info, script_scope,
           info->ast_value_factory(),
           Scope::DeserializationMode::kIncludingVariables));
     } else {
@@ -703,7 +706,8 @@ void DeclarationScope::DeclareThis(AstValueFactory* ast_value_factory) {
   bool derived_constructor = IsDerivedConstructor(function_kind_);
   Variable* var =
       Declare(zone(), ast_value_factory->this_string(),
-              derived_constructor ? CONST : VAR, THIS_VARIABLE,
+              derived_constructor ? VariableMode::kConst : VariableMode::kVar,
+              THIS_VARIABLE,
               derived_constructor ? kNeedsInitialization : kCreatedInitialized);
   receiver_ = var;
 }
@@ -717,7 +721,8 @@ void DeclarationScope::DeclareArguments(AstValueFactory* ast_value_factory) {
     // Declare 'arguments' variable which exists in all non arrow functions.
     // Note that it might never be accessed, in which case it won't be
     // allocated during variable allocation.
-    arguments_ = Declare(zone(), ast_value_factory->arguments_string(), VAR);
+    arguments_ = Declare(zone(), ast_value_factory->arguments_string(),
+                         VariableMode::kVar);
   } else if (IsLexical(arguments_)) {
     // Check if there's lexically declared variable named arguments to avoid
     // redeclaration. See ES#sec-functiondeclarationinstantiation, step 20.
@@ -731,12 +736,14 @@ void DeclarationScope::DeclareDefaultFunctionVariables(
   DCHECK(!is_arrow_scope());
 
   DeclareThis(ast_value_factory);
-  new_target_ = Declare(zone(), ast_value_factory->new_target_string(), CONST);
+  new_target_ = Declare(zone(), ast_value_factory->new_target_string(),
+                        VariableMode::kConst);
 
   if (IsConciseMethod(function_kind_) || IsClassConstructor(function_kind_) ||
       IsAccessorFunction(function_kind_)) {
     EnsureRareData()->this_function =
-        Declare(zone(), ast_value_factory->this_function_string(), CONST);
+        Declare(zone(), ast_value_factory->this_function_string(),
+                VariableMode::kConst);
   }
 }
 
@@ -746,10 +753,10 @@ Variable* DeclarationScope::DeclareFunctionVar(const AstRawString* name) {
   DCHECK_NULL(variables_.Lookup(name));
   VariableKind kind = is_sloppy(language_mode()) ? SLOPPY_FUNCTION_NAME_VARIABLE
                                                  : NORMAL_VARIABLE;
-  function_ =
-      new (zone()) Variable(this, name, CONST, kind, kCreatedInitialized);
+  function_ = new (zone())
+      Variable(this, name, VariableMode::kConst, kind, kCreatedInitialized);
   if (calls_sloppy_eval()) {
-    NonLocal(name, DYNAMIC);
+    NonLocal(name, VariableMode::kDynamic);
   } else {
     variables_.Add(zone(), function_);
   }
@@ -913,11 +920,12 @@ void Scope::Snapshot::Reparent(DeclarationScope* new_parent) const {
 
   new_parent->locals_.MoveTail(outer_closure->locals(), top_local_);
   for (Variable* local : new_parent->locals_) {
-    DCHECK(local->mode() == TEMPORARY || local->mode() == VAR);
+    DCHECK(local->mode() == VariableMode::kTemporary ||
+           local->mode() == VariableMode::kVar);
     DCHECK_EQ(local->scope(), local->scope()->GetClosureScope());
     DCHECK_NE(local->scope(), new_parent);
     local->set_scope(new_parent);
-    if (local->mode() == VAR) {
+    if (local->mode() == VariableMode::kVar) {
       outer_closure->variables_.Remove(local);
       new_parent->variables_.Add(new_parent->zone(), local);
     }
@@ -949,10 +957,6 @@ Variable* Scope::LookupInScopeInfo(const AstRawString* name) {
   // The Scope is backed up by ScopeInfo. This means it cannot operate in a
   // heap-independent mode, and all strings must be internalized immediately. So
   // it's ok to get the Handle<String> here.
-  // If we have a serialized scope info, we might find the variable there.
-  // There should be no local slot with the given name.
-  DCHECK_LT(scope_info_->StackSlotIndex(*name_handle), 0);
-
   bool found = false;
 
   VariableLocation location;
@@ -979,7 +983,7 @@ Variable* Scope::LookupInScopeInfo(const AstRawString* name) {
     index = scope_info_->FunctionContextSlotIndex(*name_handle);
     if (index < 0) return nullptr;  // Nowhere found.
     Variable* var = AsDeclarationScope()->DeclareFunctionVar(name);
-    DCHECK_EQ(CONST, var->mode());
+    DCHECK_EQ(VariableMode::kConst, var->mode());
     var->AllocateTo(VariableLocation::CONTEXT, index);
     return variables_.Lookup(name);
   }
@@ -1016,10 +1020,10 @@ Variable* DeclarationScope::DeclareParameter(
   DCHECK(!is_being_lazily_parsed_);
   DCHECK(!was_lazily_parsed_);
   Variable* var;
-  if (mode == TEMPORARY) {
+  if (mode == VariableMode::kTemporary) {
     var = NewTemporary(name);
   } else {
-    DCHECK_EQ(mode, VAR);
+    DCHECK_EQ(mode, VariableMode::kVar);
     var = Declare(zone(), name, mode);
     // TODO(wingo): Avoid O(n^2) check.
     if (is_duplicate != nullptr) {
@@ -1049,17 +1053,17 @@ Variable* DeclarationScope::DeclareParameterName(
   if (FLAG_preparser_scope_analysis) {
     Variable* var;
     if (declare_as_local) {
-      var = Declare(zone(), name, VAR);
+      var = Declare(zone(), name, VariableMode::kVar);
     } else {
-      var = new (zone())
-          Variable(this, name, TEMPORARY, NORMAL_VARIABLE, kCreatedInitialized);
+      var = new (zone()) Variable(this, name, VariableMode::kTemporary,
+                                  NORMAL_VARIABLE, kCreatedInitialized);
     }
     if (add_parameter) {
       params_.Add(var, zone());
     }
     return var;
   }
-  DeclareVariableName(name, VAR);
+  DeclareVariableName(name, VariableMode::kVar);
   return nullptr;
 }
 
@@ -1067,12 +1071,14 @@ Variable* Scope::DeclareLocal(const AstRawString* name, VariableMode mode,
                               InitializationFlag init_flag, VariableKind kind,
                               MaybeAssignedFlag maybe_assigned_flag) {
   DCHECK(!already_resolved_);
-  // This function handles VAR, LET, and CONST modes.  DYNAMIC variables are
-  // introduced during variable allocation, and TEMPORARY variables are
-  // allocated via NewTemporary().
+  // This function handles VariableMode::kVar, VariableMode::kLet, and
+  // VariableMode::kConst modes.  VariableMode::kDynamic variables are
+  // introduced during variable allocation, and VariableMode::kTemporary
+  // variables are allocated via NewTemporary().
   DCHECK(IsDeclaredVariableMode(mode));
   DCHECK_IMPLIES(GetDeclarationScope()->is_being_lazily_parsed(),
-                 mode == VAR || mode == LET || mode == CONST);
+                 mode == VariableMode::kVar || mode == VariableMode::kLet ||
+                     mode == VariableMode::kConst);
   DCHECK(!GetDeclarationScope()->was_lazily_parsed());
   return Declare(zone(), name, mode, kind, init_flag, maybe_assigned_flag);
 }
@@ -1085,7 +1091,7 @@ Variable* Scope::DeclareVariable(
   DCHECK(!GetDeclarationScope()->is_being_lazily_parsed());
   DCHECK(!GetDeclarationScope()->was_lazily_parsed());
 
-  if (mode == VAR && !is_declaration_scope()) {
+  if (mode == VariableMode::kVar && !is_declaration_scope()) {
     return GetDeclarationScope()->DeclareVariable(
         declaration, mode, init, sloppy_mode_block_scope_function_redefinition,
         ok);
@@ -1108,11 +1114,12 @@ Variable* Scope::DeclareVariable(
   // assigned because they might be accessed by a lazily parsed top-level
   // function, which, for efficiency, we preparse without variable tracking.
   if (is_script_scope() || is_module_scope()) {
-    if (mode != CONST) proxy->set_is_assigned();
+    if (mode != VariableMode::kConst) proxy->set_is_assigned();
   }
 
   Variable* var = nullptr;
-  if (is_eval_scope() && is_sloppy(language_mode()) && mode == VAR) {
+  if (is_eval_scope() && is_sloppy(language_mode()) &&
+      mode == VariableMode::kVar) {
     // In a var binding in a sloppy direct eval, pollute the enclosing scope
     // with this new binding by doing the following:
     // The proxy is bound to a lookup variable to force a dynamic declaration
@@ -1173,7 +1180,7 @@ Variable* Scope::DeclareVariable(
         *ok = false;
         return nullptr;
       }
-    } else if (mode == VAR) {
+    } else if (mode == VariableMode::kVar) {
       var->set_maybe_assigned();
     }
   }
@@ -1199,7 +1206,7 @@ Variable* Scope::DeclareVariableName(const AstRawString* name,
   DCHECK(!already_resolved_);
   DCHECK(GetDeclarationScope()->is_being_lazily_parsed());
 
-  if (mode == VAR && !is_declaration_scope()) {
+  if (mode == VariableMode::kVar && !is_declaration_scope()) {
     return GetDeclarationScope()->DeclareVariableName(name, mode);
   }
   DCHECK(!is_with_scope());
@@ -1220,7 +1227,7 @@ Variable* Scope::DeclareVariableName(const AstRawString* name,
       // a function declaration, it's an error. This is an error PreParser
       // hasn't previously detected. TODO(marja): Investigate whether we can now
       // start returning this error.
-    } else if (mode == VAR) {
+    } else if (mode == VariableMode::kVar) {
       var->set_maybe_assigned();
     }
     var->set_is_used();
@@ -1237,9 +1244,9 @@ void Scope::DeclareCatchVariableName(const AstRawString* name) {
   DCHECK(scope_info_.is_null());
 
   if (FLAG_preparser_scope_analysis) {
-    Declare(zone(), name, VAR);
+    Declare(zone(), name, VariableMode::kVar);
   } else {
-    variables_.DeclareName(zone(), name, VAR);
+    variables_.DeclareName(zone(), name, VariableMode::kVar);
   }
 }
 
@@ -1253,11 +1260,11 @@ void Scope::AddUnresolved(VariableProxy* proxy) {
 Variable* DeclarationScope::DeclareDynamicGlobal(const AstRawString* name,
                                                  VariableKind kind) {
   DCHECK(is_script_scope());
-  return variables_.Declare(zone(), this, name, DYNAMIC_GLOBAL, kind);
+  return variables_.Declare(zone(), this, name, VariableMode::kDynamicGlobal,
+                            kind);
   // TODO(neis): Mark variable as maybe-assigned?
 }
 
-
 bool Scope::RemoveUnresolved(VariableProxy* var) {
   if (unresolved_ == var) {
     unresolved_ = var->next_unresolved();
@@ -1284,8 +1291,8 @@ Variable* Scope::NewTemporary(const AstRawString* name) {
 Variable* Scope::NewTemporary(const AstRawString* name,
                               MaybeAssignedFlag maybe_assigned) {
   DeclarationScope* scope = GetClosureScope();
-  Variable* var = new (zone())
-      Variable(scope, name, TEMPORARY, NORMAL_VARIABLE, kCreatedInitialized);
+  Variable* var = new (zone()) Variable(scope, name, VariableMode::kTemporary,
+                                        NORMAL_VARIABLE, kCreatedInitialized);
   scope->AddLocal(var);
   if (maybe_assigned == kMaybeAssigned) var->set_maybe_assigned();
   return var;
@@ -1302,7 +1309,7 @@ Declaration* Scope::CheckConflictingVarDeclarations() {
     Scope* current = this;
     if (decl->IsVariableDeclaration() &&
         decl->AsVariableDeclaration()->AsNested() != nullptr) {
-      DCHECK_EQ(mode, VAR);
+      DCHECK_EQ(mode, VariableMode::kVar);
       current = decl->AsVariableDeclaration()->AsNested()->scope();
     } else if (IsLexicalVariableMode(mode)) {
       if (!is_block_scope()) continue;
@@ -1327,7 +1334,7 @@ Declaration* Scope::CheckConflictingVarDeclarations() {
 }
 
 Declaration* Scope::CheckLexDeclarationsConflictingWith(
-    const ZoneList<const AstRawString*>& names) {
+    const ZonePtrList<const AstRawString>& names) {
   DCHECK(is_block_scope());
   for (int i = 0; i < names.length(); ++i) {
     Variable* var = LookupLocal(names.at(i));
@@ -1467,11 +1474,11 @@ Scope* Scope::GetOuterScopeWithContext() {
 }
 
 Handle<StringSet> DeclarationScope::CollectNonLocals(
-    ParseInfo* info, Handle<StringSet> non_locals) {
+    Isolate* isolate, ParseInfo* info, Handle<StringSet> non_locals) {
   VariableProxy* free_variables = FetchFreeVariables(this, info);
   for (VariableProxy* proxy = free_variables; proxy != nullptr;
        proxy = proxy->next_unresolved()) {
-    non_locals = StringSet::Add(non_locals, proxy->name());
+    non_locals = StringSet::Add(isolate, non_locals, proxy->name());
   }
   return non_locals;
 }
@@ -1759,7 +1766,7 @@ void Scope::Print(int n) {
   {
     bool printed_header = false;
     for (Variable* local : locals_) {
-      if (local->mode() != TEMPORARY) continue;
+      if (local->mode() != VariableMode::kTemporary) continue;
       if (!printed_header) {
         printed_header = true;
         Indent(n1, "// temporary vars:\n");
@@ -1829,7 +1836,8 @@ Variable* Scope::LookupRecursive(ParseInfo* info, VariableProxy* proxy,
   // variables.
   // TODO(yangguo): Remove once debug-evaluate creates proper ScopeInfo for the
   // scopes in which it's evaluating.
-  if (is_debug_evaluate_scope_) return NonLocal(proxy->raw_name(), DYNAMIC);
+  if (is_debug_evaluate_scope_)
+    return NonLocal(proxy->raw_name(), VariableMode::kDynamic);
 
   // Try to find the variable in this scope.
   Variable* var = LookupLocal(proxy->raw_name());
@@ -1892,7 +1900,7 @@ Variable* Scope::LookupRecursive(ParseInfo* info, VariableProxy* proxy,
       var->ForceContextAllocation();
       if (proxy->is_assigned()) var->set_maybe_assigned();
     }
-    return NonLocal(proxy->raw_name(), DYNAMIC);
+    return NonLocal(proxy->raw_name(), VariableMode::kDynamic);
   }
 
   if (is_declaration_scope() && AsDeclarationScope()->calls_sloppy_eval()) {
@@ -1904,13 +1912,13 @@ Variable* Scope::LookupRecursive(ParseInfo* info, VariableProxy* proxy,
     // here (this excludes block and catch scopes), and variable lookups at
     // script scope are always dynamic.
     if (var->IsGlobalObjectProperty()) {
-      return NonLocal(proxy->raw_name(), DYNAMIC_GLOBAL);
+      return NonLocal(proxy->raw_name(), VariableMode::kDynamicGlobal);
     }
 
     if (var->is_dynamic()) return var;
 
     Variable* invalidated = var;
-    var = NonLocal(proxy->raw_name(), DYNAMIC_LOCAL);
+    var = NonLocal(proxy->raw_name(), VariableMode::kDynamicLocal);
     var->set_local_if_not_shadowed(invalidated);
   }
 
@@ -1937,11 +1945,11 @@ void SetNeedsHoleCheck(Variable* var, VariableProxy* proxy) {
 }
 
 void UpdateNeedsHoleCheck(Variable* var, VariableProxy* proxy, Scope* scope) {
-  if (var->mode() == DYNAMIC_LOCAL) {
+  if (var->mode() == VariableMode::kDynamicLocal) {
     // Dynamically introduced variables never need a hole check (since they're
-    // VAR bindings, either from var or function declarations), but the variable
-    // they shadow might need a hole check, which we want to do if we decide
-    // that no shadowing variable was dynamically introoduced.
+    // VariableMode::kVar bindings, either from var or function declarations),
+    // but the variable they shadow might need a hole check, which we want to do
+    // if we decide that no shadowing variable was dynamically introoduced.
     DCHECK_EQ(kCreatedInitialized, var->initialization_flag());
     return UpdateNeedsHoleCheck(var->local_if_not_shadowed(), proxy, scope);
   }
@@ -1956,12 +1964,12 @@ void UpdateNeedsHoleCheck(Variable* var, VariableProxy* proxy, Scope* scope) {
   }
 
   // Check if the binding really needs an initialization check. The check
-  // can be skipped in the following situation: we have a LET or CONST
-  // binding, both the Variable and the VariableProxy have the same
-  // declaration scope (i.e. they are both in global code, in the
-  // same function or in the same eval code), the VariableProxy is in
-  // the source physically located after the initializer of the variable,
-  // and that the initializer cannot be skipped due to a nonlinear scope.
+  // can be skipped in the following situation: we have a VariableMode::kLet or
+  // VariableMode::kConst binding, both the Variable and the VariableProxy have
+  // the same declaration scope (i.e. they are both in global code, in the same
+  // function or in the same eval code), the VariableProxy is in the source
+  // physically located after the initializer of the variable, and that the
+  // initializer cannot be skipped due to a nonlinear scope.
   //
   // The condition on the closure scopes is a conservative check for
   // nested functions that access a binding and are called before the
@@ -2136,7 +2144,7 @@ bool Scope::MustAllocateInContext(Variable* var) {
   //
   // Temporary variables are always stack-allocated.  Catch-bound variables are
   // always context-allocated.
-  if (var->mode() == TEMPORARY) return false;
+  if (var->mode() == VariableMode::kTemporary) return false;
   if (is_catch_scope()) return true;
   if ((is_script_scope() || is_eval_scope()) &&
       IsLexicalVariableMode(var->mode())) {
@@ -2234,6 +2242,8 @@ void Scope::AllocateNonParameterLocal(Variable* var) {
   if (var->IsUnallocated() && MustAllocate(var)) {
     if (MustAllocateInContext(var)) {
       AllocateHeapSlot(var);
+      DCHECK_IMPLIES(is_catch_scope(),
+                     var->index() == Context::THROWN_OBJECT_INDEX);
     } else {
       AllocateStackSlot(var);
     }
@@ -2354,21 +2364,8 @@ void Scope::AllocateScopeInfosRecursively(Isolate* isolate,
   }
 }
 
-void Scope::AllocateDebuggerScopeInfos(Isolate* isolate,
-                                       MaybeHandle<ScopeInfo> outer_scope) {
-  if (scope_info_.is_null()) {
-    scope_info_ = ScopeInfo::Create(isolate, zone(), this, outer_scope);
-  }
-  MaybeHandle<ScopeInfo> outer = NeedsContext() ? scope_info_ : outer_scope;
-  for (Scope* scope = inner_scope_; scope != nullptr; scope = scope->sibling_) {
-    if (scope->is_function_scope()) continue;
-    scope->AllocateDebuggerScopeInfos(isolate, outer);
-  }
-}
-
 // static
-void DeclarationScope::AllocateScopeInfos(ParseInfo* info, Isolate* isolate,
-                                          AnalyzeMode mode) {
+void DeclarationScope::AllocateScopeInfos(ParseInfo* info, Isolate* isolate) {
   DeclarationScope* scope = info->literal()->scope();
   if (!scope->scope_info_.is_null()) return;  // Allocated by outer function.
 
@@ -2378,9 +2375,6 @@ void DeclarationScope::AllocateScopeInfos(ParseInfo* info, Isolate* isolate,
   }
 
   scope->AllocateScopeInfosRecursively(isolate, outer_scope);
-  if (mode == AnalyzeMode::kDebugger) {
-    scope->AllocateDebuggerScopeInfos(isolate, outer_scope);
-  }
 
   // The debugger expects all shared function infos to contain a scope info.
   // Since the top-most scope will end up in a shared function info, make sure
@@ -2394,7 +2388,8 @@ void DeclarationScope::AllocateScopeInfos(ParseInfo* info, Isolate* isolate,
   // Ensuring that the outer script scope has a scope info avoids having
   // special case for native contexts vs other contexts.
   if (info->script_scope() && info->script_scope()->scope_info_.is_null()) {
-    info->script_scope()->scope_info_ = handle(ScopeInfo::Empty(isolate));
+    info->script_scope()->scope_info_ =
+        handle(ScopeInfo::Empty(isolate), isolate);
   }
 }
 
diff --git a/deps/v8/src/ast/scopes.h b/deps/v8/src/ast/scopes.h
index c95e3a380a660c..dd1220077e3ad0 100644
--- a/deps/v8/src/ast/scopes.h
+++ b/deps/v8/src/ast/scopes.h
@@ -78,8 +78,6 @@ class SloppyBlockFunctionMap : public ZoneHashMap {
   int count_;
 };
 
-enum class AnalyzeMode { kRegular, kDebugger };
-
 // Global invariants after AST construction: Each reference (i.e. identifier)
 // to a JavaScript variable (including global properties) is represented by a
 // VariableProxy node. Immediately after AST construction and before variable
@@ -134,7 +132,8 @@ class V8_EXPORT_PRIVATE Scope : public NON_EXPORTED_BASE(ZoneObject) {
 
   enum class DeserializationMode { kIncludingVariables, kScopesOnly };
 
-  static Scope* DeserializeScopeChain(Zone* zone, ScopeInfo* scope_info,
+  static Scope* DeserializeScopeChain(Isolate* isolate, Zone* zone,
+                                      ScopeInfo* scope_info,
                                       DeclarationScope* script_scope,
                                       AstValueFactory* ast_value_factory,
                                       DeserializationMode deserialization_mode);
@@ -256,7 +255,7 @@ class V8_EXPORT_PRIVATE Scope : public NON_EXPORTED_BASE(ZoneObject) {
   // which is an error even though the two 'e's are declared in different
   // scopes.
   Declaration* CheckLexDeclarationsConflictingWith(
-      const ZoneList<const AstRawString*>& names);
+      const ZonePtrList<const AstRawString>& names);
 
   // ---------------------------------------------------------------------------
   // Scope-specific info.
@@ -366,7 +365,8 @@ class V8_EXPORT_PRIVATE Scope : public NON_EXPORTED_BASE(ZoneObject) {
   // Whether this needs to be represented by a runtime context.
   bool NeedsContext() const {
     // Catch scopes always have heap slots.
-    DCHECK(!is_catch_scope() || num_heap_slots() > 0);
+    DCHECK_IMPLIES(is_catch_scope(), num_heap_slots() > 0);
+    DCHECK_IMPLIES(is_with_scope(), num_heap_slots() > 0);
     return num_heap_slots() > 0;
   }
 
@@ -812,7 +812,7 @@ class V8_EXPORT_PRIVATE DeclarationScope : public Scope {
   // The local variable 'arguments' if we need to allocate it; nullptr
   // otherwise.
   Variable* arguments() const {
-    DCHECK(!is_arrow_scope() || arguments_ == nullptr);
+    DCHECK_IMPLIES(is_arrow_scope(), arguments_ == nullptr);
     return arguments_;
   }
 
@@ -867,10 +867,9 @@ class V8_EXPORT_PRIVATE DeclarationScope : public Scope {
 
   // Allocate ScopeInfos for top scope and any inner scopes that need them.
   // Does nothing if ScopeInfo is already allocated.
-  static void AllocateScopeInfos(ParseInfo* info, Isolate* isolate,
-                                 AnalyzeMode mode);
+  static void AllocateScopeInfos(ParseInfo* info, Isolate* isolate);
 
-  Handle<StringSet> CollectNonLocals(ParseInfo* info,
+  Handle<StringSet> CollectNonLocals(Isolate* isolate, ParseInfo* info,
                                      Handle<StringSet> non_locals);
 
   // Determine if we can use lazy compilation for this scope.
@@ -964,7 +963,7 @@ class V8_EXPORT_PRIVATE DeclarationScope : public Scope {
   bool has_inferred_function_name_ : 1;
 
   // Parameter list in source order.
-  ZoneList<Variable*> params_;
+  ZonePtrList<Variable> params_;
   // Map of function names to lists of functions defined in sloppy blocks
   SloppyBlockFunctionMap* sloppy_block_function_map_;
   // Convenience variable.
@@ -1031,7 +1030,8 @@ class ModuleScope final : public DeclarationScope {
   // The generated ModuleDescriptor does not preserve all information.  In
   // particular, its module_requests map will be empty because we no longer need
   // the map after parsing.
-  ModuleScope(Handle<ScopeInfo> scope_info, AstValueFactory* ast_value_factory);
+  ModuleScope(Isolate* isolate, Handle<ScopeInfo> scope_info,
+              AstValueFactory* ast_value_factory);
 
   ModuleDescriptor* module() const {
     DCHECK_NOT_NULL(module_descriptor_);
diff --git a/deps/v8/src/ast/variables.cc b/deps/v8/src/ast/variables.cc
index bce552c2c16f62..addcf8db2bd4b6 100644
--- a/deps/v8/src/ast/variables.cc
+++ b/deps/v8/src/ast/variables.cc
@@ -26,7 +26,7 @@ Variable::Variable(Variable* other)
 bool Variable::IsGlobalObjectProperty() const {
   // Temporaries are never global, they must always be allocated in the
   // activation frame.
-  return (IsDynamicVariableMode(mode()) || mode() == VAR) &&
+  return (IsDynamicVariableMode(mode()) || mode() == VariableMode::kVar) &&
          scope_ != nullptr && scope_->is_script_scope();
 }
 
diff --git a/deps/v8/src/ast/variables.h b/deps/v8/src/ast/variables.h
index 4d58c8fed9388e..10ac5c48a53cee 100644
--- a/deps/v8/src/ast/variables.h
+++ b/deps/v8/src/ast/variables.h
@@ -36,7 +36,8 @@ class Variable final : public ZoneObject {
                    LocationField::encode(VariableLocation::UNALLOCATED) |
                    VariableKindField::encode(kind)) {
     // Var declared variables never need initialization.
-    DCHECK(!(mode == VAR && initialization_flag == kNeedsInitialization));
+    DCHECK(!(mode == VariableMode::kVar &&
+             initialization_flag == kNeedsInitialization));
   }
 
   explicit Variable(Variable* other);
@@ -137,7 +138,8 @@ class Variable final : public ZoneObject {
   }
 
   Variable* local_if_not_shadowed() const {
-    DCHECK(mode() == DYNAMIC_LOCAL && local_if_not_shadowed_ != nullptr);
+    DCHECK(mode() == VariableMode::kDynamicLocal &&
+           local_if_not_shadowed_ != nullptr);
     return local_if_not_shadowed_;
   }
 
@@ -175,7 +177,8 @@ class Variable final : public ZoneObject {
 
   static InitializationFlag DefaultInitializationFlag(VariableMode mode) {
     DCHECK(IsDeclaredVariableMode(mode));
-    return mode == VAR ? kCreatedInitialized : kNeedsInitialization;
+    return mode == VariableMode::kVar ? kCreatedInitialized
+                                      : kNeedsInitialization;
   }
 
   typedef ThreadedList<Variable> List;
diff --git a/deps/v8/src/async-hooks-wrapper.cc b/deps/v8/src/async-hooks-wrapper.cc
new file mode 100644
index 00000000000000..cc080d9cfcd74e
--- /dev/null
+++ b/deps/v8/src/async-hooks-wrapper.cc
@@ -0,0 +1,259 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "src/async-hooks-wrapper.h"
+#include "src/d8.h"
+
+namespace v8 {
+
+void AsyncHooksWrap::Enable() { enabled_ = true; }
+
+void AsyncHooksWrap::Disable() { enabled_ = false; }
+
+v8::Local<v8::Function> AsyncHooksWrap::init_function() const {
+  return init_function_.Get(isolate_);
+}
+void AsyncHooksWrap::set_init_function(v8::Local<v8::Function> value) {
+  init_function_.Reset(isolate_, value);
+}
+v8::Local<v8::Function> AsyncHooksWrap::before_function() const {
+  return before_function_.Get(isolate_);
+}
+void AsyncHooksWrap::set_before_function(v8::Local<v8::Function> value) {
+  before_function_.Reset(isolate_, value);
+}
+v8::Local<v8::Function> AsyncHooksWrap::after_function() const {
+  return after_function_.Get(isolate_);
+}
+void AsyncHooksWrap::set_after_function(v8::Local<v8::Function> value) {
+  after_function_.Reset(isolate_, value);
+}
+v8::Local<v8::Function> AsyncHooksWrap::promiseResolve_function() const {
+  return promiseResolve_function_.Get(isolate_);
+}
+void AsyncHooksWrap::set_promiseResolve_function(
+    v8::Local<v8::Function> value) {
+  promiseResolve_function_.Reset(isolate_, value);
+}
+
+static AsyncHooksWrap* UnwrapHook(
+    const v8::FunctionCallbackInfo<v8::Value>& args) {
+  Isolate* isolate = args.GetIsolate();
+  HandleScope scope(isolate);
+  Local<Object> hook = args.This();
+  Local<External> wrap = Local<External>::Cast(hook->GetInternalField(0));
+  void* ptr = wrap->Value();
+  return static_cast<AsyncHooksWrap*>(ptr);
+}
+
+static void EnableHook(const v8::FunctionCallbackInfo<v8::Value>& args) {
+  AsyncHooksWrap* wrap = UnwrapHook(args);
+  wrap->Enable();
+}
+
+static void DisableHook(const v8::FunctionCallbackInfo<v8::Value>& args) {
+  AsyncHooksWrap* wrap = UnwrapHook(args);
+  wrap->Disable();
+}
+
+async_id_t AsyncHooks::GetExecutionAsyncId() const {
+  return asyncContexts.top().execution_async_id;
+}
+
+async_id_t AsyncHooks::GetTriggerAsyncId() const {
+  return asyncContexts.top().trigger_async_id;
+}
+
+Local<Object> AsyncHooks::CreateHook(
+    const v8::FunctionCallbackInfo<v8::Value>& args) {
+  Isolate* isolate = args.GetIsolate();
+  EscapableHandleScope handle_scope(isolate);
+
+  Local<Context> currentContext = isolate->GetCurrentContext();
+
+  if (args.Length() != 1 || !args[0]->IsObject()) {
+    isolate->ThrowException(
+        String::NewFromUtf8(isolate, "Invalid arguments passed to createHook",
+                            NewStringType::kNormal)
+            .ToLocalChecked());
+    return Local<Object>();
+  }
+
+  AsyncHooksWrap* wrap = new AsyncHooksWrap(isolate);
+
+  Local<Object> fn_obj = args[0].As<Object>();
+
+#define SET_HOOK_FN(name)                                                   \
+  Local<Value> name##_v =                                                   \
+      fn_obj                                                                \
+          ->Get(currentContext,                                             \
+                String::NewFromUtf8(isolate, #name, NewStringType::kNormal) \
+                    .ToLocalChecked())                                      \
+          .ToLocalChecked();                                                \
+  if (name##_v->IsFunction()) {                                             \
+    wrap->set_##name##_function(name##_v.As<Function>());                   \
+  }
+
+  SET_HOOK_FN(init);
+  SET_HOOK_FN(before);
+  SET_HOOK_FN(after);
+  SET_HOOK_FN(promiseResolve);
+#undef SET_HOOK_FN
+
+  async_wraps_.push_back(wrap);
+
+  Local<Object> obj = async_hooks_templ.Get(isolate)
+                          ->NewInstance(currentContext)
+                          .ToLocalChecked();
+  obj->SetInternalField(0, External::New(isolate, wrap));
+
+  return handle_scope.Escape(obj);
+}
+
+void AsyncHooks::ShellPromiseHook(PromiseHookType type, Local<Promise> promise,
+                                  Local<Value> parent) {
+  AsyncHooks* hooks =
+      PerIsolateData::Get(promise->GetIsolate())->GetAsyncHooks();
+
+  HandleScope handle_scope(hooks->isolate_);
+
+  Local<Context> currentContext = hooks->isolate_->GetCurrentContext();
+
+  if (type == PromiseHookType::kInit) {
+    ++hooks->current_async_id;
+    Local<Integer> async_id =
+        Integer::New(hooks->isolate_, hooks->current_async_id);
+
+    promise->SetPrivate(currentContext,
+                        hooks->async_id_smb.Get(hooks->isolate_), async_id);
+    if (parent->IsPromise()) {
+      Local<Promise> parent_promise = parent.As<Promise>();
+      Local<Value> parent_async_id =
+          parent_promise
+              ->GetPrivate(hooks->isolate_->GetCurrentContext(),
+                           hooks->async_id_smb.Get(hooks->isolate_))
+              .ToLocalChecked();
+      promise->SetPrivate(currentContext,
+                          hooks->trigger_id_smb.Get(hooks->isolate_),
+                          parent_async_id);
+    } else {
+      CHECK(parent->IsUndefined());
+      Local<Integer> trigger_id = Integer::New(hooks->isolate_, 0);
+      promise->SetPrivate(currentContext,
+                          hooks->trigger_id_smb.Get(hooks->isolate_),
+                          trigger_id);
+    }
+  } else if (type == PromiseHookType::kBefore) {
+    AsyncContext ctx;
+    ctx.execution_async_id =
+        promise
+            ->GetPrivate(hooks->isolate_->GetCurrentContext(),
+                         hooks->async_id_smb.Get(hooks->isolate_))
+            .ToLocalChecked()
+            .As<Integer>()
+            ->Value();
+    ctx.trigger_async_id =
+        promise
+            ->GetPrivate(hooks->isolate_->GetCurrentContext(),
+                         hooks->trigger_id_smb.Get(hooks->isolate_))
+            .ToLocalChecked()
+            .As<Integer>()
+            ->Value();
+    hooks->asyncContexts.push(ctx);
+  } else if (type == PromiseHookType::kAfter) {
+    hooks->asyncContexts.pop();
+  }
+
+  for (AsyncHooksWrap* wrap : hooks->async_wraps_) {
+    PromiseHookDispatch(type, promise, parent, wrap, hooks);
+  }
+}
+
+void AsyncHooks::Initialize() {
+  HandleScope handle_scope(isolate_);
+
+  async_hook_ctor.Reset(isolate_, FunctionTemplate::New(isolate_));
+  async_hook_ctor.Get(isolate_)->SetClassName(
+      String::NewFromUtf8(isolate_, "AsyncHook", NewStringType::kNormal)
+          .ToLocalChecked());
+
+  async_hooks_templ.Reset(isolate_,
+                          async_hook_ctor.Get(isolate_)->InstanceTemplate());
+  async_hooks_templ.Get(isolate_)->SetInternalFieldCount(1);
+  async_hooks_templ.Get(isolate_)->Set(
+      String::NewFromUtf8(isolate_, "enable"),
+      FunctionTemplate::New(isolate_, EnableHook));
+  async_hooks_templ.Get(isolate_)->Set(
+      String::NewFromUtf8(isolate_, "disable"),
+      FunctionTemplate::New(isolate_, DisableHook));
+
+  async_id_smb.Reset(isolate_, Private::New(isolate_));
+  trigger_id_smb.Reset(isolate_, Private::New(isolate_));
+
+  isolate_->SetPromiseHook(ShellPromiseHook);
+}
+
+void AsyncHooks::Deinitialize() {
+  isolate_->SetPromiseHook(nullptr);
+  for (AsyncHooksWrap* wrap : async_wraps_) {
+    delete wrap;
+  }
+}
+
+void AsyncHooks::PromiseHookDispatch(PromiseHookType type,
+                                     Local<Promise> promise,
+                                     Local<Value> parent, AsyncHooksWrap* wrap,
+                                     AsyncHooks* hooks) {
+  if (!wrap->IsEnabled()) {
+    return;
+  }
+
+  HandleScope handle_scope(hooks->isolate_);
+
+  TryCatch try_catch(hooks->isolate_);
+  try_catch.SetVerbose(true);
+
+  Local<Value> rcv = Undefined(hooks->isolate_);
+  Local<Value> async_id =
+      promise
+          ->GetPrivate(hooks->isolate_->GetCurrentContext(),
+                       hooks->async_id_smb.Get(hooks->isolate_))
+          .ToLocalChecked();
+  Local<Value> args[1] = {async_id};
+
+  // Sacrifice the brevity for readability and debugfulness
+  if (type == PromiseHookType::kInit) {
+    if (!wrap->init_function().IsEmpty()) {
+      Local<Value> initArgs[4] = {
+          async_id,
+          String::NewFromUtf8(hooks->isolate_, "PROMISE",
+                              NewStringType::kNormal)
+              .ToLocalChecked(),
+          promise
+              ->GetPrivate(hooks->isolate_->GetCurrentContext(),
+                           hooks->trigger_id_smb.Get(hooks->isolate_))
+              .ToLocalChecked(),
+          promise};
+      wrap->init_function()->Call(rcv, 4, initArgs);
+    }
+  } else if (type == PromiseHookType::kBefore) {
+    if (!wrap->before_function().IsEmpty()) {
+      wrap->before_function()->Call(rcv, 1, args);
+    }
+  } else if (type == PromiseHookType::kAfter) {
+    if (!wrap->after_function().IsEmpty()) {
+      wrap->after_function()->Call(rcv, 1, args);
+    }
+  } else if (type == PromiseHookType::kResolve) {
+    if (!wrap->promiseResolve_function().IsEmpty()) {
+      wrap->promiseResolve_function()->Call(rcv, 1, args);
+    }
+  }
+
+  if (try_catch.HasCaught()) {
+    Shell::ReportException(hooks->isolate_, &try_catch);
+  }
+}
+
+}  // namespace v8
diff --git a/deps/v8/src/async-hooks-wrapper.h b/deps/v8/src/async-hooks-wrapper.h
new file mode 100644
index 00000000000000..c0c72373e016ce
--- /dev/null
+++ b/deps/v8/src/async-hooks-wrapper.h
@@ -0,0 +1,95 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef V8_ASYNC_HOOKS_WRAPPER_H_
+#define V8_ASYNC_HOOKS_WRAPPER_H_
+
+#include <stack>
+
+#include "include/v8.h"
+#include "src/objects.h"
+
+namespace v8 {
+
+typedef double async_id_t;
+
+struct AsyncContext {
+  async_id_t execution_async_id;
+  async_id_t trigger_async_id;
+};
+
+class AsyncHooksWrap {
+ public:
+  explicit AsyncHooksWrap(Isolate* isolate) {
+    enabled_ = false;
+    isolate_ = isolate;
+  }
+  void Enable();
+  void Disable();
+  bool IsEnabled() const { return enabled_; }
+
+  inline v8::Local<v8::Function> init_function() const;
+  inline void set_init_function(v8::Local<v8::Function> value);
+  inline v8::Local<v8::Function> before_function() const;
+  inline void set_before_function(v8::Local<v8::Function> value);
+  inline v8::Local<v8::Function> after_function() const;
+  inline void set_after_function(v8::Local<v8::Function> value);
+  inline v8::Local<v8::Function> promiseResolve_function() const;
+  inline void set_promiseResolve_function(v8::Local<v8::Function> value);
+
+ private:
+  Isolate* isolate_;
+
+  Persistent<v8::Function> init_function_;
+  Persistent<v8::Function> before_function_;
+  Persistent<v8::Function> after_function_;
+  Persistent<v8::Function> promiseResolve_function_;
+
+  bool enabled_;
+};
+
+class AsyncHooks {
+ public:
+  explicit AsyncHooks(Isolate* isolate) {
+    isolate_ = isolate;
+
+    AsyncContext ctx;
+    ctx.execution_async_id = 1;
+    ctx.trigger_async_id = 0;
+    asyncContexts.push(ctx);
+    current_async_id = 1;
+
+    Initialize();
+  }
+  ~AsyncHooks() { Deinitialize(); }
+
+  async_id_t GetExecutionAsyncId() const;
+  async_id_t GetTriggerAsyncId() const;
+
+  Local<Object> CreateHook(const v8::FunctionCallbackInfo<v8::Value>& args);
+
+ private:
+  std::vector<AsyncHooksWrap*> async_wraps_;
+  Isolate* isolate_;
+  Persistent<FunctionTemplate> async_hook_ctor;
+  Persistent<ObjectTemplate> async_hooks_templ;
+  Persistent<Private> async_id_smb;
+  Persistent<Private> trigger_id_smb;
+
+  void Initialize();
+  void Deinitialize();
+
+  static void ShellPromiseHook(PromiseHookType type, Local<Promise> promise,
+                               Local<Value> parent);
+  static void PromiseHookDispatch(PromiseHookType type, Local<Promise> promise,
+                                  Local<Value> parent, AsyncHooksWrap* wrap,
+                                  AsyncHooks* hooks);
+
+  std::stack<AsyncContext> asyncContexts;
+  async_id_t current_async_id;
+};
+
+}  // namespace v8
+
+#endif  // V8_ASYNC_HOOKS_WRAPPER_H_
diff --git a/deps/v8/src/bailout-reason.h b/deps/v8/src/bailout-reason.h
index d29693e3f8a042..d48d6960226015 100644
--- a/deps/v8/src/bailout-reason.h
+++ b/deps/v8/src/bailout-reason.h
@@ -31,7 +31,8 @@ namespace internal {
     "Invalid ElementsKind for InternalArray or InternalPackedArray")           \
   V(kInvalidHandleScopeLevel, "Invalid HandleScope level")                     \
   V(kInvalidJumpTableIndex, "Invalid jump table index")                        \
-  V(kInvalidRegisterFileInGenerator, "invalid register file in generator")     \
+  V(kInvalidParametersAndRegistersInGenerator,                                 \
+    "invalid parameters and registers in generator")                           \
   V(kInvalidSharedFunctionInfoData, "Invalid SharedFunctionInfo data")         \
   V(kMissingBytecodeArray, "Missing bytecode array from function")             \
   V(kObjectNotTagged, "The object is not tagged")                              \
diff --git a/deps/v8/src/base/adapters.h b/deps/v8/src/base/adapters.h
index f04391e2b22cad..6eeaed140bf0dd 100644
--- a/deps/v8/src/base/adapters.h
+++ b/deps/v8/src/base/adapters.h
@@ -8,6 +8,8 @@
 #ifndef V8_BASE_ADAPTERS_H_
 #define V8_BASE_ADAPTERS_H_
 
+#include <iterator>
+
 #include "src/base/macros.h"
 
 namespace v8 {
@@ -17,13 +19,15 @@ namespace base {
 template <typename T>
 class ReversedAdapter {
  public:
-  typedef decltype(static_cast<T*>(nullptr)->rbegin()) Iterator;
+  using Iterator =
+      std::reverse_iterator<decltype(std::begin(std::declval<T>()))>;
 
   explicit ReversedAdapter(T& t) : t_(t) {}
-  ReversedAdapter(const ReversedAdapter& ra) : t_(ra.t_) {}
+  ReversedAdapter(const ReversedAdapter& ra) = default;
 
-  Iterator begin() const { return t_.rbegin(); }
-  Iterator end() const { return t_.rend(); }
+  // TODO(clemensh): Use std::rbegin/std::rend once we have C++14 support.
+  Iterator begin() const { return Iterator(std::end(t_)); }
+  Iterator end() const { return Iterator(std::begin(t_)); }
 
  private:
   T& t_;
diff --git a/deps/v8/src/base/atomic-utils.h b/deps/v8/src/base/atomic-utils.h
index 5ba1ad424606c1..7787e4ff5279d3 100644
--- a/deps/v8/src/base/atomic-utils.h
+++ b/deps/v8/src/base/atomic-utils.h
@@ -14,6 +14,7 @@
 namespace v8 {
 namespace base {
 
+// Deprecated. Use std::atomic<T> for new code.
 template <class T>
 class AtomicNumber {
  public:
diff --git a/deps/v8/src/base/flags.h b/deps/v8/src/base/flags.h
index 3bec12cb88eff2..c1637de81c7009 100644
--- a/deps/v8/src/base/flags.h
+++ b/deps/v8/src/base/flags.h
@@ -27,15 +27,15 @@ class Flags final {
   typedef T flag_type;
   typedef S mask_type;
 
-  Flags() : mask_(0) {}
-  Flags(flag_type flag)  // NOLINT(runtime/explicit)
+  constexpr Flags() : mask_(0) {}
+  constexpr Flags(flag_type flag)  // NOLINT(runtime/explicit)
       : mask_(static_cast<S>(flag)) {}
-  explicit Flags(mask_type mask) : mask_(static_cast<S>(mask)) {}
+  constexpr explicit Flags(mask_type mask) : mask_(static_cast<S>(mask)) {}
 
-  bool operator==(flag_type flag) const {
+  constexpr bool operator==(flag_type flag) const {
     return mask_ == static_cast<S>(flag);
   }
-  bool operator!=(flag_type flag) const {
+  constexpr bool operator!=(flag_type flag) const {
     return mask_ != static_cast<S>(flag);
   }
 
@@ -52,22 +52,34 @@ class Flags final {
     return *this;
   }
 
-  Flags operator&(const Flags& flags) const { return Flags(*this) &= flags; }
-  Flags operator|(const Flags& flags) const { return Flags(*this) |= flags; }
-  Flags operator^(const Flags& flags) const { return Flags(*this) ^= flags; }
+  constexpr Flags operator&(const Flags& flags) const {
+    return Flags(*this) &= flags;
+  }
+  constexpr Flags operator|(const Flags& flags) const {
+    return Flags(*this) |= flags;
+  }
+  constexpr Flags operator^(const Flags& flags) const {
+    return Flags(*this) ^= flags;
+  }
 
   Flags& operator&=(flag_type flag) { return operator&=(Flags(flag)); }
   Flags& operator|=(flag_type flag) { return operator|=(Flags(flag)); }
   Flags& operator^=(flag_type flag) { return operator^=(Flags(flag)); }
 
-  Flags operator&(flag_type flag) const { return operator&(Flags(flag)); }
-  Flags operator|(flag_type flag) const { return operator|(Flags(flag)); }
-  Flags operator^(flag_type flag) const { return operator^(Flags(flag)); }
+  constexpr Flags operator&(flag_type flag) const {
+    return operator&(Flags(flag));
+  }
+  constexpr Flags operator|(flag_type flag) const {
+    return operator|(Flags(flag));
+  }
+  constexpr Flags operator^(flag_type flag) const {
+    return operator^(Flags(flag));
+  }
 
-  Flags operator~() const { return Flags(~mask_); }
+  constexpr Flags operator~() const { return Flags(~mask_); }
 
-  operator mask_type() const { return mask_; }
-  bool operator!() const { return !mask_; }
+  constexpr operator mask_type() const { return mask_; }
+  constexpr bool operator!() const { return !mask_; }
 
   friend size_t hash_value(const Flags& flags) { return flags.mask_; }
 
diff --git a/deps/v8/src/base/ieee754.cc b/deps/v8/src/base/ieee754.cc
index 95b84cf328021b..7a1cc175cb733e 100644
--- a/deps/v8/src/base/ieee754.cc
+++ b/deps/v8/src/base/ieee754.cc
@@ -51,6 +51,7 @@ namespace {
 /*
  * A union which permits us to convert between a double and two 32 bit
  * ints.
+ * TODO(jkummerow): This is undefined behavior. Use bit_cast instead.
  */
 
 #if V8_TARGET_LITTLE_ENDIAN
diff --git a/deps/v8/src/base/list.h b/deps/v8/src/base/list.h
new file mode 100644
index 00000000000000..18e45318a24e8a
--- /dev/null
+++ b/deps/v8/src/base/list.h
@@ -0,0 +1,136 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef V8_BASE_LIST_H_
+#define V8_BASE_LIST_H_
+
+#include <atomic>
+
+#include "src/base/logging.h"
+
+namespace v8 {
+namespace base {
+
+template <class T>
+class List {
+ public:
+  List() : front_(nullptr), back_(nullptr) {}
+
+  void PushBack(T* element) {
+    DCHECK(!element->list_node().next());
+    DCHECK(!element->list_node().prev());
+    if (back_) {
+      DCHECK(front_);
+      InsertAfter(element, back_);
+    } else {
+      AddFirstElement(element);
+    }
+  }
+
+  void PushFront(T* element) {
+    DCHECK(!element->list_node().next());
+    DCHECK(!element->list_node().prev());
+    if (front_) {
+      DCHECK(back_);
+      InsertBefore(element, front_);
+    } else {
+      AddFirstElement(element);
+    }
+  }
+
+  void Remove(T* element) {
+    DCHECK(Contains(element));
+    if (back_ == element) {
+      back_ = element->list_node().prev();
+    }
+    if (front_ == element) {
+      front_ = element->list_node().next();
+    }
+    T* next = element->list_node().next();
+    T* prev = element->list_node().prev();
+    if (next) next->list_node().set_prev(prev);
+    if (prev) prev->list_node().set_next(next);
+    element->list_node().set_prev(nullptr);
+    element->list_node().set_next(nullptr);
+  }
+
+  bool Contains(T* element) {
+    T* it = front_;
+    while (it) {
+      if (it == element) return true;
+      it = it->list_node().next();
+    }
+    return false;
+  }
+
+  bool Empty() { return !front_ && !back_; }
+
+  T* front() { return front_; }
+  T* back() { return back_; }
+
+ private:
+  void AddFirstElement(T* element) {
+    DCHECK(!back_);
+    DCHECK(!front_);
+    DCHECK(!element->list_node().next());
+    DCHECK(!element->list_node().prev());
+    element->list_node().set_prev(nullptr);
+    element->list_node().set_next(nullptr);
+    front_ = element;
+    back_ = element;
+  }
+
+  void InsertAfter(T* element, T* other) {
+    T* other_next = other->list_node().next();
+    element->list_node().set_next(other_next);
+    element->list_node().set_prev(other);
+    other->list_node().set_next(element);
+    if (other_next)
+      other_next->list_node().set_prev(element);
+    else
+      back_ = element;
+  }
+
+  void InsertBefore(T* element, T* other) {
+    T* other_prev = other->list_node().prev();
+    element->list_node().set_next(other);
+    element->list_node().set_prev(other_prev);
+    other->list_node().set_prev(element);
+    if (other_prev) {
+      other_prev->list_node().set_next(element);
+    } else {
+      front_ = element;
+    }
+  }
+
+  T* front_;
+  T* back_;
+};
+
+template <class T>
+class ListNode {
+ public:
+  ListNode() { Initialize(); }
+
+  T* next() { return next_; }
+  T* prev() { return prev_; }
+
+  void Initialize() {
+    next_ = nullptr;
+    prev_ = nullptr;
+  }
+
+ private:
+  void set_next(T* next) { next_ = next; }
+  void set_prev(T* prev) { prev_ = prev; }
+
+  T* next_;
+  T* prev_;
+
+  friend class List<T>;
+};
+}  // namespace base
+}  // namespace v8
+
+#endif  // V8_BASE_LIST_H_
diff --git a/deps/v8/src/base/logging.cc b/deps/v8/src/base/logging.cc
index e58fdba09f54af..64f7fed413e3c1 100644
--- a/deps/v8/src/base/logging.cc
+++ b/deps/v8/src/base/logging.cc
@@ -135,7 +135,7 @@ class FailureMessage {
 
   static const uintptr_t kStartMarker = 0xdecade10;
   static const uintptr_t kEndMarker = 0xdecade11;
-  static const int kMessageBufferSize = 1024;
+  static const int kMessageBufferSize = 512;
 
   uintptr_t start_marker_ = kStartMarker;
   char message_[kMessageBufferSize];
@@ -154,6 +154,7 @@ void V8_Fatal(const char* file, int line, const char* format, ...) {
 
   fflush(stdout);
   fflush(stderr);
+  // Print the formatted message to stdout without cropping the output.
   v8::base::OS::PrintError("\n\n#\n# Fatal error in %s, line %d\n# ", file,
                            line);
 
diff --git a/deps/v8/src/base/macros.h b/deps/v8/src/base/macros.h
index db2f19459168f0..5d10ae4ec0a5a0 100644
--- a/deps/v8/src/base/macros.h
+++ b/deps/v8/src/base/macros.h
@@ -43,7 +43,6 @@ template <typename T, size_t N>
 char (&ArraySizeHelper(const T (&array)[N]))[N];
 #endif
 
-
 // bit_cast<Dest,Source> is a template function that implements the
 // equivalent of "*reinterpret_cast<Dest*>(&source)".  We need this in
 // very low-level functions like the protobuf library and fast math
@@ -146,24 +145,27 @@ V8_INLINE Dest bit_cast(Source const& source) {
   void operator delete(void*, size_t) { base::OS::Abort(); } \
   void operator delete[](void*, size_t) { base::OS::Abort(); }
 
-// Newly written code should use V8_INLINE and V8_NOINLINE directly.
-#define INLINE(declarator)    V8_INLINE declarator
-#define NO_INLINE(declarator) V8_NOINLINE declarator
-
-// Define V8_USE_ADDRESS_SANITIZER macros.
+// Define V8_USE_ADDRESS_SANITIZER macro.
 #if defined(__has_feature)
 #if __has_feature(address_sanitizer)
 #define V8_USE_ADDRESS_SANITIZER 1
 #endif
 #endif
 
-// Define DISABLE_ASAN macros.
+// Define DISABLE_ASAN macro.
 #ifdef V8_USE_ADDRESS_SANITIZER
 #define DISABLE_ASAN __attribute__((no_sanitize_address))
 #else
 #define DISABLE_ASAN
 #endif
 
+// Define V8_USE_MEMORY_SANITIZER macro.
+#if defined(__has_feature)
+#if __has_feature(memory_sanitizer)
+#define V8_USE_MEMORY_SANITIZER 1
+#endif
+#endif
+
 // Helper macro to define no_sanitize attributes only with clang.
 #if defined(__clang__) && defined(__has_attribute)
 #if __has_attribute(no_sanitize)
@@ -271,6 +273,14 @@ struct Use {
 }  // namespace base
 }  // namespace v8
 
+// implicit_cast<A>(x) triggers an implicit cast from {x} to type {A}. This is
+// useful in situations where static_cast<A>(x) would do too much.
+// Only use this for cheap-to-copy types, or use move semantics explicitly.
+template <class A>
+V8_INLINE A implicit_cast(A x) {
+  return x;
+}
+
 // Define our own macros for writing 64-bit constants.  This is less fragile
 // than defining __STDC_CONSTANT_MACROS before including <stdint.h>, and it
 // works on compilers that don't have it (like MSVC).
@@ -296,6 +306,14 @@ struct Use {
 #define V8PRIdPTR V8_PTR_PREFIX "d"
 #define V8PRIuPTR V8_PTR_PREFIX "u"
 
+#ifdef V8_TARGET_ARCH_64_BIT
+#define V8_PTR_HEX_DIGITS 12
+#define V8PRIxPTR_FMT "0x%012" V8PRIxPTR
+#else
+#define V8_PTR_HEX_DIGITS 8
+#define V8PRIxPTR_FMT "0x%08" V8PRIxPTR
+#endif
+
 // ptrdiff_t is 't' according to the standard, but MSVC uses 'I'.
 #if V8_CC_MSVC
 #define V8PRIxPTRDIFF "Ix"
diff --git a/deps/v8/src/base/platform/mutex.h b/deps/v8/src/base/platform/mutex.h
index 59b653d6cd9060..6b4158f079e3e8 100644
--- a/deps/v8/src/base/platform/mutex.h
+++ b/deps/v8/src/base/platform/mutex.h
@@ -203,11 +203,21 @@ typedef LazyStaticInstance<RecursiveMutex,
 // object was created, the LockGuard is destructed and the mutex is released.
 // The LockGuard class is non-copyable.
 
-template <typename Mutex>
+// Controls whether a LockGuard always requires a valid Mutex or will just
+// ignore it if it's nullptr.
+enum class NullBehavior { kRequireNotNull, kIgnoreIfNull };
+
+template <typename Mutex, NullBehavior Behavior = NullBehavior::kRequireNotNull>
 class LockGuard final {
  public:
-  explicit LockGuard(Mutex* mutex) : mutex_(mutex) { mutex_->Lock(); }
-  ~LockGuard() { mutex_->Unlock(); }
+  explicit LockGuard(Mutex* mutex) : mutex_(mutex) {
+    if (Behavior == NullBehavior::kRequireNotNull || mutex_ != nullptr) {
+      mutex_->Lock();
+    }
+  }
+  ~LockGuard() {
+    if (mutex_ != nullptr) mutex_->Unlock();
+  }
 
  private:
   Mutex* mutex_;
diff --git a/deps/v8/src/base/platform/platform-cygwin.cc b/deps/v8/src/base/platform/platform-cygwin.cc
index ddcdc1a2d38078..c5d94fc6ba55b4 100644
--- a/deps/v8/src/base/platform/platform-cygwin.cc
+++ b/deps/v8/src/base/platform/platform-cygwin.cc
@@ -34,6 +34,8 @@ DWORD GetProtectionFromMemoryPermission(OS::MemoryPermission access) {
   switch (access) {
     case OS::MemoryPermission::kNoAccess:
       return PAGE_NOACCESS;
+    case OS::MemoryPermission::kRead:
+      return PAGE_READONLY;
     case OS::MemoryPermission::kReadWrite:
       return PAGE_READWRITE;
     case OS::MemoryPermission::kReadWriteExecute:
diff --git a/deps/v8/src/base/platform/platform-fuchsia.cc b/deps/v8/src/base/platform/platform-fuchsia.cc
index bba3f1baba953c..3a9d65a12d393d 100644
--- a/deps/v8/src/base/platform/platform-fuchsia.cc
+++ b/deps/v8/src/base/platform/platform-fuchsia.cc
@@ -19,6 +19,8 @@ uint32_t GetProtectionFromMemoryPermission(OS::MemoryPermission access) {
   switch (access) {
     case OS::MemoryPermission::kNoAccess:
       return 0;  // no permissions
+    case OS::MemoryPermission::kRead:
+      return ZX_VM_FLAG_PERM_READ;
     case OS::MemoryPermission::kReadWrite:
       return ZX_VM_FLAG_PERM_READ | ZX_VM_FLAG_PERM_WRITE;
     case OS::MemoryPermission::kReadWriteExecute:
diff --git a/deps/v8/src/base/platform/platform-posix.cc b/deps/v8/src/base/platform/platform-posix.cc
index fee67589b6b45b..d21107d6f785f6 100644
--- a/deps/v8/src/base/platform/platform-posix.cc
+++ b/deps/v8/src/base/platform/platform-posix.cc
@@ -112,6 +112,8 @@ int GetProtectionFromMemoryPermission(OS::MemoryPermission access) {
   switch (access) {
     case OS::MemoryPermission::kNoAccess:
       return PROT_NONE;
+    case OS::MemoryPermission::kRead:
+      return PROT_READ;
     case OS::MemoryPermission::kReadWrite:
       return PROT_READ | PROT_WRITE;
     case OS::MemoryPermission::kReadWriteExecute:
@@ -352,6 +354,18 @@ bool OS::SetPermissions(void* address, size_t size, MemoryPermission access) {
   if (ret == 0 && access == OS::MemoryPermission::kNoAccess) {
     ret = ReclaimInaccessibleMemory(address, size);
   }
+
+// For accounting purposes, we want to call MADV_FREE_REUSE on macOS after
+// changing permissions away from OS::MemoryPermission::kNoAccess. Since this
+// state is not kept at this layer, we always call this if access != kNoAccess.
+// The cost is a syscall that effectively no-ops.
+// TODO(erikchen): Fix this to only call MADV_FREE_REUSE when necessary.
+// https://crbug.com/823915
+#if defined(OS_MACOSX)
+  if (access != OS::MemoryPermission::kNoAccess)
+    madvise(address, size, MADV_FREE_REUSE);
+#endif
+
   return ret == 0;
 }
 
diff --git a/deps/v8/src/base/platform/platform-win32.cc b/deps/v8/src/base/platform/platform-win32.cc
index d4aa44f8a7d96f..f618c65fb6458e 100644
--- a/deps/v8/src/base/platform/platform-win32.cc
+++ b/deps/v8/src/base/platform/platform-win32.cc
@@ -758,6 +758,8 @@ DWORD GetProtectionFromMemoryPermission(OS::MemoryPermission access) {
   switch (access) {
     case OS::MemoryPermission::kNoAccess:
       return PAGE_NOACCESS;
+    case OS::MemoryPermission::kRead:
+      return PAGE_READONLY;
     case OS::MemoryPermission::kReadWrite:
       return PAGE_READWRITE;
     case OS::MemoryPermission::kReadWriteExecute:
diff --git a/deps/v8/src/base/platform/platform.h b/deps/v8/src/base/platform/platform.h
index 4fbc87c4aaa58c..51b60148216ccc 100644
--- a/deps/v8/src/base/platform/platform.h
+++ b/deps/v8/src/base/platform/platform.h
@@ -48,7 +48,7 @@ namespace base {
 
 #define V8_FAST_TLS_SUPPORTED 1
 
-INLINE(intptr_t InternalGetExistingThreadLocal(intptr_t index));
+V8_INLINE intptr_t InternalGetExistingThreadLocal(intptr_t index);
 
 inline intptr_t InternalGetExistingThreadLocal(intptr_t index) {
   const intptr_t kTibInlineTlsOffset = 0xE10;
@@ -74,7 +74,7 @@ inline intptr_t InternalGetExistingThreadLocal(intptr_t index) {
 
 extern V8_BASE_EXPORT intptr_t kMacTlsBaseOffset;
 
-INLINE(intptr_t InternalGetExistingThreadLocal(intptr_t index));
+V8_INLINE intptr_t InternalGetExistingThreadLocal(intptr_t index);
 
 inline intptr_t InternalGetExistingThreadLocal(intptr_t index) {
   intptr_t result;
@@ -159,6 +159,7 @@ class V8_BASE_EXPORT OS {
   // v8::PageAllocator.
   enum class MemoryPermission {
     kNoAccess,
+    kRead,
     kReadWrite,
     // TODO(hpayer): Remove this flag. Memory should never be rwx.
     kReadWriteExecute,
diff --git a/deps/v8/src/base/platform/time.cc b/deps/v8/src/base/platform/time.cc
index cf34af646c9938..1ab56f42b5091c 100644
--- a/deps/v8/src/base/platform/time.cc
+++ b/deps/v8/src/base/platform/time.cc
@@ -86,6 +86,26 @@ V8_INLINE int64_t ClockNow(clockid_t clk_id) {
   return 0;
 #endif
 }
+
+V8_INLINE bool IsHighResolutionTimer(clockid_t clk_id) {
+  // Limit duration of timer resolution measurement to 100 ms. If we cannot
+  // measure timer resoltuion within this time, we assume a low resolution
+  // timer.
+  int64_t end =
+      ClockNow(clk_id) + 100 * v8::base::Time::kMicrosecondsPerMillisecond;
+  int64_t start, delta;
+  do {
+    start = ClockNow(clk_id);
+    // Loop until we can detect that the clock has changed. Non-HighRes timers
+    // will increment in chunks, i.e. 15ms. By spinning until we see a clock
+    // change, we detect the minimum time between measurements.
+    do {
+      delta = ClockNow(clk_id) - start;
+    } while (delta == 0);
+  } while (delta > 1 && start < end);
+  return delta <= 1;
+}
+
 #elif V8_OS_WIN
 V8_INLINE bool IsQPCReliable() {
   v8::base::CPU cpu;
@@ -735,7 +755,16 @@ TimeTicks TimeTicks::Now() {
 }
 
 // static
-bool TimeTicks::IsHighResolution() { return true; }
+bool TimeTicks::IsHighResolution() {
+#if V8_OS_MACOSX
+  return true;
+#elif V8_OS_POSIX
+  static bool is_high_resolution = IsHighResolutionTimer(CLOCK_MONOTONIC);
+  return is_high_resolution;
+#else
+  return true;
+#endif
+}
 
 #endif  // V8_OS_WIN
 
diff --git a/deps/v8/src/base/template-utils.h b/deps/v8/src/base/template-utils.h
index 07356346ec80eb..cbbe7e3cbf2d7e 100644
--- a/deps/v8/src/base/template-utils.h
+++ b/deps/v8/src/base/template-utils.h
@@ -56,13 +56,6 @@ std::unique_ptr<T> make_unique(Args&&... args) {
   return std::unique_ptr<T>(new T(std::forward<Args>(args)...));
 }
 
-// implicit_cast<A>(x) triggers an implicit cast from {x} to type {A}. This is
-// useful in situations where static_cast<A>(x) would do too much.
-template <class A>
-A implicit_cast(A x) {
-  return x;
-}
-
 // Helper to determine how to pass values: Pass scalars and arrays by value,
 // others by const reference (even if it was a non-const ref before; this is
 // disallowed by the style guide anyway).
diff --git a/deps/v8/src/bootstrapper.cc b/deps/v8/src/bootstrapper.cc
index 2138b9c73d7db7..4e793ecb618dff 100644
--- a/deps/v8/src/bootstrapper.cc
+++ b/deps/v8/src/bootstrapper.cc
@@ -19,38 +19,46 @@
 #include "src/extensions/trigger-failure-extension.h"
 #include "src/heap/heap.h"
 #include "src/isolate-inl.h"
+#include "src/objects/api-callbacks.h"
+#include "src/objects/arguments.h"
+#include "src/objects/hash-table-inl.h"
+#ifdef V8_INTL_SUPPORT
+#include "src/objects/intl-objects.h"
+#include "src/objects/js-locale.h"
+#endif  // V8_INTL_SUPPORT
+#include "src/objects/js-regexp-string-iterator.h"
 #include "src/objects/js-regexp.h"
+#ifdef V8_INTL_SUPPORT
+#include "src/objects/js-relative-time-format.h"
+#endif  // V8_INTL_SUPPORT
+#include "src/objects/templates.h"
 #include "src/snapshot/natives.h"
 #include "src/snapshot/snapshot.h"
 #include "src/wasm/wasm-js.h"
 
-#if V8_INTL_SUPPORT
-#include "src/objects/intl-objects.h"
-#endif  // V8_INTL_SUPPORT
-
 namespace v8 {
 namespace internal {
 
 void SourceCodeCache::Initialize(Isolate* isolate, bool create_heap_objects) {
-  cache_ = create_heap_objects ? isolate->heap()->empty_fixed_array() : nullptr;
+  cache_ = create_heap_objects ? ReadOnlyRoots(isolate).empty_fixed_array()
+                               : nullptr;
 }
 
-bool SourceCodeCache::Lookup(Vector<const char> name,
+bool SourceCodeCache::Lookup(Isolate* isolate, Vector<const char> name,
                              Handle<SharedFunctionInfo>* handle) {
   for (int i = 0; i < cache_->length(); i += 2) {
     SeqOneByteString* str = SeqOneByteString::cast(cache_->get(i));
     if (str->IsUtf8EqualTo(name)) {
       *handle = Handle<SharedFunctionInfo>(
-          SharedFunctionInfo::cast(cache_->get(i + 1)));
+          SharedFunctionInfo::cast(cache_->get(i + 1)), isolate);
       return true;
     }
   }
   return false;
 }
 
-void SourceCodeCache::Add(Vector<const char> name,
+void SourceCodeCache::Add(Isolate* isolate, Vector<const char> name,
                           Handle<SharedFunctionInfo> shared) {
-  Isolate* isolate = shared->GetIsolate();
   Factory* factory = isolate->factory();
   HandleScope scope(isolate);
   int length = cache_->length();
@@ -76,7 +84,6 @@ Handle<String> Bootstrapper::GetNativeSource(NativeType type, int index) {
       new NativesExternalStringResource(type, index);
   Handle<ExternalOneByteString> source_code =
       isolate_->factory()->NewNativeSourceString(resource);
-  isolate_->heap()->RegisterExternalString(*source_code);
   DCHECK(source_code->is_short());
   return source_code;
 }
@@ -161,7 +168,7 @@ class Genesis BASE_EMBEDDED {
   // Creates some basic objects. Used for creating a context from scratch.
   void CreateRoots();
   // Creates the empty function.  Used for creating a context from scratch.
-  Handle<JSFunction> CreateEmptyFunction(Isolate* isolate);
+  Handle<JSFunction> CreateEmptyFunction();
   // Returns the %ThrowTypeError% intrinsic function.
   // See ES#sec-%throwtypeerror% for details.
   Handle<JSFunction> GetThrowTypeErrorIntrinsic();
@@ -251,7 +258,8 @@ class Genesis BASE_EMBEDDED {
 
   // Used both for deserialized and from-scratch contexts to add the extensions
   // provided.
-  static bool InstallExtensions(Handle<Context> native_context,
+  static bool InstallExtensions(Isolate* isolate,
+                                Handle<Context> native_context,
                                 v8::ExtensionConfiguration* extensions);
   static bool InstallAutoExtensions(Isolate* isolate,
                                     ExtensionStates* extension_states);
@@ -264,7 +272,8 @@ class Genesis BASE_EMBEDDED {
   static bool InstallExtension(Isolate* isolate,
                                v8::RegisteredExtension* current,
                                ExtensionStates* extension_states);
-  static bool InstallSpecialObjects(Handle<Context> native_context);
+  static bool InstallSpecialObjects(Isolate* isolate,
+                                    Handle<Context> native_context);
   bool ConfigureApiObject(Handle<JSObject> object,
                           Handle<ObjectTemplateInfo> object_template);
   bool ConfigureGlobalObjects(
@@ -340,27 +349,28 @@ Handle<JSGlobalProxy> Bootstrapper::NewRemoteContext(
 }
 
 void Bootstrapper::DetachGlobal(Handle<Context> env) {
-  Isolate* isolate = env->GetIsolate();
-  isolate->counters()->errors_thrown_per_context()->AddSample(
+  isolate_->counters()->errors_thrown_per_context()->AddSample(
       env->GetErrorsThrown());
 
-  Heap* heap = isolate->heap();
-  Handle<JSGlobalProxy> global_proxy(JSGlobalProxy::cast(env->global_proxy()));
-  global_proxy->set_native_context(heap->null_value());
-  JSObject::ForceSetPrototype(global_proxy, isolate->factory()->null_value());
-  global_proxy->map()->SetConstructor(heap->null_value());
+  ReadOnlyRoots roots(isolate_);
+  Handle<JSGlobalProxy> global_proxy(JSGlobalProxy::cast(env->global_proxy()),
+                                     isolate_);
+  global_proxy->set_native_context(roots.null_value());
+  JSObject::ForceSetPrototype(global_proxy, isolate_->factory()->null_value());
+  global_proxy->map()->SetConstructor(roots.null_value());
   if (FLAG_track_detached_contexts) {
-    env->GetIsolate()->AddDetachedContext(env);
+    isolate_->AddDetachedContext(env);
   }
 }
 
 namespace {
 
 V8_NOINLINE Handle<SharedFunctionInfo> SimpleCreateSharedFunctionInfo(
-    Isolate* isolate, Builtins::Name builtin_id, Handle<String> name, int len) {
+    Isolate* isolate, Builtins::Name builtin_id, Handle<String> name, int len,
+    FunctionKind kind = FunctionKind::kNormalFunction) {
   Handle<SharedFunctionInfo> shared =
       isolate->factory()->NewSharedFunctionInfoForBuiltin(name, builtin_id,
-                                                          kNormalFunction);
+                                                          kind);
   shared->set_internal_formal_parameter_count(len);
   shared->set_length(len);
   return shared;
@@ -376,19 +386,19 @@ V8_NOINLINE Handle<SharedFunctionInfo> SimpleCreateBuiltinSharedFunctionInfo(
   return shared;
 }
 
-V8_NOINLINE void InstallFunction(Handle<JSObject> target,
+V8_NOINLINE void InstallFunction(Isolate* isolate, Handle<JSObject> target,
                                  Handle<Name> property_name,
                                  Handle<JSFunction> function,
                                  Handle<String> function_name,
                                  PropertyAttributes attributes = DONT_ENUM) {
-  JSObject::AddProperty(target, property_name, function, attributes);
+  JSObject::AddProperty(isolate, target, property_name, function, attributes);
 }
 
-V8_NOINLINE void InstallFunction(Handle<JSObject> target,
+V8_NOINLINE void InstallFunction(Isolate* isolate, Handle<JSObject> target,
                                  Handle<JSFunction> function, Handle<Name> name,
                                  PropertyAttributes attributes = DONT_ENUM) {
   Handle<String> name_string = Name::ToFunctionName(name).ToHandleChecked();
-  InstallFunction(target, name, function, name_string, attributes);
+  InstallFunction(isolate, target, name, function, name_string, attributes);
 }
 
 V8_NOINLINE Handle<JSFunction> CreateFunction(
@@ -420,27 +430,26 @@ V8_NOINLINE Handle<JSFunction> CreateFunction(
 }
 
 V8_NOINLINE Handle<JSFunction> InstallFunction(
-    Handle<JSObject> target, Handle<Name> name, InstanceType type,
-    int instance_size, int inobject_properties,
+    Isolate* isolate, Handle<JSObject> target, Handle<Name> name,
+    InstanceType type, int instance_size, int inobject_properties,
     MaybeHandle<Object> maybe_prototype, Builtins::Name call,
     PropertyAttributes attributes) {
   Handle<String> name_string = Name::ToFunctionName(name).ToHandleChecked();
   Handle<JSFunction> function =
-      CreateFunction(target->GetIsolate(), name_string, type, instance_size,
+      CreateFunction(isolate, name_string, type, instance_size,
                      inobject_properties, maybe_prototype, call);
-  InstallFunction(target, name, function, name_string, attributes);
+  InstallFunction(isolate, target, name, function, name_string, attributes);
   return function;
 }
 
 V8_NOINLINE Handle<JSFunction> InstallFunction(
-    Handle<JSObject> target, const char* name, InstanceType type,
-    int instance_size, int inobject_properties,
+    Isolate* isolate, Handle<JSObject> target, const char* name,
+    InstanceType type, int instance_size, int inobject_properties,
     MaybeHandle<Object> maybe_prototype, Builtins::Name call) {
-  Factory* const factory = target->GetIsolate()->factory();
   PropertyAttributes attributes = DONT_ENUM;
-  return InstallFunction(target, factory->InternalizeUtf8String(name), type,
-                         instance_size, inobject_properties, maybe_prototype,
-                         call, attributes);
+  return InstallFunction(
+      isolate, target, isolate->factory()->InternalizeUtf8String(name), type,
+      instance_size, inobject_properties, maybe_prototype, call, attributes);
 }
 
 V8_NOINLINE Handle<JSFunction> SimpleCreateFunction(Isolate* isolate,
@@ -460,64 +469,65 @@ V8_NOINLINE Handle<JSFunction> SimpleCreateFunction(Isolate* isolate,
 }
 
 V8_NOINLINE Handle<JSFunction> SimpleInstallFunction(
-    Handle<JSObject> base, Handle<Name> property_name,
+    Isolate* isolate, Handle<JSObject> base, Handle<Name> property_name,
     Handle<String> function_name, Builtins::Name call, int len, bool adapt,
     PropertyAttributes attrs = DONT_ENUM,
     BuiltinFunctionId id = kInvalidBuiltinFunctionId) {
   Handle<JSFunction> fun =
-      SimpleCreateFunction(base->GetIsolate(), function_name, call, len, adapt);
+      SimpleCreateFunction(isolate, function_name, call, len, adapt);
   if (id != kInvalidBuiltinFunctionId) {
     fun->shared()->set_builtin_function_id(id);
   }
-  InstallFunction(base, fun, property_name, attrs);
+  InstallFunction(isolate, base, fun, property_name, attrs);
   return fun;
 }
 
 V8_NOINLINE Handle<JSFunction> SimpleInstallFunction(
-    Handle<JSObject> base, Handle<String> name, Builtins::Name call, int len,
-    bool adapt, PropertyAttributes attrs = DONT_ENUM,
+    Isolate* isolate, Handle<JSObject> base, Handle<String> name,
+    Builtins::Name call, int len, bool adapt,
+    PropertyAttributes attrs = DONT_ENUM,
     BuiltinFunctionId id = kInvalidBuiltinFunctionId) {
-  return SimpleInstallFunction(base, name, name, call, len, adapt, attrs, id);
+  return SimpleInstallFunction(isolate, base, name, name, call, len, adapt,
+                               attrs, id);
 }
 
 V8_NOINLINE Handle<JSFunction> SimpleInstallFunction(
-    Handle<JSObject> base, Handle<Name> property_name,
+    Isolate* isolate, Handle<JSObject> base, Handle<Name> property_name,
     const char* function_name, Builtins::Name call, int len, bool adapt,
     PropertyAttributes attrs = DONT_ENUM,
     BuiltinFunctionId id = kInvalidBuiltinFunctionId) {
-  Factory* const factory = base->GetIsolate()->factory();
   // Function name does not have to be internalized.
   return SimpleInstallFunction(
-      base, property_name, factory->NewStringFromAsciiChecked(function_name),
-      call, len, adapt, attrs, id);
+      isolate, base, property_name,
+      isolate->factory()->NewStringFromAsciiChecked(function_name), call, len,
+      adapt, attrs, id);
 }
 
 V8_NOINLINE Handle<JSFunction> SimpleInstallFunction(
-    Handle<JSObject> base, const char* name, Builtins::Name call, int len,
-    bool adapt, PropertyAttributes attrs = DONT_ENUM,
+    Isolate* isolate, Handle<JSObject> base, const char* name,
+    Builtins::Name call, int len, bool adapt,
+    PropertyAttributes attrs = DONT_ENUM,
     BuiltinFunctionId id = kInvalidBuiltinFunctionId) {
-  Factory* const factory = base->GetIsolate()->factory();
   // Although function name does not have to be internalized the property name
   // will be internalized during property addition anyway, so do it here now.
-  return SimpleInstallFunction(base, factory->InternalizeUtf8String(name), call,
-                               len, adapt, attrs, id);
+  return SimpleInstallFunction(isolate, base,
+                               isolate->factory()->InternalizeUtf8String(name),
+                               call, len, adapt, attrs, id);
 }
 
-V8_NOINLINE Handle<JSFunction> SimpleInstallFunction(Handle<JSObject> base,
-                                                     const char* name,
-                                                     Builtins::Name call,
-                                                     int len, bool adapt,
-                                                     BuiltinFunctionId id) {
-  return SimpleInstallFunction(base, name, call, len, adapt, DONT_ENUM, id);
+V8_NOINLINE Handle<JSFunction> SimpleInstallFunction(
+    Isolate* isolate, Handle<JSObject> base, const char* name,
+    Builtins::Name call, int len, bool adapt, BuiltinFunctionId id) {
+  return SimpleInstallFunction(isolate, base, name, call, len, adapt, DONT_ENUM,
+                               id);
 }
 
-V8_NOINLINE void SimpleInstallGetterSetter(Handle<JSObject> base,
+V8_NOINLINE void SimpleInstallGetterSetter(Isolate* isolate,
+                                           Handle<JSObject> base,
                                            Handle<String> name,
                                            Builtins::Name call_getter,
                                            Builtins::Name call_setter,
                                            PropertyAttributes attribs) {
-  Isolate* const isolate = base->GetIsolate();
-
   Handle<String> getter_name =
       Name::ToFunctionName(name, isolate->factory()->get_string())
           .ToHandleChecked();
@@ -533,13 +543,9 @@ V8_NOINLINE void SimpleInstallGetterSetter(Handle<JSObject> base,
   JSObject::DefineAccessor(base, name, getter, setter, attribs).Check();
 }
 
-V8_NOINLINE Handle<JSFunction> SimpleInstallGetter(Handle<JSObject> base,
-                                                   Handle<Name> name,
-                                                   Handle<Name> property_name,
-                                                   Builtins::Name call,
-                                                   bool adapt) {
-  Isolate* const isolate = base->GetIsolate();
-
+V8_NOINLINE Handle<JSFunction> SimpleInstallGetter(
+    Isolate* isolate, Handle<JSObject> base, Handle<Name> name,
+    Handle<Name> property_name, Builtins::Name call, bool adapt) {
   Handle<String> getter_name =
       Name::ToFunctionName(name, isolate->factory()->get_string())
           .ToHandleChecked();
@@ -554,19 +560,19 @@ V8_NOINLINE Handle<JSFunction> SimpleInstallGetter(Handle<JSObject> base,
   return getter;
 }
 
-V8_NOINLINE Handle<JSFunction> SimpleInstallGetter(Handle<JSObject> base,
+V8_NOINLINE Handle<JSFunction> SimpleInstallGetter(Isolate* isolate,
+                                                   Handle<JSObject> base,
                                                    Handle<Name> name,
                                                    Builtins::Name call,
                                                    bool adapt) {
-  return SimpleInstallGetter(base, name, name, call, adapt);
+  return SimpleInstallGetter(isolate, base, name, name, call, adapt);
 }
 
-V8_NOINLINE Handle<JSFunction> SimpleInstallGetter(Handle<JSObject> base,
-                                                   Handle<Name> name,
-                                                   Builtins::Name call,
-                                                   bool adapt,
-                                                   BuiltinFunctionId id) {
-  Handle<JSFunction> fun = SimpleInstallGetter(base, name, call, adapt);
+V8_NOINLINE Handle<JSFunction> SimpleInstallGetter(
+    Isolate* isolate, Handle<JSObject> base, Handle<Name> name,
+    Builtins::Name call, bool adapt, BuiltinFunctionId id) {
+  Handle<JSFunction> fun =
+      SimpleInstallGetter(isolate, base, name, call, adapt);
   fun->shared()->set_builtin_function_id(id);
   return fun;
 }
@@ -574,47 +580,51 @@ V8_NOINLINE Handle<JSFunction> SimpleInstallGetter(Handle<JSObject> base,
 V8_NOINLINE void InstallConstant(Isolate* isolate, Handle<JSObject> holder,
                                  const char* name, Handle<Object> value) {
   JSObject::AddProperty(
-      holder, isolate->factory()->NewStringFromAsciiChecked(name), value,
+      isolate, holder, isolate->factory()->NewStringFromAsciiChecked(name),
+      value,
       static_cast<PropertyAttributes>(DONT_DELETE | DONT_ENUM | READ_ONLY));
 }
 
-V8_NOINLINE void InstallSpeciesGetter(Handle<JSFunction> constructor) {
-  Factory* factory = constructor->GetIsolate()->factory();
+V8_NOINLINE void InstallSpeciesGetter(Isolate* isolate,
+                                      Handle<JSFunction> constructor) {
+  Factory* factory = isolate->factory();
   // TODO(adamk): We should be able to share a SharedFunctionInfo
   // between all these JSFunctins.
-  SimpleInstallGetter(constructor, factory->symbol_species_string(),
+  SimpleInstallGetter(isolate, constructor, factory->symbol_species_string(),
                       factory->species_symbol(), Builtins::kReturnReceiver,
                       true);
 }
 
 }  // namespace
 
-Handle<JSFunction> Genesis::CreateEmptyFunction(Isolate* isolate) {
-  Factory* factory = isolate->factory();
-
+Handle<JSFunction> Genesis::CreateEmptyFunction() {
   // Allocate the function map first and then patch the prototype later.
-  Handle<Map> empty_function_map = factory->CreateSloppyFunctionMap(
+  Handle<Map> empty_function_map = factory()->CreateSloppyFunctionMap(
       FUNCTION_WITHOUT_PROTOTYPE, MaybeHandle<JSFunction>());
   empty_function_map->set_is_prototype_map(true);
   DCHECK(!empty_function_map->is_dictionary_map());
 
+  // Allocate ScopeInfo for the empty function.
+  Handle<ScopeInfo> scope_info = ScopeInfo::CreateForEmptyFunction(isolate());
+
   // Allocate the empty function as the prototype for function according to
   // ES#sec-properties-of-the-function-prototype-object
   NewFunctionArgs args = NewFunctionArgs::ForBuiltin(
-      factory->empty_string(), empty_function_map, Builtins::kEmptyFunction);
-  Handle<JSFunction> empty_function = factory->NewFunction(args);
+      factory()->empty_string(), empty_function_map, Builtins::kEmptyFunction);
+  Handle<JSFunction> empty_function = factory()->NewFunction(args);
+  native_context()->set_empty_function(*empty_function);
 
   // --- E m p t y ---
-  Handle<String> source = factory->NewStringFromStaticChars("() {}");
-  Handle<Script> script = factory->NewScript(source);
+  Handle<String> source = factory()->NewStringFromStaticChars("() {}");
+  Handle<Script> script = factory()->NewScript(source);
   script->set_type(Script::TYPE_NATIVE);
-  Handle<WeakFixedArray> infos = factory->NewWeakFixedArray(2);
+  Handle<WeakFixedArray> infos = factory()->NewWeakFixedArray(2);
   script->set_shared_function_infos(*infos);
-  empty_function->shared()->set_raw_start_position(0);
-  empty_function->shared()->set_raw_end_position(source->length());
+  empty_function->shared()->set_scope_info(*scope_info);
   empty_function->shared()->set_function_literal_id(1);
   empty_function->shared()->DontAdaptArguments();
-  SharedFunctionInfo::SetScript(handle(empty_function->shared()), script);
+  SharedFunctionInfo::SetScript(handle(empty_function->shared(), isolate()),
+                                script);
 
   return empty_function;
 }
@@ -652,7 +662,7 @@ Handle<JSFunction> Genesis::GetThrowTypeErrorIntrinsic() {
   if (!restricted_properties_thrower_.is_null()) {
     return restricted_properties_thrower_;
   }
-  Handle<String> name(factory()->empty_string());
+  Handle<String> name = factory()->empty_string();
   NewFunctionArgs args = NewFunctionArgs::ForBuiltinWithoutPrototype(
       name, Builtins::kStrictPoisonPillThrower, i::LanguageMode::kStrict);
   Handle<JSFunction> function = factory()->NewFunction(args);
@@ -762,8 +772,9 @@ void Genesis::CreateObjectFunction(Handle<JSFunction> empty_function) {
   Handle<JSObject> object_function_prototype =
       factory->NewFunctionPrototype(object_fun);
 
-  Handle<Map> map = Map::Copy(handle(object_function_prototype->map()),
-                              "EmptyObjectPrototype");
+  Handle<Map> map =
+      Map::Copy(isolate(), handle(object_function_prototype->map(), isolate()),
+                "EmptyObjectPrototype");
   map->set_is_prototype_map(true);
   // Ban re-setting Object.prototype.__proto__ to prevent Proxy security bug
   map->set_is_immutable_proto(true);
@@ -772,7 +783,7 @@ void Genesis::CreateObjectFunction(Handle<JSFunction> empty_function) {
   // Complete setting up empty function.
   {
     Handle<Map> empty_function_map(empty_function->map(), isolate_);
-    Map::SetPrototype(empty_function_map, object_function_prototype);
+    Map::SetPrototype(isolate(), empty_function_map, object_function_prototype);
   }
 
   native_context()->set_initial_object_prototype(*object_function_prototype);
@@ -782,23 +793,23 @@ void Genesis::CreateObjectFunction(Handle<JSFunction> empty_function) {
     // Set up slow map for Object.create(null) instances without in-object
     // properties.
     Handle<Map> map(object_fun->initial_map(), isolate_);
-    map = Map::CopyInitialMapNormalized(map);
-    Map::SetPrototype(map, factory->null_value());
+    map = Map::CopyInitialMapNormalized(isolate(), map);
+    Map::SetPrototype(isolate(), map, factory->null_value());
     native_context()->set_slow_object_with_null_prototype_map(*map);
 
     // Set up slow map for literals with too many properties.
-    map = Map::Copy(map, "slow_object_with_object_prototype_map");
-    Map::SetPrototype(map, object_function_prototype);
+    map = Map::Copy(isolate(), map, "slow_object_with_object_prototype_map");
+    Map::SetPrototype(isolate(), map, object_function_prototype);
     native_context()->set_slow_object_with_object_prototype_map(*map);
   }
 }
 
 namespace {
 
-Handle<Map> CreateNonConstructorMap(Handle<Map> source_map,
+Handle<Map> CreateNonConstructorMap(Isolate* isolate, Handle<Map> source_map,
                                     Handle<JSObject> prototype,
                                     const char* reason) {
-  Handle<Map> map = Map::Copy(source_map, reason);
+  Handle<Map> map = Map::Copy(isolate, source_map, reason);
   // Ensure the resulting map has prototype slot (it is necessary for storing
   // inital map even when the prototype property is not required).
   if (!map->has_prototype_slot()) {
@@ -813,7 +824,7 @@ Handle<Map> CreateNonConstructorMap(Handle<Map> source_map,
     map->SetInObjectUnusedPropertyFields(unused_property_fields);
   }
   map->set_is_constructor(false);
-  Map::SetPrototype(map, prototype);
+  Map::SetPrototype(isolate, map, prototype);
   return map;
 }
 
@@ -824,9 +835,9 @@ void Genesis::CreateIteratorMaps(Handle<JSFunction> empty) {
   Handle<JSObject> iterator_prototype =
       factory()->NewJSObject(isolate()->object_function(), TENURED);
 
-  SimpleInstallFunction(iterator_prototype, factory()->iterator_symbol(),
-                        "[Symbol.iterator]", Builtins::kReturnReceiver, 0,
-                        true);
+  SimpleInstallFunction(isolate(), iterator_prototype,
+                        factory()->iterator_symbol(), "[Symbol.iterator]",
+                        Builtins::kReturnReceiver, 0, true);
   native_context()->set_initial_iterator_prototype(*iterator_prototype);
 
   Handle<JSObject> generator_object_prototype =
@@ -839,27 +850,28 @@ void Genesis::CreateIteratorMaps(Handle<JSFunction> empty) {
   JSObject::ForceSetPrototype(generator_function_prototype, empty);
 
   JSObject::AddProperty(
-      generator_function_prototype, factory()->to_string_tag_symbol(),
+      isolate(), generator_function_prototype,
+      factory()->to_string_tag_symbol(),
       factory()->NewStringFromAsciiChecked("GeneratorFunction"),
       static_cast<PropertyAttributes>(DONT_ENUM | READ_ONLY));
-  JSObject::AddProperty(generator_function_prototype,
+  JSObject::AddProperty(isolate(), generator_function_prototype,
                         factory()->prototype_string(),
                         generator_object_prototype,
                         static_cast<PropertyAttributes>(DONT_ENUM | READ_ONLY));
 
-  JSObject::AddProperty(generator_object_prototype,
+  JSObject::AddProperty(isolate(), generator_object_prototype,
                         factory()->constructor_string(),
                         generator_function_prototype,
                         static_cast<PropertyAttributes>(DONT_ENUM | READ_ONLY));
-  JSObject::AddProperty(generator_object_prototype,
+  JSObject::AddProperty(isolate(), generator_object_prototype,
                         factory()->to_string_tag_symbol(),
                         factory()->NewStringFromAsciiChecked("Generator"),
                         static_cast<PropertyAttributes>(DONT_ENUM | READ_ONLY));
-  SimpleInstallFunction(generator_object_prototype, "next",
+  SimpleInstallFunction(isolate(), generator_object_prototype, "next",
                         Builtins::kGeneratorPrototypeNext, 1, false);
-  SimpleInstallFunction(generator_object_prototype, "return",
+  SimpleInstallFunction(isolate(), generator_object_prototype, "return",
                         Builtins::kGeneratorPrototypeReturn, 1, false);
-  SimpleInstallFunction(generator_object_prototype, "throw",
+  SimpleInstallFunction(isolate(), generator_object_prototype, "throw",
                         Builtins::kGeneratorPrototypeThrow, 1, false);
 
   // Internal version of generator_prototype_next, flagged as non-native such
@@ -876,29 +888,32 @@ void Genesis::CreateIteratorMaps(Handle<JSFunction> empty) {
   // 04-14-15, section 25.2.4.3).
   // Generator functions do not have "caller" or "arguments" accessors.
   Handle<Map> map;
-  map = CreateNonConstructorMap(isolate()->strict_function_map(),
+  map = CreateNonConstructorMap(isolate(), isolate()->strict_function_map(),
                                 generator_function_prototype,
                                 "GeneratorFunction");
   native_context()->set_generator_function_map(*map);
 
-  map = CreateNonConstructorMap(isolate()->strict_function_with_name_map(),
-                                generator_function_prototype,
-                                "GeneratorFunction with name");
+  map = CreateNonConstructorMap(
+      isolate(), isolate()->strict_function_with_name_map(),
+      generator_function_prototype, "GeneratorFunction with name");
   native_context()->set_generator_function_with_name_map(*map);
 
-  map = CreateNonConstructorMap(strict_function_with_home_object_map_,
-                                generator_function_prototype,
-                                "GeneratorFunction with home object");
+  map = CreateNonConstructorMap(
+      isolate(), strict_function_with_home_object_map_,
+      generator_function_prototype, "GeneratorFunction with home object");
   native_context()->set_generator_function_with_home_object_map(*map);
 
-  map = CreateNonConstructorMap(strict_function_with_name_and_home_object_map_,
+  map = CreateNonConstructorMap(isolate(),
+                                strict_function_with_name_and_home_object_map_,
                                 generator_function_prototype,
                                 "GeneratorFunction with name and home object");
   native_context()->set_generator_function_with_name_and_home_object_map(*map);
 
-  Handle<JSFunction> object_function(native_context()->object_function());
+  Handle<JSFunction> object_function(native_context()->object_function(),
+                                     isolate());
   Handle<Map> generator_object_prototype_map = Map::Create(isolate(), 0);
-  Map::SetPrototype(generator_object_prototype_map, generator_object_prototype);
+  Map::SetPrototype(isolate(), generator_object_prototype_map,
+                    generator_object_prototype);
   native_context()->set_generator_object_prototype_map(
       *generator_object_prototype_map);
 }
@@ -910,25 +925,26 @@ void Genesis::CreateAsyncIteratorMaps(Handle<JSFunction> empty) {
       factory()->NewJSObject(isolate()->object_function(), TENURED);
 
   SimpleInstallFunction(
-      async_iterator_prototype, factory()->async_iterator_symbol(),
+      isolate(), async_iterator_prototype, factory()->async_iterator_symbol(),
       "[Symbol.asyncIterator]", Builtins::kReturnReceiver, 0, true);
 
   // %AsyncFromSyncIteratorPrototype%
   // proposal-async-iteration/#sec-%asyncfromsynciteratorprototype%-object
   Handle<JSObject> async_from_sync_iterator_prototype =
       factory()->NewJSObject(isolate()->object_function(), TENURED);
-  SimpleInstallFunction(async_from_sync_iterator_prototype,
+  SimpleInstallFunction(isolate(), async_from_sync_iterator_prototype,
                         factory()->next_string(),
                         Builtins::kAsyncFromSyncIteratorPrototypeNext, 1, true);
   SimpleInstallFunction(
-      async_from_sync_iterator_prototype, factory()->return_string(),
+      isolate(), async_from_sync_iterator_prototype, factory()->return_string(),
       Builtins::kAsyncFromSyncIteratorPrototypeReturn, 1, true);
   SimpleInstallFunction(
-      async_from_sync_iterator_prototype, factory()->throw_string(),
+      isolate(), async_from_sync_iterator_prototype, factory()->throw_string(),
       Builtins::kAsyncFromSyncIteratorPrototypeThrow, 1, true);
 
   JSObject::AddProperty(
-      async_from_sync_iterator_prototype, factory()->to_string_tag_symbol(),
+      isolate(), async_from_sync_iterator_prototype,
+      factory()->to_string_tag_symbol(),
       factory()->NewStringFromAsciiChecked("Async-from-Sync Iterator"),
       static_cast<PropertyAttributes>(DONT_ENUM | READ_ONLY));
 
@@ -937,7 +953,7 @@ void Genesis::CreateAsyncIteratorMaps(Handle<JSFunction> empty) {
 
   Handle<Map> async_from_sync_iterator_map = factory()->NewMap(
       JS_ASYNC_FROM_SYNC_ITERATOR_TYPE, JSAsyncFromSyncIterator::kSize);
-  Map::SetPrototype(async_from_sync_iterator_map,
+  Map::SetPrototype(isolate(), async_from_sync_iterator_map,
                     async_from_sync_iterator_prototype);
   native_context()->set_async_from_sync_iterator_map(
       *async_from_sync_iterator_map);
@@ -958,11 +974,15 @@ void Genesis::CreateAsyncIteratorMaps(Handle<JSFunction> empty) {
   //     %AsyncGeneratorPrototype% intrinsic object.
   // This property has the attributes
   //     { [[Writable]]: false, [[Enumerable]]: false, [[Configurable]]: true }.
-  JSObject::AddProperty(async_generator_function_prototype,
+  JSObject::AddProperty(isolate(), async_generator_function_prototype,
                         factory()->prototype_string(),
                         async_generator_object_prototype,
                         static_cast<PropertyAttributes>(DONT_ENUM | READ_ONLY));
-  JSObject::AddProperty(async_generator_function_prototype,
+  JSObject::AddProperty(isolate(), async_generator_object_prototype,
+                        factory()->constructor_string(),
+                        async_generator_function_prototype,
+                        static_cast<PropertyAttributes>(DONT_ENUM | READ_ONLY));
+  JSObject::AddProperty(isolate(), async_generator_function_prototype,
                         factory()->to_string_tag_symbol(),
                         AsyncGeneratorFunction_string,
                         static_cast<PropertyAttributes>(DONT_ENUM | READ_ONLY));
@@ -973,15 +993,15 @@ void Genesis::CreateAsyncIteratorMaps(Handle<JSFunction> empty) {
   native_context()->set_initial_async_generator_prototype(
       *async_generator_object_prototype);
 
-  JSObject::AddProperty(async_generator_object_prototype,
+  JSObject::AddProperty(isolate(), async_generator_object_prototype,
                         factory()->to_string_tag_symbol(),
                         factory()->NewStringFromAsciiChecked("AsyncGenerator"),
                         static_cast<PropertyAttributes>(DONT_ENUM | READ_ONLY));
-  SimpleInstallFunction(async_generator_object_prototype, "next",
+  SimpleInstallFunction(isolate(), async_generator_object_prototype, "next",
                         Builtins::kAsyncGeneratorPrototypeNext, 1, false);
-  SimpleInstallFunction(async_generator_object_prototype, "return",
+  SimpleInstallFunction(isolate(), async_generator_object_prototype, "return",
                         Builtins::kAsyncGeneratorPrototypeReturn, 1, false);
-  SimpleInstallFunction(async_generator_object_prototype, "throw",
+  SimpleInstallFunction(isolate(), async_generator_object_prototype, "throw",
                         Builtins::kAsyncGeneratorPrototypeThrow, 1, false);
 
   // Create maps for generator functions and their prototypes.  Store those
@@ -990,31 +1010,33 @@ void Genesis::CreateAsyncIteratorMaps(Handle<JSFunction> empty) {
   // 04-14-15, section 25.2.4.3).
   // Async Generator functions do not have "caller" or "arguments" accessors.
   Handle<Map> map;
-  map = CreateNonConstructorMap(isolate()->strict_function_map(),
+  map = CreateNonConstructorMap(isolate(), isolate()->strict_function_map(),
                                 async_generator_function_prototype,
                                 "AsyncGeneratorFunction");
   native_context()->set_async_generator_function_map(*map);
 
-  map = CreateNonConstructorMap(isolate()->strict_function_with_name_map(),
-                                async_generator_function_prototype,
-                                "AsyncGeneratorFunction with name");
+  map = CreateNonConstructorMap(
+      isolate(), isolate()->strict_function_with_name_map(),
+      async_generator_function_prototype, "AsyncGeneratorFunction with name");
   native_context()->set_async_generator_function_with_name_map(*map);
 
-  map = CreateNonConstructorMap(strict_function_with_home_object_map_,
-                                async_generator_function_prototype,
-                                "AsyncGeneratorFunction with home object");
+  map =
+      CreateNonConstructorMap(isolate(), strict_function_with_home_object_map_,
+                              async_generator_function_prototype,
+                              "AsyncGeneratorFunction with home object");
   native_context()->set_async_generator_function_with_home_object_map(*map);
 
   map = CreateNonConstructorMap(
-      strict_function_with_name_and_home_object_map_,
+      isolate(), strict_function_with_name_and_home_object_map_,
       async_generator_function_prototype,
       "AsyncGeneratorFunction with name and home object");
   native_context()->set_async_generator_function_with_name_and_home_object_map(
       *map);
 
-  Handle<JSFunction> object_function(native_context()->object_function());
+  Handle<JSFunction> object_function(native_context()->object_function(),
+                                     isolate());
   Handle<Map> async_generator_object_prototype_map = Map::Create(isolate(), 0);
-  Map::SetPrototype(async_generator_object_prototype_map,
+  Map::SetPrototype(isolate(), async_generator_object_prototype_map,
                     async_generator_object_prototype);
   native_context()->set_async_generator_object_prototype_map(
       *async_generator_object_prototype_map);
@@ -1026,29 +1048,29 @@ void Genesis::CreateAsyncFunctionMaps(Handle<JSFunction> empty) {
       factory()->NewJSObject(isolate()->object_function(), TENURED);
   JSObject::ForceSetPrototype(async_function_prototype, empty);
 
-  JSObject::AddProperty(async_function_prototype,
+  JSObject::AddProperty(isolate(), async_function_prototype,
                         factory()->to_string_tag_symbol(),
                         factory()->NewStringFromAsciiChecked("AsyncFunction"),
                         static_cast<PropertyAttributes>(DONT_ENUM | READ_ONLY));
 
   Handle<Map> map;
   map = CreateNonConstructorMap(
-      isolate()->strict_function_without_prototype_map(),
+      isolate(), isolate()->strict_function_without_prototype_map(),
       async_function_prototype, "AsyncFunction");
   native_context()->set_async_function_map(*map);
 
-  map = CreateNonConstructorMap(isolate()->method_with_name_map(),
+  map = CreateNonConstructorMap(isolate(), isolate()->method_with_name_map(),
                                 async_function_prototype,
                                 "AsyncFunction with name");
   native_context()->set_async_function_with_name_map(*map);
 
-  map = CreateNonConstructorMap(isolate()->method_with_home_object_map(),
-                                async_function_prototype,
-                                "AsyncFunction with home object");
+  map = CreateNonConstructorMap(
+      isolate(), isolate()->method_with_home_object_map(),
+      async_function_prototype, "AsyncFunction with home object");
   native_context()->set_async_function_with_home_object_map(*map);
 
   map = CreateNonConstructorMap(
-      isolate()->method_with_name_and_home_object_map(),
+      isolate(), isolate()->method_with_name_and_home_object_map(),
       async_function_prototype, "AsyncFunction with name and home object");
   native_context()->set_async_function_with_name_and_home_object_map(*map);
 }
@@ -1063,13 +1085,14 @@ void Genesis::CreateJSProxyMaps() {
   proxy_map->set_may_have_interesting_symbols(true);
   native_context()->set_proxy_map(*proxy_map);
 
-  Handle<Map> proxy_callable_map = Map::Copy(proxy_map, "callable Proxy");
+  Handle<Map> proxy_callable_map =
+      Map::Copy(isolate_, proxy_map, "callable Proxy");
   proxy_callable_map->set_is_callable(true);
   native_context()->set_proxy_callable_map(*proxy_callable_map);
   proxy_callable_map->SetConstructor(native_context()->function_function());
 
   Handle<Map> proxy_constructor_map =
-      Map::Copy(proxy_callable_map, "constructor Proxy");
+      Map::Copy(isolate_, proxy_callable_map, "constructor Proxy");
   proxy_constructor_map->set_is_constructor(true);
   native_context()->set_proxy_constructor_map(*proxy_constructor_map);
 
@@ -1077,7 +1100,7 @@ void Genesis::CreateJSProxyMaps() {
     Handle<Map> map =
         factory()->NewMap(JS_OBJECT_TYPE, JSProxyRevocableResult::kSize,
                           TERMINAL_FAST_ELEMENTS_KIND, 2);
-    Map::EnsureDescriptorSlack(map, 2);
+    Map::EnsureDescriptorSlack(isolate_, map, 2);
 
     {  // proxy
       Descriptor d = Descriptor::DataField(factory()->proxy_string(),
@@ -1092,7 +1115,7 @@ void Genesis::CreateJSProxyMaps() {
       map->AppendDescriptor(&d);
     }
 
-    Map::SetPrototype(map, isolate()->initial_object_prototype());
+    Map::SetPrototype(isolate(), map, isolate()->initial_object_prototype());
     map->SetConstructor(native_context()->object_function());
 
     native_context()->set_proxy_revocable_result_map(*map);
@@ -1100,11 +1123,11 @@ void Genesis::CreateJSProxyMaps() {
 }
 
 namespace {
-void ReplaceAccessors(Handle<Map> map, Handle<String> name,
+void ReplaceAccessors(Isolate* isolate, Handle<Map> map, Handle<String> name,
                       PropertyAttributes attributes,
                       Handle<AccessorPair> accessor_pair) {
   DescriptorArray* descriptors = map->instance_descriptors();
-  int idx = descriptors->SearchWithCache(map->GetIsolate(), *name, *map);
+  int idx = descriptors->SearchWithCache(isolate, *name, *map);
   Descriptor d = Descriptor::AccessorConstant(name, accessor_pair, attributes);
   descriptors->Replace(idx, &d);
 }
@@ -1117,15 +1140,15 @@ void Genesis::AddRestrictedFunctionProperties(Handle<JSFunction> empty) {
   accessors->set_getter(*thrower);
   accessors->set_setter(*thrower);
 
-  Handle<Map> map(empty->map());
-  ReplaceAccessors(map, factory()->arguments_string(), rw_attribs, accessors);
-  ReplaceAccessors(map, factory()->caller_string(), rw_attribs, accessors);
+  Handle<Map> map(empty->map(), isolate());
+  ReplaceAccessors(isolate(), map, factory()->arguments_string(), rw_attribs,
+                   accessors);
+  ReplaceAccessors(isolate(), map, factory()->caller_string(), rw_attribs,
+                   accessors);
 }
 
-
-static void AddToWeakNativeContextList(Context* context) {
+static void AddToWeakNativeContextList(Isolate* isolate, Context* context) {
   DCHECK(context->IsNativeContext());
-  Isolate* isolate = context->GetIsolate();
   Heap* heap = isolate->heap();
 #ifdef DEBUG
   { // NOLINT
@@ -1150,7 +1173,7 @@ void Genesis::CreateRoots() {
   // and the global object, but in order to create those, we need the
   // native context).
   native_context_ = factory()->NewNativeContext();
-  AddToWeakNativeContextList(*native_context());
+  AddToWeakNativeContextList(isolate(), *native_context());
   isolate()->set_context(*native_context());
 
   // Allocate the message listeners object.
@@ -1163,10 +1186,10 @@ void Genesis::CreateRoots() {
 
 void Genesis::InstallGlobalThisBinding() {
   Handle<ScriptContextTable> script_contexts(
-      native_context()->script_context_table());
+      native_context()->script_context_table(), isolate());
   Handle<ScopeInfo> scope_info = ScopeInfo::CreateGlobalThisBinding(isolate());
-  Handle<JSFunction> closure(native_context()->closure());
-  Handle<Context> context = factory()->NewScriptContext(closure, scope_info);
+  Handle<Context> context =
+      factory()->NewScriptContext(native_context(), scope_info);
 
   // Go ahead and hook it up while we're at it.
   int slot = scope_info->ReceiverContextSlotIndex();
@@ -1204,7 +1227,7 @@ Handle<JSGlobalObject> Genesis::CreateNewGlobals(
         v8::Utils::OpenHandle(*global_proxy_template);
     Handle<FunctionTemplateInfo> global_constructor =
         Handle<FunctionTemplateInfo>(
-            FunctionTemplateInfo::cast(data->constructor()));
+            FunctionTemplateInfo::cast(data->constructor()), isolate());
     Handle<Object> proto_template(global_constructor->prototype_template(),
                                   isolate());
     if (!proto_template->IsUndefined(isolate())) {
@@ -1214,7 +1237,7 @@ Handle<JSGlobalObject> Genesis::CreateNewGlobals(
   }
 
   if (js_global_object_template.is_null()) {
-    Handle<String> name(factory()->empty_string());
+    Handle<String> name = factory()->empty_string();
     Handle<JSObject> prototype =
         factory()->NewFunctionPrototype(isolate()->object_function());
     NewFunctionArgs args = NewFunctionArgs::ForBuiltinWithPrototype(
@@ -1222,7 +1245,7 @@ Handle<JSGlobalObject> Genesis::CreateNewGlobals(
         Builtins::kIllegal, MUTABLE);
     js_global_object_function = factory()->NewFunction(args);
 #ifdef DEBUG
-    LookupIterator it(prototype, factory()->constructor_string(),
+    LookupIterator it(isolate(), prototype, factory()->constructor_string(),
                       LookupIterator::OWN_SKIP_INTERCEPTOR);
     Handle<Object> value = Object::GetProperty(&it).ToHandleChecked();
     DCHECK(it.IsFound());
@@ -1230,7 +1253,8 @@ Handle<JSGlobalObject> Genesis::CreateNewGlobals(
 #endif
   } else {
     Handle<FunctionTemplateInfo> js_global_object_constructor(
-        FunctionTemplateInfo::cast(js_global_object_template->constructor()));
+        FunctionTemplateInfo::cast(js_global_object_template->constructor()),
+        isolate());
     js_global_object_function = ApiNatives::CreateApiFunction(
         isolate(), js_global_object_constructor, factory()->the_hole_value(),
         ApiNatives::GlobalObjectType);
@@ -1246,7 +1270,7 @@ Handle<JSGlobalObject> Genesis::CreateNewGlobals(
   // Step 2: (re)initialize the global proxy object.
   Handle<JSFunction> global_proxy_function;
   if (global_proxy_template.IsEmpty()) {
-    Handle<String> name(factory()->empty_string());
+    Handle<String> name = factory()->empty_string();
     NewFunctionArgs args = NewFunctionArgs::ForBuiltinWithPrototype(
         name, factory()->the_hole_value(), JS_GLOBAL_PROXY_TYPE,
         JSGlobalProxy::SizeWithEmbedderFields(0), 0, Builtins::kIllegal,
@@ -1256,7 +1280,7 @@ Handle<JSGlobalObject> Genesis::CreateNewGlobals(
     Handle<ObjectTemplateInfo> data =
         v8::Utils::OpenHandle(*global_proxy_template);
     Handle<FunctionTemplateInfo> global_constructor(
-            FunctionTemplateInfo::cast(data->constructor()));
+        FunctionTemplateInfo::cast(data->constructor()), isolate());
     global_proxy_function = ApiNatives::CreateApiFunction(
         isolate(), global_constructor, factory()->the_hole_value(),
         ApiNatives::GlobalProxyType);
@@ -1292,10 +1316,10 @@ void Genesis::HookUpGlobalProxy(Handle<JSGlobalProxy> global_proxy) {
   // Re-initialize the global proxy with the global proxy function from the
   // snapshot, and then set up the link to the native context.
   Handle<JSFunction> global_proxy_function(
-      native_context()->global_proxy_function());
+      native_context()->global_proxy_function(), isolate());
   factory()->ReinitializeJSGlobalProxy(global_proxy, global_proxy_function);
   Handle<JSObject> global_object(
-      JSObject::cast(native_context()->global_object()));
+      JSObject::cast(native_context()->global_object()), isolate());
   JSObject::ForceSetPrototype(global_proxy, global_object);
   global_proxy->set_native_context(*native_context());
   DCHECK(native_context()->global_proxy() == *global_proxy);
@@ -1303,7 +1327,7 @@ void Genesis::HookUpGlobalProxy(Handle<JSGlobalProxy> global_proxy) {
 
 void Genesis::HookUpGlobalObject(Handle<JSGlobalObject> global_object) {
   Handle<JSGlobalObject> global_object_from_snapshot(
-      JSGlobalObject::cast(native_context()->extension()));
+      JSGlobalObject::cast(native_context()->extension()), isolate());
   native_context()->set_extension(*global_object);
   native_context()->set_security_token(*global_object);
 
@@ -1315,8 +1339,9 @@ static void InstallWithIntrinsicDefaultProto(Isolate* isolate,
                                              Handle<JSFunction> function,
                                              int context_index) {
   Handle<Smi> index(Smi::FromInt(context_index), isolate);
-  JSObject::AddProperty(
-      function, isolate->factory()->native_context_index_symbol(), index, NONE);
+  JSObject::AddProperty(isolate, function,
+                        isolate->factory()->native_context_index_symbol(),
+                        index, NONE);
   isolate->native_context()->set(context_index, *function);
 }
 
@@ -1325,13 +1350,13 @@ static void InstallError(Isolate* isolate, Handle<JSObject> global,
   Factory* factory = isolate->factory();
 
   Handle<JSFunction> error_fun = InstallFunction(
-      global, name, JS_ERROR_TYPE, JSObject::kHeaderSize, 0,
+      isolate, global, name, JS_ERROR_TYPE, JSObject::kHeaderSize, 0,
       factory->the_hole_value(), Builtins::kErrorConstructor, DONT_ENUM);
   error_fun->shared()->DontAdaptArguments();
   error_fun->shared()->set_length(1);
 
   if (context_index == Context::ERROR_FUNCTION_INDEX) {
-    SimpleInstallFunction(error_fun, "captureStackTrace",
+    SimpleInstallFunction(isolate, error_fun, "captureStackTrace",
                           Builtins::kErrorCaptureStackTrace, 2, false);
   }
 
@@ -1339,22 +1364,24 @@ static void InstallError(Isolate* isolate, Handle<JSObject> global,
 
   {
     // Setup %XXXErrorPrototype%.
-    Handle<JSObject> prototype(JSObject::cast(error_fun->instance_prototype()));
+    Handle<JSObject> prototype(JSObject::cast(error_fun->instance_prototype()),
+                               isolate);
 
-    JSObject::AddProperty(prototype, factory->name_string(), name, DONT_ENUM);
-    JSObject::AddProperty(prototype, factory->message_string(),
+    JSObject::AddProperty(isolate, prototype, factory->name_string(), name,
+                          DONT_ENUM);
+    JSObject::AddProperty(isolate, prototype, factory->message_string(),
                           factory->empty_string(), DONT_ENUM);
 
     if (context_index == Context::ERROR_FUNCTION_INDEX) {
       Handle<JSFunction> to_string_fun =
-          SimpleInstallFunction(prototype, factory->toString_string(),
+          SimpleInstallFunction(isolate, prototype, factory->toString_string(),
                                 Builtins::kErrorPrototypeToString, 0, true);
       isolate->native_context()->set_error_to_string(*to_string_fun);
       isolate->native_context()->set_initial_error_prototype(*prototype);
     } else {
       DCHECK(isolate->native_context()->error_to_string()->IsJSFunction());
 
-      InstallFunction(prototype, isolate->error_to_string(),
+      InstallFunction(isolate, prototype, isolate->error_to_string(),
                       factory->toString_string(), DONT_ENUM);
 
       Handle<JSFunction> global_error = isolate->error_function();
@@ -1368,8 +1395,8 @@ static void InstallError(Isolate* isolate, Handle<JSObject> global,
     }
   }
 
-  Handle<Map> initial_map(error_fun->initial_map());
-  Map::EnsureDescriptorSlack(initial_map, 1);
+  Handle<Map> initial_map(error_fun->initial_map(), isolate);
+  Map::EnsureDescriptorSlack(isolate, initial_map, 1);
 
   {
     Handle<AccessorInfo> info = factory->error_stack_accessor();
@@ -1399,8 +1426,8 @@ void Genesis::InitializeGlobal(Handle<JSGlobalObject> global_object,
                                Handle<JSFunction> empty_function,
                                GlobalContextType context_type) {
   // --- N a t i v e   C o n t e x t ---
-  // Use the empty function as closure (no scope info).
-  native_context()->set_closure(*empty_function);
+  // Use the empty scope info.
+  native_context()->set_scope_info(empty_function->shared()->scope_info());
   native_context()->set_previous(nullptr);
   // Set extension and global object.
   native_context()->set_extension(*global_object);
@@ -1409,8 +1436,7 @@ void Genesis::InitializeGlobal(Handle<JSGlobalObject> global_object,
   // by default even in case of global object reinitialization.
   native_context()->set_security_token(*global_object);
 
-  Isolate* isolate = global_object->GetIsolate();
-  Factory* factory = isolate->factory();
+  Factory* factory = isolate_->factory();
 
   Handle<ScriptContextTable> script_context_table =
       factory->NewScriptContextTable();
@@ -1419,210 +1445,214 @@ void Genesis::InitializeGlobal(Handle<JSGlobalObject> global_object,
 
   {  // --- O b j e c t ---
     Handle<String> object_name = factory->Object_string();
-    Handle<JSFunction> object_function = isolate->object_function();
-    JSObject::AddProperty(global_object, object_name, object_function,
+    Handle<JSFunction> object_function = isolate_->object_function();
+    JSObject::AddProperty(isolate_, global_object, object_name, object_function,
                           DONT_ENUM);
 
-    SimpleInstallFunction(object_function, factory->assign_string(),
+    SimpleInstallFunction(isolate_, object_function, factory->assign_string(),
                           Builtins::kObjectAssign, 2, false);
-    SimpleInstallFunction(object_function, "getOwnPropertyDescriptor",
+    SimpleInstallFunction(isolate_, object_function, "getOwnPropertyDescriptor",
                           Builtins::kObjectGetOwnPropertyDescriptor, 2, false);
-    SimpleInstallFunction(object_function,
+    SimpleInstallFunction(isolate_, object_function,
                           factory->getOwnPropertyDescriptors_string(),
                           Builtins::kObjectGetOwnPropertyDescriptors, 1, false);
-    SimpleInstallFunction(object_function, "getOwnPropertyNames",
-                          Builtins::kObjectGetOwnPropertyNames, 1, false);
-    SimpleInstallFunction(object_function, "getOwnPropertySymbols",
+    SimpleInstallFunction(isolate_, object_function, "getOwnPropertyNames",
+                          Builtins::kObjectGetOwnPropertyNames, 1, true);
+    SimpleInstallFunction(isolate_, object_function, "getOwnPropertySymbols",
                           Builtins::kObjectGetOwnPropertySymbols, 1, false);
-    SimpleInstallFunction(object_function, "is",
-                          Builtins::kObjectIs, 2, true);
-    SimpleInstallFunction(object_function, "preventExtensions",
+    SimpleInstallFunction(isolate_, object_function, "is", Builtins::kObjectIs,
+                          2, true);
+    SimpleInstallFunction(isolate_, object_function, "preventExtensions",
                           Builtins::kObjectPreventExtensions, 1, false);
-    SimpleInstallFunction(object_function, "seal",
+    SimpleInstallFunction(isolate_, object_function, "seal",
                           Builtins::kObjectSeal, 1, false);
 
-    Handle<JSFunction> object_create =
-        SimpleInstallFunction(object_function, factory->create_string(),
-                              Builtins::kObjectCreate, 2, false);
+    Handle<JSFunction> object_create = SimpleInstallFunction(
+        isolate_, object_function, factory->create_string(),
+        Builtins::kObjectCreate, 2, false);
     native_context()->set_object_create(*object_create);
 
-    Handle<JSFunction> object_define_properties = SimpleInstallFunction(
-        object_function, "defineProperties",
-        Builtins::kObjectDefineProperties, 2, true);
+    Handle<JSFunction> object_define_properties =
+        SimpleInstallFunction(isolate_, object_function, "defineProperties",
+                              Builtins::kObjectDefineProperties, 2, true);
     native_context()->set_object_define_properties(*object_define_properties);
 
     Handle<JSFunction> object_define_property = SimpleInstallFunction(
-        object_function, factory->defineProperty_string(),
+        isolate_, object_function, factory->defineProperty_string(),
         Builtins::kObjectDefineProperty, 3, true);
     native_context()->set_object_define_property(*object_define_property);
 
-    SimpleInstallFunction(object_function, "freeze", Builtins::kObjectFreeze, 1,
-                          false);
+    SimpleInstallFunction(isolate_, object_function, "freeze",
+                          Builtins::kObjectFreeze, 1, false);
 
-    Handle<JSFunction> object_get_prototype_of = SimpleInstallFunction(
-        object_function, "getPrototypeOf", Builtins::kObjectGetPrototypeOf,
-        1, false);
+    Handle<JSFunction> object_get_prototype_of =
+        SimpleInstallFunction(isolate_, object_function, "getPrototypeOf",
+                              Builtins::kObjectGetPrototypeOf, 1, false);
     native_context()->set_object_get_prototype_of(*object_get_prototype_of);
-    SimpleInstallFunction(object_function, "setPrototypeOf",
+    SimpleInstallFunction(isolate_, object_function, "setPrototypeOf",
                           Builtins::kObjectSetPrototypeOf, 2, false);
 
-    Handle<JSFunction> object_is_extensible = SimpleInstallFunction(
-        object_function, "isExtensible", Builtins::kObjectIsExtensible,
-        1, false);
-    native_context()->set_object_is_extensible(*object_is_extensible);
+    SimpleInstallFunction(isolate_, object_function, "isExtensible",
+                          Builtins::kObjectIsExtensible, 1, false);
+    SimpleInstallFunction(isolate_, object_function, "isFrozen",
+                          Builtins::kObjectIsFrozen, 1, false);
 
-    Handle<JSFunction> object_is_frozen = SimpleInstallFunction(
-        object_function, "isFrozen", Builtins::kObjectIsFrozen, 1, false);
-    native_context()->set_object_is_frozen(*object_is_frozen);
-
-    Handle<JSFunction> object_is_sealed = SimpleInstallFunction(
-        object_function, "isSealed", Builtins::kObjectIsSealed, 1, false);
+    Handle<JSFunction> object_is_sealed =
+        SimpleInstallFunction(isolate_, object_function, "isSealed",
+                              Builtins::kObjectIsSealed, 1, false);
     native_context()->set_object_is_sealed(*object_is_sealed);
 
     Handle<JSFunction> object_keys = SimpleInstallFunction(
-        object_function, "keys", Builtins::kObjectKeys, 1, true);
+        isolate_, object_function, "keys", Builtins::kObjectKeys, 1, true);
     native_context()->set_object_keys(*object_keys);
-    SimpleInstallFunction(object_function, factory->entries_string(),
+    SimpleInstallFunction(isolate_, object_function, factory->entries_string(),
                           Builtins::kObjectEntries, 1, true);
-    SimpleInstallFunction(object_function, factory->values_string(),
+    SimpleInstallFunction(isolate_, object_function, factory->values_string(),
                           Builtins::kObjectValues, 1, true);
 
-    SimpleInstallFunction(isolate->initial_object_prototype(),
+    SimpleInstallFunction(isolate_, isolate_->initial_object_prototype(),
                           "__defineGetter__", Builtins::kObjectDefineGetter, 2,
                           true);
-    SimpleInstallFunction(isolate->initial_object_prototype(),
+    SimpleInstallFunction(isolate_, isolate_->initial_object_prototype(),
                           "__defineSetter__", Builtins::kObjectDefineSetter, 2,
                           true);
-    SimpleInstallFunction(isolate->initial_object_prototype(), "hasOwnProperty",
+    SimpleInstallFunction(isolate_, isolate_->initial_object_prototype(),
+                          "hasOwnProperty",
                           Builtins::kObjectPrototypeHasOwnProperty, 1, true);
-    SimpleInstallFunction(isolate->initial_object_prototype(),
+    SimpleInstallFunction(isolate_, isolate_->initial_object_prototype(),
                           "__lookupGetter__", Builtins::kObjectLookupGetter, 1,
                           true);
-    SimpleInstallFunction(isolate->initial_object_prototype(),
+    SimpleInstallFunction(isolate_, isolate_->initial_object_prototype(),
                           "__lookupSetter__", Builtins::kObjectLookupSetter, 1,
                           true);
-    SimpleInstallFunction(isolate->initial_object_prototype(), "isPrototypeOf",
+    SimpleInstallFunction(isolate_, isolate_->initial_object_prototype(),
+                          "isPrototypeOf",
                           Builtins::kObjectPrototypeIsPrototypeOf, 1, true);
     SimpleInstallFunction(
-        isolate->initial_object_prototype(), "propertyIsEnumerable",
+        isolate_, isolate_->initial_object_prototype(), "propertyIsEnumerable",
         Builtins::kObjectPrototypePropertyIsEnumerable, 1, false);
-    Handle<JSFunction> object_to_string = SimpleInstallFunction(
-        isolate->initial_object_prototype(), factory->toString_string(),
-        Builtins::kObjectPrototypeToString, 0, true);
+    Handle<JSFunction> object_to_string =
+        SimpleInstallFunction(isolate_, isolate_->initial_object_prototype(),
+                              factory->toString_string(),
+                              Builtins::kObjectPrototypeToString, 0, true);
     native_context()->set_object_to_string(*object_to_string);
     Handle<JSFunction> object_value_of = SimpleInstallFunction(
-        isolate->initial_object_prototype(), "valueOf",
+        isolate_, isolate_->initial_object_prototype(), "valueOf",
         Builtins::kObjectPrototypeValueOf, 0, true);
     native_context()->set_object_value_of(*object_value_of);
 
-    SimpleInstallGetterSetter(isolate->initial_object_prototype(),
+    SimpleInstallGetterSetter(isolate_, isolate_->initial_object_prototype(),
                               factory->proto_string(),
                               Builtins::kObjectPrototypeGetProto,
                               Builtins::kObjectPrototypeSetProto, DONT_ENUM);
 
-    SimpleInstallFunction(isolate->initial_object_prototype(), "toLocaleString",
+    SimpleInstallFunction(isolate_, isolate_->initial_object_prototype(),
+                          "toLocaleString",
                           Builtins::kObjectPrototypeToLocaleString, 0, true);
   }
 
-  Handle<JSObject> global(native_context()->global_object());
+  Handle<JSObject> global(native_context()->global_object(), isolate());
 
   {  // --- F u n c t i o n ---
     Handle<JSFunction> prototype = empty_function;
-    Handle<JSFunction> function_fun = InstallFunction(
-        global, "Function", JS_FUNCTION_TYPE, JSFunction::kSizeWithPrototype, 0,
-        prototype, Builtins::kFunctionConstructor);
+    Handle<JSFunction> function_fun =
+        InstallFunction(isolate_, global, "Function", JS_FUNCTION_TYPE,
+                        JSFunction::kSizeWithPrototype, 0, prototype,
+                        Builtins::kFunctionConstructor);
     // Function instances are sloppy by default.
-    function_fun->set_prototype_or_initial_map(*isolate->sloppy_function_map());
+    function_fun->set_prototype_or_initial_map(
+        *isolate_->sloppy_function_map());
     function_fun->shared()->DontAdaptArguments();
     function_fun->shared()->set_length(1);
-    InstallWithIntrinsicDefaultProto(isolate, function_fun,
+    InstallWithIntrinsicDefaultProto(isolate_, function_fun,
                                      Context::FUNCTION_FUNCTION_INDEX);
 
     // Setup the methods on the %FunctionPrototype%.
-    JSObject::AddProperty(prototype, factory->constructor_string(),
+    JSObject::AddProperty(isolate_, prototype, factory->constructor_string(),
                           function_fun, DONT_ENUM);
-    SimpleInstallFunction(prototype, factory->apply_string(),
+    SimpleInstallFunction(isolate_, prototype, factory->apply_string(),
                           Builtins::kFunctionPrototypeApply, 2, false);
-    SimpleInstallFunction(prototype, factory->bind_string(),
+    SimpleInstallFunction(isolate_, prototype, factory->bind_string(),
                           Builtins::kFastFunctionPrototypeBind, 1, false);
-    SimpleInstallFunction(prototype, factory->call_string(),
+    SimpleInstallFunction(isolate_, prototype, factory->call_string(),
                           Builtins::kFunctionPrototypeCall, 1, false);
-    SimpleInstallFunction(prototype, factory->toString_string(),
+    SimpleInstallFunction(isolate_, prototype, factory->toString_string(),
                           Builtins::kFunctionPrototypeToString, 0, false);
 
     // Install the @@hasInstance function.
     Handle<JSFunction> has_instance = SimpleInstallFunction(
-        prototype, factory->has_instance_symbol(), "[Symbol.hasInstance]",
-        Builtins::kFunctionPrototypeHasInstance, 1, true,
+        isolate_, prototype, factory->has_instance_symbol(),
+        "[Symbol.hasInstance]", Builtins::kFunctionPrototypeHasInstance, 1,
+        true,
         static_cast<PropertyAttributes>(DONT_ENUM | DONT_DELETE | READ_ONLY),
         kFunctionHasInstance);
     native_context()->set_function_has_instance(*has_instance);
 
     // Complete setting up function maps.
     {
-      isolate->sloppy_function_map()->SetConstructor(*function_fun);
-      isolate->sloppy_function_with_name_map()->SetConstructor(*function_fun);
-      isolate->sloppy_function_with_readonly_prototype_map()->SetConstructor(
+      isolate_->sloppy_function_map()->SetConstructor(*function_fun);
+      isolate_->sloppy_function_with_name_map()->SetConstructor(*function_fun);
+      isolate_->sloppy_function_with_readonly_prototype_map()->SetConstructor(
           *function_fun);
 
-      isolate->strict_function_map()->SetConstructor(*function_fun);
-      isolate->strict_function_with_name_map()->SetConstructor(*function_fun);
+      isolate_->strict_function_map()->SetConstructor(*function_fun);
+      isolate_->strict_function_with_name_map()->SetConstructor(*function_fun);
       strict_function_with_home_object_map_->SetConstructor(*function_fun);
       strict_function_with_name_and_home_object_map_->SetConstructor(
           *function_fun);
-      isolate->strict_function_with_readonly_prototype_map()->SetConstructor(
+      isolate_->strict_function_with_readonly_prototype_map()->SetConstructor(
           *function_fun);
 
-      isolate->class_function_map()->SetConstructor(*function_fun);
+      isolate_->class_function_map()->SetConstructor(*function_fun);
     }
   }
 
   {  // --- A s y n c F r o m S y n c I t e r a t o r
     Handle<SharedFunctionInfo> info = SimpleCreateSharedFunctionInfo(
-        isolate, Builtins::kAsyncIteratorValueUnwrap, factory->empty_string(),
+        isolate_, Builtins::kAsyncIteratorValueUnwrap, factory->empty_string(),
         1);
     native_context()->set_async_iterator_value_unwrap_shared_fun(*info);
   }
 
   {  // --- A s y n c G e n e r a t o r ---
     Handle<JSFunction> await_caught =
-        SimpleCreateFunction(isolate, factory->empty_string(),
+        SimpleCreateFunction(isolate_, factory->empty_string(),
                              Builtins::kAsyncGeneratorAwaitCaught, 1, false);
     native_context()->set_async_generator_await_caught(*await_caught);
 
     Handle<JSFunction> await_uncaught =
-        SimpleCreateFunction(isolate, factory->empty_string(),
+        SimpleCreateFunction(isolate_, factory->empty_string(),
                              Builtins::kAsyncGeneratorAwaitUncaught, 1, false);
     native_context()->set_async_generator_await_uncaught(*await_uncaught);
 
     Handle<SharedFunctionInfo> info = SimpleCreateSharedFunctionInfo(
-        isolate, Builtins::kAsyncGeneratorAwaitResolveClosure,
+        isolate_, Builtins::kAsyncGeneratorAwaitResolveClosure,
         factory->empty_string(), 1);
     native_context()->set_async_generator_await_resolve_shared_fun(*info);
 
     info = SimpleCreateSharedFunctionInfo(
-        isolate, Builtins::kAsyncGeneratorAwaitRejectClosure,
+        isolate_, Builtins::kAsyncGeneratorAwaitRejectClosure,
         factory->empty_string(), 1);
     native_context()->set_async_generator_await_reject_shared_fun(*info);
 
     info = SimpleCreateSharedFunctionInfo(
-        isolate, Builtins::kAsyncGeneratorYieldResolveClosure,
+        isolate_, Builtins::kAsyncGeneratorYieldResolveClosure,
         factory->empty_string(), 1);
     native_context()->set_async_generator_yield_resolve_shared_fun(*info);
 
     info = SimpleCreateSharedFunctionInfo(
-        isolate, Builtins::kAsyncGeneratorReturnResolveClosure,
+        isolate_, Builtins::kAsyncGeneratorReturnResolveClosure,
         factory->empty_string(), 1);
     native_context()->set_async_generator_return_resolve_shared_fun(*info);
 
     info = SimpleCreateSharedFunctionInfo(
-        isolate, Builtins::kAsyncGeneratorReturnClosedResolveClosure,
+        isolate_, Builtins::kAsyncGeneratorReturnClosedResolveClosure,
         factory->empty_string(), 1);
     native_context()->set_async_generator_return_closed_resolve_shared_fun(
         *info);
 
     info = SimpleCreateSharedFunctionInfo(
-        isolate, Builtins::kAsyncGeneratorReturnClosedRejectClosure,
+        isolate_, Builtins::kAsyncGeneratorReturnClosedRejectClosure,
         factory->empty_string(), 1);
     native_context()->set_async_generator_return_closed_reject_shared_fun(
         *info);
@@ -1630,8 +1660,8 @@ void Genesis::InitializeGlobal(Handle<JSGlobalObject> global_object,
 
   {  // --- A r r a y ---
     Handle<JSFunction> array_function = InstallFunction(
-        global, "Array", JS_ARRAY_TYPE, JSArray::kSize, 0,
-        isolate->initial_object_prototype(), Builtins::kArrayConstructor);
+        isolate_, global, "Array", JS_ARRAY_TYPE, JSArray::kSize, 0,
+        isolate_->initial_object_prototype(), Builtins::kArrayConstructor);
     array_function->shared()->DontAdaptArguments();
     array_function->shared()->set_builtin_function_id(kArrayConstructor);
 
@@ -1639,12 +1669,12 @@ void Genesis::InitializeGlobal(Handle<JSGlobalObject> global_object,
     // is 1.
     array_function->shared()->set_length(1);
 
-    Handle<Map> initial_map(array_function->initial_map());
+    Handle<Map> initial_map(array_function->initial_map(), isolate());
 
     // This assert protects an optimization in
     // HGraphBuilder::JSArrayBuilder::EmitMapCode()
     DCHECK(initial_map->elements_kind() == GetInitialFastElementsKind());
-    Map::EnsureDescriptorSlack(initial_map, 1);
+    Map::EnsureDescriptorSlack(isolate_, initial_map, 1);
 
     PropertyAttributes attribs = static_cast<PropertyAttributes>(
         DONT_ENUM | DONT_DELETE);
@@ -1656,9 +1686,9 @@ void Genesis::InitializeGlobal(Handle<JSGlobalObject> global_object,
       initial_map->AppendDescriptor(&d);
     }
 
-    InstallWithIntrinsicDefaultProto(isolate, array_function,
+    InstallWithIntrinsicDefaultProto(isolate_, array_function,
                                      Context::ARRAY_FUNCTION_INDEX);
-    InstallSpeciesGetter(array_function);
+    InstallSpeciesGetter(isolate_, array_function);
 
     // Cache the array maps, needed by ArrayConstructorStub
     CacheInitialJSArrayMaps(native_context(), initial_map);
@@ -1673,69 +1703,87 @@ void Genesis::InitializeGlobal(Handle<JSGlobalObject> global_object,
     native_context()->set_initial_array_prototype(*proto);
 
     Handle<JSFunction> is_arraylike = SimpleInstallFunction(
-        array_function, "isArray", Builtins::kArrayIsArray, 1, true);
+        isolate_, array_function, "isArray", Builtins::kArrayIsArray, 1, true);
     native_context()->set_is_arraylike(*is_arraylike);
 
-    SimpleInstallFunction(array_function, "from", Builtins::kArrayFrom, 1,
+    SimpleInstallFunction(isolate_, array_function, "from",
+                          Builtins::kArrayFrom, 1, false);
+    SimpleInstallFunction(isolate_, array_function, "of", Builtins::kArrayOf, 0,
                           false);
-    SimpleInstallFunction(array_function, "of", Builtins::kArrayOf, 0, false);
 
-    JSObject::AddProperty(proto, factory->constructor_string(), array_function,
-                          DONT_ENUM);
+    JSObject::AddProperty(isolate_, proto, factory->constructor_string(),
+                          array_function, DONT_ENUM);
 
-    SimpleInstallFunction(proto, "concat", Builtins::kArrayConcat, 1, false);
-    SimpleInstallFunction(proto, "find", Builtins::kArrayPrototypeFind, 1,
+    SimpleInstallFunction(isolate_, proto, "concat", Builtins::kArrayConcat, 1,
                           false);
-    SimpleInstallFunction(proto, "findIndex",
+    SimpleInstallFunction(isolate_, proto, "find",
+                          Builtins::kArrayPrototypeFind, 1, false);
+    SimpleInstallFunction(isolate_, proto, "findIndex",
                           Builtins::kArrayPrototypeFindIndex, 1, false);
-    SimpleInstallFunction(proto, "pop", Builtins::kArrayPrototypePop, 0, false);
-    SimpleInstallFunction(proto, "push", Builtins::kArrayPrototypePush, 1,
+    SimpleInstallFunction(isolate_, proto, "pop", Builtins::kArrayPrototypePop,
+                          0, false);
+    SimpleInstallFunction(isolate_, proto, "push",
+                          Builtins::kArrayPrototypePush, 1, false);
+    SimpleInstallFunction(isolate_, proto, "shift",
+                          Builtins::kArrayPrototypeShift, 0, false);
+    SimpleInstallFunction(isolate_, proto, "unshift", Builtins::kArrayUnshift,
+                          1, false);
+    SimpleInstallFunction(isolate_, proto, "slice",
+                          Builtins::kArrayPrototypeSlice, 2, false);
+    if (FLAG_enable_experimental_builtins) {
+      SimpleInstallFunction(isolate_, proto, "splice",
+                            Builtins::kArraySpliceTorque, 2, false);
+    } else {
+      SimpleInstallFunction(isolate_, proto, "splice", Builtins::kArraySplice,
+                            2, false);
+    }
+    SimpleInstallFunction(isolate_, proto, "includes", Builtins::kArrayIncludes,
+                          1, false);
+    SimpleInstallFunction(isolate_, proto, "indexOf", Builtins::kArrayIndexOf,
+                          1, false);
+    SimpleInstallFunction(isolate_, proto, "keys",
+                          Builtins::kArrayPrototypeKeys, 0, true, kArrayKeys);
+    SimpleInstallFunction(isolate_, proto, "entries",
+                          Builtins::kArrayPrototypeEntries, 0, true,
+                          kArrayEntries);
+    SimpleInstallFunction(isolate_, proto, factory->iterator_symbol(), "values",
+                          Builtins::kArrayPrototypeValues, 0, true, DONT_ENUM,
+                          kArrayValues);
+    SimpleInstallFunction(isolate_, proto, "forEach", Builtins::kArrayForEach,
+                          1, false);
+    SimpleInstallFunction(isolate_, proto, "filter", Builtins::kArrayFilter, 1,
                           false);
-    SimpleInstallFunction(proto, "shift", Builtins::kArrayPrototypeShift, 0,
+    SimpleInstallFunction(isolate_, proto, "map", Builtins::kArrayMap, 1,
                           false);
-    SimpleInstallFunction(proto, "unshift", Builtins::kArrayUnshift, 1, false);
-    SimpleInstallFunction(proto, "slice", Builtins::kArrayPrototypeSlice, 2,
+    SimpleInstallFunction(isolate_, proto, "every", Builtins::kArrayEvery, 1,
                           false);
-    SimpleInstallFunction(proto, "splice", Builtins::kArraySplice, 2, false);
-    SimpleInstallFunction(proto, "includes", Builtins::kArrayIncludes, 1,
+    SimpleInstallFunction(isolate_, proto, "some", Builtins::kArraySome, 1,
                           false);
-    SimpleInstallFunction(proto, "indexOf", Builtins::kArrayIndexOf, 1, false);
-    SimpleInstallFunction(proto, "keys", Builtins::kArrayPrototypeKeys, 0, true,
-                          kArrayKeys);
-    SimpleInstallFunction(proto, "entries", Builtins::kArrayPrototypeEntries, 0,
-                          true, kArrayEntries);
-    SimpleInstallFunction(proto, factory->iterator_symbol(), "values",
-                          Builtins::kArrayPrototypeValues, 0, true, DONT_ENUM,
-                          kArrayValues);
-    SimpleInstallFunction(proto, "forEach", Builtins::kArrayForEach, 1, false);
-    SimpleInstallFunction(proto, "filter", Builtins::kArrayFilter, 1, false);
-    SimpleInstallFunction(proto, "map", Builtins::kArrayMap, 1, false);
-    SimpleInstallFunction(proto, "every", Builtins::kArrayEvery, 1, false);
-    SimpleInstallFunction(proto, "some", Builtins::kArraySome, 1, false);
-    SimpleInstallFunction(proto, "reduce", Builtins::kArrayReduce, 1, false);
-    SimpleInstallFunction(proto, "reduceRight", Builtins::kArrayReduceRight, 1,
+    SimpleInstallFunction(isolate_, proto, "reduce", Builtins::kArrayReduce, 1,
                           false);
+    SimpleInstallFunction(isolate_, proto, "reduceRight",
+                          Builtins::kArrayReduceRight, 1, false);
   }
 
   {  // --- A r r a y I t e r a t o r ---
     Handle<JSObject> iterator_prototype(
-        native_context()->initial_iterator_prototype());
+        native_context()->initial_iterator_prototype(), isolate());
 
     Handle<JSObject> array_iterator_prototype =
-        factory->NewJSObject(isolate->object_function(), TENURED);
+        factory->NewJSObject(isolate_->object_function(), TENURED);
     JSObject::ForceSetPrototype(array_iterator_prototype, iterator_prototype);
 
     JSObject::AddProperty(
-        array_iterator_prototype, factory->to_string_tag_symbol(),
+        isolate_, array_iterator_prototype, factory->to_string_tag_symbol(),
         factory->ArrayIterator_string(),
         static_cast<PropertyAttributes>(DONT_ENUM | READ_ONLY));
 
-    SimpleInstallFunction(array_iterator_prototype, "next",
+    SimpleInstallFunction(isolate_, array_iterator_prototype, "next",
                           Builtins::kArrayIteratorPrototypeNext, 0, true,
                           kArrayIteratorNext);
 
     Handle<JSFunction> array_iterator_function =
-        CreateFunction(isolate, factory->ArrayIterator_string(),
+        CreateFunction(isolate_, factory->ArrayIterator_string(),
                        JS_ARRAY_ITERATOR_TYPE, JSArrayIterator::kSize, 0,
                        array_iterator_prototype, Builtins::kIllegal);
     array_iterator_function->shared()->set_native(false);
@@ -1748,12 +1796,12 @@ void Genesis::InitializeGlobal(Handle<JSGlobalObject> global_object,
 
   {  // --- N u m b e r ---
     Handle<JSFunction> number_fun = InstallFunction(
-        global, "Number", JS_VALUE_TYPE, JSValue::kSize, 0,
-        isolate->initial_object_prototype(), Builtins::kNumberConstructor);
+        isolate_, global, "Number", JS_VALUE_TYPE, JSValue::kSize, 0,
+        isolate_->initial_object_prototype(), Builtins::kNumberConstructor);
     number_fun->shared()->set_builtin_function_id(kNumberConstructor);
     number_fun->shared()->DontAdaptArguments();
     number_fun->shared()->set_length(1);
-    InstallWithIntrinsicDefaultProto(isolate, number_fun,
+    InstallWithIntrinsicDefaultProto(isolate_, number_fun,
                                      Context::NUMBER_FUNCTION_INDEX);
 
     // Create the %NumberPrototype%
@@ -1763,54 +1811,54 @@ void Genesis::InitializeGlobal(Handle<JSGlobalObject> global_object,
     JSFunction::SetPrototype(number_fun, prototype);
 
     // Install the "constructor" property on the {prototype}.
-    JSObject::AddProperty(prototype, factory->constructor_string(), number_fun,
-                          DONT_ENUM);
+    JSObject::AddProperty(isolate_, prototype, factory->constructor_string(),
+                          number_fun, DONT_ENUM);
 
     // Install the Number.prototype methods.
-    SimpleInstallFunction(prototype, "toExponential",
+    SimpleInstallFunction(isolate_, prototype, "toExponential",
                           Builtins::kNumberPrototypeToExponential, 1, false);
-    SimpleInstallFunction(prototype, "toFixed",
+    SimpleInstallFunction(isolate_, prototype, "toFixed",
                           Builtins::kNumberPrototypeToFixed, 1, false);
-    SimpleInstallFunction(prototype, "toPrecision",
+    SimpleInstallFunction(isolate_, prototype, "toPrecision",
                           Builtins::kNumberPrototypeToPrecision, 1, false);
-    SimpleInstallFunction(prototype, "toString",
+    SimpleInstallFunction(isolate_, prototype, "toString",
                           Builtins::kNumberPrototypeToString, 1, false);
-    SimpleInstallFunction(prototype, "valueOf",
+    SimpleInstallFunction(isolate_, prototype, "valueOf",
                           Builtins::kNumberPrototypeValueOf, 0, true);
 
     // Install Intl fallback functions.
-    SimpleInstallFunction(prototype, "toLocaleString",
+    SimpleInstallFunction(isolate_, prototype, "toLocaleString",
                           Builtins::kNumberPrototypeToLocaleString, 0, false);
 
     // Install the Number functions.
-    SimpleInstallFunction(number_fun, "isFinite", Builtins::kNumberIsFinite, 1,
-                          true);
-    SimpleInstallFunction(number_fun, "isInteger", Builtins::kNumberIsInteger,
+    SimpleInstallFunction(isolate_, number_fun, "isFinite",
+                          Builtins::kNumberIsFinite, 1, true);
+    SimpleInstallFunction(isolate_, number_fun, "isInteger",
+                          Builtins::kNumberIsInteger, 1, true);
+    SimpleInstallFunction(isolate_, number_fun, "isNaN", Builtins::kNumberIsNaN,
                           1, true);
-    SimpleInstallFunction(number_fun, "isNaN", Builtins::kNumberIsNaN, 1, true);
-    SimpleInstallFunction(number_fun, "isSafeInteger",
+    SimpleInstallFunction(isolate_, number_fun, "isSafeInteger",
                           Builtins::kNumberIsSafeInteger, 1, true);
 
     // Install Number.parseFloat and Global.parseFloat.
-    Handle<JSFunction> parse_float_fun = SimpleInstallFunction(
-        number_fun, "parseFloat", Builtins::kNumberParseFloat, 1, true);
-    JSObject::AddProperty(global_object,
+    Handle<JSFunction> parse_float_fun =
+        SimpleInstallFunction(isolate_, number_fun, "parseFloat",
+                              Builtins::kNumberParseFloat, 1, true);
+    JSObject::AddProperty(isolate_, global_object,
                           factory->NewStringFromAsciiChecked("parseFloat"),
                           parse_float_fun, DONT_ENUM);
 
     // Install Number.parseInt and Global.parseInt.
     Handle<JSFunction> parse_int_fun = SimpleInstallFunction(
-        number_fun, "parseInt", Builtins::kNumberParseInt, 2, true);
-    JSObject::AddProperty(global_object,
+        isolate_, number_fun, "parseInt", Builtins::kNumberParseInt, 2, true);
+    JSObject::AddProperty(isolate_, global_object,
                           factory->NewStringFromAsciiChecked("parseInt"),
                           parse_int_fun, DONT_ENUM);
 
     // Install Number constants
     double kMaxValue = 1.7976931348623157e+308;
     double kMinValue = 5e-324;
-
-    double kMaxSafeInt = 9007199254740991;
-    double kMinSafeInt = -9007199254740991;
+    double kMinSafeInteger = -kMaxSafeInteger;
     double kEPS = 2.220446049250313e-16;
 
     Handle<Object> infinity = factory->infinity_value();
@@ -1818,89 +1866,93 @@ void Genesis::InitializeGlobal(Handle<JSGlobalObject> global_object,
     Handle<String> nan_name = factory->NewStringFromAsciiChecked("NaN");
 
     JSObject::AddProperty(
-        number_fun, factory->NewStringFromAsciiChecked("MAX_VALUE"),
+        isolate_, number_fun, factory->NewStringFromAsciiChecked("MAX_VALUE"),
         factory->NewNumber(kMaxValue),
         static_cast<PropertyAttributes>(DONT_DELETE | DONT_ENUM | READ_ONLY));
     JSObject::AddProperty(
-        number_fun, factory->NewStringFromAsciiChecked("MIN_VALUE"),
+        isolate_, number_fun, factory->NewStringFromAsciiChecked("MIN_VALUE"),
         factory->NewNumber(kMinValue),
         static_cast<PropertyAttributes>(DONT_DELETE | DONT_ENUM | READ_ONLY));
     JSObject::AddProperty(
-        number_fun, nan_name, nan,
+        isolate_, number_fun, nan_name, nan,
         static_cast<PropertyAttributes>(DONT_DELETE | DONT_ENUM | READ_ONLY));
     JSObject::AddProperty(
-        number_fun, factory->NewStringFromAsciiChecked("NEGATIVE_INFINITY"),
+        isolate_, number_fun,
+        factory->NewStringFromAsciiChecked("NEGATIVE_INFINITY"),
         factory->NewNumber(-V8_INFINITY),
         static_cast<PropertyAttributes>(DONT_DELETE | DONT_ENUM | READ_ONLY));
     JSObject::AddProperty(
-        number_fun, factory->NewStringFromAsciiChecked("POSITIVE_INFINITY"),
-        infinity,
+        isolate_, number_fun,
+        factory->NewStringFromAsciiChecked("POSITIVE_INFINITY"), infinity,
         static_cast<PropertyAttributes>(DONT_DELETE | DONT_ENUM | READ_ONLY));
     JSObject::AddProperty(
-        number_fun, factory->NewStringFromAsciiChecked("MAX_SAFE_INTEGER"),
-        factory->NewNumber(kMaxSafeInt),
+        isolate_, number_fun,
+        factory->NewStringFromAsciiChecked("MAX_SAFE_INTEGER"),
+        factory->NewNumber(kMaxSafeInteger),
         static_cast<PropertyAttributes>(DONT_DELETE | DONT_ENUM | READ_ONLY));
     JSObject::AddProperty(
-        number_fun, factory->NewStringFromAsciiChecked("MIN_SAFE_INTEGER"),
-        factory->NewNumber(kMinSafeInt),
+        isolate_, number_fun,
+        factory->NewStringFromAsciiChecked("MIN_SAFE_INTEGER"),
+        factory->NewNumber(kMinSafeInteger),
         static_cast<PropertyAttributes>(DONT_DELETE | DONT_ENUM | READ_ONLY));
     JSObject::AddProperty(
-        number_fun, factory->NewStringFromAsciiChecked("EPSILON"),
+        isolate_, number_fun, factory->NewStringFromAsciiChecked("EPSILON"),
         factory->NewNumber(kEPS),
         static_cast<PropertyAttributes>(DONT_DELETE | DONT_ENUM | READ_ONLY));
 
     JSObject::AddProperty(
-        global, factory->NewStringFromAsciiChecked("Infinity"), infinity,
+        isolate_, global, factory->NewStringFromAsciiChecked("Infinity"),
+        infinity,
         static_cast<PropertyAttributes>(DONT_DELETE | DONT_ENUM | READ_ONLY));
     JSObject::AddProperty(
-        global, nan_name, nan,
+        isolate_, global, nan_name, nan,
         static_cast<PropertyAttributes>(DONT_DELETE | DONT_ENUM | READ_ONLY));
     JSObject::AddProperty(
-        global, factory->NewStringFromAsciiChecked("undefined"),
+        isolate_, global, factory->NewStringFromAsciiChecked("undefined"),
         factory->undefined_value(),
         static_cast<PropertyAttributes>(DONT_DELETE | DONT_ENUM | READ_ONLY));
   }
 
   {  // --- B o o l e a n ---
     Handle<JSFunction> boolean_fun = InstallFunction(
-        global, "Boolean", JS_VALUE_TYPE, JSValue::kSize, 0,
-        isolate->initial_object_prototype(), Builtins::kBooleanConstructor);
+        isolate_, global, "Boolean", JS_VALUE_TYPE, JSValue::kSize, 0,
+        isolate_->initial_object_prototype(), Builtins::kBooleanConstructor);
     boolean_fun->shared()->DontAdaptArguments();
     boolean_fun->shared()->set_length(1);
-    InstallWithIntrinsicDefaultProto(isolate, boolean_fun,
+    InstallWithIntrinsicDefaultProto(isolate_, boolean_fun,
                                      Context::BOOLEAN_FUNCTION_INDEX);
 
     // Create the %BooleanPrototype%
     Handle<JSValue> prototype =
         Handle<JSValue>::cast(factory->NewJSObject(boolean_fun, TENURED));
-    prototype->set_value(isolate->heap()->false_value());
+    prototype->set_value(ReadOnlyRoots(isolate_).false_value());
     JSFunction::SetPrototype(boolean_fun, prototype);
 
     // Install the "constructor" property on the {prototype}.
-    JSObject::AddProperty(prototype, factory->constructor_string(), boolean_fun,
-                          DONT_ENUM);
+    JSObject::AddProperty(isolate_, prototype, factory->constructor_string(),
+                          boolean_fun, DONT_ENUM);
 
     // Install the Boolean.prototype methods.
-    SimpleInstallFunction(prototype, "toString",
+    SimpleInstallFunction(isolate_, prototype, "toString",
                           Builtins::kBooleanPrototypeToString, 0, true);
-    SimpleInstallFunction(prototype, "valueOf",
+    SimpleInstallFunction(isolate_, prototype, "valueOf",
                           Builtins::kBooleanPrototypeValueOf, 0, true);
   }
 
   {  // --- S t r i n g ---
     Handle<JSFunction> string_fun = InstallFunction(
-        global, "String", JS_VALUE_TYPE, JSValue::kSize, 0,
-        isolate->initial_object_prototype(), Builtins::kStringConstructor);
+        isolate_, global, "String", JS_VALUE_TYPE, JSValue::kSize, 0,
+        isolate_->initial_object_prototype(), Builtins::kStringConstructor);
     string_fun->shared()->set_builtin_function_id(kStringConstructor);
     string_fun->shared()->DontAdaptArguments();
     string_fun->shared()->set_length(1);
-    InstallWithIntrinsicDefaultProto(isolate, string_fun,
+    InstallWithIntrinsicDefaultProto(isolate_, string_fun,
                                      Context::STRING_FUNCTION_INDEX);
 
-    Handle<Map> string_map =
-        Handle<Map>(native_context()->string_function()->initial_map());
+    Handle<Map> string_map = Handle<Map>(
+        native_context()->string_function()->initial_map(), isolate());
     string_map->set_elements_kind(FAST_STRING_WRAPPER_ELEMENTS);
-    Map::EnsureDescriptorSlack(string_map, 1);
+    Map::EnsureDescriptorSlack(isolate_, string_map, 1);
 
     PropertyAttributes attribs = static_cast<PropertyAttributes>(
         DONT_ENUM | DONT_DELETE | READ_ONLY);
@@ -1912,130 +1964,131 @@ void Genesis::InitializeGlobal(Handle<JSGlobalObject> global_object,
     }
 
     // Install the String.fromCharCode function.
-    SimpleInstallFunction(string_fun, "fromCharCode",
+    SimpleInstallFunction(isolate_, string_fun, "fromCharCode",
                           Builtins::kStringFromCharCode, 1, false);
 
     // Install the String.fromCodePoint function.
-    SimpleInstallFunction(string_fun, "fromCodePoint",
+    SimpleInstallFunction(isolate_, string_fun, "fromCodePoint",
                           Builtins::kStringFromCodePoint, 1, false);
 
     // Install the String.raw function.
-    SimpleInstallFunction(string_fun, "raw", Builtins::kStringRaw, 1, false);
+    SimpleInstallFunction(isolate_, string_fun, "raw", Builtins::kStringRaw, 1,
+                          false);
 
     // Create the %StringPrototype%
     Handle<JSValue> prototype =
         Handle<JSValue>::cast(factory->NewJSObject(string_fun, TENURED));
-    prototype->set_value(isolate->heap()->empty_string());
+    prototype->set_value(ReadOnlyRoots(isolate_).empty_string());
     JSFunction::SetPrototype(string_fun, prototype);
     native_context()->set_initial_string_prototype(*prototype);
 
     // Install the "constructor" property on the {prototype}.
-    JSObject::AddProperty(prototype, factory->constructor_string(), string_fun,
-                          DONT_ENUM);
+    JSObject::AddProperty(isolate_, prototype, factory->constructor_string(),
+                          string_fun, DONT_ENUM);
 
     // Install the String.prototype methods.
-    SimpleInstallFunction(prototype, "anchor", Builtins::kStringPrototypeAnchor,
-                          1, true);
-    SimpleInstallFunction(prototype, "big", Builtins::kStringPrototypeBig, 0,
-                          true);
-    SimpleInstallFunction(prototype, "blink", Builtins::kStringPrototypeBlink,
-                          0, true);
-    SimpleInstallFunction(prototype, "bold", Builtins::kStringPrototypeBold, 0,
-                          true);
-    SimpleInstallFunction(prototype, "charAt", Builtins::kStringPrototypeCharAt,
-                          1, true);
-    SimpleInstallFunction(prototype, "charCodeAt",
+    SimpleInstallFunction(isolate_, prototype, "anchor",
+                          Builtins::kStringPrototypeAnchor, 1, true);
+    SimpleInstallFunction(isolate_, prototype, "big",
+                          Builtins::kStringPrototypeBig, 0, true);
+    SimpleInstallFunction(isolate_, prototype, "blink",
+                          Builtins::kStringPrototypeBlink, 0, true);
+    SimpleInstallFunction(isolate_, prototype, "bold",
+                          Builtins::kStringPrototypeBold, 0, true);
+    SimpleInstallFunction(isolate_, prototype, "charAt",
+                          Builtins::kStringPrototypeCharAt, 1, true);
+    SimpleInstallFunction(isolate_, prototype, "charCodeAt",
                           Builtins::kStringPrototypeCharCodeAt, 1, true);
-    SimpleInstallFunction(prototype, "codePointAt",
+    SimpleInstallFunction(isolate_, prototype, "codePointAt",
                           Builtins::kStringPrototypeCodePointAt, 1, true);
-    SimpleInstallFunction(prototype, "concat", Builtins::kStringPrototypeConcat,
-                          1, false);
-    SimpleInstallFunction(prototype, "endsWith",
+    SimpleInstallFunction(isolate_, prototype, "concat",
+                          Builtins::kStringPrototypeConcat, 1, false);
+    SimpleInstallFunction(isolate_, prototype, "endsWith",
                           Builtins::kStringPrototypeEndsWith, 1, false);
-    SimpleInstallFunction(prototype, "fontcolor",
+    SimpleInstallFunction(isolate_, prototype, "fontcolor",
                           Builtins::kStringPrototypeFontcolor, 1, true);
-    SimpleInstallFunction(prototype, "fontsize",
+    SimpleInstallFunction(isolate_, prototype, "fontsize",
                           Builtins::kStringPrototypeFontsize, 1, true);
-    SimpleInstallFunction(prototype, "fixed", Builtins::kStringPrototypeFixed,
-                          0, true);
-    SimpleInstallFunction(prototype, "includes",
+    SimpleInstallFunction(isolate_, prototype, "fixed",
+                          Builtins::kStringPrototypeFixed, 0, true);
+    SimpleInstallFunction(isolate_, prototype, "includes",
                           Builtins::kStringPrototypeIncludes, 1, false);
-    SimpleInstallFunction(prototype, "indexOf",
+    SimpleInstallFunction(isolate_, prototype, "indexOf",
                           Builtins::kStringPrototypeIndexOf, 1, false);
-    SimpleInstallFunction(prototype, "italics",
+    SimpleInstallFunction(isolate_, prototype, "italics",
                           Builtins::kStringPrototypeItalics, 0, true);
-    SimpleInstallFunction(prototype, "lastIndexOf",
+    SimpleInstallFunction(isolate_, prototype, "lastIndexOf",
                           Builtins::kStringPrototypeLastIndexOf, 1, false);
-    SimpleInstallFunction(prototype, "link", Builtins::kStringPrototypeLink, 1,
-                          true);
-    SimpleInstallFunction(prototype, "localeCompare",
+    SimpleInstallFunction(isolate_, prototype, "link",
+                          Builtins::kStringPrototypeLink, 1, true);
+    SimpleInstallFunction(isolate_, prototype, "localeCompare",
                           Builtins::kStringPrototypeLocaleCompare, 1, true);
-    SimpleInstallFunction(prototype, "match", Builtins::kStringPrototypeMatch,
-                          1, true);
+    SimpleInstallFunction(isolate_, prototype, "match",
+                          Builtins::kStringPrototypeMatch, 1, true);
 #ifdef V8_INTL_SUPPORT
-    SimpleInstallFunction(prototype, "normalize",
+    SimpleInstallFunction(isolate_, prototype, "normalize",
                           Builtins::kStringPrototypeNormalizeIntl, 0, false);
 #else
-    SimpleInstallFunction(prototype, "normalize",
+    SimpleInstallFunction(isolate_, prototype, "normalize",
                           Builtins::kStringPrototypeNormalize, 0, false);
 #endif  // V8_INTL_SUPPORT
-    SimpleInstallFunction(prototype, "padEnd", Builtins::kStringPrototypePadEnd,
-                          1, false);
-    SimpleInstallFunction(prototype, "padStart",
+    SimpleInstallFunction(isolate_, prototype, "padEnd",
+                          Builtins::kStringPrototypePadEnd, 1, false);
+    SimpleInstallFunction(isolate_, prototype, "padStart",
                           Builtins::kStringPrototypePadStart, 1, false);
-    SimpleInstallFunction(prototype, "repeat", Builtins::kStringPrototypeRepeat,
-                          1, true);
-    SimpleInstallFunction(prototype, "replace",
+    SimpleInstallFunction(isolate_, prototype, "repeat",
+                          Builtins::kStringPrototypeRepeat, 1, true);
+    SimpleInstallFunction(isolate_, prototype, "replace",
                           Builtins::kStringPrototypeReplace, 2, true);
-    SimpleInstallFunction(prototype, "search", Builtins::kStringPrototypeSearch,
-                          1, true);
-    SimpleInstallFunction(prototype, "slice", Builtins::kStringPrototypeSlice,
-                          2, false);
-    SimpleInstallFunction(prototype, "small", Builtins::kStringPrototypeSmall,
-                          0, true);
-    SimpleInstallFunction(prototype, "split", Builtins::kStringPrototypeSplit,
-                          2, false);
-    SimpleInstallFunction(prototype, "strike", Builtins::kStringPrototypeStrike,
-                          0, true);
-    SimpleInstallFunction(prototype, "sub", Builtins::kStringPrototypeSub, 0,
-                          true);
-    SimpleInstallFunction(prototype, "substr", Builtins::kStringPrototypeSubstr,
-                          2, false);
-    SimpleInstallFunction(prototype, "substring",
+    SimpleInstallFunction(isolate_, prototype, "search",
+                          Builtins::kStringPrototypeSearch, 1, true);
+    SimpleInstallFunction(isolate_, prototype, "slice",
+                          Builtins::kStringPrototypeSlice, 2, false);
+    SimpleInstallFunction(isolate_, prototype, "small",
+                          Builtins::kStringPrototypeSmall, 0, true);
+    SimpleInstallFunction(isolate_, prototype, "split",
+                          Builtins::kStringPrototypeSplit, 2, false);
+    SimpleInstallFunction(isolate_, prototype, "strike",
+                          Builtins::kStringPrototypeStrike, 0, true);
+    SimpleInstallFunction(isolate_, prototype, "sub",
+                          Builtins::kStringPrototypeSub, 0, true);
+    SimpleInstallFunction(isolate_, prototype, "substr",
+                          Builtins::kStringPrototypeSubstr, 2, false);
+    SimpleInstallFunction(isolate_, prototype, "substring",
                           Builtins::kStringPrototypeSubstring, 2, false);
-    SimpleInstallFunction(prototype, "sup", Builtins::kStringPrototypeSup, 0,
-                          true);
-    SimpleInstallFunction(prototype, "startsWith",
+    SimpleInstallFunction(isolate_, prototype, "sup",
+                          Builtins::kStringPrototypeSup, 0, true);
+    SimpleInstallFunction(isolate_, prototype, "startsWith",
                           Builtins::kStringPrototypeStartsWith, 1, false);
-    SimpleInstallFunction(prototype, "toString",
+    SimpleInstallFunction(isolate_, prototype, "toString",
                           Builtins::kStringPrototypeToString, 0, true);
-    SimpleInstallFunction(prototype, "trim", Builtins::kStringPrototypeTrim, 0,
-                          false);
-    SimpleInstallFunction(prototype, "trimLeft",
+    SimpleInstallFunction(isolate_, prototype, "trim",
+                          Builtins::kStringPrototypeTrim, 0, false);
+    SimpleInstallFunction(isolate_, prototype, "trimLeft",
                           Builtins::kStringPrototypeTrimStart, 0, false);
-    SimpleInstallFunction(prototype, "trimRight",
+    SimpleInstallFunction(isolate_, prototype, "trimRight",
                           Builtins::kStringPrototypeTrimEnd, 0, false);
 #ifdef V8_INTL_SUPPORT
-    SimpleInstallFunction(prototype, "toLowerCase",
+    SimpleInstallFunction(isolate_, prototype, "toLowerCase",
                           Builtins::kStringPrototypeToLowerCaseIntl, 0, true);
-    SimpleInstallFunction(prototype, "toUpperCase",
+    SimpleInstallFunction(isolate_, prototype, "toUpperCase",
                           Builtins::kStringPrototypeToUpperCaseIntl, 0, false);
 #else
-    SimpleInstallFunction(prototype, "toLocaleLowerCase",
+    SimpleInstallFunction(isolate_, prototype, "toLocaleLowerCase",
                           Builtins::kStringPrototypeToLocaleLowerCase, 0,
                           false);
-    SimpleInstallFunction(prototype, "toLocaleUpperCase",
+    SimpleInstallFunction(isolate_, prototype, "toLocaleUpperCase",
                           Builtins::kStringPrototypeToLocaleUpperCase, 0,
                           false);
-    SimpleInstallFunction(prototype, "toLowerCase",
+    SimpleInstallFunction(isolate_, prototype, "toLowerCase",
                           Builtins::kStringPrototypeToLowerCase, 0, false);
-    SimpleInstallFunction(prototype, "toUpperCase",
+    SimpleInstallFunction(isolate_, prototype, "toUpperCase",
                           Builtins::kStringPrototypeToUpperCase, 0, false);
 #endif
-    SimpleInstallFunction(prototype, "valueOf",
+    SimpleInstallFunction(isolate_, prototype, "valueOf",
                           Builtins::kStringPrototypeValueOf, 0, true);
 
-    SimpleInstallFunction(prototype, factory->iterator_symbol(),
+    SimpleInstallFunction(isolate_, prototype, factory->iterator_symbol(),
                           "[Symbol.iterator]",
                           Builtins::kStringPrototypeIterator, 0, true,
                           DONT_ENUM, kStringIterator);
@@ -2043,23 +2096,23 @@ void Genesis::InitializeGlobal(Handle<JSGlobalObject> global_object,
 
   {  // --- S t r i n g I t e r a t o r ---
     Handle<JSObject> iterator_prototype(
-        native_context()->initial_iterator_prototype());
+        native_context()->initial_iterator_prototype(), isolate());
 
     Handle<JSObject> string_iterator_prototype =
-        factory->NewJSObject(isolate->object_function(), TENURED);
+        factory->NewJSObject(isolate_->object_function(), TENURED);
     JSObject::ForceSetPrototype(string_iterator_prototype, iterator_prototype);
 
     JSObject::AddProperty(
-        string_iterator_prototype, factory->to_string_tag_symbol(),
+        isolate_, string_iterator_prototype, factory->to_string_tag_symbol(),
         factory->NewStringFromAsciiChecked("String Iterator"),
         static_cast<PropertyAttributes>(DONT_ENUM | READ_ONLY));
 
-    SimpleInstallFunction(string_iterator_prototype, "next",
+    SimpleInstallFunction(isolate_, string_iterator_prototype, "next",
                           Builtins::kStringIteratorPrototypeNext, 0, true,
                           kStringIteratorNext);
 
     Handle<JSFunction> string_iterator_function = CreateFunction(
-        isolate, factory->NewStringFromAsciiChecked("StringIterator"),
+        isolate_, factory->NewStringFromAsciiChecked("StringIterator"),
         JS_STRING_ITERATOR_TYPE, JSStringIterator::kSize, 0,
         string_iterator_prototype, Builtins::kIllegal);
     string_iterator_function->shared()->set_native(false);
@@ -2069,7 +2122,7 @@ void Genesis::InitializeGlobal(Handle<JSGlobalObject> global_object,
 
   {  // --- S y m b o l ---
     Handle<JSFunction> symbol_fun = InstallFunction(
-        global, "Symbol", JS_VALUE_TYPE, JSValue::kSize, 0,
+        isolate_, global, "Symbol", JS_VALUE_TYPE, JSValue::kSize, 0,
         factory->the_hole_value(), Builtins::kSymbolConstructor);
     symbol_fun->shared()->set_builtin_function_id(kSymbolConstructor);
     symbol_fun->shared()->set_length(0);
@@ -2077,50 +2130,51 @@ void Genesis::InitializeGlobal(Handle<JSGlobalObject> global_object,
     native_context()->set_symbol_function(*symbol_fun);
 
     // Install the Symbol.for and Symbol.keyFor functions.
-    SimpleInstallFunction(symbol_fun, "for", Builtins::kSymbolFor, 1, false);
-    SimpleInstallFunction(symbol_fun, "keyFor", Builtins::kSymbolKeyFor, 1,
+    SimpleInstallFunction(isolate_, symbol_fun, "for", Builtins::kSymbolFor, 1,
                           false);
+    SimpleInstallFunction(isolate_, symbol_fun, "keyFor",
+                          Builtins::kSymbolKeyFor, 1, false);
 
     // Install well-known symbols.
-    InstallConstant(isolate, symbol_fun, "asyncIterator",
+    InstallConstant(isolate_, symbol_fun, "asyncIterator",
                     factory->async_iterator_symbol());
-    InstallConstant(isolate, symbol_fun, "hasInstance",
+    InstallConstant(isolate_, symbol_fun, "hasInstance",
                     factory->has_instance_symbol());
-    InstallConstant(isolate, symbol_fun, "isConcatSpreadable",
+    InstallConstant(isolate_, symbol_fun, "isConcatSpreadable",
                     factory->is_concat_spreadable_symbol());
-    InstallConstant(isolate, symbol_fun, "iterator",
+    InstallConstant(isolate_, symbol_fun, "iterator",
                     factory->iterator_symbol());
-    InstallConstant(isolate, symbol_fun, "match", factory->match_symbol());
-    InstallConstant(isolate, symbol_fun, "replace", factory->replace_symbol());
-    InstallConstant(isolate, symbol_fun, "search", factory->search_symbol());
-    InstallConstant(isolate, symbol_fun, "species", factory->species_symbol());
-    InstallConstant(isolate, symbol_fun, "split", factory->split_symbol());
-    InstallConstant(isolate, symbol_fun, "toPrimitive",
+    InstallConstant(isolate_, symbol_fun, "match", factory->match_symbol());
+    InstallConstant(isolate_, symbol_fun, "replace", factory->replace_symbol());
+    InstallConstant(isolate_, symbol_fun, "search", factory->search_symbol());
+    InstallConstant(isolate_, symbol_fun, "species", factory->species_symbol());
+    InstallConstant(isolate_, symbol_fun, "split", factory->split_symbol());
+    InstallConstant(isolate_, symbol_fun, "toPrimitive",
                     factory->to_primitive_symbol());
-    InstallConstant(isolate, symbol_fun, "toStringTag",
+    InstallConstant(isolate_, symbol_fun, "toStringTag",
                     factory->to_string_tag_symbol());
-    InstallConstant(isolate, symbol_fun, "unscopables",
+    InstallConstant(isolate_, symbol_fun, "unscopables",
                     factory->unscopables_symbol());
 
     // Setup %SymbolPrototype%.
-    Handle<JSObject> prototype(
-        JSObject::cast(symbol_fun->instance_prototype()));
+    Handle<JSObject> prototype(JSObject::cast(symbol_fun->instance_prototype()),
+                               isolate());
 
     // Install the @@toStringTag property on the {prototype}.
     JSObject::AddProperty(
-        prototype, factory->to_string_tag_symbol(),
+        isolate_, prototype, factory->to_string_tag_symbol(),
         factory->NewStringFromAsciiChecked("Symbol"),
         static_cast<PropertyAttributes>(DONT_ENUM | READ_ONLY));
 
     // Install the Symbol.prototype methods.
-    SimpleInstallFunction(prototype, "toString",
+    SimpleInstallFunction(isolate_, prototype, "toString",
                           Builtins::kSymbolPrototypeToString, 0, true);
-    SimpleInstallFunction(prototype, "valueOf",
+    SimpleInstallFunction(isolate_, prototype, "valueOf",
                           Builtins::kSymbolPrototypeValueOf, 0, true);
 
     // Install the @@toPrimitive function.
     Handle<JSFunction> to_primitive = InstallFunction(
-        prototype, factory->to_primitive_symbol(), JS_OBJECT_TYPE,
+        isolate_, prototype, factory->to_primitive_symbol(), JS_OBJECT_TYPE,
         JSObject::kHeaderSize, 0, MaybeHandle<JSObject>(),
         Builtins::kSymbolPrototypeToPrimitive,
         static_cast<PropertyAttributes>(DONT_ENUM | READ_ONLY));
@@ -2133,122 +2187,126 @@ void Genesis::InitializeGlobal(Handle<JSGlobalObject> global_object,
   }
 
   {  // --- D a t e ---
-    Handle<JSFunction> date_fun =
-        InstallFunction(global, "Date", JS_DATE_TYPE, JSDate::kSize, 0,
-                        factory->the_hole_value(), Builtins::kDateConstructor);
-    InstallWithIntrinsicDefaultProto(isolate, date_fun,
+    Handle<JSFunction> date_fun = InstallFunction(
+        isolate_, global, "Date", JS_DATE_TYPE, JSDate::kSize, 0,
+        factory->the_hole_value(), Builtins::kDateConstructor);
+    InstallWithIntrinsicDefaultProto(isolate_, date_fun,
                                      Context::DATE_FUNCTION_INDEX);
     date_fun->shared()->set_length(7);
     date_fun->shared()->DontAdaptArguments();
 
     // Install the Date.now, Date.parse and Date.UTC functions.
-    SimpleInstallFunction(date_fun, "now", Builtins::kDateNow, 0, false);
-    SimpleInstallFunction(date_fun, "parse", Builtins::kDateParse, 1, false);
-    SimpleInstallFunction(date_fun, "UTC", Builtins::kDateUTC, 7, false);
+    SimpleInstallFunction(isolate_, date_fun, "now", Builtins::kDateNow, 0,
+                          false);
+    SimpleInstallFunction(isolate_, date_fun, "parse", Builtins::kDateParse, 1,
+                          false);
+    SimpleInstallFunction(isolate_, date_fun, "UTC", Builtins::kDateUTC, 7,
+                          false);
 
     // Setup %DatePrototype%.
-    Handle<JSObject> prototype(JSObject::cast(date_fun->instance_prototype()));
+    Handle<JSObject> prototype(JSObject::cast(date_fun->instance_prototype()),
+                               isolate());
 
     // Install the Date.prototype methods.
-    SimpleInstallFunction(prototype, "toString",
+    SimpleInstallFunction(isolate_, prototype, "toString",
                           Builtins::kDatePrototypeToString, 0, false);
-    SimpleInstallFunction(prototype, "toDateString",
+    SimpleInstallFunction(isolate_, prototype, "toDateString",
                           Builtins::kDatePrototypeToDateString, 0, false);
-    SimpleInstallFunction(prototype, "toTimeString",
+    SimpleInstallFunction(isolate_, prototype, "toTimeString",
                           Builtins::kDatePrototypeToTimeString, 0, false);
-    SimpleInstallFunction(prototype, "toISOString",
+    SimpleInstallFunction(isolate_, prototype, "toISOString",
                           Builtins::kDatePrototypeToISOString, 0, false);
     Handle<JSFunction> to_utc_string =
-        SimpleInstallFunction(prototype, "toUTCString",
+        SimpleInstallFunction(isolate_, prototype, "toUTCString",
                               Builtins::kDatePrototypeToUTCString, 0, false);
-    InstallFunction(prototype, to_utc_string,
+    InstallFunction(isolate_, prototype, to_utc_string,
                     factory->InternalizeUtf8String("toGMTString"), DONT_ENUM);
-    SimpleInstallFunction(prototype, "getDate", Builtins::kDatePrototypeGetDate,
-                          0, true);
-    SimpleInstallFunction(prototype, "setDate", Builtins::kDatePrototypeSetDate,
-                          1, false);
-    SimpleInstallFunction(prototype, "getDay", Builtins::kDatePrototypeGetDay,
-                          0, true);
-    SimpleInstallFunction(prototype, "getFullYear",
+    SimpleInstallFunction(isolate_, prototype, "getDate",
+                          Builtins::kDatePrototypeGetDate, 0, true);
+    SimpleInstallFunction(isolate_, prototype, "setDate",
+                          Builtins::kDatePrototypeSetDate, 1, false);
+    SimpleInstallFunction(isolate_, prototype, "getDay",
+                          Builtins::kDatePrototypeGetDay, 0, true);
+    SimpleInstallFunction(isolate_, prototype, "getFullYear",
                           Builtins::kDatePrototypeGetFullYear, 0, true);
-    SimpleInstallFunction(prototype, "setFullYear",
+    SimpleInstallFunction(isolate_, prototype, "setFullYear",
                           Builtins::kDatePrototypeSetFullYear, 3, false);
-    SimpleInstallFunction(prototype, "getHours",
+    SimpleInstallFunction(isolate_, prototype, "getHours",
                           Builtins::kDatePrototypeGetHours, 0, true);
-    SimpleInstallFunction(prototype, "setHours",
+    SimpleInstallFunction(isolate_, prototype, "setHours",
                           Builtins::kDatePrototypeSetHours, 4, false);
-    SimpleInstallFunction(prototype, "getMilliseconds",
+    SimpleInstallFunction(isolate_, prototype, "getMilliseconds",
                           Builtins::kDatePrototypeGetMilliseconds, 0, true);
-    SimpleInstallFunction(prototype, "setMilliseconds",
+    SimpleInstallFunction(isolate_, prototype, "setMilliseconds",
                           Builtins::kDatePrototypeSetMilliseconds, 1, false);
-    SimpleInstallFunction(prototype, "getMinutes",
+    SimpleInstallFunction(isolate_, prototype, "getMinutes",
                           Builtins::kDatePrototypeGetMinutes, 0, true);
-    SimpleInstallFunction(prototype, "setMinutes",
+    SimpleInstallFunction(isolate_, prototype, "setMinutes",
                           Builtins::kDatePrototypeSetMinutes, 3, false);
-    SimpleInstallFunction(prototype, "getMonth",
+    SimpleInstallFunction(isolate_, prototype, "getMonth",
                           Builtins::kDatePrototypeGetMonth, 0, true);
-    SimpleInstallFunction(prototype, "setMonth",
+    SimpleInstallFunction(isolate_, prototype, "setMonth",
                           Builtins::kDatePrototypeSetMonth, 2, false);
-    SimpleInstallFunction(prototype, "getSeconds",
+    SimpleInstallFunction(isolate_, prototype, "getSeconds",
                           Builtins::kDatePrototypeGetSeconds, 0, true);
-    SimpleInstallFunction(prototype, "setSeconds",
+    SimpleInstallFunction(isolate_, prototype, "setSeconds",
                           Builtins::kDatePrototypeSetSeconds, 2, false);
-    SimpleInstallFunction(prototype, "getTime", Builtins::kDatePrototypeGetTime,
-                          0, true);
-    SimpleInstallFunction(prototype, "setTime", Builtins::kDatePrototypeSetTime,
-                          1, false);
-    SimpleInstallFunction(prototype, "getTimezoneOffset",
+    SimpleInstallFunction(isolate_, prototype, "getTime",
+                          Builtins::kDatePrototypeGetTime, 0, true);
+    SimpleInstallFunction(isolate_, prototype, "setTime",
+                          Builtins::kDatePrototypeSetTime, 1, false);
+    SimpleInstallFunction(isolate_, prototype, "getTimezoneOffset",
                           Builtins::kDatePrototypeGetTimezoneOffset, 0, true);
-    SimpleInstallFunction(prototype, "getUTCDate",
+    SimpleInstallFunction(isolate_, prototype, "getUTCDate",
                           Builtins::kDatePrototypeGetUTCDate, 0, true);
-    SimpleInstallFunction(prototype, "setUTCDate",
+    SimpleInstallFunction(isolate_, prototype, "setUTCDate",
                           Builtins::kDatePrototypeSetUTCDate, 1, false);
-    SimpleInstallFunction(prototype, "getUTCDay",
+    SimpleInstallFunction(isolate_, prototype, "getUTCDay",
                           Builtins::kDatePrototypeGetUTCDay, 0, true);
-    SimpleInstallFunction(prototype, "getUTCFullYear",
+    SimpleInstallFunction(isolate_, prototype, "getUTCFullYear",
                           Builtins::kDatePrototypeGetUTCFullYear, 0, true);
-    SimpleInstallFunction(prototype, "setUTCFullYear",
+    SimpleInstallFunction(isolate_, prototype, "setUTCFullYear",
                           Builtins::kDatePrototypeSetUTCFullYear, 3, false);
-    SimpleInstallFunction(prototype, "getUTCHours",
+    SimpleInstallFunction(isolate_, prototype, "getUTCHours",
                           Builtins::kDatePrototypeGetUTCHours, 0, true);
-    SimpleInstallFunction(prototype, "setUTCHours",
+    SimpleInstallFunction(isolate_, prototype, "setUTCHours",
                           Builtins::kDatePrototypeSetUTCHours, 4, false);
-    SimpleInstallFunction(prototype, "getUTCMilliseconds",
+    SimpleInstallFunction(isolate_, prototype, "getUTCMilliseconds",
                           Builtins::kDatePrototypeGetUTCMilliseconds, 0, true);
-    SimpleInstallFunction(prototype, "setUTCMilliseconds",
+    SimpleInstallFunction(isolate_, prototype, "setUTCMilliseconds",
                           Builtins::kDatePrototypeSetUTCMilliseconds, 1, false);
-    SimpleInstallFunction(prototype, "getUTCMinutes",
+    SimpleInstallFunction(isolate_, prototype, "getUTCMinutes",
                           Builtins::kDatePrototypeGetUTCMinutes, 0, true);
-    SimpleInstallFunction(prototype, "setUTCMinutes",
+    SimpleInstallFunction(isolate_, prototype, "setUTCMinutes",
                           Builtins::kDatePrototypeSetUTCMinutes, 3, false);
-    SimpleInstallFunction(prototype, "getUTCMonth",
+    SimpleInstallFunction(isolate_, prototype, "getUTCMonth",
                           Builtins::kDatePrototypeGetUTCMonth, 0, true);
-    SimpleInstallFunction(prototype, "setUTCMonth",
+    SimpleInstallFunction(isolate_, prototype, "setUTCMonth",
                           Builtins::kDatePrototypeSetUTCMonth, 2, false);
-    SimpleInstallFunction(prototype, "getUTCSeconds",
+    SimpleInstallFunction(isolate_, prototype, "getUTCSeconds",
                           Builtins::kDatePrototypeGetUTCSeconds, 0, true);
-    SimpleInstallFunction(prototype, "setUTCSeconds",
+    SimpleInstallFunction(isolate_, prototype, "setUTCSeconds",
                           Builtins::kDatePrototypeSetUTCSeconds, 2, false);
-    SimpleInstallFunction(prototype, "valueOf", Builtins::kDatePrototypeValueOf,
-                          0, true);
-    SimpleInstallFunction(prototype, "getYear", Builtins::kDatePrototypeGetYear,
-                          0, true);
-    SimpleInstallFunction(prototype, "setYear", Builtins::kDatePrototypeSetYear,
-                          1, false);
-    SimpleInstallFunction(prototype, "toJSON", Builtins::kDatePrototypeToJson,
-                          1, false);
+    SimpleInstallFunction(isolate_, prototype, "valueOf",
+                          Builtins::kDatePrototypeValueOf, 0, true);
+    SimpleInstallFunction(isolate_, prototype, "getYear",
+                          Builtins::kDatePrototypeGetYear, 0, true);
+    SimpleInstallFunction(isolate_, prototype, "setYear",
+                          Builtins::kDatePrototypeSetYear, 1, false);
+    SimpleInstallFunction(isolate_, prototype, "toJSON",
+                          Builtins::kDatePrototypeToJson, 1, false);
 
     // Install Intl fallback functions.
-    SimpleInstallFunction(prototype, "toLocaleString",
+    SimpleInstallFunction(isolate_, prototype, "toLocaleString",
                           Builtins::kDatePrototypeToString, 0, false);
-    SimpleInstallFunction(prototype, "toLocaleDateString",
+    SimpleInstallFunction(isolate_, prototype, "toLocaleDateString",
                           Builtins::kDatePrototypeToDateString, 0, false);
-    SimpleInstallFunction(prototype, "toLocaleTimeString",
+    SimpleInstallFunction(isolate_, prototype, "toLocaleTimeString",
                           Builtins::kDatePrototypeToTimeString, 0, false);
 
     // Install the @@toPrimitive function.
     Handle<JSFunction> to_primitive = InstallFunction(
-        prototype, factory->to_primitive_symbol(), JS_OBJECT_TYPE,
+        isolate_, prototype, factory->to_primitive_symbol(), JS_OBJECT_TYPE,
         JSObject::kHeaderSize, 0, MaybeHandle<JSObject>(),
         Builtins::kDatePrototypeToPrimitive,
         static_cast<PropertyAttributes>(DONT_ENUM | READ_ONLY));
@@ -2262,53 +2320,92 @@ void Genesis::InitializeGlobal(Handle<JSGlobalObject> global_object,
 
   {
     Handle<SharedFunctionInfo> info = SimpleCreateBuiltinSharedFunctionInfo(
-        isolate, Builtins::kPromiseGetCapabilitiesExecutor,
+        isolate_, Builtins::kPromiseGetCapabilitiesExecutor,
         factory->empty_string(), 2);
     native_context()->set_promise_get_capabilities_executor_shared_fun(*info);
   }
 
   {  // -- P r o m i s e
     Handle<JSFunction> promise_fun = InstallFunction(
-        global, "Promise", JS_PROMISE_TYPE, JSPromise::kSizeWithEmbedderFields,
-        0, factory->the_hole_value(), Builtins::kPromiseConstructor);
-    InstallWithIntrinsicDefaultProto(isolate, promise_fun,
+        isolate_, global, "Promise", JS_PROMISE_TYPE,
+        JSPromise::kSizeWithEmbedderFields, 0, factory->the_hole_value(),
+        Builtins::kPromiseConstructor);
+    InstallWithIntrinsicDefaultProto(isolate_, promise_fun,
                                      Context::PROMISE_FUNCTION_INDEX);
 
-    Handle<SharedFunctionInfo> shared(promise_fun->shared(), isolate);
+    Handle<SharedFunctionInfo> shared(promise_fun->shared(), isolate_);
     shared->set_internal_formal_parameter_count(1);
     shared->set_length(1);
 
-    InstallSpeciesGetter(promise_fun);
+    InstallSpeciesGetter(isolate_, promise_fun);
 
-    SimpleInstallFunction(promise_fun, "all", Builtins::kPromiseAll, 1, true);
+    SimpleInstallFunction(isolate_, promise_fun, "all", Builtins::kPromiseAll,
+                          1, true);
 
-    SimpleInstallFunction(promise_fun, "race", Builtins::kPromiseRace, 1, true);
+    SimpleInstallFunction(isolate_, promise_fun, "race", Builtins::kPromiseRace,
+                          1, true);
 
-    SimpleInstallFunction(promise_fun, "resolve",
+    SimpleInstallFunction(isolate_, promise_fun, "resolve",
                           Builtins::kPromiseResolveTrampoline, 1, true);
 
-    SimpleInstallFunction(promise_fun, "reject", Builtins::kPromiseReject, 1,
-                          true);
+    SimpleInstallFunction(isolate_, promise_fun, "reject",
+                          Builtins::kPromiseReject, 1, true);
 
     // Setup %PromisePrototype%.
     Handle<JSObject> prototype(
-        JSObject::cast(promise_fun->instance_prototype()));
+        JSObject::cast(promise_fun->instance_prototype()), isolate());
     native_context()->set_promise_prototype(*prototype);
 
     // Install the @@toStringTag property on the {prototype}.
     JSObject::AddProperty(
-        prototype, factory->to_string_tag_symbol(), factory->Promise_string(),
+        isolate_, prototype, factory->to_string_tag_symbol(),
+        factory->Promise_string(),
         static_cast<PropertyAttributes>(DONT_ENUM | READ_ONLY));
 
-    Handle<JSFunction> promise_then =
-        SimpleInstallFunction(prototype, isolate->factory()->then_string(),
-                              Builtins::kPromisePrototypeThen, 2, true);
+    Handle<JSFunction> promise_then = SimpleInstallFunction(
+        isolate_, prototype, isolate_->factory()->then_string(),
+        Builtins::kPromisePrototypeThen, 2, true);
     native_context()->set_promise_then(*promise_then);
 
-    Handle<JSFunction> promise_catch = SimpleInstallFunction(
-        prototype, "catch", Builtins::kPromisePrototypeCatch, 1, true);
+    Handle<JSFunction> promise_catch =
+        SimpleInstallFunction(isolate_, prototype, "catch",
+                              Builtins::kPromisePrototypeCatch, 1, true);
     native_context()->set_promise_catch(*promise_catch);
 
+    SimpleInstallFunction(isolate_, prototype, "finally",
+                          Builtins::kPromisePrototypeFinally, 1, true,
+                          DONT_ENUM);
+
+    {
+      Handle<SharedFunctionInfo> info = SimpleCreateSharedFunctionInfo(
+          isolate(), Builtins::kPromiseThenFinally,
+          isolate_->factory()->empty_string(), 1);
+      info->set_native(true);
+      native_context()->set_promise_then_finally_shared_fun(*info);
+    }
+
+    {
+      Handle<SharedFunctionInfo> info = SimpleCreateSharedFunctionInfo(
+          isolate(), Builtins::kPromiseCatchFinally,
+          isolate_->factory()->empty_string(), 1);
+      info->set_native(true);
+      native_context()->set_promise_catch_finally_shared_fun(*info);
+    }
+
+    {
+      Handle<SharedFunctionInfo> info = SimpleCreateSharedFunctionInfo(
+          isolate(), Builtins::kPromiseValueThunkFinally,
+          isolate_->factory()->empty_string(), 0);
+      native_context()->set_promise_value_thunk_finally_shared_fun(*info);
+    }
+
+    {
+      Handle<SharedFunctionInfo> info = SimpleCreateSharedFunctionInfo(
+          isolate(), Builtins::kPromiseThrowerFinally,
+          isolate_->factory()->empty_string(), 0);
+      native_context()->set_promise_thrower_finally_shared_fun(*info);
+    }
+
     // Force the Promise constructor to fast properties, so that we can use the
     // fast paths for various things like
     //
@@ -2319,33 +2416,37 @@ void Genesis::InitializeGlobal(Handle<JSGlobalObject> global_object,
     JSObject::MigrateSlowToFast(Handle<JSObject>::cast(promise_fun), 0,
                                 "Bootstrapping");
 
-    Handle<Map> prototype_map(prototype->map());
-    Map::SetShouldBeFastPrototypeMap(prototype_map, true, isolate);
+    Handle<Map> prototype_map(prototype->map(), isolate());
+    Map::SetShouldBeFastPrototypeMap(prototype_map, true, isolate_);
 
     {  // Internal: IsPromise
       Handle<JSFunction> function = SimpleCreateFunction(
-          isolate, factory->empty_string(), Builtins::kIsPromise, 1, false);
+          isolate_, factory->empty_string(), Builtins::kIsPromise, 1, false);
       native_context()->set_is_promise(*function);
     }
 
     {
       Handle<SharedFunctionInfo> info = SimpleCreateSharedFunctionInfo(
-          isolate, Builtins::kPromiseCapabilityDefaultResolve,
-          factory->empty_string(), 1);
+          isolate_, Builtins::kPromiseCapabilityDefaultResolve,
+          factory->empty_string(), 1, FunctionKind::kConciseMethod);
       info->set_native(true);
+      info->set_function_map_index(
+          Context::STRICT_FUNCTION_WITHOUT_PROTOTYPE_MAP_INDEX);
       native_context()->set_promise_capability_default_resolve_shared_fun(
           *info);
 
       info = SimpleCreateSharedFunctionInfo(
-          isolate, Builtins::kPromiseCapabilityDefaultReject,
-          factory->empty_string(), 1);
+          isolate_, Builtins::kPromiseCapabilityDefaultReject,
+          factory->empty_string(), 1, FunctionKind::kConciseMethod);
       info->set_native(true);
+      info->set_function_map_index(
+          Context::STRICT_FUNCTION_WITHOUT_PROTOTYPE_MAP_INDEX);
       native_context()->set_promise_capability_default_reject_shared_fun(*info);
     }
 
     {
       Handle<SharedFunctionInfo> info = SimpleCreateSharedFunctionInfo(
-          isolate, Builtins::kPromiseAllResolveElementClosure,
+          isolate_, Builtins::kPromiseAllResolveElementClosure,
           factory->empty_string(), 1);
       native_context()->set_promise_all_resolve_element_shared_fun(*info);
     }
@@ -2363,73 +2464,73 @@ void Genesis::InitializeGlobal(Handle<JSGlobalObject> global_object,
   {  // -- R e g E x p
     // Builtin functions for RegExp.prototype.
     Handle<JSFunction> regexp_fun = InstallFunction(
-        global, "RegExp", JS_REGEXP_TYPE,
+        isolate_, global, "RegExp", JS_REGEXP_TYPE,
         JSRegExp::kSize + JSRegExp::kInObjectFieldCount * kPointerSize,
         JSRegExp::kInObjectFieldCount, factory->the_hole_value(),
         Builtins::kRegExpConstructor);
-    InstallWithIntrinsicDefaultProto(isolate, regexp_fun,
+    InstallWithIntrinsicDefaultProto(isolate_, regexp_fun,
                                      Context::REGEXP_FUNCTION_INDEX);
 
-    Handle<SharedFunctionInfo> shared(regexp_fun->shared(), isolate);
+    Handle<SharedFunctionInfo> shared(regexp_fun->shared(), isolate_);
     shared->set_internal_formal_parameter_count(2);
     shared->set_length(2);
 
     {
       // Setup %RegExpPrototype%.
       Handle<JSObject> prototype(
-          JSObject::cast(regexp_fun->instance_prototype()));
+          JSObject::cast(regexp_fun->instance_prototype()), isolate());
 
       {
         Handle<JSFunction> fun = SimpleInstallFunction(
-            prototype, factory->exec_string(), Builtins::kRegExpPrototypeExec,
-            1, true, DONT_ENUM);
+            isolate_, prototype, factory->exec_string(),
+            Builtins::kRegExpPrototypeExec, 1, true, DONT_ENUM);
         native_context()->set_regexp_exec_function(*fun);
       }
 
-      SimpleInstallGetter(prototype, factory->dotAll_string(),
+      SimpleInstallGetter(isolate_, prototype, factory->dotAll_string(),
                           Builtins::kRegExpPrototypeDotAllGetter, true);
-      SimpleInstallGetter(prototype, factory->flags_string(),
+      SimpleInstallGetter(isolate_, prototype, factory->flags_string(),
                           Builtins::kRegExpPrototypeFlagsGetter, true);
-      SimpleInstallGetter(prototype, factory->global_string(),
+      SimpleInstallGetter(isolate_, prototype, factory->global_string(),
                           Builtins::kRegExpPrototypeGlobalGetter, true);
-      SimpleInstallGetter(prototype, factory->ignoreCase_string(),
+      SimpleInstallGetter(isolate_, prototype, factory->ignoreCase_string(),
                           Builtins::kRegExpPrototypeIgnoreCaseGetter, true);
-      SimpleInstallGetter(prototype, factory->multiline_string(),
+      SimpleInstallGetter(isolate_, prototype, factory->multiline_string(),
                           Builtins::kRegExpPrototypeMultilineGetter, true);
-      SimpleInstallGetter(prototype, factory->source_string(),
+      SimpleInstallGetter(isolate_, prototype, factory->source_string(),
                           Builtins::kRegExpPrototypeSourceGetter, true);
-      SimpleInstallGetter(prototype, factory->sticky_string(),
+      SimpleInstallGetter(isolate_, prototype, factory->sticky_string(),
                           Builtins::kRegExpPrototypeStickyGetter, true);
-      SimpleInstallGetter(prototype, factory->unicode_string(),
+      SimpleInstallGetter(isolate_, prototype, factory->unicode_string(),
                           Builtins::kRegExpPrototypeUnicodeGetter, true);
 
-      SimpleInstallFunction(prototype, "compile",
+      SimpleInstallFunction(isolate_, prototype, "compile",
                             Builtins::kRegExpPrototypeCompile, 2, true,
                             DONT_ENUM);
-      SimpleInstallFunction(prototype, factory->toString_string(),
+      SimpleInstallFunction(isolate_, prototype, factory->toString_string(),
                             Builtins::kRegExpPrototypeToString, 0, false,
                             DONT_ENUM);
-      SimpleInstallFunction(prototype, "test", Builtins::kRegExpPrototypeTest,
-                            1, true, DONT_ENUM);
+      SimpleInstallFunction(isolate_, prototype, "test",
+                            Builtins::kRegExpPrototypeTest, 1, true, DONT_ENUM);
 
-      SimpleInstallFunction(prototype, factory->match_symbol(),
+      SimpleInstallFunction(isolate_, prototype, factory->match_symbol(),
                             "[Symbol.match]", Builtins::kRegExpPrototypeMatch,
                             1, true);
 
-      SimpleInstallFunction(prototype, factory->replace_symbol(),
+      SimpleInstallFunction(isolate_, prototype, factory->replace_symbol(),
                             "[Symbol.replace]",
                             Builtins::kRegExpPrototypeReplace, 2, false);
 
-      SimpleInstallFunction(prototype, factory->search_symbol(),
+      SimpleInstallFunction(isolate_, prototype, factory->search_symbol(),
                             "[Symbol.search]", Builtins::kRegExpPrototypeSearch,
                             1, true);
 
-      SimpleInstallFunction(prototype, factory->split_symbol(),
+      SimpleInstallFunction(isolate_, prototype, factory->split_symbol(),
                             "[Symbol.split]", Builtins::kRegExpPrototypeSplit,
                             2, false);
 
-      Handle<Map> prototype_map(prototype->map());
-      Map::SetShouldBeFastPrototypeMap(prototype_map, true, isolate);
+      Handle<Map> prototype_map(prototype->map(), isolate());
+      Map::SetShouldBeFastPrototypeMap(prototype_map, true, isolate_);
 
       // Store the initial RegExp.prototype map. This is used in fast-path
       // checks. Do not alter the prototype after this point.
@@ -2439,53 +2540,53 @@ void Genesis::InitializeGlobal(Handle<JSGlobalObject> global_object,
     {
       // RegExp getters and setters.
 
-      InstallSpeciesGetter(regexp_fun);
+      InstallSpeciesGetter(isolate_, regexp_fun);
 
       // Static properties set by a successful match.
 
       const PropertyAttributes no_enum = DONT_ENUM;
-      SimpleInstallGetterSetter(regexp_fun, factory->input_string(),
+      SimpleInstallGetterSetter(isolate_, regexp_fun, factory->input_string(),
                                 Builtins::kRegExpInputGetter,
                                 Builtins::kRegExpInputSetter, no_enum);
       SimpleInstallGetterSetter(
-          regexp_fun, factory->InternalizeUtf8String("$_"),
+          isolate_, regexp_fun, factory->InternalizeUtf8String("$_"),
           Builtins::kRegExpInputGetter, Builtins::kRegExpInputSetter, no_enum);
 
       SimpleInstallGetterSetter(
-          regexp_fun, factory->InternalizeUtf8String("lastMatch"),
+          isolate_, regexp_fun, factory->InternalizeUtf8String("lastMatch"),
           Builtins::kRegExpLastMatchGetter, Builtins::kEmptyFunction, no_enum);
       SimpleInstallGetterSetter(
-          regexp_fun, factory->InternalizeUtf8String("$&"),
+          isolate_, regexp_fun, factory->InternalizeUtf8String("$&"),
           Builtins::kRegExpLastMatchGetter, Builtins::kEmptyFunction, no_enum);
 
       SimpleInstallGetterSetter(
-          regexp_fun, factory->InternalizeUtf8String("lastParen"),
+          isolate_, regexp_fun, factory->InternalizeUtf8String("lastParen"),
           Builtins::kRegExpLastParenGetter, Builtins::kEmptyFunction, no_enum);
       SimpleInstallGetterSetter(
-          regexp_fun, factory->InternalizeUtf8String("$+"),
+          isolate_, regexp_fun, factory->InternalizeUtf8String("$+"),
           Builtins::kRegExpLastParenGetter, Builtins::kEmptyFunction, no_enum);
 
-      SimpleInstallGetterSetter(regexp_fun,
+      SimpleInstallGetterSetter(isolate_, regexp_fun,
                                 factory->InternalizeUtf8String("leftContext"),
                                 Builtins::kRegExpLeftContextGetter,
                                 Builtins::kEmptyFunction, no_enum);
-      SimpleInstallGetterSetter(regexp_fun,
+      SimpleInstallGetterSetter(isolate_, regexp_fun,
                                 factory->InternalizeUtf8String("$`"),
                                 Builtins::kRegExpLeftContextGetter,
                                 Builtins::kEmptyFunction, no_enum);
 
-      SimpleInstallGetterSetter(regexp_fun,
+      SimpleInstallGetterSetter(isolate_, regexp_fun,
                                 factory->InternalizeUtf8String("rightContext"),
                                 Builtins::kRegExpRightContextGetter,
                                 Builtins::kEmptyFunction, no_enum);
-      SimpleInstallGetterSetter(regexp_fun,
+      SimpleInstallGetterSetter(isolate_, regexp_fun,
                                 factory->InternalizeUtf8String("$'"),
                                 Builtins::kRegExpRightContextGetter,
                                 Builtins::kEmptyFunction, no_enum);
 
-#define INSTALL_CAPTURE_GETTER(i)                         \
-  SimpleInstallGetterSetter(                              \
-      regexp_fun, factory->InternalizeUtf8String("$" #i), \
+#define INSTALL_CAPTURE_GETTER(i)                                   \
+  SimpleInstallGetterSetter(                                        \
+      isolate_, regexp_fun, factory->InternalizeUtf8String("$" #i), \
       Builtins::kRegExpCapture##i##Getter, Builtins::kEmptyFunction, no_enum)
       INSTALL_CAPTURE_GETTER(1);
       INSTALL_CAPTURE_GETTER(2);
@@ -2500,11 +2601,11 @@ void Genesis::InitializeGlobal(Handle<JSGlobalObject> global_object,
     }
 
     DCHECK(regexp_fun->has_initial_map());
-    Handle<Map> initial_map(regexp_fun->initial_map());
+    Handle<Map> initial_map(regexp_fun->initial_map(), isolate());
 
     DCHECK_EQ(1, initial_map->GetInObjectProperties());
 
-    Map::EnsureDescriptorSlack(initial_map, 1);
+    Map::EnsureDescriptorSlack(isolate_, initial_map, 1);
 
     // ECMA-262, section 15.10.7.5.
     PropertyAttributes writable =
@@ -2516,7 +2617,7 @@ void Genesis::InitializeGlobal(Handle<JSGlobalObject> global_object,
 
     {  // Internal: RegExpInternalMatch
       Handle<JSFunction> function =
-          SimpleCreateFunction(isolate, isolate->factory()->empty_string(),
+          SimpleCreateFunction(isolate_, isolate_->factory()->empty_string(),
                                Builtins::kRegExpInternalMatch, 2, true);
       native_context()->set(Context::REGEXP_INTERNAL_MATCH, *function);
     }
@@ -2539,60 +2640,60 @@ void Genesis::InitializeGlobal(Handle<JSGlobalObject> global_object,
   }
 
   {  // -- E r r o r
-    InstallError(isolate, global, factory->Error_string(),
+    InstallError(isolate_, global, factory->Error_string(),
                  Context::ERROR_FUNCTION_INDEX);
-    InstallMakeError(isolate, Builtins::kMakeError, Context::MAKE_ERROR_INDEX);
+    InstallMakeError(isolate_, Builtins::kMakeError, Context::MAKE_ERROR_INDEX);
   }
 
   {  // -- E v a l E r r o r
-    InstallError(isolate, global, factory->EvalError_string(),
+    InstallError(isolate_, global, factory->EvalError_string(),
                  Context::EVAL_ERROR_FUNCTION_INDEX);
   }
 
   {  // -- R a n g e E r r o r
-    InstallError(isolate, global, factory->RangeError_string(),
+    InstallError(isolate_, global, factory->RangeError_string(),
                  Context::RANGE_ERROR_FUNCTION_INDEX);
-    InstallMakeError(isolate, Builtins::kMakeRangeError,
+    InstallMakeError(isolate_, Builtins::kMakeRangeError,
                      Context::MAKE_RANGE_ERROR_INDEX);
   }
 
   {  // -- R e f e r e n c e E r r o r
-    InstallError(isolate, global, factory->ReferenceError_string(),
+    InstallError(isolate_, global, factory->ReferenceError_string(),
                  Context::REFERENCE_ERROR_FUNCTION_INDEX);
   }
 
   {  // -- S y n t a x E r r o r
-    InstallError(isolate, global, factory->SyntaxError_string(),
+    InstallError(isolate_, global, factory->SyntaxError_string(),
                  Context::SYNTAX_ERROR_FUNCTION_INDEX);
-    InstallMakeError(isolate, Builtins::kMakeSyntaxError,
+    InstallMakeError(isolate_, Builtins::kMakeSyntaxError,
                      Context::MAKE_SYNTAX_ERROR_INDEX);
   }
 
   {  // -- T y p e E r r o r
-    InstallError(isolate, global, factory->TypeError_string(),
+    InstallError(isolate_, global, factory->TypeError_string(),
                  Context::TYPE_ERROR_FUNCTION_INDEX);
-    InstallMakeError(isolate, Builtins::kMakeTypeError,
+    InstallMakeError(isolate_, Builtins::kMakeTypeError,
                      Context::MAKE_TYPE_ERROR_INDEX);
   }
 
   {  // -- U R I E r r o r
-    InstallError(isolate, global, factory->URIError_string(),
+    InstallError(isolate_, global, factory->URIError_string(),
                  Context::URI_ERROR_FUNCTION_INDEX);
-    InstallMakeError(isolate, Builtins::kMakeURIError,
+    InstallMakeError(isolate_, Builtins::kMakeURIError,
                      Context::MAKE_URI_ERROR_INDEX);
   }
 
   {  // -- C o m p i l e E r r o r
-    Handle<JSObject> dummy = factory->NewJSObject(isolate->object_function());
-    InstallError(isolate, dummy, factory->CompileError_string(),
+    Handle<JSObject> dummy = factory->NewJSObject(isolate_->object_function());
+    InstallError(isolate_, dummy, factory->CompileError_string(),
                  Context::WASM_COMPILE_ERROR_FUNCTION_INDEX);
 
     // -- L i n k E r r o r
-    InstallError(isolate, dummy, factory->LinkError_string(),
+    InstallError(isolate_, dummy, factory->LinkError_string(),
                  Context::WASM_LINK_ERROR_FUNCTION_INDEX);
 
     // -- R u n t i m e E r r o r
-    InstallError(isolate, dummy, factory->RuntimeError_string(),
+    InstallError(isolate_, dummy, factory->RuntimeError_string(),
                  Context::WASM_RUNTIME_ERROR_FUNCTION_INDEX);
   }
 
@@ -2602,13 +2703,14 @@ void Genesis::InitializeGlobal(Handle<JSGlobalObject> global_object,
   {  // -- J S O N
     Handle<String> name = factory->InternalizeUtf8String("JSON");
     Handle<JSObject> json_object =
-        factory->NewJSObject(isolate->object_function(), TENURED);
-    JSObject::AddProperty(global, name, json_object, DONT_ENUM);
-    SimpleInstallFunction(json_object, "parse", Builtins::kJsonParse, 2, false);
-    SimpleInstallFunction(json_object, "stringify", Builtins::kJsonStringify, 3,
-                          true);
+        factory->NewJSObject(isolate_->object_function(), TENURED);
+    JSObject::AddProperty(isolate_, global, name, json_object, DONT_ENUM);
+    SimpleInstallFunction(isolate_, json_object, "parse", Builtins::kJsonParse,
+                          2, false);
+    SimpleInstallFunction(isolate_, json_object, "stringify",
+                          Builtins::kJsonStringify, 3, true);
     JSObject::AddProperty(
-        json_object, factory->to_string_tag_symbol(),
+        isolate_, json_object, factory->to_string_tag_symbol(),
         factory->NewStringFromAsciiChecked("JSON"),
         static_cast<PropertyAttributes>(DONT_ENUM | READ_ONLY));
   }
@@ -2616,66 +2718,80 @@ void Genesis::InitializeGlobal(Handle<JSGlobalObject> global_object,
   {  // -- M a t h
     Handle<String> name = factory->InternalizeUtf8String("Math");
     Handle<JSObject> math =
-        factory->NewJSObject(isolate->object_function(), TENURED);
-    JSObject::AddProperty(global, name, math, DONT_ENUM);
-    SimpleInstallFunction(math, "abs", Builtins::kMathAbs, 1, true);
-    SimpleInstallFunction(math, "acos", Builtins::kMathAcos, 1, true);
-    SimpleInstallFunction(math, "acosh", Builtins::kMathAcosh, 1, true);
-    SimpleInstallFunction(math, "asin", Builtins::kMathAsin, 1, true);
-    SimpleInstallFunction(math, "asinh", Builtins::kMathAsinh, 1, true);
-    SimpleInstallFunction(math, "atan", Builtins::kMathAtan, 1, true);
-    SimpleInstallFunction(math, "atanh", Builtins::kMathAtanh, 1, true);
-    SimpleInstallFunction(math, "atan2", Builtins::kMathAtan2, 2, true);
-    SimpleInstallFunction(math, "ceil", Builtins::kMathCeil, 1, true);
-    SimpleInstallFunction(math, "cbrt", Builtins::kMathCbrt, 1, true);
-    SimpleInstallFunction(math, "expm1", Builtins::kMathExpm1, 1, true);
-    SimpleInstallFunction(math, "clz32", Builtins::kMathClz32, 1, true);
-    SimpleInstallFunction(math, "cos", Builtins::kMathCos, 1, true);
-    SimpleInstallFunction(math, "cosh", Builtins::kMathCosh, 1, true);
-    SimpleInstallFunction(math, "exp", Builtins::kMathExp, 1, true);
-    Handle<JSFunction> math_floor =
-        SimpleInstallFunction(math, "floor", Builtins::kMathFloor, 1, true);
+        factory->NewJSObject(isolate_->object_function(), TENURED);
+    JSObject::AddProperty(isolate_, global, name, math, DONT_ENUM);
+    SimpleInstallFunction(isolate_, math, "abs", Builtins::kMathAbs, 1, true);
+    SimpleInstallFunction(isolate_, math, "acos", Builtins::kMathAcos, 1, true);
+    SimpleInstallFunction(isolate_, math, "acosh", Builtins::kMathAcosh, 1,
+                          true);
+    SimpleInstallFunction(isolate_, math, "asin", Builtins::kMathAsin, 1, true);
+    SimpleInstallFunction(isolate_, math, "asinh", Builtins::kMathAsinh, 1,
+                          true);
+    SimpleInstallFunction(isolate_, math, "atan", Builtins::kMathAtan, 1, true);
+    SimpleInstallFunction(isolate_, math, "atanh", Builtins::kMathAtanh, 1,
+                          true);
+    SimpleInstallFunction(isolate_, math, "atan2", Builtins::kMathAtan2, 2,
+                          true);
+    SimpleInstallFunction(isolate_, math, "ceil", Builtins::kMathCeil, 1, true);
+    SimpleInstallFunction(isolate_, math, "cbrt", Builtins::kMathCbrt, 1, true);
+    SimpleInstallFunction(isolate_, math, "expm1", Builtins::kMathExpm1, 1,
+                          true);
+    SimpleInstallFunction(isolate_, math, "clz32", Builtins::kMathClz32, 1,
+                          true);
+    SimpleInstallFunction(isolate_, math, "cos", Builtins::kMathCos, 1, true);
+    SimpleInstallFunction(isolate_, math, "cosh", Builtins::kMathCosh, 1, true);
+    SimpleInstallFunction(isolate_, math, "exp", Builtins::kMathExp, 1, true);
+    Handle<JSFunction> math_floor = SimpleInstallFunction(
+        isolate_, math, "floor", Builtins::kMathFloor, 1, true);
     native_context()->set_math_floor(*math_floor);
-    SimpleInstallFunction(math, "fround", Builtins::kMathFround, 1, true);
-    SimpleInstallFunction(math, "hypot", Builtins::kMathHypot, 2, false);
-    SimpleInstallFunction(math, "imul", Builtins::kMathImul, 2, true);
-    SimpleInstallFunction(math, "log", Builtins::kMathLog, 1, true);
-    SimpleInstallFunction(math, "log1p", Builtins::kMathLog1p, 1, true);
-    SimpleInstallFunction(math, "log2", Builtins::kMathLog2, 1, true);
-    SimpleInstallFunction(math, "log10", Builtins::kMathLog10, 1, true);
-    SimpleInstallFunction(math, "max", Builtins::kMathMax, 2, false);
-    SimpleInstallFunction(math, "min", Builtins::kMathMin, 2, false);
-    Handle<JSFunction> math_pow =
-        SimpleInstallFunction(math, "pow", Builtins::kMathPow, 2, true);
+    SimpleInstallFunction(isolate_, math, "fround", Builtins::kMathFround, 1,
+                          true);
+    SimpleInstallFunction(isolate_, math, "hypot", Builtins::kMathHypot, 2,
+                          false);
+    SimpleInstallFunction(isolate_, math, "imul", Builtins::kMathImul, 2, true);
+    SimpleInstallFunction(isolate_, math, "log", Builtins::kMathLog, 1, true);
+    SimpleInstallFunction(isolate_, math, "log1p", Builtins::kMathLog1p, 1,
+                          true);
+    SimpleInstallFunction(isolate_, math, "log2", Builtins::kMathLog2, 1, true);
+    SimpleInstallFunction(isolate_, math, "log10", Builtins::kMathLog10, 1,
+                          true);
+    SimpleInstallFunction(isolate_, math, "max", Builtins::kMathMax, 2, false);
+    SimpleInstallFunction(isolate_, math, "min", Builtins::kMathMin, 2, false);
+    Handle<JSFunction> math_pow = SimpleInstallFunction(
+        isolate_, math, "pow", Builtins::kMathPow, 2, true);
     native_context()->set_math_pow(*math_pow);
-    SimpleInstallFunction(math, "random", Builtins::kMathRandom, 0, true);
-    SimpleInstallFunction(math, "round", Builtins::kMathRound, 1, true);
-    SimpleInstallFunction(math, "sign", Builtins::kMathSign, 1, true);
-    SimpleInstallFunction(math, "sin", Builtins::kMathSin, 1, true);
-    SimpleInstallFunction(math, "sinh", Builtins::kMathSinh, 1, true);
-    SimpleInstallFunction(math, "sqrt", Builtins::kMathSqrt, 1, true);
-    SimpleInstallFunction(math, "tan", Builtins::kMathTan, 1, true);
-    SimpleInstallFunction(math, "tanh", Builtins::kMathTanh, 1, true);
-    SimpleInstallFunction(math, "trunc", Builtins::kMathTrunc, 1, true);
+    SimpleInstallFunction(isolate_, math, "random", Builtins::kMathRandom, 0,
+                          true);
+    SimpleInstallFunction(isolate_, math, "round", Builtins::kMathRound, 1,
+                          true);
+    SimpleInstallFunction(isolate_, math, "sign", Builtins::kMathSign, 1, true);
+    SimpleInstallFunction(isolate_, math, "sin", Builtins::kMathSin, 1, true);
+    SimpleInstallFunction(isolate_, math, "sinh", Builtins::kMathSinh, 1, true);
+    SimpleInstallFunction(isolate_, math, "sqrt", Builtins::kMathSqrt, 1, true);
+    SimpleInstallFunction(isolate_, math, "tan", Builtins::kMathTan, 1, true);
+    SimpleInstallFunction(isolate_, math, "tanh", Builtins::kMathTanh, 1, true);
+    SimpleInstallFunction(isolate_, math, "trunc", Builtins::kMathTrunc, 1,
+                          true);
 
     // Install math constants.
     double const kE = base::ieee754::exp(1.0);
     double const kPI = 3.1415926535897932;
-    InstallConstant(isolate, math, "E", factory->NewNumber(kE));
-    InstallConstant(isolate, math, "LN10",
+    InstallConstant(isolate_, math, "E", factory->NewNumber(kE));
+    InstallConstant(isolate_, math, "LN10",
                     factory->NewNumber(base::ieee754::log(10.0)));
-    InstallConstant(isolate, math, "LN2",
+    InstallConstant(isolate_, math, "LN2",
                     factory->NewNumber(base::ieee754::log(2.0)));
-    InstallConstant(isolate, math, "LOG10E",
+    InstallConstant(isolate_, math, "LOG10E",
                     factory->NewNumber(base::ieee754::log10(kE)));
-    InstallConstant(isolate, math, "LOG2E",
+    InstallConstant(isolate_, math, "LOG2E",
                     factory->NewNumber(base::ieee754::log2(kE)));
-    InstallConstant(isolate, math, "PI", factory->NewNumber(kPI));
-    InstallConstant(isolate, math, "SQRT1_2",
+    InstallConstant(isolate_, math, "PI", factory->NewNumber(kPI));
+    InstallConstant(isolate_, math, "SQRT1_2",
                     factory->NewNumber(std::sqrt(0.5)));
-    InstallConstant(isolate, math, "SQRT2", factory->NewNumber(std::sqrt(2.0)));
+    InstallConstant(isolate_, math, "SQRT2",
+                    factory->NewNumber(std::sqrt(2.0)));
     JSObject::AddProperty(
-        math, factory->to_string_tag_symbol(),
+        isolate_, math, factory->to_string_tag_symbol(),
         factory->NewStringFromAsciiChecked("Math"),
         static_cast<PropertyAttributes>(DONT_ENUM | READ_ONLY));
   }
@@ -2683,65 +2799,61 @@ void Genesis::InitializeGlobal(Handle<JSGlobalObject> global_object,
   {  // -- C o n s o l e
     Handle<String> name = factory->InternalizeUtf8String("console");
     NewFunctionArgs args = NewFunctionArgs::ForFunctionWithoutCode(
-        name, isolate->strict_function_map(), LanguageMode::kStrict);
+        name, isolate_->strict_function_map(), LanguageMode::kStrict);
     Handle<JSFunction> cons = factory->NewFunction(args);
 
-    Handle<JSObject> empty = factory->NewJSObject(isolate->object_function());
+    Handle<JSObject> empty = factory->NewJSObject(isolate_->object_function());
     JSFunction::SetPrototype(cons, empty);
 
     Handle<JSObject> console = factory->NewJSObject(cons, TENURED);
     DCHECK(console->IsJSObject());
-    JSObject::AddProperty(global, name, console, DONT_ENUM);
-    SimpleInstallFunction(console, "debug", Builtins::kConsoleDebug, 1, false,
-                          NONE);
-    SimpleInstallFunction(console, "error", Builtins::kConsoleError, 1, false,
-                          NONE);
-    SimpleInstallFunction(console, "info", Builtins::kConsoleInfo, 1, false,
-                          NONE);
-    SimpleInstallFunction(console, "log", Builtins::kConsoleLog, 1, false,
-                          NONE);
-    SimpleInstallFunction(console, "warn", Builtins::kConsoleWarn, 1, false,
-                          NONE);
-    SimpleInstallFunction(console, "dir", Builtins::kConsoleDir, 1, false,
-                          NONE);
-    SimpleInstallFunction(console, "dirxml", Builtins::kConsoleDirXml, 1, false,
-                          NONE);
-    SimpleInstallFunction(console, "table", Builtins::kConsoleTable, 1, false,
-                          NONE);
-    SimpleInstallFunction(console, "trace", Builtins::kConsoleTrace, 1, false,
-                          NONE);
-    SimpleInstallFunction(console, "group", Builtins::kConsoleGroup, 1, false,
-                          NONE);
-    SimpleInstallFunction(console, "groupCollapsed",
-                          Builtins::kConsoleGroupCollapsed, 1, false, NONE);
-    SimpleInstallFunction(console, "groupEnd", Builtins::kConsoleGroupEnd, 1,
+    JSObject::AddProperty(isolate_, global, name, console, DONT_ENUM);
+    SimpleInstallFunction(isolate_, console, "debug", Builtins::kConsoleDebug,
+                          1, false, NONE);
+    SimpleInstallFunction(isolate_, console, "error", Builtins::kConsoleError,
+                          1, false, NONE);
+    SimpleInstallFunction(isolate_, console, "info", Builtins::kConsoleInfo, 1,
                           false, NONE);
-    SimpleInstallFunction(console, "clear", Builtins::kConsoleClear, 1, false,
-                          NONE);
-    SimpleInstallFunction(console, "count", Builtins::kConsoleCount, 1, false,
-                          NONE);
-    SimpleInstallFunction(console, "assert", Builtins::kFastConsoleAssert, 1,
+    SimpleInstallFunction(isolate_, console, "log", Builtins::kConsoleLog, 1,
                           false, NONE);
-    SimpleInstallFunction(console, "markTimeline",
-                          Builtins::kConsoleMarkTimeline, 1, false, NONE);
-    SimpleInstallFunction(console, "profile", Builtins::kConsoleProfile, 1,
+    SimpleInstallFunction(isolate_, console, "warn", Builtins::kConsoleWarn, 1,
                           false, NONE);
-    SimpleInstallFunction(console, "profileEnd", Builtins::kConsoleProfileEnd,
-                          1, false, NONE);
-    SimpleInstallFunction(console, "timeline", Builtins::kConsoleTimeline, 1,
+    SimpleInstallFunction(isolate_, console, "dir", Builtins::kConsoleDir, 1,
                           false, NONE);
-    SimpleInstallFunction(console, "timelineEnd", Builtins::kConsoleTimelineEnd,
+    SimpleInstallFunction(isolate_, console, "dirxml", Builtins::kConsoleDirXml,
                           1, false, NONE);
-    SimpleInstallFunction(console, "time", Builtins::kConsoleTime, 1, false,
-                          NONE);
-    SimpleInstallFunction(console, "timeEnd", Builtins::kConsoleTimeEnd, 1,
-                          false, NONE);
-    SimpleInstallFunction(console, "timeStamp", Builtins::kConsoleTimeStamp, 1,
+    SimpleInstallFunction(isolate_, console, "table", Builtins::kConsoleTable,
+                          1, false, NONE);
+    SimpleInstallFunction(isolate_, console, "trace", Builtins::kConsoleTrace,
+                          1, false, NONE);
+    SimpleInstallFunction(isolate_, console, "group", Builtins::kConsoleGroup,
+                          1, false, NONE);
+    SimpleInstallFunction(isolate_, console, "groupCollapsed",
+                          Builtins::kConsoleGroupCollapsed, 1, false, NONE);
+    SimpleInstallFunction(isolate_, console, "groupEnd",
+                          Builtins::kConsoleGroupEnd, 1, false, NONE);
+    SimpleInstallFunction(isolate_, console, "clear", Builtins::kConsoleClear,
+                          1, false, NONE);
+    SimpleInstallFunction(isolate_, console, "count", Builtins::kConsoleCount,
+                          1, false, NONE);
+    SimpleInstallFunction(isolate_, console, "countReset",
+                          Builtins::kConsoleCountReset, 1, false, NONE);
+    SimpleInstallFunction(isolate_, console, "assert",
+                          Builtins::kFastConsoleAssert, 1, false, NONE);
+    SimpleInstallFunction(isolate_, console, "profile",
+                          Builtins::kConsoleProfile, 1, false, NONE);
+    SimpleInstallFunction(isolate_, console, "profileEnd",
+                          Builtins::kConsoleProfileEnd, 1, false, NONE);
+    SimpleInstallFunction(isolate_, console, "time", Builtins::kConsoleTime, 1,
                           false, NONE);
-    SimpleInstallFunction(console, "context", Builtins::kConsoleContext, 1,
-                          true, NONE);
+    SimpleInstallFunction(isolate_, console, "timeEnd",
+                          Builtins::kConsoleTimeEnd, 1, false, NONE);
+    SimpleInstallFunction(isolate_, console, "timeStamp",
+                          Builtins::kConsoleTimeStamp, 1, false, NONE);
+    SimpleInstallFunction(isolate_, console, "context",
+                          Builtins::kConsoleContext, 1, true, NONE);
     JSObject::AddProperty(
-        console, factory->to_string_tag_symbol(),
+        isolate_, console, factory->to_string_tag_symbol(),
         factory->NewStringFromAsciiChecked("Object"),
         static_cast<PropertyAttributes>(DONT_ENUM | READ_ONLY));
   }
@@ -2750,69 +2862,110 @@ void Genesis::InitializeGlobal(Handle<JSGlobalObject> global_object,
   {  // -- I n t l
     Handle<String> name = factory->InternalizeUtf8String("Intl");
     Handle<JSObject> intl =
-        factory->NewJSObject(isolate->object_function(), TENURED);
-    JSObject::AddProperty(global, name, intl, DONT_ENUM);
+        factory->NewJSObject(isolate_->object_function(), TENURED);
+    JSObject::AddProperty(isolate_, global, name, intl, DONT_ENUM);
 
     {
       Handle<JSFunction> date_time_format_constructor = InstallFunction(
-          intl, "DateTimeFormat", JS_OBJECT_TYPE, DateFormat::kSize, 0,
-          factory->the_hole_value(), Builtins::kIllegal);
+          isolate_, intl, "DateTimeFormat", JS_OBJECT_TYPE, DateFormat::kSize,
+          0, factory->the_hole_value(), Builtins::kIllegal);
       native_context()->set_intl_date_time_format_function(
           *date_time_format_constructor);
 
       Handle<JSObject> prototype(
-          JSObject::cast(date_time_format_constructor->prototype()), isolate);
+          JSObject::cast(date_time_format_constructor->prototype()), isolate_);
 
       // Install the @@toStringTag property on the {prototype}.
       JSObject::AddProperty(
-          prototype, factory->to_string_tag_symbol(), factory->Object_string(),
+          isolate_, prototype, factory->to_string_tag_symbol(),
+          factory->Object_string(),
           static_cast<PropertyAttributes>(DONT_ENUM | READ_ONLY));
+
+      SimpleInstallFunction(isolate_, prototype, "formatToParts",
+                            Builtins::kDateTimeFormatPrototypeFormatToParts, 1,
+                            false);
     }
 
     {
       Handle<JSFunction> number_format_constructor = InstallFunction(
-          intl, "NumberFormat", JS_OBJECT_TYPE, NumberFormat::kSize, 0,
-          factory->the_hole_value(), Builtins::kIllegal);
+          isolate_, intl, "NumberFormat", JS_OBJECT_TYPE, NumberFormat::kSize,
+          0, factory->the_hole_value(), Builtins::kIllegal);
       native_context()->set_intl_number_format_function(
           *number_format_constructor);
 
       Handle<JSObject> prototype(
-          JSObject::cast(number_format_constructor->prototype()), isolate);
+          JSObject::cast(number_format_constructor->prototype()), isolate_);
 
       // Install the @@toStringTag property on the {prototype}.
       JSObject::AddProperty(
-          prototype, factory->to_string_tag_symbol(), factory->Object_string(),
+          isolate_, prototype, factory->to_string_tag_symbol(),
+          factory->Object_string(),
           static_cast<PropertyAttributes>(DONT_ENUM | READ_ONLY));
+
+      SimpleInstallFunction(isolate_, prototype, "formatToParts",
+                            Builtins::kNumberFormatPrototypeFormatToParts, 1,
+                            false);
+      SimpleInstallGetter(isolate_, prototype,
+                          factory->InternalizeUtf8String("format"),
+                          Builtins::kNumberFormatPrototypeFormatNumber, false);
+
+      {
+        Handle<SharedFunctionInfo> info = SimpleCreateBuiltinSharedFunctionInfo(
+            isolate_, Builtins::kNumberFormatInternalFormatNumber,
+            factory->empty_string(), 1);
+        native_context()->set_number_format_internal_format_number_shared_fun(
+            *info);
+      }
     }
 
     {
-      Handle<JSFunction> collator_constructor =
-          InstallFunction(intl, "Collator", JS_OBJECT_TYPE, Collator::kSize, 0,
-                          factory->the_hole_value(), Builtins::kIllegal);
+      Handle<JSFunction> collator_constructor = InstallFunction(
+          isolate_, intl, "Collator", JS_OBJECT_TYPE, Collator::kSize, 0,
+          factory->the_hole_value(), Builtins::kIllegal);
       native_context()->set_intl_collator_function(*collator_constructor);
 
       Handle<JSObject> prototype(
-          JSObject::cast(collator_constructor->prototype()), isolate);
+          JSObject::cast(collator_constructor->prototype()), isolate_);
 
       // Install the @@toStringTag property on the {prototype}.
       JSObject::AddProperty(
-          prototype, factory->to_string_tag_symbol(), factory->Object_string(),
+          isolate_, prototype, factory->to_string_tag_symbol(),
+          factory->Object_string(),
           static_cast<PropertyAttributes>(DONT_ENUM | READ_ONLY));
     }
 
     {
-      Handle<JSFunction> v8_break_iterator_constructor = InstallFunction(
-          intl, "v8BreakIterator", JS_OBJECT_TYPE, V8BreakIterator::kSize, 0,
-          factory->the_hole_value(), Builtins::kIllegal);
+      Handle<JSFunction> v8_break_iterator_constructor =
+          InstallFunction(isolate_, intl, "v8BreakIterator", JS_OBJECT_TYPE,
+                          V8BreakIterator::kSize, 0, factory->the_hole_value(),
+                          Builtins::kIllegal);
       native_context()->set_intl_v8_break_iterator_function(
           *v8_break_iterator_constructor);
 
       Handle<JSObject> prototype(
-          JSObject::cast(v8_break_iterator_constructor->prototype()), isolate);
+          JSObject::cast(v8_break_iterator_constructor->prototype()), isolate_);
+
+      // Install the @@toStringTag property on the {prototype}.
+      JSObject::AddProperty(
+          isolate_, prototype, factory->to_string_tag_symbol(),
+          factory->Object_string(),
+          static_cast<PropertyAttributes>(DONT_ENUM | READ_ONLY));
+    }
+
+    {
+      Handle<JSFunction> plural_rules_constructor = InstallFunction(
+          isolate_, intl, "PluralRules", JS_OBJECT_TYPE, PluralRules::kSize, 0,
+          factory->the_hole_value(), Builtins::kIllegal);
+      native_context()->set_intl_plural_rules_function(
+          *plural_rules_constructor);
+
+      Handle<JSObject> prototype(
+          JSObject::cast(plural_rules_constructor->prototype()), isolate_);
 
       // Install the @@toStringTag property on the {prototype}.
       JSObject::AddProperty(
-          prototype, factory->to_string_tag_symbol(), factory->Object_string(),
+          isolate_, prototype, factory->to_string_tag_symbol(),
+          factory->Object_string(),
           static_cast<PropertyAttributes>(DONT_ENUM | READ_ONLY));
     }
   }
@@ -2821,13 +2974,13 @@ void Genesis::InitializeGlobal(Handle<JSGlobalObject> global_object,
   {  // -- A r r a y B u f f e r
     Handle<String> name = factory->ArrayBuffer_string();
     Handle<JSFunction> array_buffer_fun = CreateArrayBuffer(name, ARRAY_BUFFER);
-    JSObject::AddProperty(global, name, array_buffer_fun, DONT_ENUM);
-    InstallWithIntrinsicDefaultProto(isolate, array_buffer_fun,
+    JSObject::AddProperty(isolate_, global, name, array_buffer_fun, DONT_ENUM);
+    InstallWithIntrinsicDefaultProto(isolate_, array_buffer_fun,
                                      Context::ARRAY_BUFFER_FUN_INDEX);
-    InstallSpeciesGetter(array_buffer_fun);
+    InstallSpeciesGetter(isolate_, array_buffer_fun);
 
     Handle<JSFunction> array_buffer_noinit_fun = SimpleCreateFunction(
-        isolate,
+        isolate_,
         factory->NewStringFromAsciiChecked(
             "arrayBufferConstructor_DoNotInitialize"),
         Builtins::kArrayBufferConstructor_DoNotInitialize, 1, false);
@@ -2838,128 +2991,132 @@ void Genesis::InitializeGlobal(Handle<JSGlobalObject> global_object,
     Handle<String> name = factory->SharedArrayBuffer_string();
     Handle<JSFunction> shared_array_buffer_fun =
         CreateArrayBuffer(name, SHARED_ARRAY_BUFFER);
-    InstallWithIntrinsicDefaultProto(isolate, shared_array_buffer_fun,
+    InstallWithIntrinsicDefaultProto(isolate_, shared_array_buffer_fun,
                                      Context::SHARED_ARRAY_BUFFER_FUN_INDEX);
-    InstallSpeciesGetter(shared_array_buffer_fun);
+    InstallSpeciesGetter(isolate_, shared_array_buffer_fun);
   }
 
   {  // -- A t o m i c s
     Handle<JSObject> atomics_object =
-        factory->NewJSObject(isolate->object_function(), TENURED);
+        factory->NewJSObject(isolate_->object_function(), TENURED);
     native_context()->set_atomics_object(*atomics_object);
 
-    SimpleInstallFunction(atomics_object, "load", Builtins::kAtomicsLoad, 2,
-                          true);
-    SimpleInstallFunction(atomics_object, "store", Builtins::kAtomicsStore, 3,
-                          true);
-    SimpleInstallFunction(atomics_object, "add", Builtins::kAtomicsAdd, 3,
-                          true);
-    SimpleInstallFunction(atomics_object, "sub", Builtins::kAtomicsSub, 3,
-                          true);
-    SimpleInstallFunction(atomics_object, "and", Builtins::kAtomicsAnd, 3,
-                          true);
-    SimpleInstallFunction(atomics_object, "or", Builtins::kAtomicsOr, 3, true);
-    SimpleInstallFunction(atomics_object, "xor", Builtins::kAtomicsXor, 3,
-                          true);
-    SimpleInstallFunction(atomics_object, "exchange",
+    SimpleInstallFunction(isolate_, atomics_object, "load",
+                          Builtins::kAtomicsLoad, 2, true);
+    SimpleInstallFunction(isolate_, atomics_object, "store",
+                          Builtins::kAtomicsStore, 3, true);
+    SimpleInstallFunction(isolate_, atomics_object, "add",
+                          Builtins::kAtomicsAdd, 3, true);
+    SimpleInstallFunction(isolate_, atomics_object, "sub",
+                          Builtins::kAtomicsSub, 3, true);
+    SimpleInstallFunction(isolate_, atomics_object, "and",
+                          Builtins::kAtomicsAnd, 3, true);
+    SimpleInstallFunction(isolate_, atomics_object, "or", Builtins::kAtomicsOr,
+                          3, true);
+    SimpleInstallFunction(isolate_, atomics_object, "xor",
+                          Builtins::kAtomicsXor, 3, true);
+    SimpleInstallFunction(isolate_, atomics_object, "exchange",
                           Builtins::kAtomicsExchange, 3, true);
-    SimpleInstallFunction(atomics_object, "compareExchange",
+    SimpleInstallFunction(isolate_, atomics_object, "compareExchange",
                           Builtins::kAtomicsCompareExchange, 4, true);
-    SimpleInstallFunction(atomics_object, "isLockFree",
+    SimpleInstallFunction(isolate_, atomics_object, "isLockFree",
                           Builtins::kAtomicsIsLockFree, 1, true);
-    SimpleInstallFunction(atomics_object, "wait", Builtins::kAtomicsWait, 4,
-                          true);
-    SimpleInstallFunction(atomics_object, "wake", Builtins::kAtomicsWake, 3,
-                          true);
+    SimpleInstallFunction(isolate_, atomics_object, "wait",
+                          Builtins::kAtomicsWait, 4, true);
+    SimpleInstallFunction(isolate_, atomics_object, "wake",
+                          Builtins::kAtomicsWake, 3, true);
   }
 
   {  // -- T y p e d A r r a y
     Handle<JSFunction> typed_array_fun = CreateFunction(
-        isolate, factory->InternalizeUtf8String("TypedArray"),
+        isolate_, factory->InternalizeUtf8String("TypedArray"),
         JS_TYPED_ARRAY_TYPE, JSTypedArray::kSize, 0, factory->the_hole_value(),
         Builtins::kTypedArrayBaseConstructor);
     typed_array_fun->shared()->set_native(false);
     typed_array_fun->shared()->set_length(0);
-    InstallSpeciesGetter(typed_array_fun);
+    InstallSpeciesGetter(isolate_, typed_array_fun);
     native_context()->set_typed_array_function(*typed_array_fun);
 
-    SimpleInstallFunction(typed_array_fun, "of", Builtins::kTypedArrayOf, 0,
-                          false);
-    SimpleInstallFunction(typed_array_fun, "from", Builtins::kTypedArrayFrom, 1,
-                          false);
+    SimpleInstallFunction(isolate_, typed_array_fun, "of",
+                          Builtins::kTypedArrayOf, 0, false);
+    SimpleInstallFunction(isolate_, typed_array_fun, "from",
+                          Builtins::kTypedArrayFrom, 1, false);
 
     // Setup %TypedArrayPrototype%.
     Handle<JSObject> prototype(
-        JSObject::cast(typed_array_fun->instance_prototype()));
+        JSObject::cast(typed_array_fun->instance_prototype()), isolate());
     native_context()->set_typed_array_prototype(*prototype);
 
     // Install the "buffer", "byteOffset", "byteLength", "length"
     // and @@toStringTag getters on the {prototype}.
-    SimpleInstallGetter(prototype, factory->buffer_string(),
+    SimpleInstallGetter(isolate_, prototype, factory->buffer_string(),
                         Builtins::kTypedArrayPrototypeBuffer, false);
-    SimpleInstallGetter(prototype, factory->byte_length_string(),
+    SimpleInstallGetter(isolate_, prototype, factory->byte_length_string(),
                         Builtins::kTypedArrayPrototypeByteLength, true,
                         kTypedArrayByteLength);
-    SimpleInstallGetter(prototype, factory->byte_offset_string(),
+    SimpleInstallGetter(isolate_, prototype, factory->byte_offset_string(),
                         Builtins::kTypedArrayPrototypeByteOffset, true,
                         kTypedArrayByteOffset);
-    SimpleInstallGetter(prototype, factory->length_string(),
+    SimpleInstallGetter(isolate_, prototype, factory->length_string(),
                         Builtins::kTypedArrayPrototypeLength, true,
                         kTypedArrayLength);
-    SimpleInstallGetter(prototype, factory->to_string_tag_symbol(),
+    SimpleInstallGetter(isolate_, prototype, factory->to_string_tag_symbol(),
                         Builtins::kTypedArrayPrototypeToStringTag, true,
                         kTypedArrayToStringTag);
 
     // Install "keys", "values" and "entries" methods on the {prototype}.
-    SimpleInstallFunction(prototype, "entries",
+    SimpleInstallFunction(isolate_, prototype, "entries",
                           Builtins::kTypedArrayPrototypeEntries, 0, true,
                           kTypedArrayEntries);
 
-    SimpleInstallFunction(prototype, "keys", Builtins::kTypedArrayPrototypeKeys,
-                          0, true, kTypedArrayKeys);
+    SimpleInstallFunction(isolate_, prototype, "keys",
+                          Builtins::kTypedArrayPrototypeKeys, 0, true,
+                          kTypedArrayKeys);
 
     Handle<JSFunction> values = SimpleInstallFunction(
-        prototype, "values", Builtins::kTypedArrayPrototypeValues, 0, true,
-        kTypedArrayValues);
-    JSObject::AddProperty(prototype, factory->iterator_symbol(), values,
-                          DONT_ENUM);
+        isolate_, prototype, "values", Builtins::kTypedArrayPrototypeValues, 0,
+        true, kTypedArrayValues);
+    JSObject::AddProperty(isolate_, prototype, factory->iterator_symbol(),
+                          values, DONT_ENUM);
 
     // TODO(caitp): alphasort accessors/methods
-    SimpleInstallFunction(prototype, "copyWithin",
+    SimpleInstallFunction(isolate_, prototype, "copyWithin",
                           Builtins::kTypedArrayPrototypeCopyWithin, 2, false);
-    SimpleInstallFunction(prototype, "every",
+    SimpleInstallFunction(isolate_, prototype, "every",
                           Builtins::kTypedArrayPrototypeEvery, 1, false);
-    SimpleInstallFunction(prototype, "fill",
+    SimpleInstallFunction(isolate_, prototype, "fill",
                           Builtins::kTypedArrayPrototypeFill, 1, false);
-    SimpleInstallFunction(prototype, "filter",
+    SimpleInstallFunction(isolate_, prototype, "filter",
                           Builtins::kTypedArrayPrototypeFilter, 1, false);
-    SimpleInstallFunction(prototype, "find", Builtins::kTypedArrayPrototypeFind,
-                          1, false);
-    SimpleInstallFunction(prototype, "findIndex",
+    SimpleInstallFunction(isolate_, prototype, "find",
+                          Builtins::kTypedArrayPrototypeFind, 1, false);
+    SimpleInstallFunction(isolate_, prototype, "findIndex",
                           Builtins::kTypedArrayPrototypeFindIndex, 1, false);
-    SimpleInstallFunction(prototype, "forEach",
+    SimpleInstallFunction(isolate_, prototype, "forEach",
                           Builtins::kTypedArrayPrototypeForEach, 1, false);
-    SimpleInstallFunction(prototype, "includes",
+    SimpleInstallFunction(isolate_, prototype, "includes",
                           Builtins::kTypedArrayPrototypeIncludes, 1, false);
-    SimpleInstallFunction(prototype, "indexOf",
+    SimpleInstallFunction(isolate_, prototype, "indexOf",
                           Builtins::kTypedArrayPrototypeIndexOf, 1, false);
-    SimpleInstallFunction(prototype, "lastIndexOf",
+    SimpleInstallFunction(isolate_, prototype, "lastIndexOf",
                           Builtins::kTypedArrayPrototypeLastIndexOf, 1, false);
-    SimpleInstallFunction(prototype, "map", Builtins::kTypedArrayPrototypeMap,
-                          1, false);
-    SimpleInstallFunction(prototype, "reverse",
+    SimpleInstallFunction(isolate_, prototype, "map",
+                          Builtins::kTypedArrayPrototypeMap, 1, false);
+    SimpleInstallFunction(isolate_, prototype, "reverse",
                           Builtins::kTypedArrayPrototypeReverse, 0, false);
-    SimpleInstallFunction(prototype, "reduce",
+    SimpleInstallFunction(isolate_, prototype, "reduce",
                           Builtins::kTypedArrayPrototypeReduce, 1, false);
-    SimpleInstallFunction(prototype, "reduceRight",
+    SimpleInstallFunction(isolate_, prototype, "reduceRight",
                           Builtins::kTypedArrayPrototypeReduceRight, 1, false);
-    SimpleInstallFunction(prototype, "set", Builtins::kTypedArrayPrototypeSet,
-                          1, false);
-    SimpleInstallFunction(prototype, "slice",
+    SimpleInstallFunction(isolate_, prototype, "set",
+                          Builtins::kTypedArrayPrototypeSet, 1, false);
+    SimpleInstallFunction(isolate_, prototype, "slice",
                           Builtins::kTypedArrayPrototypeSlice, 2, false);
-    SimpleInstallFunction(prototype, "some", Builtins::kTypedArrayPrototypeSome,
-                          1, false);
-    SimpleInstallFunction(prototype, "subarray",
+    SimpleInstallFunction(isolate_, prototype, "some",
+                          Builtins::kTypedArrayPrototypeSome, 1, false);
+    SimpleInstallFunction(isolate_, prototype, "sort",
+                          Builtins::kTypedArrayPrototypeSort, 1, false);
+    SimpleInstallFunction(isolate_, prototype, "subarray",
                           Builtins::kTypedArrayPrototypeSubArray, 2, false);
   }
 
@@ -2968,7 +3125,7 @@ void Genesis::InitializeGlobal(Handle<JSGlobalObject> global_object,
   {                                                                    \
     Handle<JSFunction> fun =                                           \
         InstallTypedArray(#Type "Array", TYPE##_ELEMENTS);             \
-    InstallWithIntrinsicDefaultProto(isolate, fun,                     \
+    InstallWithIntrinsicDefaultProto(isolate_, fun,                    \
                                      Context::TYPE##_ARRAY_FUN_INDEX); \
   }
     TYPED_ARRAYS(INSTALL_TYPED_ARRAY)
@@ -2977,196 +3134,189 @@ void Genesis::InitializeGlobal(Handle<JSGlobalObject> global_object,
 
   {  // -- D a t a V i e w
     Handle<JSFunction> data_view_fun = InstallFunction(
-        global, "DataView", JS_DATA_VIEW_TYPE,
+        isolate_, global, "DataView", JS_DATA_VIEW_TYPE,
         JSDataView::kSizeWithEmbedderFields, 0, factory->the_hole_value(),
         Builtins::kDataViewConstructor);
-    InstallWithIntrinsicDefaultProto(isolate, data_view_fun,
+    InstallWithIntrinsicDefaultProto(isolate_, data_view_fun,
                                      Context::DATA_VIEW_FUN_INDEX);
-    data_view_fun->shared()->set_length(3);
+    data_view_fun->shared()->set_length(1);
     data_view_fun->shared()->DontAdaptArguments();
 
     // Setup %DataViewPrototype%.
     Handle<JSObject> prototype(
-        JSObject::cast(data_view_fun->instance_prototype()));
+        JSObject::cast(data_view_fun->instance_prototype()), isolate());
 
     // Install the @@toStringTag property on the {prototype}.
     JSObject::AddProperty(
-        prototype, factory->to_string_tag_symbol(),
+        isolate_, prototype, factory->to_string_tag_symbol(),
         factory->NewStringFromAsciiChecked("DataView"),
         static_cast<PropertyAttributes>(DONT_ENUM | READ_ONLY));
 
     // Install the "buffer", "byteOffset" and "byteLength" getters
     // on the {prototype}.
-    SimpleInstallGetter(prototype, factory->buffer_string(),
+    SimpleInstallGetter(isolate_, prototype, factory->buffer_string(),
                         Builtins::kDataViewPrototypeGetBuffer, false,
                         kDataViewBuffer);
-    SimpleInstallGetter(prototype, factory->byte_length_string(),
+    SimpleInstallGetter(isolate_, prototype, factory->byte_length_string(),
                         Builtins::kDataViewPrototypeGetByteLength, false,
                         kDataViewByteLength);
-    SimpleInstallGetter(prototype, factory->byte_offset_string(),
+    SimpleInstallGetter(isolate_, prototype, factory->byte_offset_string(),
                         Builtins::kDataViewPrototypeGetByteOffset, false,
                         kDataViewByteOffset);
 
-    SimpleInstallFunction(prototype, "getInt8",
+    SimpleInstallFunction(isolate_, prototype, "getInt8",
                           Builtins::kDataViewPrototypeGetInt8, 1, false);
-    SimpleInstallFunction(prototype, "setInt8",
+    SimpleInstallFunction(isolate_, prototype, "setInt8",
                           Builtins::kDataViewPrototypeSetInt8, 2, false);
-    SimpleInstallFunction(prototype, "getUint8",
+    SimpleInstallFunction(isolate_, prototype, "getUint8",
                           Builtins::kDataViewPrototypeGetUint8, 1, false);
-    SimpleInstallFunction(prototype, "setUint8",
+    SimpleInstallFunction(isolate_, prototype, "setUint8",
                           Builtins::kDataViewPrototypeSetUint8, 2, false);
-    SimpleInstallFunction(prototype, "getInt16",
+    SimpleInstallFunction(isolate_, prototype, "getInt16",
                           Builtins::kDataViewPrototypeGetInt16, 1, false);
-    SimpleInstallFunction(prototype, "setInt16",
+    SimpleInstallFunction(isolate_, prototype, "setInt16",
                           Builtins::kDataViewPrototypeSetInt16, 2, false);
-    SimpleInstallFunction(prototype, "getUint16",
+    SimpleInstallFunction(isolate_, prototype, "getUint16",
                           Builtins::kDataViewPrototypeGetUint16, 1, false);
-    SimpleInstallFunction(prototype, "setUint16",
+    SimpleInstallFunction(isolate_, prototype, "setUint16",
                           Builtins::kDataViewPrototypeSetUint16, 2, false);
-    SimpleInstallFunction(prototype, "getInt32",
+    SimpleInstallFunction(isolate_, prototype, "getInt32",
                           Builtins::kDataViewPrototypeGetInt32, 1, false);
-    SimpleInstallFunction(prototype, "setInt32",
+    SimpleInstallFunction(isolate_, prototype, "setInt32",
                           Builtins::kDataViewPrototypeSetInt32, 2, false);
-    SimpleInstallFunction(prototype, "getUint32",
+    SimpleInstallFunction(isolate_, prototype, "getUint32",
                           Builtins::kDataViewPrototypeGetUint32, 1, false);
-    SimpleInstallFunction(prototype, "setUint32",
+    SimpleInstallFunction(isolate_, prototype, "setUint32",
                           Builtins::kDataViewPrototypeSetUint32, 2, false);
-    SimpleInstallFunction(prototype, "getFloat32",
+    SimpleInstallFunction(isolate_, prototype, "getFloat32",
                           Builtins::kDataViewPrototypeGetFloat32, 1, false);
-    SimpleInstallFunction(prototype, "setFloat32",
+    SimpleInstallFunction(isolate_, prototype, "setFloat32",
                           Builtins::kDataViewPrototypeSetFloat32, 2, false);
-    SimpleInstallFunction(prototype, "getFloat64",
+    SimpleInstallFunction(isolate_, prototype, "getFloat64",
                           Builtins::kDataViewPrototypeGetFloat64, 1, false);
-    SimpleInstallFunction(prototype, "setFloat64",
+    SimpleInstallFunction(isolate_, prototype, "setFloat64",
                           Builtins::kDataViewPrototypeSetFloat64, 2, false);
   }
 
   {  // -- M a p
-    {
-      Handle<String> index_string = isolate->factory()->zero_string();
-      uint32_t field =
-          StringHasher::MakeArrayIndexHash(0, index_string->length());
-      index_string->set_hash_field(field);
-
-      index_string = isolate->factory()->one_string();
-      field = StringHasher::MakeArrayIndexHash(1, index_string->length());
-      index_string->set_hash_field(field);
-    }
-
     Handle<JSFunction> js_map_fun =
-        InstallFunction(global, "Map", JS_MAP_TYPE, JSMap::kSize, 0,
+        InstallFunction(isolate_, global, "Map", JS_MAP_TYPE, JSMap::kSize, 0,
                         factory->the_hole_value(), Builtins::kMapConstructor);
-    InstallWithIntrinsicDefaultProto(isolate, js_map_fun,
+    InstallWithIntrinsicDefaultProto(isolate_, js_map_fun,
                                      Context::JS_MAP_FUN_INDEX);
 
-    Handle<SharedFunctionInfo> shared(js_map_fun->shared(), isolate);
+    Handle<SharedFunctionInfo> shared(js_map_fun->shared(), isolate_);
     shared->DontAdaptArguments();
     shared->set_length(0);
 
     // Setup %MapPrototype%.
-    Handle<JSObject> prototype(
-        JSObject::cast(js_map_fun->instance_prototype()));
+    Handle<JSObject> prototype(JSObject::cast(js_map_fun->instance_prototype()),
+                               isolate());
 
     // Install the @@toStringTag property on the {prototype}.
     JSObject::AddProperty(
-        prototype, factory->to_string_tag_symbol(), factory->Map_string(),
+        isolate_, prototype, factory->to_string_tag_symbol(),
+        factory->Map_string(),
         static_cast<PropertyAttributes>(DONT_ENUM | READ_ONLY));
 
     Handle<JSFunction> map_get = SimpleInstallFunction(
-        prototype, "get", Builtins::kMapPrototypeGet, 1, true);
+        isolate_, prototype, "get", Builtins::kMapPrototypeGet, 1, true);
     native_context()->set_map_get(*map_get);
 
     Handle<JSFunction> map_set = SimpleInstallFunction(
-        prototype, "set", Builtins::kMapPrototypeSet, 2, true);
+        isolate_, prototype, "set", Builtins::kMapPrototypeSet, 2, true);
     native_context()->set_map_set(*map_set);
 
     Handle<JSFunction> map_has = SimpleInstallFunction(
-        prototype, "has", Builtins::kMapPrototypeHas, 1, true);
+        isolate_, prototype, "has", Builtins::kMapPrototypeHas, 1, true);
     native_context()->set_map_has(*map_has);
 
     Handle<JSFunction> map_delete = SimpleInstallFunction(
-        prototype, "delete", Builtins::kMapPrototypeDelete, 1, true);
+        isolate_, prototype, "delete", Builtins::kMapPrototypeDelete, 1, true);
     native_context()->set_map_delete(*map_delete);
 
-    SimpleInstallFunction(prototype, "clear", Builtins::kMapPrototypeClear, 0,
-                          true);
-    Handle<JSFunction> entries = SimpleInstallFunction(
-        prototype, "entries", Builtins::kMapPrototypeEntries, 0, true);
-    JSObject::AddProperty(prototype, factory->iterator_symbol(), entries,
-                          DONT_ENUM);
-    SimpleInstallFunction(prototype, "forEach", Builtins::kMapPrototypeForEach,
-                          1, false);
-    SimpleInstallFunction(prototype, "keys", Builtins::kMapPrototypeKeys, 0,
-                          true);
-    SimpleInstallGetter(prototype, factory->InternalizeUtf8String("size"),
-                        Builtins::kMapPrototypeGetSize, true,
-                        BuiltinFunctionId::kMapSize);
-    SimpleInstallFunction(prototype, "values", Builtins::kMapPrototypeValues, 0,
-                          true);
+    SimpleInstallFunction(isolate_, prototype, "clear",
+                          Builtins::kMapPrototypeClear, 0, true);
+    Handle<JSFunction> entries =
+        SimpleInstallFunction(isolate_, prototype, "entries",
+                              Builtins::kMapPrototypeEntries, 0, true);
+    JSObject::AddProperty(isolate_, prototype, factory->iterator_symbol(),
+                          entries, DONT_ENUM);
+    SimpleInstallFunction(isolate_, prototype, "forEach",
+                          Builtins::kMapPrototypeForEach, 1, false);
+    SimpleInstallFunction(isolate_, prototype, "keys",
+                          Builtins::kMapPrototypeKeys, 0, true);
+    SimpleInstallGetter(
+        isolate_, prototype, factory->InternalizeUtf8String("size"),
+        Builtins::kMapPrototypeGetSize, true, BuiltinFunctionId::kMapSize);
+    SimpleInstallFunction(isolate_, prototype, "values",
+                          Builtins::kMapPrototypeValues, 0, true);
 
     native_context()->set_initial_map_prototype_map(prototype->map());
 
-    InstallSpeciesGetter(js_map_fun);
+    InstallSpeciesGetter(isolate_, js_map_fun);
   }
 
   {  // -- S e t
     Handle<JSFunction> js_set_fun =
-        InstallFunction(global, "Set", JS_SET_TYPE, JSSet::kSize, 0,
+        InstallFunction(isolate_, global, "Set", JS_SET_TYPE, JSSet::kSize, 0,
                         factory->the_hole_value(), Builtins::kSetConstructor);
-    InstallWithIntrinsicDefaultProto(isolate, js_set_fun,
+    InstallWithIntrinsicDefaultProto(isolate_, js_set_fun,
                                      Context::JS_SET_FUN_INDEX);
 
-    Handle<SharedFunctionInfo> shared(js_set_fun->shared(), isolate);
+    Handle<SharedFunctionInfo> shared(js_set_fun->shared(), isolate_);
     shared->DontAdaptArguments();
     shared->set_length(0);
 
     // Setup %SetPrototype%.
-    Handle<JSObject> prototype(
-        JSObject::cast(js_set_fun->instance_prototype()));
+    Handle<JSObject> prototype(JSObject::cast(js_set_fun->instance_prototype()),
+                               isolate());
 
     // Install the @@toStringTag property on the {prototype}.
     JSObject::AddProperty(
-        prototype, factory->to_string_tag_symbol(), factory->Set_string(),
+        isolate_, prototype, factory->to_string_tag_symbol(),
+        factory->Set_string(),
         static_cast<PropertyAttributes>(DONT_ENUM | READ_ONLY));
 
     Handle<JSFunction> set_has = SimpleInstallFunction(
-        prototype, "has", Builtins::kSetPrototypeHas, 1, true);
+        isolate_, prototype, "has", Builtins::kSetPrototypeHas, 1, true);
     native_context()->set_set_has(*set_has);
 
     Handle<JSFunction> set_add = SimpleInstallFunction(
-        prototype, "add", Builtins::kSetPrototypeAdd, 1, true);
+        isolate_, prototype, "add", Builtins::kSetPrototypeAdd, 1, true);
     native_context()->set_set_add(*set_add);
 
     Handle<JSFunction> set_delete = SimpleInstallFunction(
-        prototype, "delete", Builtins::kSetPrototypeDelete, 1, true);
+        isolate_, prototype, "delete", Builtins::kSetPrototypeDelete, 1, true);
     native_context()->set_set_delete(*set_delete);
 
-    SimpleInstallFunction(prototype, "clear", Builtins::kSetPrototypeClear, 0,
-                          true);
-    SimpleInstallFunction(prototype, "entries", Builtins::kSetPrototypeEntries,
-                          0, true);
-    SimpleInstallFunction(prototype, "forEach", Builtins::kSetPrototypeForEach,
-                          1, false);
-    SimpleInstallGetter(prototype, factory->InternalizeUtf8String("size"),
-                        Builtins::kSetPrototypeGetSize, true,
-                        BuiltinFunctionId::kSetSize);
+    SimpleInstallFunction(isolate_, prototype, "clear",
+                          Builtins::kSetPrototypeClear, 0, true);
+    SimpleInstallFunction(isolate_, prototype, "entries",
+                          Builtins::kSetPrototypeEntries, 0, true);
+    SimpleInstallFunction(isolate_, prototype, "forEach",
+                          Builtins::kSetPrototypeForEach, 1, false);
+    SimpleInstallGetter(
+        isolate_, prototype, factory->InternalizeUtf8String("size"),
+        Builtins::kSetPrototypeGetSize, true, BuiltinFunctionId::kSetSize);
     Handle<JSFunction> values = SimpleInstallFunction(
-        prototype, "values", Builtins::kSetPrototypeValues, 0, true);
-    JSObject::AddProperty(prototype, factory->keys_string(), values, DONT_ENUM);
-    JSObject::AddProperty(prototype, factory->iterator_symbol(), values,
+        isolate_, prototype, "values", Builtins::kSetPrototypeValues, 0, true);
+    JSObject::AddProperty(isolate_, prototype, factory->keys_string(), values,
                           DONT_ENUM);
+    JSObject::AddProperty(isolate_, prototype, factory->iterator_symbol(),
+                          values, DONT_ENUM);
 
     native_context()->set_initial_set_prototype_map(prototype->map());
 
-    InstallSpeciesGetter(js_set_fun);
+    InstallSpeciesGetter(isolate_, js_set_fun);
   }
 
   {  // -- J S M o d u l e N a m e s p a c e
     Handle<Map> map = factory->NewMap(
         JS_MODULE_NAMESPACE_TYPE, JSModuleNamespace::kSize,
         TERMINAL_FAST_ELEMENTS_KIND, JSModuleNamespace::kInObjectFieldCount);
-    Map::SetPrototype(map, isolate->factory()->null_value());
-    Map::EnsureDescriptorSlack(map, 1);
+    Map::SetPrototype(isolate(), map, isolate_->factory()->null_value());
+    Map::EnsureDescriptorSlack(isolate_, map, 1);
     native_context()->set_js_module_namespace_map(*map);
 
     {  // Install @@toStringTag.
@@ -3183,8 +3333,8 @@ void Genesis::InitializeGlobal(Handle<JSGlobalObject> global_object,
   {  // -- I t e r a t o r R e s u l t
     Handle<Map> map = factory->NewMap(JS_OBJECT_TYPE, JSIteratorResult::kSize,
                                       TERMINAL_FAST_ELEMENTS_KIND, 2);
-    Map::SetPrototype(map, isolate->initial_object_prototype());
-    Map::EnsureDescriptorSlack(map, 2);
+    Map::SetPrototype(isolate(), map, isolate_->initial_object_prototype());
+    Map::EnsureDescriptorSlack(isolate_, map, 2);
 
     {  // value
       Descriptor d = Descriptor::DataField(factory->value_string(),
@@ -3206,28 +3356,31 @@ void Genesis::InitializeGlobal(Handle<JSGlobalObject> global_object,
 
   {  // -- W e a k M a p
     Handle<JSFunction> cons = InstallFunction(
-        global, "WeakMap", JS_WEAK_MAP_TYPE, JSWeakMap::kSize, 0,
+        isolate_, global, "WeakMap", JS_WEAK_MAP_TYPE, JSWeakMap::kSize, 0,
         factory->the_hole_value(), Builtins::kWeakMapConstructor);
-    InstallWithIntrinsicDefaultProto(isolate, cons,
+    InstallWithIntrinsicDefaultProto(isolate_, cons,
                                      Context::JS_WEAK_MAP_FUN_INDEX);
 
-    Handle<SharedFunctionInfo> shared(cons->shared(), isolate);
+    Handle<SharedFunctionInfo> shared(cons->shared(), isolate_);
     shared->DontAdaptArguments();
     shared->set_length(0);
 
     // Setup %WeakMapPrototype%.
-    Handle<JSObject> prototype(JSObject::cast(cons->instance_prototype()));
+    Handle<JSObject> prototype(JSObject::cast(cons->instance_prototype()),
+                               isolate());
 
-    SimpleInstallFunction(prototype, "delete",
+    SimpleInstallFunction(isolate_, prototype, "delete",
                           Builtins::kWeakMapPrototypeDelete, 1, true);
-    SimpleInstallFunction(prototype, "get", Builtins::kWeakMapGet, 1, true);
-    SimpleInstallFunction(prototype, "has", Builtins::kWeakMapHas, 1, true);
+    SimpleInstallFunction(isolate_, prototype, "get", Builtins::kWeakMapGet, 1,
+                          true);
+    SimpleInstallFunction(isolate_, prototype, "has", Builtins::kWeakMapHas, 1,
+                          true);
     Handle<JSFunction> weakmap_set = SimpleInstallFunction(
-        prototype, "set", Builtins::kWeakMapPrototypeSet, 2, true);
+        isolate_, prototype, "set", Builtins::kWeakMapPrototypeSet, 2, true);
     native_context()->set_weakmap_set(*weakmap_set);
 
     JSObject::AddProperty(
-        prototype, factory->to_string_tag_symbol(),
+        isolate_, prototype, factory->to_string_tag_symbol(),
         factory->NewStringFromAsciiChecked("WeakMap"),
         static_cast<PropertyAttributes>(DONT_ENUM | READ_ONLY));
 
@@ -3236,27 +3389,29 @@ void Genesis::InitializeGlobal(Handle<JSGlobalObject> global_object,
 
   {  // -- W e a k S e t
     Handle<JSFunction> cons = InstallFunction(
-        global, "WeakSet", JS_WEAK_SET_TYPE, JSWeakSet::kSize, 0,
+        isolate_, global, "WeakSet", JS_WEAK_SET_TYPE, JSWeakSet::kSize, 0,
         factory->the_hole_value(), Builtins::kWeakSetConstructor);
-    InstallWithIntrinsicDefaultProto(isolate, cons,
+    InstallWithIntrinsicDefaultProto(isolate_, cons,
                                      Context::JS_WEAK_SET_FUN_INDEX);
 
-    Handle<SharedFunctionInfo> shared(cons->shared(), isolate);
+    Handle<SharedFunctionInfo> shared(cons->shared(), isolate_);
     shared->DontAdaptArguments();
     shared->set_length(0);
 
     // Setup %WeakSetPrototype%.
-    Handle<JSObject> prototype(JSObject::cast(cons->instance_prototype()));
+    Handle<JSObject> prototype(JSObject::cast(cons->instance_prototype()),
+                               isolate());
 
-    SimpleInstallFunction(prototype, "delete",
+    SimpleInstallFunction(isolate_, prototype, "delete",
                           Builtins::kWeakSetPrototypeDelete, 1, true);
-    SimpleInstallFunction(prototype, "has", Builtins::kWeakSetHas, 1, true);
+    SimpleInstallFunction(isolate_, prototype, "has", Builtins::kWeakSetHas, 1,
+                          true);
     Handle<JSFunction> weakset_add = SimpleInstallFunction(
-        prototype, "add", Builtins::kWeakSetPrototypeAdd, 1, true);
+        isolate_, prototype, "add", Builtins::kWeakSetPrototypeAdd, 1, true);
     native_context()->set_weakset_add(*weakset_add);
 
     JSObject::AddProperty(
-        prototype, factory->to_string_tag_symbol(),
+        isolate_, prototype, factory->to_string_tag_symbol(),
         factory->NewStringFromAsciiChecked("WeakSet"),
         static_cast<PropertyAttributes>(DONT_ENUM | READ_ONLY));
 
@@ -3268,8 +3423,8 @@ void Genesis::InitializeGlobal(Handle<JSGlobalObject> global_object,
 
     // Proxy function map has prototype slot for storing initial map but does
     // not have a prototype property.
-    Handle<Map> proxy_function_map =
-        Map::Copy(isolate->strict_function_without_prototype_map(), "Proxy");
+    Handle<Map> proxy_function_map = Map::Copy(
+        isolate_, isolate_->strict_function_without_prototype_map(), "Proxy");
     // Re-set the unused property fields after changing the instance size.
     // TODO(ulan): Do not change instance size after map creation.
     int unused_property_fields = proxy_function_map->UnusedPropertyFields();
@@ -3287,21 +3442,22 @@ void Genesis::InitializeGlobal(Handle<JSGlobalObject> global_object,
         name, proxy_function_map, Builtins::kProxyConstructor);
     Handle<JSFunction> proxy_function = factory->NewFunction(args);
 
-    JSFunction::SetInitialMap(proxy_function, isolate->proxy_map(),
+    JSFunction::SetInitialMap(proxy_function, isolate_->proxy_map(),
                               factory->null_value());
 
     proxy_function->shared()->set_internal_formal_parameter_count(2);
     proxy_function->shared()->set_length(2);
 
     native_context()->set_proxy_function(*proxy_function);
-    InstallFunction(global, name, proxy_function, factory->Object_string());
+    InstallFunction(isolate_, global, name, proxy_function,
+                    factory->Object_string());
 
-    SimpleInstallFunction(proxy_function, "revocable",
+    SimpleInstallFunction(isolate_, proxy_function, "revocable",
                           Builtins::kProxyRevocable, 2, true);
 
     {  // Internal: ProxyRevoke
       Handle<SharedFunctionInfo> info = SimpleCreateSharedFunctionInfo(
-          isolate, Builtins::kProxyRevoke, factory->empty_string(), 0);
+          isolate_, Builtins::kProxyRevoke, factory->empty_string(), 0);
       native_context()->set_proxy_revoke_shared_fun(*info);
     }
   }
@@ -3309,45 +3465,48 @@ void Genesis::InitializeGlobal(Handle<JSGlobalObject> global_object,
   {  // -- R e f l e c t
     Handle<String> reflect_string = factory->InternalizeUtf8String("Reflect");
     Handle<JSObject> reflect =
-        factory->NewJSObject(isolate->object_function(), TENURED);
-    JSObject::AddProperty(global, reflect_string, reflect, DONT_ENUM);
+        factory->NewJSObject(isolate_->object_function(), TENURED);
+    JSObject::AddProperty(isolate_, global, reflect_string, reflect, DONT_ENUM);
 
-    Handle<JSFunction> define_property =
-        SimpleInstallFunction(reflect, factory->defineProperty_string(),
-                              Builtins::kReflectDefineProperty, 3, true);
+    Handle<JSFunction> define_property = SimpleInstallFunction(
+        isolate_, reflect, factory->defineProperty_string(),
+        Builtins::kReflectDefineProperty, 3, true);
     native_context()->set_reflect_define_property(*define_property);
 
-    Handle<JSFunction> delete_property =
-        SimpleInstallFunction(reflect, factory->deleteProperty_string(),
-                              Builtins::kReflectDeleteProperty, 2, true);
+    Handle<JSFunction> delete_property = SimpleInstallFunction(
+        isolate_, reflect, factory->deleteProperty_string(),
+        Builtins::kReflectDeleteProperty, 2, true);
     native_context()->set_reflect_delete_property(*delete_property);
 
-    Handle<JSFunction> apply = SimpleInstallFunction(
-        reflect, factory->apply_string(), Builtins::kReflectApply, 3, false);
+    Handle<JSFunction> apply =
+        SimpleInstallFunction(isolate_, reflect, factory->apply_string(),
+                              Builtins::kReflectApply, 3, false);
     native_context()->set_reflect_apply(*apply);
 
     Handle<JSFunction> construct =
-        SimpleInstallFunction(reflect, factory->construct_string(),
+        SimpleInstallFunction(isolate_, reflect, factory->construct_string(),
                               Builtins::kReflectConstruct, 2, false);
     native_context()->set_reflect_construct(*construct);
 
-    SimpleInstallFunction(reflect, factory->get_string(), Builtins::kReflectGet,
-                          2, false);
-    SimpleInstallFunction(reflect, factory->getOwnPropertyDescriptor_string(),
+    SimpleInstallFunction(isolate_, reflect, factory->get_string(),
+                          Builtins::kReflectGet, 2, false);
+    SimpleInstallFunction(isolate_, reflect,
+                          factory->getOwnPropertyDescriptor_string(),
                           Builtins::kReflectGetOwnPropertyDescriptor, 2, true);
-    SimpleInstallFunction(reflect, factory->getPrototypeOf_string(),
+    SimpleInstallFunction(isolate_, reflect, factory->getPrototypeOf_string(),
                           Builtins::kReflectGetPrototypeOf, 1, true);
-    SimpleInstallFunction(reflect, factory->has_string(), Builtins::kReflectHas,
-                          2, true);
-    SimpleInstallFunction(reflect, factory->isExtensible_string(),
+    SimpleInstallFunction(isolate_, reflect, factory->has_string(),
+                          Builtins::kReflectHas, 2, true);
+    SimpleInstallFunction(isolate_, reflect, factory->isExtensible_string(),
                           Builtins::kReflectIsExtensible, 1, true);
-    SimpleInstallFunction(reflect, factory->ownKeys_string(),
+    SimpleInstallFunction(isolate_, reflect, factory->ownKeys_string(),
                           Builtins::kReflectOwnKeys, 1, true);
-    SimpleInstallFunction(reflect, factory->preventExtensions_string(),
+    SimpleInstallFunction(isolate_, reflect,
+                          factory->preventExtensions_string(),
                           Builtins::kReflectPreventExtensions, 1, true);
-    SimpleInstallFunction(reflect, factory->set_string(), Builtins::kReflectSet,
-                          3, false);
-    SimpleInstallFunction(reflect, factory->setPrototypeOf_string(),
+    SimpleInstallFunction(isolate_, reflect, factory->set_string(),
+                          Builtins::kReflectSet, 3, false);
+    SimpleInstallFunction(isolate_, reflect, factory->setPrototypeOf_string(),
                           Builtins::kReflectSetPrototypeOf, 2, true);
   }
 
@@ -3357,11 +3516,11 @@ void Genesis::InitializeGlobal(Handle<JSGlobalObject> global_object,
                         TERMINAL_FAST_ELEMENTS_KIND, 0);
     map->SetConstructor(native_context()->object_function());
     map->set_is_callable(true);
-    Map::SetPrototype(map, empty_function);
+    Map::SetPrototype(isolate(), map, empty_function);
 
     PropertyAttributes roc_attribs =
         static_cast<PropertyAttributes>(DONT_ENUM | READ_ONLY);
-    Map::EnsureDescriptorSlack(map, 2);
+    Map::EnsureDescriptorSlack(isolate_, map, 2);
 
     {  // length
       Descriptor d = Descriptor::AccessorConstant(
@@ -3378,7 +3537,7 @@ void Genesis::InitializeGlobal(Handle<JSGlobalObject> global_object,
     }
     native_context()->set_bound_function_without_constructor_map(*map);
 
-    map = Map::Copy(map, "IsConstructor");
+    map = Map::Copy(isolate_, map, "IsConstructor");
     map->set_is_constructor(true);
     native_context()->set_bound_function_with_constructor_map(*map);
   }
@@ -3386,14 +3545,14 @@ void Genesis::InitializeGlobal(Handle<JSGlobalObject> global_object,
   {  // --- sloppy arguments map
     Handle<String> arguments_string = factory->Arguments_string();
     NewFunctionArgs args = NewFunctionArgs::ForBuiltinWithPrototype(
-        arguments_string, isolate->initial_object_prototype(),
+        arguments_string, isolate_->initial_object_prototype(),
         JS_ARGUMENTS_TYPE, JSSloppyArgumentsObject::kSize, 2,
         Builtins::kIllegal, MUTABLE);
     Handle<JSFunction> function = factory->NewFunction(args);
-    Handle<Map> map(function->initial_map());
+    Handle<Map> map(function->initial_map(), isolate());
 
     // Create the descriptor array for the arguments object.
-    Map::EnsureDescriptorSlack(map, 2);
+    Map::EnsureDescriptorSlack(isolate_, map, 2);
 
     {  // length
       Descriptor d = Descriptor::DataField(
@@ -3416,13 +3575,13 @@ void Genesis::InitializeGlobal(Handle<JSGlobalObject> global_object,
   }
 
   {  // --- fast and slow aliased arguments map
-    Handle<Map> map = isolate->sloppy_arguments_map();
-    map = Map::Copy(map, "FastAliasedArguments");
+    Handle<Map> map = isolate_->sloppy_arguments_map();
+    map = Map::Copy(isolate_, map, "FastAliasedArguments");
     map->set_elements_kind(FAST_SLOPPY_ARGUMENTS_ELEMENTS);
     DCHECK_EQ(2, map->GetInObjectProperties());
     native_context()->set_fast_aliased_arguments_map(*map);
 
-    map = Map::Copy(map, "SlowAliasedArguments");
+    map = Map::Copy(isolate_, map, "SlowAliasedArguments");
     map->set_elements_kind(SLOW_SLOPPY_ARGUMENTS_ELEMENTS);
     DCHECK_EQ(2, map->GetInObjectProperties());
     native_context()->set_slow_aliased_arguments_map(*map);
@@ -3445,7 +3604,7 @@ void Genesis::InitializeGlobal(Handle<JSGlobalObject> global_object,
     Handle<Map> map = factory->NewMap(
         JS_ARGUMENTS_TYPE, JSStrictArgumentsObject::kSize, PACKED_ELEMENTS, 1);
     // Create the descriptor array for the arguments object.
-    Map::EnsureDescriptorSlack(map, 2);
+    Map::EnsureDescriptorSlack(isolate_, map, 2);
 
     {  // length
       Descriptor d = Descriptor::DataField(
@@ -3461,8 +3620,8 @@ void Genesis::InitializeGlobal(Handle<JSGlobalObject> global_object,
     // @@iterator method is added later.
 
     DCHECK_EQ(native_context()->object_function()->prototype(),
-              *isolate->initial_object_prototype());
-    Map::SetPrototype(map, isolate->initial_object_prototype());
+              *isolate_->initial_object_prototype());
+    Map::SetPrototype(isolate(), map, isolate_->initial_object_prototype());
 
     // Copy constructor from the sloppy arguments boilerplate.
     map->SetConstructor(
@@ -3477,7 +3636,7 @@ void Genesis::InitializeGlobal(Handle<JSGlobalObject> global_object,
   {  // --- context extension
     // Create a function for the context extension objects.
     Handle<JSFunction> context_extension_fun =
-        CreateFunction(isolate, factory->empty_string(),
+        CreateFunction(isolate_, factory->empty_string(),
                        JS_CONTEXT_EXTENSION_OBJECT_TYPE, JSObject::kHeaderSize,
                        0, factory->the_hole_value(), Builtins::kIllegal);
     native_context()->set_context_extension_function(*context_extension_fun);
@@ -3486,7 +3645,7 @@ void Genesis::InitializeGlobal(Handle<JSGlobalObject> global_object,
   {
     // Set up the call-as-function delegate.
     Handle<JSFunction> delegate =
-        SimpleCreateFunction(isolate, factory->empty_string(),
+        SimpleCreateFunction(isolate_, factory->empty_string(),
                              Builtins::kHandleApiCallAsFunction, 0, false);
     native_context()->set_call_as_function_delegate(*delegate);
   }
@@ -3494,7 +3653,7 @@ void Genesis::InitializeGlobal(Handle<JSGlobalObject> global_object,
   {
     // Set up the call-as-constructor delegate.
     Handle<JSFunction> delegate =
-        SimpleCreateFunction(isolate, factory->empty_string(),
+        SimpleCreateFunction(isolate_, factory->empty_string(),
                              Builtins::kHandleApiCallAsConstructor, 0, false);
     native_context()->set_call_as_constructor_delegate(*delegate);
   }
@@ -3502,16 +3661,16 @@ void Genesis::InitializeGlobal(Handle<JSGlobalObject> global_object,
 
 Handle<JSFunction> Genesis::InstallTypedArray(const char* name,
                                               ElementsKind elements_kind) {
-  Handle<JSObject> global = Handle<JSObject>(native_context()->global_object());
+  Handle<JSObject> global =
+      Handle<JSObject>(native_context()->global_object(), isolate());
 
-  Handle<JSObject> typed_array_prototype =
-      Handle<JSObject>(isolate()->typed_array_prototype());
-  Handle<JSFunction> typed_array_function =
-      Handle<JSFunction>(isolate()->typed_array_function());
+  Handle<JSObject> typed_array_prototype = isolate()->typed_array_prototype();
+  Handle<JSFunction> typed_array_function = isolate()->typed_array_function();
 
   Handle<JSFunction> result = InstallFunction(
-      global, name, JS_TYPED_ARRAY_TYPE, JSTypedArray::kSizeWithEmbedderFields,
-      0, factory()->the_hole_value(), Builtins::kTypedArrayConstructor);
+      isolate(), global, name, JS_TYPED_ARRAY_TYPE,
+      JSTypedArray::kSizeWithEmbedderFields, 0, factory()->the_hole_value(),
+      Builtins::kTypedArrayConstructor);
   result->initial_map()->set_elements_kind(elements_kind);
 
   result->shared()->DontAdaptArguments();
@@ -3598,7 +3757,7 @@ bool Bootstrapper::CompileNative(Isolate* isolate, Vector<const char> name,
                                  NativesFlag natives_flag) {
   SuppressDebug compiling_natives(isolate->debug());
 
-  Handle<Context> context(isolate->context());
+  Handle<Context> context(isolate->context(), isolate);
   Handle<String> script_name =
       isolate->factory()->NewStringFromUtf8(name).ToHandleChecked();
   MaybeHandle<SharedFunctionInfo> maybe_function_info =
@@ -3660,10 +3819,10 @@ bool Genesis::CompileExtension(Isolate* isolate, v8::Extension* extension) {
   // function and insert it into the cache.
   Vector<const char> name = CStrVector(extension->name());
   SourceCodeCache* cache = isolate->bootstrapper()->extensions_cache();
-  Handle<Context> context(isolate->context());
+  Handle<Context> context(isolate->context(), isolate);
   DCHECK(context->IsNativeContext());
 
-  if (!cache->Lookup(name, &function_info)) {
+  if (!cache->Lookup(isolate, name, &function_info)) {
     Handle<String> script_name =
         factory->NewStringFromUtf8(name).ToHandleChecked();
     MaybeHandle<SharedFunctionInfo> maybe_function_info =
@@ -3672,7 +3831,7 @@ bool Genesis::CompileExtension(Isolate* isolate, v8::Extension* extension) {
             extension, nullptr, ScriptCompiler::kNoCompileOptions,
             ScriptCompiler::kNoCacheBecauseV8Extension, EXTENSION_CODE);
     if (!maybe_function_info.ToHandle(&function_info)) return false;
-    cache->Add(name, function_info);
+    cache->Add(isolate, name, function_info);
   }
 
   // Set up the function context. Conceptually, we should clone the
@@ -3689,12 +3848,11 @@ bool Genesis::CompileExtension(Isolate* isolate, v8::Extension* extension) {
               .is_null();
 }
 
-
-static Handle<JSObject> ResolveBuiltinIdHolder(Handle<Context> native_context,
+static Handle<JSObject> ResolveBuiltinIdHolder(Isolate* isolate,
+                                               Handle<Context> native_context,
                                                const char* holder_expr) {
-  Isolate* isolate = native_context->GetIsolate();
   Factory* factory = isolate->factory();
-  Handle<JSGlobalObject> global(native_context->global_object());
+  Handle<JSGlobalObject> global(native_context->global_object(), isolate);
   const char* period_pos = strchr(holder_expr, '.');
   if (period_pos == nullptr) {
     return Handle<JSObject>::cast(
@@ -3709,15 +3867,16 @@ static Handle<JSObject> ResolveBuiltinIdHolder(Handle<Context> native_context,
   Handle<String> property_string = factory->InternalizeUtf8String(property);
   DCHECK(!property_string.is_null());
   Handle<JSObject> object = Handle<JSObject>::cast(
-      JSReceiver::GetProperty(global, property_string).ToHandleChecked());
+      JSReceiver::GetProperty(isolate, global, property_string)
+          .ToHandleChecked());
   if (strcmp("prototype", inner) == 0) {
     Handle<JSFunction> function = Handle<JSFunction>::cast(object);
-    return Handle<JSObject>(JSObject::cast(function->prototype()));
+    return Handle<JSObject>(JSObject::cast(function->prototype()), isolate);
   }
   Handle<String> inner_string = factory->InternalizeUtf8String(inner);
   DCHECK(!inner_string.is_null());
   Handle<Object> value =
-      JSReceiver::GetProperty(object, inner_string).ToHandleChecked();
+      JSReceiver::GetProperty(isolate, object, inner_string).ToHandleChecked();
   return Handle<JSObject>::cast(value);
 }
 
@@ -3739,14 +3898,15 @@ void Genesis::ConfigureUtilsObject(GlobalContextType context_type) {
       if (natives_key->AsArrayIndex(&dummy_index)) break;
       Handle<Object> utils = isolate()->natives_utils_object();
       Handle<JSObject> global = isolate()->global_object();
-      JSObject::AddProperty(global, natives_key, utils, DONT_ENUM);
+      JSObject::AddProperty(isolate(), global, natives_key, utils, DONT_ENUM);
       break;
     }
   }
 
   // The utils object can be removed for cases that reach this point.
-  native_context()->set_natives_utils_object(heap()->undefined_value());
-  native_context()->set_extras_utils_object(heap()->undefined_value());
+  HeapObject* undefined = ReadOnlyRoots(heap()).undefined_value();
+  native_context()->set_natives_utils_object(undefined);
+  native_context()->set_extras_utils_object(undefined);
 }
 
 
@@ -3757,34 +3917,36 @@ void Bootstrapper::ExportFromRuntime(Isolate* isolate,
   Handle<Context> native_context = isolate->native_context();
 #define EXPORT_PRIVATE_SYMBOL(NAME)                                       \
   Handle<String> NAME##_name = factory->NewStringFromAsciiChecked(#NAME); \
-  JSObject::AddProperty(container, NAME##_name, factory->NAME(), NONE);
+  JSObject::AddProperty(isolate, container, NAME##_name, factory->NAME(), NONE);
   PRIVATE_SYMBOL_LIST(EXPORT_PRIVATE_SYMBOL)
 #undef EXPORT_PRIVATE_SYMBOL
 
 #define EXPORT_PUBLIC_SYMBOL(NAME, DESCRIPTION)                           \
   Handle<String> NAME##_name = factory->NewStringFromAsciiChecked(#NAME); \
-  JSObject::AddProperty(container, NAME##_name, factory->NAME(), NONE);
+  JSObject::AddProperty(isolate, container, NAME##_name, factory->NAME(), NONE);
   PUBLIC_SYMBOL_LIST(EXPORT_PUBLIC_SYMBOL)
   WELL_KNOWN_SYMBOL_LIST(EXPORT_PUBLIC_SYMBOL)
 #undef EXPORT_PUBLIC_SYMBOL
 
   Handle<JSObject> iterator_prototype(
-      native_context->initial_iterator_prototype());
+      native_context->initial_iterator_prototype(), isolate);
 
-  JSObject::AddProperty(container,
+  JSObject::AddProperty(isolate, container,
                         factory->InternalizeUtf8String("IteratorPrototype"),
                         iterator_prototype, NONE);
 
   {
     PrototypeIterator iter(native_context->generator_function_map());
-    Handle<JSObject> generator_function_prototype(iter.GetCurrent<JSObject>());
+    Handle<JSObject> generator_function_prototype(iter.GetCurrent<JSObject>(),
+                                                  isolate);
 
     JSObject::AddProperty(
-        container, factory->InternalizeUtf8String("GeneratorFunctionPrototype"),
+        isolate, container,
+        factory->InternalizeUtf8String("GeneratorFunctionPrototype"),
         generator_function_prototype, NONE);
 
     Handle<JSFunction> generator_function_function = InstallFunction(
-        container, "GeneratorFunction", JS_FUNCTION_TYPE,
+        isolate, container, "GeneratorFunction", JS_FUNCTION_TYPE,
         JSFunction::kSizeWithPrototype, 0, generator_function_prototype,
         Builtins::kGeneratorFunctionConstructor);
     generator_function_function->set_prototype_or_initial_map(
@@ -3798,7 +3960,7 @@ void Bootstrapper::ExportFromRuntime(Isolate* isolate,
     JSObject::ForceSetPrototype(generator_function_function,
                                 isolate->function_function());
     JSObject::AddProperty(
-        generator_function_prototype, factory->constructor_string(),
+        isolate, generator_function_prototype, factory->constructor_string(),
         generator_function_function,
         static_cast<PropertyAttributes>(DONT_ENUM | READ_ONLY));
 
@@ -3809,10 +3971,10 @@ void Bootstrapper::ExportFromRuntime(Isolate* isolate,
   {
     PrototypeIterator iter(native_context->async_generator_function_map());
     Handle<JSObject> async_generator_function_prototype(
-        iter.GetCurrent<JSObject>());
+        iter.GetCurrent<JSObject>(), isolate);
 
     Handle<JSFunction> async_generator_function_function = InstallFunction(
-        container, "AsyncGeneratorFunction", JS_FUNCTION_TYPE,
+        isolate, container, "AsyncGeneratorFunction", JS_FUNCTION_TYPE,
         JSFunction::kSizeWithPrototype, 0, async_generator_function_prototype,
         Builtins::kAsyncGeneratorFunctionConstructor);
     async_generator_function_function->set_prototype_or_initial_map(
@@ -3827,8 +3989,8 @@ void Bootstrapper::ExportFromRuntime(Isolate* isolate,
                                 isolate->function_function());
 
     JSObject::AddProperty(
-        async_generator_function_prototype, factory->constructor_string(),
-        async_generator_function_function,
+        isolate, async_generator_function_prototype,
+        factory->constructor_string(), async_generator_function_function,
         static_cast<PropertyAttributes>(DONT_ENUM | READ_ONLY));
 
     native_context->async_generator_function_map()->SetConstructor(
@@ -3845,26 +4007,26 @@ void Bootstrapper::ExportFromRuntime(Isolate* isolate,
 
     // Install the @@toStringTag property on the {prototype}.
     JSObject::AddProperty(
-        prototype, factory->to_string_tag_symbol(), name,
+        isolate, prototype, factory->to_string_tag_symbol(), name,
         static_cast<PropertyAttributes>(DONT_ENUM | READ_ONLY));
 
     // Install the next function on the {prototype}.
-    SimpleInstallFunction(prototype, "next",
+    SimpleInstallFunction(isolate, prototype, "next",
                           Builtins::kSetIteratorPrototypeNext, 0, true,
                           kSetIteratorNext);
 
     // Setup SetIterator constructor.
-    Handle<JSFunction> set_iterator_function =
-        InstallFunction(container, "SetIterator", JS_SET_VALUE_ITERATOR_TYPE,
-                        JSSetIterator::kSize, 0, prototype, Builtins::kIllegal);
+    Handle<JSFunction> set_iterator_function = InstallFunction(
+        isolate, container, "SetIterator", JS_SET_VALUE_ITERATOR_TYPE,
+        JSSetIterator::kSize, 0, prototype, Builtins::kIllegal);
     set_iterator_function->shared()->set_native(false);
 
     Handle<Map> set_value_iterator_map(set_iterator_function->initial_map(),
                                        isolate);
     native_context->set_set_value_iterator_map(*set_value_iterator_map);
 
-    Handle<Map> set_key_value_iterator_map =
-        Map::Copy(set_value_iterator_map, "JS_SET_KEY_VALUE_ITERATOR_TYPE");
+    Handle<Map> set_key_value_iterator_map = Map::Copy(
+        isolate, set_value_iterator_map, "JS_SET_KEY_VALUE_ITERATOR_TYPE");
     set_key_value_iterator_map->set_instance_type(
         JS_SET_KEY_VALUE_ITERATOR_TYPE);
     native_context->set_set_key_value_iterator_map(*set_key_value_iterator_map);
@@ -3880,150 +4042,44 @@ void Bootstrapper::ExportFromRuntime(Isolate* isolate,
 
     // Install the @@toStringTag property on the {prototype}.
     JSObject::AddProperty(
-        prototype, factory->to_string_tag_symbol(), name,
+        isolate, prototype, factory->to_string_tag_symbol(), name,
         static_cast<PropertyAttributes>(DONT_ENUM | READ_ONLY));
 
     // Install the next function on the {prototype}.
-    SimpleInstallFunction(prototype, "next",
+    SimpleInstallFunction(isolate, prototype, "next",
                           Builtins::kMapIteratorPrototypeNext, 0, true,
                           kMapIteratorNext);
 
     // Setup MapIterator constructor.
-    Handle<JSFunction> map_iterator_function =
-        InstallFunction(container, "MapIterator", JS_MAP_KEY_ITERATOR_TYPE,
-                        JSMapIterator::kSize, 0, prototype, Builtins::kIllegal);
+    Handle<JSFunction> map_iterator_function = InstallFunction(
+        isolate, container, "MapIterator", JS_MAP_KEY_ITERATOR_TYPE,
+        JSMapIterator::kSize, 0, prototype, Builtins::kIllegal);
     map_iterator_function->shared()->set_native(false);
 
     Handle<Map> map_key_iterator_map(map_iterator_function->initial_map(),
                                      isolate);
     native_context->set_map_key_iterator_map(*map_key_iterator_map);
 
-    Handle<Map> map_key_value_iterator_map =
-        Map::Copy(map_key_iterator_map, "JS_MAP_KEY_VALUE_ITERATOR_TYPE");
+    Handle<Map> map_key_value_iterator_map = Map::Copy(
+        isolate, map_key_iterator_map, "JS_MAP_KEY_VALUE_ITERATOR_TYPE");
     map_key_value_iterator_map->set_instance_type(
         JS_MAP_KEY_VALUE_ITERATOR_TYPE);
     native_context->set_map_key_value_iterator_map(*map_key_value_iterator_map);
 
     Handle<Map> map_value_iterator_map =
-        Map::Copy(map_key_iterator_map, "JS_MAP_VALUE_ITERATOR_TYPE");
+        Map::Copy(isolate, map_key_iterator_map, "JS_MAP_VALUE_ITERATOR_TYPE");
     map_value_iterator_map->set_instance_type(JS_MAP_VALUE_ITERATOR_TYPE);
     native_context->set_map_value_iterator_map(*map_value_iterator_map);
   }
 
-  {  // -- S c r i p t
-    Handle<String> name = factory->Script_string();
-    Handle<JSFunction> script_fun = InstallFunction(
-        container, name, JS_VALUE_TYPE, JSValue::kSize, 0,
-        factory->the_hole_value(), Builtins::kUnsupportedThrower, DONT_ENUM);
-    native_context->set_script_function(*script_fun);
-
-    Handle<Map> script_map = Handle<Map>(script_fun->initial_map());
-    Map::EnsureDescriptorSlack(script_map, 15);
-
-    PropertyAttributes attribs =
-        static_cast<PropertyAttributes>(DONT_ENUM | DONT_DELETE | READ_ONLY);
-
-    {  // column_offset
-      Handle<AccessorInfo> info = factory->script_column_offset_accessor();
-      Descriptor d = Descriptor::AccessorConstant(handle(info->name(), isolate),
-                                                  info, attribs);
-      script_map->AppendDescriptor(&d);
-    }
-
-    {  // id
-      Handle<AccessorInfo> info = factory->script_id_accessor();
-      Descriptor d = Descriptor::AccessorConstant(handle(info->name(), isolate),
-                                                  info, attribs);
-      script_map->AppendDescriptor(&d);
-    }
-
-    {  // name
-      Handle<AccessorInfo> info = factory->script_name_accessor();
-      Descriptor d = Descriptor::AccessorConstant(handle(info->name(), isolate),
-                                                  info, attribs);
-      script_map->AppendDescriptor(&d);
-    }
-
-    {  // line_offset
-      Handle<AccessorInfo> info = factory->script_line_offset_accessor();
-      Descriptor d = Descriptor::AccessorConstant(handle(info->name(), isolate),
-                                                  info, attribs);
-      script_map->AppendDescriptor(&d);
-    }
-
-    {  // source
-      Handle<AccessorInfo> info = factory->script_source_accessor();
-      Descriptor d = Descriptor::AccessorConstant(handle(info->name(), isolate),
-                                                  info, attribs);
-      script_map->AppendDescriptor(&d);
-    }
-
-    {  // type
-      Handle<AccessorInfo> info = factory->script_type_accessor();
-      Descriptor d = Descriptor::AccessorConstant(handle(info->name(), isolate),
-                                                  info, attribs);
-      script_map->AppendDescriptor(&d);
-    }
-
-    {  // compilation_type
-      Handle<AccessorInfo> info = factory->script_compilation_type_accessor();
-      Descriptor d = Descriptor::AccessorConstant(handle(info->name(), isolate),
-                                                  info, attribs);
-      script_map->AppendDescriptor(&d);
-    }
-
-    {  // context_data
-      Handle<AccessorInfo> info = factory->script_context_data_accessor();
-      Descriptor d = Descriptor::AccessorConstant(handle(info->name(), isolate),
-                                                  info, attribs);
-      script_map->AppendDescriptor(&d);
-    }
-
-    {  // eval_from_script
-      Handle<AccessorInfo> info = factory->script_eval_from_script_accessor();
-      Descriptor d = Descriptor::AccessorConstant(handle(info->name(), isolate),
-                                                  info, attribs);
-      script_map->AppendDescriptor(&d);
-    }
-
-    {  // eval_from_script_position
-      Handle<AccessorInfo> info =
-          factory->script_eval_from_script_position_accessor();
-      Descriptor d = Descriptor::AccessorConstant(handle(info->name(), isolate),
-                                                  info, attribs);
-      script_map->AppendDescriptor(&d);
-    }
-
-    {  // eval_from_function_name
-      Handle<AccessorInfo> info =
-          factory->script_eval_from_function_name_accessor();
-      Descriptor d = Descriptor::AccessorConstant(handle(info->name(), isolate),
-                                                  info, attribs);
-      script_map->AppendDescriptor(&d);
-    }
-
-    {  // source_url
-      Handle<AccessorInfo> info = factory->script_source_url_accessor();
-      Descriptor d = Descriptor::AccessorConstant(handle(info->name(), isolate),
-                                                  info, attribs);
-      script_map->AppendDescriptor(&d);
-    }
-
-    {  // source_mapping_url
-      Handle<AccessorInfo> info = factory->script_source_mapping_url_accessor();
-      Descriptor d = Descriptor::AccessorConstant(handle(info->name(), isolate),
-                                                  info, attribs);
-      script_map->AppendDescriptor(&d);
-    }
-  }
-
   {  // -- A s y n c F u n c t i o n
     // Builtin functions for AsyncFunction.
     PrototypeIterator iter(native_context->async_function_map());
-    Handle<JSObject> async_function_prototype(iter.GetCurrent<JSObject>());
+    Handle<JSObject> async_function_prototype(iter.GetCurrent<JSObject>(),
+                                              isolate);
 
     Handle<JSFunction> async_function_constructor = InstallFunction(
-        container, "AsyncFunction", JS_FUNCTION_TYPE,
+        isolate, container, "AsyncFunction", JS_FUNCTION_TYPE,
         JSFunction::kSizeWithPrototype, 0, async_function_prototype,
         Builtins::kAsyncFunctionConstructor);
     async_function_constructor->set_prototype_or_initial_map(
@@ -4035,7 +4091,7 @@ void Bootstrapper::ExportFromRuntime(Isolate* isolate,
                                 isolate->function_function());
 
     JSObject::AddProperty(
-        async_function_prototype, factory->constructor_string(),
+        isolate, async_function_prototype, factory->constructor_string(),
         async_function_constructor,
         static_cast<PropertyAttributes>(DONT_ENUM | READ_ONLY));
 
@@ -4080,7 +4136,7 @@ void Bootstrapper::ExportFromRuntime(Isolate* isolate,
     {
       Handle<JSFunction> function = SimpleCreateFunction(
           isolate, factory->empty_string(),
-          Builtins::kAsyncFunctionPromiseRelease, 1, false);
+          Builtins::kAsyncFunctionPromiseRelease, 2, false);
       native_context->set_async_function_promise_release(*function);
     }
   }
@@ -4093,15 +4149,15 @@ void Bootstrapper::ExportFromRuntime(Isolate* isolate,
     // CallSiteUtils::Construct to create CallSite objects.
 
     Handle<JSFunction> callsite_fun = InstallFunction(
-        container, "CallSite", JS_OBJECT_TYPE, JSObject::kHeaderSize, 0,
-        factory->the_hole_value(), Builtins::kUnsupportedThrower);
+        isolate, container, "CallSite", JS_OBJECT_TYPE, JSObject::kHeaderSize,
+        0, factory->the_hole_value(), Builtins::kUnsupportedThrower);
     callsite_fun->shared()->DontAdaptArguments();
     isolate->native_context()->set_callsite_function(*callsite_fun);
 
     {
       // Setup CallSite.prototype.
       Handle<JSObject> prototype(
-          JSObject::cast(callsite_fun->instance_prototype()));
+          JSObject::cast(callsite_fun->instance_prototype()), isolate);
 
       struct FunctionInfo {
         const char* name;
@@ -4132,28 +4188,11 @@ void Bootstrapper::ExportFromRuntime(Isolate* isolate,
 
       Handle<JSFunction> fun;
       for (const FunctionInfo& info : infos) {
-        SimpleInstallFunction(prototype, info.name, info.id, 0, true, attrs);
+        SimpleInstallFunction(isolate, prototype, info.name, info.id, 0, true,
+                              attrs);
       }
     }
   }
-
-#ifdef V8_INTL_SUPPORT
-  {  // I n t l  P l u r a l R u l e s
-    Handle<JSObject> plural_rules_prototype =
-        factory->NewJSObject(isolate->object_function(), TENURED);
-    // Install the @@toStringTag property on the {prototype}.
-    JSObject::AddProperty(
-        plural_rules_prototype, factory->to_string_tag_symbol(),
-        factory->Object_string(),
-        static_cast<PropertyAttributes>(DONT_ENUM | READ_ONLY));
-    Handle<JSFunction> plural_rules_constructor = InstallFunction(
-        container, "PluralRules", JS_OBJECT_TYPE, PluralRules::kSize, 0,
-        plural_rules_prototype, Builtins::kIllegal);
-    JSObject::AddProperty(plural_rules_prototype, factory->constructor_string(),
-                          plural_rules_constructor, DONT_ENUM);
-    native_context->set_intl_plural_rules_function(*plural_rules_constructor);
-  }
-#endif  // V8_INTL_SUPPORT
 }
 
 
@@ -4161,8 +4200,6 @@ void Bootstrapper::ExportFromRuntime(Isolate* isolate,
   void Genesis::InitializeGlobal_##id() {}
 
 EMPTY_INITIALIZE_GLOBAL_FOR_FEATURE(harmony_do_expressions)
-EMPTY_INITIALIZE_GLOBAL_FOR_FEATURE(harmony_regexp_named_captures)
-EMPTY_INITIALIZE_GLOBAL_FOR_FEATURE(harmony_regexp_property)
 EMPTY_INITIALIZE_GLOBAL_FOR_FEATURE(harmony_function_tostring)
 EMPTY_INITIALIZE_GLOBAL_FOR_FEATURE(harmony_public_fields)
 EMPTY_INITIALIZE_GLOBAL_FOR_FEATURE(harmony_private_fields)
@@ -4170,67 +4207,50 @@ EMPTY_INITIALIZE_GLOBAL_FOR_FEATURE(harmony_static_fields)
 EMPTY_INITIALIZE_GLOBAL_FOR_FEATURE(harmony_class_fields)
 EMPTY_INITIALIZE_GLOBAL_FOR_FEATURE(harmony_dynamic_import)
 EMPTY_INITIALIZE_GLOBAL_FOR_FEATURE(harmony_import_meta)
-EMPTY_INITIALIZE_GLOBAL_FOR_FEATURE(harmony_restrict_constructor_return)
-EMPTY_INITIALIZE_GLOBAL_FOR_FEATURE(harmony_optional_catch_binding)
-EMPTY_INITIALIZE_GLOBAL_FOR_FEATURE(harmony_subsume_json)
 EMPTY_INITIALIZE_GLOBAL_FOR_FEATURE(harmony_numeric_separator)
 
 #undef EMPTY_INITIALIZE_GLOBAL_FOR_FEATURE
 
-void InstallPublicSymbol(Factory* factory, Handle<Context> native_context,
-                         const char* name, Handle<Symbol> value) {
-  Handle<JSGlobalObject> global(
-      JSGlobalObject::cast(native_context->global_object()));
-  Handle<String> symbol_string = factory->InternalizeUtf8String("Symbol");
-  Handle<JSObject> symbol = Handle<JSObject>::cast(
-      JSObject::GetProperty(global, symbol_string).ToHandleChecked());
-  Handle<String> name_string = factory->InternalizeUtf8String(name);
-  PropertyAttributes attributes =
-      static_cast<PropertyAttributes>(DONT_ENUM | DONT_DELETE | READ_ONLY);
-  JSObject::AddProperty(symbol, name_string, value, attributes);
-}
-
 void Genesis::InitializeGlobal_harmony_sharedarraybuffer() {
   if (!FLAG_harmony_sharedarraybuffer) return;
 
-  Handle<JSGlobalObject> global(native_context()->global_object());
-  Isolate* isolate = global->GetIsolate();
-  Factory* factory = isolate->factory();
+  Handle<JSGlobalObject> global(native_context()->global_object(), isolate());
+  Factory* factory = isolate()->factory();
 
   {
     Handle<String> name = factory->InternalizeUtf8String("SharedArrayBuffer");
-    JSObject::AddProperty(global, name, isolate->shared_array_buffer_fun(),
-                          DONT_ENUM);
+    JSObject::AddProperty(isolate_, global, name,
+                          isolate()->shared_array_buffer_fun(), DONT_ENUM);
   }
 
   {
     Handle<String> name = factory->InternalizeUtf8String("Atomics");
-    JSObject::AddProperty(global, name, isolate->atomics_object(), DONT_ENUM);
+    JSObject::AddProperty(isolate_, global, name, isolate()->atomics_object(),
+                          DONT_ENUM);
     JSObject::AddProperty(
-        isolate->atomics_object(), factory->to_string_tag_symbol(), name,
-        static_cast<PropertyAttributes>(DONT_ENUM | READ_ONLY));
+        isolate_, isolate()->atomics_object(), factory->to_string_tag_symbol(),
+        name, static_cast<PropertyAttributes>(DONT_ENUM | READ_ONLY));
   }
 }
 
 void Genesis::InitializeGlobal_harmony_string_trimming() {
   if (!FLAG_harmony_string_trimming) return;
 
-  Handle<JSGlobalObject> global(native_context()->global_object());
-  Isolate* isolate = global->GetIsolate();
-  Factory* factory = isolate->factory();
+  Handle<JSGlobalObject> global(native_context()->global_object(), isolate());
+  Factory* factory = isolate()->factory();
 
   Handle<JSObject> string_prototype(
-      native_context()->initial_string_prototype());
+      native_context()->initial_string_prototype(), isolate());
 
   {
     Handle<String> trim_left_name = factory->InternalizeUtf8String("trimLeft");
     Handle<String> trim_start_name =
         factory->InternalizeUtf8String("trimStart");
     Handle<JSFunction> trim_left_fun = Handle<JSFunction>::cast(
-        JSObject::GetProperty(string_prototype, trim_left_name)
+        JSObject::GetProperty(isolate_, string_prototype, trim_left_name)
             .ToHandleChecked());
-    JSObject::AddProperty(string_prototype, trim_start_name, trim_left_fun,
-                          DONT_ENUM);
+    JSObject::AddProperty(isolate_, string_prototype, trim_start_name,
+                          trim_left_fun, DONT_ENUM);
     trim_left_fun->shared()->SetName(*trim_start_name);
   }
 
@@ -4239,73 +4259,91 @@ void Genesis::InitializeGlobal_harmony_string_trimming() {
         factory->InternalizeUtf8String("trimRight");
     Handle<String> trim_end_name = factory->InternalizeUtf8String("trimEnd");
     Handle<JSFunction> trim_right_fun = Handle<JSFunction>::cast(
-        JSObject::GetProperty(string_prototype, trim_right_name)
+        JSObject::GetProperty(isolate_, string_prototype, trim_right_name)
             .ToHandleChecked());
-    JSObject::AddProperty(string_prototype, trim_end_name, trim_right_fun,
-                          DONT_ENUM);
+    JSObject::AddProperty(isolate_, string_prototype, trim_end_name,
+                          trim_right_fun, DONT_ENUM);
     trim_right_fun->shared()->SetName(*trim_end_name);
   }
 }
 
 void Genesis::InitializeGlobal_harmony_array_prototype_values() {
   if (!FLAG_harmony_array_prototype_values) return;
-  Handle<JSFunction> array_constructor(native_context()->array_function());
+  Handle<JSFunction> array_constructor(native_context()->array_function(),
+                                       isolate());
   Handle<JSObject> array_prototype(
-      JSObject::cast(array_constructor->instance_prototype()));
+      JSObject::cast(array_constructor->instance_prototype()), isolate());
   Handle<Object> values_iterator =
-      JSObject::GetProperty(array_prototype, factory()->iterator_symbol())
+      JSObject::GetProperty(isolate(), array_prototype,
+                            factory()->iterator_symbol())
           .ToHandleChecked();
   DCHECK(values_iterator->IsJSFunction());
-  JSObject::AddProperty(array_prototype, factory()->values_string(),
+  JSObject::AddProperty(isolate(), array_prototype, factory()->values_string(),
                         values_iterator, DONT_ENUM);
 
   Handle<Object> unscopables =
-      JSObject::GetProperty(array_prototype, factory()->unscopables_symbol())
+      JSObject::GetProperty(isolate(), array_prototype,
+                            factory()->unscopables_symbol())
           .ToHandleChecked();
   DCHECK(unscopables->IsJSObject());
-  JSObject::AddProperty(Handle<JSObject>::cast(unscopables),
+  JSObject::AddProperty(isolate(), Handle<JSObject>::cast(unscopables),
                         factory()->values_string(), factory()->true_value(),
                         NONE);
 }
 
-void Genesis::InitializeGlobal_harmony_array_flatten() {
-  if (!FLAG_harmony_array_flatten) return;
-  Handle<JSFunction> array_constructor(native_context()->array_function());
+void Genesis::InitializeGlobal_harmony_array_flat() {
+  if (!FLAG_harmony_array_flat) return;
+  Handle<JSFunction> array_constructor(native_context()->array_function(),
+                                       isolate());
   Handle<JSObject> array_prototype(
-      JSObject::cast(array_constructor->instance_prototype()));
-  SimpleInstallFunction(array_prototype, "flatten",
-                        Builtins::kArrayPrototypeFlatten, 0, false, DONT_ENUM);
-  SimpleInstallFunction(array_prototype, "flatMap",
+      JSObject::cast(array_constructor->instance_prototype()), isolate());
+  SimpleInstallFunction(isolate(), array_prototype, "flat",
+                        Builtins::kArrayPrototypeFlat, 0, false, DONT_ENUM);
+  SimpleInstallFunction(isolate(), array_prototype, "flatMap",
                         Builtins::kArrayPrototypeFlatMap, 1, false, DONT_ENUM);
 }
 
+void Genesis::InitializeGlobal_harmony_symbol_description() {
+  if (!FLAG_harmony_symbol_description) return;
+
+  // Symbol.prototype.description
+  Handle<JSFunction> symbol_fun(native_context()->symbol_function(), isolate());
+  Handle<JSObject> symbol_prototype(
+      JSObject::cast(symbol_fun->instance_prototype()), isolate());
+  SimpleInstallGetter(isolate(), symbol_prototype,
+                      factory()->InternalizeUtf8String("description"),
+                      Builtins::kSymbolPrototypeDescriptionGetter, true);
+}
+
 void Genesis::InitializeGlobal_harmony_string_matchall() {
   if (!FLAG_harmony_string_matchall) return;
 
   {  // String.prototype.matchAll
-    Handle<JSFunction> string_fun(native_context()->string_function());
+    Handle<JSFunction> string_fun(native_context()->string_function(),
+                                  isolate());
     Handle<JSObject> string_prototype(
-        JSObject::cast(string_fun->instance_prototype()));
+        JSObject::cast(string_fun->instance_prototype()), isolate());
 
-    SimpleInstallFunction(string_prototype, "matchAll",
+    SimpleInstallFunction(isolate(), string_prototype, "matchAll",
                           Builtins::kStringPrototypeMatchAll, 1, true);
   }
 
   {  // RegExp.prototype[@@matchAll]
-    Handle<JSFunction> regexp_fun(native_context()->regexp_function());
+    Handle<JSFunction> regexp_fun(native_context()->regexp_function(),
+                                  isolate());
     Handle<JSObject> regexp_prototype(
-        JSObject::cast(regexp_fun->instance_prototype()));
-    SimpleInstallFunction(regexp_prototype, factory()->match_all_symbol(),
-                          "[Symbol.matchAll]",
+        JSObject::cast(regexp_fun->instance_prototype()), isolate());
+    SimpleInstallFunction(isolate(), regexp_prototype,
+                          factory()->match_all_symbol(), "[Symbol.matchAll]",
                           Builtins::kRegExpPrototypeMatchAll, 1, true);
-    Handle<Map> regexp_prototype_map(regexp_prototype->map());
+    Handle<Map> regexp_prototype_map(regexp_prototype->map(), isolate());
     Map::SetShouldBeFastPrototypeMap(regexp_prototype_map, true, isolate());
     native_context()->set_regexp_prototype_map(*regexp_prototype_map);
   }
 
   {  // --- R e g E x p S t r i n g  I t e r a t o r ---
     Handle<JSObject> iterator_prototype(
-        native_context()->initial_iterator_prototype());
+        native_context()->initial_iterator_prototype(), isolate());
 
     Handle<JSObject> regexp_string_iterator_prototype =
         factory()->NewJSObject(isolate()->object_function(), TENURED);
@@ -4313,11 +4351,12 @@ void Genesis::InitializeGlobal_harmony_string_matchall() {
                                 iterator_prototype);
 
     JSObject::AddProperty(
-        regexp_string_iterator_prototype, factory()->to_string_tag_symbol(),
+        isolate(), regexp_string_iterator_prototype,
+        factory()->to_string_tag_symbol(),
         factory()->NewStringFromAsciiChecked("RegExp String Iterator"),
         static_cast<PropertyAttributes>(DONT_ENUM | READ_ONLY));
 
-    SimpleInstallFunction(regexp_string_iterator_prototype, "next",
+    SimpleInstallFunction(isolate(), regexp_string_iterator_prototype, "next",
                           Builtins::kRegExpStringIteratorPrototypeNext, 0,
                           true);
 
@@ -4331,58 +4370,16 @@ void Genesis::InitializeGlobal_harmony_string_matchall() {
   }
 
   {  // @@matchAll Symbol
-    Handle<JSFunction> symbol_fun(native_context()->symbol_function());
+    Handle<JSFunction> symbol_fun(native_context()->symbol_function(),
+                                  isolate());
     InstallConstant(isolate(), symbol_fun, "matchAll",
                     factory()->match_all_symbol());
   }
 }
 
-void Genesis::InitializeGlobal_harmony_promise_finally() {
-  if (!FLAG_harmony_promise_finally) return;
-
-  Handle<JSFunction> constructor(native_context()->promise_function());
-  Handle<JSObject> prototype(JSObject::cast(constructor->instance_prototype()));
-  SimpleInstallFunction(prototype, "finally",
-                        Builtins::kPromisePrototypeFinally, 1, true, DONT_ENUM);
-
-  // The promise prototype map has changed because we added a property
-  // to prototype, so we update the saved map.
-  Handle<Map> prototype_map(prototype->map());
-  Map::SetShouldBeFastPrototypeMap(prototype_map, true, isolate());
-
-  {
-    Handle<SharedFunctionInfo> info = SimpleCreateSharedFunctionInfo(
-        isolate(), Builtins::kPromiseThenFinally, factory()->empty_string(), 1);
-    info->set_native(true);
-    native_context()->set_promise_then_finally_shared_fun(*info);
-  }
-
-  {
-    Handle<SharedFunctionInfo> info = SimpleCreateSharedFunctionInfo(
-        isolate(), Builtins::kPromiseCatchFinally, factory()->empty_string(),
-        1);
-    info->set_native(true);
-    native_context()->set_promise_catch_finally_shared_fun(*info);
-  }
-
-  {
-    Handle<SharedFunctionInfo> info = SimpleCreateSharedFunctionInfo(
-        isolate(), Builtins::kPromiseValueThunkFinally,
-        factory()->empty_string(), 0);
-    native_context()->set_promise_value_thunk_finally_shared_fun(*info);
-  }
-
-  {
-    Handle<SharedFunctionInfo> info = SimpleCreateSharedFunctionInfo(
-        isolate(), Builtins::kPromiseThrowerFinally, factory()->empty_string(),
-        0);
-    native_context()->set_promise_thrower_finally_shared_fun(*info);
-  }
-}
-
 void Genesis::InitializeGlobal_harmony_bigint() {
   Factory* factory = isolate()->factory();
-  Handle<JSGlobalObject> global(native_context()->global_object());
+  Handle<JSGlobalObject> global(native_context()->global_object(), isolate());
   if (!FLAG_harmony_bigint) {
     // Typed arrays are installed by default; remove them if the flag is off.
     CHECK(JSObject::DeleteProperty(
@@ -4394,42 +4391,41 @@ void Genesis::InitializeGlobal_harmony_bigint() {
     return;
   }
 
-  Handle<JSFunction> bigint_fun =
-      InstallFunction(global, "BigInt", JS_VALUE_TYPE, JSValue::kSize, 0,
-                      factory->the_hole_value(), Builtins::kBigIntConstructor);
+  Handle<JSFunction> bigint_fun = InstallFunction(
+      isolate(), global, "BigInt", JS_VALUE_TYPE, JSValue::kSize, 0,
+      factory->the_hole_value(), Builtins::kBigIntConstructor);
   bigint_fun->shared()->set_builtin_function_id(kBigIntConstructor);
   bigint_fun->shared()->DontAdaptArguments();
   bigint_fun->shared()->set_length(1);
   InstallWithIntrinsicDefaultProto(isolate(), bigint_fun,
                                    Context::BIGINT_FUNCTION_INDEX);
-  heap()->bigint_map()->SetConstructorFunctionIndex(
-      Context::BIGINT_FUNCTION_INDEX);
 
   // Install the properties of the BigInt constructor.
   // asUintN(bits, bigint)
-  SimpleInstallFunction(bigint_fun, "asUintN", Builtins::kBigIntAsUintN, 2,
-                        false);
+  SimpleInstallFunction(isolate(), bigint_fun, "asUintN",
+                        Builtins::kBigIntAsUintN, 2, false);
   // asIntN(bits, bigint)
-  SimpleInstallFunction(bigint_fun, "asIntN", Builtins::kBigIntAsIntN, 2,
-                        false);
+  SimpleInstallFunction(isolate(), bigint_fun, "asIntN",
+                        Builtins::kBigIntAsIntN, 2, false);
 
   // Set up the %BigIntPrototype%.
-  Handle<JSObject> prototype(JSObject::cast(bigint_fun->instance_prototype()));
+  Handle<JSObject> prototype(JSObject::cast(bigint_fun->instance_prototype()),
+                             isolate());
   JSFunction::SetPrototype(bigint_fun, prototype);
 
   // Install the properties of the BigInt.prototype.
   // "constructor" is created implicitly by InstallFunction() above.
   // toLocaleString([reserved1 [, reserved2]])
-  SimpleInstallFunction(prototype, "toLocaleString",
+  SimpleInstallFunction(isolate(), prototype, "toLocaleString",
                         Builtins::kBigIntPrototypeToLocaleString, 0, false);
   // toString([radix])
-  SimpleInstallFunction(prototype, "toString",
+  SimpleInstallFunction(isolate(), prototype, "toString",
                         Builtins::kBigIntPrototypeToString, 0, false);
   // valueOf()
-  SimpleInstallFunction(prototype, "valueOf", Builtins::kBigIntPrototypeValueOf,
-                        0, false);
+  SimpleInstallFunction(isolate(), prototype, "valueOf",
+                        Builtins::kBigIntPrototypeValueOf, 0, false);
   // @@toStringTag
-  JSObject::AddProperty(prototype, factory->to_string_tag_symbol(),
+  JSObject::AddProperty(isolate(), prototype, factory->to_string_tag_symbol(),
                         factory->BigInt_string(),
                         static_cast<PropertyAttributes>(DONT_ENUM | READ_ONLY));
 
@@ -4437,43 +4433,163 @@ void Genesis::InitializeGlobal_harmony_bigint() {
   // TODO(jkummerow): Move these to the "DataView" section when dropping the
   // FLAG_harmony_bigint.
   Handle<JSObject> dataview_prototype(
-      JSObject::cast(native_context()->data_view_fun()->instance_prototype()));
-  SimpleInstallFunction(dataview_prototype, "getBigInt64",
+      JSObject::cast(native_context()->data_view_fun()->instance_prototype()),
+      isolate());
+  SimpleInstallFunction(isolate(), dataview_prototype, "getBigInt64",
                         Builtins::kDataViewPrototypeGetBigInt64, 1, false);
-  SimpleInstallFunction(dataview_prototype, "setBigInt64",
+  SimpleInstallFunction(isolate(), dataview_prototype, "setBigInt64",
                         Builtins::kDataViewPrototypeSetBigInt64, 2, false);
-  SimpleInstallFunction(dataview_prototype, "getBigUint64",
+  SimpleInstallFunction(isolate(), dataview_prototype, "getBigUint64",
                         Builtins::kDataViewPrototypeGetBigUint64, 1, false);
-  SimpleInstallFunction(dataview_prototype, "setBigUint64",
+  SimpleInstallFunction(isolate(), dataview_prototype, "setBigUint64",
                         Builtins::kDataViewPrototypeSetBigUint64, 2, false);
 }
 
-#ifdef V8_INTL_SUPPORT
+void Genesis::InitializeGlobal_harmony_await_optimization() {
+  if (!FLAG_harmony_await_optimization) return;
+
+  // async/await
+  Handle<JSFunction> await_caught_function = SimpleCreateFunction(
+      isolate(), factory()->empty_string(),
+      Builtins::kAsyncFunctionAwaitCaughtOptimized, 2, false);
+  native_context()->set_async_function_await_caught(*await_caught_function);
+
+  Handle<JSFunction> await_uncaught_function = SimpleCreateFunction(
+      isolate(), factory()->empty_string(),
+      Builtins::kAsyncFunctionAwaitUncaughtOptimized, 2, false);
+  native_context()->set_async_function_await_uncaught(*await_uncaught_function);
+
+  // async generators
+  Handle<JSObject> async_iterator_prototype =
+      factory()->NewJSObject(isolate()->object_function(), TENURED);
+
+  SimpleInstallFunction(
+      isolate(), async_iterator_prototype, factory()->async_iterator_symbol(),
+      "[Symbol.asyncIterator]", Builtins::kReturnReceiver, 0, true);
+
+  Handle<JSObject> async_from_sync_iterator_prototype =
+      factory()->NewJSObject(isolate()->object_function(), TENURED);
+  SimpleInstallFunction(
+      isolate(), async_from_sync_iterator_prototype, factory()->next_string(),
+      Builtins::kAsyncFromSyncIteratorPrototypeNextOptimized, 1, true);
+  SimpleInstallFunction(
+      isolate(), async_from_sync_iterator_prototype, factory()->return_string(),
+      Builtins::kAsyncFromSyncIteratorPrototypeReturnOptimized, 1, true);
+  SimpleInstallFunction(
+      isolate(), async_from_sync_iterator_prototype, factory()->throw_string(),
+      Builtins::kAsyncFromSyncIteratorPrototypeThrowOptimized, 1, true);
 
-void Genesis::InitializeGlobal_harmony_number_format_to_parts() {
-  if (!FLAG_harmony_number_format_to_parts) return;
-  Handle<JSObject> number_format_prototype(JSObject::cast(
-      native_context()->intl_number_format_function()->prototype()));
-  Handle<String> name = factory()->InternalizeUtf8String("formatToParts");
-  InstallFunction(number_format_prototype,
-                  SimpleCreateFunction(
-                      isolate(), name,
-                      Builtins::kNumberFormatPrototypeFormatToParts, 1, false),
-                  name);
+  JSObject::AddProperty(
+      isolate(), async_from_sync_iterator_prototype,
+      factory()->to_string_tag_symbol(),
+      factory()->NewStringFromAsciiChecked("Async-from-Sync Iterator"),
+      static_cast<PropertyAttributes>(DONT_ENUM | READ_ONLY));
+
+  JSObject::ForceSetPrototype(async_from_sync_iterator_prototype,
+                              async_iterator_prototype);
+
+  Handle<Map> async_from_sync_iterator_map = factory()->NewMap(
+      JS_ASYNC_FROM_SYNC_ITERATOR_TYPE, JSAsyncFromSyncIterator::kSize);
+  Map::SetPrototype(isolate(), async_from_sync_iterator_map,
+                    async_from_sync_iterator_prototype);
+  native_context()->set_async_from_sync_iterator_map(
+      *async_from_sync_iterator_map);
 }
 
-void Genesis::InitializeGlobal_harmony_plural_rules() {
-  if (!FLAG_harmony_plural_rules) return;
+#ifdef V8_INTL_SUPPORT
+
+void Genesis::InitializeGlobal_harmony_locale() {
+  if (!FLAG_harmony_locale) return;
 
-  Handle<JSFunction> plural_rules(
-      native_context()->intl_plural_rules_function());
   Handle<JSObject> intl = Handle<JSObject>::cast(
       JSReceiver::GetProperty(
-          Handle<JSReceiver>(native_context()->global_object()),
+          isolate(),
+          Handle<JSReceiver>(native_context()->global_object(), isolate()),
           factory()->InternalizeUtf8String("Intl"))
           .ToHandleChecked());
-  JSObject::AddProperty(intl, factory()->InternalizeUtf8String("PluralRules"),
-                        plural_rules, DONT_ENUM);
+
+  Handle<JSFunction> locale_fun = InstallFunction(
+      isolate(), intl, "Locale", JS_INTL_LOCALE_TYPE, JSLocale::kSize, 0,
+      factory()->the_hole_value(), Builtins::kLocaleConstructor);
+  InstallWithIntrinsicDefaultProto(isolate(), locale_fun,
+                                   Context::INTL_LOCALE_FUNCTION_INDEX);
+  locale_fun->shared()->set_length(1);
+  locale_fun->shared()->DontAdaptArguments();
+
+  // Setup %LocalePrototype%.
+  Handle<JSObject> prototype(JSObject::cast(locale_fun->instance_prototype()),
+                             isolate());
+
+  // Install the @@toStringTag property on the {prototype}.
+  JSObject::AddProperty(isolate(), prototype, factory()->to_string_tag_symbol(),
+                        factory()->NewStringFromAsciiChecked("Locale"),
+                        static_cast<PropertyAttributes>(DONT_ENUM | READ_ONLY));
+
+  SimpleInstallFunction(isolate(), prototype, "toString",
+                        Builtins::kLocalePrototypeToString, 0, false);
+  // Base locale getters.
+  SimpleInstallGetter(isolate(), prototype,
+                      factory()->InternalizeUtf8String("language"),
+                      Builtins::kLocalePrototypeLanguage, true);
+  SimpleInstallGetter(isolate(), prototype,
+                      factory()->InternalizeUtf8String("script"),
+                      Builtins::kLocalePrototypeScript, true);
+  SimpleInstallGetter(isolate(), prototype,
+                      factory()->InternalizeUtf8String("region"),
+                      Builtins::kLocalePrototypeRegion, true);
+  SimpleInstallGetter(isolate(), prototype,
+                      factory()->InternalizeUtf8String("baseName"),
+                      Builtins::kLocalePrototypeBaseName, true);
+  // Unicode extension getters.
+  SimpleInstallGetter(isolate(), prototype,
+                      factory()->InternalizeUtf8String("calendar"),
+                      Builtins::kLocalePrototypeCalendar, true);
+  SimpleInstallGetter(isolate(), prototype,
+                      factory()->InternalizeUtf8String("caseFirst"),
+                      Builtins::kLocalePrototypeCaseFirst, true);
+  SimpleInstallGetter(isolate(), prototype,
+                      factory()->InternalizeUtf8String("collation"),
+                      Builtins::kLocalePrototypeCollation, true);
+  SimpleInstallGetter(isolate(), prototype,
+                      factory()->InternalizeUtf8String("hourCycle"),
+                      Builtins::kLocalePrototypeHourCycle, true);
+  SimpleInstallGetter(isolate(), prototype,
+                      factory()->InternalizeUtf8String("numeric"),
+                      Builtins::kLocalePrototypeNumeric, true);
+  SimpleInstallGetter(isolate(), prototype,
+                      factory()->InternalizeUtf8String("numberingSystem"),
+                      Builtins::kLocalePrototypeNumberingSystem, true);
+}
+
+void Genesis::InitializeGlobal_harmony_intl_relative_time_format() {
+  if (!FLAG_harmony_intl_relative_time_format) return;
+  Handle<JSObject> intl = Handle<JSObject>::cast(
+      JSReceiver::GetProperty(
+          isolate(),
+          Handle<JSReceiver>(native_context()->global_object(), isolate()),
+          factory()->InternalizeUtf8String("Intl"))
+          .ToHandleChecked());
+
+  Handle<JSFunction> relative_time_format_fun = InstallFunction(
+      isolate(), intl, "RelativeTimeFormat", JS_INTL_RELATIVE_TIME_FORMAT_TYPE,
+      JSRelativeTimeFormat::kSize, 0, factory()->the_hole_value(),
+      Builtins::kRelativeTimeFormatConstructor);
+  relative_time_format_fun->shared()->set_length(0);
+  relative_time_format_fun->shared()->DontAdaptArguments();
+
+  // Setup %RelativeTimeFormatPrototype%.
+  Handle<JSObject> prototype(
+      JSObject::cast(relative_time_format_fun->instance_prototype()),
+      isolate());
+
+  // Install the @@toStringTag property on the {prototype}.
+  JSObject::AddProperty(isolate(), prototype, factory()->to_string_tag_symbol(),
+                        factory()->Object_string(),
+                        static_cast<PropertyAttributes>(DONT_ENUM | READ_ONLY));
+
+  SimpleInstallFunction(isolate(), prototype, "resolvedOptions",
+                        Builtins::kRelativeTimeFormatPrototypeResolvedOptions,
+                        0, false);
 }
 
 #endif  // V8_INTL_SUPPORT
@@ -4484,7 +4600,8 @@ Handle<JSFunction> Genesis::CreateArrayBuffer(
   // Setup the {prototype} with the given {name} for @@toStringTag.
   Handle<JSObject> prototype =
       factory()->NewJSObject(isolate()->object_function(), TENURED);
-  JSObject::AddProperty(prototype, factory()->to_string_tag_symbol(), name,
+  JSObject::AddProperty(isolate(), prototype, factory()->to_string_tag_symbol(),
+                        name,
                         static_cast<PropertyAttributes>(DONT_ENUM | READ_ONLY));
 
   // Allocate the constructor with the given {prototype}.
@@ -4496,32 +4613,32 @@ Handle<JSFunction> Genesis::CreateArrayBuffer(
   array_buffer_fun->shared()->set_length(1);
 
   // Install the "constructor" property on the {prototype}.
-  JSObject::AddProperty(prototype, factory()->constructor_string(),
+  JSObject::AddProperty(isolate(), prototype, factory()->constructor_string(),
                         array_buffer_fun, DONT_ENUM);
 
   switch (array_buffer_kind) {
     case ARRAY_BUFFER:
-      SimpleInstallFunction(array_buffer_fun, factory()->isView_string(),
-                            Builtins::kArrayBufferIsView, 1, true, DONT_ENUM,
-                            kArrayBufferIsView);
+      SimpleInstallFunction(
+          isolate(), array_buffer_fun, factory()->isView_string(),
+          Builtins::kArrayBufferIsView, 1, true, DONT_ENUM, kArrayBufferIsView);
 
       // Install the "byteLength" getter on the {prototype}.
-      SimpleInstallGetter(prototype, factory()->byte_length_string(),
+      SimpleInstallGetter(isolate(), prototype, factory()->byte_length_string(),
                           Builtins::kArrayBufferPrototypeGetByteLength, false,
                           BuiltinFunctionId::kArrayBufferByteLength);
 
-      SimpleInstallFunction(prototype, "slice",
+      SimpleInstallFunction(isolate(), prototype, "slice",
                             Builtins::kArrayBufferPrototypeSlice, 2, true);
       break;
 
     case SHARED_ARRAY_BUFFER:
       // Install the "byteLength" getter on the {prototype}.
-      SimpleInstallGetter(prototype, factory()->byte_length_string(),
+      SimpleInstallGetter(isolate(), prototype, factory()->byte_length_string(),
                           Builtins::kSharedArrayBufferPrototypeGetByteLength,
                           false,
                           BuiltinFunctionId::kSharedArrayBufferByteLength);
 
-      SimpleInstallFunction(prototype, "slice",
+      SimpleInstallFunction(isolate(), prototype, "slice",
                             Builtins::kSharedArrayBufferPrototypeSlice, 2,
                             true);
       break;
@@ -4543,18 +4660,18 @@ Handle<JSFunction> Genesis::InstallInternalArray(Handle<JSObject> target,
   Handle<JSObject> prototype =
       factory()->NewJSObject(isolate()->object_function(), TENURED);
   Handle<JSFunction> array_function =
-      InstallFunction(target, name, JS_ARRAY_TYPE, JSArray::kSize, 0, prototype,
-                      Builtins::kInternalArrayConstructor);
+      InstallFunction(isolate(), target, name, JS_ARRAY_TYPE, JSArray::kSize, 0,
+                      prototype, Builtins::kInternalArrayConstructor);
 
   array_function->shared()->DontAdaptArguments();
 
-  Handle<Map> original_map(array_function->initial_map());
-  Handle<Map> initial_map = Map::Copy(original_map, "InternalArray");
+  Handle<Map> original_map(array_function->initial_map(), isolate());
+  Handle<Map> initial_map = Map::Copy(isolate(), original_map, "InternalArray");
   initial_map->set_elements_kind(elements_kind);
   JSFunction::SetInitialMap(array_function, initial_map, prototype);
 
   // Make "length" magic on instances.
-  Map::EnsureDescriptorSlack(initial_map, 1);
+  Map::EnsureDescriptorSlack(isolate(), initial_map, 1);
 
   PropertyAttributes attribs = static_cast<PropertyAttributes>(
       DONT_ENUM | DONT_DELETE);
@@ -4591,7 +4708,7 @@ bool Genesis::InstallNatives(GlobalContextType context_type) {
       SimpleCreateFunction(isolate(), factory()->empty_string(),
                            Builtins::kPromiseInternalConstructor, 1, true);
   promise_internal_constructor->shared()->set_native(false);
-  InstallFunction(extras_utils, promise_internal_constructor,
+  InstallFunction(isolate(), extras_utils, promise_internal_constructor,
                   factory()->NewStringFromAsciiChecked("createPromise"));
 
   // v8.rejectPromise(promise, reason)
@@ -4599,7 +4716,7 @@ bool Genesis::InstallNatives(GlobalContextType context_type) {
       SimpleCreateFunction(isolate(), factory()->empty_string(),
                            Builtins::kPromiseInternalReject, 2, true);
   promise_internal_reject->shared()->set_native(false);
-  InstallFunction(extras_utils, promise_internal_reject,
+  InstallFunction(isolate(), extras_utils, promise_internal_reject,
                   factory()->NewStringFromAsciiChecked("rejectPromise"));
 
   // v8.resolvePromise(promise, resolution)
@@ -4607,10 +4724,10 @@ bool Genesis::InstallNatives(GlobalContextType context_type) {
       SimpleCreateFunction(isolate(), factory()->empty_string(),
                            Builtins::kPromiseInternalResolve, 2, true);
   promise_internal_resolve->shared()->set_native(false);
-  InstallFunction(extras_utils, promise_internal_resolve,
+  InstallFunction(isolate(), extras_utils, promise_internal_resolve,
                   factory()->NewStringFromAsciiChecked("resolvePromise"));
 
-  InstallFunction(extras_utils, isolate()->is_promise(),
+  InstallFunction(isolate(), extras_utils, isolate()->is_promise(),
                   factory()->NewStringFromAsciiChecked("isPromise"));
 
   int builtin_index = Natives::GetDebuggerCount();
@@ -4663,7 +4780,8 @@ bool Genesis::InstallNatives(GlobalContextType context_type) {
   // Store the map for the %ObjectPrototype% after the natives has been compiled
   // and the Object function has been set up.
   {
-    Handle<JSFunction> object_function(native_context()->object_function());
+    Handle<JSFunction> object_function(native_context()->object_function(),
+                                       isolate());
     DCHECK(JSObject::cast(object_function->initial_map()->prototype())
                ->HasFastProperties());
     native_context()->set_object_function_prototype_map(
@@ -4672,7 +4790,8 @@ bool Genesis::InstallNatives(GlobalContextType context_type) {
 
   // Store the map for the %StringPrototype% after the natives has been compiled
   // and the String function has been set up.
-  Handle<JSFunction> string_function(native_context()->string_function());
+  Handle<JSFunction> string_function(native_context()->string_function(),
+                                     isolate());
   JSObject* string_function_prototype =
       JSObject::cast(string_function->initial_map()->prototype());
   DCHECK(string_function_prototype->HasFastProperties());
@@ -4680,54 +4799,56 @@ bool Genesis::InstallNatives(GlobalContextType context_type) {
       string_function_prototype->map());
 
   Handle<JSGlobalObject> global_object =
-      handle(native_context()->global_object());
+      handle(native_context()->global_object(), isolate());
 
   // Install Global.decodeURI.
-  SimpleInstallFunction(global_object, "decodeURI", Builtins::kGlobalDecodeURI,
-                        1, false, kGlobalDecodeURI);
+  SimpleInstallFunction(isolate(), global_object, "decodeURI",
+                        Builtins::kGlobalDecodeURI, 1, false, kGlobalDecodeURI);
 
   // Install Global.decodeURIComponent.
-  SimpleInstallFunction(global_object, "decodeURIComponent",
+  SimpleInstallFunction(isolate(), global_object, "decodeURIComponent",
                         Builtins::kGlobalDecodeURIComponent, 1, false,
                         kGlobalDecodeURIComponent);
 
   // Install Global.encodeURI.
-  SimpleInstallFunction(global_object, "encodeURI", Builtins::kGlobalEncodeURI,
-                        1, false, kGlobalEncodeURI);
+  SimpleInstallFunction(isolate(), global_object, "encodeURI",
+                        Builtins::kGlobalEncodeURI, 1, false, kGlobalEncodeURI);
 
   // Install Global.encodeURIComponent.
-  SimpleInstallFunction(global_object, "encodeURIComponent",
+  SimpleInstallFunction(isolate(), global_object, "encodeURIComponent",
                         Builtins::kGlobalEncodeURIComponent, 1, false,
                         kGlobalEncodeURIComponent);
 
   // Install Global.escape.
-  SimpleInstallFunction(global_object, "escape", Builtins::kGlobalEscape, 1,
-                        false, kGlobalEscape);
+  SimpleInstallFunction(isolate(), global_object, "escape",
+                        Builtins::kGlobalEscape, 1, false, kGlobalEscape);
 
   // Install Global.unescape.
-  SimpleInstallFunction(global_object, "unescape", Builtins::kGlobalUnescape, 1,
-                        false, kGlobalUnescape);
+  SimpleInstallFunction(isolate(), global_object, "unescape",
+                        Builtins::kGlobalUnescape, 1, false, kGlobalUnescape);
 
   // Install Global.eval.
   {
-    Handle<JSFunction> eval =
-        SimpleInstallFunction(global_object, factory()->eval_string(),
-                              Builtins::kGlobalEval, 1, false);
+    Handle<JSFunction> eval = SimpleInstallFunction(
+        isolate(), global_object, factory()->eval_string(),
+        Builtins::kGlobalEval, 1, false);
     native_context()->set_global_eval_fun(*eval);
   }
 
   // Install Global.isFinite
-  SimpleInstallFunction(global_object, "isFinite", Builtins::kGlobalIsFinite, 1,
-                        true, kGlobalIsFinite);
+  SimpleInstallFunction(isolate(), global_object, "isFinite",
+                        Builtins::kGlobalIsFinite, 1, true, kGlobalIsFinite);
 
   // Install Global.isNaN
-  SimpleInstallFunction(global_object, "isNaN", Builtins::kGlobalIsNaN, 1, true,
-                        kGlobalIsNaN);
+  SimpleInstallFunction(isolate(), global_object, "isNaN",
+                        Builtins::kGlobalIsNaN, 1, true, kGlobalIsNaN);
 
   // Install Array builtin functions.
   {
-    Handle<JSFunction> array_constructor(native_context()->array_function());
-    Handle<JSArray> proto(JSArray::cast(array_constructor->prototype()));
+    Handle<JSFunction> array_constructor(native_context()->array_function(),
+                                         isolate());
+    Handle<JSArray> proto(JSArray::cast(array_constructor->prototype()),
+                          isolate());
 
     // Verification of important array prototype properties.
     Object* length = proto->length();
@@ -4736,15 +4857,17 @@ bool Genesis::InstallNatives(GlobalContextType context_type) {
     CHECK(proto->HasSmiOrObjectElements());
     // This is necessary to enable fast checks for absence of elements
     // on Array.prototype and below.
-    proto->set_elements(heap()->empty_fixed_array());
+    proto->set_elements(ReadOnlyRoots(heap()).empty_fixed_array());
   }
 
   // Install InternalArray.prototype.concat
   {
     Handle<JSFunction> array_constructor(
-        native_context()->internal_array_function());
-    Handle<JSObject> proto(JSObject::cast(array_constructor->prototype()));
-    SimpleInstallFunction(proto, "concat", Builtins::kArrayConcat, 1, false);
+        native_context()->internal_array_function(), isolate());
+    Handle<JSObject> proto(JSObject::cast(array_constructor->prototype()),
+                           isolate());
+    SimpleInstallFunction(isolate(), proto, "concat", Builtins::kArrayConcat, 1,
+                          false);
   }
 
   InstallBuiltinFunctionIds();
@@ -4757,7 +4880,7 @@ bool Genesis::InstallNatives(GlobalContextType context_type) {
         factory()->NewMap(JS_OBJECT_TYPE, JSAccessorPropertyDescriptor::kSize,
                           TERMINAL_FAST_ELEMENTS_KIND, 4);
     // Create the descriptor array for the property descriptor object.
-    Map::EnsureDescriptorSlack(map, 4);
+    Map::EnsureDescriptorSlack(isolate(), map, 4);
 
     {  // get
       Descriptor d = Descriptor::DataField(
@@ -4786,7 +4909,7 @@ bool Genesis::InstallNatives(GlobalContextType context_type) {
       map->AppendDescriptor(&d);
     }
 
-    Map::SetPrototype(map, isolate()->initial_object_prototype());
+    Map::SetPrototype(isolate(), map, isolate()->initial_object_prototype());
     map->SetConstructor(native_context()->object_function());
 
     native_context()->set_accessor_property_descriptor_map(*map);
@@ -4801,7 +4924,7 @@ bool Genesis::InstallNatives(GlobalContextType context_type) {
         factory()->NewMap(JS_OBJECT_TYPE, JSDataPropertyDescriptor::kSize,
                           TERMINAL_FAST_ELEMENTS_KIND, 4);
     // Create the descriptor array for the property descriptor object.
-    Map::EnsureDescriptorSlack(map, 4);
+    Map::EnsureDescriptorSlack(isolate(), map, 4);
 
     {  // value
       Descriptor d = Descriptor::DataField(
@@ -4831,7 +4954,7 @@ bool Genesis::InstallNatives(GlobalContextType context_type) {
       map->AppendDescriptor(&d);
     }
 
-    Map::SetPrototype(map, isolate()->initial_object_prototype());
+    Map::SetPrototype(isolate(), map, isolate()->initial_object_prototype());
     map->SetConstructor(native_context()->object_function());
 
     native_context()->set_data_property_descriptor_map(*map);
@@ -4843,9 +4966,10 @@ bool Genesis::InstallNatives(GlobalContextType context_type) {
     // JSRegExpResult initial map.
 
     // Find global.Array.prototype to inherit from.
-    Handle<JSFunction> array_constructor(native_context()->array_function());
+    Handle<JSFunction> array_constructor(native_context()->array_function(),
+                                         isolate());
     Handle<JSObject> array_prototype(
-        JSObject::cast(array_constructor->instance_prototype()));
+        JSObject::cast(array_constructor->instance_prototype()), isolate());
 
     // Add initial map.
     Handle<Map> initial_map = factory()->NewMap(
@@ -4855,24 +4979,24 @@ bool Genesis::InstallNatives(GlobalContextType context_type) {
 
     // Set prototype on map.
     initial_map->set_has_non_instance_prototype(false);
-    Map::SetPrototype(initial_map, array_prototype);
+    Map::SetPrototype(isolate(), initial_map, array_prototype);
 
     // Update map with length accessor from Array and add "index", "input" and
     // "groups".
-    Map::EnsureDescriptorSlack(initial_map,
+    Map::EnsureDescriptorSlack(isolate(), initial_map,
                                JSRegExpResult::kInObjectPropertyCount + 1);
 
     // length descriptor.
     {
       JSFunction* array_function = native_context()->array_function();
       Handle<DescriptorArray> array_descriptors(
-          array_function->initial_map()->instance_descriptors());
+          array_function->initial_map()->instance_descriptors(), isolate());
       Handle<String> length = factory()->length_string();
       int old = array_descriptors->SearchWithCache(
           isolate(), *length, array_function->initial_map());
       DCHECK_NE(old, DescriptorArray::kNotFound);
       Descriptor d = Descriptor::AccessorConstant(
-          length, handle(array_descriptors->GetValue(old), isolate()),
+          length, handle(array_descriptors->GetStrongValue(old), isolate()),
           array_descriptors->GetDetails(old).attributes());
       initial_map->AppendDescriptor(&d);
     }
@@ -4912,29 +5036,31 @@ bool Genesis::InstallNatives(GlobalContextType context_type) {
     {
       Descriptor d = Descriptor::AccessorConstant(factory()->iterator_symbol(),
                                                   arguments_iterator, attribs);
-      Handle<Map> map(native_context()->sloppy_arguments_map());
-      Map::EnsureDescriptorSlack(map, 1);
+      Handle<Map> map(native_context()->sloppy_arguments_map(), isolate());
+      Map::EnsureDescriptorSlack(isolate(), map, 1);
       map->AppendDescriptor(&d);
     }
     {
       Descriptor d = Descriptor::AccessorConstant(factory()->iterator_symbol(),
                                                   arguments_iterator, attribs);
-      Handle<Map> map(native_context()->fast_aliased_arguments_map());
-      Map::EnsureDescriptorSlack(map, 1);
+      Handle<Map> map(native_context()->fast_aliased_arguments_map(),
+                      isolate());
+      Map::EnsureDescriptorSlack(isolate(), map, 1);
       map->AppendDescriptor(&d);
     }
     {
       Descriptor d = Descriptor::AccessorConstant(factory()->iterator_symbol(),
                                                   arguments_iterator, attribs);
-      Handle<Map> map(native_context()->slow_aliased_arguments_map());
-      Map::EnsureDescriptorSlack(map, 1);
+      Handle<Map> map(native_context()->slow_aliased_arguments_map(),
+                      isolate());
+      Map::EnsureDescriptorSlack(isolate(), map, 1);
       map->AppendDescriptor(&d);
     }
     {
       Descriptor d = Descriptor::AccessorConstant(factory()->iterator_symbol(),
                                                   arguments_iterator, attribs);
-      Handle<Map> map(native_context()->strict_arguments_map());
-      Map::EnsureDescriptorSlack(map, 1);
+      Handle<Map> map(native_context()->strict_arguments_map(), isolate());
+      Map::EnsureDescriptorSlack(isolate(), map, 1);
       map->AppendDescriptor(&d);
     }
   }
@@ -4976,11 +5102,9 @@ bool Genesis::InstallDebuggerNatives() {
   return true;
 }
 
-
-static void InstallBuiltinFunctionId(Handle<JSObject> holder,
+static void InstallBuiltinFunctionId(Isolate* isolate, Handle<JSObject> holder,
                                      const char* function_name,
                                      BuiltinFunctionId id) {
-  Isolate* isolate = holder->GetIsolate();
   Handle<Object> function_object =
       JSReceiver::GetProperty(isolate, holder, function_name).ToHandleChecked();
   Handle<JSFunction> function = Handle<JSFunction>::cast(function_object);
@@ -5005,9 +5129,9 @@ void Genesis::InstallBuiltinFunctionIds() {
       FUNCTIONS_WITH_ID_LIST(INSTALL_BUILTIN_ID)};
 
   for (const BuiltinFunctionIds& builtin : builtins) {
-    Handle<JSObject> holder =
-        ResolveBuiltinIdHolder(native_context(), builtin.holder_expr);
-    InstallBuiltinFunctionId(holder, builtin.fun_name, builtin.id);
+    Handle<JSObject> holder = ResolveBuiltinIdHolder(
+        isolate(), native_context(), builtin.holder_expr);
+    InstallBuiltinFunctionId(isolate(), holder, builtin.fun_name, builtin.id);
   }
 }
 
@@ -5022,19 +5146,17 @@ void Genesis::InitializeNormalizedMapCaches() {
 
 bool Bootstrapper::InstallExtensions(Handle<Context> native_context,
                                      v8::ExtensionConfiguration* extensions) {
+  // Don't install extensions into the snapshot.
+  if (isolate_->serializer_enabled()) return true;
   BootstrapperActive active(this);
   SaveContext saved_context(isolate_);
   isolate_->set_context(*native_context);
-  return Genesis::InstallExtensions(native_context, extensions) &&
-      Genesis::InstallSpecialObjects(native_context);
+  return Genesis::InstallExtensions(isolate_, native_context, extensions) &&
+         Genesis::InstallSpecialObjects(isolate_, native_context);
 }
 
-
-bool Genesis::InstallSpecialObjects(Handle<Context> native_context) {
-  Isolate* isolate = native_context->GetIsolate();
-  // Don't install extensions into the snapshot.
-  if (isolate->serializer_enabled()) return true;
-
+bool Genesis::InstallSpecialObjects(Isolate* isolate,
+                                    Handle<Context> native_context) {
   Factory* factory = isolate->factory();
   HandleScope scope(isolate);
 
@@ -5042,7 +5164,7 @@ bool Genesis::InstallSpecialObjects(Handle<Context> native_context) {
   Handle<String> name =
       factory->InternalizeOneByteString(STATIC_CHAR_VECTOR("stackTraceLimit"));
   Handle<Smi> stack_trace_limit(Smi::FromInt(FLAG_stack_trace_limit), isolate);
-  JSObject::AddProperty(Error, name, stack_trace_limit, NONE);
+  JSObject::AddProperty(isolate, Error, name, stack_trace_limit, NONE);
 
   if (FLAG_expose_wasm) {
     // Install the internal data structures into the isolate and expose on
@@ -5080,10 +5202,9 @@ void Genesis::ExtensionStates::set_state(RegisteredExtension* extension,
       reinterpret_cast<void*>(static_cast<intptr_t>(state));
 }
 
-
-bool Genesis::InstallExtensions(Handle<Context> native_context,
+bool Genesis::InstallExtensions(Isolate* isolate,
+                                Handle<Context> native_context,
                                 v8::ExtensionConfiguration* extensions) {
-  Isolate* isolate = native_context->GetIsolate();
   ExtensionStates extension_states;  // All extensions have state UNVISITED.
   return InstallAutoExtensions(isolate, &extension_states) &&
          (!FLAG_expose_free_buffer ||
@@ -5187,9 +5308,9 @@ bool Genesis::InstallExtension(Isolate* isolate,
 bool Genesis::ConfigureGlobalObjects(
     v8::Local<v8::ObjectTemplate> global_proxy_template) {
   Handle<JSObject> global_proxy(
-      JSObject::cast(native_context()->global_proxy()));
+      JSObject::cast(native_context()->global_proxy()), isolate());
   Handle<JSObject> global_object(
-      JSObject::cast(native_context()->global_object()));
+      JSObject::cast(native_context()->global_object()), isolate());
 
   if (!global_proxy_template.IsEmpty()) {
     // Configure the global proxy object.
@@ -5199,10 +5320,12 @@ bool Genesis::ConfigureGlobalObjects(
 
     // Configure the global object.
     Handle<FunctionTemplateInfo> proxy_constructor(
-        FunctionTemplateInfo::cast(global_proxy_data->constructor()));
+        FunctionTemplateInfo::cast(global_proxy_data->constructor()),
+        isolate());
     if (!proxy_constructor->prototype_template()->IsUndefined(isolate())) {
       Handle<ObjectTemplateInfo> global_object_data(
-          ObjectTemplateInfo::cast(proxy_constructor->prototype_template()));
+          ObjectTemplateInfo::cast(proxy_constructor->prototype_template()),
+          isolate());
       if (!ConfigureApiObject(global_object, global_object_data)) return false;
     }
   }
@@ -5212,8 +5335,8 @@ bool Genesis::ConfigureGlobalObjects(
   native_context()->set_array_buffer_map(
       native_context()->array_buffer_fun()->initial_map());
 
-  Handle<JSFunction> js_map_fun(native_context()->js_map_fun());
-  Handle<JSFunction> js_set_fun(native_context()->js_set_fun());
+  Handle<JSFunction> js_map_fun(native_context()->js_map_fun(), isolate());
+  Handle<JSFunction> js_set_fun(native_context()->js_set_fun(), isolate());
   // Force the Map/Set constructor to fast properties, so that we can use the
   // fast paths for various things like
   //
@@ -5228,11 +5351,6 @@ bool Genesis::ConfigureGlobalObjects(
   native_context()->set_js_map_map(js_map_fun->initial_map());
   native_context()->set_js_set_map(js_set_fun->initial_map());
 
-  Handle<JSFunction> js_array_constructor(native_context()->array_function());
-  Handle<JSObject> js_array_prototype(
-      JSObject::cast(js_array_constructor->instance_prototype()));
-  native_context()->set_initial_array_prototype_map(js_array_prototype->map());
-
   return true;
 }
 
@@ -5244,7 +5362,7 @@ bool Genesis::ConfigureApiObject(Handle<JSObject> object,
              ->IsTemplateFor(object->map()));;
 
   MaybeHandle<JSObject> maybe_obj =
-      ApiNatives::InstantiateObject(object_template);
+      ApiNatives::InstantiateObject(object->GetIsolate(), object_template);
   Handle<JSObject> obj;
   if (!maybe_obj.ToHandle(&obj)) {
     DCHECK(isolate()->has_pending_exception());
@@ -5265,17 +5383,18 @@ void Genesis::TransferNamedProperties(Handle<JSObject> from,
   // in the snapshotted global object.
   if (from->HasFastProperties()) {
     Handle<DescriptorArray> descs =
-        Handle<DescriptorArray>(from->map()->instance_descriptors());
+        Handle<DescriptorArray>(from->map()->instance_descriptors(), isolate());
     for (int i = 0; i < from->map()->NumberOfOwnDescriptors(); i++) {
       PropertyDetails details = descs->GetDetails(i);
       if (details.location() == kField) {
         if (details.kind() == kData) {
           HandleScope inner(isolate());
-          Handle<Name> key = Handle<Name>(descs->GetKey(i));
+          Handle<Name> key = Handle<Name>(descs->GetKey(i), isolate());
           FieldIndex index = FieldIndex::ForDescriptor(from->map(), i);
           Handle<Object> value =
               JSObject::FastPropertyAt(from, details.representation(), index);
-          JSObject::AddProperty(to, key, value, details.attributes());
+          JSObject::AddProperty(isolate(), to, key, value,
+                                details.attributes());
         } else {
           DCHECK_EQ(kAccessor, details.kind());
           UNREACHABLE();
@@ -5286,13 +5405,13 @@ void Genesis::TransferNamedProperties(Handle<JSObject> from,
         if (details.kind() == kData) {
           DCHECK(!FLAG_track_constant_fields);
           HandleScope inner(isolate());
-          Handle<Name> key = Handle<Name>(descs->GetKey(i));
-          Handle<Object> value(descs->GetValue(i), isolate());
-          JSObject::AddProperty(to, key, value, details.attributes());
-
+          Handle<Name> key = Handle<Name>(descs->GetKey(i), isolate());
+          Handle<Object> value(descs->GetStrongValue(i), isolate());
+          JSObject::AddProperty(isolate(), to, key, value,
+                                details.attributes());
         } else {
           DCHECK_EQ(kAccessor, details.kind());
-          Handle<Name> key(descs->GetKey(i));
+          Handle<Name> key(descs->GetKey(i), isolate());
           LookupIterator it(to, key, LookupIterator::OWN_SKIP_INTERCEPTOR);
           CHECK_NE(LookupIterator::ACCESS_CHECK, it.state());
           // If the property is already there we skip it
@@ -5300,7 +5419,7 @@ void Genesis::TransferNamedProperties(Handle<JSObject> from,
           HandleScope inner(isolate());
           DCHECK(!to->HasFastProperties());
           // Add to dictionary.
-          Handle<Object> value(descs->GetValue(i), isolate());
+          Handle<Object> value(descs->GetStrongValue(i), isolate());
           PropertyDetails d(kAccessor, details.attributes(),
                             PropertyCellType::kMutable);
           JSObject::SetNormalizedProperty(to, key, value, d);
@@ -5310,12 +5429,12 @@ void Genesis::TransferNamedProperties(Handle<JSObject> from,
   } else if (from->IsJSGlobalObject()) {
     // Copy all keys and values in enumeration order.
     Handle<GlobalDictionary> properties(
-        JSGlobalObject::cast(*from)->global_dictionary());
+        JSGlobalObject::cast(*from)->global_dictionary(), isolate());
     Handle<FixedArray> indices = GlobalDictionary::IterationIndices(properties);
     for (int i = 0; i < indices->length(); i++) {
       int index = Smi::ToInt(indices->get(i));
       // If the property is already there we skip it.
-      Handle<PropertyCell> cell(properties->CellAt(index));
+      Handle<PropertyCell> cell(properties->CellAt(index), isolate());
       Handle<Name> key(cell->name(), isolate());
       LookupIterator it(to, key, LookupIterator::OWN_SKIP_INTERCEPTOR);
       CHECK_NE(LookupIterator::ACCESS_CHECK, it.state());
@@ -5325,12 +5444,12 @@ void Genesis::TransferNamedProperties(Handle<JSObject> from,
       if (value->IsTheHole(isolate())) continue;
       PropertyDetails details = cell->property_details();
       if (details.kind() != kData) continue;
-      JSObject::AddProperty(to, key, value, details.attributes());
+      JSObject::AddProperty(isolate(), to, key, value, details.attributes());
     }
   } else {
     // Copy all keys and values in enumeration order.
     Handle<NameDictionary> properties =
-        Handle<NameDictionary>(from->property_dictionary());
+        Handle<NameDictionary>(from->property_dictionary(), isolate());
     Handle<FixedArray> key_indices =
         NameDictionary::IterationIndices(properties);
     for (int i = 0; i < key_indices->length(); i++) {
@@ -5350,7 +5469,7 @@ void Genesis::TransferNamedProperties(Handle<JSObject> from,
       DCHECK(!value->IsTheHole(isolate()));
       PropertyDetails details = properties->DetailsAt(key_index);
       DCHECK_EQ(kData, details.kind());
-      JSObject::AddProperty(to, key, value, details.attributes());
+      JSObject::AddProperty(isolate(), to, key, value, details.attributes());
     }
   }
 }
@@ -5360,7 +5479,7 @@ void Genesis::TransferIndexedProperties(Handle<JSObject> from,
                                         Handle<JSObject> to) {
   // Cloning the elements array is sufficient.
   Handle<FixedArray> from_elements =
-      Handle<FixedArray>(FixedArray::cast(from->elements()));
+      Handle<FixedArray>(FixedArray::cast(from->elements()), isolate());
   Handle<FixedArray> to_elements = factory()->CopyFixedArray(from_elements);
   to->set_elements(*to_elements);
 }
@@ -5430,7 +5549,7 @@ Genesis::Genesis(
   }
 
   if (!native_context().is_null()) {
-    AddToWeakNativeContextList(*native_context());
+    AddToWeakNativeContextList(isolate, *native_context());
     isolate->set_context(*native_context());
     isolate->counters()->contexts_created_by_snapshot()->Increment();
 
@@ -5451,7 +5570,7 @@ Genesis::Genesis(
     DCHECK_EQ(0u, context_snapshot_index);
     // We get here if there was no context snapshot.
     CreateRoots();
-    Handle<JSFunction> empty_function = CreateEmptyFunction(isolate);
+    Handle<JSFunction> empty_function = CreateEmptyFunction();
     CreateSloppyModeFunctionMaps(empty_function);
     CreateStrictModeFunctionMaps(empty_function);
     CreateObjectFunction(empty_function);
@@ -5488,7 +5607,8 @@ Genesis::Genesis(
 
       // Store String.prototype's map again in case it has been changed by
       // experimental natives.
-      Handle<JSFunction> string_function(native_context()->string_function());
+      Handle<JSFunction> string_function(native_context()->string_function(),
+                                         isolate);
       JSObject* string_function_prototype =
           JSObject::cast(string_function->initial_map()->prototype());
       DCHECK(string_function_prototype->HasFastProperties());
@@ -5503,7 +5623,7 @@ Genesis::Genesis(
 
   if (FLAG_disallow_code_generation_from_strings) {
     native_context()->set_allow_code_gen_from_strings(
-        isolate->heap()->false_value());
+        ReadOnlyRoots(isolate).false_value());
   }
 
   ConfigureUtilsObject(context_type);
@@ -5540,10 +5660,11 @@ Genesis::Genesis(Isolate* isolate,
   Handle<ObjectTemplateInfo> global_proxy_data =
       Utils::OpenHandle(*global_proxy_template);
   Handle<FunctionTemplateInfo> global_constructor(
-      FunctionTemplateInfo::cast(global_proxy_data->constructor()));
+      FunctionTemplateInfo::cast(global_proxy_data->constructor()), isolate);
 
   Handle<ObjectTemplateInfo> global_object_template(
-      ObjectTemplateInfo::cast(global_constructor->prototype_template()));
+      ObjectTemplateInfo::cast(global_constructor->prototype_template()),
+      isolate);
   Handle<JSObject> global_object =
       ApiNatives::InstantiateRemoteObject(
           global_object_template).ToHandleChecked();
@@ -5558,7 +5679,7 @@ Genesis::Genesis(Isolate* isolate,
   global_proxy_map->set_may_have_interesting_symbols(true);
 
   // A remote global proxy has no native context.
-  global_proxy->set_native_context(heap()->null_value());
+  global_proxy->set_native_context(ReadOnlyRoots(heap()).null_value());
 
   // Configure the hidden prototype chain of the global proxy.
   JSObject::ForceSetPrototype(global_proxy, global_object);
diff --git a/deps/v8/src/bootstrapper.h b/deps/v8/src/bootstrapper.h
index 8902ce252952d7..e3ba8c06f2149f 100644
--- a/deps/v8/src/bootstrapper.h
+++ b/deps/v8/src/bootstrapper.h
@@ -29,9 +29,11 @@ class SourceCodeCache final BASE_EMBEDDED {
                         bit_cast<Object**, FixedArray**>(&cache_));
   }
 
-  bool Lookup(Vector<const char> name, Handle<SharedFunctionInfo>* handle);
+  bool Lookup(Isolate* isolate, Vector<const char> name,
+              Handle<SharedFunctionInfo>* handle);
 
-  void Add(Vector<const char> name, Handle<SharedFunctionInfo> shared);
+  void Add(Isolate* isolate, Vector<const char> name,
+           Handle<SharedFunctionInfo> shared);
 
  private:
   Script::Type type_;
diff --git a/deps/v8/src/builtins/arm/builtins-arm.cc b/deps/v8/src/builtins/arm/builtins-arm.cc
index de372a6453b4c9..a5219bf0701d67 100644
--- a/deps/v8/src/builtins/arm/builtins-arm.cc
+++ b/deps/v8/src/builtins/arm/builtins-arm.cc
@@ -5,6 +5,7 @@
 #if V8_TARGET_ARCH_ARM
 
 #include "src/assembler-inl.h"
+#include "src/code-factory.h"
 #include "src/code-stubs.h"
 #include "src/counters.h"
 #include "src/debug/debug.h"
@@ -23,11 +24,11 @@ void Builtins::Generate_Adaptor(MacroAssembler* masm, Address address,
                                 ExitFrameType exit_frame_type) {
 #if defined(__thumb__)
   // Thumb mode builtin.
-  DCHECK_EQ(1, reinterpret_cast<intptr_t>(
-                   ExternalReference(address, masm->isolate()).address()) &
+  DCHECK_EQ(1, reinterpret_cast<uintptr_t>(
+                   ExternalReference::Create(address).address()) &
                    1);
 #endif
-  __ mov(r5, Operand(ExternalReference(address, masm->isolate())));
+  __ Move(kJavaScriptCallExtraArg1Register, ExternalReference::Create(address));
   if (exit_frame_type == BUILTIN_EXIT) {
     __ Jump(BUILTIN_CODE(masm->isolate(), AdaptorWithBuiltinExitFrame),
             RelocInfo::CODE_TARGET);
@@ -38,56 +39,6 @@ void Builtins::Generate_Adaptor(MacroAssembler* masm, Address address,
   }
 }
 
-namespace {
-
-void AdaptorWithExitFrameType(MacroAssembler* masm,
-                              Builtins::ExitFrameType exit_frame_type) {
-  // ----------- S t a t e -------------
-  //  -- r0                 : number of arguments excluding receiver
-  //  -- r1                 : target
-  //  -- r3                 : new.target
-  //  -- r5                 : entry point
-  //  -- sp[0]              : last argument
-  //  -- ...
-  //  -- sp[4 * (argc - 1)] : first argument
-  //  -- sp[4 * argc]       : receiver
-  // -----------------------------------
-  __ AssertFunction(r1);
-
-  // Make sure we operate in the context of the called function (for example
-  // ConstructStubs implemented in C++ will be run in the context of the caller
-  // instead of the callee, due to the way that [[Construct]] is defined for
-  // ordinary functions).
-  __ ldr(cp, FieldMemOperand(r1, JSFunction::kContextOffset));
-
-  // CEntryStub expects r0 to contain the number of arguments including the
-  // receiver and the extra arguments.
-  __ add(r0, r0, Operand(BuiltinExitFrameConstants::kNumExtraArgsWithReceiver));
-
-  // Insert extra arguments.
-  __ PushRoot(Heap::kTheHoleValueRootIndex);  // Padding.
-  __ SmiTag(r0);
-  __ Push(r0, r1, r3);
-  __ SmiUntag(r0);
-
-  // Jump to the C entry runtime stub directly here instead of using
-  // JumpToExternalReference. We have already loaded entry point to r5
-  // in Generate_adaptor.
-  __ mov(r1, r5);
-  CEntryStub stub(masm->isolate(), 1, kDontSaveFPRegs, kArgvOnStack,
-                  exit_frame_type == Builtins::BUILTIN_EXIT);
-  __ Jump(stub.GetCode(), RelocInfo::CODE_TARGET);
-}
-}  // namespace
-
-void Builtins::Generate_AdaptorWithExitFrame(MacroAssembler* masm) {
-  AdaptorWithExitFrameType(masm, EXIT);
-}
-
-void Builtins::Generate_AdaptorWithBuiltinExitFrame(MacroAssembler* masm) {
-  AdaptorWithExitFrameType(masm, BUILTIN_EXIT);
-}
-
 void Builtins::Generate_InternalArrayConstructor(MacroAssembler* masm) {
   // ----------- S t a t e -------------
   //  -- r0     : number of arguments
@@ -109,39 +60,8 @@ void Builtins::Generate_InternalArrayConstructor(MacroAssembler* masm) {
   // function.
   // tail call a stub
   __ LoadRoot(r2, Heap::kUndefinedValueRootIndex);
-  InternalArrayConstructorStub stub(masm->isolate());
-  __ TailCallStub(&stub);
-}
-
-void Builtins::Generate_ArrayConstructor(MacroAssembler* masm) {
-  // ----------- S t a t e -------------
-  //  -- r0     : number of arguments
-  //  -- r1     : array function
-  //  -- lr     : return address
-  //  -- sp[...]: constructor arguments
-  // -----------------------------------
-  Label generic_array_code, one_or_more_arguments, two_or_more_arguments;
-
-  if (FLAG_debug_code) {
-    // Initial map for the builtin Array functions should be maps.
-    __ ldr(r7, FieldMemOperand(r1, JSFunction::kPrototypeOrInitialMapOffset));
-    __ SmiTst(r7);
-    __ Assert(ne, AbortReason::kUnexpectedInitialMapForArrayFunction);
-    __ CompareObjectType(r7, r8, r9, MAP_TYPE);
-    __ Assert(eq, AbortReason::kUnexpectedInitialMapForArrayFunction);
-  }
-
-  // r2 is the AllocationSite - here undefined.
-  __ LoadRoot(r2, Heap::kUndefinedValueRootIndex);
-  // If r3 (new target) is undefined, then this is the 'Call' case, so move
-  // r1 (the constructor) to r3.
-  __ cmp(r3, r2);
-  __ mov(r3, r1, LeaveCC, eq);
-
-  // Run the native code for the Array function called as a normal function.
-  // tail call a stub
-  ArrayConstructorStub stub(masm->isolate());
-  __ TailCallStub(&stub);
+  __ Jump(BUILTIN_CODE(masm->isolate(), InternalArrayConstructorImpl),
+          RelocInfo::CODE_TARGET);
 }
 
 static void GenerateTailCallToReturnedCode(MacroAssembler* masm,
@@ -247,9 +167,10 @@ void Generate_JSBuiltinsConstructStubHelper(MacroAssembler* masm) {
   __ Jump(lr);
 }
 
+}  // namespace
+
 // The construct stub for ES5 constructor functions and ES6 class constructors.
-void Generate_JSConstructStubGeneric(MacroAssembler* masm,
-                                     bool restrict_constructor_return) {
+void Builtins::Generate_JSConstructStubGeneric(MacroAssembler* masm) {
   // ----------- S t a t e -------------
   //  --      r0: number of arguments (untagged)
   //  --      r1: constructor function
@@ -377,7 +298,7 @@ void Generate_JSConstructStubGeneric(MacroAssembler* masm,
     // If the result is an object (in the ECMA sense), we should get rid
     // of the receiver and use the result; see ECMA-262 section 13.2.2-7
     // on page 74.
-    Label use_receiver, do_throw, other_result, leave_frame;
+    Label use_receiver, do_throw, leave_frame;
 
     // If the result is undefined, we jump out to using the implicit receiver.
     __ JumpIfRoot(r0, Heap::kUndefinedValueRootIndex, &use_receiver);
@@ -386,30 +307,14 @@ void Generate_JSConstructStubGeneric(MacroAssembler* masm,
     // is a valid receiver.
 
     // If the result is a smi, it is *not* an object in the ECMA sense.
-    __ JumpIfSmi(r0, &other_result);
+    __ JumpIfSmi(r0, &use_receiver);
 
     // If the type of the result (stored in its map) is less than
     // FIRST_JS_RECEIVER_TYPE, it is not an object in the ECMA sense.
     STATIC_ASSERT(LAST_JS_RECEIVER_TYPE == LAST_TYPE);
     __ CompareObjectType(r0, r4, r5, FIRST_JS_RECEIVER_TYPE);
     __ b(ge, &leave_frame);
-
-    // The result is now neither undefined nor an object.
-    __ bind(&other_result);
-    __ ldr(r4, MemOperand(fp, ConstructFrameConstants::kConstructorOffset));
-    __ ldr(r4, FieldMemOperand(r4, JSFunction::kSharedFunctionInfoOffset));
-    __ ldr(r4, FieldMemOperand(r4, SharedFunctionInfo::kFlagsOffset));
-    __ tst(r4, Operand(SharedFunctionInfo::IsClassConstructorBit::kMask));
-
-    if (restrict_constructor_return) {
-      // Throw if constructor function is a class constructor
-      __ b(eq, &use_receiver);
-    } else {
-      __ b(ne, &use_receiver);
-      __ CallRuntime(
-          Runtime::kIncrementUseCounterConstructorReturnNonUndefinedPrimitive);
-      __ b(&use_receiver);
-    }
+    __ b(&use_receiver);
 
     __ bind(&do_throw);
     __ CallRuntime(Runtime::kThrowConstructorReturnedNonObject);
@@ -431,16 +336,7 @@ void Generate_JSConstructStubGeneric(MacroAssembler* masm,
   __ add(sp, sp, Operand(kPointerSize));
   __ Jump(lr);
 }
-}  // namespace
 
-void Builtins::Generate_JSConstructStubGenericRestrictedReturn(
-    MacroAssembler* masm) {
-  Generate_JSConstructStubGeneric(masm, true);
-}
-void Builtins::Generate_JSConstructStubGenericUnrestrictedReturn(
-    MacroAssembler* masm) {
-  Generate_JSConstructStubGeneric(masm, false);
-}
 void Builtins::Generate_JSBuiltinsConstructStub(MacroAssembler* masm) {
   Generate_JSBuiltinsConstructStubHelper(masm);
 }
@@ -483,7 +379,7 @@ void Builtins::Generate_ResumeGeneratorTrampoline(MacroAssembler* masm) {
   // Flood function if we are stepping.
   ExternalReference debug_hook =
       ExternalReference::debug_hook_on_function_call_address(masm->isolate());
-  __ mov(scratch, Operand(debug_hook));
+  __ Move(scratch, debug_hook);
   __ ldrsb(scratch, MemOperand(scratch));
   __ cmp(scratch, Operand(0));
   __ b(ne, &prepare_step_in_if_stepping);
@@ -492,7 +388,7 @@ void Builtins::Generate_ResumeGeneratorTrampoline(MacroAssembler* masm) {
   // generator.
   ExternalReference debug_suspended_generator =
       ExternalReference::debug_suspended_generator_address(masm->isolate());
-  __ mov(scratch, Operand(debug_suspended_generator));
+  __ Move(scratch, debug_suspended_generator);
   __ ldr(scratch, MemOperand(scratch));
   __ cmp(scratch, Operand(r1));
   __ b(eq, &prepare_step_in_suspended_generator);
@@ -516,20 +412,25 @@ void Builtins::Generate_ResumeGeneratorTrampoline(MacroAssembler* masm) {
   //  -- sp[0] : generator receiver
   // -----------------------------------
 
-  // Push holes for arguments to generator function. Since the parser forced
-  // context allocation for any variables in generators, the actual argument
-  // values have already been copied into the context and these dummy values
-  // will never be used.
+  // Copy the function arguments from the generator object's register file.
   __ ldr(r3, FieldMemOperand(r4, JSFunction::kSharedFunctionInfoOffset));
-  __ ldr(r3,
-         FieldMemOperand(r3, SharedFunctionInfo::kFormalParameterCountOffset));
+  __ ldrh(r3,
+          FieldMemOperand(r3, SharedFunctionInfo::kFormalParameterCountOffset));
+  __ ldr(r2,
+         FieldMemOperand(r1, JSGeneratorObject::kParametersAndRegistersOffset));
   {
     Label done_loop, loop;
+    __ mov(r6, Operand(0));
+
     __ bind(&loop);
-    __ sub(r3, r3, Operand(1), SetCC);
-    __ b(mi, &done_loop);
-    __ PushRoot(Heap::kTheHoleValueRootIndex);
+    __ cmp(r6, r3);
+    __ b(ge, &done_loop);
+    __ add(scratch, r2, Operand(r6, LSL, kPointerSizeLog2));
+    __ ldr(scratch, FieldMemOperand(scratch, FixedArray::kHeaderSize));
+    __ Push(scratch);
+    __ add(r6, r6, Operand(1));
     __ b(&loop);
+
     __ bind(&done_loop);
   }
 
@@ -545,8 +446,8 @@ void Builtins::Generate_ResumeGeneratorTrampoline(MacroAssembler* masm) {
   // Resume (Ignition/TurboFan) generator object.
   {
     __ ldr(r0, FieldMemOperand(r4, JSFunction::kSharedFunctionInfoOffset));
-    __ ldr(r0, FieldMemOperand(
-                   r0, SharedFunctionInfo::kFormalParameterCountOffset));
+    __ ldrh(r0, FieldMemOperand(
+                    r0, SharedFunctionInfo::kFormalParameterCountOffset));
     // We abuse new.target both to indicate that this is a resume call and to
     // pass in the generator object.  In ordinary calls, new.target is always
     // undefined because generator functions are non-constructable.
@@ -562,6 +463,8 @@ void Builtins::Generate_ResumeGeneratorTrampoline(MacroAssembler* masm) {
   {
     FrameAndConstantPoolScope scope(masm, StackFrame::INTERNAL);
     __ Push(r1, r4);
+    // Push hole as receiver since we do not use it for stepping.
+    __ PushRoot(Heap::kTheHoleValueRootIndex);
     __ CallRuntime(Runtime::kDebugOnFunctionCall);
     __ Pop(r1);
     __ ldr(r4, FieldMemOperand(r1, JSGeneratorObject::kFunctionOffset));
@@ -623,9 +526,9 @@ static void Generate_JSEntryTrampolineHelper(MacroAssembler* masm,
     FrameScope scope(masm, StackFrame::INTERNAL);
 
     // Setup the context (we need to use the caller context from the isolate).
-    ExternalReference context_address(IsolateAddressId::kContextAddress,
-                                      masm->isolate());
-    __ mov(cp, Operand(context_address));
+    ExternalReference context_address = ExternalReference::Create(
+        IsolateAddressId::kContextAddress, masm->isolate());
+    __ Move(cp, context_address);
     __ ldr(cp, MemOperand(cp));
 
     // Push the function and the receiver onto the stack.
@@ -848,9 +751,8 @@ static void AdvanceBytecodeOffsetOrReturn(MacroAssembler* masm,
   DCHECK(!AreAliased(bytecode_array, bytecode_offset, bytecode_size_table,
                      bytecode));
 
-  __ mov(
-      bytecode_size_table,
-      Operand(ExternalReference::bytecode_size_table_address(masm->isolate())));
+  __ Move(bytecode_size_table,
+          ExternalReference::bytecode_size_table_address());
 
   // Check if the bytecode is a Wide or ExtraWide prefix bytecode.
   Label process_bytecode, extra_wide;
@@ -927,17 +829,12 @@ void Builtins::Generate_InterpreterEntryTrampoline(MacroAssembler* masm) {
   FrameScope frame_scope(masm, StackFrame::MANUAL);
   __ PushStandardFrame(closure);
 
-  // Get the bytecode array from the function object (or from the DebugInfo if
-  // it is present) and load it into kInterpreterBytecodeArrayRegister.
-  Label maybe_load_debug_bytecode_array, bytecode_array_loaded;
+  // Get the bytecode array from the function object and load it into
+  // kInterpreterBytecodeArrayRegister.
   __ ldr(r0, FieldMemOperand(closure, JSFunction::kSharedFunctionInfoOffset));
   __ ldr(kInterpreterBytecodeArrayRegister,
          FieldMemOperand(r0, SharedFunctionInfo::kFunctionDataOffset));
   GetSharedFunctionInfoBytecode(masm, kInterpreterBytecodeArrayRegister, r4);
-  __ ldr(r4, FieldMemOperand(r0, SharedFunctionInfo::kDebugInfoOffset));
-  __ SmiTst(r4);
-  __ b(ne, &maybe_load_debug_bytecode_array);
-  __ bind(&bytecode_array_loaded);
 
   // Increment invocation count for the function.
   __ ldr(r9, FieldMemOperand(feedback_vector,
@@ -1048,37 +945,6 @@ void Builtins::Generate_InterpreterEntryTrampoline(MacroAssembler* masm) {
   // The return value is in r0.
   LeaveInterpreterFrame(masm, r2);
   __ Jump(lr);
-
-  // Load debug copy of the bytecode array if it exists.
-  // kInterpreterBytecodeArrayRegister is already loaded with
-  // SharedFunctionInfo::kFunctionDataOffset.
-  __ bind(&maybe_load_debug_bytecode_array);
-  __ ldr(r9, FieldMemOperand(r4, DebugInfo::kDebugBytecodeArrayOffset), ne);
-  __ JumpIfRoot(r9, Heap::kUndefinedValueRootIndex, &bytecode_array_loaded);
-
-  __ mov(kInterpreterBytecodeArrayRegister, r9);
-  __ ldr(r9, FieldMemOperand(r4, DebugInfo::kFlagsOffset));
-  __ SmiUntag(r9);
-  __ And(r9, r9, Operand(DebugInfo::kDebugExecutionMode));
-
-  ExternalReference debug_execution_mode =
-      ExternalReference::debug_execution_mode_address(masm->isolate());
-  __ mov(r4, Operand(debug_execution_mode));
-  __ ldrsb(r4, MemOperand(r4));
-  STATIC_ASSERT(static_cast<int>(DebugInfo::kDebugExecutionMode) ==
-                static_cast<int>(DebugInfo::kSideEffects));
-  __ cmp(r4, r9);
-  __ b(eq, &bytecode_array_loaded);
-
-  __ push(closure);
-  __ push(feedback_vector);
-  __ push(kInterpreterBytecodeArrayRegister);
-  __ push(closure);
-  __ CallRuntime(Runtime::kDebugApplyInstrumentation);
-  __ pop(kInterpreterBytecodeArrayRegister);
-  __ pop(feedback_vector);
-  __ pop(closure);
-  __ b(&bytecode_array_loaded);
 }
 
 static void Generate_InterpreterPushArgs(MacroAssembler* masm,
@@ -1181,8 +1047,8 @@ void Builtins::Generate_InterpreterPushArgsThenConstructImpl(
 
     // Tail call to the array construct stub (still in the caller
     // context at this point).
-    ArrayConstructorStub array_constructor_stub(masm->isolate());
-    __ Jump(array_constructor_stub.GetCode(), RelocInfo::CODE_TARGET);
+    Handle<Code> code = BUILTIN_CODE(masm->isolate(), ArrayConstructorImpl);
+    __ Jump(code, RelocInfo::CODE_TARGET);
   } else if (mode == InterpreterPushArgsMode::kWithFinalSpread) {
     // Call the constructor with r0, r1, and r3 unmodified.
     __ Jump(BUILTIN_CODE(masm->isolate(), ConstructWithSpread),
@@ -1231,9 +1097,9 @@ static void Generate_InterpreterEnterBytecode(MacroAssembler* masm) {
                          Code::kHeaderSize - kHeapObjectTag));
 
   // Initialize the dispatch table register.
-  __ mov(kInterpreterDispatchTableRegister,
-         Operand(ExternalReference::interpreter_dispatch_table_address(
-             masm->isolate())));
+  __ Move(
+      kInterpreterDispatchTableRegister,
+      ExternalReference::interpreter_dispatch_table_address(masm->isolate()));
 
   // Get the bytecode array pointer from the frame.
   __ ldr(kInterpreterBytecodeArrayRegister,
@@ -1299,207 +1165,6 @@ void Builtins::Generate_InterpreterEnterBytecodeDispatch(MacroAssembler* masm) {
   Generate_InterpreterEnterBytecode(masm);
 }
 
-void Builtins::Generate_CompileLazyDeoptimizedCode(MacroAssembler* masm) {
-  // Set the code slot inside the JSFunction to CompileLazy.
-  __ Move(r2, BUILTIN_CODE(masm->isolate(), CompileLazy));
-  __ str(r2, FieldMemOperand(r1, JSFunction::kCodeOffset));
-  __ RecordWriteField(r1, JSFunction::kCodeOffset, r2, r4, kLRHasNotBeenSaved,
-                      kDontSaveFPRegs, OMIT_REMEMBERED_SET, OMIT_SMI_CHECK);
-  // Jump to compile lazy.
-  Generate_CompileLazy(masm);
-}
-
-static void GetSharedFunctionInfoCode(MacroAssembler* masm, Register sfi_data,
-                                      Register scratch1) {
-  // Figure out the SFI's code object.
-  Label done;
-  Label check_is_bytecode_array;
-  Label check_is_code;
-  Label check_is_fixed_array;
-  Label check_is_pre_parsed_scope_data;
-  Label check_is_function_template_info;
-  Label check_is_interpreter_data;
-
-  Register data_type = scratch1;
-
-  // IsSmi: Is builtin
-  __ JumpIfNotSmi(sfi_data, &check_is_bytecode_array);
-  __ Move(scratch1,
-          Operand(ExternalReference::builtins_address(masm->isolate())));
-  __ ldr(sfi_data, MemOperand::PointerAddressFromSmiKey(scratch1, sfi_data));
-  __ b(&done);
-
-  // Get map for subsequent checks.
-  __ bind(&check_is_bytecode_array);
-  __ ldr(data_type, FieldMemOperand(sfi_data, HeapObject::kMapOffset));
-  __ ldrh(data_type, FieldMemOperand(data_type, Map::kInstanceTypeOffset));
-
-  // IsBytecodeArray: Interpret bytecode
-  __ cmp(data_type, Operand(BYTECODE_ARRAY_TYPE));
-  __ b(ne, &check_is_code);
-  __ Move(sfi_data, BUILTIN_CODE(masm->isolate(), InterpreterEntryTrampoline));
-  __ b(&done);
-
-  // IsCode: Run code
-  __ bind(&check_is_code);
-  __ cmp(data_type, Operand(CODE_TYPE));
-  __ b(eq, &done);
-
-  // IsFixedArray: Instantiate using AsmWasmData,
-  __ bind(&check_is_fixed_array);
-  __ cmp(data_type, Operand(FIXED_ARRAY_TYPE));
-  __ b(ne, &check_is_pre_parsed_scope_data);
-  __ Move(sfi_data, BUILTIN_CODE(masm->isolate(), InstantiateAsmJs));
-  __ b(&done);
-
-  // IsPreParsedScopeData: Compile lazy
-  __ bind(&check_is_pre_parsed_scope_data);
-  __ cmp(data_type, Operand(TUPLE2_TYPE));
-  __ b(ne, &check_is_function_template_info);
-  __ Move(sfi_data, BUILTIN_CODE(masm->isolate(), CompileLazy));
-  __ b(&done);
-
-  // IsFunctionTemplateInfo: API call
-  __ bind(&check_is_function_template_info);
-  __ cmp(data_type, Operand(FUNCTION_TEMPLATE_INFO_TYPE));
-  __ b(ne, &check_is_interpreter_data);
-  __ Move(sfi_data, BUILTIN_CODE(masm->isolate(), HandleApiCall));
-  __ b(&done);
-
-  // IsInterpreterData: Interpret bytecode
-  __ bind(&check_is_interpreter_data);
-  if (FLAG_debug_code) {
-    __ cmp(data_type, Operand(INTERPRETER_DATA_TYPE));
-    __ Assert(eq, AbortReason::kInvalidSharedFunctionInfoData);
-  }
-  __ ldr(
-      sfi_data,
-      FieldMemOperand(sfi_data, InterpreterData::kInterpreterTrampolineOffset));
-
-  __ bind(&done);
-}
-
-void Builtins::Generate_CompileLazy(MacroAssembler* masm) {
-  // ----------- S t a t e -------------
-  //  -- r0 : argument count (preserved for callee)
-  //  -- r3 : new target (preserved for callee)
-  //  -- r1 : target function (preserved for callee)
-  // -----------------------------------
-  // First lookup code, maybe we don't need to compile!
-  Label gotta_call_runtime;
-
-  Register closure = r1;
-  Register feedback_vector = r2;
-
-  // Do we have a valid feedback vector?
-  __ ldr(feedback_vector,
-         FieldMemOperand(closure, JSFunction::kFeedbackCellOffset));
-  __ ldr(feedback_vector, FieldMemOperand(feedback_vector, Cell::kValueOffset));
-  __ JumpIfRoot(feedback_vector, Heap::kUndefinedValueRootIndex,
-                &gotta_call_runtime);
-
-  // Is there an optimization marker or optimized code in the feedback vector?
-  MaybeTailCallOptimizedCodeSlot(masm, feedback_vector, r4, r6, r5);
-
-  // We found no optimized code. Infer the code object needed for the SFI.
-  Register entry = r4;
-  __ ldr(entry,
-         FieldMemOperand(closure, JSFunction::kSharedFunctionInfoOffset));
-  __ ldr(entry,
-         FieldMemOperand(entry, SharedFunctionInfo::kFunctionDataOffset));
-  GetSharedFunctionInfoCode(masm, entry, r5);
-
-  // If code entry points to anything other than CompileLazy, install that.
-  __ Move(r5, masm->CodeObject());
-  __ cmp(entry, r5);
-  __ b(eq, &gotta_call_runtime);
-
-  // Install the SFI's code entry.
-  __ str(entry, FieldMemOperand(closure, JSFunction::kCodeOffset));
-  __ mov(r9, entry);  // Write barrier clobbers r9 below.
-  __ RecordWriteField(closure, JSFunction::kCodeOffset, r9, r5,
-                      kLRHasNotBeenSaved, kDontSaveFPRegs, OMIT_REMEMBERED_SET,
-                      OMIT_SMI_CHECK);
-  __ add(entry, entry, Operand(Code::kHeaderSize - kHeapObjectTag));
-  __ Jump(entry);
-
-  __ bind(&gotta_call_runtime);
-  GenerateTailCallToReturnedCode(masm, Runtime::kCompileLazy);
-}
-
-// Lazy deserialization design doc: http://goo.gl/dxkYDZ.
-void Builtins::Generate_DeserializeLazy(MacroAssembler* masm) {
-  // ----------- S t a t e -------------
-  //  -- r0 : argument count (preserved for callee)
-  //  -- r3 : new target (preserved for callee)
-  //  -- r1 : target function (preserved for callee)
-  // -----------------------------------
-
-  Label deserialize_in_runtime;
-
-  Register target = r1;  // Must be preserved
-  Register scratch0 = r2;
-  Register scratch1 = r4;
-
-  CHECK(scratch0 != r0 && scratch0 != r3 && scratch0 != r1);
-  CHECK(scratch1 != r0 && scratch1 != r3 && scratch1 != r1);
-  CHECK(scratch0 != scratch1);
-
-  // Load the builtin id for lazy deserialization from SharedFunctionInfo.
-
-  __ AssertFunction(target);
-  __ ldr(scratch0,
-         FieldMemOperand(target, JSFunction::kSharedFunctionInfoOffset));
-
-  __ ldr(scratch1,
-         FieldMemOperand(scratch0, SharedFunctionInfo::kFunctionDataOffset));
-  __ AssertSmi(scratch1);
-
-  // The builtin may already have been deserialized. If that is the case, it is
-  // stored in the builtins table, and we can copy to correct code object to
-  // both the shared function info and function without calling into runtime.
-  //
-  // Otherwise, we need to call into runtime to deserialize.
-
-  {
-    // Load the code object at builtins_table[builtin_id] into scratch1.
-
-    __ SmiUntag(scratch1);
-    __ Move(scratch0,
-            Operand(ExternalReference::builtins_address(masm->isolate())));
-    __ ldr(scratch1, MemOperand(scratch0, scratch1, LSL, kPointerSizeLog2));
-
-    // Check if the loaded code object has already been deserialized. This is
-    // the case iff it does not equal DeserializeLazy.
-
-    __ Move(scratch0, masm->CodeObject());
-    __ cmp(scratch1, scratch0);
-    __ b(eq, &deserialize_in_runtime);
-  }
-
-  {
-    // If we've reached this spot, the target builtin has been deserialized and
-    // we simply need to copy it over to the target function.
-
-    Register target_builtin = scratch1;
-
-    __ str(target_builtin, FieldMemOperand(target, JSFunction::kCodeOffset));
-    __ mov(r9, target_builtin);  // Write barrier clobbers r9 below.
-    __ RecordWriteField(target, JSFunction::kCodeOffset, r9, r5,
-                        kLRHasNotBeenSaved, kDontSaveFPRegs,
-                        OMIT_REMEMBERED_SET, OMIT_SMI_CHECK);
-
-    // All copying is done. Jump to the deserialized code object.
-
-    __ add(target_builtin, target_builtin,
-           Operand(Code::kHeaderSize - kHeapObjectTag));
-    __ Jump(target_builtin);
-  }
-
-  __ bind(&deserialize_in_runtime);
-  GenerateTailCallToReturnedCode(masm, Runtime::kDeserializeLazy);
-}
-
 void Builtins::Generate_InstantiateAsmJs(MacroAssembler* masm) {
   // ----------- S t a t e -------------
   //  -- r0 : argument count (preserved for callee)
@@ -1912,10 +1577,27 @@ void Builtins::Generate_CallOrConstructVarargs(MacroAssembler* masm,
   //  -- r4 : len (number of elements to push from args)
   //  -- r3 : new.target (for [[Construct]])
   // -----------------------------------
-  __ AssertFixedArray(r2);
-
   Register scratch = r8;
 
+  if (masm->emit_debug_code()) {
+    // Allow r2 to be a FixedArray, or a FixedDoubleArray if r4 == 0.
+    Label ok, fail;
+    __ AssertNotSmi(r2);
+    __ ldr(scratch, FieldMemOperand(r2, HeapObject::kMapOffset));
+    __ ldrh(r6, FieldMemOperand(scratch, Map::kInstanceTypeOffset));
+    __ cmp(r6, Operand(FIXED_ARRAY_TYPE));
+    __ b(eq, &ok);
+    __ cmp(r6, Operand(FIXED_DOUBLE_ARRAY_TYPE));
+    __ b(ne, &fail);
+    __ cmp(r4, Operand(0));
+    __ b(eq, &ok);
+    // Fall through.
+    __ bind(&fail);
+    __ Abort(AbortReason::kOperandIsNotAFixedArray);
+
+    __ bind(&ok);
+  }
+
   // Check for stack overflow.
   {
     // Check the stack for overflow. We are not trying to catch interruptions
@@ -1997,8 +1679,8 @@ void Builtins::Generate_CallOrConstructForwardVarargs(MacroAssembler* masm,
   {
     __ ldr(r5, MemOperand(fp, JavaScriptFrameConstants::kFunctionOffset));
     __ ldr(r5, FieldMemOperand(r5, JSFunction::kSharedFunctionInfoOffset));
-    __ ldr(r5, FieldMemOperand(
-                   r5, SharedFunctionInfo::kFormalParameterCountOffset));
+    __ ldrh(r5, FieldMemOperand(
+                    r5, SharedFunctionInfo::kFormalParameterCountOffset));
     __ mov(r4, fp);
   }
   __ b(&arguments_done);
@@ -2128,8 +1810,8 @@ void Builtins::Generate_CallFunction(MacroAssembler* masm,
   //  -- cp : the function context.
   // -----------------------------------
 
-  __ ldr(r2,
-         FieldMemOperand(r2, SharedFunctionInfo::kFormalParameterCountOffset));
+  __ ldrh(r2,
+          FieldMemOperand(r2, SharedFunctionInfo::kFormalParameterCountOffset));
   ParameterCount actual(r0);
   ParameterCount expected(r2);
   __ InvokeFunctionCode(r1, no_reg, expected, actual, JUMP_FUNCTION);
@@ -2317,7 +1999,7 @@ void Builtins::Generate_ConstructFunction(MacroAssembler* masm) {
           RelocInfo::CODE_TARGET);
 
   __ bind(&call_generic_stub);
-  __ Jump(masm->isolate()->builtins()->JSConstructStubGeneric(),
+  __ Jump(BUILTIN_CODE(masm->isolate(), JSConstructStubGeneric),
           RelocInfo::CODE_TARGET);
 }
 
@@ -2398,42 +2080,6 @@ void Builtins::Generate_Construct(MacroAssembler* masm) {
           RelocInfo::CODE_TARGET);
 }
 
-// static
-void Builtins::Generate_AllocateInNewSpace(MacroAssembler* masm) {
-  // ----------- S t a t e -------------
-  //  -- r1 : requested object size (untagged)
-  //  -- lr : return address
-  // -----------------------------------
-  __ SmiTag(r1);
-  __ Push(r1);
-  __ Move(cp, Smi::kZero);
-  __ TailCallRuntime(Runtime::kAllocateInNewSpace);
-}
-
-// static
-void Builtins::Generate_AllocateInOldSpace(MacroAssembler* masm) {
-  // ----------- S t a t e -------------
-  //  -- r1 : requested object size (untagged)
-  //  -- lr : return address
-  // -----------------------------------
-  __ SmiTag(r1);
-  __ Move(r2, Smi::FromInt(AllocateTargetSpace::encode(OLD_SPACE)));
-  __ Push(r1, r2);
-  __ Move(cp, Smi::kZero);
-  __ TailCallRuntime(Runtime::kAllocateInTargetSpace);
-}
-
-// static
-void Builtins::Generate_Abort(MacroAssembler* masm) {
-  // ----------- S t a t e -------------
-  //  -- r1 : message_id as Smi
-  //  -- lr : return address
-  // -----------------------------------
-  __ Push(r1);
-  __ Move(cp, Smi::kZero);
-  __ TailCallRuntime(Runtime::kAbort);
-}
-
 void Builtins::Generate_ArgumentsAdaptorTrampoline(MacroAssembler* masm) {
   // ----------- S t a t e -------------
   //  -- r0 : actual number of arguments
@@ -2445,10 +2091,10 @@ void Builtins::Generate_ArgumentsAdaptorTrampoline(MacroAssembler* masm) {
   Label invoke, dont_adapt_arguments, stack_overflow;
 
   Label enough, too_few;
-  __ cmp(r0, r2);
-  __ b(lt, &too_few);
   __ cmp(r2, Operand(SharedFunctionInfo::kDontAdaptArgumentsSentinel));
   __ b(eq, &dont_adapt_arguments);
+  __ cmp(r0, r2);
+  __ b(lt, &too_few);
 
   Register scratch = r5;
 
@@ -2567,31 +2213,36 @@ void Builtins::Generate_ArgumentsAdaptorTrampoline(MacroAssembler* masm) {
 }
 
 void Builtins::Generate_WasmCompileLazy(MacroAssembler* masm) {
+  // The function index was put in r4 by the jump table trampoline.
+  // Convert to Smi for the runtime call.
+  __ SmiTag(r4, r4);
   {
-    FrameAndConstantPoolScope scope(masm, StackFrame::INTERNAL);
-
-    auto wasm_instance_reg = r3;  // TODO(titzer): put in a common place.
+    TrapOnAbortScope trap_on_abort_scope(masm);  // Avoid calls to Abort.
+    FrameAndConstantPoolScope scope(masm, StackFrame::WASM_COMPILE_LAZY);
 
     // Save all parameter registers (see wasm-linkage.cc). They might be
     // overwritten in the runtime call below. We don't have any callee-saved
     // registers in wasm, so no need to store anything else.
-    constexpr RegList gp_regs = Register::ListOf<r0, r1, r2>();
+    constexpr RegList gp_regs = Register::ListOf<r0, r1, r2, r3>();
     constexpr DwVfpRegister lowest_fp_reg = d0;
     constexpr DwVfpRegister highest_fp_reg = d7;
 
     __ stm(db_w, sp, gp_regs);
     __ vstm(db_w, sp, lowest_fp_reg, highest_fp_reg);
 
-    // Pass the WASM instance as an explicit argument to WasmCompileLazy.
-    __ push(wasm_instance_reg);
-    // Initialize the JavaScript context with 0. CEntryStub will use it to
+    // Pass instance and function index as explicit arguments to the runtime
+    // function.
+    __ push(kWasmInstanceRegister);
+    __ push(r4);
+    // Load the correct CEntry builtin from the instance object.
+    __ ldr(r2, FieldMemOperand(kWasmInstanceRegister,
+                               WasmInstanceObject::kCEntryStubOffset));
+    // Initialize the JavaScript context with 0. CEntry will use it to
     // set the current context on the isolate.
     __ Move(cp, Smi::kZero);
-    __ CallRuntime(Runtime::kWasmCompileLazy);
-    // The entrypoint address is the first return value.
+    __ CallRuntimeWithCEntry(Runtime::kWasmCompileLazy, r2);
+    // The entrypoint address is the return value.
     __ mov(r8, kReturnRegister0);
-    // The WASM instance is the second return value.
-    __ mov(wasm_instance_reg, kReturnRegister1);
 
     // Restore registers.
     __ vldm(ia_w, sp, lowest_fp_reg, highest_fp_reg);
@@ -2600,6 +2251,416 @@ void Builtins::Generate_WasmCompileLazy(MacroAssembler* masm) {
   // Finally, jump to the entrypoint.
   __ Jump(r8);
 }
+
+void Builtins::Generate_CEntry(MacroAssembler* masm, int result_size,
+                               SaveFPRegsMode save_doubles, ArgvMode argv_mode,
+                               bool builtin_exit_frame) {
+  // Called from JavaScript; parameters are on stack as if calling JS function.
+  // r0: number of arguments including receiver
+  // r1: pointer to builtin function
+  // fp: frame pointer  (restored after C call)
+  // sp: stack pointer  (restored as callee's sp after C call)
+  // cp: current context  (C callee-saved)
+  //
+  // If argv_mode == kArgvInRegister:
+  // r2: pointer to the first argument
+  ProfileEntryHookStub::MaybeCallEntryHook(masm);
+
+  __ mov(r5, Operand(r1));
+
+  if (argv_mode == kArgvInRegister) {
+    // Move argv into the correct register.
+    __ mov(r1, Operand(r2));
+  } else {
+    // Compute the argv pointer in a callee-saved register.
+    __ add(r1, sp, Operand(r0, LSL, kPointerSizeLog2));
+    __ sub(r1, r1, Operand(kPointerSize));
+  }
+
+  // Enter the exit frame that transitions from JavaScript to C++.
+  FrameScope scope(masm, StackFrame::MANUAL);
+  __ EnterExitFrame(
+      save_doubles == kSaveFPRegs, 0,
+      builtin_exit_frame ? StackFrame::BUILTIN_EXIT : StackFrame::EXIT);
+
+  // Store a copy of argc in callee-saved registers for later.
+  __ mov(r4, Operand(r0));
+
+// r0, r4: number of arguments including receiver  (C callee-saved)
+// r1: pointer to the first argument (C callee-saved)
+// r5: pointer to builtin function  (C callee-saved)
+
+#if V8_HOST_ARCH_ARM
+  int frame_alignment = MacroAssembler::ActivationFrameAlignment();
+  int frame_alignment_mask = frame_alignment - 1;
+  if (FLAG_debug_code) {
+    if (frame_alignment > kPointerSize) {
+      Label alignment_as_expected;
+      DCHECK(base::bits::IsPowerOfTwo(frame_alignment));
+      __ tst(sp, Operand(frame_alignment_mask));
+      __ b(eq, &alignment_as_expected);
+      // Don't use Check here, as it will call Runtime_Abort re-entering here.
+      __ stop("Unexpected alignment");
+      __ bind(&alignment_as_expected);
+    }
+  }
+#endif
+
+  // Call C built-in.
+  // r0 = argc, r1 = argv, r2 = isolate
+  __ Move(r2, ExternalReference::isolate_address(masm->isolate()));
+
+  // To let the GC traverse the return address of the exit frames, we need to
+  // know where the return address is. CEntry is unmovable, so
+  // we can store the address on the stack to be able to find it again and
+  // we never have to restore it, because it will not change.
+  // Compute the return address in lr to return to after the jump below. Pc is
+  // already at '+ 8' from the current instruction but return is after three
+  // instructions so add another 4 to pc to get the return address.
+  {
+    // Prevent literal pool emission before return address.
+    Assembler::BlockConstPoolScope block_const_pool(masm);
+    __ add(lr, pc, Operand(4));
+    __ str(lr, MemOperand(sp));
+    __ Call(r5);
+  }
+
+  // Result returned in r0 or r1:r0 - do not destroy these registers!
+
+  // Check result for exception sentinel.
+  Label exception_returned;
+  __ CompareRoot(r0, Heap::kExceptionRootIndex);
+  __ b(eq, &exception_returned);
+
+  // Check that there is no pending exception, otherwise we
+  // should have returned the exception sentinel.
+  if (FLAG_debug_code) {
+    Label okay;
+    ExternalReference pending_exception_address = ExternalReference::Create(
+        IsolateAddressId::kPendingExceptionAddress, masm->isolate());
+    __ Move(r3, pending_exception_address);
+    __ ldr(r3, MemOperand(r3));
+    __ CompareRoot(r3, Heap::kTheHoleValueRootIndex);
+    // Cannot use check here as it attempts to generate call into runtime.
+    __ b(eq, &okay);
+    __ stop("Unexpected pending exception");
+    __ bind(&okay);
+  }
+
+  // Exit C frame and return.
+  // r0:r1: result
+  // sp: stack pointer
+  // fp: frame pointer
+  Register argc = argv_mode == kArgvInRegister
+                      // We don't want to pop arguments so set argc to no_reg.
+                      ? no_reg
+                      // Callee-saved register r4 still holds argc.
+                      : r4;
+  __ LeaveExitFrame(save_doubles == kSaveFPRegs, argc);
+  __ mov(pc, lr);
+
+  // Handling of exception.
+  __ bind(&exception_returned);
+
+  ExternalReference pending_handler_context_address = ExternalReference::Create(
+      IsolateAddressId::kPendingHandlerContextAddress, masm->isolate());
+  ExternalReference pending_handler_entrypoint_address =
+      ExternalReference::Create(
+          IsolateAddressId::kPendingHandlerEntrypointAddress, masm->isolate());
+  ExternalReference pending_handler_fp_address = ExternalReference::Create(
+      IsolateAddressId::kPendingHandlerFPAddress, masm->isolate());
+  ExternalReference pending_handler_sp_address = ExternalReference::Create(
+      IsolateAddressId::kPendingHandlerSPAddress, masm->isolate());
+
+  // Ask the runtime for help to determine the handler. This will set r0 to
+  // contain the current pending exception, don't clobber it.
+  ExternalReference find_handler =
+      ExternalReference::Create(Runtime::kUnwindAndFindExceptionHandler);
+  {
+    FrameScope scope(masm, StackFrame::MANUAL);
+    __ PrepareCallCFunction(3, 0);
+    __ mov(r0, Operand(0));
+    __ mov(r1, Operand(0));
+    __ Move(r2, ExternalReference::isolate_address(masm->isolate()));
+    __ CallCFunction(find_handler, 3);
+  }
+
+  // Retrieve the handler context, SP and FP.
+  __ Move(cp, pending_handler_context_address);
+  __ ldr(cp, MemOperand(cp));
+  __ Move(sp, pending_handler_sp_address);
+  __ ldr(sp, MemOperand(sp));
+  __ Move(fp, pending_handler_fp_address);
+  __ ldr(fp, MemOperand(fp));
+
+  // If the handler is a JS frame, restore the context to the frame. Note that
+  // the context will be set to (cp == 0) for non-JS frames.
+  __ cmp(cp, Operand(0));
+  __ str(cp, MemOperand(fp, StandardFrameConstants::kContextOffset), ne);
+
+  // Reset the masking register. This is done independent of the underlying
+  // feature flag {FLAG_branch_load_poisoning} to make the snapshot work with
+  // both configurations. It is safe to always do this, because the underlying
+  // register is caller-saved and can be arbitrarily clobbered.
+  __ ResetSpeculationPoisonRegister();
+
+  // Compute the handler entry address and jump to it.
+  ConstantPoolUnavailableScope constant_pool_unavailable(masm);
+  __ Move(r1, pending_handler_entrypoint_address);
+  __ ldr(r1, MemOperand(r1));
+  __ Jump(r1);
+}
+
+void Builtins::Generate_DoubleToI(MacroAssembler* masm) {
+  Label negate, done;
+
+  TrapOnAbortScope trap_on_abort_scope(masm);  // Avoid calls to Abort.
+  UseScratchRegisterScope temps(masm);
+  Register result_reg = r7;
+  Register double_low = GetRegisterThatIsNotOneOf(result_reg);
+  Register double_high = GetRegisterThatIsNotOneOf(result_reg, double_low);
+  LowDwVfpRegister double_scratch = temps.AcquireLowD();
+
+  // Save the old values from these temporary registers on the stack.
+  __ Push(result_reg, double_high, double_low);
+
+  // Account for saved regs.
+  const int kArgumentOffset = 3 * kPointerSize;
+
+  MemOperand input_operand(sp, kArgumentOffset);
+  MemOperand result_operand = input_operand;
+
+  // Load double input.
+  __ vldr(double_scratch, input_operand);
+  __ vmov(double_low, double_high, double_scratch);
+  // Try to convert with a FPU convert instruction. This handles all
+  // non-saturating cases.
+  __ TryInlineTruncateDoubleToI(result_reg, double_scratch, &done);
+
+  Register scratch = temps.Acquire();
+  __ Ubfx(scratch, double_high, HeapNumber::kExponentShift,
+          HeapNumber::kExponentBits);
+  // Load scratch with exponent - 1. This is faster than loading
+  // with exponent because Bias + 1 = 1024 which is an *ARM* immediate value.
+  STATIC_ASSERT(HeapNumber::kExponentBias + 1 == 1024);
+  __ sub(scratch, scratch, Operand(HeapNumber::kExponentBias + 1));
+  // If exponent is greater than or equal to 84, the 32 less significant
+  // bits are 0s (2^84 = 1, 52 significant bits, 32 uncoded bits),
+  // the result is 0.
+  // Compare exponent with 84 (compare exponent - 1 with 83). If the exponent is
+  // greater than this, the conversion is out of range, so return zero.
+  __ cmp(scratch, Operand(83));
+  __ mov(result_reg, Operand::Zero(), LeaveCC, ge);
+  __ b(ge, &done);
+
+  // If we reach this code, 30 <= exponent <= 83.
+  // `TryInlineTruncateDoubleToI` above will have truncated any double with an
+  // exponent lower than 30.
+  if (masm->emit_debug_code()) {
+    // Scratch is exponent - 1.
+    __ cmp(scratch, Operand(30 - 1));
+    __ Check(ge, AbortReason::kUnexpectedValue);
+  }
+
+  // We don't have to handle cases where 0 <= exponent <= 20 for which we would
+  // need to shift right the high part of the mantissa.
+  // Scratch contains exponent - 1.
+  // Load scratch with 52 - exponent (load with 51 - (exponent - 1)).
+  __ rsb(scratch, scratch, Operand(51), SetCC);
+
+  // 52 <= exponent <= 83, shift only double_low.
+  // On entry, scratch contains: 52 - exponent.
+  __ rsb(scratch, scratch, Operand::Zero(), LeaveCC, ls);
+  __ mov(result_reg, Operand(double_low, LSL, scratch), LeaveCC, ls);
+  __ b(ls, &negate);
+
+  // 21 <= exponent <= 51, shift double_low and double_high
+  // to generate the result.
+  __ mov(double_low, Operand(double_low, LSR, scratch));
+  // Scratch contains: 52 - exponent.
+  // We needs: exponent - 20.
+  // So we use: 32 - scratch = 32 - 52 + exponent = exponent - 20.
+  __ rsb(scratch, scratch, Operand(32));
+  __ Ubfx(result_reg, double_high, 0, HeapNumber::kMantissaBitsInTopWord);
+  // Set the implicit 1 before the mantissa part in double_high.
+  __ orr(result_reg, result_reg,
+         Operand(1 << HeapNumber::kMantissaBitsInTopWord));
+  __ orr(result_reg, double_low, Operand(result_reg, LSL, scratch));
+
+  __ bind(&negate);
+  // If input was positive, double_high ASR 31 equals 0 and
+  // double_high LSR 31 equals zero.
+  // New result = (result eor 0) + 0 = result.
+  // If the input was negative, we have to negate the result.
+  // Input_high ASR 31 equals 0xFFFFFFFF and double_high LSR 31 equals 1.
+  // New result = (result eor 0xFFFFFFFF) + 1 = 0 - result.
+  __ eor(result_reg, result_reg, Operand(double_high, ASR, 31));
+  __ add(result_reg, result_reg, Operand(double_high, LSR, 31));
+
+  __ bind(&done);
+  __ str(result_reg, result_operand);
+
+  // Restore registers corrupted in this routine and return.
+  __ Pop(result_reg, double_high, double_low);
+  __ Ret();
+}
+
+void Builtins::Generate_MathPowInternal(MacroAssembler* masm) {
+  const LowDwVfpRegister double_base = d0;
+  const LowDwVfpRegister double_exponent = d1;
+  const LowDwVfpRegister double_result = d2;
+  const LowDwVfpRegister double_scratch = d3;
+  const SwVfpRegister single_scratch = s6;
+  // Avoid using Registers r0-r3 as they may be needed when calling to C if the
+  // ABI is softfloat.
+  const Register integer_exponent = r4;
+  const Register scratch = r5;
+
+  Label call_runtime, done, int_exponent;
+
+  // Detect integer exponents stored as double.
+  __ TryDoubleToInt32Exact(integer_exponent, double_exponent, double_scratch);
+  __ b(eq, &int_exponent);
+
+  __ push(lr);
+  {
+    AllowExternalCallThatCantCauseGC scope(masm);
+    __ PrepareCallCFunction(0, 2);
+    __ MovToFloatParameters(double_base, double_exponent);
+    __ CallCFunction(ExternalReference::power_double_double_function(), 0, 2);
+  }
+  __ pop(lr);
+  __ MovFromFloatResult(double_result);
+  __ b(&done);
+
+  // Calculate power with integer exponent.
+  __ bind(&int_exponent);
+
+  __ vmov(double_scratch, double_base);  // Back up base.
+  __ vmov(double_result, Double(1.0), scratch);
+
+  // Get absolute value of exponent.
+  __ cmp(integer_exponent, Operand::Zero());
+  __ mov(scratch, integer_exponent);
+  __ rsb(scratch, integer_exponent, Operand::Zero(), LeaveCC, mi);
+
+  Label while_true;
+  __ bind(&while_true);
+  __ mov(scratch, Operand(scratch, LSR, 1), SetCC);
+  __ vmul(double_result, double_result, double_scratch, cs);
+  __ vmul(double_scratch, double_scratch, double_scratch, ne);
+  __ b(ne, &while_true);
+
+  __ cmp(integer_exponent, Operand::Zero());
+  __ b(ge, &done);
+  __ vmov(double_scratch, Double(1.0), scratch);
+  __ vdiv(double_result, double_scratch, double_result);
+  // Test whether result is zero.  Bail out to check for subnormal result.
+  // Due to subnormals, x^-y == (1/x)^y does not hold in all cases.
+  __ VFPCompareAndSetFlags(double_result, 0.0);
+  __ b(ne, &done);
+  // double_exponent may not containe the exponent value if the input was a
+  // smi.  We set it with exponent value before bailing out.
+  __ vmov(single_scratch, integer_exponent);
+  __ vcvt_f64_s32(double_exponent, single_scratch);
+
+  // Returning or bailing out.
+  __ push(lr);
+  {
+    AllowExternalCallThatCantCauseGC scope(masm);
+    __ PrepareCallCFunction(0, 2);
+    __ MovToFloatParameters(double_base, double_exponent);
+    __ CallCFunction(ExternalReference::power_double_double_function(), 0, 2);
+  }
+  __ pop(lr);
+  __ MovFromFloatResult(double_result);
+
+  __ bind(&done);
+  __ Ret();
+}
+
+namespace {
+
+void GenerateInternalArrayConstructorCase(MacroAssembler* masm,
+                                          ElementsKind kind) {
+  __ cmp(r0, Operand(1));
+
+  __ Jump(CodeFactory::InternalArrayNoArgumentConstructor(masm->isolate(), kind)
+              .code(),
+          RelocInfo::CODE_TARGET, lo);
+
+  Handle<Code> code = BUILTIN_CODE(masm->isolate(), ArrayNArgumentsConstructor);
+  __ Jump(code, RelocInfo::CODE_TARGET, hi);
+
+  if (IsFastPackedElementsKind(kind)) {
+    // We might need to create a holey array
+    // look at the first argument
+    __ ldr(r3, MemOperand(sp, 0));
+    __ cmp(r3, Operand::Zero());
+
+    __ Jump(CodeFactory::InternalArraySingleArgumentConstructor(
+                masm->isolate(), GetHoleyElementsKind(kind))
+                .code(),
+            RelocInfo::CODE_TARGET, ne);
+  }
+
+  __ Jump(
+      CodeFactory::InternalArraySingleArgumentConstructor(masm->isolate(), kind)
+          .code(),
+      RelocInfo::CODE_TARGET);
+}
+
+}  // namespace
+
+void Builtins::Generate_InternalArrayConstructorImpl(MacroAssembler* masm) {
+  // ----------- S t a t e -------------
+  //  -- r0 : argc
+  //  -- r1 : constructor
+  //  -- sp[0] : return address
+  //  -- sp[4] : last argument
+  // -----------------------------------
+
+  if (FLAG_debug_code) {
+    // The array construct code is only set for the global and natives
+    // builtin Array functions which always have maps.
+
+    // Initial map for the builtin Array function should be a map.
+    __ ldr(r3, FieldMemOperand(r1, JSFunction::kPrototypeOrInitialMapOffset));
+    // Will both indicate a nullptr and a Smi.
+    __ tst(r3, Operand(kSmiTagMask));
+    __ Assert(ne, AbortReason::kUnexpectedInitialMapForArrayFunction);
+    __ CompareObjectType(r3, r3, r4, MAP_TYPE);
+    __ Assert(eq, AbortReason::kUnexpectedInitialMapForArrayFunction);
+  }
+
+  // Figure out the right elements kind
+  __ ldr(r3, FieldMemOperand(r1, JSFunction::kPrototypeOrInitialMapOffset));
+  // Load the map's "bit field 2" into |result|. We only need the first byte,
+  // but the following bit field extraction takes care of that anyway.
+  __ ldr(r3, FieldMemOperand(r3, Map::kBitField2Offset));
+  // Retrieve elements_kind from bit field 2.
+  __ DecodeField<Map::ElementsKindBits>(r3);
+
+  if (FLAG_debug_code) {
+    Label done;
+    __ cmp(r3, Operand(PACKED_ELEMENTS));
+    __ b(eq, &done);
+    __ cmp(r3, Operand(HOLEY_ELEMENTS));
+    __ Assert(
+        eq,
+        AbortReason::kInvalidElementsKindForInternalArrayOrInternalPackedArray);
+    __ bind(&done);
+  }
+
+  Label fast_elements_case;
+  __ cmp(r3, Operand(PACKED_ELEMENTS));
+  __ b(eq, &fast_elements_case);
+  GenerateInternalArrayConstructorCase(masm, HOLEY_ELEMENTS);
+
+  __ bind(&fast_elements_case);
+  GenerateInternalArrayConstructorCase(masm, PACKED_ELEMENTS);
+}
+
 #undef __
 
 }  // namespace internal
diff --git a/deps/v8/src/builtins/arm64/builtins-arm64.cc b/deps/v8/src/builtins/arm64/builtins-arm64.cc
index aae189f19bd1eb..2254f010c13dc0 100644
--- a/deps/v8/src/builtins/arm64/builtins-arm64.cc
+++ b/deps/v8/src/builtins/arm64/builtins-arm64.cc
@@ -5,6 +5,7 @@
 #if V8_TARGET_ARCH_ARM64
 
 #include "src/arm64/macro-assembler-arm64-inl.h"
+#include "src/code-factory.h"
 #include "src/code-stubs.h"
 #include "src/counters.h"
 #include "src/debug/debug.h"
@@ -21,7 +22,7 @@ namespace internal {
 
 void Builtins::Generate_Adaptor(MacroAssembler* masm, Address address,
                                 ExitFrameType exit_frame_type) {
-  __ Mov(x5, ExternalReference(address, masm->isolate()));
+  __ Mov(kJavaScriptCallExtraArg1Register, ExternalReference::Create(address));
   if (exit_frame_type == BUILTIN_EXIT) {
     __ Jump(BUILTIN_CODE(masm->isolate(), AdaptorWithBuiltinExitFrame),
             RelocInfo::CODE_TARGET);
@@ -32,56 +33,6 @@ void Builtins::Generate_Adaptor(MacroAssembler* masm, Address address,
   }
 }
 
-namespace {
-
-void AdaptorWithExitFrameType(MacroAssembler* masm,
-                              Builtins::ExitFrameType exit_frame_type) {
-  // ----------- S t a t e -------------
-  //  -- x0                 : number of arguments excluding receiver
-  //  -- x1                 : target
-  //  -- x3                 : new target
-  //  -- x5                 : entry point
-  //  -- sp[0]              : last argument
-  //  -- ...
-  //  -- sp[4 * (argc - 1)] : first argument
-  //  -- sp[4 * argc]       : receiver
-  // -----------------------------------
-  __ AssertFunction(x1);
-
-  // Make sure we operate in the context of the called function (for example
-  // ConstructStubs implemented in C++ will be run in the context of the caller
-  // instead of the callee, due to the way that [[Construct]] is defined for
-  // ordinary functions).
-  __ Ldr(cp, FieldMemOperand(x1, JSFunction::kContextOffset));
-
-  // CEntryStub expects x0 to contain the number of arguments including the
-  // receiver and the extra arguments.
-  __ Add(x0, x0, BuiltinExitFrameConstants::kNumExtraArgsWithReceiver);
-
-  // Insert extra arguments.
-  Register padding = x10;
-  __ LoadRoot(padding, Heap::kTheHoleValueRootIndex);
-  __ SmiTag(x11, x0);
-  __ Push(padding, x11, x1, x3);
-
-  // Jump to the C entry runtime stub directly here instead of using
-  // JumpToExternalReference. We have already loaded entry point to x5
-  // in Generate_adaptor.
-  __ Mov(x1, x5);
-  CEntryStub stub(masm->isolate(), 1, kDontSaveFPRegs, kArgvOnStack,
-                  exit_frame_type == Builtins::BUILTIN_EXIT);
-  __ Jump(stub.GetCode(), RelocInfo::CODE_TARGET);
-}
-}  // namespace
-
-void Builtins::Generate_AdaptorWithExitFrame(MacroAssembler* masm) {
-  AdaptorWithExitFrameType(masm, EXIT);
-}
-
-void Builtins::Generate_AdaptorWithBuiltinExitFrame(MacroAssembler* masm) {
-  AdaptorWithExitFrameType(masm, BUILTIN_EXIT);
-}
-
 void Builtins::Generate_InternalArrayConstructor(MacroAssembler* masm) {
   // ----------- S t a t e -------------
   //  -- x0     : number of arguments
@@ -103,39 +54,8 @@ void Builtins::Generate_InternalArrayConstructor(MacroAssembler* masm) {
   // Run the native code for the InternalArray function called as a normal
   // function.
   __ LoadRoot(x2, Heap::kUndefinedValueRootIndex);
-  InternalArrayConstructorStub stub(masm->isolate());
-  __ TailCallStub(&stub);
-}
-
-void Builtins::Generate_ArrayConstructor(MacroAssembler* masm) {
-  // ----------- S t a t e -------------
-  //  -- x0     : number of arguments
-  //  -- x1     : array function
-  //  -- lr     : return address
-  //  -- sp[...]: constructor arguments
-  // -----------------------------------
-  ASM_LOCATION("Builtins::Generate_ArrayConstructor");
-  Label generic_array_code, one_or_more_arguments, two_or_more_arguments;
-
-  if (FLAG_debug_code) {
-    // Initial map for the builtin Array functions should be maps.
-    __ Ldr(x10, FieldMemOperand(x1, JSFunction::kPrototypeOrInitialMapOffset));
-    __ Tst(x10, kSmiTagMask);
-    __ Assert(ne, AbortReason::kUnexpectedInitialMapForArrayFunction);
-    __ CompareObjectType(x10, x11, x12, MAP_TYPE);
-    __ Assert(eq, AbortReason::kUnexpectedInitialMapForArrayFunction);
-  }
-
-  // x2 is the AllocationSite - here undefined.
-  __ LoadRoot(x2, Heap::kUndefinedValueRootIndex);
-  // If x3 (new target) is undefined, then this is the 'Call' case, so move
-  // x1 (the constructor) to x3.
-  __ Cmp(x3, x2);
-  __ CmovX(x3, x1, eq);
-
-  // Run the native code for the Array function called as a normal function.
-  ArrayConstructorStub stub(masm->isolate());
-  __ TailCallStub(&stub);
+  __ Jump(BUILTIN_CODE(masm->isolate(), InternalArrayConstructorImpl),
+          RelocInfo::CODE_TARGET);
 }
 
 static void GenerateTailCallToReturnedCode(MacroAssembler* masm,
@@ -264,8 +184,7 @@ void Generate_JSBuiltinsConstructStubHelper(MacroAssembler* masm) {
     // Restore smi-tagged arguments count from the frame. Use fp relative
     // addressing to avoid the circular dependency between padding existence and
     // argc parity.
-    __ Ldrsw(x1,
-             UntagSmiMemOperand(fp, ConstructFrameConstants::kLengthOffset));
+    __ SmiUntag(x1, MemOperand(fp, ConstructFrameConstants::kLengthOffset));
     // Leave construct frame.
   }
 
@@ -274,9 +193,10 @@ void Generate_JSBuiltinsConstructStubHelper(MacroAssembler* masm) {
   __ Ret();
 }
 
+}  // namespace
+
 // The construct stub for ES5 constructor functions and ES6 class constructors.
-void Generate_JSConstructStubGeneric(MacroAssembler* masm,
-                                     bool restrict_constructor_return) {
+void Builtins::Generate_JSConstructStubGeneric(MacroAssembler* masm) {
   // ----------- S t a t e -------------
   //  -- x0     : number of arguments
   //  -- x1     : constructor function
@@ -348,8 +268,7 @@ void Generate_JSConstructStubGeneric(MacroAssembler* masm,
 
     // Restore constructor function and argument count.
     __ Ldr(x1, MemOperand(fp, ConstructFrameConstants::kConstructorOffset));
-    __ Ldrsw(x12,
-             UntagSmiMemOperand(fp, ConstructFrameConstants::kLengthOffset));
+    __ SmiUntag(x12, MemOperand(fp, ConstructFrameConstants::kLengthOffset));
 
     // Copy arguments to the expression stack. The called function pops the
     // receiver along with its arguments, so we need an extra receiver on the
@@ -418,7 +337,7 @@ void Generate_JSConstructStubGeneric(MacroAssembler* masm,
     // If the result is an object (in the ECMA sense), we should get rid
     // of the receiver and use the result; see ECMA-262 section 13.2.2-7
     // on page 74.
-    Label use_receiver, do_throw, other_result, leave_frame;
+    Label use_receiver, do_throw, leave_frame;
 
     // If the result is undefined, we jump out to using the implicit receiver.
     __ CompareRoot(x0, Heap::kUndefinedValueRootIndex);
@@ -428,30 +347,13 @@ void Generate_JSConstructStubGeneric(MacroAssembler* masm,
     // is a valid receiver.
 
     // If the result is a smi, it is *not* an object in the ECMA sense.
-    __ JumpIfSmi(x0, &other_result);
+    __ JumpIfSmi(x0, &use_receiver);
 
     // If the type of the result (stored in its map) is less than
     // FIRST_JS_RECEIVER_TYPE, it is not an object in the ECMA sense.
     STATIC_ASSERT(LAST_JS_RECEIVER_TYPE == LAST_TYPE);
     __ JumpIfObjectType(x0, x4, x5, FIRST_JS_RECEIVER_TYPE, &leave_frame, ge);
-
-    // The result is now neither undefined nor an object.
-    __ Bind(&other_result);
-    __ Ldr(x4, MemOperand(fp, ConstructFrameConstants::kConstructorOffset));
-    __ Ldr(x4, FieldMemOperand(x4, JSFunction::kSharedFunctionInfoOffset));
-    __ Ldr(w4, FieldMemOperand(x4, SharedFunctionInfo::kFlagsOffset));
-
-    if (restrict_constructor_return) {
-      // Throw if constructor function is a class constructor
-      __ TestAndBranchIfAllClear(
-          w4, SharedFunctionInfo::IsClassConstructorBit::kMask, &use_receiver);
-    } else {
-      __ TestAndBranchIfAnySet(
-          w4, SharedFunctionInfo::IsClassConstructorBit::kMask, &use_receiver);
-      __ CallRuntime(
-          Runtime::kIncrementUseCounterConstructorReturnNonUndefinedPrimitive);
-      __ B(&use_receiver);
-    }
+    __ B(&use_receiver);
 
     __ Bind(&do_throw);
     __ CallRuntime(Runtime::kThrowConstructorReturnedNonObject);
@@ -465,24 +367,13 @@ void Generate_JSConstructStubGeneric(MacroAssembler* masm,
 
     __ Bind(&leave_frame);
     // Restore smi-tagged arguments count from the frame.
-    __ Ldrsw(x1,
-             UntagSmiMemOperand(fp, ConstructFrameConstants::kLengthOffset));
+    __ SmiUntag(x1, MemOperand(fp, ConstructFrameConstants::kLengthOffset));
     // Leave construct frame.
   }
   // Remove caller arguments from the stack and return.
   __ DropArguments(x1, TurboAssembler::kCountExcludesReceiver);
   __ Ret();
 }
-}  // namespace
-
-void Builtins::Generate_JSConstructStubGenericRestrictedReturn(
-    MacroAssembler* masm) {
-  Generate_JSConstructStubGeneric(masm, true);
-}
-void Builtins::Generate_JSConstructStubGenericUnrestrictedReturn(
-    MacroAssembler* masm) {
-  Generate_JSConstructStubGeneric(masm, false);
-}
 void Builtins::Generate_JSBuiltinsConstructStub(MacroAssembler* masm) {
   Generate_JSBuiltinsConstructStubHelper(masm);
 }
@@ -516,14 +407,14 @@ void Builtins::Generate_ResumeGeneratorTrampoline(MacroAssembler* masm) {
   Label stepping_prepared;
   ExternalReference debug_hook =
       ExternalReference::debug_hook_on_function_call_address(masm->isolate());
-  __ Mov(x10, Operand(debug_hook));
+  __ Mov(x10, debug_hook);
   __ Ldrsb(x10, MemOperand(x10));
   __ CompareAndBranch(x10, Operand(0), ne, &prepare_step_in_if_stepping);
 
   // Flood function if we need to continue stepping in the suspended generator.
   ExternalReference debug_suspended_generator =
       ExternalReference::debug_suspended_generator_address(masm->isolate());
-  __ Mov(x10, Operand(debug_suspended_generator));
+  __ Mov(x10, debug_suspended_generator);
   __ Ldr(x10, MemOperand(x10));
   __ CompareAndBranch(x10, Operand(x1), eq,
                       &prepare_step_in_suspended_generator);
@@ -537,8 +428,8 @@ void Builtins::Generate_ResumeGeneratorTrampoline(MacroAssembler* masm) {
 
   // Get number of arguments for generator function.
   __ Ldr(x10, FieldMemOperand(x4, JSFunction::kSharedFunctionInfoOffset));
-  __ Ldr(w10,
-         FieldMemOperand(x10, SharedFunctionInfo::kFormalParameterCountOffset));
+  __ Ldrh(w10, FieldMemOperand(
+                   x10, SharedFunctionInfo::kFormalParameterCountOffset));
 
   // Claim slots for arguments and receiver (rounded up to a multiple of two).
   __ Add(x11, x10, 2);
@@ -563,18 +454,21 @@ void Builtins::Generate_ResumeGeneratorTrampoline(MacroAssembler* masm) {
   //  -- sp[0 .. arg count - 1]   : claimed for args
   // -----------------------------------
 
-  // Push holes for arguments to generator function. Since the parser forced
-  // context allocation for any variables in generators, the actual argument
-  // values have already been copied into the context and these dummy values
-  // will never be used.
+  // Copy the function arguments from the generator object's register file.
+
+  __ Ldr(x5,
+         FieldMemOperand(x1, JSGeneratorObject::kParametersAndRegistersOffset));
   {
     Label loop, done;
     __ Cbz(x10, &done);
-    __ LoadRoot(x11, Heap::kTheHoleValueRootIndex);
+    __ Mov(x12, 0);
 
     __ Bind(&loop);
     __ Sub(x10, x10, 1);
+    __ Add(x11, x5, Operand(x12, LSL, kPointerSizeLog2));
+    __ Ldr(x11, FieldMemOperand(x11, FixedArray::kHeaderSize));
     __ Poke(x11, Operand(x10, LSL, kPointerSizeLog2));
+    __ Add(x12, x12, 1);
     __ Cbnz(x10, &loop);
     __ Bind(&done);
   }
@@ -595,8 +489,8 @@ void Builtins::Generate_ResumeGeneratorTrampoline(MacroAssembler* masm) {
   // Resume (Ignition/TurboFan) generator object.
   {
     __ Ldr(x0, FieldMemOperand(x4, JSFunction::kSharedFunctionInfoOffset));
-    __ Ldr(w0, FieldMemOperand(
-                   x0, SharedFunctionInfo::kFormalParameterCountOffset));
+    __ Ldrh(w0, FieldMemOperand(
+                    x0, SharedFunctionInfo::kFormalParameterCountOffset));
     // We abuse new.target both to indicate that this is a resume call and to
     // pass in the generator object.  In ordinary calls, new.target is always
     // undefined because generator functions are non-constructable.
@@ -611,8 +505,9 @@ void Builtins::Generate_ResumeGeneratorTrampoline(MacroAssembler* masm) {
   __ Bind(&prepare_step_in_if_stepping);
   {
     FrameScope scope(masm, StackFrame::INTERNAL);
-    __ Push(x1, padreg);
-    __ PushArgument(x4);
+    // Push hole as receiver since we do not use it for stepping.
+    __ LoadRoot(x5, Heap::kTheHoleValueRootIndex);
+    __ Push(x1, padreg, x4, x5);
     __ CallRuntime(Runtime::kDebugOnFunctionCall);
     __ Pop(padreg, x1);
     __ Ldr(x4, FieldMemOperand(x1, JSGeneratorObject::kFunctionOffset));
@@ -665,7 +560,6 @@ static void Generate_StackOverflowCheck(MacroAssembler* masm, Register num_args,
 //   x0: result.
 static void Generate_JSEntryTrampolineHelper(MacroAssembler* masm,
                                              bool is_construct) {
-  // Called from JSEntryStub::GenerateBody().
   Register new_target = x0;
   Register function = x1;
   Register receiver = x2;
@@ -681,12 +575,10 @@ static void Generate_JSEntryTrampolineHelper(MacroAssembler* masm,
     FrameScope scope(masm, StackFrame::INTERNAL);
 
     // Setup the context (we need to use the caller context from the isolate).
-    __ Mov(scratch, Operand(ExternalReference(IsolateAddressId::kContextAddress,
-                                              masm->isolate())));
+    __ Mov(scratch, ExternalReference::Create(IsolateAddressId::kContextAddress,
+                                              masm->isolate()));
     __ Ldr(cp, MemOperand(scratch));
 
-    __ InitializeRootRegister();
-
     // Claim enough space for the arguments, the receiver and the function,
     // including an optional slot of padding.
     __ Add(slots_to_claim, argc, 3);
@@ -754,7 +646,7 @@ static void Generate_JSEntryTrampolineHelper(MacroAssembler* masm,
     __ Mov(x25, x19);
     __ Mov(x28, x19);
     // Don't initialize the reserved registers.
-    // x26 : root register (root).
+    // x26 : root register (kRootRegister).
     // x27 : context pointer (cp).
     // x29 : frame pointer (fp).
 
@@ -932,9 +824,7 @@ static void AdvanceBytecodeOffsetOrReturn(MacroAssembler* masm,
   DCHECK(!AreAliased(bytecode_array, bytecode_offset, bytecode_size_table,
                      bytecode));
 
-  __ Mov(
-      bytecode_size_table,
-      Operand(ExternalReference::bytecode_size_table_address(masm->isolate())));
+  __ Mov(bytecode_size_table, ExternalReference::bytecode_size_table_address());
 
   // Check if the bytecode is a Wide or ExtraWide prefix bytecode.
   Label process_bytecode, extra_wide;
@@ -1011,10 +901,9 @@ void Builtins::Generate_InterpreterEntryTrampoline(MacroAssembler* masm) {
   __ Push(lr, fp, cp, closure);
   __ Add(fp, sp, StandardFrameConstants::kFixedFrameSizeFromFp);
 
-  // Get the bytecode array from the function object (or from the DebugInfo if
-  // it is present) and load it into kInterpreterBytecodeArrayRegister.
-  Label maybe_load_debug_bytecode_array, bytecode_array_loaded,
-      has_bytecode_array;
+  // Get the bytecode array from the function object and load it into
+  // kInterpreterBytecodeArrayRegister.
+  Label has_bytecode_array;
   __ Ldr(x0, FieldMemOperand(closure, JSFunction::kSharedFunctionInfoOffset));
   __ Ldr(kInterpreterBytecodeArrayRegister,
          FieldMemOperand(x0, SharedFunctionInfo::kFunctionDataOffset));
@@ -1025,9 +914,6 @@ void Builtins::Generate_InterpreterEntryTrampoline(MacroAssembler* masm) {
          FieldMemOperand(kInterpreterBytecodeArrayRegister,
                          InterpreterData::kBytecodeArrayOffset));
   __ Bind(&has_bytecode_array);
-  __ Ldr(x11, FieldMemOperand(x0, SharedFunctionInfo::kDebugInfoOffset));
-  __ JumpIfNotSmi(x11, &maybe_load_debug_bytecode_array);
-  __ Bind(&bytecode_array_loaded);
 
   // Increment invocation count for the function.
   __ Ldr(x11, FieldMemOperand(closure, JSFunction::kFeedbackCellOffset));
@@ -1106,9 +992,9 @@ void Builtins::Generate_InterpreterEntryTrampoline(MacroAssembler* masm) {
   // handler at the current bytecode offset.
   Label do_dispatch;
   __ bind(&do_dispatch);
-  __ Mov(kInterpreterDispatchTableRegister,
-         Operand(ExternalReference::interpreter_dispatch_table_address(
-             masm->isolate())));
+  __ Mov(
+      kInterpreterDispatchTableRegister,
+      ExternalReference::interpreter_dispatch_table_address(masm->isolate()));
   __ Ldrb(x18, MemOperand(kInterpreterBytecodeArrayRegister,
                           kInterpreterBytecodeOffsetRegister));
   __ Mov(x1, Operand(x18, LSL, kPointerSizeLog2));
@@ -1140,31 +1026,6 @@ void Builtins::Generate_InterpreterEntryTrampoline(MacroAssembler* masm) {
   // The return value is in x0.
   LeaveInterpreterFrame(masm, x2);
   __ Ret();
-
-  // Load debug copy of the bytecode array if it exists.
-  // kInterpreterBytecodeArrayRegister is already loaded with
-  // SharedFunctionInfo::kFunctionDataOffset.
-  __ Bind(&maybe_load_debug_bytecode_array);
-  __ Ldr(x10, FieldMemOperand(x11, DebugInfo::kDebugBytecodeArrayOffset));
-  __ JumpIfRoot(x10, Heap::kUndefinedValueRootIndex, &bytecode_array_loaded);
-
-  __ Mov(kInterpreterBytecodeArrayRegister, x10);
-  __ Ldr(x10, UntagSmiFieldMemOperand(x11, DebugInfo::kFlagsOffset));
-  __ And(x10, x10, Immediate(DebugInfo::kDebugExecutionMode));
-
-  STATIC_ASSERT(static_cast<int>(DebugInfo::kDebugExecutionMode) ==
-                static_cast<int>(DebugInfo::kSideEffects));
-  ExternalReference debug_execution_mode =
-      ExternalReference::debug_execution_mode_address(masm->isolate());
-  __ Mov(x11, Operand(debug_execution_mode));
-  __ Ldrsb(x11, MemOperand(x11));
-  __ CompareAndBranch(x10, x11, eq, &bytecode_array_loaded);
-
-  __ Push(closure, feedback_vector);
-  __ PushArgument(closure);
-  __ CallRuntime(Runtime::kDebugApplyInstrumentation);
-  __ Pop(feedback_vector, closure);
-  __ jmp(&bytecode_array_loaded);
 }
 
 static void Generate_InterpreterPushArgs(MacroAssembler* masm,
@@ -1302,8 +1163,8 @@ void Builtins::Generate_InterpreterPushArgsThenConstructImpl(
 
     // Tail call to the array construct stub (still in the caller
     // context at this point).
-    ArrayConstructorStub array_constructor_stub(masm->isolate());
-    __ Jump(array_constructor_stub.GetCode(), RelocInfo::CODE_TARGET);
+    Handle<Code> code = BUILTIN_CODE(masm->isolate(), ArrayConstructorImpl);
+    __ Jump(code, RelocInfo::CODE_TARGET);
   } else if (mode == InterpreterPushArgsMode::kWithFinalSpread) {
     // Call the constructor with x0, x1, and x3 unmodified.
     __ Jump(BUILTIN_CODE(masm->isolate(), ConstructWithSpread),
@@ -1345,9 +1206,9 @@ static void Generate_InterpreterEnterBytecode(MacroAssembler* masm) {
                          Code::kHeaderSize - kHeapObjectTag));
 
   // Initialize the dispatch table register.
-  __ Mov(kInterpreterDispatchTableRegister,
-         Operand(ExternalReference::interpreter_dispatch_table_address(
-             masm->isolate())));
+  __ Mov(
+      kInterpreterDispatchTableRegister,
+      ExternalReference::interpreter_dispatch_table_address(masm->isolate()));
 
   // Get the bytecode array pointer from the frame.
   __ Ldr(kInterpreterBytecodeArrayRegister,
@@ -1411,206 +1272,6 @@ void Builtins::Generate_InterpreterEnterBytecodeDispatch(MacroAssembler* masm) {
   Generate_InterpreterEnterBytecode(masm);
 }
 
-void Builtins::Generate_CompileLazyDeoptimizedCode(MacroAssembler* masm) {
-  // Set the code slot inside the JSFunction to CompileLazy.
-  __ Mov(x2, BUILTIN_CODE(masm->isolate(), CompileLazy));
-  __ Str(x2, FieldMemOperand(x1, JSFunction::kCodeOffset));
-  __ RecordWriteField(x1, JSFunction::kCodeOffset, x2, x5, kLRHasNotBeenSaved,
-                      kDontSaveFPRegs, OMIT_REMEMBERED_SET, OMIT_SMI_CHECK);
-  // Jump to compile lazy.
-  Generate_CompileLazy(masm);
-}
-
-static void GetSharedFunctionInfoCode(MacroAssembler* masm, Register sfi_data,
-                                      Register scratch1) {
-  // Figure out the SFI's code object.
-  Label done;
-  Label check_is_bytecode_array;
-  Label check_is_code;
-  Label check_is_fixed_array;
-  Label check_is_pre_parsed_scope_data;
-  Label check_is_function_template_info;
-  Label check_is_interpreter_data;
-
-  Register data_type = scratch1;
-
-  // IsSmi: Is builtin
-  __ JumpIfNotSmi(sfi_data, &check_is_bytecode_array);
-  __ Mov(scratch1, ExternalReference::builtins_address(masm->isolate()));
-  __ Mov(sfi_data, Operand::UntagSmiAndScale(sfi_data, kPointerSizeLog2));
-  __ Ldr(sfi_data, MemOperand(scratch1, sfi_data));
-  __ B(&done);
-
-  // Get map for subsequent checks.
-  __ Bind(&check_is_bytecode_array);
-  __ Ldr(data_type, FieldMemOperand(sfi_data, HeapObject::kMapOffset));
-  __ Ldrh(data_type, FieldMemOperand(data_type, Map::kInstanceTypeOffset));
-
-  // IsBytecodeArray: Interpret bytecode
-  __ Cmp(data_type, Operand(BYTECODE_ARRAY_TYPE));
-  __ B(ne, &check_is_code);
-  __ Move(sfi_data, BUILTIN_CODE(masm->isolate(), InterpreterEntryTrampoline));
-  __ B(&done);
-
-  // IsCode: Run code
-  __ Bind(&check_is_code);
-  __ Cmp(data_type, Operand(CODE_TYPE));
-  __ B(eq, &done);
-
-  // IsFixedArray: Instantiate using AsmWasmData,
-  __ Bind(&check_is_fixed_array);
-  __ Cmp(data_type, Operand(FIXED_ARRAY_TYPE));
-  __ B(ne, &check_is_pre_parsed_scope_data);
-  __ Move(sfi_data, BUILTIN_CODE(masm->isolate(), InstantiateAsmJs));
-  __ B(&done);
-
-  // IsPreParsedScopeData: Compile lazy
-  __ Bind(&check_is_pre_parsed_scope_data);
-  __ Cmp(data_type, Operand(TUPLE2_TYPE));
-  __ B(ne, &check_is_function_template_info);
-  __ Move(sfi_data, BUILTIN_CODE(masm->isolate(), CompileLazy));
-  __ B(&done);
-
-  // IsFunctionTemplateInfo: API call
-  __ Bind(&check_is_function_template_info);
-  __ Cmp(data_type, Operand(FUNCTION_TEMPLATE_INFO_TYPE));
-  __ B(ne, &check_is_interpreter_data);
-  __ Move(sfi_data, BUILTIN_CODE(masm->isolate(), HandleApiCall));
-  __ B(&done);
-
-  // IsInterpreterData: Interpret bytecode
-  __ Bind(&check_is_interpreter_data);
-  if (FLAG_debug_code) {
-    __ Cmp(data_type, Operand(INTERPRETER_DATA_TYPE));
-    __ Assert(eq, AbortReason::kInvalidSharedFunctionInfoData);
-  }
-  __ Ldr(
-      sfi_data,
-      FieldMemOperand(sfi_data, InterpreterData::kInterpreterTrampolineOffset));
-
-  __ Bind(&done);
-}
-
-void Builtins::Generate_CompileLazy(MacroAssembler* masm) {
-  // ----------- S t a t e -------------
-  //  -- x0 : argument count (preserved for callee)
-  //  -- x3 : new target (preserved for callee)
-  //  -- x1 : target function (preserved for callee)
-  // -----------------------------------
-  // First lookup code, maybe we don't need to compile!
-  Label gotta_call_runtime;
-
-  Register closure = x1;
-  Register feedback_vector = x2;
-
-  // Do we have a valid feedback vector?
-  __ Ldr(feedback_vector,
-         FieldMemOperand(closure, JSFunction::kFeedbackCellOffset));
-  __ Ldr(feedback_vector, FieldMemOperand(feedback_vector, Cell::kValueOffset));
-  __ JumpIfRoot(feedback_vector, Heap::kUndefinedValueRootIndex,
-                &gotta_call_runtime);
-
-  // Is there an optimization marker or optimized code in the feedback vector?
-  MaybeTailCallOptimizedCodeSlot(masm, feedback_vector, x7, x4, x5);
-
-  // We found no optimized code. Infer the code object needed for the SFI.
-  Register entry = x7;
-  __ Ldr(entry,
-         FieldMemOperand(closure, JSFunction::kSharedFunctionInfoOffset));
-  __ Ldr(entry,
-         FieldMemOperand(entry, SharedFunctionInfo::kFunctionDataOffset));
-  GetSharedFunctionInfoCode(masm, entry, x5);
-
-  // If code entry points to anything other than CompileLazy, install that.
-  __ Move(x5, masm->CodeObject());
-  __ Cmp(entry, x5);
-  __ B(eq, &gotta_call_runtime);
-
-  // Install the SFI's code entry.
-  __ Str(entry, FieldMemOperand(closure, JSFunction::kCodeOffset));
-  __ Mov(x10, entry);  // Write barrier clobbers x10 below.
-  __ RecordWriteField(closure, JSFunction::kCodeOffset, x10, x5,
-                      kLRHasNotBeenSaved, kDontSaveFPRegs, OMIT_REMEMBERED_SET,
-                      OMIT_SMI_CHECK);
-  __ Add(entry, entry, Operand(Code::kHeaderSize - kHeapObjectTag));
-  __ Jump(entry);
-
-  __ Bind(&gotta_call_runtime);
-  GenerateTailCallToReturnedCode(masm, Runtime::kCompileLazy);
-}
-
-// Lazy deserialization design doc: http://goo.gl/dxkYDZ.
-void Builtins::Generate_DeserializeLazy(MacroAssembler* masm) {
-  // ----------- S t a t e -------------
-  //  -- x0 : argument count (preserved for callee)
-  //  -- x3 : new target (preserved for callee)
-  //  -- x1 : target function (preserved for callee)
-  // -----------------------------------
-
-  Label deserialize_in_runtime;
-
-  Register target = x1;  // Must be preserved
-  Register scratch0 = x2;
-  Register scratch1 = x4;
-
-  CHECK(!scratch0.is(x0) && !scratch0.is(x3) && !scratch0.is(x1));
-  CHECK(!scratch1.is(x0) && !scratch1.is(x3) && !scratch1.is(x1));
-  CHECK(!scratch0.is(scratch1));
-
-  // Load the builtin id for lazy deserialization from SharedFunctionInfo.
-
-  __ AssertFunction(target);
-  __ Ldr(scratch0,
-         FieldMemOperand(target, JSFunction::kSharedFunctionInfoOffset));
-
-  __ Ldr(scratch1,
-         FieldMemOperand(scratch0, SharedFunctionInfo::kFunctionDataOffset));
-  __ AssertSmi(scratch1);
-
-  // The builtin may already have been deserialized. If that is the case, it is
-  // stored in the builtins table, and we can copy to correct code object to
-  // both the shared function info and function without calling into runtime.
-  //
-  // Otherwise, we need to call into runtime to deserialize.
-
-  {
-    // Load the code object at builtins_table[builtin_id] into scratch1.
-
-    __ SmiUntag(scratch1);
-    __ Mov(scratch0, ExternalReference::builtins_address(masm->isolate()));
-    __ Ldr(scratch1, MemOperand(scratch0, scratch1, LSL, kPointerSizeLog2));
-
-    // Check if the loaded code object has already been deserialized. This is
-    // the case iff it does not equal DeserializeLazy.
-
-    __ Move(scratch0, masm->CodeObject());
-    __ Cmp(scratch1, scratch0);
-    __ B(eq, &deserialize_in_runtime);
-  }
-
-  {
-    // If we've reached this spot, the target builtin has been deserialized and
-    // we simply need to copy it over to the target function.
-
-    Register target_builtin = scratch1;
-
-    __ Str(target_builtin, FieldMemOperand(target, JSFunction::kCodeOffset));
-    __ Mov(x9, target_builtin);  // Write barrier clobbers x9 below.
-    __ RecordWriteField(target, JSFunction::kCodeOffset, x9, x5,
-                        kLRHasNotBeenSaved, kDontSaveFPRegs,
-                        OMIT_REMEMBERED_SET, OMIT_SMI_CHECK);
-
-    // All copying is done. Jump to the deserialized code object.
-
-    __ Add(target_builtin, target_builtin,
-           Operand(Code::kHeaderSize - kHeapObjectTag));
-    __ Jump(target_builtin);
-  }
-
-  __ bind(&deserialize_in_runtime);
-  GenerateTailCallToReturnedCode(masm, Runtime::kDeserializeLazy);
-}
-
 void Builtins::Generate_InstantiateAsmJs(MacroAssembler* masm) {
   // ----------- S t a t e -------------
   //  -- x0 : argument count (preserved for callee)
@@ -1681,7 +1342,7 @@ void Builtins::Generate_InstantiateAsmJs(MacroAssembler* masm) {
     __ JumpIfSmi(x0, &failed);
 
     // Peek the argument count from the stack, untagging at the same time.
-    __ Ldr(w4, UntagSmiMemOperand(sp, 3 * kPointerSize));
+    __ SmiUntag(x4, MemOperand(sp, 3 * kPointerSize));
     __ Drop(4);
     scope.GenerateLeaveFrame();
 
@@ -1825,9 +1486,9 @@ static void Generate_OnStackReplacementHelper(MacroAssembler* masm,
 
   // Load the OSR entrypoint offset from the deoptimization data.
   // <osr_offset> = <deopt_data>[#header_size + #osr_pc_offset]
-  __ Ldrsw(w1, UntagSmiFieldMemOperand(
-                   x1, FixedArray::OffsetOfElementAt(
-                           DeoptimizationData::kOsrPcOffsetIndex)));
+  __ SmiUntag(x1,
+              FieldMemOperand(x1, FixedArray::OffsetOfElementAt(
+                                      DeoptimizationData::kOsrPcOffsetIndex)));
 
   // Compute the target address = code_obj + header_size + osr_offset
   // <entry_addr> = <code_obj> + #header_size + <osr_offset>
@@ -2247,7 +1908,24 @@ void Builtins::Generate_CallOrConstructVarargs(MacroAssembler* masm,
   //  -- x4 : len (number of elements to push from args)
   //  -- x3 : new.target (for [[Construct]])
   // -----------------------------------
-  __ AssertFixedArray(x2);
+  if (masm->emit_debug_code()) {
+    // Allow x2 to be a FixedArray, or a FixedDoubleArray if x4 == 0.
+    Label ok, fail;
+    __ AssertNotSmi(x2, AbortReason::kOperandIsNotAFixedArray);
+    __ Ldr(x10, FieldMemOperand(x2, HeapObject::kMapOffset));
+    __ Ldrh(x13, FieldMemOperand(x10, Map::kInstanceTypeOffset));
+    __ Cmp(x13, FIXED_ARRAY_TYPE);
+    __ B(eq, &ok);
+    __ Cmp(x13, FIXED_DOUBLE_ARRAY_TYPE);
+    __ B(ne, &fail);
+    __ Cmp(x4, 0);
+    __ B(eq, &ok);
+    // Fall through.
+    __ bind(&fail);
+    __ Abort(AbortReason::kOperandIsNotAFixedArray);
+
+    __ bind(&ok);
+  }
 
   Register arguments_list = x2;
   Register argc = x0;
@@ -2353,18 +2031,18 @@ void Builtins::Generate_CallOrConstructForwardVarargs(MacroAssembler* masm,
              MemOperand(fp, JavaScriptFrameConstants::kFunctionOffset));
       __ Ldr(scratch,
              FieldMemOperand(scratch, JSFunction::kSharedFunctionInfoOffset));
-      __ Ldrsw(len,
-               FieldMemOperand(
-                   scratch, SharedFunctionInfo::kFormalParameterCountOffset));
+      __ Ldrh(len,
+              FieldMemOperand(scratch,
+                              SharedFunctionInfo::kFormalParameterCountOffset));
       __ Mov(args_fp, fp);
     }
     __ B(&arguments_done);
     __ Bind(&arguments_adaptor);
     {
       // Just load the length from ArgumentsAdaptorFrame.
-      __ Ldrsw(len,
-               UntagSmiMemOperand(
-                   args_fp, ArgumentsAdaptorFrameConstants::kLengthOffset));
+      __ SmiUntag(
+          len,
+          MemOperand(args_fp, ArgumentsAdaptorFrameConstants::kLengthOffset));
     }
     __ Bind(&arguments_done);
   }
@@ -2480,8 +2158,8 @@ void Builtins::Generate_CallFunction(MacroAssembler* masm,
   //  -- cp : the function context.
   // -----------------------------------
 
-  __ Ldrsw(
-      x2, FieldMemOperand(x2, SharedFunctionInfo::kFormalParameterCountOffset));
+  __ Ldrh(x2,
+          FieldMemOperand(x2, SharedFunctionInfo::kFormalParameterCountOffset));
   ParameterCount actual(x0);
   ParameterCount expected(x2);
   __ InvokeFunctionCode(x1, no_reg, expected, actual, JUMP_FUNCTION);
@@ -2511,8 +2189,8 @@ void Generate_PushBoundArguments(MacroAssembler* masm) {
   Label no_bound_arguments;
   __ Ldr(bound_argv,
          FieldMemOperand(x1, JSBoundFunction::kBoundArgumentsOffset));
-  __ Ldrsw(bound_argc,
-           UntagSmiFieldMemOperand(bound_argv, FixedArray::kLengthOffset));
+  __ SmiUntag(bound_argc,
+              FieldMemOperand(bound_argv, FixedArray::kLengthOffset));
   __ Cbz(bound_argc, &no_bound_arguments);
   {
     // ----------- S t a t e -------------
@@ -2713,7 +2391,7 @@ void Builtins::Generate_ConstructFunction(MacroAssembler* masm) {
           RelocInfo::CODE_TARGET);
 
   __ bind(&call_generic_stub);
-  __ Jump(masm->isolate()->builtins()->JSConstructStubGeneric(),
+  __ Jump(BUILTIN_CODE(masm->isolate(), JSConstructStubGeneric),
           RelocInfo::CODE_TARGET);
 }
 
@@ -2799,46 +2477,6 @@ void Builtins::Generate_Construct(MacroAssembler* masm) {
           RelocInfo::CODE_TARGET);
 }
 
-// static
-void Builtins::Generate_AllocateInNewSpace(MacroAssembler* masm) {
-  ASM_LOCATION("Builtins::Generate_AllocateInNewSpace");
-  // ----------- S t a t e -------------
-  //  -- x1 : requested object size (untagged)
-  //  -- lr : return address
-  // -----------------------------------
-  __ SmiTag(x1);
-  __ PushArgument(x1);
-  __ Move(cp, Smi::kZero);
-  __ TailCallRuntime(Runtime::kAllocateInNewSpace);
-}
-
-// static
-void Builtins::Generate_AllocateInOldSpace(MacroAssembler* masm) {
-  ASM_LOCATION("Builtins::Generate_AllocateInOldSpace");
-  // ----------- S t a t e -------------
-  //  -- x1 : requested object size (untagged)
-  //  -- lr : return address
-  // -----------------------------------
-  __ SmiTag(x1);
-  __ Move(x2, Smi::FromInt(AllocateTargetSpace::encode(OLD_SPACE)));
-  __ Push(x1, x2);
-  __ Move(cp, Smi::kZero);
-  __ TailCallRuntime(Runtime::kAllocateInTargetSpace);
-}
-
-// static
-void Builtins::Generate_Abort(MacroAssembler* masm) {
-  ASM_LOCATION("Builtins::Generate_Abort");
-  // ----------- S t a t e -------------
-  //  -- x1 : message_id as Smi
-  //  -- lr : return address
-  // -----------------------------------
-  MacroAssembler::NoUseRealAbortsScope no_use_real_aborts(masm);
-  __ PushArgument(x1);
-  __ Move(cp, Smi::kZero);
-  __ TailCallRuntime(Runtime::kAbort);
-}
-
 void Builtins::Generate_ArgumentsAdaptorTrampoline(MacroAssembler* masm) {
   ASM_LOCATION("Builtins::Generate_ArgumentsAdaptorTrampoline");
   // ----------- S t a t e -------------
@@ -3032,34 +2670,38 @@ void Builtins::Generate_ArgumentsAdaptorTrampoline(MacroAssembler* masm) {
 }
 
 void Builtins::Generate_WasmCompileLazy(MacroAssembler* masm) {
+  // The function index was put in w8 by the jump table trampoline.
+  // Sign extend and convert to Smi for the runtime call.
+  __ sxtw(x8, w8);
+  __ SmiTag(x8, x8);
   {
-    FrameScope scope(masm, StackFrame::INTERNAL);
-
-    auto wasm_instance_reg = x7;  // TODO(titzer): put in a common place.
+    TrapOnAbortScope trap_on_abort_scope(masm);  // Avoid calls to Abort.
+    FrameScope scope(masm, StackFrame::WASM_COMPILE_LAZY);
 
     // Save all parameter registers (see wasm-linkage.cc). They might be
     // overwritten in the runtime call below. We don't have any callee-saved
     // registers in wasm, so no need to store anything else.
-    constexpr RegList gp_regs = Register::ListOf<x0, x1, x2, x3, x4, x5>();
+    constexpr RegList gp_regs =
+        Register::ListOf<x0, x1, x2, x3, x4, x5, x6, x7>();
     constexpr RegList fp_regs =
         Register::ListOf<d0, d1, d2, d3, d4, d5, d6, d7>();
     __ PushXRegList(gp_regs);
     __ PushDRegList(fp_regs);
-    __ Push(x5, x6);  // note: pushed twice because alignment required
 
-    // Pass the WASM instance as an explicit argument to WasmCompileLazy.
-    __ PushArgument(wasm_instance_reg);
-    // Initialize the JavaScript context with 0. CEntryStub will use it to
+    // Pass instance and function index as explicit arguments to the runtime
+    // function.
+    __ Push(kWasmInstanceRegister, x8);
+    // Load the correct CEntry builtin from the instance object.
+    __ Ldr(x2, FieldMemOperand(kWasmInstanceRegister,
+                               WasmInstanceObject::kCEntryStubOffset));
+    // Initialize the JavaScript context with 0. CEntry will use it to
     // set the current context on the isolate.
     __ Move(cp, Smi::kZero);
-    __ CallRuntime(Runtime::kWasmCompileLazy);
-    // The entrypoint address is the first return value.
+    __ CallRuntimeWithCEntry(Runtime::kWasmCompileLazy, x2);
+    // The entrypoint address is the return value.
     __ mov(x8, kReturnRegister0);
-    // The WASM instance is the second return value.
-    __ mov(wasm_instance_reg, kReturnRegister1);
 
     // Restore registers.
-    __ Pop(x6, x5);  // note: pushed twice because alignment required
     __ PopDRegList(fp_regs);
     __ PopXRegList(gp_regs);
   }
@@ -3067,6 +2709,483 @@ void Builtins::Generate_WasmCompileLazy(MacroAssembler* masm) {
   __ Jump(x8);
 }
 
+void Builtins::Generate_CEntry(MacroAssembler* masm, int result_size,
+                               SaveFPRegsMode save_doubles, ArgvMode argv_mode,
+                               bool builtin_exit_frame) {
+  // The Abort mechanism relies on CallRuntime, which in turn relies on
+  // CEntry, so until this stub has been generated, we have to use a
+  // fall-back Abort mechanism.
+  //
+  // Note that this stub must be generated before any use of Abort.
+  MacroAssembler::NoUseRealAbortsScope no_use_real_aborts(masm);
+
+  ASM_LOCATION("CEntry::Generate entry");
+  ProfileEntryHookStub::MaybeCallEntryHook(masm);
+
+  // Register parameters:
+  //    x0: argc (including receiver, untagged)
+  //    x1: target
+  // If argv_mode == kArgvInRegister:
+  //    x11: argv (pointer to first argument)
+  //
+  // The stack on entry holds the arguments and the receiver, with the receiver
+  // at the highest address:
+  //
+  //    sp]argc-1]: receiver
+  //    sp[argc-2]: arg[argc-2]
+  //    ...           ...
+  //    sp[1]:      arg[1]
+  //    sp[0]:      arg[0]
+  //
+  // The arguments are in reverse order, so that arg[argc-2] is actually the
+  // first argument to the target function and arg[0] is the last.
+  const Register& argc_input = x0;
+  const Register& target_input = x1;
+
+  // Calculate argv, argc and the target address, and store them in
+  // callee-saved registers so we can retry the call without having to reload
+  // these arguments.
+  // TODO(jbramley): If the first call attempt succeeds in the common case (as
+  // it should), then we might be better off putting these parameters directly
+  // into their argument registers, rather than using callee-saved registers and
+  // preserving them on the stack.
+  const Register& argv = x21;
+  const Register& argc = x22;
+  const Register& target = x23;
+
+  // Derive argv from the stack pointer so that it points to the first argument
+  // (arg[argc-2]), or just below the receiver in case there are no arguments.
+  //  - Adjust for the arg[] array.
+  Register temp_argv = x11;
+  if (argv_mode == kArgvOnStack) {
+    __ SlotAddress(temp_argv, x0);
+    //  - Adjust for the receiver.
+    __ Sub(temp_argv, temp_argv, 1 * kPointerSize);
+  }
+
+  // Reserve three slots to preserve x21-x23 callee-saved registers.
+  int extra_stack_space = 3;
+  // Enter the exit frame.
+  FrameScope scope(masm, StackFrame::MANUAL);
+  __ EnterExitFrame(
+      save_doubles == kSaveFPRegs, x10, extra_stack_space,
+      builtin_exit_frame ? StackFrame::BUILTIN_EXIT : StackFrame::EXIT);
+
+  // Poke callee-saved registers into reserved space.
+  __ Poke(argv, 1 * kPointerSize);
+  __ Poke(argc, 2 * kPointerSize);
+  __ Poke(target, 3 * kPointerSize);
+
+  // We normally only keep tagged values in callee-saved registers, as they
+  // could be pushed onto the stack by called stubs and functions, and on the
+  // stack they can confuse the GC. However, we're only calling C functions
+  // which can push arbitrary data onto the stack anyway, and so the GC won't
+  // examine that part of the stack.
+  __ Mov(argc, argc_input);
+  __ Mov(target, target_input);
+  __ Mov(argv, temp_argv);
+
+  // x21 : argv
+  // x22 : argc
+  // x23 : call target
+  //
+  // The stack (on entry) holds the arguments and the receiver, with the
+  // receiver at the highest address:
+  //
+  //         argv[8]:     receiver
+  // argv -> argv[0]:     arg[argc-2]
+  //         ...          ...
+  //         argv[...]:   arg[1]
+  //         argv[...]:   arg[0]
+  //
+  // Immediately below (after) this is the exit frame, as constructed by
+  // EnterExitFrame:
+  //         fp[8]:    CallerPC (lr)
+  //   fp -> fp[0]:    CallerFP (old fp)
+  //         fp[-8]:   Space reserved for SPOffset.
+  //         fp[-16]:  CodeObject()
+  //         sp[...]:  Saved doubles, if saved_doubles is true.
+  //         sp[32]:   Alignment padding, if necessary.
+  //         sp[24]:   Preserved x23 (used for target).
+  //         sp[16]:   Preserved x22 (used for argc).
+  //         sp[8]:    Preserved x21 (used for argv).
+  //   sp -> sp[0]:    Space reserved for the return address.
+  //
+  // After a successful call, the exit frame, preserved registers (x21-x23) and
+  // the arguments (including the receiver) are dropped or popped as
+  // appropriate. The stub then returns.
+  //
+  // After an unsuccessful call, the exit frame and suchlike are left
+  // untouched, and the stub either throws an exception by jumping to one of
+  // the exception_returned label.
+
+  // Prepare AAPCS64 arguments to pass to the builtin.
+  __ Mov(x0, argc);
+  __ Mov(x1, argv);
+  __ Mov(x2, ExternalReference::isolate_address(masm->isolate()));
+
+  Label return_location;
+  __ Adr(x12, &return_location);
+  __ Poke(x12, 0);
+
+  if (__ emit_debug_code()) {
+    // Verify that the slot below fp[kSPOffset]-8 points to the return location
+    // (currently in x12).
+    UseScratchRegisterScope temps(masm);
+    Register temp = temps.AcquireX();
+    __ Ldr(temp, MemOperand(fp, ExitFrameConstants::kSPOffset));
+    __ Ldr(temp, MemOperand(temp, -static_cast<int64_t>(kXRegSize)));
+    __ Cmp(temp, x12);
+    __ Check(eq, AbortReason::kReturnAddressNotFoundInFrame);
+  }
+
+  // Call the builtin.
+  __ Blr(target);
+  __ Bind(&return_location);
+
+  // Result returned in x0 or x1:x0 - do not destroy these registers!
+
+  //  x0    result0      The return code from the call.
+  //  x1    result1      For calls which return ObjectPair.
+  //  x21   argv
+  //  x22   argc
+  //  x23   target
+  const Register& result = x0;
+
+  // Check result for exception sentinel.
+  Label exception_returned;
+  __ CompareRoot(result, Heap::kExceptionRootIndex);
+  __ B(eq, &exception_returned);
+
+  // The call succeeded, so unwind the stack and return.
+
+  // Restore callee-saved registers x21-x23.
+  __ Mov(x11, argc);
+
+  __ Peek(argv, 1 * kPointerSize);
+  __ Peek(argc, 2 * kPointerSize);
+  __ Peek(target, 3 * kPointerSize);
+
+  __ LeaveExitFrame(save_doubles == kSaveFPRegs, x10, x9);
+  if (argv_mode == kArgvOnStack) {
+    // Drop the remaining stack slots and return from the stub.
+    __ DropArguments(x11);
+  }
+  __ AssertFPCRState();
+  __ Ret();
+
+  // Handling of exception.
+  __ Bind(&exception_returned);
+
+  ExternalReference pending_handler_context_address = ExternalReference::Create(
+      IsolateAddressId::kPendingHandlerContextAddress, masm->isolate());
+  ExternalReference pending_handler_entrypoint_address =
+      ExternalReference::Create(
+          IsolateAddressId::kPendingHandlerEntrypointAddress, masm->isolate());
+  ExternalReference pending_handler_fp_address = ExternalReference::Create(
+      IsolateAddressId::kPendingHandlerFPAddress, masm->isolate());
+  ExternalReference pending_handler_sp_address = ExternalReference::Create(
+      IsolateAddressId::kPendingHandlerSPAddress, masm->isolate());
+
+  // Ask the runtime for help to determine the handler. This will set x0 to
+  // contain the current pending exception, don't clobber it.
+  ExternalReference find_handler =
+      ExternalReference::Create(Runtime::kUnwindAndFindExceptionHandler);
+  {
+    FrameScope scope(masm, StackFrame::MANUAL);
+    __ Mov(x0, 0);  // argc.
+    __ Mov(x1, 0);  // argv.
+    __ Mov(x2, ExternalReference::isolate_address(masm->isolate()));
+    __ CallCFunction(find_handler, 3);
+  }
+
+  // Retrieve the handler context, SP and FP.
+  __ Mov(cp, pending_handler_context_address);
+  __ Ldr(cp, MemOperand(cp));
+  {
+    UseScratchRegisterScope temps(masm);
+    Register scratch = temps.AcquireX();
+    __ Mov(scratch, pending_handler_sp_address);
+    __ Ldr(scratch, MemOperand(scratch));
+    __ Mov(sp, scratch);
+  }
+  __ Mov(fp, pending_handler_fp_address);
+  __ Ldr(fp, MemOperand(fp));
+
+  // If the handler is a JS frame, restore the context to the frame. Note that
+  // the context will be set to (cp == 0) for non-JS frames.
+  Label not_js_frame;
+  __ Cbz(cp, &not_js_frame);
+  __ Str(cp, MemOperand(fp, StandardFrameConstants::kContextOffset));
+  __ Bind(&not_js_frame);
+
+  // Reset the masking register. This is done independent of the underlying
+  // feature flag {FLAG_branch_load_poisoning} to make the snapshot work with
+  // both configurations. It is safe to always do this, because the underlying
+  // register is caller-saved and can be arbitrarily clobbered.
+  __ ResetSpeculationPoisonRegister();
+
+  // Compute the handler entry address and jump to it.
+  __ Mov(x10, pending_handler_entrypoint_address);
+  __ Ldr(x10, MemOperand(x10));
+  __ Br(x10);
+}
+
+void Builtins::Generate_DoubleToI(MacroAssembler* masm) {
+  Label done;
+  Register result = x7;
+
+  DCHECK(result.Is64Bits());
+
+  TrapOnAbortScope trap_on_abort_scope(masm);  // Avoid calls to Abort.
+  UseScratchRegisterScope temps(masm);
+  Register scratch1 = temps.AcquireX();
+  Register scratch2 = temps.AcquireX();
+  DoubleRegister double_scratch = temps.AcquireD();
+
+  // Account for saved regs.
+  const int kArgumentOffset = 2 * kPointerSize;
+
+  __ Push(result, scratch1);  // scratch1 is also pushed to preserve alignment.
+  __ Peek(double_scratch, kArgumentOffset);
+
+  // Try to convert with a FPU convert instruction.  This handles all
+  // non-saturating cases.
+  __ TryConvertDoubleToInt64(result, double_scratch, &done);
+  __ Fmov(result, double_scratch);
+
+  // If we reach here we need to manually convert the input to an int32.
+
+  // Extract the exponent.
+  Register exponent = scratch1;
+  __ Ubfx(exponent, result, HeapNumber::kMantissaBits,
+          HeapNumber::kExponentBits);
+
+  // It the exponent is >= 84 (kMantissaBits + 32), the result is always 0 since
+  // the mantissa gets shifted completely out of the int32_t result.
+  __ Cmp(exponent, HeapNumber::kExponentBias + HeapNumber::kMantissaBits + 32);
+  __ CzeroX(result, ge);
+  __ B(ge, &done);
+
+  // The Fcvtzs sequence handles all cases except where the conversion causes
+  // signed overflow in the int64_t target. Since we've already handled
+  // exponents >= 84, we can guarantee that 63 <= exponent < 84.
+
+  if (masm->emit_debug_code()) {
+    __ Cmp(exponent, HeapNumber::kExponentBias + 63);
+    // Exponents less than this should have been handled by the Fcvt case.
+    __ Check(ge, AbortReason::kUnexpectedValue);
+  }
+
+  // Isolate the mantissa bits, and set the implicit '1'.
+  Register mantissa = scratch2;
+  __ Ubfx(mantissa, result, 0, HeapNumber::kMantissaBits);
+  __ Orr(mantissa, mantissa, 1UL << HeapNumber::kMantissaBits);
+
+  // Negate the mantissa if necessary.
+  __ Tst(result, kXSignMask);
+  __ Cneg(mantissa, mantissa, ne);
+
+  // Shift the mantissa bits in the correct place. We know that we have to shift
+  // it left here, because exponent >= 63 >= kMantissaBits.
+  __ Sub(exponent, exponent,
+         HeapNumber::kExponentBias + HeapNumber::kMantissaBits);
+  __ Lsl(result, mantissa, exponent);
+
+  __ Bind(&done);
+  __ Poke(result, kArgumentOffset);
+  __ Pop(scratch1, result);
+  __ Ret();
+}
+
+void Builtins::Generate_MathPowInternal(MacroAssembler* masm) {
+  Register exponent_integer = x12;
+  Register saved_lr = x19;
+  VRegister result_double = d0;
+  VRegister base_double = d0;
+  VRegister exponent_double = d1;
+  VRegister base_double_copy = d2;
+  VRegister scratch1_double = d6;
+  VRegister scratch0_double = d7;
+
+  // A fast-path for integer exponents.
+  Label exponent_is_integer;
+  // Allocate a heap number for the result, and return it.
+  Label done;
+
+  // Unpack the inputs.
+
+  // Handle double (heap number) exponents.
+  // Detect integer exponents stored as doubles and handle those in the
+  // integer fast-path.
+  __ TryRepresentDoubleAsInt64(exponent_integer, exponent_double,
+                               scratch0_double, &exponent_is_integer);
+
+  {
+    AllowExternalCallThatCantCauseGC scope(masm);
+    __ Mov(saved_lr, lr);
+    __ CallCFunction(ExternalReference::power_double_double_function(), 0, 2);
+    __ Mov(lr, saved_lr);
+    __ B(&done);
+  }
+
+  __ Bind(&exponent_is_integer);
+
+  // Find abs(exponent). For negative exponents, we can find the inverse later.
+  Register exponent_abs = x13;
+  __ Cmp(exponent_integer, 0);
+  __ Cneg(exponent_abs, exponent_integer, mi);
+
+  // Repeatedly multiply to calculate the power.
+  //  result = 1.0;
+  //  For each bit n (exponent_integer{n}) {
+  //    if (exponent_integer{n}) {
+  //      result *= base;
+  //    }
+  //    base *= base;
+  //    if (remaining bits in exponent_integer are all zero) {
+  //      break;
+  //    }
+  //  }
+  Label power_loop, power_loop_entry, power_loop_exit;
+  __ Fmov(scratch1_double, base_double);
+  __ Fmov(base_double_copy, base_double);
+  __ Fmov(result_double, 1.0);
+  __ B(&power_loop_entry);
+
+  __ Bind(&power_loop);
+  __ Fmul(scratch1_double, scratch1_double, scratch1_double);
+  __ Lsr(exponent_abs, exponent_abs, 1);
+  __ Cbz(exponent_abs, &power_loop_exit);
+
+  __ Bind(&power_loop_entry);
+  __ Tbz(exponent_abs, 0, &power_loop);
+  __ Fmul(result_double, result_double, scratch1_double);
+  __ B(&power_loop);
+
+  __ Bind(&power_loop_exit);
+
+  // If the exponent was positive, result_double holds the result.
+  __ Tbz(exponent_integer, kXSignBit, &done);
+
+  // The exponent was negative, so find the inverse.
+  __ Fmov(scratch0_double, 1.0);
+  __ Fdiv(result_double, scratch0_double, result_double);
+  // ECMA-262 only requires Math.pow to return an 'implementation-dependent
+  // approximation' of base^exponent. However, mjsunit/math-pow uses Math.pow
+  // to calculate the subnormal value 2^-1074. This method of calculating
+  // negative powers doesn't work because 2^1074 overflows to infinity. To
+  // catch this corner-case, we bail out if the result was 0. (This can only
+  // occur if the divisor is infinity or the base is zero.)
+  __ Fcmp(result_double, 0.0);
+  __ B(&done, ne);
+
+  AllowExternalCallThatCantCauseGC scope(masm);
+  __ Mov(saved_lr, lr);
+  __ Fmov(base_double, base_double_copy);
+  __ Scvtf(exponent_double, exponent_integer);
+  __ CallCFunction(ExternalReference::power_double_double_function(), 0, 2);
+  __ Mov(lr, saved_lr);
+  __ Bind(&done);
+  __ Ret();
+}
+
+namespace {
+
+void GenerateInternalArrayConstructorCase(MacroAssembler* masm,
+                                          ElementsKind kind) {
+  Label zero_case, n_case;
+  Register argc = x0;
+
+  __ Cbz(argc, &zero_case);
+  __ CompareAndBranch(argc, 1, ne, &n_case);
+
+  // One argument.
+  if (IsFastPackedElementsKind(kind)) {
+    Label packed_case;
+
+    // We might need to create a holey array; look at the first argument.
+    __ Peek(x10, 0);
+    __ Cbz(x10, &packed_case);
+
+    __ Jump(CodeFactory::InternalArraySingleArgumentConstructor(
+                masm->isolate(), GetHoleyElementsKind(kind))
+                .code(),
+            RelocInfo::CODE_TARGET);
+
+    __ Bind(&packed_case);
+  }
+
+  __ Jump(
+      CodeFactory::InternalArraySingleArgumentConstructor(masm->isolate(), kind)
+          .code(),
+      RelocInfo::CODE_TARGET);
+
+  __ Bind(&zero_case);
+  // No arguments.
+  __ Jump(CodeFactory::InternalArrayNoArgumentConstructor(masm->isolate(), kind)
+              .code(),
+          RelocInfo::CODE_TARGET);
+
+  __ Bind(&n_case);
+  // N arguments.
+  Handle<Code> code = BUILTIN_CODE(masm->isolate(), ArrayNArgumentsConstructor);
+  __ Jump(code, RelocInfo::CODE_TARGET);
+}
+
+}  // namespace
+
+void Builtins::Generate_InternalArrayConstructorImpl(MacroAssembler* masm) {
+  // ----------- S t a t e -------------
+  //  -- x0 : argc
+  //  -- x1 : constructor
+  //  -- sp[0] : return address
+  //  -- sp[4] : last argument
+  // -----------------------------------
+
+  Register constructor = x1;
+
+  if (FLAG_debug_code) {
+    // The array construct code is only set for the global and natives
+    // builtin Array functions which always have maps.
+
+    Label unexpected_map, map_ok;
+    // Initial map for the builtin Array function should be a map.
+    __ Ldr(x10, FieldMemOperand(constructor,
+                                JSFunction::kPrototypeOrInitialMapOffset));
+    // Will both indicate a nullptr and a Smi.
+    __ JumpIfSmi(x10, &unexpected_map);
+    __ JumpIfObjectType(x10, x10, x11, MAP_TYPE, &map_ok);
+    __ Bind(&unexpected_map);
+    __ Abort(AbortReason::kUnexpectedInitialMapForArrayFunction);
+    __ Bind(&map_ok);
+  }
+
+  Register kind = w3;
+  // Figure out the right elements kind
+  __ Ldr(x10, FieldMemOperand(constructor,
+                              JSFunction::kPrototypeOrInitialMapOffset));
+
+  // Retrieve elements_kind from map.
+  __ LoadElementsKindFromMap(kind, x10);
+
+  if (FLAG_debug_code) {
+    Label done;
+    __ Cmp(x3, PACKED_ELEMENTS);
+    __ Ccmp(x3, HOLEY_ELEMENTS, ZFlag, ne);
+    __ Assert(
+        eq,
+        AbortReason::kInvalidElementsKindForInternalArrayOrInternalPackedArray);
+  }
+
+  Label fast_elements_case;
+  __ CompareAndBranch(kind, PACKED_ELEMENTS, eq, &fast_elements_case);
+  GenerateInternalArrayConstructorCase(masm, HOLEY_ELEMENTS);
+
+  __ Bind(&fast_elements_case);
+  GenerateInternalArrayConstructorCase(masm, PACKED_ELEMENTS);
+}
+
 #undef __
 
 }  // namespace internal
diff --git a/deps/v8/src/builtins/array-foreach.tq b/deps/v8/src/builtins/array-foreach.tq
new file mode 100644
index 00000000000000..9919f9e3954ae3
--- /dev/null
+++ b/deps/v8/src/builtins/array-foreach.tq
@@ -0,0 +1,173 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+module array {
+  macro ArrayForEachTorqueContinuation(
+      context: Context, o: Object, len: Number, callbackfn: Callable,
+      thisArg: Object, initial_k: Smi): Object {
+    // 5. Let k be 0.
+    // 6. Repeat, while k < len
+    for (let k: Smi = initial_k; k < len; k = k + 1) {
+      // 6a. Let Pk be ! ToString(k).
+      let pK: String = ToString_Inline(context, k);
+
+      // 6b. Let kPresent be ? HasProperty(O, Pk).
+      let kPresent: Oddball = HasPropertyObject(o, pK, context, kHasProperty);
+
+      // 6c. If kPresent is true, then
+      if (kPresent == True) {
+        // 6c. i. Let kValue be ? Get(O, Pk).
+        let kValue: Object = GetProperty(context, o, pK);
+
+        // 6c. ii. Perform ? Call(callbackfn, T, <kValue, k, O>).
+        Call(context, callbackfn, thisArg, kValue, k, o);
+      }
+
+      // 6d. Increase k by 1. (done by the loop).
+    }
+    return Undefined;
+  }
+
+  javascript builtin ArrayForEachLoopEagerDeoptContinuation(
+      context: Context, receiver: Object, callback: Object, thisArg: Object,
+      initialK: Object, length: Object): Object {
+    return ArrayForEachLoopContinuation(
+        context, receiver, callback, thisArg, Undefined, receiver, initialK,
+        length, Undefined);
+  }
+
+  javascript builtin ArrayForEachLoopLazyDeoptContinuation(
+      context: Context, receiver: Object, callback: Object, thisArg: Object,
+      initialK: Object, length: Object, result: Object): Object {
+    return ArrayForEachLoopContinuation(
+        context, receiver, callback, thisArg, Undefined, receiver, initialK,
+        length, Undefined);
+  }
+
+  builtin ArrayForEachLoopContinuation(
+      context: Context, receiver: Object, callback: Object, thisArg: Object,
+      array: Object, object: Object, initialK: Object, length: Object,
+      to: Object): Object {
+    try {
+      let callbackfn: Callable = cast<Callable>(callback) otherwise Unexpected;
+      let k: Smi = cast<Smi>(initialK) otherwise Unexpected;
+      let number_length: Number = cast<Number>(length) otherwise Unexpected;
+
+      return ArrayForEachTorqueContinuation(
+          context, object, number_length, callbackfn, thisArg, k);
+    }
+    label Unexpected {
+      unreachable;
+    }
+  }
+
+  macro VisitAllElements<FixedArrayType : type>(
+      context: Context, a: JSArray, len: Smi, callbackfn: Callable,
+      thisArg: Object): void labels
+  Bailout(Smi) {
+    let k: Smi = 0;
+    let map: Map = a.map;
+
+    try {
+      // Build a fast loop over the smi array.
+      for (; k < len; k = k + 1) {
+        // Ensure that the map didn't change.
+        if (map != a.map) goto Slow;
+        // Ensure that we haven't walked beyond a possibly updated length.
+        if (k >= a.length) goto Slow;
+
+        try {
+          let value: Object =
+              LoadElementNoHole<FixedArrayType>(a, k) otherwise FoundHole;
+          Call(context, callbackfn, thisArg, value, k, a);
+        }
+        label FoundHole {
+          // If we found the hole, we need to bail out if the initial
+          // array prototype has had elements inserted. This is preferable
+          // to walking the prototype chain looking for elements.
+
+          if (IsNoElementsProtectorCellInvalid()) goto Bailout(k);
+        }
+      }
+    }
+    label Slow {
+      goto Bailout(k);
+    }
+  }
+
+  macro FastArrayForEach(
+      context: Context, o: Object, len: Number, callbackfn: Callable,
+      thisArg: Object): Object labels
+  Bailout(Smi) {
+    let k: Smi = 0;
+    try {
+      let smi_len: Smi = cast<Smi>(len) otherwise Slow;
+      let a: JSArray = cast<JSArray>(o) otherwise Slow;
+      let map: Map = a.map;
+
+      if (!IsPrototypeInitialArrayPrototype(context, map)) goto Slow;
+      let elementsKind: ElementsKind = map.elements_kind;
+      if (!IsFastElementsKind(elementsKind)) goto Slow;
+
+      if (IsElementsKindGreaterThan(elementsKind, HOLEY_ELEMENTS)) {
+        VisitAllElements<FixedDoubleArray>(
+            context, a, smi_len, callbackfn, thisArg)
+        otherwise Bailout;
+      } else {
+        VisitAllElements<FixedArray>(context, a, smi_len, callbackfn, thisArg)
+        otherwise Bailout;
+      }
+    }
+    label Slow {
+      goto Bailout(k);
+    }
+    return Undefined;
+  }
+
+  // https://tc39.github.io/ecma262/#sec-array.prototype.foreach
+  javascript builtin ArrayForEach(
+      context: Context, receiver: Object, ...arguments): Object {
+    try {
+      if (IsNullOrUndefined(receiver)) {
+        goto NullOrUndefinedError;
+      }
+
+      // 1. Let O be ? ToObject(this value).
+      let o: Object = ToObject(context, receiver);
+
+      // 2. Let len be ? ToLength(? Get(O, "length")).
+      let len: Number = GetLengthProperty(context, o);
+
+      // 3. If IsCallable(callbackfn) is false, throw a TypeError exception.
+      if (arguments.length == 0) {
+        goto TypeError;
+      }
+      let callbackfn: Callable =
+          cast<Callable>(arguments[0]) otherwise TypeError;
+
+      // 4. If thisArg is present, let T be thisArg; else let T be undefined.
+      let thisArg: Object = arguments.length > 1 ? arguments[1] : Undefined;
+
+      // Special cases.
+      let k: Smi = 0;
+      try {
+        return FastArrayForEach(context, o, len, callbackfn, thisArg)
+        otherwise Bailout;
+      }
+      label Bailout(k_value: Smi) {
+        k = k_value;
+      }
+
+      return ArrayForEachTorqueContinuation(
+          context, o, len, callbackfn, thisArg, k);
+    }
+    label TypeError {
+      ThrowTypeError(context, kCalledNonCallable, arguments[0]);
+    }
+    label NullOrUndefinedError {
+      ThrowTypeError(
+          context, kCalledOnNullOrUndefined, 'Array.prototype.forEach');
+    }
+  }
+}
diff --git a/deps/v8/src/builtins/array-sort.tq b/deps/v8/src/builtins/array-sort.tq
new file mode 100644
index 00000000000000..30bbf5ef746795
--- /dev/null
+++ b/deps/v8/src/builtins/array-sort.tq
@@ -0,0 +1,8 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+module array {
+  // TODO(szuend): TimSort implementation will go here. Keeping the file around
+  //               after removing the QuickSort Torque implementation.
+}
diff --git a/deps/v8/src/builtins/array.tq b/deps/v8/src/builtins/array.tq
new file mode 100644
index 00000000000000..edfe342ae3878c
--- /dev/null
+++ b/deps/v8/src/builtins/array.tq
@@ -0,0 +1,309 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+module array {
+  macro GetLengthProperty(context: Context, o: Object): Number {
+    if (BranchIfFastJSArray(o, context)) {
+      let a: JSArray = unsafe_cast<JSArray>(o);
+      return a.length_fast;
+    } else
+      deferred {
+        return ToLength_Inline(context, GetProperty(context, o, 'length'));
+      }
+  }
+
+  macro FastArraySplice(
+      context: Context, args: constexpr Arguments, o: Object,
+      originalLengthNumber: Number, actualStartNumber: Number, insertCount: Smi,
+      actualDeleteCountNumber: Number): Object
+  labels Bailout {
+    let originalLength: Smi = cast<Smi>(originalLengthNumber) otherwise Bailout;
+    let actualStart: Smi = cast<Smi>(actualStartNumber) otherwise Bailout;
+    let actualDeleteCount: Smi =
+        cast<Smi>(actualDeleteCountNumber) otherwise Bailout;
+    let lengthDelta: Smi = insertCount - actualDeleteCount;
+    let newLength: Smi = originalLength + lengthDelta;
+
+    let a: JSArray = cast<JSArray>(o) otherwise Bailout;
+
+    let map: Map = a.map;
+    if (!IsPrototypeInitialArrayPrototype(context, map)) goto Bailout;
+    if (IsNoElementsProtectorCellInvalid()) goto Bailout;
+    if (IsArraySpeciesProtectorCellInvalid()) goto Bailout;
+
+    // Fast path only works on fast elements kind and with writable length.
+    let elementsKind: ElementsKind = EnsureArrayPushable(map) otherwise Bailout;
+    if (!IsFastElementsKind(elementsKind)) goto Bailout;
+
+    // For now, only support non-double fast elements
+    if (!IsFastSmiOrTaggedElementsKind(elementsKind)) goto Bailout;
+
+    if (IsFastSmiElementsKind(elementsKind)) {
+      for (let e: Object of args [2: ]) {
+        if (TaggedIsNotSmi(e)) goto Bailout;
+      }
+    }
+
+    // Make sure that the length hasn't been changed by side-effect.
+    let length: Smi = cast<Smi>(a.length) otherwise Bailout;
+    if (originalLength != length) goto Bailout;
+
+    let deletedResult: JSArray =
+        ExtractFastJSArray(context, a, actualStart, actualDeleteCount);
+
+    if (newLength == 0) {
+      a.elements = kEmptyFixedArray;
+      a.length = 0;
+      return deletedResult;
+    }
+
+    let elements: FixedArray = cast<FixedArray>(a.elements) otherwise Bailout;
+    let elementsMap: Map = elements.map;
+
+    // If the source is a COW array or the spliced array is larger then the
+    // source array, then allocate a new FixedArray to hold the result.
+    let newElements: FixedArray = elements;
+    if ((elementsMap == kCOWMap) || (lengthDelta > 0)) {
+      newElements = ExtractFixedArray(
+          elements, 0, actualStart, newLength, kAllFixedArrays);
+      newElements.map = elementsMap;
+      a.elements = newElements;
+    }
+
+    // Double check that the array is still in fast elements mode
+    assert(IsFastSmiElementsKind(a.map.elements_kind));
+
+    // Copy over inserted elements.
+    let k: Smi = actualStart;
+    if (insertCount > 0) {
+      for (let e: Object of args [2: ]) {
+        newElements[k++] = e;
+      }
+    }
+
+    // Copy over elements after deleted elements.
+    let count: Smi = length - actualStart - actualDeleteCount;
+    while (count > 0) {
+      let e: Object = elements[k - lengthDelta];
+      newElements[k++] = e;
+      count--;
+    }
+
+    // Fill rest of spliced FixedArray with the hole, but only if the
+    // destination FixedArray is the original array's, since otherwise the array
+    // is pre-filled with holes.
+    if (elements == newElements) {
+      let limit: Smi = elements.length;
+      while (k < limit) {
+        newElements[k++] = Hole;
+      }
+    }
+
+    // Update the array's length after all the FixedArray shuffling is done.
+    a.length = newLength;
+
+    return deletedResult;
+  }
+
+  // https://tc39.github.io/ecma262/#sec-array.prototype.splice
+  javascript builtin ArraySpliceTorque(
+      context: Context, receiver: Object, ...arguments): Object {
+    // 1. Let O be ? ToObject(this value).
+    let o: Object = ToObject(context, receiver);
+
+    // 2. Let len be ? ToLength(? Get(O, "length")).
+    let len: Number = GetLengthProperty(context, o);
+
+    // 3. Let relativeStart be ? ToInteger(start).
+    let start: Object = arguments[0];
+    let relativeStart: Number = ToInteger_Inline(context, start);
+
+    // 4. If relativeStart < 0, let actualStart be max((len + relativeStart),
+    // 0);
+    //    else let actualStart be min(relativeStart, len).
+    let actualStart: Number = relativeStart < 0 ?
+        max((len + relativeStart), 0) :
+        min(relativeStart, len);
+
+    let insertCount: Smi;
+    let actualDeleteCount: Number;
+    // 5. If the Number of actual arguments is 0, then
+    if (arguments.length == 0) {
+      // a. Let insertCount be 0.
+      insertCount = 0;
+      // b. Let actualDeleteCount be 0.
+      actualDeleteCount = 0;
+      // 6. Else if the Number of actual arguments is 1, then
+    } else if (arguments.length == 1) {
+      // a. Let insertCount be 0.
+      insertCount = 0;
+      // b. Let actualDeleteCount be len - actualStart.
+      actualDeleteCount = len - actualStart;
+      // 7. Else,
+    } else {
+      // a. Let insertCount be the Number of actual arguments minus 2.
+      insertCount = convert<Smi>(arguments.length) - 2;
+      // b. Let dc be ? ToInteger(deleteCount).
+      let deleteCount: Object = arguments[1];
+      let dc: Number = ToInteger_Inline(context, deleteCount);
+      // c. Let actualDeleteCount be min(max(dc, 0), len - actualStart).
+      actualDeleteCount = min(max(dc, 0), len - actualStart);
+    }
+
+    // 8. If len + insertCount - actualDeleteCount > 2^53-1, throw a
+    //    Bailout exception.
+    if (len + insertCount - actualDeleteCount > kMaxSafeInteger) {
+      ThrowRangeError(context, kInvalidArrayLength);
+    }
+
+    try {
+      return FastArraySplice(
+          context, arguments, o, len, actualStart, insertCount,
+          actualDeleteCount) otherwise Bailout;
+    }
+    label Bailout {}
+    // If the fast case fails, just continue with the slow, correct,
+    // spec-compliant case.
+
+    // 9. Let A be ? ArraySpeciesCreate(O, actualDeleteCount).
+    let a: Object = ArraySpeciesCreate(context, o, actualDeleteCount);
+
+    // 10. Let k be 0.
+    let k: Number = 0;
+
+    // 11. Repeat, while k < actualDeleteCount
+    while (k < actualDeleteCount) {
+      // a. Let from be ! ToString(actualStart + k).
+      let from: String = ToString_Inline(context, actualStart + k);
+
+      // b. Let fromPresent be ? HasProperty(O, from).
+      let fromPresent: Oddball =
+          HasPropertyObject(o, from, context, kHasProperty);
+
+      // c. If fromPresent is true, then
+      if (fromPresent == True) {
+        // i. Let fromValue be ? Get(O, from).
+        let fromValue: Object = GetProperty(context, o, from);
+
+        // ii. Perform ? CreateDataPropertyOrThrow(A, ! ToString(k), fromValue).
+        CreateDataProperty(context, a, ToString_Inline(context, k), fromValue);
+      }
+
+      // d. Increment k by 1.
+      k = k + 1;
+    }
+
+    // 12. Perform ? Set(A, "length", actualDeleteCount, true).
+    SetProperty(context, a, 'length', actualDeleteCount, kStrict);
+
+    // 13. Let items be a List whose elements are, in left-to-right order,
+    //     the portion of the actual argument list starting with the third
+    //     argument. The list is empty if fewer than three arguments were
+    //     passed.
+    // 14. Let itemCount be the Number of elements in items.
+    let itemCount: Number = insertCount;
+
+    // 15. If itemCount < actualDeleteCount, then
+    if (itemCount < actualDeleteCount) {
+      // a. Let k be actualStart.
+      let k: Number = actualStart;
+
+      // b. Repeat, while k < (len - actualDeleteCount)
+      while (k < (len - actualDeleteCount)) {
+        // i. Let from be ! ToString(k + actualDeleteCount).
+        let from: String = ToString_Inline(context, k + actualDeleteCount);
+        // ii. Let to be ! ToString(k + itemCount).
+        let to: String = ToString_Inline(context, k + itemCount);
+
+        // iii. Let fromPresent be ? HasProperty(O, from).
+        let fromPresent: Oddball =
+            HasPropertyObject(o, from, context, kHasProperty);
+
+        // iv. If fromPresent is true, then
+        if (fromPresent == True) {
+          // 1. Let fromValue be ? Get(O, from).
+          let fromValue: Object = GetProperty(context, o, from);
+
+          // 2. Perform ? Set(O, to, fromValue, true).
+          SetProperty(context, o, to, fromValue, kStrict);
+
+          // v. Else fromPresent is false,
+        } else {
+          // 1. Perform ? DeletePropertyOrThrow(O, to).
+          DeleteProperty(context, o, to, kStrict);
+        }
+        // vi. Increase k by 1.
+        k = k + 1;
+      }
+
+      // c. Let k be len.
+      k = len;
+      // d. Repeat, while k > (len - actualDeleteCount + itemCount)
+      while (k > (len - actualDeleteCount + itemCount)) {
+        // i. Perform ? DeletePropertyOrThrow(O, ! ToString(k - 1)).
+        DeleteProperty(context, o, ToString_Inline(context, k - 1), kStrict);
+
+        // ii. Decrease k by 1.
+        k = k - 1;
+      }
+      // 16. Else if itemCount > actualDeleteCount, then
+    } else if (itemCount > actualDeleteCount) {
+      // a. Let k be (len - actualDeleteCount).
+      let k: Number = len - actualDeleteCount;
+
+      // b. Repeat, while k > actualStart
+      while (k > actualStart) {
+        // i. Let from be ! ToString(k + actualDeleteCount - 1).
+        let from: String = ToString_Inline(context, k + actualDeleteCount - 1);
+
+        // ii. Let to be ! ToString(k + itemCount - 1).
+        let to: String = ToString_Inline(context, k + itemCount - 1);
+
+        // iii. Let fromPresent be ? HasProperty(O, from).
+        let fromPresent: Oddball =
+            HasPropertyObject(o, from, context, kHasProperty);
+
+        // iv. If fromPresent is true, then
+        if (fromPresent == True) {
+          // 1. Let fromValue be ? Get(O, from).
+          let fromValue: Object = GetProperty(context, o, from);
+
+          // 2. Perform ? Set(O, to, fromValue, true).
+          SetProperty(context, o, to, fromValue, kStrict);
+
+          // v. Else fromPresent is false,
+        } else {
+          // 1. Perform ? DeletePropertyOrThrow(O, to).
+          DeleteProperty(context, o, to, kStrict);
+        }
+
+        // vi. Decrease k by 1.
+        k = k - 1;
+      }
+    }
+
+    // 17. Let k be actualStart.
+    k = actualStart;
+
+    // 18. Repeat, while items is not empty
+    //   a. Remove the first element from items and let E be the value of that
+    //   element.
+    if (arguments.length > 2) {
+      for (let e: Object of arguments [2: ]) {
+        // b. Perform ? Set(O, ! ToString(k), E, true).
+        SetProperty(context, o, ToString_Inline(context, k), e, kStrict);
+
+        // c. Increase k by 1.
+        k = k + 1;
+      }
+    }
+
+    // 19. Perform ? Set(O, "length", len - actualDeleteCount + itemCount,
+    // true).
+    SetProperty(
+        context, o, 'length', len - actualDeleteCount + itemCount, kStrict);
+
+    return a;
+  }
+}
diff --git a/deps/v8/src/builtins/base.tq b/deps/v8/src/builtins/base.tq
new file mode 100644
index 00000000000000..6ab1f644c1b960
--- /dev/null
+++ b/deps/v8/src/builtins/base.tq
@@ -0,0 +1,701 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+type Arguments constexpr 'CodeStubArguments*';
+type void generates 'void';
+type never generates 'void';
+
+type Tagged generates 'TNode<Object>';
+type Smi extends Tagged generates 'TNode<Smi>';
+type HeapObject extends Tagged generates 'TNode<HeapObject>';
+type Object = Smi|HeapObject;
+type int32 generates 'TNode<Int32T>' constexpr 'int32_t';
+type uint32 generates 'TNode<Uint32T>' constexpr 'uint32_t';
+type int64 generates 'TNode<Int64T>' constexpr 'int64_t';
+type intptr generates 'TNode<IntPtrT>' constexpr 'intptr_t';
+type uintptr generates 'TNode<UintPtrT>' constexpr 'uintptr_t';
+type float32 generates 'TNode<Float32T>' constexpr 'float';
+type float64 generates 'TNode<Float64T>' constexpr 'double';
+type bool generates 'TNode<BoolT>' constexpr 'bool';
+type string constexpr 'const char*';
+
+type int31 extends int32 generates 'TNode<Int32T>' constexpr 'int31_t';
+type RawPtr generates 'TNode<RawPtrT>' constexpr 'void*';
+type AbstractCode extends HeapObject generates 'TNode<AbstractCode>';
+type Code extends AbstractCode generates 'TNode<Code>';
+type JSReceiver extends HeapObject generates 'TNode<JSReceiver>';
+type Context extends HeapObject generates 'TNode<Context>';
+type String extends HeapObject generates 'TNode<String>';
+type Oddball extends HeapObject generates 'TNode<Oddball>';
+type HeapNumber extends HeapObject generates 'TNode<HeapNumber>';
+type Number = Smi|HeapNumber;
+type BigInt extends HeapObject generates 'TNode<BigInt>';
+type Numeric = Number|BigInt;
+type Boolean extends Oddball generates 'TNode<Oddball>';
+type JSProxy extends JSReceiver generates 'TNode<JSProxy>';
+type JSObject extends JSReceiver generates 'TNode<JSObject>';
+type JSArray extends JSObject generates 'TNode<JSArray>';
+type JSFunction extends JSObject generates 'TNode<JSFunction>';
+type JSBoundFunction extends JSObject generates 'TNode<JSBoundFunction>';
+type Callable = JSFunction|JSBoundFunction|JSProxy;
+type Map extends HeapObject generates 'TNode<Map>';
+type FixedArrayBase extends HeapObject generates 'TNode<FixedArrayBase>';
+type FixedArray extends FixedArrayBase generates 'TNode<FixedArray>';
+type FixedDoubleArray extends FixedArrayBase generates
+'TNode<FixedDoubleArray>';
+type FixedTypedArrayBase extends FixedArrayBase generates
+'TNode<FixedTypedArrayBase>';
+type FixedTypedArray extends FixedTypedArrayBase generates
+'TNode<FixedTypedArray>';
+type NumberDictionary extends HeapObject generates 'TNode<NumberDictionary>';
+
+type JSArrayBuffer extends JSObject generates 'TNode<JSArrayBuffer>';
+type JSArrayBufferView extends JSObject generates 'TNode<JSArrayBufferView>';
+type JSTypedArray extends JSArrayBufferView generates 'TNode<JSTypedArray>';
+type JSDataView extends JSArrayBufferView generates 'TNode<JSDataView>';
+
+type InstanceType generates 'TNode<Int32T>' constexpr 'InstanceType';
+type ElementsKind generates 'TNode<Int32T>' constexpr 'ElementsKind';
+type LanguageMode generates 'TNode<Smi>' constexpr 'LanguageMode';
+type ExtractFixedArrayFlags generates
+'TNode<Smi>' constexpr 'ExtractFixedArrayFlags';
+type ParameterMode generates 'TNode<Int32T>' constexpr 'ParameterMode';
+type RootListIndex generates 'TNode<Int32T>' constexpr 'Heap::RootListIndex';
+
+type MessageTemplate constexpr 'MessageTemplate';
+type HasPropertyLookupMode constexpr 'HasPropertyLookupMode';
+
+const NO_ELEMENTS: constexpr ElementsKind generates 'NO_ELEMENTS';
+
+const PACKED_SMI_ELEMENTS: constexpr ElementsKind generates
+    'PACKED_SMI_ELEMENTS';
+const HOLEY_SMI_ELEMENTS: constexpr ElementsKind generates 'HOLEY_SMI_ELEMENTS';
+const PACKED_ELEMENTS: constexpr ElementsKind generates 'PACKED_ELEMENTS';
+const HOLEY_ELEMENTS: constexpr ElementsKind generates 'HOLEY_ELEMENTS';
+const PACKED_DOUBLE_ELEMENTS: constexpr ElementsKind generates
+    'PACKED_DOUBLE_ELEMENTS';
+const HOLEY_DOUBLE_ELEMENTS: constexpr ElementsKind generates
+    'HOLEY_DOUBLE_ELEMENTS';
+const DICTIONARY_ELEMENTS: constexpr ElementsKind generates
+    'DICTIONARY_ELEMENTS';
+
+const UINT8_ELEMENTS: constexpr ElementsKind generates 'UINT8_ELEMENTS';
+const INT8_ELEMENTS: constexpr ElementsKind generates 'INT8_ELEMENTS';
+const UINT16_ELEMENTS: constexpr ElementsKind generates 'UINT16_ELEMENTS';
+const INT16_ELEMENTS: constexpr ElementsKind generates 'INT16_ELEMENTS';
+const UINT32_ELEMENTS: constexpr ElementsKind generates 'UINT32_ELEMENTS';
+const INT32_ELEMENTS: constexpr ElementsKind generates 'INT32_ELEMENTS';
+const FLOAT32_ELEMENTS: constexpr ElementsKind generates 'FLOAT32_ELEMENTS';
+const FLOAT64_ELEMENTS: constexpr ElementsKind generates 'FLOAT64_ELEMENTS';
+const UINT8_CLAMPED_ELEMENTS: constexpr ElementsKind generates
+    'UINT8_CLAMPED_ELEMENTS';
+const BIGUINT64_ELEMENTS: constexpr ElementsKind generates 'BIGUINT64_ELEMENTS';
+const BIGINT64_ELEMENTS: constexpr ElementsKind generates 'BIGINT64_ELEMENTS';
+
+type FixedUint8Array extends FixedTypedArray;
+type FixedInt8Array extends FixedTypedArray;
+type FixedUint16Array extends FixedTypedArray;
+type FixedInt16Array extends FixedTypedArray;
+type FixedUint32Array extends FixedTypedArray;
+type FixedInt32Array extends FixedTypedArray;
+type FixedFloat32Array extends FixedTypedArray;
+type FixedFloat64Array extends FixedTypedArray;
+type FixedUint8ClampedArray extends FixedTypedArray;
+type FixedBigUint64Array extends FixedTypedArray;
+type FixedBigInt64Array extends FixedTypedArray;
+
+const kAllFixedArrays: constexpr ExtractFixedArrayFlags generates
+'ExtractFixedArrayFlag::kAllFixedArrays';
+
+const kCOWMap: Map generates 'LoadRoot(Heap::kFixedCOWArrayMapRootIndex)';
+const kEmptyFixedArray: FixedArrayBase generates
+'UncheckedCast<FixedArrayBase>(LoadRoot(Heap::kEmptyFixedArrayRootIndex))';
+
+const kInvalidArrayLength: constexpr MessageTemplate generates
+'MessageTemplate::kInvalidArrayLength';
+const kCalledNonCallable: constexpr MessageTemplate generates
+'MessageTemplate::kCalledNonCallable';
+const kCalledOnNullOrUndefined: constexpr MessageTemplate generates
+'MessageTemplate::kCalledOnNullOrUndefined';
+
+const kHasProperty: constexpr HasPropertyLookupMode generates 'kHasProperty';
+
+const kMaxSafeInteger: constexpr float64 generates 'kMaxSafeInteger';
+
+const kNotTypedArray: constexpr MessageTemplate generates
+'MessageTemplate::kNotTypedArray';
+const kDetachedOperation: constexpr MessageTemplate generates
+'MessageTemplate::kDetachedOperation';
+const kBadSortComparisonFunction: constexpr MessageTemplate generates
+'MessageTemplate::kBadSortComparisonFunction';
+const kIncompatibleMethodReceiver: constexpr MessageTemplate generates
+'MessageTemplate::kIncompatibleMethodReceiver';
+const kInvalidDataViewAccessorOffset: constexpr MessageTemplate generates
+'MessageTemplate::kInvalidDataViewAccessorOffset';
+const kStrictReadOnlyProperty: constexpr MessageTemplate generates
+'MessageTemplate::kStrictReadOnlyProperty';
+
+const Hole: Oddball generates 'TheHoleConstant()';
+const Null: Oddball generates 'NullConstant()';
+const Undefined: Oddball generates 'UndefinedConstant()';
+const True: Boolean generates 'TrueConstant()';
+const False: Boolean generates 'FalseConstant()';
+const true: constexpr bool generates 'true';
+const false: constexpr bool generates 'false';
+
+const kStrict: constexpr LanguageMode generates 'LanguageMode::kStrict';
+const kSloppy: constexpr LanguageMode generates 'LanguageMode::kSloppy';
+
+const SMI_PARAMETERS: constexpr ParameterMode generates 'SMI_PARAMETERS';
+const INTPTR_PARAMETERS: constexpr ParameterMode generates 'INTPTR_PARAMETERS';
+
+extern macro Is64(): constexpr bool;
+
+extern macro Print(constexpr string);
+extern macro Print(constexpr string, Object);
+extern macro Print(Object);
+extern macro DebugBreak();
+extern macro ToInteger_Inline(Context, Object): Number;
+extern macro ToLength_Inline(Context, Object): Number;
+extern macro ToNumber_Inline(Context, Object): Number;
+extern macro ToString_Inline(Context, Object): String;
+extern macro GetProperty(Context, Object, Object): Object;
+extern macro HasProperty(
+    HeapObject, Object, Context, constexpr HasPropertyLookupMode): Oddball;
+extern macro ThrowRangeError(Context, constexpr MessageTemplate): never;
+extern macro ThrowTypeError(Context, constexpr MessageTemplate): never;
+extern macro ThrowTypeError(Context, constexpr MessageTemplate, Object): never;
+extern macro ThrowTypeError(Context, constexpr MessageTemplate, Object, Object,
+    Object): never;
+extern macro ArraySpeciesCreate(Context, Object, Number): Object;
+extern macro EnsureArrayPushable(Map): ElementsKind labels Bailout;
+
+extern builtin ToObject(Context, Object): JSReceiver;
+extern macro IsNullOrUndefined(Object): bool;
+extern macro IsTheHole(Object): bool;
+extern macro IsString(HeapObject): bool;
+extern builtin ToString(Context, Object): String;
+
+extern runtime CreateDataProperty(Context, Object, Object, Object);
+extern runtime SetProperty(Context, Object, Object, Object, LanguageMode);
+extern runtime DeleteProperty(Context, Object, Object, LanguageMode);
+
+extern macro LoadRoot(constexpr RootListIndex): Object;
+extern macro StoreRoot(constexpr RootListIndex, Object): Object;
+extern macro LoadAndUntagToWord32Root(constexpr RootListIndex): int32;
+
+extern runtime StringEqual(Context, String, String): Oddball;
+extern builtin StringLessThan(Context, String, String): Boolean;
+
+extern macro StrictEqual(Object, Object): Boolean;
+extern runtime SmiLexicographicCompare(Context, Object, Object): Number;
+
+extern operator '<' macro Int32LessThan(int32, int32): bool;
+extern operator '>' macro Int32GreaterThan(int32, int32): bool;
+extern operator '<=' macro Int32LessThanOrEqual(int32, int32): bool;
+extern operator '>=' macro Int32GreaterThanOrEqual(int32, int32): bool;
+
+extern operator '==' macro SmiEqual(Smi, Smi): bool;
+extern operator '!=' macro SmiNotEqual(Smi, Smi): bool;
+extern operator '<' macro SmiLessThan(Smi, Smi): bool;
+extern operator '<=' macro SmiLessThanOrEqual(Smi, Smi): bool;
+extern operator '>' macro SmiGreaterThan(Smi, Smi): bool;
+extern operator '>=' macro SmiGreaterThanOrEqual(Smi, Smi): bool;
+
+extern operator '==' macro ElementsKindEqual(
+    constexpr ElementsKind, constexpr ElementsKind): constexpr bool;
+extern operator '==' macro ElementsKindEqual(ElementsKind, ElementsKind): bool;
+extern macro IsFastElementsKind(constexpr ElementsKind): constexpr bool;
+extern macro IsDoubleElementsKind(constexpr ElementsKind): constexpr bool;
+
+extern macro SmiAbove(Smi, Smi): bool;
+
+extern operator '==' macro WordEqual(intptr, intptr): bool;
+extern operator '==' macro WordEqual(uintptr, uintptr): bool;
+extern operator '!=' macro WordNotEqual(intptr, intptr): bool;
+extern operator '!=' macro WordNotEqual(uintptr, uintptr): bool;
+extern operator '<' macro IntPtrLessThan(intptr, intptr): bool;
+extern operator '>' macro IntPtrGreaterThan(intptr, intptr): bool;
+extern operator '<=' macro IntPtrLessThanOrEqual(intptr, intptr): bool;
+extern operator '>=' macro IntPtrGreaterThanOrEqual(intptr, intptr): bool;
+extern operator '>=' macro UintPtrGreaterThanOrEqual(uintptr, uintptr): bool;
+
+extern operator '==' macro Float64Equal(float64, float64): bool;
+extern operator '!=' macro Float64NotEqual(float64, float64): bool;
+
+extern operator
+'<' macro BranchIfNumberLessThan(Number, Number): never labels Taken, NotTaken;
+extern operator
+'<=' macro BranchIfNumberLessThanOrEqual(Number, Number): never labels Taken,
+    NotTaken;
+extern operator
+'>' macro BranchIfNumberGreaterThan(Number, Number): never labels Taken,
+    NotTaken;
+extern operator '>=' macro BranchIfNumberGreaterThanOrEqual(Number, Number):
+    never labels Taken,
+    NotTaken;
+
+extern operator '==' macro WordEqual(Object, Object): bool;
+extern operator '!=' macro WordNotEqual(Object, Object): bool;
+
+extern operator '+' macro SmiAdd(Smi, Smi): Smi;
+extern operator '-' macro SmiSub(Smi, Smi): Smi;
+extern operator '&' macro SmiAnd(Smi, Smi): Smi;
+extern operator '>>>' macro SmiShr(Smi, constexpr int31): Smi;
+
+extern operator '+' macro IntPtrAdd(intptr, intptr): intptr;
+extern operator '-' macro IntPtrSub(intptr, intptr): intptr;
+extern operator '>>>' macro WordShr(uintptr, uintptr): uintptr;
+extern operator '<<' macro WordShl(intptr, intptr): intptr;
+extern operator '&' macro WordAnd(intptr, intptr): intptr;
+extern operator '&' macro WordAnd(uintptr, uintptr): uintptr;
+
+extern operator '+' macro Int32Add(int32, int32): int32;
+extern operator '-' macro Int32Sub(int32, int32): int32;
+extern operator '*' macro Int32Mul(int32, int32): int32;
+extern operator '%' macro Int32Mod(int32, int32): int32;
+extern operator '&' macro Word32And(int32, int32): int32;
+extern operator '&' macro Word32And(uint32, uint32): uint32;
+extern operator '==' macro
+ConstexprInt31Equal(constexpr int31, constexpr int31): constexpr bool;
+
+extern operator '==' macro Word32Equal(int32, int32): bool;
+extern operator '==' macro Word32Equal(uint32, uint32): bool;
+extern operator '!=' macro Word32NotEqual(int32, int32): bool;
+extern operator '!=' macro Word32NotEqual(uint32, uint32): bool;
+extern operator '>>>' macro Word32Shr(uint32, uint32): uint32;
+extern operator '<<' macro Word32Shl(int32, int32): int32;
+extern operator '<<' macro Word32Shl(uint32, uint32): uint32;
+extern operator '|' macro Word32Or(int32, int32): int32;
+extern operator '|' macro Word32Or(uint32, uint32): uint32;
+
+extern operator '+' macro NumberAdd(Number, Number): Number;
+extern operator '-' macro NumberSub(Number, Number): Number;
+extern operator 'min' macro NumberMin(Number, Number): Number;
+extern operator 'max' macro NumberMax(Number, Number): Number;
+
+extern operator '!' macro ConstexprBoolNot(constexpr bool): constexpr bool;
+extern operator '!' macro Word32BinaryNot(bool): bool;
+
+extern operator '.map' macro LoadMap(HeapObject): Map;
+extern operator '.map=' macro StoreMap(HeapObject, Map);
+extern operator
+'.instanceType' macro LoadInstanceType(HeapObject): InstanceType;
+
+extern operator '.length' macro LoadStringLengthAsWord(String): intptr;
+
+extern operator '.length' macro GetArgumentsLength(constexpr Arguments): intptr;
+extern operator
+'[]' macro GetArgumentValue(constexpr Arguments, intptr): Object;
+
+extern operator 'is<Smi>' macro TaggedIsSmi(Object): bool;
+extern operator 'isnt<Smi>' macro TaggedIsNotSmi(Object): bool;
+extern macro TaggedIsPositiveSmi(Object): bool;
+
+extern macro TaggedToJSDataView(Object): JSDataView labels CastError;
+extern macro TaggedToHeapObject(Object): HeapObject labels CastError;
+extern macro TaggedToSmi(Object): Smi labels CastError;
+extern macro TaggedToJSArray(Object): JSArray labels CastError;
+extern macro TaggedToCallable(Object): Callable labels CastError;
+extern macro ConvertFixedArrayBaseToFixedArray(FixedArrayBase):
+    FixedArray labels CastError;
+extern macro ConvertFixedArrayBaseToFixedDoubleArray(FixedArrayBase):
+    FixedDoubleArray labels CastError;
+extern macro TaggedToNumber(Object): Number labels CastError;
+
+macro cast<A : type>(o: Object): A labels CastError;
+cast<Number>(o: Object): Number labels CastError {
+  return TaggedToNumber(o) otherwise CastError;
+}
+cast<HeapObject>(o: Object): HeapObject labels CastError {
+  return TaggedToHeapObject(o) otherwise CastError;
+}
+cast<Smi>(o: Object): Smi labels CastError {
+  return TaggedToSmi(o) otherwise CastError;
+}
+cast<JSDataView>(o: Object): JSDataView labels CastError {
+  return TaggedToJSDataView(o) otherwise CastError;
+}
+cast<Callable>(o: Object): Callable labels CastError {
+  return TaggedToCallable(o) otherwise CastError;
+}
+cast<JSArray>(o: Object): JSArray labels CastError {
+  return TaggedToJSArray(o) otherwise CastError;
+}
+macro cast<A : type>(o: FixedArrayBase): A labels CastError;
+cast<FixedArray>(o: FixedArrayBase): FixedArray labels CastError {
+  return ConvertFixedArrayBaseToFixedArray(o) otherwise CastError;
+}
+cast<FixedDoubleArray>(o: FixedArrayBase): FixedDoubleArray labels CastError {
+  return ConvertFixedArrayBaseToFixedDoubleArray(o) otherwise CastError;
+}
+
+extern macro AllocateHeapNumberWithValue(float64): HeapNumber;
+extern macro ChangeInt32ToTagged(int32): Number;
+extern macro ChangeUint32ToTagged(uint32): Number;
+extern macro Unsigned(int32): uint32;
+extern macro Unsigned(intptr): uintptr;
+extern macro Unsigned(RawPtr): uintptr;
+extern macro Signed(uint32): int32;
+extern macro Signed(uintptr): intptr;
+extern macro Signed(RawPtr): intptr;
+extern macro TruncateIntPtrToInt32(intptr): int32;
+extern macro SmiTag(intptr): Smi;
+extern macro SmiFromInt32(int32): Smi;
+extern macro SmiUntag(Smi): intptr;
+extern macro SmiToInt32(Smi): int32;
+extern macro LoadHeapNumberValue(HeapNumber): float64;
+extern macro ChangeFloat32ToFloat64(float32): float64;
+extern macro ChangeNumberToFloat64(Number): float64;
+extern macro ChangeInt32ToIntPtr(int32): intptr;  // Sign-extends.
+extern macro ChangeUint32ToWord(uint32): uintptr;  // Doesn't sign-extend.
+
+extern macro NumberConstant(constexpr float64): Number;
+extern macro NumberConstant(constexpr int32): Number;
+extern macro IntPtrConstant(constexpr int31): intptr;
+extern macro IntPtrConstant(constexpr int32): intptr;
+extern macro Int32Constant(constexpr int31): int31;
+extern macro Int32Constant(constexpr int32): int32;
+extern macro Float64Constant(constexpr int31): float64;
+extern macro SmiConstant(constexpr int31): Smi;
+extern macro BoolConstant(constexpr bool): bool;
+extern macro StringConstant(constexpr string): String;
+extern macro LanguageModeConstant(constexpr LanguageMode): LanguageMode;
+extern macro Int32Constant(constexpr ElementsKind): ElementsKind;
+
+macro from_constexpr<A : type>(o: constexpr int31): A;
+from_constexpr<intptr>(i: constexpr int31): intptr {
+  return IntPtrConstant(i);
+}
+from_constexpr<int31>(i: constexpr int31): int31 {
+  return Int32Constant(i);
+}
+from_constexpr<int32>(i: constexpr int31): int32 {
+  return Int32Constant(i);
+}
+from_constexpr<uint32>(i: constexpr int31): uint32 {
+  return Unsigned(Int32Constant(i));
+}
+from_constexpr<uintptr>(i: constexpr int31): uintptr {
+  return ChangeUint32ToWord(i);
+}
+from_constexpr<Smi>(i: constexpr int31): Smi {
+  return SmiConstant(i);
+}
+from_constexpr<Number>(i: constexpr int31): Number {
+  return SmiConstant(i);
+}
+from_constexpr<float64>(i: constexpr int31): float64 {
+  return Float64Constant(i);
+}
+macro from_constexpr<A : type>(o: constexpr int32): A;
+from_constexpr<intptr>(i: constexpr int32): intptr {
+  return IntPtrConstant(i);
+}
+from_constexpr<int32>(i: constexpr int32): int32 {
+  return Int32Constant(i);
+}
+from_constexpr<Number>(i: constexpr int32): Number {
+  return NumberConstant(i);
+}
+macro from_constexpr<A : type>(o: constexpr float64): A;
+from_constexpr<Number>(f: constexpr float64): Number {
+  return NumberConstant(f);
+}
+macro from_constexpr<A : type>(b: constexpr bool): A;
+from_constexpr<bool>(b: constexpr bool): bool {
+  return BoolConstant(b);
+}
+macro from_constexpr<A : type>(l: constexpr LanguageMode): A;
+from_constexpr<LanguageMode>(b: constexpr LanguageMode): LanguageMode {
+  return LanguageModeConstant(b);
+}
+macro from_constexpr<A : type>(e: constexpr ElementsKind): A;
+from_constexpr<ElementsKind>(e: constexpr ElementsKind): ElementsKind {
+  return Int32Constant(e);
+}
+macro from_constexpr<A : type>(s: constexpr string): A;
+from_constexpr<String>(s: constexpr string): String {
+  return StringConstant(s);
+}
+from_constexpr<Object>(s: constexpr string): Object {
+  return StringConstant(s);
+}
+
+macro convert<A : type>(i: constexpr int31): A {
+  return i;
+}
+macro convert<A : type>(i: int32): A;
+convert<Number>(i: int32): Number {
+  return ChangeInt32ToTagged(i);
+}
+convert<intptr>(i: int32): intptr {
+  return ChangeInt32ToIntPtr(i);
+}
+convert<Smi>(i: int32): Smi {
+  return SmiFromInt32(i);
+}
+macro convert<A : type>(ui: uint32): A;
+convert<Number>(ui: uint32): Number {
+  return ChangeUint32ToTagged(ui);
+}
+convert<Smi>(ui: uint32): Smi {
+  return SmiFromInt32(Signed(ui));
+}
+convert<uintptr>(ui: uint32): uintptr {
+  return ChangeUint32ToWord(ui);
+}
+macro convert<A : type>(i: intptr): A;
+convert<int32>(i: intptr): int32 {
+  return TruncateIntPtrToInt32(i);
+}
+convert<Smi>(i: intptr): Smi {
+  return SmiTag(i);
+}
+macro convert<A : type>(ui: uintptr): A;
+convert<uint32>(ui: uintptr): uint32 {
+  return Unsigned(TruncateIntPtrToInt32(Signed(ui)));
+}
+macro convert<A : type>(s: Smi): A;
+convert<intptr>(s: Smi): intptr {
+  return SmiUntag(s);
+}
+convert<int32>(s: Smi): int32 {
+  return SmiToInt32(s);
+}
+macro convert<A : type>(h: HeapNumber): A;
+convert<float64>(h: HeapNumber): float64 {
+  return LoadHeapNumberValue(h);
+}
+macro convert<A : type>(n: Number): A;
+convert<float64>(n: Number): float64 {
+  return ChangeNumberToFloat64(n);
+}
+macro convert<A : type>(f: float32): A;
+convert<float64>(f: float32): float64 {
+  return ChangeFloat32ToFloat64(f);
+}
+macro convert<A : type>(d: float64): A;
+convert<Number>(d: float64): Number {
+  return AllocateHeapNumberWithValue(d);
+}
+macro convert<A : type>(r: RawPtr): A;
+convert<uintptr>(r: RawPtr): uintptr {
+  return Unsigned(r);
+}
+convert<intptr>(r: RawPtr): intptr {
+  return Signed(r);
+}
+
+extern macro UnsafeCastNumberToHeapNumber(Number): HeapNumber;
+extern macro UnsafeCastObjectToFixedArray(Object): FixedArray;
+extern macro UnsafeCastObjectToFixedDoubleArray(Object): FixedDoubleArray;
+extern macro UnsafeCastObjectToHeapNumber(Object): HeapNumber;
+extern macro UnsafeCastObjectToCallable(Object): Callable;
+extern macro UnsafeCastObjectToSmi(Object): Smi;
+extern macro UnsafeCastObjectToNumber(Object): Number;
+extern macro UnsafeCastObjectToHeapObject(Object): HeapObject;
+extern macro UnsafeCastObjectToJSArray(Object): JSArray;
+extern macro UnsafeCastObjectToFixedTypedArrayBase(Object): FixedTypedArrayBase;
+extern macro UnsafeCastObjectToNumberDictionary(Object): NumberDictionary;
+extern macro UnsafeCastObjectToJSReceiver(Object): JSReceiver;
+extern macro UnsafeCastObjectToJSObject(Object): JSObject;
+
+macro unsafe_cast<A : type>(n: Number): A;
+unsafe_cast<HeapNumber>(n: Number): HeapNumber {
+  return UnsafeCastNumberToHeapNumber(n);
+}
+macro unsafe_cast<A : type>(o: Object): A;
+unsafe_cast<FixedArray>(o: Object): FixedArray {
+  return UnsafeCastObjectToFixedArray(o);
+}
+unsafe_cast<FixedDoubleArray>(o: Object): FixedDoubleArray {
+  return UnsafeCastObjectToFixedDoubleArray(o);
+}
+unsafe_cast<HeapNumber>(o: Object): HeapNumber {
+  return UnsafeCastObjectToHeapNumber(o);
+}
+unsafe_cast<Callable>(o: Object): Callable {
+  return UnsafeCastObjectToCallable(o);
+}
+unsafe_cast<Smi>(o: Object): Smi {
+  return UnsafeCastObjectToSmi(o);
+}
+unsafe_cast<Number>(o: Object): Number {
+  return UnsafeCastObjectToNumber(o);
+}
+unsafe_cast<HeapObject>(o: Object): HeapObject {
+  return UnsafeCastObjectToHeapObject(o);
+}
+unsafe_cast<JSArray>(o: Object): JSArray {
+  return UnsafeCastObjectToJSArray(o);
+}
+unsafe_cast<FixedTypedArrayBase>(o: Object): FixedTypedArrayBase {
+  return UnsafeCastObjectToFixedTypedArrayBase(o);
+}
+unsafe_cast<NumberDictionary>(o: Object): NumberDictionary {
+  return UnsafeCastObjectToNumberDictionary(o);
+}
+unsafe_cast<JSReceiver>(o: Object): JSReceiver {
+  return UnsafeCastObjectToJSReceiver(o);
+}
+unsafe_cast<JSObject>(o: Object): JSObject {
+  return UnsafeCastObjectToJSObject(o);
+}
+
+extern macro BranchIfFastJSArray(Object, Context): never labels Taken, NotTaken;
+extern macro BranchIfNotFastJSArray(Object, Context): never labels Taken,
+    NotTaken;
+
+extern macro IsPrototypeInitialArrayPrototype(Context, Map): bool;
+extern macro IsNoElementsProtectorCellInvalid(): bool;
+extern macro IsArraySpeciesProtectorCellInvalid(): bool;
+extern macro IsTypedArraySpeciesProtectorCellInvalid(): bool;
+extern macro IsPromiseSpeciesProtectorCellInvalid(): bool;
+
+extern operator
+'.buffer' macro LoadTypedArrayBuffer(JSTypedArray): JSArrayBuffer;
+
+extern operator '.data_ptr' macro LoadDataPtr(JSTypedArray): RawPtr;
+
+extern operator '.elements_kind' macro LoadMapElementsKind(Map): ElementsKind;
+extern operator
+'.elements_kind' macro LoadElementsKind(JSTypedArray): ElementsKind;
+
+extern operator '.elements' macro LoadElements(JSObject): FixedArrayBase;
+extern operator '.elements=' macro StoreElements(JSObject, FixedArrayBase);
+
+extern operator '.length' macro LoadTypedArrayLength(JSTypedArray): Smi;
+extern operator '.length' macro LoadJSArrayLength(JSArray): Number;
+extern operator '.length_fast' macro LoadFastJSArrayLength(JSArray): Smi;
+extern operator '.length=' macro StoreJSArrayLength(JSArray, Smi);
+
+extern operator '.length' macro LoadFixedArrayBaseLength(FixedArrayBase): Smi;
+extern operator '[]' macro LoadFixedArrayElement(FixedArray, intptr): Object;
+extern operator '[]' macro LoadFixedArrayElement(FixedArray, Smi): Object;
+extern operator
+'[]' macro LoadFixedArrayElementInt(FixedArray, constexpr int31): Object;
+extern operator
+'[]=' macro StoreFixedArrayElement(FixedArray, intptr, Object): void;
+extern operator
+'[]=' macro StoreFixedArrayElementInt(
+    FixedArray, constexpr int31, Object): void;
+extern operator
+'[]=' macro StoreFixedArrayElementSmi(FixedArray, Smi, Object): void;
+
+extern operator '.instance_type' macro LoadMapInstanceType(Map): int32;
+
+extern macro LoadFixedDoubleArrayElement(FixedDoubleArray, Smi): float64;
+extern macro Float64SilenceNaN(float64): float64;
+
+extern macro StoreFixedDoubleArrayElement(
+    FixedDoubleArray, Object, float64, constexpr ParameterMode);
+macro StoreFixedDoubleArrayElementWithSmiIndex(
+    array: FixedDoubleArray, index: Smi, value: float64) {
+  StoreFixedDoubleArrayElement(array, index, value, SMI_PARAMETERS);
+}
+
+extern macro BasicLoadNumberDictionaryElement(NumberDictionary, intptr):
+    Object labels NotData, IfHole;
+extern macro BasicStoreNumberDictionaryElement(NumberDictionary, intptr, Object)
+labels NotData, IfHole, ReadOnly;
+
+extern macro IsFastElementsKind(ElementsKind): bool;
+extern macro IsDoubleElementsKind(ElementsKind): bool;
+extern macro IsFastSmiOrTaggedElementsKind(ElementsKind): bool;
+extern macro IsFastSmiElementsKind(ElementsKind): bool;
+extern macro IsHoleyFastElementsKind(ElementsKind): bool;
+
+extern macro AllocateFixedArray(constexpr ElementsKind, intptr): FixedArray;
+
+extern macro CopyFixedArrayElements(
+    constexpr ElementsKind, FixedArray, constexpr ElementsKind, FixedArray,
+    intptr, intptr, intptr): void;
+extern macro CopyFixedArrayElements(
+    constexpr ElementsKind, FixedArray, constexpr ElementsKind, FixedArray, Smi,
+    Smi, Smi): void;
+
+extern macro AllocateJSArray(constexpr ElementsKind, Map, intptr, Smi): JSArray;
+extern macro AllocateJSArray(constexpr ElementsKind, Map, Smi, Smi): JSArray;
+extern macro IsElementsKindGreaterThan(
+    ElementsKind, constexpr ElementsKind): bool;
+
+extern macro LoadDoubleWithHoleCheck(FixedDoubleArray, Smi): float64
+labels IfHole;
+
+extern macro Call(Context, Callable, Object, ...): Object;
+
+extern macro ExtractFixedArray(
+    FixedArray, Smi, Smi, Smi, constexpr ExtractFixedArrayFlags): FixedArray;
+
+extern builtin ExtractFastJSArray(Context, JSArray, Smi, Smi): JSArray;
+
+macro LoadElementNoHole<T : type>(a: JSArray, index: Smi): Object labels IfHole;
+
+LoadElementNoHole<FixedArray>(a: JSArray, index: Smi): Object
+labels IfHole {
+  try {
+    let elements: FixedArray =
+        cast<FixedArray>(a.elements) otherwise Unexpected;
+    let e: Object = elements[index];
+    if (e == Hole) {
+      goto IfHole;
+    }
+    return e;
+  }
+  label Unexpected {
+    unreachable;
+  }
+}
+
+LoadElementNoHole<FixedDoubleArray>(a: JSArray, index: Smi): Object
+labels IfHole {
+  try {
+    let elements: FixedDoubleArray =
+        cast<FixedDoubleArray>(a.elements) otherwise Unexpected;
+    let e: float64 = LoadDoubleWithHoleCheck(elements, index) otherwise IfHole;
+    return AllocateHeapNumberWithValue(e);
+  }
+  label Unexpected {
+    unreachable;
+  }
+}
+
+macro HasPropertyObject(
+    o: Object, p: Object, c: Context,
+    f: constexpr HasPropertyLookupMode): Oddball {
+  try {
+    return HasProperty((cast<HeapObject>(o) otherwise CastError), p, c, f);
+  }
+  label CastError {
+    return False;
+  }
+}
+
+extern macro IsCallable(HeapObject): bool;
+extern macro IsJSArray(HeapObject): bool;
+extern macro TaggedIsCallable(Object): bool;
+extern macro IsDetachedBuffer(JSArrayBuffer): bool;
+extern macro IsHeapNumber(HeapObject): bool;
+extern macro IsExtensibleMap(Map): bool;
+extern macro IsCustomElementsReceiverInstanceType(int32): bool;
+extern macro Typeof(Object): Object;
+
+// Return true iff number is NaN.
+macro NumberIsNaN(number: Number): bool {
+  if (TaggedIsSmi(number)) return false;
+
+  let value: float64 = convert<float64>(unsafe_cast<HeapNumber>(number));
+  return value != value;
+}
+
+extern macro BranchIfToBooleanIsTrue(Object): never labels Taken, NotTaken;
+
+macro ToBoolean(obj: Object): bool {
+  if (BranchIfToBooleanIsTrue(obj)) {
+    return true;
+  } else {
+    return false;
+  }
+}
diff --git a/deps/v8/src/builtins/builtins-api.cc b/deps/v8/src/builtins/builtins-api.cc
index cba404676a9420..d77bc792388642 100644
--- a/deps/v8/src/builtins/builtins-api.cc
+++ b/deps/v8/src/builtins/builtins-api.cc
@@ -10,6 +10,7 @@
 #include "src/counters.h"
 #include "src/log.h"
 #include "src/objects-inl.h"
+#include "src/objects/templates.h"
 #include "src/prototype.h"
 #include "src/visitors.h"
 
@@ -63,7 +64,7 @@ V8_WARN_UNUSED_RESULT MaybeHandle<Object> HandleApiCallHelper(
         ObjectTemplateInfo::cast(fun_data->instance_template()), isolate);
     ASSIGN_RETURN_ON_EXCEPTION(
         isolate, js_receiver,
-        ApiNatives::InstantiateObject(instance_template,
+        ApiNatives::InstantiateObject(isolate, instance_template,
                                       Handle<JSReceiver>::cast(new_target)),
         Object);
     args[0] = *js_receiver;
@@ -79,7 +80,8 @@ V8_WARN_UNUSED_RESULT MaybeHandle<Object> HandleApiCallHelper(
       // Proxies never need access checks.
       DCHECK(js_receiver->IsJSObject());
       Handle<JSObject> js_obj_receiver = Handle<JSObject>::cast(js_receiver);
-      if (!isolate->MayAccess(handle(isolate->context()), js_obj_receiver)) {
+      if (!isolate->MayAccess(handle(isolate->context(), isolate),
+                              js_obj_receiver)) {
         isolate->ReportFailedAccessCheck(js_obj_receiver);
         RETURN_EXCEPTION_IF_SCHEDULED_EXCEPTION(isolate, Object);
         return isolate->factory()->undefined_value();
@@ -221,7 +223,8 @@ MaybeHandle<Object> Builtins::InvokeApiFunction(Isolate* isolate,
     argv[cursor--] = *args[i];
   }
   DCHECK_EQ(cursor, BuiltinArguments::kPaddingOffset);
-  argv[BuiltinArguments::kPaddingOffset] = isolate->heap()->the_hole_value();
+  argv[BuiltinArguments::kPaddingOffset] =
+      ReadOnlyRoots(isolate).the_hole_value();
   argv[BuiltinArguments::kArgcOffset] = Smi::FromInt(frame_argc);
   argv[BuiltinArguments::kTargetOffset] = *function;
   argv[BuiltinArguments::kNewTargetOffset] = *new_target;
@@ -259,7 +262,7 @@ V8_WARN_UNUSED_RESULT static Object* HandleApiCallAsFunctionOrConstructor(
     // right answer.
     new_target = obj;
   } else {
-    new_target = isolate->heap()->undefined_value();
+    new_target = ReadOnlyRoots(isolate).undefined_value();
   }
 
   // Get the invocation callback from the function descriptor that was
@@ -283,7 +286,7 @@ V8_WARN_UNUSED_RESULT static Object* HandleApiCallAsFunctionOrConstructor(
                                      args.length() - 1);
     Handle<Object> result_handle = custom.Call(call_data);
     if (result_handle.is_null()) {
-      result = isolate->heap()->undefined_value();
+      result = ReadOnlyRoots(isolate).undefined_value();
     } else {
       result = *result_handle;
     }
diff --git a/deps/v8/src/builtins/builtins-arguments-gen.cc b/deps/v8/src/builtins/builtins-arguments-gen.cc
index 2bf5e1c343c2e0..09c725fe37aa57 100644
--- a/deps/v8/src/builtins/builtins-arguments-gen.cc
+++ b/deps/v8/src/builtins/builtins-arguments-gen.cc
@@ -4,6 +4,7 @@
 
 #include "src/builtins/builtins-arguments-gen.h"
 
+#include "src/arguments.h"
 #include "src/builtins/builtins-utils-gen.h"
 #include "src/builtins/builtins.h"
 #include "src/code-factory.h"
@@ -11,6 +12,7 @@
 #include "src/frame-constants.h"
 #include "src/interface-descriptors.h"
 #include "src/objects-inl.h"
+#include "src/objects/arguments.h"
 
 namespace v8 {
 namespace internal {
@@ -43,7 +45,7 @@ ArgumentsBuiltinsAssembler::GetArgumentsFrameAndCount(Node* function,
   CSA_SLOW_ASSERT(this, HasInstanceType(shared, SHARED_FUNCTION_INFO_TYPE));
   Node* formal_parameter_count =
       LoadObjectField(shared, SharedFunctionInfo::kFormalParameterCountOffset,
-                      MachineType::Int32());
+                      MachineType::Uint16());
   formal_parameter_count = Int32ToParameter(formal_parameter_count, mode);
 
   argument_count.Bind(formal_parameter_count);
diff --git a/deps/v8/src/builtins/builtins-array-gen.cc b/deps/v8/src/builtins/builtins-array-gen.cc
index cca395b2ced3f2..fd08639c72cd68 100644
--- a/deps/v8/src/builtins/builtins-array-gen.cc
+++ b/deps/v8/src/builtins/builtins-array-gen.cc
@@ -2,16 +2,17 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
+#include "src/builtins/builtins-array-gen.h"
+
 #include "src/builtins/builtins-iterator-gen.h"
 #include "src/builtins/builtins-string-gen.h"
-#include "src/builtins/builtins-typedarray-gen.h"
+#include "src/builtins/builtins-typed-array-gen.h"
 #include "src/builtins/builtins-utils-gen.h"
 #include "src/builtins/builtins.h"
 #include "src/code-stub-assembler.h"
 #include "src/frame-constants.h"
 #include "src/heap/factory-inl.h"
-
-#include "src/builtins/builtins-array-gen.h"
+#include "src/objects/arguments-inl.h"
 
 namespace v8 {
 namespace internal {
@@ -20,7 +21,7 @@ using Node = compiler::Node;
 
 ArrayBuiltinsAssembler::ArrayBuiltinsAssembler(
     compiler::CodeAssemblerState* state)
-    : CodeStubAssembler(state),
+    : BaseBuiltinsFromDSLAssembler(state),
       k_(this, MachineRepresentation::kTagged),
       a_(this, MachineRepresentation::kTagged),
       to_(this, MachineRepresentation::kTagged, SmiConstant(0)),
@@ -150,7 +151,7 @@ Node* ArrayBuiltinsAssembler::FindProcessor(Node* k_value, Node* k) {
 
       BIND(&fast);
       {
-        GotoIf(SmiNotEqual(LoadJSArrayLength(a()), to_.value()), &runtime);
+        GotoIf(WordNotEqual(LoadJSArrayLength(a()), to_.value()), &runtime);
         kind = EnsureArrayPushable(LoadMap(a()), &runtime);
         GotoIf(IsElementsKindGreaterThan(kind, HOLEY_SMI_ELEMENTS),
                &object_push_pre);
@@ -211,9 +212,7 @@ Node* ArrayBuiltinsAssembler::FindProcessor(Node* k_value, Node* k) {
         context(), original_array, length, method_name);
     // In the Spec and our current implementation, the length check is already
     // performed in TypedArraySpeciesCreate.
-    CSA_ASSERT(this,
-               SmiLessThanOrEqual(
-                   len_, LoadObjectField(a, JSTypedArray::kLengthOffset)));
+    CSA_ASSERT(this, SmiLessThanOrEqual(CAST(len_), LoadTypedArrayLength(a)));
     fast_typed_array_target_ =
         Word32Equal(LoadInstanceType(LoadElements(original_array)),
                     LoadInstanceType(LoadElements(a)));
@@ -247,7 +246,7 @@ Node* ArrayBuiltinsAssembler::FindProcessor(Node* k_value, Node* k) {
         transition_smi_double(this);
     Label array_not_smi(this), array_fast(this), array_double(this);
 
-    Node* kind = LoadMapElementsKind(LoadMap(a()));
+    TNode<Int32T> kind = LoadElementsKind(a());
     Node* elements = LoadElements(a());
     GotoIf(IsElementsKindGreaterThan(kind, HOLEY_SMI_ELEMENTS), &array_not_smi);
     TryStoreArrayElement(HOLEY_SMI_ELEMENTS, mode, &transition_pre, elements, k,
@@ -295,9 +294,18 @@ Node* ArrayBuiltinsAssembler::FindProcessor(Node* k_value, Node* k) {
       Node* const native_context = LoadNativeContext(context());
       Node* const double_map = LoadContextElement(
           native_context, Context::JS_ARRAY_HOLEY_DOUBLE_ELEMENTS_MAP_INDEX);
-      CallStub(CodeFactory::TransitionElementsKind(
-                   isolate(), HOLEY_SMI_ELEMENTS, HOLEY_DOUBLE_ELEMENTS, true),
-               context(), a(), double_map);
+
+      const ElementsKind kFromKind = HOLEY_SMI_ELEMENTS;
+      const ElementsKind kToKind = HOLEY_DOUBLE_ELEMENTS;
+      const bool kIsJSArray = true;
+
+      Label transition_in_runtime(this, Label::kDeferred);
+      TransitionElementsKind(a(), double_map, kFromKind, kToKind, kIsJSArray,
+                             &transition_in_runtime);
+      Goto(&array_double);
+
+      BIND(&transition_in_runtime);
+      CallRuntime(Runtime::kTransitionElementsKind, context(), a(), double_map);
       Goto(&array_double);
     }
 
@@ -385,10 +393,9 @@ Node* ArrayBuiltinsAssembler::FindProcessor(Node* k_value, Node* k) {
 
   void ArrayBuiltinsAssembler::InitIteratingArrayBuiltinBody(
       TNode<Context> context, TNode<Object> receiver, Node* callbackfn,
-      Node* this_arg, Node* new_target, TNode<IntPtrT> argc) {
+      Node* this_arg, TNode<IntPtrT> argc) {
     context_ = context;
     receiver_ = receiver;
-    new_target_ = new_target;
     callbackfn_ = callbackfn;
     this_arg_ = this_arg;
     argc_ = argc;
@@ -419,28 +426,34 @@ Node* ArrayBuiltinsAssembler::FindProcessor(Node* k_value, Node* k) {
     GotoIf(DoesntHaveInstanceType(o(), JS_ARRAY_TYPE), &not_js_array);
     merged_length = LoadJSArrayLength(CAST(o()));
     Goto(&has_length);
+
     BIND(&not_js_array);
-    Node* len_property =
-        GetProperty(context(), o(), isolate()->factory()->length_string());
-    merged_length = ToLength_Inline(context(), len_property);
-    Goto(&has_length);
+    {
+      Node* len_property =
+          GetProperty(context(), o(), isolate()->factory()->length_string());
+      merged_length = ToLength_Inline(context(), len_property);
+      Goto(&has_length);
+    }
     BIND(&has_length);
-    len_ = merged_length.value();
+    {
+      len_ = merged_length.value();
 
-    // 5. If IsCallable(callbackfn) is false, throw a TypeError exception.
-    Label type_exception(this, Label::kDeferred);
-    Label done(this);
-    GotoIf(TaggedIsSmi(callbackfn()), &type_exception);
-    Branch(IsCallableMap(LoadMap(callbackfn())), &done, &type_exception);
+      // 5. If IsCallable(callbackfn) is false, throw a TypeError exception.
+      Label type_exception(this, Label::kDeferred);
+      Label done(this);
+      GotoIf(TaggedIsSmi(callbackfn()), &type_exception);
+      Branch(IsCallableMap(LoadMap(callbackfn())), &done, &type_exception);
 
-    BIND(&throw_null_undefined_exception);
-    ThrowTypeError(context(), MessageTemplate::kCalledOnNullOrUndefined, name);
+      BIND(&throw_null_undefined_exception);
+      ThrowTypeError(context(), MessageTemplate::kCalledOnNullOrUndefined,
+                     name);
 
-    BIND(&type_exception);
-    ThrowTypeError(context(), MessageTemplate::kCalledNonCallable,
-                   callbackfn());
+      BIND(&type_exception);
+      ThrowTypeError(context(), MessageTemplate::kCalledNonCallable,
+                     callbackfn());
 
-    BIND(&done);
+      BIND(&done);
+    }
 
     // 6. If thisArg was supplied, let T be thisArg; else let T be undefined.
     // [Already done by the arguments adapter]
@@ -501,7 +514,7 @@ Node* ArrayBuiltinsAssembler::FindProcessor(Node* k_value, Node* k) {
         LoadObjectField(typed_array, JSTypedArray::kBufferOffset);
     GotoIf(IsDetachedBuffer(array_buffer), &throw_detached);
 
-    len_ = LoadObjectField<Smi>(typed_array, JSTypedArray::kLengthOffset);
+    len_ = LoadTypedArrayLength(typed_array);
 
     Label throw_not_callable(this, Label::kDeferred);
     Label distinguish_types(this);
@@ -545,6 +558,7 @@ Node* ArrayBuiltinsAssembler::FindProcessor(Node* k_value, Node* k) {
     } else {
       k_.Bind(NumberDec(len()));
     }
+    CSA_ASSERT(this, IsSafeInteger(k()));
     Node* instance_type = LoadInstanceType(LoadElements(typed_array));
     Switch(instance_type, &unexpected_instance_type, instance_types.data(),
            label_ptrs.data(), labels.size());
@@ -586,10 +600,9 @@ Node* ArrayBuiltinsAssembler::FindProcessor(Node* k_value, Node* k) {
 
       Label done_element(this, &to_);
       // a. Let Pk be ToString(k).
-      // We never have to perform a ToString conversion as the above guards
-      // guarantee that we have a positive {k} which also is a valid array
-      // index in the range [0, 2^32-1).
-      CSA_ASSERT(this, IsNumberArrayIndex(k()));
+      // k() is guaranteed to be a positive integer, hence ToString is
+      // side-effect free and HasProperty/GetProperty do the conversion inline.
+      CSA_ASSERT(this, IsSafeInteger(k()));
 
       if (missing_property_mode == MissingPropertyMode::kSkip) {
         // b. Let kPresent be HasProperty(O, Pk).
@@ -679,6 +692,9 @@ Node* ArrayBuiltinsAssembler::FindProcessor(Node* k_value, Node* k) {
       Label* array_changed, ParameterMode mode, ForEachDirection direction,
       MissingPropertyMode missing_property_mode, TNode<Smi> length) {
     Comment("begin VisitAllFastElementsOneKind");
+    // We only use this kind of processing if the no-elements protector is
+    // in place at the start. We'll continue checking during array iteration.
+    CSA_ASSERT(this, Word32BinaryNot(IsNoElementsProtectorCellInvalid()));
     VARIABLE(original_map, MachineRepresentation::kTagged);
     original_map.Bind(LoadMap(o()));
     VariableList list({&original_map, &a_, &k_, &to_}, zone());
@@ -704,7 +720,8 @@ Node* ArrayBuiltinsAssembler::FindProcessor(Node* k_value, Node* k) {
           TNode<JSArray> o_array = CAST(o());
           // Check if o's length has changed during the callback and if the
           // index is now out of range of the new length.
-          GotoIf(SmiGreaterThanOrEqual(k_.value(), LoadJSArrayLength(o_array)),
+          GotoIf(SmiGreaterThanOrEqual(CAST(k_.value()),
+                                       CAST(LoadJSArrayLength(o_array))),
                  array_changed);
 
           // Re-load the elements array. If may have been resized.
@@ -730,10 +747,9 @@ Node* ArrayBuiltinsAssembler::FindProcessor(Node* k_value, Node* k) {
 
           BIND(&hole_element);
           if (missing_property_mode == MissingPropertyMode::kSkip) {
-            // Check if o's prototype change unexpectedly has elements after
-            // the callback in the case of a hole.
-            BranchIfPrototypesHaveNoElements(o_map, &one_element_done,
-                                             array_changed);
+            // The NoElementsProtectorCell could go invalid during callbacks.
+            Branch(IsNoElementsProtectorCellInvalid(), array_changed,
+                   &one_element_done);
           } else {
             value.Bind(UndefinedConstant());
             Goto(&process_element);
@@ -867,8 +883,9 @@ Node* ArrayBuiltinsAssembler::FindProcessor(Node* k_value, Node* k) {
     GotoIf(WordEqual(value, protector_invalid), &runtime);
 
     GotoIfNot(TaggedIsPositiveSmi(len), &runtime);
-    GotoIf(SmiAbove(len, SmiConstant(JSArray::kInitialMaxFastElementArray)),
-           &runtime);
+    GotoIf(
+        SmiAbove(CAST(len), SmiConstant(JSArray::kInitialMaxFastElementArray)),
+        &runtime);
 
     // We need to be conservative and start with holey because the builtins
     // that create output arrays aren't guaranteed to be called for every
@@ -898,9 +915,9 @@ Node* ArrayBuiltinsAssembler::FindProcessor(Node* k_value, Node* k) {
 
 TF_BUILTIN(ArrayPrototypePop, CodeStubAssembler) {
   TNode<Int32T> argc =
-      UncheckedCast<Int32T>(Parameter(BuiltinDescriptor::kArgumentsCount));
-  TNode<Context> context = CAST(Parameter(BuiltinDescriptor::kContext));
-  CSA_ASSERT(this, IsUndefined(Parameter(BuiltinDescriptor::kNewTarget)));
+      UncheckedCast<Int32T>(Parameter(Descriptor::kJSActualArgumentsCount));
+  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
+  CSA_ASSERT(this, IsUndefined(Parameter(Descriptor::kJSNewTarget)));
 
   CodeStubArguments args(this, ChangeInt32ToIntPtr(argc));
   TNode<Object> receiver = args.GetReceiver();
@@ -949,7 +966,7 @@ TF_BUILTIN(ArrayPrototypePop, CodeStubAssembler) {
     StoreObjectFieldNoWriteBarrier(array_receiver, JSArray::kLengthOffset,
                                    SmiTag(new_length));
 
-    Node* elements_kind = LoadMapElementsKind(LoadMap(array_receiver));
+    TNode<Int32T> elements_kind = LoadElementsKind(array_receiver);
     GotoIf(Int32LessThanOrEqual(elements_kind,
                                 Int32Constant(TERMINAL_FAST_ELEMENTS_KIND)),
            &fast_elements);
@@ -990,10 +1007,12 @@ TF_BUILTIN(ArrayPrototypePop, CodeStubAssembler) {
 
   BIND(&runtime);
   {
-    Node* target = LoadFromFrame(StandardFrameConstants::kFunctionOffset,
-                                 MachineType::TaggedPointer());
-    TailCallStub(CodeFactory::ArrayPop(isolate()), context, target,
-                 UndefinedConstant(), argc);
+    // We are not using Parameter(Descriptor::kJSTarget) and loading the value
+    // from the current frame here in order to reduce register pressure on the
+    // fast path.
+    TNode<JSFunction> target = LoadTargetFromFrame();
+    TailCallBuiltin(Builtins::kArrayPop, context, target, UndefinedConstant(),
+                    argc);
   }
 }
 
@@ -1010,9 +1029,9 @@ TF_BUILTIN(ArrayPrototypePush, CodeStubAssembler) {
   // TODO(ishell): use constants from Descriptor once the JSFunction linkage
   // arguments are reordered.
   TNode<Int32T> argc =
-      UncheckedCast<Int32T>(Parameter(BuiltinDescriptor::kArgumentsCount));
-  TNode<Context> context = CAST(Parameter(BuiltinDescriptor::kContext));
-  CSA_ASSERT(this, IsUndefined(Parameter(BuiltinDescriptor::kNewTarget)));
+      UncheckedCast<Int32T>(Parameter(Descriptor::kJSActualArgumentsCount));
+  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
+  CSA_ASSERT(this, IsUndefined(Parameter(Descriptor::kJSNewTarget)));
 
   CodeStubArguments args(this, ChangeInt32ToIntPtr(argc));
   TNode<Object> receiver = args.GetReceiver();
@@ -1122,10 +1141,12 @@ TF_BUILTIN(ArrayPrototypePush, CodeStubAssembler) {
 
   BIND(&runtime);
   {
-    Node* target = LoadFromFrame(StandardFrameConstants::kFunctionOffset,
-                                 MachineType::TaggedPointer());
-    TailCallStub(CodeFactory::ArrayPush(isolate()), context, target,
-                 UndefinedConstant(), argc);
+    // We are not using Parameter(Descriptor::kJSTarget) and loading the value
+    // from the current frame here in order to reduce register pressure on the
+    // fast path.
+    TNode<JSFunction> target = LoadTargetFromFrame();
+    TailCallBuiltin(Builtins::kArrayPush, context, target, UndefinedConstant(),
+                    argc);
   }
 }
 
@@ -1162,12 +1183,12 @@ class ArrayPrototypeSliceCodeStubAssembler : public CodeStubAssembler {
     // Make sure that the length hasn't been changed by side-effect.
     Node* array_length = LoadJSArrayLength(array);
     GotoIf(TaggedIsNotSmi(array_length), slow);
-    GotoIf(SmiAbove(SmiAdd(from, count), array_length), slow);
+    GotoIf(SmiAbove(SmiAdd(CAST(from), CAST(count)), CAST(array_length)), slow);
 
-    CSA_ASSERT(this, SmiGreaterThanOrEqual(from, SmiConstant(0)));
+    CSA_ASSERT(this, SmiGreaterThanOrEqual(CAST(from), SmiConstant(0)));
 
-    result.Bind(CallStub(CodeFactory::ExtractFastJSArray(isolate()), context,
-                         array, from, count));
+    result.Bind(CallBuiltin(Builtins::kExtractFastJSArray, context, array, from,
+                            count));
     Goto(&done);
 
     BIND(&try_fast_arguments);
@@ -1178,8 +1199,9 @@ class ArrayPrototypeSliceCodeStubAssembler : public CodeStubAssembler {
     GotoIf(WordNotEqual(map, fast_aliasted_arguments_map), &try_simple_slice);
 
     Node* sloppy_elements = LoadElements(array);
-    Node* sloppy_elements_length = LoadFixedArrayBaseLength(sloppy_elements);
-    Node* parameter_map_length =
+    TNode<Smi> sloppy_elements_length =
+        LoadFixedArrayBaseLength(sloppy_elements);
+    TNode<Smi> parameter_map_length =
         SmiSub(sloppy_elements_length,
                SmiConstant(SloppyArgumentsElements::kParameterMapStart));
     VARIABLE(index_out, MachineType::PointerRepresentation());
@@ -1188,16 +1210,16 @@ class ArrayPrototypeSliceCodeStubAssembler : public CodeStubAssembler {
         (kMaxRegularHeapObjectSize - FixedArray::kHeaderSize - JSArray::kSize -
          AllocationMemento::kSize) /
         kPointerSize;
-    GotoIf(SmiAboveOrEqual(count, SmiConstant(max_fast_elements)),
+    GotoIf(SmiAboveOrEqual(CAST(count), SmiConstant(max_fast_elements)),
            &try_simple_slice);
 
-    GotoIf(SmiLessThan(from, SmiConstant(0)), slow);
+    GotoIf(SmiLessThan(CAST(from), SmiConstant(0)), slow);
 
-    Node* end = SmiAdd(from, count);
+    TNode<Smi> end = SmiAdd(CAST(from), CAST(count));
 
     Node* unmapped_elements = LoadFixedArrayElement(
         sloppy_elements, SloppyArgumentsElements::kArgumentsIndex);
-    Node* unmapped_elements_length =
+    TNode<Smi> unmapped_elements_length =
         LoadFixedArrayBaseLength(unmapped_elements);
 
     GotoIf(SmiAbove(end, unmapped_elements_length), slow);
@@ -1208,8 +1230,8 @@ class ArrayPrototypeSliceCodeStubAssembler : public CodeStubAssembler {
 
     index_out.Bind(IntPtrConstant(0));
     Node* result_elements = LoadElements(result.value());
-    Node* from_mapped = SmiMin(parameter_map_length, from);
-    Node* to = SmiMin(parameter_map_length, end);
+    TNode<Smi> from_mapped = SmiMin(parameter_map_length, CAST(from));
+    TNode<Smi> to = SmiMin(parameter_map_length, end);
     Node* arguments_context = LoadFixedArrayElement(
         sloppy_elements, SloppyArgumentsElements::kContextIndex);
     VariableList var_list({&index_out}, zone());
@@ -1239,7 +1261,8 @@ class ArrayPrototypeSliceCodeStubAssembler : public CodeStubAssembler {
         },
         1, SMI_PARAMETERS, IndexAdvanceMode::kPost);
 
-    Node* unmapped_from = SmiMin(SmiMax(parameter_map_length, from), end);
+    TNode<Smi> unmapped_from =
+        SmiMin(SmiMax(parameter_map_length, CAST(from)), end);
 
     BuildFastLoop(
         var_list, unmapped_from, end,
@@ -1291,8 +1314,8 @@ class ArrayPrototypeSliceCodeStubAssembler : public CodeStubAssembler {
 
 TF_BUILTIN(ArrayPrototypeSlice, ArrayPrototypeSliceCodeStubAssembler) {
   Node* const argc =
-      ChangeInt32ToIntPtr(Parameter(BuiltinDescriptor::kArgumentsCount));
-  TNode<Context> context = CAST(Parameter(BuiltinDescriptor::kContext));
+      ChangeInt32ToIntPtr(Parameter(Descriptor::kJSActualArgumentsCount));
+  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
   Label slow(this, Label::kDeferred), fast_elements_kind(this);
 
   CodeStubArguments args(this, argc);
@@ -1304,7 +1327,7 @@ TF_BUILTIN(ArrayPrototypeSlice, ArrayPrototypeSliceCodeStubAssembler) {
       load_arguments_length(this);
 
   GotoIf(TaggedIsSmi(receiver), &generic_length);
-  GotoIfNot(IsJSArray(receiver), &check_arguments_length);
+  GotoIfNot(IsJSArray(CAST(receiver)), &check_arguments_length);
 
   TNode<JSArray> array_receiver = CAST(receiver);
   o = array_receiver;
@@ -1320,7 +1343,7 @@ TF_BUILTIN(ArrayPrototypeSlice, ArrayPrototypeSliceCodeStubAssembler) {
   BIND(&clone);
 
   args.PopAndReturn(
-      CallStub(CodeFactory::CloneFastJSArray(isolate()), context, receiver));
+      CallBuiltin(Builtins::kCloneFastJSArray, context, receiver));
 
   BIND(&check_arguments_length);
 
@@ -1466,9 +1489,9 @@ TF_BUILTIN(ArrayPrototypeSlice, ArrayPrototypeSliceCodeStubAssembler) {
 
 TF_BUILTIN(ArrayPrototypeShift, CodeStubAssembler) {
   TNode<Int32T> argc =
-      UncheckedCast<Int32T>(Parameter(BuiltinDescriptor::kArgumentsCount));
-  TNode<Context> context = CAST(Parameter(BuiltinDescriptor::kContext));
-  CSA_ASSERT(this, IsUndefined(Parameter(BuiltinDescriptor::kNewTarget)));
+      UncheckedCast<Int32T>(Parameter(Descriptor::kJSActualArgumentsCount));
+  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
+  CSA_ASSERT(this, IsUndefined(Parameter(Descriptor::kJSNewTarget)));
 
   CodeStubArguments args(this, ChangeInt32ToIntPtr(argc));
   TNode<Object> receiver = args.GetReceiver();
@@ -1525,7 +1548,7 @@ TF_BUILTIN(ArrayPrototypeShift, CodeStubAssembler) {
     StoreObjectFieldNoWriteBarrier(array_receiver, JSArray::kLengthOffset,
                                    SmiTag(new_length));
 
-    Node* elements_kind = LoadMapElementsKind(LoadMap(array_receiver));
+    TNode<Int32T> elements_kind = LoadElementsKind(array_receiver);
     GotoIf(
         Int32LessThanOrEqual(elements_kind, Int32Constant(HOLEY_SMI_ELEMENTS)),
         &fast_elements_smi);
@@ -1549,7 +1572,7 @@ TF_BUILTIN(ArrayPrototypeShift, CodeStubAssembler) {
 
       int32_t header_size = FixedDoubleArray::kHeaderSize - kHeapObjectTag;
       Node* memmove =
-          ExternalConstant(ExternalReference::libc_memmove_function(isolate()));
+          ExternalConstant(ExternalReference::libc_memmove_function());
       Node* start = IntPtrAdd(
           BitcastTaggedToWord(elements),
           ElementOffsetFromIndex(IntPtrConstant(0), HOLEY_DOUBLE_ELEMENTS,
@@ -1617,10 +1640,12 @@ TF_BUILTIN(ArrayPrototypeShift, CodeStubAssembler) {
 
   BIND(&runtime);
   {
-    Node* target = LoadFromFrame(StandardFrameConstants::kFunctionOffset,
-                                 MachineType::TaggedPointer());
-    TailCallStub(CodeFactory::ArrayShift(isolate()), context, target,
-                 UndefinedConstant(), argc);
+    // We are not using Parameter(Descriptor::kJSTarget) and loading the value
+    // from the current frame here in order to reduce register pressure on the
+    // fast path.
+    TNode<JSFunction> target = LoadTargetFromFrame();
+    TailCallBuiltin(Builtins::kArrayShift, context, target, UndefinedConstant(),
+                    argc);
   }
 }
 
@@ -1730,16 +1755,14 @@ TF_BUILTIN(ArrayFindLoopAfterCallbackLazyDeoptContinuation,
 // ES #sec-get-%typedarray%.prototype.find
 TF_BUILTIN(ArrayPrototypeFind, ArrayBuiltinsAssembler) {
   TNode<IntPtrT> argc =
-      ChangeInt32ToIntPtr(Parameter(BuiltinDescriptor::kArgumentsCount));
+      ChangeInt32ToIntPtr(Parameter(Descriptor::kJSActualArgumentsCount));
   CodeStubArguments args(this, argc);
-  TNode<Context> context = CAST(Parameter(BuiltinDescriptor::kContext));
-  Node* new_target = Parameter(BuiltinDescriptor::kNewTarget);
+  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
   TNode<Object> receiver = args.GetReceiver();
   Node* callbackfn = args.GetOptionalArgumentValue(0);
   Node* this_arg = args.GetOptionalArgumentValue(1);
 
-  InitIteratingArrayBuiltinBody(context, receiver, callbackfn, this_arg,
-                                new_target, argc);
+  InitIteratingArrayBuiltinBody(context, receiver, callbackfn, this_arg, argc);
 
   GenerateIteratingArrayBuiltinBody(
       "Array.prototype.find", &ArrayBuiltinsAssembler::FindResultGenerator,
@@ -1824,16 +1847,14 @@ TF_BUILTIN(ArrayFindIndexLoopAfterCallbackLazyDeoptContinuation,
 // ES #sec-get-%typedarray%.prototype.findIndex
 TF_BUILTIN(ArrayPrototypeFindIndex, ArrayBuiltinsAssembler) {
   TNode<IntPtrT> argc =
-      ChangeInt32ToIntPtr(Parameter(BuiltinDescriptor::kArgumentsCount));
+      ChangeInt32ToIntPtr(Parameter(Descriptor::kJSActualArgumentsCount));
   CodeStubArguments args(this, argc);
-  TNode<Context> context = CAST(Parameter(BuiltinDescriptor::kContext));
-  Node* new_target = Parameter(BuiltinDescriptor::kNewTarget);
+  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
   TNode<Object> receiver = args.GetReceiver();
   Node* callbackfn = args.GetOptionalArgumentValue(0);
   Node* this_arg = args.GetOptionalArgumentValue(1);
 
-  InitIteratingArrayBuiltinBody(context, receiver, callbackfn, this_arg,
-                                new_target, argc);
+  InitIteratingArrayBuiltinBody(context, receiver, callbackfn, this_arg, argc);
 
   GenerateIteratingArrayBuiltinBody(
       "Array.prototype.findIndex",
@@ -1855,7 +1876,7 @@ class ArrayPopulatorAssembler : public CodeStubAssembler {
     TVARIABLE(Object, array);
     Label is_constructor(this), is_not_constructor(this), done(this);
     GotoIf(TaggedIsSmi(receiver), &is_not_constructor);
-    Branch(IsConstructor(receiver), &is_constructor, &is_not_constructor);
+    Branch(IsConstructor(CAST(receiver)), &is_constructor, &is_not_constructor);
 
     BIND(&is_constructor);
     {
@@ -1888,7 +1909,7 @@ class ArrayPopulatorAssembler : public CodeStubAssembler {
     Label is_constructor(this), is_not_constructor(this), done(this);
     CSA_ASSERT(this, IsNumberNormalized(length));
     GotoIf(TaggedIsSmi(receiver), &is_not_constructor);
-    Branch(IsConstructor(receiver), &is_constructor, &is_not_constructor);
+    Branch(IsConstructor(CAST(receiver)), &is_constructor, &is_not_constructor);
 
     BIND(&is_constructor);
     {
@@ -1986,9 +2007,9 @@ class ArrayPopulatorAssembler : public CodeStubAssembler {
 
 // ES #sec-array.from
 TF_BUILTIN(ArrayFrom, ArrayPopulatorAssembler) {
-  TNode<Context> context = CAST(Parameter(BuiltinDescriptor::kContext));
+  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
   TNode<Int32T> argc =
-      UncheckedCast<Int32T>(Parameter(BuiltinDescriptor::kArgumentsCount));
+      UncheckedCast<Int32T>(Parameter(Descriptor::kJSActualArgumentsCount));
 
   CodeStubArguments args(this, ChangeInt32ToIntPtr(argc));
 
@@ -1999,7 +2020,7 @@ TF_BUILTIN(ArrayFrom, ArrayPopulatorAssembler) {
     Label no_error(this), error(this);
     GotoIf(IsUndefined(map_function), &no_error);
     GotoIf(TaggedIsSmi(map_function), &error);
-    Branch(IsCallable(map_function), &no_error, &error);
+    Branch(IsCallable(CAST(map_function)), &no_error, &error);
 
     BIND(&error);
     ThrowTypeError(context, MessageTemplate::kCalledNonCallable, map_function);
@@ -2036,7 +2057,7 @@ TF_BUILTIN(ArrayFrom, ArrayPopulatorAssembler) {
     {
       Label get_method_not_callable(this, Label::kDeferred), next(this);
       GotoIf(TaggedIsSmi(iterator_method), &get_method_not_callable);
-      GotoIfNot(IsCallable(iterator_method), &get_method_not_callable);
+      GotoIfNot(IsCallable(CAST(iterator_method)), &get_method_not_callable);
       Goto(&next);
 
       BIND(&get_method_not_callable);
@@ -2076,7 +2097,7 @@ TF_BUILTIN(ArrayFrom, ArrayPopulatorAssembler) {
         Label next(this);
         GotoIf(IsUndefined(map_function), &next);
 
-        CSA_ASSERT(this, IsCallable(map_function));
+        CSA_ASSERT(this, IsCallable(CAST(map_function)));
         Node* v = CallJS(CodeFactory::Call(isolate()), context, map_function,
                          this_arg, value.value(), index.value());
         GotoIfException(v, &on_exception, &var_exception);
@@ -2135,7 +2156,9 @@ TF_BUILTIN(ArrayFrom, ArrayPopulatorAssembler) {
 
     TVARIABLE(Number, index, SmiConstant(0));
 
-    GotoIf(SmiEqual(length.value(), SmiConstant(0)), &finished);
+    // TODO(ishell): remove <Object, Object>
+    GotoIf(WordEqual<Object, Object>(length.value(), SmiConstant(0)),
+           &finished);
 
     // Loop from 0 to length-1.
     {
@@ -2152,7 +2175,7 @@ TF_BUILTIN(ArrayFrom, ArrayPopulatorAssembler) {
         Label next(this);
         GotoIf(IsUndefined(map_function), &next);
 
-        CSA_ASSERT(this, IsCallable(map_function));
+        CSA_ASSERT(this, IsCallable(CAST(map_function)));
         value = CAST(CallJS(CodeFactory::Call(isolate()), context, map_function,
                             this_arg, value.value(), index.value()));
         Goto(&next);
@@ -2178,10 +2201,10 @@ TF_BUILTIN(ArrayFrom, ArrayPopulatorAssembler) {
 // ES #sec-array.of
 TF_BUILTIN(ArrayOf, ArrayPopulatorAssembler) {
   TNode<Int32T> argc =
-      UncheckedCast<Int32T>(Parameter(BuiltinDescriptor::kArgumentsCount));
+      UncheckedCast<Int32T>(Parameter(Descriptor::kJSActualArgumentsCount));
   TNode<Smi> length = SmiFromInt32(argc);
 
-  TNode<Context> context = CAST(Parameter(BuiltinDescriptor::kContext));
+  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
 
   CodeStubArguments args(this, length, nullptr, ParameterMode::SMI_PARAMETERS);
 
@@ -2204,16 +2227,14 @@ TF_BUILTIN(ArrayOf, ArrayPopulatorAssembler) {
 // ES #sec-get-%typedarray%.prototype.find
 TF_BUILTIN(TypedArrayPrototypeFind, ArrayBuiltinsAssembler) {
   TNode<IntPtrT> argc =
-      ChangeInt32ToIntPtr(Parameter(BuiltinDescriptor::kArgumentsCount));
+      ChangeInt32ToIntPtr(Parameter(Descriptor::kJSActualArgumentsCount));
   CodeStubArguments args(this, argc);
-  TNode<Context> context = CAST(Parameter(BuiltinDescriptor::kContext));
-  Node* new_target = Parameter(BuiltinDescriptor::kNewTarget);
+  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
   TNode<Object> receiver = args.GetReceiver();
   Node* callbackfn = args.GetOptionalArgumentValue(0);
   Node* this_arg = args.GetOptionalArgumentValue(1);
 
-  InitIteratingArrayBuiltinBody(context, receiver, callbackfn, this_arg,
-                                new_target, argc);
+  InitIteratingArrayBuiltinBody(context, receiver, callbackfn, this_arg, argc);
 
   GenerateIteratingTypedArrayBuiltinBody(
       "%TypedArray%.prototype.find",
@@ -2225,16 +2246,14 @@ TF_BUILTIN(TypedArrayPrototypeFind, ArrayBuiltinsAssembler) {
 // ES #sec-get-%typedarray%.prototype.findIndex
 TF_BUILTIN(TypedArrayPrototypeFindIndex, ArrayBuiltinsAssembler) {
   TNode<IntPtrT> argc =
-      ChangeInt32ToIntPtr(Parameter(BuiltinDescriptor::kArgumentsCount));
+      ChangeInt32ToIntPtr(Parameter(Descriptor::kJSActualArgumentsCount));
   CodeStubArguments args(this, argc);
-  TNode<Context> context = CAST(Parameter(BuiltinDescriptor::kContext));
-  Node* new_target = Parameter(BuiltinDescriptor::kNewTarget);
+  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
   TNode<Object> receiver = args.GetReceiver();
   Node* callbackfn = args.GetOptionalArgumentValue(0);
   Node* this_arg = args.GetOptionalArgumentValue(1);
 
-  InitIteratingArrayBuiltinBody(context, receiver, callbackfn, this_arg,
-                                new_target, argc);
+  InitIteratingArrayBuiltinBody(context, receiver, callbackfn, this_arg, argc);
 
   GenerateIteratingTypedArrayBuiltinBody(
       "%TypedArray%.prototype.findIndex",
@@ -2243,86 +2262,16 @@ TF_BUILTIN(TypedArrayPrototypeFindIndex, ArrayBuiltinsAssembler) {
       &ArrayBuiltinsAssembler::NullPostLoopAction);
 }
 
-TF_BUILTIN(ArrayForEachLoopContinuation, ArrayBuiltinsAssembler) {
-  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
-  TNode<Object> receiver = CAST(Parameter(Descriptor::kReceiver));
-  Node* callbackfn = Parameter(Descriptor::kCallbackFn);
-  Node* this_arg = Parameter(Descriptor::kThisArg);
-  Node* array = Parameter(Descriptor::kArray);
-  TNode<JSReceiver> object = CAST(Parameter(Descriptor::kObject));
-  Node* initial_k = Parameter(Descriptor::kInitialK);
-  TNode<Number> len = CAST(Parameter(Descriptor::kLength));
-  Node* to = Parameter(Descriptor::kTo);
-
-  InitIteratingArrayBuiltinLoopContinuation(context, receiver, callbackfn,
-                                            this_arg, array, object, initial_k,
-                                            len, to);
-
-  GenerateIteratingArrayBuiltinLoopContinuation(
-      &ArrayBuiltinsAssembler::ForEachProcessor,
-      &ArrayBuiltinsAssembler::NullPostLoopAction, MissingPropertyMode::kSkip);
-}
-
-TF_BUILTIN(ArrayForEachLoopEagerDeoptContinuation, ArrayBuiltinsAssembler) {
-  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
-  TNode<Object> receiver = CAST(Parameter(Descriptor::kReceiver));
-  Node* callbackfn = Parameter(Descriptor::kCallbackFn);
-  Node* this_arg = Parameter(Descriptor::kThisArg);
-  Node* initial_k = Parameter(Descriptor::kInitialK);
-  TNode<Number> len = CAST(Parameter(Descriptor::kLength));
-
-  Return(CallBuiltin(Builtins::kArrayForEachLoopContinuation, context, receiver,
-                     callbackfn, this_arg, UndefinedConstant(), receiver,
-                     initial_k, len, UndefinedConstant()));
-}
-
-TF_BUILTIN(ArrayForEachLoopLazyDeoptContinuation, ArrayBuiltinsAssembler) {
-  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
-  TNode<Object> receiver = CAST(Parameter(Descriptor::kReceiver));
-  Node* callbackfn = Parameter(Descriptor::kCallbackFn);
-  Node* this_arg = Parameter(Descriptor::kThisArg);
-  Node* initial_k = Parameter(Descriptor::kInitialK);
-  TNode<Number> len = CAST(Parameter(Descriptor::kLength));
-
-  Return(CallBuiltin(Builtins::kArrayForEachLoopContinuation, context, receiver,
-                     callbackfn, this_arg, UndefinedConstant(), receiver,
-                     initial_k, len, UndefinedConstant()));
-}
-
-TF_BUILTIN(ArrayForEach, ArrayBuiltinsAssembler) {
-  TNode<IntPtrT> argc =
-      ChangeInt32ToIntPtr(Parameter(BuiltinDescriptor::kArgumentsCount));
-  CodeStubArguments args(this, argc);
-  TNode<Context> context = CAST(Parameter(BuiltinDescriptor::kContext));
-  Node* new_target = Parameter(BuiltinDescriptor::kNewTarget);
-  TNode<Object> receiver = args.GetReceiver();
-  Node* callbackfn = args.GetOptionalArgumentValue(0);
-  Node* this_arg = args.GetOptionalArgumentValue(1);
-
-  InitIteratingArrayBuiltinBody(context, receiver, callbackfn, this_arg,
-                                new_target, argc);
-
-  GenerateIteratingArrayBuiltinBody(
-      "Array.prototype.forEach",
-      &ArrayBuiltinsAssembler::ForEachResultGenerator,
-      &ArrayBuiltinsAssembler::ForEachProcessor,
-      &ArrayBuiltinsAssembler::NullPostLoopAction,
-      Builtins::CallableFor(isolate(), Builtins::kArrayForEachLoopContinuation),
-      MissingPropertyMode::kSkip);
-}
-
 TF_BUILTIN(TypedArrayPrototypeForEach, ArrayBuiltinsAssembler) {
   TNode<IntPtrT> argc =
-      ChangeInt32ToIntPtr(Parameter(BuiltinDescriptor::kArgumentsCount));
+      ChangeInt32ToIntPtr(Parameter(Descriptor::kJSActualArgumentsCount));
   CodeStubArguments args(this, argc);
-  TNode<Context> context = CAST(Parameter(BuiltinDescriptor::kContext));
-  Node* new_target = Parameter(BuiltinDescriptor::kNewTarget);
+  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
   TNode<Object> receiver = args.GetReceiver();
   Node* callbackfn = args.GetOptionalArgumentValue(0);
   Node* this_arg = args.GetOptionalArgumentValue(1);
 
-  InitIteratingArrayBuiltinBody(context, receiver, callbackfn, this_arg,
-                                new_target, argc);
+  InitIteratingArrayBuiltinBody(context, receiver, callbackfn, this_arg, argc);
 
   GenerateIteratingTypedArrayBuiltinBody(
       "%TypedArray%.prototype.forEach",
@@ -2395,16 +2344,14 @@ TF_BUILTIN(ArraySomeLoopContinuation, ArrayBuiltinsAssembler) {
 
 TF_BUILTIN(ArraySome, ArrayBuiltinsAssembler) {
   TNode<IntPtrT> argc =
-      ChangeInt32ToIntPtr(Parameter(BuiltinDescriptor::kArgumentsCount));
+      ChangeInt32ToIntPtr(Parameter(Descriptor::kJSActualArgumentsCount));
   CodeStubArguments args(this, argc);
-  TNode<Context> context = CAST(Parameter(BuiltinDescriptor::kContext));
-  Node* new_target = Parameter(BuiltinDescriptor::kNewTarget);
+  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
   TNode<Object> receiver = args.GetReceiver();
   Node* callbackfn = args.GetOptionalArgumentValue(0);
   Node* this_arg = args.GetOptionalArgumentValue(1);
 
-  InitIteratingArrayBuiltinBody(context, receiver, callbackfn, this_arg,
-                                new_target, argc);
+  InitIteratingArrayBuiltinBody(context, receiver, callbackfn, this_arg, argc);
 
   GenerateIteratingArrayBuiltinBody(
       "Array.prototype.some", &ArrayBuiltinsAssembler::SomeResultGenerator,
@@ -2416,16 +2363,14 @@ TF_BUILTIN(ArraySome, ArrayBuiltinsAssembler) {
 
 TF_BUILTIN(TypedArrayPrototypeSome, ArrayBuiltinsAssembler) {
   TNode<IntPtrT> argc =
-      ChangeInt32ToIntPtr(Parameter(BuiltinDescriptor::kArgumentsCount));
+      ChangeInt32ToIntPtr(Parameter(Descriptor::kJSActualArgumentsCount));
   CodeStubArguments args(this, argc);
-  TNode<Context> context = CAST(Parameter(BuiltinDescriptor::kContext));
-  Node* new_target = Parameter(BuiltinDescriptor::kNewTarget);
+  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
   TNode<Object> receiver = args.GetReceiver();
   Node* callbackfn = args.GetOptionalArgumentValue(0);
   Node* this_arg = args.GetOptionalArgumentValue(1);
 
-  InitIteratingArrayBuiltinBody(context, receiver, callbackfn, this_arg,
-                                new_target, argc);
+  InitIteratingArrayBuiltinBody(context, receiver, callbackfn, this_arg, argc);
 
   GenerateIteratingTypedArrayBuiltinBody(
       "%TypedArray%.prototype.some",
@@ -2498,16 +2443,14 @@ TF_BUILTIN(ArrayEveryLoopContinuation, ArrayBuiltinsAssembler) {
 
 TF_BUILTIN(ArrayEvery, ArrayBuiltinsAssembler) {
   TNode<IntPtrT> argc =
-      ChangeInt32ToIntPtr(Parameter(BuiltinDescriptor::kArgumentsCount));
+      ChangeInt32ToIntPtr(Parameter(Descriptor::kJSActualArgumentsCount));
   CodeStubArguments args(this, argc);
-  TNode<Context> context = CAST(Parameter(BuiltinDescriptor::kContext));
-  Node* new_target = Parameter(BuiltinDescriptor::kNewTarget);
+  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
   TNode<Object> receiver = args.GetReceiver();
   Node* callbackfn = args.GetOptionalArgumentValue(0);
   Node* this_arg = args.GetOptionalArgumentValue(1);
 
-  InitIteratingArrayBuiltinBody(context, receiver, callbackfn, this_arg,
-                                new_target, argc);
+  InitIteratingArrayBuiltinBody(context, receiver, callbackfn, this_arg, argc);
 
   GenerateIteratingArrayBuiltinBody(
       "Array.prototype.every", &ArrayBuiltinsAssembler::EveryResultGenerator,
@@ -2519,16 +2462,14 @@ TF_BUILTIN(ArrayEvery, ArrayBuiltinsAssembler) {
 
 TF_BUILTIN(TypedArrayPrototypeEvery, ArrayBuiltinsAssembler) {
   TNode<IntPtrT> argc =
-      ChangeInt32ToIntPtr(Parameter(BuiltinDescriptor::kArgumentsCount));
+      ChangeInt32ToIntPtr(Parameter(Descriptor::kJSActualArgumentsCount));
   CodeStubArguments args(this, argc);
-  TNode<Context> context = CAST(Parameter(BuiltinDescriptor::kContext));
-  Node* new_target = Parameter(BuiltinDescriptor::kNewTarget);
+  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
   TNode<Object> receiver = args.GetReceiver();
   Node* callbackfn = args.GetOptionalArgumentValue(0);
   Node* this_arg = args.GetOptionalArgumentValue(1);
 
-  InitIteratingArrayBuiltinBody(context, receiver, callbackfn, this_arg,
-                                new_target, argc);
+  InitIteratingArrayBuiltinBody(context, receiver, callbackfn, this_arg, argc);
 
   GenerateIteratingTypedArrayBuiltinBody(
       "%TypedArray%.prototype.every",
@@ -2600,16 +2541,15 @@ TF_BUILTIN(ArrayReduceLoopLazyDeoptContinuation, ArrayBuiltinsAssembler) {
 
 TF_BUILTIN(ArrayReduce, ArrayBuiltinsAssembler) {
   TNode<IntPtrT> argc =
-      ChangeInt32ToIntPtr(Parameter(BuiltinDescriptor::kArgumentsCount));
+      ChangeInt32ToIntPtr(Parameter(Descriptor::kJSActualArgumentsCount));
   CodeStubArguments args(this, argc);
-  TNode<Context> context = CAST(Parameter(BuiltinDescriptor::kContext));
-  Node* new_target = Parameter(BuiltinDescriptor::kNewTarget);
+  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
   TNode<Object> receiver = args.GetReceiver();
   Node* callbackfn = args.GetOptionalArgumentValue(0);
   Node* initial_value = args.GetOptionalArgumentValue(1, TheHoleConstant());
 
   InitIteratingArrayBuiltinBody(context, receiver, callbackfn, initial_value,
-                                new_target, argc);
+                                argc);
 
   GenerateIteratingArrayBuiltinBody(
       "Array.prototype.reduce", &ArrayBuiltinsAssembler::ReduceResultGenerator,
@@ -2621,16 +2561,15 @@ TF_BUILTIN(ArrayReduce, ArrayBuiltinsAssembler) {
 
 TF_BUILTIN(TypedArrayPrototypeReduce, ArrayBuiltinsAssembler) {
   TNode<IntPtrT> argc =
-      ChangeInt32ToIntPtr(Parameter(BuiltinDescriptor::kArgumentsCount));
+      ChangeInt32ToIntPtr(Parameter(Descriptor::kJSActualArgumentsCount));
   CodeStubArguments args(this, argc);
-  TNode<Context> context = CAST(Parameter(BuiltinDescriptor::kContext));
-  Node* new_target = Parameter(BuiltinDescriptor::kNewTarget);
+  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
   TNode<Object> receiver = args.GetReceiver();
   Node* callbackfn = args.GetOptionalArgumentValue(0);
   Node* initial_value = args.GetOptionalArgumentValue(1, TheHoleConstant());
 
   InitIteratingArrayBuiltinBody(context, receiver, callbackfn, initial_value,
-                                new_target, argc);
+                                argc);
 
   GenerateIteratingTypedArrayBuiltinBody(
       "%TypedArray%.prototype.reduce",
@@ -2704,16 +2643,15 @@ TF_BUILTIN(ArrayReduceRightLoopLazyDeoptContinuation, ArrayBuiltinsAssembler) {
 
 TF_BUILTIN(ArrayReduceRight, ArrayBuiltinsAssembler) {
   TNode<IntPtrT> argc =
-      ChangeInt32ToIntPtr(Parameter(BuiltinDescriptor::kArgumentsCount));
+      ChangeInt32ToIntPtr(Parameter(Descriptor::kJSActualArgumentsCount));
   CodeStubArguments args(this, argc);
-  TNode<Context> context = CAST(Parameter(BuiltinDescriptor::kContext));
-  Node* new_target = Parameter(BuiltinDescriptor::kNewTarget);
+  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
   TNode<Object> receiver = args.GetReceiver();
   Node* callbackfn = args.GetOptionalArgumentValue(0);
   Node* initial_value = args.GetOptionalArgumentValue(1, TheHoleConstant());
 
   InitIteratingArrayBuiltinBody(context, receiver, callbackfn, initial_value,
-                                new_target, argc);
+                                argc);
 
   GenerateIteratingArrayBuiltinBody(
       "Array.prototype.reduceRight",
@@ -2727,16 +2665,15 @@ TF_BUILTIN(ArrayReduceRight, ArrayBuiltinsAssembler) {
 
 TF_BUILTIN(TypedArrayPrototypeReduceRight, ArrayBuiltinsAssembler) {
   TNode<IntPtrT> argc =
-      ChangeInt32ToIntPtr(Parameter(BuiltinDescriptor::kArgumentsCount));
+      ChangeInt32ToIntPtr(Parameter(Descriptor::kJSActualArgumentsCount));
   CodeStubArguments args(this, argc);
-  TNode<Context> context = CAST(Parameter(BuiltinDescriptor::kContext));
-  Node* new_target = Parameter(BuiltinDescriptor::kNewTarget);
+  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
   TNode<Object> receiver = args.GetReceiver();
   Node* callbackfn = args.GetOptionalArgumentValue(0);
   Node* initial_value = args.GetOptionalArgumentValue(1, TheHoleConstant());
 
   InitIteratingArrayBuiltinBody(context, receiver, callbackfn, initial_value,
-                                new_target, argc);
+                                argc);
 
   GenerateIteratingTypedArrayBuiltinBody(
       "%TypedArray%.prototype.reduceRight",
@@ -2824,16 +2761,14 @@ TF_BUILTIN(ArrayFilterLoopLazyDeoptContinuation, ArrayBuiltinsAssembler) {
 
 TF_BUILTIN(ArrayFilter, ArrayBuiltinsAssembler) {
   TNode<IntPtrT> argc =
-      ChangeInt32ToIntPtr(Parameter(BuiltinDescriptor::kArgumentsCount));
+      ChangeInt32ToIntPtr(Parameter(Descriptor::kJSActualArgumentsCount));
   CodeStubArguments args(this, argc);
-  TNode<Context> context = CAST(Parameter(BuiltinDescriptor::kContext));
-  Node* new_target = Parameter(BuiltinDescriptor::kNewTarget);
+  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
   TNode<Object> receiver = args.GetReceiver();
   Node* callbackfn = args.GetOptionalArgumentValue(0);
   Node* this_arg = args.GetOptionalArgumentValue(1);
 
-  InitIteratingArrayBuiltinBody(context, receiver, callbackfn, this_arg,
-                                new_target, argc);
+  InitIteratingArrayBuiltinBody(context, receiver, callbackfn, this_arg, argc);
 
   GenerateIteratingArrayBuiltinBody(
       "Array.prototype.filter", &ArrayBuiltinsAssembler::FilterResultGenerator,
@@ -2904,16 +2839,14 @@ TF_BUILTIN(ArrayMapLoopLazyDeoptContinuation, ArrayBuiltinsAssembler) {
 
 TF_BUILTIN(ArrayMap, ArrayBuiltinsAssembler) {
   TNode<IntPtrT> argc =
-      ChangeInt32ToIntPtr(Parameter(BuiltinDescriptor::kArgumentsCount));
+      ChangeInt32ToIntPtr(Parameter(Descriptor::kJSActualArgumentsCount));
   CodeStubArguments args(this, argc);
-  TNode<Context> context = CAST(Parameter(BuiltinDescriptor::kContext));
-  Node* new_target = Parameter(BuiltinDescriptor::kNewTarget);
+  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
   TNode<Object> receiver = args.GetReceiver();
   Node* callbackfn = args.GetOptionalArgumentValue(0);
   Node* this_arg = args.GetOptionalArgumentValue(1);
 
-  InitIteratingArrayBuiltinBody(context, receiver, callbackfn, this_arg,
-                                new_target, argc);
+  InitIteratingArrayBuiltinBody(context, receiver, callbackfn, this_arg, argc);
 
   GenerateIteratingArrayBuiltinBody(
       "Array.prototype.map", &ArrayBuiltinsAssembler::MapResultGenerator,
@@ -2925,16 +2858,14 @@ TF_BUILTIN(ArrayMap, ArrayBuiltinsAssembler) {
 
 TF_BUILTIN(TypedArrayPrototypeMap, ArrayBuiltinsAssembler) {
   TNode<IntPtrT> argc =
-      ChangeInt32ToIntPtr(Parameter(BuiltinDescriptor::kArgumentsCount));
+      ChangeInt32ToIntPtr(Parameter(Descriptor::kJSActualArgumentsCount));
   CodeStubArguments args(this, argc);
-  TNode<Context> context = CAST(Parameter(BuiltinDescriptor::kContext));
-  Node* new_target = Parameter(BuiltinDescriptor::kNewTarget);
+  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
   TNode<Object> receiver = args.GetReceiver();
   Node* callbackfn = args.GetOptionalArgumentValue(0);
   Node* this_arg = args.GetOptionalArgumentValue(1);
 
-  InitIteratingArrayBuiltinBody(context, receiver, callbackfn, this_arg,
-                                new_target, argc);
+  InitIteratingArrayBuiltinBody(context, receiver, callbackfn, this_arg, argc);
 
   GenerateIteratingTypedArrayBuiltinBody(
       "%TypedArray%.prototype.map",
@@ -2975,7 +2906,8 @@ class ArrayIncludesIndexofAssembler : public CodeStubAssembler {
 
   enum SearchVariant { kIncludes, kIndexOf };
 
-  void Generate(SearchVariant variant);
+  void Generate(SearchVariant variant, TNode<IntPtrT> argc,
+                TNode<Context> context);
   void GenerateSmiOrObject(SearchVariant variant, Node* context, Node* elements,
                            Node* search_element, Node* array_length,
                            Node* from_index);
@@ -2987,18 +2919,17 @@ class ArrayIncludesIndexofAssembler : public CodeStubAssembler {
                             Node* from_index);
 };
 
-void ArrayIncludesIndexofAssembler::Generate(SearchVariant variant) {
+void ArrayIncludesIndexofAssembler::Generate(SearchVariant variant,
+                                             TNode<IntPtrT> argc,
+                                             TNode<Context> context) {
   const int kSearchElementArg = 0;
   const int kFromIndexArg = 1;
 
-  TNode<IntPtrT> argc =
-      ChangeInt32ToIntPtr(Parameter(BuiltinDescriptor::kArgumentsCount));
   CodeStubArguments args(this, argc);
 
   TNode<Object> receiver = args.GetReceiver();
   TNode<Object> search_element =
       args.GetOptionalArgumentValue(kSearchElementArg);
-  TNode<Context> context = CAST(Parameter(BuiltinDescriptor::kContext));
 
   Node* intptr_zero = IntPtrConstant(0);
 
@@ -3058,7 +2989,7 @@ void ArrayIncludesIndexofAssembler::Generate(SearchVariant variant) {
 
   Label if_smiorobjects(this), if_packed_doubles(this), if_holey_doubles(this);
 
-  Node* elements_kind = LoadMapElementsKind(LoadMap(array));
+  TNode<Int32T> elements_kind = LoadElementsKind(array);
   Node* elements = LoadElements(array);
   STATIC_ASSERT(PACKED_SMI_ELEMENTS == 0);
   STATIC_ASSERT(HOLEY_SMI_ELEMENTS == 1);
@@ -3220,7 +3151,7 @@ void ArrayIncludesIndexofAssembler::GenerateSmiOrObject(
                 &return_not_found);
       Node* element_k = LoadFixedArrayElement(elements, index_var.value());
       GotoIf(TaggedIsSmi(element_k), &continue_loop);
-      GotoIfNot(IsHeapNumber(element_k), &continue_loop);
+      GotoIfNot(IsHeapNumber(CAST(element_k)), &continue_loop);
       BranchIfFloat64IsNaN(LoadHeapNumberValue(element_k), &return_found,
                            &continue_loop);
 
@@ -3272,7 +3203,7 @@ void ArrayIncludesIndexofAssembler::GenerateSmiOrObject(
     Node* element_k = LoadFixedArrayElement(elements, index_var.value());
     Label continue_loop(this);
     GotoIf(TaggedIsSmi(element_k), &continue_loop);
-    GotoIfNot(IsBigInt(element_k), &continue_loop);
+    GotoIfNot(IsBigInt(CAST(element_k)), &continue_loop);
     TNode<Object> result = CallRuntime(Runtime::kBigIntEqualToBigInt, context,
                                        search_element, element_k);
     Branch(WordEqual(result, TrueConstant()), &return_found, &continue_loop);
@@ -3463,7 +3394,11 @@ void ArrayIncludesIndexofAssembler::GenerateHoleyDoubles(SearchVariant variant,
 }
 
 TF_BUILTIN(ArrayIncludes, ArrayIncludesIndexofAssembler) {
-  Generate(kIncludes);
+  TNode<IntPtrT> argc =
+      ChangeInt32ToIntPtr(Parameter(Descriptor::kJSActualArgumentsCount));
+  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
+
+  Generate(kIncludes, argc, context);
 }
 
 TF_BUILTIN(ArrayIncludesSmiOrObject, ArrayIncludesIndexofAssembler) {
@@ -3497,7 +3432,13 @@ TF_BUILTIN(ArrayIncludesHoleyDoubles, ArrayIncludesIndexofAssembler) {
                        from_index);
 }
 
-TF_BUILTIN(ArrayIndexOf, ArrayIncludesIndexofAssembler) { Generate(kIndexOf); }
+TF_BUILTIN(ArrayIndexOf, ArrayIncludesIndexofAssembler) {
+  TNode<IntPtrT> argc =
+      ChangeInt32ToIntPtr(Parameter(Descriptor::kJSActualArgumentsCount));
+  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
+
+  Generate(kIndexOf, argc, context);
+}
 
 TF_BUILTIN(ArrayIndexOfSmiOrObject, ArrayIncludesIndexofAssembler) {
   Node* context = Parameter(Descriptor::kContext);
@@ -3577,7 +3518,7 @@ TF_BUILTIN(ArrayIteratorPrototypeNext, CodeStubAssembler) {
   // If O does not have all of the internal slots of an Array Iterator Instance
   // (22.1.5.3), throw a TypeError exception
   GotoIf(TaggedIsSmi(iterator), &throw_bad_receiver);
-  GotoIfNot(IsJSArrayIterator(iterator), &throw_bad_receiver);
+  GotoIfNot(IsJSArrayIterator(CAST(iterator)), &throw_bad_receiver);
 
   // Let a be O.[[IteratedObject]].
   Node* array =
@@ -3603,17 +3544,14 @@ TF_BUILTIN(ArrayIteratorPrototypeNext, CodeStubAssembler) {
     Node* elements_kind = LoadMapElementsKind(array_map);
     GotoIfNot(IsFastElementsKind(elements_kind), &if_other);
 
-    Node* length = LoadJSArrayLength(array);
-
-    CSA_ASSERT(this, TaggedIsSmi(length));
-    CSA_ASSERT(this, TaggedIsSmi(index));
+    TNode<Smi> length = CAST(LoadJSArrayLength(array));
 
-    GotoIfNot(SmiBelow(index, length), &set_done);
+    GotoIfNot(SmiBelow(CAST(index), length), &set_done);
 
     var_value.Bind(index);
-    Node* one = SmiConstant(1);
+    TNode<Smi> one = SmiConstant(1);
     StoreObjectFieldNoWriteBarrier(iterator, JSArrayIterator::kNextIndexOffset,
-                                   SmiAdd(index, one));
+                                   SmiAdd(CAST(index), one));
     var_done.Bind(FalseConstant());
 
     GotoIf(Word32Equal(LoadAndUntagToWord32ObjectField(
@@ -3718,17 +3656,14 @@ TF_BUILTIN(ArrayIteratorPrototypeNext, CodeStubAssembler) {
     Node* buffer = LoadObjectField(array, JSTypedArray::kBufferOffset);
     GotoIf(IsDetachedBuffer(buffer), &if_detached);
 
-    Node* length = LoadObjectField(array, JSTypedArray::kLengthOffset);
+    TNode<Smi> length = LoadTypedArrayLength(CAST(array));
 
-    CSA_ASSERT(this, TaggedIsSmi(length));
-    CSA_ASSERT(this, TaggedIsSmi(index));
-
-    GotoIfNot(SmiBelow(index, length), &set_done);
+    GotoIfNot(SmiBelow(CAST(index), length), &set_done);
 
     var_value.Bind(index);
-    Node* one = SmiConstant(1);
+    TNode<Smi> one = SmiConstant(1);
     StoreObjectFieldNoWriteBarrier(iterator, JSArrayIterator::kNextIndexOffset,
-                                   SmiAdd(index, one));
+                                   SmiAdd(CAST(index), one));
     var_done.Bind(FalseConstant());
 
     GotoIf(Word32Equal(LoadAndUntagToWord32ObjectField(
@@ -3879,7 +3814,8 @@ class ArrayFlattenAssembler : public CodeStubAssembler {
 
       // a. Let P be ! ToString(sourceIndex).
       // b. Let exists be ? HasProperty(source, P).
-      CSA_ASSERT(this, SmiGreaterThanOrEqual(source_index, SmiConstant(0)));
+      CSA_ASSERT(this,
+                 SmiGreaterThanOrEqual(CAST(source_index), SmiConstant(0)));
       Node* const exists =
           HasProperty(source, source_index, context, kHasProperty);
 
@@ -4013,12 +3949,12 @@ TF_BUILTIN(FlatMapIntoArray, ArrayFlattenAssembler) {
                           mapper_function, this_arg));
 }
 
-// https://tc39.github.io/proposal-flatMap/#sec-Array.prototype.flatten
-TF_BUILTIN(ArrayPrototypeFlatten, CodeStubAssembler) {
+// https://tc39.github.io/proposal-flatMap/#sec-Array.prototype.flat
+TF_BUILTIN(ArrayPrototypeFlat, CodeStubAssembler) {
   Node* const argc =
-      ChangeInt32ToIntPtr(Parameter(BuiltinDescriptor::kArgumentsCount));
+      ChangeInt32ToIntPtr(Parameter(Descriptor::kJSActualArgumentsCount));
   CodeStubArguments args(this, argc);
-  Node* const context = Parameter(BuiltinDescriptor::kContext);
+  Node* const context = Parameter(Descriptor::kContext);
   Node* const receiver = args.GetReceiver();
   Node* const depth = args.GetOptionalArgumentValue(0);
 
@@ -4059,9 +3995,9 @@ TF_BUILTIN(ArrayPrototypeFlatten, CodeStubAssembler) {
 // https://tc39.github.io/proposal-flatMap/#sec-Array.prototype.flatMap
 TF_BUILTIN(ArrayPrototypeFlatMap, CodeStubAssembler) {
   Node* const argc =
-      ChangeInt32ToIntPtr(Parameter(BuiltinDescriptor::kArgumentsCount));
+      ChangeInt32ToIntPtr(Parameter(Descriptor::kJSActualArgumentsCount));
   CodeStubArguments args(this, argc);
-  Node* const context = Parameter(BuiltinDescriptor::kContext);
+  Node* const context = Parameter(Descriptor::kContext);
   Node* const receiver = args.GetReceiver();
   Node* const mapper_function = args.GetOptionalArgumentValue(0);
 
@@ -4097,5 +4033,405 @@ TF_BUILTIN(ArrayPrototypeFlatMap, CodeStubAssembler) {
   { ThrowTypeError(context, MessageTemplate::kMapperFunctionNonCallable); }
 }
 
+TF_BUILTIN(ArrayConstructor, ArrayBuiltinsAssembler) {
+  // This is a trampoline to ArrayConstructorImpl which just adds
+  // allocation_site parameter value and sets new_target if necessary.
+  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
+  TNode<JSFunction> function = CAST(Parameter(Descriptor::kTarget));
+  TNode<Object> new_target = CAST(Parameter(Descriptor::kNewTarget));
+  TNode<Int32T> argc =
+      UncheckedCast<Int32T>(Parameter(Descriptor::kActualArgumentsCount));
+
+  // If new_target is undefined, then this is the 'Call' case, so set new_target
+  // to function.
+  new_target =
+      SelectConstant<Object>(IsUndefined(new_target), function, new_target);
+
+  // Run the native code for the Array function called as a normal function.
+  TNode<Object> no_allocation_site = UndefinedConstant();
+  TailCallBuiltin(Builtins::kArrayConstructorImpl, context, function,
+                  new_target, argc, no_allocation_site);
+}
+
+void ArrayBuiltinsAssembler::TailCallArrayConstructorStub(
+    const Callable& callable, TNode<Context> context, TNode<JSFunction> target,
+    TNode<HeapObject> allocation_site_or_undefined, TNode<Int32T> argc) {
+  TNode<Code> code = HeapConstant(callable.code());
+
+  // We are going to call here ArrayNoArgumentsConstructor or
+  // ArraySingleArgumentsConstructor which in addition to the register arguments
+  // also expect some number of arguments on the expression stack.
+  // Since
+  // 1) incoming JS arguments are still on the stack,
+  // 2) the ArrayNoArgumentsConstructor, ArraySingleArgumentsConstructor and
+  //    ArrayNArgumentsConstructor are defined so that the register arguments
+  //    are passed on the same registers,
+  // in order to be able to generate a tail call to those builtins we do the
+  // following trick here: we tail call to the constructor builtin using
+  // ArrayNArgumentsConstructorDescriptor, so the tail call instruction
+  // pops the current frame but leaves all the incoming JS arguments on the
+  // expression stack so that the target builtin can still find them where it
+  // expects.
+  TailCallStub(ArrayNArgumentsConstructorDescriptor{}, code, context, target,
+               allocation_site_or_undefined, argc);
+}
+
+void ArrayBuiltinsAssembler::CreateArrayDispatchNoArgument(
+    TNode<Context> context, TNode<JSFunction> target, TNode<Int32T> argc,
+    AllocationSiteOverrideMode mode, TNode<AllocationSite> allocation_site) {
+  if (mode == DISABLE_ALLOCATION_SITES) {
+    Callable callable = CodeFactory::ArrayNoArgumentConstructor(
+        isolate(), GetInitialFastElementsKind(), mode);
+
+    TailCallArrayConstructorStub(callable, context, target, UndefinedConstant(),
+                                 argc);
+  } else {
+    DCHECK_EQ(mode, DONT_OVERRIDE);
+    TNode<Int32T> elements_kind = LoadElementsKind(allocation_site);
+
+    // TODO(ishell): Compute the builtin index dynamically instead of
+    // iterating over all expected elements kinds.
+    int last_index =
+        GetSequenceIndexFromFastElementsKind(TERMINAL_FAST_ELEMENTS_KIND);
+    for (int i = 0; i <= last_index; ++i) {
+      Label next(this);
+      ElementsKind kind = GetFastElementsKindFromSequenceIndex(i);
+      GotoIfNot(Word32Equal(elements_kind, Int32Constant(kind)), &next);
+
+      Callable callable =
+          CodeFactory::ArrayNoArgumentConstructor(isolate(), kind, mode);
+
+      TailCallArrayConstructorStub(callable, context, target, allocation_site,
+                                   argc);
+
+      BIND(&next);
+    }
+
+    // If we reached this point there is a problem.
+    Abort(AbortReason::kUnexpectedElementsKindInArrayConstructor);
+  }
+}
+
+void ArrayBuiltinsAssembler::CreateArrayDispatchSingleArgument(
+    TNode<Context> context, TNode<JSFunction> target, TNode<Int32T> argc,
+    AllocationSiteOverrideMode mode, TNode<AllocationSite> allocation_site) {
+  if (mode == DISABLE_ALLOCATION_SITES) {
+    ElementsKind initial = GetInitialFastElementsKind();
+    ElementsKind holey_initial = GetHoleyElementsKind(initial);
+    Callable callable = CodeFactory::ArraySingleArgumentConstructor(
+        isolate(), holey_initial, mode);
+
+    TailCallArrayConstructorStub(callable, context, target, UndefinedConstant(),
+                                 argc);
+  } else {
+    DCHECK_EQ(mode, DONT_OVERRIDE);
+    TNode<Smi> transition_info = LoadTransitionInfo(allocation_site);
+
+    // Least significant bit in fast array elements kind means holeyness.
+    STATIC_ASSERT(PACKED_SMI_ELEMENTS == 0);
+    STATIC_ASSERT(HOLEY_SMI_ELEMENTS == 1);
+    STATIC_ASSERT(PACKED_ELEMENTS == 2);
+    STATIC_ASSERT(HOLEY_ELEMENTS == 3);
+    STATIC_ASSERT(PACKED_DOUBLE_ELEMENTS == 4);
+    STATIC_ASSERT(HOLEY_DOUBLE_ELEMENTS == 5);
+
+    Label normal_sequence(this);
+    TVARIABLE(Int32T, var_elements_kind,
+              Signed(DecodeWord32<AllocationSite::ElementsKindBits>(
+                  SmiToInt32(transition_info))));
+    // Is the low bit set? If so, we are holey and that is good.
+    int fast_elements_kind_holey_mask =
+        AllocationSite::ElementsKindBits::encode(static_cast<ElementsKind>(1));
+    GotoIf(IsSetSmi(transition_info, fast_elements_kind_holey_mask),
+           &normal_sequence);
+    {
+      // Make elements kind holey and update elements kind in the type info.
+      var_elements_kind =
+          Signed(Word32Or(var_elements_kind.value(), Int32Constant(1)));
+      StoreObjectFieldNoWriteBarrier(
+          allocation_site, AllocationSite::kTransitionInfoOrBoilerplateOffset,
+          SmiOr(transition_info, SmiConstant(fast_elements_kind_holey_mask)));
+      Goto(&normal_sequence);
+    }
+    BIND(&normal_sequence);
+
+    // TODO(ishell): Compute the builtin index dynamically instead of
+    // iterating over all expected elements kinds.
+    // TODO(ishell): Given that the code above ensures that the elements kind
+    // is holey we can skip checking with non-holey elements kinds.
+    int last_index =
+        GetSequenceIndexFromFastElementsKind(TERMINAL_FAST_ELEMENTS_KIND);
+    for (int i = 0; i <= last_index; ++i) {
+      Label next(this);
+      ElementsKind kind = GetFastElementsKindFromSequenceIndex(i);
+      GotoIfNot(Word32Equal(var_elements_kind.value(), Int32Constant(kind)),
+                &next);
+
+      Callable callable =
+          CodeFactory::ArraySingleArgumentConstructor(isolate(), kind, mode);
+
+      TailCallArrayConstructorStub(callable, context, target, allocation_site,
+                                   argc);
+
+      BIND(&next);
+    }
+
+    // If we reached this point there is a problem.
+    Abort(AbortReason::kUnexpectedElementsKindInArrayConstructor);
+  }
+}
+
+void ArrayBuiltinsAssembler::GenerateDispatchToArrayStub(
+    TNode<Context> context, TNode<JSFunction> target, TNode<Int32T> argc,
+    AllocationSiteOverrideMode mode, TNode<AllocationSite> allocation_site) {
+  Label check_one_case(this), fallthrough(this);
+  GotoIfNot(Word32Equal(argc, Int32Constant(0)), &check_one_case);
+  CreateArrayDispatchNoArgument(context, target, argc, mode, allocation_site);
+
+  BIND(&check_one_case);
+  GotoIfNot(Word32Equal(argc, Int32Constant(1)), &fallthrough);
+  CreateArrayDispatchSingleArgument(context, target, argc, mode,
+                                    allocation_site);
+
+  BIND(&fallthrough);
+}
+
+TF_BUILTIN(ArrayConstructorImpl, ArrayBuiltinsAssembler) {
+  TNode<JSFunction> target = CAST(Parameter(Descriptor::kTarget));
+  TNode<Object> new_target = CAST(Parameter(Descriptor::kNewTarget));
+  TNode<Int32T> argc =
+      UncheckedCast<Int32T>(Parameter(Descriptor::kActualArgumentsCount));
+  TNode<HeapObject> maybe_allocation_site =
+      CAST(Parameter(Descriptor::kAllocationSite));
+
+  // Initial map for the builtin Array functions should be Map.
+  CSA_ASSERT(this, IsMap(CAST(LoadObjectField(
+                       target, JSFunction::kPrototypeOrInitialMapOffset))));
+
+  // We should either have undefined or a valid AllocationSite
+  CSA_ASSERT(this, Word32Or(IsUndefined(maybe_allocation_site),
+                            IsAllocationSite(maybe_allocation_site)));
+
+  // "Enter" the context of the Array function.
+  TNode<Context> context =
+      CAST(LoadObjectField(target, JSFunction::kContextOffset));
+
+  Label runtime(this, Label::kDeferred);
+  GotoIf(WordNotEqual(target, new_target), &runtime);
+
+  Label no_info(this);
+  // If the feedback vector is the undefined value call an array constructor
+  // that doesn't use AllocationSites.
+  GotoIf(IsUndefined(maybe_allocation_site), &no_info);
+
+  GenerateDispatchToArrayStub(context, target, argc, DONT_OVERRIDE,
+                              CAST(maybe_allocation_site));
+  Goto(&runtime);
+
+  BIND(&no_info);
+  GenerateDispatchToArrayStub(context, target, argc, DISABLE_ALLOCATION_SITES);
+  Goto(&runtime);
+
+  BIND(&runtime);
+  GenerateArrayNArgumentsConstructor(context, target, new_target, argc,
+                                     maybe_allocation_site);
+}
+
+void ArrayBuiltinsAssembler::GenerateConstructor(
+    Node* context, Node* array_function, Node* array_map, Node* array_size,
+    Node* allocation_site, ElementsKind elements_kind,
+    AllocationSiteMode mode) {
+  Label ok(this);
+  Label smi_size(this);
+  Label small_smi_size(this);
+  Label call_runtime(this, Label::kDeferred);
+
+  Branch(TaggedIsSmi(array_size), &smi_size, &call_runtime);
+
+  BIND(&smi_size);
+
+  if (IsFastPackedElementsKind(elements_kind)) {
+    Label abort(this, Label::kDeferred);
+    Branch(SmiEqual(CAST(array_size), SmiConstant(0)), &small_smi_size, &abort);
+
+    BIND(&abort);
+    Node* reason = SmiConstant(AbortReason::kAllocatingNonEmptyPackedArray);
+    TailCallRuntime(Runtime::kAbort, context, reason);
+  } else {
+    int element_size =
+        IsDoubleElementsKind(elements_kind) ? kDoubleSize : kPointerSize;
+    int max_fast_elements =
+        (kMaxRegularHeapObjectSize - FixedArray::kHeaderSize - JSArray::kSize -
+         AllocationMemento::kSize) /
+        element_size;
+    Branch(SmiAboveOrEqual(CAST(array_size), SmiConstant(max_fast_elements)),
+           &call_runtime, &small_smi_size);
+  }
+
+  BIND(&small_smi_size);
+  {
+    Node* array = AllocateJSArray(
+        elements_kind, array_map, array_size, array_size,
+        mode == DONT_TRACK_ALLOCATION_SITE ? nullptr : allocation_site,
+        CodeStubAssembler::SMI_PARAMETERS);
+    Return(array);
+  }
+
+  BIND(&call_runtime);
+  {
+    TailCallRuntime(Runtime::kNewArray, context, array_function, array_size,
+                    array_function, allocation_site);
+  }
+}
+
+void ArrayBuiltinsAssembler::GenerateArrayNoArgumentConstructor(
+    ElementsKind kind, AllocationSiteOverrideMode mode) {
+  typedef ArrayNoArgumentConstructorDescriptor Descriptor;
+  Node* native_context = LoadObjectField(Parameter(Descriptor::kFunction),
+                                         JSFunction::kContextOffset);
+  bool track_allocation_site =
+      AllocationSite::ShouldTrack(kind) && mode != DISABLE_ALLOCATION_SITES;
+  Node* allocation_site =
+      track_allocation_site ? Parameter(Descriptor::kAllocationSite) : nullptr;
+  Node* array_map = LoadJSArrayElementsMap(kind, native_context);
+  Node* array = AllocateJSArray(
+      kind, array_map, IntPtrConstant(JSArray::kPreallocatedArrayElements),
+      SmiConstant(0), allocation_site);
+  Return(array);
+}
+
+void ArrayBuiltinsAssembler::GenerateArraySingleArgumentConstructor(
+    ElementsKind kind, AllocationSiteOverrideMode mode) {
+  typedef ArraySingleArgumentConstructorDescriptor Descriptor;
+  Node* context = Parameter(Descriptor::kContext);
+  Node* function = Parameter(Descriptor::kFunction);
+  Node* native_context = LoadObjectField(function, JSFunction::kContextOffset);
+  Node* array_map = LoadJSArrayElementsMap(kind, native_context);
+
+  AllocationSiteMode allocation_site_mode = DONT_TRACK_ALLOCATION_SITE;
+  if (mode == DONT_OVERRIDE) {
+    allocation_site_mode = AllocationSite::ShouldTrack(kind)
+                               ? TRACK_ALLOCATION_SITE
+                               : DONT_TRACK_ALLOCATION_SITE;
+  }
+
+  Node* array_size = Parameter(Descriptor::kArraySizeSmiParameter);
+  Node* allocation_site = Parameter(Descriptor::kAllocationSite);
+
+  GenerateConstructor(context, function, array_map, array_size, allocation_site,
+                      kind, allocation_site_mode);
+}
+
+void ArrayBuiltinsAssembler::GenerateArrayNArgumentsConstructor(
+    TNode<Context> context, TNode<JSFunction> target, TNode<Object> new_target,
+    TNode<Int32T> argc, TNode<HeapObject> maybe_allocation_site) {
+  // Replace incoming JS receiver argument with the target.
+  // TODO(ishell): Avoid replacing the target on the stack and just add it
+  // as another additional parameter for Runtime::kNewArray.
+  CodeStubArguments args(this, ChangeInt32ToIntPtr(argc));
+  args.SetReceiver(target);
+
+  // Adjust arguments count for the runtime call: +1 for implicit receiver
+  // and +2 for new_target and maybe_allocation_site.
+  argc = Int32Add(argc, Int32Constant(3));
+  TailCallRuntime(Runtime::kNewArray, argc, context, new_target,
+                  maybe_allocation_site);
+}
+
+TF_BUILTIN(ArrayNArgumentsConstructor, ArrayBuiltinsAssembler) {
+  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
+  TNode<JSFunction> target = CAST(Parameter(Descriptor::kFunction));
+  TNode<Int32T> argc =
+      UncheckedCast<Int32T>(Parameter(Descriptor::kActualArgumentsCount));
+  TNode<HeapObject> maybe_allocation_site =
+      CAST(Parameter(Descriptor::kAllocationSite));
+
+  GenerateArrayNArgumentsConstructor(context, target, target, argc,
+                                     maybe_allocation_site);
+}
+
+void ArrayBuiltinsAssembler::GenerateInternalArrayNoArgumentConstructor(
+    ElementsKind kind) {
+  typedef ArrayNoArgumentConstructorDescriptor Descriptor;
+  Node* array_map = LoadObjectField(Parameter(Descriptor::kFunction),
+                                    JSFunction::kPrototypeOrInitialMapOffset);
+  Node* array = AllocateJSArray(
+      kind, array_map, IntPtrConstant(JSArray::kPreallocatedArrayElements),
+      SmiConstant(0));
+  Return(array);
+}
+
+void ArrayBuiltinsAssembler::GenerateInternalArraySingleArgumentConstructor(
+    ElementsKind kind) {
+  typedef ArraySingleArgumentConstructorDescriptor Descriptor;
+  Node* context = Parameter(Descriptor::kContext);
+  Node* function = Parameter(Descriptor::kFunction);
+  Node* array_map =
+      LoadObjectField(function, JSFunction::kPrototypeOrInitialMapOffset);
+  Node* array_size = Parameter(Descriptor::kArraySizeSmiParameter);
+  Node* allocation_site = UndefinedConstant();
+
+  GenerateConstructor(context, function, array_map, array_size, allocation_site,
+                      kind, DONT_TRACK_ALLOCATION_SITE);
+}
+
+#define GENERATE_ARRAY_CTOR(name, kind_camel, kind_caps, mode_camel, \
+                            mode_caps)                               \
+  TF_BUILTIN(Array##name##Constructor_##kind_camel##_##mode_camel,   \
+             ArrayBuiltinsAssembler) {                               \
+    GenerateArray##name##Constructor(kind_caps, mode_caps);          \
+  }
+
+// The ArrayNoArgumentConstructor builtin family.
+GENERATE_ARRAY_CTOR(NoArgument, PackedSmi, PACKED_SMI_ELEMENTS, DontOverride,
+                    DONT_OVERRIDE);
+GENERATE_ARRAY_CTOR(NoArgument, HoleySmi, HOLEY_SMI_ELEMENTS, DontOverride,
+                    DONT_OVERRIDE);
+GENERATE_ARRAY_CTOR(NoArgument, PackedSmi, PACKED_SMI_ELEMENTS,
+                    DisableAllocationSites, DISABLE_ALLOCATION_SITES);
+GENERATE_ARRAY_CTOR(NoArgument, HoleySmi, HOLEY_SMI_ELEMENTS,
+                    DisableAllocationSites, DISABLE_ALLOCATION_SITES);
+GENERATE_ARRAY_CTOR(NoArgument, Packed, PACKED_ELEMENTS, DisableAllocationSites,
+                    DISABLE_ALLOCATION_SITES);
+GENERATE_ARRAY_CTOR(NoArgument, Holey, HOLEY_ELEMENTS, DisableAllocationSites,
+                    DISABLE_ALLOCATION_SITES);
+GENERATE_ARRAY_CTOR(NoArgument, PackedDouble, PACKED_DOUBLE_ELEMENTS,
+                    DisableAllocationSites, DISABLE_ALLOCATION_SITES);
+GENERATE_ARRAY_CTOR(NoArgument, HoleyDouble, HOLEY_DOUBLE_ELEMENTS,
+                    DisableAllocationSites, DISABLE_ALLOCATION_SITES);
+
+// The ArraySingleArgumentConstructor builtin family.
+GENERATE_ARRAY_CTOR(SingleArgument, PackedSmi, PACKED_SMI_ELEMENTS,
+                    DontOverride, DONT_OVERRIDE);
+GENERATE_ARRAY_CTOR(SingleArgument, HoleySmi, HOLEY_SMI_ELEMENTS, DontOverride,
+                    DONT_OVERRIDE);
+GENERATE_ARRAY_CTOR(SingleArgument, PackedSmi, PACKED_SMI_ELEMENTS,
+                    DisableAllocationSites, DISABLE_ALLOCATION_SITES);
+GENERATE_ARRAY_CTOR(SingleArgument, HoleySmi, HOLEY_SMI_ELEMENTS,
+                    DisableAllocationSites, DISABLE_ALLOCATION_SITES);
+GENERATE_ARRAY_CTOR(SingleArgument, Packed, PACKED_ELEMENTS,
+                    DisableAllocationSites, DISABLE_ALLOCATION_SITES);
+GENERATE_ARRAY_CTOR(SingleArgument, Holey, HOLEY_ELEMENTS,
+                    DisableAllocationSites, DISABLE_ALLOCATION_SITES);
+GENERATE_ARRAY_CTOR(SingleArgument, PackedDouble, PACKED_DOUBLE_ELEMENTS,
+                    DisableAllocationSites, DISABLE_ALLOCATION_SITES);
+GENERATE_ARRAY_CTOR(SingleArgument, HoleyDouble, HOLEY_DOUBLE_ELEMENTS,
+                    DisableAllocationSites, DISABLE_ALLOCATION_SITES);
+
+#undef GENERATE_ARRAY_CTOR
+
+#define GENERATE_INTERNAL_ARRAY_CTOR(name, kind_camel, kind_caps) \
+  TF_BUILTIN(InternalArray##name##Constructor_##kind_camel,       \
+             ArrayBuiltinsAssembler) {                            \
+    GenerateInternalArray##name##Constructor(kind_caps);          \
+  }
+
+GENERATE_INTERNAL_ARRAY_CTOR(NoArgument, Packed, PACKED_ELEMENTS);
+GENERATE_INTERNAL_ARRAY_CTOR(NoArgument, Holey, HOLEY_ELEMENTS);
+GENERATE_INTERNAL_ARRAY_CTOR(SingleArgument, Packed, PACKED_ELEMENTS);
+GENERATE_INTERNAL_ARRAY_CTOR(SingleArgument, Holey, HOLEY_ELEMENTS);
+
+#undef GENERATE_INTERNAL_ARRAY_CTOR
+
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/src/builtins/builtins-array-gen.h b/deps/v8/src/builtins/builtins-array-gen.h
index aabd4bab6ea700..92b32115a009a2 100644
--- a/deps/v8/src/builtins/builtins-array-gen.h
+++ b/deps/v8/src/builtins/builtins-array-gen.h
@@ -5,12 +5,12 @@
 #ifndef V8_BUILTINS_BUILTINS_ARRAY_GEN_H_
 #define V8_BUILTINS_BUILTINS_ARRAY_GEN_H_
 
-#include "src/code-stub-assembler.h"
+#include "torque-generated/builtins-base-from-dsl-gen.h"
 
 namespace v8 {
 namespace internal {
 
-class ArrayBuiltinsAssembler : public CodeStubAssembler {
+class ArrayBuiltinsAssembler : public BaseBuiltinsFromDSLAssembler {
  public:
   explicit ArrayBuiltinsAssembler(compiler::CodeAssemblerState* state);
 
@@ -68,24 +68,31 @@ class ArrayBuiltinsAssembler : public CodeStubAssembler {
 
   void NullPostLoopAction();
 
+  // TODO(szuend): Remove once overload resolution is fixed in Torque.
+  TNode<Object> LoadFixedArrayElementInt(TNode<FixedArray> array, int index) {
+    return LoadFixedArrayElement(array, index);
+  }
+  Node* StoreFixedArrayElementInt(TNode<FixedArray> array, int index,
+                                  TNode<Object> value) {
+    return StoreFixedArrayElement(array, index, value);
+  }
+
  protected:
   TNode<Context> context() { return context_; }
   TNode<Object> receiver() { return receiver_; }
-  Node* new_target() { return new_target_; }
   TNode<IntPtrT> argc() { return argc_; }
   TNode<JSReceiver> o() { return o_; }
   TNode<Number> len() { return len_; }
   Node* callbackfn() { return callbackfn_; }
   Node* this_arg() { return this_arg_; }
-  Node* k() { return k_.value(); }
+  TNode<Number> k() { return CAST(k_.value()); }
   Node* a() { return a_.value(); }
 
   void ReturnFromBuiltin(Node* value);
 
   void InitIteratingArrayBuiltinBody(TNode<Context> context,
                                      TNode<Object> receiver, Node* callbackfn,
-                                     Node* this_arg, Node* new_target,
-                                     TNode<IntPtrT> argc);
+                                     Node* this_arg, TNode<IntPtrT> argc);
 
   void GenerateIteratingArrayBuiltinBody(
       const char* name, const BuiltinResultGenerator& generator,
@@ -108,6 +115,41 @@ class ArrayBuiltinsAssembler : public CodeStubAssembler {
       MissingPropertyMode missing_property_mode,
       ForEachDirection direction = ForEachDirection::kForward);
 
+  void TailCallArrayConstructorStub(
+      const Callable& callable, TNode<Context> context,
+      TNode<JSFunction> target, TNode<HeapObject> allocation_site_or_undefined,
+      TNode<Int32T> argc);
+
+  void GenerateDispatchToArrayStub(
+      TNode<Context> context, TNode<JSFunction> target, TNode<Int32T> argc,
+      AllocationSiteOverrideMode mode,
+      TNode<AllocationSite> allocation_site = TNode<AllocationSite>());
+
+  void CreateArrayDispatchNoArgument(
+      TNode<Context> context, TNode<JSFunction> target, TNode<Int32T> argc,
+      AllocationSiteOverrideMode mode,
+      TNode<AllocationSite> allocation_site = TNode<AllocationSite>());
+
+  void CreateArrayDispatchSingleArgument(
+      TNode<Context> context, TNode<JSFunction> target, TNode<Int32T> argc,
+      AllocationSiteOverrideMode mode,
+      TNode<AllocationSite> allocation_site = TNode<AllocationSite>());
+
+  void GenerateConstructor(Node* context, Node* array_function, Node* array_map,
+                           Node* array_size, Node* allocation_site,
+                           ElementsKind elements_kind, AllocationSiteMode mode);
+  void GenerateArrayNoArgumentConstructor(ElementsKind kind,
+                                          AllocationSiteOverrideMode mode);
+  void GenerateArraySingleArgumentConstructor(ElementsKind kind,
+                                              AllocationSiteOverrideMode mode);
+  void GenerateArrayNArgumentsConstructor(
+      TNode<Context> context, TNode<JSFunction> target,
+      TNode<Object> new_target, TNode<Int32T> argc,
+      TNode<HeapObject> maybe_allocation_site);
+
+  void GenerateInternalArrayNoArgumentConstructor(ElementsKind kind);
+  void GenerateInternalArraySingleArgumentConstructor(ElementsKind kind);
+
  private:
   static ElementsKind ElementsKindForInstanceType(InstanceType type);
 
@@ -142,7 +184,6 @@ class ArrayBuiltinsAssembler : public CodeStubAssembler {
   TNode<Number> len_;
   TNode<Context> context_;
   TNode<Object> receiver_;
-  Node* new_target_ = nullptr;
   TNode<IntPtrT> argc_;
   Node* fast_typed_array_target_ = nullptr;
   const char* name_ = nullptr;
diff --git a/deps/v8/src/builtins/builtins-array.cc b/deps/v8/src/builtins/builtins-array.cc
index f57c7d39ca846f..ce84f6bc38eb07 100644
--- a/deps/v8/src/builtins/builtins-array.cc
+++ b/deps/v8/src/builtins/builtins-array.cc
@@ -14,6 +14,7 @@
 #include "src/isolate.h"
 #include "src/lookup.h"
 #include "src/objects-inl.h"
+#include "src/objects/hash-table-inl.h"
 #include "src/prototype.h"
 
 namespace v8 {
@@ -55,7 +56,7 @@ inline bool IsJSArrayFastElementMovingAllowed(Isolate* isolate,
 }
 
 inline bool HasSimpleElements(JSObject* current) {
-  return current->map()->instance_type() > LAST_CUSTOM_ELEMENTS_RECEIVER &&
+  return !current->map()->IsCustomElementsReceiverMap() &&
          !current->GetElementsAccessor()->HasAccessors(current);
 }
 
@@ -140,46 +141,167 @@ V8_WARN_UNUSED_RESULT static Object* CallJsIntrinsic(
       isolate,
       Execution::Call(isolate, function, args.receiver(), argc, argv.start()));
 }
+
+V8_WARN_UNUSED_RESULT Object* GenericArrayPush(Isolate* isolate,
+                                               BuiltinArguments* args) {
+  // 1. Let O be ? ToObject(this value).
+  Handle<JSReceiver> receiver;
+  ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
+      isolate, receiver, Object::ToObject(isolate, args->receiver()));
+
+  // 2. Let len be ? ToLength(? Get(O, "length")).
+  Handle<Object> raw_length_number;
+  ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
+      isolate, raw_length_number,
+      Object::GetLengthFromArrayLike(isolate, Handle<Object>::cast(receiver)));
+
+  // 3. Let args be a List whose elements are, in left to right order,
+  //    the arguments that were passed to this function invocation.
+  // 4. Let arg_count be the number of elements in args.
+  int arg_count = args->length() - 1;
+
+  // 5. If len + arg_count > 2^53-1, throw a TypeError exception.
+  double length = raw_length_number->Number();
+  if (arg_count > kMaxSafeInteger - length) {
+    THROW_NEW_ERROR_RETURN_FAILURE(
+        isolate, NewTypeError(MessageTemplate::kPushPastSafeLength,
+                              isolate->factory()->NewNumberFromInt(arg_count),
+                              raw_length_number));
+  }
+
+  // 6. Repeat, while args is not empty.
+  for (int i = 0; i < arg_count; ++i) {
+    // a. Remove the first element from args and let E be the value of the
+    //    element.
+    Handle<Object> element = args->at(i + 1);
+
+    // b. Perform ? Set(O, ! ToString(len), E, true).
+    if (length <= static_cast<double>(JSArray::kMaxArrayIndex)) {
+      RETURN_FAILURE_ON_EXCEPTION(
+          isolate, Object::SetElement(isolate, receiver, length, element,
+                                      LanguageMode::kStrict));
+    } else {
+      bool success;
+      LookupIterator it = LookupIterator::PropertyOrElement(
+          isolate, receiver, isolate->factory()->NewNumber(length), &success);
+      // Must succeed since we always pass a valid key.
+      DCHECK(success);
+      MAYBE_RETURN(Object::SetProperty(&it, element, LanguageMode::kStrict,
+                                       Object::MAY_BE_STORE_FROM_KEYED),
+                   ReadOnlyRoots(isolate).exception());
+    }
+
+    // c. Let len be len+1.
+    ++length;
+  }
+
+  // 7. Perform ? Set(O, "length", len, true).
+  Handle<Object> final_length = isolate->factory()->NewNumber(length);
+  RETURN_FAILURE_ON_EXCEPTION(
+      isolate,
+      Object::SetProperty(receiver, isolate->factory()->length_string(),
+                          final_length, LanguageMode::kStrict));
+
+  // 8. Return len.
+  return *final_length;
+}
 }  // namespace
 
 BUILTIN(ArrayPush) {
   HandleScope scope(isolate);
   Handle<Object> receiver = args.receiver();
   if (!EnsureJSArrayWithWritableFastElements(isolate, receiver, &args, 1)) {
-    return CallJsIntrinsic(isolate, isolate->array_push(), args);
+    return GenericArrayPush(isolate, &args);
   }
+
   // Fast Elements Path
   int to_add = args.length() - 1;
   Handle<JSArray> array = Handle<JSArray>::cast(receiver);
-  int len = Smi::ToInt(array->length());
-  if (to_add == 0) return Smi::FromInt(len);
+  uint32_t len = static_cast<uint32_t>(array->length()->Number());
+  if (to_add == 0) return *isolate->factory()->NewNumberFromUint(len);
 
   // Currently fixed arrays cannot grow too big, so we should never hit this.
   DCHECK_LE(to_add, Smi::kMaxValue - Smi::ToInt(array->length()));
 
   if (JSArray::HasReadOnlyLength(array)) {
-    return CallJsIntrinsic(isolate, isolate->array_push(), args);
+    return GenericArrayPush(isolate, &args);
   }
 
   ElementsAccessor* accessor = array->GetElementsAccessor();
-  int new_length = accessor->Push(array, &args, to_add);
-  return Smi::FromInt(new_length);
+  uint32_t new_length = accessor->Push(array, &args, to_add);
+  return *isolate->factory()->NewNumberFromUint((new_length));
+}
+
+namespace {
+
+V8_WARN_UNUSED_RESULT Object* GenericArrayPop(Isolate* isolate,
+                                              BuiltinArguments* args) {
+  // 1. Let O be ? ToObject(this value).
+  Handle<JSReceiver> receiver;
+  ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
+      isolate, receiver, Object::ToObject(isolate, args->receiver()));
+
+  // 2. Let len be ? ToLength(? Get(O, "length")).
+  Handle<Object> raw_length_number;
+  ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
+      isolate, raw_length_number,
+      Object::GetLengthFromArrayLike(isolate, receiver));
+  double length = raw_length_number->Number();
+
+  // 3. If len is zero, then.
+  if (length == 0) {
+    // a. Perform ? Set(O, "length", 0, true).
+    RETURN_FAILURE_ON_EXCEPTION(
+        isolate, Object::SetProperty(
+                     receiver, isolate->factory()->length_string(),
+                     Handle<Smi>(Smi::kZero, isolate), LanguageMode::kStrict));
+
+    // b. Return undefined.
+    return ReadOnlyRoots(isolate).undefined_value();
+  }
+
+  // 4. Else len > 0.
+  // a. Let new_len be len-1.
+  Handle<Object> new_length = isolate->factory()->NewNumber(length - 1);
+
+  // b. Let index be ! ToString(newLen).
+  Handle<String> index = isolate->factory()->NumberToString(new_length);
+
+  // c. Let element be ? Get(O, index).
+  Handle<Object> element;
+  ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
+      isolate, element, JSReceiver::GetPropertyOrElement(receiver, index));
+
+  // d. Perform ? DeletePropertyOrThrow(O, index).
+  MAYBE_RETURN(JSReceiver::DeletePropertyOrElement(receiver, index,
+                                                   LanguageMode::kStrict),
+               ReadOnlyRoots(isolate).exception());
+
+  // e. Perform ? Set(O, "length", newLen, true).
+  RETURN_FAILURE_ON_EXCEPTION(
+      isolate,
+      Object::SetProperty(receiver, isolate->factory()->length_string(),
+                          new_length, LanguageMode::kStrict));
+
+  // f. Return element.
+  return *element;
 }
 
+}  // namespace
+
 BUILTIN(ArrayPop) {
   HandleScope scope(isolate);
   Handle<Object> receiver = args.receiver();
   if (!EnsureJSArrayWithWritableFastElements(isolate, receiver, nullptr, 0)) {
-    return CallJsIntrinsic(isolate, isolate->array_pop(), args);
+    return GenericArrayPop(isolate, &args);
   }
-
   Handle<JSArray> array = Handle<JSArray>::cast(receiver);
 
-  uint32_t len = static_cast<uint32_t>(Smi::ToInt(array->length()));
-  if (len == 0) return isolate->heap()->undefined_value();
+  uint32_t len = static_cast<uint32_t>(array->length()->Number());
+  if (len == 0) return ReadOnlyRoots(isolate).undefined_value();
 
   if (JSArray::HasReadOnlyLength(array)) {
-    return CallJsIntrinsic(isolate, isolate->array_pop(), args);
+    return GenericArrayPop(isolate, &args);
   }
 
   Handle<Object> result;
@@ -193,6 +315,7 @@ BUILTIN(ArrayPop) {
         isolate, result, JSReceiver::GetElement(isolate, array, new_length));
     JSArray::SetLength(array, new_length);
   }
+
   return *result;
 }
 
@@ -207,7 +330,7 @@ BUILTIN(ArrayShift) {
   Handle<JSArray> array = Handle<JSArray>::cast(receiver);
 
   int len = Smi::ToInt(array->length());
-  if (len == 0) return heap->undefined_value();
+  if (len == 0) return ReadOnlyRoots(heap).undefined_value();
 
   if (JSArray::HasReadOnlyLength(array)) {
     return CallJsIntrinsic(isolate, isolate->array_shift(), args);
@@ -321,13 +444,12 @@ class ArrayConcatVisitor {
       : isolate_(isolate),
         storage_(isolate->global_handles()->Create(*storage)),
         index_offset_(0u),
-        bit_field_(
-            FastElementsField::encode(fast_elements) |
-            ExceedsLimitField::encode(false) |
-            IsFixedArrayField::encode(storage->IsFixedArray()) |
-            HasSimpleElementsField::encode(storage->IsFixedArray() ||
-                                           storage->map()->instance_type() >
-                                               LAST_CUSTOM_ELEMENTS_RECEIVER)) {
+        bit_field_(FastElementsField::encode(fast_elements) |
+                   ExceedsLimitField::encode(false) |
+                   IsFixedArrayField::encode(storage->IsFixedArray()) |
+                   HasSimpleElementsField::encode(
+                       storage->IsFixedArray() ||
+                       !storage->map()->IsCustomElementsReceiverMap())) {
     DCHECK(!(this->fast_elements() && !is_fixed_array()));
   }
 
@@ -364,7 +486,7 @@ class ArrayConcatVisitor {
       // Fall-through to dictionary mode.
     }
     DCHECK(!fast_elements());
-    Handle<NumberDictionary> dict(NumberDictionary::cast(*storage_));
+    Handle<NumberDictionary> dict(NumberDictionary::cast(*storage_), isolate_);
     // The object holding this backing store has just been allocated, so
     // it cannot yet be used as a prototype.
     Handle<JSObject> not_a_prototype_holder;
@@ -378,6 +500,8 @@ class ArrayConcatVisitor {
     return true;
   }
 
+  uint32_t index_offset() const { return index_offset_; }
+
   void increase_index_offset(uint32_t delta) {
     if (JSObject::kMaxElementCount - index_offset_ < delta) {
       index_offset_ = JSObject::kMaxElementCount;
@@ -489,7 +613,7 @@ class ArrayConcatVisitor {
   uint32_t bit_field_;
 };
 
-uint32_t EstimateElementCount(Handle<JSArray> array) {
+uint32_t EstimateElementCount(Isolate* isolate, Handle<JSArray> array) {
   DisallowHeapAllocation no_gc;
   uint32_t length = static_cast<uint32_t>(array->length()->Number());
   int element_count = 0;
@@ -502,7 +626,6 @@ uint32_t EstimateElementCount(Handle<JSArray> array) {
       // a 32-bit signed integer.
       DCHECK_GE(static_cast<int32_t>(FixedArray::kMaxLength), 0);
       int fast_length = static_cast<int>(length);
-      Isolate* isolate = array->GetIsolate();
       FixedArray* elements = FixedArray::cast(array->elements());
       for (int i = 0; i < fast_length; i++) {
         if (!elements->get(i)->IsTheHole(isolate)) element_count++;
@@ -527,7 +650,6 @@ uint32_t EstimateElementCount(Handle<JSArray> array) {
     }
     case DICTIONARY_ELEMENTS: {
       NumberDictionary* dictionary = NumberDictionary::cast(array->elements());
-      Isolate* isolate = dictionary->GetIsolate();
       int capacity = dictionary->Capacity();
       for (int i = 0; i < capacity; i++) {
         Object* key = dictionary->KeyAt(i);
@@ -556,9 +678,8 @@ uint32_t EstimateElementCount(Handle<JSArray> array) {
   return element_count;
 }
 
-void CollectElementIndices(Handle<JSObject> object, uint32_t range,
-                           std::vector<uint32_t>* indices) {
-  Isolate* isolate = object->GetIsolate();
+void CollectElementIndices(Isolate* isolate, Handle<JSObject> object,
+                           uint32_t range, std::vector<uint32_t>* indices) {
   ElementsKind kind = object->GetElementsKind();
   switch (kind) {
     case PACKED_SMI_ELEMENTS:
@@ -583,7 +704,7 @@ void CollectElementIndices(Handle<JSObject> object, uint32_t range,
         break;
       }
       Handle<FixedDoubleArray> elements(
-          FixedDoubleArray::cast(object->elements()));
+          FixedDoubleArray::cast(object->elements()), isolate);
       uint32_t length = static_cast<uint32_t>(elements->length());
       if (range < length) length = range;
       for (uint32_t i = 0; i < length; i++) {
@@ -668,8 +789,8 @@ void CollectElementIndices(Handle<JSObject> object, uint32_t range,
   if (!iter.IsAtEnd()) {
     // The prototype will usually have no inherited element indices,
     // but we have to check.
-    CollectElementIndices(PrototypeIterator::GetCurrent<JSObject>(iter), range,
-                          indices);
+    CollectElementIndices(
+        isolate, PrototypeIterator::GetCurrent<JSObject>(iter), range, indices);
   }
 }
 
@@ -710,6 +831,11 @@ bool IterateElements(Isolate* isolate, Handle<JSReceiver> receiver,
     Handle<Object> val;
     ASSIGN_RETURN_ON_EXCEPTION_VALUE(
         isolate, val, Object::GetLengthFromArrayLike(isolate, receiver), false);
+    if (visitor->index_offset() + val->Number() > kMaxSafeInteger) {
+      isolate->Throw(*isolate->factory()->NewTypeError(
+          MessageTemplate::kInvalidArrayLength));
+      return false;
+    }
     // TODO(caitp): Support larger element indexes (up to 2^53-1).
     if (!val->ToUint32(&length)) {
       length = 0;
@@ -731,7 +857,7 @@ bool IterateElements(Isolate* isolate, Handle<JSReceiver> receiver,
     case HOLEY_ELEMENTS: {
       // Run through the elements FixedArray and use HasElement and GetElement
       // to check the prototype for missing elements.
-      Handle<FixedArray> elements(FixedArray::cast(array->elements()));
+      Handle<FixedArray> elements(FixedArray::cast(array->elements()), isolate);
       int fast_length = static_cast<int>(length);
       DCHECK(fast_length <= elements->length());
       FOR_WITH_HANDLE_SCOPE(isolate, int, j = 0, j, j < fast_length, j++, {
@@ -764,7 +890,7 @@ bool IterateElements(Isolate* isolate, Handle<JSReceiver> receiver,
         break;
       }
       Handle<FixedDoubleArray> elements(
-          FixedDoubleArray::cast(array->elements()));
+          FixedDoubleArray::cast(array->elements()), isolate);
       int fast_length = static_cast<int>(length);
       DCHECK(fast_length <= elements->length());
       FOR_WITH_HANDLE_SCOPE(isolate, int, j = 0, j, j < fast_length, j++, {
@@ -791,13 +917,13 @@ bool IterateElements(Isolate* isolate, Handle<JSReceiver> receiver,
     }
 
     case DICTIONARY_ELEMENTS: {
-      Handle<NumberDictionary> dict(array->element_dictionary());
+      Handle<NumberDictionary> dict(array->element_dictionary(), isolate);
       std::vector<uint32_t> indices;
       indices.reserve(dict->Capacity() / 2);
 
       // Collect all indices in the object and the prototypes less
       // than length. This might introduce duplicates in the indices list.
-      CollectElementIndices(array, length, &indices);
+      CollectElementIndices(isolate, array, length, &indices);
       std::sort(indices.begin(), indices.end());
       size_t n = indices.size();
       FOR_WITH_HANDLE_SCOPE(isolate, size_t, j = 0, j, j < n, (void)0, {
@@ -852,7 +978,7 @@ static Maybe<bool> IsConcatSpreadable(Isolate* isolate, Handle<Object> obj) {
     MaybeHandle<Object> maybeValue =
         i::Runtime::GetObjectProperty(isolate, obj, key);
     if (!maybeValue.ToHandle(&value)) return Nothing<bool>();
-    if (!value->IsUndefined(isolate)) return Just(value->BooleanValue());
+    if (!value->IsUndefined(isolate)) return Just(value->BooleanValue(isolate));
   }
   return Object::IsArray(obj);
 }
@@ -884,7 +1010,7 @@ Object* Slow_ArrayConcat(BuiltinArguments* args, Handle<Object> species,
             GetPackedElementsKind(array->GetElementsKind());
         kind = GetMoreGeneralElementsKind(kind, array_kind);
       }
-      element_estimate = EstimateElementCount(array);
+      element_estimate = EstimateElementCount(isolate, array);
     } else {
       if (obj->IsHeapObject()) {
         kind = GetMoreGeneralElementsKind(
@@ -958,7 +1084,7 @@ Object* Slow_ArrayConcat(BuiltinArguments* args, Handle<Object> species,
             }
             case HOLEY_SMI_ELEMENTS:
             case PACKED_SMI_ELEMENTS: {
-              Object* the_hole = isolate->heap()->the_hole_value();
+              Object* the_hole = ReadOnlyRoots(isolate).the_hole_value();
               FixedArray* elements(FixedArray::cast(array->elements()));
               for (uint32_t i = 0; i < length; i++) {
                 Object* element = elements->get(i);
@@ -1014,14 +1140,14 @@ Object* Slow_ArrayConcat(BuiltinArguments* args, Handle<Object> species,
   for (int i = 0; i < argument_count; i++) {
     Handle<Object> obj((*args)[i], isolate);
     Maybe<bool> spreadable = IsConcatSpreadable(isolate, obj);
-    MAYBE_RETURN(spreadable, isolate->heap()->exception());
+    MAYBE_RETURN(spreadable, ReadOnlyRoots(isolate).exception());
     if (spreadable.FromJust()) {
       Handle<JSReceiver> object = Handle<JSReceiver>::cast(obj);
       if (!IterateElements(isolate, object, &visitor)) {
-        return isolate->heap()->exception();
+        return ReadOnlyRoots(isolate).exception();
       }
     } else {
-      if (!visitor.visit(0, obj)) return isolate->heap()->exception();
+      if (!visitor.visit(0, obj)) return ReadOnlyRoots(isolate).exception();
       visitor.increase_index_offset(1);
     }
   }
@@ -1121,7 +1247,8 @@ BUILTIN(ArrayConcat) {
     if (Fast_ArrayConcat(isolate, &args).ToHandle(&result_array)) {
       return *result_array;
     }
-    if (isolate->has_pending_exception()) return isolate->heap()->exception();
+    if (isolate->has_pending_exception())
+      return ReadOnlyRoots(isolate).exception();
   }
   // Reading @@species happens before anything else with a side effect, so
   // we can do it here to determine whether to take the fast path.
@@ -1132,7 +1259,8 @@ BUILTIN(ArrayConcat) {
     if (Fast_ArrayConcat(isolate, &args).ToHandle(&result_array)) {
       return *result_array;
     }
-    if (isolate->has_pending_exception()) return isolate->heap()->exception();
+    if (isolate->has_pending_exception())
+      return ReadOnlyRoots(isolate).exception();
   }
   return Slow_ArrayConcat(&args, species, isolate);
 }
diff --git a/deps/v8/src/builtins/builtins-arraybuffer.cc b/deps/v8/src/builtins/builtins-arraybuffer.cc
index 9c77a0047d77ec..92b003a4e28e48 100644
--- a/deps/v8/src/builtins/builtins-arraybuffer.cc
+++ b/deps/v8/src/builtins/builtins-arraybuffer.cc
@@ -82,7 +82,8 @@ BUILTIN(ArrayBufferConstructor) {
 // all cases, or we will expose uinitialized memory to user code.
 BUILTIN(ArrayBufferConstructor_DoNotInitialize) {
   HandleScope scope(isolate);
-  Handle<JSFunction> target(isolate->native_context()->array_buffer_fun());
+  Handle<JSFunction> target(isolate->native_context()->array_buffer_fun(),
+                            isolate);
   Handle<Object> length = args.atOrUndefined(isolate, 1);
   return ConstructBuffer(isolate, target, target, length, false);
 }
diff --git a/deps/v8/src/builtins/builtins-async-function-gen.cc b/deps/v8/src/builtins/builtins-async-function-gen.cc
index 0d0e34ee0da93a..7fbfbdd4940ca4 100644
--- a/deps/v8/src/builtins/builtins-async-function-gen.cc
+++ b/deps/v8/src/builtins/builtins-async-function-gen.cc
@@ -20,6 +20,10 @@ class AsyncFunctionBuiltinsAssembler : public AsyncBuiltinsAssembler {
   void AsyncFunctionAwait(Node* const context, Node* const generator,
                           Node* const awaited, Node* const outer_promise,
                           const bool is_predicted_as_caught);
+  void AsyncFunctionAwaitOptimized(Node* const context, Node* const generator,
+                                   Node* const awaited,
+                                   Node* const outer_promise,
+                                   const bool is_predicted_as_caught);
 
   void AsyncFunctionAwaitResumeClosure(
       Node* const context, Node* const sent_value,
@@ -55,9 +59,9 @@ void AsyncFunctionBuiltinsAssembler::AsyncFunctionAwaitResumeClosure(
   // Ensure that the generator is neither closed nor running.
   CSA_SLOW_ASSERT(
       this,
-      SmiGreaterThan(
-          LoadObjectField(generator, JSGeneratorObject::kContinuationOffset),
-          SmiConstant(JSGeneratorObject::kGeneratorClosed)));
+      SmiGreaterThan(CAST(LoadObjectField(
+                         generator, JSGeneratorObject::kContinuationOffset)),
+                     SmiConstant(JSGeneratorObject::kGeneratorClosed)));
 
   // Remember the {resume_mode} for the {generator}.
   StoreObjectFieldNoWriteBarrier(generator,
@@ -120,6 +124,11 @@ void AsyncFunctionBuiltinsAssembler::AsyncFunctionAwait(
   // TODO(jgruber): Use a faster specialized version of
   // InternalPerformPromiseThen.
 
+  Label after_debug_hook(this), call_debug_hook(this, Label::kDeferred);
+  GotoIf(HasAsyncEventDelegate(), &call_debug_hook);
+  Goto(&after_debug_hook);
+  BIND(&after_debug_hook);
+
   Await(context, generator, awaited, outer_promise, AwaitContext::kLength,
         init_closure_context, Context::ASYNC_FUNCTION_AWAIT_RESOLVE_SHARED_FUN,
         Context::ASYNC_FUNCTION_AWAIT_REJECT_SHARED_FUN,
@@ -128,6 +137,47 @@ void AsyncFunctionBuiltinsAssembler::AsyncFunctionAwait(
   // Return outer promise to avoid adding an load of the outer promise before
   // suspending in BytecodeGenerator.
   Return(outer_promise);
+
+  BIND(&call_debug_hook);
+  CallRuntime(Runtime::kDebugAsyncFunctionSuspended, context, outer_promise);
+  Goto(&after_debug_hook);
+}
+
+void AsyncFunctionBuiltinsAssembler::AsyncFunctionAwaitOptimized(
+    Node* const context, Node* const generator, Node* const awaited,
+    Node* const outer_promise, const bool is_predicted_as_caught) {
+  CSA_SLOW_ASSERT(this, HasInstanceType(generator, JS_GENERATOR_OBJECT_TYPE));
+  CSA_SLOW_ASSERT(this, HasInstanceType(outer_promise, JS_PROMISE_TYPE));
+
+  ContextInitializer init_closure_context = [&](Node* context) {
+    StoreContextElementNoWriteBarrier(context, AwaitContext::kGeneratorSlot,
+                                      generator);
+  };
+
+  // TODO(jgruber): AsyncBuiltinsAssembler::Await currently does not reuse
+  // the awaited promise if it is already a promise. Reuse is non-spec compliant
+  // but part of our old behavior gives us a couple of percent
+  // performance boost.
+  // TODO(jgruber): Use a faster specialized version of
+  // InternalPerformPromiseThen.
+
+  Label after_debug_hook(this), call_debug_hook(this, Label::kDeferred);
+  GotoIf(HasAsyncEventDelegate(), &call_debug_hook);
+  Goto(&after_debug_hook);
+  BIND(&after_debug_hook);
+
+  AwaitOptimized(
+      context, generator, awaited, outer_promise, AwaitContext::kLength,
+      init_closure_context, Context::ASYNC_FUNCTION_AWAIT_RESOLVE_SHARED_FUN,
+      Context::ASYNC_FUNCTION_AWAIT_REJECT_SHARED_FUN, is_predicted_as_caught);
+
+  // Return outer promise to avoid adding an load of the outer promise before
+  // suspending in BytecodeGenerator.
+  Return(outer_promise);
+
+  BIND(&call_debug_hook);
+  CallRuntime(Runtime::kDebugAsyncFunctionSuspended, context, outer_promise);
+  Goto(&after_debug_hook);
 }
 
 // Called by the parser from the desugaring of 'await' when catch
@@ -145,6 +195,19 @@ TF_BUILTIN(AsyncFunctionAwaitCaught, AsyncFunctionBuiltinsAssembler) {
                      kIsPredictedAsCaught);
 }
 
+TF_BUILTIN(AsyncFunctionAwaitCaughtOptimized, AsyncFunctionBuiltinsAssembler) {
+  CSA_ASSERT_JS_ARGC_EQ(this, 3);
+  Node* const generator = Parameter(Descriptor::kGenerator);
+  Node* const awaited = Parameter(Descriptor::kAwaited);
+  Node* const outer_promise = Parameter(Descriptor::kOuterPromise);
+  Node* const context = Parameter(Descriptor::kContext);
+
+  static const bool kIsPredictedAsCaught = true;
+
+  AsyncFunctionAwaitOptimized(context, generator, awaited, outer_promise,
+                              kIsPredictedAsCaught);
+}
+
 // Called by the parser from the desugaring of 'await' when catch
 // prediction indicates no locally surrounding catch block.
 TF_BUILTIN(AsyncFunctionAwaitUncaught, AsyncFunctionBuiltinsAssembler) {
@@ -160,6 +223,20 @@ TF_BUILTIN(AsyncFunctionAwaitUncaught, AsyncFunctionBuiltinsAssembler) {
                      kIsPredictedAsCaught);
 }
 
+TF_BUILTIN(AsyncFunctionAwaitUncaughtOptimized,
+           AsyncFunctionBuiltinsAssembler) {
+  CSA_ASSERT_JS_ARGC_EQ(this, 3);
+  Node* const generator = Parameter(Descriptor::kGenerator);
+  Node* const awaited = Parameter(Descriptor::kAwaited);
+  Node* const outer_promise = Parameter(Descriptor::kOuterPromise);
+  Node* const context = Parameter(Descriptor::kContext);
+
+  static const bool kIsPredictedAsCaught = false;
+
+  AsyncFunctionAwaitOptimized(context, generator, awaited, outer_promise,
+                              kIsPredictedAsCaught);
+}
+
 TF_BUILTIN(AsyncFunctionPromiseCreate, AsyncFunctionBuiltinsAssembler) {
   CSA_ASSERT_JS_ARGC_EQ(this, 0);
   Node* const context = Parameter(Descriptor::kContext);
@@ -177,29 +254,29 @@ TF_BUILTIN(AsyncFunctionPromiseCreate, AsyncFunctionBuiltinsAssembler) {
     // Push the Promise under construction in an async function on
     // the catch prediction stack to handle exceptions thrown before
     // the first await.
-    // Assign ID and create a recurring task to save stack for future
-    // resumptions from await.
-    CallRuntime(Runtime::kDebugAsyncFunctionPromiseCreated, context, promise);
+    CallRuntime(Runtime::kDebugPushPromise, context, promise);
     Return(promise);
   }
 }
 
 TF_BUILTIN(AsyncFunctionPromiseRelease, AsyncFunctionBuiltinsAssembler) {
-  CSA_ASSERT_JS_ARGC_EQ(this, 1);
+  CSA_ASSERT_JS_ARGC_EQ(this, 2);
   Node* const promise = Parameter(Descriptor::kPromise);
   Node* const context = Parameter(Descriptor::kContext);
 
-  Label if_is_debug_active(this, Label::kDeferred);
-  GotoIf(IsDebugActive(), &if_is_debug_active);
+  Label call_debug_instrumentation(this, Label::kDeferred);
+  GotoIf(HasAsyncEventDelegate(), &call_debug_instrumentation);
+  GotoIf(IsDebugActive(), &call_debug_instrumentation);
 
   // Early exit if debug is not active.
   Return(UndefinedConstant());
 
-  BIND(&if_is_debug_active);
+  BIND(&call_debug_instrumentation);
   {
     // Pop the Promise under construction in an async function on
     // from catch prediction stack.
-    CallRuntime(Runtime::kDebugPopPromise, context);
+    CallRuntime(Runtime::kDebugAsyncFunctionFinished, context,
+                Parameter(Descriptor::kCanSuspend), promise);
     Return(promise);
   }
 }
diff --git a/deps/v8/src/builtins/builtins-async-gen.cc b/deps/v8/src/builtins/builtins-async-gen.cc
index ba0226d7b3a42a..c7e3c5cdeb643a 100644
--- a/deps/v8/src/builtins/builtins-async-gen.cc
+++ b/deps/v8/src/builtins/builtins-async-gen.cc
@@ -6,6 +6,7 @@
 
 #include "src/builtins/builtins-utils-gen.h"
 #include "src/heap/factory-inl.h"
+#include "src/objects/js-promise.h"
 #include "src/objects/shared-function-info.h"
 
 namespace v8 {
@@ -97,10 +98,9 @@ Node* AsyncBuiltinsAssembler::Await(
   {
     // Add PromiseHooks if needed
     Label next(this);
-    GotoIfNot(IsPromiseHookEnabledOrDebugIsActive(), &next);
-    CallRuntime(Runtime::kPromiseHookInit, context, wrapped_value,
-                outer_promise);
-    CallRuntime(Runtime::kPromiseHookInit, context, throwaway, wrapped_value);
+    GotoIfNot(IsPromiseHookEnabledOrHasAsyncEventDelegate(), &next);
+    CallRuntime(Runtime::kAwaitPromisesInit, context, wrapped_value,
+                outer_promise, throwaway);
     Goto(&next);
     BIND(&next);
   }
@@ -147,6 +147,120 @@ Node* AsyncBuiltinsAssembler::Await(
                      on_resolve, on_reject, throwaway);
 }
 
+Node* AsyncBuiltinsAssembler::AwaitOptimized(
+    Node* context, Node* generator, Node* value, Node* outer_promise,
+    int context_length, const ContextInitializer& init_closure_context,
+    Node* on_resolve_context_index, Node* on_reject_context_index,
+    Node* is_predicted_as_caught) {
+  DCHECK_GE(context_length, Context::MIN_CONTEXT_SLOTS);
+
+  Node* const native_context = LoadNativeContext(context);
+  Node* const promise_fun =
+      LoadContextElement(native_context, Context::PROMISE_FUNCTION_INDEX);
+  CSA_ASSERT(this, IsFunctionWithPrototypeSlotMap(LoadMap(promise_fun)));
+  CSA_ASSERT(this, IsConstructor(promise_fun));
+
+  static const int kThrowawayPromiseOffset =
+      FixedArray::SizeFor(context_length);
+  static const int kResolveClosureOffset =
+      kThrowawayPromiseOffset + JSPromise::kSizeWithEmbedderFields;
+  static const int kRejectClosureOffset =
+      kResolveClosureOffset + JSFunction::kSizeWithoutPrototype;
+  static const int kTotalSize =
+      kRejectClosureOffset + JSFunction::kSizeWithoutPrototype;
+
+  // 2. Let promise be ? PromiseResolve(« promise »).
+  Node* const promise =
+      CallBuiltin(Builtins::kPromiseResolve, context, promise_fun, value);
+
+  Node* const base = AllocateInNewSpace(kTotalSize);
+  Node* const closure_context = base;
+  {
+    // Initialize closure context
+    InitializeFunctionContext(native_context, closure_context, context_length);
+    init_closure_context(closure_context);
+  }
+
+  Node* const promise_map =
+      LoadObjectField(promise_fun, JSFunction::kPrototypeOrInitialMapOffset);
+  // Assert that the JSPromise map has an instance size is
+  // JSPromise::kSizeWithEmbedderFields.
+  CSA_ASSERT(this, WordEqual(LoadMapInstanceSizeInWords(promise_map),
+                             IntPtrConstant(JSPromise::kSizeWithEmbedderFields /
+                                            kPointerSize)));
+  Node* const throwaway = InnerAllocate(base, kThrowawayPromiseOffset);
+  {
+    // Initialize throwawayPromise
+    StoreMapNoWriteBarrier(throwaway, promise_map);
+    InitializeJSObjectFromMap(
+        throwaway, promise_map,
+        IntPtrConstant(JSPromise::kSizeWithEmbedderFields));
+    PromiseInit(throwaway);
+  }
+
+  Node* const on_resolve = InnerAllocate(base, kResolveClosureOffset);
+  {
+    // Initialize resolve handler
+    InitializeNativeClosure(closure_context, native_context, on_resolve,
+                            on_resolve_context_index);
+  }
+
+  Node* const on_reject = InnerAllocate(base, kRejectClosureOffset);
+  {
+    // Initialize reject handler
+    InitializeNativeClosure(closure_context, native_context, on_reject,
+                            on_reject_context_index);
+  }
+
+  {
+    // Add PromiseHooks if needed
+    Label next(this);
+    GotoIfNot(IsPromiseHookEnabledOrHasAsyncEventDelegate(), &next);
+    CallRuntime(Runtime::kAwaitPromisesInit, context, promise, outer_promise,
+                throwaway);
+    Goto(&next);
+    BIND(&next);
+  }
+
+  // The Promise will be thrown away and not handled, but it shouldn't trigger
+  // unhandled reject events as its work is done
+  PromiseSetHasHandler(throwaway);
+
+  Label do_perform_promise_then(this);
+  GotoIfNot(IsDebugActive(), &do_perform_promise_then);
+  {
+    Label common(this);
+    GotoIf(TaggedIsSmi(value), &common);
+    GotoIfNot(HasInstanceType(value, JS_PROMISE_TYPE), &common);
+    {
+      // Mark the reject handler callback to be a forwarding edge, rather
+      // than a meaningful catch handler
+      Node* const key =
+          HeapConstant(factory()->promise_forwarding_handler_symbol());
+      CallRuntime(Runtime::kSetProperty, context, on_reject, key,
+                  TrueConstant(), SmiConstant(LanguageMode::kStrict));
+
+      GotoIf(IsFalse(is_predicted_as_caught), &common);
+      PromiseSetHandledHint(value);
+    }
+
+    Goto(&common);
+    BIND(&common);
+    // Mark the dependency to outer Promise in case the throwaway Promise is
+    // found on the Promise stack
+    CSA_SLOW_ASSERT(this, HasInstanceType(outer_promise, JS_PROMISE_TYPE));
+
+    Node* const key = HeapConstant(factory()->promise_handled_by_symbol());
+    CallRuntime(Runtime::kSetProperty, context, throwaway, key, outer_promise,
+                SmiConstant(LanguageMode::kStrict));
+  }
+
+  Goto(&do_perform_promise_then);
+  BIND(&do_perform_promise_then);
+  return CallBuiltin(Builtins::kPerformPromiseThen, native_context, promise,
+                     on_resolve, on_reject, throwaway);
+}
+
 void AsyncBuiltinsAssembler::InitializeNativeClosure(Node* context,
                                                      Node* native_context,
                                                      Node* function,
diff --git a/deps/v8/src/builtins/builtins-async-gen.h b/deps/v8/src/builtins/builtins-async-gen.h
index 45d7c8689a902a..e5f487d8cc37ed 100644
--- a/deps/v8/src/builtins/builtins-async-gen.h
+++ b/deps/v8/src/builtins/builtins-async-gen.h
@@ -28,6 +28,12 @@ class AsyncBuiltinsAssembler : public PromiseBuiltinsAssembler {
               const ContextInitializer& init_closure_context,
               Node* on_resolve_context_index, Node* on_reject_context_index,
               Node* is_predicted_as_caught);
+  Node* AwaitOptimized(Node* context, Node* generator, Node* value,
+                       Node* outer_promise, int context_length,
+                       const ContextInitializer& init_closure_context,
+                       Node* on_resolve_context_index,
+                       Node* on_reject_context_index,
+                       Node* is_predicted_as_caught);
   Node* Await(Node* context, Node* generator, Node* value, Node* outer_promise,
               int context_length,
               const ContextInitializer& init_closure_context,
@@ -38,6 +44,17 @@ class AsyncBuiltinsAssembler : public PromiseBuiltinsAssembler {
                  IntPtrConstant(on_reject_context_index),
                  is_predicted_as_caught);
   }
+  Node* AwaitOptimized(Node* context, Node* generator, Node* value,
+                       Node* outer_promise, int context_length,
+                       const ContextInitializer& init_closure_context,
+                       int on_resolve_context_index,
+                       int on_reject_context_index,
+                       Node* is_predicted_as_caught) {
+    return AwaitOptimized(
+        context, generator, value, outer_promise, context_length,
+        init_closure_context, IntPtrConstant(on_resolve_context_index),
+        IntPtrConstant(on_reject_context_index), is_predicted_as_caught);
+  }
   Node* Await(Node* context, Node* generator, Node* value, Node* outer_promise,
               int context_length,
               const ContextInitializer& init_closure_context,
@@ -48,6 +65,17 @@ class AsyncBuiltinsAssembler : public PromiseBuiltinsAssembler {
                  on_reject_context_index,
                  BooleanConstant(is_predicted_as_caught));
   }
+  Node* AwaitOptimized(Node* context, Node* generator, Node* value,
+                       Node* outer_promise, int context_length,
+                       const ContextInitializer& init_closure_context,
+                       int on_resolve_context_index,
+                       int on_reject_context_index,
+                       bool is_predicted_as_caught) {
+    return AwaitOptimized(context, generator, value, outer_promise,
+                          context_length, init_closure_context,
+                          on_resolve_context_index, on_reject_context_index,
+                          BooleanConstant(is_predicted_as_caught));
+  }
 
   // Return a new built-in function object as defined in
   // Async Iterator Value Unwrap Functions
diff --git a/deps/v8/src/builtins/builtins-async-generator-gen.cc b/deps/v8/src/builtins/builtins-async-generator-gen.cc
index dd6c644196451f..251ff1ee400408 100644
--- a/deps/v8/src/builtins/builtins-async-generator-gen.cc
+++ b/deps/v8/src/builtins/builtins-async-generator-gen.cc
@@ -41,37 +41,39 @@ class AsyncGeneratorBuiltinsAssembler : public AsyncBuiltinsAssembler {
     return LoadObjectField(generator, JSGeneratorObject::kContinuationOffset);
   }
 
-  inline Node* IsGeneratorStateClosed(Node* const state) {
+  inline TNode<BoolT> IsGeneratorStateClosed(SloppyTNode<Smi> const state) {
     return SmiEqual(state, SmiConstant(JSGeneratorObject::kGeneratorClosed));
   }
-  inline Node* IsGeneratorClosed(Node* const generator) {
+  inline TNode<BoolT> IsGeneratorClosed(Node* const generator) {
     return IsGeneratorStateClosed(LoadGeneratorState(generator));
   }
 
-  inline Node* IsGeneratorStateSuspended(Node* const state) {
+  inline TNode<BoolT> IsGeneratorStateSuspended(SloppyTNode<Smi> const state) {
     return SmiGreaterThanOrEqual(state, SmiConstant(0));
   }
 
-  inline Node* IsGeneratorSuspended(Node* const generator) {
+  inline TNode<BoolT> IsGeneratorSuspended(Node* const generator) {
     return IsGeneratorStateSuspended(LoadGeneratorState(generator));
   }
 
-  inline Node* IsGeneratorStateSuspendedAtStart(Node* const state) {
+  inline TNode<BoolT> IsGeneratorStateSuspendedAtStart(
+      SloppyTNode<Smi> const state) {
     return SmiEqual(state, SmiConstant(0));
   }
 
-  inline Node* IsGeneratorStateNotExecuting(Node* const state) {
+  inline TNode<BoolT> IsGeneratorStateNotExecuting(
+      SloppyTNode<Smi> const state) {
     return SmiNotEqual(state,
                        SmiConstant(JSGeneratorObject::kGeneratorExecuting));
   }
-  inline Node* IsGeneratorNotExecuting(Node* const generator) {
+  inline TNode<BoolT> IsGeneratorNotExecuting(Node* const generator) {
     return IsGeneratorStateNotExecuting(LoadGeneratorState(generator));
   }
 
-  inline Node* IsGeneratorAwaiting(Node* const generator) {
-    Node* is_generator_awaiting =
+  inline TNode<BoolT> IsGeneratorAwaiting(Node* const generator) {
+    TNode<Object> is_generator_awaiting =
         LoadObjectField(generator, JSAsyncGeneratorObject::kIsAwaitingOffset);
-    return SmiEqual(is_generator_awaiting, SmiConstant(1));
+    return WordEqual(is_generator_awaiting, SmiConstant(1));
   }
 
   inline void SetGeneratorAwaiting(Node* const generator) {
@@ -118,7 +120,7 @@ class AsyncGeneratorBuiltinsAssembler : public AsyncBuiltinsAssembler {
     return LoadObjectField(request, AsyncGeneratorRequest::kValueOffset);
   }
 
-  inline Node* IsAbruptResumeType(Node* const resume_type) {
+  inline TNode<BoolT> IsAbruptResumeType(SloppyTNode<Smi> const resume_type) {
     return SmiNotEqual(resume_type, SmiConstant(JSGeneratorObject::kNext));
   }
 
@@ -174,7 +176,7 @@ void AsyncGeneratorBuiltinsAssembler::AsyncGeneratorEnqueue(
     // If state is not "executing", then
     //     Perform AsyncGeneratorResumeNext(Generator)
     // Check if the {receiver} is running or already closed.
-    Node* continuation = LoadGeneratorState(generator);
+    TNode<Smi> continuation = CAST(LoadGeneratorState(generator));
 
     GotoIf(SmiEqual(continuation,
                     SmiConstant(JSAsyncGeneratorObject::kGeneratorExecuting)),
@@ -327,12 +329,12 @@ TF_BUILTIN(AsyncGeneratorPrototypeNext, AsyncGeneratorBuiltinsAssembler) {
   const int kValueArg = 0;
 
   Node* argc =
-      ChangeInt32ToIntPtr(Parameter(BuiltinDescriptor::kArgumentsCount));
+      ChangeInt32ToIntPtr(Parameter(Descriptor::kJSActualArgumentsCount));
   CodeStubArguments args(this, argc);
 
   Node* generator = args.GetReceiver();
   Node* value = args.GetOptionalArgumentValue(kValueArg);
-  Node* context = Parameter(BuiltinDescriptor::kContext);
+  Node* context = Parameter(Descriptor::kContext);
 
   AsyncGeneratorEnqueue(&args, context, generator, value,
                         JSAsyncGeneratorObject::kNext,
@@ -345,12 +347,12 @@ TF_BUILTIN(AsyncGeneratorPrototypeReturn, AsyncGeneratorBuiltinsAssembler) {
   const int kValueArg = 0;
 
   Node* argc =
-      ChangeInt32ToIntPtr(Parameter(BuiltinDescriptor::kArgumentsCount));
+      ChangeInt32ToIntPtr(Parameter(Descriptor::kJSActualArgumentsCount));
   CodeStubArguments args(this, argc);
 
   Node* generator = args.GetReceiver();
   Node* value = args.GetOptionalArgumentValue(kValueArg);
-  Node* context = Parameter(BuiltinDescriptor::kContext);
+  Node* context = Parameter(Descriptor::kContext);
 
   AsyncGeneratorEnqueue(&args, context, generator, value,
                         JSAsyncGeneratorObject::kReturn,
@@ -363,12 +365,12 @@ TF_BUILTIN(AsyncGeneratorPrototypeThrow, AsyncGeneratorBuiltinsAssembler) {
   const int kValueArg = 0;
 
   Node* argc =
-      ChangeInt32ToIntPtr(Parameter(BuiltinDescriptor::kArgumentsCount));
+      ChangeInt32ToIntPtr(Parameter(Descriptor::kJSActualArgumentsCount));
   CodeStubArguments args(this, argc);
 
   Node* generator = args.GetReceiver();
   Node* value = args.GetOptionalArgumentValue(kValueArg);
-  Node* context = Parameter(BuiltinDescriptor::kContext);
+  Node* context = Parameter(Descriptor::kContext);
 
   AsyncGeneratorEnqueue(&args, context, generator, value,
                         JSAsyncGeneratorObject::kThrow,
@@ -430,7 +432,8 @@ TF_BUILTIN(AsyncGeneratorResumeNext, AsyncGeneratorBuiltinsAssembler) {
   ReturnIf(IsUndefined(var_next.value()), UndefinedConstant());
 
   Node* const next = var_next.value();
-  Node* const resume_type = LoadResumeTypeFromAsyncGeneratorRequest(next);
+  TNode<Smi> const resume_type =
+      CAST(LoadResumeTypeFromAsyncGeneratorRequest(next));
 
   Label if_abrupt(this), if_normal(this), resume_generator(this);
   Branch(IsAbruptResumeType(resume_type), &if_abrupt, &if_normal);
@@ -524,11 +527,38 @@ TF_BUILTIN(AsyncGeneratorResolve, AsyncGeneratorBuiltinsAssembler) {
                                    done);
   }
 
-  // Perform Call(promiseCapability.[[Resolve]], undefined, «iteratorResult»).
-  CallBuiltin(Builtins::kResolvePromise, context, promise, iter_result);
+  // We know that {iter_result} itself doesn't have any "then" property (a
+  // freshly allocated IterResultObject only has "value" and "done" properties)
+  // and we also know that the [[Prototype]] of {iter_result} is the intrinsic
+  // %ObjectPrototype%. So we can skip the [[Resolve]] logic here completely
+  // and directly call into the FulfillPromise operation if we can prove
+  // that the %ObjectPrototype% also doesn't have any "then" property. This
+  // is guarded by the Promise#then() protector.
+  // If the PromiseHooks are enabled, we cannot take the shortcut here, since
+  // the "promiseResolve" hook would not be fired otherwise.
+  Label if_fast(this), if_slow(this, Label::kDeferred), return_promise(this);
+  GotoIfForceSlowPath(&if_slow);
+  GotoIf(IsPromiseHookEnabled(), &if_slow);
+  Branch(IsPromiseThenProtectorCellInvalid(), &if_slow, &if_fast);
+
+  BIND(&if_fast);
+  {
+    // Skip the "then" on {iter_result} and directly fulfill the {promise}
+    // with the {iter_result}.
+    CallBuiltin(Builtins::kFulfillPromise, context, promise, iter_result);
+    Goto(&return_promise);
+  }
+
+  BIND(&if_slow);
+  {
+    // Perform Call(promiseCapability.[[Resolve]], undefined, «iteratorResult»).
+    CallBuiltin(Builtins::kResolvePromise, context, promise, iter_result);
+    Goto(&return_promise);
+  }
 
   // Per spec, AsyncGeneratorResolve() returns undefined. However, for the
   // benefit of %TraceExit(), return the Promise.
+  BIND(&return_promise);
   Return(promise);
 }
 
diff --git a/deps/v8/src/builtins/builtins-async-iterator-gen.cc b/deps/v8/src/builtins/builtins-async-iterator-gen.cc
index 58691bd00e62ed..82db5fbd5da07c 100644
--- a/deps/v8/src/builtins/builtins-async-iterator-gen.cc
+++ b/deps/v8/src/builtins/builtins-async-iterator-gen.cc
@@ -36,6 +36,13 @@ class AsyncFromSyncBuiltinsAssembler : public AsyncBuiltinsAssembler {
       const char* operation_name,
       Label::Type reject_label_type = Label::kDeferred,
       Node* const initial_exception_value = nullptr);
+  void Generate_AsyncFromSyncIteratorMethodOptimized(
+      Node* const context, Node* const iterator, Node* const sent_value,
+      const SyncIteratorNodeGenerator& get_method,
+      const UndefinedMethodHandler& if_method_undefined,
+      const char* operation_name,
+      Label::Type reject_label_type = Label::kDeferred,
+      Node* const initial_exception_value = nullptr);
 
   void Generate_AsyncFromSyncIteratorMethod(
       Node* const context, Node* const iterator, Node* const sent_value,
@@ -50,6 +57,19 @@ class AsyncFromSyncBuiltinsAssembler : public AsyncBuiltinsAssembler {
         context, iterator, sent_value, get_method, if_method_undefined,
         operation_name, reject_label_type, initial_exception_value);
   }
+  void Generate_AsyncFromSyncIteratorMethodOptimized(
+      Node* const context, Node* const iterator, Node* const sent_value,
+      Handle<String> name, const UndefinedMethodHandler& if_method_undefined,
+      const char* operation_name,
+      Label::Type reject_label_type = Label::kDeferred,
+      Node* const initial_exception_value = nullptr) {
+    auto get_method = [=](Node* const sync_iterator) {
+      return GetProperty(context, sync_iterator, name);
+    };
+    return Generate_AsyncFromSyncIteratorMethodOptimized(
+        context, iterator, sent_value, get_method, if_method_undefined,
+        operation_name, reject_label_type, initial_exception_value);
+  }
 
   // Load "value" and "done" from an iterator result object. If an exception
   // is thrown at any point, jumps to te `if_exception` label with exception
@@ -157,6 +177,73 @@ void AsyncFromSyncBuiltinsAssembler::Generate_AsyncFromSyncIteratorMethod(
   }
 }
 
+void AsyncFromSyncBuiltinsAssembler::
+    Generate_AsyncFromSyncIteratorMethodOptimized(
+        Node* const context, Node* const iterator, Node* const sent_value,
+        const SyncIteratorNodeGenerator& get_method,
+        const UndefinedMethodHandler& if_method_undefined,
+        const char* operation_name, Label::Type reject_label_type,
+        Node* const initial_exception_value) {
+  Node* const native_context = LoadNativeContext(context);
+  Node* const promise = AllocateAndInitJSPromise(context);
+
+  VARIABLE(var_exception, MachineRepresentation::kTagged,
+           initial_exception_value == nullptr ? UndefinedConstant()
+                                              : initial_exception_value);
+  Label reject_promise(this, reject_label_type);
+
+  ThrowIfNotAsyncFromSyncIterator(context, iterator, &reject_promise,
+                                  &var_exception, operation_name);
+
+  Node* const sync_iterator =
+      LoadObjectField(iterator, JSAsyncFromSyncIterator::kSyncIteratorOffset);
+
+  Node* const method = get_method(sync_iterator);
+
+  if (if_method_undefined) {
+    Label if_isnotundefined(this);
+
+    GotoIfNot(IsUndefined(method), &if_isnotundefined);
+    if_method_undefined(native_context, promise, &reject_promise);
+
+    BIND(&if_isnotundefined);
+  }
+
+  Node* const iter_result = CallJS(CodeFactory::Call(isolate()), context,
+                                   method, sync_iterator, sent_value);
+  GotoIfException(iter_result, &reject_promise, &var_exception);
+
+  Node* value;
+  Node* done;
+  std::tie(value, done) = LoadIteratorResult(
+      context, native_context, iter_result, &reject_promise, &var_exception);
+
+  Node* const promise_fun =
+      LoadContextElement(native_context, Context::PROMISE_FUNCTION_INDEX);
+  CSA_ASSERT(this, IsConstructor(promise_fun));
+
+  // Let valueWrapper be ? PromiseResolve(« value »).
+  Node* const valueWrapper = CallBuiltin(Builtins::kPromiseResolve,
+                                         native_context, promise_fun, value);
+
+  // Let onFulfilled be a new built-in function object as defined in
+  // Async Iterator Value Unwrap Functions.
+  // Set onFulfilled.[[Done]] to throwDone.
+  Node* const on_fulfilled = CreateUnwrapClosure(native_context, done);
+
+  // Perform ! PerformPromiseThen(valueWrapper,
+  //     onFulfilled, undefined, promiseCapability).
+  Return(CallBuiltin(Builtins::kPerformPromiseThen, context, valueWrapper,
+                     on_fulfilled, UndefinedConstant(), promise));
+
+  BIND(&reject_promise);
+  {
+    Node* const exception = var_exception.value();
+    CallBuiltin(Builtins::kRejectPromise, context, promise, exception,
+                TrueConstant());
+    Return(promise);
+  }
+}
 std::pair<Node*, Node*> AsyncFromSyncBuiltinsAssembler::LoadIteratorResult(
     Node* const context, Node* const native_context, Node* const iter_result,
     Label* if_exception, Variable* var_exception) {
@@ -246,6 +333,20 @@ TF_BUILTIN(AsyncFromSyncIteratorPrototypeNext, AsyncFromSyncBuiltinsAssembler) {
       "[Async-from-Sync Iterator].prototype.next");
 }
 
+TF_BUILTIN(AsyncFromSyncIteratorPrototypeNextOptimized,
+           AsyncFromSyncBuiltinsAssembler) {
+  Node* const iterator = Parameter(Descriptor::kReceiver);
+  Node* const value = Parameter(Descriptor::kValue);
+  Node* const context = Parameter(Descriptor::kContext);
+
+  auto get_method = [=](Node* const unused) {
+    return LoadObjectField(iterator, JSAsyncFromSyncIterator::kNextOffset);
+  };
+  Generate_AsyncFromSyncIteratorMethodOptimized(
+      context, iterator, value, get_method, UndefinedMethodHandler(),
+      "[Async-from-Sync Iterator].prototype.next");
+}
+
 // https://tc39.github.io/proposal-async-iteration/
 // Section #sec-%asyncfromsynciteratorprototype%.return
 TF_BUILTIN(AsyncFromSyncIteratorPrototypeReturn,
@@ -273,6 +374,31 @@ TF_BUILTIN(AsyncFromSyncIteratorPrototypeReturn,
       "[Async-from-Sync Iterator].prototype.return");
 }
 
+TF_BUILTIN(AsyncFromSyncIteratorPrototypeReturnOptimized,
+           AsyncFromSyncBuiltinsAssembler) {
+  Node* const iterator = Parameter(Descriptor::kReceiver);
+  Node* const value = Parameter(Descriptor::kValue);
+  Node* const context = Parameter(Descriptor::kContext);
+
+  auto if_return_undefined = [=](Node* const native_context,
+                                 Node* const promise, Label* if_exception) {
+    // If return is undefined, then
+    // Let iterResult be ! CreateIterResultObject(value, true)
+    Node* const iter_result = CallBuiltin(Builtins::kCreateIterResultObject,
+                                          context, value, TrueConstant());
+
+    // Perform ! Call(promiseCapability.[[Resolve]], undefined, « iterResult »).
+    // IfAbruptRejectPromise(nextDone, promiseCapability).
+    // Return promiseCapability.[[Promise]].
+    CallBuiltin(Builtins::kResolvePromise, context, promise, iter_result);
+    Return(promise);
+  };
+
+  Generate_AsyncFromSyncIteratorMethodOptimized(
+      context, iterator, value, factory()->return_string(), if_return_undefined,
+      "[Async-from-Sync Iterator].prototype.return");
+}
+
 // https://tc39.github.io/proposal-async-iteration/
 // Section #sec-%asyncfromsynciteratorprototype%.throw
 TF_BUILTIN(AsyncFromSyncIteratorPrototypeThrow,
@@ -290,5 +416,20 @@ TF_BUILTIN(AsyncFromSyncIteratorPrototypeThrow,
       reason);
 }
 
+TF_BUILTIN(AsyncFromSyncIteratorPrototypeThrowOptimized,
+           AsyncFromSyncBuiltinsAssembler) {
+  Node* const iterator = Parameter(Descriptor::kReceiver);
+  Node* const reason = Parameter(Descriptor::kReason);
+  Node* const context = Parameter(Descriptor::kContext);
+
+  auto if_throw_undefined = [=](Node* const native_context, Node* const promise,
+                                Label* if_exception) { Goto(if_exception); };
+
+  Generate_AsyncFromSyncIteratorMethodOptimized(
+      context, iterator, reason, factory()->throw_string(), if_throw_undefined,
+      "[Async-from-Sync Iterator].prototype.throw", Label::kNonDeferred,
+      reason);
+}
+
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/src/builtins/builtins-bigint.cc b/deps/v8/src/builtins/builtins-bigint.cc
index 6c04c9dcb7199d..6bc1a911f7770e 100644
--- a/deps/v8/src/builtins/builtins-bigint.cc
+++ b/deps/v8/src/builtins/builtins-bigint.cc
@@ -49,7 +49,8 @@ BUILTIN(BigIntAsUintN) {
   ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, bigint,
                                      BigInt::FromObject(isolate, bigint_obj));
 
-  RETURN_RESULT_OR_FAILURE(isolate, BigInt::AsUintN(bits->Number(), bigint));
+  RETURN_RESULT_OR_FAILURE(isolate,
+                           BigInt::AsUintN(isolate, bits->Number(), bigint));
 }
 
 BUILTIN(BigIntAsIntN) {
@@ -66,7 +67,7 @@ BUILTIN(BigIntAsIntN) {
   ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, bigint,
                                      BigInt::FromObject(isolate, bigint_obj));
 
-  return *BigInt::AsIntN(bits->Number(), bigint);
+  return *BigInt::AsIntN(isolate, bits->Number(), bigint);
 }
 
 namespace {
@@ -115,7 +116,7 @@ Object* BigIntToStringImpl(Handle<Object> receiver, Handle<Object> radix,
   }
   // Return the String representation of this Number value using the radix
   // specified by radixNumber.
-  RETURN_RESULT_OR_FAILURE(isolate, BigInt::ToString(x, radix_number));
+  RETURN_RESULT_OR_FAILURE(isolate, BigInt::ToString(isolate, x, radix_number));
 }
 
 }  // namespace
diff --git a/deps/v8/src/builtins/builtins-boolean.cc b/deps/v8/src/builtins/builtins-boolean.cc
index 5dc42d506f3754..e0e1bb738c1796 100644
--- a/deps/v8/src/builtins/builtins-boolean.cc
+++ b/deps/v8/src/builtins/builtins-boolean.cc
@@ -18,7 +18,7 @@ BUILTIN(BooleanConstructor) {
   HandleScope scope(isolate);
   if (args.new_target()->IsUndefined(isolate)) {  // [[Call]]
     Handle<Object> value = args.atOrUndefined(isolate, 1);
-    return isolate->heap()->ToBoolean(value->BooleanValue());
+    return isolate->heap()->ToBoolean(value->BooleanValue(isolate));
   } else {  // [[Construct]]
     HandleScope scope(isolate);
     Handle<Object> value = args.atOrUndefined(isolate, 1);
@@ -29,7 +29,7 @@ BUILTIN(BooleanConstructor) {
     ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, result,
                                        JSObject::New(target, new_target));
     Handle<JSValue>::cast(result)->set_value(
-        isolate->heap()->ToBoolean(value->BooleanValue()));
+        isolate->heap()->ToBoolean(value->BooleanValue(isolate)));
     return *result;
   }
 }
diff --git a/deps/v8/src/builtins/builtins-call-gen.cc b/deps/v8/src/builtins/builtins-call-gen.cc
index 34c88670f46952..35aaee5ec200bf 100644
--- a/deps/v8/src/builtins/builtins-call-gen.cc
+++ b/deps/v8/src/builtins/builtins-call-gen.cc
@@ -62,9 +62,8 @@ void Builtins::Generate_CallFunctionForwardVarargs(MacroAssembler* masm) {
 }
 
 void CallOrConstructBuiltinsAssembler::CallOrConstructWithArrayLike(
-    Node* target, Node* new_target, Node* arguments_list, Node* context) {
-  VARIABLE(var_elements, MachineRepresentation::kTagged);
-  VARIABLE(var_length, MachineRepresentation::kWord32);
+    TNode<Object> target, SloppyTNode<Object> new_target,
+    TNode<Object> arguments_list, TNode<Context> context) {
   Label if_done(this), if_arguments(this), if_array(this),
       if_holey_array(this, Label::kDeferred),
       if_runtime(this, Label::kDeferred);
@@ -75,7 +74,8 @@ void CallOrConstructBuiltinsAssembler::CallOrConstructWithArrayLike(
     Label if_target_callable(this),
         if_target_not_callable(this, Label::kDeferred);
     GotoIf(TaggedIsSmi(target), &if_target_not_callable);
-    Branch(IsCallable(target), &if_target_callable, &if_target_not_callable);
+    Branch(IsCallable(CAST(target)), &if_target_callable,
+           &if_target_not_callable);
     BIND(&if_target_not_callable);
     {
       CallRuntime(Runtime::kThrowApplyNonFunction, context, target);
@@ -87,7 +87,7 @@ void CallOrConstructBuiltinsAssembler::CallOrConstructWithArrayLike(
     Label if_target_constructor(this),
         if_target_not_constructor(this, Label::kDeferred);
     GotoIf(TaggedIsSmi(target), &if_target_not_constructor);
-    Branch(IsConstructor(target), &if_target_constructor,
+    Branch(IsConstructor(CAST(target)), &if_target_constructor,
            &if_target_not_constructor);
     BIND(&if_target_not_constructor);
     {
@@ -100,7 +100,7 @@ void CallOrConstructBuiltinsAssembler::CallOrConstructWithArrayLike(
     Label if_new_target_constructor(this),
         if_new_target_not_constructor(this, Label::kDeferred);
     GotoIf(TaggedIsSmi(new_target), &if_new_target_not_constructor);
-    Branch(IsConstructor(new_target), &if_new_target_constructor,
+    Branch(IsConstructor(CAST(new_target)), &if_new_target_constructor,
            &if_new_target_not_constructor);
     BIND(&if_new_target_not_constructor);
     {
@@ -111,27 +111,29 @@ void CallOrConstructBuiltinsAssembler::CallOrConstructWithArrayLike(
   }
 
   GotoIf(TaggedIsSmi(arguments_list), &if_runtime);
-  Node* arguments_list_map = LoadMap(arguments_list);
-  Node* native_context = LoadNativeContext(context);
+
+  TNode<Map> arguments_list_map = LoadMap(CAST(arguments_list));
+  TNode<Context> native_context = LoadNativeContext(context);
 
   // Check if {arguments_list} is an (unmodified) arguments object.
-  Node* sloppy_arguments_map =
-      LoadContextElement(native_context, Context::SLOPPY_ARGUMENTS_MAP_INDEX);
+  TNode<Map> sloppy_arguments_map = CAST(
+      LoadContextElement(native_context, Context::SLOPPY_ARGUMENTS_MAP_INDEX));
   GotoIf(WordEqual(arguments_list_map, sloppy_arguments_map), &if_arguments);
-  Node* strict_arguments_map =
-      LoadContextElement(native_context, Context::STRICT_ARGUMENTS_MAP_INDEX);
+  TNode<Map> strict_arguments_map = CAST(
+      LoadContextElement(native_context, Context::STRICT_ARGUMENTS_MAP_INDEX));
   GotoIf(WordEqual(arguments_list_map, strict_arguments_map), &if_arguments);
 
   // Check if {arguments_list} is a fast JSArray.
   Branch(IsJSArrayMap(arguments_list_map), &if_array, &if_runtime);
 
+  TVARIABLE(FixedArrayBase, var_elements);
+  TVARIABLE(Int32T, var_length);
   BIND(&if_array);
   {
     // Try to extract the elements from a JSArray object.
-    var_elements.Bind(
-        LoadObjectField(arguments_list, JSArray::kElementsOffset));
-    var_length.Bind(LoadAndUntagToWord32ObjectField(arguments_list,
-                                                    JSArray::kLengthOffset));
+    var_elements = LoadElements(CAST(arguments_list));
+    var_length =
+        LoadAndUntagToWord32ObjectField(arguments_list, JSArray::kLengthOffset);
 
     // Holey arrays and double backing stores need special treatment.
     STATIC_ASSERT(PACKED_SMI_ELEMENTS == 0);
@@ -142,7 +144,7 @@ void CallOrConstructBuiltinsAssembler::CallOrConstructWithArrayLike(
     STATIC_ASSERT(HOLEY_DOUBLE_ELEMENTS == 5);
     STATIC_ASSERT(LAST_FAST_ELEMENTS_KIND == HOLEY_DOUBLE_ELEMENTS);
 
-    Node* kind = LoadMapElementsKind(arguments_list_map);
+    TNode<Int32T> kind = LoadMapElementsKind(arguments_list_map);
 
     GotoIf(Int32GreaterThan(kind, Int32Constant(LAST_FAST_ELEMENTS_KIND)),
            &if_runtime);
@@ -160,26 +162,25 @@ void CallOrConstructBuiltinsAssembler::CallOrConstructWithArrayLike(
 
   BIND(&if_arguments);
   {
+    TNode<JSArgumentsObject> js_arguments = CAST(arguments_list);
     // Try to extract the elements from an JSArgumentsObject.
-    Node* length =
-        LoadObjectField(arguments_list, JSArgumentsObject::kLengthOffset);
-    Node* elements =
-        LoadObjectField(arguments_list, JSArgumentsObject::kElementsOffset);
-    Node* elements_length = LoadFixedArrayBaseLength(elements);
+    TNode<Object> length =
+        LoadObjectField(js_arguments, JSArgumentsObject::kLengthOffset);
+    TNode<FixedArrayBase> elements = LoadElements(js_arguments);
+    TNode<Smi> elements_length = LoadFixedArrayBaseLength(elements);
     GotoIfNot(WordEqual(length, elements_length), &if_runtime);
-    var_elements.Bind(elements);
-    var_length.Bind(SmiToInt32(length));
+    var_elements = elements;
+    var_length = SmiToInt32(CAST(length));
     Goto(&if_done);
   }
 
   BIND(&if_runtime);
   {
     // Ask the runtime to create the list (actually a FixedArray).
-    Node* elements =
-        CallRuntime(Runtime::kCreateListFromArrayLike, context, arguments_list);
-    var_elements.Bind(elements);
-    var_length.Bind(
-        LoadAndUntagToWord32ObjectField(elements, FixedArray::kLengthOffset));
+    var_elements = CAST(CallRuntime(Runtime::kCreateListFromArrayLike, context,
+                                    arguments_list));
+    var_length = LoadAndUntagToWord32ObjectField(var_elements.value(),
+                                                 FixedArray::kLengthOffset);
     Goto(&if_done);
   }
 
@@ -188,27 +189,41 @@ void CallOrConstructBuiltinsAssembler::CallOrConstructWithArrayLike(
   BIND(&if_done);
   {
     Label if_not_double(this), if_double(this);
-    Node* elements = var_elements.value();
-    Node* length = var_length.value();
-    Node* args_count = Int32Constant(0);  // args already on the stack
+    TNode<Int32T> args_count = Int32Constant(0);  // args already on the stack
 
+    TNode<Int32T> length = var_length.value();
+    {
+      Label normalize_done(this);
+      GotoIfNot(Word32Equal(length, Int32Constant(0)), &normalize_done);
+      // Make sure we don't accidentally pass along the
+      // empty_fixed_double_array since the tailed-called stubs cannot handle
+      // the normalization yet.
+      var_elements = EmptyFixedArrayConstant();
+      Goto(&normalize_done);
+
+      BIND(&normalize_done);
+    }
+
+    TNode<FixedArrayBase> elements = var_elements.value();
     Branch(IsFixedDoubleArray(elements), &if_double, &if_not_double);
 
     BIND(&if_not_double);
-    if (new_target == nullptr) {
-      Callable callable = CodeFactory::CallVarargs(isolate());
-      TailCallStub(callable, context, target, args_count, elements, length);
-    } else {
-      Callable callable = CodeFactory::ConstructVarargs(isolate());
-      TailCallStub(callable, context, target, new_target, args_count, elements,
-                   length);
+    {
+      if (new_target == nullptr) {
+        Callable callable = CodeFactory::CallVarargs(isolate());
+        TailCallStub(callable, context, target, args_count, elements, length);
+      } else {
+        Callable callable = CodeFactory::ConstructVarargs(isolate());
+        TailCallStub(callable, context, target, new_target, args_count,
+                     elements, length);
+      }
     }
 
     BIND(&if_double);
     {
       // Kind is hardcoded here because CreateListFromArrayLike will only
       // produce holey double arrays.
-      CallOrConstructDoubleVarargs(target, new_target, elements, length,
+      CallOrConstructDoubleVarargs(target, new_target, CAST(elements), length,
                                    args_count, context,
                                    Int32Constant(HOLEY_DOUBLE_ELEMENTS));
     }
@@ -219,19 +234,19 @@ void CallOrConstructBuiltinsAssembler::CallOrConstructWithArrayLike(
 // boxed as HeapNumbers, then tail calls CallVarargs/ConstructVarargs depending
 // on whether {new_target} was passed.
 void CallOrConstructBuiltinsAssembler::CallOrConstructDoubleVarargs(
-    Node* target, Node* new_target, Node* elements, Node* length,
-    Node* args_count, Node* context, Node* kind) {
+    TNode<Object> target, SloppyTNode<Object> new_target,
+    TNode<FixedDoubleArray> elements, TNode<Int32T> length,
+    TNode<Int32T> args_count, TNode<Context> context, TNode<Int32T> kind) {
   Label if_holey_double(this), if_packed_double(this), if_done(this);
 
   const ElementsKind new_kind = PACKED_ELEMENTS;
-  const ParameterMode mode = INTPTR_PARAMETERS;
   const WriteBarrierMode barrier_mode = UPDATE_WRITE_BARRIER;
-  Node* intptr_length = ChangeInt32ToIntPtr(length);
+  TNode<IntPtrT> intptr_length = ChangeInt32ToIntPtr(length);
+  CSA_ASSERT(this, WordNotEqual(intptr_length, IntPtrConstant(0)));
 
   // Allocate a new FixedArray of Objects.
-  Node* new_elements =
-      AllocateFixedArray(new_kind, intptr_length, mode,
-                         CodeStubAssembler::kAllowLargeObjectAllocation);
+  TNode<FixedArray> new_elements = AllocateFixedArray(
+      new_kind, intptr_length, CodeStubAssembler::kAllowLargeObjectAllocation);
   Branch(Word32Equal(kind, Int32Constant(HOLEY_DOUBLE_ELEMENTS)),
          &if_holey_double, &if_packed_double);
 
@@ -266,18 +281,19 @@ void CallOrConstructBuiltinsAssembler::CallOrConstructDoubleVarargs(
 }
 
 void CallOrConstructBuiltinsAssembler::CallOrConstructWithSpread(
-    Node* target, Node* new_target, Node* spread, Node* args_count,
-    Node* context) {
+    TNode<Object> target, TNode<Object> new_target, TNode<Object> spread,
+    TNode<Int32T> args_count, TNode<Context> context) {
   Label if_smiorobject(this), if_double(this),
       if_generic(this, Label::kDeferred);
 
-  VARIABLE(var_length, MachineRepresentation::kWord32);
-  VARIABLE(var_elements, MachineRepresentation::kTagged);
-  VARIABLE(var_elements_kind, MachineRepresentation::kWord32);
+  TVARIABLE(Int32T, var_length);
+  TVARIABLE(FixedArrayBase, var_elements);
+  TVARIABLE(Int32T, var_elements_kind);
 
   GotoIf(TaggedIsSmi(spread), &if_generic);
-  Node* spread_map = LoadMap(spread);
+  TNode<Map> spread_map = LoadMap(CAST(spread));
   GotoIfNot(IsJSArrayMap(spread_map), &if_generic);
+  TNode<JSArray> spread_array = CAST(spread);
 
   // Check that we have the original Array.prototype.
   GotoIfNot(IsPrototypeInitialArrayPrototype(context, spread_map), &if_generic);
@@ -287,40 +303,41 @@ void CallOrConstructBuiltinsAssembler::CallOrConstructWithSpread(
 
   // Check that the Array.prototype hasn't been modified in a way that would
   // affect iteration.
-  Node* protector_cell = LoadRoot(Heap::kArrayIteratorProtectorRootIndex);
-  DCHECK(isolate()->heap()->array_iterator_protector()->IsPropertyCell());
+  TNode<PropertyCell> protector_cell =
+      CAST(LoadRoot(Heap::kArrayIteratorProtectorRootIndex));
   GotoIf(WordEqual(LoadObjectField(protector_cell, PropertyCell::kValueOffset),
                    SmiConstant(Isolate::kProtectorInvalid)),
          &if_generic);
-
-  // The fast-path accesses the {spread} elements directly.
-  Node* spread_kind = LoadMapElementsKind(spread_map);
-  var_elements_kind.Bind(spread_kind);
-  var_length.Bind(
-      LoadAndUntagToWord32ObjectField(spread, JSArray::kLengthOffset));
-  var_elements.Bind(LoadObjectField(spread, JSArray::kElementsOffset));
-
-  // Check elements kind of {spread}.
-  GotoIf(Int32LessThan(spread_kind, Int32Constant(PACKED_DOUBLE_ELEMENTS)),
-         &if_smiorobject);
-  Branch(Int32GreaterThan(spread_kind, Int32Constant(LAST_FAST_ELEMENTS_KIND)),
-         &if_generic, &if_double);
+  {
+    // The fast-path accesses the {spread} elements directly.
+    TNode<Int32T> spread_kind = LoadMapElementsKind(spread_map);
+    var_elements_kind = spread_kind;
+    var_length =
+        LoadAndUntagToWord32ObjectField(spread_array, JSArray::kLengthOffset);
+    var_elements = LoadElements(spread_array);
+
+    // Check elements kind of {spread}.
+    GotoIf(Int32LessThan(spread_kind, Int32Constant(PACKED_DOUBLE_ELEMENTS)),
+           &if_smiorobject);
+    Branch(
+        Int32GreaterThan(spread_kind, Int32Constant(LAST_FAST_ELEMENTS_KIND)),
+        &if_generic, &if_double);
+  }
 
   BIND(&if_generic);
   {
     Label if_iterator_fn_not_callable(this, Label::kDeferred);
-    Node* iterator_fn = GetProperty(context, spread, IteratorSymbolConstant());
-    GotoIf(TaggedIsSmi(iterator_fn), &if_iterator_fn_not_callable);
-    GotoIfNot(IsCallable(iterator_fn), &if_iterator_fn_not_callable);
-    Node* list =
-        CallBuiltin(Builtins::kIterableToList, context, spread, iterator_fn);
-    CSA_ASSERT(this, IsJSArray(list));
-    Node* list_kind = LoadMapElementsKind(LoadMap(list));
-    var_length.Bind(
-        LoadAndUntagToWord32ObjectField(list, JSArray::kLengthOffset));
-    var_elements.Bind(LoadObjectField(list, JSArray::kElementsOffset));
-    var_elements_kind.Bind(list_kind);
-    Branch(Int32LessThan(list_kind, Int32Constant(PACKED_DOUBLE_ELEMENTS)),
+    TNode<Object> iterator_fn =
+        GetProperty(context, spread, IteratorSymbolConstant());
+    GotoIfNot(TaggedIsCallable(iterator_fn), &if_iterator_fn_not_callable);
+    TNode<JSArray> list = CAST(
+        CallBuiltin(Builtins::kIterableToList, context, spread, iterator_fn));
+    var_length = LoadAndUntagToWord32ObjectField(list, JSArray::kLengthOffset);
+
+    var_elements = LoadElements(list);
+    var_elements_kind = LoadElementsKind(list);
+    Branch(Int32LessThan(var_elements_kind.value(),
+                         Int32Constant(PACKED_DOUBLE_ELEMENTS)),
            &if_smiorobject, &if_double);
 
     BIND(&if_iterator_fn_not_callable);
@@ -329,8 +346,8 @@ void CallOrConstructBuiltinsAssembler::CallOrConstructWithSpread(
 
   BIND(&if_smiorobject);
   {
-    Node* const elements = var_elements.value();
-    Node* const length = var_length.value();
+    TNode<FixedArrayBase> elements = var_elements.value();
+    TNode<Int32T> length = var_length.value();
 
     if (new_target == nullptr) {
       Callable callable = CodeFactory::CallVarargs(isolate());
@@ -344,29 +361,28 @@ void CallOrConstructBuiltinsAssembler::CallOrConstructWithSpread(
 
   BIND(&if_double);
   {
-    Node* const elements_kind = var_elements_kind.value();
-    Node* const elements = var_elements.value();
-    Node* const length = var_length.value();
-
-    CallOrConstructDoubleVarargs(target, new_target, elements, length,
-                                 args_count, context, elements_kind);
+    GotoIf(Word32Equal(var_length.value(), Int32Constant(0)), &if_smiorobject);
+    CallOrConstructDoubleVarargs(target, new_target, CAST(var_elements.value()),
+                                 var_length.value(), args_count, context,
+                                 var_elements_kind.value());
   }
 }
 
 TF_BUILTIN(CallWithArrayLike, CallOrConstructBuiltinsAssembler) {
-  Node* target = Parameter(CallWithArrayLikeDescriptor::kTarget);
-  Node* new_target = nullptr;
-  Node* arguments_list = Parameter(CallWithArrayLikeDescriptor::kArgumentsList);
-  Node* context = Parameter(CallWithArrayLikeDescriptor::kContext);
+  TNode<Object> target = CAST(Parameter(Descriptor::kTarget));
+  SloppyTNode<Object> new_target = nullptr;
+  TNode<Object> arguments_list = CAST(Parameter(Descriptor::kArgumentsList));
+  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
   CallOrConstructWithArrayLike(target, new_target, arguments_list, context);
 }
 
 TF_BUILTIN(CallWithSpread, CallOrConstructBuiltinsAssembler) {
-  Node* target = Parameter(CallWithSpreadDescriptor::kTarget);
-  Node* new_target = nullptr;
-  Node* spread = Parameter(CallWithSpreadDescriptor::kSpread);
-  Node* args_count = Parameter(CallWithSpreadDescriptor::kArgumentsCount);
-  Node* context = Parameter(CallWithSpreadDescriptor::kContext);
+  TNode<Object> target = CAST(Parameter(Descriptor::kTarget));
+  SloppyTNode<Object> new_target = nullptr;
+  TNode<Object> spread = CAST(Parameter(Descriptor::kSpread));
+  TNode<Int32T> args_count =
+      UncheckedCast<Int32T>(Parameter(Descriptor::kArgumentsCount));
+  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
   CallOrConstructWithSpread(target, new_target, spread, args_count, context);
 }
 
diff --git a/deps/v8/src/builtins/builtins-call-gen.h b/deps/v8/src/builtins/builtins-call-gen.h
index bbbdefc0c50538..013093f38b456d 100644
--- a/deps/v8/src/builtins/builtins-call-gen.h
+++ b/deps/v8/src/builtins/builtins-call-gen.h
@@ -15,14 +15,19 @@ class CallOrConstructBuiltinsAssembler : public CodeStubAssembler {
   explicit CallOrConstructBuiltinsAssembler(compiler::CodeAssemblerState* state)
       : CodeStubAssembler(state) {}
 
-  void CallOrConstructWithArrayLike(Node* target, Node* new_target,
-                                    Node* arguments_list, Node* context);
-  void CallOrConstructDoubleVarargs(Node* target, Node* new_target,
-                                    Node* elements, Node* length,
-                                    Node* args_count, Node* context,
-                                    Node* kind);
-  void CallOrConstructWithSpread(Node* target, Node* new_target, Node* spread,
-                                 Node* args_count, Node* context);
+  void CallOrConstructWithArrayLike(TNode<Object> target,
+                                    SloppyTNode<Object> new_target,
+                                    TNode<Object> arguments_list,
+                                    TNode<Context> context);
+  void CallOrConstructDoubleVarargs(TNode<Object> target,
+                                    SloppyTNode<Object> new_target,
+                                    TNode<FixedDoubleArray> elements,
+                                    TNode<Int32T> length,
+                                    TNode<Int32T> args_count,
+                                    TNode<Context> context, TNode<Int32T> kind);
+  void CallOrConstructWithSpread(TNode<Object> target, TNode<Object> new_target,
+                                 TNode<Object> spread, TNode<Int32T> args_count,
+                                 TNode<Context> context);
 };
 
 }  // namespace internal
diff --git a/deps/v8/src/builtins/builtins-callsite.cc b/deps/v8/src/builtins/builtins-callsite.cc
index 5ce0aa01553af4..ff04fa2dbe3c57 100644
--- a/deps/v8/src/builtins/builtins-callsite.cc
+++ b/deps/v8/src/builtins/builtins-callsite.cc
@@ -28,7 +28,7 @@ namespace {
 
 Object* PositiveNumberOrNull(int value, Isolate* isolate) {
   if (value >= 0) return *isolate->factory()->NewNumberFromInt(value);
-  return isolate->heap()->null_value();
+  return ReadOnlyRoots(isolate).null_value();
 }
 
 Handle<FrameArray> GetFrameArray(Isolate* isolate, Handle<JSObject> object) {
@@ -76,7 +76,7 @@ BUILTIN(CallSitePrototypeGetFunction) {
                         GetFrameIndex(isolate, recv));
 
   StackFrameBase* frame = it.Frame();
-  if (frame->IsStrict()) return isolate->heap()->undefined_value();
+  if (frame->IsStrict()) return ReadOnlyRoots(isolate).undefined_value();
   return *frame->GetFunction();
 }
 
@@ -127,7 +127,7 @@ BUILTIN(CallSitePrototypeGetThis) {
                         GetFrameIndex(isolate, recv));
 
   StackFrameBase* frame = it.Frame();
-  if (frame->IsStrict()) return isolate->heap()->undefined_value();
+  if (frame->IsStrict()) return ReadOnlyRoots(isolate).undefined_value();
   return *frame->GetReceiver();
 }
 
diff --git a/deps/v8/src/builtins/builtins-collections-gen.cc b/deps/v8/src/builtins/builtins-collections-gen.cc
index 5c3f26374689dc..6cab828e2e2ed0 100644
--- a/deps/v8/src/builtins/builtins-collections-gen.cc
+++ b/deps/v8/src/builtins/builtins-collections-gen.cc
@@ -7,7 +7,8 @@
 #include "src/builtins/builtins-utils-gen.h"
 #include "src/code-stub-assembler.h"
 #include "src/heap/factory-inl.h"
-#include "src/objects/hash-table.h"
+#include "src/objects/hash-table-inl.h"
+#include "src/objects/js-collection.h"
 
 namespace v8 {
 namespace internal {
@@ -81,7 +82,9 @@ class BaseCollectionsAssembler : public CodeStubAssembler {
 
   // Main entry point for a collection constructor builtin.
   void GenerateConstructor(Variant variant,
-                           Handle<String> constructor_function_name);
+                           Handle<String> constructor_function_name,
+                           TNode<Object> new_target, TNode<IntPtrT> argc,
+                           TNode<Context> context);
 
   // Retrieves the collection function that adds an entry. `set` for Maps and
   // `add` for Sets.
@@ -116,13 +119,13 @@ class BaseCollectionsAssembler : public CodeStubAssembler {
 
   // Loads an element from a fixed array.  If the element is the hole, returns
   // `undefined`.
-  TNode<Object> LoadAndNormalizeFixedArrayElement(TNode<Object> elements,
+  TNode<Object> LoadAndNormalizeFixedArrayElement(TNode<HeapObject> elements,
                                                   TNode<IntPtrT> index);
 
   // Loads an element from a fixed double array.  If the element is the hole,
   // returns `undefined`.
-  TNode<Object> LoadAndNormalizeFixedDoubleArrayElement(TNode<Object> elements,
-                                                        TNode<IntPtrT> index);
+  TNode<Object> LoadAndNormalizeFixedDoubleArrayElement(
+      TNode<HeapObject> elements, TNode<IntPtrT> index);
 
   // Loads key and value variables with the first and second elements of an
   // array.  If the array lacks 2 elements, undefined is used.
@@ -220,7 +223,7 @@ void BaseCollectionsAssembler::AddConstructorEntriesFromFastJSArray(
     TNode<Object> collection, TNode<JSArray> fast_jsarray,
     Label* if_may_have_side_effects) {
   TNode<FixedArrayBase> elements = LoadElements(fast_jsarray);
-  TNode<Int32T> elements_kind = LoadMapElementsKind(LoadMap(fast_jsarray));
+  TNode<Int32T> elements_kind = LoadElementsKind(fast_jsarray);
   TNode<JSFunction> add_func = GetInitialAddFunction(variant, native_context);
   CSA_ASSERT(
       this,
@@ -262,12 +265,11 @@ void BaseCollectionsAssembler::AddConstructorEntriesFromFastJSArray(
     // A Map constructor requires entries to be arrays (ex. [key, value]),
     // so a FixedDoubleArray can never succeed.
     if (variant == kMap || variant == kWeakMap) {
-      TNode<Float64T> element =
-          UncheckedCast<Float64T>(LoadFixedDoubleArrayElement(
-              elements, IntPtrConstant(0), MachineType::Float64(), 0,
-              INTPTR_PARAMETERS));
+      CSA_ASSERT(this, IntPtrGreaterThan(length, IntPtrConstant(0)));
+      TNode<Object> element =
+          LoadAndNormalizeFixedDoubleArrayElement(elements, IntPtrConstant(0));
       ThrowTypeError(context, MessageTemplate::kIteratorValueNotAnObject,
-                     AllocateHeapNumberWithValue(element));
+                     element);
     } else {
       DCHECK(variant == kSet || variant == kWeakSet);
       auto set_entry = [&](Node* index) {
@@ -354,13 +356,11 @@ TNode<Object> BaseCollectionsAssembler::AllocateJSCollectionSlow(
 }
 
 void BaseCollectionsAssembler::GenerateConstructor(
-    Variant variant, Handle<String> constructor_function_name) {
+    Variant variant, Handle<String> constructor_function_name,
+    TNode<Object> new_target, TNode<IntPtrT> argc, TNode<Context> context) {
   const int kIterableArg = 0;
-  CodeStubArguments args(
-      this, ChangeInt32ToIntPtr(Parameter(BuiltinDescriptor::kArgumentsCount)));
+  CodeStubArguments args(this, argc);
   TNode<Object> iterable = args.GetOptionalArgumentValue(kIterableArg);
-  TNode<Object> new_target = CAST(Parameter(BuiltinDescriptor::kNewTarget));
-  TNode<Context> context = CAST(Parameter(BuiltinDescriptor::kContext));
 
   Label if_undefined(this, Label::kDeferred);
   GotoIf(IsUndefined(new_target), &if_undefined);
@@ -386,7 +386,7 @@ TNode<Object> BaseCollectionsAssembler::GetAddFunction(
 
   Label exit(this), if_notcallable(this, Label::kDeferred);
   GotoIf(TaggedIsSmi(add_func), &if_notcallable);
-  GotoIfNot(IsCallable(add_func), &if_notcallable);
+  GotoIfNot(IsCallable(CAST(add_func)), &if_notcallable);
   Goto(&exit);
 
   BIND(&if_notcallable);
@@ -485,24 +485,25 @@ TNode<BoolT> BaseCollectionsAssembler::HasInitialCollectionPrototype(
   TNode<Map> initial_prototype_map =
       CAST(LoadContextElement(native_context, initial_prototype_index));
   TNode<Map> collection_proto_map =
-      LoadMap(CAST(LoadMapPrototype(LoadMap(CAST(collection)))));
+      LoadMap(LoadMapPrototype(LoadMap(CAST(collection))));
 
   return WordEqual(collection_proto_map, initial_prototype_map);
 }
 
 TNode<Object> BaseCollectionsAssembler::LoadAndNormalizeFixedArrayElement(
-    TNode<Object> elements, TNode<IntPtrT> index) {
+    TNode<HeapObject> elements, TNode<IntPtrT> index) {
   TNode<Object> element = LoadFixedArrayElement(elements, index);
   return Select<Object>(IsTheHole(element), [=] { return UndefinedConstant(); },
                         [=] { return element; });
 }
 
 TNode<Object> BaseCollectionsAssembler::LoadAndNormalizeFixedDoubleArrayElement(
-    TNode<Object> elements, TNode<IntPtrT> index) {
+    TNode<HeapObject> elements, TNode<IntPtrT> index) {
   TVARIABLE(Object, entry);
   Label if_hole(this, Label::kDeferred), next(this);
-  TNode<Float64T> element = UncheckedCast<Float64T>(LoadFixedDoubleArrayElement(
-      elements, index, MachineType::Float64(), 0, INTPTR_PARAMETERS, &if_hole));
+  TNode<Float64T> element =
+      LoadFixedDoubleArrayElement(CAST(elements), index, MachineType::Float64(),
+                                  0, INTPTR_PARAMETERS, &if_hole);
   {  // not hole
     entry = AllocateHeapNumberWithValue(element);
     Goto(&next);
@@ -529,7 +530,7 @@ void BaseCollectionsAssembler::LoadKeyValue(
     TNode<JSArray> array = CAST(maybe_array);
     TNode<Smi> length = LoadFastJSArrayLength(array);
     TNode<FixedArrayBase> elements = LoadElements(array);
-    TNode<Int32T> elements_kind = LoadMapElementsKind(LoadMap(array));
+    TNode<Int32T> elements_kind = LoadElementsKind(array);
 
     Label if_smiorobjects(this), if_doubles(this);
     Branch(IsFastSmiOrTaggedElementsKind(elements_kind), &if_smiorobjects,
@@ -621,8 +622,6 @@ class CollectionsBuiltinsAssembler : public BaseCollectionsAssembler {
       : BaseCollectionsAssembler(state) {}
 
  protected:
-  template <typename CollectionType>
-  Node* AllocateOrderedHashTable();
   template <typename IteratorType>
   Node* AllocateJSCollectionIterator(Node* context, int map_index,
                                      Node* collection);
@@ -646,22 +645,6 @@ class CollectionsBuiltinsAssembler : public BaseCollectionsAssembler {
   std::tuple<Node*, Node*, Node*> NextSkipHoles(Node* table, Node* index,
                                                 Label* if_end);
 
-  // Builds code that finds OrderedHashTable entry for a key with hash code
-  // {hash} with using the comparison code generated by {key_compare}. The code
-  // jumps to {entry_found} if the key is found, or to {not_found} if the key
-  // was not found. In the {entry_found} branch, the variable
-  // entry_start_position will be bound to the index of the entry (relative to
-  // OrderedHashTable::kHashTableStartIndex).
-  //
-  // The {CollectionType} template parameter stands for the particular instance
-  // of OrderedHashTable, it should be OrderedHashMap or OrderedHashSet.
-  template <typename CollectionType>
-  void FindOrderedHashTableEntry(
-      Node* table, Node* hash,
-      std::function<void(Node* other, Label* if_same, Label* if_not_same)>
-          key_compare,
-      Variable* entry_start_position, Label* entry_found, Label* not_found);
-
   // Specialization for Smi.
   // The {result} variable will contain the entry index if the key was found,
   // or the hash code otherwise.
@@ -735,58 +718,6 @@ class CollectionsBuiltinsAssembler : public BaseCollectionsAssembler {
                                    Node* const occupancy);
 };
 
-template <typename CollectionType>
-Node* CollectionsBuiltinsAssembler::AllocateOrderedHashTable() {
-  static const int kCapacity = CollectionType::kMinCapacity;
-  static const int kBucketCount = kCapacity / CollectionType::kLoadFactor;
-  static const int kDataTableLength = kCapacity * CollectionType::kEntrySize;
-  static const int kFixedArrayLength =
-      CollectionType::kHashTableStartIndex + kBucketCount + kDataTableLength;
-  static const int kDataTableStartIndex =
-      CollectionType::kHashTableStartIndex + kBucketCount;
-
-  STATIC_ASSERT(base::bits::IsPowerOfTwo(kCapacity));
-  STATIC_ASSERT(kCapacity <= CollectionType::kMaxCapacity);
-
-  // Allocate the table and add the proper map.
-  const ElementsKind elements_kind = HOLEY_ELEMENTS;
-  Node* const length_intptr = IntPtrConstant(kFixedArrayLength);
-  Node* const fixed_array_map = LoadRoot(
-      static_cast<Heap::RootListIndex>(CollectionType::GetMapRootIndex()));
-  Node* const table =
-      AllocateFixedArray(elements_kind, length_intptr, INTPTR_PARAMETERS,
-                         kAllowLargeObjectAllocation, fixed_array_map);
-
-  // Initialize the OrderedHashTable fields.
-  const WriteBarrierMode barrier_mode = SKIP_WRITE_BARRIER;
-  StoreFixedArrayElement(table, CollectionType::kNumberOfElementsIndex,
-                         SmiConstant(0), barrier_mode);
-  StoreFixedArrayElement(table, CollectionType::kNumberOfDeletedElementsIndex,
-                         SmiConstant(0), barrier_mode);
-  StoreFixedArrayElement(table, CollectionType::kNumberOfBucketsIndex,
-                         SmiConstant(kBucketCount), barrier_mode);
-
-  // Fill the buckets with kNotFound.
-  Node* const not_found = SmiConstant(CollectionType::kNotFound);
-  STATIC_ASSERT(CollectionType::kHashTableStartIndex ==
-                CollectionType::kNumberOfBucketsIndex + 1);
-  STATIC_ASSERT((CollectionType::kHashTableStartIndex + kBucketCount) ==
-                kDataTableStartIndex);
-  for (int i = 0; i < kBucketCount; i++) {
-    StoreFixedArrayElement(table, CollectionType::kHashTableStartIndex + i,
-                           not_found, barrier_mode);
-  }
-
-  // Fill the data table with undefined.
-  STATIC_ASSERT(kDataTableStartIndex + kDataTableLength == kFixedArrayLength);
-  for (int i = 0; i < kDataTableLength; i++) {
-    StoreFixedArrayElement(table, kDataTableStartIndex + i, UndefinedConstant(),
-                           barrier_mode);
-  }
-
-  return table;
-}
-
 template <typename IteratorType>
 Node* CollectionsBuiltinsAssembler::AllocateJSCollectionIterator(
     Node* context, int map_index, Node* collection) {
@@ -814,11 +745,23 @@ TNode<Object> CollectionsBuiltinsAssembler::AllocateTable(
 }
 
 TF_BUILTIN(MapConstructor, CollectionsBuiltinsAssembler) {
-  GenerateConstructor(kMap, isolate()->factory()->Map_string());
+  TNode<Object> new_target = CAST(Parameter(Descriptor::kJSNewTarget));
+  TNode<IntPtrT> argc =
+      ChangeInt32ToIntPtr(Parameter(Descriptor::kJSActualArgumentsCount));
+  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
+
+  GenerateConstructor(kMap, isolate()->factory()->Map_string(), new_target,
+                      argc, context);
 }
 
 TF_BUILTIN(SetConstructor, CollectionsBuiltinsAssembler) {
-  GenerateConstructor(kSet, isolate()->factory()->Set_string());
+  TNode<Object> new_target = CAST(Parameter(Descriptor::kJSNewTarget));
+  TNode<IntPtrT> argc =
+      ChangeInt32ToIntPtr(Parameter(Descriptor::kJSActualArgumentsCount));
+  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
+
+  GenerateConstructor(kSet, isolate()->factory()->Set_string(), new_target,
+                      argc, context);
 }
 
 Node* CollectionsBuiltinsAssembler::CallGetOrCreateHashRaw(Node* const key) {
@@ -837,8 +780,8 @@ Node* CollectionsBuiltinsAssembler::CallGetOrCreateHashRaw(Node* const key) {
 }
 
 Node* CollectionsBuiltinsAssembler::CallGetHashRaw(Node* const key) {
-  Node* const function_addr = ExternalConstant(
-      ExternalReference::orderedhashmap_gethash_raw(isolate()));
+  Node* const function_addr =
+      ExternalConstant(ExternalReference::orderedhashmap_gethash_raw());
   Node* const isolate_ptr =
       ExternalConstant(ExternalReference::isolate_address(isolate()));
 
@@ -1053,78 +996,9 @@ void CollectionsBuiltinsAssembler::SameValueZeroHeapNumber(Node* key_float,
   }
 }
 
-template <typename CollectionType>
-void CollectionsBuiltinsAssembler::FindOrderedHashTableEntry(
-    Node* table, Node* hash,
-    std::function<void(Node*, Label*, Label*)> key_compare,
-    Variable* entry_start_position, Label* entry_found, Label* not_found) {
-  // Get the index of the bucket.
-  Node* const number_of_buckets = SmiUntag(CAST(
-      LoadFixedArrayElement(table, CollectionType::kNumberOfBucketsIndex)));
-  Node* const bucket =
-      WordAnd(hash, IntPtrSub(number_of_buckets, IntPtrConstant(1)));
-  Node* const first_entry = SmiUntag(CAST(LoadFixedArrayElement(
-      table, bucket, CollectionType::kHashTableStartIndex * kPointerSize)));
-
-  // Walk the bucket chain.
-  Node* entry_start;
-  Label if_key_found(this);
-  {
-    VARIABLE(var_entry, MachineType::PointerRepresentation(), first_entry);
-    Label loop(this, {&var_entry, entry_start_position}),
-        continue_next_entry(this);
-    Goto(&loop);
-    BIND(&loop);
-
-    // If the entry index is the not-found sentinel, we are done.
-    GotoIf(
-        WordEqual(var_entry.value(), IntPtrConstant(CollectionType::kNotFound)),
-        not_found);
-
-    // Make sure the entry index is within range.
-    CSA_ASSERT(
-        this,
-        UintPtrLessThan(
-            var_entry.value(),
-            SmiUntag(SmiAdd(
-                CAST(LoadFixedArrayElement(
-                    table, CollectionType::kNumberOfElementsIndex)),
-                CAST(LoadFixedArrayElement(
-                    table, CollectionType::kNumberOfDeletedElementsIndex))))));
-
-    // Compute the index of the entry relative to kHashTableStartIndex.
-    entry_start =
-        IntPtrAdd(IntPtrMul(var_entry.value(),
-                            IntPtrConstant(CollectionType::kEntrySize)),
-                  number_of_buckets);
-
-    // Load the key from the entry.
-    Node* const candidate_key = LoadFixedArrayElement(
-        table, entry_start,
-        CollectionType::kHashTableStartIndex * kPointerSize);
-
-    key_compare(candidate_key, &if_key_found, &continue_next_entry);
-
-    BIND(&continue_next_entry);
-    // Load the index of the next entry in the bucket chain.
-    var_entry.Bind(SmiUntag(CAST(LoadFixedArrayElement(
-        table, entry_start,
-        (CollectionType::kHashTableStartIndex + CollectionType::kChainOffset) *
-            kPointerSize))));
-
-    Goto(&loop);
-  }
-
-  BIND(&if_key_found);
-  entry_start_position->Bind(entry_start);
-  Goto(entry_found);
-}
-
 TF_BUILTIN(OrderedHashTableHealIndex, CollectionsBuiltinsAssembler) {
-  Node* table = Parameter(Descriptor::kTable);
-  Node* index = Parameter(Descriptor::kIndex);
-  CSA_ASSERT(this, TaggedIsNotSmi(table));
-  CSA_ASSERT(this, TaggedIsSmi(index));
+  TNode<HeapObject> table = CAST(Parameter(Descriptor::kTable));
+  TNode<Smi> index = CAST(Parameter(Descriptor::kIndex));
   Label return_index(this), return_zero(this);
 
   // Check if we need to update the {index}.
@@ -1145,8 +1019,8 @@ TF_BUILTIN(OrderedHashTableHealIndex, CollectionsBuiltinsAssembler) {
   {
     Node* i = var_i.value();
     GotoIfNot(IntPtrLessThan(i, number_of_deleted_elements), &return_index);
-    Node* removed_index = LoadFixedArrayElement(
-        table, i, OrderedHashTableBase::kRemovedHolesIndex * kPointerSize);
+    TNode<Smi> removed_index = CAST(LoadFixedArrayElement(
+        table, i, OrderedHashTableBase::kRemovedHolesIndex * kPointerSize));
     GotoIf(SmiGreaterThanOrEqual(removed_index, index), &return_index);
     Decrement(&var_index, 1, SMI_PARAMETERS);
     Increment(&var_i);
@@ -1258,8 +1132,8 @@ TF_BUILTIN(MapPrototypeGet, CollectionsBuiltinsAssembler) {
   ThrowIfNotInstanceType(context, receiver, JS_MAP_TYPE, "Map.prototype.get");
 
   Node* const table = LoadObjectField(receiver, JSMap::kTableOffset);
-  Node* index =
-      CallBuiltin(Builtins::kFindOrderedHashMapEntry, context, table, key);
+  TNode<Smi> index = CAST(
+      CallBuiltin(Builtins::kFindOrderedHashMapEntry, context, table, key));
 
   Label if_found(this), if_not_found(this);
   Branch(SmiGreaterThanOrEqual(index, SmiConstant(0)), &if_found,
@@ -1283,8 +1157,8 @@ TF_BUILTIN(MapPrototypeHas, CollectionsBuiltinsAssembler) {
   ThrowIfNotInstanceType(context, receiver, JS_MAP_TYPE, "Map.prototype.has");
 
   Node* const table = LoadObjectField(receiver, JSMap::kTableOffset);
-  Node* index =
-      CallBuiltin(Builtins::kFindOrderedHashMapEntry, context, table, key);
+  TNode<Smi> index = CAST(
+      CallBuiltin(Builtins::kFindOrderedHashMapEntry, context, table, key));
 
   Label if_found(this), if_not_found(this);
   Branch(SmiGreaterThanOrEqual(index, SmiConstant(0)), &if_found,
@@ -1420,8 +1294,8 @@ void CollectionsBuiltinsAssembler::StoreOrderedHashMapNewEntry(
                          OrderedHashMap::kHashTableStartIndex * kPointerSize);
 
   // Bump the elements count.
-  Node* const number_of_elements =
-      LoadObjectField(table, OrderedHashMap::kNumberOfElementsOffset);
+  TNode<Smi> const number_of_elements =
+      CAST(LoadObjectField(table, OrderedHashMap::kNumberOfElementsOffset));
   StoreObjectFieldNoWriteBarrier(table, OrderedHashMap::kNumberOfElementsOffset,
                                  SmiAdd(number_of_elements, SmiConstant(1)));
 }
@@ -1458,20 +1332,20 @@ TF_BUILTIN(MapPrototypeDelete, CollectionsBuiltinsAssembler) {
                                          OrderedHashMap::kValueOffset));
 
   // Decrement the number of elements, increment the number of deleted elements.
-  Node* const number_of_elements = SmiSub(
+  TNode<Smi> const number_of_elements = SmiSub(
       CAST(LoadObjectField(table, OrderedHashMap::kNumberOfElementsOffset)),
       SmiConstant(1));
   StoreObjectFieldNoWriteBarrier(table, OrderedHashMap::kNumberOfElementsOffset,
                                  number_of_elements);
-  Node* const number_of_deleted =
+  TNode<Smi> const number_of_deleted =
       SmiAdd(CAST(LoadObjectField(
                  table, OrderedHashMap::kNumberOfDeletedElementsOffset)),
              SmiConstant(1));
   StoreObjectFieldNoWriteBarrier(
       table, OrderedHashMap::kNumberOfDeletedElementsOffset, number_of_deleted);
 
-  Node* const number_of_buckets =
-      LoadFixedArrayElement(table, OrderedHashMap::kNumberOfBucketsIndex);
+  TNode<Smi> const number_of_buckets =
+      CAST(LoadFixedArrayElement(table, OrderedHashMap::kNumberOfBucketsIndex));
 
   // If there fewer elements than #buckets / 2, shrink the table.
   Label shrink(this);
@@ -1583,8 +1457,8 @@ void CollectionsBuiltinsAssembler::StoreOrderedHashSetNewEntry(
                          OrderedHashSet::kHashTableStartIndex * kPointerSize);
 
   // Bump the elements count.
-  Node* const number_of_elements =
-      LoadObjectField(table, OrderedHashSet::kNumberOfElementsOffset);
+  TNode<Smi> const number_of_elements =
+      CAST(LoadObjectField(table, OrderedHashSet::kNumberOfElementsOffset));
   StoreObjectFieldNoWriteBarrier(table, OrderedHashSet::kNumberOfElementsOffset,
                                  SmiAdd(number_of_elements, SmiConstant(1)));
 }
@@ -1617,20 +1491,20 @@ TF_BUILTIN(SetPrototypeDelete, CollectionsBuiltinsAssembler) {
                          kPointerSize * OrderedHashSet::kHashTableStartIndex);
 
   // Decrement the number of elements, increment the number of deleted elements.
-  Node* const number_of_elements = SmiSub(
+  TNode<Smi> const number_of_elements = SmiSub(
       CAST(LoadObjectField(table, OrderedHashSet::kNumberOfElementsOffset)),
       SmiConstant(1));
   StoreObjectFieldNoWriteBarrier(table, OrderedHashSet::kNumberOfElementsOffset,
                                  number_of_elements);
-  Node* const number_of_deleted =
+  TNode<Smi> const number_of_deleted =
       SmiAdd(CAST(LoadObjectField(
                  table, OrderedHashSet::kNumberOfDeletedElementsOffset)),
              SmiConstant(1));
   StoreObjectFieldNoWriteBarrier(
       table, OrderedHashSet::kNumberOfDeletedElementsOffset, number_of_deleted);
 
-  Node* const number_of_buckets =
-      LoadFixedArrayElement(table, OrderedHashSet::kNumberOfBucketsIndex);
+  TNode<Smi> const number_of_buckets =
+      CAST(LoadFixedArrayElement(table, OrderedHashSet::kNumberOfBucketsIndex));
 
   // If there fewer elements than #buckets / 2, shrink the table.
   Label shrink(this);
@@ -1664,8 +1538,8 @@ TF_BUILTIN(MapPrototypeGetSize, CollectionsBuiltinsAssembler) {
 
 TF_BUILTIN(MapPrototypeForEach, CollectionsBuiltinsAssembler) {
   const char* const kMethodName = "Map.prototype.forEach";
-  Node* const argc = Parameter(BuiltinDescriptor::kArgumentsCount);
-  Node* const context = Parameter(BuiltinDescriptor::kContext);
+  Node* const argc = Parameter(Descriptor::kJSActualArgumentsCount);
+  Node* const context = Parameter(Descriptor::kContext);
   CodeStubArguments args(this, ChangeInt32ToIntPtr(argc));
   Node* const receiver = args.GetReceiver();
   Node* const callback = args.GetOptionalArgumentValue(0);
@@ -1895,8 +1769,8 @@ TF_BUILTIN(SetPrototypeGetSize, CollectionsBuiltinsAssembler) {
 
 TF_BUILTIN(SetPrototypeForEach, CollectionsBuiltinsAssembler) {
   const char* const kMethodName = "Set.prototype.forEach";
-  Node* const argc = Parameter(BuiltinDescriptor::kArgumentsCount);
-  Node* const context = Parameter(BuiltinDescriptor::kContext);
+  Node* const argc = Parameter(Descriptor::kJSActualArgumentsCount);
+  Node* const context = Parameter(Descriptor::kContext);
   CodeStubArguments args(this, ChangeInt32ToIntPtr(argc));
   Node* const receiver = args.GetReceiver();
   Node* const callback = args.GetOptionalArgumentValue(0);
@@ -2094,7 +1968,7 @@ class WeakCollectionsBuiltinsAssembler : public BaseCollectionsAssembler {
       : BaseCollectionsAssembler(state) {}
 
  protected:
-  void AddEntry(TNode<Object> table, TNode<IntPtrT> key_index,
+  void AddEntry(TNode<HeapObject> table, TNode<IntPtrT> key_index,
                 TNode<Object> key, TNode<Object> value,
                 TNode<IntPtrT> number_of_elements);
 
@@ -2105,24 +1979,25 @@ class WeakCollectionsBuiltinsAssembler : public BaseCollectionsAssembler {
   TNode<Smi> CreateIdentityHash(TNode<Object> receiver);
   TNode<IntPtrT> EntryMask(TNode<IntPtrT> capacity);
 
-  // Builds code that finds the ObjectHashTable entry for a {key} using the
+  // Builds code that finds the EphemeronHashTable entry for a {key} using the
   // comparison code generated by {key_compare}. The key index is returned if
   // the {key} is found.
   typedef std::function<void(TNode<Object> entry_key, Label* if_same)>
       KeyComparator;
-  TNode<IntPtrT> FindKeyIndex(TNode<Object> table, TNode<IntPtrT> key_hash,
+  TNode<IntPtrT> FindKeyIndex(TNode<HeapObject> table, TNode<IntPtrT> key_hash,
                               TNode<IntPtrT> entry_mask,
                               const KeyComparator& key_compare);
 
-  // Builds code that finds an ObjectHashTable entry available for a new entry.
-  TNode<IntPtrT> FindKeyIndexForInsertion(TNode<Object> table,
+  // Builds code that finds an EphemeronHashTable entry available for a new
+  // entry.
+  TNode<IntPtrT> FindKeyIndexForInsertion(TNode<HeapObject> table,
                                           TNode<IntPtrT> key_hash,
                                           TNode<IntPtrT> entry_mask);
 
-  // Builds code that finds the ObjectHashTable entry with key that matches
+  // Builds code that finds the EphemeronHashTable entry with key that matches
   // {key} and returns the entry's key index. If {key} cannot be found, jumps to
   // {if_not_found}.
-  TNode<IntPtrT> FindKeyIndexForKey(TNode<Object> table, TNode<Object> key,
+  TNode<IntPtrT> FindKeyIndexForKey(TNode<HeapObject> table, TNode<Object> key,
                                     TNode<IntPtrT> hash,
                                     TNode<IntPtrT> entry_mask,
                                     Label* if_not_found);
@@ -2132,12 +2007,12 @@ class WeakCollectionsBuiltinsAssembler : public BaseCollectionsAssembler {
                                            TNode<IntPtrT> number_of_deleted);
   TNode<IntPtrT> KeyIndexFromEntry(TNode<IntPtrT> entry);
 
-  TNode<IntPtrT> LoadNumberOfElements(TNode<Object> table, int offset);
-  TNode<IntPtrT> LoadNumberOfDeleted(TNode<Object> table, int offset = 0);
-  TNode<Object> LoadTable(SloppyTNode<Object> collection);
-  TNode<IntPtrT> LoadTableCapacity(TNode<Object> table);
+  TNode<IntPtrT> LoadNumberOfElements(TNode<HeapObject> table, int offset);
+  TNode<IntPtrT> LoadNumberOfDeleted(TNode<HeapObject> table, int offset = 0);
+  TNode<HeapObject> LoadTable(SloppyTNode<HeapObject> collection);
+  TNode<IntPtrT> LoadTableCapacity(TNode<HeapObject> table);
 
-  void RemoveEntry(TNode<Object> table, TNode<IntPtrT> key_index,
+  void RemoveEntry(TNode<HeapObject> table, TNode<IntPtrT> key_index,
                    TNode<IntPtrT> number_of_elements);
   TNode<BoolT> ShouldRehash(TNode<IntPtrT> number_of_elements,
                             TNode<IntPtrT> number_of_deleted);
@@ -2147,15 +2022,15 @@ class WeakCollectionsBuiltinsAssembler : public BaseCollectionsAssembler {
 };
 
 void WeakCollectionsBuiltinsAssembler::AddEntry(
-    TNode<Object> table, TNode<IntPtrT> key_index, TNode<Object> key,
+    TNode<HeapObject> table, TNode<IntPtrT> key_index, TNode<Object> key,
     TNode<Object> value, TNode<IntPtrT> number_of_elements) {
-  // See ObjectHashTable::AddEntry().
+  // See EphemeronHashTable::AddEntry().
   TNode<IntPtrT> value_index = ValueIndexFromKeyIndex(key_index);
   StoreFixedArrayElement(table, key_index, key);
   StoreFixedArrayElement(table, value_index, value);
 
   // See HashTableBase::ElementAdded().
-  StoreFixedArrayElement(table, ObjectHashTable::kNumberOfElementsIndex,
+  StoreFixedArrayElement(table, EphemeronHashTable::kNumberOfElementsIndex,
                          SmiFromIntPtr(number_of_elements), SKIP_WRITE_BARRIER);
 }
 
@@ -2169,17 +2044,18 @@ TNode<Object> WeakCollectionsBuiltinsAssembler::AllocateTable(
 
   // See HashTable::NewInternal().
   TNode<IntPtrT> length = KeyIndexFromEntry(capacity);
-  TNode<Object> table = CAST(AllocateFixedArray(
-      HOLEY_ELEMENTS, length, INTPTR_PARAMETERS, kAllowLargeObjectAllocation));
+  TNode<FixedArray> table =
+      AllocateFixedArray(HOLEY_ELEMENTS, length, kAllowLargeObjectAllocation);
 
-  Heap::RootListIndex map_root_index =
-      static_cast<Heap::RootListIndex>(ObjectHashTableShape::GetMapRootIndex());
+  Heap::RootListIndex map_root_index = static_cast<Heap::RootListIndex>(
+      EphemeronHashTableShape::GetMapRootIndex());
   StoreMapNoWriteBarrier(table, map_root_index);
-  StoreFixedArrayElement(table, ObjectHashTable::kNumberOfElementsIndex,
+  StoreFixedArrayElement(table, EphemeronHashTable::kNumberOfElementsIndex,
                          SmiConstant(0), SKIP_WRITE_BARRIER);
-  StoreFixedArrayElement(table, ObjectHashTable::kNumberOfDeletedElementsIndex,
+  StoreFixedArrayElement(table,
+                         EphemeronHashTable::kNumberOfDeletedElementsIndex,
                          SmiConstant(0), SKIP_WRITE_BARRIER);
-  StoreFixedArrayElement(table, ObjectHashTable::kCapacityIndex,
+  StoreFixedArrayElement(table, EphemeronHashTable::kCapacityIndex,
                          SmiFromIntPtr(capacity), SKIP_WRITE_BARRIER);
 
   TNode<IntPtrT> start = KeyIndexFromEntry(IntPtrConstant(0));
@@ -2208,7 +2084,7 @@ TNode<IntPtrT> WeakCollectionsBuiltinsAssembler::EntryMask(
 }
 
 TNode<IntPtrT> WeakCollectionsBuiltinsAssembler::FindKeyIndex(
-    TNode<Object> table, TNode<IntPtrT> key_hash, TNode<IntPtrT> entry_mask,
+    TNode<HeapObject> table, TNode<IntPtrT> key_hash, TNode<IntPtrT> entry_mask,
     const KeyComparator& key_compare) {
   // See HashTable::FirstProbe().
   TVARIABLE(IntPtrT, var_entry, WordAnd(key_hash, entry_mask));
@@ -2237,7 +2113,8 @@ TNode<IntPtrT> WeakCollectionsBuiltinsAssembler::FindKeyIndex(
 }
 
 TNode<IntPtrT> WeakCollectionsBuiltinsAssembler::FindKeyIndexForInsertion(
-    TNode<Object> table, TNode<IntPtrT> key_hash, TNode<IntPtrT> entry_mask) {
+    TNode<HeapObject> table, TNode<IntPtrT> key_hash,
+    TNode<IntPtrT> entry_mask) {
   // See HashTable::FindInsertionEntry().
   auto is_not_live = [&](TNode<Object> entry_key, Label* if_found) {
     // This is the the negative form BaseShape::IsLive().
@@ -2247,7 +2124,7 @@ TNode<IntPtrT> WeakCollectionsBuiltinsAssembler::FindKeyIndexForInsertion(
 }
 
 TNode<IntPtrT> WeakCollectionsBuiltinsAssembler::FindKeyIndexForKey(
-    TNode<Object> table, TNode<Object> key, TNode<IntPtrT> hash,
+    TNode<HeapObject> table, TNode<Object> key, TNode<IntPtrT> hash,
     TNode<IntPtrT> entry_mask, Label* if_not_found) {
   // See HashTable::FindEntry().
   auto match_key_or_exit_on_empty = [&](TNode<Object> entry_key,
@@ -2263,34 +2140,34 @@ TNode<IntPtrT> WeakCollectionsBuiltinsAssembler::KeyIndexFromEntry(
   // See HashTable::KeyAt().
   // (entry * kEntrySize) + kElementsStartIndex + kEntryKeyIndex
   return IntPtrAdd(
-      IntPtrMul(entry, IntPtrConstant(ObjectHashTable::kEntrySize)),
-      IntPtrConstant(ObjectHashTable::kElementsStartIndex +
-                     ObjectHashTable::kEntryKeyIndex));
+      IntPtrMul(entry, IntPtrConstant(EphemeronHashTable::kEntrySize)),
+      IntPtrConstant(EphemeronHashTable::kElementsStartIndex +
+                     EphemeronHashTable::kEntryKeyIndex));
 }
 
 TNode<IntPtrT> WeakCollectionsBuiltinsAssembler::LoadNumberOfElements(
-    TNode<Object> table, int offset) {
-  TNode<IntPtrT> number_of_elements = SmiUntag(CAST(
-      LoadFixedArrayElement(table, ObjectHashTable::kNumberOfElementsIndex)));
+    TNode<HeapObject> table, int offset) {
+  TNode<IntPtrT> number_of_elements = SmiUntag(CAST(LoadFixedArrayElement(
+      table, EphemeronHashTable::kNumberOfElementsIndex)));
   return IntPtrAdd(number_of_elements, IntPtrConstant(offset));
 }
 
 TNode<IntPtrT> WeakCollectionsBuiltinsAssembler::LoadNumberOfDeleted(
-    TNode<Object> table, int offset) {
+    TNode<HeapObject> table, int offset) {
   TNode<IntPtrT> number_of_deleted = SmiUntag(CAST(LoadFixedArrayElement(
-      table, ObjectHashTable::kNumberOfDeletedElementsIndex)));
+      table, EphemeronHashTable::kNumberOfDeletedElementsIndex)));
   return IntPtrAdd(number_of_deleted, IntPtrConstant(offset));
 }
 
-TNode<Object> WeakCollectionsBuiltinsAssembler::LoadTable(
-    SloppyTNode<Object> collection) {
-  return LoadObjectField(CAST(collection), JSWeakCollection::kTableOffset);
+TNode<HeapObject> WeakCollectionsBuiltinsAssembler::LoadTable(
+    SloppyTNode<HeapObject> collection) {
+  return CAST(LoadObjectField(collection, JSWeakCollection::kTableOffset));
 }
 
 TNode<IntPtrT> WeakCollectionsBuiltinsAssembler::LoadTableCapacity(
-    TNode<Object> table) {
+    TNode<HeapObject> table) {
   return SmiUntag(
-      CAST(LoadFixedArrayElement(table, ObjectHashTable::kCapacityIndex)));
+      CAST(LoadFixedArrayElement(table, EphemeronHashTable::kCapacityIndex)));
 }
 
 TNode<Word32T> WeakCollectionsBuiltinsAssembler::InsufficientCapacityToAdd(
@@ -2312,18 +2189,19 @@ TNode<Word32T> WeakCollectionsBuiltinsAssembler::InsufficientCapacityToAdd(
 }
 
 void WeakCollectionsBuiltinsAssembler::RemoveEntry(
-    TNode<Object> table, TNode<IntPtrT> key_index,
+    TNode<HeapObject> table, TNode<IntPtrT> key_index,
     TNode<IntPtrT> number_of_elements) {
-  // See ObjectHashTable::RemoveEntry().
+  // See EphemeronHashTable::RemoveEntry().
   TNode<IntPtrT> value_index = ValueIndexFromKeyIndex(key_index);
   StoreFixedArrayElement(table, key_index, TheHoleConstant());
   StoreFixedArrayElement(table, value_index, TheHoleConstant());
 
   // See HashTableBase::ElementRemoved().
   TNode<IntPtrT> number_of_deleted = LoadNumberOfDeleted(table, 1);
-  StoreFixedArrayElement(table, ObjectHashTable::kNumberOfElementsIndex,
+  StoreFixedArrayElement(table, EphemeronHashTable::kNumberOfElementsIndex,
                          SmiFromIntPtr(number_of_elements), SKIP_WRITE_BARRIER);
-  StoreFixedArrayElement(table, ObjectHashTable::kNumberOfDeletedElementsIndex,
+  StoreFixedArrayElement(table,
+                         EphemeronHashTable::kNumberOfDeletedElementsIndex,
                          SmiFromIntPtr(number_of_deleted), SKIP_WRITE_BARRIER);
 }
 
@@ -2353,20 +2231,32 @@ TNode<Word32T> WeakCollectionsBuiltinsAssembler::ShouldShrink(
 TNode<IntPtrT> WeakCollectionsBuiltinsAssembler::ValueIndexFromKeyIndex(
     TNode<IntPtrT> key_index) {
   return IntPtrAdd(key_index,
-                   IntPtrConstant(ObjectHashTableShape::kEntryValueIndex -
-                                  ObjectHashTable::kEntryKeyIndex));
+                   IntPtrConstant(EphemeronHashTableShape::kEntryValueIndex -
+                                  EphemeronHashTable::kEntryKeyIndex));
 }
 
 TF_BUILTIN(WeakMapConstructor, WeakCollectionsBuiltinsAssembler) {
-  GenerateConstructor(kWeakMap, isolate()->factory()->WeakMap_string());
+  TNode<Object> new_target = CAST(Parameter(Descriptor::kJSNewTarget));
+  TNode<IntPtrT> argc =
+      ChangeInt32ToIntPtr(Parameter(Descriptor::kJSActualArgumentsCount));
+  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
+
+  GenerateConstructor(kWeakMap, isolate()->factory()->WeakMap_string(),
+                      new_target, argc, context);
 }
 
 TF_BUILTIN(WeakSetConstructor, WeakCollectionsBuiltinsAssembler) {
-  GenerateConstructor(kWeakSet, isolate()->factory()->WeakSet_string());
+  TNode<Object> new_target = CAST(Parameter(Descriptor::kJSNewTarget));
+  TNode<IntPtrT> argc =
+      ChangeInt32ToIntPtr(Parameter(Descriptor::kJSActualArgumentsCount));
+  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
+
+  GenerateConstructor(kWeakSet, isolate()->factory()->WeakSet_string(),
+                      new_target, argc, context);
 }
 
 TF_BUILTIN(WeakMapLookupHashIndex, WeakCollectionsBuiltinsAssembler) {
-  TNode<Object> table = CAST(Parameter(Descriptor::kTable));
+  TNode<HeapObject> table = CAST(Parameter(Descriptor::kTable));
   TNode<Object> key = CAST(Parameter(Descriptor::kKey));
 
   Label if_not_found(this);
@@ -2428,10 +2318,10 @@ TF_BUILTIN(WeakMapHas, WeakCollectionsBuiltinsAssembler) {
 }
 
 // Helper that removes the entry with a given key from the backing store
-// (ObjectHashTable) of a WeakMap or WeakSet.
+// (EphemeronHashTable) of a WeakMap or WeakSet.
 TF_BUILTIN(WeakCollectionDelete, WeakCollectionsBuiltinsAssembler) {
   TNode<Context> context = CAST(Parameter(Descriptor::kContext));
-  TNode<Object> collection = CAST(Parameter(Descriptor::kCollection));
+  TNode<HeapObject> collection = CAST(Parameter(Descriptor::kCollection));
   TNode<Object> key = CAST(Parameter(Descriptor::kKey));
 
   Label call_runtime(this), if_not_found(this);
@@ -2439,7 +2329,7 @@ TF_BUILTIN(WeakCollectionDelete, WeakCollectionsBuiltinsAssembler) {
   GotoIfNotJSReceiver(key, &if_not_found);
 
   TNode<IntPtrT> hash = LoadJSReceiverIdentityHash(key, &if_not_found);
-  TNode<Object> table = LoadTable(collection);
+  TNode<HeapObject> table = LoadTable(collection);
   TNode<IntPtrT> capacity = LoadTableCapacity(table);
   TNode<IntPtrT> key_index =
       FindKeyIndexForKey(table, key, hash, EntryMask(capacity), &if_not_found);
@@ -2457,19 +2347,19 @@ TF_BUILTIN(WeakCollectionDelete, WeakCollectionsBuiltinsAssembler) {
                      SmiTag(hash)));
 }
 
-// Helper that sets the key and value to the backing store (ObjectHashTable) of
-// a WeakMap or WeakSet.
+// Helper that sets the key and value to the backing store (EphemeronHashTable)
+// of a WeakMap or WeakSet.
 TF_BUILTIN(WeakCollectionSet, WeakCollectionsBuiltinsAssembler) {
   TNode<Context> context = CAST(Parameter(Descriptor::kContext));
-  TNode<Object> collection = CAST(Parameter(Descriptor::kCollection));
-  TNode<Object> key = CAST(Parameter(Descriptor::kKey));
+  TNode<HeapObject> collection = CAST(Parameter(Descriptor::kCollection));
+  TNode<JSReceiver> key = CAST(Parameter(Descriptor::kKey));
   TNode<Object> value = CAST(Parameter(Descriptor::kValue));
 
   CSA_ASSERT(this, IsJSReceiver(key));
 
   Label call_runtime(this), if_no_hash(this), if_not_found(this);
 
-  TNode<Object> table = LoadTable(collection);
+  TNode<HeapObject> table = LoadTable(collection);
   TNode<IntPtrT> capacity = LoadTableCapacity(table);
   TNode<IntPtrT> entry_mask = EntryMask(capacity);
 
diff --git a/deps/v8/src/builtins/builtins-collections.cc b/deps/v8/src/builtins/builtins-collections.cc
index e3c97d38413336..9a642e7d3b90aa 100644
--- a/deps/v8/src/builtins/builtins-collections.cc
+++ b/deps/v8/src/builtins/builtins-collections.cc
@@ -5,6 +5,7 @@
 #include "src/builtins/builtins-utils.h"
 #include "src/builtins/builtins.h"
 #include "src/objects-inl.h"
+#include "src/objects/js-collection-inl.h"
 
 namespace v8 {
 namespace internal {
@@ -13,16 +14,16 @@ BUILTIN(MapPrototypeClear) {
   HandleScope scope(isolate);
   const char* const kMethodName = "Map.prototype.clear";
   CHECK_RECEIVER(JSMap, map, kMethodName);
-  JSMap::Clear(map);
-  return isolate->heap()->undefined_value();
+  JSMap::Clear(isolate, map);
+  return ReadOnlyRoots(isolate).undefined_value();
 }
 
 BUILTIN(SetPrototypeClear) {
   HandleScope scope(isolate);
   const char* const kMethodName = "Set.prototype.clear";
   CHECK_RECEIVER(JSSet, set, kMethodName);
-  JSSet::Clear(set);
-  return isolate->heap()->undefined_value();
+  JSSet::Clear(isolate, set);
+  return ReadOnlyRoots(isolate).undefined_value();
 }
 
 }  // namespace internal
diff --git a/deps/v8/src/builtins/builtins-console-gen.cc b/deps/v8/src/builtins/builtins-console-gen.cc
index 0ddd90e3f19f40..249ec10a28b60b 100644
--- a/deps/v8/src/builtins/builtins-console-gen.cc
+++ b/deps/v8/src/builtins/builtins-console-gen.cc
@@ -16,9 +16,9 @@ TF_BUILTIN(FastConsoleAssert, CodeStubAssembler) {
 
   // TODO(ishell): use constants from Descriptor once the JSFunction linkage
   // arguments are reordered.
-  Node* argc = Parameter(BuiltinDescriptor::kArgumentsCount);
-  Node* context = Parameter(BuiltinDescriptor::kContext);
-  Node* new_target = Parameter(BuiltinDescriptor::kNewTarget);
+  Node* argc = Parameter(Descriptor::kJSActualArgumentsCount);
+  Node* context = Parameter(Descriptor::kContext);
+  Node* new_target = Parameter(Descriptor::kJSNewTarget);
   GotoIf(Word32Equal(argc, Int32Constant(0)), &runtime);
 
   CodeStubArguments args(this, ChangeInt32ToIntPtr(argc));
@@ -28,8 +28,10 @@ TF_BUILTIN(FastConsoleAssert, CodeStubAssembler) {
 
   BIND(&runtime);
   {
-    Node* target = LoadFromFrame(StandardFrameConstants::kFunctionOffset,
-                                 MachineType::TaggedPointer());
+    // We are not using Parameter(Descriptor::kJSTarget) and loading the value
+    // from the current frame here in order to reduce register pressure on the
+    // fast path.
+    TNode<JSFunction> target = LoadTargetFromFrame();
     TailCallBuiltin(Builtins::kConsoleAssert, context, target, new_target,
                     argc);
   }
diff --git a/deps/v8/src/builtins/builtins-console.cc b/deps/v8/src/builtins/builtins-console.cc
index 138db2a422b4b6..e19aefd2738465 100644
--- a/deps/v8/src/builtins/builtins-console.cc
+++ b/deps/v8/src/builtins/builtins-console.cc
@@ -30,12 +30,10 @@ namespace internal {
   V(GroupEnd, groupEnd)             \
   V(Clear, clear)                   \
   V(Count, count)                   \
+  V(CountReset, countReset)         \
   V(Assert, assert)                 \
-  V(MarkTimeline, markTimeline)     \
   V(Profile, profile)               \
-  V(ProfileEnd, profileEnd)         \
-  V(Timeline, timeline)             \
-  V(TimelineEnd, timelineEnd)
+  V(ProfileEnd, profileEnd)
 
 namespace {
 void ConsoleCall(
@@ -80,7 +78,7 @@ void LogTimerEvent(Isolate* isolate, BuiltinArguments args,
   BUILTIN(Console##call) {                                     \
     ConsoleCall(isolate, args, &debug::ConsoleDelegate::call); \
     RETURN_FAILURE_IF_SCHEDULED_EXCEPTION(isolate);            \
-    return isolate->heap()->undefined_value();                 \
+    return ReadOnlyRoots(isolate).undefined_value();           \
   }
 CONSOLE_METHOD_LIST(CONSOLE_BUILTIN_IMPLEMENTATION)
 #undef CONSOLE_BUILTIN_IMPLEMENTATION
@@ -89,28 +87,28 @@ BUILTIN(ConsoleTime) {
   LogTimerEvent(isolate, args, Logger::START);
   ConsoleCall(isolate, args, &debug::ConsoleDelegate::Time);
   RETURN_FAILURE_IF_SCHEDULED_EXCEPTION(isolate);
-  return isolate->heap()->undefined_value();
+  return ReadOnlyRoots(isolate).undefined_value();
 }
 
 BUILTIN(ConsoleTimeEnd) {
   LogTimerEvent(isolate, args, Logger::END);
   ConsoleCall(isolate, args, &debug::ConsoleDelegate::TimeEnd);
   RETURN_FAILURE_IF_SCHEDULED_EXCEPTION(isolate);
-  return isolate->heap()->undefined_value();
+  return ReadOnlyRoots(isolate).undefined_value();
 }
 
 BUILTIN(ConsoleTimeStamp) {
   LogTimerEvent(isolate, args, Logger::STAMP);
   ConsoleCall(isolate, args, &debug::ConsoleDelegate::TimeStamp);
   RETURN_FAILURE_IF_SCHEDULED_EXCEPTION(isolate);
-  return isolate->heap()->undefined_value();
+  return ReadOnlyRoots(isolate).undefined_value();
 }
 
 namespace {
-void InstallContextFunction(Handle<JSObject> target, const char* name,
-                            Builtins::Name builtin_id, int context_id,
-                            Handle<Object> context_name) {
-  Factory* const factory = target->GetIsolate()->factory();
+void InstallContextFunction(Isolate* isolate, Handle<JSObject> target,
+                            const char* name, Builtins::Name builtin_id,
+                            int context_id, Handle<Object> context_name) {
+  Factory* const factory = isolate->factory();
 
   Handle<String> name_string =
       Name::ToFunctionName(factory->InternalizeUtf8String(name))
@@ -123,14 +121,13 @@ void InstallContextFunction(Handle<JSObject> target, const char* name,
   fun->shared()->DontAdaptArguments();
   fun->shared()->set_length(1);
 
-  JSObject::AddProperty(fun, factory->console_context_id_symbol(),
-                        handle(Smi::FromInt(context_id), target->GetIsolate()),
-                        NONE);
+  JSObject::AddProperty(isolate, fun, factory->console_context_id_symbol(),
+                        handle(Smi::FromInt(context_id), isolate), NONE);
   if (context_name->IsString()) {
-    JSObject::AddProperty(fun, factory->console_context_name_symbol(),
+    JSObject::AddProperty(isolate, fun, factory->console_context_name_symbol(),
                           context_name, NONE);
   }
-  JSObject::AddProperty(target, name_string, fun, NONE);
+  JSObject::AddProperty(isolate, target, name_string, fun, NONE);
 }
 }  // namespace
 
@@ -151,17 +148,17 @@ BUILTIN(ConsoleContext) {
   int id = isolate->last_console_context_id() + 1;
   isolate->set_last_console_context_id(id);
 
-#define CONSOLE_BUILTIN_SETUP(call, name)                              \
-  InstallContextFunction(context, #name, Builtins::kConsole##call, id, \
-                         args.at(1));
+#define CONSOLE_BUILTIN_SETUP(call, name)                                   \
+  InstallContextFunction(isolate, context, #name, Builtins::kConsole##call, \
+                         id, args.at(1));
   CONSOLE_METHOD_LIST(CONSOLE_BUILTIN_SETUP)
 #undef CONSOLE_BUILTIN_SETUP
-  InstallContextFunction(context, "time", Builtins::kConsoleTime, id,
-                         args.at(1));
-  InstallContextFunction(context, "timeEnd", Builtins::kConsoleTimeEnd, id,
-                         args.at(1));
-  InstallContextFunction(context, "timeStamp", Builtins::kConsoleTimeStamp, id,
+  InstallContextFunction(isolate, context, "time", Builtins::kConsoleTime, id,
                          args.at(1));
+  InstallContextFunction(isolate, context, "timeEnd", Builtins::kConsoleTimeEnd,
+                         id, args.at(1));
+  InstallContextFunction(isolate, context, "timeStamp",
+                         Builtins::kConsoleTimeStamp, id, args.at(1));
 
   return *context;
 }
diff --git a/deps/v8/src/builtins/builtins-constructor-gen.cc b/deps/v8/src/builtins/builtins-constructor-gen.cc
index e16945ba26d354..76c28bc8698894 100644
--- a/deps/v8/src/builtins/builtins-constructor-gen.cc
+++ b/deps/v8/src/builtins/builtins-constructor-gen.cc
@@ -36,35 +36,25 @@ void Builtins::Generate_ConstructFunctionForwardVarargs(MacroAssembler* masm) {
 }
 
 TF_BUILTIN(ConstructWithArrayLike, CallOrConstructBuiltinsAssembler) {
-  Node* target = Parameter(ConstructWithArrayLikeDescriptor::kTarget);
-  Node* new_target = Parameter(ConstructWithArrayLikeDescriptor::kNewTarget);
-  Node* arguments_list =
-      Parameter(ConstructWithArrayLikeDescriptor::kArgumentsList);
-  Node* context = Parameter(ConstructWithArrayLikeDescriptor::kContext);
+  TNode<Object> target = CAST(Parameter(Descriptor::kTarget));
+  SloppyTNode<Object> new_target = CAST(Parameter(Descriptor::kNewTarget));
+  TNode<Object> arguments_list = CAST(Parameter(Descriptor::kArgumentsList));
+  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
   CallOrConstructWithArrayLike(target, new_target, arguments_list, context);
 }
 
 TF_BUILTIN(ConstructWithSpread, CallOrConstructBuiltinsAssembler) {
-  Node* target = Parameter(ConstructWithSpreadDescriptor::kTarget);
-  Node* new_target = Parameter(ConstructWithSpreadDescriptor::kNewTarget);
-  Node* spread = Parameter(ConstructWithSpreadDescriptor::kSpread);
-  Node* args_count = Parameter(ConstructWithSpreadDescriptor::kArgumentsCount);
-  Node* context = Parameter(ConstructWithSpreadDescriptor::kContext);
+  TNode<Object> target = CAST(Parameter(Descriptor::kTarget));
+  SloppyTNode<Object> new_target = CAST(Parameter(Descriptor::kNewTarget));
+  TNode<Object> spread = CAST(Parameter(Descriptor::kSpread));
+  TNode<Int32T> args_count =
+      UncheckedCast<Int32T>(Parameter(Descriptor::kActualArgumentsCount));
+  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
   CallOrConstructWithSpread(target, new_target, spread, args_count, context);
 }
 
 typedef compiler::Node Node;
 
-Node* ConstructorBuiltinsAssembler::NotHasBoilerplate(Node* literal_site) {
-  return TaggedIsSmi(literal_site);
-}
-
-Node* ConstructorBuiltinsAssembler::LoadAllocationSiteBoilerplate(Node* site) {
-  CSA_ASSERT(this, IsAllocationSite(site));
-  return LoadObjectField(site,
-                         AllocationSite::kTransitionInfoOrBoilerplateOffset);
-}
-
 TF_BUILTIN(FastNewClosure, ConstructorBuiltinsAssembler) {
   Node* shared_function_info = Parameter(Descriptor::kSharedFunctionInfo);
   Node* feedback_cell = Parameter(Descriptor::kFeedbackCell);
@@ -149,7 +139,7 @@ TF_BUILTIN(FastNewClosure, ConstructorBuiltinsAssembler) {
                                  shared_function_info);
   StoreObjectFieldNoWriteBarrier(result, JSFunction::kContextOffset, context);
   Handle<Code> lazy_builtin_handle(
-      isolate()->builtins()->builtin(Builtins::kCompileLazy));
+      isolate()->builtins()->builtin(Builtins::kCompileLazy), isolate());
   Node* lazy_builtin = HeapConstant(lazy_builtin_handle);
   StoreObjectFieldNoWriteBarrier(result, JSFunction::kCodeOffset, lazy_builtin);
   Return(result);
@@ -233,7 +223,7 @@ Node* ConstructorBuiltinsAssembler::EmitFastNewObject(Node* context,
 }
 
 Node* ConstructorBuiltinsAssembler::EmitFastNewFunctionContext(
-    Node* function, Node* slots, Node* context, ScopeType scope_type) {
+    Node* scope_info, Node* slots, Node* context, ScopeType scope_type) {
   slots = ChangeUint32ToWord(slots);
 
   // TODO(ishell): Use CSA::OptimalParameterMode() here.
@@ -261,8 +251,8 @@ Node* ConstructorBuiltinsAssembler::EmitFastNewFunctionContext(
                                  SmiTag(length));
 
   // Set up the fixed slots.
-  StoreFixedArrayElement(function_context, Context::CLOSURE_INDEX, function,
-                         SKIP_WRITE_BARRIER);
+  StoreFixedArrayElement(function_context, Context::SCOPE_INFO_INDEX,
+                         scope_info, SKIP_WRITE_BARRIER);
   StoreFixedArrayElement(function_context, Context::PREVIOUS_INDEX, context,
                          SKIP_WRITE_BARRIER);
   StoreFixedArrayElement(function_context, Context::EXTENSION_INDEX,
@@ -287,18 +277,18 @@ Node* ConstructorBuiltinsAssembler::EmitFastNewFunctionContext(
 }
 
 TF_BUILTIN(FastNewFunctionContextEval, ConstructorBuiltinsAssembler) {
-  Node* function = Parameter(FastNewFunctionContextDescriptor::kFunction);
-  Node* slots = Parameter(FastNewFunctionContextDescriptor::kSlots);
-  Node* context = Parameter(FastNewFunctionContextDescriptor::kContext);
-  Return(EmitFastNewFunctionContext(function, slots, context,
+  Node* scope_info = Parameter(Descriptor::kScopeInfo);
+  Node* slots = Parameter(Descriptor::kSlots);
+  Node* context = Parameter(Descriptor::kContext);
+  Return(EmitFastNewFunctionContext(scope_info, slots, context,
                                     ScopeType::EVAL_SCOPE));
 }
 
 TF_BUILTIN(FastNewFunctionContextFunction, ConstructorBuiltinsAssembler) {
-  Node* function = Parameter(FastNewFunctionContextDescriptor::kFunction);
-  Node* slots = Parameter(FastNewFunctionContextDescriptor::kSlots);
-  Node* context = Parameter(FastNewFunctionContextDescriptor::kContext);
-  Return(EmitFastNewFunctionContext(function, slots, context,
+  Node* scope_info = Parameter(Descriptor::kScopeInfo);
+  Node* slots = Parameter(Descriptor::kSlots);
+  Node* context = Parameter(Descriptor::kContext);
+  Return(EmitFastNewFunctionContext(scope_info, slots, context,
                                     ScopeType::FUNCTION_SCOPE));
 }
 
@@ -308,8 +298,8 @@ Node* ConstructorBuiltinsAssembler::EmitCreateRegExpLiteral(
   Label call_runtime(this, Label::kDeferred), end(this);
 
   VARIABLE(result, MachineRepresentation::kTagged);
-  Node* literal_site =
-      LoadFeedbackVectorSlot(feedback_vector, slot, 0, INTPTR_PARAMETERS);
+  TNode<Object> literal_site =
+      CAST(LoadFeedbackVectorSlot(feedback_vector, slot, 0, INTPTR_PARAMETERS));
   GotoIf(NotHasBoilerplate(literal_site), &call_runtime);
   {
     Node* boilerplate = literal_site;
@@ -353,17 +343,19 @@ Node* ConstructorBuiltinsAssembler::EmitCreateShallowArrayLiteral(
       return_result(this);
   VARIABLE(result, MachineRepresentation::kTagged);
 
-  Node* allocation_site =
-      LoadFeedbackVectorSlot(feedback_vector, slot, 0, INTPTR_PARAMETERS);
-  GotoIf(NotHasBoilerplate(allocation_site), call_runtime);
+  TNode<Object> maybe_allocation_site =
+      CAST(LoadFeedbackVectorSlot(feedback_vector, slot, 0, INTPTR_PARAMETERS));
+  GotoIf(NotHasBoilerplate(maybe_allocation_site), call_runtime);
 
-  Node* boilerplate = LoadAllocationSiteBoilerplate(allocation_site);
-  allocation_site =
-      allocation_site_mode == TRACK_ALLOCATION_SITE ? allocation_site : nullptr;
+  TNode<AllocationSite> allocation_site = CAST(maybe_allocation_site);
+  TNode<JSArray> boilerplate = CAST(LoadBoilerplate(allocation_site));
 
-  CSA_ASSERT(this, IsJSArrayMap(LoadMap(boilerplate)));
   ParameterMode mode = OptimalParameterMode();
-  return CloneFastJSArray(context, boilerplate, mode, allocation_site);
+  if (allocation_site_mode == TRACK_ALLOCATION_SITE) {
+    return CloneFastJSArray(context, boilerplate, mode, allocation_site);
+  } else {
+    return CloneFastJSArray(context, boilerplate, mode);
+  }
 }
 
 TF_BUILTIN(CreateShallowArrayLiteral, ConstructorBuiltinsAssembler) {
@@ -390,29 +382,28 @@ Node* ConstructorBuiltinsAssembler::EmitCreateEmptyArrayLiteral(
     Node* feedback_vector, Node* slot, Node* context) {
   // Array literals always have a valid AllocationSite to properly track
   // elements transitions.
-  VARIABLE(allocation_site, MachineRepresentation::kTagged,
-           LoadFeedbackVectorSlot(feedback_vector, slot, 0, INTPTR_PARAMETERS));
+  TNode<Object> maybe_allocation_site =
+      CAST(LoadFeedbackVectorSlot(feedback_vector, slot, 0, INTPTR_PARAMETERS));
+  TVARIABLE(AllocationSite, allocation_site);
 
   Label create_empty_array(this),
       initialize_allocation_site(this, Label::kDeferred), done(this);
-  Branch(TaggedIsSmi(allocation_site.value()), &initialize_allocation_site,
-         &create_empty_array);
-
+  GotoIf(TaggedIsSmi(maybe_allocation_site), &initialize_allocation_site);
+  {
+    allocation_site = CAST(maybe_allocation_site);
+    Goto(&create_empty_array);
+  }
   // TODO(cbruni): create the AllocationSite in CSA.
   BIND(&initialize_allocation_site);
   {
-    allocation_site.Bind(
-        CreateAllocationSiteInFeedbackVector(feedback_vector, SmiTag(slot)));
+    allocation_site =
+        CreateAllocationSiteInFeedbackVector(feedback_vector, SmiTag(slot));
     Goto(&create_empty_array);
   }
 
   BIND(&create_empty_array);
-  CSA_ASSERT(this, IsAllocationSite(allocation_site.value()));
-  Node* kind = SmiToInt32(CAST(
-      LoadObjectField(allocation_site.value(),
-                      AllocationSite::kTransitionInfoOrBoilerplateOffset)));
-  CSA_ASSERT(this, IsFastElementsKind(kind));
-  Node* native_context = LoadNativeContext(context);
+  TNode<Int32T> kind = LoadElementsKind(allocation_site.value());
+  TNode<Context> native_context = LoadNativeContext(context);
   Comment("LoadJSArrayElementsMap");
   Node* array_map = LoadJSArrayElementsMap(kind, native_context);
   Node* zero = SmiConstant(0);
@@ -437,12 +428,13 @@ TF_BUILTIN(CreateEmptyArrayLiteral, ConstructorBuiltinsAssembler) {
 
 Node* ConstructorBuiltinsAssembler::EmitCreateShallowObjectLiteral(
     Node* feedback_vector, Node* slot, Label* call_runtime) {
-  Node* allocation_site =
-      LoadFeedbackVectorSlot(feedback_vector, slot, 0, INTPTR_PARAMETERS);
-  GotoIf(NotHasBoilerplate(allocation_site), call_runtime);
+  TNode<Object> maybe_allocation_site =
+      CAST(LoadFeedbackVectorSlot(feedback_vector, slot, 0, INTPTR_PARAMETERS));
+  GotoIf(NotHasBoilerplate(maybe_allocation_site), call_runtime);
 
-  Node* boilerplate = LoadAllocationSiteBoilerplate(allocation_site);
-  Node* boilerplate_map = LoadMap(boilerplate);
+  TNode<AllocationSite> allocation_site = CAST(maybe_allocation_site);
+  TNode<JSObject> boilerplate = LoadBoilerplate(allocation_site);
+  TNode<Map> boilerplate_map = LoadMap(boilerplate);
   CSA_ASSERT(this, IsJSObjectMap(boilerplate_map));
 
   VARIABLE(var_properties, MachineRepresentation::kTagged);
@@ -456,8 +448,8 @@ Node* ConstructorBuiltinsAssembler::EmitCreateShallowObjectLiteral(
     BIND(&if_dictionary);
     {
       Comment("Copy dictionary properties");
-      var_properties.Bind(
-          CopyNameDictionary(LoadSlowProperties(boilerplate), call_runtime));
+      var_properties.Bind(CopyNameDictionary(
+          CAST(LoadSlowProperties(boilerplate)), call_runtime));
       // Slow objects have no in-object properties.
       Goto(&done);
     }
@@ -585,7 +577,7 @@ Node* ConstructorBuiltinsAssembler::EmitCreateShallowObjectLiteral(
                       {
                         Node* double_value = LoadHeapNumberValue(field);
                         Node* mutable_heap_number =
-                            AllocateHeapNumberWithValue(double_value, MUTABLE);
+                            AllocateMutableHeapNumberWithValue(double_value);
                         StoreObjectField(copy, offset, mutable_heap_number);
                         Goto(&continue_loop);
                       }
@@ -608,12 +600,12 @@ TF_BUILTIN(CreateShallowObjectLiteral, ConstructorBuiltinsAssembler) {
   Return(copy);
 
   BIND(&call_runtime);
-  Node* boilerplate_description =
-      Parameter(Descriptor::kBoilerplateDescription);
+  Node* object_boilerplate_description =
+      Parameter(Descriptor::kObjectBoilerplateDescription);
   Node* flags = Parameter(Descriptor::kFlags);
   Node* context = Parameter(Descriptor::kContext);
   TailCallRuntime(Runtime::kCreateObjectLiteral, context, feedback_vector,
-                  SmiTag(slot), boilerplate_description, flags);
+                  SmiTag(slot), object_boilerplate_description, flags);
 }
 
 // Used by the CreateEmptyObjectLiteral bytecode and the Object constructor.
@@ -639,17 +631,16 @@ Node* ConstructorBuiltinsAssembler::EmitCreateEmptyObjectLiteral(
 TF_BUILTIN(ObjectConstructor, ConstructorBuiltinsAssembler) {
   int const kValueArg = 0;
   Node* argc =
-      ChangeInt32ToIntPtr(Parameter(BuiltinDescriptor::kArgumentsCount));
+      ChangeInt32ToIntPtr(Parameter(Descriptor::kJSActualArgumentsCount));
   CodeStubArguments args(this, argc);
-  Node* context = Parameter(BuiltinDescriptor::kContext);
-  Node* new_target = Parameter(BuiltinDescriptor::kNewTarget);
+  Node* context = Parameter(Descriptor::kContext);
+  Node* new_target = Parameter(Descriptor::kJSNewTarget);
 
   VARIABLE(var_result, MachineRepresentation::kTagged);
   Label if_subclass(this, Label::kDeferred), if_notsubclass(this),
       return_result(this);
   GotoIf(IsUndefined(new_target), &if_notsubclass);
-  Node* target = LoadFromFrame(StandardFrameConstants::kFunctionOffset,
-                               MachineType::TaggedPointer());
+  TNode<JSFunction> target = CAST(Parameter(Descriptor::kJSTarget));
   Branch(WordEqual(new_target, target), &if_notsubclass, &if_subclass);
 
   BIND(&if_subclass);
@@ -691,9 +682,9 @@ TF_BUILTIN(ObjectConstructor, ConstructorBuiltinsAssembler) {
 
 // ES #sec-number-constructor
 TF_BUILTIN(NumberConstructor, ConstructorBuiltinsAssembler) {
-  Node* context = Parameter(BuiltinDescriptor::kContext);
+  Node* context = Parameter(Descriptor::kContext);
   Node* argc =
-      ChangeInt32ToIntPtr(Parameter(BuiltinDescriptor::kArgumentsCount));
+      ChangeInt32ToIntPtr(Parameter(Descriptor::kJSActualArgumentsCount));
   CodeStubArguments args(this, argc);
 
   // 1. If no arguments were passed to this function invocation, let n be +0.
@@ -713,7 +704,7 @@ TF_BUILTIN(NumberConstructor, ConstructorBuiltinsAssembler) {
   {
     // 3. If NewTarget is undefined, return n.
     Node* n_value = var_n.value();
-    Node* new_target = Parameter(BuiltinDescriptor::kNewTarget);
+    Node* new_target = Parameter(Descriptor::kJSNewTarget);
     Label return_n(this), constructnumber(this, Label::kDeferred);
     Branch(IsUndefined(new_target), &return_n, &constructnumber);
 
@@ -726,8 +717,11 @@ TF_BUILTIN(NumberConstructor, ConstructorBuiltinsAssembler) {
       //    "%NumberPrototype%", « [[NumberData]] »).
       // 5. Set O.[[NumberData]] to n.
       // 6. Return O.
-      Node* target = LoadFromFrame(StandardFrameConstants::kFunctionOffset,
-                                   MachineType::TaggedPointer());
+
+      // We are not using Parameter(Descriptor::kJSTarget) and loading the value
+      // from the current frame here in order to reduce register pressure on the
+      // fast path.
+      TNode<JSFunction> target = LoadTargetFromFrame();
       Node* result =
           CallBuiltin(Builtins::kFastNewObject, context, target, new_target);
       StoreObjectField(result, JSValue::kValueOffset, n_value);
@@ -738,14 +732,12 @@ TF_BUILTIN(NumberConstructor, ConstructorBuiltinsAssembler) {
 
 // https://tc39.github.io/ecma262/#sec-string-constructor
 TF_BUILTIN(StringConstructor, ConstructorBuiltinsAssembler) {
-  Node* context = Parameter(BuiltinDescriptor::kContext);
+  Node* context = Parameter(Descriptor::kContext);
   Node* argc =
-      ChangeInt32ToIntPtr(Parameter(BuiltinDescriptor::kArgumentsCount));
+      ChangeInt32ToIntPtr(Parameter(Descriptor::kJSActualArgumentsCount));
   CodeStubArguments args(this, argc);
 
-  Node* new_target = Parameter(BuiltinDescriptor::kNewTarget);
-  Node* target = LoadFromFrame(StandardFrameConstants::kFunctionOffset,
-                               MachineType::TaggedPointer());
+  TNode<Object> new_target = CAST(Parameter(Descriptor::kJSNewTarget));
 
   // 1. If no arguments were passed to this function invocation, let s be "".
   VARIABLE(var_s, MachineRepresentation::kTagged, EmptyStringConstant());
@@ -786,6 +778,11 @@ TF_BUILTIN(StringConstructor, ConstructorBuiltinsAssembler) {
 
     BIND(&constructstring);
     {
+      // We are not using Parameter(Descriptor::kJSTarget) and loading the value
+      // from the current frame here in order to reduce register pressure on the
+      // fast path.
+      TNode<JSFunction> target = LoadTargetFromFrame();
+
       Node* result =
           CallBuiltin(Builtins::kFastNewObject, context, target, new_target);
       StoreObjectField(result, JSValue::kValueOffset, s_value);
diff --git a/deps/v8/src/builtins/builtins-constructor-gen.h b/deps/v8/src/builtins/builtins-constructor-gen.h
index 820970961bb6ae..3079d9a4f79630 100644
--- a/deps/v8/src/builtins/builtins-constructor-gen.h
+++ b/deps/v8/src/builtins/builtins-constructor-gen.h
@@ -35,10 +35,6 @@ class ConstructorBuiltinsAssembler : public CodeStubAssembler {
 
   Node* EmitFastNewObject(Node* context, Node* target, Node* new_target,
                           Label* call_runtime);
-
- private:
-  Node* NotHasBoilerplate(Node* literal_site);
-  Node* LoadAllocationSiteBoilerplate(Node* allocation_site);
 };
 
 }  // namespace internal
diff --git a/deps/v8/src/builtins/builtins-conversion-gen.cc b/deps/v8/src/builtins/builtins-conversion-gen.cc
index 63a6dc0a9134d3..b1441adc372272 100644
--- a/deps/v8/src/builtins/builtins-conversion-gen.cc
+++ b/deps/v8/src/builtins/builtins-conversion-gen.cc
@@ -392,7 +392,7 @@ TF_BUILTIN(ToObject, CodeStubAssembler) {
 
 // ES6 section 12.5.5 typeof operator
 TF_BUILTIN(Typeof, CodeStubAssembler) {
-  Node* object = Parameter(TypeofDescriptor::kObject);
+  Node* object = Parameter(Descriptor::kObject);
 
   Return(Typeof(object));
 }
diff --git a/deps/v8/src/builtins/builtins-data-view-gen.h b/deps/v8/src/builtins/builtins-data-view-gen.h
new file mode 100644
index 00000000000000..cf4809efdd2b58
--- /dev/null
+++ b/deps/v8/src/builtins/builtins-data-view-gen.h
@@ -0,0 +1,67 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef V8_BUILTINS_BUILTINS_DATA_VIEW_GEN_H_
+#define V8_BUILTINS_BUILTINS_DATA_VIEW_GEN_H_
+
+#include "src/elements-kind.h"
+#include "src/objects/bigint.h"
+#include "torque-generated/builtins-base-from-dsl-gen.h"
+
+namespace v8 {
+namespace internal {
+
+class DataViewBuiltinsAssembler : public BaseBuiltinsFromDSLAssembler {
+ public:
+  explicit DataViewBuiltinsAssembler(compiler::CodeAssemblerState* state)
+      : BaseBuiltinsFromDSLAssembler(state) {}
+
+  TNode<Smi> LoadDataViewByteOffset(TNode<JSDataView> data_view) {
+    return CAST(LoadObjectField(data_view, JSDataView::kByteOffsetOffset));
+  }
+
+  TNode<Smi> LoadDataViewByteLength(TNode<JSDataView> data_view) {
+    return CAST(LoadObjectField(data_view, JSDataView::kByteLengthOffset));
+  }
+
+  TNode<Int32T> LoadUint8(TNode<RawPtrT> data_pointer, TNode<IntPtrT> offset) {
+    return UncheckedCast<Int32T>(
+        Load(MachineType::Uint8(), data_pointer, offset));
+  }
+
+  TNode<Int32T> LoadInt8(TNode<RawPtrT> data_pointer, TNode<IntPtrT> offset) {
+    return UncheckedCast<Int32T>(
+        Load(MachineType::Int8(), data_pointer, offset));
+  }
+
+  void StoreWord8(TNode<RawPtrT> data_pointer, TNode<IntPtrT> offset,
+                  TNode<Word32T> value) {
+    StoreNoWriteBarrier(MachineRepresentation::kWord8, data_pointer, offset,
+                        value);
+  }
+
+  int32_t DataViewElementSize(ElementsKind elements_kind) {
+    return ElementsKindToByteSize(elements_kind);
+  }
+
+  TNode<IntPtrT> DataViewEncodeBigIntBits(bool sign, int32_t digits) {
+    return IntPtrConstant(BigInt::SignBits::encode(sign) |
+                          BigInt::LengthBits::encode(digits));
+  }
+
+  TNode<UintPtrT> DataViewDecodeBigIntLength(TNode<BigInt> value) {
+    TNode<WordT> bitfield = LoadBigIntBitfield(value);
+    return DecodeWord<BigIntBase::LengthBits>(bitfield);
+  }
+
+  TNode<UintPtrT> DataViewDecodeBigIntSign(TNode<BigInt> value) {
+    TNode<WordT> bitfield = LoadBigIntBitfield(value);
+    return DecodeWord<BigIntBase::SignBits>(bitfield);
+  }
+};
+
+}  // namespace internal
+}  // namespace v8
+
+#endif  // V8_BUILTINS_BUILTINS_DATA_VIEW_GEN_H_
diff --git a/deps/v8/src/builtins/builtins-dataview.cc b/deps/v8/src/builtins/builtins-dataview.cc
index 49dcbe1e83ace2..07aa4eb48b8647 100644
--- a/deps/v8/src/builtins/builtins-dataview.cc
+++ b/deps/v8/src/builtins/builtins-dataview.cc
@@ -104,299 +104,5 @@ BUILTIN(DataViewConstructor) {
   }
 }
 
-// ES6 section 24.2.4.1 get DataView.prototype.buffer
-BUILTIN(DataViewPrototypeGetBuffer) {
-  HandleScope scope(isolate);
-  CHECK_RECEIVER(JSDataView, data_view, "get DataView.prototype.buffer");
-  return data_view->buffer();
-}
-
-// ES6 section 24.2.4.2 get DataView.prototype.byteLength
-BUILTIN(DataViewPrototypeGetByteLength) {
-  HandleScope scope(isolate);
-  CHECK_RECEIVER(JSDataView, data_view, "get DataView.prototype.byteLength");
-  // TODO(bmeurer): According to the ES6 spec, we should throw a TypeError
-  // here if the JSArrayBuffer of the {data_view} was neutered.
-  return data_view->byte_length();
-}
-
-// ES6 section 24.2.4.3 get DataView.prototype.byteOffset
-BUILTIN(DataViewPrototypeGetByteOffset) {
-  HandleScope scope(isolate);
-  CHECK_RECEIVER(JSDataView, data_view, "get DataView.prototype.byteOffset");
-  // TODO(bmeurer): According to the ES6 spec, we should throw a TypeError
-  // here if the JSArrayBuffer of the {data_view} was neutered.
-  return data_view->byte_offset();
-}
-
-namespace {
-
-bool NeedToFlipBytes(bool is_little_endian) {
-#ifdef V8_TARGET_LITTLE_ENDIAN
-  return !is_little_endian;
-#else
-  return is_little_endian;
-#endif
-}
-
-template <size_t n>
-void CopyBytes(uint8_t* target, uint8_t const* source) {
-  for (size_t i = 0; i < n; i++) {
-    *(target++) = *(source++);
-  }
-}
-
-template <size_t n>
-void FlipBytes(uint8_t* target, uint8_t const* source) {
-  source = source + (n - 1);
-  for (size_t i = 0; i < n; i++) {
-    *(target++) = *(source--);
-  }
-}
-
-template <typename T>
-MaybeHandle<Object> AllocateResult(Isolate* isolate, T value) {
-  return isolate->factory()->NewNumber(value);
-}
-
-template <>
-MaybeHandle<Object> AllocateResult(Isolate* isolate, int64_t value) {
-  return BigInt::FromInt64(isolate, value);
-}
-
-template <>
-MaybeHandle<Object> AllocateResult(Isolate* isolate, uint64_t value) {
-  return BigInt::FromUint64(isolate, value);
-}
-
-// ES6 section 24.2.1.1 GetViewValue (view, requestIndex, isLittleEndian, type)
-template <typename T>
-MaybeHandle<Object> GetViewValue(Isolate* isolate, Handle<JSDataView> data_view,
-                                 Handle<Object> request_index,
-                                 bool is_little_endian, const char* method) {
-  ASSIGN_RETURN_ON_EXCEPTION(
-      isolate, request_index,
-      Object::ToIndex(isolate, request_index,
-                      MessageTemplate::kInvalidDataViewAccessorOffset),
-      Object);
-  size_t get_index = 0;
-  if (!TryNumberToSize(*request_index, &get_index)) {
-    THROW_NEW_ERROR(
-        isolate, NewRangeError(MessageTemplate::kInvalidDataViewAccessorOffset),
-        Object);
-  }
-  Handle<JSArrayBuffer> buffer(JSArrayBuffer::cast(data_view->buffer()),
-                               isolate);
-  if (buffer->was_neutered()) {
-    Handle<String> operation =
-        isolate->factory()->NewStringFromAsciiChecked(method);
-    THROW_NEW_ERROR(
-        isolate, NewTypeError(MessageTemplate::kDetachedOperation, operation),
-        Object);
-  }
-  size_t const data_view_byte_offset = NumberToSize(data_view->byte_offset());
-  size_t const data_view_byte_length = NumberToSize(data_view->byte_length());
-  if (get_index + sizeof(T) > data_view_byte_length ||
-      get_index + sizeof(T) < get_index) {  // overflow
-    THROW_NEW_ERROR(
-        isolate, NewRangeError(MessageTemplate::kInvalidDataViewAccessorOffset),
-        Object);
-  }
-  union {
-    T data;
-    uint8_t bytes[sizeof(T)];
-  } v;
-  size_t const buffer_offset = data_view_byte_offset + get_index;
-  DCHECK_GE(NumberToSize(buffer->byte_length()), buffer_offset + sizeof(T));
-  uint8_t const* const source =
-      static_cast<uint8_t*>(buffer->backing_store()) + buffer_offset;
-  if (NeedToFlipBytes(is_little_endian)) {
-    FlipBytes<sizeof(T)>(v.bytes, source);
-  } else {
-    CopyBytes<sizeof(T)>(v.bytes, source);
-  }
-  return AllocateResult<T>(isolate, v.data);
-}
-
-template <typename T>
-MaybeHandle<Object> DataViewConvertInput(Isolate* isolate,
-                                         Handle<Object> input) {
-  return Object::ToNumber(input);
-}
-
-template <>
-MaybeHandle<Object> DataViewConvertInput<int64_t>(Isolate* isolate,
-                                                  Handle<Object> input) {
-  return BigInt::FromObject(isolate, input);
-}
-
-template <>
-MaybeHandle<Object> DataViewConvertInput<uint64_t>(Isolate* isolate,
-                                                   Handle<Object> input) {
-  return BigInt::FromObject(isolate, input);
-}
-
-template <typename T>
-T DataViewConvertValue(Handle<Object> value);
-
-template <>
-int8_t DataViewConvertValue<int8_t>(Handle<Object> value) {
-  return static_cast<int8_t>(DoubleToInt32(value->Number()));
-}
-
-template <>
-int16_t DataViewConvertValue<int16_t>(Handle<Object> value) {
-  return static_cast<int16_t>(DoubleToInt32(value->Number()));
-}
-
-template <>
-int32_t DataViewConvertValue<int32_t>(Handle<Object> value) {
-  return DoubleToInt32(value->Number());
-}
-
-template <>
-uint8_t DataViewConvertValue<uint8_t>(Handle<Object> value) {
-  return static_cast<uint8_t>(DoubleToUint32(value->Number()));
-}
-
-template <>
-uint16_t DataViewConvertValue<uint16_t>(Handle<Object> value) {
-  return static_cast<uint16_t>(DoubleToUint32(value->Number()));
-}
-
-template <>
-uint32_t DataViewConvertValue<uint32_t>(Handle<Object> value) {
-  return DoubleToUint32(value->Number());
-}
-
-template <>
-float DataViewConvertValue<float>(Handle<Object> value) {
-  return static_cast<float>(value->Number());
-}
-
-template <>
-double DataViewConvertValue<double>(Handle<Object> value) {
-  return value->Number();
-}
-
-template <>
-int64_t DataViewConvertValue<int64_t>(Handle<Object> value) {
-  return BigInt::cast(*value)->AsInt64();
-}
-
-template <>
-uint64_t DataViewConvertValue<uint64_t>(Handle<Object> value) {
-  return BigInt::cast(*value)->AsUint64();
-}
-
-// ES6 section 24.2.1.2 SetViewValue (view, requestIndex, isLittleEndian, type,
-//                                    value)
-template <typename T>
-MaybeHandle<Object> SetViewValue(Isolate* isolate, Handle<JSDataView> data_view,
-                                 Handle<Object> request_index,
-                                 bool is_little_endian, Handle<Object> value,
-                                 const char* method) {
-  ASSIGN_RETURN_ON_EXCEPTION(
-      isolate, request_index,
-      Object::ToIndex(isolate, request_index,
-                      MessageTemplate::kInvalidDataViewAccessorOffset),
-      Object);
-  ASSIGN_RETURN_ON_EXCEPTION(isolate, value,
-                             DataViewConvertInput<T>(isolate, value), Object);
-  size_t get_index = 0;
-  if (!TryNumberToSize(*request_index, &get_index)) {
-    THROW_NEW_ERROR(
-        isolate, NewRangeError(MessageTemplate::kInvalidDataViewAccessorOffset),
-        Object);
-  }
-  Handle<JSArrayBuffer> buffer(JSArrayBuffer::cast(data_view->buffer()),
-                               isolate);
-  if (buffer->was_neutered()) {
-    Handle<String> operation =
-        isolate->factory()->NewStringFromAsciiChecked(method);
-    THROW_NEW_ERROR(
-        isolate, NewTypeError(MessageTemplate::kDetachedOperation, operation),
-        Object);
-  }
-  size_t const data_view_byte_offset = NumberToSize(data_view->byte_offset());
-  size_t const data_view_byte_length = NumberToSize(data_view->byte_length());
-  if (get_index + sizeof(T) > data_view_byte_length ||
-      get_index + sizeof(T) < get_index) {  // overflow
-    THROW_NEW_ERROR(
-        isolate, NewRangeError(MessageTemplate::kInvalidDataViewAccessorOffset),
-        Object);
-  }
-  union {
-    T data;
-    uint8_t bytes[sizeof(T)];
-  } v;
-  v.data = DataViewConvertValue<T>(value);
-  size_t const buffer_offset = data_view_byte_offset + get_index;
-  DCHECK(NumberToSize(buffer->byte_length()) >= buffer_offset + sizeof(T));
-  uint8_t* const target =
-      static_cast<uint8_t*>(buffer->backing_store()) + buffer_offset;
-  if (NeedToFlipBytes(is_little_endian)) {
-    FlipBytes<sizeof(T)>(target, v.bytes);
-  } else {
-    CopyBytes<sizeof(T)>(target, v.bytes);
-  }
-  return isolate->factory()->undefined_value();
-}
-
-}  // namespace
-
-#define DATA_VIEW_PROTOTYPE_GET(Type, type)                                \
-  BUILTIN(DataViewPrototypeGet##Type) {                                    \
-    HandleScope scope(isolate);                                            \
-    CHECK_RECEIVER(JSDataView, data_view, "DataView.prototype.get" #Type); \
-    Handle<Object> byte_offset = args.atOrUndefined(isolate, 1);           \
-    Handle<Object> is_little_endian = args.atOrUndefined(isolate, 2);      \
-    Handle<Object> result;                                                 \
-    ASSIGN_RETURN_FAILURE_ON_EXCEPTION(                                    \
-        isolate, result,                                                   \
-        GetViewValue<type>(isolate, data_view, byte_offset,                \
-                           is_little_endian->BooleanValue(),               \
-                           "DataView.prototype.get" #Type));               \
-    return *result;                                                        \
-  }
-DATA_VIEW_PROTOTYPE_GET(Int8, int8_t)
-DATA_VIEW_PROTOTYPE_GET(Uint8, uint8_t)
-DATA_VIEW_PROTOTYPE_GET(Int16, int16_t)
-DATA_VIEW_PROTOTYPE_GET(Uint16, uint16_t)
-DATA_VIEW_PROTOTYPE_GET(Int32, int32_t)
-DATA_VIEW_PROTOTYPE_GET(Uint32, uint32_t)
-DATA_VIEW_PROTOTYPE_GET(Float32, float)
-DATA_VIEW_PROTOTYPE_GET(Float64, double)
-DATA_VIEW_PROTOTYPE_GET(BigInt64, int64_t)
-DATA_VIEW_PROTOTYPE_GET(BigUint64, uint64_t)
-#undef DATA_VIEW_PROTOTYPE_GET
-
-#define DATA_VIEW_PROTOTYPE_SET(Type, type)                                \
-  BUILTIN(DataViewPrototypeSet##Type) {                                    \
-    HandleScope scope(isolate);                                            \
-    CHECK_RECEIVER(JSDataView, data_view, "DataView.prototype.set" #Type); \
-    Handle<Object> byte_offset = args.atOrUndefined(isolate, 1);           \
-    Handle<Object> value = args.atOrUndefined(isolate, 2);                 \
-    Handle<Object> is_little_endian = args.atOrUndefined(isolate, 3);      \
-    Handle<Object> result;                                                 \
-    ASSIGN_RETURN_FAILURE_ON_EXCEPTION(                                    \
-        isolate, result,                                                   \
-        SetViewValue<type>(isolate, data_view, byte_offset,                \
-                           is_little_endian->BooleanValue(), value,        \
-                           "DataView.prototype.get" #Type));               \
-    return *result;                                                        \
-  }
-DATA_VIEW_PROTOTYPE_SET(Int8, int8_t)
-DATA_VIEW_PROTOTYPE_SET(Uint8, uint8_t)
-DATA_VIEW_PROTOTYPE_SET(Int16, int16_t)
-DATA_VIEW_PROTOTYPE_SET(Uint16, uint16_t)
-DATA_VIEW_PROTOTYPE_SET(Int32, int32_t)
-DATA_VIEW_PROTOTYPE_SET(Uint32, uint32_t)
-DATA_VIEW_PROTOTYPE_SET(Float32, float)
-DATA_VIEW_PROTOTYPE_SET(Float64, double)
-DATA_VIEW_PROTOTYPE_SET(BigInt64, int64_t)
-DATA_VIEW_PROTOTYPE_SET(BigUint64, uint64_t)
-#undef DATA_VIEW_PROTOTYPE_SET
-
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/src/builtins/builtins-date-gen.cc b/deps/v8/src/builtins/builtins-date-gen.cc
index 8b58c1ec80044d..4d3c7faa530211 100644
--- a/deps/v8/src/builtins/builtins-date-gen.cc
+++ b/deps/v8/src/builtins/builtins-date-gen.cc
@@ -52,7 +52,7 @@ void DateBuiltinsAssembler::Generate_DatePrototype_GetField(Node* context,
 
     Node* field_index_smi = SmiConstant(field_index);
     Node* function =
-        ExternalConstant(ExternalReference::get_date_field_function(isolate()));
+        ExternalConstant(ExternalReference::get_date_field_function());
     Node* result = CallCFunction2(
         MachineType::AnyTagged(), MachineType::AnyTagged(),
         MachineType::AnyTagged(), function, receiver, field_index_smi);
diff --git a/deps/v8/src/builtins/builtins-date.cc b/deps/v8/src/builtins/builtins-date.cc
index 73c7098c06be6c..e6d5846cc7eee9 100644
--- a/deps/v8/src/builtins/builtins-date.cc
+++ b/deps/v8/src/builtins/builtins-date.cc
@@ -80,7 +80,7 @@ double MakeDay(double year, double month, double date) {
                                           182, 213, 244, 274, 305, 335};
       day_from_year += kDayFromMonth[m];
     }
-    return static_cast<double>(day_from_year - 1) + date;
+    return static_cast<double>(day_from_year - 1) + DoubleToInteger(date);
   }
   return std::numeric_limits<double>::quiet_NaN();
 }
@@ -98,23 +98,14 @@ double MakeTime(double hour, double min, double sec, double ms) {
   return std::numeric_limits<double>::quiet_NaN();
 }
 
-// ES6 section 20.3.1.15 TimeClip (time)
-double TimeClip(double time) {
-  if (-DateCache::kMaxTimeInMs <= time && time <= DateCache::kMaxTimeInMs) {
-    return DoubleToInteger(time) + 0.0;
-  }
-  return std::numeric_limits<double>::quiet_NaN();
-}
-
 const char* kShortWeekDays[] = {"Sun", "Mon", "Tue", "Wed",
                                 "Thu", "Fri", "Sat"};
 const char* kShortMonths[] = {"Jan", "Feb", "Mar", "Apr", "May", "Jun",
                               "Jul", "Aug", "Sep", "Oct", "Nov", "Dec"};
 
 // ES6 section 20.3.1.16 Date Time String Format
-double ParseDateTimeString(Handle<String> str) {
-  Isolate* const isolate = str->GetIsolate();
-  str = String::Flatten(str);
+double ParseDateTimeString(Isolate* isolate, Handle<String> str) {
+  str = String::Flatten(isolate, str);
   // TODO(bmeurer): Change DateParser to not use the FixedArray.
   Handle<FixedArray> tmp =
       isolate->factory()->NewFixedArray(DateParser::OUTPUT_SIZE);
@@ -182,15 +173,15 @@ void ToDateString(double time_val, Vector<char> str, DateCache* date_cache,
   UNREACHABLE();
 }
 
-Object* SetLocalDateValue(Handle<JSDate> date, double time_val) {
+Object* SetLocalDateValue(Isolate* isolate, Handle<JSDate> date,
+                          double time_val) {
   if (time_val >= -DateCache::kMaxTimeBeforeUTCInMs &&
       time_val <= DateCache::kMaxTimeBeforeUTCInMs) {
-    Isolate* const isolate = date->GetIsolate();
     time_val = isolate->date_cache()->ToUTC(static_cast<int64_t>(time_val));
   } else {
     time_val = std::numeric_limits<double>::quiet_NaN();
   }
-  return *JSDate::SetValue(date, TimeClip(time_val));
+  return *JSDate::SetValue(date, DateCache::TimeClip(time_val));
 }
 
 }  // namespace
@@ -219,7 +210,7 @@ BUILTIN(DateConstructor) {
         ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, value,
                                            Object::ToPrimitive(value));
         if (value->IsString()) {
-          time_val = ParseDateTimeString(Handle<String>::cast(value));
+          time_val = ParseDateTimeString(isolate, Handle<String>::cast(value));
         } else {
           ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, value,
                                              Object::ToNumber(value));
@@ -298,7 +289,7 @@ BUILTIN(DateParse) {
   ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
       isolate, string,
       Object::ToString(isolate, args.atOrUndefined(isolate, 1)));
-  return *isolate->factory()->NewNumber(ParseDateTimeString(string));
+  return *isolate->factory()->NewNumber(ParseDateTimeString(isolate, string));
 }
 
 // ES6 section 20.3.3.4 Date.UTC (year,month,date,hours,minutes,seconds,ms)
@@ -356,7 +347,8 @@ BUILTIN(DateUTC) {
   }
   double const day = MakeDay(year, month, date);
   double const time = MakeTime(hours, minutes, seconds, ms);
-  return *isolate->factory()->NewNumber(TimeClip(MakeDate(day, time)));
+  return *isolate->factory()->NewNumber(
+      DateCache::TimeClip(MakeDate(day, time)));
 }
 
 // ES6 section 20.3.4.20 Date.prototype.setDate ( date )
@@ -375,7 +367,7 @@ BUILTIN(DatePrototypeSetDate) {
     isolate->date_cache()->YearMonthDayFromDays(days, &year, &month, &day);
     time_val = MakeDate(MakeDay(year, month, value->Number()), time_within_day);
   }
-  return SetLocalDateValue(date, time_val);
+  return SetLocalDateValue(isolate, date, time_val);
 }
 
 // ES6 section 20.3.4.21 Date.prototype.setFullYear (year, month, date)
@@ -408,7 +400,7 @@ BUILTIN(DatePrototypeSetFullYear) {
     }
   }
   double time_val = MakeDate(MakeDay(y, m, dt), time_within_day);
-  return SetLocalDateValue(date, time_val);
+  return SetLocalDateValue(isolate, date, time_val);
 }
 
 // ES6 section 20.3.4.22 Date.prototype.setHours(hour, min, sec, ms)
@@ -445,7 +437,7 @@ BUILTIN(DatePrototypeSetHours) {
     }
     time_val = MakeDate(day, MakeTime(h, m, s, milli));
   }
-  return SetLocalDateValue(date, time_val);
+  return SetLocalDateValue(isolate, date, time_val);
 }
 
 // ES6 section 20.3.4.23 Date.prototype.setMilliseconds(ms)
@@ -465,7 +457,7 @@ BUILTIN(DatePrototypeSetMilliseconds) {
     int s = (time_within_day / 1000) % 60;
     time_val = MakeDate(day, MakeTime(h, m, s, ms->Number()));
   }
-  return SetLocalDateValue(date, time_val);
+  return SetLocalDateValue(isolate, date, time_val);
 }
 
 // ES6 section 20.3.4.24 Date.prototype.setMinutes ( min, sec, ms )
@@ -497,7 +489,7 @@ BUILTIN(DatePrototypeSetMinutes) {
     }
     time_val = MakeDate(day, MakeTime(h, m, s, milli));
   }
-  return SetLocalDateValue(date, time_val);
+  return SetLocalDateValue(isolate, date, time_val);
 }
 
 // ES6 section 20.3.4.25 Date.prototype.setMonth ( month, date )
@@ -524,7 +516,7 @@ BUILTIN(DatePrototypeSetMonth) {
     }
     time_val = MakeDate(MakeDay(year, m, dt), time_within_day);
   }
-  return SetLocalDateValue(date, time_val);
+  return SetLocalDateValue(isolate, date, time_val);
 }
 
 // ES6 section 20.3.4.26 Date.prototype.setSeconds ( sec, ms )
@@ -551,7 +543,7 @@ BUILTIN(DatePrototypeSetSeconds) {
     }
     time_val = MakeDate(day, MakeTime(h, m, s, milli));
   }
-  return SetLocalDateValue(date, time_val);
+  return SetLocalDateValue(isolate, date, time_val);
 }
 
 // ES6 section 20.3.4.27 Date.prototype.setTime ( time )
@@ -560,7 +552,7 @@ BUILTIN(DatePrototypeSetTime) {
   CHECK_RECEIVER(JSDate, date, "Date.prototype.setTime");
   Handle<Object> value = args.atOrUndefined(isolate, 1);
   ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, value, Object::ToNumber(value));
-  return *JSDate::SetValue(date, TimeClip(value->Number()));
+  return *JSDate::SetValue(date, DateCache::TimeClip(value->Number()));
 }
 
 // ES6 section 20.3.4.28 Date.prototype.setUTCDate ( date )
@@ -577,7 +569,7 @@ BUILTIN(DatePrototypeSetUTCDate) {
   isolate->date_cache()->YearMonthDayFromDays(days, &year, &month, &day);
   double const time_val =
       MakeDate(MakeDay(year, month, value->Number()), time_within_day);
-  return *JSDate::SetValue(date, TimeClip(time_val));
+  return *JSDate::SetValue(date, DateCache::TimeClip(time_val));
 }
 
 // ES6 section 20.3.4.29 Date.prototype.setUTCFullYear (year, month, date)
@@ -609,7 +601,7 @@ BUILTIN(DatePrototypeSetUTCFullYear) {
     }
   }
   double const time_val = MakeDate(MakeDay(y, m, dt), time_within_day);
-  return *JSDate::SetValue(date, TimeClip(time_val));
+  return *JSDate::SetValue(date, DateCache::TimeClip(time_val));
 }
 
 // ES6 section 20.3.4.30 Date.prototype.setUTCHours(hour, min, sec, ms)
@@ -645,7 +637,7 @@ BUILTIN(DatePrototypeSetUTCHours) {
     }
     time_val = MakeDate(day, MakeTime(h, m, s, milli));
   }
-  return *JSDate::SetValue(date, TimeClip(time_val));
+  return *JSDate::SetValue(date, DateCache::TimeClip(time_val));
 }
 
 // ES6 section 20.3.4.31 Date.prototype.setUTCMilliseconds(ms)
@@ -664,7 +656,7 @@ BUILTIN(DatePrototypeSetUTCMilliseconds) {
     int s = (time_within_day / 1000) % 60;
     time_val = MakeDate(day, MakeTime(h, m, s, ms->Number()));
   }
-  return *JSDate::SetValue(date, TimeClip(time_val));
+  return *JSDate::SetValue(date, DateCache::TimeClip(time_val));
 }
 
 // ES6 section 20.3.4.32 Date.prototype.setUTCMinutes ( min, sec, ms )
@@ -695,7 +687,7 @@ BUILTIN(DatePrototypeSetUTCMinutes) {
     }
     time_val = MakeDate(day, MakeTime(h, m, s, milli));
   }
-  return *JSDate::SetValue(date, TimeClip(time_val));
+  return *JSDate::SetValue(date, DateCache::TimeClip(time_val));
 }
 
 // ES6 section 20.3.4.31 Date.prototype.setUTCMonth ( month, date )
@@ -721,7 +713,7 @@ BUILTIN(DatePrototypeSetUTCMonth) {
     }
     time_val = MakeDate(MakeDay(year, m, dt), time_within_day);
   }
-  return *JSDate::SetValue(date, TimeClip(time_val));
+  return *JSDate::SetValue(date, DateCache::TimeClip(time_val));
 }
 
 // ES6 section 20.3.4.34 Date.prototype.setUTCSeconds ( sec, ms )
@@ -747,7 +739,7 @@ BUILTIN(DatePrototypeSetUTCSeconds) {
     }
     time_val = MakeDate(day, MakeTime(h, m, s, milli));
   }
-  return *JSDate::SetValue(date, TimeClip(time_val));
+  return *JSDate::SetValue(date, DateCache::TimeClip(time_val));
 }
 
 // ES6 section 20.3.4.35 Date.prototype.toDateString ( )
@@ -865,7 +857,7 @@ BUILTIN(DatePrototypeSetYear) {
     dt = day;
   }
   double time_val = MakeDate(MakeDay(y, m, dt), time_within_day);
-  return SetLocalDateValue(date, time_val);
+  return SetLocalDateValue(isolate, date, time_val);
 }
 
 // ES6 section 20.3.4.37 Date.prototype.toJSON ( key )
@@ -880,7 +872,7 @@ BUILTIN(DatePrototypeToJson) {
       isolate, primitive,
       Object::ToPrimitive(receiver_obj, ToPrimitiveHint::kNumber));
   if (primitive->IsNumber() && !std::isfinite(primitive->Number())) {
-    return isolate->heap()->null_value();
+    return ReadOnlyRoots(isolate).null_value();
   } else {
     Handle<String> name =
         isolate->factory()->NewStringFromAsciiChecked("toISOString");
diff --git a/deps/v8/src/builtins/builtins-definitions.h b/deps/v8/src/builtins/builtins-definitions.h
index 5f06abeceb0d76..46b02d88d81719 100644
--- a/deps/v8/src/builtins/builtins-definitions.h
+++ b/deps/v8/src/builtins/builtins-definitions.h
@@ -5,6 +5,9 @@
 #ifndef V8_BUILTINS_BUILTINS_DEFINITIONS_H_
 #define V8_BUILTINS_BUILTINS_DEFINITIONS_H_
 
+// include generated header
+#include "torque-generated/builtin-definitions-from-dsl.h"
+
 namespace v8 {
 namespace internal {
 
@@ -28,8 +31,8 @@ namespace internal {
   TFC(RecordWrite, RecordWrite, 1)                                             \
                                                                                \
   /* Adaptors for CPP/API builtin */                                           \
-  ASM(AdaptorWithExitFrame)                                                    \
-  ASM(AdaptorWithBuiltinExitFrame)                                             \
+  TFC(AdaptorWithExitFrame, CppBuiltinAdaptor, 1)                              \
+  TFC(AdaptorWithBuiltinExitFrame, CppBuiltinAdaptor, 1)                       \
                                                                                \
   /* Calls */                                                                  \
   ASM(ArgumentsAdaptorTrampoline)                                              \
@@ -65,8 +68,7 @@ namespace internal {
   TFC(ConstructWithArrayLike, ConstructWithArrayLike, 1)                       \
   ASM(ConstructForwardVarargs)                                                 \
   ASM(ConstructFunctionForwardVarargs)                                         \
-  ASM(JSConstructStubGenericRestrictedReturn)                                  \
-  ASM(JSConstructStubGenericUnrestrictedReturn)                                \
+  ASM(JSConstructStubGeneric)                                                  \
   ASM(JSBuiltinsConstructStub)                                                 \
   TFC(FastNewObject, FastNewObject, 1)                                         \
   TFS(FastNewClosure, kSharedFunctionInfo, kFeedbackCell)                      \
@@ -76,9 +78,9 @@ namespace internal {
   TFS(CreateEmptyArrayLiteral, kFeedbackVector, kSlot)                         \
   TFS(CreateShallowArrayLiteral, kFeedbackVector, kSlot, kConstantElements)    \
   TFS(CreateShallowObjectLiteral, kFeedbackVector, kSlot,                      \
-      kBoilerplateDescription, kFlags)                                         \
+      kObjectBoilerplateDescription, kFlags)                                   \
   /* ES6 section 9.5.14 [[Construct]] ( argumentsList, newTarget) */           \
-  TFC(ConstructProxy, ConstructTrampoline, 1)                                  \
+  TFC(ConstructProxy, JSTrampoline, 1)                                         \
                                                                                \
   /* Apply and entries */                                                      \
   ASM(JSEntryTrampoline)                                                       \
@@ -118,9 +120,9 @@ namespace internal {
   ASM(InterpreterOnStackReplacement)                                           \
                                                                                \
   /* Code life-cycle */                                                        \
-  ASM(CompileLazy)                                                             \
-  ASM(CompileLazyDeoptimizedCode)                                              \
-  ASM(DeserializeLazy)                                                         \
+  TFC(CompileLazy, JSTrampoline, 1)                                            \
+  TFC(CompileLazyDeoptimizedCode, JSTrampoline, 1)                             \
+  TFC(DeserializeLazy, JSTrampoline, 1)                                        \
   ASM(InstantiateAsmJs)                                                        \
   ASM(NotifyDeoptimized)                                                       \
                                                                                \
@@ -157,8 +159,8 @@ namespace internal {
   API(HandleApiCallAsConstructor)                                              \
                                                                                \
   /* Adapters for Turbofan into runtime */                                     \
-  ASM(AllocateInNewSpace)                                                      \
-  ASM(AllocateInOldSpace)                                                      \
+  TFC(AllocateInNewSpace, Allocate, 1)                                         \
+  TFC(AllocateInOldSpace, Allocate, 1)                                         \
                                                                                \
   /* TurboFan support builtins */                                              \
   TFS(CopyFastSmiOrObjectElements, kObject)                                    \
@@ -203,7 +205,6 @@ namespace internal {
   TFH(KeyedStoreIC_Megamorphic, StoreWithVector)                               \
   TFH(KeyedStoreIC_Slow, StoreWithVector)                                      \
   TFH(LoadGlobalIC_Slow, LoadWithVector)                                       \
-  TFH(LoadField, LoadField)                                                    \
   TFH(LoadIC_FunctionPrototype, LoadWithVector)                                \
   TFH(LoadIC_Slow, LoadWithVector)                                             \
   TFH(LoadIC_StringLength, LoadWithVector)                                     \
@@ -222,8 +223,8 @@ namespace internal {
   TFS(DeleteProperty, kObject, kKey, kLanguageMode)                            \
                                                                                \
   /* Abort */                                                                  \
-  ASM(Abort)                                                                   \
-  TFC(AbortJS, AbortJS, 1)                                                     \
+  TFC(Abort, Abort, 1)                                                         \
+  TFC(AbortJS, Abort, 1)                                                       \
                                                                                \
   /* Built-in functions for Javascript */                                      \
   /* Special internal builtins */                                              \
@@ -231,14 +232,56 @@ namespace internal {
   CPP(Illegal)                                                                 \
   CPP(StrictPoisonPillThrower)                                                 \
   CPP(UnsupportedThrower)                                                      \
-  TFJ(ReturnReceiver, 0)                                                       \
+  TFJ(ReturnReceiver, 0, kReceiver)                                            \
                                                                                \
   /* Array */                                                                  \
-  ASM(ArrayConstructor)                                                        \
+  TFC(ArrayConstructor, JSTrampoline, 1)                                       \
+  TFC(ArrayConstructorImpl, ArrayConstructor, 1)                               \
+  TFC(ArrayNoArgumentConstructor_PackedSmi_DontOverride,                       \
+      ArrayNoArgumentConstructor, 1)                                           \
+  TFC(ArrayNoArgumentConstructor_HoleySmi_DontOverride,                        \
+      ArrayNoArgumentConstructor, 1)                                           \
+  TFC(ArrayNoArgumentConstructor_PackedSmi_DisableAllocationSites,             \
+      ArrayNoArgumentConstructor, 1)                                           \
+  TFC(ArrayNoArgumentConstructor_HoleySmi_DisableAllocationSites,              \
+      ArrayNoArgumentConstructor, 1)                                           \
+  TFC(ArrayNoArgumentConstructor_Packed_DisableAllocationSites,                \
+      ArrayNoArgumentConstructor, 1)                                           \
+  TFC(ArrayNoArgumentConstructor_Holey_DisableAllocationSites,                 \
+      ArrayNoArgumentConstructor, 1)                                           \
+  TFC(ArrayNoArgumentConstructor_PackedDouble_DisableAllocationSites,          \
+      ArrayNoArgumentConstructor, 1)                                           \
+  TFC(ArrayNoArgumentConstructor_HoleyDouble_DisableAllocationSites,           \
+      ArrayNoArgumentConstructor, 1)                                           \
+  TFC(ArraySingleArgumentConstructor_PackedSmi_DontOverride,                   \
+      ArraySingleArgumentConstructor, 1)                                       \
+  TFC(ArraySingleArgumentConstructor_HoleySmi_DontOverride,                    \
+      ArraySingleArgumentConstructor, 1)                                       \
+  TFC(ArraySingleArgumentConstructor_PackedSmi_DisableAllocationSites,         \
+      ArraySingleArgumentConstructor, 1)                                       \
+  TFC(ArraySingleArgumentConstructor_HoleySmi_DisableAllocationSites,          \
+      ArraySingleArgumentConstructor, 1)                                       \
+  TFC(ArraySingleArgumentConstructor_Packed_DisableAllocationSites,            \
+      ArraySingleArgumentConstructor, 1)                                       \
+  TFC(ArraySingleArgumentConstructor_Holey_DisableAllocationSites,             \
+      ArraySingleArgumentConstructor, 1)                                       \
+  TFC(ArraySingleArgumentConstructor_PackedDouble_DisableAllocationSites,      \
+      ArraySingleArgumentConstructor, 1)                                       \
+  TFC(ArraySingleArgumentConstructor_HoleyDouble_DisableAllocationSites,       \
+      ArraySingleArgumentConstructor, 1)                                       \
+  TFC(ArrayNArgumentsConstructor, ArrayNArgumentsConstructor, 1)               \
   ASM(InternalArrayConstructor)                                                \
+  ASM(InternalArrayConstructorImpl)                                            \
+  TFC(InternalArrayNoArgumentConstructor_Packed, ArrayNoArgumentConstructor,   \
+      1)                                                                       \
+  TFC(InternalArrayNoArgumentConstructor_Holey, ArrayNoArgumentConstructor, 1) \
+  TFC(InternalArraySingleArgumentConstructor_Packed,                           \
+      ArraySingleArgumentConstructor, 1)                                       \
+  TFC(InternalArraySingleArgumentConstructor_Holey,                            \
+      ArraySingleArgumentConstructor, 1)                                       \
   CPP(ArrayConcat)                                                             \
   /* ES6 #sec-array.isarray */                                                 \
-  TFJ(ArrayIsArray, 1, kArg)                                                   \
+  TFJ(ArrayIsArray, 1, kReceiver, kArg)                                        \
   /* ES6 #sec-array.from */                                                    \
   TFJ(ArrayFrom, SharedFunctionInfo::kDontAdaptArgumentsSentinel)              \
   /* ES6 #sec-array.of */                                                      \
@@ -276,99 +319,93 @@ namespace internal {
   /* Support for Array.from and other array-copying idioms */                  \
   TFS(CloneFastJSArray, kSource)                                               \
   TFS(ExtractFastJSArray, kSource, kBegin, kCount)                             \
-  /* ES6 #sec-array.prototype.foreach */                                       \
-  TFS(ArrayForEachLoopContinuation, kReceiver, kCallbackFn, kThisArg, kArray,  \
-      kObject, kInitialK, kLength, kTo)                                        \
-  TFJ(ArrayForEachLoopEagerDeoptContinuation, 4, kCallbackFn, kThisArg,        \
-      kInitialK, kLength)                                                      \
-  TFJ(ArrayForEachLoopLazyDeoptContinuation, 5, kCallbackFn, kThisArg,         \
-      kInitialK, kLength, kResult)                                             \
-  TFJ(ArrayForEach, SharedFunctionInfo::kDontAdaptArgumentsSentinel)           \
   /* ES6 #sec-array.prototype.every */                                         \
   TFS(ArrayEveryLoopContinuation, kReceiver, kCallbackFn, kThisArg, kArray,    \
       kObject, kInitialK, kLength, kTo)                                        \
-  TFJ(ArrayEveryLoopEagerDeoptContinuation, 4, kCallbackFn, kThisArg,          \
-      kInitialK, kLength)                                                      \
-  TFJ(ArrayEveryLoopLazyDeoptContinuation, 5, kCallbackFn, kThisArg,           \
-      kInitialK, kLength, kResult)                                             \
+  TFJ(ArrayEveryLoopEagerDeoptContinuation, 4, kReceiver, kCallbackFn,         \
+      kThisArg, kInitialK, kLength)                                            \
+  TFJ(ArrayEveryLoopLazyDeoptContinuation, 5, kReceiver, kCallbackFn,          \
+      kThisArg, kInitialK, kLength, kResult)                                   \
   TFJ(ArrayEvery, SharedFunctionInfo::kDontAdaptArgumentsSentinel)             \
   /* ES6 #sec-array.prototype.some */                                          \
   TFS(ArraySomeLoopContinuation, kReceiver, kCallbackFn, kThisArg, kArray,     \
       kObject, kInitialK, kLength, kTo)                                        \
-  TFJ(ArraySomeLoopEagerDeoptContinuation, 4, kCallbackFn, kThisArg,           \
-      kInitialK, kLength)                                                      \
-  TFJ(ArraySomeLoopLazyDeoptContinuation, 5, kCallbackFn, kThisArg, kInitialK, \
-      kLength, kResult)                                                        \
+  TFJ(ArraySomeLoopEagerDeoptContinuation, 4, kReceiver, kCallbackFn,          \
+      kThisArg, kInitialK, kLength)                                            \
+  TFJ(ArraySomeLoopLazyDeoptContinuation, 5, kReceiver, kCallbackFn, kThisArg, \
+      kInitialK, kLength, kResult)                                             \
   TFJ(ArraySome, SharedFunctionInfo::kDontAdaptArgumentsSentinel)              \
   /* ES6 #sec-array.prototype.filter */                                        \
   TFS(ArrayFilterLoopContinuation, kReceiver, kCallbackFn, kThisArg, kArray,   \
       kObject, kInitialK, kLength, kTo)                                        \
   TFJ(ArrayFilter, SharedFunctionInfo::kDontAdaptArgumentsSentinel)            \
-  TFJ(ArrayFilterLoopEagerDeoptContinuation, 6, kCallbackFn, kThisArg, kArray, \
-      kInitialK, kLength, kTo)                                                 \
-  TFJ(ArrayFilterLoopLazyDeoptContinuation, 8, kCallbackFn, kThisArg, kArray,  \
-      kInitialK, kLength, kValueK, kTo, kResult)                               \
+  TFJ(ArrayFilterLoopEagerDeoptContinuation, 6, kReceiver, kCallbackFn,        \
+      kThisArg, kArray, kInitialK, kLength, kTo)                               \
+  TFJ(ArrayFilterLoopLazyDeoptContinuation, 8, kReceiver, kCallbackFn,         \
+      kThisArg, kArray, kInitialK, kLength, kValueK, kTo, kResult)             \
   /* ES6 #sec-array.prototype.foreach */                                       \
   TFS(ArrayMapLoopContinuation, kReceiver, kCallbackFn, kThisArg, kArray,      \
       kObject, kInitialK, kLength, kTo)                                        \
-  TFJ(ArrayMapLoopEagerDeoptContinuation, 5, kCallbackFn, kThisArg, kArray,    \
-      kInitialK, kLength)                                                      \
-  TFJ(ArrayMapLoopLazyDeoptContinuation, 6, kCallbackFn, kThisArg, kArray,     \
-      kInitialK, kLength, kResult)                                             \
+  TFJ(ArrayMapLoopEagerDeoptContinuation, 5, kReceiver, kCallbackFn, kThisArg, \
+      kArray, kInitialK, kLength)                                              \
+  TFJ(ArrayMapLoopLazyDeoptContinuation, 6, kReceiver, kCallbackFn, kThisArg,  \
+      kArray, kInitialK, kLength, kResult)                                     \
   TFJ(ArrayMap, SharedFunctionInfo::kDontAdaptArgumentsSentinel)               \
   /* ES6 #sec-array.prototype.reduce */                                        \
   TFS(ArrayReduceLoopContinuation, kReceiver, kCallbackFn, kThisArg,           \
       kAccumulator, kObject, kInitialK, kLength, kTo)                          \
-  TFJ(ArrayReducePreLoopEagerDeoptContinuation, 2, kCallbackFn, kLength)       \
-  TFJ(ArrayReduceLoopEagerDeoptContinuation, 4, kCallbackFn, kInitialK,        \
-      kLength, kAccumulator)                                                   \
-  TFJ(ArrayReduceLoopLazyDeoptContinuation, 4, kCallbackFn, kInitialK,         \
-      kLength, kResult)                                                        \
+  TFJ(ArrayReducePreLoopEagerDeoptContinuation, 2, kReceiver, kCallbackFn,     \
+      kLength)                                                                 \
+  TFJ(ArrayReduceLoopEagerDeoptContinuation, 4, kReceiver, kCallbackFn,        \
+      kInitialK, kLength, kAccumulator)                                        \
+  TFJ(ArrayReduceLoopLazyDeoptContinuation, 4, kReceiver, kCallbackFn,         \
+      kInitialK, kLength, kResult)                                             \
   TFJ(ArrayReduce, SharedFunctionInfo::kDontAdaptArgumentsSentinel)            \
   /* ES6 #sec-array.prototype.reduceRight */                                   \
   TFS(ArrayReduceRightLoopContinuation, kReceiver, kCallbackFn, kThisArg,      \
       kAccumulator, kObject, kInitialK, kLength, kTo)                          \
-  TFJ(ArrayReduceRightPreLoopEagerDeoptContinuation, 2, kCallbackFn, kLength)  \
-  TFJ(ArrayReduceRightLoopEagerDeoptContinuation, 4, kCallbackFn, kInitialK,   \
-      kLength, kAccumulator)                                                   \
-  TFJ(ArrayReduceRightLoopLazyDeoptContinuation, 4, kCallbackFn, kInitialK,    \
-      kLength, kResult)                                                        \
+  TFJ(ArrayReduceRightPreLoopEagerDeoptContinuation, 2, kReceiver,             \
+      kCallbackFn, kLength)                                                    \
+  TFJ(ArrayReduceRightLoopEagerDeoptContinuation, 4, kReceiver, kCallbackFn,   \
+      kInitialK, kLength, kAccumulator)                                        \
+  TFJ(ArrayReduceRightLoopLazyDeoptContinuation, 4, kReceiver, kCallbackFn,    \
+      kInitialK, kLength, kResult)                                             \
   TFJ(ArrayReduceRight, SharedFunctionInfo::kDontAdaptArgumentsSentinel)       \
   /* ES6 #sec-array.prototype.entries */                                       \
-  TFJ(ArrayPrototypeEntries, 0)                                                \
+  TFJ(ArrayPrototypeEntries, 0, kReceiver)                                     \
   /* ES6 #sec-array.prototype.find */                                          \
   TFS(ArrayFindLoopContinuation, kReceiver, kCallbackFn, kThisArg, kArray,     \
       kObject, kInitialK, kLength, kTo)                                        \
-  TFJ(ArrayFindLoopEagerDeoptContinuation, 4, kCallbackFn, kThisArg,           \
-      kInitialK, kLength)                                                      \
-  TFJ(ArrayFindLoopLazyDeoptContinuation, 5, kCallbackFn, kThisArg, kInitialK, \
-      kLength, kResult)                                                        \
-  TFJ(ArrayFindLoopAfterCallbackLazyDeoptContinuation, 6, kCallbackFn,         \
-      kThisArg, kInitialK, kLength, kFoundValue, kIsFound)                     \
+  TFJ(ArrayFindLoopEagerDeoptContinuation, 4, kReceiver, kCallbackFn,          \
+      kThisArg, kInitialK, kLength)                                            \
+  TFJ(ArrayFindLoopLazyDeoptContinuation, 5, kReceiver, kCallbackFn, kThisArg, \
+      kInitialK, kLength, kResult)                                             \
+  TFJ(ArrayFindLoopAfterCallbackLazyDeoptContinuation, 6, kReceiver,           \
+      kCallbackFn, kThisArg, kInitialK, kLength, kFoundValue, kIsFound)        \
   TFJ(ArrayPrototypeFind, SharedFunctionInfo::kDontAdaptArgumentsSentinel)     \
   /* ES6 #sec-array.prototype.findIndex */                                     \
   TFS(ArrayFindIndexLoopContinuation, kReceiver, kCallbackFn, kThisArg,        \
       kArray, kObject, kInitialK, kLength, kTo)                                \
-  TFJ(ArrayFindIndexLoopEagerDeoptContinuation, 4, kCallbackFn, kThisArg,      \
-      kInitialK, kLength)                                                      \
-  TFJ(ArrayFindIndexLoopLazyDeoptContinuation, 5, kCallbackFn, kThisArg,       \
-      kInitialK, kLength, kResult)                                             \
-  TFJ(ArrayFindIndexLoopAfterCallbackLazyDeoptContinuation, 6, kCallbackFn,    \
-      kThisArg, kInitialK, kLength, kFoundValue, kIsFound)                     \
+  TFJ(ArrayFindIndexLoopEagerDeoptContinuation, 4, kReceiver, kCallbackFn,     \
+      kThisArg, kInitialK, kLength)                                            \
+  TFJ(ArrayFindIndexLoopLazyDeoptContinuation, 5, kReceiver, kCallbackFn,      \
+      kThisArg, kInitialK, kLength, kResult)                                   \
+  TFJ(ArrayFindIndexLoopAfterCallbackLazyDeoptContinuation, 6, kReceiver,      \
+      kCallbackFn, kThisArg, kInitialK, kLength, kFoundValue, kIsFound)        \
   TFJ(ArrayPrototypeFindIndex,                                                 \
       SharedFunctionInfo::kDontAdaptArgumentsSentinel)                         \
   /* ES6 #sec-array.prototype.keys */                                          \
-  TFJ(ArrayPrototypeKeys, 0)                                                   \
+  TFJ(ArrayPrototypeKeys, 0, kReceiver)                                        \
   /* ES6 #sec-array.prototype.values */                                        \
-  TFJ(ArrayPrototypeValues, 0)                                                 \
+  TFJ(ArrayPrototypeValues, 0, kReceiver)                                      \
   /* ES6 #sec-%arrayiteratorprototype%.next */                                 \
-  TFJ(ArrayIteratorPrototypeNext, 0)                                           \
+  TFJ(ArrayIteratorPrototypeNext, 0, kReceiver)                                \
   /* https://tc39.github.io/proposal-flatMap/#sec-FlattenIntoArray */          \
   TFS(FlattenIntoArray, kTarget, kSource, kSourceLength, kStart, kDepth)       \
   TFS(FlatMapIntoArray, kTarget, kSource, kSourceLength, kStart, kDepth,       \
       kMapperFunction, kThisArg)                                               \
-  /* https://tc39.github.io/proposal-flatMap/#sec-Array.prototype.flatten */   \
-  TFJ(ArrayPrototypeFlatten, SharedFunctionInfo::kDontAdaptArgumentsSentinel)  \
+  /* https://tc39.github.io/proposal-flatMap/#sec-Array.prototype.flat */      \
+  TFJ(ArrayPrototypeFlat, SharedFunctionInfo::kDontAdaptArgumentsSentinel)     \
   /* https://tc39.github.io/proposal-flatMap/#sec-Array.prototype.flatMap */   \
   TFJ(ArrayPrototypeFlatMap, SharedFunctionInfo::kDontAdaptArgumentsSentinel)  \
                                                                                \
@@ -381,12 +418,18 @@ namespace internal {
   CPP(ArrayBufferPrototypeSlice)                                               \
                                                                                \
   /* AsyncFunction */                                                          \
-  TFJ(AsyncFunctionAwaitCaught, 3, kGenerator, kAwaited, kOuterPromise)        \
-  TFJ(AsyncFunctionAwaitUncaught, 3, kGenerator, kAwaited, kOuterPromise)      \
-  TFJ(AsyncFunctionAwaitRejectClosure, 1, kSentError)                          \
-  TFJ(AsyncFunctionAwaitResolveClosure, 1, kSentValue)                         \
-  TFJ(AsyncFunctionPromiseCreate, 0)                                           \
-  TFJ(AsyncFunctionPromiseRelease, 1, kPromise)                                \
+  TFJ(AsyncFunctionAwaitCaught, 3, kReceiver, kGenerator, kAwaited,            \
+      kOuterPromise)                                                           \
+  TFJ(AsyncFunctionAwaitCaughtOptimized, 3, kReceiver, kGenerator, kAwaited,   \
+      kOuterPromise)                                                           \
+  TFJ(AsyncFunctionAwaitUncaught, 3, kReceiver, kGenerator, kAwaited,          \
+      kOuterPromise)                                                           \
+  TFJ(AsyncFunctionAwaitUncaughtOptimized, 3, kReceiver, kGenerator, kAwaited, \
+      kOuterPromise)                                                           \
+  TFJ(AsyncFunctionAwaitRejectClosure, 1, kReceiver, kSentError)               \
+  TFJ(AsyncFunctionAwaitResolveClosure, 1, kReceiver, kSentValue)              \
+  TFJ(AsyncFunctionPromiseCreate, 0, kReceiver)                                \
+  TFJ(AsyncFunctionPromiseRelease, 2, kReceiver, kPromise, kCanSuspend)        \
                                                                                \
   /* BigInt */                                                                 \
   CPP(BigIntConstructor)                                                       \
@@ -400,9 +443,9 @@ namespace internal {
   /* ES #sec-boolean-constructor */                                            \
   CPP(BooleanConstructor)                                                      \
   /* ES6 #sec-boolean.prototype.tostring */                                    \
-  TFJ(BooleanPrototypeToString, 0)                                             \
+  TFJ(BooleanPrototypeToString, 0, kReceiver)                                  \
   /* ES6 #sec-boolean.prototype.valueof */                                     \
-  TFJ(BooleanPrototypeValueOf, 0)                                              \
+  TFJ(BooleanPrototypeValueOf, 0, kReceiver)                                   \
                                                                                \
   /* CallSite */                                                               \
   CPP(CallSitePrototypeGetColumnNumber)                                        \
@@ -437,13 +480,11 @@ namespace internal {
   CPP(ConsoleGroupEnd)                                                         \
   CPP(ConsoleClear)                                                            \
   CPP(ConsoleCount)                                                            \
+  CPP(ConsoleCountReset)                                                       \
   CPP(ConsoleAssert)                                                           \
   TFJ(FastConsoleAssert, SharedFunctionInfo::kDontAdaptArgumentsSentinel)      \
-  CPP(ConsoleMarkTimeline)                                                     \
   CPP(ConsoleProfile)                                                          \
   CPP(ConsoleProfileEnd)                                                       \
-  CPP(ConsoleTimeline)                                                         \
-  CPP(ConsoleTimelineEnd)                                                      \
   CPP(ConsoleTime)                                                             \
   CPP(ConsoleTimeEnd)                                                          \
   CPP(ConsoleTimeStamp)                                                        \
@@ -452,73 +493,50 @@ namespace internal {
   /* DataView */                                                               \
   /* ES #sec-dataview-constructor */                                           \
   CPP(DataViewConstructor)                                                     \
-  CPP(DataViewPrototypeGetBuffer)                                              \
-  CPP(DataViewPrototypeGetByteLength)                                          \
-  CPP(DataViewPrototypeGetByteOffset)                                          \
-  CPP(DataViewPrototypeGetInt8)                                                \
-  CPP(DataViewPrototypeSetInt8)                                                \
-  CPP(DataViewPrototypeGetUint8)                                               \
-  CPP(DataViewPrototypeSetUint8)                                               \
-  CPP(DataViewPrototypeGetInt16)                                               \
-  CPP(DataViewPrototypeSetInt16)                                               \
-  CPP(DataViewPrototypeGetUint16)                                              \
-  CPP(DataViewPrototypeSetUint16)                                              \
-  CPP(DataViewPrototypeGetInt32)                                               \
-  CPP(DataViewPrototypeSetInt32)                                               \
-  CPP(DataViewPrototypeGetUint32)                                              \
-  CPP(DataViewPrototypeSetUint32)                                              \
-  CPP(DataViewPrototypeGetFloat32)                                             \
-  CPP(DataViewPrototypeSetFloat32)                                             \
-  CPP(DataViewPrototypeGetFloat64)                                             \
-  CPP(DataViewPrototypeSetFloat64)                                             \
-  CPP(DataViewPrototypeGetBigInt64)                                            \
-  CPP(DataViewPrototypeSetBigInt64)                                            \
-  CPP(DataViewPrototypeGetBigUint64)                                           \
-  CPP(DataViewPrototypeSetBigUint64)                                           \
                                                                                \
   /* Date */                                                                   \
   /* ES #sec-date-constructor */                                               \
   CPP(DateConstructor)                                                         \
   /* ES6 #sec-date.prototype.getdate */                                        \
-  TFJ(DatePrototypeGetDate, 0)                                                 \
+  TFJ(DatePrototypeGetDate, 0, kReceiver)                                      \
   /* ES6 #sec-date.prototype.getday */                                         \
-  TFJ(DatePrototypeGetDay, 0)                                                  \
+  TFJ(DatePrototypeGetDay, 0, kReceiver)                                       \
   /* ES6 #sec-date.prototype.getfullyear */                                    \
-  TFJ(DatePrototypeGetFullYear, 0)                                             \
+  TFJ(DatePrototypeGetFullYear, 0, kReceiver)                                  \
   /* ES6 #sec-date.prototype.gethours */                                       \
-  TFJ(DatePrototypeGetHours, 0)                                                \
+  TFJ(DatePrototypeGetHours, 0, kReceiver)                                     \
   /* ES6 #sec-date.prototype.getmilliseconds */                                \
-  TFJ(DatePrototypeGetMilliseconds, 0)                                         \
+  TFJ(DatePrototypeGetMilliseconds, 0, kReceiver)                              \
   /* ES6 #sec-date.prototype.getminutes */                                     \
-  TFJ(DatePrototypeGetMinutes, 0)                                              \
+  TFJ(DatePrototypeGetMinutes, 0, kReceiver)                                   \
   /* ES6 #sec-date.prototype.getmonth */                                       \
-  TFJ(DatePrototypeGetMonth, 0)                                                \
+  TFJ(DatePrototypeGetMonth, 0, kReceiver)                                     \
   /* ES6 #sec-date.prototype.getseconds */                                     \
-  TFJ(DatePrototypeGetSeconds, 0)                                              \
+  TFJ(DatePrototypeGetSeconds, 0, kReceiver)                                   \
   /* ES6 #sec-date.prototype.gettime */                                        \
-  TFJ(DatePrototypeGetTime, 0)                                                 \
+  TFJ(DatePrototypeGetTime, 0, kReceiver)                                      \
   /* ES6 #sec-date.prototype.gettimezoneoffset */                              \
-  TFJ(DatePrototypeGetTimezoneOffset, 0)                                       \
+  TFJ(DatePrototypeGetTimezoneOffset, 0, kReceiver)                            \
   /* ES6 #sec-date.prototype.getutcdate */                                     \
-  TFJ(DatePrototypeGetUTCDate, 0)                                              \
+  TFJ(DatePrototypeGetUTCDate, 0, kReceiver)                                   \
   /* ES6 #sec-date.prototype.getutcday */                                      \
-  TFJ(DatePrototypeGetUTCDay, 0)                                               \
+  TFJ(DatePrototypeGetUTCDay, 0, kReceiver)                                    \
   /* ES6 #sec-date.prototype.getutcfullyear */                                 \
-  TFJ(DatePrototypeGetUTCFullYear, 0)                                          \
+  TFJ(DatePrototypeGetUTCFullYear, 0, kReceiver)                               \
   /* ES6 #sec-date.prototype.getutchours */                                    \
-  TFJ(DatePrototypeGetUTCHours, 0)                                             \
+  TFJ(DatePrototypeGetUTCHours, 0, kReceiver)                                  \
   /* ES6 #sec-date.prototype.getutcmilliseconds */                             \
-  TFJ(DatePrototypeGetUTCMilliseconds, 0)                                      \
+  TFJ(DatePrototypeGetUTCMilliseconds, 0, kReceiver)                           \
   /* ES6 #sec-date.prototype.getutcminutes */                                  \
-  TFJ(DatePrototypeGetUTCMinutes, 0)                                           \
+  TFJ(DatePrototypeGetUTCMinutes, 0, kReceiver)                                \
   /* ES6 #sec-date.prototype.getutcmonth */                                    \
-  TFJ(DatePrototypeGetUTCMonth, 0)                                             \
+  TFJ(DatePrototypeGetUTCMonth, 0, kReceiver)                                  \
   /* ES6 #sec-date.prototype.getutcseconds */                                  \
-  TFJ(DatePrototypeGetUTCSeconds, 0)                                           \
+  TFJ(DatePrototypeGetUTCSeconds, 0, kReceiver)                                \
   /* ES6 #sec-date.prototype.valueof */                                        \
-  TFJ(DatePrototypeValueOf, 0)                                                 \
+  TFJ(DatePrototypeValueOf, 0, kReceiver)                                      \
   /* ES6 #sec-date.prototype-@@toprimitive */                                  \
-  TFJ(DatePrototypeToPrimitive, 1, kHint)                                      \
+  TFJ(DatePrototypeToPrimitive, 1, kReceiver, kHint)                           \
   CPP(DatePrototypeGetYear)                                                    \
   CPP(DatePrototypeSetYear)                                                    \
   CPP(DateNow)                                                                 \
@@ -565,7 +583,7 @@ namespace internal {
       SharedFunctionInfo::kDontAdaptArgumentsSentinel)                         \
   ASM(FunctionPrototypeCall)                                                   \
   /* ES6 #sec-function.prototype-@@hasinstance */                              \
-  TFJ(FunctionPrototypeHasInstance, 1, kV)                                     \
+  TFJ(FunctionPrototypeHasInstance, 1, kReceiver, kV)                          \
   /* ES6 #sec-function.prototype.tostring */                                   \
   CPP(FunctionPrototypeToString)                                               \
                                                                                \
@@ -594,9 +612,9 @@ namespace internal {
   CPP(GlobalUnescape)                                                          \
   CPP(GlobalEval)                                                              \
   /* ES6 #sec-isfinite-number */                                               \
-  TFJ(GlobalIsFinite, 1, kNumber)                                              \
+  TFJ(GlobalIsFinite, 1, kReceiver, kNumber)                                   \
   /* ES6 #sec-isnan-number */                                                  \
-  TFJ(GlobalIsNaN, 1, kNumber)                                                 \
+  TFJ(GlobalIsNaN, 1, kReceiver, kNumber)                                      \
                                                                                \
   /* JSON */                                                                   \
   CPP(JsonParse)                                                               \
@@ -623,119 +641,120 @@ namespace internal {
   /* Map */                                                                    \
   TFS(FindOrderedHashMapEntry, kTable, kKey)                                   \
   TFJ(MapConstructor, SharedFunctionInfo::kDontAdaptArgumentsSentinel)         \
-  TFJ(MapPrototypeSet, 2, kKey, kValue)                                        \
-  TFJ(MapPrototypeDelete, 1, kKey)                                             \
-  TFJ(MapPrototypeGet, 1, kKey)                                                \
-  TFJ(MapPrototypeHas, 1, kKey)                                                \
+  TFJ(MapPrototypeSet, 2, kReceiver, kKey, kValue)                             \
+  TFJ(MapPrototypeDelete, 1, kReceiver, kKey)                                  \
+  TFJ(MapPrototypeGet, 1, kReceiver, kKey)                                     \
+  TFJ(MapPrototypeHas, 1, kReceiver, kKey)                                     \
   CPP(MapPrototypeClear)                                                       \
   /* ES #sec-map.prototype.entries */                                          \
-  TFJ(MapPrototypeEntries, 0)                                                  \
+  TFJ(MapPrototypeEntries, 0, kReceiver)                                       \
   /* ES #sec-get-map.prototype.size */                                         \
-  TFJ(MapPrototypeGetSize, 0)                                                  \
+  TFJ(MapPrototypeGetSize, 0, kReceiver)                                       \
   /* ES #sec-map.prototype.forEach */                                          \
   TFJ(MapPrototypeForEach, SharedFunctionInfo::kDontAdaptArgumentsSentinel)    \
   /* ES #sec-map.prototype.keys */                                             \
-  TFJ(MapPrototypeKeys, 0)                                                     \
+  TFJ(MapPrototypeKeys, 0, kReceiver)                                          \
   /* ES #sec-map.prototype.values */                                           \
-  TFJ(MapPrototypeValues, 0)                                                   \
+  TFJ(MapPrototypeValues, 0, kReceiver)                                        \
   /* ES #sec-%mapiteratorprototype%.next */                                    \
-  TFJ(MapIteratorPrototypeNext, 0)                                             \
+  TFJ(MapIteratorPrototypeNext, 0, kReceiver)                                  \
                                                                                \
   /* Math */                                                                   \
   /* ES6 #sec-math.abs */                                                      \
-  TFJ(MathAbs, 1, kX)                                                          \
+  TFJ(MathAbs, 1, kReceiver, kX)                                               \
   /* ES6 #sec-math.acos */                                                     \
-  TFJ(MathAcos, 1, kX)                                                         \
+  TFJ(MathAcos, 1, kReceiver, kX)                                              \
   /* ES6 #sec-math.acosh */                                                    \
-  TFJ(MathAcosh, 1, kX)                                                        \
+  TFJ(MathAcosh, 1, kReceiver, kX)                                             \
   /* ES6 #sec-math.asin */                                                     \
-  TFJ(MathAsin, 1, kX)                                                         \
+  TFJ(MathAsin, 1, kReceiver, kX)                                              \
   /* ES6 #sec-math.asinh */                                                    \
-  TFJ(MathAsinh, 1, kX)                                                        \
+  TFJ(MathAsinh, 1, kReceiver, kX)                                             \
   /* ES6 #sec-math.atan */                                                     \
-  TFJ(MathAtan, 1, kX)                                                         \
+  TFJ(MathAtan, 1, kReceiver, kX)                                              \
   /* ES6 #sec-math.atanh */                                                    \
-  TFJ(MathAtanh, 1, kX)                                                        \
+  TFJ(MathAtanh, 1, kReceiver, kX)                                             \
   /* ES6 #sec-math.atan2 */                                                    \
-  TFJ(MathAtan2, 2, kY, kX)                                                    \
+  TFJ(MathAtan2, 2, kReceiver, kY, kX)                                         \
   /* ES6 #sec-math.cbrt */                                                     \
-  TFJ(MathCbrt, 1, kX)                                                         \
+  TFJ(MathCbrt, 1, kReceiver, kX)                                              \
   /* ES6 #sec-math.ceil */                                                     \
-  TFJ(MathCeil, 1, kX)                                                         \
+  TFJ(MathCeil, 1, kReceiver, kX)                                              \
   /* ES6 #sec-math.clz32 */                                                    \
-  TFJ(MathClz32, 1, kX)                                                        \
+  TFJ(MathClz32, 1, kReceiver, kX)                                             \
   /* ES6 #sec-math.cos */                                                      \
-  TFJ(MathCos, 1, kX)                                                          \
+  TFJ(MathCos, 1, kReceiver, kX)                                               \
   /* ES6 #sec-math.cosh */                                                     \
-  TFJ(MathCosh, 1, kX)                                                         \
+  TFJ(MathCosh, 1, kReceiver, kX)                                              \
   /* ES6 #sec-math.exp */                                                      \
-  TFJ(MathExp, 1, kX)                                                          \
+  TFJ(MathExp, 1, kReceiver, kX)                                               \
   /* ES6 #sec-math.expm1 */                                                    \
-  TFJ(MathExpm1, 1, kX)                                                        \
+  TFJ(MathExpm1, 1, kReceiver, kX)                                             \
   /* ES6 #sec-math.floor */                                                    \
-  TFJ(MathFloor, 1, kX)                                                        \
+  TFJ(MathFloor, 1, kReceiver, kX)                                             \
   /* ES6 #sec-math.fround */                                                   \
-  TFJ(MathFround, 1, kX)                                                       \
+  TFJ(MathFround, 1, kReceiver, kX)                                            \
   /* ES6 #sec-math.hypot */                                                    \
   CPP(MathHypot)                                                               \
   /* ES6 #sec-math.imul */                                                     \
-  TFJ(MathImul, 2, kX, kY)                                                     \
+  TFJ(MathImul, 2, kReceiver, kX, kY)                                          \
   /* ES6 #sec-math.log */                                                      \
-  TFJ(MathLog, 1, kX)                                                          \
+  TFJ(MathLog, 1, kReceiver, kX)                                               \
   /* ES6 #sec-math.log1p */                                                    \
-  TFJ(MathLog1p, 1, kX)                                                        \
+  TFJ(MathLog1p, 1, kReceiver, kX)                                             \
   /* ES6 #sec-math.log10 */                                                    \
-  TFJ(MathLog10, 1, kX)                                                        \
+  TFJ(MathLog10, 1, kReceiver, kX)                                             \
   /* ES6 #sec-math.log2 */                                                     \
-  TFJ(MathLog2, 1, kX)                                                         \
+  TFJ(MathLog2, 1, kReceiver, kX)                                              \
   /* ES6 #sec-math.max */                                                      \
   TFJ(MathMax, SharedFunctionInfo::kDontAdaptArgumentsSentinel)                \
   /* ES6 #sec-math.min */                                                      \
   TFJ(MathMin, SharedFunctionInfo::kDontAdaptArgumentsSentinel)                \
   /* ES6 #sec-math.pow */                                                      \
-  TFJ(MathPow, 2, kBase, kExponent)                                            \
+  TFJ(MathPow, 2, kReceiver, kBase, kExponent)                                 \
   /* ES6 #sec-math.random */                                                   \
-  TFJ(MathRandom, 0)                                                           \
+  TFJ(MathRandom, 0, kReceiver)                                                \
   /* ES6 #sec-math.round */                                                    \
-  TFJ(MathRound, 1, kX)                                                        \
+  TFJ(MathRound, 1, kReceiver, kX)                                             \
   /* ES6 #sec-math.sign */                                                     \
-  TFJ(MathSign, 1, kX)                                                         \
+  TFJ(MathSign, 1, kReceiver, kX)                                              \
   /* ES6 #sec-math.sin */                                                      \
-  TFJ(MathSin, 1, kX)                                                          \
+  TFJ(MathSin, 1, kReceiver, kX)                                               \
   /* ES6 #sec-math.sinh */                                                     \
-  TFJ(MathSinh, 1, kX)                                                         \
+  TFJ(MathSinh, 1, kReceiver, kX)                                              \
   /* ES6 #sec-math.sqrt */                                                     \
-  TFJ(MathTan, 1, kX)                                                          \
+  TFJ(MathTan, 1, kReceiver, kX)                                               \
   /* ES6 #sec-math.tan */                                                      \
-  TFJ(MathTanh, 1, kX)                                                         \
+  TFJ(MathTanh, 1, kReceiver, kX)                                              \
   /* ES6 #sec-math.tanh */                                                     \
-  TFJ(MathSqrt, 1, kX)                                                         \
+  TFJ(MathSqrt, 1, kReceiver, kX)                                              \
   /* ES6 #sec-math.trunc */                                                    \
-  TFJ(MathTrunc, 1, kX)                                                        \
+  TFJ(MathTrunc, 1, kReceiver, kX)                                             \
                                                                                \
   /* Number */                                                                 \
   TFC(AllocateHeapNumber, AllocateHeapNumber, 1)                               \
   /* ES #sec-number-constructor */                                             \
   TFJ(NumberConstructor, SharedFunctionInfo::kDontAdaptArgumentsSentinel)      \
   /* ES6 #sec-number.isfinite */                                               \
-  TFJ(NumberIsFinite, 1, kNumber)                                              \
+  TFJ(NumberIsFinite, 1, kReceiver, kNumber)                                   \
   /* ES6 #sec-number.isinteger */                                              \
-  TFJ(NumberIsInteger, 1, kNumber)                                             \
+  TFJ(NumberIsInteger, 1, kReceiver, kNumber)                                  \
   /* ES6 #sec-number.isnan */                                                  \
-  TFJ(NumberIsNaN, 1, kNumber)                                                 \
+  TFJ(NumberIsNaN, 1, kReceiver, kNumber)                                      \
   /* ES6 #sec-number.issafeinteger */                                          \
-  TFJ(NumberIsSafeInteger, 1, kNumber)                                         \
+  TFJ(NumberIsSafeInteger, 1, kReceiver, kNumber)                              \
   /* ES6 #sec-number.parsefloat */                                             \
-  TFJ(NumberParseFloat, 1, kString)                                            \
+  TFJ(NumberParseFloat, 1, kReceiver, kString)                                 \
   /* ES6 #sec-number.parseint */                                               \
-  TFJ(NumberParseInt, 2, kString, kRadix)                                      \
+  TFJ(NumberParseInt, 2, kReceiver, kString, kRadix)                           \
+  TFS(ParseInt, kString, kRadix)                                               \
   CPP(NumberPrototypeToExponential)                                            \
   CPP(NumberPrototypeToFixed)                                                  \
   CPP(NumberPrototypeToLocaleString)                                           \
   CPP(NumberPrototypeToPrecision)                                              \
   CPP(NumberPrototypeToString)                                                 \
   /* ES6 #sec-number.prototype.valueof */                                      \
-  TFJ(NumberPrototypeValueOf, 0)                                               \
+  TFJ(NumberPrototypeValueOf, 0, kReceiver)                                    \
   TFC(Add, BinaryOp, 1)                                                        \
   TFC(Subtract, BinaryOp, 1)                                                   \
   TFC(Multiply, BinaryOp, 1)                                                   \
@@ -763,44 +782,45 @@ namespace internal {
   /* Object */                                                                 \
   /* ES #sec-object-constructor */                                             \
   TFJ(ObjectConstructor, SharedFunctionInfo::kDontAdaptArgumentsSentinel)      \
-  CPP(ObjectAssign)                                                            \
+  TFJ(ObjectAssign, SharedFunctionInfo::kDontAdaptArgumentsSentinel)           \
   /* ES #sec-object.create */                                                  \
   TFJ(ObjectCreate, SharedFunctionInfo::kDontAdaptArgumentsSentinel)           \
+  TFS(CreateObjectWithoutProperties, kPrototypeArg)                            \
   CPP(ObjectDefineGetter)                                                      \
   CPP(ObjectDefineProperties)                                                  \
   CPP(ObjectDefineProperty)                                                    \
   CPP(ObjectDefineSetter)                                                      \
-  TFJ(ObjectEntries, 1, kObject)                                               \
+  TFJ(ObjectEntries, 1, kReceiver, kObject)                                    \
   CPP(ObjectFreeze)                                                            \
   TFJ(ObjectGetOwnPropertyDescriptor,                                          \
       SharedFunctionInfo::kDontAdaptArgumentsSentinel)                         \
   CPP(ObjectGetOwnPropertyDescriptors)                                         \
-  CPP(ObjectGetOwnPropertyNames)                                               \
+  TFJ(ObjectGetOwnPropertyNames, 1, kReceiver, kObject)                        \
   CPP(ObjectGetOwnPropertySymbols)                                             \
   CPP(ObjectGetPrototypeOf)                                                    \
   CPP(ObjectSetPrototypeOf)                                                    \
-  TFJ(ObjectIs, 2, kLeft, kRight)                                              \
+  TFJ(ObjectIs, 2, kReceiver, kLeft, kRight)                                   \
   CPP(ObjectIsExtensible)                                                      \
   CPP(ObjectIsFrozen)                                                          \
   CPP(ObjectIsSealed)                                                          \
-  TFJ(ObjectKeys, 1, kObject)                                                  \
+  TFJ(ObjectKeys, 1, kReceiver, kObject)                                       \
   CPP(ObjectLookupGetter)                                                      \
   CPP(ObjectLookupSetter)                                                      \
   CPP(ObjectPreventExtensions)                                                 \
   /* ES6 #sec-object.prototype.tostring */                                     \
-  TFJ(ObjectPrototypeToString, 0)                                              \
+  TFJ(ObjectPrototypeToString, 0, kReceiver)                                   \
   /* ES6 #sec-object.prototype.valueof */                                      \
-  TFJ(ObjectPrototypeValueOf, 0)                                               \
+  TFJ(ObjectPrototypeValueOf, 0, kReceiver)                                    \
   /* ES6 #sec-object.prototype.hasownproperty */                               \
-  TFJ(ObjectPrototypeHasOwnProperty, 1, kKey)                                  \
-  TFJ(ObjectPrototypeIsPrototypeOf, 1, kValue)                                 \
+  TFJ(ObjectPrototypeHasOwnProperty, 1, kReceiver, kKey)                       \
+  TFJ(ObjectPrototypeIsPrototypeOf, 1, kReceiver, kValue)                      \
   CPP(ObjectPrototypePropertyIsEnumerable)                                     \
   CPP(ObjectPrototypeGetProto)                                                 \
   CPP(ObjectPrototypeSetProto)                                                 \
   /* ES #sec-object.prototype.tolocalestring */                                \
-  TFJ(ObjectPrototypeToLocaleString, 0)                                        \
+  TFJ(ObjectPrototypeToLocaleString, 0, kReceiver)                             \
   CPP(ObjectSeal)                                                              \
-  TFJ(ObjectValues, 1, kObject)                                                \
+  TFJ(ObjectValues, 1, kReceiver, kObject)                                     \
                                                                                \
   /* instanceof */                                                             \
   TFC(OrdinaryHasInstance, Compare, 1)                                         \
@@ -819,57 +839,57 @@ namespace internal {
   /* Starting at step 6 of "Promise Resolve Functions" */                      \
   TFS(ResolvePromise, kPromise, kResolution)                                   \
   /* ES #sec-promise-reject-functions */                                       \
-  TFJ(PromiseCapabilityDefaultReject, 1, kReason)                              \
+  TFJ(PromiseCapabilityDefaultReject, 1, kReceiver, kReason)                   \
   /* ES #sec-promise-resolve-functions */                                      \
-  TFJ(PromiseCapabilityDefaultResolve, 1, kResolution)                         \
+  TFJ(PromiseCapabilityDefaultResolve, 1, kReceiver, kResolution)              \
   /* ES6 #sec-getcapabilitiesexecutor-functions */                             \
-  TFJ(PromiseGetCapabilitiesExecutor, 2, kResolve, kReject)                    \
+  TFJ(PromiseGetCapabilitiesExecutor, 2, kReceiver, kResolve, kReject)         \
   /* ES6 #sec-newpromisecapability */                                          \
   TFS(NewPromiseCapability, kConstructor, kDebugEvent)                         \
-  TFJ(PromiseConstructorLazyDeoptContinuation, 4, kPromise, kReject,           \
-      kException, kResult)                                                     \
+  TFJ(PromiseConstructorLazyDeoptContinuation, 4, kReceiver, kPromise,         \
+      kReject, kException, kResult)                                            \
   /* ES6 #sec-promise-executor */                                              \
-  TFJ(PromiseConstructor, 1, kExecutor)                                        \
+  TFJ(PromiseConstructor, 1, kReceiver, kExecutor)                             \
   CPP(IsPromise)                                                               \
   /* ES #sec-promise.prototype.then */                                         \
-  TFJ(PromisePrototypeThen, 2, kOnFulfilled, kOnRejected)                      \
+  TFJ(PromisePrototypeThen, 2, kReceiver, kOnFulfilled, kOnRejected)           \
   /* ES #sec-performpromisethen */                                             \
   TFS(PerformPromiseThen, kPromise, kOnFulfilled, kOnRejected, kResultPromise) \
   /* ES #sec-promise.prototype.catch */                                        \
-  TFJ(PromisePrototypeCatch, 1, kOnRejected)                                   \
+  TFJ(PromisePrototypeCatch, 1, kReceiver, kOnRejected)                        \
   /* ES #sec-promisereactionjob */                                             \
   TFS(PromiseRejectReactionJob, kReason, kHandler, kPromiseOrCapability)       \
   TFS(PromiseFulfillReactionJob, kValue, kHandler, kPromiseOrCapability)       \
   /* ES #sec-promiseresolvethenablejob */                                      \
   TFS(PromiseResolveThenableJob, kPromiseToResolve, kThenable, kThen)          \
   /* ES #sec-promise.resolve */                                                \
-  TFJ(PromiseResolveTrampoline, 1, kValue)                                     \
+  TFJ(PromiseResolveTrampoline, 1, kReceiver, kValue)                          \
   /* ES #sec-promise-resolve */                                                \
   TFS(PromiseResolve, kConstructor, kValue)                                    \
   /* ES #sec-promise.reject */                                                 \
-  TFJ(PromiseReject, 1, kReason)                                               \
-  TFJ(PromisePrototypeFinally, 1, kOnFinally)                                  \
-  TFJ(PromiseThenFinally, 1, kValue)                                           \
-  TFJ(PromiseCatchFinally, 1, kReason)                                         \
-  TFJ(PromiseValueThunkFinally, 0)                                             \
-  TFJ(PromiseThrowerFinally, 0)                                                \
+  TFJ(PromiseReject, 1, kReceiver, kReason)                                    \
+  TFJ(PromisePrototypeFinally, 1, kReceiver, kOnFinally)                       \
+  TFJ(PromiseThenFinally, 1, kReceiver, kValue)                                \
+  TFJ(PromiseCatchFinally, 1, kReceiver, kReason)                              \
+  TFJ(PromiseValueThunkFinally, 0, kReceiver)                                  \
+  TFJ(PromiseThrowerFinally, 0, kReceiver)                                     \
   /* ES #sec-promise.all */                                                    \
-  TFJ(PromiseAll, 1, kIterable)                                                \
-  TFJ(PromiseAllResolveElementClosure, 1, kValue)                              \
+  TFJ(PromiseAll, 1, kReceiver, kIterable)                                     \
+  TFJ(PromiseAllResolveElementClosure, 1, kReceiver, kValue)                   \
   /* ES #sec-promise.race */                                                   \
-  TFJ(PromiseRace, 1, kIterable)                                               \
+  TFJ(PromiseRace, 1, kReceiver, kIterable)                                    \
   /* V8 Extras: v8.createPromise(parent) */                                    \
-  TFJ(PromiseInternalConstructor, 1, kParent)                                  \
+  TFJ(PromiseInternalConstructor, 1, kReceiver, kParent)                       \
   /* V8 Extras: v8.rejectPromise(promise, reason) */                           \
-  TFJ(PromiseInternalReject, 2, kPromise, kReason)                             \
+  TFJ(PromiseInternalReject, 2, kReceiver, kPromise, kReason)                  \
   /* V8 Extras: v8.resolvePromise(promise, resolution) */                      \
-  TFJ(PromiseInternalResolve, 2, kPromise, kResolution)                        \
+  TFJ(PromiseInternalResolve, 2, kReceiver, kPromise, kResolution)             \
                                                                                \
   /* Proxy */                                                                  \
-  TFJ(ProxyConstructor, 2, kTarget, kHandler)                                  \
-  TFJ(ProxyRevocable, 2, kTarget, kHandler)                                    \
-  TFJ(ProxyRevoke, 0)                                                          \
-  TFS(ProxyGetProperty, kProxy, kName, kReceiverValue)                         \
+  TFJ(ProxyConstructor, 2, kReceiver, kTarget, kHandler)                       \
+  TFJ(ProxyRevocable, 2, kReceiver, kTarget, kHandler)                         \
+  TFJ(ProxyRevoke, 0, kReceiver)                                               \
+  TFS(ProxyGetProperty, kProxy, kName, kReceiverValue, kOnNonExistent)         \
   TFS(ProxyHasProperty, kProxy, kName)                                         \
   TFS(ProxySetProperty, kProxy, kName, kValue, kReceiverValue, kLanguageMode)  \
                                                                                \
@@ -881,7 +901,7 @@ namespace internal {
   CPP(ReflectGet)                                                              \
   CPP(ReflectGetOwnPropertyDescriptor)                                         \
   CPP(ReflectGetPrototypeOf)                                                   \
-  TFJ(ReflectHas, 2, kTarget, kKey)                                            \
+  TFJ(ReflectHas, 2, kReceiver, kTarget, kKey)                                 \
   CPP(ReflectIsExtensible)                                                     \
   CPP(ReflectOwnKeys)                                                          \
   CPP(ReflectPreventExtensions)                                                \
@@ -899,42 +919,43 @@ namespace internal {
   CPP(RegExpCapture8Getter)                                                    \
   CPP(RegExpCapture9Getter)                                                    \
   /* ES #sec-regexp-pattern-flags */                                           \
-  TFJ(RegExpConstructor, 2, kPattern, kFlags)                                  \
-  TFJ(RegExpInternalMatch, 2, kRegExp, kString)                                \
+  TFJ(RegExpConstructor, 2, kReceiver, kPattern, kFlags)                       \
+  TFJ(RegExpInternalMatch, 2, kReceiver, kRegExp, kString)                     \
   CPP(RegExpInputGetter)                                                       \
   CPP(RegExpInputSetter)                                                       \
   CPP(RegExpLastMatchGetter)                                                   \
   CPP(RegExpLastParenGetter)                                                   \
   CPP(RegExpLeftContextGetter)                                                 \
   /* ES #sec-regexp.prototype.compile */                                       \
-  TFJ(RegExpPrototypeCompile, 2, kPattern, kFlags)                             \
+  TFJ(RegExpPrototypeCompile, 2, kReceiver, kPattern, kFlags)                  \
   /* ES #sec-regexp.prototype.exec */                                          \
-  TFJ(RegExpPrototypeExec, 1, kString)                                         \
+  TFJ(RegExpPrototypeExec, 1, kReceiver, kString)                              \
   /* ES #sec-get-regexp.prototype.dotAll */                                    \
-  TFJ(RegExpPrototypeDotAllGetter, 0)                                          \
+  TFJ(RegExpPrototypeDotAllGetter, 0, kReceiver)                               \
   /* ES #sec-get-regexp.prototype.flags */                                     \
-  TFJ(RegExpPrototypeFlagsGetter, 0)                                           \
+  TFJ(RegExpPrototypeFlagsGetter, 0, kReceiver)                                \
   /* ES #sec-get-regexp.prototype.global */                                    \
-  TFJ(RegExpPrototypeGlobalGetter, 0)                                          \
+  TFJ(RegExpPrototypeGlobalGetter, 0, kReceiver)                               \
   /* ES #sec-get-regexp.prototype.ignorecase */                                \
-  TFJ(RegExpPrototypeIgnoreCaseGetter, 0)                                      \
+  TFJ(RegExpPrototypeIgnoreCaseGetter, 0, kReceiver)                           \
   /* ES #sec-regexp.prototype-@@match */                                       \
-  TFJ(RegExpPrototypeMatch, 1, kString)                                        \
+  TFJ(RegExpPrototypeMatch, 1, kReceiver, kString)                             \
   /* https://tc39.github.io/proposal-string-matchall/ */                       \
-  TFJ(RegExpPrototypeMatchAll, 1, kString)                                     \
+  TFJ(RegExpPrototypeMatchAll, 1, kReceiver, kString)                          \
   /* ES #sec-get-regexp.prototype.multiline */                                 \
-  TFJ(RegExpPrototypeMultilineGetter, 0)                                       \
+  TFJ(RegExpPrototypeMultilineGetter, 0, kReceiver)                            \
   /* ES #sec-regexp.prototype-@@search */                                      \
-  TFJ(RegExpPrototypeSearch, 1, kString)                                       \
+  TFJ(RegExpPrototypeSearch, 1, kReceiver, kString)                            \
   /* ES #sec-get-regexp.prototype.source */                                    \
-  TFJ(RegExpPrototypeSourceGetter, 0)                                          \
+  TFJ(RegExpPrototypeSourceGetter, 0, kReceiver)                               \
   /* ES #sec-get-regexp.prototype.sticky */                                    \
-  TFJ(RegExpPrototypeStickyGetter, 0)                                          \
+  TFJ(RegExpPrototypeStickyGetter, 0, kReceiver)                               \
   /* ES #sec-regexp.prototype.test */                                          \
-  TFJ(RegExpPrototypeTest, 1, kString)                                         \
+  TFJ(RegExpPrototypeTest, 1, kReceiver, kString)                              \
+  TFS(RegExpPrototypeTestFast, kReceiver, kString)                             \
   CPP(RegExpPrototypeToString)                                                 \
   /* ES #sec-get-regexp.prototype.unicode */                                   \
-  TFJ(RegExpPrototypeUnicodeGetter, 0)                                         \
+  TFJ(RegExpPrototypeUnicodeGetter, 0, kReceiver)                              \
   CPP(RegExpRightContextGetter)                                                \
                                                                                \
   /* ES #sec-regexp.prototype-@@replace */                                     \
@@ -943,6 +964,7 @@ namespace internal {
   TFJ(RegExpPrototypeSplit, SharedFunctionInfo::kDontAdaptArgumentsSentinel)   \
   /* RegExp helpers */                                                         \
   TFS(RegExpExecAtom, kRegExp, kString, kLastIndex, kMatchInfo)                \
+  TFS(RegExpExecInternal, kRegExp, kString, kLastIndex, kMatchInfo)            \
   TFS(RegExpMatchFast, kReceiver, kPattern)                                    \
   TFS(RegExpPrototypeExecSlow, kReceiver, kString)                             \
   TFS(RegExpReplace, kRegExp, kString, kReplaceValue)                          \
@@ -951,37 +973,38 @@ namespace internal {
                                                                                \
   /* RegExp String Iterator */                                                 \
   /* https://tc39.github.io/proposal-string-matchall/ */                       \
-  TFJ(RegExpStringIteratorPrototypeNext, 0)                                    \
+  TFJ(RegExpStringIteratorPrototypeNext, 0, kReceiver)                         \
                                                                                \
   /* Set */                                                                    \
   TFJ(SetConstructor, SharedFunctionInfo::kDontAdaptArgumentsSentinel)         \
-  TFJ(SetPrototypeHas, 1, kKey)                                                \
-  TFJ(SetPrototypeAdd, 1, kKey)                                                \
-  TFJ(SetPrototypeDelete, 1, kKey)                                             \
+  TFJ(SetPrototypeHas, 1, kReceiver, kKey)                                     \
+  TFJ(SetPrototypeAdd, 1, kReceiver, kKey)                                     \
+  TFJ(SetPrototypeDelete, 1, kReceiver, kKey)                                  \
   CPP(SetPrototypeClear)                                                       \
   /* ES #sec-set.prototype.entries */                                          \
-  TFJ(SetPrototypeEntries, 0)                                                  \
+  TFJ(SetPrototypeEntries, 0, kReceiver)                                       \
   /* ES #sec-get-set.prototype.size */                                         \
-  TFJ(SetPrototypeGetSize, 0)                                                  \
+  TFJ(SetPrototypeGetSize, 0, kReceiver)                                       \
   /* ES #sec-set.prototype.foreach */                                          \
   TFJ(SetPrototypeForEach, SharedFunctionInfo::kDontAdaptArgumentsSentinel)    \
   /* ES #sec-set.prototype.values */                                           \
-  TFJ(SetPrototypeValues, 0)                                                   \
+  TFJ(SetPrototypeValues, 0, kReceiver)                                        \
   /* ES #sec-%setiteratorprototype%.next */                                    \
-  TFJ(SetIteratorPrototypeNext, 0)                                             \
+  TFJ(SetIteratorPrototypeNext, 0, kReceiver)                                  \
                                                                                \
   /* SharedArrayBuffer */                                                      \
   CPP(SharedArrayBufferPrototypeGetByteLength)                                 \
   CPP(SharedArrayBufferPrototypeSlice)                                         \
-  TFJ(AtomicsLoad, 2, kArray, kIndex)                                          \
-  TFJ(AtomicsStore, 3, kArray, kIndex, kValue)                                 \
-  TFJ(AtomicsExchange, 3, kArray, kIndex, kValue)                              \
-  TFJ(AtomicsCompareExchange, 4, kArray, kIndex, kOldValue, kNewValue)         \
-  TFJ(AtomicsAdd, 3, kArray, kIndex, kValue)                                   \
-  TFJ(AtomicsSub, 3, kArray, kIndex, kValue)                                   \
-  TFJ(AtomicsAnd, 3, kArray, kIndex, kValue)                                   \
-  TFJ(AtomicsOr, 3, kArray, kIndex, kValue)                                    \
-  TFJ(AtomicsXor, 3, kArray, kIndex, kValue)                                   \
+  TFJ(AtomicsLoad, 2, kReceiver, kArray, kIndex)                               \
+  TFJ(AtomicsStore, 3, kReceiver, kArray, kIndex, kValue)                      \
+  TFJ(AtomicsExchange, 3, kReceiver, kArray, kIndex, kValue)                   \
+  TFJ(AtomicsCompareExchange, 4, kReceiver, kArray, kIndex, kOldValue,         \
+      kNewValue)                                                               \
+  TFJ(AtomicsAdd, 3, kReceiver, kArray, kIndex, kValue)                        \
+  TFJ(AtomicsSub, 3, kReceiver, kArray, kIndex, kValue)                        \
+  TFJ(AtomicsAnd, 3, kReceiver, kArray, kIndex, kValue)                        \
+  TFJ(AtomicsOr, 3, kReceiver, kArray, kIndex, kValue)                         \
+  TFJ(AtomicsXor, 3, kReceiver, kArray, kIndex, kValue)                        \
   CPP(AtomicsIsLockFree)                                                       \
   CPP(AtomicsWait)                                                             \
   CPP(AtomicsWake)                                                             \
@@ -994,44 +1017,44 @@ namespace internal {
   /* ES6 #sec-string.fromcharcode */                                           \
   TFJ(StringFromCharCode, SharedFunctionInfo::kDontAdaptArgumentsSentinel)     \
   /* ES6 #sec-string.prototype.anchor */                                       \
-  TFJ(StringPrototypeAnchor, 1, kValue)                                        \
+  TFJ(StringPrototypeAnchor, 1, kReceiver, kValue)                             \
   /* ES6 #sec-string.prototype.big */                                          \
-  TFJ(StringPrototypeBig, 0)                                                   \
+  TFJ(StringPrototypeBig, 0, kReceiver)                                        \
   /* ES6 #sec-string.prototype.blink */                                        \
-  TFJ(StringPrototypeBlink, 0)                                                 \
+  TFJ(StringPrototypeBlink, 0, kReceiver)                                      \
   /* ES6 #sec-string.prototype.bold */                                         \
-  TFJ(StringPrototypeBold, 0)                                                  \
+  TFJ(StringPrototypeBold, 0, kReceiver)                                       \
   /* ES6 #sec-string.prototype.charat */                                       \
-  TFJ(StringPrototypeCharAt, 1, kPosition)                                     \
+  TFJ(StringPrototypeCharAt, 1, kReceiver, kPosition)                          \
   /* ES6 #sec-string.prototype.charcodeat */                                   \
-  TFJ(StringPrototypeCharCodeAt, 1, kPosition)                                 \
+  TFJ(StringPrototypeCharCodeAt, 1, kReceiver, kPosition)                      \
   /* ES6 #sec-string.prototype.codepointat */                                  \
-  TFJ(StringPrototypeCodePointAt, 1, kPosition)                                \
+  TFJ(StringPrototypeCodePointAt, 1, kReceiver, kPosition)                     \
   /* ES6 #sec-string.prototype.concat */                                       \
   TFJ(StringPrototypeConcat, SharedFunctionInfo::kDontAdaptArgumentsSentinel)  \
   /* ES6 #sec-string.prototype.endswith */                                     \
   CPP(StringPrototypeEndsWith)                                                 \
   /* ES6 #sec-string.prototype.fontcolor */                                    \
-  TFJ(StringPrototypeFontcolor, 1, kValue)                                     \
+  TFJ(StringPrototypeFontcolor, 1, kReceiver, kValue)                          \
   /* ES6 #sec-string.prototype.fontsize */                                     \
-  TFJ(StringPrototypeFontsize, 1, kValue)                                      \
+  TFJ(StringPrototypeFontsize, 1, kReceiver, kValue)                           \
   /* ES6 #sec-string.prototype.fixed */                                        \
-  TFJ(StringPrototypeFixed, 0)                                                 \
+  TFJ(StringPrototypeFixed, 0, kReceiver)                                      \
   /* ES6 #sec-string.prototype.includes */                                     \
   TFJ(StringPrototypeIncludes,                                                 \
       SharedFunctionInfo::kDontAdaptArgumentsSentinel)                         \
   /* ES6 #sec-string.prototype.indexof */                                      \
   TFJ(StringPrototypeIndexOf, SharedFunctionInfo::kDontAdaptArgumentsSentinel) \
   /* ES6 #sec-string.prototype.italics */                                      \
-  TFJ(StringPrototypeItalics, 0)                                               \
+  TFJ(StringPrototypeItalics, 0, kReceiver)                                    \
   /* ES6 #sec-string.prototype.lastindexof */                                  \
   CPP(StringPrototypeLastIndexOf)                                              \
   /* ES6 #sec-string.prototype.link */                                         \
-  TFJ(StringPrototypeLink, 1, kValue)                                          \
+  TFJ(StringPrototypeLink, 1, kReceiver, kValue)                               \
   /* ES6 #sec-string.prototype.match */                                        \
-  TFJ(StringPrototypeMatch, 1, kRegexp)                                        \
+  TFJ(StringPrototypeMatch, 1, kReceiver, kRegexp)                             \
   /* ES #sec-string.prototype.matchAll */                                      \
-  TFJ(StringPrototypeMatchAll, 1, kRegexp)                                     \
+  TFJ(StringPrototypeMatchAll, 1, kReceiver, kRegexp)                          \
   /* ES6 #sec-string.prototype.localecompare */                                \
   CPP(StringPrototypeLocaleCompare)                                            \
   /* ES6 #sec-string.prototype.padEnd */                                       \
@@ -1040,46 +1063,46 @@ namespace internal {
   TFJ(StringPrototypePadStart,                                                 \
       SharedFunctionInfo::kDontAdaptArgumentsSentinel)                         \
   /* ES6 #sec-string.prototype.repeat */                                       \
-  TFJ(StringPrototypeRepeat, 1, kCount)                                        \
+  TFJ(StringPrototypeRepeat, 1, kReceiver, kCount)                             \
   /* ES6 #sec-string.prototype.replace */                                      \
-  TFJ(StringPrototypeReplace, 2, kSearch, kReplace)                            \
+  TFJ(StringPrototypeReplace, 2, kReceiver, kSearch, kReplace)                 \
   /* ES6 #sec-string.prototype.search */                                       \
-  TFJ(StringPrototypeSearch, 1, kRegexp)                                       \
+  TFJ(StringPrototypeSearch, 1, kReceiver, kRegexp)                            \
   /* ES6 #sec-string.prototype.slice */                                        \
   TFJ(StringPrototypeSlice, SharedFunctionInfo::kDontAdaptArgumentsSentinel)   \
   /* ES6 #sec-string.prototype.small */                                        \
-  TFJ(StringPrototypeSmall, 0)                                                 \
+  TFJ(StringPrototypeSmall, 0, kReceiver)                                      \
   /* ES6 #sec-string.prototype.split */                                        \
   TFJ(StringPrototypeSplit, SharedFunctionInfo::kDontAdaptArgumentsSentinel)   \
   /* ES6 #sec-string.prototype.strike */                                       \
-  TFJ(StringPrototypeStrike, 0)                                                \
+  TFJ(StringPrototypeStrike, 0, kReceiver)                                     \
   /* ES6 #sec-string.prototype.sub */                                          \
-  TFJ(StringPrototypeSub, 0)                                                   \
+  TFJ(StringPrototypeSub, 0, kReceiver)                                        \
   /* ES6 #sec-string.prototype.substr */                                       \
   TFJ(StringPrototypeSubstr, SharedFunctionInfo::kDontAdaptArgumentsSentinel)  \
   /* ES6 #sec-string.prototype.substring */                                    \
   TFJ(StringPrototypeSubstring,                                                \
       SharedFunctionInfo::kDontAdaptArgumentsSentinel)                         \
   /* ES6 #sec-string.prototype.sup */                                          \
-  TFJ(StringPrototypeSup, 0)                                                   \
+  TFJ(StringPrototypeSup, 0, kReceiver)                                        \
   /* ES6 #sec-string.prototype.startswith */                                   \
   CPP(StringPrototypeStartsWith)                                               \
   /* ES6 #sec-string.prototype.tostring */                                     \
-  TFJ(StringPrototypeToString, 0)                                              \
+  TFJ(StringPrototypeToString, 0, kReceiver)                                   \
   TFJ(StringPrototypeTrim, SharedFunctionInfo::kDontAdaptArgumentsSentinel)    \
   TFJ(StringPrototypeTrimEnd, SharedFunctionInfo::kDontAdaptArgumentsSentinel) \
   TFJ(StringPrototypeTrimStart,                                                \
       SharedFunctionInfo::kDontAdaptArgumentsSentinel)                         \
   /* ES6 #sec-string.prototype.valueof */                                      \
-  TFJ(StringPrototypeValueOf, 0)                                               \
+  TFJ(StringPrototypeValueOf, 0, kReceiver)                                    \
   /* ES6 #sec-string.raw */                                                    \
   CPP(StringRaw)                                                               \
   /* ES6 #sec-string.prototype-@@iterator */                                   \
-  TFJ(StringPrototypeIterator, 0)                                              \
+  TFJ(StringPrototypeIterator, 0, kReceiver)                                   \
                                                                                \
   /* StringIterator */                                                         \
   /* ES6 #sec-%stringiteratorprototype%.next */                                \
-  TFJ(StringIteratorPrototypeNext, 0)                                          \
+  TFJ(StringIteratorPrototypeNext, 0, kReceiver)                               \
                                                                                \
   /* Symbol */                                                                 \
   /* ES #sec-symbol-constructor */                                             \
@@ -1088,36 +1111,39 @@ namespace internal {
   CPP(SymbolFor)                                                               \
   /* ES6 #sec-symbol.keyfor */                                                 \
   CPP(SymbolKeyFor)                                                            \
+  /* ES #sec-symbol.prototype.description */                                   \
+  TFJ(SymbolPrototypeDescriptionGetter, 0, kReceiver)                          \
   /* ES6 #sec-symbol.prototype-@@toprimitive */                                \
-  TFJ(SymbolPrototypeToPrimitive, 1, kHint)                                    \
+  TFJ(SymbolPrototypeToPrimitive, 1, kReceiver, kHint)                         \
   /* ES6 #sec-symbol.prototype.tostring */                                     \
-  TFJ(SymbolPrototypeToString, 0)                                              \
+  TFJ(SymbolPrototypeToString, 0, kReceiver)                                   \
   /* ES6 #sec-symbol.prototype.valueof */                                      \
-  TFJ(SymbolPrototypeValueOf, 0)                                               \
+  TFJ(SymbolPrototypeValueOf, 0, kReceiver)                                    \
                                                                                \
   /* TypedArray */                                                             \
   TFS(IterableToList, kIterable, kIteratorFn)                                  \
-  TFS(TypedArrayInitialize, kHolder, kLength, kElementSize, kInitialize)       \
+  TFS(TypedArrayInitialize, kHolder, kLength, kElementSize, kInitialize,       \
+      kBufferConstructor)                                                      \
   TFS(TypedArrayInitializeWithBuffer, kHolder, kLength, kBuffer, kElementSize, \
       kByteOffset)                                                             \
   /* ES #sec-typedarray-constructors */                                        \
   TFS(CreateTypedArray, kTarget, kNewTarget, kArg1, kArg2, kArg3)              \
-  TFJ(TypedArrayBaseConstructor, 0)                                            \
-  TFJ(TypedArrayConstructorLazyDeoptContinuation, 1, kResult)                  \
+  TFJ(TypedArrayBaseConstructor, 0, kReceiver)                                 \
+  TFJ(TypedArrayConstructorLazyDeoptContinuation, 1, kReceiver, kResult)       \
   TFJ(TypedArrayConstructor, SharedFunctionInfo::kDontAdaptArgumentsSentinel)  \
   CPP(TypedArrayPrototypeBuffer)                                               \
   /* ES6 #sec-get-%typedarray%.prototype.bytelength */                         \
-  TFJ(TypedArrayPrototypeByteLength, 0)                                        \
+  TFJ(TypedArrayPrototypeByteLength, 0, kReceiver)                             \
   /* ES6 #sec-get-%typedarray%.prototype.byteoffset */                         \
-  TFJ(TypedArrayPrototypeByteOffset, 0)                                        \
+  TFJ(TypedArrayPrototypeByteOffset, 0, kReceiver)                             \
   /* ES6 #sec-get-%typedarray%.prototype.length */                             \
-  TFJ(TypedArrayPrototypeLength, 0)                                            \
+  TFJ(TypedArrayPrototypeLength, 0, kReceiver)                                 \
   /* ES6 #sec-%typedarray%.prototype.entries */                                \
-  TFJ(TypedArrayPrototypeEntries, 0)                                           \
+  TFJ(TypedArrayPrototypeEntries, 0, kReceiver)                                \
   /* ES6 #sec-%typedarray%.prototype.keys */                                   \
-  TFJ(TypedArrayPrototypeKeys, 0)                                              \
+  TFJ(TypedArrayPrototypeKeys, 0, kReceiver)                                   \
   /* ES6 #sec-%typedarray%.prototype.values */                                 \
-  TFJ(TypedArrayPrototypeValues, 0)                                            \
+  TFJ(TypedArrayPrototypeValues, 0, kReceiver)                                 \
   /* ES6 #sec-%typedarray%.prototype.copywithin */                             \
   CPP(TypedArrayPrototypeCopyWithin)                                           \
   /* ES6 #sec-%typedarray%.prototype.fill */                                   \
@@ -1148,7 +1174,7 @@ namespace internal {
   TFJ(TypedArrayPrototypeSubArray,                                             \
       SharedFunctionInfo::kDontAdaptArgumentsSentinel)                         \
   /* ES6 #sec-get-%typedarray%.prototype-@@tostringtag */                      \
-  TFJ(TypedArrayPrototypeToStringTag, 0)                                       \
+  TFJ(TypedArrayPrototypeToStringTag, 0, kReceiver)                            \
   /* ES6 %TypedArray%.prototype.every */                                       \
   TFJ(TypedArrayPrototypeEvery,                                                \
       SharedFunctionInfo::kDontAdaptArgumentsSentinel)                         \
@@ -1173,29 +1199,34 @@ namespace internal {
                                                                                \
   /* Wasm */                                                                   \
   ASM(WasmCompileLazy)                                                         \
-  TFC(WasmStackGuard, WasmRuntimeCall, 1)                                      \
-  TFC(ThrowWasmTrapUnreachable, WasmRuntimeCall, 1)                            \
-  TFC(ThrowWasmTrapMemOutOfBounds, WasmRuntimeCall, 1)                         \
-  TFC(ThrowWasmTrapDivByZero, WasmRuntimeCall, 1)                              \
-  TFC(ThrowWasmTrapDivUnrepresentable, WasmRuntimeCall, 1)                     \
-  TFC(ThrowWasmTrapRemByZero, WasmRuntimeCall, 1)                              \
-  TFC(ThrowWasmTrapFloatUnrepresentable, WasmRuntimeCall, 1)                   \
-  TFC(ThrowWasmTrapFuncInvalid, WasmRuntimeCall, 1)                            \
-  TFC(ThrowWasmTrapFuncSigMismatch, WasmRuntimeCall, 1)                        \
+  TFC(WasmAllocateHeapNumber, AllocateHeapNumber, 1)                           \
+  TFC(WasmArgumentsAdaptor, ArgumentAdaptor, 1)                                \
+  TFC(WasmCallJavaScript, CallTrampoline, 1)                                   \
+  TFC(WasmGrowMemory, WasmGrowMemory, 1)                                       \
+  TFC(WasmStackGuard, NoContext, 1)                                            \
+  TFC(WasmToNumber, TypeConversion, 1)                                         \
+  TFS(ThrowWasmTrapUnreachable)                                                \
+  TFS(ThrowWasmTrapMemOutOfBounds)                                             \
+  TFS(ThrowWasmTrapDivByZero)                                                  \
+  TFS(ThrowWasmTrapDivUnrepresentable)                                         \
+  TFS(ThrowWasmTrapRemByZero)                                                  \
+  TFS(ThrowWasmTrapFloatUnrepresentable)                                       \
+  TFS(ThrowWasmTrapFuncInvalid)                                                \
+  TFS(ThrowWasmTrapFuncSigMismatch)                                            \
                                                                                \
   /* WeakMap */                                                                \
   TFJ(WeakMapConstructor, SharedFunctionInfo::kDontAdaptArgumentsSentinel)     \
   TFS(WeakMapLookupHashIndex, kTable, kKey)                                    \
-  TFJ(WeakMapGet, 1, kKey)                                                     \
-  TFJ(WeakMapHas, 1, kKey)                                                     \
-  TFJ(WeakMapPrototypeSet, 2, kKey, kValue)                                    \
-  TFJ(WeakMapPrototypeDelete, 1, kKey)                                         \
+  TFJ(WeakMapGet, 1, kReceiver, kKey)                                          \
+  TFJ(WeakMapHas, 1, kReceiver, kKey)                                          \
+  TFJ(WeakMapPrototypeSet, 2, kReceiver, kKey, kValue)                         \
+  TFJ(WeakMapPrototypeDelete, 1, kReceiver, kKey)                              \
                                                                                \
   /* WeakSet */                                                                \
   TFJ(WeakSetConstructor, SharedFunctionInfo::kDontAdaptArgumentsSentinel)     \
-  TFJ(WeakSetHas, 1, kKey)                                                     \
-  TFJ(WeakSetPrototypeAdd, 1, kValue)                                          \
-  TFJ(WeakSetPrototypeDelete, 1, kValue)                                       \
+  TFJ(WeakSetHas, 1, kReceiver, kKey)                                          \
+  TFJ(WeakSetPrototypeAdd, 1, kReceiver, kValue)                               \
+  TFJ(WeakSetPrototypeDelete, 1, kReceiver, kValue)                            \
                                                                                \
   /* WeakSet / WeakMap Helpers */                                              \
   TFS(WeakCollectionDelete, kCollection, kKey)                                 \
@@ -1227,54 +1258,110 @@ namespace internal {
                                                                                \
   /* Await (proposal-async-iteration/#await), with resume behaviour */         \
   /* specific to Async Generators. Internal / Not exposed to JS code. */       \
-  TFJ(AsyncGeneratorAwaitCaught, 2, kGenerator, kAwaited)                      \
-  TFJ(AsyncGeneratorAwaitUncaught, 2, kGenerator, kAwaited)                    \
-  TFJ(AsyncGeneratorAwaitResolveClosure, 1, kValue)                            \
-  TFJ(AsyncGeneratorAwaitRejectClosure, 1, kValue)                             \
-  TFJ(AsyncGeneratorYieldResolveClosure, 1, kValue)                            \
-  TFJ(AsyncGeneratorReturnClosedResolveClosure, 1, kValue)                     \
-  TFJ(AsyncGeneratorReturnClosedRejectClosure, 1, kValue)                      \
-  TFJ(AsyncGeneratorReturnResolveClosure, 1, kValue)                           \
+  TFJ(AsyncGeneratorAwaitCaught, 2, kReceiver, kGenerator, kAwaited)           \
+  TFJ(AsyncGeneratorAwaitUncaught, 2, kReceiver, kGenerator, kAwaited)         \
+  TFJ(AsyncGeneratorAwaitResolveClosure, 1, kReceiver, kValue)                 \
+  TFJ(AsyncGeneratorAwaitRejectClosure, 1, kReceiver, kValue)                  \
+  TFJ(AsyncGeneratorYieldResolveClosure, 1, kReceiver, kValue)                 \
+  TFJ(AsyncGeneratorReturnClosedResolveClosure, 1, kReceiver, kValue)          \
+  TFJ(AsyncGeneratorReturnClosedRejectClosure, 1, kReceiver, kValue)           \
+  TFJ(AsyncGeneratorReturnResolveClosure, 1, kReceiver, kValue)                \
                                                                                \
   /* Async-from-Sync Iterator */                                               \
                                                                                \
   /* %AsyncFromSyncIteratorPrototype% */                                       \
   /* See tc39.github.io/proposal-async-iteration/ */                           \
   /* #sec-%asyncfromsynciteratorprototype%-object) */                          \
-  TFJ(AsyncFromSyncIteratorPrototypeNext, 1, kValue)                           \
+  TFJ(AsyncFromSyncIteratorPrototypeNext, 1, kReceiver, kValue)                \
+  TFJ(AsyncFromSyncIteratorPrototypeNextOptimized, 1, kReceiver, kValue)       \
   /* #sec-%asyncfromsynciteratorprototype%.throw */                            \
-  TFJ(AsyncFromSyncIteratorPrototypeThrow, 1, kReason)                         \
+  TFJ(AsyncFromSyncIteratorPrototypeThrow, 1, kReceiver, kReason)              \
+  TFJ(AsyncFromSyncIteratorPrototypeThrowOptimized, 1, kReceiver, kReason)     \
   /* #sec-%asyncfromsynciteratorprototype%.return */                           \
-  TFJ(AsyncFromSyncIteratorPrototypeReturn, 1, kValue)                         \
+  TFJ(AsyncFromSyncIteratorPrototypeReturn, 1, kReceiver, kValue)              \
+  TFJ(AsyncFromSyncIteratorPrototypeReturnOptimized, 1, kReceiver, kValue)     \
   /* #sec-async-iterator-value-unwrap-functions */                             \
-  TFJ(AsyncIteratorValueUnwrap, 1, kValue)
+  TFJ(AsyncIteratorValueUnwrap, 1, kReceiver, kValue)                          \
+                                                                               \
+  /* CEntry */                                                                 \
+  ASM(CEntry_Return1_DontSaveFPRegs_ArgvOnStack_NoBuiltinExit)                 \
+  ASM(CEntry_Return1_DontSaveFPRegs_ArgvOnStack_BuiltinExit)                   \
+  ASM(CEntry_Return1_DontSaveFPRegs_ArgvInRegister_NoBuiltinExit)              \
+  ASM(CEntry_Return1_SaveFPRegs_ArgvOnStack_NoBuiltinExit)                     \
+  ASM(CEntry_Return1_SaveFPRegs_ArgvOnStack_BuiltinExit)                       \
+  ASM(CEntry_Return2_DontSaveFPRegs_ArgvOnStack_NoBuiltinExit)                 \
+  ASM(CEntry_Return2_DontSaveFPRegs_ArgvOnStack_BuiltinExit)                   \
+  ASM(CEntry_Return2_DontSaveFPRegs_ArgvInRegister_NoBuiltinExit)              \
+  ASM(CEntry_Return2_SaveFPRegs_ArgvOnStack_NoBuiltinExit)                     \
+  ASM(CEntry_Return2_SaveFPRegs_ArgvOnStack_BuiltinExit)                       \
+                                                                               \
+  /* String helpers */                                                         \
+  TFS(StringAdd_CheckNone_NotTenured, kLeft, kRight)                           \
+  TFS(StringAdd_CheckNone_Tenured, kLeft, kRight)                              \
+  TFS(StringAdd_ConvertLeft_NotTenured, kLeft, kRight)                         \
+  TFS(StringAdd_ConvertRight_NotTenured, kLeft, kRight)                        \
+  TFS(SubString, kString, kFrom, kTo)                                          \
+                                                                               \
+  /* Miscellaneous */                                                          \
+  ASM(CallApiCallback_Argc0)                                                   \
+  ASM(CallApiCallback_Argc1)                                                   \
+  ASM(CallApiGetter)                                                           \
+  ASM(DoubleToI)                                                               \
+  TFC(GetProperty, GetProperty, 1)                                             \
+  ASM(MathPowInternal)
 
 #ifdef V8_INTL_SUPPORT
-#define BUILTIN_LIST(CPP, API, TFJ, TFC, TFS, TFH, ASM)        \
-  BUILTIN_LIST_BASE(CPP, API, TFJ, TFC, TFS, TFH, ASM)         \
-                                                               \
-  TFS(StringToLowerCaseIntl, kString)                          \
-  /* ES #sec-string.prototype.tolowercase */                   \
-  TFJ(StringPrototypeToLowerCaseIntl, 0)                       \
-  /* ES #sec-string.prototype.touppercase */                   \
-  CPP(StringPrototypeToUpperCaseIntl)                          \
-  /* ES #sec-string.prototype.normalize */                     \
-  CPP(StringPrototypeNormalizeIntl)                            \
-  /* ecma402 #sec-intl.numberformat.prototype.formattoparts */ \
-  CPP(NumberFormatPrototypeFormatToParts)
+#define BUILTIN_LIST(CPP, API, TFJ, TFC, TFS, TFH, ASM)                \
+  BUILTIN_LIST_BASE(CPP, API, TFJ, TFC, TFS, TFH, ASM)                 \
+  BUILTIN_LIST_FROM_DSL(CPP, API, TFJ, TFC, TFS, TFH, ASM)             \
+                                                                       \
+  TFS(StringToLowerCaseIntl, kString)                                  \
+  /* ES #sec-string.prototype.tolowercase */                           \
+  TFJ(StringPrototypeToLowerCaseIntl, 0, kReceiver)                    \
+  /* ES #sec-string.prototype.touppercase */                           \
+  CPP(StringPrototypeToUpperCaseIntl)                                  \
+  /* ES #sec-string.prototype.normalize */                             \
+  CPP(StringPrototypeNormalizeIntl)                                    \
+  /* ecma402 #sec-intl.numberformat.prototype.formattoparts */         \
+  CPP(NumberFormatPrototypeFormatToParts)                              \
+  /* ecma402 #sec-intl.datetimeformat.prototype.formattoparts */       \
+  CPP(DateTimeFormatPrototypeFormatToParts)                            \
+  /* ecma402 #new proposal */                                          \
+  /* ecma402 #sec-intl-locale-constructor */                           \
+  CPP(LocaleConstructor)                                               \
+  CPP(LocalePrototypeLanguage)                                         \
+  CPP(LocalePrototypeScript)                                           \
+  CPP(LocalePrototypeRegion)                                           \
+  CPP(LocalePrototypeBaseName)                                         \
+  CPP(LocalePrototypeCalendar)                                         \
+  CPP(LocalePrototypeCaseFirst)                                        \
+  CPP(LocalePrototypeCollation)                                        \
+  CPP(LocalePrototypeHourCycle)                                        \
+  CPP(LocalePrototypeNumeric)                                          \
+  CPP(LocalePrototypeNumberingSystem)                                  \
+  CPP(LocalePrototypeToString)                                         \
+  /* ecma402 #sec-number-format-functions */                           \
+  CPP(NumberFormatInternalFormatNumber)                                \
+  /* ecma402 #sec-intl.numberformat.prototype.format */                \
+  CPP(NumberFormatPrototypeFormatNumber)                               \
+  /* ecma402 #sec-intl-relativetimeformat-constructor */               \
+  CPP(RelativeTimeFormatConstructor)                                   \
+  /* ecma402 #sec-intl.relativetimeformat.prototype.resolvedoptions */ \
+  CPP(RelativeTimeFormatPrototypeResolvedOptions)
 #else
-#define BUILTIN_LIST(CPP, API, TFJ, TFC, TFS, TFH, ASM) \
-  BUILTIN_LIST_BASE(CPP, API, TFJ, TFC, TFS, TFH, ASM)  \
-                                                        \
-  /* no-op fallback version */                          \
-  CPP(StringPrototypeNormalize)                         \
-  /* same as toLowercase; fallback version */           \
-  CPP(StringPrototypeToLocaleLowerCase)                 \
-  /* same as toUppercase; fallback version */           \
-  CPP(StringPrototypeToLocaleUpperCase)                 \
-  /* (obsolete) Unibrow version */                      \
-  CPP(StringPrototypeToLowerCase)                       \
-  /* (obsolete) Unibrow version */                      \
+#define BUILTIN_LIST(CPP, API, TFJ, TFC, TFS, TFH, ASM)    \
+  BUILTIN_LIST_BASE(CPP, API, TFJ, TFC, TFS, TFH, ASM)     \
+  BUILTIN_LIST_FROM_DSL(CPP, API, TFJ, TFC, TFS, TFH, ASM) \
+                                                           \
+  /* no-op fallback version */                             \
+  CPP(StringPrototypeNormalize)                            \
+  /* same as toLowercase; fallback version */              \
+  CPP(StringPrototypeToLocaleLowerCase)                    \
+  /* same as toUppercase; fallback version */              \
+  CPP(StringPrototypeToLocaleUpperCase)                    \
+  /* (obsolete) Unibrow version */                         \
+  CPP(StringPrototypeToLowerCase)                          \
+  /* (obsolete) Unibrow version */                         \
   CPP(StringPrototypeToUpperCase)
 #endif  // V8_INTL_SUPPORT
 
@@ -1283,9 +1370,14 @@ namespace internal {
 #define BUILTIN_PROMISE_REJECTION_PREDICTION_LIST(V) \
   V(AsyncFromSyncIteratorPrototypeNext)              \
   V(AsyncFromSyncIteratorPrototypeReturn)            \
+  V(AsyncFromSyncIteratorPrototypeNextOptimized)     \
+  V(AsyncFromSyncIteratorPrototypeThrowOptimized)    \
+  V(AsyncFromSyncIteratorPrototypeReturnOptimized)   \
   V(AsyncFromSyncIteratorPrototypeThrow)             \
   V(AsyncFunctionAwaitCaught)                        \
+  V(AsyncFunctionAwaitCaughtOptimized)               \
   V(AsyncFunctionAwaitUncaught)                      \
+  V(AsyncFunctionAwaitUncaughtOptimized)             \
   V(AsyncGeneratorResolve)                           \
   V(AsyncGeneratorAwaitCaught)                       \
   V(AsyncGeneratorAwaitUncaught)                     \
diff --git a/deps/v8/src/builtins/builtins-descriptors.h b/deps/v8/src/builtins/builtins-descriptors.h
index 6026b9f721d99c..abc5d58e2735a4 100644
--- a/deps/v8/src/builtins/builtins-descriptors.h
+++ b/deps/v8/src/builtins/builtins-descriptors.h
@@ -6,22 +6,27 @@
 #define V8_BUILTINS_BUILTINS_DESCRIPTORS_H_
 
 #include "src/builtins/builtins.h"
+#include "src/compiler/code-assembler.h"
 #include "src/interface-descriptors.h"
+#include "src/objects/shared-function-info.h"
 
 namespace v8 {
 namespace internal {
 
 // Define interface descriptors for builtins with JS linkage.
-#define DEFINE_TFJ_INTERFACE_DESCRIPTOR(Name, Argc, ...) \
-  struct Builtin_##Name##_InterfaceDescriptor {          \
-    enum ParameterIndices {                              \
-      kReceiver,                                         \
-      ##__VA_ARGS__,                                     \
-      kNewTarget,                                        \
-      kActualArgumentsCount,                             \
-      kContext,                                          \
-      kParameterCount,                                   \
-    };                                                   \
+#define DEFINE_TFJ_INTERFACE_DESCRIPTOR(Name, Argc, ...)                \
+  struct Builtin_##Name##_InterfaceDescriptor {                         \
+    enum ParameterIndices {                                             \
+      kJSTarget = compiler::CodeAssembler::kTargetParameterIndex,       \
+      ##__VA_ARGS__,                                                    \
+      kJSNewTarget,                                                     \
+      kJSActualArgumentsCount,                                          \
+      kContext,                                                         \
+      kParameterCount,                                                  \
+    };                                                                  \
+    static_assert((Argc) == static_cast<uint16_t>(kParameterCount - 4), \
+                  "Inconsistent set of arguments");                     \
+    static_assert(kJSTarget == -1, "Unexpected kJSTarget index value"); \
   };
 
 // Define interface descriptors for builtins with StubCall linkage.
diff --git a/deps/v8/src/builtins/builtins-error.cc b/deps/v8/src/builtins/builtins-error.cc
index a80409794c8847..0043c42810bdb8 100644
--- a/deps/v8/src/builtins/builtins-error.cc
+++ b/deps/v8/src/builtins/builtins-error.cc
@@ -9,6 +9,7 @@
 #include "src/counters.h"
 #include "src/messages.h"
 #include "src/objects-inl.h"
+#include "src/objects/api-callbacks.h"
 #include "src/property-descriptor.h"
 #include "src/string-builder.h"
 
@@ -74,7 +75,7 @@ BUILTIN(ErrorCaptureStackTrace) {
 
   RETURN_FAILURE_ON_EXCEPTION(
       isolate, JSObject::SetAccessor(object, name, error_stack, DONT_ENUM));
-  return isolate->heap()->undefined_value();
+  return ReadOnlyRoots(isolate).undefined_value();
 }
 
 // ES6 section 19.5.3.4 Error.prototype.toString ( )
diff --git a/deps/v8/src/builtins/builtins-function-gen.cc b/deps/v8/src/builtins/builtins-function-gen.cc
index 05b0fb9fcd826e..4924d4c0c41173 100644
--- a/deps/v8/src/builtins/builtins-function-gen.cc
+++ b/deps/v8/src/builtins/builtins-function-gen.cc
@@ -6,6 +6,7 @@
 #include "src/builtins/builtins.h"
 #include "src/code-stub-assembler.h"
 #include "src/frame-constants.h"
+#include "src/objects/api-callbacks.h"
 #include "src/objects/descriptor-array.h"
 
 namespace v8 {
@@ -16,9 +17,9 @@ TF_BUILTIN(FastFunctionPrototypeBind, CodeStubAssembler) {
 
   // TODO(ishell): use constants from Descriptor once the JSFunction linkage
   // arguments are reordered.
-  Node* argc = Parameter(BuiltinDescriptor::kArgumentsCount);
-  Node* context = Parameter(BuiltinDescriptor::kContext);
-  Node* new_target = Parameter(BuiltinDescriptor::kNewTarget);
+  Node* argc = Parameter(Descriptor::kJSActualArgumentsCount);
+  Node* context = Parameter(Descriptor::kContext);
+  Node* new_target = Parameter(Descriptor::kJSNewTarget);
 
   CodeStubArguments args(this, ChangeInt32ToIntPtr(argc));
 
@@ -48,7 +49,7 @@ TF_BUILTIN(FastFunctionPrototypeBind, CodeStubAssembler) {
   // Minimum descriptor array length required for fast path.
   const int min_descriptors_length = DescriptorArray::LengthFor(Max(
       JSFunction::kLengthDescriptorIndex, JSFunction::kNameDescriptorIndex));
-  TNode<Smi> descriptors_length = LoadFixedArrayBaseLength(descriptors);
+  TNode<Smi> descriptors_length = LoadWeakFixedArrayLength(descriptors);
   GotoIf(SmiLessThanOrEqual(descriptors_length,
                             SmiConstant(min_descriptors_length)),
          &slow);
@@ -59,25 +60,25 @@ TF_BUILTIN(FastFunctionPrototypeBind, CodeStubAssembler) {
   Comment("Check name and length properties");
   {
     const int length_index = JSFunction::kLengthDescriptorIndex;
-    TNode<Name> maybe_length = CAST(LoadFixedArrayElement(
+    TNode<Name> maybe_length = CAST(LoadWeakFixedArrayElement(
         descriptors, DescriptorArray::ToKeyIndex(length_index)));
     GotoIf(WordNotEqual(maybe_length, LoadRoot(Heap::klength_stringRootIndex)),
            &slow);
 
-    TNode<Object> maybe_length_accessor = LoadFixedArrayElement(
-        descriptors, DescriptorArray::ToValueIndex(length_index));
+    TNode<Object> maybe_length_accessor = CAST(LoadWeakFixedArrayElement(
+        descriptors, DescriptorArray::ToValueIndex(length_index)));
     GotoIf(TaggedIsSmi(maybe_length_accessor), &slow);
     Node* length_value_map = LoadMap(CAST(maybe_length_accessor));
     GotoIfNot(IsAccessorInfoMap(length_value_map), &slow);
 
     const int name_index = JSFunction::kNameDescriptorIndex;
-    TNode<Name> maybe_name = CAST(LoadFixedArrayElement(
+    TNode<Name> maybe_name = CAST(LoadWeakFixedArrayElement(
         descriptors, DescriptorArray::ToKeyIndex(name_index)));
     GotoIf(WordNotEqual(maybe_name, LoadRoot(Heap::kname_stringRootIndex)),
            &slow);
 
-    TNode<Object> maybe_name_accessor = LoadFixedArrayElement(
-        descriptors, DescriptorArray::ToValueIndex(name_index));
+    TNode<Object> maybe_name_accessor = CAST(LoadWeakFixedArrayElement(
+        descriptors, DescriptorArray::ToValueIndex(name_index)));
     GotoIf(TaggedIsSmi(maybe_name_accessor), &slow);
     TNode<Map> name_value_map = LoadMap(CAST(maybe_name_accessor));
     GotoIfNot(IsAccessorInfoMap(name_value_map), &slow);
@@ -120,11 +121,10 @@ TF_BUILTIN(FastFunctionPrototypeBind, CodeStubAssembler) {
     Label empty_arguments(this);
     Label arguments_done(this, &argument_array);
     GotoIf(Uint32LessThanOrEqual(argc, Int32Constant(1)), &empty_arguments);
-    Node* elements_length =
-        ChangeUint32ToWord(Unsigned(Int32Sub(argc, Int32Constant(1))));
-    Node* elements =
-        AllocateFixedArray(PACKED_ELEMENTS, elements_length, INTPTR_PARAMETERS,
-                           kAllowLargeObjectAllocation);
+    TNode<IntPtrT> elements_length =
+        Signed(ChangeUint32ToWord(Unsigned(Int32Sub(argc, Int32Constant(1)))));
+    Node* elements = AllocateFixedArray(PACKED_ELEMENTS, elements_length,
+                                        kAllowLargeObjectAllocation);
     VARIABLE(index, MachineType::PointerRepresentation());
     index.Bind(IntPtrConstant(0));
     VariableList foreach_vars({&index}, zone());
@@ -184,10 +184,14 @@ TF_BUILTIN(FastFunctionPrototypeBind, CodeStubAssembler) {
   }
 
   BIND(&slow);
-  Node* target = LoadFromFrame(StandardFrameConstants::kFunctionOffset,
-                               MachineType::TaggedPointer());
-  TailCallStub(CodeFactory::FunctionPrototypeBind(isolate()), context, target,
-               new_target, argc);
+  {
+    // We are not using Parameter(Descriptor::kJSTarget) and loading the value
+    // from the current frame here in order to reduce register pressure on the
+    // fast path.
+    TNode<JSFunction> target = LoadTargetFromFrame();
+    TailCallBuiltin(Builtins::kFunctionPrototypeBind, context, target,
+                    new_target, argc);
+  }
 }
 
 // ES6 #sec-function.prototype-@@hasinstance
diff --git a/deps/v8/src/builtins/builtins-function.cc b/deps/v8/src/builtins/builtins-function.cc
index cc6d237af68ddf..d0e96847c9a5d2 100644
--- a/deps/v8/src/builtins/builtins-function.cc
+++ b/deps/v8/src/builtins/builtins-function.cc
@@ -10,6 +10,7 @@
 #include "src/counters.h"
 #include "src/lookup.h"
 #include "src/objects-inl.h"
+#include "src/objects/api-callbacks.h"
 #include "src/string-builder.h"
 
 namespace v8 {
@@ -52,7 +53,7 @@ MaybeHandle<Object> CreateDynamicFunction(Isolate* isolate,
         Handle<String> param;
         ASSIGN_RETURN_ON_EXCEPTION(
             isolate, param, Object::ToString(isolate, args.at(i)), Object);
-        param = String::Flatten(param);
+        param = String::Flatten(isolate, param);
         builder.AppendString(param);
         if (!FLAG_harmony_function_tostring) {
           // If the formal parameters string include ) - an illegal
@@ -134,7 +135,7 @@ MaybeHandle<Object> CreateDynamicFunction(Isolate* isolate,
         JSFunction::GetDerivedMap(isolate, target, new_target), Object);
 
     Handle<SharedFunctionInfo> shared_info(function->shared(), isolate);
-    Handle<Map> map = Map::AsLanguageMode(initial_map, shared_info);
+    Handle<Map> map = Map::AsLanguageMode(isolate, initial_map, shared_info);
 
     Handle<Context> context(function->context(), isolate);
     function = isolate->factory()->NewFunctionFromSharedFunctionInfo(
@@ -172,7 +173,8 @@ BUILTIN(AsyncFunctionConstructor) {
   // Do not lazily compute eval position for AsyncFunction, as they may not be
   // determined after the function is resumed.
   Handle<JSFunction> func = Handle<JSFunction>::cast(maybe_func);
-  Handle<Script> script = handle(Script::cast(func->shared()->script()));
+  Handle<Script> script =
+      handle(Script::cast(func->shared()->script()), isolate);
   int position = script->GetEvalPosition();
   USE(position);
 
@@ -190,7 +192,8 @@ BUILTIN(AsyncGeneratorFunctionConstructor) {
   // Do not lazily compute eval position for AsyncFunction, as they may not be
   // determined after the function is resumed.
   Handle<JSFunction> func = Handle<JSFunction>::cast(maybe_func);
-  Handle<Script> script = handle(Script::cast(func->shared()->script()));
+  Handle<Script> script =
+      handle(Script::cast(func->shared()->script()), isolate);
   int position = script->GetEvalPosition();
   USE(position);
 
@@ -234,7 +237,7 @@ Object* DoFunctionBind(Isolate* isolate, BuiltinArguments args) {
     Handle<Object> length(Smi::kZero, isolate);
     Maybe<PropertyAttributes> attributes =
         JSReceiver::GetPropertyAttributes(&length_lookup);
-    if (attributes.IsNothing()) return isolate->heap()->exception();
+    if (attributes.IsNothing()) return ReadOnlyRoots(isolate).exception();
     if (attributes.FromJust() != ABSENT) {
       Handle<Object> target_length;
       ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, target_length,
@@ -302,7 +305,7 @@ BUILTIN(FunctionPrototypeToString) {
   // receivers for this method.
   if (FLAG_harmony_function_tostring && receiver->IsJSReceiver() &&
       JSReceiver::cast(*receiver)->map()->is_callable()) {
-    return isolate->heap()->function_native_code_string();
+    return ReadOnlyRoots(isolate).function_native_code_string();
   }
   THROW_NEW_ERROR_RETURN_FAILURE(
       isolate, NewTypeError(MessageTemplate::kNotGeneric,
diff --git a/deps/v8/src/builtins/builtins-generator-gen.cc b/deps/v8/src/builtins/builtins-generator-gen.cc
index 07a56c86eda1d4..b7f296ac4d0a91 100644
--- a/deps/v8/src/builtins/builtins-generator-gen.cc
+++ b/deps/v8/src/builtins/builtins-generator-gen.cc
@@ -35,11 +35,11 @@ void GeneratorBuiltinsAssembler::GeneratorPrototypeResume(
             &if_receiverisincompatible);
 
   // Check if the {receiver} is running or already closed.
-  Node* receiver_continuation =
-      LoadObjectField(receiver, JSGeneratorObject::kContinuationOffset);
+  TNode<Smi> receiver_continuation =
+      CAST(LoadObjectField(receiver, JSGeneratorObject::kContinuationOffset));
   Label if_receiverisclosed(this, Label::kDeferred),
       if_receiverisrunning(this, Label::kDeferred);
-  Node* closed = SmiConstant(JSGeneratorObject::kGeneratorClosed);
+  TNode<Smi> closed = SmiConstant(JSGeneratorObject::kGeneratorClosed);
   GotoIf(SmiEqual(receiver_continuation, closed), &if_receiverisclosed);
   DCHECK_LT(JSGeneratorObject::kGeneratorExecuting,
             JSGeneratorObject::kGeneratorClosed);
@@ -59,14 +59,14 @@ void GeneratorBuiltinsAssembler::GeneratorPrototypeResume(
 
   // If the generator is not suspended (i.e., its state is 'executing'),
   // close it and wrap the return value in IteratorResult.
-  Node* result_continuation =
-      LoadObjectField(receiver, JSGeneratorObject::kContinuationOffset);
+  TNode<Smi> result_continuation =
+      CAST(LoadObjectField(receiver, JSGeneratorObject::kContinuationOffset));
 
   // The generator function should not close the generator by itself, let's
   // check it is indeed not closed yet.
   CSA_ASSERT(this, SmiNotEqual(result_continuation, closed));
 
-  Node* executing = SmiConstant(JSGeneratorObject::kGeneratorExecuting);
+  TNode<Smi> executing = SmiConstant(JSGeneratorObject::kGeneratorExecuting);
   GotoIf(SmiEqual(result_continuation, executing), &if_final_return);
 
   args->PopAndReturn(result);
@@ -125,12 +125,12 @@ TF_BUILTIN(GeneratorPrototypeNext, GeneratorBuiltinsAssembler) {
   const int kValueArg = 0;
 
   Node* argc =
-      ChangeInt32ToIntPtr(Parameter(BuiltinDescriptor::kArgumentsCount));
+      ChangeInt32ToIntPtr(Parameter(Descriptor::kJSActualArgumentsCount));
   CodeStubArguments args(this, argc);
 
   Node* receiver = args.GetReceiver();
   Node* value = args.GetOptionalArgumentValue(kValueArg);
-  Node* context = Parameter(BuiltinDescriptor::kContext);
+  Node* context = Parameter(Descriptor::kContext);
 
   GeneratorPrototypeResume(&args, receiver, value, context,
                            JSGeneratorObject::kNext,
@@ -142,12 +142,12 @@ TF_BUILTIN(GeneratorPrototypeReturn, GeneratorBuiltinsAssembler) {
   const int kValueArg = 0;
 
   Node* argc =
-      ChangeInt32ToIntPtr(Parameter(BuiltinDescriptor::kArgumentsCount));
+      ChangeInt32ToIntPtr(Parameter(Descriptor::kJSActualArgumentsCount));
   CodeStubArguments args(this, argc);
 
   Node* receiver = args.GetReceiver();
   Node* value = args.GetOptionalArgumentValue(kValueArg);
-  Node* context = Parameter(BuiltinDescriptor::kContext);
+  Node* context = Parameter(Descriptor::kContext);
 
   GeneratorPrototypeResume(&args, receiver, value, context,
                            JSGeneratorObject::kReturn,
@@ -159,12 +159,12 @@ TF_BUILTIN(GeneratorPrototypeThrow, GeneratorBuiltinsAssembler) {
   const int kExceptionArg = 0;
 
   Node* argc =
-      ChangeInt32ToIntPtr(Parameter(BuiltinDescriptor::kArgumentsCount));
+      ChangeInt32ToIntPtr(Parameter(Descriptor::kJSActualArgumentsCount));
   CodeStubArguments args(this, argc);
 
   Node* receiver = args.GetReceiver();
   Node* exception = args.GetOptionalArgumentValue(kExceptionArg);
-  Node* context = Parameter(BuiltinDescriptor::kContext);
+  Node* context = Parameter(Descriptor::kContext);
 
   GeneratorPrototypeResume(&args, receiver, exception, context,
                            JSGeneratorObject::kThrow,
diff --git a/deps/v8/src/builtins/builtins-global.cc b/deps/v8/src/builtins/builtins-global.cc
index 4d3337f2135a91..3c71a322f9ea04 100644
--- a/deps/v8/src/builtins/builtins-global.cc
+++ b/deps/v8/src/builtins/builtins-global.cc
@@ -89,7 +89,7 @@ BUILTIN(GlobalEval) {
   if (!x->IsString()) return *x;
   if (!Builtins::AllowDynamicFunction(isolate, target, target_global_proxy)) {
     isolate->CountUsage(v8::Isolate::kFunctionConstructorReturnedUndefined);
-    return isolate->heap()->undefined_value();
+    return ReadOnlyRoots(isolate).undefined_value();
   }
   Handle<JSFunction> function;
   ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
diff --git a/deps/v8/src/builtins/builtins-ic-gen.cc b/deps/v8/src/builtins/builtins-ic-gen.cc
index 2439cd9d7bd15d..7ee50345aadea3 100644
--- a/deps/v8/src/builtins/builtins-ic-gen.cc
+++ b/deps/v8/src/builtins/builtins-ic-gen.cc
@@ -25,7 +25,6 @@ IC_BUILTIN(LoadIC_Noninlined)
 IC_BUILTIN(LoadIC_Uninitialized)
 IC_BUILTIN(KeyedLoadIC)
 IC_BUILTIN(LoadICTrampoline)
-IC_BUILTIN(LoadField)
 IC_BUILTIN(KeyedLoadICTrampoline)
 IC_BUILTIN(KeyedLoadIC_Megamorphic)
 IC_BUILTIN(KeyedLoadIC_PolymorphicName)
diff --git a/deps/v8/src/builtins/builtins-internal-gen.cc b/deps/v8/src/builtins/builtins-internal-gen.cc
index 4e533ad1c4c503..658ab03d062eeb 100644
--- a/deps/v8/src/builtins/builtins-internal-gen.cc
+++ b/deps/v8/src/builtins/builtins-internal-gen.cc
@@ -176,19 +176,21 @@ TF_BUILTIN(ReturnReceiver, CodeStubAssembler) {
 
 TF_BUILTIN(DebugBreakTrampoline, CodeStubAssembler) {
   Label tailcall_to_shared(this);
-  TNode<Context> context = CAST(Parameter(BuiltinDescriptor::kContext));
-  TNode<Object> new_target = CAST(Parameter(BuiltinDescriptor::kNewTarget));
+  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
+  TNode<Object> new_target = CAST(Parameter(Descriptor::kJSNewTarget));
   TNode<Int32T> arg_count =
-      UncheckedCast<Int32T>(Parameter(BuiltinDescriptor::kArgumentsCount));
-  TNode<JSFunction> function = CAST(LoadFromFrame(
-      StandardFrameConstants::kFunctionOffset, MachineType::TaggedPointer()));
+      UncheckedCast<Int32T>(Parameter(Descriptor::kJSActualArgumentsCount));
+  TNode<JSFunction> function = CAST(Parameter(Descriptor::kJSTarget));
 
   // Check break-at-entry flag on the debug info.
   TNode<SharedFunctionInfo> shared =
       CAST(LoadObjectField(function, JSFunction::kSharedFunctionInfoOffset));
-  TNode<Object> maybe_debug_info =
-      LoadObjectField(shared, SharedFunctionInfo::kDebugInfoOffset);
-  GotoIf(TaggedIsSmi(maybe_debug_info), &tailcall_to_shared);
+  TNode<Object> maybe_heap_object_or_smi = LoadObjectField(
+      shared, SharedFunctionInfo::kFunctionIdentifierOrDebugInfoOffset);
+  TNode<HeapObject> maybe_debug_info =
+      TaggedToHeapObject(maybe_heap_object_or_smi, &tailcall_to_shared);
+  GotoIfNot(HasInstanceType(maybe_debug_info, InstanceType::DEBUG_INFO_TYPE),
+            &tailcall_to_shared);
 
   {
     TNode<DebugInfo> debug_info = CAST(maybe_debug_info);
@@ -204,11 +206,7 @@ TF_BUILTIN(DebugBreakTrampoline, CodeStubAssembler) {
   BIND(&tailcall_to_shared);
   // Tail call into code object on the SharedFunctionInfo.
   TNode<Code> code = GetSharedFunctionInfoCode(shared);
-  // Use the ConstructTrampolineDescriptor because it passes new.target too in
-  // case this is called during construct.
-  CSA_ASSERT(this, IsCode(code));
-  ConstructTrampolineDescriptor descriptor(isolate());
-  TailCallStub(descriptor, code, context, function, new_target, arg_count);
+  TailCallJSCode(code, context, function, new_target, arg_count);
 }
 
 class RecordWriteCodeStubAssembler : public CodeStubAssembler {
@@ -383,8 +381,8 @@ class RecordWriteCodeStubAssembler : public CodeStubAssembler {
 
     BIND(&overflow);
     {
-      Node* function = ExternalConstant(
-          ExternalReference::store_buffer_overflow_function(this->isolate()));
+      Node* function =
+          ExternalConstant(ExternalReference::store_buffer_overflow_function());
       CallCFunction1WithCallerSavedRegistersMode(MachineType::Int32(),
                                                  MachineType::Pointer(),
                                                  function, isolate, mode, next);
@@ -467,8 +465,7 @@ TF_BUILTIN(RecordWrite, RecordWriteCodeStubAssembler) {
     BIND(&call_incremental_wb);
     {
       Node* function = ExternalConstant(
-          ExternalReference::incremental_marking_record_write_function(
-              this->isolate()));
+          ExternalReference::incremental_marking_record_write_function());
       CallCFunction3WithCallerSavedRegistersMode(
           MachineType::Int32(), MachineType::Pointer(), MachineType::Pointer(),
           MachineType::Pointer(), function, object, slot, isolate, fp_mode,
@@ -485,22 +482,23 @@ class DeletePropertyBaseAssembler : public AccessorAssembler {
   explicit DeletePropertyBaseAssembler(compiler::CodeAssemblerState* state)
       : AccessorAssembler(state) {}
 
-  void DeleteDictionaryProperty(Node* receiver, Node* properties, Node* name,
-                                Node* context, Label* dont_delete,
-                                Label* notfound) {
-    VARIABLE(var_name_index, MachineType::PointerRepresentation());
+  void DeleteDictionaryProperty(TNode<Object> receiver,
+                                TNode<NameDictionary> properties,
+                                TNode<Name> name, TNode<Context> context,
+                                Label* dont_delete, Label* notfound) {
+    TVARIABLE(IntPtrT, var_name_index);
     Label dictionary_found(this, &var_name_index);
     NameDictionaryLookup<NameDictionary>(properties, name, &dictionary_found,
                                          &var_name_index, notfound);
 
     BIND(&dictionary_found);
-    Node* key_index = var_name_index.value();
-    Node* details =
+    TNode<IntPtrT> key_index = var_name_index.value();
+    TNode<Uint32T> details =
         LoadDetailsByKeyIndex<NameDictionary>(properties, key_index);
     GotoIf(IsSetWord32(details, PropertyDetails::kAttributesDontDeleteMask),
            dont_delete);
     // Overwrite the entry itself (see NameDictionary::SetEntry).
-    Node* filler = TheHoleConstant();
+    TNode<HeapObject> filler = TheHoleConstant();
     DCHECK(Heap::RootIsImmortalImmovable(Heap::kTheHoleValueRootIndex));
     StoreFixedArrayElement(properties, key_index, filler, SKIP_WRITE_BARRIER);
     StoreValueByKeyIndex<NameDictionary>(properties, key_index, filler,
@@ -509,16 +507,17 @@ class DeletePropertyBaseAssembler : public AccessorAssembler {
                                            SmiConstant(0));
 
     // Update bookkeeping information (see NameDictionary::ElementRemoved).
-    Node* nof = GetNumberOfElements<NameDictionary>(properties);
-    Node* new_nof = SmiSub(nof, SmiConstant(1));
+    TNode<Smi> nof = GetNumberOfElements<NameDictionary>(properties);
+    TNode<Smi> new_nof = SmiSub(nof, SmiConstant(1));
     SetNumberOfElements<NameDictionary>(properties, new_nof);
-    Node* num_deleted = GetNumberOfDeletedElements<NameDictionary>(properties);
-    Node* new_deleted = SmiAdd(num_deleted, SmiConstant(1));
+    TNode<Smi> num_deleted =
+        GetNumberOfDeletedElements<NameDictionary>(properties);
+    TNode<Smi> new_deleted = SmiAdd(num_deleted, SmiConstant(1));
     SetNumberOfDeletedElements<NameDictionary>(properties, new_deleted);
 
     // Shrink the dictionary if necessary (see NameDictionary::Shrink).
     Label shrinking_done(this);
-    Node* capacity = GetCapacity<NameDictionary>(properties);
+    TNode<Smi> capacity = GetCapacity<NameDictionary>(properties);
     GotoIf(SmiGreaterThan(new_nof, SmiShr(capacity, 2)), &shrinking_done);
     GotoIf(SmiLessThan(new_nof, SmiConstant(16)), &shrinking_done);
     CallRuntime(Runtime::kShrinkPropertyDictionary, context, receiver);
@@ -530,10 +529,10 @@ class DeletePropertyBaseAssembler : public AccessorAssembler {
 };
 
 TF_BUILTIN(DeleteProperty, DeletePropertyBaseAssembler) {
-  Node* receiver = Parameter(Descriptor::kObject);
-  Node* key = Parameter(Descriptor::kKey);
-  Node* language_mode = Parameter(Descriptor::kLanguageMode);
-  Node* context = Parameter(Descriptor::kContext);
+  TNode<Object> receiver = CAST(Parameter(Descriptor::kObject));
+  TNode<Object> key = CAST(Parameter(Descriptor::kKey));
+  TNode<Smi> language_mode = CAST(Parameter(Descriptor::kLanguageMode));
+  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
 
   VARIABLE(var_index, MachineType::PointerRepresentation());
   VARIABLE(var_unique, MachineRepresentation::kTagged, key);
@@ -541,11 +540,9 @@ TF_BUILTIN(DeleteProperty, DeletePropertyBaseAssembler) {
       if_notfound(this), slow(this);
 
   GotoIf(TaggedIsSmi(receiver), &slow);
-  Node* receiver_map = LoadMap(receiver);
-  Node* instance_type = LoadMapInstanceType(receiver_map);
-  GotoIf(Int32LessThanOrEqual(instance_type,
-                              Int32Constant(LAST_CUSTOM_ELEMENTS_RECEIVER)),
-         &slow);
+  TNode<Map> receiver_map = LoadMap(CAST(receiver));
+  TNode<Int32T> instance_type = LoadMapInstanceType(receiver_map);
+  GotoIf(IsCustomElementsReceiverInstanceType(instance_type), &slow);
   TryToName(key, &if_index, &var_index, &if_unique_name, &var_unique, &slow,
             &if_notunique);
 
@@ -558,7 +555,7 @@ TF_BUILTIN(DeleteProperty, DeletePropertyBaseAssembler) {
   BIND(&if_unique_name);
   {
     Comment("key is unique name");
-    Node* unique = var_unique.value();
+    TNode<Name> unique = CAST(var_unique.value());
     CheckForAssociatedProtector(unique, &slow);
 
     Label dictionary(this), dont_delete(this);
@@ -572,7 +569,8 @@ TF_BUILTIN(DeleteProperty, DeletePropertyBaseAssembler) {
     {
       InvalidateValidityCellIfPrototype(receiver_map);
 
-      Node* properties = LoadSlowProperties(receiver);
+      TNode<NameDictionary> properties =
+          CAST(LoadSlowProperties(CAST(receiver)));
       DeleteDictionaryProperty(receiver, properties, unique, context,
                                &dont_delete, &if_notfound);
     }
@@ -672,12 +670,12 @@ class InternalBuiltinsAssembler : public CodeStubAssembler {
                       SloppyTNode<HeapObject> promise_or_capability);
 
   TNode<Object> GetPendingException() {
-    auto ref = ExternalReference(kPendingExceptionAddress, isolate());
+    auto ref = ExternalReference::Create(kPendingExceptionAddress, isolate());
     return TNode<Object>::UncheckedCast(
         Load(MachineType::AnyTagged(), ExternalConstant(ref)));
   }
   void ClearPendingException() {
-    auto ref = ExternalReference(kPendingExceptionAddress, isolate());
+    auto ref = ExternalReference::Create(kPendingExceptionAddress, isolate());
     StoreNoWriteBarrier(MachineRepresentation::kTagged, ExternalConstant(ref),
                         TheHoleConstant());
   }
@@ -692,8 +690,61 @@ class InternalBuiltinsAssembler : public CodeStubAssembler {
     StoreNoWriteBarrier(MachineRepresentation::kTagged, ExternalConstant(ref),
                         TheHoleConstant());
   }
+
+  template <typename Descriptor>
+  void GenerateAdaptorWithExitFrameType(
+      Builtins::ExitFrameType exit_frame_type);
 };
 
+template <typename Descriptor>
+void InternalBuiltinsAssembler::GenerateAdaptorWithExitFrameType(
+    Builtins::ExitFrameType exit_frame_type) {
+  TNode<JSFunction> target = CAST(Parameter(Descriptor::kTarget));
+  TNode<Object> new_target = CAST(Parameter(Descriptor::kNewTarget));
+  TNode<WordT> c_function =
+      UncheckedCast<WordT>(Parameter(Descriptor::kCFunction));
+
+  // The logic contained here is mirrored for TurboFan inlining in
+  // JSTypedLowering::ReduceJSCall{Function,Construct}. Keep these in sync.
+
+  // Make sure we operate in the context of the called function (for example
+  // ConstructStubs implemented in C++ will be run in the context of the caller
+  // instead of the callee, due to the way that [[Construct]] is defined for
+  // ordinary functions).
+  TNode<Context> context =
+      CAST(LoadObjectField(target, JSFunction::kContextOffset));
+
+  // Update arguments count for CEntry to contain the number of arguments
+  // including the receiver and the extra arguments.
+  TNode<Int32T> argc =
+      UncheckedCast<Int32T>(Parameter(Descriptor::kActualArgumentsCount));
+  argc = Int32Add(
+      argc,
+      Int32Constant(BuiltinExitFrameConstants::kNumExtraArgsWithReceiver));
+
+  TNode<Code> code = HeapConstant(
+      CodeFactory::CEntry(isolate(), 1, kDontSaveFPRegs, kArgvOnStack,
+                          exit_frame_type == Builtins::BUILTIN_EXIT));
+
+  // Unconditionally push argc, target and new target as extra stack arguments.
+  // They will be used by stack frame iterators when constructing stack trace.
+  TailCallStub(CEntry1ArgvOnStackDescriptor{},  // descriptor
+               code, context,       // standard arguments for TailCallStub
+               argc, c_function,    // register arguments
+               TheHoleConstant(),   // additional stack argument 1 (padding)
+               SmiFromInt32(argc),  // additional stack argument 2
+               target,              // additional stack argument 3
+               new_target);         // additional stack argument 4
+}
+
+TF_BUILTIN(AdaptorWithExitFrame, InternalBuiltinsAssembler) {
+  GenerateAdaptorWithExitFrameType<Descriptor>(Builtins::EXIT);
+}
+
+TF_BUILTIN(AdaptorWithBuiltinExitFrame, InternalBuiltinsAssembler) {
+  GenerateAdaptorWithExitFrameType<Descriptor>(Builtins::BUILTIN_EXIT);
+}
+
 TNode<IntPtrT> InternalBuiltinsAssembler::GetPendingMicrotaskCount() {
   auto ref = ExternalReference::pending_microtask_count_address(isolate());
   if (kIntSize == 8) {
@@ -728,13 +779,13 @@ void InternalBuiltinsAssembler::SetMicrotaskQueue(TNode<FixedArray> queue) {
 }
 
 TNode<Context> InternalBuiltinsAssembler::GetCurrentContext() {
-  auto ref = ExternalReference(kContextAddress, isolate());
+  auto ref = ExternalReference::Create(kContextAddress, isolate());
   return TNode<Context>::UncheckedCast(
       Load(MachineType::AnyTagged(), ExternalConstant(ref)));
 }
 
 void InternalBuiltinsAssembler::SetCurrentContext(TNode<Context> context) {
-  auto ref = ExternalReference(kContextAddress, isolate());
+  auto ref = ExternalReference::Create(kContextAddress, isolate());
   StoreNoWriteBarrier(MachineRepresentation::kTagged, ExternalConstant(ref),
                       context);
 }
@@ -792,7 +843,8 @@ void InternalBuiltinsAssembler::RunPromiseHook(
     Runtime::FunctionId id, TNode<Context> context,
     SloppyTNode<HeapObject> promise_or_capability) {
   Label hook(this, Label::kDeferred), done_hook(this);
-  Branch(IsPromiseHookEnabledOrDebugIsActive(), &hook, &done_hook);
+  GotoIf(IsDebugActive(), &hook);
+  Branch(IsPromiseHookEnabledOrHasAsyncEventDelegate(), &hook, &done_hook);
   BIND(&hook);
   {
     // Get to the underlying JSPromise instance.
@@ -838,7 +890,7 @@ TF_BUILTIN(EnqueueMicrotask, InternalBuiltinsAssembler) {
       // This is the likely case where the new queue fits into new space,
       // and thus we don't need any write barriers for initializing it.
       TNode<FixedArray> new_queue =
-          CAST(AllocateFixedArray(PACKED_ELEMENTS, new_queue_length));
+          AllocateFixedArray(PACKED_ELEMENTS, new_queue_length);
       CopyFixedArrayElements(PACKED_ELEMENTS, queue, new_queue, num_tasks,
                              SKIP_WRITE_BARRIER);
       StoreFixedArrayElement(new_queue, num_tasks, microtask,
@@ -852,9 +904,9 @@ TF_BUILTIN(EnqueueMicrotask, InternalBuiltinsAssembler) {
     BIND(&if_lospace);
     {
       // The fallback case where the new queue ends up in large object space.
-      TNode<FixedArray> new_queue = CAST(AllocateFixedArray(
+      TNode<FixedArray> new_queue = AllocateFixedArray(
           PACKED_ELEMENTS, new_queue_length, INTPTR_PARAMETERS,
-          AllocationFlag::kAllowLargeObjectAllocation));
+          AllocationFlag::kAllowLargeObjectAllocation);
       CopyFixedArrayElements(PACKED_ELEMENTS, queue, new_queue, num_tasks);
       StoreFixedArrayElement(new_queue, num_tasks, microtask);
       FillFixedArrayWithValue(PACKED_ELEMENTS, new_queue, new_num_tasks,
@@ -960,7 +1012,7 @@ TF_BUILTIN(RunMicrotasks, InternalBuiltinsAssembler) {
             LoadObjectField(microtask, CallbackTask::kDataOffset);
 
         // If this turns out to become a bottleneck because of the calls
-        // to C++ via CEntryStub, we can choose to speed them up using a
+        // to C++ via CEntry, we can choose to speed them up using a
         // similar mechanism that we use for the CallApiFunction stub,
         // except that calling the MicrotaskCallback is even easier, since
         // it doesn't accept any tagged parameters, doesn't return a value
@@ -1091,10 +1143,165 @@ TF_BUILTIN(RunMicrotasks, InternalBuiltinsAssembler) {
   }
 }
 
+TF_BUILTIN(AllocateInNewSpace, CodeStubAssembler) {
+  TNode<Int32T> requested_size =
+      UncheckedCast<Int32T>(Parameter(Descriptor::kRequestedSize));
+
+  TailCallRuntime(Runtime::kAllocateInNewSpace, NoContextConstant(),
+                  SmiFromInt32(requested_size));
+}
+
+TF_BUILTIN(AllocateInOldSpace, CodeStubAssembler) {
+  TNode<Int32T> requested_size =
+      UncheckedCast<Int32T>(Parameter(Descriptor::kRequestedSize));
+
+  int flags = AllocateTargetSpace::encode(OLD_SPACE);
+  TailCallRuntime(Runtime::kAllocateInTargetSpace, NoContextConstant(),
+                  SmiFromInt32(requested_size), SmiConstant(flags));
+}
+
+TF_BUILTIN(Abort, CodeStubAssembler) {
+  TNode<Smi> message_id = CAST(Parameter(Descriptor::kMessageOrMessageId));
+  TailCallRuntime(Runtime::kAbort, NoContextConstant(), message_id);
+}
+
 TF_BUILTIN(AbortJS, CodeStubAssembler) {
-  Node* message = Parameter(Descriptor::kObject);
-  Node* reason = SmiConstant(0);
-  TailCallRuntime(Runtime::kAbortJS, reason, message);
+  TNode<String> message = CAST(Parameter(Descriptor::kMessageOrMessageId));
+  TailCallRuntime(Runtime::kAbortJS, NoContextConstant(), message);
+}
+
+void Builtins::Generate_CEntry_Return1_DontSaveFPRegs_ArgvOnStack_NoBuiltinExit(
+    MacroAssembler* masm) {
+  Generate_CEntry(masm, 1, kDontSaveFPRegs, kArgvOnStack, false);
+}
+
+void Builtins::Generate_CEntry_Return1_DontSaveFPRegs_ArgvOnStack_BuiltinExit(
+    MacroAssembler* masm) {
+  Generate_CEntry(masm, 1, kDontSaveFPRegs, kArgvOnStack, true);
+}
+
+void Builtins::
+    Generate_CEntry_Return1_DontSaveFPRegs_ArgvInRegister_NoBuiltinExit(
+        MacroAssembler* masm) {
+  Generate_CEntry(masm, 1, kDontSaveFPRegs, kArgvInRegister, false);
+}
+
+void Builtins::Generate_CEntry_Return1_SaveFPRegs_ArgvOnStack_NoBuiltinExit(
+    MacroAssembler* masm) {
+  Generate_CEntry(masm, 1, kSaveFPRegs, kArgvOnStack, false);
+}
+
+void Builtins::Generate_CEntry_Return1_SaveFPRegs_ArgvOnStack_BuiltinExit(
+    MacroAssembler* masm) {
+  Generate_CEntry(masm, 1, kSaveFPRegs, kArgvOnStack, true);
+}
+
+void Builtins::Generate_CEntry_Return2_DontSaveFPRegs_ArgvOnStack_NoBuiltinExit(
+    MacroAssembler* masm) {
+  Generate_CEntry(masm, 2, kDontSaveFPRegs, kArgvOnStack, false);
+}
+
+void Builtins::Generate_CEntry_Return2_DontSaveFPRegs_ArgvOnStack_BuiltinExit(
+    MacroAssembler* masm) {
+  Generate_CEntry(masm, 2, kDontSaveFPRegs, kArgvOnStack, true);
+}
+
+void Builtins::
+    Generate_CEntry_Return2_DontSaveFPRegs_ArgvInRegister_NoBuiltinExit(
+        MacroAssembler* masm) {
+  Generate_CEntry(masm, 2, kDontSaveFPRegs, kArgvInRegister, false);
+}
+
+void Builtins::Generate_CEntry_Return2_SaveFPRegs_ArgvOnStack_NoBuiltinExit(
+    MacroAssembler* masm) {
+  Generate_CEntry(masm, 2, kSaveFPRegs, kArgvOnStack, false);
+}
+
+void Builtins::Generate_CEntry_Return2_SaveFPRegs_ArgvOnStack_BuiltinExit(
+    MacroAssembler* masm) {
+  Generate_CEntry(masm, 2, kSaveFPRegs, kArgvOnStack, true);
+}
+
+void Builtins::Generate_CallApiGetter(MacroAssembler* masm) {
+  // CallApiGetterStub only exists as a stub to avoid duplicating code between
+  // here and code-stubs-<arch>.cc. For example, see CallApiFunctionAndReturn.
+  // Here we abuse the instantiated stub to generate code.
+  CallApiGetterStub stub(masm->isolate());
+  stub.Generate(masm);
+}
+
+void Builtins::Generate_CallApiCallback_Argc0(MacroAssembler* masm) {
+  // The common variants of CallApiCallbackStub (i.e. all that are embedded into
+  // the snapshot) are generated as builtins. The rest remain available as code
+  // stubs. Here we abuse the instantiated stub to generate code and avoid
+  // duplication.
+  const int kArgc = 0;
+  CallApiCallbackStub stub(masm->isolate(), kArgc);
+  stub.Generate(masm);
+}
+
+void Builtins::Generate_CallApiCallback_Argc1(MacroAssembler* masm) {
+  // The common variants of CallApiCallbackStub (i.e. all that are embedded into
+  // the snapshot) are generated as builtins. The rest remain available as code
+  // stubs. Here we abuse the instantiated stub to generate code and avoid
+  // duplication.
+  const int kArgc = 1;
+  CallApiCallbackStub stub(masm->isolate(), kArgc);
+  stub.Generate(masm);
+}
+
+// ES6 [[Get]] operation.
+TF_BUILTIN(GetProperty, CodeStubAssembler) {
+  Label call_runtime(this, Label::kDeferred), return_undefined(this), end(this);
+
+  Node* object = Parameter(Descriptor::kObject);
+  Node* key = Parameter(Descriptor::kKey);
+  Node* context = Parameter(Descriptor::kContext);
+  VARIABLE(var_result, MachineRepresentation::kTagged);
+
+  CodeStubAssembler::LookupInHolder lookup_property_in_holder =
+      [=, &var_result, &end](Node* receiver, Node* holder, Node* holder_map,
+                             Node* holder_instance_type, Node* unique_name,
+                             Label* next_holder, Label* if_bailout) {
+        VARIABLE(var_value, MachineRepresentation::kTagged);
+        Label if_found(this);
+        TryGetOwnProperty(context, receiver, holder, holder_map,
+                          holder_instance_type, unique_name, &if_found,
+                          &var_value, next_holder, if_bailout);
+        BIND(&if_found);
+        {
+          var_result.Bind(var_value.value());
+          Goto(&end);
+        }
+      };
+
+  CodeStubAssembler::LookupInHolder lookup_element_in_holder =
+      [=](Node* receiver, Node* holder, Node* holder_map,
+          Node* holder_instance_type, Node* index, Label* next_holder,
+          Label* if_bailout) {
+        // Not supported yet.
+        Use(next_holder);
+        Goto(if_bailout);
+      };
+
+  TryPrototypeChainLookup(object, key, lookup_property_in_holder,
+                          lookup_element_in_holder, &return_undefined,
+                          &call_runtime);
+
+  BIND(&return_undefined);
+  {
+    var_result.Bind(UndefinedConstant());
+    Goto(&end);
+  }
+
+  BIND(&call_runtime);
+  {
+    var_result.Bind(CallRuntime(Runtime::kGetProperty, context, object, key));
+    Goto(&end);
+  }
+
+  BIND(&end);
+  Return(var_result.value());
 }
 
 }  // namespace internal
diff --git a/deps/v8/src/builtins/builtins-internal.cc b/deps/v8/src/builtins/builtins-internal.cc
index 810d6e930d55f8..3a1eb078d0ac3b 100644
--- a/deps/v8/src/builtins/builtins-internal.cc
+++ b/deps/v8/src/builtins/builtins-internal.cc
@@ -15,7 +15,7 @@ BUILTIN(Illegal) {
   UNREACHABLE();
 }
 
-BUILTIN(EmptyFunction) { return isolate->heap()->undefined_value(); }
+BUILTIN(EmptyFunction) { return ReadOnlyRoots(isolate).undefined_value(); }
 
 BUILTIN(UnsupportedThrower) {
   HandleScope scope(isolate);
diff --git a/deps/v8/src/builtins/builtins-intl-gen.cc b/deps/v8/src/builtins/builtins-intl-gen.cc
index 88641b04e26c16..6d8636949e91a2 100644
--- a/deps/v8/src/builtins/builtins-intl-gen.cc
+++ b/deps/v8/src/builtins/builtins-intl-gen.cc
@@ -57,8 +57,8 @@ TF_BUILTIN(StringToLowerCaseIntl, IntlBuiltinsAssembler) {
     TNode<IntPtrT> const end_address =
         Signed(IntPtrAdd(start_address, SmiUntag(length)));
 
-    Node* const to_lower_table_addr = ExternalConstant(
-        ExternalReference::intl_to_latin1_lower_table(isolate()));
+    Node* const to_lower_table_addr =
+        ExternalConstant(ExternalReference::intl_to_latin1_lower_table());
 
     VARIABLE(var_did_change, MachineRepresentation::kWord32, Int32Constant(0));
 
@@ -93,8 +93,8 @@ TF_BUILTIN(StringToLowerCaseIntl, IntlBuiltinsAssembler) {
   {
     Node* const src = to_direct.string();
 
-    Node* const function_addr = ExternalConstant(
-        ExternalReference::intl_convert_one_byte_to_lower(isolate()));
+    Node* const function_addr =
+        ExternalConstant(ExternalReference::intl_convert_one_byte_to_lower());
     Node* const isolate_ptr =
         ExternalConstant(ExternalReference::isolate_address(isolate()));
 
diff --git a/deps/v8/src/builtins/builtins-intl.cc b/deps/v8/src/builtins/builtins-intl.cc
index 45471171c7741d..3c16f0b23e6050 100644
--- a/deps/v8/src/builtins/builtins-intl.cc
+++ b/deps/v8/src/builtins/builtins-intl.cc
@@ -9,15 +9,21 @@
 #include "src/builtins/builtins-intl.h"
 #include "src/builtins/builtins-utils.h"
 #include "src/builtins/builtins.h"
+#include "src/date.h"
 #include "src/intl.h"
 #include "src/objects-inl.h"
 #include "src/objects/intl-objects.h"
+#include "src/objects/js-locale-inl.h"
+#include "src/objects/js-relative-time-format-inl.h"
 
+#include "unicode/datefmt.h"
 #include "unicode/decimfmt.h"
 #include "unicode/fieldpos.h"
 #include "unicode/fpositer.h"
 #include "unicode/normalizer2.h"
 #include "unicode/numfmt.h"
+#include "unicode/smpdtfmt.h"
+#include "unicode/udat.h"
 #include "unicode/ufieldpositer.h"
 #include "unicode/unistr.h"
 #include "unicode/ustring.h"
@@ -28,7 +34,7 @@ namespace internal {
 BUILTIN(StringPrototypeToUpperCaseIntl) {
   HandleScope scope(isolate);
   TO_THIS_STRING(string, "String.prototype.toUpperCase");
-  string = String::Flatten(string);
+  string = String::Flatten(isolate, string);
   return ConvertCase(string, true, isolate);
 }
 
@@ -48,16 +54,19 @@ BUILTIN(StringPrototypeNormalizeIntl) {
     ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, form,
                                        Object::ToString(isolate, form_input));
 
-    if (String::Equals(form, isolate->factory()->NFC_string())) {
+    if (String::Equals(isolate, form, isolate->factory()->NFC_string())) {
       form_name = "nfc";
       form_mode = UNORM2_COMPOSE;
-    } else if (String::Equals(form, isolate->factory()->NFD_string())) {
+    } else if (String::Equals(isolate, form,
+                              isolate->factory()->NFD_string())) {
       form_name = "nfc";
       form_mode = UNORM2_DECOMPOSE;
-    } else if (String::Equals(form, isolate->factory()->NFKC_string())) {
+    } else if (String::Equals(isolate, form,
+                              isolate->factory()->NFKC_string())) {
       form_name = "nfkc";
       form_mode = UNORM2_COMPOSE;
-    } else if (String::Equals(form, isolate->factory()->NFKD_string())) {
+    } else if (String::Equals(isolate, form,
+                              isolate->factory()->NFKD_string())) {
       form_name = "nfkc";
       form_mode = UNORM2_DECOMPOSE;
     } else {
@@ -70,7 +79,7 @@ BUILTIN(StringPrototypeNormalizeIntl) {
   }
 
   int length = string->length();
-  string = String::Flatten(string);
+  string = String::Flatten(isolate, string);
   icu::UnicodeString result;
   std::unique_ptr<uc16[]> sap;
   UErrorCode status = U_ZERO_ERROR;
@@ -97,7 +106,7 @@ BUILTIN(StringPrototypeNormalizeIntl) {
   }
 
   if (U_FAILURE(status)) {
-    return isolate->heap()->undefined_value();
+    return ReadOnlyRoots(isolate).undefined_value();
   }
 
   RETURN_RESULT_OR_FAILURE(
@@ -152,6 +161,57 @@ Handle<String> IcuNumberFieldIdToNumberType(int32_t field_id, double number,
   }
 }
 
+// The list comes from third_party/icu/source/i18n/unicode/udat.h.
+// They're mapped to DateTimeFormat components listed at
+// https://tc39.github.io/ecma402/#sec-datetimeformat-abstracts .
+
+Handle<String> IcuDateFieldIdToDateType(int32_t field_id, Isolate* isolate) {
+  switch (field_id) {
+    case -1:
+      return isolate->factory()->literal_string();
+    case UDAT_YEAR_FIELD:
+    case UDAT_EXTENDED_YEAR_FIELD:
+    case UDAT_YEAR_NAME_FIELD:
+      return isolate->factory()->year_string();
+    case UDAT_MONTH_FIELD:
+    case UDAT_STANDALONE_MONTH_FIELD:
+      return isolate->factory()->month_string();
+    case UDAT_DATE_FIELD:
+      return isolate->factory()->day_string();
+    case UDAT_HOUR_OF_DAY1_FIELD:
+    case UDAT_HOUR_OF_DAY0_FIELD:
+    case UDAT_HOUR1_FIELD:
+    case UDAT_HOUR0_FIELD:
+      return isolate->factory()->hour_string();
+    case UDAT_MINUTE_FIELD:
+      return isolate->factory()->minute_string();
+    case UDAT_SECOND_FIELD:
+      return isolate->factory()->second_string();
+    case UDAT_DAY_OF_WEEK_FIELD:
+    case UDAT_DOW_LOCAL_FIELD:
+    case UDAT_STANDALONE_DAY_FIELD:
+      return isolate->factory()->weekday_string();
+    case UDAT_AM_PM_FIELD:
+      return isolate->factory()->dayperiod_string();
+    case UDAT_TIMEZONE_FIELD:
+    case UDAT_TIMEZONE_RFC_FIELD:
+    case UDAT_TIMEZONE_GENERIC_FIELD:
+    case UDAT_TIMEZONE_SPECIAL_FIELD:
+    case UDAT_TIMEZONE_LOCALIZED_GMT_OFFSET_FIELD:
+    case UDAT_TIMEZONE_ISO_FIELD:
+    case UDAT_TIMEZONE_ISO_LOCAL_FIELD:
+      return isolate->factory()->timeZoneName_string();
+    case UDAT_ERA_FIELD:
+      return isolate->factory()->era_string();
+    default:
+      // Other UDAT_*_FIELD's cannot show up because there is no way to specify
+      // them via options of Intl.DateTimeFormat.
+      UNREACHABLE();
+      // To prevent MSVC from issuing C4715 warning.
+      return Handle<String>();
+  }
+}
+
 bool AddElement(Handle<JSArray> array, int index,
                 Handle<String> field_type_string,
                 const icu::UnicodeString& formatted, int32_t begin, int32_t end,
@@ -160,8 +220,8 @@ bool AddElement(Handle<JSArray> array, int index,
   Factory* factory = isolate->factory();
   Handle<JSObject> element = factory->NewJSObject(isolate->object_function());
   Handle<String> value;
-  JSObject::AddProperty(element, factory->type_string(), field_type_string,
-                        NONE);
+  JSObject::AddProperty(isolate, element, factory->type_string(),
+                        field_type_string, NONE);
 
   icu::UnicodeString field(formatted.tempSubStringBetween(begin, end));
   ASSIGN_RETURN_ON_EXCEPTION_VALUE(
@@ -171,9 +231,8 @@ bool AddElement(Handle<JSArray> array, int index,
           field.length())),
       false);
 
-  JSObject::AddProperty(element, factory->value_string(), value, NONE);
-  RETURN_ON_EXCEPTION_VALUE(
-      isolate, JSObject::AddDataElement(array, index, element, NONE), false);
+  JSObject::AddProperty(isolate, element, factory->value_string(), value, NONE);
+  JSObject::AddDataElement(array, index, element, NONE);
   return true;
 }
 
@@ -200,7 +259,7 @@ Object* FormatNumberToParts(Isolate* isolate, icu::NumberFormat* fmt,
   icu::FieldPositionIterator fp_iter;
   UErrorCode status = U_ZERO_ERROR;
   fmt->format(number, formatted, &fp_iter, status);
-  if (U_FAILURE(status)) return isolate->heap()->undefined_value();
+  if (U_FAILURE(status)) return ReadOnlyRoots(isolate).undefined_value();
 
   Handle<JSArray> result = factory->NewJSArray(0);
   int32_t length = formatted.length();
@@ -232,7 +291,7 @@ Object* FormatNumberToParts(Isolate* isolate, icu::NumberFormat* fmt,
             : IcuNumberFieldIdToNumberType(part.field_id, number, isolate);
     if (!AddElement(result, index, field_type_string, formatted, part.begin_pos,
                     part.end_pos, isolate)) {
-      return isolate->heap()->undefined_value();
+      return ReadOnlyRoots(isolate).undefined_value();
     }
     ++index;
   }
@@ -240,6 +299,53 @@ Object* FormatNumberToParts(Isolate* isolate, icu::NumberFormat* fmt,
 
   return *result;
 }
+
+Object* FormatDateToParts(Isolate* isolate, icu::DateFormat* format,
+                          double date_value) {
+  Factory* factory = isolate->factory();
+
+  icu::UnicodeString formatted;
+  icu::FieldPositionIterator fp_iter;
+  icu::FieldPosition fp;
+  UErrorCode status = U_ZERO_ERROR;
+  format->format(date_value, formatted, &fp_iter, status);
+  if (U_FAILURE(status)) return ReadOnlyRoots(isolate).undefined_value();
+
+  Handle<JSArray> result = factory->NewJSArray(0);
+  int32_t length = formatted.length();
+  if (length == 0) return *result;
+
+  int index = 0;
+  int32_t previous_end_pos = 0;
+  while (fp_iter.next(fp)) {
+    int32_t begin_pos = fp.getBeginIndex();
+    int32_t end_pos = fp.getEndIndex();
+
+    if (previous_end_pos < begin_pos) {
+      if (!AddElement(result, index, IcuDateFieldIdToDateType(-1, isolate),
+                      formatted, previous_end_pos, begin_pos, isolate)) {
+        return ReadOnlyRoots(isolate).undefined_value();
+      }
+      ++index;
+    }
+    if (!AddElement(result, index,
+                    IcuDateFieldIdToDateType(fp.getField(), isolate), formatted,
+                    begin_pos, end_pos, isolate)) {
+      return ReadOnlyRoots(isolate).undefined_value();
+    }
+    previous_end_pos = end_pos;
+    ++index;
+  }
+  if (previous_end_pos < length) {
+    if (!AddElement(result, index, IcuDateFieldIdToDateType(-1, isolate),
+                    formatted, previous_end_pos, length, isolate)) {
+      return ReadOnlyRoots(isolate).undefined_value();
+    }
+  }
+  JSObject::ValidateElements(*result);
+  return *result;
+}
+
 }  // namespace
 
 // Flattens a list of possibly-overlapping "regions" to a list of
@@ -337,12 +443,8 @@ BUILTIN(NumberFormatPrototypeFormatToParts) {
   HandleScope handle_scope(isolate);
   CHECK_RECEIVER(JSObject, number_format_holder, method);
 
-  Handle<Symbol> marker = isolate->factory()->intl_initialized_marker_symbol();
-  Handle<Object> tag =
-      JSReceiver::GetDataProperty(number_format_holder, marker);
-  Handle<String> expected_tag =
-      isolate->factory()->NewStringFromStaticChars("numberformat");
-  if (!(tag->IsString() && String::cast(*tag)->Equals(*expected_tag))) {
+  if (!Intl::IsObjectOfType(isolate, number_format_holder,
+                            Intl::Type::kNumberFormat)) {
     THROW_NEW_ERROR_RETURN_FAILURE(
         isolate,
         NewTypeError(MessageTemplate::kIncompatibleMethodReceiver,
@@ -366,5 +468,299 @@ BUILTIN(NumberFormatPrototypeFormatToParts) {
   return result;
 }
 
+BUILTIN(DateTimeFormatPrototypeFormatToParts) {
+  const char* const method = "Intl.DateTimeFormat.prototype.formatToParts";
+  HandleScope handle_scope(isolate);
+  CHECK_RECEIVER(JSObject, date_format_holder, method);
+  Factory* factory = isolate->factory();
+
+  if (!Intl::IsObjectOfType(isolate, date_format_holder,
+                            Intl::Type::kDateTimeFormat)) {
+    THROW_NEW_ERROR_RETURN_FAILURE(
+        isolate, NewTypeError(MessageTemplate::kIncompatibleMethodReceiver,
+                              factory->NewStringFromAsciiChecked(method),
+                              date_format_holder));
+  }
+
+  Handle<Object> x = args.atOrUndefined(isolate, 1);
+  if (x->IsUndefined(isolate)) {
+    x = factory->NewNumber(JSDate::CurrentTimeValue(isolate));
+  } else {
+    ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, x,
+                                       Object::ToNumber(args.at(1)));
+  }
+
+  double date_value = DateCache::TimeClip(x->Number());
+  if (std::isnan(date_value)) {
+    THROW_NEW_ERROR_RETURN_FAILURE(
+        isolate, NewRangeError(MessageTemplate::kInvalidTimeValue));
+  }
+
+  icu::SimpleDateFormat* date_format =
+      DateFormat::UnpackDateFormat(isolate, date_format_holder);
+  CHECK_NOT_NULL(date_format);
+
+  return FormatDateToParts(isolate, date_format, date_value);
+}
+
+BUILTIN(NumberFormatPrototypeFormatNumber) {
+  const char* const method = "get Intl.NumberFormat.prototype.format";
+  HandleScope scope(isolate);
+
+  // 1. Let nf be the this value.
+  // 2. If Type(nf) is not Object, throw a TypeError exception.
+  CHECK_RECEIVER(JSReceiver, receiver, method);
+
+  // 3. Let nf be ? UnwrapNumberFormat(nf).
+  Handle<JSObject> number_format_holder;
+  ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
+      isolate, number_format_holder,
+      NumberFormat::Unwrap(isolate, receiver, method));
+
+  DCHECK(Intl::IsObjectOfType(isolate, number_format_holder,
+                              Intl::Type::kNumberFormat));
+
+  Handle<Object> bound_format = Handle<Object>(
+      number_format_holder->GetEmbedderField(NumberFormat::kBoundFormatIndex),
+      isolate);
+
+  // 4. If nf.[[BoundFormat]] is undefined, then
+  if (!bound_format->IsUndefined(isolate)) {
+    DCHECK(bound_format->IsJSFunction());
+    // 5. Return nf.[[BoundFormat]].
+    return *bound_format;
+  }
+
+  Handle<Context> native_context =
+      Handle<Context>(isolate->context()->native_context(), isolate);
+
+  Handle<Context> context = isolate->factory()->NewBuiltinContext(
+      native_context, NumberFormat::ContextSlot::kLength);
+
+  // 4. b. Set F.[[NumberFormat]] to nf.
+  context->set(NumberFormat::ContextSlot::kNumberFormat, *number_format_holder);
+
+  Handle<SharedFunctionInfo> info = Handle<SharedFunctionInfo>(
+      native_context->number_format_internal_format_number_shared_fun(),
+      isolate);
+
+  Handle<Map> map = isolate->strict_function_without_prototype_map();
+
+  // 4. a. Let F be a new built-in function object as defined in
+  // Number Format Functions (11.1.4).
+  Handle<JSFunction> new_bound_format_function =
+      isolate->factory()->NewFunctionFromSharedFunctionInfo(map, info, context);
+
+  // 4. c. Set nf.[[BoundFormat]] to F.
+  number_format_holder->SetEmbedderField(NumberFormat::kBoundFormatIndex,
+                                         *new_bound_format_function);
+
+  // 5. Return nf.[[BoundFormat]].
+  return *new_bound_format_function;
+}
+
+BUILTIN(NumberFormatInternalFormatNumber) {
+  HandleScope scope(isolate);
+
+  Handle<Context> context = Handle<Context>(isolate->context(), isolate);
+
+  // 1. Let nf be F.[[NumberFormat]].
+  Handle<JSObject> number_format_holder = Handle<JSObject>(
+      JSObject::cast(context->get(NumberFormat::ContextSlot::kNumberFormat)),
+      isolate);
+
+  // 2. Assert: Type(nf) is Object and nf has an
+  //    [[InitializedNumberFormat]] internal slot.
+  DCHECK(Intl::IsObjectOfType(isolate, number_format_holder,
+                              Intl::Type::kNumberFormat));
+
+  // 3. If value is not provided, let value be undefined.
+  Handle<Object> value = args.atOrUndefined(isolate, 1);
+
+  // 4. Let x be ? ToNumber(value).
+  Handle<Object> number_obj;
+  ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, number_obj,
+                                     Object::ToNumber(value));
+
+  // Spec treats -0 as 0.
+  if (number_obj->IsMinusZero()) {
+    number_obj = Handle<Smi>(Smi::kZero, isolate);
+  }
+
+  double number = number_obj->Number();
+  // Return FormatNumber(nf, x).
+  RETURN_RESULT_OR_FAILURE(isolate, NumberFormat::FormatNumber(
+                                        isolate, number_format_holder, number));
+}
+
+// Intl.Locale implementation
+BUILTIN(LocaleConstructor) {
+  HandleScope scope(isolate);
+  if (args.new_target()->IsUndefined(isolate)) {  // [[Call]]
+    THROW_NEW_ERROR_RETURN_FAILURE(
+        isolate, NewTypeError(MessageTemplate::kConstructorNotFunction,
+                              isolate->factory()->NewStringFromAsciiChecked(
+                                  "Intl.Locale")));
+  } else {  // [[Construct]]
+    Handle<JSFunction> target = args.target();
+    Handle<JSReceiver> new_target = Handle<JSReceiver>::cast(args.new_target());
+
+    Handle<JSObject> result;
+    ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, result,
+                                       JSObject::New(target, new_target));
+
+    Handle<Object> tag = args.atOrUndefined(isolate, 1);
+    Handle<Object> options = args.atOrUndefined(isolate, 2);
+
+    // First parameter is a locale, as a string/object. Can't be empty.
+    if (!tag->IsName() && !tag->IsJSReceiver()) {
+      THROW_NEW_ERROR_RETURN_FAILURE(
+          isolate, NewTypeError(MessageTemplate::kLocaleNotEmpty));
+    }
+
+    Handle<String> locale_string;
+    if (tag->IsJSLocale() &&
+        Handle<JSLocale>::cast(tag)->locale()->IsString()) {
+      locale_string =
+          Handle<String>(Handle<JSLocale>::cast(tag)->locale(), isolate);
+    } else {
+      ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, locale_string,
+                                         Object::ToString(isolate, tag));
+    }
+
+    Handle<JSReceiver> options_object;
+    if (options->IsNullOrUndefined(isolate)) {
+      // Make empty options bag.
+      options_object = isolate->factory()->NewJSObjectWithNullProto();
+    } else {
+      ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, options_object,
+                                         Object::ToObject(isolate, options));
+    }
+
+    RETURN_RESULT_OR_FAILURE(
+        isolate,
+        JSLocale::InitializeLocale(isolate, Handle<JSLocale>::cast(result),
+                                   locale_string, options_object));
+  }
+}
+
+BUILTIN(RelativeTimeFormatConstructor) {
+  HandleScope scope(isolate);
+  // 1. If NewTarget is undefined, throw a TypeError exception.
+  if (args.new_target()->IsUndefined(isolate)) {  // [[Call]]
+    THROW_NEW_ERROR_RETURN_FAILURE(
+        isolate, NewTypeError(MessageTemplate::kConstructorNotFunction,
+                              isolate->factory()->NewStringFromStaticChars(
+                                  "Intl.RelativeTimeFormat")));
+  }
+  // [[Construct]]
+  Handle<JSFunction> target = args.target();
+  Handle<JSReceiver> new_target = Handle<JSReceiver>::cast(args.new_target());
+
+  Handle<JSObject> result;
+  // 2. Let relativeTimeFormat be
+  //    ! OrdinaryCreateFromConstructor(NewTarget,
+  //                                    "%RelativeTimeFormatPrototype%").
+  ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, result,
+                                     JSObject::New(target, new_target));
+
+  Handle<Object> locales = args.atOrUndefined(isolate, 1);
+  Handle<Object> options = args.atOrUndefined(isolate, 2);
+
+  // 3. Return ? InitializeRelativeTimeFormat(relativeTimeFormat, locales,
+  //                                          options).
+  RETURN_RESULT_OR_FAILURE(
+      isolate, JSRelativeTimeFormat::InitializeRelativeTimeFormat(
+                   isolate, Handle<JSRelativeTimeFormat>::cast(result), locales,
+                   options));
+}
+
+BUILTIN(RelativeTimeFormatPrototypeResolvedOptions) {
+  HandleScope scope(isolate);
+  CHECK_RECEIVER(JSRelativeTimeFormat, format_holder,
+                 "Intl.RelativeTimeFormat.prototype.resolvedOptions");
+  return *JSRelativeTimeFormat::ResolvedOptions(isolate, format_holder);
+}
+
+// Locale getters.
+BUILTIN(LocalePrototypeLanguage) {
+  HandleScope scope(isolate);
+  // CHECK_RECEIVER will case locale_holder to JSLocale.
+  CHECK_RECEIVER(JSLocale, locale_holder, "Intl.Locale.prototype.language");
+
+  return locale_holder->language();
+}
+
+BUILTIN(LocalePrototypeScript) {
+  HandleScope scope(isolate);
+  CHECK_RECEIVER(JSLocale, locale_holder, "Intl.Locale.prototype.script");
+
+  return locale_holder->script();
+}
+
+BUILTIN(LocalePrototypeRegion) {
+  HandleScope scope(isolate);
+  CHECK_RECEIVER(JSLocale, locale_holder, "Intl.Locale.prototype.region");
+
+  return locale_holder->region();
+}
+
+BUILTIN(LocalePrototypeBaseName) {
+  HandleScope scope(isolate);
+  CHECK_RECEIVER(JSLocale, locale_holder, "Intl.Locale.prototype.baseName");
+
+  return locale_holder->base_name();
+}
+
+BUILTIN(LocalePrototypeCalendar) {
+  HandleScope scope(isolate);
+  CHECK_RECEIVER(JSLocale, locale_holder, "Intl.Locale.prototype.calendar");
+
+  return locale_holder->calendar();
+}
+
+BUILTIN(LocalePrototypeCaseFirst) {
+  HandleScope scope(isolate);
+  CHECK_RECEIVER(JSLocale, locale_holder, "Intl.Locale.prototype.caseFirst");
+
+  return locale_holder->case_first();
+}
+
+BUILTIN(LocalePrototypeCollation) {
+  HandleScope scope(isolate);
+  CHECK_RECEIVER(JSLocale, locale_holder, "Intl.Locale.prototype.collation");
+
+  return locale_holder->collation();
+}
+
+BUILTIN(LocalePrototypeHourCycle) {
+  HandleScope scope(isolate);
+  CHECK_RECEIVER(JSLocale, locale_holder, "Intl.Locale.prototype.hourCycle");
+
+  return locale_holder->hour_cycle();
+}
+
+BUILTIN(LocalePrototypeNumeric) {
+  HandleScope scope(isolate);
+  CHECK_RECEIVER(JSLocale, locale_holder, "Intl.Locale.prototype.numeric");
+
+  return locale_holder->numeric();
+}
+
+BUILTIN(LocalePrototypeNumberingSystem) {
+  HandleScope scope(isolate);
+  CHECK_RECEIVER(JSLocale, locale_holder,
+                 "Intl.Locale.prototype.numberingSystem");
+
+  return locale_holder->numbering_system();
+}
+
+BUILTIN(LocalePrototypeToString) {
+  HandleScope scope(isolate);
+  CHECK_RECEIVER(JSLocale, locale_holder, "Intl.Locale.prototype.toString");
+
+  return locale_holder->locale();
+}
+
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/src/builtins/builtins-json.cc b/deps/v8/src/builtins/builtins-json.cc
index 7bc6ab0b066c8a..3c317d5b88f7b5 100644
--- a/deps/v8/src/builtins/builtins-json.cc
+++ b/deps/v8/src/builtins/builtins-json.cc
@@ -21,7 +21,7 @@ BUILTIN(JsonParse) {
   Handle<String> string;
   ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, string,
                                      Object::ToString(isolate, source));
-  string = String::Flatten(string);
+  string = String::Flatten(isolate, string);
   RETURN_RESULT_OR_FAILURE(
       isolate, string->IsSeqOneByteString()
                    ? JsonParser<true>::Parse(isolate, string, reviver)
diff --git a/deps/v8/src/builtins/builtins-lazy-gen.cc b/deps/v8/src/builtins/builtins-lazy-gen.cc
new file mode 100644
index 00000000000000..d1314733c7cbda
--- /dev/null
+++ b/deps/v8/src/builtins/builtins-lazy-gen.cc
@@ -0,0 +1,203 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "src/builtins/builtins-lazy-gen.h"
+
+#include "src/builtins/builtins-utils-gen.h"
+#include "src/builtins/builtins.h"
+#include "src/feedback-vector.h"
+#include "src/globals.h"
+#include "src/objects/shared-function-info.h"
+
+namespace v8 {
+namespace internal {
+
+void LazyBuiltinsAssembler::GenerateTailCallToJSCode(
+    TNode<Code> code, TNode<JSFunction> function) {
+  TNode<Int32T> argc =
+      UncheckedCast<Int32T>(Parameter(Descriptor::kActualArgumentsCount));
+  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
+  TNode<Object> new_target = CAST(Parameter(Descriptor::kNewTarget));
+
+  TailCallJSCode(code, context, function, new_target, argc);
+}
+
+void LazyBuiltinsAssembler::GenerateTailCallToReturnedCode(
+    Runtime::FunctionId function_id, TNode<JSFunction> function) {
+  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
+  TNode<Code> code = CAST(CallRuntime(function_id, context, function));
+  GenerateTailCallToJSCode(code, function);
+}
+
+void LazyBuiltinsAssembler::TailCallRuntimeIfMarkerEquals(
+    TNode<Smi> marker, OptimizationMarker expected_marker,
+    Runtime::FunctionId function_id, TNode<JSFunction> function) {
+  Label no_match(this);
+  GotoIfNot(SmiEqual(marker, SmiConstant(expected_marker)), &no_match);
+  GenerateTailCallToReturnedCode(function_id, function);
+  BIND(&no_match);
+}
+
+void LazyBuiltinsAssembler::MaybeTailCallOptimizedCodeSlot(
+    TNode<JSFunction> function, TNode<FeedbackVector> feedback_vector) {
+  Label fallthrough(this);
+
+  TNode<MaybeObject> maybe_optimized_code_entry = LoadMaybeWeakObjectField(
+      feedback_vector, FeedbackVector::kOptimizedCodeOffset);
+
+  // Check if the code entry is a Smi. If yes, we interpret it as an
+  // optimisation marker. Otherwise, interpret it as a weak reference to a code
+  // object.
+  Label optimized_code_slot_is_smi(this), optimized_code_slot_is_weak_ref(this);
+  Branch(TaggedIsSmi(maybe_optimized_code_entry), &optimized_code_slot_is_smi,
+         &optimized_code_slot_is_weak_ref);
+
+  BIND(&optimized_code_slot_is_smi);
+  {
+    // Optimized code slot is a Smi optimization marker.
+    TNode<Smi> marker = CAST(maybe_optimized_code_entry);
+
+    // Fall through if no optimization trigger.
+    GotoIf(SmiEqual(marker, SmiConstant(OptimizationMarker::kNone)),
+           &fallthrough);
+
+    // TODO(ishell): introduce Runtime::kHandleOptimizationMarker and check
+    // all these marker values there.
+    TailCallRuntimeIfMarkerEquals(marker,
+                                  OptimizationMarker::kLogFirstExecution,
+                                  Runtime::kFunctionFirstExecution, function);
+    TailCallRuntimeIfMarkerEquals(marker, OptimizationMarker::kCompileOptimized,
+                                  Runtime::kCompileOptimized_NotConcurrent,
+                                  function);
+    TailCallRuntimeIfMarkerEquals(
+        marker, OptimizationMarker::kCompileOptimizedConcurrent,
+        Runtime::kCompileOptimized_Concurrent, function);
+
+    // Otherwise, the marker is InOptimizationQueue, so fall through hoping
+    // that an interrupt will eventually update the slot with optimized code.
+    CSA_ASSERT(this,
+               SmiEqual(marker,
+                        SmiConstant(OptimizationMarker::kInOptimizationQueue)));
+    Goto(&fallthrough);
+  }
+
+  BIND(&optimized_code_slot_is_weak_ref);
+  {
+    // Optimized code slot is a weak reference.
+    TNode<Code> optimized_code =
+        CAST(ToWeakHeapObject(maybe_optimized_code_entry, &fallthrough));
+
+    // Check if the optimized code is marked for deopt. If it is, call the
+    // runtime to clear it.
+    Label found_deoptimized_code(this);
+    TNode<CodeDataContainer> code_data_container =
+        CAST(LoadObjectField(optimized_code, Code::kCodeDataContainerOffset));
+
+    TNode<Int32T> code_kind_specific_flags = LoadObjectField<Int32T>(
+        code_data_container, CodeDataContainer::kKindSpecificFlagsOffset);
+    GotoIf(IsSetWord32<Code::MarkedForDeoptimizationField>(
+               code_kind_specific_flags),
+           &found_deoptimized_code);
+
+    // Optimized code is good, get it into the closure and link the closure into
+    // the optimized functions list, then tail call the optimized code.
+    StoreObjectField(function, JSFunction::kCodeOffset, optimized_code);
+    GenerateTailCallToJSCode(optimized_code, function);
+
+    // Optimized code slot contains deoptimized code, evict it and re-enter the
+    // closure's code.
+    BIND(&found_deoptimized_code);
+    GenerateTailCallToReturnedCode(Runtime::kEvictOptimizedCodeSlot, function);
+  }
+
+  // Fall-through if the optimized code cell is clear and there is no
+  // optimization marker.
+  BIND(&fallthrough);
+}
+
+void LazyBuiltinsAssembler::CompileLazy(TNode<JSFunction> function) {
+  // First lookup code, maybe we don't need to compile!
+  Label compile_function(this, Label::kDeferred);
+
+  // Compile function if we don't have a valid feedback vector.
+  TNode<FeedbackVector> feedback_vector =
+      LoadFeedbackVector(function, &compile_function);
+
+  // Is there an optimization marker or optimized code in the feedback vector?
+  MaybeTailCallOptimizedCodeSlot(function, feedback_vector);
+
+  // We found no optimized code. Infer the code object needed for the SFI.
+  TNode<SharedFunctionInfo> shared =
+      CAST(LoadObjectField(function, JSFunction::kSharedFunctionInfoOffset));
+  // If code entry points to anything other than CompileLazy, install that,
+  // otherwise call runtime to compile the function.
+  TNode<Code> code = GetSharedFunctionInfoCode(shared, &compile_function);
+
+  CSA_ASSERT(
+      this,
+      WordNotEqual(code, HeapConstant(BUILTIN_CODE(isolate(), CompileLazy))));
+
+  // Install the SFI's code entry.
+  StoreObjectField(function, JSFunction::kCodeOffset, code);
+  GenerateTailCallToJSCode(code, function);
+
+  BIND(&compile_function);
+  { GenerateTailCallToReturnedCode(Runtime::kCompileLazy, function); }
+}
+
+TF_BUILTIN(CompileLazy, LazyBuiltinsAssembler) {
+  TNode<JSFunction> function = CAST(Parameter(Descriptor::kTarget));
+
+  CompileLazy(function);
+}
+
+TF_BUILTIN(CompileLazyDeoptimizedCode, LazyBuiltinsAssembler) {
+  TNode<JSFunction> function = CAST(Parameter(Descriptor::kTarget));
+
+  // Set the code slot inside the JSFunction to CompileLazy.
+  TNode<Code> code = HeapConstant(BUILTIN_CODE(isolate(), CompileLazy));
+  StoreObjectField(function, JSFunction::kCodeOffset, code);
+  GenerateTailCallToJSCode(code, function);
+}
+
+// Lazy deserialization design doc: http://goo.gl/dxkYDZ.
+TF_BUILTIN(DeserializeLazy, LazyBuiltinsAssembler) {
+  Label deserialize_in_runtime(this, Label::kDeferred);
+
+  TNode<JSFunction> function = CAST(Parameter(Descriptor::kTarget));
+
+  // Load the builtin id for lazy deserialization from SharedFunctionInfo.
+  TNode<SharedFunctionInfo> shared =
+      CAST(LoadObjectField(function, JSFunction::kSharedFunctionInfoOffset));
+
+  TNode<Smi> sfi_data =
+      CAST(LoadObjectField(shared, SharedFunctionInfo::kFunctionDataOffset));
+
+  // The builtin may already have been deserialized. If that is the case, it is
+  // stored in the builtins table, and we can copy to correct code object to
+  // both the shared function info and function without calling into runtime.
+  //
+  // Otherwise, we need to call into runtime to deserialize.
+
+  TNode<Code> code = LoadBuiltin(sfi_data);
+
+  // Check if the loaded code object has already been deserialized. This is
+  // the case iff it does not equal DeserializeLazy.
+  GotoIf(
+      WordEqual(code, HeapConstant(BUILTIN_CODE(isolate(), DeserializeLazy))),
+      &deserialize_in_runtime);
+
+  // If we've reached this spot, the target builtin has been deserialized and
+  // we simply need to copy it over to the target function.
+  StoreObjectField(function, JSFunction::kCodeOffset, code);
+
+  // All copying is done. Jump to the deserialized code object.
+  GenerateTailCallToJSCode(code, function);
+
+  BIND(&deserialize_in_runtime);
+  { GenerateTailCallToReturnedCode(Runtime::kDeserializeLazy, function); }
+}
+
+}  // namespace internal
+}  // namespace v8
diff --git a/deps/v8/src/builtins/builtins-lazy-gen.h b/deps/v8/src/builtins/builtins-lazy-gen.h
new file mode 100644
index 00000000000000..7f64aa096b0c91
--- /dev/null
+++ b/deps/v8/src/builtins/builtins-lazy-gen.h
@@ -0,0 +1,37 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef V8_BUILTINS_BUILTINS_LAZY_GEN_H_
+#define V8_BUILTINS_BUILTINS_LAZY_GEN_H_
+
+#include "src/code-stub-assembler.h"
+
+namespace v8 {
+namespace internal {
+
+class LazyBuiltinsAssembler : public CodeStubAssembler {
+ public:
+  typedef JSTrampolineDescriptor Descriptor;
+
+  explicit LazyBuiltinsAssembler(compiler::CodeAssemblerState* state)
+      : CodeStubAssembler(state) {}
+
+  void GenerateTailCallToJSCode(TNode<Code> code, TNode<JSFunction> function);
+
+  void GenerateTailCallToReturnedCode(Runtime::FunctionId function_id,
+                                      TNode<JSFunction> function);
+  void TailCallRuntimeIfMarkerEquals(TNode<Smi> marker,
+                                     OptimizationMarker expected_marker,
+                                     Runtime::FunctionId function_id,
+                                     TNode<JSFunction> function);
+
+  void MaybeTailCallOptimizedCodeSlot(TNode<JSFunction> function,
+                                      TNode<FeedbackVector> feedback_vector);
+  void CompileLazy(TNode<JSFunction> function);
+};
+
+}  // namespace internal
+}  // namespace v8
+
+#endif  // V8_BUILTINS_BUILTINS_LAZY_GEN_H_
diff --git a/deps/v8/src/builtins/builtins-math-gen.cc b/deps/v8/src/builtins/builtins-math-gen.cc
index be58e8210ea6b4..952bdda5de3264 100644
--- a/deps/v8/src/builtins/builtins-math-gen.cc
+++ b/deps/v8/src/builtins/builtins-math-gen.cc
@@ -35,18 +35,22 @@ TF_BUILTIN(MathAbs, CodeStubAssembler) {
 
     BIND(&if_xissmi);
     {
-      Label if_overflow(this, Label::kDeferred), if_notoverflow(this);
-      Node* pair = nullptr;
+      Label if_overflow(this, Label::kDeferred);
 
       // check if support abs function
       if (IsIntPtrAbsWithOverflowSupported()) {
-        pair = IntPtrAbsWithOverflow(x);
+        Node* pair = IntPtrAbsWithOverflow(x);
         Node* overflow = Projection(1, pair);
-        Branch(overflow, &if_overflow, &if_notoverflow);
+        GotoIf(overflow, &if_overflow);
+
+        // There is a Smi representation for negated {x}.
+        Node* result = Projection(0, pair);
+        Return(BitcastWordToTagged(result));
+
       } else {
         // Check if {x} is already positive.
         Label if_xispositive(this), if_xisnotpositive(this);
-        BranchIfSmiLessThanOrEqual(SmiConstant(0), x, &if_xispositive,
+        BranchIfSmiLessThanOrEqual(SmiConstant(0), CAST(x), &if_xispositive,
                                    &if_xisnotpositive);
 
         BIND(&if_xispositive);
@@ -58,20 +62,11 @@ TF_BUILTIN(MathAbs, CodeStubAssembler) {
         BIND(&if_xisnotpositive);
         {
           // Try to negate the {x} value.
-          pair =
-              IntPtrSubWithOverflow(IntPtrConstant(0), BitcastTaggedToWord(x));
-          Node* overflow = Projection(1, pair);
-          Branch(overflow, &if_overflow, &if_notoverflow);
+          TNode<Smi> result = TrySmiSub(SmiConstant(0), CAST(x), &if_overflow);
+          Return(result);
         }
       }
 
-      BIND(&if_notoverflow);
-      {
-        // There is a Smi representation for negated {x}.
-        Node* result = Projection(0, pair);
-        Return(BitcastWordToTagged(result));
-      }
-
       BIND(&if_overflow);
       { Return(NumberConstant(0.0 - Smi::kMinValue)); }
     }
@@ -409,8 +404,8 @@ TF_BUILTIN(MathRandom, CodeStubAssembler) {
   Node* native_context = LoadNativeContext(context);
 
   // Load cache index.
-  VARIABLE(smi_index, MachineRepresentation::kTagged);
-  smi_index.Bind(
+  TVARIABLE(Smi, smi_index);
+  smi_index = CAST(
       LoadContextElement(native_context, Context::MATH_RANDOM_INDEX_INDEX));
 
   // Cached random numbers are exhausted if index is 0. Go to slow path.
@@ -418,12 +413,12 @@ TF_BUILTIN(MathRandom, CodeStubAssembler) {
   GotoIf(SmiAbove(smi_index.value(), SmiConstant(0)), &if_cached);
 
   // Cache exhausted, populate the cache. Return value is the new index.
-  smi_index.Bind(CallRuntime(Runtime::kGenerateRandomNumbers, context));
+  smi_index = CAST(CallRuntime(Runtime::kGenerateRandomNumbers, context));
   Goto(&if_cached);
 
   // Compute next index by decrement.
   BIND(&if_cached);
-  Node* new_smi_index = SmiSub(smi_index.value(), SmiConstant(1));
+  TNode<Smi> new_smi_index = SmiSub(smi_index.value(), SmiConstant(1));
   StoreContextElement(native_context, Context::MATH_RANDOM_INDEX_INDEX,
                       new_smi_index);
 
@@ -508,8 +503,8 @@ TF_BUILTIN(MathTrunc, MathBuiltinsAssembler) {
 TF_BUILTIN(MathMax, MathBuiltinsAssembler) {
   // TODO(ishell): use constants from Descriptor once the JSFunction linkage
   // arguments are reordered.
-  Node* context = Parameter(BuiltinDescriptor::kContext);
-  Node* argc = Parameter(BuiltinDescriptor::kArgumentsCount);
+  Node* context = Parameter(Descriptor::kContext);
+  Node* argc = Parameter(Descriptor::kJSActualArgumentsCount);
   MathMaxMin(context, argc, &CodeStubAssembler::Float64Max, -1.0 * V8_INFINITY);
 }
 
@@ -517,8 +512,8 @@ TF_BUILTIN(MathMax, MathBuiltinsAssembler) {
 TF_BUILTIN(MathMin, MathBuiltinsAssembler) {
   // TODO(ishell): use constants from Descriptor once the JSFunction linkage
   // arguments are reordered.
-  Node* context = Parameter(BuiltinDescriptor::kContext);
-  Node* argc = Parameter(BuiltinDescriptor::kArgumentsCount);
+  Node* context = Parameter(Descriptor::kContext);
+  Node* argc = Parameter(Descriptor::kJSActualArgumentsCount);
   MathMaxMin(context, argc, &CodeStubAssembler::Float64Min, V8_INFINITY);
 }
 
diff --git a/deps/v8/src/builtins/builtins-math.cc b/deps/v8/src/builtins/builtins-math.cc
index d390b5db319e93..df310bdfa10c4c 100644
--- a/deps/v8/src/builtins/builtins-math.cc
+++ b/deps/v8/src/builtins/builtins-math.cc
@@ -43,7 +43,7 @@ BUILTIN(MathHypot) {
   }
 
   if (one_arg_is_nan) {
-    return isolate->heap()->nan_value();
+    return ReadOnlyRoots(isolate).nan_value();
   }
 
   if (max == 0) {
diff --git a/deps/v8/src/builtins/builtins-number-gen.cc b/deps/v8/src/builtins/builtins-number-gen.cc
index 1340c33eb1dce9..cfc81612f2d4c2 100644
--- a/deps/v8/src/builtins/builtins-number-gen.cc
+++ b/deps/v8/src/builtins/builtins-number-gen.cc
@@ -101,31 +101,8 @@ TF_BUILTIN(AllocateHeapNumber, CodeStubAssembler) {
 
 // ES6 #sec-number.isinteger
 TF_BUILTIN(NumberIsInteger, CodeStubAssembler) {
-  Node* number = Parameter(Descriptor::kNumber);
-
-  Label return_true(this), return_false(this);
-
-  // Check if {number} is a Smi.
-  GotoIf(TaggedIsSmi(number), &return_true);
-
-  // Check if {number} is a HeapNumber.
-  GotoIfNot(IsHeapNumber(number), &return_false);
-
-  // Load the actual value of {number}.
-  Node* number_value = LoadHeapNumberValue(number);
-
-  // Truncate the value of {number} to an integer (or an infinity).
-  Node* integer = Float64Trunc(number_value);
-
-  // Check if {number}s value matches the integer (ruling out the infinities).
-  Branch(Float64Equal(Float64Sub(number_value, integer), Float64Constant(0.0)),
-         &return_true, &return_false);
-
-  BIND(&return_true);
-  Return(TrueConstant());
-
-  BIND(&return_false);
-  Return(FalseConstant());
+  TNode<Object> number = CAST(Parameter(Descriptor::kNumber));
+  Return(SelectBooleanConstant(IsInteger(number)));
 }
 
 // ES6 #sec-number.isnan
@@ -153,37 +130,8 @@ TF_BUILTIN(NumberIsNaN, CodeStubAssembler) {
 
 // ES6 #sec-number.issafeinteger
 TF_BUILTIN(NumberIsSafeInteger, CodeStubAssembler) {
-  Node* number = Parameter(Descriptor::kNumber);
-
-  Label return_true(this), return_false(this);
-
-  // Check if {number} is a Smi.
-  GotoIf(TaggedIsSmi(number), &return_true);
-
-  // Check if {number} is a HeapNumber.
-  GotoIfNot(IsHeapNumber(number), &return_false);
-
-  // Load the actual value of {number}.
-  Node* number_value = LoadHeapNumberValue(number);
-
-  // Truncate the value of {number} to an integer (or an infinity).
-  Node* integer = Float64Trunc(number_value);
-
-  // Check if {number}s value matches the integer (ruling out the infinities).
-  GotoIfNot(
-      Float64Equal(Float64Sub(number_value, integer), Float64Constant(0.0)),
-      &return_false);
-
-  // Check if the {integer} value is in safe integer range.
-  Branch(Float64LessThanOrEqual(Float64Abs(integer),
-                                Float64Constant(kMaxSafeInteger)),
-         &return_true, &return_false);
-
-  BIND(&return_true);
-  Return(TrueConstant());
-
-  BIND(&return_false);
-  Return(FalseConstant());
+  TNode<Object> number = CAST(Parameter(Descriptor::kNumber));
+  Return(SelectBooleanConstant(IsSafeInteger(number)));
 }
 
 // ES6 #sec-number.parsefloat
@@ -280,7 +228,7 @@ TF_BUILTIN(NumberParseFloat, CodeStubAssembler) {
 }
 
 // ES6 #sec-number.parseint
-TF_BUILTIN(NumberParseInt, CodeStubAssembler) {
+TF_BUILTIN(ParseInt, CodeStubAssembler) {
   Node* context = Parameter(Descriptor::kContext);
   Node* input = Parameter(Descriptor::kString);
   Node* radix = Parameter(Descriptor::kRadix);
@@ -357,6 +305,14 @@ TF_BUILTIN(NumberParseInt, CodeStubAssembler) {
   }
 }
 
+// ES6 #sec-number.parseint
+TF_BUILTIN(NumberParseInt, CodeStubAssembler) {
+  Node* context = Parameter(Descriptor::kContext);
+  Node* input = Parameter(Descriptor::kString);
+  Node* radix = Parameter(Descriptor::kRadix);
+  Return(CallBuiltin(Builtins::kParseInt, context, input, radix));
+}
+
 // ES6 #sec-number.prototype.valueof
 TF_BUILTIN(NumberPrototypeValueOf, CodeStubAssembler) {
   Node* context = Parameter(Descriptor::kContext);
@@ -436,13 +392,9 @@ TF_BUILTIN(Add, AddStubAssembler) {
 
       BIND(&if_right_smi);
       {
-        // Try fast Smi addition first, bail out if it overflows.
-        Node* pair = IntPtrAddWithOverflow(BitcastTaggedToWord(left),
-                                           BitcastTaggedToWord(right));
-        Node* overflow = Projection(1, pair);
         Label if_overflow(this);
-        GotoIf(overflow, &if_overflow);
-        Return(BitcastWordToTaggedSigned(Projection(0, pair)));
+        TNode<Smi> result = TrySmiAdd(CAST(left), CAST(right), &if_overflow);
+        Return(result);
 
         BIND(&if_overflow);
         {
@@ -731,12 +683,10 @@ TF_BUILTIN(Subtract, NumberBuiltinsAssembler) {
 
   BIND(&do_smi_sub);
   {
-    // Try a fast Smi subtraction first, bail out if it overflows.
-    Node* pair = IntPtrSubWithOverflow(BitcastTaggedToWord(var_left.value()),
-                                       BitcastTaggedToWord(var_right.value()));
-    Node* overflow = Projection(1, pair);
-    Label if_overflow(this), if_notoverflow(this);
-    Branch(overflow, &if_overflow, &if_notoverflow);
+    Label if_overflow(this);
+    TNode<Smi> result = TrySmiSub(CAST(var_left.value()),
+                                  CAST(var_right.value()), &if_overflow);
+    Return(result);
 
     BIND(&if_overflow);
     {
@@ -744,9 +694,6 @@ TF_BUILTIN(Subtract, NumberBuiltinsAssembler) {
       var_right_double.Bind(SmiToFloat64(var_right.value()));
       Goto(&do_double_sub);
     }
-
-    BIND(&if_notoverflow);
-    Return(BitcastWordToTaggedSigned(Projection(0, pair)));
   }
 
   BIND(&do_double_sub);
@@ -831,7 +778,7 @@ TF_BUILTIN(Negate, NumberBuiltinsAssembler) {
                       &do_bigint);
 
   BIND(&do_smi);
-  { Return(SmiMul(var_input.value(), SmiConstant(-1))); }
+  { Return(SmiMul(CAST(var_input.value()), SmiConstant(-1))); }
 
   BIND(&do_double);
   {
@@ -859,7 +806,7 @@ TF_BUILTIN(Multiply, NumberBuiltinsAssembler) {
 
   BIND(&do_smi_mul);
   // The result is not necessarily a smi, in case of overflow.
-  Return(SmiMul(var_left.value(), var_right.value()));
+  Return(SmiMul(CAST(var_left.value()), CAST(var_right.value())));
 
   BIND(&do_double_mul);
   Node* value = Float64Mul(var_left_double.value(), var_right_double.value());
@@ -887,8 +834,8 @@ TF_BUILTIN(Divide, NumberBuiltinsAssembler) {
   {
     // TODO(jkummerow): Consider just always doing a double division.
     Label bailout(this);
-    Node* dividend = var_left.value();
-    Node* divisor = var_right.value();
+    TNode<Smi> dividend = CAST(var_left.value());
+    TNode<Smi> divisor = CAST(var_right.value());
 
     // Do floating point division if {divisor} is zero.
     GotoIf(SmiEqual(divisor, SmiConstant(0)), &bailout);
@@ -968,7 +915,7 @@ TF_BUILTIN(Modulus, NumberBuiltinsAssembler) {
                        &var_left_double, &var_right_double, &do_bigint_mod);
 
   BIND(&do_smi_mod);
-  Return(SmiMod(var_left.value(), var_right.value()));
+  Return(SmiMod(CAST(var_left.value()), CAST(var_right.value())));
 
   BIND(&do_double_mod);
   Node* value = Float64Mod(var_left_double.value(), var_right_double.value());
diff --git a/deps/v8/src/builtins/builtins-number.cc b/deps/v8/src/builtins/builtins-number.cc
index 46aa0514848955..7e701c1546e077 100644
--- a/deps/v8/src/builtins/builtins-number.cc
+++ b/deps/v8/src/builtins/builtins-number.cc
@@ -39,10 +39,10 @@ BUILTIN(NumberPrototypeToExponential) {
       isolate, fraction_digits, Object::ToInteger(isolate, fraction_digits));
   double const fraction_digits_number = fraction_digits->Number();
 
-  if (std::isnan(value_number)) return isolate->heap()->NaN_string();
+  if (std::isnan(value_number)) return ReadOnlyRoots(isolate).NaN_string();
   if (std::isinf(value_number)) {
-    return (value_number < 0.0) ? isolate->heap()->minus_Infinity_string()
-                                : isolate->heap()->Infinity_string();
+    return (value_number < 0.0) ? ReadOnlyRoots(isolate).minus_Infinity_string()
+                                : ReadOnlyRoots(isolate).Infinity_string();
   }
   if (fraction_digits_number < 0.0 ||
       fraction_digits_number > kMaxFractionDigits) {
@@ -93,10 +93,10 @@ BUILTIN(NumberPrototypeToFixed) {
                                    "toFixed() digits")));
   }
 
-  if (std::isnan(value_number)) return isolate->heap()->NaN_string();
+  if (std::isnan(value_number)) return ReadOnlyRoots(isolate).NaN_string();
   if (std::isinf(value_number)) {
-    return (value_number < 0.0) ? isolate->heap()->minus_Infinity_string()
-                                : isolate->heap()->Infinity_string();
+    return (value_number < 0.0) ? ReadOnlyRoots(isolate).minus_Infinity_string()
+                                : ReadOnlyRoots(isolate).Infinity_string();
   }
   char* const str = DoubleToFixedCString(
       value_number, static_cast<int>(fraction_digits_number));
@@ -155,10 +155,10 @@ BUILTIN(NumberPrototypeToPrecision) {
                                      Object::ToInteger(isolate, precision));
   double const precision_number = precision->Number();
 
-  if (std::isnan(value_number)) return isolate->heap()->NaN_string();
+  if (std::isnan(value_number)) return ReadOnlyRoots(isolate).NaN_string();
   if (std::isinf(value_number)) {
-    return (value_number < 0.0) ? isolate->heap()->minus_Infinity_string()
-                                : isolate->heap()->Infinity_string();
+    return (value_number < 0.0) ? ReadOnlyRoots(isolate).minus_Infinity_string()
+                                : ReadOnlyRoots(isolate).Infinity_string();
   }
   if (precision_number < 1.0 || precision_number > kMaxFractionDigits) {
     THROW_NEW_ERROR_RETURN_FAILURE(
@@ -219,10 +219,10 @@ BUILTIN(NumberPrototypeToString) {
   }
 
   // Slow case.
-  if (std::isnan(value_number)) return isolate->heap()->NaN_string();
+  if (std::isnan(value_number)) return ReadOnlyRoots(isolate).NaN_string();
   if (std::isinf(value_number)) {
-    return (value_number < 0.0) ? isolate->heap()->minus_Infinity_string()
-                                : isolate->heap()->Infinity_string();
+    return (value_number < 0.0) ? ReadOnlyRoots(isolate).minus_Infinity_string()
+                                : ReadOnlyRoots(isolate).Infinity_string();
   }
   char* const str =
       DoubleToRadixCString(value_number, static_cast<int>(radix_number));
diff --git a/deps/v8/src/builtins/builtins-object-gen.cc b/deps/v8/src/builtins/builtins-object-gen.cc
index 20d9453aa74d41..fb89694c314558 100644
--- a/deps/v8/src/builtins/builtins-object-gen.cc
+++ b/deps/v8/src/builtins/builtins-object-gen.cc
@@ -6,6 +6,8 @@
 #include "src/builtins/builtins.h"
 #include "src/code-stub-assembler.h"
 #include "src/heap/factory-inl.h"
+#include "src/ic/accessor-assembler.h"
+#include "src/ic/keyed-store-generic.h"
 #include "src/objects/property-descriptor-object.h"
 #include "src/objects/shared-function-info.h"
 
@@ -26,8 +28,10 @@ class ObjectBuiltinsAssembler : public CodeStubAssembler {
 
  protected:
   void ReturnToStringFormat(Node* context, Node* string);
-  void AddToDictionaryIf(Node* condition, Node* name_dictionary,
-                         Handle<Name> name, Node* value, Label* bailout);
+  void AddToDictionaryIf(TNode<BoolT> condition,
+                         TNode<NameDictionary> name_dictionary,
+                         Handle<Name> name, TNode<Object> value,
+                         Label* bailout);
   Node* FromPropertyDescriptor(Node* context, Node* desc);
   Node* FromPropertyDetails(Node* context, Node* raw_value, Node* details,
                             Label* if_bailout);
@@ -38,6 +42,16 @@ class ObjectBuiltinsAssembler : public CodeStubAssembler {
   Node* GetAccessorOrUndefined(Node* accessor, Label* if_bailout);
 
   Node* IsSpecialReceiverMap(SloppyTNode<Map> map);
+
+  TNode<Word32T> IsStringWrapperElementsKind(TNode<Map> map);
+
+  // Checks that |map| has only simple properties, returns bitfield3.
+  TNode<Uint32T> EnsureOnlyHasSimpleProperties(TNode<Map> map,
+                                               TNode<Int32T> instance_type,
+                                               Label* bailout);
+
+  void ObjectAssignFast(TNode<Context> context, TNode<JSReceiver> to,
+                        TNode<Object> from, Label* slow);
 };
 
 class ObjectEntriesValuesBuiltinsAssembler : public ObjectBuiltinsAssembler {
@@ -49,8 +63,6 @@ class ObjectEntriesValuesBuiltinsAssembler : public ObjectBuiltinsAssembler {
  protected:
   enum CollectType { kEntries, kValues };
 
-  TNode<Word32T> IsStringWrapperElementsKind(TNode<Map> map);
-
   TNode<BoolT> IsPropertyEnumerable(TNode<Uint32T> details);
 
   TNode<BoolT> IsPropertyKindAccessor(TNode<Uint32T> kind);
@@ -153,8 +165,7 @@ Node* ObjectBuiltinsAssembler::IsSpecialReceiverMap(SloppyTNode<Map> map) {
   return is_special;
 }
 
-TNode<Word32T>
-ObjectEntriesValuesBuiltinsAssembler::IsStringWrapperElementsKind(
+TNode<Word32T> ObjectBuiltinsAssembler::IsStringWrapperElementsKind(
     TNode<Map> map) {
   Node* kind = LoadMapElementsKind(map);
   return Word32Or(
@@ -255,7 +266,7 @@ TNode<JSArray> ObjectEntriesValuesBuiltinsAssembler::FastGetOwnValuesOrEntries(
     TNode<Context> context, TNode<JSObject> object,
     Label* if_call_runtime_with_fast_path, Label* if_no_properties,
     CollectType collect_type) {
-  Node* native_context = LoadNativeContext(context);
+  TNode<Context> native_context = LoadNativeContext(context);
   TNode<Map> array_map =
       LoadJSArrayElementsMap(PACKED_ELEMENTS, native_context);
   TNode<Map> map = LoadMap(object);
@@ -263,9 +274,9 @@ TNode<JSArray> ObjectEntriesValuesBuiltinsAssembler::FastGetOwnValuesOrEntries(
 
   Label if_has_enum_cache(this), if_not_has_enum_cache(this),
       collect_entries(this);
-  Node* object_enum_length =
-      DecodeWordFromWord32<Map::EnumLengthBits>(bit_field3);
-  Node* has_enum_cache = WordNotEqual(
+  TNode<IntPtrT> object_enum_length =
+      Signed(DecodeWordFromWord32<Map::EnumLengthBits>(bit_field3));
+  TNode<BoolT> has_enum_cache = WordNotEqual(
       object_enum_length, IntPtrConstant(kInvalidEnumCacheSentinel));
 
   // In case, we found enum_cache in object,
@@ -281,9 +292,8 @@ TNode<JSArray> ObjectEntriesValuesBuiltinsAssembler::FastGetOwnValuesOrEntries(
   BIND(&if_has_enum_cache);
   {
     GotoIf(WordEqual(object_enum_length, IntPtrConstant(0)), if_no_properties);
-    TNode<FixedArray> values_or_entries = TNode<FixedArray>::UncheckedCast(
-        AllocateFixedArray(PACKED_ELEMENTS, object_enum_length,
-                           INTPTR_PARAMETERS, kAllowLargeObjectAllocation));
+    TNode<FixedArray> values_or_entries = AllocateFixedArray(
+        PACKED_ELEMENTS, object_enum_length, kAllowLargeObjectAllocation);
 
     // If in case we have enum_cache,
     // we can't detect accessor of object until loop through descriptors.
@@ -331,8 +341,7 @@ TNode<JSArray> ObjectEntriesValuesBuiltinsAssembler::FastGetOwnValuesOrEntries(
       // the next descriptor.
       GotoIfNot(IsPropertyEnumerable(details), &next_descriptor);
 
-      VARIABLE(var_property_value, MachineRepresentation::kTagged,
-               UndefinedConstant());
+      TVARIABLE(Object, var_property_value, UndefinedConstant());
       TNode<IntPtrT> descriptor_name_index = ToKeyIndex<DescriptorArray>(
           Unsigned(TruncateIntPtrToInt32(var_descriptor_number.value())));
 
@@ -342,7 +351,7 @@ TNode<JSArray> ObjectEntriesValuesBuiltinsAssembler::FastGetOwnValuesOrEntries(
                                  &var_property_value);
 
       // If kind is "value", append value to properties.
-      Node* value = var_property_value.value();
+      TNode<Object> value = var_property_value.value();
 
       if (collect_type == CollectType::kEntries) {
         // Let entry be CreateArrayFromList(« key, value »).
@@ -353,7 +362,7 @@ TNode<JSArray> ObjectEntriesValuesBuiltinsAssembler::FastGetOwnValuesOrEntries(
             IntPtrConstant(2));
         StoreFixedArrayElement(elements, 0, next_key, SKIP_WRITE_BARRIER);
         StoreFixedArrayElement(elements, 1, value, SKIP_WRITE_BARRIER);
-        value = array;
+        value = TNode<JSArray>::UncheckedCast(array);
       }
 
       StoreFixedArrayElement(values_or_entries, var_result_index.value(),
@@ -419,7 +428,7 @@ TF_BUILTIN(ObjectPrototypeHasOwnProperty, ObjectBuiltinsAssembler) {
   BIND(&if_objectisnotsmi);
 
   Node* map = LoadMap(object);
-  Node* instance_type = LoadMapInstanceType(map);
+  TNode<Int32T> instance_type = LoadMapInstanceType(map);
 
   {
     VARIABLE(var_index, MachineType::PointerRepresentation());
@@ -473,6 +482,219 @@ TF_BUILTIN(ObjectPrototypeHasOwnProperty, ObjectBuiltinsAssembler) {
   Return(CallRuntime(Runtime::kObjectHasOwnProperty, context, object, key));
 }
 
+// ES #sec-object.assign
+TF_BUILTIN(ObjectAssign, ObjectBuiltinsAssembler) {
+  TNode<IntPtrT> argc =
+      ChangeInt32ToIntPtr(Parameter(Descriptor::kJSActualArgumentsCount));
+  CodeStubArguments args(this, argc);
+
+  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
+  TNode<Object> target = args.GetOptionalArgumentValue(0);
+
+  // 1. Let to be ? ToObject(target).
+  TNode<JSReceiver> to = ToObject(context, target);
+
+  Label done(this);
+  // 2. If only one argument was passed, return to.
+  GotoIf(UintPtrLessThanOrEqual(argc, IntPtrConstant(1)), &done);
+
+  // 3. Let sources be the List of argument values starting with the
+  //    second argument.
+  // 4. For each element nextSource of sources, in ascending index order,
+  args.ForEach(
+      [=](Node* next_source_) {
+        TNode<Object> next_source = CAST(next_source_);
+        Label slow(this), cont(this);
+        ObjectAssignFast(context, to, next_source, &slow);
+        Goto(&cont);
+
+        BIND(&slow);
+        {
+          CallRuntime(Runtime::kSetDataProperties, context, to, next_source);
+          Goto(&cont);
+        }
+        BIND(&cont);
+      },
+      IntPtrConstant(1));
+  Goto(&done);
+
+  // 5. Return to.
+  BIND(&done);
+  args.PopAndReturn(to);
+}
+
+TNode<Uint32T> ObjectBuiltinsAssembler::EnsureOnlyHasSimpleProperties(
+    TNode<Map> map, TNode<Int32T> instance_type, Label* bailout) {
+  GotoIf(IsCustomElementsReceiverInstanceType(instance_type), bailout);
+
+  TNode<Uint32T> bit_field3 = LoadMapBitField3(map);
+  GotoIf(IsSetWord32(bit_field3, Map::IsDictionaryMapBit::kMask |
+                                     Map::HasHiddenPrototypeBit::kMask),
+         bailout);
+
+  return bit_field3;
+}
+
+// This function mimics what FastAssign() function does for C++ implementation.
+void ObjectBuiltinsAssembler::ObjectAssignFast(TNode<Context> context,
+                                               TNode<JSReceiver> to,
+                                               TNode<Object> from,
+                                               Label* slow) {
+  Label done(this);
+
+  // Non-empty strings are the only non-JSReceivers that need to be handled
+  // explicitly by Object.assign.
+  GotoIf(TaggedIsSmi(from), &done);
+  TNode<Map> from_map = LoadMap(CAST(from));
+  TNode<Int32T> from_instance_type = LoadMapInstanceType(from_map);
+  {
+    Label cont(this);
+    GotoIf(IsJSReceiverInstanceType(from_instance_type), &cont);
+    GotoIfNot(IsStringInstanceType(from_instance_type), &done);
+    {
+      Branch(SmiEqual(LoadStringLengthAsSmi(CAST(from)), SmiConstant(0)), &done,
+             slow);
+    }
+    BIND(&cont);
+  }
+
+  // If the target is deprecated, the object will be updated on first store. If
+  // the source for that store equals the target, this will invalidate the
+  // cached representation of the source. Handle this case in runtime.
+  TNode<Map> to_map = LoadMap(to);
+  GotoIf(IsDeprecatedMap(to_map), slow);
+  TNode<BoolT> to_is_simple_receiver = IsSimpleObjectMap(to_map);
+
+  GotoIfNot(IsJSObjectInstanceType(from_instance_type), slow);
+  TNode<Uint32T> from_bit_field3 =
+      EnsureOnlyHasSimpleProperties(from_map, from_instance_type, slow);
+
+  GotoIfNot(IsEmptyFixedArray(LoadElements(CAST(from))), slow);
+
+  TNode<DescriptorArray> from_descriptors = LoadMapDescriptors(from_map);
+  TNode<Uint32T> nof_descriptors =
+      DecodeWord32<Map::NumberOfOwnDescriptorsBits>(from_bit_field3);
+
+  TVARIABLE(BoolT, var_stable, Int32TrueConstant());
+  VariableList list({&var_stable}, zone());
+
+  DescriptorArrayForEach(
+      list, Unsigned(Int32Constant(0)), nof_descriptors,
+      [=, &var_stable](TNode<UintPtrT> descriptor_key_index) {
+        TNode<Name> next_key = CAST(
+            LoadWeakFixedArrayElement(from_descriptors, descriptor_key_index));
+
+        TVARIABLE(Object, var_value, SmiConstant(0));
+        Label do_store(this), next_iteration(this);
+
+        {
+          TVARIABLE(Map, var_from_map);
+          TVARIABLE(HeapObject, var_meta_storage);
+          TVARIABLE(IntPtrT, var_entry);
+          TVARIABLE(Uint32T, var_details);
+          Label if_found(this);
+
+          Label if_found_fast(this), if_found_dict(this);
+
+          Label if_stable(this), if_not_stable(this);
+          Branch(var_stable.value(), &if_stable, &if_not_stable);
+          BIND(&if_stable);
+          {
+            // Directly decode from the descriptor array if |from| did not
+            // change shape.
+            var_from_map = from_map;
+            var_meta_storage = from_descriptors;
+            var_entry = Signed(descriptor_key_index);
+            Goto(&if_found_fast);
+          }
+          BIND(&if_not_stable);
+          {
+            // If the map did change, do a slower lookup. We are still
+            // guaranteed that the object has a simple shape, and that the key
+            // is a name.
+            var_from_map = LoadMap(CAST(from));
+            TryLookupPropertyInSimpleObject(
+                CAST(from), var_from_map.value(), next_key, &if_found_fast,
+                &if_found_dict, &var_meta_storage, &var_entry, &next_iteration);
+          }
+
+          BIND(&if_found_fast);
+          {
+            TNode<DescriptorArray> descriptors = CAST(var_meta_storage.value());
+            TNode<IntPtrT> name_index = var_entry.value();
+
+            // Skip non-enumerable properties.
+            var_details = LoadDetailsByKeyIndex(descriptors, name_index);
+            GotoIf(IsSetWord32(var_details.value(),
+                               PropertyDetails::kAttributesDontEnumMask),
+                   &next_iteration);
+
+            LoadPropertyFromFastObject(from, var_from_map.value(), descriptors,
+                                       name_index, var_details.value(),
+                                       &var_value);
+            Goto(&if_found);
+          }
+          BIND(&if_found_dict);
+          {
+            Node* dictionary = var_meta_storage.value();
+            Node* entry = var_entry.value();
+
+            TNode<Uint32T> details =
+                LoadDetailsByKeyIndex<NameDictionary>(dictionary, entry);
+            // Skip non-enumerable properties.
+            GotoIf(
+                IsSetWord32(details, PropertyDetails::kAttributesDontEnumMask),
+                &next_iteration);
+
+            var_details = details;
+            var_value = LoadValueByKeyIndex<NameDictionary>(dictionary, entry);
+            Goto(&if_found);
+          }
+
+          // Here we have details and value which could be an accessor.
+          BIND(&if_found);
+          {
+            Label slow_load(this, Label::kDeferred);
+
+            var_value =
+                CallGetterIfAccessor(var_value.value(), var_details.value(),
+                                     context, from, &slow_load, kCallJSGetter);
+            Goto(&do_store);
+
+            BIND(&slow_load);
+            {
+              var_value =
+                  CallRuntime(Runtime::kGetProperty, context, from, next_key);
+              Goto(&do_store);
+            }
+          }
+        }
+
+        // Store property to target object.
+        BIND(&do_store);
+        {
+          KeyedStoreGenericGenerator::SetProperty(
+              state(), context, to, to_is_simple_receiver, next_key,
+              var_value.value(), LanguageMode::kStrict);
+
+          // Check if the |from| object is still stable, i.e. we can proceed
+          // using property details from preloaded |from_descriptors|.
+          var_stable = Select<BoolT>(
+              var_stable.value(),
+              [=] { return WordEqual(LoadMap(CAST(from)), from_map); },
+              [=] { return Int32FalseConstant(); });
+
+          Goto(&next_iteration);
+        }
+
+        BIND(&next_iteration);
+      });
+
+  Goto(&done);
+
+  BIND(&done);
+}
+
 // ES #sec-object.keys
 TF_BUILTIN(ObjectKeys, ObjectBuiltinsAssembler) {
   Node* object = Parameter(Descriptor::kObject);
@@ -557,6 +779,108 @@ TF_BUILTIN(ObjectKeys, ObjectBuiltinsAssembler) {
   }
 }
 
+// ES #sec-object.getOwnPropertyNames
+TF_BUILTIN(ObjectGetOwnPropertyNames, ObjectBuiltinsAssembler) {
+  Node* object = Parameter(Descriptor::kObject);
+  Node* context = Parameter(Descriptor::kContext);
+
+  VARIABLE(var_length, MachineRepresentation::kTagged);
+  VARIABLE(var_elements, MachineRepresentation::kTagged);
+  Label if_empty(this, Label::kDeferred), if_empty_elements(this),
+      if_fast(this), try_fast(this, Label::kDeferred),
+      if_slow(this, Label::kDeferred), if_join(this);
+
+  // Check if the {object} has a usable enum cache.
+  GotoIf(TaggedIsSmi(object), &if_slow);
+  Node* object_map = LoadMap(object);
+  Node* object_bit_field3 = LoadMapBitField3(object_map);
+  Node* object_enum_length =
+      DecodeWordFromWord32<Map::EnumLengthBits>(object_bit_field3);
+  GotoIf(
+      WordEqual(object_enum_length, IntPtrConstant(kInvalidEnumCacheSentinel)),
+      &try_fast);
+
+  // Ensure that the {object} doesn't have any elements.
+  CSA_ASSERT(this, IsJSObjectMap(object_map));
+  Node* object_elements = LoadElements(object);
+  GotoIf(IsEmptyFixedArray(object_elements), &if_empty_elements);
+  Branch(IsEmptySlowElementDictionary(object_elements), &if_empty_elements,
+         &if_slow);
+
+  // Check whether all own properties are enumerable.
+  BIND(&if_empty_elements);
+  Node* number_descriptors =
+      DecodeWordFromWord32<Map::NumberOfOwnDescriptorsBits>(object_bit_field3);
+  GotoIfNot(WordEqual(object_enum_length, number_descriptors), &if_slow);
+
+  // Check whether there are enumerable properties.
+  Branch(WordEqual(object_enum_length, IntPtrConstant(0)), &if_empty, &if_fast);
+
+  BIND(&if_fast);
+  {
+    // The {object} has a usable enum cache and all own properties are
+    // enumerable, use that.
+    Node* object_descriptors = LoadMapDescriptors(object_map);
+    Node* object_enum_cache =
+        LoadObjectField(object_descriptors, DescriptorArray::kEnumCacheOffset);
+    Node* object_enum_keys =
+        LoadObjectField(object_enum_cache, EnumCache::kKeysOffset);
+
+    // Allocate a JSArray and copy the elements from the {object_enum_keys}.
+    Node* array = nullptr;
+    Node* elements = nullptr;
+    Node* native_context = LoadNativeContext(context);
+    Node* array_map = LoadJSArrayElementsMap(PACKED_ELEMENTS, native_context);
+    Node* array_length = SmiTag(object_enum_length);
+    std::tie(array, elements) = AllocateUninitializedJSArrayWithElements(
+        PACKED_ELEMENTS, array_map, array_length, nullptr, object_enum_length,
+        INTPTR_PARAMETERS);
+    CopyFixedArrayElements(PACKED_ELEMENTS, object_enum_keys, elements,
+                           object_enum_length, SKIP_WRITE_BARRIER);
+    Return(array);
+  }
+
+  BIND(&try_fast);
+  {
+    // Let the runtime compute the elements and try initializing enum cache.
+    Node* elements = CallRuntime(Runtime::kObjectGetOwnPropertyNamesTryFast,
+                                 context, object);
+    var_length.Bind(LoadObjectField(elements, FixedArray::kLengthOffset));
+    var_elements.Bind(elements);
+    Goto(&if_join);
+  }
+
+  BIND(&if_empty);
+  {
+    // The {object} doesn't have any enumerable keys.
+    var_length.Bind(SmiConstant(0));
+    var_elements.Bind(EmptyFixedArrayConstant());
+    Goto(&if_join);
+  }
+
+  BIND(&if_slow);
+  {
+    // Let the runtime compute the elements.
+    Node* elements =
+        CallRuntime(Runtime::kObjectGetOwnPropertyNames, context, object);
+    var_length.Bind(LoadObjectField(elements, FixedArray::kLengthOffset));
+    var_elements.Bind(elements);
+    Goto(&if_join);
+  }
+
+  BIND(&if_join);
+  {
+    // Wrap the elements into a proper JSArray and return that.
+    Node* native_context = LoadNativeContext(context);
+    Node* array_map = LoadJSArrayElementsMap(PACKED_ELEMENTS, native_context);
+    Node* array = AllocateUninitializedJSArrayWithoutElements(
+        array_map, var_length.value(), nullptr);
+    StoreObjectFieldNoWriteBarrier(array, JSArray::kElementsOffset,
+                                   var_elements.value());
+    Return(array);
+  }
+}
+
 TF_BUILTIN(ObjectValues, ObjectEntriesValuesBuiltinsAssembler) {
   TNode<JSObject> object =
       TNode<JSObject>::UncheckedCast(Parameter(Descriptor::kObject));
@@ -903,18 +1227,81 @@ TF_BUILTIN(ObjectPrototypeValueOf, CodeStubAssembler) {
   Return(ToObject(context, receiver));
 }
 
+// ES #sec-object.create
+TF_BUILTIN(CreateObjectWithoutProperties, ObjectBuiltinsAssembler) {
+  Node* const prototype = Parameter(Descriptor::kPrototypeArg);
+  Node* const context = Parameter(Descriptor::kContext);
+  Node* const native_context = LoadNativeContext(context);
+  Label call_runtime(this, Label::kDeferred), prototype_null(this),
+      prototype_jsreceiver(this);
+  {
+    Comment("Argument check: prototype");
+    GotoIf(IsNull(prototype), &prototype_null);
+    BranchIfJSReceiver(prototype, &prototype_jsreceiver, &call_runtime);
+  }
+
+  VARIABLE(map, MachineRepresentation::kTagged);
+  VARIABLE(properties, MachineRepresentation::kTagged);
+  Label instantiate_map(this);
+
+  BIND(&prototype_null);
+  {
+    Comment("Prototype is null");
+    map.Bind(LoadContextElement(native_context,
+                                Context::SLOW_OBJECT_WITH_NULL_PROTOTYPE_MAP));
+    properties.Bind(AllocateNameDictionary(NameDictionary::kInitialCapacity));
+    Goto(&instantiate_map);
+  }
+
+  BIND(&prototype_jsreceiver);
+  {
+    Comment("Prototype is JSReceiver");
+    properties.Bind(EmptyFixedArrayConstant());
+    Node* object_function =
+        LoadContextElement(native_context, Context::OBJECT_FUNCTION_INDEX);
+    Node* object_function_map = LoadObjectField(
+        object_function, JSFunction::kPrototypeOrInitialMapOffset);
+    map.Bind(object_function_map);
+    GotoIf(WordEqual(prototype, LoadMapPrototype(map.value())),
+           &instantiate_map);
+    Comment("Try loading the prototype info");
+    Node* prototype_info =
+        LoadMapPrototypeInfo(LoadMap(prototype), &call_runtime);
+    TNode<MaybeObject> maybe_map = LoadMaybeWeakObjectField(
+        prototype_info, PrototypeInfo::kObjectCreateMapOffset);
+    GotoIf(IsStrongReferenceTo(maybe_map, UndefinedConstant()), &call_runtime);
+    map.Bind(ToWeakHeapObject(maybe_map, &call_runtime));
+    Goto(&instantiate_map);
+  }
+
+  BIND(&instantiate_map);
+  {
+    Comment("Instantiate map");
+    Node* instance = AllocateJSObjectFromMap(map.value(), properties.value());
+    Return(instance);
+  }
+
+  BIND(&call_runtime);
+  {
+    Comment("Call Runtime (prototype is not null/jsreceiver)");
+    Node* result = CallRuntime(Runtime::kObjectCreate, context, prototype,
+                               UndefinedConstant());
+    Return(result);
+  }
+}
+
 // ES #sec-object.create
 TF_BUILTIN(ObjectCreate, ObjectBuiltinsAssembler) {
   int const kPrototypeArg = 0;
   int const kPropertiesArg = 1;
 
   Node* argc =
-      ChangeInt32ToIntPtr(Parameter(BuiltinDescriptor::kArgumentsCount));
+      ChangeInt32ToIntPtr(Parameter(Descriptor::kJSActualArgumentsCount));
   CodeStubArguments args(this, argc);
 
   Node* prototype = args.GetOptionalArgumentValue(kPrototypeArg);
   Node* properties = args.GetOptionalArgumentValue(kPropertiesArg);
-  Node* context = Parameter(BuiltinDescriptor::kContext);
+  Node* context = Parameter(Descriptor::kContext);
 
   Label call_runtime(this, Label::kDeferred), prototype_valid(this),
       no_properties(this);
@@ -975,10 +1362,11 @@ TF_BUILTIN(ObjectCreate, ObjectBuiltinsAssembler) {
       Node* prototype_info =
           LoadMapPrototypeInfo(LoadMap(prototype), &call_runtime);
       Comment("Load ObjectCreateMap from PrototypeInfo");
-      Node* weak_cell =
-          LoadObjectField(prototype_info, PrototypeInfo::kObjectCreateMap);
-      GotoIf(IsUndefined(weak_cell), &call_runtime);
-      map.Bind(LoadWeakCellValue(weak_cell, &call_runtime));
+      TNode<MaybeObject> maybe_map = LoadMaybeWeakObjectField(
+          prototype_info, PrototypeInfo::kObjectCreateMapOffset);
+      GotoIf(IsStrongReferenceTo(maybe_map, UndefinedConstant()),
+             &call_runtime);
+      map.Bind(ToWeakHeapObject(maybe_map, &call_runtime));
       Goto(&instantiate_map);
     }
 
@@ -1078,12 +1466,17 @@ TF_BUILTIN(CreateGeneratorObject, ObjectBuiltinsAssembler) {
       LoadObjectField(closure, JSFunction::kSharedFunctionInfoOffset);
   Node* bytecode_array = LoadSharedFunctionInfoBytecodeArray(shared);
 
+  Node* formal_parameter_count = ChangeInt32ToIntPtr(
+      LoadObjectField(shared, SharedFunctionInfo::kFormalParameterCountOffset,
+                      MachineType::Uint16()));
   Node* frame_size = ChangeInt32ToIntPtr(LoadObjectField(
       bytecode_array, BytecodeArray::kFrameSizeOffset, MachineType::Int32()));
-  Node* size = WordSar(frame_size, IntPtrConstant(kPointerSizeLog2));
-  Node* register_file = AllocateFixedArray(HOLEY_ELEMENTS, size);
-  FillFixedArrayWithValue(HOLEY_ELEMENTS, register_file, IntPtrConstant(0),
-                          size, Heap::kUndefinedValueRootIndex);
+  Node* size = IntPtrAdd(WordSar(frame_size, IntPtrConstant(kPointerSizeLog2)),
+                         formal_parameter_count);
+  Node* parameters_and_registers = AllocateFixedArray(HOLEY_ELEMENTS, size);
+  FillFixedArrayWithValue(HOLEY_ELEMENTS, parameters_and_registers,
+                          IntPtrConstant(0), size,
+                          Heap::kUndefinedValueRootIndex);
   // TODO(cbruni): support start_offset to avoid double initialization.
   Node* result = AllocateJSObjectFromMap(maybe_map, nullptr, nullptr, kNone,
                                          kWithSlackTracking);
@@ -1093,8 +1486,9 @@ TF_BUILTIN(CreateGeneratorObject, ObjectBuiltinsAssembler) {
                                  context);
   StoreObjectFieldNoWriteBarrier(result, JSGeneratorObject::kReceiverOffset,
                                  receiver);
-  StoreObjectFieldNoWriteBarrier(result, JSGeneratorObject::kRegisterFileOffset,
-                                 register_file);
+  StoreObjectFieldNoWriteBarrier(
+      result, JSGeneratorObject::kParametersAndRegistersOffset,
+      parameters_and_registers);
   Node* executing = SmiConstant(JSGeneratorObject::kGeneratorExecuting);
   StoreObjectFieldNoWriteBarrier(result, JSGeneratorObject::kContinuationOffset,
                                  executing);
@@ -1115,9 +1509,9 @@ TF_BUILTIN(CreateGeneratorObject, ObjectBuiltinsAssembler) {
 
 // ES6 section 19.1.2.7 Object.getOwnPropertyDescriptor ( O, P )
 TF_BUILTIN(ObjectGetOwnPropertyDescriptor, ObjectBuiltinsAssembler) {
-  Node* argc = Parameter(BuiltinDescriptor::kArgumentsCount);
-  Node* context = Parameter(BuiltinDescriptor::kContext);
-  CSA_ASSERT(this, IsUndefined(Parameter(BuiltinDescriptor::kNewTarget)));
+  Node* argc = Parameter(Descriptor::kJSActualArgumentsCount);
+  Node* context = Parameter(Descriptor::kContext);
+  CSA_ASSERT(this, IsUndefined(Parameter(Descriptor::kJSNewTarget)));
 
   CodeStubArguments args(this, ChangeInt32ToIntPtr(argc));
   Node* object = args.GetOptionalArgumentValue(0);
@@ -1134,7 +1528,7 @@ TF_BUILTIN(ObjectGetOwnPropertyDescriptor, ObjectBuiltinsAssembler) {
       call_runtime(this, Label::kDeferred),
       return_undefined(this, Label::kDeferred), if_notunique_name(this);
   Node* map = LoadMap(object);
-  Node* instance_type = LoadMapInstanceType(map);
+  TNode<Int32T> instance_type = LoadMapInstanceType(map);
   GotoIf(IsSpecialReceiverInstanceType(instance_type), &call_runtime);
   {
     VARIABLE(var_index, MachineType::PointerRepresentation(),
@@ -1206,10 +1600,9 @@ TF_BUILTIN(ObjectGetOwnPropertyDescriptor, ObjectBuiltinsAssembler) {
   args.PopAndReturn(UndefinedConstant());
 }
 
-void ObjectBuiltinsAssembler::AddToDictionaryIf(Node* condition,
-                                                Node* name_dictionary,
-                                                Handle<Name> name, Node* value,
-                                                Label* bailout) {
+void ObjectBuiltinsAssembler::AddToDictionaryIf(
+    TNode<BoolT> condition, TNode<NameDictionary> name_dictionary,
+    Handle<Name> name, TNode<Object> value, Label* bailout) {
   Label done(this);
   GotoIfNot(condition, &done);
 
@@ -1269,13 +1662,14 @@ Node* ObjectBuiltinsAssembler::FromPropertyDescriptor(Node* context,
         native_context, Context::SLOW_OBJECT_WITH_OBJECT_PROTOTYPE_MAP);
     // We want to preallocate the slots for value, writable, get, set,
     // enumerable and configurable - a total of 6
-    Node* properties = AllocateNameDictionary(6);
+    TNode<NameDictionary> properties = AllocateNameDictionary(6);
     Node* js_desc = AllocateJSObjectFromMap(map, properties);
 
     Label bailout(this, Label::kDeferred);
 
     Factory* factory = isolate()->factory();
-    Node* value = LoadObjectField(desc, PropertyDescriptorObject::kValueOffset);
+    TNode<Object> value =
+        LoadObjectField(desc, PropertyDescriptorObject::kValueOffset);
     AddToDictionaryIf(IsNotTheHole(value), properties, factory->value_string(),
                       value, &bailout);
     AddToDictionaryIf(
@@ -1285,10 +1679,12 @@ Node* ObjectBuiltinsAssembler::FromPropertyDescriptor(Node* context,
             IsSetWord32<PropertyDescriptorObject::IsWritableBit>(flags)),
         &bailout);
 
-    Node* get = LoadObjectField(desc, PropertyDescriptorObject::kGetOffset);
+    TNode<Object> get =
+        LoadObjectField(desc, PropertyDescriptorObject::kGetOffset);
     AddToDictionaryIf(IsNotTheHole(get), properties, factory->get_string(), get,
                       &bailout);
-    Node* set = LoadObjectField(desc, PropertyDescriptorObject::kSetOffset);
+    TNode<Object> set =
+        LoadObjectField(desc, PropertyDescriptorObject::kSetOffset);
     AddToDictionaryIf(IsNotTheHole(set), properties, factory->set_string(), set,
                       &bailout);
 
diff --git a/deps/v8/src/builtins/builtins-object.cc b/deps/v8/src/builtins/builtins-object.cc
index 4e353b92600531..927161d45f549d 100644
--- a/deps/v8/src/builtins/builtins-object.cc
+++ b/deps/v8/src/builtins/builtins-object.cc
@@ -18,29 +18,6 @@ namespace internal {
 // -----------------------------------------------------------------------------
 // ES6 section 19.1 Object Objects
 
-// ES6 19.1.2.1 Object.assign
-BUILTIN(ObjectAssign) {
-  HandleScope scope(isolate);
-  Handle<Object> target = args.atOrUndefined(isolate, 1);
-
-  // 1. Let to be ? ToObject(target).
-  ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, target,
-                                     Object::ToObject(isolate, target));
-  Handle<JSReceiver> to = Handle<JSReceiver>::cast(target);
-  // 2. If only one argument was passed, return to.
-  if (args.length() == 2) return *to;
-  // 3. Let sources be the List of argument values starting with the
-  //    second argument.
-  // 4. For each element nextSource of sources, in ascending index order,
-  for (int i = 2; i < args.length(); ++i) {
-    Handle<Object> next_source = args.at(i);
-    MAYBE_RETURN(JSReceiver::SetOrCopyDataProperties(isolate, to, next_source),
-                 isolate->heap()->exception());
-  }
-  // 5. Return to.
-  return *to;
-}
-
 // ES6 section 19.1.3.4 Object.prototype.propertyIsEnumerable ( V )
 BUILTIN(ObjectPrototypePropertyIsEnumerable) {
   HandleScope scope(isolate);
@@ -52,8 +29,8 @@ BUILTIN(ObjectPrototypePropertyIsEnumerable) {
       isolate, object, JSReceiver::ToObject(isolate, args.receiver()));
   Maybe<PropertyAttributes> maybe =
       JSReceiver::GetOwnPropertyAttributes(object, name);
-  if (maybe.IsNothing()) return isolate->heap()->exception();
-  if (maybe.FromJust() == ABSENT) return isolate->heap()->false_value();
+  if (maybe.IsNothing()) return ReadOnlyRoots(isolate).exception();
+  if (maybe.FromJust() == ABSENT) return ReadOnlyRoots(isolate).false_value();
   return isolate->heap()->ToBoolean((maybe.FromJust() & DONT_ENUM) == 0);
 }
 
@@ -115,12 +92,12 @@ Object* ObjectDefineAccessor(Isolate* isolate, Handle<Object> object,
   // throwing an exception.
   Maybe<bool> success = JSReceiver::DefineOwnProperty(isolate, receiver, name,
                                                       &desc, kThrowOnError);
-  MAYBE_RETURN(success, isolate->heap()->exception());
+  MAYBE_RETURN(success, ReadOnlyRoots(isolate).exception());
   if (!success.FromJust()) {
     isolate->CountUsage(v8::Isolate::kDefineGetterOrSetterWouldThrow);
   }
   // 6. Return undefined.
-  return isolate->heap()->undefined_value();
+  return ReadOnlyRoots(isolate).undefined_value();
 }
 
 Object* ObjectLookupAccessor(Isolate* isolate, Handle<Object> object,
@@ -146,13 +123,13 @@ Object* ObjectLookupAccessor(Isolate* isolate, Handle<Object> object,
         if (it.HasAccess()) continue;
         isolate->ReportFailedAccessCheck(it.GetHolder<JSObject>());
         RETURN_FAILURE_IF_SCHEDULED_EXCEPTION(isolate);
-        return isolate->heap()->undefined_value();
+        return ReadOnlyRoots(isolate).undefined_value();
 
       case LookupIterator::JSPROXY: {
         PropertyDescriptor desc;
         Maybe<bool> found = JSProxy::GetOwnPropertyDescriptor(
             isolate, it.GetHolder<JSProxy>(), it.GetName(), &desc);
-        MAYBE_RETURN(found, isolate->heap()->exception());
+        MAYBE_RETURN(found, ReadOnlyRoots(isolate).exception());
         if (found.FromJust()) {
           if (component == ACCESSOR_GETTER && desc.has_get()) {
             return *desc.get();
@@ -160,20 +137,20 @@ Object* ObjectLookupAccessor(Isolate* isolate, Handle<Object> object,
           if (component == ACCESSOR_SETTER && desc.has_set()) {
             return *desc.set();
           }
-          return isolate->heap()->undefined_value();
+          return ReadOnlyRoots(isolate).undefined_value();
         }
         Handle<Object> prototype;
         ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
             isolate, prototype, JSProxy::GetPrototype(it.GetHolder<JSProxy>()));
         if (prototype->IsNull(isolate)) {
-          return isolate->heap()->undefined_value();
+          return ReadOnlyRoots(isolate).undefined_value();
         }
         return ObjectLookupAccessor(isolate, prototype, key, component);
       }
 
       case LookupIterator::INTEGER_INDEXED_EXOTIC:
       case LookupIterator::DATA:
-        return isolate->heap()->undefined_value();
+        return ReadOnlyRoots(isolate).undefined_value();
 
       case LookupIterator::ACCESSOR: {
         Handle<Object> maybe_pair = it.GetAccessors();
@@ -185,7 +162,7 @@ Object* ObjectLookupAccessor(Isolate* isolate, Handle<Object> object,
     }
   }
 
-  return isolate->heap()->undefined_value();
+  return ReadOnlyRoots(isolate).undefined_value();
 }
 
 }  // namespace
@@ -235,7 +212,7 @@ BUILTIN(ObjectFreeze) {
   if (object->IsJSReceiver()) {
     MAYBE_RETURN(JSReceiver::SetIntegrityLevel(Handle<JSReceiver>::cast(object),
                                                FROZEN, kThrowOnError),
-                 isolate->heap()->exception());
+                 ReadOnlyRoots(isolate).exception());
   }
   return *object;
 }
@@ -280,7 +257,7 @@ BUILTIN(ObjectSetPrototypeOf) {
   // 4. Let status be ? O.[[SetPrototypeOf]](proto).
   // 5. If status is false, throw a TypeError exception.
   MAYBE_RETURN(JSReceiver::SetPrototype(receiver, proto, true, kThrowOnError),
-               isolate->heap()->exception());
+               ReadOnlyRoots(isolate).exception());
 
   // 6. Return O.
   return *receiver;
@@ -314,20 +291,20 @@ BUILTIN(ObjectPrototypeSetProto) {
   // 2. If Type(proto) is neither Object nor Null, return undefined.
   Handle<Object> proto = args.at(1);
   if (!proto->IsNull(isolate) && !proto->IsJSReceiver()) {
-    return isolate->heap()->undefined_value();
+    return ReadOnlyRoots(isolate).undefined_value();
   }
 
   // 3. If Type(O) is not Object, return undefined.
-  if (!object->IsJSReceiver()) return isolate->heap()->undefined_value();
+  if (!object->IsJSReceiver()) return ReadOnlyRoots(isolate).undefined_value();
   Handle<JSReceiver> receiver = Handle<JSReceiver>::cast(object);
 
   // 4. Let status be ? O.[[SetPrototypeOf]](proto).
   // 5. If status is false, throw a TypeError exception.
   MAYBE_RETURN(JSReceiver::SetPrototype(receiver, proto, true, kThrowOnError),
-               isolate->heap()->exception());
+               ReadOnlyRoots(isolate).exception());
 
   // Return undefined.
-  return isolate->heap()->undefined_value();
+  return ReadOnlyRoots(isolate).undefined_value();
 }
 
 namespace {
@@ -349,11 +326,6 @@ Object* GetOwnPropertyKeys(Isolate* isolate, BuiltinArguments args,
 
 }  // namespace
 
-// ES6 section 19.1.2.7 Object.getOwnPropertyNames ( O )
-BUILTIN(ObjectGetOwnPropertyNames) {
-  return GetOwnPropertyKeys(isolate, args, SKIP_SYMBOLS);
-}
-
 // ES6 section 19.1.2.8 Object.getOwnPropertySymbols ( O )
 BUILTIN(ObjectGetOwnPropertySymbols) {
   return GetOwnPropertyKeys(isolate, args, SKIP_STRINGS);
@@ -367,7 +339,7 @@ BUILTIN(ObjectIsExtensible) {
       object->IsJSReceiver()
           ? JSReceiver::IsExtensible(Handle<JSReceiver>::cast(object))
           : Just(false);
-  MAYBE_RETURN(result, isolate->heap()->exception());
+  MAYBE_RETURN(result, ReadOnlyRoots(isolate).exception());
   return isolate->heap()->ToBoolean(result.FromJust());
 }
 
@@ -379,7 +351,7 @@ BUILTIN(ObjectIsFrozen) {
                            ? JSReceiver::TestIntegrityLevel(
                                  Handle<JSReceiver>::cast(object), FROZEN)
                            : Just(true);
-  MAYBE_RETURN(result, isolate->heap()->exception());
+  MAYBE_RETURN(result, ReadOnlyRoots(isolate).exception());
   return isolate->heap()->ToBoolean(result.FromJust());
 }
 
@@ -391,7 +363,7 @@ BUILTIN(ObjectIsSealed) {
                            ? JSReceiver::TestIntegrityLevel(
                                  Handle<JSReceiver>::cast(object), SEALED)
                            : Just(true);
-  MAYBE_RETURN(result, isolate->heap()->exception());
+  MAYBE_RETURN(result, ReadOnlyRoots(isolate).exception());
   return isolate->heap()->ToBoolean(result.FromJust());
 }
 
@@ -417,7 +389,7 @@ BUILTIN(ObjectGetOwnPropertyDescriptors) {
     PropertyDescriptor descriptor;
     Maybe<bool> did_get_descriptor = JSReceiver::GetOwnPropertyDescriptor(
         isolate, receiver, key, &descriptor);
-    MAYBE_RETURN(did_get_descriptor, isolate->heap()->exception());
+    MAYBE_RETURN(did_get_descriptor, ReadOnlyRoots(isolate).exception());
 
     if (!did_get_descriptor.FromJust()) continue;
     Handle<Object> from_descriptor = descriptor.ToObject(isolate);
@@ -439,7 +411,7 @@ BUILTIN(ObjectPreventExtensions) {
   if (object->IsJSReceiver()) {
     MAYBE_RETURN(JSReceiver::PreventExtensions(Handle<JSReceiver>::cast(object),
                                                kThrowOnError),
-                 isolate->heap()->exception());
+                 ReadOnlyRoots(isolate).exception());
   }
   return *object;
 }
@@ -451,7 +423,7 @@ BUILTIN(ObjectSeal) {
   if (object->IsJSReceiver()) {
     MAYBE_RETURN(JSReceiver::SetIntegrityLevel(Handle<JSReceiver>::cast(object),
                                                SEALED, kThrowOnError),
-                 isolate->heap()->exception());
+                 ReadOnlyRoots(isolate).exception());
   }
   return *object;
 }
diff --git a/deps/v8/src/builtins/builtins-promise-gen.cc b/deps/v8/src/builtins/builtins-promise-gen.cc
index 868b45a8316ff5..ccfb3b11b0978e 100644
--- a/deps/v8/src/builtins/builtins-promise-gen.cc
+++ b/deps/v8/src/builtins/builtins-promise-gen.cc
@@ -11,6 +11,7 @@
 #include "src/code-factory.h"
 #include "src/code-stub-assembler.h"
 #include "src/objects-inl.h"
+#include "src/objects/js-promise.h"
 
 namespace v8 {
 namespace internal {
@@ -55,7 +56,7 @@ Node* PromiseBuiltinsAssembler::AllocateAndInitJSPromise(Node* context,
   PromiseInit(instance);
 
   Label out(this);
-  GotoIfNot(IsPromiseHookEnabledOrDebugIsActive(), &out);
+  GotoIfNot(IsPromiseHookEnabledOrHasAsyncEventDelegate(), &out);
   CallRuntime(Runtime::kPromiseHookInit, context, instance, parent);
   Goto(&out);
 
@@ -79,7 +80,7 @@ Node* PromiseBuiltinsAssembler::AllocateAndSetJSPromise(
   }
 
   Label out(this);
-  GotoIfNot(IsPromiseHookEnabledOrDebugIsActive(), &out);
+  GotoIfNot(IsPromiseHookEnabledOrHasAsyncEventDelegate(), &out);
   CallRuntime(Runtime::kPromiseHookInit, context, instance,
               UndefinedConstant());
   Goto(&out);
@@ -221,8 +222,7 @@ Node* PromiseBuiltinsAssembler::CreatePromiseAllResolveElementContext(
 }
 
 Node* PromiseBuiltinsAssembler::CreatePromiseAllResolveElementFunction(
-    Node* context, Node* index, Node* native_context) {
-  CSA_ASSERT(this, TaggedIsSmi(index));
+    Node* context, TNode<Smi> index, Node* native_context) {
   CSA_ASSERT(this, SmiGreaterThan(index, SmiConstant(0)));
   CSA_ASSERT(this, SmiLessThanOrEqual(
                        index, SmiConstant(PropertyArray::HashField::kMax)));
@@ -247,6 +247,8 @@ Node* PromiseBuiltinsAssembler::CreatePromiseResolvingFunctionsContext(
   Node* const context =
       CreatePromiseContext(native_context, kPromiseContextLength);
   StoreContextElementNoWriteBarrier(context, kPromiseSlot, promise);
+  StoreContextElementNoWriteBarrier(context, kAlreadyResolvedSlot,
+                                    FalseConstant());
   StoreContextElementNoWriteBarrier(context, kDebugEventSlot, debug_event);
   return context;
 }
@@ -266,8 +268,9 @@ Node* PromiseBuiltinsAssembler::PromiseHasHandler(Node* promise) {
 }
 
 void PromiseBuiltinsAssembler::PromiseSetHasHandler(Node* promise) {
-  Node* const flags = LoadObjectField(promise, JSPromise::kFlagsOffset);
-  Node* const new_flags =
+  TNode<Smi> const flags =
+      CAST(LoadObjectField(promise, JSPromise::kFlagsOffset));
+  TNode<Smi> const new_flags =
       SmiOr(flags, SmiConstant(1 << JSPromise::kHasHandlerBit));
   StoreObjectFieldNoWriteBarrier(promise, JSPromise::kFlagsOffset, new_flags);
 }
@@ -279,7 +282,8 @@ Node* PromiseBuiltinsAssembler::IsPromiseStatus(
 
 Node* PromiseBuiltinsAssembler::PromiseStatus(Node* promise) {
   STATIC_ASSERT(JSPromise::kStatusShift == 0);
-  Node* const flags = LoadObjectField(promise, JSPromise::kFlagsOffset);
+  TNode<Smi> const flags =
+      CAST(LoadObjectField(promise, JSPromise::kFlagsOffset));
   return Word32And(SmiToInt32(flags), Int32Constant(JSPromise::kStatusMask));
 }
 
@@ -289,15 +293,17 @@ void PromiseBuiltinsAssembler::PromiseSetStatus(
              IsPromiseStatus(PromiseStatus(promise), v8::Promise::kPending));
   CHECK_NE(status, v8::Promise::kPending);
 
-  Node* mask = SmiConstant(status);
-  Node* const flags = LoadObjectField(promise, JSPromise::kFlagsOffset);
+  TNode<Smi> mask = SmiConstant(status);
+  TNode<Smi> const flags =
+      CAST(LoadObjectField(promise, JSPromise::kFlagsOffset));
   StoreObjectFieldNoWriteBarrier(promise, JSPromise::kFlagsOffset,
                                  SmiOr(flags, mask));
 }
 
 void PromiseBuiltinsAssembler::PromiseSetHandledHint(Node* promise) {
-  Node* const flags = LoadObjectField(promise, JSPromise::kFlagsOffset);
-  Node* const new_flags =
+  TNode<Smi> const flags =
+      CAST(LoadObjectField(promise, JSPromise::kFlagsOffset));
+  TNode<Smi> const new_flags =
       SmiOr(flags, SmiConstant(1 << JSPromise::kHandledHintBit));
   StoreObjectFieldNoWriteBarrier(promise, JSPromise::kFlagsOffset, new_flags);
 }
@@ -733,17 +739,27 @@ TF_BUILTIN(PromiseCapabilityDefaultReject, PromiseBuiltinsAssembler) {
   Node* const promise = LoadContextElement(context, kPromiseSlot);
 
   // 3. Let alreadyResolved be F.[[AlreadyResolved]].
+  Label if_already_resolved(this, Label::kDeferred);
+  Node* const already_resolved =
+      LoadContextElement(context, kAlreadyResolvedSlot);
+
   // 4. If alreadyResolved.[[Value]] is true, return undefined.
-  // We use undefined as a marker for the [[AlreadyResolved]] state.
-  ReturnIf(IsUndefined(promise), UndefinedConstant());
+  GotoIf(IsTrue(already_resolved), &if_already_resolved);
 
   // 5. Set alreadyResolved.[[Value]] to true.
-  StoreContextElementNoWriteBarrier(context, kPromiseSlot, UndefinedConstant());
+  StoreContextElementNoWriteBarrier(context, kAlreadyResolvedSlot,
+                                    TrueConstant());
 
   // 6. Return RejectPromise(promise, reason).
   Node* const debug_event = LoadContextElement(context, kDebugEventSlot);
   Return(CallBuiltin(Builtins::kRejectPromise, context, promise, reason,
                      debug_event));
+
+  BIND(&if_already_resolved);
+  {
+    Return(CallRuntime(Runtime::kPromiseRejectAfterResolved, context, promise,
+                       reason));
+  }
 }
 
 // ES #sec-promise-resolve-functions
@@ -755,16 +771,26 @@ TF_BUILTIN(PromiseCapabilityDefaultResolve, PromiseBuiltinsAssembler) {
   Node* const promise = LoadContextElement(context, kPromiseSlot);
 
   // 3. Let alreadyResolved be F.[[AlreadyResolved]].
+  Label if_already_resolved(this, Label::kDeferred);
+  Node* const already_resolved =
+      LoadContextElement(context, kAlreadyResolvedSlot);
+
   // 4. If alreadyResolved.[[Value]] is true, return undefined.
-  // We use undefined as a marker for the [[AlreadyResolved]] state.
-  ReturnIf(IsUndefined(promise), UndefinedConstant());
+  GotoIf(IsTrue(already_resolved), &if_already_resolved);
 
   // 5. Set alreadyResolved.[[Value]] to true.
-  StoreContextElementNoWriteBarrier(context, kPromiseSlot, UndefinedConstant());
+  StoreContextElementNoWriteBarrier(context, kAlreadyResolvedSlot,
+                                    TrueConstant());
 
   // The rest of the logic (and the catch prediction) is
   // encapsulated in the dedicated ResolvePromise builtin.
   Return(CallBuiltin(Builtins::kResolvePromise, context, promise, resolution));
+
+  BIND(&if_already_resolved);
+  {
+    Return(CallRuntime(Runtime::kPromiseResolveAfterResolved, context, promise,
+                       resolution));
+  }
 }
 
 TF_BUILTIN(PromiseConstructorLazyDeoptContinuation, PromiseBuiltinsAssembler) {
@@ -787,7 +813,7 @@ TF_BUILTIN(PromiseConstructorLazyDeoptContinuation, PromiseBuiltinsAssembler) {
 // ES6 #sec-promise-executor
 TF_BUILTIN(PromiseConstructor, PromiseBuiltinsAssembler) {
   Node* const executor = Parameter(Descriptor::kExecutor);
-  Node* const new_target = Parameter(Descriptor::kNewTarget);
+  Node* const new_target = Parameter(Descriptor::kJSNewTarget);
   Node* const context = Parameter(Descriptor::kContext);
   Isolate* isolate = this->isolate();
 
@@ -835,7 +861,7 @@ TF_BUILTIN(PromiseConstructor, PromiseBuiltinsAssembler) {
     PromiseInit(instance);
     var_result.Bind(instance);
 
-    GotoIfNot(IsPromiseHookEnabledOrDebugIsActive(), &debug_push);
+    GotoIfNot(IsPromiseHookEnabledOrHasAsyncEventDelegate(), &debug_push);
     CallRuntime(Runtime::kPromiseHookInit, context, instance,
                 UndefinedConstant());
     Goto(&debug_push);
@@ -1055,7 +1081,8 @@ TF_BUILTIN(PromiseResolveThenableJob, PromiseBuiltinsAssembler) {
   GotoIfNot(WordEqual(then, promise_then), &if_slow);
   Node* const thenable_map = LoadMap(thenable);
   GotoIfNot(IsJSPromiseMap(thenable_map), &if_slow);
-  GotoIf(IsPromiseHookEnabledOrDebugIsActive(), &if_slow);
+  GotoIf(IsPromiseHookEnabled(), &if_slow);
+  GotoIf(IsDebugActive(), &if_slow);
   BranchIfPromiseSpeciesLookupChainIntact(native_context, thenable_map,
                                           &if_fast, &if_slow);
 
@@ -1661,7 +1688,8 @@ TF_BUILTIN(RejectPromise, PromiseBuiltinsAssembler) {
   // the runtime handle this operation, which greatly reduces
   // the complexity here and also avoids a couple of back and
   // forth between JavaScript and C++ land.
-  GotoIf(IsPromiseHookEnabledOrDebugIsActive(), &if_runtime);
+  GotoIf(IsPromiseHookEnabled(), &if_runtime);
+  GotoIf(IsDebugActive(), &if_runtime);
 
   // 7. If promise.[[PromiseIsHandled]] is false, perform
   //    HostPromiseRejectionTracker(promise, "reject").
@@ -1708,7 +1736,8 @@ TF_BUILTIN(ResolvePromise, PromiseBuiltinsAssembler) {
   // the runtime handle this operation, which greatly reduces
   // the complexity here and also avoids a couple of back and
   // forth between JavaScript and C++ land.
-  GotoIf(IsPromiseHookEnabledOrDebugIsActive(), &if_runtime);
+  GotoIf(IsPromiseHookEnabled(), &if_runtime);
+  GotoIf(IsDebugActive(), &if_runtime);
 
   // 6. If SameValue(resolution, promise) is true, then
   // We can use pointer comparison here, since the {promise} is guaranteed
@@ -1717,29 +1746,47 @@ TF_BUILTIN(ResolvePromise, PromiseBuiltinsAssembler) {
 
   // 7. If Type(resolution) is not Object, then
   GotoIf(TaggedIsSmi(resolution), &if_fulfill);
-  Node* const result_map = LoadMap(resolution);
-  GotoIfNot(IsJSReceiverMap(result_map), &if_fulfill);
+  Node* const resolution_map = LoadMap(resolution);
+  GotoIfNot(IsJSReceiverMap(resolution_map), &if_fulfill);
 
   // We can skip the "then" lookup on {resolution} if its [[Prototype]]
   // is the (initial) Promise.prototype and the Promise#then protector
   // is intact, as that guards the lookup path for the "then" property
   // on JSPromise instances which have the (initial) %PromisePrototype%.
-  Label if_fast(this), if_slow(this, Label::kDeferred);
+  Label if_fast(this), if_receiver(this), if_slow(this, Label::kDeferred);
   Node* const native_context = LoadNativeContext(context);
-  BranchIfPromiseThenLookupChainIntact(native_context, result_map, &if_fast,
-                                       &if_slow);
+  GotoIfForceSlowPath(&if_slow);
+  GotoIf(IsPromiseThenProtectorCellInvalid(), &if_slow);
+  GotoIfNot(IsJSPromiseMap(resolution_map), &if_receiver);
+  Node* const promise_prototype =
+      LoadContextElement(native_context, Context::PROMISE_PROTOTYPE_INDEX);
+  Branch(WordEqual(LoadMapPrototype(resolution_map), promise_prototype),
+         &if_fast, &if_slow);
 
-  // Resolution is a native promise and if it's already resolved or
-  // rejected, shortcircuit the resolution procedure by directly
-  // reusing the value from the promise.
   BIND(&if_fast);
   {
+    // The {resolution} is a native Promise in this case.
     Node* const then =
         LoadContextElement(native_context, Context::PROMISE_THEN_INDEX);
     var_then.Bind(then);
     Goto(&do_enqueue);
   }
 
+  BIND(&if_receiver);
+  {
+    // We can skip the lookup of "then" if the {resolution} is a (newly
+    // created) IterResultObject, as the Promise#then() protector also
+    // ensures that the intrinsic %ObjectPrototype% doesn't contain any
+    // "then" property. This helps to avoid negative lookups on iterator
+    // results from async generators.
+    CSA_ASSERT(this, IsJSReceiverMap(resolution_map));
+    CSA_ASSERT(this, Word32BinaryNot(IsPromiseThenProtectorCellInvalid()));
+    Node* const iterator_result_map =
+        LoadContextElement(native_context, Context::ITERATOR_RESULT_MAP_INDEX);
+    Branch(WordEqual(resolution_map, iterator_result_map), &if_fulfill,
+           &if_slow);
+  }
+
   BIND(&if_slow);
   {
     // 8. Let then be Get(resolution, "then").
@@ -1801,7 +1848,7 @@ Node* PromiseBuiltinsAssembler::PerformPromiseAll(
   Node* const resolve_element_context =
       CreatePromiseAllResolveElementContext(capability, native_context);
 
-  VARIABLE(var_index, MachineRepresentation::kTagged, SmiConstant(1));
+  TVARIABLE(Smi, var_index, SmiConstant(1));
   Label loop(this, &var_index), done_loop(this),
       too_many_elements(this, Label::kDeferred),
       close_iterator(this, Label::kDeferred);
@@ -1831,14 +1878,14 @@ Node* PromiseBuiltinsAssembler::PerformPromiseAll(
                       var_exception);
 
     // Check if we reached the limit.
-    Node* const index = var_index.value();
+    TNode<Smi> const index = var_index.value();
     GotoIf(SmiEqual(index, SmiConstant(PropertyArray::HashField::kMax)),
            &too_many_elements);
 
     // Set remainingElementsCount.[[Value]] to
     //     remainingElementsCount.[[Value]] + 1.
-    Node* const remaining_elements_count = LoadContextElement(
-        resolve_element_context, kPromiseAllResolveElementRemainingSlot);
+    TNode<Smi> const remaining_elements_count = CAST(LoadContextElement(
+        resolve_element_context, kPromiseAllResolveElementRemainingSlot));
     StoreContextElementNoWriteBarrier(
         resolve_element_context, kPromiseAllResolveElementRemainingSlot,
         SmiAdd(remaining_elements_count, SmiConstant(1)));
@@ -1877,7 +1924,7 @@ Node* PromiseBuiltinsAssembler::PerformPromiseAll(
     });
 
     // Set index to index + 1.
-    var_index.Bind(SmiAdd(index, SmiConstant(1)));
+    var_index = SmiAdd(index, SmiConstant(1));
     Goto(&loop);
   }
 
@@ -1911,8 +1958,8 @@ Node* PromiseBuiltinsAssembler::PerformPromiseAll(
     // Set iteratorRecord.[[Done]] to true.
     // Set remainingElementsCount.[[Value]] to
     //    remainingElementsCount.[[Value]] - 1.
-    Node* remaining_elements_count = LoadContextElement(
-        resolve_element_context, kPromiseAllResolveElementRemainingSlot);
+    TNode<Smi> remaining_elements_count = CAST(LoadContextElement(
+        resolve_element_context, kPromiseAllResolveElementRemainingSlot));
     remaining_elements_count = SmiSub(remaining_elements_count, SmiConstant(1));
     StoreContextElementNoWriteBarrier(resolve_element_context,
                                       kPromiseAllResolveElementRemainingSlot,
@@ -1927,8 +1974,8 @@ Node* PromiseBuiltinsAssembler::PerformPromiseAll(
     Node* const values_array = LoadContextElement(
         resolve_element_context, kPromiseAllResolveElementValuesArraySlot);
     Node* const old_elements = LoadElements(values_array);
-    Node* const old_capacity = LoadFixedArrayBaseLength(old_elements);
-    Node* const new_capacity = var_index.value();
+    TNode<Smi> const old_capacity = LoadFixedArrayBaseLength(old_elements);
+    TNode<Smi> const new_capacity = var_index.value();
     GotoIf(SmiGreaterThanOrEqual(old_capacity, new_capacity), &return_promise);
     Node* const new_elements =
         AllocateFixedArray(PACKED_ELEMENTS, new_capacity, SMI_PARAMETERS,
@@ -2019,9 +2066,9 @@ TF_BUILTIN(PromiseAll, PromiseBuiltinsAssembler) {
 }
 
 TF_BUILTIN(PromiseAllResolveElementClosure, PromiseBuiltinsAssembler) {
-  Node* const value = Parameter(Descriptor::kValue);
-  Node* const context = Parameter(Descriptor::kContext);
-  Node* const function = LoadFromFrame(StandardFrameConstants::kFunctionOffset);
+  TNode<Object> value = CAST(Parameter(Descriptor::kValue));
+  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
+  TNode<JSFunction> function = CAST(Parameter(Descriptor::kJSTarget));
 
   Label already_called(this, Label::kDeferred), resolve_promise(this);
 
@@ -2033,22 +2080,22 @@ TF_BUILTIN(PromiseAllResolveElementClosure, PromiseBuiltinsAssembler) {
   GotoIf(IsNativeContext(context), &already_called);
   CSA_ASSERT(this, SmiEqual(LoadFixedArrayBaseLength(context),
                             SmiConstant(kPromiseAllResolveElementLength)));
-  Node* const native_context = LoadNativeContext(context);
+  TNode<Context> native_context = LoadNativeContext(context);
   StoreObjectField(function, JSFunction::kContextOffset, native_context);
 
   // Determine the index from the {function}.
   Label unreachable(this, Label::kDeferred);
   STATIC_ASSERT(PropertyArray::kNoHashSentinel == 0);
-  Node* const identity_hash =
+  TNode<IntPtrT> identity_hash =
       LoadJSReceiverIdentityHash(function, &unreachable);
   CSA_ASSERT(this, IntPtrGreaterThan(identity_hash, IntPtrConstant(0)));
-  Node* const index = IntPtrSub(identity_hash, IntPtrConstant(1));
+  TNode<IntPtrT> index = IntPtrSub(identity_hash, IntPtrConstant(1));
 
   // Check if we need to grow the [[ValuesArray]] to store {value} at {index}.
-  Node* const values_array =
-      LoadContextElement(context, kPromiseAllResolveElementValuesArraySlot);
-  Node* const elements = LoadElements(values_array);
-  Node* const values_length =
+  TNode<JSArray> values_array = CAST(
+      LoadContextElement(context, kPromiseAllResolveElementValuesArraySlot));
+  TNode<FixedArray> elements = CAST(LoadElements(values_array));
+  TNode<IntPtrT> values_length =
       LoadAndUntagObjectField(values_array, JSArray::kLengthOffset);
   Label if_inbounds(this), if_outofbounds(this), done(this);
   Branch(IntPtrLessThan(index, values_length), &if_inbounds, &if_outofbounds);
@@ -2056,8 +2103,8 @@ TF_BUILTIN(PromiseAllResolveElementClosure, PromiseBuiltinsAssembler) {
   BIND(&if_outofbounds);
   {
     // Check if we need to grow the backing store.
-    Node* const new_length = IntPtrAdd(index, IntPtrConstant(1));
-    Node* const elements_length =
+    TNode<IntPtrT> new_length = IntPtrAdd(index, IntPtrConstant(1));
+    TNode<IntPtrT> elements_length =
         LoadAndUntagObjectField(elements, FixedArray::kLengthOffset);
     Label if_grow(this, Label::kDeferred), if_nogrow(this);
     Branch(IntPtrLessThan(index, elements_length), &if_nogrow, &if_grow);
@@ -2065,14 +2112,14 @@ TF_BUILTIN(PromiseAllResolveElementClosure, PromiseBuiltinsAssembler) {
     BIND(&if_grow);
     {
       // We need to grow the backing store to fit the {index} as well.
-      Node* const new_elements_length =
+      TNode<IntPtrT> new_elements_length =
           IntPtrMin(CalculateNewElementsCapacity(new_length),
                     IntPtrConstant(PropertyArray::HashField::kMax + 1));
       CSA_ASSERT(this, IntPtrLessThan(index, new_elements_length));
       CSA_ASSERT(this, IntPtrLessThan(elements_length, new_elements_length));
-      Node* const new_elements = AllocateFixedArray(
-          PACKED_ELEMENTS, new_elements_length, INTPTR_PARAMETERS,
-          AllocationFlag::kAllowLargeObjectAllocation);
+      TNode<FixedArray> new_elements =
+          AllocateFixedArray(PACKED_ELEMENTS, new_elements_length,
+                             AllocationFlag::kAllowLargeObjectAllocation);
       CopyFixedArrayElements(PACKED_ELEMENTS, elements, PACKED_ELEMENTS,
                              new_elements, elements_length,
                              new_elements_length);
@@ -2105,8 +2152,8 @@ TF_BUILTIN(PromiseAllResolveElementClosure, PromiseBuiltinsAssembler) {
   }
 
   BIND(&done);
-  Node* remaining_elements_count =
-      LoadContextElement(context, kPromiseAllResolveElementRemainingSlot);
+  TNode<Smi> remaining_elements_count =
+      CAST(LoadContextElement(context, kPromiseAllResolveElementRemainingSlot));
   remaining_elements_count = SmiSub(remaining_elements_count, SmiConstant(1));
   StoreContextElement(context, kPromiseAllResolveElementRemainingSlot,
                       remaining_elements_count);
@@ -2114,9 +2161,9 @@ TF_BUILTIN(PromiseAllResolveElementClosure, PromiseBuiltinsAssembler) {
   Return(UndefinedConstant());
 
   BIND(&resolve_promise);
-  Node* const capability =
-      LoadContextElement(context, kPromiseAllResolveElementCapabilitySlot);
-  Node* const resolve =
+  TNode<PromiseCapability> capability = CAST(
+      LoadContextElement(context, kPromiseAllResolveElementCapabilitySlot));
+  TNode<Object> resolve =
       LoadObjectField(capability, PromiseCapability::kResolveOffset);
   CallJS(CodeFactory::Call(isolate(), ConvertReceiverMode::kNullOrUndefined),
          context, resolve, UndefinedConstant(), values_array);
diff --git a/deps/v8/src/builtins/builtins-promise-gen.h b/deps/v8/src/builtins/builtins-promise-gen.h
index 694cea28c06b5a..4954b383fecf17 100644
--- a/deps/v8/src/builtins/builtins-promise-gen.h
+++ b/deps/v8/src/builtins/builtins-promise-gen.h
@@ -17,11 +17,12 @@ typedef compiler::CodeAssemblerState CodeAssemblerState;
 class PromiseBuiltinsAssembler : public CodeStubAssembler {
  public:
   enum PromiseResolvingFunctionContextSlot {
-    // The promise which resolve/reject callbacks fulfill. If this is
-    // undefined, then we've already visited this callback and it
-    // should be a no-op.
+    // The promise which resolve/reject callbacks fulfill.
     kPromiseSlot = Context::MIN_CONTEXT_SLOTS,
 
+    // Whether the callback was already invoked.
+    kAlreadyResolvedSlot,
+
     // Whether to trigger a debug event or not. Used in catch
     // prediction.
     kDebugEventSlot,
@@ -113,7 +114,7 @@ class PromiseBuiltinsAssembler : public CodeStubAssembler {
   // case to mark it's done).
   Node* CreatePromiseAllResolveElementContext(Node* promise_capability,
                                               Node* native_context);
-  Node* CreatePromiseAllResolveElementFunction(Node* context, Node* index,
+  Node* CreatePromiseAllResolveElementFunction(Node* context, TNode<Smi> index,
                                                Node* native_context);
 
   Node* CreatePromiseResolvingFunctionsContext(Node* promise, Node* debug_event,
diff --git a/deps/v8/src/builtins/builtins-proxy-gen.cc b/deps/v8/src/builtins/builtins-proxy-gen.cc
index a4c208ac4e6900..1d4c6d08028207 100644
--- a/deps/v8/src/builtins/builtins-proxy-gen.cc
+++ b/deps/v8/src/builtins/builtins-proxy-gen.cc
@@ -17,7 +17,7 @@ void ProxiesCodeStubAssembler::GotoIfRevokedProxy(Node* object,
                                                   Label* if_proxy_revoked) {
   Label proxy_not_revoked(this);
   GotoIfNot(IsJSProxy(object), &proxy_not_revoked);
-  Branch(IsJSReceiver(LoadObjectField(object, JSProxy::kHandlerOffset)),
+  Branch(IsJSReceiver(CAST(LoadObjectField(object, JSProxy::kHandlerOffset))),
          &proxy_not_revoked, if_proxy_revoked);
   BIND(&proxy_not_revoked);
 }
@@ -150,7 +150,7 @@ TF_BUILTIN(ProxyConstructor, ProxiesCodeStubAssembler) {
   Node* context = Parameter(Descriptor::kContext);
 
   // 1. If NewTarget is undefined, throw a TypeError exception.
-  Node* new_target = Parameter(Descriptor::kNewTarget);
+  Node* new_target = Parameter(Descriptor::kJSNewTarget);
   Label throwtypeerror(this, Label::kDeferred), createproxy(this);
   Branch(IsUndefined(new_target), &throwtypeerror, &createproxy);
 
@@ -289,7 +289,7 @@ TF_BUILTIN(CallProxy, ProxiesCodeStubAssembler) {
   CSA_ASSERT(this, IsJSProxy(proxy));
   CSA_ASSERT(this, IsCallable(proxy));
 
-  PerformStackCheck(context);
+  PerformStackCheck(CAST(context));
 
   Label throw_proxy_handler_revoked(this, Label::kDeferred),
       trap_undefined(this);
@@ -337,7 +337,7 @@ TF_BUILTIN(CallProxy, ProxiesCodeStubAssembler) {
 TF_BUILTIN(ConstructProxy, ProxiesCodeStubAssembler) {
   Node* argc = Parameter(Descriptor::kActualArgumentsCount);
   Node* argc_ptr = ChangeInt32ToIntPtr(argc);
-  Node* proxy = Parameter(Descriptor::kFunction);
+  Node* proxy = Parameter(Descriptor::kTarget);
   Node* new_target = Parameter(Descriptor::kNewTarget);
   Node* context = Parameter(Descriptor::kContext);
 
@@ -408,6 +408,8 @@ TF_BUILTIN(ProxyHasProperty, ProxiesCodeStubAssembler) {
 
   CSA_ASSERT(this, IsJSProxy(proxy));
 
+  PerformStackCheck(CAST(context));
+
   // 1. Assert: IsPropertyKey(P) is true.
   CSA_ASSERT(this, IsName(name));
   CSA_ASSERT(this, Word32Equal(IsPrivateSymbol(name), Int32Constant(0)));
@@ -480,6 +482,7 @@ TF_BUILTIN(ProxyGetProperty, ProxiesCodeStubAssembler) {
   Node* proxy = Parameter(Descriptor::kProxy);
   Node* name = Parameter(Descriptor::kName);
   Node* receiver = Parameter(Descriptor::kReceiverValue);
+  Node* on_non_existent = Parameter(Descriptor::kOnNonExistent);
 
   CSA_ASSERT(this, IsJSProxy(proxy));
 
@@ -529,7 +532,7 @@ TF_BUILTIN(ProxyGetProperty, ProxiesCodeStubAssembler) {
     // 7.a. Return ? target.[[Get]](P, Receiver).
     // TODO(mslekova): Introduce GetPropertyWithReceiver stub
     Return(CallRuntime(Runtime::kGetPropertyWithReceiver, context, target, name,
-                       receiver));
+                       receiver, on_non_existent));
   }
 
   BIND(&throw_proxy_handler_revoked);
@@ -542,7 +545,7 @@ TF_BUILTIN(ProxySetProperty, ProxiesCodeStubAssembler) {
   Node* name = Parameter(Descriptor::kName);
   Node* value = Parameter(Descriptor::kValue);
   Node* receiver = Parameter(Descriptor::kReceiverValue);
-  Node* language_mode = Parameter(Descriptor::kLanguageMode);
+  TNode<Smi> language_mode = CAST(Parameter(Descriptor::kLanguageMode));
 
   CSA_ASSERT(this, IsJSProxy(proxy));
 
@@ -714,14 +717,23 @@ void ProxiesCodeStubAssembler::CheckGetSetTrapResult(
 
     BIND(&throw_non_configurable_data);
     {
-      ThrowTypeError(context, MessageTemplate::kProxyGetNonConfigurableData,
-                     name, var_value.value(), trap_result);
+      if (access_kind == JSProxy::kGet) {
+        ThrowTypeError(context, MessageTemplate::kProxyGetNonConfigurableData,
+                       name, var_value.value(), trap_result);
+      } else {
+        ThrowTypeError(context, MessageTemplate::kProxySetFrozenData, name);
+      }
     }
 
     BIND(&throw_non_configurable_accessor);
     {
-      ThrowTypeError(context, MessageTemplate::kProxyGetNonConfigurableAccessor,
-                     name, trap_result);
+      if (access_kind == JSProxy::kGet) {
+        ThrowTypeError(context,
+                       MessageTemplate::kProxyGetNonConfigurableAccessor, name,
+                       trap_result);
+      } else {
+        ThrowTypeError(context, MessageTemplate::kProxySetFrozenAccessor, name);
+      }
     }
   }
 }
diff --git a/deps/v8/src/builtins/builtins-reflect.cc b/deps/v8/src/builtins/builtins-reflect.cc
index bc596e0ccb0ccc..cc97caf6a9e259 100644
--- a/deps/v8/src/builtins/builtins-reflect.cc
+++ b/deps/v8/src/builtins/builtins-reflect.cc
@@ -38,12 +38,12 @@ BUILTIN(ReflectDefineProperty) {
 
   PropertyDescriptor desc;
   if (!PropertyDescriptor::ToPropertyDescriptor(isolate, attributes, &desc)) {
-    return isolate->heap()->exception();
+    return ReadOnlyRoots(isolate).exception();
   }
 
   Maybe<bool> result = JSReceiver::DefineOwnProperty(
       isolate, Handle<JSReceiver>::cast(target), name, &desc, kDontThrow);
-  MAYBE_RETURN(result, isolate->heap()->exception());
+  MAYBE_RETURN(result, ReadOnlyRoots(isolate).exception());
   return *isolate->factory()->ToBoolean(result.FromJust());
 }
 
@@ -67,7 +67,7 @@ BUILTIN(ReflectDeleteProperty) {
 
   Maybe<bool> result = JSReceiver::DeletePropertyOrElement(
       Handle<JSReceiver>::cast(target), name, LanguageMode::kSloppy);
-  MAYBE_RETURN(result, isolate->heap()->exception());
+  MAYBE_RETURN(result, ReadOnlyRoots(isolate).exception());
   return *isolate->factory()->ToBoolean(result.FromJust());
 }
 
@@ -115,8 +115,8 @@ BUILTIN(ReflectGetOwnPropertyDescriptor) {
   PropertyDescriptor desc;
   Maybe<bool> found = JSReceiver::GetOwnPropertyDescriptor(
       isolate, Handle<JSReceiver>::cast(target), name, &desc);
-  MAYBE_RETURN(found, isolate->heap()->exception());
-  if (!found.FromJust()) return isolate->heap()->undefined_value();
+  MAYBE_RETURN(found, ReadOnlyRoots(isolate).exception());
+  if (!found.FromJust()) return ReadOnlyRoots(isolate).undefined_value();
   return *desc.ToObject(isolate);
 }
 
@@ -152,7 +152,7 @@ BUILTIN(ReflectIsExtensible) {
 
   Maybe<bool> result =
       JSReceiver::IsExtensible(Handle<JSReceiver>::cast(target));
-  MAYBE_RETURN(result, isolate->heap()->exception());
+  MAYBE_RETURN(result, ReadOnlyRoots(isolate).exception());
   return *isolate->factory()->ToBoolean(result.FromJust());
 }
 
@@ -193,7 +193,7 @@ BUILTIN(ReflectPreventExtensions) {
 
   Maybe<bool> result = JSReceiver::PreventExtensions(
       Handle<JSReceiver>::cast(target), kDontThrow);
-  MAYBE_RETURN(result, isolate->heap()->exception());
+  MAYBE_RETURN(result, ReadOnlyRoots(isolate).exception());
   return *isolate->factory()->ToBoolean(result.FromJust());
 }
 
@@ -220,7 +220,7 @@ BUILTIN(ReflectSet) {
       isolate, receiver, name, Handle<JSReceiver>::cast(target));
   Maybe<bool> result = Object::SetSuperProperty(
       &it, value, LanguageMode::kSloppy, Object::MAY_BE_STORE_FROM_KEYED);
-  MAYBE_RETURN(result, isolate->heap()->exception());
+  MAYBE_RETURN(result, ReadOnlyRoots(isolate).exception());
   return *isolate->factory()->ToBoolean(result.FromJust());
 }
 
@@ -245,7 +245,7 @@ BUILTIN(ReflectSetPrototypeOf) {
 
   Maybe<bool> result = JSReceiver::SetPrototype(
       Handle<JSReceiver>::cast(target), proto, true, kDontThrow);
-  MAYBE_RETURN(result, isolate->heap()->exception());
+  MAYBE_RETURN(result, ReadOnlyRoots(isolate).exception());
   return *isolate->factory()->ToBoolean(result.FromJust());
 }
 
diff --git a/deps/v8/src/builtins/builtins-regexp-gen.cc b/deps/v8/src/builtins/builtins-regexp-gen.cc
index 2cc354cb945dc2..1cf5d4f61f47aa 100644
--- a/deps/v8/src/builtins/builtins-regexp-gen.cc
+++ b/deps/v8/src/builtins/builtins-regexp-gen.cc
@@ -35,8 +35,9 @@ Node* RegExpBuiltinsAssembler::AllocateRegExpResult(Node* context, Node* length,
   CSA_ASSERT(this, IsString(input));
 
 #ifdef DEBUG
-  Node* const max_length = SmiConstant(JSArray::kInitialMaxFastElementArray);
-  CSA_ASSERT(this, SmiLessThanOrEqual(length, max_length));
+  TNode<Smi> const max_length =
+      SmiConstant(JSArray::kInitialMaxFastElementArray);
+  CSA_ASSERT(this, SmiLessThanOrEqual(CAST(length), max_length));
 #endif  // DEBUG
 
   // Allocate the JSRegExpResult together with its elements fixed array.
@@ -113,7 +114,7 @@ TNode<Object> RegExpBuiltinsAssembler::RegExpCreate(TNode<Context> context,
                      pattern, flags);
 }
 
-Node* RegExpBuiltinsAssembler::FastLoadLastIndex(Node* regexp) {
+TNode<Object> RegExpBuiltinsAssembler::FastLoadLastIndex(Node* regexp) {
   // Load the in-object field.
   static const int field_offset =
       JSRegExp::kSize + JSRegExp::kLastIndexFieldIndex * kPointerSize;
@@ -169,7 +170,7 @@ Node* RegExpBuiltinsAssembler::ConstructNewResultFromMatchInfo(
 
   TNode<IntPtrT> num_indices = SmiUntag(CAST(LoadFixedArrayElement(
       match_info, RegExpMatchInfo::kNumberOfCapturesIndex)));
-  Node* const num_results = SmiTag(WordShr(num_indices, 1));
+  TNode<Smi> const num_results = SmiTag(WordShr(num_indices, 1));
   Node* const start =
       LoadFixedArrayElement(match_info, RegExpMatchInfo::kFirstCaptureIndex);
   Node* const end = LoadFixedArrayElement(
@@ -178,7 +179,8 @@ Node* RegExpBuiltinsAssembler::ConstructNewResultFromMatchInfo(
   // Calculate the substring of the first match before creating the result array
   // to avoid an unnecessary write barrier storing the first result.
 
-  TNode<String> const first = SubString(string, SmiUntag(start), SmiUntag(end));
+  TNode<String> first =
+      CAST(CallBuiltin(Builtins::kSubString, context, string, start, end));
 
   Node* const result =
       AllocateRegExpResult(context, num_results, start, string);
@@ -206,7 +208,8 @@ Node* RegExpBuiltinsAssembler::ConstructNewResultFromMatchInfo(
   {
     Node* const from_cursor = var_from_cursor.value();
     Node* const to_cursor = var_to_cursor.value();
-    Node* const start = LoadFixedArrayElement(match_info, from_cursor);
+    TNode<Smi> const start =
+        CAST(LoadFixedArrayElement(match_info, from_cursor));
 
     Label next_iter(this);
     GotoIf(SmiEqual(start, SmiConstant(-1)), &next_iter);
@@ -215,7 +218,7 @@ Node* RegExpBuiltinsAssembler::ConstructNewResultFromMatchInfo(
     Node* const end = LoadFixedArrayElement(match_info, from_cursor_plus1);
 
     TNode<String> const capture =
-        SubString(string, SmiUntag(start), SmiUntag(end));
+        CAST(CallBuiltin(Builtins::kSubString, context, string, start, end));
     StoreFixedArrayElement(result_elements, to_cursor, capture);
     Goto(&next_iter);
 
@@ -238,14 +241,15 @@ Node* RegExpBuiltinsAssembler::ConstructNewResultFromMatchInfo(
     // not have any named captures to minimize performance impact.
 
     Node* const data = LoadObjectField(regexp, JSRegExp::kDataOffset);
-    CSA_ASSERT(this, SmiEqual(LoadFixedArrayElement(data, JSRegExp::kTagIndex),
-                              SmiConstant(JSRegExp::IRREGEXP)));
+    CSA_ASSERT(this,
+               SmiEqual(CAST(LoadFixedArrayElement(data, JSRegExp::kTagIndex)),
+                        SmiConstant(JSRegExp::IRREGEXP)));
 
     // The names fixed array associates names at even indices with a capture
     // index at odd indices.
-    Node* const names =
+    TNode<Object> const maybe_names =
         LoadFixedArrayElement(data, JSRegExp::kIrregexpCaptureNameMapIndex);
-    GotoIf(SmiEqual(names, SmiConstant(0)), &out);
+    GotoIf(WordEqual(maybe_names, SmiConstant(0)), &out);
 
     // Allocate a new object to store the named capture properties.
     // TODO(jgruber): Could be optimized by adding the object map to the heap
@@ -262,8 +266,8 @@ Node* RegExpBuiltinsAssembler::ConstructNewResultFromMatchInfo(
 
     // One or more named captures exist, add a property for each one.
 
-    CSA_ASSERT(this, HasInstanceType(names, FIXED_ARRAY_TYPE));
-    Node* const names_length = LoadAndUntagFixedArrayBaseLength(names);
+    TNode<FixedArray> names = CAST(maybe_names);
+    TNode<IntPtrT> const names_length = LoadAndUntagFixedArrayBaseLength(names);
     CSA_ASSERT(this, IntPtrGreaterThan(names_length, IntPtrConstant(0)));
 
     VARIABLE(var_i, MachineType::PointerRepresentation());
@@ -403,9 +407,8 @@ Node* RegExpBuiltinsAssembler::RegExpExecInternal(Node* const context,
 
     // Check (number_of_captures + 1) * 2 <= offsets vector size
     // Or              number_of_captures <= offsets vector size / 2 - 1
-    Node* const capture_count =
-        LoadFixedArrayElement(data, JSRegExp::kIrregexpCaptureCountIndex);
-    CSA_ASSERT(this, TaggedIsSmi(capture_count));
+    TNode<Smi> const capture_count =
+        CAST(LoadFixedArrayElement(data, JSRegExp::kIrregexpCaptureCountIndex));
 
     STATIC_ASSERT(Isolate::kJSRegexpStaticOffsetsVectorSize >= 2);
     GotoIf(SmiAbove(
@@ -470,7 +473,7 @@ Node* RegExpBuiltinsAssembler::RegExpExecInternal(Node* const context,
   Node* const code = var_code.value();
   CSA_ASSERT_BRANCH(this, [=](Label* ok, Label* not_ok) {
     GotoIfNot(TaggedIsSmi(code), ok);
-    Branch(SmiEqual(code, SmiConstant(JSRegExp::kUninitializedValue)), ok,
+    Branch(SmiEqual(CAST(code), SmiConstant(JSRegExp::kUninitializedValue)), ok,
            not_ok);
   });
   GotoIf(TaggedIsSmi(code), &runtime);
@@ -567,13 +570,13 @@ Node* RegExpBuiltinsAssembler::RegExpExecInternal(Node* const context,
     // Check that the last match info has space for the capture registers and
     // the additional information. Ensure no overflow in add.
     STATIC_ASSERT(FixedArray::kMaxLength < kMaxInt - FixedArray::kLengthOffset);
-    Node* const available_slots =
+    TNode<Smi> const available_slots =
         SmiSub(LoadFixedArrayBaseLength(match_info),
                SmiConstant(RegExpMatchInfo::kLastMatchOverhead));
-    Node* const capture_count =
-        LoadFixedArrayElement(data, JSRegExp::kIrregexpCaptureCountIndex);
+    TNode<Smi> const capture_count =
+        CAST(LoadFixedArrayElement(data, JSRegExp::kIrregexpCaptureCountIndex));
     // Calculate number of register_count = (capture_count + 1) * 2.
-    Node* const register_count =
+    TNode<Smi> const register_count =
         SmiShl(SmiAdd(capture_count, SmiConstant(1)), 1);
     GotoIf(SmiGreaterThan(register_count, available_slots), &runtime);
 
@@ -624,8 +627,9 @@ Node* RegExpBuiltinsAssembler::RegExpExecInternal(Node* const context,
   {
 // A stack overflow was detected in RegExp code.
 #ifdef DEBUG
-    Node* const pending_exception_address = ExternalConstant(ExternalReference(
-        IsolateAddressId::kPendingExceptionAddress, isolate()));
+    Node* const pending_exception_address =
+        ExternalConstant(ExternalReference::Create(
+            IsolateAddressId::kPendingExceptionAddress, isolate()));
     CSA_ASSERT(this, IsTheHole(Load(MachineType::AnyTagged(),
                                     pending_exception_address)));
 #endif  // DEBUG
@@ -669,7 +673,7 @@ Node* RegExpBuiltinsAssembler::RegExpPrototypeExecBodyWithoutResult(
   Node* const smi_zero = SmiConstant(0);
 
   if (is_fastpath) {
-    CSA_ASSERT(this, IsFastRegExpNoPrototype(context, regexp));
+    CSA_ASSERT(this, HasInstanceType(regexp, JS_REGEXP_TYPE));
   } else {
     ThrowIfNotInstanceType(context, regexp, JS_REGEXP_TYPE,
                            "RegExp.prototype.exec");
@@ -726,7 +730,7 @@ Node* RegExpBuiltinsAssembler::RegExpPrototypeExecBodyWithoutResult(
       Label if_isoob(this, Label::kDeferred);
       GotoIfNot(TaggedIsSmi(lastindex), &if_isoob);
       TNode<Smi> const string_length = LoadStringLengthAsSmi(string);
-      GotoIfNot(SmiLessThanOrEqual(lastindex, string_length), &if_isoob);
+      GotoIfNot(SmiLessThanOrEqual(CAST(lastindex), string_length), &if_isoob);
       Goto(&run_exec);
 
       BIND(&if_isoob);
@@ -872,6 +876,51 @@ Node* RegExpBuiltinsAssembler::IsFastRegExpNoPrototype(Node* const context,
   return var_result.value();
 }
 
+// We also return true if exec is undefined (and hence per spec)
+// the original {exec} will be used.
+TNode<BoolT> RegExpBuiltinsAssembler::IsFastRegExpWithOriginalExec(
+    TNode<Context> context, TNode<JSRegExp> object) {
+  CSA_ASSERT(this, TaggedIsNotSmi(object));
+  Label out(this);
+  Label check_last_index(this);
+  TVARIABLE(BoolT, var_result);
+
+#ifdef V8_ENABLE_FORCE_SLOW_PATH
+  var_result = BoolConstant(0);
+  GotoIfForceSlowPath(&out);
+#endif
+
+  TNode<BoolT> is_regexp = HasInstanceType(object, JS_REGEXP_TYPE);
+
+  var_result = is_regexp;
+  GotoIfNot(is_regexp, &out);
+
+  TNode<Context> native_context = LoadNativeContext(context);
+  TNode<Object> original_exec =
+      LoadContextElement(native_context, Context::REGEXP_EXEC_FUNCTION_INDEX);
+
+  TNode<Object> regexp_exec =
+      GetProperty(context, object, isolate()->factory()->exec_string());
+
+  TNode<BoolT> has_initialexec = WordEqual(regexp_exec, original_exec);
+  var_result = has_initialexec;
+  GotoIf(has_initialexec, &check_last_index);
+  TNode<BoolT> is_undefined = IsUndefined(regexp_exec);
+  var_result = is_undefined;
+  GotoIfNot(is_undefined, &out);
+  Goto(&check_last_index);
+
+  BIND(&check_last_index);
+  // The smi check is required to omit ToLength(lastIndex) calls with possible
+  // user-code execution on the fast path.
+  TNode<Object> last_index = FastLoadLastIndex(object);
+  var_result = TaggedIsPositiveSmi(last_index);
+  Goto(&out);
+
+  BIND(&out);
+  return var_result.value();
+}
+
 Node* RegExpBuiltinsAssembler::IsFastRegExpNoPrototype(Node* const context,
                                                        Node* const object) {
   CSA_ASSERT(this, TaggedIsNotSmi(object));
@@ -905,7 +954,7 @@ void RegExpBuiltinsAssembler::BranchIfFastRegExp(Node* const context,
 
   Node* const initial_proto_initial_map =
       LoadContextElement(native_context, Context::REGEXP_PROTOTYPE_MAP_INDEX);
-  Node* const proto_map = LoadMap(CAST(LoadMapPrototype(map)));
+  Node* const proto_map = LoadMap(LoadMapPrototype(map));
   Node* const proto_has_initialmap =
       WordEqual(proto_map, initial_proto_initial_map);
 
@@ -926,19 +975,19 @@ void RegExpBuiltinsAssembler::BranchIfFastRegExp(Node* const context,
                      if_ismodified);
 }
 
-Node* RegExpBuiltinsAssembler::IsFastRegExp(Node* const context,
-                                            Node* const object) {
+TNode<BoolT> RegExpBuiltinsAssembler::IsFastRegExp(SloppyTNode<Context> context,
+                                                   SloppyTNode<Object> object) {
   Label yup(this), nope(this), out(this);
-  VARIABLE(var_result, MachineRepresentation::kWord32);
+  TVARIABLE(BoolT, var_result);
 
   BranchIfFastRegExp(context, object, &yup, &nope);
 
   BIND(&yup);
-  var_result.Bind(Int32Constant(1));
+  var_result = Int32TrueConstant();
   Goto(&out);
 
   BIND(&nope);
-  var_result.Bind(Int32Constant(0));
+  var_result = Int32FalseConstant();
   Goto(&out);
 
   BIND(&out);
@@ -986,8 +1035,9 @@ TF_BUILTIN(RegExpExecAtom, RegExpBuiltinsAssembler) {
 
   Node* const data = LoadObjectField(regexp, JSRegExp::kDataOffset);
   CSA_ASSERT(this, IsFixedArray(data));
-  CSA_ASSERT(this, SmiEqual(LoadFixedArrayElement(data, JSRegExp::kTagIndex),
-                            SmiConstant(JSRegExp::ATOM)));
+  CSA_ASSERT(this,
+             SmiEqual(CAST(LoadFixedArrayElement(data, JSRegExp::kTagIndex)),
+                      SmiConstant(JSRegExp::ATOM)));
 
   // Callers ensure that last_index is in-bounds.
   CSA_ASSERT(this,
@@ -998,10 +1048,9 @@ TF_BUILTIN(RegExpExecAtom, RegExpBuiltinsAssembler) {
       LoadFixedArrayElement(data, JSRegExp::kAtomPatternIndex);
   CSA_ASSERT(this, IsString(needle_string));
 
-  Node* const match_from =
-      CallBuiltin(Builtins::kStringIndexOf, context, subject_string,
-                  needle_string, last_index);
-  CSA_ASSERT(this, TaggedIsSmi(match_from));
+  TNode<Smi> const match_from =
+      CAST(CallBuiltin(Builtins::kStringIndexOf, context, subject_string,
+                       needle_string, last_index));
 
   Label if_failure(this), if_success(this);
   Branch(SmiEqual(match_from, SmiConstant(-1)), &if_failure, &if_success);
@@ -1015,7 +1064,7 @@ TF_BUILTIN(RegExpExecAtom, RegExpBuiltinsAssembler) {
     const int kNumRegisters = 2;
     STATIC_ASSERT(RegExpMatchInfo::kInitialCaptureIndices >= kNumRegisters);
 
-    Node* const match_to =
+    TNode<Smi> const match_to =
         SmiAdd(match_from, LoadStringLengthAsSmi(needle_string));
 
     StoreFixedArrayElement(match_info, RegExpMatchInfo::kNumberOfCapturesIndex,
@@ -1036,6 +1085,19 @@ TF_BUILTIN(RegExpExecAtom, RegExpBuiltinsAssembler) {
   Return(NullConstant());
 }
 
+TF_BUILTIN(RegExpExecInternal, RegExpBuiltinsAssembler) {
+  TNode<JSRegExp> regexp = CAST(Parameter(Descriptor::kRegExp));
+  TNode<String> string = CAST(Parameter(Descriptor::kString));
+  TNode<Number> last_index = CAST(Parameter(Descriptor::kLastIndex));
+  TNode<FixedArray> match_info = CAST(Parameter(Descriptor::kMatchInfo));
+  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
+
+  CSA_ASSERT(this, IsNumberNormalized(last_index));
+  CSA_ASSERT(this, IsNumberPositive(last_index));
+
+  Return(RegExpExecInternal(context, regexp, string, last_index, match_info));
+}
+
 // ES#sec-regexp.prototype.exec
 // RegExp.prototype.exec ( string )
 TF_BUILTIN(RegExpPrototypeExec, RegExpBuiltinsAssembler) {
@@ -1250,7 +1312,7 @@ TF_BUILTIN(RegExpPrototypeFlagsGetter, RegExpBuiltinsAssembler) {
 TF_BUILTIN(RegExpConstructor, RegExpBuiltinsAssembler) {
   Node* const pattern = Parameter(Descriptor::kPattern);
   Node* const flags = Parameter(Descriptor::kFlags);
-  Node* const new_target = Parameter(Descriptor::kNewTarget);
+  Node* const new_target = Parameter(Descriptor::kJSNewTarget);
   Node* const context = Parameter(Descriptor::kContext);
 
   Isolate* isolate = this->isolate();
@@ -1475,8 +1537,9 @@ TF_BUILTIN(RegExpPrototypeSourceGetter, RegExpBuiltinsAssembler) {
 // Fast-path implementation for flag checks on an unmodified JSRegExp instance.
 Node* RegExpBuiltinsAssembler::FastFlagGetter(Node* const regexp,
                                               JSRegExp::Flag flag) {
-  Node* const flags = LoadObjectField(regexp, JSRegExp::kFlagsOffset);
-  Node* const mask = SmiConstant(flag);
+  TNode<Smi> const flags =
+      CAST(LoadObjectField(regexp, JSRegExp::kFlagsOffset));
+  TNode<Smi> const mask = SmiConstant(flag);
   return SmiToInt32(SmiAnd(flags, mask));
 }
 
@@ -1737,6 +1800,20 @@ TF_BUILTIN(RegExpPrototypeTest, RegExpBuiltinsAssembler) {
   }
 }
 
+TF_BUILTIN(RegExpPrototypeTestFast, RegExpBuiltinsAssembler) {
+  TNode<JSRegExp> const regexp = CAST(Parameter(Descriptor::kReceiver));
+  TNode<String> const string = CAST(Parameter(Descriptor::kString));
+  TNode<Context> const context = CAST(Parameter(Descriptor::kContext));
+  Label if_didnotmatch(this);
+  CSA_ASSERT(this, IsFastRegExpWithOriginalExec(context, regexp));
+  RegExpPrototypeExecBodyWithoutResult(context, regexp, string, &if_didnotmatch,
+                                       true);
+  Return(TrueConstant());
+
+  BIND(&if_didnotmatch);
+  Return(FalseConstant());
+}
+
 Node* RegExpBuiltinsAssembler::AdvanceStringIndex(Node* const string,
                                                   Node* const index,
                                                   Node* const is_unicode,
@@ -1855,8 +1932,8 @@ void RegExpBuiltinsAssembler::RegExpPrototypeMatchBody(Node* const context,
         Node* const match_to = LoadFixedArrayElement(
             match_indices, RegExpMatchInfo::kFirstCaptureIndex + 1);
 
-        var_match.Bind(
-            SubString(string, SmiUntag(match_from), SmiUntag(match_to)));
+        var_match.Bind(CallBuiltin(Builtins::kSubString, context, string,
+                                   match_from, match_to));
         Goto(&if_didmatch);
       } else {
         DCHECK(!is_fastpath);
@@ -1866,8 +1943,8 @@ void RegExpBuiltinsAssembler::RegExpPrototypeMatchBody(Node* const context,
         Branch(IsNull(result), &if_didnotmatch, &load_match);
 
         BIND(&load_match);
-        Node* const match = GetProperty(context, result, smi_zero);
-        var_match.Bind(ToString_Inline(context, match));
+        var_match.Bind(
+            ToString_Inline(context, GetProperty(context, result, smi_zero)));
         Goto(&if_didmatch);
       }
 
@@ -1955,20 +2032,48 @@ TF_BUILTIN(RegExpPrototypeMatch, RegExpBuiltinsAssembler) {
 
 TNode<Object> RegExpBuiltinsAssembler::MatchAllIterator(
     TNode<Context> context, TNode<Context> native_context,
-    TNode<Object> maybe_regexp, TNode<Object> maybe_string,
-    char const* method_name) {
-  Label create_iterator(this), if_regexp(this), if_not_regexp(this),
-      throw_type_error(this, Label::kDeferred);
+    TNode<Object> maybe_regexp, TNode<String> string,
+    TNode<BoolT> is_fast_regexp, char const* method_name) {
+  Label create_iterator(this), if_fast_regexp(this),
+      if_slow_regexp(this, Label::kDeferred), if_not_regexp(this);
 
   // 1. Let S be ? ToString(O).
-  TNode<String> string = ToString_Inline(context, maybe_string);
+  // Handled by the caller of MatchAllIterator.
+  CSA_ASSERT(this, IsString(string));
+
   TVARIABLE(Object, var_matcher);
   TVARIABLE(Int32T, var_global);
   TVARIABLE(Int32T, var_unicode);
 
   // 2. If ? IsRegExp(R) is true, then
-  Branch(IsRegExp(context, maybe_regexp), &if_regexp, &if_not_regexp);
-  BIND(&if_regexp);
+  GotoIf(is_fast_regexp, &if_fast_regexp);
+  Branch(IsRegExp(context, maybe_regexp), &if_slow_regexp, &if_not_regexp);
+  BIND(&if_fast_regexp);
+  {
+    CSA_ASSERT(this, IsFastRegExp(context, maybe_regexp));
+    TNode<JSRegExp> fast_regexp = CAST(maybe_regexp);
+    TNode<Object> source =
+        LoadObjectField(fast_regexp, JSRegExp::kSourceOffset);
+    TNode<String> flags = CAST(FlagsGetter(context, fast_regexp, true));
+
+    // c. Let matcher be ? Construct(C, « R, flags »).
+    var_matcher = RegExpCreate(context, native_context, source, flags);
+    CSA_ASSERT(this, IsFastRegExp(context, var_matcher.value()));
+
+    // d. Let global be ? ToBoolean(? Get(matcher, "global")).
+    var_global = UncheckedCast<Int32T>(
+        FastFlagGetter(var_matcher.value(), JSRegExp::kGlobal));
+
+    // e. Let fullUnicode be ? ToBoolean(? Get(matcher, "unicode").
+    var_unicode = UncheckedCast<Int32T>(
+        FastFlagGetter(var_matcher.value(), JSRegExp::kUnicode));
+
+    // f. Let lastIndex be ? ToLength(? Get(R, "lastIndex")).
+    // g. Perform ? Set(matcher, "lastIndex", lastIndex, true).
+    FastStoreLastIndex(var_matcher.value(), FastLoadLastIndex(fast_regexp));
+    Goto(&create_iterator);
+  }
+  BIND(&if_slow_regexp);
   {
     // a. Let C be ? SpeciesConstructor(R, %RegExp%).
     TNode<Object> regexp_fun =
@@ -1977,10 +2082,9 @@ TNode<Object> RegExpBuiltinsAssembler::MatchAllIterator(
         SpeciesConstructor(native_context, maybe_regexp, regexp_fun);
 
     // b. Let flags be ? ToString(? Get(R, "flags")).
-    // TODO(pwong): Add fast path to avoid property lookup.
     TNode<Object> flags = GetProperty(context, maybe_regexp,
                                       isolate()->factory()->flags_string());
-    TNode<Object> flags_string = ToString_Inline(context, flags);
+    TNode<String> flags_string = ToString_Inline(context, flags);
 
     // c. Let matcher be ? Construct(C, « R, flags »).
     var_matcher =
@@ -1988,22 +2092,18 @@ TNode<Object> RegExpBuiltinsAssembler::MatchAllIterator(
                          species_constructor, maybe_regexp, flags_string));
 
     // d. Let global be ? ToBoolean(? Get(matcher, "global")).
-    // TODO(pwong): Add fast path for loading flags.
     var_global = UncheckedCast<Int32T>(
         SlowFlagGetter(context, var_matcher.value(), JSRegExp::kGlobal));
 
     // e. Let fullUnicode be ? ToBoolean(? Get(matcher, "unicode").
-    // TODO(pwong): Add fast path for loading flags.
     var_unicode = UncheckedCast<Int32T>(
         SlowFlagGetter(context, var_matcher.value(), JSRegExp::kUnicode));
 
     // f. Let lastIndex be ? ToLength(? Get(R, "lastIndex")).
-    // TODO(pwong): Add fast path for loading last index.
     TNode<Number> last_index = UncheckedCast<Number>(
         ToLength_Inline(context, SlowLoadLastIndex(context, maybe_regexp)));
 
     // g. Perform ? Set(matcher, "lastIndex", lastIndex, true).
-    // TODO(pwong): Add fast path for storing last index.
     SlowStoreLastIndex(context, var_matcher.value(), last_index);
 
     Goto(&create_iterator);
@@ -2016,28 +2116,22 @@ TNode<Object> RegExpBuiltinsAssembler::MatchAllIterator(
     var_matcher = RegExpCreate(context, native_context, maybe_regexp,
                                StringConstant("g"));
 
-    // c. If ? IsRegExp(matcher) is not true, throw a TypeError exception.
-    GotoIfNot(IsRegExp(context, var_matcher.value()), &throw_type_error);
-
-    // d. Let global be true.
+    // c. Let global be true.
     var_global = Int32Constant(1);
 
-    // e. Let fullUnicode be false.
+    // d. Let fullUnicode be false.
     var_unicode = Int32Constant(0);
 
-    // f. If ? Get(matcher, "lastIndex") is not 0, throw a TypeError exception.
+#ifdef DEBUG
+    // Assert: ! Get(matcher, "lastIndex") is 0.
     TNode<Object> last_index =
         CAST(LoadLastIndex(context, var_matcher.value(), false));
-    Branch(SmiEqual(SmiConstant(0), last_index), &create_iterator,
-           &throw_type_error);
-  }
-  BIND(&throw_type_error);
-  {
-    ThrowTypeError(context, MessageTemplate::kIncompatibleMethodReceiver,
-                   StringConstant(method_name), maybe_regexp);
+    CSA_ASSERT(this, WordEqual(SmiConstant(0), last_index));
+#endif  // DEBUG
+
+    Goto(&create_iterator);
   }
   // 4. Return ! CreateRegExpStringIterator(matcher, S, global, fullUnicode).
-  // CreateRegExpStringIterator ( R, S, global, fullUnicode )
   BIND(&create_iterator);
   {
     TNode<Map> map = CAST(LoadContextElement(
@@ -2106,8 +2200,9 @@ TF_BUILTIN(RegExpPrototypeMatchAll, RegExpBuiltinsAssembler) {
                        "RegExp.prototype.@@matchAll");
 
   // 3. Return ? MatchAllIterator(R, string).
-  Return(MatchAllIterator(context, native_context, receiver, string,
-                          "RegExp.prototype.@@matchAll"));
+  Return(MatchAllIterator(
+      context, native_context, receiver, ToString_Inline(context, string),
+      IsFastRegExp(context, receiver), "RegExp.prototype.@@matchAll"));
 }
 
 // Helper that skips a few initial checks. and assumes...
@@ -2267,10 +2362,9 @@ TF_BUILTIN(RegExpSearchFast, RegExpBuiltinsAssembler) {
 void RegExpBuiltinsAssembler::RegExpPrototypeSplitBody(Node* const context,
                                                        Node* const regexp,
                                                        TNode<String> string,
-                                                       Node* const limit) {
+                                                       TNode<Smi> const limit) {
   CSA_ASSERT(this, IsFastRegExp(context, regexp));
   CSA_ASSERT(this, Word32BinaryNot(FastFlagGetter(regexp, JSRegExp::kSticky)));
-  CSA_ASSERT(this, TaggedIsSmi(limit));
 
   TNode<Smi> const smi_zero = SmiConstant(0);
   TNode<IntPtrT> const int_zero = IntPtrConstant(0);
@@ -2305,8 +2399,9 @@ void RegExpBuiltinsAssembler::RegExpPrototypeSplitBody(Node* const context,
       Node* const last_match_info = LoadContextElement(
           native_context, Context::REGEXP_LAST_MATCH_INFO_INDEX);
 
-      Node* const match_indices = RegExpExecInternal(context, regexp, string,
-                                                     smi_zero, last_match_info);
+      Node* const match_indices =
+          CallBuiltin(Builtins::kRegExpExecInternal, context, regexp, string,
+                      smi_zero, last_match_info);
 
       Label return_singleton_array(this);
       Branch(IsNull(match_indices), &return_singleton_array,
@@ -2333,11 +2428,8 @@ void RegExpBuiltinsAssembler::RegExpPrototypeSplitBody(Node* const context,
 
   GrowableFixedArray array(state());
 
-  VARIABLE(var_last_matched_until, MachineRepresentation::kTagged);
-  VARIABLE(var_next_search_from, MachineRepresentation::kTagged);
-
-  var_last_matched_until.Bind(smi_zero);
-  var_next_search_from.Bind(smi_zero);
+  TVARIABLE(Smi, var_last_matched_until, smi_zero);
+  TVARIABLE(Smi, var_next_search_from, smi_zero);
 
   Variable* vars[] = {array.var_array(), array.var_length(),
                       array.var_capacity(), &var_last_matched_until,
@@ -2348,11 +2440,8 @@ void RegExpBuiltinsAssembler::RegExpPrototypeSplitBody(Node* const context,
 
   BIND(&loop);
   {
-    Node* const next_search_from = var_next_search_from.value();
-    Node* const last_matched_until = var_last_matched_until.value();
-
-    CSA_ASSERT(this, TaggedIsSmi(next_search_from));
-    CSA_ASSERT(this, TaggedIsSmi(last_matched_until));
+    TNode<Smi> const next_search_from = var_next_search_from.value();
+    TNode<Smi> const last_matched_until = var_last_matched_until.value();
 
     // We're done if we've reached the end of the string.
     {
@@ -2367,8 +2456,9 @@ void RegExpBuiltinsAssembler::RegExpPrototypeSplitBody(Node* const context,
     Node* const last_match_info = LoadContextElement(
         native_context, Context::REGEXP_LAST_MATCH_INFO_INDEX);
 
-    Node* const match_indices = RegExpExecInternal(
-        context, regexp, string, next_search_from, last_match_info);
+    Node* const match_indices =
+        CallBuiltin(Builtins::kRegExpExecInternal, context, regexp, string,
+                    next_search_from, last_match_info);
 
     // We're done if no match was found.
     {
@@ -2377,8 +2467,8 @@ void RegExpBuiltinsAssembler::RegExpPrototypeSplitBody(Node* const context,
       BIND(&next);
     }
 
-    Node* const match_from = LoadFixedArrayElement(
-        match_indices, RegExpMatchInfo::kFirstCaptureIndex);
+    TNode<Smi> const match_from = CAST(LoadFixedArrayElement(
+        match_indices, RegExpMatchInfo::kFirstCaptureIndex));
 
     // We're done if the match starts beyond the string.
     {
@@ -2387,8 +2477,8 @@ void RegExpBuiltinsAssembler::RegExpPrototypeSplitBody(Node* const context,
       BIND(&next);
     }
 
-    Node* const match_to = LoadFixedArrayElement(
-        match_indices, RegExpMatchInfo::kFirstCaptureIndex + 1);
+    TNode<Smi> const match_to = CAST(LoadFixedArrayElement(
+        match_indices, RegExpMatchInfo::kFirstCaptureIndex + 1));
 
     // Advance index and continue if the match is empty.
     {
@@ -2400,7 +2490,7 @@ void RegExpBuiltinsAssembler::RegExpPrototypeSplitBody(Node* const context,
       Node* const is_unicode = FastFlagGetter(regexp, JSRegExp::kUnicode);
       Node* const new_next_search_from =
           AdvanceStringIndex(string, next_search_from, is_unicode, true);
-      var_next_search_from.Bind(new_next_search_from);
+      var_next_search_from = CAST(new_next_search_from);
       Goto(&loop);
 
       BIND(&next);
@@ -2408,9 +2498,9 @@ void RegExpBuiltinsAssembler::RegExpPrototypeSplitBody(Node* const context,
 
     // A valid match was found, add the new substring to the array.
     {
-      Node* const from = last_matched_until;
-      Node* const to = match_from;
-      array.Push(SubString(string, SmiUntag(from), SmiUntag(to)));
+      TNode<Smi> const from = last_matched_until;
+      TNode<Smi> const to = match_from;
+      array.Push(CallBuiltin(Builtins::kSubString, context, string, from, to));
       GotoIf(WordEqual(array.length(), int_limit), &out);
     }
 
@@ -2436,9 +2526,9 @@ void RegExpBuiltinsAssembler::RegExpPrototypeSplitBody(Node* const context,
         Node* const from = LoadFixedArrayElement(
             match_indices, reg,
             RegExpMatchInfo::kFirstCaptureIndex * kPointerSize, mode);
-        Node* const to = LoadFixedArrayElement(
+        TNode<Smi> const to = CAST(LoadFixedArrayElement(
             match_indices, reg,
-            (RegExpMatchInfo::kFirstCaptureIndex + 1) * kPointerSize, mode);
+            (RegExpMatchInfo::kFirstCaptureIndex + 1) * kPointerSize, mode));
 
         Label select_capture(this), select_undefined(this), store_value(this);
         VARIABLE(var_value, MachineRepresentation::kTagged);
@@ -2447,7 +2537,8 @@ void RegExpBuiltinsAssembler::RegExpPrototypeSplitBody(Node* const context,
 
         BIND(&select_capture);
         {
-          var_value.Bind(SubString(string, SmiUntag(from), SmiUntag(to)));
+          var_value.Bind(
+              CallBuiltin(Builtins::kSubString, context, string, from, to));
           Goto(&store_value);
         }
 
@@ -2473,8 +2564,8 @@ void RegExpBuiltinsAssembler::RegExpPrototypeSplitBody(Node* const context,
       BIND(&nested_loop_out);
     }
 
-    var_last_matched_until.Bind(match_to);
-    var_next_search_from.Bind(match_to);
+    var_last_matched_until = match_to;
+    var_next_search_from = match_to;
     Goto(&loop);
   }
 
@@ -2482,7 +2573,7 @@ void RegExpBuiltinsAssembler::RegExpPrototypeSplitBody(Node* const context,
   {
     Node* const from = var_last_matched_until.value();
     Node* const to = string_length;
-    array.Push(SubString(string, SmiUntag(from), SmiUntag(to)));
+    array.Push(CallBuiltin(Builtins::kSubString, context, string, from, to));
     Goto(&out);
   }
 
@@ -2550,7 +2641,7 @@ TF_BUILTIN(RegExpSplit, RegExpBuiltinsAssembler) {
 
   // We're good to go on the fast path, which is inlined here.
 
-  RegExpPrototypeSplitBody(context, regexp, string, var_limit.value());
+  RegExpPrototypeSplitBody(context, regexp, string, CAST(var_limit.value()));
 
   BIND(&runtime);
   Return(CallRuntime(Runtime::kRegExpSplit, context, regexp, string,
@@ -2564,13 +2655,13 @@ TF_BUILTIN(RegExpPrototypeSplit, RegExpBuiltinsAssembler) {
   const int kLimitArg = 1;
 
   Node* argc =
-      ChangeInt32ToIntPtr(Parameter(BuiltinDescriptor::kArgumentsCount));
+      ChangeInt32ToIntPtr(Parameter(Descriptor::kJSActualArgumentsCount));
   CodeStubArguments args(this, argc);
 
   Node* const maybe_receiver = args.GetReceiver();
   Node* const maybe_string = args.GetOptionalArgumentValue(kStringArg);
   Node* const maybe_limit = args.GetOptionalArgumentValue(kLimitArg);
-  Node* const context = Parameter(BuiltinDescriptor::kContext);
+  Node* const context = Parameter(Descriptor::kContext);
 
   // Ensure {maybe_receiver} is a JSReceiver.
   ThrowIfNotJSReceiver(context, maybe_receiver,
@@ -2652,8 +2743,8 @@ Node* RegExpBuiltinsAssembler::ReplaceGlobalCallableFastPath(
   Node* const res_elems = LoadElements(res);
   CSA_ASSERT(this, HasInstanceType(res_elems, FIXED_ARRAY_TYPE));
 
-  Node* const num_capture_registers = LoadFixedArrayElement(
-      last_match_info, RegExpMatchInfo::kNumberOfCapturesIndex);
+  TNode<Smi> const num_capture_registers = CAST(LoadFixedArrayElement(
+      last_match_info, RegExpMatchInfo::kNumberOfCapturesIndex));
 
   Label if_hasexplicitcaptures(this), if_noexplicitcaptures(this),
       create_result(this);
@@ -2688,14 +2779,15 @@ Node* RegExpBuiltinsAssembler::ReplaceGlobalCallableFastPath(
 
       BIND(&if_issmi);
       {
+        TNode<Smi> smi_elem = CAST(elem);
         // Integers represent slices of the original string.
         Label if_isnegativeorzero(this), if_ispositive(this);
-        BranchIfSmiLessThanOrEqual(elem, smi_zero, &if_isnegativeorzero,
+        BranchIfSmiLessThanOrEqual(smi_elem, smi_zero, &if_isnegativeorzero,
                                    &if_ispositive);
 
         BIND(&if_ispositive);
         {
-          TNode<IntPtrT> int_elem = SmiUntag(elem);
+          TNode<IntPtrT> int_elem = SmiUntag(smi_elem);
           TNode<IntPtrT> new_match_start =
               Signed(IntPtrAdd(WordShr(int_elem, IntPtrConstant(11)),
                                WordAnd(int_elem, IntPtrConstant(0x7FF))));
@@ -2707,10 +2799,10 @@ Node* RegExpBuiltinsAssembler::ReplaceGlobalCallableFastPath(
         {
           var_i = IntPtrAdd(var_i.value(), int_one);
 
-          Node* const next_elem =
-              LoadFixedArrayElement(res_elems, var_i.value());
+          TNode<Smi> const next_elem =
+              CAST(LoadFixedArrayElement(res_elems, var_i.value()));
 
-          var_match_start = SmiSub(next_elem, elem);
+          var_match_start = SmiSub(next_elem, smi_elem);
           Goto(&loop_epilogue);
         }
       }
@@ -2811,7 +2903,7 @@ Node* RegExpBuiltinsAssembler::ReplaceSimpleStringFastPath(
 
   CSA_ASSERT(this, IsFastRegExp(context, regexp));
 
-  Node* const smi_zero = SmiConstant(0);
+  TNode<Smi> const smi_zero = SmiConstant(0);
   const bool kIsFastPath = true;
 
   TVARIABLE(String, var_result, EmptyStringConstant());
@@ -2837,37 +2929,27 @@ Node* RegExpBuiltinsAssembler::ReplaceSimpleStringFastPath(
 
     // Successful match.
     {
-      Node* const match_start = LoadFixedArrayElement(
-          var_match_indices.value(), RegExpMatchInfo::kFirstCaptureIndex);
-      Node* const match_end = LoadFixedArrayElement(
-          var_match_indices.value(), RegExpMatchInfo::kFirstCaptureIndex + 1);
+      TNode<Smi> const match_start = CAST(LoadFixedArrayElement(
+          var_match_indices.value(), RegExpMatchInfo::kFirstCaptureIndex));
+      TNode<Smi> const match_end = CAST(LoadFixedArrayElement(
+          var_match_indices.value(), RegExpMatchInfo::kFirstCaptureIndex + 1));
 
-      Label if_replaceisempty(this), if_replaceisnotempty(this);
       TNode<Smi> const replace_length = LoadStringLengthAsSmi(replace_string);
-      Branch(SmiEqual(replace_length, smi_zero), &if_replaceisempty,
-             &if_replaceisnotempty);
 
-      BIND(&if_replaceisempty);
-      {
-        // TODO(jgruber): We could skip many of the checks that using SubString
-        // here entails.
-        TNode<String> const first_part =
-            SubString(string, SmiUntag(var_last_match_end.value()),
-                      SmiUntag(match_start));
-        var_result = StringAdd(context, var_result.value(), first_part);
-        Goto(&loop_end);
-      }
+      // TODO(jgruber): We could skip many of the checks that using SubString
+      // here entails.
+      TNode<String> first_part =
+          CAST(CallBuiltin(Builtins::kSubString, context, string,
+                           var_last_match_end.value(), match_start));
+      var_result = CAST(CallBuiltin(Builtins::kStringAdd_CheckNone_NotTenured,
+                                    context, var_result.value(), first_part));
 
-      BIND(&if_replaceisnotempty);
-      {
-        TNode<String> const first_part =
-            SubString(string, SmiUntag(var_last_match_end.value()),
-                      SmiUntag(match_start));
-        TNode<String> result =
-            StringAdd(context, var_result.value(), first_part);
-        var_result = StringAdd(context, result, replace_string);
-        Goto(&loop_end);
-      }
+      GotoIf(SmiEqual(replace_length, smi_zero), &loop_end);
+
+      var_result =
+          CAST(CallBuiltin(Builtins::kStringAdd_CheckNone_NotTenured, context,
+                           var_result.value(), replace_string));
+      Goto(&loop_end);
 
       BIND(&loop_end);
       {
@@ -2889,9 +2971,11 @@ Node* RegExpBuiltinsAssembler::ReplaceSimpleStringFastPath(
   BIND(&if_nofurthermatches);
   {
     TNode<Smi> const string_length = LoadStringLengthAsSmi(string);
-    TNode<String> const last_part = SubString(
-        string, SmiUntag(var_last_match_end.value()), SmiUntag(string_length));
-    var_result = StringAdd(context, var_result.value(), last_part);
+    TNode<String> last_part =
+        CAST(CallBuiltin(Builtins::kSubString, context, string,
+                         var_last_match_end.value(), string_length));
+    var_result = CAST(CallBuiltin(Builtins::kStringAdd_CheckNone_NotTenured,
+                                  context, var_result.value(), last_part));
     Goto(&out);
   }
 
@@ -2931,11 +3015,11 @@ TF_BUILTIN(RegExpReplace, RegExpBuiltinsAssembler) {
       BIND(&next);
     }
 
-    Node* const dollar_string = HeapConstant(
+    TNode<String> const dollar_string = HeapConstant(
         isolate()->factory()->LookupSingleCharacterStringFromCode('$'));
-    Node* const dollar_ix =
-        CallBuiltin(Builtins::kStringIndexOf, context, replace_string,
-                    dollar_string, SmiConstant(0));
+    TNode<Smi> const dollar_ix =
+        CAST(CallBuiltin(Builtins::kStringIndexOf, context, replace_string,
+                         dollar_string, SmiConstant(0)));
     GotoIfNot(SmiEqual(dollar_ix, SmiConstant(-1)), &runtime);
 
     Return(
@@ -2973,13 +3057,13 @@ TF_BUILTIN(RegExpPrototypeReplace, RegExpBuiltinsAssembler) {
   const int kReplaceValueArg = 1;
 
   Node* argc =
-      ChangeInt32ToIntPtr(Parameter(BuiltinDescriptor::kArgumentsCount));
+      ChangeInt32ToIntPtr(Parameter(Descriptor::kJSActualArgumentsCount));
   CodeStubArguments args(this, argc);
 
   Node* const maybe_receiver = args.GetReceiver();
   Node* const maybe_string = args.GetOptionalArgumentValue(kStringArg);
   Node* const replace_value = args.GetOptionalArgumentValue(kReplaceValueArg);
-  Node* const context = Parameter(BuiltinDescriptor::kContext);
+  Node* const context = Parameter(Descriptor::kContext);
 
   // RegExpPrototypeReplace is a bit of a beast - a summary of dispatch logic:
   //
@@ -3032,8 +3116,9 @@ TF_BUILTIN(RegExpInternalMatch, RegExpBuiltinsAssembler) {
   Node* const native_context = LoadNativeContext(context);
   Node* const internal_match_info = LoadContextElement(
       native_context, Context::REGEXP_INTERNAL_MATCH_INFO_INDEX);
-  Node* const match_indices = RegExpExecInternal(context, regexp, string,
-                                                 smi_zero, internal_match_info);
+  Node* const match_indices =
+      CallBuiltin(Builtins::kRegExpExecInternal, context, regexp, string,
+                  smi_zero, internal_match_info);
   Node* const null = NullConstant();
   Label if_matched(this);
   GotoIfNot(WordEqual(match_indices, null), &if_matched);
@@ -3093,8 +3178,8 @@ TF_BUILTIN(RegExpStringIteratorPrototypeNext, RegExpStringIteratorAssembler) {
   // 1. Let O be the this value.
   // 2. If Type(O) is not Object, throw a TypeError exception.
   GotoIf(TaggedIsSmi(maybe_receiver), &throw_bad_receiver);
-  GotoIfNot(IsJSReceiver(maybe_receiver), &throw_bad_receiver);
   TNode<HeapObject> receiver = CAST(maybe_receiver);
+  GotoIfNot(IsJSReceiver(receiver), &throw_bad_receiver);
 
   // 3. If O does not have all of the internal slots of a RegExp String Iterator
   // Object Instance (see 5.3), throw a TypeError exception.
@@ -3123,25 +3208,28 @@ TF_BUILTIN(RegExpStringIteratorPrototypeNext, RegExpStringIteratorAssembler) {
 
   // 9. Let match be ? RegExpExec(R, S).
   TVARIABLE(Object, var_match);
+  TVARIABLE(BoolT, var_is_fast_regexp);
   {
-    Label if_fast(this), if_slow(this), next(this);
+    Label if_fast(this), if_slow(this, Label::kDeferred);
     BranchIfFastRegExp(context, iterating_regexp, &if_fast, &if_slow);
     BIND(&if_fast);
     {
-      var_match = CAST(RegExpPrototypeExecBody(context, iterating_regexp,
-                                               iterating_string, true));
-      Goto(&next);
+      TNode<Object> indices_or_null = CAST(RegExpPrototypeExecBodyWithoutResult(
+          context, iterating_regexp, iterating_string, &if_no_match, true));
+      var_match = CAST(ConstructNewResultFromMatchInfo(
+          context, iterating_regexp, indices_or_null, iterating_string));
+      var_is_fast_regexp = Int32TrueConstant();
+      Goto(&if_match);
     }
     BIND(&if_slow);
     {
       var_match = CAST(RegExpExec(context, iterating_regexp, iterating_string));
-      Goto(&next);
+      var_is_fast_regexp = Int32FalseConstant();
+      Branch(IsNull(var_match.value()), &if_no_match, &if_match);
     }
-    BIND(&next);
   }
 
   // 10. If match is null, then
-  Branch(IsNull(var_match.value()), &if_no_match, &if_match);
   BIND(&if_no_match);
   {
     // a. Set O.[[Done]] to true.
@@ -3153,26 +3241,60 @@ TF_BUILTIN(RegExpStringIteratorPrototypeNext, RegExpStringIteratorAssembler) {
   // 11. Else,
   BIND(&if_match);
   {
-    Label if_global(this), if_not_global(this, Label::kDeferred);
+    Label if_global(this), if_not_global(this, Label::kDeferred),
+        return_result(this);
 
     // a. If global is true,
     Branch(HasGlobalFlag(flags), &if_global, &if_not_global);
     BIND(&if_global);
     {
-      // i. Let matchStr be ? ToString(? Get(match, "0")).
-      // TODO(pwong): Add fast path for fast regexp results. See
-      // BranchIfFastRegExpResult().
-      TNode<Object> match_str = ToString_Inline(
-          context, GetProperty(context, var_match.value(),
-                               isolate()->factory()->zero_string()));
+      Label if_fast(this), if_slow(this, Label::kDeferred);
 
       // ii. If matchStr is the empty string,
+      Branch(var_is_fast_regexp.value(), &if_fast, &if_slow);
+      BIND(&if_fast);
+      {
+        // i. Let matchStr be ? ToString(? Get(match, "0")).
+        CSA_ASSERT_BRANCH(this, [&](Label* ok, Label* not_ok) {
+          BranchIfFastRegExpResult(context, var_match.value(), ok, not_ok);
+        });
+        CSA_ASSERT(this,
+                   SmiNotEqual(LoadFastJSArrayLength(CAST(var_match.value())),
+                               SmiConstant(0)));
+        TNode<FixedArrayBase> result_fixed_array =
+            LoadElements(CAST(var_match.value()));
+        TNode<String> match_str =
+            CAST(LoadFixedArrayElement(result_fixed_array, 0));
+
+        // When iterating_regexp is fast, we assume it stays fast even after
+        // accessing the first match from the RegExp result.
+        CSA_ASSERT(this, IsFastRegExp(context, iterating_regexp));
+        GotoIfNot(IsEmptyString(match_str), &return_result);
+
+        // 1. Let thisIndex be ? ToLength(? Get(R, "lastIndex")).
+        TNode<Smi> this_index = CAST(FastLoadLastIndex(iterating_regexp));
+        CSA_ASSERT(this, TaggedIsSmi(this_index));
+
+        // 2. Let nextIndex be ! AdvanceStringIndex(S, thisIndex, fullUnicode).
+        TNode<Smi> next_index = CAST(AdvanceStringIndex(
+            iterating_string, this_index, HasUnicodeFlag(flags), true));
+        CSA_ASSERT(this, TaggedIsSmi(next_index));
+
+        // 3. Perform ? Set(R, "lastIndex", nextIndex, true).
+        FastStoreLastIndex(iterating_regexp, next_index);
+
+        // iii. Return ! CreateIterResultObject(match, false).
+        Goto(&return_result);
+      }
+      BIND(&if_slow);
       {
-        Label next(this);
-        GotoIfNot(IsEmptyString(match_str), &next);
+        // i. Let matchStr be ? ToString(? Get(match, "0")).
+        TNode<String> match_str = ToString_Inline(
+            context, GetProperty(context, var_match.value(), SmiConstant(0)));
+
+        GotoIfNot(IsEmptyString(match_str), &return_result);
 
         // 1. Let thisIndex be ? ToLength(? Get(R, "lastIndex")).
-        // TODO(pwong): Add fast path for loading last index.
         TNode<Object> last_index =
             CAST(SlowLoadLastIndex(context, iterating_regexp));
         TNode<Number> this_index = ToLength_Inline(context, last_index);
@@ -3182,16 +3304,11 @@ TF_BUILTIN(RegExpStringIteratorPrototypeNext, RegExpStringIteratorAssembler) {
             iterating_string, this_index, HasUnicodeFlag(flags), false));
 
         // 3. Perform ? Set(R, "lastIndex", nextIndex, true).
-        // TODO(pwong): Add fast path for storing last index.
         SlowStoreLastIndex(context, iterating_regexp, next_index);
 
-        Goto(&next);
-        BIND(&next);
+        // iii. Return ! CreateIterResultObject(match, false).
+        Goto(&return_result);
       }
-
-      // iii. Return ! CreateIterResultObject(match, false).
-      Return(AllocateJSIteratorResult(context, var_match.value(),
-                                      FalseConstant()));
     }
     // b. Else,
     BIND(&if_not_global);
@@ -3200,6 +3317,10 @@ TF_BUILTIN(RegExpStringIteratorPrototypeNext, RegExpStringIteratorAssembler) {
       SetDoneFlag(receiver, flags);
 
       // ii. Return ! CreateIterResultObject(match, false).
+      Goto(&return_result);
+    }
+    BIND(&return_result);
+    {
       Return(AllocateJSIteratorResult(context, var_match.value(),
                                       FalseConstant()));
     }
diff --git a/deps/v8/src/builtins/builtins-regexp-gen.h b/deps/v8/src/builtins/builtins-regexp-gen.h
index 2146da5c0e6633..251e8c035e49f3 100644
--- a/deps/v8/src/builtins/builtins-regexp-gen.h
+++ b/deps/v8/src/builtins/builtins-regexp-gen.h
@@ -29,7 +29,8 @@ class RegExpBuiltinsAssembler : public CodeStubAssembler {
 
   TNode<Object> MatchAllIterator(TNode<Context> context,
                                  TNode<Context> native_context,
-                                 TNode<Object> regexp, TNode<Object> string,
+                                 TNode<Object> regexp, TNode<String> string,
+                                 TNode<BoolT> is_fast_regexp,
                                  char const* method_name);
 
  protected:
@@ -40,7 +41,7 @@ class RegExpBuiltinsAssembler : public CodeStubAssembler {
   Node* AllocateRegExpResult(Node* context, Node* length, Node* index,
                              Node* input);
 
-  Node* FastLoadLastIndex(Node* regexp);
+  TNode<Object> FastLoadLastIndex(Node* regexp);
   Node* SlowLoadLastIndex(Node* context, Node* regexp);
   Node* LoadLastIndex(Node* context, Node* regexp, bool is_fastpath);
 
@@ -77,16 +78,19 @@ class RegExpBuiltinsAssembler : public CodeStubAssembler {
                              MessageTemplate::Template msg_template,
                              char const* method_name);
 
+  // Analogous to BranchIfFastRegExp, for use in asserts.
+  TNode<BoolT> IsFastRegExp(SloppyTNode<Context> context,
+                            SloppyTNode<Object> object);
+
   void BranchIfFastRegExp(Node* const context, Node* const object,
                           Label* const if_isunmodified,
                           Label* const if_ismodified);
 
-  // Analogous to BranchIfFastRegExp, for use in asserts.
-  Node* IsFastRegExp(Node* const context, Node* const object);
-
   // Performs fast path checks on the given object itself, but omits prototype
   // checks.
   Node* IsFastRegExpNoPrototype(Node* const context, Node* const object);
+  TNode<BoolT> IsFastRegExpWithOriginalExec(TNode<Context> context,
+                                            TNode<JSRegExp> object);
   Node* IsFastRegExpNoPrototype(Node* const context, Node* const object,
                                 Node* const map);
 
@@ -104,6 +108,7 @@ class RegExpBuiltinsAssembler : public CodeStubAssembler {
                   int counter, const char* method_name);
 
   Node* IsRegExp(Node* const context, Node* const maybe_receiver);
+
   Node* RegExpInitialize(Node* const context, Node* const regexp,
                          Node* const maybe_pattern, Node* const maybe_flags);
 
@@ -122,7 +127,8 @@ class RegExpBuiltinsAssembler : public CodeStubAssembler {
                                      Node* const string);
 
   void RegExpPrototypeSplitBody(Node* const context, Node* const regexp,
-                                TNode<String> const string, Node* const limit);
+                                TNode<String> const string,
+                                TNode<Smi> const limit);
 
   Node* ReplaceGlobalCallableFastPath(Node* context, Node* regexp, Node* string,
                                       Node* replace_callable);
diff --git a/deps/v8/src/builtins/builtins-regexp.cc b/deps/v8/src/builtins/builtins-regexp.cc
index 49506f4697321d..86bf06b6581ef7 100644
--- a/deps/v8/src/builtins/builtins-regexp.cc
+++ b/deps/v8/src/builtins/builtins-regexp.cc
@@ -31,7 +31,8 @@ BUILTIN(RegExpPrototypeToString) {
     Handle<Object> source;
     ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
         isolate, source,
-        JSReceiver::GetProperty(recv, isolate->factory()->source_string()));
+        JSReceiver::GetProperty(isolate, recv,
+                                isolate->factory()->source_string()));
     Handle<String> source_str;
     ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, source_str,
                                        Object::ToString(isolate, source));
@@ -43,7 +44,8 @@ BUILTIN(RegExpPrototypeToString) {
     Handle<Object> flags;
     ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
         isolate, flags,
-        JSReceiver::GetProperty(recv, isolate->factory()->flags_string()));
+        JSReceiver::GetProperty(isolate, recv,
+                                isolate->factory()->flags_string()));
     Handle<String> flags_str;
     ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, flags_str,
                                        Object::ToString(isolate, flags));
@@ -80,7 +82,7 @@ DEFINE_CAPTURE_GETTER(9)
 BUILTIN(RegExpInputGetter) {
   HandleScope scope(isolate);
   Handle<Object> obj(isolate->regexp_last_match_info()->LastInput(), isolate);
-  return obj->IsUndefined(isolate) ? isolate->heap()->empty_string()
+  return obj->IsUndefined(isolate) ? ReadOnlyRoots(isolate).empty_string()
                                    : String::cast(*obj);
 }
 
@@ -91,7 +93,7 @@ BUILTIN(RegExpInputSetter) {
   ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, str,
                                      Object::ToString(isolate, value));
   isolate->regexp_last_match_info()->SetLastInput(*str);
-  return isolate->heap()->undefined_value();
+  return ReadOnlyRoots(isolate).undefined_value();
 }
 
 // Getters for the static properties lastMatch, lastParen, leftContext, and
@@ -108,7 +110,9 @@ BUILTIN(RegExpLastParenGetter) {
   HandleScope scope(isolate);
   Handle<RegExpMatchInfo> match_info = isolate->regexp_last_match_info();
   const int length = match_info->NumberOfCaptureRegisters();
-  if (length <= 2) return isolate->heap()->empty_string();  // No captures.
+  if (length <= 2) {
+    return ReadOnlyRoots(isolate).empty_string();  // No captures.
+  }
 
   DCHECK_EQ(0, length % 2);
   const int last_capture = (length / 2) - 1;
@@ -123,7 +127,7 @@ BUILTIN(RegExpLeftContextGetter) {
   HandleScope scope(isolate);
   Handle<RegExpMatchInfo> match_info = isolate->regexp_last_match_info();
   const int start_index = match_info->Capture(0);
-  Handle<String> last_subject(match_info->LastSubject());
+  Handle<String> last_subject(match_info->LastSubject(), isolate);
   return *isolate->factory()->NewSubString(last_subject, 0, start_index);
 }
 
@@ -131,7 +135,7 @@ BUILTIN(RegExpRightContextGetter) {
   HandleScope scope(isolate);
   Handle<RegExpMatchInfo> match_info = isolate->regexp_last_match_info();
   const int start_index = match_info->Capture(1);
-  Handle<String> last_subject(match_info->LastSubject());
+  Handle<String> last_subject(match_info->LastSubject(), isolate);
   const int len = last_subject->length();
   return *isolate->factory()->NewSubString(last_subject, start_index, len);
 }
diff --git a/deps/v8/src/builtins/builtins-sharedarraybuffer-gen.cc b/deps/v8/src/builtins/builtins-sharedarraybuffer-gen.cc
index 2c9f0791dad379..52673bfd367ba7 100644
--- a/deps/v8/src/builtins/builtins-sharedarraybuffer-gen.cc
+++ b/deps/v8/src/builtins/builtins-sharedarraybuffer-gen.cc
@@ -111,8 +111,8 @@ void SharedArrayBufferBuiltinsAssembler::ValidateAtomicIndex(Node* array,
                                                              Node* context) {
   // Check if the index is in bounds. If not, throw RangeError.
   Label check_passed(this);
-  Node* array_length_word32 = TruncateTaggedToWord32(
-      context, LoadObjectField(array, JSTypedArray::kLengthOffset));
+  Node* array_length_word32 =
+      TruncateTaggedToWord32(context, LoadTypedArrayLength(CAST(array)));
   GotoIf(Uint32LessThan(index_word, array_length_word32), &check_passed);
 
   ThrowRangeError(context, MessageTemplate::kInvalidAtomicAccessIndex);
@@ -127,12 +127,10 @@ void SharedArrayBufferBuiltinsAssembler::DebugSanityCheckAtomicIndex(
   // ToInteger above calls out to JavaScript. A SharedArrayBuffer can't be
   // neutered and the TypedArray length can't change either, so skipping this
   // check in Release mode is safe.
-  CSA_ASSERT(
-      this,
-      Uint32LessThan(
-          index_word,
-          TruncateTaggedToWord32(
-              context, LoadObjectField(array, JSTypedArray::kLengthOffset))));
+  CSA_ASSERT(this,
+             Uint32LessThan(index_word,
+                            TruncateTaggedToWord32(
+                                context, LoadTypedArrayLength(CAST(array)))));
 }
 #endif
 
diff --git a/deps/v8/src/builtins/builtins-sharedarraybuffer.cc b/deps/v8/src/builtins/builtins-sharedarraybuffer.cc
index a847a5d892cd66..a1b36c5fb6e922 100644
--- a/deps/v8/src/builtins/builtins-sharedarraybuffer.cc
+++ b/deps/v8/src/builtins/builtins-sharedarraybuffer.cc
@@ -93,7 +93,7 @@ BUILTIN(AtomicsWake) {
       isolate, sta, ValidateSharedIntegerTypedArray(isolate, array, true));
 
   Maybe<size_t> maybe_index = ValidateAtomicAccess(isolate, sta, index);
-  if (maybe_index.IsNothing()) return isolate->heap()->exception();
+  if (maybe_index.IsNothing()) return ReadOnlyRoots(isolate).exception();
   size_t i = maybe_index.FromJust();
 
   uint32_t c;
@@ -130,7 +130,7 @@ BUILTIN(AtomicsWait) {
       isolate, sta, ValidateSharedIntegerTypedArray(isolate, array, true));
 
   Maybe<size_t> maybe_index = ValidateAtomicAccess(isolate, sta, index);
-  if (maybe_index.IsNothing()) return isolate->heap()->exception();
+  if (maybe_index.IsNothing()) return ReadOnlyRoots(isolate).exception();
   size_t i = maybe_index.FromJust();
 
   ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, value,
@@ -139,13 +139,13 @@ BUILTIN(AtomicsWait) {
 
   double timeout_number;
   if (timeout->IsUndefined(isolate)) {
-    timeout_number = isolate->heap()->infinity_value()->Number();
+    timeout_number = ReadOnlyRoots(isolate).infinity_value()->Number();
   } else {
     ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, timeout,
                                        Object::ToNumber(timeout));
     timeout_number = timeout->Number();
     if (std::isnan(timeout_number))
-      timeout_number = isolate->heap()->infinity_value()->Number();
+      timeout_number = ReadOnlyRoots(isolate).infinity_value()->Number();
     else if (timeout_number < 0)
       timeout_number = 0;
   }
diff --git a/deps/v8/src/builtins/builtins-string-gen.cc b/deps/v8/src/builtins/builtins-string-gen.cc
index bc9578514a28e5..5524db56da6c6b 100644
--- a/deps/v8/src/builtins/builtins-string-gen.cc
+++ b/deps/v8/src/builtins/builtins-string-gen.cc
@@ -98,8 +98,7 @@ Node* StringBuiltinsAssembler::CallSearchStringRaw(Node* const subject_ptr,
                                                    Node* const search_length,
                                                    Node* const start_position) {
   Node* const function_addr = ExternalConstant(
-      ExternalReference::search_string_raw<SubjectChar, PatternChar>(
-          isolate()));
+      ExternalReference::search_string_raw<SubjectChar, PatternChar>());
   Node* const isolate_ptr =
       ExternalConstant(ExternalReference::isolate_address(isolate()));
 
@@ -285,6 +284,76 @@ void StringBuiltinsAssembler::StringEqual_Loop(
   }
 }
 
+void StringBuiltinsAssembler::Generate_StringAdd(StringAddFlags flags,
+                                                 PretenureFlag pretenure_flag,
+                                                 Node* context, Node* left,
+                                                 Node* right) {
+  switch (flags) {
+    case STRING_ADD_CONVERT_LEFT: {
+      // TODO(danno): The ToString and JSReceiverToPrimitive below could be
+      // combined to avoid duplicate smi and instance type checks.
+      left = ToString(context, JSReceiverToPrimitive(context, left));
+      Callable callable = CodeFactory::StringAdd(
+          isolate(), STRING_ADD_CHECK_NONE, pretenure_flag);
+      TailCallStub(callable, context, left, right);
+      break;
+    }
+    case STRING_ADD_CONVERT_RIGHT: {
+      // TODO(danno): The ToString and JSReceiverToPrimitive below could be
+      // combined to avoid duplicate smi and instance type checks.
+      right = ToString(context, JSReceiverToPrimitive(context, right));
+      Callable callable = CodeFactory::StringAdd(
+          isolate(), STRING_ADD_CHECK_NONE, pretenure_flag);
+      TailCallStub(callable, context, left, right);
+      break;
+    }
+    case STRING_ADD_CHECK_NONE: {
+      CodeStubAssembler::AllocationFlag allocation_flags =
+          (pretenure_flag == TENURED) ? CodeStubAssembler::kPretenured
+                                      : CodeStubAssembler::kNone;
+      Return(StringAdd(context, CAST(left), CAST(right), allocation_flags));
+      break;
+    }
+  }
+}
+
+TF_BUILTIN(StringAdd_CheckNone_NotTenured, StringBuiltinsAssembler) {
+  Node* left = Parameter(Descriptor::kLeft);
+  Node* right = Parameter(Descriptor::kRight);
+  Node* context = Parameter(Descriptor::kContext);
+  Generate_StringAdd(STRING_ADD_CHECK_NONE, NOT_TENURED, context, left, right);
+}
+
+TF_BUILTIN(StringAdd_CheckNone_Tenured, StringBuiltinsAssembler) {
+  Node* left = Parameter(Descriptor::kLeft);
+  Node* right = Parameter(Descriptor::kRight);
+  Node* context = Parameter(Descriptor::kContext);
+  Generate_StringAdd(STRING_ADD_CHECK_NONE, TENURED, context, left, right);
+}
+
+TF_BUILTIN(StringAdd_ConvertLeft_NotTenured, StringBuiltinsAssembler) {
+  Node* left = Parameter(Descriptor::kLeft);
+  Node* right = Parameter(Descriptor::kRight);
+  Node* context = Parameter(Descriptor::kContext);
+  Generate_StringAdd(STRING_ADD_CONVERT_LEFT, NOT_TENURED, context, left,
+                     right);
+}
+
+TF_BUILTIN(StringAdd_ConvertRight_NotTenured, StringBuiltinsAssembler) {
+  Node* left = Parameter(Descriptor::kLeft);
+  Node* right = Parameter(Descriptor::kRight);
+  Node* context = Parameter(Descriptor::kContext);
+  Generate_StringAdd(STRING_ADD_CONVERT_RIGHT, NOT_TENURED, context, left,
+                     right);
+}
+
+TF_BUILTIN(SubString, StringBuiltinsAssembler) {
+  TNode<String> string = CAST(Parameter(Descriptor::kString));
+  TNode<Smi> from = CAST(Parameter(Descriptor::kFrom));
+  TNode<Smi> to = CAST(Parameter(Descriptor::kTo));
+  Return(SubString(string, SmiUntag(from), SmiUntag(to)));
+}
+
 void StringBuiltinsAssembler::GenerateStringAt(char const* method_name,
                                                TNode<Context> context,
                                                Node* receiver,
@@ -566,8 +635,8 @@ TF_BUILTIN(StringFromCharCode, CodeStubAssembler) {
   // TODO(ishell): use constants from Descriptor once the JSFunction linkage
   // arguments are reordered.
   TNode<Int32T> argc =
-      UncheckedCast<Int32T>(Parameter(BuiltinDescriptor::kArgumentsCount));
-  Node* context = Parameter(BuiltinDescriptor::kContext);
+      UncheckedCast<Int32T>(Parameter(Descriptor::kJSActualArgumentsCount));
+  Node* context = Parameter(Descriptor::kContext);
 
   CodeStubArguments arguments(this, ChangeInt32ToIntPtr(argc));
   TNode<Smi> smi_argc = SmiTag(arguments.GetLength(INTPTR_PARAMETERS));
@@ -725,9 +794,10 @@ TF_BUILTIN(StringPrototypeConcat, CodeStubAssembler) {
   // TODO(ishell): use constants from Descriptor once the JSFunction linkage
   // arguments are reordered.
   CodeStubArguments arguments(
-      this, ChangeInt32ToIntPtr(Parameter(BuiltinDescriptor::kArgumentsCount)));
+      this,
+      ChangeInt32ToIntPtr(Parameter(Descriptor::kJSActualArgumentsCount)));
   Node* receiver = arguments.GetReceiver();
-  Node* context = Parameter(BuiltinDescriptor::kContext);
+  Node* context = Parameter(Descriptor::kContext);
 
   // Check that {receiver} is coercible to Object and convert it to a String.
   receiver = ToThisString(context, receiver, "String.prototype.concat");
@@ -831,7 +901,7 @@ void StringBuiltinsAssembler::StringIndexOf(
           ChangeInt32ToIntPtr(Load(MachineType::Uint8(), adjusted_search_ptr));
 
       Node* const memchr =
-          ExternalConstant(ExternalReference::libc_memchr_function(isolate()));
+          ExternalConstant(ExternalReference::libc_memchr_function());
       Node* const result_address =
           CallCFunction3(MachineType::Pointer(), MachineType::Pointer(),
                          MachineType::IntPtr(), MachineType::UintPtr(), memchr,
@@ -928,24 +998,26 @@ TF_BUILTIN(StringIndexOf, StringBuiltinsAssembler) {
 // ES6 String.prototype.includes(searchString [, position])
 // #sec-string.prototype.includes
 TF_BUILTIN(StringPrototypeIncludes, StringIncludesIndexOfAssembler) {
-  Generate(kIncludes);
+  TNode<IntPtrT> argc =
+      ChangeInt32ToIntPtr(Parameter(Descriptor::kJSActualArgumentsCount));
+  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
+  Generate(kIncludes, argc, context);
 }
 
 // ES6 String.prototype.indexOf(searchString [, position])
 // #sec-string.prototype.indexof
 TF_BUILTIN(StringPrototypeIndexOf, StringIncludesIndexOfAssembler) {
-  Generate(kIndexOf);
+  TNode<IntPtrT> argc =
+      ChangeInt32ToIntPtr(Parameter(Descriptor::kJSActualArgumentsCount));
+  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
+  Generate(kIndexOf, argc, context);
 }
 
-void StringIncludesIndexOfAssembler::Generate(SearchVariant variant) {
-  // TODO(ishell): use constants from Descriptor once the JSFunction linkage
-  // arguments are reordered.
-  Node* argc = Parameter(BuiltinDescriptor::kArgumentsCount);
-  Node* const context = Parameter(BuiltinDescriptor::kContext);
-  CodeStubArguments arguments(this, ChangeInt32ToIntPtr(argc));
+void StringIncludesIndexOfAssembler::Generate(SearchVariant variant,
+                                              TNode<IntPtrT> argc,
+                                              TNode<Context> context) {
+  CodeStubArguments arguments(this, argc);
   Node* const receiver = arguments.GetReceiver();
-  // From now on use word-size argc value.
-  argc = arguments.GetLength(INTPTR_PARAMETERS);
 
   VARIABLE(var_search_string, MachineRepresentation::kTagged);
   VARIABLE(var_position, MachineRepresentation::kTagged);
@@ -992,7 +1064,7 @@ void StringIncludesIndexOfAssembler::Generate(SearchVariant variant) {
       arguments.PopAndReturn((variant == kIndexOf)
                                  ? result
                                  : SelectBooleanConstant(SmiGreaterThanOrEqual(
-                                       result, SmiConstant(0))));
+                                       CAST(result), SmiConstant(0))));
     });
   }
   BIND(&call_runtime);
@@ -1046,7 +1118,7 @@ void StringBuiltinsAssembler::MaybeCallFunctionAtSymbol(
         LoadContextElement(native_context, Context::STRING_FUNCTION_INDEX);
     Node* const initial_map =
         LoadObjectField(string_fun, JSFunction::kPrototypeOrInitialMapOffset);
-    Node* const proto_map = LoadMap(CAST(LoadMapPrototype(initial_map)));
+    Node* const proto_map = LoadMap(LoadMapPrototype(initial_map));
 
     Branch(WordEqual(proto_map, initial_proto_initial_map), &out, &next);
 
@@ -1094,16 +1166,15 @@ void StringBuiltinsAssembler::MaybeCallFunctionAtSymbol(
   BIND(&out);
 }
 
-compiler::Node* StringBuiltinsAssembler::IndexOfDollarChar(Node* const context,
-                                                           Node* const string) {
+TNode<Smi> StringBuiltinsAssembler::IndexOfDollarChar(Node* const context,
+                                                      Node* const string) {
   CSA_ASSERT(this, IsString(string));
 
-  Node* const dollar_string = HeapConstant(
+  TNode<String> const dollar_string = HeapConstant(
       isolate()->factory()->LookupSingleCharacterStringFromCode('$'));
-  Node* const dollar_ix = CallBuiltin(Builtins::kStringIndexOf, context, string,
-                                      dollar_string, SmiConstant(0));
-
-  CSA_ASSERT(this, TaggedIsSmi(dollar_ix));
+  TNode<Smi> const dollar_ix =
+      CAST(CallBuiltin(Builtins::kStringIndexOf, context, string, dollar_string,
+                       SmiConstant(0)));
   return dollar_ix;
 }
 
@@ -1126,7 +1197,7 @@ compiler::Node* StringBuiltinsAssembler::GetSubstitution(
   // TODO(jgruber): Possibly extend this in the future to handle more complex
   // cases without runtime calls.
 
-  Node* const dollar_index = IndexOfDollarChar(context, replace_string);
+  TNode<Smi> const dollar_index = IndexOfDollarChar(context, replace_string);
   Branch(SmiIsNegative(dollar_index), &out, &runtime);
 
   BIND(&runtime);
@@ -1171,16 +1242,17 @@ TF_BUILTIN(StringPrototypeRepeat, StringBuiltinsAssembler) {
     Label if_count_isheapnumber(this, Label::kDeferred);
 
     GotoIfNot(TaggedIsSmi(var_count.value()), &if_count_isheapnumber);
-
-    // If count is a SMI, throw a RangeError if less than 0 or greater than
-    // the maximum string length.
-    GotoIf(SmiLessThan(var_count.value(), SmiConstant(0)), &invalid_count);
-    GotoIf(SmiEqual(var_count.value(), SmiConstant(0)), &return_emptystring);
-    GotoIf(is_stringempty, &return_emptystring);
-    GotoIf(SmiGreaterThan(var_count.value(), SmiConstant(String::kMaxLength)),
-           &invalid_string_length);
-    Return(CallBuiltin(Builtins::kStringRepeat, context, string,
-                       var_count.value()));
+    {
+      // If count is a SMI, throw a RangeError if less than 0 or greater than
+      // the maximum string length.
+      TNode<Smi> smi_count = CAST(var_count.value());
+      GotoIf(SmiLessThan(smi_count, SmiConstant(0)), &invalid_count);
+      GotoIf(SmiEqual(smi_count, SmiConstant(0)), &return_emptystring);
+      GotoIf(is_stringempty, &return_emptystring);
+      GotoIf(SmiGreaterThan(smi_count, SmiConstant(String::kMaxLength)),
+             &invalid_string_length);
+      Return(CallBuiltin(Builtins::kStringRepeat, context, string, smi_count));
+    }
 
     // If count is a Heap Number...
     // 1) If count is Infinity, throw a RangeError exception
@@ -1218,7 +1290,7 @@ TF_BUILTIN(StringPrototypeRepeat, StringBuiltinsAssembler) {
 TF_BUILTIN(StringRepeat, StringBuiltinsAssembler) {
   Node* const context = Parameter(Descriptor::kContext);
   Node* const string = Parameter(Descriptor::kString);
-  Node* const count = Parameter(Descriptor::kCount);
+  TNode<Smi> const count = CAST(Parameter(Descriptor::kCount));
 
   CSA_ASSERT(this, IsString(string));
   CSA_ASSERT(this, Word32BinaryNot(IsEmptyString(string)));
@@ -1237,7 +1309,7 @@ TF_BUILTIN(StringRepeat, StringBuiltinsAssembler) {
   //   }
   VARIABLE(var_result, MachineRepresentation::kTagged, EmptyStringConstant());
   VARIABLE(var_temp, MachineRepresentation::kTagged, string);
-  VARIABLE(var_count, MachineRepresentation::kTagged, count);
+  TVARIABLE(Smi, var_count, count);
 
   Callable stringadd_callable =
       CodeFactory::StringAdd(isolate(), STRING_ADD_CHECK_NONE, NOT_TENURED);
@@ -1255,7 +1327,7 @@ TF_BUILTIN(StringRepeat, StringBuiltinsAssembler) {
       BIND(&next);
     }
 
-    var_count.Bind(SmiShr(var_count.value(), 1));
+    var_count = SmiShr(var_count.value(), 1);
     GotoIf(SmiEqual(var_count.value(), SmiConstant(0)), &return_result);
     var_temp.Bind(CallStub(stringadd_callable, context, var_temp.value(),
                            var_temp.value()));
@@ -1275,7 +1347,7 @@ TF_BUILTIN(StringPrototypeReplace, StringBuiltinsAssembler) {
   Node* const replace = Parameter(Descriptor::kReplace);
   Node* const context = Parameter(Descriptor::kContext);
 
-  Node* const smi_zero = SmiConstant(0);
+  TNode<Smi> const smi_zero = SmiConstant(0);
 
   RequireObjectCoercible(context, receiver, "String.prototype.replace");
 
@@ -1330,10 +1402,9 @@ TF_BUILTIN(StringPrototypeReplace, StringBuiltinsAssembler) {
   // longer substrings - we can handle up to 8 chars (one-byte) / 4 chars
   // (2-byte).
 
-  Node* const match_start_index =
-      CallBuiltin(Builtins::kStringIndexOf, context, subject_string,
-                  search_string, smi_zero);
-  CSA_ASSERT(this, TaggedIsSmi(match_start_index));
+  TNode<Smi> const match_start_index =
+      CAST(CallBuiltin(Builtins::kStringIndexOf, context, subject_string,
+                       search_string, smi_zero));
 
   // Early exit if no match found.
   {
@@ -1359,7 +1430,7 @@ TF_BUILTIN(StringPrototypeReplace, StringBuiltinsAssembler) {
     BIND(&next);
   }
 
-  Node* const match_end_index = SmiAdd(match_start_index, search_length);
+  TNode<Smi> const match_end_index = SmiAdd(match_start_index, search_length);
 
   Callable stringadd_callable =
       CodeFactory::StringAdd(isolate(), STRING_ADD_CHECK_NONE, NOT_TENURED);
@@ -1507,13 +1578,24 @@ TF_BUILTIN(StringPrototypeMatchAll, StringBuiltinsAssembler) {
   RequireObjectCoercible(context, receiver, method_name);
 
   // 2. If regexp is neither undefined nor null, then
-  Label return_match_all_iterator(this);
-  GotoIf(IsNullOrUndefined(maybe_regexp), &return_match_all_iterator);
+  Label return_match_all_iterator(this),
+      tostring_and_return_match_all_iterator(this, Label::kDeferred);
+  TVARIABLE(BoolT, var_is_fast_regexp);
+  TVARIABLE(String, var_receiver_string);
+  GotoIf(IsNullOrUndefined(maybe_regexp),
+         &tostring_and_return_match_all_iterator);
   {
     // a. Let matcher be ? GetMethod(regexp, @@matchAll).
     // b. If matcher is not undefined, then
     //   i. Return ? Call(matcher, regexp, « O »).
-    auto if_regexp_call = [&] { Goto(&return_match_all_iterator); };
+    auto if_regexp_call = [&] {
+      // MaybeCallFunctionAtSymbol guarantees fast path is chosen only if
+      // maybe_regexp is a fast regexp and receiver is a string.
+      var_receiver_string = CAST(receiver);
+      CSA_ASSERT(this, IsString(var_receiver_string.value()));
+      var_is_fast_regexp = Int32TrueConstant();
+      Goto(&return_match_all_iterator);
+    };
     auto if_generic_call = [=](Node* fn) {
       Callable call_callable = CodeFactory::Call(isolate());
       Return(CallJS(call_callable, context, fn, maybe_regexp, receiver));
@@ -1521,6 +1603,12 @@ TF_BUILTIN(StringPrototypeMatchAll, StringBuiltinsAssembler) {
     MaybeCallFunctionAtSymbol(context, maybe_regexp, receiver,
                               isolate()->factory()->match_all_symbol(),
                               if_regexp_call, if_generic_call);
+    Goto(&tostring_and_return_match_all_iterator);
+  }
+  BIND(&tostring_and_return_match_all_iterator);
+  {
+    var_receiver_string = ToString_Inline(context, receiver);
+    var_is_fast_regexp = Int32FalseConstant();
     Goto(&return_match_all_iterator);
   }
   BIND(&return_match_all_iterator);
@@ -1528,7 +1616,8 @@ TF_BUILTIN(StringPrototypeMatchAll, StringBuiltinsAssembler) {
     // 3. Return ? MatchAllIterator(regexp, O).
     RegExpBuiltinsAssembler regexp_asm(state());
     TNode<Object> iterator = regexp_asm.MatchAllIterator(
-        context, native_context, maybe_regexp, receiver, method_name);
+        context, native_context, maybe_regexp, var_receiver_string.value(),
+        var_is_fast_regexp.value(), method_name);
     Return(iterator);
   }
 }
@@ -1541,10 +1630,8 @@ class StringPadAssembler : public StringBuiltinsAssembler {
  protected:
   enum Variant { kStart, kEnd };
 
-  void Generate(Variant variant, const char* method_name) {
-    Node* const context = Parameter(BuiltinDescriptor::kContext);
-    Node* argc =
-        ChangeInt32ToIntPtr(Parameter(BuiltinDescriptor::kArgumentsCount));
+  void Generate(Variant variant, const char* method_name, TNode<IntPtrT> argc,
+                TNode<Context> context) {
     CodeStubArguments arguments(this, argc);
     Node* const receiver = arguments.GetReceiver();
     Node* const receiver_string = ToThisString(context, receiver, method_name);
@@ -1558,18 +1645,20 @@ class StringPadAssembler : public StringBuiltinsAssembler {
     // If no max_length was provided, return the string.
     GotoIf(IntPtrEqual(argc, IntPtrConstant(0)), &dont_pad);
 
-    Node* const max_length = ToLength_Inline(context, arguments.AtIndex(0));
+    TNode<Number> const max_length =
+        ToLength_Inline(context, arguments.AtIndex(0));
     CSA_ASSERT(this, IsNumberNormalized(max_length));
 
     // Throw if max_length is not a smi or greater than the max string length.
-    GotoIfNot(Word32And(TaggedIsSmi(max_length),
-                        SmiLessThanOrEqual(max_length,
-                                           SmiConstant(String::kMaxLength))),
-              &invalid_string_length);
+    GotoIfNot(TaggedIsSmi(max_length), &invalid_string_length);
+    TNode<Smi> smi_max_length = CAST(max_length);
+    GotoIfNot(
+        SmiLessThanOrEqual(smi_max_length, SmiConstant(String::kMaxLength)),
+        &invalid_string_length);
 
     // If the max_length is less than length of the string, return the string.
-    CSA_ASSERT(this, TaggedIsPositiveSmi(max_length));
-    GotoIf(SmiLessThanOrEqual(max_length, string_length), &dont_pad);
+    CSA_ASSERT(this, TaggedIsPositiveSmi(smi_max_length));
+    GotoIf(SmiLessThanOrEqual(smi_max_length, string_length), &dont_pad);
 
     Branch(IntPtrEqual(argc, IntPtrConstant(1)), &pad, &argc_2);
     BIND(&argc_2);
@@ -1587,11 +1676,11 @@ class StringPadAssembler : public StringBuiltinsAssembler {
     {
       CSA_ASSERT(this,
                  IntPtrGreaterThan(var_fill_length.value(), IntPtrConstant(0)));
-      CSA_ASSERT(this, SmiGreaterThan(max_length, string_length));
+      CSA_ASSERT(this, SmiGreaterThan(smi_max_length, string_length));
 
       Callable stringadd_callable =
           CodeFactory::StringAdd(isolate(), STRING_ADD_CHECK_NONE, NOT_TENURED);
-      TNode<Smi> const pad_length = SmiSub(max_length, string_length);
+      TNode<Smi> const pad_length = SmiSub(smi_max_length, string_length);
 
       VARIABLE(var_pad, MachineRepresentation::kTagged);
 
@@ -1652,11 +1741,19 @@ class StringPadAssembler : public StringBuiltinsAssembler {
 };
 
 TF_BUILTIN(StringPrototypePadEnd, StringPadAssembler) {
-  Generate(kEnd, "String.prototype.padEnd");
+  TNode<IntPtrT> argc =
+      ChangeInt32ToIntPtr(Parameter(Descriptor::kJSActualArgumentsCount));
+  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
+
+  Generate(kEnd, "String.prototype.padEnd", argc, context);
 }
 
 TF_BUILTIN(StringPrototypePadStart, StringPadAssembler) {
-  Generate(kStart, "String.prototype.padStart");
+  TNode<IntPtrT> argc =
+      ChangeInt32ToIntPtr(Parameter(Descriptor::kJSActualArgumentsCount));
+  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
+
+  Generate(kStart, "String.prototype.padStart", argc, context);
 }
 
 // ES6 #sec-string.prototype.search
@@ -1676,12 +1773,12 @@ TF_BUILTIN(StringPrototypeSlice, StringBuiltinsAssembler) {
   const int kStart = 0;
   const int kEnd = 1;
   Node* argc =
-      ChangeInt32ToIntPtr(Parameter(BuiltinDescriptor::kArgumentsCount));
+      ChangeInt32ToIntPtr(Parameter(Descriptor::kJSActualArgumentsCount));
   CodeStubArguments args(this, argc);
   Node* const receiver = args.GetReceiver();
   TNode<Object> start = args.GetOptionalArgumentValue(kStart);
   TNode<Object> end = args.GetOptionalArgumentValue(kEnd);
-  TNode<Context> context = CAST(Parameter(BuiltinDescriptor::kContext));
+  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
 
   // 1. Let O be ? RequireObjectCoercible(this value).
   RequireObjectCoercible(context, receiver, "String.prototype.slice");
@@ -1718,21 +1815,97 @@ TF_BUILTIN(StringPrototypeSlice, StringBuiltinsAssembler) {
   args.PopAndReturn(EmptyStringConstant());
 }
 
+TNode<JSArray> StringBuiltinsAssembler::StringToArray(
+    TNode<Context> context, TNode<String> subject_string,
+    TNode<Smi> subject_length, TNode<Number> limit_number) {
+  CSA_ASSERT(this, SmiGreaterThan(subject_length, SmiConstant(0)));
+
+  Label done(this), call_runtime(this, Label::kDeferred),
+      fill_thehole_and_call_runtime(this, Label::kDeferred);
+  TVARIABLE(JSArray, result_array);
+
+  TNode<Int32T> instance_type = LoadInstanceType(subject_string);
+  GotoIfNot(IsOneByteStringInstanceType(instance_type), &call_runtime);
+
+  // Try to use cached one byte characters.
+  {
+    TNode<Smi> length_smi =
+        Select<Smi>(TaggedIsSmi(limit_number),
+                    [=] { return SmiMin(CAST(limit_number), subject_length); },
+                    [=] { return subject_length; });
+    TNode<IntPtrT> length = SmiToIntPtr(length_smi);
+
+    ToDirectStringAssembler to_direct(state(), subject_string);
+    to_direct.TryToDirect(&call_runtime);
+    TNode<FixedArray> elements = AllocateFixedArray(
+        PACKED_ELEMENTS, length, AllocationFlag::kAllowLargeObjectAllocation);
+    // Don't allocate anything while {string_data} is live!
+    TNode<RawPtrT> string_data = UncheckedCast<RawPtrT>(
+        to_direct.PointerToData(&fill_thehole_and_call_runtime));
+    TNode<IntPtrT> string_data_offset = to_direct.offset();
+    TNode<Object> cache = LoadRoot(Heap::kSingleCharacterStringCacheRootIndex);
+
+    BuildFastLoop(
+        IntPtrConstant(0), length,
+        [&](Node* index) {
+          // TODO(jkummerow): Implement a CSA version of DisallowHeapAllocation
+          // and use that to guard ToDirectStringAssembler.PointerToData().
+          CSA_ASSERT(this, WordEqual(to_direct.PointerToData(&call_runtime),
+                                     string_data));
+          TNode<Int32T> char_code =
+              UncheckedCast<Int32T>(Load(MachineType::Uint8(), string_data,
+                                         IntPtrAdd(index, string_data_offset)));
+          Node* code_index = ChangeUint32ToWord(char_code);
+          TNode<Object> entry = LoadFixedArrayElement(CAST(cache), code_index);
+
+          // If we cannot find a char in the cache, fill the hole for the fixed
+          // array, and call runtime.
+          GotoIf(IsUndefined(entry), &fill_thehole_and_call_runtime);
+
+          StoreFixedArrayElement(elements, index, entry);
+        },
+        1, ParameterMode::INTPTR_PARAMETERS, IndexAdvanceMode::kPost);
+
+    TNode<Map> array_map = LoadJSArrayElementsMap(PACKED_ELEMENTS, context);
+    result_array = CAST(
+        AllocateUninitializedJSArrayWithoutElements(array_map, length_smi));
+    StoreObjectField(result_array.value(), JSObject::kElementsOffset, elements);
+    Goto(&done);
+
+    BIND(&fill_thehole_and_call_runtime);
+    {
+      FillFixedArrayWithValue(PACKED_ELEMENTS, elements, IntPtrConstant(0),
+                              length, Heap::kTheHoleValueRootIndex);
+      Goto(&call_runtime);
+    }
+  }
+
+  BIND(&call_runtime);
+  {
+    result_array = CAST(CallRuntime(Runtime::kStringToArray, context,
+                                    subject_string, limit_number));
+    Goto(&done);
+  }
+
+  BIND(&done);
+  return result_array.value();
+}
+
 // ES6 section 21.1.3.19 String.prototype.split ( separator, limit )
 TF_BUILTIN(StringPrototypeSplit, StringBuiltinsAssembler) {
   const int kSeparatorArg = 0;
   const int kLimitArg = 1;
 
   Node* const argc =
-      ChangeInt32ToIntPtr(Parameter(BuiltinDescriptor::kArgumentsCount));
+      ChangeInt32ToIntPtr(Parameter(Descriptor::kJSActualArgumentsCount));
   CodeStubArguments args(this, argc);
 
   Node* const receiver = args.GetReceiver();
   Node* const separator = args.GetOptionalArgumentValue(kSeparatorArg);
   Node* const limit = args.GetOptionalArgumentValue(kLimitArg);
-  Node* const context = Parameter(BuiltinDescriptor::kContext);
+  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
 
-  Node* const smi_zero = SmiConstant(0);
+  TNode<Smi> smi_zero = SmiConstant(0);
 
   RequireObjectCoercible(context, receiver, "String.prototype.split");
 
@@ -1752,29 +1925,17 @@ TF_BUILTIN(StringPrototypeSplit, StringBuiltinsAssembler) {
 
   // String and integer conversions.
 
-  Node* const subject_string = ToString_Inline(context, receiver);
-  TNode<Number> const limit_number = Select<Number>(
+  TNode<String> subject_string = ToString_Inline(context, receiver);
+  TNode<Number> limit_number = Select<Number>(
       IsUndefined(limit), [=] { return NumberConstant(kMaxUInt32); },
       [=] { return ToUint32(context, limit); });
   Node* const separator_string = ToString_Inline(context, separator);
 
-  // Shortcut for {limit} == 0.
-  {
-    Label next(this);
-    GotoIfNot(SmiEqual(limit_number, smi_zero), &next);
-
-    const ElementsKind kind = PACKED_ELEMENTS;
-    Node* const native_context = LoadNativeContext(context);
-    Node* const array_map = LoadJSArrayElementsMap(kind, native_context);
-
-    Node* const length = smi_zero;
-    Node* const capacity = IntPtrConstant(0);
-    Node* const result = AllocateJSArray(kind, array_map, capacity, length);
-
-    args.PopAndReturn(result);
+  Label return_empty_array(this);
 
-    BIND(&next);
-  }
+  // Shortcut for {limit} == 0.
+  GotoIf(WordEqual<Object, Object>(limit_number, smi_zero),
+         &return_empty_array);
 
   // ECMA-262 says that if {separator} is undefined, the result should
   // be an array of size 1 containing the entire string.
@@ -1801,12 +1962,14 @@ TF_BUILTIN(StringPrototypeSplit, StringBuiltinsAssembler) {
   // If the separator string is empty then return the elements in the subject.
   {
     Label next(this);
-    GotoIfNot(SmiEqual(LoadStringLengthAsSmi(separator_string), SmiConstant(0)),
+    GotoIfNot(SmiEqual(LoadStringLengthAsSmi(separator_string), smi_zero),
               &next);
 
-    Node* const result = CallRuntime(Runtime::kStringToArray, context,
-                                     subject_string, limit_number);
-    args.PopAndReturn(result);
+    TNode<Smi> subject_length = LoadStringLengthAsSmi(subject_string);
+    GotoIf(SmiEqual(subject_length, smi_zero), &return_empty_array);
+
+    args.PopAndReturn(
+        StringToArray(context, subject_string, subject_length, limit_number));
 
     BIND(&next);
   }
@@ -1815,6 +1978,19 @@ TF_BUILTIN(StringPrototypeSplit, StringBuiltinsAssembler) {
       CallRuntime(Runtime::kStringSplit, context, subject_string,
                   separator_string, limit_number);
   args.PopAndReturn(result);
+
+  BIND(&return_empty_array);
+  {
+    const ElementsKind kind = PACKED_ELEMENTS;
+    Node* const native_context = LoadNativeContext(context);
+    Node* const array_map = LoadJSArrayElementsMap(kind, native_context);
+
+    Node* const length = smi_zero;
+    Node* const capacity = IntPtrConstant(0);
+    Node* const result = AllocateJSArray(kind, array_map, capacity, length);
+
+    args.PopAndReturn(result);
+  }
 }
 
 // ES6 #sec-string.prototype.substr
@@ -1823,13 +1999,13 @@ TF_BUILTIN(StringPrototypeSubstr, StringBuiltinsAssembler) {
   const int kLengthArg = 1;
 
   Node* const argc =
-      ChangeInt32ToIntPtr(Parameter(BuiltinDescriptor::kArgumentsCount));
+      ChangeInt32ToIntPtr(Parameter(Descriptor::kJSActualArgumentsCount));
   CodeStubArguments args(this, argc);
 
   Node* const receiver = args.GetReceiver();
   TNode<Object> start = args.GetOptionalArgumentValue(kStartArg);
   TNode<Object> length = args.GetOptionalArgumentValue(kLengthArg);
-  TNode<Context> context = CAST(Parameter(BuiltinDescriptor::kContext));
+  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
 
   Label out(this);
 
@@ -1887,7 +2063,7 @@ TF_BUILTIN(StringPrototypeSubstr, StringBuiltinsAssembler) {
     // two cases according to the spec: if it is negative, "" is returned; if
     // it is positive, then length is set to {string_length} - {start}.
 
-    CSA_ASSERT(this, IsHeapNumber(var_length.value()));
+    CSA_ASSERT(this, IsHeapNumber(CAST(var_length.value())));
 
     Label if_isnegative(this), if_ispositive(this);
     TNode<Float64T> const float_zero = Float64Constant(0.);
@@ -1979,34 +2155,34 @@ TF_BUILTIN(StringPrototypeSubstring, StringBuiltinsAssembler) {
   const int kEndArg = 1;
 
   Node* const argc =
-      ChangeInt32ToIntPtr(Parameter(BuiltinDescriptor::kArgumentsCount));
+      ChangeInt32ToIntPtr(Parameter(Descriptor::kJSActualArgumentsCount));
   CodeStubArguments args(this, argc);
 
   Node* const receiver = args.GetReceiver();
   Node* const start = args.GetOptionalArgumentValue(kStartArg);
   Node* const end = args.GetOptionalArgumentValue(kEndArg);
-  Node* const context = Parameter(BuiltinDescriptor::kContext);
+  Node* const context = Parameter(Descriptor::kContext);
 
   Label out(this);
 
-  VARIABLE(var_start, MachineRepresentation::kTagged);
-  VARIABLE(var_end, MachineRepresentation::kTagged);
+  TVARIABLE(Smi, var_start);
+  TVARIABLE(Smi, var_end);
 
   // Check that {receiver} is coercible to Object and convert it to a String.
   TNode<String> const string =
       ToThisString(context, receiver, "String.prototype.substring");
 
-  Node* const length = LoadStringLengthAsSmi(string);
+  TNode<Smi> const length = LoadStringLengthAsSmi(string);
 
   // Conversion and bounds-checks for {start}.
-  var_start.Bind(ToSmiBetweenZeroAnd(context, start, length));
+  var_start = ToSmiBetweenZeroAnd(context, start, length);
 
   // Conversion and bounds-checks for {end}.
   {
-    var_end.Bind(length);
+    var_end = length;
     GotoIf(IsUndefined(end), &out);
 
-    var_end.Bind(ToSmiBetweenZeroAnd(context, end, length));
+    var_end = ToSmiBetweenZeroAnd(context, end, length);
 
     Label if_endislessthanstart(this);
     Branch(SmiLessThan(var_end.value(), var_start.value()),
@@ -2014,9 +2190,9 @@ TF_BUILTIN(StringPrototypeSubstring, StringBuiltinsAssembler) {
 
     BIND(&if_endislessthanstart);
     {
-      Node* const tmp = var_end.value();
-      var_end.Bind(var_start.value());
-      var_start.Bind(tmp);
+      TNode<Smi> const tmp = var_end.value();
+      var_end = var_start.value();
+      var_start = tmp;
       Goto(&out);
     }
   }
@@ -2030,26 +2206,37 @@ TF_BUILTIN(StringPrototypeSubstring, StringBuiltinsAssembler) {
 
 // ES6 #sec-string.prototype.trim
 TF_BUILTIN(StringPrototypeTrim, StringTrimAssembler) {
-  Generate(String::kTrim, "String.prototype.trim");
+  TNode<IntPtrT> argc =
+      ChangeInt32ToIntPtr(Parameter(Descriptor::kJSActualArgumentsCount));
+  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
+
+  Generate(String::kTrim, "String.prototype.trim", argc, context);
 }
 
 // https://github.com/tc39/proposal-string-left-right-trim
 TF_BUILTIN(StringPrototypeTrimStart, StringTrimAssembler) {
-  Generate(String::kTrimStart, "String.prototype.trimLeft");
+  TNode<IntPtrT> argc =
+      ChangeInt32ToIntPtr(Parameter(Descriptor::kJSActualArgumentsCount));
+  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
+
+  Generate(String::kTrimStart, "String.prototype.trimLeft", argc, context);
 }
 
 // https://github.com/tc39/proposal-string-left-right-trim
 TF_BUILTIN(StringPrototypeTrimEnd, StringTrimAssembler) {
-  Generate(String::kTrimEnd, "String.prototype.trimRight");
+  TNode<IntPtrT> argc =
+      ChangeInt32ToIntPtr(Parameter(Descriptor::kJSActualArgumentsCount));
+  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
+
+  Generate(String::kTrimEnd, "String.prototype.trimRight", argc, context);
 }
 
 void StringTrimAssembler::Generate(String::TrimMode mode,
-                                   const char* method_name) {
+                                   const char* method_name, TNode<IntPtrT> argc,
+                                   TNode<Context> context) {
   Label return_emptystring(this), if_runtime(this);
 
-  Node* const argc = Parameter(BuiltinDescriptor::kArgumentsCount);
-  Node* const context = Parameter(BuiltinDescriptor::kContext);
-  CodeStubArguments arguments(this, ChangeInt32ToIntPtr(argc));
+  CodeStubArguments arguments(this, argc);
   Node* const receiver = arguments.GetReceiver();
 
   // Check that {receiver} is coercible to Object and convert it to a String.
diff --git a/deps/v8/src/builtins/builtins-string-gen.h b/deps/v8/src/builtins/builtins-string-gen.h
index 4147b3fc0c5202..06ac127f131328 100644
--- a/deps/v8/src/builtins/builtins-string-gen.h
+++ b/deps/v8/src/builtins/builtins-string-gen.h
@@ -74,12 +74,17 @@ class StringBuiltinsAssembler : public CodeStubAssembler {
   void StringIndexOf(Node* const subject_string, Node* const search_string,
                      Node* const position, std::function<void(Node*)> f_return);
 
-  Node* IndexOfDollarChar(Node* const context, Node* const string);
+  TNode<Smi> IndexOfDollarChar(Node* const context, Node* const string);
+
+  TNode<JSArray> StringToArray(TNode<Context> context,
+                               TNode<String> subject_string,
+                               TNode<Smi> subject_length,
+                               TNode<Number> limit_number);
 
   void RequireObjectCoercible(Node* const context, Node* const value,
                               const char* method_name);
 
-  Node* SmiIsNegative(Node* const value) {
+  TNode<BoolT> SmiIsNegative(TNode<Smi> value) {
     return SmiLessThan(value, SmiConstant(0));
   }
 
@@ -102,6 +107,9 @@ class StringBuiltinsAssembler : public CodeStubAssembler {
                                  Handle<Symbol> symbol,
                                  const NodeFunction0& regexp_call,
                                  const NodeFunction1& generic_call);
+
+  void Generate_StringAdd(StringAddFlags flags, PretenureFlag pretenure_flag,
+                          Node* context, Node* left, Node* right);
 };
 
 class StringIncludesIndexOfAssembler : public StringBuiltinsAssembler {
@@ -112,7 +120,8 @@ class StringIncludesIndexOfAssembler : public StringBuiltinsAssembler {
  protected:
   enum SearchVariant { kIncludes, kIndexOf };
 
-  void Generate(SearchVariant variant);
+  void Generate(SearchVariant variant, TNode<IntPtrT> argc,
+                TNode<Context> context);
 };
 
 class StringTrimAssembler : public StringBuiltinsAssembler {
@@ -124,7 +133,8 @@ class StringTrimAssembler : public StringBuiltinsAssembler {
                                            Label* const if_not_whitespace);
 
  protected:
-  void Generate(String::TrimMode mode, const char* method);
+  void Generate(String::TrimMode mode, const char* method, TNode<IntPtrT> argc,
+                TNode<Context> context);
 
   void ScanForNonWhiteSpaceOrLineTerminator(Node* const string_data,
                                             Node* const string_data_offset,
diff --git a/deps/v8/src/builtins/builtins-string.cc b/deps/v8/src/builtins/builtins-string.cc
index 854bb5e58a0417..b9f802e3f11ee3 100644
--- a/deps/v8/src/builtins/builtins-string.cc
+++ b/deps/v8/src/builtins/builtins-string.cc
@@ -52,7 +52,7 @@ uc32 NextCodePoint(Isolate* isolate, BuiltinArguments args, int index) {
 BUILTIN(StringFromCodePoint) {
   HandleScope scope(isolate);
   int const length = args.length() - 1;
-  if (length == 0) return isolate->heap()->empty_string();
+  if (length == 0) return ReadOnlyRoots(isolate).empty_string();
   DCHECK_LT(0, length);
 
   // Optimistically assume that the resulting String contains only one byte
@@ -64,7 +64,7 @@ BUILTIN(StringFromCodePoint) {
   for (index = 0; index < length; index++) {
     code = NextCodePoint(isolate, args, index);
     if (code < 0) {
-      return isolate->heap()->exception();
+      return ReadOnlyRoots(isolate).exception();
     }
     if (code > String::kMaxOneByteCharCode) {
       break;
@@ -94,7 +94,7 @@ BUILTIN(StringFromCodePoint) {
     }
     code = NextCodePoint(isolate, args, index);
     if (code < 0) {
-      return isolate->heap()->exception();
+      return ReadOnlyRoots(isolate).exception();
     }
   }
 
@@ -122,7 +122,7 @@ BUILTIN(StringPrototypeEndsWith) {
   Maybe<bool> is_reg_exp = RegExpUtils::IsRegExp(isolate, search);
   if (is_reg_exp.IsNothing()) {
     DCHECK(isolate->has_pending_exception());
-    return isolate->heap()->exception();
+    return ReadOnlyRoots(isolate).exception();
   }
   if (is_reg_exp.FromJust()) {
     THROW_NEW_ERROR_RETURN_FAILURE(
@@ -146,10 +146,10 @@ BUILTIN(StringPrototypeEndsWith) {
   }
 
   int start = end - search_string->length();
-  if (start < 0) return isolate->heap()->false_value();
+  if (start < 0) return ReadOnlyRoots(isolate).false_value();
 
-  str = String::Flatten(str);
-  search_string = String::Flatten(search_string);
+  str = String::Flatten(isolate, str);
+  search_string = String::Flatten(isolate, search_string);
 
   DisallowHeapAllocation no_gc;  // ensure vectors stay valid
   String::FlatContent str_content = str->GetFlatContent();
@@ -169,10 +169,10 @@ BUILTIN(StringPrototypeEndsWith) {
 
   for (int i = 0; i < search_string->length(); i++) {
     if (str_reader.Get(start + i) != search_reader.Get(i)) {
-      return isolate->heap()->false_value();
+      return ReadOnlyRoots(isolate).false_value();
     }
   }
-  return isolate->heap()->true_value();
+  return ReadOnlyRoots(isolate).true_value();
 }
 
 // ES6 section 21.1.3.9
@@ -219,8 +219,8 @@ BUILTIN(StringPrototypeLocaleCompare) {
   int d = str1->Get(0) - str2->Get(0);
   if (d != 0) return Smi::FromInt(d);
 
-  str1 = String::Flatten(str1);
-  str2 = String::Flatten(str2);
+  str1 = String::Flatten(isolate, str1);
+  str2 = String::Flatten(isolate, str2);
 
   DisallowHeapAllocation no_gc;
   String::FlatContent flat1 = str1->GetFlatContent();
@@ -252,13 +252,13 @@ BUILTIN(StringPrototypeNormalize) {
   ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, form,
                                      Object::ToString(isolate, form_input));
 
-  if (!(String::Equals(form,
+  if (!(String::Equals(isolate, form,
                        isolate->factory()->NewStringFromStaticChars("NFC")) ||
-        String::Equals(form,
+        String::Equals(isolate, form,
                        isolate->factory()->NewStringFromStaticChars("NFD")) ||
-        String::Equals(form,
+        String::Equals(isolate, form,
                        isolate->factory()->NewStringFromStaticChars("NFKC")) ||
-        String::Equals(form,
+        String::Equals(isolate, form,
                        isolate->factory()->NewStringFromStaticChars("NFKD")))) {
     Handle<String> valid_forms =
         isolate->factory()->NewStringFromStaticChars("NFC, NFD, NFKC, NFKD");
@@ -280,7 +280,7 @@ BUILTIN(StringPrototypeStartsWith) {
   Maybe<bool> is_reg_exp = RegExpUtils::IsRegExp(isolate, search);
   if (is_reg_exp.IsNothing()) {
     DCHECK(isolate->has_pending_exception());
-    return isolate->heap()->exception();
+    return ReadOnlyRoots(isolate).exception();
   }
   if (is_reg_exp.FromJust()) {
     THROW_NEW_ERROR_RETURN_FAILURE(
@@ -304,18 +304,19 @@ BUILTIN(StringPrototypeStartsWith) {
   }
 
   if (start + search_string->length() > str->length()) {
-    return isolate->heap()->false_value();
+    return ReadOnlyRoots(isolate).false_value();
   }
 
-  FlatStringReader str_reader(isolate, String::Flatten(str));
-  FlatStringReader search_reader(isolate, String::Flatten(search_string));
+  FlatStringReader str_reader(isolate, String::Flatten(isolate, str));
+  FlatStringReader search_reader(isolate,
+                                 String::Flatten(isolate, search_string));
 
   for (int i = 0; i < search_string->length(); i++) {
     if (str_reader.Get(start + i) != search_reader.Get(i)) {
-      return isolate->heap()->false_value();
+      return ReadOnlyRoots(isolate).false_value();
     }
   }
-  return isolate->heap()->true_value();
+  return ReadOnlyRoots(isolate).true_value();
 }
 
 #ifndef V8_INTL_SUPPORT
@@ -430,7 +431,7 @@ template <class Converter>
 V8_WARN_UNUSED_RESULT static Object* ConvertCase(
     Handle<String> s, Isolate* isolate,
     unibrow::Mapping<Converter, 128>* mapping) {
-  s = String::Flatten(s);
+  s = String::Flatten(isolate, s);
   int length = s->length();
   // Assume that the string is not empty; we need this assumption later
   if (length == 0) return *s;
diff --git a/deps/v8/src/builtins/builtins-symbol-gen.cc b/deps/v8/src/builtins/builtins-symbol-gen.cc
index 4015a2dcbab0fa..425fbab5d11998 100644
--- a/deps/v8/src/builtins/builtins-symbol-gen.cc
+++ b/deps/v8/src/builtins/builtins-symbol-gen.cc
@@ -11,6 +11,16 @@ namespace internal {
 
 // -----------------------------------------------------------------------------
 // ES6 #sec-symbol-objects
+// ES ##sec-symbol.prototype.description
+TF_BUILTIN(SymbolPrototypeDescriptionGetter, CodeStubAssembler) {
+  Node* context = Parameter(Descriptor::kContext);
+  Node* receiver = Parameter(Descriptor::kReceiver);
+
+  Node* value = ToThisValue(context, receiver, PrimitiveType::kSymbol,
+                            "Symbol.prototype.description");
+  Node* result = LoadObjectField(value, Symbol::kNameOffset);
+  Return(result);
+}
 
 // ES6 #sec-symbol.prototype-@@toprimitive
 TF_BUILTIN(SymbolPrototypeToPrimitive, CodeStubAssembler) {
diff --git a/deps/v8/src/builtins/builtins-symbol.cc b/deps/v8/src/builtins/builtins-symbol.cc
index 1343a293bd8df8..9ebb8c499dd6dd 100644
--- a/deps/v8/src/builtins/builtins-symbol.cc
+++ b/deps/v8/src/builtins/builtins-symbol.cc
@@ -57,7 +57,7 @@ BUILTIN(SymbolKeyFor) {
     result = symbol->name();
     DCHECK(result->IsString());
   } else {
-    result = isolate->heap()->undefined_value();
+    result = ReadOnlyRoots(isolate).undefined_value();
   }
   DCHECK_EQ(isolate->heap()->public_symbol_table()->SlowReverseLookup(*symbol),
             result);
diff --git a/deps/v8/src/builtins/builtins-test-gen.h b/deps/v8/src/builtins/builtins-test-gen.h
new file mode 100644
index 00000000000000..5412beb9bdad68
--- /dev/null
+++ b/deps/v8/src/builtins/builtins-test-gen.h
@@ -0,0 +1,22 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef V8_BUILTINS_BUILTINS_TEST_GEN_H_
+#define V8_BUILTINS_BUILTINS_TEST_GEN_H_
+
+#include "torque-generated/builtins-base-from-dsl-gen.h"
+
+namespace v8 {
+namespace internal {
+
+class TestBuiltinsAssembler : public BaseBuiltinsFromDSLAssembler {
+ public:
+  explicit TestBuiltinsAssembler(compiler::CodeAssemblerState* state)
+      : BaseBuiltinsFromDSLAssembler(state) {}
+};
+
+}  // namespace internal
+}  // namespace v8
+
+#endif  // V8_BUILTINS_BUILTINS_TEST_GEN_H_
diff --git a/deps/v8/src/builtins/builtins-typedarray-gen.cc b/deps/v8/src/builtins/builtins-typed-array-gen.cc
similarity index 88%
rename from deps/v8/src/builtins/builtins-typedarray-gen.cc
rename to deps/v8/src/builtins/builtins-typed-array-gen.cc
index e5ac615cca58d6..595ec1f97bedb6 100644
--- a/deps/v8/src/builtins/builtins-typedarray-gen.cc
+++ b/deps/v8/src/builtins/builtins-typed-array-gen.cc
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#include "src/builtins/builtins-typedarray-gen.h"
+#include "src/builtins/builtins-typed-array-gen.h"
 
 #include "src/builtins/builtins-constructor-gen.h"
 #include "src/builtins/builtins-iterator-gen.h"
@@ -36,7 +36,8 @@ TNode<Map> TypedArrayBuiltinsAssembler::LoadMapForType(
   DispatchTypedArrayByElementsKind(
       elements_kind,
       [&](ElementsKind kind, int size, int typed_array_fun_index) {
-        Handle<Map> map(isolate()->heap()->MapForFixedTypedArray(kind));
+        Handle<Map> map(isolate()->heap()->MapForFixedTypedArray(kind),
+                        isolate());
         var_typed_map = HeapConstant(map);
       });
 
@@ -122,6 +123,8 @@ TF_BUILTIN(TypedArrayInitialize, TypedArrayBuiltinsAssembler) {
   TNode<Smi> length = CAST(Parameter(Descriptor::kLength));
   TNode<Smi> element_size = CAST(Parameter(Descriptor::kElementSize));
   Node* initialize = Parameter(Descriptor::kInitialize);
+  TNode<JSReceiver> buffer_constructor =
+      CAST(Parameter(Descriptor::kBufferConstructor));
   TNode<Context> context = CAST(Parameter(Descriptor::kContext));
 
   CSA_ASSERT(this, TaggedIsPositiveSmi(length));
@@ -135,6 +138,7 @@ TF_BUILTIN(TypedArrayInitialize, TypedArrayBuiltinsAssembler) {
 
   Label setup_holder(this), allocate_on_heap(this), aligned(this),
       allocate_elements(this), allocate_off_heap(this),
+      allocate_off_heap_custom_constructor(this),
       allocate_off_heap_no_init(this), attach_buffer(this), done(this);
   TVARIABLE(IntPtrT, var_total_size);
 
@@ -144,8 +148,15 @@ TF_BUILTIN(TypedArrayInitialize, TypedArrayBuiltinsAssembler) {
   SetupTypedArray(holder, length, byte_offset, byte_length);
 
   TNode<Map> fixed_typed_map = LoadMapForType(holder);
+
+  // If target and new_target for the buffer differ, allocate off-heap.
+  TNode<JSFunction> default_constructor = CAST(LoadContextElement(
+      LoadNativeContext(context), Context::ARRAY_BUFFER_FUN_INDEX));
+  GotoIfNot(WordEqual(buffer_constructor, default_constructor),
+            &allocate_off_heap_custom_constructor);
+
+  // For buffers with byte_length over the threshold, allocate off-heap.
   GotoIf(TaggedIsNotSmi(byte_length), &allocate_off_heap);
-  // The goto above ensures that byte_length is a Smi.
   TNode<Smi> smi_byte_length = CAST(byte_length);
   GotoIf(SmiGreaterThan(smi_byte_length,
                         SmiConstant(V8_TYPED_ARRAY_MAX_SIZE_IN_HEAP)),
@@ -195,8 +206,10 @@ TF_BUILTIN(TypedArrayInitialize, TypedArrayBuiltinsAssembler) {
     StoreObjectField(holder, JSArrayBufferView::kBufferOffset, buffer);
 
     // Check the alignment.
-    GotoIf(SmiEqual(SmiMod(element_size, SmiConstant(kObjectAlignment)),
-                    SmiConstant(0)),
+    // TODO(ishell): remove <Object, Object>
+    GotoIf(WordEqual<Object, Object>(
+               SmiMod(element_size, SmiConstant(kObjectAlignment)),
+               SmiConstant(0)),
            &aligned);
 
     // Fix alignment if needed.
@@ -247,8 +260,7 @@ TF_BUILTIN(TypedArrayInitialize, TypedArrayBuiltinsAssembler) {
     Node* backing_store = IntPtrAdd(BitcastTaggedToWord(elements),
                                     IntPtrConstant(fta_base_data_offset));
     // Call out to memset to perform initialization.
-    Node* memset =
-        ExternalConstant(ExternalReference::libc_memset_function(isolate()));
+    Node* memset = ExternalConstant(ExternalReference::libc_memset_function());
     CallCFunction3(MachineType::AnyTagged(), MachineType::Pointer(),
                    MachineType::IntPtr(), MachineType::UintPtr(), memset,
                    backing_store, IntPtrConstant(0), word_byte_length);
@@ -260,11 +272,17 @@ TF_BUILTIN(TypedArrayInitialize, TypedArrayBuiltinsAssembler) {
   BIND(&allocate_off_heap);
   {
     GotoIf(IsFalse(initialize), &allocate_off_heap_no_init);
-
-    Node* buffer_constructor = LoadContextElement(
-        LoadNativeContext(context), Context::ARRAY_BUFFER_FUN_INDEX);
     var_buffer = CAST(ConstructJS(CodeFactory::Construct(isolate()), context,
-                                  buffer_constructor, byte_length));
+                                  default_constructor, byte_length));
+    Goto(&attach_buffer);
+  }
+
+  BIND(&allocate_off_heap_custom_constructor);
+  {
+    var_buffer =
+        CAST(CallStub(CodeFactory::Construct(isolate()), context,
+                      default_constructor, buffer_constructor, Int32Constant(1),
+                      UndefinedConstant(), byte_length));
     Goto(&attach_buffer);
   }
 
@@ -310,8 +328,10 @@ void TypedArrayBuiltinsAssembler::ConstructByLength(TNode<Context> context,
   GotoIf(SmiLessThan(smi_converted_length, SmiConstant(0)), &invalid_length);
 
   Node* initialize = TrueConstant();
+  TNode<JSFunction> default_constructor = CAST(LoadContextElement(
+      LoadNativeContext(context), Context::ARRAY_BUFFER_FUN_INDEX));
   CallBuiltin(Builtins::kTypedArrayInitialize, context, holder,
-              converted_length, element_size, initialize);
+              converted_length, element_size, initialize, default_constructor);
   Goto(&done);
 
   BIND(&invalid_length);
@@ -350,10 +370,12 @@ void TypedArrayBuiltinsAssembler::ConstructByArrayBuffer(
   // Check that the offset is a multiple of the element size.
   BIND(&offset_is_smi);
   {
-    GotoIf(SmiEqual(offset.value(), SmiConstant(0)), &check_length);
-    GotoIf(SmiLessThan(offset.value(), SmiConstant(0)), &invalid_length);
-    Node* remainder = SmiMod(offset.value(), element_size);
-    Branch(SmiEqual(remainder, SmiConstant(0)), &check_length,
+    TNode<Smi> smi_offset = CAST(offset.value());
+    GotoIf(SmiEqual(smi_offset, SmiConstant(0)), &check_length);
+    GotoIf(SmiLessThan(smi_offset, SmiConstant(0)), &invalid_length);
+    TNode<Number> remainder = SmiMod(smi_offset, element_size);
+    // TODO(ishell): remove <Object, Object>
+    Branch(WordEqual<Object, Object>(remainder, SmiConstant(0)), &check_length,
            &start_offset_error);
   }
   BIND(&offset_not_smi);
@@ -481,8 +503,7 @@ void TypedArrayBuiltinsAssembler::ConstructByTypedArray(
   Goto(&check_for_sab);
 
   BIND(&if_notdetached);
-  source_length =
-      CAST(LoadObjectField(typed_array, JSTypedArray::kLengthOffset));
+  source_length = LoadTypedArrayLength(typed_array);
   Goto(&check_for_sab);
 
   // The spec requires that constructing a typed array using a SAB-backed typed
@@ -507,14 +528,7 @@ void TypedArrayBuiltinsAssembler::ConstructByTypedArray(
   BIND(&construct);
   {
     ConstructByArrayLike(context, holder, typed_array, source_length.value(),
-                         element_size);
-    TNode<Object> proto = GetProperty(context, buffer_constructor.value(),
-                                      PrototypeStringConstant());
-    // TODO(petermarshall): Correct for realm as per 9.1.14 step 4.
-    TNode<JSArrayBuffer> buffer = LoadObjectField<JSArrayBuffer>(
-        holder, JSArrayBufferView::kBufferOffset);
-    CallRuntime(Runtime::kInternalSetPrototype, context, buffer, proto);
-
+                         element_size, buffer_constructor.value());
     Goto(&done);
   }
 
@@ -554,22 +568,30 @@ TNode<BoolT> TypedArrayBuiltinsAssembler::ByteLengthIsValid(
 void TypedArrayBuiltinsAssembler::ConstructByArrayLike(
     TNode<Context> context, TNode<JSTypedArray> holder,
     TNode<HeapObject> array_like, TNode<Object> initial_length,
-    TNode<Smi> element_size) {
-  Node* initialize = FalseConstant();
-
-  Label invalid_length(this), fill(this), fast_copy(this), done(this);
+    TNode<Smi> element_size, TNode<JSReceiver> buffer_constructor) {
+  Label invalid_length(this, Label::kDeferred), fill(this), fast_copy(this),
+      detached_check(this), done(this), detached_error(this, Label::kDeferred);
 
   // The caller has looked up length on array_like, which is observable.
   TNode<Smi> length = ToSmiLength(initial_length, context, &invalid_length);
 
+  Node* initialize = FalseConstant();
   CallBuiltin(Builtins::kTypedArrayInitialize, context, holder, length,
-              element_size, initialize);
-  GotoIf(SmiNotEqual(length, SmiConstant(0)), &fill);
-  Goto(&done);
+              element_size, initialize, buffer_constructor);
+
+  GotoIf(IsJSTypedArray(array_like), &detached_check);
+  Goto(&fill);
+
+  BIND(&detached_check);
+  GotoIf(IsDetachedBuffer(
+             LoadObjectField(array_like, JSTypedArray::kBufferOffset)),
+         &detached_error);
+  Goto(&fill);
 
   BIND(&fill);
-  TNode<Int32T> holder_kind = LoadMapElementsKind(LoadMap(holder));
-  TNode<Int32T> source_kind = LoadMapElementsKind(LoadMap(array_like));
+  GotoIf(SmiEqual(length, SmiConstant(0)), &done);
+  TNode<Int32T> holder_kind = LoadElementsKind(holder);
+  TNode<Int32T> source_kind = LoadElementsKind(array_like);
   GotoIf(Word32Equal(holder_kind, source_kind), &fast_copy);
 
   // Copy using the elements accessor.
@@ -597,14 +619,16 @@ void TypedArrayBuiltinsAssembler::ConstructByArrayLike(
                          byte_length_intptr,
                          IntPtrConstant(FixedTypedArrayBase::kMaxByteLength)));
 
-    Node* memcpy =
-        ExternalConstant(ExternalReference::libc_memcpy_function(isolate()));
+    Node* memcpy = ExternalConstant(ExternalReference::libc_memcpy_function());
     CallCFunction3(MachineType::AnyTagged(), MachineType::Pointer(),
                    MachineType::Pointer(), MachineType::UintPtr(), memcpy,
                    holder_data_ptr, source_data_ptr, byte_length_intptr);
     Goto(&done);
   }
 
+  BIND(&detached_error);
+  { ThrowTypeError(context, MessageTemplate::kDetachedOperation, "Construct"); }
+
   BIND(&invalid_length);
   {
     ThrowRangeError(context, MessageTemplate::kInvalidTypedArrayLength,
@@ -616,16 +640,19 @@ void TypedArrayBuiltinsAssembler::ConstructByArrayLike(
 
 void TypedArrayBuiltinsAssembler::ConstructByIterable(
     TNode<Context> context, TNode<JSTypedArray> holder,
-    TNode<JSReceiver> iterable, TNode<Object> iterator_fn,
+    TNode<JSReceiver> iterable, TNode<JSReceiver> iterator_fn,
     TNode<Smi> element_size) {
-  CSA_ASSERT(this, IsCallable(iterator_fn));
   Label fast_path(this), slow_path(this), done(this);
+  CSA_ASSERT(this, IsCallable(iterator_fn));
 
   TNode<JSArray> array_like = CAST(
       CallBuiltin(Builtins::kIterableToList, context, iterable, iterator_fn));
   TNode<Object> initial_length = LoadJSArrayLength(array_like);
+
+  TNode<JSFunction> default_constructor = CAST(LoadContextElement(
+      LoadNativeContext(context), Context::ARRAY_BUFFER_FUN_INDEX));
   ConstructByArrayLike(context, holder, array_like, initial_length,
-                       element_size);
+                       element_size, default_constructor);
 }
 
 TF_BUILTIN(TypedArrayBaseConstructor, TypedArrayBuiltinsAssembler) {
@@ -657,9 +684,10 @@ TF_BUILTIN(CreateTypedArray, TypedArrayBuiltinsAssembler) {
       SmiTag(GetTypedArrayElementSize(LoadElementsKind(result)));
 
   GotoIf(TaggedIsSmi(arg1), &if_arg1isnumber);
-  GotoIf(IsJSArrayBuffer(arg1), &if_arg1isbuffer);
-  GotoIf(IsJSTypedArray(arg1), &if_arg1istypedarray);
-  GotoIf(IsJSReceiver(arg1), &if_arg1isreceiver);
+  TNode<HeapObject> arg1_heap_object = UncheckedCast<HeapObject>(arg1);
+  GotoIf(IsJSArrayBuffer(arg1_heap_object), &if_arg1isbuffer);
+  GotoIf(IsJSTypedArray(arg1_heap_object), &if_arg1istypedarray);
+  GotoIf(IsJSReceiver(arg1_heap_object), &if_arg1isreceiver);
   Goto(&if_arg1isnumber);
 
   // https://tc39.github.io/ecma262/#sec-typedarray-buffer-byteoffset-length
@@ -673,7 +701,7 @@ TF_BUILTIN(CreateTypedArray, TypedArrayBuiltinsAssembler) {
   // https://tc39.github.io/ecma262/#sec-typedarray-typedarray
   BIND(&if_arg1istypedarray);
   {
-    TNode<JSTypedArray> typed_array = CAST(arg1);
+    TNode<JSTypedArray> typed_array = CAST(arg1_heap_object);
     ConstructByTypedArray(context, result, typed_array, element_size);
     Goto(&return_result);
   }
@@ -683,23 +711,26 @@ TF_BUILTIN(CreateTypedArray, TypedArrayBuiltinsAssembler) {
   {
     Label if_iteratorundefined(this), if_iteratornotcallable(this);
     // Get iterator symbol
-    TNode<Object> iteratorFn =
-        CAST(GetMethod(context, arg1, isolate()->factory()->iterator_symbol(),
-                       &if_iteratorundefined));
+    TNode<Object> iteratorFn = CAST(GetMethod(
+        context, arg1_heap_object, isolate()->factory()->iterator_symbol(),
+        &if_iteratorundefined));
     GotoIf(TaggedIsSmi(iteratorFn), &if_iteratornotcallable);
-    GotoIfNot(IsCallable(iteratorFn), &if_iteratornotcallable);
+    GotoIfNot(IsCallable(CAST(iteratorFn)), &if_iteratornotcallable);
 
-    ConstructByIterable(context, result, CAST(arg1), iteratorFn, element_size);
+    ConstructByIterable(context, result, CAST(arg1_heap_object),
+                        CAST(iteratorFn), element_size);
     Goto(&return_result);
 
     BIND(&if_iteratorundefined);
     {
-      TNode<HeapObject> array_like = CAST(arg1);
+      TNode<HeapObject> array_like = arg1_heap_object;
       TNode<Object> initial_length =
           GetProperty(context, arg1, LengthStringConstant());
 
+      TNode<JSFunction> default_constructor = CAST(LoadContextElement(
+          LoadNativeContext(context), Context::ARRAY_BUFFER_FUN_INDEX));
       ConstructByArrayLike(context, result, array_like, initial_length,
-                           element_size);
+                           element_size, default_constructor);
       Goto(&return_result);
     }
 
@@ -727,12 +758,11 @@ TF_BUILTIN(TypedArrayConstructorLazyDeoptContinuation,
 
 // ES #sec-typedarray-constructors
 TF_BUILTIN(TypedArrayConstructor, TypedArrayBuiltinsAssembler) {
-  Node* context = Parameter(BuiltinDescriptor::kContext);
-  Node* target = LoadFromFrame(StandardFrameConstants::kFunctionOffset,
-                               MachineType::TaggedPointer());
-  Node* new_target = Parameter(BuiltinDescriptor::kNewTarget);
+  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
+  TNode<JSFunction> target = CAST(Parameter(Descriptor::kJSTarget));
+  TNode<Object> new_target = CAST(Parameter(Descriptor::kJSNewTarget));
   Node* argc =
-      ChangeInt32ToIntPtr(Parameter(BuiltinDescriptor::kArgumentsCount));
+      ChangeInt32ToIntPtr(Parameter(Descriptor::kJSActualArgumentsCount));
   CodeStubArguments args(this, argc);
   Node* arg1 = args.GetOptionalArgumentValue(0);
   Node* arg2 = args.GetOptionalArgumentValue(1);
@@ -750,7 +780,8 @@ TF_BUILTIN(TypedArrayConstructor, TypedArrayBuiltinsAssembler) {
 
   BIND(&throwtypeerror);
   {
-    Node* name = CallRuntime(Runtime::kGetFunctionName, context, target);
+    TNode<String> name =
+        CAST(CallRuntime(Runtime::kGetFunctionName, context, target));
     ThrowTypeError(context, MessageTemplate::kConstructorNotFunction, name);
   }
 }
@@ -823,11 +854,6 @@ TNode<Word32T> TypedArrayBuiltinsAssembler::IsBigInt64ElementsKind(
                   Word32Equal(kind, Int32Constant(BIGUINT64_ELEMENTS)));
 }
 
-TNode<Word32T> TypedArrayBuiltinsAssembler::LoadElementsKind(
-    TNode<JSTypedArray> typed_array) {
-  return LoadMapElementsKind(LoadMap(typed_array));
-}
-
 TNode<IntPtrT> TypedArrayBuiltinsAssembler::GetTypedArrayElementSize(
     TNode<Word32T> elements_kind) {
   TVARIABLE(IntPtrT, element_size);
@@ -899,9 +925,8 @@ TNode<JSTypedArray> TypedArrayBuiltinsAssembler::SpeciesCreateByLength(
   CSA_ASSERT(this, TaggedIsPositiveSmi(len));
 
   // Let constructor be ? SpeciesConstructor(exemplar, defaultConstructor).
-  TNode<Object> constructor = TypedArraySpeciesConstructor(context, exemplar);
-  CSA_ASSERT(this, IsJSFunction(constructor));
-
+  TNode<HeapObject> constructor =
+      CAST(TypedArraySpeciesConstructor(context, exemplar));
   return CreateByLength(context, constructor, len, method_name);
 }
 
@@ -919,8 +944,7 @@ TNode<JSTypedArray> TypedArrayBuiltinsAssembler::CreateByLength(
   // If newTypedArray.[[ArrayLength]] < argumentList[0], throw a TypeError
   // exception.
   Label if_length_is_not_short(this);
-  TNode<Smi> new_length =
-      LoadObjectField<Smi>(new_typed_array, JSTypedArray::kLengthOffset);
+  TNode<Smi> new_length = LoadTypedArrayLength(new_typed_array);
   GotoIfNot(SmiLessThan(new_length, len), &if_length_is_not_short);
   ThrowTypeError(context, MessageTemplate::kTypedArrayTooShort);
 
@@ -982,10 +1006,8 @@ void TypedArrayBuiltinsAssembler::SetTypedArraySource(
 
   // Check for possible range errors.
 
-  TNode<IntPtrT> source_length =
-      LoadAndUntagObjectField(source, JSTypedArray::kLengthOffset);
-  TNode<IntPtrT> target_length =
-      LoadAndUntagObjectField(target, JSTypedArray::kLengthOffset);
+  TNode<IntPtrT> source_length = SmiUntag(LoadTypedArrayLength(source));
+  TNode<IntPtrT> target_length = SmiUntag(LoadTypedArrayLength(target));
   TNode<IntPtrT> required_target_length = IntPtrAdd(source_length, offset);
 
   GotoIf(IntPtrGreaterThan(required_target_length, target_length),
@@ -1035,8 +1057,7 @@ void TypedArrayBuiltinsAssembler::SetTypedArraySource(
                           IsBigInt64ElementsKind(target_el_kind)),
            &exception);
 
-    TNode<IntPtrT> source_length =
-        LoadAndUntagObjectField(source, JSTypedArray::kLengthOffset);
+    TNode<IntPtrT> source_length = SmiUntag(LoadTypedArrayLength(source));
     CallCCopyTypedArrayElementsToTypedArray(source, target, source_length,
                                             offset);
     Goto(&out);
@@ -1057,8 +1078,7 @@ void TypedArrayBuiltinsAssembler::SetJSArraySource(
              IntPtrLessThanOrEqual(offset, IntPtrConstant(Smi::kMaxValue)));
 
   TNode<IntPtrT> source_length = SmiUntag(LoadFastJSArrayLength(source));
-  TNode<IntPtrT> target_length =
-      LoadAndUntagObjectField(target, JSTypedArray::kLengthOffset);
+  TNode<IntPtrT> target_length = SmiUntag(LoadTypedArrayLength(target));
 
   // Maybe out of bounds?
   GotoIf(IntPtrGreaterThan(IntPtrAdd(source_length, offset), target_length),
@@ -1080,7 +1100,7 @@ void TypedArrayBuiltinsAssembler::SetJSArraySource(
     };
     STATIC_ASSERT(arraysize(values) == arraysize(labels));
 
-    TNode<Int32T> source_elements_kind = LoadMapElementsKind(LoadMap(source));
+    TNode<Int32T> source_elements_kind = LoadElementsKind(source);
     Switch(source_elements_kind, call_runtime, values, labels,
            arraysize(values));
   }
@@ -1097,7 +1117,7 @@ void TypedArrayBuiltinsAssembler::CallCMemmove(TNode<IntPtrT> dest_ptr,
                                                TNode<IntPtrT> src_ptr,
                                                TNode<IntPtrT> byte_length) {
   TNode<ExternalReference> memmove =
-      ExternalConstant(ExternalReference::libc_memmove_function(isolate()));
+      ExternalConstant(ExternalReference::libc_memmove_function());
   CallCFunction3(MachineType::AnyTagged(), MachineType::Pointer(),
                  MachineType::Pointer(), MachineType::UintPtr(), memmove,
                  dest_ptr, src_ptr, byte_length);
@@ -1111,8 +1131,7 @@ void TypedArrayBuiltinsAssembler::
                                                    TNode<IntPtrT> offset) {
   CSA_ASSERT(this, Word32Not(IsBigInt64ElementsKind(LoadElementsKind(dest))));
   TNode<ExternalReference> f = ExternalConstant(
-      ExternalReference::copy_fast_number_jsarray_elements_to_typed_array(
-          isolate()));
+      ExternalReference::copy_fast_number_jsarray_elements_to_typed_array());
   CallCFunction5(MachineType::AnyTagged(), MachineType::AnyTagged(),
                  MachineType::AnyTagged(), MachineType::AnyTagged(),
                  MachineType::UintPtr(), MachineType::UintPtr(), f, context,
@@ -1123,7 +1142,7 @@ void TypedArrayBuiltinsAssembler::CallCCopyTypedArrayElementsToTypedArray(
     TNode<JSTypedArray> source, TNode<JSTypedArray> dest,
     TNode<IntPtrT> source_length, TNode<IntPtrT> offset) {
   TNode<ExternalReference> f = ExternalConstant(
-      ExternalReference::copy_typed_array_elements_to_typed_array(isolate()));
+      ExternalReference::copy_typed_array_elements_to_typed_array());
   CallCFunction4(MachineType::AnyTagged(), MachineType::AnyTagged(),
                  MachineType::AnyTagged(), MachineType::UintPtr(),
                  MachineType::UintPtr(), f, source, dest, source_length,
@@ -1133,8 +1152,8 @@ void TypedArrayBuiltinsAssembler::CallCCopyTypedArrayElementsToTypedArray(
 void TypedArrayBuiltinsAssembler::CallCCopyTypedArrayElementsSlice(
     TNode<JSTypedArray> source, TNode<JSTypedArray> dest, TNode<IntPtrT> start,
     TNode<IntPtrT> end) {
-  TNode<ExternalReference> f = ExternalConstant(
-      ExternalReference::copy_typed_array_elements_slice(isolate()));
+  TNode<ExternalReference> f =
+      ExternalConstant(ExternalReference::copy_typed_array_elements_slice());
   CallCFunction4(MachineType::AnyTagged(), MachineType::AnyTagged(),
                  MachineType::AnyTagged(), MachineType::UintPtr(),
                  MachineType::UintPtr(), f, source, dest, start, end);
@@ -1182,9 +1201,10 @@ void TypedArrayBuiltinsAssembler::DispatchTypedArrayByElementsKind(
 
 // ES #sec-get-%typedarray%.prototype.set
 TF_BUILTIN(TypedArrayPrototypeSet, TypedArrayBuiltinsAssembler) {
-  TNode<Context> context = CAST(Parameter(BuiltinDescriptor::kContext));
+  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
   CodeStubArguments args(
-      this, ChangeInt32ToIntPtr(Parameter(BuiltinDescriptor::kArgumentsCount)));
+      this,
+      ChangeInt32ToIntPtr(Parameter(Descriptor::kJSActualArgumentsCount)));
 
   Label if_source_is_typed_array(this), if_source_is_fast_jsarray(this),
       if_offset_is_out_of_bounds(this, Label::kDeferred),
@@ -1195,7 +1215,7 @@ TF_BUILTIN(TypedArrayPrototypeSet, TypedArrayBuiltinsAssembler) {
   // Check the receiver is a typed array.
   TNode<Object> receiver = args.GetReceiver();
   GotoIf(TaggedIsSmi(receiver), &if_receiver_is_not_typedarray);
-  GotoIfNot(IsJSTypedArray(receiver), &if_receiver_is_not_typedarray);
+  GotoIfNot(IsJSTypedArray(CAST(receiver)), &if_receiver_is_not_typedarray);
 
   // Normalize offset argument (using ToInteger) and handle heap number cases.
   TNode<Object> offset = args.GetOptionalArgumentValue(1, SmiConstant(0));
@@ -1221,7 +1241,7 @@ TF_BUILTIN(TypedArrayPrototypeSet, TypedArrayBuiltinsAssembler) {
   Label call_runtime(this);
   TNode<Object> source = args.GetOptionalArgumentValue(0);
   GotoIf(TaggedIsSmi(source), &call_runtime);
-  GotoIf(IsJSTypedArray(source), &if_source_is_typed_array);
+  GotoIf(IsJSTypedArray(CAST(source)), &if_source_is_typed_array);
   BranchIfFastJSArray(source, context, &if_source_is_fast_jsarray,
                       &call_runtime);
 
@@ -1272,16 +1292,16 @@ TF_BUILTIN(TypedArrayPrototypeSlice, TypedArrayBuiltinsAssembler) {
       if_typed_array_is_neutered(this, Label::kDeferred),
       if_bigint_mixed_types(this, Label::kDeferred);
 
-  TNode<Context> context = CAST(Parameter(BuiltinDescriptor::kContext));
+  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
   CodeStubArguments args(
-      this, ChangeInt32ToIntPtr(Parameter(BuiltinDescriptor::kArgumentsCount)));
+      this,
+      ChangeInt32ToIntPtr(Parameter(Descriptor::kJSActualArgumentsCount)));
 
   TNode<Object> receiver = args.GetReceiver();
   TNode<JSTypedArray> source =
       ValidateTypedArray(context, receiver, method_name);
 
-  TNode<Smi> source_length =
-      LoadObjectField<Smi>(source, JSTypedArray::kLengthOffset);
+  TNode<Smi> source_length = LoadTypedArrayLength(source);
 
   // Convert start offset argument to integer, and calculate relative offset.
   TNode<Object> start = args.GetOptionalArgumentValue(0, SmiConstant(0));
@@ -1347,15 +1367,24 @@ TF_BUILTIN(TypedArrayPrototypeSlice, TypedArrayBuiltinsAssembler) {
     TNode<IntPtrT> count_bytes = IntPtrMul(SmiToIntPtr(count), source_el_size);
 
 #ifdef DEBUG
-    TNode<IntPtrT> target_byte_length =
-        LoadAndUntagObjectField(result_array, JSTypedArray::kByteLengthOffset);
+    Label done(this), to_intptr_failed(this, Label::kDeferred);
+    TNode<IntPtrT> target_byte_length = TryToIntptr(
+        LoadObjectField<Number>(result_array, JSTypedArray::kByteLengthOffset),
+        &to_intptr_failed);
     CSA_ASSERT(this, IntPtrLessThanOrEqual(count_bytes, target_byte_length));
 
-    TNode<IntPtrT> source_byte_length =
-        LoadAndUntagObjectField(source, JSTypedArray::kByteLengthOffset);
+    TNode<IntPtrT> source_byte_length = TryToIntptr(
+        LoadObjectField<Number>(source, JSTypedArray::kByteLengthOffset),
+        &to_intptr_failed);
     TNode<IntPtrT> source_size_in_bytes =
         IntPtrSub(source_byte_length, source_start_bytes);
     CSA_ASSERT(this, IntPtrLessThanOrEqual(count_bytes, source_size_in_bytes));
+    Goto(&done);
+
+    BIND(&to_intptr_failed);
+    Unreachable();
+
+    BIND(&done);
 #endif  // DEBUG
 
     CallCMemmove(target_data_ptr, source_start, count_bytes);
@@ -1388,9 +1417,10 @@ TF_BUILTIN(TypedArrayPrototypeSubArray, TypedArrayBuiltinsAssembler) {
   TVARIABLE(Smi, var_begin);
   TVARIABLE(Smi, var_end);
 
-  TNode<Context> context = CAST(Parameter(BuiltinDescriptor::kContext));
+  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
   CodeStubArguments args(
-      this, ChangeInt32ToIntPtr(Parameter(BuiltinDescriptor::kArgumentsCount)));
+      this,
+      ChangeInt32ToIntPtr(Parameter(Descriptor::kJSActualArgumentsCount)));
 
   // 1. Let O be the this value.
   // 3. If O does not have a [[TypedArrayName]] internal slot, throw a TypeError
@@ -1403,8 +1433,7 @@ TF_BUILTIN(TypedArrayPrototypeSubArray, TypedArrayBuiltinsAssembler) {
   // 5. Let buffer be O.[[ViewedArrayBuffer]].
   TNode<JSArrayBuffer> buffer = GetBuffer(context, source);
   // 6. Let srcLength be O.[[ArrayLength]].
-  TNode<Smi> source_length =
-      LoadObjectField<Smi>(source, JSTypedArray::kLengthOffset);
+  TNode<Smi> source_length = LoadTypedArrayLength(source);
 
   // 7. Let relativeBegin be ? ToInteger(begin).
   // 8. If relativeBegin < 0, let beginIndex be max((srcLength + relativeBegin),
@@ -1485,7 +1514,7 @@ TF_BUILTIN(TypedArrayPrototypeToStringTag, TypedArrayBuiltinsAssembler) {
   // performance.
   BIND(&if_receiverisheapobject);
   Node* elements_kind =
-      Int32Sub(LoadMapElementsKind(LoadMap(receiver)),
+      Int32Sub(LoadElementsKind(receiver),
                Int32Constant(FIRST_FIXED_TYPED_ARRAY_ELEMENTS_KIND));
   Switch(elements_kind, &return_undefined, elements_kinds, elements_kind_labels,
          kTypedElementsKindCount);
@@ -1495,16 +1524,16 @@ TF_BUILTIN(TypedArrayPrototypeToStringTag, TypedArrayBuiltinsAssembler) {
 }
 
 void TypedArrayBuiltinsAssembler::GenerateTypedArrayPrototypeIterationMethod(
-    Node* context, Node* receiver, const char* method_name,
+    TNode<Context> context, TNode<Object> receiver, const char* method_name,
     IterationKind kind) {
   Label throw_bad_receiver(this, Label::kDeferred);
 
   GotoIf(TaggedIsSmi(receiver), &throw_bad_receiver);
-  GotoIfNot(IsJSTypedArray(receiver), &throw_bad_receiver);
+  GotoIfNot(IsJSTypedArray(CAST(receiver)), &throw_bad_receiver);
 
   // Check if the {receiver}'s JSArrayBuffer was neutered.
-  Node* receiver_buffer =
-      LoadObjectField(receiver, JSTypedArray::kBufferOffset);
+  TNode<JSArrayBuffer> receiver_buffer = LoadObjectField<JSArrayBuffer>(
+      CAST(receiver), JSTypedArray::kBufferOffset);
   Label if_receiverisneutered(this, Label::kDeferred);
   GotoIf(IsDetachedBuffer(receiver_buffer), &if_receiverisneutered);
 
@@ -1519,8 +1548,8 @@ void TypedArrayBuiltinsAssembler::GenerateTypedArrayPrototypeIterationMethod(
 
 // ES #sec-%typedarray%.prototype.values
 TF_BUILTIN(TypedArrayPrototypeValues, TypedArrayBuiltinsAssembler) {
-  Node* context = Parameter(Descriptor::kContext);
-  Node* receiver = Parameter(Descriptor::kReceiver);
+  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
+  TNode<Object> receiver = CAST(Parameter(Descriptor::kReceiver));
   GenerateTypedArrayPrototypeIterationMethod(context, receiver,
                                              "%TypedArray%.prototype.values()",
                                              IterationKind::kValues);
@@ -1528,8 +1557,8 @@ TF_BUILTIN(TypedArrayPrototypeValues, TypedArrayBuiltinsAssembler) {
 
 // ES #sec-%typedarray%.prototype.entries
 TF_BUILTIN(TypedArrayPrototypeEntries, TypedArrayBuiltinsAssembler) {
-  Node* context = Parameter(Descriptor::kContext);
-  Node* receiver = Parameter(Descriptor::kReceiver);
+  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
+  TNode<Object> receiver = CAST(Parameter(Descriptor::kReceiver));
   GenerateTypedArrayPrototypeIterationMethod(context, receiver,
                                              "%TypedArray%.prototype.entries()",
                                              IterationKind::kEntries);
@@ -1537,19 +1566,19 @@ TF_BUILTIN(TypedArrayPrototypeEntries, TypedArrayBuiltinsAssembler) {
 
 // ES #sec-%typedarray%.prototype.keys
 TF_BUILTIN(TypedArrayPrototypeKeys, TypedArrayBuiltinsAssembler) {
-  Node* context = Parameter(Descriptor::kContext);
-  Node* receiver = Parameter(Descriptor::kReceiver);
+  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
+  TNode<Object> receiver = CAST(Parameter(Descriptor::kReceiver));
   GenerateTypedArrayPrototypeIterationMethod(
       context, receiver, "%TypedArray%.prototype.keys()", IterationKind::kKeys);
 }
 
 // ES6 #sec-%typedarray%.of
 TF_BUILTIN(TypedArrayOf, TypedArrayBuiltinsAssembler) {
-  TNode<Context> context = CAST(Parameter(BuiltinDescriptor::kContext));
+  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
 
   // 1. Let len be the actual number of arguments passed to this function.
   TNode<IntPtrT> length = ChangeInt32ToIntPtr(
-      UncheckedCast<Int32T>(Parameter(BuiltinDescriptor::kArgumentsCount)));
+      UncheckedCast<Int32T>(Parameter(Descriptor::kJSActualArgumentsCount)));
   // 2. Let items be the List of arguments passed to this function.
   CodeStubArguments args(this, length, nullptr, INTPTR_PARAMETERS,
                          CodeStubArguments::ReceiverMode::kHasReceiver);
@@ -1561,7 +1590,7 @@ TF_BUILTIN(TypedArrayOf, TypedArrayBuiltinsAssembler) {
   // 4. If IsConstructor(C) is false, throw a TypeError exception.
   TNode<Object> receiver = args.GetReceiver();
   GotoIf(TaggedIsSmi(receiver), &if_not_constructor);
-  GotoIfNot(IsConstructor(receiver), &if_not_constructor);
+  GotoIfNot(IsConstructor(CAST(receiver)), &if_not_constructor);
 
   // 5. Let newObj be ? TypedArrayCreate(C, len).
   TNode<JSTypedArray> new_typed_array =
@@ -1621,6 +1650,46 @@ TF_BUILTIN(TypedArrayOf, TypedArrayBuiltinsAssembler) {
                  "%TypedArray%.of");
 }
 
+void TypedArrayBuiltinsAssembler::IterableToListSlowPath(
+    TNode<Context> context, TNode<Object> iterable, TNode<Object> iterator_fn,
+    Variable* created_list) {
+  IteratorBuiltinsAssembler iterator_assembler(state());
+
+  // 1. Let iteratorRecord be ? GetIterator(items, method).
+  IteratorRecord iterator_record =
+      iterator_assembler.GetIterator(context, iterable, iterator_fn);
+
+  // 2. Let values be a new empty List.
+  GrowableFixedArray values(state());
+
+  Variable* vars[] = {values.var_array(), values.var_length(),
+                      values.var_capacity()};
+  Label loop_start(this, 3, vars), loop_end(this);
+  Goto(&loop_start);
+  // 3. Let next be true.
+  // 4. Repeat, while next is not false
+  BIND(&loop_start);
+  {
+    //  a. Set next to ? IteratorStep(iteratorRecord).
+    TNode<Object> next = CAST(
+        iterator_assembler.IteratorStep(context, iterator_record, &loop_end));
+    //  b. If next is not false, then
+    //   i. Let nextValue be ? IteratorValue(next).
+    TNode<Object> next_value =
+        CAST(iterator_assembler.IteratorValue(context, next));
+    //   ii. Append nextValue to the end of the List values.
+    values.Push(next_value);
+    Goto(&loop_start);
+  }
+  BIND(&loop_end);
+
+  // 5. Return values.
+  TNode<JSArray> js_array_values = values.ToJSArray(context);
+  created_list->Bind(js_array_values);
+}
+
+// This builtin always returns a new JSArray and is thus safe to use even in the
+// presence of code that may call back into user-JS.
 TF_BUILTIN(IterableToList, TypedArrayBuiltinsAssembler) {
   TNode<Context> context = CAST(Parameter(Descriptor::kContext));
   TNode<Object> iterable = CAST(Parameter(Descriptor::kIterable));
@@ -1631,7 +1700,7 @@ TF_BUILTIN(IterableToList, TypedArrayBuiltinsAssembler) {
   TVARIABLE(JSArray, created_list);
 
   // This is a fast-path for ignoring the iterator.
-  // TODO(petermarshall): Port to CSA.
+  // TODO(petermarshall): Port IterableToListCanBeElided to CSA.
   Node* elided =
       CallRuntime(Runtime::kIterableToListCanBeElided, context, iterable);
   CSA_ASSERT(this, IsBoolean(elided));
@@ -1639,45 +1708,15 @@ TF_BUILTIN(IterableToList, TypedArrayBuiltinsAssembler) {
 
   BIND(&fast_path);
   {
-    created_list = CAST(iterable);
+    TNode<JSArray> input_array = CAST(iterable);
+    TNode<JSArray> new_array = CAST(CloneFastJSArray(context, input_array));
+    created_list = new_array;
     Goto(&done);
   }
 
   BIND(&slow_path);
   {
-    IteratorBuiltinsAssembler iterator_assembler(state());
-
-    // 1. Let iteratorRecord be ? GetIterator(items, method).
-    IteratorRecord iterator_record =
-        iterator_assembler.GetIterator(context, iterable, iterator_fn);
-
-    // 2. Let values be a new empty List.
-    GrowableFixedArray values(state());
-
-    Variable* vars[] = {values.var_array(), values.var_length(),
-                        values.var_capacity()};
-    Label loop_start(this, 3, vars), loop_end(this);
-    Goto(&loop_start);
-    // 3. Let next be true.
-    // 4. Repeat, while next is not false
-    BIND(&loop_start);
-    {
-      //  a. Set next to ? IteratorStep(iteratorRecord).
-      TNode<Object> next = CAST(
-          iterator_assembler.IteratorStep(context, iterator_record, &loop_end));
-      //  b. If next is not false, then
-      //   i. Let nextValue be ? IteratorValue(next).
-      TNode<Object> next_value =
-          CAST(iterator_assembler.IteratorValue(context, next));
-      //   ii. Append nextValue to the end of the List values.
-      values.Push(next_value);
-      Goto(&loop_start);
-    }
-    BIND(&loop_end);
-
-    // 5. Return values.
-    TNode<JSArray> js_array_values = values.ToJSArray(context);
-    created_list = js_array_values;
+    IterableToListSlowPath(context, iterable, iterator_fn, &created_list);
     Goto(&done);
   }
 
@@ -1687,7 +1726,7 @@ TF_BUILTIN(IterableToList, TypedArrayBuiltinsAssembler) {
 
 // ES6 #sec-%typedarray%.from
 TF_BUILTIN(TypedArrayFrom, TypedArrayBuiltinsAssembler) {
-  TNode<Context> context = CAST(Parameter(BuiltinDescriptor::kContext));
+  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
 
   Label check_iterator(this), from_array_like(this), fast_path(this),
       slow_path(this), create_typed_array(this),
@@ -1697,7 +1736,8 @@ TF_BUILTIN(TypedArrayFrom, TypedArrayBuiltinsAssembler) {
       if_neutered(this, Label::kDeferred);
 
   CodeStubArguments args(
-      this, ChangeInt32ToIntPtr(Parameter(BuiltinDescriptor::kArgumentsCount)));
+      this,
+      ChangeInt32ToIntPtr(Parameter(Descriptor::kJSActualArgumentsCount)));
   TNode<Object> source = args.GetOptionalArgumentValue(0);
 
   // 5. If thisArg is present, let T be thisArg; else let T be undefined.
@@ -1707,7 +1747,7 @@ TF_BUILTIN(TypedArrayFrom, TypedArrayBuiltinsAssembler) {
   // 2. If IsConstructor(C) is false, throw a TypeError exception.
   TNode<Object> receiver = args.GetReceiver();
   GotoIf(TaggedIsSmi(receiver), &if_not_constructor);
-  GotoIfNot(IsConstructor(receiver), &if_not_constructor);
+  GotoIfNot(IsConstructor(CAST(receiver)), &if_not_constructor);
 
   // 3. If mapfn is present and mapfn is not undefined, then
   TNode<Object> map_fn = args.GetOptionalArgumentValue(1);
@@ -1718,7 +1758,7 @@ TF_BUILTIN(TypedArrayFrom, TypedArrayBuiltinsAssembler) {
   //  b. Let mapping be true.
   // 4. Else, let mapping be false.
   GotoIf(TaggedIsSmi(map_fn), &if_map_fn_not_callable);
-  GotoIfNot(IsCallable(map_fn), &if_map_fn_not_callable);
+  GotoIfNot(IsCallable(CAST(map_fn)), &if_map_fn_not_callable);
   mapping = Int32TrueConstant();
   Goto(&check_iterator);
 
@@ -1741,7 +1781,7 @@ TF_BUILTIN(TypedArrayFrom, TypedArrayBuiltinsAssembler) {
         CAST(GetMethod(context, source, isolate()->factory()->iterator_symbol(),
                        &from_array_like));
     GotoIf(TaggedIsSmi(iterator_fn), &if_iterator_fn_not_callable);
-    GotoIfNot(IsCallable(iterator_fn), &if_iterator_fn_not_callable);
+    GotoIfNot(IsCallable(CAST(iterator_fn)), &if_iterator_fn_not_callable);
 
     // We are using the iterator.
     Label if_length_not_smi(this, Label::kDeferred);
@@ -1869,9 +1909,10 @@ TF_BUILTIN(TypedArrayFrom, TypedArrayBuiltinsAssembler) {
 TF_BUILTIN(TypedArrayPrototypeFilter, TypedArrayBuiltinsAssembler) {
   const char* method_name = "%TypedArray%.prototype.filter";
 
-  TNode<Context> context = CAST(Parameter(BuiltinDescriptor::kContext));
+  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
   CodeStubArguments args(
-      this, ChangeInt32ToIntPtr(Parameter(BuiltinDescriptor::kArgumentsCount)));
+      this,
+      ChangeInt32ToIntPtr(Parameter(Descriptor::kJSActualArgumentsCount)));
 
   Label if_callback_not_callable(this, Label::kDeferred),
       detached(this, Label::kDeferred);
@@ -1883,12 +1924,12 @@ TF_BUILTIN(TypedArrayPrototypeFilter, TypedArrayBuiltinsAssembler) {
       ValidateTypedArray(context, receiver, method_name);
 
   // 3. Let len be O.[[ArrayLength]].
-  TNode<Smi> length = LoadObjectField<Smi>(source, JSTypedArray::kLengthOffset);
+  TNode<Smi> length = LoadTypedArrayLength(source);
 
   // 4. If IsCallable(callbackfn) is false, throw a TypeError exception.
   TNode<Object> callbackfn = args.GetOptionalArgumentValue(0);
   GotoIf(TaggedIsSmi(callbackfn), &if_callback_not_callable);
-  GotoIfNot(IsCallable(callbackfn), &if_callback_not_callable);
+  GotoIfNot(IsCallable(CAST(callbackfn)), &if_callback_not_callable);
 
   // 5. If thisArg is present, let T be thisArg; else let T be undefined.
   TNode<Object> this_arg = args.GetOptionalArgumentValue(1);
diff --git a/deps/v8/src/builtins/builtins-typedarray-gen.h b/deps/v8/src/builtins/builtins-typed-array-gen.h
similarity index 84%
rename from deps/v8/src/builtins/builtins-typedarray-gen.h
rename to deps/v8/src/builtins/builtins-typed-array-gen.h
index 37f923dea6a2c9..e74469187fde98 100644
--- a/deps/v8/src/builtins/builtins-typedarray-gen.h
+++ b/deps/v8/src/builtins/builtins-typed-array-gen.h
@@ -2,18 +2,18 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef V8_BUILTINS_BUILTINS_TYPEDARRAY_GEN_H_
-#define V8_BUILTINS_BUILTINS_TYPEDARRAY_GEN_H_
+#ifndef V8_BUILTINS_BUILTINS_TYPED_ARRAY_GEN_H_
+#define V8_BUILTINS_BUILTINS_TYPED_ARRAY_GEN_H_
 
-#include "src/code-stub-assembler.h"
+#include "torque-generated/builtins-base-from-dsl-gen.h"
 
 namespace v8 {
 namespace internal {
 
-class TypedArrayBuiltinsAssembler : public CodeStubAssembler {
+class TypedArrayBuiltinsAssembler : public BaseBuiltinsFromDSLAssembler {
  public:
   explicit TypedArrayBuiltinsAssembler(compiler::CodeAssemblerState* state)
-      : CodeStubAssembler(state) {}
+      : BaseBuiltinsFromDSLAssembler(state) {}
 
   TNode<JSTypedArray> SpeciesCreateByLength(TNode<Context> context,
                                             TNode<JSTypedArray> exemplar,
@@ -24,7 +24,8 @@ class TypedArrayBuiltinsAssembler : public CodeStubAssembler {
   void GenerateTypedArrayPrototypeGetter(Node* context, Node* receiver,
                                          const char* method_name,
                                          int object_offset);
-  void GenerateTypedArrayPrototypeIterationMethod(Node* context, Node* receiver,
+  void GenerateTypedArrayPrototypeIterationMethod(TNode<Context> context,
+                                                  TNode<Object> receiver,
                                                   const char* method_name,
                                                   IterationKind iteration_kind);
 
@@ -41,10 +42,12 @@ class TypedArrayBuiltinsAssembler : public CodeStubAssembler {
   void ConstructByArrayLike(TNode<Context> context, TNode<JSTypedArray> holder,
                             TNode<HeapObject> array_like,
                             TNode<Object> initial_length,
-                            TNode<Smi> element_size);
+                            TNode<Smi> element_size,
+                            TNode<JSReceiver> buffer_constructor);
   void ConstructByIterable(TNode<Context> context, TNode<JSTypedArray> holder,
                            TNode<JSReceiver> iterable,
-                           TNode<Object> iterator_fn, TNode<Smi> element_size);
+                           TNode<JSReceiver> iterator_fn,
+                           TNode<Smi> element_size);
 
   void SetupTypedArray(TNode<JSTypedArray> holder, TNode<Smi> length,
                        TNode<Number> byte_offset, TNode<Number> byte_length);
@@ -52,6 +55,10 @@ class TypedArrayBuiltinsAssembler : public CodeStubAssembler {
                     TNode<Map> map, TNode<Smi> length,
                     TNode<Number> byte_offset);
 
+  void IterableToListSlowPath(TNode<Context> context, TNode<Object> iterable,
+                              TNode<Object> iterator_fn,
+                              Variable* created_list);
+
   TNode<Map> LoadMapForType(TNode<JSTypedArray> array);
   TNode<UintPtrT> CalculateExternalPointer(TNode<UintPtrT> backing_store,
                                            TNode<Number> byte_offset);
@@ -64,12 +71,14 @@ class TypedArrayBuiltinsAssembler : public CodeStubAssembler {
   // Returns true if kind is either BIGINT64_ELEMENTS or BIGUINT64_ELEMENTS.
   TNode<Word32T> IsBigInt64ElementsKind(TNode<Word32T> kind);
 
-  // Loads the element kind of TypedArray instance.
-  TNode<Word32T> LoadElementsKind(TNode<JSTypedArray> typed_array);
-
   // Returns the byte size of an element for a TypedArray elements kind.
   TNode<IntPtrT> GetTypedArrayElementSize(TNode<Word32T> elements_kind);
 
+  TNode<JSArrayBuffer> LoadTypedArrayBuffer(TNode<JSTypedArray> typed_array) {
+    return LoadObjectField<JSArrayBuffer>(typed_array,
+                                          JSTypedArray::kBufferOffset);
+  }
+
   TNode<Object> GetDefaultConstructor(TNode<Context> context,
                                       TNode<JSTypedArray> exemplar);
 
@@ -130,4 +139,4 @@ class TypedArrayBuiltinsAssembler : public CodeStubAssembler {
 }  // namespace internal
 }  // namespace v8
 
-#endif  // V8_BUILTINS_BUILTINS_TYPEDARRAY_GEN_H_
+#endif  // V8_BUILTINS_BUILTINS_TYPED_ARRAY_GEN_H_
diff --git a/deps/v8/src/builtins/builtins-typedarray.cc b/deps/v8/src/builtins/builtins-typed-array.cc
similarity index 95%
rename from deps/v8/src/builtins/builtins-typedarray.cc
rename to deps/v8/src/builtins/builtins-typed-array.cc
index 6fcc279c66303b..4ca09988fcd191 100644
--- a/deps/v8/src/builtins/builtins-typedarray.cc
+++ b/deps/v8/src/builtins/builtins-typed-array.cc
@@ -95,7 +95,7 @@ BUILTIN(TypedArrayPrototypeCopyWithin) {
   DCHECK_GE(len - count, 0);
 
   Handle<FixedTypedArrayBase> elements(
-      FixedTypedArrayBase::cast(array->elements()));
+      FixedTypedArrayBase::cast(array->elements()), isolate);
   size_t element_size = array->element_size();
   to = to * element_size;
   from = from * element_size;
@@ -170,10 +170,10 @@ BUILTIN(TypedArrayPrototypeIncludes) {
   ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
       isolate, array, JSTypedArray::Validate(isolate, args.receiver(), method));
 
-  if (args.length() < 2) return isolate->heap()->false_value();
+  if (args.length() < 2) return ReadOnlyRoots(isolate).false_value();
 
   int64_t len = array->length_value();
-  if (len == 0) return isolate->heap()->false_value();
+  if (len == 0) return ReadOnlyRoots(isolate).false_value();
 
   int64_t index = 0;
   if (args.length() > 2) {
@@ -184,14 +184,15 @@ BUILTIN(TypedArrayPrototypeIncludes) {
   }
 
   // TODO(cwhan.tunz): throw. See the above comment in CopyWithin.
-  if (V8_UNLIKELY(array->WasNeutered())) return isolate->heap()->false_value();
+  if (V8_UNLIKELY(array->WasNeutered()))
+    return ReadOnlyRoots(isolate).false_value();
 
   Handle<Object> search_element = args.atOrUndefined(isolate, 1);
   ElementsAccessor* elements = array->GetElementsAccessor();
   Maybe<bool> result = elements->IncludesValue(isolate, array, search_element,
                                                static_cast<uint32_t>(index),
                                                static_cast<uint32_t>(len));
-  MAYBE_RETURN(result, isolate->heap()->exception());
+  MAYBE_RETURN(result, ReadOnlyRoots(isolate).exception());
   return *isolate->factory()->ToBoolean(result.FromJust());
 }
 
@@ -222,7 +223,7 @@ BUILTIN(TypedArrayPrototypeIndexOf) {
   Maybe<int64_t> result = elements->IndexOfValue(isolate, array, search_element,
                                                  static_cast<uint32_t>(index),
                                                  static_cast<uint32_t>(len));
-  MAYBE_RETURN(result, isolate->heap()->exception());
+  MAYBE_RETURN(result, ReadOnlyRoots(isolate).exception());
   return *isolate->factory()->NewNumberFromInt64(result.FromJust());
 }
 
@@ -256,7 +257,7 @@ BUILTIN(TypedArrayPrototypeLastIndexOf) {
   ElementsAccessor* elements = array->GetElementsAccessor();
   Maybe<int64_t> result = elements->LastIndexOfValue(
       isolate, array, search_element, static_cast<uint32_t>(index));
-  MAYBE_RETURN(result, isolate->heap()->exception());
+  MAYBE_RETURN(result, ReadOnlyRoots(isolate).exception());
   return *isolate->factory()->NewNumberFromInt64(result.FromJust());
 }
 
diff --git a/deps/v8/src/builtins/builtins-utils-gen.h b/deps/v8/src/builtins/builtins-utils-gen.h
index 6af5eff3572482..99843309809967 100644
--- a/deps/v8/src/builtins/builtins-utils-gen.h
+++ b/deps/v8/src/builtins/builtins-utils-gen.h
@@ -38,11 +38,6 @@ class CodeAssemblerState;
     Node* Parameter(Descriptor::ParameterIndices index) {                \
       return CodeAssembler::Parameter(static_cast<int>(index));          \
     }                                                                    \
-    /* TODO(ishell): Remove this way of accessing parameters once the */ \
-    /* JSFunction linkage arguments are reordered. */                    \
-    Node* Parameter(BuiltinDescriptor::ParameterIndices index) {         \
-      return CodeAssembler::Parameter(static_cast<int>(index));          \
-    }                                                                    \
   };                                                                     \
   void Builtins::Generate_##Name(compiler::CodeAssemblerState* state) {  \
     Name##Assembler assembler(state);                                    \
diff --git a/deps/v8/src/builtins/builtins-wasm-gen.cc b/deps/v8/src/builtins/builtins-wasm-gen.cc
index 87fe14743a42cf..5826ec546e882b 100644
--- a/deps/v8/src/builtins/builtins-wasm-gen.cc
+++ b/deps/v8/src/builtins/builtins-wasm-gen.cc
@@ -10,17 +10,111 @@
 namespace v8 {
 namespace internal {
 
-typedef compiler::Node Node;
+class WasmBuiltinsAssembler : public CodeStubAssembler {
+ public:
+  explicit WasmBuiltinsAssembler(compiler::CodeAssemblerState* state)
+      : CodeStubAssembler(state) {}
 
-TF_BUILTIN(WasmStackGuard, CodeStubAssembler) {
-  TailCallRuntime(Runtime::kWasmStackGuard, NoContextConstant());
+ protected:
+  TNode<Object> UncheckedParameter(int index) {
+    return UncheckedCast<Object>(Parameter(index));
+  }
+
+  TNode<Code> LoadBuiltinFromFrame(Builtins::Name id) {
+    TNode<Object> instance = LoadInstanceFromFrame();
+    TNode<IntPtrT> roots = UncheckedCast<IntPtrT>(
+        Load(MachineType::Pointer(), instance,
+             IntPtrConstant(WasmInstanceObject::kRootsArrayAddressOffset -
+                            kHeapObjectTag)));
+    TNode<Code> target = UncheckedCast<Code>(Load(
+        MachineType::TaggedPointer(), roots,
+        IntPtrConstant(Heap::roots_to_builtins_offset() + id * kPointerSize)));
+    return target;
+  }
+
+  TNode<Object> LoadInstanceFromFrame() {
+    return UncheckedCast<Object>(
+        LoadFromParentFrame(WasmCompiledFrameConstants::kWasmInstanceOffset));
+  }
+
+  TNode<Code> LoadCEntryFromInstance(TNode<Object> instance) {
+    return UncheckedCast<Code>(
+        Load(MachineType::AnyTagged(), instance,
+             IntPtrConstant(WasmInstanceObject::kCEntryStubOffset -
+                            kHeapObjectTag)));
+  }
+
+  TNode<Code> LoadCEntryFromFrame() {
+    return LoadCEntryFromInstance(LoadInstanceFromFrame());
+  }
+};
+
+TF_BUILTIN(WasmAllocateHeapNumber, WasmBuiltinsAssembler) {
+  TNode<Code> target = LoadBuiltinFromFrame(Builtins::kAllocateHeapNumber);
+  TailCallStub(AllocateHeapNumberDescriptor(), target, NoContextConstant());
+}
+
+TF_BUILTIN(WasmArgumentsAdaptor, WasmBuiltinsAssembler) {
+  TNode<Object> context = UncheckedParameter(Descriptor::kContext);
+  TNode<Object> function = UncheckedParameter(Descriptor::kTarget);
+  TNode<Object> new_target = UncheckedParameter(Descriptor::kNewTarget);
+  TNode<Object> argc1 = UncheckedParameter(Descriptor::kActualArgumentsCount);
+  TNode<Object> argc2 = UncheckedParameter(Descriptor::kExpectedArgumentsCount);
+  TNode<Code> target =
+      LoadBuiltinFromFrame(Builtins::kArgumentsAdaptorTrampoline);
+  TailCallStub(ArgumentAdaptorDescriptor{}, target, context, function,
+               new_target, argc1, argc2);
+}
+
+TF_BUILTIN(WasmCallJavaScript, WasmBuiltinsAssembler) {
+  TNode<Object> context = UncheckedParameter(Descriptor::kContext);
+  TNode<Object> function = UncheckedParameter(Descriptor::kFunction);
+  TNode<Object> argc = UncheckedParameter(Descriptor::kActualArgumentsCount);
+  TNode<Code> target = LoadBuiltinFromFrame(Builtins::kCall_ReceiverIsAny);
+  TailCallStub(CallTrampolineDescriptor{}, target, context, function, argc);
+}
+
+TF_BUILTIN(WasmToNumber, WasmBuiltinsAssembler) {
+  TNode<Object> context = UncheckedParameter(Descriptor::kContext);
+  TNode<Object> argument = UncheckedParameter(Descriptor::kArgument);
+  TNode<Code> target = LoadBuiltinFromFrame(Builtins::kToNumber);
+  TailCallStub(TypeConversionDescriptor(), target, context, argument);
+}
+
+TF_BUILTIN(WasmStackGuard, WasmBuiltinsAssembler) {
+  TNode<Code> centry = LoadCEntryFromFrame();
+  TailCallRuntimeWithCEntry(Runtime::kWasmStackGuard, centry,
+                            NoContextConstant());
+}
+
+TF_BUILTIN(WasmGrowMemory, WasmBuiltinsAssembler) {
+  TNode<Int32T> num_pages =
+      UncheckedCast<Int32T>(Parameter(Descriptor::kNumPages));
+  Label num_pages_out_of_range(this, Label::kDeferred);
+
+  TNode<BoolT> num_pages_fits_in_smi =
+      IsValidPositiveSmi(ChangeInt32ToIntPtr(num_pages));
+  GotoIfNot(num_pages_fits_in_smi, &num_pages_out_of_range);
+
+  TNode<Smi> num_pages_smi = SmiFromInt32(num_pages);
+  TNode<Object> instance = LoadInstanceFromFrame();
+  TNode<Code> centry = LoadCEntryFromInstance(instance);
+  TNode<Smi> ret_smi = UncheckedCast<Smi>(
+      CallRuntimeWithCEntry(Runtime::kWasmGrowMemory, centry,
+                            NoContextConstant(), instance, num_pages_smi));
+  TNode<Int32T> ret = SmiToInt32(ret_smi);
+  ReturnRaw(ret);
+
+  BIND(&num_pages_out_of_range);
+  ReturnRaw(Int32Constant(-1));
 }
 
 #define DECLARE_ENUM(name)                                                    \
-  TF_BUILTIN(ThrowWasm##name, CodeStubAssembler) {                            \
+  TF_BUILTIN(ThrowWasm##name, WasmBuiltinsAssembler) {                        \
+    TNode<Code> centry = LoadCEntryFromFrame();                               \
     int message_id = wasm::WasmOpcodes::TrapReasonToMessageId(wasm::k##name); \
-    TailCallRuntime(Runtime::kThrowWasmError, NoContextConstant(),            \
-                    SmiConstant(message_id));                                 \
+    TailCallRuntimeWithCEntry(Runtime::kThrowWasmError, centry,               \
+                              NoContextConstant(), SmiConstant(message_id));  \
   }
 FOREACH_WASM_TRAPREASON(DECLARE_ENUM)
 #undef DECLARE_ENUM
diff --git a/deps/v8/src/builtins/builtins.cc b/deps/v8/src/builtins/builtins.cc
index 7e6a0459a7da90..ee4031d71a1b70 100644
--- a/deps/v8/src/builtins/builtins.cc
+++ b/deps/v8/src/builtins/builtins.cc
@@ -40,11 +40,11 @@ struct BuiltinMetadata {
                               { FUNCTION_ADDR(Builtin_##Name) }},
 #ifdef V8_TARGET_BIG_ENDIAN
 #define DECL_TFJ(Name, Count, ...) { #Name, Builtins::TFJ, \
-  { reinterpret_cast<Address>(static_cast<uintptr_t>(      \
+  { static_cast<Address>(static_cast<uintptr_t>(           \
                               Count) << (kBitsPerByte * (kPointerSize - 1))) }},
 #else
 #define DECL_TFJ(Name, Count, ...) { #Name, Builtins::TFJ, \
-                              { reinterpret_cast<Address>(Count) }},
+                              { static_cast<Address>(Count) }},
 #endif
 #define DECL_TFC(Name, ...) { #Name, Builtins::TFC, {} },
 #define DECL_TFS(Name, ...) { #Name, Builtins::TFS, {} },
@@ -65,12 +65,6 @@ const BuiltinMetadata builtin_metadata[] = {
 
 }  // namespace
 
-Builtins::Builtins() : initialized_(false) {
-  memset(builtins_, 0, sizeof(builtins_[0]) * builtin_count);
-}
-
-Builtins::~Builtins() {}
-
 BailoutId Builtins::GetContinuationBailoutId(Name name) {
   DCHECK(Builtins::KindOf(name) == TFJ || Builtins::KindOf(name) == TFC);
   return BailoutId(BailoutId::kFirstBuiltinContinuationId + name);
@@ -85,18 +79,11 @@ Builtins::Name Builtins::GetBuiltinFromBailoutId(BailoutId id) {
 
 void Builtins::TearDown() { initialized_ = false; }
 
-void Builtins::IterateBuiltins(RootVisitor* v) {
-  for (int i = 0; i < builtin_count; i++) {
-    v->VisitRootPointer(Root::kBuiltins, name(i), &builtins_[i]);
-  }
-}
-
-const char* Builtins::Lookup(byte* pc) {
+const char* Builtins::Lookup(Address pc) {
   // may be called during initialization (disassembler!)
   if (initialized_) {
     for (int i = 0; i < builtin_count; i++) {
-      Code* entry = Code::cast(builtins_[i]);
-      if (entry->contains(pc)) return name(i);
+      if (isolate_->heap()->builtin(i)->contains(pc)) return name(i);
     }
   }
   return nullptr;
@@ -137,16 +124,15 @@ Handle<Code> Builtins::OrdinaryToPrimitive(OrdinaryToPrimitiveHint hint) {
 }
 
 void Builtins::set_builtin(int index, HeapObject* builtin) {
-  DCHECK(Builtins::IsBuiltinId(index));
-  DCHECK(Internals::HasHeapObjectTag(builtin));
-  // The given builtin may be completely uninitialized thus we cannot check its
-  // type here.
-  builtins_[index] = builtin;
+  isolate_->heap()->set_builtin(index, builtin);
 }
 
+Code* Builtins::builtin(int index) { return isolate_->heap()->builtin(index); }
+
 Handle<Code> Builtins::builtin_handle(int index) {
   DCHECK(IsBuiltinId(index));
-  return Handle<Code>(reinterpret_cast<Code**>(builtin_address(index)));
+  return Handle<Code>(
+      reinterpret_cast<Code**>(isolate_->heap()->builtin_address(index)));
 }
 
 // static
@@ -157,8 +143,7 @@ int Builtins::GetStackParameterCount(Name name) {
 
 // static
 Callable Builtins::CallableFor(Isolate* isolate, Name name) {
-  Handle<Code> code(
-      reinterpret_cast<Code**>(isolate->builtins()->builtin_address(name)));
+  Handle<Code> code = isolate->builtins()->builtin_handle(name);
   CallDescriptors::Key key;
   switch (name) {
 // This macro is deliberately crafted so as to emit very little code,
@@ -174,11 +159,11 @@ Callable Builtins::CallableFor(Isolate* isolate, Name name) {
     default:
       Builtins::Kind kind = Builtins::KindOf(name);
       if (kind == TFJ || kind == CPP) {
-        return Callable(code, BuiltinDescriptor(isolate));
+        return Callable(code, JSTrampolineDescriptor{});
       }
       UNREACHABLE();
   }
-  CallInterfaceDescriptor descriptor(isolate, key);
+  CallInterfaceDescriptor descriptor(key);
   return Callable(code, descriptor);
 }
 
@@ -199,24 +184,38 @@ bool Builtins::IsBuiltin(const Code* code) {
   return Builtins::IsBuiltinId(code->builtin_index());
 }
 
+bool Builtins::IsBuiltinHandle(Handle<HeapObject> maybe_code,
+                               int* index) const {
+  Heap* heap = isolate_->heap();
+  Address handle_location = maybe_code.address();
+  Address start = heap->builtin_address(0);
+  Address end = heap->builtin_address(Builtins::builtin_count);
+  if (handle_location >= end) return false;
+  if (handle_location < start) return false;
+  *index = static_cast<int>(handle_location - start) >> kPointerSizeLog2;
+  DCHECK(Builtins::IsBuiltinId(*index));
+  return true;
+}
+
 // static
-bool Builtins::IsEmbeddedBuiltin(const Code* code) {
-#ifdef V8_EMBEDDED_BUILTINS
-  return Builtins::IsBuiltinId(code->builtin_index()) &&
-         Builtins::IsIsolateIndependent(code->builtin_index());
-#else
-  return false;
-#endif
+bool Builtins::IsIsolateIndependentBuiltin(const Code* code) {
+  if (FLAG_embedded_builtins) {
+    const int builtin_index = code->builtin_index();
+    return Builtins::IsBuiltinId(builtin_index) &&
+           Builtins::IsIsolateIndependent(builtin_index);
+  } else {
+    return false;
+  }
 }
 
 // static
 bool Builtins::IsLazy(int index) {
   DCHECK(IsBuiltinId(index));
 
-#ifdef V8_EMBEDDED_BUILTINS
-  // We don't want to lazy-deserialize off-heap builtins.
-  if (Builtins::IsIsolateIndependent(index)) return false;
-#endif
+  if (FLAG_embedded_builtins) {
+    // We don't want to lazy-deserialize off-heap builtins.
+    if (Builtins::IsIsolateIndependent(index)) return false;
+  }
 
   // There are a couple of reasons that builtins can require eager-loading,
   // i.e. deserialization at isolate creation instead of on-demand. For
@@ -254,6 +253,18 @@ bool Builtins::IsLazy(int index) {
     case kArraySomeLoopLazyDeoptContinuation:
     case kAsyncGeneratorAwaitCaught:            // https://crbug.com/v8/6786.
     case kAsyncGeneratorAwaitUncaught:          // https://crbug.com/v8/6786.
+    // CEntry variants must be immovable, whereas lazy deserialization allocates
+    // movable code.
+    case kCEntry_Return1_DontSaveFPRegs_ArgvOnStack_NoBuiltinExit:
+    case kCEntry_Return1_DontSaveFPRegs_ArgvOnStack_BuiltinExit:
+    case kCEntry_Return1_DontSaveFPRegs_ArgvInRegister_NoBuiltinExit:
+    case kCEntry_Return1_SaveFPRegs_ArgvOnStack_NoBuiltinExit:
+    case kCEntry_Return1_SaveFPRegs_ArgvOnStack_BuiltinExit:
+    case kCEntry_Return2_DontSaveFPRegs_ArgvOnStack_NoBuiltinExit:
+    case kCEntry_Return2_DontSaveFPRegs_ArgvOnStack_BuiltinExit:
+    case kCEntry_Return2_DontSaveFPRegs_ArgvInRegister_NoBuiltinExit:
+    case kCEntry_Return2_SaveFPRegs_ArgvOnStack_NoBuiltinExit:
+    case kCEntry_Return2_SaveFPRegs_ArgvOnStack_BuiltinExit:
     case kCompileLazy:
     case kDebugBreakTrampoline:
     case kDeserializeLazy:
@@ -291,354 +302,43 @@ bool Builtins::IsLazy(int index) {
 bool Builtins::IsIsolateIndependent(int index) {
   DCHECK(IsBuiltinId(index));
   switch (index) {
-#ifdef DEBUG
-    case kAbortJS:
-    case kContinueToCodeStubBuiltin:
-    case kContinueToCodeStubBuiltinWithResult:
-    case kContinueToJavaScriptBuiltin:
-    case kContinueToJavaScriptBuiltinWithResult:
-    case kKeyedLoadIC_Slow:
-    case kKeyedStoreIC_Slow:
-    case kLoadGlobalIC_Slow:
-    case kLoadIC_Slow:
-    case kStoreGlobalIC_Slow:
-    case kWasmStackGuard:
-    case kThrowWasmTrapUnreachable:
-    case kThrowWasmTrapMemOutOfBounds:
-    case kThrowWasmTrapDivByZero:
-    case kThrowWasmTrapDivUnrepresentable:
-    case kThrowWasmTrapRemByZero:
-    case kThrowWasmTrapFloatUnrepresentable:
-    case kThrowWasmTrapFuncInvalid:
-    case kThrowWasmTrapFuncSigMismatch:
-#else
-    case kAbortJS:
-    case kAdd:
-    case kAllocateHeapNumber:
-    case kArrayEvery:
-    case kArrayEveryLoopContinuation:
-    case kArrayEveryLoopEagerDeoptContinuation:
-    case kArrayEveryLoopLazyDeoptContinuation:
-    case kArrayFilterLoopEagerDeoptContinuation:
-    case kArrayFilterLoopLazyDeoptContinuation:
-    case kArrayFindIndexLoopAfterCallbackLazyDeoptContinuation:
-    case kArrayFindIndexLoopContinuation:
-    case kArrayFindIndexLoopEagerDeoptContinuation:
-    case kArrayFindIndexLoopLazyDeoptContinuation:
-    case kArrayFindLoopAfterCallbackLazyDeoptContinuation:
-    case kArrayFindLoopContinuation:
-    case kArrayFindLoopEagerDeoptContinuation:
-    case kArrayFindLoopLazyDeoptContinuation:
-    case kArrayForEach:
-    case kArrayForEachLoopContinuation:
-    case kArrayForEachLoopEagerDeoptContinuation:
-    case kArrayForEachLoopLazyDeoptContinuation:
-    case kArrayFrom:
-    case kArrayIncludes:
-    case kArrayIndexOf:
-    case kArrayIsArray:
-    case kArrayMapLoopContinuation:
-    case kArrayMapLoopEagerDeoptContinuation:
-    case kArrayMapLoopLazyDeoptContinuation:
-    case kArrayOf:
-    case kArrayPrototypeEntries:
-    case kArrayPrototypeFind:
-    case kArrayPrototypeFindIndex:
-    case kArrayPrototypeKeys:
-    case kArrayPrototypeSlice:
-    case kArrayPrototypeValues:
-    case kArrayReduce:
-    case kArrayReduceLoopContinuation:
-    case kArrayReduceLoopEagerDeoptContinuation:
-    case kArrayReduceLoopLazyDeoptContinuation:
-    case kArrayReducePreLoopEagerDeoptContinuation:
-    case kArrayReduceRight:
-    case kArrayReduceRightLoopContinuation:
-    case kArrayReduceRightLoopEagerDeoptContinuation:
-    case kArrayReduceRightLoopLazyDeoptContinuation:
-    case kArrayReduceRightPreLoopEagerDeoptContinuation:
-    case kArraySome:
-    case kArraySomeLoopContinuation:
-    case kArraySomeLoopEagerDeoptContinuation:
-    case kArraySomeLoopLazyDeoptContinuation:
-    case kAsyncFromSyncIteratorPrototypeNext:
-    case kAsyncFromSyncIteratorPrototypeReturn:
-    case kAsyncFromSyncIteratorPrototypeThrow:
-    case kAsyncFunctionAwaitCaught:
-    case kAsyncFunctionPromiseCreate:
-    case kAsyncFunctionPromiseRelease:
-    case kAsyncGeneratorResumeNext:
-    case kAsyncGeneratorReturnClosedRejectClosure:
-    case kAsyncGeneratorReturn:
-    case kAsyncIteratorValueUnwrap:
-    case kBitwiseNot:
-    case kBooleanPrototypeToString:
-    case kBooleanPrototypeValueOf:
-    case kContinueToCodeStubBuiltin:
-    case kContinueToCodeStubBuiltinWithResult:
-    case kContinueToJavaScriptBuiltin:
-    case kContinueToJavaScriptBuiltinWithResult:
-    case kCreateGeneratorObject:
-    case kCreateIterResultObject:
-    case kCreateRegExpLiteral:
-    case kDatePrototypeGetDate:
-    case kDatePrototypeGetDay:
-    case kDatePrototypeGetFullYear:
-    case kDatePrototypeGetHours:
-    case kDatePrototypeGetMilliseconds:
-    case kDatePrototypeGetMinutes:
-    case kDatePrototypeGetMonth:
-    case kDatePrototypeGetSeconds:
-    case kDatePrototypeGetTime:
-    case kDatePrototypeGetTimezoneOffset:
-    case kDatePrototypeGetUTCDate:
-    case kDatePrototypeGetUTCDay:
-    case kDatePrototypeGetUTCFullYear:
-    case kDatePrototypeGetUTCHours:
-    case kDatePrototypeGetUTCMilliseconds:
-    case kDatePrototypeGetUTCMinutes:
-    case kDatePrototypeGetUTCMonth:
-    case kDatePrototypeGetUTCSeconds:
-    case kDatePrototypeToPrimitive:
-    case kDatePrototypeValueOf:
-    case kDecrement:
-    case kDeleteProperty:
-    case kDivide:
-    case kEqual:
-    case kFastConsoleAssert:
-    case kFastNewClosure:
-    case kFastNewFunctionContextEval:
-    case kFastNewFunctionContextFunction:
-    case kFastNewObject:
-    case kFindOrderedHashMapEntry:
-    case kForInEnumerate:
-    case kForInFilter:
-    case kFunctionPrototypeHasInstance:
-    case kGeneratorPrototypeNext:
-    case kGeneratorPrototypeReturn:
-    case kGeneratorPrototypeThrow:
-    case kGetSuperConstructor:
-    case kGlobalIsFinite:
-    case kGlobalIsNaN:
-    case kGreaterThan:
-    case kGreaterThanOrEqual:
-    case kHasProperty:
-    case kIncrement:
-    case kInstanceOf:
+    // TODO(jgruber): There's currently two blockers for moving
+    // InterpreterEntryTrampoline into the binary:
+    // 1. InterpreterEnterBytecode calculates a pointer into the middle of
+    //    InterpreterEntryTrampoline (see interpreter_entry_return_pc_offset).
+    //    When the builtin is embedded, the pointer would need to be calculated
+    //    at an offset from the embedded instruction stream (instead of the
+    //    trampoline code object).
+    // 2. We create distinct copies of the trampoline to make it possible to
+    //    attribute ticks in the interpreter to individual JS functions.
+    //    See https://crrev.com/c/959081 and InstallBytecodeArray. When the
+    //    trampoline is embedded, we need to ensure that CopyCode creates a copy
+    //    of the builtin itself (and not just the trampoline).
+    case kInterpreterEntryTrampoline:
+      return false;
+#if V8_TARGET_ARCH_MIPS64 || V8_TARGET_ARCH_MIPS
+    // TODO(7882): The size of these builtins on MIP64 and MIPS32 is greater
+    // than 128KB, and this triggers generation of MIPS specific trampolines.
+    // Trampoline code is not PIC and therefore the builtin is not isolate
+    // independent.
+    case kArraySpliceTorque:
     case kKeyedLoadIC_Megamorphic:
-    case kKeyedLoadIC_PolymorphicName:
-    case kKeyedLoadIC_Slow:
-    case kKeyedLoadICTrampoline:
-    case kKeyedStoreIC_Slow:
-    case kKeyedStoreICTrampoline:
-    case kLessThan:
-    case kLessThanOrEqual:
-    case kLoadField:
-    case kLoadGlobalIC:
-    case kLoadGlobalICInsideTypeof:
-    case kLoadGlobalICInsideTypeofTrampoline:
-    case kLoadGlobalIC_Slow:
-    case kLoadGlobalICTrampoline:
-    case kLoadIC:
-    case kLoadIC_FunctionPrototype:
-    case kLoadIC_Noninlined:
-    case kLoadIC_Slow:
-    case kLoadIC_StringLength:
-    case kLoadIC_StringWrapperLength:
-    case kLoadICTrampoline:
-    case kLoadIC_Uninitialized:
-    case kMapPrototypeEntries:
-    case kMapPrototypeForEach:
-    case kMapPrototypeGet:
-    case kMapPrototypeGetSize:
-    case kMapPrototypeHas:
-    case kMapPrototypeKeys:
-    case kMapPrototypeValues:
-    case kMathCeil:
-    case kMathFloor:
-    case kMathFround:
-    case kMathMax:
-    case kMathMin:
-    case kMathRound:
-    case kMathSign:
-    case kMathSqrt:
-    case kMathTrunc:
-    case kMultiply:
-    case kNegate:
-    case kNewArgumentsElements:
-    case kNonNumberToNumber:
-    case kNonNumberToNumeric:
-    case kNonPrimitiveToPrimitive_Default:
-    case kNonPrimitiveToPrimitive_Number:
-    case kNonPrimitiveToPrimitive_String:
-    case kNumberIsFinite:
-    case kNumberIsInteger:
-    case kNumberIsNaN:
-    case kNumberIsSafeInteger:
-    case kNumberParseFloat:
-    case kNumberPrototypeValueOf:
-    case kNumberToString:
-    case kObjectConstructor:
-    case kObjectCreate:
-    case kObjectIs:
-    case kObjectKeys:
-    case kObjectPrototypeHasOwnProperty:
-    case kObjectPrototypeIsPrototypeOf:
-    case kObjectPrototypeToLocaleString:
-    case kObjectPrototypeToString:
-    case kObjectPrototypeValueOf:
-    case kOrderedHashTableHealIndex:
-    case kOrdinaryHasInstance:
-    case kOrdinaryToPrimitive_Number:
-    case kOrdinaryToPrimitive_String:
-    case kPromiseCapabilityDefaultReject:
-    case kPromiseCapabilityDefaultResolve:
-    case kPromiseCatchFinally:
-    case kPromiseConstructor:
-    case kPromiseConstructorLazyDeoptContinuation:
-    case kPromiseFulfillReactionJob:
-    case kPromiseInternalConstructor:
-    case kPromiseInternalReject:
-    case kPromiseInternalResolve:
-    case kPromisePrototypeCatch:
-    case kPromisePrototypeFinally:
-    case kPromiseRace:
-    case kPromiseReject:
-    case kPromiseRejectReactionJob:
-    case kPromiseResolve:
-    case kPromiseResolveThenableJob:
-    case kPromiseResolveTrampoline:
-    case kPromiseThenFinally:
-    case kPromiseThrowerFinally:
-    case kPromiseValueThunkFinally:
-    case kProxyGetProperty:
-    case kProxyHasProperty:
-    case kProxySetProperty:
-    case kReflectHas:
-    case kRegExpConstructor:
-    case kRegExpPrototypeCompile:
-    case kRegExpPrototypeDotAllGetter:
-    case kRegExpPrototypeFlagsGetter:
-    case kRegExpPrototypeGlobalGetter:
-    case kRegExpPrototypeIgnoreCaseGetter:
-    case kRegExpPrototypeMultilineGetter:
-    case kRegExpPrototypeReplace:
-    case kRegExpPrototypeSearch:
-    case kRegExpPrototypeSourceGetter:
-    case kRegExpPrototypeSplit:
-    case kRegExpPrototypeStickyGetter:
-    case kRegExpPrototypeUnicodeGetter:
-    case kResolvePromise:
-    case kReturnReceiver:
-    case kRunMicrotasks:
-    case kSameValue:
-    case kSetPrototypeEntries:
-    case kSetPrototypeForEach:
-    case kSetPrototypeGetSize:
-    case kSetPrototypeHas:
-    case kSetPrototypeValues:
-    case kStoreGlobalIC_Slow:
-    case kStoreGlobalICTrampoline:
-    case kStoreICTrampoline:
-    case kStrictEqual:
-    case kStringCodePointAtUTF16:
-    case kStringCodePointAtUTF32:
-    case kStringEqual:
-    case kStringGreaterThan:
-    case kStringGreaterThanOrEqual:
-    case kStringIndexOf:
-    case kStringLessThan:
-    case kStringLessThanOrEqual:
-    case kStringPrototypeAnchor:
-    case kStringPrototypeBig:
-    case kStringPrototypeBlink:
-    case kStringPrototypeBold:
-    case kStringPrototypeCharCodeAt:
-    case kStringPrototypeCodePointAt:
-    case kStringPrototypeConcat:
-    case kStringPrototypeFixed:
-    case kStringPrototypeFontcolor:
-    case kStringPrototypeFontsize:
-    case kStringPrototypeIncludes:
-    case kStringPrototypeIndexOf:
-    case kStringPrototypeItalics:
-    case kStringPrototypeIterator:
-    case kStringPrototypeLink:
-    case kStringPrototypeMatch:
-    case kStringPrototypePadEnd:
-    case kStringPrototypePadStart:
-    case kStringPrototypeRepeat:
-    case kStringPrototypeReplace:
-    case kStringPrototypeSearch:
-    case kStringPrototypeSmall:
-    case kStringPrototypeStrike:
-    case kStringPrototypeSub:
-    case kStringPrototypeSup:
-#ifdef V8_INTL_SUPPORT
-    case kStringPrototypeToLowerCaseIntl:
-    case kStringToLowerCaseIntl:
+    case kKeyedStoreIC_Megamorphic:
+    case kObjectAssign:
+    case kObjectGetOwnPropertyDescriptor:
+    case kRegExpMatchFast:
+    case kRegExpReplace:
+    case kRegExpSplit:
+    case kRegExpStringIteratorPrototypeNext:
+    case kStoreIC_Uninitialized:
+      return false;
 #endif
-    case kStringPrototypeToString:
-    case kStringPrototypeValueOf:
-    case kStringRepeat:
-    case kStringToNumber:
-    case kSubtract:
-    case kSymbolPrototypeToPrimitive:
-    case kSymbolPrototypeToString:
-    case kSymbolPrototypeValueOf:
-    case kThrowWasmTrapDivByZero:
-    case kThrowWasmTrapDivUnrepresentable:
-    case kThrowWasmTrapFloatUnrepresentable:
-    case kThrowWasmTrapFuncInvalid:
-    case kThrowWasmTrapFuncSigMismatch:
-    case kThrowWasmTrapMemOutOfBounds:
-    case kThrowWasmTrapRemByZero:
-    case kThrowWasmTrapUnreachable:
-    case kToBoolean:
-    case kToBooleanLazyDeoptContinuation:
-    case kToInteger:
-    case kToInteger_TruncateMinusZero:
-    case kToName:
-    case kToNumber:
-    case kToNumeric:
-    case kToString:
-    case kTypedArrayConstructor:
-    case kTypedArrayPrototypeByteLength:
-    case kTypedArrayPrototypeByteOffset:
-    case kTypedArrayPrototypeEntries:
-    case kTypedArrayPrototypeEvery:
-    case kTypedArrayPrototypeFind:
-    case kTypedArrayPrototypeFindIndex:
-    case kTypedArrayPrototypeForEach:
-    case kTypedArrayPrototypeKeys:
-    case kTypedArrayPrototypeLength:
-    case kTypedArrayPrototypeReduce:
-    case kTypedArrayPrototypeReduceRight:
-    case kTypedArrayPrototypeSet:
-    case kTypedArrayPrototypeSlice:
-    case kTypedArrayPrototypeSome:
-    case kTypedArrayPrototypeSubArray:
-    case kTypedArrayPrototypeToStringTag:
-    case kTypedArrayPrototypeValues:
-    case kTypeof:
-    case kWasmStackGuard:
-    case kWeakMapGet:
-    case kWeakMapHas:
-    case kWeakMapLookupHashIndex:
-    case kWeakMapPrototypeDelete:
-    case kWeakMapPrototypeSet:
-    case kWeakSetHas:
-    case kWeakSetPrototypeAdd:
-    case kWeakSetPrototypeDelete:
-#endif  // !DEBUG
-      return true;
     default:
-      return false;
+      return true;
   }
   UNREACHABLE();
 }
 
-#ifdef V8_EMBEDDED_BUILTINS
 // static
 Handle<Code> Builtins::GenerateOffHeapTrampolineFor(Isolate* isolate,
                                                     Address off_heap_entry) {
@@ -662,7 +362,6 @@ Handle<Code> Builtins::GenerateOffHeapTrampolineFor(Isolate* isolate,
 
   return isolate->factory()->NewCode(desc, Code::BUILTIN, masm.CodeObject());
 }
-#endif  // V8_EMBEDDED_BUILTINS
 
 // static
 Builtins::Kind Builtins::KindOf(int index) {
@@ -696,12 +395,6 @@ bool Builtins::HasCppImplementation(int index) {
   return (kind == CPP || kind == API);
 }
 
-Handle<Code> Builtins::JSConstructStubGeneric() {
-  return FLAG_harmony_restrict_constructor_return
-             ? builtin_handle(kJSConstructStubGenericRestrictedReturn)
-             : builtin_handle(kJSConstructStubGenericUnrestrictedReturn);
-}
-
 // static
 bool Builtins::AllowDynamicFunction(Isolate* isolate, Handle<JSFunction> target,
                                     Handle<JSObject> target_global_proxy) {
diff --git a/deps/v8/src/builtins/builtins.h b/deps/v8/src/builtins/builtins.h
index 7745420366e1e4..ccb9619eeba183 100644
--- a/deps/v8/src/builtins/builtins.h
+++ b/deps/v8/src/builtins/builtins.h
@@ -31,15 +31,12 @@ class CodeAssemblerState;
 
 class Builtins {
  public:
-  ~Builtins();
+  explicit Builtins(Isolate* isolate) : isolate_(isolate) {}
 
   void TearDown();
 
-  // Garbage collection support.
-  void IterateBuiltins(RootVisitor* v);
-
   // Disassembler support.
-  const char* Lookup(byte* pc);
+  const char* Lookup(Address pc);
 
   enum Name : int32_t {
 #define DEF_ENUM(Name, ...) k##Name,
@@ -75,24 +72,9 @@ class Builtins {
   // Used by BuiltinDeserializer and CreateOffHeapTrampolines in isolate.cc.
   void set_builtin(int index, HeapObject* builtin);
 
-  Code* builtin(int index) {
-    DCHECK(IsBuiltinId(index));
-    // Code::cast cannot be used here since we access builtins
-    // during the marking phase of mark sweep. See IC::Clear.
-    return reinterpret_cast<Code*>(builtins_[index]);
-  }
-
-  Address builtin_address(int index) {
-    DCHECK(IsBuiltinId(index));
-    return reinterpret_cast<Address>(&builtins_[index]);
-  }
-
+  Code* builtin(int index);
   V8_EXPORT_PRIVATE Handle<Code> builtin_handle(int index);
 
-  // Used by lazy deserialization to determine whether a given builtin has been
-  // deserialized. See the DeserializeLazy builtin.
-  Object** builtins_table_address() { return &builtins_[0]; }
-
   V8_EXPORT_PRIVATE static Callable CallableFor(Isolate* isolate, Name name);
 
   static int GetStackParameterCount(Name name);
@@ -113,8 +95,12 @@ class Builtins {
   // necessarily mean that its kind is Code::BUILTIN.
   static bool IsBuiltin(const Code* code);
 
+  // As above, but safe to access off the main thread since the check is done
+  // by handle location. Similar to Heap::IsRootHandle.
+  bool IsBuiltinHandle(Handle<HeapObject> maybe_code, int* index) const;
+
   // True, iff the given code object is a builtin with off-heap embedded code.
-  static bool IsEmbeddedBuiltin(const Code* code);
+  static bool IsIsolateIndependentBuiltin(const Code* code);
 
   // Returns true iff the given builtin can be lazy-loaded from the snapshot.
   // This is true in general for most builtins with the exception of a few
@@ -143,20 +129,20 @@ class Builtins {
   static void Generate_Adaptor(MacroAssembler* masm, Address builtin_address,
                                ExitFrameType exit_frame_type);
 
+  static void Generate_CEntry(MacroAssembler* masm, int result_size,
+                              SaveFPRegsMode save_doubles, ArgvMode argv_mode,
+                              bool builtin_exit_frame);
+
   static bool AllowDynamicFunction(Isolate* isolate, Handle<JSFunction> target,
                                    Handle<JSObject> target_global_proxy);
 
- private:
-  Builtins();
-
-#ifdef V8_EMBEDDED_BUILTINS
   // Creates a trampoline code object that jumps to the given off-heap entry.
   // The result should not be used directly, but only from the related Factory
   // function.
   static Handle<Code> GenerateOffHeapTrampolineFor(Isolate* isolate,
                                                    Address off_heap_entry);
-#endif
 
+ private:
   static void Generate_CallFunction(MacroAssembler* masm,
                                     ConvertReceiverMode mode);
 
@@ -189,14 +175,9 @@ class Builtins {
 #undef DECLARE_ASM
 #undef DECLARE_TF
 
-  // Note: These are always Code objects, but to conform with
-  // IterateBuiltins() above which assumes Object**'s for the callback
-  // function f, we use an Object* array here.
-  Object* builtins_[builtin_count];
-  bool initialized_;
+  Isolate* isolate_;
+  bool initialized_ = false;
 
-  friend class Factory;  // For GenerateOffHeapTrampolineFor.
-  friend class Isolate;
   friend class SetupIsolateDelegate;
 
   DISALLOW_COPY_AND_ASSIGN(Builtins);
diff --git a/deps/v8/src/builtins/constants-table-builder.cc b/deps/v8/src/builtins/constants-table-builder.cc
index c044a348da206d..6dd390c795dbb9 100644
--- a/deps/v8/src/builtins/constants-table-builder.cc
+++ b/deps/v8/src/builtins/constants-table-builder.cc
@@ -12,7 +12,7 @@ namespace internal {
 BuiltinsConstantsTableBuilder::BuiltinsConstantsTableBuilder(Isolate* isolate)
     : isolate_(isolate), map_(isolate->heap()) {
   // Ensure this is only called once per Isolate.
-  DCHECK_EQ(isolate_->heap()->empty_fixed_array(),
+  DCHECK_EQ(ReadOnlyRoots(isolate_).empty_fixed_array(),
             isolate_->heap()->builtins_constants_table());
 
   // And that the initial value of the builtins constants table can be treated
@@ -30,14 +30,19 @@ uint32_t BuiltinsConstantsTableBuilder::AddObject(Handle<Object> object) {
   DCHECK(!isolate_->heap()->IsRootHandle(object, &root_list_index));
 
   // Not yet finalized.
-  DCHECK_EQ(isolate_->heap()->empty_fixed_array(),
+  DCHECK_EQ(ReadOnlyRoots(isolate_).empty_fixed_array(),
             isolate_->heap()->builtins_constants_table());
 
+  // Must be on the main thread.
+  DCHECK(ThreadId::Current().Equals(isolate_->thread_id()));
+
+  // Must be serializing.
   DCHECK(isolate_->serializer_enabled());
 #endif
 
   uint32_t* maybe_key = map_.Find(object);
   if (maybe_key == nullptr) {
+    DCHECK(object->IsHeapObject());
     uint32_t index = map_.size();
     map_.Set(object, index);
     return index;
@@ -46,10 +51,41 @@ uint32_t BuiltinsConstantsTableBuilder::AddObject(Handle<Object> object) {
   }
 }
 
+void BuiltinsConstantsTableBuilder::PatchSelfReference(
+    Handle<Object> self_reference, Handle<Code> code_object) {
+#ifdef DEBUG
+  // Roots must not be inserted into the constants table as they are already
+  // accessibly from the root list.
+  Heap::RootListIndex root_list_index;
+  DCHECK(!isolate_->heap()->IsRootHandle(code_object, &root_list_index));
+
+  // Not yet finalized.
+  DCHECK_EQ(ReadOnlyRoots(isolate_).empty_fixed_array(),
+            isolate_->heap()->builtins_constants_table());
+
+  DCHECK(isolate_->serializer_enabled());
+
+  DCHECK(self_reference->IsOddball());
+  DCHECK(Oddball::cast(*self_reference)->kind() ==
+         Oddball::kSelfReferenceMarker);
+
+  // During indirection generation, we always create a distinct marker for each
+  // macro assembler. The canonical marker is only used when not generating a
+  // snapshot.
+  DCHECK(*self_reference != ReadOnlyRoots(isolate_).self_reference_marker());
+#endif
+
+  uint32_t key;
+  if (map_.Delete(self_reference, &key)) {
+    DCHECK(code_object->IsCode());
+    map_.Set(code_object, key);
+  }
+}
+
 void BuiltinsConstantsTableBuilder::Finalize() {
   HandleScope handle_scope(isolate_);
 
-  DCHECK_EQ(isolate_->heap()->empty_fixed_array(),
+  DCHECK_EQ(ReadOnlyRoots(isolate_).empty_fixed_array(),
             isolate_->heap()->builtins_constants_table());
   DCHECK(isolate_->serializer_enabled());
 
@@ -69,13 +105,15 @@ void BuiltinsConstantsTableBuilder::Finalize() {
       // builtin.
       value = builtins->builtin(Code::cast(value)->builtin_index());
     }
+    DCHECK(value->IsHeapObject());
     table->set(index, value);
   }
 
 #ifdef DEBUG
   for (int i = 0; i < map_.size(); i++) {
     DCHECK(table->get(i)->IsHeapObject());
-    DCHECK_NE(isolate_->heap()->undefined_value(), table->get(i));
+    DCHECK_NE(ReadOnlyRoots(isolate_).undefined_value(), table->get(i));
+    DCHECK_NE(ReadOnlyRoots(isolate_).self_reference_marker(), table->get(i));
   }
 #endif
 
diff --git a/deps/v8/src/builtins/constants-table-builder.h b/deps/v8/src/builtins/constants-table-builder.h
index aefad8c3bb8d38..12644d49642665 100644
--- a/deps/v8/src/builtins/constants-table-builder.h
+++ b/deps/v8/src/builtins/constants-table-builder.h
@@ -28,6 +28,12 @@ class BuiltinsConstantsTableBuilder final {
   // object, possibly adding the object to the table. Objects are deduplicated.
   uint32_t AddObject(Handle<Object> object);
 
+  // Self-references during code generation start out by referencing a handle
+  // with a temporary dummy object. Once the final Code object exists, such
+  // entries in the constants map must be patched up.
+  void PatchSelfReference(Handle<Object> self_reference,
+                          Handle<Code> code_object);
+
   // Should be called after all affected code (e.g. builtins and bytecode
   // handlers) has been generated.
   void Finalize();
diff --git a/deps/v8/src/builtins/data-view.tq b/deps/v8/src/builtins/data-view.tq
new file mode 100644
index 00000000000000..27bf531888feb1
--- /dev/null
+++ b/deps/v8/src/builtins/data-view.tq
@@ -0,0 +1,886 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+module data_view {
+
+  extern operator '.buffer' macro LoadArrayBufferViewBuffer(
+      JSArrayBufferView): JSArrayBuffer;
+  extern operator '.byte_length' macro LoadDataViewByteLength(JSDataView): Smi;
+  extern operator '.byte_offset' macro LoadDataViewByteOffset(JSDataView): Smi;
+  extern operator '.backing_store' macro LoadArrayBufferBackingStore(
+      JSArrayBuffer): RawPtr;
+
+  macro WasNeutered(view: JSArrayBufferView): bool {
+    return IsDetachedBuffer(view.buffer);
+  }
+
+  macro ValidateDataView(context: Context,
+      o: Object, method: String): JSDataView {
+    try {
+      return cast<JSDataView>(o) otherwise CastError;
+    }
+    label CastError {
+      ThrowTypeError(context, kIncompatibleMethodReceiver, method);
+    }
+  }
+
+  // ES6 section 24.2.4.1 get DataView.prototype.buffer
+  javascript builtin DataViewPrototypeGetBuffer(
+      context: Context, receiver: Object, ...arguments): JSArrayBuffer {
+    let data_view: JSDataView = ValidateDataView(
+      context, receiver, 'get DataView.prototype.buffer');
+    return data_view.buffer;
+  }
+
+  // ES6 section 24.2.4.2 get DataView.prototype.byteLength
+  javascript builtin DataViewPrototypeGetByteLength(
+      context: Context, receiver: Object, ...arguments): Smi {
+    let data_view: JSDataView = ValidateDataView(
+        context, receiver, 'get DataView.prototype.byte_length');
+    if (WasNeutered(data_view)) {
+      // TODO(bmeurer): According to the ES6 spec, we should throw a TypeError
+      // here if the JSArrayBuffer of the {data_view} was neutered.
+      return 0;
+    }
+    return data_view.byte_length;
+  }
+
+  // ES6 section 24.2.4.3 get DataView.prototype.byteOffset
+  javascript builtin DataViewPrototypeGetByteOffset(
+      context: Context, receiver: Object, ...arguments): Smi {
+    let data_view: JSDataView = ValidateDataView(
+        context, receiver, 'get DataView.prototype.byte_offset');
+    if (WasNeutered(data_view)) {
+      // TODO(bmeurer): According to the ES6 spec, we should throw a TypeError
+      // here if the JSArrayBuffer of the {data_view} was neutered.
+      return 0;
+    }
+    return data_view.byte_offset;
+  }
+
+  extern macro BitcastInt32ToFloat32(uint32): float32;
+  extern macro BitcastFloat32ToInt32(float32): uint32;
+  extern macro Float64ExtractLowWord32(float64): uint32;
+  extern macro Float64ExtractHighWord32(float64): uint32;
+  extern macro Float64InsertLowWord32(float64, uint32): float64;
+  extern macro Float64InsertHighWord32(float64, uint32): float64;
+
+  extern macro LoadUint8(RawPtr, intptr): uint32;
+  extern macro LoadInt8(RawPtr, intptr): int32;
+
+  macro LoadDataViewUint8(buffer: JSArrayBuffer, offset: intptr): Smi {
+    return convert<Smi>(LoadUint8(buffer.backing_store, offset));
+  }
+
+  macro LoadDataViewInt8(buffer: JSArrayBuffer, offset: intptr): Smi {
+    return convert<Smi>(LoadInt8(buffer.backing_store, offset));
+  }
+
+  macro LoadDataView16(buffer: JSArrayBuffer, offset: intptr,
+                       requested_little_endian: bool,
+                       signed: constexpr bool): Number {
+    let data_pointer: RawPtr = buffer.backing_store;
+
+    let b0: int32;
+    let b1: int32;
+    let result: int32;
+
+    // Sign-extend the most significant byte by loading it as an Int8.
+    if (requested_little_endian) {
+      b0 = Signed(LoadUint8(data_pointer, offset));
+      b1 = LoadInt8(data_pointer, offset + 1);
+      result = (b1 << 8) + b0;
+    } else {
+      b0 = LoadInt8(data_pointer, offset);
+      b1 = Signed(LoadUint8(data_pointer, offset + 1));
+      result = (b0 << 8) + b1;
+    }
+    if constexpr (signed) {
+      return convert<Smi>(result);
+    } else {
+      // Bit-mask the higher bits to prevent sign extension if we're unsigned.
+      return convert<Smi>(result & 0xFFFF);
+    }
+  }
+
+  macro LoadDataView32(buffer: JSArrayBuffer, offset: intptr,
+                       requested_little_endian: bool,
+                       signed: constexpr bool): Number {
+    let data_pointer: RawPtr = buffer.backing_store;
+
+    let b0: uint32 = LoadUint8(data_pointer, offset);
+    let b1: uint32 = LoadUint8(data_pointer, offset + 1);
+    let b2: uint32 = LoadUint8(data_pointer, offset + 2);
+    let b3: uint32 = LoadUint8(data_pointer, offset + 3);
+    let result: uint32;
+
+    if (requested_little_endian) {
+      result = (b3 << 24) | (b2 << 16) | (b1 << 8) | b0;
+    } else {
+      result = (b0 << 24) | (b1 << 16) | (b2 << 8) | b3;
+    }
+
+    if constexpr (signed) {
+      return convert<Number>(Signed(result));
+    } else {
+      return convert<Number>(result);
+    }
+  }
+
+  macro LoadDataViewFloat32(buffer: JSArrayBuffer, offset: intptr,
+                            requested_little_endian: bool): Number {
+    let data_pointer: RawPtr = buffer.backing_store;
+
+    let b0: uint32 = LoadUint8(data_pointer, offset);
+    let b1: uint32 = LoadUint8(data_pointer, offset + 1);
+    let b2: uint32 = LoadUint8(data_pointer, offset + 2);
+    let b3: uint32 = LoadUint8(data_pointer, offset + 3);
+    let result: uint32;
+
+    if (requested_little_endian) {
+      result = (b3 << 24) | (b2 << 16) | (b1 << 8) | b0;
+    } else {
+      result = (b0 << 24) | (b1 << 16) | (b2 << 8) | b3;
+    }
+
+    let float_res: float64 = convert<float64>(BitcastInt32ToFloat32(result));
+    return convert<Number>(float_res);
+  }
+
+  macro LoadDataViewFloat64(buffer: JSArrayBuffer, offset: intptr,
+                            requested_little_endian: bool): Number {
+    let data_pointer: RawPtr = buffer.backing_store;
+
+    let b0: uint32 = LoadUint8(data_pointer, offset);
+    let b1: uint32 = LoadUint8(data_pointer, offset + 1);
+    let b2: uint32 = LoadUint8(data_pointer, offset + 2);
+    let b3: uint32 = LoadUint8(data_pointer, offset + 3);
+    let b4: uint32 = LoadUint8(data_pointer, offset + 4);
+    let b5: uint32 = LoadUint8(data_pointer, offset + 5);
+    let b6: uint32 = LoadUint8(data_pointer, offset + 6);
+    let b7: uint32 = LoadUint8(data_pointer, offset + 7);
+    let low_word: uint32;
+    let high_word: uint32;
+
+    if (requested_little_endian) {
+      low_word = (b3 << 24) | (b2 << 16) | (b1 << 8) | b0;
+      high_word = (b7 << 24) | (b6 << 16) | (b5 << 8) | b4;
+    } else {
+      high_word = (b0 << 24) | (b1 << 16) | (b2 << 8) | b3;
+      low_word = (b4 << 24) | (b5 << 16) | (b6 << 8) | b7;
+    }
+
+    let result: float64 = 0;
+    result = Float64InsertLowWord32(result, low_word);
+    result = Float64InsertHighWord32(result, high_word);
+
+    return convert<Number>(result);
+  }
+
+  extern macro AllocateBigInt(intptr): BigInt;
+  extern macro StoreBigIntBitfield(BigInt, intptr): void;
+  extern macro StoreBigIntDigit(BigInt, constexpr int31, uintptr): void;
+  extern macro DataViewEncodeBigIntBits(constexpr bool,
+      constexpr int31): intptr;
+
+  const kPositiveBigInt: constexpr bool generates 'false';
+  const kNegativeBigInt: constexpr bool generates 'true';
+  const kZeroDigitBigInt: constexpr int31 generates '0';
+  const kOneDigitBigInt: constexpr int31 generates '1';
+  const kTwoDigitBigInt: constexpr int31 generates '2';
+
+  macro CreateEmptyBigInt(is_positive: bool, length: constexpr int31): BigInt {
+    // Allocate a BigInt with the desired length (number of digits).
+    let result: BigInt = AllocateBigInt(length);
+
+    // Write the desired sign and length to the BigInt bitfield.
+    if (is_positive) {
+      StoreBigIntBitfield(result,
+          DataViewEncodeBigIntBits(kPositiveBigInt, length));
+    } else {
+      StoreBigIntBitfield(result,
+          DataViewEncodeBigIntBits(kNegativeBigInt, length));
+    }
+
+    return result;
+  }
+
+  // Create a BigInt on a 64-bit architecture from two 32-bit values.
+  macro MakeBigIntOn64Bit(low_word: uint32, high_word: uint32,
+                          signed: constexpr bool): BigInt {
+
+    // 0n is represented by a zero-length BigInt.
+    if (low_word == 0 && high_word == 0) {
+      return AllocateBigInt(kZeroDigitBigInt);
+    }
+
+    let is_positive: bool = true;
+    let high_part: intptr = Signed(convert<uintptr>(high_word));
+    let low_part: intptr = Signed(convert<uintptr>(low_word));
+    let raw_value: intptr = (high_part << 32) + low_part;
+
+    if constexpr (signed) {
+      if (raw_value < 0) {
+        is_positive = false;
+        // We have to store the absolute value of raw_value in the digit.
+        raw_value = 0 - raw_value;
+      }
+    }
+
+    // Allocate the BigInt and store the absolute value.
+    let result: BigInt = CreateEmptyBigInt(is_positive, kOneDigitBigInt);
+
+    StoreBigIntDigit(result, 0, Unsigned(raw_value));
+
+    return result;
+  }
+
+  // Create a BigInt on a 32-bit architecture from two 32-bit values.
+  macro MakeBigIntOn32Bit(low_word: uint32, high_word: uint32,
+                          signed: constexpr bool): BigInt {
+
+    // 0n is represented by a zero-length BigInt.
+    if (low_word == 0 && high_word == 0) {
+      return AllocateBigInt(kZeroDigitBigInt);
+    }
+
+    // On a 32-bit platform, we might need 1 or 2 digits to store the number.
+    let need_two_digits: bool = false;
+    let is_positive: bool = true;
+
+    // We need to do some math on low_word and high_word,
+    // so convert them to int32.
+    let low_part: int32 = Signed(low_word);
+    let high_part: int32 = Signed(high_word);
+
+    // If high_word == 0, the number is positive, and we only need 1 digit,
+    // so we don't have anything to do.
+    // Otherwise, all cases are possible.
+    if (high_word != 0) {
+      if constexpr (signed) {
+
+        // If high_part < 0, the number is always negative.
+        if (high_part < 0) {
+          is_positive = false;
+
+          // We have to compute the absolute value by hand.
+          // There will be a negative carry from the low word
+          // to the high word iff low != 0.
+          high_part = 0 - high_part;
+          if (low_part != 0) {
+            high_part = high_part - 1;
+          }
+          low_part = 0 - low_part;
+
+          // Here, high_part could be 0 again so we might have 1 or 2 digits.
+          if (high_part != 0) {
+            need_two_digits = true;
+          }
+
+        } else {
+          // In this case, the number is positive, and we need 2 digits.
+          need_two_digits = true;
+        }
+
+      } else {
+        // In this case, the number is positive (unsigned),
+        // and we need 2 digits.
+        need_two_digits = true;
+      }
+    }
+
+    // Allocate the BigInt with the right sign and length.
+    let result: BigInt;
+    if (need_two_digits) {
+      result = CreateEmptyBigInt(is_positive, kTwoDigitBigInt);
+    } else {
+      result = CreateEmptyBigInt(is_positive, kOneDigitBigInt);
+    }
+
+    // Finally, write the digit(s) to the BigInt.
+    StoreBigIntDigit(result, 0, Unsigned(convert<intptr>(low_part)));
+
+    if (need_two_digits) {
+      StoreBigIntDigit(result, 1, Unsigned(convert<intptr>(high_part)));
+    }
+
+    return result;
+  }
+
+  macro MakeBigInt(low_word: uint32, high_word: uint32,
+                   signed: constexpr bool): BigInt {
+    // A BigInt digit has the platform word size, so we only need one digit
+    // on 64-bit platforms but may need two on 32-bit.
+    if constexpr (Is64()) {
+      return MakeBigIntOn64Bit(low_word, high_word, signed);
+    } else {
+      return MakeBigIntOn32Bit(low_word, high_word, signed);
+    }
+  }
+
+  macro LoadDataViewBigInt(buffer: JSArrayBuffer, offset: intptr,
+                           requested_little_endian: bool,
+                           signed: constexpr bool): BigInt {
+    let data_pointer: RawPtr = buffer.backing_store;
+
+    let b0: uint32 = LoadUint8(data_pointer, offset);
+    let b1: uint32 = LoadUint8(data_pointer, offset + 1);
+    let b2: uint32 = LoadUint8(data_pointer, offset + 2);
+    let b3: uint32 = LoadUint8(data_pointer, offset + 3);
+    let b4: uint32 = LoadUint8(data_pointer, offset + 4);
+    let b5: uint32 = LoadUint8(data_pointer, offset + 5);
+    let b6: uint32 = LoadUint8(data_pointer, offset + 6);
+    let b7: uint32 = LoadUint8(data_pointer, offset + 7);
+    let low_word: uint32;
+    let high_word: uint32;
+
+    if (requested_little_endian) {
+      low_word = (b3 << 24) | (b2 << 16) | (b1 << 8) | b0;
+      high_word = (b7 << 24) | (b6 << 16) | (b5 << 8) | b4;
+    } else {
+      high_word = (b0 << 24) | (b1 << 16) | (b2 << 8) | b3;
+      low_word = (b4 << 24) | (b5 << 16) | (b6 << 8) | b7;
+    }
+
+    return MakeBigInt(low_word, high_word, signed);
+  }
+
+  extern macro ToSmiIndex(Object, Context): Smi labels RangeError;
+  extern macro DataViewElementSize(constexpr ElementsKind): constexpr int31;
+
+  macro DataViewGet(context: Context,
+                    receiver: Object,
+                    offset: Object,
+                    requested_little_endian: Object,
+                    kind: constexpr ElementsKind): Numeric {
+
+    // TODO(theotime): add more specific method name to match
+    // the former implementation.
+    let data_view: JSDataView = ValidateDataView(
+        context, receiver, 'get DataView.prototype.get');
+
+    let getIndexSmi: Smi;
+    try {
+      getIndexSmi = ToSmiIndex(offset, context) otherwise RangeError;
+    }
+    label RangeError {
+      ThrowRangeError(context, kInvalidDataViewAccessorOffset);
+    }
+    let getIndex: intptr = convert<intptr>(getIndexSmi);
+
+    let littleEndian: bool = ToBoolean(requested_little_endian);
+    let buffer: JSArrayBuffer = data_view.buffer;
+
+    if (IsDetachedBuffer(buffer)) {
+      ThrowTypeError(context, kDetachedOperation, 'DataView.prototype.get');
+    }
+
+    let viewOffset: intptr = convert<intptr>(data_view.byte_offset);
+    let viewSize: intptr = convert<intptr>(data_view.byte_length);
+    let elementSize: intptr = DataViewElementSize(kind);
+
+    if (getIndex + elementSize > viewSize) {
+      ThrowRangeError(context, kInvalidDataViewAccessorOffset);
+    }
+
+    let bufferIndex: intptr = getIndex + viewOffset;
+
+    if constexpr (kind == UINT8_ELEMENTS) {
+      return LoadDataViewUint8(buffer, bufferIndex);
+    } else if constexpr (kind == INT8_ELEMENTS) {
+      return LoadDataViewInt8(buffer, bufferIndex);
+    } else if constexpr (kind == UINT16_ELEMENTS) {
+      return LoadDataView16(buffer, bufferIndex, littleEndian, false);
+    } else if constexpr (kind == INT16_ELEMENTS) {
+      return LoadDataView16(buffer, bufferIndex, littleEndian, true);
+    } else if constexpr (kind == UINT32_ELEMENTS) {
+      return LoadDataView32(buffer, bufferIndex, littleEndian, false);
+    } else if constexpr (kind == INT32_ELEMENTS) {
+      return LoadDataView32(buffer, bufferIndex, littleEndian, true);
+    } else if constexpr (kind == FLOAT32_ELEMENTS) {
+      return LoadDataViewFloat32(buffer, bufferIndex, littleEndian);
+    } else if constexpr (kind == FLOAT64_ELEMENTS) {
+      return LoadDataViewFloat64(buffer, bufferIndex, littleEndian);
+    } else if constexpr (kind == BIGINT64_ELEMENTS) {
+      return LoadDataViewBigInt(buffer, bufferIndex, littleEndian, true);
+    } else if constexpr (kind == BIGUINT64_ELEMENTS) {
+      return LoadDataViewBigInt(buffer, bufferIndex, littleEndian, false);
+    } else {
+      unreachable;
+    }
+  }
+
+  javascript builtin DataViewPrototypeGetInt8(
+      context: Context, receiver: Object, ...arguments): Object {
+    let offset: Object = arguments.length > 0 ?
+        arguments[0] :
+        Undefined;
+    return DataViewGet(context, receiver, offset, Undefined, INT8_ELEMENTS);
+  }
+
+  javascript builtin DataViewPrototypeGetUint8(
+    context: Context, receiver: Object, ...arguments): Object {
+      let offset: Object = arguments.length > 0 ?
+          arguments[0] :
+          Undefined;
+      return DataViewGet(context, receiver, offset, Undefined, UINT8_ELEMENTS);
+    }
+
+  javascript builtin DataViewPrototypeGetInt16(
+    context: Context, receiver: Object, ...arguments): Object {
+      let offset: Object = arguments.length > 0 ?
+          arguments[0] :
+          Undefined;
+      let is_little_endian : Object = arguments.length > 1 ?
+          arguments[1] :
+          Undefined;
+      return DataViewGet(context, receiver, offset, is_little_endian,
+                         INT16_ELEMENTS);
+    }
+
+  javascript builtin DataViewPrototypeGetUint16(
+    context: Context, receiver: Object, ...arguments): Object {
+      let offset: Object = arguments.length > 0 ?
+          arguments[0] :
+          Undefined;
+      let is_little_endian : Object = arguments.length > 1 ?
+          arguments[1] :
+          Undefined;
+      return DataViewGet(context, receiver, offset, is_little_endian,
+                         UINT16_ELEMENTS);
+    }
+
+  javascript builtin DataViewPrototypeGetInt32(
+    context: Context, receiver: Object, ...arguments): Object {
+      let offset: Object = arguments.length > 0 ?
+          arguments[0] :
+          Undefined;
+      let is_little_endian : Object = arguments.length > 1 ?
+          arguments[1] :
+          Undefined;
+      return DataViewGet(context, receiver, offset, is_little_endian,
+                         INT32_ELEMENTS);
+    }
+
+  javascript builtin DataViewPrototypeGetUint32(
+    context: Context, receiver: Object, ...arguments): Object {
+      let offset: Object = arguments.length > 0 ?
+          arguments[0] :
+          Undefined;
+      let is_little_endian : Object = arguments.length > 1 ?
+          arguments[1] :
+          Undefined;
+      return DataViewGet(context, receiver, offset, is_little_endian,
+                         UINT32_ELEMENTS);
+    }
+
+  javascript builtin DataViewPrototypeGetFloat32(
+    context: Context, receiver: Object, ...arguments): Object {
+      let offset: Object = arguments.length > 0 ?
+          arguments[0] :
+          Undefined;
+      let is_little_endian : Object = arguments.length > 1 ?
+          arguments[1] :
+          Undefined;
+      return DataViewGet(context, receiver, offset, is_little_endian,
+                         FLOAT32_ELEMENTS);
+    }
+
+  javascript builtin DataViewPrototypeGetFloat64(
+    context: Context, receiver: Object, ...arguments): Object {
+      let offset: Object = arguments.length > 0 ?
+          arguments[0] :
+          Undefined;
+      let is_little_endian : Object = arguments.length > 1 ?
+          arguments[1] :
+          Undefined;
+      return DataViewGet(context, receiver, offset, is_little_endian,
+                         FLOAT64_ELEMENTS);
+    }
+
+  javascript builtin DataViewPrototypeGetBigInt64(
+    context: Context, receiver: Object, ...arguments): Object {
+      let offset: Object = arguments.length > 0 ?
+          arguments[0] :
+          Undefined;
+      let is_little_endian : Object = arguments.length > 1 ?
+          arguments[1] :
+          Undefined;
+      return DataViewGet(context, receiver, offset, is_little_endian,
+                         BIGINT64_ELEMENTS);
+    }
+
+  javascript builtin DataViewPrototypeGetBigUint64(
+    context: Context, receiver: Object, ...arguments): Object {
+      let offset: Object = arguments.length > 0 ?
+          arguments[0] :
+          Undefined;
+      let is_little_endian : Object = arguments.length > 1 ?
+          arguments[1] :
+          Undefined;
+      return DataViewGet(context, receiver, offset, is_little_endian,
+                         BIGUINT64_ELEMENTS);
+    }
+
+  extern macro ToNumber(Context, Object): Number;
+  extern macro ToBigInt(Context, Object): BigInt;
+  extern macro TruncateFloat64ToFloat32(float64): float32;
+  extern macro TruncateFloat64ToWord32(float64): uint32;
+
+  extern macro StoreWord8(RawPtr, intptr, uint32): void;
+
+  macro StoreDataView8(buffer: JSArrayBuffer, offset: intptr,
+                       value: uint32) {
+    StoreWord8(buffer.backing_store, offset, value & 0xFF);
+  }
+
+  macro StoreDataView16(buffer: JSArrayBuffer, offset: intptr, value: uint32,
+                        requested_little_endian: bool) {
+    let data_pointer: RawPtr = buffer.backing_store;
+
+    let b0: uint32 = value & 0xFF;
+    let b1: uint32 = (value >>> 8) & 0xFF;
+
+    if (requested_little_endian) {
+      StoreWord8(data_pointer, offset, b0);
+      StoreWord8(data_pointer, offset + 1, b1);
+    } else {
+      StoreWord8(data_pointer, offset, b1);
+      StoreWord8(data_pointer, offset + 1, b0);
+    }
+  }
+
+  macro StoreDataView32(buffer: JSArrayBuffer, offset: intptr, value: uint32,
+                        requested_little_endian: bool) {
+    let data_pointer: RawPtr = buffer.backing_store;
+
+    let b0: uint32 = value & 0xFF;
+    let b1: uint32 = (value >>> 8) & 0xFF;
+    let b2: uint32 = (value >>> 16) & 0xFF;
+    let b3: uint32 = value >>> 24; // We don't need to mask here.
+
+    if (requested_little_endian) {
+      StoreWord8(data_pointer, offset, b0);
+      StoreWord8(data_pointer, offset + 1, b1);
+      StoreWord8(data_pointer, offset + 2, b2);
+      StoreWord8(data_pointer, offset + 3, b3);
+    } else {
+      StoreWord8(data_pointer, offset, b3);
+      StoreWord8(data_pointer, offset + 1, b2);
+      StoreWord8(data_pointer, offset + 2, b1);
+      StoreWord8(data_pointer, offset + 3, b0);
+    }
+  }
+
+  macro StoreDataView64(buffer: JSArrayBuffer, offset: intptr,
+                        low_word: uint32, high_word: uint32,
+                        requested_little_endian: bool) {
+    let data_pointer: RawPtr = buffer.backing_store;
+
+    let b0: uint32 = low_word & 0xFF;
+    let b1: uint32 = (low_word >>> 8) & 0xFF;
+    let b2: uint32 = (low_word >>> 16) & 0xFF;
+    let b3: uint32 = low_word >>> 24;
+
+    let b4: uint32 = high_word & 0xFF;
+    let b5: uint32 = (high_word >>> 8) & 0xFF;
+    let b6: uint32 = (high_word >>> 16) & 0xFF;
+    let b7: uint32 = high_word >>> 24;
+
+
+    if (requested_little_endian) {
+      StoreWord8(data_pointer, offset, b0);
+      StoreWord8(data_pointer, offset + 1, b1);
+      StoreWord8(data_pointer, offset + 2, b2);
+      StoreWord8(data_pointer, offset + 3, b3);
+      StoreWord8(data_pointer, offset + 4, b4);
+      StoreWord8(data_pointer, offset + 5, b5);
+      StoreWord8(data_pointer, offset + 6, b6);
+      StoreWord8(data_pointer, offset + 7, b7);
+    } else {
+      StoreWord8(data_pointer, offset, b7);
+      StoreWord8(data_pointer, offset + 1, b6);
+      StoreWord8(data_pointer, offset + 2, b5);
+      StoreWord8(data_pointer, offset + 3, b4);
+      StoreWord8(data_pointer, offset + 4, b3);
+      StoreWord8(data_pointer, offset + 5, b2);
+      StoreWord8(data_pointer, offset + 6, b1);
+      StoreWord8(data_pointer, offset + 7, b0);
+    }
+  }
+
+  extern macro DataViewDecodeBigIntLength(BigInt): uintptr;
+  extern macro DataViewDecodeBigIntSign(BigInt): uintptr;
+  extern macro LoadBigIntDigit(BigInt, constexpr int31): uintptr;
+
+  // We might get here a BigInt that is bigger than 64 bits, but we're only
+  // interested in the 64 lowest ones. This means the lowest BigInt digit
+  // on 64-bit platforms, and the 2 lowest BigInt digits on 32-bit ones.
+  macro StoreDataViewBigInt(buffer: JSArrayBuffer, offset: intptr,
+                            bigint_value: BigInt,
+                            requested_little_endian: bool) {
+
+    let length: uintptr = DataViewDecodeBigIntLength(bigint_value);
+    let sign: uintptr = DataViewDecodeBigIntSign(bigint_value);
+
+    // The 32-bit words that will hold the BigInt's value in
+    // two's complement representation.
+    let low_word: uint32 = 0;
+    let high_word: uint32 = 0;
+
+    // The length is nonzero if and only if the BigInt's value is nonzero.
+    if (length != 0) {
+      if constexpr (Is64()) {
+        // There is always exactly 1 BigInt digit to load in this case.
+        let value: uintptr = LoadBigIntDigit(bigint_value, 0);
+        low_word = convert<uint32>(value); // Truncates value to 32 bits.
+        high_word = convert<uint32>(value >>> 32);
+      }
+      else { // There might be either 1 or 2 BigInt digits we need to load.
+        low_word = convert<uint32>(LoadBigIntDigit(bigint_value, 0));
+        if (length >= 2) { // Only load the second digit if there is one.
+          high_word = convert<uint32>(LoadBigIntDigit(bigint_value, 1));
+        }
+      }
+    }
+
+    if (sign != 0) { // The number is negative, convert it.
+      high_word = Unsigned(0 - Signed(high_word));
+      if (low_word != 0) {
+        high_word = Unsigned(Signed(high_word) - 1);
+      }
+      low_word = Unsigned(0 - Signed(low_word));
+    }
+
+    StoreDataView64(buffer, offset, low_word, high_word,
+                    requested_little_endian);
+  }
+
+  macro DataViewSet(context: Context,
+                    receiver: Object,
+                    offset: Object,
+                    value: Object,
+                    requested_little_endian: Object,
+                    kind: constexpr ElementsKind): Object {
+
+    // TODO(theotime): add more specific method name to match
+    // the former implementation.
+    let data_view: JSDataView = ValidateDataView(
+        context, receiver, 'get DataView.prototype.get');
+
+    let getIndexSmi: Smi;
+    try {
+      getIndexSmi = ToSmiIndex(offset, context) otherwise RangeError;
+    }
+    label RangeError {
+      ThrowRangeError(context, kInvalidDataViewAccessorOffset);
+    }
+    let getIndex: intptr = convert<intptr>(getIndexSmi);
+
+    let littleEndian: bool = ToBoolean(requested_little_endian);
+    let buffer: JSArrayBuffer = data_view.buffer;
+
+    let bigint_value: BigInt;
+    let num_value: Number;
+    // According to ES6 section 24.2.1.2 SetViewValue, we must perform
+    // the conversion before doing the bounds check.
+    if constexpr (kind == BIGUINT64_ELEMENTS || kind == BIGINT64_ELEMENTS) {
+      bigint_value = ToBigInt(context, value);
+    } else {
+      num_value = ToNumber(context, value);
+    }
+
+    if (IsDetachedBuffer(buffer)) {
+      ThrowTypeError(context, kDetachedOperation, 'DataView.prototype.get');
+    }
+
+    let viewOffset: intptr = convert<intptr>(data_view.byte_offset);
+    let viewSize: intptr = convert<intptr>(data_view.byte_length);
+    let elementSize: intptr = DataViewElementSize(kind);
+
+    if (getIndex + elementSize > viewSize) {
+      ThrowRangeError(context, kInvalidDataViewAccessorOffset);
+    }
+
+    let bufferIndex: intptr = getIndex + viewOffset;
+
+    if constexpr (kind == BIGUINT64_ELEMENTS || kind == BIGINT64_ELEMENTS) {
+      StoreDataViewBigInt(buffer, bufferIndex, bigint_value,
+                          littleEndian);
+    }
+    else {
+      let double_value: float64 = ChangeNumberToFloat64(num_value);
+
+      if constexpr (kind == UINT8_ELEMENTS || kind == INT8_ELEMENTS) {
+        StoreDataView8(buffer, bufferIndex,
+                      TruncateFloat64ToWord32(double_value));
+      }
+      else if constexpr (kind == UINT16_ELEMENTS || kind == INT16_ELEMENTS) {
+        StoreDataView16(buffer, bufferIndex,
+                        TruncateFloat64ToWord32(double_value), littleEndian);
+      }
+      else if constexpr (kind == UINT32_ELEMENTS || kind == INT32_ELEMENTS) {
+        StoreDataView32(buffer, bufferIndex,
+                        TruncateFloat64ToWord32(double_value), littleEndian);
+      }
+      else if constexpr (kind == FLOAT32_ELEMENTS) {
+        let float_value: float32 = TruncateFloat64ToFloat32(double_value);
+        StoreDataView32(buffer, bufferIndex,
+                        BitcastFloat32ToInt32(float_value), littleEndian);
+      }
+      else if constexpr (kind == FLOAT64_ELEMENTS) {
+        let low_word: uint32 = Float64ExtractLowWord32(double_value);
+        let high_word: uint32 = Float64ExtractHighWord32(double_value);
+        StoreDataView64(buffer, bufferIndex, low_word, high_word,
+                        littleEndian);
+      }
+    }
+    return Undefined;
+  }
+
+  javascript builtin DataViewPrototypeSetInt8(
+    context: Context, receiver: Object, ...arguments): Object {
+      let offset: Object = arguments.length > 0 ?
+          arguments[0] :
+          Undefined;
+      let value : Object = arguments.length > 1 ?
+          arguments[1] :
+          Undefined;
+      return DataViewSet(context, receiver, offset, value, Undefined,
+                         INT8_ELEMENTS);
+    }
+
+  javascript builtin DataViewPrototypeSetUint8(
+    context: Context, receiver: Object, ...arguments): Object {
+      let offset: Object = arguments.length > 0 ?
+          arguments[0] :
+          Undefined;
+      let value : Object = arguments.length > 1 ?
+          arguments[1] :
+          Undefined;
+      return DataViewSet(context, receiver, offset, value, Undefined,
+                         UINT8_ELEMENTS);
+    }
+
+  javascript builtin DataViewPrototypeSetInt16(
+    context: Context, receiver: Object, ...arguments): Object {
+      let offset: Object = arguments.length > 0 ?
+          arguments[0] :
+          Undefined;
+      let value : Object = arguments.length > 1 ?
+          arguments[1] :
+          Undefined;
+      let is_little_endian : Object = arguments.length > 2 ?
+          arguments[2] :
+          Undefined;
+      return DataViewSet(context, receiver, offset, value,
+                         is_little_endian, INT16_ELEMENTS);
+    }
+
+  javascript builtin DataViewPrototypeSetUint16(
+    context: Context, receiver: Object, ...arguments): Object {
+      let offset: Object = arguments.length > 0 ?
+          arguments[0] :
+          Undefined;
+      let value : Object = arguments.length > 1 ?
+          arguments[1] :
+          Undefined;
+      let is_little_endian : Object = arguments.length > 2 ?
+          arguments[2] :
+          Undefined;
+      return DataViewSet(context, receiver, offset, value,
+                         is_little_endian, UINT16_ELEMENTS);
+    }
+
+  javascript builtin DataViewPrototypeSetInt32(
+    context: Context, receiver: Object, ...arguments): Object {
+      let offset: Object = arguments.length > 0 ?
+          arguments[0] :
+          Undefined;
+      let value : Object = arguments.length > 1 ?
+          arguments[1] :
+          Undefined;
+      let is_little_endian : Object = arguments.length > 2 ?
+          arguments[2] :
+          Undefined;
+      return DataViewSet(context, receiver, offset, value,
+                         is_little_endian, INT32_ELEMENTS);
+    }
+
+  javascript builtin DataViewPrototypeSetUint32(
+    context: Context, receiver: Object, ...arguments): Object {
+      let offset: Object = arguments.length > 0 ?
+          arguments[0] :
+          Undefined;
+      let value : Object = arguments.length > 1 ?
+          arguments[1] :
+          Undefined;
+      let is_little_endian : Object = arguments.length > 2 ?
+          arguments[2] :
+          Undefined;
+      return DataViewSet(context, receiver, offset, value,
+                         is_little_endian, UINT32_ELEMENTS);
+    }
+
+  javascript builtin DataViewPrototypeSetFloat32(
+    context: Context, receiver: Object, ...arguments): Object {
+      let offset: Object = arguments.length > 0 ?
+          arguments[0] :
+          Undefined;
+      let value : Object = arguments.length > 1 ?
+          arguments[1] :
+          Undefined;
+      let is_little_endian : Object = arguments.length > 2 ?
+          arguments[2] :
+          Undefined;
+      return DataViewSet(context, receiver, offset, value,
+                         is_little_endian, FLOAT32_ELEMENTS);
+    }
+
+  javascript builtin DataViewPrototypeSetFloat64(
+    context: Context, receiver: Object, ...arguments): Object {
+      let offset: Object = arguments.length > 0 ?
+          arguments[0] :
+          Undefined;
+      let value : Object = arguments.length > 1 ?
+          arguments[1] :
+          Undefined;
+      let is_little_endian : Object = arguments.length > 2 ?
+          arguments[2] :
+          Undefined;
+      return DataViewSet(context, receiver, offset, value,
+                         is_little_endian, FLOAT64_ELEMENTS);
+    }
+
+  javascript builtin DataViewPrototypeSetBigInt64(
+    context: Context, receiver: Object, ...arguments): Object {
+      let offset: Object = arguments.length > 0 ?
+          arguments[0] :
+          Undefined;
+      let value : Object = arguments.length > 1 ?
+          arguments[1] :
+          Undefined;
+      let is_little_endian : Object = arguments.length > 2 ?
+          arguments[2] :
+          Undefined;
+      return DataViewSet(context, receiver, offset, value,
+                         is_little_endian, BIGINT64_ELEMENTS);
+    }
+
+  javascript builtin DataViewPrototypeSetBigUint64(
+    context: Context, receiver: Object, ...arguments): Object {
+      let offset: Object = arguments.length > 0 ?
+          arguments[0] :
+          Undefined;
+      let value : Object = arguments.length > 1 ?
+          arguments[1] :
+          Undefined;
+      let is_little_endian : Object = arguments.length > 2 ?
+          arguments[2] :
+          Undefined;
+      return DataViewSet(context, receiver, offset, value,
+                         is_little_endian, BIGUINT64_ELEMENTS);
+    }
+
+}
diff --git a/deps/v8/src/builtins/ia32/builtins-ia32.cc b/deps/v8/src/builtins/ia32/builtins-ia32.cc
index 2afcebab80c5c8..d1c0a5d5fbbc76 100644
--- a/deps/v8/src/builtins/ia32/builtins-ia32.cc
+++ b/deps/v8/src/builtins/ia32/builtins-ia32.cc
@@ -4,12 +4,14 @@
 
 #if V8_TARGET_ARCH_IA32
 
+#include "src/base/adapters.h"
 #include "src/code-factory.h"
 #include "src/debug/debug.h"
 #include "src/deoptimizer.h"
 #include "src/frame-constants.h"
 #include "src/frames.h"
 #include "src/objects-inl.h"
+#include "src/wasm/wasm-linkage.h"
 
 namespace v8 {
 namespace internal {
@@ -18,7 +20,8 @@ namespace internal {
 
 void Builtins::Generate_Adaptor(MacroAssembler* masm, Address address,
                                 ExitFrameType exit_frame_type) {
-  __ mov(ebx, Immediate(ExternalReference(address, masm->isolate())));
+  __ mov(kJavaScriptCallExtraArg1Register,
+         Immediate(ExternalReference::Create(address)));
   if (exit_frame_type == BUILTIN_EXIT) {
     __ Jump(BUILTIN_CODE(masm->isolate(), AdaptorWithBuiltinExitFrame),
             RelocInfo::CODE_TARGET);
@@ -29,59 +32,6 @@ void Builtins::Generate_Adaptor(MacroAssembler* masm, Address address,
   }
 }
 
-namespace {
-
-void AdaptorWithExitFrameType(MacroAssembler* masm,
-                              Builtins::ExitFrameType exit_frame_type) {
-  // ----------- S t a t e -------------
-  //  -- eax                : number of arguments excluding receiver
-  //  -- ebx                : entry point
-  //  -- edi                : target
-  //  -- edx                : new.target
-  //  -- esp[0]             : return address
-  //  -- esp[4]             : last argument
-  //  -- ...
-  //  -- esp[4 * argc]      : first argument
-  //  -- esp[4 * (argc +1)] : receiver
-  // -----------------------------------
-  __ AssertFunction(edi);
-
-  // Make sure we operate in the context of the called function (for example
-  // ConstructStubs implemented in C++ will be run in the context of the caller
-  // instead of the callee, due to the way that [[Construct]] is defined for
-  // ordinary functions).
-  __ mov(esi, FieldOperand(edi, JSFunction::kContextOffset));
-
-  // CEntryStub expects eax to contain the number of arguments including the
-  // receiver and the extra arguments.
-  __ add(eax, Immediate(BuiltinExitFrameConstants::kNumExtraArgsWithReceiver));
-
-  // Insert extra arguments.
-  __ PopReturnAddressTo(ecx);
-  __ SmiTag(eax);
-  __ PushRoot(Heap::kTheHoleValueRootIndex);  // Padding.
-  __ Push(eax);
-  __ SmiUntag(eax);
-  __ Push(edi);
-  __ Push(edx);
-  __ PushReturnAddressFrom(ecx);
-
-  // Jump to the C entry runtime stub directly here instead of using
-  // JumpToExternalReference because ebx is loaded by Generate_adaptor.
-  CEntryStub ces(masm->isolate(), 1, kDontSaveFPRegs, kArgvOnStack,
-                 exit_frame_type == Builtins::BUILTIN_EXIT);
-  __ jmp(ces.GetCode(), RelocInfo::CODE_TARGET);
-}
-}  // namespace
-
-void Builtins::Generate_AdaptorWithExitFrame(MacroAssembler* masm) {
-  AdaptorWithExitFrameType(masm, EXIT);
-}
-
-void Builtins::Generate_AdaptorWithBuiltinExitFrame(MacroAssembler* masm) {
-  AdaptorWithExitFrameType(masm, BUILTIN_EXIT);
-}
-
 static void GenerateTailCallToReturnedCode(MacroAssembler* masm,
                                            Runtime::FunctionId function_id) {
   // ----------- S t a t e -------------
@@ -183,9 +133,10 @@ void Generate_JSBuiltinsConstructStubHelper(MacroAssembler* masm) {
   __ ret(0);
 }
 
+}  // namespace
+
 // The construct stub for ES5 constructor functions and ES6 class constructors.
-void Generate_JSConstructStubGeneric(MacroAssembler* masm,
-                                     bool restrict_constructor_return) {
+void Builtins::Generate_JSConstructStubGeneric(MacroAssembler* masm) {
   // ----------- S t a t e -------------
   //  -- eax: number of arguments (untagged)
   //  -- edi: constructor function
@@ -316,7 +267,7 @@ void Generate_JSConstructStubGeneric(MacroAssembler* masm,
     // If the result is an object (in the ECMA sense), we should get rid
     // of the receiver and use the result; see ECMA-262 section 13.2.2-7
     // on page 74.
-    Label use_receiver, do_throw, other_result, leave_frame;
+    Label use_receiver, do_throw, leave_frame;
 
     // If the result is undefined, we jump out to using the implicit receiver.
     __ JumpIfRoot(eax, Heap::kUndefinedValueRootIndex, &use_receiver,
@@ -326,30 +277,14 @@ void Generate_JSConstructStubGeneric(MacroAssembler* masm,
     // is a valid receiver.
 
     // If the result is a smi, it is *not* an object in the ECMA sense.
-    __ JumpIfSmi(eax, &other_result, Label::kNear);
+    __ JumpIfSmi(eax, &use_receiver, Label::kNear);
 
     // If the type of the result (stored in its map) is less than
     // FIRST_JS_RECEIVER_TYPE, it is not an object in the ECMA sense.
     STATIC_ASSERT(LAST_JS_RECEIVER_TYPE == LAST_TYPE);
     __ CmpObjectType(eax, FIRST_JS_RECEIVER_TYPE, ecx);
     __ j(above_equal, &leave_frame, Label::kNear);
-
-    // The result is now neither undefined nor an object.
-    __ bind(&other_result);
-    __ mov(ebx, Operand(ebp, ConstructFrameConstants::kConstructorOffset));
-    __ mov(ebx, FieldOperand(ebx, JSFunction::kSharedFunctionInfoOffset));
-    __ test(FieldOperand(ebx, SharedFunctionInfo::kFlagsOffset),
-            Immediate(SharedFunctionInfo::IsClassConstructorBit::kMask));
-
-    if (restrict_constructor_return) {
-      // Throw if constructor function is a class constructor
-      __ j(Condition::zero, &use_receiver, Label::kNear);
-    } else {
-      __ j(not_zero, &use_receiver, Label::kNear);
-      __ CallRuntime(
-          Runtime::kIncrementUseCounterConstructorReturnNonUndefinedPrimitive);
-      __ jmp(&use_receiver, Label::kNear);
-    }
+    __ jmp(&use_receiver, Label::kNear);
 
     __ bind(&do_throw);
     __ CallRuntime(Runtime::kThrowConstructorReturnedNonObject);
@@ -372,16 +307,7 @@ void Generate_JSConstructStubGeneric(MacroAssembler* masm,
   __ push(ecx);
   __ ret(0);
 }
-}  // namespace
 
-void Builtins::Generate_JSConstructStubGenericRestrictedReturn(
-    MacroAssembler* masm) {
-  return Generate_JSConstructStubGeneric(masm, true);
-}
-void Builtins::Generate_JSConstructStubGenericUnrestrictedReturn(
-    MacroAssembler* masm) {
-  return Generate_JSConstructStubGeneric(masm, false);
-}
 void Builtins::Generate_JSBuiltinsConstructStub(MacroAssembler* masm) {
   Generate_JSBuiltinsConstructStubHelper(masm);
 }
@@ -426,8 +352,8 @@ static void Generate_JSEntryTrampolineHelper(MacroAssembler* masm,
     FrameScope scope(masm, StackFrame::INTERNAL);
 
     // Setup the context (we need to use the caller context from the isolate).
-    ExternalReference context_address(IsolateAddressId::kContextAddress,
-                                      masm->isolate());
+    ExternalReference context_address = ExternalReference::Create(
+        IsolateAddressId::kContextAddress, masm->isolate());
     __ mov(esi, Operand::StaticVariable(context_address));
 
     // Load the previous frame pointer (ebx) to access C arguments
@@ -560,21 +486,26 @@ void Builtins::Generate_ResumeGeneratorTrampoline(MacroAssembler* masm) {
   //  -- esp[0] : generator receiver
   // -----------------------------------
 
-  // Push holes for arguments to generator function. Since the parser forced
-  // context allocation for any variables in generators, the actual argument
-  // values have already been copied into the context and these dummy values
-  // will never be used.
+  // Copy the function arguments from the generator object's register file.
   __ mov(ecx, FieldOperand(edi, JSFunction::kSharedFunctionInfoOffset));
-  __ mov(ecx,
-         FieldOperand(ecx, SharedFunctionInfo::kFormalParameterCountOffset));
+  __ movzx_w(
+      ecx, FieldOperand(ecx, SharedFunctionInfo::kFormalParameterCountOffset));
+  __ mov(ebx,
+         FieldOperand(edx, JSGeneratorObject::kParametersAndRegistersOffset));
   {
     Label done_loop, loop;
+    __ Set(edi, 0);
+
     __ bind(&loop);
-    __ sub(ecx, Immediate(1));
-    __ j(carry, &done_loop, Label::kNear);
-    __ PushRoot(Heap::kTheHoleValueRootIndex);
+    __ cmp(edi, ecx);
+    __ j(greater_equal, &done_loop);
+    __ Push(
+        FieldOperand(ebx, edi, times_pointer_size, FixedArray::kHeaderSize));
+    __ add(edi, Immediate(1));
     __ jmp(&loop);
+
     __ bind(&done_loop);
+    __ mov(edi, FieldOperand(edx, JSGeneratorObject::kFunctionOffset));
   }
 
   // Underlying function needs to have bytecode available.
@@ -592,8 +523,8 @@ void Builtins::Generate_ResumeGeneratorTrampoline(MacroAssembler* masm) {
   {
     __ PushReturnAddressFrom(eax);
     __ mov(eax, FieldOperand(edi, JSFunction::kSharedFunctionInfoOffset));
-    __ mov(eax,
-           FieldOperand(eax, SharedFunctionInfo::kFormalParameterCountOffset));
+    __ movzx_w(eax, FieldOperand(
+                        eax, SharedFunctionInfo::kFormalParameterCountOffset));
     // We abuse new.target both to indicate that this is a resume call and to
     // pass in the generator object.  In ordinary calls, new.target is always
     // undefined because generator functions are non-constructable.
@@ -608,6 +539,8 @@ void Builtins::Generate_ResumeGeneratorTrampoline(MacroAssembler* masm) {
     FrameScope scope(masm, StackFrame::INTERNAL);
     __ Push(edx);
     __ Push(edi);
+    // Push hole as receiver since we do not use it for stepping.
+    __ PushRoot(Heap::kTheHoleValueRootIndex);
     __ CallRuntime(Runtime::kDebugOnFunctionCall);
     __ Pop(edx);
     __ mov(edi, FieldOperand(edx, JSGeneratorObject::kFunctionOffset));
@@ -788,8 +721,7 @@ static void AdvanceBytecodeOffsetOrReturn(MacroAssembler* masm,
                      bytecode));
 
   __ Move(bytecode_size_table,
-          Immediate(
-              ExternalReference::bytecode_size_table_address(masm->isolate())));
+          Immediate(ExternalReference::bytecode_size_table_address()));
 
   // Check if the bytecode is a Wide or ExtraWide prefix bytecode.
   Label process_bytecode, extra_wide;
@@ -868,19 +800,14 @@ void Builtins::Generate_InterpreterEntryTrampoline(MacroAssembler* masm) {
   __ push(esi);  // Callee's context.
   __ push(edi);  // Callee's JS function.
 
-  // Get the bytecode array from the function object (or from the DebugInfo if
-  // it is present) and load it into kInterpreterBytecodeArrayRegister.
-  Label maybe_load_debug_bytecode_array, bytecode_array_loaded,
-      apply_instrumentation;
+  // Get the bytecode array from the function object and load it into
+  // kInterpreterBytecodeArrayRegister.
   __ mov(eax, FieldOperand(edi, JSFunction::kSharedFunctionInfoOffset));
   __ mov(kInterpreterBytecodeArrayRegister,
          FieldOperand(eax, SharedFunctionInfo::kFunctionDataOffset));
   __ Push(eax);
   GetSharedFunctionInfoBytecode(masm, kInterpreterBytecodeArrayRegister, eax);
   __ Pop(eax);
-  __ JumpIfNotSmi(FieldOperand(eax, SharedFunctionInfo::kDebugInfoOffset),
-                  &maybe_load_debug_bytecode_array);
-  __ bind(&bytecode_array_loaded);
 
   __ inc(FieldOperand(feedback_vector, FeedbackVector::kInvocationCountOffset));
 
@@ -989,35 +916,6 @@ void Builtins::Generate_InterpreterEntryTrampoline(MacroAssembler* masm) {
   // The return value is in eax.
   LeaveInterpreterFrame(masm, ebx, ecx);
   __ ret(0);
-
-  // Load debug copy of the bytecode array if it exists.
-  // kInterpreterBytecodeArrayRegister is already loaded with
-  // SharedFunctionInfo::kFunctionDataOffset.
-  __ bind(&maybe_load_debug_bytecode_array);
-  __ mov(eax, FieldOperand(eax, SharedFunctionInfo::kDebugInfoOffset));
-  __ mov(ecx, FieldOperand(eax, DebugInfo::kDebugBytecodeArrayOffset));
-  __ JumpIfRoot(ecx, Heap::kUndefinedValueRootIndex, &bytecode_array_loaded);
-
-  __ mov(kInterpreterBytecodeArrayRegister, ecx);
-  __ mov(ecx, FieldOperand(eax, DebugInfo::kFlagsOffset));
-  __ SmiUntag(ecx);
-  __ and_(ecx, Immediate(DebugInfo::kDebugExecutionMode));
-  STATIC_ASSERT(static_cast<int>(DebugInfo::kDebugExecutionMode) ==
-                static_cast<int>(DebugInfo::kSideEffects));
-  ExternalReference debug_execution_mode =
-      ExternalReference::debug_execution_mode_address(masm->isolate());
-  __ cmp(ecx, Operand::StaticVariable(debug_execution_mode));
-  __ j(equal, &bytecode_array_loaded);
-
-  __ pop(ecx);  // get JSFunction from stack
-  __ push(ecx);
-  __ push(ebx);  // preserve feedback_vector and bytecode array register
-  __ push(kInterpreterBytecodeArrayRegister);
-  __ push(ecx);  // pass function as argument
-  __ CallRuntime(Runtime::kDebugApplyInstrumentation);
-  __ pop(kInterpreterBytecodeArrayRegister);
-  __ pop(ebx);
-  __ jmp(&bytecode_array_loaded);
 }
 
 
@@ -1135,30 +1033,11 @@ void Generate_InterpreterPushZeroAndArgsAndReturnAddress(
   Generate_StackOverflowCheck(masm, num_args, scratch1, scratch2,
                               stack_overflow, true);
 
-// Step 1 - Update the stack pointer. scratch1 already contains the required
-// increment to the stack. i.e. num_args + 1 stack slots. This is computed in
-// the Generate_StackOverflowCheck.
-
-#ifdef _MSC_VER
-  // TODO(mythria): Move it to macro assembler.
-  // In windows, we cannot increment the stack size by more than one page
-  // (mimimum page size is 4KB) without accessing at least one byte on the
-  // page. Check this:
-  // https://msdn.microsoft.com/en-us/library/aa227153(v=vs.60).aspx.
-  const int page_size = 4 * 1024;
-  Label check_offset, update_stack_pointer;
-  __ bind(&check_offset);
-  __ cmp(scratch1, page_size);
-  __ j(less, &update_stack_pointer);
-  __ sub(esp, Immediate(page_size));
-  // Just to touch the page, before we increment further.
-  __ mov(Operand(esp, 0), Immediate(0));
-  __ sub(scratch1, Immediate(page_size));
-  __ jmp(&check_offset);
-  __ bind(&update_stack_pointer);
-#endif
-
-  __ sub(esp, scratch1);
+  // Step 1 - Update the stack pointer. scratch1 already contains the required
+  // increment to the stack. i.e. num_args + 1 stack slots. This is computed in
+  // Generate_StackOverflowCheck.
+
+  __ AllocateStackFrame(scratch1);
 
   // Step 2 move return_address and slots above it to the correct locations.
   // Move from top to bottom, otherwise we may overwrite when num_args = 0 or 1,
@@ -1234,8 +1113,8 @@ void Builtins::Generate_InterpreterPushArgsThenConstructImpl(
     // Tail call to the array construct stub (still in the caller
     // context at this point).
     __ AssertFunction(edi);
-    ArrayConstructorStub array_constructor_stub(masm->isolate());
-    __ Jump(array_constructor_stub.GetCode(), RelocInfo::CODE_TARGET);
+    Handle<Code> code = BUILTIN_CODE(masm->isolate(), ArrayConstructorImpl);
+    __ Jump(code, RelocInfo::CODE_TARGET);
   } else if (mode == InterpreterPushArgsMode::kWithFinalSpread) {
     // Call the constructor with unmodified eax, edi, edx values.
     __ Jump(BUILTIN_CODE(masm->isolate(), ConstructWithSpread),
@@ -1355,205 +1234,6 @@ void Builtins::Generate_InterpreterEnterBytecodeDispatch(MacroAssembler* masm) {
   Generate_InterpreterEnterBytecode(masm);
 }
 
-void Builtins::Generate_CompileLazyDeoptimizedCode(MacroAssembler* masm) {
-  // Set the code slot inside the JSFunction to CompileLazy.
-  __ Move(ecx, BUILTIN_CODE(masm->isolate(), CompileLazy));
-  __ mov(FieldOperand(edi, JSFunction::kCodeOffset), ecx);
-  __ RecordWriteField(edi, JSFunction::kCodeOffset, ecx, ebx, kDontSaveFPRegs,
-                      OMIT_REMEMBERED_SET, OMIT_SMI_CHECK);
-  // Jump to compile lazy.
-  Generate_CompileLazy(masm);
-}
-
-static void GetSharedFunctionInfoCode(MacroAssembler* masm, Register sfi_data,
-                                      Register scratch1) {
-  // Figure out the SFI's code object.
-  Label done;
-  Label check_is_bytecode_array;
-  Label check_is_code;
-  Label check_is_fixed_array;
-  Label check_is_pre_parsed_scope_data;
-  Label check_is_function_template_info;
-  Label check_is_interpreter_data;
-
-  Register data_type = scratch1;
-
-  // IsSmi: Is builtin
-  __ JumpIfNotSmi(sfi_data, &check_is_bytecode_array);
-  __ mov(scratch1,
-         Immediate(ExternalReference::builtins_address(masm->isolate())));
-  // Avoid untagging the Smi unnecessarily.
-  STATIC_ASSERT(times_2 == times_pointer_size - kSmiTagSize);
-  __ mov(sfi_data, Operand(scratch1, sfi_data, times_2, 0));
-  __ jmp(&done);
-
-  // Get map for subsequent checks.
-  __ bind(&check_is_bytecode_array);
-  __ mov(data_type, FieldOperand(sfi_data, HeapObject::kMapOffset));
-  __ mov(data_type, FieldOperand(data_type, Map::kInstanceTypeOffset));
-
-  // IsBytecodeArray: Interpret bytecode
-  __ cmpw(data_type, Immediate(BYTECODE_ARRAY_TYPE));
-  __ j(not_equal, &check_is_code);
-  __ Move(sfi_data, BUILTIN_CODE(masm->isolate(), InterpreterEntryTrampoline));
-  __ jmp(&done);
-
-  // IsCode: Run code
-  __ bind(&check_is_code);
-  __ cmpw(data_type, Immediate(CODE_TYPE));
-  __ j(equal, &done);
-
-  // IsFixedArray: Instantiate using AsmWasmData,
-  __ bind(&check_is_fixed_array);
-  __ cmpw(data_type, Immediate(FIXED_ARRAY_TYPE));
-  __ j(not_equal, &check_is_pre_parsed_scope_data);
-  __ Move(sfi_data, BUILTIN_CODE(masm->isolate(), InstantiateAsmJs));
-  __ jmp(&done);
-
-  // IsPreParsedScopeData: Compile lazy
-  __ bind(&check_is_pre_parsed_scope_data);
-  __ cmpw(data_type, Immediate(TUPLE2_TYPE));
-  __ j(not_equal, &check_is_function_template_info);
-  __ Move(sfi_data, BUILTIN_CODE(masm->isolate(), CompileLazy));
-  __ jmp(&done);
-
-  // IsFunctionTemplateInfo: API call
-  __ bind(&check_is_function_template_info);
-  __ cmpw(data_type, Immediate(FUNCTION_TEMPLATE_INFO_TYPE));
-  __ j(not_equal, &check_is_interpreter_data);
-  __ Move(sfi_data, BUILTIN_CODE(masm->isolate(), HandleApiCall));
-  __ jmp(&done);
-
-  // IsInterpreterData: Interpret bytecode
-  __ bind(&check_is_interpreter_data);
-  if (FLAG_debug_code) {
-    __ cmpw(data_type, Immediate(INTERPRETER_DATA_TYPE));
-    __ Check(equal, AbortReason::kInvalidSharedFunctionInfoData);
-  }
-  __ mov(sfi_data,
-         FieldOperand(sfi_data, InterpreterData::kInterpreterTrampolineOffset));
-
-  __ bind(&done);
-}
-
-void Builtins::Generate_CompileLazy(MacroAssembler* masm) {
-  // ----------- S t a t e -------------
-  //  -- eax : argument count (preserved for callee)
-  //  -- edx : new target (preserved for callee)
-  //  -- edi : target function (preserved for callee)
-  // -----------------------------------
-  // First lookup code, maybe we don't need to compile!
-  Label gotta_call_runtime;
-
-  Register closure = edi;
-  Register feedback_vector = ebx;
-
-  // Do we have a valid feedback vector?
-  __ mov(feedback_vector,
-         FieldOperand(closure, JSFunction::kFeedbackCellOffset));
-  __ mov(feedback_vector, FieldOperand(feedback_vector, Cell::kValueOffset));
-  __ JumpIfRoot(feedback_vector, Heap::kUndefinedValueRootIndex,
-                &gotta_call_runtime);
-
-  // Is there an optimization marker or optimized code in the feedback vector?
-  MaybeTailCallOptimizedCodeSlot(masm, feedback_vector, ecx);
-
-  // We found no optimized code. Infer the code object needed for the SFI.
-  Register entry = ecx;
-  __ mov(entry, FieldOperand(closure, JSFunction::kSharedFunctionInfoOffset));
-  __ mov(entry, FieldOperand(entry, SharedFunctionInfo::kFunctionDataOffset));
-  GetSharedFunctionInfoCode(masm, entry, ebx);
-
-  // If code entry points to anything other than CompileLazy, install that.
-  __ Move(ebx, masm->CodeObject());
-  __ cmp(entry, ebx);
-  __ j(equal, &gotta_call_runtime);
-
-  // Install the SFI's code entry.
-  __ mov(FieldOperand(closure, JSFunction::kCodeOffset), entry);
-  __ RecordWriteField(closure, JSFunction::kCodeOffset, entry, ebx,
-                      kDontSaveFPRegs, OMIT_REMEMBERED_SET, OMIT_SMI_CHECK);
-  __ mov(entry, FieldOperand(closure, JSFunction::kCodeOffset));
-  __ lea(entry, FieldOperand(entry, Code::kHeaderSize));
-  __ jmp(entry);
-
-  __ bind(&gotta_call_runtime);
-  GenerateTailCallToReturnedCode(masm, Runtime::kCompileLazy);
-}
-
-// Lazy deserialization design doc: http://goo.gl/dxkYDZ.
-void Builtins::Generate_DeserializeLazy(MacroAssembler* masm) {
-  // ----------- S t a t e -------------
-  //  -- eax : argument count (preserved for callee)
-  //  -- edx : new target (preserved for callee)
-  //  -- edi : target function (preserved for callee)
-  // -----------------------------------
-
-  Label deserialize_in_runtime;
-
-  Register target = edi;  // Must be preserved
-  Register scratch0 = ebx;
-  Register scratch1 = ecx;
-
-  CHECK(scratch0 != eax && scratch0 != edx && scratch0 != edi);
-  CHECK(scratch1 != eax && scratch1 != edx && scratch1 != edi);
-  CHECK(scratch0 != scratch1);
-
-  // Load the builtin id for lazy deserialization from SharedFunctionInfo.
-
-  __ AssertFunction(target);
-  __ mov(scratch0, FieldOperand(target, JSFunction::kSharedFunctionInfoOffset));
-
-  __ mov(scratch1,
-         FieldOperand(scratch0, SharedFunctionInfo::kFunctionDataOffset));
-  __ AssertSmi(scratch1);
-
-  // The builtin may already have been deserialized. If that is the case, it is
-  // stored in the builtins table, and we can copy to correct code object to
-  // both the shared function info and function without calling into runtime.
-  //
-  // Otherwise, we need to call into runtime to deserialize.
-
-  {
-    // Load the code object at builtins_table[builtin_id] into scratch1.
-
-    __ SmiUntag(scratch1);
-    __ mov(scratch0,
-           Immediate(ExternalReference::builtins_address(masm->isolate())));
-    __ mov(scratch1, Operand(scratch0, scratch1, times_pointer_size, 0));
-
-    // Check if the loaded code object has already been deserialized. This is
-    // the case iff it does not equal DeserializeLazy.
-
-    __ Move(scratch0, masm->CodeObject());
-    __ cmp(scratch1, scratch0);
-    __ j(equal, &deserialize_in_runtime);
-  }
-
-  {
-    // If we've reached this spot, the target builtin has been deserialized and
-    // we simply need to copy it over to the target function.
-
-    Register target_builtin = scratch1;
-
-    __ mov(FieldOperand(target, JSFunction::kCodeOffset), target_builtin);
-    __ push(eax);  // Write barrier clobbers these below.
-    __ push(target_builtin);
-    __ RecordWriteField(target, JSFunction::kCodeOffset, target_builtin, eax,
-                        kDontSaveFPRegs, OMIT_REMEMBERED_SET, OMIT_SMI_CHECK);
-    __ pop(target_builtin);
-    __ pop(eax);
-
-    // All copying is done. Jump to the deserialized code object.
-
-    __ lea(target_builtin, FieldOperand(target_builtin, Code::kHeaderSize));
-    __ jmp(target_builtin);
-  }
-
-  __ bind(&deserialize_in_runtime);
-  GenerateTailCallToReturnedCode(masm, Runtime::kDeserializeLazy);
-}
-
 void Builtins::Generate_InstantiateAsmJs(MacroAssembler* masm) {
   // ----------- S t a t e -------------
   //  -- eax : argument count (preserved for callee)
@@ -1927,44 +1607,9 @@ void Builtins::Generate_InternalArrayConstructor(MacroAssembler* masm) {
 
   // Run the native code for the InternalArray function called as a normal
   // function.
-  // tail call a stub
-  __ mov(ebx, masm->isolate()->factory()->undefined_value());
-  InternalArrayConstructorStub stub(masm->isolate());
-  __ TailCallStub(&stub);
-}
-
-void Builtins::Generate_ArrayConstructor(MacroAssembler* masm) {
-  // ----------- S t a t e -------------
-  //  -- eax : argc
-  //  -- edi    : array function
-  //  -- esp[0] : return address
-  //  -- esp[4] : last argument
-  // -----------------------------------
-  Label generic_array_code;
-
-  if (FLAG_debug_code) {
-    // Initial map for the builtin Array function should be a map.
-    __ mov(ebx, FieldOperand(edi, JSFunction::kPrototypeOrInitialMapOffset));
-    // Will both indicate a nullptr and a Smi.
-    __ test(ebx, Immediate(kSmiTagMask));
-    __ Assert(not_zero, AbortReason::kUnexpectedInitialMapForArrayFunction);
-    __ CmpObjectType(ebx, MAP_TYPE, ecx);
-    __ Assert(equal, AbortReason::kUnexpectedInitialMapForArrayFunction);
-  }
-
-  // ebx is the AllocationSite - here undefined.
   __ mov(ebx, masm->isolate()->factory()->undefined_value());
-  // If edx (new target) is undefined, then this is the 'Call' case, so move
-  // edi (the constructor) to rdx.
-  Label call;
-  __ cmp(edx, ebx);
-  __ j(not_equal, &call);
-  __ mov(edx, edi);
-
-  // Run the native code for the Array function called as a normal function.
-  __ bind(&call);
-  ArrayConstructorStub stub(masm->isolate());
-  __ TailCallStub(&stub);
+  __ Jump(BUILTIN_CODE(masm->isolate(), InternalArrayConstructorImpl),
+          RelocInfo::CODE_TARGET);
 }
 
 static void EnterArgumentsAdaptorFrame(MacroAssembler* masm) {
@@ -2012,13 +1657,30 @@ void Builtins::Generate_CallOrConstructVarargs(MacroAssembler* masm,
   //  -- edx    : new.target (checked to be constructor or undefined)
   //  -- esp[0] : return address.
   // -----------------------------------
-  __ AssertFixedArray(ebx);
 
   // We need to preserve eax, edi and ebx.
   __ movd(xmm0, edx);
   __ movd(xmm1, edi);
   __ movd(xmm2, eax);
 
+  if (masm->emit_debug_code()) {
+    // Allow ebx to be a FixedArray, or a FixedDoubleArray if ecx == 0.
+    Label ok, fail;
+    __ AssertNotSmi(ebx);
+    __ mov(edx, FieldOperand(ebx, HeapObject::kMapOffset));
+    __ CmpInstanceType(edx, FIXED_ARRAY_TYPE);
+    __ j(equal, &ok);
+    __ CmpInstanceType(edx, FIXED_DOUBLE_ARRAY_TYPE);
+    __ j(not_equal, &fail);
+    __ cmp(ecx, 0);
+    __ j(equal, &ok);
+    // Fall through.
+    __ bind(&fail);
+    __ Abort(AbortReason::kOperandIsNotAFixedArray);
+
+    __ bind(&ok);
+  }
+
   // Check for stack overflow.
   {
     // Check the stack for overflow. We are not trying to catch interruptions
@@ -2114,8 +1776,8 @@ void Builtins::Generate_CallOrConstructForwardVarargs(MacroAssembler* masm,
   {
     __ mov(edx, Operand(ebp, JavaScriptFrameConstants::kFunctionOffset));
     __ mov(edx, FieldOperand(edx, JSFunction::kSharedFunctionInfoOffset));
-    __ mov(edx,
-           FieldOperand(edx, SharedFunctionInfo::kFormalParameterCountOffset));
+    __ movzx_w(edx, FieldOperand(
+                        edx, SharedFunctionInfo::kFormalParameterCountOffset));
     __ mov(ebx, ebp);
   }
   __ jmp(&arguments_done, Label::kNear);
@@ -2264,8 +1926,8 @@ void Builtins::Generate_CallFunction(MacroAssembler* masm,
   //  -- esi : the function context.
   // -----------------------------------
 
-  __ mov(ebx,
-         FieldOperand(edx, SharedFunctionInfo::kFormalParameterCountOffset));
+  __ movzx_w(
+      ebx, FieldOperand(edx, SharedFunctionInfo::kFormalParameterCountOffset));
   ParameterCount actual(eax);
   ParameterCount expected(ebx);
   __ InvokeFunctionCode(edi, no_reg, expected, actual, JUMP_FUNCTION);
@@ -2458,7 +2120,7 @@ void Builtins::Generate_ConstructFunction(MacroAssembler* masm) {
           RelocInfo::CODE_TARGET);
 
   __ bind(&call_generic_stub);
-  __ Jump(masm->isolate()->builtins()->JSConstructStubGeneric(),
+  __ Jump(BUILTIN_CODE(masm->isolate(), JSConstructStubGeneric),
           RelocInfo::CODE_TARGET);
 }
 
@@ -2543,48 +2205,6 @@ void Builtins::Generate_Construct(MacroAssembler* masm) {
           RelocInfo::CODE_TARGET);
 }
 
-// static
-void Builtins::Generate_AllocateInNewSpace(MacroAssembler* masm) {
-  // ----------- S t a t e -------------
-  //  -- edx    : requested object size (untagged)
-  //  -- esp[0] : return address
-  // -----------------------------------
-  __ SmiTag(edx);
-  __ PopReturnAddressTo(ecx);
-  __ Push(edx);
-  __ PushReturnAddressFrom(ecx);
-  __ Move(esi, Smi::kZero);
-  __ TailCallRuntime(Runtime::kAllocateInNewSpace);
-}
-
-// static
-void Builtins::Generate_AllocateInOldSpace(MacroAssembler* masm) {
-  // ----------- S t a t e -------------
-  //  -- edx    : requested object size (untagged)
-  //  -- esp[0] : return address
-  // -----------------------------------
-  __ SmiTag(edx);
-  __ PopReturnAddressTo(ecx);
-  __ Push(edx);
-  __ Push(Smi::FromInt(AllocateTargetSpace::encode(OLD_SPACE)));
-  __ PushReturnAddressFrom(ecx);
-  __ Move(esi, Smi::kZero);
-  __ TailCallRuntime(Runtime::kAllocateInTargetSpace);
-}
-
-// static
-void Builtins::Generate_Abort(MacroAssembler* masm) {
-  // ----------- S t a t e -------------
-  //  -- edx    : message_id as Smi
-  //  -- esp[0] : return address
-  // -----------------------------------
-  __ PopReturnAddressTo(ecx);
-  __ Push(edx);
-  __ PushReturnAddressFrom(ecx);
-  __ Move(esi, Smi::kZero);
-  __ TailCallRuntime(Runtime::kAbort);
-}
-
 void Builtins::Generate_ArgumentsAdaptorTrampoline(MacroAssembler* masm) {
   // ----------- S t a t e -------------
   //  -- eax : actual number of arguments
@@ -2597,10 +2217,10 @@ void Builtins::Generate_ArgumentsAdaptorTrampoline(MacroAssembler* masm) {
   __ IncrementCounter(masm->isolate()->counters()->arguments_adaptors(), 1);
 
   Label enough, too_few;
-  __ cmp(eax, ebx);
-  __ j(less, &too_few);
   __ cmp(ebx, SharedFunctionInfo::kDontAdaptArgumentsSentinel);
   __ j(equal, &dont_adapt_arguments);
+  __ cmp(eax, ebx);
+  __ j(less, &too_few);
 
   {  // Enough parameters: Actual >= expected.
     __ bind(&enough);
@@ -2759,50 +2379,513 @@ void Builtins::Generate_InterpreterOnStackReplacement(MacroAssembler* masm) {
 }
 
 void Builtins::Generate_WasmCompileLazy(MacroAssembler* masm) {
+  // The function index was put in edi by the jump table trampoline.
+  // Convert to Smi for the runtime call.
+  __ SmiTag(edi);
   {
-    FrameScope scope(masm, StackFrame::INTERNAL);
-
-    auto wasm_instance_reg = esi;  // TODO(titzer): put in a common place.
+    TrapOnAbortScope trap_on_abort_scope(masm);  // Avoid calls to Abort.
+    FrameScope scope(masm, StackFrame::WASM_COMPILE_LAZY);
 
     // Save all parameter registers (see wasm-linkage.cc). They might be
     // overwritten in the runtime call below. We don't have any callee-saved
     // registers in wasm, so no need to store anything else.
-    constexpr Register gp_regs[]{eax, ebx, ecx, edx};
-    constexpr XMMRegister xmm_regs[]{xmm1, xmm2, xmm3, xmm4, xmm5, xmm6};
-
-    for (auto reg : gp_regs) {
+    static_assert(WasmCompileLazyFrameConstants::kNumberOfSavedGpParamRegs ==
+                      arraysize(wasm::kGpParamRegisters),
+                  "frame size mismatch");
+    for (Register reg : wasm::kGpParamRegisters) {
       __ Push(reg);
     }
-    __ sub(esp, Immediate(16 * arraysize(xmm_regs)));
-    for (int i = 0, e = arraysize(xmm_regs); i < e; ++i) {
-      __ movdqu(Operand(esp, 16 * i), xmm_regs[i]);
+    static_assert(WasmCompileLazyFrameConstants::kNumberOfSavedFpParamRegs ==
+                      arraysize(wasm::kFpParamRegisters),
+                  "frame size mismatch");
+    __ sub(esp, Immediate(kSimd128Size * arraysize(wasm::kFpParamRegisters)));
+    int offset = 0;
+    for (DoubleRegister reg : wasm::kFpParamRegisters) {
+      __ movdqu(Operand(esp, offset), reg);
+      offset += kSimd128Size;
     }
 
-    // Pass the WASM instance as an explicit argument to WasmCompileLazy.
-    __ Push(wasm_instance_reg);
-    // Initialize the JavaScript context with 0. CEntryStub will use it to
+    // Push the WASM instance as an explicit argument to WasmCompileLazy.
+    __ Push(kWasmInstanceRegister);
+    // Push the function index as second argument.
+    __ Push(edi);
+    // Load the correct CEntry builtin from the instance object.
+    __ mov(ecx, FieldOperand(kWasmInstanceRegister,
+                             WasmInstanceObject::kCEntryStubOffset));
+    // Initialize the JavaScript context with 0. CEntry will use it to
     // set the current context on the isolate.
-    __ Move(esi, Smi::kZero);
-    __ CallRuntime(Runtime::kWasmCompileLazy);
-    // The entrypoint address is the first return value.
+    __ Move(kContextRegister, Smi::kZero);
+    __ CallRuntimeWithCEntry(Runtime::kWasmCompileLazy, ecx);
+    // The entrypoint address is the return value.
     __ mov(edi, kReturnRegister0);
-    // The WASM instance is the second return value.
-    __ mov(wasm_instance_reg, kReturnRegister1);
 
     // Restore registers.
-    for (int i = arraysize(xmm_regs) - 1; i >= 0; --i) {
-      __ movdqu(xmm_regs[i], Operand(esp, 16 * i));
+    for (DoubleRegister reg : base::Reversed(wasm::kFpParamRegisters)) {
+      offset -= kSimd128Size;
+      __ movdqu(reg, Operand(esp, offset));
     }
-    __ add(esp, Immediate(16 * arraysize(xmm_regs)));
-    for (int i = arraysize(gp_regs) - 1; i >= 0; --i) {
-      __ Pop(gp_regs[i]);
+    DCHECK_EQ(0, offset);
+    __ add(esp, Immediate(kSimd128Size * arraysize(wasm::kFpParamRegisters)));
+    for (Register reg : base::Reversed(wasm::kGpParamRegisters)) {
+      __ Pop(reg);
     }
   }
   // Finally, jump to the entrypoint.
   __ jmp(edi);
 }
 
+void Builtins::Generate_CEntry(MacroAssembler* masm, int result_size,
+                               SaveFPRegsMode save_doubles, ArgvMode argv_mode,
+                               bool builtin_exit_frame) {
+  // eax: number of arguments including receiver
+  // ebx: pointer to C function  (C callee-saved)
+  // ebp: frame pointer  (restored after C call)
+  // esp: stack pointer  (restored after C call)
+  // esi: current context (C callee-saved)
+  // edi: JS function of the caller (C callee-saved)
+  //
+  // If argv_mode == kArgvInRegister:
+  // ecx: pointer to the first argument
+
+  ProfileEntryHookStub::MaybeCallEntryHook(masm);
+
+  // Reserve space on the stack for the three arguments passed to the call. If
+  // result size is greater than can be returned in registers, also reserve
+  // space for the hidden argument for the result location, and space for the
+  // result itself.
+  int arg_stack_space = 3;
+
+  // Enter the exit frame that transitions from JavaScript to C++.
+  if (argv_mode == kArgvInRegister) {
+    DCHECK(save_doubles == kDontSaveFPRegs);
+    DCHECK(!builtin_exit_frame);
+    __ EnterApiExitFrame(arg_stack_space);
+
+    // Move argc and argv into the correct registers.
+    __ mov(esi, ecx);
+    __ mov(edi, eax);
+  } else {
+    __ EnterExitFrame(
+        arg_stack_space, save_doubles == kSaveFPRegs,
+        builtin_exit_frame ? StackFrame::BUILTIN_EXIT : StackFrame::EXIT);
+  }
+
+  // ebx: pointer to C function  (C callee-saved)
+  // ebp: frame pointer  (restored after C call)
+  // esp: stack pointer  (restored after C call)
+  // edi: number of arguments including receiver  (C callee-saved)
+  // esi: pointer to the first argument (C callee-saved)
+
+  // Result returned in eax, or eax+edx if result size is 2.
+
+  // Check stack alignment.
+  if (FLAG_debug_code) {
+    __ CheckStackAlignment();
+  }
+  // Call C function.
+  __ mov(Operand(esp, 0 * kPointerSize), edi);  // argc.
+  __ mov(Operand(esp, 1 * kPointerSize), esi);  // argv.
+  __ mov(Operand(esp, 2 * kPointerSize),
+         Immediate(ExternalReference::isolate_address(masm->isolate())));
+  __ call(ebx);
+
+  // Result is in eax or edx:eax - do not destroy these registers!
+
+  // Check result for exception sentinel.
+  Label exception_returned;
+  __ cmp(eax, masm->isolate()->factory()->exception());
+  __ j(equal, &exception_returned);
+
+  // Check that there is no pending exception, otherwise we
+  // should have returned the exception sentinel.
+  if (FLAG_debug_code) {
+    __ push(edx);
+    __ mov(edx, Immediate(masm->isolate()->factory()->the_hole_value()));
+    Label okay;
+    ExternalReference pending_exception_address = ExternalReference::Create(
+        IsolateAddressId::kPendingExceptionAddress, masm->isolate());
+    __ cmp(edx, Operand::StaticVariable(pending_exception_address));
+    // Cannot use check here as it attempts to generate call into runtime.
+    __ j(equal, &okay, Label::kNear);
+    __ int3();
+    __ bind(&okay);
+    __ pop(edx);
+  }
+
+  // Exit the JavaScript to C++ exit frame.
+  __ LeaveExitFrame(save_doubles == kSaveFPRegs, argv_mode == kArgvOnStack);
+  __ ret(0);
+
+  // Handling of exception.
+  __ bind(&exception_returned);
+
+  ExternalReference pending_handler_context_address = ExternalReference::Create(
+      IsolateAddressId::kPendingHandlerContextAddress, masm->isolate());
+  ExternalReference pending_handler_entrypoint_address =
+      ExternalReference::Create(
+          IsolateAddressId::kPendingHandlerEntrypointAddress, masm->isolate());
+  ExternalReference pending_handler_fp_address = ExternalReference::Create(
+      IsolateAddressId::kPendingHandlerFPAddress, masm->isolate());
+  ExternalReference pending_handler_sp_address = ExternalReference::Create(
+      IsolateAddressId::kPendingHandlerSPAddress, masm->isolate());
+
+  // Ask the runtime for help to determine the handler. This will set eax to
+  // contain the current pending exception, don't clobber it.
+  ExternalReference find_handler =
+      ExternalReference::Create(Runtime::kUnwindAndFindExceptionHandler);
+  {
+    FrameScope scope(masm, StackFrame::MANUAL);
+    __ PrepareCallCFunction(3, eax);
+    __ mov(Operand(esp, 0 * kPointerSize), Immediate(0));  // argc.
+    __ mov(Operand(esp, 1 * kPointerSize), Immediate(0));  // argv.
+    __ mov(Operand(esp, 2 * kPointerSize),
+           Immediate(ExternalReference::isolate_address(masm->isolate())));
+    __ CallCFunction(find_handler, 3);
+  }
+
+  // Retrieve the handler context, SP and FP.
+  __ mov(esi, Operand::StaticVariable(pending_handler_context_address));
+  __ mov(esp, Operand::StaticVariable(pending_handler_sp_address));
+  __ mov(ebp, Operand::StaticVariable(pending_handler_fp_address));
+
+  // If the handler is a JS frame, restore the context to the frame. Note that
+  // the context will be set to (esi == 0) for non-JS frames.
+  Label skip;
+  __ test(esi, esi);
+  __ j(zero, &skip, Label::kNear);
+  __ mov(Operand(ebp, StandardFrameConstants::kContextOffset), esi);
+  __ bind(&skip);
+
+  // Reset the masking register. This is done independent of the underlying
+  // feature flag {FLAG_branch_load_poisoning} to make the snapshot work with
+  // both configurations. It is safe to always do this, because the underlying
+  // register is caller-saved and can be arbitrarily clobbered.
+  __ ResetSpeculationPoisonRegister();
+
+  // Compute the handler entry address and jump to it.
+  __ mov(edi, Operand::StaticVariable(pending_handler_entrypoint_address));
+  __ jmp(edi);
+}
+
+void Builtins::Generate_DoubleToI(MacroAssembler* masm) {
+  Label check_negative, process_64_bits, done;
+
+  // Account for return address and saved regs.
+  const int kArgumentOffset = 4 * kPointerSize;
+
+  MemOperand mantissa_operand(MemOperand(esp, kArgumentOffset));
+  MemOperand exponent_operand(
+      MemOperand(esp, kArgumentOffset + kDoubleSize / 2));
+
+  // The result is returned on the stack.
+  MemOperand return_operand = mantissa_operand;
+
+  Register scratch1 = ebx;
+
+  // Since we must use ecx for shifts below, use some other register (eax)
+  // to calculate the result.
+  Register result_reg = eax;
+  // Save ecx if it isn't the return register and therefore volatile, or if it
+  // is the return register, then save the temp register we use in its stead for
+  // the result.
+  Register save_reg = eax;
+  __ push(ecx);
+  __ push(scratch1);
+  __ push(save_reg);
+
+  __ mov(scratch1, mantissa_operand);
+  if (CpuFeatures::IsSupported(SSE3)) {
+    CpuFeatureScope scope(masm, SSE3);
+    // Load x87 register with heap number.
+    __ fld_d(mantissa_operand);
+  }
+  __ mov(ecx, exponent_operand);
+
+  __ and_(ecx, HeapNumber::kExponentMask);
+  __ shr(ecx, HeapNumber::kExponentShift);
+  __ lea(result_reg, MemOperand(ecx, -HeapNumber::kExponentBias));
+  __ cmp(result_reg, Immediate(HeapNumber::kMantissaBits));
+  __ j(below, &process_64_bits);
+
+  // Result is entirely in lower 32-bits of mantissa
+  int delta = HeapNumber::kExponentBias + Double::kPhysicalSignificandSize;
+  if (CpuFeatures::IsSupported(SSE3)) {
+    __ fstp(0);
+  }
+  __ sub(ecx, Immediate(delta));
+  __ xor_(result_reg, result_reg);
+  __ cmp(ecx, Immediate(31));
+  __ j(above, &done);
+  __ shl_cl(scratch1);
+  __ jmp(&check_negative);
+
+  __ bind(&process_64_bits);
+  if (CpuFeatures::IsSupported(SSE3)) {
+    CpuFeatureScope scope(masm, SSE3);
+    // Reserve space for 64 bit answer.
+    __ sub(esp, Immediate(kDoubleSize));  // Nolint.
+    // Do conversion, which cannot fail because we checked the exponent.
+    __ fisttp_d(Operand(esp, 0));
+    __ mov(result_reg, Operand(esp, 0));  // Load low word of answer as result
+    __ add(esp, Immediate(kDoubleSize));
+    __ jmp(&done);
+  } else {
+    // Result must be extracted from shifted 32-bit mantissa
+    __ sub(ecx, Immediate(delta));
+    __ neg(ecx);
+    __ mov(result_reg, exponent_operand);
+    __ and_(result_reg,
+            Immediate(static_cast<uint32_t>(Double::kSignificandMask >> 32)));
+    __ add(result_reg,
+           Immediate(static_cast<uint32_t>(Double::kHiddenBit >> 32)));
+    __ shrd_cl(scratch1, result_reg);
+    __ shr_cl(result_reg);
+    __ test(ecx, Immediate(32));
+    __ cmov(not_equal, scratch1, result_reg);
+  }
+
+  // If the double was negative, negate the integer result.
+  __ bind(&check_negative);
+  __ mov(result_reg, scratch1);
+  __ neg(result_reg);
+  __ cmp(exponent_operand, Immediate(0));
+  __ cmov(greater, result_reg, scratch1);
+
+  // Restore registers
+  __ bind(&done);
+  __ mov(return_operand, result_reg);
+  __ pop(save_reg);
+  __ pop(scratch1);
+  __ pop(ecx);
+  __ ret(0);
+}
+
+void Builtins::Generate_MathPowInternal(MacroAssembler* masm) {
+  const Register exponent = eax;
+  const Register scratch = ecx;
+  const XMMRegister double_result = xmm3;
+  const XMMRegister double_base = xmm2;
+  const XMMRegister double_exponent = xmm1;
+  const XMMRegister double_scratch = xmm4;
+
+  Label call_runtime, done, exponent_not_smi, int_exponent;
+
+  // Save 1 in double_result - we need this several times later on.
+  __ mov(scratch, Immediate(1));
+  __ Cvtsi2sd(double_result, scratch);
+
+  Label fast_power, try_arithmetic_simplification;
+  __ DoubleToI(exponent, double_exponent, double_scratch,
+               &try_arithmetic_simplification, &try_arithmetic_simplification);
+  __ jmp(&int_exponent);
+
+  __ bind(&try_arithmetic_simplification);
+  // Skip to runtime if possibly NaN (indicated by the indefinite integer).
+  __ cvttsd2si(exponent, Operand(double_exponent));
+  __ cmp(exponent, Immediate(0x1));
+  __ j(overflow, &call_runtime);
+
+  // Using FPU instructions to calculate power.
+  Label fast_power_failed;
+  __ bind(&fast_power);
+  __ fnclex();  // Clear flags to catch exceptions later.
+  // Transfer (B)ase and (E)xponent onto the FPU register stack.
+  __ sub(esp, Immediate(kDoubleSize));
+  __ movsd(Operand(esp, 0), double_exponent);
+  __ fld_d(Operand(esp, 0));  // E
+  __ movsd(Operand(esp, 0), double_base);
+  __ fld_d(Operand(esp, 0));  // B, E
+
+  // Exponent is in st(1) and base is in st(0)
+  // B ^ E = (2^(E * log2(B)) - 1) + 1 = (2^X - 1) + 1 for X = E * log2(B)
+  // FYL2X calculates st(1) * log2(st(0))
+  __ fyl2x();    // X
+  __ fld(0);     // X, X
+  __ frndint();  // rnd(X), X
+  __ fsub(1);    // rnd(X), X-rnd(X)
+  __ fxch(1);    // X - rnd(X), rnd(X)
+  // F2XM1 calculates 2^st(0) - 1 for -1 < st(0) < 1
+  __ f2xm1();   // 2^(X-rnd(X)) - 1, rnd(X)
+  __ fld1();    // 1, 2^(X-rnd(X)) - 1, rnd(X)
+  __ faddp(1);  // 2^(X-rnd(X)), rnd(X)
+  // FSCALE calculates st(0) * 2^st(1)
+  __ fscale();  // 2^X, rnd(X)
+  __ fstp(1);   // 2^X
+  // Bail out to runtime in case of exceptions in the status word.
+  __ fnstsw_ax();
+  __ test_b(eax, Immediate(0x5F));  // We check for all but precision exception.
+  __ j(not_zero, &fast_power_failed, Label::kNear);
+  __ fstp_d(Operand(esp, 0));
+  __ movsd(double_result, Operand(esp, 0));
+  __ add(esp, Immediate(kDoubleSize));
+  __ jmp(&done);
+
+  __ bind(&fast_power_failed);
+  __ fninit();
+  __ add(esp, Immediate(kDoubleSize));
+  __ jmp(&call_runtime);
+
+  // Calculate power with integer exponent.
+  __ bind(&int_exponent);
+  const XMMRegister double_scratch2 = double_exponent;
+  __ mov(scratch, exponent);                 // Back up exponent.
+  __ movsd(double_scratch, double_base);     // Back up base.
+  __ movsd(double_scratch2, double_result);  // Load double_exponent with 1.
+
+  // Get absolute value of exponent.
+  Label no_neg, while_true, while_false;
+  __ test(scratch, scratch);
+  __ j(positive, &no_neg, Label::kNear);
+  __ neg(scratch);
+  __ bind(&no_neg);
+
+  __ j(zero, &while_false, Label::kNear);
+  __ shr(scratch, 1);
+  // Above condition means CF==0 && ZF==0.  This means that the
+  // bit that has been shifted out is 0 and the result is not 0.
+  __ j(above, &while_true, Label::kNear);
+  __ movsd(double_result, double_scratch);
+  __ j(zero, &while_false, Label::kNear);
+
+  __ bind(&while_true);
+  __ shr(scratch, 1);
+  __ mulsd(double_scratch, double_scratch);
+  __ j(above, &while_true, Label::kNear);
+  __ mulsd(double_result, double_scratch);
+  __ j(not_zero, &while_true);
+
+  __ bind(&while_false);
+  // scratch has the original value of the exponent - if the exponent is
+  // negative, return 1/result.
+  __ test(exponent, exponent);
+  __ j(positive, &done);
+  __ divsd(double_scratch2, double_result);
+  __ movsd(double_result, double_scratch2);
+  // Test whether result is zero.  Bail out to check for subnormal result.
+  // Due to subnormals, x^-y == (1/x)^y does not hold in all cases.
+  __ xorps(double_scratch2, double_scratch2);
+  __ ucomisd(double_scratch2, double_result);  // Result cannot be NaN.
+  // double_exponent aliased as double_scratch2 has already been overwritten
+  // and may not have contained the exponent value in the first place when the
+  // exponent is a smi.  We reset it with exponent value before bailing out.
+  __ j(not_equal, &done);
+  __ Cvtsi2sd(double_exponent, exponent);
+
+  // Returning or bailing out.
+  __ bind(&call_runtime);
+  {
+    AllowExternalCallThatCantCauseGC scope(masm);
+    __ PrepareCallCFunction(4, scratch);
+    __ movsd(Operand(esp, 0 * kDoubleSize), double_base);
+    __ movsd(Operand(esp, 1 * kDoubleSize), double_exponent);
+    __ CallCFunction(ExternalReference::power_double_double_function(), 4);
+  }
+  // Return value is in st(0) on ia32.
+  // Store it into the (fixed) result register.
+  __ sub(esp, Immediate(kDoubleSize));
+  __ fstp_d(Operand(esp, 0));
+  __ movsd(double_result, Operand(esp, 0));
+  __ add(esp, Immediate(kDoubleSize));
+
+  __ bind(&done);
+  __ ret(0);
+}
+
+namespace {
+
+void GenerateInternalArrayConstructorCase(MacroAssembler* masm,
+                                          ElementsKind kind) {
+  Label not_zero_case, not_one_case;
+  Label normal_sequence;
+
+  __ test(eax, eax);
+  __ j(not_zero, &not_zero_case);
+  __ Jump(CodeFactory::InternalArrayNoArgumentConstructor(masm->isolate(), kind)
+              .code(),
+          RelocInfo::CODE_TARGET);
+
+  __ bind(&not_zero_case);
+  __ cmp(eax, 1);
+  __ j(greater, &not_one_case);
+
+  if (IsFastPackedElementsKind(kind)) {
+    // We might need to create a holey array
+    // look at the first argument
+    __ mov(ecx, Operand(esp, kPointerSize));
+    __ test(ecx, ecx);
+    __ j(zero, &normal_sequence);
+
+    __ Jump(CodeFactory::InternalArraySingleArgumentConstructor(
+                masm->isolate(), GetHoleyElementsKind(kind))
+                .code(),
+            RelocInfo::CODE_TARGET);
+  }
+
+  __ bind(&normal_sequence);
+  __ Jump(
+      CodeFactory::InternalArraySingleArgumentConstructor(masm->isolate(), kind)
+          .code(),
+      RelocInfo::CODE_TARGET);
+
+  __ bind(&not_one_case);
+  Handle<Code> code = BUILTIN_CODE(masm->isolate(), ArrayNArgumentsConstructor);
+  __ Jump(code, RelocInfo::CODE_TARGET);
+}
+
+}  // namespace
+
+void Builtins::Generate_InternalArrayConstructorImpl(MacroAssembler* masm) {
+  // ----------- S t a t e -------------
+  //  -- eax : argc
+  //  -- edi : constructor
+  //  -- esp[0] : return address
+  //  -- esp[4] : last argument
+  // -----------------------------------
+
+  if (FLAG_debug_code) {
+    // The array construct code is only set for the global and natives
+    // builtin Array functions which always have maps.
+
+    // Initial map for the builtin Array function should be a map.
+    __ mov(ecx, FieldOperand(edi, JSFunction::kPrototypeOrInitialMapOffset));
+    // Will both indicate a nullptr and a Smi.
+    __ test(ecx, Immediate(kSmiTagMask));
+    __ Assert(not_zero, AbortReason::kUnexpectedInitialMapForArrayFunction);
+    __ CmpObjectType(ecx, MAP_TYPE, ecx);
+    __ Assert(equal, AbortReason::kUnexpectedInitialMapForArrayFunction);
+  }
+
+  // Figure out the right elements kind
+  __ mov(ecx, FieldOperand(edi, JSFunction::kPrototypeOrInitialMapOffset));
+
+  // Load the map's "bit field 2" into |result|. We only need the first byte,
+  // but the following masking takes care of that anyway.
+  __ mov(ecx, FieldOperand(ecx, Map::kBitField2Offset));
+  // Retrieve elements_kind from bit field 2.
+  __ DecodeField<Map::ElementsKindBits>(ecx);
+
+  if (FLAG_debug_code) {
+    Label done;
+    __ cmp(ecx, Immediate(PACKED_ELEMENTS));
+    __ j(equal, &done);
+    __ cmp(ecx, Immediate(HOLEY_ELEMENTS));
+    __ Assert(
+        equal,
+        AbortReason::kInvalidElementsKindForInternalArrayOrInternalPackedArray);
+    __ bind(&done);
+  }
+
+  Label fast_elements_case;
+  __ cmp(ecx, Immediate(PACKED_ELEMENTS));
+  __ j(equal, &fast_elements_case);
+  GenerateInternalArrayConstructorCase(masm, HOLEY_ELEMENTS);
+
+  __ bind(&fast_elements_case);
+  GenerateInternalArrayConstructorCase(masm, PACKED_ELEMENTS);
+}
+
 #undef __
+
 }  // namespace internal
 }  // namespace v8
 
diff --git a/deps/v8/src/builtins/mips/builtins-mips.cc b/deps/v8/src/builtins/mips/builtins-mips.cc
index 34faac09692bff..12c1d6075747b8 100644
--- a/deps/v8/src/builtins/mips/builtins-mips.cc
+++ b/deps/v8/src/builtins/mips/builtins-mips.cc
@@ -4,12 +4,14 @@
 
 #if V8_TARGET_ARCH_MIPS
 
+#include "src/code-factory.h"
 #include "src/code-stubs.h"
 #include "src/counters.h"
 #include "src/debug/debug.h"
 #include "src/deoptimizer.h"
 #include "src/frame-constants.h"
 #include "src/frames.h"
+#include "src/mips/constants-mips.h"
 #include "src/objects-inl.h"
 #include "src/runtime/runtime.h"
 
@@ -20,7 +22,7 @@ namespace internal {
 
 void Builtins::Generate_Adaptor(MacroAssembler* masm, Address address,
                                 ExitFrameType exit_frame_type) {
-  __ li(s2, Operand(ExternalReference(address, masm->isolate())));
+  __ li(kJavaScriptCallExtraArg1Register, ExternalReference::Create(address));
   if (exit_frame_type == BUILTIN_EXIT) {
     __ Jump(BUILTIN_CODE(masm->isolate(), AdaptorWithBuiltinExitFrame),
             RelocInfo::CODE_TARGET);
@@ -31,57 +33,6 @@ void Builtins::Generate_Adaptor(MacroAssembler* masm, Address address,
   }
 }
 
-namespace {
-
-void AdaptorWithExitFrameType(MacroAssembler* masm,
-                              Builtins::ExitFrameType exit_frame_type) {
-  // ----------- S t a t e -------------
-  //  -- a0                 : number of arguments excluding receiver
-  //  -- a1                 : target
-  //  -- a3                 : new.target
-  //  -- s2                 : entry point
-  //  -- sp[0]              : last argument
-  //  -- ...
-  //  -- sp[4 * (argc - 1)] : first argument
-  //  -- sp[4 * agrc]       : receiver
-  // -----------------------------------
-  __ AssertFunction(a1);
-
-  // Make sure we operate in the context of the called function (for example
-  // ConstructStubs implemented in C++ will be run in the context of the caller
-  // instead of the callee, due to the way that [[Construct]] is defined for
-  // ordinary functions).
-  __ lw(cp, FieldMemOperand(a1, JSFunction::kContextOffset));
-
-  // CEntryStub expects a0 to contain the number of arguments including the
-  // receiver and the extra arguments.
-  __ Addu(a0, a0, BuiltinExitFrameConstants::kNumExtraArgsWithReceiver);
-
-  // Insert extra arguments.
-  __ PushRoot(Heap::kTheHoleValueRootIndex);  // Padding.
-  __ SmiTag(a0);
-  __ Push(a0, a1, a3);
-  __ SmiUntag(a0);
-
-  // Jump to the C entry runtime stub directly here instead of using
-  // JumpToExternalReference. We have already loaded entry point to s2
-  // in Generate_adaptor.
-  __ mov(a1, s2);
-  CEntryStub stub(masm->isolate(), 1, kDontSaveFPRegs, kArgvOnStack,
-                  exit_frame_type == Builtins::BUILTIN_EXIT);
-  __ Jump(stub.GetCode(), RelocInfo::CODE_TARGET, al, zero_reg,
-          Operand(zero_reg), PROTECT);
-}
-}  // namespace
-
-void Builtins::Generate_AdaptorWithExitFrame(MacroAssembler* masm) {
-  AdaptorWithExitFrameType(masm, EXIT);
-}
-
-void Builtins::Generate_AdaptorWithBuiltinExitFrame(MacroAssembler* masm) {
-  AdaptorWithExitFrameType(masm, BUILTIN_EXIT);
-}
-
 void Builtins::Generate_InternalArrayConstructor(MacroAssembler* masm) {
   // ----------- S t a t e -------------
   //  -- a0     : number of arguments
@@ -103,44 +54,9 @@ void Builtins::Generate_InternalArrayConstructor(MacroAssembler* masm) {
 
   // Run the native code for the InternalArray function called as a normal
   // function.
-  // Tail call a stub.
-  __ LoadRoot(a2, Heap::kUndefinedValueRootIndex);
-  InternalArrayConstructorStub stub(masm->isolate());
-  __ TailCallStub(&stub);
-}
-
-void Builtins::Generate_ArrayConstructor(MacroAssembler* masm) {
-  // ----------- S t a t e -------------
-  //  -- a0     : number of arguments
-  //  -- a1     : array function
-  //  -- ra     : return address
-  //  -- sp[...]: constructor arguments
-  // -----------------------------------
-  Label generic_array_code;
-
-  if (FLAG_debug_code) {
-    // Initial map for the builtin Array functions should be maps.
-    __ lw(a2, FieldMemOperand(a1, JSFunction::kPrototypeOrInitialMapOffset));
-    __ SmiTst(a2, t0);
-    __ Assert(ne, AbortReason::kUnexpectedInitialMapForArrayFunction1, t0,
-              Operand(zero_reg));
-    __ GetObjectType(a2, t1, t0);
-    __ Assert(eq, AbortReason::kUnexpectedInitialMapForArrayFunction2, t0,
-              Operand(MAP_TYPE));
-  }
-
-  // a2 is the AllocationSite - here undefined.
   __ LoadRoot(a2, Heap::kUndefinedValueRootIndex);
-  // If a3 (new target) is undefined, then this is the 'Call' case, so move
-  // a1 (the constructor) to a3.
-  Label call;
-  __ Branch(&call, ne, a3, Operand(a2));
-  __ mov(a3, a1);
-
-  // Run the native code for the Array function called as a normal function.
-  __ bind(&call);
-  ArrayConstructorStub stub(masm->isolate());
-  __ TailCallStub(&stub);
+  __ Jump(BUILTIN_CODE(masm->isolate(), InternalArrayConstructorImpl),
+          RelocInfo::CODE_TARGET);
 }
 
 static void GenerateTailCallToReturnedCode(MacroAssembler* masm,
@@ -237,9 +153,10 @@ void Generate_JSBuiltinsConstructStubHelper(MacroAssembler* masm) {
   __ Ret();
 }
 
+}  // namespace
+
 // The construct stub for ES5 constructor functions and ES6 class constructors.
-void Generate_JSConstructStubGeneric(MacroAssembler* masm,
-                                     bool restrict_constructor_return) {
+void Builtins::Generate_JSConstructStubGeneric(MacroAssembler* masm) {
   // ----------- S t a t e -------------
   //  --      a0: number of arguments (untagged)
   //  --      a1: constructor function
@@ -369,7 +286,7 @@ void Generate_JSConstructStubGeneric(MacroAssembler* masm,
     // If the result is an object (in the ECMA sense), we should get rid
     // of the receiver and use the result; see ECMA-262 section 13.2.2-7
     // on page 74.
-    Label use_receiver, do_throw, other_result, leave_frame;
+    Label use_receiver, do_throw, leave_frame;
 
     // If the result is undefined, we jump out to using the implicit receiver.
     __ JumpIfRoot(v0, Heap::kUndefinedValueRootIndex, &use_receiver);
@@ -378,30 +295,14 @@ void Generate_JSConstructStubGeneric(MacroAssembler* masm,
     // is a valid receiver.
 
     // If the result is a smi, it is *not* an object in the ECMA sense.
-    __ JumpIfSmi(v0, &other_result);
+    __ JumpIfSmi(v0, &use_receiver);
 
     // If the type of the result (stored in its map) is less than
     // FIRST_JS_RECEIVER_TYPE, it is not an object in the ECMA sense.
     __ GetObjectType(v0, t2, t2);
     STATIC_ASSERT(LAST_JS_RECEIVER_TYPE == LAST_TYPE);
     __ Branch(&leave_frame, greater_equal, t2, Operand(FIRST_JS_RECEIVER_TYPE));
-
-    // The result is now neither undefined nor an object.
-    __ bind(&other_result);
-    __ lw(a1, MemOperand(fp, ConstructFrameConstants::kConstructorOffset));
-    __ lw(t2, FieldMemOperand(a1, JSFunction::kSharedFunctionInfoOffset));
-    __ lw(t2, FieldMemOperand(t2, SharedFunctionInfo::kFlagsOffset));
-    __ And(t2, t2, Operand(SharedFunctionInfo::IsClassConstructorBit::kMask));
-
-    if (restrict_constructor_return) {
-      // Throw if constructor function is a class constructor
-      __ Branch(&use_receiver, eq, t2, Operand(zero_reg));
-    } else {
-      __ Branch(&use_receiver, ne, t2, Operand(zero_reg));
-      __ CallRuntime(
-          Runtime::kIncrementUseCounterConstructorReturnNonUndefinedPrimitive);
-      __ Branch(&use_receiver);
-    }
+    __ Branch(&use_receiver);
 
     __ bind(&do_throw);
     __ CallRuntime(Runtime::kThrowConstructorReturnedNonObject);
@@ -423,16 +324,6 @@ void Generate_JSConstructStubGeneric(MacroAssembler* masm,
   __ Ret();
 }
 
-}  // namespace
-
-void Builtins::Generate_JSConstructStubGenericRestrictedReturn(
-    MacroAssembler* masm) {
-  Generate_JSConstructStubGeneric(masm, true);
-}
-void Builtins::Generate_JSConstructStubGenericUnrestrictedReturn(
-    MacroAssembler* masm) {
-  Generate_JSConstructStubGeneric(masm, false);
-}
 void Builtins::Generate_JSBuiltinsConstructStub(MacroAssembler* masm) {
   Generate_JSBuiltinsConstructStubHelper(masm);
 }
@@ -466,8 +357,6 @@ static void Generate_CheckStackOverflow(MacroAssembler* masm, Register argc) {
 
 static void Generate_JSEntryTrampolineHelper(MacroAssembler* masm,
                                              bool is_construct) {
-  // Called from JSEntryStub::GenerateBody
-
   // ----------- S t a t e -------------
   //  -- a0: new.target
   //  -- a1: function
@@ -482,9 +371,9 @@ static void Generate_JSEntryTrampolineHelper(MacroAssembler* masm,
     FrameScope scope(masm, StackFrame::INTERNAL);
 
     // Setup the context (we need to use the caller context from the isolate).
-    ExternalReference context_address(IsolateAddressId::kContextAddress,
-                                      masm->isolate());
-    __ li(cp, Operand(context_address));
+    ExternalReference context_address = ExternalReference::Create(
+        IsolateAddressId::kContextAddress, masm->isolate());
+    __ li(cp, context_address);
     __ lw(cp, MemOperand(cp));
 
     // Push the function and the receiver onto the stack.
@@ -585,14 +474,14 @@ void Builtins::Generate_ResumeGeneratorTrampoline(MacroAssembler* masm) {
   Label stepping_prepared;
   ExternalReference debug_hook =
       ExternalReference::debug_hook_on_function_call_address(masm->isolate());
-  __ li(t1, Operand(debug_hook));
+  __ li(t1, debug_hook);
   __ lb(t1, MemOperand(t1));
   __ Branch(&prepare_step_in_if_stepping, ne, t1, Operand(zero_reg));
 
   // Flood function if we need to continue stepping in the suspended generator.
   ExternalReference debug_suspended_generator =
       ExternalReference::debug_suspended_generator_address(masm->isolate());
-  __ li(t1, Operand(debug_suspended_generator));
+  __ li(t1, debug_suspended_generator);
   __ lw(t1, MemOperand(t1));
   __ Branch(&prepare_step_in_suspended_generator, eq, a1, Operand(t1));
   __ bind(&stepping_prepared);
@@ -600,8 +489,8 @@ void Builtins::Generate_ResumeGeneratorTrampoline(MacroAssembler* masm) {
   // Check the stack for overflow. We are not trying to catch interruptions
   // (i.e. debug break and preemption) here, so check the "real stack limit".
   Label stack_overflow;
-  __ LoadRoot(at, Heap::kRealStackLimitRootIndex);
-  __ Branch(&stack_overflow, lo, sp, Operand(at));
+  __ LoadRoot(kScratchReg, Heap::kRealStackLimitRootIndex);
+  __ Branch(&stack_overflow, lo, sp, Operand(kScratchReg));
 
   // Push receiver.
   __ lw(t1, FieldMemOperand(a1, JSGeneratorObject::kReceiverOffset));
@@ -615,19 +504,23 @@ void Builtins::Generate_ResumeGeneratorTrampoline(MacroAssembler* masm) {
   //  -- sp[0] : generator receiver
   // -----------------------------------
 
-  // Push holes for arguments to generator function. Since the parser forced
-  // context allocation for any variables in generators, the actual argument
-  // values have already been copied into the context and these dummy values
-  // will never be used.
+  // Copy the function arguments from the generator object's register file.
+
   __ lw(a3, FieldMemOperand(t0, JSFunction::kSharedFunctionInfoOffset));
-  __ lw(a3,
-        FieldMemOperand(a3, SharedFunctionInfo::kFormalParameterCountOffset));
+  __ lhu(a3,
+         FieldMemOperand(a3, SharedFunctionInfo::kFormalParameterCountOffset));
+  __ lw(t1,
+        FieldMemOperand(a1, JSGeneratorObject::kParametersAndRegistersOffset));
   {
     Label done_loop, loop;
+    __ Move(t2, zero_reg);
     __ bind(&loop);
     __ Subu(a3, a3, Operand(1));
     __ Branch(&done_loop, lt, a3, Operand(zero_reg));
-    __ PushRoot(Heap::kTheHoleValueRootIndex);
+    __ Lsa(kScratchReg, t1, t2, kPointerSizeLog2);
+    __ lw(kScratchReg, FieldMemOperand(kScratchReg, FixedArray::kHeaderSize));
+    __ Push(kScratchReg);
+    __ Addu(t2, t2, Operand(1));
     __ Branch(&loop);
     __ bind(&done_loop);
   }
@@ -645,8 +538,8 @@ void Builtins::Generate_ResumeGeneratorTrampoline(MacroAssembler* masm) {
   // Resume (Ignition/TurboFan) generator object.
   {
     __ lw(a0, FieldMemOperand(t0, JSFunction::kSharedFunctionInfoOffset));
-    __ lw(a0,
-          FieldMemOperand(a0, SharedFunctionInfo::kFormalParameterCountOffset));
+    __ lhu(a0, FieldMemOperand(
+                   a0, SharedFunctionInfo::kFormalParameterCountOffset));
     // We abuse new.target both to indicate that this is a resume call and to
     // pass in the generator object.  In ordinary calls, new.target is always
     // undefined because generator functions are non-constructable.
@@ -662,6 +555,8 @@ void Builtins::Generate_ResumeGeneratorTrampoline(MacroAssembler* masm) {
   {
     FrameScope scope(masm, StackFrame::INTERNAL);
     __ Push(a1, t0);
+    // Push hole as receiver since we do not use it for stepping.
+    __ PushRoot(Heap::kTheHoleValueRootIndex);
     __ CallRuntime(Runtime::kDebugOnFunctionCall);
     __ Pop(a1);
   }
@@ -830,9 +725,7 @@ static void AdvanceBytecodeOffsetOrReturn(MacroAssembler* masm,
   DCHECK(!AreAliased(bytecode_array, bytecode_offset, bytecode_size_table,
                      bytecode));
 
-  __ li(
-      bytecode_size_table,
-      Operand(ExternalReference::bytecode_size_table_address(masm->isolate())));
+  __ li(bytecode_size_table, ExternalReference::bytecode_size_table_address());
 
   // Check if the bytecode is a Wide or ExtraWide prefix bytecode.
   Label process_bytecode, extra_wide;
@@ -911,16 +804,12 @@ void Builtins::Generate_InterpreterEntryTrampoline(MacroAssembler* masm) {
   FrameScope frame_scope(masm, StackFrame::MANUAL);
   __ PushStandardFrame(closure);
 
-  // Get the bytecode array from the function object (or from the DebugInfo if
-  // it is present) and load it into kInterpreterBytecodeArrayRegister.
-  Label maybe_load_debug_bytecode_array, bytecode_array_loaded;
+  // Get the bytecode array from the function object and load it into
+  // kInterpreterBytecodeArrayRegister.
   __ lw(a0, FieldMemOperand(closure, JSFunction::kSharedFunctionInfoOffset));
   __ lw(kInterpreterBytecodeArrayRegister,
         FieldMemOperand(a0, SharedFunctionInfo::kFunctionDataOffset));
   GetSharedFunctionInfoBytecode(masm, kInterpreterBytecodeArrayRegister, t0);
-  __ lw(t0, FieldMemOperand(a0, SharedFunctionInfo::kDebugInfoOffset));
-  __ JumpIfNotSmi(t0, &maybe_load_debug_bytecode_array);
-  __ bind(&bytecode_array_loaded);
 
   // Increment invocation count for the function.
   __ lw(t0, FieldMemOperand(feedback_vector,
@@ -1002,13 +891,12 @@ void Builtins::Generate_InterpreterEntryTrampoline(MacroAssembler* masm) {
   Label do_dispatch;
   __ bind(&do_dispatch);
   __ li(kInterpreterDispatchTableRegister,
-        Operand(ExternalReference::interpreter_dispatch_table_address(
-            masm->isolate())));
+        ExternalReference::interpreter_dispatch_table_address(masm->isolate()));
   __ Addu(a0, kInterpreterBytecodeArrayRegister,
           kInterpreterBytecodeOffsetRegister);
   __ lbu(t3, MemOperand(a0));
-  __ Lsa(at, kInterpreterDispatchTableRegister, t3, kPointerSizeLog2);
-  __ lw(kJavaScriptCallCodeStartRegister, MemOperand(at));
+  __ Lsa(kScratchReg, kInterpreterDispatchTableRegister, t3, kPointerSizeLog2);
+  __ lw(kJavaScriptCallCodeStartRegister, MemOperand(kScratchReg));
   __ Call(kJavaScriptCallCodeStartRegister);
   masm->isolate()->heap()->SetInterpreterEntryReturnPCOffset(masm->pc_offset());
 
@@ -1035,36 +923,6 @@ void Builtins::Generate_InterpreterEntryTrampoline(MacroAssembler* masm) {
   // The return value is in v0.
   LeaveInterpreterFrame(masm, t0);
   __ Jump(ra);
-
-  // Load debug copy of the bytecode array if it exists.
-  // kInterpreterBytecodeArrayRegister is already loaded with
-  // SharedFunctionInfo::kFunctionDataOffset.
-  __ bind(&maybe_load_debug_bytecode_array);
-  __ lw(t1, FieldMemOperand(t0, DebugInfo::kDebugBytecodeArrayOffset));
-  __ JumpIfRoot(t1, Heap::kUndefinedValueRootIndex, &bytecode_array_loaded);
-
-  __ mov(kInterpreterBytecodeArrayRegister, t1);
-  __ lw(t1, FieldMemOperand(t0, DebugInfo::kFlagsOffset));
-  __ SmiUntag(t1);
-  __ And(t1, t1, Operand(DebugInfo::kDebugExecutionMode));
-
-  ExternalReference debug_execution_mode =
-      ExternalReference::debug_execution_mode_address(masm->isolate());
-  __ li(t0, Operand(debug_execution_mode));
-  __ lb(t0, MemOperand(t0));
-  STATIC_ASSERT(static_cast<int>(DebugInfo::kDebugExecutionMode) ==
-                static_cast<int>(DebugInfo::kSideEffects));
-  __ Branch(&bytecode_array_loaded, eq, t0, Operand(t1));
-
-  __ push(closure);
-  __ push(feedback_vector);
-  __ push(kInterpreterBytecodeArrayRegister);
-  __ push(closure);
-  __ CallRuntime(Runtime::kDebugApplyInstrumentation);
-  __ pop(kInterpreterBytecodeArrayRegister);
-  __ pop(feedback_vector);
-  __ pop(closure);
-  __ Branch(&bytecode_array_loaded);
 }
 
 
@@ -1184,8 +1042,8 @@ void Builtins::Generate_InterpreterPushArgsThenConstructImpl(
 
     // Tail call to the array construct stub (still in the caller
     // context at this point).
-    ArrayConstructorStub array_constructor_stub(masm->isolate());
-    __ Jump(array_constructor_stub.GetCode(), RelocInfo::CODE_TARGET);
+    __ Jump(BUILTIN_CODE(masm->isolate(), ArrayConstructorImpl),
+            RelocInfo::CODE_TARGET);
   } else if (mode == InterpreterPushArgsMode::kWithFinalSpread) {
     // Call the constructor with a0, a1, and a3 unmodified.
     __ Jump(BUILTIN_CODE(masm->isolate(), ConstructWithSpread),
@@ -1226,7 +1084,7 @@ static void Generate_InterpreterEnterBytecode(MacroAssembler* masm) {
   __ Branch(&trampoline_loaded);
 
   __ bind(&builtin_trampoline);
-  __ li(t0, Operand(BUILTIN_CODE(masm->isolate(), InterpreterEntryTrampoline)));
+  __ li(t0, BUILTIN_CODE(masm->isolate(), InterpreterEntryTrampoline));
 
   __ bind(&trampoline_loaded);
   __ Addu(ra, t0, Operand(interpreter_entry_return_pc_offset->value() +
@@ -1234,8 +1092,7 @@ static void Generate_InterpreterEnterBytecode(MacroAssembler* masm) {
 
   // Initialize the dispatch table register.
   __ li(kInterpreterDispatchTableRegister,
-        Operand(ExternalReference::interpreter_dispatch_table_address(
-            masm->isolate())));
+        ExternalReference::interpreter_dispatch_table_address(masm->isolate()));
 
   // Get the bytecode array pointer from the frame.
   __ lw(kInterpreterBytecodeArrayRegister,
@@ -1243,10 +1100,10 @@ static void Generate_InterpreterEnterBytecode(MacroAssembler* masm) {
 
   if (FLAG_debug_code) {
     // Check function data field is actually a BytecodeArray object.
-    __ SmiTst(kInterpreterBytecodeArrayRegister, at);
+    __ SmiTst(kInterpreterBytecodeArrayRegister, kScratchReg);
     __ Assert(ne,
               AbortReason::kFunctionDataShouldBeBytecodeArrayOnInterpreterEntry,
-              at, Operand(zero_reg));
+              kScratchReg, Operand(zero_reg));
     __ GetObjectType(kInterpreterBytecodeArrayRegister, a1, a1);
     __ Assert(eq,
               AbortReason::kFunctionDataShouldBeBytecodeArrayOnInterpreterEntry,
@@ -1303,201 +1160,6 @@ void Builtins::Generate_InterpreterEnterBytecodeDispatch(MacroAssembler* masm) {
   Generate_InterpreterEnterBytecode(masm);
 }
 
-void Builtins::Generate_CompileLazyDeoptimizedCode(MacroAssembler* masm) {
-  // Set the code slot inside the JSFunction to CompileLazy.
-  __ Move(a2, BUILTIN_CODE(masm->isolate(), CompileLazy));
-  __ sw(a2, FieldMemOperand(a1, JSFunction::kCodeOffset));
-  __ RecordWriteField(a1, JSFunction::kCodeOffset, a2, t0, kRAHasNotBeenSaved,
-                      kDontSaveFPRegs, OMIT_REMEMBERED_SET, OMIT_SMI_CHECK);
-  // Jump to compile lazy.
-  Generate_CompileLazy(masm);
-}
-
-static void GetSharedFunctionInfoCode(MacroAssembler* masm, Register sfi_data,
-                                      Register scratch1) {
-  // Figure out the SFI's code object.
-  Label done;
-  Label check_is_bytecode_array;
-  Label check_is_code;
-  Label check_is_fixed_array;
-  Label check_is_pre_parsed_scope_data;
-  Label check_is_function_template_info;
-  Label check_is_interpreter_data;
-
-  Register data_type = scratch1;
-
-  // IsSmi: Is builtin
-  __ JumpIfNotSmi(sfi_data, &check_is_bytecode_array);
-  __ li(scratch1,
-        Operand(ExternalReference::builtins_address(masm->isolate())));
-  // Avoid untagging the Smi.
-  STATIC_ASSERT(kPointerSizeLog2 > kSmiTagSize);
-  STATIC_ASSERT(kSmiShiftSize == 0);
-  __ Lsa(scratch1, scratch1, sfi_data, kPointerSizeLog2 - kSmiTagSize);
-  __ lw(sfi_data, MemOperand(scratch1));
-  __ Branch(&done);
-
-  // Get map for subsequent checks.
-  __ bind(&check_is_bytecode_array);
-  __ lw(data_type, FieldMemOperand(sfi_data, HeapObject::kMapOffset));
-  __ lhu(data_type, FieldMemOperand(data_type, Map::kInstanceTypeOffset));
-
-  // IsBytecodeArray: Interpret bytecode
-  __ Branch(&check_is_code, ne, data_type, Operand(BYTECODE_ARRAY_TYPE));
-  __ Move(sfi_data, BUILTIN_CODE(masm->isolate(), InterpreterEntryTrampoline));
-  __ Branch(&done);
-
-  // IsCode: Run code
-  __ bind(&check_is_code);
-  __ Branch(&done, eq, data_type, Operand(CODE_TYPE));
-
-  // IsFixedArray: Instantiate using AsmWasmData,
-  __ bind(&check_is_fixed_array);
-  __ Branch(&check_is_pre_parsed_scope_data, ne, data_type,
-            Operand(FIXED_ARRAY_TYPE));
-  __ Move(sfi_data, BUILTIN_CODE(masm->isolate(), InstantiateAsmJs));
-  __ Branch(&done);
-
-  // IsPreParsedScopeData: Compile lazy
-  __ bind(&check_is_pre_parsed_scope_data);
-  __ Branch(&check_is_function_template_info, ne, data_type,
-            Operand(TUPLE2_TYPE));
-  __ Move(sfi_data, BUILTIN_CODE(masm->isolate(), CompileLazy));
-  __ Branch(&done);
-
-  // IsFunctionTemplateInfo: API call
-  __ bind(&check_is_function_template_info);
-  __ Branch(&check_is_interpreter_data, ne, data_type,
-            Operand(FUNCTION_TEMPLATE_INFO_TYPE));
-  __ Move(sfi_data, BUILTIN_CODE(masm->isolate(), HandleApiCall));
-
-  // IsInterpreterData: Interpret bytecode
-  __ bind(&check_is_interpreter_data);
-  if (FLAG_debug_code) {
-    __ Assert(eq, AbortReason::kInvalidSharedFunctionInfoData, data_type,
-              Operand(INTERPRETER_DATA_TYPE));
-  }
-  __ lw(sfi_data, FieldMemOperand(
-                      sfi_data, InterpreterData::kInterpreterTrampolineOffset));
-
-  __ bind(&done);
-}
-
-void Builtins::Generate_CompileLazy(MacroAssembler* masm) {
-  // ----------- S t a t e -------------
-  //  -- a0 : argument count (preserved for callee)
-  //  -- a3 : new target (preserved for callee)
-  //  -- a1 : target function (preserved for callee)
-  // -----------------------------------
-  // First lookup code, maybe we don't need to compile!
-  Label gotta_call_runtime;
-
-  Register closure = a1;
-  Register feedback_vector = a2;
-
-  // Do we have a valid feedback vector?
-  __ lw(feedback_vector,
-        FieldMemOperand(closure, JSFunction::kFeedbackCellOffset));
-  __ lw(feedback_vector, FieldMemOperand(feedback_vector, Cell::kValueOffset));
-  __ JumpIfRoot(feedback_vector, Heap::kUndefinedValueRootIndex,
-                &gotta_call_runtime);
-
-  // Is there an optimization marker or optimized code in the feedback vector?
-  MaybeTailCallOptimizedCodeSlot(masm, feedback_vector, t0, t3, t1);
-
-  // We found no optimized code. Infer the code object needed for the SFI.
-  Register entry = t0;
-  __ lw(entry, FieldMemOperand(closure, JSFunction::kSharedFunctionInfoOffset));
-  __ lw(entry, FieldMemOperand(entry, SharedFunctionInfo::kFunctionDataOffset));
-  GetSharedFunctionInfoCode(masm, entry, t1);
-
-  // If code entry points to anything other than CompileLazy, install that.
-  __ Move(t1, masm->CodeObject());
-  __ Branch(&gotta_call_runtime, eq, entry, Operand(t1));
-
-  // Install the SFI's code entry.
-  __ sw(entry, FieldMemOperand(closure, JSFunction::kCodeOffset));
-  __ mov(t3, entry);  // Write barrier clobbers t3 below.
-  __ RecordWriteField(closure, JSFunction::kCodeOffset, t3, t1,
-                      kRAHasNotBeenSaved, kDontSaveFPRegs, OMIT_REMEMBERED_SET,
-                      OMIT_SMI_CHECK);
-  __ Jump(entry, Code::kHeaderSize - kHeapObjectTag);
-
-  __ bind(&gotta_call_runtime);
-  GenerateTailCallToReturnedCode(masm, Runtime::kCompileLazy);
-}
-
-// Lazy deserialization design doc: http://goo.gl/dxkYDZ.
-void Builtins::Generate_DeserializeLazy(MacroAssembler* masm) {
-  // ----------- S t a t e -------------
-  //  -- a0 : argument count (preserved for callee)
-  //  -- a3 : new target (preserved for callee)
-  //  -- a1 : target function (preserved for callee)
-  // -----------------------------------
-
-  Label deserialize_in_runtime;
-
-  Register target = a1;  // Must be preserved
-  Register scratch0 = a2;
-  Register scratch1 = t0;
-
-  CHECK(scratch0 != a0 && scratch0 != a3 && scratch0 != a1);
-  CHECK(scratch1 != a0 && scratch1 != a3 && scratch1 != a1);
-  CHECK(scratch0 != scratch1);
-
-  // Load the builtin id for lazy deserialization from SharedFunctionInfo.
-
-  __ AssertFunction(target);
-  __ lw(scratch0,
-        FieldMemOperand(target, JSFunction::kSharedFunctionInfoOffset));
-
-  __ lw(scratch1,
-        FieldMemOperand(scratch0, SharedFunctionInfo::kFunctionDataOffset));
-  __ AssertSmi(scratch1);
-
-  // The builtin may already have been deserialized. If that is the case, it is
-  // stored in the builtins table, and we can copy to correct code object to
-  // both the shared function info and function without calling into runtime.
-  //
-  // Otherwise, we need to call into runtime to deserialize.
-
-  {
-    // Load the code object at builtins_table[builtin_id] into scratch1.
-
-    __ SmiUntag(scratch1);
-    __ li(scratch0,
-          Operand(ExternalReference::builtins_address(masm->isolate())));
-    __ Lsa(scratch1, scratch0, scratch1, kPointerSizeLog2);
-    __ lw(scratch1, MemOperand(scratch1));
-
-    // Check if the loaded code object has already been deserialized. This is
-    // the case iff it does not equal DeserializeLazy.
-
-    __ Move(scratch0, masm->CodeObject());
-    __ Branch(&deserialize_in_runtime, eq, scratch1, Operand(scratch0));
-  }
-
-  {
-    // If we've reached this spot, the target builtin has been deserialized and
-    // we simply need to copy it over to the target function.
-
-    Register target_builtin = scratch1;
-
-    __ sw(target_builtin, FieldMemOperand(target, JSFunction::kCodeOffset));
-    __ mov(t3, target_builtin);  // Write barrier clobbers t3 below.
-    __ RecordWriteField(target, JSFunction::kCodeOffset, t3, t1,
-                        kRAHasNotBeenSaved, kDontSaveFPRegs,
-                        OMIT_REMEMBERED_SET, OMIT_SMI_CHECK);
-
-    // All copying is done. Jump to the deserialized code object.
-
-    __ Jump(target_builtin, Code::kHeaderSize - kHeapObjectTag);
-  }
-
-  __ bind(&deserialize_in_runtime);
-  GenerateTailCallToReturnedCode(masm, Runtime::kDeserializeLazy);
-}
-
 void Builtins::Generate_InstantiateAsmJs(MacroAssembler* masm) {
   // ----------- S t a t e -------------
   //  -- a0 : argument count (preserved for callee)
@@ -1755,8 +1417,8 @@ void Builtins::Generate_FunctionPrototypeCall(MacroAssembler* masm) {
 
   // 2. Get the function to call (passed as receiver) from the stack.
   // a0: actual number of arguments
-  __ Lsa(at, sp, a0, kPointerSizeLog2);
-  __ lw(a1, MemOperand(at));
+  __ Lsa(kScratchReg, sp, a0, kPointerSizeLog2);
+  __ lw(a1, MemOperand(kScratchReg));
 
   // 3. Shift arguments and return address one slot down on the stack
   //    (overwriting the original receiver).  Adjust argument count to make
@@ -1769,8 +1431,8 @@ void Builtins::Generate_FunctionPrototypeCall(MacroAssembler* masm) {
     __ Lsa(a2, sp, a0, kPointerSizeLog2);
 
     __ bind(&loop);
-    __ lw(at, MemOperand(a2, -kPointerSize));
-    __ sw(at, MemOperand(a2));
+    __ lw(kScratchReg, MemOperand(a2, -kPointerSize));
+    __ sw(kScratchReg, MemOperand(a2));
     __ Subu(a2, a2, Operand(kPointerSize));
     __ Branch(&loop, ne, a2, Operand(sp));
     // Adjust the actual number of arguments and remove the top element
@@ -1923,7 +1585,20 @@ void Builtins::Generate_CallOrConstructVarargs(MacroAssembler* masm,
   //  -- t0 : len (number of elements to push from args)
   //  -- a3 : new.target (for [[Construct]])
   // -----------------------------------
-  __ AssertFixedArray(a2);
+  if (masm->emit_debug_code()) {
+    // Allow a2 to be a FixedArray, or a FixedDoubleArray if t0 == 0.
+    Label ok, fail;
+    __ AssertNotSmi(a2);
+    __ GetObjectType(a2, t8, t8);
+    __ Branch(&ok, eq, t8, Operand(FIXED_ARRAY_TYPE));
+    __ Branch(&fail, ne, t8, Operand(FIXED_DOUBLE_ARRAY_TYPE));
+    __ Branch(&ok, eq, t0, Operand(0));
+    // Fall through.
+    __ bind(&fail);
+    __ Abort(AbortReason::kOperandIsNotAFixedArray);
+
+    __ bind(&ok);
+  }
 
   // Check for stack overflow.
   {
@@ -1935,8 +1610,8 @@ void Builtins::Generate_CallOrConstructVarargs(MacroAssembler* masm,
     // here which will cause ip to become negative.
     __ Subu(t1, sp, t1);
     // Check if the arguments will overflow the stack.
-    __ sll(at, t0, kPointerSizeLog2);
-    __ Branch(&done, gt, t1, Operand(at));  // Signed comparison.
+    __ sll(kScratchReg, t0, kPointerSizeLog2);
+    __ Branch(&done, gt, t1, Operand(kScratchReg));  // Signed comparison.
     __ TailCallRuntime(Runtime::kThrowStackOverflow);
     __ bind(&done);
   }
@@ -1948,12 +1623,12 @@ void Builtins::Generate_CallOrConstructVarargs(MacroAssembler* masm,
     __ LoadRoot(t1, Heap::kTheHoleValueRootIndex);
     __ bind(&loop);
     __ Branch(&done, eq, t2, Operand(t0));
-    __ Lsa(at, a2, t2, kPointerSizeLog2);
-    __ lw(at, FieldMemOperand(at, FixedArray::kHeaderSize));
-    __ Branch(&push, ne, t1, Operand(at));
-    __ LoadRoot(at, Heap::kUndefinedValueRootIndex);
+    __ Lsa(kScratchReg, a2, t2, kPointerSizeLog2);
+    __ lw(kScratchReg, FieldMemOperand(kScratchReg, FixedArray::kHeaderSize));
+    __ Branch(&push, ne, t1, Operand(kScratchReg));
+    __ LoadRoot(kScratchReg, Heap::kUndefinedValueRootIndex);
     __ bind(&push);
-    __ Push(at);
+    __ Push(kScratchReg);
     __ Addu(t2, t2, Operand(1));
     __ Branch(&loop);
     __ bind(&done);
@@ -2002,8 +1677,8 @@ void Builtins::Generate_CallOrConstructForwardVarargs(MacroAssembler* masm,
   {
     __ lw(t2, MemOperand(fp, JavaScriptFrameConstants::kFunctionOffset));
     __ lw(t2, FieldMemOperand(t2, JSFunction::kSharedFunctionInfoOffset));
-    __ lw(t2,
-          FieldMemOperand(t2, SharedFunctionInfo::kFormalParameterCountOffset));
+    __ lhu(t2, FieldMemOperand(
+                   t2, SharedFunctionInfo::kFormalParameterCountOffset));
     __ mov(t3, fp);
   }
   __ Branch(&arguments_done);
@@ -2028,9 +1703,9 @@ void Builtins::Generate_CallOrConstructForwardVarargs(MacroAssembler* masm,
       __ Addu(a0, a0, t2);
       __ bind(&loop);
       {
-        __ Lsa(at, t3, t2, kPointerSizeLog2);
-        __ lw(at, MemOperand(at, 1 * kPointerSize));
-        __ push(at);
+        __ Lsa(kScratchReg, t3, t2, kPointerSizeLog2);
+        __ lw(kScratchReg, MemOperand(kScratchReg, 1 * kPointerSize));
+        __ push(kScratchReg);
         __ Subu(t2, t2, Operand(1));
         __ Branch(&loop, ne, t2, Operand(zero_reg));
       }
@@ -2059,8 +1734,9 @@ void Builtins::Generate_CallFunction(MacroAssembler* masm,
   Label class_constructor;
   __ lw(a2, FieldMemOperand(a1, JSFunction::kSharedFunctionInfoOffset));
   __ lw(a3, FieldMemOperand(a2, SharedFunctionInfo::kFlagsOffset));
-  __ And(at, a3, Operand(SharedFunctionInfo::IsClassConstructorBit::kMask));
-  __ Branch(&class_constructor, ne, at, Operand(zero_reg));
+  __ And(kScratchReg, a3,
+         Operand(SharedFunctionInfo::IsClassConstructorBit::kMask));
+  __ Branch(&class_constructor, ne, kScratchReg, Operand(zero_reg));
 
   // Enter the context of the function; ToObject has to run in the function
   // context, and we also need to take the global proxy from the function
@@ -2069,10 +1745,10 @@ void Builtins::Generate_CallFunction(MacroAssembler* masm,
   // We need to convert the receiver for non-native sloppy mode functions.
   Label done_convert;
   __ lw(a3, FieldMemOperand(a2, SharedFunctionInfo::kFlagsOffset));
-  __ And(at, a3,
+  __ And(kScratchReg, a3,
          Operand(SharedFunctionInfo::IsNativeBit::kMask |
                  SharedFunctionInfo::IsStrictBit::kMask));
-  __ Branch(&done_convert, ne, at, Operand(zero_reg));
+  __ Branch(&done_convert, ne, kScratchReg, Operand(zero_reg));
   {
     // ----------- S t a t e -------------
     //  -- a0 : the number of arguments (not including the receiver)
@@ -2086,8 +1762,8 @@ void Builtins::Generate_CallFunction(MacroAssembler* masm,
       __ LoadGlobalProxy(a3);
     } else {
       Label convert_to_object, convert_receiver;
-      __ Lsa(at, sp, a0, kPointerSizeLog2);
-      __ lw(a3, MemOperand(at));
+      __ Lsa(kScratchReg, sp, a0, kPointerSizeLog2);
+      __ lw(a3, MemOperand(kScratchReg));
       __ JumpIfSmi(a3, &convert_to_object);
       STATIC_ASSERT(LAST_JS_RECEIVER_TYPE == LAST_TYPE);
       __ GetObjectType(a3, t0, t0);
@@ -2124,8 +1800,8 @@ void Builtins::Generate_CallFunction(MacroAssembler* masm,
       __ lw(a2, FieldMemOperand(a1, JSFunction::kSharedFunctionInfoOffset));
       __ bind(&convert_receiver);
     }
-    __ Lsa(at, sp, a0, kPointerSizeLog2);
-    __ sw(a3, MemOperand(at));
+    __ Lsa(kScratchReg, sp, a0, kPointerSizeLog2);
+    __ sw(a3, MemOperand(kScratchReg));
   }
   __ bind(&done_convert);
 
@@ -2136,8 +1812,8 @@ void Builtins::Generate_CallFunction(MacroAssembler* masm,
   //  -- cp : the function context.
   // -----------------------------------
 
-  __ lw(a2,
-        FieldMemOperand(a2, SharedFunctionInfo::kFormalParameterCountOffset));
+  __ lhu(a2,
+         FieldMemOperand(a2, SharedFunctionInfo::kFormalParameterCountOffset));
   ParameterCount actual(a0);
   ParameterCount expected(a2);
   __ InvokeFunctionCode(a1, no_reg, expected, actual, JUMP_FUNCTION);
@@ -2161,9 +1837,9 @@ void Builtins::Generate_CallBoundFunctionImpl(MacroAssembler* masm) {
 
   // Patch the receiver to [[BoundThis]].
   {
-    __ lw(at, FieldMemOperand(a1, JSBoundFunction::kBoundThisOffset));
+    __ lw(kScratchReg, FieldMemOperand(a1, JSBoundFunction::kBoundThisOffset));
     __ Lsa(t0, sp, a0, kPointerSizeLog2);
-    __ sw(at, MemOperand(t0));
+    __ sw(kScratchReg, MemOperand(t0));
   }
 
   // Load [[BoundArguments]] into a2 and length of that into t0.
@@ -2185,8 +1861,8 @@ void Builtins::Generate_CallBoundFunctionImpl(MacroAssembler* masm) {
     __ Subu(sp, sp, Operand(t1));
     // Check the stack for overflow. We are not trying to catch interruptions
     // (i.e. debug break and preemption) here, so check the "real stack limit".
-    __ LoadRoot(at, Heap::kRealStackLimitRootIndex);
-    __ Branch(&done, gt, sp, Operand(at));  // Signed comparison.
+    __ LoadRoot(kScratchReg, Heap::kRealStackLimitRootIndex);
+    __ Branch(&done, gt, sp, Operand(kScratchReg));  // Signed comparison.
     // Restore the stack pointer.
     __ Addu(sp, sp, Operand(t1));
     {
@@ -2204,9 +1880,9 @@ void Builtins::Generate_CallBoundFunctionImpl(MacroAssembler* masm) {
     __ bind(&loop);
     __ Branch(&done_loop, gt, t1, Operand(a0));
     __ Lsa(t2, sp, t0, kPointerSizeLog2);
-    __ lw(at, MemOperand(t2));
+    __ lw(kScratchReg, MemOperand(t2));
     __ Lsa(t2, sp, t1, kPointerSizeLog2);
-    __ sw(at, MemOperand(t2));
+    __ sw(kScratchReg, MemOperand(t2));
     __ Addu(t0, t0, Operand(1));
     __ Addu(t1, t1, Operand(1));
     __ Branch(&loop);
@@ -2223,9 +1899,9 @@ void Builtins::Generate_CallBoundFunctionImpl(MacroAssembler* masm) {
     __ Subu(t0, t0, Operand(1));
     __ Branch(&done_loop, lt, t0, Operand(zero_reg));
     __ Lsa(t1, a2, t0, kPointerSizeLog2);
-    __ lw(at, MemOperand(t1));
+    __ lw(kScratchReg, MemOperand(t1));
     __ Lsa(t1, sp, a0, kPointerSizeLog2);
-    __ sw(at, MemOperand(t1));
+    __ sw(kScratchReg, MemOperand(t1));
     __ Addu(a0, a0, Operand(1));
     __ Branch(&loop);
     __ bind(&done_loop);
@@ -2266,8 +1942,8 @@ void Builtins::Generate_Call(MacroAssembler* masm, ConvertReceiverMode mode) {
   // not we raise an exception).
   __ bind(&non_function);
   // Overwrite the original receiver with the (original) target.
-  __ Lsa(at, sp, a0, kPointerSizeLog2);
-  __ sw(a1, MemOperand(at));
+  __ Lsa(kScratchReg, sp, a0, kPointerSizeLog2);
+  __ sw(a1, MemOperand(kScratchReg));
   // Let the "call_as_function_delegate" take care of the rest.
   __ LoadNativeContextSlot(Context::CALL_AS_FUNCTION_DELEGATE_INDEX, a1);
   __ Jump(masm->isolate()->builtins()->CallFunction(
@@ -2309,7 +1985,7 @@ void Builtins::Generate_ConstructFunction(MacroAssembler* masm) {
           RelocInfo::CODE_TARGET);
 
   __ bind(&call_generic_stub);
-  __ Jump(masm->isolate()->builtins()->JSConstructStubGeneric(),
+  __ Jump(BUILTIN_CODE(masm->isolate(), JSConstructStubGeneric),
           RelocInfo::CODE_TARGET);
 }
 
@@ -2343,8 +2019,8 @@ void Builtins::Generate_ConstructBoundFunction(MacroAssembler* masm) {
     __ Subu(sp, sp, Operand(t1));
     // Check the stack for overflow. We are not trying to catch interruptions
     // (i.e. debug break and preemption) here, so check the "real stack limit".
-    __ LoadRoot(at, Heap::kRealStackLimitRootIndex);
-    __ Branch(&done, gt, sp, Operand(at));  // Signed comparison.
+    __ LoadRoot(kScratchReg, Heap::kRealStackLimitRootIndex);
+    __ Branch(&done, gt, sp, Operand(kScratchReg));  // Signed comparison.
     // Restore the stack pointer.
     __ Addu(sp, sp, Operand(t1));
     {
@@ -2362,9 +2038,9 @@ void Builtins::Generate_ConstructBoundFunction(MacroAssembler* masm) {
     __ bind(&loop);
     __ Branch(&done_loop, ge, t1, Operand(a0));
     __ Lsa(t2, sp, t0, kPointerSizeLog2);
-    __ lw(at, MemOperand(t2));
+    __ lw(kScratchReg, MemOperand(t2));
     __ Lsa(t2, sp, t1, kPointerSizeLog2);
-    __ sw(at, MemOperand(t2));
+    __ sw(kScratchReg, MemOperand(t2));
     __ Addu(t0, t0, Operand(1));
     __ Addu(t1, t1, Operand(1));
     __ Branch(&loop);
@@ -2381,9 +2057,9 @@ void Builtins::Generate_ConstructBoundFunction(MacroAssembler* masm) {
     __ Subu(t0, t0, Operand(1));
     __ Branch(&done_loop, lt, t0, Operand(zero_reg));
     __ Lsa(t1, a2, t0, kPointerSizeLog2);
-    __ lw(at, MemOperand(t1));
+    __ lw(kScratchReg, MemOperand(t1));
     __ Lsa(t1, sp, a0, kPointerSizeLog2);
-    __ sw(at, MemOperand(t1));
+    __ sw(kScratchReg, MemOperand(t1));
     __ Addu(a0, a0, Operand(1));
     __ Branch(&loop);
     __ bind(&done_loop);
@@ -2440,8 +2116,8 @@ void Builtins::Generate_Construct(MacroAssembler* masm) {
   __ bind(&non_proxy);
   {
     // Overwrite the original receiver with the (original) target.
-    __ Lsa(at, sp, a0, kPointerSizeLog2);
-    __ sw(a1, MemOperand(at));
+    __ Lsa(kScratchReg, sp, a0, kPointerSizeLog2);
+    __ sw(a1, MemOperand(kScratchReg));
     // Let the "call_as_constructor_delegate" take care of the rest.
     __ LoadNativeContextSlot(Context::CALL_AS_CONSTRUCTOR_DELEGATE_INDEX, a1);
     __ Jump(masm->isolate()->builtins()->CallFunction(),
@@ -2455,42 +2131,6 @@ void Builtins::Generate_Construct(MacroAssembler* masm) {
           RelocInfo::CODE_TARGET);
 }
 
-// static
-void Builtins::Generate_AllocateInNewSpace(MacroAssembler* masm) {
-  // ----------- S t a t e -------------
-  //  -- a0 : requested object size (untagged)
-  //  -- ra : return address
-  // -----------------------------------
-  __ SmiTag(a0);
-  __ Push(a0);
-  __ Move(cp, Smi::kZero);
-  __ TailCallRuntime(Runtime::kAllocateInNewSpace);
-}
-
-// static
-void Builtins::Generate_AllocateInOldSpace(MacroAssembler* masm) {
-  // ----------- S t a t e -------------
-  //  -- a0 : requested object size (untagged)
-  //  -- ra : return address
-  // -----------------------------------
-  __ SmiTag(a0);
-  __ Move(a1, Smi::FromInt(AllocateTargetSpace::encode(OLD_SPACE)));
-  __ Push(a0, a1);
-  __ Move(cp, Smi::kZero);
-  __ TailCallRuntime(Runtime::kAllocateInTargetSpace);
-}
-
-// static
-void Builtins::Generate_Abort(MacroAssembler* masm) {
-  // ----------- S t a t e -------------
-  //  -- a0 : message_id as Smi
-  //  -- ra : return address
-  // -----------------------------------
-  __ Push(a0);
-  __ Move(cp, Smi::kZero);
-  __ TailCallRuntime(Runtime::kAbort);
-}
-
 void Builtins::Generate_ArgumentsAdaptorTrampoline(MacroAssembler* masm) {
   // State setup as expected by MacroAssembler::InvokePrologue.
   // ----------- S t a t e -------------
@@ -2515,7 +2155,7 @@ void Builtins::Generate_ArgumentsAdaptorTrampoline(MacroAssembler* masm) {
     // a3: new target (passed through to callee)
     __ bind(&enough);
     EnterArgumentsAdaptorFrame(masm);
-    Generate_StackOverflowCheck(masm, a2, t1, at, &stack_overflow);
+    Generate_StackOverflowCheck(masm, a2, t1, kScratchReg, &stack_overflow);
 
     // Calculate copy start address into a0 and copy end address into t1.
     __ Lsa(a0, fp, a0, kPointerSizeLog2 - kSmiTagSize);
@@ -2545,7 +2185,7 @@ void Builtins::Generate_ArgumentsAdaptorTrampoline(MacroAssembler* masm) {
   {  // Too few parameters: Actual < expected.
     __ bind(&too_few);
     EnterArgumentsAdaptorFrame(masm);
-    Generate_StackOverflowCheck(masm, a2, t1, at, &stack_overflow);
+    Generate_StackOverflowCheck(masm, a2, t1, kScratchReg, &stack_overflow);
 
     // Calculate copy start address into a0 and copy end address into t3.
     // a0: actual number of arguments as a smi
@@ -2627,35 +2267,517 @@ void Builtins::Generate_ArgumentsAdaptorTrampoline(MacroAssembler* masm) {
 }
 
 void Builtins::Generate_WasmCompileLazy(MacroAssembler* masm) {
+  // The function index was put in t0 by the jump table trampoline.
+  // Convert to Smi for the runtime call.
+  __ SmiTag(t0);
   {
-    FrameScope scope(masm, StackFrame::INTERNAL);
-
-    auto wasm_instance_reg = a0;  // TODO(titzer): put in a common place.
+    TrapOnAbortScope trap_on_abort_scope(masm);  // Avoid calls to Abort.
+    FrameScope scope(masm, StackFrame::WASM_COMPILE_LAZY);
 
     // Save all parameter registers (see wasm-linkage.cc). They might be
     // overwritten in the runtime call below. We don't have any callee-saved
     // registers in wasm, so no need to store anything else.
-    constexpr RegList gp_regs = Register::ListOf<a1, a2, a3>();
+    constexpr RegList gp_regs = Register::ListOf<a0, a1, a2, a3>();
     constexpr RegList fp_regs =
         DoubleRegister::ListOf<f2, f4, f6, f8, f10, f12, f14>();
     __ MultiPush(gp_regs);
     __ MultiPushFPU(fp_regs);
 
-    // Pass the WASM instance as an explicit argument to WasmCompileLazy.
-    __ push(wasm_instance_reg);
-    // Initialize the JavaScript context with 0. CEntryStub will use it to
+    // Pass instance and function index as an explicit arguments to the runtime
+    // function.
+    __ Push(kWasmInstanceRegister, t0);
+    // Load the correct CEntry builtin from the instance object.
+    __ lw(a2, FieldMemOperand(kWasmInstanceRegister,
+                              WasmInstanceObject::kCEntryStubOffset));
+    // Initialize the JavaScript context with 0. CEntry will use it to
     // set the current context on the isolate.
     __ Move(kContextRegister, Smi::kZero);
-    __ CallRuntime(Runtime::kWasmCompileLazy);
-    // The WASM instance is the second return value.
-    __ mov(wasm_instance_reg, kReturnRegister1);
+    __ CallRuntimeWithCEntry(Runtime::kWasmCompileLazy, a2);
 
     // Restore registers.
     __ MultiPopFPU(fp_regs);
     __ MultiPop(gp_regs);
   }
   // Finally, jump to the entrypoint.
-  __ Jump(at, v0, 0);
+  __ Jump(kScratchReg, v0, 0);
+}
+
+void Builtins::Generate_CEntry(MacroAssembler* masm, int result_size,
+                               SaveFPRegsMode save_doubles, ArgvMode argv_mode,
+                               bool builtin_exit_frame) {
+  // Called from JavaScript; parameters are on stack as if calling JS function
+  // a0: number of arguments including receiver
+  // a1: pointer to builtin function
+  // fp: frame pointer    (restored after C call)
+  // sp: stack pointer    (restored as callee's sp after C call)
+  // cp: current context  (C callee-saved)
+  //
+  // If argv_mode == kArgvInRegister:
+  // a2: pointer to the first argument
+
+  ProfileEntryHookStub::MaybeCallEntryHook(masm);
+
+  if (argv_mode == kArgvInRegister) {
+    // Move argv into the correct register.
+    __ mov(s1, a2);
+  } else {
+    // Compute the argv pointer in a callee-saved register.
+    __ Lsa(s1, sp, a0, kPointerSizeLog2);
+    __ Subu(s1, s1, kPointerSize);
+  }
+
+  // Enter the exit frame that transitions from JavaScript to C++.
+  FrameScope scope(masm, StackFrame::MANUAL);
+  __ EnterExitFrame(
+      save_doubles == kSaveFPRegs, 0,
+      builtin_exit_frame ? StackFrame::BUILTIN_EXIT : StackFrame::EXIT);
+
+  // s0: number of arguments  including receiver (C callee-saved)
+  // s1: pointer to first argument (C callee-saved)
+  // s2: pointer to builtin function (C callee-saved)
+
+  // Prepare arguments for C routine.
+  // a0 = argc
+  __ mov(s0, a0);
+  __ mov(s2, a1);
+
+  // We are calling compiled C/C++ code. a0 and a1 hold our two arguments. We
+  // also need to reserve the 4 argument slots on the stack.
+
+  __ AssertStackIsAligned();
+
+  // a0 = argc, a1 = argv, a2 = isolate
+  __ li(a2, ExternalReference::isolate_address(masm->isolate()));
+  __ mov(a1, s1);
+
+  // To let the GC traverse the return address of the exit frames, we need to
+  // know where the return address is. The CEntry is unmovable, so
+  // we can store the address on the stack to be able to find it again and
+  // we never have to restore it, because it will not change.
+  {
+    Assembler::BlockTrampolinePoolScope block_trampoline_pool(masm);
+    int kNumInstructionsToJump = 4;
+    Label find_ra;
+    // Adjust the value in ra to point to the correct return location, 2nd
+    // instruction past the real call into C code (the jalr(t9)), and push it.
+    // This is the return address of the exit frame.
+    if (kArchVariant >= kMips32r6) {
+      __ addiupc(ra, kNumInstructionsToJump + 1);
+    } else {
+      // This branch-and-link sequence is needed to find the current PC on mips
+      // before r6, saved to the ra register.
+      __ bal(&find_ra);  // bal exposes branch delay slot.
+      __ Addu(ra, ra, kNumInstructionsToJump * Instruction::kInstrSize);
+    }
+    __ bind(&find_ra);
+
+    // This spot was reserved in EnterExitFrame.
+    __ sw(ra, MemOperand(sp));
+    // Stack space reservation moved to the branch delay slot below.
+    // Stack is still aligned.
+
+    // Call the C routine.
+    __ mov(t9, s2);  // Function pointer to t9 to conform to ABI for PIC.
+    __ jalr(t9);
+    // Set up sp in the delay slot.
+    __ addiu(sp, sp, -kCArgsSlotsSize);
+    // Make sure the stored 'ra' points to this position.
+    DCHECK_EQ(kNumInstructionsToJump,
+              masm->InstructionsGeneratedSince(&find_ra));
+  }
+
+  // Result returned in v0 or v1:v0 - do not destroy these registers!
+
+  // Check result for exception sentinel.
+  Label exception_returned;
+  __ LoadRoot(t0, Heap::kExceptionRootIndex);
+  __ Branch(&exception_returned, eq, t0, Operand(v0));
+
+  // Check that there is no pending exception, otherwise we
+  // should have returned the exception sentinel.
+  if (FLAG_debug_code) {
+    Label okay;
+    ExternalReference pending_exception_address = ExternalReference::Create(
+        IsolateAddressId::kPendingExceptionAddress, masm->isolate());
+    __ li(a2, pending_exception_address);
+    __ lw(a2, MemOperand(a2));
+    __ LoadRoot(t0, Heap::kTheHoleValueRootIndex);
+    // Cannot use check here as it attempts to generate call into runtime.
+    __ Branch(&okay, eq, t0, Operand(a2));
+    __ stop("Unexpected pending exception");
+    __ bind(&okay);
+  }
+
+  // Exit C frame and return.
+  // v0:v1: result
+  // sp: stack pointer
+  // fp: frame pointer
+  Register argc = argv_mode == kArgvInRegister
+                      // We don't want to pop arguments so set argc to no_reg.
+                      ? no_reg
+                      // s0: still holds argc (callee-saved).
+                      : s0;
+  __ LeaveExitFrame(save_doubles == kSaveFPRegs, argc, EMIT_RETURN);
+
+  // Handling of exception.
+  __ bind(&exception_returned);
+
+  ExternalReference pending_handler_context_address = ExternalReference::Create(
+      IsolateAddressId::kPendingHandlerContextAddress, masm->isolate());
+  ExternalReference pending_handler_entrypoint_address =
+      ExternalReference::Create(
+          IsolateAddressId::kPendingHandlerEntrypointAddress, masm->isolate());
+  ExternalReference pending_handler_fp_address = ExternalReference::Create(
+      IsolateAddressId::kPendingHandlerFPAddress, masm->isolate());
+  ExternalReference pending_handler_sp_address = ExternalReference::Create(
+      IsolateAddressId::kPendingHandlerSPAddress, masm->isolate());
+
+  // Ask the runtime for help to determine the handler. This will set v0 to
+  // contain the current pending exception, don't clobber it.
+  ExternalReference find_handler =
+      ExternalReference::Create(Runtime::kUnwindAndFindExceptionHandler);
+  {
+    FrameScope scope(masm, StackFrame::MANUAL);
+    __ PrepareCallCFunction(3, 0, a0);
+    __ mov(a0, zero_reg);
+    __ mov(a1, zero_reg);
+    __ li(a2, ExternalReference::isolate_address(masm->isolate()));
+    __ CallCFunction(find_handler, 3);
+  }
+
+  // Retrieve the handler context, SP and FP.
+  __ li(cp, pending_handler_context_address);
+  __ lw(cp, MemOperand(cp));
+  __ li(sp, pending_handler_sp_address);
+  __ lw(sp, MemOperand(sp));
+  __ li(fp, pending_handler_fp_address);
+  __ lw(fp, MemOperand(fp));
+
+  // If the handler is a JS frame, restore the context to the frame. Note that
+  // the context will be set to (cp == 0) for non-JS frames.
+  Label zero;
+  __ Branch(&zero, eq, cp, Operand(zero_reg));
+  __ sw(cp, MemOperand(fp, StandardFrameConstants::kContextOffset));
+  __ bind(&zero);
+
+  // Reset the masking register. This is done independent of the underlying
+  // feature flag {FLAG_branch_load_poisoning} to make the snapshot work with
+  // both configurations. It is safe to always do this, because the underlying
+  // register is caller-saved and can be arbitrarily clobbered.
+  __ ResetSpeculationPoisonRegister();
+
+  // Compute the handler entry address and jump to it.
+  __ li(t9, pending_handler_entrypoint_address);
+  __ lw(t9, MemOperand(t9));
+  __ Jump(t9);
+}
+
+void Builtins::Generate_DoubleToI(MacroAssembler* masm) {
+  Label out_of_range, only_low, negate, done;
+  Register result_reg = t0;
+
+  Register scratch = GetRegisterThatIsNotOneOf(result_reg);
+  Register scratch2 = GetRegisterThatIsNotOneOf(result_reg, scratch);
+  Register scratch3 = GetRegisterThatIsNotOneOf(result_reg, scratch, scratch2);
+  DoubleRegister double_scratch = kScratchDoubleReg;
+
+  // Account for saved regs.
+  const int kArgumentOffset = 4 * kPointerSize;
+
+  __ Push(result_reg);
+  __ Push(scratch, scratch2, scratch3);
+
+  // Load double input.
+  __ Ldc1(double_scratch, MemOperand(sp, kArgumentOffset));
+
+  // Clear cumulative exception flags and save the FCSR.
+  __ cfc1(scratch2, FCSR);
+  __ ctc1(zero_reg, FCSR);
+
+  // Try a conversion to a signed integer.
+  __ Trunc_w_d(double_scratch, double_scratch);
+  // Move the converted value into the result register.
+  __ mfc1(scratch3, double_scratch);
+
+  // Retrieve and restore the FCSR.
+  __ cfc1(scratch, FCSR);
+  __ ctc1(scratch2, FCSR);
+
+  // Check for overflow and NaNs.
+  __ And(
+      scratch, scratch,
+      kFCSROverflowFlagMask | kFCSRUnderflowFlagMask | kFCSRInvalidOpFlagMask);
+  // If we had no exceptions then set result_reg and we are done.
+  Label error;
+  __ Branch(&error, ne, scratch, Operand(zero_reg));
+  __ Move(result_reg, scratch3);
+  __ Branch(&done);
+  __ bind(&error);
+
+  // Load the double value and perform a manual truncation.
+  Register input_high = scratch2;
+  Register input_low = scratch3;
+
+  __ lw(input_low, MemOperand(sp, kArgumentOffset + Register::kMantissaOffset));
+  __ lw(input_high,
+        MemOperand(sp, kArgumentOffset + Register::kExponentOffset));
+
+  Label normal_exponent, restore_sign;
+  // Extract the biased exponent in result.
+  __ Ext(result_reg, input_high, HeapNumber::kExponentShift,
+         HeapNumber::kExponentBits);
+
+  // Check for Infinity and NaNs, which should return 0.
+  __ Subu(scratch, result_reg, HeapNumber::kExponentMask);
+  __ Movz(result_reg, zero_reg, scratch);
+  __ Branch(&done, eq, scratch, Operand(zero_reg));
+
+  // Express exponent as delta to (number of mantissa bits + 31).
+  __ Subu(result_reg, result_reg,
+          Operand(HeapNumber::kExponentBias + HeapNumber::kMantissaBits + 31));
+
+  // If the delta is strictly positive, all bits would be shifted away,
+  // which means that we can return 0.
+  __ Branch(&normal_exponent, le, result_reg, Operand(zero_reg));
+  __ mov(result_reg, zero_reg);
+  __ Branch(&done);
+
+  __ bind(&normal_exponent);
+  const int kShiftBase = HeapNumber::kNonMantissaBitsInTopWord - 1;
+  // Calculate shift.
+  __ Addu(scratch, result_reg, Operand(kShiftBase + HeapNumber::kMantissaBits));
+
+  // Save the sign.
+  Register sign = result_reg;
+  result_reg = no_reg;
+  __ And(sign, input_high, Operand(HeapNumber::kSignMask));
+
+  // On ARM shifts > 31 bits are valid and will result in zero. On MIPS we need
+  // to check for this specific case.
+  Label high_shift_needed, high_shift_done;
+  __ Branch(&high_shift_needed, lt, scratch, Operand(32));
+  __ mov(input_high, zero_reg);
+  __ Branch(&high_shift_done);
+  __ bind(&high_shift_needed);
+
+  // Set the implicit 1 before the mantissa part in input_high.
+  __ Or(input_high, input_high,
+        Operand(1 << HeapNumber::kMantissaBitsInTopWord));
+  // Shift the mantissa bits to the correct position.
+  // We don't need to clear non-mantissa bits as they will be shifted away.
+  // If they weren't, it would mean that the answer is in the 32bit range.
+  __ sllv(input_high, input_high, scratch);
+
+  __ bind(&high_shift_done);
+
+  // Replace the shifted bits with bits from the lower mantissa word.
+  Label pos_shift, shift_done;
+  __ li(kScratchReg, 32);
+  __ subu(scratch, kScratchReg, scratch);
+  __ Branch(&pos_shift, ge, scratch, Operand(zero_reg));
+
+  // Negate scratch.
+  __ Subu(scratch, zero_reg, scratch);
+  __ sllv(input_low, input_low, scratch);
+  __ Branch(&shift_done);
+
+  __ bind(&pos_shift);
+  __ srlv(input_low, input_low, scratch);
+
+  __ bind(&shift_done);
+  __ Or(input_high, input_high, Operand(input_low));
+  // Restore sign if necessary.
+  __ mov(scratch, sign);
+  result_reg = sign;
+  sign = no_reg;
+  __ Subu(result_reg, zero_reg, input_high);
+  __ Movz(result_reg, input_high, scratch);
+
+  __ bind(&done);
+  __ sw(result_reg, MemOperand(sp, kArgumentOffset));
+  __ Pop(scratch, scratch2, scratch3);
+  __ Pop(result_reg);
+  __ Ret();
+}
+
+void Builtins::Generate_MathPowInternal(MacroAssembler* masm) {
+  const Register exponent = a2;
+  const DoubleRegister double_base = f2;
+  const DoubleRegister double_exponent = f4;
+  const DoubleRegister double_result = f0;
+  const DoubleRegister double_scratch = f6;
+  const FPURegister single_scratch = f8;
+  const Register scratch = t5;
+  const Register scratch2 = t3;
+
+  Label call_runtime, done, int_exponent;
+
+  Label int_exponent_convert;
+  // Detect integer exponents stored as double.
+  __ EmitFPUTruncate(kRoundToMinusInf, scratch, double_exponent, kScratchReg,
+                     double_scratch, scratch2, kCheckForInexactConversion);
+  // scratch2 == 0 means there was no conversion error.
+  __ Branch(&int_exponent_convert, eq, scratch2, Operand(zero_reg));
+
+  __ push(ra);
+  {
+    AllowExternalCallThatCantCauseGC scope(masm);
+    __ PrepareCallCFunction(0, 2, scratch2);
+    __ MovToFloatParameters(double_base, double_exponent);
+    __ CallCFunction(ExternalReference::power_double_double_function(), 0, 2);
+  }
+  __ pop(ra);
+  __ MovFromFloatResult(double_result);
+  __ jmp(&done);
+
+  __ bind(&int_exponent_convert);
+
+  // Calculate power with integer exponent.
+  __ bind(&int_exponent);
+
+  // Get two copies of exponent in the registers scratch and exponent.
+  // Exponent has previously been stored into scratch as untagged integer.
+  __ mov(exponent, scratch);
+
+  __ mov_d(double_scratch, double_base);  // Back up base.
+  __ Move(double_result, 1.0);
+
+  // Get absolute value of exponent.
+  Label positive_exponent, bail_out;
+  __ Branch(&positive_exponent, ge, scratch, Operand(zero_reg));
+  __ Subu(scratch, zero_reg, scratch);
+  // Check when Subu overflows and we get negative result
+  // (happens only when input is MIN_INT).
+  __ Branch(&bail_out, gt, zero_reg, Operand(scratch));
+  __ bind(&positive_exponent);
+  __ Assert(ge, AbortReason::kUnexpectedNegativeValue, scratch,
+            Operand(zero_reg));
+
+  Label while_true, no_carry, loop_end;
+  __ bind(&while_true);
+
+  __ And(scratch2, scratch, 1);
+
+  __ Branch(&no_carry, eq, scratch2, Operand(zero_reg));
+  __ mul_d(double_result, double_result, double_scratch);
+  __ bind(&no_carry);
+
+  __ sra(scratch, scratch, 1);
+
+  __ Branch(&loop_end, eq, scratch, Operand(zero_reg));
+  __ mul_d(double_scratch, double_scratch, double_scratch);
+
+  __ Branch(&while_true);
+
+  __ bind(&loop_end);
+
+  __ Branch(&done, ge, exponent, Operand(zero_reg));
+  __ Move(double_scratch, 1.0);
+  __ div_d(double_result, double_scratch, double_result);
+  // Test whether result is zero.  Bail out to check for subnormal result.
+  // Due to subnormals, x^-y == (1/x)^y does not hold in all cases.
+  __ CompareF64(EQ, double_result, kDoubleRegZero);
+  __ BranchFalseShortF(&done);
+
+  // double_exponent may not contain the exponent value if the input was a
+  // smi.  We set it with exponent value before bailing out.
+  __ bind(&bail_out);
+  __ mtc1(exponent, single_scratch);
+  __ cvt_d_w(double_exponent, single_scratch);
+
+  // Returning or bailing out.
+  __ push(ra);
+  {
+    AllowExternalCallThatCantCauseGC scope(masm);
+    __ PrepareCallCFunction(0, 2, scratch);
+    __ MovToFloatParameters(double_base, double_exponent);
+    __ CallCFunction(ExternalReference::power_double_double_function(), 0, 2);
+  }
+  __ pop(ra);
+  __ MovFromFloatResult(double_result);
+
+  __ bind(&done);
+  __ Ret();
+}
+
+namespace {
+
+void GenerateInternalArrayConstructorCase(MacroAssembler* masm,
+                                          ElementsKind kind) {
+  __ Jump(CodeFactory::InternalArrayNoArgumentConstructor(masm->isolate(), kind)
+              .code(),
+          RelocInfo::CODE_TARGET, lo, a0, Operand(1));
+
+  __ Jump(BUILTIN_CODE(masm->isolate(), ArrayNArgumentsConstructor),
+          RelocInfo::CODE_TARGET, hi, a0, Operand(1));
+
+  if (IsFastPackedElementsKind(kind)) {
+    // We might need to create a holey array
+    // look at the first argument.
+    __ lw(kScratchReg, MemOperand(sp, 0));
+
+    __ Jump(CodeFactory::InternalArraySingleArgumentConstructor(
+                masm->isolate(), GetHoleyElementsKind(kind))
+                .code(),
+            RelocInfo::CODE_TARGET, ne, kScratchReg, Operand(zero_reg));
+  }
+
+  __ Jump(
+      CodeFactory::InternalArraySingleArgumentConstructor(masm->isolate(), kind)
+          .code(),
+      RelocInfo::CODE_TARGET);
+}
+
+}  // namespace
+
+void Builtins::Generate_InternalArrayConstructorImpl(MacroAssembler* masm) {
+  // ----------- S t a t e -------------
+  //  -- a0 : argc
+  //  -- a1 : constructor
+  //  -- sp[0] : return address
+  //  -- sp[4] : last argument
+  // -----------------------------------
+
+  if (FLAG_debug_code) {
+    // The array construct code is only set for the global and natives
+    // builtin Array functions which always have maps.
+
+    // Initial map for the builtin Array function should be a map.
+    __ lw(a3, FieldMemOperand(a1, JSFunction::kPrototypeOrInitialMapOffset));
+    // Will both indicate a nullptr and a Smi.
+    __ SmiTst(a3, kScratchReg);
+    __ Assert(ne, AbortReason::kUnexpectedInitialMapForArrayFunction,
+              kScratchReg, Operand(zero_reg));
+    __ GetObjectType(a3, a3, t0);
+    __ Assert(eq, AbortReason::kUnexpectedInitialMapForArrayFunction, t0,
+              Operand(MAP_TYPE));
+  }
+
+  // Figure out the right elements kind.
+  __ lw(a3, FieldMemOperand(a1, JSFunction::kPrototypeOrInitialMapOffset));
+
+  // Load the map's "bit field 2" into a3. We only need the first byte,
+  // but the following bit field extraction takes care of that anyway.
+  __ lbu(a3, FieldMemOperand(a3, Map::kBitField2Offset));
+  // Retrieve elements_kind from bit field 2.
+  __ DecodeField<Map::ElementsKindBits>(a3);
+
+  if (FLAG_debug_code) {
+    Label done;
+    __ Branch(&done, eq, a3, Operand(PACKED_ELEMENTS));
+    __ Assert(
+        eq,
+        AbortReason::kInvalidElementsKindForInternalArrayOrInternalPackedArray,
+        a3, Operand(HOLEY_ELEMENTS));
+    __ bind(&done);
+  }
+
+  Label fast_elements_case;
+  __ Branch(&fast_elements_case, eq, a3, Operand(PACKED_ELEMENTS));
+  GenerateInternalArrayConstructorCase(masm, HOLEY_ELEMENTS);
+
+  __ bind(&fast_elements_case);
+  GenerateInternalArrayConstructorCase(masm, PACKED_ELEMENTS);
 }
 
 #undef __
diff --git a/deps/v8/src/builtins/mips64/builtins-mips64.cc b/deps/v8/src/builtins/mips64/builtins-mips64.cc
index 7756872b14111e..a93c75b2fceaf8 100644
--- a/deps/v8/src/builtins/mips64/builtins-mips64.cc
+++ b/deps/v8/src/builtins/mips64/builtins-mips64.cc
@@ -4,12 +4,14 @@
 
 #if V8_TARGET_ARCH_MIPS64
 
+#include "src/code-factory.h"
 #include "src/code-stubs.h"
 #include "src/counters.h"
 #include "src/debug/debug.h"
 #include "src/deoptimizer.h"
 #include "src/frame-constants.h"
 #include "src/frames.h"
+#include "src/mips64/constants-mips64.h"
 #include "src/objects-inl.h"
 #include "src/runtime/runtime.h"
 
@@ -20,7 +22,7 @@ namespace internal {
 
 void Builtins::Generate_Adaptor(MacroAssembler* masm, Address address,
                                 ExitFrameType exit_frame_type) {
-  __ li(s2, Operand(ExternalReference(address, masm->isolate())));
+  __ li(kJavaScriptCallExtraArg1Register, ExternalReference::Create(address));
   if (exit_frame_type == BUILTIN_EXIT) {
     __ Jump(BUILTIN_CODE(masm->isolate(), AdaptorWithBuiltinExitFrame),
             RelocInfo::CODE_TARGET);
@@ -31,57 +33,6 @@ void Builtins::Generate_Adaptor(MacroAssembler* masm, Address address,
   }
 }
 
-namespace {
-
-void AdaptorWithExitFrameType(MacroAssembler* masm,
-                              Builtins::ExitFrameType exit_frame_type) {
-  // ----------- S t a t e -------------
-  //  -- a0                 : number of arguments excluding receiver
-  //  -- a1                 : target
-  //  -- a3                 : new.target
-  //  -- s2                 : entry point
-  //  -- sp[0]              : last argument
-  //  -- ...
-  //  -- sp[8 * (argc - 1)] : first argument
-  //  -- sp[8 * agrc]       : receiver
-  // -----------------------------------
-  __ AssertFunction(a1);
-
-  // Make sure we operate in the context of the called function (for example
-  // ConstructStubs implemented in C++ will be run in the context of the caller
-  // instead of the callee, due to the way that [[Construct]] is defined for
-  // ordinary functions).
-  __ Ld(cp, FieldMemOperand(a1, JSFunction::kContextOffset));
-
-  // CEntryStub expects a0 to contain the number of arguments including the
-  // receiver and the extra arguments.
-  __ Daddu(a0, a0, BuiltinExitFrameConstants::kNumExtraArgsWithReceiver);
-
-  // Insert extra arguments.
-  __ PushRoot(Heap::kTheHoleValueRootIndex);  // Padding.
-  __ SmiTag(a0);
-  __ Push(a0, a1, a3);
-  __ SmiUntag(a0);
-
-  // Jump to the C entry runtime stub directly here instead of using
-  // JumpToExternalReference. We have already loaded entry point to s2
-  // in Generate_adaptor.
-  __ mov(a1, s2);
-  CEntryStub stub(masm->isolate(), 1, kDontSaveFPRegs, kArgvOnStack,
-                  exit_frame_type == Builtins::BUILTIN_EXIT);
-  __ Jump(stub.GetCode(), RelocInfo::CODE_TARGET, al, zero_reg,
-          Operand(zero_reg), PROTECT);
-}
-}  // namespace
-
-void Builtins::Generate_AdaptorWithExitFrame(MacroAssembler* masm) {
-  AdaptorWithExitFrameType(masm, EXIT);
-}
-
-void Builtins::Generate_AdaptorWithBuiltinExitFrame(MacroAssembler* masm) {
-  AdaptorWithExitFrameType(masm, BUILTIN_EXIT);
-}
-
 void Builtins::Generate_InternalArrayConstructor(MacroAssembler* masm) {
   // ----------- S t a t e -------------
   //  -- a0     : number of arguments
@@ -103,44 +54,9 @@ void Builtins::Generate_InternalArrayConstructor(MacroAssembler* masm) {
 
   // Run the native code for the InternalArray function called as a normal
   // function.
-  // Tail call a stub.
-  __ LoadRoot(a2, Heap::kUndefinedValueRootIndex);
-  InternalArrayConstructorStub stub(masm->isolate());
-  __ TailCallStub(&stub);
-}
-
-void Builtins::Generate_ArrayConstructor(MacroAssembler* masm) {
-  // ----------- S t a t e -------------
-  //  -- a0     : number of arguments
-  //  -- a1     : array function
-  //  -- ra     : return address
-  //  -- sp[...]: constructor arguments
-  // -----------------------------------
-  Label generic_array_code;
-
-  if (FLAG_debug_code) {
-    // Initial map for the builtin Array functions should be maps.
-    __ Ld(a2, FieldMemOperand(a1, JSFunction::kPrototypeOrInitialMapOffset));
-    __ SmiTst(a2, a4);
-    __ Assert(ne, AbortReason::kUnexpectedInitialMapForArrayFunction1, a4,
-              Operand(zero_reg));
-    __ GetObjectType(a2, t0, a4);
-    __ Assert(eq, AbortReason::kUnexpectedInitialMapForArrayFunction2, a4,
-              Operand(MAP_TYPE));
-  }
-
-  // a2 is the AllocationSite - here undefined.
   __ LoadRoot(a2, Heap::kUndefinedValueRootIndex);
-  // If a3 (new target) is undefined, then this is the 'Call' case, so move
-  // a1 (the constructor) to a3.
-  Label call;
-  __ Branch(&call, ne, a3, Operand(a2));
-  __ mov(a3, a1);
-
-  // Run the native code for the Array function called as a normal function.
-  __ bind(&call);
-  ArrayConstructorStub stub(masm->isolate());
-  __ TailCallStub(&stub);
+  __ Jump(BUILTIN_CODE(masm->isolate(), InternalArrayConstructorImpl),
+          RelocInfo::CODE_TARGET);
 }
 
 static void GenerateTailCallToReturnedCode(MacroAssembler* masm,
@@ -237,9 +153,10 @@ void Generate_JSBuiltinsConstructStubHelper(MacroAssembler* masm) {
   __ Ret();
 }
 
+}  // namespace
+
 // The construct stub for ES5 constructor functions and ES6 class constructors.
-void Generate_JSConstructStubGeneric(MacroAssembler* masm,
-                                     bool restrict_constructor_return) {
+void Builtins::Generate_JSConstructStubGeneric(MacroAssembler* masm) {
   // ----------- S t a t e -------------
   //  --      a0: number of arguments (untagged)
   //  --      a1: constructor function
@@ -369,7 +286,7 @@ void Generate_JSConstructStubGeneric(MacroAssembler* masm,
     // If the result is an object (in the ECMA sense), we should get rid
     // of the receiver and use the result; see ECMA-262 section 13.2.2-7
     // on page 74.
-    Label use_receiver, do_throw, other_result, leave_frame;
+    Label use_receiver, do_throw, leave_frame;
 
     // If the result is undefined, we jump out to using the implicit receiver.
     __ JumpIfRoot(v0, Heap::kUndefinedValueRootIndex, &use_receiver);
@@ -378,30 +295,14 @@ void Generate_JSConstructStubGeneric(MacroAssembler* masm,
     // is a valid receiver.
 
     // If the result is a smi, it is *not* an object in the ECMA sense.
-    __ JumpIfSmi(v0, &other_result);
+    __ JumpIfSmi(v0, &use_receiver);
 
     // If the type of the result (stored in its map) is less than
     // FIRST_JS_RECEIVER_TYPE, it is not an object in the ECMA sense.
     __ GetObjectType(v0, t2, t2);
     STATIC_ASSERT(LAST_JS_RECEIVER_TYPE == LAST_TYPE);
     __ Branch(&leave_frame, greater_equal, t2, Operand(FIRST_JS_RECEIVER_TYPE));
-
-    // The result is now neither undefined nor an object.
-    __ bind(&other_result);
-    __ Ld(a1, MemOperand(fp, ConstructFrameConstants::kConstructorOffset));
-    __ Ld(t2, FieldMemOperand(a1, JSFunction::kSharedFunctionInfoOffset));
-    __ lwu(t2, FieldMemOperand(t2, SharedFunctionInfo::kFlagsOffset));
-    __ And(t2, t2, Operand(SharedFunctionInfo::IsClassConstructorBit::kMask));
-
-    if (restrict_constructor_return) {
-      // Throw if constructor function is a class constructor
-      __ Branch(&use_receiver, eq, t2, Operand(zero_reg));
-    } else {
-      __ Branch(&use_receiver, ne, t2, Operand(zero_reg));
-      __ CallRuntime(
-          Runtime::kIncrementUseCounterConstructorReturnNonUndefinedPrimitive);
-      __ Branch(&use_receiver);
-    }
+    __ Branch(&use_receiver);
 
     __ bind(&do_throw);
     __ CallRuntime(Runtime::kThrowConstructorReturnedNonObject);
@@ -424,16 +325,6 @@ void Generate_JSConstructStubGeneric(MacroAssembler* masm,
   __ Ret();
 }
 
-}  // namespace
-
-void Builtins::Generate_JSConstructStubGenericRestrictedReturn(
-    MacroAssembler* masm) {
-  Generate_JSConstructStubGeneric(masm, true);
-}
-void Builtins::Generate_JSConstructStubGenericUnrestrictedReturn(
-    MacroAssembler* masm) {
-  Generate_JSConstructStubGeneric(masm, false);
-}
 void Builtins::Generate_JSBuiltinsConstructStub(MacroAssembler* masm) {
   Generate_JSBuiltinsConstructStubHelper(masm);
 }
@@ -474,14 +365,14 @@ void Builtins::Generate_ResumeGeneratorTrampoline(MacroAssembler* masm) {
   Label stepping_prepared;
   ExternalReference debug_hook =
       ExternalReference::debug_hook_on_function_call_address(masm->isolate());
-  __ li(a5, Operand(debug_hook));
+  __ li(a5, debug_hook);
   __ Lb(a5, MemOperand(a5));
   __ Branch(&prepare_step_in_if_stepping, ne, a5, Operand(zero_reg));
 
   // Flood function if we need to continue stepping in the suspended generator.
   ExternalReference debug_suspended_generator =
       ExternalReference::debug_suspended_generator_address(masm->isolate());
-  __ li(a5, Operand(debug_suspended_generator));
+  __ li(a5, debug_suspended_generator);
   __ Ld(a5, MemOperand(a5));
   __ Branch(&prepare_step_in_suspended_generator, eq, a1, Operand(a5));
   __ bind(&stepping_prepared);
@@ -489,8 +380,8 @@ void Builtins::Generate_ResumeGeneratorTrampoline(MacroAssembler* masm) {
   // Check the stack for overflow. We are not trying to catch interruptions
   // (i.e. debug break and preemption) here, so check the "real stack limit".
   Label stack_overflow;
-  __ LoadRoot(at, Heap::kRealStackLimitRootIndex);
-  __ Branch(&stack_overflow, lo, sp, Operand(at));
+  __ LoadRoot(kScratchReg, Heap::kRealStackLimitRootIndex);
+  __ Branch(&stack_overflow, lo, sp, Operand(kScratchReg));
 
   // Push receiver.
   __ Ld(a5, FieldMemOperand(a1, JSGeneratorObject::kReceiverOffset));
@@ -509,14 +400,20 @@ void Builtins::Generate_ResumeGeneratorTrampoline(MacroAssembler* masm) {
   // values have already been copied into the context and these dummy values
   // will never be used.
   __ Ld(a3, FieldMemOperand(a4, JSFunction::kSharedFunctionInfoOffset));
-  __ Lw(a3,
-        FieldMemOperand(a3, SharedFunctionInfo::kFormalParameterCountOffset));
+  __ Lhu(a3,
+         FieldMemOperand(a3, SharedFunctionInfo::kFormalParameterCountOffset));
+  __ Ld(t1,
+        FieldMemOperand(a1, JSGeneratorObject::kParametersAndRegistersOffset));
   {
     Label done_loop, loop;
+    __ Move(t2, zero_reg);
     __ bind(&loop);
     __ Dsubu(a3, a3, Operand(1));
     __ Branch(&done_loop, lt, a3, Operand(zero_reg));
-    __ PushRoot(Heap::kTheHoleValueRootIndex);
+    __ Dlsa(kScratchReg, t1, t2, kPointerSizeLog2);
+    __ Ld(kScratchReg, FieldMemOperand(kScratchReg, FixedArray::kHeaderSize));
+    __ Push(kScratchReg);
+    __ Daddu(t2, t2, Operand(1));
     __ Branch(&loop);
     __ bind(&done_loop);
   }
@@ -534,8 +431,8 @@ void Builtins::Generate_ResumeGeneratorTrampoline(MacroAssembler* masm) {
   // Resume (Ignition/TurboFan) generator object.
   {
     __ Ld(a0, FieldMemOperand(a4, JSFunction::kSharedFunctionInfoOffset));
-    __ Lw(a0,
-          FieldMemOperand(a0, SharedFunctionInfo::kFormalParameterCountOffset));
+    __ Lhu(a0, FieldMemOperand(
+                   a0, SharedFunctionInfo::kFormalParameterCountOffset));
     // We abuse new.target both to indicate that this is a resume call and to
     // pass in the generator object.  In ordinary calls, new.target is always
     // undefined because generator functions are non-constructable.
@@ -551,6 +448,8 @@ void Builtins::Generate_ResumeGeneratorTrampoline(MacroAssembler* masm) {
   {
     FrameScope scope(masm, StackFrame::INTERNAL);
     __ Push(a1, a4);
+    // Push hole as receiver since we do not use it for stepping.
+    __ PushRoot(Heap::kTheHoleValueRootIndex);
     __ CallRuntime(Runtime::kDebugOnFunctionCall);
     __ Pop(a1);
   }
@@ -603,8 +502,6 @@ static void Generate_CheckStackOverflow(MacroAssembler* masm, Register argc) {
 
 static void Generate_JSEntryTrampolineHelper(MacroAssembler* masm,
                                              bool is_construct) {
-  // Called from JSEntryStub::GenerateBody
-
   // ----------- S t a t e -------------
   //  -- a0: new.target
   //  -- a1: function
@@ -619,9 +516,9 @@ static void Generate_JSEntryTrampolineHelper(MacroAssembler* masm,
     FrameScope scope(masm, StackFrame::INTERNAL);
 
     // Setup the context (we need to use the caller context from the isolate).
-    ExternalReference context_address(IsolateAddressId::kContextAddress,
-                                      masm->isolate());
-    __ li(cp, Operand(context_address));
+    ExternalReference context_address = ExternalReference::Create(
+        IsolateAddressId::kContextAddress, masm->isolate());
+    __ li(cp, context_address);
     __ Ld(cp, MemOperand(cp));
 
     // Push the function and the receiver onto the stack.
@@ -827,9 +724,7 @@ static void AdvanceBytecodeOffsetOrReturn(MacroAssembler* masm,
   Register bytecode_size_table = scratch1;
   DCHECK(!AreAliased(bytecode_array, bytecode_offset, bytecode_size_table,
                      bytecode));
-  __ li(
-      bytecode_size_table,
-      Operand(ExternalReference::bytecode_size_table_address(masm->isolate())));
+  __ li(bytecode_size_table, ExternalReference::bytecode_size_table_address());
 
   // Check if the bytecode is a Wide or ExtraWide prefix bytecode.
   Label process_bytecode, extra_wide;
@@ -908,16 +803,12 @@ void Builtins::Generate_InterpreterEntryTrampoline(MacroAssembler* masm) {
   FrameScope frame_scope(masm, StackFrame::MANUAL);
   __ PushStandardFrame(closure);
 
-  // Get the bytecode array from the function object (or from the DebugInfo if
-  // it is present) and load it into kInterpreterBytecodeArrayRegister.
-  Label maybe_load_debug_bytecode_array, bytecode_array_loaded;
+  // Get the bytecode array from the function object and load it into
+  // kInterpreterBytecodeArrayRegister.
   __ Ld(a0, FieldMemOperand(closure, JSFunction::kSharedFunctionInfoOffset));
   __ Ld(kInterpreterBytecodeArrayRegister,
         FieldMemOperand(a0, SharedFunctionInfo::kFunctionDataOffset));
   GetSharedFunctionInfoBytecode(masm, kInterpreterBytecodeArrayRegister, a4);
-  __ Ld(a4, FieldMemOperand(a0, SharedFunctionInfo::kDebugInfoOffset));
-  __ JumpIfNotSmi(a4, &maybe_load_debug_bytecode_array);
-  __ bind(&bytecode_array_loaded);
 
   // Increment invocation count for the function.
   __ Lw(a4, FieldMemOperand(feedback_vector,
@@ -999,13 +890,12 @@ void Builtins::Generate_InterpreterEntryTrampoline(MacroAssembler* masm) {
   Label do_dispatch;
   __ bind(&do_dispatch);
   __ li(kInterpreterDispatchTableRegister,
-        Operand(ExternalReference::interpreter_dispatch_table_address(
-            masm->isolate())));
+        ExternalReference::interpreter_dispatch_table_address(masm->isolate()));
   __ Daddu(a0, kInterpreterBytecodeArrayRegister,
            kInterpreterBytecodeOffsetRegister);
   __ Lbu(a7, MemOperand(a0));
-  __ Dlsa(at, kInterpreterDispatchTableRegister, a7, kPointerSizeLog2);
-  __ Ld(kJavaScriptCallCodeStartRegister, MemOperand(at));
+  __ Dlsa(kScratchReg, kInterpreterDispatchTableRegister, a7, kPointerSizeLog2);
+  __ Ld(kJavaScriptCallCodeStartRegister, MemOperand(kScratchReg));
   __ Call(kJavaScriptCallCodeStartRegister);
   masm->isolate()->heap()->SetInterpreterEntryReturnPCOffset(masm->pc_offset());
 
@@ -1033,36 +923,6 @@ void Builtins::Generate_InterpreterEntryTrampoline(MacroAssembler* masm) {
   // The return value is in v0.
   LeaveInterpreterFrame(masm, t0);
   __ Jump(ra);
-
-  // Load debug copy of the bytecode array if it exists.
-  // kInterpreterBytecodeArrayRegister is already loaded with
-  // SharedFunctionInfo::kFunctionDataOffset.
-  __ bind(&maybe_load_debug_bytecode_array);
-  __ Ld(a5, FieldMemOperand(a4, DebugInfo::kDebugBytecodeArrayOffset));
-  __ JumpIfRoot(a5, Heap::kUndefinedValueRootIndex, &bytecode_array_loaded);
-
-  __ mov(kInterpreterBytecodeArrayRegister, a5);
-  __ Ld(a5, FieldMemOperand(a4, DebugInfo::kFlagsOffset));
-  __ SmiUntag(a5);
-  __ And(a5, a5, Operand(DebugInfo::kDebugExecutionMode));
-
-  ExternalReference debug_execution_mode =
-      ExternalReference::debug_execution_mode_address(masm->isolate());
-  __ li(a4, Operand(debug_execution_mode));
-  __ Lb(a4, MemOperand(a4));
-  STATIC_ASSERT(static_cast<int>(DebugInfo::kDebugExecutionMode) ==
-                static_cast<int>(DebugInfo::kSideEffects));
-  __ Branch(&bytecode_array_loaded, eq, a4, Operand(a5));
-
-  __ push(closure);
-  __ push(feedback_vector);
-  __ push(kInterpreterBytecodeArrayRegister);
-  __ push(closure);
-  __ CallRuntime(Runtime::kDebugApplyInstrumentation);
-  __ pop(kInterpreterBytecodeArrayRegister);
-  __ pop(feedback_vector);
-  __ pop(closure);
-  __ Branch(&bytecode_array_loaded);
 }
 
 static void Generate_StackOverflowCheck(MacroAssembler* masm, Register num_args,
@@ -1181,8 +1041,8 @@ void Builtins::Generate_InterpreterPushArgsThenConstructImpl(
 
     // Tail call to the function-specific construct stub (still in the caller
     // context at this point).
-    ArrayConstructorStub array_constructor_stub(masm->isolate());
-    __ Jump(array_constructor_stub.GetCode(), RelocInfo::CODE_TARGET);
+    __ Jump(BUILTIN_CODE(masm->isolate(), ArrayConstructorImpl),
+            RelocInfo::CODE_TARGET);
   } else if (mode == InterpreterPushArgsMode::kWithFinalSpread) {
     // Call the constructor with a0, a1, and a3 unmodified.
     __ Jump(BUILTIN_CODE(masm->isolate(), ConstructWithSpread),
@@ -1223,7 +1083,7 @@ static void Generate_InterpreterEnterBytecode(MacroAssembler* masm) {
   __ Branch(&trampoline_loaded);
 
   __ bind(&builtin_trampoline);
-  __ li(t0, Operand(BUILTIN_CODE(masm->isolate(), InterpreterEntryTrampoline)));
+  __ li(t0, BUILTIN_CODE(masm->isolate(), InterpreterEntryTrampoline));
 
   __ bind(&trampoline_loaded);
   __ Daddu(ra, t0, Operand(interpreter_entry_return_pc_offset->value() +
@@ -1231,8 +1091,7 @@ static void Generate_InterpreterEnterBytecode(MacroAssembler* masm) {
 
   // Initialize the dispatch table register.
   __ li(kInterpreterDispatchTableRegister,
-        Operand(ExternalReference::interpreter_dispatch_table_address(
-            masm->isolate())));
+        ExternalReference::interpreter_dispatch_table_address(masm->isolate()));
 
   // Get the bytecode array pointer from the frame.
   __ Ld(kInterpreterBytecodeArrayRegister,
@@ -1240,10 +1099,10 @@ static void Generate_InterpreterEnterBytecode(MacroAssembler* masm) {
 
   if (FLAG_debug_code) {
     // Check function data field is actually a BytecodeArray object.
-    __ SmiTst(kInterpreterBytecodeArrayRegister, at);
+    __ SmiTst(kInterpreterBytecodeArrayRegister, kScratchReg);
     __ Assert(ne,
               AbortReason::kFunctionDataShouldBeBytecodeArrayOnInterpreterEntry,
-              at, Operand(zero_reg));
+              kScratchReg, Operand(zero_reg));
     __ GetObjectType(kInterpreterBytecodeArrayRegister, a1, a1);
     __ Assert(eq,
               AbortReason::kFunctionDataShouldBeBytecodeArrayOnInterpreterEntry,
@@ -1251,9 +1110,8 @@ static void Generate_InterpreterEnterBytecode(MacroAssembler* masm) {
   }
 
   // Get the target bytecode offset from the frame.
-  __ Lw(
-      kInterpreterBytecodeOffsetRegister,
-      UntagSmiMemOperand(fp, InterpreterFrameConstants::kBytecodeOffsetFromFp));
+  __ SmiUntag(kInterpreterBytecodeOffsetRegister,
+              MemOperand(fp, InterpreterFrameConstants::kBytecodeOffsetFromFp));
 
   // Dispatch to the target bytecode.
   __ Daddu(a1, kInterpreterBytecodeArrayRegister,
@@ -1300,203 +1158,6 @@ void Builtins::Generate_InterpreterEnterBytecodeDispatch(MacroAssembler* masm) {
   Generate_InterpreterEnterBytecode(masm);
 }
 
-void Builtins::Generate_CompileLazyDeoptimizedCode(MacroAssembler* masm) {
-  // Set the code slot inside the JSFunction to CompileLazy.
-  __ Move(a2, BUILTIN_CODE(masm->isolate(), CompileLazy));
-  __ Sd(a2, FieldMemOperand(a1, JSFunction::kCodeOffset));
-  __ RecordWriteField(a1, JSFunction::kCodeOffset, a2, a4, kRAHasNotBeenSaved,
-                      kDontSaveFPRegs, OMIT_REMEMBERED_SET, OMIT_SMI_CHECK);
-  // Jump to compile lazy.
-  Generate_CompileLazy(masm);
-}
-
-static void GetSharedFunctionInfoCode(MacroAssembler* masm, Register sfi_data,
-                                      Register scratch1) {
-  // Figure out the SFI's code object.
-  Label done;
-  Label check_is_bytecode_array;
-  Label check_is_code;
-  Label check_is_fixed_array;
-  Label check_is_pre_parsed_scope_data;
-  Label check_is_function_template_info;
-  Label check_is_interpreter_data;
-
-  Register data_type = scratch1;
-
-  // IsSmi: Is builtin
-  __ JumpIfNotSmi(sfi_data, &check_is_bytecode_array);
-  __ li(scratch1,
-        Operand(ExternalReference::builtins_address(masm->isolate())));
-  // Avoid untagging the Smi by merging the shift
-  STATIC_ASSERT(kPointerSizeLog2 < kSmiShift);
-  __ dsrl(sfi_data, sfi_data, kSmiShift - kPointerSizeLog2);
-  __ Daddu(scratch1, scratch1, sfi_data);
-  __ Ld(sfi_data, MemOperand(scratch1));
-  __ Branch(&done);
-
-  // Get map for subsequent checks.
-  __ bind(&check_is_bytecode_array);
-  __ Ld(data_type, FieldMemOperand(sfi_data, HeapObject::kMapOffset));
-  __ Lhu(data_type, FieldMemOperand(data_type, Map::kInstanceTypeOffset));
-
-  // IsBytecodeArray: Interpret bytecode
-  __ Branch(&check_is_code, ne, data_type, Operand(BYTECODE_ARRAY_TYPE));
-  __ Move(sfi_data, BUILTIN_CODE(masm->isolate(), InterpreterEntryTrampoline));
-  __ Branch(&done);
-
-  // IsCode: Run code
-  __ bind(&check_is_code);
-  __ Branch(&done, eq, data_type, Operand(CODE_TYPE));
-
-  // IsFixedArray: Instantiate using AsmWasmData,
-  __ bind(&check_is_fixed_array);
-  __ Branch(&check_is_pre_parsed_scope_data, ne, data_type,
-            Operand(FIXED_ARRAY_TYPE));
-  __ Move(sfi_data, BUILTIN_CODE(masm->isolate(), InstantiateAsmJs));
-  __ Branch(&done);
-
-  // IsPreParsedScopeData: Compile lazy
-  __ bind(&check_is_pre_parsed_scope_data);
-  __ Branch(&check_is_function_template_info, ne, data_type,
-            Operand(TUPLE2_TYPE));
-  __ Move(sfi_data, BUILTIN_CODE(masm->isolate(), CompileLazy));
-  __ Branch(&done);
-
-  // IsFunctionTemplateInfo: API call
-  __ bind(&check_is_function_template_info);
-  __ Branch(&check_is_interpreter_data, ne, data_type,
-            Operand(FUNCTION_TEMPLATE_INFO_TYPE));
-  __ Move(sfi_data, BUILTIN_CODE(masm->isolate(), HandleApiCall));
-
-  // IsInterpreterData: Interpret bytecode
-  __ bind(&check_is_interpreter_data);
-  if (FLAG_debug_code) {
-    __ Assert(eq, AbortReason::kInvalidSharedFunctionInfoData, data_type,
-              Operand(INTERPRETER_DATA_TYPE));
-  }
-  __ Ld(sfi_data, FieldMemOperand(
-                      sfi_data, InterpreterData::kInterpreterTrampolineOffset));
-
-  __ bind(&done);
-}
-
-void Builtins::Generate_CompileLazy(MacroAssembler* masm) {
-  // ----------- S t a t e -------------
-  //  -- a0 : argument count (preserved for callee)
-  //  -- a3 : new target (preserved for callee)
-  //  -- a1 : target function (preserved for callee)
-  // -----------------------------------
-  // First lookup code, maybe we don't need to compile!
-  Label gotta_call_runtime;
-
-  Register closure = a1;
-  Register feedback_vector = a2;
-
-  // Do we have a valid feedback vector?
-  __ Ld(feedback_vector,
-        FieldMemOperand(closure, JSFunction::kFeedbackCellOffset));
-  __ Ld(feedback_vector, FieldMemOperand(feedback_vector, Cell::kValueOffset));
-  __ JumpIfRoot(feedback_vector, Heap::kUndefinedValueRootIndex,
-                &gotta_call_runtime);
-
-  // Is there an optimization marker or optimized code in the feedback vector?
-  MaybeTailCallOptimizedCodeSlot(masm, feedback_vector, a4, t3, a5);
-
-  // We found no optimized code. Infer the code object needed for the SFI.
-  Register entry = a4;
-  __ Ld(entry, FieldMemOperand(closure, JSFunction::kSharedFunctionInfoOffset));
-  __ Ld(entry, FieldMemOperand(entry, SharedFunctionInfo::kFunctionDataOffset));
-  GetSharedFunctionInfoCode(masm, entry, t1);
-
-  __ Move(t1, masm->CodeObject());
-  __ Branch(&gotta_call_runtime, eq, entry, Operand(t1));
-
-  // Install the SFI's code entry.
-  __ Sd(entry, FieldMemOperand(closure, JSFunction::kCodeOffset));
-  __ mov(t3, entry);  // Write barrier clobbers t3 below.
-  __ RecordWriteField(closure, JSFunction::kCodeOffset, t3, a5,
-                      kRAHasNotBeenSaved, kDontSaveFPRegs, OMIT_REMEMBERED_SET,
-                      OMIT_SMI_CHECK);
-  __ Daddu(entry, entry, Operand(Code::kHeaderSize - kHeapObjectTag));
-  __ Jump(entry);
-
-  __ bind(&gotta_call_runtime);
-  GenerateTailCallToReturnedCode(masm, Runtime::kCompileLazy);
-}
-
-// Lazy deserialization design doc: http://goo.gl/dxkYDZ.
-void Builtins::Generate_DeserializeLazy(MacroAssembler* masm) {
-  // ----------- S t a t e -------------
-  //  -- a0 : argument count (preserved for callee)
-  //  -- a3 : new target (preserved for callee)
-  //  -- a1 : target function (preserved for callee)
-  // -----------------------------------
-
-  Label deserialize_in_runtime;
-
-  Register target = a1;  // Must be preserved
-  Register scratch0 = a2;
-  Register scratch1 = t0;
-
-  CHECK(scratch0 != a0 && scratch0 != a3 && scratch0 != a1);
-  CHECK(scratch1 != a0 && scratch1 != a3 && scratch1 != a1);
-  CHECK(scratch0 != scratch1);
-
-  // Load the builtin id for lazy deserialization from SharedFunctionInfo.
-
-  __ AssertFunction(target);
-  __ Ld(scratch0,
-        FieldMemOperand(target, JSFunction::kSharedFunctionInfoOffset));
-
-  __ Ld(scratch1,
-        FieldMemOperand(scratch0, SharedFunctionInfo::kFunctionDataOffset));
-  __ AssertSmi(scratch1);
-
-  // The builtin may already have been deserialized. If that is the case, it is
-  // stored in the builtins table, and we can copy to correct code object to
-  // both the shared function info and function without calling into runtime.
-  //
-  // Otherwise, we need to call into runtime to deserialize.
-
-  {
-    // Load the code object at builtins_table[builtin_id] into scratch1.
-
-    __ SmiUntag(scratch1);
-    __ li(scratch0,
-          Operand(ExternalReference::builtins_address(masm->isolate())));
-    __ Dlsa(scratch1, scratch0, scratch1, kPointerSizeLog2);
-    __ Ld(scratch1, MemOperand(scratch1));
-
-    // Check if the loaded code object has already been deserialized. This is
-    // the case iff it does not equal DeserializeLazy.
-
-    __ Move(scratch0, masm->CodeObject());
-    __ Branch(&deserialize_in_runtime, eq, scratch1, Operand(scratch0));
-  }
-
-  {
-    // If we've reached this spot, the target builtin has been deserialized and
-    // we simply need to copy it over to the target function.
-
-    Register target_builtin = scratch1;
-
-    __ Sd(target_builtin, FieldMemOperand(target, JSFunction::kCodeOffset));
-    __ mov(t3, target_builtin);  // Write barrier clobbers t3 below.
-    __ RecordWriteField(target, JSFunction::kCodeOffset, t3, t1,
-                        kRAHasNotBeenSaved, kDontSaveFPRegs,
-                        OMIT_REMEMBERED_SET, OMIT_SMI_CHECK);
-
-    // All copying is done. Jump to the deserialized code object.
-
-    __ Daddu(target_builtin, target_builtin,
-             Operand(Code::kHeaderSize - kHeapObjectTag));
-    __ Jump(target_builtin);
-  }
-
-  __ bind(&deserialize_in_runtime);
-  GenerateTailCallToReturnedCode(masm, Runtime::kDeserializeLazy);
-}
-
 void Builtins::Generate_InstantiateAsmJs(MacroAssembler* masm) {
   // ----------- S t a t e -------------
   //  -- a0 : argument count (preserved for callee)
@@ -1656,9 +1317,9 @@ static void Generate_OnStackReplacementHelper(MacroAssembler* masm,
 
   // Load the OSR entrypoint offset from the deoptimization data.
   // <osr_offset> = <deopt_data>[#header_size + #osr_pc_offset]
-  __ Lw(a1, UntagSmiMemOperand(a1, FixedArray::OffsetOfElementAt(
-                                       DeoptimizationData::kOsrPcOffsetIndex) -
-                                       kHeapObjectTag));
+  __ SmiUntag(a1, MemOperand(a1, FixedArray::OffsetOfElementAt(
+                                     DeoptimizationData::kOsrPcOffsetIndex) -
+                                     kHeapObjectTag));
 
   // Compute the target address = code_obj + header_size + osr_offset
   // <entry_addr> = <code_obj> + #header_size + <osr_offset>
@@ -1758,8 +1419,8 @@ void Builtins::Generate_FunctionPrototypeCall(MacroAssembler* masm) {
 
   // 2. Get the function to call (passed as receiver) from the stack.
   // a0: actual number of arguments
-  __ Dlsa(at, sp, a0, kPointerSizeLog2);
-  __ Ld(a1, MemOperand(at));
+  __ Dlsa(kScratchReg, sp, a0, kPointerSizeLog2);
+  __ Ld(a1, MemOperand(kScratchReg));
 
   // 3. Shift arguments and return address one slot down on the stack
   //    (overwriting the original receiver).  Adjust argument count to make
@@ -1772,8 +1433,8 @@ void Builtins::Generate_FunctionPrototypeCall(MacroAssembler* masm) {
     __ Dlsa(a2, sp, a0, kPointerSizeLog2);
 
     __ bind(&loop);
-    __ Ld(at, MemOperand(a2, -kPointerSize));
-    __ Sd(at, MemOperand(a2));
+    __ Ld(kScratchReg, MemOperand(a2, -kPointerSize));
+    __ Sd(kScratchReg, MemOperand(a2));
     __ Dsubu(a2, a2, Operand(kPointerSize));
     __ Branch(&loop, ne, a2, Operand(sp));
     // Adjust the actual number of arguments and remove the top element
@@ -1905,8 +1566,7 @@ void Builtins::Generate_ReflectConstruct(MacroAssembler* masm) {
 }
 
 static void EnterArgumentsAdaptorFrame(MacroAssembler* masm) {
-  // __ sll(a0, a0, kSmiTagSize);
-  __ dsll32(a0, a0, 0);
+  __ SmiTag(a0);
   __ li(a4, Operand(StackFrame::TypeToMarker(StackFrame::ARGUMENTS_ADAPTOR)));
   __ MultiPush(a0.bit() | a1.bit() | a4.bit() | fp.bit() | ra.bit());
   __ Push(Smi::kZero);  // Padding.
@@ -1939,7 +1599,20 @@ void Builtins::Generate_CallOrConstructVarargs(MacroAssembler* masm,
   //  -- a4 : len (number of elements to push from args)
   //  -- a3 : new.target (for [[Construct]])
   // -----------------------------------
-  __ AssertFixedArray(a2);
+  if (masm->emit_debug_code()) {
+    // Allow a2 to be a FixedArray, or a FixedDoubleArray if a4 == 0.
+    Label ok, fail;
+    __ AssertNotSmi(a2);
+    __ GetObjectType(a2, t8, t8);
+    __ Branch(&ok, eq, t8, Operand(FIXED_ARRAY_TYPE));
+    __ Branch(&fail, ne, t8, Operand(FIXED_DOUBLE_ARRAY_TYPE));
+    __ Branch(&ok, eq, a4, Operand(zero_reg));
+    // Fall through.
+    __ bind(&fail);
+    __ Abort(AbortReason::kOperandIsNotAFixedArray);
+
+    __ bind(&ok);
+  }
 
   Register args = a2;
   Register len = a4;
@@ -1954,8 +1627,8 @@ void Builtins::Generate_CallOrConstructVarargs(MacroAssembler* masm,
     // here which will cause ip to become negative.
     __ Dsubu(a5, sp, a5);
     // Check if the arguments will overflow the stack.
-    __ dsll(at, len, kPointerSizeLog2);
-    __ Branch(&done, gt, a5, Operand(at));  // Signed comparison.
+    __ dsll(kScratchReg, len, kPointerSizeLog2);
+    __ Branch(&done, gt, a5, Operand(kScratchReg));  // Signed comparison.
     __ TailCallRuntime(Runtime::kThrowStackOverflow);
     __ bind(&done);
   }
@@ -2025,16 +1698,16 @@ void Builtins::Generate_CallOrConstructForwardVarargs(MacroAssembler* masm,
   {
     __ Ld(a7, MemOperand(fp, JavaScriptFrameConstants::kFunctionOffset));
     __ Ld(a7, FieldMemOperand(a7, JSFunction::kSharedFunctionInfoOffset));
-    __ Lw(a7,
-          FieldMemOperand(a7, SharedFunctionInfo::kFormalParameterCountOffset));
+    __ Lhu(a7, FieldMemOperand(
+                   a7, SharedFunctionInfo::kFormalParameterCountOffset));
     __ mov(a6, fp);
   }
   __ Branch(&arguments_done);
   __ bind(&arguments_adaptor);
   {
     // Just get the length from the ArgumentsAdaptorFrame.
-    __ Lw(a7, UntagSmiMemOperand(
-                  a6, ArgumentsAdaptorFrameConstants::kLengthOffset));
+    __ SmiUntag(a7,
+                MemOperand(a6, ArgumentsAdaptorFrameConstants::kLengthOffset));
   }
   __ bind(&arguments_done);
 
@@ -2051,9 +1724,9 @@ void Builtins::Generate_CallOrConstructForwardVarargs(MacroAssembler* masm,
       __ Daddu(a0, a0, a7);
       __ bind(&loop);
       {
-        __ Dlsa(at, a6, a7, kPointerSizeLog2);
-        __ Ld(at, MemOperand(at, 1 * kPointerSize));
-        __ push(at);
+        __ Dlsa(kScratchReg, a6, a7, kPointerSizeLog2);
+        __ Ld(kScratchReg, MemOperand(kScratchReg, 1 * kPointerSize));
+        __ push(kScratchReg);
         __ Subu(a7, a7, Operand(1));
         __ Branch(&loop, ne, a7, Operand(zero_reg));
       }
@@ -2082,8 +1755,9 @@ void Builtins::Generate_CallFunction(MacroAssembler* masm,
   Label class_constructor;
   __ Ld(a2, FieldMemOperand(a1, JSFunction::kSharedFunctionInfoOffset));
   __ Lwu(a3, FieldMemOperand(a2, SharedFunctionInfo::kFlagsOffset));
-  __ And(at, a3, Operand(SharedFunctionInfo::IsClassConstructorBit::kMask));
-  __ Branch(&class_constructor, ne, at, Operand(zero_reg));
+  __ And(kScratchReg, a3,
+         Operand(SharedFunctionInfo::IsClassConstructorBit::kMask));
+  __ Branch(&class_constructor, ne, kScratchReg, Operand(zero_reg));
 
   // Enter the context of the function; ToObject has to run in the function
   // context, and we also need to take the global proxy from the function
@@ -2092,10 +1766,10 @@ void Builtins::Generate_CallFunction(MacroAssembler* masm,
   // We need to convert the receiver for non-native sloppy mode functions.
   Label done_convert;
   __ Lwu(a3, FieldMemOperand(a2, SharedFunctionInfo::kFlagsOffset));
-  __ And(at, a3,
+  __ And(kScratchReg, a3,
          Operand(SharedFunctionInfo::IsNativeBit::kMask |
                  SharedFunctionInfo::IsStrictBit::kMask));
-  __ Branch(&done_convert, ne, at, Operand(zero_reg));
+  __ Branch(&done_convert, ne, kScratchReg, Operand(zero_reg));
   {
     // ----------- S t a t e -------------
     //  -- a0 : the number of arguments (not including the receiver)
@@ -2109,8 +1783,8 @@ void Builtins::Generate_CallFunction(MacroAssembler* masm,
       __ LoadGlobalProxy(a3);
     } else {
       Label convert_to_object, convert_receiver;
-      __ Dlsa(at, sp, a0, kPointerSizeLog2);
-      __ Ld(a3, MemOperand(at));
+      __ Dlsa(kScratchReg, sp, a0, kPointerSizeLog2);
+      __ Ld(a3, MemOperand(kScratchReg));
       __ JumpIfSmi(a3, &convert_to_object);
       STATIC_ASSERT(LAST_JS_RECEIVER_TYPE == LAST_TYPE);
       __ GetObjectType(a3, a4, a4);
@@ -2147,8 +1821,8 @@ void Builtins::Generate_CallFunction(MacroAssembler* masm,
       __ Ld(a2, FieldMemOperand(a1, JSFunction::kSharedFunctionInfoOffset));
       __ bind(&convert_receiver);
     }
-    __ Dlsa(at, sp, a0, kPointerSizeLog2);
-    __ Sd(a3, MemOperand(at));
+    __ Dlsa(kScratchReg, sp, a0, kPointerSizeLog2);
+    __ Sd(a3, MemOperand(kScratchReg));
   }
   __ bind(&done_convert);
 
@@ -2159,8 +1833,8 @@ void Builtins::Generate_CallFunction(MacroAssembler* masm,
   //  -- cp : the function context.
   // -----------------------------------
 
-  __ Lw(a2,
-        FieldMemOperand(a2, SharedFunctionInfo::kFormalParameterCountOffset));
+  __ Lhu(a2,
+         FieldMemOperand(a2, SharedFunctionInfo::kFormalParameterCountOffset));
   ParameterCount actual(a0);
   ParameterCount expected(a2);
   __ InvokeFunctionCode(a1, no_reg, expected, actual, JUMP_FUNCTION);
@@ -2184,14 +1858,14 @@ void Builtins::Generate_CallBoundFunctionImpl(MacroAssembler* masm) {
 
   // Patch the receiver to [[BoundThis]].
   {
-    __ Ld(at, FieldMemOperand(a1, JSBoundFunction::kBoundThisOffset));
+    __ Ld(kScratchReg, FieldMemOperand(a1, JSBoundFunction::kBoundThisOffset));
     __ Dlsa(a4, sp, a0, kPointerSizeLog2);
-    __ Sd(at, MemOperand(a4));
+    __ Sd(kScratchReg, MemOperand(a4));
   }
 
   // Load [[BoundArguments]] into a2 and length of that into a4.
   __ Ld(a2, FieldMemOperand(a1, JSBoundFunction::kBoundArgumentsOffset));
-  __ Lw(a4, UntagSmiFieldMemOperand(a2, FixedArray::kLengthOffset));
+  __ SmiUntag(a4, FieldMemOperand(a2, FixedArray::kLengthOffset));
 
   // ----------- S t a t e -------------
   //  -- a0 : the number of arguments (not including the receiver)
@@ -2207,8 +1881,8 @@ void Builtins::Generate_CallBoundFunctionImpl(MacroAssembler* masm) {
     __ Dsubu(sp, sp, Operand(a5));
     // Check the stack for overflow. We are not trying to catch interruptions
     // (i.e. debug break and preemption) here, so check the "real stack limit".
-    __ LoadRoot(at, Heap::kRealStackLimitRootIndex);
-    __ Branch(&done, gt, sp, Operand(at));  // Signed comparison.
+    __ LoadRoot(kScratchReg, Heap::kRealStackLimitRootIndex);
+    __ Branch(&done, gt, sp, Operand(kScratchReg));  // Signed comparison.
     // Restore the stack pointer.
     __ Daddu(sp, sp, Operand(a5));
     {
@@ -2226,9 +1900,9 @@ void Builtins::Generate_CallBoundFunctionImpl(MacroAssembler* masm) {
     __ bind(&loop);
     __ Branch(&done_loop, gt, a5, Operand(a0));
     __ Dlsa(a6, sp, a4, kPointerSizeLog2);
-    __ Ld(at, MemOperand(a6));
+    __ Ld(kScratchReg, MemOperand(a6));
     __ Dlsa(a6, sp, a5, kPointerSizeLog2);
-    __ Sd(at, MemOperand(a6));
+    __ Sd(kScratchReg, MemOperand(a6));
     __ Daddu(a4, a4, Operand(1));
     __ Daddu(a5, a5, Operand(1));
     __ Branch(&loop);
@@ -2238,15 +1912,15 @@ void Builtins::Generate_CallBoundFunctionImpl(MacroAssembler* masm) {
   // Copy [[BoundArguments]] to the stack (below the arguments).
   {
     Label loop, done_loop;
-    __ Lw(a4, UntagSmiFieldMemOperand(a2, FixedArray::kLengthOffset));
+    __ SmiUntag(a4, FieldMemOperand(a2, FixedArray::kLengthOffset));
     __ Daddu(a2, a2, Operand(FixedArray::kHeaderSize - kHeapObjectTag));
     __ bind(&loop);
     __ Dsubu(a4, a4, Operand(1));
     __ Branch(&done_loop, lt, a4, Operand(zero_reg));
     __ Dlsa(a5, a2, a4, kPointerSizeLog2);
-    __ Ld(at, MemOperand(a5));
+    __ Ld(kScratchReg, MemOperand(a5));
     __ Dlsa(a5, sp, a0, kPointerSizeLog2);
-    __ Sd(at, MemOperand(a5));
+    __ Sd(kScratchReg, MemOperand(a5));
     __ Daddu(a0, a0, Operand(1));
     __ Branch(&loop);
     __ bind(&done_loop);
@@ -2286,8 +1960,8 @@ void Builtins::Generate_Call(MacroAssembler* masm, ConvertReceiverMode mode) {
   // not we raise an exception).
   __ bind(&non_function);
   // Overwrite the original receiver with the (original) target.
-  __ Dlsa(at, sp, a0, kPointerSizeLog2);
-  __ Sd(a1, MemOperand(at));
+  __ Dlsa(kScratchReg, sp, a0, kPointerSizeLog2);
+  __ Sd(a1, MemOperand(kScratchReg));
   // Let the "call_as_function_delegate" take care of the rest.
   __ LoadNativeContextSlot(Context::CALL_AS_FUNCTION_DELEGATE_INDEX, a1);
   __ Jump(masm->isolate()->builtins()->CallFunction(
@@ -2328,7 +2002,7 @@ void Builtins::Generate_ConstructFunction(MacroAssembler* masm) {
           RelocInfo::CODE_TARGET);
 
   __ bind(&call_generic_stub);
-  __ Jump(masm->isolate()->builtins()->JSConstructStubGeneric(),
+  __ Jump(BUILTIN_CODE(masm->isolate(), JSConstructStubGeneric),
           RelocInfo::CODE_TARGET);
 }
 
@@ -2344,7 +2018,7 @@ void Builtins::Generate_ConstructBoundFunction(MacroAssembler* masm) {
 
   // Load [[BoundArguments]] into a2 and length of that into a4.
   __ Ld(a2, FieldMemOperand(a1, JSBoundFunction::kBoundArgumentsOffset));
-  __ Lw(a4, UntagSmiFieldMemOperand(a2, FixedArray::kLengthOffset));
+  __ SmiUntag(a4, FieldMemOperand(a2, FixedArray::kLengthOffset));
 
   // ----------- S t a t e -------------
   //  -- a0 : the number of arguments (not including the receiver)
@@ -2361,8 +2035,8 @@ void Builtins::Generate_ConstructBoundFunction(MacroAssembler* masm) {
     __ Dsubu(sp, sp, Operand(a5));
     // Check the stack for overflow. We are not trying to catch interruptions
     // (i.e. debug break and preemption) here, so check the "real stack limit".
-    __ LoadRoot(at, Heap::kRealStackLimitRootIndex);
-    __ Branch(&done, gt, sp, Operand(at));  // Signed comparison.
+    __ LoadRoot(kScratchReg, Heap::kRealStackLimitRootIndex);
+    __ Branch(&done, gt, sp, Operand(kScratchReg));  // Signed comparison.
     // Restore the stack pointer.
     __ Daddu(sp, sp, Operand(a5));
     {
@@ -2380,9 +2054,9 @@ void Builtins::Generate_ConstructBoundFunction(MacroAssembler* masm) {
     __ bind(&loop);
     __ Branch(&done_loop, ge, a5, Operand(a0));
     __ Dlsa(a6, sp, a4, kPointerSizeLog2);
-    __ Ld(at, MemOperand(a6));
+    __ Ld(kScratchReg, MemOperand(a6));
     __ Dlsa(a6, sp, a5, kPointerSizeLog2);
-    __ Sd(at, MemOperand(a6));
+    __ Sd(kScratchReg, MemOperand(a6));
     __ Daddu(a4, a4, Operand(1));
     __ Daddu(a5, a5, Operand(1));
     __ Branch(&loop);
@@ -2392,15 +2066,15 @@ void Builtins::Generate_ConstructBoundFunction(MacroAssembler* masm) {
   // Copy [[BoundArguments]] to the stack (below the arguments).
   {
     Label loop, done_loop;
-    __ Lw(a4, UntagSmiFieldMemOperand(a2, FixedArray::kLengthOffset));
+    __ SmiUntag(a4, FieldMemOperand(a2, FixedArray::kLengthOffset));
     __ Daddu(a2, a2, Operand(FixedArray::kHeaderSize - kHeapObjectTag));
     __ bind(&loop);
     __ Dsubu(a4, a4, Operand(1));
     __ Branch(&done_loop, lt, a4, Operand(zero_reg));
     __ Dlsa(a5, a2, a4, kPointerSizeLog2);
-    __ Ld(at, MemOperand(a5));
+    __ Ld(kScratchReg, MemOperand(a5));
     __ Dlsa(a5, sp, a0, kPointerSizeLog2);
-    __ Sd(at, MemOperand(a5));
+    __ Sd(kScratchReg, MemOperand(a5));
     __ Daddu(a0, a0, Operand(1));
     __ Branch(&loop);
     __ bind(&done_loop);
@@ -2457,8 +2131,8 @@ void Builtins::Generate_Construct(MacroAssembler* masm) {
   __ bind(&non_proxy);
   {
     // Overwrite the original receiver with the (original) target.
-    __ Dlsa(at, sp, a0, kPointerSizeLog2);
-    __ Sd(a1, MemOperand(at));
+    __ Dlsa(kScratchReg, sp, a0, kPointerSizeLog2);
+    __ Sd(a1, MemOperand(kScratchReg));
     // Let the "call_as_constructor_delegate" take care of the rest.
     __ LoadNativeContextSlot(Context::CALL_AS_CONSTRUCTOR_DELEGATE_INDEX, a1);
     __ Jump(masm->isolate()->builtins()->CallFunction(),
@@ -2472,42 +2146,6 @@ void Builtins::Generate_Construct(MacroAssembler* masm) {
           RelocInfo::CODE_TARGET);
 }
 
-// static
-void Builtins::Generate_AllocateInNewSpace(MacroAssembler* masm) {
-  // ----------- S t a t e -------------
-  //  -- a0 : requested object size (untagged)
-  //  -- ra : return address
-  // -----------------------------------
-  __ SmiTag(a0);
-  __ Push(a0);
-  __ Move(cp, Smi::kZero);
-  __ TailCallRuntime(Runtime::kAllocateInNewSpace);
-}
-
-// static
-void Builtins::Generate_AllocateInOldSpace(MacroAssembler* masm) {
-  // ----------- S t a t e -------------
-  //  -- a0 : requested object size (untagged)
-  //  -- ra : return address
-  // -----------------------------------
-  __ SmiTag(a0);
-  __ Move(a1, Smi::FromInt(AllocateTargetSpace::encode(OLD_SPACE)));
-  __ Push(a0, a1);
-  __ Move(cp, Smi::kZero);
-  __ TailCallRuntime(Runtime::kAllocateInTargetSpace);
-}
-
-// static
-void Builtins::Generate_Abort(MacroAssembler* masm) {
-  // ----------- S t a t e -------------
-  //  -- a0 : message_id as Smi
-  //  -- ra : return address
-  // -----------------------------------
-  __ Push(a0);
-  __ Move(cp, Smi::kZero);
-  __ TailCallRuntime(Runtime::kAbort);
-}
-
 void Builtins::Generate_ArgumentsAdaptorTrampoline(MacroAssembler* masm) {
   // State setup as expected by MacroAssembler::InvokePrologue.
   // ----------- S t a t e -------------
@@ -2532,7 +2170,7 @@ void Builtins::Generate_ArgumentsAdaptorTrampoline(MacroAssembler* masm) {
     // a3: new target (passed through to callee)
     __ bind(&enough);
     EnterArgumentsAdaptorFrame(masm);
-    Generate_StackOverflowCheck(masm, a2, a5, at, &stack_overflow);
+    Generate_StackOverflowCheck(masm, a2, a5, kScratchReg, &stack_overflow);
 
     // Calculate copy start address into a0 and copy end address into a4.
     __ SmiScale(a0, a0, kPointerSizeLog2);
@@ -2563,7 +2201,7 @@ void Builtins::Generate_ArgumentsAdaptorTrampoline(MacroAssembler* masm) {
   {  // Too few parameters: Actual < expected.
     __ bind(&too_few);
     EnterArgumentsAdaptorFrame(masm);
-    Generate_StackOverflowCheck(masm, a2, a5, at, &stack_overflow);
+    Generate_StackOverflowCheck(masm, a2, a5, kScratchReg, &stack_overflow);
 
     // Calculate copy start address into a0 and copy end address into a7.
     // a0: actual number of arguments as a smi
@@ -2646,28 +2284,33 @@ void Builtins::Generate_ArgumentsAdaptorTrampoline(MacroAssembler* masm) {
 }
 
 void Builtins::Generate_WasmCompileLazy(MacroAssembler* masm) {
+  // The function index was put in t0 by the jump table trampoline.
+  // Convert to Smi for the runtime call
+  __ SmiTag(t0);
   {
-    FrameScope scope(masm, StackFrame::INTERNAL);
-
-    auto wasm_instance_reg = a0;  // TODO(titzer): put in a common place.
+    TrapOnAbortScope trap_on_abort_scope(masm);  // Avoid calls to Abort.
+    FrameScope scope(masm, StackFrame::WASM_COMPILE_LAZY);
 
     // Save all parameter registers (see wasm-linkage.cc). They might be
     // overwritten in the runtime call below. We don't have any callee-saved
     // registers in wasm, so no need to store anything else.
-    constexpr RegList gp_regs = Register::ListOf<a1, a2, a3, a4, a5, a6, a7>();
+    constexpr RegList gp_regs =
+        Register::ListOf<a0, a1, a2, a3, a4, a5, a6, a7>();
     constexpr RegList fp_regs =
         DoubleRegister::ListOf<f2, f4, f6, f8, f10, f12, f14>();
     __ MultiPush(gp_regs);
     __ MultiPushFPU(fp_regs);
 
-    // Pass the WASM instance as an explicit argument to WasmCompileLazy.
-    __ push(wasm_instance_reg);
-    // Initialize the JavaScript context with 0. CEntryStub will use it to
+    // Pass instance and function index as an explicit arguments to the runtime
+    // function.
+    __ Push(kWasmInstanceRegister, t0);
+    // Load the correct CEntry builtin from the instance object.
+    __ Ld(a2, FieldMemOperand(kWasmInstanceRegister,
+                              WasmInstanceObject::kCEntryStubOffset));
+    // Initialize the JavaScript context with 0. CEntry will use it to
     // set the current context on the isolate.
     __ Move(kContextRegister, Smi::kZero);
-    __ CallRuntime(Runtime::kWasmCompileLazy);
-    // The WASM instance is the second return value.
-    __ mov(wasm_instance_reg, kReturnRegister1);
+    __ CallRuntimeWithCEntry(Runtime::kWasmCompileLazy, a2);
 
     // Restore registers.
     __ MultiPopFPU(fp_regs);
@@ -2677,6 +2320,485 @@ void Builtins::Generate_WasmCompileLazy(MacroAssembler* masm) {
   __ Jump(v0);
 }
 
+void Builtins::Generate_CEntry(MacroAssembler* masm, int result_size,
+                               SaveFPRegsMode save_doubles, ArgvMode argv_mode,
+                               bool builtin_exit_frame) {
+  // Called from JavaScript; parameters are on stack as if calling JS function
+  // a0: number of arguments including receiver
+  // a1: pointer to builtin function
+  // fp: frame pointer    (restored after C call)
+  // sp: stack pointer    (restored as callee's sp after C call)
+  // cp: current context  (C callee-saved)
+  //
+  // If argv_mode == kArgvInRegister:
+  // a2: pointer to the first argument
+
+  ProfileEntryHookStub::MaybeCallEntryHook(masm);
+
+  if (argv_mode == kArgvInRegister) {
+    // Move argv into the correct register.
+    __ mov(s1, a2);
+  } else {
+    // Compute the argv pointer in a callee-saved register.
+    __ Dlsa(s1, sp, a0, kPointerSizeLog2);
+    __ Dsubu(s1, s1, kPointerSize);
+  }
+
+  // Enter the exit frame that transitions from JavaScript to C++.
+  FrameScope scope(masm, StackFrame::MANUAL);
+  __ EnterExitFrame(
+      save_doubles == kSaveFPRegs, 0,
+      builtin_exit_frame ? StackFrame::BUILTIN_EXIT : StackFrame::EXIT);
+
+  // s0: number of arguments  including receiver (C callee-saved)
+  // s1: pointer to first argument (C callee-saved)
+  // s2: pointer to builtin function (C callee-saved)
+
+  // Prepare arguments for C routine.
+  // a0 = argc
+  __ mov(s0, a0);
+  __ mov(s2, a1);
+
+  // We are calling compiled C/C++ code. a0 and a1 hold our two arguments. We
+  // also need to reserve the 4 argument slots on the stack.
+
+  __ AssertStackIsAligned();
+
+  // a0 = argc, a1 = argv, a2 = isolate
+  __ li(a2, ExternalReference::isolate_address(masm->isolate()));
+  __ mov(a1, s1);
+
+  // To let the GC traverse the return address of the exit frames, we need to
+  // know where the return address is. The CEntry is unmovable, so
+  // we can store the address on the stack to be able to find it again and
+  // we never have to restore it, because it will not change.
+  {
+    Assembler::BlockTrampolinePoolScope block_trampoline_pool(masm);
+    int kNumInstructionsToJump = 4;
+    Label find_ra;
+    // Adjust the value in ra to point to the correct return location, 2nd
+    // instruction past the real call into C code (the jalr(t9)), and push it.
+    // This is the return address of the exit frame.
+    if (kArchVariant >= kMips64r6) {
+      __ addiupc(ra, kNumInstructionsToJump + 1);
+    } else {
+      // This branch-and-link sequence is needed to find the current PC on mips
+      // before r6, saved to the ra register.
+      __ bal(&find_ra);  // bal exposes branch delay slot.
+      __ Daddu(ra, ra, kNumInstructionsToJump * Instruction::kInstrSize);
+    }
+    __ bind(&find_ra);
+
+    // This spot was reserved in EnterExitFrame.
+    __ Sd(ra, MemOperand(sp));
+    // Stack space reservation moved to the branch delay slot below.
+    // Stack is still aligned.
+
+    // Call the C routine.
+    __ mov(t9, s2);  // Function pointer to t9 to conform to ABI for PIC.
+    __ jalr(t9);
+    // Set up sp in the delay slot.
+    __ daddiu(sp, sp, -kCArgsSlotsSize);
+    // Make sure the stored 'ra' points to this position.
+    DCHECK_EQ(kNumInstructionsToJump,
+              masm->InstructionsGeneratedSince(&find_ra));
+  }
+
+  // Result returned in v0 or v1:v0 - do not destroy these registers!
+
+  // Check result for exception sentinel.
+  Label exception_returned;
+  __ LoadRoot(a4, Heap::kExceptionRootIndex);
+  __ Branch(&exception_returned, eq, a4, Operand(v0));
+
+  // Check that there is no pending exception, otherwise we
+  // should have returned the exception sentinel.
+  if (FLAG_debug_code) {
+    Label okay;
+    ExternalReference pending_exception_address = ExternalReference::Create(
+        IsolateAddressId::kPendingExceptionAddress, masm->isolate());
+    __ li(a2, pending_exception_address);
+    __ Ld(a2, MemOperand(a2));
+    __ LoadRoot(a4, Heap::kTheHoleValueRootIndex);
+    // Cannot use check here as it attempts to generate call into runtime.
+    __ Branch(&okay, eq, a4, Operand(a2));
+    __ stop("Unexpected pending exception");
+    __ bind(&okay);
+  }
+
+  // Exit C frame and return.
+  // v0:v1: result
+  // sp: stack pointer
+  // fp: frame pointer
+  Register argc = argv_mode == kArgvInRegister
+                      // We don't want to pop arguments so set argc to no_reg.
+                      ? no_reg
+                      // s0: still holds argc (callee-saved).
+                      : s0;
+  __ LeaveExitFrame(save_doubles == kSaveFPRegs, argc, EMIT_RETURN);
+
+  // Handling of exception.
+  __ bind(&exception_returned);
+
+  ExternalReference pending_handler_context_address = ExternalReference::Create(
+      IsolateAddressId::kPendingHandlerContextAddress, masm->isolate());
+  ExternalReference pending_handler_entrypoint_address =
+      ExternalReference::Create(
+          IsolateAddressId::kPendingHandlerEntrypointAddress, masm->isolate());
+  ExternalReference pending_handler_fp_address = ExternalReference::Create(
+      IsolateAddressId::kPendingHandlerFPAddress, masm->isolate());
+  ExternalReference pending_handler_sp_address = ExternalReference::Create(
+      IsolateAddressId::kPendingHandlerSPAddress, masm->isolate());
+
+  // Ask the runtime for help to determine the handler. This will set v0 to
+  // contain the current pending exception, don't clobber it.
+  ExternalReference find_handler =
+      ExternalReference::Create(Runtime::kUnwindAndFindExceptionHandler);
+  {
+    FrameScope scope(masm, StackFrame::MANUAL);
+    __ PrepareCallCFunction(3, 0, a0);
+    __ mov(a0, zero_reg);
+    __ mov(a1, zero_reg);
+    __ li(a2, ExternalReference::isolate_address(masm->isolate()));
+    __ CallCFunction(find_handler, 3);
+  }
+
+  // Retrieve the handler context, SP and FP.
+  __ li(cp, pending_handler_context_address);
+  __ Ld(cp, MemOperand(cp));
+  __ li(sp, pending_handler_sp_address);
+  __ Ld(sp, MemOperand(sp));
+  __ li(fp, pending_handler_fp_address);
+  __ Ld(fp, MemOperand(fp));
+
+  // If the handler is a JS frame, restore the context to the frame. Note that
+  // the context will be set to (cp == 0) for non-JS frames.
+  Label zero;
+  __ Branch(&zero, eq, cp, Operand(zero_reg));
+  __ Sd(cp, MemOperand(fp, StandardFrameConstants::kContextOffset));
+  __ bind(&zero);
+
+  // Reset the masking register. This is done independent of the underlying
+  // feature flag {FLAG_branch_load_poisoning} to make the snapshot work with
+  // both configurations. It is safe to always do this, because the underlying
+  // register is caller-saved and can be arbitrarily clobbered.
+  __ ResetSpeculationPoisonRegister();
+
+  // Compute the handler entry address and jump to it.
+  __ li(t9, pending_handler_entrypoint_address);
+  __ Ld(t9, MemOperand(t9));
+  __ Jump(t9);
+}
+
+void Builtins::Generate_DoubleToI(MacroAssembler* masm) {
+  Label out_of_range, only_low, negate, done;
+  Register result_reg = t0;
+
+  Register scratch = GetRegisterThatIsNotOneOf(result_reg);
+  Register scratch2 = GetRegisterThatIsNotOneOf(result_reg, scratch);
+  Register scratch3 = GetRegisterThatIsNotOneOf(result_reg, scratch, scratch2);
+  DoubleRegister double_scratch = kScratchDoubleReg;
+
+  // Account for saved regs.
+  const int kArgumentOffset = 4 * kPointerSize;
+
+  __ Push(result_reg);
+  __ Push(scratch, scratch2, scratch3);
+
+  // Load double input.
+  __ Ldc1(double_scratch, MemOperand(sp, kArgumentOffset));
+
+  // Clear cumulative exception flags and save the FCSR.
+  __ cfc1(scratch2, FCSR);
+  __ ctc1(zero_reg, FCSR);
+
+  // Try a conversion to a signed integer.
+  __ Trunc_w_d(double_scratch, double_scratch);
+  // Move the converted value into the result register.
+  __ mfc1(scratch3, double_scratch);
+
+  // Retrieve and restore the FCSR.
+  __ cfc1(scratch, FCSR);
+  __ ctc1(scratch2, FCSR);
+
+  // Check for overflow and NaNs.
+  __ And(
+      scratch, scratch,
+      kFCSROverflowFlagMask | kFCSRUnderflowFlagMask | kFCSRInvalidOpFlagMask);
+  // If we had no exceptions then set result_reg and we are done.
+  Label error;
+  __ Branch(&error, ne, scratch, Operand(zero_reg));
+  __ Move(result_reg, scratch3);
+  __ Branch(&done);
+  __ bind(&error);
+
+  // Load the double value and perform a manual truncation.
+  Register input_high = scratch2;
+  Register input_low = scratch3;
+
+  __ Lw(input_low, MemOperand(sp, kArgumentOffset + Register::kMantissaOffset));
+  __ Lw(input_high,
+        MemOperand(sp, kArgumentOffset + Register::kExponentOffset));
+
+  Label normal_exponent, restore_sign;
+  // Extract the biased exponent in result.
+  __ Ext(result_reg, input_high, HeapNumber::kExponentShift,
+         HeapNumber::kExponentBits);
+
+  // Check for Infinity and NaNs, which should return 0.
+  __ Subu(scratch, result_reg, HeapNumber::kExponentMask);
+  __ Movz(result_reg, zero_reg, scratch);
+  __ Branch(&done, eq, scratch, Operand(zero_reg));
+
+  // Express exponent as delta to (number of mantissa bits + 31).
+  __ Subu(result_reg, result_reg,
+          Operand(HeapNumber::kExponentBias + HeapNumber::kMantissaBits + 31));
+
+  // If the delta is strictly positive, all bits would be shifted away,
+  // which means that we can return 0.
+  __ Branch(&normal_exponent, le, result_reg, Operand(zero_reg));
+  __ mov(result_reg, zero_reg);
+  __ Branch(&done);
+
+  __ bind(&normal_exponent);
+  const int kShiftBase = HeapNumber::kNonMantissaBitsInTopWord - 1;
+  // Calculate shift.
+  __ Addu(scratch, result_reg, Operand(kShiftBase + HeapNumber::kMantissaBits));
+
+  // Save the sign.
+  Register sign = result_reg;
+  result_reg = no_reg;
+  __ And(sign, input_high, Operand(HeapNumber::kSignMask));
+
+  // On ARM shifts > 31 bits are valid and will result in zero. On MIPS we need
+  // to check for this specific case.
+  Label high_shift_needed, high_shift_done;
+  __ Branch(&high_shift_needed, lt, scratch, Operand(32));
+  __ mov(input_high, zero_reg);
+  __ Branch(&high_shift_done);
+  __ bind(&high_shift_needed);
+
+  // Set the implicit 1 before the mantissa part in input_high.
+  __ Or(input_high, input_high,
+        Operand(1 << HeapNumber::kMantissaBitsInTopWord));
+  // Shift the mantissa bits to the correct position.
+  // We don't need to clear non-mantissa bits as they will be shifted away.
+  // If they weren't, it would mean that the answer is in the 32bit range.
+  __ sllv(input_high, input_high, scratch);
+
+  __ bind(&high_shift_done);
+
+  // Replace the shifted bits with bits from the lower mantissa word.
+  Label pos_shift, shift_done;
+  __ li(kScratchReg, 32);
+  __ subu(scratch, kScratchReg, scratch);
+  __ Branch(&pos_shift, ge, scratch, Operand(zero_reg));
+
+  // Negate scratch.
+  __ Subu(scratch, zero_reg, scratch);
+  __ sllv(input_low, input_low, scratch);
+  __ Branch(&shift_done);
+
+  __ bind(&pos_shift);
+  __ srlv(input_low, input_low, scratch);
+
+  __ bind(&shift_done);
+  __ Or(input_high, input_high, Operand(input_low));
+  // Restore sign if necessary.
+  __ mov(scratch, sign);
+  result_reg = sign;
+  sign = no_reg;
+  __ Subu(result_reg, zero_reg, input_high);
+  __ Movz(result_reg, input_high, scratch);
+
+  __ bind(&done);
+
+  __ Sd(result_reg, MemOperand(sp, kArgumentOffset));
+  __ Pop(scratch, scratch2, scratch3);
+  __ Pop(result_reg);
+  __ Ret();
+}
+
+void Builtins::Generate_MathPowInternal(MacroAssembler* masm) {
+  const Register exponent = a2;
+  const DoubleRegister double_base = f2;
+  const DoubleRegister double_exponent = f4;
+  const DoubleRegister double_result = f0;
+  const DoubleRegister double_scratch = f6;
+  const FPURegister single_scratch = f8;
+  const Register scratch = t1;
+  const Register scratch2 = a7;
+
+  Label call_runtime, done, int_exponent;
+
+  Label int_exponent_convert;
+  // Detect integer exponents stored as double.
+  __ EmitFPUTruncate(kRoundToMinusInf, scratch, double_exponent, kScratchReg,
+                     double_scratch, scratch2, kCheckForInexactConversion);
+  // scratch2 == 0 means there was no conversion error.
+  __ Branch(&int_exponent_convert, eq, scratch2, Operand(zero_reg));
+
+  __ push(ra);
+  {
+    AllowExternalCallThatCantCauseGC scope(masm);
+    __ PrepareCallCFunction(0, 2, scratch2);
+    __ MovToFloatParameters(double_base, double_exponent);
+    __ CallCFunction(ExternalReference::power_double_double_function(), 0, 2);
+  }
+  __ pop(ra);
+  __ MovFromFloatResult(double_result);
+  __ jmp(&done);
+
+  __ bind(&int_exponent_convert);
+
+  // Calculate power with integer exponent.
+  __ bind(&int_exponent);
+
+  // Get two copies of exponent in the registers scratch and exponent.
+  // Exponent has previously been stored into scratch as untagged integer.
+  __ mov(exponent, scratch);
+
+  __ mov_d(double_scratch, double_base);  // Back up base.
+  __ Move(double_result, 1.0);
+
+  // Get absolute value of exponent.
+  Label positive_exponent, bail_out;
+  __ Branch(&positive_exponent, ge, scratch, Operand(zero_reg));
+  __ Dsubu(scratch, zero_reg, scratch);
+  // Check when Dsubu overflows and we get negative result
+  // (happens only when input is MIN_INT).
+  __ Branch(&bail_out, gt, zero_reg, Operand(scratch));
+  __ bind(&positive_exponent);
+  __ Assert(ge, AbortReason::kUnexpectedNegativeValue, scratch,
+            Operand(zero_reg));
+
+  Label while_true, no_carry, loop_end;
+  __ bind(&while_true);
+
+  __ And(scratch2, scratch, 1);
+
+  __ Branch(&no_carry, eq, scratch2, Operand(zero_reg));
+  __ mul_d(double_result, double_result, double_scratch);
+  __ bind(&no_carry);
+
+  __ dsra(scratch, scratch, 1);
+
+  __ Branch(&loop_end, eq, scratch, Operand(zero_reg));
+  __ mul_d(double_scratch, double_scratch, double_scratch);
+
+  __ Branch(&while_true);
+
+  __ bind(&loop_end);
+
+  __ Branch(&done, ge, exponent, Operand(zero_reg));
+  __ Move(double_scratch, 1.0);
+  __ div_d(double_result, double_scratch, double_result);
+  // Test whether result is zero.  Bail out to check for subnormal result.
+  // Due to subnormals, x^-y == (1/x)^y does not hold in all cases.
+  __ CompareF64(EQ, double_result, kDoubleRegZero);
+  __ BranchFalseShortF(&done);
+
+  // double_exponent may not contain the exponent value if the input was a
+  // smi.  We set it with exponent value before bailing out.
+  __ bind(&bail_out);
+  __ mtc1(exponent, single_scratch);
+  __ cvt_d_w(double_exponent, single_scratch);
+
+  // Returning or bailing out.
+  __ push(ra);
+  {
+    AllowExternalCallThatCantCauseGC scope(masm);
+    __ PrepareCallCFunction(0, 2, scratch);
+    __ MovToFloatParameters(double_base, double_exponent);
+    __ CallCFunction(ExternalReference::power_double_double_function(), 0, 2);
+  }
+  __ pop(ra);
+  __ MovFromFloatResult(double_result);
+
+  __ bind(&done);
+  __ Ret();
+}
+
+namespace {
+
+void GenerateInternalArrayConstructorCase(MacroAssembler* masm,
+                                          ElementsKind kind) {
+  __ Jump(CodeFactory::InternalArrayNoArgumentConstructor(masm->isolate(), kind)
+              .code(),
+          RelocInfo::CODE_TARGET, lo, a0, Operand(1));
+
+  __ Jump(BUILTIN_CODE(masm->isolate(), ArrayNArgumentsConstructor),
+          RelocInfo::CODE_TARGET, hi, a0, Operand(1));
+
+  if (IsFastPackedElementsKind(kind)) {
+    // We might need to create a holey array
+    // look at the first argument.
+    __ Ld(kScratchReg, MemOperand(sp, 0));
+
+    __ Jump(CodeFactory::InternalArraySingleArgumentConstructor(
+                masm->isolate(), GetHoleyElementsKind(kind))
+                .code(),
+            RelocInfo::CODE_TARGET, ne, kScratchReg, Operand(zero_reg));
+  }
+
+  __ Jump(
+      CodeFactory::InternalArraySingleArgumentConstructor(masm->isolate(), kind)
+          .code(),
+      RelocInfo::CODE_TARGET);
+}
+
+}  // namespace
+
+void Builtins::Generate_InternalArrayConstructorImpl(MacroAssembler* masm) {
+  // ----------- S t a t e -------------
+  //  -- a0 : argc
+  //  -- a1 : constructor
+  //  -- sp[0] : return address
+  //  -- sp[4] : last argument
+  // -----------------------------------
+
+  if (FLAG_debug_code) {
+    // The array construct code is only set for the global and natives
+    // builtin Array functions which always have maps.
+
+    // Initial map for the builtin Array function should be a map.
+    __ Ld(a3, FieldMemOperand(a1, JSFunction::kPrototypeOrInitialMapOffset));
+    // Will both indicate a nullptr and a Smi.
+    __ SmiTst(a3, kScratchReg);
+    __ Assert(ne, AbortReason::kUnexpectedInitialMapForArrayFunction,
+              kScratchReg, Operand(zero_reg));
+    __ GetObjectType(a3, a3, a4);
+    __ Assert(eq, AbortReason::kUnexpectedInitialMapForArrayFunction, a4,
+              Operand(MAP_TYPE));
+  }
+
+  // Figure out the right elements kind.
+  __ Ld(a3, FieldMemOperand(a1, JSFunction::kPrototypeOrInitialMapOffset));
+
+  // Load the map's "bit field 2" into a3. We only need the first byte,
+  // but the following bit field extraction takes care of that anyway.
+  __ Lbu(a3, FieldMemOperand(a3, Map::kBitField2Offset));
+  // Retrieve elements_kind from bit field 2.
+  __ DecodeField<Map::ElementsKindBits>(a3);
+
+  if (FLAG_debug_code) {
+    Label done;
+    __ Branch(&done, eq, a3, Operand(PACKED_ELEMENTS));
+    __ Assert(
+        eq,
+        AbortReason::kInvalidElementsKindForInternalArrayOrInternalPackedArray,
+        a3, Operand(HOLEY_ELEMENTS));
+    __ bind(&done);
+  }
+
+  Label fast_elements_case;
+  __ Branch(&fast_elements_case, eq, a3, Operand(PACKED_ELEMENTS));
+  GenerateInternalArrayConstructorCase(masm, HOLEY_ELEMENTS);
+
+  __ bind(&fast_elements_case);
+  GenerateInternalArrayConstructorCase(masm, PACKED_ELEMENTS);
+}
+
 #undef __
 
 }  // namespace internal
diff --git a/deps/v8/src/builtins/ppc/builtins-ppc.cc b/deps/v8/src/builtins/ppc/builtins-ppc.cc
index 2989d69a4bbf32..3ba3e99789c7a6 100644
--- a/deps/v8/src/builtins/ppc/builtins-ppc.cc
+++ b/deps/v8/src/builtins/ppc/builtins-ppc.cc
@@ -5,6 +5,7 @@
 #if V8_TARGET_ARCH_PPC
 
 #include "src/assembler-inl.h"
+#include "src/code-factory.h"
 #include "src/code-stubs.h"
 #include "src/debug/debug.h"
 #include "src/deoptimizer.h"
@@ -19,7 +20,7 @@ namespace internal {
 
 void Builtins::Generate_Adaptor(MacroAssembler* masm, Address address,
                                 ExitFrameType exit_frame_type) {
-  __ mov(r15, Operand(ExternalReference(address, masm->isolate())));
+  __ Move(kJavaScriptCallExtraArg1Register, ExternalReference::Create(address));
   if (exit_frame_type == BUILTIN_EXIT) {
     __ Jump(BUILTIN_CODE(masm->isolate(), AdaptorWithBuiltinExitFrame),
             RelocInfo::CODE_TARGET);
@@ -30,57 +31,6 @@ void Builtins::Generate_Adaptor(MacroAssembler* masm, Address address,
   }
 }
 
-namespace {
-
-void AdaptorWithExitFrameType(MacroAssembler* masm,
-                              Builtins::ExitFrameType exit_frame_type) {
-  // ----------- S t a t e -------------
-  //  -- r3                 : number of arguments excluding receiver
-  //  -- r4                 : target
-  //  -- r6                 : new.target
-  //  -- r15                : entry point
-  //  -- sp[0]              : last argument
-  //  -- ...
-  //  -- sp[4 * (argc - 1)] : first argument
-  //  -- sp[4 * argc]       : receiver
-  // -----------------------------------
-  __ AssertFunction(r4);
-
-  // Make sure we operate in the context of the called function (for example
-  // ConstructStubs implemented in C++ will be run in the context of the caller
-  // instead of the callee, due to the way that [[Construct]] is defined for
-  // ordinary functions).
-  __ LoadP(cp, FieldMemOperand(r4, JSFunction::kContextOffset));
-
-  // CEntryStub expects r3 to contain the number of arguments including the
-  // receiver and the extra arguments.
-  __ addi(r3, r3,
-          Operand(BuiltinExitFrameConstants::kNumExtraArgsWithReceiver));
-
-  // Insert extra arguments.
-  __ PushRoot(Heap::kTheHoleValueRootIndex);  // Padding.
-  __ SmiTag(r3);
-  __ Push(r3, r4, r6);
-  __ SmiUntag(r3);
-
-  // Jump to the C entry runtime stub directly here instead of using
-  // JumpToExternalReference. We have already loaded entry point to r15
-  // in Generate_adaptor.
-  __ mr(r4, r15);
-  CEntryStub stub(masm->isolate(), 1, kDontSaveFPRegs, kArgvOnStack,
-                  exit_frame_type == Builtins::BUILTIN_EXIT);
-  __ Jump(stub.GetCode(), RelocInfo::CODE_TARGET);
-}
-}  // namespace
-
-void Builtins::Generate_AdaptorWithExitFrame(MacroAssembler* masm) {
-  AdaptorWithExitFrameType(masm, EXIT);
-}
-
-void Builtins::Generate_AdaptorWithBuiltinExitFrame(MacroAssembler* masm) {
-  AdaptorWithExitFrameType(masm, BUILTIN_EXIT);
-}
-
 void Builtins::Generate_InternalArrayConstructor(MacroAssembler* masm) {
   // ----------- S t a t e -------------
   //  -- r3     : number of arguments
@@ -103,41 +53,8 @@ void Builtins::Generate_InternalArrayConstructor(MacroAssembler* masm) {
   // function.
   // tail call a stub
   __ LoadRoot(r5, Heap::kUndefinedValueRootIndex);
-  InternalArrayConstructorStub stub(masm->isolate());
-  __ TailCallStub(&stub);
-}
-
-void Builtins::Generate_ArrayConstructor(MacroAssembler* masm) {
-  // ----------- S t a t e -------------
-  //  -- r3     : number of arguments
-  //  -- r4     : array function
-  //  -- lr     : return address
-  //  -- sp[...]: constructor arguments
-  // -----------------------------------
-  Label generic_array_code, one_or_more_arguments, two_or_more_arguments;
-
-  if (FLAG_debug_code) {
-    // Initial map for the builtin Array functions should be maps.
-    __ LoadP(r5, FieldMemOperand(r4, JSFunction::kPrototypeOrInitialMapOffset));
-    __ TestIfSmi(r5, r0);
-    __ Assert(ne, AbortReason::kUnexpectedInitialMapForArrayFunction, cr0);
-    __ CompareObjectType(r5, r7, r8, MAP_TYPE);
-    __ Assert(eq, AbortReason::kUnexpectedInitialMapForArrayFunction);
-  }
-
-  // r5 is the AllocationSite - here undefined.
-  __ LoadRoot(r5, Heap::kUndefinedValueRootIndex);
-  // If r6 (new target) is undefined, then this is the 'Call' case, so move
-  // r4 (the constructor) to r6.
-  Label call;
-  __ cmp(r6, r5);
-  __ bne(&call);
-  __ mr(r6, r4);
-
-  // Run the native code for the Array function called as a normal function.
-  __ bind(&call);
-  ArrayConstructorStub stub(masm->isolate());
-  __ TailCallStub(&stub);
+  __ Jump(BUILTIN_CODE(masm->isolate(), InternalArrayConstructorImpl),
+          RelocInfo::CODE_TARGET);
 }
 
 static void GenerateTailCallToReturnedCode(MacroAssembler* masm,
@@ -244,9 +161,10 @@ void Generate_JSBuiltinsConstructStubHelper(MacroAssembler* masm) {
   __ blr();
 }
 
+}  // namespace
+
 // The construct stub for ES5 constructor functions and ES6 class constructors.
-void Generate_JSConstructStubGeneric(MacroAssembler* masm,
-                                     bool restrict_constructor_return) {
+void Builtins::Generate_JSConstructStubGeneric(MacroAssembler* masm) {
   // ----------- S t a t e -------------
   //  --      r3: number of arguments (untagged)
   //  --      r4: constructor function
@@ -380,7 +298,7 @@ void Generate_JSConstructStubGeneric(MacroAssembler* masm,
     // If the result is an object (in the ECMA sense), we should get rid
     // of the receiver and use the result; see ECMA-262 section 13.2.2-7
     // on page 74.
-    Label use_receiver, do_throw, other_result, leave_frame;
+    Label use_receiver, do_throw, leave_frame;
 
     // If the result is undefined, we jump out to using the implicit receiver.
     __ JumpIfRoot(r3, Heap::kUndefinedValueRootIndex, &use_receiver);
@@ -389,33 +307,17 @@ void Generate_JSConstructStubGeneric(MacroAssembler* masm,
     // is a valid receiver.
 
     // If the result is a smi, it is *not* an object in the ECMA sense.
-    __ JumpIfSmi(r3, &other_result);
+    __ JumpIfSmi(r3, &use_receiver);
 
     // If the type of the result (stored in its map) is less than
     // FIRST_JS_RECEIVER_TYPE, it is not an object in the ECMA sense.
     STATIC_ASSERT(LAST_JS_RECEIVER_TYPE == LAST_TYPE);
     __ CompareObjectType(r3, r7, r7, FIRST_JS_RECEIVER_TYPE);
     __ bge(&leave_frame);
-
-    __ bind(&other_result);
-    // The result is now neither undefined nor an object.
-    if (restrict_constructor_return) {
-      // Throw if constructor function is a class constructor
-      __ LoadP(r7, MemOperand(fp, ConstructFrameConstants::kConstructorOffset));
-      __ LoadP(r7, FieldMemOperand(r7, JSFunction::kSharedFunctionInfoOffset));
-      __ lwz(r7, FieldMemOperand(r7, SharedFunctionInfo::kFlagsOffset));
-      __ TestBitMask(r7, SharedFunctionInfo::IsClassConstructorBit::kMask, r0);
-      __ beq(&use_receiver, cr0);
-
-    } else {
-      __ b(&use_receiver);
-    }
+    __ b(&use_receiver);
 
     __ bind(&do_throw);
-    {
-      FrameAndConstantPoolScope scope(masm, StackFrame::INTERNAL);
-      __ CallRuntime(Runtime::kThrowConstructorReturnedNonObject);
-    }
+    __ CallRuntime(Runtime::kThrowConstructorReturnedNonObject);
 
     // Throw away the result of the constructor invocation and use the
     // on-stack receiver as the result.
@@ -438,16 +340,6 @@ void Generate_JSConstructStubGeneric(MacroAssembler* masm,
   __ blr();
 }
 
-}  // namespace
-
-void Builtins::Generate_JSConstructStubGenericRestrictedReturn(
-    MacroAssembler* masm) {
-  Generate_JSConstructStubGeneric(masm, true);
-}
-void Builtins::Generate_JSConstructStubGenericUnrestrictedReturn(
-    MacroAssembler* masm) {
-  Generate_JSConstructStubGeneric(masm, false);
-}
 void Builtins::Generate_JSBuiltinsConstructStub(MacroAssembler* masm) {
   Generate_JSBuiltinsConstructStubHelper(masm);
 }
@@ -488,7 +380,7 @@ void Builtins::Generate_ResumeGeneratorTrampoline(MacroAssembler* masm) {
   Label stepping_prepared;
   ExternalReference debug_hook =
       ExternalReference::debug_hook_on_function_call_address(masm->isolate());
-  __ mov(ip, Operand(debug_hook));
+  __ Move(ip, debug_hook);
   __ LoadByte(ip, MemOperand(ip), r0);
   __ extsb(ip, ip);
   __ CmpSmiLiteral(ip, Smi::kZero, r0);
@@ -499,7 +391,7 @@ void Builtins::Generate_ResumeGeneratorTrampoline(MacroAssembler* masm) {
   ExternalReference debug_suspended_generator =
       ExternalReference::debug_suspended_generator_address(masm->isolate());
 
-  __ mov(ip, Operand(debug_suspended_generator));
+  __ Move(ip, debug_suspended_generator);
   __ LoadP(ip, MemOperand(ip));
   __ cmp(ip, r4);
   __ beq(&prepare_step_in_suspended_generator);
@@ -523,22 +415,27 @@ void Builtins::Generate_ResumeGeneratorTrampoline(MacroAssembler* masm) {
   //  -- sp[0] : generator receiver
   // -----------------------------------
 
-  // Push holes for arguments to generator function. Since the parser forced
-  // context allocation for any variables in generators, the actual argument
-  // values have already been copied into the context and these dummy values
-  // will never be used.
+  // Copy the function arguments from the generator object's register file.
   __ LoadP(r6, FieldMemOperand(r7, JSFunction::kSharedFunctionInfoOffset));
-  __ LoadWordArith(
-      r3, FieldMemOperand(r6, SharedFunctionInfo::kFormalParameterCountOffset));
+  __ LoadHalfWord(
+      r6, FieldMemOperand(r6, SharedFunctionInfo::kFormalParameterCountOffset));
+  __ LoadP(r5, FieldMemOperand(
+                   r4, JSGeneratorObject::kParametersAndRegistersOffset));
   {
     Label loop, done_loop;
-    __ LoadRoot(ip, Heap::kTheHoleValueRootIndex);
-    __ cmpi(r3, Operand::Zero());
-    __ beq(&done_loop);
-    __ mtctr(r3);
+    __ cmpi(r6, Operand::Zero());
+    __ ble(&done_loop);
+
+    // setup r9 to first element address - kPointerSize
+    __ addi(r9, r5,
+            Operand(FixedArray::kHeaderSize - kHeapObjectTag - kPointerSize));
+
+    __ mtctr(r6);
     __ bind(&loop);
+    __ LoadPU(ip, MemOperand(r9, kPointerSize));
     __ push(ip);
     __ bdnz(&loop);
+
     __ bind(&done_loop);
   }
 
@@ -568,6 +465,8 @@ void Builtins::Generate_ResumeGeneratorTrampoline(MacroAssembler* masm) {
   {
     FrameAndConstantPoolScope scope(masm, StackFrame::INTERNAL);
     __ Push(r4, r7);
+    // Push hole as receiver since we do not use it for stepping.
+    __ PushRoot(Heap::kTheHoleValueRootIndex);
     __ CallRuntime(Runtime::kDebugOnFunctionCall);
     __ Pop(r4);
     __ LoadP(r7, FieldMemOperand(r4, JSGeneratorObject::kFunctionOffset));
@@ -635,9 +534,9 @@ static void Generate_JSEntryTrampolineHelper(MacroAssembler* masm,
     FrameScope scope(masm, StackFrame::INTERNAL);
 
     // Setup the context (we need to use the caller context from the isolate).
-    ExternalReference context_address(IsolateAddressId::kContextAddress,
-                                      masm->isolate());
-    __ mov(cp, Operand(context_address));
+    ExternalReference context_address = ExternalReference::Create(
+        IsolateAddressId::kContextAddress, masm->isolate());
+    __ Move(cp, context_address);
     __ LoadP(cp, MemOperand(cp));
 
     // Push the function and the receiver onto the stack.
@@ -849,9 +748,8 @@ static void AdvanceBytecodeOffsetOrReturn(MacroAssembler* masm,
   Register scratch2 = bytecode;
   DCHECK(!AreAliased(bytecode_array, bytecode_offset, bytecode_size_table,
                      bytecode));
-  __ mov(
-      bytecode_size_table,
-      Operand(ExternalReference::bytecode_size_table_address(masm->isolate())));
+  __ Move(bytecode_size_table,
+          ExternalReference::bytecode_size_table_address());
 
   // Check if the bytecode is a Wide or ExtraWide prefix bytecode.
   Label process_bytecode, extra_wide;
@@ -932,18 +830,13 @@ void Builtins::Generate_InterpreterEntryTrampoline(MacroAssembler* masm) {
   FrameScope frame_scope(masm, StackFrame::MANUAL);
   __ PushStandardFrame(closure);
 
-  // Get the bytecode array from the function object (or from the DebugInfo if
-  // it is present) and load it into kInterpreterBytecodeArrayRegister.
-  Label maybe_load_debug_bytecode_array, bytecode_array_loaded;
+  // Get the bytecode array from the function object and load it into
+  // kInterpreterBytecodeArrayRegister.
   __ LoadP(r3, FieldMemOperand(closure, JSFunction::kSharedFunctionInfoOffset));
   // Load original bytecode array or the debug copy.
   __ LoadP(kInterpreterBytecodeArrayRegister,
            FieldMemOperand(r3, SharedFunctionInfo::kFunctionDataOffset));
   GetSharedFunctionInfoBytecode(masm, kInterpreterBytecodeArrayRegister, r7);
-  __ LoadP(r7, FieldMemOperand(r3, SharedFunctionInfo::kDebugInfoOffset));
-  __ TestIfSmi(r7, r0);
-  __ bne(&maybe_load_debug_bytecode_array, cr0);
-  __ bind(&bytecode_array_loaded);
 
   // Increment invocation count for the function.
   __ LoadWord(
@@ -1030,9 +923,9 @@ void Builtins::Generate_InterpreterEntryTrampoline(MacroAssembler* masm) {
   // handler at the current bytecode offset.
   Label do_dispatch;
   __ bind(&do_dispatch);
-  __ mov(kInterpreterDispatchTableRegister,
-         Operand(ExternalReference::interpreter_dispatch_table_address(
-             masm->isolate())));
+  __ Move(
+      kInterpreterDispatchTableRegister,
+      ExternalReference::interpreter_dispatch_table_address(masm->isolate()));
   __ lbzx(r6, MemOperand(kInterpreterBytecodeArrayRegister,
                          kInterpreterBytecodeOffsetRegister));
   __ ShiftLeftImm(r6, r6, Operand(kPointerSizeLog2));
@@ -1065,32 +958,6 @@ void Builtins::Generate_InterpreterEntryTrampoline(MacroAssembler* masm) {
   // The return value is in r3.
   LeaveInterpreterFrame(masm, r5);
   __ blr();
-
-  // Load debug copy of the bytecode array if it exists.
-  // kInterpreterBytecodeArrayRegister is already loaded with
-  // SharedFunctionInfo::kFunctionDataOffset.
-  __ bind(&maybe_load_debug_bytecode_array);
-  __ LoadP(ip, FieldMemOperand(r7, DebugInfo::kDebugBytecodeArrayOffset));
-  __ JumpIfRoot(ip, Heap::kUndefinedValueRootIndex, &bytecode_array_loaded);
-
-  __ mr(kInterpreterBytecodeArrayRegister, ip);
-  __ LoadP(ip, FieldMemOperand(r7, DebugInfo::kFlagsOffset));
-  __ SmiUntag(ip);
-  __ andi(ip, ip, Operand(DebugInfo::kDebugExecutionMode));
-
-  ExternalReference debug_execution_mode =
-      ExternalReference::debug_execution_mode_address(masm->isolate());
-  __ mov(r7, Operand(debug_execution_mode));
-  __ lwz(r7, MemOperand(r7));
-  STATIC_ASSERT(static_cast<int>(DebugInfo::kDebugExecutionMode) ==
-                static_cast<int>(DebugInfo::kSideEffects));
-  __ cmp(r7, ip);
-  __ beq(&bytecode_array_loaded);
-
-  __ Push(closure, feedback_vector, kInterpreterBytecodeArrayRegister, closure);
-  __ CallRuntime(Runtime::kDebugApplyInstrumentation);
-  __ Pop(closure, feedback_vector, kInterpreterBytecodeArrayRegister);
-  __ b(&bytecode_array_loaded);
 }
 
 static void Generate_StackOverflowCheck(MacroAssembler* masm, Register num_args,
@@ -1209,8 +1076,8 @@ void Builtins::Generate_InterpreterPushArgsThenConstructImpl(
 
     // Tail call to the array construct stub (still in the caller
     // context at this point).
-    ArrayConstructorStub array_constructor_stub(masm->isolate());
-    __ Jump(array_constructor_stub.GetCode(), RelocInfo::CODE_TARGET);
+    Handle<Code> code = BUILTIN_CODE(masm->isolate(), ArrayConstructorImpl);
+    __ Jump(code, RelocInfo::CODE_TARGET);
   } else if (mode == InterpreterPushArgsMode::kWithFinalSpread) {
     // Call the constructor with r3, r4, and r6 unmodified.
     __ Jump(BUILTIN_CODE(masm->isolate(), ConstructWithSpread),
@@ -1260,9 +1127,9 @@ static void Generate_InterpreterEnterBytecode(MacroAssembler* masm) {
   __ mtlr(r0);
 
   // Initialize the dispatch table register.
-  __ mov(kInterpreterDispatchTableRegister,
-         Operand(ExternalReference::interpreter_dispatch_table_address(
-             masm->isolate())));
+  __ Move(
+      kInterpreterDispatchTableRegister,
+      ExternalReference::interpreter_dispatch_table_address(masm->isolate()));
 
   // Get the bytecode array pointer from the frame.
   __ LoadP(kInterpreterBytecodeArrayRegister,
@@ -1328,213 +1195,6 @@ void Builtins::Generate_InterpreterEnterBytecodeDispatch(MacroAssembler* masm) {
   Generate_InterpreterEnterBytecode(masm);
 }
 
-void Builtins::Generate_CompileLazyDeoptimizedCode(MacroAssembler* masm) {
-  // Set the code slot inside the JSFunction to CompileLazy.
-  __ Move(r5, BUILTIN_CODE(masm->isolate(), CompileLazy));
-  __ StoreP(r5, FieldMemOperand(r4, JSFunction::kCodeOffset), r0);
-  __ RecordWriteField(r4, JSFunction::kCodeOffset, r5, r7, kLRHasNotBeenSaved,
-                      kDontSaveFPRegs, OMIT_REMEMBERED_SET, OMIT_SMI_CHECK);
-  // Jump to compile lazy.
-  Generate_CompileLazy(masm);
-}
-
-static void GetSharedFunctionInfoCode(MacroAssembler* masm, Register sfi_data,
-                                      Register scratch1) {
-  // Figure out the SFI's code object.
-  Label done;
-  Label check_is_bytecode_array;
-  Label check_is_code;
-  Label check_is_fixed_array;
-  Label check_is_pre_parsed_scope_data;
-  Label check_is_function_template_info;
-  Label check_is_interpreter_data;
-
-  Register data_type = scratch1;
-
-  // IsSmi: Is builtin
-  __ JumpIfNotSmi(sfi_data, &check_is_bytecode_array);
-  __ mov(scratch1,
-         Operand(ExternalReference::builtins_address(masm->isolate())));
-  __ SmiUntag(sfi_data, LeaveRC, kPointerSizeLog2);
-  __ LoadPX(sfi_data, MemOperand(scratch1, sfi_data));
-  __ b(&done);
-
-  // Get map for subsequent checks.
-  __ bind(&check_is_bytecode_array);
-  __ LoadP(data_type, FieldMemOperand(sfi_data, HeapObject::kMapOffset));
-  __ LoadHalfWord(data_type,
-                  FieldMemOperand(data_type, Map::kInstanceTypeOffset), r0);
-
-  // IsBytecodeArray: Interpret bytecode
-  __ cmpi(data_type, Operand(BYTECODE_ARRAY_TYPE));
-  __ bne(&check_is_code);
-  __ Move(sfi_data, BUILTIN_CODE(masm->isolate(), InterpreterEntryTrampoline));
-  __ b(&done);
-
-  // IsCode: Run code
-  __ bind(&check_is_code);
-  __ cmpi(data_type, Operand(CODE_TYPE));
-  __ beq(&done);
-
-  // IsFixedArray: Instantiate using AsmWasmData,
-  __ bind(&check_is_fixed_array);
-  __ cmpi(data_type, Operand(FIXED_ARRAY_TYPE));
-  __ bne(&check_is_pre_parsed_scope_data);
-  __ Move(sfi_data, BUILTIN_CODE(masm->isolate(), InstantiateAsmJs));
-  __ b(&done);
-
-  // IsPreParsedScopeData: Compile lazy
-  __ bind(&check_is_pre_parsed_scope_data);
-  __ cmpi(data_type, Operand(TUPLE2_TYPE));
-  __ bne(&check_is_function_template_info);
-  __ Move(sfi_data, BUILTIN_CODE(masm->isolate(), CompileLazy));
-  __ b(&done);
-
-  // IsFunctionTemplateInfo: API call
-  __ bind(&check_is_function_template_info);
-  __ cmpi(data_type, Operand(FUNCTION_TEMPLATE_INFO_TYPE));
-  __ bne(&check_is_interpreter_data);
-  __ Move(sfi_data, BUILTIN_CODE(masm->isolate(), HandleApiCall));
-  __ b(&done);
-
-  // IsInterpreterData: Interpret bytecode
-  __ bind(&check_is_interpreter_data);
-  if (FLAG_debug_code) {
-    __ cmpi(data_type, Operand(INTERPRETER_DATA_TYPE));
-    __ Assert(eq, AbortReason::kInvalidSharedFunctionInfoData);
-  }
-  __ Move(sfi_data, BUILTIN_CODE(masm->isolate(), HandleApiCall));
-  __ LoadP(
-      sfi_data,
-      FieldMemOperand(sfi_data, InterpreterData::kInterpreterTrampolineOffset));
-
-  __ bind(&done);
-}
-
-void Builtins::Generate_CompileLazy(MacroAssembler* masm) {
-  // ----------- S t a t e -------------
-  //  -- r3 : argument count (preserved for callee)
-  //  -- r6 : new target (preserved for callee)
-  //  -- r4 : target function (preserved for callee)
-  // -----------------------------------
-  // First lookup code, maybe we don't need to compile!
-  Label gotta_call_runtime;
-
-  Register closure = r4;
-  Register feedback_vector = r5;
-
-  // Do we have a valid feedback vector?
-  __ LoadP(feedback_vector,
-           FieldMemOperand(closure, JSFunction::kFeedbackCellOffset));
-  __ LoadP(feedback_vector,
-           FieldMemOperand(feedback_vector, Cell::kValueOffset));
-  __ JumpIfRoot(feedback_vector, Heap::kUndefinedValueRootIndex,
-                &gotta_call_runtime);
-
-  // Is there an optimization marker or optimized code in the feedback vector?
-  MaybeTailCallOptimizedCodeSlot(masm, feedback_vector, r7, r9, r8);
-
-  // We found no optimized code. Infer the code object needed for the SFI.
-  Register entry = r7;
-  __ LoadP(entry,
-           FieldMemOperand(closure, JSFunction::kSharedFunctionInfoOffset));
-  __ LoadP(entry,
-           FieldMemOperand(entry, SharedFunctionInfo::kFunctionDataOffset));
-  GetSharedFunctionInfoCode(masm, entry, r8);
-
-  // If code entry points to anything other than CompileLazy, install that.
-  __ mov(r8, Operand(masm->CodeObject()));
-  __ cmp(entry, r8);
-  __ beq(&gotta_call_runtime);
-
-  // Install the SFI's code entry.
-  __ StoreP(entry, FieldMemOperand(closure, JSFunction::kCodeOffset), r0);
-  __ mr(r9, entry);  // Write barrier clobbers ip below.
-  __ RecordWriteField(closure, JSFunction::kCodeOffset, r9, r8,
-                      kLRHasNotBeenSaved, kDontSaveFPRegs, OMIT_REMEMBERED_SET,
-                      OMIT_SMI_CHECK);
-  __ addi(entry, entry, Operand(Code::kHeaderSize - kHeapObjectTag));
-  __ JumpToJSEntry(entry);
-
-  __ bind(&gotta_call_runtime);
-  GenerateTailCallToReturnedCode(masm, Runtime::kCompileLazy);
-}
-
-// Lazy deserialization design doc: http://goo.gl/dxkYDZ.
-void Builtins::Generate_DeserializeLazy(MacroAssembler* masm) {
-  // ----------- S t a t e -------------
-  //  -- r3 : argument count (preserved for callee)
-  //  -- r6 : new target (preserved for callee)
-  //  -- r4 : target function (preserved for callee)
-  // -----------------------------------
-
-  Label deserialize_in_runtime;
-
-  Register target = r4;  // Must be preserved
-  Register scratch0 = r5;
-  Register scratch1 = r7;
-
-  CHECK(scratch0 != r3 && scratch0 != r6 && scratch0 != r4);
-  CHECK(scratch1 != r3 && scratch1 != r6 && scratch1 != r4);
-  CHECK(scratch0 != scratch1);
-
-  // Load the builtin id for lazy deserialization from SharedFunctionInfo.
-
-  __ AssertFunction(target);
-  __ LoadP(scratch0,
-           FieldMemOperand(target, JSFunction::kSharedFunctionInfoOffset));
-
-  __ LoadP(scratch1,
-           FieldMemOperand(scratch0, SharedFunctionInfo::kFunctionDataOffset));
-  __ AssertSmi(scratch1);
-
-  // The builtin may already have been deserialized. If that is the case, it is
-  // stored in the builtins table, and we can copy to correct code object to
-  // both the shared function info and function without calling into runtime.
-  //
-  // Otherwise, we need to call into runtime to deserialize.
-
-  {
-    // Load the code object at builtins_table[builtin_id] into scratch1.
-
-    __ SmiUntag(scratch1);
-    __ mov(scratch0,
-           Operand(ExternalReference::builtins_address(masm->isolate())));
-    __ ShiftLeftImm(scratch1, scratch1, Operand(kPointerSizeLog2));
-    __ LoadPX(scratch1, MemOperand(scratch0, scratch1));
-
-    // Check if the loaded code object has already been deserialized. This is
-    // the case iff it does not equal DeserializeLazy.
-
-    __ Move(scratch0, masm->CodeObject());
-    __ cmp(scratch1, scratch0);
-    __ beq(&deserialize_in_runtime);
-  }
-  {
-    // If we've reached this spot, the target builtin has been deserialized and
-    // we simply need to copy it over to the target function.
-
-    Register target_builtin = scratch1;
-
-    __ StoreP(target_builtin, FieldMemOperand(target, JSFunction::kCodeOffset),
-              r0);
-    __ mr(r9, target_builtin);  // Write barrier clobbers r9 below.
-    __ RecordWriteField(target, JSFunction::kCodeOffset, r9, r8,
-                        kLRHasNotBeenSaved, kDontSaveFPRegs,
-                        OMIT_REMEMBERED_SET, OMIT_SMI_CHECK);
-
-    // All copying is done. Jump to the deserialized code object.
-
-    __ addi(target_builtin, target_builtin,
-            Operand(Code::kHeaderSize - kHeapObjectTag));
-    __ mr(ip, target_builtin);
-    __ Jump(ip);
-  }
-
-  __ bind(&deserialize_in_runtime);
-  GenerateTailCallToReturnedCode(masm, Runtime::kDeserializeLazy);
-}
-
 void Builtins::Generate_InstantiateAsmJs(MacroAssembler* masm) {
   // ----------- S t a t e -------------
   //  -- r3 : argument count (preserved for callee)
@@ -1981,7 +1641,28 @@ void Builtins::Generate_CallOrConstructVarargs(MacroAssembler* masm,
   //  -- r6 : new.target (for [[Construct]])
   // -----------------------------------
 
-  __ AssertFixedArray(r5);
+  Register scratch = ip;
+
+  if (masm->emit_debug_code()) {
+    // Allow r5 to be a FixedArray, or a FixedDoubleArray if r7 == 0.
+    Label ok, fail;
+    __ AssertNotSmi(r5);
+    __ LoadP(scratch, FieldMemOperand(r5, HeapObject::kMapOffset));
+    __ LoadHalfWord(scratch,
+                    FieldMemOperand(scratch, Map::kInstanceTypeOffset));
+    __ cmpi(scratch, Operand(FIXED_ARRAY_TYPE));
+    __ beq(&ok);
+    __ cmpi(scratch, Operand(FIXED_DOUBLE_ARRAY_TYPE));
+    __ bne(&fail);
+    __ cmpi(r7, Operand::Zero());
+    __ beq(&ok);
+    // Fall through.
+    __ bind(&fail);
+    __ Abort(AbortReason::kOperandIsNotAFixedArray);
+
+    __ bind(&ok);
+  }
+
   // Check for stack overflow.
   {
     // Check the stack for overflow. We are not trying to catch interruptions
@@ -2062,7 +1743,7 @@ void Builtins::Generate_CallOrConstructForwardVarargs(MacroAssembler* masm,
   {
     __ LoadP(r8, MemOperand(fp, JavaScriptFrameConstants::kFunctionOffset));
     __ LoadP(r8, FieldMemOperand(r8, JSFunction::kSharedFunctionInfoOffset));
-    __ LoadWordArith(
+    __ LoadHalfWord(
         r8,
         FieldMemOperand(r8, SharedFunctionInfo::kFormalParameterCountOffset));
     __ mr(r7, fp);
@@ -2199,7 +1880,7 @@ void Builtins::Generate_CallFunction(MacroAssembler* masm,
   //  -- cp : the function context.
   // -----------------------------------
 
-  __ LoadWordArith(
+  __ LoadHalfWord(
       r5, FieldMemOperand(r5, SharedFunctionInfo::kFormalParameterCountOffset));
   ParameterCount actual(r3);
   ParameterCount expected(r5);
@@ -2394,7 +2075,7 @@ void Builtins::Generate_ConstructFunction(MacroAssembler* masm) {
           RelocInfo::CODE_TARGET);
 
   __ bind(&call_generic_stub);
-  __ Jump(masm->isolate()->builtins()->JSConstructStubGeneric(),
+  __ Jump(BUILTIN_CODE(masm->isolate(), JSConstructStubGeneric),
           RelocInfo::CODE_TARGET);
 }
 
@@ -2480,42 +2161,6 @@ void Builtins::Generate_Construct(MacroAssembler* masm) {
           RelocInfo::CODE_TARGET);
 }
 
-// static
-void Builtins::Generate_AllocateInNewSpace(MacroAssembler* masm) {
-  // ----------- S t a t e -------------
-  //  -- r4 : requested object size (untagged)
-  //  -- lr : return address
-  // -----------------------------------
-  __ SmiTag(r4);
-  __ Push(r4);
-  __ LoadSmiLiteral(cp, Smi::kZero);
-  __ TailCallRuntime(Runtime::kAllocateInNewSpace);
-}
-
-// static
-void Builtins::Generate_AllocateInOldSpace(MacroAssembler* masm) {
-  // ----------- S t a t e -------------
-  //  -- r4 : requested object size (untagged)
-  //  -- lr : return address
-  // -----------------------------------
-  __ SmiTag(r4);
-  __ LoadSmiLiteral(r5, Smi::FromInt(AllocateTargetSpace::encode(OLD_SPACE)));
-  __ Push(r4, r5);
-  __ LoadSmiLiteral(cp, Smi::kZero);
-  __ TailCallRuntime(Runtime::kAllocateInTargetSpace);
-}
-
-// static
-void Builtins::Generate_Abort(MacroAssembler* masm) {
-  // ----------- S t a t e -------------
-  //  -- r4 : message_id as Smi
-  //  -- lr : return address
-  // -----------------------------------
-  __ push(r4);
-  __ LoadSmiLiteral(cp, Smi::kZero);
-  __ TailCallRuntime(Runtime::kAbort);
-}
-
 void Builtins::Generate_ArgumentsAdaptorTrampoline(MacroAssembler* masm) {
   // ----------- S t a t e -------------
   //  -- r3 : actual number of arguments
@@ -2527,10 +2172,10 @@ void Builtins::Generate_ArgumentsAdaptorTrampoline(MacroAssembler* masm) {
   Label invoke, dont_adapt_arguments, stack_overflow;
 
   Label enough, too_few;
+  __ cmpli(r5, Operand(SharedFunctionInfo::kDontAdaptArgumentsSentinel));
+  __ beq(&dont_adapt_arguments);
   __ cmp(r3, r5);
   __ blt(&too_few);
-  __ cmpi(r5, Operand(SharedFunctionInfo::kDontAdaptArgumentsSentinel));
-  __ beq(&dont_adapt_arguments);
 
   {  // Enough parameters: actual >= expected
     __ bind(&enough);
@@ -2650,30 +2295,35 @@ void Builtins::Generate_ArgumentsAdaptorTrampoline(MacroAssembler* masm) {
 }
 
 void Builtins::Generate_WasmCompileLazy(MacroAssembler* masm) {
+  // The function index was put in r15 by the jump table trampoline.
+  // Convert to Smi for the runtime call.
+  __ SmiTag(r15, r15);
   {
-    FrameAndConstantPoolScope scope(masm, StackFrame::INTERNAL);
-
-    auto wasm_instance_reg = r10;  // TODO(titzer): put in a common place.
+    TrapOnAbortScope trap_on_abort_scope(masm);  // Avoid calls to Abort.
+    FrameAndConstantPoolScope scope(masm, StackFrame::WASM_COMPILE_LAZY);
 
     // Save all parameter registers (see wasm-linkage.cc). They might be
     // overwritten in the runtime call below. We don't have any callee-saved
     // registers in wasm, so no need to store anything else.
-    constexpr RegList gp_regs = Register::ListOf<r3, r4, r5, r6, r7, r8, r9>();
+    constexpr RegList gp_regs =
+        Register::ListOf<r3, r4, r5, r6, r7, r8, r9, r10>();
     constexpr RegList fp_regs =
         DoubleRegister::ListOf<d1, d2, d3, d4, d5, d6, d7, d8>();
     __ MultiPush(gp_regs);
     __ MultiPushDoubles(fp_regs);
 
-    // Pass the WASM instance as an explicit argument to WasmCompileLazy.
-    __ Push(wasm_instance_reg);
-    // Initialize the JavaScript context with 0. CEntryStub will use it to
+    // Pass instance and function index as explicit arguments to the runtime
+    // function.
+    __ Push(kWasmInstanceRegister, r15);
+    // Load the correct CEntry builtin from the instance object.
+    __ LoadP(r5, FieldMemOperand(kWasmInstanceRegister,
+                                 WasmInstanceObject::kCEntryStubOffset));
+    // Initialize the JavaScript context with 0. CEntry will use it to
     // set the current context on the isolate.
     __ LoadSmiLiteral(cp, Smi::kZero);
-    __ CallRuntime(Runtime::kWasmCompileLazy);
-    // The entrypoint address is the first return value.
+    __ CallRuntimeWithCEntry(Runtime::kWasmCompileLazy, r5);
+    // The entrypoint address is the return value.
     __ mr(r11, kReturnRegister0);
-    // The WASM instance is the second return value.
-    __ mr(wasm_instance_reg, kReturnRegister1);
 
     // Restore registers.
     __ MultiPopDoubles(fp_regs);
@@ -2683,6 +2333,491 @@ void Builtins::Generate_WasmCompileLazy(MacroAssembler* masm) {
   __ Jump(r11);
 }
 
+void Builtins::Generate_CEntry(MacroAssembler* masm, int result_size,
+                               SaveFPRegsMode save_doubles, ArgvMode argv_mode,
+                               bool builtin_exit_frame) {
+  // Called from JavaScript; parameters are on stack as if calling JS function.
+  // r3: number of arguments including receiver
+  // r4: pointer to builtin function
+  // fp: frame pointer  (restored after C call)
+  // sp: stack pointer  (restored as callee's sp after C call)
+  // cp: current context  (C callee-saved)
+  //
+  // If argv_mode == kArgvInRegister:
+  // r5: pointer to the first argument
+  ProfileEntryHookStub::MaybeCallEntryHook(masm);
+
+  __ mr(r15, r4);
+
+  if (argv_mode == kArgvInRegister) {
+    // Move argv into the correct register.
+    __ mr(r4, r5);
+  } else {
+    // Compute the argv pointer.
+    __ ShiftLeftImm(r4, r3, Operand(kPointerSizeLog2));
+    __ add(r4, r4, sp);
+    __ subi(r4, r4, Operand(kPointerSize));
+  }
+
+  // Enter the exit frame that transitions from JavaScript to C++.
+  FrameScope scope(masm, StackFrame::MANUAL);
+
+  // Need at least one extra slot for return address location.
+  int arg_stack_space = 1;
+
+  // Pass buffer for return value on stack if necessary
+  bool needs_return_buffer =
+      (result_size == 2 && !ABI_RETURNS_OBJECT_PAIRS_IN_REGS);
+  if (needs_return_buffer) {
+    arg_stack_space += result_size;
+  }
+
+  __ EnterExitFrame(
+      save_doubles, arg_stack_space,
+      builtin_exit_frame ? StackFrame::BUILTIN_EXIT : StackFrame::EXIT);
+
+  // Store a copy of argc in callee-saved registers for later.
+  __ mr(r14, r3);
+
+  // r3, r14: number of arguments including receiver  (C callee-saved)
+  // r4: pointer to the first argument
+  // r15: pointer to builtin function  (C callee-saved)
+
+  // Result returned in registers or stack, depending on result size and ABI.
+
+  Register isolate_reg = r5;
+  if (needs_return_buffer) {
+    // The return value is a non-scalar value.
+    // Use frame storage reserved by calling function to pass return
+    // buffer as implicit first argument.
+    __ mr(r5, r4);
+    __ mr(r4, r3);
+    __ addi(r3, sp, Operand((kStackFrameExtraParamSlot + 1) * kPointerSize));
+    isolate_reg = r6;
+  }
+
+  // Call C built-in.
+  __ Move(isolate_reg, ExternalReference::isolate_address(masm->isolate()));
+
+  Register target = r15;
+  if (ABI_USES_FUNCTION_DESCRIPTORS) {
+    // AIX/PPC64BE Linux use a function descriptor.
+    __ LoadP(ToRegister(ABI_TOC_REGISTER), MemOperand(r15, kPointerSize));
+    __ LoadP(ip, MemOperand(r15, 0));  // Instruction address
+    target = ip;
+  } else if (ABI_CALL_VIA_IP) {
+    __ Move(ip, r15);
+    target = ip;
+  }
+
+  // To let the GC traverse the return address of the exit frames, we need to
+  // know where the return address is. The CEntryStub is unmovable, so
+  // we can store the address on the stack to be able to find it again and
+  // we never have to restore it, because it will not change.
+  Label start_call;
+  constexpr int after_call_offset = 5 * Assembler::kInstrSize;
+  DCHECK_NE(r7, target);
+  __ LoadPC(r7);
+  __ bind(&start_call);
+  __ addi(r7, r7, Operand(after_call_offset));
+  __ StoreP(r7, MemOperand(sp, kStackFrameExtraParamSlot * kPointerSize));
+  __ Call(target);
+  DCHECK_EQ(after_call_offset - Assembler::kInstrSize,
+            __ SizeOfCodeGeneratedSince(&start_call));
+
+  // If return value is on the stack, pop it to registers.
+  if (needs_return_buffer) {
+    __ LoadP(r4, MemOperand(r3, kPointerSize));
+    __ LoadP(r3, MemOperand(r3));
+  }
+
+  // Check result for exception sentinel.
+  Label exception_returned;
+  __ CompareRoot(r3, Heap::kExceptionRootIndex);
+  __ beq(&exception_returned);
+
+  // Check that there is no pending exception, otherwise we
+  // should have returned the exception sentinel.
+  if (FLAG_debug_code) {
+    Label okay;
+    ExternalReference pending_exception_address = ExternalReference::Create(
+        IsolateAddressId::kPendingExceptionAddress, masm->isolate());
+
+    __ Move(r6, pending_exception_address);
+    __ LoadP(r6, MemOperand(r6));
+    __ CompareRoot(r6, Heap::kTheHoleValueRootIndex);
+    // Cannot use check here as it attempts to generate call into runtime.
+    __ beq(&okay);
+    __ stop("Unexpected pending exception");
+    __ bind(&okay);
+  }
+
+  // Exit C frame and return.
+  // r3:r4: result
+  // sp: stack pointer
+  // fp: frame pointer
+  Register argc = argv_mode == kArgvInRegister
+                      // We don't want to pop arguments so set argc to no_reg.
+                      ? no_reg
+                      // r14: still holds argc (callee-saved).
+                      : r14;
+  __ LeaveExitFrame(save_doubles, argc);
+  __ blr();
+
+  // Handling of exception.
+  __ bind(&exception_returned);
+
+  ExternalReference pending_handler_context_address = ExternalReference::Create(
+      IsolateAddressId::kPendingHandlerContextAddress, masm->isolate());
+  ExternalReference pending_handler_entrypoint_address =
+      ExternalReference::Create(
+          IsolateAddressId::kPendingHandlerEntrypointAddress, masm->isolate());
+  ExternalReference pending_handler_constant_pool_address =
+      ExternalReference::Create(
+          IsolateAddressId::kPendingHandlerConstantPoolAddress,
+          masm->isolate());
+  ExternalReference pending_handler_fp_address = ExternalReference::Create(
+      IsolateAddressId::kPendingHandlerFPAddress, masm->isolate());
+  ExternalReference pending_handler_sp_address = ExternalReference::Create(
+      IsolateAddressId::kPendingHandlerSPAddress, masm->isolate());
+
+  // Ask the runtime for help to determine the handler. This will set r3 to
+  // contain the current pending exception, don't clobber it.
+  ExternalReference find_handler =
+      ExternalReference::Create(Runtime::kUnwindAndFindExceptionHandler);
+  {
+    FrameScope scope(masm, StackFrame::MANUAL);
+    __ PrepareCallCFunction(3, 0, r3);
+    __ li(r3, Operand::Zero());
+    __ li(r4, Operand::Zero());
+    __ Move(r5, ExternalReference::isolate_address(masm->isolate()));
+    __ CallCFunction(find_handler, 3);
+  }
+
+  // Retrieve the handler context, SP and FP.
+  __ Move(cp, pending_handler_context_address);
+  __ LoadP(cp, MemOperand(cp));
+  __ Move(sp, pending_handler_sp_address);
+  __ LoadP(sp, MemOperand(sp));
+  __ Move(fp, pending_handler_fp_address);
+  __ LoadP(fp, MemOperand(fp));
+
+  // If the handler is a JS frame, restore the context to the frame. Note that
+  // the context will be set to (cp == 0) for non-JS frames.
+  Label skip;
+  __ cmpi(cp, Operand::Zero());
+  __ beq(&skip);
+  __ StoreP(cp, MemOperand(fp, StandardFrameConstants::kContextOffset));
+  __ bind(&skip);
+
+  // Reset the masking register.
+  if (FLAG_branch_load_poisoning) {
+    __ ResetSpeculationPoisonRegister();
+  }
+
+  // Compute the handler entry address and jump to it.
+  ConstantPoolUnavailableScope constant_pool_unavailable(masm);
+  __ Move(ip, pending_handler_entrypoint_address);
+  __ LoadP(ip, MemOperand(ip));
+  if (FLAG_enable_embedded_constant_pool) {
+    __ Move(kConstantPoolRegister, pending_handler_constant_pool_address);
+    __ LoadP(kConstantPoolRegister, MemOperand(kConstantPoolRegister));
+  }
+  __ Jump(ip);
+}
+
+void Builtins::Generate_DoubleToI(MacroAssembler* masm) {
+  Label out_of_range, only_low, negate, done, fastpath_done;
+  Register result_reg = r3;
+
+  TrapOnAbortScope trap_on_abort_scope(masm);  // Avoid calls to Abort.
+
+  // Immediate values for this stub fit in instructions, so it's safe to use ip.
+  Register scratch = GetRegisterThatIsNotOneOf(result_reg);
+  Register scratch_low = GetRegisterThatIsNotOneOf(result_reg, scratch);
+  Register scratch_high =
+      GetRegisterThatIsNotOneOf(result_reg, scratch, scratch_low);
+  DoubleRegister double_scratch = kScratchDoubleReg;
+
+  __ Push(result_reg, scratch);
+  // Account for saved regs.
+  int argument_offset = 2 * kPointerSize;
+
+  // Load double input.
+  __ lfd(double_scratch, MemOperand(sp, argument_offset));
+
+  // Do fast-path convert from double to int.
+  __ ConvertDoubleToInt64(double_scratch,
+#if !V8_TARGET_ARCH_PPC64
+                          scratch,
+#endif
+                          result_reg, d0);
+
+// Test for overflow
+#if V8_TARGET_ARCH_PPC64
+  __ TestIfInt32(result_reg, r0);
+#else
+  __ TestIfInt32(scratch, result_reg, r0);
+#endif
+  __ beq(&fastpath_done);
+
+  __ Push(scratch_high, scratch_low);
+  // Account for saved regs.
+  argument_offset += 2 * kPointerSize;
+
+  __ lwz(scratch_high,
+         MemOperand(sp, argument_offset + Register::kExponentOffset));
+  __ lwz(scratch_low,
+         MemOperand(sp, argument_offset + Register::kMantissaOffset));
+
+  __ ExtractBitMask(scratch, scratch_high, HeapNumber::kExponentMask);
+  // Load scratch with exponent - 1. This is faster than loading
+  // with exponent because Bias + 1 = 1024 which is a *PPC* immediate value.
+  STATIC_ASSERT(HeapNumber::kExponentBias + 1 == 1024);
+  __ subi(scratch, scratch, Operand(HeapNumber::kExponentBias + 1));
+  // If exponent is greater than or equal to 84, the 32 less significant
+  // bits are 0s (2^84 = 1, 52 significant bits, 32 uncoded bits),
+  // the result is 0.
+  // Compare exponent with 84 (compare exponent - 1 with 83).
+  __ cmpi(scratch, Operand(83));
+  __ bge(&out_of_range);
+
+  // If we reach this code, 31 <= exponent <= 83.
+  // So, we don't have to handle cases where 0 <= exponent <= 20 for
+  // which we would need to shift right the high part of the mantissa.
+  // Scratch contains exponent - 1.
+  // Load scratch with 52 - exponent (load with 51 - (exponent - 1)).
+  __ subfic(scratch, scratch, Operand(51));
+  __ cmpi(scratch, Operand::Zero());
+  __ ble(&only_low);
+  // 21 <= exponent <= 51, shift scratch_low and scratch_high
+  // to generate the result.
+  __ srw(scratch_low, scratch_low, scratch);
+  // Scratch contains: 52 - exponent.
+  // We needs: exponent - 20.
+  // So we use: 32 - scratch = 32 - 52 + exponent = exponent - 20.
+  __ subfic(scratch, scratch, Operand(32));
+  __ ExtractBitMask(result_reg, scratch_high, HeapNumber::kMantissaMask);
+  // Set the implicit 1 before the mantissa part in scratch_high.
+  STATIC_ASSERT(HeapNumber::kMantissaBitsInTopWord >= 16);
+  __ oris(result_reg, result_reg,
+          Operand(1 << ((HeapNumber::kMantissaBitsInTopWord)-16)));
+  __ slw(r0, result_reg, scratch);
+  __ orx(result_reg, scratch_low, r0);
+  __ b(&negate);
+
+  __ bind(&out_of_range);
+  __ mov(result_reg, Operand::Zero());
+  __ b(&done);
+
+  __ bind(&only_low);
+  // 52 <= exponent <= 83, shift only scratch_low.
+  // On entry, scratch contains: 52 - exponent.
+  __ neg(scratch, scratch);
+  __ slw(result_reg, scratch_low, scratch);
+
+  __ bind(&negate);
+  // If input was positive, scratch_high ASR 31 equals 0 and
+  // scratch_high LSR 31 equals zero.
+  // New result = (result eor 0) + 0 = result.
+  // If the input was negative, we have to negate the result.
+  // Input_high ASR 31 equals 0xFFFFFFFF and scratch_high LSR 31 equals 1.
+  // New result = (result eor 0xFFFFFFFF) + 1 = 0 - result.
+  __ srawi(r0, scratch_high, 31);
+#if V8_TARGET_ARCH_PPC64
+  __ srdi(r0, r0, Operand(32));
+#endif
+  __ xor_(result_reg, result_reg, r0);
+  __ srwi(r0, scratch_high, Operand(31));
+  __ add(result_reg, result_reg, r0);
+
+  __ bind(&done);
+  __ Pop(scratch_high, scratch_low);
+  // Account for saved regs.
+  argument_offset -= 2 * kPointerSize;
+
+  __ bind(&fastpath_done);
+  __ StoreP(result_reg, MemOperand(sp, argument_offset));
+  __ Pop(result_reg, scratch);
+
+  __ Ret();
+}
+
+void Builtins::Generate_MathPowInternal(MacroAssembler* masm) {
+  const Register exponent = r5;
+  const DoubleRegister double_base = d1;
+  const DoubleRegister double_exponent = d2;
+  const DoubleRegister double_result = d3;
+  const DoubleRegister double_scratch = d0;
+  const Register scratch = r11;
+  const Register scratch2 = r10;
+
+  Label call_runtime, done, int_exponent;
+
+  // Detect integer exponents stored as double.
+  __ TryDoubleToInt32Exact(scratch, double_exponent, scratch2, double_scratch);
+  __ beq(&int_exponent);
+
+  __ mflr(r0);
+  __ push(r0);
+  {
+    AllowExternalCallThatCantCauseGC scope(masm);
+    __ PrepareCallCFunction(0, 2, scratch);
+    __ MovToFloatParameters(double_base, double_exponent);
+    __ CallCFunction(ExternalReference::power_double_double_function(), 0, 2);
+  }
+  __ pop(r0);
+  __ mtlr(r0);
+  __ MovFromFloatResult(double_result);
+  __ b(&done);
+
+  // Calculate power with integer exponent.
+  __ bind(&int_exponent);
+
+  // Get two copies of exponent in the registers scratch and exponent.
+  // Exponent has previously been stored into scratch as untagged integer.
+  __ mr(exponent, scratch);
+
+  __ fmr(double_scratch, double_base);  // Back up base.
+  __ li(scratch2, Operand(1));
+  __ ConvertIntToDouble(scratch2, double_result);
+
+  // Get absolute value of exponent.
+  __ cmpi(scratch, Operand::Zero());
+  if (CpuFeatures::IsSupported(ISELECT)) {
+    __ neg(scratch2, scratch);
+    __ isel(lt, scratch, scratch2, scratch);
+  } else {
+    Label positive_exponent;
+    __ bge(&positive_exponent);
+    __ neg(scratch, scratch);
+    __ bind(&positive_exponent);
+  }
+
+  Label while_true, no_carry, loop_end;
+  __ bind(&while_true);
+  __ andi(scratch2, scratch, Operand(1));
+  __ beq(&no_carry, cr0);
+  __ fmul(double_result, double_result, double_scratch);
+  __ bind(&no_carry);
+  __ ShiftRightImm(scratch, scratch, Operand(1), SetRC);
+  __ beq(&loop_end, cr0);
+  __ fmul(double_scratch, double_scratch, double_scratch);
+  __ b(&while_true);
+  __ bind(&loop_end);
+
+  __ cmpi(exponent, Operand::Zero());
+  __ bge(&done);
+
+  __ li(scratch2, Operand(1));
+  __ ConvertIntToDouble(scratch2, double_scratch);
+  __ fdiv(double_result, double_scratch, double_result);
+  // Test whether result is zero.  Bail out to check for subnormal result.
+  // Due to subnormals, x^-y == (1/x)^y does not hold in all cases.
+  __ fcmpu(double_result, kDoubleRegZero);
+  __ bne(&done);
+  // double_exponent may not containe the exponent value if the input was a
+  // smi.  We set it with exponent value before bailing out.
+  __ ConvertIntToDouble(exponent, double_exponent);
+
+  // Returning or bailing out.
+  __ mflr(r0);
+  __ push(r0);
+  {
+    AllowExternalCallThatCantCauseGC scope(masm);
+    __ PrepareCallCFunction(0, 2, scratch);
+    __ MovToFloatParameters(double_base, double_exponent);
+    __ CallCFunction(ExternalReference::power_double_double_function(), 0, 2);
+  }
+  __ pop(r0);
+  __ mtlr(r0);
+  __ MovFromFloatResult(double_result);
+
+  __ bind(&done);
+  __ Ret();
+}
+
+namespace {
+
+void GenerateInternalArrayConstructorCase(MacroAssembler* masm,
+                                          ElementsKind kind) {
+  __ cmpli(r3, Operand(1));
+
+  __ Jump(CodeFactory::InternalArrayNoArgumentConstructor(masm->isolate(), kind)
+              .code(),
+          RelocInfo::CODE_TARGET, lt);
+
+  __ Jump(BUILTIN_CODE(masm->isolate(), ArrayNArgumentsConstructor),
+          RelocInfo::CODE_TARGET, gt);
+
+  if (IsFastPackedElementsKind(kind)) {
+    // We might need to create a holey array
+    // look at the first argument
+    __ LoadP(r6, MemOperand(sp, 0));
+    __ cmpi(r6, Operand::Zero());
+
+    __ Jump(CodeFactory::InternalArraySingleArgumentConstructor(
+                masm->isolate(), GetHoleyElementsKind(kind))
+                .code(),
+            RelocInfo::CODE_TARGET, ne);
+  }
+
+  __ Jump(
+      CodeFactory::InternalArraySingleArgumentConstructor(masm->isolate(), kind)
+          .code(),
+      RelocInfo::CODE_TARGET);
+}
+
+}  // namespace
+
+void Builtins::Generate_InternalArrayConstructorImpl(MacroAssembler* masm) {
+  // ----------- S t a t e -------------
+  //  -- r3 : argc
+  //  -- r4 : constructor
+  //  -- sp[0] : return address
+  //  -- sp[4] : last argument
+  // -----------------------------------
+
+  if (FLAG_debug_code) {
+    // The array construct code is only set for the global and natives
+    // builtin Array functions which always have maps.
+
+    // Initial map for the builtin Array function should be a map.
+    __ LoadP(r6, FieldMemOperand(r4, JSFunction::kPrototypeOrInitialMapOffset));
+    // Will both indicate a nullptr and a Smi.
+    __ TestIfSmi(r6, r0);
+    __ Assert(ne, AbortReason::kUnexpectedInitialMapForArrayFunction, cr0);
+    __ CompareObjectType(r6, r6, r7, MAP_TYPE);
+    __ Assert(eq, AbortReason::kUnexpectedInitialMapForArrayFunction);
+  }
+
+  // Figure out the right elements kind
+  __ LoadP(r6, FieldMemOperand(r4, JSFunction::kPrototypeOrInitialMapOffset));
+  // Load the map's "bit field 2" into |result|.
+  __ lbz(r6, FieldMemOperand(r6, Map::kBitField2Offset));
+  // Retrieve elements_kind from bit field 2.
+  __ DecodeField<Map::ElementsKindBits>(r6);
+
+  if (FLAG_debug_code) {
+    Label done;
+    __ cmpi(r6, Operand(PACKED_ELEMENTS));
+    __ beq(&done);
+    __ cmpi(r6, Operand(HOLEY_ELEMENTS));
+    __ Assert(
+        eq,
+        AbortReason::kInvalidElementsKindForInternalArrayOrInternalPackedArray);
+    __ bind(&done);
+  }
+
+  Label fast_elements_case;
+  __ cmpi(r6, Operand(PACKED_ELEMENTS));
+  __ beq(&fast_elements_case);
+  GenerateInternalArrayConstructorCase(masm, HOLEY_ELEMENTS);
+
+  __ bind(&fast_elements_case);
+  GenerateInternalArrayConstructorCase(masm, PACKED_ELEMENTS);
+}
+
 #undef __
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/src/builtins/s390/builtins-s390.cc b/deps/v8/src/builtins/s390/builtins-s390.cc
index bf7229ac691f3b..c7e955f6e4c5e3 100644
--- a/deps/v8/src/builtins/s390/builtins-s390.cc
+++ b/deps/v8/src/builtins/s390/builtins-s390.cc
@@ -5,6 +5,7 @@
 #if V8_TARGET_ARCH_S390
 
 #include "src/assembler-inl.h"
+#include "src/code-factory.h"
 #include "src/code-stubs.h"
 #include "src/debug/debug.h"
 #include "src/deoptimizer.h"
@@ -19,7 +20,7 @@ namespace internal {
 
 void Builtins::Generate_Adaptor(MacroAssembler* masm, Address address,
                                 ExitFrameType exit_frame_type) {
-  __ mov(r7, Operand(ExternalReference(address, masm->isolate())));
+  __ Move(kJavaScriptCallExtraArg1Register, ExternalReference::Create(address));
   if (exit_frame_type == BUILTIN_EXIT) {
     __ Jump(BUILTIN_CODE(masm->isolate(), AdaptorWithBuiltinExitFrame),
             RelocInfo::CODE_TARGET);
@@ -30,63 +31,6 @@ void Builtins::Generate_Adaptor(MacroAssembler* masm, Address address,
   }
 }
 
-namespace {
-
-void AdaptorWithExitFrameType(MacroAssembler* masm,
-                              Builtins::ExitFrameType exit_frame_type) {
-  // ----------- S t a t e -------------
-  //  -- r2                 : number of arguments excluding receiver
-  //  -- r3                 : target
-  //  -- r5                 : new.target
-  //  -- r7                 : entry point
-  //  -- sp[0]              : last argument
-  //  -- ...
-  //  -- sp[4 * (argc - 1)] : first argument
-  //  -- sp[4 * argc]       : receiver
-  // -----------------------------------
-  __ AssertFunction(r3);
-
-  // Make sure we operate in the context of the called function (for example
-  // ConstructStubs implemented in C++ will be run in the context of the caller
-  // instead of the callee, due to the way that [[Construct]] is defined for
-  // ordinary functions).
-  __ LoadP(cp, FieldMemOperand(r3, JSFunction::kContextOffset));
-
-  // CEntryStub expects r2 to contain the number of arguments including the
-  // receiver and the extra arguments.
-  __ AddP(r2, r2,
-          Operand(BuiltinExitFrameConstants::kNumExtraArgsWithReceiver));
-
-  // Insert extra arguments.
-  __ PushRoot(Heap::kTheHoleValueRootIndex);  // Padding.
-  __ SmiTag(r2);
-  __ Push(r2, r3, r5);
-  __ SmiUntag(r2);
-
-  // Jump to the C entry runtime stub directly here instead of using
-  // JumpToExternalReference. We have already loaded entry point to r7
-  // in Generate_adaptor.
-  __ LoadRR(r3, r7);
-  CEntryStub stub(masm->isolate(), 1, kDontSaveFPRegs, kArgvOnStack,
-                  exit_frame_type == Builtins::BUILTIN_EXIT);
-  __ Jump(stub.GetCode(), RelocInfo::CODE_TARGET);
-}
-}  // namespace
-
-void Builtins::Generate_AdaptorWithExitFrame(MacroAssembler* masm) {
-  AdaptorWithExitFrameType(masm, EXIT);
-}
-
-void Builtins::Generate_AdaptorWithBuiltinExitFrame(MacroAssembler* masm) {
-  AdaptorWithExitFrameType(masm, BUILTIN_EXIT);
-}
-
-// Load the built-in Array function from the current context.
-static void GenerateLoadArrayFunction(MacroAssembler* masm, Register result) {
-  // Load the Array function from the current native context.
-  __ LoadNativeContextSlot(Context::ARRAY_FUNCTION_INDEX, result);
-}
-
 void Builtins::Generate_InternalArrayConstructor(MacroAssembler* masm) {
   // ----------- S t a t e -------------
   //  -- r2     : number of arguments
@@ -109,44 +53,8 @@ void Builtins::Generate_InternalArrayConstructor(MacroAssembler* masm) {
   // function.
   // tail call a stub
   __ LoadRoot(r4, Heap::kUndefinedValueRootIndex);
-  InternalArrayConstructorStub stub(masm->isolate());
-  __ TailCallStub(&stub);
-}
-
-void Builtins::Generate_ArrayConstructor(MacroAssembler* masm) {
-  // ----------- S t a t e -------------
-  //  -- r2     : number of arguments
-  //  -- r3     : array function
-  //  -- lr     : return address
-  //  -- sp[...]: constructor arguments
-  // -----------------------------------
-  Label generic_array_code, one_or_more_arguments, two_or_more_arguments;
-
-  // Get the Array function.
-  GenerateLoadArrayFunction(masm, r3);
-
-  if (FLAG_debug_code) {
-    // Initial map for the builtin Array functions should be maps.
-    __ LoadP(r4, FieldMemOperand(r3, JSFunction::kPrototypeOrInitialMapOffset));
-    __ TestIfSmi(r4);
-    __ Assert(ne, AbortReason::kUnexpectedInitialMapForArrayFunction, cr0);
-    __ CompareObjectType(r4, r6, r7, MAP_TYPE);
-    __ Assert(eq, AbortReason::kUnexpectedInitialMapForArrayFunction);
-  }
-
-  // r4 is the AllocationSite - here undefined.
-  __ LoadRoot(r4, Heap::kUndefinedValueRootIndex);
-  // If r5 (new target) is undefined, then this is the 'Call' case, so move
-  // r3 (the constructor) to r5.
-  Label call;
-  __ CmpP(r5, r4);
-  __ bne(&call);
-  __ LoadRR(r5, r3);
-
-  // Run the native code for the Array function called as a normal function.
-  __ bind(&call);
-  ArrayConstructorStub stub(masm->isolate());
-  __ TailCallStub(&stub);
+  __ Jump(BUILTIN_CODE(masm->isolate(), InternalArrayConstructorImpl),
+          RelocInfo::CODE_TARGET);
 }
 
 static void GenerateTailCallToReturnedCode(MacroAssembler* masm,
@@ -247,9 +155,10 @@ void Generate_JSBuiltinsConstructStubHelper(MacroAssembler* masm) {
   __ Ret();
 }
 
+}  // namespace
+
 // The construct stub for ES5 constructor functions and ES6 class constructors.
-void Generate_JSConstructStubGeneric(MacroAssembler* masm,
-                                     bool restrict_constructor_return) {
+void Builtins::Generate_JSConstructStubGeneric(MacroAssembler* masm) {
   // ----------- S t a t e -------------
   //  --      r2: number of arguments (untagged)
   //  --      r3: constructor function
@@ -381,7 +290,7 @@ void Generate_JSConstructStubGeneric(MacroAssembler* masm,
     // If the result is an object (in the ECMA sense), we should get rid
     // of the receiver and use the result; see ECMA-262 section 13.2.2-7
     // on page 74.
-    Label use_receiver, do_throw, other_result, leave_frame;
+    Label use_receiver, do_throw, leave_frame;
 
     // If the result is undefined, we jump out to using the implicit receiver.
     __ JumpIfRoot(r2, Heap::kUndefinedValueRootIndex, &use_receiver);
@@ -390,31 +299,17 @@ void Generate_JSConstructStubGeneric(MacroAssembler* masm,
     // is a valid receiver.
 
     // If the result is a smi, it is *not* an object in the ECMA sense.
-    __ JumpIfSmi(r2, &other_result);
+    __ JumpIfSmi(r2, &use_receiver);
 
     // If the type of the result (stored in its map) is less than
     // FIRST_JS_RECEIVER_TYPE, it is not an object in the ECMA sense.
     STATIC_ASSERT(LAST_JS_RECEIVER_TYPE == LAST_TYPE);
     __ CompareObjectType(r2, r6, r6, FIRST_JS_RECEIVER_TYPE);
     __ bge(&leave_frame);
+    __ b(&use_receiver);
 
-    __ bind(&other_result);
-    // The result is now neither undefined nor an object.
-    if (restrict_constructor_return) {
-      // Throw if constructor function is a class constructor
-      __ LoadP(r6, MemOperand(fp, ConstructFrameConstants::kConstructorOffset));
-      __ LoadP(r6, FieldMemOperand(r6, JSFunction::kSharedFunctionInfoOffset));
-      __ LoadlW(r6, FieldMemOperand(r6, SharedFunctionInfo::kFlagsOffset));
-      __ TestBitMask(r6, SharedFunctionInfo::IsClassConstructorBit::kMask, r0);
-      __ beq(&use_receiver);
-    } else {
-      __ b(&use_receiver);
-    }
     __ bind(&do_throw);
-    {
-      FrameAndConstantPoolScope scope(masm, StackFrame::INTERNAL);
-      __ CallRuntime(Runtime::kThrowConstructorReturnedNonObject);
-    }
+    __ CallRuntime(Runtime::kThrowConstructorReturnedNonObject);
 
     // Throw away the result of the constructor invocation and use the
     // on-stack receiver as the result.
@@ -436,16 +331,7 @@ void Generate_JSConstructStubGeneric(MacroAssembler* masm,
   __ AddP(sp, sp, Operand(kPointerSize));
   __ Ret();
 }
-}  // namespace
 
-void Builtins::Generate_JSConstructStubGenericRestrictedReturn(
-    MacroAssembler* masm) {
-  Generate_JSConstructStubGeneric(masm, true);
-}
-void Builtins::Generate_JSConstructStubGenericUnrestrictedReturn(
-    MacroAssembler* masm) {
-  Generate_JSConstructStubGeneric(masm, false);
-}
 void Builtins::Generate_JSBuiltinsConstructStub(MacroAssembler* masm) {
   Generate_JSBuiltinsConstructStubHelper(masm);
 }
@@ -486,7 +372,7 @@ void Builtins::Generate_ResumeGeneratorTrampoline(MacroAssembler* masm) {
   Label stepping_prepared;
   ExternalReference debug_hook =
       ExternalReference::debug_hook_on_function_call_address(masm->isolate());
-  __ mov(ip, Operand(debug_hook));
+  __ Move(ip, debug_hook);
   __ LoadB(ip, MemOperand(ip));
   __ CmpSmiLiteral(ip, Smi::kZero, r0);
   __ bne(&prepare_step_in_if_stepping);
@@ -496,7 +382,7 @@ void Builtins::Generate_ResumeGeneratorTrampoline(MacroAssembler* masm) {
   ExternalReference debug_suspended_generator =
       ExternalReference::debug_suspended_generator_address(masm->isolate());
 
-  __ mov(ip, Operand(debug_suspended_generator));
+  __ Move(ip, debug_suspended_generator);
   __ LoadP(ip, MemOperand(ip));
   __ CmpP(ip, r3);
   __ beq(&prepare_step_in_suspended_generator);
@@ -520,27 +406,36 @@ void Builtins::Generate_ResumeGeneratorTrampoline(MacroAssembler* masm) {
   //  -- sp[0] : generator receiver
   // -----------------------------------
 
-  // Push holes for arguments to generator function. Since the parser forced
-  // context allocation for any variables in generators, the actual argument
-  // values have already been copied into the context and these dummy values
-  // will never be used.
+  // Copy the function arguments from the generator object's register file.
   __ LoadP(r5, FieldMemOperand(r6, JSFunction::kSharedFunctionInfoOffset));
-  __ LoadW(
-      r2, FieldMemOperand(r5, SharedFunctionInfo::kFormalParameterCountOffset));
+  __ LoadLogicalHalfWordP(
+      r5, FieldMemOperand(r5, SharedFunctionInfo::kFormalParameterCountOffset));
+  __ LoadP(r4, FieldMemOperand(
+                   r3, JSGeneratorObject::kParametersAndRegistersOffset));
   {
     Label loop, done_loop;
-    __ LoadRoot(ip, Heap::kTheHoleValueRootIndex);
-#if V8_TARGET_ARCH_S390X
-    __ CmpP(r2, Operand::Zero());
-    __ beq(&done_loop);
-#else
-    __ LoadAndTestP(r2, r2);
-    __ beq(&done_loop);
-#endif
-    __ LoadRR(r1, r2);
+    __ ShiftLeftP(r5, r5, Operand(kPointerSizeLog2));
+    __ SubP(sp, r5);
+
+    // ip = stack offset
+    // r5 = parameter array offset
+    __ LoadImmP(ip, Operand::Zero());
+    __ SubP(r5, Operand(kPointerSize));
+    __ blt(&done_loop);
+
+    __ lgfi(r1, Operand(-kPointerSize));
+
     __ bind(&loop);
-    __ push(ip);
-    __ BranchOnCount(r1, &loop);
+
+    // parameter copy loop
+    __ LoadP(r0, FieldMemOperand(r4, r5, FixedArray::kHeaderSize));
+    __ StoreP(r0, MemOperand(sp, ip));
+
+    // update offsets
+    __ lay(ip, MemOperand(ip, kPointerSize));
+
+    __ BranchRelativeOnIdxHighP(r5, r1, &loop);
+
     __ bind(&done_loop);
   }
 
@@ -548,7 +443,7 @@ void Builtins::Generate_ResumeGeneratorTrampoline(MacroAssembler* masm) {
   if (FLAG_debug_code) {
     __ LoadP(r5, FieldMemOperand(r6, JSFunction::kSharedFunctionInfoOffset));
     __ LoadP(r5, FieldMemOperand(r5, SharedFunctionInfo::kFunctionDataOffset));
-    GetSharedFunctionInfoBytecode(masm, r5, r1);
+    GetSharedFunctionInfoBytecode(masm, r5, ip);
     __ CompareObjectType(r5, r5, r5, BYTECODE_ARRAY_TYPE);
     __ Assert(eq, AbortReason::kMissingBytecodeArray);
   }
@@ -570,6 +465,8 @@ void Builtins::Generate_ResumeGeneratorTrampoline(MacroAssembler* masm) {
   {
     FrameAndConstantPoolScope scope(masm, StackFrame::INTERNAL);
     __ Push(r3, r6);
+    // Push hole as receiver since we do not use it for stepping.
+    __ PushRoot(Heap::kTheHoleValueRootIndex);
     __ CallRuntime(Runtime::kDebugOnFunctionCall);
     __ Pop(r3);
     __ LoadP(r6, FieldMemOperand(r3, JSGeneratorObject::kFunctionOffset));
@@ -638,9 +535,9 @@ static void Generate_JSEntryTrampolineHelper(MacroAssembler* masm,
     FrameScope scope(masm, StackFrame::INTERNAL);
 
     // Setup the context (we need to use the caller context from the isolate).
-    ExternalReference context_address(IsolateAddressId::kContextAddress,
-                                      masm->isolate());
-    __ mov(cp, Operand(context_address));
+    ExternalReference context_address = ExternalReference::Create(
+        IsolateAddressId::kContextAddress, masm->isolate());
+    __ Move(cp, context_address);
     __ LoadP(cp, MemOperand(cp));
 
     // Push the function and the receiver onto the stack.
@@ -859,9 +756,8 @@ static void AdvanceBytecodeOffsetOrReturn(MacroAssembler* masm,
   Register scratch2 = bytecode;
   DCHECK(!AreAliased(bytecode_array, bytecode_offset, bytecode_size_table,
                      bytecode));
-  __ mov(
-      bytecode_size_table,
-      Operand(ExternalReference::bytecode_size_table_address(masm->isolate())));
+  __ Move(bytecode_size_table,
+          ExternalReference::bytecode_size_table_address());
 
   // Check if the bytecode is a Wide or ExtraWide prefix bytecode.
   Label process_bytecode, extra_wide;
@@ -943,18 +839,13 @@ void Builtins::Generate_InterpreterEntryTrampoline(MacroAssembler* masm) {
   FrameScope frame_scope(masm, StackFrame::MANUAL);
   __ PushStandardFrame(closure);
 
-  // Get the bytecode array from the function object (or from the DebugInfo if
-  // it is present) and load it into kInterpreterBytecodeArrayRegister.
-  Label maybe_load_debug_bytecode_array, bytecode_array_loaded;
+  // Get the bytecode array from the function object and load it into
+  // kInterpreterBytecodeArrayRegister.
   __ LoadP(r2, FieldMemOperand(closure, JSFunction::kSharedFunctionInfoOffset));
   // Load original bytecode array or the debug copy.
   __ LoadP(kInterpreterBytecodeArrayRegister,
            FieldMemOperand(r2, SharedFunctionInfo::kFunctionDataOffset));
   GetSharedFunctionInfoBytecode(masm, kInterpreterBytecodeArrayRegister, r6);
-  __ LoadP(r6, FieldMemOperand(r2, SharedFunctionInfo::kDebugInfoOffset));
-  __ TestIfSmi(r6);
-  __ bne(&maybe_load_debug_bytecode_array);
-  __ bind(&bytecode_array_loaded);
 
   // Increment invocation count for the function.
   __ LoadW(r1, FieldMemOperand(feedback_vector,
@@ -1072,32 +963,6 @@ void Builtins::Generate_InterpreterEntryTrampoline(MacroAssembler* masm) {
   // The return value is in r2.
   LeaveInterpreterFrame(masm, r4);
   __ Ret();
-
-  // Load debug copy of the bytecode array if it exists.
-  // kInterpreterBytecodeArrayRegister is already loaded with
-  // SharedFunctionInfo::kFunctionDataOffset.
-  __ bind(&maybe_load_debug_bytecode_array);
-  __ LoadP(ip, FieldMemOperand(r6, DebugInfo::kDebugBytecodeArrayOffset));
-  __ JumpIfRoot(ip, Heap::kUndefinedValueRootIndex, &bytecode_array_loaded);
-
-  __ LoadRR(kInterpreterBytecodeArrayRegister, ip);
-  __ LoadP(ip, FieldMemOperand(r6, DebugInfo::kFlagsOffset));
-  __ SmiUntag(ip);
-  __ AndP(ip, ip, Operand(DebugInfo::kDebugExecutionMode));
-
-  ExternalReference debug_execution_mode =
-      ExternalReference::debug_execution_mode_address(masm->isolate());
-  __ mov(r6, Operand(debug_execution_mode));
-  __ LoadW(r6, MemOperand(r6));
-  STATIC_ASSERT(static_cast<int>(DebugInfo::kDebugExecutionMode) ==
-                static_cast<int>(DebugInfo::kSideEffects));
-  __ CmpP(r6, ip);
-  __ beq(&bytecode_array_loaded);
-
-  __ Push(closure, feedback_vector, kInterpreterBytecodeArrayRegister, closure);
-  __ CallRuntime(Runtime::kDebugApplyInstrumentation);
-  __ Pop(closure, feedback_vector, kInterpreterBytecodeArrayRegister);
-  __ b(&bytecode_array_loaded);
 }
 
 static void Generate_StackOverflowCheck(MacroAssembler* masm, Register num_args,
@@ -1216,8 +1081,8 @@ void Builtins::Generate_InterpreterPushArgsThenConstructImpl(
 
     // Tail call to the array construct stub (still in the caller
     // context at this point).
-    ArrayConstructorStub array_constructor_stub(masm->isolate());
-    __ Jump(array_constructor_stub.GetCode(), RelocInfo::CODE_TARGET);
+    Handle<Code> code = BUILTIN_CODE(masm->isolate(), ArrayConstructorImpl);
+    __ Jump(code, RelocInfo::CODE_TARGET);
   } else if (mode == InterpreterPushArgsMode::kWithFinalSpread) {
     // Call the constructor with r2, r3, and r5 unmodified.
     __ Jump(BUILTIN_CODE(masm->isolate(), ConstructWithSpread),
@@ -1266,9 +1131,9 @@ static void Generate_InterpreterEnterBytecode(MacroAssembler* masm) {
                            Code::kHeaderSize - kHeapObjectTag));
 
   // Initialize the dispatch table register.
-  __ mov(kInterpreterDispatchTableRegister,
-         Operand(ExternalReference::interpreter_dispatch_table_address(
-             masm->isolate())));
+  __ Move(
+      kInterpreterDispatchTableRegister,
+      ExternalReference::interpreter_dispatch_table_address(masm->isolate()));
 
   // Get the bytecode array pointer from the frame.
   __ LoadP(kInterpreterBytecodeArrayRegister,
@@ -1333,212 +1198,6 @@ void Builtins::Generate_InterpreterEnterBytecodeDispatch(MacroAssembler* masm) {
   Generate_InterpreterEnterBytecode(masm);
 }
 
-void Builtins::Generate_CompileLazyDeoptimizedCode(MacroAssembler* masm) {
-  // Set the code slot inside the JSFunction to CompileLazy.
-  __ Move(r4, BUILTIN_CODE(masm->isolate(), CompileLazy));
-  __ StoreP(r4, FieldMemOperand(r3, JSFunction::kCodeOffset));
-  __ RecordWriteField(r3, JSFunction::kCodeOffset, r4, r6, kLRHasNotBeenSaved,
-                      kDontSaveFPRegs, OMIT_REMEMBERED_SET, OMIT_SMI_CHECK);
-  // Jump to compile lazy.
-  Generate_CompileLazy(masm);
-}
-
-static void GetSharedFunctionInfoCode(MacroAssembler* masm, Register sfi_data,
-                                      Register scratch1) {
-  // Figure out the SFI's code object.
-  Label done;
-  Label check_is_bytecode_array;
-  Label check_is_code;
-  Label check_is_fixed_array;
-  Label check_is_pre_parsed_scope_data;
-  Label check_is_function_template_info;
-  Label check_is_interpreter_data;
-
-  Register data_type = scratch1;
-
-  // IsSmi: Is builtin
-  __ JumpIfNotSmi(sfi_data, &check_is_bytecode_array);
-  __ mov(scratch1,
-         Operand(ExternalReference::builtins_address(masm->isolate())));
-  __ SmiUntag(sfi_data, kPointerSizeLog2);
-  __ LoadP(sfi_data, MemOperand(scratch1, sfi_data));
-  __ b(&done);
-
-  // Get map for subsequent checks.
-  __ bind(&check_is_bytecode_array);
-  __ LoadP(data_type, FieldMemOperand(sfi_data, HeapObject::kMapOffset));
-  __ LoadHalfWordP(data_type,
-                   FieldMemOperand(data_type, Map::kInstanceTypeOffset));
-
-  // IsBytecodeArray: Interpret bytecode
-  __ CmpP(data_type, Operand(BYTECODE_ARRAY_TYPE));
-  __ bne(&check_is_code);
-  __ Move(sfi_data, BUILTIN_CODE(masm->isolate(), InterpreterEntryTrampoline));
-  __ b(&done);
-
-  // IsCode: Run code
-  __ bind(&check_is_code);
-  __ CmpP(data_type, Operand(CODE_TYPE));
-  __ beq(&done);
-
-  // IsFixedArray: Instantiate using AsmWasmData,
-  __ bind(&check_is_fixed_array);
-  __ CmpP(data_type, Operand(FIXED_ARRAY_TYPE));
-  __ bne(&check_is_pre_parsed_scope_data);
-  __ Move(sfi_data, BUILTIN_CODE(masm->isolate(), InstantiateAsmJs));
-  __ b(&done);
-
-  // IsPreParsedScopeData: Compile lazy
-  __ bind(&check_is_pre_parsed_scope_data);
-  __ CmpP(data_type, Operand(TUPLE2_TYPE));
-  __ bne(&check_is_function_template_info);
-  __ Move(sfi_data, BUILTIN_CODE(masm->isolate(), CompileLazy));
-  __ b(&done);
-
-  // IsFunctionTemplateInfo: API call
-  __ bind(&check_is_function_template_info);
-  __ CmpP(data_type, Operand(FUNCTION_TEMPLATE_INFO_TYPE));
-  __ bne(&check_is_interpreter_data);
-  __ Move(sfi_data, BUILTIN_CODE(masm->isolate(), HandleApiCall));
-  __ b(&done);
-
-  // IsInterpreterData: Interpret bytecode
-  __ bind(&check_is_interpreter_data);
-  if (FLAG_debug_code) {
-    __ CmpP(data_type, Operand(INTERPRETER_DATA_TYPE));
-    __ Assert(eq, AbortReason::kInvalidSharedFunctionInfoData);
-  }
-  __ Move(sfi_data, BUILTIN_CODE(masm->isolate(), HandleApiCall));
-  __ LoadP(
-      sfi_data,
-      FieldMemOperand(sfi_data, InterpreterData::kInterpreterTrampolineOffset));
-
-  __ bind(&done);
-}
-
-void Builtins::Generate_CompileLazy(MacroAssembler* masm) {
-  // ----------- S t a t e -------------
-  //  -- r2 : argument count (preserved for callee)
-  //  -- r5 : new target (preserved for callee)
-  //  -- r3 : target function (preserved for callee)
-  // -----------------------------------
-  // First lookup code, maybe we don't need to compile!
-  Label gotta_call_runtime;
-
-  Register closure = r3;
-  Register feedback_vector = r4;
-
-  // Do we have a valid feedback vector?
-  __ LoadP(feedback_vector,
-           FieldMemOperand(closure, JSFunction::kFeedbackCellOffset));
-  __ LoadP(feedback_vector,
-           FieldMemOperand(feedback_vector, Cell::kValueOffset));
-  __ JumpIfRoot(feedback_vector, Heap::kUndefinedValueRootIndex,
-                &gotta_call_runtime);
-
-  // Is there an optimization marker or optimized code in the feedback vector?
-  MaybeTailCallOptimizedCodeSlot(masm, feedback_vector, r6, r8, r7);
-
-  // We found no optimized code. Infer the code object needed for the SFI.
-  Register entry = r6;
-  __ LoadP(entry,
-           FieldMemOperand(closure, JSFunction::kSharedFunctionInfoOffset));
-  __ LoadP(entry,
-           FieldMemOperand(entry, SharedFunctionInfo::kFunctionDataOffset));
-  GetSharedFunctionInfoCode(masm, entry, r7);
-
-  // If code entry points to anything other than CompileLazy, install that.
-  __ mov(r7, Operand(masm->CodeObject()));
-  __ CmpP(entry, r7);
-  __ beq(&gotta_call_runtime);
-
-  // Install the SFI's code entry.
-  __ StoreP(entry, FieldMemOperand(closure, JSFunction::kCodeOffset), r0);
-  __ LoadRR(r8, entry);  // Write barrier clobbers r8 below.
-  __ RecordWriteField(closure, JSFunction::kCodeOffset, r8, r7,
-                      kLRHasNotBeenSaved, kDontSaveFPRegs, OMIT_REMEMBERED_SET,
-                      OMIT_SMI_CHECK);
-  __ AddP(entry, entry, Operand(Code::kHeaderSize - kHeapObjectTag));
-  __ JumpToJSEntry(entry);
-
-  __ bind(&gotta_call_runtime);
-  GenerateTailCallToReturnedCode(masm, Runtime::kCompileLazy);
-}
-
-// Lazy deserialization design doc: http://goo.gl/dxkYDZ.
-void Builtins::Generate_DeserializeLazy(MacroAssembler* masm) {
-  // ----------- S t a t e -------------
-  //  -- r2 : argument count (preserved for callee)
-  //  -- r5 : new target (preserved for callee)
-  //  -- r3 : target function (preserved for callee)
-  // -----------------------------------
-
-  Label deserialize_in_runtime;
-
-  Register target = r3;  // Must be preserved
-  Register scratch0 = r4;
-  Register scratch1 = r6;
-
-  CHECK(scratch0 != r2 && scratch0 != r5 && scratch0 != r3);
-  CHECK(scratch1 != r2 && scratch1 != r5 && scratch1 != r3);
-  CHECK(scratch0 != scratch1);
-
-  // Load the builtin id for lazy deserialization from SharedFunctionInfo.
-
-  __ AssertFunction(target);
-  __ LoadP(scratch0,
-           FieldMemOperand(target, JSFunction::kSharedFunctionInfoOffset));
-
-  __ LoadP(scratch1,
-           FieldMemOperand(scratch0, SharedFunctionInfo::kFunctionDataOffset));
-  __ AssertSmi(scratch1);
-
-  // The builtin may already have been deserialized. If that is the case, it is
-  // stored in the builtins table, and we can copy to correct code object to
-  // both the shared function info and function without calling into runtime.
-  //
-  // Otherwise, we need to call into runtime to deserialize.
-
-  {
-    // Load the code object at builtins_table[builtin_id] into scratch1.
-
-    __ SmiUntag(scratch1);
-    __ mov(scratch0,
-           Operand(ExternalReference::builtins_address(masm->isolate())));
-    __ ShiftLeftP(scratch1, scratch1, Operand(kPointerSizeLog2));
-    __ LoadP(scratch1, MemOperand(scratch0, scratch1));
-
-    // Check if the loaded code object has already been deserialized. This is
-    // the case iff it does not equal DeserializeLazy.
-
-    __ Move(scratch0, masm->CodeObject());
-    __ CmpP(scratch1, scratch0);
-    __ beq(&deserialize_in_runtime);
-  }
-  {
-    // If we've reached this spot, the target builtin has been deserialized and
-    // we simply need to copy it over to the target function.
-
-    Register target_builtin = scratch1;
-
-    __ StoreP(target_builtin, FieldMemOperand(target, JSFunction::kCodeOffset));
-    __ LoadRR(r8, target_builtin);  // Write barrier clobbers r9 below.
-    __ RecordWriteField(target, JSFunction::kCodeOffset, r8, r7,
-                        kLRHasNotBeenSaved, kDontSaveFPRegs,
-                        OMIT_REMEMBERED_SET, OMIT_SMI_CHECK);
-
-    // All copying is done. Jump to the deserialized code object.
-
-    __ AddP(target_builtin, target_builtin,
-            Operand(Code::kHeaderSize - kHeapObjectTag));
-    __ LoadRR(ip, target_builtin);
-    __ Jump(ip);
-  }
-
-  __ bind(&deserialize_in_runtime);
-  GenerateTailCallToReturnedCode(masm, Runtime::kDeserializeLazy);
-}
-
 void Builtins::Generate_InstantiateAsmJs(MacroAssembler* masm) {
   // ----------- S t a t e -------------
   //  -- r2 : argument count (preserved for callee)
@@ -1986,7 +1645,28 @@ void Builtins::Generate_CallOrConstructVarargs(MacroAssembler* masm,
   //  -- r5 : new.target (for [[Construct]])
   // -----------------------------------
 
-  __ AssertFixedArray(r4);
+  Register scratch = ip;
+
+  if (masm->emit_debug_code()) {
+    // Allow r4 to be a FixedArray, or a FixedDoubleArray if r6 == 0.
+    Label ok, fail;
+    __ AssertNotSmi(r4);
+    __ LoadP(scratch, FieldMemOperand(r4, HeapObject::kMapOffset));
+    __ LoadHalfWordP(scratch,
+                     FieldMemOperand(scratch, Map::kInstanceTypeOffset));
+    __ CmpP(scratch, Operand(FIXED_ARRAY_TYPE));
+    __ beq(&ok);
+    __ CmpP(scratch, Operand(FIXED_DOUBLE_ARRAY_TYPE));
+    __ bne(&fail);
+    __ CmpP(r6, Operand::Zero());
+    __ beq(&ok);
+    // Fall through.
+    __ bind(&fail);
+    __ Abort(AbortReason::kOperandIsNotAFixedArray);
+
+    __ bind(&ok);
+  }
+
   // Check for stack overflow.
   {
     // Check the stack for overflow. We are not trying to catch interruptions
@@ -2068,8 +1748,9 @@ void Builtins::Generate_CallOrConstructForwardVarargs(MacroAssembler* masm,
   {
     __ LoadP(r7, MemOperand(fp, JavaScriptFrameConstants::kFunctionOffset));
     __ LoadP(r7, FieldMemOperand(r7, JSFunction::kSharedFunctionInfoOffset));
-    __ LoadW(r7, FieldMemOperand(
-                     r7, SharedFunctionInfo::kFormalParameterCountOffset));
+    __ LoadLogicalHalfWordP(
+        r7,
+        FieldMemOperand(r7, SharedFunctionInfo::kFormalParameterCountOffset));
     __ LoadRR(r6, fp);
   }
   __ b(&arguments_done);
@@ -2204,7 +1885,7 @@ void Builtins::Generate_CallFunction(MacroAssembler* masm,
   //  -- cp : the function context.
   // -----------------------------------
 
-  __ LoadW(
+  __ LoadLogicalHalfWordP(
       r4, FieldMemOperand(r4, SharedFunctionInfo::kFormalParameterCountOffset));
   ParameterCount actual(r2);
   ParameterCount expected(r4);
@@ -2400,7 +2081,7 @@ void Builtins::Generate_ConstructFunction(MacroAssembler* masm) {
           RelocInfo::CODE_TARGET);
 
   __ bind(&call_generic_stub);
-  __ Jump(masm->isolate()->builtins()->JSConstructStubGeneric(),
+  __ Jump(BUILTIN_CODE(masm->isolate(), JSConstructStubGeneric),
           RelocInfo::CODE_TARGET);
 }
 
@@ -2486,42 +2167,6 @@ void Builtins::Generate_Construct(MacroAssembler* masm) {
           RelocInfo::CODE_TARGET);
 }
 
-// static
-void Builtins::Generate_AllocateInNewSpace(MacroAssembler* masm) {
-  // ----------- S t a t e -------------
-  //  -- r3 : requested object size (untagged)
-  //  -- lr : return address
-  // -----------------------------------
-  __ SmiTag(r3);
-  __ Push(r3);
-  __ LoadSmiLiteral(cp, Smi::kZero);
-  __ TailCallRuntime(Runtime::kAllocateInNewSpace);
-}
-
-// static
-void Builtins::Generate_AllocateInOldSpace(MacroAssembler* masm) {
-  // ----------- S t a t e -------------
-  //  -- r3 : requested object size (untagged)
-  //  -- lr : return address
-  // -----------------------------------
-  __ SmiTag(r3);
-  __ LoadSmiLiteral(r4, Smi::FromInt(AllocateTargetSpace::encode(OLD_SPACE)));
-  __ Push(r3, r4);
-  __ LoadSmiLiteral(cp, Smi::kZero);
-  __ TailCallRuntime(Runtime::kAllocateInTargetSpace);
-}
-
-// static
-void Builtins::Generate_Abort(MacroAssembler* masm) {
-  // ----------- S t a t e -------------
-  //  -- r3 : message_id as Smi
-  //  -- lr : return address
-  // -----------------------------------
-  __ push(r3);
-  __ LoadSmiLiteral(cp, Smi::kZero);
-  __ TailCallRuntime(Runtime::kAbort);
-}
-
 void Builtins::Generate_ArgumentsAdaptorTrampoline(MacroAssembler* masm) {
   // ----------- S t a t e -------------
   //  -- r2 : actual number of arguments
@@ -2533,10 +2178,10 @@ void Builtins::Generate_ArgumentsAdaptorTrampoline(MacroAssembler* masm) {
   Label invoke, dont_adapt_arguments, stack_overflow;
 
   Label enough, too_few;
-  __ CmpP(r2, r4);
+  __ tmll(r4, Operand(SharedFunctionInfo::kDontAdaptArgumentsSentinel));
+  __ b(Condition(1), &dont_adapt_arguments);
+  __ CmpLogicalP(r2, r4);
   __ blt(&too_few);
-  __ CmpP(r4, Operand(SharedFunctionInfo::kDontAdaptArgumentsSentinel));
-  __ beq(&dont_adapt_arguments);
 
   {  // Enough parameters: actual >= expected
     __ bind(&enough);
@@ -2655,10 +2300,12 @@ void Builtins::Generate_ArgumentsAdaptorTrampoline(MacroAssembler* masm) {
 }
 
 void Builtins::Generate_WasmCompileLazy(MacroAssembler* masm) {
+  // The function index was put in r7 by the jump table trampoline.
+  // Convert to Smi for the runtime call.
+  __ SmiTag(r7, r7);
   {
-    FrameAndConstantPoolScope scope(masm, StackFrame::INTERNAL);
-
-    auto wasm_instance_reg = r6;  // TODO(titzer): put in a common place.
+    TrapOnAbortScope trap_on_abort_scope(masm);  // Avoid calls to Abort.
+    FrameAndConstantPoolScope scope(masm, StackFrame::WASM_COMPILE_LAZY);
 
     // Save all parameter registers (see wasm-linkage.cc). They might be
     // overwritten in the runtime call below. We don't have any callee-saved
@@ -2672,16 +2319,18 @@ void Builtins::Generate_WasmCompileLazy(MacroAssembler* masm) {
     __ MultiPush(gp_regs);
     __ MultiPushDoubles(fp_regs);
 
-    // Pass the WASM instance as an explicit argument to WasmCompileLazy.
-    __ Push(wasm_instance_reg);
-    // Initialize the JavaScript context with 0. CEntryStub will use it to
+    // Pass instance and function index as explicit arguments to the runtime
+    // function.
+    __ Push(kWasmInstanceRegister, r7);
+    // Load the correct CEntry builtin from the instance object.
+    __ LoadP(r4, FieldMemOperand(kWasmInstanceRegister,
+                                 WasmInstanceObject::kCEntryStubOffset));
+    // Initialize the JavaScript context with 0. CEntry will use it to
     // set the current context on the isolate.
     __ LoadSmiLiteral(cp, Smi::kZero);
-    __ CallRuntime(Runtime::kWasmCompileLazy);
-    // The entrypoint address is the first return value.
+    __ CallRuntimeWithCEntry(Runtime::kWasmCompileLazy, r4);
+    // The entrypoint address is the return value.
     __ LoadRR(ip, r2);
-    // The WASM instance is the second return value.
-    __ LoadRR(wasm_instance_reg, kReturnRegister1);
 
     // Restore registers.
     __ MultiPopDoubles(fp_regs);
@@ -2691,6 +2340,470 @@ void Builtins::Generate_WasmCompileLazy(MacroAssembler* masm) {
   __ Jump(ip);
 }
 
+void Builtins::Generate_CEntry(MacroAssembler* masm, int result_size,
+                               SaveFPRegsMode save_doubles, ArgvMode argv_mode,
+                               bool builtin_exit_frame) {
+  // Called from JavaScript; parameters are on stack as if calling JS function.
+  // r2: number of arguments including receiver
+  // r3: pointer to builtin function
+  // fp: frame pointer  (restored after C call)
+  // sp: stack pointer  (restored as callee's sp after C call)
+  // cp: current context  (C callee-saved)
+  //
+  // If argv_mode == kArgvInRegister:
+  // r4: pointer to the first argument
+  ProfileEntryHookStub::MaybeCallEntryHook(masm);
+
+  __ LoadRR(r7, r3);
+
+  if (argv_mode == kArgvInRegister) {
+    // Move argv into the correct register.
+    __ LoadRR(r3, r4);
+  } else {
+    // Compute the argv pointer.
+    __ ShiftLeftP(r3, r2, Operand(kPointerSizeLog2));
+    __ lay(r3, MemOperand(r3, sp, -kPointerSize));
+  }
+
+  // Enter the exit frame that transitions from JavaScript to C++.
+  FrameScope scope(masm, StackFrame::MANUAL);
+
+  // Need at least one extra slot for return address location.
+  int arg_stack_space = 1;
+
+  // Pass buffer for return value on stack if necessary
+  bool needs_return_buffer =
+      result_size == 2 && !ABI_RETURNS_OBJECTPAIR_IN_REGS;
+  if (needs_return_buffer) {
+    arg_stack_space += result_size;
+  }
+
+#if V8_TARGET_ARCH_S390X
+  // 64-bit linux pass Argument object by reference not value
+  arg_stack_space += 2;
+#endif
+
+  __ EnterExitFrame(
+      save_doubles, arg_stack_space,
+      builtin_exit_frame ? StackFrame::BUILTIN_EXIT : StackFrame::EXIT);
+
+  // Store a copy of argc, argv in callee-saved registers for later.
+  __ LoadRR(r6, r2);
+  __ LoadRR(r8, r3);
+  // r2, r6: number of arguments including receiver  (C callee-saved)
+  // r3, r8: pointer to the first argument
+  // r7: pointer to builtin function  (C callee-saved)
+
+  // Result returned in registers or stack, depending on result size and ABI.
+
+  Register isolate_reg = r4;
+  if (needs_return_buffer) {
+    // The return value is 16-byte non-scalar value.
+    // Use frame storage reserved by calling function to pass return
+    // buffer as implicit first argument in R2.  Shfit original parameters
+    // by one register each.
+    __ LoadRR(r4, r3);
+    __ LoadRR(r3, r2);
+    __ la(r2, MemOperand(sp, (kStackFrameExtraParamSlot + 1) * kPointerSize));
+    isolate_reg = r5;
+  }
+  // Call C built-in.
+  __ Move(isolate_reg, ExternalReference::isolate_address(masm->isolate()));
+
+  Register target = r7;
+
+  // To let the GC traverse the return address of the exit frames, we need to
+  // know where the return address is. The CEntryStub is unmovable, so
+  // we can store the address on the stack to be able to find it again and
+  // we never have to restore it, because it will not change.
+  {
+    Label return_label;
+    __ larl(r14, &return_label);  // Generate the return addr of call later.
+    __ StoreP(r14, MemOperand(sp, kStackFrameRASlot * kPointerSize));
+
+    // zLinux ABI requires caller's frame to have sufficient space for callee
+    // preserved regsiter save area.
+    // __ lay(sp, MemOperand(sp, -kCalleeRegisterSaveAreaSize));
+    __ b(target);
+    __ bind(&return_label);
+    // __ la(sp, MemOperand(sp, +kCalleeRegisterSaveAreaSize));
+  }
+
+  // If return value is on the stack, pop it to registers.
+  if (needs_return_buffer) {
+    __ LoadP(r3, MemOperand(r2, kPointerSize));
+    __ LoadP(r2, MemOperand(r2));
+  }
+
+  // Check result for exception sentinel.
+  Label exception_returned;
+  __ CompareRoot(r2, Heap::kExceptionRootIndex);
+  __ beq(&exception_returned, Label::kNear);
+
+  // Check that there is no pending exception, otherwise we
+  // should have returned the exception sentinel.
+  if (FLAG_debug_code) {
+    Label okay;
+    ExternalReference pending_exception_address = ExternalReference::Create(
+        IsolateAddressId::kPendingExceptionAddress, masm->isolate());
+    __ Move(r1, pending_exception_address);
+    __ LoadP(r1, MemOperand(r1));
+    __ CompareRoot(r1, Heap::kTheHoleValueRootIndex);
+    // Cannot use check here as it attempts to generate call into runtime.
+    __ beq(&okay, Label::kNear);
+    __ stop("Unexpected pending exception");
+    __ bind(&okay);
+  }
+
+  // Exit C frame and return.
+  // r2:r3: result
+  // sp: stack pointer
+  // fp: frame pointer
+  Register argc = argv_mode == kArgvInRegister
+                      // We don't want to pop arguments so set argc to no_reg.
+                      ? no_reg
+                      // r6: still holds argc (callee-saved).
+                      : r6;
+  __ LeaveExitFrame(save_doubles, argc);
+  __ b(r14);
+
+  // Handling of exception.
+  __ bind(&exception_returned);
+
+  ExternalReference pending_handler_context_address = ExternalReference::Create(
+      IsolateAddressId::kPendingHandlerContextAddress, masm->isolate());
+  ExternalReference pending_handler_entrypoint_address =
+      ExternalReference::Create(
+          IsolateAddressId::kPendingHandlerEntrypointAddress, masm->isolate());
+  ExternalReference pending_handler_fp_address = ExternalReference::Create(
+      IsolateAddressId::kPendingHandlerFPAddress, masm->isolate());
+  ExternalReference pending_handler_sp_address = ExternalReference::Create(
+      IsolateAddressId::kPendingHandlerSPAddress, masm->isolate());
+
+  // Ask the runtime for help to determine the handler. This will set r3 to
+  // contain the current pending exception, don't clobber it.
+  ExternalReference find_handler =
+      ExternalReference::Create(Runtime::kUnwindAndFindExceptionHandler);
+  {
+    FrameScope scope(masm, StackFrame::MANUAL);
+    __ PrepareCallCFunction(3, 0, r2);
+    __ LoadImmP(r2, Operand::Zero());
+    __ LoadImmP(r3, Operand::Zero());
+    __ Move(r4, ExternalReference::isolate_address(masm->isolate()));
+    __ CallCFunction(find_handler, 3);
+  }
+
+  // Retrieve the handler context, SP and FP.
+  __ Move(cp, pending_handler_context_address);
+  __ LoadP(cp, MemOperand(cp));
+  __ Move(sp, pending_handler_sp_address);
+  __ LoadP(sp, MemOperand(sp));
+  __ Move(fp, pending_handler_fp_address);
+  __ LoadP(fp, MemOperand(fp));
+
+  // If the handler is a JS frame, restore the context to the frame. Note that
+  // the context will be set to (cp == 0) for non-JS frames.
+  Label skip;
+  __ CmpP(cp, Operand::Zero());
+  __ beq(&skip, Label::kNear);
+  __ StoreP(cp, MemOperand(fp, StandardFrameConstants::kContextOffset));
+  __ bind(&skip);
+
+  // Reset the masking register.
+  if (FLAG_branch_load_poisoning) {
+    __ ResetSpeculationPoisonRegister();
+  }
+
+  // Compute the handler entry address and jump to it.
+  __ Move(r3, pending_handler_entrypoint_address);
+  __ LoadP(r3, MemOperand(r3));
+  __ Jump(r3);
+}
+
+void Builtins::Generate_DoubleToI(MacroAssembler* masm) {
+  Label out_of_range, only_low, negate, done, fastpath_done;
+  Register result_reg = r2;
+
+  TrapOnAbortScope trap_on_abort_scope(masm);  // Avoid calls to Abort.
+
+  // Immediate values for this stub fit in instructions, so it's safe to use ip.
+  Register scratch = GetRegisterThatIsNotOneOf(result_reg);
+  Register scratch_low = GetRegisterThatIsNotOneOf(result_reg, scratch);
+  Register scratch_high =
+      GetRegisterThatIsNotOneOf(result_reg, scratch, scratch_low);
+  DoubleRegister double_scratch = kScratchDoubleReg;
+
+  __ Push(result_reg, scratch);
+  // Account for saved regs.
+  int argument_offset = 2 * kPointerSize;
+
+  // Load double input.
+  __ LoadDouble(double_scratch, MemOperand(sp, argument_offset));
+
+  // Do fast-path convert from double to int.
+  __ ConvertDoubleToInt64(result_reg, double_scratch);
+
+  // Test for overflow
+  __ TestIfInt32(result_reg);
+  __ beq(&fastpath_done, Label::kNear);
+
+  __ Push(scratch_high, scratch_low);
+  // Account for saved regs.
+  argument_offset += 2 * kPointerSize;
+
+  __ LoadlW(scratch_high,
+            MemOperand(sp, argument_offset + Register::kExponentOffset));
+  __ LoadlW(scratch_low,
+            MemOperand(sp, argument_offset + Register::kMantissaOffset));
+
+  __ ExtractBitMask(scratch, scratch_high, HeapNumber::kExponentMask);
+  // Load scratch with exponent - 1. This is faster than loading
+  // with exponent because Bias + 1 = 1024 which is a *S390* immediate value.
+  STATIC_ASSERT(HeapNumber::kExponentBias + 1 == 1024);
+  __ SubP(scratch, Operand(HeapNumber::kExponentBias + 1));
+  // If exponent is greater than or equal to 84, the 32 less significant
+  // bits are 0s (2^84 = 1, 52 significant bits, 32 uncoded bits),
+  // the result is 0.
+  // Compare exponent with 84 (compare exponent - 1 with 83).
+  __ CmpP(scratch, Operand(83));
+  __ bge(&out_of_range, Label::kNear);
+
+  // If we reach this code, 31 <= exponent <= 83.
+  // So, we don't have to handle cases where 0 <= exponent <= 20 for
+  // which we would need to shift right the high part of the mantissa.
+  // Scratch contains exponent - 1.
+  // Load scratch with 52 - exponent (load with 51 - (exponent - 1)).
+  __ Load(r0, Operand(51));
+  __ SubP(scratch, r0, scratch);
+  __ CmpP(scratch, Operand::Zero());
+  __ ble(&only_low, Label::kNear);
+  // 21 <= exponent <= 51, shift scratch_low and scratch_high
+  // to generate the result.
+  __ ShiftRight(scratch_low, scratch_low, scratch);
+  // Scratch contains: 52 - exponent.
+  // We needs: exponent - 20.
+  // So we use: 32 - scratch = 32 - 52 + exponent = exponent - 20.
+  __ Load(r0, Operand(32));
+  __ SubP(scratch, r0, scratch);
+  __ ExtractBitMask(result_reg, scratch_high, HeapNumber::kMantissaMask);
+  // Set the implicit 1 before the mantissa part in scratch_high.
+  STATIC_ASSERT(HeapNumber::kMantissaBitsInTopWord >= 16);
+  __ Load(r0, Operand(1 << ((HeapNumber::kMantissaBitsInTopWord)-16)));
+  __ ShiftLeftP(r0, r0, Operand(16));
+  __ OrP(result_reg, result_reg, r0);
+  __ ShiftLeft(r0, result_reg, scratch);
+  __ OrP(result_reg, scratch_low, r0);
+  __ b(&negate, Label::kNear);
+
+  __ bind(&out_of_range);
+  __ mov(result_reg, Operand::Zero());
+  __ b(&done, Label::kNear);
+
+  __ bind(&only_low);
+  // 52 <= exponent <= 83, shift only scratch_low.
+  // On entry, scratch contains: 52 - exponent.
+  __ LoadComplementRR(scratch, scratch);
+  __ ShiftLeft(result_reg, scratch_low, scratch);
+
+  __ bind(&negate);
+  // If input was positive, scratch_high ASR 31 equals 0 and
+  // scratch_high LSR 31 equals zero.
+  // New result = (result eor 0) + 0 = result.
+  // If the input was negative, we have to negate the result.
+  // Input_high ASR 31 equals 0xFFFFFFFF and scratch_high LSR 31 equals 1.
+  // New result = (result eor 0xFFFFFFFF) + 1 = 0 - result.
+  __ ShiftRightArith(r0, scratch_high, Operand(31));
+#if V8_TARGET_ARCH_S390X
+  __ lgfr(r0, r0);
+  __ ShiftRightP(r0, r0, Operand(32));
+#endif
+  __ XorP(result_reg, r0);
+  __ ShiftRight(r0, scratch_high, Operand(31));
+  __ AddP(result_reg, r0);
+
+  __ bind(&done);
+  __ Pop(scratch_high, scratch_low);
+  argument_offset -= 2 * kPointerSize;
+
+  __ bind(&fastpath_done);
+  __ StoreP(result_reg, MemOperand(sp, argument_offset));
+  __ Pop(result_reg, scratch);
+
+  __ Ret();
+}
+
+void Builtins::Generate_MathPowInternal(MacroAssembler* masm) {
+  const Register exponent = r4;
+  const DoubleRegister double_base = d1;
+  const DoubleRegister double_exponent = d2;
+  const DoubleRegister double_result = d3;
+  const DoubleRegister double_scratch = d0;
+  const Register scratch = r1;
+  const Register scratch2 = r9;
+
+  Label call_runtime, done, int_exponent;
+
+  // Detect integer exponents stored as double.
+  __ TryDoubleToInt32Exact(scratch, double_exponent, scratch2, double_scratch);
+  __ beq(&int_exponent, Label::kNear);
+
+  __ push(r14);
+  {
+    AllowExternalCallThatCantCauseGC scope(masm);
+    __ PrepareCallCFunction(0, 2, scratch);
+    __ MovToFloatParameters(double_base, double_exponent);
+    __ CallCFunction(ExternalReference::power_double_double_function(), 0, 2);
+  }
+  __ pop(r14);
+  __ MovFromFloatResult(double_result);
+  __ b(&done);
+
+  // Calculate power with integer exponent.
+  __ bind(&int_exponent);
+
+  // Get two copies of exponent in the registers scratch and exponent.
+  // Exponent has previously been stored into scratch as untagged integer.
+  __ LoadRR(exponent, scratch);
+
+  __ ldr(double_scratch, double_base);  // Back up base.
+  __ LoadImmP(scratch2, Operand(1));
+  __ ConvertIntToDouble(double_result, scratch2);
+
+  // Get absolute value of exponent.
+  Label positive_exponent;
+  __ CmpP(scratch, Operand::Zero());
+  __ bge(&positive_exponent, Label::kNear);
+  __ LoadComplementRR(scratch, scratch);
+  __ bind(&positive_exponent);
+
+  Label while_true, no_carry, loop_end;
+  __ bind(&while_true);
+  __ mov(scratch2, Operand(1));
+  __ AndP(scratch2, scratch);
+  __ beq(&no_carry, Label::kNear);
+  __ mdbr(double_result, double_scratch);
+  __ bind(&no_carry);
+  __ ShiftRightP(scratch, scratch, Operand(1));
+  __ LoadAndTestP(scratch, scratch);
+  __ beq(&loop_end, Label::kNear);
+  __ mdbr(double_scratch, double_scratch);
+  __ b(&while_true);
+  __ bind(&loop_end);
+
+  __ CmpP(exponent, Operand::Zero());
+  __ bge(&done);
+
+  // get 1/double_result:
+  __ ldr(double_scratch, double_result);
+  __ LoadImmP(scratch2, Operand(1));
+  __ ConvertIntToDouble(double_result, scratch2);
+  __ ddbr(double_result, double_scratch);
+
+  // Test whether result is zero.  Bail out to check for subnormal result.
+  // Due to subnormals, x^-y == (1/x)^y does not hold in all cases.
+  __ lzdr(kDoubleRegZero);
+  __ cdbr(double_result, kDoubleRegZero);
+  __ bne(&done, Label::kNear);
+  // double_exponent may not containe the exponent value if the input was a
+  // smi.  We set it with exponent value before bailing out.
+  __ ConvertIntToDouble(double_exponent, exponent);
+
+  // Returning or bailing out.
+  __ push(r14);
+  {
+    AllowExternalCallThatCantCauseGC scope(masm);
+    __ PrepareCallCFunction(0, 2, scratch);
+    __ MovToFloatParameters(double_base, double_exponent);
+    __ CallCFunction(ExternalReference::power_double_double_function(), 0, 2);
+  }
+  __ pop(r14);
+  __ MovFromFloatResult(double_result);
+
+  __ bind(&done);
+  __ Ret();
+}
+
+namespace {
+
+void GenerateInternalArrayConstructorCase(MacroAssembler* masm,
+                                          ElementsKind kind) {
+  __ CmpLogicalP(r2, Operand(1));
+
+  __ Jump(CodeFactory::InternalArrayNoArgumentConstructor(masm->isolate(), kind)
+              .code(),
+          RelocInfo::CODE_TARGET, lt);
+
+  __ Jump(BUILTIN_CODE(masm->isolate(), ArrayNArgumentsConstructor),
+          RelocInfo::CODE_TARGET, gt);
+
+  if (IsFastPackedElementsKind(kind)) {
+    // We might need to create a holey array
+    // look at the first argument
+    __ LoadP(r5, MemOperand(sp, 0));
+    __ CmpP(r5, Operand::Zero());
+
+    __ Jump(CodeFactory::InternalArraySingleArgumentConstructor(
+                masm->isolate(), GetHoleyElementsKind(kind))
+                .code(),
+            RelocInfo::CODE_TARGET, ne);
+  }
+
+  __ Jump(
+      CodeFactory::InternalArraySingleArgumentConstructor(masm->isolate(), kind)
+          .code(),
+      RelocInfo::CODE_TARGET);
+}
+
+}  // namespace
+
+void Builtins::Generate_InternalArrayConstructorImpl(MacroAssembler* masm) {
+  // ----------- S t a t e -------------
+  //  -- r2 : argc
+  //  -- r3 : constructor
+  //  -- sp[0] : return address
+  //  -- sp[4] : last argument
+  // -----------------------------------
+
+  if (FLAG_debug_code) {
+    // The array construct code is only set for the global and natives
+    // builtin Array functions which always have maps.
+
+    // Initial map for the builtin Array function should be a map.
+    __ LoadP(r5, FieldMemOperand(r3, JSFunction::kPrototypeOrInitialMapOffset));
+    // Will both indicate a nullptr and a Smi.
+    __ TestIfSmi(r5);
+    __ Assert(ne, AbortReason::kUnexpectedInitialMapForArrayFunction, cr0);
+    __ CompareObjectType(r5, r5, r6, MAP_TYPE);
+    __ Assert(eq, AbortReason::kUnexpectedInitialMapForArrayFunction);
+  }
+
+  // Figure out the right elements kind
+  __ LoadP(r5, FieldMemOperand(r3, JSFunction::kPrototypeOrInitialMapOffset));
+  // Load the map's "bit field 2" into |result|.
+  __ LoadlB(r5, FieldMemOperand(r5, Map::kBitField2Offset));
+  // Retrieve elements_kind from bit field 2.
+  __ DecodeField<Map::ElementsKindBits>(r5);
+
+  if (FLAG_debug_code) {
+    Label done;
+    __ CmpP(r5, Operand(PACKED_ELEMENTS));
+    __ beq(&done);
+    __ CmpP(r5, Operand(HOLEY_ELEMENTS));
+    __ Assert(
+        eq,
+        AbortReason::kInvalidElementsKindForInternalArrayOrInternalPackedArray);
+    __ bind(&done);
+  }
+
+  Label fast_elements_case;
+  __ CmpP(r5, Operand(PACKED_ELEMENTS));
+  __ beq(&fast_elements_case);
+  GenerateInternalArrayConstructorCase(masm, HOLEY_ELEMENTS);
+
+  __ bind(&fast_elements_case);
+  GenerateInternalArrayConstructorCase(masm, PACKED_ELEMENTS);
+}
+
 #undef __
 
 }  // namespace internal
diff --git a/deps/v8/src/builtins/setup-builtins-internal.cc b/deps/v8/src/builtins/setup-builtins-internal.cc
index 45040844c36ed4..ab0180e825bf2e 100644
--- a/deps/v8/src/builtins/setup-builtins-internal.cc
+++ b/deps/v8/src/builtins/setup-builtins-internal.cc
@@ -30,15 +30,24 @@ void PostBuildProfileAndTracing(Isolate* isolate, Code* code,
                                    AbstractCode::cast(code), name));
 #ifdef ENABLE_DISASSEMBLER
   if (FLAG_print_builtin_code) {
-    CodeTracer::Scope trace_scope(isolate->GetCodeTracer());
-    OFStream os(trace_scope.file());
-    os << "Builtin: " << name << "\n";
-    code->Disassemble(name, os);
-    os << "\n";
+    code->PrintBuiltinCode(isolate, name);
   }
 #endif
 }
 
+AssemblerOptions BuiltinAssemblerOptions(Isolate* isolate,
+                                         int32_t builtin_index) {
+  AssemblerOptions options = AssemblerOptions::Default(isolate);
+  if (isolate->ShouldLoadConstantsFromRootList() &&
+      Builtins::IsIsolateIndependent(builtin_index) &&
+      isolate->heap()->memory_allocator()->code_range()->valid() &&
+      isolate->heap()->memory_allocator()->code_range()->size() <=
+          kMaxPCRelativeCodeRangeInMB * MB) {
+    options.use_pc_relative_calls_and_jumps = true;
+  }
+  return options;
+}
+
 typedef void (*MacroAssemblerGenerator)(MacroAssembler*);
 typedef void (*CodeAssemblerGenerator)(compiler::CodeAssemblerState*);
 
@@ -50,7 +59,10 @@ Handle<Code> BuildPlaceholder(Isolate* isolate, int32_t builtin_index) {
   DCHECK(!masm.has_frame());
   {
     FrameScope scope(&masm, StackFrame::NONE);
-    masm.CallRuntime(Runtime::kSystemBreak);
+    // The contents of placeholder don't matter, as long as they don't create
+    // embedded constants or external references.
+    masm.Move(kJavaScriptCallCodeStartRegister, Smi::kZero);
+    masm.Call(kJavaScriptCallCodeStartRegister);
   }
   CodeDesc desc;
   masm.GetCode(isolate, &desc);
@@ -68,7 +80,10 @@ Code* BuildWithMacroAssembler(Isolate* isolate, int32_t builtin_index,
   CanonicalHandleScope canonical(isolate);
   const size_t buffer_size = 32 * KB;
   byte buffer[buffer_size];  // NOLINT(runtime/arrays)
-  MacroAssembler masm(isolate, buffer, buffer_size, CodeObjectRequired::kYes);
+
+  MacroAssembler masm(isolate, BuiltinAssemblerOptions(isolate, builtin_index),
+                      buffer, buffer_size, CodeObjectRequired::kYes);
+  masm.set_builtin_index(builtin_index);
   DCHECK(!masm.has_frame());
   generator(&masm);
   CodeDesc desc;
@@ -88,7 +103,9 @@ Code* BuildAdaptor(Isolate* isolate, int32_t builtin_index,
   CanonicalHandleScope canonical(isolate);
   const size_t buffer_size = 32 * KB;
   byte buffer[buffer_size];  // NOLINT(runtime/arrays)
-  MacroAssembler masm(isolate, buffer, buffer_size, CodeObjectRequired::kYes);
+  MacroAssembler masm(isolate, BuiltinAssemblerOptions(isolate, builtin_index),
+                      buffer, buffer_size, CodeObjectRequired::kYes);
+  masm.set_builtin_index(builtin_index);
   DCHECK(!masm.has_frame());
   Builtins::Generate_Adaptor(&masm, builtin_address, exit_frame_type);
   CodeDesc desc;
@@ -116,9 +133,10 @@ Code* BuildWithCodeStubAssemblerJS(Isolate* isolate, int32_t builtin_index,
       (argc == SharedFunctionInfo::kDontAdaptArgumentsSentinel) ? 0 : argc + 1;
   compiler::CodeAssemblerState state(
       isolate, &zone, argc_with_recv, Code::BUILTIN, name,
-      PoisoningMitigationLevel::kOff, builtin_index);
+      PoisoningMitigationLevel::kDontPoison, builtin_index);
   generator(&state);
-  Handle<Code> code = compiler::CodeAssembler::GenerateCode(&state);
+  Handle<Code> code = compiler::CodeAssembler::GenerateCode(
+      &state, BuiltinAssemblerOptions(isolate, builtin_index));
   PostBuildProfileAndTracing(isolate, *code, name);
   return *code;
 }
@@ -138,25 +156,29 @@ Code* BuildWithCodeStubAssemblerCS(Isolate* isolate, int32_t builtin_index,
   Zone zone(isolate->allocator(), ZONE_NAME, segment_size);
   // The interface descriptor with given key must be initialized at this point
   // and this construction just queries the details from the descriptors table.
-  CallInterfaceDescriptor descriptor(isolate, interface_descriptor);
+  CallInterfaceDescriptor descriptor(interface_descriptor);
   // Ensure descriptor is already initialized.
+  DCHECK_EQ(result_size, descriptor.GetReturnCount());
   DCHECK_LE(0, descriptor.GetRegisterParameterCount());
-  compiler::CodeAssemblerState state(isolate, &zone, descriptor, Code::BUILTIN,
-                                     name, PoisoningMitigationLevel::kOff,
-                                     result_size, 0, builtin_index);
+  compiler::CodeAssemblerState state(
+      isolate, &zone, descriptor, Code::BUILTIN, name,
+      PoisoningMitigationLevel::kDontPoison, 0, builtin_index);
   generator(&state);
-  Handle<Code> code = compiler::CodeAssembler::GenerateCode(&state);
+  Handle<Code> code = compiler::CodeAssembler::GenerateCode(
+      &state, BuiltinAssemblerOptions(isolate, builtin_index));
   PostBuildProfileAndTracing(isolate, *code, name);
   return *code;
 }
 }  // anonymous namespace
 
+// static
 void SetupIsolateDelegate::AddBuiltin(Builtins* builtins, int index,
                                       Code* code) {
   DCHECK_EQ(index, code->builtin_index());
-  builtins->builtins_[index] = code;
+  builtins->set_builtin(index, code);
 }
 
+// static
 void SetupIsolateDelegate::PopulateWithPlaceholders(Isolate* isolate) {
   // Fill the builtins list with placeholders. References to these placeholder
   // builtins are eventually replaced by the actual builtins. This is to
@@ -169,13 +191,16 @@ void SetupIsolateDelegate::PopulateWithPlaceholders(Isolate* isolate) {
   }
 }
 
+// static
 void SetupIsolateDelegate::ReplacePlaceholders(Isolate* isolate) {
   // Replace references from all code objects to placeholders.
   Builtins* builtins = isolate->builtins();
   DisallowHeapAllocation no_gc;
   CodeSpaceMemoryModificationScope modification_scope(isolate->heap());
-  static const int kRelocMask = RelocInfo::ModeMask(RelocInfo::CODE_TARGET) |
-                                RelocInfo::ModeMask(RelocInfo::EMBEDDED_OBJECT);
+  static const int kRelocMask =
+      RelocInfo::ModeMask(RelocInfo::CODE_TARGET) |
+      RelocInfo::ModeMask(RelocInfo::EMBEDDED_OBJECT) |
+      RelocInfo::ModeMask(RelocInfo::RELATIVE_CODE_TARGET);
   HeapIterator iterator(isolate->heap());
   while (HeapObject* obj = iterator.next()) {
     if (!obj->IsCode()) continue;
@@ -183,11 +208,12 @@ void SetupIsolateDelegate::ReplacePlaceholders(Isolate* isolate) {
     bool flush_icache = false;
     for (RelocIterator it(code, kRelocMask); !it.done(); it.next()) {
       RelocInfo* rinfo = it.rinfo();
-      if (RelocInfo::IsCodeTarget(rinfo->rmode())) {
+      if (RelocInfo::IsCodeTargetMode(rinfo->rmode())) {
         Code* target = Code::GetCodeFromTargetAddress(rinfo->target_address());
+        DCHECK_IMPLIES(RelocInfo::IsRelativeCodeTarget(rinfo->rmode()),
+                       Builtins::IsIsolateIndependent(target->builtin_index()));
         if (!target->is_builtin()) continue;
-        Code* new_target =
-            Code::cast(builtins->builtins_[target->builtin_index()]);
+        Code* new_target = builtins->builtin(target->builtin_index());
         rinfo->set_target_address(new_target->raw_instruction_start(),
                                   UPDATE_WRITE_BARRIER, SKIP_ICACHE_FLUSH);
       } else {
@@ -196,10 +222,9 @@ void SetupIsolateDelegate::ReplacePlaceholders(Isolate* isolate) {
         if (!object->IsCode()) continue;
         Code* target = Code::cast(object);
         if (!target->is_builtin()) continue;
-        Code* new_target =
-            Code::cast(builtins->builtins_[target->builtin_index()]);
-        rinfo->set_target_object(new_target, UPDATE_WRITE_BARRIER,
-                                 SKIP_ICACHE_FLUSH);
+        Code* new_target = builtins->builtin(target->builtin_index());
+        rinfo->set_target_object(isolate->heap(), new_target,
+                                 UPDATE_WRITE_BARRIER, SKIP_ICACHE_FLUSH);
       }
       flush_icache = true;
     }
@@ -210,6 +235,7 @@ void SetupIsolateDelegate::ReplacePlaceholders(Isolate* isolate) {
   }
 }
 
+// static
 void SetupIsolateDelegate::SetupBuiltinsInternal(Isolate* isolate) {
   Builtins* builtins = isolate->builtins();
   DCHECK(!builtins->initialized_);
@@ -234,7 +260,6 @@ void SetupIsolateDelegate::SetupBuiltinsInternal(Isolate* isolate) {
       isolate, index, &Builtins::Generate_##Name, Argc, #Name); \
   AddBuiltin(builtins, index++, code);
 #define BUILD_TFC(Name, InterfaceDescriptor, result_size)        \
-  { InterfaceDescriptor##Descriptor descriptor(isolate); }       \
   code = BuildWithCodeStubAssemblerCS(                           \
       isolate, index, &Builtins::Generate_##Name,                \
       CallDescriptors::InterfaceDescriptor, #Name, result_size); \
@@ -246,7 +271,6 @@ void SetupIsolateDelegate::SetupBuiltinsInternal(Isolate* isolate) {
                                    CallDescriptors::Name, #Name, 1);           \
   AddBuiltin(builtins, index++, code);
 #define BUILD_TFH(Name, InterfaceDescriptor)               \
-  { InterfaceDescriptor##Descriptor descriptor(isolate); } \
   /* Return size for IC builtins/handlers is always 1. */  \
   code = BuildWithCodeStubAssemblerCS(                     \
       isolate, index, &Builtins::Generate_##Name,          \
@@ -271,16 +295,14 @@ void SetupIsolateDelegate::SetupBuiltinsInternal(Isolate* isolate) {
 
   ReplacePlaceholders(isolate);
 
-#define SET_PROMISE_REJECTION_PREDICTION(Name)       \
-  Code::cast(builtins->builtins_[Builtins::k##Name]) \
-      ->set_is_promise_rejection(true);
+#define SET_PROMISE_REJECTION_PREDICTION(Name) \
+  builtins->builtin(Builtins::k##Name)->set_is_promise_rejection(true);
 
   BUILTIN_PROMISE_REJECTION_PREDICTION_LIST(SET_PROMISE_REJECTION_PREDICTION)
 #undef SET_PROMISE_REJECTION_PREDICTION
 
-#define SET_EXCEPTION_CAUGHT_PREDICTION(Name)        \
-  Code::cast(builtins->builtins_[Builtins::k##Name]) \
-      ->set_is_exception_caught(true);
+#define SET_EXCEPTION_CAUGHT_PREDICTION(Name) \
+  builtins->builtin(Builtins::k##Name)->set_is_exception_caught(true);
 
   BUILTIN_EXCEPTION_CAUGHT_PREDICTION_LIST(SET_EXCEPTION_CAUGHT_PREDICTION)
 #undef SET_EXCEPTION_CAUGHT_PREDICTION
diff --git a/deps/v8/src/builtins/typed-array.tq b/deps/v8/src/builtins/typed-array.tq
new file mode 100644
index 00000000000000..2d2a086de58022
--- /dev/null
+++ b/deps/v8/src/builtins/typed-array.tq
@@ -0,0 +1,340 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+module typed_array {
+  extern runtime TypedArraySortFast(Context, Object): JSTypedArray;
+  extern macro ValidateTypedArray(
+      Context, Object, constexpr string): JSTypedArray;
+
+  extern macro LoadFixedTypedArrayElementAsTagged(
+      RawPtr, Smi, constexpr ElementsKind, constexpr ParameterMode): Object;
+  extern macro StoreFixedTypedArrayElementFromTagged(
+      Context, FixedArrayBase, Smi, Object, constexpr ElementsKind,
+      constexpr ParameterMode);
+
+  type LoadFn = builtin(Context, JSTypedArray, Smi) => Object;
+  type StoreFn = builtin(Context, JSTypedArray, Smi, Object) => Object;
+
+  macro KindForArrayType<T : type>(): constexpr ElementsKind;
+  KindForArrayType<FixedUint8Array>(): constexpr ElementsKind {
+    return UINT8_ELEMENTS;
+  }
+  KindForArrayType<FixedInt8Array>(): constexpr ElementsKind {
+    return INT8_ELEMENTS;
+  }
+  KindForArrayType<FixedUint16Array>(): constexpr ElementsKind {
+    return UINT16_ELEMENTS;
+  }
+  KindForArrayType<FixedInt16Array>(): constexpr ElementsKind {
+    return INT16_ELEMENTS;
+  }
+  KindForArrayType<FixedUint32Array>(): constexpr ElementsKind {
+    return UINT32_ELEMENTS;
+  }
+  KindForArrayType<FixedInt32Array>(): constexpr ElementsKind {
+    return INT32_ELEMENTS;
+  }
+  KindForArrayType<FixedFloat32Array>(): constexpr ElementsKind {
+    return FLOAT32_ELEMENTS;
+  }
+  KindForArrayType<FixedFloat64Array>(): constexpr ElementsKind {
+    return FLOAT64_ELEMENTS;
+  }
+  KindForArrayType<FixedUint8ClampedArray>(): constexpr ElementsKind {
+    return UINT8_CLAMPED_ELEMENTS;
+  }
+  KindForArrayType<FixedBigUint64Array>(): constexpr ElementsKind {
+    return BIGUINT64_ELEMENTS;
+  }
+  KindForArrayType<FixedBigInt64Array>(): constexpr ElementsKind {
+    return BIGINT64_ELEMENTS;
+  }
+
+  builtin LoadFixedElement<T : type>(
+      context: Context, array: JSTypedArray, index: Smi): Object {
+    return LoadFixedTypedArrayElementAsTagged(
+        array.data_ptr, index, KindForArrayType<T>(), SMI_PARAMETERS);
+  }
+
+  builtin StoreFixedElement<T : type>(
+      context: Context, array: JSTypedArray, index: Smi,
+      value: Object): Object {
+    let elements: FixedTypedArrayBase =
+        unsafe_cast<FixedTypedArrayBase>(array.elements);
+    StoreFixedTypedArrayElementFromTagged(
+        context, elements, index, value, KindForArrayType<T>(), SMI_PARAMETERS);
+    return Undefined;
+  }
+
+  macro CallCompareWithDetachedCheck(
+      context: Context, array: JSTypedArray, comparefn: Callable, a: Object,
+      b: Object): Number labels Detached {
+    // a. Let v be ? ToNumber(? Call(comparefn, undefined, x, y)).
+    let v: Number =
+        ToNumber_Inline(context, Call(context, comparefn, Undefined, a, b));
+
+    // b. If IsDetachedBuffer(buffer) is true, throw a TypeError exception.
+    if (IsDetachedBuffer(array.buffer)) goto Detached;
+
+    // c. If v is NaN, return +0.
+    if (NumberIsNaN(v)) return 0;
+
+    // d. return v.
+    return v;
+  }
+
+  // InsertionSort is used for smaller arrays.
+  macro TypedArrayInsertionSort(
+      context: Context, array: JSTypedArray, from_arg: Smi, to_arg: Smi,
+      comparefn: Callable, Load: LoadFn, Store: StoreFn)
+  labels Detached {
+    let from: Smi = from_arg;
+    let to: Smi = to_arg;
+
+    if (IsDetachedBuffer(array.buffer)) goto Detached;
+
+    for (let i: Smi = from + 1; i < to; ++i) {
+      let element: Object = Load(context, array, i);
+      let j: Smi = i - 1;
+      for (; j >= from; --j) {
+        let tmp: Object = Load(context, array, j);
+        let order: Number = CallCompareWithDetachedCheck(
+            context, array, comparefn, tmp, element) otherwise Detached;
+        if (order > 0) {
+          Store(context, array, j + 1, tmp);
+        } else {
+          break;
+        }
+      }
+      Store(context, array, j + 1, element);
+    }
+  }
+
+  macro TypedArrayQuickSortImpl(
+      context: Context, array: JSTypedArray, from_arg: Smi, to_arg: Smi,
+      comparefn: Callable, Load: LoadFn, Store: StoreFn)
+  labels Detached {
+    let from: Smi = from_arg;
+    let to: Smi = to_arg;
+
+    while (to - from > 1) {
+      if (to - from <= 10) {
+        // TODO(szuend): Investigate InsertionSort removal.
+        //               Currently it does not make any difference when the
+        //               benchmarks are run locally.
+        TypedArrayInsertionSort(
+            context, array, from, to, comparefn, Load, Store)
+        otherwise Detached;
+        break;
+      }
+
+      // TODO(szuend): Check if a more involved third_index calculation is
+      //               worth it for very large arrays.
+      let third_index: Smi = from + ((to - from) >>> 1);
+
+      if (IsDetachedBuffer(array.buffer)) goto Detached;
+
+      // Find a pivot as the median of first, last and middle element.
+      let v0: Object = Load(context, array, from);
+      let v1: Object = Load(context, array, to - 1);
+      let v2: Object = Load(context, array, third_index);
+
+      let c01: Number = CallCompareWithDetachedCheck(
+          context, array, comparefn, v0, v1) otherwise Detached;
+      if (c01 > 0) {
+        // v1 < v0, so swap them.
+        let tmp: Object = v0;
+        v0 = v1;
+        v1 = tmp;
+      }
+      // v0 <= v1.
+      let c02: Number = CallCompareWithDetachedCheck(
+          context, array, comparefn, v0, v2) otherwise Detached;
+      if (c02 >= 0) {
+        // v2 <= v0 <= v1.
+        let tmp: Object = v0;
+        v0 = v2;
+        v2 = v1;
+        v1 = tmp;
+      } else {
+        // v0 <= v1 && v0 < v2.
+        let c12: Number = CallCompareWithDetachedCheck(
+            context, array, comparefn, v1, v2) otherwise Detached;
+        if (c12 > 0) {
+          // v0 <= v2 < v1.
+          let tmp: Object = v1;
+          v1 = v2;
+          v2 = tmp;
+        }
+      }
+
+      // v0 <= v1 <= v2.
+      Store(context, array, from, v0);
+      Store(context, array, to - 1, v2);
+
+      let pivot: Object = v1;
+      let low_end: Smi = from + 1;   // Upper bound of elems lower than pivot.
+      let high_start: Smi = to - 1;  // Lower bound of elems greater than pivot.
+
+      let low_end_value: Object = Load(context, array, low_end);
+      Store(context, array, third_index, low_end_value);
+      Store(context, array, low_end, pivot);
+
+      // From low_end to idx are elements equal to pivot.
+      // From idx to high_start are elements that haven"t been compared yet.
+      for (let idx: Smi = low_end + 1; idx < high_start; idx++) {
+        let element: Object = Load(context, array, idx);
+        let order: Number = CallCompareWithDetachedCheck(
+            context, array, comparefn, element, pivot) otherwise Detached;
+
+        if (order < 0) {
+          low_end_value = Load(context, array, low_end);
+          Store(context, array, idx, low_end_value);
+          Store(context, array, low_end, element);
+          low_end++;
+        } else if (order > 0) {
+          let break_for: bool = false;
+
+          while (order > 0) {
+            high_start--;
+            if (high_start == idx) {
+              break_for = true;
+              break;
+            }
+
+            let top_elem: Object = Load(context, array, high_start);
+            order = CallCompareWithDetachedCheck(
+                context, array, comparefn, top_elem, pivot) otherwise Detached;
+          }
+
+          if (break_for) {
+            break;
+          }
+
+          let high_start_value: Object = Load(context, array, high_start);
+          Store(context, array, idx, high_start_value);
+          Store(context, array, high_start, element);
+
+          if (order < 0) {
+            element = Load(context, array, idx);
+
+            low_end_value = Load(context, array, low_end);
+            Store(context, array, idx, low_end_value);
+            Store(context, array, low_end, element);
+            low_end++;
+          }
+        }
+      }
+
+      if ((to - high_start) < (low_end - from)) {
+        TypedArrayQuickSort(
+            context, array, high_start, to, comparefn, Load, Store);
+        to = low_end;
+      } else {
+        TypedArrayQuickSort(
+            context, array, from, low_end, comparefn, Load, Store);
+        from = high_start;
+      }
+    }
+  }
+
+  builtin TypedArrayQuickSort(
+      context: Context, array: JSTypedArray, from: Smi, to: Smi,
+      comparefn: Callable, Load: LoadFn, Store: StoreFn): JSTypedArray {
+    try {
+      TypedArrayQuickSortImpl(context, array, from, to, comparefn, Load, Store)
+      otherwise Detached;
+    }
+    label Detached {
+      ThrowTypeError(
+          context, kDetachedOperation, '%TypedArray%.prototype.sort');
+    }
+    return array;
+  }
+
+  // https://tc39.github.io/ecma262/#sec-%typedarray%.prototype.sort
+  javascript builtin TypedArrayPrototypeSort(
+      context: Context, receiver: Object, ...arguments): JSTypedArray {
+    // 1. If comparefn is not undefined and IsCallable(comparefn) is false,
+    //    throw a TypeError exception.
+    let comparefn_obj: Object = arguments.length > 0 ? arguments[0] : Undefined;
+    if (comparefn_obj != Undefined && !TaggedIsCallable(comparefn_obj)) {
+      ThrowTypeError(context, kBadSortComparisonFunction, comparefn_obj);
+    }
+
+    // 2. Let obj be the this value.
+    let obj: Object = receiver;
+
+    // 3. Let buffer be ? ValidateTypedArray(obj).
+    //    ValidateTypedArray currently returns the array, not the ViewBuffer.
+    let array: JSTypedArray =
+        ValidateTypedArray(context, obj, '%TypedArray%.prototype.sort');
+
+    // Default sorting is done in C++ using std::sort
+    if (comparefn_obj == Undefined) {
+      return TypedArraySortFast(context, obj);
+    }
+
+    // 4. Let len be obj.[[ArrayLength]].
+    let len: Smi = array.length;
+
+    try {
+      let comparefn: Callable =
+          cast<Callable>(comparefn_obj) otherwise CastError;
+      let loadfn: LoadFn;
+      let storefn: StoreFn;
+
+      let elements_kind: ElementsKind = array.elements_kind;
+
+      if (IsElementsKindGreaterThan(elements_kind, UINT32_ELEMENTS)) {
+        if (elements_kind == INT32_ELEMENTS) {
+          loadfn = LoadFixedElement<FixedInt32Array>;
+          storefn = StoreFixedElement<FixedInt32Array>;
+        } else if (elements_kind == FLOAT32_ELEMENTS) {
+          loadfn = LoadFixedElement<FixedFloat32Array>;
+          storefn = StoreFixedElement<FixedFloat32Array>;
+        } else if (elements_kind == FLOAT64_ELEMENTS) {
+          loadfn = LoadFixedElement<FixedFloat64Array>;
+          storefn = StoreFixedElement<FixedFloat64Array>;
+        } else if (elements_kind == UINT8_CLAMPED_ELEMENTS) {
+          loadfn = LoadFixedElement<FixedUint8ClampedArray>;
+          storefn = StoreFixedElement<FixedUint8ClampedArray>;
+        } else if (elements_kind == BIGUINT64_ELEMENTS) {
+          loadfn = LoadFixedElement<FixedBigUint64Array>;
+          storefn = StoreFixedElement<FixedBigUint64Array>;
+        } else if (elements_kind == BIGINT64_ELEMENTS) {
+          loadfn = LoadFixedElement<FixedBigInt64Array>;
+          storefn = StoreFixedElement<FixedBigInt64Array>;
+        } else {
+          unreachable;
+        }
+      } else {
+        if (elements_kind == UINT8_ELEMENTS) {
+          loadfn = LoadFixedElement<FixedUint8Array>;
+          storefn = StoreFixedElement<FixedUint8Array>;
+        } else if (elements_kind == INT8_ELEMENTS) {
+          loadfn = LoadFixedElement<FixedInt8Array>;
+          storefn = StoreFixedElement<FixedInt8Array>;
+        } else if (elements_kind == UINT16_ELEMENTS) {
+          loadfn = LoadFixedElement<FixedUint16Array>;
+          storefn = StoreFixedElement<FixedUint16Array>;
+        } else if (elements_kind == INT16_ELEMENTS) {
+          loadfn = LoadFixedElement<FixedInt16Array>;
+          storefn = StoreFixedElement<FixedInt16Array>;
+        } else if (elements_kind == UINT32_ELEMENTS) {
+          loadfn = LoadFixedElement<FixedUint32Array>;
+          storefn = StoreFixedElement<FixedUint32Array>;
+        } else {
+          unreachable;
+        }
+      }
+
+      TypedArrayQuickSort(context, array, 0, len, comparefn, loadfn, storefn);
+    }
+    label CastError {
+      unreachable;
+    }
+    return array;
+  }
+}
diff --git a/deps/v8/src/builtins/x64/builtins-x64.cc b/deps/v8/src/builtins/x64/builtins-x64.cc
index ad64b02af9baf2..438b577af6b72c 100644
--- a/deps/v8/src/builtins/x64/builtins-x64.cc
+++ b/deps/v8/src/builtins/x64/builtins-x64.cc
@@ -4,6 +4,7 @@
 
 #if V8_TARGET_ARCH_X64
 
+#include "src/base/adapters.h"
 #include "src/code-factory.h"
 #include "src/counters.h"
 #include "src/deoptimizer.h"
@@ -11,6 +12,7 @@
 #include "src/frames.h"
 #include "src/objects-inl.h"
 #include "src/objects/debug-objects.h"
+#include "src/wasm/wasm-linkage.h"
 
 namespace v8 {
 namespace internal {
@@ -19,7 +21,8 @@ namespace internal {
 
 void Builtins::Generate_Adaptor(MacroAssembler* masm, Address address,
                                 ExitFrameType exit_frame_type) {
-  __ LoadAddress(rbx, ExternalReference(address, masm->isolate()));
+  __ LoadAddress(kJavaScriptCallExtraArg1Register,
+                 ExternalReference::Create(address));
   if (exit_frame_type == BUILTIN_EXIT) {
     __ Jump(BUILTIN_CODE(masm->isolate(), AdaptorWithBuiltinExitFrame),
             RelocInfo::CODE_TARGET);
@@ -30,63 +33,6 @@ void Builtins::Generate_Adaptor(MacroAssembler* masm, Address address,
   }
 }
 
-namespace {
-
-void AdaptorWithExitFrameType(MacroAssembler* masm,
-                              Builtins::ExitFrameType exit_frame_type) {
-  // ----------- S t a t e -------------
-  //  -- rax                 : number of arguments excluding receiver
-  //  -- rbx                 : entry point
-  //  -- rdi                 : target
-  //  -- rdx                 : new.target
-  //  -- rsp[0]              : return address
-  //  -- rsp[8]              : last argument
-  //  -- ...
-  //  -- rsp[8 * argc]       : first argument
-  //  -- rsp[8 * (argc + 1)] : receiver
-  // -----------------------------------
-  __ AssertFunction(rdi);
-
-  // The logic contained here is mirrored for TurboFan inlining in
-  // JSTypedLowering::ReduceJSCall{Function,Construct}. Keep these in sync.
-
-  // Make sure we operate in the context of the called function (for example
-  // ConstructStubs implemented in C++ will be run in the context of the caller
-  // instead of the callee, due to the way that [[Construct]] is defined for
-  // ordinary functions).
-  __ movp(rsi, FieldOperand(rdi, JSFunction::kContextOffset));
-
-  // CEntryStub expects rax to contain the number of arguments including the
-  // receiver and the extra arguments.
-  __ addp(rax, Immediate(BuiltinExitFrameConstants::kNumExtraArgsWithReceiver));
-
-  // Unconditionally insert argc, target and new target as extra arguments. They
-  // will be used by stack frame iterators when constructing the stack trace.
-  __ PopReturnAddressTo(kScratchRegister);
-  __ Integer32ToSmi(rax, rax);
-  __ PushRoot(Heap::kTheHoleValueRootIndex);  // Padding.
-  __ Push(rax);
-  __ SmiToInteger32(rax, rax);
-  __ Push(rdi);
-  __ Push(rdx);
-  __ PushReturnAddressFrom(kScratchRegister);
-
-  // Jump to the C entry runtime stub directly here instead of using
-  // JumpToExternalReference because rbx is loaded by Generate_adaptor.
-  CEntryStub ces(masm->isolate(), 1, kDontSaveFPRegs, kArgvOnStack,
-                 exit_frame_type == Builtins::BUILTIN_EXIT);
-  __ jmp(ces.GetCode(), RelocInfo::CODE_TARGET);
-}
-}  // namespace
-
-void Builtins::Generate_AdaptorWithExitFrame(MacroAssembler* masm) {
-  AdaptorWithExitFrameType(masm, EXIT);
-}
-
-void Builtins::Generate_AdaptorWithBuiltinExitFrame(MacroAssembler* masm) {
-  AdaptorWithExitFrameType(masm, BUILTIN_EXIT);
-}
-
 static void GenerateTailCallToReturnedCode(MacroAssembler* masm,
                                            Runtime::FunctionId function_id) {
   // ----------- S t a t e -------------
@@ -97,7 +43,7 @@ static void GenerateTailCallToReturnedCode(MacroAssembler* masm,
   {
     FrameScope scope(masm, StackFrame::INTERNAL);
     // Push the number of arguments to the callee.
-    __ Integer32ToSmi(rax, rax);
+    __ SmiTag(rax, rax);
     __ Push(rax);
     // Push a copy of the target function and the new target.
     __ Push(rdi);
@@ -112,7 +58,7 @@ static void GenerateTailCallToReturnedCode(MacroAssembler* masm,
     __ Pop(rdx);
     __ Pop(rdi);
     __ Pop(rax);
-    __ SmiToInteger32(rax, rax);
+    __ SmiUntag(rax, rax);
   }
   static_assert(kJavaScriptCallCodeStartRegister == rcx, "ABI mismatch");
   __ leap(rcx, FieldOperand(rcx, Code::kHeaderSize));
@@ -134,7 +80,7 @@ void Generate_JSBuiltinsConstructStubHelper(MacroAssembler* masm) {
     FrameScope scope(masm, StackFrame::CONSTRUCT);
 
     // Preserve the incoming parameters on the stack.
-    __ Integer32ToSmi(rcx, rax);
+    __ SmiTag(rcx, rax);
     __ Push(rsi);
     __ Push(rcx);
 
@@ -187,10 +133,10 @@ void Generate_JSBuiltinsConstructStubHelper(MacroAssembler* masm) {
 
   __ ret(0);
 }
+}  // namespace
 
 // The construct stub for ES5 constructor functions and ES6 class constructors.
-void Generate_JSConstructStubGeneric(MacroAssembler* masm,
-                                     bool restrict_constructor_return) {
+void Builtins::Generate_JSConstructStubGeneric(MacroAssembler* masm) {
   // ----------- S t a t e -------------
   //  -- rax: number of arguments (untagged)
   //  -- rdi: constructor function
@@ -205,7 +151,7 @@ void Generate_JSConstructStubGeneric(MacroAssembler* masm,
     Label post_instantiation_deopt_entry, not_create_implicit_receiver;
 
     // Preserve the incoming parameters on the stack.
-    __ Integer32ToSmi(rcx, rax);
+    __ SmiTag(rcx, rax);
     __ Push(rsi);
     __ Push(rcx);
     __ Push(rdi);
@@ -268,8 +214,7 @@ void Generate_JSConstructStubGeneric(MacroAssembler* masm,
 
     // Restore constructor function and argument count.
     __ movp(rdi, Operand(rbp, ConstructFrameConstants::kConstructorOffset));
-    __ SmiToInteger32(rax,
-                      Operand(rbp, ConstructFrameConstants::kLengthOffset));
+    __ SmiUntag(rax, Operand(rbp, ConstructFrameConstants::kLengthOffset));
 
     // Set up pointer to last argument.
     __ leap(rbx, Operand(rbp, StandardFrameConstants::kCallerSPOffset));
@@ -319,7 +264,7 @@ void Generate_JSConstructStubGeneric(MacroAssembler* masm,
     // If the result is an object (in the ECMA sense), we should get rid
     // of the receiver and use the result; see ECMA-262 section 13.2.2-7
     // on page 74.
-    Label use_receiver, do_throw, other_result, leave_frame;
+    Label use_receiver, do_throw, leave_frame;
 
     // If the result is undefined, we jump out to using the implicit receiver.
     __ JumpIfRoot(rax, Heap::kUndefinedValueRootIndex, &use_receiver,
@@ -329,30 +274,14 @@ void Generate_JSConstructStubGeneric(MacroAssembler* masm,
     // is a valid receiver.
 
     // If the result is a smi, it is *not* an object in the ECMA sense.
-    __ JumpIfSmi(rax, &other_result, Label::kNear);
+    __ JumpIfSmi(rax, &use_receiver, Label::kNear);
 
     // If the type of the result (stored in its map) is less than
     // FIRST_JS_RECEIVER_TYPE, it is not an object in the ECMA sense.
     STATIC_ASSERT(LAST_JS_RECEIVER_TYPE == LAST_TYPE);
     __ CmpObjectType(rax, FIRST_JS_RECEIVER_TYPE, rcx);
     __ j(above_equal, &leave_frame, Label::kNear);
-
-    // The result is now neither undefined nor an object.
-    __ bind(&other_result);
-    __ movp(rbx, Operand(rbp, ConstructFrameConstants::kConstructorOffset));
-    __ movp(rbx, FieldOperand(rbx, JSFunction::kSharedFunctionInfoOffset));
-    __ testl(FieldOperand(rbx, SharedFunctionInfo::kFlagsOffset),
-             Immediate(SharedFunctionInfo::IsClassConstructorBit::kMask));
-
-    if (restrict_constructor_return) {
-      // Throw if constructor function is a class constructor
-      __ j(Condition::zero, &use_receiver, Label::kNear);
-    } else {
-      __ j(not_zero, &use_receiver, Label::kNear);
-      __ CallRuntime(
-          Runtime::kIncrementUseCounterConstructorReturnNonUndefinedPrimitive);
-      __ jmp(&use_receiver, Label::kNear);
-    }
+    __ jmp(&use_receiver, Label::kNear);
 
     __ bind(&do_throw);
     __ CallRuntime(Runtime::kThrowConstructorReturnedNonObject);
@@ -375,16 +304,7 @@ void Generate_JSConstructStubGeneric(MacroAssembler* masm,
   __ PushReturnAddressFrom(rcx);
   __ ret(0);
 }
-}  // namespace
 
-void Builtins::Generate_JSConstructStubGenericRestrictedReturn(
-    MacroAssembler* masm) {
-  return Generate_JSConstructStubGeneric(masm, true);
-}
-void Builtins::Generate_JSConstructStubGenericUnrestrictedReturn(
-    MacroAssembler* masm) {
-  return Generate_JSConstructStubGeneric(masm, false);
-}
 void Builtins::Generate_JSBuiltinsConstructStub(MacroAssembler* masm) {
   Generate_JSBuiltinsConstructStubHelper(masm);
 }
@@ -446,8 +366,8 @@ static void Generate_JSEntryTrampolineHelper(MacroAssembler* masm,
     FrameScope scope(masm, StackFrame::INTERNAL);
 
     // Setup the context (we need to use the caller context from the isolate).
-    ExternalReference context_address(IsolateAddressId::kContextAddress,
-                                      masm->isolate());
+    ExternalReference context_address = ExternalReference::Create(
+        IsolateAddressId::kContextAddress, masm->isolate());
     __ movp(rsi, masm->ExternalOperand(context_address));
 
     // Push the function and the receiver onto the stack.
@@ -483,8 +403,8 @@ static void Generate_JSEntryTrampolineHelper(MacroAssembler* masm,
     FrameScope scope(masm, StackFrame::INTERNAL);
 
     // Setup the context (we need to use the caller context from the isolate).
-    ExternalReference context_address(IsolateAddressId::kContextAddress,
-                                      masm->isolate());
+    ExternalReference context_address = ExternalReference::Create(
+        IsolateAddressId::kContextAddress, masm->isolate());
     __ movp(rsi, masm->ExternalOperand(context_address));
 
     // Push the function and receiver onto the stack.
@@ -628,20 +548,25 @@ void Builtins::Generate_ResumeGeneratorTrampoline(MacroAssembler* masm) {
   //  -- rsp[0] : generator receiver
   // -----------------------------------
 
-  // Push holes for arguments to generator function. Since the parser forced
-  // context allocation for any variables in generators, the actual argument
-  // values have already been copied into the context and these dummy values
-  // will never be used.
+  // Copy the function arguments from the generator object's register file.
   __ movp(rcx, FieldOperand(rdi, JSFunction::kSharedFunctionInfoOffset));
-  __ movl(rcx,
-          FieldOperand(rcx, SharedFunctionInfo::kFormalParameterCountOffset));
+  __ movzxwq(
+      rcx, FieldOperand(rcx, SharedFunctionInfo::kFormalParameterCountOffset));
+
+  __ movp(rbx,
+          FieldOperand(rdx, JSGeneratorObject::kParametersAndRegistersOffset));
+
   {
     Label done_loop, loop;
+    __ Set(r9, 0);
+
     __ bind(&loop);
-    __ subl(rcx, Immediate(1));
-    __ j(carry, &done_loop, Label::kNear);
-    __ PushRoot(Heap::kTheHoleValueRootIndex);
+    __ cmpl(r9, rcx);
+    __ j(greater_equal, &done_loop, Label::kNear);
+    __ Push(FieldOperand(rbx, r9, times_pointer_size, FixedArray::kHeaderSize));
+    __ addl(r9, Immediate(1));
     __ jmp(&loop);
+
     __ bind(&done_loop);
   }
 
@@ -658,7 +583,7 @@ void Builtins::Generate_ResumeGeneratorTrampoline(MacroAssembler* masm) {
   {
     __ PushReturnAddressFrom(rax);
     __ movp(rax, FieldOperand(rdi, JSFunction::kSharedFunctionInfoOffset));
-    __ movsxlq(rax, FieldOperand(
+    __ movzxwq(rax, FieldOperand(
                         rax, SharedFunctionInfo::kFormalParameterCountOffset));
     // We abuse new.target both to indicate that this is a resume call and to
     // pass in the generator object.  In ordinary calls, new.target is always
@@ -674,6 +599,8 @@ void Builtins::Generate_ResumeGeneratorTrampoline(MacroAssembler* masm) {
     FrameScope scope(masm, StackFrame::INTERNAL);
     __ Push(rdx);
     __ Push(rdi);
+    // Push hole as receiver since we do not use it for stepping.
+    __ PushRoot(Heap::kTheHoleValueRootIndex);
     __ CallRuntime(Runtime::kDebugOnFunctionCall);
     __ Pop(rdx);
     __ movp(rdi, FieldOperand(rdx, JSGeneratorObject::kFunctionOffset));
@@ -738,7 +665,7 @@ static void TailCallRuntimeIfMarkerEquals(MacroAssembler* masm,
                                           Runtime::FunctionId function_id) {
   Label no_match;
   __ SmiCompare(smi_entry, Smi::FromEnum(marker));
-  __ j(not_equal, &no_match, Label::kNear);
+  __ j(not_equal, &no_match);
   GenerateTailCallToReturnedCode(masm, function_id);
   __ bind(&no_match);
 }
@@ -851,7 +778,7 @@ static void AdvanceBytecodeOffsetOrReturn(MacroAssembler* masm,
                      bytecode));
 
   __ Move(bytecode_size_table,
-          ExternalReference::bytecode_size_table_address(masm->isolate()));
+          ExternalReference::bytecode_size_table_address());
 
   // Check if the bytecode is a Wide or ExtraWide prefix bytecode.
   Label process_bytecode, extra_wide;
@@ -930,17 +857,13 @@ void Builtins::Generate_InterpreterEntryTrampoline(MacroAssembler* masm) {
   __ Push(rsi);  // Callee's context.
   __ Push(rdi);  // Callee's JS function.
 
-  // Get the bytecode array from the function object (or from the DebugInfo if
-  // it is present) and load it into kInterpreterBytecodeArrayRegister.
-  Label maybe_load_debug_bytecode_array, bytecode_array_loaded;
+  // Get the bytecode array from the function object and load it into
+  // kInterpreterBytecodeArrayRegister.
   __ movp(rax, FieldOperand(closure, JSFunction::kSharedFunctionInfoOffset));
   __ movp(kInterpreterBytecodeArrayRegister,
           FieldOperand(rax, SharedFunctionInfo::kFunctionDataOffset));
   GetSharedFunctionInfoBytecode(masm, kInterpreterBytecodeArrayRegister,
                                 kScratchRegister);
-  __ JumpIfNotSmi(FieldOperand(rax, SharedFunctionInfo::kDebugInfoOffset),
-                  &maybe_load_debug_bytecode_array);
-  __ bind(&bytecode_array_loaded);
 
   // Increment invocation count for the function.
   __ incl(
@@ -967,7 +890,7 @@ void Builtins::Generate_InterpreterEntryTrampoline(MacroAssembler* masm) {
 
   // Push bytecode array and Smi tagged bytecode offset.
   __ Push(kInterpreterBytecodeArrayRegister);
-  __ Integer32ToSmi(rcx, kInterpreterBytecodeOffsetRegister);
+  __ SmiTag(rcx, kInterpreterBytecodeOffsetRegister);
   __ Push(rcx);
 
   // Allocate the local and temporary register file on the stack.
@@ -1037,8 +960,8 @@ void Builtins::Generate_InterpreterEntryTrampoline(MacroAssembler* masm) {
           Operand(rbp, InterpreterFrameConstants::kBytecodeArrayFromFp));
   __ movp(kInterpreterBytecodeOffsetRegister,
           Operand(rbp, InterpreterFrameConstants::kBytecodeOffsetFromFp));
-  __ SmiToInteger32(kInterpreterBytecodeOffsetRegister,
-                    kInterpreterBytecodeOffsetRegister);
+  __ SmiUntag(kInterpreterBytecodeOffsetRegister,
+              kInterpreterBytecodeOffsetRegister);
 
   // Either return, or advance to the next bytecode and dispatch.
   Label do_return;
@@ -1053,39 +976,6 @@ void Builtins::Generate_InterpreterEntryTrampoline(MacroAssembler* masm) {
   // The return value is in rax.
   LeaveInterpreterFrame(masm, rbx, rcx);
   __ ret(0);
-
-  // Load debug copy of the bytecode array if it exists.
-  // kInterpreterBytecodeArrayRegister is already loaded with
-  // SharedFunctionInfo::kFunctionDataOffset.
-  __ bind(&maybe_load_debug_bytecode_array);
-  __ movp(rax, FieldOperand(closure, JSFunction::kSharedFunctionInfoOffset));
-  __ movp(rcx, FieldOperand(rax, SharedFunctionInfo::kDebugInfoOffset));
-  __ movp(kScratchRegister,
-          FieldOperand(rcx, DebugInfo::kDebugBytecodeArrayOffset));
-  __ JumpIfRoot(kScratchRegister, Heap::kUndefinedValueRootIndex,
-                &bytecode_array_loaded);
-
-  __ movp(kInterpreterBytecodeArrayRegister, kScratchRegister);
-  __ SmiToInteger32(rax, FieldOperand(rcx, DebugInfo::kFlagsOffset));
-  __ andb(rax, Immediate(DebugInfo::kDebugExecutionMode));
-  STATIC_ASSERT(static_cast<int>(DebugInfo::kDebugExecutionMode) ==
-                static_cast<int>(DebugInfo::kSideEffects));
-  ExternalReference debug_execution_mode_address =
-      ExternalReference::debug_execution_mode_address(masm->isolate());
-  Operand debug_execution_mode =
-      masm->ExternalOperand(debug_execution_mode_address);
-  __ cmpb(rax, debug_execution_mode);
-  __ j(equal, &bytecode_array_loaded);
-
-  __ Push(closure);
-  __ Push(feedback_vector);
-  __ Push(kInterpreterBytecodeArrayRegister);
-  __ Push(closure);
-  __ CallRuntime(Runtime::kDebugApplyInstrumentation);
-  __ Pop(kInterpreterBytecodeArrayRegister);
-  __ Pop(feedback_vector);
-  __ Pop(closure);
-  __ jmp(&bytecode_array_loaded);
 }
 
 static void Generate_InterpreterPushArgs(MacroAssembler* masm,
@@ -1124,8 +1014,7 @@ void Builtins::Generate_InterpreterPushArgsThenCallImpl(
   Label stack_overflow;
 
   // Number of values to be pushed.
-  __ Move(rcx, rax);
-  __ addp(rcx, Immediate(1));  // Add one for receiver.
+  __ leal(rcx, Operand(rax, 1));  // Add one for receiver.
 
   // Add a stack check before pushing arguments.
   Generate_StackOverflowCheck(masm, rcx, rdx, &stack_overflow);
@@ -1136,7 +1025,7 @@ void Builtins::Generate_InterpreterPushArgsThenCallImpl(
   // Push "undefined" as the receiver arg if we need to.
   if (receiver_mode == ConvertReceiverMode::kNullOrUndefined) {
     __ PushRoot(Heap::kUndefinedValueRootIndex);
-    __ subp(rcx, Immediate(1));  // Subtract one for receiver.
+    __ decl(rcx);  // Subtract one for receiver.
   }
 
   // rbx and rdx will be modified.
@@ -1144,7 +1033,7 @@ void Builtins::Generate_InterpreterPushArgsThenCallImpl(
 
   if (mode == InterpreterPushArgsMode::kWithFinalSpread) {
     __ Pop(rbx);                 // Pass the spread in a register
-    __ subp(rax, Immediate(1));  // Subtract one for spread
+    __ decl(rax);                // Subtract one for spread
   }
 
   // Call the target.
@@ -1196,7 +1085,7 @@ void Builtins::Generate_InterpreterPushArgsThenConstructImpl(
 
   if (mode == InterpreterPushArgsMode::kWithFinalSpread) {
     __ Pop(rbx);                 // Pass the spread in a register
-    __ subp(rax, Immediate(1));  // Subtract one for spread
+    __ decl(rax);                // Subtract one for spread
 
     // Push return address in preparation for the tail-call.
     __ PushReturnAddressFrom(kScratchRegister);
@@ -1210,8 +1099,8 @@ void Builtins::Generate_InterpreterPushArgsThenConstructImpl(
     // context at this point).
     __ AssertFunction(rdi);
     // Jump to the constructor function (rax, rbx, rdx passed on).
-    ArrayConstructorStub array_constructor_stub(masm->isolate());
-    __ Jump(array_constructor_stub.GetCode(), RelocInfo::CODE_TARGET);
+    Handle<Code> code = BUILTIN_CODE(masm->isolate(), ArrayConstructorImpl);
+    __ Jump(code, RelocInfo::CODE_TARGET);
   } else if (mode == InterpreterPushArgsMode::kWithFinalSpread) {
     // Call the constructor (rax, rdx, rdi passed on).
     __ Jump(BUILTIN_CODE(masm->isolate(), ConstructWithSpread),
@@ -1235,9 +1124,6 @@ static void Generate_InterpreterEnterBytecode(MacroAssembler* masm) {
   // Set the return address to the correct point in the interpreter entry
   // trampoline.
   Label builtin_trampoline, trampoline_loaded;
-  // TODO(jgruber,v8:6666): Update logic once builtin is isolate-independent.
-  DCHECK(
-      !Builtins::IsIsolateIndependent(Builtins::kInterpreterEntryTrampoline));
   Smi* interpreter_entry_return_pc_offset(
       masm->isolate()->heap()->interpreter_entry_return_pc_offset());
   DCHECK_NE(interpreter_entry_return_pc_offset, Smi::kZero);
@@ -1284,8 +1170,8 @@ static void Generate_InterpreterEnterBytecode(MacroAssembler* masm) {
   // Get the target bytecode offset from the frame.
   __ movp(kInterpreterBytecodeOffsetRegister,
           Operand(rbp, InterpreterFrameConstants::kBytecodeOffsetFromFp));
-  __ SmiToInteger32(kInterpreterBytecodeOffsetRegister,
-                    kInterpreterBytecodeOffsetRegister);
+  __ SmiUntag(kInterpreterBytecodeOffsetRegister,
+              kInterpreterBytecodeOffsetRegister);
 
   // Dispatch to the target bytecode.
   __ movzxbp(r11, Operand(kInterpreterBytecodeArrayRegister,
@@ -1302,8 +1188,8 @@ void Builtins::Generate_InterpreterEnterBytecodeAdvance(MacroAssembler* masm) {
           Operand(rbp, InterpreterFrameConstants::kBytecodeArrayFromFp));
   __ movp(kInterpreterBytecodeOffsetRegister,
           Operand(rbp, InterpreterFrameConstants::kBytecodeOffsetFromFp));
-  __ SmiToInteger32(kInterpreterBytecodeOffsetRegister,
-                    kInterpreterBytecodeOffsetRegister);
+  __ SmiUntag(kInterpreterBytecodeOffsetRegister,
+              kInterpreterBytecodeOffsetRegister);
 
   // Load the current bytecode.
   __ movzxbp(rbx, Operand(kInterpreterBytecodeArrayRegister,
@@ -1316,7 +1202,7 @@ void Builtins::Generate_InterpreterEnterBytecodeAdvance(MacroAssembler* masm) {
                                 &if_return);
 
   // Convert new bytecode offset to a Smi and save in the stackframe.
-  __ Integer32ToSmi(rbx, kInterpreterBytecodeOffsetRegister);
+  __ SmiTag(rbx, kInterpreterBytecodeOffsetRegister);
   __ movp(Operand(rbp, InterpreterFrameConstants::kBytecodeOffsetFromFp), rbx);
 
   Generate_InterpreterEnterBytecode(masm);
@@ -1330,204 +1216,6 @@ void Builtins::Generate_InterpreterEnterBytecodeDispatch(MacroAssembler* masm) {
   Generate_InterpreterEnterBytecode(masm);
 }
 
-// TODO(jupvfranco): investigate whether there is any case where the CompileLazy
-// builtin does not set the code field in the JS function. If there isn't then
-// we do not need this builtin and can jump directly to CompileLazy.
-void Builtins::Generate_CompileLazyDeoptimizedCode(MacroAssembler* masm) {
-  // Set the code slot inside the JSFunction to CompileLazy.
-  __ Move(rcx, BUILTIN_CODE(masm->isolate(), CompileLazy));
-  __ movp(FieldOperand(rdi, JSFunction::kCodeOffset), rcx);
-  __ RecordWriteField(rdi, JSFunction::kCodeOffset, rcx, r15, kDontSaveFPRegs,
-                      OMIT_REMEMBERED_SET, OMIT_SMI_CHECK);
-  // Jump to compile lazy.
-  Generate_CompileLazy(masm);
-}
-
-static void GetSharedFunctionInfoCode(MacroAssembler* masm, Register sfi_data,
-                                      Register scratch1) {
-  // Figure out the SFI's code object.
-  Label done;
-  Label check_is_bytecode_array;
-  Label check_is_code;
-  Label check_is_fixed_array;
-  Label check_is_pre_parsed_scope_data;
-  Label check_is_function_template_info;
-  Label check_is_interpreter_data;
-
-  Register data_type = scratch1;
-
-  // IsSmi: Is builtin
-  __ JumpIfNotSmi(sfi_data, &check_is_bytecode_array);
-  __ Move(scratch1, ExternalReference::builtins_address(masm->isolate()));
-  SmiIndex index = masm->SmiToIndex(sfi_data, sfi_data, kPointerSizeLog2);
-  __ movp(sfi_data, Operand(scratch1, index.reg, index.scale, 0));
-  __ j(always, &done);
-
-  // Get map for subsequent checks.
-  __ bind(&check_is_bytecode_array);
-  __ movp(data_type, FieldOperand(sfi_data, HeapObject::kMapOffset));
-  __ movw(data_type, FieldOperand(data_type, Map::kInstanceTypeOffset));
-
-  // IsBytecodeArray: Interpret bytecode
-  __ cmpw(data_type, Immediate(BYTECODE_ARRAY_TYPE));
-  __ j(not_equal, &check_is_code);
-  __ Move(sfi_data, BUILTIN_CODE(masm->isolate(), InterpreterEntryTrampoline));
-  __ j(always, &done);
-
-  // IsCode: Run code
-  __ bind(&check_is_code);
-  __ cmpw(data_type, Immediate(CODE_TYPE));
-  __ j(equal, &done);
-
-  // IsFixedArray: Instantiate using AsmWasmData,
-  __ bind(&check_is_fixed_array);
-  __ cmpw(data_type, Immediate(FIXED_ARRAY_TYPE));
-  __ j(not_equal, &check_is_pre_parsed_scope_data);
-  __ Move(sfi_data, BUILTIN_CODE(masm->isolate(), InstantiateAsmJs));
-  __ j(always, &done);
-
-  // IsPreParsedScopeData: Compile lazy
-  __ bind(&check_is_pre_parsed_scope_data);
-  __ cmpw(data_type, Immediate(TUPLE2_TYPE));
-  __ j(not_equal, &check_is_function_template_info);
-  __ Move(sfi_data, BUILTIN_CODE(masm->isolate(), CompileLazy));
-  __ j(always, &done);
-
-  // IsFunctionTemplateInfo: API call
-  __ bind(&check_is_function_template_info);
-  __ cmpw(data_type, Immediate(FUNCTION_TEMPLATE_INFO_TYPE));
-  __ j(not_equal, &check_is_interpreter_data);
-  __ Move(sfi_data, BUILTIN_CODE(masm->isolate(), HandleApiCall));
-  __ j(always, &done);
-
-  // IsInterpreterData: Interpret bytecode with unique interpreter
-  __ bind(&check_is_interpreter_data);
-  if (FLAG_debug_code) {
-    __ cmpw(data_type, Immediate(INTERPRETER_DATA_TYPE));
-    __ Check(equal, AbortReason::kInvalidSharedFunctionInfoData);
-  }
-  __ movp(
-      sfi_data,
-      FieldOperand(sfi_data, InterpreterData::kInterpreterTrampolineOffset));
-
-  __ bind(&done);
-}
-
-void Builtins::Generate_CompileLazy(MacroAssembler* masm) {
-  // ----------- S t a t e -------------
-  //  -- rax : argument count (preserved for callee)
-  //  -- rdx : new target (preserved for callee)
-  //  -- rdi : target function (preserved for callee)
-  // -----------------------------------
-  // First lookup code, maybe we don't need to compile!
-  Label gotta_call_runtime;
-
-  Register closure = rdi;
-  Register feedback_vector = rbx;
-
-  // Do we have a valid feedback vector?
-  __ movp(feedback_vector,
-          FieldOperand(closure, JSFunction::kFeedbackCellOffset));
-  __ movp(feedback_vector, FieldOperand(feedback_vector, Cell::kValueOffset));
-  __ JumpIfRoot(feedback_vector, Heap::kUndefinedValueRootIndex,
-                &gotta_call_runtime);
-
-  // Is there an optimization marker or optimized code in the feedback vector?
-  MaybeTailCallOptimizedCodeSlot(masm, feedback_vector, rcx, r14, r15);
-
-  // We found no optimized code. Infer the code object needed for the SFI.
-  Register entry = rcx;
-  __ movp(entry, FieldOperand(closure, JSFunction::kSharedFunctionInfoOffset));
-  __ movp(entry, FieldOperand(entry, SharedFunctionInfo::kFunctionDataOffset));
-  GetSharedFunctionInfoCode(masm, entry, rbx);
-
-  // If code entry points to anything other than CompileLazy, install that.
-  __ Move(rbx, masm->CodeObject());
-  __ cmpp(entry, rbx);
-  __ j(equal, &gotta_call_runtime);
-
-  // Install the SFI's code entry.
-  __ movp(FieldOperand(closure, JSFunction::kCodeOffset), entry);
-  __ movp(r14, entry);  // Write barrier clobbers r14 below.
-  __ RecordWriteField(closure, JSFunction::kCodeOffset, r14, r15,
-                      kDontSaveFPRegs, OMIT_REMEMBERED_SET, OMIT_SMI_CHECK);
-  __ leap(entry, FieldOperand(entry, Code::kHeaderSize));
-  __ jmp(entry);
-
-  __ bind(&gotta_call_runtime);
-  GenerateTailCallToReturnedCode(masm, Runtime::kCompileLazy);
-}
-
-// Lazy deserialization design doc: http://goo.gl/dxkYDZ.
-void Builtins::Generate_DeserializeLazy(MacroAssembler* masm) {
-  // ----------- S t a t e -------------
-  //  -- rax : argument count (preserved for callee)
-  //  -- rdx : new target (preserved for callee)
-  //  -- rdi : target function (preserved for callee)
-  // -----------------------------------
-
-  Label deserialize_in_runtime;
-
-  Register target = rdi;  // Must be preserved
-  Register scratch0 = rbx;
-  Register scratch1 = r12;
-
-  CHECK(scratch0 != rax && scratch0 != rdx && scratch0 != rdi);
-  CHECK(scratch1 != rax && scratch1 != rdx && scratch1 != rdi);
-  CHECK(scratch0 != scratch1);
-
-  // Load the builtin id for lazy deserialization from SharedFunctionInfo.
-
-  __ AssertFunction(target);
-  __ movp(scratch0,
-          FieldOperand(target, JSFunction::kSharedFunctionInfoOffset));
-
-  __ movp(scratch1,
-          FieldOperand(scratch0, SharedFunctionInfo::kFunctionDataOffset));
-  __ AssertSmi(scratch1);
-
-  // The builtin may already have been deserialized. If that is the case, it is
-  // stored in the builtins table, and we can copy to correct code object to
-  // both the shared function info and function without calling into runtime.
-  //
-  // Otherwise, we need to call into runtime to deserialize.
-
-  {
-    // Load the code object at builtins_table[builtin_id] into scratch1.
-
-    __ SmiToInteger32(scratch1, scratch1);
-    __ Move(scratch0, ExternalReference::builtins_address(masm->isolate()));
-    __ movp(scratch1, Operand(scratch0, scratch1, times_pointer_size, 0));
-
-    // Check if the loaded code object has already been deserialized. This is
-    // the case iff it does not equal DeserializeLazy.
-
-    __ Move(scratch0, masm->CodeObject());
-    __ cmpp(scratch1, scratch0);
-    __ j(equal, &deserialize_in_runtime);
-  }
-
-  {
-    // If we've reached this spot, the target builtin has been deserialized and
-    // we simply need to copy it over to the target function.
-
-    Register target_builtin = scratch1;
-
-    __ movp(FieldOperand(target, JSFunction::kCodeOffset), target_builtin);
-    __ movp(r14, target_builtin);  // Write barrier clobbers r14 below.
-    __ RecordWriteField(target, JSFunction::kCodeOffset, r14, r15,
-                        kDontSaveFPRegs, OMIT_REMEMBERED_SET, OMIT_SMI_CHECK);
-
-    // All copying is done. Jump to the deserialized code object.
-
-    __ leap(target_builtin, FieldOperand(target_builtin, Code::kHeaderSize));
-    __ jmp(target_builtin);
-  }
-
-  __ bind(&deserialize_in_runtime);
-  GenerateTailCallToReturnedCode(masm, Runtime::kDeserializeLazy);
-}
-
 void Builtins::Generate_InstantiateAsmJs(MacroAssembler* masm) {
   // ----------- S t a t e -------------
   //  -- rax : argument count (preserved for callee)
@@ -1540,7 +1228,7 @@ void Builtins::Generate_InstantiateAsmJs(MacroAssembler* masm) {
     // Preserve argument count for later compare.
     __ movp(rcx, rax);
     // Push the number of arguments to the callee.
-    __ Integer32ToSmi(rax, rax);
+    __ SmiTag(rax, rax);
     __ Push(rax);
     // Push a copy of the target function and the new target.
     __ Push(rdi);
@@ -1577,7 +1265,7 @@ void Builtins::Generate_InstantiateAsmJs(MacroAssembler* masm) {
 
     __ Drop(2);
     __ Pop(rcx);
-    __ SmiToInteger32(rcx, rcx);
+    __ SmiUntag(rcx, rcx);
     scope.GenerateLeaveFrame();
 
     __ PopReturnAddressTo(rbx);
@@ -1591,7 +1279,7 @@ void Builtins::Generate_InstantiateAsmJs(MacroAssembler* masm) {
     __ Pop(rdx);
     __ Pop(rdi);
     __ Pop(rax);
-    __ SmiToInteger32(rax, rax);
+    __ SmiUntag(rax, rax);
   }
   // On failure, tail call back to regular js by re-calling the function
   // which has be reset to the compile lazy builtin.
@@ -1618,7 +1306,7 @@ void Generate_ContinueToBuiltinHelper(MacroAssembler* masm,
     int code = config->GetAllocatableGeneralCode(i);
     __ popq(Register::from_code(code));
     if (java_script_builtin && code == kJavaScriptCallArgCountRegister.code()) {
-      __ SmiToInteger32(Register::from_code(code), Register::from_code(code));
+      __ SmiUntag(Register::from_code(code), Register::from_code(code));
     }
   }
   __ movq(
@@ -1911,45 +1599,9 @@ void Builtins::Generate_InternalArrayConstructor(MacroAssembler* masm) {
 
   // Run the native code for the InternalArray function called as a normal
   // function.
-  // tail call a stub
-  __ LoadRoot(rbx, Heap::kUndefinedValueRootIndex);
-  InternalArrayConstructorStub stub(masm->isolate());
-  __ TailCallStub(&stub);
-}
-
-void Builtins::Generate_ArrayConstructor(MacroAssembler* masm) {
-  // ----------- S t a t e -------------
-  //  -- rax    : argc
-  //  -- rdi    : array function
-  //  -- rsp[0] : return address
-  //  -- rsp[8] : last argument
-  // -----------------------------------
-  Label generic_array_code;
-
-  if (FLAG_debug_code) {
-    // Initial map for the builtin Array functions should be maps.
-    __ movp(rbx, FieldOperand(rdi, JSFunction::kPrototypeOrInitialMapOffset));
-    // Will both indicate a nullptr and a Smi.
-    STATIC_ASSERT(kSmiTag == 0);
-    Condition not_smi = NegateCondition(masm->CheckSmi(rbx));
-    __ Check(not_smi, AbortReason::kUnexpectedInitialMapForArrayFunction);
-    __ CmpObjectType(rbx, MAP_TYPE, rcx);
-    __ Check(equal, AbortReason::kUnexpectedInitialMapForArrayFunction);
-  }
-
-  // rbx is the AllocationSite - here undefined.
   __ LoadRoot(rbx, Heap::kUndefinedValueRootIndex);
-  // If rdx (new target) is undefined, then this is the 'Call' case, so move
-  // rdi (the constructor) to rdx.
-  Label call;
-  __ cmpp(rdx, rbx);
-  __ j(not_equal, &call);
-  __ movp(rdx, rdi);
-
-  // Run the native code for the Array function called as a normal function.
-  __ bind(&call);
-  ArrayConstructorStub stub(masm->isolate());
-  __ TailCallStub(&stub);
+  __ Jump(BUILTIN_CODE(masm->isolate(), InternalArrayConstructorImpl),
+          RelocInfo::CODE_TARGET);
 }
 
 static void EnterArgumentsAdaptorFrame(MacroAssembler* masm) {
@@ -1965,7 +1617,7 @@ static void EnterArgumentsAdaptorFrame(MacroAssembler* masm) {
   // Preserve the number of arguments on the stack. Must preserve rax,
   // rbx and rcx because these registers are used when copying the
   // arguments and the receiver.
-  __ Integer32ToSmi(r8, rax);
+  __ SmiTag(r8, rax);
   __ Push(r8);
 
   __ Push(Immediate(0));  // Padding.
@@ -1986,48 +1638,6 @@ static void LeaveArgumentsAdaptorFrame(MacroAssembler* masm) {
   __ PushReturnAddressFrom(rcx);
 }
 
-// static
-void Builtins::Generate_AllocateInNewSpace(MacroAssembler* masm) {
-  // ----------- S t a t e -------------
-  //  -- rdx    : requested object size (untagged)
-  //  -- rsp[0] : return address
-  // -----------------------------------
-  __ Integer32ToSmi(rdx, rdx);
-  __ PopReturnAddressTo(rcx);
-  __ Push(rdx);
-  __ PushReturnAddressFrom(rcx);
-  __ Move(rsi, Smi::kZero);
-  __ TailCallRuntime(Runtime::kAllocateInNewSpace);
-}
-
-// static
-void Builtins::Generate_AllocateInOldSpace(MacroAssembler* masm) {
-  // ----------- S t a t e -------------
-  //  -- rdx    : requested object size (untagged)
-  //  -- rsp[0] : return address
-  // -----------------------------------
-  __ Integer32ToSmi(rdx, rdx);
-  __ PopReturnAddressTo(rcx);
-  __ Push(rdx);
-  __ Push(Smi::FromInt(AllocateTargetSpace::encode(OLD_SPACE)));
-  __ PushReturnAddressFrom(rcx);
-  __ Move(rsi, Smi::kZero);
-  __ TailCallRuntime(Runtime::kAllocateInTargetSpace);
-}
-
-// static
-void Builtins::Generate_Abort(MacroAssembler* masm) {
-  // ----------- S t a t e -------------
-  //  -- rdx    : message_id as Smi
-  //  -- rsp[0] : return address
-  // -----------------------------------
-  __ PopReturnAddressTo(rcx);
-  __ Push(rdx);
-  __ PushReturnAddressFrom(rcx);
-  __ Move(rsi, Smi::kZero);
-  __ TailCallRuntime(Runtime::kAbort);
-}
-
 void Builtins::Generate_ArgumentsAdaptorTrampoline(MacroAssembler* masm) {
   // ----------- S t a t e -------------
   //  -- rax : actual number of arguments
@@ -2041,10 +1651,10 @@ void Builtins::Generate_ArgumentsAdaptorTrampoline(MacroAssembler* masm) {
   __ IncrementCounter(counters->arguments_adaptors(), 1);
 
   Label enough, too_few;
-  __ cmpp(rax, rbx);
-  __ j(less, &too_few);
   __ cmpp(rbx, Immediate(SharedFunctionInfo::kDontAdaptArgumentsSentinel));
   __ j(equal, &dont_adapt_arguments);
+  __ cmpp(rax, rbx);
+  __ j(less, &too_few);
 
   {  // Enough parameters: Actual >= expected.
     __ bind(&enough);
@@ -2146,7 +1756,24 @@ void Builtins::Generate_CallOrConstructVarargs(MacroAssembler* masm,
   //  -- rdx    : new.target (for [[Construct]])
   //  -- rsp[0] : return address
   // -----------------------------------
-  __ AssertFixedArray(rbx);
+  if (masm->emit_debug_code()) {
+    // Allow rbx to be a FixedArray, or a FixedDoubleArray if rcx == 0.
+    Label ok, fail;
+    __ AssertNotSmi(rbx);
+    Register map = r9;
+    __ movp(map, FieldOperand(rbx, HeapObject::kMapOffset));
+    __ CmpInstanceType(map, FIXED_ARRAY_TYPE);
+    __ j(equal, &ok);
+    __ CmpInstanceType(map, FIXED_DOUBLE_ARRAY_TYPE);
+    __ j(not_equal, &fail);
+    __ cmpl(rcx, Immediate(0));
+    __ j(equal, &ok);
+    // Fall through.
+    __ bind(&fail);
+    __ Abort(AbortReason::kOperandIsNotAFixedArray);
+
+    __ bind(&ok);
+  }
 
   // Check for stack overflow.
   {
@@ -2231,15 +1858,15 @@ void Builtins::Generate_CallOrConstructForwardVarargs(MacroAssembler* masm,
   {
     __ movp(r8, Operand(rbp, JavaScriptFrameConstants::kFunctionOffset));
     __ movp(r8, FieldOperand(r8, JSFunction::kSharedFunctionInfoOffset));
-    __ movl(r8,
-            FieldOperand(r8, SharedFunctionInfo::kFormalParameterCountOffset));
+    __ movzxwq(
+        r8, FieldOperand(r8, SharedFunctionInfo::kFormalParameterCountOffset));
     __ movp(rbx, rbp);
   }
   __ jmp(&arguments_done, Label::kNear);
   __ bind(&arguments_adaptor);
   {
-    __ SmiToInteger32(
-        r8, Operand(rbx, ArgumentsAdaptorFrameConstants::kLengthOffset));
+    __ SmiUntag(r8,
+                Operand(rbx, ArgumentsAdaptorFrameConstants::kLengthOffset));
   }
   __ bind(&arguments_done);
 
@@ -2337,7 +1964,7 @@ void Builtins::Generate_CallFunction(MacroAssembler* masm,
           // Patch receiver to global proxy.
           __ LoadGlobalProxy(rcx);
         }
-        __ jmp(&convert_receiver, Label::kNear);
+        __ jmp(&convert_receiver);
       }
       __ bind(&convert_to_object);
       {
@@ -2345,7 +1972,7 @@ void Builtins::Generate_CallFunction(MacroAssembler* masm,
         // TODO(bmeurer): Inline the allocation here to avoid building the frame
         // in the fast case? (fall back to AllocateInNewSpace?)
         FrameScope scope(masm, StackFrame::INTERNAL);
-        __ Integer32ToSmi(rax, rax);
+        __ SmiTag(rax, rax);
         __ Push(rax);
         __ Push(rdi);
         __ movp(rax, rcx);
@@ -2356,7 +1983,7 @@ void Builtins::Generate_CallFunction(MacroAssembler* masm,
         __ movp(rcx, rax);
         __ Pop(rdi);
         __ Pop(rax);
-        __ SmiToInteger32(rax, rax);
+        __ SmiUntag(rax, rax);
       }
       __ movp(rdx, FieldOperand(rdi, JSFunction::kSharedFunctionInfoOffset));
       __ bind(&convert_receiver);
@@ -2372,7 +1999,7 @@ void Builtins::Generate_CallFunction(MacroAssembler* masm,
   //  -- rsi : the function context.
   // -----------------------------------
 
-  __ movsxlq(
+  __ movzxwq(
       rbx, FieldOperand(rdx, SharedFunctionInfo::kFormalParameterCountOffset));
   ParameterCount actual(rax);
   ParameterCount expected(rbx);
@@ -2400,7 +2027,7 @@ void Generate_PushBoundArguments(MacroAssembler* masm) {
   // Load [[BoundArguments]] into rcx and length of that into rbx.
   Label no_bound_arguments;
   __ movp(rcx, FieldOperand(rdi, JSBoundFunction::kBoundArgumentsOffset));
-  __ SmiToInteger32(rbx, FieldOperand(rcx, FixedArray::kLengthOffset));
+  __ SmiUntag(rbx, FieldOperand(rcx, FixedArray::kLengthOffset));
   __ testl(rbx, rbx);
   __ j(zero, &no_bound_arguments);
   {
@@ -2452,7 +2079,7 @@ void Generate_PushBoundArguments(MacroAssembler* masm) {
     {
       Label loop;
       __ movp(rcx, FieldOperand(rdi, JSBoundFunction::kBoundArgumentsOffset));
-      __ SmiToInteger32(rbx, FieldOperand(rcx, FixedArray::kLengthOffset));
+      __ SmiUntag(rbx, FieldOperand(rcx, FixedArray::kLengthOffset));
       __ bind(&loop);
       __ decl(rbx);
       __ movp(kScratchRegister, FieldOperand(rcx, rbx, times_pointer_size,
@@ -2502,15 +2129,15 @@ void Builtins::Generate_Call(MacroAssembler* masm, ConvertReceiverMode mode) {
   // -----------------------------------
   StackArgumentsAccessor args(rsp, rax);
 
-  Label non_callable, non_function, non_smi;
+  Label non_callable;
   __ JumpIfSmi(rdi, &non_callable);
-  __ bind(&non_smi);
   __ CmpObjectType(rdi, JS_FUNCTION_TYPE, rcx);
-  __ j(equal, masm->isolate()->builtins()->CallFunction(mode),
-       RelocInfo::CODE_TARGET);
+  __ Jump(masm->isolate()->builtins()->CallFunction(mode),
+          RelocInfo::CODE_TARGET, equal);
+
   __ CmpInstanceType(rcx, JS_BOUND_FUNCTION_TYPE);
-  __ j(equal, BUILTIN_CODE(masm->isolate(), CallBoundFunction),
-       RelocInfo::CODE_TARGET);
+  __ Jump(BUILTIN_CODE(masm->isolate(), CallBoundFunction),
+          RelocInfo::CODE_TARGET, equal);
 
   // Check if target has a [[Call]] internal method.
   __ testb(FieldOperand(rcx, Map::kBitFieldOffset),
@@ -2519,12 +2146,12 @@ void Builtins::Generate_Call(MacroAssembler* masm, ConvertReceiverMode mode) {
 
   // Check if target is a proxy and call CallProxy external builtin
   __ CmpInstanceType(rcx, JS_PROXY_TYPE);
-  __ j(not_equal, &non_function, Label::kNear);
-  __ Jump(BUILTIN_CODE(masm->isolate(), CallProxy), RelocInfo::CODE_TARGET);
+  __ Jump(BUILTIN_CODE(masm->isolate(), CallProxy), RelocInfo::CODE_TARGET,
+          equal);
 
   // 2. Call to something else, which might have a [[Call]] internal method (if
   // not we raise an exception).
-  __ bind(&non_function);
+
   // Overwrite the original receiver with the (original) target.
   __ movp(args.GetReceiverOperand(), rdi);
   // Let the "call_as_function_delegate" take care of the rest.
@@ -2556,19 +2183,14 @@ void Builtins::Generate_ConstructFunction(MacroAssembler* masm) {
   // rbx to contain either an AllocationSite or undefined.
   __ LoadRoot(rbx, Heap::kUndefinedValueRootIndex);
 
-  Label call_generic_stub;
-
   // Jump to JSBuiltinsConstructStub or JSConstructStubGeneric.
   __ movp(rcx, FieldOperand(rdi, JSFunction::kSharedFunctionInfoOffset));
   __ testl(FieldOperand(rcx, SharedFunctionInfo::kFlagsOffset),
            Immediate(SharedFunctionInfo::ConstructAsBuiltinBit::kMask));
-  __ j(zero, &call_generic_stub, Label::kNear);
-
   __ Jump(BUILTIN_CODE(masm->isolate(), JSBuiltinsConstructStub),
-          RelocInfo::CODE_TARGET);
+          RelocInfo::CODE_TARGET, not_zero);
 
-  __ bind(&call_generic_stub);
-  __ Jump(masm->isolate()->builtins()->JSConstructStubGeneric(),
+  __ Jump(BUILTIN_CODE(masm->isolate(), JSConstructStubGeneric),
           RelocInfo::CODE_TARGET);
 }
 
@@ -2611,34 +2233,32 @@ void Builtins::Generate_Construct(MacroAssembler* masm) {
   StackArgumentsAccessor args(rsp, rax);
 
   // Check if target is a Smi.
-  Label non_constructor, non_proxy;
-  __ JumpIfSmi(rdi, &non_constructor, Label::kNear);
+  Label non_constructor;
+  __ JumpIfSmi(rdi, &non_constructor);
 
   // Check if target has a [[Construct]] internal method.
   __ movq(rcx, FieldOperand(rdi, HeapObject::kMapOffset));
   __ testb(FieldOperand(rcx, Map::kBitFieldOffset),
            Immediate(Map::IsConstructorBit::kMask));
-  __ j(zero, &non_constructor, Label::kNear);
+  __ j(zero, &non_constructor);
 
   // Dispatch based on instance type.
   __ CmpInstanceType(rcx, JS_FUNCTION_TYPE);
-  __ j(equal, BUILTIN_CODE(masm->isolate(), ConstructFunction),
-       RelocInfo::CODE_TARGET);
+  __ Jump(BUILTIN_CODE(masm->isolate(), ConstructFunction),
+          RelocInfo::CODE_TARGET, equal);
 
   // Only dispatch to bound functions after checking whether they are
   // constructors.
   __ CmpInstanceType(rcx, JS_BOUND_FUNCTION_TYPE);
-  __ j(equal, BUILTIN_CODE(masm->isolate(), ConstructBoundFunction),
-       RelocInfo::CODE_TARGET);
+  __ Jump(BUILTIN_CODE(masm->isolate(), ConstructBoundFunction),
+          RelocInfo::CODE_TARGET, equal);
 
   // Only dispatch to proxies after checking whether they are constructors.
   __ CmpInstanceType(rcx, JS_PROXY_TYPE);
-  __ j(not_equal, &non_proxy, Label::kNear);
-  __ Jump(BUILTIN_CODE(masm->isolate(), ConstructProxy),
-          RelocInfo::CODE_TARGET);
+  __ Jump(BUILTIN_CODE(masm->isolate(), ConstructProxy), RelocInfo::CODE_TARGET,
+          equal);
 
   // Called Construct on an exotic Object with a [[Construct]] internal method.
-  __ bind(&non_proxy);
   {
     // Overwrite the original receiver with the (original) target.
     __ movp(args.GetReceiverOperand(), rdi);
@@ -2690,10 +2310,9 @@ static void Generate_OnStackReplacementHelper(MacroAssembler* masm,
   __ movp(rbx, Operand(rax, Code::kDeoptimizationDataOffset - kHeapObjectTag));
 
   // Load the OSR entrypoint offset from the deoptimization data.
-  __ SmiToInteger32(rbx,
-                    Operand(rbx, FixedArray::OffsetOfElementAt(
-                                     DeoptimizationData::kOsrPcOffsetIndex) -
-                                     kHeapObjectTag));
+  __ SmiUntag(rbx, Operand(rbx, FixedArray::OffsetOfElementAt(
+                                    DeoptimizationData::kOsrPcOffsetIndex) -
+                                    kHeapObjectTag));
 
   // Compute the target address = code_obj + header_size + osr_offset
   __ leap(rax, Operand(rax, rbx, times_1, Code::kHeaderSize - kHeapObjectTag));
@@ -2714,49 +2333,517 @@ void Builtins::Generate_InterpreterOnStackReplacement(MacroAssembler* masm) {
 }
 
 void Builtins::Generate_WasmCompileLazy(MacroAssembler* masm) {
+  // The function index was pushed to the stack by the caller as int32.
+  __ Pop(r11);
+  // Convert to Smi for the runtime call.
+  __ SmiTag(r11, r11);
   {
-    FrameScope scope(masm, StackFrame::INTERNAL);
-
-    auto wasm_instance_reg = rsi;  // TODO(titzer): put in a common place.
+    TrapOnAbortScope trap_on_abort_scope(masm);  // Avoid calls to Abort.
+    FrameScope scope(masm, StackFrame::WASM_COMPILE_LAZY);
 
     // Save all parameter registers (see wasm-linkage.cc). They might be
     // overwritten in the runtime call below. We don't have any callee-saved
     // registers in wasm, so no need to store anything else.
-    constexpr Register gp_regs[]{rax, rbx, rcx, rdx, rdi};
-    constexpr XMMRegister xmm_regs[]{xmm1, xmm2, xmm3, xmm4, xmm5, xmm6};
-
-    for (auto reg : gp_regs) {
+    static_assert(WasmCompileLazyFrameConstants::kNumberOfSavedGpParamRegs ==
+                      arraysize(wasm::kGpParamRegisters),
+                  "frame size mismatch");
+    for (Register reg : wasm::kGpParamRegisters) {
       __ Push(reg);
     }
-    __ subp(rsp, Immediate(16 * arraysize(xmm_regs)));
-    for (int i = 0, e = arraysize(xmm_regs); i < e; ++i) {
-      __ movdqu(Operand(rsp, 16 * i), xmm_regs[i]);
+    static_assert(WasmCompileLazyFrameConstants::kNumberOfSavedFpParamRegs ==
+                      arraysize(wasm::kFpParamRegisters),
+                  "frame size mismatch");
+    __ subp(rsp, Immediate(kSimd128Size * arraysize(wasm::kFpParamRegisters)));
+    int offset = 0;
+    for (DoubleRegister reg : wasm::kFpParamRegisters) {
+      __ movdqu(Operand(rsp, offset), reg);
+      offset += kSimd128Size;
     }
 
-    // Pass the WASM instance as an explicit argument to WasmCompileLazy.
-    __ Push(wasm_instance_reg);
-    // Initialize the JavaScript context with 0. CEntryStub will use it to
+    // Push the WASM instance as an explicit argument to WasmCompileLazy.
+    __ Push(kWasmInstanceRegister);
+    // Push the function index as second argument.
+    __ Push(r11);
+    // Load the correct CEntry builtin from the instance object.
+    __ movp(rcx, FieldOperand(kWasmInstanceRegister,
+                              WasmInstanceObject::kCEntryStubOffset));
+    // Initialize the JavaScript context with 0. CEntry will use it to
     // set the current context on the isolate.
-    __ Move(rsi, Smi::kZero);
-    __ CallRuntime(Runtime::kWasmCompileLazy);
-    // The entrypoint address is the first return value.
+    __ Move(kContextRegister, Smi::kZero);
+    __ CallRuntimeWithCEntry(Runtime::kWasmCompileLazy, rcx);
+    // The entrypoint address is the return value.
     __ movq(r11, kReturnRegister0);
-    // The WASM instance is the second return value.
-    __ movq(wasm_instance_reg, kReturnRegister1);
 
     // Restore registers.
-    for (int i = arraysize(xmm_regs) - 1; i >= 0; --i) {
-      __ movdqu(xmm_regs[i], Operand(rsp, 16 * i));
+    for (DoubleRegister reg : base::Reversed(wasm::kFpParamRegisters)) {
+      offset -= kSimd128Size;
+      __ movdqu(reg, Operand(rsp, offset));
     }
-    __ addp(rsp, Immediate(16 * arraysize(xmm_regs)));
-    for (int i = arraysize(gp_regs) - 1; i >= 0; --i) {
-      __ Pop(gp_regs[i]);
+    DCHECK_EQ(0, offset);
+    __ addp(rsp, Immediate(kSimd128Size * arraysize(wasm::kFpParamRegisters)));
+    for (Register reg : base::Reversed(wasm::kGpParamRegisters)) {
+      __ Pop(reg);
     }
   }
   // Finally, jump to the entrypoint.
   __ jmp(r11);
 }
 
+void Builtins::Generate_CEntry(MacroAssembler* masm, int result_size,
+                               SaveFPRegsMode save_doubles, ArgvMode argv_mode,
+                               bool builtin_exit_frame) {
+  // rax: number of arguments including receiver
+  // rbx: pointer to C function  (C callee-saved)
+  // rbp: frame pointer of calling JS frame (restored after C call)
+  // rsp: stack pointer  (restored after C call)
+  // rsi: current context (restored)
+  //
+  // If argv_mode == kArgvInRegister:
+  // r15: pointer to the first argument
+
+  ProfileEntryHookStub::MaybeCallEntryHook(masm);
+
+#ifdef _WIN64
+  // Windows 64-bit ABI passes arguments in rcx, rdx, r8, r9. It requires the
+  // stack to be aligned to 16 bytes. It only allows a single-word to be
+  // returned in register rax. Larger return sizes must be written to an address
+  // passed as a hidden first argument.
+  const Register kCCallArg0 = rcx;
+  const Register kCCallArg1 = rdx;
+  const Register kCCallArg2 = r8;
+  const Register kCCallArg3 = r9;
+  const int kArgExtraStackSpace = 2;
+  const int kMaxRegisterResultSize = 1;
+#else
+  // GCC / Clang passes arguments in rdi, rsi, rdx, rcx, r8, r9. Simple results
+  // are returned in rax, and a struct of two pointers are returned in rax+rdx.
+  // Larger return sizes must be written to an address passed as a hidden first
+  // argument.
+  const Register kCCallArg0 = rdi;
+  const Register kCCallArg1 = rsi;
+  const Register kCCallArg2 = rdx;
+  const Register kCCallArg3 = rcx;
+  const int kArgExtraStackSpace = 0;
+  const int kMaxRegisterResultSize = 2;
+#endif  // _WIN64
+
+  // Enter the exit frame that transitions from JavaScript to C++.
+  int arg_stack_space =
+      kArgExtraStackSpace +
+      (result_size <= kMaxRegisterResultSize ? 0 : result_size);
+  if (argv_mode == kArgvInRegister) {
+    DCHECK(save_doubles == kDontSaveFPRegs);
+    DCHECK(!builtin_exit_frame);
+    __ EnterApiExitFrame(arg_stack_space);
+    // Move argc into r14 (argv is already in r15).
+    __ movp(r14, rax);
+  } else {
+    __ EnterExitFrame(
+        arg_stack_space, save_doubles == kSaveFPRegs,
+        builtin_exit_frame ? StackFrame::BUILTIN_EXIT : StackFrame::EXIT);
+  }
+
+  // rbx: pointer to builtin function  (C callee-saved).
+  // rbp: frame pointer of exit frame  (restored after C call).
+  // rsp: stack pointer (restored after C call).
+  // r14: number of arguments including receiver (C callee-saved).
+  // r15: argv pointer (C callee-saved).
+
+  // Check stack alignment.
+  if (FLAG_debug_code) {
+    __ CheckStackAlignment();
+  }
+
+  // Call C function. The arguments object will be created by stubs declared by
+  // DECLARE_RUNTIME_FUNCTION().
+  if (result_size <= kMaxRegisterResultSize) {
+    // Pass a pointer to the Arguments object as the first argument.
+    // Return result in single register (rax), or a register pair (rax, rdx).
+    __ movp(kCCallArg0, r14);  // argc.
+    __ movp(kCCallArg1, r15);  // argv.
+    __ Move(kCCallArg2, ExternalReference::isolate_address(masm->isolate()));
+  } else {
+    DCHECK_LE(result_size, 2);
+    // Pass a pointer to the result location as the first argument.
+    __ leap(kCCallArg0, StackSpaceOperand(kArgExtraStackSpace));
+    // Pass a pointer to the Arguments object as the second argument.
+    __ movp(kCCallArg1, r14);  // argc.
+    __ movp(kCCallArg2, r15);  // argv.
+    __ Move(kCCallArg3, ExternalReference::isolate_address(masm->isolate()));
+  }
+  __ call(rbx);
+
+  if (result_size > kMaxRegisterResultSize) {
+    // Read result values stored on stack. Result is stored
+    // above the the two Arguments object slots on Win64.
+    DCHECK_LE(result_size, 2);
+    __ movq(kReturnRegister0, StackSpaceOperand(kArgExtraStackSpace + 0));
+    __ movq(kReturnRegister1, StackSpaceOperand(kArgExtraStackSpace + 1));
+  }
+  // Result is in rax or rdx:rax - do not destroy these registers!
+
+  // Check result for exception sentinel.
+  Label exception_returned;
+  __ CompareRoot(rax, Heap::kExceptionRootIndex);
+  __ j(equal, &exception_returned);
+
+  // Check that there is no pending exception, otherwise we
+  // should have returned the exception sentinel.
+  if (FLAG_debug_code) {
+    Label okay;
+    __ LoadRoot(r14, Heap::kTheHoleValueRootIndex);
+    ExternalReference pending_exception_address = ExternalReference::Create(
+        IsolateAddressId::kPendingExceptionAddress, masm->isolate());
+    Operand pending_exception_operand =
+        masm->ExternalOperand(pending_exception_address);
+    __ cmpp(r14, pending_exception_operand);
+    __ j(equal, &okay, Label::kNear);
+    __ int3();
+    __ bind(&okay);
+  }
+
+  // Exit the JavaScript to C++ exit frame.
+  __ LeaveExitFrame(save_doubles == kSaveFPRegs, argv_mode == kArgvOnStack);
+  __ ret(0);
+
+  // Handling of exception.
+  __ bind(&exception_returned);
+
+  ExternalReference pending_handler_context_address = ExternalReference::Create(
+      IsolateAddressId::kPendingHandlerContextAddress, masm->isolate());
+  ExternalReference pending_handler_entrypoint_address =
+      ExternalReference::Create(
+          IsolateAddressId::kPendingHandlerEntrypointAddress, masm->isolate());
+  ExternalReference pending_handler_fp_address = ExternalReference::Create(
+      IsolateAddressId::kPendingHandlerFPAddress, masm->isolate());
+  ExternalReference pending_handler_sp_address = ExternalReference::Create(
+      IsolateAddressId::kPendingHandlerSPAddress, masm->isolate());
+
+  // Ask the runtime for help to determine the handler. This will set rax to
+  // contain the current pending exception, don't clobber it.
+  ExternalReference find_handler =
+      ExternalReference::Create(Runtime::kUnwindAndFindExceptionHandler);
+  {
+    FrameScope scope(masm, StackFrame::MANUAL);
+    __ movp(arg_reg_1, Immediate(0));  // argc.
+    __ movp(arg_reg_2, Immediate(0));  // argv.
+    __ Move(arg_reg_3, ExternalReference::isolate_address(masm->isolate()));
+    __ PrepareCallCFunction(3);
+    __ CallCFunction(find_handler, 3);
+  }
+  // Retrieve the handler context, SP and FP.
+  __ movp(rsi, masm->ExternalOperand(pending_handler_context_address));
+  __ movp(rsp, masm->ExternalOperand(pending_handler_sp_address));
+  __ movp(rbp, masm->ExternalOperand(pending_handler_fp_address));
+
+  // If the handler is a JS frame, restore the context to the frame. Note that
+  // the context will be set to (rsi == 0) for non-JS frames.
+  Label skip;
+  __ testp(rsi, rsi);
+  __ j(zero, &skip, Label::kNear);
+  __ movp(Operand(rbp, StandardFrameConstants::kContextOffset), rsi);
+  __ bind(&skip);
+
+  // Reset the masking register. This is done independent of the underlying
+  // feature flag {FLAG_branch_load_poisoning} to make the snapshot work with
+  // both configurations. It is safe to always do this, because the underlying
+  // register is caller-saved and can be arbitrarily clobbered.
+  __ ResetSpeculationPoisonRegister();
+
+  // Compute the handler entry address and jump to it.
+  __ movp(rdi, masm->ExternalOperand(pending_handler_entrypoint_address));
+  __ jmp(rdi);
+}
+
+void Builtins::Generate_DoubleToI(MacroAssembler* masm) {
+  Label check_negative, process_64_bits, done;
+
+  // Account for return address and saved regs.
+  const int kArgumentOffset = 4 * kRegisterSize;
+
+  MemOperand mantissa_operand(MemOperand(rsp, kArgumentOffset));
+  MemOperand exponent_operand(
+      MemOperand(rsp, kArgumentOffset + kDoubleSize / 2));
+
+  // The result is returned on the stack.
+  MemOperand return_operand = mantissa_operand;
+
+  Register scratch1 = rbx;
+
+  // Since we must use rcx for shifts below, use some other register (rax)
+  // to calculate the result if ecx is the requested return register.
+  Register result_reg = rax;
+  // Save ecx if it isn't the return register and therefore volatile, or if it
+  // is the return register, then save the temp register we use in its stead
+  // for the result.
+  Register save_reg = rax;
+  __ pushq(rcx);
+  __ pushq(scratch1);
+  __ pushq(save_reg);
+
+  __ movl(scratch1, mantissa_operand);
+  __ Movsd(kScratchDoubleReg, mantissa_operand);
+  __ movl(rcx, exponent_operand);
+
+  __ andl(rcx, Immediate(HeapNumber::kExponentMask));
+  __ shrl(rcx, Immediate(HeapNumber::kExponentShift));
+  __ leal(result_reg, MemOperand(rcx, -HeapNumber::kExponentBias));
+  __ cmpl(result_reg, Immediate(HeapNumber::kMantissaBits));
+  __ j(below, &process_64_bits, Label::kNear);
+
+  // Result is entirely in lower 32-bits of mantissa
+  int delta = HeapNumber::kExponentBias + Double::kPhysicalSignificandSize;
+  __ subl(rcx, Immediate(delta));
+  __ xorl(result_reg, result_reg);
+  __ cmpl(rcx, Immediate(31));
+  __ j(above, &done, Label::kNear);
+  __ shll_cl(scratch1);
+  __ jmp(&check_negative, Label::kNear);
+
+  __ bind(&process_64_bits);
+  __ Cvttsd2siq(result_reg, kScratchDoubleReg);
+  __ jmp(&done, Label::kNear);
+
+  // If the double was negative, negate the integer result.
+  __ bind(&check_negative);
+  __ movl(result_reg, scratch1);
+  __ negl(result_reg);
+  __ cmpl(exponent_operand, Immediate(0));
+  __ cmovl(greater, result_reg, scratch1);
+
+  // Restore registers
+  __ bind(&done);
+  __ movl(return_operand, result_reg);
+  __ popq(save_reg);
+  __ popq(scratch1);
+  __ popq(rcx);
+  __ ret(0);
+}
+
+void Builtins::Generate_MathPowInternal(MacroAssembler* masm) {
+  const Register exponent = rdx;
+  const Register scratch = rcx;
+  const XMMRegister double_result = xmm3;
+  const XMMRegister double_base = xmm2;
+  const XMMRegister double_exponent = xmm1;
+  const XMMRegister double_scratch = xmm4;
+
+  Label call_runtime, done, exponent_not_smi, int_exponent;
+
+  // Save 1 in double_result - we need this several times later on.
+  __ movp(scratch, Immediate(1));
+  __ Cvtlsi2sd(double_result, scratch);
+
+  Label fast_power, try_arithmetic_simplification;
+  // Detect integer exponents stored as double.
+  __ DoubleToI(exponent, double_exponent, double_scratch,
+               &try_arithmetic_simplification, &try_arithmetic_simplification);
+  __ jmp(&int_exponent);
+
+  __ bind(&try_arithmetic_simplification);
+  __ Cvttsd2si(exponent, double_exponent);
+  // Skip to runtime if possibly NaN (indicated by the indefinite integer).
+  __ cmpl(exponent, Immediate(0x1));
+  __ j(overflow, &call_runtime);
+
+  // Using FPU instructions to calculate power.
+  Label fast_power_failed;
+  __ bind(&fast_power);
+  __ fnclex();  // Clear flags to catch exceptions later.
+  // Transfer (B)ase and (E)xponent onto the FPU register stack.
+  __ subp(rsp, Immediate(kDoubleSize));
+  __ Movsd(Operand(rsp, 0), double_exponent);
+  __ fld_d(Operand(rsp, 0));  // E
+  __ Movsd(Operand(rsp, 0), double_base);
+  __ fld_d(Operand(rsp, 0));  // B, E
+
+  // Exponent is in st(1) and base is in st(0)
+  // B ^ E = (2^(E * log2(B)) - 1) + 1 = (2^X - 1) + 1 for X = E * log2(B)
+  // FYL2X calculates st(1) * log2(st(0))
+  __ fyl2x();    // X
+  __ fld(0);     // X, X
+  __ frndint();  // rnd(X), X
+  __ fsub(1);    // rnd(X), X-rnd(X)
+  __ fxch(1);    // X - rnd(X), rnd(X)
+  // F2XM1 calculates 2^st(0) - 1 for -1 < st(0) < 1
+  __ f2xm1();   // 2^(X-rnd(X)) - 1, rnd(X)
+  __ fld1();    // 1, 2^(X-rnd(X)) - 1, rnd(X)
+  __ faddp(1);  // 2^(X-rnd(X)), rnd(X)
+  // FSCALE calculates st(0) * 2^st(1)
+  __ fscale();  // 2^X, rnd(X)
+  __ fstp(1);
+  // Bail out to runtime in case of exceptions in the status word.
+  __ fnstsw_ax();
+  __ testb(rax, Immediate(0x5F));  // Check for all but precision exception.
+  __ j(not_zero, &fast_power_failed, Label::kNear);
+  __ fstp_d(Operand(rsp, 0));
+  __ Movsd(double_result, Operand(rsp, 0));
+  __ addp(rsp, Immediate(kDoubleSize));
+  __ jmp(&done);
+
+  __ bind(&fast_power_failed);
+  __ fninit();
+  __ addp(rsp, Immediate(kDoubleSize));
+  __ jmp(&call_runtime);
+
+  // Calculate power with integer exponent.
+  __ bind(&int_exponent);
+  const XMMRegister double_scratch2 = double_exponent;
+  // Back up exponent as we need to check if exponent is negative later.
+  __ movp(scratch, exponent);                // Back up exponent.
+  __ Movsd(double_scratch, double_base);     // Back up base.
+  __ Movsd(double_scratch2, double_result);  // Load double_exponent with 1.
+
+  // Get absolute value of exponent.
+  Label no_neg, while_true, while_false;
+  __ testl(scratch, scratch);
+  __ j(positive, &no_neg, Label::kNear);
+  __ negl(scratch);
+  __ bind(&no_neg);
+
+  __ j(zero, &while_false, Label::kNear);
+  __ shrl(scratch, Immediate(1));
+  // Above condition means CF==0 && ZF==0.  This means that the
+  // bit that has been shifted out is 0 and the result is not 0.
+  __ j(above, &while_true, Label::kNear);
+  __ Movsd(double_result, double_scratch);
+  __ j(zero, &while_false, Label::kNear);
+
+  __ bind(&while_true);
+  __ shrl(scratch, Immediate(1));
+  __ Mulsd(double_scratch, double_scratch);
+  __ j(above, &while_true, Label::kNear);
+  __ Mulsd(double_result, double_scratch);
+  __ j(not_zero, &while_true);
+
+  __ bind(&while_false);
+  // If the exponent is negative, return 1/result.
+  __ testl(exponent, exponent);
+  __ j(greater, &done);
+  __ Divsd(double_scratch2, double_result);
+  __ Movsd(double_result, double_scratch2);
+  // Test whether result is zero.  Bail out to check for subnormal result.
+  // Due to subnormals, x^-y == (1/x)^y does not hold in all cases.
+  __ Xorpd(double_scratch2, double_scratch2);
+  __ Ucomisd(double_scratch2, double_result);
+  // double_exponent aliased as double_scratch2 has already been overwritten
+  // and may not have contained the exponent value in the first place when the
+  // input was a smi.  We reset it with exponent value before bailing out.
+  __ j(not_equal, &done);
+  __ Cvtlsi2sd(double_exponent, exponent);
+
+  // Returning or bailing out.
+  __ bind(&call_runtime);
+  // Move base to the correct argument register.  Exponent is already in xmm1.
+  __ Movsd(xmm0, double_base);
+  DCHECK(double_exponent == xmm1);
+  {
+    AllowExternalCallThatCantCauseGC scope(masm);
+    __ PrepareCallCFunction(2);
+    __ CallCFunction(ExternalReference::power_double_double_function(), 2);
+  }
+  // Return value is in xmm0.
+  __ Movsd(double_result, xmm0);
+
+  __ bind(&done);
+  __ ret(0);
+}
+
+namespace {
+
+void GenerateInternalArrayConstructorCase(MacroAssembler* masm,
+                                          ElementsKind kind) {
+  Label not_zero_case, not_one_case;
+  Label normal_sequence;
+
+  __ testp(rax, rax);
+  __ j(not_zero, &not_zero_case);
+  __ Jump(CodeFactory::InternalArrayNoArgumentConstructor(masm->isolate(), kind)
+              .code(),
+          RelocInfo::CODE_TARGET);
+
+  __ bind(&not_zero_case);
+  __ cmpl(rax, Immediate(1));
+  __ j(greater, &not_one_case);
+
+  if (IsFastPackedElementsKind(kind)) {
+    // We might need to create a holey array
+    // look at the first argument
+    StackArgumentsAccessor args(rsp, 1, ARGUMENTS_DONT_CONTAIN_RECEIVER);
+    __ movp(rcx, args.GetArgumentOperand(0));
+    __ testp(rcx, rcx);
+    __ j(zero, &normal_sequence);
+
+    __ Jump(CodeFactory::InternalArraySingleArgumentConstructor(
+                masm->isolate(), GetHoleyElementsKind(kind))
+                .code(),
+            RelocInfo::CODE_TARGET);
+  }
+
+  __ bind(&normal_sequence);
+  __ Jump(
+      CodeFactory::InternalArraySingleArgumentConstructor(masm->isolate(), kind)
+          .code(),
+      RelocInfo::CODE_TARGET);
+
+  __ bind(&not_one_case);
+  Handle<Code> code = BUILTIN_CODE(masm->isolate(), ArrayNArgumentsConstructor);
+  __ Jump(code, RelocInfo::CODE_TARGET);
+}
+
+}  // namespace
+
+void Builtins::Generate_InternalArrayConstructorImpl(MacroAssembler* masm) {
+  // ----------- S t a t e -------------
+  //  -- rax    : argc
+  //  -- rdi    : constructor
+  //  -- rsp[0] : return address
+  //  -- rsp[8] : last argument
+  // -----------------------------------
+
+  if (FLAG_debug_code) {
+    // The array construct code is only set for the global and natives
+    // builtin Array functions which always have maps.
+
+    // Initial map for the builtin Array function should be a map.
+    __ movp(rcx, FieldOperand(rdi, JSFunction::kPrototypeOrInitialMapOffset));
+    // Will both indicate a nullptr and a Smi.
+    STATIC_ASSERT(kSmiTag == 0);
+    Condition not_smi = NegateCondition(masm->CheckSmi(rcx));
+    __ Check(not_smi, AbortReason::kUnexpectedInitialMapForArrayFunction);
+    __ CmpObjectType(rcx, MAP_TYPE, rcx);
+    __ Check(equal, AbortReason::kUnexpectedInitialMapForArrayFunction);
+  }
+
+  // Figure out the right elements kind
+  __ movp(rcx, FieldOperand(rdi, JSFunction::kPrototypeOrInitialMapOffset));
+
+  // Load the map's "bit field 2" into |result|. We only need the first byte,
+  // but the following masking takes care of that anyway.
+  __ movzxbp(rcx, FieldOperand(rcx, Map::kBitField2Offset));
+  // Retrieve elements_kind from bit field 2.
+  __ DecodeField<Map::ElementsKindBits>(rcx);
+
+  if (FLAG_debug_code) {
+    Label done;
+    __ cmpl(rcx, Immediate(PACKED_ELEMENTS));
+    __ j(equal, &done);
+    __ cmpl(rcx, Immediate(HOLEY_ELEMENTS));
+    __ Assert(
+        equal,
+        AbortReason::kInvalidElementsKindForInternalArrayOrInternalPackedArray);
+    __ bind(&done);
+  }
+
+  Label fast_elements_case;
+  __ cmpl(rcx, Immediate(PACKED_ELEMENTS));
+  __ j(equal, &fast_elements_case);
+  GenerateInternalArrayConstructorCase(masm, HOLEY_ELEMENTS);
+
+  __ bind(&fast_elements_case);
+  GenerateInternalArrayConstructorCase(masm, PACKED_ELEMENTS);
+}
+
 #undef __
 
 }  // namespace internal
diff --git a/deps/v8/src/checks.h b/deps/v8/src/checks.h
index 0d7eed3481184c..8eb10f43dd7e97 100644
--- a/deps/v8/src/checks.h
+++ b/deps/v8/src/checks.h
@@ -27,9 +27,8 @@ static const bool FLAG_enable_slow_asserts = false;
 }  // namespace internal
 }  // namespace v8
 
-#define DCHECK_TAG_ALIGNED(address)             \
-  DCHECK((reinterpret_cast<intptr_t>(address) & \
-          ::v8::internal::kHeapObjectTagMask) == 0)
+#define DCHECK_TAG_ALIGNED(address) \
+  DCHECK((address & ::v8::internal::kHeapObjectTagMask) == 0)
 
 #define DCHECK_SIZE_TAG_ALIGNED(size) \
   DCHECK((size & ::v8::internal::kHeapObjectTagMask) == 0)
diff --git a/deps/v8/src/code-events.h b/deps/v8/src/code-events.h
index caed5160f47a24..09cd5a62e00beb 100644
--- a/deps/v8/src/code-events.h
+++ b/deps/v8/src/code-events.h
@@ -88,8 +88,7 @@ class CodeEventListener {
   virtual void CodeMovingGCEvent() = 0;
   virtual void CodeDisableOptEvent(AbstractCode* code,
                                    SharedFunctionInfo* shared) = 0;
-  enum DeoptKind { kSoft, kLazy, kEager };
-  virtual void CodeDeoptEvent(Code* code, DeoptKind kind, Address pc,
+  virtual void CodeDeoptEvent(Code* code, DeoptimizeKind kind, Address pc,
                               int fp_to_sp_delta) = 0;
 
   virtual bool is_listening_to_code_events() { return false; }
@@ -165,7 +164,7 @@ class CodeEventDispatcher {
   void CodeDisableOptEvent(AbstractCode* code, SharedFunctionInfo* shared) {
     CODE_EVENT_DISPATCH(CodeDisableOptEvent(code, shared));
   }
-  void CodeDeoptEvent(Code* code, CodeEventListener::DeoptKind kind, Address pc,
+  void CodeDeoptEvent(Code* code, DeoptimizeKind kind, Address pc,
                       int fp_to_sp_delta) {
     CODE_EVENT_DISPATCH(CodeDeoptEvent(code, kind, pc, fp_to_sp_delta));
   }
diff --git a/deps/v8/src/code-factory.cc b/deps/v8/src/code-factory.cc
index e5b72b6fabcb32..b6eb03f81babd9 100644
--- a/deps/v8/src/code-factory.cc
+++ b/deps/v8/src/code-factory.cc
@@ -18,27 +18,76 @@ namespace {
 template <typename Stub>
 Callable make_callable(Stub& stub) {
   typedef typename Stub::Descriptor Descriptor;
-  return Callable(stub.GetCode(), Descriptor(stub.isolate()));
+  return Callable(stub.GetCode(), Descriptor{});
 }
 
 }  // namespace
 
 // static
 Handle<Code> CodeFactory::RuntimeCEntry(Isolate* isolate, int result_size) {
-  CEntryStub stub(isolate, result_size);
-  return stub.GetCode();
+  return CodeFactory::CEntry(isolate, result_size);
+}
+
+#define CENTRY_CODE(RS, SD, AM, BE) \
+  BUILTIN_CODE(isolate, CEntry_##RS##_##SD##_##AM##_##BE)
+
+// static
+Handle<Code> CodeFactory::CEntry(Isolate* isolate, int result_size,
+                                 SaveFPRegsMode save_doubles,
+                                 ArgvMode argv_mode, bool builtin_exit_frame) {
+  // Aliases for readability below.
+  const int rs = result_size;
+  const SaveFPRegsMode sd = save_doubles;
+  const ArgvMode am = argv_mode;
+  const bool be = builtin_exit_frame;
+
+  if (rs == 1 && sd == kDontSaveFPRegs && am == kArgvOnStack && !be) {
+    return CENTRY_CODE(Return1, DontSaveFPRegs, ArgvOnStack, NoBuiltinExit);
+  } else if (rs == 1 && sd == kDontSaveFPRegs && am == kArgvOnStack && be) {
+    return CENTRY_CODE(Return1, DontSaveFPRegs, ArgvOnStack, BuiltinExit);
+  } else if (rs == 1 && sd == kDontSaveFPRegs && am == kArgvInRegister && !be) {
+    return CENTRY_CODE(Return1, DontSaveFPRegs, ArgvInRegister, NoBuiltinExit);
+  } else if (rs == 1 && sd == kSaveFPRegs && am == kArgvOnStack && !be) {
+    return CENTRY_CODE(Return1, SaveFPRegs, ArgvOnStack, NoBuiltinExit);
+  } else if (rs == 1 && sd == kSaveFPRegs && am == kArgvOnStack && be) {
+    return CENTRY_CODE(Return1, SaveFPRegs, ArgvOnStack, BuiltinExit);
+  } else if (rs == 2 && sd == kDontSaveFPRegs && am == kArgvOnStack && !be) {
+    return CENTRY_CODE(Return2, DontSaveFPRegs, ArgvOnStack, NoBuiltinExit);
+  } else if (rs == 2 && sd == kDontSaveFPRegs && am == kArgvOnStack && be) {
+    return CENTRY_CODE(Return2, DontSaveFPRegs, ArgvOnStack, BuiltinExit);
+  } else if (rs == 2 && sd == kDontSaveFPRegs && am == kArgvInRegister && !be) {
+    return CENTRY_CODE(Return2, DontSaveFPRegs, ArgvInRegister, NoBuiltinExit);
+  } else if (rs == 2 && sd == kSaveFPRegs && am == kArgvOnStack && !be) {
+    return CENTRY_CODE(Return2, SaveFPRegs, ArgvOnStack, NoBuiltinExit);
+  } else if (rs == 2 && sd == kSaveFPRegs && am == kArgvOnStack && be) {
+    return CENTRY_CODE(Return2, SaveFPRegs, ArgvOnStack, BuiltinExit);
+  }
+
+  UNREACHABLE();
 }
 
+#undef CENTRY_CODE
+
 // static
 Callable CodeFactory::ApiGetter(Isolate* isolate) {
-  CallApiGetterStub stub(isolate);
-  return make_callable(stub);
+  return Callable(BUILTIN_CODE(isolate, CallApiGetter), ApiGetterDescriptor{});
 }
 
 // static
 Callable CodeFactory::CallApiCallback(Isolate* isolate, int argc) {
-  CallApiCallbackStub stub(isolate, argc);
-  return make_callable(stub);
+  switch (argc) {
+    case 0:
+      return Callable(BUILTIN_CODE(isolate, CallApiCallback_Argc0),
+                      ApiCallbackDescriptor{});
+    case 1:
+      return Callable(BUILTIN_CODE(isolate, CallApiCallback_Argc1),
+                      ApiCallbackDescriptor{});
+    default: {
+      CallApiCallbackStub stub(isolate, argc);
+      return make_callable(stub);
+    }
+  }
+  UNREACHABLE();
 }
 
 // static
@@ -47,7 +96,7 @@ Callable CodeFactory::LoadGlobalIC(Isolate* isolate, TypeofMode typeof_mode) {
       typeof_mode == NOT_INSIDE_TYPEOF
           ? BUILTIN_CODE(isolate, LoadGlobalICTrampoline)
           : BUILTIN_CODE(isolate, LoadGlobalICInsideTypeofTrampoline),
-      LoadGlobalDescriptor(isolate));
+      LoadGlobalDescriptor{});
 }
 
 // static
@@ -56,21 +105,19 @@ Callable CodeFactory::LoadGlobalICInOptimizedCode(Isolate* isolate,
   return Callable(typeof_mode == NOT_INSIDE_TYPEOF
                       ? BUILTIN_CODE(isolate, LoadGlobalIC)
                       : BUILTIN_CODE(isolate, LoadGlobalICInsideTypeof),
-                  LoadGlobalWithVectorDescriptor(isolate));
+                  LoadGlobalWithVectorDescriptor{});
 }
 
 Callable CodeFactory::StoreOwnIC(Isolate* isolate) {
   // TODO(ishell): Currently we use StoreOwnIC only for storing properties that
   // already exist in the boilerplate therefore we can use StoreIC.
-  return Callable(BUILTIN_CODE(isolate, StoreICTrampoline),
-                  StoreDescriptor(isolate));
+  return Callable(BUILTIN_CODE(isolate, StoreICTrampoline), StoreDescriptor{});
 }
 
 Callable CodeFactory::StoreOwnICInOptimizedCode(Isolate* isolate) {
   // TODO(ishell): Currently we use StoreOwnIC only for storing properties that
   // already exist in the boilerplate therefore we can use StoreIC.
-  return Callable(BUILTIN_CODE(isolate, StoreIC),
-                  StoreWithVectorDescriptor(isolate));
+  return Callable(BUILTIN_CODE(isolate, StoreIC), StoreWithVectorDescriptor{});
 }
 
 // static
@@ -104,140 +151,149 @@ Callable CodeFactory::BinaryOperation(Isolate* isolate, Operation op) {
   UNREACHABLE();
 }
 
-// static
-Callable CodeFactory::GetProperty(Isolate* isolate) {
-  GetPropertyStub stub(isolate);
-  return make_callable(stub);
-}
-
 // static
 Callable CodeFactory::NonPrimitiveToPrimitive(Isolate* isolate,
                                               ToPrimitiveHint hint) {
   return Callable(isolate->builtins()->NonPrimitiveToPrimitive(hint),
-                  TypeConversionDescriptor(isolate));
+                  TypeConversionDescriptor{});
 }
 
 // static
 Callable CodeFactory::OrdinaryToPrimitive(Isolate* isolate,
                                           OrdinaryToPrimitiveHint hint) {
   return Callable(isolate->builtins()->OrdinaryToPrimitive(hint),
-                  TypeConversionDescriptor(isolate));
+                  TypeConversionDescriptor{});
 }
 
 // static
 Callable CodeFactory::StringAdd(Isolate* isolate, StringAddFlags flags,
                                 PretenureFlag pretenure_flag) {
-  StringAddStub stub(isolate, flags, pretenure_flag);
-  return make_callable(stub);
+  if (pretenure_flag == NOT_TENURED) {
+    switch (flags) {
+      case STRING_ADD_CHECK_NONE:
+        return Builtins::CallableFor(isolate,
+                                     Builtins::kStringAdd_CheckNone_NotTenured);
+      case STRING_ADD_CONVERT_LEFT:
+        return Builtins::CallableFor(
+            isolate, Builtins::kStringAdd_ConvertLeft_NotTenured);
+      case STRING_ADD_CONVERT_RIGHT:
+        return Builtins::CallableFor(
+            isolate, Builtins::kStringAdd_ConvertRight_NotTenured);
+    }
+  } else {
+    CHECK_EQ(TENURED, pretenure_flag);
+    CHECK_EQ(STRING_ADD_CHECK_NONE, flags);
+    return Builtins::CallableFor(isolate,
+                                 Builtins::kStringAdd_CheckNone_Tenured);
+  }
+
+  UNREACHABLE();
 }
 
 // static
 Callable CodeFactory::ResumeGenerator(Isolate* isolate) {
   return Callable(BUILTIN_CODE(isolate, ResumeGeneratorTrampoline),
-                  ResumeGeneratorDescriptor(isolate));
+                  ResumeGeneratorDescriptor{});
 }
 
 // static
 Callable CodeFactory::FrameDropperTrampoline(Isolate* isolate) {
   return Callable(BUILTIN_CODE(isolate, FrameDropperTrampoline),
-                  FrameDropperTrampolineDescriptor(isolate));
+                  FrameDropperTrampolineDescriptor{});
 }
 
 // static
 Callable CodeFactory::HandleDebuggerStatement(Isolate* isolate) {
   return Callable(BUILTIN_CODE(isolate, HandleDebuggerStatement),
-                  ContextOnlyDescriptor(isolate));
+                  ContextOnlyDescriptor{});
 }
 
 // static
 Callable CodeFactory::FastNewFunctionContext(Isolate* isolate,
                                              ScopeType scope_type) {
   return Callable(isolate->builtins()->NewFunctionContext(scope_type),
-                  FastNewFunctionContextDescriptor(isolate));
+                  FastNewFunctionContextDescriptor{});
 }
 
 // static
 Callable CodeFactory::ArgumentAdaptor(Isolate* isolate) {
   return Callable(BUILTIN_CODE(isolate, ArgumentsAdaptorTrampoline),
-                  ArgumentAdaptorDescriptor(isolate));
+                  ArgumentAdaptorDescriptor{});
 }
 
 // static
 Callable CodeFactory::Call(Isolate* isolate, ConvertReceiverMode mode) {
-  return Callable(isolate->builtins()->Call(mode),
-                  CallTrampolineDescriptor(isolate));
+  return Callable(isolate->builtins()->Call(mode), CallTrampolineDescriptor{});
 }
 
 // static
 Callable CodeFactory::CallWithArrayLike(Isolate* isolate) {
   return Callable(BUILTIN_CODE(isolate, CallWithArrayLike),
-                  CallWithArrayLikeDescriptor(isolate));
+                  CallWithArrayLikeDescriptor{});
 }
 
 // static
 Callable CodeFactory::CallWithSpread(Isolate* isolate) {
   return Callable(BUILTIN_CODE(isolate, CallWithSpread),
-                  CallWithSpreadDescriptor(isolate));
+                  CallWithSpreadDescriptor{});
 }
 
 // static
 Callable CodeFactory::CallFunction(Isolate* isolate, ConvertReceiverMode mode) {
   return Callable(isolate->builtins()->CallFunction(mode),
-                  CallTrampolineDescriptor(isolate));
+                  CallTrampolineDescriptor{});
 }
 
 // static
 Callable CodeFactory::CallVarargs(Isolate* isolate) {
-  return Callable(BUILTIN_CODE(isolate, CallVarargs),
-                  CallVarargsDescriptor(isolate));
+  return Callable(BUILTIN_CODE(isolate, CallVarargs), CallVarargsDescriptor{});
 }
 
 // static
 Callable CodeFactory::CallForwardVarargs(Isolate* isolate) {
   return Callable(BUILTIN_CODE(isolate, CallForwardVarargs),
-                  CallForwardVarargsDescriptor(isolate));
+                  CallForwardVarargsDescriptor{});
 }
 
 // static
 Callable CodeFactory::CallFunctionForwardVarargs(Isolate* isolate) {
   return Callable(BUILTIN_CODE(isolate, CallFunctionForwardVarargs),
-                  CallForwardVarargsDescriptor(isolate));
+                  CallForwardVarargsDescriptor{});
 }
 
 // static
 Callable CodeFactory::Construct(Isolate* isolate) {
-  return Callable(BUILTIN_CODE(isolate, Construct),
-                  ConstructTrampolineDescriptor(isolate));
+  return Callable(BUILTIN_CODE(isolate, Construct), JSTrampolineDescriptor{});
 }
 
 // static
 Callable CodeFactory::ConstructWithSpread(Isolate* isolate) {
   return Callable(BUILTIN_CODE(isolate, ConstructWithSpread),
-                  ConstructWithSpreadDescriptor(isolate));
+                  ConstructWithSpreadDescriptor{});
 }
 
 // static
 Callable CodeFactory::ConstructFunction(Isolate* isolate) {
   return Callable(BUILTIN_CODE(isolate, ConstructFunction),
-                  ConstructTrampolineDescriptor(isolate));
+                  JSTrampolineDescriptor{});
 }
 
 // static
 Callable CodeFactory::ConstructVarargs(Isolate* isolate) {
   return Callable(BUILTIN_CODE(isolate, ConstructVarargs),
-                  ConstructVarargsDescriptor(isolate));
+                  ConstructVarargsDescriptor{});
 }
 
 // static
 Callable CodeFactory::ConstructForwardVarargs(Isolate* isolate) {
   return Callable(BUILTIN_CODE(isolate, ConstructForwardVarargs),
-                  ConstructForwardVarargsDescriptor(isolate));
+                  ConstructForwardVarargsDescriptor{});
 }
 
 // static
 Callable CodeFactory::ConstructFunctionForwardVarargs(Isolate* isolate) {
   return Callable(BUILTIN_CODE(isolate, ConstructFunctionForwardVarargs),
-                  ConstructForwardVarargsDescriptor(isolate));
+                  ConstructForwardVarargsDescriptor{});
 }
 
 // static
@@ -246,76 +302,139 @@ Callable CodeFactory::InterpreterPushArgsThenCall(
     InterpreterPushArgsMode mode) {
   return Callable(
       isolate->builtins()->InterpreterPushArgsThenCall(receiver_mode, mode),
-      InterpreterPushArgsThenCallDescriptor(isolate));
+      InterpreterPushArgsThenCallDescriptor{});
 }
 
 // static
 Callable CodeFactory::InterpreterPushArgsThenConstruct(
     Isolate* isolate, InterpreterPushArgsMode mode) {
   return Callable(isolate->builtins()->InterpreterPushArgsThenConstruct(mode),
-                  InterpreterPushArgsThenConstructDescriptor(isolate));
+                  InterpreterPushArgsThenConstructDescriptor{});
 }
 
 // static
 Callable CodeFactory::InterpreterCEntry(Isolate* isolate, int result_size) {
   // Note: If we ever use fpregs in the interpreter then we will need to
   // save fpregs too.
-  CEntryStub stub(isolate, result_size, kDontSaveFPRegs, kArgvInRegister);
-  return Callable(stub.GetCode(), InterpreterCEntryDescriptor(isolate));
+  Handle<Code> code = CodeFactory::CEntry(isolate, result_size, kDontSaveFPRegs,
+                                          kArgvInRegister);
+  if (result_size == 1) {
+    return Callable(code, InterpreterCEntry1Descriptor{});
+  } else {
+    DCHECK_EQ(result_size, 2);
+    return Callable(code, InterpreterCEntry2Descriptor{});
+  }
 }
 
 // static
 Callable CodeFactory::InterpreterOnStackReplacement(Isolate* isolate) {
   return Callable(BUILTIN_CODE(isolate, InterpreterOnStackReplacement),
-                  ContextOnlyDescriptor(isolate));
-}
-
-// static
-Callable CodeFactory::ArrayConstructor(Isolate* isolate) {
-  ArrayConstructorStub stub(isolate);
-  return make_callable(stub);
-}
-
-// static
-Callable CodeFactory::ArrayPop(Isolate* isolate) {
-  return Callable(BUILTIN_CODE(isolate, ArrayPop), BuiltinDescriptor(isolate));
-}
-
-// static
-Callable CodeFactory::ArrayShift(Isolate* isolate) {
-  return Callable(BUILTIN_CODE(isolate, ArrayShift),
-                  BuiltinDescriptor(isolate));
-}
-
-// static
-Callable CodeFactory::ExtractFastJSArray(Isolate* isolate) {
-  return Callable(BUILTIN_CODE(isolate, ExtractFastJSArray),
-                  ExtractFastJSArrayDescriptor(isolate));
-}
-
-// static
-Callable CodeFactory::CloneFastJSArray(Isolate* isolate) {
-  return Callable(BUILTIN_CODE(isolate, CloneFastJSArray),
-                  CloneFastJSArrayDescriptor(isolate));
-}
-
-// static
-Callable CodeFactory::ArrayPush(Isolate* isolate) {
-  return Callable(BUILTIN_CODE(isolate, ArrayPush), BuiltinDescriptor(isolate));
+                  ContextOnlyDescriptor{});
+}
+
+// static
+Callable CodeFactory::ArrayNoArgumentConstructor(
+    Isolate* isolate, ElementsKind kind,
+    AllocationSiteOverrideMode override_mode) {
+#define CASE(kind_caps, kind_camel, mode_camel)                               \
+  case kind_caps:                                                             \
+    return Callable(                                                          \
+        BUILTIN_CODE(isolate,                                                 \
+                     ArrayNoArgumentConstructor_##kind_camel##_##mode_camel), \
+        ArrayNoArgumentConstructorDescriptor{})
+  if (override_mode == DONT_OVERRIDE && AllocationSite::ShouldTrack(kind)) {
+    DCHECK(IsSmiElementsKind(kind));
+    switch (kind) {
+      CASE(PACKED_SMI_ELEMENTS, PackedSmi, DontOverride);
+      CASE(HOLEY_SMI_ELEMENTS, HoleySmi, DontOverride);
+      default:
+        UNREACHABLE();
+    }
+  } else {
+    DCHECK(override_mode == DISABLE_ALLOCATION_SITES ||
+           !AllocationSite::ShouldTrack(kind));
+    switch (kind) {
+      CASE(PACKED_SMI_ELEMENTS, PackedSmi, DisableAllocationSites);
+      CASE(HOLEY_SMI_ELEMENTS, HoleySmi, DisableAllocationSites);
+      CASE(PACKED_ELEMENTS, Packed, DisableAllocationSites);
+      CASE(HOLEY_ELEMENTS, Holey, DisableAllocationSites);
+      CASE(PACKED_DOUBLE_ELEMENTS, PackedDouble, DisableAllocationSites);
+      CASE(HOLEY_DOUBLE_ELEMENTS, HoleyDouble, DisableAllocationSites);
+      default:
+        UNREACHABLE();
+    }
+  }
+#undef CASE
+}
+
+// static
+Callable CodeFactory::ArraySingleArgumentConstructor(
+    Isolate* isolate, ElementsKind kind,
+    AllocationSiteOverrideMode override_mode) {
+#define CASE(kind_caps, kind_camel, mode_camel)                          \
+  case kind_caps:                                                        \
+    return Callable(                                                     \
+        BUILTIN_CODE(                                                    \
+            isolate,                                                     \
+            ArraySingleArgumentConstructor_##kind_camel##_##mode_camel), \
+        ArraySingleArgumentConstructorDescriptor{})
+  if (override_mode == DONT_OVERRIDE && AllocationSite::ShouldTrack(kind)) {
+    DCHECK(IsSmiElementsKind(kind));
+    switch (kind) {
+      CASE(PACKED_SMI_ELEMENTS, PackedSmi, DontOverride);
+      CASE(HOLEY_SMI_ELEMENTS, HoleySmi, DontOverride);
+      default:
+        UNREACHABLE();
+    }
+  } else {
+    DCHECK(override_mode == DISABLE_ALLOCATION_SITES ||
+           !AllocationSite::ShouldTrack(kind));
+    switch (kind) {
+      CASE(PACKED_SMI_ELEMENTS, PackedSmi, DisableAllocationSites);
+      CASE(HOLEY_SMI_ELEMENTS, HoleySmi, DisableAllocationSites);
+      CASE(PACKED_ELEMENTS, Packed, DisableAllocationSites);
+      CASE(HOLEY_ELEMENTS, Holey, DisableAllocationSites);
+      CASE(PACKED_DOUBLE_ELEMENTS, PackedDouble, DisableAllocationSites);
+      CASE(HOLEY_DOUBLE_ELEMENTS, HoleyDouble, DisableAllocationSites);
+      default:
+        UNREACHABLE();
+    }
+  }
+#undef CASE
 }
 
 // static
-Callable CodeFactory::FunctionPrototypeBind(Isolate* isolate) {
-  return Callable(BUILTIN_CODE(isolate, FunctionPrototypeBind),
-                  BuiltinDescriptor(isolate));
+Callable CodeFactory::InternalArrayNoArgumentConstructor(Isolate* isolate,
+                                                         ElementsKind kind) {
+  switch (kind) {
+    case PACKED_ELEMENTS:
+      return Callable(
+          BUILTIN_CODE(isolate, InternalArrayNoArgumentConstructor_Packed),
+          ArrayNoArgumentConstructorDescriptor{});
+    case HOLEY_ELEMENTS:
+      return Callable(
+          BUILTIN_CODE(isolate, InternalArrayNoArgumentConstructor_Holey),
+          ArrayNoArgumentConstructorDescriptor{});
+    default:
+      UNREACHABLE();
+  }
 }
 
 // static
-Callable CodeFactory::TransitionElementsKind(Isolate* isolate,
-                                             ElementsKind from, ElementsKind to,
-                                             bool is_jsarray) {
-  TransitionElementsKindStub stub(isolate, from, to, is_jsarray);
-  return make_callable(stub);
+Callable CodeFactory::InternalArraySingleArgumentConstructor(
+    Isolate* isolate, ElementsKind kind) {
+  switch (kind) {
+    case PACKED_ELEMENTS:
+      return Callable(
+          BUILTIN_CODE(isolate, InternalArraySingleArgumentConstructor_Packed),
+          ArraySingleArgumentConstructorDescriptor{});
+    case HOLEY_ELEMENTS:
+      return Callable(
+          BUILTIN_CODE(isolate, InternalArraySingleArgumentConstructor_Holey),
+          ArraySingleArgumentConstructorDescriptor{});
+    default:
+      UNREACHABLE();
+  }
 }
 
 }  // namespace internal
diff --git a/deps/v8/src/code-factory.h b/deps/v8/src/code-factory.h
index 079f16899af59a..3ff37695e2570e 100644
--- a/deps/v8/src/code-factory.h
+++ b/deps/v8/src/code-factory.h
@@ -15,14 +15,25 @@
 namespace v8 {
 namespace internal {
 
+// For ArrayNoArgumentConstructor and ArraySingleArgumentConstructor.
+enum AllocationSiteOverrideMode {
+  DONT_OVERRIDE,
+  DISABLE_ALLOCATION_SITES,
+};
+
 class V8_EXPORT_PRIVATE CodeFactory final {
  public:
-  // CEntryStub has var-args semantics (all the arguments are passed on the
+  // CEntry has var-args semantics (all the arguments are passed on the
   // stack and the arguments count is passed via register) which currently
   // can't be expressed in CallInterfaceDescriptor. Therefore only the code
   // is exported here.
   static Handle<Code> RuntimeCEntry(Isolate* isolate, int result_size = 1);
 
+  static Handle<Code> CEntry(Isolate* isolate, int result_size = 1,
+                             SaveFPRegsMode save_doubles = kDontSaveFPRegs,
+                             ArgvMode argv_mode = kArgvOnStack,
+                             bool builtin_exit_frame = false);
+
   // Initial states for ICs.
   static Callable LoadGlobalIC(Isolate* isolate, TypeofMode typeof_mode);
   static Callable LoadGlobalICInOptimizedCode(Isolate* isolate,
@@ -42,7 +53,6 @@ class V8_EXPORT_PRIVATE CodeFactory final {
 
   // Code stubs. Add methods here as needed to reduce dependency on
   // code-stubs.h.
-  static Callable GetProperty(Isolate* isolate);
 
   static Callable NonPrimitiveToPrimitive(
       Isolate* isolate, ToPrimitiveHint hint = ToPrimitiveHint::kDefault);
@@ -81,15 +91,17 @@ class V8_EXPORT_PRIVATE CodeFactory final {
   static Callable InterpreterCEntry(Isolate* isolate, int result_size = 1);
   static Callable InterpreterOnStackReplacement(Isolate* isolate);
 
-  static Callable ArrayConstructor(Isolate* isolate);
-  static Callable ArrayPop(Isolate* isolate);
-  static Callable ArrayPush(Isolate* isolate);
-  static Callable ArrayShift(Isolate* isolate);
-  static Callable ExtractFastJSArray(Isolate* isolate);
-  static Callable CloneFastJSArray(Isolate* isolate);
-  static Callable FunctionPrototypeBind(Isolate* isolate);
-  static Callable TransitionElementsKind(Isolate* isolate, ElementsKind from,
-                                         ElementsKind to, bool is_jsarray);
+  static Callable ArrayNoArgumentConstructor(
+      Isolate* isolate, ElementsKind kind,
+      AllocationSiteOverrideMode override_mode);
+  static Callable ArraySingleArgumentConstructor(
+      Isolate* isolate, ElementsKind kind,
+      AllocationSiteOverrideMode override_mode);
+
+  static Callable InternalArrayNoArgumentConstructor(Isolate* isolate,
+                                                     ElementsKind kind);
+  static Callable InternalArraySingleArgumentConstructor(Isolate* isolate,
+                                                         ElementsKind kind);
 };
 
 }  // namespace internal
diff --git a/deps/v8/src/code-reference.cc b/deps/v8/src/code-reference.cc
new file mode 100644
index 00000000000000..3716ad04d9fee6
--- /dev/null
+++ b/deps/v8/src/code-reference.cc
@@ -0,0 +1,53 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "src/code-reference.h"
+
+#include "src/handles-inl.h"
+#include "src/objects-inl.h"
+#include "src/wasm/wasm-code-manager.h"
+
+namespace v8 {
+namespace internal {
+
+Address CodeReference::constant_pool() const {
+  return kind_ == JS ? js_code_->constant_pool() : wasm_code_->constant_pool();
+}
+
+Address CodeReference::instruction_start() const {
+  return kind_ == JS
+             ? js_code_->InstructionStart()
+             : reinterpret_cast<Address>(wasm_code_->instructions().start());
+}
+
+Address CodeReference::instruction_end() const {
+  return kind_ == JS
+             ? js_code_->InstructionEnd()
+             : reinterpret_cast<Address>(wasm_code_->instructions().start() +
+                                         wasm_code_->instructions().size());
+}
+
+int CodeReference::instruction_size() const {
+  return kind_ == JS ? js_code_->InstructionSize()
+                     : wasm_code_->instructions().length();
+}
+
+const byte* CodeReference::relocation_start() const {
+  return kind_ == JS ? js_code_->relocation_start()
+                     : wasm_code_->reloc_info().start();
+}
+
+const byte* CodeReference::relocation_end() const {
+  return kind_ == JS ? js_code_->relocation_end()
+                     : wasm_code_->reloc_info().start() +
+                           wasm_code_->reloc_info().length();
+}
+
+int CodeReference::relocation_size() const {
+  return kind_ == JS ? js_code_->relocation_size()
+                     : wasm_code_->reloc_info().length();
+}
+
+}  // namespace internal
+}  // namespace v8
diff --git a/deps/v8/src/code-reference.h b/deps/v8/src/code-reference.h
new file mode 100644
index 00000000000000..cb4b25a62186e1
--- /dev/null
+++ b/deps/v8/src/code-reference.h
@@ -0,0 +1,62 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef V8_CODE_REFERENCE_H_
+#define V8_CODE_REFERENCE_H_
+
+#include "src/handles.h"
+#include "src/objects/code.h"
+
+namespace v8 {
+namespace internal {
+
+class Code;
+
+namespace wasm {
+class WasmCode;
+}
+
+class CodeReference {
+ public:
+  CodeReference() : kind_(JS), js_code_() {}
+  explicit CodeReference(const wasm::WasmCode* wasm_code)
+      : kind_(WASM), wasm_code_(wasm_code) {}
+  explicit CodeReference(Handle<Code> js_code) : kind_(JS), js_code_(js_code) {}
+
+  Address constant_pool() const;
+  Address instruction_start() const;
+  Address instruction_end() const;
+  int instruction_size() const;
+  const byte* relocation_start() const;
+  const byte* relocation_end() const;
+  int relocation_size() const;
+  bool is_null() const {
+    return kind_ == JS ? js_code_.is_null() : wasm_code_ == nullptr;
+  }
+
+  Handle<Code> as_js_code() const {
+    DCHECK_EQ(JS, kind_);
+    return js_code_;
+  }
+
+  const wasm::WasmCode* as_wasm_code() const {
+    DCHECK_EQ(WASM, kind_);
+    return wasm_code_;
+  }
+
+ private:
+  enum { JS, WASM } kind_;
+  union {
+    const wasm::WasmCode* wasm_code_;
+    Handle<Code> js_code_;
+  };
+
+  DISALLOW_NEW_AND_DELETE();
+};
+ASSERT_TRIVIALLY_COPYABLE(CodeReference);
+
+}  // namespace internal
+}  // namespace v8
+
+#endif  // V8_CODE_REFERENCE_H_
diff --git a/deps/v8/src/code-stub-assembler.cc b/deps/v8/src/code-stub-assembler.cc
index b85609d9560ef7..c0da2333958fb0 100644
--- a/deps/v8/src/code-stub-assembler.cc
+++ b/deps/v8/src/code-stub-assembler.cc
@@ -7,6 +7,9 @@
 #include "src/code-factory.h"
 #include "src/frames-inl.h"
 #include "src/frames.h"
+#include "src/objects/api-callbacks.h"
+#include "src/objects/descriptor-array.h"
+#include "src/objects/ordered-hash-table-inl.h"
 
 namespace v8 {
 namespace internal {
@@ -14,6 +17,8 @@ namespace internal {
 using compiler::Node;
 template <class T>
 using TNode = compiler::TNode<T>;
+template <class T>
+using SloppyTNode = compiler::SloppyTNode<T>;
 
 CodeStubAssembler::CodeStubAssembler(compiler::CodeAssemblerState* state)
     : compiler::CodeAssembler(state) {
@@ -201,7 +206,7 @@ TNode<Smi> CodeStubAssembler::SelectSmiConstant(SloppyTNode<BoolT> condition,
                              SmiConstant(false_value));
 }
 
-Node* CodeStubAssembler::NoContextConstant() {
+TNode<Object> CodeStubAssembler::NoContextConstant() {
   return SmiConstant(Context::kNoContext);
 }
 
@@ -213,7 +218,18 @@ Node* CodeStubAssembler::NoContextConstant() {
         *std::declval<Heap>().rootAccessorName())>::type>(            \
         LoadRoot(Heap::k##rootIndexName##RootIndex));                 \
   }
-HEAP_CONSTANT_LIST(HEAP_CONSTANT_ACCESSOR);
+HEAP_MUTABLE_IMMOVABLE_OBJECT_LIST(HEAP_CONSTANT_ACCESSOR);
+#undef HEAP_CONSTANT_ACCESSOR
+
+#define HEAP_CONSTANT_ACCESSOR(rootIndexName, rootAccessorName, name) \
+  compiler::TNode<std::remove_reference<decltype(                     \
+      *std::declval<ReadOnlyRoots>().rootAccessorName())>::type>      \
+      CodeStubAssembler::name##Constant() {                           \
+    return UncheckedCast<std::remove_reference<decltype(              \
+        *std::declval<ReadOnlyRoots>().rootAccessorName())>::type>(   \
+        LoadRoot(Heap::k##rootIndexName##RootIndex));                 \
+  }
+HEAP_IMMUTABLE_IMMOVABLE_OBJECT_LIST(HEAP_CONSTANT_ACCESSOR);
 #undef HEAP_CONSTANT_ACCESSOR
 
 #define HEAP_CONSTANT_TEST(rootIndexName, rootAccessorName, name) \
@@ -225,17 +241,13 @@ HEAP_CONSTANT_LIST(HEAP_CONSTANT_ACCESSOR);
       SloppyTNode<Object> value) {                                \
     return WordNotEqual(value, name##Constant());                 \
   }
-HEAP_CONSTANT_LIST(HEAP_CONSTANT_TEST);
+HEAP_IMMOVABLE_OBJECT_LIST(HEAP_CONSTANT_TEST);
 #undef HEAP_CONSTANT_TEST
 
-Node* CodeStubAssembler::HashSeed() {
+TNode<Int32T> CodeStubAssembler::HashSeed() {
   return LoadAndUntagToWord32Root(Heap::kHashSeedRootIndex);
 }
 
-Node* CodeStubAssembler::StaleRegisterConstant() {
-  return LoadRoot(Heap::kStaleRegisterRootIndex);
-}
-
 Node* CodeStubAssembler::IntPtrOrSmiConstant(int value, ParameterMode mode) {
   if (mode == SMI_PARAMETERS) {
     return SmiConstant(value);
@@ -282,14 +294,15 @@ bool CodeStubAssembler::TryGetIntPtrOrSmiConstantValue(Node* maybe_constant,
   return false;
 }
 
-Node* CodeStubAssembler::IntPtrRoundUpToPowerOfTwo32(Node* value) {
+TNode<IntPtrT> CodeStubAssembler::IntPtrRoundUpToPowerOfTwo32(
+    TNode<IntPtrT> value) {
   Comment("IntPtrRoundUpToPowerOfTwo32");
   CSA_ASSERT(this, UintPtrLessThanOrEqual(value, IntPtrConstant(0x80000000u)));
-  value = IntPtrSub(value, IntPtrConstant(1));
+  value = Signed(IntPtrSub(value, IntPtrConstant(1)));
   for (int i = 1; i <= 16; i *= 2) {
-    value = WordOr(value, WordShr(value, IntPtrConstant(i)));
+    value = Signed(WordOr(value, WordShr(value, IntPtrConstant(i))));
   }
-  return IntPtrAdd(value, IntPtrConstant(1));
+  return Signed(IntPtrAdd(value, IntPtrConstant(1)));
 }
 
 Node* CodeStubAssembler::MatchesParameterMode(Node* value, ParameterMode mode) {
@@ -524,14 +537,27 @@ TNode<Float64T> CodeStubAssembler::Float64Trunc(SloppyTNode<Float64T> x) {
   return TNode<Float64T>::UncheckedCast(var_x.value());
 }
 
+TNode<BoolT> CodeStubAssembler::IsValidSmi(TNode<Smi> smi) {
+  if (SmiValuesAre31Bits() && kPointerSize == kInt64Size) {
+    // Check that the Smi value is properly sign-extended.
+    TNode<IntPtrT> value = Signed(BitcastTaggedToWord(smi));
+    return WordEqual(value, ChangeInt32ToIntPtr(TruncateIntPtrToInt32(value)));
+  }
+  return Int32TrueConstant();
+}
+
 Node* CodeStubAssembler::SmiShiftBitsConstant() {
   return IntPtrConstant(kSmiShiftSize + kSmiTagSize);
 }
 
 TNode<Smi> CodeStubAssembler::SmiFromInt32(SloppyTNode<Int32T> value) {
   TNode<IntPtrT> value_intptr = ChangeInt32ToIntPtr(value);
-  return BitcastWordToTaggedSigned(
-      WordShl(value_intptr, SmiShiftBitsConstant()));
+  TNode<Smi> smi =
+      BitcastWordToTaggedSigned(WordShl(value_intptr, SmiShiftBitsConstant()));
+#if V8_COMPRESS_POINTERS
+  CSA_ASSERT(this, IsValidSmi(smi));
+#endif
+  return smi;
 }
 
 TNode<BoolT> CodeStubAssembler::IsValidPositiveSmi(TNode<IntPtrT> value) {
@@ -551,16 +577,23 @@ TNode<Smi> CodeStubAssembler::SmiTag(SloppyTNode<IntPtrT> value) {
   if (ToInt32Constant(value, constant_value) && Smi::IsValid(constant_value)) {
     return SmiConstant(constant_value);
   }
-  return BitcastWordToTaggedSigned(WordShl(value, SmiShiftBitsConstant()));
+  TNode<Smi> smi =
+      BitcastWordToTaggedSigned(WordShl(value, SmiShiftBitsConstant()));
+#if V8_COMPRESS_POINTERS
+  CSA_ASSERT(this, IsValidSmi(smi));
+#endif
+  return smi;
 }
 
 TNode<IntPtrT> CodeStubAssembler::SmiUntag(SloppyTNode<Smi> value) {
+#if V8_COMPRESS_POINTERS
+  CSA_ASSERT(this, IsValidSmi(value));
+#endif
   intptr_t constant_value;
   if (ToIntPtrConstant(value, constant_value)) {
     return IntPtrConstant(constant_value >> (kSmiShiftSize + kSmiTagSize));
   }
-  return UncheckedCast<IntPtrT>(
-      WordSar(BitcastTaggedToWord(value), SmiShiftBitsConstant()));
+  return Signed(WordSar(BitcastTaggedToWord(value), SmiShiftBitsConstant()));
 }
 
 TNode<Int32T> CodeStubAssembler::SmiToInt32(SloppyTNode<Smi> value) {
@@ -572,14 +605,56 @@ TNode<Float64T> CodeStubAssembler::SmiToFloat64(SloppyTNode<Smi> value) {
   return ChangeInt32ToFloat64(SmiToInt32(value));
 }
 
-TNode<Smi> CodeStubAssembler::SmiMax(SloppyTNode<Smi> a, SloppyTNode<Smi> b) {
+TNode<Smi> CodeStubAssembler::SmiMax(TNode<Smi> a, TNode<Smi> b) {
   return SelectConstant<Smi>(SmiLessThan(a, b), b, a);
 }
 
-TNode<Smi> CodeStubAssembler::SmiMin(SloppyTNode<Smi> a, SloppyTNode<Smi> b) {
+TNode<Smi> CodeStubAssembler::SmiMin(TNode<Smi> a, TNode<Smi> b) {
   return SelectConstant<Smi>(SmiLessThan(a, b), a, b);
 }
 
+TNode<Smi> CodeStubAssembler::TrySmiAdd(TNode<Smi> lhs, TNode<Smi> rhs,
+                                        Label* if_overflow) {
+  if (SmiValuesAre32Bits()) {
+    TNode<PairT<IntPtrT, BoolT>> pair = IntPtrAddWithOverflow(
+        BitcastTaggedToWord(lhs), BitcastTaggedToWord(rhs));
+    TNode<BoolT> overflow = Projection<1>(pair);
+    GotoIf(overflow, if_overflow);
+    TNode<IntPtrT> result = Projection<0>(pair);
+    return BitcastWordToTaggedSigned(result);
+  } else {
+    DCHECK(SmiValuesAre31Bits());
+    TNode<PairT<Int32T, BoolT>> pair =
+        Int32AddWithOverflow(TruncateIntPtrToInt32(BitcastTaggedToWord(lhs)),
+                             TruncateIntPtrToInt32(BitcastTaggedToWord(rhs)));
+    TNode<BoolT> overflow = Projection<1>(pair);
+    GotoIf(overflow, if_overflow);
+    TNode<Int32T> result = Projection<0>(pair);
+    return BitcastWordToTaggedSigned(ChangeInt32ToIntPtr(result));
+  }
+}
+
+TNode<Smi> CodeStubAssembler::TrySmiSub(TNode<Smi> lhs, TNode<Smi> rhs,
+                                        Label* if_overflow) {
+  if (SmiValuesAre32Bits()) {
+    TNode<PairT<IntPtrT, BoolT>> pair = IntPtrSubWithOverflow(
+        BitcastTaggedToWord(lhs), BitcastTaggedToWord(rhs));
+    TNode<BoolT> overflow = Projection<1>(pair);
+    GotoIf(overflow, if_overflow);
+    TNode<IntPtrT> result = Projection<0>(pair);
+    return BitcastWordToTaggedSigned(result);
+  } else {
+    DCHECK(SmiValuesAre31Bits());
+    TNode<PairT<Int32T, BoolT>> pair =
+        Int32SubWithOverflow(TruncateIntPtrToInt32(BitcastTaggedToWord(lhs)),
+                             TruncateIntPtrToInt32(BitcastTaggedToWord(rhs)));
+    TNode<BoolT> overflow = Projection<1>(pair);
+    GotoIf(overflow, if_overflow);
+    TNode<Int32T> result = Projection<0>(pair);
+    return BitcastWordToTaggedSigned(ChangeInt32ToIntPtr(result));
+  }
+}
+
 TNode<Object> CodeStubAssembler::NumberMax(SloppyTNode<Object> a,
                                            SloppyTNode<Object> b) {
   // TODO(danno): This could be optimized by specifically handling smi cases.
@@ -656,8 +731,7 @@ TNode<IntPtrT> CodeStubAssembler::ConvertToRelativeIndex(
   return result.value();
 }
 
-TNode<Number> CodeStubAssembler::SmiMod(SloppyTNode<Smi> a,
-                                        SloppyTNode<Smi> b) {
+TNode<Number> CodeStubAssembler::SmiMod(TNode<Smi> a, TNode<Smi> b) {
   TVARIABLE(Number, var_result);
   Label return_result(this, &var_result),
       return_minuszero(this, Label::kDeferred),
@@ -720,8 +794,7 @@ TNode<Number> CodeStubAssembler::SmiMod(SloppyTNode<Smi> a,
   return var_result.value();
 }
 
-TNode<Number> CodeStubAssembler::SmiMul(SloppyTNode<Smi> a,
-                                        SloppyTNode<Smi> b) {
+TNode<Number> CodeStubAssembler::SmiMul(TNode<Smi> a, TNode<Smi> b) {
   TVARIABLE(Number, var_result);
   VARIABLE(var_lhs_float64, MachineRepresentation::kFloat64);
   VARIABLE(var_rhs_float64, MachineRepresentation::kFloat64);
@@ -781,8 +854,8 @@ TNode<Number> CodeStubAssembler::SmiMul(SloppyTNode<Smi> a,
   return var_result.value();
 }
 
-Node* CodeStubAssembler::TrySmiDiv(Node* dividend, Node* divisor,
-                                   Label* bailout) {
+TNode<Smi> CodeStubAssembler::TrySmiDiv(TNode<Smi> dividend, TNode<Smi> divisor,
+                                        Label* bailout) {
   // Both {a} and {b} are Smis. Bailout to floating point division if {divisor}
   // is zero.
   GotoIf(WordEqual(divisor, SmiConstant(0)), bailout);
@@ -800,8 +873,8 @@ Node* CodeStubAssembler::TrySmiDiv(Node* dividend, Node* divisor,
   }
   BIND(&dividend_is_not_zero);
 
-  Node* untagged_divisor = SmiToInt32(divisor);
-  Node* untagged_dividend = SmiToInt32(dividend);
+  TNode<Int32T> untagged_divisor = SmiToInt32(divisor);
+  TNode<Int32T> untagged_dividend = SmiToInt32(dividend);
 
   // Do floating point division if {dividend} is kMinInt (or kMinInt - 1
   // if the Smi size is 31) and {divisor} is -1.
@@ -819,8 +892,8 @@ Node* CodeStubAssembler::TrySmiDiv(Node* dividend, Node* divisor,
   }
   BIND(&divisor_is_not_minus_one);
 
-  Node* untagged_result = Int32Div(untagged_dividend, untagged_divisor);
-  Node* truncated = Int32Mul(untagged_result, untagged_divisor);
+  TNode<Int32T> untagged_result = Int32Div(untagged_dividend, untagged_divisor);
+  TNode<Int32T> truncated = Signed(Int32Mul(untagged_result, untagged_divisor));
 
   // Do floating point division if the remainder is not 0.
   GotoIf(Word32NotEqual(untagged_dividend, truncated), bailout);
@@ -841,6 +914,12 @@ TNode<BoolT> CodeStubAssembler::TaggedIsSmi(SloppyTNode<Object> a) {
                    IntPtrConstant(0));
 }
 
+TNode<BoolT> CodeStubAssembler::TaggedIsSmi(TNode<MaybeObject> a) {
+  return WordEqual(
+      WordAnd(BitcastMaybeObjectToWord(a), IntPtrConstant(kSmiTagMask)),
+      IntPtrConstant(0));
+}
+
 TNode<BoolT> CodeStubAssembler::TaggedIsNotSmi(SloppyTNode<Object> a) {
   return WordNotEqual(
       WordAnd(BitcastTaggedToWord(a), IntPtrConstant(kSmiTagMask)),
@@ -866,6 +945,12 @@ void CodeStubAssembler::Bind(Label* label, AssemblerDebugInfo debug_info) {
 void CodeStubAssembler::Bind(Label* label) { CodeAssembler::Bind(label); }
 #endif  // DEBUG
 
+TNode<Float64T> CodeStubAssembler::LoadDoubleWithHoleCheck(
+    TNode<FixedDoubleArray> array, TNode<Smi> index, Label* if_hole) {
+  return LoadFixedDoubleArrayElement(array, index, MachineType::Float64(), 0,
+                                     SMI_PARAMETERS, if_hole);
+}
+
 void CodeStubAssembler::BranchIfPrototypesHaveNoElements(
     Node* receiver_map, Label* definitely_no_elements,
     Label* possibly_elements) {
@@ -883,15 +968,14 @@ void CodeStubAssembler::BranchIfPrototypesHaveNoElements(
     Node* prototype = LoadMapPrototype(map);
     GotoIf(IsNull(prototype), definitely_no_elements);
     Node* prototype_map = LoadMap(prototype);
-    Node* prototype_instance_type = LoadMapInstanceType(prototype_map);
+    TNode<Int32T> prototype_instance_type = LoadMapInstanceType(prototype_map);
 
     // Pessimistically assume elements if a Proxy, Special API Object,
     // or JSValue wrapper is found on the prototype chain. After this
     // instance type check, it's not necessary to check for interceptors or
     // access checks.
     Label if_custom(this, Label::kDeferred), if_notcustom(this);
-    Branch(Int32LessThanOrEqual(prototype_instance_type,
-                                Int32Constant(LAST_CUSTOM_ELEMENTS_RECEIVER)),
+    Branch(IsCustomElementsReceiverInstanceType(prototype_instance_type),
            &if_custom, &if_notcustom);
 
     BIND(&if_custom);
@@ -922,13 +1006,6 @@ void CodeStubAssembler::BranchIfJSReceiver(Node* object, Label* if_true,
   Branch(IsJSReceiver(object), if_true, if_false);
 }
 
-void CodeStubAssembler::BranchIfJSObject(Node* object, Label* if_true,
-                                         Label* if_false) {
-  GotoIf(TaggedIsSmi(object), if_false);
-  STATIC_ASSERT(LAST_JS_OBJECT_TYPE == LAST_TYPE);
-  Branch(IsJSObject(object), if_true, if_false);
-}
-
 TNode<BoolT> CodeStubAssembler::IsFastJSArray(SloppyTNode<Object> object,
                                               SloppyTNode<Context> context) {
   Label if_true(this), if_false(this, Label::kDeferred), exit(this);
@@ -989,7 +1066,7 @@ void CodeStubAssembler::BranchIfFastJSArray(Node* object, Node* context,
   Node* elements_kind = LoadMapElementsKind(map);
   GotoIfNot(IsFastElementsKind(elements_kind), if_false);
 
-  // Check prototype chain if receiver does not have packed elements
+  // Verify that our prototype is the initial array prototype.
   GotoIfNot(IsPrototypeInitialArrayPrototype(context, map), if_false);
 
   Branch(IsNoElementsProtectorCellInvalid(), if_false, if_true);
@@ -1220,7 +1297,7 @@ void CodeStubAssembler::BranchIfToBooleanIsTrue(Node* value, Label* if_true,
   BIND(&if_smi);
   {
     // The {value} is a Smi, only need to check against zero.
-    BranchIfSmiEqual(value, SmiConstant(0), if_false, if_true);
+    BranchIfSmiEqual(CAST(value), SmiConstant(0), if_false, if_true);
   }
 
   BIND(&if_notsmi);
@@ -1271,6 +1348,12 @@ Node* CodeStubAssembler::LoadFromParentFrame(int offset, MachineType rep) {
   return Load(rep, frame_pointer, IntPtrConstant(offset));
 }
 
+TNode<JSFunction> CodeStubAssembler::LoadTargetFromFrame() {
+  DCHECK(IsJSFunctionCall());
+  return CAST(LoadFromFrame(StandardFrameConstants::kFunctionOffset,
+                            MachineType::TaggedPointer()));
+}
+
 Node* CodeStubAssembler::LoadBufferObject(Node* buffer, int offset,
                                           MachineType rep) {
   return Load(rep, buffer, IntPtrConstant(offset));
@@ -1278,20 +1361,20 @@ Node* CodeStubAssembler::LoadBufferObject(Node* buffer, int offset,
 
 Node* CodeStubAssembler::LoadObjectField(SloppyTNode<HeapObject> object,
                                          int offset, MachineType rep) {
-  AssertIsStrongHeapObject(object);
+  CSA_ASSERT(this, IsStrongHeapObject(object));
   return Load(rep, object, IntPtrConstant(offset - kHeapObjectTag));
 }
 
 Node* CodeStubAssembler::LoadObjectField(SloppyTNode<HeapObject> object,
                                          SloppyTNode<IntPtrT> offset,
                                          MachineType rep) {
-  AssertIsStrongHeapObject(object);
+  CSA_ASSERT(this, IsStrongHeapObject(object));
   return Load(rep, object, IntPtrSub(offset, IntPtrConstant(kHeapObjectTag)));
 }
 
 TNode<IntPtrT> CodeStubAssembler::LoadAndUntagObjectField(
     SloppyTNode<HeapObject> object, int offset) {
-  if (Is64()) {
+  if (SmiValuesAre32Bits()) {
 #if V8_TARGET_LITTLE_ENDIAN
     offset += kPointerSize / 2;
 #endif
@@ -1305,7 +1388,7 @@ TNode<IntPtrT> CodeStubAssembler::LoadAndUntagObjectField(
 
 TNode<Int32T> CodeStubAssembler::LoadAndUntagToWord32ObjectField(Node* object,
                                                                  int offset) {
-  if (Is64()) {
+  if (SmiValuesAre32Bits()) {
 #if V8_TARGET_LITTLE_ENDIAN
     offset += kPointerSize / 2;
 #endif
@@ -1318,7 +1401,7 @@ TNode<Int32T> CodeStubAssembler::LoadAndUntagToWord32ObjectField(Node* object,
 }
 
 TNode<IntPtrT> CodeStubAssembler::LoadAndUntagSmi(Node* base, int index) {
-  if (Is64()) {
+  if (SmiValuesAre32Bits()) {
 #if V8_TARGET_LITTLE_ENDIAN
     index += kPointerSize / 2;
 #endif
@@ -1330,16 +1413,17 @@ TNode<IntPtrT> CodeStubAssembler::LoadAndUntagSmi(Node* base, int index) {
   }
 }
 
-Node* CodeStubAssembler::LoadAndUntagToWord32Root(
+TNode<Int32T> CodeStubAssembler::LoadAndUntagToWord32Root(
     Heap::RootListIndex root_index) {
   Node* roots_array_start =
       ExternalConstant(ExternalReference::roots_array_start(isolate()));
   int index = root_index * kPointerSize;
-  if (Is64()) {
+  if (SmiValuesAre32Bits()) {
 #if V8_TARGET_LITTLE_ENDIAN
     index += kPointerSize / 2;
 #endif
-    return Load(MachineType::Int32(), roots_array_start, IntPtrConstant(index));
+    return UncheckedCast<Int32T>(
+        Load(MachineType::Int32(), roots_array_start, IntPtrConstant(index)));
   } else {
     return SmiToInt32(Load(MachineType::AnyTagged(), roots_array_start,
                            IntPtrConstant(index)));
@@ -1347,7 +1431,7 @@ Node* CodeStubAssembler::LoadAndUntagToWord32Root(
 }
 
 Node* CodeStubAssembler::StoreAndTagSmi(Node* base, int offset, Node* value) {
-  if (Is64()) {
+  if (SmiValuesAre32Bits()) {
     int zero_offset = offset + kPointerSize / 2;
     int payload_offset = offset;
 #if V8_TARGET_LITTLE_ENDIAN
@@ -1384,27 +1468,6 @@ TNode<BoolT> CodeStubAssembler::HasInstanceType(SloppyTNode<HeapObject> object,
   return InstanceTypeEqual(LoadInstanceType(object), instance_type);
 }
 
-TNode<BoolT>
-CodeStubAssembler::InitialArrayPrototypeHasInitialArrayPrototypeMap(
-    TNode<Context> native_context) {
-  CSA_ASSERT(this, IsNativeContext(native_context));
-  TNode<Map> proto_map = LoadMap(CAST(LoadContextElement(
-      native_context, Context::INITIAL_ARRAY_PROTOTYPE_INDEX)));
-  TNode<Map> initial_map = CAST(LoadContextElement(
-      native_context, Context::INITIAL_ARRAY_PROTOTYPE_MAP_INDEX));
-  return WordEqual(proto_map, initial_map);
-}
-
-TNode<BoolT> CodeStubAssembler::HasInitialFastElementsKindMap(
-    TNode<Context> native_context, TNode<JSArray> jsarray) {
-  CSA_ASSERT(this, IsNativeContext(native_context));
-  TNode<Map> map = LoadMap(jsarray);
-  TNode<Int32T> elements_kind = LoadMapElementsKind(map);
-  TNode<Map> initial_jsarray_element_map =
-      LoadJSArrayElementsMap(elements_kind, native_context);
-  return WordEqual(initial_jsarray_element_map, map);
-}
-
 TNode<BoolT> CodeStubAssembler::DoesntHaveInstanceType(
     SloppyTNode<HeapObject> object, InstanceType instance_type) {
   return Word32NotEqual(LoadInstanceType(object), Int32Constant(instance_type));
@@ -1452,7 +1515,7 @@ TNode<Number> CodeStubAssembler::LoadJSArrayLength(SloppyTNode<JSArray> array) {
 TNode<Smi> CodeStubAssembler::LoadFastJSArrayLength(
     SloppyTNode<JSArray> array) {
   TNode<Object> length = LoadJSArrayLength(array);
-  CSA_ASSERT(this, IsFastElementsKind(LoadMapElementsKind(LoadMap(array))));
+  CSA_ASSERT(this, IsFastElementsKind(LoadElementsKind(array)));
   // JSArray length is always a positive Smi for fast arrays.
   CSA_SLOW_ASSERT(this, TaggedIsPositiveSmi(length));
   return UncheckedCast<Smi>(length);
@@ -1460,6 +1523,7 @@ TNode<Smi> CodeStubAssembler::LoadFastJSArrayLength(
 
 TNode<Smi> CodeStubAssembler::LoadFixedArrayBaseLength(
     SloppyTNode<FixedArrayBase> array) {
+  CSA_SLOW_ASSERT(this, IsNotWeakFixedArraySubclass(array));
   return CAST(LoadObjectField(array, FixedArrayBase::kLengthOffset));
 }
 
@@ -1468,6 +1532,27 @@ TNode<IntPtrT> CodeStubAssembler::LoadAndUntagFixedArrayBaseLength(
   return LoadAndUntagObjectField(array, FixedArrayBase::kLengthOffset);
 }
 
+TNode<IntPtrT> CodeStubAssembler::LoadFeedbackVectorLength(
+    TNode<FeedbackVector> vector) {
+  return ChangeInt32ToIntPtr(
+      LoadObjectField<Int32T>(vector, FeedbackVector::kLengthOffset));
+}
+
+TNode<Smi> CodeStubAssembler::LoadWeakFixedArrayLength(
+    TNode<WeakFixedArray> array) {
+  return CAST(LoadObjectField(array, WeakFixedArray::kLengthOffset));
+}
+
+TNode<IntPtrT> CodeStubAssembler::LoadAndUntagWeakFixedArrayLength(
+    SloppyTNode<WeakFixedArray> array) {
+  return LoadAndUntagObjectField(array, WeakFixedArray::kLengthOffset);
+}
+
+TNode<Smi> CodeStubAssembler::LoadTypedArrayLength(
+    TNode<JSTypedArray> typed_array) {
+  return CAST(LoadObjectField(typed_array, JSTypedArray::kLengthOffset));
+}
+
 TNode<Int32T> CodeStubAssembler::LoadMapBitField(SloppyTNode<Map> map) {
   CSA_SLOW_ASSERT(this, IsMap(map));
   return UncheckedCast<Int32T>(
@@ -1497,30 +1582,35 @@ TNode<Int32T> CodeStubAssembler::LoadMapElementsKind(SloppyTNode<Map> map) {
   return Signed(DecodeWord32<Map::ElementsKindBits>(bit_field2));
 }
 
+TNode<Int32T> CodeStubAssembler::LoadElementsKind(
+    SloppyTNode<HeapObject> object) {
+  return LoadMapElementsKind(LoadMap(object));
+}
+
 TNode<DescriptorArray> CodeStubAssembler::LoadMapDescriptors(
     SloppyTNode<Map> map) {
   CSA_SLOW_ASSERT(this, IsMap(map));
   return CAST(LoadObjectField(map, Map::kDescriptorsOffset));
 }
 
-TNode<Object> CodeStubAssembler::LoadMapPrototype(SloppyTNode<Map> map) {
+TNode<HeapObject> CodeStubAssembler::LoadMapPrototype(SloppyTNode<Map> map) {
   CSA_SLOW_ASSERT(this, IsMap(map));
-  return LoadObjectField(map, Map::kPrototypeOffset);
+  return CAST(LoadObjectField(map, Map::kPrototypeOffset));
 }
 
 TNode<PrototypeInfo> CodeStubAssembler::LoadMapPrototypeInfo(
     SloppyTNode<Map> map, Label* if_no_proto_info) {
   Label if_strong_heap_object(this);
   CSA_ASSERT(this, IsMap(map));
-  Node* maybe_prototype_info =
-      LoadObjectField(map, Map::kTransitionsOrPrototypeInfoOffset);
-  VARIABLE(prototype_info, MachineRepresentation::kTagged);
+  TNode<MaybeObject> maybe_prototype_info =
+      LoadMaybeWeakObjectField(map, Map::kTransitionsOrPrototypeInfoOffset);
+  TVARIABLE(Object, prototype_info);
   DispatchMaybeObject(maybe_prototype_info, if_no_proto_info, if_no_proto_info,
                       if_no_proto_info, &if_strong_heap_object,
                       &prototype_info);
 
   BIND(&if_strong_heap_object);
-  GotoIfNot(WordEqual(LoadMap(prototype_info.value()),
+  GotoIfNot(WordEqual(LoadMap(CAST(prototype_info.value())),
                       LoadRoot(Heap::kPrototypeInfoMapRootIndex)),
             if_no_proto_info);
   return CAST(prototype_info.value());
@@ -1581,8 +1671,8 @@ Node* CodeStubAssembler::LoadMapEnumLength(SloppyTNode<Map> map) {
 }
 
 TNode<Object> CodeStubAssembler::LoadMapBackPointer(SloppyTNode<Map> map) {
-  TNode<Object> object =
-      LoadObjectField(map, Map::kConstructorOrBackPointerOffset);
+  TNode<HeapObject> object =
+      CAST(LoadObjectField(map, Map::kConstructorOrBackPointerOffset));
   return Select<Object>(IsMap(object), [=] { return object; },
                         [=] { return UndefinedConstant(); });
 }
@@ -1604,7 +1694,7 @@ TNode<IntPtrT> CodeStubAssembler::LoadJSReceiverIdentityHash(
 
   GotoIf(InstanceTypeEqual(properties_instance_type, PROPERTY_ARRAY_TYPE),
          &if_property_array);
-  Branch(InstanceTypeEqual(properties_instance_type, HASH_TABLE_TYPE),
+  Branch(InstanceTypeEqual(properties_instance_type, NAME_DICTIONARY_TYPE),
          &if_property_dictionary, &if_fixed_array);
 
   BIND(&if_fixed_array);
@@ -1686,7 +1776,9 @@ Node* CodeStubAssembler::LoadJSValueValue(Node* object) {
   return LoadObjectField(object, JSValue::kValueOffset);
 }
 
-TNode<Object> CodeStubAssembler::LoadWeakCellValueUnchecked(Node* weak_cell) {
+TNode<Object> CodeStubAssembler::LoadWeakCellValueUnchecked(
+    SloppyTNode<HeapObject> weak_cell) {
+  CSA_ASSERT(this, IsStrongHeapObject(weak_cell));
   // TODO(ishell): fix callers.
   return LoadObjectField(weak_cell, WeakCell::kValueOffset);
 }
@@ -1701,49 +1793,170 @@ TNode<Object> CodeStubAssembler::LoadWeakCellValue(
   return value;
 }
 
-void CodeStubAssembler::DispatchMaybeObject(Node* maybe_object, Label* if_smi,
-                                            Label* if_cleared, Label* if_weak,
-                                            Label* if_strong,
-                                            Variable* extracted) {
+void CodeStubAssembler::DispatchMaybeObject(TNode<MaybeObject> maybe_object,
+                                            Label* if_smi, Label* if_cleared,
+                                            Label* if_weak, Label* if_strong,
+                                            TVariable<Object>* extracted) {
   Label inner_if_smi(this), inner_if_strong(this);
 
   GotoIf(TaggedIsSmi(maybe_object), &inner_if_smi);
 
-  GotoIf(WordEqual(maybe_object, IntPtrConstant(reinterpret_cast<intptr_t>(
-                                     HeapObjectReference::ClearedValue()))),
+  GotoIf(WordEqual(BitcastMaybeObjectToWord(maybe_object),
+                   IntPtrConstant(reinterpret_cast<intptr_t>(
+                       HeapObjectReference::ClearedValue()))),
          if_cleared);
 
-  GotoIf(WordEqual(WordAnd(BitcastTaggedToWord(maybe_object),
-                           IntPtrConstant(kWeakHeapObjectMask)),
-                   IntPtrConstant(0)),
+  GotoIf(WordEqual(WordAnd(BitcastMaybeObjectToWord(maybe_object),
+                           IntPtrConstant(kHeapObjectTagMask)),
+                   IntPtrConstant(kHeapObjectTag)),
          &inner_if_strong);
 
-  extracted->Bind(
-      BitcastWordToTagged(WordAnd(BitcastTaggedToWord(maybe_object),
-                                  IntPtrConstant(~kWeakHeapObjectMask))));
+  *extracted =
+      BitcastWordToTagged(WordAnd(BitcastMaybeObjectToWord(maybe_object),
+                                  IntPtrConstant(~kWeakHeapObjectMask)));
   Goto(if_weak);
 
   BIND(&inner_if_smi);
-  extracted->Bind(maybe_object);
+  *extracted = CAST(maybe_object);
   Goto(if_smi);
 
   BIND(&inner_if_strong);
-  extracted->Bind(maybe_object);
+  *extracted = CAST(maybe_object);
   Goto(if_strong);
 }
 
-TNode<Object> CodeStubAssembler::LoadFixedArrayElement(
-    SloppyTNode<Object> object, Node* index_node, int additional_offset,
-    ParameterMode parameter_mode, LoadSensitivity needs_poisoning) {
-  CSA_SLOW_ASSERT(this, IntPtrGreaterThanOrEqual(
-                            ParameterToIntPtr(index_node, parameter_mode),
-                            IntPtrConstant(0)));
-  int32_t header_size =
-      FixedArray::kHeaderSize + additional_offset - kHeapObjectTag;
+TNode<BoolT> CodeStubAssembler::IsStrongHeapObject(TNode<MaybeObject> value) {
+  return WordEqual(WordAnd(BitcastMaybeObjectToWord(value),
+                           IntPtrConstant(kHeapObjectTagMask)),
+                   IntPtrConstant(kHeapObjectTag));
+}
+
+TNode<HeapObject> CodeStubAssembler::ToStrongHeapObject(
+    TNode<MaybeObject> value, Label* if_not_strong) {
+  GotoIfNot(IsStrongHeapObject(value), if_not_strong);
+  return CAST(value);
+}
+
+TNode<BoolT> CodeStubAssembler::IsWeakOrClearedHeapObject(
+    TNode<MaybeObject> value) {
+  return WordEqual(WordAnd(BitcastMaybeObjectToWord(value),
+                           IntPtrConstant(kHeapObjectTagMask)),
+                   IntPtrConstant(kWeakHeapObjectTag));
+}
+
+TNode<BoolT> CodeStubAssembler::IsClearedWeakHeapObject(
+    TNode<MaybeObject> value) {
+  return WordEqual(BitcastMaybeObjectToWord(value),
+                   IntPtrConstant(kClearedWeakHeapObject));
+}
+
+TNode<BoolT> CodeStubAssembler::IsNotClearedWeakHeapObject(
+    TNode<MaybeObject> value) {
+  return WordNotEqual(BitcastMaybeObjectToWord(value),
+                      IntPtrConstant(kClearedWeakHeapObject));
+}
+
+TNode<HeapObject> CodeStubAssembler::ToWeakHeapObject(
+    TNode<MaybeObject> value) {
+  CSA_ASSERT(this, IsWeakOrClearedHeapObject(value));
+  CSA_ASSERT(this, IsNotClearedWeakHeapObject(value));
+  return UncheckedCast<HeapObject>(BitcastWordToTagged(WordAnd(
+      BitcastMaybeObjectToWord(value), IntPtrConstant(~kWeakHeapObjectMask))));
+}
+
+TNode<HeapObject> CodeStubAssembler::ToWeakHeapObject(TNode<MaybeObject> value,
+                                                      Label* if_cleared) {
+  GotoIf(IsClearedWeakHeapObject(value), if_cleared);
+  return ToWeakHeapObject(value);
+}
+
+TNode<BoolT> CodeStubAssembler::IsWeakReferenceTo(TNode<MaybeObject> object,
+                                                  TNode<Object> value) {
+  return WordEqual(WordAnd(BitcastMaybeObjectToWord(object),
+                           IntPtrConstant(~kWeakHeapObjectMask)),
+                   BitcastTaggedToWord(value));
+}
+
+TNode<BoolT> CodeStubAssembler::IsStrongReferenceTo(TNode<MaybeObject> object,
+                                                    TNode<Object> value) {
+  return WordEqual(BitcastMaybeObjectToWord(object),
+                   BitcastTaggedToWord(value));
+}
+
+TNode<BoolT> CodeStubAssembler::IsNotWeakReferenceTo(TNode<MaybeObject> object,
+                                                     TNode<Object> value) {
+  return WordNotEqual(WordAnd(BitcastMaybeObjectToWord(object),
+                              IntPtrConstant(~kWeakHeapObjectMask)),
+                      BitcastTaggedToWord(value));
+}
+
+TNode<MaybeObject> CodeStubAssembler::MakeWeak(TNode<HeapObject> value) {
+  return ReinterpretCast<MaybeObject>(BitcastWordToTagged(
+      WordOr(BitcastTaggedToWord(value), IntPtrConstant(kWeakHeapObjectTag))));
+}
+
+TNode<MaybeObject> CodeStubAssembler::LoadArrayElement(
+    SloppyTNode<HeapObject> array, int array_header_size, Node* index_node,
+    int additional_offset, ParameterMode parameter_mode,
+    LoadSensitivity needs_poisoning) {
+  CSA_ASSERT(this, IntPtrGreaterThanOrEqual(
+                       ParameterToIntPtr(index_node, parameter_mode),
+                       IntPtrConstant(0)));
+  DCHECK_EQ(additional_offset % kPointerSize, 0);
+  int32_t header_size = array_header_size + additional_offset - kHeapObjectTag;
   TNode<IntPtrT> offset = ElementOffsetFromIndex(index_node, HOLEY_ELEMENTS,
                                                  parameter_mode, header_size);
-  return UncheckedCast<Object>(
-      Load(MachineType::AnyTagged(), object, offset, needs_poisoning));
+  STATIC_ASSERT(FixedArrayBase::kLengthOffset == WeakFixedArray::kLengthOffset);
+  STATIC_ASSERT(FixedArrayBase::kLengthOffset ==
+                PropertyArray::kLengthAndHashOffset);
+  // Check that index_node + additional_offset <= object.length.
+  // TODO(cbruni): Use proper LoadXXLength helpers
+  CSA_ASSERT(
+      this,
+      IsOffsetInBounds(
+          offset,
+          Select<IntPtrT>(
+              IsPropertyArray(array),
+              [=] {
+                TNode<IntPtrT> length_and_hash = LoadAndUntagObjectField(
+                    array, PropertyArray::kLengthAndHashOffset);
+                return TNode<IntPtrT>::UncheckedCast(
+                    DecodeWord<PropertyArray::LengthField>(length_and_hash));
+              },
+              [=] {
+                return LoadAndUntagObjectField(array,
+                                               FixedArrayBase::kLengthOffset);
+              }),
+          FixedArray::kHeaderSize));
+  return UncheckedCast<MaybeObject>(
+      Load(MachineType::AnyTagged(), array, offset, needs_poisoning));
+}
+
+TNode<Object> CodeStubAssembler::LoadFixedArrayElement(
+    SloppyTNode<HeapObject> object, Node* index_node, int additional_offset,
+    ParameterMode parameter_mode, LoadSensitivity needs_poisoning) {
+  // This function is currently used for non-FixedArrays (e.g., PropertyArrays)
+  // and thus the reasonable assert IsFixedArraySubclass(object) is
+  // not always true. TODO(marja): Fix.
+  CSA_SLOW_ASSERT(
+      this, Word32Or(IsFixedArraySubclass(object), IsPropertyArray(object)));
+  CSA_ASSERT(this, IsNotWeakFixedArraySubclass(object));
+  TNode<MaybeObject> element =
+      LoadArrayElement(object, FixedArray::kHeaderSize, index_node,
+                       additional_offset, parameter_mode, needs_poisoning);
+  return CAST(element);
+}
+
+TNode<Object> CodeStubAssembler::LoadPropertyArrayElement(
+    SloppyTNode<PropertyArray> object, SloppyTNode<IntPtrT> index) {
+  int additional_offset = 0;
+  ParameterMode parameter_mode = INTPTR_PARAMETERS;
+  LoadSensitivity needs_poisoning = LoadSensitivity::kSafe;
+  STATIC_ASSERT(PropertyArray::kHeaderSize == FixedArray::kHeaderSize);
+
+  return CAST(LoadArrayElement(object, PropertyArray::kHeaderSize, index,
+                               additional_offset, parameter_mode,
+                               needs_poisoning));
 }
 
 TNode<RawPtrT> CodeStubAssembler::LoadFixedTypedArrayBackingStore(
@@ -1955,7 +2168,48 @@ Node* CodeStubAssembler::LoadFixedTypedArrayElementAsTagged(
   }
 }
 
-TNode<Object> CodeStubAssembler::LoadFeedbackVectorSlot(
+void CodeStubAssembler::StoreFixedTypedArrayElementFromTagged(
+    TNode<Context> context, TNode<FixedTypedArrayBase> elements,
+    TNode<Object> index_node, TNode<Object> value, ElementsKind elements_kind,
+    ParameterMode parameter_mode) {
+  TNode<RawPtrT> data_pointer = LoadFixedTypedArrayBackingStore(elements);
+  switch (elements_kind) {
+    case UINT8_ELEMENTS:
+    case UINT8_CLAMPED_ELEMENTS:
+    case INT8_ELEMENTS:
+    case UINT16_ELEMENTS:
+    case INT16_ELEMENTS:
+      StoreElement(data_pointer, elements_kind, index_node,
+                   SmiToInt32(CAST(value)), parameter_mode);
+      break;
+    case UINT32_ELEMENTS:
+    case INT32_ELEMENTS:
+      StoreElement(data_pointer, elements_kind, index_node,
+                   TruncateTaggedToWord32(context, value), parameter_mode);
+      break;
+    case FLOAT32_ELEMENTS:
+      StoreElement(data_pointer, elements_kind, index_node,
+                   TruncateFloat64ToFloat32(LoadHeapNumberValue(CAST(value))),
+                   parameter_mode);
+      break;
+    case FLOAT64_ELEMENTS:
+      StoreElement(data_pointer, elements_kind, index_node,
+                   LoadHeapNumberValue(CAST(value)), parameter_mode);
+      break;
+    case BIGUINT64_ELEMENTS:
+    case BIGINT64_ELEMENTS: {
+      TNode<IntPtrT> offset =
+          ElementOffsetFromIndex(index_node, elements_kind, parameter_mode, 0);
+      EmitBigTypedArrayElementStore(elements, data_pointer, offset,
+                                    CAST(value));
+      break;
+    }
+    default:
+      UNREACHABLE();
+  }
+}
+
+TNode<MaybeObject> CodeStubAssembler::LoadFeedbackVectorSlot(
     Node* object, Node* slot_index_node, int additional_offset,
     ParameterMode parameter_mode) {
   CSA_SLOW_ASSERT(this, IsFeedbackVector(object));
@@ -1964,46 +2218,77 @@ TNode<Object> CodeStubAssembler::LoadFeedbackVectorSlot(
       FeedbackVector::kFeedbackSlotsOffset + additional_offset - kHeapObjectTag;
   Node* offset = ElementOffsetFromIndex(slot_index_node, HOLEY_ELEMENTS,
                                         parameter_mode, header_size);
-  return UncheckedCast<Object>(Load(MachineType::AnyTagged(), object, offset));
+  CSA_SLOW_ASSERT(
+      this, IsOffsetInBounds(offset, LoadFeedbackVectorLength(CAST(object)),
+                             FeedbackVector::kHeaderSize));
+  return UncheckedCast<MaybeObject>(
+      Load(MachineType::AnyTagged(), object, offset));
 }
 
-TNode<Int32T> CodeStubAssembler::LoadAndUntagToWord32FixedArrayElement(
-    SloppyTNode<Object> object, Node* index_node, int additional_offset,
-    ParameterMode parameter_mode) {
-  CSA_SLOW_ASSERT(this, IsFixedArraySubclass(object));
+TNode<Int32T> CodeStubAssembler::LoadAndUntagToWord32ArrayElement(
+    SloppyTNode<HeapObject> object, int array_header_size, Node* index_node,
+    int additional_offset, ParameterMode parameter_mode) {
   CSA_SLOW_ASSERT(this, MatchesParameterMode(index_node, parameter_mode));
-  int32_t header_size =
-      FixedArray::kHeaderSize + additional_offset - kHeapObjectTag;
+  DCHECK_EQ(additional_offset % kPointerSize, 0);
+  int endian_correction = 0;
 #if V8_TARGET_LITTLE_ENDIAN
-  if (Is64()) {
-    header_size += kPointerSize / 2;
-  }
+  if (SmiValuesAre32Bits()) endian_correction = kPointerSize / 2;
 #endif
+  int32_t header_size = array_header_size + additional_offset - kHeapObjectTag +
+                        endian_correction;
   Node* offset = ElementOffsetFromIndex(index_node, HOLEY_ELEMENTS,
                                         parameter_mode, header_size);
-  if (Is64()) {
+  STATIC_ASSERT(FixedArrayBase::kLengthOffset == WeakFixedArray::kLengthOffset);
+  // Check that index_node + additional_offset <= object.length.
+  // TODO(cbruni): Use proper LoadXXLength helpers
+  CSA_ASSERT(this,
+             IsOffsetInBounds(
+                 offset,
+                 LoadAndUntagObjectField(object, FixedArrayBase::kLengthOffset),
+                 FixedArray::kHeaderSize + endian_correction));
+  if (SmiValuesAre32Bits()) {
     return UncheckedCast<Int32T>(Load(MachineType::Int32(), object, offset));
   } else {
     return SmiToInt32(Load(MachineType::AnyTagged(), object, offset));
   }
 }
 
-Node* CodeStubAssembler::LoadFixedDoubleArrayElement(
-    Node* object, Node* index_node, MachineType machine_type,
-    int additional_offset, ParameterMode parameter_mode, Label* if_hole) {
-  CSA_SLOW_ASSERT(this, IsFixedDoubleArray(object));
-  CSA_SLOW_ASSERT(this, MatchesParameterMode(index_node, parameter_mode));
+TNode<Int32T> CodeStubAssembler::LoadAndUntagToWord32FixedArrayElement(
+    SloppyTNode<HeapObject> object, Node* index_node, int additional_offset,
+    ParameterMode parameter_mode) {
+  CSA_SLOW_ASSERT(this, IsFixedArraySubclass(object));
+  return LoadAndUntagToWord32ArrayElement(object, FixedArray::kHeaderSize,
+                                          index_node, additional_offset,
+                                          parameter_mode);
+}
+
+TNode<MaybeObject> CodeStubAssembler::LoadWeakFixedArrayElement(
+    TNode<WeakFixedArray> object, Node* index, int additional_offset,
+    ParameterMode parameter_mode, LoadSensitivity needs_poisoning) {
+  return LoadArrayElement(object, WeakFixedArray::kHeaderSize, index,
+                          additional_offset, parameter_mode, needs_poisoning);
+}
+
+TNode<Float64T> CodeStubAssembler::LoadFixedDoubleArrayElement(
+    SloppyTNode<FixedDoubleArray> object, Node* index_node,
+    MachineType machine_type, int additional_offset,
+    ParameterMode parameter_mode, Label* if_hole) {
   CSA_ASSERT(this, IsFixedDoubleArray(object));
+  DCHECK_EQ(additional_offset % kPointerSize, 0);
+  CSA_SLOW_ASSERT(this, MatchesParameterMode(index_node, parameter_mode));
   int32_t header_size =
       FixedDoubleArray::kHeaderSize + additional_offset - kHeapObjectTag;
-  Node* offset = ElementOffsetFromIndex(index_node, HOLEY_DOUBLE_ELEMENTS,
-                                        parameter_mode, header_size);
+  TNode<IntPtrT> offset = ElementOffsetFromIndex(
+      index_node, HOLEY_DOUBLE_ELEMENTS, parameter_mode, header_size);
+  CSA_ASSERT(this, IsOffsetInBounds(
+                       offset, LoadAndUntagFixedArrayBaseLength(object),
+                       FixedDoubleArray::kHeaderSize, HOLEY_DOUBLE_ELEMENTS));
   return LoadDoubleWithHoleCheck(object, offset, if_hole, machine_type);
 }
 
-Node* CodeStubAssembler::LoadDoubleWithHoleCheck(Node* base, Node* offset,
-                                                 Label* if_hole,
-                                                 MachineType machine_type) {
+TNode<Float64T> CodeStubAssembler::LoadDoubleWithHoleCheck(
+    SloppyTNode<Object> base, SloppyTNode<IntPtrT> offset, Label* if_hole,
+    MachineType machine_type) {
   if (if_hole) {
     // TODO(ishell): Compare only the upper part for the hole once the
     // compiler is able to fold addition of already complex |offset| with
@@ -2021,9 +2306,9 @@ Node* CodeStubAssembler::LoadDoubleWithHoleCheck(Node* base, Node* offset,
   }
   if (machine_type.IsNone()) {
     // This means the actual value is not needed.
-    return nullptr;
+    return TNode<Float64T>();
   }
-  return Load(machine_type, base, offset);
+  return UncheckedCast<Float64T>(Load(machine_type, base, offset));
 }
 
 TNode<Object> CodeStubAssembler::LoadContextElement(
@@ -2155,12 +2440,25 @@ Node* CodeStubAssembler::LoadSharedFunctionInfoBytecodeArray(Node* shared) {
   return var_result.value();
 }
 
+void CodeStubAssembler::StoreObjectByteNoWriteBarrier(TNode<HeapObject> object,
+                                                      int offset,
+                                                      TNode<Word32T> value) {
+  StoreNoWriteBarrier(MachineRepresentation::kWord8, object,
+                      IntPtrConstant(offset - kHeapObjectTag), value);
+}
+
 void CodeStubAssembler::StoreHeapNumberValue(SloppyTNode<HeapNumber> object,
                                              SloppyTNode<Float64T> value) {
   StoreObjectFieldNoWriteBarrier(object, HeapNumber::kValueOffset, value,
                                  MachineRepresentation::kFloat64);
 }
 
+void CodeStubAssembler::StoreMutableHeapNumberValue(
+    SloppyTNode<MutableHeapNumber> object, SloppyTNode<Float64T> value) {
+  StoreObjectFieldNoWriteBarrier(object, MutableHeapNumber::kValueOffset, value,
+                                 MachineRepresentation::kFloat64);
+}
+
 Node* CodeStubAssembler::StoreObjectField(
     Node* object, int offset, Node* value) {
   DCHECK_NE(HeapObject::kMapOffset, offset);  // Use StoreMap instead.
@@ -2236,18 +2534,38 @@ Node* CodeStubAssembler::StoreFixedArrayElement(Node* object, Node* index_node,
                                                 int additional_offset,
                                                 ParameterMode parameter_mode) {
   CSA_SLOW_ASSERT(
-      this,
-      Word32Or(IsHashTable(object),
-               Word32Or(IsFixedArray(object),
-                        Word32Or(IsPropertyArray(object), IsContext(object)))));
+      this, Word32Or(IsFixedArraySubclass(object), IsPropertyArray(object)));
   CSA_SLOW_ASSERT(this, MatchesParameterMode(index_node, parameter_mode));
   DCHECK(barrier_mode == SKIP_WRITE_BARRIER ||
          barrier_mode == UPDATE_WRITE_BARRIER);
+  DCHECK_EQ(additional_offset % kPointerSize, 0);
   STATIC_ASSERT(FixedArray::kHeaderSize == PropertyArray::kHeaderSize);
   int header_size =
       FixedArray::kHeaderSize + additional_offset - kHeapObjectTag;
   Node* offset = ElementOffsetFromIndex(index_node, HOLEY_ELEMENTS,
                                         parameter_mode, header_size);
+  STATIC_ASSERT(FixedArrayBase::kLengthOffset == WeakFixedArray::kLengthOffset);
+  STATIC_ASSERT(FixedArrayBase::kLengthOffset ==
+                PropertyArray::kLengthAndHashOffset);
+  // Check that index_node + additional_offset <= object.length.
+  // TODO(cbruni): Use proper LoadXXLength helpers
+  CSA_ASSERT(
+      this,
+      IsOffsetInBounds(
+          offset,
+          Select<IntPtrT>(
+              IsPropertyArray(object),
+              [=] {
+                TNode<IntPtrT> length_and_hash = LoadAndUntagObjectField(
+                    object, PropertyArray::kLengthAndHashOffset);
+                return TNode<IntPtrT>::UncheckedCast(
+                    DecodeWord<PropertyArray::LengthField>(length_and_hash));
+              },
+              [=] {
+                return LoadAndUntagObjectField(object,
+                                               FixedArrayBase::kLengthOffset);
+              }),
+          FixedArray::kHeaderSize));
   if (barrier_mode == SKIP_WRITE_BARRIER) {
     return StoreNoWriteBarrier(MachineRepresentation::kTagged, object, offset,
                                value);
@@ -2263,6 +2581,9 @@ Node* CodeStubAssembler::StoreFixedDoubleArrayElement(
   Node* offset =
       ElementOffsetFromIndex(index_node, PACKED_DOUBLE_ELEMENTS, parameter_mode,
                              FixedArray::kHeaderSize - kHeapObjectTag);
+  CSA_ASSERT(this, IsOffsetInBounds(
+                       offset, LoadAndUntagFixedArrayBaseLength(object),
+                       FixedDoubleArray::kHeaderSize, PACKED_DOUBLE_ELEMENTS));
   MachineRepresentation rep = MachineRepresentation::kFloat64;
   return StoreNoWriteBarrier(rep, object, offset, value);
 }
@@ -2275,12 +2596,17 @@ Node* CodeStubAssembler::StoreFeedbackVectorSlot(Node* object,
                                                  ParameterMode parameter_mode) {
   CSA_SLOW_ASSERT(this, IsFeedbackVector(object));
   CSA_SLOW_ASSERT(this, MatchesParameterMode(slot_index_node, parameter_mode));
+  DCHECK_EQ(additional_offset % kPointerSize, 0);
   DCHECK(barrier_mode == SKIP_WRITE_BARRIER ||
          barrier_mode == UPDATE_WRITE_BARRIER);
   int header_size =
       FeedbackVector::kFeedbackSlotsOffset + additional_offset - kHeapObjectTag;
   Node* offset = ElementOffsetFromIndex(slot_index_node, HOLEY_ELEMENTS,
                                         parameter_mode, header_size);
+  // Check that slot_index_node <= object.length.
+  CSA_ASSERT(this,
+             IsOffsetInBounds(offset, LoadFeedbackVectorLength(CAST(object)),
+                              FeedbackVector::kHeaderSize));
   if (barrier_mode == SKIP_WRITE_BARRIER) {
     return StoreNoWriteBarrier(MachineRepresentation::kTagged, object, offset,
                                value);
@@ -2301,14 +2627,14 @@ void CodeStubAssembler::EnsureArrayLengthWritable(TNode<Map> map,
 
   int length_index = JSArray::kLengthDescriptorIndex;
 #ifdef DEBUG
-  TNode<Name> maybe_length = CAST(LoadFixedArrayElement(
+  TNode<Name> maybe_length = CAST(LoadWeakFixedArrayElement(
       descriptors, DescriptorArray::ToKeyIndex(length_index)));
   CSA_ASSERT(this,
              WordEqual(maybe_length, LoadRoot(Heap::klength_stringRootIndex)));
 #endif
 
-  TNode<Int32T> details = LoadAndUntagToWord32FixedArrayElement(
-      descriptors, DescriptorArray::ToDetailsIndex(length_index));
+  TNode<Uint32T> details = LoadDetailsByKeyIndex(
+      descriptors, IntPtrConstant(DescriptorArray::ToKeyIndex(length_index)));
   GotoIf(IsSetWord32(details, PropertyDetails::kAttributesReadOnlyMask),
          bailout);
 }
@@ -2414,15 +2740,8 @@ void CodeStubAssembler::TryStoreArrayElement(ElementsKind kind,
   } else if (IsDoubleElementsKind(kind)) {
     GotoIfNotNumber(value, bailout);
   }
-  if (IsDoubleElementsKind(kind)) {
-    Node* double_value = ChangeNumberToFloat64(value);
-    StoreFixedDoubleArrayElement(elements, index,
-                                 Float64SilenceNaN(double_value), mode);
-  } else {
-    WriteBarrierMode barrier_mode =
-        IsSmiElementsKind(kind) ? SKIP_WRITE_BARRIER : UPDATE_WRITE_BARRIER;
-    StoreFixedArrayElement(elements, index, value, barrier_mode, 0, mode);
-  }
+  if (IsDoubleElementsKind(kind)) value = ChangeNumberToFloat64(value);
+  StoreElement(elements, kind, index, value, mode);
 }
 
 void CodeStubAssembler::BuildAppendJSArray(ElementsKind kind, Node* array,
@@ -2474,22 +2793,34 @@ Node* CodeStubAssembler::StoreCellValue(Node* cell, Node* value,
   }
 }
 
-TNode<HeapNumber> CodeStubAssembler::AllocateHeapNumber(MutableMode mode) {
+TNode<HeapNumber> CodeStubAssembler::AllocateHeapNumber() {
   Node* result = Allocate(HeapNumber::kSize, kNone);
-  Heap::RootListIndex heap_map_index =
-      mode == IMMUTABLE ? Heap::kHeapNumberMapRootIndex
-                        : Heap::kMutableHeapNumberMapRootIndex;
+  Heap::RootListIndex heap_map_index = Heap::kHeapNumberMapRootIndex;
   StoreMapNoWriteBarrier(result, heap_map_index);
   return UncheckedCast<HeapNumber>(result);
 }
 
 TNode<HeapNumber> CodeStubAssembler::AllocateHeapNumberWithValue(
-    SloppyTNode<Float64T> value, MutableMode mode) {
-  TNode<HeapNumber> result = AllocateHeapNumber(mode);
+    SloppyTNode<Float64T> value) {
+  TNode<HeapNumber> result = AllocateHeapNumber();
   StoreHeapNumberValue(result, value);
   return result;
 }
 
+TNode<MutableHeapNumber> CodeStubAssembler::AllocateMutableHeapNumber() {
+  Node* result = Allocate(MutableHeapNumber::kSize, kNone);
+  Heap::RootListIndex heap_map_index = Heap::kMutableHeapNumberMapRootIndex;
+  StoreMapNoWriteBarrier(result, heap_map_index);
+  return UncheckedCast<MutableHeapNumber>(result);
+}
+
+TNode<MutableHeapNumber> CodeStubAssembler::AllocateMutableHeapNumberWithValue(
+    SloppyTNode<Float64T> value) {
+  TNode<MutableHeapNumber> result = AllocateMutableHeapNumber();
+  StoreMutableHeapNumberValue(result, value);
+  return result;
+}
+
 TNode<BigInt> CodeStubAssembler::AllocateBigInt(TNode<IntPtrT> length) {
   TNode<BigInt> result = AllocateRawBigInt(length);
   StoreBigIntBitfield(result, WordShl(length, BigInt::LengthBits::kShift));
@@ -2551,18 +2882,10 @@ TNode<String> CodeStubAssembler::AllocateSeqOneByteString(
   return CAST(result);
 }
 
-Node* CodeStubAssembler::IsZeroOrContext(Node* object) {
-  Label out(this);
-  VARIABLE(var_result, MachineRepresentation::kWord32, Int32Constant(1));
-
-  GotoIf(WordEqual(object, SmiConstant(0)), &out);
-  GotoIf(IsContext(object), &out);
-
-  var_result.Bind(Int32Constant(0));
-  Goto(&out);
-
-  BIND(&out);
-  return var_result.value();
+TNode<BoolT> CodeStubAssembler::IsZeroOrContext(SloppyTNode<Object> object) {
+  return Select<BoolT>(WordEqual(object, SmiConstant(0)),
+                       [=] { return Int32TrueConstant(); },
+                       [=] { return IsContext(CAST(object)); });
 }
 
 TNode<String> CodeStubAssembler::AllocateSeqOneByteString(
@@ -2814,24 +3137,27 @@ TNode<String> CodeStubAssembler::NewConsString(Node* context, TNode<Smi> length,
   return result.value();
 }
 
-Node* CodeStubAssembler::AllocateNameDictionary(int at_least_space_for) {
+TNode<NameDictionary> CodeStubAssembler::AllocateNameDictionary(
+    int at_least_space_for) {
   return AllocateNameDictionary(IntPtrConstant(at_least_space_for));
 }
 
-Node* CodeStubAssembler::AllocateNameDictionary(Node* at_least_space_for) {
+TNode<NameDictionary> CodeStubAssembler::AllocateNameDictionary(
+    TNode<IntPtrT> at_least_space_for) {
   CSA_ASSERT(this, UintPtrLessThanOrEqual(
                        at_least_space_for,
                        IntPtrConstant(NameDictionary::kMaxCapacity)));
-  Node* capacity = HashTableComputeCapacity(at_least_space_for);
+  TNode<IntPtrT> capacity = HashTableComputeCapacity(at_least_space_for);
   return AllocateNameDictionaryWithCapacity(capacity);
 }
 
-Node* CodeStubAssembler::AllocateNameDictionaryWithCapacity(Node* capacity) {
+TNode<NameDictionary> CodeStubAssembler::AllocateNameDictionaryWithCapacity(
+    TNode<IntPtrT> capacity) {
   CSA_ASSERT(this, WordIsPowerOfTwo(capacity));
   CSA_ASSERT(this, IntPtrGreaterThan(capacity, IntPtrConstant(0)));
-  Node* length = EntryToIndex<NameDictionary>(capacity);
-  Node* store_size = IntPtrAdd(TimesPointerSize(length),
-                               IntPtrConstant(NameDictionary::kHeaderSize));
+  TNode<IntPtrT> length = EntryToIndex<NameDictionary>(capacity);
+  TNode<WordT> store_size = IntPtrAdd(
+      TimesPointerSize(length), IntPtrConstant(NameDictionary::kHeaderSize));
 
   Node* result = AllocateInNewSpace(store_size);
   Comment("Initialize NameDictionary");
@@ -2841,7 +3167,7 @@ Node* CodeStubAssembler::AllocateNameDictionaryWithCapacity(Node* capacity) {
   StoreObjectFieldNoWriteBarrier(result, FixedArray::kLengthOffset,
                                  SmiFromIntPtr(length));
   // Initialized HashTable fields.
-  Node* zero = SmiConstant(0);
+  TNode<Smi> zero = SmiConstant(0);
   StoreFixedArrayElement(result, NameDictionary::kNumberOfElementsIndex, zero,
                          SKIP_WRITE_BARRIER);
   StoreFixedArrayElement(result, NameDictionary::kNumberOfDeletedElementsIndex,
@@ -2849,7 +3175,7 @@ Node* CodeStubAssembler::AllocateNameDictionaryWithCapacity(Node* capacity) {
   StoreFixedArrayElement(result, NameDictionary::kCapacityIndex,
                          SmiTag(capacity), SKIP_WRITE_BARRIER);
   // Initialize Dictionary fields.
-  Node* filler = UndefinedConstant();
+  TNode<HeapObject> filler = UndefinedConstant();
   StoreFixedArrayElement(result, NameDictionary::kNextEnumerationIndexIndex,
                          SmiConstant(PropertyDetails::kInitialIndex),
                          SKIP_WRITE_BARRIER);
@@ -2858,33 +3184,245 @@ Node* CodeStubAssembler::AllocateNameDictionaryWithCapacity(Node* capacity) {
                          SKIP_WRITE_BARRIER);
 
   // Initialize NameDictionary elements.
-  Node* result_word = BitcastTaggedToWord(result);
-  Node* start_address = IntPtrAdd(
+  TNode<WordT> result_word = BitcastTaggedToWord(result);
+  TNode<WordT> start_address = IntPtrAdd(
       result_word, IntPtrConstant(NameDictionary::OffsetOfElementAt(
                                       NameDictionary::kElementsStartIndex) -
                                   kHeapObjectTag));
-  Node* end_address = IntPtrAdd(
+  TNode<WordT> end_address = IntPtrAdd(
       result_word, IntPtrSub(store_size, IntPtrConstant(kHeapObjectTag)));
   StoreFieldsNoWriteBarrier(start_address, end_address, filler);
-  return result;
+  return CAST(result);
 }
 
-Node* CodeStubAssembler::CopyNameDictionary(Node* dictionary,
-                                            Label* large_object_fallback) {
-  CSA_ASSERT(this, IsHashTable(dictionary));
+TNode<NameDictionary> CodeStubAssembler::CopyNameDictionary(
+    TNode<NameDictionary> dictionary, Label* large_object_fallback) {
   Comment("Copy boilerplate property dict");
-  Node* capacity = SmiUntag(GetCapacity<NameDictionary>(dictionary));
+  TNode<IntPtrT> capacity = SmiUntag(GetCapacity<NameDictionary>(dictionary));
   CSA_ASSERT(this, IntPtrGreaterThanOrEqual(capacity, IntPtrConstant(0)));
   GotoIf(UintPtrGreaterThan(
              capacity, IntPtrConstant(NameDictionary::kMaxRegularCapacity)),
          large_object_fallback);
-  Node* properties = AllocateNameDictionaryWithCapacity(capacity);
-  Node* length = SmiUntag(LoadFixedArrayBaseLength(dictionary));
+  TNode<NameDictionary> properties =
+      AllocateNameDictionaryWithCapacity(capacity);
+  TNode<IntPtrT> length = SmiUntag(LoadFixedArrayBaseLength(dictionary));
   CopyFixedArrayElements(PACKED_ELEMENTS, dictionary, properties, length,
                          SKIP_WRITE_BARRIER, INTPTR_PARAMETERS);
   return properties;
 }
 
+template <typename CollectionType>
+Node* CodeStubAssembler::AllocateOrderedHashTable() {
+  static const int kCapacity = CollectionType::kMinCapacity;
+  static const int kBucketCount = kCapacity / CollectionType::kLoadFactor;
+  static const int kDataTableLength = kCapacity * CollectionType::kEntrySize;
+  static const int kFixedArrayLength =
+      CollectionType::kHashTableStartIndex + kBucketCount + kDataTableLength;
+  static const int kDataTableStartIndex =
+      CollectionType::kHashTableStartIndex + kBucketCount;
+
+  STATIC_ASSERT(base::bits::IsPowerOfTwo(kCapacity));
+  STATIC_ASSERT(kCapacity <= CollectionType::kMaxCapacity);
+
+  // Allocate the table and add the proper map.
+  const ElementsKind elements_kind = HOLEY_ELEMENTS;
+  TNode<IntPtrT> length_intptr = IntPtrConstant(kFixedArrayLength);
+  TNode<Map> fixed_array_map = CAST(LoadRoot(
+      static_cast<Heap::RootListIndex>(CollectionType::GetMapRootIndex())));
+  TNode<FixedArray> table =
+      AllocateFixedArray(elements_kind, length_intptr,
+                         kAllowLargeObjectAllocation, fixed_array_map);
+
+  // Initialize the OrderedHashTable fields.
+  const WriteBarrierMode barrier_mode = SKIP_WRITE_BARRIER;
+  StoreFixedArrayElement(table, CollectionType::kNumberOfElementsIndex,
+                         SmiConstant(0), barrier_mode);
+  StoreFixedArrayElement(table, CollectionType::kNumberOfDeletedElementsIndex,
+                         SmiConstant(0), barrier_mode);
+  StoreFixedArrayElement(table, CollectionType::kNumberOfBucketsIndex,
+                         SmiConstant(kBucketCount), barrier_mode);
+
+  // Fill the buckets with kNotFound.
+  TNode<Smi> not_found = SmiConstant(CollectionType::kNotFound);
+  STATIC_ASSERT(CollectionType::kHashTableStartIndex ==
+                CollectionType::kNumberOfBucketsIndex + 1);
+  STATIC_ASSERT((CollectionType::kHashTableStartIndex + kBucketCount) ==
+                kDataTableStartIndex);
+  for (int i = 0; i < kBucketCount; i++) {
+    StoreFixedArrayElement(table, CollectionType::kHashTableStartIndex + i,
+                           not_found, barrier_mode);
+  }
+
+  // Fill the data table with undefined.
+  STATIC_ASSERT(kDataTableStartIndex + kDataTableLength == kFixedArrayLength);
+  for (int i = 0; i < kDataTableLength; i++) {
+    StoreFixedArrayElement(table, kDataTableStartIndex + i, UndefinedConstant(),
+                           barrier_mode);
+  }
+
+  return table;
+}
+
+template Node* CodeStubAssembler::AllocateOrderedHashTable<OrderedHashMap>();
+template Node* CodeStubAssembler::AllocateOrderedHashTable<OrderedHashSet>();
+
+template <typename CollectionType>
+TNode<CollectionType> CodeStubAssembler::AllocateSmallOrderedHashTable(
+    TNode<IntPtrT> capacity) {
+  CSA_ASSERT(this, WordIsPowerOfTwo(capacity));
+  CSA_ASSERT(this, IntPtrLessThan(
+                       capacity, IntPtrConstant(CollectionType::kMaxCapacity)));
+
+  TNode<IntPtrT> data_table_start_offset =
+      IntPtrConstant(CollectionType::kDataTableStartOffset);
+
+  TNode<IntPtrT> data_table_size = IntPtrMul(
+      capacity, IntPtrConstant(CollectionType::kEntrySize * kPointerSize));
+
+  TNode<Int32T> hash_table_size =
+      Int32Div(TruncateIntPtrToInt32(capacity),
+               Int32Constant(CollectionType::kLoadFactor));
+
+  TNode<IntPtrT> hash_table_start_offset =
+      IntPtrAdd(data_table_start_offset, data_table_size);
+
+  TNode<IntPtrT> hash_table_and_chain_table_size =
+      IntPtrAdd(ChangeInt32ToIntPtr(hash_table_size), capacity);
+
+  TNode<IntPtrT> total_size =
+      IntPtrAdd(hash_table_start_offset, hash_table_and_chain_table_size);
+
+  TNode<IntPtrT> total_size_word_aligned =
+      IntPtrAdd(total_size, IntPtrConstant(kPointerSize - 1));
+  total_size_word_aligned = ChangeInt32ToIntPtr(
+      Int32Div(TruncateIntPtrToInt32(total_size_word_aligned),
+               Int32Constant(kPointerSize)));
+  total_size_word_aligned =
+      UncheckedCast<IntPtrT>(TimesPointerSize(total_size_word_aligned));
+
+  // Allocate the table and add the proper map.
+  TNode<Map> small_ordered_hash_map = CAST(LoadRoot(
+      static_cast<Heap::RootListIndex>(CollectionType::GetMapRootIndex())));
+  TNode<Object> table_obj = CAST(AllocateInNewSpace(total_size_word_aligned));
+  StoreMapNoWriteBarrier(table_obj, small_ordered_hash_map);
+  TNode<CollectionType> table = UncheckedCast<CollectionType>(table_obj);
+
+  // Initialize the SmallOrderedHashTable fields.
+  StoreObjectByteNoWriteBarrier(
+      table, CollectionType::kNumberOfBucketsOffset,
+      Word32And(Int32Constant(0xFF), hash_table_size));
+  StoreObjectByteNoWriteBarrier(table, CollectionType::kNumberOfElementsOffset,
+                                Int32Constant(0));
+  StoreObjectByteNoWriteBarrier(
+      table, CollectionType::kNumberOfDeletedElementsOffset, Int32Constant(0));
+
+  TNode<IntPtrT> table_address =
+      IntPtrSub(BitcastTaggedToWord(table), IntPtrConstant(kHeapObjectTag));
+  TNode<IntPtrT> hash_table_start_address =
+      IntPtrAdd(table_address, hash_table_start_offset);
+
+  // Initialize the HashTable part.
+  Node* memset = ExternalConstant(ExternalReference::libc_memset_function());
+  CallCFunction3(MachineType::AnyTagged(), MachineType::Pointer(),
+                 MachineType::IntPtr(), MachineType::UintPtr(), memset,
+                 hash_table_start_address, IntPtrConstant(0xFF),
+                 hash_table_and_chain_table_size);
+
+  // Initialize the DataTable part.
+  TNode<HeapObject> filler = TheHoleConstant();
+  TNode<WordT> data_table_start_address =
+      IntPtrAdd(table_address, data_table_start_offset);
+  TNode<WordT> data_table_end_address =
+      IntPtrAdd(data_table_start_address, data_table_size);
+  StoreFieldsNoWriteBarrier(data_table_start_address, data_table_end_address,
+                            filler);
+
+  return table;
+}
+
+template TNode<SmallOrderedHashMap>
+CodeStubAssembler::AllocateSmallOrderedHashTable<SmallOrderedHashMap>(
+    TNode<IntPtrT> capacity);
+template TNode<SmallOrderedHashSet>
+CodeStubAssembler::AllocateSmallOrderedHashTable<SmallOrderedHashSet>(
+    TNode<IntPtrT> capacity);
+
+template <typename CollectionType>
+void CodeStubAssembler::FindOrderedHashTableEntry(
+    Node* table, Node* hash,
+    std::function<void(Node*, Label*, Label*)> key_compare,
+    Variable* entry_start_position, Label* entry_found, Label* not_found) {
+  // Get the index of the bucket.
+  Node* const number_of_buckets = SmiUntag(CAST(
+      LoadFixedArrayElement(table, CollectionType::kNumberOfBucketsIndex)));
+  Node* const bucket =
+      WordAnd(hash, IntPtrSub(number_of_buckets, IntPtrConstant(1)));
+  Node* const first_entry = SmiUntag(CAST(LoadFixedArrayElement(
+      table, bucket, CollectionType::kHashTableStartIndex * kPointerSize)));
+
+  // Walk the bucket chain.
+  Node* entry_start;
+  Label if_key_found(this);
+  {
+    VARIABLE(var_entry, MachineType::PointerRepresentation(), first_entry);
+    Label loop(this, {&var_entry, entry_start_position}),
+        continue_next_entry(this);
+    Goto(&loop);
+    BIND(&loop);
+
+    // If the entry index is the not-found sentinel, we are done.
+    GotoIf(
+        WordEqual(var_entry.value(), IntPtrConstant(CollectionType::kNotFound)),
+        not_found);
+
+    // Make sure the entry index is within range.
+    CSA_ASSERT(
+        this,
+        UintPtrLessThan(
+            var_entry.value(),
+            SmiUntag(SmiAdd(
+                CAST(LoadFixedArrayElement(
+                    table, CollectionType::kNumberOfElementsIndex)),
+                CAST(LoadFixedArrayElement(
+                    table, CollectionType::kNumberOfDeletedElementsIndex))))));
+
+    // Compute the index of the entry relative to kHashTableStartIndex.
+    entry_start =
+        IntPtrAdd(IntPtrMul(var_entry.value(),
+                            IntPtrConstant(CollectionType::kEntrySize)),
+                  number_of_buckets);
+
+    // Load the key from the entry.
+    Node* const candidate_key = LoadFixedArrayElement(
+        table, entry_start,
+        CollectionType::kHashTableStartIndex * kPointerSize);
+
+    key_compare(candidate_key, &if_key_found, &continue_next_entry);
+
+    BIND(&continue_next_entry);
+    // Load the index of the next entry in the bucket chain.
+    var_entry.Bind(SmiUntag(CAST(LoadFixedArrayElement(
+        table, entry_start,
+        (CollectionType::kHashTableStartIndex + CollectionType::kChainOffset) *
+            kPointerSize))));
+
+    Goto(&loop);
+  }
+
+  BIND(&if_key_found);
+  entry_start_position->Bind(entry_start);
+  Goto(entry_found);
+}
+
+template void CodeStubAssembler::FindOrderedHashTableEntry<OrderedHashMap>(
+    Node* table, Node* hash,
+    std::function<void(Node*, Label*, Label*)> key_compare,
+    Variable* entry_start_position, Label* entry_found, Label* not_found);
+template void CodeStubAssembler::FindOrderedHashTableEntry<OrderedHashSet>(
+    Node* table, Node* hash,
+    std::function<void(Node*, Label*, Label*)> key_compare,
+    Variable* entry_start_position, Label* entry_found, Label* not_found);
+
 Node* CodeStubAssembler::AllocateStruct(Node* map, AllocationFlags flags) {
   Comment("AllocateStruct");
   CSA_ASSERT(this, IsMap(map));
@@ -2936,7 +3474,7 @@ void CodeStubAssembler::InitializeJSObjectFromMap(
                          Heap::kEmptyFixedArrayRootIndex);
   } else {
     CSA_ASSERT(this, Word32Or(Word32Or(IsPropertyArray(properties),
-                                       IsDictionary(properties)),
+                                       IsNameDictionary(properties)),
                               IsEmptyFixedArray(properties)));
     StoreObjectFieldNoWriteBarrier(object, JSObject::kPropertiesOrHashOffset,
                                    properties);
@@ -3087,7 +3625,7 @@ CodeStubAssembler::AllocateUninitializedJSArrayWithElements(
                                  : Heap::kFixedArrayMapRootIndex;
   DCHECK(Heap::RootIsImmortalImmovable(elements_map_index));
   StoreMapNoWriteBarrier(elements, elements_map_index);
-  Node* capacity_smi = ParameterToTagged(capacity, capacity_mode);
+  TNode<Smi> capacity_smi = ParameterToTagged(capacity, capacity_mode);
   CSA_ASSERT(this, SmiGreaterThan(capacity_smi, SmiConstant(0)));
   StoreObjectFieldNoWriteBarrier(elements, FixedArray::kLengthOffset,
                                  capacity_smi);
@@ -3226,16 +3764,14 @@ Node* CodeStubAssembler::CloneFastJSArray(Node* context, Node* array,
   return result;
 }
 
-Node* CodeStubAssembler::AllocateFixedArray(ElementsKind kind,
-                                            Node* capacity_node,
-                                            ParameterMode mode,
-                                            AllocationFlags flags,
-                                            Node* fixed_array_map) {
+TNode<FixedArray> CodeStubAssembler::AllocateFixedArray(
+    ElementsKind kind, Node* capacity, ParameterMode mode,
+    AllocationFlags flags, SloppyTNode<Map> fixed_array_map) {
   Comment("AllocateFixedArray");
-  CSA_SLOW_ASSERT(this, MatchesParameterMode(capacity_node, mode));
-  CSA_ASSERT(this, IntPtrOrSmiGreaterThan(capacity_node,
+  CSA_SLOW_ASSERT(this, MatchesParameterMode(capacity, mode));
+  CSA_ASSERT(this, IntPtrOrSmiGreaterThan(capacity,
                                           IntPtrOrSmiConstant(0, mode), mode));
-  Node* total_size = GetFixedArrayAllocationSize(capacity_node, kind, mode);
+  TNode<IntPtrT> total_size = GetFixedArrayAllocationSize(capacity, kind, mode);
 
   if (IsDoubleElementsKind(kind)) flags |= kDoubleAlignment;
   // Allocate both array and elements object, and initialize the JSArray.
@@ -3260,8 +3796,8 @@ Node* CodeStubAssembler::AllocateFixedArray(ElementsKind kind,
     StoreMapNoWriteBarrier(array, map_index);
   }
   StoreObjectFieldNoWriteBarrier(array, FixedArray::kLengthOffset,
-                                 ParameterToTagged(capacity_node, mode));
-  return array;
+                                 ParameterToTagged(capacity, mode));
+  return UncheckedCast<FixedArray>(array);
 }
 
 TNode<FixedArray> CodeStubAssembler::ExtractFixedArray(
@@ -3742,7 +4278,7 @@ Node* CodeStubAssembler::LoadElementAndPrepareForStore(Node* array,
                                                        ElementsKind from_kind,
                                                        ElementsKind to_kind,
                                                        Label* if_hole) {
-  CSA_SLOW_ASSERT(this, IsFixedArrayWithKind(array, from_kind));
+  CSA_ASSERT(this, IsFixedArrayWithKind(array, from_kind));
   if (IsDoubleElementsKind(from_kind)) {
     Node* value =
         LoadDoubleWithHoleCheck(array, offset, if_hole, MachineType::Float64());
@@ -3855,12 +4391,14 @@ void CodeStubAssembler::InitializeAllocationMemento(Node* base,
   StoreObjectFieldNoWriteBarrier(
       memento, AllocationMemento::kAllocationSiteOffset, allocation_site);
   if (FLAG_allocation_site_pretenuring) {
-    Node* count = LoadObjectField(allocation_site,
-                                  AllocationSite::kPretenureCreateCountOffset);
-    Node* incremented_count = SmiAdd(count, SmiConstant(1));
-    StoreObjectFieldNoWriteBarrier(allocation_site,
-                                   AllocationSite::kPretenureCreateCountOffset,
-                                   incremented_count);
+    TNode<Int32T> count = UncheckedCast<Int32T>(LoadObjectField(
+        allocation_site, AllocationSite::kPretenureCreateCountOffset,
+        MachineType::Int32()));
+
+    TNode<Int32T> incremented_count = Int32Add(count, Int32Constant(1));
+    StoreObjectFieldNoWriteBarrier(
+        allocation_site, AllocationSite::kPretenureCreateCountOffset,
+        incremented_count, MachineRepresentation::kWord32);
   }
   Comment("]");
 }
@@ -4004,7 +4542,7 @@ void CodeStubAssembler::TaggedToWord32OrBigIntImpl(
         // We do not require an Or with earlier feedback here because once we
         // convert the value to a Numeric, we cannot reach this path. We can
         // only reach this path on the first pass when the feedback is kNone.
-        CSA_ASSERT(this, SmiEqual(var_feedback->value(),
+        CSA_ASSERT(this, SmiEqual(CAST(var_feedback->value()),
                                   SmiConstant(BinaryOperationFeedback::kNone)));
       }
       GotoIf(InstanceTypeEqual(instance_type, ODDBALL_TYPE), &is_oddball);
@@ -4064,11 +4602,12 @@ TNode<Number> CodeStubAssembler::ChangeFloat64ToTagged(
   TVARIABLE(Number, var_result);
   BIND(&if_valueisint32);
   {
-    if (Is64()) {
+    if (SmiValuesAre32Bits()) {
       TNode<Smi> result = SmiTag(ChangeInt32ToIntPtr(value32));
       var_result = result;
       Goto(&if_join);
     } else {
+      DCHECK(SmiValuesAre31Bits());
       TNode<PairT<Int32T, BoolT>> pair = Int32AddWithOverflow(value32, value32);
       TNode<BoolT> overflow = Projection<1>(pair);
       Label if_overflow(this, Label::kDeferred), if_notoverflow(this);
@@ -4077,8 +4616,9 @@ TNode<Number> CodeStubAssembler::ChangeFloat64ToTagged(
       Goto(&if_valueisheapnumber);
       BIND(&if_notoverflow);
       {
-        TNode<IntPtrT> result = ChangeInt32ToIntPtr(Projection<0>(pair));
-        var_result = BitcastWordToTaggedSigned(result);
+        TNode<Smi> result =
+            BitcastWordToTaggedSigned(ChangeInt32ToIntPtr(Projection<0>(pair)));
+        var_result = result;
         Goto(&if_join);
       }
     }
@@ -4094,9 +4634,10 @@ TNode<Number> CodeStubAssembler::ChangeFloat64ToTagged(
 
 TNode<Number> CodeStubAssembler::ChangeInt32ToTagged(
     SloppyTNode<Int32T> value) {
-  if (Is64()) {
+  if (SmiValuesAre32Bits()) {
     return SmiTag(ChangeInt32ToIntPtr(value));
   }
+  DCHECK(SmiValuesAre31Bits());
   TVARIABLE(Number, var_result);
   TNode<PairT<Int32T, BoolT>> pair = Int32AddWithOverflow(value, value);
   TNode<BoolT> overflow = Projection<1>(pair);
@@ -4112,8 +4653,10 @@ TNode<Number> CodeStubAssembler::ChangeInt32ToTagged(
   Goto(&if_join);
   BIND(&if_notoverflow);
   {
-    TNode<Smi> result =
-        BitcastWordToTaggedSigned(ChangeInt32ToIntPtr(Projection<0>(pair)));
+    TNode<IntPtrT> almost_tagged_value =
+        ChangeInt32ToIntPtr(Projection<0>(pair));
+    TNode<Smi> result;
+    result = BitcastWordToTaggedSigned(almost_tagged_value);
     var_result = result;
   }
   Goto(&if_join);
@@ -4132,10 +4675,11 @@ TNode<Number> CodeStubAssembler::ChangeUint32ToTagged(
 
   BIND(&if_not_overflow);
   {
-    if (Is64()) {
+    if (SmiValuesAre32Bits()) {
       var_result =
           SmiTag(ReinterpretCast<IntPtrT>(ChangeUint32ToUint64(value)));
     } else {
+      DCHECK(SmiValuesAre31Bits());
       // If tagging {value} results in an overflow, we need to use a HeapNumber
       // to represent it.
       // TODO(tebbi): This overflow can never happen.
@@ -4144,9 +4688,9 @@ TNode<Number> CodeStubAssembler::ChangeUint32ToTagged(
       TNode<BoolT> overflow = Projection<1>(pair);
       GotoIf(overflow, &if_overflow);
 
-      TNode<Smi> result =
-          BitcastWordToTaggedSigned(ChangeInt32ToIntPtr(Projection<0>(pair)));
-      var_result = result;
+      TNode<IntPtrT> almost_tagged_value =
+          ChangeInt32ToIntPtr(Projection<0>(pair));
+      var_result = BitcastWordToTaggedSigned(almost_tagged_value);
     }
   }
   Goto(&if_join);
@@ -4247,7 +4791,7 @@ TNode<UintPtrT> CodeStubAssembler::ChangeNonnegativeNumberToUintPtr(
   return result.value();
 }
 
-Node* CodeStubAssembler::TimesPointerSize(Node* value) {
+SloppyTNode<WordT> CodeStubAssembler::TimesPointerSize(Node* value) {
   return WordShl(value, IntPtrConstant(kPointerSizeLog2));
 }
 
@@ -4436,70 +4980,70 @@ TNode<BoolT> CodeStubAssembler::IsDictionaryMap(SloppyTNode<Map> map) {
   return IsSetWord32<Map::IsDictionaryMapBit>(bit_field3);
 }
 
-Node* CodeStubAssembler::IsExtensibleMap(Node* map) {
+TNode<BoolT> CodeStubAssembler::IsExtensibleMap(SloppyTNode<Map> map) {
   CSA_ASSERT(this, IsMap(map));
   return IsSetWord32<Map::IsExtensibleBit>(LoadMapBitField2(map));
 }
 
-Node* CodeStubAssembler::IsCallableMap(Node* map) {
+TNode<BoolT> CodeStubAssembler::IsCallableMap(SloppyTNode<Map> map) {
   CSA_ASSERT(this, IsMap(map));
   return IsSetWord32<Map::IsCallableBit>(LoadMapBitField(map));
 }
 
-Node* CodeStubAssembler::IsDeprecatedMap(Node* map) {
+TNode<BoolT> CodeStubAssembler::IsDeprecatedMap(SloppyTNode<Map> map) {
   CSA_ASSERT(this, IsMap(map));
   return IsSetWord32<Map::IsDeprecatedBit>(LoadMapBitField3(map));
 }
 
-Node* CodeStubAssembler::IsUndetectableMap(Node* map) {
+TNode<BoolT> CodeStubAssembler::IsUndetectableMap(SloppyTNode<Map> map) {
   CSA_ASSERT(this, IsMap(map));
   return IsSetWord32<Map::IsUndetectableBit>(LoadMapBitField(map));
 }
 
-Node* CodeStubAssembler::IsNoElementsProtectorCellInvalid() {
+TNode<BoolT> CodeStubAssembler::IsNoElementsProtectorCellInvalid() {
   Node* invalid = SmiConstant(Isolate::kProtectorInvalid);
   Node* cell = LoadRoot(Heap::kNoElementsProtectorRootIndex);
   Node* cell_value = LoadObjectField(cell, PropertyCell::kValueOffset);
   return WordEqual(cell_value, invalid);
 }
 
-Node* CodeStubAssembler::IsPromiseResolveProtectorCellInvalid() {
+TNode<BoolT> CodeStubAssembler::IsPromiseResolveProtectorCellInvalid() {
   Node* invalid = SmiConstant(Isolate::kProtectorInvalid);
   Node* cell = LoadRoot(Heap::kPromiseResolveProtectorRootIndex);
   Node* cell_value = LoadObjectField(cell, Cell::kValueOffset);
   return WordEqual(cell_value, invalid);
 }
 
-Node* CodeStubAssembler::IsPromiseThenProtectorCellInvalid() {
+TNode<BoolT> CodeStubAssembler::IsPromiseThenProtectorCellInvalid() {
   Node* invalid = SmiConstant(Isolate::kProtectorInvalid);
   Node* cell = LoadRoot(Heap::kPromiseThenProtectorRootIndex);
   Node* cell_value = LoadObjectField(cell, PropertyCell::kValueOffset);
   return WordEqual(cell_value, invalid);
 }
 
-Node* CodeStubAssembler::IsArraySpeciesProtectorCellInvalid() {
+TNode<BoolT> CodeStubAssembler::IsArraySpeciesProtectorCellInvalid() {
   Node* invalid = SmiConstant(Isolate::kProtectorInvalid);
   Node* cell = LoadRoot(Heap::kArraySpeciesProtectorRootIndex);
   Node* cell_value = LoadObjectField(cell, PropertyCell::kValueOffset);
   return WordEqual(cell_value, invalid);
 }
 
-Node* CodeStubAssembler::IsTypedArraySpeciesProtectorCellInvalid() {
+TNode<BoolT> CodeStubAssembler::IsTypedArraySpeciesProtectorCellInvalid() {
   Node* invalid = SmiConstant(Isolate::kProtectorInvalid);
   Node* cell = LoadRoot(Heap::kTypedArraySpeciesProtectorRootIndex);
   Node* cell_value = LoadObjectField(cell, PropertyCell::kValueOffset);
   return WordEqual(cell_value, invalid);
 }
 
-Node* CodeStubAssembler::IsPromiseSpeciesProtectorCellInvalid() {
+TNode<BoolT> CodeStubAssembler::IsPromiseSpeciesProtectorCellInvalid() {
   Node* invalid = SmiConstant(Isolate::kProtectorInvalid);
   Node* cell = LoadRoot(Heap::kPromiseSpeciesProtectorRootIndex);
   Node* cell_value = LoadObjectField(cell, PropertyCell::kValueOffset);
   return WordEqual(cell_value, invalid);
 }
 
-Node* CodeStubAssembler::IsPrototypeInitialArrayPrototype(Node* context,
-                                                          Node* map) {
+TNode<BoolT> CodeStubAssembler::IsPrototypeInitialArrayPrototype(
+    SloppyTNode<Context> context, SloppyTNode<Map> map) {
   Node* const native_context = LoadNativeContext(context);
   Node* const initial_array_prototype = LoadContextElement(
       native_context, Context::INITIAL_ARRAY_PROTOTYPE_INDEX);
@@ -4512,209 +5056,255 @@ TNode<BoolT> CodeStubAssembler::IsPrototypeTypedArrayPrototype(
   TNode<Context> const native_context = LoadNativeContext(context);
   TNode<Object> const typed_array_prototype =
       LoadContextElement(native_context, Context::TYPED_ARRAY_PROTOTYPE_INDEX);
-  TNode<Object> proto = LoadMapPrototype(map);
-  TNode<Object> proto_of_proto = Select<Object>(
-      IsJSObject(proto), [=] { return LoadMapPrototype(LoadMap(CAST(proto))); },
+  TNode<HeapObject> proto = LoadMapPrototype(map);
+  TNode<HeapObject> proto_of_proto = Select<HeapObject>(
+      IsJSObject(proto), [=] { return LoadMapPrototype(LoadMap(proto)); },
       [=] { return NullConstant(); });
   return WordEqual(proto_of_proto, typed_array_prototype);
 }
 
-Node* CodeStubAssembler::IsCallable(Node* object) {
+TNode<BoolT> CodeStubAssembler::TaggedIsCallable(TNode<Object> object) {
+  return Select<BoolT>(
+      TaggedIsSmi(object), [=] { return Int32FalseConstant(); },
+      [=] {
+        return IsCallableMap(LoadMap(UncheckedCast<HeapObject>(object)));
+      });
+}
+
+TNode<BoolT> CodeStubAssembler::IsCallable(SloppyTNode<HeapObject> object) {
   return IsCallableMap(LoadMap(object));
 }
 
-Node* CodeStubAssembler::IsCell(Node* object) {
+TNode<BoolT> CodeStubAssembler::IsCell(SloppyTNode<HeapObject> object) {
   return WordEqual(LoadMap(object), LoadRoot(Heap::kCellMapRootIndex));
 }
 
-Node* CodeStubAssembler::IsCode(Node* object) {
+TNode<BoolT> CodeStubAssembler::IsCode(SloppyTNode<HeapObject> object) {
   return HasInstanceType(object, CODE_TYPE);
 }
 
-Node* CodeStubAssembler::IsConstructorMap(Node* map) {
+TNode<BoolT> CodeStubAssembler::IsConstructorMap(SloppyTNode<Map> map) {
   CSA_ASSERT(this, IsMap(map));
   return IsSetWord32<Map::IsConstructorBit>(LoadMapBitField(map));
 }
 
-Node* CodeStubAssembler::IsConstructor(Node* object) {
+TNode<BoolT> CodeStubAssembler::IsConstructor(SloppyTNode<HeapObject> object) {
   return IsConstructorMap(LoadMap(object));
 }
 
-Node* CodeStubAssembler::IsFunctionWithPrototypeSlotMap(Node* map) {
+TNode<BoolT> CodeStubAssembler::IsFunctionWithPrototypeSlotMap(
+    SloppyTNode<Map> map) {
   CSA_ASSERT(this, IsMap(map));
   return IsSetWord32<Map::HasPrototypeSlotBit>(LoadMapBitField(map));
 }
 
 TNode<BoolT> CodeStubAssembler::IsSpecialReceiverInstanceType(
-    Node* instance_type) {
+    TNode<Int32T> instance_type) {
   STATIC_ASSERT(JS_GLOBAL_OBJECT_TYPE <= LAST_SPECIAL_RECEIVER_TYPE);
   return Int32LessThanOrEqual(instance_type,
                               Int32Constant(LAST_SPECIAL_RECEIVER_TYPE));
 }
 
-Node* CodeStubAssembler::IsStringInstanceType(Node* instance_type) {
+TNode<BoolT> CodeStubAssembler::IsCustomElementsReceiverInstanceType(
+    TNode<Int32T> instance_type) {
+  return Int32LessThanOrEqual(instance_type,
+                              Int32Constant(LAST_CUSTOM_ELEMENTS_RECEIVER));
+}
+
+TNode<BoolT> CodeStubAssembler::IsStringInstanceType(
+    SloppyTNode<Int32T> instance_type) {
   STATIC_ASSERT(INTERNALIZED_STRING_TYPE == FIRST_TYPE);
   return Int32LessThan(instance_type, Int32Constant(FIRST_NONSTRING_TYPE));
 }
 
-Node* CodeStubAssembler::IsOneByteStringInstanceType(Node* instance_type) {
+TNode<BoolT> CodeStubAssembler::IsOneByteStringInstanceType(
+    SloppyTNode<Int32T> instance_type) {
   CSA_ASSERT(this, IsStringInstanceType(instance_type));
   return Word32Equal(
       Word32And(instance_type, Int32Constant(kStringEncodingMask)),
       Int32Constant(kOneByteStringTag));
 }
 
-Node* CodeStubAssembler::IsSequentialStringInstanceType(Node* instance_type) {
+TNode<BoolT> CodeStubAssembler::IsSequentialStringInstanceType(
+    SloppyTNode<Int32T> instance_type) {
   CSA_ASSERT(this, IsStringInstanceType(instance_type));
   return Word32Equal(
       Word32And(instance_type, Int32Constant(kStringRepresentationMask)),
       Int32Constant(kSeqStringTag));
 }
 
-Node* CodeStubAssembler::IsConsStringInstanceType(Node* instance_type) {
+TNode<BoolT> CodeStubAssembler::IsConsStringInstanceType(
+    SloppyTNode<Int32T> instance_type) {
   CSA_ASSERT(this, IsStringInstanceType(instance_type));
   return Word32Equal(
       Word32And(instance_type, Int32Constant(kStringRepresentationMask)),
       Int32Constant(kConsStringTag));
 }
 
-Node* CodeStubAssembler::IsIndirectStringInstanceType(Node* instance_type) {
+TNode<BoolT> CodeStubAssembler::IsIndirectStringInstanceType(
+    SloppyTNode<Int32T> instance_type) {
   CSA_ASSERT(this, IsStringInstanceType(instance_type));
   STATIC_ASSERT(kIsIndirectStringMask == 0x1);
   STATIC_ASSERT(kIsIndirectStringTag == 0x1);
-  return Word32And(instance_type, Int32Constant(kIsIndirectStringMask));
+  return UncheckedCast<BoolT>(
+      Word32And(instance_type, Int32Constant(kIsIndirectStringMask)));
 }
 
-Node* CodeStubAssembler::IsExternalStringInstanceType(Node* instance_type) {
+TNode<BoolT> CodeStubAssembler::IsExternalStringInstanceType(
+    SloppyTNode<Int32T> instance_type) {
   CSA_ASSERT(this, IsStringInstanceType(instance_type));
   return Word32Equal(
       Word32And(instance_type, Int32Constant(kStringRepresentationMask)),
       Int32Constant(kExternalStringTag));
 }
 
-Node* CodeStubAssembler::IsShortExternalStringInstanceType(
-    Node* instance_type) {
+TNode<BoolT> CodeStubAssembler::IsShortExternalStringInstanceType(
+    SloppyTNode<Int32T> instance_type) {
   CSA_ASSERT(this, IsStringInstanceType(instance_type));
   STATIC_ASSERT(kShortExternalStringTag != 0);
   return IsSetWord32(instance_type, kShortExternalStringMask);
 }
 
-Node* CodeStubAssembler::IsJSReceiverInstanceType(Node* instance_type) {
+TNode<BoolT> CodeStubAssembler::IsJSReceiverInstanceType(
+    SloppyTNode<Int32T> instance_type) {
   STATIC_ASSERT(LAST_JS_RECEIVER_TYPE == LAST_TYPE);
   return Int32GreaterThanOrEqual(instance_type,
                                  Int32Constant(FIRST_JS_RECEIVER_TYPE));
 }
 
-Node* CodeStubAssembler::IsJSReceiverMap(Node* map) {
+TNode<BoolT> CodeStubAssembler::IsJSReceiverMap(SloppyTNode<Map> map) {
   return IsJSReceiverInstanceType(LoadMapInstanceType(map));
 }
 
-Node* CodeStubAssembler::IsJSReceiver(Node* object) {
+TNode<BoolT> CodeStubAssembler::IsJSReceiver(SloppyTNode<HeapObject> object) {
   return IsJSReceiverMap(LoadMap(object));
 }
 
-Node* CodeStubAssembler::IsNullOrJSReceiver(Node* object) {
-  return Word32Or(IsJSReceiver(object), IsNull(object));
+TNode<BoolT> CodeStubAssembler::IsNullOrJSReceiver(
+    SloppyTNode<HeapObject> object) {
+  return UncheckedCast<BoolT>(Word32Or(IsJSReceiver(object), IsNull(object)));
 }
 
-Node* CodeStubAssembler::IsNullOrUndefined(Node* const value) {
-  return Word32Or(IsUndefined(value), IsNull(value));
+TNode<BoolT> CodeStubAssembler::IsNullOrUndefined(SloppyTNode<Object> value) {
+  return UncheckedCast<BoolT>(Word32Or(IsUndefined(value), IsNull(value)));
 }
 
-Node* CodeStubAssembler::IsJSGlobalProxyInstanceType(Node* instance_type) {
+TNode<BoolT> CodeStubAssembler::IsJSGlobalProxyInstanceType(
+    SloppyTNode<Int32T> instance_type) {
   return InstanceTypeEqual(instance_type, JS_GLOBAL_PROXY_TYPE);
 }
 
-Node* CodeStubAssembler::IsJSObjectInstanceType(Node* instance_type) {
+TNode<BoolT> CodeStubAssembler::IsJSObjectInstanceType(
+    SloppyTNode<Int32T> instance_type) {
   STATIC_ASSERT(LAST_JS_OBJECT_TYPE == LAST_TYPE);
   return Int32GreaterThanOrEqual(instance_type,
                                  Int32Constant(FIRST_JS_OBJECT_TYPE));
 }
 
-Node* CodeStubAssembler::IsJSObjectMap(Node* map) {
+TNode<BoolT> CodeStubAssembler::IsJSObjectMap(SloppyTNode<Map> map) {
   CSA_ASSERT(this, IsMap(map));
   return IsJSObjectInstanceType(LoadMapInstanceType(map));
 }
 
-Node* CodeStubAssembler::IsJSObject(Node* object) {
+TNode<BoolT> CodeStubAssembler::IsJSObject(SloppyTNode<HeapObject> object) {
   return IsJSObjectMap(LoadMap(object));
 }
 
-Node* CodeStubAssembler::IsJSPromiseMap(Node* map) {
+TNode<BoolT> CodeStubAssembler::IsJSPromiseMap(SloppyTNode<Map> map) {
   CSA_ASSERT(this, IsMap(map));
   return InstanceTypeEqual(LoadMapInstanceType(map), JS_PROMISE_TYPE);
 }
 
-Node* CodeStubAssembler::IsJSPromise(Node* object) {
+TNode<BoolT> CodeStubAssembler::IsJSPromise(SloppyTNode<HeapObject> object) {
   return IsJSPromiseMap(LoadMap(object));
 }
 
-Node* CodeStubAssembler::IsJSProxy(Node* object) {
+TNode<BoolT> CodeStubAssembler::IsJSProxy(SloppyTNode<HeapObject> object) {
   return HasInstanceType(object, JS_PROXY_TYPE);
 }
 
-Node* CodeStubAssembler::IsJSGlobalProxy(Node* object) {
+TNode<BoolT> CodeStubAssembler::IsJSGlobalProxy(
+    SloppyTNode<HeapObject> object) {
   return HasInstanceType(object, JS_GLOBAL_PROXY_TYPE);
 }
 
-Node* CodeStubAssembler::IsMap(Node* map) { return IsMetaMap(LoadMap(map)); }
+TNode<BoolT> CodeStubAssembler::IsMap(SloppyTNode<HeapObject> map) {
+  return IsMetaMap(LoadMap(map));
+}
 
-Node* CodeStubAssembler::IsJSValueInstanceType(Node* instance_type) {
+TNode<BoolT> CodeStubAssembler::IsJSValueInstanceType(
+    SloppyTNode<Int32T> instance_type) {
   return InstanceTypeEqual(instance_type, JS_VALUE_TYPE);
 }
 
-Node* CodeStubAssembler::IsJSValue(Node* object) {
+TNode<BoolT> CodeStubAssembler::IsJSValue(SloppyTNode<HeapObject> object) {
   return IsJSValueMap(LoadMap(object));
 }
 
-Node* CodeStubAssembler::IsJSValueMap(Node* map) {
+TNode<BoolT> CodeStubAssembler::IsJSValueMap(SloppyTNode<Map> map) {
   return IsJSValueInstanceType(LoadMapInstanceType(map));
 }
 
-Node* CodeStubAssembler::IsJSArrayInstanceType(Node* instance_type) {
+TNode<BoolT> CodeStubAssembler::IsJSArrayInstanceType(
+    SloppyTNode<Int32T> instance_type) {
   return InstanceTypeEqual(instance_type, JS_ARRAY_TYPE);
 }
 
-Node* CodeStubAssembler::IsJSArray(Node* object) {
+TNode<BoolT> CodeStubAssembler::IsJSArray(SloppyTNode<HeapObject> object) {
   return IsJSArrayMap(LoadMap(object));
 }
 
-Node* CodeStubAssembler::IsJSArrayMap(Node* map) {
+TNode<BoolT> CodeStubAssembler::IsJSArrayMap(SloppyTNode<Map> map) {
   return IsJSArrayInstanceType(LoadMapInstanceType(map));
 }
 
-Node* CodeStubAssembler::IsJSArrayIterator(Node* object) {
+TNode<BoolT> CodeStubAssembler::IsJSArrayIterator(
+    SloppyTNode<HeapObject> object) {
   return HasInstanceType(object, JS_ARRAY_ITERATOR_TYPE);
 }
 
-Node* CodeStubAssembler::IsJSAsyncGeneratorObject(Node* object) {
+TNode<BoolT> CodeStubAssembler::IsJSAsyncGeneratorObject(
+    SloppyTNode<HeapObject> object) {
   return HasInstanceType(object, JS_ASYNC_GENERATOR_OBJECT_TYPE);
 }
 
-Node* CodeStubAssembler::IsContext(Node* object) {
+TNode<BoolT> CodeStubAssembler::IsContext(SloppyTNode<HeapObject> object) {
   Node* instance_type = LoadInstanceType(object);
-  return Word32And(
+  return UncheckedCast<BoolT>(Word32And(
       Int32GreaterThanOrEqual(instance_type, Int32Constant(FIRST_CONTEXT_TYPE)),
-      Int32LessThanOrEqual(instance_type, Int32Constant(LAST_CONTEXT_TYPE)));
+      Int32LessThanOrEqual(instance_type, Int32Constant(LAST_CONTEXT_TYPE))));
 }
 
-Node* CodeStubAssembler::IsFixedArray(Node* object) {
+TNode<BoolT> CodeStubAssembler::IsFixedArray(SloppyTNode<HeapObject> object) {
   return HasInstanceType(object, FIXED_ARRAY_TYPE);
 }
 
-Node* CodeStubAssembler::IsFixedArraySubclass(Node* object) {
+TNode<BoolT> CodeStubAssembler::IsFixedArraySubclass(
+    SloppyTNode<HeapObject> object) {
   Node* instance_type = LoadInstanceType(object);
-  return Word32And(Int32GreaterThanOrEqual(
-                       instance_type, Int32Constant(FIRST_FIXED_ARRAY_TYPE)),
-                   Int32LessThanOrEqual(instance_type,
-                                        Int32Constant(LAST_FIXED_ARRAY_TYPE)));
+  return UncheckedCast<BoolT>(
+      Word32And(Int32GreaterThanOrEqual(instance_type,
+                                        Int32Constant(FIRST_FIXED_ARRAY_TYPE)),
+                Int32LessThanOrEqual(instance_type,
+                                     Int32Constant(LAST_FIXED_ARRAY_TYPE))));
 }
 
-Node* CodeStubAssembler::IsPromiseCapability(Node* object) {
+TNode<BoolT> CodeStubAssembler::IsNotWeakFixedArraySubclass(
+    SloppyTNode<HeapObject> object) {
+  Node* instance_type = LoadInstanceType(object);
+  return UncheckedCast<BoolT>(Word32Or(
+      Int32LessThan(instance_type, Int32Constant(FIRST_WEAK_FIXED_ARRAY_TYPE)),
+      Int32GreaterThan(instance_type,
+                       Int32Constant(LAST_WEAK_FIXED_ARRAY_TYPE))));
+}
+
+TNode<BoolT> CodeStubAssembler::IsPromiseCapability(
+    SloppyTNode<HeapObject> object) {
   return HasInstanceType(object, PROMISE_CAPABILITY_TYPE);
 }
 
-Node* CodeStubAssembler::IsPropertyArray(Node* object) {
+TNode<BoolT> CodeStubAssembler::IsPropertyArray(
+    SloppyTNode<HeapObject> object) {
   return HasInstanceType(object, PROPERTY_ARRAY_TYPE);
 }
 
@@ -4727,24 +5317,25 @@ Node* CodeStubAssembler::IsPropertyArray(Node* object) {
 // source array is empty.
 // TODO(jgruber): It might we worth creating an empty_double_array constant to
 // simplify this case.
-Node* CodeStubAssembler::IsFixedArrayWithKindOrEmpty(Node* object,
-                                                     ElementsKind kind) {
+TNode<BoolT> CodeStubAssembler::IsFixedArrayWithKindOrEmpty(
+    SloppyTNode<HeapObject> object, ElementsKind kind) {
   Label out(this);
-  VARIABLE(var_result, MachineRepresentation::kWord32, Int32Constant(1));
+  TVARIABLE(BoolT, var_result, Int32TrueConstant());
 
   GotoIf(IsFixedArrayWithKind(object, kind), &out);
 
-  Node* const length = LoadFixedArrayBaseLength(object);
+  TNode<Smi> const length = LoadFixedArrayBaseLength(CAST(object));
   GotoIf(SmiEqual(length, SmiConstant(0)), &out);
 
-  var_result.Bind(Int32Constant(0));
+  var_result = Int32FalseConstant();
   Goto(&out);
 
   BIND(&out);
   return var_result.value();
 }
 
-Node* CodeStubAssembler::IsFixedArrayWithKind(Node* object, ElementsKind kind) {
+TNode<BoolT> CodeStubAssembler::IsFixedArrayWithKind(
+    SloppyTNode<HeapObject> object, ElementsKind kind) {
   if (IsDoubleElementsKind(kind)) {
     return IsFixedDoubleArray(object);
   } else {
@@ -4753,81 +5344,91 @@ Node* CodeStubAssembler::IsFixedArrayWithKind(Node* object, ElementsKind kind) {
   }
 }
 
-Node* CodeStubAssembler::IsWeakCell(Node* object) {
+TNode<BoolT> CodeStubAssembler::IsWeakCell(SloppyTNode<HeapObject> object) {
+  CSA_ASSERT(this, IsStrongHeapObject(object));
   return IsWeakCellMap(LoadMap(object));
 }
 
-Node* CodeStubAssembler::IsBoolean(Node* object) {
+TNode<BoolT> CodeStubAssembler::IsBoolean(SloppyTNode<HeapObject> object) {
   return IsBooleanMap(LoadMap(object));
 }
 
-Node* CodeStubAssembler::IsPropertyCell(Node* object) {
+TNode<BoolT> CodeStubAssembler::IsPropertyCell(SloppyTNode<HeapObject> object) {
   return IsPropertyCellMap(LoadMap(object));
 }
 
-Node* CodeStubAssembler::IsAccessorInfo(Node* object) {
+TNode<BoolT> CodeStubAssembler::IsAccessorInfo(SloppyTNode<HeapObject> object) {
   return IsAccessorInfoMap(LoadMap(object));
 }
 
-Node* CodeStubAssembler::IsAccessorPair(Node* object) {
+TNode<BoolT> CodeStubAssembler::IsAccessorPair(SloppyTNode<HeapObject> object) {
   return IsAccessorPairMap(LoadMap(object));
 }
 
-Node* CodeStubAssembler::IsAllocationSite(Node* object) {
-  return IsAllocationSiteMap(LoadMap(object));
+TNode<BoolT> CodeStubAssembler::IsAllocationSite(
+    SloppyTNode<HeapObject> object) {
+  return IsAllocationSiteInstanceType(LoadInstanceType(object));
 }
 
-Node* CodeStubAssembler::IsAnyHeapNumber(Node* object) {
-  return Word32Or(IsMutableHeapNumber(object), IsHeapNumber(object));
+TNode<BoolT> CodeStubAssembler::IsAnyHeapNumber(
+    SloppyTNode<HeapObject> object) {
+  return UncheckedCast<BoolT>(
+      Word32Or(IsMutableHeapNumber(object), IsHeapNumber(object)));
 }
 
-TNode<BoolT> CodeStubAssembler::IsHeapNumber(Node* object) {
+TNode<BoolT> CodeStubAssembler::IsHeapNumber(SloppyTNode<HeapObject> object) {
   return IsHeapNumberMap(LoadMap(object));
 }
 
-Node* CodeStubAssembler::IsMutableHeapNumber(Node* object) {
+TNode<BoolT> CodeStubAssembler::IsMutableHeapNumber(
+    SloppyTNode<HeapObject> object) {
   return IsMutableHeapNumberMap(LoadMap(object));
 }
 
-Node* CodeStubAssembler::IsFeedbackCell(Node* object) {
+TNode<BoolT> CodeStubAssembler::IsFeedbackCell(SloppyTNode<HeapObject> object) {
   return HasInstanceType(object, FEEDBACK_CELL_TYPE);
 }
 
-Node* CodeStubAssembler::IsFeedbackVector(Node* object) {
+TNode<BoolT> CodeStubAssembler::IsFeedbackVector(
+    SloppyTNode<HeapObject> object) {
   return IsFeedbackVectorMap(LoadMap(object));
 }
 
-Node* CodeStubAssembler::IsName(Node* object) {
+TNode<BoolT> CodeStubAssembler::IsName(SloppyTNode<HeapObject> object) {
   return Int32LessThanOrEqual(LoadInstanceType(object),
                               Int32Constant(LAST_NAME_TYPE));
 }
 
-Node* CodeStubAssembler::IsString(Node* object) {
+TNode<BoolT> CodeStubAssembler::IsString(SloppyTNode<HeapObject> object) {
   return IsStringInstanceType(LoadInstanceType(object));
 }
 
-Node* CodeStubAssembler::IsSymbolInstanceType(Node* instance_type) {
+TNode<BoolT> CodeStubAssembler::IsSymbolInstanceType(
+    SloppyTNode<Int32T> instance_type) {
   return InstanceTypeEqual(instance_type, SYMBOL_TYPE);
 }
 
-Node* CodeStubAssembler::IsSymbol(Node* object) {
+TNode<BoolT> CodeStubAssembler::IsSymbol(SloppyTNode<HeapObject> object) {
   return IsSymbolMap(LoadMap(object));
 }
 
-Node* CodeStubAssembler::IsBigIntInstanceType(Node* instance_type) {
+TNode<BoolT> CodeStubAssembler::IsBigIntInstanceType(
+    SloppyTNode<Int32T> instance_type) {
   return InstanceTypeEqual(instance_type, BIGINT_TYPE);
 }
 
-Node* CodeStubAssembler::IsBigInt(Node* object) {
+TNode<BoolT> CodeStubAssembler::IsBigInt(SloppyTNode<HeapObject> object) {
   return IsBigIntInstanceType(LoadInstanceType(object));
 }
 
-Node* CodeStubAssembler::IsPrimitiveInstanceType(Node* instance_type) {
+TNode<BoolT> CodeStubAssembler::IsPrimitiveInstanceType(
+    SloppyTNode<Int32T> instance_type) {
   return Int32LessThanOrEqual(instance_type,
                               Int32Constant(LAST_PRIMITIVE_TYPE));
 }
 
-TNode<BoolT> CodeStubAssembler::IsPrivateSymbol(Node* object) {
+TNode<BoolT> CodeStubAssembler::IsPrivateSymbol(
+    SloppyTNode<HeapObject> object) {
   return Select<BoolT>(
       IsSymbol(object),
       [=] {
@@ -4839,75 +5440,107 @@ TNode<BoolT> CodeStubAssembler::IsPrivateSymbol(Node* object) {
       [=] { return Int32FalseConstant(); });
 }
 
-Node* CodeStubAssembler::IsNativeContext(Node* object) {
+TNode<BoolT> CodeStubAssembler::IsNativeContext(
+    SloppyTNode<HeapObject> object) {
   return WordEqual(LoadMap(object), LoadRoot(Heap::kNativeContextMapRootIndex));
 }
 
-Node* CodeStubAssembler::IsFixedDoubleArray(Node* object) {
+TNode<BoolT> CodeStubAssembler::IsFixedDoubleArray(
+    SloppyTNode<HeapObject> object) {
   return WordEqual(LoadMap(object), FixedDoubleArrayMapConstant());
 }
 
-Node* CodeStubAssembler::IsHashTable(Node* object) {
-  return HasInstanceType(object, HASH_TABLE_TYPE);
+TNode<BoolT> CodeStubAssembler::IsHashTable(SloppyTNode<HeapObject> object) {
+  Node* instance_type = LoadInstanceType(object);
+  return UncheckedCast<BoolT>(
+      Word32And(Int32GreaterThanOrEqual(instance_type,
+                                        Int32Constant(FIRST_HASH_TABLE_TYPE)),
+                Int32LessThanOrEqual(instance_type,
+                                     Int32Constant(LAST_HASH_TABLE_TYPE))));
 }
 
-Node* CodeStubAssembler::IsDictionary(Node* object) {
-  return Word32Or(IsHashTable(object), IsNumberDictionary(object));
+TNode<BoolT> CodeStubAssembler::IsEphemeronHashTable(
+    SloppyTNode<HeapObject> object) {
+  return HasInstanceType(object, EPHEMERON_HASH_TABLE_TYPE);
+}
+
+TNode<BoolT> CodeStubAssembler::IsNameDictionary(
+    SloppyTNode<HeapObject> object) {
+  return HasInstanceType(object, NAME_DICTIONARY_TYPE);
 }
 
-Node* CodeStubAssembler::IsNumberDictionary(Node* object) {
-  return WordEqual(LoadMap(object),
-                   LoadRoot(Heap::kNumberDictionaryMapRootIndex));
+TNode<BoolT> CodeStubAssembler::IsGlobalDictionary(
+    SloppyTNode<HeapObject> object) {
+  return HasInstanceType(object, GLOBAL_DICTIONARY_TYPE);
+}
+
+TNode<BoolT> CodeStubAssembler::IsNumberDictionary(
+    SloppyTNode<HeapObject> object) {
+  return HasInstanceType(object, NUMBER_DICTIONARY_TYPE);
 }
 
-Node* CodeStubAssembler::IsJSGeneratorObject(Node* object) {
+TNode<BoolT> CodeStubAssembler::IsJSGeneratorObject(
+    SloppyTNode<HeapObject> object) {
   return HasInstanceType(object, JS_GENERATOR_OBJECT_TYPE);
 }
 
-Node* CodeStubAssembler::IsJSFunctionInstanceType(Node* instance_type) {
+TNode<BoolT> CodeStubAssembler::IsJSFunctionInstanceType(
+    SloppyTNode<Int32T> instance_type) {
   return InstanceTypeEqual(instance_type, JS_FUNCTION_TYPE);
 }
 
-Node* CodeStubAssembler::IsJSFunction(Node* object) {
+TNode<BoolT> CodeStubAssembler::IsAllocationSiteInstanceType(
+    SloppyTNode<Int32T> instance_type) {
+  return InstanceTypeEqual(instance_type, ALLOCATION_SITE_TYPE);
+}
+
+TNode<BoolT> CodeStubAssembler::IsJSFunction(SloppyTNode<HeapObject> object) {
   return IsJSFunctionMap(LoadMap(object));
 }
 
-Node* CodeStubAssembler::IsJSFunctionMap(Node* map) {
+TNode<BoolT> CodeStubAssembler::IsJSFunctionMap(SloppyTNode<Map> map) {
   return IsJSFunctionInstanceType(LoadMapInstanceType(map));
 }
 
-Node* CodeStubAssembler::IsJSTypedArray(Node* object) {
+TNode<BoolT> CodeStubAssembler::IsJSTypedArray(SloppyTNode<HeapObject> object) {
   return HasInstanceType(object, JS_TYPED_ARRAY_TYPE);
 }
 
-Node* CodeStubAssembler::IsJSArrayBuffer(Node* object) {
+TNode<BoolT> CodeStubAssembler::IsJSArrayBuffer(
+    SloppyTNode<HeapObject> object) {
   return HasInstanceType(object, JS_ARRAY_BUFFER_TYPE);
 }
 
-Node* CodeStubAssembler::IsFixedTypedArray(Node* object) {
-  Node* instance_type = LoadInstanceType(object);
-  return Word32And(
+TNode<BoolT> CodeStubAssembler::IsJSDataView(TNode<HeapObject> object) {
+  return HasInstanceType(object, JS_DATA_VIEW_TYPE);
+}
+
+TNode<BoolT> CodeStubAssembler::IsFixedTypedArray(
+    SloppyTNode<HeapObject> object) {
+  TNode<Int32T> instance_type = LoadInstanceType(object);
+  return UncheckedCast<BoolT>(Word32And(
       Int32GreaterThanOrEqual(instance_type,
                               Int32Constant(FIRST_FIXED_TYPED_ARRAY_TYPE)),
       Int32LessThanOrEqual(instance_type,
-                           Int32Constant(LAST_FIXED_TYPED_ARRAY_TYPE)));
+                           Int32Constant(LAST_FIXED_TYPED_ARRAY_TYPE))));
 }
 
-Node* CodeStubAssembler::IsJSRegExp(Node* object) {
+TNode<BoolT> CodeStubAssembler::IsJSRegExp(SloppyTNode<HeapObject> object) {
   return HasInstanceType(object, JS_REGEXP_TYPE);
 }
 
 TNode<BoolT> CodeStubAssembler::IsNumber(SloppyTNode<Object> object) {
   return Select<BoolT>(TaggedIsSmi(object), [=] { return Int32TrueConstant(); },
-                       [=] { return IsHeapNumber(object); });
+                       [=] { return IsHeapNumber(CAST(object)); });
 }
 
 TNode<BoolT> CodeStubAssembler::IsNumeric(SloppyTNode<Object> object) {
-  return Select<BoolT>(TaggedIsSmi(object), [=] { return Int32TrueConstant(); },
-                       [=] {
-                         return UncheckedCast<BoolT>(
-                             Word32Or(IsHeapNumber(object), IsBigInt(object)));
-                       });
+  return Select<BoolT>(
+      TaggedIsSmi(object), [=] { return Int32TrueConstant(); },
+      [=] {
+        return UncheckedCast<BoolT>(
+            Word32Or(IsHeapNumber(CAST(object)), IsBigInt(CAST(object))));
+      });
 }
 
 TNode<BoolT> CodeStubAssembler::IsNumberNormalized(SloppyTNode<Number> number) {
@@ -4934,43 +5567,95 @@ TNode<BoolT> CodeStubAssembler::IsNumberNormalized(SloppyTNode<Number> number) {
 }
 
 TNode<BoolT> CodeStubAssembler::IsNumberPositive(SloppyTNode<Number> number) {
-  TNode<Float64T> float_zero = Float64Constant(0.);
   return Select<BoolT>(TaggedIsSmi(number),
                        [=] { return TaggedIsPositiveSmi(number); },
-                       [=] {
-                         TNode<Float64T> v = LoadHeapNumberValue(CAST(number));
-                         return Float64GreaterThanOrEqual(v, float_zero);
-                       });
+                       [=] { return IsHeapNumberPositive(CAST(number)); });
 }
 
-TNode<BoolT> CodeStubAssembler::IsNumberArrayIndex(SloppyTNode<Number> number) {
-  TVARIABLE(BoolT, var_result, Int32TrueConstant());
+// TODO(cbruni): Use TNode<HeapNumber> instead of custom name.
+TNode<BoolT> CodeStubAssembler::IsHeapNumberPositive(TNode<HeapNumber> number) {
+  TNode<Float64T> value = LoadHeapNumberValue(number);
+  TNode<Float64T> float_zero = Float64Constant(0.);
+  return Float64GreaterThanOrEqual(value, float_zero);
+}
+
+TNode<BoolT> CodeStubAssembler::IsNumberNonNegativeSafeInteger(
+    TNode<Number> number) {
+  return Select<BoolT>(
+      // TODO(cbruni): Introduce TaggedIsNonNegateSmi to avoid confusion.
+      TaggedIsSmi(number), [=] { return TaggedIsPositiveSmi(number); },
+      [=] {
+        TNode<HeapNumber> heap_number = CAST(number);
+        return Select<BoolT>(IsInteger(heap_number),
+                             [=] { return IsHeapNumberPositive(heap_number); },
+                             [=] { return Int32FalseConstant(); });
+      });
+}
 
-  Label check_upper_bound(this), check_is_integer(this), out(this),
-      return_false(this);
+TNode<BoolT> CodeStubAssembler::IsSafeInteger(TNode<Object> number) {
+  return Select<BoolT>(
+      TaggedIsSmi(number), [=] { return Int32TrueConstant(); },
+      [=] {
+        return Select<BoolT>(
+            IsHeapNumber(CAST(number)),
+            [=] { return IsSafeInteger(UncheckedCast<HeapNumber>(number)); },
+            [=] { return Int32FalseConstant(); });
+      });
+}
 
-  GotoIfNumberGreaterThanOrEqual(number, NumberConstant(0), &check_upper_bound);
-  Goto(&return_false);
+TNode<BoolT> CodeStubAssembler::IsSafeInteger(TNode<HeapNumber> number) {
+  // Load the actual value of {number}.
+  TNode<Float64T> number_value = LoadHeapNumberValue(number);
+  // Truncate the value of {number} to an integer (or an infinity).
+  TNode<Float64T> integer = Float64Trunc(number_value);
 
-  BIND(&check_upper_bound);
-  GotoIfNumberGreaterThanOrEqual(number, NumberConstant(kMaxUInt32),
-                                 &return_false);
-  Goto(&check_is_integer);
+  return Select<BoolT>(
+      // Check if {number}s value matches the integer (ruling out the
+      // infinities).
+      Float64Equal(Float64Sub(number_value, integer), Float64Constant(0.0)),
+      [=] {
+        // Check if the {integer} value is in safe integer range.
+        return Float64LessThanOrEqual(Float64Abs(integer),
+                                      Float64Constant(kMaxSafeInteger));
+      },
+      [=] { return Int32FalseConstant(); });
+}
 
-  BIND(&check_is_integer);
-  GotoIf(TaggedIsSmi(number), &out);
-  // Check that the HeapNumber is a valid uint32
-  TNode<Float64T> value = LoadHeapNumberValue(CAST(number));
-  TNode<Uint32T> int_value = ChangeFloat64ToUint32(value);
-  GotoIf(Float64Equal(value, ChangeUint32ToFloat64(int_value)), &out);
-  Goto(&return_false);
+TNode<BoolT> CodeStubAssembler::IsInteger(TNode<Object> number) {
+  return Select<BoolT>(
+      TaggedIsSmi(number), [=] { return Int32TrueConstant(); },
+      [=] {
+        return Select<BoolT>(
+            IsHeapNumber(CAST(number)),
+            [=] { return IsInteger(UncheckedCast<HeapNumber>(number)); },
+            [=] { return Int32FalseConstant(); });
+      });
+}
 
-  BIND(&return_false);
-  var_result = Int32FalseConstant();
-  Goto(&out);
+TNode<BoolT> CodeStubAssembler::IsInteger(TNode<HeapNumber> number) {
+  TNode<Float64T> number_value = LoadHeapNumberValue(number);
+  // Truncate the value of {number} to an integer (or an infinity).
+  TNode<Float64T> integer = Float64Trunc(number_value);
+  // Check if {number}s value matches the integer (ruling out the infinities).
+  return Float64Equal(Float64Sub(number_value, integer), Float64Constant(0.0));
+}
 
-  BIND(&out);
-  return var_result.value();
+TNode<BoolT> CodeStubAssembler::IsHeapNumberUint32(TNode<HeapNumber> number) {
+  // Check that the HeapNumber is a valid uint32
+  return Select<BoolT>(
+      IsHeapNumberPositive(number),
+      [=] {
+        TNode<Float64T> value = LoadHeapNumberValue(number);
+        TNode<Uint32T> int_value = ChangeFloat64ToUint32(value);
+        return Float64Equal(value, ChangeUint32ToFloat64(int_value));
+      },
+      [=] { return Int32FalseConstant(); });
+}
+
+TNode<BoolT> CodeStubAssembler::IsNumberArrayIndex(TNode<Number> number) {
+  return Select<BoolT>(TaggedIsSmi(number),
+                       [=] { return TaggedIsPositiveSmi(number); },
+                       [=] { return IsHeapNumberUint32(CAST(number)); });
 }
 
 Node* CodeStubAssembler::FixedArraySizeDoesntFitInNewSpace(Node* element_count,
@@ -5517,8 +6202,7 @@ TNode<String> CodeStubAssembler::StringAdd(Node* context, TNode<String> left,
     // If new length is greater than String::kMaxLength, goto runtime to
     // throw. Note: we also need to invalidate the string length protector, so
     // can't just throw here directly.
-    GotoIf(SmiGreaterThan(new_length, SmiConstant(String::kMaxLength)),
-           &runtime);
+    GotoIf(SmiAbove(new_length, SmiConstant(String::kMaxLength)), &runtime);
 
     TVARIABLE(String, var_left, left);
     TVARIABLE(String, var_right, right);
@@ -5946,7 +6630,7 @@ TNode<Number> CodeStubAssembler::ToNumber_Inline(SloppyTNode<Context> context,
   BIND(&not_smi);
   {
     var_result =
-        Select<Number>(IsHeapNumber(input), [=] { return CAST(input); },
+        Select<Number>(IsHeapNumber(CAST(input)), [=] { return CAST(input); },
                        [=] {
                          return CAST(CallBuiltin(Builtins::kNonNumberToNumber,
                                                  context, input));
@@ -5997,7 +6681,7 @@ TNode<BigInt> CodeStubAssembler::ToBigInt(SloppyTNode<Context> context,
   Label if_bigint(this), done(this), if_throw(this);
 
   GotoIf(TaggedIsSmi(input), &if_throw);
-  GotoIf(IsBigInt(input), &if_bigint);
+  GotoIf(IsBigInt(CAST(input)), &if_bigint);
   var_result = CAST(CallRuntime(Runtime::kToBigInt, context, input));
   Goto(&done);
 
@@ -6207,7 +6891,7 @@ TNode<String> CodeStubAssembler::ToString_Inline(SloppyTNode<Context> context,
   Label stub_call(this, Label::kDeferred), out(this);
 
   GotoIf(TaggedIsSmi(input), &stub_call);
-  Branch(IsString(input), &out, &stub_call);
+  Branch(IsString(CAST(input)), &out, &stub_call);
 
   BIND(&stub_call);
   var_result.Bind(CallBuiltin(Builtins::kToString, context, input));
@@ -6357,7 +7041,8 @@ TNode<Number> CodeStubAssembler::ToInteger(SloppyTNode<Context> context,
     // Check if {arg} is a HeapNumber.
     Label if_argisheapnumber(this),
         if_argisnotheapnumber(this, Label::kDeferred);
-    Branch(IsHeapNumber(arg), &if_argisheapnumber, &if_argisnotheapnumber);
+    Branch(IsHeapNumber(CAST(arg)), &if_argisheapnumber,
+           &if_argisnotheapnumber);
 
     BIND(&if_argisheapnumber);
     {
@@ -6412,10 +7097,11 @@ TNode<UintPtrT> CodeStubAssembler::DecodeWord(SloppyTNode<WordT> word,
       WordShr(WordAnd(word, IntPtrConstant(mask)), static_cast<int>(shift)));
 }
 
-Node* CodeStubAssembler::UpdateWord(Node* word, Node* value, uint32_t shift,
-                                    uint32_t mask) {
-  Node* encoded_value = WordShl(value, static_cast<int>(shift));
-  Node* inverted_mask = IntPtrConstant(~static_cast<intptr_t>(mask));
+TNode<WordT> CodeStubAssembler::UpdateWord(TNode<WordT> word,
+                                           TNode<WordT> value, uint32_t shift,
+                                           uint32_t mask) {
+  TNode<WordT> encoded_value = WordShl(value, static_cast<int>(shift));
+  TNode<IntPtrT> inverted_mask = IntPtrConstant(~static_cast<intptr_t>(mask));
   // Ensure the {value} fits fully in the mask.
   CSA_ASSERT(this, WordEqual(WordAnd(encoded_value, inverted_mask),
                              IntPtrConstant(0)));
@@ -6424,7 +7110,8 @@ Node* CodeStubAssembler::UpdateWord(Node* word, Node* value, uint32_t shift,
 
 void CodeStubAssembler::SetCounter(StatsCounter* counter, int value) {
   if (FLAG_native_code_counters && counter->Enabled()) {
-    Node* counter_address = ExternalConstant(ExternalReference(counter));
+    Node* counter_address =
+        ExternalConstant(ExternalReference::Create(counter));
     StoreNoWriteBarrier(MachineRepresentation::kWord32, counter_address,
                         Int32Constant(value));
   }
@@ -6433,7 +7120,8 @@ void CodeStubAssembler::SetCounter(StatsCounter* counter, int value) {
 void CodeStubAssembler::IncrementCounter(StatsCounter* counter, int delta) {
   DCHECK_GT(delta, 0);
   if (FLAG_native_code_counters && counter->Enabled()) {
-    Node* counter_address = ExternalConstant(ExternalReference(counter));
+    Node* counter_address =
+        ExternalConstant(ExternalReference::Create(counter));
     Node* value = Load(MachineType::Int32(), counter_address);
     value = Int32Add(value, Int32Constant(delta));
     StoreNoWriteBarrier(MachineRepresentation::kWord32, counter_address, value);
@@ -6443,7 +7131,8 @@ void CodeStubAssembler::IncrementCounter(StatsCounter* counter, int delta) {
 void CodeStubAssembler::DecrementCounter(StatsCounter* counter, int delta) {
   DCHECK_GT(delta, 0);
   if (FLAG_native_code_counters && counter->Enabled()) {
-    Node* counter_address = ExternalConstant(ExternalReference(counter));
+    Node* counter_address =
+        ExternalConstant(ExternalReference::Create(counter));
     Node* value = Load(MachineType::Int32(), counter_address);
     value = Int32Sub(value, Int32Constant(delta));
     StoreNoWriteBarrier(MachineRepresentation::kWord32, counter_address, value);
@@ -6527,8 +7216,8 @@ void CodeStubAssembler::TryInternalizeString(
   DCHECK(var_index->rep() == MachineType::PointerRepresentation());
   DCHECK_EQ(var_internalized->rep(), MachineRepresentation::kTagged);
   CSA_SLOW_ASSERT(this, IsString(string));
-  Node* function = ExternalConstant(
-      ExternalReference::try_internalize_string_function(isolate()));
+  Node* function =
+      ExternalConstant(ExternalReference::try_internalize_string_function());
   Node* result = CallCFunction1(MachineType::AnyTagged(),
                                 MachineType::AnyTagged(), function, string);
   Label internalized(this);
@@ -6547,20 +7236,51 @@ void CodeStubAssembler::TryInternalizeString(
 }
 
 template <typename Dictionary>
-Node* CodeStubAssembler::EntryToIndex(Node* entry, int field_index) {
-  Node* entry_index = IntPtrMul(entry, IntPtrConstant(Dictionary::kEntrySize));
+TNode<IntPtrT> CodeStubAssembler::EntryToIndex(TNode<IntPtrT> entry,
+                                               int field_index) {
+  TNode<IntPtrT> entry_index =
+      IntPtrMul(entry, IntPtrConstant(Dictionary::kEntrySize));
   return IntPtrAdd(entry_index, IntPtrConstant(Dictionary::kElementsStartIndex +
                                                field_index));
 }
 
-template Node* CodeStubAssembler::EntryToIndex<NameDictionary>(Node*, int);
-template Node* CodeStubAssembler::EntryToIndex<GlobalDictionary>(Node*, int);
-template Node* CodeStubAssembler::EntryToIndex<NumberDictionary>(Node*, int);
+TNode<Uint32T> CodeStubAssembler::LoadDetailsByKeyIndex(
+    TNode<DescriptorArray> container, TNode<IntPtrT> key_index) {
+  const int kKeyToDetailsOffset =
+      (DescriptorArray::kEntryDetailsIndex - DescriptorArray::kEntryKeyIndex) *
+      kPointerSize;
+  return Unsigned(LoadAndUntagToWord32ArrayElement(
+      container, WeakFixedArray::kHeaderSize, key_index, kKeyToDetailsOffset));
+}
+
+TNode<Object> CodeStubAssembler::LoadValueByKeyIndex(
+    TNode<DescriptorArray> container, TNode<IntPtrT> key_index) {
+  const int kKeyToValueOffset =
+      (DescriptorArray::kEntryValueIndex - DescriptorArray::kEntryKeyIndex) *
+      kPointerSize;
+  return CAST(
+      LoadWeakFixedArrayElement(container, key_index, kKeyToValueOffset));
+}
+
+TNode<MaybeObject> CodeStubAssembler::LoadFieldTypeByKeyIndex(
+    TNode<DescriptorArray> container, TNode<IntPtrT> key_index) {
+  const int kKeyToValueOffset =
+      (DescriptorArray::kEntryValueIndex - DescriptorArray::kEntryKeyIndex) *
+      kPointerSize;
+  return LoadWeakFixedArrayElement(container, key_index, kKeyToValueOffset);
+}
+
+template TNode<IntPtrT> CodeStubAssembler::EntryToIndex<NameDictionary>(
+    TNode<IntPtrT>, int);
+template TNode<IntPtrT> CodeStubAssembler::EntryToIndex<GlobalDictionary>(
+    TNode<IntPtrT>, int);
+template TNode<IntPtrT> CodeStubAssembler::EntryToIndex<NumberDictionary>(
+    TNode<IntPtrT>, int);
 
 // This must be kept in sync with HashTableBase::ComputeCapacity().
 TNode<IntPtrT> CodeStubAssembler::HashTableComputeCapacity(
-    SloppyTNode<IntPtrT> at_least_space_for) {
-  Node* capacity = IntPtrRoundUpToPowerOfTwo32(
+    TNode<IntPtrT> at_least_space_for) {
+  TNode<IntPtrT> capacity = IntPtrRoundUpToPowerOfTwo32(
       IntPtrAdd(at_least_space_for, WordShr(at_least_space_for, 1)));
   return IntPtrMax(capacity, IntPtrConstant(HashTableBase::kMinCapacity));
 }
@@ -6589,85 +7309,73 @@ TNode<IntPtrT> CodeStubAssembler::IntPtrMin(SloppyTNode<IntPtrT> left,
                                  right);
 }
 
-template <class Dictionary>
-Node* CodeStubAssembler::GetNextEnumerationIndex(Node* dictionary) {
-  return LoadFixedArrayElement(dictionary,
-                               Dictionary::kNextEnumerationIndexIndex);
-}
-
-template <class Dictionary>
-void CodeStubAssembler::SetNextEnumerationIndex(Node* dictionary,
-                                                Node* next_enum_index_smi) {
-  StoreFixedArrayElement(dictionary, Dictionary::kNextEnumerationIndexIndex,
-                         next_enum_index_smi, SKIP_WRITE_BARRIER);
-}
-
 template <>
-Node* CodeStubAssembler::LoadName<NameDictionary>(Node* key) {
+TNode<HeapObject> CodeStubAssembler::LoadName<NameDictionary>(
+    TNode<HeapObject> key) {
   CSA_ASSERT(this, Word32Or(IsTheHole(key), IsName(key)));
   return key;
 }
 
 template <>
-Node* CodeStubAssembler::LoadName<GlobalDictionary>(Node* key) {
-  CSA_ASSERT(this, IsPropertyCell(key));
-  CSA_ASSERT(this, IsNotTheHole(key));
-  return LoadObjectField(key, PropertyCell::kNameOffset);
+TNode<HeapObject> CodeStubAssembler::LoadName<GlobalDictionary>(
+    TNode<HeapObject> key) {
+  TNode<PropertyCell> property_cell = CAST(key);
+  return CAST(LoadObjectField(property_cell, PropertyCell::kNameOffset));
 }
 
 template <typename Dictionary>
-void CodeStubAssembler::NameDictionaryLookup(Node* dictionary,
-                                             Node* unique_name, Label* if_found,
-                                             Variable* var_name_index,
-                                             Label* if_not_found,
-                                             int inlined_probes,
-                                             LookupMode mode) {
-  CSA_ASSERT(this, IsDictionary(dictionary));
+void CodeStubAssembler::NameDictionaryLookup(
+    TNode<Dictionary> dictionary, TNode<Name> unique_name, Label* if_found,
+    TVariable<IntPtrT>* var_name_index, Label* if_not_found, int inlined_probes,
+    LookupMode mode) {
+  static_assert(std::is_same<Dictionary, NameDictionary>::value ||
+                    std::is_same<Dictionary, GlobalDictionary>::value,
+                "Unexpected NameDictionary");
   DCHECK_EQ(MachineType::PointerRepresentation(), var_name_index->rep());
   DCHECK_IMPLIES(mode == kFindInsertionIndex,
                  inlined_probes == 0 && if_found == nullptr);
   Comment("NameDictionaryLookup");
 
-  Node* capacity = SmiUntag(GetCapacity<Dictionary>(dictionary));
-  Node* mask = IntPtrSub(capacity, IntPtrConstant(1));
-  Node* hash = ChangeUint32ToWord(LoadNameHash(unique_name));
+  TNode<IntPtrT> capacity = SmiUntag(GetCapacity<Dictionary>(dictionary));
+  TNode<WordT> mask = IntPtrSub(capacity, IntPtrConstant(1));
+  TNode<WordT> hash = ChangeUint32ToWord(LoadNameHash(unique_name));
 
   // See Dictionary::FirstProbe().
-  Node* count = IntPtrConstant(0);
-  Node* entry = WordAnd(hash, mask);
+  TNode<IntPtrT> count = IntPtrConstant(0);
+  TNode<IntPtrT> entry = Signed(WordAnd(hash, mask));
   Node* undefined = UndefinedConstant();
 
   for (int i = 0; i < inlined_probes; i++) {
-    Node* index = EntryToIndex<Dictionary>(entry);
-    var_name_index->Bind(index);
+    TNode<IntPtrT> index = EntryToIndex<Dictionary>(entry);
+    *var_name_index = index;
 
-    Node* current = LoadFixedArrayElement(dictionary, index);
+    TNode<HeapObject> current = CAST(LoadFixedArrayElement(dictionary, index));
     GotoIf(WordEqual(current, undefined), if_not_found);
     current = LoadName<Dictionary>(current);
     GotoIf(WordEqual(current, unique_name), if_found);
 
     // See Dictionary::NextProbe().
     count = IntPtrConstant(i + 1);
-    entry = WordAnd(IntPtrAdd(entry, count), mask);
+    entry = Signed(WordAnd(IntPtrAdd(entry, count), mask));
   }
   if (mode == kFindInsertionIndex) {
     // Appease the variable merging algorithm for "Goto(&loop)" below.
-    var_name_index->Bind(IntPtrConstant(0));
+    *var_name_index = IntPtrConstant(0);
   }
 
-  VARIABLE(var_count, MachineType::PointerRepresentation(), count);
-  VARIABLE(var_entry, MachineType::PointerRepresentation(), entry);
+  TVARIABLE(IntPtrT, var_count, count);
+  TVARIABLE(IntPtrT, var_entry, entry);
   Variable* loop_vars[] = {&var_count, &var_entry, var_name_index};
   Label loop(this, 3, loop_vars);
   Goto(&loop);
   BIND(&loop);
   {
-    Node* entry = var_entry.value();
+    TNode<IntPtrT> entry = var_entry.value();
 
-    Node* index = EntryToIndex<Dictionary>(entry);
-    var_name_index->Bind(index);
+    TNode<IntPtrT> index = EntryToIndex<Dictionary>(entry);
+    *var_name_index = index;
 
-    Node* current = LoadFixedArrayElement(dictionary, index);
+    TNode<HeapObject> current = CAST(LoadFixedArrayElement(dictionary, index));
     GotoIf(WordEqual(current, undefined), if_not_found);
     if (mode == kFindExisting) {
       current = LoadName<Dictionary>(current);
@@ -6679,18 +7387,20 @@ void CodeStubAssembler::NameDictionaryLookup(Node* dictionary,
 
     // See Dictionary::NextProbe().
     Increment(&var_count);
-    entry = WordAnd(IntPtrAdd(entry, var_count.value()), mask);
+    entry = Signed(WordAnd(IntPtrAdd(entry, var_count.value()), mask));
 
-    var_entry.Bind(entry);
+    var_entry = entry;
     Goto(&loop);
   }
 }
 
 // Instantiate template methods to workaround GCC compilation issue.
 template void CodeStubAssembler::NameDictionaryLookup<NameDictionary>(
-    Node*, Node*, Label*, Variable*, Label*, int, LookupMode);
+    TNode<NameDictionary>, TNode<Name>, Label*, TVariable<IntPtrT>*, Label*,
+    int, LookupMode);
 template void CodeStubAssembler::NameDictionaryLookup<GlobalDictionary>(
-    Node*, Node*, Label*, Variable*, Label*, int, LookupMode);
+    TNode<GlobalDictionary>, TNode<Name>, Label*, TVariable<IntPtrT>*, Label*,
+    int, LookupMode);
 
 Node* CodeStubAssembler::ComputeIntegerHash(Node* key) {
   return ComputeIntegerHash(key, IntPtrConstant(kZeroHashSeed));
@@ -6710,39 +7420,38 @@ Node* CodeStubAssembler::ComputeIntegerHash(Node* key, Node* seed) {
   return Word32And(hash, Int32Constant(0x3FFFFFFF));
 }
 
-void CodeStubAssembler::NumberDictionaryLookup(Node* dictionary,
-                                               Node* intptr_index,
-                                               Label* if_found,
-                                               Variable* var_entry,
-                                               Label* if_not_found) {
+void CodeStubAssembler::NumberDictionaryLookup(
+    TNode<NumberDictionary> dictionary, TNode<IntPtrT> intptr_index,
+    Label* if_found, TVariable<IntPtrT>* var_entry, Label* if_not_found) {
   CSA_ASSERT(this, IsNumberDictionary(dictionary));
   DCHECK_EQ(MachineType::PointerRepresentation(), var_entry->rep());
   Comment("NumberDictionaryLookup");
 
-  Node* capacity = SmiUntag(GetCapacity<NumberDictionary>(dictionary));
-  Node* mask = IntPtrSub(capacity, IntPtrConstant(1));
+  TNode<IntPtrT> capacity = SmiUntag(GetCapacity<NumberDictionary>(dictionary));
+  TNode<WordT> mask = IntPtrSub(capacity, IntPtrConstant(1));
 
-  Node* int32_seed = HashSeed();
-  Node* hash = ChangeUint32ToWord(ComputeIntegerHash(intptr_index, int32_seed));
+  TNode<Int32T> int32_seed = HashSeed();
+  TNode<WordT> hash =
+      ChangeUint32ToWord(ComputeIntegerHash(intptr_index, int32_seed));
   Node* key_as_float64 = RoundIntPtrToFloat64(intptr_index);
 
   // See Dictionary::FirstProbe().
-  Node* count = IntPtrConstant(0);
-  Node* entry = WordAnd(hash, mask);
+  TNode<IntPtrT> count = IntPtrConstant(0);
+  TNode<IntPtrT> entry = Signed(WordAnd(hash, mask));
 
   Node* undefined = UndefinedConstant();
   Node* the_hole = TheHoleConstant();
 
-  VARIABLE(var_count, MachineType::PointerRepresentation(), count);
+  TVARIABLE(IntPtrT, var_count, count);
   Variable* loop_vars[] = {&var_count, var_entry};
   Label loop(this, 2, loop_vars);
-  var_entry->Bind(entry);
+  *var_entry = entry;
   Goto(&loop);
   BIND(&loop);
   {
-    Node* entry = var_entry->value();
+    TNode<IntPtrT> entry = var_entry->value();
 
-    Node* index = EntryToIndex<NumberDictionary>(entry);
+    TNode<IntPtrT> index = EntryToIndex<NumberDictionary>(entry);
     Node* current = LoadFixedArrayElement(dictionary, index);
     GotoIf(WordEqual(current, undefined), if_not_found);
     Label next_probe(this);
@@ -6767,22 +7476,69 @@ void CodeStubAssembler::NumberDictionaryLookup(Node* dictionary,
     BIND(&next_probe);
     // See Dictionary::NextProbe().
     Increment(&var_count);
-    entry = WordAnd(IntPtrAdd(entry, var_count.value()), mask);
+    entry = Signed(WordAnd(IntPtrAdd(entry, var_count.value()), mask));
 
-    var_entry->Bind(entry);
+    *var_entry = entry;
     Goto(&loop);
   }
 }
 
+TNode<Object> CodeStubAssembler::BasicLoadNumberDictionaryElement(
+    TNode<NumberDictionary> dictionary, TNode<IntPtrT> intptr_index,
+    Label* not_data, Label* if_hole) {
+  TVARIABLE(IntPtrT, var_entry);
+  Label if_found(this);
+  NumberDictionaryLookup(dictionary, intptr_index, &if_found, &var_entry,
+                         if_hole);
+  BIND(&if_found);
+
+  // Check that the value is a data property.
+  TNode<IntPtrT> index = EntryToIndex<NumberDictionary>(var_entry.value());
+  TNode<Uint32T> details =
+      LoadDetailsByKeyIndex<NumberDictionary>(dictionary, index);
+  TNode<Uint32T> kind = DecodeWord32<PropertyDetails::KindField>(details);
+  // TODO(jkummerow): Support accessors without missing?
+  GotoIfNot(Word32Equal(kind, Int32Constant(kData)), not_data);
+  // Finally, load the value.
+  return LoadValueByKeyIndex<NumberDictionary>(dictionary, index);
+}
+
+void CodeStubAssembler::BasicStoreNumberDictionaryElement(
+    TNode<NumberDictionary> dictionary, TNode<IntPtrT> intptr_index,
+    TNode<Object> value, Label* not_data, Label* if_hole, Label* read_only) {
+  TVARIABLE(IntPtrT, var_entry);
+  Label if_found(this);
+  NumberDictionaryLookup(dictionary, intptr_index, &if_found, &var_entry,
+                         if_hole);
+  BIND(&if_found);
+
+  // Check that the value is a data property.
+  TNode<IntPtrT> index = EntryToIndex<NumberDictionary>(var_entry.value());
+  TNode<Uint32T> details =
+      LoadDetailsByKeyIndex<NumberDictionary>(dictionary, index);
+  TNode<Uint32T> kind = DecodeWord32<PropertyDetails::KindField>(details);
+  // TODO(jkummerow): Support accessors without missing?
+  GotoIfNot(Word32Equal(kind, Int32Constant(kData)), not_data);
+
+  // Check that the property is writeable.
+  GotoIf(IsSetWord32(details, PropertyDetails::kAttributesReadOnlyMask),
+         read_only);
+
+  // Finally, store the value.
+  StoreValueByKeyIndex<NumberDictionary>(dictionary, index, value);
+}
+
 template <class Dictionary>
-void CodeStubAssembler::FindInsertionEntry(Node* dictionary, Node* key,
-                                           Variable* var_key_index) {
+void CodeStubAssembler::FindInsertionEntry(TNode<Dictionary> dictionary,
+                                           TNode<Name> key,
+                                           TVariable<IntPtrT>* var_key_index) {
   UNREACHABLE();
 }
 
 template <>
 void CodeStubAssembler::FindInsertionEntry<NameDictionary>(
-    Node* dictionary, Node* key, Variable* var_key_index) {
+    TNode<NameDictionary> dictionary, TNode<Name> key,
+    TVariable<IntPtrT>* var_key_index) {
   Label done(this);
   NameDictionaryLookup<NameDictionary>(dictionary, key, nullptr, var_key_index,
                                        &done, 0, kFindInsertionIndex);
@@ -6790,18 +7546,17 @@ void CodeStubAssembler::FindInsertionEntry<NameDictionary>(
 }
 
 template <class Dictionary>
-void CodeStubAssembler::InsertEntry(Node* dictionary, Node* key, Node* value,
-                                    Node* index, Node* enum_index) {
+void CodeStubAssembler::InsertEntry(TNode<Dictionary> dictionary,
+                                    TNode<Name> key, TNode<Object> value,
+                                    TNode<IntPtrT> index,
+                                    TNode<Smi> enum_index) {
   UNREACHABLE();  // Use specializations instead.
 }
 
 template <>
-void CodeStubAssembler::InsertEntry<NameDictionary>(Node* dictionary,
-                                                    Node* name, Node* value,
-                                                    Node* index,
-                                                    Node* enum_index) {
-  CSA_SLOW_ASSERT(this, IsDictionary(dictionary));
-
+void CodeStubAssembler::InsertEntry<NameDictionary>(
+    TNode<NameDictionary> dictionary, TNode<Name> name, TNode<Object> value,
+    TNode<IntPtrT> index, TNode<Smi> enum_index) {
   // Store name and value.
   StoreFixedArrayElement(dictionary, index, name);
   StoreValueByKeyIndex<NameDictionary>(dictionary, index, value);
@@ -6812,15 +7567,14 @@ void CodeStubAssembler::InsertEntry<NameDictionary>(Node* dictionary,
       SmiShl(enum_index, PropertyDetails::DictionaryStorageField::kShift);
   // We OR over the actual index below, so we expect the initial value to be 0.
   DCHECK_EQ(0, d.dictionary_index());
-  VARIABLE(var_details, MachineRepresentation::kTaggedSigned,
-           SmiOr(SmiConstant(d.AsSmi()), enum_index));
+  TVARIABLE(Smi, var_details, SmiOr(SmiConstant(d.AsSmi()), enum_index));
 
   // Private names must be marked non-enumerable.
   Label not_private(this, &var_details);
   GotoIfNot(IsPrivateSymbol(name), &not_private);
-  Node* dont_enum =
+  TNode<Smi> dont_enum =
       SmiShl(SmiConstant(DONT_ENUM), PropertyDetails::AttributesField::kShift);
-  var_details.Bind(SmiOr(var_details.value(), dont_enum));
+  var_details = SmiOr(var_details.value(), dont_enum);
   Goto(&not_private);
   BIND(&not_private);
 
@@ -6830,34 +7584,33 @@ void CodeStubAssembler::InsertEntry<NameDictionary>(Node* dictionary,
 }
 
 template <>
-void CodeStubAssembler::InsertEntry<GlobalDictionary>(Node* dictionary,
-                                                      Node* key, Node* value,
-                                                      Node* index,
-                                                      Node* enum_index) {
+void CodeStubAssembler::InsertEntry<GlobalDictionary>(
+    TNode<GlobalDictionary> dictionary, TNode<Name> key, TNode<Object> value,
+    TNode<IntPtrT> index, TNode<Smi> enum_index) {
   UNIMPLEMENTED();
 }
 
 template <class Dictionary>
-void CodeStubAssembler::Add(Node* dictionary, Node* key, Node* value,
-                            Label* bailout) {
-  CSA_SLOW_ASSERT(this, IsDictionary(dictionary));
-  Node* capacity = GetCapacity<Dictionary>(dictionary);
-  Node* nof = GetNumberOfElements<Dictionary>(dictionary);
-  Node* new_nof = SmiAdd(nof, SmiConstant(1));
+void CodeStubAssembler::Add(TNode<Dictionary> dictionary, TNode<Name> key,
+                            TNode<Object> value, Label* bailout) {
+  CSA_ASSERT(this, Word32BinaryNot(IsEmptyPropertyDictionary(dictionary)));
+  TNode<Smi> capacity = GetCapacity<Dictionary>(dictionary);
+  TNode<Smi> nof = GetNumberOfElements<Dictionary>(dictionary);
+  TNode<Smi> new_nof = SmiAdd(nof, SmiConstant(1));
   // Require 33% to still be free after adding additional_elements.
   // Computing "x + (x >> 1)" on a Smi x does not return a valid Smi!
   // But that's OK here because it's only used for a comparison.
-  Node* required_capacity_pseudo_smi = SmiAdd(new_nof, SmiShr(new_nof, 1));
+  TNode<Smi> required_capacity_pseudo_smi = SmiAdd(new_nof, SmiShr(new_nof, 1));
   GotoIf(SmiBelow(capacity, required_capacity_pseudo_smi), bailout);
   // Require rehashing if more than 50% of free elements are deleted elements.
-  Node* deleted = GetNumberOfDeletedElements<Dictionary>(dictionary);
+  TNode<Smi> deleted = GetNumberOfDeletedElements<Dictionary>(dictionary);
   CSA_ASSERT(this, SmiAbove(capacity, new_nof));
-  Node* half_of_free_elements = SmiShr(SmiSub(capacity, new_nof), 1);
+  TNode<Smi> half_of_free_elements = SmiShr(SmiSub(capacity, new_nof), 1);
   GotoIf(SmiAbove(deleted, half_of_free_elements), bailout);
 
-  Node* enum_index = GetNextEnumerationIndex<Dictionary>(dictionary);
-  Node* new_enum_index = SmiAdd(enum_index, SmiConstant(1));
-  Node* max_enum_index =
+  TNode<Smi> enum_index = GetNextEnumerationIndex<Dictionary>(dictionary);
+  TNode<Smi> new_enum_index = SmiAdd(enum_index, SmiConstant(1));
+  TNode<Smi> max_enum_index =
       SmiConstant(PropertyDetails::DictionaryStorageField::kMax);
   GotoIf(SmiAbove(new_enum_index, max_enum_index), bailout);
 
@@ -6867,13 +7620,14 @@ void CodeStubAssembler::Add(Node* dictionary, Node* key, Node* value,
   SetNextEnumerationIndex<Dictionary>(dictionary, new_enum_index);
   SetNumberOfElements<Dictionary>(dictionary, new_nof);
 
-  VARIABLE(var_key_index, MachineType::PointerRepresentation());
+  TVARIABLE(IntPtrT, var_key_index);
   FindInsertionEntry<Dictionary>(dictionary, key, &var_key_index);
   InsertEntry<Dictionary>(dictionary, key, value, var_key_index.value(),
                           enum_index);
 }
 
-template void CodeStubAssembler::Add<NameDictionary>(Node*, Node*, Node*,
+template void CodeStubAssembler::Add<NameDictionary>(TNode<NameDictionary>,
+                                                     TNode<Name>, TNode<Object>,
                                                      Label*);
 
 template <typename Array>
@@ -6883,6 +7637,9 @@ void CodeStubAssembler::LookupLinear(TNode<Name> unique_name,
                                      Label* if_found,
                                      TVariable<IntPtrT>* var_name_index,
                                      Label* if_not_found) {
+  static_assert(std::is_base_of<FixedArray, Array>::value ||
+                    std::is_base_of<WeakFixedArray, Array>::value,
+                "T must be a descendant of FixedArray or a WeakFixedArray");
   Comment("LookupLinear");
   TNode<IntPtrT> first_inclusive = IntPtrConstant(Array::ToKeyIndex(0));
   TNode<IntPtrT> factor = IntPtrConstant(Array::kEntrySize);
@@ -6892,8 +7649,9 @@ void CodeStubAssembler::LookupLinear(TNode<Name> unique_name,
 
   BuildFastLoop(last_exclusive, first_inclusive,
                 [=](SloppyTNode<IntPtrT> name_index) {
-                  TNode<Name> candidate_name =
-                      CAST(LoadFixedArrayElement(array, name_index));
+                  TNode<MaybeObject> element =
+                      LoadArrayElement(array, Array::kHeaderSize, name_index);
+                  TNode<Name> candidate_name = CAST(element);
                   *var_name_index = name_index;
                   GotoIf(WordEqual(candidate_name, unique_name), if_found);
                 },
@@ -6904,20 +7662,21 @@ void CodeStubAssembler::LookupLinear(TNode<Name> unique_name,
 template <>
 TNode<Uint32T> CodeStubAssembler::NumberOfEntries<DescriptorArray>(
     TNode<DescriptorArray> descriptors) {
-  return Unsigned(LoadAndUntagToWord32FixedArrayElement(
-      descriptors, IntPtrConstant(DescriptorArray::kDescriptorLengthIndex)));
+  return Unsigned(LoadAndUntagToWord32ArrayElement(
+      descriptors, WeakFixedArray::kHeaderSize,
+      IntPtrConstant(DescriptorArray::kDescriptorLengthIndex)));
 }
 
 template <>
 TNode<Uint32T> CodeStubAssembler::NumberOfEntries<TransitionArray>(
     TNode<TransitionArray> transitions) {
-  TNode<IntPtrT> length = LoadAndUntagFixedArrayBaseLength(transitions);
+  TNode<IntPtrT> length = LoadAndUntagWeakFixedArrayLength(transitions);
   return Select<Uint32T>(
       UintPtrLessThan(length, IntPtrConstant(TransitionArray::kFirstIndex)),
       [=] { return Unsigned(Int32Constant(0)); },
       [=] {
-        return Unsigned(LoadAndUntagToWord32FixedArrayElement(
-            transitions,
+        return Unsigned(LoadAndUntagToWord32ArrayElement(
+            transitions, WeakFixedArray::kHeaderSize,
             IntPtrConstant(TransitionArray::kTransitionLengthIndex)));
       });
 }
@@ -6958,9 +7717,14 @@ TNode<Uint32T> CodeStubAssembler::GetSortedKeyIndex<TransitionArray>(
 template <typename Array>
 TNode<Name> CodeStubAssembler::GetKey(TNode<Array> array,
                                       TNode<Uint32T> entry_index) {
-  const int key_offset = DescriptorArray::ToKeyIndex(0) * kPointerSize;
-  return CAST(LoadFixedArrayElement(
-      array, EntryIndexToIndex<Array>(entry_index), key_offset));
+  static_assert(std::is_base_of<FixedArray, Array>::value ||
+                    std::is_base_of<WeakFixedArray, Array>::value,
+                "T must be a descendant of FixedArray or a TransitionArray");
+  const int key_offset = Array::ToKeyIndex(0) * kPointerSize;
+  TNode<MaybeObject> element =
+      LoadArrayElement(array, Array::kHeaderSize,
+                       EntryIndexToIndex<Array>(entry_index), key_offset);
+  return CAST(element);
 }
 
 template TNode<Name> CodeStubAssembler::GetKey<DescriptorArray>(
@@ -6971,9 +7735,9 @@ template TNode<Name> CodeStubAssembler::GetKey<TransitionArray>(
 TNode<Uint32T> CodeStubAssembler::DescriptorArrayGetDetails(
     TNode<DescriptorArray> descriptors, TNode<Uint32T> descriptor_number) {
   const int details_offset = DescriptorArray::ToDetailsIndex(0) * kPointerSize;
-  return Unsigned(LoadAndUntagToWord32FixedArrayElement(
-      descriptors, EntryIndexToIndex<DescriptorArray>(descriptor_number),
-      details_offset));
+  return Unsigned(LoadAndUntagToWord32ArrayElement(
+      descriptors, WeakFixedArray::kHeaderSize,
+      EntryIndexToIndex<DescriptorArray>(descriptor_number), details_offset));
 }
 
 template <typename Array>
@@ -7048,6 +7812,27 @@ void CodeStubAssembler::LookupBinary(TNode<Name> unique_name,
   }
 }
 
+void CodeStubAssembler::DescriptorArrayForEach(
+    VariableList& variable_list, TNode<Uint32T> start_descriptor,
+    TNode<Uint32T> end_descriptor, const ForEachDescriptorBodyFunction& body) {
+  TNode<IntPtrT> start_index =
+      IntPtrAdd(IntPtrConstant(DescriptorArray::ToKeyIndex(0)),
+                EntryIndexToIndex<DescriptorArray>(start_descriptor));
+
+  TNode<IntPtrT> end_index =
+      IntPtrAdd(IntPtrConstant(DescriptorArray::ToKeyIndex(0)),
+                EntryIndexToIndex<DescriptorArray>(end_descriptor));
+
+  BuildFastLoop(variable_list, start_index, end_index,
+                [=](Node* index) {
+                  TNode<UintPtrT> descriptor_key_index =
+                      TNode<UintPtrT>::UncheckedCast(index);
+                  body(descriptor_key_index);
+                },
+                DescriptorArray::kEntrySize, INTPTR_PARAMETERS,
+                IndexAdvanceMode::kPost);
+}
+
 void CodeStubAssembler::DescriptorLookup(
     SloppyTNode<Name> unique_name, SloppyTNode<DescriptorArray> descriptors,
     SloppyTNode<Uint32T> bitfield3, Label* if_found,
@@ -7096,19 +7881,22 @@ void CodeStubAssembler::Lookup(TNode<Name> unique_name, TNode<Array> array,
   }
 }
 
+TNode<BoolT> CodeStubAssembler::IsSimpleObjectMap(TNode<Map> map) {
+  uint32_t mask =
+      Map::HasNamedInterceptorBit::kMask | Map::IsAccessCheckNeededBit::kMask;
+  // !IsSpecialReceiverType && !IsNamedInterceptor && !IsAccessCheckNeeded
+  return Select<BoolT>(
+      IsSpecialReceiverInstanceType(LoadMapInstanceType(map)),
+      [=] { return Int32FalseConstant(); },
+      [=] { return IsClearWord32(LoadMapBitField(map), mask); });
+}
+
 void CodeStubAssembler::TryLookupPropertyInSimpleObject(
     TNode<JSObject> object, TNode<Map> map, TNode<Name> unique_name,
     Label* if_found_fast, Label* if_found_dict,
     TVariable<HeapObject>* var_meta_storage, TVariable<IntPtrT>* var_name_index,
     Label* if_not_found) {
-  CSA_ASSERT(
-      this,
-      Word32BinaryNot(IsSpecialReceiverInstanceType(LoadMapInstanceType(map))));
-
-  uint32_t mask =
-      Map::HasNamedInterceptorBit::kMask | Map::IsAccessCheckNeededBit::kMask;
-  CSA_ASSERT(this, Word32BinaryNot(IsSetWord32(LoadMapBitField(map), mask)));
-  USE(mask);
+  CSA_ASSERT(this, IsSimpleObjectMap(map));
 
   TNode<Uint32T> bit_field3 = LoadMapBitField3(map);
   Label if_isfastmap(this), if_isslowmap(this);
@@ -7202,27 +7990,23 @@ Node* CodeStubAssembler::GetMethod(Node* context, Node* object,
   return method;
 }
 
-void CodeStubAssembler::LoadPropertyFromFastObject(Node* object, Node* map,
-                                                   Node* descriptors,
-                                                   Node* name_index,
-                                                   Variable* var_details,
-                                                   Variable* var_value) {
+void CodeStubAssembler::LoadPropertyFromFastObject(
+    Node* object, Node* map, TNode<DescriptorArray> descriptors,
+    Node* name_index, Variable* var_details, Variable* var_value) {
   DCHECK_EQ(MachineRepresentation::kWord32, var_details->rep());
   DCHECK_EQ(MachineRepresentation::kTagged, var_value->rep());
 
   Node* details =
-      LoadDetailsByKeyIndex<DescriptorArray>(descriptors, name_index);
+      LoadDetailsByKeyIndex(descriptors, UncheckedCast<IntPtrT>(name_index));
   var_details->Bind(details);
 
   LoadPropertyFromFastObject(object, map, descriptors, name_index, details,
                              var_value);
 }
 
-void CodeStubAssembler::LoadPropertyFromFastObject(Node* object, Node* map,
-                                                   Node* descriptors,
-                                                   Node* name_index,
-                                                   Node* details,
-                                                   Variable* var_value) {
+void CodeStubAssembler::LoadPropertyFromFastObject(
+    Node* object, Node* map, TNode<DescriptorArray> descriptors,
+    Node* name_index, Node* details, Variable* var_value) {
   Comment("[ LoadPropertyFromFastObject");
 
   Node* location = DecodeWord32<PropertyDetails::LocationField>(details);
@@ -7277,7 +8061,7 @@ void CodeStubAssembler::LoadPropertyFromFastObject(Node* object, Node* map,
       Comment("if_backing_store");
       Node* properties = LoadFastProperties(object);
       field_index = IntPtrSub(field_index, instance_size_in_words);
-      Node* value = LoadFixedArrayElement(properties, field_index);
+      Node* value = LoadPropertyArrayElement(properties, field_index);
 
       Label if_double(this), if_tagged(this);
       Branch(Word32NotEqual(representation,
@@ -7305,7 +8089,7 @@ void CodeStubAssembler::LoadPropertyFromFastObject(Node* object, Node* map,
   BIND(&if_in_descriptor);
   {
     var_value->Bind(
-        LoadValueByKeyIndex<DescriptorArray>(descriptors, name_index));
+        LoadValueByKeyIndex(descriptors, UncheckedCast<IntPtrT>(name_index)));
     Goto(&done);
   }
   BIND(&done);
@@ -7318,7 +8102,7 @@ void CodeStubAssembler::LoadPropertyFromNameDictionary(Node* dictionary,
                                                        Variable* var_details,
                                                        Variable* var_value) {
   Comment("LoadPropertyFromNameDictionary");
-  CSA_ASSERT(this, IsDictionary(dictionary));
+  CSA_ASSERT(this, IsNameDictionary(dictionary));
 
   var_details->Bind(
       LoadDetailsByKeyIndex<NameDictionary>(dictionary, name_index));
@@ -7333,7 +8117,7 @@ void CodeStubAssembler::LoadPropertyFromGlobalDictionary(Node* dictionary,
                                                          Variable* var_value,
                                                          Label* if_deleted) {
   Comment("[ LoadPropertyFromGlobalDictionary");
-  CSA_ASSERT(this, IsDictionary(dictionary));
+  CSA_ASSERT(this, IsGlobalDictionary(dictionary));
 
   Node* property_cell = LoadFixedArrayElement(dictionary, name_index);
   CSA_ASSERT(this, IsPropertyCell(property_cell));
@@ -7482,14 +8266,14 @@ void CodeStubAssembler::TryGetOwnProperty(
   if (!var_details) {
     var_details = &local_var_details;
   }
-  Label if_found(this, {var_value, var_details});
+  Label if_found(this);
 
   TryLookupProperty(object, map, instance_type, unique_name, &if_found_fast,
                     &if_found_dict, &if_found_global, &var_meta_storage,
                     &var_entry, if_not_found, if_bailout);
   BIND(&if_found_fast);
   {
-    Node* descriptors = var_meta_storage.value();
+    TNode<DescriptorArray> descriptors = CAST(var_meta_storage.value());
     Node* name_index = var_entry.value();
 
     LoadPropertyFromFastObject(object, map, descriptors, name_index,
@@ -7527,9 +8311,10 @@ void CodeStubAssembler::TryGetOwnProperty(
 }
 
 void CodeStubAssembler::TryLookupElement(Node* object, Node* map,
-                                         Node* instance_type,
-                                         Node* intptr_index, Label* if_found,
-                                         Label* if_absent, Label* if_not_found,
+                                         SloppyTNode<Int32T> instance_type,
+                                         SloppyTNode<IntPtrT> intptr_index,
+                                         Label* if_found, Label* if_absent,
+                                         Label* if_not_found,
                                          Label* if_bailout) {
   // Handle special objects in runtime.
   GotoIf(IsSpecialReceiverInstanceType(instance_type), if_bailout);
@@ -7620,8 +8405,8 @@ void CodeStubAssembler::TryLookupElement(Node* object, Node* map,
     // Negative keys must be converted to property names.
     GotoIf(IntPtrLessThan(intptr_index, IntPtrConstant(0)), if_bailout);
 
-    VARIABLE(var_entry, MachineType::PointerRepresentation());
-    Node* elements = LoadElements(object);
+    TVARIABLE(IntPtrT, var_entry);
+    TNode<NumberDictionary> elements = CAST(LoadElements(object));
     NumberDictionaryLookup(elements, intptr_index, if_found, &var_entry,
                            if_not_found);
   }
@@ -7648,8 +8433,7 @@ void CodeStubAssembler::TryLookupElement(Node* object, Node* map,
     Node* buffer = LoadObjectField(object, JSArrayBufferView::kBufferOffset);
     GotoIf(IsDetachedBuffer(buffer), if_absent);
 
-    Node* length = TryToIntptr(
-        LoadObjectField(object, JSTypedArray::kLengthOffset), if_bailout);
+    Node* length = SmiUntag(LoadTypedArrayLength(CAST(object)));
     Branch(UintPtrLessThan(intptr_index, length), if_found, if_absent);
   }
   BIND(&if_oob);
@@ -7818,7 +8602,7 @@ Node* CodeStubAssembler::HasInPrototypeChain(Node* context, Node* object,
     // Check if we can determine the prototype directly from the {object_map}.
     Label if_objectisdirect(this), if_objectisspecial(this, Label::kDeferred);
     Node* object_map = var_object_map.value();
-    Node* object_instance_type = LoadMapInstanceType(object_map);
+    TNode<Int32T> object_instance_type = LoadMapInstanceType(object_map);
     Branch(IsSpecialReceiverInstanceType(object_instance_type),
            &if_objectisspecial, &if_objectisdirect);
     BIND(&if_objectisspecial);
@@ -7938,6 +8722,7 @@ TNode<IntPtrT> CodeStubAssembler::ElementOffsetFromIndex(Node* index_node,
                                                          ElementsKind kind,
                                                          ParameterMode mode,
                                                          int base_size) {
+  CSA_SLOW_ASSERT(this, MatchesParameterMode(index_node, mode));
   int element_size_shift = ElementsKindToShiftSize(kind);
   int element_size = 1 << element_size_shift;
   int const kSmiShiftBits = kSmiShiftSize + kSmiTagSize;
@@ -7966,16 +8751,33 @@ TNode<IntPtrT> CodeStubAssembler::ElementOffsetFromIndex(Node* index_node,
   return IntPtrAdd(IntPtrConstant(base_size), Signed(shifted_index));
 }
 
-Node* CodeStubAssembler::LoadFeedbackVector(Node* closure) {
-  Node* feedback_cell =
-      LoadObjectField(closure, JSFunction::kFeedbackCellOffset);
-  CSA_ASSERT(this, IsFeedbackCell(feedback_cell));
-  return LoadObjectField(feedback_cell, FeedbackCell::kValueOffset);
+TNode<BoolT> CodeStubAssembler::IsOffsetInBounds(SloppyTNode<IntPtrT> offset,
+                                                 SloppyTNode<IntPtrT> length,
+                                                 int header_size,
+                                                 ElementsKind kind) {
+  // Make sure we point to the last field.
+  int element_size = 1 << ElementsKindToShiftSize(kind);
+  int correction = header_size - kHeapObjectTag - element_size;
+  TNode<IntPtrT> last_offset =
+      ElementOffsetFromIndex(length, kind, INTPTR_PARAMETERS, correction);
+  return IntPtrLessThanOrEqual(offset, last_offset);
 }
 
-Node* CodeStubAssembler::LoadFeedbackVectorForStub() {
-  Node* function =
-      LoadFromParentFrame(JavaScriptFrameConstants::kFunctionOffset);
+TNode<FeedbackVector> CodeStubAssembler::LoadFeedbackVector(
+    SloppyTNode<JSFunction> closure, Label* if_undefined) {
+  TNode<FeedbackCell> feedback_cell =
+      CAST(LoadObjectField(closure, JSFunction::kFeedbackCellOffset));
+  TNode<Object> maybe_vector =
+      LoadObjectField(feedback_cell, FeedbackCell::kValueOffset);
+  if (if_undefined) {
+    GotoIf(IsUndefined(maybe_vector), if_undefined);
+  }
+  return CAST(maybe_vector);
+}
+
+TNode<FeedbackVector> CodeStubAssembler::LoadFeedbackVectorForStub() {
+  TNode<JSFunction> function =
+      CAST(LoadFromParentFrame(JavaScriptFrameConstants::kFunctionOffset));
   return LoadFeedbackVector(function);
 }
 
@@ -7984,8 +8786,10 @@ void CodeStubAssembler::UpdateFeedback(Node* feedback, Node* feedback_vector,
   // This method is used for binary op and compare feedback. These
   // vector nodes are initialized with a smi 0, so we can simply OR
   // our new feedback in place.
-  Node* previous_feedback = LoadFeedbackVectorSlot(feedback_vector, slot_id);
-  Node* combined_feedback = SmiOr(previous_feedback, feedback);
+  TNode<MaybeObject> feedback_element =
+      LoadFeedbackVectorSlot(feedback_vector, slot_id);
+  TNode<Smi> previous_feedback = CAST(feedback_element);
+  TNode<Smi> combined_feedback = SmiOr(previous_feedback, CAST(feedback));
   Label end(this);
 
   GotoIf(SmiEqual(previous_feedback, combined_feedback), &end);
@@ -8025,13 +8829,14 @@ void CodeStubAssembler::CombineFeedback(Variable* existing_feedback,
                                         int feedback) {
   if (existing_feedback == nullptr) return;
   existing_feedback->Bind(
-      SmiOr(existing_feedback->value(), SmiConstant(feedback)));
+      SmiOr(CAST(existing_feedback->value()), SmiConstant(feedback)));
 }
 
 void CodeStubAssembler::CombineFeedback(Variable* existing_feedback,
                                         Node* feedback) {
   if (existing_feedback == nullptr) return;
-  existing_feedback->Bind(SmiOr(existing_feedback->value(), feedback));
+  existing_feedback->Bind(
+      SmiOr(CAST(existing_feedback->value()), CAST(feedback)));
 }
 
 void CodeStubAssembler::CheckForAssociatedProtector(Node* name,
@@ -8227,18 +9032,17 @@ void CodeStubAssembler::StoreElement(Node* elements, ElementsKind kind,
                  Word32Equal(value, Word32And(Int32Constant(0xFF), value)));
     }
     Node* offset = ElementOffsetFromIndex(index, kind, mode, 0);
+    // TODO(cbruni): Add OOB check once typed.
     MachineRepresentation rep = ElementsKindToMachineRepresentation(kind);
     StoreNoWriteBarrier(rep, elements, offset, value);
     return;
-  }
-
-  WriteBarrierMode barrier_mode =
-      IsSmiElementsKind(kind) ? SKIP_WRITE_BARRIER : UPDATE_WRITE_BARRIER;
-  if (IsDoubleElementsKind(kind)) {
+  } else if (IsDoubleElementsKind(kind)) {
     // Make sure we do not store signalling NaNs into double arrays.
     value = Float64SilenceNaN(value);
     StoreFixedDoubleArrayElement(elements, index, value, mode);
   } else {
+    WriteBarrierMode barrier_mode =
+        IsSmiElementsKind(kind) ? SKIP_WRITE_BARRIER : UPDATE_WRITE_BARRIER;
     StoreFixedArrayElement(elements, index, value, barrier_mode, 0, mode);
   }
 }
@@ -8293,6 +9097,9 @@ Node* CodeStubAssembler::PrepareValueForWriteToTypedArray(
     case FLOAT64_ELEMENTS:
       rep = MachineRepresentation::kFloat64;
       break;
+    case BIGINT64_ELEMENTS:
+    case BIGUINT64_ELEMENTS:
+      return ToBigInt(context, input);
     default:
       UNREACHABLE();
   }
@@ -8362,7 +9169,22 @@ void CodeStubAssembler::EmitBigTypedArrayElementStore(
     TNode<JSTypedArray> object, TNode<FixedTypedArrayBase> elements,
     TNode<IntPtrT> intptr_key, TNode<Object> value, TNode<Context> context,
     Label* opt_if_neutered) {
+  if (opt_if_neutered != nullptr) {
+    // Check if buffer has been neutered.
+    Node* buffer = LoadObjectField(object, JSArrayBufferView::kBufferOffset);
+    GotoIf(IsDetachedBuffer(buffer), opt_if_neutered);
+  }
+
   TNode<BigInt> bigint_value = ToBigInt(context, value);
+  TNode<RawPtrT> backing_store = LoadFixedTypedArrayBackingStore(elements);
+  TNode<IntPtrT> offset = ElementOffsetFromIndex(intptr_key, BIGINT64_ELEMENTS,
+                                                 INTPTR_PARAMETERS, 0);
+  EmitBigTypedArrayElementStore(elements, backing_store, offset, bigint_value);
+}
+
+void CodeStubAssembler::EmitBigTypedArrayElementStore(
+    TNode<FixedTypedArrayBase> elements, TNode<RawPtrT> backing_store,
+    TNode<IntPtrT> offset, TNode<BigInt> bigint_value) {
   TNode<WordT> bitfield = LoadBigIntBitfield(bigint_value);
   TNode<UintPtrT> length = DecodeWord<BigIntBase::LengthBits>(bitfield);
   TNode<UintPtrT> sign = DecodeWord<BigIntBase::SignBits>(bitfield);
@@ -8391,17 +9213,14 @@ void CodeStubAssembler::EmitBigTypedArrayElementStore(
   }
   var_low = Unsigned(IntPtrSub(IntPtrConstant(0), var_low.value()));
   Goto(&do_store);
-
   BIND(&do_store);
-  if (opt_if_neutered != nullptr) {
-    // Check if buffer has been neutered.
-    Node* buffer = LoadObjectField(object, JSArrayBufferView::kBufferOffset);
-    GotoIf(IsDetachedBuffer(buffer), opt_if_neutered);
-  }
 
-  Node* backing_store = LoadFixedTypedArrayBackingStore(elements);
-  Node* offset = ElementOffsetFromIndex(intptr_key, BIGINT64_ELEMENTS,
-                                        INTPTR_PARAMETERS, 0);
+  // Assert that offset < elements.length. Given that it's an offset for a raw
+  // pointer we correct it by the usual kHeapObjectTag offset.
+  CSA_ASSERT(
+      this, IsOffsetInBounds(offset, LoadAndUntagFixedArrayBaseLength(elements),
+                             kHeapObjectTag, BIGINT64_ELEMENTS));
+
   MachineRepresentation rep = WordT::kMachineRepresentation;
 #if defined(V8_TARGET_BIG_ENDIAN)
   if (!Is64()) {
@@ -8442,10 +9261,24 @@ void CodeStubAssembler::EmitElementStore(Node* object, Node* key, Node* value,
 
   if (IsFixedTypedArrayElementsKind(elements_kind)) {
     Label done(this);
+
+    // IntegerIndexedElementSet converts value to a Number/BigInt prior to the
+    // bounds check.
+    value = PrepareValueForWriteToTypedArray(CAST(value), elements_kind,
+                                             CAST(context));
+
+    // There must be no allocations between the buffer load and
+    // and the actual store to backing store, because GC may decide that
+    // the buffer is not alive or move the elements.
+    // TODO(ishell): introduce DisallowHeapAllocationCode scope here.
+
+    // Check if buffer has been neutered.
+    Node* buffer = LoadObjectField(object, JSArrayBufferView::kBufferOffset);
+    GotoIf(IsDetachedBuffer(buffer), bailout);
+
     // Bounds check.
-    Node* length = TaggedToParameter(
-        CAST(LoadObjectField(object, JSTypedArray::kLengthOffset)),
-        parameter_mode);
+    Node* length =
+        TaggedToParameter(LoadTypedArrayLength(CAST(object)), parameter_mode);
 
     if (store_mode == STORE_NO_TRANSITION_IGNORE_OUT_OF_BOUNDS) {
       // Skip the store if we write beyond the length or
@@ -8456,24 +9289,17 @@ void CodeStubAssembler::EmitElementStore(Node* object, Node* key, Node* value,
       GotoIfNot(UintPtrLessThan(intptr_key, length), bailout);
     }
 
-    TNode<Object> value_obj = UncheckedCast<Object>(value);
     if (elements_kind == BIGINT64_ELEMENTS ||
         elements_kind == BIGUINT64_ELEMENTS) {
-      EmitBigTypedArrayElementStore(CAST(object), CAST(elements), intptr_key,
-                                    value_obj, CAST(context), bailout);
+      TNode<BigInt> bigint_value = UncheckedCast<BigInt>(value);
+
+      TNode<RawPtrT> backing_store =
+          LoadFixedTypedArrayBackingStore(CAST(elements));
+      TNode<IntPtrT> offset = ElementOffsetFromIndex(
+          intptr_key, BIGINT64_ELEMENTS, INTPTR_PARAMETERS, 0);
+      EmitBigTypedArrayElementStore(CAST(elements), backing_store, offset,
+                                    bigint_value);
     } else {
-      value = PrepareValueForWriteToTypedArray(value_obj, elements_kind,
-                                               CAST(context));
-
-      // There must be no allocations between the buffer load and
-      // and the actual store to backing store, because GC may decide that
-      // the buffer is not alive or move the elements.
-      // TODO(ishell): introduce DisallowHeapAllocationCode scope here.
-
-      // Check if buffer has been neutered.
-      Node* buffer = LoadObjectField(object, JSArrayBufferView::kBufferOffset);
-      GotoIf(IsDetachedBuffer(buffer), bailout);
-
       Node* backing_store = LoadFixedTypedArrayBackingStore(CAST(elements));
       StoreElement(backing_store, elements_kind, intptr_key, value,
                    parameter_mode);
@@ -8647,30 +9473,32 @@ void CodeStubAssembler::TrapAllocationMemento(Node* object,
   Label no_memento_found(this);
   Label top_check(this), map_check(this);
 
-  Node* new_space_top_address = ExternalConstant(
+  TNode<ExternalReference> new_space_top_address = ExternalConstant(
       ExternalReference::new_space_allocation_top_address(isolate()));
   const int kMementoMapOffset = JSArray::kSize;
   const int kMementoLastWordOffset =
       kMementoMapOffset + AllocationMemento::kSize - kPointerSize;
 
   // Bail out if the object is not in new space.
-  Node* object_word = BitcastTaggedToWord(object);
-  Node* object_page = PageFromAddress(object_word);
+  TNode<IntPtrT> object_word = BitcastTaggedToWord(object);
+  TNode<IntPtrT> object_page = PageFromAddress(object_word);
   {
-    Node* page_flags = Load(MachineType::IntPtr(), object_page,
-                            IntPtrConstant(Page::kFlagsOffset));
+    TNode<IntPtrT> page_flags =
+        UncheckedCast<IntPtrT>(Load(MachineType::IntPtr(), object_page,
+                                    IntPtrConstant(Page::kFlagsOffset)));
     GotoIf(WordEqual(WordAnd(page_flags,
                              IntPtrConstant(MemoryChunk::kIsInNewSpaceMask)),
                      IntPtrConstant(0)),
            &no_memento_found);
   }
 
-  Node* memento_last_word = IntPtrAdd(
+  TNode<IntPtrT> memento_last_word = IntPtrAdd(
       object_word, IntPtrConstant(kMementoLastWordOffset - kHeapObjectTag));
-  Node* memento_last_word_page = PageFromAddress(memento_last_word);
+  TNode<IntPtrT> memento_last_word_page = PageFromAddress(memento_last_word);
 
-  Node* new_space_top = Load(MachineType::Pointer(), new_space_top_address);
-  Node* new_space_top_page = PageFromAddress(new_space_top);
+  TNode<IntPtrT> new_space_top = UncheckedCast<IntPtrT>(
+      Load(MachineType::Pointer(), new_space_top_address));
+  TNode<IntPtrT> new_space_top_page = PageFromAddress(new_space_top);
 
   // If the object is in new space, we need to check whether respective
   // potential memento object is on the same page as the current top.
@@ -8693,7 +9521,7 @@ void CodeStubAssembler::TrapAllocationMemento(Node* object,
   // Memento map check.
   BIND(&map_check);
   {
-    Node* memento_map = LoadObjectField(object, kMementoMapOffset);
+    TNode<Object> memento_map = LoadObjectField(object, kMementoMapOffset);
     Branch(
         WordEqual(memento_map, LoadRoot(Heap::kAllocationMementoMapRootIndex)),
         memento_found, &no_memento_found);
@@ -8702,41 +9530,44 @@ void CodeStubAssembler::TrapAllocationMemento(Node* object,
   Comment("] TrapAllocationMemento");
 }
 
-Node* CodeStubAssembler::PageFromAddress(Node* address) {
+TNode<IntPtrT> CodeStubAssembler::PageFromAddress(TNode<IntPtrT> address) {
   return WordAnd(address, IntPtrConstant(~Page::kPageAlignmentMask));
 }
 
-Node* CodeStubAssembler::CreateAllocationSiteInFeedbackVector(
-    Node* feedback_vector, Node* slot) {
-  Node* size = IntPtrConstant(AllocationSite::kSize);
+TNode<AllocationSite> CodeStubAssembler::CreateAllocationSiteInFeedbackVector(
+    SloppyTNode<FeedbackVector> feedback_vector, TNode<Smi> slot) {
+  TNode<IntPtrT> size = IntPtrConstant(AllocationSite::kSizeWithWeakNext);
   Node* site = Allocate(size, CodeStubAssembler::kPretenured);
-  StoreMapNoWriteBarrier(site, Heap::kAllocationSiteMapRootIndex);
+  StoreMapNoWriteBarrier(site, Heap::kAllocationSiteWithWeakNextMapRootIndex);
   // Should match AllocationSite::Initialize.
-  Node* field = UpdateWord<AllocationSite::ElementsKindBits>(
+  TNode<WordT> field = UpdateWord<AllocationSite::ElementsKindBits>(
       IntPtrConstant(0), IntPtrConstant(GetInitialFastElementsKind()));
   StoreObjectFieldNoWriteBarrier(
-      site, AllocationSite::kTransitionInfoOrBoilerplateOffset, SmiTag(field));
+      site, AllocationSite::kTransitionInfoOrBoilerplateOffset,
+      SmiTag(Signed(field)));
 
   // Unlike literals, constructed arrays don't have nested sites
-  Node* zero = SmiConstant(0);
+  TNode<Smi> zero = SmiConstant(0);
   StoreObjectFieldNoWriteBarrier(site, AllocationSite::kNestedSiteOffset, zero);
 
   // Pretenuring calculation field.
   StoreObjectFieldNoWriteBarrier(site, AllocationSite::kPretenureDataOffset,
-                                 zero);
+                                 Int32Constant(0),
+                                 MachineRepresentation::kWord32);
 
   // Pretenuring memento creation count field.
   StoreObjectFieldNoWriteBarrier(
-      site, AllocationSite::kPretenureCreateCountOffset, zero);
+      site, AllocationSite::kPretenureCreateCountOffset, Int32Constant(0),
+      MachineRepresentation::kWord32);
 
   // Store an empty fixed array for the code dependency.
   StoreObjectFieldRoot(site, AllocationSite::kDependentCodeOffset,
                        Heap::kEmptyFixedArrayRootIndex);
 
   // Link the object to the allocation site list
-  Node* site_list = ExternalConstant(
+  TNode<ExternalReference> site_list = ExternalConstant(
       ExternalReference::allocation_sites_list_address(isolate()));
-  Node* next_site = LoadBufferObject(site_list, 0);
+  TNode<Object> next_site = CAST(LoadBufferObject(site_list, 0));
 
   // TODO(mvstanton): This is a store to a weak pointer, which we may want to
   // mark as such in order to skip the write barrier, once we have a unified
@@ -8747,25 +9578,45 @@ Node* CodeStubAssembler::CreateAllocationSiteInFeedbackVector(
   StoreNoWriteBarrier(MachineRepresentation::kTagged, site_list, site);
 
   StoreFeedbackVectorSlot(feedback_vector, slot, site, UPDATE_WRITE_BARRIER, 0,
-                          CodeStubAssembler::SMI_PARAMETERS);
-  return site;
+                          SMI_PARAMETERS);
+  return CAST(site);
 }
 
-Node* CodeStubAssembler::CreateWeakCellInFeedbackVector(Node* feedback_vector,
-                                                        Node* slot,
-                                                        Node* value) {
-  Node* size = IntPtrConstant(WeakCell::kSize);
-  Node* cell = Allocate(size, CodeStubAssembler::kPretenured);
+TNode<MaybeObject> CodeStubAssembler::StoreWeakReferenceInFeedbackVector(
+    SloppyTNode<FeedbackVector> feedback_vector, SloppyTNode<IntPtrT> slot,
+    TNode<HeapObject> value) {
+  TNode<MaybeObject> weak_value = MakeWeak(value);
+  StoreFeedbackVectorSlot(feedback_vector, slot, weak_value);
+  return weak_value;
+}
+
+TNode<BoolT> CodeStubAssembler::NotHasBoilerplate(
+    TNode<Object> maybe_literal_site) {
+  return TaggedIsSmi(maybe_literal_site);
+}
 
-  // Initialize the WeakCell.
-  DCHECK(Heap::RootIsImmortalImmovable(Heap::kWeakCellMapRootIndex));
-  StoreMapNoWriteBarrier(cell, Heap::kWeakCellMapRootIndex);
-  StoreObjectField(cell, WeakCell::kValueOffset, value);
+TNode<Smi> CodeStubAssembler::LoadTransitionInfo(
+    TNode<AllocationSite> allocation_site) {
+  TNode<Smi> transition_info = CAST(LoadObjectField(
+      allocation_site, AllocationSite::kTransitionInfoOrBoilerplateOffset));
+  return transition_info;
+}
 
-  // Store the WeakCell in the feedback vector.
-  StoreFeedbackVectorSlot(feedback_vector, slot, cell, UPDATE_WRITE_BARRIER, 0,
-                          CodeStubAssembler::INTPTR_PARAMETERS);
-  return cell;
+TNode<JSObject> CodeStubAssembler::LoadBoilerplate(
+    TNode<AllocationSite> allocation_site) {
+  TNode<JSObject> boilerplate = CAST(LoadObjectField(
+      allocation_site, AllocationSite::kTransitionInfoOrBoilerplateOffset));
+  return boilerplate;
+}
+
+TNode<Int32T> CodeStubAssembler::LoadElementsKind(
+    TNode<AllocationSite> allocation_site) {
+  TNode<Smi> transition_info = LoadTransitionInfo(allocation_site);
+  TNode<Int32T> elements_kind =
+      Signed(DecodeWord32<AllocationSite::ElementsKindBits>(
+          SmiToInt32(transition_info)));
+  CSA_ASSERT(this, IsFastElementsKind(elements_kind));
+  return elements_kind;
 }
 
 Node* CodeStubAssembler::BuildFastLoop(
@@ -8898,31 +9749,35 @@ void CodeStubAssembler::BranchIfNumberRelationalComparison(
 
   BIND(&if_left_smi);
   {
+    TNode<Smi> smi_left = CAST(left);
+
     Label if_right_not_smi(this);
     GotoIfNot(TaggedIsSmi(right), &if_right_not_smi);
+    {
+      TNode<Smi> smi_right = CAST(right);
 
-    // Both {left} and {right} are Smi, so just perform a fast Smi comparison.
-    switch (op) {
-      case Operation::kLessThan:
-        BranchIfSmiLessThan(left, right, if_true, if_false);
-        break;
-      case Operation::kLessThanOrEqual:
-        BranchIfSmiLessThanOrEqual(left, right, if_true, if_false);
-        break;
-      case Operation::kGreaterThan:
-        BranchIfSmiLessThan(right, left, if_true, if_false);
-        break;
-      case Operation::kGreaterThanOrEqual:
-        BranchIfSmiLessThanOrEqual(right, left, if_true, if_false);
-        break;
-      default:
-        UNREACHABLE();
+      // Both {left} and {right} are Smi, so just perform a fast Smi comparison.
+      switch (op) {
+        case Operation::kLessThan:
+          BranchIfSmiLessThan(smi_left, smi_right, if_true, if_false);
+          break;
+        case Operation::kLessThanOrEqual:
+          BranchIfSmiLessThanOrEqual(smi_left, smi_right, if_true, if_false);
+          break;
+        case Operation::kGreaterThan:
+          BranchIfSmiLessThan(smi_right, smi_left, if_true, if_false);
+          break;
+        case Operation::kGreaterThanOrEqual:
+          BranchIfSmiLessThanOrEqual(smi_right, smi_left, if_true, if_false);
+          break;
+        default:
+          UNREACHABLE();
+      }
     }
-
     BIND(&if_right_not_smi);
     {
       CSA_ASSERT(this, IsHeapNumber(right));
-      var_left_float = SmiToFloat64(left);
+      var_left_float = SmiToFloat64(smi_left);
       var_right_float = LoadHeapNumberValue(right);
       Goto(&do_float_comparison);
     }
@@ -9032,6 +9887,7 @@ Node* CodeStubAssembler::RelationalComparison(Operation op, Node* left,
 
     BIND(&if_left_smi);
     {
+      TNode<Smi> smi_left = CAST(left);
       Label if_right_smi(this), if_right_heapnumber(this),
           if_right_bigint(this, Label::kDeferred),
           if_right_not_numeric(this, Label::kDeferred);
@@ -9044,21 +9900,24 @@ Node* CodeStubAssembler::RelationalComparison(Operation op, Node* left,
 
       BIND(&if_right_smi);
       {
+        TNode<Smi> smi_right = CAST(right);
         CombineFeedback(var_type_feedback,
                         CompareOperationFeedback::kSignedSmall);
         switch (op) {
           case Operation::kLessThan:
-            BranchIfSmiLessThan(left, right, &return_true, &return_false);
+            BranchIfSmiLessThan(smi_left, smi_right, &return_true,
+                                &return_false);
             break;
           case Operation::kLessThanOrEqual:
-            BranchIfSmiLessThanOrEqual(left, right, &return_true,
+            BranchIfSmiLessThanOrEqual(smi_left, smi_right, &return_true,
                                        &return_false);
             break;
           case Operation::kGreaterThan:
-            BranchIfSmiLessThan(right, left, &return_true, &return_false);
+            BranchIfSmiLessThan(smi_right, smi_left, &return_true,
+                                &return_false);
             break;
           case Operation::kGreaterThanOrEqual:
-            BranchIfSmiLessThanOrEqual(right, left, &return_true,
+            BranchIfSmiLessThanOrEqual(smi_right, smi_left, &return_true,
                                        &return_false);
             break;
           default:
@@ -9069,7 +9928,7 @@ Node* CodeStubAssembler::RelationalComparison(Operation op, Node* left,
       BIND(&if_right_heapnumber);
       {
         CombineFeedback(var_type_feedback, CompareOperationFeedback::kNumber);
-        var_left_float = SmiToFloat64(left);
+        var_left_float = SmiToFloat64(smi_left);
         var_right_float = LoadHeapNumberValue(right);
         Goto(&do_float_comparison);
       }
@@ -9200,11 +10059,12 @@ Node* CodeStubAssembler::RelationalComparison(Operation op, Node* left,
         BIND(&if_left_bigint);
         {
           Label if_right_heapnumber(this), if_right_bigint(this),
-              if_right_not_numeric(this);
+              if_right_string(this), if_right_other(this);
           GotoIf(IsHeapNumberMap(right_map), &if_right_heapnumber);
           Node* right_instance_type = LoadMapInstanceType(right_map);
-          Branch(IsBigIntInstanceType(right_instance_type), &if_right_bigint,
-                 &if_right_not_numeric);
+          GotoIf(IsBigIntInstanceType(right_instance_type), &if_right_bigint);
+          Branch(IsStringInstanceType(right_instance_type), &if_right_string,
+                 &if_right_other);
 
           BIND(&if_right_heapnumber);
           {
@@ -9226,7 +10086,18 @@ Node* CodeStubAssembler::RelationalComparison(Operation op, Node* left,
             Goto(&end);
           }
 
-          BIND(&if_right_not_numeric);
+          BIND(&if_right_string);
+          {
+            OverwriteFeedback(var_type_feedback,
+                              CompareOperationFeedback::kAny);
+            var_result = CAST(CallRuntime(Runtime::kBigIntCompareToString,
+                                          NoContextConstant(), SmiConstant(op),
+                                          left, right));
+            Goto(&end);
+          }
+
+          // {right} is not a Number, BigInt, or String.
+          BIND(&if_right_other);
           {
             OverwriteFeedback(var_type_feedback,
                               CompareOperationFeedback::kAny);
@@ -9274,11 +10145,14 @@ Node* CodeStubAssembler::RelationalComparison(Operation op, Node* left,
           {
             OverwriteFeedback(var_type_feedback,
                               CompareOperationFeedback::kAny);
-            // {left} is a String, while {right} isn't. So we call
-            // ToPrimitive(right, hint Number) if {right} is a receiver, or
-            // ToNumeric(left) and then ToNumeric(right) in the other cases.
+            // {left} is a String, while {right} isn't. Check if {right} is
+            // a BigInt, otherwise call ToPrimitive(right, hint Number) if
+            // {right} is a receiver, or ToNumeric(left) and then
+            // ToNumeric(right) in the other cases.
             STATIC_ASSERT(LAST_JS_RECEIVER_TYPE == LAST_TYPE);
-            Label if_right_receiver(this, Label::kDeferred);
+            Label if_right_bigint(this),
+                if_right_receiver(this, Label::kDeferred);
+            GotoIf(IsBigIntInstanceType(right_instance_type), &if_right_bigint);
             GotoIf(IsJSReceiverInstanceType(right_instance_type),
                    &if_right_receiver);
 
@@ -9287,6 +10161,14 @@ Node* CodeStubAssembler::RelationalComparison(Operation op, Node* left,
             var_right.Bind(CallBuiltin(Builtins::kToNumeric, context, right));
             Goto(&loop);
 
+            BIND(&if_right_bigint);
+            {
+              var_result = CAST(CallRuntime(
+                  Runtime::kBigIntCompareToString, NoContextConstant(),
+                  SmiConstant(Reverse(op)), right, left));
+              Goto(&end);
+            }
+
             BIND(&if_right_receiver);
             {
               Callable callable = CodeFactory::NonPrimitiveToPrimitive(
@@ -9398,8 +10280,9 @@ Node* CodeStubAssembler::RelationalComparison(Operation op, Node* left,
   return var_result.value();
 }
 
-Node* CodeStubAssembler::CollectFeedbackForString(Node* instance_type) {
-  Node* feedback = SelectSmiConstant(
+TNode<Smi> CodeStubAssembler::CollectFeedbackForString(
+    SloppyTNode<Int32T> instance_type) {
+  TNode<Smi> feedback = SelectSmiConstant(
       Word32Equal(
           Word32And(instance_type, Int32Constant(kIsNotInternalizedMask)),
           Int32Constant(kInternalizedTag)),
@@ -9996,9 +10879,9 @@ Node* CodeStubAssembler::StrictEqual(Node* lhs, Node* rhs,
             BIND(&if_rhsisstring);
             {
               if (var_type_feedback != nullptr) {
-                Node* lhs_feedback =
+                TNode<Smi> lhs_feedback =
                     CollectFeedbackForString(lhs_instance_type);
-                Node* rhs_feedback =
+                TNode<Smi> rhs_feedback =
                     CollectFeedbackForString(rhs_instance_type);
                 var_type_feedback->Bind(SmiOr(lhs_feedback, rhs_feedback));
               }
@@ -10523,7 +11406,7 @@ Node* CodeStubAssembler::InstanceOf(Node* object, Node* callable,
     //
     // Call to Function.prototype[@@hasInstance] directly.
     Callable builtin(BUILTIN_CODE(isolate(), FunctionPrototypeHasInstance),
-                     CallTrampolineDescriptor(isolate()));
+                     CallTrampolineDescriptor{});
     Node* result = CallJS(builtin, context, inst_of_handler, callable, object);
     var_result.Bind(result);
     Goto(&return_result);
@@ -10582,23 +11465,14 @@ TNode<Number> CodeStubAssembler::NumberInc(SloppyTNode<Number> value) {
 
   BIND(&if_issmi);
   {
-    // Try fast Smi addition first.
+    Label if_overflow(this);
+    TNode<Smi> smi_value = CAST(value);
     TNode<Smi> one = SmiConstant(1);
-    TNode<PairT<IntPtrT, BoolT>> pair = IntPtrAddWithOverflow(
-        BitcastTaggedToWord(value), BitcastTaggedToWord(one));
-    TNode<BoolT> overflow = Projection<1>(pair);
-
-    // Check if the Smi addition overflowed.
-    Label if_overflow(this), if_notoverflow(this);
-    Branch(overflow, &if_overflow, &if_notoverflow);
-
-    BIND(&if_notoverflow);
-    var_result = BitcastWordToTaggedSigned(Projection<0>(pair));
+    var_result = TrySmiAdd(smi_value, one, &if_overflow);
     Goto(&end);
 
     BIND(&if_overflow);
     {
-      TNode<Smi> smi_value = CAST(value);
       var_finc_value = SmiToFloat64(smi_value);
       Goto(&do_finc);
     }
@@ -10634,23 +11508,14 @@ TNode<Number> CodeStubAssembler::NumberDec(SloppyTNode<Number> value) {
 
   BIND(&if_issmi);
   {
-    // Try fast Smi subtraction first.
+    TNode<Smi> smi_value = CAST(value);
     TNode<Smi> one = SmiConstant(1);
-    TNode<PairT<IntPtrT, BoolT>> pair = IntPtrSubWithOverflow(
-        BitcastTaggedToWord(value), BitcastTaggedToWord(one));
-    TNode<BoolT> overflow = Projection<1>(pair);
-
-    // Check if the Smi subtraction overflowed.
-    Label if_overflow(this), if_notoverflow(this);
-    Branch(overflow, &if_overflow, &if_notoverflow);
-
-    BIND(&if_notoverflow);
-    var_result = BitcastWordToTaggedSigned(Projection<0>(pair));
+    Label if_overflow(this);
+    var_result = TrySmiSub(smi_value, one, &if_overflow);
     Goto(&end);
 
     BIND(&if_overflow);
     {
-      TNode<Smi> smi_value = CAST(value);
       var_fdec_value = SmiToFloat64(smi_value);
       Goto(&do_fdec);
     }
@@ -10686,15 +11551,7 @@ TNode<Number> CodeStubAssembler::NumberAdd(SloppyTNode<Number> a,
   GotoIf(TaggedIsNotSmi(b), &float_add);
 
   // Try fast Smi addition first.
-  TNode<PairT<IntPtrT, BoolT>> pair =
-      IntPtrAddWithOverflow(BitcastTaggedToWord(a), BitcastTaggedToWord(b));
-  TNode<BoolT> overflow = Projection<1>(pair);
-
-  // Check if the Smi addition overflowed.
-  Label if_overflow(this), if_notoverflow(this);
-  GotoIf(overflow, &float_add);
-
-  var_result = BitcastWordToTaggedSigned(Projection<0>(pair));
+  var_result = TrySmiAdd(CAST(a), CAST(b), &float_add);
   Goto(&end);
 
   BIND(&float_add);
@@ -10716,15 +11573,7 @@ TNode<Number> CodeStubAssembler::NumberSub(SloppyTNode<Number> a,
   GotoIf(TaggedIsNotSmi(b), &float_sub);
 
   // Try fast Smi subtraction first.
-  TNode<PairT<IntPtrT, BoolT>> pair =
-      IntPtrSubWithOverflow(BitcastTaggedToWord(a), BitcastTaggedToWord(b));
-  TNode<BoolT> overflow = Projection<1>(pair);
-
-  // Check if the Smi subtraction overflowed.
-  Label if_overflow(this), if_notoverflow(this);
-  GotoIf(overflow, &float_sub);
-
-  var_result = BitcastWordToTaggedSigned(Projection<0>(pair));
+  var_result = TrySmiSub(CAST(a), CAST(b), &float_sub);
   Goto(&end);
 
   BIND(&float_sub);
@@ -10750,8 +11599,8 @@ void CodeStubAssembler::GotoIfNumber(Node* input, Label* is_number) {
   GotoIf(IsHeapNumber(input), is_number);
 }
 
-Node* CodeStubAssembler::BitwiseOp(Node* left32, Node* right32,
-                                   Operation bitwise_op) {
+TNode<Number> CodeStubAssembler::BitwiseOp(Node* left32, Node* right32,
+                                           Operation bitwise_op) {
   switch (bitwise_op) {
     case Operation::kBitwiseAnd:
       return ChangeInt32ToTagged(Signed(Word32And(left32, right32)));
@@ -10781,11 +11630,11 @@ Node* CodeStubAssembler::BitwiseOp(Node* left32, Node* right32,
 }
 
 // ES #sec-createarrayiterator
-Node* CodeStubAssembler::CreateArrayIterator(Node* context, Node* object,
-                                             IterationKind kind) {
-  Node* native_context = LoadNativeContext(context);
-  Node* iterator_map = LoadContextElement(
-      native_context, Context::INITIAL_ARRAY_ITERATOR_MAP_INDEX);
+TNode<JSArrayIterator> CodeStubAssembler::CreateArrayIterator(
+    TNode<Context> context, TNode<Object> object, IterationKind kind) {
+  TNode<Context> native_context = LoadNativeContext(context);
+  TNode<Map> iterator_map = CAST(LoadContextElement(
+      native_context, Context::INITIAL_ARRAY_ITERATOR_MAP_INDEX));
   Node* iterator = Allocate(JSArrayIterator::kSize);
   StoreMapNoWriteBarrier(iterator, iterator_map);
   StoreObjectFieldRoot(iterator, JSArrayIterator::kPropertiesOrHashOffset,
@@ -10799,7 +11648,7 @@ Node* CodeStubAssembler::CreateArrayIterator(Node* context, Node* object,
   StoreObjectFieldNoWriteBarrier(
       iterator, JSArrayIterator::kKindOffset,
       SmiConstant(Smi::FromInt(static_cast<int>(kind))));
-  return iterator;
+  return CAST(iterator);
 }
 
 Node* CodeStubAssembler::AllocateJSIteratorResult(Node* context, Node* value,
@@ -10871,6 +11720,18 @@ Node* CodeStubAssembler::IsDetachedBuffer(Node* buffer) {
   return IsSetWord32<JSArrayBuffer::WasNeutered>(buffer_bit_field);
 }
 
+TNode<JSArrayBuffer> CodeStubAssembler::LoadArrayBufferViewBuffer(
+    TNode<JSArrayBufferView> array_buffer_view) {
+  return LoadObjectField<JSArrayBuffer>(array_buffer_view,
+                                        JSArrayBufferView::kBufferOffset);
+}
+
+TNode<RawPtrT> CodeStubAssembler::LoadArrayBufferBackingStore(
+    TNode<JSArrayBuffer> array_buffer) {
+  return LoadObjectField<RawPtrT>(array_buffer,
+                                  JSArrayBuffer::kBackingStoreOffset);
+}
+
 CodeStubArguments::CodeStubArguments(
     CodeStubAssembler* assembler, Node* argc, Node* fp,
     CodeStubAssembler::ParameterMode param_mode, ReceiverMode receiver_mode)
@@ -10894,6 +11755,13 @@ TNode<Object> CodeStubArguments::GetReceiver() const {
                        assembler_->IntPtrConstant(kPointerSize)));
 }
 
+void CodeStubArguments::SetReceiver(TNode<Object> object) const {
+  DCHECK_EQ(receiver_mode_, ReceiverMode::kHasReceiver);
+  assembler_->StoreNoWriteBarrier(MachineRepresentation::kTagged, arguments_,
+                                  assembler_->IntPtrConstant(kPointerSize),
+                                  object);
+}
+
 TNode<RawPtr<Object>> CodeStubArguments::AtIndexPtr(
     Node* index, CodeStubAssembler::ParameterMode mode) const {
   typedef compiler::Node Node;
@@ -11002,11 +11870,24 @@ void CodeStubArguments::PopAndReturn(Node* value) {
 }
 
 Node* CodeStubAssembler::IsFastElementsKind(Node* elements_kind) {
+  STATIC_ASSERT(FIRST_ELEMENTS_KIND == FIRST_FAST_ELEMENTS_KIND);
   return Uint32LessThanOrEqual(elements_kind,
                                Int32Constant(LAST_FAST_ELEMENTS_KIND));
 }
 
+TNode<BoolT> CodeStubAssembler::IsDoubleElementsKind(
+    TNode<Int32T> elements_kind) {
+  STATIC_ASSERT(FIRST_ELEMENTS_KIND == FIRST_FAST_ELEMENTS_KIND);
+  STATIC_ASSERT((PACKED_DOUBLE_ELEMENTS & 1) == 0);
+  STATIC_ASSERT(PACKED_DOUBLE_ELEMENTS + 1 == HOLEY_DOUBLE_ELEMENTS);
+  return Word32Equal(Word32Shr(elements_kind, Int32Constant(1)),
+                     Int32Constant(PACKED_DOUBLE_ELEMENTS / 2));
+}
+
 Node* CodeStubAssembler::IsFastSmiOrTaggedElementsKind(Node* elements_kind) {
+  STATIC_ASSERT(FIRST_ELEMENTS_KIND == FIRST_FAST_ELEMENTS_KIND);
+  STATIC_ASSERT(PACKED_DOUBLE_ELEMENTS > TERMINAL_FAST_ELEMENTS_KIND);
+  STATIC_ASSERT(HOLEY_DOUBLE_ELEMENTS > TERMINAL_FAST_ELEMENTS_KIND);
   return Uint32LessThanOrEqual(elements_kind,
                                Int32Constant(TERMINAL_FAST_ELEMENTS_KIND));
 }
@@ -11037,13 +11918,28 @@ Node* CodeStubAssembler::IsDebugActive() {
   return Word32NotEqual(is_debug_active, Int32Constant(0));
 }
 
-Node* CodeStubAssembler::IsPromiseHookEnabledOrDebugIsActive() {
-  Node* const promise_hook_or_debug_is_active =
+Node* CodeStubAssembler::IsPromiseHookEnabled() {
+  Node* const promise_hook = Load(
+      MachineType::Pointer(),
+      ExternalConstant(ExternalReference::promise_hook_address(isolate())));
+  return WordNotEqual(promise_hook, IntPtrConstant(0));
+}
+
+Node* CodeStubAssembler::HasAsyncEventDelegate() {
+  Node* const async_event_delegate =
+      Load(MachineType::Pointer(),
+           ExternalConstant(
+               ExternalReference::async_event_delegate_address(isolate())));
+  return WordNotEqual(async_event_delegate, IntPtrConstant(0));
+}
+
+Node* CodeStubAssembler::IsPromiseHookEnabledOrHasAsyncEventDelegate() {
+  Node* const promise_hook_or_async_event_delegate =
       Load(MachineType::Uint8(),
            ExternalConstant(
-               ExternalReference::promise_hook_or_debug_is_active_address(
+               ExternalReference::promise_hook_or_async_event_delegate_address(
                    isolate())));
-  return Word32NotEqual(promise_hook_or_debug_is_active, Int32Constant(0));
+  return Word32NotEqual(promise_hook_or_async_event_delegate, Int32Constant(0));
 }
 
 TNode<Code> CodeStubAssembler::LoadBuiltin(TNode<Smi> builtin_id) {
@@ -11064,17 +11960,21 @@ TNode<Code> CodeStubAssembler::LoadBuiltin(TNode<Smi> builtin_id) {
 }
 
 TNode<Code> CodeStubAssembler::GetSharedFunctionInfoCode(
-    SloppyTNode<SharedFunctionInfo> shared_info) {
+    SloppyTNode<SharedFunctionInfo> shared_info, Label* if_compile_lazy) {
   TNode<Object> sfi_data =
       LoadObjectField(shared_info, SharedFunctionInfo::kFunctionDataOffset);
 
-  TYPED_VARIABLE_DEF(Code, sfi_code, this);
+  TVARIABLE(Code, sfi_code);
 
   Label done(this);
   Label check_instance_type(this);
 
   // IsSmi: Is builtin
   GotoIf(TaggedIsNotSmi(sfi_data), &check_instance_type);
+  if (if_compile_lazy) {
+    GotoIf(SmiEqual(CAST(sfi_data), SmiConstant(Builtins::kCompileLazy)),
+           if_compile_lazy);
+  }
   sfi_code = LoadBuiltin(CAST(sfi_data));
   Goto(&done);
 
@@ -11082,17 +11982,25 @@ TNode<Code> CodeStubAssembler::GetSharedFunctionInfoCode(
   BIND(&check_instance_type);
   TNode<Int32T> data_type = LoadInstanceType(CAST(sfi_data));
 
-  int32_t case_values[] = {BYTECODE_ARRAY_TYPE, CODE_TYPE, FIXED_ARRAY_TYPE,
-                           TUPLE2_TYPE, FUNCTION_TEMPLATE_INFO_TYPE};
+  int32_t case_values[] = {BYTECODE_ARRAY_TYPE,
+                           WASM_EXPORTED_FUNCTION_DATA_TYPE,
+                           FIXED_ARRAY_TYPE,
+                           UNCOMPILED_DATA_WITHOUT_PRE_PARSED_SCOPE_TYPE,
+                           UNCOMPILED_DATA_WITH_PRE_PARSED_SCOPE_TYPE,
+                           FUNCTION_TEMPLATE_INFO_TYPE};
   Label check_is_bytecode_array(this);
-  Label check_is_code(this);
+  Label check_is_exported_function_data(this);
   Label check_is_fixed_array(this);
-  Label check_is_pre_parsed_scope_data(this);
+  Label check_is_uncompiled_data_without_pre_parsed_scope(this);
+  Label check_is_uncompiled_data_with_pre_parsed_scope(this);
   Label check_is_function_template_info(this);
   Label check_is_interpreter_data(this);
-  Label* case_labels[] = {
-      &check_is_bytecode_array, &check_is_code, &check_is_fixed_array,
-      &check_is_pre_parsed_scope_data, &check_is_function_template_info};
+  Label* case_labels[] = {&check_is_bytecode_array,
+                          &check_is_exported_function_data,
+                          &check_is_fixed_array,
+                          &check_is_uncompiled_data_without_pre_parsed_scope,
+                          &check_is_uncompiled_data_with_pre_parsed_scope,
+                          &check_is_function_template_info};
   STATIC_ASSERT(arraysize(case_values) == arraysize(case_labels));
   Switch(data_type, &check_is_interpreter_data, case_values, case_labels,
          arraysize(case_labels));
@@ -11103,22 +12011,26 @@ TNode<Code> CodeStubAssembler::GetSharedFunctionInfoCode(
   sfi_code = HeapConstant(BUILTIN_CODE(isolate(), InterpreterEntryTrampoline));
   Goto(&done);
 
-  // IsCode: Run code
-  BIND(&check_is_code);
-  sfi_code = CAST(sfi_data);
+  // IsWasmExportedFunctionData: Use the wrapper code
+  BIND(&check_is_exported_function_data);
+  sfi_code = CAST(LoadObjectField(
+      CAST(sfi_data), WasmExportedFunctionData::kWrapperCodeOffset));
   Goto(&done);
 
-  // IsFixedArray: Instantiate using AsmWasmData,
+  // IsFixedArray: Instantiate using AsmWasmData
   BIND(&check_is_fixed_array);
   DCHECK(!Builtins::IsLazy(Builtins::kInstantiateAsmJs));
   sfi_code = HeapConstant(BUILTIN_CODE(isolate(), InstantiateAsmJs));
   Goto(&done);
 
-  // IsPreParsedScopeData: Compile lazy
-  BIND(&check_is_pre_parsed_scope_data);
+  // IsUncompiledDataWithPreParsedScope | IsUncompiledDataWithoutPreParsedScope:
+  // Compile lazy
+  BIND(&check_is_uncompiled_data_with_pre_parsed_scope);
+  Goto(&check_is_uncompiled_data_without_pre_parsed_scope);
+  BIND(&check_is_uncompiled_data_without_pre_parsed_scope);
   DCHECK(!Builtins::IsLazy(Builtins::kCompileLazy));
   sfi_code = HeapConstant(BUILTIN_CODE(isolate(), CompileLazy));
-  Goto(&done);
+  Goto(if_compile_lazy ? if_compile_lazy : &done);
 
   // IsFunctionTemplateInfo: API call
   BIND(&check_is_function_template_info);
@@ -11267,11 +12179,6 @@ TNode<Object> CodeStubAssembler::GetArgumentValue(CodeStubArguments* args,
   return args->GetOptionalArgumentValue(index);
 }
 
-TNode<Object> CodeStubAssembler::GetArgumentValue(CodeStubArguments* args,
-                                                  TNode<Smi> index) {
-  return args->GetOptionalArgumentValue(SmiUntag(index));
-}
-
 void CodeStubAssembler::Print(const char* s) {
   std::string formatted(s);
   formatted += "\n";
@@ -11291,22 +12198,24 @@ void CodeStubAssembler::Print(const char* prefix, Node* tagged_value) {
   CallRuntime(Runtime::kDebugPrint, NoContextConstant(), tagged_value);
 }
 
-void CodeStubAssembler::PerformStackCheck(Node* context) {
+void CodeStubAssembler::PerformStackCheck(TNode<Context> context) {
   Label ok(this), stack_check_interrupt(this, Label::kDeferred);
 
-  Node* sp = LoadStackPointer();
-  Node* stack_limit = Load(
+  // The instruction sequence below is carefully crafted to hit our pattern
+  // matcher for stack checks within instruction selection.
+  // See StackCheckMatcher::Matched and JSGenericLowering::LowerJSStackCheck.
+
+  TNode<UintPtrT> sp = UncheckedCast<UintPtrT>(LoadStackPointer());
+  TNode<UintPtrT> stack_limit = UncheckedCast<UintPtrT>(Load(
       MachineType::Pointer(),
-      ExternalConstant(ExternalReference::address_of_stack_limit(isolate())));
-  Node* interrupt = UintPtrLessThan(sp, stack_limit);
+      ExternalConstant(ExternalReference::address_of_stack_limit(isolate()))));
+  TNode<BoolT> sp_within_limit = UintPtrLessThan(stack_limit, sp);
 
-  Branch(interrupt, &stack_check_interrupt, &ok);
+  Branch(sp_within_limit, &ok, &stack_check_interrupt);
 
   BIND(&stack_check_interrupt);
-  {
-    CallRuntime(Runtime::kStackGuard, context);
-    Goto(&ok);
-  }
+  CallRuntime(Runtime::kStackGuard, context);
+  Goto(&ok);
 
   BIND(&ok);
 }
@@ -11318,9 +12227,10 @@ void CodeStubAssembler::InitializeFunctionContext(Node* native_context,
   StoreObjectFieldNoWriteBarrier(context, FixedArray::kLengthOffset,
                                  SmiConstant(slots));
 
-  Node* const empty_fn =
-      LoadContextElement(native_context, Context::CLOSURE_INDEX);
-  StoreContextElementNoWriteBarrier(context, Context::CLOSURE_INDEX, empty_fn);
+  Node* const empty_scope_info =
+      LoadContextElement(native_context, Context::SCOPE_INFO_INDEX);
+  StoreContextElementNoWriteBarrier(context, Context::SCOPE_INFO_INDEX,
+                                    empty_scope_info);
   StoreContextElementNoWriteBarrier(context, Context::PREVIOUS_INDEX,
                                     UndefinedConstant());
   StoreContextElementNoWriteBarrier(context, Context::EXTENSION_INDEX,
@@ -11329,12 +12239,5 @@ void CodeStubAssembler::InitializeFunctionContext(Node* native_context,
                                     native_context);
 }
 
-void CodeStubAssembler::AssertIsStrongHeapObject(
-    SloppyTNode<HeapObject> object) {
-  CSA_SLOW_ASSERT(this, WordEqual(WordAnd(BitcastTaggedToWord(object),
-                                          IntPtrConstant(kHeapObjectTagMask)),
-                                  IntPtrConstant(kHeapObjectTag)));
-}
-
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/src/code-stub-assembler.h b/deps/v8/src/code-stub-assembler.h
index 633b1d8dce6f51..2260b09f1be2f0 100644
--- a/deps/v8/src/code-stub-assembler.h
+++ b/deps/v8/src/code-stub-assembler.h
@@ -7,9 +7,11 @@
 
 #include <functional>
 
+#include "src/base/macros.h"
 #include "src/compiler/code-assembler.h"
 #include "src/globals.h"
 #include "src/objects.h"
+#include "src/roots.h"
 
 namespace v8 {
 namespace internal {
@@ -22,55 +24,72 @@ class StubCache;
 
 enum class PrimitiveType { kBoolean, kNumber, kString, kSymbol };
 
-#define HEAP_CONSTANT_LIST(V)                                              \
-  V(AccessorInfoMap, accessor_info_map, AccessorInfoMap)                   \
-  V(AccessorPairMap, accessor_pair_map, AccessorPairMap)                   \
-  V(AllocationSiteMap, allocation_site_map, AllocationSiteMap)             \
-  V(BooleanMap, boolean_map, BooleanMap)                                   \
-  V(CodeMap, code_map, CodeMap)                                            \
+#define HEAP_MUTABLE_IMMOVABLE_OBJECT_LIST(V)                              \
+  V(ArraySpeciesProtector, array_species_protector, ArraySpeciesProtector) \
   V(EmptyPropertyDictionary, empty_property_dictionary,                    \
     EmptyPropertyDictionary)                                               \
-  V(EmptyFixedArray, empty_fixed_array, EmptyFixedArray)                   \
-  V(EmptySlowElementDictionary, empty_slow_element_dictionary,             \
-    EmptySlowElementDictionary)                                            \
-  V(empty_string, empty_string, EmptyString)                               \
-  V(EmptyWeakCell, empty_weak_cell, EmptyWeakCell)                         \
-  V(FalseValue, false_value, False)                                        \
-  V(FeedbackVectorMap, feedback_vector_map, FeedbackVectorMap)             \
-  V(FixedArrayMap, fixed_array_map, FixedArrayMap)                         \
-  V(FixedCOWArrayMap, fixed_cow_array_map, FixedCOWArrayMap)               \
-  V(FixedDoubleArrayMap, fixed_double_array_map, FixedDoubleArrayMap)      \
-  V(FunctionTemplateInfoMap, function_template_info_map,                   \
-    FunctionTemplateInfoMap)                                               \
-  V(GlobalPropertyCellMap, global_property_cell_map, PropertyCellMap)      \
-  V(has_instance_symbol, has_instance_symbol, HasInstanceSymbol)           \
-  V(HeapNumberMap, heap_number_map, HeapNumberMap)                         \
-  V(iterator_symbol, iterator_symbol, IteratorSymbol)                      \
-  V(length_string, length_string, LengthString)                            \
-  V(ManyClosuresCellMap, many_closures_cell_map, ManyClosuresCellMap)      \
-  V(MetaMap, meta_map, MetaMap)                                            \
-  V(MinusZeroValue, minus_zero_value, MinusZero)                           \
-  V(MutableHeapNumberMap, mutable_heap_number_map, MutableHeapNumberMap)   \
-  V(NanValue, nan_value, Nan)                                              \
-  V(NoClosuresCellMap, no_closures_cell_map, NoClosuresCellMap)            \
-  V(NullValue, null_value, Null)                                           \
-  V(OneClosureCellMap, one_closure_cell_map, OneClosureCellMap)            \
-  V(prototype_string, prototype_string, PrototypeString)                   \
-  V(ArraySpeciesProtector, array_species_protector, ArraySpeciesProtector) \
-  V(TypedArraySpeciesProtector, typed_array_species_protector,             \
-    TypedArraySpeciesProtector)                                            \
   V(PromiseSpeciesProtector, promise_species_protector,                    \
     PromiseSpeciesProtector)                                               \
-  V(StoreHandler0Map, store_handler0_map, StoreHandler0Map)                \
-  V(SymbolMap, symbol_map, SymbolMap)                                      \
-  V(TheHoleValue, the_hole_value, TheHole)                                 \
-  V(TransitionArrayMap, transition_array_map, TransitionArrayMap)          \
-  V(TrueValue, true_value, True)                                           \
-  V(Tuple2Map, tuple2_map, Tuple2Map)                                      \
-  V(Tuple3Map, tuple3_map, Tuple3Map)                                      \
-  V(UndefinedValue, undefined_value, Undefined)                            \
-  V(WeakCellMap, weak_cell_map, WeakCellMap)                               \
-  V(SharedFunctionInfoMap, shared_function_info_map, SharedFunctionInfoMap)
+  V(TypedArraySpeciesProtector, typed_array_species_protector,             \
+    TypedArraySpeciesProtector)                                            \
+  V(StoreHandler0Map, store_handler0_map, StoreHandler0Map)
+
+#define HEAP_IMMUTABLE_IMMOVABLE_OBJECT_LIST(V)                             \
+  V(AccessorInfoMap, accessor_info_map, AccessorInfoMap)                    \
+  V(AccessorPairMap, accessor_pair_map, AccessorPairMap)                    \
+  V(AllocationSiteWithWeakNextMap, allocation_site_map, AllocationSiteMap)  \
+  V(AllocationSiteWithoutWeakNextMap, allocation_site_without_weaknext_map, \
+    AllocationSiteWithoutWeakNextMap)                                       \
+  V(BooleanMap, boolean_map, BooleanMap)                                    \
+  V(CodeMap, code_map, CodeMap)                                             \
+  V(EmptyFixedArray, empty_fixed_array, EmptyFixedArray)                    \
+  V(EmptySlowElementDictionary, empty_slow_element_dictionary,              \
+    EmptySlowElementDictionary)                                             \
+  V(empty_string, empty_string, EmptyString)                                \
+  V(EmptyWeakCell, empty_weak_cell, EmptyWeakCell)                          \
+  V(FalseValue, false_value, False)                                         \
+  V(FeedbackVectorMap, feedback_vector_map, FeedbackVectorMap)              \
+  V(FixedArrayMap, fixed_array_map, FixedArrayMap)                          \
+  V(FixedCOWArrayMap, fixed_cow_array_map, FixedCOWArrayMap)                \
+  V(FixedDoubleArrayMap, fixed_double_array_map, FixedDoubleArrayMap)       \
+  V(FunctionTemplateInfoMap, function_template_info_map,                    \
+    FunctionTemplateInfoMap)                                                \
+  V(GlobalPropertyCellMap, global_property_cell_map, PropertyCellMap)       \
+  V(has_instance_symbol, has_instance_symbol, HasInstanceSymbol)            \
+  V(HeapNumberMap, heap_number_map, HeapNumberMap)                          \
+  V(iterator_symbol, iterator_symbol, IteratorSymbol)                       \
+  V(length_string, length_string, LengthString)                             \
+  V(ManyClosuresCellMap, many_closures_cell_map, ManyClosuresCellMap)       \
+  V(MetaMap, meta_map, MetaMap)                                             \
+  V(MinusZeroValue, minus_zero_value, MinusZero)                            \
+  V(MutableHeapNumberMap, mutable_heap_number_map, MutableHeapNumberMap)    \
+  V(NanValue, nan_value, Nan)                                               \
+  V(NoClosuresCellMap, no_closures_cell_map, NoClosuresCellMap)             \
+  V(NullValue, null_value, Null)                                            \
+  V(OneClosureCellMap, one_closure_cell_map, OneClosureCellMap)             \
+  V(prototype_string, prototype_string, PrototypeString)                    \
+  V(SharedFunctionInfoMap, shared_function_info_map, SharedFunctionInfoMap) \
+  V(SymbolMap, symbol_map, SymbolMap)                                       \
+  V(TheHoleValue, the_hole_value, TheHole)                                  \
+  V(TransitionArrayMap, transition_array_map, TransitionArrayMap)           \
+  V(TrueValue, true_value, True)                                            \
+  V(Tuple2Map, tuple2_map, Tuple2Map)                                       \
+  V(Tuple3Map, tuple3_map, Tuple3Map)                                       \
+  V(ArrayBoilerplateDescriptionMap, array_boilerplate_description_map,      \
+    ArrayBoilerplateDescriptionMap)                                         \
+  V(UncompiledDataWithoutPreParsedScopeMap,                                 \
+    uncompiled_data_without_pre_parsed_scope_map,                           \
+    UncompiledDataWithoutPreParsedScopeMap)                                 \
+  V(UncompiledDataWithPreParsedScopeMap,                                    \
+    uncompiled_data_with_pre_parsed_scope_map,                              \
+    UncompiledDataWithPreParsedScopeMap)                                    \
+  V(UndefinedValue, undefined_value, Undefined)                             \
+  V(WeakCellMap, weak_cell_map, WeakCellMap)                                \
+  V(WeakFixedArrayMap, weak_fixed_array_map, WeakFixedArrayMap)
+
+#define HEAP_IMMOVABLE_OBJECT_LIST(V)   \
+  HEAP_MUTABLE_IMMOVABLE_OBJECT_LIST(V) \
+  HEAP_IMMUTABLE_IMMOVABLE_OBJECT_LIST(V)
 
 // Returned from IteratorBuiltinsAssembler::GetIterator(). Struct is declared
 // here to simplify use in other generated builtins.
@@ -83,6 +102,119 @@ struct IteratorRecord {
   compiler::TNode<Object> next;
 };
 
+#define CSA_CHECK(csa, x)                                        \
+  (csa)->Check(                                                  \
+      [&]() -> compiler::Node* {                                 \
+        return implicit_cast<compiler::SloppyTNode<Word32T>>(x); \
+      },                                                         \
+      #x, __FILE__, __LINE__)
+
+#ifdef DEBUG
+// Add stringified versions to the given values, except the first. That is,
+// transform
+//   x, a, b, c, d, e, f
+// to
+//   a, "a", b, "b", c, "c", d, "d", e, "e", f, "f"
+//
+// __VA_ARGS__  is ignored to allow the caller to pass through too many
+// parameters, and the first element is ignored to support having no extra
+// values without empty __VA_ARGS__ (which cause all sorts of problems with
+// extra commas).
+#define CSA_ASSERT_STRINGIFY_EXTRA_VALUES_5(_, v1, v2, v3, v4, v5, ...) \
+  v1, #v1, v2, #v2, v3, #v3, v4, #v4, v5, #v5
+
+// Stringify the given variable number of arguments. The arguments are trimmed
+// to 5 if there are too many, and padded with nullptr if there are not enough.
+#define CSA_ASSERT_STRINGIFY_EXTRA_VALUES(...)                                \
+  CSA_ASSERT_STRINGIFY_EXTRA_VALUES_5(__VA_ARGS__, nullptr, nullptr, nullptr, \
+                                      nullptr, nullptr)
+
+#define CSA_ASSERT_GET_FIRST(x, ...) (x)
+#define CSA_ASSERT_GET_FIRST_STR(x, ...) #x
+
+// CSA_ASSERT(csa, <condition>, <extra values to print...>)
+
+// We have to jump through some hoops to allow <extra values to print...> to be
+// empty.
+#define CSA_ASSERT(csa, ...)                                             \
+  (csa)->Assert(                                                         \
+      [&]() -> compiler::Node* {                                         \
+        return implicit_cast<compiler::SloppyTNode<Word32T>>(            \
+            EXPAND(CSA_ASSERT_GET_FIRST(__VA_ARGS__)));                  \
+      },                                                                 \
+      EXPAND(CSA_ASSERT_GET_FIRST_STR(__VA_ARGS__)), __FILE__, __LINE__, \
+      CSA_ASSERT_STRINGIFY_EXTRA_VALUES(__VA_ARGS__))
+
+// CSA_ASSERT_BRANCH(csa, [](Label* ok, Label* not_ok) {...},
+//     <extra values to print...>)
+
+#define CSA_ASSERT_BRANCH(csa, ...)                                      \
+  (csa)->Assert(EXPAND(CSA_ASSERT_GET_FIRST(__VA_ARGS__)),               \
+                EXPAND(CSA_ASSERT_GET_FIRST_STR(__VA_ARGS__)), __FILE__, \
+                __LINE__, CSA_ASSERT_STRINGIFY_EXTRA_VALUES(__VA_ARGS__))
+
+#define CSA_ASSERT_JS_ARGC_OP(csa, Op, op, expected)                       \
+  (csa)->Assert(                                                           \
+      [&]() -> compiler::Node* {                                           \
+        compiler::Node* const argc =                                       \
+            (csa)->Parameter(Descriptor::kJSActualArgumentsCount);         \
+        return (csa)->Op(argc, (csa)->Int32Constant(expected));            \
+      },                                                                   \
+      "argc " #op " " #expected, __FILE__, __LINE__,                       \
+      SmiFromInt32((csa)->Parameter(Descriptor::kJSActualArgumentsCount)), \
+      "argc")
+
+#define CSA_ASSERT_JS_ARGC_EQ(csa, expected) \
+  CSA_ASSERT_JS_ARGC_OP(csa, Word32Equal, ==, expected)
+
+#define CSA_DEBUG_INFO(name) \
+  { #name, __FILE__, __LINE__ }
+#define BIND(label) Bind(label, CSA_DEBUG_INFO(label))
+#define VARIABLE(name, ...) \
+  Variable name(this, CSA_DEBUG_INFO(name), __VA_ARGS__)
+#define VARIABLE_CONSTRUCTOR(name, ...) \
+  name(this, CSA_DEBUG_INFO(name), __VA_ARGS__)
+#define TYPED_VARIABLE_DEF(type, name, ...) \
+  TVariable<type> name(CSA_DEBUG_INFO(name), __VA_ARGS__)
+#else  // DEBUG
+#define CSA_ASSERT(csa, ...) ((void)0)
+#define CSA_ASSERT_BRANCH(csa, ...) ((void)0)
+#define CSA_ASSERT_JS_ARGC_EQ(csa, expected) ((void)0)
+#define BIND(label) Bind(label)
+#define VARIABLE(name, ...) Variable name(this, __VA_ARGS__)
+#define VARIABLE_CONSTRUCTOR(name, ...) name(this, __VA_ARGS__)
+#define TYPED_VARIABLE_DEF(type, name, ...) TVariable<type> name(__VA_ARGS__)
+#endif  // DEBUG
+
+#define TVARIABLE(...) EXPAND(TYPED_VARIABLE_DEF(__VA_ARGS__, this))
+
+#ifdef ENABLE_SLOW_DCHECKS
+#define CSA_SLOW_ASSERT(csa, ...) \
+  if (FLAG_enable_slow_asserts) { \
+    CSA_ASSERT(csa, __VA_ARGS__); \
+  }
+#else
+#define CSA_SLOW_ASSERT(csa, ...) ((void)0)
+#endif
+
+class int31_t {
+ public:
+  int31_t() : value_(0) {}
+  int31_t(int value) : value_(value) {  // NOLINT(runtime/explicit)
+    DCHECK_EQ((value & 0x80000000) != 0, (value & 0x40000000) != 0);
+  }
+  int31_t& operator=(int value) {
+    DCHECK_EQ((value & 0x80000000) != 0, (value & 0x40000000) != 0);
+    value_ = value;
+    return *this;
+  }
+  int32_t value() const { return value_; }
+  operator int32_t() const { return value_; }
+
+ private:
+  int32_t value_;
+};
+
 // Provides JavaScript-specific "macro-assembler" functionality on top of the
 // CodeAssembler. By factoring the JavaScript-isms out of the CodeAssembler,
 // it's possible to add JavaScript-specific useful CodeAssembler "macros"
@@ -113,6 +245,7 @@ class V8_EXPORT_PRIVATE CodeStubAssembler : public compiler::CodeAssembler {
   typedef base::Flags<AllocationFlag> AllocationFlags;
 
   enum ParameterMode { SMI_PARAMETERS, INTPTR_PARAMETERS };
+
   // On 32-bit platforms, there is a slight performance advantage to doing all
   // of the array offset/index arithmetic with SMIs, since it's possible
   // to save a few tag/untag operations without paying an extra expense when
@@ -161,21 +294,100 @@ class V8_EXPORT_PRIVATE CodeStubAssembler : public compiler::CodeAssembler {
     return UncheckedCast<Smi>(value);
   }
 
+  TNode<Number> TaggedToNumber(TNode<Object> value, Label* fail) {
+    GotoIfNot(IsNumber(value), fail);
+    return UncheckedCast<Number>(value);
+  }
+
   TNode<HeapObject> TaggedToHeapObject(TNode<Object> value, Label* fail) {
     GotoIf(TaggedIsSmi(value), fail);
     return UncheckedCast<HeapObject>(value);
   }
 
   TNode<JSArray> TaggedToJSArray(TNode<Object> value, Label* fail) {
-    GotoIfNot(IsJSArray(value), fail);
-    return UncheckedCast<JSArray>(value);
+    GotoIf(TaggedIsSmi(value), fail);
+    TNode<HeapObject> heap_object = CAST(value);
+    GotoIfNot(IsJSArray(heap_object), fail);
+    return UncheckedCast<JSArray>(heap_object);
+  }
+
+  TNode<JSArray> TaggedToFastJSArray(TNode<Context> context,
+                                     TNode<Object> value, Label* fail) {
+    GotoIf(TaggedIsSmi(value), fail);
+    TNode<HeapObject> heap_object = CAST(value);
+    GotoIfNot(IsFastJSArray(heap_object, context), fail);
+    return UncheckedCast<JSArray>(heap_object);
+  }
+
+  TNode<JSDataView> TaggedToJSDataView(TNode<Object> value, Label* fail) {
+    GotoIf(TaggedIsSmi(value), fail);
+    TNode<HeapObject> heap_object = CAST(value);
+    GotoIfNot(IsJSDataView(heap_object), fail);
+    return UncheckedCast<JSDataView>(heap_object);
   }
 
-  TNode<HeapObject> TaggedToCallable(TNode<Object> value, Label* fail) {
+  TNode<JSReceiver> TaggedToCallable(TNode<Object> value, Label* fail) {
     GotoIf(TaggedIsSmi(value), fail);
     TNode<HeapObject> result = UncheckedCast<HeapObject>(value);
-    GotoIfNot(IsCallableMap(LoadMap(result)), fail);
-    return result;
+    GotoIfNot(IsCallable(result), fail);
+    return CAST(result);
+  }
+
+  TNode<HeapNumber> UnsafeCastNumberToHeapNumber(TNode<Number> p_n) {
+    return CAST(p_n);
+  }
+
+  TNode<FixedArray> UnsafeCastObjectToFixedArray(TNode<Object> p_o) {
+    return CAST(p_o);
+  }
+
+  TNode<FixedDoubleArray> UnsafeCastObjectToFixedDoubleArray(
+      TNode<Object> p_o) {
+    return CAST(p_o);
+  }
+
+  TNode<HeapNumber> UnsafeCastObjectToHeapNumber(TNode<Object> p_o) {
+    return CAST(p_o);
+  }
+
+  TNode<HeapObject> UnsafeCastObjectToCallable(TNode<Object> p_o) {
+    return CAST(p_o);
+  }
+
+  TNode<Smi> UnsafeCastObjectToSmi(TNode<Object> p_o) { return CAST(p_o); }
+
+  TNode<Number> UnsafeCastObjectToNumber(TNode<Object> p_o) {
+    return CAST(p_o);
+  }
+
+  TNode<HeapObject> UnsafeCastObjectToHeapObject(TNode<Object> p_o) {
+    return CAST(p_o);
+  }
+
+  TNode<JSArray> UnsafeCastObjectToJSArray(TNode<Object> p_o) {
+    return CAST(p_o);
+  }
+
+  TNode<FixedTypedArrayBase> UnsafeCastObjectToFixedTypedArrayBase(
+      TNode<Object> p_o) {
+    return CAST(p_o);
+  }
+
+  TNode<Object> UnsafeCastObjectToCompareBuiltinFn(TNode<Object> p_o) {
+    return p_o;
+  }
+
+  TNode<NumberDictionary> UnsafeCastObjectToNumberDictionary(
+      TNode<Object> p_o) {
+    return CAST(p_o);
+  }
+
+  TNode<JSReceiver> UnsafeCastObjectToJSReceiver(TNode<Object> p_o) {
+    return CAST(p_o);
+  }
+
+  TNode<JSObject> UnsafeCastObjectToJSObject(TNode<Object> p_o) {
+    return CAST(p_o);
   }
 
   Node* MatchesParameterMode(Node* value, ParameterMode mode);
@@ -183,7 +395,7 @@ class V8_EXPORT_PRIVATE CodeStubAssembler : public compiler::CodeAssembler {
 #define PARAMETER_BINOP(OpName, IntPtrOpName, SmiOpName) \
   Node* OpName(Node* a, Node* b, ParameterMode mode) {   \
     if (mode == SMI_PARAMETERS) {                        \
-      return SmiOpName(a, b);                            \
+      return SmiOpName(CAST(a), CAST(b));                \
     } else {                                             \
       DCHECK_EQ(INTPTR_PARAMETERS, mode);                \
       return IntPtrOpName(a, b);                         \
@@ -203,31 +415,41 @@ class V8_EXPORT_PRIVATE CodeStubAssembler : public compiler::CodeAssembler {
                   SmiAboveOrEqual)
 #undef PARAMETER_BINOP
 
-  Node* NoContextConstant();
+  TNode<Object> NoContextConstant();
+
+#define HEAP_CONSTANT_ACCESSOR(rootIndexName, rootAccessorName, name) \
+  compiler::TNode<std::remove_reference<decltype(                     \
+      *std::declval<ReadOnlyRoots>().rootAccessorName())>::type>      \
+      name##Constant();
+  HEAP_IMMUTABLE_IMMOVABLE_OBJECT_LIST(HEAP_CONSTANT_ACCESSOR)
+#undef HEAP_CONSTANT_ACCESSOR
+
 #define HEAP_CONSTANT_ACCESSOR(rootIndexName, rootAccessorName, name) \
   compiler::TNode<std::remove_reference<decltype(                     \
       *std::declval<Heap>().rootAccessorName())>::type>               \
       name##Constant();
-  HEAP_CONSTANT_LIST(HEAP_CONSTANT_ACCESSOR)
+  HEAP_MUTABLE_IMMOVABLE_OBJECT_LIST(HEAP_CONSTANT_ACCESSOR)
 #undef HEAP_CONSTANT_ACCESSOR
 
 #define HEAP_CONSTANT_TEST(rootIndexName, rootAccessorName, name) \
   TNode<BoolT> Is##name(SloppyTNode<Object> value);               \
   TNode<BoolT> IsNot##name(SloppyTNode<Object> value);
-  HEAP_CONSTANT_LIST(HEAP_CONSTANT_TEST)
+  HEAP_IMMOVABLE_OBJECT_LIST(HEAP_CONSTANT_TEST)
 #undef HEAP_CONSTANT_TEST
 
-  Node* HashSeed();
-  Node* StaleRegisterConstant();
+  TNode<Int32T> HashSeed();
 
   Node* IntPtrOrSmiConstant(int value, ParameterMode mode);
+  TNode<Smi> LanguageModeConstant(LanguageMode mode) {
+    return SmiConstant(static_cast<int>(mode));
+  }
 
   bool IsIntPtrOrSmiConstantZero(Node* test, ParameterMode mode);
   bool TryGetIntPtrOrSmiConstantValue(Node* maybe_constant, int* value,
                                       ParameterMode mode);
 
   // Round the 32bits payload of the provided word up to the next power of two.
-  Node* IntPtrRoundUpToPowerOfTwo32(Node* value);
+  TNode<IntPtrT> IntPtrRoundUpToPowerOfTwo32(TNode<IntPtrT> value);
   // Select the maximum of the two provided IntPtr values.
   TNode<IntPtrT> IntPtrMax(SloppyTNode<IntPtrT> left,
                            SloppyTNode<IntPtrT> right);
@@ -268,22 +490,36 @@ class V8_EXPORT_PRIVATE CodeStubAssembler : public compiler::CodeAssembler {
   TNode<Int32T> SmiToInt32(SloppyTNode<Smi> value);
 
   // Smi operations.
-#define SMI_ARITHMETIC_BINOP(SmiOpName, IntPtrOpName)                  \
-  TNode<Smi> SmiOpName(SloppyTNode<Smi> a, SloppyTNode<Smi> b) {       \
-    return BitcastWordToTaggedSigned(                                  \
-        IntPtrOpName(BitcastTaggedToWord(a), BitcastTaggedToWord(b))); \
-  }
-  SMI_ARITHMETIC_BINOP(SmiAdd, IntPtrAdd)
-  SMI_ARITHMETIC_BINOP(SmiSub, IntPtrSub)
-  SMI_ARITHMETIC_BINOP(SmiAnd, WordAnd)
-  SMI_ARITHMETIC_BINOP(SmiOr, WordOr)
+#define SMI_ARITHMETIC_BINOP(SmiOpName, IntPtrOpName, Int32OpName)       \
+  TNode<Smi> SmiOpName(TNode<Smi> a, TNode<Smi> b) {                     \
+    if (SmiValuesAre32Bits()) {                                          \
+      return BitcastWordToTaggedSigned(                                  \
+          IntPtrOpName(BitcastTaggedToWord(a), BitcastTaggedToWord(b))); \
+    } else {                                                             \
+      DCHECK(SmiValuesAre31Bits());                                      \
+      if (kPointerSize == kInt64Size) {                                  \
+        CSA_ASSERT(this, IsValidSmi(a));                                 \
+        CSA_ASSERT(this, IsValidSmi(b));                                 \
+      }                                                                  \
+      return BitcastWordToTaggedSigned(ChangeInt32ToIntPtr(              \
+          Int32OpName(TruncateIntPtrToInt32(BitcastTaggedToWord(a)),     \
+                      TruncateIntPtrToInt32(BitcastTaggedToWord(b)))));  \
+    }                                                                    \
+  }
+  SMI_ARITHMETIC_BINOP(SmiAdd, IntPtrAdd, Int32Add)
+  SMI_ARITHMETIC_BINOP(SmiSub, IntPtrSub, Int32Sub)
+  SMI_ARITHMETIC_BINOP(SmiAnd, WordAnd, Word32And)
+  SMI_ARITHMETIC_BINOP(SmiOr, WordOr, Word32Or)
 #undef SMI_ARITHMETIC_BINOP
 
-  Node* SmiShl(Node* a, int shift) {
+  TNode<Smi> TrySmiAdd(TNode<Smi> a, TNode<Smi> b, Label* if_overflow);
+  TNode<Smi> TrySmiSub(TNode<Smi> a, TNode<Smi> b, Label* if_overflow);
+
+  TNode<Smi> SmiShl(TNode<Smi> a, int shift) {
     return BitcastWordToTaggedSigned(WordShl(BitcastTaggedToWord(a), shift));
   }
 
-  Node* SmiShr(Node* a, int shift) {
+  TNode<Smi> SmiShr(TNode<Smi> a, int shift) {
     return BitcastWordToTaggedSigned(
         WordAnd(WordShr(BitcastTaggedToWord(a), shift),
                 BitcastTaggedToWord(SmiConstant(-1))));
@@ -291,7 +527,7 @@ class V8_EXPORT_PRIVATE CodeStubAssembler : public compiler::CodeAssembler {
 
   Node* WordOrSmiShl(Node* a, int shift, ParameterMode mode) {
     if (mode == SMI_PARAMETERS) {
-      return SmiShl(a, shift);
+      return SmiShl(CAST(a), shift);
     } else {
       DCHECK_EQ(INTPTR_PARAMETERS, mode);
       return WordShl(a, shift);
@@ -300,36 +536,49 @@ class V8_EXPORT_PRIVATE CodeStubAssembler : public compiler::CodeAssembler {
 
   Node* WordOrSmiShr(Node* a, int shift, ParameterMode mode) {
     if (mode == SMI_PARAMETERS) {
-      return SmiShr(a, shift);
+      return SmiShr(CAST(a), shift);
     } else {
       DCHECK_EQ(INTPTR_PARAMETERS, mode);
       return WordShr(a, shift);
     }
   }
 
-#define SMI_COMPARISON_OP(SmiOpName, IntPtrOpName)                       \
-  TNode<BoolT> SmiOpName(Node* a, Node* b) {                             \
-    return IntPtrOpName(BitcastTaggedToWord(a), BitcastTaggedToWord(b)); \
-  }
-  SMI_COMPARISON_OP(SmiEqual, WordEqual)
-  SMI_COMPARISON_OP(SmiNotEqual, WordNotEqual)
-  SMI_COMPARISON_OP(SmiAbove, UintPtrGreaterThan)
-  SMI_COMPARISON_OP(SmiAboveOrEqual, UintPtrGreaterThanOrEqual)
-  SMI_COMPARISON_OP(SmiBelow, UintPtrLessThan)
-  SMI_COMPARISON_OP(SmiLessThan, IntPtrLessThan)
-  SMI_COMPARISON_OP(SmiLessThanOrEqual, IntPtrLessThanOrEqual)
-  SMI_COMPARISON_OP(SmiGreaterThan, IntPtrGreaterThan)
-  SMI_COMPARISON_OP(SmiGreaterThanOrEqual, IntPtrGreaterThanOrEqual)
+#define SMI_COMPARISON_OP(SmiOpName, IntPtrOpName, Int32OpName)            \
+  TNode<BoolT> SmiOpName(TNode<Smi> a, TNode<Smi> b) {                     \
+    if (SmiValuesAre32Bits()) {                                            \
+      return IntPtrOpName(BitcastTaggedToWord(a), BitcastTaggedToWord(b)); \
+    } else {                                                               \
+      DCHECK(SmiValuesAre31Bits());                                        \
+      if (kPointerSize == kInt64Size) {                                    \
+        CSA_ASSERT(this, IsValidSmi(a));                                   \
+        CSA_ASSERT(this, IsValidSmi(b));                                   \
+      }                                                                    \
+      return Int32OpName(TruncateIntPtrToInt32(BitcastTaggedToWord(a)),    \
+                         TruncateIntPtrToInt32(BitcastTaggedToWord(b)));   \
+    }                                                                      \
+  }
+  SMI_COMPARISON_OP(SmiEqual, WordEqual, Word32Equal)
+  SMI_COMPARISON_OP(SmiNotEqual, WordNotEqual, Word32NotEqual)
+  SMI_COMPARISON_OP(SmiAbove, UintPtrGreaterThan, Uint32GreaterThan)
+  SMI_COMPARISON_OP(SmiAboveOrEqual, UintPtrGreaterThanOrEqual,
+                    Uint32GreaterThanOrEqual)
+  SMI_COMPARISON_OP(SmiBelow, UintPtrLessThan, Uint32LessThan)
+  SMI_COMPARISON_OP(SmiLessThan, IntPtrLessThan, Int32LessThan)
+  SMI_COMPARISON_OP(SmiLessThanOrEqual, IntPtrLessThanOrEqual,
+                    Int32LessThanOrEqual)
+  SMI_COMPARISON_OP(SmiGreaterThan, IntPtrGreaterThan, Int32GreaterThan)
+  SMI_COMPARISON_OP(SmiGreaterThanOrEqual, IntPtrGreaterThanOrEqual,
+                    Int32GreaterThanOrEqual)
 #undef SMI_COMPARISON_OP
-  TNode<Smi> SmiMax(SloppyTNode<Smi> a, SloppyTNode<Smi> b);
-  TNode<Smi> SmiMin(SloppyTNode<Smi> a, SloppyTNode<Smi> b);
+  TNode<Smi> SmiMax(TNode<Smi> a, TNode<Smi> b);
+  TNode<Smi> SmiMin(TNode<Smi> a, TNode<Smi> b);
   // Computes a % b for Smi inputs a and b; result is not necessarily a Smi.
-  TNode<Number> SmiMod(SloppyTNode<Smi> a, SloppyTNode<Smi> b);
+  TNode<Number> SmiMod(TNode<Smi> a, TNode<Smi> b);
   // Computes a * b for Smi inputs a and b; result is not necessarily a Smi.
-  TNode<Number> SmiMul(SloppyTNode<Smi> a, SloppyTNode<Smi> b);
-  // Tries to computes dividend / divisor for Smi inputs; branching to bailout
+  TNode<Number> SmiMul(TNode<Smi> a, TNode<Smi> b);
+  // Tries to compute dividend / divisor for Smi inputs; branching to bailout
   // if the division needs to be performed as a floating point operation.
-  Node* TrySmiDiv(Node* dividend, Node* divisor, Label* bailout);
+  TNode<Smi> TrySmiDiv(TNode<Smi> dividend, TNode<Smi> divisor, Label* bailout);
 
   // Smi | HeapNumber operations.
   TNode<Number> NumberInc(SloppyTNode<Number> value);
@@ -340,7 +589,7 @@ class V8_EXPORT_PRIVATE CodeStubAssembler : public compiler::CodeAssembler {
   void GotoIfNumber(Node* value, Label* is_number);
   TNode<Number> SmiToNumber(TNode<Smi> v) { return v; }
 
-  Node* BitwiseOp(Node* left32, Node* right32, Operation bitwise_op);
+  TNode<Number> BitwiseOp(Node* left32, Node* right32, Operation bitwise_op);
 
   // Allocate an object of the given size.
   Node* AllocateInNewSpace(Node* size, AllocationFlags flags = kNone);
@@ -397,6 +646,11 @@ class V8_EXPORT_PRIVATE CodeStubAssembler : public compiler::CodeAssembler {
   template <class... TArgs>
   TNode<Object> Call(TNode<Context> context, TNode<Object> callable,
                      TNode<Object> receiver, TArgs... args) {
+    if (IsUndefinedConstant(receiver) || IsNullConstant(receiver)) {
+      return UncheckedCast<Object>(CallJS(
+          CodeFactory::Call(isolate(), ConvertReceiverMode::kNullOrUndefined),
+          context, callable, receiver, args...));
+    }
     return UncheckedCast<Object>(CallJS(CodeFactory::Call(isolate()), context,
                                         callable, receiver, args...));
   }
@@ -406,8 +660,8 @@ class V8_EXPORT_PRIVATE CodeStubAssembler : public compiler::CodeAssembler {
                   const G& false_body) {
     return UncheckedCast<A>(SelectImpl(
         condition,
-        [&]() -> Node* { return base::implicit_cast<TNode<A>>(true_body()); },
-        [&]() -> Node* { return base::implicit_cast<TNode<A>>(false_body()); },
+        [&]() -> Node* { return implicit_cast<TNode<A>>(true_body()); },
+        [&]() -> Node* { return implicit_cast<TNode<A>>(false_body()); },
         MachineRepresentationOf<A>::value));
   }
 
@@ -443,6 +697,7 @@ class V8_EXPORT_PRIVATE CodeStubAssembler : public compiler::CodeAssembler {
 
   // Check a value for smi-ness
   TNode<BoolT> TaggedIsSmi(SloppyTNode<Object> a);
+  TNode<BoolT> TaggedIsSmi(TNode<MaybeObject> a);
   TNode<BoolT> TaggedIsNotSmi(SloppyTNode<Object> a);
   // Check that the value is a non-negative smi.
   TNode<BoolT> TaggedIsPositiveSmi(SloppyTNode<Object> a);
@@ -450,23 +705,23 @@ class V8_EXPORT_PRIVATE CodeStubAssembler : public compiler::CodeAssembler {
   TNode<BoolT> WordIsWordAligned(SloppyTNode<WordT> word);
   TNode<BoolT> WordIsPowerOfTwo(SloppyTNode<IntPtrT> value);
 
-  Node* IsNotTheHole(Node* value) { return Word32BinaryNot(IsTheHole(value)); }
-
 #if DEBUG
   void Bind(Label* label, AssemblerDebugInfo debug_info);
 #else
   void Bind(Label* label);
 #endif  // DEBUG
 
-  void BranchIfSmiEqual(Node* a, Node* b, Label* if_true, Label* if_false) {
+  void BranchIfSmiEqual(TNode<Smi> a, TNode<Smi> b, Label* if_true,
+                        Label* if_false) {
     Branch(SmiEqual(a, b), if_true, if_false);
   }
 
-  void BranchIfSmiLessThan(Node* a, Node* b, Label* if_true, Label* if_false) {
+  void BranchIfSmiLessThan(TNode<Smi> a, TNode<Smi> b, Label* if_true,
+                           Label* if_false) {
     Branch(SmiLessThan(a, b), if_true, if_false);
   }
 
-  void BranchIfSmiLessThanOrEqual(Node* a, Node* b, Label* if_true,
+  void BranchIfSmiLessThanOrEqual(TNode<Smi> a, TNode<Smi> b, Label* if_true,
                                   Label* if_false) {
     Branch(SmiLessThanOrEqual(a, b), if_true, if_false);
   }
@@ -480,7 +735,6 @@ class V8_EXPORT_PRIVATE CodeStubAssembler : public compiler::CodeAssembler {
   void BranchIfToBooleanIsTrue(Node* value, Label* if_true, Label* if_false);
 
   void BranchIfJSReceiver(Node* object, Label* if_true, Label* if_false);
-  void BranchIfJSObject(Node* object, Label* if_true, Label* if_false);
 
   void BranchIfFastJSArray(Node* object, Node* context, Label* if_true,
                            Label* if_false);
@@ -504,6 +758,14 @@ class V8_EXPORT_PRIVATE CodeStubAssembler : public compiler::CodeAssembler {
   Node* LoadFromParentFrame(int offset,
                             MachineType rep = MachineType::AnyTagged());
 
+  // Load target function from the current JS frame.
+  // This is an alternative way of getting the target function in addition to
+  // Parameter(Descriptor::kJSTarget). The latter should be used near the
+  // beginning of builtin code while the target value is still in the register
+  // and the former should be used in slow paths in order to reduce register
+  // pressure on the fast path.
+  TNode<JSFunction> LoadTargetFromFrame();
+
   // Load an object pointer from a buffer that isn't in the heap.
   Node* LoadBufferObject(Node* buffer, int offset,
                          MachineType rep = MachineType::AnyTagged());
@@ -542,7 +804,13 @@ class V8_EXPORT_PRIVATE CodeStubAssembler : public compiler::CodeAssembler {
   // Load a SMI and untag it.
   TNode<IntPtrT> LoadAndUntagSmi(Node* base, int index);
   // Load a SMI root, untag it, and convert to Word32.
-  Node* LoadAndUntagToWord32Root(Heap::RootListIndex root_index);
+  TNode<Int32T> LoadAndUntagToWord32Root(Heap::RootListIndex root_index);
+
+  TNode<MaybeObject> LoadMaybeWeakObjectField(SloppyTNode<HeapObject> object,
+                                              int offset) {
+    return UncheckedCast<MaybeObject>(
+        LoadObjectField(object, offset, MachineType::AnyTagged()));
+  }
 
   // Tag a smi and store it.
   Node* StoreAndTagSmi(Node* base, int offset, Node* value);
@@ -556,12 +824,6 @@ class V8_EXPORT_PRIVATE CodeStubAssembler : public compiler::CodeAssembler {
   // Compare the instance the type of the object against the provided one.
   TNode<BoolT> HasInstanceType(SloppyTNode<HeapObject> object,
                                InstanceType type);
-  // Determines whether Array's prototype has changed.
-  TNode<BoolT> InitialArrayPrototypeHasInitialArrayPrototypeMap(
-      TNode<Context> native_context);
-  // Determines whether an array's elements map has changed.
-  TNode<BoolT> HasInitialFastElementsKindMap(TNode<Context> native_context,
-                                             TNode<JSArray> jsarray);
   TNode<BoolT> DoesntHaveInstanceType(SloppyTNode<HeapObject> object,
                                       InstanceType type);
   TNode<BoolT> TaggedDoesntHaveInstanceType(SloppyTNode<HeapObject> any_tagged,
@@ -580,6 +842,12 @@ class V8_EXPORT_PRIVATE CodeStubAssembler : public compiler::CodeAssembler {
   // Load the length of a fixed array base instance.
   TNode<IntPtrT> LoadAndUntagFixedArrayBaseLength(
       SloppyTNode<FixedArrayBase> array);
+  // Load the length of a WeakFixedArray.
+  TNode<Smi> LoadWeakFixedArrayLength(TNode<WeakFixedArray> array);
+  TNode<IntPtrT> LoadAndUntagWeakFixedArrayLength(
+      SloppyTNode<WeakFixedArray> array);
+  // Load the length of a JSTypedArray instance.
+  TNode<Smi> LoadTypedArrayLength(TNode<JSTypedArray> typed_array);
   // Load the bit field of a Map.
   TNode<Int32T> LoadMapBitField(SloppyTNode<Map> map);
   // Load bit field 2 of a map.
@@ -590,10 +858,11 @@ class V8_EXPORT_PRIVATE CodeStubAssembler : public compiler::CodeAssembler {
   TNode<Int32T> LoadMapInstanceType(SloppyTNode<Map> map);
   // Load the ElementsKind of a map.
   TNode<Int32T> LoadMapElementsKind(SloppyTNode<Map> map);
+  TNode<Int32T> LoadElementsKind(SloppyTNode<HeapObject> map);
   // Load the instance descriptors of a map.
   TNode<DescriptorArray> LoadMapDescriptors(SloppyTNode<Map> map);
   // Load the prototype of a map.
-  TNode<Object> LoadMapPrototype(SloppyTNode<Map> map);
+  TNode<HeapObject> LoadMapPrototype(SloppyTNode<Map> map);
   // Load the prototype info of a map. The result has to be checked if it is a
   // prototype info object or not.
   TNode<PrototypeInfo> LoadMapPrototypeInfo(SloppyTNode<Map> map,
@@ -639,7 +908,7 @@ class V8_EXPORT_PRIVATE CodeStubAssembler : public compiler::CodeAssembler {
   // Load value field of a JSValue object.
   Node* LoadJSValueValue(Node* object);
   // Load value field of a WeakCell object.
-  TNode<Object> LoadWeakCellValueUnchecked(Node* weak_cell);
+  TNode<Object> LoadWeakCellValueUnchecked(SloppyTNode<HeapObject> weak_cell);
   TNode<Object> LoadWeakCellValue(SloppyTNode<WeakCell> weak_cell,
                                   Label* if_cleared = nullptr);
 
@@ -651,17 +920,51 @@ class V8_EXPORT_PRIVATE CodeStubAssembler : public compiler::CodeAssembler {
   // pointed to)
   // - a strong reference (jump to "if_strong", "extracted" will be the object
   // pointed to)
-  void DispatchMaybeObject(Node* maybe_object, Label* if_smi, Label* if_cleared,
-                           Label* if_weak, Label* if_strong,
-                           Variable* extracted);
+  void DispatchMaybeObject(TNode<MaybeObject> maybe_object, Label* if_smi,
+                           Label* if_cleared, Label* if_weak, Label* if_strong,
+                           TVariable<Object>* extracted);
+  // See MaybeObject for semantics of these functions.
+  TNode<BoolT> IsStrongHeapObject(TNode<MaybeObject> value);
+  // This variant is for overzealous checking.
+  TNode<BoolT> IsStrongHeapObject(TNode<Object> value) {
+    return IsStrongHeapObject(ReinterpretCast<MaybeObject>(value));
+  }
+  TNode<HeapObject> ToStrongHeapObject(TNode<MaybeObject> value,
+                                       Label* if_not_strong);
+
+  TNode<BoolT> IsWeakOrClearedHeapObject(TNode<MaybeObject> value);
+  TNode<BoolT> IsClearedWeakHeapObject(TNode<MaybeObject> value);
+  TNode<BoolT> IsNotClearedWeakHeapObject(TNode<MaybeObject> value);
+
+  // Removes the weak bit + asserts it was set.
+  TNode<HeapObject> ToWeakHeapObject(TNode<MaybeObject> value);
+
+  TNode<HeapObject> ToWeakHeapObject(TNode<MaybeObject> value,
+                                     Label* if_cleared);
+
+  TNode<BoolT> IsWeakReferenceTo(TNode<MaybeObject> object,
+                                 TNode<Object> value);
+  TNode<BoolT> IsNotWeakReferenceTo(TNode<MaybeObject> object,
+                                    TNode<Object> value);
+  TNode<BoolT> IsStrongReferenceTo(TNode<MaybeObject> object,
+                                   TNode<Object> value);
+
+  TNode<MaybeObject> MakeWeak(TNode<HeapObject> value);
+
+  // Load an array element from a FixedArray / WeakFixedArray / PropertyArray.
+  TNode<MaybeObject> LoadArrayElement(
+      SloppyTNode<HeapObject> object, int array_header_size, Node* index,
+      int additional_offset = 0,
+      ParameterMode parameter_mode = INTPTR_PARAMETERS,
+      LoadSensitivity needs_poisoning = LoadSensitivity::kSafe);
 
   // Load an array element from a FixedArray.
   TNode<Object> LoadFixedArrayElement(
-      SloppyTNode<Object> object, Node* index, int additional_offset = 0,
+      SloppyTNode<HeapObject> object, Node* index, int additional_offset = 0,
       ParameterMode parameter_mode = INTPTR_PARAMETERS,
       LoadSensitivity needs_poisoning = LoadSensitivity::kSafe);
 
-  TNode<Object> LoadFixedArrayElement(SloppyTNode<Object> object,
+  TNode<Object> LoadFixedArrayElement(SloppyTNode<HeapObject> object,
                                       TNode<IntPtrT> index,
                                       LoadSensitivity needs_poisoning) {
     return LoadFixedArrayElement(object, index, 0, INTPTR_PARAMETERS,
@@ -669,7 +972,7 @@ class V8_EXPORT_PRIVATE CodeStubAssembler : public compiler::CodeAssembler {
   }
 
   TNode<Object> LoadFixedArrayElement(
-      SloppyTNode<Object> object, TNode<IntPtrT> index,
+      SloppyTNode<HeapObject> object, TNode<IntPtrT> index,
       int additional_offset = 0,
       LoadSensitivity needs_poisoning = LoadSensitivity::kSafe) {
     return LoadFixedArrayElement(object, index, additional_offset,
@@ -677,43 +980,80 @@ class V8_EXPORT_PRIVATE CodeStubAssembler : public compiler::CodeAssembler {
   }
 
   TNode<Object> LoadFixedArrayElement(
-      SloppyTNode<Object> object, int index, int additional_offset = 0,
+      SloppyTNode<HeapObject> object, int index, int additional_offset = 0,
       LoadSensitivity needs_poisoning = LoadSensitivity::kSafe) {
     return LoadFixedArrayElement(object, IntPtrConstant(index),
                                  additional_offset, INTPTR_PARAMETERS,
                                  needs_poisoning);
   }
-  TNode<Object> LoadFixedArrayElement(TNode<Object> object, TNode<Smi> index) {
+  TNode<Object> LoadFixedArrayElement(TNode<HeapObject> object,
+                                      TNode<Smi> index) {
     return LoadFixedArrayElement(object, index, 0, SMI_PARAMETERS);
   }
+
+  TNode<Object> LoadPropertyArrayElement(SloppyTNode<PropertyArray> object,
+                                         SloppyTNode<IntPtrT> index);
+
+  // Load an array element from a FixedArray / WeakFixedArray, untag it and
+  // return it as Word32.
+  TNode<Int32T> LoadAndUntagToWord32ArrayElement(
+      SloppyTNode<HeapObject> object, int array_header_size, Node* index,
+      int additional_offset = 0,
+      ParameterMode parameter_mode = INTPTR_PARAMETERS);
+
   // Load an array element from a FixedArray, untag it and return it as Word32.
   TNode<Int32T> LoadAndUntagToWord32FixedArrayElement(
-      SloppyTNode<Object> object, Node* index, int additional_offset = 0,
+      SloppyTNode<HeapObject> object, Node* index, int additional_offset = 0,
       ParameterMode parameter_mode = INTPTR_PARAMETERS);
 
   TNode<Int32T> LoadAndUntagToWord32FixedArrayElement(
-      SloppyTNode<Object> object, int index, int additional_offset = 0) {
+      SloppyTNode<HeapObject> object, int index, int additional_offset = 0) {
     return LoadAndUntagToWord32FixedArrayElement(
         object, IntPtrConstant(index), additional_offset, INTPTR_PARAMETERS);
   }
 
+  // Load an array element from a WeakFixedArray.
+  TNode<MaybeObject> LoadWeakFixedArrayElement(
+      TNode<WeakFixedArray> object, Node* index, int additional_offset = 0,
+      ParameterMode parameter_mode = INTPTR_PARAMETERS,
+      LoadSensitivity needs_poisoning = LoadSensitivity::kSafe);
+
+  TNode<MaybeObject> LoadWeakFixedArrayElement(
+      TNode<WeakFixedArray> object, int index, int additional_offset = 0,
+      LoadSensitivity needs_poisoning = LoadSensitivity::kSafe) {
+    return LoadWeakFixedArrayElement(object, IntPtrConstant(index),
+                                     additional_offset, INTPTR_PARAMETERS,
+                                     needs_poisoning);
+  }
+
   // Load an array element from a FixedDoubleArray.
-  Node* LoadFixedDoubleArrayElement(
-      Node* object, Node* index, MachineType machine_type,
-      int additional_offset = 0,
+  TNode<Float64T> LoadFixedDoubleArrayElement(
+      SloppyTNode<FixedDoubleArray> object, Node* index,
+      MachineType machine_type, int additional_offset = 0,
       ParameterMode parameter_mode = INTPTR_PARAMETERS,
       Label* if_hole = nullptr);
 
+  Node* LoadFixedDoubleArrayElement(TNode<FixedDoubleArray> object,
+                                    TNode<Smi> index) {
+    return LoadFixedDoubleArrayElement(object, index, MachineType::Float64(), 0,
+                                       SMI_PARAMETERS);
+  }
+
   // Load a feedback slot from a FeedbackVector.
-  TNode<Object> LoadFeedbackVectorSlot(
+  TNode<MaybeObject> LoadFeedbackVectorSlot(
       Node* object, Node* index, int additional_offset = 0,
       ParameterMode parameter_mode = INTPTR_PARAMETERS);
 
+  TNode<IntPtrT> LoadFeedbackVectorLength(TNode<FeedbackVector>);
+  TNode<Float64T> LoadDoubleWithHoleCheck(TNode<FixedDoubleArray> array,
+                                          TNode<Smi> index,
+                                          Label* if_hole = nullptr);
+
   // Load Float64 value by |base| + |offset| address. If the value is a double
   // hole then jump to |if_hole|. If |machine_type| is None then only the hole
   // check is generated.
-  Node* LoadDoubleWithHoleCheck(
-      Node* base, Node* offset, Label* if_hole,
+  TNode<Float64T> LoadDoubleWithHoleCheck(
+      SloppyTNode<Object> base, SloppyTNode<IntPtrT> offset, Label* if_hole,
       MachineType machine_type = MachineType::Float64());
   TNode<RawPtrT> LoadFixedTypedArrayBackingStore(
       TNode<FixedTypedArrayBase> typed_array);
@@ -725,6 +1065,11 @@ class V8_EXPORT_PRIVATE CodeStubAssembler : public compiler::CodeAssembler {
   Node* LoadFixedBigUint64ArrayElementAsTagged(Node* data_pointer,
                                                Node* offset);
 
+  void StoreFixedTypedArrayElementFromTagged(
+      TNode<Context> context, TNode<FixedTypedArrayBase> elements,
+      TNode<Object> index_node, TNode<Object> value, ElementsKind elements_kind,
+      ParameterMode parameter_mode);
+
   // Context manipulation
   TNode<Object> LoadContextElement(SloppyTNode<Context> context,
                                    int slot_index);
@@ -758,9 +1103,14 @@ class V8_EXPORT_PRIVATE CodeStubAssembler : public compiler::CodeAssembler {
 
   Node* LoadSharedFunctionInfoBytecodeArray(Node* shared);
 
+  void StoreObjectByteNoWriteBarrier(TNode<HeapObject> object, int offset,
+                                     TNode<Word32T> value);
+
   // Store the floating point value of a HeapNumber.
   void StoreHeapNumberValue(SloppyTNode<HeapNumber> object,
                             SloppyTNode<Float64T> value);
+  void StoreMutableHeapNumberValue(SloppyTNode<MutableHeapNumber> object,
+                                   SloppyTNode<Float64T> value);
   // Store a field to an object on the heap.
   Node* StoreObjectField(Node* object, int offset, Node* value);
   Node* StoreObjectField(Node* object, Node* offset, Node* value);
@@ -846,10 +1196,16 @@ class V8_EXPORT_PRIVATE CodeStubAssembler : public compiler::CodeAssembler {
                        WriteBarrierMode mode = UPDATE_WRITE_BARRIER);
 
   // Allocate a HeapNumber without initializing its value.
-  TNode<HeapNumber> AllocateHeapNumber(MutableMode mode = IMMUTABLE);
+  TNode<HeapNumber> AllocateHeapNumber();
   // Allocate a HeapNumber with a specific value.
-  TNode<HeapNumber> AllocateHeapNumberWithValue(SloppyTNode<Float64T> value,
-                                                MutableMode mode = IMMUTABLE);
+  TNode<HeapNumber> AllocateHeapNumberWithValue(SloppyTNode<Float64T> value);
+  TNode<HeapNumber> AllocateHeapNumberWithValue(double value) {
+    return AllocateHeapNumberWithValue(Float64Constant(value));
+  }
+
+  // Allocate a MutableHeapNumber with a specific value.
+  TNode<MutableHeapNumber> AllocateMutableHeapNumberWithValue(
+      SloppyTNode<Float64T> value);
 
   // Allocate a BigInt with {length} digits. Sets the sign bit to {false}.
   // Does not initialize the digits.
@@ -862,11 +1218,6 @@ class V8_EXPORT_PRIVATE CodeStubAssembler : public compiler::CodeAssembler {
   TNode<WordT> LoadBigIntBitfield(TNode<BigInt> bigint);
   TNode<UintPtrT> LoadBigIntDigit(TNode<BigInt> bigint, int digit_index);
 
-  TNode<HeapNumber> AllocateHeapNumberWithValue(double value,
-                                                MutableMode mode = IMMUTABLE) {
-    return AllocateHeapNumberWithValue(Float64Constant(value), mode);
-  }
-
   // Allocate a SeqOneByteString with the given length.
   TNode<String> AllocateSeqOneByteString(int length,
                                          AllocationFlags flags = kNone);
@@ -911,10 +1262,34 @@ class V8_EXPORT_PRIVATE CodeStubAssembler : public compiler::CodeAssembler {
                               TNode<String> left, TNode<String> right,
                               AllocationFlags flags = kNone);
 
-  Node* AllocateNameDictionary(int at_least_space_for);
-  Node* AllocateNameDictionary(Node* at_least_space_for);
-  Node* AllocateNameDictionaryWithCapacity(Node* capacity);
-  Node* CopyNameDictionary(Node* dictionary, Label* large_object_fallback);
+  TNode<NameDictionary> AllocateNameDictionary(int at_least_space_for);
+  TNode<NameDictionary> AllocateNameDictionary(
+      TNode<IntPtrT> at_least_space_for);
+  TNode<NameDictionary> AllocateNameDictionaryWithCapacity(
+      TNode<IntPtrT> capacity);
+  TNode<NameDictionary> CopyNameDictionary(TNode<NameDictionary> dictionary,
+                                           Label* large_object_fallback);
+
+  template <typename CollectionType>
+  Node* AllocateOrderedHashTable();
+
+  // Builds code that finds OrderedHashTable entry for a key with hash code
+  // {hash} with using the comparison code generated by {key_compare}. The code
+  // jumps to {entry_found} if the key is found, or to {not_found} if the key
+  // was not found. In the {entry_found} branch, the variable
+  // entry_start_position will be bound to the index of the entry (relative to
+  // OrderedHashTable::kHashTableStartIndex).
+  //
+  // The {CollectionType} template parameter stands for the particular instance
+  // of OrderedHashTable, it should be OrderedHashMap or OrderedHashSet.
+  template <typename CollectionType>
+  void FindOrderedHashTableEntry(
+      Node* table, Node* hash,
+      std::function<void(Node*, Label*, Label*)> key_compare,
+      Variable* entry_start_position, Label* entry_found, Label* not_found);
+
+  template <typename CollectionType>
+  TNode<CollectionType> AllocateSmallOrderedHashTable(TNode<IntPtrT> capacity);
 
   Node* AllocateStruct(Node* map, AllocationFlags flags = kNone);
   void InitializeStructBody(Node* object, Node* map, Node* size,
@@ -972,19 +1347,16 @@ class V8_EXPORT_PRIVATE CodeStubAssembler : public compiler::CodeAssembler {
                            Node* capacity = nullptr,
                            Node* allocation_site = nullptr);
 
-  Node* AllocateFixedArray(ElementsKind kind, Node* capacity,
-                           ParameterMode mode = INTPTR_PARAMETERS,
-                           AllocationFlags flags = kNone,
-                           Node* fixed_array_map = nullptr);
-
-  Node* AllocateFixedArray(ElementsKind kind, TNode<Smi> capacity,
-                           AllocationFlags flags = kNone) {
-    return AllocateFixedArray(kind, capacity, SMI_PARAMETERS, flags);
-  }
+  TNode<FixedArray> AllocateFixedArray(
+      ElementsKind kind, Node* capacity, ParameterMode mode = INTPTR_PARAMETERS,
+      AllocationFlags flags = kNone,
+      SloppyTNode<Map> fixed_array_map = nullptr);
 
-  Node* AllocateFixedArray(ElementsKind kind, TNode<Smi> capacity,
-                           TNode<Map> map, AllocationFlags flags = kNone) {
-    return AllocateFixedArray(kind, capacity, SMI_PARAMETERS, flags, map);
+  TNode<FixedArray> AllocateFixedArray(
+      ElementsKind kind, TNode<IntPtrT> capacity, AllocationFlags flags,
+      SloppyTNode<Map> fixed_array_map = nullptr) {
+    return AllocateFixedArray(kind, capacity, INTPTR_PARAMETERS, flags,
+                              fixed_array_map);
   }
 
   Node* AllocatePropertyArray(Node* capacity,
@@ -992,7 +1364,9 @@ class V8_EXPORT_PRIVATE CodeStubAssembler : public compiler::CodeAssembler {
                               AllocationFlags flags = kNone);
 
   // Perform CreateArrayIterator (ES #sec-createarrayiterator).
-  Node* CreateArrayIterator(Node* context, Node* object, IterationKind mode);
+  TNode<JSArrayIterator> CreateArrayIterator(TNode<Context> context,
+                                             TNode<Object> object,
+                                             IterationKind mode);
 
   Node* AllocateJSIteratorResult(Node* context, Node* value, Node* done);
   Node* AllocateJSIteratorResultForEntry(Node* context, Node* key, Node* value);
@@ -1217,7 +1591,7 @@ class V8_EXPORT_PRIVATE CodeStubAssembler : public compiler::CodeAssembler {
                                    Variable* var_numeric,
                                    Variable* var_feedback);
 
-  Node* TimesPointerSize(Node* value);
+  SloppyTNode<WordT> TimesPointerSize(Node* value);
 
   // Type conversions.
   // Throws a TypeError for {method_name} if {value} is not coercible to Object,
@@ -1253,106 +1627,122 @@ class V8_EXPORT_PRIVATE CodeStubAssembler : public compiler::CodeAssembler {
   // Check whether the map is for an object with special properties, such as a
   // JSProxy or an object with interceptors.
   TNode<BoolT> InstanceTypeEqual(SloppyTNode<Int32T> instance_type, int type);
-  Node* IsAccessorInfo(Node* object);
-  Node* IsAccessorPair(Node* object);
-  Node* IsAllocationSite(Node* object);
-  Node* IsAnyHeapNumber(Node* object);
-  Node* IsNoElementsProtectorCellInvalid();
-  Node* IsBigIntInstanceType(Node* instance_type);
-  Node* IsBigInt(Node* object);
-  Node* IsBoolean(Node* object);
-  Node* IsCallableMap(Node* map);
-  Node* IsCallable(Node* object);
-  Node* IsCell(Node* object);
-  Node* IsCode(Node* object);
-  Node* IsConsStringInstanceType(Node* instance_type);
-  Node* IsConstructorMap(Node* map);
-  Node* IsConstructor(Node* object);
-  Node* IsDeprecatedMap(Node* map);
-  Node* IsDictionary(Node* object);
-  Node* IsExtensibleMap(Node* map);
-  Node* IsExternalStringInstanceType(Node* instance_type);
+  TNode<BoolT> IsAccessorInfo(SloppyTNode<HeapObject> object);
+  TNode<BoolT> IsAccessorPair(SloppyTNode<HeapObject> object);
+  TNode<BoolT> IsAllocationSite(SloppyTNode<HeapObject> object);
+  TNode<BoolT> IsAnyHeapNumber(SloppyTNode<HeapObject> object);
+  TNode<BoolT> IsNoElementsProtectorCellInvalid();
+  TNode<BoolT> IsBigIntInstanceType(SloppyTNode<Int32T> instance_type);
+  TNode<BoolT> IsBigInt(SloppyTNode<HeapObject> object);
+  TNode<BoolT> IsBoolean(SloppyTNode<HeapObject> object);
+  TNode<BoolT> IsCallableMap(SloppyTNode<Map> map);
+  TNode<BoolT> IsCallable(SloppyTNode<HeapObject> object);
+  TNode<BoolT> TaggedIsCallable(TNode<Object> object);
+  TNode<BoolT> IsCell(SloppyTNode<HeapObject> object);
+  TNode<BoolT> IsCode(SloppyTNode<HeapObject> object);
+  TNode<BoolT> IsConsStringInstanceType(SloppyTNode<Int32T> instance_type);
+  TNode<BoolT> IsConstructorMap(SloppyTNode<Map> map);
+  TNode<BoolT> IsConstructor(SloppyTNode<HeapObject> object);
+  TNode<BoolT> IsDeprecatedMap(SloppyTNode<Map> map);
+  TNode<BoolT> IsNameDictionary(SloppyTNode<HeapObject> object);
+  TNode<BoolT> IsGlobalDictionary(SloppyTNode<HeapObject> object);
+  TNode<BoolT> IsExtensibleMap(SloppyTNode<Map> map);
+  TNode<BoolT> IsExternalStringInstanceType(SloppyTNode<Int32T> instance_type);
   TNode<BoolT> IsFastJSArray(SloppyTNode<Object> object,
                              SloppyTNode<Context> context);
   TNode<BoolT> IsFastJSArrayWithNoCustomIteration(
       TNode<Object> object, TNode<Context> context,
       TNode<Context> native_context);
-  Node* IsFeedbackCell(Node* object);
-  Node* IsFeedbackVector(Node* object);
-  Node* IsContext(Node* object);
-  Node* IsFixedArray(Node* object);
-  Node* IsFixedArraySubclass(Node* object);
-  Node* IsFixedArrayWithKind(Node* object, ElementsKind kind);
-  Node* IsFixedArrayWithKindOrEmpty(Node* object, ElementsKind kind);
-  Node* IsFixedDoubleArray(Node* object);
-  Node* IsFixedTypedArray(Node* object);
-  Node* IsFunctionWithPrototypeSlotMap(Node* map);
-  Node* IsHashTable(Node* object);
-  TNode<BoolT> IsHeapNumber(Node* object);
-  Node* IsIndirectStringInstanceType(Node* instance_type);
-  Node* IsJSArrayBuffer(Node* object);
-  Node* IsJSArrayInstanceType(Node* instance_type);
-  Node* IsJSArrayMap(Node* object);
-  Node* IsJSArray(Node* object);
-  Node* IsJSArrayIterator(Node* object);
-  Node* IsJSAsyncGeneratorObject(Node* object);
-  Node* IsJSFunctionInstanceType(Node* instance_type);
-  Node* IsJSFunctionMap(Node* object);
-  Node* IsJSFunction(Node* object);
-  Node* IsJSGeneratorObject(Node* object);
-  Node* IsJSGlobalProxyInstanceType(Node* instance_type);
-  Node* IsJSGlobalProxy(Node* object);
-  Node* IsJSObjectInstanceType(Node* instance_type);
-  Node* IsJSObjectMap(Node* map);
-  Node* IsJSObject(Node* object);
-  Node* IsJSPromiseMap(Node* map);
-  Node* IsJSPromise(Node* object);
-  Node* IsJSProxy(Node* object);
-  Node* IsJSReceiverInstanceType(Node* instance_type);
-  Node* IsJSReceiverMap(Node* map);
-  Node* IsJSReceiver(Node* object);
-  Node* IsJSRegExp(Node* object);
-  Node* IsJSTypedArray(Node* object);
-  Node* IsJSValueInstanceType(Node* instance_type);
-  Node* IsJSValueMap(Node* map);
-  Node* IsJSValue(Node* object);
-  Node* IsMap(Node* object);
-  Node* IsMutableHeapNumber(Node* object);
-  Node* IsName(Node* object);
-  Node* IsNativeContext(Node* object);
-  Node* IsNullOrJSReceiver(Node* object);
-  Node* IsNullOrUndefined(Node* object);
-  Node* IsNumberDictionary(Node* object);
-  Node* IsOneByteStringInstanceType(Node* instance_type);
-  Node* IsPrimitiveInstanceType(Node* instance_type);
-  TNode<BoolT> IsPrivateSymbol(Node* object);
-  Node* IsPromiseCapability(Node* object);
-  Node* IsPropertyArray(Node* object);
-  Node* IsPropertyCell(Node* object);
-  Node* IsPrototypeInitialArrayPrototype(Node* context, Node* map);
+  TNode<BoolT> IsFeedbackCell(SloppyTNode<HeapObject> object);
+  TNode<BoolT> IsFeedbackVector(SloppyTNode<HeapObject> object);
+  TNode<BoolT> IsContext(SloppyTNode<HeapObject> object);
+  TNode<BoolT> IsFixedArray(SloppyTNode<HeapObject> object);
+  TNode<BoolT> IsFixedArraySubclass(SloppyTNode<HeapObject> object);
+  TNode<BoolT> IsFixedArrayWithKind(SloppyTNode<HeapObject> object,
+                                    ElementsKind kind);
+  TNode<BoolT> IsFixedArrayWithKindOrEmpty(SloppyTNode<HeapObject> object,
+                                           ElementsKind kind);
+  TNode<BoolT> IsFixedDoubleArray(SloppyTNode<HeapObject> object);
+  TNode<BoolT> IsFixedTypedArray(SloppyTNode<HeapObject> object);
+  TNode<BoolT> IsFunctionWithPrototypeSlotMap(SloppyTNode<Map> map);
+  TNode<BoolT> IsHashTable(SloppyTNode<HeapObject> object);
+  TNode<BoolT> IsEphemeronHashTable(SloppyTNode<HeapObject> object);
+  TNode<BoolT> IsHeapNumber(SloppyTNode<HeapObject> object);
+  TNode<BoolT> IsIndirectStringInstanceType(SloppyTNode<Int32T> instance_type);
+  TNode<BoolT> IsJSArrayBuffer(SloppyTNode<HeapObject> object);
+  TNode<BoolT> IsJSDataView(TNode<HeapObject> object);
+  TNode<BoolT> IsJSArrayInstanceType(SloppyTNode<Int32T> instance_type);
+  TNode<BoolT> IsJSArrayMap(SloppyTNode<Map> map);
+  TNode<BoolT> IsJSArray(SloppyTNode<HeapObject> object);
+  TNode<BoolT> IsJSArrayIterator(SloppyTNode<HeapObject> object);
+  TNode<BoolT> IsJSAsyncGeneratorObject(SloppyTNode<HeapObject> object);
+  TNode<BoolT> IsJSFunctionInstanceType(SloppyTNode<Int32T> instance_type);
+  TNode<BoolT> IsAllocationSiteInstanceType(SloppyTNode<Int32T> instance_type);
+  TNode<BoolT> IsJSFunctionMap(SloppyTNode<Map> map);
+  TNode<BoolT> IsJSFunction(SloppyTNode<HeapObject> object);
+  TNode<BoolT> IsJSGeneratorObject(SloppyTNode<HeapObject> object);
+  TNode<BoolT> IsJSGlobalProxyInstanceType(SloppyTNode<Int32T> instance_type);
+  TNode<BoolT> IsJSGlobalProxy(SloppyTNode<HeapObject> object);
+  TNode<BoolT> IsJSObjectInstanceType(SloppyTNode<Int32T> instance_type);
+  TNode<BoolT> IsJSObjectMap(SloppyTNode<Map> map);
+  TNode<BoolT> IsJSObject(SloppyTNode<HeapObject> object);
+  TNode<BoolT> IsJSPromiseMap(SloppyTNode<Map> map);
+  TNode<BoolT> IsJSPromise(SloppyTNode<HeapObject> object);
+  TNode<BoolT> IsJSProxy(SloppyTNode<HeapObject> object);
+  TNode<BoolT> IsJSReceiverInstanceType(SloppyTNode<Int32T> instance_type);
+  TNode<BoolT> IsJSReceiverMap(SloppyTNode<Map> map);
+  TNode<BoolT> IsJSReceiver(SloppyTNode<HeapObject> object);
+  TNode<BoolT> IsJSRegExp(SloppyTNode<HeapObject> object);
+  TNode<BoolT> IsJSTypedArray(SloppyTNode<HeapObject> object);
+  TNode<BoolT> IsJSValueInstanceType(SloppyTNode<Int32T> instance_type);
+  TNode<BoolT> IsJSValueMap(SloppyTNode<Map> map);
+  TNode<BoolT> IsJSValue(SloppyTNode<HeapObject> object);
+  TNode<BoolT> IsMap(SloppyTNode<HeapObject> object);
+  TNode<BoolT> IsMutableHeapNumber(SloppyTNode<HeapObject> object);
+  TNode<BoolT> IsName(SloppyTNode<HeapObject> object);
+  TNode<BoolT> IsNativeContext(SloppyTNode<HeapObject> object);
+  TNode<BoolT> IsNullOrJSReceiver(SloppyTNode<HeapObject> object);
+  TNode<BoolT> IsNullOrUndefined(SloppyTNode<Object> object);
+  TNode<BoolT> IsNumberDictionary(SloppyTNode<HeapObject> object);
+  TNode<BoolT> IsOneByteStringInstanceType(SloppyTNode<Int32T> instance_type);
+  TNode<BoolT> IsPrimitiveInstanceType(SloppyTNode<Int32T> instance_type);
+  TNode<BoolT> IsPrivateSymbol(SloppyTNode<HeapObject> object);
+  TNode<BoolT> IsPromiseCapability(SloppyTNode<HeapObject> object);
+  TNode<BoolT> IsPropertyArray(SloppyTNode<HeapObject> object);
+  TNode<BoolT> IsPropertyCell(SloppyTNode<HeapObject> object);
+  TNode<BoolT> IsPrototypeInitialArrayPrototype(SloppyTNode<Context> context,
+                                                SloppyTNode<Map> map);
   TNode<BoolT> IsPrototypeTypedArrayPrototype(SloppyTNode<Context> context,
                                               SloppyTNode<Map> map);
-  Node* IsSequentialStringInstanceType(Node* instance_type);
-  Node* IsShortExternalStringInstanceType(Node* instance_type);
-  TNode<BoolT> IsSpecialReceiverInstanceType(Node* instance_type);
-  Node* IsSpecialReceiverMap(Node* map);
-  Node* IsStringInstanceType(Node* instance_type);
-  Node* IsString(Node* object);
-  Node* IsSymbolInstanceType(Node* instance_type);
-  Node* IsSymbol(Node* object);
-  Node* IsUndetectableMap(Node* map);
-  Node* IsWeakCell(Node* object);
-  Node* IsZeroOrContext(Node* object);
+  TNode<BoolT> IsSequentialStringInstanceType(
+      SloppyTNode<Int32T> instance_type);
+  TNode<BoolT> IsShortExternalStringInstanceType(
+      SloppyTNode<Int32T> instance_type);
+  TNode<BoolT> IsSpecialReceiverInstanceType(TNode<Int32T> instance_type);
+  TNode<BoolT> IsCustomElementsReceiverInstanceType(
+      TNode<Int32T> instance_type);
+  TNode<BoolT> IsSpecialReceiverMap(SloppyTNode<Map> map);
+  // Returns true if the map corresponds to non-special fast or dictionary
+  // object.
+  TNode<BoolT> IsSimpleObjectMap(TNode<Map> map);
+  TNode<BoolT> IsStringInstanceType(SloppyTNode<Int32T> instance_type);
+  TNode<BoolT> IsString(SloppyTNode<HeapObject> object);
+  TNode<BoolT> IsSymbolInstanceType(SloppyTNode<Int32T> instance_type);
+  TNode<BoolT> IsSymbol(SloppyTNode<HeapObject> object);
+  TNode<BoolT> IsUndetectableMap(SloppyTNode<Map> map);
+  TNode<BoolT> IsWeakCell(SloppyTNode<HeapObject> object);
+  TNode<BoolT> IsNotWeakFixedArraySubclass(SloppyTNode<HeapObject> object);
+  TNode<BoolT> IsZeroOrContext(SloppyTNode<Object> object);
 
   inline Node* IsSharedFunctionInfo(Node* object) {
     return IsSharedFunctionInfoMap(LoadMap(object));
   }
 
-  Node* IsPromiseResolveProtectorCellInvalid();
-  Node* IsPromiseThenProtectorCellInvalid();
-  Node* IsArraySpeciesProtectorCellInvalid();
-  Node* IsTypedArraySpeciesProtectorCellInvalid();
-  Node* IsPromiseSpeciesProtectorCellInvalid();
+  TNode<BoolT> IsPromiseResolveProtectorCellInvalid();
+  TNode<BoolT> IsPromiseThenProtectorCellInvalid();
+  TNode<BoolT> IsArraySpeciesProtectorCellInvalid();
+  TNode<BoolT> IsTypedArraySpeciesProtectorCellInvalid();
+  TNode<BoolT> IsPromiseSpeciesProtectorCellInvalid();
 
   // True iff |object| is a Smi or a HeapNumber.
   TNode<BoolT> IsNumber(SloppyTNode<Object> object);
@@ -1363,16 +1753,43 @@ class V8_EXPORT_PRIVATE CodeStubAssembler : public compiler::CodeAssembler {
   // within Smi range.
   TNode<BoolT> IsNumberNormalized(SloppyTNode<Number> number);
   TNode<BoolT> IsNumberPositive(SloppyTNode<Number> number);
+  TNode<BoolT> IsHeapNumberPositive(TNode<HeapNumber> number);
+
+  // True iff {number} is non-negative and less or equal than 2**53-1.
+  TNode<BoolT> IsNumberNonNegativeSafeInteger(TNode<Number> number);
+
+  // True iff {number} represents an integer value.
+  TNode<BoolT> IsInteger(TNode<Object> number);
+  TNode<BoolT> IsInteger(TNode<HeapNumber> number);
+
+  // True iff abs({number}) <= 2**53 -1
+  TNode<BoolT> IsSafeInteger(TNode<Object> number);
+  TNode<BoolT> IsSafeInteger(TNode<HeapNumber> number);
+
+  // True iff {number} represents a valid uint32t value.
+  TNode<BoolT> IsHeapNumberUint32(TNode<HeapNumber> number);
+
   // True iff {number} is a positive number and a valid array index in the range
   // [0, 2^32-1).
-  TNode<BoolT> IsNumberArrayIndex(SloppyTNode<Number> number);
+  TNode<BoolT> IsNumberArrayIndex(TNode<Number> number);
 
   Node* FixedArraySizeDoesntFitInNewSpace(
       Node* element_count, int base_size = FixedArray::kHeaderSize,
       ParameterMode mode = INTPTR_PARAMETERS);
 
   // ElementsKind helpers:
+  TNode<BoolT> ElementsKindEqual(TNode<Int32T> a, TNode<Int32T> b) {
+    return Word32Equal(a, b);
+  }
+  bool ElementsKindEqual(ElementsKind a, ElementsKind b) { return a == b; }
   Node* IsFastElementsKind(Node* elements_kind);
+  bool IsFastElementsKind(ElementsKind kind) {
+    return v8::internal::IsFastElementsKind(kind);
+  }
+  TNode<BoolT> IsDoubleElementsKind(TNode<Int32T> elements_kind);
+  bool IsDoubleElementsKind(ElementsKind kind) {
+    return v8::internal::IsDoubleElementsKind(kind);
+  }
   Node* IsFastSmiOrTaggedElementsKind(Node* elements_kind);
   Node* IsFastSmiElementsKind(Node* elements_kind);
   Node* IsHoleyFastElementsKind(Node* elements_kind);
@@ -1387,7 +1804,7 @@ class V8_EXPORT_PRIVATE CodeStubAssembler : public compiler::CodeAssembler {
   TNode<String> StringFromSingleCharCode(TNode<Int32T> code);
 
   // Return a new string object which holds a substring containing the range
-  // [from,to[ of string.  |from| and |to| are expected to be tagged.
+  // [from,to[ of string.
   TNode<String> SubString(TNode<String> string, TNode<IntPtrT> from,
                           TNode<IntPtrT> to);
 
@@ -1528,13 +1945,14 @@ class V8_EXPORT_PRIVATE CodeStubAssembler : public compiler::CodeAssembler {
 
   // Returns a node that contains the updated values of a |BitField|.
   template <typename BitField>
-  Node* UpdateWord(Node* word, Node* value) {
+  TNode<WordT> UpdateWord(TNode<WordT> word, TNode<WordT> value) {
     return UpdateWord(word, value, BitField::kShift, BitField::kMask);
   }
 
   // Returns a node that contains the updated {value} inside {word} starting
   // at {shift} and fitting in {mask}.
-  Node* UpdateWord(Node* word, Node* value, uint32_t shift, uint32_t mask);
+  TNode<WordT> UpdateWord(TNode<WordT> word, TNode<WordT> value, uint32_t shift,
+                          uint32_t mask);
 
   // Returns true if any of the |T|'s bits in given |word32| are set.
   template <typename T>
@@ -1556,18 +1974,18 @@ class V8_EXPORT_PRIVATE CodeStubAssembler : public compiler::CodeAssembler {
 
   // Returns true if any of the |T|'s bits in given |word| are set.
   template <typename T>
-  Node* IsSetWord(Node* word) {
+  TNode<BoolT> IsSetWord(SloppyTNode<WordT> word) {
     return IsSetWord(word, T::kMask);
   }
 
   // Returns true if any of the mask's bits in given |word| are set.
-  Node* IsSetWord(Node* word, uint32_t mask) {
+  TNode<BoolT> IsSetWord(SloppyTNode<WordT> word, uint32_t mask) {
     return WordNotEqual(WordAnd(word, IntPtrConstant(mask)), IntPtrConstant(0));
   }
 
   // Returns true if any of the mask's bit are set in the given Smi.
   // Smi-encoding of the mask is performed implicitly!
-  Node* IsSetSmi(Node* smi, int untagged_mask) {
+  TNode<BoolT> IsSetSmi(SloppyTNode<Smi> smi, int untagged_mask) {
     intptr_t mask_word = bit_cast<intptr_t>(Smi::FromInt(untagged_mask));
     return WordNotEqual(
         WordAnd(BitcastTaggedToWord(smi), IntPtrConstant(mask_word)),
@@ -1576,24 +1994,24 @@ class V8_EXPORT_PRIVATE CodeStubAssembler : public compiler::CodeAssembler {
 
   // Returns true if all of the |T|'s bits in given |word32| are clear.
   template <typename T>
-  Node* IsClearWord32(Node* word32) {
+  TNode<BoolT> IsClearWord32(SloppyTNode<Word32T> word32) {
     return IsClearWord32(word32, T::kMask);
   }
 
   // Returns true if all of the mask's bits in given |word32| are clear.
-  Node* IsClearWord32(Node* word32, uint32_t mask) {
+  TNode<BoolT> IsClearWord32(SloppyTNode<Word32T> word32, uint32_t mask) {
     return Word32Equal(Word32And(word32, Int32Constant(mask)),
                        Int32Constant(0));
   }
 
   // Returns true if all of the |T|'s bits in given |word| are clear.
   template <typename T>
-  Node* IsClearWord(Node* word) {
+  TNode<BoolT> IsClearWord(SloppyTNode<WordT> word) {
     return IsClearWord(word, T::kMask);
   }
 
   // Returns true if all of the mask's bits in given |word| are clear.
-  Node* IsClearWord(Node* word, uint32_t mask) {
+  TNode<BoolT> IsClearWord(SloppyTNode<WordT> word, uint32_t mask) {
     return WordEqual(WordAnd(word, IntPtrConstant(mask)), IntPtrConstant(0));
   }
 
@@ -1636,9 +2054,9 @@ class V8_EXPORT_PRIVATE CodeStubAssembler : public compiler::CodeAssembler {
   // Calculates array index for given dictionary entry and entry field.
   // See Dictionary::EntryToIndex().
   template <typename Dictionary>
-  Node* EntryToIndex(Node* entry, int field_index);
+  TNode<IntPtrT> EntryToIndex(TNode<IntPtrT> entry, int field_index);
   template <typename Dictionary>
-  Node* EntryToIndex(Node* entry) {
+  TNode<IntPtrT> EntryToIndex(TNode<IntPtrT> entry) {
     return EntryToIndex<Dictionary>(entry, Dictionary::kEntryKeyIndex);
   }
 
@@ -1646,6 +2064,8 @@ class V8_EXPORT_PRIVATE CodeStubAssembler : public compiler::CodeAssembler {
   // Returns an untagged int32.
   template <class ContainerType>
   TNode<Uint32T> LoadDetailsByKeyIndex(Node* container, Node* key_index) {
+    static_assert(!std::is_same<ContainerType, DescriptorArray>::value,
+                  "Use the non-templatized version for DescriptorArray");
     const int kKeyToDetailsOffset =
         (ContainerType::kEntryDetailsIndex - ContainerType::kEntryKeyIndex) *
         kPointerSize;
@@ -1657,6 +2077,8 @@ class V8_EXPORT_PRIVATE CodeStubAssembler : public compiler::CodeAssembler {
   // Returns a tagged value.
   template <class ContainerType>
   TNode<Object> LoadValueByKeyIndex(Node* container, Node* key_index) {
+    static_assert(!std::is_same<ContainerType, DescriptorArray>::value,
+                  "Use the non-templatized version for DescriptorArray");
     const int kKeyToValueOffset =
         (ContainerType::kEntryValueIndex - ContainerType::kEntryKeyIndex) *
         kPointerSize;
@@ -1664,6 +2086,13 @@ class V8_EXPORT_PRIVATE CodeStubAssembler : public compiler::CodeAssembler {
         LoadFixedArrayElement(container, key_index, kKeyToValueOffset));
   }
 
+  TNode<Uint32T> LoadDetailsByKeyIndex(TNode<DescriptorArray> container,
+                                       TNode<IntPtrT> key_index);
+  TNode<Object> LoadValueByKeyIndex(TNode<DescriptorArray> container,
+                                    TNode<IntPtrT> key_index);
+  TNode<MaybeObject> LoadFieldTypeByKeyIndex(TNode<DescriptorArray> container,
+                                             TNode<IntPtrT> key_index);
+
   // Stores the details for the entry with the given key_index.
   // |details| must be a Smi.
   template <class ContainerType>
@@ -1688,44 +2117,52 @@ class V8_EXPORT_PRIVATE CodeStubAssembler : public compiler::CodeAssembler {
   }
 
   // Calculate a valid size for the a hash table.
-  TNode<IntPtrT> HashTableComputeCapacity(
-      SloppyTNode<IntPtrT> at_least_space_for);
+  TNode<IntPtrT> HashTableComputeCapacity(TNode<IntPtrT> at_least_space_for);
 
   template <class Dictionary>
-  Node* GetNumberOfElements(Node* dictionary) {
-    return LoadFixedArrayElement(dictionary,
-                                 Dictionary::kNumberOfElementsIndex);
+  TNode<Smi> GetNumberOfElements(TNode<Dictionary> dictionary) {
+    return CAST(
+        LoadFixedArrayElement(dictionary, Dictionary::kNumberOfElementsIndex));
   }
 
   template <class Dictionary>
-  void SetNumberOfElements(Node* dictionary, Node* num_elements_smi) {
+  void SetNumberOfElements(TNode<Dictionary> dictionary,
+                           TNode<Smi> num_elements_smi) {
     StoreFixedArrayElement(dictionary, Dictionary::kNumberOfElementsIndex,
                            num_elements_smi, SKIP_WRITE_BARRIER);
   }
 
   template <class Dictionary>
-  Node* GetNumberOfDeletedElements(Node* dictionary) {
-    return LoadFixedArrayElement(dictionary,
-                                 Dictionary::kNumberOfDeletedElementsIndex);
+  TNode<Smi> GetNumberOfDeletedElements(TNode<Dictionary> dictionary) {
+    return CAST(LoadFixedArrayElement(
+        dictionary, Dictionary::kNumberOfDeletedElementsIndex));
   }
 
   template <class Dictionary>
-  void SetNumberOfDeletedElements(Node* dictionary, Node* num_deleted_smi) {
+  void SetNumberOfDeletedElements(TNode<Dictionary> dictionary,
+                                  TNode<Smi> num_deleted_smi) {
     StoreFixedArrayElement(dictionary,
                            Dictionary::kNumberOfDeletedElementsIndex,
                            num_deleted_smi, SKIP_WRITE_BARRIER);
   }
 
   template <class Dictionary>
-  Node* GetCapacity(Node* dictionary) {
-    return LoadFixedArrayElement(dictionary, Dictionary::kCapacityIndex);
+  TNode<Smi> GetCapacity(TNode<Dictionary> dictionary) {
+    return CAST(LoadFixedArrayElement(dictionary, Dictionary::kCapacityIndex));
   }
 
   template <class Dictionary>
-  Node* GetNextEnumerationIndex(Node* dictionary);
+  TNode<Smi> GetNextEnumerationIndex(TNode<Dictionary> dictionary) {
+    return CAST(LoadFixedArrayElement(dictionary,
+                                      Dictionary::kNextEnumerationIndexIndex));
+  }
 
   template <class Dictionary>
-  void SetNextEnumerationIndex(Node* dictionary, Node* next_enum_index_smi);
+  void SetNextEnumerationIndex(TNode<Dictionary> dictionary,
+                               TNode<Smi> next_enum_index_smi) {
+    StoreFixedArrayElement(dictionary, Dictionary::kNextEnumerationIndexIndex,
+                           next_enum_index_smi, SKIP_WRITE_BARRIER);
+  }
 
   // Looks up an entry in a NameDictionaryBase successor. If the entry is found
   // control goes to {if_found} and {var_name_index} contains an index of the
@@ -1735,11 +2172,12 @@ class V8_EXPORT_PRIVATE CodeStubAssembler : public compiler::CodeAssembler {
   enum LookupMode { kFindExisting, kFindInsertionIndex };
 
   template <typename Dictionary>
-  Node* LoadName(Node* key);
+  TNode<HeapObject> LoadName(TNode<HeapObject> key);
 
   template <typename Dictionary>
-  void NameDictionaryLookup(Node* dictionary, Node* unique_name,
-                            Label* if_found, Variable* var_name_index,
+  void NameDictionaryLookup(TNode<Dictionary> dictionary,
+                            TNode<Name> unique_name, Label* if_found,
+                            TVariable<IntPtrT>* var_name_index,
                             Label* if_not_found,
                             int inlined_probes = kInlinedDictionaryProbes,
                             LookupMode mode = kFindExisting);
@@ -1747,19 +2185,31 @@ class V8_EXPORT_PRIVATE CodeStubAssembler : public compiler::CodeAssembler {
   Node* ComputeIntegerHash(Node* key);
   Node* ComputeIntegerHash(Node* key, Node* seed);
 
-  void NumberDictionaryLookup(Node* dictionary, Node* intptr_index,
-                              Label* if_found, Variable* var_entry,
+  void NumberDictionaryLookup(TNode<NumberDictionary> dictionary,
+                              TNode<IntPtrT> intptr_index, Label* if_found,
+                              TVariable<IntPtrT>* var_entry,
                               Label* if_not_found);
 
+  TNode<Object> BasicLoadNumberDictionaryElement(
+      TNode<NumberDictionary> dictionary, TNode<IntPtrT> intptr_index,
+      Label* not_data, Label* if_hole);
+  void BasicStoreNumberDictionaryElement(TNode<NumberDictionary> dictionary,
+                                         TNode<IntPtrT> intptr_index,
+                                         TNode<Object> value, Label* not_data,
+                                         Label* if_hole, Label* read_only);
+
   template <class Dictionary>
-  void FindInsertionEntry(Node* dictionary, Node* key, Variable* var_key_index);
+  void FindInsertionEntry(TNode<Dictionary> dictionary, TNode<Name> key,
+                          TVariable<IntPtrT>* var_key_index);
 
   template <class Dictionary>
-  void InsertEntry(Node* dictionary, Node* key, Node* value, Node* index,
-                   Node* enum_index);
+  void InsertEntry(TNode<Dictionary> dictionary, TNode<Name> key,
+                   TNode<Object> value, TNode<IntPtrT> index,
+                   TNode<Smi> enum_index);
 
   template <class Dictionary>
-  void Add(Node* dictionary, Node* key, Node* value, Label* bailout);
+  void Add(TNode<Dictionary> dictionary, TNode<Name> key, TNode<Object> value,
+           Label* bailout);
 
   // Tries to check if {object} has own {unique_name} property.
   void TryHasOwnProperty(Node* object, Node* map, Node* instance_type,
@@ -1791,36 +2241,37 @@ class V8_EXPORT_PRIVATE CodeStubAssembler : public compiler::CodeAssembler {
   TNode<Object> GetProperty(SloppyTNode<Context> context,
                             SloppyTNode<Object> receiver,
                             SloppyTNode<Object> name) {
-    return UncheckedCast<Object>(
-        CallStub(CodeFactory::GetProperty(isolate()), context, receiver, name));
+    return CallStub(Builtins::CallableFor(isolate(), Builtins::kGetProperty),
+                    context, receiver, name);
   }
 
   Node* GetMethod(Node* context, Node* object, Handle<Name> name,
                   Label* if_null_or_undefined);
 
   template <class... TArgs>
-  TNode<Object> CallBuiltin(Builtins::Name id, SloppyTNode<Context> context,
+  TNode<Object> CallBuiltin(Builtins::Name id, SloppyTNode<Object> context,
                             TArgs... args) {
     DCHECK_IMPLIES(Builtins::KindOf(id) == Builtins::TFJ,
                    !Builtins::IsLazy(id));
-    return UncheckedCast<Object>(
-        CallStub(Builtins::CallableFor(isolate(), id), context, args...));
+    return CallStub<Object>(Builtins::CallableFor(isolate(), id), context,
+                            args...);
   }
 
   template <class... TArgs>
-  TNode<Object> TailCallBuiltin(Builtins::Name id, SloppyTNode<Context> context,
-                                TArgs... args) {
+  void TailCallBuiltin(Builtins::Name id, SloppyTNode<Object> context,
+                       TArgs... args) {
     DCHECK_IMPLIES(Builtins::KindOf(id) == Builtins::TFJ,
                    !Builtins::IsLazy(id));
-    return UncheckedCast<Object>(
-        TailCallStub(Builtins::CallableFor(isolate(), id), context, args...));
+    return TailCallStub(Builtins::CallableFor(isolate(), id), context, args...);
   }
 
-  void LoadPropertyFromFastObject(Node* object, Node* map, Node* descriptors,
+  void LoadPropertyFromFastObject(Node* object, Node* map,
+                                  TNode<DescriptorArray> descriptors,
                                   Node* name_index, Variable* var_details,
                                   Variable* var_value);
 
-  void LoadPropertyFromFastObject(Node* object, Node* map, Node* descriptors,
+  void LoadPropertyFromFastObject(Node* object, Node* map,
+                                  TNode<DescriptorArray> descriptors,
                                   Node* name_index, Node* details,
                                   Variable* var_value);
 
@@ -1865,9 +2316,11 @@ class V8_EXPORT_PRIVATE CodeStubAssembler : public compiler::CodeAssembler {
   // This method jumps to if_found if the element is known to exist. To
   // if_absent if it's known to not exist. To if_not_found if the prototype
   // chain needs to be checked. And if_bailout if the lookup is unsupported.
-  void TryLookupElement(Node* object, Node* map, Node* instance_type,
-                        Node* intptr_index, Label* if_found, Label* if_absent,
-                        Label* if_not_found, Label* if_bailout);
+  void TryLookupElement(Node* object, Node* map,
+                        SloppyTNode<Int32T> instance_type,
+                        SloppyTNode<IntPtrT> intptr_index, Label* if_found,
+                        Label* if_absent, Label* if_not_found,
+                        Label* if_bailout);
 
   // This is a type of a lookup in holder generator function. In case of a
   // property lookup the {key} is guaranteed to be an unique name and in case of
@@ -1908,10 +2361,11 @@ class V8_EXPORT_PRIVATE CodeStubAssembler : public compiler::CodeAssembler {
   Node* OrdinaryHasInstance(Node* context, Node* callable, Node* object);
 
   // Load type feedback vector from the stub caller's frame.
-  Node* LoadFeedbackVectorForStub();
+  TNode<FeedbackVector> LoadFeedbackVectorForStub();
 
   // Load type feedback vector for the given closure.
-  Node* LoadFeedbackVector(Node* closure);
+  TNode<FeedbackVector> LoadFeedbackVector(SloppyTNode<JSFunction> closure,
+                                           Label* if_undefined = nullptr);
 
   // Update the type feedback vector.
   void UpdateFeedback(Node* feedback, Node* feedback_vector, Node* slot_id);
@@ -1969,6 +2423,11 @@ class V8_EXPORT_PRIVATE CodeStubAssembler : public compiler::CodeAssembler {
                                      TNode<Object> value,
                                      TNode<Context> context,
                                      Label* opt_if_neutered);
+  // Part of the above, refactored out to reuse in another place
+  void EmitBigTypedArrayElementStore(TNode<FixedTypedArrayBase> elements,
+                                     TNode<RawPtrT> backing_store,
+                                     TNode<IntPtrT> offset,
+                                     TNode<BigInt> bigint_value);
 
   void EmitElementStore(Node* object, Node* key, Node* value, bool is_jsarray,
                         ElementsKind elements_kind,
@@ -1989,15 +2448,22 @@ class V8_EXPORT_PRIVATE CodeStubAssembler : public compiler::CodeAssembler {
 
   void TrapAllocationMemento(Node* object, Label* memento_found);
 
-  Node* PageFromAddress(Node* address);
+  TNode<IntPtrT> PageFromAddress(TNode<IntPtrT> address);
 
-  // Create a new weak cell with a specified value and install it into a
-  // feedback vector.
-  Node* CreateWeakCellInFeedbackVector(Node* feedback_vector, Node* slot,
-                                       Node* value);
+  // Store a weak in-place reference into the FeedbackVector.
+  TNode<MaybeObject> StoreWeakReferenceInFeedbackVector(
+      SloppyTNode<FeedbackVector> feedback_vector, SloppyTNode<IntPtrT> slot,
+      TNode<HeapObject> value);
 
   // Create a new AllocationSite and install it into a feedback vector.
-  Node* CreateAllocationSiteInFeedbackVector(Node* feedback_vector, Node* slot);
+  TNode<AllocationSite> CreateAllocationSiteInFeedbackVector(
+      SloppyTNode<FeedbackVector> feedback_vector, TNode<Smi> slot);
+
+  // TODO(ishell, cbruni): Change to HasBoilerplate.
+  TNode<BoolT> NotHasBoilerplate(TNode<Object> maybe_literal_site);
+  TNode<Smi> LoadTransitionInfo(TNode<AllocationSite> allocation_site);
+  TNode<JSObject> LoadBoilerplate(TNode<AllocationSite> allocation_site);
+  TNode<Int32T> LoadElementsKind(TNode<AllocationSite> allocation_site);
 
   enum class IndexAdvanceMode { kPre, kPost };
 
@@ -2136,22 +2602,35 @@ class V8_EXPORT_PRIVATE CodeStubAssembler : public compiler::CodeAssembler {
 
   // TypedArray/ArrayBuffer helpers
   Node* IsDetachedBuffer(Node* buffer);
+  TNode<JSArrayBuffer> LoadArrayBufferViewBuffer(
+      TNode<JSArrayBufferView> array_buffer_view);
+  TNode<RawPtrT> LoadArrayBufferBackingStore(TNode<JSArrayBuffer> array_buffer);
 
   TNode<IntPtrT> ElementOffsetFromIndex(Node* index, ElementsKind kind,
                                         ParameterMode mode, int base_size = 0);
 
+  // Check that a field offset is within the bounds of the an object.
+  TNode<BoolT> IsOffsetInBounds(SloppyTNode<IntPtrT> offset,
+                                SloppyTNode<IntPtrT> length, int header_size,
+                                ElementsKind kind = HOLEY_ELEMENTS);
+
   // Load a builtin's code from the builtin array in the isolate.
   TNode<Code> LoadBuiltin(TNode<Smi> builtin_id);
 
   // Figure out the SFI's code object using its data field.
+  // If |if_compile_lazy| is provided then the execution will go to the given
+  // label in case of an CompileLazy code object.
   TNode<Code> GetSharedFunctionInfoCode(
-      SloppyTNode<SharedFunctionInfo> shared_info);
+      SloppyTNode<SharedFunctionInfo> shared_info,
+      Label* if_compile_lazy = nullptr);
 
   Node* AllocateFunctionWithMapAndContext(Node* map, Node* shared_info,
                                           Node* context);
 
   // Promise helpers
-  Node* IsPromiseHookEnabledOrDebugIsActive();
+  Node* IsPromiseHookEnabled();
+  Node* HasAsyncEventDelegate();
+  Node* IsPromiseHookEnabledOrHasAsyncEventDelegate();
 
   // Helpers for StackFrame markers.
   Node* MarkerIsFrameType(Node* marker_or_function,
@@ -2166,7 +2645,6 @@ class V8_EXPORT_PRIVATE CodeStubAssembler : public compiler::CodeAssembler {
 
   TNode<IntPtrT> GetArgumentsLength(CodeStubArguments* args);
   TNode<Object> GetArgumentValue(CodeStubArguments* args, TNode<IntPtrT> index);
-  TNode<Object> GetArgumentValue(CodeStubArguments* args, TNode<Smi> index);
 
   // Support for printf-style debugging
   void Print(const char* s);
@@ -2174,6 +2652,9 @@ class V8_EXPORT_PRIVATE CodeStubAssembler : public compiler::CodeAssembler {
   inline void Print(SloppyTNode<Object> tagged_value) {
     return Print(nullptr, tagged_value);
   }
+  inline void Print(TNode<MaybeObject> tagged_value) {
+    return Print(nullptr, tagged_value);
+  }
 
   template <class... TArgs>
   Node* MakeTypeError(MessageTemplate::Template message, Node* context,
@@ -2190,7 +2671,11 @@ class V8_EXPORT_PRIVATE CodeStubAssembler : public compiler::CodeAssembler {
     Unreachable();
   }
 
-  void PerformStackCheck(Node* context);
+  bool ConstexprBoolNot(bool value) { return !value; }
+
+  bool ConstexprInt31Equal(int31_t a, int31_t b) { return a == b; }
+
+  void PerformStackCheck(TNode<Context> context);
 
  protected:
   // Implements DescriptorArray::Search().
@@ -2242,6 +2727,14 @@ class V8_EXPORT_PRIVATE CodeStubAssembler : public compiler::CodeAssembler {
   TNode<Uint32T> DescriptorArrayGetDetails(TNode<DescriptorArray> descriptors,
                                            TNode<Uint32T> descriptor_number);
 
+  typedef std::function<void(TNode<UintPtrT> descriptor_key_index)>
+      ForEachDescriptorBodyFunction;
+
+  void DescriptorArrayForEach(VariableList& variable_list,
+                              TNode<Uint32T> start_descriptor,
+                              TNode<Uint32T> end_descriptor,
+                              const ForEachDescriptorBodyFunction& body);
+
   TNode<Object> CallGetterIfAccessor(Node* value, Node* details, Node* context,
                                      Node* receiver, Label* if_bailout,
                                      GetOwnPropertyMode mode = kCallJSGetter);
@@ -2255,8 +2748,6 @@ class V8_EXPORT_PRIVATE CodeStubAssembler : public compiler::CodeAssembler {
   void InitializeFunctionContext(Node* native_context, Node* context,
                                  int slots);
 
-  void AssertIsStrongHeapObject(SloppyTNode<HeapObject> object);
-
  private:
   friend class CodeStubArguments;
 
@@ -2274,6 +2765,7 @@ class V8_EXPORT_PRIVATE CodeStubAssembler : public compiler::CodeAssembler {
                                      Node* allocation_site,
                                      Node* size_in_bytes);
 
+  TNode<BoolT> IsValidSmi(TNode<Smi> smi);
   Node* SmiShiftBitsConstant();
 
   // Emits keyed sloppy arguments load if the |value| is nullptr or store
@@ -2289,6 +2781,9 @@ class V8_EXPORT_PRIVATE CodeStubAssembler : public compiler::CodeAssembler {
                                    TNode<Smi> length, TNode<String> first,
                                    TNode<String> second, AllocationFlags flags);
 
+  // Allocate a MutableHeapNumber without initializing its value.
+  TNode<MutableHeapNumber> AllocateMutableHeapNumber();
+
   Node* SelectImpl(TNode<BoolT> condition, const NodeGenerator& true_body,
                    const NodeGenerator& false_body, MachineRepresentation rep);
 
@@ -2301,7 +2796,7 @@ class V8_EXPORT_PRIVATE CodeStubAssembler : public compiler::CodeAssembler {
   TNode<Uint32T> GetSortedKeyIndex(TNode<Array> descriptors,
                                    TNode<Uint32T> entry_index);
 
-  Node* CollectFeedbackForString(Node* instance_type);
+  TNode<Smi> CollectFeedbackForString(SloppyTNode<Int32T> instance_type);
   void GenerateEqual_Same(Node* value, Label* if_equal, Label* if_notequal,
                           Variable* var_type_feedback = nullptr);
   TNode<String> AllocAndCopyStringCharacters(Node* from,
@@ -2352,6 +2847,10 @@ class CodeStubArguments {
                     ReceiverMode receiver_mode = ReceiverMode::kHasReceiver);
 
   TNode<Object> GetReceiver() const;
+  // Replaces receiver argument on the expression stack. Should be used only
+  // for manipulating arguments in trampoline builtins before tail calling
+  // further with passing all the JS arguments as is.
+  void SetReceiver(TNode<Object> object) const;
 
   TNode<RawPtr<Object>> AtIndexPtr(
       Node* index, CodeStubAssembler::ParameterMode mode =
@@ -2389,8 +2888,9 @@ class CodeStubArguments {
 
   // Iteration doesn't include the receiver. |first| and |last| are zero-based.
   void ForEach(const ForEachBodyFunction& body, Node* first = nullptr,
-               Node* last = nullptr, CodeStubAssembler::ParameterMode mode =
-                                         CodeStubAssembler::INTPTR_PARAMETERS) {
+               Node* last = nullptr,
+               CodeStubAssembler::ParameterMode mode =
+                   CodeStubAssembler::INTPTR_PARAMETERS) {
     CodeStubAssembler::VariableList list(0, assembler_->zone());
     ForEach(list, body, first, last);
   }
@@ -2398,8 +2898,9 @@ class CodeStubArguments {
   // Iteration doesn't include the receiver. |first| and |last| are zero-based.
   void ForEach(const CodeStubAssembler::VariableList& vars,
                const ForEachBodyFunction& body, Node* first = nullptr,
-               Node* last = nullptr, CodeStubAssembler::ParameterMode mode =
-                                         CodeStubAssembler::INTPTR_PARAMETERS);
+               Node* last = nullptr,
+               CodeStubAssembler::ParameterMode mode =
+                   CodeStubAssembler::INTPTR_PARAMETERS);
 
   void PopAndReturn(Node* value);
 
@@ -2463,100 +2964,6 @@ class ToDirectStringAssembler : public CodeStubAssembler {
   const Flags flags_;
 };
 
-#define CSA_CHECK(csa, x)                                              \
-  (csa)->Check(                                                        \
-      [&]() -> compiler::Node* {                                       \
-        return base::implicit_cast<compiler::SloppyTNode<Word32T>>(x); \
-      },                                                               \
-      #x, __FILE__, __LINE__)
-
-#ifdef DEBUG
-// Add stringified versions to the given values, except the first. That is,
-// transform
-//   x, a, b, c, d, e, f
-// to
-//   a, "a", b, "b", c, "c", d, "d", e, "e", f, "f"
-//
-// __VA_ARGS__  is ignored to allow the caller to pass through too many
-// parameters, and the first element is ignored to support having no extra
-// values without empty __VA_ARGS__ (which cause all sorts of problems with
-// extra commas).
-#define CSA_ASSERT_STRINGIFY_EXTRA_VALUES_5(_, v1, v2, v3, v4, v5, ...) \
-  v1, #v1, v2, #v2, v3, #v3, v4, #v4, v5, #v5
-
-// Stringify the given variable number of arguments. The arguments are trimmed
-// to 5 if there are too many, and padded with nullptr if there are not enough.
-#define CSA_ASSERT_STRINGIFY_EXTRA_VALUES(...)                                \
-  CSA_ASSERT_STRINGIFY_EXTRA_VALUES_5(__VA_ARGS__, nullptr, nullptr, nullptr, \
-                                      nullptr, nullptr)
-
-#define CSA_ASSERT_GET_FIRST(x, ...) (x)
-#define CSA_ASSERT_GET_FIRST_STR(x, ...) #x
-
-// CSA_ASSERT(csa, <condition>, <extra values to print...>)
-
-// We have to jump through some hoops to allow <extra values to print...> to be
-// empty.
-#define CSA_ASSERT(csa, ...)                                             \
-  (csa)->Assert(                                                         \
-      [&]() -> compiler::Node* {                                         \
-        return base::implicit_cast<compiler::SloppyTNode<Word32T>>(      \
-            EXPAND(CSA_ASSERT_GET_FIRST(__VA_ARGS__)));                  \
-      },                                                                 \
-      EXPAND(CSA_ASSERT_GET_FIRST_STR(__VA_ARGS__)), __FILE__, __LINE__, \
-      CSA_ASSERT_STRINGIFY_EXTRA_VALUES(__VA_ARGS__))
-
-// CSA_ASSERT_BRANCH(csa, [](Label* ok, Label* not_ok) {...},
-//     <extra values to print...>)
-
-#define CSA_ASSERT_BRANCH(csa, ...)                                      \
-  (csa)->Assert(EXPAND(CSA_ASSERT_GET_FIRST(__VA_ARGS__)),               \
-                EXPAND(CSA_ASSERT_GET_FIRST_STR(__VA_ARGS__)), __FILE__, \
-                __LINE__, CSA_ASSERT_STRINGIFY_EXTRA_VALUES(__VA_ARGS__))
-
-#define CSA_ASSERT_JS_ARGC_OP(csa, Op, op, expected)                     \
-  (csa)->Assert(                                                         \
-      [&]() -> compiler::Node* {                                         \
-        compiler::Node* const argc =                                     \
-            (csa)->Parameter(Descriptor::kActualArgumentsCount);         \
-        return (csa)->Op(argc, (csa)->Int32Constant(expected));          \
-      },                                                                 \
-      "argc " #op " " #expected, __FILE__, __LINE__,                     \
-      SmiFromInt32((csa)->Parameter(Descriptor::kActualArgumentsCount)), \
-      "argc")
-
-#define CSA_ASSERT_JS_ARGC_EQ(csa, expected) \
-  CSA_ASSERT_JS_ARGC_OP(csa, Word32Equal, ==, expected)
-
-#define CSA_DEBUG_INFO(name) \
-  { #name, __FILE__, __LINE__ }
-#define BIND(label) Bind(label, CSA_DEBUG_INFO(label))
-#define VARIABLE(name, ...) \
-  Variable name(this, CSA_DEBUG_INFO(name), __VA_ARGS__)
-#define VARIABLE_CONSTRUCTOR(name, ...) \
-  name(this, CSA_DEBUG_INFO(name), __VA_ARGS__)
-#define TYPED_VARIABLE_DEF(type, name, ...) \
-  TVariable<type> name(CSA_DEBUG_INFO(name), __VA_ARGS__)
-#else  // DEBUG
-#define CSA_ASSERT(csa, ...) ((void)0)
-#define CSA_ASSERT_BRANCH(csa, ...) ((void)0)
-#define CSA_ASSERT_JS_ARGC_EQ(csa, expected) ((void)0)
-#define BIND(label) Bind(label)
-#define VARIABLE(name, ...) Variable name(this, __VA_ARGS__)
-#define VARIABLE_CONSTRUCTOR(name, ...) name(this, __VA_ARGS__)
-#define TYPED_VARIABLE_DEF(type, name, ...) TVariable<type> name(__VA_ARGS__)
-#endif  // DEBUG
-
-#define TVARIABLE(...) EXPAND(TYPED_VARIABLE_DEF(__VA_ARGS__, this))
-
-#ifdef ENABLE_SLOW_DCHECKS
-#define CSA_SLOW_ASSERT(csa, ...) \
-  if (FLAG_enable_slow_asserts) { \
-    CSA_ASSERT(csa, __VA_ARGS__); \
-  }
-#else
-#define CSA_SLOW_ASSERT(csa, ...) ((void)0)
-#endif
 
 DEFINE_OPERATORS_FOR_FLAGS(CodeStubAssembler::AllocationFlags);
 
diff --git a/deps/v8/src/code-stubs.cc b/deps/v8/src/code-stubs.cc
index 1503703a6e57af..8bb1cb05b04661 100644
--- a/deps/v8/src/code-stubs.cc
+++ b/deps/v8/src/code-stubs.cc
@@ -20,6 +20,7 @@
 #include "src/ic/ic.h"
 #include "src/macro-assembler.h"
 #include "src/objects-inl.h"
+#include "src/objects/hash-table-inl.h"
 #include "src/tracing/tracing-category-observer.h"
 
 namespace v8 {
@@ -33,18 +34,16 @@ CodeStubDescriptor::CodeStubDescriptor(CodeStub* stub)
       stack_parameter_count_(no_reg),
       hint_stack_parameter_count_(-1),
       function_mode_(NOT_JS_FUNCTION_STUB_MODE),
-      deoptimization_handler_(nullptr),
+      deoptimization_handler_(kNullAddress),
       miss_handler_(),
-      has_miss_handler_(false) {
-  stub->InitializeDescriptor(this);
-}
+      has_miss_handler_(false) {}
 
 CodeStubDescriptor::CodeStubDescriptor(Isolate* isolate, uint32_t stub_key)
     : isolate_(isolate),
       stack_parameter_count_(no_reg),
       hint_stack_parameter_count_(-1),
       function_mode_(NOT_JS_FUNCTION_STUB_MODE),
-      deoptimization_handler_(nullptr),
+      deoptimization_handler_(kNullAddress),
       miss_handler_(),
       has_miss_handler_(false) {
   CodeStub::InitializeDescriptor(isolate, stub_key, this);
@@ -89,14 +88,14 @@ void CodeStub::RecordCodeGeneration(Handle<Code> code) {
   Counters* counters = isolate()->counters();
   counters->total_stubs_code_size()->Increment(code->raw_instruction_size());
 #ifdef DEBUG
-  code->VerifyEmbeddedObjects();
+  code->VerifyEmbeddedObjects(isolate());
 #endif
 }
 
 
 void CodeStub::DeleteStubFromCacheForTesting() {
   Heap* heap = isolate_->heap();
-  Handle<SimpleNumberDictionary> dict(heap->code_stubs());
+  Handle<SimpleNumberDictionary> dict(heap->code_stubs(), isolate());
   int entry = dict->FindEntry(GetKey());
   DCHECK_NE(SimpleNumberDictionary::kNotFound, entry);
   dict = SimpleNumberDictionary::DeleteEntry(dict, entry);
@@ -107,15 +106,16 @@ Handle<Code> PlatformCodeStub::GenerateCode() {
   Factory* factory = isolate()->factory();
 
   // Generate the new code.
-  MacroAssembler masm(isolate(), nullptr, 256, CodeObjectRequired::kYes);
+  // TODO(yangguo): remove this once we can serialize IC stubs.
+  AssemblerOptions options = AssemblerOptions::Default(isolate(), true);
+  MacroAssembler masm(isolate(), options, nullptr, 256,
+                      CodeObjectRequired::kYes);
 
   {
     // Update the static counter each time a new code stub is generated.
     isolate()->counters()->code_stubs()->Increment();
 
     // Generate the code for the stub.
-    // TODO(yangguo): remove this once we can serialize IC stubs.
-    masm.enable_serializer();
     NoCurrentFrameScope scope(&masm);
     Generate(&masm);
   }
@@ -140,7 +140,7 @@ Handle<Code> CodeStub::GetCode() {
   Code* code;
   if (FindCodeInCache(&code)) {
     DCHECK(code->is_stub());
-    return handle(code);
+    return handle(code, isolate_);
   }
 
   {
@@ -166,7 +166,7 @@ Handle<Code> CodeStub::GetCode() {
 
     // Update the dictionary and the root in Heap.
     Handle<SimpleNumberDictionary> dict = SimpleNumberDictionary::Set(
-        handle(heap->code_stubs()), GetKey(), new_object);
+        handle(heap->code_stubs(), isolate_), GetKey(), new_object);
     heap->SetRootCodeStubs(*dict);
     code = *new_object;
   }
@@ -176,7 +176,7 @@ Handle<Code> CodeStub::GetCode() {
   return Handle<Code>(code, isolate());
 }
 
-CodeStub::Major CodeStub::GetMajorKey(Code* code_stub) {
+CodeStub::Major CodeStub::GetMajorKey(const Code* code_stub) {
   return MajorKeyFromKey(code_stub->stub_key());
 }
 
@@ -230,7 +230,6 @@ static void InitializeDescriptorDispatchedCall(CodeStub* stub,
                                                void** value_out) {
   CodeStubDescriptor* descriptor_out =
       reinterpret_cast<CodeStubDescriptor*>(value_out);
-  stub->InitializeDescriptor(descriptor_out);
   descriptor_out->set_call_descriptor(stub->GetCallInterfaceDescriptor());
 }
 
@@ -256,53 +255,16 @@ MaybeHandle<Code> CodeStub::GetCode(Isolate* isolate, uint32_t key) {
   return scope.CloseAndEscape(code);
 }
 
-
-void StringAddStub::PrintBaseName(std::ostream& os) const {  // NOLINT
-  os << "StringAddStub_" << flags() << "_" << pretenure_flag();
-}
-
-TF_STUB(StringAddStub, CodeStubAssembler) {
-  StringAddFlags flags = stub->flags();
-  PretenureFlag pretenure_flag = stub->pretenure_flag();
-
-  Node* left = Parameter(Descriptor::kLeft);
-  Node* right = Parameter(Descriptor::kRight);
-  Node* context = Parameter(Descriptor::kContext);
-
-  if ((flags & STRING_ADD_CHECK_LEFT) != 0) {
-    DCHECK_NE(flags & STRING_ADD_CONVERT, 0);
-    // TODO(danno): The ToString and JSReceiverToPrimitive below could be
-    // combined to avoid duplicate smi and instance type checks.
-    left = ToString(context, JSReceiverToPrimitive(context, left));
-  }
-  if ((flags & STRING_ADD_CHECK_RIGHT) != 0) {
-    DCHECK_NE(flags & STRING_ADD_CONVERT, 0);
-    // TODO(danno): The ToString and JSReceiverToPrimitive below could be
-    // combined to avoid duplicate smi and instance type checks.
-    right = ToString(context, JSReceiverToPrimitive(context, right));
-  }
-
-  if ((flags & STRING_ADD_CHECK_BOTH) == 0) {
-    CodeStubAssembler::AllocationFlag allocation_flags =
-        (pretenure_flag == TENURED) ? CodeStubAssembler::kPretenured
-                                    : CodeStubAssembler::kNone;
-    Return(StringAdd(context, CAST(left), CAST(right), allocation_flags));
-  } else {
-    Callable callable = CodeFactory::StringAdd(isolate(), STRING_ADD_CHECK_NONE,
-                                               pretenure_flag);
-    TailCallStub(callable, context, left, right);
-  }
-}
-
 Handle<Code> TurboFanCodeStub::GenerateCode() {
   const char* name = CodeStub::MajorName(MajorKey());
   Zone zone(isolate()->allocator(), ZONE_NAME);
   CallInterfaceDescriptor descriptor(GetCallInterfaceDescriptor());
-  compiler::CodeAssemblerState state(isolate(), &zone, descriptor, Code::STUB,
-                                     name, PoisoningMitigationLevel::kOff, 1,
-                                     GetKey());
+  compiler::CodeAssemblerState state(
+      isolate(), &zone, descriptor, Code::STUB, name,
+      PoisoningMitigationLevel::kDontPoison, GetKey());
   GenerateAssembly(&state);
-  return compiler::CodeAssembler::GenerateCode(&state);
+  return compiler::CodeAssembler::GenerateCode(
+      &state, AssemblerOptions::Default(isolate()));
 }
 
 TF_STUB(ElementsTransitionAndStoreStub, CodeStubAssembler) {
@@ -342,23 +304,6 @@ TF_STUB(ElementsTransitionAndStoreStub, CodeStubAssembler) {
   }
 }
 
-TF_STUB(TransitionElementsKindStub, CodeStubAssembler) {
-  Node* context = Parameter(Descriptor::kContext);
-  Node* object = Parameter(Descriptor::kObject);
-  Node* new_map = Parameter(Descriptor::kMap);
-
-  Label bailout(this);
-  TransitionElementsKind(object, new_map, stub->from_kind(), stub->to_kind(),
-                         stub->is_jsarray(), &bailout);
-  Return(object);
-
-  BIND(&bailout);
-  {
-    Comment("Call runtime");
-    TailCallRuntime(Runtime::kTransitionElementsKind, context, object, new_map);
-  }
-}
-
 // TODO(ishell): move to builtins-handler-gen.
 TF_STUB(KeyedLoadSloppyArgumentsStub, CodeStubAssembler) {
   Node* receiver = Parameter(Descriptor::kReceiver);
@@ -438,61 +383,6 @@ int JSEntryStub::GenerateHandlerTable(MacroAssembler* masm) {
   return handler_table_offset;
 }
 
-
-// TODO(ishell): move to builtins.
-TF_STUB(GetPropertyStub, CodeStubAssembler) {
-  Label call_runtime(this, Label::kDeferred), return_undefined(this), end(this);
-
-  Node* object = Parameter(Descriptor::kObject);
-  Node* key = Parameter(Descriptor::kKey);
-  Node* context = Parameter(Descriptor::kContext);
-  VARIABLE(var_result, MachineRepresentation::kTagged);
-
-  CodeStubAssembler::LookupInHolder lookup_property_in_holder =
-      [=, &var_result, &end](Node* receiver, Node* holder, Node* holder_map,
-                             Node* holder_instance_type, Node* unique_name,
-                             Label* next_holder, Label* if_bailout) {
-        VARIABLE(var_value, MachineRepresentation::kTagged);
-        Label if_found(this);
-        TryGetOwnProperty(context, receiver, holder, holder_map,
-                          holder_instance_type, unique_name, &if_found,
-                          &var_value, next_holder, if_bailout);
-        BIND(&if_found);
-        {
-          var_result.Bind(var_value.value());
-          Goto(&end);
-        }
-      };
-
-  CodeStubAssembler::LookupInHolder lookup_element_in_holder =
-      [=](Node* receiver, Node* holder, Node* holder_map,
-          Node* holder_instance_type, Node* index, Label* next_holder,
-          Label* if_bailout) {
-        // Not supported yet.
-        Use(next_holder);
-        Goto(if_bailout);
-      };
-
-  TryPrototypeChainLookup(object, key, lookup_property_in_holder,
-                          lookup_element_in_holder, &return_undefined,
-                          &call_runtime);
-
-  BIND(&return_undefined);
-  {
-    var_result.Bind(UndefinedConstant());
-    Goto(&end);
-  }
-
-  BIND(&call_runtime);
-  {
-    var_result.Bind(CallRuntime(Runtime::kGetProperty, context, object, key));
-    Goto(&end);
-  }
-
-  BIND(&end);
-  Return(var_result.value());
-}
-
 // TODO(ishell): move to builtins-handler-gen.
 TF_STUB(StoreSlowElementStub, CodeStubAssembler) {
   Node* receiver = Parameter(Descriptor::kReceiver);
@@ -567,140 +457,8 @@ void ProfileEntryHookStub::EntryHookTrampoline(intptr_t function,
   entry_hook(function, stack_pointer);
 }
 
-TF_STUB(ArrayNoArgumentConstructorStub, CodeStubAssembler) {
-  ElementsKind elements_kind = stub->elements_kind();
-  Node* native_context = LoadObjectField(Parameter(Descriptor::kFunction),
-                                         JSFunction::kContextOffset);
-  bool track_allocation_site =
-      AllocationSite::ShouldTrack(elements_kind) &&
-      stub->override_mode() != DISABLE_ALLOCATION_SITES;
-  Node* allocation_site =
-      track_allocation_site ? Parameter(Descriptor::kAllocationSite) : nullptr;
-  Node* array_map = LoadJSArrayElementsMap(elements_kind, native_context);
-  Node* array =
-      AllocateJSArray(elements_kind, array_map,
-                      IntPtrConstant(JSArray::kPreallocatedArrayElements),
-                      SmiConstant(0), allocation_site);
-  Return(array);
-}
-
-TF_STUB(InternalArrayNoArgumentConstructorStub, CodeStubAssembler) {
-  Node* array_map = LoadObjectField(Parameter(Descriptor::kFunction),
-                                    JSFunction::kPrototypeOrInitialMapOffset);
-  Node* array = AllocateJSArray(
-      stub->elements_kind(), array_map,
-      IntPtrConstant(JSArray::kPreallocatedArrayElements), SmiConstant(0));
-  Return(array);
-}
-
-class ArrayConstructorAssembler : public CodeStubAssembler {
- public:
-  typedef compiler::Node Node;
-
-  explicit ArrayConstructorAssembler(compiler::CodeAssemblerState* state)
-      : CodeStubAssembler(state) {}
-
-  void GenerateConstructor(Node* context, Node* array_function, Node* array_map,
-                           Node* array_size, Node* allocation_site,
-                           ElementsKind elements_kind, AllocationSiteMode mode);
-};
-
-void ArrayConstructorAssembler::GenerateConstructor(
-    Node* context, Node* array_function, Node* array_map, Node* array_size,
-    Node* allocation_site, ElementsKind elements_kind,
-    AllocationSiteMode mode) {
-  Label ok(this);
-  Label smi_size(this);
-  Label small_smi_size(this);
-  Label call_runtime(this, Label::kDeferred);
-
-  Branch(TaggedIsSmi(array_size), &smi_size, &call_runtime);
-
-  BIND(&smi_size);
-
-  if (IsFastPackedElementsKind(elements_kind)) {
-    Label abort(this, Label::kDeferred);
-    Branch(SmiEqual(array_size, SmiConstant(0)), &small_smi_size, &abort);
-
-    BIND(&abort);
-    Node* reason = SmiConstant(AbortReason::kAllocatingNonEmptyPackedArray);
-    TailCallRuntime(Runtime::kAbort, context, reason);
-  } else {
-    int element_size =
-        IsDoubleElementsKind(elements_kind) ? kDoubleSize : kPointerSize;
-    int max_fast_elements =
-        (kMaxRegularHeapObjectSize - FixedArray::kHeaderSize - JSArray::kSize -
-         AllocationMemento::kSize) /
-        element_size;
-    Branch(SmiAboveOrEqual(array_size, SmiConstant(max_fast_elements)),
-           &call_runtime, &small_smi_size);
-  }
-
-  BIND(&small_smi_size);
-  {
-    Node* array = AllocateJSArray(
-        elements_kind, array_map, array_size, array_size,
-        mode == DONT_TRACK_ALLOCATION_SITE ? nullptr : allocation_site,
-        CodeStubAssembler::SMI_PARAMETERS);
-    Return(array);
-  }
-
-  BIND(&call_runtime);
-  {
-    TailCallRuntime(Runtime::kNewArray, context, array_function, array_size,
-                    array_function, allocation_site);
-  }
-}
-
-TF_STUB(ArraySingleArgumentConstructorStub, ArrayConstructorAssembler) {
-  ElementsKind elements_kind = stub->elements_kind();
-  Node* context = Parameter(Descriptor::kContext);
-  Node* function = Parameter(Descriptor::kFunction);
-  Node* native_context = LoadObjectField(function, JSFunction::kContextOffset);
-  Node* array_map = LoadJSArrayElementsMap(elements_kind, native_context);
-  AllocationSiteMode mode = DONT_TRACK_ALLOCATION_SITE;
-  if (stub->override_mode() == DONT_OVERRIDE) {
-    mode = AllocationSite::ShouldTrack(elements_kind)
-               ? TRACK_ALLOCATION_SITE
-               : DONT_TRACK_ALLOCATION_SITE;
-  }
-
-  Node* array_size = Parameter(Descriptor::kArraySizeSmiParameter);
-  Node* allocation_site = Parameter(Descriptor::kAllocationSite);
-
-  GenerateConstructor(context, function, array_map, array_size, allocation_site,
-                      elements_kind, mode);
-}
-
-TF_STUB(InternalArraySingleArgumentConstructorStub, ArrayConstructorAssembler) {
-  Node* context = Parameter(Descriptor::kContext);
-  Node* function = Parameter(Descriptor::kFunction);
-  Node* array_map =
-      LoadObjectField(function, JSFunction::kPrototypeOrInitialMapOffset);
-  Node* array_size = Parameter(Descriptor::kArraySizeSmiParameter);
-  Node* allocation_site = UndefinedConstant();
-
-  GenerateConstructor(context, function, array_map, array_size, allocation_site,
-                      stub->elements_kind(), DONT_TRACK_ALLOCATION_SITE);
-}
-
-ArrayConstructorStub::ArrayConstructorStub(Isolate* isolate)
-    : PlatformCodeStub(isolate) {}
-
-InternalArrayConstructorStub::InternalArrayConstructorStub(Isolate* isolate)
-    : PlatformCodeStub(isolate) {}
-
-CommonArrayConstructorStub::CommonArrayConstructorStub(
-    Isolate* isolate, ElementsKind kind,
-    AllocationSiteOverrideMode override_mode)
-    : TurboFanCodeStub(isolate) {
-  // It only makes sense to override local allocation site behavior
-  // if there is a difference between the global allocation site policy
-  // for an ElementsKind and the desired usage of the stub.
-  DCHECK(override_mode != DISABLE_ALLOCATION_SITES ||
-         AllocationSite::ShouldTrack(kind));
-  set_sub_minor_key(ElementsKindBits::encode(kind) |
-                    AllocationSiteOverrideModeBits::encode(override_mode));
+void CodeStub::GenerateStubsAheadOfTime(Isolate* isolate) {
+  StoreFastElementStub::GenerateAheadOfTime(isolate);
 }
 
 }  // namespace internal
diff --git a/deps/v8/src/code-stubs.h b/deps/v8/src/code-stubs.h
index 96d2ad51cf05e8..745aa1aa24ecb4 100644
--- a/deps/v8/src/code-stubs.h
+++ b/deps/v8/src/code-stubs.h
@@ -5,54 +5,33 @@
 #ifndef V8_CODE_STUBS_H_
 #define V8_CODE_STUBS_H_
 
-#include "src/allocation.h"
-#include "src/assembler.h"
-#include "src/globals.h"
-#include "src/heap/factory.h"
 #include "src/interface-descriptors.h"
-#include "src/macro-assembler.h"
-#include "src/ostreams.h"
 #include "src/type-hints.h"
 
 namespace v8 {
 namespace internal {
 
 // Forward declarations.
-class CodeStubAssembler;
+class Isolate;
 namespace compiler {
-class CodeAssemblerLabel;
 class CodeAssemblerState;
-class Node;
 }
 
 // List of code stubs used on all platforms.
 #define CODE_STUB_LIST_ALL_PLATFORMS(V)     \
   /* --- PlatformCodeStubs --- */           \
-  V(ArrayConstructor)                       \
   V(CallApiCallback)                        \
   V(CallApiGetter)                          \
-  V(CEntry)                                 \
-  V(DoubleToI)                              \
-  V(InternalArrayConstructor)               \
   V(JSEntry)                                \
-  V(MathPow)                                \
   V(ProfileEntryHook)                       \
   /* --- TurboFanCodeStubs --- */           \
   V(StoreSlowElement)                       \
   V(StoreInArrayLiteralSlow)                \
-  V(ArrayNoArgumentConstructor)             \
-  V(ArraySingleArgumentConstructor)         \
-  V(ArrayNArgumentsConstructor)             \
-  V(InternalArrayNoArgumentConstructor)     \
-  V(InternalArraySingleArgumentConstructor) \
   V(ElementsTransitionAndStore)             \
   V(KeyedLoadSloppyArguments)               \
   V(KeyedStoreSloppyArguments)              \
-  V(StringAdd)                              \
-  V(GetProperty)                            \
   V(StoreFastElement)                       \
   V(StoreInterceptor)                       \
-  V(TransitionElementsKind)                 \
   V(LoadIndexedInterceptor)
 
 // List of code stubs only used on ARM 32 bits platforms.
@@ -128,7 +107,7 @@ class CodeStub : public ZoneObject {
   }
 
   // Gets the major key from a code object that is a code stub or binary op IC.
-  static Major GetMajorKey(Code* code_stub);
+  static Major GetMajorKey(const Code* code_stub);
 
   static uint32_t NoCacheKey() { return MajorKeyBits::encode(NoCache); }
 
@@ -138,7 +117,6 @@ class CodeStub : public ZoneObject {
   virtual ~CodeStub() {}
 
   static void GenerateStubsAheadOfTime(Isolate* isolate);
-  static void GenerateFPStubs(Isolate* isolate);
 
   // Some stubs put untagged junk on the stack that cannot be scanned by the
   // GC.  This means that we must be statically sure that no GC can occur while
@@ -157,8 +135,6 @@ class CodeStub : public ZoneObject {
     return GetCallInterfaceDescriptor().GetStackParameterCount();
   }
 
-  virtual void InitializeDescriptor(CodeStubDescriptor* descriptor) {}
-
   static void InitializeDescriptor(Isolate* isolate, uint32_t key,
                                    CodeStubDescriptor* desc);
 
@@ -191,6 +167,8 @@ class CodeStub : public ZoneObject {
 
   // Returns whether the code generated for this stub needs to be allocated as
   // a fixed (non-moveable) code object.
+  // TODO(jgruber): Only required by DirectCEntryStub. Can be removed when/if
+  // that is ported to a builtin.
   virtual Movability NeedsImmovableCode() { return kMovable; }
 
   virtual void PrintName(std::ostream& os) const;        // NOLINT
@@ -263,7 +241,7 @@ class CodeStub : public ZoneObject {
  public:                                                                \
   typedef NAME##Descriptor Descriptor;                                  \
   CallInterfaceDescriptor GetCallInterfaceDescriptor() const override { \
-    return Descriptor(isolate());                                       \
+    return Descriptor();                                                \
   }
 
 // There are some code stubs we just can't describe right now with a
@@ -304,17 +282,17 @@ class CodeStubDescriptor {
 
   CodeStubDescriptor(Isolate* isolate, uint32_t stub_key);
 
-  void Initialize(Address deoptimization_handler = nullptr,
+  void Initialize(Address deoptimization_handler = kNullAddress,
                   int hint_stack_parameter_count = -1,
                   StubFunctionMode function_mode = NOT_JS_FUNCTION_STUB_MODE);
   void Initialize(Register stack_parameter_count,
-                  Address deoptimization_handler = nullptr,
+                  Address deoptimization_handler = kNullAddress,
                   int hint_stack_parameter_count = -1,
                   StubFunctionMode function_mode = NOT_JS_FUNCTION_STUB_MODE);
 
   void SetMissHandler(Runtime::FunctionId id) {
     miss_handler_id_ = id;
-    miss_handler_ = ExternalReference(Runtime::FunctionForId(id), isolate_);
+    miss_handler_ = ExternalReference::Create(Runtime::FunctionForId(id));
     has_miss_handler_ = true;
     // Our miss handler infrastructure doesn't currently support
     // variable stack parameter counts.
@@ -434,6 +412,7 @@ class TurboFanCodeStub : public CodeStub {
 namespace v8 {
 namespace internal {
 
+// TODO(jgruber): Convert this stub into a builtin.
 class StoreInterceptorStub : public TurboFanCodeStub {
  public:
   explicit StoreInterceptorStub(Isolate* isolate) : TurboFanCodeStub(isolate) {}
@@ -442,37 +421,7 @@ class StoreInterceptorStub : public TurboFanCodeStub {
   DEFINE_TURBOFAN_CODE_STUB(StoreInterceptor, TurboFanCodeStub);
 };
 
-class TransitionElementsKindStub : public TurboFanCodeStub {
- public:
-  TransitionElementsKindStub(Isolate* isolate, ElementsKind from_kind,
-                             ElementsKind to_kind, bool is_jsarray)
-      : TurboFanCodeStub(isolate) {
-    set_sub_minor_key(FromKindBits::encode(from_kind) |
-                      ToKindBits::encode(to_kind) |
-                      IsJSArrayBits::encode(is_jsarray));
-  }
-
-  void set_sub_minor_key(uint32_t key) { minor_key_ = key; }
-
-  uint32_t sub_minor_key() const { return minor_key_; }
-
-  ElementsKind from_kind() const {
-    return FromKindBits::decode(sub_minor_key());
-  }
-
-  ElementsKind to_kind() const { return ToKindBits::decode(sub_minor_key()); }
-
-  bool is_jsarray() const { return IsJSArrayBits::decode(sub_minor_key()); }
-
- private:
-  class ToKindBits : public BitField<ElementsKind, 0, 8> {};
-  class FromKindBits : public BitField<ElementsKind, ToKindBits::kNext, 8> {};
-  class IsJSArrayBits : public BitField<bool, FromKindBits::kNext, 1> {};
-
-  DEFINE_CALL_INTERFACE_DESCRIPTOR(TransitionElementsKind);
-  DEFINE_TURBOFAN_CODE_STUB(TransitionElementsKind, TurboFanCodeStub);
-};
-
+// TODO(jgruber): Convert this stub into a builtin.
 class LoadIndexedInterceptorStub : public TurboFanCodeStub {
  public:
   explicit LoadIndexedInterceptorStub(Isolate* isolate)
@@ -482,61 +431,7 @@ class LoadIndexedInterceptorStub : public TurboFanCodeStub {
   DEFINE_TURBOFAN_CODE_STUB(LoadIndexedInterceptor, TurboFanCodeStub);
 };
 
-// ES6 [[Get]] operation.
-class GetPropertyStub : public TurboFanCodeStub {
- public:
-  explicit GetPropertyStub(Isolate* isolate) : TurboFanCodeStub(isolate) {}
-
-  DEFINE_CALL_INTERFACE_DESCRIPTOR(GetProperty);
-  DEFINE_TURBOFAN_CODE_STUB(GetProperty, TurboFanCodeStub);
-};
-
-
-enum AllocationSiteOverrideMode {
-  DONT_OVERRIDE,
-  DISABLE_ALLOCATION_SITES,
-  LAST_ALLOCATION_SITE_OVERRIDE_MODE = DISABLE_ALLOCATION_SITES
-};
-
-
-class ArrayConstructorStub: public PlatformCodeStub {
- public:
-  explicit ArrayConstructorStub(Isolate* isolate);
-
- private:
-  void GenerateDispatchToArrayStub(MacroAssembler* masm,
-                                   AllocationSiteOverrideMode mode);
-
-  DEFINE_CALL_INTERFACE_DESCRIPTOR(ArrayConstructor);
-  DEFINE_PLATFORM_CODE_STUB(ArrayConstructor, PlatformCodeStub);
-};
-
-
-class InternalArrayConstructorStub: public PlatformCodeStub {
- public:
-  explicit InternalArrayConstructorStub(Isolate* isolate);
-
- private:
-  void GenerateCase(MacroAssembler* masm, ElementsKind kind);
-
-  DEFINE_CALL_INTERFACE_DESCRIPTOR(ArrayNArgumentsConstructor);
-  DEFINE_PLATFORM_CODE_STUB(InternalArrayConstructor, PlatformCodeStub);
-};
-
-
-class MathPowStub: public PlatformCodeStub {
- public:
-  MathPowStub() : PlatformCodeStub(nullptr) {}
-
-  CallInterfaceDescriptor GetCallInterfaceDescriptor() const override {
-    // A CallInterfaceDescriptor doesn't specify double registers (yet).
-    return ContextOnlyDescriptor(isolate());
-  }
-
- private:
-  DEFINE_PLATFORM_CODE_STUB(MathPow, PlatformCodeStub);
-};
-
+// TODO(jgruber): Convert this stub into a builtin.
 class KeyedLoadSloppyArgumentsStub : public TurboFanCodeStub {
  public:
   explicit KeyedLoadSloppyArgumentsStub(Isolate* isolate)
@@ -570,7 +465,7 @@ class CallApiCallbackStub : public PlatformCodeStub {
 
   CallApiCallbackStub(Isolate* isolate, int argc)
       : PlatformCodeStub(isolate) {
-    CHECK_LE(0, argc);
+    CHECK_LE(0, argc);  // The argc in {0, 1} cases are covered by builtins.
     CHECK_LE(argc, kArgMax);
     minor_key_ = ArgumentBits::encode(argc);
   }
@@ -580,84 +475,25 @@ class CallApiCallbackStub : public PlatformCodeStub {
 
   class ArgumentBits : public BitField<int, 0, kArgBits> {};
 
+  friend class Builtins;  // For generating the related builtin.
+
   DEFINE_CALL_INTERFACE_DESCRIPTOR(ApiCallback);
   DEFINE_PLATFORM_CODE_STUB(CallApiCallback, PlatformCodeStub);
 };
 
-
+// TODO(jgruber): This stub only exists to avoid code duplication between
+// code-stubs-<arch>.cc and builtins-<arch>.cc. If CallApiCallbackStub is ever
+// completely removed, CallApiGetterStub can also be deleted.
 class CallApiGetterStub : public PlatformCodeStub {
- public:
+ private:
+  // For generating the related builtin.
   explicit CallApiGetterStub(Isolate* isolate) : PlatformCodeStub(isolate) {}
+  friend class Builtins;
 
   DEFINE_CALL_INTERFACE_DESCRIPTOR(ApiGetter);
   DEFINE_PLATFORM_CODE_STUB(CallApiGetter, PlatformCodeStub);
 };
 
-
-class StringAddStub final : public TurboFanCodeStub {
- public:
-  StringAddStub(Isolate* isolate, StringAddFlags flags,
-                PretenureFlag pretenure_flag)
-      : TurboFanCodeStub(isolate) {
-    minor_key_ = (StringAddFlagsBits::encode(flags) |
-                  PretenureFlagBits::encode(pretenure_flag));
-  }
-
-  StringAddFlags flags() const {
-    return StringAddFlagsBits::decode(minor_key_);
-  }
-
-  PretenureFlag pretenure_flag() const {
-    return PretenureFlagBits::decode(minor_key_);
-  }
-
- private:
-  class StringAddFlagsBits : public BitField<StringAddFlags, 0, 3> {};
-  class PretenureFlagBits : public BitField<PretenureFlag, 3, 1> {};
-
-  void PrintBaseName(std::ostream& os) const override;  // NOLINT
-
-  DEFINE_CALL_INTERFACE_DESCRIPTOR(StringAdd);
-  DEFINE_TURBOFAN_CODE_STUB(StringAdd, TurboFanCodeStub);
-};
-
-
-class CEntryStub : public PlatformCodeStub {
- public:
-  CEntryStub(Isolate* isolate, int result_size,
-             SaveFPRegsMode save_doubles = kDontSaveFPRegs,
-             ArgvMode argv_mode = kArgvOnStack, bool builtin_exit_frame = false)
-      : PlatformCodeStub(isolate) {
-    minor_key_ = SaveDoublesBits::encode(save_doubles == kSaveFPRegs) |
-                 FrameTypeBits::encode(builtin_exit_frame) |
-                 ArgvMode::encode(argv_mode == kArgvInRegister);
-    DCHECK(result_size == 1 || result_size == 2);
-    minor_key_ = ResultSizeBits::update(minor_key_, result_size);
-  }
-
-  // The version of this stub that doesn't save doubles is generated ahead of
-  // time, so it's OK to call it from other stubs that can't cope with GC during
-  // their code generation.  On machines that always have gp registers (x64) we
-  // can generate both variants ahead of time.
-  static void GenerateAheadOfTime(Isolate* isolate);
-
- private:
-  bool save_doubles() const { return SaveDoublesBits::decode(minor_key_); }
-  bool argv_in_register() const { return ArgvMode::decode(minor_key_); }
-  bool is_builtin_exit() const { return FrameTypeBits::decode(minor_key_); }
-  int result_size() const { return ResultSizeBits::decode(minor_key_); }
-
-  Movability NeedsImmovableCode() override;
-
-  class SaveDoublesBits : public BitField<bool, 0, 1> {};
-  class ArgvMode : public BitField<bool, 1, 1> {};
-  class FrameTypeBits : public BitField<bool, 2, 1> {};
-  class ResultSizeBits : public BitField<int, 3, 3> {};
-
-  DEFINE_NULL_CALL_INTERFACE_DESCRIPTOR();
-  DEFINE_PLATFORM_CODE_STUB(CEntry, PlatformCodeStub);
-};
-
 class JSEntryStub : public PlatformCodeStub {
  public:
   enum class SpecialTarget { kNone, kRunMicrotasks };
@@ -713,49 +549,6 @@ class JSEntryStub : public PlatformCodeStub {
   DEFINE_PLATFORM_CODE_STUB(JSEntry, PlatformCodeStub);
 };
 
-
-enum ReceiverCheckMode {
-  // We don't know anything about the receiver.
-  RECEIVER_IS_UNKNOWN,
-
-  // We know the receiver is a string.
-  RECEIVER_IS_STRING
-};
-
-
-enum EmbedMode {
-  // The code being generated is part of an IC handler, which may MISS
-  // to an IC in failure cases.
-  PART_OF_IC_HANDLER,
-
-  NOT_PART_OF_IC_HANDLER
-};
-
-class DoubleToIStub : public PlatformCodeStub {
- public:
-  DoubleToIStub(Isolate* isolate, Register destination)
-      : PlatformCodeStub(isolate) {
-    minor_key_ = DestinationRegisterBits::encode(destination.code()) |
-                 SSE3Bits::encode(CpuFeatures::IsSupported(SSE3) ? 1 : 0);
-  }
-
-  bool SometimesSetsUpAFrame() override { return false; }
-
- private:
-  Register destination() const {
-    return Register::from_code(DestinationRegisterBits::decode(minor_key_));
-  }
-
-  static const int kBitsPerRegisterNumber = 6;
-  STATIC_ASSERT((1L << kBitsPerRegisterNumber) >= Register::kNumRegisters);
-  class DestinationRegisterBits
-      : public BitField<int, 0, kBitsPerRegisterNumber> {};
-  class SSE3Bits : public BitField<int, kBitsPerRegisterNumber, 1> {};
-
-  DEFINE_NULL_CALL_INTERFACE_DESCRIPTOR();
-  DEFINE_PLATFORM_CODE_STUB(DoubleToI, PlatformCodeStub);
-};
-
 class StoreFastElementStub : public TurboFanCodeStub {
  public:
   StoreFastElementStub(Isolate* isolate, bool is_js_array,
@@ -787,119 +580,6 @@ class StoreFastElementStub : public TurboFanCodeStub {
   DEFINE_TURBOFAN_CODE_STUB(StoreFastElement, TurboFanCodeStub);
 };
 
-
-class CommonArrayConstructorStub : public TurboFanCodeStub {
- protected:
-  CommonArrayConstructorStub(Isolate* isolate, ElementsKind kind,
-                             AllocationSiteOverrideMode override_mode);
-
-  void set_sub_minor_key(uint32_t key) { minor_key_ = key; }
-
-  uint32_t sub_minor_key() const { return minor_key_; }
-
-  CommonArrayConstructorStub(uint32_t key, Isolate* isolate)
-      : TurboFanCodeStub(key, isolate) {}
-
- public:
-  ElementsKind elements_kind() const {
-    return ElementsKindBits::decode(sub_minor_key());
-  }
-
-  AllocationSiteOverrideMode override_mode() const {
-    return AllocationSiteOverrideModeBits::decode(sub_minor_key());
-  }
-
-  static void GenerateStubsAheadOfTime(Isolate* isolate);
-
- private:
-  // Ensure data fits within available bits.
-  STATIC_ASSERT(LAST_ALLOCATION_SITE_OVERRIDE_MODE == 1);
-
-  class ElementsKindBits : public BitField<ElementsKind, 0, 8> {};
-  class AllocationSiteOverrideModeBits
-      : public BitField<AllocationSiteOverrideMode, 8, 1> {};  // NOLINT
-};
-
-class ArrayNoArgumentConstructorStub : public CommonArrayConstructorStub {
- public:
-  ArrayNoArgumentConstructorStub(
-      Isolate* isolate, ElementsKind kind,
-      AllocationSiteOverrideMode override_mode = DONT_OVERRIDE)
-      : CommonArrayConstructorStub(isolate, kind, override_mode) {}
-
- private:
-  void PrintName(std::ostream& os) const override {  // NOLINT
-    os << "ArrayNoArgumentConstructorStub";
-  }
-
-  DEFINE_CALL_INTERFACE_DESCRIPTOR(ArrayNoArgumentConstructor);
-  DEFINE_TURBOFAN_CODE_STUB(ArrayNoArgumentConstructor,
-                            CommonArrayConstructorStub);
-};
-
-class InternalArrayNoArgumentConstructorStub
-    : public CommonArrayConstructorStub {
- public:
-  InternalArrayNoArgumentConstructorStub(Isolate* isolate, ElementsKind kind)
-      : CommonArrayConstructorStub(isolate, kind, DONT_OVERRIDE) {}
-
- private:
-  void PrintName(std::ostream& os) const override {  // NOLINT
-    os << "InternalArrayNoArgumentConstructorStub";
-  }
-
-  DEFINE_CALL_INTERFACE_DESCRIPTOR(ArrayNoArgumentConstructor);
-  DEFINE_TURBOFAN_CODE_STUB(InternalArrayNoArgumentConstructor,
-                            CommonArrayConstructorStub);
-};
-
-class ArraySingleArgumentConstructorStub : public CommonArrayConstructorStub {
- public:
-  ArraySingleArgumentConstructorStub(
-      Isolate* isolate, ElementsKind kind,
-      AllocationSiteOverrideMode override_mode = DONT_OVERRIDE)
-      : CommonArrayConstructorStub(isolate, kind, override_mode) {}
-
- private:
-  void PrintName(std::ostream& os) const override {  // NOLINT
-    os << "ArraySingleArgumentConstructorStub";
-  }
-
-  DEFINE_CALL_INTERFACE_DESCRIPTOR(ArraySingleArgumentConstructor);
-  DEFINE_TURBOFAN_CODE_STUB(ArraySingleArgumentConstructor,
-                            CommonArrayConstructorStub);
-};
-
-class InternalArraySingleArgumentConstructorStub
-    : public CommonArrayConstructorStub {
- public:
-  InternalArraySingleArgumentConstructorStub(Isolate* isolate,
-                                             ElementsKind kind)
-      : CommonArrayConstructorStub(isolate, kind, DONT_OVERRIDE) {}
-
- private:
-  void PrintName(std::ostream& os) const override {  // NOLINT
-    os << "InternalArraySingleArgumentConstructorStub";
-  }
-
-  DEFINE_CALL_INTERFACE_DESCRIPTOR(ArraySingleArgumentConstructor);
-  DEFINE_TURBOFAN_CODE_STUB(InternalArraySingleArgumentConstructor,
-                            CommonArrayConstructorStub);
-};
-
-class ArrayNArgumentsConstructorStub : public PlatformCodeStub {
- public:
-  explicit ArrayNArgumentsConstructorStub(Isolate* isolate)
-      : PlatformCodeStub(isolate) {}
-
-  CallInterfaceDescriptor GetCallInterfaceDescriptor() const override {
-    return ArrayNArgumentsConstructorDescriptor(isolate());
-  }
-
- private:
-  DEFINE_PLATFORM_CODE_STUB(ArrayNArgumentsConstructor, PlatformCodeStub);
-};
-
 class StoreSlowElementStub : public TurboFanCodeStub {
  public:
   StoreSlowElementStub(Isolate* isolate, KeyedAccessStoreMode mode)
@@ -952,7 +632,7 @@ class ElementsTransitionAndStoreStub : public TurboFanCodeStub {
   DEFINE_TURBOFAN_CODE_STUB(ElementsTransitionAndStore, TurboFanCodeStub);
 };
 
-
+// TODO(jgruber): Convert this stub into a builtin.
 class ProfileEntryHookStub : public PlatformCodeStub {
  public:
   explicit ProfileEntryHookStub(Isolate* isolate) : PlatformCodeStub(isolate) {}
diff --git a/deps/v8/src/compilation-cache.cc b/deps/v8/src/compilation-cache.cc
index ba9a071c33ffcf..5af2cbc91929bf 100644
--- a/deps/v8/src/compilation-cache.cc
+++ b/deps/v8/src/compilation-cache.cc
@@ -65,7 +65,7 @@ void CompilationSubCache::Age() {
   }
 
   // Set the first generation as unborn.
-  tables_[0] = isolate()->heap()->undefined_value();
+  tables_[0] = ReadOnlyRoots(isolate()).undefined_value();
 }
 
 void CompilationSubCache::Iterate(RootVisitor* v) {
@@ -74,7 +74,8 @@ void CompilationSubCache::Iterate(RootVisitor* v) {
 }
 
 void CompilationSubCache::Clear() {
-  MemsetPointer(tables_, isolate()->heap()->undefined_value(), generations_);
+  MemsetPointer(tables_, ReadOnlyRoots(isolate()).undefined_value(),
+                generations_);
 }
 
 void CompilationSubCache::Remove(Handle<SharedFunctionInfo> function_info) {
@@ -115,8 +116,9 @@ bool CompilationCacheScript::HasOrigin(Handle<SharedFunctionInfo> function_info,
   if (resource_options.Flags() != script->origin_options().Flags())
     return false;
   // Compare the two name strings for equality.
-  return String::Equals(Handle<String>::cast(name),
-                        Handle<String>(String::cast(script->name())));
+  return String::Equals(
+      isolate(), Handle<String>::cast(name),
+      Handle<String>(String::cast(script->name()), isolate()));
 }
 
 // TODO(245): Need to allow identical code from different contexts to
@@ -126,7 +128,7 @@ bool CompilationCacheScript::HasOrigin(Handle<SharedFunctionInfo> function_info,
 MaybeHandle<SharedFunctionInfo> CompilationCacheScript::Lookup(
     Handle<String> source, MaybeHandle<Object> name, int line_offset,
     int column_offset, ScriptOriginOptions resource_options,
-    Handle<Context> context, LanguageMode language_mode) {
+    Handle<Context> native_context, LanguageMode language_mode) {
   MaybeHandle<SharedFunctionInfo> result;
 
   // Probe the script generation tables. Make sure not to leak handles
@@ -136,7 +138,7 @@ MaybeHandle<SharedFunctionInfo> CompilationCacheScript::Lookup(
     DCHECK_EQ(generations(), 1);
     Handle<CompilationCacheTable> table = GetTable(generation);
     MaybeHandle<SharedFunctionInfo> probe =
-        table->LookupScript(source, context, language_mode);
+        table->LookupScript(source, native_context, language_mode);
     Handle<SharedFunctionInfo> function_info;
     if (probe.ToHandle(&function_info)) {
       // Break when we've found a suitable shared function info that
@@ -160,18 +162,20 @@ MaybeHandle<SharedFunctionInfo> CompilationCacheScript::Lookup(
                      resource_options));
 #endif
     isolate()->counters()->compilation_cache_hits()->Increment();
+    LOG(isolate(), CompilationCacheEvent("hit", "script", *function_info));
   } else {
     isolate()->counters()->compilation_cache_misses()->Increment();
   }
   return result;
 }
 
-void CompilationCacheScript::Put(Handle<String> source, Handle<Context> context,
+void CompilationCacheScript::Put(Handle<String> source,
+                                 Handle<Context> native_context,
                                  LanguageMode language_mode,
                                  Handle<SharedFunctionInfo> function_info) {
   HandleScope scope(isolate());
   Handle<CompilationCacheTable> table = GetFirstTable();
-  SetFirstTable(CompilationCacheTable::PutScript(table, source, context,
+  SetFirstTable(CompilationCacheTable::PutScript(table, source, native_context,
                                                  language_mode, function_info));
 }
 
@@ -258,11 +262,11 @@ void CompilationCache::Remove(Handle<SharedFunctionInfo> function_info) {
 MaybeHandle<SharedFunctionInfo> CompilationCache::LookupScript(
     Handle<String> source, MaybeHandle<Object> name, int line_offset,
     int column_offset, ScriptOriginOptions resource_options,
-    Handle<Context> context, LanguageMode language_mode) {
+    Handle<Context> native_context, LanguageMode language_mode) {
   if (!IsEnabled()) return MaybeHandle<SharedFunctionInfo>();
 
   return script_.Lookup(source, name, line_offset, column_offset,
-                        resource_options, context, language_mode);
+                        resource_options, native_context, language_mode);
 }
 
 InfoCellPair CompilationCache::LookupEval(Handle<String> source,
@@ -273,14 +277,23 @@ InfoCellPair CompilationCache::LookupEval(Handle<String> source,
   InfoCellPair result;
   if (!IsEnabled()) return result;
 
+  const char* cache_type;
+
   if (context->IsNativeContext()) {
     result = eval_global_.Lookup(source, outer_info, context, language_mode,
                                  position);
+    cache_type = "eval-global";
+
   } else {
     DCHECK_NE(position, kNoSourcePosition);
     Handle<Context> native_context(context->native_context(), isolate());
     result = eval_contextual_.Lookup(source, outer_info, native_context,
                                      language_mode, position);
+    cache_type = "eval-contextual";
+  }
+
+  if (result.has_shared()) {
+    LOG(isolate(), CompilationCacheEvent("hit", cache_type, result.shared()));
   }
 
   return result;
@@ -293,12 +306,14 @@ MaybeHandle<FixedArray> CompilationCache::LookupRegExp(Handle<String> source,
   return reg_exp_.Lookup(source, flags);
 }
 
-void CompilationCache::PutScript(Handle<String> source, Handle<Context> context,
+void CompilationCache::PutScript(Handle<String> source,
+                                 Handle<Context> native_context,
                                  LanguageMode language_mode,
                                  Handle<SharedFunctionInfo> function_info) {
   if (!IsEnabled()) return;
+  LOG(isolate(), CompilationCacheEvent("put", "script", *function_info));
 
-  script_.Put(source, context, language_mode, function_info);
+  script_.Put(source, native_context, language_mode, function_info);
 }
 
 void CompilationCache::PutEval(Handle<String> source,
@@ -309,24 +324,26 @@ void CompilationCache::PutEval(Handle<String> source,
                                int position) {
   if (!IsEnabled()) return;
 
+  const char* cache_type;
   HandleScope scope(isolate());
   if (context->IsNativeContext()) {
     eval_global_.Put(source, outer_info, function_info, context, feedback_cell,
                      position);
+    cache_type = "eval-global";
   } else {
     DCHECK_NE(position, kNoSourcePosition);
     Handle<Context> native_context(context->native_context(), isolate());
     eval_contextual_.Put(source, outer_info, function_info, native_context,
                          feedback_cell, position);
+    cache_type = "eval-contextual";
   }
+  LOG(isolate(), CompilationCacheEvent("put", cache_type, *function_info));
 }
 
 void CompilationCache::PutRegExp(Handle<String> source,
                                  JSRegExp::Flags flags,
                                  Handle<FixedArray> data) {
-  if (!IsEnabled()) {
-    return;
-  }
+  if (!IsEnabled()) return;
 
   reg_exp_.Put(source, flags, data);
 }
diff --git a/deps/v8/src/compilation-cache.h b/deps/v8/src/compilation-cache.h
index 0072d3b487a085..3a4fe2e7b5ef56 100644
--- a/deps/v8/src/compilation-cache.h
+++ b/deps/v8/src/compilation-cache.h
@@ -83,7 +83,7 @@ class CompilationCacheScript : public CompilationSubCache {
                                          MaybeHandle<Object> name,
                                          int line_offset, int column_offset,
                                          ScriptOriginOptions resource_options,
-                                         Handle<Context> context,
+                                         Handle<Context> native_context,
                                          LanguageMode language_mode);
 
   void Put(Handle<String> source, Handle<Context> context,
@@ -158,7 +158,7 @@ class CompilationCache {
   MaybeHandle<SharedFunctionInfo> LookupScript(
       Handle<String> source, MaybeHandle<Object> name, int line_offset,
       int column_offset, ScriptOriginOptions resource_options,
-      Handle<Context> context, LanguageMode language_mode);
+      Handle<Context> native_context, LanguageMode language_mode);
 
   // Finds the shared function info for a source string for eval in a
   // given context.  Returns an empty handle if the cache doesn't
@@ -175,7 +175,7 @@ class CompilationCache {
 
   // Associate the (source, kind) pair to the shared function
   // info. This may overwrite an existing mapping.
-  void PutScript(Handle<String> source, Handle<Context> context,
+  void PutScript(Handle<String> source, Handle<Context> native_context,
                  LanguageMode language_mode,
                  Handle<SharedFunctionInfo> function_info);
 
@@ -220,9 +220,9 @@ class CompilationCache {
   // The number of sub caches covering the different types to cache.
   static const int kSubCacheCount = 4;
 
-  bool IsEnabled() { return FLAG_compilation_cache && enabled_; }
+  bool IsEnabled() const { return FLAG_compilation_cache && enabled_; }
 
-  Isolate* isolate() { return isolate_; }
+  Isolate* isolate() const { return isolate_; }
 
   Isolate* isolate_;
 
diff --git a/deps/v8/src/compilation-dependencies.cc b/deps/v8/src/compilation-dependencies.cc
deleted file mode 100644
index 8be814025a0e3e..00000000000000
--- a/deps/v8/src/compilation-dependencies.cc
+++ /dev/null
@@ -1,153 +0,0 @@
-// Copyright 2015 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "src/compilation-dependencies.h"
-
-#include "src/handles-inl.h"
-#include "src/heap/factory.h"
-#include "src/isolate.h"
-#include "src/objects-inl.h"
-#include "src/zone/zone.h"
-
-namespace v8 {
-namespace internal {
-
-DependentCode* CompilationDependencies::Get(Handle<Object> object) const {
-  if (object->IsMap()) {
-    return Handle<Map>::cast(object)->dependent_code();
-  } else if (object->IsPropertyCell()) {
-    return Handle<PropertyCell>::cast(object)->dependent_code();
-  } else if (object->IsAllocationSite()) {
-    return Handle<AllocationSite>::cast(object)->dependent_code();
-  }
-  UNREACHABLE();
-}
-
-
-void CompilationDependencies::Set(Handle<Object> object,
-                                  Handle<DependentCode> dep) {
-  if (object->IsMap()) {
-    Handle<Map>::cast(object)->set_dependent_code(*dep);
-  } else if (object->IsPropertyCell()) {
-    Handle<PropertyCell>::cast(object)->set_dependent_code(*dep);
-  } else if (object->IsAllocationSite()) {
-    Handle<AllocationSite>::cast(object)->set_dependent_code(*dep);
-  } else {
-    UNREACHABLE();
-  }
-}
-
-
-void CompilationDependencies::Insert(DependentCode::DependencyGroup group,
-                                     Handle<HeapObject> object) {
-  if (groups_[group] == nullptr) {
-    groups_[group] = new (zone_->New(sizeof(ZoneVector<Handle<HeapObject>>)))
-        ZoneVector<Handle<HeapObject>>(zone_);
-  }
-  groups_[group]->push_back(object);
-
-  if (object_wrapper_.is_null()) {
-    // Allocate the wrapper if necessary.
-    object_wrapper_ =
-        isolate_->factory()->NewForeign(reinterpret_cast<Address>(this));
-  }
-
-  // Get the old dependent code list.
-  Handle<DependentCode> old_dependent_code =
-      Handle<DependentCode>(Get(object), isolate_);
-  Handle<DependentCode> new_dependent_code =
-      DependentCode::InsertCompilationDependencies(old_dependent_code, group,
-                                                   object_wrapper_);
-
-  // Set the new dependent code list if the head of the list changed.
-  if (!new_dependent_code.is_identical_to(old_dependent_code)) {
-    Set(object, new_dependent_code);
-  }
-}
-
-
-void CompilationDependencies::Commit(Handle<Code> code) {
-  if (IsEmpty()) return;
-
-  DCHECK(!object_wrapper_.is_null());
-  Handle<WeakCell> cell = Code::WeakCellFor(code);
-  AllowDeferredHandleDereference get_wrapper;
-  for (int i = 0; i < DependentCode::kGroupCount; i++) {
-    ZoneVector<Handle<HeapObject>>* group_objects = groups_[i];
-    if (group_objects == nullptr) continue;
-    DependentCode::DependencyGroup group =
-        static_cast<DependentCode::DependencyGroup>(i);
-    for (size_t j = 0; j < group_objects->size(); j++) {
-      DependentCode* dependent_code = Get(group_objects->at(j));
-      dependent_code->UpdateToFinishedCode(group, *object_wrapper_, *cell);
-    }
-    groups_[i] = nullptr;  // Zone-allocated, no need to delete.
-  }
-}
-
-
-void CompilationDependencies::Rollback() {
-  if (IsEmpty()) return;
-
-  AllowDeferredHandleDereference get_wrapper;
-  // Unregister from all dependent maps if not yet committed.
-  for (int i = 0; i < DependentCode::kGroupCount; i++) {
-    ZoneVector<Handle<HeapObject>>* group_objects = groups_[i];
-    if (group_objects == nullptr) continue;
-    DependentCode::DependencyGroup group =
-        static_cast<DependentCode::DependencyGroup>(i);
-    for (size_t j = 0; j < group_objects->size(); j++) {
-      DependentCode* dependent_code = Get(group_objects->at(j));
-      dependent_code->RemoveCompilationDependencies(group, *object_wrapper_);
-    }
-    groups_[i] = nullptr;  // Zone-allocated, no need to delete.
-  }
-}
-
-
-void CompilationDependencies::AssumeMapNotDeprecated(Handle<Map> map) {
-  DCHECK(!map->is_deprecated());
-  // Do nothing if the map cannot be deprecated.
-  if (map->CanBeDeprecated()) {
-    Insert(DependentCode::kTransitionGroup, map);
-  }
-}
-
-
-void CompilationDependencies::AssumeMapStable(Handle<Map> map) {
-  DCHECK(map->is_stable());
-  // Do nothing if the map cannot transition.
-  if (map->CanTransition()) {
-    Insert(DependentCode::kPrototypeCheckGroup, map);
-  }
-}
-
-
-void CompilationDependencies::AssumePrototypeMapsStable(
-    Handle<Map> map, MaybeHandle<JSReceiver> prototype) {
-  for (PrototypeIterator i(map); !i.IsAtEnd(); i.Advance()) {
-    Handle<JSReceiver> const current =
-        PrototypeIterator::GetCurrent<JSReceiver>(i);
-    AssumeMapStable(handle(current->map()));
-    Handle<JSReceiver> last;
-    if (prototype.ToHandle(&last) && last.is_identical_to(current)) {
-      break;
-    }
-  }
-}
-
-
-void CompilationDependencies::AssumeTransitionStable(
-    Handle<AllocationSite> site) {
-  // Do nothing if the object doesn't have any useful element transitions left.
-  ElementsKind kind = site->PointsToLiteral()
-                          ? site->boilerplate()->GetElementsKind()
-                          : site->GetElementsKind();
-  if (AllocationSite::ShouldTrack(kind)) {
-    Insert(DependentCode::kAllocationSiteTransitionChangedGroup, site);
-  }
-}
-
-}  // namespace internal
-}  // namespace v8
diff --git a/deps/v8/src/compilation-dependencies.h b/deps/v8/src/compilation-dependencies.h
deleted file mode 100644
index fa26e67b1a0d2c..00000000000000
--- a/deps/v8/src/compilation-dependencies.h
+++ /dev/null
@@ -1,74 +0,0 @@
-// Copyright 2015 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef V8_COMPILATION_DEPENDENCIES_H_
-#define V8_COMPILATION_DEPENDENCIES_H_
-
-#include "src/handles.h"
-#include "src/objects.h"
-#include "src/objects/map.h"
-#include "src/zone/zone-containers.h"
-
-namespace v8 {
-namespace internal {
-
-// Collects dependencies for this compilation, e.g. assumptions about
-// stable maps, constant globals, etc.
-class CompilationDependencies {
- public:
-  CompilationDependencies(Isolate* isolate, Zone* zone)
-      : isolate_(isolate),
-        zone_(zone),
-        object_wrapper_(Handle<Foreign>::null()),
-        aborted_(false) {
-    std::fill_n(groups_, DependentCode::kGroupCount, nullptr);
-  }
-
-  void Insert(DependentCode::DependencyGroup group, Handle<HeapObject> handle);
-
-  void AssumeInitialMapCantChange(Handle<Map> map) {
-    Insert(DependentCode::kInitialMapChangedGroup, map);
-  }
-  void AssumeFieldOwner(Handle<Map> map) {
-    Insert(DependentCode::kFieldOwnerGroup, map);
-  }
-  void AssumeMapStable(Handle<Map> map);
-  void AssumePrototypeMapsStable(
-      Handle<Map> map,
-      MaybeHandle<JSReceiver> prototype = MaybeHandle<JSReceiver>());
-  void AssumeMapNotDeprecated(Handle<Map> map);
-  void AssumePropertyCell(Handle<PropertyCell> cell) {
-    Insert(DependentCode::kPropertyCellChangedGroup, cell);
-  }
-  void AssumeTenuringDecision(Handle<AllocationSite> site) {
-    Insert(DependentCode::kAllocationSiteTenuringChangedGroup, site);
-  }
-  void AssumeTransitionStable(Handle<AllocationSite> site);
-
-  void Commit(Handle<Code> code);
-  void Rollback();
-  void Abort() { aborted_ = true; }
-  bool HasAborted() const { return aborted_; }
-
-  bool IsEmpty() const {
-    for (int i = 0; i < DependentCode::kGroupCount; i++) {
-      if (groups_[i]) return false;
-    }
-    return true;
-  }
-
- private:
-  Isolate* isolate_;
-  Zone* zone_;
-  Handle<Foreign> object_wrapper_;
-  bool aborted_;
-  ZoneVector<Handle<HeapObject> >* groups_[DependentCode::kGroupCount];
-
-  DependentCode* Get(Handle<Object> object) const;
-  void Set(Handle<Object> object, Handle<DependentCode> dep);
-};
-}  // namespace internal
-}  // namespace v8
-
-#endif  // V8_COMPILATION_DEPENDENCIES_H_
diff --git a/deps/v8/src/compiler-dispatcher/compiler-dispatcher.cc b/deps/v8/src/compiler-dispatcher/compiler-dispatcher.cc
index 56620268ceb52b..f887e2e89e0e65 100644
--- a/deps/v8/src/compiler-dispatcher/compiler-dispatcher.cc
+++ b/deps/v8/src/compiler-dispatcher/compiler-dispatcher.cc
@@ -709,8 +709,8 @@ CompilerDispatcher::JobMap::const_iterator CompilerDispatcher::RemoveJob(
     Handle<SharedFunctionInfo> shared =
         job->AsUnoptimizedCompileJob()->shared();
     if (!shared.is_null()) {
-      JobId deleted_id = shared_to_unoptimized_job_id_.Delete(shared);
-      USE(deleted_id);
+      JobId deleted_id;
+      shared_to_unoptimized_job_id_.Delete(shared, &deleted_id);
       DCHECK_EQ(it->first, deleted_id);
     }
   }
diff --git a/deps/v8/src/compiler-dispatcher/optimizing-compile-dispatcher.cc b/deps/v8/src/compiler-dispatcher/optimizing-compile-dispatcher.cc
index dd7527dfbf1b55..47b2181a88bf50 100644
--- a/deps/v8/src/compiler-dispatcher/optimizing-compile-dispatcher.cc
+++ b/deps/v8/src/compiler-dispatcher/optimizing-compile-dispatcher.cc
@@ -201,7 +201,7 @@ void OptimizingCompileDispatcher::InstallOptimizedFunctions() {
       output_queue_.pop();
     }
     OptimizedCompilationInfo* info = job->compilation_info();
-    Handle<JSFunction> function(*info->closure());
+    Handle<JSFunction> function(*info->closure(), isolate_);
     if (function->HasOptimizedCode()) {
       if (FLAG_trace_concurrent_recompilation) {
         PrintF("  ** Aborting compilation for ");
diff --git a/deps/v8/src/compiler-dispatcher/unoptimized-compile-job.cc b/deps/v8/src/compiler-dispatcher/unoptimized-compile-job.cc
index 3e90ccfa409e13..e5c58f62b2a7aa 100644
--- a/deps/v8/src/compiler-dispatcher/unoptimized-compile-job.cc
+++ b/deps/v8/src/compiler-dispatcher/unoptimized-compile-job.cc
@@ -116,20 +116,28 @@ void UnoptimizedCompileJob::PrepareOnMainThread(Isolate* isolate) {
            static_cast<void*>(this));
   }
 
-  HandleScope scope(isolate);
+  ParseInfo* parse_info = new ParseInfo(isolate, shared_);
+  parse_info_.reset(parse_info);
+
   unicode_cache_.reset(new UnicodeCache());
-  Handle<Script> script(Script::cast(shared_->script()), isolate);
-  DCHECK(script->type() != Script::TYPE_NATIVE);
+  parse_info_->set_unicode_cache(unicode_cache_.get());
+  parse_info_->set_function_literal_id(shared_->function_literal_id());
+  if (V8_UNLIKELY(FLAG_runtime_stats)) {
+    parse_info_->set_runtime_call_stats(new (parse_info_->zone())
+                                            RuntimeCallStats());
+  }
+
+  Handle<Script> script = parse_info->script();
+  HandleScope scope(isolate);
 
+  DCHECK(script->type() != Script::TYPE_NATIVE);
   Handle<String> source(String::cast(script->source()), isolate);
-  parse_info_.reset(new ParseInfo(isolate->allocator()));
-  parse_info_->InitFromIsolate(isolate);
   if (source->IsExternalTwoByteString() || source->IsExternalOneByteString()) {
     std::unique_ptr<Utf16CharacterStream> stream(ScannerStream::For(
-        source, shared_->StartPosition(), shared_->EndPosition()));
+        isolate, source, shared_->StartPosition(), shared_->EndPosition()));
     parse_info_->set_character_stream(std::move(stream));
   } else {
-    source = String::Flatten(source);
+    source = String::Flatten(isolate, source);
     const void* data;
     int offset = 0;
     int length = source->length();
@@ -172,47 +180,31 @@ void UnoptimizedCompileJob::PrepareOnMainThread(Isolate* isolate) {
     if (source->IsOneByteRepresentation()) {
       ExternalOneByteString::Resource* resource =
           new OneByteWrapper(data, length);
-      source_wrapper_.reset(resource);
       wrapper = isolate->factory()
                     ->NewExternalStringFromOneByte(resource)
                     .ToHandleChecked();
     } else {
       ExternalTwoByteString::Resource* resource =
           new TwoByteWrapper(data, length);
-      source_wrapper_.reset(resource);
       wrapper = isolate->factory()
                     ->NewExternalStringFromTwoByte(resource)
                     .ToHandleChecked();
     }
     wrapper_ = isolate->global_handles()->Create(*wrapper);
     std::unique_ptr<Utf16CharacterStream> stream(
-        ScannerStream::For(wrapper_, shared_->StartPosition() - offset,
+        ScannerStream::For(isolate, wrapper_, shared_->StartPosition() - offset,
                            shared_->EndPosition() - offset));
     parse_info_->set_character_stream(std::move(stream));
   }
-  parse_info_->set_hash_seed(isolate->heap()->HashSeed());
-  parse_info_->set_is_named_expression(shared_->is_named_expression());
-  parse_info_->set_function_flags(shared_->flags());
-  parse_info_->set_start_position(shared_->StartPosition());
-  parse_info_->set_end_position(shared_->EndPosition());
-  parse_info_->set_unicode_cache(unicode_cache_.get());
-  parse_info_->set_language_mode(shared_->language_mode());
-  parse_info_->set_function_literal_id(shared_->function_literal_id());
-  if (V8_UNLIKELY(FLAG_runtime_stats)) {
-    parse_info_->set_runtime_call_stats(new (parse_info_->zone())
-                                            RuntimeCallStats());
-  }
-
   parser_.reset(new Parser(parse_info_.get()));
-  MaybeHandle<ScopeInfo> outer_scope_info;
-  if (shared_->HasOuterScopeInfo()) {
-    outer_scope_info = handle(shared_->GetOuterScopeInfo());
-  }
-  parser_->DeserializeScopeChain(parse_info_.get(), outer_scope_info);
+  parser_->DeserializeScopeChain(isolate, parse_info_.get(),
+                                 parse_info_->maybe_outer_scope_info());
 
-  Handle<String> name(shared_->Name());
+  // Initailize the name after setting up the ast_value_factory.
+  Handle<String> name(shared_->Name(), isolate);
   parse_info_->set_function_name(
       parse_info_->ast_value_factory()->GetString(name));
+
   set_status(Status::kPrepared);
 }
 
@@ -278,7 +270,8 @@ void UnoptimizedCompileJob::FinalizeOnMainThread(Isolate* isolate) {
   }
 
   Handle<Script> script(Script::cast(shared_->script()), isolate);
-  parse_info_->set_script(script);
+  DCHECK_EQ(*parse_info_->script(), shared_->script());
+
   parser_->UpdateStatistics(isolate, script);
   parse_info_->UpdateBackgroundParseStatisticsOnMainThread(isolate);
   parser_->HandleSourceURLComments(isolate, script);
@@ -288,8 +281,7 @@ void UnoptimizedCompileJob::FinalizeOnMainThread(Isolate* isolate) {
     // Internalize ast values onto the heap.
     parse_info_->ast_value_factory()->Internalize(isolate);
     // Allocate scope infos for the literal.
-    DeclarationScope::AllocateScopeInfos(parse_info_.get(), isolate,
-                                         AnalyzeMode::kRegular);
+    DeclarationScope::AllocateScopeInfos(parse_info_.get(), isolate);
     if (compilation_job_->state() == CompilationJob::State::kFailed ||
         !Compiler::FinalizeCompilationJob(compilation_job_.release(), shared_,
                                           isolate)) {
diff --git a/deps/v8/src/compiler-dispatcher/unoptimized-compile-job.h b/deps/v8/src/compiler-dispatcher/unoptimized-compile-job.h
index 8352e4e7950a18..3e08388ca097ee 100644
--- a/deps/v8/src/compiler-dispatcher/unoptimized-compile-job.h
+++ b/deps/v8/src/compiler-dispatcher/unoptimized-compile-job.h
@@ -67,7 +67,6 @@ class V8_EXPORT_PRIVATE UnoptimizedCompileJob : public CompilerDispatcherJob {
   Handle<SharedFunctionInfo> shared_;  // Global handle.
   Handle<String> source_;              // Global handle.
   Handle<String> wrapper_;             // Global handle.
-  std::unique_ptr<v8::String::ExternalStringResourceBase> source_wrapper_;
   size_t max_stack_size_;
 
   // Members required for parsing.
diff --git a/deps/v8/src/compiler.cc b/deps/v8/src/compiler.cc
index d63f03d358e3db..62bdd708b49cd8 100644
--- a/deps/v8/src/compiler.cc
+++ b/deps/v8/src/compiler.cc
@@ -94,7 +94,7 @@ void LogFunctionCompilation(CodeEventListener::LogEventsAndTags tag,
   int column_num = Script::GetColumnNumber(script, shared->StartPosition()) + 1;
   String* script_name = script->name()->IsString()
                             ? String::cast(script->name())
-                            : isolate->heap()->empty_string();
+                            : ReadOnlyRoots(isolate).empty_string();
   CodeEventListener::LogEventsAndTags log_tag =
       Logger::ToNativeByScript(tag, *script);
   PROFILE(isolate, CodeCreateEvent(log_tag, *abstract_code, *shared,
@@ -119,7 +119,7 @@ void LogFunctionCompilation(CodeEventListener::LogEventsAndTags tag,
       UNREACHABLE();
   }
 
-  LOG(isolate, FunctionEvent(name.c_str(), nullptr, script->id(), time_taken_ms,
+  LOG(isolate, FunctionEvent(name.c_str(), script->id(), time_taken_ms,
                              shared->StartPosition(), shared->EndPosition(),
                              shared->DebugName()));
 }
@@ -198,7 +198,7 @@ CompilationJob::Status OptimizedCompilationJob::PrepareJob(Isolate* isolate) {
   DisallowJavascriptExecution no_js(isolate);
 
   if (FLAG_trace_opt && compilation_info()->IsOptimizing()) {
-    OFStream os(stdout);
+    StdoutStream os;
     os << "[compiling method " << Brief(*compilation_info()->closure())
        << " using " << compiler_name_;
     if (compilation_info()->is_osr()) os << " OSR";
@@ -227,8 +227,6 @@ CompilationJob::Status OptimizedCompilationJob::FinalizeJob(Isolate* isolate) {
   DCHECK(ThreadId::Current().Equals(isolate->thread_id()));
   DisallowCodeDependencyChange no_dependency_change;
   DisallowJavascriptExecution no_js(isolate);
-  CHECK(!compilation_info()->dependencies() ||
-        !compilation_info()->dependencies()->HasAborted());
 
   // Delegate to the underlying implementation.
   DCHECK_EQ(state(), State::kReadyToFinalize);
@@ -285,7 +283,7 @@ void OptimizedCompilationJob::RecordFunctionCompilation(
                          time_taken_to_finalize_.InMillisecondsF();
 
   Handle<Script> script(
-      Script::cast(compilation_info()->shared_info()->script()));
+      Script::cast(compilation_info()->shared_info()->script()), isolate);
   LogFunctionCompilation(tag, compilation_info()->shared_info(), script,
                          abstract_code, true, time_taken_ms, isolate);
 }
@@ -342,7 +340,7 @@ void InstallBytecodeArray(Handle<BytecodeArray> bytecode_array,
       Script::GetColumnNumber(script, shared_info->StartPosition()) + 1;
   String* script_name = script->name()->IsString()
                             ? String::cast(script->name())
-                            : isolate->heap()->empty_string();
+                            : ReadOnlyRoots(isolate).empty_string();
   CodeEventListener::LogEventsAndTags log_tag = Logger::ToNativeByScript(
       CodeEventListener::INTERPRETED_FUNCTION_TAG, *script);
   PROFILE(isolate, CodeCreateEvent(log_tag, *abstract_code, *shared_info,
@@ -374,7 +372,7 @@ void InstallUnoptimizedCode(UnoptimizedCompilationInfo* compilation_info,
     DCHECK(compilation_info->has_asm_wasm_data());
     shared_info->set_asm_wasm_data(*compilation_info->asm_wasm_data());
     shared_info->set_feedback_metadata(
-        isolate->heap()->empty_feedback_metadata());
+        ReadOnlyRoots(isolate).empty_feedback_metadata());
   }
 
   // Install coverage info on the shared function info.
@@ -509,8 +507,7 @@ bool FinalizeUnoptimizedCode(
   DCHECK(AllowCompilation::IsAllowed(isolate));
 
   // Allocate scope infos for the literal.
-  DeclarationScope::AllocateScopeInfos(parse_info, isolate,
-                                       AnalyzeMode::kRegular);
+  DeclarationScope::AllocateScopeInfos(parse_info, isolate);
 
   // Finalize the outer-most function's compilation job.
   if (FinalizeUnoptimizedCompilationJob(outer_function_job, shared_info,
@@ -548,7 +545,7 @@ V8_WARN_UNUSED_RESULT MaybeHandle<Code> GetCodeFromOptimizedCodeCache(
   RuntimeCallTimerScope runtimeTimer(
       function->GetIsolate(),
       RuntimeCallCounterId::kCompileGetFromOptimizedCodeMap);
-  Handle<SharedFunctionInfo> shared(function->shared());
+  Handle<SharedFunctionInfo> shared(function->shared(), function->GetIsolate());
   DisallowHeapAllocation no_gc;
   if (osr_offset.IsNone()) {
     if (function->feedback_cell()->value()->IsFeedbackVector()) {
@@ -561,7 +558,7 @@ V8_WARN_UNUSED_RESULT MaybeHandle<Code> GetCodeFromOptimizedCodeCache(
         // Caching of optimized code enabled and optimized code found.
         DCHECK(!code->marked_for_deoptimization());
         DCHECK(function->shared()->is_compiled());
-        return Handle<Code>(code);
+        return Handle<Code>(code, feedback_vector->GetIsolate());
       }
     }
   }
@@ -593,8 +590,9 @@ void InsertCodeIntoOptimizedCodeCache(
 
   // Cache optimized context-specific code.
   Handle<JSFunction> function = compilation_info->closure();
-  Handle<SharedFunctionInfo> shared(function->shared());
-  Handle<Context> native_context(function->context()->native_context());
+  Handle<SharedFunctionInfo> shared(function->shared(), function->GetIsolate());
+  Handle<Context> native_context(function->context()->native_context(),
+                                 function->GetIsolate());
   if (compilation_info->osr_offset().IsNone()) {
     Handle<FeedbackVector> vector =
         handle(function->feedback_vector(), function->GetIsolate());
@@ -711,7 +709,7 @@ MaybeHandle<Code> GetOptimizedCode(Handle<JSFunction> function,
   // tolerate the lack of a script without bytecode.
   DCHECK_IMPLIES(!has_script, shared->HasBytecodeArray());
   std::unique_ptr<OptimizedCompilationJob> job(
-      compiler::Pipeline::NewCompilationJob(function, has_script));
+      compiler::Pipeline::NewCompilationJob(isolate, function, has_script));
   OptimizedCompilationInfo* compilation_info = job->compilation_info();
 
   compilation_info->SetOptimizingForOsr(osr_offset, osr_frame);
@@ -755,7 +753,7 @@ MaybeHandle<Code> GetOptimizedCode(Handle<JSFunction> function,
   CanonicalHandleScope canonical(isolate);
 
   // Reopen handles in the new CompilationHandleScope.
-  compilation_info->ReopenHandlesInNewHandleScope();
+  compilation_info->ReopenHandlesInNewHandleScope(isolate);
 
   if (mode == ConcurrencyMode::kConcurrent) {
     if (GetOptimizedCodeLater(job.get(), isolate)) {
@@ -802,8 +800,6 @@ CompilationJob::Status FinalizeOptimizedCompilationJob(
   if (job->state() == CompilationJob::State::kReadyToFinalize) {
     if (shared->optimization_disabled()) {
       job->RetryOptimization(BailoutReason::kOptimizationDisabled);
-    } else if (compilation_info->dependencies()->HasAborted()) {
-      job->RetryOptimization(BailoutReason::kBailedOutDueToDependencyChange);
     } else if (job->FinalizeJob(isolate) == CompilationJob::SUCCEEDED) {
       job->RecordCompilationStats();
       job->RecordFunctionCompilation(CodeEventListener::LAZY_COMPILE_TAG,
@@ -973,8 +969,9 @@ BackgroundCompileTask::BackgroundCompileTask(ScriptStreamingData* source,
 
   // Prepare the data for the internalization phase and compilation phase, which
   // will happen in the main thread after parsing.
-  ParseInfo* info = new ParseInfo(isolate->allocator());
-  info->InitFromIsolate(isolate);
+  ParseInfo* info = new ParseInfo(isolate);
+  LOG(isolate, ScriptEvent(Logger::ScriptEventType::kBackgroundCompile,
+                           info->script_id()));
   if (V8_UNLIKELY(FLAG_runtime_stats)) {
     info->set_runtime_call_stats(new (info->zone()) RuntimeCallStats());
   } else {
@@ -1000,7 +997,7 @@ BackgroundCompileTask::BackgroundCompileTask(ScriptStreamingData* source,
   // Parser needs to stay alive for finalizing the parsing on the main
   // thread.
   source_->parser.reset(new Parser(source_->info.get()));
-  source_->parser->DeserializeScopeChain(source_->info.get(),
+  source_->parser->DeserializeScopeChain(isolate, source_->info.get(),
                                          MaybeHandle<ScopeInfo>());
 }
 
@@ -1077,7 +1074,7 @@ bool Compiler::Compile(Handle<SharedFunctionInfo> shared_info,
   AggregatedHistogramTimerScope timer(isolate->counters()->compile_lazy());
 
   // Set up parse info.
-  ParseInfo parse_info(shared_info);
+  ParseInfo parse_info(isolate, shared_info);
   parse_info.set_lazy_compile();
 
   // Check if the compiler dispatcher has shared_info enqueued for compile.
@@ -1090,13 +1087,11 @@ bool Compiler::Compile(Handle<SharedFunctionInfo> shared_info,
   }
 
   if (FLAG_preparser_scope_analysis) {
-    if (shared_info->HasPreParsedScopeData()) {
-      Handle<PreParsedScopeData> data(
-          PreParsedScopeData::cast(shared_info->preparsed_scope_data()));
-      parse_info.consumed_preparsed_scope_data()->SetData(data);
-      // After we've compiled the function, we don't need data about its
-      // skippable functions any more.
-      shared_info->ClearPreParsedScopeData();
+    if (shared_info->HasUncompiledDataWithPreParsedScope()) {
+      parse_info.consumed_preparsed_scope_data()->SetData(
+          isolate, handle(shared_info->uncompiled_data_with_pre_parsed_scope()
+                              ->pre_parsed_scope_data(),
+                          isolate));
     }
   }
 
@@ -1136,7 +1131,7 @@ bool Compiler::Compile(Handle<JSFunction> function, ClearExceptionFlag flag) {
   DCHECK(!function->HasOptimizedCode());
 
   Isolate* isolate = function->GetIsolate();
-  Handle<SharedFunctionInfo> shared_info = handle(function->shared());
+  Handle<SharedFunctionInfo> shared_info = handle(function->shared(), isolate);
 
   // Ensure shared function info is compiled.
   if (!shared_info->is_compiled() && !Compile(shared_info, flag)) return false;
@@ -1202,37 +1197,9 @@ bool Compiler::CompileOptimized(Handle<JSFunction> function,
   return true;
 }
 
-MaybeHandle<JSArray> Compiler::CompileForLiveEdit(Handle<Script> script) {
-  Isolate* isolate = script->GetIsolate();
-  DCHECK(AllowCompilation::IsAllowed(isolate));
-
-  // In order to ensure that live edit function info collection finds the newly
-  // generated shared function infos, clear the script's list temporarily
-  // and restore it at the end of this method.
-  Handle<WeakFixedArray> old_function_infos(script->shared_function_infos(),
-                                            isolate);
-  script->set_shared_function_infos(isolate->heap()->empty_weak_fixed_array());
-
-  // Start a compilation.
-  ParseInfo parse_info(script);
-  parse_info.set_eager();
-
-  // TODO(635): support extensions.
-  Handle<JSArray> infos;
-  Handle<SharedFunctionInfo> shared_info;
-  if (CompileToplevel(&parse_info, isolate).ToHandle(&shared_info)) {
-    // Check postconditions on success.
-    DCHECK(!isolate->has_pending_exception());
-    infos = LiveEditFunctionTracker::Collect(parse_info.literal(), script,
-                                             parse_info.zone(), isolate);
-  }
-
-  // Restore the original function info list in order to remain side-effect
-  // free as much as possible, since some code expects the old shared function
-  // infos to stick around.
-  script->set_shared_function_infos(*old_function_infos);
-
-  return infos;
+MaybeHandle<SharedFunctionInfo> Compiler::CompileForLiveEdit(
+    ParseInfo* parse_info, Isolate* isolate) {
+  return CompileToplevel(parse_info, isolate);
 }
 
 MaybeHandle<JSFunction> Compiler::GetFunctionFromEval(
@@ -1242,7 +1209,7 @@ MaybeHandle<JSFunction> Compiler::GetFunctionFromEval(
     int eval_scope_position, int eval_position, int line_offset,
     int column_offset, Handle<Object> script_name,
     ScriptOriginOptions options) {
-  Isolate* isolate = source->GetIsolate();
+  Isolate* isolate = context->GetIsolate();
   int source_length = source->length();
   isolate->counters()->total_eval_size()->Increment(source_length);
   isolate->counters()->total_compile_size()->Increment(source_length);
@@ -1279,24 +1246,22 @@ MaybeHandle<JSFunction> Compiler::GetFunctionFromEval(
     script = Handle<Script>(Script::cast(shared_info->script()), isolate);
     allow_eval_cache = true;
   } else {
-    script = isolate->factory()->NewScript(source);
-    if (isolate->NeedsSourcePositionsForProfiling()) {
-      Script::InitLineEnds(script);
-    }
+    ParseInfo parse_info(isolate);
+    script = parse_info.CreateScript(isolate, source, options);
     if (!script_name.is_null()) {
+      // TODO(cbruni): check whether we can store this data in options
       script->set_name(*script_name);
       script->set_line_offset(line_offset);
       script->set_column_offset(column_offset);
+      LOG(isolate, ScriptDetails(*script));
     }
-    script->set_origin_options(options);
     script->set_compilation_type(Script::COMPILATION_TYPE_EVAL);
-
     script->set_eval_from_shared(*outer_info);
     if (eval_position == kNoSourcePosition) {
       // If the position is missing, attempt to get the code offset by
       // walking the stack. Do not translate the code offset into source
       // position, but store it as negative value for lazy translation.
-      StackTraceFrameIterator it(script->GetIsolate());
+      StackTraceFrameIterator it(isolate);
       if (!it.done() && it.is_javascript()) {
         FrameSummary summary = FrameSummary::GetTop(it.javascript_frame());
         script->set_eval_from_shared(
@@ -1308,13 +1273,12 @@ MaybeHandle<JSFunction> Compiler::GetFunctionFromEval(
     }
     script->set_eval_from_position(eval_position);
 
-    ParseInfo parse_info(script);
     parse_info.set_eval();
     parse_info.set_language_mode(language_mode);
     parse_info.set_parse_restriction(restriction);
     parse_info.set_parameters_end_pos(parameters_end_pos);
     if (!context->IsNativeContext()) {
-      parse_info.set_outer_scope_info(handle(context->scope_info()));
+      parse_info.set_outer_scope_info(handle(context->scope_info(), isolate));
     }
     DCHECK(!parse_info.is_module());
 
@@ -1357,11 +1321,6 @@ MaybeHandle<JSFunction> Compiler::GetFunctionFromEval(
     }
   }
 
-  // OnAfterCompile has to be called after we create the JSFunction, which we
-  // may require to recompile the eval for debugging, if we find a function
-  // that contains break points in the eval script.
-  isolate->debug()->OnAfterCompile(script);
-
   return result;
 }
 
@@ -1403,7 +1362,8 @@ MaybeHandle<JSFunction> Compiler::GetFunctionFromString(
   // Compile source string in the native context.
   int eval_scope_position = 0;
   int eval_position = kNoSourcePosition;
-  Handle<SharedFunctionInfo> outer_info(native_context->closure()->shared());
+  Handle<SharedFunctionInfo> outer_info(
+      native_context->empty_function()->shared(), isolate);
   return Compiler::GetFunctionFromEval(
       source, outer_info, native_context, LanguageMode::kSloppy, restriction,
       parameters_end_pos, eval_scope_position, eval_position);
@@ -1606,29 +1566,20 @@ struct ScriptCompileTimerScope {
   }
 };
 
-Handle<Script> NewScript(Isolate* isolate, Handle<String> source,
+Handle<Script> NewScript(Isolate* isolate, ParseInfo* parse_info,
+                         Handle<String> source,
                          Compiler::ScriptDetails script_details,
                          ScriptOriginOptions origin_options,
                          NativesFlag natives) {
   // Create a script object describing the script to be compiled.
-  Handle<Script> script = isolate->factory()->NewScript(source);
-  if (isolate->NeedsSourcePositionsForProfiling()) {
-    Script::InitLineEnds(script);
-  }
-  if (natives == NATIVES_CODE) {
-    script->set_type(Script::TYPE_NATIVE);
-  } else if (natives == EXTENSION_CODE) {
-    script->set_type(Script::TYPE_EXTENSION);
-  } else if (natives == INSPECTOR_CODE) {
-    script->set_type(Script::TYPE_INSPECTOR);
-  }
+  Handle<Script> script =
+      parse_info->CreateScript(isolate, source, origin_options, natives);
   Handle<Object> script_name;
   if (script_details.name_obj.ToHandle(&script_name)) {
     script->set_name(*script_name);
     script->set_line_offset(script_details.line_offset);
     script->set_column_offset(script_details.column_offset);
   }
-  script->set_origin_options(origin_options);
   Handle<Object> source_map_url;
   if (script_details.source_map_url.ToHandle(&source_map_url)) {
     script->set_source_mapping_url(*source_map_url);
@@ -1637,6 +1588,7 @@ Handle<Script> NewScript(Isolate* isolate, Handle<String> source,
   if (script_details.host_defined_options.ToHandle(&host_defined_options)) {
     script->set_host_defined_options(*host_defined_options);
   }
+  LOG(isolate, ScriptDetails(*script));
   return script;
 }
 
@@ -1670,7 +1622,7 @@ MaybeHandle<SharedFunctionInfo> Compiler::GetSharedFunctionInfoForScript(
   if (extension == nullptr) {
     bool can_consume_code_cache =
         compile_options == ScriptCompiler::kConsumeCodeCache &&
-        !isolate->debug()->is_loaded();
+        !isolate->debug()->is_active();
     if (can_consume_code_cache) {
       compile_timer.set_consuming_code_cache();
     }
@@ -1691,7 +1643,8 @@ MaybeHandle<SharedFunctionInfo> Compiler::GetSharedFunctionInfoForScript(
       TRACE_EVENT0(TRACE_DISABLED_BY_DEFAULT("v8.compile"),
                    "V8.CompileDeserialize");
       Handle<SharedFunctionInfo> inner_result;
-      if (CodeSerializer::Deserialize(isolate, cached_data, source)
+      if (CodeSerializer::Deserialize(isolate, cached_data, source,
+                                      origin_options)
               .ToHandle(&inner_result)) {
         // Promote to per-isolate compilation cache.
         DCHECK(inner_result->is_compiled());
@@ -1707,12 +1660,12 @@ MaybeHandle<SharedFunctionInfo> Compiler::GetSharedFunctionInfoForScript(
   }
 
   if (maybe_result.is_null()) {
+    ParseInfo parse_info(isolate);
     // No cache entry found compile the script.
-    Handle<Script> script =
-        NewScript(isolate, source, script_details, origin_options, natives);
+    NewScript(isolate, &parse_info, source, script_details, origin_options,
+              natives);
 
     // Compile the function and add it to the isolate cache.
-    ParseInfo parse_info(script);
     Zone compile_zone(isolate->allocator(), ZONE_NAME);
     if (origin_options.IsModule()) parse_info.set_module();
     parse_info.set_extension(extension);
@@ -1732,12 +1685,6 @@ MaybeHandle<SharedFunctionInfo> Compiler::GetSharedFunctionInfoForScript(
     }
   }
 
-  // On success, report script compilation to debugger.
-  Handle<SharedFunctionInfo> result;
-  if (maybe_result.ToHandle(&result)) {
-    isolate->debug()->OnAfterCompile(handle(Script::cast(result->script())));
-  }
-
   return maybe_result;
 }
 
@@ -1747,7 +1694,7 @@ MaybeHandle<JSFunction> Compiler::GetWrappedFunction(
     ScriptOriginOptions origin_options, ScriptData* cached_data,
     v8::ScriptCompiler::CompileOptions compile_options,
     v8::ScriptCompiler::NoCacheReason no_cache_reason) {
-  Isolate* isolate = source->GetIsolate();
+  Isolate* isolate = context->GetIsolate();
   ScriptCompileTimerScope compile_timer(isolate, no_cache_reason);
 
   if (compile_options == ScriptCompiler::kNoCompileOptions ||
@@ -1766,7 +1713,7 @@ MaybeHandle<JSFunction> Compiler::GetWrappedFunction(
   MaybeHandle<SharedFunctionInfo> maybe_result;
   bool can_consume_code_cache =
       compile_options == ScriptCompiler::kConsumeCodeCache &&
-      !isolate->debug()->is_loaded();
+      !isolate->debug()->is_active();
   if (can_consume_code_cache) {
     compile_timer.set_consuming_code_cache();
     // Then check cached code provided by embedder.
@@ -1775,7 +1722,8 @@ MaybeHandle<JSFunction> Compiler::GetWrappedFunction(
         isolate, RuntimeCallCounterId::kCompileDeserialize);
     TRACE_EVENT0(TRACE_DISABLED_BY_DEFAULT("v8.compile"),
                  "V8.CompileDeserialize");
-    maybe_result = CodeSerializer::Deserialize(isolate, cached_data, source);
+    maybe_result = CodeSerializer::Deserialize(isolate, cached_data, source,
+                                               origin_options);
     if (maybe_result.is_null()) {
       // Deserializer failed. Fall through to compile.
       compile_timer.set_consuming_code_cache_failed();
@@ -1785,16 +1733,16 @@ MaybeHandle<JSFunction> Compiler::GetWrappedFunction(
   Handle<SharedFunctionInfo> wrapped;
   Handle<Script> script;
   if (!maybe_result.ToHandle(&wrapped)) {
-    script = NewScript(isolate, source, script_details, origin_options,
-                       NOT_NATIVES_CODE);
+    ParseInfo parse_info(isolate);
+    script = NewScript(isolate, &parse_info, source, script_details,
+                       origin_options, NOT_NATIVES_CODE);
     script->set_wrapped_arguments(*arguments);
 
-    ParseInfo parse_info(script);
     parse_info.set_eval();  // Use an eval scope as declaration scope.
     parse_info.set_wrapped_as_function();
     // parse_info.set_eager(compile_options == ScriptCompiler::kEagerCompile);
     if (!context->IsNativeContext()) {
-      parse_info.set_outer_scope_info(handle(context->scope_info()));
+      parse_info.set_outer_scope_info(handle(context->scope_info(), isolate));
     }
     parse_info.set_language_mode(
         stricter_language_mode(parse_info.language_mode(), language_mode));
@@ -1804,7 +1752,7 @@ MaybeHandle<JSFunction> Compiler::GetWrappedFunction(
     if (maybe_result.is_null()) isolate->ReportPendingMessages();
     ASSIGN_RETURN_ON_EXCEPTION(isolate, top_level, maybe_result, JSFunction);
 
-    SharedFunctionInfo::ScriptIterator infos(script);
+    SharedFunctionInfo::ScriptIterator infos(isolate, *script);
     while (SharedFunctionInfo* info = infos.Next()) {
       if (info->is_wrapped()) {
         wrapped = Handle<SharedFunctionInfo>(info, isolate);
@@ -1816,14 +1764,8 @@ MaybeHandle<JSFunction> Compiler::GetWrappedFunction(
     script = Handle<Script>(Script::cast(wrapped->script()), isolate);
   }
 
-  Handle<JSFunction> function =
-      isolate->factory()->NewFunctionFromSharedFunctionInfo(wrapped, context,
+  return isolate->factory()->NewFunctionFromSharedFunctionInfo(wrapped, context,
                                                             NOT_TENURED);
-  // OnAfterCompile has to be called after we create the JSFunction, which we
-  // may require to recompile the eval for debugging, if we find a function
-  // that contains break points in the eval script.
-  isolate->debug()->OnAfterCompile(script);
-  return function;
 }
 
 ScriptCompiler::ScriptStreamingTask* Compiler::NewBackgroundCompileTask(
@@ -1862,9 +1804,9 @@ Compiler::GetSharedFunctionInfoForStreamedScript(
   if (maybe_result.is_null()) {
     // No cache entry found, finalize compilation of the script and add it to
     // the isolate cache.
-    Handle<Script> script = NewScript(isolate, source, script_details,
-                                      origin_options, NOT_NATIVES_CODE);
-    parse_info->set_script(script);
+    Handle<Script> script =
+        NewScript(isolate, parse_info, source, script_details, origin_options,
+                  NOT_NATIVES_CODE);
     streaming_data->parser->UpdateStatistics(isolate, script);
     streaming_data->parser->HandleSourceURLComments(isolate, script);
 
@@ -1893,12 +1835,6 @@ Compiler::GetSharedFunctionInfoForStreamedScript(
     }
   }
 
-  // On success, report script compilation to debugger.
-  Handle<SharedFunctionInfo> result;
-  if (maybe_result.ToHandle(&result)) {
-    isolate->debug()->OnAfterCompile(handle(Script::cast(result->script())));
-  }
-
   streaming_data->Release();
   return maybe_result;
 }
@@ -1955,7 +1891,7 @@ bool Compiler::FinalizeCompilationJob(UnoptimizedCompilationJob* raw_job,
 
 void Compiler::PostInstantiation(Handle<JSFunction> function,
                                  PretenureFlag pretenure) {
-  Handle<SharedFunctionInfo> shared(function->shared());
+  Handle<SharedFunctionInfo> shared(function->shared(), function->GetIsolate());
 
   if (FLAG_always_opt && shared->allows_lazy_compilation() &&
       !shared->optimization_disabled() && !shared->HasAsmWasmData() &&
@@ -1981,6 +1917,13 @@ void Compiler::PostInstantiation(Handle<JSFunction> function,
       function->set_code(code);
     }
   }
+
+  if (shared->is_toplevel() || shared->is_wrapped()) {
+    // If it's a top-level script, report compilation to the debugger.
+    Handle<Script> script(
+        handle(Script::cast(shared->script()), function->GetIsolate()));
+    function->GetIsolate()->debug()->OnAfterCompile(script);
+  }
 }
 
 // ----------------------------------------------------------------------------
diff --git a/deps/v8/src/compiler.h b/deps/v8/src/compiler.h
index 1477b4f3f1bf45..e6e2195b42d5a1 100644
--- a/deps/v8/src/compiler.h
+++ b/deps/v8/src/compiler.h
@@ -57,7 +57,9 @@ class V8_EXPORT_PRIVATE Compiler : public AllStatic {
                       ClearExceptionFlag flag);
   static bool Compile(Handle<JSFunction> function, ClearExceptionFlag flag);
   static bool CompileOptimized(Handle<JSFunction> function, ConcurrencyMode);
-  static MaybeHandle<JSArray> CompileForLiveEdit(Handle<Script> script);
+
+  V8_WARN_UNUSED_RESULT static MaybeHandle<SharedFunctionInfo>
+  CompileForLiveEdit(ParseInfo* parse_info, Isolate* isolate);
 
   // Creates a new task that when run will parse and compile the streamed
   // script associated with |streaming_data| and can be finalized with
diff --git a/deps/v8/src/compiler/OWNERS b/deps/v8/src/compiler/OWNERS
index e7c4b7542f0599..40783a35117915 100644
--- a/deps/v8/src/compiler/OWNERS
+++ b/deps/v8/src/compiler/OWNERS
@@ -22,4 +22,6 @@ per-file wasm-*=kschimpf@chromium.org
 
 per-file int64-lowering.*=ahaas@chromium.org
 
+per-file simd-scalar-lowering.*=aseemgarg@chromium.org
+
 # COMPONENT: Blink>JavaScript>Compiler
diff --git a/deps/v8/src/compiler/access-builder.cc b/deps/v8/src/compiler/access-builder.cc
index bbef35570c51b1..0b78795e008462 100644
--- a/deps/v8/src/compiler/access-builder.cc
+++ b/deps/v8/src/compiler/access-builder.cc
@@ -10,6 +10,9 @@
 #include "src/handles-inl.h"
 #include "src/heap/heap.h"
 #include "src/objects-inl.h"
+#include "src/objects/arguments.h"
+#include "src/objects/js-collection.h"
+#include "src/objects/module.h"
 
 namespace v8 {
 namespace internal {
@@ -82,9 +85,9 @@ FieldAccess AccessBuilder::ForJSObjectElements() {
 
 
 // static
-FieldAccess AccessBuilder::ForJSObjectInObjectProperty(Handle<Map> map,
+FieldAccess AccessBuilder::ForJSObjectInObjectProperty(const MapRef& map,
                                                        int index) {
-  int const offset = map->GetInObjectPropertyOffset(index);
+  int const offset = map.GetInObjectPropertyOffset(index);
   FieldAccess access = {kTaggedBase,         offset,
                         MaybeHandle<Name>(), MaybeHandle<Map>(),
                         Type::NonInternal(), MachineType::AnyTagged(),
@@ -259,9 +262,9 @@ FieldAccess AccessBuilder::ForJSGeneratorObjectInputOrDebugPos() {
 
 
 // static
-FieldAccess AccessBuilder::ForJSGeneratorObjectRegisterFile() {
+FieldAccess AccessBuilder::ForJSGeneratorObjectParametersAndRegisters() {
   FieldAccess access = {
-      kTaggedBase,         JSGeneratorObject::kRegisterFileOffset,
+      kTaggedBase,         JSGeneratorObject::kParametersAndRegistersOffset,
       Handle<Name>(),      MaybeHandle<Map>(),
       Type::Internal(),    MachineType::AnyTagged(),
       kPointerWriteBarrier};
@@ -851,25 +854,6 @@ FieldAccess AccessBuilder::ForContextSlot(size_t index) {
   return access;
 }
 
-// static
-FieldAccess AccessBuilder::ForContextExtensionScopeInfo() {
-  FieldAccess access = {
-      kTaggedBase,           ContextExtension::kScopeInfoOffset,
-      Handle<Name>(),        MaybeHandle<Map>(),
-      Type::OtherInternal(), MachineType::AnyTagged(),
-      kFullWriteBarrier};
-  return access;
-}
-
-// static
-FieldAccess AccessBuilder::ForContextExtensionExtension() {
-  FieldAccess access = {kTaggedBase,      ContextExtension::kExtensionOffset,
-                        Handle<Name>(),   MaybeHandle<Map>(),
-                        Type::Any(),      MachineType::AnyTagged(),
-                        kFullWriteBarrier};
-  return access;
-}
-
 // static
 ElementAccess AccessBuilder::ForFixedArrayElement() {
   ElementAccess access = {kTaggedBase, FixedArray::kHeaderSize, Type::Any(),
@@ -878,9 +862,11 @@ ElementAccess AccessBuilder::ForFixedArrayElement() {
 }
 
 // static
-ElementAccess AccessBuilder::ForFixedArrayElement(ElementsKind kind) {
-  ElementAccess access = {kTaggedBase, FixedArray::kHeaderSize, Type::Any(),
-                          MachineType::AnyTagged(), kFullWriteBarrier};
+ElementAccess AccessBuilder::ForFixedArrayElement(
+    ElementsKind kind, LoadSensitivity load_sensitivity) {
+  ElementAccess access = {kTaggedBase,       FixedArray::kHeaderSize,
+                          Type::Any(),       MachineType::AnyTagged(),
+                          kFullWriteBarrier, load_sensitivity};
   switch (kind) {
     case PACKED_SMI_ELEMENTS:
       access.type = Type::SignedSmall();
@@ -939,50 +925,59 @@ FieldAccess AccessBuilder::ForEnumCacheIndices() {
 }
 
 // static
-ElementAccess AccessBuilder::ForTypedArrayElement(ExternalArrayType type,
-                                                  bool is_external) {
+ElementAccess AccessBuilder::ForTypedArrayElement(
+    ExternalArrayType type, bool is_external,
+    LoadSensitivity load_sensitivity) {
   BaseTaggedness taggedness = is_external ? kUntaggedBase : kTaggedBase;
   int header_size = is_external ? 0 : FixedTypedArrayBase::kDataOffset;
   switch (type) {
     case kExternalInt8Array: {
-      ElementAccess access = {taggedness, header_size, Type::Signed32(),
-                              MachineType::Int8(), kNoWriteBarrier};
+      ElementAccess access = {taggedness,       header_size,
+                              Type::Signed32(), MachineType::Int8(),
+                              kNoWriteBarrier,  load_sensitivity};
       return access;
     }
     case kExternalUint8Array:
     case kExternalUint8ClampedArray: {
-      ElementAccess access = {taggedness, header_size, Type::Unsigned32(),
-                              MachineType::Uint8(), kNoWriteBarrier};
+      ElementAccess access = {taggedness,         header_size,
+                              Type::Unsigned32(), MachineType::Uint8(),
+                              kNoWriteBarrier,    load_sensitivity};
       return access;
     }
     case kExternalInt16Array: {
-      ElementAccess access = {taggedness, header_size, Type::Signed32(),
-                              MachineType::Int16(), kNoWriteBarrier};
+      ElementAccess access = {taggedness,       header_size,
+                              Type::Signed32(), MachineType::Int16(),
+                              kNoWriteBarrier,  load_sensitivity};
       return access;
     }
     case kExternalUint16Array: {
-      ElementAccess access = {taggedness, header_size, Type::Unsigned32(),
-                              MachineType::Uint16(), kNoWriteBarrier};
+      ElementAccess access = {taggedness,         header_size,
+                              Type::Unsigned32(), MachineType::Uint16(),
+                              kNoWriteBarrier,    load_sensitivity};
       return access;
     }
     case kExternalInt32Array: {
-      ElementAccess access = {taggedness, header_size, Type::Signed32(),
-                              MachineType::Int32(), kNoWriteBarrier};
+      ElementAccess access = {taggedness,       header_size,
+                              Type::Signed32(), MachineType::Int32(),
+                              kNoWriteBarrier,  load_sensitivity};
       return access;
     }
     case kExternalUint32Array: {
-      ElementAccess access = {taggedness, header_size, Type::Unsigned32(),
-                              MachineType::Uint32(), kNoWriteBarrier};
+      ElementAccess access = {taggedness,         header_size,
+                              Type::Unsigned32(), MachineType::Uint32(),
+                              kNoWriteBarrier,    load_sensitivity};
       return access;
     }
     case kExternalFloat32Array: {
-      ElementAccess access = {taggedness, header_size, Type::Number(),
-                              MachineType::Float32(), kNoWriteBarrier};
+      ElementAccess access = {taggedness,      header_size,
+                              Type::Number(),  MachineType::Float32(),
+                              kNoWriteBarrier, load_sensitivity};
       return access;
     }
     case kExternalFloat64Array: {
-      ElementAccess access = {taggedness, header_size, Type::Number(),
-                              MachineType::Float64(), kNoWriteBarrier};
+      ElementAccess access = {taggedness,      header_size,
+                              Type::Number(),  MachineType::Float64(),
+                              kNoWriteBarrier, load_sensitivity};
       return access;
     }
     case kExternalBigInt64Array:
diff --git a/deps/v8/src/compiler/access-builder.h b/deps/v8/src/compiler/access-builder.h
index 44298c2188ea06..945edf30148ded 100644
--- a/deps/v8/src/compiler/access-builder.h
+++ b/deps/v8/src/compiler/access-builder.h
@@ -48,7 +48,7 @@ class V8_EXPORT_PRIVATE AccessBuilder final
   static FieldAccess ForJSObjectElements();
 
   // Provides access to JSObject inobject property fields.
-  static FieldAccess ForJSObjectInObjectProperty(Handle<Map> map, int index);
+  static FieldAccess ForJSObjectInObjectProperty(const MapRef& map, int index);
   static FieldAccess ForJSObjectOffset(
       int offset, WriteBarrierKind write_barrier_kind = kFullWriteBarrier);
 
@@ -94,8 +94,8 @@ class V8_EXPORT_PRIVATE AccessBuilder final
   // Provides access to JSGeneratorObject::input_or_debug_pos() field.
   static FieldAccess ForJSGeneratorObjectInputOrDebugPos();
 
-  // Provides access to JSGeneratorObject::register_file() field.
-  static FieldAccess ForJSGeneratorObjectRegisterFile();
+  // Provides access to JSGeneratorObject::parameters_and_registers() field.
+  static FieldAccess ForJSGeneratorObjectParametersAndRegisters();
 
   // Provides access to JSGeneratorObject::function() field.
   static FieldAccess ForJSGeneratorObjectFunction();
@@ -273,13 +273,11 @@ class V8_EXPORT_PRIVATE AccessBuilder final
   // Provides access to Context slots.
   static FieldAccess ForContextSlot(size_t index);
 
-  // Provides access to ContextExtension fields.
-  static FieldAccess ForContextExtensionScopeInfo();
-  static FieldAccess ForContextExtensionExtension();
-
   // Provides access to FixedArray elements.
   static ElementAccess ForFixedArrayElement();
-  static ElementAccess ForFixedArrayElement(ElementsKind kind);
+  static ElementAccess ForFixedArrayElement(
+      ElementsKind kind,
+      LoadSensitivity load_sensitivity = LoadSensitivity::kUnsafe);
 
   // Provides access to FixedDoubleArray elements.
   static ElementAccess ForFixedDoubleArrayElement();
@@ -291,8 +289,9 @@ class V8_EXPORT_PRIVATE AccessBuilder final
   static FieldAccess ForEnumCacheIndices();
 
   // Provides access to Fixed{type}TypedArray and External{type}Array elements.
-  static ElementAccess ForTypedArrayElement(ExternalArrayType type,
-                                            bool is_external);
+  static ElementAccess ForTypedArrayElement(
+      ExternalArrayType type, bool is_external,
+      LoadSensitivity load_sensitivity = LoadSensitivity::kUnsafe);
 
   // Provides access to HashTable fields.
   static FieldAccess ForHashTableBaseNumberOfElements();
diff --git a/deps/v8/src/compiler/access-info.cc b/deps/v8/src/compiler/access-info.cc
index c1254e4cdbb61f..3aae014e917e48 100644
--- a/deps/v8/src/compiler/access-info.cc
+++ b/deps/v8/src/compiler/access-info.cc
@@ -4,14 +4,17 @@
 
 #include <ostream>
 
-#include "src/accessors.h"
-#include "src/compilation-dependencies.h"
 #include "src/compiler/access-info.h"
+
+#include "src/accessors.h"
+#include "src/compiler/compilation-dependencies.h"
 #include "src/compiler/type-cache.h"
 #include "src/field-index-inl.h"
 #include "src/field-type.h"
 #include "src/ic/call-optimization.h"
 #include "src/objects-inl.h"
+#include "src/objects/module-inl.h"
+#include "src/objects/templates.h"
 
 namespace v8 {
 namespace internal {
@@ -85,9 +88,10 @@ PropertyAccessInfo PropertyAccessInfo::DataConstant(
 PropertyAccessInfo PropertyAccessInfo::DataField(
     PropertyConstness constness, MapHandles const& receiver_maps,
     FieldIndex field_index, MachineRepresentation field_representation,
-    Type* field_type, MaybeHandle<Map> field_map, MaybeHandle<JSObject> holder,
+    Type field_type, MaybeHandle<Map> field_map, MaybeHandle<JSObject> holder,
     MaybeHandle<Map> transition_map) {
-  Kind kind = constness == kConst ? kDataConstantField : kDataField;
+  Kind kind =
+      constness == PropertyConstness::kConst ? kDataConstantField : kDataField;
   return PropertyAccessInfo(kind, holder, transition_map, field_index,
                             field_representation, field_type, field_map,
                             receiver_maps);
@@ -133,7 +137,7 @@ PropertyAccessInfo::PropertyAccessInfo(Kind kind, MaybeHandle<JSObject> holder,
 PropertyAccessInfo::PropertyAccessInfo(
     Kind kind, MaybeHandle<JSObject> holder, MaybeHandle<Map> transition_map,
     FieldIndex field_index, MachineRepresentation field_representation,
-    Type* field_type, MaybeHandle<Map> field_map,
+    Type field_type, MaybeHandle<Map> field_map,
     MapHandles const& receiver_maps)
     : kind_(kind),
       receiver_maps_(receiver_maps),
@@ -234,8 +238,10 @@ Handle<Cell> PropertyAccessInfo::export_cell() const {
 }
 
 AccessInfoFactory::AccessInfoFactory(CompilationDependencies* dependencies,
+                                     const JSHeapBroker* js_heap_broker,
                                      Handle<Context> native_context, Zone* zone)
     : dependencies_(dependencies),
+      js_heap_broker_(js_heap_broker),
       native_context_(native_context),
       isolate_(native_context->GetIsolate()),
       type_cache_(TypeCache::Get()),
@@ -272,7 +278,7 @@ bool AccessInfoFactory::ComputeElementAccessInfos(
   MapHandles possible_transition_targets;
   possible_transition_targets.reserve(maps.size());
   for (Handle<Map> map : maps) {
-    if (Map::TryUpdate(map).ToHandle(&map)) {
+    if (Map::TryUpdate(isolate(), map).ToHandle(&map)) {
       if (CanInlineElementAccess(map) &&
           IsFastElementsKind(map->elements_kind()) &&
           GetInitialFastElementsKind() != map->elements_kind()) {
@@ -286,16 +292,17 @@ bool AccessInfoFactory::ComputeElementAccessInfos(
   receiver_maps.reserve(maps.size());
   MapTransitionList transitions(maps.size());
   for (Handle<Map> map : maps) {
-    if (Map::TryUpdate(map).ToHandle(&map)) {
+    if (Map::TryUpdate(isolate(), map).ToHandle(&map)) {
       // Don't generate elements kind transitions from stable maps.
-      Map* transition_target = map->is_stable()
-                                   ? nullptr
-                                   : map->FindElementsKindTransitionedMap(
-                                         possible_transition_targets);
+      Map* transition_target =
+          map->is_stable() ? nullptr
+                           : map->FindElementsKindTransitionedMap(
+                                 isolate(), possible_transition_targets);
       if (transition_target == nullptr) {
         receiver_maps.push_back(map);
       } else {
-        transitions.push_back(std::make_pair(map, handle(transition_target)));
+        transitions.push_back(
+            std::make_pair(map, handle(transition_target, isolate())));
       }
     }
   }
@@ -343,7 +350,7 @@ bool AccessInfoFactory::ComputePropertyAccessInfo(
   do {
     // Lookup the named property on the {map}.
     Handle<DescriptorArray> descriptors(map->instance_descriptors(), isolate());
-    int const number = descriptors->SearchWithCache(isolate(), *name, *map);
+    int const number = descriptors->Search(*name, *map);
     if (number != DescriptorArray::kNotFound) {
       PropertyDetails const details = descriptors->GetDetails(number);
       if (access_mode == AccessMode::kStore ||
@@ -366,7 +373,7 @@ bool AccessInfoFactory::ComputePropertyAccessInfo(
           Representation details_representation = details.representation();
           FieldIndex field_index =
               FieldIndex::ForPropertyIndex(*map, index, details_representation);
-          Type* field_type = Type::NonInternal();
+          Type field_type = Type::NonInternal();
           MachineRepresentation field_representation =
               MachineRepresentation::kTagged;
           MaybeHandle<Map> field_map;
@@ -389,13 +396,10 @@ bool AccessInfoFactory::ComputePropertyAccessInfo(
               // The field type was cleared by the GC, so we don't know anything
               // about the contents now.
             } else if (descriptors_field_type->IsClass()) {
-              // Add proper code dependencies in case of stable field map(s).
-              Handle<Map> field_owner_map(map->FindFieldOwner(number),
-                                          isolate());
-              dependencies()->AssumeFieldOwner(field_owner_map);
-
+              dependencies()->DependOnFieldType(map, number);
               // Remember the field map, and try to infer a useful type.
-              field_type = Type::For(descriptors_field_type->AsClass());
+              field_type = Type::For(js_heap_broker(),
+                                     descriptors_field_type->AsClass());
               field_map = descriptors_field_type->AsClass();
             }
           }
@@ -415,7 +419,7 @@ bool AccessInfoFactory::ComputePropertyAccessInfo(
           DCHECK(!FLAG_track_constant_fields);
           *access_info = PropertyAccessInfo::DataConstant(
               MapHandles{receiver_map},
-              handle(descriptors->GetValue(number), isolate()), holder);
+              handle(descriptors->GetStrongValue(number), isolate()), holder);
           return true;
         } else {
           DCHECK_EQ(kAccessor, details.kind());
@@ -440,7 +444,8 @@ bool AccessInfoFactory::ComputePropertyAccessInfo(
                 MapHandles{receiver_map}, cell);
             return true;
           }
-          Handle<Object> accessors(descriptors->GetValue(number), isolate());
+          Handle<Object> accessors(descriptors->GetStrongValue(number),
+                                   isolate());
           if (!accessors->IsAccessorPair()) return false;
           Handle<Object> accessor(
               access_mode == AccessMode::kLoad
@@ -448,7 +453,7 @@ bool AccessInfoFactory::ComputePropertyAccessInfo(
                   : Handle<AccessorPair>::cast(accessors)->setter(),
               isolate());
           if (!accessor->IsJSFunction()) {
-            CallOptimization optimization(accessor);
+            CallOptimization optimization(isolate(), accessor);
             if (!optimization.is_simple_api_call()) return false;
             if (optimization.IsCrossContextLazyAccessorPair(*native_context_,
                                                             *map)) {
@@ -553,7 +558,7 @@ bool AccessInfoFactory::ComputePropertyAccessInfos(
     MapHandles const& maps, Handle<Name> name, AccessMode access_mode,
     ZoneVector<PropertyAccessInfo>* access_infos) {
   for (Handle<Map> map : maps) {
-    if (Map::TryUpdate(map).ToHandle(&map)) {
+    if (Map::TryUpdate(isolate(), map).ToHandle(&map)) {
       PropertyAccessInfo access_info;
       if (!ComputePropertyAccessInfo(map, name, access_mode, &access_info)) {
         return false;
@@ -617,17 +622,17 @@ bool AccessInfoFactory::LookupSpecialFieldAccessor(
     Handle<Map> map, Handle<Name> name, PropertyAccessInfo* access_info) {
   // Check for special JSObject field accessors.
   FieldIndex field_index;
-  if (Accessors::IsJSObjectFieldAccessor(map, name, &field_index)) {
-    Type* field_type = Type::NonInternal();
+  if (Accessors::IsJSObjectFieldAccessor(isolate(), map, name, &field_index)) {
+    Type field_type = Type::NonInternal();
     MachineRepresentation field_representation = MachineRepresentation::kTagged;
     if (map->IsStringMap()) {
-      DCHECK(Name::Equals(factory()->length_string(), name));
+      DCHECK(Name::Equals(isolate(), factory()->length_string(), name));
       // The String::length property is always a smi in the range
       // [0, String::kMaxLength].
       field_type = type_cache_.kStringLengthType;
       field_representation = MachineRepresentation::kTaggedSigned;
     } else if (map->IsJSArrayMap()) {
-      DCHECK(Name::Equals(factory()->length_string(), name));
+      DCHECK(Name::Equals(isolate(), factory()->length_string(), name));
       // The JSArray::length property is a smi in the range
       // [0, FixedDoubleArray::kMaxLength] in case of fast double
       // elements, a smi in the range [0, FixedArray::kMaxLength]
@@ -644,9 +649,9 @@ bool AccessInfoFactory::LookupSpecialFieldAccessor(
       }
     }
     // Special fields are always mutable.
-    *access_info =
-        PropertyAccessInfo::DataField(kMutable, MapHandles{map}, field_index,
-                                      field_representation, field_type);
+    *access_info = PropertyAccessInfo::DataField(
+        PropertyConstness::kMutable, MapHandles{map}, field_index,
+        field_representation, field_type);
     return true;
   }
   return false;
@@ -658,10 +663,10 @@ bool AccessInfoFactory::LookupTransition(Handle<Map> map, Handle<Name> name,
                                          PropertyAccessInfo* access_info) {
   // Check if the {map} has a data transition with the given {name}.
   Map* transition =
-      TransitionsAccessor(map).SearchTransition(*name, kData, NONE);
+      TransitionsAccessor(isolate(), map).SearchTransition(*name, kData, NONE);
   if (transition == nullptr) return false;
 
-  Handle<Map> transition_map(transition);
+  Handle<Map> transition_map(transition, isolate());
   int const number = transition_map->LastAdded();
   PropertyDetails const details =
       transition_map->instance_descriptors()->GetDetails(number);
@@ -673,7 +678,7 @@ bool AccessInfoFactory::LookupTransition(Handle<Map> map, Handle<Name> name,
   Representation details_representation = details.representation();
   FieldIndex field_index = FieldIndex::ForPropertyIndex(*transition_map, index,
                                                         details_representation);
-  Type* field_type = Type::NonInternal();
+  Type field_type = Type::NonInternal();
   MaybeHandle<Map> field_map;
   MachineRepresentation field_representation = MachineRepresentation::kTagged;
   if (details_representation.IsSmi()) {
@@ -693,21 +698,18 @@ bool AccessInfoFactory::LookupTransition(Handle<Map> map, Handle<Name> name,
       // Store is not safe if the field type was cleared.
       return false;
     } else if (descriptors_field_type->IsClass()) {
-      // Add proper code dependencies in case of stable field map(s).
-      Handle<Map> field_owner_map(transition_map->FindFieldOwner(number),
-                                  isolate());
-      dependencies()->AssumeFieldOwner(field_owner_map);
-
+      dependencies()->DependOnFieldType(transition_map, number);
       // Remember the field map, and try to infer a useful type.
-      field_type = Type::For(descriptors_field_type->AsClass());
+      field_type =
+          Type::For(js_heap_broker(), descriptors_field_type->AsClass());
       field_map = descriptors_field_type->AsClass();
     }
   }
-  dependencies()->AssumeMapNotDeprecated(transition_map);
+  dependencies()->DependOnTransition(transition_map);
   // Transitioning stores are never stores to constant fields.
   *access_info = PropertyAccessInfo::DataField(
-      kMutable, MapHandles{map}, field_index, field_representation, field_type,
-      field_map, holder, transition_map);
+      PropertyConstness::kMutable, MapHandles{map}, field_index,
+      field_representation, field_type, field_map, holder, transition_map);
   return true;
 }
 
diff --git a/deps/v8/src/compiler/access-info.h b/deps/v8/src/compiler/access-info.h
index 808b8af0d1a0bb..887147deecdb4b 100644
--- a/deps/v8/src/compiler/access-info.h
+++ b/deps/v8/src/compiler/access-info.h
@@ -7,6 +7,7 @@
 
 #include <iosfwd>
 
+#include "src/compiler/types.h"
 #include "src/field-index.h"
 #include "src/machine-type.h"
 #include "src/objects.h"
@@ -17,12 +18,12 @@ namespace v8 {
 namespace internal {
 
 // Forward declarations.
-class CompilationDependencies;
 class Factory;
 
 namespace compiler {
 
 // Forward declarations.
+class CompilationDependencies;
 class Type;
 class TypeCache;
 
@@ -75,7 +76,7 @@ class PropertyAccessInfo final {
   static PropertyAccessInfo DataField(
       PropertyConstness constness, MapHandles const& receiver_maps,
       FieldIndex field_index, MachineRepresentation field_representation,
-      Type* field_type, MaybeHandle<Map> field_map = MaybeHandle<Map>(),
+      Type field_type, MaybeHandle<Map> field_map = MaybeHandle<Map>(),
       MaybeHandle<JSObject> holder = MaybeHandle<JSObject>(),
       MaybeHandle<Map> transition_map = MaybeHandle<Map>());
   static PropertyAccessInfo AccessorConstant(MapHandles const& receiver_maps,
@@ -105,7 +106,7 @@ class PropertyAccessInfo final {
   MaybeHandle<Map> transition_map() const { return transition_map_; }
   Handle<Object> constant() const { return constant_; }
   FieldIndex field_index() const { return field_index_; }
-  Type* field_type() const { return field_type_; }
+  Type field_type() const { return field_type_; }
   MachineRepresentation field_representation() const {
     return field_representation_;
   }
@@ -121,7 +122,7 @@ class PropertyAccessInfo final {
   PropertyAccessInfo(Kind kind, MaybeHandle<JSObject> holder,
                      MaybeHandle<Map> transition_map, FieldIndex field_index,
                      MachineRepresentation field_representation,
-                     Type* field_type, MaybeHandle<Map> field_map,
+                     Type field_type, MaybeHandle<Map> field_map,
                      MapHandles const& receiver_maps);
 
   Kind kind_;
@@ -131,7 +132,7 @@ class PropertyAccessInfo final {
   MaybeHandle<JSObject> holder_;
   FieldIndex field_index_;
   MachineRepresentation field_representation_;
-  Type* field_type_;
+  Type field_type_;
   MaybeHandle<Map> field_map_;
 };
 
@@ -140,6 +141,7 @@ class PropertyAccessInfo final {
 class AccessInfoFactory final {
  public:
   AccessInfoFactory(CompilationDependencies* dependencies,
+                    const JSHeapBroker* js_heap_broker,
                     Handle<Context> native_context, Zone* zone);
 
   bool ComputeElementAccessInfo(Handle<Map> map, AccessMode access_mode,
@@ -166,12 +168,14 @@ class AccessInfoFactory final {
                         PropertyAccessInfo* access_info);
 
   CompilationDependencies* dependencies() const { return dependencies_; }
+  const JSHeapBroker* js_heap_broker() const { return js_heap_broker_; }
   Factory* factory() const;
   Isolate* isolate() const { return isolate_; }
   Handle<Context> native_context() const { return native_context_; }
   Zone* zone() const { return zone_; }
 
   CompilationDependencies* const dependencies_;
+  const JSHeapBroker* const js_heap_broker_;
   Handle<Context> const native_context_;
   Isolate* const isolate_;
   TypeCache const& type_cache_;
diff --git a/deps/v8/src/compiler/allocation-builder.h b/deps/v8/src/compiler/allocation-builder.h
index 86fea3309002a2..6368a43240f54f 100644
--- a/deps/v8/src/compiler/allocation-builder.h
+++ b/deps/v8/src/compiler/allocation-builder.h
@@ -18,15 +18,17 @@ namespace compiler {
 // allocated object and also provides helpers for commonly allocated objects.
 class AllocationBuilder final {
  public:
-  AllocationBuilder(JSGraph* jsgraph, Node* effect, Node* control)
+  AllocationBuilder(JSGraph* jsgraph, const JSHeapBroker* js_heap_broker,
+                    Node* effect, Node* control)
       : jsgraph_(jsgraph),
+        js_heap_broker_(js_heap_broker),
         allocation_(nullptr),
         effect_(effect),
         control_(control) {}
 
   // Primitive allocation of static size.
   void Allocate(int size, PretenureFlag pretenure = NOT_TENURED,
-                Type* type = Type::Any()) {
+                Type type = Type::Any()) {
     DCHECK_LE(size, kMaxRegularHeapObjectSize);
     effect_ = graph()->NewNode(
         common()->BeginRegion(RegionObservability::kNotObservable), effect_);
@@ -75,6 +77,10 @@ class AllocationBuilder final {
   void Store(const FieldAccess& access, Handle<Object> value) {
     Store(access, jsgraph()->Constant(value));
   }
+  // Compound store of a constant into a field.
+  void Store(const FieldAccess& access, const ObjectRef& value) {
+    Store(access, jsgraph()->Constant(js_heap_broker(), value));
+  }
 
   void FinishAndChange(Node* node) {
     NodeProperties::SetType(allocation_, NodeProperties::GetType(node));
@@ -90,12 +96,15 @@ class AllocationBuilder final {
 
  protected:
   JSGraph* jsgraph() { return jsgraph_; }
+  const JSHeapBroker* js_heap_broker() { return js_heap_broker_; }
+  Isolate* isolate() const { return jsgraph_->isolate(); }
   Graph* graph() { return jsgraph_->graph(); }
   CommonOperatorBuilder* common() { return jsgraph_->common(); }
   SimplifiedOperatorBuilder* simplified() { return jsgraph_->simplified(); }
 
  private:
   JSGraph* const jsgraph_;
+  const JSHeapBroker* const js_heap_broker_;
   Node* allocation_;
   Node* effect_;
   Node* control_;
diff --git a/deps/v8/src/compiler/arm/code-generator-arm.cc b/deps/v8/src/compiler/arm/code-generator-arm.cc
index b5f258ab45b91b..e1987732d85352 100644
--- a/deps/v8/src/compiler/arm/code-generator-arm.cc
+++ b/deps/v8/src/compiler/arm/code-generator-arm.cc
@@ -423,8 +423,7 @@ void ComputePoisonedAddressForLoad(CodeGenerator* codegen,
     __ PrepareCallCFunction(0, 2);                                             \
     __ MovToFloatParameters(i.InputDoubleRegister(0),                          \
                             i.InputDoubleRegister(1));                         \
-    __ CallCFunction(                                                          \
-        ExternalReference::ieee754_##name##_function(__ isolate()), 0, 2);     \
+    __ CallCFunction(ExternalReference::ieee754_##name##_function(), 0, 2);    \
     /* Move the result in the double result register. */                       \
     __ MovFromFloatResult(i.OutputDoubleRegister());                           \
     DCHECK_EQ(LeaveCC, i.OutputSBit());                                        \
@@ -437,8 +436,7 @@ void ComputePoisonedAddressForLoad(CodeGenerator* codegen,
     FrameScope scope(tasm(), StackFrame::MANUAL);                              \
     __ PrepareCallCFunction(0, 1);                                             \
     __ MovToFloatParameter(i.InputDoubleRegister(0));                          \
-    __ CallCFunction(                                                          \
-        ExternalReference::ieee754_##name##_function(__ isolate()), 0, 1);     \
+    __ CallCFunction(ExternalReference::ieee754_##name##_function(), 0, 1);    \
     /* Move the result in the double result register. */                       \
     __ MovFromFloatResult(i.OutputDoubleRegister());                           \
     DCHECK_EQ(LeaveCC, i.OutputSBit());                                        \
@@ -634,6 +632,9 @@ void CodeGenerator::BailoutIfDeoptimized() {
   __ ldr(scratch,
          FieldMemOperand(scratch, CodeDataContainer::kKindSpecificFlagsOffset));
   __ tst(scratch, Operand(1 << Code::kMarkedForDeoptimizationBit));
+  // Ensure we're not serializing (otherwise we'd need to use an indirection to
+  // access the builtin below).
+  DCHECK(!isolate()->ShouldLoadConstantsFromRootList());
   Handle<Code> code = isolate()->builtins()->builtin_handle(
       Builtins::kCompileLazyDeoptimizedCode);
   __ Jump(code, RelocInfo::CODE_TARGET, ne);
@@ -668,19 +669,15 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
   ArchOpcode arch_opcode = ArchOpcodeField::decode(opcode);
   switch (arch_opcode) {
     case kArchCallCodeObject: {
-      // We must not share code targets for calls to builtins for wasm code, as
-      // they might need to be patched individually.
-      internal::Assembler::BlockCodeTargetSharingScope scope;
-      if (info()->IsWasm()) scope.Open(tasm());
-
       if (instr->InputAt(0)->IsImmediate()) {
         __ Call(i.InputCode(0), RelocInfo::CODE_TARGET);
       } else {
-        UseScratchRegisterScope temps(tasm());
-        Register scratch = temps.Acquire();
-        __ add(scratch, i.InputRegister(0),
-               Operand(Code::kHeaderSize - kHeapObjectTag));
-        __ Call(scratch);
+        Register reg = i.InputRegister(0);
+        DCHECK_IMPLIES(
+            HasCallDescriptorFlag(instr, CallDescriptor::kFixedTargetRegister),
+            reg == kJavaScriptCallCodeStartRegister);
+        __ add(reg, reg, Operand(Code::kHeaderSize - kHeapObjectTag));
+        __ Call(reg);
       }
       RecordCallPosition(instr);
       DCHECK_EQ(LeaveCC, i.OutputSBit());
@@ -688,19 +685,10 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       break;
     }
     case kArchCallWasmFunction: {
-      // We must not share code targets for calls to builtins for wasm code, as
-      // they might need to be patched individually.
-      internal::Assembler::BlockCodeTargetSharingScope scope;
-      RelocInfo::Mode rmode = RelocInfo::JS_TO_WASM_CALL;
-      if (info()->IsWasm()) {
-        scope.Open(tasm());
-        rmode = RelocInfo::WASM_CALL;
-      }
-
       if (instr->InputAt(0)->IsImmediate()) {
-        Address wasm_code = reinterpret_cast<Address>(
-            i.ToConstant(instr->InputAt(0)).ToInt32());
-        __ Call(wasm_code, rmode);
+        Constant constant = i.ToConstant(instr->InputAt(0));
+        Address wasm_code = static_cast<Address>(constant.ToInt32());
+        __ Call(wasm_code, constant.rmode());
       } else {
         __ Call(i.InputRegister(0));
       }
@@ -711,11 +699,6 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
     }
     case kArchTailCallCodeObjectFromJSFunction:
     case kArchTailCallCodeObject: {
-      // We must not share code targets for calls to builtins for wasm code, as
-      // they might need to be patched individually.
-      internal::Assembler::BlockCodeTargetSharingScope scope;
-      if (info()->IsWasm()) scope.Open(tasm());
-
       if (arch_opcode == kArchTailCallCodeObjectFromJSFunction) {
         AssemblePopArgumentsAdaptorFrame(kJavaScriptCallArgCountRegister,
                                          i.TempRegister(0), i.TempRegister(1),
@@ -724,11 +707,12 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       if (instr->InputAt(0)->IsImmediate()) {
         __ Jump(i.InputCode(0), RelocInfo::CODE_TARGET);
       } else {
-        UseScratchRegisterScope temps(tasm());
-        Register scratch = temps.Acquire();
-        __ add(scratch, i.InputRegister(0),
-               Operand(Code::kHeaderSize - kHeapObjectTag));
-        __ Jump(scratch);
+        Register reg = i.InputRegister(0);
+        DCHECK_IMPLIES(
+            HasCallDescriptorFlag(instr, CallDescriptor::kFixedTargetRegister),
+            reg == kJavaScriptCallCodeStartRegister);
+        __ add(reg, reg, Operand(Code::kHeaderSize - kHeapObjectTag));
+        __ Jump(reg);
       }
       DCHECK_EQ(LeaveCC, i.OutputSBit());
       unwinding_info_writer_.MarkBlockWillExit();
@@ -737,19 +721,10 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       break;
     }
     case kArchTailCallWasm: {
-      // We must not share code targets for calls to builtins for wasm code, as
-      // they might need to be patched individually.
-      internal::Assembler::BlockCodeTargetSharingScope scope;
-      RelocInfo::Mode rmode = RelocInfo::JS_TO_WASM_CALL;
-      if (info()->IsWasm()) {
-        scope.Open(tasm());
-        rmode = RelocInfo::WASM_CALL;
-      }
-
       if (instr->InputAt(0)->IsImmediate()) {
-        Address wasm_code = reinterpret_cast<Address>(
-            i.ToConstant(instr->InputAt(0)).ToInt32());
-        __ Jump(wasm_code, rmode);
+        Constant constant = i.ToConstant(instr->InputAt(0));
+        Address wasm_code = static_cast<Address>(constant.ToInt32());
+        __ Jump(wasm_code, constant.rmode());
       } else {
         __ Jump(i.InputRegister(0));
       }
@@ -761,7 +736,11 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
     }
     case kArchTailCallAddress: {
       CHECK(!instr->InputAt(0)->IsImmediate());
-      __ Jump(i.InputRegister(0));
+      Register reg = i.InputRegister(0);
+      DCHECK_IMPLIES(
+          HasCallDescriptorFlag(instr, CallDescriptor::kFixedTargetRegister),
+          reg == kJavaScriptCallCodeStartRegister);
+      __ Jump(reg);
       unwinding_info_writer_.MarkBlockWillExit();
       frame_access_state()->ClearSPDelta();
       frame_access_state()->SetFrameAccessToDefault();
@@ -853,6 +832,9 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       AssembleArchJump(i.InputRpo(0));
       DCHECK_EQ(LeaveCC, i.OutputSBit());
       break;
+    case kArchBinarySearchSwitch:
+      AssembleArchBinarySearchSwitch(instr);
+      break;
     case kArchLookupSwitch:
       AssembleArchLookupSwitch(instr);
       DCHECK_EQ(LeaveCC, i.OutputSBit());
@@ -874,17 +856,19 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
                 RelocInfo::CODE_TARGET);
       }
       __ stop("kArchDebugAbort");
+      unwinding_info_writer_.MarkBlockWillExit();
       break;
     case kArchDebugBreak:
       __ stop("kArchDebugBreak");
       break;
-    case kArchComment: {
-      Address comment_string = i.InputExternalReference(0).address();
-      __ RecordComment(reinterpret_cast<const char*>(comment_string));
+    case kArchComment:
+      __ RecordComment(reinterpret_cast<const char*>(i.InputInt32(0)));
       break;
-    }
-    case kArchNop:
     case kArchThrowTerminator:
+      DCHECK_EQ(LeaveCC, i.OutputSBit());
+      unwinding_info_writer_.MarkBlockWillExit();
+      break;
+    case kArchNop:
       // don't emit code for nops.
       DCHECK_EQ(LeaveCC, i.OutputSBit());
       break;
@@ -894,6 +878,7 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       CodeGenResult result =
           AssembleDeoptimizerCall(deopt_state_id, current_source_position_);
       if (result != kSuccess) return result;
+      unwinding_info_writer_.MarkBlockWillExit();
       break;
     }
     case kArchRet:
@@ -915,13 +900,9 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
         __ mov(i.OutputRegister(), fp);
       }
       break;
-    case kArchRootsPointer:
-      __ mov(i.OutputRegister(), kRootRegister);
-      DCHECK_EQ(LeaveCC, i.OutputSBit());
-      break;
     case kArchTruncateDoubleToI:
-      __ TruncateDoubleToIDelayed(zone(), i.OutputRegister(),
-                                  i.InputDoubleRegister(0));
+      __ TruncateDoubleToI(isolate(), zone(), i.OutputRegister(),
+                           i.InputDoubleRegister(0), DetermineStubCallMode());
       DCHECK_EQ(LeaveCC, i.OutputSBit());
       break;
     case kArchStoreWithWriteBarrier: {
@@ -1011,7 +992,7 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       ASSEMBLE_IEEE754_UNOP(log10);
       break;
     case kIeee754Float64Pow: {
-      __ CallStubDelayed(new (zone()) MathPowStub());
+      __ Call(BUILTIN_CODE(isolate(), MathPowInternal), RelocInfo::CODE_TARGET);
       __ vmov(d0, d2);
       break;
     }
@@ -1357,8 +1338,7 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       __ PrepareCallCFunction(0, 2);
       __ MovToFloatParameters(i.InputDoubleRegister(0),
                               i.InputDoubleRegister(1));
-      __ CallCFunction(
-          ExternalReference::mod_two_doubles_operation(__ isolate()), 0, 2);
+      __ CallCFunction(ExternalReference::mod_two_doubles_operation(), 0, 2);
       // Move the result in the double result register.
       __ MovFromFloatResult(i.OutputDoubleRegister());
       DCHECK_EQ(LeaveCC, i.OutputSBit());
@@ -1741,7 +1721,7 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       __ isb(SY);
       break;
     }
-    case kArchPoisonOnSpeculationWord:
+    case kArchWordPoisonOnSpeculation:
       __ and_(i.OutputRegister(0), i.InputRegister(0),
               Operand(kSpeculationPoisonRegister));
       break;
@@ -2786,39 +2766,26 @@ void CodeGenerator::AssembleArchTrap(Instruction* instr,
                                      FlagsCondition condition) {
   class OutOfLineTrap final : public OutOfLineCode {
    public:
-    OutOfLineTrap(CodeGenerator* gen, bool frame_elided, Instruction* instr)
-        : OutOfLineCode(gen),
-          frame_elided_(frame_elided),
-          instr_(instr),
-          gen_(gen) {}
+    OutOfLineTrap(CodeGenerator* gen, Instruction* instr)
+        : OutOfLineCode(gen), instr_(instr), gen_(gen) {}
 
     void Generate() final {
       ArmOperandConverter i(gen_, instr_);
-
-      Builtins::Name trap_id =
-          static_cast<Builtins::Name>(i.InputInt32(instr_->InputCount() - 1));
-      bool old_has_frame = __ has_frame();
-      if (frame_elided_) {
-        __ set_has_frame(true);
-        __ EnterFrame(StackFrame::WASM_COMPILED);
-      }
+      TrapId trap_id =
+          static_cast<TrapId>(i.InputInt32(instr_->InputCount() - 1));
       GenerateCallToTrap(trap_id);
-      if (frame_elided_) {
-        __ set_has_frame(old_has_frame);
-      }
     }
 
    private:
-    void GenerateCallToTrap(Builtins::Name trap_id) {
-      if (trap_id == Builtins::builtin_count) {
+    void GenerateCallToTrap(TrapId trap_id) {
+      if (trap_id == TrapId::kInvalid) {
         // We cannot test calls to the runtime in cctest/test-run-wasm.
         // Therefore we emit a call to C here instead of a call to the runtime.
         // We use the context register as the scratch register, because we do
         // not have a context here.
         __ PrepareCallCFunction(0, 0);
-        __ CallCFunction(ExternalReference::wasm_call_trap_callback_for_testing(
-                             __ isolate()),
-                         0);
+        __ CallCFunction(
+            ExternalReference::wasm_call_trap_callback_for_testing(), 0);
         __ LeaveFrame(StackFrame::WASM_COMPILED);
         auto call_descriptor = gen_->linkage()->GetIncomingDescriptor();
         int pop_count =
@@ -2827,8 +2794,9 @@ void CodeGenerator::AssembleArchTrap(Instruction* instr,
         __ Ret();
       } else {
         gen_->AssembleSourcePosition(instr_);
-        __ Call(__ isolate()->builtins()->builtin_handle(trap_id),
-                RelocInfo::CODE_TARGET);
+        // A direct call to a wasm runtime stub defined in this module.
+        // Just encode the stub index. This will be patched at relocation.
+        __ Call(static_cast<Address>(trap_id), RelocInfo::WASM_STUB_CALL);
         ReferenceMap* reference_map =
             new (gen_->zone()) ReferenceMap(gen_->zone());
         gen_->RecordSafepoint(reference_map, Safepoint::kSimple, 0,
@@ -2839,12 +2807,10 @@ void CodeGenerator::AssembleArchTrap(Instruction* instr,
       }
     }
 
-    bool frame_elided_;
     Instruction* instr_;
     CodeGenerator* gen_;
   };
-  bool frame_elided = !frame_access_state()->has_frame();
-  auto ool = new (zone()) OutOfLineTrap(this, frame_elided, instr);
+  auto ool = new (zone()) OutOfLineTrap(this, instr);
   Label* tlabel = ool->entry();
   Condition cc = FlagsConditionToCondition(condition);
   __ b(cc, tlabel);
@@ -2864,6 +2830,16 @@ void CodeGenerator::AssembleArchBoolean(Instruction* instr,
   __ mov(reg, Operand(1), LeaveCC, cc);
 }
 
+void CodeGenerator::AssembleArchBinarySearchSwitch(Instruction* instr) {
+  ArmOperandConverter i(this, instr);
+  Register input = i.InputRegister(0);
+  std::vector<std::pair<int32_t, Label*>> cases;
+  for (size_t index = 2; index < instr->InputCount(); index += 2) {
+    cases.push_back({i.InputInt32(index + 0), GetLabel(i.InputRpo(index + 1))});
+  }
+  AssembleArchBinarySearchSwitchRange(input, i.InputRpo(1), cases.data(),
+                                      cases.data() + cases.size());
+}
 
 void CodeGenerator::AssembleArchLookupSwitch(Instruction* instr) {
   ArmOperandConverter i(this, instr);
@@ -2928,6 +2904,9 @@ void CodeGenerator::AssembleConstructFrame() {
       }
     } else {
       __ StubPrologue(info()->GetOutputStackFrameType());
+      if (call_descriptor->IsWasmFunctionCall()) {
+        __ Push(kWasmInstanceRegister);
+      }
     }
 
     unwinding_info_writer_.MarkFrameConstructed(__ pc_offset());
@@ -2954,47 +2933,42 @@ void CodeGenerator::AssembleConstructFrame() {
   const RegList saves_fp = call_descriptor->CalleeSavedFPRegisters();
 
   if (shrink_slots > 0) {
-    if (info()->IsWasm()) {
-      if (shrink_slots > 128) {
-        // For WebAssembly functions with big frames we have to do the stack
-        // overflow check before we construct the frame. Otherwise we may not
-        // have enough space on the stack to call the runtime for the stack
-        // overflow.
-        Label done;
-
-        // If the frame is bigger than the stack, we throw the stack overflow
-        // exception unconditionally. Thereby we can avoid the integer overflow
-        // check in the condition code.
-        if ((shrink_slots * kPointerSize) < (FLAG_stack_size * 1024)) {
-          UseScratchRegisterScope temps(tasm());
-          Register scratch = temps.Acquire();
-          __ Move(scratch,
-                  Operand(ExternalReference::address_of_real_stack_limit(
-                      __ isolate())));
-          __ ldr(scratch, MemOperand(scratch));
-          __ add(scratch, scratch, Operand(shrink_slots * kPointerSize));
-          __ cmp(sp, scratch);
-          __ b(cs, &done);
-        }
-
-        if (!frame_access_state()->has_frame()) {
-          __ set_has_frame(true);
-          // There is no need to leave the frame, we will not return from the
-          // runtime call.
-          __ EnterFrame(StackFrame::WASM_COMPILED);
-        }
-        __ Move(cp, Smi::kZero);
-        __ CallRuntimeDelayed(zone(), Runtime::kThrowWasmStackOverflow);
-        // We come from WebAssembly, there are no references for the GC.
-        ReferenceMap* reference_map = new (zone()) ReferenceMap(zone());
-        RecordSafepoint(reference_map, Safepoint::kSimple, 0,
-                        Safepoint::kNoLazyDeopt);
-        if (FLAG_debug_code) {
-          __ stop(GetAbortReason(AbortReason::kUnexpectedReturnFromThrow));
-        }
+    DCHECK(frame_access_state()->has_frame());
+    if (info()->IsWasm() && shrink_slots > 128) {
+      // For WebAssembly functions with big frames we have to do the stack
+      // overflow check before we construct the frame. Otherwise we may not
+      // have enough space on the stack to call the runtime for the stack
+      // overflow.
+      Label done;
+
+      // If the frame is bigger than the stack, we throw the stack overflow
+      // exception unconditionally. Thereby we can avoid the integer overflow
+      // check in the condition code.
+      if ((shrink_slots * kPointerSize) < (FLAG_stack_size * 1024)) {
+        UseScratchRegisterScope temps(tasm());
+        Register scratch = temps.Acquire();
+        __ ldr(scratch, FieldMemOperand(
+                            kWasmInstanceRegister,
+                            WasmInstanceObject::kRealStackLimitAddressOffset));
+        __ ldr(scratch, MemOperand(scratch));
+        __ add(scratch, scratch, Operand(shrink_slots * kPointerSize));
+        __ cmp(sp, scratch);
+        __ b(cs, &done);
+      }
 
-        __ bind(&done);
+      __ ldr(r2, FieldMemOperand(kWasmInstanceRegister,
+                                 WasmInstanceObject::kCEntryStubOffset));
+      __ Move(cp, Smi::kZero);
+      __ CallRuntimeWithCEntry(Runtime::kThrowWasmStackOverflow, r2);
+      // We come from WebAssembly, there are no references for the GC.
+      ReferenceMap* reference_map = new (zone()) ReferenceMap(zone());
+      RecordSafepoint(reference_map, Safepoint::kSimple, 0,
+                      Safepoint::kNoLazyDeopt);
+      if (FLAG_debug_code) {
+        __ stop(GetAbortReason(AbortReason::kUnexpectedReturnFromThrow));
       }
+
+      __ bind(&done);
     }
 
     // Skip callee-saved and return slots, which are pushed below.
@@ -3100,6 +3074,8 @@ void CodeGenerator::AssembleMove(InstructionOperand* source,
       } else {
         __ Move(dst, src_object);
       }
+    } else if (src.type() == Constant::kExternalReference) {
+      __ Move(dst, src.ToExternalReference());
     } else {
       __ mov(dst, g.ToImmediate(source));
     }
diff --git a/deps/v8/src/compiler/arm/instruction-selector-arm.cc b/deps/v8/src/compiler/arm/instruction-selector-arm.cc
index b2f6fd6e7196e9..56054e87a8c49a 100644
--- a/deps/v8/src/compiler/arm/instruction-selector-arm.cc
+++ b/deps/v8/src/compiler/arm/instruction-selector-arm.cc
@@ -73,6 +73,17 @@ class ArmOperandGenerator : public OperandGenerator {
     }
     return false;
   }
+
+  // Use the stack pointer if the node is LoadStackPointer, otherwise assign a
+  // register.
+  InstructionOperand UseRegisterOrStackPointer(Node* node) {
+    if (node->opcode() == IrOpcode::kLoadStackPointer) {
+      return LocationOperand(LocationOperand::EXPLICIT,
+                             LocationOperand::REGISTER,
+                             MachineRepresentation::kWord32, sp.code());
+    }
+    return UseRegister(node);
+  }
 };
 
 
@@ -444,7 +455,7 @@ void InstructionSelector::VisitLoad(Node* node) {
       return;
   }
   if (node->opcode() == IrOpcode::kPoisonedLoad) {
-    CHECK_EQ(poisoning_enabled_, PoisoningMitigationLevel::kOn);
+    CHECK_NE(poisoning_level_, PoisoningMitigationLevel::kDontPoison);
     opcode |= MiscField::encode(kMemoryAccessPoisoned);
   }
 
@@ -1679,17 +1690,17 @@ void VisitWordCompare(InstructionSelector* selector, Node* node,
 
   if (TryMatchImmediateOrShift(selector, &opcode, m.right().node(),
                                &input_count, &inputs[1])) {
-    inputs[0] = g.UseRegister(m.left().node());
+    inputs[0] = g.UseRegisterOrStackPointer(m.left().node());
     input_count++;
   } else if (TryMatchImmediateOrShift(selector, &opcode, m.left().node(),
                                       &input_count, &inputs[1])) {
     if (!node->op()->HasProperty(Operator::kCommutative)) cont->Commute();
-    inputs[0] = g.UseRegister(m.right().node());
+    inputs[0] = g.UseRegisterOrStackPointer(m.right().node());
     input_count++;
   } else {
     opcode |= AddressingModeField::encode(kMode_Operand2_R);
-    inputs[input_count++] = g.UseRegister(m.left().node());
-    inputs[input_count++] = g.UseRegister(m.right().node());
+    inputs[input_count++] = g.UseRegisterOrStackPointer(m.left().node());
+    inputs[input_count++] = g.UseRegisterOrStackPointer(m.right().node());
   }
 
   if (has_result) {
@@ -1886,11 +1897,10 @@ void InstructionSelector::VisitSwitch(Node* node, const SwitchInfo& sw) {
     }
   }
 
-  // Generate a sequence of conditional jumps.
-  return EmitLookupSwitch(sw, value_operand);
+  // Generate a tree of conditional jumps.
+  return EmitBinarySearchSwitch(sw, value_operand);
 }
 
-
 void InstructionSelector::VisitWord32Equal(Node* const node) {
   FlagsContinuation cont = FlagsContinuation::ForSet(kEqual, node);
   Int32BinopMatcher m(node);
@@ -2157,7 +2167,7 @@ void InstructionSelector::VisitWord32AtomicCompareExchange(Node* node) {
   Emit(code, 1, outputs, input_count, inputs, arraysize(temps), temps);
 }
 
-void InstructionSelector::VisitAtomicBinaryOperation(
+void InstructionSelector::VisitWord32AtomicBinaryOperation(
     Node* node, ArchOpcode int8_op, ArchOpcode uint8_op, ArchOpcode int16_op,
     ArchOpcode uint16_op, ArchOpcode word32_op) {
   ArmOperandGenerator g(this);
@@ -2197,7 +2207,7 @@ void InstructionSelector::VisitAtomicBinaryOperation(
 
 #define VISIT_ATOMIC_BINOP(op)                                   \
   void InstructionSelector::VisitWord32Atomic##op(Node* node) {  \
-    VisitAtomicBinaryOperation(                                  \
+    VisitWord32AtomicBinaryOperation(                            \
         node, kWord32Atomic##op##Int8, kWord32Atomic##op##Uint8, \
         kWord32Atomic##op##Int16, kWord32Atomic##op##Uint16,     \
         kWord32Atomic##op##Word32);                              \
@@ -2434,7 +2444,9 @@ static const ShuffleEntry arch_shuffles[] = {
     {{1, 0, 3, 2, 5, 4, 7, 6, 9, 8, 11, 10, 13, 12, 15, 14}, kArmS8x2Reverse}};
 
 bool TryMatchArchShuffle(const uint8_t* shuffle, const ShuffleEntry* table,
-                         size_t num_entries, uint8_t mask, ArchOpcode* opcode) {
+                         size_t num_entries, bool is_swizzle,
+                         ArchOpcode* opcode) {
+  uint8_t mask = is_swizzle ? kSimd128Size - 1 : 2 * kSimd128Size - 1;
   for (size_t i = 0; i < num_entries; ++i) {
     const ShuffleEntry& entry = table[i];
     int j = 0;
@@ -2466,48 +2478,45 @@ void ArrangeShuffleTable(ArmOperandGenerator* g, Node* input0, Node* input1,
 }  // namespace
 
 void InstructionSelector::VisitS8x16Shuffle(Node* node) {
-  const uint8_t* shuffle = OpParameter<uint8_t*>(node->op());
-  uint8_t mask = CanonicalizeShuffle(node);
+  uint8_t shuffle[kSimd128Size];
+  bool is_swizzle;
+  CanonicalizeShuffle(node, shuffle, &is_swizzle);
+  Node* input0 = node->InputAt(0);
+  Node* input1 = node->InputAt(1);
   uint8_t shuffle32x4[4];
   ArmOperandGenerator g(this);
   int index = 0;
   if (TryMatch32x4Shuffle(shuffle, shuffle32x4)) {
     if (TryMatchDup<4>(shuffle, &index)) {
-      InstructionOperand src = index < 4 ? g.UseRegister(node->InputAt(0))
-                                         : g.UseRegister(node->InputAt(1));
-      Emit(kArmS128Dup, g.DefineAsRegister(node), src, g.UseImmediate(Neon32),
-           g.UseImmediate(index % 4));
+      DCHECK_GT(4, index);
+      Emit(kArmS128Dup, g.DefineAsRegister(node), g.UseRegister(input0),
+           g.UseImmediate(Neon32), g.UseImmediate(index % 4));
     } else {
-      Emit(kArmS32x4Shuffle, g.DefineAsRegister(node),
-           g.UseRegister(node->InputAt(0)), g.UseRegister(node->InputAt(1)),
-           g.UseImmediate(Pack4Lanes(shuffle32x4, mask)));
+      Emit(kArmS32x4Shuffle, g.DefineAsRegister(node), g.UseRegister(input0),
+           g.UseRegister(input1), g.UseImmediate(Pack4Lanes(shuffle32x4)));
     }
     return;
   }
   if (TryMatchDup<8>(shuffle, &index)) {
-    InstructionOperand src = index < 8 ? g.UseRegister(node->InputAt(0))
-                                       : g.UseRegister(node->InputAt(1));
-    Emit(kArmS128Dup, g.DefineAsRegister(node), src, g.UseImmediate(Neon16),
-         g.UseImmediate(index % 8));
+    DCHECK_GT(8, index);
+    Emit(kArmS128Dup, g.DefineAsRegister(node), g.UseRegister(input0),
+         g.UseImmediate(Neon16), g.UseImmediate(index % 8));
     return;
   }
   if (TryMatchDup<16>(shuffle, &index)) {
-    InstructionOperand src = index < 16 ? g.UseRegister(node->InputAt(0))
-                                        : g.UseRegister(node->InputAt(1));
-    Emit(kArmS128Dup, g.DefineAsRegister(node), src, g.UseImmediate(Neon8),
-         g.UseImmediate(index % 16));
+    DCHECK_GT(16, index);
+    Emit(kArmS128Dup, g.DefineAsRegister(node), g.UseRegister(input0),
+         g.UseImmediate(Neon8), g.UseImmediate(index % 16));
     return;
   }
   ArchOpcode opcode;
   if (TryMatchArchShuffle(shuffle, arch_shuffles, arraysize(arch_shuffles),
-                          mask, &opcode)) {
+                          is_swizzle, &opcode)) {
     VisitRRRShuffle(this, opcode, node);
     return;
   }
-  Node* input0 = node->InputAt(0);
-  Node* input1 = node->InputAt(1);
   uint8_t offset;
-  if (TryMatchConcat(shuffle, mask, &offset)) {
+  if (TryMatchConcat(shuffle, &offset)) {
     Emit(kArmS8x16Concat, g.DefineAsRegister(node), g.UseRegister(input0),
          g.UseRegister(input1), g.UseImmediate(offset));
     return;
@@ -2516,10 +2525,10 @@ void InstructionSelector::VisitS8x16Shuffle(Node* node) {
   InstructionOperand src0, src1;
   ArrangeShuffleTable(&g, input0, input1, &src0, &src1);
   Emit(kArmS8x16Shuffle, g.DefineAsRegister(node), src0, src1,
-       g.UseImmediate(Pack4Lanes(shuffle, mask)),
-       g.UseImmediate(Pack4Lanes(shuffle + 4, mask)),
-       g.UseImmediate(Pack4Lanes(shuffle + 8, mask)),
-       g.UseImmediate(Pack4Lanes(shuffle + 12, mask)));
+       g.UseImmediate(Pack4Lanes(shuffle)),
+       g.UseImmediate(Pack4Lanes(shuffle + 4)),
+       g.UseImmediate(Pack4Lanes(shuffle + 8)),
+       g.UseImmediate(Pack4Lanes(shuffle + 12)));
 }
 
 void InstructionSelector::VisitSignExtendWord8ToInt32(Node* node) {
diff --git a/deps/v8/src/compiler/arm64/code-generator-arm64.cc b/deps/v8/src/compiler/arm64/code-generator-arm64.cc
index 968c6133fbfd69..a7c5beee4cf9ba 100644
--- a/deps/v8/src/compiler/arm64/code-generator-arm64.cc
+++ b/deps/v8/src/compiler/arm64/code-generator-arm64.cc
@@ -130,6 +130,7 @@ class Arm64OperandConverter final : public InstructionOperandConverter {
         return Operand(InputRegister32(index), SXTW);
       case kMode_MRI:
       case kMode_MRR:
+      case kMode_Root:
         break;
     }
     UNREACHABLE();
@@ -159,13 +160,13 @@ class Arm64OperandConverter final : public InstructionOperandConverter {
         return Operand(InputRegister64(index), SXTW);
       case kMode_MRI:
       case kMode_MRR:
+      case kMode_Root:
         break;
     }
     UNREACHABLE();
   }
 
-  MemOperand MemoryOperand(size_t* first_index) {
-    const size_t index = *first_index;
+  MemOperand MemoryOperand(size_t index = 0) {
     switch (AddressingModeField::decode(instr_->opcode())) {
       case kMode_None:
       case kMode_Operand2_R_LSR_I:
@@ -177,24 +178,19 @@ class Arm64OperandConverter final : public InstructionOperandConverter {
       case kMode_Operand2_R_SXTH:
       case kMode_Operand2_R_SXTW:
         break;
+      case kMode_Root:
+        return MemOperand(kRootRegister, InputInt64(index));
       case kMode_Operand2_R_LSL_I:
-        *first_index += 3;
         return MemOperand(InputRegister(index + 0), InputRegister(index + 1),
                           LSL, InputInt32(index + 2));
       case kMode_MRI:
-        *first_index += 2;
         return MemOperand(InputRegister(index + 0), InputInt32(index + 1));
       case kMode_MRR:
-        *first_index += 2;
         return MemOperand(InputRegister(index + 0), InputRegister(index + 1));
     }
     UNREACHABLE();
   }
 
-  MemOperand MemoryOperand(size_t first_index = 0) {
-    return MemoryOperand(&first_index);
-  }
-
   Operand ToOperand(InstructionOperand* op) {
     if (op->IsRegister()) {
       return Operand(ToRegister(op));
@@ -395,81 +391,64 @@ void EmitWordLoadPoisoningIfNeeded(CodeGenerator* codegen,
     }                                                                       \
   } while (0)
 
-#define ASSEMBLE_ATOMIC_LOAD_INTEGER(asm_instr)                        \
+#define ASSEMBLE_ATOMIC_LOAD_INTEGER(asm_instr, reg)                   \
   do {                                                                 \
     __ Add(i.TempRegister(0), i.InputRegister(0), i.InputRegister(1)); \
-    __ asm_instr(i.OutputRegister32(), i.TempRegister(0));             \
+    __ asm_instr(i.Output##reg(), i.TempRegister(0));                  \
   } while (0)
 
-#define ASSEMBLE_ATOMIC_STORE_INTEGER(asm_instr)                       \
+#define ASSEMBLE_ATOMIC_STORE_INTEGER(asm_instr, reg)                  \
   do {                                                                 \
     __ Add(i.TempRegister(0), i.InputRegister(0), i.InputRegister(1)); \
-    __ asm_instr(i.InputRegister32(2), i.TempRegister(0));             \
+    __ asm_instr(i.Input##reg(2), i.TempRegister(0));                  \
   } while (0)
 
-#define ASSEMBLE_ATOMIC_EXCHANGE_INTEGER(load_instr, store_instr)      \
-  do {                                                                 \
-    Label exchange;                                                    \
-    __ Add(i.TempRegister(0), i.InputRegister(0), i.InputRegister(1)); \
-    __ Bind(&exchange);                                                \
-    __ load_instr(i.OutputRegister32(), i.TempRegister(0));            \
-    __ store_instr(i.TempRegister32(1), i.InputRegister32(2),          \
-                   i.TempRegister(0));                                 \
-    __ Cbnz(i.TempRegister32(1), &exchange);                           \
+#define ASSEMBLE_ATOMIC_EXCHANGE_INTEGER(load_instr, store_instr, reg)       \
+  do {                                                                       \
+    Label exchange;                                                          \
+    __ Add(i.TempRegister(0), i.InputRegister(0), i.InputRegister(1));       \
+    __ Bind(&exchange);                                                      \
+    __ load_instr(i.Output##reg(), i.TempRegister(0));                       \
+    __ store_instr(i.TempRegister32(1), i.Input##reg(2), i.TempRegister(0)); \
+    __ Cbnz(i.TempRegister32(1), &exchange);                                 \
   } while (0)
 
-#define ASSEMBLE_ATOMIC_COMPARE_EXCHANGE_INTEGER(load_instr, store_instr, ext) \
+#define ASSEMBLE_ATOMIC_COMPARE_EXCHANGE_INTEGER(load_instr, store_instr, ext, \
+                                                 reg)                          \
   do {                                                                         \
     Label compareExchange;                                                     \
     Label exit;                                                                \
     __ Add(i.TempRegister(0), i.InputRegister(0), i.InputRegister(1));         \
     __ Bind(&compareExchange);                                                 \
-    __ load_instr(i.OutputRegister32(), i.TempRegister(0));                    \
-    __ Cmp(i.OutputRegister32(), Operand(i.InputRegister32(2), ext));          \
+    __ load_instr(i.Output##reg(), i.TempRegister(0));                         \
+    __ Cmp(i.Output##reg(), Operand(i.Input##reg(2), ext));                    \
     __ B(ne, &exit);                                                           \
-    __ store_instr(i.TempRegister32(1), i.InputRegister32(3),                  \
-                   i.TempRegister(0));                                         \
+    __ store_instr(i.TempRegister32(1), i.Input##reg(3), i.TempRegister(0));   \
     __ Cbnz(i.TempRegister32(1), &compareExchange);                            \
     __ Bind(&exit);                                                            \
   } while (0)
 
-#define ASSEMBLE_ATOMIC_BINOP(load_instr, store_instr, bin_instr)      \
-  do {                                                                 \
-    Label binop;                                                       \
-    __ Add(i.TempRegister(0), i.InputRegister(0), i.InputRegister(1)); \
-    __ Bind(&binop);                                                   \
-    __ load_instr(i.OutputRegister32(), i.TempRegister(0));            \
-    __ bin_instr(i.TempRegister32(1), i.OutputRegister32(),            \
-                 Operand(i.InputRegister32(2)));                       \
-    __ store_instr(i.TempRegister32(2), i.TempRegister32(1),           \
-                   i.TempRegister(0));                                 \
-    __ Cbnz(i.TempRegister32(2), &binop);                              \
-  } while (0)
-
-#define ASSEMBLE_ATOMIC64_BINOP(load_instr, store_instr, bin_instr)          \
+#define ASSEMBLE_ATOMIC_BINOP(load_instr, store_instr, bin_instr, reg)       \
   do {                                                                       \
     Label binop;                                                             \
     __ Add(i.TempRegister(0), i.InputRegister(0), i.InputRegister(1));       \
     __ Bind(&binop);                                                         \
-    __ load_instr(i.OutputRegister(), i.TempRegister(0));                    \
-    __ bin_instr(i.TempRegister(1), i.OutputRegister(),                      \
-                 Operand(i.InputRegister(2)));                               \
-    __ store_instr(i.TempRegister(2), i.TempRegister(1), i.TempRegister(0)); \
-    __ Cbnz(i.TempRegister(2), &binop);                                      \
+    __ load_instr(i.Output##reg(), i.TempRegister(0));                       \
+    __ bin_instr(i.Temp##reg(1), i.Output##reg(), Operand(i.Input##reg(2))); \
+    __ store_instr(i.TempRegister32(2), i.Temp##reg(1), i.TempRegister(0));  \
+    __ Cbnz(i.TempRegister32(2), &binop);                                    \
   } while (0)
 
-#define ASSEMBLE_IEEE754_BINOP(name)                                       \
-  do {                                                                     \
-    FrameScope scope(tasm(), StackFrame::MANUAL);                          \
-    __ CallCFunction(                                                      \
-        ExternalReference::ieee754_##name##_function(__ isolate()), 0, 2); \
+#define ASSEMBLE_IEEE754_BINOP(name)                                        \
+  do {                                                                      \
+    FrameScope scope(tasm(), StackFrame::MANUAL);                           \
+    __ CallCFunction(ExternalReference::ieee754_##name##_function(), 0, 2); \
   } while (0)
 
-#define ASSEMBLE_IEEE754_UNOP(name)                                        \
-  do {                                                                     \
-    FrameScope scope(tasm(), StackFrame::MANUAL);                          \
-    __ CallCFunction(                                                      \
-        ExternalReference::ieee754_##name##_function(__ isolate()), 0, 1); \
+#define ASSEMBLE_IEEE754_UNOP(name)                                         \
+  do {                                                                      \
+    FrameScope scope(tasm(), StackFrame::MANUAL);                           \
+    __ CallCFunction(ExternalReference::ieee754_##name##_function(), 0, 1); \
   } while (0)
 
 void CodeGenerator::AssembleDeconstructFrame() {
@@ -578,6 +557,9 @@ void CodeGenerator::BailoutIfDeoptimized() {
          FieldMemOperand(scratch, CodeDataContainer::kKindSpecificFlagsOffset));
   Label not_deoptimized;
   __ Tbz(scratch, Code::kMarkedForDeoptimizationBit, &not_deoptimized);
+  // Ensure we're not serializing (otherwise we'd need to use an indirection to
+  // access the builtin below).
+  DCHECK(!isolate()->ShouldLoadConstantsFromRootList());
   Handle<Code> code = isolate()->builtins()->builtin_handle(
       Builtins::kCompileLazyDeoptimizedCode);
   __ Jump(code, RelocInfo::CODE_TARGET);
@@ -615,36 +597,25 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
   ArchOpcode arch_opcode = ArchOpcodeField::decode(opcode);
   switch (arch_opcode) {
     case kArchCallCodeObject: {
-      // We must not share code targets for calls to builtins for wasm code, as
-      // they might need to be patched individually.
-      internal::Assembler::BlockCodeTargetSharingScope scope;
-      if (info()->IsWasm()) scope.Open(tasm());
-
       if (instr->InputAt(0)->IsImmediate()) {
         __ Call(i.InputCode(0), RelocInfo::CODE_TARGET);
       } else {
-        Register target = i.InputRegister(0);
-        __ Add(target, target, Code::kHeaderSize - kHeapObjectTag);
-        __ Call(target);
+        Register reg = i.InputRegister(0);
+        DCHECK_IMPLIES(
+            HasCallDescriptorFlag(instr, CallDescriptor::kFixedTargetRegister),
+            reg == kJavaScriptCallCodeStartRegister);
+        __ Add(reg, reg, Code::kHeaderSize - kHeapObjectTag);
+        __ Call(reg);
       }
       RecordCallPosition(instr);
       frame_access_state()->ClearSPDelta();
       break;
     }
     case kArchCallWasmFunction: {
-      // We must not share code targets for calls to builtins for wasm code, as
-      // they might need to be patched individually.
-      internal::Assembler::BlockCodeTargetSharingScope scope;
-      if (info()->IsWasm()) scope.Open(tasm());
-
       if (instr->InputAt(0)->IsImmediate()) {
-        Address wasm_code = reinterpret_cast<Address>(
-            i.ToConstant(instr->InputAt(0)).ToInt64());
-        if (info()->IsWasm()) {
-          __ Call(wasm_code, RelocInfo::WASM_CALL);
-        } else {
-          __ Call(wasm_code, RelocInfo::JS_TO_WASM_CALL);
-        }
+        Constant constant = i.ToConstant(instr->InputAt(0));
+        Address wasm_code = static_cast<Address>(constant.ToInt64());
+        __ Call(wasm_code, constant.rmode());
       } else {
         Register target = i.InputRegister(0);
         __ Call(target);
@@ -655,11 +626,6 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
     }
     case kArchTailCallCodeObjectFromJSFunction:
     case kArchTailCallCodeObject: {
-      // We must not share code targets for calls to builtins for wasm code, as
-      // they might need to be patched individually.
-      internal::Assembler::BlockCodeTargetSharingScope scope;
-      if (info()->IsWasm()) scope.Open(tasm());
-
       if (arch_opcode == kArchTailCallCodeObjectFromJSFunction) {
         AssemblePopArgumentsAdaptorFrame(kJavaScriptCallArgCountRegister,
                                          i.TempRegister(0), i.TempRegister(1),
@@ -668,9 +634,12 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       if (instr->InputAt(0)->IsImmediate()) {
         __ Jump(i.InputCode(0), RelocInfo::CODE_TARGET);
       } else {
-        Register target = i.InputRegister(0);
-        __ Add(target, target, Code::kHeaderSize - kHeapObjectTag);
-        __ Jump(target);
+        Register reg = i.InputRegister(0);
+        DCHECK_IMPLIES(
+            HasCallDescriptorFlag(instr, CallDescriptor::kFixedTargetRegister),
+            reg == kJavaScriptCallCodeStartRegister);
+        __ Add(reg, reg, Code::kHeaderSize - kHeapObjectTag);
+        __ Jump(reg);
       }
       unwinding_info_writer_.MarkBlockWillExit();
       frame_access_state()->ClearSPDelta();
@@ -678,20 +647,10 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       break;
     }
     case kArchTailCallWasm: {
-      // We must not share code targets for calls to builtins for wasm code, as
-      // they might need to be patched individually.
-      internal::Assembler::BlockCodeTargetSharingScope scope;
-      if (info()->IsWasm()) scope.Open(tasm());
-
       if (instr->InputAt(0)->IsImmediate()) {
-        Address wasm_code = reinterpret_cast<Address>(
-            i.ToConstant(instr->InputAt(0)).ToInt64());
-        if (info()->IsWasm()) {
-          __ Jump(wasm_code, RelocInfo::WASM_CALL);
-        } else {
-          __ Jump(wasm_code, RelocInfo::JS_TO_WASM_CALL);
-        }
-
+        Constant constant = i.ToConstant(instr->InputAt(0));
+        Address wasm_code = static_cast<Address>(constant.ToInt64());
+        __ Jump(wasm_code, constant.rmode());
       } else {
         Register target = i.InputRegister(0);
         __ Jump(target);
@@ -703,7 +662,11 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
     }
     case kArchTailCallAddress: {
       CHECK(!instr->InputAt(0)->IsImmediate());
-      __ Jump(i.InputRegister(0));
+      Register reg = i.InputRegister(0);
+      DCHECK_IMPLIES(
+          HasCallDescriptorFlag(instr, CallDescriptor::kFixedTargetRegister),
+          reg == kJavaScriptCallCodeStartRegister);
+      __ Jump(reg);
       unwinding_info_writer_.MarkBlockWillExit();
       frame_access_state()->ClearSPDelta();
       frame_access_state()->SetFrameAccessToDefault();
@@ -798,6 +761,9 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
     case kArchTableSwitch:
       AssembleArchTableSwitch(instr);
       break;
+    case kArchBinarySearchSwitch:
+      AssembleArchBinarySearchSwitch(instr);
+      break;
     case kArchLookupSwitch:
       AssembleArchLookupSwitch(instr);
       break;
@@ -814,17 +780,18 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
                 RelocInfo::CODE_TARGET);
       }
       __ Debug("kArchDebugAbort", 0, BREAK);
+      unwinding_info_writer_.MarkBlockWillExit();
       break;
     case kArchDebugBreak:
       __ Debug("kArchDebugBreak", 0, BREAK);
       break;
-    case kArchComment: {
-      Address comment_string = i.InputExternalReference(0).address();
-      __ RecordComment(reinterpret_cast<const char*>(comment_string));
+    case kArchComment:
+      __ RecordComment(reinterpret_cast<const char*>(i.InputInt64(0)));
       break;
-    }
-    case kArchNop:
     case kArchThrowTerminator:
+      unwinding_info_writer_.MarkBlockWillExit();
+      break;
+    case kArchNop:
       // don't emit code for nops.
       break;
     case kArchDeoptimize: {
@@ -833,6 +800,7 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       CodeGenResult result =
           AssembleDeoptimizerCall(deopt_state_id, current_source_position_);
       if (result != kSuccess) return result;
+      unwinding_info_writer_.MarkBlockWillExit();
       break;
     }
     case kArchRet:
@@ -851,12 +819,9 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
         __ mov(i.OutputRegister(), fp);
       }
       break;
-    case kArchRootsPointer:
-      __ mov(i.OutputRegister(), root);
-      break;
     case kArchTruncateDoubleToI:
-      __ TruncateDoubleToIDelayed(zone(), i.OutputRegister(),
-                                  i.InputDoubleRegister(0));
+      __ TruncateDoubleToI(isolate(), zone(), i.OutputRegister(),
+                           i.InputDoubleRegister(0), DetermineStubCallMode());
       break;
     case kArchStoreWithWriteBarrier: {
       RecordWriteMode mode =
@@ -940,7 +905,7 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       ASSEMBLE_IEEE754_UNOP(log10);
       break;
     case kIeee754Float64Pow: {
-      __ CallStubDelayed(new (zone()) MathPowStub());
+      __ Call(BUILTIN_CODE(isolate(), MathPowInternal), RelocInfo::CODE_TARGET);
       break;
     }
     case kIeee754Float64Sin:
@@ -1387,8 +1352,7 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       DCHECK(d1.is(i.InputDoubleRegister(1)));
       DCHECK(d0.is(i.OutputDoubleRegister()));
       // TODO(dcarney): make sure this saves all relevant registers.
-      __ CallCFunction(
-          ExternalReference::mod_two_doubles_operation(__ isolate()), 0, 2);
+      __ CallCFunction(ExternalReference::mod_two_doubles_operation(), 0, 2);
       break;
     }
     case kArm64Float32Max: {
@@ -1601,90 +1565,121 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       __ Dsb(FullSystem, BarrierAll);
       __ Isb();
       break;
-    case kArchPoisonOnSpeculationWord:
+    case kArchWordPoisonOnSpeculation:
       __ And(i.OutputRegister(0), i.InputRegister(0),
              Operand(kSpeculationPoisonRegister));
       break;
     case kWord32AtomicLoadInt8:
-      ASSEMBLE_ATOMIC_LOAD_INTEGER(Ldarb);
+      ASSEMBLE_ATOMIC_LOAD_INTEGER(Ldarb, Register32);
       __ Sxtb(i.OutputRegister(0), i.OutputRegister(0));
       break;
     case kWord32AtomicLoadUint8:
-      ASSEMBLE_ATOMIC_LOAD_INTEGER(Ldarb);
+    case kArm64Word64AtomicLoadUint8:
+      ASSEMBLE_ATOMIC_LOAD_INTEGER(Ldarb, Register32);
       break;
     case kWord32AtomicLoadInt16:
-      ASSEMBLE_ATOMIC_LOAD_INTEGER(Ldarh);
+      ASSEMBLE_ATOMIC_LOAD_INTEGER(Ldarh, Register32);
       __ Sxth(i.OutputRegister(0), i.OutputRegister(0));
       break;
     case kWord32AtomicLoadUint16:
-      ASSEMBLE_ATOMIC_LOAD_INTEGER(Ldarh);
+    case kArm64Word64AtomicLoadUint16:
+      ASSEMBLE_ATOMIC_LOAD_INTEGER(Ldarh, Register32);
       break;
     case kWord32AtomicLoadWord32:
-      ASSEMBLE_ATOMIC_LOAD_INTEGER(Ldar);
+    case kArm64Word64AtomicLoadUint32:
+      ASSEMBLE_ATOMIC_LOAD_INTEGER(Ldar, Register32);
+      break;
+    case kArm64Word64AtomicLoadUint64:
+      ASSEMBLE_ATOMIC_LOAD_INTEGER(Ldar, Register);
       break;
     case kWord32AtomicStoreWord8:
-      ASSEMBLE_ATOMIC_STORE_INTEGER(Stlrb);
+    case kArm64Word64AtomicStoreWord8:
+      ASSEMBLE_ATOMIC_STORE_INTEGER(Stlrb, Register32);
       break;
     case kWord32AtomicStoreWord16:
-      ASSEMBLE_ATOMIC_STORE_INTEGER(Stlrh);
+    case kArm64Word64AtomicStoreWord16:
+      ASSEMBLE_ATOMIC_STORE_INTEGER(Stlrh, Register32);
       break;
     case kWord32AtomicStoreWord32:
-      ASSEMBLE_ATOMIC_STORE_INTEGER(Stlr);
+    case kArm64Word64AtomicStoreWord32:
+      ASSEMBLE_ATOMIC_STORE_INTEGER(Stlr, Register32);
+      break;
+    case kArm64Word64AtomicStoreWord64:
+      ASSEMBLE_ATOMIC_STORE_INTEGER(Stlr, Register);
       break;
     case kWord32AtomicExchangeInt8:
-      ASSEMBLE_ATOMIC_EXCHANGE_INTEGER(ldaxrb, stlxrb);
+      ASSEMBLE_ATOMIC_EXCHANGE_INTEGER(ldaxrb, stlxrb, Register32);
       __ Sxtb(i.OutputRegister(0), i.OutputRegister(0));
       break;
     case kWord32AtomicExchangeUint8:
-      ASSEMBLE_ATOMIC_EXCHANGE_INTEGER(ldaxrb, stlxrb);
+    case kArm64Word64AtomicExchangeUint8:
+      ASSEMBLE_ATOMIC_EXCHANGE_INTEGER(ldaxrb, stlxrb, Register32);
       break;
     case kWord32AtomicExchangeInt16:
-      ASSEMBLE_ATOMIC_EXCHANGE_INTEGER(ldaxrh, stlxrh);
+      ASSEMBLE_ATOMIC_EXCHANGE_INTEGER(ldaxrh, stlxrh, Register32);
       __ Sxth(i.OutputRegister(0), i.OutputRegister(0));
       break;
     case kWord32AtomicExchangeUint16:
-      ASSEMBLE_ATOMIC_EXCHANGE_INTEGER(ldaxrh, stlxrh);
+    case kArm64Word64AtomicExchangeUint16:
+      ASSEMBLE_ATOMIC_EXCHANGE_INTEGER(ldaxrh, stlxrh, Register32);
       break;
     case kWord32AtomicExchangeWord32:
-      ASSEMBLE_ATOMIC_EXCHANGE_INTEGER(ldaxr, stlxr);
+    case kArm64Word64AtomicExchangeUint32:
+      ASSEMBLE_ATOMIC_EXCHANGE_INTEGER(ldaxr, stlxr, Register32);
+      break;
+    case kArm64Word64AtomicExchangeUint64:
+      ASSEMBLE_ATOMIC_EXCHANGE_INTEGER(ldaxr, stlxr, Register);
       break;
     case kWord32AtomicCompareExchangeInt8:
-      ASSEMBLE_ATOMIC_COMPARE_EXCHANGE_INTEGER(ldaxrb, stlxrb, UXTB);
+      ASSEMBLE_ATOMIC_COMPARE_EXCHANGE_INTEGER(ldaxrb, stlxrb, UXTB,
+                                               Register32);
       __ Sxtb(i.OutputRegister(0), i.OutputRegister(0));
       break;
     case kWord32AtomicCompareExchangeUint8:
-      ASSEMBLE_ATOMIC_COMPARE_EXCHANGE_INTEGER(ldaxrb, stlxrb, UXTB);
+    case kArm64Word64AtomicCompareExchangeUint8:
+      ASSEMBLE_ATOMIC_COMPARE_EXCHANGE_INTEGER(ldaxrb, stlxrb, UXTB,
+                                               Register32);
       break;
     case kWord32AtomicCompareExchangeInt16:
-      ASSEMBLE_ATOMIC_COMPARE_EXCHANGE_INTEGER(ldaxrh, stlxrh, UXTH);
+      ASSEMBLE_ATOMIC_COMPARE_EXCHANGE_INTEGER(ldaxrh, stlxrh, UXTH,
+                                               Register32);
       __ Sxth(i.OutputRegister(0), i.OutputRegister(0));
       break;
     case kWord32AtomicCompareExchangeUint16:
-      ASSEMBLE_ATOMIC_COMPARE_EXCHANGE_INTEGER(ldaxrh, stlxrh, UXTH);
+    case kArm64Word64AtomicCompareExchangeUint16:
+      ASSEMBLE_ATOMIC_COMPARE_EXCHANGE_INTEGER(ldaxrh, stlxrh, UXTH,
+                                               Register32);
       break;
     case kWord32AtomicCompareExchangeWord32:
-      ASSEMBLE_ATOMIC_COMPARE_EXCHANGE_INTEGER(ldaxr, stlxr, UXTW);
-      break;
-#define ATOMIC_BINOP_CASE(op, inst)                    \
-  case kWord32Atomic##op##Int8:                        \
-    ASSEMBLE_ATOMIC_BINOP(ldaxrb, stlxrb, inst);       \
-    __ Sxtb(i.OutputRegister(0), i.OutputRegister(0)); \
-    break;                                             \
-  case kWord32Atomic##op##Uint8:                       \
-  case kArm64Word64Atomic##op##Uint8:                  \
-    ASSEMBLE_ATOMIC_BINOP(ldaxrb, stlxrb, inst);       \
-    break;                                             \
-  case kWord32Atomic##op##Int16:                       \
-    ASSEMBLE_ATOMIC_BINOP(ldaxrh, stlxrh, inst);       \
-    __ Sxth(i.OutputRegister(0), i.OutputRegister(0)); \
-    break;                                             \
-  case kWord32Atomic##op##Uint16:                      \
-  case kArm64Word64Atomic##op##Uint16:                 \
-    ASSEMBLE_ATOMIC_BINOP(ldaxrh, stlxrh, inst);       \
-    break;                                             \
-  case kWord32Atomic##op##Word32:                      \
-  case kArm64Word64Atomic##op##Uint32:                 \
-    ASSEMBLE_ATOMIC_BINOP(ldaxr, stlxr, inst);         \
+    case kArm64Word64AtomicCompareExchangeUint32:
+      ASSEMBLE_ATOMIC_COMPARE_EXCHANGE_INTEGER(ldaxr, stlxr, UXTW, Register32);
+      break;
+    case kArm64Word64AtomicCompareExchangeUint64:
+      ASSEMBLE_ATOMIC_COMPARE_EXCHANGE_INTEGER(ldaxr, stlxr, UXTX, Register);
+      break;
+#define ATOMIC_BINOP_CASE(op, inst)                          \
+  case kWord32Atomic##op##Int8:                              \
+    ASSEMBLE_ATOMIC_BINOP(ldaxrb, stlxrb, inst, Register32); \
+    __ Sxtb(i.OutputRegister(0), i.OutputRegister(0));       \
+    break;                                                   \
+  case kWord32Atomic##op##Uint8:                             \
+  case kArm64Word64Atomic##op##Uint8:                        \
+    ASSEMBLE_ATOMIC_BINOP(ldaxrb, stlxrb, inst, Register32); \
+    break;                                                   \
+  case kWord32Atomic##op##Int16:                             \
+    ASSEMBLE_ATOMIC_BINOP(ldaxrh, stlxrh, inst, Register32); \
+    __ Sxth(i.OutputRegister(0), i.OutputRegister(0));       \
+    break;                                                   \
+  case kWord32Atomic##op##Uint16:                            \
+  case kArm64Word64Atomic##op##Uint16:                       \
+    ASSEMBLE_ATOMIC_BINOP(ldaxrh, stlxrh, inst, Register32); \
+    break;                                                   \
+  case kWord32Atomic##op##Word32:                            \
+  case kArm64Word64Atomic##op##Uint32:                       \
+    ASSEMBLE_ATOMIC_BINOP(ldaxr, stlxr, inst, Register32);   \
+    break;                                                   \
+  case kArm64Word64Atomic##op##Uint64:                       \
+    ASSEMBLE_ATOMIC_BINOP(ldaxr, stlxr, inst, Register);     \
     break;
       ATOMIC_BINOP_CASE(Add, Add)
       ATOMIC_BINOP_CASE(Sub, Sub)
@@ -1692,25 +1687,14 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       ATOMIC_BINOP_CASE(Or, Orr)
       ATOMIC_BINOP_CASE(Xor, Eor)
 #undef ATOMIC_BINOP_CASE
-#define ATOMIC64_BINOP_CASE(op, inst)            \
-  case kArm64Word64Atomic##op##Uint64:           \
-    ASSEMBLE_ATOMIC64_BINOP(ldaxr, stlxr, inst); \
-    break;
-      ATOMIC64_BINOP_CASE(Add, Add)
-      ATOMIC64_BINOP_CASE(Sub, Sub)
-      ATOMIC64_BINOP_CASE(And, And)
-      ATOMIC64_BINOP_CASE(Or, Orr)
-      ATOMIC64_BINOP_CASE(Xor, Eor)
-#undef ATOMIC64_BINOP_CASE
 #undef ASSEMBLE_SHIFT
 #undef ASSEMBLE_ATOMIC_LOAD_INTEGER
 #undef ASSEMBLE_ATOMIC_STORE_INTEGER
 #undef ASSEMBLE_ATOMIC_EXCHANGE_INTEGER
+#undef ASSEMBLE_ATOMIC_COMPARE_EXCHANGE_INTEGER
 #undef ASSEMBLE_ATOMIC_BINOP
-#undef ASSEMBLE_ATOMIC64_BINOP
 #undef ASSEMBLE_IEEE754_BINOP
 #undef ASSEMBLE_IEEE754_UNOP
-#undef ASSEMBLE_ATOMIC_COMPARE_EXCHANGE_INTEGER
 
 #define SIMD_UNOP_CASE(Op, Instr, FORMAT)            \
   case Op:                                           \
@@ -2254,34 +2238,22 @@ void CodeGenerator::AssembleArchTrap(Instruction* instr,
                                      FlagsCondition condition) {
   class OutOfLineTrap final : public OutOfLineCode {
    public:
-    OutOfLineTrap(CodeGenerator* gen, bool frame_elided, Instruction* instr)
-        : OutOfLineCode(gen),
-          frame_elided_(frame_elided),
-          instr_(instr),
-          gen_(gen) {}
+    OutOfLineTrap(CodeGenerator* gen, Instruction* instr)
+        : OutOfLineCode(gen), instr_(instr), gen_(gen) {}
     void Generate() final {
       Arm64OperandConverter i(gen_, instr_);
-      Builtins::Name trap_id =
-          static_cast<Builtins::Name>(i.InputInt32(instr_->InputCount() - 1));
-      bool old_has_frame = __ has_frame();
-      if (frame_elided_) {
-        __ set_has_frame(true);
-        __ EnterFrame(StackFrame::WASM_COMPILED);
-      }
+      TrapId trap_id =
+          static_cast<TrapId>(i.InputInt32(instr_->InputCount() - 1));
       GenerateCallToTrap(trap_id);
-      if (frame_elided_) {
-        __ set_has_frame(old_has_frame);
-      }
     }
 
    private:
-    void GenerateCallToTrap(Builtins::Name trap_id) {
-      if (trap_id == Builtins::builtin_count) {
+    void GenerateCallToTrap(TrapId trap_id) {
+      if (trap_id == TrapId::kInvalid) {
         // We cannot test calls to the runtime in cctest/test-run-wasm.
         // Therefore we emit a call to C here instead of a call to the runtime.
-        __ CallCFunction(ExternalReference::wasm_call_trap_callback_for_testing(
-                             __ isolate()),
-                         0);
+        __ CallCFunction(
+            ExternalReference::wasm_call_trap_callback_for_testing(), 0);
         __ LeaveFrame(StackFrame::WASM_COMPILED);
         auto call_descriptor = gen_->linkage()->GetIncomingDescriptor();
         int pop_count =
@@ -2291,8 +2263,9 @@ void CodeGenerator::AssembleArchTrap(Instruction* instr,
         __ Ret();
       } else {
         gen_->AssembleSourcePosition(instr_);
-        __ Call(__ isolate()->builtins()->builtin_handle(trap_id),
-                RelocInfo::CODE_TARGET);
+        // A direct call to a wasm runtime stub defined in this module.
+        // Just encode the stub index. This will be patched at relocation.
+        __ Call(static_cast<Address>(trap_id), RelocInfo::WASM_STUB_CALL);
         ReferenceMap* reference_map =
             new (gen_->zone()) ReferenceMap(gen_->zone());
         gen_->RecordSafepoint(reference_map, Safepoint::kSimple, 0,
@@ -2303,12 +2276,10 @@ void CodeGenerator::AssembleArchTrap(Instruction* instr,
         }
       }
     }
-    bool frame_elided_;
     Instruction* instr_;
     CodeGenerator* gen_;
   };
-  bool frame_elided = !frame_access_state()->has_frame();
-  auto ool = new (zone()) OutOfLineTrap(this, frame_elided, instr);
+  auto ool = new (zone()) OutOfLineTrap(this, instr);
   Label* tlabel = ool->entry();
   Condition cc = FlagsConditionToCondition(condition);
   __ B(cc, tlabel);
@@ -2327,6 +2298,16 @@ void CodeGenerator::AssembleArchBoolean(Instruction* instr,
   __ Cset(reg, cc);
 }
 
+void CodeGenerator::AssembleArchBinarySearchSwitch(Instruction* instr) {
+  Arm64OperandConverter i(this, instr);
+  Register input = i.InputRegister32(0);
+  std::vector<std::pair<int32_t, Label*>> cases;
+  for (size_t index = 2; index < instr->InputCount(); index += 2) {
+    cases.push_back({i.InputInt32(index + 0), GetLabel(i.InputRpo(index + 1))});
+  }
+  AssembleArchBinarySearchSwitchRange(input, i.InputRpo(1), cases.data(),
+                                      cases.data() + cases.size());
+}
 
 void CodeGenerator::AssembleArchLookupSwitch(Instruction* instr) {
   Arm64OperandConverter i(this, instr);
@@ -2437,22 +2418,30 @@ void CodeGenerator::AssembleConstructFrame() {
       if (shrink_slots * kPointerSize < FLAG_stack_size * 1024) {
         UseScratchRegisterScope scope(tasm());
         Register scratch = scope.AcquireX();
-        __ Mov(scratch, Operand(ExternalReference::address_of_real_stack_limit(
-                            __ isolate())));
+        __ Ldr(scratch, FieldMemOperand(
+                            kWasmInstanceRegister,
+                            WasmInstanceObject::kRealStackLimitAddressOffset));
         __ Ldr(scratch, MemOperand(scratch));
         __ Add(scratch, scratch, shrink_slots * kPointerSize);
         __ Cmp(sp, scratch);
         __ B(hs, &done);
       }
 
-      if (!frame_access_state()->has_frame()) {
-        __ set_has_frame(true);
-        // There is no need to leave the frame, we will not return from the
-        // runtime call.
-        __ EnterFrame(StackFrame::WASM_COMPILED);
+      {
+        // Finish the frame that hasn't been fully built yet.
+        UseScratchRegisterScope temps(tasm());
+        __ Claim(2);  // Claim extra slots for marker + instance.
+        Register scratch = temps.AcquireX();
+        __ Mov(scratch,
+               StackFrame::TypeToMarker(info()->GetOutputStackFrameType()));
+        __ Str(scratch, MemOperand(fp, TypedFrameConstants::kFrameTypeOffset));
+        __ Str(kWasmInstanceRegister,
+               MemOperand(fp, WasmCompiledFrameConstants::kWasmInstanceOffset));
       }
+      __ Ldr(x2, FieldMemOperand(kWasmInstanceRegister,
+                                 WasmInstanceObject::kCEntryStubOffset));
       __ Mov(cp, Smi::kZero);
-      __ CallRuntimeDelayed(zone(), Runtime::kThrowWasmStackOverflow);
+      __ CallRuntimeWithCEntry(Runtime::kThrowWasmStackOverflow, x2);
       // We come from WebAssembly, there are no references for the GC.
       ReferenceMap* reference_map = new (zone()) ReferenceMap(zone());
       RecordSafepoint(reference_map, Safepoint::kSimple, 0,
@@ -2482,8 +2471,7 @@ void CodeGenerator::AssembleConstructFrame() {
           __ Claim(shrink_slots);
         }
         break;
-      case CallDescriptor::kCallCodeObject:
-      case CallDescriptor::kCallWasmFunction: {
+      case CallDescriptor::kCallCodeObject: {
         UseScratchRegisterScope temps(tasm());
         __ Claim(shrink_slots + 1);  // Claim extra slot for frame type marker.
         Register scratch = temps.AcquireX();
@@ -2491,6 +2479,16 @@ void CodeGenerator::AssembleConstructFrame() {
                StackFrame::TypeToMarker(info()->GetOutputStackFrameType()));
         __ Str(scratch, MemOperand(fp, TypedFrameConstants::kFrameTypeOffset));
       } break;
+      case CallDescriptor::kCallWasmFunction: {
+        UseScratchRegisterScope temps(tasm());
+        __ Claim(shrink_slots + 2);  // Claim extra slots for marker + instance.
+        Register scratch = temps.AcquireX();
+        __ Mov(scratch,
+               StackFrame::TypeToMarker(info()->GetOutputStackFrameType()));
+        __ Str(scratch, MemOperand(fp, TypedFrameConstants::kFrameTypeOffset));
+        __ Str(kWasmInstanceRegister,
+               MemOperand(fp, WasmCompiledFrameConstants::kWasmInstanceOffset));
+      } break;
       case CallDescriptor::kCallAddress:
         __ Claim(shrink_slots);
         break;
@@ -2582,8 +2580,10 @@ void CodeGenerator::AssembleMove(InstructionOperand* source,
       if (IsMaterializableFromRoot(src_object, &index)) {
         __ LoadRoot(dst, index);
       } else {
-        __ Mov(dst, src_object);
+        __ Move(dst, src_object);
       }
+    } else if (src.type() == Constant::kExternalReference) {
+      __ Mov(dst, src.ToExternalReference());
     } else {
       __ Mov(dst, g.ToImmediate(source));
     }
diff --git a/deps/v8/src/compiler/arm64/instruction-codes-arm64.h b/deps/v8/src/compiler/arm64/instruction-codes-arm64.h
index 5eb09dfe05ae2b..ce73515321e2dc 100644
--- a/deps/v8/src/compiler/arm64/instruction-codes-arm64.h
+++ b/deps/v8/src/compiler/arm64/instruction-codes-arm64.h
@@ -11,316 +11,332 @@ namespace compiler {
 
 // ARM64-specific opcodes that specify which assembly sequence to emit.
 // Most opcodes specify a single instruction.
-#define TARGET_ARCH_OPCODE_LIST(V) \
-  V(Arm64Add)                      \
-  V(Arm64Add32)                    \
-  V(Arm64And)                      \
-  V(Arm64And32)                    \
-  V(Arm64Bic)                      \
-  V(Arm64Bic32)                    \
-  V(Arm64Clz)                      \
-  V(Arm64Clz32)                    \
-  V(Arm64Cmp)                      \
-  V(Arm64Cmp32)                    \
-  V(Arm64Cmn)                      \
-  V(Arm64Cmn32)                    \
-  V(Arm64Tst)                      \
-  V(Arm64Tst32)                    \
-  V(Arm64Or)                       \
-  V(Arm64Or32)                     \
-  V(Arm64Orn)                      \
-  V(Arm64Orn32)                    \
-  V(Arm64Eor)                      \
-  V(Arm64Eor32)                    \
-  V(Arm64Eon)                      \
-  V(Arm64Eon32)                    \
-  V(Arm64Sub)                      \
-  V(Arm64Sub32)                    \
-  V(Arm64Mul)                      \
-  V(Arm64Mul32)                    \
-  V(Arm64Smull)                    \
-  V(Arm64Umull)                    \
-  V(Arm64Madd)                     \
-  V(Arm64Madd32)                   \
-  V(Arm64Msub)                     \
-  V(Arm64Msub32)                   \
-  V(Arm64Mneg)                     \
-  V(Arm64Mneg32)                   \
-  V(Arm64Idiv)                     \
-  V(Arm64Idiv32)                   \
-  V(Arm64Udiv)                     \
-  V(Arm64Udiv32)                   \
-  V(Arm64Imod)                     \
-  V(Arm64Imod32)                   \
-  V(Arm64Umod)                     \
-  V(Arm64Umod32)                   \
-  V(Arm64Not)                      \
-  V(Arm64Not32)                    \
-  V(Arm64Lsl)                      \
-  V(Arm64Lsl32)                    \
-  V(Arm64Lsr)                      \
-  V(Arm64Lsr32)                    \
-  V(Arm64Asr)                      \
-  V(Arm64Asr32)                    \
-  V(Arm64Ror)                      \
-  V(Arm64Ror32)                    \
-  V(Arm64Mov32)                    \
-  V(Arm64Sxtb32)                   \
-  V(Arm64Sxth32)                   \
-  V(Arm64Sxtb)                     \
-  V(Arm64Sxth)                     \
-  V(Arm64Sxtw)                     \
-  V(Arm64Sbfx32)                   \
-  V(Arm64Ubfx)                     \
-  V(Arm64Ubfx32)                   \
-  V(Arm64Ubfiz32)                  \
-  V(Arm64Bfi)                      \
-  V(Arm64Rbit)                     \
-  V(Arm64Rbit32)                   \
-  V(Arm64TestAndBranch32)          \
-  V(Arm64TestAndBranch)            \
-  V(Arm64CompareAndBranch32)       \
-  V(Arm64CompareAndBranch)         \
-  V(Arm64Claim)                    \
-  V(Arm64Poke)                     \
-  V(Arm64PokePair)                 \
-  V(Arm64Peek)                     \
-  V(Arm64Float32Cmp)               \
-  V(Arm64Float32Add)               \
-  V(Arm64Float32Sub)               \
-  V(Arm64Float32Mul)               \
-  V(Arm64Float32Div)               \
-  V(Arm64Float32Abs)               \
-  V(Arm64Float32Neg)               \
-  V(Arm64Float32Sqrt)              \
-  V(Arm64Float32RoundDown)         \
-  V(Arm64Float32Max)               \
-  V(Arm64Float32Min)               \
-  V(Arm64Float64Cmp)               \
-  V(Arm64Float64Add)               \
-  V(Arm64Float64Sub)               \
-  V(Arm64Float64Mul)               \
-  V(Arm64Float64Div)               \
-  V(Arm64Float64Mod)               \
-  V(Arm64Float64Max)               \
-  V(Arm64Float64Min)               \
-  V(Arm64Float64Abs)               \
-  V(Arm64Float64Neg)               \
-  V(Arm64Float64Sqrt)              \
-  V(Arm64Float64RoundDown)         \
-  V(Arm64Float32RoundUp)           \
-  V(Arm64Float64RoundUp)           \
-  V(Arm64Float64RoundTiesAway)     \
-  V(Arm64Float32RoundTruncate)     \
-  V(Arm64Float64RoundTruncate)     \
-  V(Arm64Float32RoundTiesEven)     \
-  V(Arm64Float64RoundTiesEven)     \
-  V(Arm64Float64SilenceNaN)        \
-  V(Arm64Float32ToFloat64)         \
-  V(Arm64Float64ToFloat32)         \
-  V(Arm64Float32ToInt32)           \
-  V(Arm64Float64ToInt32)           \
-  V(Arm64Float32ToUint32)          \
-  V(Arm64Float64ToUint32)          \
-  V(Arm64Float32ToInt64)           \
-  V(Arm64Float64ToInt64)           \
-  V(Arm64Float32ToUint64)          \
-  V(Arm64Float64ToUint64)          \
-  V(Arm64Int32ToFloat32)           \
-  V(Arm64Int32ToFloat64)           \
-  V(Arm64Int64ToFloat32)           \
-  V(Arm64Int64ToFloat64)           \
-  V(Arm64Uint32ToFloat32)          \
-  V(Arm64Uint32ToFloat64)          \
-  V(Arm64Uint64ToFloat32)          \
-  V(Arm64Uint64ToFloat64)          \
-  V(Arm64Float64ExtractLowWord32)  \
-  V(Arm64Float64ExtractHighWord32) \
-  V(Arm64Float64InsertLowWord32)   \
-  V(Arm64Float64InsertHighWord32)  \
-  V(Arm64Float64MoveU64)           \
-  V(Arm64U64MoveFloat64)           \
-  V(Arm64LdrS)                     \
-  V(Arm64StrS)                     \
-  V(Arm64LdrD)                     \
-  V(Arm64StrD)                     \
-  V(Arm64LdrQ)                     \
-  V(Arm64StrQ)                     \
-  V(Arm64Ldrb)                     \
-  V(Arm64Ldrsb)                    \
-  V(Arm64Strb)                     \
-  V(Arm64Ldrh)                     \
-  V(Arm64Ldrsh)                    \
-  V(Arm64Strh)                     \
-  V(Arm64Ldrsw)                    \
-  V(Arm64LdrW)                     \
-  V(Arm64StrW)                     \
-  V(Arm64Ldr)                      \
-  V(Arm64Str)                      \
-  V(Arm64DsbIsb)                   \
-  V(Arm64F32x4Splat)               \
-  V(Arm64F32x4ExtractLane)         \
-  V(Arm64F32x4ReplaceLane)         \
-  V(Arm64F32x4SConvertI32x4)       \
-  V(Arm64F32x4UConvertI32x4)       \
-  V(Arm64F32x4Abs)                 \
-  V(Arm64F32x4Neg)                 \
-  V(Arm64F32x4RecipApprox)         \
-  V(Arm64F32x4RecipSqrtApprox)     \
-  V(Arm64F32x4Add)                 \
-  V(Arm64F32x4AddHoriz)            \
-  V(Arm64F32x4Sub)                 \
-  V(Arm64F32x4Mul)                 \
-  V(Arm64F32x4Min)                 \
-  V(Arm64F32x4Max)                 \
-  V(Arm64F32x4Eq)                  \
-  V(Arm64F32x4Ne)                  \
-  V(Arm64F32x4Lt)                  \
-  V(Arm64F32x4Le)                  \
-  V(Arm64I32x4Splat)               \
-  V(Arm64I32x4ExtractLane)         \
-  V(Arm64I32x4ReplaceLane)         \
-  V(Arm64I32x4SConvertF32x4)       \
-  V(Arm64I32x4SConvertI16x8Low)    \
-  V(Arm64I32x4SConvertI16x8High)   \
-  V(Arm64I32x4Neg)                 \
-  V(Arm64I32x4Shl)                 \
-  V(Arm64I32x4ShrS)                \
-  V(Arm64I32x4Add)                 \
-  V(Arm64I32x4AddHoriz)            \
-  V(Arm64I32x4Sub)                 \
-  V(Arm64I32x4Mul)                 \
-  V(Arm64I32x4MinS)                \
-  V(Arm64I32x4MaxS)                \
-  V(Arm64I32x4Eq)                  \
-  V(Arm64I32x4Ne)                  \
-  V(Arm64I32x4GtS)                 \
-  V(Arm64I32x4GeS)                 \
-  V(Arm64I32x4UConvertF32x4)       \
-  V(Arm64I32x4UConvertI16x8Low)    \
-  V(Arm64I32x4UConvertI16x8High)   \
-  V(Arm64I32x4ShrU)                \
-  V(Arm64I32x4MinU)                \
-  V(Arm64I32x4MaxU)                \
-  V(Arm64I32x4GtU)                 \
-  V(Arm64I32x4GeU)                 \
-  V(Arm64I16x8Splat)               \
-  V(Arm64I16x8ExtractLane)         \
-  V(Arm64I16x8ReplaceLane)         \
-  V(Arm64I16x8SConvertI8x16Low)    \
-  V(Arm64I16x8SConvertI8x16High)   \
-  V(Arm64I16x8Neg)                 \
-  V(Arm64I16x8Shl)                 \
-  V(Arm64I16x8ShrS)                \
-  V(Arm64I16x8SConvertI32x4)       \
-  V(Arm64I16x8Add)                 \
-  V(Arm64I16x8AddSaturateS)        \
-  V(Arm64I16x8AddHoriz)            \
-  V(Arm64I16x8Sub)                 \
-  V(Arm64I16x8SubSaturateS)        \
-  V(Arm64I16x8Mul)                 \
-  V(Arm64I16x8MinS)                \
-  V(Arm64I16x8MaxS)                \
-  V(Arm64I16x8Eq)                  \
-  V(Arm64I16x8Ne)                  \
-  V(Arm64I16x8GtS)                 \
-  V(Arm64I16x8GeS)                 \
-  V(Arm64I16x8UConvertI8x16Low)    \
-  V(Arm64I16x8UConvertI8x16High)   \
-  V(Arm64I16x8ShrU)                \
-  V(Arm64I16x8UConvertI32x4)       \
-  V(Arm64I16x8AddSaturateU)        \
-  V(Arm64I16x8SubSaturateU)        \
-  V(Arm64I16x8MinU)                \
-  V(Arm64I16x8MaxU)                \
-  V(Arm64I16x8GtU)                 \
-  V(Arm64I16x8GeU)                 \
-  V(Arm64I8x16Splat)               \
-  V(Arm64I8x16ExtractLane)         \
-  V(Arm64I8x16ReplaceLane)         \
-  V(Arm64I8x16Neg)                 \
-  V(Arm64I8x16Shl)                 \
-  V(Arm64I8x16ShrS)                \
-  V(Arm64I8x16SConvertI16x8)       \
-  V(Arm64I8x16Add)                 \
-  V(Arm64I8x16AddSaturateS)        \
-  V(Arm64I8x16Sub)                 \
-  V(Arm64I8x16SubSaturateS)        \
-  V(Arm64I8x16Mul)                 \
-  V(Arm64I8x16MinS)                \
-  V(Arm64I8x16MaxS)                \
-  V(Arm64I8x16Eq)                  \
-  V(Arm64I8x16Ne)                  \
-  V(Arm64I8x16GtS)                 \
-  V(Arm64I8x16GeS)                 \
-  V(Arm64I8x16ShrU)                \
-  V(Arm64I8x16UConvertI16x8)       \
-  V(Arm64I8x16AddSaturateU)        \
-  V(Arm64I8x16SubSaturateU)        \
-  V(Arm64I8x16MinU)                \
-  V(Arm64I8x16MaxU)                \
-  V(Arm64I8x16GtU)                 \
-  V(Arm64I8x16GeU)                 \
-  V(Arm64S128Zero)                 \
-  V(Arm64S128Dup)                  \
-  V(Arm64S128And)                  \
-  V(Arm64S128Or)                   \
-  V(Arm64S128Xor)                  \
-  V(Arm64S128Not)                  \
-  V(Arm64S128Select)               \
-  V(Arm64S32x4ZipLeft)             \
-  V(Arm64S32x4ZipRight)            \
-  V(Arm64S32x4UnzipLeft)           \
-  V(Arm64S32x4UnzipRight)          \
-  V(Arm64S32x4TransposeLeft)       \
-  V(Arm64S32x4TransposeRight)      \
-  V(Arm64S32x4Shuffle)             \
-  V(Arm64S16x8ZipLeft)             \
-  V(Arm64S16x8ZipRight)            \
-  V(Arm64S16x8UnzipLeft)           \
-  V(Arm64S16x8UnzipRight)          \
-  V(Arm64S16x8TransposeLeft)       \
-  V(Arm64S16x8TransposeRight)      \
-  V(Arm64S8x16ZipLeft)             \
-  V(Arm64S8x16ZipRight)            \
-  V(Arm64S8x16UnzipLeft)           \
-  V(Arm64S8x16UnzipRight)          \
-  V(Arm64S8x16TransposeLeft)       \
-  V(Arm64S8x16TransposeRight)      \
-  V(Arm64S8x16Concat)              \
-  V(Arm64S8x16Shuffle)             \
-  V(Arm64S32x2Reverse)             \
-  V(Arm64S16x4Reverse)             \
-  V(Arm64S16x2Reverse)             \
-  V(Arm64S8x8Reverse)              \
-  V(Arm64S8x4Reverse)              \
-  V(Arm64S8x2Reverse)              \
-  V(Arm64S1x4AnyTrue)              \
-  V(Arm64S1x4AllTrue)              \
-  V(Arm64S1x8AnyTrue)              \
-  V(Arm64S1x8AllTrue)              \
-  V(Arm64S1x16AnyTrue)             \
-  V(Arm64S1x16AllTrue)             \
-  V(Arm64Word64AtomicAddUint8)     \
-  V(Arm64Word64AtomicAddUint16)    \
-  V(Arm64Word64AtomicAddUint32)    \
-  V(Arm64Word64AtomicAddUint64)    \
-  V(Arm64Word64AtomicSubUint8)     \
-  V(Arm64Word64AtomicSubUint16)    \
-  V(Arm64Word64AtomicSubUint32)    \
-  V(Arm64Word64AtomicSubUint64)    \
-  V(Arm64Word64AtomicAndUint8)     \
-  V(Arm64Word64AtomicAndUint16)    \
-  V(Arm64Word64AtomicAndUint32)    \
-  V(Arm64Word64AtomicAndUint64)    \
-  V(Arm64Word64AtomicOrUint8)      \
-  V(Arm64Word64AtomicOrUint16)     \
-  V(Arm64Word64AtomicOrUint32)     \
-  V(Arm64Word64AtomicOrUint64)     \
-  V(Arm64Word64AtomicXorUint8)     \
-  V(Arm64Word64AtomicXorUint16)    \
-  V(Arm64Word64AtomicXorUint32)    \
-  V(Arm64Word64AtomicXorUint64)
+#define TARGET_ARCH_OPCODE_LIST(V)          \
+  V(Arm64Add)                               \
+  V(Arm64Add32)                             \
+  V(Arm64And)                               \
+  V(Arm64And32)                             \
+  V(Arm64Bic)                               \
+  V(Arm64Bic32)                             \
+  V(Arm64Clz)                               \
+  V(Arm64Clz32)                             \
+  V(Arm64Cmp)                               \
+  V(Arm64Cmp32)                             \
+  V(Arm64Cmn)                               \
+  V(Arm64Cmn32)                             \
+  V(Arm64Tst)                               \
+  V(Arm64Tst32)                             \
+  V(Arm64Or)                                \
+  V(Arm64Or32)                              \
+  V(Arm64Orn)                               \
+  V(Arm64Orn32)                             \
+  V(Arm64Eor)                               \
+  V(Arm64Eor32)                             \
+  V(Arm64Eon)                               \
+  V(Arm64Eon32)                             \
+  V(Arm64Sub)                               \
+  V(Arm64Sub32)                             \
+  V(Arm64Mul)                               \
+  V(Arm64Mul32)                             \
+  V(Arm64Smull)                             \
+  V(Arm64Umull)                             \
+  V(Arm64Madd)                              \
+  V(Arm64Madd32)                            \
+  V(Arm64Msub)                              \
+  V(Arm64Msub32)                            \
+  V(Arm64Mneg)                              \
+  V(Arm64Mneg32)                            \
+  V(Arm64Idiv)                              \
+  V(Arm64Idiv32)                            \
+  V(Arm64Udiv)                              \
+  V(Arm64Udiv32)                            \
+  V(Arm64Imod)                              \
+  V(Arm64Imod32)                            \
+  V(Arm64Umod)                              \
+  V(Arm64Umod32)                            \
+  V(Arm64Not)                               \
+  V(Arm64Not32)                             \
+  V(Arm64Lsl)                               \
+  V(Arm64Lsl32)                             \
+  V(Arm64Lsr)                               \
+  V(Arm64Lsr32)                             \
+  V(Arm64Asr)                               \
+  V(Arm64Asr32)                             \
+  V(Arm64Ror)                               \
+  V(Arm64Ror32)                             \
+  V(Arm64Mov32)                             \
+  V(Arm64Sxtb32)                            \
+  V(Arm64Sxth32)                            \
+  V(Arm64Sxtb)                              \
+  V(Arm64Sxth)                              \
+  V(Arm64Sxtw)                              \
+  V(Arm64Sbfx32)                            \
+  V(Arm64Ubfx)                              \
+  V(Arm64Ubfx32)                            \
+  V(Arm64Ubfiz32)                           \
+  V(Arm64Bfi)                               \
+  V(Arm64Rbit)                              \
+  V(Arm64Rbit32)                            \
+  V(Arm64TestAndBranch32)                   \
+  V(Arm64TestAndBranch)                     \
+  V(Arm64CompareAndBranch32)                \
+  V(Arm64CompareAndBranch)                  \
+  V(Arm64Claim)                             \
+  V(Arm64Poke)                              \
+  V(Arm64PokePair)                          \
+  V(Arm64Peek)                              \
+  V(Arm64Float32Cmp)                        \
+  V(Arm64Float32Add)                        \
+  V(Arm64Float32Sub)                        \
+  V(Arm64Float32Mul)                        \
+  V(Arm64Float32Div)                        \
+  V(Arm64Float32Abs)                        \
+  V(Arm64Float32Neg)                        \
+  V(Arm64Float32Sqrt)                       \
+  V(Arm64Float32RoundDown)                  \
+  V(Arm64Float32Max)                        \
+  V(Arm64Float32Min)                        \
+  V(Arm64Float64Cmp)                        \
+  V(Arm64Float64Add)                        \
+  V(Arm64Float64Sub)                        \
+  V(Arm64Float64Mul)                        \
+  V(Arm64Float64Div)                        \
+  V(Arm64Float64Mod)                        \
+  V(Arm64Float64Max)                        \
+  V(Arm64Float64Min)                        \
+  V(Arm64Float64Abs)                        \
+  V(Arm64Float64Neg)                        \
+  V(Arm64Float64Sqrt)                       \
+  V(Arm64Float64RoundDown)                  \
+  V(Arm64Float32RoundUp)                    \
+  V(Arm64Float64RoundUp)                    \
+  V(Arm64Float64RoundTiesAway)              \
+  V(Arm64Float32RoundTruncate)              \
+  V(Arm64Float64RoundTruncate)              \
+  V(Arm64Float32RoundTiesEven)              \
+  V(Arm64Float64RoundTiesEven)              \
+  V(Arm64Float64SilenceNaN)                 \
+  V(Arm64Float32ToFloat64)                  \
+  V(Arm64Float64ToFloat32)                  \
+  V(Arm64Float32ToInt32)                    \
+  V(Arm64Float64ToInt32)                    \
+  V(Arm64Float32ToUint32)                   \
+  V(Arm64Float64ToUint32)                   \
+  V(Arm64Float32ToInt64)                    \
+  V(Arm64Float64ToInt64)                    \
+  V(Arm64Float32ToUint64)                   \
+  V(Arm64Float64ToUint64)                   \
+  V(Arm64Int32ToFloat32)                    \
+  V(Arm64Int32ToFloat64)                    \
+  V(Arm64Int64ToFloat32)                    \
+  V(Arm64Int64ToFloat64)                    \
+  V(Arm64Uint32ToFloat32)                   \
+  V(Arm64Uint32ToFloat64)                   \
+  V(Arm64Uint64ToFloat32)                   \
+  V(Arm64Uint64ToFloat64)                   \
+  V(Arm64Float64ExtractLowWord32)           \
+  V(Arm64Float64ExtractHighWord32)          \
+  V(Arm64Float64InsertLowWord32)            \
+  V(Arm64Float64InsertHighWord32)           \
+  V(Arm64Float64MoveU64)                    \
+  V(Arm64U64MoveFloat64)                    \
+  V(Arm64LdrS)                              \
+  V(Arm64StrS)                              \
+  V(Arm64LdrD)                              \
+  V(Arm64StrD)                              \
+  V(Arm64LdrQ)                              \
+  V(Arm64StrQ)                              \
+  V(Arm64Ldrb)                              \
+  V(Arm64Ldrsb)                             \
+  V(Arm64Strb)                              \
+  V(Arm64Ldrh)                              \
+  V(Arm64Ldrsh)                             \
+  V(Arm64Strh)                              \
+  V(Arm64Ldrsw)                             \
+  V(Arm64LdrW)                              \
+  V(Arm64StrW)                              \
+  V(Arm64Ldr)                               \
+  V(Arm64Str)                               \
+  V(Arm64DsbIsb)                            \
+  V(Arm64F32x4Splat)                        \
+  V(Arm64F32x4ExtractLane)                  \
+  V(Arm64F32x4ReplaceLane)                  \
+  V(Arm64F32x4SConvertI32x4)                \
+  V(Arm64F32x4UConvertI32x4)                \
+  V(Arm64F32x4Abs)                          \
+  V(Arm64F32x4Neg)                          \
+  V(Arm64F32x4RecipApprox)                  \
+  V(Arm64F32x4RecipSqrtApprox)              \
+  V(Arm64F32x4Add)                          \
+  V(Arm64F32x4AddHoriz)                     \
+  V(Arm64F32x4Sub)                          \
+  V(Arm64F32x4Mul)                          \
+  V(Arm64F32x4Min)                          \
+  V(Arm64F32x4Max)                          \
+  V(Arm64F32x4Eq)                           \
+  V(Arm64F32x4Ne)                           \
+  V(Arm64F32x4Lt)                           \
+  V(Arm64F32x4Le)                           \
+  V(Arm64I32x4Splat)                        \
+  V(Arm64I32x4ExtractLane)                  \
+  V(Arm64I32x4ReplaceLane)                  \
+  V(Arm64I32x4SConvertF32x4)                \
+  V(Arm64I32x4SConvertI16x8Low)             \
+  V(Arm64I32x4SConvertI16x8High)            \
+  V(Arm64I32x4Neg)                          \
+  V(Arm64I32x4Shl)                          \
+  V(Arm64I32x4ShrS)                         \
+  V(Arm64I32x4Add)                          \
+  V(Arm64I32x4AddHoriz)                     \
+  V(Arm64I32x4Sub)                          \
+  V(Arm64I32x4Mul)                          \
+  V(Arm64I32x4MinS)                         \
+  V(Arm64I32x4MaxS)                         \
+  V(Arm64I32x4Eq)                           \
+  V(Arm64I32x4Ne)                           \
+  V(Arm64I32x4GtS)                          \
+  V(Arm64I32x4GeS)                          \
+  V(Arm64I32x4UConvertF32x4)                \
+  V(Arm64I32x4UConvertI16x8Low)             \
+  V(Arm64I32x4UConvertI16x8High)            \
+  V(Arm64I32x4ShrU)                         \
+  V(Arm64I32x4MinU)                         \
+  V(Arm64I32x4MaxU)                         \
+  V(Arm64I32x4GtU)                          \
+  V(Arm64I32x4GeU)                          \
+  V(Arm64I16x8Splat)                        \
+  V(Arm64I16x8ExtractLane)                  \
+  V(Arm64I16x8ReplaceLane)                  \
+  V(Arm64I16x8SConvertI8x16Low)             \
+  V(Arm64I16x8SConvertI8x16High)            \
+  V(Arm64I16x8Neg)                          \
+  V(Arm64I16x8Shl)                          \
+  V(Arm64I16x8ShrS)                         \
+  V(Arm64I16x8SConvertI32x4)                \
+  V(Arm64I16x8Add)                          \
+  V(Arm64I16x8AddSaturateS)                 \
+  V(Arm64I16x8AddHoriz)                     \
+  V(Arm64I16x8Sub)                          \
+  V(Arm64I16x8SubSaturateS)                 \
+  V(Arm64I16x8Mul)                          \
+  V(Arm64I16x8MinS)                         \
+  V(Arm64I16x8MaxS)                         \
+  V(Arm64I16x8Eq)                           \
+  V(Arm64I16x8Ne)                           \
+  V(Arm64I16x8GtS)                          \
+  V(Arm64I16x8GeS)                          \
+  V(Arm64I16x8UConvertI8x16Low)             \
+  V(Arm64I16x8UConvertI8x16High)            \
+  V(Arm64I16x8ShrU)                         \
+  V(Arm64I16x8UConvertI32x4)                \
+  V(Arm64I16x8AddSaturateU)                 \
+  V(Arm64I16x8SubSaturateU)                 \
+  V(Arm64I16x8MinU)                         \
+  V(Arm64I16x8MaxU)                         \
+  V(Arm64I16x8GtU)                          \
+  V(Arm64I16x8GeU)                          \
+  V(Arm64I8x16Splat)                        \
+  V(Arm64I8x16ExtractLane)                  \
+  V(Arm64I8x16ReplaceLane)                  \
+  V(Arm64I8x16Neg)                          \
+  V(Arm64I8x16Shl)                          \
+  V(Arm64I8x16ShrS)                         \
+  V(Arm64I8x16SConvertI16x8)                \
+  V(Arm64I8x16Add)                          \
+  V(Arm64I8x16AddSaturateS)                 \
+  V(Arm64I8x16Sub)                          \
+  V(Arm64I8x16SubSaturateS)                 \
+  V(Arm64I8x16Mul)                          \
+  V(Arm64I8x16MinS)                         \
+  V(Arm64I8x16MaxS)                         \
+  V(Arm64I8x16Eq)                           \
+  V(Arm64I8x16Ne)                           \
+  V(Arm64I8x16GtS)                          \
+  V(Arm64I8x16GeS)                          \
+  V(Arm64I8x16ShrU)                         \
+  V(Arm64I8x16UConvertI16x8)                \
+  V(Arm64I8x16AddSaturateU)                 \
+  V(Arm64I8x16SubSaturateU)                 \
+  V(Arm64I8x16MinU)                         \
+  V(Arm64I8x16MaxU)                         \
+  V(Arm64I8x16GtU)                          \
+  V(Arm64I8x16GeU)                          \
+  V(Arm64S128Zero)                          \
+  V(Arm64S128Dup)                           \
+  V(Arm64S128And)                           \
+  V(Arm64S128Or)                            \
+  V(Arm64S128Xor)                           \
+  V(Arm64S128Not)                           \
+  V(Arm64S128Select)                        \
+  V(Arm64S32x4ZipLeft)                      \
+  V(Arm64S32x4ZipRight)                     \
+  V(Arm64S32x4UnzipLeft)                    \
+  V(Arm64S32x4UnzipRight)                   \
+  V(Arm64S32x4TransposeLeft)                \
+  V(Arm64S32x4TransposeRight)               \
+  V(Arm64S32x4Shuffle)                      \
+  V(Arm64S16x8ZipLeft)                      \
+  V(Arm64S16x8ZipRight)                     \
+  V(Arm64S16x8UnzipLeft)                    \
+  V(Arm64S16x8UnzipRight)                   \
+  V(Arm64S16x8TransposeLeft)                \
+  V(Arm64S16x8TransposeRight)               \
+  V(Arm64S8x16ZipLeft)                      \
+  V(Arm64S8x16ZipRight)                     \
+  V(Arm64S8x16UnzipLeft)                    \
+  V(Arm64S8x16UnzipRight)                   \
+  V(Arm64S8x16TransposeLeft)                \
+  V(Arm64S8x16TransposeRight)               \
+  V(Arm64S8x16Concat)                       \
+  V(Arm64S8x16Shuffle)                      \
+  V(Arm64S32x2Reverse)                      \
+  V(Arm64S16x4Reverse)                      \
+  V(Arm64S16x2Reverse)                      \
+  V(Arm64S8x8Reverse)                       \
+  V(Arm64S8x4Reverse)                       \
+  V(Arm64S8x2Reverse)                       \
+  V(Arm64S1x4AnyTrue)                       \
+  V(Arm64S1x4AllTrue)                       \
+  V(Arm64S1x8AnyTrue)                       \
+  V(Arm64S1x8AllTrue)                       \
+  V(Arm64S1x16AnyTrue)                      \
+  V(Arm64S1x16AllTrue)                      \
+  V(Arm64Word64AtomicLoadUint8)             \
+  V(Arm64Word64AtomicLoadUint16)            \
+  V(Arm64Word64AtomicLoadUint32)            \
+  V(Arm64Word64AtomicLoadUint64)            \
+  V(Arm64Word64AtomicStoreWord8)            \
+  V(Arm64Word64AtomicStoreWord16)           \
+  V(Arm64Word64AtomicStoreWord32)           \
+  V(Arm64Word64AtomicStoreWord64)           \
+  V(Arm64Word64AtomicAddUint8)              \
+  V(Arm64Word64AtomicAddUint16)             \
+  V(Arm64Word64AtomicAddUint32)             \
+  V(Arm64Word64AtomicAddUint64)             \
+  V(Arm64Word64AtomicSubUint8)              \
+  V(Arm64Word64AtomicSubUint16)             \
+  V(Arm64Word64AtomicSubUint32)             \
+  V(Arm64Word64AtomicSubUint64)             \
+  V(Arm64Word64AtomicAndUint8)              \
+  V(Arm64Word64AtomicAndUint16)             \
+  V(Arm64Word64AtomicAndUint32)             \
+  V(Arm64Word64AtomicAndUint64)             \
+  V(Arm64Word64AtomicOrUint8)               \
+  V(Arm64Word64AtomicOrUint16)              \
+  V(Arm64Word64AtomicOrUint32)              \
+  V(Arm64Word64AtomicOrUint64)              \
+  V(Arm64Word64AtomicXorUint8)              \
+  V(Arm64Word64AtomicXorUint16)             \
+  V(Arm64Word64AtomicXorUint32)             \
+  V(Arm64Word64AtomicXorUint64)             \
+  V(Arm64Word64AtomicExchangeUint8)         \
+  V(Arm64Word64AtomicExchangeUint16)        \
+  V(Arm64Word64AtomicExchangeUint32)        \
+  V(Arm64Word64AtomicExchangeUint64)        \
+  V(Arm64Word64AtomicCompareExchangeUint8)  \
+  V(Arm64Word64AtomicCompareExchangeUint16) \
+  V(Arm64Word64AtomicCompareExchangeUint32) \
+  V(Arm64Word64AtomicCompareExchangeUint64)
 
 // Addressing modes represent the "shape" of inputs to an instruction.
 // Many instructions support multiple addressing modes. Addressing modes
@@ -346,7 +362,8 @@ namespace compiler {
   V(Operand2_R_UXTH)  /* %r0 UXTH (unsigned extend halfword) */ \
   V(Operand2_R_SXTB)  /* %r0 SXTB (signed extend byte) */       \
   V(Operand2_R_SXTH)  /* %r0 SXTH (signed extend halfword) */   \
-  V(Operand2_R_SXTW)  /* %r0 SXTW (signed extend word) */
+  V(Operand2_R_SXTW)  /* %r0 SXTW (signed extend word) */       \
+  V(Root)             /* [%rr + K] */
 
 }  // namespace compiler
 }  // namespace internal
diff --git a/deps/v8/src/compiler/arm64/instruction-scheduler-arm64.cc b/deps/v8/src/compiler/arm64/instruction-scheduler-arm64.cc
index 289fe47e09a12c..4ea251c590e2c1 100644
--- a/deps/v8/src/compiler/arm64/instruction-scheduler-arm64.cc
+++ b/deps/v8/src/compiler/arm64/instruction-scheduler-arm64.cc
@@ -309,6 +309,16 @@ int InstructionScheduler::GetTargetInstructionFlags(
     case kArm64DsbIsb:
       return kHasSideEffect;
 
+    case kArm64Word64AtomicLoadUint8:
+    case kArm64Word64AtomicLoadUint16:
+    case kArm64Word64AtomicLoadUint32:
+    case kArm64Word64AtomicLoadUint64:
+      return kIsLoadOperation;
+
+    case kArm64Word64AtomicStoreWord8:
+    case kArm64Word64AtomicStoreWord16:
+    case kArm64Word64AtomicStoreWord32:
+    case kArm64Word64AtomicStoreWord64:
     case kArm64Word64AtomicAddUint8:
     case kArm64Word64AtomicAddUint16:
     case kArm64Word64AtomicAddUint32:
@@ -329,6 +339,14 @@ int InstructionScheduler::GetTargetInstructionFlags(
     case kArm64Word64AtomicXorUint16:
     case kArm64Word64AtomicXorUint32:
     case kArm64Word64AtomicXorUint64:
+    case kArm64Word64AtomicExchangeUint8:
+    case kArm64Word64AtomicExchangeUint16:
+    case kArm64Word64AtomicExchangeUint32:
+    case kArm64Word64AtomicExchangeUint64:
+    case kArm64Word64AtomicCompareExchangeUint8:
+    case kArm64Word64AtomicCompareExchangeUint16:
+    case kArm64Word64AtomicCompareExchangeUint32:
+    case kArm64Word64AtomicCompareExchangeUint64:
       return kHasSideEffect;
 
 #define CASE(Name) case k##Name:
diff --git a/deps/v8/src/compiler/arm64/instruction-selector-arm64.cc b/deps/v8/src/compiler/arm64/instruction-selector-arm64.cc
index 08538cc4e2b169..aaa079b44a90fc 100644
--- a/deps/v8/src/compiler/arm64/instruction-selector-arm64.cc
+++ b/deps/v8/src/compiler/arm64/instruction-selector-arm64.cc
@@ -49,6 +49,16 @@ class Arm64OperandGenerator final : public OperandGenerator {
     return UseRegister(node);
   }
 
+  // Use the stack pointer if the node is LoadStackPointer, otherwise assign a
+  // register.
+  InstructionOperand UseRegisterOrStackPointer(Node* node, bool sp_allowed) {
+    if (sp_allowed && node->opcode() == IrOpcode::kLoadStackPointer)
+      return LocationOperand(LocationOperand::EXPLICIT,
+                             LocationOperand::REGISTER,
+                             MachineRepresentation::kWord64, sp.code());
+    return UseRegister(node);
+  }
+
   // Use the provided node if it has the required value, or create a
   // TempImmediate otherwise.
   InstructionOperand UseImmediateOrTemp(Node* node, int32_t value) {
@@ -550,6 +560,27 @@ void EmitLoad(InstructionSelector* selector, Node* node, InstructionCode opcode,
   // If output is not nullptr, use that as the output register. This
   // is used when we merge a conversion into the load.
   outputs[0] = g.DefineAsRegister(output == nullptr ? node : output);
+
+  if (selector->CanAddressRelativeToRootsRegister()) {
+    ExternalReferenceMatcher m(base);
+    if (m.HasValue() && g.IsIntegerConstant(index)) {
+      ptrdiff_t const delta =
+          g.GetIntegerConstantValue(index) +
+          TurboAssemblerBase::RootRegisterOffsetForExternalReference(
+              selector->isolate(), m.Value());
+      input_count = 1;
+      // Check that the delta is a 32-bit integer due to the limitations of
+      // immediate operands.
+      if (is_int32(delta)) {
+        inputs[0] = g.UseImmediate(static_cast<int32_t>(delta));
+        opcode |= AddressingModeField::encode(kMode_Root);
+        selector->Emit(opcode, arraysize(outputs), outputs, input_count,
+                       inputs);
+        return;
+      }
+    }
+  }
+
   inputs[0] = g.UseRegister(base);
 
   if (g.CanBeImmediate(index, immediate_mode)) {
@@ -612,7 +643,7 @@ void InstructionSelector::VisitLoad(Node* node) {
       return;
   }
   if (node->opcode() == IrOpcode::kPoisonedLoad) {
-    CHECK_EQ(poisoning_enabled_, PoisoningMitigationLevel::kOn);
+    CHECK_NE(poisoning_level_, PoisoningMitigationLevel::kDontPoison);
     opcode |= MiscField::encode(kMemoryAccessPoisoned);
   }
 
@@ -1747,17 +1778,21 @@ void VisitWordCompare(InstructionSelector* selector, Node* node,
   Node* left = node->InputAt(0);
   Node* right = node->InputAt(1);
 
+  if (right->opcode() == IrOpcode::kLoadStackPointer ||
+      g.CanBeImmediate(left, immediate_mode)) {
+    if (!commutative) cont->Commute();
+    std::swap(left, right);
+  }
+
   // Match immediates on left or right side of comparison.
   if (g.CanBeImmediate(right, immediate_mode)) {
-    VisitCompare(selector, opcode, g.UseRegister(left), g.UseImmediate(right),
-                 cont);
-  } else if (g.CanBeImmediate(left, immediate_mode)) {
-    if (!commutative) cont->Commute();
-    VisitCompare(selector, opcode, g.UseRegister(right), g.UseImmediate(left),
-                 cont);
+    VisitCompare(selector, opcode,
+                 g.UseRegisterOrStackPointer(left, opcode == kArm64Cmp),
+                 g.UseImmediate(right), cont);
   } else {
-    VisitCompare(selector, opcode, g.UseRegister(left), g.UseRegister(right),
-                 cont);
+    VisitCompare(selector, opcode,
+                 g.UseRegisterOrStackPointer(left, opcode == kArm64Cmp),
+                 g.UseRegister(right), cont);
   }
 }
 
@@ -2102,6 +2137,82 @@ void VisitFloat64Compare(InstructionSelector* selector, Node* node,
   }
 }
 
+void VisitAtomicExchange(InstructionSelector* selector, Node* node,
+                         ArchOpcode opcode) {
+  Arm64OperandGenerator g(selector);
+  Node* base = node->InputAt(0);
+  Node* index = node->InputAt(1);
+  Node* value = node->InputAt(2);
+  InstructionOperand inputs[] = {g.UseRegister(base), g.UseRegister(index),
+                                 g.UseUniqueRegister(value)};
+  InstructionOperand outputs[] = {g.DefineAsRegister(node)};
+  InstructionOperand temps[] = {g.TempRegister(), g.TempRegister()};
+  InstructionCode code = opcode | AddressingModeField::encode(kMode_MRR);
+  selector->Emit(code, arraysize(outputs), outputs, arraysize(inputs), inputs,
+                 arraysize(temps), temps);
+}
+
+void VisitAtomicCompareExchange(InstructionSelector* selector, Node* node,
+                                ArchOpcode opcode) {
+  Arm64OperandGenerator g(selector);
+  Node* base = node->InputAt(0);
+  Node* index = node->InputAt(1);
+  Node* old_value = node->InputAt(2);
+  Node* new_value = node->InputAt(3);
+  InstructionOperand inputs[] = {g.UseRegister(base), g.UseRegister(index),
+                                 g.UseUniqueRegister(old_value),
+                                 g.UseUniqueRegister(new_value)};
+  InstructionOperand outputs[] = {g.DefineAsRegister(node)};
+  InstructionOperand temps[] = {g.TempRegister(), g.TempRegister()};
+  InstructionCode code = opcode | AddressingModeField::encode(kMode_MRR);
+  selector->Emit(code, arraysize(outputs), outputs, arraysize(inputs), inputs,
+                 arraysize(temps), temps);
+}
+
+void VisitAtomicLoad(InstructionSelector* selector, Node* node,
+                     ArchOpcode opcode) {
+  Arm64OperandGenerator g(selector);
+  Node* base = node->InputAt(0);
+  Node* index = node->InputAt(1);
+  InstructionOperand inputs[] = {g.UseRegister(base), g.UseRegister(index)};
+  InstructionOperand outputs[] = {g.DefineAsRegister(node)};
+  InstructionOperand temps[] = {g.TempRegister()};
+  InstructionCode code = opcode | AddressingModeField::encode(kMode_MRR);
+  selector->Emit(code, arraysize(outputs), outputs, arraysize(inputs), inputs,
+                 arraysize(temps), temps);
+}
+
+void VisitAtomicStore(InstructionSelector* selector, Node* node,
+                      ArchOpcode opcode) {
+  Arm64OperandGenerator g(selector);
+  Node* base = node->InputAt(0);
+  Node* index = node->InputAt(1);
+  Node* value = node->InputAt(2);
+  InstructionOperand inputs[] = {g.UseRegister(base), g.UseRegister(index),
+                                 g.UseUniqueRegister(value)};
+  InstructionOperand temps[] = {g.TempRegister()};
+  InstructionCode code = opcode | AddressingModeField::encode(kMode_MRR);
+  selector->Emit(code, 0, nullptr, arraysize(inputs), inputs, arraysize(temps),
+                 temps);
+}
+
+void VisitAtomicBinop(InstructionSelector* selector, Node* node,
+                      ArchOpcode opcode) {
+  Arm64OperandGenerator g(selector);
+  Node* base = node->InputAt(0);
+  Node* index = node->InputAt(1);
+  Node* value = node->InputAt(2);
+  AddressingMode addressing_mode = kMode_MRR;
+  InstructionOperand inputs[] = {g.UseRegister(base), g.UseRegister(index),
+                                 g.UseUniqueRegister(value)};
+  InstructionOperand outputs[] = {g.DefineAsRegister(node)};
+  InstructionOperand temps[] = {g.TempRegister(), g.TempRegister(),
+                                g.TempRegister()};
+  InstructionCode code = opcode | AddressingModeField::encode(addressing_mode);
+  selector->Emit(code, arraysize(outputs), outputs, arraysize(inputs), inputs,
+                 arraysize(temps), temps);
+}
+
 }  // namespace
 
 void InstructionSelector::VisitWordCompareZero(Node* user, Node* value,
@@ -2298,11 +2409,10 @@ void InstructionSelector::VisitSwitch(Node* node, const SwitchInfo& sw) {
     }
   }
 
-  // Generate a sequence of conditional jumps.
-  return EmitLookupSwitch(sw, value_operand);
+  // Generate a tree of conditional jumps.
+  return EmitBinarySearchSwitch(sw, value_operand);
 }
 
-
 void InstructionSelector::VisitWord32Equal(Node* const node) {
   Node* const user = node;
   FlagsContinuation cont = FlagsContinuation::ForSet(kEqual, node);
@@ -2544,9 +2654,6 @@ void InstructionSelector::VisitFloat64InsertHighWord32(Node* node) {
 
 void InstructionSelector::VisitWord32AtomicLoad(Node* node) {
   LoadRepresentation load_rep = LoadRepresentationOf(node->op());
-  Arm64OperandGenerator g(this);
-  Node* base = node->InputAt(0);
-  Node* index = node->InputAt(1);
   ArchOpcode opcode = kArchNop;
   switch (load_rep.representation()) {
     case MachineRepresentation::kWord8:
@@ -2564,20 +2671,34 @@ void InstructionSelector::VisitWord32AtomicLoad(Node* node) {
       UNREACHABLE();
       return;
   }
-  InstructionOperand inputs[] = {g.UseRegister(base), g.UseRegister(index)};
-  InstructionOperand outputs[] = {g.DefineAsRegister(node)};
-  InstructionOperand temps[] = {g.TempRegister()};
-  InstructionCode code = opcode | AddressingModeField::encode(kMode_MRR);
-  Emit(code, arraysize(outputs), outputs, arraysize(inputs), inputs,
-       arraysize(temps), temps);
+  VisitAtomicLoad(this, node, opcode);
+}
+
+void InstructionSelector::VisitWord64AtomicLoad(Node* node) {
+  LoadRepresentation load_rep = LoadRepresentationOf(node->op());
+  ArchOpcode opcode = kArchNop;
+  switch (load_rep.representation()) {
+    case MachineRepresentation::kWord8:
+      opcode = kArm64Word64AtomicLoadUint8;
+      break;
+    case MachineRepresentation::kWord16:
+      opcode = kArm64Word64AtomicLoadUint16;
+      break;
+    case MachineRepresentation::kWord32:
+      opcode = kArm64Word64AtomicLoadUint32;
+      break;
+    case MachineRepresentation::kWord64:
+      opcode = kArm64Word64AtomicLoadUint64;
+      break;
+    default:
+      UNREACHABLE();
+      return;
+  }
+  VisitAtomicLoad(this, node, opcode);
 }
 
 void InstructionSelector::VisitWord32AtomicStore(Node* node) {
   MachineRepresentation rep = AtomicStoreRepresentationOf(node->op());
-  Arm64OperandGenerator g(this);
-  Node* base = node->InputAt(0);
-  Node* index = node->InputAt(1);
-  Node* value = node->InputAt(2);
   ArchOpcode opcode = kArchNop;
   switch (rep) {
     case MachineRepresentation::kWord8:
@@ -2593,23 +2714,33 @@ void InstructionSelector::VisitWord32AtomicStore(Node* node) {
       UNREACHABLE();
       return;
   }
+  VisitAtomicStore(this, node, opcode);
+}
 
-  AddressingMode addressing_mode = kMode_MRR;
-  InstructionOperand inputs[3];
-  size_t input_count = 0;
-  inputs[input_count++] = g.UseUniqueRegister(base);
-  inputs[input_count++] = g.UseUniqueRegister(index);
-  inputs[input_count++] = g.UseUniqueRegister(value);
-  InstructionCode code = opcode | AddressingModeField::encode(addressing_mode);
-  InstructionOperand temps[] = {g.TempRegister()};
-  Emit(code, 0, nullptr, input_count, inputs, arraysize(temps), temps);
+void InstructionSelector::VisitWord64AtomicStore(Node* node) {
+  MachineRepresentation rep = AtomicStoreRepresentationOf(node->op());
+  ArchOpcode opcode = kArchNop;
+  switch (rep) {
+    case MachineRepresentation::kWord8:
+      opcode = kArm64Word64AtomicStoreWord8;
+      break;
+    case MachineRepresentation::kWord16:
+      opcode = kArm64Word64AtomicStoreWord16;
+      break;
+    case MachineRepresentation::kWord32:
+      opcode = kArm64Word64AtomicStoreWord32;
+      break;
+    case MachineRepresentation::kWord64:
+      opcode = kArm64Word64AtomicStoreWord64;
+      break;
+    default:
+      UNREACHABLE();
+      return;
+  }
+  VisitAtomicStore(this, node, opcode);
 }
 
 void InstructionSelector::VisitWord32AtomicExchange(Node* node) {
-  Arm64OperandGenerator g(this);
-  Node* base = node->InputAt(0);
-  Node* index = node->InputAt(1);
-  Node* value = node->InputAt(2);
   ArchOpcode opcode = kArchNop;
   MachineType type = AtomicOpRepresentationOf(node->op());
   if (type == MachineType::Int8()) {
@@ -2626,26 +2757,28 @@ void InstructionSelector::VisitWord32AtomicExchange(Node* node) {
     UNREACHABLE();
     return;
   }
+  VisitAtomicExchange(this, node, opcode);
+}
 
-  AddressingMode addressing_mode = kMode_MRR;
-  InstructionOperand inputs[3];
-  size_t input_count = 0;
-  inputs[input_count++] = g.UseRegister(base);
-  inputs[input_count++] = g.UseRegister(index);
-  inputs[input_count++] = g.UseUniqueRegister(value);
-  InstructionOperand outputs[1];
-  outputs[0] = g.DefineAsRegister(node);
-  InstructionOperand temps[] = {g.TempRegister(), g.TempRegister()};
-  InstructionCode code = opcode | AddressingModeField::encode(addressing_mode);
-  Emit(code, 1, outputs, input_count, inputs, arraysize(temps), temps);
+void InstructionSelector::VisitWord64AtomicExchange(Node* node) {
+  ArchOpcode opcode = kArchNop;
+  MachineType type = AtomicOpRepresentationOf(node->op());
+  if (type == MachineType::Uint8()) {
+    opcode = kArm64Word64AtomicExchangeUint8;
+  } else if (type == MachineType::Uint16()) {
+    opcode = kArm64Word64AtomicExchangeUint16;
+  } else if (type == MachineType::Uint32()) {
+    opcode = kArm64Word64AtomicExchangeUint32;
+  } else if (type == MachineType::Uint64()) {
+    opcode = kArm64Word64AtomicExchangeUint64;
+  } else {
+    UNREACHABLE();
+    return;
+  }
+  VisitAtomicExchange(this, node, opcode);
 }
 
 void InstructionSelector::VisitWord32AtomicCompareExchange(Node* node) {
-  Arm64OperandGenerator g(this);
-  Node* base = node->InputAt(0);
-  Node* index = node->InputAt(1);
-  Node* old_value = node->InputAt(2);
-  Node* new_value = node->InputAt(3);
   ArchOpcode opcode = kArchNop;
   MachineType type = AtomicOpRepresentationOf(node->op());
   if (type == MachineType::Int8()) {
@@ -2662,28 +2795,30 @@ void InstructionSelector::VisitWord32AtomicCompareExchange(Node* node) {
     UNREACHABLE();
     return;
   }
+  VisitAtomicCompareExchange(this, node, opcode);
+}
 
-  AddressingMode addressing_mode = kMode_MRR;
-  InstructionOperand inputs[4];
-  size_t input_count = 0;
-  inputs[input_count++] = g.UseRegister(base);
-  inputs[input_count++] = g.UseRegister(index);
-  inputs[input_count++] = g.UseUniqueRegister(old_value);
-  inputs[input_count++] = g.UseUniqueRegister(new_value);
-  InstructionOperand outputs[1];
-  outputs[0] = g.DefineAsRegister(node);
-  InstructionOperand temps[] = {g.TempRegister(), g.TempRegister()};
-  InstructionCode code = opcode | AddressingModeField::encode(addressing_mode);
-  Emit(code, 1, outputs, input_count, inputs, arraysize(temps), temps);
+void InstructionSelector::VisitWord64AtomicCompareExchange(Node* node) {
+  ArchOpcode opcode = kArchNop;
+  MachineType type = AtomicOpRepresentationOf(node->op());
+  if (type == MachineType::Uint8()) {
+    opcode = kArm64Word64AtomicCompareExchangeUint8;
+  } else if (type == MachineType::Uint16()) {
+    opcode = kArm64Word64AtomicCompareExchangeUint16;
+  } else if (type == MachineType::Uint32()) {
+    opcode = kArm64Word64AtomicCompareExchangeUint32;
+  } else if (type == MachineType::Uint64()) {
+    opcode = kArm64Word64AtomicCompareExchangeUint64;
+  } else {
+    UNREACHABLE();
+    return;
+  }
+  VisitAtomicCompareExchange(this, node, opcode);
 }
 
-void InstructionSelector::VisitAtomicBinaryOperation(
+void InstructionSelector::VisitWord32AtomicBinaryOperation(
     Node* node, ArchOpcode int8_op, ArchOpcode uint8_op, ArchOpcode int16_op,
     ArchOpcode uint16_op, ArchOpcode word32_op) {
-  Arm64OperandGenerator g(this);
-  Node* base = node->InputAt(0);
-  Node* index = node->InputAt(1);
-  Node* value = node->InputAt(2);
   ArchOpcode opcode = kArchNop;
   MachineType type = AtomicOpRepresentationOf(node->op());
   if (type == MachineType::Int8()) {
@@ -2700,24 +2835,12 @@ void InstructionSelector::VisitAtomicBinaryOperation(
     UNREACHABLE();
     return;
   }
-
-  AddressingMode addressing_mode = kMode_MRR;
-  InstructionOperand inputs[3];
-  size_t input_count = 0;
-  inputs[input_count++] = g.UseRegister(base);
-  inputs[input_count++] = g.UseRegister(index);
-  inputs[input_count++] = g.UseUniqueRegister(value);
-  InstructionOperand outputs[1];
-  outputs[0] = g.DefineAsRegister(node);
-  InstructionOperand temps[] = {g.TempRegister(), g.TempRegister(),
-                                g.TempRegister()};
-  InstructionCode code = opcode | AddressingModeField::encode(addressing_mode);
-  Emit(code, 1, outputs, input_count, inputs, arraysize(temps), temps);
+  VisitAtomicBinop(this, node, opcode);
 }
 
 #define VISIT_ATOMIC_BINOP(op)                                   \
   void InstructionSelector::VisitWord32Atomic##op(Node* node) {  \
-    VisitAtomicBinaryOperation(                                  \
+    VisitWord32AtomicBinaryOperation(                            \
         node, kWord32Atomic##op##Int8, kWord32Atomic##op##Uint8, \
         kWord32Atomic##op##Int16, kWord32Atomic##op##Uint16,     \
         kWord32Atomic##op##Word32);                              \
@@ -2732,10 +2855,6 @@ VISIT_ATOMIC_BINOP(Xor)
 void InstructionSelector::VisitWord64AtomicBinaryOperation(
     Node* node, ArchOpcode uint8_op, ArchOpcode uint16_op, ArchOpcode uint32_op,
     ArchOpcode uint64_op) {
-  Arm64OperandGenerator g(this);
-  Node* base = node->InputAt(0);
-  Node* index = node->InputAt(1);
-  Node* value = node->InputAt(2);
   ArchOpcode opcode = kArchNop;
   MachineType type = AtomicOpRepresentationOf(node->op());
   if (type == MachineType::Uint8()) {
@@ -2750,19 +2869,7 @@ void InstructionSelector::VisitWord64AtomicBinaryOperation(
     UNREACHABLE();
     return;
   }
-
-  AddressingMode addressing_mode = kMode_MRR;
-  InstructionOperand inputs[3];
-  size_t input_count = 0;
-  inputs[input_count++] = g.UseRegister(base);
-  inputs[input_count++] = g.UseRegister(index);
-  inputs[input_count++] = g.UseUniqueRegister(value);
-  InstructionOperand outputs[1];
-  outputs[0] = g.DefineAsRegister(node);
-  InstructionOperand temps[] = {g.TempRegister(), g.TempRegister(),
-                                g.TempRegister()};
-  InstructionCode code = opcode | AddressingModeField::encode(addressing_mode);
-  Emit(code, 1, outputs, input_count, inputs, arraysize(temps), temps);
+  VisitAtomicBinop(this, node, opcode);
 }
 
 #define VISIT_ATOMIC_BINOP(op)                                               \
@@ -3015,7 +3122,9 @@ static const ShuffleEntry arch_shuffles[] = {
      kArm64S8x2Reverse}};
 
 bool TryMatchArchShuffle(const uint8_t* shuffle, const ShuffleEntry* table,
-                         size_t num_entries, uint8_t mask, ArchOpcode* opcode) {
+                         size_t num_entries, bool is_swizzle,
+                         ArchOpcode* opcode) {
+  uint8_t mask = is_swizzle ? kSimd128Size - 1 : 2 * kSimd128Size - 1;
   for (size_t i = 0; i < num_entries; i++) {
     const ShuffleEntry& entry = table[i];
     int j = 0;
@@ -3047,60 +3156,57 @@ void ArrangeShuffleTable(Arm64OperandGenerator* g, Node* input0, Node* input1,
 }  // namespace
 
 void InstructionSelector::VisitS8x16Shuffle(Node* node) {
-  const uint8_t* shuffle = OpParameter<uint8_t*>(node->op());
-  uint8_t mask = CanonicalizeShuffle(node);
+  uint8_t shuffle[kSimd128Size];
+  bool is_swizzle;
+  CanonicalizeShuffle(node, shuffle, &is_swizzle);
   uint8_t shuffle32x4[4];
   Arm64OperandGenerator g(this);
   ArchOpcode opcode;
   if (TryMatchArchShuffle(shuffle, arch_shuffles, arraysize(arch_shuffles),
-                          mask, &opcode)) {
+                          is_swizzle, &opcode)) {
     VisitRRR(this, opcode, node);
     return;
   }
   Node* input0 = node->InputAt(0);
   Node* input1 = node->InputAt(1);
-  uint8_t bias;
-  if (TryMatchConcat(shuffle, mask, &bias)) {
+  uint8_t offset;
+  if (TryMatchConcat(shuffle, &offset)) {
     Emit(kArm64S8x16Concat, g.DefineAsRegister(node), g.UseRegister(input0),
-         g.UseRegister(input1), g.UseImmediate(bias));
+         g.UseRegister(input1), g.UseImmediate(offset));
     return;
   }
   int index = 0;
   if (TryMatch32x4Shuffle(shuffle, shuffle32x4)) {
     if (TryMatchDup<4>(shuffle, &index)) {
-      InstructionOperand src = index < 4 ? g.UseRegister(node->InputAt(0))
-                                         : g.UseRegister(node->InputAt(1));
-      Emit(kArm64S128Dup, g.DefineAsRegister(node), src, g.UseImmediate(4),
-           g.UseImmediate(index % 4));
+      DCHECK_GT(4, index);
+      Emit(kArm64S128Dup, g.DefineAsRegister(node), g.UseRegister(input0),
+           g.UseImmediate(4), g.UseImmediate(index % 4));
     } else {
-      Emit(kArm64S32x4Shuffle, g.DefineAsRegister(node),
-           g.UseRegister(node->InputAt(0)), g.UseRegister(node->InputAt(1)),
-           g.UseImmediate(Pack4Lanes(shuffle32x4, mask)));
+      Emit(kArm64S32x4Shuffle, g.DefineAsRegister(node), g.UseRegister(input0),
+           g.UseRegister(input1), g.UseImmediate(Pack4Lanes(shuffle32x4)));
     }
     return;
   }
   if (TryMatchDup<8>(shuffle, &index)) {
-    InstructionOperand src = index < 8 ? g.UseRegister(node->InputAt(0))
-                                       : g.UseRegister(node->InputAt(1));
-    Emit(kArm64S128Dup, g.DefineAsRegister(node), src, g.UseImmediate(8),
-         g.UseImmediate(index % 8));
+    DCHECK_GT(8, index);
+    Emit(kArm64S128Dup, g.DefineAsRegister(node), g.UseRegister(input0),
+         g.UseImmediate(8), g.UseImmediate(index % 8));
     return;
   }
   if (TryMatchDup<16>(shuffle, &index)) {
-    InstructionOperand src = index < 16 ? g.UseRegister(node->InputAt(0))
-                                        : g.UseRegister(node->InputAt(1));
-    Emit(kArm64S128Dup, g.DefineAsRegister(node), src, g.UseImmediate(16),
-         g.UseImmediate(index % 16));
+    DCHECK_GT(16, index);
+    Emit(kArm64S128Dup, g.DefineAsRegister(node), g.UseRegister(input0),
+         g.UseImmediate(16), g.UseImmediate(index % 16));
     return;
   }
   // Code generator uses vtbl, arrange sources to form a valid lookup table.
   InstructionOperand src0, src1;
   ArrangeShuffleTable(&g, input0, input1, &src0, &src1);
   Emit(kArm64S8x16Shuffle, g.DefineAsRegister(node), src0, src1,
-       g.UseImmediate(Pack4Lanes(shuffle, mask)),
-       g.UseImmediate(Pack4Lanes(shuffle + 4, mask)),
-       g.UseImmediate(Pack4Lanes(shuffle + 8, mask)),
-       g.UseImmediate(Pack4Lanes(shuffle + 12, mask)));
+       g.UseImmediate(Pack4Lanes(shuffle)),
+       g.UseImmediate(Pack4Lanes(shuffle + 4)),
+       g.UseImmediate(Pack4Lanes(shuffle + 8)),
+       g.UseImmediate(Pack4Lanes(shuffle + 12)));
 }
 
 void InstructionSelector::VisitSignExtendWord8ToInt32(Node* node) {
diff --git a/deps/v8/src/compiler/branch-elimination.cc b/deps/v8/src/compiler/branch-elimination.cc
index 3d71e98a120964..741de6f26493c7 100644
--- a/deps/v8/src/compiler/branch-elimination.cc
+++ b/deps/v8/src/compiler/branch-elimination.cc
@@ -61,12 +61,16 @@ Reduction BranchElimination::ReduceBranch(Node* node) {
   bool condition_value;
   // If we know the condition we can discard the branch.
   if (from_input.LookupCondition(condition, &branch, &condition_value)) {
-    // Mark the branch as a safety check.
+    // Mark the branch as a safety check if necessary.
     // Check if {branch} is dead because we might have a stale side-table entry.
-    if (IsSafetyCheckOf(node->op()) == IsSafetyCheck::kSafetyCheck &&
-        !branch->IsDead()) {
-      NodeProperties::ChangeOp(branch,
-                               common()->MarkAsSafetyCheck(branch->op()));
+    if (!branch->IsDead()) {
+      IsSafetyCheck branch_safety = IsSafetyCheckOf(branch->op());
+      IsSafetyCheck combined_safety =
+          CombineSafetyChecks(branch_safety, IsSafetyCheckOf(node->op()));
+      if (branch_safety != combined_safety) {
+        NodeProperties::ChangeOp(
+            branch, common()->MarkAsSafetyCheck(branch->op(), combined_safety));
+      }
     }
 
     for (Node* const use : node->uses()) {
@@ -107,9 +111,12 @@ Reduction BranchElimination::ReduceDeoptimizeConditional(Node* node) {
   Node* branch;
   if (conditions.LookupCondition(condition, &branch, &condition_value)) {
     // Mark the branch as a safety check.
-    if (p.is_safety_check() == IsSafetyCheck::kSafetyCheck) {
-      NodeProperties::ChangeOp(branch,
-                               common()->MarkAsSafetyCheck(branch->op()));
+    IsSafetyCheck branch_safety = IsSafetyCheckOf(branch->op());
+    IsSafetyCheck combined_safety =
+        CombineSafetyChecks(branch_safety, p.is_safety_check());
+    if (branch_safety != combined_safety) {
+      NodeProperties::ChangeOp(
+          branch, common()->MarkAsSafetyCheck(branch->op(), combined_safety));
     }
 
     // If we know the condition we can discard the branch.
@@ -240,13 +247,15 @@ bool BranchElimination::ControlPathConditions::LookupCondition(
     }
   }
   return false;
-  }
+}
 
-  Graph* BranchElimination::graph() const { return jsgraph()->graph(); }
+Graph* BranchElimination::graph() const { return jsgraph()->graph(); }
 
-  CommonOperatorBuilder* BranchElimination::common() const {
-    return jsgraph()->common();
-  }
+Isolate* BranchElimination::isolate() const { return jsgraph()->isolate(); }
+
+CommonOperatorBuilder* BranchElimination::common() const {
+  return jsgraph()->common();
+}
 
 }  // namespace compiler
 }  // namespace internal
diff --git a/deps/v8/src/compiler/branch-elimination.h b/deps/v8/src/compiler/branch-elimination.h
index de3b9e5b2ead4d..23881ebd0a7c79 100644
--- a/deps/v8/src/compiler/branch-elimination.h
+++ b/deps/v8/src/compiler/branch-elimination.h
@@ -72,6 +72,7 @@ class V8_EXPORT_PRIVATE BranchElimination final
   Node* dead() const { return dead_; }
   Graph* graph() const;
   JSGraph* jsgraph() const { return jsgraph_; }
+  Isolate* isolate() const;
   CommonOperatorBuilder* common() const;
 
   JSGraph* const jsgraph_;
diff --git a/deps/v8/src/compiler/bytecode-graph-builder.cc b/deps/v8/src/compiler/bytecode-graph-builder.cc
index 76c3978f60ce11..2d16ba525c45e6 100644
--- a/deps/v8/src/compiler/bytecode-graph-builder.cc
+++ b/deps/v8/src/compiler/bytecode-graph-builder.cc
@@ -14,7 +14,7 @@
 #include "src/compiler/simplified-operator.h"
 #include "src/interpreter/bytecodes.h"
 #include "src/objects-inl.h"
-#include "src/objects/literal-objects.h"
+#include "src/objects/literal-objects-inl.h"
 #include "src/vector-slot-pair.h"
 
 namespace v8 {
@@ -521,7 +521,8 @@ BytecodeGraphBuilder::BytecodeGraphBuilder(
     : local_zone_(local_zone),
       jsgraph_(jsgraph),
       invocation_frequency_(invocation_frequency),
-      bytecode_array_(handle(shared_info->GetBytecodeArray())),
+      bytecode_array_(
+          handle(shared_info->GetBytecodeArray(), jsgraph->isolate())),
       feedback_vector_(feedback_vector),
       type_hint_lowering_(jsgraph, feedback_vector, flags),
       frame_state_function_info_(common()->CreateFrameStateFunctionInfo(
@@ -878,11 +879,10 @@ void BytecodeGraphBuilder::VisitBytecodes() {
   interpreter::BytecodeArrayIterator iterator(bytecode_array());
   set_bytecode_iterator(&iterator);
   SourcePositionTableIterator source_position_iterator(
-      handle(bytecode_array()->SourcePositionTable()));
+      handle(bytecode_array()->SourcePositionTable(), isolate()));
 
   if (analyze_environment_liveness() && FLAG_trace_environment_liveness) {
-    OFStream of(stdout);
-
+    StdoutStream of;
     bytecode_analysis.PrintLivenessTo(of);
   }
 
@@ -918,8 +918,8 @@ void BytecodeGraphBuilder::VisitLdaSmi() {
 }
 
 void BytecodeGraphBuilder::VisitLdaConstant() {
-  Node* node =
-      jsgraph()->Constant(bytecode_iterator().GetConstantForIndexOperand(0));
+  Node* node = jsgraph()->Constant(
+      handle(bytecode_iterator().GetConstantForIndexOperand(0), isolate()));
   environment()->BindAccumulator(node);
 }
 
@@ -976,8 +976,8 @@ Node* BytecodeGraphBuilder::BuildLoadGlobal(Handle<Name> name,
 
 void BytecodeGraphBuilder::VisitLdaGlobal() {
   PrepareEagerCheckpoint();
-  Handle<Name> name =
-      Handle<Name>::cast(bytecode_iterator().GetConstantForIndexOperand(0));
+  Handle<Name> name(
+      Name::cast(bytecode_iterator().GetConstantForIndexOperand(0)), isolate());
   uint32_t feedback_slot_index = bytecode_iterator().GetIndexOperand(1);
   Node* node =
       BuildLoadGlobal(name, feedback_slot_index, TypeofMode::NOT_INSIDE_TYPEOF);
@@ -986,8 +986,8 @@ void BytecodeGraphBuilder::VisitLdaGlobal() {
 
 void BytecodeGraphBuilder::VisitLdaGlobalInsideTypeof() {
   PrepareEagerCheckpoint();
-  Handle<Name> name =
-      Handle<Name>::cast(bytecode_iterator().GetConstantForIndexOperand(0));
+  Handle<Name> name(
+      Name::cast(bytecode_iterator().GetConstantForIndexOperand(0)), isolate());
   uint32_t feedback_slot_index = bytecode_iterator().GetIndexOperand(1);
   Node* node =
       BuildLoadGlobal(name, feedback_slot_index, TypeofMode::INSIDE_TYPEOF);
@@ -996,8 +996,8 @@ void BytecodeGraphBuilder::VisitLdaGlobalInsideTypeof() {
 
 void BytecodeGraphBuilder::VisitStaGlobal() {
   PrepareEagerCheckpoint();
-  Handle<Name> name =
-      Handle<Name>::cast(bytecode_iterator().GetConstantForIndexOperand(0));
+  Handle<Name> name(
+      Name::cast(bytecode_iterator().GetConstantForIndexOperand(0)), isolate());
   VectorSlotPair feedback =
       CreateVectorSlotPair(bytecode_iterator().GetIndexOperand(1));
   Node* value = environment()->LookupAccumulator();
@@ -1122,8 +1122,8 @@ void BytecodeGraphBuilder::VisitStaCurrentContextSlot() {
 
 void BytecodeGraphBuilder::BuildLdaLookupSlot(TypeofMode typeof_mode) {
   PrepareEagerCheckpoint();
-  Node* name =
-      jsgraph()->Constant(bytecode_iterator().GetConstantForIndexOperand(0));
+  Node* name = jsgraph()->Constant(
+      handle(bytecode_iterator().GetConstantForIndexOperand(0), isolate()));
   const Operator* op =
       javascript()->CallRuntime(typeof_mode == TypeofMode::NOT_INSIDE_TYPEOF
                                     ? Runtime::kLoadLookupSlot
@@ -1208,7 +1208,7 @@ void BytecodeGraphBuilder::BuildLdaLookupContextSlot(TypeofMode typeof_mode) {
     set_environment(slow_environment);
     {
       Node* name = jsgraph()->Constant(
-          bytecode_iterator().GetConstantForIndexOperand(0));
+          handle(bytecode_iterator().GetConstantForIndexOperand(0), isolate()));
 
       const Operator* op =
           javascript()->CallRuntime(typeof_mode == TypeofMode::NOT_INSIDE_TYPEOF
@@ -1243,8 +1243,9 @@ void BytecodeGraphBuilder::BuildLdaLookupGlobalSlot(TypeofMode typeof_mode) {
   // Fast path, do a global load.
   {
     PrepareEagerCheckpoint();
-    Handle<Name> name =
-        Handle<Name>::cast(bytecode_iterator().GetConstantForIndexOperand(0));
+    Handle<Name> name(
+        Name::cast(bytecode_iterator().GetConstantForIndexOperand(0)),
+        isolate());
     uint32_t feedback_slot_index = bytecode_iterator().GetIndexOperand(1);
     Node* node = BuildLoadGlobal(name, feedback_slot_index, typeof_mode);
     environment()->BindAccumulator(node, Environment::kAttachFrameState);
@@ -1260,7 +1261,7 @@ void BytecodeGraphBuilder::BuildLdaLookupGlobalSlot(TypeofMode typeof_mode) {
     set_environment(slow_environment);
     {
       Node* name = jsgraph()->Constant(
-          bytecode_iterator().GetConstantForIndexOperand(0));
+          handle(bytecode_iterator().GetConstantForIndexOperand(0), isolate()));
 
       const Operator* op =
           javascript()->CallRuntime(typeof_mode == TypeofMode::NOT_INSIDE_TYPEOF
@@ -1289,8 +1290,8 @@ void BytecodeGraphBuilder::VisitLdaLookupGlobalSlotInsideTypeof() {
 void BytecodeGraphBuilder::VisitStaLookupSlot() {
   PrepareEagerCheckpoint();
   Node* value = environment()->LookupAccumulator();
-  Node* name =
-      jsgraph()->Constant(bytecode_iterator().GetConstantForIndexOperand(0));
+  Node* name = jsgraph()->Constant(
+      handle(bytecode_iterator().GetConstantForIndexOperand(0), isolate()));
   int bytecode_flags = bytecode_iterator().GetFlagOperand(1);
   LanguageMode language_mode = static_cast<LanguageMode>(
       interpreter::StoreLookupSlotFlags::LanguageModeBit::decode(
@@ -1314,8 +1315,8 @@ void BytecodeGraphBuilder::VisitLdaNamedProperty() {
   PrepareEagerCheckpoint();
   Node* object =
       environment()->LookupRegister(bytecode_iterator().GetRegisterOperand(0));
-  Handle<Name> name =
-      Handle<Name>::cast(bytecode_iterator().GetConstantForIndexOperand(1));
+  Handle<Name> name(
+      Name::cast(bytecode_iterator().GetConstantForIndexOperand(1)), isolate());
   VectorSlotPair feedback =
       CreateVectorSlotPair(bytecode_iterator().GetIndexOperand(2));
   const Operator* op = javascript()->LoadNamed(name, feedback);
@@ -1362,8 +1363,8 @@ void BytecodeGraphBuilder::BuildNamedStore(StoreMode store_mode) {
   Node* value = environment()->LookupAccumulator();
   Node* object =
       environment()->LookupRegister(bytecode_iterator().GetRegisterOperand(0));
-  Handle<Name> name =
-      Handle<Name>::cast(bytecode_iterator().GetConstantForIndexOperand(1));
+  Handle<Name> name(
+      Name::cast(bytecode_iterator().GetConstantForIndexOperand(1)), isolate());
   VectorSlotPair feedback =
       CreateVectorSlotPair(bytecode_iterator().GetIndexOperand(2));
 
@@ -1461,8 +1462,10 @@ void BytecodeGraphBuilder::VisitPopContext() {
 }
 
 void BytecodeGraphBuilder::VisitCreateClosure() {
-  Handle<SharedFunctionInfo> shared_info = Handle<SharedFunctionInfo>::cast(
-      bytecode_iterator().GetConstantForIndexOperand(0));
+  Handle<SharedFunctionInfo> shared_info(
+      SharedFunctionInfo::cast(
+          bytecode_iterator().GetConstantForIndexOperand(0)),
+      isolate());
   FeedbackSlot slot = bytecode_iterator().GetSlotOperand(1);
   FeedbackNexus nexus(feedback_vector(), slot);
   PretenureFlag tenured =
@@ -1472,58 +1475,66 @@ void BytecodeGraphBuilder::VisitCreateClosure() {
           : NOT_TENURED;
   const Operator* op = javascript()->CreateClosure(
       shared_info, nexus.GetFeedbackCell(),
-      handle(jsgraph()->isolate()->builtins()->builtin(Builtins::kCompileLazy)),
+      handle(jsgraph()->isolate()->builtins()->builtin(Builtins::kCompileLazy),
+             isolate()),
       tenured);
   Node* closure = NewNode(op);
   environment()->BindAccumulator(closure);
 }
 
 void BytecodeGraphBuilder::VisitCreateBlockContext() {
-  Handle<ScopeInfo> scope_info = Handle<ScopeInfo>::cast(
-      bytecode_iterator().GetConstantForIndexOperand(0));
+  Handle<ScopeInfo> scope_info(
+      ScopeInfo::cast(bytecode_iterator().GetConstantForIndexOperand(0)),
+      isolate());
 
   const Operator* op = javascript()->CreateBlockContext(scope_info);
-  Node* context = NewNode(op, environment()->LookupAccumulator());
+  Node* context = NewNode(op);
   environment()->BindAccumulator(context);
 }
 
 void BytecodeGraphBuilder::VisitCreateFunctionContext() {
-  uint32_t slots = bytecode_iterator().GetUnsignedImmediateOperand(0);
+  Handle<ScopeInfo> scope_info(
+      ScopeInfo::cast(bytecode_iterator().GetConstantForIndexOperand(0)),
+      isolate());
+  uint32_t slots = bytecode_iterator().GetUnsignedImmediateOperand(1);
   const Operator* op =
-      javascript()->CreateFunctionContext(slots, FUNCTION_SCOPE);
-  Node* context = NewNode(op, GetFunctionClosure());
+      javascript()->CreateFunctionContext(scope_info, slots, FUNCTION_SCOPE);
+  Node* context = NewNode(op);
   environment()->BindAccumulator(context);
 }
 
 void BytecodeGraphBuilder::VisitCreateEvalContext() {
-  uint32_t slots = bytecode_iterator().GetUnsignedImmediateOperand(0);
-  const Operator* op = javascript()->CreateFunctionContext(slots, EVAL_SCOPE);
-  Node* context = NewNode(op, GetFunctionClosure());
+  Handle<ScopeInfo> scope_info(
+      ScopeInfo::cast(bytecode_iterator().GetConstantForIndexOperand(0)),
+      isolate());
+  uint32_t slots = bytecode_iterator().GetUnsignedImmediateOperand(1);
+  const Operator* op =
+      javascript()->CreateFunctionContext(scope_info, slots, EVAL_SCOPE);
+  Node* context = NewNode(op);
   environment()->BindAccumulator(context);
 }
 
 void BytecodeGraphBuilder::VisitCreateCatchContext() {
   interpreter::Register reg = bytecode_iterator().GetRegisterOperand(0);
   Node* exception = environment()->LookupRegister(reg);
-  Handle<String> name =
-      Handle<String>::cast(bytecode_iterator().GetConstantForIndexOperand(1));
-  Handle<ScopeInfo> scope_info = Handle<ScopeInfo>::cast(
-      bytecode_iterator().GetConstantForIndexOperand(2));
-  Node* closure = environment()->LookupAccumulator();
-
-  const Operator* op = javascript()->CreateCatchContext(name, scope_info);
-  Node* context = NewNode(op, exception, closure);
+  Handle<ScopeInfo> scope_info(
+      ScopeInfo::cast(bytecode_iterator().GetConstantForIndexOperand(1)),
+      isolate());
+
+  const Operator* op = javascript()->CreateCatchContext(scope_info);
+  Node* context = NewNode(op, exception);
   environment()->BindAccumulator(context);
 }
 
 void BytecodeGraphBuilder::VisitCreateWithContext() {
   Node* object =
       environment()->LookupRegister(bytecode_iterator().GetRegisterOperand(0));
-  Handle<ScopeInfo> scope_info = Handle<ScopeInfo>::cast(
-      bytecode_iterator().GetConstantForIndexOperand(1));
+  Handle<ScopeInfo> scope_info(
+      ScopeInfo::cast(bytecode_iterator().GetConstantForIndexOperand(1)),
+      isolate());
 
   const Operator* op = javascript()->CreateWithContext(scope_info);
-  Node* context = NewNode(op, object, environment()->LookupAccumulator());
+  Node* context = NewNode(op, object);
   environment()->BindAccumulator(context);
 }
 
@@ -1546,8 +1557,9 @@ void BytecodeGraphBuilder::VisitCreateRestParameter() {
 }
 
 void BytecodeGraphBuilder::VisitCreateRegExpLiteral() {
-  Handle<String> constant_pattern =
-      Handle<String>::cast(bytecode_iterator().GetConstantForIndexOperand(0));
+  Handle<String> constant_pattern(
+      String::cast(bytecode_iterator().GetConstantForIndexOperand(0)),
+      isolate());
   int const slot_id = bytecode_iterator().GetIndexOperand(1);
   VectorSlotPair pair = CreateVectorSlotPair(slot_id);
   int literal_flags = bytecode_iterator().GetFlagOperand(2);
@@ -1557,9 +1569,10 @@ void BytecodeGraphBuilder::VisitCreateRegExpLiteral() {
 }
 
 void BytecodeGraphBuilder::VisitCreateArrayLiteral() {
-  Handle<ConstantElementsPair> constant_elements =
-      Handle<ConstantElementsPair>::cast(
-          bytecode_iterator().GetConstantForIndexOperand(0));
+  Handle<ArrayBoilerplateDescription> array_boilerplate_description(
+      ArrayBoilerplateDescription::cast(
+          bytecode_iterator().GetConstantForIndexOperand(0)),
+      isolate());
   int const slot_id = bytecode_iterator().GetIndexOperand(1);
   VectorSlotPair pair = CreateVectorSlotPair(slot_id);
   int bytecode_flags = bytecode_iterator().GetFlagOperand(2);
@@ -1572,9 +1585,10 @@ void BytecodeGraphBuilder::VisitCreateArrayLiteral() {
   literal_flags |= ArrayLiteral::kDisableMementos;
   // TODO(mstarzinger): Thread through number of elements. The below number is
   // only an estimate and does not match {ArrayLiteral::values::length}.
-  int number_of_elements = constant_elements->constant_values()->length();
+  int number_of_elements =
+      array_boilerplate_description->constant_elements()->length();
   Node* literal = NewNode(javascript()->CreateLiteralArray(
-      constant_elements, pair, literal_flags, number_of_elements));
+      array_boilerplate_description, pair, literal_flags, number_of_elements));
   environment()->BindAccumulator(literal, Environment::kAttachFrameState);
 }
 
@@ -1586,9 +1600,10 @@ void BytecodeGraphBuilder::VisitCreateEmptyArrayLiteral() {
 }
 
 void BytecodeGraphBuilder::VisitCreateObjectLiteral() {
-  Handle<BoilerplateDescription> constant_properties =
-      Handle<BoilerplateDescription>::cast(
-          bytecode_iterator().GetConstantForIndexOperand(0));
+  Handle<ObjectBoilerplateDescription> constant_properties(
+      ObjectBoilerplateDescription::cast(
+          bytecode_iterator().GetConstantForIndexOperand(0)),
+      isolate());
   int const slot_id = bytecode_iterator().GetIndexOperand(1);
   VectorSlotPair pair = CreateVectorSlotPair(slot_id);
   int bytecode_flags = bytecode_iterator().GetFlagOperand(2);
@@ -1610,21 +1625,24 @@ void BytecodeGraphBuilder::VisitCreateEmptyObjectLiteral() {
 }
 
 void BytecodeGraphBuilder::VisitGetTemplateObject() {
-  Handle<TemplateObjectDescription> description =
-      Handle<TemplateObjectDescription>::cast(
-          bytecode_iterator().GetConstantForIndexOperand(0));
+  Handle<TemplateObjectDescription> description(
+      TemplateObjectDescription::cast(
+          bytecode_iterator().GetConstantForIndexOperand(0)),
+      isolate());
   FeedbackSlot slot = bytecode_iterator().GetSlotOperand(1);
   FeedbackNexus nexus(feedback_vector(), slot);
 
   Handle<JSArray> cached_value;
-  if (nexus.GetFeedback() == Smi::kZero) {
+  if (nexus.GetFeedback() == MaybeObject::FromSmi(Smi::kZero)) {
     // It's not observable when the template object is created, so we
     // can just create it eagerly during graph building and bake in
     // the JSArray constant here.
-    cached_value = TemplateObjectDescription::CreateTemplateObject(description);
+    cached_value =
+        TemplateObjectDescription::CreateTemplateObject(isolate(), description);
     nexus.vector()->Set(slot, *cached_value);
   } else {
-    cached_value = handle(JSArray::cast(nexus.GetFeedback()));
+    cached_value = handle(
+        JSArray::cast(nexus.GetFeedback()->ToStrongHeapObject()), isolate());
   }
 
   Node* template_object = jsgraph()->HeapConstant(cached_value);
@@ -2080,8 +2098,8 @@ void BytecodeGraphBuilder::VisitThrowReferenceErrorIfHole() {
   Node* accumulator = environment()->LookupAccumulator();
   Node* check_for_hole = NewNode(simplified()->ReferenceEqual(), accumulator,
                                  jsgraph()->TheHoleConstant());
-  Node* name =
-      jsgraph()->Constant(bytecode_iterator().GetConstantForIndexOperand(0));
+  Node* name = jsgraph()->Constant(
+      handle(bytecode_iterator().GetConstantForIndexOperand(0), isolate()));
   BuildHoleCheckAndThrow(check_for_hole, Runtime::kThrowReferenceError, name);
 }
 
@@ -2413,19 +2431,12 @@ void BytecodeGraphBuilder::VisitTestGreaterThanOrEqual() {
   BuildCompareOp(javascript()->GreaterThanOrEqual(GetCompareOperationHint()));
 }
 
-void BytecodeGraphBuilder::VisitTestEqualStrictNoFeedback() {
-  // TODO(5310): Currently this is used with both Smi operands and with
-  // string operands. We pass string operands for static property check in
-  // VisitClassLiteralProperties. This should be changed, so we only use this
-  // for Smi operations and lower it to SpeculativeNumberEqual[kSignedSmall]
-  PrepareEagerCheckpoint();
+void BytecodeGraphBuilder::VisitTestReferenceEqual() {
   Node* left =
       environment()->LookupRegister(bytecode_iterator().GetRegisterOperand(0));
   Node* right = environment()->LookupAccumulator();
-
-  Node* node = NewNode(javascript()->StrictEqual(CompareOperationHint::kAny),
-                       left, right);
-  environment()->BindAccumulator(node, Environment::kAttachFrameState);
+  Node* result = NewNode(simplified()->ReferenceEqual(), left, right);
+  environment()->BindAccumulator(result);
 }
 
 void BytecodeGraphBuilder::BuildTestingOp(const Operator* op) {
@@ -2796,6 +2807,9 @@ void BytecodeGraphBuilder::VisitSuspendGenerator() {
   CHECK_EQ(0, first_reg.index());
   int register_count =
       static_cast<int>(bytecode_iterator().GetRegisterCountOperand(2));
+  int parameter_count_without_receiver =
+      bytecode_array()->parameter_count() - 1;
+
   Node* suspend_id = jsgraph()->SmiConstant(
       bytecode_iterator().GetUnsignedImmediateOperand(3));
 
@@ -2812,7 +2826,7 @@ void BytecodeGraphBuilder::VisitSuspendGenerator() {
   // are live.
   // TODO(leszeks): We could get this count from liveness rather than the
   // register list.
-  int value_input_count = 3 + register_count;
+  int value_input_count = 3 + parameter_count_without_receiver + register_count;
 
   Node** value_inputs = local_zone()->NewArray<Node*>(value_input_count);
   value_inputs[0] = generator;
@@ -2820,14 +2834,24 @@ void BytecodeGraphBuilder::VisitSuspendGenerator() {
   value_inputs[2] = offset;
 
   int count_written = 0;
+  // Store the parameters.
+  for (int i = 0; i < parameter_count_without_receiver; i++) {
+    value_inputs[3 + count_written++] =
+        environment()->LookupRegister(interpreter::Register::FromParameterIndex(
+            i, parameter_count_without_receiver));
+  }
+
+  // Store the registers.
   for (int i = 0; i < register_count; ++i) {
     if (liveness == nullptr || liveness->RegisterIsLive(i)) {
-      while (count_written < i) {
+      int index_in_parameters_and_registers =
+          parameter_count_without_receiver + i;
+      while (count_written < index_in_parameters_and_registers) {
         value_inputs[3 + count_written++] = jsgraph()->OptimizedOutConstant();
       }
       value_inputs[3 + count_written++] =
           environment()->LookupRegister(interpreter::Register(i));
-      DCHECK_EQ(count_written, i + 1);
+      DCHECK_EQ(count_written, index_in_parameters_and_registers + 1);
     }
   }
 
@@ -2925,12 +2949,16 @@ void BytecodeGraphBuilder::VisitResumeGenerator() {
       bytecode_analysis()->GetOutLivenessFor(
           bytecode_iterator().current_offset());
 
-  // Bijection between registers and array indices must match that used in
-  // InterpreterAssembler::ExportRegisterFile.
+  int parameter_count_without_receiver =
+      bytecode_array()->parameter_count() - 1;
+
+  // Mapping between registers and array indices must match that used in
+  // InterpreterAssembler::ExportParametersAndRegisterFile.
   for (int i = 0; i < environment()->register_count(); ++i) {
     if (liveness == nullptr || liveness->RegisterIsLive(i)) {
-      Node* value =
-          NewNode(javascript()->GeneratorRestoreRegister(i), generator);
+      Node* value = NewNode(javascript()->GeneratorRestoreRegister(
+                                parameter_count_without_receiver + i),
+                            generator);
       environment()->BindRegister(interpreter::Register(i), value);
     }
   }
diff --git a/deps/v8/src/compiler/bytecode-graph-builder.h b/deps/v8/src/compiler/bytecode-graph-builder.h
index 9025d477d57fe3..a94a3d79afe7e6 100644
--- a/deps/v8/src/compiler/bytecode-graph-builder.h
+++ b/deps/v8/src/compiler/bytecode-graph-builder.h
@@ -302,6 +302,7 @@ class BytecodeGraphBuilder {
   CommonOperatorBuilder* common() const { return jsgraph_->common(); }
   Zone* graph_zone() const { return graph()->zone(); }
   JSGraph* jsgraph() const { return jsgraph_; }
+  Isolate* isolate() const { return jsgraph_->isolate(); }
   JSOperatorBuilder* javascript() const { return jsgraph_->javascript(); }
   SimplifiedOperatorBuilder* simplified() const {
     return jsgraph_->simplified();
diff --git a/deps/v8/src/compiler/checkpoint-elimination.cc b/deps/v8/src/compiler/checkpoint-elimination.cc
index d44dfdff489e63..172d42845c2d98 100644
--- a/deps/v8/src/compiler/checkpoint-elimination.cc
+++ b/deps/v8/src/compiler/checkpoint-elimination.cc
@@ -39,6 +39,7 @@ Reduction CheckpointElimination::ReduceCheckpoint(Node* node) {
 }
 
 Reduction CheckpointElimination::Reduce(Node* node) {
+  DisallowHeapAccess no_heap_access;
   switch (node->opcode()) {
     case IrOpcode::kCheckpoint:
       return ReduceCheckpoint(node);
diff --git a/deps/v8/src/compiler/code-assembler.cc b/deps/v8/src/compiler/code-assembler.cc
index 01e8d54707c914..7a8f6aef75f521 100644
--- a/deps/v8/src/compiler/code-assembler.cc
+++ b/deps/v8/src/compiler/code-assembler.cc
@@ -6,7 +6,6 @@
 
 #include <ostream>
 
-#include "src/builtins/constants-table-builder.h"
 #include "src/code-factory.h"
 #include "src/compiler/graph.h"
 #include "src/compiler/instruction-selector.h"
@@ -18,27 +17,13 @@
 #include "src/frames.h"
 #include "src/interface-descriptors.h"
 #include "src/interpreter/bytecodes.h"
+#include "src/lsan.h"
 #include "src/machine-type.h"
 #include "src/macro-assembler.h"
 #include "src/objects-inl.h"
-#include "src/snapshot/serializer-common.h"
 #include "src/utils.h"
 #include "src/zone/zone.h"
 
-#define REPEAT_1_TO_2(V, T) V(T) V(T, T)
-#define REPEAT_1_TO_3(V, T) REPEAT_1_TO_2(V, T) V(T, T, T)
-#define REPEAT_1_TO_4(V, T) REPEAT_1_TO_3(V, T) V(T, T, T, T)
-#define REPEAT_1_TO_5(V, T) REPEAT_1_TO_4(V, T) V(T, T, T, T, T)
-#define REPEAT_1_TO_6(V, T) REPEAT_1_TO_5(V, T) V(T, T, T, T, T, T)
-#define REPEAT_1_TO_7(V, T) REPEAT_1_TO_6(V, T) V(T, T, T, T, T, T, T)
-#define REPEAT_1_TO_8(V, T) REPEAT_1_TO_7(V, T) V(T, T, T, T, T, T, T, T)
-#define REPEAT_1_TO_9(V, T) REPEAT_1_TO_8(V, T) V(T, T, T, T, T, T, T, T, T)
-#define REPEAT_1_TO_10(V, T) REPEAT_1_TO_9(V, T) V(T, T, T, T, T, T, T, T, T, T)
-#define REPEAT_1_TO_11(V, T) \
-  REPEAT_1_TO_10(V, T) V(T, T, T, T, T, T, T, T, T, T, T)
-#define REPEAT_1_TO_12(V, T) \
-  REPEAT_1_TO_11(V, T) V(T, T, T, T, T, T, T, T, T, T, T, T)
-
 namespace v8 {
 namespace internal {
 
@@ -58,41 +43,40 @@ static_assert(
 
 CodeAssemblerState::CodeAssemblerState(
     Isolate* isolate, Zone* zone, const CallInterfaceDescriptor& descriptor,
-    Code::Kind kind, const char* name,
-    PoisoningMitigationLevel poisoning_enabled, size_t result_size,
+    Code::Kind kind, const char* name, PoisoningMitigationLevel poisoning_level,
     uint32_t stub_key, int32_t builtin_index)
     // TODO(rmcilroy): Should we use Linkage::GetBytecodeDispatchDescriptor for
     // bytecode handlers?
     : CodeAssemblerState(
           isolate, zone,
           Linkage::GetStubCallDescriptor(
-              isolate, zone, descriptor, descriptor.GetStackParameterCount(),
-              CallDescriptor::kNoFlags, Operator::kNoProperties,
-              MachineType::AnyTagged(), result_size),
-          kind, name, poisoning_enabled, stub_key, builtin_index) {}
-
-CodeAssemblerState::CodeAssemblerState(
-    Isolate* isolate, Zone* zone, int parameter_count, Code::Kind kind,
-    const char* name, PoisoningMitigationLevel poisoning_enabled,
-    int32_t builtin_index)
+              zone, descriptor, descriptor.GetStackParameterCount(),
+              CallDescriptor::kNoFlags, Operator::kNoProperties),
+          kind, name, poisoning_level, stub_key, builtin_index) {}
+
+CodeAssemblerState::CodeAssemblerState(Isolate* isolate, Zone* zone,
+                                       int parameter_count, Code::Kind kind,
+                                       const char* name,
+                                       PoisoningMitigationLevel poisoning_level,
+                                       int32_t builtin_index)
     : CodeAssemblerState(
           isolate, zone,
           Linkage::GetJSCallDescriptor(zone, false, parameter_count,
                                        kind == Code::BUILTIN
                                            ? CallDescriptor::kPushArgumentCount
                                            : CallDescriptor::kNoFlags),
-          kind, name, poisoning_enabled, 0, builtin_index) {}
+          kind, name, poisoning_level, 0, builtin_index) {}
 
-CodeAssemblerState::CodeAssemblerState(
-    Isolate* isolate, Zone* zone, CallDescriptor* call_descriptor,
-    Code::Kind kind, const char* name,
-    PoisoningMitigationLevel poisoning_enabled, uint32_t stub_key,
-    int32_t builtin_index)
+CodeAssemblerState::CodeAssemblerState(Isolate* isolate, Zone* zone,
+                                       CallDescriptor* call_descriptor,
+                                       Code::Kind kind, const char* name,
+                                       PoisoningMitigationLevel poisoning_level,
+                                       uint32_t stub_key, int32_t builtin_index)
     : raw_assembler_(new RawMachineAssembler(
           isolate, new (zone) Graph(zone), call_descriptor,
           MachineType::PointerRepresentation(),
           InstructionSelector::SupportedMachineOperatorFlags(),
-          InstructionSelector::AlignmentRequirements(), poisoning_enabled)),
+          InstructionSelector::AlignmentRequirements(), poisoning_level)),
       kind_(kind),
       name_(name),
       stub_key_(stub_key),
@@ -178,12 +162,13 @@ bool CodeAssembler::Word32ShiftIsSafe() const {
   return raw_assembler()->machine()->Word32ShiftIsSafe();
 }
 
-PoisoningMitigationLevel CodeAssembler::poisoning_enabled() const {
-  return raw_assembler()->poisoning_enabled();
+PoisoningMitigationLevel CodeAssembler::poisoning_level() const {
+  return raw_assembler()->poisoning_level();
 }
 
 // static
-Handle<Code> CodeAssembler::GenerateCode(CodeAssemblerState* state) {
+Handle<Code> CodeAssembler::GenerateCode(CodeAssemblerState* state,
+                                         const AssemblerOptions& options) {
   DCHECK(!state->code_generated_);
 
   RawMachineAssembler* rasm = state->raw_assembler_.get();
@@ -193,19 +178,24 @@ Handle<Code> CodeAssembler::GenerateCode(CodeAssemblerState* state) {
   bool should_optimize_jumps =
       rasm->isolate()->serializer_enabled() && FLAG_turbo_rewrite_far_jumps;
 
-  Handle<Code> code = Pipeline::GenerateCodeForCodeStub(
-      rasm->isolate(), rasm->call_descriptor(), rasm->graph(), schedule,
-      state->kind_, state->name_, state->stub_key_, state->builtin_index_,
-      should_optimize_jumps ? &jump_opt : nullptr, rasm->poisoning_enabled());
+  Handle<Code> code =
+      Pipeline::GenerateCodeForCodeStub(
+          rasm->isolate(), rasm->call_descriptor(), rasm->graph(), schedule,
+          state->kind_, state->name_, state->stub_key_, state->builtin_index_,
+          should_optimize_jumps ? &jump_opt : nullptr, rasm->poisoning_level(),
+          options)
+          .ToHandleChecked();
 
   if (jump_opt.is_optimizable()) {
     jump_opt.set_optimizing();
 
     // Regenerate machine code
-    code = Pipeline::GenerateCodeForCodeStub(
-        rasm->isolate(), rasm->call_descriptor(), rasm->graph(), schedule,
-        state->kind_, state->name_, state->stub_key_, state->builtin_index_,
-        &jump_opt, rasm->poisoning_enabled());
+    code =
+        Pipeline::GenerateCodeForCodeStub(
+            rasm->isolate(), rasm->call_descriptor(), rasm->graph(), schedule,
+            state->kind_, state->name_, state->stub_key_, state->builtin_index_,
+            &jump_opt, rasm->poisoning_level(), options)
+            .ToHandleChecked();
   }
 
   state->code_generated_ = true;
@@ -243,58 +233,20 @@ bool CodeAssembler::IsIntPtrAbsWithOverflowSupported() const {
                 : IsInt32AbsWithOverflowSupported();
 }
 
-#ifdef V8_EMBEDDED_BUILTINS
-TNode<HeapObject> CodeAssembler::LookupConstant(Handle<HeapObject> object) {
-  DCHECK(isolate()->serializer_enabled());
-
-  // Ensure the given object is in the builtins constants table and fetch its
-  // index.
-  BuiltinsConstantsTableBuilder* builder =
-      isolate()->builtins_constants_table_builder();
-  uint32_t index = builder->AddObject(object);
-
-  // The builtins constants table is loaded through the root register on all
-  // supported platforms. This is checked by the
-  // VerifyBuiltinsIsolateIndependence cctest, which disallows embedded objects
-  // in isolate-independent builtins.
-  DCHECK(isolate()->heap()->RootCanBeTreatedAsConstant(
-      Heap::kBuiltinsConstantsTableRootIndex));
-  TNode<FixedArray> builtins_constants_table = UncheckedCast<FixedArray>(
-      LoadRoot(Heap::kBuiltinsConstantsTableRootIndex));
-
-  // Generate the lookup.
-  const int32_t header_size = FixedArray::kHeaderSize - kHeapObjectTag;
-  TNode<IntPtrT> offset = IntPtrConstant(header_size + kPointerSize * index);
-  return UncheckedCast<HeapObject>(
-      Load(MachineType::AnyTagged(), builtins_constants_table, offset));
+#ifdef DEBUG
+void CodeAssembler::GenerateCheckMaybeObjectIsObject(Node* node,
+                                                     const char* location) {
+  Label ok(this);
+  GotoIf(WordNotEqual(WordAnd(BitcastMaybeObjectToWord(node),
+                              IntPtrConstant(kHeapObjectTagMask)),
+                      IntPtrConstant(kWeakHeapObjectTag)),
+         &ok);
+  Node* message_node = StringConstant(location);
+  DebugAbort(message_node);
+  Unreachable();
+  Bind(&ok);
 }
-
-// External references are stored in the external reference table.
-TNode<ExternalReference> CodeAssembler::LookupExternalReference(
-    ExternalReference reference) {
-  DCHECK(isolate()->serializer_enabled());
-
-  // Encode as an index into the external reference table stored on the isolate.
-
-  ExternalReferenceEncoder encoder(isolate());
-  ExternalReferenceEncoder::Value v = encoder.Encode(reference.address());
-  CHECK(!v.is_from_api());
-  uint32_t index = v.index();
-
-  // Generate code to load from the external reference table.
-
-  const intptr_t roots_to_external_reference_offset =
-      Heap::roots_to_external_reference_table_offset()
-#ifdef V8_TARGET_ARCH_X64
-      - kRootRegisterBias
 #endif
-      + ExternalReferenceTable::OffsetOfEntry(index);
-
-  return UncheckedCast<ExternalReference>(
-      Load(MachineType::Pointer(), LoadRootsPointer(),
-           IntPtrConstant(roots_to_external_reference_offset)));
-}
-#endif  // V8_EMBEDDED_BUILTINS
 
 TNode<Int32T> CodeAssembler::Int32Constant(int32_t value) {
   return UncheckedCast<Int32T>(raw_assembler()->Int32Constant(value));
@@ -313,7 +265,12 @@ TNode<Number> CodeAssembler::NumberConstant(double value) {
   if (DoubleToSmiInteger(value, &smi_value)) {
     return UncheckedCast<Number>(SmiConstant(smi_value));
   } else {
-    return UncheckedCast<Number>(raw_assembler()->NumberConstant(value));
+    // We allocate the heap number constant eagerly at this point instead of
+    // deferring allocation to code generation
+    // (see AllocateAndInstallRequestedHeapObjects) since that makes it easier
+    // to generate constant lookups for embedded builtins.
+    return UncheckedCast<Number>(
+        HeapConstant(isolate()->factory()->NewHeapNumber(value, TENURED)));
   }
 }
 
@@ -328,16 +285,6 @@ TNode<Smi> CodeAssembler::SmiConstant(int value) {
 
 TNode<HeapObject> CodeAssembler::UntypedHeapConstant(
     Handle<HeapObject> object) {
-#ifdef V8_EMBEDDED_BUILTINS
-  // Root constants are simply loaded from the root list, while non-root
-  // constants must be looked up from the builtins constants table.
-  if (ShouldLoadConstantsFromRootList()) {
-    Heap::RootListIndex root_index;
-    if (!isolate()->heap()->IsRootHandle(object, &root_index)) {
-      return LookupConstant(object);
-    }
-  }
-#endif  // V8_EMBEDDED_BUILTINS
   return UncheckedCast<HeapObject>(raw_assembler()->HeapConstant(object));
 }
 
@@ -353,11 +300,6 @@ TNode<Oddball> CodeAssembler::BooleanConstant(bool value) {
 
 TNode<ExternalReference> CodeAssembler::ExternalConstant(
     ExternalReference address) {
-#ifdef V8_EMBEDDED_BUILTINS
-  if (ShouldLoadConstantsFromRootList()) {
-    return LookupExternalReference(address);
-  }
-#endif  // V8_EMBEDDED_BUILTINS
   return UncheckedCast<ExternalReference>(
       raw_assembler()->ExternalConstant(address));
 }
@@ -371,12 +313,21 @@ TNode<HeapNumber> CodeAssembler::NaNConstant() {
 }
 
 bool CodeAssembler::ToInt32Constant(Node* node, int32_t& out_value) {
-  Int64Matcher m(node);
-  if (m.HasValue() &&
-      m.IsInRange(std::numeric_limits<int32_t>::min(),
-                  std::numeric_limits<int32_t>::max())) {
-    out_value = static_cast<int32_t>(m.Value());
-    return true;
+  {
+    Int64Matcher m(node);
+    if (m.HasValue() && m.IsInRange(std::numeric_limits<int32_t>::min(),
+                                    std::numeric_limits<int32_t>::max())) {
+      out_value = static_cast<int32_t>(m.Value());
+      return true;
+    }
+  }
+
+  {
+    Int32Matcher m(node);
+    if (m.HasValue()) {
+      out_value = m.Value();
+      return true;
+    }
   }
 
   return false;
@@ -413,8 +364,24 @@ bool CodeAssembler::ToIntPtrConstant(Node* node, intptr_t& out_value) {
   return m.HasValue();
 }
 
-Node* CodeAssembler::Parameter(int value) {
-  return raw_assembler()->Parameter(value);
+bool CodeAssembler::IsUndefinedConstant(TNode<Object> node) {
+  compiler::HeapObjectMatcher m(node);
+  return m.Is(isolate()->factory()->undefined_value());
+}
+
+bool CodeAssembler::IsNullConstant(TNode<Object> node) {
+  compiler::HeapObjectMatcher m(node);
+  return m.Is(isolate()->factory()->null_value());
+}
+
+Node* CodeAssembler::Parameter(int index) {
+  if (index == kTargetParameterIndex) return raw_assembler()->TargetParameter();
+  return raw_assembler()->Parameter(index);
+}
+
+bool CodeAssembler::IsJSFunctionCall() const {
+  auto call_descriptor = raw_assembler()->call_descriptor();
+  return call_descriptor->IsJSFunctionCall();
 }
 
 TNode<Context> CodeAssembler::GetJSContextParameter() {
@@ -451,6 +418,10 @@ void CodeAssembler::ReturnIf(Node* condition, Node* value) {
   Bind(&if_continue);
 }
 
+void CodeAssembler::ReturnRaw(Node* value) {
+  return raw_assembler()->Return(value);
+}
+
 void CodeAssembler::DebugAbort(Node* message) {
   raw_assembler()->DebugAbort(message);
 }
@@ -476,6 +447,7 @@ void CodeAssembler::Comment(const char* format, ...) {
   const int prefix_len = 2;
   int length = builder.position() + 1;
   char* copy = reinterpret_cast<char*>(malloc(length + prefix_len));
+  LSAN_IGNORE_OBJECT(copy);
   MemCopy(copy + prefix_len, builder.Finalize(), length);
   copy[0] = ';';
   copy[1] = ' ';
@@ -498,22 +470,18 @@ Node* CodeAssembler::LoadParentFramePointer() {
   return raw_assembler()->LoadParentFramePointer();
 }
 
-TNode<IntPtrT> CodeAssembler::LoadRootsPointer() {
-  return UncheckedCast<IntPtrT>(raw_assembler()->LoadRootsPointer());
-}
-
 Node* CodeAssembler::LoadStackPointer() {
   return raw_assembler()->LoadStackPointer();
 }
 
-TNode<Object> CodeAssembler::PoisonOnSpeculationTagged(
+TNode<Object> CodeAssembler::TaggedPoisonOnSpeculation(
     SloppyTNode<Object> value) {
   return UncheckedCast<Object>(
-      raw_assembler()->PoisonOnSpeculationTagged(value));
+      raw_assembler()->TaggedPoisonOnSpeculation(value));
 }
 
-TNode<WordT> CodeAssembler::PoisonOnSpeculationWord(SloppyTNode<WordT> value) {
-  return UncheckedCast<WordT>(raw_assembler()->PoisonOnSpeculationWord(value));
+TNode<WordT> CodeAssembler::WordPoisonOnSpeculation(SloppyTNode<WordT> value) {
+  return UncheckedCast<WordT>(raw_assembler()->WordPoisonOnSpeculation(value));
 }
 
 #define DEFINE_CODE_ASSEMBLER_BINARY_OP(name, ResType, Arg1Type, Arg2Type) \
@@ -912,6 +880,25 @@ TNode<Word64T> CodeAssembler::Word64Sar(SloppyTNode<Word64T> left,
   return UncheckedCast<Word64T>(raw_assembler()->Word64Sar(left, right));
 }
 
+#define CODE_ASSEMBLER_COMPARE(Name, ArgT, VarT, ToConstant, op)     \
+  TNode<BoolT> CodeAssembler::Name(SloppyTNode<ArgT> left,           \
+                                   SloppyTNode<ArgT> right) {        \
+    VarT lhs, rhs;                                                   \
+    if (ToConstant(left, lhs) && ToConstant(right, rhs)) {           \
+      return BoolConstant(lhs op rhs);                               \
+    }                                                                \
+    return UncheckedCast<BoolT>(raw_assembler()->Name(left, right)); \
+  }
+
+CODE_ASSEMBLER_COMPARE(IntPtrEqual, WordT, intptr_t, ToIntPtrConstant, ==)
+CODE_ASSEMBLER_COMPARE(WordEqual, WordT, intptr_t, ToIntPtrConstant, ==)
+CODE_ASSEMBLER_COMPARE(WordNotEqual, WordT, intptr_t, ToIntPtrConstant, !=)
+CODE_ASSEMBLER_COMPARE(Word32Equal, Word32T, int32_t, ToInt32Constant, ==)
+CODE_ASSEMBLER_COMPARE(Word32NotEqual, Word32T, int32_t, ToInt32Constant, !=)
+CODE_ASSEMBLER_COMPARE(Word64Equal, Word64T, int64_t, ToInt64Constant, ==)
+CODE_ASSEMBLER_COMPARE(Word64NotEqual, Word64T, int64_t, ToInt64Constant, !=)
+#undef CODE_ASSEMBLER_COMPARE
+
 TNode<UintPtrT> CodeAssembler::ChangeUint32ToWord(SloppyTNode<Word32T> value) {
   if (raw_assembler()->machine()->Is64()) {
     return UncheckedCast<UintPtrT>(
@@ -975,6 +962,9 @@ TNode<Object> CodeAssembler::LoadRoot(Heap::RootListIndex root_index) {
     }
   }
 
+  // TODO(jgruber): In theory we could generate better code for this by
+  // letting the macro assembler decide how to load from the roots list. In most
+  // cases, it would boil down to loading from a fixed kRootRegister offset.
   Node* roots_array_start =
       ExternalConstant(ExternalReference::roots_array_start(isolate()));
   return UncheckedCast<Object>(Load(MachineType::AnyTagged(), roots_array_start,
@@ -1074,99 +1064,107 @@ void CodeAssembler::GotoIfException(Node* node, Label* if_exception,
   Bind(&success);
 }
 
-template <class... TArgs>
-TNode<Object> CodeAssembler::CallRuntimeImpl(Runtime::FunctionId function,
-                                             SloppyTNode<Object> context,
-                                             TArgs... args) {
-  int argc = static_cast<int>(sizeof...(args));
+namespace {
+template <size_t kMaxSize>
+class NodeArray {
+ public:
+  void Add(Node* node) {
+    DCHECK_GT(kMaxSize, size());
+    *ptr_++ = node;
+  }
+
+  Node* const* data() const { return arr_; }
+  int size() const { return static_cast<int>(ptr_ - arr_); }
+
+ private:
+  Node* arr_[kMaxSize];
+  Node** ptr_ = arr_;
+};
+}  // namespace
+
+TNode<Object> CodeAssembler::CallRuntimeImpl(
+    Runtime::FunctionId function, TNode<Object> context,
+    std::initializer_list<TNode<Object>> args) {
+  int result_size = Runtime::FunctionForId(function)->result_size;
+  TNode<Code> centry =
+      HeapConstant(CodeFactory::RuntimeCEntry(isolate(), result_size));
+  return CallRuntimeWithCEntryImpl(function, centry, context, args);
+}
+
+TNode<Object> CodeAssembler::CallRuntimeWithCEntryImpl(
+    Runtime::FunctionId function, TNode<Code> centry, TNode<Object> context,
+    std::initializer_list<TNode<Object>> args) {
+  constexpr size_t kMaxNumArgs = 6;
+  DCHECK_GE(kMaxNumArgs, args.size());
+  int argc = static_cast<int>(args.size());
   auto call_descriptor = Linkage::GetRuntimeCallDescriptor(
       zone(), function, argc, Operator::kNoProperties,
       CallDescriptor::kNoFlags);
-  int return_count = static_cast<int>(call_descriptor->ReturnCount());
 
-  Node* centry =
-      HeapConstant(CodeFactory::RuntimeCEntry(isolate(), return_count));
-  Node* ref = ExternalConstant(ExternalReference(function, isolate()));
+  Node* ref = ExternalConstant(ExternalReference::Create(function));
   Node* arity = Int32Constant(argc);
 
-  Node* nodes[] = {centry, args..., ref, arity, context};
+  NodeArray<kMaxNumArgs + 4> inputs;
+  inputs.Add(centry);
+  for (auto arg : args) inputs.Add(arg);
+  inputs.Add(ref);
+  inputs.Add(arity);
+  inputs.Add(context);
 
   CallPrologue();
   Node* return_value =
-      raw_assembler()->CallN(call_descriptor, arraysize(nodes), nodes);
+      raw_assembler()->CallN(call_descriptor, inputs.size(), inputs.data());
   CallEpilogue();
   return UncheckedCast<Object>(return_value);
 }
 
-// Instantiate CallRuntime() for argument counts used by CSA-generated code
-#define INSTANTIATE(...)                                                   \
-  template V8_EXPORT_PRIVATE TNode<Object> CodeAssembler::CallRuntimeImpl( \
-      Runtime::FunctionId, __VA_ARGS__);
-REPEAT_1_TO_7(INSTANTIATE, SloppyTNode<Object>)
-#undef INSTANTIATE
+void CodeAssembler::TailCallRuntimeImpl(
+    Runtime::FunctionId function, TNode<Int32T> arity, TNode<Object> context,
+    std::initializer_list<TNode<Object>> args) {
+  int result_size = Runtime::FunctionForId(function)->result_size;
+  TNode<Code> centry =
+      HeapConstant(CodeFactory::RuntimeCEntry(isolate(), result_size));
+  return TailCallRuntimeWithCEntryImpl(function, arity, centry, context, args);
+}
 
-template <class... TArgs>
-TNode<Object> CodeAssembler::TailCallRuntimeImpl(Runtime::FunctionId function,
-                                                 SloppyTNode<Object> context,
-                                                 TArgs... args) {
-  int argc = static_cast<int>(sizeof...(args));
+void CodeAssembler::TailCallRuntimeWithCEntryImpl(
+    Runtime::FunctionId function, TNode<Int32T> arity, TNode<Code> centry,
+    TNode<Object> context, std::initializer_list<TNode<Object>> args) {
+  constexpr size_t kMaxNumArgs = 6;
+  DCHECK_GE(kMaxNumArgs, args.size());
+  int argc = static_cast<int>(args.size());
   auto call_descriptor = Linkage::GetRuntimeCallDescriptor(
       zone(), function, argc, Operator::kNoProperties,
       CallDescriptor::kNoFlags);
-  int return_count = static_cast<int>(call_descriptor->ReturnCount());
 
-  Node* centry =
-      HeapConstant(CodeFactory::RuntimeCEntry(isolate(), return_count));
-  Node* ref = ExternalConstant(ExternalReference(function, isolate()));
-  Node* arity = Int32Constant(argc);
+  Node* ref = ExternalConstant(ExternalReference::Create(function));
 
-  Node* nodes[] = {centry, args..., ref, arity, context};
+  NodeArray<kMaxNumArgs + 4> inputs;
+  inputs.Add(centry);
+  for (auto arg : args) inputs.Add(arg);
+  inputs.Add(ref);
+  inputs.Add(arity);
+  inputs.Add(context);
 
-  return UncheckedCast<Object>(
-      raw_assembler()->TailCallN(call_descriptor, arraysize(nodes), nodes));
+  raw_assembler()->TailCallN(call_descriptor, inputs.size(), inputs.data());
 }
 
-// Instantiate TailCallRuntime() for argument counts used by CSA-generated code
-#define INSTANTIATE(...)                                                       \
-  template V8_EXPORT_PRIVATE TNode<Object> CodeAssembler::TailCallRuntimeImpl( \
-      Runtime::FunctionId, __VA_ARGS__);
-REPEAT_1_TO_7(INSTANTIATE, SloppyTNode<Object>)
-#undef INSTANTIATE
-
-template <class... TArgs>
-Node* CodeAssembler::CallStubR(const CallInterfaceDescriptor& descriptor,
-                               size_t result_size, Node* target, Node* context,
-                               TArgs... args) {
-  Node* nodes[] = {target, args..., context};
-  int input_count = arraysize(nodes);
-  if (context == nullptr) --input_count;
-  return CallStubN(descriptor, result_size, input_count, nodes,
-                   context != nullptr);
-}
-
-// Instantiate CallStubR() for argument counts used by CSA-generated code.
-#define INSTANTIATE(...)                                     \
-  template V8_EXPORT_PRIVATE Node* CodeAssembler::CallStubR( \
-      const CallInterfaceDescriptor& descriptor, size_t, Node*, __VA_ARGS__);
-REPEAT_1_TO_11(INSTANTIATE, Node*)
-#undef INSTANTIATE
-
 Node* CodeAssembler::CallStubN(const CallInterfaceDescriptor& descriptor,
                                size_t result_size, int input_count,
-                               Node* const* inputs, bool pass_context) {
+                               Node* const* inputs) {
   // implicit nodes are target and optionally context.
-  int implicit_nodes = pass_context ? 2 : 1;
+  int implicit_nodes = descriptor.HasContextParameter() ? 2 : 1;
   DCHECK_LE(implicit_nodes, input_count);
   int argc = input_count - implicit_nodes;
   DCHECK_LE(descriptor.GetParameterCount(), argc);
   // Extra arguments not mentioned in the descriptor are passed on the stack.
   int stack_parameter_count = argc - descriptor.GetRegisterParameterCount();
   DCHECK_LE(descriptor.GetStackParameterCount(), stack_parameter_count);
+  DCHECK_EQ(result_size, descriptor.GetReturnCount());
+
   auto call_descriptor = Linkage::GetStubCallDescriptor(
-      isolate(), zone(), descriptor, stack_parameter_count,
-      CallDescriptor::kNoFlags, Operator::kNoProperties,
-      MachineType::AnyTagged(), result_size,
-      pass_context ? Linkage::kPassContext : Linkage::kNoContext);
+      zone(), descriptor, stack_parameter_count, CallDescriptor::kNoFlags,
+      Operator::kNoProperties);
 
   CallPrologue();
   Node* return_value =
@@ -1175,62 +1173,73 @@ Node* CodeAssembler::CallStubN(const CallInterfaceDescriptor& descriptor,
   return return_value;
 }
 
-template <class... TArgs>
-Node* CodeAssembler::TailCallStubImpl(const CallInterfaceDescriptor& descriptor,
-                                      Node* target, Node* context,
-                                      TArgs... args) {
-  DCHECK_EQ(descriptor.GetParameterCount(), sizeof...(args));
-  size_t result_size = 1;
+void CodeAssembler::TailCallStubImpl(const CallInterfaceDescriptor& descriptor,
+                                     TNode<Code> target, TNode<Object> context,
+                                     std::initializer_list<Node*> args) {
+  constexpr size_t kMaxNumArgs = 11;
+  DCHECK_GE(kMaxNumArgs, args.size());
+  DCHECK_EQ(descriptor.GetParameterCount(), args.size());
   auto call_descriptor = Linkage::GetStubCallDescriptor(
-      isolate(), zone(), descriptor, descriptor.GetStackParameterCount(),
-      CallDescriptor::kNoFlags, Operator::kNoProperties,
-      MachineType::AnyTagged(), result_size);
+      zone(), descriptor, descriptor.GetStackParameterCount(),
+      CallDescriptor::kNoFlags, Operator::kNoProperties);
+
+  NodeArray<kMaxNumArgs + 2> inputs;
+  inputs.Add(target);
+  for (auto arg : args) inputs.Add(arg);
+  if (descriptor.HasContextParameter()) {
+    inputs.Add(context);
+  }
 
-  Node* nodes[] = {target, args..., context};
-  CHECK_EQ(descriptor.GetParameterCount() + 2, arraysize(nodes));
-  return raw_assembler()->TailCallN(call_descriptor, arraysize(nodes), nodes);
+  raw_assembler()->TailCallN(call_descriptor, inputs.size(), inputs.data());
 }
 
-// Instantiate TailCallStub() for argument counts used by CSA-generated code
-#define INSTANTIATE(...)                                            \
-  template V8_EXPORT_PRIVATE Node* CodeAssembler::TailCallStubImpl( \
-      const CallInterfaceDescriptor& descriptor, Node*, __VA_ARGS__);
-REPEAT_1_TO_12(INSTANTIATE, Node*)
-#undef INSTANTIATE
+Node* CodeAssembler::CallStubRImpl(const CallInterfaceDescriptor& descriptor,
+                                   size_t result_size, SloppyTNode<Code> target,
+                                   SloppyTNode<Object> context,
+                                   std::initializer_list<Node*> args) {
+  constexpr size_t kMaxNumArgs = 10;
+  DCHECK_GE(kMaxNumArgs, args.size());
 
-template <class... TArgs>
-Node* CodeAssembler::TailCallStubThenBytecodeDispatch(
+  NodeArray<kMaxNumArgs + 2> inputs;
+  inputs.Add(target);
+  for (auto arg : args) inputs.Add(arg);
+  if (descriptor.HasContextParameter()) {
+    inputs.Add(context);
+  }
+
+  return CallStubN(descriptor, result_size, inputs.size(), inputs.data());
+}
+
+Node* CodeAssembler::TailCallStubThenBytecodeDispatchImpl(
     const CallInterfaceDescriptor& descriptor, Node* target, Node* context,
-    TArgs... args) {
-  DCHECK_LE(descriptor.GetParameterCount(), sizeof...(args));
+    std::initializer_list<Node*> args) {
+  constexpr size_t kMaxNumArgs = 6;
+  DCHECK_GE(kMaxNumArgs, args.size());
+
+  DCHECK_LE(descriptor.GetParameterCount(), args.size());
+  int argc = static_cast<int>(args.size());
   // Extra arguments not mentioned in the descriptor are passed on the stack.
-  int stack_parameter_count =
-      sizeof...(args) - descriptor.GetRegisterParameterCount();
+  int stack_parameter_count = argc - descriptor.GetRegisterParameterCount();
   DCHECK_LE(descriptor.GetStackParameterCount(), stack_parameter_count);
   auto call_descriptor = Linkage::GetStubCallDescriptor(
-      isolate(), zone(), descriptor, stack_parameter_count,
-      CallDescriptor::kNoFlags, Operator::kNoProperties,
-      MachineType::AnyTagged(), 0);
+      zone(), descriptor, stack_parameter_count, CallDescriptor::kNoFlags,
+      Operator::kNoProperties);
 
-  Node* nodes[] = {target, args..., context};
-  return raw_assembler()->TailCallN(call_descriptor, arraysize(nodes), nodes);
-}
+  NodeArray<kMaxNumArgs + 2> inputs;
+  inputs.Add(target);
+  for (auto arg : args) inputs.Add(arg);
+  inputs.Add(context);
 
-// Instantiate TailCallJSAndBytecodeDispatch() for argument counts used by
-// CSA-generated code
-#define INSTANTIATE(...)                           \
-  template V8_EXPORT_PRIVATE Node*                 \
-  CodeAssembler::TailCallStubThenBytecodeDispatch( \
-      const CallInterfaceDescriptor&, Node*, Node*, Node*, __VA_ARGS__);
-REPEAT_1_TO_7(INSTANTIATE, Node*)
-#undef INSTANTIATE
+  return raw_assembler()->TailCallN(call_descriptor, inputs.size(),
+                                    inputs.data());
+}
 
 template <class... TArgs>
 Node* CodeAssembler::TailCallBytecodeDispatch(
     const CallInterfaceDescriptor& descriptor, Node* target, TArgs... args) {
   DCHECK_EQ(descriptor.GetParameterCount(), sizeof...(args));
   auto call_descriptor = Linkage::GetBytecodeDispatchCallDescriptor(
-      isolate(), zone(), descriptor, descriptor.GetStackParameterCount());
+      zone(), descriptor, descriptor.GetStackParameterCount());
 
   Node* nodes[] = {target, args...};
   CHECK_EQ(descriptor.GetParameterCount() + 1, arraysize(nodes));
@@ -1243,6 +1252,22 @@ template V8_EXPORT_PRIVATE Node* CodeAssembler::TailCallBytecodeDispatch(
     const CallInterfaceDescriptor& descriptor, Node* target, Node*, Node*,
     Node*, Node*);
 
+TNode<Object> CodeAssembler::TailCallJSCode(TNode<Code> code,
+                                            TNode<Context> context,
+                                            TNode<JSFunction> function,
+                                            TNode<Object> new_target,
+                                            TNode<Int32T> arg_count) {
+  JSTrampolineDescriptor descriptor;
+  auto call_descriptor = Linkage::GetStubCallDescriptor(
+      zone(), descriptor, descriptor.GetStackParameterCount(),
+      CallDescriptor::kFixedTargetRegister, Operator::kNoProperties);
+
+  Node* nodes[] = {code, function, new_target, arg_count, context};
+  CHECK_EQ(descriptor.GetParameterCount() + 2, arraysize(nodes));
+  return UncheckedCast<Object>(
+      raw_assembler()->TailCallN(call_descriptor, arraysize(nodes), nodes));
+}
+
 Node* CodeAssembler::CallCFunctionN(Signature<MachineType>* signature,
                                     int input_count, Node* const* inputs) {
   auto call_descriptor = Linkage::GetSimplifiedCDescriptor(zone(), signature);
@@ -1660,7 +1685,8 @@ void CodeAssemblerLabel::UpdateVariablesAfterBind() {
 
 }  // namespace compiler
 
-Smi* CheckObjectType(Object* value, Smi* type, String* location) {
+Smi* CheckObjectType(Isolate* isolate, Object* value, Smi* type,
+                     String* location) {
 #ifdef DEBUG
   const char* expected;
   switch (static_cast<ObjectType>(type->value())) {
@@ -1683,7 +1709,7 @@ Smi* CheckObjectType(Object* value, Smi* type, String* location) {
 #undef TYPE_STRUCT_CASE
   }
   std::stringstream value_description;
-  value->Print(value_description);
+  value->Print(isolate, value_description);
   V8_Fatal(__FILE__, __LINE__,
            "Type cast failed in %s\n"
            "  Expected %s but found %s",
@@ -1695,15 +1721,3 @@ Smi* CheckObjectType(Object* value, Smi* type, String* location) {
 
 }  // namespace internal
 }  // namespace v8
-
-#undef REPEAT_1_TO_2
-#undef REPEAT_1_TO_3
-#undef REPEAT_1_TO_4
-#undef REPEAT_1_TO_5
-#undef REPEAT_1_TO_6
-#undef REPEAT_1_TO_7
-#undef REPEAT_1_TO_8
-#undef REPEAT_1_TO_9
-#undef REPEAT_1_TO_10
-#undef REPEAT_1_TO_11
-#undef REPEAT_1_TO_12
diff --git a/deps/v8/src/compiler/code-assembler.h b/deps/v8/src/compiler/code-assembler.h
index c91345e73fc5bf..6419140a745834 100644
--- a/deps/v8/src/compiler/code-assembler.h
+++ b/deps/v8/src/compiler/code-assembler.h
@@ -11,14 +11,16 @@
 // Clients of this interface shouldn't depend on lots of compiler internals.
 // Do not include anything from src/compiler here!
 #include "src/allocation.h"
-#include "src/base/template-utils.h"
+#include "src/base/macros.h"
 #include "src/builtins/builtins.h"
 #include "src/code-factory.h"
 #include "src/globals.h"
 #include "src/heap/heap.h"
 #include "src/machine-type.h"
+#include "src/objects.h"
 #include "src/objects/data-handler.h"
 #include "src/objects/map.h"
+#include "src/objects/maybe-object.h"
 #include "src/runtime/runtime.h"
 #include "src/zone/zone-containers.h"
 
@@ -33,6 +35,7 @@ class JSRegExpStringIterator;
 class JSWeakCollection;
 class JSWeakMap;
 class JSWeakSet;
+class MaybeObject;
 class PromiseCapability;
 class PromiseFulfillReactionJobTask;
 class PromiseReaction;
@@ -42,6 +45,9 @@ class InterpreterData;
 class Factory;
 class Zone;
 
+template <typename T>
+class Signature;
+
 struct UntaggedT {};
 
 struct IntegralT : UntaggedT {};
@@ -52,7 +58,9 @@ struct WordT : IntegralT {
                           : MachineRepresentation::kWord64;
 };
 
-struct RawPtrT : WordT {};
+struct RawPtrT : WordT {
+  static constexpr MachineType kMachineType = MachineType::Pointer();
+};
 
 template <class To>
 struct RawPtr : RawPtrT {};
@@ -126,6 +134,10 @@ struct MachineTypeOf<Object> {
   static constexpr MachineType value = MachineType::AnyTagged();
 };
 template <>
+struct MachineTypeOf<MaybeObject> {
+  static constexpr MachineType value = MachineType::AnyTagged();
+};
+template <>
 struct MachineTypeOf<Smi> {
   static constexpr MachineType value = MachineType::TaggedSigned();
 };
@@ -151,13 +163,21 @@ struct MachineRepresentationOf<
   static const MachineRepresentation value =
       MachineTypeOf<T>::value.representation();
 };
+template <class T>
+struct MachineRepresentationOf<
+    T, typename std::enable_if<std::is_base_of<MaybeObject, T>::value>::type> {
+  static const MachineRepresentation value =
+      MachineTypeOf<T>::value.representation();
+};
 
 template <class T>
 struct is_valid_type_tag {
   static const bool value = std::is_base_of<Object, T>::value ||
                             std::is_base_of<UntaggedT, T>::value ||
+                            std::is_base_of<MaybeObject, T>::value ||
                             std::is_same<ExternalReference, T>::value;
-  static const bool is_tagged = std::is_base_of<Object, T>::value;
+  static const bool is_tagged = std::is_base_of<Object, T>::value ||
+                                std::is_base_of<MaybeObject, T>::value;
 };
 
 template <class T1, class T2>
@@ -225,6 +245,7 @@ class StringWrapper;
 class SymbolWrapper;
 class Undetectable;
 class UniqueName;
+class WasmExportedFunctionData;
 class WasmGlobalObject;
 class WasmMemoryObject;
 class WasmModuleObject;
@@ -257,7 +278,8 @@ HEAP_OBJECT_TEMPLATE_TYPE_LIST(OBJECT_TYPE_TEMPLATE_CASE)
 #undef OBJECT_TYPE_STRUCT_CASE
 #undef OBJECT_TYPE_TEMPLATE_CASE
 
-Smi* CheckObjectType(Object* value, Smi* type, String* location);
+Smi* CheckObjectType(Isolate* isolate, Object* value, Smi* type,
+                     String* location);
 
 namespace compiler {
 
@@ -343,6 +365,16 @@ struct types_have_common_values<UnionT<T1, T2>, UnionT<U1, U2>> {
                             types_have_common_values<T2, U2>::value;
 };
 
+template <class T>
+struct types_have_common_values<T, MaybeObject> {
+  static const bool value = types_have_common_values<T, Object>::value;
+};
+
+template <class T>
+struct types_have_common_values<MaybeObject, T> {
+  static const bool value = types_have_common_values<Object, T>::value;
+};
+
 // TNode<T> is an SSA value with the static type tag T, which is one of the
 // following:
 //   - a subclass of internal::Object represents a tagged type
@@ -362,7 +394,7 @@ class TNode {
   TNode() : node_(nullptr) {}
 
   TNode operator=(TNode other) {
-    DCHECK_NULL(node_);
+    DCHECK_NOT_NULL(other.node_);
     node_ = other.node_;
     return *this;
   }
@@ -403,6 +435,7 @@ class SloppyTNode : public TNode<T> {
   V(Float32GreaterThan, BoolT, Float32T, Float32T)        \
   V(Float32GreaterThanOrEqual, BoolT, Float32T, Float32T) \
   V(Float64Equal, BoolT, Float64T, Float64T)              \
+  V(Float64NotEqual, BoolT, Float64T, Float64T)           \
   V(Float64LessThan, BoolT, Float64T, Float64T)           \
   V(Float64LessThanOrEqual, BoolT, Float64T, Float64T)    \
   V(Float64GreaterThan, BoolT, Float64T, Float64T)        \
@@ -415,7 +448,6 @@ class SloppyTNode : public TNode<T> {
   V(IntPtrLessThanOrEqual, BoolT, WordT, WordT)           \
   V(IntPtrGreaterThan, BoolT, WordT, WordT)               \
   V(IntPtrGreaterThanOrEqual, BoolT, WordT, WordT)        \
-  V(IntPtrEqual, BoolT, WordT, WordT)                     \
   V(Uint32LessThan, BoolT, Word32T, Word32T)              \
   V(Uint32LessThanOrEqual, BoolT, Word32T, Word32T)       \
   V(Uint32GreaterThan, BoolT, Word32T, Word32T)           \
@@ -423,13 +455,7 @@ class SloppyTNode : public TNode<T> {
   V(UintPtrLessThan, BoolT, WordT, WordT)                 \
   V(UintPtrLessThanOrEqual, BoolT, WordT, WordT)          \
   V(UintPtrGreaterThan, BoolT, WordT, WordT)              \
-  V(UintPtrGreaterThanOrEqual, BoolT, WordT, WordT)       \
-  V(WordEqual, BoolT, WordT, WordT)                       \
-  V(WordNotEqual, BoolT, WordT, WordT)                    \
-  V(Word32Equal, BoolT, Word32T, Word32T)                 \
-  V(Word32NotEqual, BoolT, Word32T, Word32T)              \
-  V(Word64Equal, BoolT, Word64T, Word64T)                 \
-  V(Word64NotEqual, BoolT, Word64T, Word64T)
+  V(UintPtrGreaterThanOrEqual, BoolT, WordT, WordT)
 
 #define CODE_ASSEMBLER_BINARY_OP_LIST(V)                                \
   CODE_ASSEMBLER_COMPARE_BINARY_OP_LIST(V)                              \
@@ -449,6 +475,7 @@ class SloppyTNode : public TNode<T> {
   V(Int32Add, Word32T, Word32T, Word32T)                                \
   V(Int32AddWithOverflow, PAIR_TYPE(Int32T, BoolT), Int32T, Int32T)     \
   V(Int32Sub, Word32T, Word32T, Word32T)                                \
+  V(Int32SubWithOverflow, PAIR_TYPE(Int32T, BoolT), Int32T, Int32T)     \
   V(Int32Mul, Word32T, Word32T, Word32T)                                \
   V(Int32MulWithOverflow, PAIR_TYPE(Int32T, BoolT), Int32T, Int32T)     \
   V(Int32Div, Int32T, Int32T, Int32T)                                   \
@@ -485,6 +512,7 @@ TNode<Float64T> Float64Add(TNode<Float64T> a, TNode<Float64T> b);
   V(Float64ExtractLowWord32, Word32T, Float64T)                \
   V(Float64ExtractHighWord32, Word32T, Float64T)               \
   V(BitcastTaggedToWord, IntPtrT, Object)                      \
+  V(BitcastMaybeObjectToWord, IntPtrT, MaybeObject)            \
   V(BitcastWordToTagged, Object, WordT)                        \
   V(BitcastWordToTaggedSigned, Smi, WordT)                     \
   V(TruncateFloat64ToFloat32, Float32T, Float64T)              \
@@ -497,6 +525,8 @@ TNode<Float64T> Float64Add(TNode<Float64T> a, TNode<Float64T> b);
   V(ChangeInt32ToInt64, Int64T, Int32T)                        \
   V(ChangeUint32ToFloat64, Float64T, Word32T)                  \
   V(ChangeUint32ToUint64, Uint64T, Word32T)                    \
+  V(BitcastInt32ToFloat32, Float32T, Word32T)                  \
+  V(BitcastFloat32ToInt32, Word32T, Float32T)                  \
   V(RoundFloat64ToInt32, Int32T, Float64T)                     \
   V(RoundInt32ToFloat32, Int32T, Float32T)                     \
   V(Float64SilenceNaN, Float64T, Float64T)                     \
@@ -537,7 +567,8 @@ class V8_EXPORT_PRIVATE CodeAssembler {
   explicit CodeAssembler(CodeAssemblerState* state) : state_(state) {}
   ~CodeAssembler();
 
-  static Handle<Code> GenerateCode(CodeAssemblerState* state);
+  static Handle<Code> GenerateCode(CodeAssemblerState* state,
+                                   const AssemblerOptions& options);
 
   bool Is64() const;
   bool IsFloat64RoundUpSupported() const;
@@ -572,6 +603,10 @@ class V8_EXPORT_PRIVATE CodeAssembler {
 
     template <class A>
     operator TNode<A>() {
+      static_assert(
+          !std::is_same<A, MaybeObject>::value,
+          "Can't cast to MaybeObject, use explicit conversion functions. ");
+
       static_assert(types_have_common_values<A, PreviousType>::value,
                     "Incompatible types: this cast can never succeed.");
       static_assert(std::is_convertible<TNode<A>, TNode<Object>>::value,
@@ -583,12 +618,17 @@ class V8_EXPORT_PRIVATE CodeAssembler {
           "Unnecessary CAST: types are convertible.");
 #ifdef DEBUG
       if (FLAG_debug_code) {
+        if (std::is_same<PreviousType, MaybeObject>::value) {
+          code_assembler_->GenerateCheckMaybeObjectIsObject(node_, location_);
+        }
         Node* function = code_assembler_->ExternalConstant(
-            ExternalReference::check_object_type(code_assembler_->isolate()));
-        code_assembler_->CallCFunction3(
-            MachineType::AnyTagged(), MachineType::AnyTagged(),
-            MachineType::TaggedSigned(), MachineType::AnyTagged(), function,
-            node_,
+            ExternalReference::check_object_type());
+        Node* const isolate_ptr = code_assembler_->ExternalConstant(
+            ExternalReference::isolate_address(code_assembler_->isolate()));
+        code_assembler_->CallCFunction4(
+            MachineType::AnyTagged(), MachineType::Pointer(),
+            MachineType::AnyTagged(), MachineType::TaggedSigned(),
+            MachineType::AnyTagged(), function, isolate_ptr, node_,
             code_assembler_->SmiConstant(
                 static_cast<int>(ObjectTypeOf<A>::value)),
             code_assembler_->StringConstant(location_));
@@ -599,7 +639,7 @@ class V8_EXPORT_PRIVATE CodeAssembler {
 
     template <class A>
     operator SloppyTNode<A>() {
-      return base::implicit_cast<TNode<A>>(*this);
+      return implicit_cast<TNode<A>>(*this);
     }
 
     Node* node() const { return node_; }
@@ -648,16 +688,8 @@ class V8_EXPORT_PRIVATE CodeAssembler {
 #define CAST(x) Cast(x, "")
 #endif
 
-#ifdef V8_EMBEDDED_BUILTINS
-  // Off-heap builtins cannot embed constants within the code object itself,
-  // and thus need to load them from the root list.
-  bool ShouldLoadConstantsFromRootList() const {
-    return (isolate()->serializer_enabled() &&
-            isolate()->builtins_constants_table_builder() != nullptr);
-  }
-
-  TNode<HeapObject> LookupConstant(Handle<HeapObject> object);
-  TNode<ExternalReference> LookupExternalReference(ExternalReference reference);
+#ifdef DEBUG
+  void GenerateCheckMaybeObjectIsObject(Node* node, const char* location);
 #endif
 
   // Constants.
@@ -689,12 +721,18 @@ class V8_EXPORT_PRIVATE CodeAssembler {
   TNode<BoolT> Int32FalseConstant() {
     return ReinterpretCast<BoolT>(Int32Constant(0));
   }
+  TNode<BoolT> BoolConstant(bool value) {
+    return value ? Int32TrueConstant() : Int32FalseConstant();
+  }
 
   bool ToInt32Constant(Node* node, int32_t& out_value);
   bool ToInt64Constant(Node* node, int64_t& out_value);
   bool ToSmiConstant(Node* node, Smi*& out_value);
   bool ToIntPtrConstant(Node* node, intptr_t& out_value);
 
+  bool IsUndefinedConstant(TNode<Object> node);
+  bool IsNullConstant(TNode<Object> node);
+
   TNode<Int32T> Signed(TNode<Word32T> x) { return UncheckedCast<Int32T>(x); }
   TNode<IntPtrT> Signed(TNode<WordT> x) { return UncheckedCast<IntPtrT>(x); }
   TNode<Uint32T> Unsigned(TNode<Word32T> x) {
@@ -704,6 +742,8 @@ class V8_EXPORT_PRIVATE CodeAssembler {
     return UncheckedCast<UintPtrT>(x);
   }
 
+  static constexpr int kTargetParameterIndex = -1;
+
   Node* Parameter(int value);
 
   TNode<Context> GetJSContextParameter();
@@ -715,6 +755,8 @@ class V8_EXPORT_PRIVATE CodeAssembler {
 
   void ReturnIf(Node* condition, Node* value);
 
+  void ReturnRaw(Node* value);
+
   void DebugAbort(Node* message);
   void DebugBreak();
   void Unreachable();
@@ -737,15 +779,12 @@ class V8_EXPORT_PRIVATE CodeAssembler {
   Node* LoadFramePointer();
   Node* LoadParentFramePointer();
 
-  // Access to the roots pointer.
-  TNode<IntPtrT> LoadRootsPointer();
-
   // Access to the stack pointer
   Node* LoadStackPointer();
 
   // Poison |value| on speculative paths.
-  TNode<Object> PoisonOnSpeculationTagged(SloppyTNode<Object> value);
-  TNode<WordT> PoisonOnSpeculationWord(SloppyTNode<WordT> value);
+  TNode<Object> TaggedPoisonOnSpeculation(SloppyTNode<Object> value);
+  TNode<WordT> WordPoisonOnSpeculation(SloppyTNode<WordT> value);
 
   // Load raw memory location.
   Node* Load(MachineType rep, Node* base,
@@ -842,6 +881,18 @@ class V8_EXPORT_PRIVATE CodeAssembler {
                         ReinterpretCast<WordT>(right));
   }
 
+  TNode<BoolT> IntPtrEqual(SloppyTNode<WordT> left, SloppyTNode<WordT> right);
+  TNode<BoolT> WordEqual(SloppyTNode<WordT> left, SloppyTNode<WordT> right);
+  TNode<BoolT> WordNotEqual(SloppyTNode<WordT> left, SloppyTNode<WordT> right);
+  TNode<BoolT> Word32Equal(SloppyTNode<Word32T> left,
+                           SloppyTNode<Word32T> right);
+  TNode<BoolT> Word32NotEqual(SloppyTNode<Word32T> left,
+                              SloppyTNode<Word32T> right);
+  TNode<BoolT> Word64Equal(SloppyTNode<Word64T> left,
+                           SloppyTNode<Word64T> right);
+  TNode<BoolT> Word64NotEqual(SloppyTNode<Word64T> left,
+                              SloppyTNode<Word64T> right);
+
   TNode<Int32T> Int32Add(TNode<Int32T> left, TNode<Int32T> right) {
     return Signed(
         Int32Add(static_cast<Node*>(left), static_cast<Node*>(right)));
@@ -938,66 +989,88 @@ class V8_EXPORT_PRIVATE CodeAssembler {
 
   // Calls
   template <class... TArgs>
-  TNode<Object> CallRuntimeImpl(Runtime::FunctionId function,
-                                SloppyTNode<Object> context, TArgs... args);
-  template <class... TArgs>
   TNode<Object> CallRuntime(Runtime::FunctionId function,
                             SloppyTNode<Object> context, TArgs... args) {
     return CallRuntimeImpl(function, context,
-                           base::implicit_cast<SloppyTNode<Object>>(args)...);
+                           {implicit_cast<SloppyTNode<Object>>(args)...});
+  }
+
+  template <class... TArgs>
+  TNode<Object> CallRuntimeWithCEntry(Runtime::FunctionId function,
+                                      TNode<Code> centry,
+                                      SloppyTNode<Object> context,
+                                      TArgs... args) {
+    return CallRuntimeWithCEntryImpl(function, centry, context, {args...});
   }
 
   template <class... TArgs>
-  TNode<Object> TailCallRuntimeImpl(Runtime::FunctionId function,
-                                    SloppyTNode<Object> context, TArgs... args);
+  void TailCallRuntime(Runtime::FunctionId function,
+                       SloppyTNode<Object> context, TArgs... args) {
+    int argc = static_cast<int>(sizeof...(args));
+    TNode<Int32T> arity = Int32Constant(argc);
+    return TailCallRuntimeImpl(function, arity, context,
+                               {implicit_cast<SloppyTNode<Object>>(args)...});
+  }
+
   template <class... TArgs>
-  TNode<Object> TailCallRuntime(Runtime::FunctionId function,
-                                SloppyTNode<Object> context, TArgs... args) {
-    return TailCallRuntimeImpl(
-        function, context, base::implicit_cast<SloppyTNode<Object>>(args)...);
+  void TailCallRuntime(Runtime::FunctionId function, TNode<Int32T> arity,
+                       SloppyTNode<Object> context, TArgs... args) {
+    return TailCallRuntimeImpl(function, arity, context,
+                               {implicit_cast<SloppyTNode<Object>>(args)...});
+  }
+
+  template <class... TArgs>
+  void TailCallRuntimeWithCEntry(Runtime::FunctionId function,
+                                 TNode<Code> centry, TNode<Object> context,
+                                 TArgs... args) {
+    int argc = sizeof...(args);
+    TNode<Int32T> arity = Int32Constant(argc);
+    return TailCallRuntimeWithCEntryImpl(
+        function, arity, centry, context,
+        {implicit_cast<SloppyTNode<Object>>(args)...});
   }
 
   //
   // If context passed to CallStub is nullptr, it won't be passed to the stub.
   //
 
-  template <class... TArgs>
-  Node* CallStub(Callable const& callable, Node* context, TArgs... args) {
-    Node* target = HeapConstant(callable.code());
-    return CallStub(callable.descriptor(), target, context,
-                    base::implicit_cast<Node*>(args)...);
+  template <class T = Object, class... TArgs>
+  TNode<T> CallStub(Callable const& callable, SloppyTNode<Object> context,
+                    TArgs... args) {
+    TNode<Code> target = HeapConstant(callable.code());
+    return CallStub<T>(callable.descriptor(), target, context, args...);
   }
 
-  template <class... TArgs>
-  Node* CallStub(const CallInterfaceDescriptor& descriptor, Node* target,
-                 Node* context, TArgs... args) {
-    return CallStubR(descriptor, 1, target, context,
-                     base::implicit_cast<Node*>(args)...);
+  template <class T = Object, class... TArgs>
+  TNode<T> CallStub(const CallInterfaceDescriptor& descriptor,
+                    SloppyTNode<Code> target, SloppyTNode<Object> context,
+                    TArgs... args) {
+    return UncheckedCast<T>(CallStubR(descriptor, 1, target, context, args...));
   }
 
   template <class... TArgs>
   Node* CallStubR(const CallInterfaceDescriptor& descriptor, size_t result_size,
-                  Node* target, Node* context, TArgs... args);
+                  SloppyTNode<Code> target, SloppyTNode<Object> context,
+                  TArgs... args) {
+    return CallStubRImpl(descriptor, result_size, target, context, {args...});
+  }
 
   Node* CallStubN(const CallInterfaceDescriptor& descriptor, size_t result_size,
-                  int input_count, Node* const* inputs,
-                  bool pass_context = true);
+                  int input_count, Node* const* inputs);
 
   template <class... TArgs>
-  Node* TailCallStub(Callable const& callable, Node* context, TArgs... args) {
-    Node* target = HeapConstant(callable.code());
+  void TailCallStub(Callable const& callable, SloppyTNode<Object> context,
+                    TArgs... args) {
+    TNode<Code> target = HeapConstant(callable.code());
     return TailCallStub(callable.descriptor(), target, context, args...);
   }
 
   template <class... TArgs>
-  Node* TailCallStub(const CallInterfaceDescriptor& descriptor, Node* target,
-                     Node* context, TArgs... args) {
-    return TailCallStubImpl(descriptor, target, context,
-                            base::implicit_cast<Node*>(args)...);
+  void TailCallStub(const CallInterfaceDescriptor& descriptor,
+                    SloppyTNode<Code> target, SloppyTNode<Object> context,
+                    TArgs... args) {
+    return TailCallStubImpl(descriptor, target, context, {args...});
   }
-  template <class... TArgs>
-  Node* TailCallStubImpl(const CallInterfaceDescriptor& descriptor,
-                         Node* target, Node* context, TArgs... args);
 
   template <class... TArgs>
   Node* TailCallBytecodeDispatch(const CallInterfaceDescriptor& descriptor,
@@ -1005,8 +1078,23 @@ class V8_EXPORT_PRIVATE CodeAssembler {
 
   template <class... TArgs>
   Node* TailCallStubThenBytecodeDispatch(
-      const CallInterfaceDescriptor& descriptor, Node* context, Node* target,
-      TArgs... args);
+      const CallInterfaceDescriptor& descriptor, Node* target, Node* context,
+      TArgs... args) {
+    return TailCallStubThenBytecodeDispatchImpl(descriptor, target, context,
+                                                {args...});
+  }
+
+  // Tailcalls to the given code object with JSCall linkage. The JS arguments
+  // (including receiver) are supposed to be already on the stack.
+  // This is a building block for implementing trampoline stubs that are
+  // installed instead of code objects with JSCall linkage.
+  // Note that no arguments adaption is going on here - all the JavaScript
+  // arguments are left on the stack unmodified. Therefore, this tail call can
+  // only be used after arguments adaptation has been performed already.
+  TNode<Object> TailCallJSCode(TNode<Code> code, TNode<Context> context,
+                               TNode<JSFunction> function,
+                               TNode<Object> new_target,
+                               TNode<Int32T> arg_count);
 
   template <class... TArgs>
   Node* CallJS(Callable const& callable, Node* context, Node* function,
@@ -1113,9 +1201,41 @@ class V8_EXPORT_PRIVATE CodeAssembler {
   void UnregisterCallGenerationCallbacks();
 
   bool Word32ShiftIsSafe() const;
-  PoisoningMitigationLevel poisoning_enabled() const;
+  PoisoningMitigationLevel poisoning_level() const;
+
+  bool IsJSFunctionCall() const;
 
  private:
+  TNode<Object> CallRuntimeImpl(Runtime::FunctionId function,
+                                TNode<Object> context,
+                                std::initializer_list<TNode<Object>> args);
+
+  TNode<Object> CallRuntimeWithCEntryImpl(
+      Runtime::FunctionId function, TNode<Code> centry, TNode<Object> context,
+      std::initializer_list<TNode<Object>> args);
+
+  void TailCallRuntimeImpl(Runtime::FunctionId function, TNode<Int32T> arity,
+                           TNode<Object> context,
+                           std::initializer_list<TNode<Object>> args);
+
+  void TailCallRuntimeWithCEntryImpl(Runtime::FunctionId function,
+                                     TNode<Int32T> arity, TNode<Code> centry,
+                                     TNode<Object> context,
+                                     std::initializer_list<TNode<Object>> args);
+
+  void TailCallStubImpl(const CallInterfaceDescriptor& descriptor,
+                        TNode<Code> target, TNode<Object> context,
+                        std::initializer_list<Node*> args);
+
+  Node* TailCallStubThenBytecodeDispatchImpl(
+      const CallInterfaceDescriptor& descriptor, Node* target, Node* context,
+      std::initializer_list<Node*> args);
+
+  Node* CallStubRImpl(const CallInterfaceDescriptor& descriptor,
+                      size_t result_size, SloppyTNode<Code> target,
+                      SloppyTNode<Object> context,
+                      std::initializer_list<Node*> args);
+
   // These two don't have definitions and are here only for catching use cases
   // where the cast is not necessary.
   TNode<Int32T> Signed(TNode<Int32T> x);
@@ -1228,6 +1348,7 @@ class CodeAssemblerLabel {
   ~CodeAssemblerLabel();
 
   inline bool is_bound() const { return bound_; }
+  inline bool is_used() const { return merge_count_ != 0; }
 
  private:
   friend class CodeAssembler;
@@ -1258,15 +1379,14 @@ class V8_EXPORT_PRIVATE CodeAssemblerState {
   // TODO(rmcilroy): move result_size to the CallInterfaceDescriptor.
   CodeAssemblerState(Isolate* isolate, Zone* zone,
                      const CallInterfaceDescriptor& descriptor, Code::Kind kind,
-                     const char* name,
-                     PoisoningMitigationLevel poisoning_enabled,
-                     size_t result_size = 1, uint32_t stub_key = 0,
+                     const char* name, PoisoningMitigationLevel poisoning_level,
+                     uint32_t stub_key = 0,
                      int32_t builtin_index = Builtins::kNoBuiltinId);
 
   // Create with JSCall linkage.
   CodeAssemblerState(Isolate* isolate, Zone* zone, int parameter_count,
                      Code::Kind kind, const char* name,
-                     PoisoningMitigationLevel poisoning_enabled,
+                     PoisoningMitigationLevel poisoning_level,
                      int32_t builtin_index = Builtins::kNoBuiltinId);
 
   ~CodeAssemblerState();
@@ -1288,8 +1408,7 @@ class V8_EXPORT_PRIVATE CodeAssemblerState {
 
   CodeAssemblerState(Isolate* isolate, Zone* zone,
                      CallDescriptor* call_descriptor, Code::Kind kind,
-                     const char* name,
-                     PoisoningMitigationLevel poisoning_enabled,
+                     const char* name, PoisoningMitigationLevel poisoning_level,
                      uint32_t stub_key, int32_t builtin_index);
 
   std::unique_ptr<RawMachineAssembler> raw_assembler_;
diff --git a/deps/v8/src/compiler/code-generator.cc b/deps/v8/src/compiler/code-generator.cc
index f52347cd98ccdd..98620a0961dd40 100644
--- a/deps/v8/src/compiler/code-generator.cc
+++ b/deps/v8/src/compiler/code-generator.cc
@@ -13,6 +13,7 @@
 #include "src/compiler/wasm-compiler.h"
 #include "src/eh-frame.h"
 #include "src/frames.h"
+#include "src/lsan.h"
 #include "src/macro-assembler-inl.h"
 #include "src/optimized-compilation-info.h"
 
@@ -37,14 +38,13 @@ class CodeGenerator::JumpTable final : public ZoneObject {
   size_t const target_count_;
 };
 
-CodeGenerator::CodeGenerator(Zone* codegen_zone, Frame* frame, Linkage* linkage,
-                             InstructionSequence* code,
-                             OptimizedCompilationInfo* info, Isolate* isolate,
-                             base::Optional<OsrHelper> osr_helper,
-                             int start_source_position,
-                             JumpOptimizationInfo* jump_opt,
-                             WasmCompilationData* wasm_compilation_data,
-                             CodeGeneratorPoisoningLevel poisoning_level)
+CodeGenerator::CodeGenerator(
+    Zone* codegen_zone, Frame* frame, Linkage* linkage,
+    InstructionSequence* code, OptimizedCompilationInfo* info, Isolate* isolate,
+    base::Optional<OsrHelper> osr_helper, int start_source_position,
+    JumpOptimizationInfo* jump_opt, WasmCompilationData* wasm_compilation_data,
+    PoisoningMitigationLevel poisoning_level, const AssemblerOptions& options,
+    int32_t builtin_index)
     : zone_(codegen_zone),
       isolate_(isolate),
       frame_access_state_(nullptr),
@@ -56,7 +56,7 @@ CodeGenerator::CodeGenerator(Zone* codegen_zone, Frame* frame, Linkage* linkage,
       current_block_(RpoNumber::Invalid()),
       start_source_position_(start_source_position),
       current_source_position_(SourcePosition::Unknown()),
-      tasm_(isolate, nullptr, 0, CodeObjectRequired::kNo),
+      tasm_(isolate, options, nullptr, 0, CodeObjectRequired::kNo),
       resolver_(this),
       safepoints_(zone()),
       handlers_(zone()),
@@ -77,7 +77,9 @@ CodeGenerator::CodeGenerator(Zone* codegen_zone, Frame* frame, Linkage* linkage,
           SourcePositionTableBuilder::RECORD_SOURCE_POSITIONS),
       wasm_compilation_data_(wasm_compilation_data),
       result_(kSuccess),
-      poisoning_level_(poisoning_level) {
+      poisoning_level_(poisoning_level),
+      block_starts_(zone()),
+      instr_starts_(zone()) {
   for (int i = 0; i < code->InstructionBlockCount(); ++i) {
     new (&labels_[i]) Label;
   }
@@ -85,10 +87,12 @@ CodeGenerator::CodeGenerator(Zone* codegen_zone, Frame* frame, Linkage* linkage,
   CHECK_EQ(info->is_osr(), osr_helper_.has_value());
   tasm_.set_jump_optimization_info(jump_opt);
   Code::Kind code_kind = info_->code_kind();
-  if (code_kind == Code::JS_TO_WASM_FUNCTION ||
-      code_kind == Code::WASM_FUNCTION) {
-    tasm_.enable_serializer();
+  if (code_kind == Code::WASM_FUNCTION ||
+      code_kind == Code::WASM_TO_JS_FUNCTION ||
+      code_kind == Code::WASM_INTERPRETER_ENTRY) {
+    tasm_.set_trap_on_abort(true);
   }
+  tasm_.set_builtin_index(builtin_index);
 }
 
 bool CodeGenerator::wasm_runtime_exception_support() const {
@@ -110,31 +114,16 @@ void CodeGenerator::CreateFrameAccessState(Frame* frame) {
 CodeGenerator::CodeGenResult CodeGenerator::AssembleDeoptimizerCall(
     int deoptimization_id, SourcePosition pos) {
   DeoptimizeKind deopt_kind = GetDeoptimizationKind(deoptimization_id);
-  Deoptimizer::BailoutType bailout_type;
-  switch (deopt_kind) {
-    case DeoptimizeKind::kSoft: {
-      bailout_type = Deoptimizer::SOFT;
-      break;
-    }
-    case DeoptimizeKind::kEager: {
-      bailout_type = Deoptimizer::EAGER;
-      break;
-    }
-    case DeoptimizeKind::kLazy: {
-      bailout_type = Deoptimizer::LAZY;
-      break;
-    }
-    default: { UNREACHABLE(); }
-  }
   DeoptimizeReason deoptimization_reason =
       GetDeoptimizationReason(deoptimization_id);
   Address deopt_entry = Deoptimizer::GetDeoptimizationEntry(
-      tasm()->isolate(), deoptimization_id, bailout_type);
-  if (deopt_entry == nullptr) return kTooManyDeoptimizationBailouts;
+      tasm()->isolate(), deoptimization_id, deopt_kind);
+  if (deopt_entry == kNullAddress) return kTooManyDeoptimizationBailouts;
   if (info()->is_source_positions_enabled()) {
     tasm()->RecordDeoptReason(deoptimization_reason, pos, deoptimization_id);
   }
-  tasm()->CallForDeoptimization(deopt_entry, RelocInfo::RUNTIME_ENTRY);
+  tasm()->CallForDeoptimization(deopt_entry, deoptimization_id,
+                                RelocInfo::RUNTIME_ENTRY);
   return kSuccess;
 }
 
@@ -189,6 +178,10 @@ void CodeGenerator::AssembleCode() {
   unwinding_info_writer_.SetNumberOfInstructionBlocks(
       code()->InstructionBlockCount());
 
+  if (info->trace_turbo_json_enabled()) {
+    block_starts_.assign(code()->instruction_blocks().size(), -1);
+    instr_starts_.assign(code()->instructions().size(), -1);
+  }
   // Assemble all non-deferred blocks, followed by deferred ones.
   for (int deferred = 0; deferred < 2; ++deferred) {
     for (const InstructionBlock* block : code()->instruction_blocks()) {
@@ -200,13 +193,16 @@ void CodeGenerator::AssembleCode() {
       if (block->IsLoopHeader() && !tasm()->jump_optimization_info()) {
         tasm()->Align(16);
       }
+      if (info->trace_turbo_json_enabled()) {
+        block_starts_[block->rpo_number().ToInt()] = tasm()->pc_offset();
+      }
       // Bind a label for a block.
       current_block_ = block->rpo_number();
       unwinding_info_writer_.BeginInstructionBlock(tasm()->pc_offset(), block);
       if (FLAG_code_comments) {
-        // TODO(titzer): these code comments are a giant memory leak.
         Vector<char> buffer = Vector<char>::New(200);
         char* buffer_start = buffer.start();
+        LSAN_IGNORE_OBJECT(buffer_start);
 
         int next = SNPrintF(
             buffer, "-- B%d start%s%s%s%s", block->rpo_number().ToInt(),
@@ -286,7 +282,8 @@ void CodeGenerator::AssembleCode() {
       last_updated = safepoints()->UpdateDeoptimizationInfo(
           ds->pc_offset(), trampoline_pc, last_updated);
     }
-    AssembleDeoptimizerCall(deoptimization_id, exit->pos());
+    result_ = AssembleDeoptimizerCall(deoptimization_id, exit->pos());
+    if (result_ != kSuccess) return;
   }
 
   FinishCode();
@@ -352,14 +349,33 @@ void CodeGenerator::TryInsertBranchPoisoning(const InstructionBlock* block) {
   }
 }
 
-Handle<ByteArray> CodeGenerator::GetSourcePositionTable() {
-  return source_position_table_builder_.ToSourcePositionTable(isolate());
+void CodeGenerator::AssembleArchBinarySearchSwitchRange(
+    Register input, RpoNumber def_block, std::pair<int32_t, Label*>* begin,
+    std::pair<int32_t, Label*>* end) {
+  if (end - begin < kBinarySearchSwitchMinimalCases) {
+    while (begin != end) {
+      tasm()->JumpIfEqual(input, begin->first, begin->second);
+      ++begin;
+    }
+    AssembleArchJump(def_block);
+    return;
+  }
+  auto middle = begin + (end - begin) / 2;
+  Label less_label;
+  tasm()->JumpIfLessThan(input, middle->first, &less_label);
+  AssembleArchBinarySearchSwitchRange(input, def_block, middle, end);
+  tasm()->bind(&less_label);
+  AssembleArchBinarySearchSwitchRange(input, def_block, begin, middle);
+}
+
+OwnedVector<byte> CodeGenerator::GetSourcePositionTable() {
+  return source_position_table_builder_.ToSourcePositionTableVector();
 }
 
-Handle<Code> CodeGenerator::FinalizeCode() {
+MaybeHandle<Code> CodeGenerator::FinalizeCode() {
   if (result_ != kSuccess) {
     tasm()->AbortedCodeGeneration();
-    return Handle<Code>();
+    return MaybeHandle<Code>();
   }
 
   // Allocate the source position table.
@@ -376,19 +392,25 @@ Handle<Code> CodeGenerator::FinalizeCode() {
     unwinding_info_writer_.eh_frame_writer()->GetEhFrame(&desc);
   }
 
-  Handle<Code> result = isolate()->factory()->NewCode(
+  MaybeHandle<Code> maybe_code = isolate()->factory()->TryNewCode(
       desc, info()->code_kind(), Handle<Object>(), info()->builtin_index(),
       source_positions, deopt_data, kMovable, info()->stub_key(), true,
       frame()->GetTotalFrameSlotCount(), safepoints()->GetCodeOffset(),
       handler_table_offset_);
+
+  Handle<Code> code;
+  if (!maybe_code.ToHandle(&code)) {
+    tasm()->AbortedCodeGeneration();
+    return MaybeHandle<Code>();
+  }
   isolate()->counters()->total_compiled_code_size()->Increment(
-      result->raw_instruction_size());
+      code->raw_instruction_size());
 
   LOG_CODE_EVENT(isolate(),
-                 CodeLinePosInfoRecordEvent(result->raw_instruction_start(),
+                 CodeLinePosInfoRecordEvent(code->raw_instruction_start(),
                                             *source_positions));
 
-  return result;
+  return code;
 }
 
 
@@ -440,6 +462,9 @@ bool CodeGenerator::IsMaterializableFromRoot(
 CodeGenerator::CodeGenResult CodeGenerator::AssembleBlock(
     const InstructionBlock* block) {
   for (int i = block->code_start(); i < block->code_end(); ++i) {
+    if (info()->trace_turbo_json_enabled()) {
+      instr_starts_[i] = tasm()->pc_offset();
+    }
     Instruction* instr = code()->InstructionAt(i);
     CodeGenResult result = AssembleInstruction(instr, block);
     if (result != kSuccess) return result;
@@ -696,7 +721,9 @@ void CodeGenerator::AssembleSourcePosition(SourcePosition source_position) {
     if (info->IsStub()) return;
     std::ostringstream buffer;
     buffer << "-- ";
-    if (FLAG_trace_turbo || FLAG_trace_turbo_graph ||
+    // Turbolizer only needs the source position, as it can reconstruct
+    // the inlining stack from other information.
+    if (info->trace_turbo_json_enabled() ||
         tasm()->isolate()->concurrent_recompilation_enabled()) {
       buffer << source_position;
     } else {
@@ -706,7 +733,9 @@ void CodeGenerator::AssembleSourcePosition(SourcePosition source_position) {
       buffer << source_position.InliningStack(info);
     }
     buffer << " --";
-    tasm()->RecordComment(StrDup(buffer.str().c_str()));
+    char* str = StrDup(buffer.str().c_str());
+    LSAN_IGNORE_OBJECT(str);
+    tasm()->RecordComment(str);
   }
 }
 
@@ -721,6 +750,14 @@ bool CodeGenerator::GetSlotAboveSPBeforeTailCall(Instruction* instr,
   }
 }
 
+StubCallMode CodeGenerator::DetermineStubCallMode() const {
+  Code::Kind code_kind = info()->code_kind();
+  return (code_kind == Code::WASM_FUNCTION ||
+          code_kind == Code::WASM_TO_JS_FUNCTION)
+             ? StubCallMode::kCallWasmRuntimeStub
+             : StubCallMode::kCallOnHeapBuiltin;
+}
+
 void CodeGenerator::AssembleGaps(Instruction* instr) {
   for (int i = Instruction::FIRST_GAP_POSITION;
        i <= Instruction::LAST_GAP_POSITION; i++) {
@@ -1192,7 +1229,7 @@ DeoptimizationExit* CodeGenerator::AddDeoptimizationExit(
 }
 
 void CodeGenerator::InitializeSpeculationPoison() {
-  if (poisoning_level_ == CodeGeneratorPoisoningLevel::kDontPoison) return;
+  if (poisoning_level_ == PoisoningMitigationLevel::kDontPoison) return;
 
   // Initialize {kSpeculationPoisonRegister} either by comparing the expected
   // with the actual call target, or by unconditionally using {-1} initially.
@@ -1209,7 +1246,7 @@ void CodeGenerator::InitializeSpeculationPoison() {
 }
 
 void CodeGenerator::ResetSpeculationPoison() {
-  if (poisoning_level_ == CodeGeneratorPoisoningLevel::kPoisonAll) {
+  if (poisoning_level_ != PoisoningMitigationLevel::kDontPoison) {
     tasm()->ResetSpeculationPoisonRegister();
   }
 }
diff --git a/deps/v8/src/compiler/code-generator.h b/deps/v8/src/compiler/code-generator.h
index e33aed0d9be1bd..dcdb6bb806e330 100644
--- a/deps/v8/src/compiler/code-generator.h
+++ b/deps/v8/src/compiler/code-generator.h
@@ -74,12 +74,6 @@ class DeoptimizationLiteral {
   double number_;
 };
 
-enum class CodeGeneratorPoisoningLevel {
-  kDontPoison,
-  kPoisonStackPointerInPrologue,
-  kPoisonAll
-};
-
 // Generates native code for a sequence of instructions.
 class CodeGenerator final : public GapResolver::Assembler {
  public:
@@ -90,15 +84,17 @@ class CodeGenerator final : public GapResolver::Assembler {
                          int start_source_position,
                          JumpOptimizationInfo* jump_opt,
                          WasmCompilationData* wasm_compilation_data,
-                         CodeGeneratorPoisoningLevel poisoning_level);
+                         PoisoningMitigationLevel poisoning_level,
+                         const AssemblerOptions& options,
+                         int32_t builtin_index);
 
   // Generate native code. After calling AssembleCode, call FinalizeCode to
   // produce the actual code object. If an error occurs during either phase,
-  // FinalizeCode returns a null handle.
+  // FinalizeCode returns an empty MaybeHandle.
   void AssembleCode();  // Does not need to run on main thread.
-  Handle<Code> FinalizeCode();
+  MaybeHandle<Code> FinalizeCode();
 
-  Handle<ByteArray> GetSourcePositionTable();
+  OwnedVector<byte> GetSourcePositionTable();
 
   InstructionSequence* code() const { return code_; }
   FrameAccessState* frame_access_state() const { return frame_access_state_; }
@@ -129,6 +125,11 @@ class CodeGenerator final : public GapResolver::Assembler {
   size_t GetSafepointTableOffset() const { return safepoints_.GetCodeOffset(); }
   size_t GetHandlerTableOffset() const { return handler_table_offset_; }
 
+  const ZoneVector<int>& block_starts() const { return block_starts_; }
+  const ZoneVector<int>& instr_starts() const { return instr_starts_; }
+
+  static constexpr int kBinarySearchSwitchMinimalCases = 4;
+
  private:
   GapResolver* resolver() { return &resolver_; }
   SafepointTableBuilder* safepoints() { return &safepoints_; }
@@ -182,6 +183,9 @@ class CodeGenerator final : public GapResolver::Assembler {
   // adjusted stack pointer is returned in |slot|.
   bool GetSlotAboveSPBeforeTailCall(Instruction* instr, int* slot);
 
+  // Determines how to call helper stubs depending on the code kind.
+  StubCallMode DetermineStubCallMode() const;
+
   CodeGenResult AssembleDeoptimizerCall(int deoptimization_id,
                                         SourcePosition pos);
 
@@ -198,6 +202,10 @@ class CodeGenerator final : public GapResolver::Assembler {
 
   void AssembleArchBoolean(Instruction* instr, FlagsCondition condition);
   void AssembleArchTrap(Instruction* instr, FlagsCondition condition);
+  void AssembleArchBinarySearchSwitchRange(Register input, RpoNumber def_block,
+                                           std::pair<int32_t, Label*>* begin,
+                                           std::pair<int32_t, Label*>* end);
+  void AssembleArchBinarySearchSwitch(Instruction* instr);
   void AssembleArchLookupSwitch(Instruction* instr);
   void AssembleArchTableSwitch(Instruction* instr);
 
@@ -421,7 +429,9 @@ class CodeGenerator final : public GapResolver::Assembler {
   SourcePositionTableBuilder source_position_table_builder_;
   WasmCompilationData* wasm_compilation_data_;
   CodeGenResult result_;
-  CodeGeneratorPoisoningLevel poisoning_level_;
+  PoisoningMitigationLevel poisoning_level_;
+  ZoneVector<int> block_starts_;
+  ZoneVector<int> instr_starts_;
 };
 
 }  // namespace compiler
diff --git a/deps/v8/src/compiler/common-operator-reducer.cc b/deps/v8/src/compiler/common-operator-reducer.cc
index 388cc66c161a7e..76837d1fcad51f 100644
--- a/deps/v8/src/compiler/common-operator-reducer.cc
+++ b/deps/v8/src/compiler/common-operator-reducer.cc
@@ -19,7 +19,7 @@ namespace compiler {
 
 namespace {
 
-Decision DecideCondition(Node* const cond) {
+Decision DecideCondition(const JSHeapBroker* broker, Node* const cond) {
   switch (cond->opcode()) {
     case IrOpcode::kInt32Constant: {
       Int32Matcher mcond(cond);
@@ -27,7 +27,8 @@ Decision DecideCondition(Node* const cond) {
     }
     case IrOpcode::kHeapConstant: {
       HeapObjectMatcher mcond(cond);
-      return mcond.Value()->BooleanValue() ? Decision::kTrue : Decision::kFalse;
+      ObjectRef object(mcond.Value());
+      return object.BooleanValue(broker) ? Decision::kTrue : Decision::kFalse;
     }
     default:
       return Decision::kUnknown;
@@ -37,11 +38,13 @@ Decision DecideCondition(Node* const cond) {
 }  // namespace
 
 CommonOperatorReducer::CommonOperatorReducer(Editor* editor, Graph* graph,
+                                             const JSHeapBroker* js_heap_broker,
                                              CommonOperatorBuilder* common,
                                              MachineOperatorBuilder* machine,
                                              Zone* temp_zone)
     : AdvancedReducer(editor),
       graph_(graph),
+      js_heap_broker_(js_heap_broker),
       common_(common),
       machine_(machine),
       dead_(graph->NewNode(common->Dead())),
@@ -50,6 +53,7 @@ CommonOperatorReducer::CommonOperatorReducer(Editor* editor, Graph* graph,
 }
 
 Reduction CommonOperatorReducer::Reduce(Node* node) {
+  DisallowHeapAccess no_heap_access;
   switch (node->opcode()) {
     case IrOpcode::kBranch:
       return ReduceBranch(node);
@@ -85,8 +89,10 @@ Reduction CommonOperatorReducer::ReduceBranch(Node* node) {
   // not (i.e. true being returned in the false case and vice versa).
   if (cond->opcode() == IrOpcode::kBooleanNot ||
       (cond->opcode() == IrOpcode::kSelect &&
-       DecideCondition(cond->InputAt(1)) == Decision::kFalse &&
-       DecideCondition(cond->InputAt(2)) == Decision::kTrue)) {
+       DecideCondition(js_heap_broker(), cond->InputAt(1)) ==
+           Decision::kFalse &&
+       DecideCondition(js_heap_broker(), cond->InputAt(2)) ==
+           Decision::kTrue)) {
     for (Node* const use : node->uses()) {
       switch (use->opcode()) {
         case IrOpcode::kIfTrue:
@@ -108,7 +114,7 @@ Reduction CommonOperatorReducer::ReduceBranch(Node* node) {
         node, common()->Branch(NegateBranchHint(BranchHintOf(node->op()))));
     return Changed(node);
   }
-  Decision const decision = DecideCondition(cond);
+  Decision const decision = DecideCondition(js_heap_broker(), cond);
   if (decision == Decision::kUnknown) return NoChange();
   Node* const control = node->InputAt(1);
   for (Node* const use : node->uses()) {
@@ -148,7 +154,7 @@ Reduction CommonOperatorReducer::ReduceDeoptimizeConditional(Node* node) {
             : common()->DeoptimizeUnless(p.kind(), p.reason(), p.feedback()));
     return Changed(node);
   }
-  Decision const decision = DecideCondition(condition);
+  Decision const decision = DecideCondition(js_heap_broker(), condition);
   if (decision == Decision::kUnknown) return NoChange();
   if (condition_is_true == (decision == Decision::kTrue)) {
     ReplaceWithValue(node, dead(), effect, control);
@@ -381,7 +387,7 @@ Reduction CommonOperatorReducer::ReduceSelect(Node* node) {
   Node* const vtrue = node->InputAt(1);
   Node* const vfalse = node->InputAt(2);
   if (vtrue == vfalse) return Replace(vtrue);
-  switch (DecideCondition(cond)) {
+  switch (DecideCondition(js_heap_broker(), cond)) {
     case Decision::kTrue:
       return Replace(vtrue);
     case Decision::kFalse:
diff --git a/deps/v8/src/compiler/common-operator-reducer.h b/deps/v8/src/compiler/common-operator-reducer.h
index 022c4fbe8cd1a1..77a1d710841db9 100644
--- a/deps/v8/src/compiler/common-operator-reducer.h
+++ b/deps/v8/src/compiler/common-operator-reducer.h
@@ -25,6 +25,7 @@ class V8_EXPORT_PRIVATE CommonOperatorReducer final
     : public NON_EXPORTED_BASE(AdvancedReducer) {
  public:
   CommonOperatorReducer(Editor* editor, Graph* graph,
+                        const JSHeapBroker* js_heap_broker,
                         CommonOperatorBuilder* common,
                         MachineOperatorBuilder* machine, Zone* temp_zone);
   ~CommonOperatorReducer() final {}
@@ -47,11 +48,13 @@ class V8_EXPORT_PRIVATE CommonOperatorReducer final
   Reduction Change(Node* node, Operator const* op, Node* a, Node* b);
 
   Graph* graph() const { return graph_; }
+  const JSHeapBroker* js_heap_broker() const { return js_heap_broker_; }
   CommonOperatorBuilder* common() const { return common_; }
   MachineOperatorBuilder* machine() const { return machine_; }
   Node* dead() const { return dead_; }
 
   Graph* const graph_;
+  const JSHeapBroker* const js_heap_broker_;
   CommonOperatorBuilder* const common_;
   MachineOperatorBuilder* const machine_;
   Node* const dead_;
diff --git a/deps/v8/src/compiler/common-operator.cc b/deps/v8/src/compiler/common-operator.cc
index 7488e363054a76..253a92eb847241 100644
--- a/deps/v8/src/compiler/common-operator.cc
+++ b/deps/v8/src/compiler/common-operator.cc
@@ -31,6 +31,8 @@ std::ostream& operator<<(std::ostream& os, BranchHint hint) {
 
 std::ostream& operator<<(std::ostream& os, IsSafetyCheck is_safety_check) {
   switch (is_safety_check) {
+    case IsSafetyCheck::kCriticalSafetyCheck:
+      return os << "CriticalSafetyCheck";
     case IsSafetyCheck::kSafetyCheck:
       return os << "SafetyCheck";
     case IsSafetyCheck::kNoSafetyCheck:
@@ -39,6 +41,25 @@ std::ostream& operator<<(std::ostream& os, IsSafetyCheck is_safety_check) {
   UNREACHABLE();
 }
 
+std::ostream& operator<<(std::ostream& os, TrapId trap_id) {
+  switch (trap_id) {
+#define TRAP_CASE(Name) \
+  case TrapId::k##Name: \
+    return os << #Name;
+    FOREACH_WASM_TRAPREASON(TRAP_CASE)
+#undef TRAP_CASE
+    case TrapId::kInvalid:
+      return os << "Invalid";
+  }
+  UNREACHABLE();
+}
+
+TrapId TrapIdOf(const Operator* const op) {
+  DCHECK(op->opcode() == IrOpcode::kTrapIf ||
+         op->opcode() == IrOpcode::kTrapUnless);
+  return OpParameter<TrapId>(op);
+}
+
 std::ostream& operator<<(std::ostream& os, BranchOperatorInfo info) {
   return os << info.hint << "|" << info.is_safety_check;
 }
@@ -96,21 +117,20 @@ IsSafetyCheck IsSafetyCheckOf(const Operator* op) {
   return DeoptimizeParametersOf(op).is_safety_check();
 }
 
-const Operator* CommonOperatorBuilder::MarkAsSafetyCheck(const Operator* op) {
+const Operator* CommonOperatorBuilder::MarkAsSafetyCheck(
+    const Operator* op, IsSafetyCheck safety_check) {
   if (op->opcode() == IrOpcode::kBranch) {
     BranchOperatorInfo info = BranchOperatorInfoOf(op);
-    if (info.is_safety_check == IsSafetyCheck::kSafetyCheck) return op;
-    return Branch(info.hint, IsSafetyCheck::kSafetyCheck);
+    if (info.is_safety_check == safety_check) return op;
+    return Branch(info.hint, safety_check);
   }
   DeoptimizeParameters p = DeoptimizeParametersOf(op);
-  if (p.is_safety_check() == IsSafetyCheck::kSafetyCheck) return op;
+  if (p.is_safety_check() == safety_check) return op;
   switch (op->opcode()) {
     case IrOpcode::kDeoptimizeIf:
-      return DeoptimizeIf(p.kind(), p.reason(), p.feedback(),
-                          IsSafetyCheck::kSafetyCheck);
+      return DeoptimizeIf(p.kind(), p.reason(), p.feedback(), safety_check);
     case IrOpcode::kDeoptimizeUnless:
-      return DeoptimizeUnless(p.kind(), p.reason(), p.feedback(),
-                              IsSafetyCheck::kSafetyCheck);
+      return DeoptimizeUnless(p.kind(), p.reason(), p.feedback(), safety_check);
     default:
       UNREACHABLE();
   }
@@ -347,9 +367,9 @@ RegionObservability RegionObservabilityOf(Operator const* op) {
   return OpParameter<RegionObservability>(op);
 }
 
-Type* TypeGuardTypeOf(Operator const* op) {
+Type TypeGuardTypeOf(Operator const* op) {
   DCHECK_EQ(IrOpcode::kTypeGuard, op->opcode());
-  return OpParameter<Type*>(op);
+  return OpParameter<Type>(op);
 }
 
 std::ostream& operator<<(std::ostream& os,
@@ -430,12 +450,15 @@ IfValueParameters const& IfValueParametersOf(const Operator* op) {
   V(FinishRegion, Operator::kKontrol, 1, 1, 0, 1, 1, 0)                       \
   V(Retain, Operator::kKontrol, 1, 1, 0, 0, 1, 0)
 
-#define CACHED_BRANCH_LIST(V) \
-  V(None, SafetyCheck)        \
-  V(True, SafetyCheck)        \
-  V(False, SafetyCheck)       \
-  V(None, NoSafetyCheck)      \
-  V(True, NoSafetyCheck)      \
+#define CACHED_BRANCH_LIST(V)   \
+  V(None, CriticalSafetyCheck)  \
+  V(True, CriticalSafetyCheck)  \
+  V(False, CriticalSafetyCheck) \
+  V(None, SafetyCheck)          \
+  V(True, SafetyCheck)          \
+  V(False, SafetyCheck)         \
+  V(None, NoSafetyCheck)        \
+  V(True, NoSafetyCheck)        \
   V(False, NoSafetyCheck)
 
 #define CACHED_RETURN_LIST(V) \
@@ -738,35 +761,33 @@ struct CommonOperatorGlobalCache final {
   CACHED_DEOPTIMIZE_UNLESS_LIST(CACHED_DEOPTIMIZE_UNLESS)
 #undef CACHED_DEOPTIMIZE_UNLESS
 
-  template <int32_t trap_id>
-  struct TrapIfOperator final : public Operator1<int32_t> {
+  template <TrapId trap_id>
+  struct TrapIfOperator final : public Operator1<TrapId> {
     TrapIfOperator()
-        : Operator1<int32_t>(                            // --
+        : Operator1<TrapId>(                             // --
               IrOpcode::kTrapIf,                         // opcode
               Operator::kFoldable | Operator::kNoThrow,  // properties
               "TrapIf",                                  // name
               1, 1, 1, 0, 0, 1,                          // counts
               trap_id) {}                                // parameter
   };
-#define CACHED_TRAP_IF(Trap)                                       \
-  TrapIfOperator<static_cast<int32_t>(Builtins::kThrowWasm##Trap)> \
-      kTrapIf##Trap##Operator;
+#define CACHED_TRAP_IF(Trap) \
+  TrapIfOperator<TrapId::k##Trap> kTrapIf##Trap##Operator;
   CACHED_TRAP_IF_LIST(CACHED_TRAP_IF)
 #undef CACHED_TRAP_IF
 
-  template <int32_t trap_id>
-  struct TrapUnlessOperator final : public Operator1<int32_t> {
+  template <TrapId trap_id>
+  struct TrapUnlessOperator final : public Operator1<TrapId> {
     TrapUnlessOperator()
-        : Operator1<int32_t>(                            // --
+        : Operator1<TrapId>(                             // --
               IrOpcode::kTrapUnless,                     // opcode
               Operator::kFoldable | Operator::kNoThrow,  // properties
               "TrapUnless",                              // name
               1, 1, 1, 0, 0, 1,                          // counts
               trap_id) {}                                // parameter
   };
-#define CACHED_TRAP_UNLESS(Trap)                                       \
-  TrapUnlessOperator<static_cast<int32_t>(Builtins::kThrowWasm##Trap)> \
-      kTrapUnless##Trap##Operator;
+#define CACHED_TRAP_UNLESS(Trap) \
+  TrapUnlessOperator<TrapId::k##Trap> kTrapUnless##Trap##Operator;
   CACHED_TRAP_UNLESS_LIST(CACHED_TRAP_UNLESS)
 #undef CACHED_TRAP_UNLESS
 
@@ -969,10 +990,10 @@ const Operator* CommonOperatorBuilder::DeoptimizeUnless(
       parameter);                                       // parameter
 }
 
-const Operator* CommonOperatorBuilder::TrapIf(int32_t trap_id) {
+const Operator* CommonOperatorBuilder::TrapIf(TrapId trap_id) {
   switch (trap_id) {
-#define CACHED_TRAP_IF(Trap)       \
-  case Builtins::kThrowWasm##Trap: \
+#define CACHED_TRAP_IF(Trap) \
+  case TrapId::k##Trap:      \
     return &cache_.kTrapIf##Trap##Operator;
     CACHED_TRAP_IF_LIST(CACHED_TRAP_IF)
 #undef CACHED_TRAP_IF
@@ -980,7 +1001,7 @@ const Operator* CommonOperatorBuilder::TrapIf(int32_t trap_id) {
       break;
   }
   // Uncached
-  return new (zone()) Operator1<int>(            // --
+  return new (zone()) Operator1<TrapId>(         // --
       IrOpcode::kTrapIf,                         // opcode
       Operator::kFoldable | Operator::kNoThrow,  // properties
       "TrapIf",                                  // name
@@ -988,10 +1009,10 @@ const Operator* CommonOperatorBuilder::TrapIf(int32_t trap_id) {
       trap_id);                                  // parameter
 }
 
-const Operator* CommonOperatorBuilder::TrapUnless(int32_t trap_id) {
+const Operator* CommonOperatorBuilder::TrapUnless(TrapId trap_id) {
   switch (trap_id) {
-#define CACHED_TRAP_UNLESS(Trap)   \
-  case Builtins::kThrowWasm##Trap: \
+#define CACHED_TRAP_UNLESS(Trap) \
+  case TrapId::k##Trap:          \
     return &cache_.kTrapUnless##Trap##Operator;
     CACHED_TRAP_UNLESS_LIST(CACHED_TRAP_UNLESS)
 #undef CACHED_TRAP_UNLESS
@@ -999,7 +1020,7 @@ const Operator* CommonOperatorBuilder::TrapUnless(int32_t trap_id) {
       break;
   }
   // Uncached
-  return new (zone()) Operator1<int>(            // --
+  return new (zone()) Operator1<TrapId>(         // --
       IrOpcode::kTrapUnless,                     // opcode
       Operator::kFoldable | Operator::kNoThrow,  // properties
       "TrapUnless",                              // name
@@ -1227,8 +1248,8 @@ const Operator* CommonOperatorBuilder::Phi(MachineRepresentation rep,
       rep);                                              // parameter
 }
 
-const Operator* CommonOperatorBuilder::TypeGuard(Type* type) {
-  return new (zone()) Operator1<Type*>(       // --
+const Operator* CommonOperatorBuilder::TypeGuard(Type type) {
+  return new (zone()) Operator1<Type>(        // --
       IrOpcode::kTypeGuard, Operator::kPure,  // opcode
       "TypeGuard",                            // name
       1, 1, 1, 1, 1, 0,                       // counts
@@ -1516,6 +1537,17 @@ const FrameStateInfo& FrameStateInfoOf(const Operator* op) {
   return OpParameter<FrameStateInfo>(op);
 }
 
+IsSafetyCheck CombineSafetyChecks(IsSafetyCheck a, IsSafetyCheck b) {
+  if (a == IsSafetyCheck::kCriticalSafetyCheck ||
+      b == IsSafetyCheck::kCriticalSafetyCheck) {
+    return IsSafetyCheck::kCriticalSafetyCheck;
+  }
+  if (a == IsSafetyCheck::kSafetyCheck || b == IsSafetyCheck::kSafetyCheck) {
+    return IsSafetyCheck::kSafetyCheck;
+  }
+  return IsSafetyCheck::kNoSafetyCheck;
+}
+
 #undef COMMON_CACHED_OP_LIST
 #undef CACHED_BRANCH_LIST
 #undef CACHED_RETURN_LIST
diff --git a/deps/v8/src/compiler/common-operator.h b/deps/v8/src/compiler/common-operator.h
index 9bb941a8367517..23f1cdfc1db8a5 100644
--- a/deps/v8/src/compiler/common-operator.h
+++ b/deps/v8/src/compiler/common-operator.h
@@ -45,13 +45,33 @@ inline size_t hash_value(BranchHint hint) { return static_cast<size_t>(hint); }
 
 V8_EXPORT_PRIVATE std::ostream& operator<<(std::ostream&, BranchHint);
 
-enum class IsSafetyCheck : uint8_t { kSafetyCheck, kNoSafetyCheck };
+enum class IsSafetyCheck : uint8_t {
+  kCriticalSafetyCheck,
+  kSafetyCheck,
+  kNoSafetyCheck
+};
+
+// Get the more critical safety check of the two arguments.
+IsSafetyCheck CombineSafetyChecks(IsSafetyCheck, IsSafetyCheck);
 
 V8_EXPORT_PRIVATE std::ostream& operator<<(std::ostream&, IsSafetyCheck);
 inline size_t hash_value(IsSafetyCheck is_safety_check) {
   return static_cast<size_t>(is_safety_check);
 }
 
+enum class TrapId : uint32_t {
+#define DEF_ENUM(Name, ...) k##Name,
+  FOREACH_WASM_TRAPREASON(DEF_ENUM)
+#undef DEF_ENUM
+      kInvalid
+};
+
+inline size_t hash_value(TrapId id) { return static_cast<uint32_t>(id); }
+
+std::ostream& operator<<(std::ostream&, TrapId trap_id);
+
+TrapId TrapIdOf(const Operator* const op);
+
 struct BranchOperatorInfo {
   BranchHint hint;
   IsSafetyCheck is_safety_check;
@@ -347,7 +367,7 @@ RegionObservability RegionObservabilityOf(Operator const*)
 std::ostream& operator<<(std::ostream& os,
                          const ZoneVector<MachineType>* types);
 
-Type* TypeGuardTypeOf(Operator const*) V8_WARN_UNUSED_RESULT;
+Type TypeGuardTypeOf(Operator const*) V8_WARN_UNUSED_RESULT;
 
 int OsrValueIndexOf(Operator const*) V8_WARN_UNUSED_RESULT;
 
@@ -424,9 +444,8 @@ class V8_EXPORT_PRIVATE CommonOperatorBuilder final
   const Operator* DeadValue(MachineRepresentation rep);
   const Operator* Unreachable();
   const Operator* End(size_t control_input_count);
-  const Operator* Branch(
-      BranchHint = BranchHint::kNone,
-      IsSafetyCheck is_safety_check = IsSafetyCheck::kSafetyCheck);
+  const Operator* Branch(BranchHint = BranchHint::kNone,
+                         IsSafetyCheck = IsSafetyCheck::kSafetyCheck);
   const Operator* IfTrue();
   const Operator* IfFalse();
   const Operator* IfSuccess();
@@ -445,8 +464,8 @@ class V8_EXPORT_PRIVATE CommonOperatorBuilder final
       DeoptimizeKind kind, DeoptimizeReason reason,
       VectorSlotPair const& feedback,
       IsSafetyCheck is_safety_check = IsSafetyCheck::kSafetyCheck);
-  const Operator* TrapIf(int32_t trap_id);
-  const Operator* TrapUnless(int32_t trap_id);
+  const Operator* TrapIf(TrapId trap_id);
+  const Operator* TrapUnless(TrapId trap_id);
   const Operator* Return(int value_input_count = 1);
   const Operator* Terminate();
 
@@ -502,7 +521,7 @@ class V8_EXPORT_PRIVATE CommonOperatorBuilder final
   const Operator* TailCall(const CallDescriptor* call_descriptor);
   const Operator* Projection(size_t index);
   const Operator* Retain();
-  const Operator* TypeGuard(Type* type);
+  const Operator* TypeGuard(Type type);
 
   // Constructs a new merge or phi operator with the same opcode as {op}, but
   // with {size} inputs.
@@ -513,7 +532,8 @@ class V8_EXPORT_PRIVATE CommonOperatorBuilder final
       FrameStateType type, int parameter_count, int local_count,
       Handle<SharedFunctionInfo> shared_info);
 
-  const Operator* MarkAsSafetyCheck(const Operator* op);
+  const Operator* MarkAsSafetyCheck(const Operator* op,
+                                    IsSafetyCheck safety_check);
 
  private:
   Zone* zone() const { return zone_; }
diff --git a/deps/v8/src/compiler/compilation-dependencies.cc b/deps/v8/src/compiler/compilation-dependencies.cc
new file mode 100644
index 00000000000000..46481b4fb0e3f8
--- /dev/null
+++ b/deps/v8/src/compiler/compilation-dependencies.cc
@@ -0,0 +1,359 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "src/compiler/compilation-dependencies.h"
+
+#include "src/handles-inl.h"
+#include "src/objects-inl.h"
+
+namespace v8 {
+namespace internal {
+namespace compiler {
+
+CompilationDependencies::CompilationDependencies(Isolate* isolate, Zone* zone)
+    : isolate_(isolate), zone_(zone), dependencies_(zone) {}
+
+class CompilationDependencies::Dependency : public ZoneObject {
+ public:
+  virtual bool IsValid() const = 0;
+  virtual void Install(Isolate* isolate, Handle<WeakCell> code) = 0;
+};
+
+class InitialMapDependency final : public CompilationDependencies::Dependency {
+ public:
+  InitialMapDependency(Handle<JSFunction> function, Handle<Map> initial_map)
+      : function_(function), initial_map_(initial_map) {
+    DCHECK(IsValid());
+  }
+
+  bool IsValid() const override {
+    DisallowHeapAllocation no_heap_allocation;
+    DCHECK(function_->has_initial_map());
+    return *initial_map_ == function_->initial_map();
+  }
+
+  void Install(Isolate* isolate, Handle<WeakCell> code) override {
+    DCHECK(IsValid());
+    DependentCode::InstallDependency(isolate, code, initial_map_,
+                                     DependentCode::kInitialMapChangedGroup);
+  }
+
+ private:
+  Handle<JSFunction> function_;
+  Handle<Map> initial_map_;
+};
+
+class StableMapDependency final : public CompilationDependencies::Dependency {
+ public:
+  explicit StableMapDependency(Handle<Map> map) : map_(map) {
+    DCHECK(IsValid());
+  }
+
+  bool IsValid() const override {
+    DisallowHeapAllocation no_heap_allocation;
+    return map_->is_stable();
+  }
+
+  void Install(Isolate* isolate, Handle<WeakCell> code) override {
+    DCHECK(IsValid());
+    DependentCode::InstallDependency(isolate, code, map_,
+                                     DependentCode::kPrototypeCheckGroup);
+  }
+
+ private:
+  Handle<Map> map_;
+};
+
+class TransitionDependency final : public CompilationDependencies::Dependency {
+ public:
+  explicit TransitionDependency(Handle<Map> map) : map_(map) {
+    DCHECK(IsValid());
+  }
+
+  bool IsValid() const override {
+    DisallowHeapAllocation no_heap_allocation;
+    return !map_->is_deprecated();
+  }
+
+  void Install(Isolate* isolate, Handle<WeakCell> code) override {
+    DCHECK(IsValid());
+    DependentCode::InstallDependency(isolate, code, map_,
+                                     DependentCode::kTransitionGroup);
+  }
+
+ private:
+  Handle<Map> map_;
+};
+
+class PretenureModeDependency final
+    : public CompilationDependencies::Dependency {
+ public:
+  PretenureModeDependency(Handle<AllocationSite> site, PretenureFlag mode)
+      : site_(site), mode_(mode) {
+    DCHECK(IsValid());
+  }
+
+  bool IsValid() const override {
+    DisallowHeapAllocation no_heap_allocation;
+    return mode_ == site_->GetPretenureMode();
+  }
+
+  void Install(Isolate* isolate, Handle<WeakCell> code) override {
+    DCHECK(IsValid());
+    DependentCode::InstallDependency(
+        isolate, code, site_,
+        DependentCode::kAllocationSiteTenuringChangedGroup);
+  }
+
+ private:
+  Handle<AllocationSite> site_;
+  PretenureFlag mode_;
+};
+
+class FieldTypeDependency final : public CompilationDependencies::Dependency {
+ public:
+  FieldTypeDependency(Isolate* isolate, Handle<Map> owner, int descriptor,
+                      Handle<FieldType> type)
+      : isolate_(isolate), owner_(owner), descriptor_(descriptor), type_(type) {
+    DCHECK(IsValid());
+  }
+
+  bool IsValid() const override {
+    DisallowHeapAllocation no_heap_allocation;
+    CHECK_EQ(*owner_, owner_->FindFieldOwner(isolate_, descriptor_));
+    return *type_ == owner_->instance_descriptors()->GetFieldType(descriptor_);
+  }
+
+  void Install(Isolate* isolate, Handle<WeakCell> code) override {
+    DCHECK(IsValid());
+    DependentCode::InstallDependency(isolate, code, owner_,
+                                     DependentCode::kFieldOwnerGroup);
+  }
+
+ private:
+  Isolate* isolate_;
+  Handle<Map> owner_;
+  int descriptor_;
+  Handle<FieldType> type_;
+};
+
+class GlobalPropertyDependency final
+    : public CompilationDependencies::Dependency {
+ public:
+  GlobalPropertyDependency(Handle<PropertyCell> cell, PropertyCellType type,
+                           bool read_only)
+      : cell_(cell), type_(type), read_only_(read_only) {
+    DCHECK(IsValid());
+  }
+
+  bool IsValid() const override {
+    DisallowHeapAllocation no_heap_allocation;
+    return type_ == cell_->property_details().cell_type() &&
+           read_only_ == cell_->property_details().IsReadOnly();
+  }
+
+  void Install(Isolate* isolate, Handle<WeakCell> code) override {
+    DCHECK(IsValid());
+    DependentCode::InstallDependency(isolate, code, cell_,
+                                     DependentCode::kPropertyCellChangedGroup);
+  }
+
+ private:
+  Handle<PropertyCell> cell_;
+  PropertyCellType type_;
+  bool read_only_;
+};
+
+class ProtectorDependency final : public CompilationDependencies::Dependency {
+ public:
+  explicit ProtectorDependency(Handle<PropertyCell> cell) : cell_(cell) {
+    DCHECK(IsValid());
+  }
+
+  bool IsValid() const override {
+    DisallowHeapAllocation no_heap_allocation;
+    return cell_->value() == Smi::FromInt(Isolate::kProtectorValid);
+  }
+
+  void Install(Isolate* isolate, Handle<WeakCell> code) override {
+    DCHECK(IsValid());
+    DependentCode::InstallDependency(isolate, code, cell_,
+                                     DependentCode::kPropertyCellChangedGroup);
+  }
+
+ private:
+  Handle<PropertyCell> cell_;
+};
+
+class ElementsKindDependency final
+    : public CompilationDependencies::Dependency {
+ public:
+  ElementsKindDependency(Handle<AllocationSite> site, ElementsKind kind)
+      : site_(site), kind_(kind) {
+    DCHECK(IsValid());
+  }
+
+  bool IsValid() const override {
+    DisallowHeapAllocation no_heap_allocation;
+    DCHECK(AllocationSite::ShouldTrack(kind_));
+    ElementsKind kind = site_->PointsToLiteral()
+                            ? site_->boilerplate()->GetElementsKind()
+                            : site_->GetElementsKind();
+    return kind_ == kind;
+  }
+
+  void Install(Isolate* isolate, Handle<WeakCell> code) override {
+    DCHECK(IsValid());
+    DependentCode::InstallDependency(
+        isolate, code, site_,
+        DependentCode::kAllocationSiteTransitionChangedGroup);
+  }
+
+ private:
+  Handle<AllocationSite> site_;
+  ElementsKind kind_;
+};
+
+Handle<Map> CompilationDependencies::DependOnInitialMap(
+    Handle<JSFunction> function) {
+  Handle<Map> map(function->initial_map(), function->GetIsolate());
+  dependencies_.push_front(new (zone_) InitialMapDependency(function, map));
+  return map;
+}
+
+void CompilationDependencies::DependOnStableMap(Handle<Map> map) {
+  if (map->CanTransition()) {
+    dependencies_.push_front(new (zone_) StableMapDependency(map));
+  } else {
+    DCHECK(map->is_stable());
+  }
+}
+
+void CompilationDependencies::DependOnTransition(Handle<Map> target_map) {
+  if (target_map->CanBeDeprecated()) {
+    dependencies_.push_front(new (zone_) TransitionDependency(target_map));
+  } else {
+    DCHECK(!target_map->is_deprecated());
+  }
+}
+
+PretenureFlag CompilationDependencies::DependOnPretenureMode(
+    Handle<AllocationSite> site) {
+  PretenureFlag mode = site->GetPretenureMode();
+  dependencies_.push_front(new (zone_) PretenureModeDependency(site, mode));
+  return mode;
+}
+
+void CompilationDependencies::DependOnFieldType(Handle<Map> map,
+                                                int descriptor) {
+  Handle<Map> owner(map->FindFieldOwner(isolate_, descriptor), isolate_);
+  Handle<FieldType> type(
+      owner->instance_descriptors()->GetFieldType(descriptor), isolate_);
+  DCHECK_EQ(*type, map->instance_descriptors()->GetFieldType(descriptor));
+  dependencies_.push_front(
+      new (zone_) FieldTypeDependency(isolate_, owner, descriptor, type));
+}
+
+void CompilationDependencies::DependOnFieldType(const LookupIterator* it) {
+  Handle<Map> owner = it->GetFieldOwnerMap();
+  int descriptor = it->GetFieldDescriptorIndex();
+  Handle<FieldType> type = it->GetFieldType();
+  CHECK_EQ(*type,
+           it->GetHolder<Map>()->map()->instance_descriptors()->GetFieldType(
+               descriptor));
+  dependencies_.push_front(
+      new (zone_) FieldTypeDependency(isolate_, owner, descriptor, type));
+}
+
+void CompilationDependencies::DependOnGlobalProperty(
+    Handle<PropertyCell> cell) {
+  PropertyCellType type = cell->property_details().cell_type();
+  bool read_only = cell->property_details().IsReadOnly();
+  dependencies_.push_front(new (zone_)
+                               GlobalPropertyDependency(cell, type, read_only));
+}
+
+void CompilationDependencies::DependOnProtector(Handle<PropertyCell> cell) {
+  dependencies_.push_front(new (zone_) ProtectorDependency(cell));
+}
+
+void CompilationDependencies::DependOnElementsKind(
+    Handle<AllocationSite> site) {
+  // Do nothing if the object doesn't have any useful element transitions left.
+  ElementsKind kind = site->PointsToLiteral()
+                          ? site->boilerplate()->GetElementsKind()
+                          : site->GetElementsKind();
+  if (AllocationSite::ShouldTrack(kind)) {
+    dependencies_.push_front(new (zone_) ElementsKindDependency(site, kind));
+  }
+}
+
+bool CompilationDependencies::AreValid() const {
+  for (auto dep : dependencies_) {
+    if (!dep->IsValid()) return false;
+  }
+  return true;
+}
+
+bool CompilationDependencies::Commit(Handle<Code> code) {
+  // Check validity of all dependencies first, such that we can abort before
+  // installing anything.
+  if (!AreValid()) {
+    dependencies_.clear();
+    return false;
+  }
+
+  Handle<WeakCell> cell = Code::WeakCellFor(code);
+  for (auto dep : dependencies_) {
+    dep->Install(isolate_, cell);
+  }
+  dependencies_.clear();
+  return true;
+}
+
+namespace {
+void DependOnStablePrototypeChain(CompilationDependencies* deps,
+                                  Handle<Map> map,
+                                  MaybeHandle<JSReceiver> last_prototype) {
+  for (PrototypeIterator i(map); !i.IsAtEnd(); i.Advance()) {
+    Handle<JSReceiver> const current =
+        PrototypeIterator::GetCurrent<JSReceiver>(i);
+    deps->DependOnStableMap(handle(current->map(), current->GetIsolate()));
+    Handle<JSReceiver> last;
+    if (last_prototype.ToHandle(&last) && last.is_identical_to(current)) {
+      break;
+    }
+  }
+}
+}  // namespace
+
+void CompilationDependencies::DependOnStablePrototypeChains(
+    Handle<Context> native_context,
+    std::vector<Handle<Map>> const& receiver_maps, Handle<JSObject> holder) {
+  // Determine actual holder and perform prototype chain checks.
+  for (auto map : receiver_maps) {
+    // Perform the implicit ToObject for primitives here.
+    // Implemented according to ES6 section 7.3.2 GetV (V, P).
+    Handle<JSFunction> constructor;
+    if (Map::GetConstructorFunction(map, native_context)
+            .ToHandle(&constructor)) {
+      map = handle(constructor->initial_map(), isolate_);
+    }
+    DependOnStablePrototypeChain(this, map, holder);
+  }
+}
+
+void CompilationDependencies::DependOnElementsKinds(
+    Handle<AllocationSite> site) {
+  while (true) {
+    DependOnElementsKind(site);
+    if (!site->nested_site()->IsAllocationSite()) break;
+    site = handle(AllocationSite::cast(site->nested_site()), isolate_);
+  }
+  CHECK_EQ(site->nested_site(), Smi::kZero);
+}
+
+}  // namespace compiler
+}  // namespace internal
+}  // namespace v8
diff --git a/deps/v8/src/compiler/compilation-dependencies.h b/deps/v8/src/compiler/compilation-dependencies.h
new file mode 100644
index 00000000000000..3438bfaf271cb1
--- /dev/null
+++ b/deps/v8/src/compiler/compilation-dependencies.h
@@ -0,0 +1,77 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef V8_COMPILER_COMPILATION_DEPENDENCIES_H_
+#define V8_COMPILER_COMPILATION_DEPENDENCIES_H_
+
+#include "src/objects.h"
+#include "src/zone/zone-containers.h"
+
+namespace v8 {
+namespace internal {
+namespace compiler {
+
+// Collects and installs dependencies of the code that is being generated.
+class V8_EXPORT_PRIVATE CompilationDependencies : public ZoneObject {
+ public:
+  CompilationDependencies(Isolate* isolate, Zone* zone);
+
+  V8_WARN_UNUSED_RESULT bool Commit(Handle<Code> code);
+
+  // Return the initial map of {function} and record the assumption that it
+  // stays the intial map.
+  Handle<Map> DependOnInitialMap(Handle<JSFunction> function);
+
+  // Record the assumption that {map} stays stable.
+  void DependOnStableMap(Handle<Map> map);
+
+  // Record the assumption that {target_map} can be transitioned to, i.e., that
+  // it does not become deprecated.
+  void DependOnTransition(Handle<Map> target_map);
+
+  // Return the pretenure mode of {site} and record the assumption that it does
+  // not change.
+  PretenureFlag DependOnPretenureMode(Handle<AllocationSite> site);
+
+  // Record the assumption that the field type of a field does not change. The
+  // field is identified by the argument(s).
+  void DependOnFieldType(Handle<Map> map, int descriptor);
+  void DependOnFieldType(const LookupIterator* it);
+
+  // Record the assumption that neither {cell}'s {CellType} changes, nor the
+  // {IsReadOnly()} flag of {cell}'s {PropertyDetails}.
+  void DependOnGlobalProperty(Handle<PropertyCell> cell);
+
+  // Record the assumption that the protector remains valid.
+  void DependOnProtector(Handle<PropertyCell> cell);
+
+  // Record the assumption that {site}'s {ElementsKind} doesn't change.
+  void DependOnElementsKind(Handle<AllocationSite> site);
+
+  // Depend on the stability of (the maps of) all prototypes of every class in
+  // {receiver_type} up to (and including) the {holder}.
+  void DependOnStablePrototypeChains(
+      Handle<Context> native_context,
+      std::vector<Handle<Map>> const& receiver_maps, Handle<JSObject> holder);
+
+  // Like DependOnElementsKind but also applies to all nested allocation sites.
+  void DependOnElementsKinds(Handle<AllocationSite> site);
+
+  // Exposed only for testing purposes.
+  bool AreValid() const;
+
+  // Exposed only because C++.
+  class Dependency;
+
+ private:
+  Isolate* isolate_;
+  Zone* zone_;
+  ZoneForwardList<Dependency*> dependencies_;
+};
+
+}  // namespace compiler
+}  // namespace internal
+}  // namespace v8
+
+#endif  // V8_COMPILER_COMPILATION_DEPENDENCIES_H_
diff --git a/deps/v8/src/compiler/compiler-source-position-table.cc b/deps/v8/src/compiler/compiler-source-position-table.cc
index c5520e7407638d..a7e23194102525 100644
--- a/deps/v8/src/compiler/compiler-source-position-table.cc
+++ b/deps/v8/src/compiler/compiler-source-position-table.cc
@@ -51,7 +51,7 @@ void SourcePositionTable::SetSourcePosition(Node* node,
   table_.Set(node, position);
 }
 
-void SourcePositionTable::Print(std::ostream& os) const {
+void SourcePositionTable::PrintJson(std::ostream& os) const {
   os << "{";
   bool needs_comma = false;
   for (auto i : table_) {
@@ -60,8 +60,8 @@ void SourcePositionTable::Print(std::ostream& os) const {
       if (needs_comma) {
         os << ",";
       }
-      os << "\"" << i.first << "\""
-         << ":" << pos.ScriptOffset();
+      os << "\"" << i.first << "\" : ";
+      pos.PrintJson(os);
       needs_comma = true;
     }
   }
diff --git a/deps/v8/src/compiler/compiler-source-position-table.h b/deps/v8/src/compiler/compiler-source-position-table.h
index 4d14ae28113bd4..e0314f5556586b 100644
--- a/deps/v8/src/compiler/compiler-source-position-table.h
+++ b/deps/v8/src/compiler/compiler-source-position-table.h
@@ -53,7 +53,7 @@ class V8_EXPORT_PRIVATE SourcePositionTable final
     current_position_ = pos;
   }
 
-  void Print(std::ostream& os) const;
+  void PrintJson(std::ostream& os) const;
 
  private:
   class Decorator;
diff --git a/deps/v8/src/compiler/constant-folding-reducer.cc b/deps/v8/src/compiler/constant-folding-reducer.cc
new file mode 100644
index 00000000000000..29d93ee073d3d1
--- /dev/null
+++ b/deps/v8/src/compiler/constant-folding-reducer.cc
@@ -0,0 +1,70 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "src/compiler/constant-folding-reducer.h"
+
+#include "src/compiler/js-graph.h"
+#include "src/objects-inl.h"
+
+namespace v8 {
+namespace internal {
+namespace compiler {
+
+ConstantFoldingReducer::ConstantFoldingReducer(
+    Editor* editor, JSGraph* jsgraph, const JSHeapBroker* js_heap_broker)
+    : AdvancedReducer(editor),
+      jsgraph_(jsgraph),
+      js_heap_broker_(js_heap_broker) {}
+
+ConstantFoldingReducer::~ConstantFoldingReducer() {}
+
+Reduction ConstantFoldingReducer::Reduce(Node* node) {
+  DisallowHeapAccess no_heap_access;
+  // Check if the output type is a singleton.  In that case we already know the
+  // result value and can simply replace the node if it's eliminable.
+  if (!NodeProperties::IsConstant(node) && NodeProperties::IsTyped(node) &&
+      node->op()->HasProperty(Operator::kEliminatable)) {
+    // TODO(v8:5303): We must not eliminate FinishRegion here. This special
+    // case can be removed once we have separate operators for value and
+    // effect regions.
+    if (node->opcode() == IrOpcode::kFinishRegion) return NoChange();
+    // We can only constant-fold nodes here, that are known to not cause any
+    // side-effect, may it be a JavaScript observable side-effect or a possible
+    // eager deoptimization exit (i.e. {node} has an operator that doesn't have
+    // the Operator::kNoDeopt property).
+    Type upper = NodeProperties::GetType(node);
+    if (!upper.IsNone()) {
+      Node* replacement = nullptr;
+      if (upper.IsHeapConstant()) {
+        replacement = jsgraph()->Constant(js_heap_broker(),
+                                          upper.AsHeapConstant()->Ref());
+      } else if (upper.Is(Type::MinusZero())) {
+        Factory* factory = jsgraph()->isolate()->factory();
+        ObjectRef minus_zero(factory->minus_zero_value());
+        replacement = jsgraph()->Constant(js_heap_broker(), minus_zero);
+      } else if (upper.Is(Type::NaN())) {
+        replacement = jsgraph()->NaNConstant();
+      } else if (upper.Is(Type::Null())) {
+        replacement = jsgraph()->NullConstant();
+      } else if (upper.Is(Type::PlainNumber()) && upper.Min() == upper.Max()) {
+        replacement = jsgraph()->Constant(upper.Min());
+      } else if (upper.Is(Type::Undefined())) {
+        replacement = jsgraph()->UndefinedConstant();
+      }
+      if (replacement) {
+        // Make sure the node has a type.
+        if (!NodeProperties::IsTyped(replacement)) {
+          NodeProperties::SetType(replacement, upper);
+        }
+        ReplaceWithValue(node, replacement);
+        return Changed(replacement);
+      }
+    }
+  }
+  return NoChange();
+}
+
+}  // namespace compiler
+}  // namespace internal
+}  // namespace v8
diff --git a/deps/v8/src/compiler/constant-folding-reducer.h b/deps/v8/src/compiler/constant-folding-reducer.h
new file mode 100644
index 00000000000000..b111e5b87899a0
--- /dev/null
+++ b/deps/v8/src/compiler/constant-folding-reducer.h
@@ -0,0 +1,42 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef V8_COMPILER_CONSTANT_FOLDING_REDUCER_H_
+#define V8_COMPILER_CONSTANT_FOLDING_REDUCER_H_
+
+#include "src/compiler/graph-reducer.h"
+
+namespace v8 {
+namespace internal {
+namespace compiler {
+
+// Forward declarations.
+class JSGraph;
+
+class V8_EXPORT_PRIVATE ConstantFoldingReducer final
+    : public NON_EXPORTED_BASE(AdvancedReducer) {
+ public:
+  ConstantFoldingReducer(Editor* editor, JSGraph* jsgraph,
+                         const JSHeapBroker* js_heap_broker);
+  ~ConstantFoldingReducer() final;
+
+  const char* reducer_name() const override { return "ConstantFoldingReducer"; }
+
+  Reduction Reduce(Node* node) final;
+
+ private:
+  JSGraph* jsgraph() const { return jsgraph_; }
+  const JSHeapBroker* js_heap_broker() const { return js_heap_broker_; }
+
+  JSGraph* const jsgraph_;
+  const JSHeapBroker* const js_heap_broker_;
+
+  DISALLOW_COPY_AND_ASSIGN(ConstantFoldingReducer);
+};
+
+}  // namespace compiler
+}  // namespace internal
+}  // namespace v8
+
+#endif  // V8_COMPILER_CONSTANT_FOLDING_REDUCER_H_
diff --git a/deps/v8/src/compiler/dead-code-elimination.cc b/deps/v8/src/compiler/dead-code-elimination.cc
index 6c54f2b0361922..424db00fc4ba1e 100644
--- a/deps/v8/src/compiler/dead-code-elimination.cc
+++ b/deps/v8/src/compiler/dead-code-elimination.cc
@@ -33,7 +33,7 @@ bool NoReturn(Node* node) {
   return node->opcode() == IrOpcode::kDead ||
          node->opcode() == IrOpcode::kUnreachable ||
          node->opcode() == IrOpcode::kDeadValue ||
-         NodeProperties::GetTypeOrAny(node)->IsNone();
+         NodeProperties::GetTypeOrAny(node).IsNone();
 }
 
 Node* FindDeadInput(Node* node) {
@@ -46,6 +46,7 @@ Node* FindDeadInput(Node* node) {
 }  // namespace
 
 Reduction DeadCodeElimination::Reduce(Node* node) {
+  DisallowHeapAccess no_heap_access;
   switch (node->opcode()) {
     case IrOpcode::kEnd:
       return ReduceEnd(node);
@@ -217,7 +218,7 @@ Reduction DeadCodeElimination::ReducePhi(Node* node) {
   if (reduction.Changed()) return reduction;
   MachineRepresentation rep = PhiRepresentationOf(node->op());
   if (rep == MachineRepresentation::kNone ||
-      NodeProperties::GetTypeOrAny(node)->IsNone()) {
+      NodeProperties::GetTypeOrAny(node).IsNone()) {
     return Replace(DeadValue(node, rep));
   }
   int input_count = node->op()->ValueInputCount();
diff --git a/deps/v8/src/compiler/diamond.h b/deps/v8/src/compiler/diamond.h
index e1333052d745bb..cc6ca954f3d92e 100644
--- a/deps/v8/src/compiler/diamond.h
+++ b/deps/v8/src/compiler/diamond.h
@@ -52,6 +52,10 @@ struct Diamond {
   Node* Phi(MachineRepresentation rep, Node* tv, Node* fv) {
     return graph->NewNode(common->Phi(rep, 2), tv, fv, merge);
   }
+
+  Node* EffectPhi(Node* tv, Node* fv) {
+    return graph->NewNode(common->EffectPhi(2), tv, fv, merge);
+  }
 };
 
 }  // namespace compiler
diff --git a/deps/v8/src/compiler/effect-control-linearizer.cc b/deps/v8/src/compiler/effect-control-linearizer.cc
index 52cbefb15cf092..a67fa6ab903983 100644
--- a/deps/v8/src/compiler/effect-control-linearizer.cc
+++ b/deps/v8/src/compiler/effect-control-linearizer.cc
@@ -10,6 +10,7 @@
 #include "src/compiler/js-graph.h"
 #include "src/compiler/linkage.h"
 #include "src/compiler/node-matchers.h"
+#include "src/compiler/node-origin-table.h"
 #include "src/compiler/node-properties.h"
 #include "src/compiler/node.h"
 #include "src/compiler/schedule.h"
@@ -21,13 +22,14 @@ namespace compiler {
 
 EffectControlLinearizer::EffectControlLinearizer(
     JSGraph* js_graph, Schedule* schedule, Zone* temp_zone,
-    SourcePositionTable* source_positions,
+    SourcePositionTable* source_positions, NodeOriginTable* node_origins,
     MaskArrayIndexEnable mask_array_index)
     : js_graph_(js_graph),
       schedule_(schedule),
       temp_zone_(temp_zone),
       mask_array_index_(mask_array_index),
       source_positions_(source_positions),
+      node_origins_(node_origins),
       graph_assembler_(js_graph, nullptr, nullptr, temp_zone),
       frame_state_zapper_(nullptr) {}
 
@@ -167,7 +169,8 @@ void RemoveRenameNode(Node* node) {
 void TryCloneBranch(Node* node, BasicBlock* block, Zone* temp_zone,
                     Graph* graph, CommonOperatorBuilder* common,
                     BlockEffectControlMap* block_effects,
-                    SourcePositionTable* source_positions) {
+                    SourcePositionTable* source_positions,
+                    NodeOriginTable* node_origins) {
   DCHECK_EQ(IrOpcode::kBranch, node->opcode());
 
   // This optimization is a special case of (super)block cloning. It takes an
@@ -221,6 +224,7 @@ void TryCloneBranch(Node* node, BasicBlock* block, Zone* temp_zone,
 
   SourcePositionTable::Scope scope(source_positions,
                                    source_positions->GetSourcePosition(node));
+  NodeOriginTable::Scope origin_scope(node_origins, "clone branch", node);
   Node* branch = node;
   Node* cond = NodeProperties::GetValueInput(branch, 0);
   if (!cond->OwnedBy(branch) || cond->opcode() != IrOpcode::kPhi) return;
@@ -484,7 +488,8 @@ void EffectControlLinearizer::Run() {
       case BasicBlock::kBranch:
         ProcessNode(block->control_input(), &frame_state, &effect, &control);
         TryCloneBranch(block->control_input(), block, temp_zone(), graph(),
-                       common(), &block_effects, source_positions_);
+                       common(), &block_effects, source_positions_,
+                       node_origins_);
         break;
     }
 
@@ -516,6 +521,7 @@ void EffectControlLinearizer::ProcessNode(Node* node, Node** frame_state,
                                           Node** effect, Node** control) {
   SourcePositionTable::Scope scope(source_positions_,
                                    source_positions_->GetSourcePosition(node));
+  NodeOriginTable::Scope origin_scope(node_origins_, "process node", node);
 
   // If the node needs to be wired into the effect/control chain, do this
   // here. Pass current frame state for lowering to eager deoptimization.
@@ -661,8 +667,8 @@ bool EffectControlLinearizer::TryWireInStateEffect(Node* node,
     case IrOpcode::kCheckBounds:
       result = LowerCheckBounds(node, frame_state);
       break;
-    case IrOpcode::kMaskIndexWithBound:
-      result = LowerMaskIndexWithBound(node);
+    case IrOpcode::kPoisonIndex:
+      result = LowerPoisonIndex(node);
       break;
     case IrOpcode::kCheckMaps:
       LowerCheckMaps(node, frame_state);
@@ -770,6 +776,9 @@ bool EffectControlLinearizer::TryWireInStateEffect(Node* node,
     case IrOpcode::kObjectIsNaN:
       result = LowerObjectIsNaN(node);
       break;
+    case IrOpcode::kNumberIsNaN:
+      result = LowerNumberIsNaN(node);
+      break;
     case IrOpcode::kObjectIsNonCallable:
       result = LowerObjectIsNonCallable(node);
       break;
@@ -926,9 +935,15 @@ bool EffectControlLinearizer::TryWireInStateEffect(Node* node,
     case IrOpcode::kLoadTypedElement:
       result = LowerLoadTypedElement(node);
       break;
+    case IrOpcode::kLoadDataViewElement:
+      result = LowerLoadDataViewElement(node);
+      break;
     case IrOpcode::kStoreTypedElement:
       LowerStoreTypedElement(node);
       break;
+    case IrOpcode::kStoreDataViewElement:
+      LowerStoreDataViewElement(node);
+      break;
     case IrOpcode::kStoreSignedSmallElement:
       LowerStoreSignedSmallElement(node);
       break;
@@ -973,6 +988,9 @@ bool EffectControlLinearizer::TryWireInStateEffect(Node* node,
         return false;
       }
       break;
+    case IrOpcode::kDateNow:
+      result = LowerDateNow(node);
+      break;
     default:
       return false;
   }
@@ -1026,14 +1044,16 @@ Node* EffectControlLinearizer::LowerChangeFloat64ToTagged(Node* node) {
       __ Bind(&if_smi);
     }
 
-    if (machine()->Is64()) {
+    if (SmiValuesAre32Bits()) {
       Node* value_smi = ChangeInt32ToSmi(value32);
       __ Goto(&done, value_smi);
     } else {
+      DCHECK(SmiValuesAre31Bits());
       Node* add = __ Int32AddWithOverflow(value32, value32);
       Node* ovf = __ Projection(1, add);
       __ GotoIf(ovf, &if_heapnumber);
       Node* value_smi = __ Projection(0, add);
+      value_smi = ChangeInt32ToIntPtr(value_smi);
       __ Goto(&done, value_smi);
     }
   }
@@ -1077,9 +1097,10 @@ Node* EffectControlLinearizer::LowerChangeInt31ToTaggedSigned(Node* node) {
 Node* EffectControlLinearizer::LowerChangeInt32ToTagged(Node* node) {
   Node* value = node->InputAt(0);
 
-  if (machine()->Is64()) {
+  if (SmiValuesAre32Bits()) {
     return ChangeInt32ToSmi(value);
   }
+  DCHECK(SmiValuesAre31Bits());
 
   auto if_overflow = __ MakeDeferredLabel();
   auto done = __ MakeLabel(MachineRepresentation::kTagged);
@@ -1087,7 +1108,9 @@ Node* EffectControlLinearizer::LowerChangeInt32ToTagged(Node* node) {
   Node* add = __ Int32AddWithOverflow(value, value);
   Node* ovf = __ Projection(1, add);
   __ GotoIf(ovf, &if_overflow);
-  __ Goto(&done, __ Projection(0, add));
+  Node* value_smi = __ Projection(0, add);
+  value_smi = ChangeInt32ToIntPtr(value_smi);
+  __ Goto(&done, value_smi);
 
   __ Bind(&if_overflow);
   Node* number = AllocateHeapNumberWithValue(__ ChangeInt32ToFloat64(value));
@@ -1310,22 +1333,14 @@ Node* EffectControlLinearizer::LowerCheckBounds(Node* node, Node* frame_state) {
 
   Node* check = __ Uint32LessThan(index, limit);
   __ DeoptimizeIfNot(DeoptimizeReason::kOutOfBounds, params.feedback(), check,
-                     frame_state);
+                     frame_state, IsSafetyCheck::kCriticalSafetyCheck);
   return index;
 }
 
-Node* EffectControlLinearizer::LowerMaskIndexWithBound(Node* node) {
+Node* EffectControlLinearizer::LowerPoisonIndex(Node* node) {
   Node* index = node->InputAt(0);
   if (mask_array_index_ == kMaskArrayIndex) {
-    Node* limit = node->InputAt(1);
-
-    // mask = ((index - limit) & ~index) >> 31
-    // index = index & mask
-    Node* neg_index = __ Word32Xor(index, __ Int32Constant(-1));
-    Node* mask =
-        __ Word32Sar(__ Word32And(__ Int32Sub(index, limit), neg_index),
-                     __ Int32Constant(31));
-    index = __ Word32And(index, mask);
+    index = __ Word32PoisonOnSpeculation(index);
   }
   return index;
 }
@@ -1373,10 +1388,9 @@ void EffectControlLinearizer::LowerCheckMaps(Node* node, Node* frame_state) {
       Runtime::FunctionId id = Runtime::kTryMigrateInstance;
       auto call_descriptor = Linkage::GetRuntimeCallDescriptor(
           graph()->zone(), id, 1, properties, CallDescriptor::kNoFlags);
-      Node* result =
-          __ Call(call_descriptor, __ CEntryStubConstant(1), value,
-                  __ ExternalConstant(ExternalReference(id, isolate())),
-                  __ Int32Constant(1), __ NoContextConstant());
+      Node* result = __ Call(call_descriptor, __ CEntryStubConstant(1), value,
+                             __ ExternalConstant(ExternalReference::Create(id)),
+                             __ Int32Constant(1), __ NoContextConstant());
       Node* check = ObjectIsSmi(result);
       __ DeoptimizeIf(DeoptimizeReason::kInstanceMigrationFailed, p.feedback(),
                       check, frame_state);
@@ -1526,8 +1540,8 @@ Node* EffectControlLinearizer::LowerCheckInternalizedString(Node* node,
 
 void EffectControlLinearizer::LowerCheckIf(Node* node, Node* frame_state) {
   Node* value = node->InputAt(0);
-  __ DeoptimizeIfNot(DeoptimizeKind::kEager, DeoptimizeReasonOf(node->op()),
-                     VectorSlotPair(), value, frame_state);
+  const CheckIfParameters& p = CheckIfParametersOf(node->op());
+  __ DeoptimizeIfNot(p.reason(), p.feedback(), value, frame_state);
 }
 
 Node* EffectControlLinearizer::LowerCheckedInt32Add(Node* node,
@@ -1786,7 +1800,9 @@ Node* EffectControlLinearizer::LowerCheckedInt32ToTaggedSigned(
   Node* check = __ Projection(1, add);
   __ DeoptimizeIf(DeoptimizeReason::kOverflow, params.feedback(), check,
                   frame_state);
-  return __ Projection(0, add);
+  Node* result = __ Projection(0, add);
+  result = ChangeInt32ToIntPtr(result);
+  return result;
 }
 
 Node* EffectControlLinearizer::LowerCheckedUint32ToInt32(Node* node,
@@ -2032,7 +2048,7 @@ Node* EffectControlLinearizer::LowerNumberToString(Node* node) {
   Operator::Properties properties = Operator::kEliminatable;
   CallDescriptor::Flags flags = CallDescriptor::kNoFlags;
   auto call_descriptor = Linkage::GetStubCallDescriptor(
-      isolate(), graph()->zone(), callable.descriptor(), 0, flags, properties);
+      graph()->zone(), callable.descriptor(), 0, flags, properties);
   return __ Call(call_descriptor, __ HeapConstant(callable.code()), argument,
                  __ NoContextConstant());
 }
@@ -2327,6 +2343,13 @@ Node* EffectControlLinearizer::LowerObjectIsNaN(Node* node) {
   return done.PhiAt(0);
 }
 
+Node* EffectControlLinearizer::LowerNumberIsNaN(Node* node) {
+  Node* number = node->InputAt(0);
+  Node* diff = __ Float64Equal(number, number);
+  Node* check = __ Word32Equal(diff, __ Int32Constant(0));
+  return check;
+}
+
 Node* EffectControlLinearizer::LowerObjectIsNonCallable(Node* node) {
   Node* value = node->InputAt(0);
 
@@ -2481,7 +2504,7 @@ Node* EffectControlLinearizer::LowerTypeOf(Node* node) {
   Operator::Properties const properties = Operator::kEliminatable;
   CallDescriptor::Flags const flags = CallDescriptor::kNoAllocate;
   auto call_descriptor = Linkage::GetStubCallDescriptor(
-      isolate(), graph()->zone(), callable.descriptor(), 0, flags, properties);
+      graph()->zone(), callable.descriptor(), 0, flags, properties);
   return __ Call(call_descriptor, __ HeapConstant(callable.code()), obj,
                  __ NoContextConstant());
 }
@@ -2493,7 +2516,7 @@ Node* EffectControlLinearizer::LowerToBoolean(Node* node) {
   Operator::Properties const properties = Operator::kEliminatable;
   CallDescriptor::Flags const flags = CallDescriptor::kNoAllocate;
   auto call_descriptor = Linkage::GetStubCallDescriptor(
-      isolate(), graph()->zone(), callable.descriptor(), 0, flags, properties);
+      graph()->zone(), callable.descriptor(), 0, flags, properties);
   return __ Call(call_descriptor, __ HeapConstant(callable.code()), obj,
                  __ NoContextConstant());
 }
@@ -2576,6 +2599,11 @@ Node* EffectControlLinearizer::LowerNewDoubleElements(Node* node) {
   PretenureFlag const pretenure = PretenureFlagOf(node->op());
   Node* length = node->InputAt(0);
 
+  auto done = __ MakeLabel(MachineRepresentation::kTaggedPointer);
+  Node* zero_length = __ Word32Equal(length, __ Int32Constant(0));
+  __ GotoIf(zero_length, &done,
+            jsgraph()->HeapConstant(factory()->empty_fixed_array()));
+
   // Compute the effective size of the backing store.
   Node* size =
       __ Int32Add(__ Word32Shl(length, __ Int32Constant(kDoubleSizeLog2)),
@@ -2594,14 +2622,13 @@ Node* EffectControlLinearizer::LowerNewDoubleElements(Node* node) {
   Node* the_hole =
       __ LoadField(AccessBuilder::ForHeapNumberValue(), __ TheHoleConstant());
   auto loop = __ MakeLoopLabel(MachineType::PointerRepresentation());
-  auto done_loop = __ MakeLabel();
   __ Goto(&loop, __ IntPtrConstant(0));
   __ Bind(&loop);
   {
     // Check if we've initialized everything.
     Node* index = loop.PhiAt(0);
     Node* check = __ UintLessThan(index, limit);
-    __ GotoIfNot(check, &done_loop);
+    __ GotoIfNot(check, &done, result);
 
     // Storing "the_hole" doesn't need a write barrier.
     StoreRepresentation rep(MachineRepresentation::kFloat64, kNoWriteBarrier);
@@ -2615,14 +2642,19 @@ Node* EffectControlLinearizer::LowerNewDoubleElements(Node* node) {
     __ Goto(&loop, index);
   }
 
-  __ Bind(&done_loop);
-  return result;
+  __ Bind(&done);
+  return done.PhiAt(0);
 }
 
 Node* EffectControlLinearizer::LowerNewSmiOrObjectElements(Node* node) {
   PretenureFlag const pretenure = PretenureFlagOf(node->op());
   Node* length = node->InputAt(0);
 
+  auto done = __ MakeLabel(MachineRepresentation::kTaggedPointer);
+  Node* zero_length = __ Word32Equal(length, __ Int32Constant(0));
+  __ GotoIf(zero_length, &done,
+            jsgraph()->HeapConstant(factory()->empty_fixed_array()));
+
   // Compute the effective size of the backing store.
   Node* size =
       __ Int32Add(__ Word32Shl(length, __ Int32Constant(kPointerSizeLog2)),
@@ -2638,14 +2670,13 @@ Node* EffectControlLinearizer::LowerNewSmiOrObjectElements(Node* node) {
   Node* limit = ChangeUint32ToUintPtr(length);
   Node* the_hole = __ TheHoleConstant();
   auto loop = __ MakeLoopLabel(MachineType::PointerRepresentation());
-  auto done_loop = __ MakeLabel();
   __ Goto(&loop, __ IntPtrConstant(0));
   __ Bind(&loop);
   {
     // Check if we've initialized everything.
     Node* index = loop.PhiAt(0);
     Node* check = __ UintLessThan(index, limit);
-    __ GotoIfNot(check, &done_loop);
+    __ GotoIfNot(check, &done, result);
 
     // Storing "the_hole" doesn't need a write barrier.
     StoreRepresentation rep(MachineRepresentation::kTagged, kNoWriteBarrier);
@@ -2659,8 +2690,8 @@ Node* EffectControlLinearizer::LowerNewSmiOrObjectElements(Node* node) {
     __ Goto(&loop, index);
   }
 
-  __ Bind(&done_loop);
-  return result;
+  __ Bind(&done);
+  return done.PhiAt(0);
 }
 
 Node* EffectControlLinearizer::LowerNewArgumentsElements(Node* node) {
@@ -2673,7 +2704,7 @@ Node* EffectControlLinearizer::LowerNewArgumentsElements(Node* node) {
   Operator::Properties const properties = node->op()->properties();
   CallDescriptor::Flags const flags = CallDescriptor::kNoFlags;
   auto call_descriptor = Linkage::GetStubCallDescriptor(
-      isolate(), graph()->zone(), callable.descriptor(), 0, flags, properties);
+      graph()->zone(), callable.descriptor(), 0, flags, properties);
   return __ Call(call_descriptor, __ HeapConstant(callable.code()), frame,
                  length, __ SmiConstant(mapped_count), __ NoContextConstant());
 }
@@ -2746,7 +2777,7 @@ Node* EffectControlLinearizer::LowerSameValue(Node* node) {
   Operator::Properties properties = Operator::kEliminatable;
   CallDescriptor::Flags flags = CallDescriptor::kNoFlags;
   auto call_descriptor = Linkage::GetStubCallDescriptor(
-      isolate(), graph()->zone(), callable.descriptor(), 0, flags, properties);
+      graph()->zone(), callable.descriptor(), 0, flags, properties);
   return __ Call(call_descriptor, __ HeapConstant(callable.code()), lhs, rhs,
                  __ NoContextConstant());
 }
@@ -2768,7 +2799,7 @@ Node* EffectControlLinearizer::LowerStringToNumber(Node* node) {
   Operator::Properties properties = Operator::kEliminatable;
   CallDescriptor::Flags flags = CallDescriptor::kNoFlags;
   auto call_descriptor = Linkage::GetStubCallDescriptor(
-      isolate(), graph()->zone(), callable.descriptor(), 0, flags, properties);
+      graph()->zone(), callable.descriptor(), 0, flags, properties);
   return __ Call(call_descriptor, __ HeapConstant(callable.code()), string,
                  __ NoContextConstant());
 }
@@ -2899,11 +2930,10 @@ Node* EffectControlLinearizer::LowerStringCharCodeAt(Node* node) {
       Runtime::FunctionId id = Runtime::kStringCharCodeAt;
       auto call_descriptor = Linkage::GetRuntimeCallDescriptor(
           graph()->zone(), id, 2, properties, CallDescriptor::kNoFlags);
-      Node* result =
-          __ Call(call_descriptor, __ CEntryStubConstant(1), receiver,
-                  ChangeInt32ToSmi(position),
-                  __ ExternalConstant(ExternalReference(id, isolate())),
-                  __ Int32Constant(2), __ NoContextConstant());
+      Node* result = __ Call(call_descriptor, __ CEntryStubConstant(1),
+                             receiver, ChangeInt32ToSmi(position),
+                             __ ExternalConstant(ExternalReference::Create(id)),
+                             __ Int32Constant(2), __ NoContextConstant());
       __ Goto(&loop_done, ChangeSmiToInt32(result));
     }
 
@@ -2927,8 +2957,7 @@ Node* EffectControlLinearizer::LowerStringCodePointAt(
   Operator::Properties properties = Operator::kNoThrow | Operator::kNoWrite;
   CallDescriptor::Flags flags = CallDescriptor::kNoFlags;
   auto call_descriptor = Linkage::GetStubCallDescriptor(
-      isolate(), graph()->zone(), callable.descriptor(), 0, flags, properties,
-      MachineType::TaggedSigned());
+      graph()->zone(), callable.descriptor(), 0, flags, properties);
   return __ Call(call_descriptor, __ HeapConstant(callable.code()), receiver,
                  position, __ NoContextConstant());
 }
@@ -3037,7 +3066,7 @@ Node* EffectControlLinearizer::LowerStringToLowerCaseIntl(Node* node) {
   Operator::Properties properties = Operator::kNoDeopt | Operator::kNoThrow;
   CallDescriptor::Flags flags = CallDescriptor::kNoFlags;
   auto call_descriptor = Linkage::GetStubCallDescriptor(
-      isolate(), graph()->zone(), callable.descriptor(), 0, flags, properties);
+      graph()->zone(), callable.descriptor(), 0, flags, properties);
   return __ Call(call_descriptor, __ HeapConstant(callable.code()), receiver,
                  __ NoContextConstant());
 }
@@ -3049,7 +3078,7 @@ Node* EffectControlLinearizer::LowerStringToUpperCaseIntl(Node* node) {
   auto call_descriptor = Linkage::GetRuntimeCallDescriptor(
       graph()->zone(), id, 1, properties, CallDescriptor::kNoFlags);
   return __ Call(call_descriptor, __ CEntryStubConstant(1), receiver,
-                 __ ExternalConstant(ExternalReference(id, isolate())),
+                 __ ExternalConstant(ExternalReference::Create(id)),
                  __ Int32Constant(1), __ NoContextConstant());
 }
 
@@ -3206,7 +3235,7 @@ Node* EffectControlLinearizer::LowerStringIndexOf(Node* node) {
   Operator::Properties properties = Operator::kEliminatable;
   CallDescriptor::Flags flags = CallDescriptor::kNoFlags;
   auto call_descriptor = Linkage::GetStubCallDescriptor(
-      isolate(), graph()->zone(), callable.descriptor(), 0, flags, properties);
+      graph()->zone(), callable.descriptor(), 0, flags, properties);
   return __ Call(call_descriptor, __ HeapConstant(callable.code()), subject,
                  search_string, position, __ NoContextConstant());
 }
@@ -3225,7 +3254,7 @@ Node* EffectControlLinearizer::LowerStringComparison(Callable const& callable,
   Operator::Properties properties = Operator::kEliminatable;
   CallDescriptor::Flags flags = CallDescriptor::kNoFlags;
   auto call_descriptor = Linkage::GetStubCallDescriptor(
-      isolate(), graph()->zone(), callable.descriptor(), 0, flags, properties);
+      graph()->zone(), callable.descriptor(), 0, flags, properties);
   return __ Call(call_descriptor, __ HeapConstant(callable.code()), lhs, rhs,
                  __ NoContextConstant());
 }
@@ -3240,7 +3269,7 @@ Node* EffectControlLinearizer::LowerStringSubstring(Node* node) {
   Operator::Properties properties = Operator::kEliminatable;
   CallDescriptor::Flags flags = CallDescriptor::kNoFlags;
   auto call_descriptor = Linkage::GetStubCallDescriptor(
-      isolate(), graph()->zone(), callable.descriptor(), 0, flags, properties);
+      graph()->zone(), callable.descriptor(), 0, flags, properties);
   return __ Call(call_descriptor, __ HeapConstant(callable.code()), receiver,
                  start, end, __ NoContextConstant());
 }
@@ -3347,7 +3376,7 @@ void EffectControlLinearizer::LowerCheckEqualsInternalizedString(
       builder.AddReturn(MachineType::AnyTagged());
       builder.AddParam(MachineType::AnyTagged());
       Node* try_internalize_string_function = __ ExternalConstant(
-          ExternalReference::try_internalize_string_function(isolate()));
+          ExternalReference::try_internalize_string_function());
       auto call_descriptor =
           Linkage::GetSimplifiedCDescriptor(graph()->zone(), builder.Build());
       Node* val_internalized = __ Call(common()->Call(call_descriptor),
@@ -3527,7 +3556,7 @@ Node* EffectControlLinearizer::LowerEnsureWritableFastElements(Node* node) {
       Builtins::CallableFor(isolate(), Builtins::kCopyFastSmiOrObjectElements);
   CallDescriptor::Flags flags = CallDescriptor::kNoFlags;
   auto call_descriptor = Linkage::GetStubCallDescriptor(
-      isolate(), graph()->zone(), callable.descriptor(), 0, flags, properties);
+      graph()->zone(), callable.descriptor(), 0, flags, properties);
   Node* result = __ Call(call_descriptor, __ HeapConstant(callable.code()),
                          object, __ NoContextConstant());
   __ Goto(&done, result);
@@ -3563,8 +3592,7 @@ Node* EffectControlLinearizer::LowerMaybeGrowFastElements(Node* node,
                                   Builtins::kGrowFastSmiOrObjectElements);
   CallDescriptor::Flags call_flags = CallDescriptor::kNoFlags;
   auto call_descriptor = Linkage::GetStubCallDescriptor(
-      isolate(), graph()->zone(), callable.descriptor(), 0, call_flags,
-      properties);
+      graph()->zone(), callable.descriptor(), 0, call_flags, properties);
   Node* new_elements =
       __ Call(call_descriptor, __ HeapConstant(callable.code()), object,
               ChangeInt32ToSmi(index), __ NoContextConstant());
@@ -3609,7 +3637,7 @@ void EffectControlLinearizer::LowerTransitionElementsKind(Node* node) {
       auto call_descriptor = Linkage::GetRuntimeCallDescriptor(
           graph()->zone(), id, 2, properties, CallDescriptor::kNoFlags);
       __ Call(call_descriptor, __ CEntryStubConstant(1), object, target_map,
-              __ ExternalConstant(ExternalReference(id, isolate())),
+              __ ExternalConstant(ExternalReference::Create(id)),
               __ Int32Constant(2), __ NoContextConstant());
       break;
     }
@@ -3720,6 +3748,350 @@ Node* EffectControlLinearizer::LowerLoadFieldByIndex(Node* node) {
   return done.PhiAt(0);
 }
 
+Node* EffectControlLinearizer::LowerLoadDataViewElement(Node* node) {
+  ExternalArrayType element_type = ExternalArrayTypeOf(node->op());
+  Node* buffer = node->InputAt(0);
+  Node* storage = node->InputAt(1);
+  Node* index = node->InputAt(2);
+  Node* is_little_endian = node->InputAt(3);
+
+  // We need to keep the {buffer} alive so that the GC will not release the
+  // ArrayBuffer (if there's any) as long as we are still operating on it.
+  __ Retain(buffer);
+
+  ElementAccess access_int8 = AccessBuilder::ForTypedArrayElement(
+      kExternalInt8Array, true, LoadSensitivity::kCritical);
+  ElementAccess access_uint8 = AccessBuilder::ForTypedArrayElement(
+      kExternalUint8Array, true, LoadSensitivity::kCritical);
+
+  switch (element_type) {
+    case kExternalUint8Array:
+      return __ LoadElement(access_uint8, storage, index);
+
+    case kExternalInt8Array:
+      return __ LoadElement(access_int8, storage, index);
+
+    case kExternalUint16Array:  // Fall through.
+    case kExternalInt16Array: {
+      auto big_endian = __ MakeLabel();
+      auto done = __ MakeLabel(MachineRepresentation::kWord32);
+
+      // If we're doing an Int16 load, sign-extend the most significant byte
+      // by loading it as an Int8 instead of Uint8.
+      ElementAccess access_msb =
+          element_type == kExternalInt16Array ? access_int8 : access_uint8;
+
+      __ GotoIfNot(is_little_endian, &big_endian);
+      {
+        // Little-endian load.
+        Node* b0 = __ LoadElement(access_uint8, storage, index);
+        Node* b1 = __ LoadElement(access_msb, storage,
+                                  __ Int32Add(index, __ Int32Constant(1)));
+
+        // result = (b1 << 8) + b0
+        Node* result = __ Int32Add(__ Word32Shl(b1, __ Int32Constant(8)), b0);
+        __ Goto(&done, result);
+      }
+
+      __ Bind(&big_endian);
+      {
+        // Big-endian load.
+        Node* b0 = __ LoadElement(access_msb, storage, index);
+        Node* b1 = __ LoadElement(access_uint8, storage,
+                                  __ Int32Add(index, __ Int32Constant(1)));
+
+        // result = (b0 << 8) + b1;
+        Node* result = __ Int32Add(__ Word32Shl(b0, __ Int32Constant(8)), b1);
+        __ Goto(&done, result);
+      }
+
+      // We're done, return {result}.
+      __ Bind(&done);
+      return done.PhiAt(0);
+    }
+
+    case kExternalUint32Array:  // Fall through.
+    case kExternalInt32Array:   // Fall through.
+    case kExternalFloat32Array: {
+      Node* b0 = __ LoadElement(access_uint8, storage, index);
+      Node* b1 = __ LoadElement(access_uint8, storage,
+                                __ Int32Add(index, __ Int32Constant(1)));
+      Node* b2 = __ LoadElement(access_uint8, storage,
+                                __ Int32Add(index, __ Int32Constant(2)));
+      Node* b3 = __ LoadElement(access_uint8, storage,
+                                __ Int32Add(index, __ Int32Constant(3)));
+
+      auto big_endian = __ MakeLabel();
+      auto done = __ MakeLabel(MachineRepresentation::kWord32);
+
+      __ GotoIfNot(is_little_endian, &big_endian);
+      {
+        // Little-endian load.
+        // result = (b3 << 24) | (b2 << 16) | (b1 << 8) | b0;
+        Node* result =
+            __ Word32Or(__ Word32Or(__ Word32Shl(b3, __ Int32Constant(24)),
+                                    __ Word32Shl(b2, __ Int32Constant(16))),
+                        __ Word32Or(__ Word32Shl(b1, __ Int32Constant(8)), b0));
+        __ Goto(&done, result);
+      }
+
+      __ Bind(&big_endian);
+      {
+        // Big-endian load.
+        // result = (b0 << 24) | (b1 << 16) | (b2 << 8) | b3;
+        Node* result =
+            __ Word32Or(__ Word32Or(__ Word32Shl(b0, __ Int32Constant(24)),
+                                    __ Word32Shl(b1, __ Int32Constant(16))),
+                        __ Word32Or(__ Word32Shl(b2, __ Int32Constant(8)), b3));
+        __ Goto(&done, result);
+      }
+
+      // We're done, return {result}.
+      __ Bind(&done);
+      if (element_type == kExternalFloat32Array) {
+        return __ BitcastInt32ToFloat32(done.PhiAt(0));
+      } else {
+        return done.PhiAt(0);
+      }
+    }
+
+    case kExternalFloat64Array: {
+      Node* b0 = __ LoadElement(access_uint8, storage, index);
+      Node* b1 = __ LoadElement(access_uint8, storage,
+                                __ Int32Add(index, __ Int32Constant(1)));
+      Node* b2 = __ LoadElement(access_uint8, storage,
+                                __ Int32Add(index, __ Int32Constant(2)));
+      Node* b3 = __ LoadElement(access_uint8, storage,
+                                __ Int32Add(index, __ Int32Constant(3)));
+      Node* b4 = __ LoadElement(access_uint8, storage,
+                                __ Int32Add(index, __ Int32Constant(4)));
+      Node* b5 = __ LoadElement(access_uint8, storage,
+                                __ Int32Add(index, __ Int32Constant(5)));
+      Node* b6 = __ LoadElement(access_uint8, storage,
+                                __ Int32Add(index, __ Int32Constant(6)));
+      Node* b7 = __ LoadElement(access_uint8, storage,
+                                __ Int32Add(index, __ Int32Constant(7)));
+
+      auto big_endian = __ MakeLabel();
+      auto done = __ MakeLabel(MachineRepresentation::kWord32,
+                               MachineRepresentation::kWord32);
+
+      __ GotoIfNot(is_little_endian, &big_endian);
+      {
+        // Little-endian load.
+        // low_word = (b3 << 24) | (b2 << 16) | (b1 << 8) | b0;
+        // high_word = (b7 << 24) | (b6 << 16) | (b5 << 8) | b4;
+        Node* low_word =
+            __ Word32Or(__ Word32Or(__ Word32Shl(b3, __ Int32Constant(24)),
+                                    __ Word32Shl(b2, __ Int32Constant(16))),
+                        __ Word32Or(__ Word32Shl(b1, __ Int32Constant(8)), b0));
+        Node* high_word =
+            __ Word32Or(__ Word32Or(__ Word32Shl(b7, __ Int32Constant(24)),
+                                    __ Word32Shl(b6, __ Int32Constant(16))),
+                        __ Word32Or(__ Word32Shl(b5, __ Int32Constant(8)), b4));
+        __ Goto(&done, low_word, high_word);
+      }
+
+      __ Bind(&big_endian);
+      {
+        // Big-endian load.
+        // high_word = (b0 << 24) | (b1 << 16) | (b2 << 8) | b3;
+        // low_word = (b4 << 24) | (b5 << 16) | (b6 << 8) | b7;
+        Node* high_word =
+            __ Word32Or(__ Word32Or(__ Word32Shl(b0, __ Int32Constant(24)),
+                                    __ Word32Shl(b1, __ Int32Constant(16))),
+                        __ Word32Or(__ Word32Shl(b2, __ Int32Constant(8)), b3));
+        Node* low_word =
+            __ Word32Or(__ Word32Or(__ Word32Shl(b4, __ Int32Constant(24)),
+                                    __ Word32Shl(b5, __ Int32Constant(16))),
+                        __ Word32Or(__ Word32Shl(b6, __ Int32Constant(8)), b7));
+        __ Goto(&done, low_word, high_word);
+      }
+
+      // We're done, store the low and high words into a float64.
+      __ Bind(&done);
+      Node* result = __ Float64Constant(0.0);
+      result = __ Float64InsertLowWord32(result, done.PhiAt(0));
+      result = __ Float64InsertHighWord32(result, done.PhiAt(1));
+      return result;
+    }
+
+    default:
+      UNREACHABLE();
+  }
+}
+
+void EffectControlLinearizer::LowerStoreDataViewElement(Node* node) {
+  ExternalArrayType element_type = ExternalArrayTypeOf(node->op());
+  Node* buffer = node->InputAt(0);
+  Node* storage = node->InputAt(1);
+  Node* index = node->InputAt(2);
+  Node* value = node->InputAt(3);
+  Node* is_little_endian = node->InputAt(4);
+
+  // We need to keep the {buffer} alive so that the GC will not release the
+  // ArrayBuffer (if there's any) as long as we are still operating on it.
+  __ Retain(buffer);
+
+  ElementAccess access =
+      AccessBuilder::ForTypedArrayElement(kExternalUint8Array, true);
+
+  switch (element_type) {
+    case kExternalUint8Array:  // Fall through.
+    case kExternalInt8Array: {
+      Node* b0 = __ Word32And(value, __ Int32Constant(0xFF));
+      __ StoreElement(access, storage, index, b0);
+      break;
+    }
+    case kExternalUint16Array:  // Fall through.
+    case kExternalInt16Array: {
+      Node* b0 = __ Word32And(value, __ Int32Constant(0xFF));
+      Node* b1 = __ Word32And(__ Word32Shr(value, __ Int32Constant(8)),
+                              __ Int32Constant(0xFF));
+
+      auto big_endian = __ MakeLabel();
+      auto done = __ MakeLabel();
+
+      __ GotoIfNot(is_little_endian, &big_endian);
+      {
+        // Little-endian store.
+        __ StoreElement(access, storage, index, b0);
+        __ StoreElement(access, storage,
+                        __ Int32Add(index, __ Int32Constant(1)), b1);
+        __ Goto(&done);
+      }
+
+      __ Bind(&big_endian);
+      {
+        // Big-endian store.
+        __ StoreElement(access, storage, index, b1);
+        __ StoreElement(access, storage,
+                        __ Int32Add(index, __ Int32Constant(1)), b0);
+        __ Goto(&done);
+      }
+
+      __ Bind(&done);
+      break;
+    }
+
+    case kExternalUint32Array:  // Fall through.
+    case kExternalInt32Array:   // Fall through.
+    case kExternalFloat32Array: {
+      if (element_type == kExternalFloat32Array) {
+        value = __ BitcastFloat32ToInt32(value);
+      }
+
+      Node* b0 = __ Word32And(value, __ Int32Constant(0xFF));
+      Node* b1 = __ Word32And(__ Word32Shr(value, __ Int32Constant(8)),
+                              __ Int32Constant(0xFF));
+      Node* b2 = __ Word32And(__ Word32Shr(value, __ Int32Constant(16)),
+                              __ Int32Constant(0xFF));
+      Node* b3 = __ Word32Shr(value, __ Int32Constant(24));
+
+      auto big_endian = __ MakeLabel();
+      auto done = __ MakeLabel();
+
+      __ GotoIfNot(is_little_endian, &big_endian);
+      {
+        // Little-endian store.
+        __ StoreElement(access, storage, index, b0);
+        __ StoreElement(access, storage,
+                        __ Int32Add(index, __ Int32Constant(1)), b1);
+        __ StoreElement(access, storage,
+                        __ Int32Add(index, __ Int32Constant(2)), b2);
+        __ StoreElement(access, storage,
+                        __ Int32Add(index, __ Int32Constant(3)), b3);
+        __ Goto(&done);
+      }
+
+      __ Bind(&big_endian);
+      {
+        // Big-endian store.
+        __ StoreElement(access, storage, index, b3);
+        __ StoreElement(access, storage,
+                        __ Int32Add(index, __ Int32Constant(1)), b2);
+        __ StoreElement(access, storage,
+                        __ Int32Add(index, __ Int32Constant(2)), b1);
+        __ StoreElement(access, storage,
+                        __ Int32Add(index, __ Int32Constant(3)), b0);
+        __ Goto(&done);
+      }
+
+      __ Bind(&done);
+      break;
+    }
+
+    case kExternalFloat64Array: {
+      Node* low_word = __ Float64ExtractLowWord32(value);
+      Node* high_word = __ Float64ExtractHighWord32(value);
+
+      Node* b0 = __ Word32And(low_word, __ Int32Constant(0xFF));
+      Node* b1 = __ Word32And(__ Word32Shr(low_word, __ Int32Constant(8)),
+                              __ Int32Constant(0xFF));
+      Node* b2 = __ Word32And(__ Word32Shr(low_word, __ Int32Constant(16)),
+                              __ Int32Constant(0xFF));
+      Node* b3 = __ Word32Shr(low_word, __ Int32Constant(24));
+
+      Node* b4 = __ Word32And(high_word, __ Int32Constant(0xFF));
+      Node* b5 = __ Word32And(__ Word32Shr(high_word, __ Int32Constant(8)),
+                              __ Int32Constant(0xFF));
+      Node* b6 = __ Word32And(__ Word32Shr(high_word, __ Int32Constant(16)),
+                              __ Int32Constant(0xFF));
+      Node* b7 = __ Word32Shr(high_word, __ Int32Constant(24));
+
+      auto big_endian = __ MakeLabel();
+      auto done = __ MakeLabel();
+
+      __ GotoIfNot(is_little_endian, &big_endian);
+      {
+        // Little-endian store.
+        __ StoreElement(access, storage, index, b0);
+        __ StoreElement(access, storage,
+                        __ Int32Add(index, __ Int32Constant(1)), b1);
+        __ StoreElement(access, storage,
+                        __ Int32Add(index, __ Int32Constant(2)), b2);
+        __ StoreElement(access, storage,
+                        __ Int32Add(index, __ Int32Constant(3)), b3);
+        __ StoreElement(access, storage,
+                        __ Int32Add(index, __ Int32Constant(4)), b4);
+        __ StoreElement(access, storage,
+                        __ Int32Add(index, __ Int32Constant(5)), b5);
+        __ StoreElement(access, storage,
+                        __ Int32Add(index, __ Int32Constant(6)), b6);
+        __ StoreElement(access, storage,
+                        __ Int32Add(index, __ Int32Constant(7)), b7);
+        __ Goto(&done);
+      }
+
+      __ Bind(&big_endian);
+      {
+        // Big-endian store.
+        __ StoreElement(access, storage, index, b7);
+        __ StoreElement(access, storage,
+                        __ Int32Add(index, __ Int32Constant(1)), b6);
+        __ StoreElement(access, storage,
+                        __ Int32Add(index, __ Int32Constant(2)), b5);
+        __ StoreElement(access, storage,
+                        __ Int32Add(index, __ Int32Constant(3)), b4);
+        __ StoreElement(access, storage,
+                        __ Int32Add(index, __ Int32Constant(4)), b3);
+        __ StoreElement(access, storage,
+                        __ Int32Add(index, __ Int32Constant(5)), b2);
+        __ StoreElement(access, storage,
+                        __ Int32Add(index, __ Int32Constant(6)), b1);
+        __ StoreElement(access, storage,
+                        __ Int32Add(index, __ Int32Constant(7)), b0);
+        __ Goto(&done);
+      }
+
+      __ Bind(&done);
+      break;
+    }
+
+    default:
+      UNREACHABLE();
+  }
+}
 Node* EffectControlLinearizer::LowerLoadTypedElement(Node* node) {
   ExternalArrayType array_type = ExternalArrayTypeOf(node->op());
   Node* buffer = node->InputAt(0);
@@ -3739,7 +4111,8 @@ Node* EffectControlLinearizer::LowerLoadTypedElement(Node* node) {
                       : __ UnsafePointerAdd(base, external);
 
   // Perform the actual typed element access.
-  return __ LoadElement(AccessBuilder::ForTypedArrayElement(array_type, true),
+  return __ LoadElement(AccessBuilder::ForTypedArrayElement(
+                            array_type, true, LoadSensitivity::kCritical),
                         storage, index);
 }
 
@@ -3786,7 +4159,7 @@ void EffectControlLinearizer::TransitionElementsTo(Node* node, Node* array,
     auto call_descriptor = Linkage::GetRuntimeCallDescriptor(
         graph()->zone(), id, 2, properties, CallDescriptor::kNoFlags);
     __ Call(call_descriptor, __ CEntryStubConstant(1), array, target_map,
-            __ ExternalConstant(ExternalReference(id, isolate())),
+            __ ExternalConstant(ExternalReference::Create(id)),
             __ Int32Constant(2), __ NoContextConstant());
   }
 }
@@ -4060,8 +4433,8 @@ void EffectControlLinearizer::LowerTransitionAndStoreNonNumberElement(
   Node* elements = __ LoadField(AccessBuilder::ForJSObjectElements(), array);
   // Our ElementsKind is HOLEY_ELEMENTS.
   ElementAccess access = AccessBuilder::ForFixedArrayElement(HOLEY_ELEMENTS);
-  Type* value_type = ValueTypeParameterOf(node->op());
-  if (value_type->Is(Type::BooleanOrNullOrUndefined())) {
+  Type value_type = ValueTypeParameterOf(node->op());
+  if (value_type.Is(Type::BooleanOrNullOrUndefined())) {
     access.type = value_type;
     access.write_barrier_kind = kNoWriteBarrier;
   }
@@ -4134,7 +4507,7 @@ void EffectControlLinearizer::LowerRuntimeAbort(Node* node) {
       graph()->zone(), id, 1, properties, CallDescriptor::kNoFlags);
   __ Call(call_descriptor, __ CEntryStubConstant(1),
           jsgraph()->SmiConstant(static_cast<int>(reason)),
-          __ ExternalConstant(ExternalReference(id, isolate())),
+          __ ExternalConstant(ExternalReference::Create(id)),
           __ Int32Constant(1), __ NoContextConstant());
 }
 
@@ -4168,8 +4541,7 @@ Node* EffectControlLinearizer::LowerConvertReceiver(Node* node) {
       Callable callable = Builtins::CallableFor(isolate(), Builtins::kToObject);
       CallDescriptor::Flags flags = CallDescriptor::kNoFlags;
       auto call_descriptor = Linkage::GetStubCallDescriptor(
-          isolate(), graph()->zone(), callable.descriptor(), 0, flags,
-          properties);
+          graph()->zone(), callable.descriptor(), 0, flags, properties);
       Node* native_context = __ LoadField(
           AccessBuilder::ForJSGlobalProxyNativeContext(), global_proxy);
       Node* result = __ Call(call_descriptor, __ HeapConstant(callable.code()),
@@ -4204,8 +4576,7 @@ Node* EffectControlLinearizer::LowerConvertReceiver(Node* node) {
       Callable callable = Builtins::CallableFor(isolate(), Builtins::kToObject);
       CallDescriptor::Flags flags = CallDescriptor::kNoFlags;
       auto call_descriptor = Linkage::GetStubCallDescriptor(
-          isolate(), graph()->zone(), callable.descriptor(), 0, flags,
-          properties);
+          graph()->zone(), callable.descriptor(), 0, flags, properties);
       Node* native_context = __ LoadField(
           AccessBuilder::ForJSGlobalProxyNativeContext(), global_proxy);
       Node* result = __ Call(call_descriptor, __ HeapConstant(callable.code()),
@@ -4566,8 +4937,7 @@ Node* EffectControlLinearizer::LowerFindOrderedHashMapEntry(Node* node) {
     Operator::Properties const properties = node->op()->properties();
     CallDescriptor::Flags const flags = CallDescriptor::kNoFlags;
     auto call_descriptor = Linkage::GetStubCallDescriptor(
-        isolate(), graph()->zone(), callable.descriptor(), 0, flags,
-        properties);
+        graph()->zone(), callable.descriptor(), 0, flags, properties);
     return __ Call(call_descriptor, __ HeapConstant(callable.code()), table,
                    key, __ NoContextConstant());
   }
@@ -4662,6 +5032,16 @@ Node* EffectControlLinearizer::LowerFindOrderedHashMapEntryForInt32Key(
   return done.PhiAt(0);
 }
 
+Node* EffectControlLinearizer::LowerDateNow(Node* node) {
+  Operator::Properties properties = Operator::kNoDeopt | Operator::kNoThrow;
+  Runtime::FunctionId id = Runtime::kDateCurrentTime;
+  auto call_descriptor = Linkage::GetRuntimeCallDescriptor(
+      graph()->zone(), id, 0, properties, CallDescriptor::kNoFlags);
+  return __ Call(call_descriptor, __ CEntryStubConstant(1),
+                 __ ExternalConstant(ExternalReference::Create(id)),
+                 __ Int32Constant(0), __ NoContextConstant());
+}
+
 #undef __
 
 Factory* EffectControlLinearizer::factory() const {
diff --git a/deps/v8/src/compiler/effect-control-linearizer.h b/deps/v8/src/compiler/effect-control-linearizer.h
index 4bab19ebcbd3c5..47e0a249cfefc4 100644
--- a/deps/v8/src/compiler/effect-control-linearizer.h
+++ b/deps/v8/src/compiler/effect-control-linearizer.h
@@ -27,6 +27,7 @@ class JSGraph;
 class Graph;
 class Schedule;
 class SourcePositionTable;
+class NodeOriginTable;
 
 class V8_EXPORT_PRIVATE EffectControlLinearizer {
  public:
@@ -34,6 +35,7 @@ class V8_EXPORT_PRIVATE EffectControlLinearizer {
 
   EffectControlLinearizer(JSGraph* graph, Schedule* schedule, Zone* temp_zone,
                           SourcePositionTable* source_positions,
+                          NodeOriginTable* node_origins,
                           MaskArrayIndexEnable mask_array_index);
 
   void Run();
@@ -56,7 +58,7 @@ class V8_EXPORT_PRIVATE EffectControlLinearizer {
   Node* LowerChangeTaggedToUint32(Node* node);
   Node* LowerChangeTaggedToTaggedSigned(Node* node);
   Node* LowerCheckBounds(Node* node, Node* frame_state);
-  Node* LowerMaskIndexWithBound(Node* node);
+  Node* LowerPoisonIndex(Node* node);
   Node* LowerCheckInternalizedString(Node* node, Node* frame_state);
   void LowerCheckMaps(Node* node, Node* frame_state);
   Node* LowerCompareMaps(Node* node);
@@ -97,6 +99,7 @@ class V8_EXPORT_PRIVATE EffectControlLinearizer {
   Node* LowerObjectIsDetectableCallable(Node* node);
   Node* LowerObjectIsMinusZero(Node* node);
   Node* LowerObjectIsNaN(Node* node);
+  Node* LowerNumberIsNaN(Node* node);
   Node* LowerObjectIsNonCallable(Node* node);
   Node* LowerObjectIsNumber(Node* node);
   Node* LowerObjectIsReceiver(Node* node);
@@ -148,7 +151,9 @@ class V8_EXPORT_PRIVATE EffectControlLinearizer {
   void LowerTransitionElementsKind(Node* node);
   Node* LowerLoadFieldByIndex(Node* node);
   Node* LowerLoadTypedElement(Node* node);
+  Node* LowerLoadDataViewElement(Node* node);
   void LowerStoreTypedElement(Node* node);
+  void LowerStoreDataViewElement(Node* node);
   void LowerStoreSignedSmallElement(Node* node);
   Node* LowerFindOrderedHashMapEntry(Node* node);
   Node* LowerFindOrderedHashMapEntryForInt32Key(Node* node);
@@ -157,6 +162,7 @@ class V8_EXPORT_PRIVATE EffectControlLinearizer {
   void LowerTransitionAndStoreNonNumberElement(Node* node);
   void LowerRuntimeAbort(Node* node);
   Node* LowerConvertReceiver(Node* node);
+  Node* LowerDateNow(Node* node);
 
   // Lowering of optional operators.
   Maybe<Node*> LowerFloat64RoundUp(Node* node);
@@ -211,6 +217,7 @@ class V8_EXPORT_PRIVATE EffectControlLinearizer {
   MaskArrayIndexEnable mask_array_index_;
   RegionObservability region_observability_ = RegionObservability::kObservable;
   SourcePositionTable* source_positions_;
+  NodeOriginTable* node_origins_;
   GraphAssembler graph_assembler_;
   Node* frame_state_zapper_;  // For tracking down compiler::Node::New crashes.
 };
diff --git a/deps/v8/src/compiler/escape-analysis-reducer.cc b/deps/v8/src/compiler/escape-analysis-reducer.cc
index 81da548ca26a8e..1642d85c230cab 100644
--- a/deps/v8/src/compiler/escape-analysis-reducer.cc
+++ b/deps/v8/src/compiler/escape-analysis-reducer.cc
@@ -42,9 +42,9 @@ Reduction EscapeAnalysisReducer::ReplaceNode(Node* original,
     RelaxEffectsAndControls(original);
     return Replace(replacement);
   }
-  Type* const replacement_type = NodeProperties::GetType(replacement);
-  Type* const original_type = NodeProperties::GetType(original);
-  if (replacement_type->Is(original_type)) {
+  Type const replacement_type = NodeProperties::GetType(replacement);
+  Type const original_type = NodeProperties::GetType(original);
+  if (replacement_type.Is(original_type)) {
     RelaxEffectsAndControls(original);
     return Replace(replacement);
   }
@@ -366,7 +366,7 @@ Node* NodeHashCache::Query(Node* node) {
 
 NodeHashCache::Constructor::Constructor(NodeHashCache* cache,
                                         const Operator* op, int input_count,
-                                        Node** inputs, Type* type)
+                                        Node** inputs, Type type)
     : node_cache_(cache), from_(nullptr) {
   if (node_cache_->temp_nodes_.size() > 0) {
     tmp_ = node_cache_->temp_nodes_.back();
diff --git a/deps/v8/src/compiler/escape-analysis-reducer.h b/deps/v8/src/compiler/escape-analysis-reducer.h
index 29290d3a0a7ecf..976be6d9068285 100644
--- a/deps/v8/src/compiler/escape-analysis-reducer.h
+++ b/deps/v8/src/compiler/escape-analysis-reducer.h
@@ -33,7 +33,7 @@ class NodeHashCache {
         : node_cache_(cache), from_(from), tmp_(nullptr) {}
     // Construct a new node from scratch.
     Constructor(NodeHashCache* cache, const Operator* op, int input_count,
-                Node** inputs, Type* type);
+                Node** inputs, Type type);
 
     // Modify the new node.
     void ReplaceValueInput(Node* input, int i) {
@@ -100,6 +100,7 @@ class V8_EXPORT_PRIVATE EscapeAnalysisReducer final
   Reduction ReplaceNode(Node* original, Node* replacement);
 
   JSGraph* jsgraph() const { return jsgraph_; }
+  Isolate* isolate() const { return jsgraph_->isolate(); }
   EscapeAnalysisResult analysis_result() const { return analysis_result_; }
   Zone* zone() const { return zone_; }
 
diff --git a/deps/v8/src/compiler/escape-analysis.cc b/deps/v8/src/compiler/escape-analysis.cc
index 984c5133968421..0e6822a9cadcce 100644
--- a/deps/v8/src/compiler/escape-analysis.cc
+++ b/deps/v8/src/compiler/escape-analysis.cc
@@ -9,7 +9,6 @@
 #include "src/compiler/node-matchers.h"
 #include "src/compiler/operator-properties.h"
 #include "src/compiler/simplified-operator.h"
-#include "src/zone/zone-list-inl.h"  // TODO(mstarzinger): Fix zone-handle-set.h instead!
 
 #ifdef DEBUG
 #define TRACE(...)                                    \
@@ -502,10 +501,10 @@ int OffsetOfFieldAccess(const Operator* op) {
 Maybe<int> OffsetOfElementsAccess(const Operator* op, Node* index_node) {
   DCHECK(op->opcode() == IrOpcode::kLoadElement ||
          op->opcode() == IrOpcode::kStoreElement);
-  Type* index_type = NodeProperties::GetType(index_node);
-  if (!index_type->Is(Type::OrderedNumber())) return Nothing<int>();
-  double max = index_type->Max();
-  double min = index_type->Min();
+  Type index_type = NodeProperties::GetType(index_node);
+  if (!index_type.Is(Type::OrderedNumber())) return Nothing<int>();
+  double max = index_type.Max();
+  double min = index_type.Min();
   int index = static_cast<int>(min);
   if (!(index == min && index == max)) return Nothing<int>();
   ElementAccess access = ElementAccessOf(op);
@@ -649,8 +648,8 @@ void ReduceNode(const Operator* op, EscapeAnalysisTracker::Scope* current,
         // types (which might confuse representation selection). We get
         // around this by refusing to constant-fold and escape-analyze
         // if the type is not inhabited.
-        if (!NodeProperties::GetType(left)->IsNone() &&
-            !NodeProperties::GetType(right)->IsNone()) {
+        if (!NodeProperties::GetType(left).IsNone() &&
+            !NodeProperties::GetType(right).IsNone()) {
           current->SetReplacement(replacement);
         } else {
           current->SetEscaped(left);
@@ -669,10 +668,10 @@ void ReduceNode(const Operator* op, EscapeAnalysisTracker::Scope* current,
           vobject->FieldAt(HeapObject::kMapOffset).To(&map_field) &&
           current->Get(map_field).To(&map)) {
         if (map) {
-          Type* const map_type = NodeProperties::GetType(map);
-          if (map_type->IsHeapConstant() &&
+          Type const map_type = NodeProperties::GetType(map);
+          if (map_type.IsHeapConstant() &&
               params.maps().contains(
-                  bit_cast<Handle<Map>>(map_type->AsHeapConstant()->Value()))) {
+                  bit_cast<Handle<Map>>(map_type.AsHeapConstant()->Value()))) {
             current->MarkForDeletion();
             break;
           }
diff --git a/deps/v8/src/compiler/escape-analysis.h b/deps/v8/src/compiler/escape-analysis.h
index 504729bc81137a..71aae6b2a4e062 100644
--- a/deps/v8/src/compiler/escape-analysis.h
+++ b/deps/v8/src/compiler/escape-analysis.h
@@ -180,6 +180,7 @@ class V8_EXPORT_PRIVATE EscapeAnalysis final
  private:
   void Reduce(Node* node, Reduction* reduction);
   JSGraph* jsgraph() { return jsgraph_; }
+  Isolate* isolate() const { return jsgraph_->isolate(); }
   EscapeAnalysisTracker* tracker_;
   JSGraph* jsgraph_;
 };
diff --git a/deps/v8/src/compiler/frame.h b/deps/v8/src/compiler/frame.h
index f5c36dba171968..94789276bb8223 100644
--- a/deps/v8/src/compiler/frame.h
+++ b/deps/v8/src/compiler/frame.h
@@ -153,9 +153,6 @@ class Frame : public ZoneObject {
     return frame_slot_count_ - 1;
   }
 
-  static const int kContextSlot = 2 + StandardFrameConstants::kCPSlotCount;
-  static const int kJSFunctionSlot = 3 + StandardFrameConstants::kCPSlotCount;
-
  private:
   void AllocateAlignedFrameSlots(int width) {
     DCHECK_LT(0, width);
diff --git a/deps/v8/src/compiler/graph-assembler.cc b/deps/v8/src/compiler/graph-assembler.cc
index 37d6c94a7247c4..9780d227fd37a7 100644
--- a/deps/v8/src/compiler/graph-assembler.cc
+++ b/deps/v8/src/compiler/graph-assembler.cc
@@ -178,6 +178,12 @@ Node* GraphAssembler::BitcastWordToTagged(Node* value) {
                               current_effect_, current_control_);
 }
 
+Node* GraphAssembler::Word32PoisonOnSpeculation(Node* value) {
+  return current_effect_ =
+             graph()->NewNode(machine()->Word32PoisonOnSpeculation(), value,
+                              current_effect_, current_control_);
+}
+
 Node* GraphAssembler::DeoptimizeIf(DeoptimizeReason reason,
                                    VectorSlotPair const& feedback,
                                    Node* condition, Node* frame_state) {
@@ -186,20 +192,14 @@ Node* GraphAssembler::DeoptimizeIf(DeoptimizeReason reason,
              condition, frame_state, current_effect_, current_control_);
 }
 
-Node* GraphAssembler::DeoptimizeIfNot(DeoptimizeKind kind,
-                                      DeoptimizeReason reason,
-                                      VectorSlotPair const& feedback,
-                                      Node* condition, Node* frame_state) {
-  return current_control_ = current_effect_ = graph()->NewNode(
-             common()->DeoptimizeUnless(kind, reason, feedback), condition,
-             frame_state, current_effect_, current_control_);
-}
-
 Node* GraphAssembler::DeoptimizeIfNot(DeoptimizeReason reason,
                                       VectorSlotPair const& feedback,
-                                      Node* condition, Node* frame_state) {
-  return DeoptimizeIfNot(DeoptimizeKind::kEager, reason, feedback, condition,
-                         frame_state);
+                                      Node* condition, Node* frame_state,
+                                      IsSafetyCheck is_safety_check) {
+  return current_control_ = current_effect_ = graph()->NewNode(
+             common()->DeoptimizeUnless(DeoptimizeKind::kEager, reason,
+                                        feedback, is_safety_check),
+             condition, frame_state, current_effect_, current_control_);
 }
 
 void GraphAssembler::Branch(Node* condition, GraphAssemblerLabel<0u>* if_true,
@@ -247,9 +247,9 @@ Operator const* GraphAssembler::ToNumberOperator() {
     Callable callable =
         Builtins::CallableFor(jsgraph()->isolate(), Builtins::kToNumber);
     CallDescriptor::Flags flags = CallDescriptor::kNoFlags;
-    auto call_descriptor = Linkage::GetStubCallDescriptor(
-        jsgraph()->isolate(), graph()->zone(), callable.descriptor(), 0, flags,
-        Operator::kEliminatable);
+    auto call_descriptor =
+        Linkage::GetStubCallDescriptor(graph()->zone(), callable.descriptor(),
+                                       0, flags, Operator::kEliminatable);
     to_number_operator_.set(common()->Call(call_descriptor));
   }
   return to_number_operator_.get();
diff --git a/deps/v8/src/compiler/graph-assembler.h b/deps/v8/src/compiler/graph-assembler.h
index bc793df1a6a5b3..f9b45a2007d71a 100644
--- a/deps/v8/src/compiler/graph-assembler.h
+++ b/deps/v8/src/compiler/graph-assembler.h
@@ -28,7 +28,10 @@ namespace compiler {
   V(TruncateInt64ToInt32)                \
   V(RoundFloat64ToInt32)                 \
   V(TruncateFloat64ToWord32)             \
+  V(Float64ExtractLowWord32)             \
   V(Float64ExtractHighWord32)            \
+  V(BitcastInt32ToFloat32)               \
+  V(BitcastFloat32ToInt32)               \
   V(Float64Abs)
 
 #define PURE_ASSEMBLER_MACH_BINOP_LIST(V) \
@@ -60,6 +63,8 @@ namespace compiler {
   V(Float64Equal)                         \
   V(Float64LessThan)                      \
   V(Float64LessThanOrEqual)               \
+  V(Float64InsertLowWord32)               \
+  V(Float64InsertHighWord32)              \
   V(Word32Equal)                          \
   V(WordEqual)
 
@@ -213,13 +218,14 @@ class GraphAssembler {
   Node* Retain(Node* buffer);
   Node* UnsafePointerAdd(Node* base, Node* external);
 
+  Node* Word32PoisonOnSpeculation(Node* value);
+
   Node* DeoptimizeIf(DeoptimizeReason reason, VectorSlotPair const& feedback,
                      Node* condition, Node* frame_state);
-  Node* DeoptimizeIfNot(DeoptimizeKind kind, DeoptimizeReason reason,
-                        VectorSlotPair const& feedback, Node* condition,
-                        Node* frame_state);
-  Node* DeoptimizeIfNot(DeoptimizeReason reason, VectorSlotPair const& feedback,
-                        Node* condition, Node* frame_state);
+  Node* DeoptimizeIfNot(
+      DeoptimizeReason reason, VectorSlotPair const& feedback, Node* condition,
+      Node* frame_state,
+      IsSafetyCheck is_safety_check = IsSafetyCheck::kSafetyCheck);
   template <typename... Args>
   Node* Call(const CallDescriptor* call_descriptor, Args... args);
   template <typename... Args>
@@ -257,6 +263,7 @@ class GraphAssembler {
   Operator const* ToNumberOperator();
 
   JSGraph* jsgraph() const { return jsgraph_; }
+  Isolate* isolate() const { return jsgraph_->isolate(); }
   Graph* graph() const { return jsgraph_->graph(); }
   Zone* temp_zone() const { return temp_zone_; }
   CommonOperatorBuilder* common() const { return jsgraph()->common(); }
diff --git a/deps/v8/src/compiler/graph-reducer.cc b/deps/v8/src/compiler/graph-reducer.cc
index 8631810ebd3222..dc7b23521f188c 100644
--- a/deps/v8/src/compiler/graph-reducer.cc
+++ b/deps/v8/src/compiler/graph-reducer.cc
@@ -90,9 +90,8 @@ Reduction GraphReducer::Reduce(Node* const node) {
         // all the other reducers for this node, as now there may be more
         // opportunities for reduction.
         if (FLAG_trace_turbo_reduction) {
-          OFStream os(stdout);
-          os << "- In-place update of " << *node << " by reducer "
-             << (*i)->reducer_name() << std::endl;
+          StdoutStream{} << "- In-place update of " << *node << " by reducer "
+                         << (*i)->reducer_name() << std::endl;
         }
         skip = i;
         i = reducers_.begin();
@@ -100,10 +99,9 @@ Reduction GraphReducer::Reduce(Node* const node) {
       } else {
         // {node} was replaced by another node.
         if (FLAG_trace_turbo_reduction) {
-          OFStream os(stdout);
-          os << "- Replacement of " << *node << " with "
-             << *(reduction.replacement()) << " by reducer "
-             << (*i)->reducer_name() << std::endl;
+          StdoutStream{} << "- Replacement of " << *node << " with "
+                         << *(reduction.replacement()) << " by reducer "
+                         << (*i)->reducer_name() << std::endl;
         }
         return reduction;
       }
diff --git a/deps/v8/src/compiler/graph-trimmer.cc b/deps/v8/src/compiler/graph-trimmer.cc
index 74626fe67fabc1..c3de2cd8097175 100644
--- a/deps/v8/src/compiler/graph-trimmer.cc
+++ b/deps/v8/src/compiler/graph-trimmer.cc
@@ -34,9 +34,8 @@ void GraphTrimmer::TrimGraph() {
       Node* const user = edge.from();
       if (!IsLive(user)) {
         if (FLAG_trace_turbo_trimming) {
-          OFStream os(stdout);
-          os << "DeadLink: " << *user << "(" << edge.index() << ") -> " << *live
-             << std::endl;
+          StdoutStream{} << "DeadLink: " << *user << "(" << edge.index()
+                         << ") -> " << *live << std::endl;
         }
         edge.UpdateTo(nullptr);
       }
diff --git a/deps/v8/src/compiler/graph-visualizer.cc b/deps/v8/src/compiler/graph-visualizer.cc
index 73e7f615dbec1e..feb0a8e9d316d6 100644
--- a/deps/v8/src/compiler/graph-visualizer.cc
+++ b/deps/v8/src/compiler/graph-visualizer.cc
@@ -12,6 +12,7 @@
 #include "src/compiler/all-nodes.h"
 #include "src/compiler/compiler-source-position-table.h"
 #include "src/compiler/graph.h"
+#include "src/compiler/node-origin-table.h"
 #include "src/compiler/node-properties.h"
 #include "src/compiler/node.h"
 #include "src/compiler/opcodes.h"
@@ -22,14 +23,148 @@
 #include "src/compiler/scheduler.h"
 #include "src/interpreter/bytecodes.h"
 #include "src/objects/script-inl.h"
+#include "src/objects/shared-function-info.h"
 #include "src/optimized-compilation-info.h"
 #include "src/ostreams.h"
+#include "src/source-position.h"
 
 namespace v8 {
 namespace internal {
 namespace compiler {
 
+const char* get_cached_trace_turbo_filename(OptimizedCompilationInfo* info) {
+  if (!info->trace_turbo_filename()) {
+    info->set_trace_turbo_filename(
+        GetVisualizerLogFileName(info, FLAG_trace_turbo_path, nullptr, "json"));
+  }
+  return info->trace_turbo_filename();
+}
+
+TurboJsonFile::TurboJsonFile(OptimizedCompilationInfo* info,
+                             std::ios_base::openmode mode)
+    : std::ofstream(get_cached_trace_turbo_filename(info), mode) {}
+
+TurboJsonFile::~TurboJsonFile() { flush(); }
+
+std::ostream& operator<<(std::ostream& out,
+                         const SourcePositionAsJSON& asJSON) {
+  asJSON.sp.PrintJson(out);
+  return out;
+}
+
+std::ostream& operator<<(std::ostream& out, const NodeOriginAsJSON& asJSON) {
+  asJSON.no.PrintJson(out);
+  return out;
+}
+
+void JsonPrintFunctionSource(std::ostream& os, int source_id,
+                             std::unique_ptr<char[]> function_name,
+                             Handle<Script> script, Isolate* isolate,
+                             Handle<SharedFunctionInfo> shared, bool with_key) {
+  if (with_key) os << "\"" << source_id << "\" : ";
+
+  os << "{ ";
+  os << "\"sourceId\": " << source_id;
+  os << ", \"functionName\": \"" << function_name.get() << "\" ";
+
+  int start = 0;
+  int end = 0;
+  if (!script.is_null() && !script->IsUndefined(isolate) && !shared.is_null()) {
+    Object* source_name = script->name();
+    os << ", \"sourceName\": \"";
+    if (source_name->IsString()) {
+      os << String::cast(source_name)->ToCString().get();
+    }
+    os << "\"";
+    {
+      DisallowHeapAllocation no_allocation;
+      start = shared->StartPosition();
+      end = shared->EndPosition();
+      os << ", \"sourceText\": \"";
+      int len = shared->EndPosition() - start;
+      String::SubStringRange source(String::cast(script->source()), start, len);
+      for (const auto& c : source) {
+        os << AsEscapedUC16ForJSON(c);
+      }
+      os << "\"";
+    }
+  } else {
+    os << ", \"sourceName\": \"\"";
+    os << ", \"sourceText\": \"\"";
+  }
+  os << ", \"startPosition\": " << start;
+  os << ", \"endPosition\": " << end;
+  os << "}";
+}
+
+int SourceIdAssigner::GetIdFor(Handle<SharedFunctionInfo> shared) {
+  for (unsigned i = 0; i < printed_.size(); i++) {
+    if (printed_.at(i).is_identical_to(shared)) {
+      source_ids_.push_back(i);
+      return i;
+    }
+  }
+  const int source_id = static_cast<int>(printed_.size());
+  printed_.push_back(shared);
+  source_ids_.push_back(source_id);
+  return source_id;
+}
+
+namespace {
+
+void JsonPrintInlinedFunctionInfo(
+    std::ostream& os, int source_id, int inlining_id,
+    const OptimizedCompilationInfo::InlinedFunctionHolder& h) {
+  os << "\"" << inlining_id << "\" : ";
+  os << "{ \"inliningId\" : " << inlining_id;
+  os << ", \"sourceId\" : " << source_id;
+  const SourcePosition position = h.position.position;
+  if (position.IsKnown()) {
+    os << ", \"inliningPosition\" : " << AsJSON(position);
+  }
+  os << "}";
+}
+
+}  // namespace
+
+void JsonPrintAllSourceWithPositions(std::ostream& os,
+                                     OptimizedCompilationInfo* info,
+                                     Isolate* isolate) {
+  AllowDeferredHandleDereference allow_deference_for_print_code;
+  os << "\"sources\" : {";
+  Handle<Script> script =
+      (info->shared_info().is_null() || !info->shared_info()->script())
+          ? Handle<Script>()
+          : handle(Script::cast(info->shared_info()->script()), isolate);
+  JsonPrintFunctionSource(os, -1,
+                          info->shared_info().is_null()
+                              ? std::unique_ptr<char[]>(new char[1]{0})
+                              : info->shared_info()->DebugName()->ToCString(),
+                          script, isolate, info->shared_info(), true);
+  const auto& inlined = info->inlined_functions();
+  SourceIdAssigner id_assigner(info->inlined_functions().size());
+  for (unsigned id = 0; id < inlined.size(); id++) {
+    os << ", ";
+    Handle<SharedFunctionInfo> shared = inlined[id].shared_info;
+    const int source_id = id_assigner.GetIdFor(shared);
+    JsonPrintFunctionSource(os, source_id, shared->DebugName()->ToCString(),
+                            handle(Script::cast(shared->script()), isolate),
+                            isolate, shared, true);
+  }
+  os << "}, ";
+  os << "\"inlinings\" : {";
+  bool need_comma = false;
+  for (unsigned id = 0; id < inlined.size(); id++) {
+    if (need_comma) os << ", ";
+    const int source_id = id_assigner.GetIdAt(id);
+    JsonPrintInlinedFunctionInfo(os, source_id, id, inlined[id]);
+    need_comma = true;
+  }
+  os << "}";
+}
+
 std::unique_ptr<char[]> GetVisualizerLogFileName(OptimizedCompilationInfo* info,
+                                                 const char* optional_base_dir,
                                                  const char* phase,
                                                  const char* suffix) {
   EmbeddedVector<char, 256> filename(0);
@@ -39,7 +174,7 @@ std::unique_ptr<char[]> GetVisualizerLogFileName(OptimizedCompilationInfo* info,
     SNPrintF(filename, "turbo-%s-%i", debug_name.get(), optimization_id);
   } else if (info->has_shared_info()) {
     SNPrintF(filename, "turbo-%p-%i",
-             static_cast<void*>(info->shared_info()->address()),
+             reinterpret_cast<void*>(info->shared_info()->address()),
              optimization_id);
   } else {
     SNPrintF(filename, "turbo-none-%i", optimization_id);
@@ -62,16 +197,26 @@ std::unique_ptr<char[]> GetVisualizerLogFileName(OptimizedCompilationInfo* info,
   std::replace(filename.start(), filename.start() + filename.length(), ' ',
                '_');
 
+  EmbeddedVector<char, 256> base_dir;
+  if (optional_base_dir != nullptr) {
+    SNPrintF(base_dir, "%s%c", optional_base_dir,
+             base::OS::DirectorySeparator());
+  } else {
+    base_dir[0] = '\0';
+  }
+
   EmbeddedVector<char, 256> full_filename;
   if (phase == nullptr && !source_available) {
-    SNPrintF(full_filename, "%s.%s", filename.start(), suffix);
+    SNPrintF(full_filename, "%s%s.%s", base_dir.start(), filename.start(),
+             suffix);
   } else if (phase != nullptr && !source_available) {
-    SNPrintF(full_filename, "%s-%s.%s", filename.start(), phase, suffix);
+    SNPrintF(full_filename, "%s%s-%s.%s", base_dir.start(), filename.start(),
+             phase, suffix);
   } else if (phase == nullptr && source_available) {
-    SNPrintF(full_filename, "%s_%s.%s", filename.start(), source_file.start(),
-             suffix);
+    SNPrintF(full_filename, "%s%s_%s.%s", base_dir.start(), filename.start(),
+             source_file.start(), suffix);
   } else {
-    SNPrintF(full_filename, "%s_%s-%s.%s", filename.start(),
+    SNPrintF(full_filename, "%s%s_%s-%s.%s", base_dir.start(), filename.start(),
              source_file.start(), phase, suffix);
   }
 
@@ -114,11 +259,13 @@ class JSONEscaped {
 class JSONGraphNodeWriter {
  public:
   JSONGraphNodeWriter(std::ostream& os, Zone* zone, const Graph* graph,
-                      const SourcePositionTable* positions)
+                      const SourcePositionTable* positions,
+                      const NodeOriginTable* origins)
       : os_(os),
         all_(zone, graph, false),
         live_(zone, graph, true),
         positions_(positions),
+        origins_(origins),
         first_node_(true) {}
 
   void Print() {
@@ -157,7 +304,13 @@ class JSONGraphNodeWriter {
     }
     SourcePosition position = positions_->GetSourcePosition(node);
     if (position.IsKnown()) {
-      os_ << ",\"pos\":" << position.ScriptOffset();
+      os_ << ", \"sourcePosition\" : " << AsJSON(position);
+    }
+    if (origins_) {
+      NodeOrigin origin = origins_->GetNodeOrigin(node);
+      if (origin.IsKnown()) {
+        os_ << ", \"origin\" : " << AsJSON(origin);
+      }
     }
     os_ << ",\"opcode\":\"" << IrOpcode::Mnemonic(node->opcode()) << "\"";
     os_ << ",\"control\":" << (NodeProperties::IsControl(node) ? "true"
@@ -169,9 +322,9 @@ class JSONGraphNodeWriter {
         << node->op()->EffectOutputCount() << " eff "
         << node->op()->ControlOutputCount() << " ctrl out\"";
     if (NodeProperties::IsTyped(node)) {
-      Type* type = NodeProperties::GetType(node);
+      Type type = NodeProperties::GetType(node);
       std::ostringstream type_out;
-      type->PrintTo(type_out);
+      type.PrintTo(type_out);
       os_ << ",\"type\":\"" << JSONEscaped(type_out) << "\"";
     }
     os_ << "}";
@@ -182,6 +335,7 @@ class JSONGraphNodeWriter {
   AllNodes all_;
   AllNodes live_;
   const SourcePositionTable* positions_;
+  const NodeOriginTable* origins_;
   bool first_node_;
 
   DISALLOW_COPY_AND_ASSIGN(JSONGraphNodeWriter);
@@ -238,12 +392,12 @@ class JSONGraphEdgeWriter {
   DISALLOW_COPY_AND_ASSIGN(JSONGraphEdgeWriter);
 };
 
-
-std::ostream& operator<<(std::ostream& os, const AsJSON& ad) {
+std::ostream& operator<<(std::ostream& os, const GraphAsJSON& ad) {
   AccountingAllocator allocator;
   Zone tmp_zone(&allocator, ZONE_NAME);
   os << "{\n\"nodes\":[";
-  JSONGraphNodeWriter(os, &tmp_zone, &ad.graph, ad.positions).Print();
+  JSONGraphNodeWriter(os, &tmp_zone, &ad.graph, ad.positions, ad.origins)
+      .Print();
   os << "],\n\"edges\":[";
   JSONGraphEdgeWriter(os, &tmp_zone, &ad.graph).Print();
   os << "]}";
@@ -400,9 +554,8 @@ void GraphC1Visualizer::PrintInputs(Node* node) {
 
 void GraphC1Visualizer::PrintType(Node* node) {
   if (NodeProperties::IsTyped(node)) {
-    Type* type = NodeProperties::GetType(node);
-    os_ << " type:";
-    type->PrintTo(os_);
+    Type type = NodeProperties::GetType(node);
+    os_ << " type:" << type;
   }
 }
 
@@ -708,9 +861,7 @@ std::ostream& operator<<(std::ostream& os, const AsRPO& ar) {
       os << ")";
       // Print the node type, if any.
       if (NodeProperties::IsTyped(n)) {
-        os << "  [Type: ";
-        NodeProperties::GetType(n)->PrintTo(os);
-        os << "]";
+        os << "  [Type: " << NodeProperties::GetType(n) << "]";
       }
       os << std::endl;
     }
@@ -739,9 +890,7 @@ void PrintScheduledNode(std::ostream& os, int indent, Node* n) {
   os << ")";
   // Print the node type, if any.
   if (NodeProperties::IsTyped(n)) {
-    os << "  [Type: ";
-    NodeProperties::GetType(n)->PrintTo(os);
-    os << "]";
+    os << "  [Type: " << NodeProperties::GetType(n) << "]";
   }
 }
 
diff --git a/deps/v8/src/compiler/graph-visualizer.h b/deps/v8/src/compiler/graph-visualizer.h
index 7fa2f89867433c..4b95169215a8ae 100644
--- a/deps/v8/src/compiler/graph-visualizer.h
+++ b/deps/v8/src/compiler/graph-visualizer.h
@@ -6,6 +6,7 @@
 #define V8_COMPILER_GRAPH_VISUALIZER_H_
 
 #include <stdio.h>
+#include <fstream>  // NOLINT(readability/streams)
 #include <iosfwd>
 #include <memory>
 
@@ -15,26 +16,89 @@ namespace v8 {
 namespace internal {
 
 class OptimizedCompilationInfo;
-
+class SharedFunctionInfo;
+class SourcePosition;
 namespace compiler {
 
 class Graph;
 class InstructionSequence;
+class NodeOrigin;
+class NodeOriginTable;
 class RegisterAllocationData;
 class Schedule;
 class SourcePositionTable;
 
+struct TurboJsonFile : public std::ofstream {
+  TurboJsonFile(OptimizedCompilationInfo* info, std::ios_base::openmode mode);
+  ~TurboJsonFile();
+};
+
+struct SourcePositionAsJSON {
+  explicit SourcePositionAsJSON(const SourcePosition& sp) : sp(sp) {}
+  const SourcePosition& sp;
+};
+
+V8_INLINE V8_EXPORT_PRIVATE SourcePositionAsJSON
+AsJSON(const SourcePosition& sp) {
+  return SourcePositionAsJSON(sp);
+}
+
+struct NodeOriginAsJSON {
+  explicit NodeOriginAsJSON(const NodeOrigin& no) : no(no) {}
+  const NodeOrigin& no;
+};
+
+V8_INLINE V8_EXPORT_PRIVATE NodeOriginAsJSON AsJSON(const NodeOrigin& no) {
+  return NodeOriginAsJSON(no);
+}
+
+std::ostream& operator<<(std::ostream& out, const SourcePositionAsJSON& pos);
+
+// Small helper that deduplicates SharedFunctionInfos.
+class SourceIdAssigner {
+ public:
+  explicit SourceIdAssigner(size_t size) {
+    printed_.reserve(size);
+    source_ids_.reserve(size);
+  }
+  int GetIdFor(Handle<SharedFunctionInfo> shared);
+  int GetIdAt(size_t pos) const { return source_ids_[pos]; }
+
+ private:
+  std::vector<Handle<SharedFunctionInfo>> printed_;
+  std::vector<int> source_ids_;
+};
+
+void JsonPrintAllSourceWithPositions(std::ostream& os,
+                                     OptimizedCompilationInfo* info,
+                                     Isolate* isolate);
+
+void JsonPrintFunctionSource(std::ostream& os, int source_id,
+                             std::unique_ptr<char[]> function_name,
+                             Handle<Script> script, Isolate* isolate,
+                             Handle<SharedFunctionInfo> shared,
+                             bool with_key = false);
 std::unique_ptr<char[]> GetVisualizerLogFileName(OptimizedCompilationInfo* info,
+                                                 const char* optional_base_dir,
                                                  const char* phase,
                                                  const char* suffix);
 
-struct AsJSON {
-  AsJSON(const Graph& g, SourcePositionTable* p) : graph(g), positions(p) {}
+struct GraphAsJSON {
+  GraphAsJSON(const Graph& g, SourcePositionTable* p, NodeOriginTable* o)
+      : graph(g), positions(p), origins(o) {}
   const Graph& graph;
   const SourcePositionTable* positions;
+  const NodeOriginTable* origins;
 };
 
-V8_EXPORT_PRIVATE std::ostream& operator<<(std::ostream& os, const AsJSON& ad);
+V8_INLINE V8_EXPORT_PRIVATE GraphAsJSON AsJSON(const Graph& g,
+                                               SourcePositionTable* p,
+                                               NodeOriginTable* o) {
+  return GraphAsJSON(g, p, o);
+}
+
+V8_EXPORT_PRIVATE std::ostream& operator<<(std::ostream& os,
+                                           const GraphAsJSON& ad);
 
 struct AsRPO {
   explicit AsRPO(const Graph& g) : graph(g) {}
diff --git a/deps/v8/src/compiler/graph.cc b/deps/v8/src/compiler/graph.cc
index 373d6d7ee1bc2d..fea76bff81506f 100644
--- a/deps/v8/src/compiler/graph.cc
+++ b/deps/v8/src/compiler/graph.cc
@@ -73,10 +73,7 @@ NodeId Graph::NextNodeId() {
   return id;
 }
 
-void Graph::Print() const {
-  OFStream os(stdout);
-  os << AsRPO(*this);
-}
+void Graph::Print() const { StdoutStream{} << AsRPO(*this); }
 
 }  // namespace compiler
 }  // namespace internal
diff --git a/deps/v8/src/compiler/ia32/code-generator-ia32.cc b/deps/v8/src/compiler/ia32/code-generator-ia32.cc
index d1b59a5416fd6a..9aef13881189c6 100644
--- a/deps/v8/src/compiler/ia32/code-generator-ia32.cc
+++ b/deps/v8/src/compiler/ia32/code-generator-ia32.cc
@@ -64,7 +64,7 @@ class IA32OperandConverter : public InstructionOperandConverter {
     Constant constant = ToConstant(operand);
     if (constant.type() == Constant::kInt32 &&
         RelocInfo::IsWasmReference(constant.rmode())) {
-      return Immediate(reinterpret_cast<Address>(constant.ToInt32()),
+      return Immediate(static_cast<Address>(constant.ToInt32()),
                        constant.rmode());
     }
     switch (constant.type()) {
@@ -206,22 +206,33 @@ class OutOfLineLoadFloat64NaN final : public OutOfLineCode {
 class OutOfLineTruncateDoubleToI final : public OutOfLineCode {
  public:
   OutOfLineTruncateDoubleToI(CodeGenerator* gen, Register result,
-                             XMMRegister input)
+                             XMMRegister input, StubCallMode stub_mode)
       : OutOfLineCode(gen),
         result_(result),
         input_(input),
+        stub_mode_(stub_mode),
+        isolate_(gen->isolate()),
         zone_(gen->zone()) {}
 
   void Generate() final {
     __ sub(esp, Immediate(kDoubleSize));
     __ movsd(MemOperand(esp, 0), input_);
-    __ SlowTruncateToIDelayed(zone_, result_);
+    if (stub_mode_ == StubCallMode::kCallWasmRuntimeStub) {
+      // A direct call to a wasm runtime stub defined in this module.
+      // Just encode the stub index. This will be patched at relocation.
+      __ wasm_call(wasm::WasmCode::kDoubleToI, RelocInfo::WASM_STUB_CALL);
+    } else {
+      __ Call(BUILTIN_CODE(isolate_, DoubleToI), RelocInfo::CODE_TARGET);
+    }
+    __ mov(result_, MemOperand(esp, 0));
     __ add(esp, Immediate(kDoubleSize));
   }
 
  private:
   Register const result_;
   XMMRegister const input_;
+  StubCallMode stub_mode_;
+  Isolate* isolate_;
   Zone* zone_;
 };
 
@@ -342,35 +353,33 @@ void EmitWordLoadPoisoningIfNeeded(CodeGenerator* codegen,
     }                                                                 \
   } while (0)
 
-#define ASSEMBLE_IEEE754_BINOP(name)                                    \
-  do {                                                                  \
-    /* Pass two doubles as arguments on the stack. */                   \
-    __ PrepareCallCFunction(4, eax);                                    \
-    __ movsd(Operand(esp, 0 * kDoubleSize), i.InputDoubleRegister(0));  \
-    __ movsd(Operand(esp, 1 * kDoubleSize), i.InputDoubleRegister(1));  \
-    __ CallCFunction(                                                   \
-        ExternalReference::ieee754_##name##_function(__ isolate()), 4); \
-    /* Return value is in st(0) on ia32. */                             \
-    /* Store it into the result register. */                            \
-    __ sub(esp, Immediate(kDoubleSize));                                \
-    __ fstp_d(Operand(esp, 0));                                         \
-    __ movsd(i.OutputDoubleRegister(), Operand(esp, 0));                \
-    __ add(esp, Immediate(kDoubleSize));                                \
+#define ASSEMBLE_IEEE754_BINOP(name)                                     \
+  do {                                                                   \
+    /* Pass two doubles as arguments on the stack. */                    \
+    __ PrepareCallCFunction(4, eax);                                     \
+    __ movsd(Operand(esp, 0 * kDoubleSize), i.InputDoubleRegister(0));   \
+    __ movsd(Operand(esp, 1 * kDoubleSize), i.InputDoubleRegister(1));   \
+    __ CallCFunction(ExternalReference::ieee754_##name##_function(), 4); \
+    /* Return value is in st(0) on ia32. */                              \
+    /* Store it into the result register. */                             \
+    __ sub(esp, Immediate(kDoubleSize));                                 \
+    __ fstp_d(Operand(esp, 0));                                          \
+    __ movsd(i.OutputDoubleRegister(), Operand(esp, 0));                 \
+    __ add(esp, Immediate(kDoubleSize));                                 \
   } while (false)
 
-#define ASSEMBLE_IEEE754_UNOP(name)                                     \
-  do {                                                                  \
-    /* Pass one double as argument on the stack. */                     \
-    __ PrepareCallCFunction(2, eax);                                    \
-    __ movsd(Operand(esp, 0 * kDoubleSize), i.InputDoubleRegister(0));  \
-    __ CallCFunction(                                                   \
-        ExternalReference::ieee754_##name##_function(__ isolate()), 2); \
-    /* Return value is in st(0) on ia32. */                             \
-    /* Store it into the result register. */                            \
-    __ sub(esp, Immediate(kDoubleSize));                                \
-    __ fstp_d(Operand(esp, 0));                                         \
-    __ movsd(i.OutputDoubleRegister(), Operand(esp, 0));                \
-    __ add(esp, Immediate(kDoubleSize));                                \
+#define ASSEMBLE_IEEE754_UNOP(name)                                      \
+  do {                                                                   \
+    /* Pass one double as argument on the stack. */                      \
+    __ PrepareCallCFunction(2, eax);                                     \
+    __ movsd(Operand(esp, 0 * kDoubleSize), i.InputDoubleRegister(0));   \
+    __ CallCFunction(ExternalReference::ieee754_##name##_function(), 2); \
+    /* Return value is in st(0) on ia32. */                              \
+    /* Store it into the result register. */                             \
+    __ sub(esp, Immediate(kDoubleSize));                                 \
+    __ fstp_d(Operand(esp, 0));                                          \
+    __ movsd(i.OutputDoubleRegister(), Operand(esp, 0));                 \
+    __ add(esp, Immediate(kDoubleSize));                                 \
   } while (false)
 
 #define ASSEMBLE_BINOP(asm_instr)                                     \
@@ -411,6 +420,30 @@ void EmitWordLoadPoisoningIfNeeded(CodeGenerator* codegen,
     }                                                       \
   } while (0)
 
+#define ASSEMBLE_SIMD_PUNPCK_SHUFFLE(opcode)                         \
+  do {                                                               \
+    XMMRegister src0 = i.InputSimd128Register(0);                    \
+    Operand src1 = i.InputOperand(instr->InputCount() == 2 ? 1 : 0); \
+    if (CpuFeatures::IsSupported(AVX)) {                             \
+      CpuFeatureScope avx_scope(tasm(), AVX);                        \
+      __ v##opcode(i.OutputSimd128Register(), src0, src1);           \
+    } else {                                                         \
+      DCHECK_EQ(i.OutputSimd128Register(), src0);                    \
+      __ opcode(i.OutputSimd128Register(), src1);                    \
+    }                                                                \
+  } while (false)
+
+#define ASSEMBLE_SIMD_IMM_SHUFFLE(opcode, SSELevel, imm)               \
+  if (CpuFeatures::IsSupported(AVX)) {                                 \
+    CpuFeatureScope avx_scope(tasm(), AVX);                            \
+    __ v##opcode(i.OutputSimd128Register(), i.InputSimd128Register(0), \
+                 i.InputOperand(1), imm);                              \
+  } else {                                                             \
+    CpuFeatureScope sse_scope(tasm(), SSELevel);                       \
+    DCHECK_EQ(i.OutputSimd128Register(), i.InputSimd128Register(0));   \
+    __ opcode(i.OutputSimd128Register(), i.InputOperand(1), imm);      \
+  }
+
 void CodeGenerator::AssembleDeconstructFrame() {
   __ mov(esp, ebp);
   __ pop(ebp);
@@ -544,6 +577,9 @@ void CodeGenerator::BailoutIfDeoptimized() {
   __ mov(ebx, Operand(kJavaScriptCallCodeStartRegister, offset));
   __ test(FieldOperand(ebx, CodeDataContainer::kKindSpecificFlagsOffset),
           Immediate(1 << Code::kMarkedForDeoptimizationBit));
+  // Ensure we're not serializing (otherwise we'd need to use an indirection to
+  // access the builtin below).
+  DCHECK(!isolate()->ShouldLoadConstantsFromRootList());
   Handle<Code> code = isolate()->builtins()->builtin_handle(
       Builtins::kCompileLazyDeoptimizedCode);
   __ j(not_zero, code, RelocInfo::CODE_TARGET);
@@ -583,6 +619,9 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
         __ call(code, RelocInfo::CODE_TARGET);
       } else {
         Register reg = i.InputRegister(0);
+        DCHECK_IMPLIES(
+            HasCallDescriptorFlag(instr, CallDescriptor::kFixedTargetRegister),
+            reg == kJavaScriptCallCodeStartRegister);
         __ add(reg, Immediate(Code::kHeaderSize - kHeapObjectTag));
         if (HasCallDescriptorFlag(instr, CallDescriptor::kRetpoline)) {
           __ RetpolineCall(reg);
@@ -597,15 +636,15 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
     case kArchCallWasmFunction: {
       MoveOperandIfAliasedWithPoisonRegister(instr, this);
       if (HasImmediateInput(instr, 0)) {
-        Address wasm_code = reinterpret_cast<Address>(
-            i.ToConstant(instr->InputAt(0)).ToInt32());
-        if (info()->IsWasm()) {
-          __ wasm_call(wasm_code, RelocInfo::WASM_CALL);
+        Constant constant = i.ToConstant(instr->InputAt(0));
+        Address wasm_code = static_cast<Address>(constant.ToInt32());
+        if (DetermineStubCallMode() == StubCallMode::kCallWasmRuntimeStub) {
+          __ wasm_call(wasm_code, constant.rmode());
         } else {
           if (HasCallDescriptorFlag(instr, CallDescriptor::kRetpoline)) {
-            __ RetpolineCall(wasm_code, RelocInfo::JS_TO_WASM_CALL);
+            __ RetpolineCall(wasm_code, constant.rmode());
           } else {
-            __ call(wasm_code, RelocInfo::JS_TO_WASM_CALL);
+            __ call(wasm_code, constant.rmode());
           }
         }
       } else {
@@ -632,6 +671,9 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
         __ jmp(code, RelocInfo::CODE_TARGET);
       } else {
         Register reg = i.InputRegister(0);
+        DCHECK_IMPLIES(
+            HasCallDescriptorFlag(instr, CallDescriptor::kFixedTargetRegister),
+            reg == kJavaScriptCallCodeStartRegister);
         __ add(reg, Immediate(Code::kHeaderSize - kHeapObjectTag));
         if (HasCallDescriptorFlag(instr, CallDescriptor::kRetpoline)) {
           __ RetpolineJump(reg);
@@ -646,13 +688,9 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
     case kArchTailCallWasm: {
       MoveOperandIfAliasedWithPoisonRegister(instr, this);
       if (HasImmediateInput(instr, 0)) {
-        Address wasm_code = reinterpret_cast<Address>(
-            i.ToConstant(instr->InputAt(0)).ToInt32());
-        if (info()->IsWasm()) {
-          __ jmp(wasm_code, RelocInfo::WASM_CALL);
-        } else {
-          __ jmp(wasm_code, RelocInfo::JS_TO_WASM_CALL);
-        }
+        Constant constant = i.ToConstant(instr->InputAt(0));
+        Address wasm_code = static_cast<Address>(constant.ToInt32());
+        __ jmp(wasm_code, constant.rmode());
       } else {
         Register reg = i.InputRegister(0);
         if (HasCallDescriptorFlag(instr, CallDescriptor::kRetpoline)) {
@@ -669,6 +707,9 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       MoveOperandIfAliasedWithPoisonRegister(instr, this);
       CHECK(!HasImmediateInput(instr, 0));
       Register reg = i.InputRegister(0);
+      DCHECK_IMPLIES(
+          HasCallDescriptorFlag(instr, CallDescriptor::kFixedTargetRegister),
+          reg == kJavaScriptCallCodeStartRegister);
       if (HasCallDescriptorFlag(instr, CallDescriptor::kRetpoline)) {
         __ RetpolineJump(reg);
       } else {
@@ -761,17 +802,18 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
     case kArchJmp:
       AssembleArchJump(i.InputRpo(0));
       break;
+    case kArchBinarySearchSwitch:
+      AssembleArchBinarySearchSwitch(instr);
+      break;
     case kArchLookupSwitch:
       AssembleArchLookupSwitch(instr);
       break;
     case kArchTableSwitch:
       AssembleArchTableSwitch(instr);
       break;
-    case kArchComment: {
-      Address comment_string = i.InputExternalReference(0).address();
-      __ RecordComment(reinterpret_cast<const char*>(comment_string));
+    case kArchComment:
+      __ RecordComment(reinterpret_cast<const char*>(i.InputInt32(0)));
       break;
-    }
     case kArchDebugAbort:
       DCHECK(i.InputRegister(0) == edx);
       if (!frame_access_state()->has_frame()) {
@@ -817,13 +859,11 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
         __ mov(i.OutputRegister(), ebp);
       }
       break;
-    case kArchRootsPointer:
-      // TODO(jgruber,v8:6666): Implement ia32 support.
-      UNREACHABLE();
     case kArchTruncateDoubleToI: {
       auto result = i.OutputRegister();
       auto input = i.InputDoubleRegister(0);
-      auto ool = new (zone()) OutOfLineTruncateDoubleToI(this, result, input);
+      auto ool = new (zone()) OutOfLineTruncateDoubleToI(
+          this, result, input, DetermineStubCallMode());
       __ cvttsd2si(result, Operand(input));
       __ cmp(result, 1);
       __ j(overflow, ool->entry());
@@ -913,7 +953,7 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
         __ movaps(xmm1, xmm2);
         __ movaps(xmm2, xmm0);
       }
-      __ CallStubDelayed(new (zone()) MathPowStub());
+      __ Call(BUILTIN_CODE(isolate(), MathPowInternal), RelocInfo::CODE_TARGET);
       __ movaps(i.OutputDoubleRegister(), xmm3);
       break;
     }
@@ -1112,7 +1152,7 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
     case kIA32Popcnt:
       __ Popcnt(i.OutputRegister(), i.InputOperand(0));
       break;
-    case kArchPoisonOnSpeculationWord:
+    case kArchWordPoisonOnSpeculation:
       DCHECK_EQ(i.OutputRegister(), i.InputRegister(0));
       __ and_(i.InputRegister(0), kSpeculationPoisonRegister);
       break;
@@ -1348,43 +1388,27 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
     case kSSEFloat32ToInt32:
       __ cvttss2si(i.OutputRegister(), i.InputOperand(0));
       break;
-    case kSSEFloat32ToUint32: {
-      Label success;
-      __ cvttss2si(i.OutputRegister(), i.InputOperand(0));
-      __ test(i.OutputRegister(), i.OutputRegister());
-      __ j(positive, &success);
-      __ Move(kScratchDoubleReg, static_cast<float>(INT32_MIN));
-      __ addss(kScratchDoubleReg, i.InputOperand(0));
-      __ cvttss2si(i.OutputRegister(), kScratchDoubleReg);
-      __ or_(i.OutputRegister(), Immediate(0x80000000));
-      __ bind(&success);
+    case kSSEFloat32ToUint32:
+      __ Cvttss2ui(i.OutputRegister(), i.InputOperand(0), kScratchDoubleReg);
       break;
-    }
     case kSSEFloat64ToInt32:
       __ cvttsd2si(i.OutputRegister(), i.InputOperand(0));
       break;
-    case kSSEFloat64ToUint32: {
-      __ Move(kScratchDoubleReg, -2147483648.0);
-      __ addsd(kScratchDoubleReg, i.InputOperand(0));
-      __ cvttsd2si(i.OutputRegister(), kScratchDoubleReg);
-      __ add(i.OutputRegister(), Immediate(0x80000000));
+    case kSSEFloat64ToUint32:
+      __ Cvttsd2ui(i.OutputRegister(), i.InputOperand(0), kScratchDoubleReg);
       break;
-    }
     case kSSEInt32ToFloat32:
       __ cvtsi2ss(i.OutputDoubleRegister(), i.InputOperand(0));
       break;
-    case kSSEUint32ToFloat32: {
-      Register scratch0 = i.TempRegister(0);
-      Register scratch1 = i.TempRegister(1);
-      __ mov(scratch0, i.InputOperand(0));
-      __ Cvtui2ss(i.OutputDoubleRegister(), scratch0, scratch1);
+    case kSSEUint32ToFloat32:
+      __ Cvtui2ss(i.OutputDoubleRegister(), i.InputOperand(0),
+                  i.TempRegister(0));
       break;
-    }
     case kSSEInt32ToFloat64:
       __ cvtsi2sd(i.OutputDoubleRegister(), i.InputOperand(0));
       break;
     case kSSEUint32ToFloat64:
-      __ LoadUint32(i.OutputDoubleRegister(), i.InputOperand(0));
+      __ Cvtui2sd(i.OutputDoubleRegister(), i.InputOperand(0));
       break;
     case kSSEFloat64ExtractLowWord32:
       if (instr->InputAt(0)->IsFPStackSlot()) {
@@ -1986,6 +2010,52 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
                  i.InputOperand(2), i.InputInt8(1));
       break;
     }
+    case kSSEI32x4SConvertF32x4: {
+      DCHECK_EQ(i.OutputSimd128Register(), i.InputSimd128Register(0));
+      XMMRegister dst = i.OutputSimd128Register();
+      // NAN->0
+      __ movaps(kScratchDoubleReg, dst);
+      __ cmpeqps(kScratchDoubleReg, kScratchDoubleReg);
+      __ pand(dst, kScratchDoubleReg);
+      // Set top bit if >= 0 (but not -0.0!)
+      __ pxor(kScratchDoubleReg, dst);
+      // Convert
+      __ cvttps2dq(dst, dst);
+      // Set top bit if >=0 is now < 0
+      __ pand(kScratchDoubleReg, dst);
+      __ psrad(kScratchDoubleReg, 31);
+      // Set positive overflow lanes to 0x7FFFFFFF
+      __ pxor(dst, kScratchDoubleReg);
+      break;
+    }
+    case kAVXI32x4SConvertF32x4: {
+      CpuFeatureScope avx_scope(tasm(), AVX);
+      XMMRegister dst = i.OutputSimd128Register();
+      XMMRegister src = i.InputSimd128Register(0);
+      // NAN->0
+      __ vcmpeqps(kScratchDoubleReg, src, src);
+      __ vpand(dst, src, kScratchDoubleReg);
+      // Set top bit if >= 0 (but not -0.0!)
+      __ vpxor(kScratchDoubleReg, kScratchDoubleReg, dst);
+      // Convert
+      __ vcvttps2dq(dst, dst);
+      // Set top bit if >=0 is now < 0
+      __ vpand(kScratchDoubleReg, kScratchDoubleReg, dst);
+      __ vpsrad(kScratchDoubleReg, kScratchDoubleReg, 31);
+      // Set positive overflow lanes to 0x7FFFFFFF
+      __ vpxor(dst, dst, kScratchDoubleReg);
+      break;
+    }
+    case kIA32I32x4SConvertI16x8Low: {
+      __ Pmovsxwd(i.OutputSimd128Register(), i.InputOperand(0));
+      break;
+    }
+    case kIA32I32x4SConvertI16x8High: {
+      XMMRegister dst = i.OutputSimd128Register();
+      __ Palignr(dst, i.InputOperand(0), 8);
+      __ Pmovsxwd(dst, dst);
+      break;
+    }
     case kIA32I32x4Neg: {
       XMMRegister dst = i.OutputSimd128Register();
       Operand src = i.InputOperand(0);
@@ -2145,6 +2215,71 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       __ vpcmpeqd(i.OutputSimd128Register(), kScratchDoubleReg, src2);
       break;
     }
+    case kSSEI32x4UConvertF32x4: {
+      DCHECK_EQ(i.OutputSimd128Register(), i.InputSimd128Register(0));
+      CpuFeatureScope sse_scope(tasm(), SSE4_1);
+      XMMRegister dst = i.OutputSimd128Register();
+      XMMRegister tmp = i.ToSimd128Register(instr->TempAt(0));
+      // NAN->0, negative->0
+      __ pxor(kScratchDoubleReg, kScratchDoubleReg);
+      __ maxps(dst, kScratchDoubleReg);
+      // scratch: float representation of max_signed
+      __ pcmpeqd(kScratchDoubleReg, kScratchDoubleReg);
+      __ psrld(kScratchDoubleReg, 1);                     // 0x7fffffff
+      __ cvtdq2ps(kScratchDoubleReg, kScratchDoubleReg);  // 0x4f000000
+      // tmp: convert (src-max_signed).
+      // Positive overflow lanes -> 0x7FFFFFFF
+      // Negative lanes -> 0
+      __ movaps(tmp, dst);
+      __ subps(tmp, kScratchDoubleReg);
+      __ cmpleps(kScratchDoubleReg, tmp);
+      __ cvttps2dq(tmp, tmp);
+      __ pxor(tmp, kScratchDoubleReg);
+      __ pxor(kScratchDoubleReg, kScratchDoubleReg);
+      __ pmaxsd(tmp, kScratchDoubleReg);
+      // convert. Overflow lanes above max_signed will be 0x80000000
+      __ cvttps2dq(dst, dst);
+      // Add (src-max_signed) for overflow lanes.
+      __ paddd(dst, tmp);
+      break;
+    }
+    case kAVXI32x4UConvertF32x4: {
+      DCHECK_EQ(i.OutputSimd128Register(), i.InputSimd128Register(0));
+      CpuFeatureScope avx_scope(tasm(), AVX);
+      XMMRegister dst = i.OutputSimd128Register();
+      XMMRegister tmp = i.ToSimd128Register(instr->TempAt(0));
+      // NAN->0, negative->0
+      __ vpxor(kScratchDoubleReg, kScratchDoubleReg, kScratchDoubleReg);
+      __ vmaxps(dst, dst, kScratchDoubleReg);
+      // scratch: float representation of max_signed
+      __ vpcmpeqd(kScratchDoubleReg, kScratchDoubleReg, kScratchDoubleReg);
+      __ vpsrld(kScratchDoubleReg, kScratchDoubleReg, 1);  // 0x7fffffff
+      __ vcvtdq2ps(kScratchDoubleReg, kScratchDoubleReg);  // 0x4f000000
+      // tmp: convert (src-max_signed).
+      // Positive overflow lanes -> 0x7FFFFFFF
+      // Negative lanes -> 0
+      __ vsubps(tmp, dst, kScratchDoubleReg);
+      __ vcmpleps(kScratchDoubleReg, kScratchDoubleReg, tmp);
+      __ vcvttps2dq(tmp, tmp);
+      __ vpxor(tmp, tmp, kScratchDoubleReg);
+      __ vpxor(kScratchDoubleReg, kScratchDoubleReg, kScratchDoubleReg);
+      __ vpmaxsd(tmp, tmp, kScratchDoubleReg);
+      // convert. Overflow lanes above max_signed will be 0x80000000
+      __ vcvttps2dq(dst, dst);
+      // Add (src-max_signed) for overflow lanes.
+      __ vpaddd(dst, dst, tmp);
+      break;
+    }
+    case kIA32I32x4UConvertI16x8Low: {
+      __ Pmovzxwd(i.OutputSimd128Register(), i.InputOperand(0));
+      break;
+    }
+    case kIA32I32x4UConvertI16x8High: {
+      XMMRegister dst = i.OutputSimd128Register();
+      __ Palignr(dst, i.InputOperand(0), 8);
+      __ Pmovzxwd(dst, dst);
+      break;
+    }
     case kSSEI32x4ShrU: {
       DCHECK_EQ(i.OutputSimd128Register(), i.InputSimd128Register(0));
       __ psrld(i.OutputSimd128Register(), i.InputInt8(1));
@@ -2243,6 +2378,16 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
                  i.InputOperand(2), i.InputInt8(1));
       break;
     }
+    case kIA32I16x8SConvertI8x16Low: {
+      __ Pmovsxbw(i.OutputSimd128Register(), i.InputOperand(0));
+      break;
+    }
+    case kIA32I16x8SConvertI8x16High: {
+      XMMRegister dst = i.OutputSimd128Register();
+      __ Palignr(dst, i.InputOperand(0), 8);
+      __ Pmovsxbw(dst, dst);
+      break;
+    }
     case kIA32I16x8Neg: {
       XMMRegister dst = i.OutputSimd128Register();
       Operand src = i.InputOperand(0);
@@ -2277,6 +2422,17 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
                 i.InputInt8(1));
       break;
     }
+    case kSSEI16x8SConvertI32x4: {
+      DCHECK_EQ(i.OutputSimd128Register(), i.InputSimd128Register(0));
+      __ packssdw(i.OutputSimd128Register(), i.InputOperand(1));
+      break;
+    }
+    case kAVXI16x8SConvertI32x4: {
+      CpuFeatureScope avx_scope(tasm(), AVX);
+      __ vpackssdw(i.OutputSimd128Register(), i.InputSimd128Register(0),
+                   i.InputOperand(1));
+      break;
+    }
     case kSSEI16x8Add: {
       DCHECK_EQ(i.OutputSimd128Register(), i.InputSimd128Register(0));
       __ paddw(i.OutputSimd128Register(), i.InputOperand(1));
@@ -2420,6 +2576,16 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       __ vpcmpeqw(i.OutputSimd128Register(), kScratchDoubleReg, src2);
       break;
     }
+    case kIA32I16x8UConvertI8x16Low: {
+      __ Pmovzxbw(i.OutputSimd128Register(), i.InputOperand(0));
+      break;
+    }
+    case kIA32I16x8UConvertI8x16High: {
+      XMMRegister dst = i.OutputSimd128Register();
+      __ Palignr(dst, i.InputOperand(0), 8);
+      __ Pmovzxbw(dst, dst);
+      break;
+    }
     case kSSEI16x8ShrU: {
       DCHECK_EQ(i.OutputSimd128Register(), i.InputSimd128Register(0));
       __ psrlw(i.OutputSimd128Register(), i.InputInt8(1));
@@ -2431,6 +2597,30 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
                 i.InputInt8(1));
       break;
     }
+    case kSSEI16x8UConvertI32x4: {
+      DCHECK_EQ(i.OutputSimd128Register(), i.InputSimd128Register(0));
+      CpuFeatureScope sse_scope(tasm(), SSE4_1);
+      XMMRegister dst = i.OutputSimd128Register();
+      // Change negative lanes to 0x7FFFFFFF
+      __ pcmpeqd(kScratchDoubleReg, kScratchDoubleReg);
+      __ psrld(kScratchDoubleReg, 1);
+      __ pminud(dst, kScratchDoubleReg);
+      __ pminud(kScratchDoubleReg, i.InputOperand(1));
+      __ packusdw(dst, kScratchDoubleReg);
+      break;
+    }
+    case kAVXI16x8UConvertI32x4: {
+      DCHECK_EQ(i.OutputSimd128Register(), i.InputSimd128Register(0));
+      CpuFeatureScope avx_scope(tasm(), AVX);
+      XMMRegister dst = i.OutputSimd128Register();
+      // Change negative lanes to 0x7FFFFFFF
+      __ vpcmpeqd(kScratchDoubleReg, kScratchDoubleReg, kScratchDoubleReg);
+      __ vpsrld(kScratchDoubleReg, kScratchDoubleReg, 1);
+      __ vpminud(dst, kScratchDoubleReg, i.InputSimd128Register(0));
+      __ vpminud(kScratchDoubleReg, kScratchDoubleReg, i.InputOperand(1));
+      __ vpackusdw(dst, dst, kScratchDoubleReg);
+      break;
+    }
     case kSSEI16x8AddSaturateU: {
       DCHECK_EQ(i.OutputSimd128Register(), i.InputSimd128Register(0));
       __ paddusw(i.OutputSimd128Register(), i.InputOperand(1));
@@ -2541,6 +2731,17 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
                  i.InputOperand(2), i.InputInt8(1));
       break;
     }
+    case kSSEI8x16SConvertI16x8: {
+      DCHECK_EQ(i.OutputSimd128Register(), i.InputSimd128Register(0));
+      __ packsswb(i.OutputSimd128Register(), i.InputOperand(1));
+      break;
+    }
+    case kAVXI8x16SConvertI16x8: {
+      CpuFeatureScope avx_scope(tasm(), AVX);
+      __ vpacksswb(i.OutputSimd128Register(), i.InputSimd128Register(0),
+                   i.InputOperand(1));
+      break;
+    }
     case kIA32I8x16Neg: {
       XMMRegister dst = i.OutputSimd128Register();
       Operand src = i.InputOperand(0);
@@ -2553,29 +2754,23 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       }
       break;
     }
-
-#define I8x16_SPLAT(reg, scratch, v)      \
-  __ Move(reg, static_cast<uint32_t>(v)); \
-  __ Pxor(scratch, scratch);              \
-  __ Pshufb(reg, scratch)
-
     case kSSEI8x16Shl: {
-      DCHECK_EQ(i.OutputSimd128Register(), i.InputSimd128Register(0));
-      XMMRegister src = i.InputSimd128Register(0);
+      XMMRegister dst = i.OutputSimd128Register();
+      DCHECK_EQ(dst, i.InputSimd128Register(0));
       int8_t shift = i.InputInt8(1) & 0x7;
-      XMMRegister tmp = i.ToSimd128Register(instr->TempAt(0));
-
-      // src = AAaa ... AAaa
-      // tmp = 0F0F ... 0F0F (shift=4)
-      I8x16_SPLAT(tmp, kScratchDoubleReg, 0xFFU >> shift);
-
-      // src = src & tmp
-      //    => 0A0a ... 0A0a
-      __ pand(src, tmp);
-
-      // src = src << shift
-      //    => A0a0 ... A0a0 (shift=4)
-      __ pslld(src, shift);
+      if (shift < 4) {
+        // For small shifts, doubling is faster.
+        for (int i = 0; i < shift; ++i) {
+          __ paddb(dst, dst);
+        }
+      } else {
+        // Mask off the unwanted bits before word-shifting.
+        __ pcmpeqw(kScratchDoubleReg, kScratchDoubleReg);
+        __ psrlw(kScratchDoubleReg, 8 + shift);
+        __ packuswb(kScratchDoubleReg, kScratchDoubleReg);
+        __ pand(dst, kScratchDoubleReg);
+        __ psllw(dst, shift);
+      }
       break;
     }
     case kAVXI8x16Shl: {
@@ -2583,94 +2778,32 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       XMMRegister dst = i.OutputSimd128Register();
       XMMRegister src = i.InputSimd128Register(0);
       int8_t shift = i.InputInt8(1) & 0x7;
-      XMMRegister tmp =
-          dst != src ? dst : i.ToSimd128Register(instr->TempAt(0));
-
-      // src = AAaa ... AAaa
-      // tmp = 0F0F ... 0F0F (shift=4)
-      I8x16_SPLAT(tmp, kScratchDoubleReg, 0xFFU >> shift);
-
-      // dst = src & tmp
-      //    => 0A0a ... 0A0a
-      __ vpand(dst, src, tmp);
-
-      // dst = dst << shift
-      //    => A0a0 ... A0a0 (shift=4)
-      __ vpslld(dst, dst, shift);
-      break;
-    }
-    case kSSEI8x16ShrS: {
-      DCHECK_EQ(i.OutputSimd128Register(), i.InputSimd128Register(0));
-      XMMRegister src = i.InputSimd128Register(0);
-      int8_t shift = i.InputInt8(1) & 0x7;
-      XMMRegister tmp = i.ToSimd128Register(instr->TempAt(0));
-
-      // I16x8 view of I8x16
-      // src = AAaa AAaa ... AAaa AAaa
-
-      // tmp = aa00 aa00 ... aa00 aa00
-      __ movaps(tmp, src);
-      __ Move(kScratchDoubleReg, static_cast<uint32_t>(0xff00));
-      __ psllw(tmp, 8);
-
-      // src = I16x8ShrS(src, shift)
-      //    => SAAa SAAa ... SAAa SAAa (shift=4)
-      __ pshuflw(kScratchDoubleReg, kScratchDoubleReg, 0x0);
-      __ psraw(src, shift);
-
-      // tmp = I16x8ShrS(tmp, shift)
-      //    => Saa0 Saa0 ... Saa0 Saa0 (shift=4)
-      __ pshufd(kScratchDoubleReg, kScratchDoubleReg, 0x0);
-      __ psraw(tmp, shift);
-
-      // src = I16x8And(src, 0xff00)
-      //    => SA00 SA00 ... SA00 SA00
-      __ pand(src, kScratchDoubleReg);
-
-      // tmp = I16x8ShrU(tmp, 8)
-      //    => 00Sa 00Sa ... 00Sa 00Sa (shift=4)
-      __ psrlw(tmp, 8);
-
-      // src = I16x8Or(src, tmp)
-      //    => SASa SASa ... SASa SASa (shift=4)
-      __ por(src, tmp);
+      if (shift < 4) {
+        // For small shifts, doubling is faster.
+        for (int i = 0; i < shift; ++i) {
+          __ vpaddb(dst, src, src);
+          src = dst;
+        }
+      } else {
+        // Mask off the unwanted bits before word-shifting.
+        __ vpcmpeqw(kScratchDoubleReg, kScratchDoubleReg, kScratchDoubleReg);
+        __ vpsrlw(kScratchDoubleReg, kScratchDoubleReg, 8 + shift);
+        __ vpackuswb(kScratchDoubleReg, kScratchDoubleReg, kScratchDoubleReg);
+        __ vpand(dst, src, kScratchDoubleReg);
+        __ vpsllw(dst, dst, shift);
+      }
       break;
     }
-    case kAVXI8x16ShrS: {
-      CpuFeatureScope avx_scope(tasm(), AVX);
+    case kIA32I8x16ShrS: {
       XMMRegister dst = i.OutputSimd128Register();
       XMMRegister src = i.InputSimd128Register(0);
       int8_t shift = i.InputInt8(1) & 0x7;
-      XMMRegister tmp = i.ToSimd128Register(instr->TempAt(0));
-
-      // I16x8 view of I8x16
-      // src = AAaa AAaa ... AAaa AAaa
-
-      // tmp = aa00 aa00 ... aa00 aa00
-      __ Move(kScratchDoubleReg, static_cast<uint32_t>(0xff00));
-      __ vpsllw(tmp, src, 8);
-
-      // dst = I16x8ShrS(src, shift)
-      //    => SAAa SAAa ... SAAa SAAa (shift=4)
-      __ vpshuflw(kScratchDoubleReg, kScratchDoubleReg, 0x0);
-      __ vpsraw(dst, src, shift);
-
-      // tmp = I16x8ShrS(tmp, shift)
-      //    => Saa0 Saa0 ... Saa0 Saa0 (shift=4)
-      __ vpshufd(kScratchDoubleReg, kScratchDoubleReg, 0x0);
-      __ vpsraw(tmp, tmp, shift);
-
-      // dst = I16x8And(dst, 0xff00)
-      //    => SA00 SA00 ... SA00 SA00
-      __ vpand(dst, dst, kScratchDoubleReg);
-
-      // tmp = I16x8ShrU(tmp, 8)
-      //    => 00Sa 00Sa ... 00Sa 00Sa (shift=4)
-      __ vpsrlw(tmp, tmp, 8);
-
-      // dst = I16x8Or(dst, tmp)
-      //    => SASa SASa ... SASa SASa (shift=4)
-      __ vpor(dst, dst, tmp);
+      // Unpack the bytes into words, do arithmetic shifts, and repack.
+      __ Punpckhbw(kScratchDoubleReg, src);
+      __ Punpcklbw(dst, src);
+      __ Psraw(kScratchDoubleReg, 8 + shift);
+      __ Psraw(dst, 8 + shift);
+      __ Packsswb(dst, kScratchDoubleReg);
       break;
     }
     case kSSEI8x16Add: {
@@ -2718,44 +2851,42 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       break;
     }
     case kSSEI8x16Mul: {
-      DCHECK_EQ(i.OutputSimd128Register(), i.InputSimd128Register(0));
-      XMMRegister left = i.InputSimd128Register(0);
+      XMMRegister dst = i.OutputSimd128Register();
+      DCHECK_EQ(dst, i.InputSimd128Register(0));
       XMMRegister right = i.InputSimd128Register(1);
-      XMMRegister t0 = i.ToSimd128Register(instr->TempAt(0));
-      XMMRegister t1 = i.ToSimd128Register(instr->TempAt(1));
+      XMMRegister tmp = i.ToSimd128Register(instr->TempAt(0));
 
       // I16x8 view of I8x16
       // left = AAaa AAaa ... AAaa AAaa
       // right= BBbb BBbb ... BBbb BBbb
 
-      // t0 = 00AA 00AA ... 00AA 00AA
-      // t1 = 00BB 00BB ... 00BB 00BB
-      __ movaps(t0, left);
-      __ movaps(t1, right);
-      __ Move(kScratchDoubleReg, static_cast<uint32_t>(0x00ff));
-      __ psrlw(t0, 8);
-      __ psrlw(t1, 8);
-
-      // left = I16x8Mul(left, right)
-      //    => __pp __pp ...  __pp  __pp
-      // t0 = I16x8Mul(t0, t1)
+      // t = 00AA 00AA ... 00AA 00AA
+      // s = 00BB 00BB ... 00BB 00BB
+      __ movaps(tmp, dst);
+      __ movaps(kScratchDoubleReg, right);
+      __ psrlw(tmp, 8);
+      __ psrlw(kScratchDoubleReg, 8);
+      // dst = left * 256
+      __ psllw(dst, 8);
+
+      // t = I16x8Mul(t, s)
       //    => __PP __PP ...  __PP  __PP
-      __ pshuflw(kScratchDoubleReg, kScratchDoubleReg, 0x0);
-      __ pmullw(t0, t1);
-      __ pmullw(left, right);
-      __ pshufd(kScratchDoubleReg, kScratchDoubleReg, 0x0);
+      __ pmullw(tmp, kScratchDoubleReg);
+      // dst = I16x8Mul(left * 256, right)
+      //    => pp__ pp__ ...  pp__  pp__
+      __ pmullw(dst, right);
 
-      // t0 = I16x8Shl(t0, 8)
+      // t = I16x8Shl(t, 8)
       //    => PP00 PP00 ...  PP00  PP00
-      __ psllw(t0, 8);
+      __ psllw(tmp, 8);
 
-      // left = I16x8And(left, 0x00ff)
+      // dst = I16x8Shr(dst, 8)
       //    => 00pp 00pp ...  00pp  00pp
-      __ pand(left, kScratchDoubleReg);
+      __ psrlw(dst, 8);
 
-      // left = I16x8Or(left, t0)
+      // dst = I16x8Or(dst, t)
       //    => PPpp PPpp ...  PPpp  PPpp
-      __ por(left, t0);
+      __ por(dst, tmp);
       break;
     }
     case kAVXI8x16Mul: {
@@ -2763,40 +2894,39 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       XMMRegister dst = i.OutputSimd128Register();
       XMMRegister left = i.InputSimd128Register(0);
       XMMRegister right = i.InputSimd128Register(1);
-      XMMRegister t0 = i.ToSimd128Register(instr->TempAt(0));
-      XMMRegister t1 = i.ToSimd128Register(instr->TempAt(1));
+      XMMRegister tmp = i.ToSimd128Register(instr->TempAt(0));
 
       // I16x8 view of I8x16
       // left = AAaa AAaa ... AAaa AAaa
       // right= BBbb BBbb ... BBbb BBbb
 
-      // t0 = 00AA 00AA ... 00AA 00AA
-      // t1 = 00BB 00BB ... 00BB 00BB
-      __ Move(kScratchDoubleReg, static_cast<uint32_t>(0x00ff));
-      __ vpsrlw(t0, left, 8);
-      __ vpsrlw(t1, right, 8);
-
-      // dst = I16x8Mul(left, right)
-      //    => __pp __pp ...  __pp  __pp
-      __ vpshuflw(kScratchDoubleReg, kScratchDoubleReg, 0x0);
-      __ vpmullw(dst, left, right);
+      // t = 00AA 00AA ... 00AA 00AA
+      // s = 00BB 00BB ... 00BB 00BB
+      __ vpsrlw(tmp, left, 8);
+      __ vpsrlw(kScratchDoubleReg, right, 8);
 
-      // t0 = I16x8Mul(t0, t1)
+      // t = I16x8Mul(t0, t1)
       //    => __PP __PP ...  __PP  __PP
-      __ vpmullw(t0, t0, t1);
-      __ vpshufd(kScratchDoubleReg, kScratchDoubleReg, 0x0);
+      __ vpmullw(tmp, tmp, kScratchDoubleReg);
 
-      // t0 = I16x8Shl(t0, 8)
-      //    => PP00 PP00 ...  PP00  PP00
-      __ vpsllw(t0, t0, 8);
+      // s = left * 256
+      __ vpsllw(kScratchDoubleReg, left, 8);
+
+      // dst = I16x8Mul(left * 256, right)
+      //    => pp__ pp__ ...  pp__  pp__
+      __ vpmullw(dst, kScratchDoubleReg, right);
 
-      // dst = I16x8And(dst, 0x00ff)
+      // dst = I16x8Shr(dst, 8)
       //    => 00pp 00pp ...  00pp  00pp
-      __ vpand(dst, dst, kScratchDoubleReg);
+      __ vpsrlw(dst, dst, 8);
 
-      // dst = I16x8Or(dst, t0)
+      // t = I16x8Shl(t, 8)
+      //    => PP00 PP00 ...  PP00  PP00
+      __ vpsllw(tmp, tmp, 8);
+
+      // dst = I16x8Or(dst, t)
       //    => PPpp PPpp ...  PPpp  PPpp
-      __ vpor(dst, dst, t0);
+      __ vpor(dst, dst, tmp);
       break;
     }
     case kSSEI8x16MinS: {
@@ -2878,6 +3008,30 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       __ vpcmpeqb(i.OutputSimd128Register(), kScratchDoubleReg, src2);
       break;
     }
+    case kSSEI8x16UConvertI16x8: {
+      DCHECK_EQ(i.OutputSimd128Register(), i.InputSimd128Register(0));
+      CpuFeatureScope sse_scope(tasm(), SSE4_1);
+      XMMRegister dst = i.OutputSimd128Register();
+      // Change negative lanes to 0x7FFF
+      __ pcmpeqw(kScratchDoubleReg, kScratchDoubleReg);
+      __ psrlw(kScratchDoubleReg, 1);
+      __ pminuw(dst, kScratchDoubleReg);
+      __ pminuw(kScratchDoubleReg, i.InputOperand(1));
+      __ packuswb(dst, kScratchDoubleReg);
+      break;
+    }
+    case kAVXI8x16UConvertI16x8: {
+      DCHECK_EQ(i.OutputSimd128Register(), i.InputSimd128Register(0));
+      CpuFeatureScope avx_scope(tasm(), AVX);
+      XMMRegister dst = i.OutputSimd128Register();
+      // Change negative lanes to 0x7FFF
+      __ vpcmpeqw(kScratchDoubleReg, kScratchDoubleReg, kScratchDoubleReg);
+      __ vpsrlw(kScratchDoubleReg, kScratchDoubleReg, 1);
+      __ vpminuw(dst, kScratchDoubleReg, i.InputSimd128Register(0));
+      __ vpminuw(kScratchDoubleReg, kScratchDoubleReg, i.InputOperand(1));
+      __ vpackuswb(dst, dst, kScratchDoubleReg);
+      break;
+    }
     case kSSEI8x16AddSaturateU: {
       DCHECK_EQ(i.OutputSimd128Register(), i.InputSimd128Register(0));
       __ paddusb(i.OutputSimd128Register(), i.InputOperand(1));
@@ -2900,51 +3054,22 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
                   i.InputOperand(1));
       break;
     }
-    case kSSEI8x16ShrU: {
-      DCHECK_EQ(i.OutputSimd128Register(), i.InputSimd128Register(0));
-      XMMRegister src = i.InputSimd128Register(0);
-      int8_t shift = i.InputInt8(1) & 0x7;
-      XMMRegister tmp = i.ToSimd128Register(instr->TempAt(0));
-
-      // src = AAaa ... AAaa
-      // tmp = F0F0 ... F0F0 (shift=4)
-
-      I8x16_SPLAT(tmp, kScratchDoubleReg, 0xFFU << shift);  // needn't byte cast
-
-      // src = src & tmp
-      //    => A0a0 ... A0a0
-      __ pand(src, tmp);
-
-      // src = src >> shift
-      //    => 0A0a ... 0A0a (shift=4)
-      __ psrld(src, shift);
-      break;
-    }
-    case kAVXI8x16ShrU: {
-      CpuFeatureScope avx_scope(tasm(), AVX);
+    case kIA32I8x16ShrU: {
       XMMRegister dst = i.OutputSimd128Register();
       XMMRegister src = i.InputSimd128Register(0);
       int8_t shift = i.InputInt8(1) & 0x7;
-      XMMRegister tmp =
-          dst != src ? dst : i.ToSimd128Register(instr->TempAt(0));
-
-      // src = AAaa ... AAaa
-      // tmp = F0F0 ... F0F0 (shift=4)
-      I8x16_SPLAT(tmp, kScratchDoubleReg, 0xFFU << shift);
-
-      // src = src & tmp
-      //    => A0a0 ... A0a0
-      __ vpand(dst, src, tmp);
-
-      // dst = dst >> shift
-      //    => 0A0a ... 0A0a (shift=4)
-      __ vpsrld(dst, dst, shift);
+      // Unpack the bytes into words, do logical shifts, and repack.
+      __ Punpckhbw(kScratchDoubleReg, src);
+      __ Punpcklbw(dst, src);
+      __ Psrlw(kScratchDoubleReg, 8 + shift);
+      __ Psrlw(dst, 8 + shift);
+      __ Packuswb(dst, kScratchDoubleReg);
       break;
     }
-#undef I8x16_SPLAT
     case kSSEI8x16MinU: {
-      DCHECK_EQ(i.OutputSimd128Register(), i.InputSimd128Register(0));
-      __ pminub(i.OutputSimd128Register(), i.InputOperand(1));
+      XMMRegister dst = i.OutputSimd128Register();
+      DCHECK_EQ(dst, i.InputSimd128Register(0));
+      __ pminub(dst, i.InputOperand(1));
       break;
     }
     case kAVXI8x16MinU: {
@@ -3078,12 +3203,13 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
     }
     case kIA32S8x16Shuffle: {
       XMMRegister dst = i.OutputSimd128Register();
+      Operand src0 = i.InputOperand(0);
       Register tmp = i.TempRegister(0);
-      // Prepare 16-byte boundary buffer for shuffle control mask
+      // Prepare 16 byte aligned buffer for shuffle control mask
       __ mov(tmp, esp);
-      __ movups(dst, i.InputOperand(0));
       __ and_(esp, -16);
       if (instr->InputCount() == 5) {  // only one input operand
+        DCHECK_EQ(i.OutputSimd128Register(), i.InputSimd128Register(0));
         for (int j = 4; j > 0; j--) {
           uint32_t mask = i.InputUint32(j);
           __ push(Immediate(mask));
@@ -3091,6 +3217,7 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
         __ Pshufb(dst, Operand(esp, 0));
       } else {  // two input operands
         DCHECK_EQ(6, instr->InputCount());
+        __ movups(kScratchDoubleReg, src0);
         for (int j = 5; j > 1; j--) {
           uint32_t lanes = i.InputUint32(j);
           uint32_t mask = 0;
@@ -3100,8 +3227,9 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
           }
           __ push(Immediate(mask));
         }
-        __ Pshufb(dst, Operand(esp, 0));
-        __ movups(kScratchDoubleReg, i.InputOperand(1));
+        __ Pshufb(kScratchDoubleReg, Operand(esp, 0));
+        Operand src1 = i.InputOperand(1);
+        if (!src1.is_reg(dst)) __ movups(dst, src1);
         for (int j = 5; j > 1; j--) {
           uint32_t lanes = i.InputUint32(j);
           uint32_t mask = 0;
@@ -3111,16 +3239,358 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
           }
           __ push(Immediate(mask));
         }
-        __ Pshufb(kScratchDoubleReg, Operand(esp, 0));
+        __ Pshufb(dst, Operand(esp, 0));
         __ por(dst, kScratchDoubleReg);
       }
       __ mov(esp, tmp);
       break;
     }
     case kIA32S32x4Swizzle: {
+      DCHECK_EQ(2, instr->InputCount());
       __ Pshufd(i.OutputSimd128Register(), i.InputOperand(0), i.InputInt8(1));
       break;
     }
+    case kIA32S32x4Shuffle: {
+      DCHECK_EQ(4, instr->InputCount());  // Swizzles should be handled above.
+      int8_t shuffle = i.InputInt8(2);
+      DCHECK_NE(0xe4, shuffle);  // A simple blend should be handled below.
+      __ Pshufd(kScratchDoubleReg, i.InputOperand(1), shuffle);
+      __ Pshufd(i.OutputSimd128Register(), i.InputOperand(0), shuffle);
+      __ Pblendw(i.OutputSimd128Register(), kScratchDoubleReg, i.InputInt8(3));
+      break;
+    }
+    case kIA32S16x8Blend:
+      ASSEMBLE_SIMD_IMM_SHUFFLE(pblendw, SSE4_1, i.InputInt8(2));
+      break;
+    case kIA32S16x8HalfShuffle1: {
+      XMMRegister dst = i.OutputSimd128Register();
+      __ Pshuflw(dst, i.InputOperand(0), i.InputInt8(1));
+      __ Pshufhw(dst, dst, i.InputInt8(2));
+      break;
+    }
+    case kIA32S16x8HalfShuffle2: {
+      XMMRegister dst = i.OutputSimd128Register();
+      __ Pshuflw(kScratchDoubleReg, i.InputOperand(1), i.InputInt8(2));
+      __ Pshufhw(kScratchDoubleReg, kScratchDoubleReg, i.InputInt8(3));
+      __ Pshuflw(dst, i.InputOperand(0), i.InputInt8(2));
+      __ Pshufhw(dst, dst, i.InputInt8(3));
+      __ Pblendw(dst, kScratchDoubleReg, i.InputInt8(4));
+      break;
+    }
+    case kIA32S8x16Alignr:
+      ASSEMBLE_SIMD_IMM_SHUFFLE(palignr, SSSE3, i.InputInt8(2));
+      break;
+    case kIA32S16x8Dup: {
+      XMMRegister dst = i.OutputSimd128Register();
+      Operand src = i.InputOperand(0);
+      int8_t lane = i.InputInt8(1) & 0x7;
+      int8_t lane4 = lane & 0x3;
+      int8_t half_dup = lane4 | (lane4 << 2) | (lane4 << 4) | (lane4 << 6);
+      if (lane < 4) {
+        __ Pshuflw(dst, src, half_dup);
+        __ Pshufd(dst, dst, 0);
+      } else {
+        __ Pshufhw(dst, src, half_dup);
+        __ Pshufd(dst, dst, 0xaa);
+      }
+      break;
+    }
+    case kIA32S8x16Dup: {
+      XMMRegister dst = i.OutputSimd128Register();
+      XMMRegister src = i.InputSimd128Register(0);
+      int8_t lane = i.InputInt8(1) & 0xf;
+      if (CpuFeatures::IsSupported(AVX)) {
+        CpuFeatureScope avx_scope(tasm(), AVX);
+        if (lane < 8) {
+          __ vpunpcklbw(dst, src, src);
+        } else {
+          __ vpunpckhbw(dst, src, src);
+        }
+      } else {
+        DCHECK_EQ(dst, src);
+        if (lane < 8) {
+          __ punpcklbw(dst, dst);
+        } else {
+          __ punpckhbw(dst, dst);
+        }
+      }
+      lane &= 0x7;
+      int8_t lane4 = lane & 0x3;
+      int8_t half_dup = lane4 | (lane4 << 2) | (lane4 << 4) | (lane4 << 6);
+      if (lane < 4) {
+        __ Pshuflw(dst, dst, half_dup);
+        __ Pshufd(dst, dst, 0);
+      } else {
+        __ Pshufhw(dst, dst, half_dup);
+        __ Pshufd(dst, dst, 0xaa);
+      }
+      break;
+    }
+    case kIA32S64x2UnpackHigh:
+      ASSEMBLE_SIMD_PUNPCK_SHUFFLE(punpckhqdq);
+      break;
+    case kIA32S32x4UnpackHigh:
+      ASSEMBLE_SIMD_PUNPCK_SHUFFLE(punpckhdq);
+      break;
+    case kIA32S16x8UnpackHigh:
+      ASSEMBLE_SIMD_PUNPCK_SHUFFLE(punpckhwd);
+      break;
+    case kIA32S8x16UnpackHigh:
+      ASSEMBLE_SIMD_PUNPCK_SHUFFLE(punpckhbw);
+      break;
+    case kIA32S64x2UnpackLow:
+      ASSEMBLE_SIMD_PUNPCK_SHUFFLE(punpcklqdq);
+      break;
+    case kIA32S32x4UnpackLow:
+      ASSEMBLE_SIMD_PUNPCK_SHUFFLE(punpckldq);
+      break;
+    case kIA32S16x8UnpackLow:
+      ASSEMBLE_SIMD_PUNPCK_SHUFFLE(punpcklwd);
+      break;
+    case kIA32S8x16UnpackLow:
+      ASSEMBLE_SIMD_PUNPCK_SHUFFLE(punpcklbw);
+      break;
+    case kSSES16x8UnzipHigh: {
+      CpuFeatureScope sse_scope(tasm(), SSE4_1);
+      XMMRegister dst = i.OutputSimd128Register();
+      XMMRegister src2 = dst;
+      DCHECK_EQ(dst, i.InputSimd128Register(0));
+      if (instr->InputCount() == 2) {
+        __ movups(kScratchDoubleReg, i.InputOperand(1));
+        __ psrld(kScratchDoubleReg, 16);
+        src2 = kScratchDoubleReg;
+      }
+      __ psrld(dst, 16);
+      __ packusdw(dst, src2);
+      break;
+    }
+    case kAVXS16x8UnzipHigh: {
+      CpuFeatureScope avx_scope(tasm(), AVX);
+      XMMRegister dst = i.OutputSimd128Register();
+      XMMRegister src2 = dst;
+      if (instr->InputCount() == 2) {
+        __ vpsrld(kScratchDoubleReg, i.InputSimd128Register(1), 16);
+        src2 = kScratchDoubleReg;
+      }
+      __ vpsrld(dst, i.InputSimd128Register(0), 16);
+      __ vpackusdw(dst, dst, src2);
+      break;
+    }
+    case kSSES16x8UnzipLow: {
+      CpuFeatureScope sse_scope(tasm(), SSE4_1);
+      XMMRegister dst = i.OutputSimd128Register();
+      XMMRegister src2 = dst;
+      DCHECK_EQ(dst, i.InputSimd128Register(0));
+      __ pxor(kScratchDoubleReg, kScratchDoubleReg);
+      if (instr->InputCount() == 2) {
+        __ pblendw(kScratchDoubleReg, i.InputOperand(1), 0x55);
+        src2 = kScratchDoubleReg;
+      }
+      __ pblendw(dst, kScratchDoubleReg, 0xaa);
+      __ packusdw(dst, src2);
+      break;
+    }
+    case kAVXS16x8UnzipLow: {
+      CpuFeatureScope avx_scope(tasm(), AVX);
+      XMMRegister dst = i.OutputSimd128Register();
+      XMMRegister src2 = dst;
+      __ vpxor(kScratchDoubleReg, kScratchDoubleReg, kScratchDoubleReg);
+      if (instr->InputCount() == 2) {
+        __ vpblendw(kScratchDoubleReg, kScratchDoubleReg, i.InputOperand(1),
+                    0x55);
+        src2 = kScratchDoubleReg;
+      }
+      __ vpblendw(dst, kScratchDoubleReg, i.InputSimd128Register(0), 0x55);
+      __ vpackusdw(dst, dst, src2);
+      break;
+    }
+    case kSSES8x16UnzipHigh: {
+      XMMRegister dst = i.OutputSimd128Register();
+      XMMRegister src2 = dst;
+      DCHECK_EQ(dst, i.InputSimd128Register(0));
+      if (instr->InputCount() == 2) {
+        __ movups(kScratchDoubleReg, i.InputOperand(1));
+        __ psrlw(kScratchDoubleReg, 8);
+        src2 = kScratchDoubleReg;
+      }
+      __ psrlw(dst, 8);
+      __ packuswb(dst, src2);
+      break;
+    }
+    case kAVXS8x16UnzipHigh: {
+      CpuFeatureScope avx_scope(tasm(), AVX);
+      XMMRegister dst = i.OutputSimd128Register();
+      XMMRegister src2 = dst;
+      if (instr->InputCount() == 2) {
+        __ vpsrlw(kScratchDoubleReg, i.InputSimd128Register(1), 8);
+        src2 = kScratchDoubleReg;
+      }
+      __ vpsrlw(dst, i.InputSimd128Register(0), 8);
+      __ vpackuswb(dst, dst, src2);
+      break;
+    }
+    case kSSES8x16UnzipLow: {
+      XMMRegister dst = i.OutputSimd128Register();
+      XMMRegister src2 = dst;
+      DCHECK_EQ(dst, i.InputSimd128Register(0));
+      if (instr->InputCount() == 2) {
+        __ movups(kScratchDoubleReg, i.InputOperand(1));
+        __ psllw(kScratchDoubleReg, 8);
+        __ psrlw(kScratchDoubleReg, 8);
+        src2 = kScratchDoubleReg;
+      }
+      __ psllw(dst, 8);
+      __ psrlw(dst, 8);
+      __ packuswb(dst, src2);
+      break;
+    }
+    case kAVXS8x16UnzipLow: {
+      CpuFeatureScope avx_scope(tasm(), AVX);
+      XMMRegister dst = i.OutputSimd128Register();
+      XMMRegister src2 = dst;
+      if (instr->InputCount() == 2) {
+        __ vpsllw(kScratchDoubleReg, i.InputSimd128Register(1), 8);
+        __ vpsrlw(kScratchDoubleReg, kScratchDoubleReg, 8);
+        src2 = kScratchDoubleReg;
+      }
+      __ vpsllw(dst, i.InputSimd128Register(0), 8);
+      __ vpsrlw(dst, dst, 8);
+      __ vpackuswb(dst, dst, src2);
+      break;
+    }
+    case kSSES8x16TransposeLow: {
+      XMMRegister dst = i.OutputSimd128Register();
+      DCHECK_EQ(dst, i.InputSimd128Register(0));
+      __ psllw(dst, 8);
+      if (instr->InputCount() == 1) {
+        __ movups(kScratchDoubleReg, dst);
+      } else {
+        DCHECK_EQ(2, instr->InputCount());
+        __ movups(kScratchDoubleReg, i.InputOperand(1));
+        __ psllw(kScratchDoubleReg, 8);
+      }
+      __ psrlw(dst, 8);
+      __ por(dst, kScratchDoubleReg);
+      break;
+    }
+    case kAVXS8x16TransposeLow: {
+      CpuFeatureScope avx_scope(tasm(), AVX);
+      XMMRegister dst = i.OutputSimd128Register();
+      if (instr->InputCount() == 1) {
+        __ vpsllw(kScratchDoubleReg, i.InputSimd128Register(0), 8);
+        __ vpsrlw(dst, kScratchDoubleReg, 8);
+      } else {
+        DCHECK_EQ(2, instr->InputCount());
+        __ vpsllw(kScratchDoubleReg, i.InputSimd128Register(1), 8);
+        __ vpsllw(dst, i.InputSimd128Register(0), 8);
+        __ vpsrlw(dst, dst, 8);
+      }
+      __ vpor(dst, dst, kScratchDoubleReg);
+      break;
+    }
+    case kSSES8x16TransposeHigh: {
+      XMMRegister dst = i.OutputSimd128Register();
+      DCHECK_EQ(dst, i.InputSimd128Register(0));
+      __ psrlw(dst, 8);
+      if (instr->InputCount() == 1) {
+        __ movups(kScratchDoubleReg, dst);
+      } else {
+        DCHECK_EQ(2, instr->InputCount());
+        __ movups(kScratchDoubleReg, i.InputOperand(1));
+        __ psrlw(kScratchDoubleReg, 8);
+      }
+      __ psllw(kScratchDoubleReg, 8);
+      __ por(dst, kScratchDoubleReg);
+      break;
+    }
+    case kAVXS8x16TransposeHigh: {
+      CpuFeatureScope avx_scope(tasm(), AVX);
+      XMMRegister dst = i.OutputSimd128Register();
+      if (instr->InputCount() == 1) {
+        __ vpsrlw(dst, i.InputSimd128Register(0), 8);
+        __ vpsllw(kScratchDoubleReg, dst, 8);
+      } else {
+        DCHECK_EQ(2, instr->InputCount());
+        __ vpsrlw(kScratchDoubleReg, i.InputSimd128Register(1), 8);
+        __ vpsrlw(dst, i.InputSimd128Register(0), 8);
+        __ vpsllw(kScratchDoubleReg, kScratchDoubleReg, 8);
+      }
+      __ vpor(dst, dst, kScratchDoubleReg);
+      break;
+    }
+    case kSSES8x8Reverse:
+    case kSSES8x4Reverse:
+    case kSSES8x2Reverse: {
+      DCHECK_EQ(1, instr->InputCount());
+      XMMRegister dst = i.OutputSimd128Register();
+      DCHECK_EQ(dst, i.InputSimd128Register(0));
+      if (arch_opcode != kSSES8x2Reverse) {
+        // First shuffle words into position.
+        int8_t shuffle_mask = arch_opcode == kSSES8x4Reverse ? 0xB1 : 0x1B;
+        __ pshuflw(dst, dst, shuffle_mask);
+        __ pshufhw(dst, dst, shuffle_mask);
+      }
+      __ movaps(kScratchDoubleReg, dst);
+      __ psrlw(kScratchDoubleReg, 8);
+      __ psllw(dst, 8);
+      __ por(dst, kScratchDoubleReg);
+      break;
+    }
+    case kAVXS8x2Reverse:
+    case kAVXS8x4Reverse:
+    case kAVXS8x8Reverse: {
+      DCHECK_EQ(1, instr->InputCount());
+      CpuFeatureScope avx_scope(tasm(), AVX);
+      XMMRegister dst = i.OutputSimd128Register();
+      XMMRegister src = dst;
+      if (arch_opcode != kAVXS8x2Reverse) {
+        // First shuffle words into position.
+        int8_t shuffle_mask = arch_opcode == kAVXS8x4Reverse ? 0xB1 : 0x1B;
+        __ vpshuflw(dst, i.InputOperand(0), shuffle_mask);
+        __ vpshufhw(dst, dst, shuffle_mask);
+      } else {
+        src = i.InputSimd128Register(0);
+      }
+      // Reverse each 16 bit lane.
+      __ vpsrlw(kScratchDoubleReg, src, 8);
+      __ vpsllw(dst, src, 8);
+      __ vpor(dst, dst, kScratchDoubleReg);
+      break;
+    }
+    case kIA32S1x4AnyTrue:
+    case kIA32S1x8AnyTrue:
+    case kIA32S1x16AnyTrue: {
+      Register dst = i.OutputRegister();
+      XMMRegister src = i.InputSimd128Register(0);
+      Register tmp = i.TempRegister(0);
+      __ xor_(tmp, tmp);
+      __ mov(dst, Immediate(-1));
+      __ Ptest(src, src);
+      __ cmov(zero, dst, tmp);
+      break;
+    }
+    case kIA32S1x4AllTrue:
+    case kIA32S1x8AllTrue:
+    case kIA32S1x16AllTrue: {
+      Register dst = i.OutputRegister();
+      Operand src = i.InputOperand(0);
+      Register tmp = i.TempRegister(0);
+      __ mov(tmp, Immediate(-1));
+      __ xor_(dst, dst);
+      // Compare all src lanes to false.
+      __ Pxor(kScratchDoubleReg, kScratchDoubleReg);
+      if (arch_opcode == kIA32S1x4AllTrue) {
+        __ Pcmpeqd(kScratchDoubleReg, src);
+      } else if (arch_opcode == kIA32S1x8AllTrue) {
+        __ Pcmpeqw(kScratchDoubleReg, src);
+      } else {
+        __ Pcmpeqb(kScratchDoubleReg, src);
+      }
+      // If kScratchDoubleReg is all zero, none of src lanes are false.
+      __ Ptest(kScratchDoubleReg, kScratchDoubleReg);
+      __ cmov(zero, dst, tmp);
+      break;
+    }
     case kIA32StackCheck: {
       ExternalReference const stack_limit =
           ExternalReference::address_of_stack_limit(__ isolate());
@@ -3314,37 +3784,24 @@ void CodeGenerator::AssembleArchTrap(Instruction* instr,
                                      FlagsCondition condition) {
   class OutOfLineTrap final : public OutOfLineCode {
    public:
-    OutOfLineTrap(CodeGenerator* gen, bool frame_elided, Instruction* instr)
-        : OutOfLineCode(gen),
-          frame_elided_(frame_elided),
-          instr_(instr),
-          gen_(gen) {}
+    OutOfLineTrap(CodeGenerator* gen, Instruction* instr)
+        : OutOfLineCode(gen), instr_(instr), gen_(gen) {}
 
     void Generate() final {
       IA32OperandConverter i(gen_, instr_);
-
-      Builtins::Name trap_id =
-          static_cast<Builtins::Name>(i.InputInt32(instr_->InputCount() - 1));
-      bool old_has_frame = __ has_frame();
-      if (frame_elided_) {
-        __ set_has_frame(true);
-        __ EnterFrame(StackFrame::WASM_COMPILED);
-      }
+      TrapId trap_id =
+          static_cast<TrapId>(i.InputInt32(instr_->InputCount() - 1));
       GenerateCallToTrap(trap_id);
-      if (frame_elided_) {
-        __ set_has_frame(old_has_frame);
-      }
     }
 
    private:
-    void GenerateCallToTrap(Builtins::Name trap_id) {
-      if (trap_id == Builtins::builtin_count) {
+    void GenerateCallToTrap(TrapId trap_id) {
+      if (trap_id == TrapId::kInvalid) {
         // We cannot test calls to the runtime in cctest/test-run-wasm.
         // Therefore we emit a call to C here instead of a call to the runtime.
         __ PrepareCallCFunction(0, esi);
-        __ CallCFunction(ExternalReference::wasm_call_trap_callback_for_testing(
-                             __ isolate()),
-                         0);
+        __ CallCFunction(
+            ExternalReference::wasm_call_trap_callback_for_testing(), 0);
         __ LeaveFrame(StackFrame::WASM_COMPILED);
         auto call_descriptor = gen_->linkage()->GetIncomingDescriptor();
         size_t pop_size = call_descriptor->StackParameterCount() * kPointerSize;
@@ -3352,8 +3809,9 @@ void CodeGenerator::AssembleArchTrap(Instruction* instr,
         __ Ret(static_cast<int>(pop_size), ecx);
       } else {
         gen_->AssembleSourcePosition(instr_);
-        __ Call(__ isolate()->builtins()->builtin_handle(trap_id),
-                RelocInfo::CODE_TARGET);
+        // A direct call to a wasm runtime stub defined in this module.
+        // Just encode the stub index. This will be patched at relocation.
+        __ wasm_call(static_cast<Address>(trap_id), RelocInfo::WASM_STUB_CALL);
         ReferenceMap* reference_map =
             new (gen_->zone()) ReferenceMap(gen_->zone());
         gen_->RecordSafepoint(reference_map, Safepoint::kSimple, 0,
@@ -3362,12 +3820,10 @@ void CodeGenerator::AssembleArchTrap(Instruction* instr,
       }
     }
 
-    bool frame_elided_;
     Instruction* instr_;
     CodeGenerator* gen_;
   };
-  bool frame_elided = !frame_access_state()->has_frame();
-  auto ool = new (zone()) OutOfLineTrap(this, frame_elided, instr);
+  auto ool = new (zone()) OutOfLineTrap(this, instr);
   Label* tlabel = ool->entry();
   Label end;
   if (condition == kUnorderedEqual) {
@@ -3418,6 +3874,16 @@ void CodeGenerator::AssembleArchBoolean(Instruction* instr,
   __ bind(&done);
 }
 
+void CodeGenerator::AssembleArchBinarySearchSwitch(Instruction* instr) {
+  IA32OperandConverter i(this, instr);
+  Register input = i.InputRegister(0);
+  std::vector<std::pair<int32_t, Label*>> cases;
+  for (size_t index = 2; index < instr->InputCount(); index += 2) {
+    cases.push_back({i.InputInt32(index + 0), GetLabel(i.InputRpo(index + 1))});
+  }
+  AssembleArchBinarySearchSwitchRange(input, i.InputRpo(1), cases.data(),
+                                      cases.data() + cases.size());
+}
 
 void CodeGenerator::AssembleArchLookupSwitch(Instruction* instr) {
   IA32OperandConverter i(this, instr);
@@ -3498,9 +3964,8 @@ void CodeGenerator::AssembleArchTableSwitch(Instruction* instr) {
 // |                                                       |  caller frame |
 //                                                         ^ esp           ^ ebp
 
-
 // Runtime function calls are accomplished by doing a stub call to the
-// CEntryStub (a real code object). On IA32 passes arguments on the
+// CEntry (a real code object). On IA32 passes arguments on the
 // stack, the number of arguments in EAX, the address of the runtime function
 // in EBX, and the context in ESI.
 
@@ -3513,7 +3978,7 @@ void CodeGenerator::AssembleArchTableSwitch(Instruction* instr) {
 //                                       ^ esp                             ^ ebp
 //              [eax = #args, ebx = runtime function, esi = context]
 
-// --{ call #CEntryStub }-------------------------------------------------------
+// --{ call #CEntry }-----------------------------------------------------------
 //                                 | RET | args + receiver |  caller frame |
 //                                 ^ esp                                   ^ ebp
 
@@ -3599,6 +4064,9 @@ void CodeGenerator::AssembleConstructFrame() {
       }
     } else {
       __ StubPrologue(info()->GetOutputStackFrameType());
+      if (call_descriptor->IsWasmFunctionCall()) {
+        __ push(kWasmInstanceRegister);
+      }
     }
   }
 
@@ -3621,6 +4089,7 @@ void CodeGenerator::AssembleConstructFrame() {
 
   const RegList saves = call_descriptor->CalleeSavedRegisters();
   if (shrink_slots > 0) {
+    DCHECK(frame_access_state()->has_frame());
     if (info()->IsWasm() && shrink_slots > 128) {
       // For WebAssembly functions with big frames we have to do the stack
       // overflow check before we construct the frame. Otherwise we may not
@@ -3635,20 +4104,18 @@ void CodeGenerator::AssembleConstructFrame() {
         Register scratch = esi;
         __ push(scratch);
         __ mov(scratch,
-               Immediate(ExternalReference::address_of_real_stack_limit(
-                   __ isolate())));
+               FieldOperand(kWasmInstanceRegister,
+                            WasmInstanceObject::kRealStackLimitAddressOffset));
         __ mov(scratch, Operand(scratch, 0));
         __ add(scratch, Immediate(shrink_slots * kPointerSize));
         __ cmp(esp, scratch);
         __ pop(scratch);
         __ j(above_equal, &done);
       }
-      if (!frame_access_state()->has_frame()) {
-        __ set_has_frame(true);
-        __ EnterFrame(StackFrame::WASM_COMPILED);
-      }
+      __ mov(ecx, FieldOperand(kWasmInstanceRegister,
+                               WasmInstanceObject::kCEntryStubOffset));
       __ Move(esi, Smi::kZero);
-      __ CallRuntimeDelayed(zone(), Runtime::kThrowWasmStackOverflow);
+      __ CallRuntimeWithCEntry(Runtime::kThrowWasmStackOverflow, ecx);
       ReferenceMap* reference_map = new (zone()) ReferenceMap(zone());
       RecordSafepoint(reference_map, Safepoint::kSimple, 0,
                       Safepoint::kNoLazyDeopt);
@@ -3984,6 +4451,8 @@ void CodeGenerator::AssembleJumpTable(Label** targets, size_t target_count) {
 #undef ASSEMBLE_BINOP
 #undef ASSEMBLE_ATOMIC_BINOP
 #undef ASSEMBLE_MOVX
+#undef ASSEMBLE_SIMD_PUNPCK_SHUFFLE
+#undef ASSEMBLE_SIMD_IMM_SHUFFLE
 
 }  // namespace compiler
 }  // namespace internal
diff --git a/deps/v8/src/compiler/ia32/instruction-codes-ia32.h b/deps/v8/src/compiler/ia32/instruction-codes-ia32.h
index e5b1e85082afe3..8ffc9c3819b645 100644
--- a/deps/v8/src/compiler/ia32/instruction-codes-ia32.h
+++ b/deps/v8/src/compiler/ia32/instruction-codes-ia32.h
@@ -154,6 +154,10 @@ namespace compiler {
   V(IA32I32x4ExtractLane)          \
   V(SSEI32x4ReplaceLane)           \
   V(AVXI32x4ReplaceLane)           \
+  V(SSEI32x4SConvertF32x4)         \
+  V(AVXI32x4SConvertF32x4)         \
+  V(IA32I32x4SConvertI16x8Low)     \
+  V(IA32I32x4SConvertI16x8High)    \
   V(IA32I32x4Neg)                  \
   V(SSEI32x4Shl)                   \
   V(AVXI32x4Shl)                   \
@@ -179,6 +183,10 @@ namespace compiler {
   V(AVXI32x4GtS)                   \
   V(SSEI32x4GeS)                   \
   V(AVXI32x4GeS)                   \
+  V(SSEI32x4UConvertF32x4)         \
+  V(AVXI32x4UConvertF32x4)         \
+  V(IA32I32x4UConvertI16x8Low)     \
+  V(IA32I32x4UConvertI16x8High)    \
   V(SSEI32x4ShrU)                  \
   V(AVXI32x4ShrU)                  \
   V(SSEI32x4MinU)                  \
@@ -193,11 +201,15 @@ namespace compiler {
   V(IA32I16x8ExtractLane)          \
   V(SSEI16x8ReplaceLane)           \
   V(AVXI16x8ReplaceLane)           \
+  V(IA32I16x8SConvertI8x16Low)     \
+  V(IA32I16x8SConvertI8x16High)    \
   V(IA32I16x8Neg)                  \
   V(SSEI16x8Shl)                   \
   V(AVXI16x8Shl)                   \
   V(SSEI16x8ShrS)                  \
   V(AVXI16x8ShrS)                  \
+  V(SSEI16x8SConvertI32x4)         \
+  V(AVXI16x8SConvertI32x4)         \
   V(SSEI16x8Add)                   \
   V(AVXI16x8Add)                   \
   V(SSEI16x8AddSaturateS)          \
@@ -222,8 +234,12 @@ namespace compiler {
   V(AVXI16x8GtS)                   \
   V(SSEI16x8GeS)                   \
   V(AVXI16x8GeS)                   \
+  V(IA32I16x8UConvertI8x16Low)     \
+  V(IA32I16x8UConvertI8x16High)    \
   V(SSEI16x8ShrU)                  \
   V(AVXI16x8ShrU)                  \
+  V(SSEI16x8UConvertI32x4)         \
+  V(AVXI16x8UConvertI32x4)         \
   V(SSEI16x8AddSaturateU)          \
   V(AVXI16x8AddSaturateU)          \
   V(SSEI16x8SubSaturateU)          \
@@ -240,11 +256,12 @@ namespace compiler {
   V(IA32I8x16ExtractLane)          \
   V(SSEI8x16ReplaceLane)           \
   V(AVXI8x16ReplaceLane)           \
+  V(SSEI8x16SConvertI16x8)         \
+  V(AVXI8x16SConvertI16x8)         \
+  V(IA32I8x16Neg)                  \
   V(SSEI8x16Shl)                   \
   V(AVXI8x16Shl)                   \
-  V(SSEI8x16ShrS)                  \
-  V(AVXI8x16ShrS)                  \
-  V(IA32I8x16Neg)                  \
+  V(IA32I8x16ShrS)                 \
   V(SSEI8x16Add)                   \
   V(AVXI8x16Add)                   \
   V(SSEI8x16AddSaturateS)          \
@@ -267,12 +284,13 @@ namespace compiler {
   V(AVXI8x16GtS)                   \
   V(SSEI8x16GeS)                   \
   V(AVXI8x16GeS)                   \
+  V(SSEI8x16UConvertI16x8)         \
+  V(AVXI8x16UConvertI16x8)         \
   V(SSEI8x16AddSaturateU)          \
   V(AVXI8x16AddSaturateU)          \
   V(SSEI8x16SubSaturateU)          \
   V(AVXI8x16SubSaturateU)          \
-  V(SSEI8x16ShrU)                  \
-  V(AVXI8x16ShrU)                  \
+  V(IA32I8x16ShrU)                 \
   V(SSEI8x16MinU)                  \
   V(AVXI8x16MinU)                  \
   V(SSEI8x16MaxU)                  \
@@ -293,7 +311,46 @@ namespace compiler {
   V(SSES128Select)                 \
   V(AVXS128Select)                 \
   V(IA32S8x16Shuffle)              \
-  V(IA32S32x4Swizzle)
+  V(IA32S32x4Swizzle)              \
+  V(IA32S32x4Shuffle)              \
+  V(IA32S16x8Blend)                \
+  V(IA32S16x8HalfShuffle1)         \
+  V(IA32S16x8HalfShuffle2)         \
+  V(IA32S8x16Alignr)               \
+  V(IA32S16x8Dup)                  \
+  V(IA32S8x16Dup)                  \
+  V(SSES16x8UnzipHigh)             \
+  V(AVXS16x8UnzipHigh)             \
+  V(SSES16x8UnzipLow)              \
+  V(AVXS16x8UnzipLow)              \
+  V(SSES8x16UnzipHigh)             \
+  V(AVXS8x16UnzipHigh)             \
+  V(SSES8x16UnzipLow)              \
+  V(AVXS8x16UnzipLow)              \
+  V(IA32S64x2UnpackHigh)           \
+  V(IA32S32x4UnpackHigh)           \
+  V(IA32S16x8UnpackHigh)           \
+  V(IA32S8x16UnpackHigh)           \
+  V(IA32S64x2UnpackLow)            \
+  V(IA32S32x4UnpackLow)            \
+  V(IA32S16x8UnpackLow)            \
+  V(IA32S8x16UnpackLow)            \
+  V(SSES8x16TransposeLow)          \
+  V(AVXS8x16TransposeLow)          \
+  V(SSES8x16TransposeHigh)         \
+  V(AVXS8x16TransposeHigh)         \
+  V(SSES8x8Reverse)                \
+  V(AVXS8x8Reverse)                \
+  V(SSES8x4Reverse)                \
+  V(AVXS8x4Reverse)                \
+  V(SSES8x2Reverse)                \
+  V(AVXS8x2Reverse)                \
+  V(IA32S1x4AnyTrue)               \
+  V(IA32S1x4AllTrue)               \
+  V(IA32S1x8AnyTrue)               \
+  V(IA32S1x8AllTrue)               \
+  V(IA32S1x16AnyTrue)              \
+  V(IA32S1x16AllTrue)
 
 // Addressing modes represent the "shape" of inputs to an instruction.
 // Many instructions support multiple addressing modes. Addressing modes
diff --git a/deps/v8/src/compiler/ia32/instruction-scheduler-ia32.cc b/deps/v8/src/compiler/ia32/instruction-scheduler-ia32.cc
index 0d592afbef9968..82d6fb88a30844 100644
--- a/deps/v8/src/compiler/ia32/instruction-scheduler-ia32.cc
+++ b/deps/v8/src/compiler/ia32/instruction-scheduler-ia32.cc
@@ -136,6 +136,10 @@ int InstructionScheduler::GetTargetInstructionFlags(
     case kIA32I32x4ExtractLane:
     case kSSEI32x4ReplaceLane:
     case kAVXI32x4ReplaceLane:
+    case kSSEI32x4SConvertF32x4:
+    case kAVXI32x4SConvertF32x4:
+    case kIA32I32x4SConvertI16x8Low:
+    case kIA32I32x4SConvertI16x8High:
     case kIA32I32x4Neg:
     case kSSEI32x4Shl:
     case kAVXI32x4Shl:
@@ -161,6 +165,10 @@ int InstructionScheduler::GetTargetInstructionFlags(
     case kAVXI32x4GtS:
     case kSSEI32x4GeS:
     case kAVXI32x4GeS:
+    case kSSEI32x4UConvertF32x4:
+    case kAVXI32x4UConvertF32x4:
+    case kIA32I32x4UConvertI16x8Low:
+    case kIA32I32x4UConvertI16x8High:
     case kSSEI32x4ShrU:
     case kAVXI32x4ShrU:
     case kSSEI32x4MinU:
@@ -175,11 +183,15 @@ int InstructionScheduler::GetTargetInstructionFlags(
     case kIA32I16x8ExtractLane:
     case kSSEI16x8ReplaceLane:
     case kAVXI16x8ReplaceLane:
+    case kIA32I16x8SConvertI8x16Low:
+    case kIA32I16x8SConvertI8x16High:
     case kIA32I16x8Neg:
     case kSSEI16x8Shl:
     case kAVXI16x8Shl:
     case kSSEI16x8ShrS:
     case kAVXI16x8ShrS:
+    case kSSEI16x8SConvertI32x4:
+    case kAVXI16x8SConvertI32x4:
     case kSSEI16x8Add:
     case kAVXI16x8Add:
     case kSSEI16x8AddSaturateS:
@@ -204,8 +216,12 @@ int InstructionScheduler::GetTargetInstructionFlags(
     case kAVXI16x8GtS:
     case kSSEI16x8GeS:
     case kAVXI16x8GeS:
+    case kIA32I16x8UConvertI8x16Low:
+    case kIA32I16x8UConvertI8x16High:
     case kSSEI16x8ShrU:
     case kAVXI16x8ShrU:
+    case kSSEI16x8UConvertI32x4:
+    case kAVXI16x8UConvertI32x4:
     case kSSEI16x8AddSaturateU:
     case kAVXI16x8AddSaturateU:
     case kSSEI16x8SubSaturateU:
@@ -222,11 +238,12 @@ int InstructionScheduler::GetTargetInstructionFlags(
     case kIA32I8x16ExtractLane:
     case kSSEI8x16ReplaceLane:
     case kAVXI8x16ReplaceLane:
+    case kSSEI8x16SConvertI16x8:
+    case kAVXI8x16SConvertI16x8:
     case kIA32I8x16Neg:
     case kSSEI8x16Shl:
     case kAVXI8x16Shl:
-    case kSSEI8x16ShrS:
-    case kAVXI8x16ShrS:
+    case kIA32I8x16ShrS:
     case kSSEI8x16Add:
     case kAVXI8x16Add:
     case kSSEI8x16AddSaturateS:
@@ -249,12 +266,13 @@ int InstructionScheduler::GetTargetInstructionFlags(
     case kAVXI8x16GtS:
     case kSSEI8x16GeS:
     case kAVXI8x16GeS:
+    case kSSEI8x16UConvertI16x8:
+    case kAVXI8x16UConvertI16x8:
     case kSSEI8x16AddSaturateU:
     case kAVXI8x16AddSaturateU:
     case kSSEI8x16SubSaturateU:
     case kAVXI8x16SubSaturateU:
-    case kSSEI8x16ShrU:
-    case kAVXI8x16ShrU:
+    case kIA32I8x16ShrU:
     case kSSEI8x16MinU:
     case kAVXI8x16MinU:
     case kSSEI8x16MaxU:
@@ -276,6 +294,45 @@ int InstructionScheduler::GetTargetInstructionFlags(
     case kAVXS128Select:
     case kIA32S8x16Shuffle:
     case kIA32S32x4Swizzle:
+    case kIA32S32x4Shuffle:
+    case kIA32S16x8Blend:
+    case kIA32S16x8HalfShuffle1:
+    case kIA32S16x8HalfShuffle2:
+    case kIA32S8x16Alignr:
+    case kIA32S16x8Dup:
+    case kIA32S8x16Dup:
+    case kSSES16x8UnzipHigh:
+    case kAVXS16x8UnzipHigh:
+    case kSSES16x8UnzipLow:
+    case kAVXS16x8UnzipLow:
+    case kSSES8x16UnzipHigh:
+    case kAVXS8x16UnzipHigh:
+    case kSSES8x16UnzipLow:
+    case kAVXS8x16UnzipLow:
+    case kIA32S64x2UnpackHigh:
+    case kIA32S32x4UnpackHigh:
+    case kIA32S16x8UnpackHigh:
+    case kIA32S8x16UnpackHigh:
+    case kIA32S64x2UnpackLow:
+    case kIA32S32x4UnpackLow:
+    case kIA32S16x8UnpackLow:
+    case kIA32S8x16UnpackLow:
+    case kSSES8x16TransposeLow:
+    case kAVXS8x16TransposeLow:
+    case kSSES8x16TransposeHigh:
+    case kAVXS8x16TransposeHigh:
+    case kSSES8x8Reverse:
+    case kAVXS8x8Reverse:
+    case kSSES8x4Reverse:
+    case kAVXS8x4Reverse:
+    case kSSES8x2Reverse:
+    case kAVXS8x2Reverse:
+    case kIA32S1x4AnyTrue:
+    case kIA32S1x4AllTrue:
+    case kIA32S1x8AnyTrue:
+    case kIA32S1x8AllTrue:
+    case kIA32S1x16AnyTrue:
+    case kIA32S1x16AllTrue:
       return (instr->addressing_mode() == kMode_None)
           ? kNoOpcodeFlags
           : kIsLoadOperation | kHasSideEffect;
diff --git a/deps/v8/src/compiler/ia32/instruction-selector-ia32.cc b/deps/v8/src/compiler/ia32/instruction-selector-ia32.cc
index f49935d8e08588..a789673b48d477 100644
--- a/deps/v8/src/compiler/ia32/instruction-selector-ia32.cc
+++ b/deps/v8/src/compiler/ia32/instruction-selector-ia32.cc
@@ -75,8 +75,7 @@ class IA32OperandGenerator final : public OperandGenerator {
         // Constants in new space cannot be used as immediates in V8 because
         // the GC does not scan code objects when collecting the new generation.
         Handle<HeapObject> value = HeapConstantOf(node->op());
-        Isolate* isolate = value->GetIsolate();
-        return !isolate->heap()->InNewSpace(*value);
+        return !Heap::InNewSpace(*value);
 #else
         return false;
 #endif
@@ -210,19 +209,36 @@ void VisitFloatUnop(InstructionSelector* selector, Node* node, Node* input,
   }
 }
 
+void VisitRRSimd(InstructionSelector* selector, Node* node,
+                 ArchOpcode avx_opcode, ArchOpcode sse_opcode) {
+  IA32OperandGenerator g(selector);
+  InstructionOperand operand0 = g.UseRegister(node->InputAt(0));
+  if (selector->IsSupported(AVX)) {
+    selector->Emit(avx_opcode, g.DefineAsRegister(node), operand0);
+  } else {
+    selector->Emit(sse_opcode, g.DefineSameAsFirst(node), operand0);
+  }
+}
+
+void VisitRRISimd(InstructionSelector* selector, Node* node,
+                  ArchOpcode opcode) {
+  IA32OperandGenerator g(selector);
+  InstructionOperand operand0 = g.UseRegister(node->InputAt(0));
+  InstructionOperand operand1 =
+      g.UseImmediate(OpParameter<int32_t>(node->op()));
+  selector->Emit(opcode, g.DefineAsRegister(node), operand0, operand1);
+}
+
 void VisitRRISimd(InstructionSelector* selector, Node* node,
                   ArchOpcode avx_opcode, ArchOpcode sse_opcode) {
   IA32OperandGenerator g(selector);
   InstructionOperand operand0 = g.UseRegister(node->InputAt(0));
   InstructionOperand operand1 =
       g.UseImmediate(OpParameter<int32_t>(node->op()));
-  InstructionOperand temps[] = {g.TempSimd128Register()};
   if (selector->IsSupported(AVX)) {
-    selector->Emit(avx_opcode, g.DefineAsRegister(node), operand0, operand1,
-                   arraysize(temps), temps);
+    selector->Emit(avx_opcode, g.DefineAsRegister(node), operand0, operand1);
   } else {
-    selector->Emit(sse_opcode, g.DefineSameAsFirst(node), operand0, operand1,
-                   arraysize(temps), temps);
+    selector->Emit(sse_opcode, g.DefineSameAsFirst(node), operand0, operand1);
   }
 }
 
@@ -289,7 +305,7 @@ void InstructionSelector::VisitLoad(Node* node) {
       g.GetEffectiveAddressMemoryOperand(node, inputs, &input_count);
   InstructionCode code = opcode | AddressingModeField::encode(mode);
   if (node->opcode() == IrOpcode::kPoisonedLoad) {
-    CHECK_EQ(poisoning_enabled_, PoisoningMitigationLevel::kOn);
+    CHECK_NE(poisoning_level_, PoisoningMitigationLevel::kDontPoison);
     code |= MiscField::encode(kMemoryAccessPoisoned);
   }
   Emit(code, 1, outputs, input_count, inputs);
@@ -905,7 +921,7 @@ void InstructionSelector::VisitUint32Mod(Node* node) {
 
 void InstructionSelector::VisitRoundUint32ToFloat32(Node* node) {
   IA32OperandGenerator g(this);
-  InstructionOperand temps[] = {g.TempRegister(), g.TempRegister()};
+  InstructionOperand temps[] = {g.TempRegister()};
   Emit(kSSEUint32ToFloat32, g.DefineAsRegister(node), g.Use(node->InputAt(0)),
        arraysize(temps), temps);
 }
@@ -1244,20 +1260,27 @@ void VisitWordCompare(InstructionSelector* selector, Node* node,
 
 void VisitWordCompare(InstructionSelector* selector, Node* node,
                       FlagsContinuation* cont) {
-  IA32OperandGenerator g(selector);
-  Int32BinopMatcher m(node);
-  if (m.left().IsLoad() && m.right().IsLoadStackPointer()) {
-    LoadMatcher<ExternalReferenceMatcher> mleft(m.left().node());
-    ExternalReference js_stack_limit =
-        ExternalReference::address_of_stack_limit(selector->isolate());
-    if (mleft.object().Is(js_stack_limit) && mleft.index().Is(0)) {
-      // Compare(Load(js_stack_limit), LoadStackPointer)
-      if (!node->op()->HasProperty(Operator::kCommutative)) cont->Commute();
-      InstructionCode opcode = cont->Encode(kIA32StackCheck);
-      CHECK(cont->IsBranch());
-      selector->EmitWithContinuation(opcode, cont);
-      return;
-    }
+  StackCheckMatcher<Int32BinopMatcher, IrOpcode::kUint32LessThan> m(
+      selector->isolate(), node);
+  if (m.Matched()) {
+    // Compare(Load(js_stack_limit), LoadStackPointer)
+    if (!node->op()->HasProperty(Operator::kCommutative)) cont->Commute();
+    InstructionCode opcode = cont->Encode(kIA32StackCheck);
+    CHECK(cont->IsBranch());
+    selector->EmitWithContinuation(opcode, cont);
+    return;
+  }
+  WasmStackCheckMatcher<Int32BinopMatcher, IrOpcode::kUint32LessThan> wasm_m(
+      node);
+  if (wasm_m.Matched()) {
+    // This is a wasm stack check. By structure, we know that we can use the
+    // stack pointer directly, as wasm code does not modify the stack at points
+    // where stack checks are performed.
+    Node* left = node->InputAt(0);
+    LocationOperand esp(InstructionOperand::EXPLICIT, LocationOperand::REGISTER,
+                        InstructionSequence::DefaultRepresentation(),
+                        RegisterCode::kRegCode_esp);
+    return VisitCompareWithMemoryOperand(selector, kIA32Cmp, left, esp, cont);
   }
   VisitWordCompare(selector, node, kIA32Cmp, cont);
 }
@@ -1381,8 +1404,8 @@ void InstructionSelector::VisitSwitch(Node* node, const SwitchInfo& sw) {
     }
   }
 
-  // Generate a sequence of conditional jumps.
-  return EmitLookupSwitch(sw, value_operand);
+  // Generate a tree of conditional jumps.
+  return EmitBinarySearchSwitch(sw, value_operand);
 }
 
 
@@ -1665,7 +1688,7 @@ void InstructionSelector::VisitWord32AtomicCompareExchange(Node* node) {
   Emit(code, 1, outputs, input_count, inputs);
 }
 
-void InstructionSelector::VisitAtomicBinaryOperation(
+void InstructionSelector::VisitWord32AtomicBinaryOperation(
     Node* node, ArchOpcode int8_op, ArchOpcode uint8_op, ArchOpcode int16_op,
     ArchOpcode uint16_op, ArchOpcode word32_op) {
   IA32OperandGenerator g(this);
@@ -1715,7 +1738,7 @@ void InstructionSelector::VisitAtomicBinaryOperation(
 
 #define VISIT_ATOMIC_BINOP(op)                                   \
   void InstructionSelector::VisitWord32Atomic##op(Node* node) {  \
-    VisitAtomicBinaryOperation(                                  \
+    VisitWord32AtomicBinaryOperation(                            \
         node, kWord32Atomic##op##Int8, kWord32Atomic##op##Uint8, \
         kWord32Atomic##op##Int16, kWord32Atomic##op##Uint16,     \
         kWord32Atomic##op##Word32);                              \
@@ -1757,6 +1780,7 @@ VISIT_ATOMIC_BINOP(Xor)
   V(I32x4MaxU)             \
   V(I32x4GtU)              \
   V(I32x4GeU)              \
+  V(I16x8SConvertI32x4)    \
   V(I16x8Add)              \
   V(I16x8AddSaturateS)     \
   V(I16x8AddHoriz)         \
@@ -1775,6 +1799,7 @@ VISIT_ATOMIC_BINOP(Xor)
   V(I16x8MaxU)             \
   V(I16x8GtU)              \
   V(I16x8GeU)              \
+  V(I8x16SConvertI16x8)    \
   V(I8x16Add)              \
   V(I8x16AddSaturateS)     \
   V(I8x16Sub)              \
@@ -1795,12 +1820,20 @@ VISIT_ATOMIC_BINOP(Xor)
   V(S128Or)                \
   V(S128Xor)
 
-#define SIMD_UNOP_LIST(V) \
-  V(F32x4SConvertI32x4)   \
-  V(F32x4RecipApprox)     \
-  V(F32x4RecipSqrtApprox) \
-  V(I32x4Neg)             \
-  V(I16x8Neg)             \
+#define SIMD_UNOP_LIST(V)   \
+  V(F32x4SConvertI32x4)     \
+  V(F32x4RecipApprox)       \
+  V(F32x4RecipSqrtApprox)   \
+  V(I32x4SConvertI16x8Low)  \
+  V(I32x4SConvertI16x8High) \
+  V(I32x4Neg)               \
+  V(I32x4UConvertI16x8Low)  \
+  V(I32x4UConvertI16x8High) \
+  V(I16x8SConvertI8x16Low)  \
+  V(I16x8SConvertI8x16High) \
+  V(I16x8Neg)               \
+  V(I16x8UConvertI8x16Low)  \
+  V(I16x8UConvertI8x16High) \
   V(I8x16Neg)
 
 #define SIMD_UNOP_PREFIX_LIST(V) \
@@ -1808,66 +1841,59 @@ VISIT_ATOMIC_BINOP(Xor)
   V(F32x4Neg)                    \
   V(S128Not)
 
+#define SIMD_ANYTRUE_LIST(V) \
+  V(S1x4AnyTrue)             \
+  V(S1x8AnyTrue)             \
+  V(S1x16AnyTrue)
+
+#define SIMD_ALLTRUE_LIST(V) \
+  V(S1x4AllTrue)             \
+  V(S1x8AllTrue)             \
+  V(S1x16AllTrue)
+
 #define SIMD_SHIFT_OPCODES(V) \
   V(I32x4Shl)                 \
   V(I32x4ShrS)                \
   V(I32x4ShrU)                \
   V(I16x8Shl)                 \
   V(I16x8ShrS)                \
-  V(I16x8ShrU)
+  V(I16x8ShrU)                \
+  V(I8x16Shl)
+
+#define SIMD_I8X16_RIGHT_SHIFT_OPCODES(V) \
+  V(I8x16ShrS)                            \
+  V(I8x16ShrU)
 
 void InstructionSelector::VisitF32x4Splat(Node* node) {
-  IA32OperandGenerator g(this);
-  InstructionOperand operand0 = g.UseRegister(node->InputAt(0));
-  if (IsSupported(AVX)) {
-    Emit(kAVXF32x4Splat, g.DefineAsRegister(node), operand0);
-  } else {
-    Emit(kSSEF32x4Splat, g.DefineSameAsFirst(node), operand0);
-  }
+  VisitRRSimd(this, node, kAVXF32x4Splat, kSSEF32x4Splat);
 }
 
 void InstructionSelector::VisitF32x4ExtractLane(Node* node) {
-  IA32OperandGenerator g(this);
-  InstructionOperand operand0 = g.UseRegister(node->InputAt(0));
-  InstructionOperand operand1 =
-      g.UseImmediate(OpParameter<int32_t>(node->op()));
-  if (IsSupported(AVX)) {
-    Emit(kAVXF32x4ExtractLane, g.DefineAsRegister(node), operand0, operand1);
-  } else {
-    Emit(kSSEF32x4ExtractLane, g.DefineSameAsFirst(node), operand0, operand1);
-  }
+  VisitRRISimd(this, node, kAVXF32x4ExtractLane, kSSEF32x4ExtractLane);
 }
 
 void InstructionSelector::VisitF32x4UConvertI32x4(Node* node) {
-  IA32OperandGenerator g(this);
-  InstructionOperand operand0 = g.UseRegister(node->InputAt(0));
-  if (IsSupported(AVX)) {
-    Emit(kAVXF32x4UConvertI32x4, g.DefineAsRegister(node), operand0);
-  } else {
-    Emit(kSSEF32x4UConvertI32x4, g.DefineSameAsFirst(node), operand0);
-  }
+  VisitRRSimd(this, node, kAVXF32x4UConvertI32x4, kSSEF32x4UConvertI32x4);
 }
 
-#define SIMD_I8X16_SHIFT_OPCODES(V) \
-  V(I8x16Shl)                       \
-  V(I8x16ShrS)                      \
-  V(I8x16ShrU)
-
-#define VISIT_SIMD_I8X16_SHIFT(Op)                  \
-  void InstructionSelector::Visit##Op(Node* node) { \
-    VisitRRISimd(this, node, kAVX##Op, kSSE##Op);   \
-  }
+void InstructionSelector::VisitI32x4SConvertF32x4(Node* node) {
+  VisitRRSimd(this, node, kAVXI32x4SConvertF32x4, kSSEI32x4SConvertF32x4);
+}
 
-SIMD_I8X16_SHIFT_OPCODES(VISIT_SIMD_I8X16_SHIFT)
-#undef SIMD_I8X16_SHIFT_OPCODES
-#undef VISIT_SIMD_I8X16_SHIFT
+void InstructionSelector::VisitI32x4UConvertF32x4(Node* node) {
+  IA32OperandGenerator g(this);
+  InstructionOperand temps[] = {g.TempSimd128Register()};
+  InstructionCode opcode =
+      IsSupported(AVX) ? kAVXI32x4UConvertF32x4 : kSSEI32x4UConvertF32x4;
+  Emit(opcode, g.DefineSameAsFirst(node), g.UseRegister(node->InputAt(0)),
+       arraysize(temps), temps);
+}
 
 void InstructionSelector::VisitI8x16Mul(Node* node) {
   IA32OperandGenerator g(this);
-  InstructionOperand operand0 = g.UseRegister(node->InputAt(0));
-  InstructionOperand operand1 = g.UseRegister(node->InputAt(1));
-  InstructionOperand temps[] = {g.TempSimd128Register(),
-                                g.TempSimd128Register()};
+  InstructionOperand operand0 = g.UseUniqueRegister(node->InputAt(0));
+  InstructionOperand operand1 = g.UseUniqueRegister(node->InputAt(1));
+  InstructionOperand temps[] = {g.TempSimd128Register()};
   if (IsSupported(AVX)) {
     Emit(kAVXI8x16Mul, g.DefineAsRegister(node), operand0, operand1,
          arraysize(temps), temps);
@@ -1904,10 +1930,7 @@ SIMD_INT_TYPES(VISIT_SIMD_SPLAT)
 
 #define VISIT_SIMD_EXTRACT_LANE(Type)                              \
   void InstructionSelector::Visit##Type##ExtractLane(Node* node) { \
-    IA32OperandGenerator g(this);                                  \
-    int32_t lane = OpParameter<int32_t>(node->op());               \
-    Emit(kIA32##Type##ExtractLane, g.DefineAsRegister(node),       \
-         g.UseRegister(node->InputAt(0)), g.UseImmediate(lane));   \
+    VisitRRISimd(this, node, kIA32##Type##ExtractLane);            \
   }
 SIMD_INT_TYPES(VISIT_SIMD_EXTRACT_LANE)
 #undef VISIT_SIMD_EXTRACT_LANE
@@ -1932,22 +1955,23 @@ VISIT_SIMD_REPLACE_LANE(F32x4)
 #undef VISIT_SIMD_REPLACE_LANE
 #undef SIMD_INT_TYPES
 
-#define VISIT_SIMD_SHIFT(Opcode)                                         \
-  void InstructionSelector::Visit##Opcode(Node* node) {                  \
-    IA32OperandGenerator g(this);                                        \
-    InstructionOperand operand0 = g.UseRegister(node->InputAt(0));       \
-    InstructionOperand operand1 =                                        \
-        g.UseImmediate(OpParameter<int32_t>(node->op()));                \
-    if (IsSupported(AVX)) {                                              \
-      Emit(kAVX##Opcode, g.DefineAsRegister(node), operand0, operand1);  \
-    } else {                                                             \
-      Emit(kSSE##Opcode, g.DefineSameAsFirst(node), operand0, operand1); \
-    }                                                                    \
+#define VISIT_SIMD_SHIFT(Opcode)                          \
+  void InstructionSelector::Visit##Opcode(Node* node) {   \
+    VisitRRISimd(this, node, kAVX##Opcode, kSSE##Opcode); \
   }
 SIMD_SHIFT_OPCODES(VISIT_SIMD_SHIFT)
 #undef VISIT_SIMD_SHIFT
 #undef SIMD_SHIFT_OPCODES
 
+#define VISIT_SIMD_I8X16_RIGHT_SHIFT(Op)            \
+  void InstructionSelector::Visit##Op(Node* node) { \
+    VisitRRISimd(this, node, kIA32##Op);            \
+  }
+
+SIMD_I8X16_RIGHT_SHIFT_OPCODES(VISIT_SIMD_I8X16_RIGHT_SHIFT)
+#undef SIMD_I8X16_RIGHT_SHIFT_OPCODES
+#undef VISIT_SIMD_I8X16_RIGHT_SHIFT
+
 #define VISIT_SIMD_UNOP(Opcode)                                             \
   void InstructionSelector::Visit##Opcode(Node* node) {                     \
     IA32OperandGenerator g(this);                                           \
@@ -1967,6 +1991,28 @@ SIMD_UNOP_PREFIX_LIST(VISIT_SIMD_UNOP_PREFIX)
 #undef VISIT_SIMD_UNOP_PREFIX
 #undef SIMD_UNOP_PREFIX_LIST
 
+#define VISIT_SIMD_ANYTRUE(Opcode)                                  \
+  void InstructionSelector::Visit##Opcode(Node* node) {             \
+    IA32OperandGenerator g(this);                                   \
+    InstructionOperand temps[] = {g.TempRegister()};                \
+    Emit(kIA32##Opcode, g.DefineAsRegister(node),                   \
+         g.UseRegister(node->InputAt(0)), arraysize(temps), temps); \
+  }
+SIMD_ANYTRUE_LIST(VISIT_SIMD_ANYTRUE)
+#undef VISIT_SIMD_ANYTRUE
+#undef SIMD_ANYTRUE_LIST
+
+#define VISIT_SIMD_ALLTRUE(Opcode)                                         \
+  void InstructionSelector::Visit##Opcode(Node* node) {                    \
+    IA32OperandGenerator g(this);                                          \
+    InstructionOperand temps[] = {g.TempRegister()};                       \
+    Emit(kIA32##Opcode, g.DefineAsRegister(node), g.Use(node->InputAt(0)), \
+         arraysize(temps), temps);                                         \
+  }
+SIMD_ALLTRUE_LIST(VISIT_SIMD_ALLTRUE)
+#undef VISIT_SIMD_ALLTRUE
+#undef SIMD_ALLTRUE_LIST
+
 #define VISIT_SIMD_BINOP(Opcode)                           \
   void InstructionSelector::Visit##Opcode(Node* node) {    \
     VisitRROFloat(this, node, kAVX##Opcode, kSSE##Opcode); \
@@ -1975,6 +2021,26 @@ SIMD_BINOP_LIST(VISIT_SIMD_BINOP)
 #undef VISIT_SIMD_BINOP
 #undef SIMD_BINOP_LIST
 
+void VisitPack(InstructionSelector* selector, Node* node, ArchOpcode avx_opcode,
+               ArchOpcode sse_opcode) {
+  IA32OperandGenerator g(selector);
+  InstructionOperand operand0 = g.UseRegister(node->InputAt(0));
+  InstructionOperand operand1 = g.Use(node->InputAt(1));
+  if (selector->IsSupported(AVX)) {
+    selector->Emit(avx_opcode, g.DefineSameAsFirst(node), operand0, operand1);
+  } else {
+    selector->Emit(sse_opcode, g.DefineSameAsFirst(node), operand0, operand1);
+  }
+}
+
+void InstructionSelector::VisitI16x8UConvertI32x4(Node* node) {
+  VisitPack(this, node, kAVXI16x8UConvertI32x4, kSSEI16x8UConvertI32x4);
+}
+
+void InstructionSelector::VisitI8x16UConvertI16x8(Node* node) {
+  VisitPack(this, node, kAVXI8x16UConvertI16x8, kSSEI8x16UConvertI16x8);
+}
+
 void InstructionSelector::VisitInt32AbsWithOverflow(Node* node) {
   UNREACHABLE();
 }
@@ -1983,41 +2049,295 @@ void InstructionSelector::VisitInt64AbsWithOverflow(Node* node) {
   UNREACHABLE();
 }
 
+namespace {
+
+// Packs a 4 lane shuffle into a single imm8 suitable for use by pshufd,
+// pshuflw, and pshufhw.
+uint8_t PackShuffle4(uint8_t* shuffle) {
+  return (shuffle[0] & 3) | ((shuffle[1] & 3) << 2) | ((shuffle[2] & 3) << 4) |
+         ((shuffle[3] & 3) << 6);
+}
+
+// Gets an 8 bit lane mask suitable for 16x8 pblendw.
+uint8_t PackBlend8(const uint8_t* shuffle16x8) {
+  int8_t result = 0;
+  for (int i = 0; i < 8; ++i) {
+    result |= (shuffle16x8[i] >= 8 ? 1 : 0) << i;
+  }
+  return result;
+}
+
+// Gets an 8 bit lane mask suitable for 32x4 pblendw.
+uint8_t PackBlend4(const uint8_t* shuffle32x4) {
+  int8_t result = 0;
+  for (int i = 0; i < 4; ++i) {
+    result |= (shuffle32x4[i] >= 4 ? 0x3 : 0) << (i * 2);
+  }
+  return result;
+}
+
+// Returns true if shuffle can be decomposed into two 16x4 half shuffles
+// followed by a 16x8 blend.
+// E.g. [3 2 1 0 15 14 13 12].
+bool TryMatch16x8HalfShuffle(uint8_t* shuffle16x8, uint8_t* blend_mask) {
+  *blend_mask = 0;
+  for (int i = 0; i < 8; i++) {
+    if ((shuffle16x8[i] & 0x4) != (i & 0x4)) return false;
+    *blend_mask |= (shuffle16x8[i] > 7 ? 1 : 0) << i;
+  }
+  return true;
+}
+
+struct ShuffleEntry {
+  uint8_t shuffle[kSimd128Size];
+  ArchOpcode opcode;
+  ArchOpcode avx_opcode;
+  bool src0_needs_reg;
+  bool src1_needs_reg;
+};
+
+// Shuffles that map to architecture-specific instruction sequences. These are
+// matched very early, so we shouldn't include shuffles that match better in
+// later tests, like 32x4 and 16x8 shuffles. In general, these patterns should
+// map to either a single instruction, or be finer grained, such as zip/unzip or
+// transpose patterns.
+static const ShuffleEntry arch_shuffles[] = {
+    {{0, 1, 2, 3, 4, 5, 6, 7, 16, 17, 18, 19, 20, 21, 22, 23},
+     kIA32S64x2UnpackLow,
+     kIA32S64x2UnpackLow,
+     true,
+     false},
+    {{8, 9, 10, 11, 12, 13, 14, 15, 24, 25, 26, 27, 28, 29, 30, 31},
+     kIA32S64x2UnpackHigh,
+     kIA32S64x2UnpackHigh,
+     true,
+     false},
+    {{0, 1, 2, 3, 16, 17, 18, 19, 4, 5, 6, 7, 20, 21, 22, 23},
+     kIA32S32x4UnpackLow,
+     kIA32S32x4UnpackLow,
+     true,
+     false},
+    {{8, 9, 10, 11, 24, 25, 26, 27, 12, 13, 14, 15, 28, 29, 30, 31},
+     kIA32S32x4UnpackHigh,
+     kIA32S32x4UnpackHigh,
+     true,
+     false},
+    {{0, 1, 16, 17, 2, 3, 18, 19, 4, 5, 20, 21, 6, 7, 22, 23},
+     kIA32S16x8UnpackLow,
+     kIA32S16x8UnpackLow,
+     true,
+     false},
+    {{8, 9, 24, 25, 10, 11, 26, 27, 12, 13, 28, 29, 14, 15, 30, 31},
+     kIA32S16x8UnpackHigh,
+     kIA32S16x8UnpackHigh,
+     true,
+     false},
+    {{0, 16, 1, 17, 2, 18, 3, 19, 4, 20, 5, 21, 6, 22, 7, 23},
+     kIA32S8x16UnpackLow,
+     kIA32S8x16UnpackLow,
+     true,
+     false},
+    {{8, 24, 9, 25, 10, 26, 11, 27, 12, 28, 13, 29, 14, 30, 15, 31},
+     kIA32S8x16UnpackHigh,
+     kIA32S8x16UnpackHigh,
+     true,
+     false},
+
+    {{0, 1, 4, 5, 8, 9, 12, 13, 16, 17, 20, 21, 24, 25, 28, 29},
+     kSSES16x8UnzipLow,
+     kAVXS16x8UnzipLow,
+     true,
+     false},
+    {{2, 3, 6, 7, 10, 11, 14, 15, 18, 19, 22, 23, 26, 27, 30, 31},
+     kSSES16x8UnzipHigh,
+     kAVXS16x8UnzipHigh,
+     true,
+     true},
+    {{0, 2, 4, 6, 8, 10, 12, 14, 16, 18, 20, 22, 24, 26, 28, 30},
+     kSSES8x16UnzipLow,
+     kAVXS8x16UnzipLow,
+     true,
+     true},
+    {{1, 3, 5, 7, 9, 11, 13, 15, 17, 19, 21, 23, 25, 27, 29, 31},
+     kSSES8x16UnzipHigh,
+     kAVXS8x16UnzipHigh,
+     true,
+     true},
+
+    {{0, 16, 2, 18, 4, 20, 6, 22, 8, 24, 10, 26, 12, 28, 14, 30},
+     kSSES8x16TransposeLow,
+     kAVXS8x16TransposeLow,
+     true,
+     true},
+    {{1, 17, 3, 19, 5, 21, 7, 23, 9, 25, 11, 27, 13, 29, 15, 31},
+     kSSES8x16TransposeHigh,
+     kAVXS8x16TransposeHigh,
+     true,
+     true},
+    {{7, 6, 5, 4, 3, 2, 1, 0, 15, 14, 13, 12, 11, 10, 9, 8},
+     kSSES8x8Reverse,
+     kAVXS8x8Reverse,
+     false,
+     false},
+    {{3, 2, 1, 0, 7, 6, 5, 4, 11, 10, 9, 8, 15, 14, 13, 12},
+     kSSES8x4Reverse,
+     kAVXS8x4Reverse,
+     false,
+     false},
+    {{1, 0, 3, 2, 5, 4, 7, 6, 9, 8, 11, 10, 13, 12, 15, 14},
+     kSSES8x2Reverse,
+     kAVXS8x2Reverse,
+     true,
+     true}};
+
+bool TryMatchArchShuffle(const uint8_t* shuffle, const ShuffleEntry* table,
+                         size_t num_entries, bool is_swizzle,
+                         const ShuffleEntry** arch_shuffle) {
+  uint8_t mask = is_swizzle ? kSimd128Size - 1 : 2 * kSimd128Size - 1;
+  for (size_t i = 0; i < num_entries; ++i) {
+    const ShuffleEntry& entry = table[i];
+    int j = 0;
+    for (; j < kSimd128Size; ++j) {
+      if ((entry.shuffle[j] & mask) != (shuffle[j] & mask)) {
+        break;
+      }
+    }
+    if (j == kSimd128Size) {
+      *arch_shuffle = &entry;
+      return true;
+    }
+  }
+  return false;
+}
+
+}  // namespace
+
+// TODO(bbudge) Make sure identity shuffle emits no instructions.
 void InstructionSelector::VisitS8x16Shuffle(Node* node) {
-  static const int kMaxSwizzleIndex = 15;
-  static const int kMaxShuffleIndex = 31;
-  const uint8_t* shuffle = OpParameter<uint8_t*>(node->op());
-  uint8_t mask = CanonicalizeShuffle(node);
-  uint8_t shuffle32x4[4];
+  uint8_t shuffle[kSimd128Size];
+  bool is_swizzle;
+  CanonicalizeShuffle(node, shuffle, &is_swizzle);
+
+  int imm_count = 0;
+  static const int kMaxImms = 6;
+  uint32_t imms[kMaxImms];
+  int temp_count = 0;
+  static const int kMaxTemps = 2;
+  InstructionOperand temps[kMaxTemps];
+
   IA32OperandGenerator g(this);
-  InstructionOperand output = g.DefineAsRegister(node);
-  InstructionOperand inputs[6];
-  InstructionOperand temps[1];
-  size_t input_count = 0;
-  Node* input0 = node->InputAt(0);
-  Node* input1 = node->InputAt(1);
-  if (mask == kMaxSwizzleIndex) {
-    if (TryMatch32x4Shuffle(shuffle, shuffle32x4)) {
-      Emit(kIA32S32x4Swizzle, output, g.Use(input0),
-           g.UseImmediate((shuffle32x4[0] & 3) | ((shuffle32x4[1] & 3) << 2) |
-                          ((shuffle32x4[2] & 3) << 4) |
-                          ((shuffle32x4[3] & 3) << 6)));
-      return;
+  bool use_avx = CpuFeatures::IsSupported(AVX);
+  // AVX and swizzles don't generally need DefineSameAsFirst to avoid a move.
+  bool no_same_as_first = use_avx || is_swizzle;
+  // We generally need UseRegister for input0, Use for input1.
+  bool src0_needs_reg = true;
+  bool src1_needs_reg = false;
+  ArchOpcode opcode = kIA32S8x16Shuffle;  // general shuffle is the default
+
+  uint8_t offset;
+  uint8_t shuffle32x4[4];
+  uint8_t shuffle16x8[8];
+  int index;
+  const ShuffleEntry* arch_shuffle;
+  if (TryMatchConcat(shuffle, &offset)) {
+    // Swap inputs from the normal order for (v)palignr.
+    SwapShuffleInputs(node);
+    is_swizzle = false;  // It's simpler to just handle the general case.
+    no_same_as_first = use_avx;  // SSE requires same-as-first.
+    opcode = kIA32S8x16Alignr;
+    // palignr takes a single imm8 offset.
+    imms[imm_count++] = offset;
+  } else if (TryMatchArchShuffle(shuffle, arch_shuffles,
+                                 arraysize(arch_shuffles), is_swizzle,
+                                 &arch_shuffle)) {
+    opcode = use_avx ? arch_shuffle->avx_opcode : arch_shuffle->opcode;
+    src0_needs_reg = !use_avx || arch_shuffle->src0_needs_reg;
+    // SSE can't take advantage of both operands in registers and needs
+    // same-as-first.
+    src1_needs_reg = use_avx && arch_shuffle->src1_needs_reg;
+    no_same_as_first = use_avx;
+  } else if (TryMatch32x4Shuffle(shuffle, shuffle32x4)) {
+    uint8_t shuffle_mask = PackShuffle4(shuffle32x4);
+    if (is_swizzle) {
+      // pshufd takes a single imm8 shuffle mask.
+      opcode = kIA32S32x4Swizzle;
+      no_same_as_first = true;
+      src0_needs_reg = false;
+      imms[imm_count++] = shuffle_mask;
+    } else {
+      // 2 operand shuffle
+      // A blend is more efficient than a general 32x4 shuffle; try it first.
+      if (TryMatchBlend(shuffle)) {
+        opcode = kIA32S16x8Blend;
+        uint8_t blend_mask = PackBlend4(shuffle32x4);
+        imms[imm_count++] = blend_mask;
+      } else {
+        opcode = kIA32S32x4Shuffle;
+        no_same_as_first = true;
+        src0_needs_reg = false;
+        imms[imm_count++] = shuffle_mask;
+        int8_t blend_mask = PackBlend4(shuffle32x4);
+        imms[imm_count++] = blend_mask;
+      }
     }
-    // TODO(ia32): handle non 32x4 swizzles here
-    inputs[input_count++] = g.Use(input0);
-  } else {
-    DCHECK_EQ(kMaxShuffleIndex, mask);
-    USE(kMaxShuffleIndex);
-    inputs[input_count++] = g.Use(input0);
-    inputs[input_count++] = g.Use(input1);
-  }
-  inputs[input_count++] = g.UseImmediate(Pack4Lanes(shuffle, mask));
-  inputs[input_count++] = g.UseImmediate(Pack4Lanes(shuffle + 4, mask));
-  inputs[input_count++] = g.UseImmediate(Pack4Lanes(shuffle + 8, mask));
-  inputs[input_count++] = g.UseImmediate(Pack4Lanes(shuffle + 12, mask));
-  temps[0] = g.TempRegister();
-  Emit(kIA32S8x16Shuffle, 1, &output, input_count, inputs, 1, temps);
+  } else if (TryMatch16x8Shuffle(shuffle, shuffle16x8)) {
+    uint8_t blend_mask;
+    if (TryMatchBlend(shuffle)) {
+      opcode = kIA32S16x8Blend;
+      blend_mask = PackBlend8(shuffle16x8);
+      imms[imm_count++] = blend_mask;
+    } else if (TryMatchDup<8>(shuffle, &index)) {
+      opcode = kIA32S16x8Dup;
+      src0_needs_reg = false;
+      imms[imm_count++] = index;
+    } else if (TryMatch16x8HalfShuffle(shuffle16x8, &blend_mask)) {
+      opcode = is_swizzle ? kIA32S16x8HalfShuffle1 : kIA32S16x8HalfShuffle2;
+      // Half-shuffles don't need DefineSameAsFirst or UseRegister(src0).
+      no_same_as_first = true;
+      src0_needs_reg = false;
+      uint8_t mask_lo = PackShuffle4(shuffle16x8);
+      uint8_t mask_hi = PackShuffle4(shuffle16x8 + 4);
+      imms[imm_count++] = mask_lo;
+      imms[imm_count++] = mask_hi;
+      if (!is_swizzle) imms[imm_count++] = blend_mask;
+    }
+  } else if (TryMatchDup<16>(shuffle, &index)) {
+    opcode = kIA32S8x16Dup;
+    no_same_as_first = use_avx;
+    src0_needs_reg = true;
+    imms[imm_count++] = index;
+  }
+  if (opcode == kIA32S8x16Shuffle) {
+    // Use same-as-first for general swizzle, but not shuffle.
+    no_same_as_first = !is_swizzle;
+    src0_needs_reg = !no_same_as_first;
+    imms[imm_count++] = Pack4Lanes(shuffle);
+    imms[imm_count++] = Pack4Lanes(shuffle + 4);
+    imms[imm_count++] = Pack4Lanes(shuffle + 8);
+    imms[imm_count++] = Pack4Lanes(shuffle + 12);
+    temps[temp_count++] = g.TempRegister();
+  }
+
+  // Use DefineAsRegister(node) and Use(src0) if we can without forcing an extra
+  // move instruction in the CodeGenerator.
+  Node* input0 = node->InputAt(0);
+  InstructionOperand dst =
+      no_same_as_first ? g.DefineAsRegister(node) : g.DefineSameAsFirst(node);
+  InstructionOperand src0 =
+      src0_needs_reg ? g.UseRegister(input0) : g.Use(input0);
+
+  int input_count = 0;
+  InstructionOperand inputs[2 + kMaxImms + kMaxTemps];
+  inputs[input_count++] = src0;
+  if (!is_swizzle) {
+    Node* input1 = node->InputAt(1);
+    inputs[input_count++] =
+        src1_needs_reg ? g.UseRegister(input1) : g.Use(input1);
+  }
+  for (int i = 0; i < imm_count; ++i) {
+    inputs[input_count++] = g.UseImmediate(imms[i]);
+  }
+  Emit(opcode, 1, &dst, input_count, inputs, temp_count, temps);
 }
 
 // static
diff --git a/deps/v8/src/compiler/instruction-codes.h b/deps/v8/src/compiler/instruction-codes.h
index d5820faa5efb5d..83e8da9e8a4133 100644
--- a/deps/v8/src/compiler/instruction-codes.h
+++ b/deps/v8/src/compiler/instruction-codes.h
@@ -54,6 +54,7 @@ enum class RecordWriteMode { kValueIsMap, kValueIsPointer, kValueIsAny };
   V(ArchCallWasmFunction)                 \
   V(ArchTailCallWasm)                     \
   V(ArchJmp)                              \
+  V(ArchBinarySearchSwitch)               \
   V(ArchLookupSwitch)                     \
   V(ArchTableSwitch)                      \
   V(ArchNop)                              \
@@ -66,11 +67,10 @@ enum class RecordWriteMode { kValueIsMap, kValueIsPointer, kValueIsAny };
   V(ArchStackPointer)                     \
   V(ArchFramePointer)                     \
   V(ArchParentFramePointer)               \
-  V(ArchRootsPointer)                     \
   V(ArchTruncateDoubleToI)                \
   V(ArchStoreWithWriteBarrier)            \
   V(ArchStackSlot)                        \
-  V(ArchPoisonOnSpeculationWord)          \
+  V(ArchWordPoisonOnSpeculation)          \
   V(Word32AtomicLoadInt8)                 \
   V(Word32AtomicLoadUint8)                \
   V(Word32AtomicLoadInt16)                \
diff --git a/deps/v8/src/compiler/instruction-scheduler.cc b/deps/v8/src/compiler/instruction-scheduler.cc
index 9219e9a520c14c..de042cb670bb01 100644
--- a/deps/v8/src/compiler/instruction-scheduler.cc
+++ b/deps/v8/src/compiler/instruction-scheduler.cc
@@ -248,13 +248,13 @@ int InstructionScheduler::GetInstructionFlags(const Instruction* instr) const {
     case kArchNop:
     case kArchFramePointer:
     case kArchParentFramePointer:
-    case kArchRootsPointer:
     case kArchStackSlot:  // Despite its name this opcode will produce a
                           // reference to a frame slot, so it is not affected
                           // by the arm64 dual stack issues mentioned below.
     case kArchComment:
     case kArchDeoptimize:
     case kArchJmp:
+    case kArchBinarySearchSwitch:
     case kArchLookupSwitch:
     case kArchRet:
     case kArchTableSwitch:
@@ -290,7 +290,7 @@ int InstructionScheduler::GetInstructionFlags(const Instruction* instr) const {
       // must not be reordered with instruction with side effects.
       return kIsLoadOperation;
 
-    case kArchPoisonOnSpeculationWord:
+    case kArchWordPoisonOnSpeculation:
       // While poisoning operations have no side effect, they must not be
       // reordered relative to branches.
       return kHasSideEffect;
diff --git a/deps/v8/src/compiler/instruction-selector-impl.h b/deps/v8/src/compiler/instruction-selector-impl.h
index 824b6a53763ac9..27f37215dfd441 100644
--- a/deps/v8/src/compiler/instruction-selector-impl.h
+++ b/deps/v8/src/compiler/instruction-selector-impl.h
@@ -45,14 +45,23 @@ class SwitchInfo {
     }
   }
 
+  // Ensure that comparison order of if-cascades is preserved.
+  std::vector<CaseInfo> CasesSortedByOriginalOrder() const {
+    std::vector<CaseInfo> result(cases_.begin(), cases_.end());
+    std::stable_sort(result.begin(), result.end());
+    return result;
+  }
+  std::vector<CaseInfo> CasesSortedByValue() const {
+    std::vector<CaseInfo> result(cases_.begin(), cases_.end());
+    std::stable_sort(result.begin(), result.end(),
+                     [](CaseInfo a, CaseInfo b) { return a.value < b.value; });
+    return result;
+  }
+  const ZoneVector<CaseInfo>& CasesUnsorted() const { return cases_; }
   int32_t min_value() const { return min_value_; }
   int32_t max_value() const { return max_value_; }
   size_t value_range() const { return value_range_; }
   size_t case_count() const { return cases_.size(); }
-  const CaseInfo& GetCase(size_t i) const {
-    DCHECK_LT(i, cases_.size());
-    return cases_[i];
-  }
   BasicBlock* default_branch() const { return default_branch_; }
 
  private:
@@ -299,8 +308,15 @@ class OperandGenerator {
       case IrOpcode::kNumberConstant:
         return Constant(OpParameter<double>(node->op()));
       case IrOpcode::kExternalConstant:
-      case IrOpcode::kComment:
         return Constant(OpParameter<ExternalReference>(node->op()));
+      case IrOpcode::kComment: {
+        // We cannot use {intptr_t} here, since the Constant constructor would
+        // be ambiguous on some architectures.
+        using ptrsize_int_t =
+            std::conditional<kPointerSize == 8, int64_t, int32_t>::type;
+        return Constant(reinterpret_cast<ptrsize_int_t>(
+            OpParameter<const char*>(node->op())));
+      }
       case IrOpcode::kHeapConstant:
         return Constant(HeapConstantOf(node->op()));
       case IrOpcode::kDeadValue: {
diff --git a/deps/v8/src/compiler/instruction-selector.cc b/deps/v8/src/compiler/instruction-selector.cc
index 6fce9ea4707b88..f1ca52b14d0fd4 100644
--- a/deps/v8/src/compiler/instruction-selector.cc
+++ b/deps/v8/src/compiler/instruction-selector.cc
@@ -27,8 +27,8 @@ InstructionSelector::InstructionSelector(
     EnableSwitchJumpTable enable_switch_jump_table,
     SourcePositionMode source_position_mode, Features features,
     EnableScheduling enable_scheduling,
-    EnableSerialization enable_serialization,
-    PoisoningMitigationLevel poisoning_enabled)
+    EnableRootsRelativeAddressing enable_roots_relative_addressing,
+    PoisoningMitigationLevel poisoning_level, EnableTraceTurboJson trace_turbo)
     : zone_(zone),
       linkage_(linkage),
       sequence_(sequence),
@@ -48,14 +48,20 @@ InstructionSelector::InstructionSelector(
       virtual_register_rename_(zone),
       scheduler_(nullptr),
       enable_scheduling_(enable_scheduling),
-      enable_serialization_(enable_serialization),
+      enable_roots_relative_addressing_(enable_roots_relative_addressing),
       enable_switch_jump_table_(enable_switch_jump_table),
-      poisoning_enabled_(poisoning_enabled),
+      poisoning_level_(poisoning_level),
       frame_(frame),
-      instruction_selection_failed_(false) {
+      instruction_selection_failed_(false),
+      instr_origins_(sequence->zone()),
+      trace_turbo_(trace_turbo) {
   instructions_.reserve(node_count);
   continuation_inputs_.reserve(5);
   continuation_outputs_.reserve(2);
+
+  if (trace_turbo_ == kEnableTraceTurboJson) {
+    instr_origins_.assign(node_count, {-1, 0});
+  }
 }
 
 bool InstructionSelector::SelectInstructions() {
@@ -414,7 +420,7 @@ void InstructionSelector::SetEffectLevel(Node* node, int effect_level) {
 }
 
 bool InstructionSelector::CanAddressRelativeToRootsRegister() const {
-  return enable_serialization_ == kDisableSerialization &&
+  return enable_roots_relative_addressing_ == kEnableRootsRelativeAddressing &&
          CanUseRootsRegister();
 }
 
@@ -720,7 +726,8 @@ Instruction* InstructionSelector::EmitWithContinuation(
   } else if (cont->IsSet()) {
     continuation_outputs_.push_back(g.DefineAsRegister(cont->result()));
   } else if (cont->IsTrap()) {
-    continuation_inputs_.push_back(g.UseImmediate(cont->trap_id()));
+    int trap_id = static_cast<int>(cont->trap_id());
+    continuation_inputs_.push_back(g.UseImmediate(trap_id));
   } else {
     DCHECK(cont->IsNone());
   }
@@ -1001,7 +1008,7 @@ void InstructionSelector::InitializeCallBuffer(Node* call, CallBuffer* buffer,
       // If we do load poisoning and the linkage uses the poisoning register,
       // then we request the input in memory location, and during code
       // generation, we move the input to the register.
-      if (poisoning_enabled_ != PoisoningMitigationLevel::kOff &&
+      if (poisoning_level_ != PoisoningMitigationLevel::kDontPoison &&
           unallocated.HasFixedRegisterPolicy()) {
         int reg = unallocated.fixed_register_index();
         if (reg == kSpeculationPoisonRegister.code()) {
@@ -1091,21 +1098,29 @@ void InstructionSelector::VisitBlock(BasicBlock* block) {
   // Visit code in reverse control flow order, because architecture-specific
   // matching may cover more than one node at a time.
   for (auto node : base::Reversed(*block)) {
-    // Skip nodes that are unused or already defined.
-    if (!IsUsed(node) || IsDefined(node)) continue;
-    // Generate code for this node "top down", but schedule the code "bottom
-    // up".
     int current_node_end = current_num_instructions();
-    VisitNode(node);
-    if (!FinishEmittedInstructions(node, current_node_end)) return;
+    // Skip nodes that are unused or already defined.
+    if (IsUsed(node) && !IsDefined(node)) {
+      // Generate code for this node "top down", but schedule the code "bottom
+      // up".
+      VisitNode(node);
+      if (!FinishEmittedInstructions(node, current_node_end)) return;
+    }
+    if (trace_turbo_ == kEnableTraceTurboJson) {
+      instr_origins_[node->id()] = {current_num_instructions(),
+                                    current_node_end};
+    }
   }
 
   // We're done with the block.
   InstructionBlock* instruction_block =
       sequence()->InstructionBlockAt(RpoNumber::FromInt(block->rpo_number()));
-  instruction_block->set_code_start(static_cast<int>(instructions_.size()));
+  if (current_num_instructions() == current_block_end) {
+    // Avoid empty block: insert a {kArchNop} instruction.
+    Emit(Instruction::New(sequence()->zone(), kArchNop));
+  }
+  instruction_block->set_code_start(current_num_instructions());
   instruction_block->set_code_end(current_block_end);
-
   current_block_ = nullptr;
 }
 
@@ -1131,25 +1146,34 @@ void InstructionSelector::VisitControl(BasicBlock* block) {
 #endif
 
   Node* input = block->control_input();
+  int instruction_end = static_cast<int>(instructions_.size());
   switch (block->control()) {
     case BasicBlock::kGoto:
-      return VisitGoto(block->SuccessorAt(0));
+      VisitGoto(block->SuccessorAt(0));
+      break;
     case BasicBlock::kCall: {
       DCHECK_EQ(IrOpcode::kCall, input->opcode());
       BasicBlock* success = block->SuccessorAt(0);
       BasicBlock* exception = block->SuccessorAt(1);
-      return VisitCall(input, exception), VisitGoto(success);
+      VisitCall(input, exception);
+      VisitGoto(success);
+      break;
     }
     case BasicBlock::kTailCall: {
       DCHECK_EQ(IrOpcode::kTailCall, input->opcode());
-      return VisitTailCall(input);
+      VisitTailCall(input);
+      break;
     }
     case BasicBlock::kBranch: {
       DCHECK_EQ(IrOpcode::kBranch, input->opcode());
       BasicBlock* tbranch = block->SuccessorAt(0);
       BasicBlock* fbranch = block->SuccessorAt(1);
-      if (tbranch == fbranch) return VisitGoto(tbranch);
-      return VisitBranch(input, tbranch, fbranch);
+      if (tbranch == fbranch) {
+        VisitGoto(tbranch);
+      } else {
+        VisitBranch(input, tbranch, fbranch);
+      }
+      break;
     }
     case BasicBlock::kSwitch: {
       DCHECK_EQ(IrOpcode::kSwitch, input->opcode());
@@ -1168,23 +1192,25 @@ void InstructionSelector::VisitControl(BasicBlock* block) {
         if (min_value > p.value()) min_value = p.value();
         if (max_value < p.value()) max_value = p.value();
       }
-      // Ensure that comparison order of if-cascades is preserved.
-      std::stable_sort(cases.begin(), cases.end());
       SwitchInfo sw(cases, min_value, max_value, default_branch);
-      return VisitSwitch(input, sw);
+      VisitSwitch(input, sw);
+      break;
     }
     case BasicBlock::kReturn: {
       DCHECK_EQ(IrOpcode::kReturn, input->opcode());
-      return VisitReturn(input);
+      VisitReturn(input);
+      break;
     }
     case BasicBlock::kDeoptimize: {
       DeoptimizeParameters p = DeoptimizeParametersOf(input->op());
       Node* value = input->InputAt(0);
-      return VisitDeoptimize(p.kind(), p.reason(), p.feedback(), value);
+      VisitDeoptimize(p.kind(), p.reason(), p.feedback(), value);
+      break;
     }
     case BasicBlock::kThrow:
       DCHECK_EQ(IrOpcode::kThrow, input->opcode());
-      return VisitThrow(input);
+      VisitThrow(input);
+      break;
     case BasicBlock::kNone: {
       // Exit block doesn't have control.
       DCHECK_NULL(input);
@@ -1194,6 +1220,10 @@ void InstructionSelector::VisitControl(BasicBlock* block) {
       UNREACHABLE();
       break;
   }
+  if (trace_turbo_ == kEnableTraceTurboJson && input) {
+    int instruction_start = static_cast<int>(instructions_.size());
+    instr_origins_[input->id()] = {instruction_start, instruction_end};
+  }
 }
 
 void InstructionSelector::MarkPairProjectionsAsWord32(Node* node) {
@@ -1272,11 +1302,9 @@ void InstructionSelector::VisitNode(Node* node) {
     case IrOpcode::kDeoptimizeUnless:
       return VisitDeoptimizeUnless(node);
     case IrOpcode::kTrapIf:
-      return VisitTrapIf(node, static_cast<Runtime::FunctionId>(
-                                   OpParameter<int32_t>(node->op())));
+      return VisitTrapIf(node, TrapIdOf(node->op()));
     case IrOpcode::kTrapUnless:
-      return VisitTrapUnless(node, static_cast<Runtime::FunctionId>(
-                                       OpParameter<int32_t>(node->op())));
+      return VisitTrapUnless(node, TrapIdOf(node->op()));
     case IrOpcode::kFrameState:
     case IrOpcode::kStateValues:
     case IrOpcode::kObjectState:
@@ -1618,11 +1646,12 @@ void InstructionSelector::VisitNode(Node* node) {
       return MarkAsFloat64(node), VisitFloat64InsertLowWord32(node);
     case IrOpcode::kFloat64InsertHighWord32:
       return MarkAsFloat64(node), VisitFloat64InsertHighWord32(node);
-    case IrOpcode::kPoisonOnSpeculationTagged:
-      return MarkAsReference(node), VisitPoisonOnSpeculationTagged(node);
-    case IrOpcode::kPoisonOnSpeculationWord:
-      return MarkAsRepresentation(MachineType::PointerRepresentation(), node),
-             VisitPoisonOnSpeculationWord(node);
+    case IrOpcode::kTaggedPoisonOnSpeculation:
+      return MarkAsReference(node), VisitTaggedPoisonOnSpeculation(node);
+    case IrOpcode::kWord32PoisonOnSpeculation:
+      return MarkAsWord32(node), VisitWord32PoisonOnSpeculation(node);
+    case IrOpcode::kWord64PoisonOnSpeculation:
+      return MarkAsWord64(node), VisitWord64PoisonOnSpeculation(node);
     case IrOpcode::kStackSlot:
       return VisitStackSlot(node);
     case IrOpcode::kLoadStackPointer:
@@ -1631,8 +1660,6 @@ void InstructionSelector::VisitNode(Node* node) {
       return VisitLoadFramePointer(node);
     case IrOpcode::kLoadParentFramePointer:
       return VisitLoadParentFramePointer(node);
-    case IrOpcode::kLoadRootsPointer:
-      return VisitLoadRootsPointer(node);
     case IrOpcode::kUnalignedLoad: {
       LoadRepresentation type = LoadRepresentationOf(node->op());
       MarkAsRepresentation(type.representation(), node);
@@ -1958,20 +1985,28 @@ void InstructionSelector::VisitNode(Node* node) {
   }
 }
 
-void InstructionSelector::VisitPoisonOnSpeculationWord(Node* node) {
-  if (poisoning_enabled_ != PoisoningMitigationLevel::kOff) {
+void InstructionSelector::EmitWordPoisonOnSpeculation(Node* node) {
+  if (poisoning_level_ != PoisoningMitigationLevel::kDontPoison) {
     OperandGenerator g(this);
     Node* input_node = NodeProperties::GetValueInput(node, 0);
     InstructionOperand input = g.UseRegister(input_node);
     InstructionOperand output = g.DefineSameAsFirst(node);
-    Emit(kArchPoisonOnSpeculationWord, output, input);
+    Emit(kArchWordPoisonOnSpeculation, output, input);
   } else {
     EmitIdentity(node);
   }
 }
 
-void InstructionSelector::VisitPoisonOnSpeculationTagged(Node* node) {
-  VisitPoisonOnSpeculationWord(node);
+void InstructionSelector::VisitWord32PoisonOnSpeculation(Node* node) {
+  EmitWordPoisonOnSpeculation(node);
+}
+
+void InstructionSelector::VisitWord64PoisonOnSpeculation(Node* node) {
+  EmitWordPoisonOnSpeculation(node);
+}
+
+void InstructionSelector::VisitTaggedPoisonOnSpeculation(Node* node) {
+  EmitWordPoisonOnSpeculation(node);
 }
 
 void InstructionSelector::VisitLoadStackPointer(Node* node) {
@@ -1989,11 +2024,6 @@ void InstructionSelector::VisitLoadParentFramePointer(Node* node) {
   Emit(kArchParentFramePointer, g.DefineAsRegister(node));
 }
 
-void InstructionSelector::VisitLoadRootsPointer(Node* node) {
-  OperandGenerator g(this);
-  Emit(kArchRootsPointer, g.DefineAsRegister(node));
-}
-
 void InstructionSelector::VisitFloat64Acos(Node* node) {
   VisitFloat64Ieee754Unop(node, kIeee754Float64Acos);
 }
@@ -2087,8 +2117,7 @@ void InstructionSelector::EmitTableSwitch(const SwitchInfo& sw,
   inputs[0] = index_operand;
   InstructionOperand default_operand = g.Label(sw.default_branch());
   std::fill(&inputs[1], &inputs[input_count], default_operand);
-  for (size_t index = 0; index < sw.case_count(); ++index) {
-    const CaseInfo& c = sw.GetCase(index);
+  for (const CaseInfo& c : sw.CasesUnsorted()) {
     size_t value = c.value - sw.min_value();
     DCHECK_LE(0u, value);
     DCHECK_LT(value + 2, input_count);
@@ -2101,19 +2130,38 @@ void InstructionSelector::EmitTableSwitch(const SwitchInfo& sw,
 void InstructionSelector::EmitLookupSwitch(const SwitchInfo& sw,
                                            InstructionOperand& value_operand) {
   OperandGenerator g(this);
+  std::vector<CaseInfo> cases = sw.CasesSortedByOriginalOrder();
   size_t input_count = 2 + sw.case_count() * 2;
   DCHECK_LE(sw.case_count(), (std::numeric_limits<size_t>::max() - 2) / 2);
   auto* inputs = zone()->NewArray<InstructionOperand>(input_count);
   inputs[0] = value_operand;
   inputs[1] = g.Label(sw.default_branch());
-  for (size_t index = 0; index < sw.case_count(); ++index) {
-    const CaseInfo& c = sw.GetCase(index);
+  for (size_t index = 0; index < cases.size(); ++index) {
+    const CaseInfo& c = cases[index];
     inputs[index * 2 + 2 + 0] = g.TempImmediate(c.value);
     inputs[index * 2 + 2 + 1] = g.Label(c.branch);
   }
   Emit(kArchLookupSwitch, 0, nullptr, input_count, inputs, 0, nullptr);
 }
 
+void InstructionSelector::EmitBinarySearchSwitch(
+    const SwitchInfo& sw, InstructionOperand& value_operand) {
+  OperandGenerator g(this);
+  size_t input_count = 2 + sw.case_count() * 2;
+  DCHECK_LE(sw.case_count(), (std::numeric_limits<size_t>::max() - 2) / 2);
+  auto* inputs = zone()->NewArray<InstructionOperand>(input_count);
+  inputs[0] = value_operand;
+  inputs[1] = g.Label(sw.default_branch());
+  std::vector<CaseInfo> cases = sw.CasesSortedByValue();
+  std::stable_sort(cases.begin(), cases.end(),
+                   [](CaseInfo a, CaseInfo b) { return a.value < b.value; });
+  for (size_t index = 0; index < cases.size(); ++index) {
+    const CaseInfo& c = cases[index];
+    inputs[index * 2 + 2 + 0] = g.TempImmediate(c.value);
+    inputs[index * 2 + 2 + 1] = g.Label(c.branch);
+  }
+  Emit(kArchBinarySearchSwitch, 0, nullptr, input_count, inputs, 0, nullptr);
+}
 
 void InstructionSelector::VisitBitcastTaggedToWord(Node* node) {
   EmitIdentity(node);
@@ -2317,15 +2365,13 @@ void InstructionSelector::VisitF32x4UConvertI32x4(Node* node) {
 #endif  // !V8_TARGET_ARCH_ARM && !V8_TARGET_ARCH_ARM64 && !V8_TARGET_ARCH_MIPS
         // && !V8_TARGET_ARCH_MIPS64 && !V8_TARGET_ARCH_IA32
 
-#if !V8_TARGET_ARCH_X64
+#if !V8_TARGET_ARCH_X64 && !V8_TARGET_ARCH_ARM64
 void InstructionSelector::VisitWord64AtomicLoad(Node* node) { UNIMPLEMENTED(); }
 
 void InstructionSelector::VisitWord64AtomicStore(Node* node) {
   UNIMPLEMENTED();
 }
-#endif  // !V8_TARGET_ARCH_X64
 
-#if !V8_TARGET_ARCH_X64 && !V8_TARGET_ARCH_ARM64
 void InstructionSelector::VisitWord64AtomicAdd(Node* node) { UNIMPLEMENTED(); }
 
 void InstructionSelector::VisitWord64AtomicSub(Node* node) { UNIMPLEMENTED(); }
@@ -2335,9 +2381,7 @@ void InstructionSelector::VisitWord64AtomicAnd(Node* node) { UNIMPLEMENTED(); }
 void InstructionSelector::VisitWord64AtomicOr(Node* node) { UNIMPLEMENTED(); }
 
 void InstructionSelector::VisitWord64AtomicXor(Node* node) { UNIMPLEMENTED(); }
-#endif  // !V8_TARGET_ARCH_X64 && !V8_TARGET_ARCH_ARM64
 
-#if !V8_TARGET_ARCH_X64
 void InstructionSelector::VisitWord64AtomicExchange(Node* node) {
   UNIMPLEMENTED();
 }
@@ -2345,10 +2389,10 @@ void InstructionSelector::VisitWord64AtomicExchange(Node* node) {
 void InstructionSelector::VisitWord64AtomicCompareExchange(Node* node) {
   UNIMPLEMENTED();
 }
-#endif  // !V8_TARGET_ARCH_X64
+#endif  // !V8_TARGET_ARCH_X64 && !V8_TARGET_ARCH_ARM64
 
 #if !V8_TARGET_ARCH_ARM && !V8_TARGET_ARCH_ARM64 && !V8_TARGET_ARCH_MIPS && \
-    !V8_TARGET_ARCH_MIPS64
+    !V8_TARGET_ARCH_MIPS64 && !V8_TARGET_ARCH_IA32
 void InstructionSelector::VisitI32x4SConvertF32x4(Node* node) {
   UNIMPLEMENTED();
 }
@@ -2356,11 +2400,7 @@ void InstructionSelector::VisitI32x4SConvertF32x4(Node* node) {
 void InstructionSelector::VisitI32x4UConvertF32x4(Node* node) {
   UNIMPLEMENTED();
 }
-#endif  // !V8_TARGET_ARCH_ARM && !V8_TARGET_ARCH_ARM64 && !V8_TARGET_ARCH_MIPS
-        // && !V8_TARGET_ARCH_MIPS64
 
-#if !V8_TARGET_ARCH_ARM && !V8_TARGET_ARCH_ARM64 && !V8_TARGET_ARCH_MIPS && \
-    !V8_TARGET_ARCH_MIPS64
 void InstructionSelector::VisitI32x4SConvertI16x8Low(Node* node) {
   UNIMPLEMENTED();
 }
@@ -2385,23 +2425,18 @@ void InstructionSelector::VisitI16x8SConvertI8x16High(Node* node) {
   UNIMPLEMENTED();
 }
 
-void InstructionSelector::VisitI16x8SConvertI32x4(Node* node) {
+void InstructionSelector::VisitI16x8UConvertI8x16Low(Node* node) {
   UNIMPLEMENTED();
 }
-#endif  // !V8_TARGET_ARCH_ARM && !V8_TARGET_ARCH_ARM64 && !V8_TARGET_ARCH_MIPS
-        // && !V8_TARGET_ARCH_MIPS64
 
-#if !V8_TARGET_ARCH_ARM && !V8_TARGET_ARCH_ARM64 && !V8_TARGET_ARCH_MIPS && \
-    !V8_TARGET_ARCH_MIPS64
-void InstructionSelector::VisitI16x8UConvertI32x4(Node* node) {
+void InstructionSelector::VisitI16x8UConvertI8x16High(Node* node) {
   UNIMPLEMENTED();
 }
 
-void InstructionSelector::VisitI16x8UConvertI8x16Low(Node* node) {
+void InstructionSelector::VisitI16x8SConvertI32x4(Node* node) {
   UNIMPLEMENTED();
 }
-
-void InstructionSelector::VisitI16x8UConvertI8x16High(Node* node) {
+void InstructionSelector::VisitI16x8UConvertI32x4(Node* node) {
   UNIMPLEMENTED();
 }
 
@@ -2412,11 +2447,7 @@ void InstructionSelector::VisitI8x16SConvertI16x8(Node* node) {
 void InstructionSelector::VisitI8x16UConvertI16x8(Node* node) {
   UNIMPLEMENTED();
 }
-#endif  // !V8_TARGET_ARCH_ARM && !V8_TARGET_ARCH_ARM64 && !V8_TARGET_ARCH_MIPS
-        // && !V8_TARGET_ARCH_MIPS64
 
-#if !V8_TARGET_ARCH_ARM && !V8_TARGET_ARCH_ARM64 && !V8_TARGET_ARCH_MIPS && \
-    !V8_TARGET_ARCH_MIPS64 && !V8_TARGET_ARCH_IA32
 void InstructionSelector::VisitI8x16Shl(Node* node) { UNIMPLEMENTED(); }
 
 void InstructionSelector::VisitI8x16ShrS(Node* node) { UNIMPLEMENTED(); }
@@ -2426,11 +2457,7 @@ void InstructionSelector::VisitI8x16ShrU(Node* node) { UNIMPLEMENTED(); }
 void InstructionSelector::VisitI8x16Mul(Node* node) { UNIMPLEMENTED(); }
 
 void InstructionSelector::VisitS8x16Shuffle(Node* node) { UNIMPLEMENTED(); }
-#endif  // !V8_TARGET_ARCH_ARM && !V8_TARGET_ARCH_ARM64 && !V8_TARGET_ARCH_MIPS
-        // && !V8_TARGET_ARCH_MIPS64 && !V8_TARGET_ARCH_IA32
 
-#if !V8_TARGET_ARCH_ARM && !V8_TARGET_ARCH_ARM64 && !V8_TARGET_ARCH_MIPS && \
-    !V8_TARGET_ARCH_MIPS64
 void InstructionSelector::VisitS1x4AnyTrue(Node* node) { UNIMPLEMENTED(); }
 
 void InstructionSelector::VisitS1x4AllTrue(Node* node) { UNIMPLEMENTED(); }
@@ -2443,7 +2470,7 @@ void InstructionSelector::VisitS1x16AnyTrue(Node* node) { UNIMPLEMENTED(); }
 
 void InstructionSelector::VisitS1x16AllTrue(Node* node) { UNIMPLEMENTED(); }
 #endif  // !V8_TARGET_ARCH_ARM && !V8_TARGET_ARCH_ARM64 && !V8_TARGET_ARCH_MIPS
-        // && !V8_TARGET_ARCH_MIPS64
+        // && !V8_TARGET_ARCH_MIPS64 && !V8_TARGET_ARCH_IA32
 
 void InstructionSelector::VisitFinishRegion(Node* node) { EmitIdentity(node); }
 
@@ -2716,44 +2743,52 @@ void InstructionSelector::VisitReturn(Node* ret) {
 
 void InstructionSelector::VisitBranch(Node* branch, BasicBlock* tbranch,
                                       BasicBlock* fbranch) {
-  bool update_poison =
-      IsSafetyCheckOf(branch->op()) == IsSafetyCheck::kSafetyCheck &&
-      poisoning_enabled_ == PoisoningMitigationLevel::kOn;
-  FlagsContinuation cont =
-      FlagsContinuation::ForBranch(kNotEqual, tbranch, fbranch, update_poison);
-  VisitWordCompareZero(branch, branch->InputAt(0), &cont);
+  if (NeedsPoisoning(IsSafetyCheckOf(branch->op()))) {
+    FlagsContinuation cont =
+        FlagsContinuation::ForBranchAndPoison(kNotEqual, tbranch, fbranch);
+    VisitWordCompareZero(branch, branch->InputAt(0), &cont);
+  } else {
+    FlagsContinuation cont =
+        FlagsContinuation::ForBranch(kNotEqual, tbranch, fbranch);
+    VisitWordCompareZero(branch, branch->InputAt(0), &cont);
+  }
 }
 
 void InstructionSelector::VisitDeoptimizeIf(Node* node) {
   DeoptimizeParameters p = DeoptimizeParametersOf(node->op());
-  bool update_poison = p.is_safety_check() == IsSafetyCheck::kSafetyCheck &&
-                       poisoning_enabled_ == PoisoningMitigationLevel::kOn;
-  FlagsContinuation cont = FlagsContinuation::ForDeoptimize(
-      kNotEqual, p.kind(), p.reason(), p.feedback(), node->InputAt(1),
-      update_poison);
-  VisitWordCompareZero(node, node->InputAt(0), &cont);
+  if (NeedsPoisoning(p.is_safety_check())) {
+    FlagsContinuation cont = FlagsContinuation::ForDeoptimizeAndPoison(
+        kNotEqual, p.kind(), p.reason(), p.feedback(), node->InputAt(1));
+    VisitWordCompareZero(node, node->InputAt(0), &cont);
+  } else {
+    FlagsContinuation cont = FlagsContinuation::ForDeoptimize(
+        kNotEqual, p.kind(), p.reason(), p.feedback(), node->InputAt(1));
+    VisitWordCompareZero(node, node->InputAt(0), &cont);
+  }
 }
 
 void InstructionSelector::VisitDeoptimizeUnless(Node* node) {
   DeoptimizeParameters p = DeoptimizeParametersOf(node->op());
-  bool update_poison = p.is_safety_check() == IsSafetyCheck::kSafetyCheck &&
-                       poisoning_enabled_ == PoisoningMitigationLevel::kOn;
-  FlagsContinuation cont = FlagsContinuation::ForDeoptimize(
-      kEqual, p.kind(), p.reason(), p.feedback(), node->InputAt(1),
-      update_poison);
-  VisitWordCompareZero(node, node->InputAt(0), &cont);
+  if (NeedsPoisoning(p.is_safety_check())) {
+    FlagsContinuation cont = FlagsContinuation::ForDeoptimizeAndPoison(
+        kEqual, p.kind(), p.reason(), p.feedback(), node->InputAt(1));
+    VisitWordCompareZero(node, node->InputAt(0), &cont);
+  } else {
+    FlagsContinuation cont = FlagsContinuation::ForDeoptimize(
+        kEqual, p.kind(), p.reason(), p.feedback(), node->InputAt(1));
+    VisitWordCompareZero(node, node->InputAt(0), &cont);
+  }
 }
 
-void InstructionSelector::VisitTrapIf(Node* node, Runtime::FunctionId func_id) {
+void InstructionSelector::VisitTrapIf(Node* node, TrapId trap_id) {
   FlagsContinuation cont =
-      FlagsContinuation::ForTrap(kNotEqual, func_id, node->InputAt(1));
+      FlagsContinuation::ForTrap(kNotEqual, trap_id, node->InputAt(1));
   VisitWordCompareZero(node, node->InputAt(0), &cont);
 }
 
-void InstructionSelector::VisitTrapUnless(Node* node,
-                                          Runtime::FunctionId func_id) {
+void InstructionSelector::VisitTrapUnless(Node* node, TrapId trap_id) {
   FlagsContinuation cont =
-      FlagsContinuation::ForTrap(kEqual, func_id, node->InputAt(1));
+      FlagsContinuation::ForTrap(kEqual, trap_id, node->InputAt(1));
   VisitWordCompareZero(node, node->InputAt(0), &cont);
 }
 
@@ -2849,6 +2884,84 @@ FrameStateDescriptor* InstructionSelector::GetFrameStateDescriptor(
       state_info.shared_info(), outer_state);
 }
 
+// static
+void InstructionSelector::CanonicalizeShuffle(bool inputs_equal,
+                                              uint8_t* shuffle,
+                                              bool* needs_swap,
+                                              bool* is_swizzle) {
+  *needs_swap = false;
+  // Inputs equal, then it's a swizzle.
+  if (inputs_equal) {
+    *is_swizzle = true;
+  } else {
+    // Inputs are distinct; check that both are required.
+    bool src0_is_used = false;
+    bool src1_is_used = false;
+    for (int i = 0; i < kSimd128Size; ++i) {
+      if (shuffle[i] < kSimd128Size) {
+        src0_is_used = true;
+      } else {
+        src1_is_used = true;
+      }
+    }
+    if (src0_is_used && !src1_is_used) {
+      *is_swizzle = true;
+    } else if (src1_is_used && !src0_is_used) {
+      *needs_swap = true;
+      *is_swizzle = true;
+    } else {
+      *is_swizzle = false;
+      // Canonicalize general 2 input shuffles so that the first input lanes are
+      // encountered first. This makes architectural shuffle pattern matching
+      // easier, since we only need to consider 1 input ordering instead of 2.
+      if (shuffle[0] >= kSimd128Size) {
+        // The second operand is used first. Swap inputs and adjust the shuffle.
+        *needs_swap = true;
+        for (int i = 0; i < kSimd128Size; ++i) {
+          shuffle[i] ^= kSimd128Size;
+        }
+      }
+    }
+  }
+  if (*is_swizzle) {
+    for (int i = 0; i < kSimd128Size; ++i) shuffle[i] &= kSimd128Size - 1;
+  }
+}
+
+void InstructionSelector::CanonicalizeShuffle(Node* node, uint8_t* shuffle,
+                                              bool* is_swizzle) {
+  // Get raw shuffle indices.
+  memcpy(shuffle, OpParameter<uint8_t*>(node->op()), kSimd128Size);
+  bool needs_swap;
+  bool inputs_equal = GetVirtualRegister(node->InputAt(0)) ==
+                      GetVirtualRegister(node->InputAt(1));
+  CanonicalizeShuffle(inputs_equal, shuffle, &needs_swap, is_swizzle);
+  if (needs_swap) {
+    SwapShuffleInputs(node);
+  }
+  // Duplicate the first input; for some shuffles on some architectures, it's
+  // easiest to implement a swizzle as a shuffle so it might be used.
+  if (*is_swizzle) {
+    node->ReplaceInput(1, node->InputAt(0));
+  }
+}
+
+// static
+void InstructionSelector::SwapShuffleInputs(Node* node) {
+  Node* input0 = node->InputAt(0);
+  Node* input1 = node->InputAt(1);
+  node->ReplaceInput(0, input1);
+  node->ReplaceInput(1, input0);
+}
+
+// static
+bool InstructionSelector::TryMatchIdentity(const uint8_t* shuffle) {
+  for (int i = 0; i < kSimd128Size; ++i) {
+    if (shuffle[i] != i) return false;
+  }
+  return true;
+}
+
 // static
 bool InstructionSelector::TryMatch32x4Shuffle(const uint8_t* shuffle,
                                               uint8_t* shuffle32x4) {
@@ -2863,66 +2976,67 @@ bool InstructionSelector::TryMatch32x4Shuffle(const uint8_t* shuffle,
 }
 
 // static
-bool InstructionSelector::TryMatchConcat(const uint8_t* shuffle, uint8_t mask,
-                                         uint8_t* vext) {
-  uint8_t start = shuffle[0];
-  int i = 1;
-  for (; i < 16 - start; ++i) {
-    if ((shuffle[i] & mask) != ((shuffle[i - 1] + 1) & mask)) return false;
-  }
-  uint8_t wrap = 16;
-  for (; i < 16; ++i, ++wrap) {
-    if ((shuffle[i] & mask) != (wrap & mask)) return false;
+bool InstructionSelector::TryMatch16x8Shuffle(const uint8_t* shuffle,
+                                              uint8_t* shuffle16x8) {
+  for (int i = 0; i < 8; ++i) {
+    if (shuffle[i * 2] % 2 != 0) return false;
+    for (int j = 1; j < 2; ++j) {
+      if (shuffle[i * 2 + j] - shuffle[i * 2 + j - 1] != 1) return false;
+    }
+    shuffle16x8[i] = shuffle[i * 2] / 2;
   }
-  *vext = start;
   return true;
 }
 
-// Canonicalize shuffles to make pattern matching simpler. Returns a mask that
-// will ignore the high bit of indices in some cases.
-uint8_t InstructionSelector::CanonicalizeShuffle(Node* node) {
-  static const int kMaxLaneIndex = 15;
-  static const int kMaxShuffleIndex = 31;
-
-  const uint8_t* shuffle = OpParameter<uint8_t*>(node->op());
-  uint8_t mask = kMaxShuffleIndex;
-  // If shuffle is unary, set 'mask' to ignore the high bit of the indices.
-  // Replace any unused source with the other.
-  if (GetVirtualRegister(node->InputAt(0)) ==
-      GetVirtualRegister(node->InputAt(1))) {
-    // unary, src0 == src1.
-    mask = kMaxLaneIndex;
-  } else {
-    bool src0_is_used = false;
-    bool src1_is_used = false;
-    for (int i = 0; i < 16; ++i) {
-      if (shuffle[i] < 16) {
-        src0_is_used = true;
-      } else {
-        src1_is_used = true;
-      }
-    }
-    if (src0_is_used && !src1_is_used) {
-      node->ReplaceInput(1, node->InputAt(0));
-      mask = kMaxLaneIndex;
-    } else if (src1_is_used && !src0_is_used) {
-      node->ReplaceInput(0, node->InputAt(1));
-      mask = kMaxLaneIndex;
+// static
+bool InstructionSelector::TryMatchConcat(const uint8_t* shuffle,
+                                         uint8_t* offset) {
+  // Don't match the identity shuffle (e.g. [0 1 2 ... 15]).
+  uint8_t start = shuffle[0];
+  if (start == 0) return false;
+  DCHECK_GT(kSimd128Size, start);  // The shuffle should be canonicalized.
+  // A concatenation is a series of consecutive indices, with at most one jump
+  // in the middle from the last lane to the first.
+  for (int i = 1; i < kSimd128Size; ++i) {
+    if ((shuffle[i]) != ((shuffle[i - 1] + 1))) {
+      if (shuffle[i - 1] != 15) return false;
+      if (shuffle[i] % kSimd128Size != 0) return false;
     }
   }
-  return mask;
+  *offset = start;
+  return true;
+}
+
+// static
+bool InstructionSelector::TryMatchBlend(const uint8_t* shuffle) {
+  for (int i = 0; i < 16; ++i) {
+    if ((shuffle[i] & 0xF) != i) return false;
+  }
+  return true;
 }
 
 // static
-int32_t InstructionSelector::Pack4Lanes(const uint8_t* shuffle, uint8_t mask) {
+int32_t InstructionSelector::Pack4Lanes(const uint8_t* shuffle) {
   int32_t result = 0;
   for (int i = 3; i >= 0; --i) {
     result <<= 8;
-    result |= shuffle[i] & mask;
+    result |= shuffle[i];
   }
   return result;
 }
 
+bool InstructionSelector::NeedsPoisoning(IsSafetyCheck safety_check) const {
+  switch (poisoning_level_) {
+    case PoisoningMitigationLevel::kDontPoison:
+      return false;
+    case PoisoningMitigationLevel::kPoisonAll:
+      return safety_check != IsSafetyCheck::kNoSafetyCheck;
+    case PoisoningMitigationLevel::kPoisonCriticalOnly:
+      return safety_check == IsSafetyCheck::kCriticalSafetyCheck;
+  }
+  UNREACHABLE();
+}
+
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/src/compiler/instruction-selector.h b/deps/v8/src/compiler/instruction-selector.h
index fc597b5843cdae..39d0c01ee9ac76 100644
--- a/deps/v8/src/compiler/instruction-selector.h
+++ b/deps/v8/src/compiler/instruction-selector.h
@@ -41,10 +41,8 @@ class FlagsContinuation final {
   // blocks.
   static FlagsContinuation ForBranch(FlagsCondition condition,
                                      BasicBlock* true_block,
-                                     BasicBlock* false_block,
-                                     bool update_poison) {
-    FlagsMode mode = update_poison ? kFlags_branch_and_poison : kFlags_branch;
-    return FlagsContinuation(mode, condition, true_block, false_block);
+                                     BasicBlock* false_block) {
+    return FlagsContinuation(kFlags_branch, condition, true_block, false_block);
   }
 
   static FlagsContinuation ForBranchAndPoison(FlagsCondition condition,
@@ -55,13 +53,21 @@ class FlagsContinuation final {
   }
 
   // Creates a new flags continuation for an eager deoptimization exit.
-  static FlagsContinuation ForDeoptimize(
+  static FlagsContinuation ForDeoptimize(FlagsCondition condition,
+                                         DeoptimizeKind kind,
+                                         DeoptimizeReason reason,
+                                         VectorSlotPair const& feedback,
+                                         Node* frame_state) {
+    return FlagsContinuation(kFlags_deoptimize, condition, kind, reason,
+                             feedback, frame_state);
+  }
+
+  // Creates a new flags continuation for an eager deoptimization exit.
+  static FlagsContinuation ForDeoptimizeAndPoison(
       FlagsCondition condition, DeoptimizeKind kind, DeoptimizeReason reason,
-      VectorSlotPair const& feedback, Node* frame_state, bool update_poison) {
-    FlagsMode mode =
-        update_poison ? kFlags_deoptimize_and_poison : kFlags_deoptimize;
-    return FlagsContinuation(mode, condition, kind, reason, feedback,
-                             frame_state);
+      VectorSlotPair const& feedback, Node* frame_state) {
+    return FlagsContinuation(kFlags_deoptimize_and_poison, condition, kind,
+                             reason, feedback, frame_state);
   }
 
   // Creates a new flags continuation for a boolean value.
@@ -70,8 +76,8 @@ class FlagsContinuation final {
   }
 
   // Creates a new flags continuation for a wasm trap.
-  static FlagsContinuation ForTrap(FlagsCondition condition,
-                                   Runtime::FunctionId trap_id, Node* result) {
+  static FlagsContinuation ForTrap(FlagsCondition condition, TrapId trap_id,
+                                   Node* result) {
     return FlagsContinuation(condition, trap_id, result);
   }
 
@@ -112,7 +118,7 @@ class FlagsContinuation final {
     DCHECK(IsSet());
     return frame_state_or_result_;
   }
-  Runtime::FunctionId trap_id() const {
+  TrapId trap_id() const {
     DCHECK(IsTrap());
     return trap_id_;
   }
@@ -204,8 +210,7 @@ class FlagsContinuation final {
     DCHECK_NOT_NULL(result);
   }
 
-  FlagsContinuation(FlagsCondition condition, Runtime::FunctionId trap_id,
-                    Node* result)
+  FlagsContinuation(FlagsCondition condition, TrapId trap_id, Node* result)
       : mode_(kFlags_trap),
         condition_(condition),
         frame_state_or_result_(result),
@@ -222,7 +227,7 @@ class FlagsContinuation final {
                                  // or mode_ == kFlags_set.
   BasicBlock* true_block_;       // Only valid if mode_ == kFlags_branch*.
   BasicBlock* false_block_;      // Only valid if mode_ == kFlags_branch*.
-  Runtime::FunctionId trap_id_;  // Only valid if mode_ == kFlags_trap.
+  TrapId trap_id_;               // Only valid if mode_ == kFlags_trap.
 };
 
 // This struct connects nodes of parameters which are going to be pushed on the
@@ -246,11 +251,15 @@ class V8_EXPORT_PRIVATE InstructionSelector final {
 
   enum SourcePositionMode { kCallSourcePositions, kAllSourcePositions };
   enum EnableScheduling { kDisableScheduling, kEnableScheduling };
-  enum EnableSerialization { kDisableSerialization, kEnableSerialization };
+  enum EnableRootsRelativeAddressing {
+    kDisableRootsRelativeAddressing,
+    kEnableRootsRelativeAddressing
+  };
   enum EnableSwitchJumpTable {
     kDisableSwitchJumpTable,
     kEnableSwitchJumpTable
   };
+  enum EnableTraceTurboJson { kDisableTraceTurboJson, kEnableTraceTurboJson };
 
   InstructionSelector(
       Zone* zone, size_t node_count, Linkage* linkage,
@@ -262,9 +271,11 @@ class V8_EXPORT_PRIVATE InstructionSelector final {
       EnableScheduling enable_scheduling = FLAG_turbo_instruction_scheduling
                                                ? kEnableScheduling
                                                : kDisableScheduling,
-      EnableSerialization enable_serialization = kDisableSerialization,
-      PoisoningMitigationLevel poisoning_enabled =
-          PoisoningMitigationLevel::kOff);
+      EnableRootsRelativeAddressing enable_roots_relative_addressing =
+          kDisableRootsRelativeAddressing,
+      PoisoningMitigationLevel poisoning_level =
+          PoisoningMitigationLevel::kDontPoison,
+      EnableTraceTurboJson trace_turbo = kDisableTraceTurboJson);
 
   // Visit code for the entire graph with the included schedule.
   bool SelectInstructions();
@@ -371,6 +382,8 @@ class V8_EXPORT_PRIVATE InstructionSelector final {
 
   static MachineOperatorBuilder::AlignmentRequirements AlignmentRequirements();
 
+  bool NeedsPoisoning(IsSafetyCheck safety_check) const;
+
   // ===========================================================================
   // ============ Architecture-independent graph covering methods. =============
   // ===========================================================================
@@ -424,14 +437,47 @@ class V8_EXPORT_PRIVATE InstructionSelector final {
   const std::map<NodeId, int> GetVirtualRegistersForTesting() const;
 
   // Check if we can generate loads and stores of ExternalConstants relative
-  // to the roots register, i.e. if both a root register is available for this
-  // compilation unit and the serializer is disabled.
+  // to the roots register.
   bool CanAddressRelativeToRootsRegister() const;
   // Check if we can use the roots register to access GC roots.
   bool CanUseRootsRegister() const;
 
   Isolate* isolate() const { return sequence()->isolate(); }
 
+  const ZoneVector<std::pair<int, int>>& instr_origins() const {
+    return instr_origins_;
+  }
+
+  // Expose these SIMD helper functions for testing.
+  static void CanonicalizeShuffleForTesting(bool inputs_equal, uint8_t* shuffle,
+                                            bool* needs_swap,
+                                            bool* is_swizzle) {
+    CanonicalizeShuffle(inputs_equal, shuffle, needs_swap, is_swizzle);
+  }
+
+  static bool TryMatchIdentityForTesting(const uint8_t* shuffle) {
+    return TryMatchIdentity(shuffle);
+  }
+  template <int LANES>
+  static bool TryMatchDupForTesting(const uint8_t* shuffle, int* index) {
+    return TryMatchDup<LANES>(shuffle, index);
+  }
+  static bool TryMatch32x4ShuffleForTesting(const uint8_t* shuffle,
+                                            uint8_t* shuffle32x4) {
+    return TryMatch32x4Shuffle(shuffle, shuffle32x4);
+  }
+  static bool TryMatch16x8ShuffleForTesting(const uint8_t* shuffle,
+                                            uint8_t* shuffle16x8) {
+    return TryMatch16x8Shuffle(shuffle, shuffle16x8);
+  }
+  static bool TryMatchConcatForTesting(const uint8_t* shuffle,
+                                       uint8_t* offset) {
+    return TryMatchConcat(shuffle, offset);
+  }
+  static bool TryMatchBlendForTesting(const uint8_t* shuffle) {
+    return TryMatchBlend(shuffle);
+  }
+
  private:
   friend class OperandGenerator;
 
@@ -448,6 +494,8 @@ class V8_EXPORT_PRIVATE InstructionSelector final {
   void EmitTableSwitch(const SwitchInfo& sw, InstructionOperand& index_operand);
   void EmitLookupSwitch(const SwitchInfo& sw,
                         InstructionOperand& value_operand);
+  void EmitBinarySearchSwitch(const SwitchInfo& sw,
+                              InstructionOperand& value_operand);
 
   void TryRename(InstructionOperand* op);
   int GetRename(int virtual_register);
@@ -559,8 +607,8 @@ class V8_EXPORT_PRIVATE InstructionSelector final {
                                          BasicBlock* handler = nullptr);
   void VisitDeoptimizeIf(Node* node);
   void VisitDeoptimizeUnless(Node* node);
-  void VisitTrapIf(Node* node, Runtime::FunctionId func_id);
-  void VisitTrapUnless(Node* node, Runtime::FunctionId func_id);
+  void VisitTrapIf(Node* node, TrapId trap_id);
+  void VisitTrapUnless(Node* node, TrapId trap_id);
   void VisitTailCall(Node* call);
   void VisitGoto(BasicBlock* target);
   void VisitBranch(Node* input, BasicBlock* tbranch, BasicBlock* fbranch);
@@ -575,6 +623,8 @@ class V8_EXPORT_PRIVATE InstructionSelector final {
 
   void VisitWordCompareZero(Node* user, Node* value, FlagsContinuation* cont);
 
+  void EmitWordPoisonOnSpeculation(Node* node);
+
   void EmitPrepareArguments(ZoneVector<compiler::PushParameter>* arguments,
                             const CallDescriptor* call_descriptor, Node* node);
   void EmitPrepareResults(ZoneVector<compiler::PushParameter>* results,
@@ -587,6 +637,27 @@ class V8_EXPORT_PRIVATE InstructionSelector final {
   // ============= Vector instruction (SIMD) helper fns. =======================
   // ===========================================================================
 
+  // Converts a shuffle into canonical form, meaning that the first lane index
+  // is in the range [0 .. 15]. Set |inputs_equal| true if this is an explicit
+  // swizzle. Returns canonicalized |shuffle|, |needs_swap|, and |is_swizzle|.
+  // If |needs_swap| is true, inputs must be swapped. If |is_swizzle| is true,
+  // the second input can be ignored.
+  static void CanonicalizeShuffle(bool inputs_equal, uint8_t* shuffle,
+                                  bool* needs_swap, bool* is_swizzle);
+
+  // Canonicalize shuffles to make pattern matching simpler. Returns the shuffle
+  // indices, and a boolean indicating if the shuffle is a swizzle (one input).
+  void CanonicalizeShuffle(Node* node, uint8_t* shuffle, bool* is_swizzle);
+
+  // Swaps the two first input operands of the node, to help match shuffles
+  // to specific architectural instructions.
+  void SwapShuffleInputs(Node* node);
+
+  // Tries to match an 8x16 byte shuffle to the identity shuffle, which is
+  // [0 1 ... 15]. This should be called after canonicalizing the shuffle, so
+  // the second identity shuffle, [16 17 .. 31] is converted to the first one.
+  static bool TryMatchIdentity(const uint8_t* shuffle);
+
   // Tries to match a byte shuffle to a scalar splat operation. Returns the
   // index of the lane if successful.
   template <int LANES>
@@ -611,22 +682,30 @@ class V8_EXPORT_PRIVATE InstructionSelector final {
     return true;
   }
 
-  // Tries to match 8x16 byte shuffle to an equivalent 32x4 word shuffle. If
-  // successful, it writes the 32x4 shuffle word indices.
+  // Tries to match an 8x16 byte shuffle to an equivalent 32x4 shuffle. If
+  // successful, it writes the 32x4 shuffle word indices. E.g.
+  // [0 1 2 3 8 9 10 11 4 5 6 7 12 13 14 15] == [0 2 1 3]
   static bool TryMatch32x4Shuffle(const uint8_t* shuffle, uint8_t* shuffle32x4);
 
-  // Tries to match a byte shuffle to a concatenate operation. If successful,
-  // it writes the byte offset.
-  static bool TryMatchConcat(const uint8_t* shuffle, uint8_t mask,
-                             uint8_t* offset);
+  // Tries to match an 8x16 byte shuffle to an equivalent 16x8 shuffle. If
+  // successful, it writes the 16x8 shuffle word indices. E.g.
+  // [0 1 8 9 2 3 10 11 4 5 12 13 6 7 14 15] == [0 4 1 5 2 6 3 7]
+  static bool TryMatch16x8Shuffle(const uint8_t* shuffle, uint8_t* shuffle16x8);
+
+  // Tries to match a byte shuffle to a concatenate operation, formed by taking
+  // 16 bytes from the 32 byte concatenation of the inputs.  If successful, it
+  // writes the byte offset. E.g. [4 5 6 7 .. 16 17 18 19] concatenates both
+  // source vectors with offset 4. The shuffle should be canonicalized.
+  static bool TryMatchConcat(const uint8_t* shuffle, uint8_t* offset);
 
-  // Packs 4 bytes of shuffle into a 32 bit immediate, using a mask from
-  // CanonicalizeShuffle to convert unary shuffles.
-  static int32_t Pack4Lanes(const uint8_t* shuffle, uint8_t mask);
+  // Tries to match a byte shuffle to a blend operation, which is a shuffle
+  // where no lanes change position. E.g. [0 9 2 11 .. 14 31] interleaves the
+  // even lanes of the first source with the odd lanes of the second.  The
+  // shuffle should be canonicalized.
+  static bool TryMatchBlend(const uint8_t* shuffle);
 
-  // Canonicalize shuffles to make pattern matching simpler. Returns a mask that
-  // will ignore the high bit of indices if shuffle is unary.
-  uint8_t CanonicalizeShuffle(Node* node);
+  // Packs 4 bytes of shuffle into a 32 bit immediate.
+  static int32_t Pack4Lanes(const uint8_t* shuffle);
 
   // ===========================================================================
 
@@ -643,9 +722,11 @@ class V8_EXPORT_PRIVATE InstructionSelector final {
 
   void MarkPairProjectionsAsWord32(Node* node);
   bool IsSourcePositionUsed(Node* node);
-  void VisitAtomicBinaryOperation(Node* node, ArchOpcode int8_op,
-                                  ArchOpcode uint8_op, ArchOpcode int16_op,
-                                  ArchOpcode uint16_op, ArchOpcode word32_op);
+  void VisitWord32AtomicBinaryOperation(Node* node, ArchOpcode int8_op,
+                                        ArchOpcode uint8_op,
+                                        ArchOpcode int16_op,
+                                        ArchOpcode uint16_op,
+                                        ArchOpcode word32_op);
   void VisitWord64AtomicBinaryOperation(Node* node, ArchOpcode uint8_op,
                                         ArchOpcode uint16_op,
                                         ArchOpcode uint32_op,
@@ -671,12 +752,14 @@ class V8_EXPORT_PRIVATE InstructionSelector final {
   IntVector virtual_register_rename_;
   InstructionScheduler* scheduler_;
   EnableScheduling enable_scheduling_;
-  EnableSerialization enable_serialization_;
+  EnableRootsRelativeAddressing enable_roots_relative_addressing_;
   EnableSwitchJumpTable enable_switch_jump_table_;
 
-  PoisoningMitigationLevel poisoning_enabled_;
+  PoisoningMitigationLevel poisoning_level_;
   Frame* frame_;
   bool instruction_selection_failed_;
+  ZoneVector<std::pair<int, int>> instr_origins_;
+  EnableTraceTurboJson trace_turbo_;
 };
 
 }  // namespace compiler
diff --git a/deps/v8/src/compiler/instruction.cc b/deps/v8/src/compiler/instruction.cc
index 68f0ae2a9c0441..83ed28fb537463 100644
--- a/deps/v8/src/compiler/instruction.cc
+++ b/deps/v8/src/compiler/instruction.cc
@@ -4,6 +4,8 @@
 
 #include "src/compiler/instruction.h"
 
+#include <iomanip>
+
 #include "src/compiler/common-operator.h"
 #include "src/compiler/graph.h"
 #include "src/compiler/schedule.h"
@@ -117,11 +119,10 @@ bool LocationOperand::IsCompatible(LocationOperand* op) {
 }
 
 void InstructionOperand::Print(const RegisterConfiguration* config) const {
-  OFStream os(stdout);
   PrintableInstructionOperand wrapper;
   wrapper.register_configuration_ = config;
   wrapper.op_ = *this;
-  os << wrapper << std::endl;
+  StdoutStream{} << wrapper << std::endl;
 }
 
 void InstructionOperand::Print() const { Print(GetRegConfig()); }
@@ -183,7 +184,8 @@ std::ostream& operator<<(std::ostream& os,
         os << "[fp_stack:" << allocated.index();
       } else if (op.IsRegister()) {
         os << "["
-           << GetRegConfig()->GetGeneralRegisterName(allocated.register_code())
+           << GetRegConfig()->GetGeneralOrSpecialRegisterName(
+                  allocated.register_code())
            << "|R";
       } else if (op.IsDoubleRegister()) {
         os << "["
@@ -249,7 +251,7 @@ std::ostream& operator<<(std::ostream& os,
 }
 
 void MoveOperands::Print(const RegisterConfiguration* config) const {
-  OFStream os(stdout);
+  StdoutStream os;
   PrintableInstructionOperand wrapper;
   wrapper.register_configuration_ = config;
   wrapper.op_ = destination();
@@ -367,11 +369,10 @@ bool Instruction::AreMovesRedundant() const {
 }
 
 void Instruction::Print(const RegisterConfiguration* config) const {
-  OFStream os(stdout);
   PrintableInstruction wrapper;
   wrapper.instr_ = this;
   wrapper.register_configuration_ = config;
-  os << wrapper << std::endl;
+  StdoutStream{} << wrapper << std::endl;
 }
 
 void Instruction::Print() const { Print(GetRegConfig()); }
@@ -603,8 +604,7 @@ std::ostream& operator<<(std::ostream& os, const Constant& constant) {
     case Constant::kFloat64:
       return os << constant.ToFloat64().value();
     case Constant::kExternalReference:
-      return os << static_cast<const void*>(
-                       constant.ToExternalReference().address());
+      return os << constant.ToExternalReference().address();
     case Constant::kHeapObject:
       return os << Brief(*constant.ToHeapObject());
     case Constant::kRpoNumber:
@@ -692,7 +692,7 @@ static InstructionBlock* InstructionBlockFor(Zone* zone,
 }
 
 std::ostream& operator<<(std::ostream& os,
-                         PrintableInstructionBlock& printable_block) {
+                         const PrintableInstructionBlock& printable_block) {
   const InstructionBlock* block = printable_block.block_;
   const RegisterConfiguration* config = printable_block.register_configuration_;
   const InstructionSequence* code = printable_block.code_;
@@ -725,17 +725,15 @@ std::ostream& operator<<(std::ostream& os,
     os << std::endl;
   }
 
-  ScopedVector<char> buf(32);
   PrintableInstruction printable_instr;
   printable_instr.register_configuration_ = config;
   for (int j = block->first_instruction_index();
        j <= block->last_instruction_index(); j++) {
-    // TODO(svenpanne) Add some basic formatting to our streams.
-    SNPrintF(buf, "%5d", j);
     printable_instr.instr_ = code->InstructionAt(j);
-    os << "   " << buf.start() << ": " << printable_instr << std::endl;
+    os << "   " << std::setw(5) << j << ": " << printable_instr << std::endl;
   }
 
+  os << " successors:";
   for (RpoNumber succ : block->successors()) {
     os << " B" << succ.ToInt();
   }
@@ -870,12 +868,8 @@ void InstructionSequence::StartBlock(RpoNumber rpo) {
 void InstructionSequence::EndBlock(RpoNumber rpo) {
   int end = static_cast<int>(instructions_.size());
   DCHECK_EQ(current_block_->rpo_number(), rpo);
-  if (current_block_->code_start() == end) {  // Empty block.  Insert a nop.
-    AddInstruction(Instruction::New(zone(), kArchNop));
-    end = static_cast<int>(instructions_.size());
-  }
-  DCHECK(current_block_->code_start() >= 0 &&
-         current_block_->code_start() < end);
+  CHECK(current_block_->code_start() >= 0 &&
+        current_block_->code_start() < end);
   current_block_->set_code_end(end);
   current_block_ = nullptr;
 }
@@ -991,23 +985,21 @@ void InstructionSequence::SetSourcePosition(const Instruction* instr,
 }
 
 void InstructionSequence::Print(const RegisterConfiguration* config) const {
-  OFStream os(stdout);
   PrintableInstructionSequence wrapper;
   wrapper.register_configuration_ = config;
   wrapper.sequence_ = this;
-  os << wrapper << std::endl;
+  StdoutStream{} << wrapper << std::endl;
 }
 
 void InstructionSequence::Print() const { Print(GetRegConfig()); }
 
 void InstructionSequence::PrintBlock(const RegisterConfiguration* config,
                                      int block_id) const {
-  OFStream os(stdout);
   RpoNumber rpo = RpoNumber::FromInt(block_id);
   const InstructionBlock* block = InstructionBlockAt(rpo);
   CHECK(block->rpo_number() == rpo);
   PrintableInstructionBlock printable_block = {config, block, this};
-  os << printable_block << std::endl;
+  StdoutStream{} << printable_block << std::endl;
 }
 
 void InstructionSequence::PrintBlock(int block_id) const {
diff --git a/deps/v8/src/compiler/int64-lowering.cc b/deps/v8/src/compiler/int64-lowering.cc
index 824871587677a4..410e78a30d246e 100644
--- a/deps/v8/src/compiler/int64-lowering.cc
+++ b/deps/v8/src/compiler/int64-lowering.cc
@@ -13,6 +13,8 @@
 #include "src/compiler/node-properties.h"
 #include "src/compiler/node.h"
 #include "src/compiler/wasm-compiler.h"
+// TODO(wasm): Remove this include.
+#include "src/wasm/wasm-linkage.h"
 #include "src/zone/zone.h"
 
 namespace v8 {
@@ -124,12 +126,6 @@ int Int64Lowering::GetParameterCountAfterLowering(
       signature, static_cast<int>(signature->parameter_count()));
 }
 
-// static
-bool Int64Lowering::IsI64AsTwoParameters(MachineOperatorBuilder* machine,
-                                         MachineRepresentation type) {
-  return machine->Is32() && type == MachineRepresentation::kWord64;
-}
-
 void Int64Lowering::GetIndexNodes(Node* index, Node*& index_low,
                                   Node*& index_high) {
   if (HasReplacementLow(index)) {
@@ -282,7 +278,7 @@ void Int64Lowering::LowerNode(Node* node) {
         int old_index = ParameterIndexOf(node->op());
         // TODO(wasm): Make this part not wasm specific.
         // Prevent special lowering of the instance parameter.
-        if (old_index == kWasmInstanceParameterIndex) {
+        if (old_index == wasm::kWasmInstanceParameterIndex) {
           DefaultLowering(node);
           break;
         }
@@ -595,6 +591,7 @@ void Int64Lowering::LowerNode(Node* node) {
                       machine()->Uint32LessThanOrEqual());
       break;
     }
+    case IrOpcode::kSignExtendWord32ToInt64:
     case IrOpcode::kChangeInt32ToInt64: {
       DCHECK_EQ(1, node->InputCount());
       Node* input = node->InputAt(0);
@@ -864,6 +861,40 @@ void Int64Lowering::LowerNode(Node* node) {
                                    GetReplacementLow(input)));
       break;
     }
+    case IrOpcode::kSignExtendWord8ToInt64: {
+      DCHECK_EQ(1, node->InputCount());
+      Node* input = node->InputAt(0);
+      if (HasReplacementLow(input)) {
+        input = GetReplacementLow(input);
+      }
+      // Sign extend low node to Int32
+      input = graph()->NewNode(machine()->SignExtendWord8ToInt32(), input);
+
+      // We use SAR to preserve the sign in the high word.
+      ReplaceNode(
+          node, input,
+          graph()->NewNode(machine()->Word32Sar(), input,
+                           graph()->NewNode(common()->Int32Constant(31))));
+      node->NullAllInputs();
+      break;
+    }
+    case IrOpcode::kSignExtendWord16ToInt64: {
+      DCHECK_EQ(1, node->InputCount());
+      Node* input = node->InputAt(0);
+      if (HasReplacementLow(input)) {
+        input = GetReplacementLow(input);
+      }
+      // Sign extend low node to Int32
+      input = graph()->NewNode(machine()->SignExtendWord16ToInt32(), input);
+
+      // We use SAR to preserve the sign in the high word.
+      ReplaceNode(
+          node, input,
+          graph()->NewNode(machine()->Word32Sar(), input,
+                           graph()->NewNode(common()->Int32Constant(31))));
+      node->NullAllInputs();
+      break;
+    }
 
     default: { DefaultLowering(node); }
   }
diff --git a/deps/v8/src/compiler/int64-lowering.h b/deps/v8/src/compiler/int64-lowering.h
index c14dc95d8b61e4..6109cd58472f62 100644
--- a/deps/v8/src/compiler/int64-lowering.h
+++ b/deps/v8/src/compiler/int64-lowering.h
@@ -14,6 +14,10 @@
 
 namespace v8 {
 namespace internal {
+
+template <typename T>
+class Signature;
+
 namespace compiler {
 
 class V8_EXPORT_PRIVATE Int64Lowering {
@@ -27,11 +31,6 @@ class V8_EXPORT_PRIVATE Int64Lowering {
   static int GetParameterCountAfterLowering(
       Signature<MachineRepresentation>* signature);
 
-  // Determine whether the given type is i64 and has to be passed via two
-  // parameters on the given machine.
-  static bool IsI64AsTwoParameters(MachineOperatorBuilder* machine,
-                                   MachineRepresentation type);
-
  private:
   enum class State : uint8_t { kUnvisited, kOnStack, kVisited };
 
@@ -46,13 +45,11 @@ class V8_EXPORT_PRIVATE Int64Lowering {
   CommonOperatorBuilder* common() const { return common_; }
   Signature<MachineRepresentation>* signature() const { return signature_; }
 
-  void PrepareReplacements(Node* node);
   void PushNode(Node* node);
   void LowerNode(Node* node);
   bool DefaultLowering(Node* node, bool low_word_only = false);
   void LowerComparison(Node* node, const Operator* signed_op,
                        const Operator* unsigned_op);
-  void PrepareProjectionReplacements(Node* node);
 
   void ReplaceNode(Node* old, Node* new_low, Node* new_high);
   bool HasReplacementLow(Node* node);
diff --git a/deps/v8/src/compiler/js-builtin-reducer.cc b/deps/v8/src/compiler/js-builtin-reducer.cc
deleted file mode 100644
index c3483092d23fb4..00000000000000
--- a/deps/v8/src/compiler/js-builtin-reducer.cc
+++ /dev/null
@@ -1,449 +0,0 @@
-// Copyright 2014 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "src/compiler/js-builtin-reducer.h"
-
-#include "src/base/bits.h"
-#include "src/builtins/builtins-utils.h"
-#include "src/code-factory.h"
-#include "src/compilation-dependencies.h"
-#include "src/compiler/access-builder.h"
-#include "src/compiler/allocation-builder.h"
-#include "src/compiler/js-graph.h"
-#include "src/compiler/linkage.h"
-#include "src/compiler/node-matchers.h"
-#include "src/compiler/node-properties.h"
-#include "src/compiler/simplified-operator.h"
-#include "src/compiler/type-cache.h"
-#include "src/compiler/types.h"
-#include "src/objects-inl.h"
-
-namespace v8 {
-namespace internal {
-namespace compiler {
-
-// Helper class to access JSCall nodes that are potential candidates
-// for reduction when they have a BuiltinFunctionId associated with them.
-class JSCallReduction {
- public:
-  explicit JSCallReduction(Node* node) : node_(node) {}
-
-  // Determines whether the node is a JSCall operation that targets a
-  // constant callee being a well-known builtin with a BuiltinFunctionId.
-  bool HasBuiltinFunctionId() {
-    if (node_->opcode() != IrOpcode::kJSCall) return false;
-    HeapObjectMatcher m(NodeProperties::GetValueInput(node_, 0));
-    if (!m.HasValue() || !m.Value()->IsJSFunction()) return false;
-    Handle<JSFunction> function = Handle<JSFunction>::cast(m.Value());
-    return function->shared()->HasBuiltinFunctionId();
-  }
-
-  bool BuiltinCanBeInlined() {
-    DCHECK_EQ(IrOpcode::kJSCall, node_->opcode());
-    HeapObjectMatcher m(NodeProperties::GetValueInput(node_, 0));
-    Handle<JSFunction> function = Handle<JSFunction>::cast(m.Value());
-    // Do not inline if the builtin may have break points.
-    return !function->shared()->HasBreakInfo();
-  }
-
-  // Retrieves the BuiltinFunctionId as described above.
-  BuiltinFunctionId GetBuiltinFunctionId() {
-    DCHECK_EQ(IrOpcode::kJSCall, node_->opcode());
-    HeapObjectMatcher m(NodeProperties::GetValueInput(node_, 0));
-    Handle<JSFunction> function = Handle<JSFunction>::cast(m.Value());
-    return function->shared()->builtin_function_id();
-  }
-
-  bool ReceiverMatches(Type* type) {
-    return NodeProperties::GetType(receiver())->Is(type);
-  }
-
-  // Determines whether the call takes zero inputs.
-  bool InputsMatchZero() { return GetJSCallArity() == 0; }
-
-  // Determines whether the call takes one input of the given type.
-  bool InputsMatchOne(Type* t1) {
-    return GetJSCallArity() == 1 &&
-           NodeProperties::GetType(GetJSCallInput(0))->Is(t1);
-  }
-
-  // Determines whether the call takes two inputs of the given types.
-  bool InputsMatchTwo(Type* t1, Type* t2) {
-    return GetJSCallArity() == 2 &&
-           NodeProperties::GetType(GetJSCallInput(0))->Is(t1) &&
-           NodeProperties::GetType(GetJSCallInput(1))->Is(t2);
-  }
-
-  // Determines whether the call takes inputs all of the given type.
-  bool InputsMatchAll(Type* t) {
-    for (int i = 0; i < GetJSCallArity(); i++) {
-      if (!NodeProperties::GetType(GetJSCallInput(i))->Is(t)) {
-        return false;
-      }
-    }
-    return true;
-  }
-
-  Node* receiver() { return NodeProperties::GetValueInput(node_, 1); }
-  Node* left() { return GetJSCallInput(0); }
-  Node* right() { return GetJSCallInput(1); }
-
-  int GetJSCallArity() {
-    DCHECK_EQ(IrOpcode::kJSCall, node_->opcode());
-    // Skip first (i.e. callee) and second (i.e. receiver) operand.
-    return node_->op()->ValueInputCount() - 2;
-  }
-
-  Node* GetJSCallInput(int index) {
-    DCHECK_EQ(IrOpcode::kJSCall, node_->opcode());
-    DCHECK_LT(index, GetJSCallArity());
-    // Skip first (i.e. callee) and second (i.e. receiver) operand.
-    return NodeProperties::GetValueInput(node_, index + 2);
-  }
-
- private:
-  Node* node_;
-};
-
-JSBuiltinReducer::JSBuiltinReducer(Editor* editor, JSGraph* jsgraph,
-                                   CompilationDependencies* dependencies,
-                                   Handle<Context> native_context)
-    : AdvancedReducer(editor),
-      dependencies_(dependencies),
-      jsgraph_(jsgraph),
-      native_context_(native_context),
-      type_cache_(TypeCache::Get()) {}
-
-// ES6 section 22.1.2.2 Array.isArray ( arg )
-Reduction JSBuiltinReducer::ReduceArrayIsArray(Node* node) {
-  // We certainly know that undefined is not an array.
-  if (node->op()->ValueInputCount() < 3) {
-    Node* value = jsgraph()->FalseConstant();
-    ReplaceWithValue(node, value);
-    return Replace(value);
-  }
-  Node* value = NodeProperties::GetValueInput(node, 2);
-  Type* value_type = NodeProperties::GetType(value);
-  Node* context = NodeProperties::GetContextInput(node);
-  Node* frame_state = NodeProperties::GetFrameStateInput(node);
-  Node* effect = NodeProperties::GetEffectInput(node);
-  Node* control = NodeProperties::GetControlInput(node);
-
-  // Constant-fold based on {value} type.
-  if (value_type->Is(Type::Array())) {
-    Node* value = jsgraph()->TrueConstant();
-    ReplaceWithValue(node, value);
-    return Replace(value);
-  } else if (!value_type->Maybe(Type::ArrayOrProxy())) {
-    Node* value = jsgraph()->FalseConstant();
-    ReplaceWithValue(node, value);
-    return Replace(value);
-  }
-
-  int count = 0;
-  Node* values[5];
-  Node* effects[5];
-  Node* controls[4];
-
-  // Check if the {value} is a Smi.
-  Node* check = graph()->NewNode(simplified()->ObjectIsSmi(), value);
-  control =
-      graph()->NewNode(common()->Branch(BranchHint::kFalse), check, control);
-
-  // The {value} is a Smi.
-  controls[count] = graph()->NewNode(common()->IfTrue(), control);
-  effects[count] = effect;
-  values[count] = jsgraph()->FalseConstant();
-  count++;
-
-  control = graph()->NewNode(common()->IfFalse(), control);
-
-  // Load the {value}s instance type.
-  Node* value_map = effect = graph()->NewNode(
-      simplified()->LoadField(AccessBuilder::ForMap()), value, effect, control);
-  Node* value_instance_type = effect = graph()->NewNode(
-      simplified()->LoadField(AccessBuilder::ForMapInstanceType()), value_map,
-      effect, control);
-
-  // Check if the {value} is a JSArray.
-  check = graph()->NewNode(simplified()->NumberEqual(), value_instance_type,
-                           jsgraph()->Constant(JS_ARRAY_TYPE));
-  control = graph()->NewNode(common()->Branch(), check, control);
-
-  // The {value} is a JSArray.
-  controls[count] = graph()->NewNode(common()->IfTrue(), control);
-  effects[count] = effect;
-  values[count] = jsgraph()->TrueConstant();
-  count++;
-
-  control = graph()->NewNode(common()->IfFalse(), control);
-
-  // Check if the {value} is a JSProxy.
-  check = graph()->NewNode(simplified()->NumberEqual(), value_instance_type,
-                           jsgraph()->Constant(JS_PROXY_TYPE));
-  control =
-      graph()->NewNode(common()->Branch(BranchHint::kFalse), check, control);
-
-  // The {value} is neither a JSArray nor a JSProxy.
-  controls[count] = graph()->NewNode(common()->IfFalse(), control);
-  effects[count] = effect;
-  values[count] = jsgraph()->FalseConstant();
-  count++;
-
-  control = graph()->NewNode(common()->IfTrue(), control);
-
-  // Let the %ArrayIsArray runtime function deal with the JSProxy {value}.
-  value = effect = control =
-      graph()->NewNode(javascript()->CallRuntime(Runtime::kArrayIsArray), value,
-                       context, frame_state, effect, control);
-  NodeProperties::SetType(value, Type::Boolean());
-
-  // Update potential {IfException} uses of {node} to point to the above
-  // %ArrayIsArray runtime call node instead.
-  Node* on_exception = nullptr;
-  if (NodeProperties::IsExceptionalCall(node, &on_exception)) {
-    NodeProperties::ReplaceControlInput(on_exception, control);
-    NodeProperties::ReplaceEffectInput(on_exception, effect);
-    control = graph()->NewNode(common()->IfSuccess(), control);
-    Revisit(on_exception);
-  }
-
-  // The {value} is neither a JSArray nor a JSProxy.
-  controls[count] = control;
-  effects[count] = effect;
-  values[count] = value;
-  count++;
-
-  control = graph()->NewNode(common()->Merge(count), count, controls);
-  effects[count] = control;
-  values[count] = control;
-  effect = graph()->NewNode(common()->EffectPhi(count), count + 1, effects);
-  value = graph()->NewNode(common()->Phi(MachineRepresentation::kTagged, count),
-                           count + 1, values);
-  ReplaceWithValue(node, value, effect, control);
-  return Replace(value);
-}
-
-// ES6 section 20.3.3.1 Date.now ( )
-Reduction JSBuiltinReducer::ReduceDateNow(Node* node) {
-  NodeProperties::RemoveValueInputs(node);
-  NodeProperties::ChangeOp(
-      node, javascript()->CallRuntime(Runtime::kDateCurrentTime));
-  return Changed(node);
-}
-
-// ES6 section 20.3.4.10 Date.prototype.getTime ( )
-Reduction JSBuiltinReducer::ReduceDateGetTime(Node* node) {
-  Node* receiver = NodeProperties::GetValueInput(node, 1);
-  Node* effect = NodeProperties::GetEffectInput(node);
-  Node* control = NodeProperties::GetControlInput(node);
-  if (NodeProperties::HasInstanceTypeWitness(receiver, effect, JS_DATE_TYPE)) {
-    Node* value = effect = graph()->NewNode(
-        simplified()->LoadField(AccessBuilder::ForJSDateValue()), receiver,
-        effect, control);
-    ReplaceWithValue(node, value, effect, control);
-    return Replace(value);
-  }
-  return NoChange();
-}
-
-// ES6 section 18.2.2 isFinite ( number )
-Reduction JSBuiltinReducer::ReduceGlobalIsFinite(Node* node) {
-  JSCallReduction r(node);
-  if (r.InputsMatchOne(Type::PlainPrimitive())) {
-    // isFinite(a:plain-primitive) -> NumberEqual(a', a')
-    // where a' = NumberSubtract(ToNumber(a), ToNumber(a))
-    Node* input = ToNumber(r.GetJSCallInput(0));
-    Node* diff = graph()->NewNode(simplified()->NumberSubtract(), input, input);
-    Node* value = graph()->NewNode(simplified()->NumberEqual(), diff, diff);
-    return Replace(value);
-  }
-  return NoChange();
-}
-
-// ES6 section 18.2.3 isNaN ( number )
-Reduction JSBuiltinReducer::ReduceGlobalIsNaN(Node* node) {
-  JSCallReduction r(node);
-  if (r.InputsMatchOne(Type::PlainPrimitive())) {
-    // isNaN(a:plain-primitive) -> BooleanNot(NumberEqual(a', a'))
-    // where a' = ToNumber(a)
-    Node* input = ToNumber(r.GetJSCallInput(0));
-    Node* check = graph()->NewNode(simplified()->NumberEqual(), input, input);
-    Node* value = graph()->NewNode(simplified()->BooleanNot(), check);
-    return Replace(value);
-  }
-  return NoChange();
-}
-
-// ES6 section 20.1.2.13 Number.parseInt ( string, radix )
-Reduction JSBuiltinReducer::ReduceNumberParseInt(Node* node) {
-  JSCallReduction r(node);
-  if (r.InputsMatchOne(type_cache_.kSafeInteger) ||
-      r.InputsMatchTwo(type_cache_.kSafeInteger,
-                       type_cache_.kZeroOrUndefined) ||
-      r.InputsMatchTwo(type_cache_.kSafeInteger, type_cache_.kTenOrUndefined)) {
-    // Number.parseInt(a:safe-integer) -> a
-    // Number.parseInt(a:safe-integer,b:#0\/undefined) -> a
-    // Number.parseInt(a:safe-integer,b:#10\/undefined) -> a
-    Node* value = r.GetJSCallInput(0);
-    return Replace(value);
-  }
-  return NoChange();
-}
-
-// ES6 section #sec-object.create Object.create(proto, properties)
-Reduction JSBuiltinReducer::ReduceObjectCreate(Node* node) {
-  // We need exactly target, receiver and value parameters.
-  int arg_count = node->op()->ValueInputCount();
-  if (arg_count != 3) return NoChange();
-  Node* effect = NodeProperties::GetEffectInput(node);
-  Node* control = NodeProperties::GetControlInput(node);
-  Node* prototype = NodeProperties::GetValueInput(node, 2);
-  Type* prototype_type = NodeProperties::GetType(prototype);
-  if (!prototype_type->IsHeapConstant()) return NoChange();
-  Handle<HeapObject> prototype_const =
-      prototype_type->AsHeapConstant()->Value();
-  Handle<Map> instance_map;
-  MaybeHandle<Map> maybe_instance_map =
-      Map::TryGetObjectCreateMap(prototype_const);
-  if (!maybe_instance_map.ToHandle(&instance_map)) return NoChange();
-  Node* properties = jsgraph()->EmptyFixedArrayConstant();
-  if (instance_map->is_dictionary_map()) {
-    // Allocated an empty NameDictionary as backing store for the properties.
-    Handle<Map> map(isolate()->heap()->name_dictionary_map(), isolate());
-    int capacity =
-        NameDictionary::ComputeCapacity(NameDictionary::kInitialCapacity);
-    DCHECK(base::bits::IsPowerOfTwo(capacity));
-    int length = NameDictionary::EntryToIndex(capacity);
-    int size = NameDictionary::SizeFor(length);
-
-    AllocationBuilder a(jsgraph(), effect, control);
-    a.Allocate(size, NOT_TENURED, Type::Any());
-    a.Store(AccessBuilder::ForMap(), map);
-    // Initialize FixedArray fields.
-    a.Store(AccessBuilder::ForFixedArrayLength(),
-            jsgraph()->SmiConstant(length));
-    // Initialize HashTable fields.
-    a.Store(AccessBuilder::ForHashTableBaseNumberOfElements(),
-            jsgraph()->SmiConstant(0));
-    a.Store(AccessBuilder::ForHashTableBaseNumberOfDeletedElement(),
-            jsgraph()->SmiConstant(0));
-    a.Store(AccessBuilder::ForHashTableBaseCapacity(),
-            jsgraph()->SmiConstant(capacity));
-    // Initialize Dictionary fields.
-    a.Store(AccessBuilder::ForDictionaryNextEnumerationIndex(),
-            jsgraph()->SmiConstant(PropertyDetails::kInitialIndex));
-    a.Store(AccessBuilder::ForDictionaryObjectHashIndex(),
-            jsgraph()->SmiConstant(PropertyArray::kNoHashSentinel));
-    // Initialize the Properties fields.
-    Node* undefined = jsgraph()->UndefinedConstant();
-    STATIC_ASSERT(NameDictionary::kElementsStartIndex ==
-                  NameDictionary::kObjectHashIndex + 1);
-    for (int index = NameDictionary::kElementsStartIndex; index < length;
-         index++) {
-      a.Store(AccessBuilder::ForFixedArraySlot(index, kNoWriteBarrier),
-              undefined);
-    }
-    properties = effect = a.Finish();
-  }
-
-  int const instance_size = instance_map->instance_size();
-  if (instance_size > kMaxRegularHeapObjectSize) return NoChange();
-  dependencies()->AssumeInitialMapCantChange(instance_map);
-
-  // Emit code to allocate the JSObject instance for the given
-  // {instance_map}.
-  AllocationBuilder a(jsgraph(), effect, control);
-  a.Allocate(instance_size, NOT_TENURED, Type::Any());
-  a.Store(AccessBuilder::ForMap(), instance_map);
-  a.Store(AccessBuilder::ForJSObjectPropertiesOrHash(), properties);
-  a.Store(AccessBuilder::ForJSObjectElements(),
-          jsgraph()->EmptyFixedArrayConstant());
-  // Initialize Object fields.
-  Node* undefined = jsgraph()->UndefinedConstant();
-  for (int offset = JSObject::kHeaderSize; offset < instance_size;
-       offset += kPointerSize) {
-    a.Store(AccessBuilder::ForJSObjectOffset(offset, kNoWriteBarrier),
-            undefined);
-  }
-  Node* value = effect = a.Finish();
-
-  // replace it
-  ReplaceWithValue(node, value, effect, control);
-  return Replace(value);
-}
-
-Reduction JSBuiltinReducer::Reduce(Node* node) {
-  Reduction reduction = NoChange();
-  JSCallReduction r(node);
-
-  // Dispatch according to the BuiltinFunctionId if present.
-  if (!r.HasBuiltinFunctionId()) return NoChange();
-  if (!r.BuiltinCanBeInlined()) return NoChange();
-  switch (r.GetBuiltinFunctionId()) {
-    case kArrayIsArray:
-      return ReduceArrayIsArray(node);
-    case kDateNow:
-      return ReduceDateNow(node);
-    case kDateGetTime:
-      return ReduceDateGetTime(node);
-    case kGlobalIsFinite:
-      reduction = ReduceGlobalIsFinite(node);
-      break;
-    case kGlobalIsNaN:
-      reduction = ReduceGlobalIsNaN(node);
-      break;
-    case kNumberParseInt:
-      reduction = ReduceNumberParseInt(node);
-      break;
-    case kObjectCreate:
-      reduction = ReduceObjectCreate(node);
-      break;
-    default:
-      break;
-  }
-
-  // Replace builtin call assuming replacement nodes are pure values that don't
-  // produce an effect. Replaces {node} with {reduction} and relaxes effects.
-  if (reduction.Changed()) ReplaceWithValue(node, reduction.replacement());
-
-  return reduction;
-}
-
-Node* JSBuiltinReducer::ToNumber(Node* input) {
-  Type* input_type = NodeProperties::GetType(input);
-  if (input_type->Is(Type::Number())) return input;
-  return graph()->NewNode(simplified()->PlainPrimitiveToNumber(), input);
-}
-
-Node* JSBuiltinReducer::ToUint32(Node* input) {
-  input = ToNumber(input);
-  Type* input_type = NodeProperties::GetType(input);
-  if (input_type->Is(Type::Unsigned32())) return input;
-  return graph()->NewNode(simplified()->NumberToUint32(), input);
-}
-
-Graph* JSBuiltinReducer::graph() const { return jsgraph()->graph(); }
-
-Factory* JSBuiltinReducer::factory() const { return isolate()->factory(); }
-
-Isolate* JSBuiltinReducer::isolate() const { return jsgraph()->isolate(); }
-
-
-CommonOperatorBuilder* JSBuiltinReducer::common() const {
-  return jsgraph()->common();
-}
-
-
-SimplifiedOperatorBuilder* JSBuiltinReducer::simplified() const {
-  return jsgraph()->simplified();
-}
-
-JSOperatorBuilder* JSBuiltinReducer::javascript() const {
-  return jsgraph()->javascript();
-}
-
-}  // namespace compiler
-}  // namespace internal
-}  // namespace v8
diff --git a/deps/v8/src/compiler/js-builtin-reducer.h b/deps/v8/src/compiler/js-builtin-reducer.h
deleted file mode 100644
index eff40060bb1cd8..00000000000000
--- a/deps/v8/src/compiler/js-builtin-reducer.h
+++ /dev/null
@@ -1,73 +0,0 @@
-// Copyright 2014 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef V8_COMPILER_JS_BUILTIN_REDUCER_H_
-#define V8_COMPILER_JS_BUILTIN_REDUCER_H_
-
-#include "src/base/compiler-specific.h"
-#include "src/compiler/graph-reducer.h"
-#include "src/globals.h"
-
-namespace v8 {
-namespace internal {
-
-// Forward declarations.
-class CompilationDependencies;
-class Factory;
-
-namespace compiler {
-
-// Forward declarations.
-class CommonOperatorBuilder;
-struct FieldAccess;
-class JSGraph;
-class JSOperatorBuilder;
-class SimplifiedOperatorBuilder;
-class TypeCache;
-
-class V8_EXPORT_PRIVATE JSBuiltinReducer final
-    : public NON_EXPORTED_BASE(AdvancedReducer) {
- public:
-  JSBuiltinReducer(Editor* editor, JSGraph* jsgraph,
-                   CompilationDependencies* dependencies,
-                   Handle<Context> native_context);
-  ~JSBuiltinReducer() final {}
-
-  const char* reducer_name() const override { return "JSBuiltinReducer"; }
-
-  Reduction Reduce(Node* node) final;
-
- private:
-  Reduction ReduceArrayIsArray(Node* node);
-
-  Reduction ReduceDateNow(Node* node);
-  Reduction ReduceDateGetTime(Node* node);
-  Reduction ReduceGlobalIsFinite(Node* node);
-  Reduction ReduceGlobalIsNaN(Node* node);
-  Reduction ReduceNumberParseInt(Node* node);
-  Reduction ReduceObjectCreate(Node* node);
-  Node* ToNumber(Node* value);
-  Node* ToUint32(Node* value);
-
-  Graph* graph() const;
-  Factory* factory() const;
-  JSGraph* jsgraph() const { return jsgraph_; }
-  Isolate* isolate() const;
-  Handle<Context> native_context() const { return native_context_; }
-  CommonOperatorBuilder* common() const;
-  SimplifiedOperatorBuilder* simplified() const;
-  JSOperatorBuilder* javascript() const;
-  CompilationDependencies* dependencies() const { return dependencies_; }
-
-  CompilationDependencies* const dependencies_;
-  JSGraph* const jsgraph_;
-  Handle<Context> const native_context_;
-  TypeCache const& type_cache_;
-};
-
-}  // namespace compiler
-}  // namespace internal
-}  // namespace v8
-
-#endif  // V8_COMPILER_JS_BUILTIN_REDUCER_H_
diff --git a/deps/v8/src/compiler/js-call-reducer.cc b/deps/v8/src/compiler/js-call-reducer.cc
index 451ec80a8d4f87..b86897eb6a7de6 100644
--- a/deps/v8/src/compiler/js-call-reducer.cc
+++ b/deps/v8/src/compiler/js-call-reducer.cc
@@ -9,17 +9,20 @@
 #include "src/builtins/builtins-utils.h"
 #include "src/code-factory.h"
 #include "src/code-stubs.h"
-#include "src/compilation-dependencies.h"
 #include "src/compiler/access-builder.h"
+#include "src/compiler/access-info.h"
 #include "src/compiler/allocation-builder.h"
+#include "src/compiler/compilation-dependencies.h"
 #include "src/compiler/js-graph.h"
 #include "src/compiler/linkage.h"
 #include "src/compiler/node-matchers.h"
+#include "src/compiler/property-access-builder.h"
 #include "src/compiler/simplified-operator.h"
 #include "src/compiler/type-cache.h"
 #include "src/feedback-vector-inl.h"
 #include "src/ic/call-optimization.h"
 #include "src/objects-inl.h"
+#include "src/objects/arguments-inl.h"
 #include "src/vector-slot-pair.h"
 
 namespace v8 {
@@ -247,8 +250,8 @@ Reduction JSCallReducer::ReduceObjectConstructor(Node* node) {
   Node* effect = NodeProperties::GetEffectInput(node);
 
   // We can fold away the Object(x) call if |x| is definitely not a primitive.
-  if (NodeProperties::CanBePrimitive(value, effect)) {
-    if (!NodeProperties::CanBeNullOrUndefined(value, effect)) {
+  if (NodeProperties::CanBePrimitive(isolate(), value, effect)) {
+    if (!NodeProperties::CanBeNullOrUndefined(isolate(), value, effect)) {
       // Turn the {node} into a {JSToObject} call if we know that
       // the {value} cannot be null or undefined.
       NodeProperties::ReplaceValueInputs(node, value);
@@ -289,7 +292,8 @@ Reduction JSCallReducer::ReduceFunctionPrototypeApply(Node* node) {
 
     // If {arguments_list} cannot be null or undefined, we don't need
     // to expand this {node} to control-flow.
-    if (!NodeProperties::CanBeNullOrUndefined(arguments_list, effect)) {
+    if (!NodeProperties::CanBeNullOrUndefined(isolate(), arguments_list,
+                                              effect)) {
       // Massage the value inputs appropriately.
       node->ReplaceInput(0, target);
       node->ReplaceInput(1, this_argument);
@@ -401,7 +405,8 @@ Reduction JSCallReducer::ReduceFunctionPrototypeBind(Node* node) {
   // definitely a constructor or not a constructor.
   ZoneHandleSet<Map> receiver_maps;
   NodeProperties::InferReceiverMapsResult result =
-      NodeProperties::InferReceiverMaps(receiver, effect, &receiver_maps);
+      NodeProperties::InferReceiverMaps(isolate(), receiver, effect,
+                                        &receiver_maps);
   if (result == NodeProperties::kNoReceiverMaps) return NoChange();
   DCHECK_NE(0, receiver_maps.size());
   bool const is_constructor = receiver_maps[0]->is_constructor();
@@ -426,18 +431,18 @@ Reduction JSCallReducer::ReduceFunctionPrototypeBind(Node* node) {
                                         isolate());
     if (descriptors->number_of_descriptors() < 2) return NoChange();
     if (descriptors->GetKey(JSFunction::kLengthDescriptorIndex) !=
-        isolate()->heap()->length_string()) {
+        ReadOnlyRoots(isolate()).length_string()) {
       return NoChange();
     }
-    if (!descriptors->GetValue(JSFunction::kLengthDescriptorIndex)
+    if (!descriptors->GetStrongValue(JSFunction::kLengthDescriptorIndex)
              ->IsAccessorInfo()) {
       return NoChange();
     }
     if (descriptors->GetKey(JSFunction::kNameDescriptorIndex) !=
-        isolate()->heap()->name_string()) {
+        ReadOnlyRoots(isolate()).name_string()) {
       return NoChange();
     }
-    if (!descriptors->GetValue(JSFunction::kNameDescriptorIndex)
+    if (!descriptors->GetStrongValue(JSFunction::kNameDescriptorIndex)
              ->IsAccessorInfo()) {
       return NoChange();
     }
@@ -451,7 +456,7 @@ Reduction JSCallReducer::ReduceFunctionPrototypeBind(Node* node) {
           : native_context()->bound_function_without_constructor_map(),
       isolate());
   if (map->prototype() != *prototype) {
-    map = Map::TransitionToPrototype(map, prototype);
+    map = Map::TransitionToPrototype(isolate(), map, prototype);
   }
 
   // Make sure we can rely on the {receiver_maps}.
@@ -562,7 +567,8 @@ Reduction JSCallReducer::ReduceObjectGetPrototype(Node* node, Node* object) {
   // Try to determine the {object} map.
   ZoneHandleSet<Map> object_maps;
   NodeProperties::InferReceiverMapsResult result =
-      NodeProperties::InferReceiverMaps(object, effect, &object_maps);
+      NodeProperties::InferReceiverMaps(isolate(), object, effect,
+                                        &object_maps);
   if (result != NodeProperties::kNoReceiverMaps) {
     Handle<Map> candidate_map = object_maps[0];
     Handle<Object> candidate_prototype(candidate_map->prototype(), isolate());
@@ -588,7 +594,7 @@ Reduction JSCallReducer::ReduceObjectGetPrototype(Node* node, Node* object) {
     }
     if (result == NodeProperties::kUnreliableReceiverMaps) {
       for (size_t i = 0; i < object_maps.size(); ++i) {
-        dependencies()->AssumeMapStable(object_maps[i]);
+        dependencies()->DependOnStableMap(object_maps[i]);
       }
     }
     Node* value = jsgraph()->Constant(candidate_prototype);
@@ -721,7 +727,8 @@ Reduction JSCallReducer::ReduceObjectPrototypeIsPrototypeOf(Node* node) {
   // the ToObject step of Object.prototype.isPrototypeOf is a no-op).
   ZoneHandleSet<Map> receiver_maps;
   NodeProperties::InferReceiverMapsResult result =
-      NodeProperties::InferReceiverMaps(receiver, effect, &receiver_maps);
+      NodeProperties::InferReceiverMaps(isolate(), receiver, effect,
+                                        &receiver_maps);
   if (result == NodeProperties::kNoReceiverMaps) return NoChange();
   for (size_t i = 0; i < receiver_maps.size(); ++i) {
     if (!receiver_maps[i]->IsJSReceiverMap()) return NoChange();
@@ -794,6 +801,29 @@ Reduction JSCallReducer::ReduceReflectGetPrototypeOf(Node* node) {
   return ReduceObjectGetPrototype(node, target);
 }
 
+// ES6 section #sec-object.create Object.create(proto, properties)
+Reduction JSCallReducer::ReduceObjectCreate(Node* node) {
+  int arg_count = node->op()->ValueInputCount();
+  Node* properties = arg_count >= 4 ? NodeProperties::GetValueInput(node, 3)
+                                    : jsgraph()->UndefinedConstant();
+  if (properties != jsgraph()->UndefinedConstant()) return NoChange();
+
+  Node* effect = NodeProperties::GetEffectInput(node);
+  Node* control = NodeProperties::GetControlInput(node);
+  Node* context = NodeProperties::GetContextInput(node);
+  Node* frame_state = NodeProperties::GetFrameStateInput(node);
+  Node* prototype = arg_count >= 3 ? NodeProperties::GetValueInput(node, 2)
+                                   : jsgraph()->UndefinedConstant();
+  node->ReplaceInput(0, prototype);
+  node->ReplaceInput(1, context);
+  node->ReplaceInput(2, frame_state);
+  node->ReplaceInput(3, effect);
+  node->ReplaceInput(4, control);
+  node->TrimInputCount(5);
+  NodeProperties::ChangeOp(node, javascript()->CreateObject());
+  return Changed(node);
+}
+
 // ES section #sec-reflect.get
 Reduction JSCallReducer::ReduceReflectGet(Node* node) {
   DCHECK_EQ(IrOpcode::kJSCall, node->opcode());
@@ -829,11 +859,11 @@ Reduction JSCallReducer::ReduceReflectGet(Node* node) {
   Node* etrue = effect;
   Node* vtrue;
   {
-    Callable callable = CodeFactory::GetProperty(isolate());
+    Callable callable =
+        Builtins::CallableFor(isolate(), Builtins::kGetProperty);
     auto call_descriptor = Linkage::GetStubCallDescriptor(
-        isolate(), graph()->zone(), callable.descriptor(), 0,
-        CallDescriptor::kNeedsFrameState, Operator::kNoProperties,
-        MachineType::AnyTagged(), 1);
+        graph()->zone(), callable.descriptor(), 0,
+        CallDescriptor::kNeedsFrameState, Operator::kNoProperties);
     Node* stub_code = jsgraph()->HeapConstant(callable.code());
     vtrue = etrue = if_true =
         graph()->NewNode(common()->Call(call_descriptor), stub_code, target,
@@ -938,8 +968,8 @@ Reduction JSCallReducer::ReduceReflectHas(Node* node) {
   return Changed(vtrue);
 }
 
-bool CanInlineArrayIteratingBuiltin(Handle<Map> receiver_map) {
-  Isolate* const isolate = receiver_map->GetIsolate();
+bool CanInlineArrayIteratingBuiltin(Isolate* isolate,
+                                    Handle<Map> receiver_map) {
   if (!receiver_map->prototype()->IsJSArray()) return false;
   Handle<JSArray> receiver_prototype(JSArray::cast(receiver_map->prototype()),
                                      isolate);
@@ -992,7 +1022,8 @@ Reduction JSCallReducer::ReduceArrayForEach(Node* node,
                        : jsgraph()->UndefinedConstant();
   ZoneHandleSet<Map> receiver_maps;
   NodeProperties::InferReceiverMapsResult result =
-      NodeProperties::InferReceiverMaps(receiver, effect, &receiver_maps);
+      NodeProperties::InferReceiverMaps(isolate(), receiver, effect,
+                                        &receiver_maps);
   if (result == NodeProperties::kNoReceiverMaps) return NoChange();
 
   // By ensuring that {kind} is object or double, we can be polymorphic
@@ -1003,7 +1034,7 @@ Reduction JSCallReducer::ReduceArrayForEach(Node* node,
   }
   for (Handle<Map> receiver_map : receiver_maps) {
     ElementsKind next_kind = receiver_map->elements_kind();
-    if (!CanInlineArrayIteratingBuiltin(receiver_map)) {
+    if (!CanInlineArrayIteratingBuiltin(isolate(), receiver_map)) {
       return NoChange();
     }
     if (!IsFastElementsKind(next_kind)) {
@@ -1019,7 +1050,7 @@ Reduction JSCallReducer::ReduceArrayForEach(Node* node,
 
   // Install code dependencies on the {receiver} prototype maps and the
   // global array protector cell.
-  dependencies()->AssumePropertyCell(factory()->no_elements_protector());
+  dependencies()->DependOnProtector(factory()->no_elements_protector());
 
   // If we have unreliable maps, we need a map check.
   if (result == NodeProperties::kUnreliableReceiverMaps) {
@@ -1180,12 +1211,14 @@ Reduction JSCallReducer::ReduceArrayReduce(Node* node,
 
   ZoneHandleSet<Map> receiver_maps;
   NodeProperties::InferReceiverMapsResult result =
-      NodeProperties::InferReceiverMaps(receiver, effect, &receiver_maps);
+      NodeProperties::InferReceiverMaps(isolate(), receiver, effect,
+                                        &receiver_maps);
   if (result == NodeProperties::kNoReceiverMaps) return NoChange();
 
   ElementsKind kind = receiver_maps[0]->elements_kind();
   for (Handle<Map> receiver_map : receiver_maps) {
-    if (!CanInlineArrayIteratingBuiltin(receiver_map)) return NoChange();
+    if (!CanInlineArrayIteratingBuiltin(isolate(), receiver_map))
+      return NoChange();
     if (!UnionElementsKindUptoSize(&kind, receiver_map->elements_kind()))
       return NoChange();
   }
@@ -1201,7 +1234,7 @@ Reduction JSCallReducer::ReduceArrayReduce(Node* node,
 
   // Install code dependencies on the {receiver} prototype maps and the
   // global array protector cell.
-  dependencies()->AssumePropertyCell(factory()->no_elements_protector());
+  dependencies()->DependOnProtector(factory()->no_elements_protector());
 
   // If we have unreliable maps, we need a map check.
   if (result == NodeProperties::kUnreliableReceiverMaps) {
@@ -1454,7 +1487,8 @@ Reduction JSCallReducer::ReduceArrayMap(Node* node,
                        : jsgraph()->UndefinedConstant();
   ZoneHandleSet<Map> receiver_maps;
   NodeProperties::InferReceiverMapsResult result =
-      NodeProperties::InferReceiverMaps(receiver, effect, &receiver_maps);
+      NodeProperties::InferReceiverMaps(isolate(), receiver, effect,
+                                        &receiver_maps);
   if (result == NodeProperties::kNoReceiverMaps) return NoChange();
 
   // Ensure that any changes to the Array species constructor cause deopt.
@@ -1463,13 +1497,14 @@ Reduction JSCallReducer::ReduceArrayMap(Node* node,
   const ElementsKind kind = receiver_maps[0]->elements_kind();
 
   for (Handle<Map> receiver_map : receiver_maps) {
-    if (!CanInlineArrayIteratingBuiltin(receiver_map)) return NoChange();
+    if (!CanInlineArrayIteratingBuiltin(isolate(), receiver_map))
+      return NoChange();
     // We can handle different maps, as long as their elements kind are the
     // same.
     if (receiver_map->elements_kind() != kind) return NoChange();
   }
 
-  dependencies()->AssumePropertyCell(factory()->array_species_protector());
+  dependencies()->DependOnProtector(factory()->array_species_protector());
 
   Handle<JSFunction> handle_constructor(
       JSFunction::cast(
@@ -1594,10 +1629,12 @@ Reduction JSCallReducer::ReduceArrayMap(Node* node,
                                      &check_fail, &control);
   }
 
-  Handle<Map> double_map(Map::cast(
-      native_context()->get(Context::ArrayMapIndex(HOLEY_DOUBLE_ELEMENTS))));
+  Handle<Map> double_map(Map::cast(native_context()->get(
+                             Context::ArrayMapIndex(HOLEY_DOUBLE_ELEMENTS))),
+                         isolate());
   Handle<Map> fast_map(
-      Map::cast(native_context()->get(Context::ArrayMapIndex(HOLEY_ELEMENTS))));
+      Map::cast(native_context()->get(Context::ArrayMapIndex(HOLEY_ELEMENTS))),
+      isolate());
   effect = graph()->NewNode(
       simplified()->TransitionAndStoreElement(double_map, fast_map), a, k,
       callback_value, effect, control);
@@ -1654,7 +1691,8 @@ Reduction JSCallReducer::ReduceArrayFilter(Node* node,
                        : jsgraph()->UndefinedConstant();
   ZoneHandleSet<Map> receiver_maps;
   NodeProperties::InferReceiverMapsResult result =
-      NodeProperties::InferReceiverMaps(receiver, effect, &receiver_maps);
+      NodeProperties::InferReceiverMaps(isolate(), receiver, effect,
+                                        &receiver_maps);
   if (result == NodeProperties::kNoReceiverMaps) return NoChange();
 
   // And ensure that any changes to the Array species constructor cause deopt.
@@ -1665,7 +1703,7 @@ Reduction JSCallReducer::ReduceArrayFilter(Node* node,
   const ElementsKind packed_kind = GetPackedElementsKind(kind);
 
   for (Handle<Map> receiver_map : receiver_maps) {
-    if (!CanInlineArrayIteratingBuiltin(receiver_map)) {
+    if (!CanInlineArrayIteratingBuiltin(isolate(), receiver_map)) {
       return NoChange();
     }
     // We can handle different maps, as long as their elements kind are the
@@ -1673,10 +1711,11 @@ Reduction JSCallReducer::ReduceArrayFilter(Node* node,
     if (receiver_map->elements_kind() != kind) return NoChange();
   }
 
-  dependencies()->AssumePropertyCell(factory()->array_species_protector());
+  dependencies()->DependOnProtector(factory()->array_species_protector());
 
   Handle<Map> initial_map(
-      Map::cast(native_context()->GetInitialJSArrayMap(packed_kind)));
+      Map::cast(native_context()->GetInitialJSArrayMap(packed_kind)),
+      isolate());
 
   Node* k = jsgraph()->ZeroConstant();
   Node* to = jsgraph()->ZeroConstant();
@@ -1691,7 +1730,7 @@ Reduction JSCallReducer::ReduceArrayFilter(Node* node,
 
   Node* a;  // Construct the output array.
   {
-    AllocationBuilder ab(jsgraph(), effect, control);
+    AllocationBuilder ab(jsgraph(), js_heap_broker(), effect, control);
     ab.Allocate(initial_map->instance_size(), NOT_TENURED, Type::Array());
     ab.Store(AccessBuilder::ForMap(), initial_map);
     Node* empty_fixed_array = jsgraph()->EmptyFixedArrayConstant();
@@ -1700,8 +1739,9 @@ Reduction JSCallReducer::ReduceArrayFilter(Node* node,
     ab.Store(AccessBuilder::ForJSArrayLength(packed_kind),
              jsgraph()->ZeroConstant());
     for (int i = 0; i < initial_map->GetInObjectProperties(); ++i) {
-      ab.Store(AccessBuilder::ForJSObjectInObjectProperty(initial_map, i),
-               jsgraph()->UndefinedConstant());
+      ab.Store(
+          AccessBuilder::ForJSObjectInObjectProperty(MapRef(initial_map), i),
+          jsgraph()->UndefinedConstant());
     }
     a = effect = ab.Finish();
   }
@@ -1928,7 +1968,8 @@ Reduction JSCallReducer::ReduceArrayFind(Node* node, ArrayFindVariant variant,
                        : jsgraph()->UndefinedConstant();
   ZoneHandleSet<Map> receiver_maps;
   NodeProperties::InferReceiverMapsResult result =
-      NodeProperties::InferReceiverMaps(receiver, effect, &receiver_maps);
+      NodeProperties::InferReceiverMaps(isolate(), receiver, effect,
+                                        &receiver_maps);
   if (result == NodeProperties::kNoReceiverMaps) return NoChange();
 
   const ElementsKind kind = receiver_maps[0]->elements_kind();
@@ -1939,7 +1980,8 @@ Reduction JSCallReducer::ReduceArrayFind(Node* node, ArrayFindVariant variant,
   }
 
   for (Handle<Map> receiver_map : receiver_maps) {
-    if (!CanInlineArrayIteratingBuiltin(receiver_map)) return NoChange();
+    if (!CanInlineArrayIteratingBuiltin(isolate(), receiver_map))
+      return NoChange();
     // We can handle different maps, as long as their elements kind are the
     // same.
     if (receiver_map->elements_kind() != kind) return NoChange();
@@ -1947,7 +1989,7 @@ Reduction JSCallReducer::ReduceArrayFind(Node* node, ArrayFindVariant variant,
 
   // Install code dependencies on the {receiver} prototype maps and the
   // global array protector cell.
-  dependencies()->AssumePropertyCell(factory()->no_elements_protector());
+  dependencies()->DependOnProtector(factory()->no_elements_protector());
 
   // If we have unreliable maps, we need a map check.
   if (result == NodeProperties::kUnreliableReceiverMaps) {
@@ -2117,7 +2159,7 @@ Node* JSCallReducer::DoFilterPostCallbackWork(ElementsKind kind, Node** control,
         simplified()->LoadField(AccessBuilder::ForJSObjectElements()), a, etrue,
         if_true);
 
-    DCHECK(TypeCache::Get().kFixedDoubleArrayLengthType->Is(
+    DCHECK(TypeCache::Get().kFixedDoubleArrayLengthType.Is(
         TypeCache::Get().kFixedArrayLengthType));
     Node* checked_to = etrue = graph()->NewNode(
         common()->TypeGuard(TypeCache::Get().kFixedArrayLengthType), to, etrue,
@@ -2215,12 +2257,10 @@ Node* JSCallReducer::SafeLoadElement(ElementsKind kind, Node* receiver,
       simplified()->LoadField(AccessBuilder::ForJSObjectElements()), receiver,
       *effect, control);
 
-  Node* masked_index =
-      graph()->NewNode(simplified()->MaskIndexWithBound(), *k, length);
-
   Node* element = *effect = graph()->NewNode(
-      simplified()->LoadElement(AccessBuilder::ForFixedArrayElement(kind)),
-      elements, masked_index, *effect, control);
+      simplified()->LoadElement(AccessBuilder::ForFixedArrayElement(
+          kind, LoadSensitivity::kCritical)),
+      elements, *k, *effect, control);
   return element;
 }
 
@@ -2247,7 +2287,8 @@ Reduction JSCallReducer::ReduceArrayEvery(Node* node,
                        : jsgraph()->UndefinedConstant();
   ZoneHandleSet<Map> receiver_maps;
   NodeProperties::InferReceiverMapsResult result =
-      NodeProperties::InferReceiverMaps(receiver, effect, &receiver_maps);
+      NodeProperties::InferReceiverMaps(isolate(), receiver, effect,
+                                        &receiver_maps);
   if (result == NodeProperties::kNoReceiverMaps) return NoChange();
 
   // And ensure that any changes to the Array species constructor cause deopt.
@@ -2256,13 +2297,14 @@ Reduction JSCallReducer::ReduceArrayEvery(Node* node,
   const ElementsKind kind = receiver_maps[0]->elements_kind();
 
   for (Handle<Map> receiver_map : receiver_maps) {
-    if (!CanInlineArrayIteratingBuiltin(receiver_map)) return NoChange();
+    if (!CanInlineArrayIteratingBuiltin(isolate(), receiver_map))
+      return NoChange();
     // We can handle different maps, as long as their elements kind are the
     // same.
     if (receiver_map->elements_kind() != kind) return NoChange();
   }
 
-  dependencies()->AssumePropertyCell(factory()->array_species_protector());
+  dependencies()->DependOnProtector(factory()->array_species_protector());
 
   // If we have unreliable maps, we need a map check.
   if (result == NodeProperties::kUnreliableReceiverMaps) {
@@ -2503,7 +2545,7 @@ Reduction JSCallReducer::ReduceArrayIndexOfIncludes(
   }
 
   Handle<Map> receiver_map;
-  if (!NodeProperties::GetMapWitness(node).ToHandle(&receiver_map))
+  if (!NodeProperties::GetMapWitness(isolate(), node).ToHandle(&receiver_map))
     return NoChange();
 
   if (receiver_map->instance_type() != JS_ARRAY_TYPE) return NoChange();
@@ -2515,8 +2557,8 @@ Reduction JSCallReducer::ReduceArrayIndexOfIncludes(
           : GetCallableForArrayIncludes(receiver_map->elements_kind(),
                                         isolate());
   CallDescriptor const* const desc = Linkage::GetStubCallDescriptor(
-      isolate(), graph()->zone(), callable.descriptor(), 0,
-      CallDescriptor::kNoFlags, Operator::kEliminatable);
+      graph()->zone(), callable.descriptor(), 0, CallDescriptor::kNoFlags,
+      Operator::kEliminatable);
   // The stub expects the following arguments: the receiver array, its elements,
   // the search_element, the array length, and the index to start searching
   // from.
@@ -2583,7 +2625,8 @@ Reduction JSCallReducer::ReduceArraySome(Node* node,
                        : jsgraph()->UndefinedConstant();
   ZoneHandleSet<Map> receiver_maps;
   NodeProperties::InferReceiverMapsResult result =
-      NodeProperties::InferReceiverMaps(receiver, effect, &receiver_maps);
+      NodeProperties::InferReceiverMaps(isolate(), receiver, effect,
+                                        &receiver_maps);
   if (result == NodeProperties::kNoReceiverMaps) return NoChange();
 
   // And ensure that any changes to the Array species constructor cause deopt.
@@ -2594,13 +2637,14 @@ Reduction JSCallReducer::ReduceArraySome(Node* node,
   const ElementsKind kind = receiver_maps[0]->elements_kind();
 
   for (Handle<Map> receiver_map : receiver_maps) {
-    if (!CanInlineArrayIteratingBuiltin(receiver_map)) return NoChange();
+    if (!CanInlineArrayIteratingBuiltin(isolate(), receiver_map))
+      return NoChange();
     // We can handle different maps, as long as their elements kind are the
     // same.
     if (receiver_map->elements_kind() != kind) return NoChange();
   }
 
-  dependencies()->AssumePropertyCell(factory()->array_species_protector());
+  dependencies()->DependOnProtector(factory()->array_species_protector());
 
   Node* k = jsgraph()->ZeroConstant();
 
@@ -2802,7 +2846,7 @@ Reduction JSCallReducer::ReduceCallApiFunction(
   Node* control = NodeProperties::GetControlInput(node);
 
   Handle<FunctionTemplateInfo> function_template_info(
-      FunctionTemplateInfo::cast(shared->function_data()));
+      FunctionTemplateInfo::cast(shared->function_data()), isolate());
 
   // CallApiCallbackStub expects the target in a register, so we count it out,
   // and counts the receiver as an implicit argument, so we count the receiver
@@ -2813,7 +2857,8 @@ Reduction JSCallReducer::ReduceCallApiFunction(
   // callback based on those.
   ZoneHandleSet<Map> receiver_maps;
   NodeProperties::InferReceiverMapsResult result =
-      NodeProperties::InferReceiverMaps(receiver, effect, &receiver_maps);
+      NodeProperties::InferReceiverMaps(isolate(), receiver, effect,
+                                        &receiver_maps);
   if (result == NodeProperties::kNoReceiverMaps) return NoChange();
   for (size_t i = 0; i < receiver_maps.size(); ++i) {
     Handle<Map> receiver_map = receiver_maps[i];
@@ -2830,7 +2875,7 @@ Reduction JSCallReducer::ReduceCallApiFunction(
   }
 
   // See if we can constant-fold the compatible receiver checks.
-  CallOptimization call_optimization(function_template_info);
+  CallOptimization call_optimization(isolate(), function_template_info);
   if (!call_optimization.is_simple_api_call()) return NoChange();
   CallOptimization::HolderLookup lookup;
   Handle<JSObject> api_holder =
@@ -2847,7 +2892,7 @@ Reduction JSCallReducer::ReduceCallApiFunction(
   // Install stability dependencies for unreliable {receiver_maps}.
   if (result == NodeProperties::kUnreliableReceiverMaps) {
     for (size_t i = 0; i < receiver_maps.size(); ++i) {
-      dependencies()->AssumeMapStable(receiver_maps[i]);
+      dependencies()->DependOnStableMap(receiver_maps[i]);
     }
   }
 
@@ -2864,21 +2909,20 @@ Reduction JSCallReducer::ReduceCallApiFunction(
   Handle<CallHandlerInfo> call_handler_info(
       CallHandlerInfo::cast(function_template_info->call_code()), isolate());
   Handle<Object> data(call_handler_info->data(), isolate());
-  CallApiCallbackStub stub(isolate(), argc);
-  CallInterfaceDescriptor cid = stub.GetCallInterfaceDescriptor();
+  Callable call_api_callback = CodeFactory::CallApiCallback(isolate(), argc);
+  CallInterfaceDescriptor cid = call_api_callback.descriptor();
   auto call_descriptor = Linkage::GetStubCallDescriptor(
-      isolate(), graph()->zone(), cid,
+      graph()->zone(), cid,
       cid.GetStackParameterCount() + argc + 1 /* implicit receiver */,
-      CallDescriptor::kNeedsFrameState, Operator::kNoProperties,
-      MachineType::AnyTagged(), 1, Linkage::kNoContext);
+      CallDescriptor::kNeedsFrameState);
   ApiFunction api_function(v8::ToCData<Address>(call_handler_info->callback()));
   Node* holder = lookup == CallOptimization::kHolderFound
                      ? jsgraph()->HeapConstant(api_holder)
                      : receiver;
-  ExternalReference function_reference(
-      &api_function, ExternalReference::DIRECT_API_CALL, isolate());
+  ExternalReference function_reference = ExternalReference::Create(
+      &api_function, ExternalReference::DIRECT_API_CALL);
   node->InsertInput(graph()->zone(), 0,
-                    jsgraph()->HeapConstant(stub.GetCode()));
+                    jsgraph()->HeapConstant(call_api_callback.code()));
   node->ReplaceInput(1, context);
   node->InsertInput(graph()->zone(), 2, jsgraph()->Constant(data));
   node->InsertInput(graph()->zone(), 3, holder);
@@ -3018,7 +3062,7 @@ Reduction JSCallReducer::ReduceCallOrConstructWithArrayLikeOrSpread(
   // that no one messed with the %ArrayIteratorPrototype%.next method.
   if (node->opcode() == IrOpcode::kJSCallWithSpread ||
       node->opcode() == IrOpcode::kJSConstructWithSpread) {
-    dependencies()->AssumePropertyCell(factory()->array_iterator_protector());
+    dependencies()->DependOnProtector(factory()->array_iterator_protector());
   }
 
   // Remove the {arguments_list} input from the {node}.
@@ -3227,7 +3271,7 @@ Reduction JSCallReducer::ReduceJSCall(Node* node) {
 
     // Update the JSCall operator on {node}.
     ConvertReceiverMode const convert_mode =
-        NodeProperties::CanBeNullOrUndefined(bound_this, effect)
+        NodeProperties::CanBeNullOrUndefined(isolate(), bound_this, effect)
             ? ConvertReceiverMode::kAny
             : ConvertReceiverMode::kNotNullOrUndefined;
     NodeProperties::ChangeOp(
@@ -3251,15 +3295,14 @@ Reduction JSCallReducer::ReduceJSCall(Node* node) {
     return NoChange();
   }
 
-  Handle<Object> feedback(nexus.GetFeedback(), isolate());
-  if (feedback->IsWeakCell()) {
+  HeapObject* heap_object;
+  if (nexus.GetFeedback()->ToWeakHeapObject(&heap_object)) {
+    Handle<HeapObject> feedback(heap_object, isolate());
     // Check if we want to use CallIC feedback here.
     if (!ShouldUseCallICFeedback(target)) return NoChange();
 
-    Handle<WeakCell> cell = Handle<WeakCell>::cast(feedback);
-    if (cell->value()->IsCallable()) {
-      Node* target_function =
-          jsgraph()->Constant(handle(cell->value(), isolate()));
+    if (feedback->IsCallable()) {
+      Node* target_function = jsgraph()->Constant(feedback);
 
       // Check that the {target} is still the {target_function}.
       Node* check = graph()->NewNode(simplified()->ReferenceEqual(), target,
@@ -3316,6 +3359,8 @@ Reduction JSCallReducer::ReduceJSCall(Node* node,
       return ReduceFunctionPrototypeHasInstance(node);
     case Builtins::kObjectConstructor:
       return ReduceObjectConstructor(node);
+    case Builtins::kObjectCreate:
+      return ReduceObjectCreate(node);
     case Builtins::kObjectGetPrototypeOf:
       return ReduceObjectGetPrototypeOf(node);
     case Builtins::kObjectIs:
@@ -3372,6 +3417,8 @@ Reduction JSCallReducer::ReduceJSCall(Node* node,
       return ReduceArrayIterator(node, IterationKind::kValues);
     case Builtins::kArrayIteratorPrototypeNext:
       return ReduceArrayIteratorPrototypeNext(node);
+    case Builtins::kArrayIsArray:
+      return ReduceArrayIsArray(node);
     case Builtins::kArrayBufferIsView:
       return ReduceArrayBufferIsView(node);
     case Builtins::kDataViewPrototypeGetByteLength:
@@ -3382,6 +3429,54 @@ Reduction JSCallReducer::ReduceJSCall(Node* node,
       return ReduceArrayBufferViewAccessor(
           node, JS_DATA_VIEW_TYPE,
           AccessBuilder::ForJSArrayBufferViewByteOffset());
+    case Builtins::kDataViewPrototypeGetUint8:
+      return ReduceDataViewPrototypeGet(node,
+                                        ExternalArrayType::kExternalUint8Array);
+    case Builtins::kDataViewPrototypeGetInt8:
+      return ReduceDataViewPrototypeGet(node,
+                                        ExternalArrayType::kExternalInt8Array);
+    case Builtins::kDataViewPrototypeGetUint16:
+      return ReduceDataViewPrototypeGet(
+          node, ExternalArrayType::kExternalUint16Array);
+    case Builtins::kDataViewPrototypeGetInt16:
+      return ReduceDataViewPrototypeGet(node,
+                                        ExternalArrayType::kExternalInt16Array);
+    case Builtins::kDataViewPrototypeGetUint32:
+      return ReduceDataViewPrototypeGet(
+          node, ExternalArrayType::kExternalUint32Array);
+    case Builtins::kDataViewPrototypeGetInt32:
+      return ReduceDataViewPrototypeGet(node,
+                                        ExternalArrayType::kExternalInt32Array);
+    case Builtins::kDataViewPrototypeGetFloat32:
+      return ReduceDataViewPrototypeGet(
+          node, ExternalArrayType::kExternalFloat32Array);
+    case Builtins::kDataViewPrototypeGetFloat64:
+      return ReduceDataViewPrototypeGet(
+          node, ExternalArrayType::kExternalFloat64Array);
+    case Builtins::kDataViewPrototypeSetUint8:
+      return ReduceDataViewPrototypeSet(node,
+                                        ExternalArrayType::kExternalUint8Array);
+    case Builtins::kDataViewPrototypeSetInt8:
+      return ReduceDataViewPrototypeSet(node,
+                                        ExternalArrayType::kExternalInt8Array);
+    case Builtins::kDataViewPrototypeSetUint16:
+      return ReduceDataViewPrototypeSet(
+          node, ExternalArrayType::kExternalUint16Array);
+    case Builtins::kDataViewPrototypeSetInt16:
+      return ReduceDataViewPrototypeSet(node,
+                                        ExternalArrayType::kExternalInt16Array);
+    case Builtins::kDataViewPrototypeSetUint32:
+      return ReduceDataViewPrototypeSet(
+          node, ExternalArrayType::kExternalUint32Array);
+    case Builtins::kDataViewPrototypeSetInt32:
+      return ReduceDataViewPrototypeSet(node,
+                                        ExternalArrayType::kExternalInt32Array);
+    case Builtins::kDataViewPrototypeSetFloat32:
+      return ReduceDataViewPrototypeSet(
+          node, ExternalArrayType::kExternalFloat32Array);
+    case Builtins::kDataViewPrototypeSetFloat64:
+      return ReduceDataViewPrototypeSet(
+          node, ExternalArrayType::kExternalFloat64Array);
     case Builtins::kTypedArrayPrototypeByteLength:
       return ReduceArrayBufferViewAccessor(
           node, JS_TYPED_ARRAY_TYPE,
@@ -3471,10 +3566,18 @@ Reduction JSCallReducer::ReduceJSCall(Node* node,
       return ReduceNumberIsSafeInteger(node);
     case Builtins::kNumberIsNaN:
       return ReduceNumberIsNaN(node);
+    case Builtins::kNumberParseInt:
+      return ReduceNumberParseInt(node);
+    case Builtins::kGlobalIsFinite:
+      return ReduceGlobalIsFinite(node);
+    case Builtins::kGlobalIsNaN:
+      return ReduceGlobalIsNaN(node);
     case Builtins::kMapPrototypeGet:
       return ReduceMapPrototypeGet(node);
     case Builtins::kMapPrototypeHas:
       return ReduceMapPrototypeHas(node);
+    case Builtins::kRegExpPrototypeTest:
+      return ReduceRegExpPrototypeTest(node);
     case Builtins::kReturnReceiver:
       return ReduceReturnReceiver(node);
     case Builtins::kStringPrototypeIndexOf:
@@ -3519,10 +3622,6 @@ Reduction JSCallReducer::ReduceJSCall(Node* node,
       return ReduceAsyncFunctionPromiseCreate(node);
     case Builtins::kAsyncFunctionPromiseRelease:
       return ReduceAsyncFunctionPromiseRelease(node);
-    case Builtins::kPromiseCapabilityDefaultReject:
-      return ReducePromiseCapabilityDefaultReject(node);
-    case Builtins::kPromiseCapabilityDefaultResolve:
-      return ReducePromiseCapabilityDefaultResolve(node);
     case Builtins::kPromiseInternalConstructor:
       return ReducePromiseInternalConstructor(node);
     case Builtins::kPromiseInternalReject:
@@ -3562,6 +3661,10 @@ Reduction JSCallReducer::ReduceJSCall(Node* node,
       return ReduceCollectionIteratorPrototypeNext(
           node, OrderedHashSet::kEntrySize, factory()->empty_ordered_hash_set(),
           FIRST_SET_ITERATOR_TYPE, LAST_SET_ITERATOR_TYPE);
+    case Builtins::kDatePrototypeGetTime:
+      return ReduceDatePrototypeGetTime(node);
+    case Builtins::kDateNow:
+      return ReduceDateNow(node);
     default:
       break;
   }
@@ -3614,13 +3717,15 @@ Reduction JSCallReducer::ReduceJSConstruct(Node* node) {
       return NoChange();
     }
 
-    Handle<Object> feedback(nexus.GetFeedback(), isolate());
-    if (feedback->IsAllocationSite()) {
+    HeapObject* feedback_object;
+    if (nexus.GetFeedback()->ToStrongHeapObject(&feedback_object) &&
+        feedback_object->IsAllocationSite()) {
       // The feedback is an AllocationSite, which means we have called the
       // Array function and collected transition (and pretenuring) feedback
       // for the resulting arrays.  This has to be kept in sync with the
       // implementation in Ignition.
-      Handle<AllocationSite> site = Handle<AllocationSite>::cast(feedback);
+      Handle<AllocationSite> site(AllocationSite::cast(feedback_object),
+                                  isolate());
 
       // Retrieve the Array function from the {node}.
       Node* array_function = jsgraph()->HeapConstant(
@@ -3642,12 +3747,11 @@ Reduction JSCallReducer::ReduceJSConstruct(Node* node) {
       NodeProperties::ReplaceValueInput(node, array_function, 1);
       NodeProperties::ChangeOp(node, javascript()->CreateArray(arity, site));
       return Changed(node);
-    } else if (feedback->IsWeakCell() &&
+    } else if (nexus.GetFeedback()->ToWeakHeapObject(&feedback_object) &&
                !HeapObjectMatcher(new_target).HasValue()) {
-      Handle<WeakCell> cell = Handle<WeakCell>::cast(feedback);
-      if (cell->value()->IsConstructor()) {
-        Node* new_target_feedback =
-            jsgraph()->Constant(handle(cell->value(), isolate()));
+      Handle<HeapObject> object(feedback_object, isolate());
+      if (object->IsConstructor()) {
+        Node* new_target_feedback = jsgraph()->Constant(object);
 
         // Check that the {new_target} is still the {new_target_feedback}.
         Node* check = graph()->NewNode(simplified()->ReferenceEqual(),
@@ -4174,20 +4278,17 @@ Reduction JSCallReducer::ReduceSoftDeoptimize(Node* node,
 namespace {
 
 // TODO(turbofan): This was copied from Crankshaft, might be too restrictive.
-bool IsReadOnlyLengthDescriptor(Handle<Map> jsarray_map) {
+bool IsReadOnlyLengthDescriptor(Isolate* isolate, Handle<Map> jsarray_map) {
   DCHECK(!jsarray_map->is_dictionary_map());
-  Isolate* isolate = jsarray_map->GetIsolate();
   Handle<Name> length_string = isolate->factory()->length_string();
   DescriptorArray* descriptors = jsarray_map->instance_descriptors();
-  int number =
-      descriptors->SearchWithCache(isolate, *length_string, *jsarray_map);
+  int number = descriptors->Search(*length_string, *jsarray_map);
   DCHECK_NE(DescriptorArray::kNotFound, number);
   return descriptors->GetDetails(number).IsReadOnly();
 }
 
 // TODO(turbofan): This was copied from Crankshaft, might be too restrictive.
-bool CanInlineArrayResizeOperation(Handle<Map> receiver_map) {
-  Isolate* const isolate = receiver_map->GetIsolate();
+bool CanInlineArrayResizeOperation(Isolate* isolate, Handle<Map> receiver_map) {
   if (!receiver_map->prototype()->IsJSArray()) return false;
   Handle<JSArray> receiver_prototype(JSArray::cast(receiver_map->prototype()),
                                      isolate);
@@ -4195,7 +4296,7 @@ bool CanInlineArrayResizeOperation(Handle<Map> receiver_map) {
          IsFastElementsKind(receiver_map->elements_kind()) &&
          !receiver_map->is_dictionary_map() && receiver_map->is_extensible() &&
          isolate->IsAnyInitialArrayPrototype(receiver_prototype) &&
-         !IsReadOnlyLengthDescriptor(receiver_map);
+         !IsReadOnlyLengthDescriptor(isolate, receiver_map);
 }
 
 }  // namespace
@@ -4218,20 +4319,22 @@ Reduction JSCallReducer::ReduceArrayPrototypePush(Node* node) {
   // Try to determine the {receiver} map(s).
   ZoneHandleSet<Map> receiver_maps;
   NodeProperties::InferReceiverMapsResult result =
-      NodeProperties::InferReceiverMaps(receiver, effect, &receiver_maps);
+      NodeProperties::InferReceiverMaps(isolate(), receiver, effect,
+                                        &receiver_maps);
   if (result == NodeProperties::kNoReceiverMaps) return NoChange();
   DCHECK_NE(0, receiver_maps.size());
 
   ElementsKind kind = receiver_maps[0]->elements_kind();
 
   for (Handle<Map> receiver_map : receiver_maps) {
-    if (!CanInlineArrayResizeOperation(receiver_map)) return NoChange();
+    if (!CanInlineArrayResizeOperation(isolate(), receiver_map))
+      return NoChange();
     if (!UnionElementsKindUptoPackedness(&kind, receiver_map->elements_kind()))
       return NoChange();
   }
 
   // Install code dependencies on the {receiver} global array protector cell.
-  dependencies()->AssumePropertyCell(factory()->no_elements_protector());
+  dependencies()->DependOnProtector(factory()->no_elements_protector());
 
   // If the {receiver_maps} information is not reliable, we need
   // to check that the {receiver} still has one of these maps.
@@ -4327,13 +4430,15 @@ Reduction JSCallReducer::ReduceArrayPrototypePop(Node* node) {
 
   ZoneHandleSet<Map> receiver_maps;
   NodeProperties::InferReceiverMapsResult result =
-      NodeProperties::InferReceiverMaps(receiver, effect, &receiver_maps);
+      NodeProperties::InferReceiverMaps(isolate(), receiver, effect,
+                                        &receiver_maps);
   if (result == NodeProperties::kNoReceiverMaps) return NoChange();
   DCHECK_NE(0, receiver_maps.size());
 
   ElementsKind kind = receiver_maps[0]->elements_kind();
   for (Handle<Map> receiver_map : receiver_maps) {
-    if (!CanInlineArrayResizeOperation(receiver_map)) return NoChange();
+    if (!CanInlineArrayResizeOperation(isolate(), receiver_map))
+      return NoChange();
     // TODO(turbofan): Extend this to also handle fast holey double elements
     // once we got the hole NaN mess sorted out in TurboFan/V8.
     if (receiver_map->elements_kind() == HOLEY_DOUBLE_ELEMENTS)
@@ -4343,7 +4448,7 @@ Reduction JSCallReducer::ReduceArrayPrototypePop(Node* node) {
   }
 
   // Install code dependencies on the {receiver} global array protector cell.
-  dependencies()->AssumePropertyCell(factory()->no_elements_protector());
+  dependencies()->DependOnProtector(factory()->no_elements_protector());
 
   // If the {receiver_maps} information is not reliable, we need
   // to check that the {receiver} still has one of these maps.
@@ -4443,13 +4548,15 @@ Reduction JSCallReducer::ReduceArrayPrototypeShift(Node* node) {
 
   ZoneHandleSet<Map> receiver_maps;
   NodeProperties::InferReceiverMapsResult result =
-      NodeProperties::InferReceiverMaps(receiver, effect, &receiver_maps);
+      NodeProperties::InferReceiverMaps(isolate(), receiver, effect,
+                                        &receiver_maps);
   if (result == NodeProperties::kNoReceiverMaps) return NoChange();
   DCHECK_NE(0, receiver_maps.size());
 
   ElementsKind kind = receiver_maps[0]->elements_kind();
   for (Handle<Map> receiver_map : receiver_maps) {
-    if (!CanInlineArrayResizeOperation(receiver_map)) return NoChange();
+    if (!CanInlineArrayResizeOperation(isolate(), receiver_map))
+      return NoChange();
     // TODO(turbofan): Extend this to also handle fast holey double elements
     // once we got the hole NaN mess sorted out in TurboFan/V8.
     if (receiver_map->elements_kind() == HOLEY_DOUBLE_ELEMENTS)
@@ -4459,7 +4566,7 @@ Reduction JSCallReducer::ReduceArrayPrototypeShift(Node* node) {
   }
 
   // Install code dependencies on the {receiver} global array protector cell.
-  dependencies()->AssumePropertyCell(factory()->no_elements_protector());
+  dependencies()->DependOnProtector(factory()->no_elements_protector());
 
   // If the {receiver_maps} information is not reliable, we need
   // to check that the {receiver} still has one of these maps.
@@ -4584,8 +4691,8 @@ Reduction JSCallReducer::ReduceArrayPrototypeShift(Node* node) {
       Node* stub_code =
           jsgraph()->CEntryStubConstant(1, kDontSaveFPRegs, kArgvOnStack, true);
       Address builtin_entry = Builtins::CppEntryOf(builtin_index);
-      Node* entry = jsgraph()->ExternalConstant(
-          ExternalReference(builtin_entry, isolate()));
+      Node* entry =
+          jsgraph()->ExternalConstant(ExternalReference::Create(builtin_entry));
       Node* argc =
           jsgraph()->Constant(BuiltinArguments::kNumExtraArgsWithReceiver);
       if_false1 = efalse1 = vfalse1 =
@@ -4619,6 +4726,30 @@ Reduction JSCallReducer::ReduceArrayPrototypeShift(Node* node) {
     return Replace(value);
 }
 
+// ES6 section 22.1.2.2 Array.isArray ( arg )
+Reduction JSCallReducer::ReduceArrayIsArray(Node* node) {
+  // We certainly know that undefined is not an array.
+  if (node->op()->ValueInputCount() < 3) {
+    Node* value = jsgraph()->FalseConstant();
+    ReplaceWithValue(node, value);
+    return Replace(value);
+  }
+
+  Node* effect = NodeProperties::GetEffectInput(node);
+  Node* control = NodeProperties::GetControlInput(node);
+  Node* context = NodeProperties::GetContextInput(node);
+  Node* frame_state = NodeProperties::GetFrameStateInput(node);
+  Node* object = NodeProperties::GetValueInput(node, 2);
+  node->ReplaceInput(0, object);
+  node->ReplaceInput(1, context);
+  node->ReplaceInput(2, frame_state);
+  node->ReplaceInput(3, effect);
+  node->ReplaceInput(4, control);
+  node->TrimInputCount(5);
+  NodeProperties::ChangeOp(node, javascript()->ObjectIsArray());
+  return Changed(node);
+}
+
 Reduction JSCallReducer::ReduceArrayIterator(Node* node, IterationKind kind) {
   DCHECK_EQ(IrOpcode::kJSCall, node->opcode());
   Node* receiver = NodeProperties::GetValueInput(node, 1);
@@ -4629,7 +4760,8 @@ Reduction JSCallReducer::ReduceArrayIterator(Node* node, IterationKind kind) {
   // Check if we know that {receiver} is a valid JSReceiver.
   ZoneHandleSet<Map> receiver_maps;
   NodeProperties::InferReceiverMapsResult result =
-      NodeProperties::InferReceiverMaps(receiver, effect, &receiver_maps);
+      NodeProperties::InferReceiverMaps(isolate(), receiver, effect,
+                                        &receiver_maps);
   if (result == NodeProperties::kNoReceiverMaps) return NoChange();
   DCHECK_NE(0, receiver_maps.size());
   for (Handle<Map> receiver_map : receiver_maps) {
@@ -4649,14 +4781,14 @@ Reduction JSCallReducer::ReduceArrayIterator(Node* node, IterationKind kind) {
 
 namespace {
 
-bool InferIteratedObjectMaps(Node* iterator,
+bool InferIteratedObjectMaps(Isolate* isolate, Node* iterator,
                              ZoneHandleSet<Map>* iterated_object_maps) {
   DCHECK_EQ(IrOpcode::kJSCreateArrayIterator, iterator->opcode());
   Node* iterated_object = NodeProperties::GetValueInput(iterator, 0);
   Node* effect = NodeProperties::GetEffectInput(iterator);
 
   NodeProperties::InferReceiverMapsResult result =
-      NodeProperties::InferReceiverMaps(iterated_object, effect,
+      NodeProperties::InferReceiverMaps(isolate, iterated_object, effect,
                                         iterated_object_maps);
   return result != NodeProperties::kNoReceiverMaps;
 }
@@ -4683,7 +4815,7 @@ Reduction JSCallReducer::ReduceArrayIteratorPrototypeNext(Node* node) {
 
   // Try to infer the [[IteratedObject]] maps from the {iterator}.
   ZoneHandleSet<Map> iterated_object_maps;
-  if (!InferIteratedObjectMaps(iterator, &iterated_object_maps)) {
+  if (!InferIteratedObjectMaps(isolate(), iterator, &iterated_object_maps)) {
     return NoChange();
   }
   DCHECK_NE(0, iterated_object_maps.size());
@@ -4703,7 +4835,7 @@ Reduction JSCallReducer::ReduceArrayIteratorPrototypeNext(Node* node) {
     }
   } else {
     for (Handle<Map> iterated_object_map : iterated_object_maps) {
-      if (!CanInlineArrayIteratingBuiltin(iterated_object_map)) {
+      if (!CanInlineArrayIteratingBuiltin(isolate(), iterated_object_map)) {
         return NoChange();
       }
       if (!UnionElementsKindUptoSize(&elements_kind,
@@ -4715,7 +4847,7 @@ Reduction JSCallReducer::ReduceArrayIteratorPrototypeNext(Node* node) {
 
   // Install code dependency on the array protector for holey arrays.
   if (IsHoleyElementsKind(elements_kind)) {
-    dependencies()->AssumePropertyCell(factory()->no_elements_protector());
+    dependencies()->DependOnProtector(factory()->no_elements_protector());
   }
 
   // Load the (current) {iterated_object} from the {iterator}; this might be
@@ -4739,7 +4871,7 @@ Reduction JSCallReducer::ReduceArrayIteratorPrototypeNext(Node* node) {
     if (isolate()->IsArrayBufferNeuteringIntact()) {
       // Add a code dependency so we are deoptimized in case an ArrayBuffer
       // gets neutered.
-      dependencies()->AssumePropertyCell(
+      dependencies()->DependOnProtector(
           factory()->array_buffer_neutering_protector());
     } else {
       // Deoptimize if the array buffer was neutered.
@@ -4796,7 +4928,7 @@ Reduction JSCallReducer::ReduceArrayIteratorPrototypeNext(Node* node) {
     // We know that the {index} is range of the {length} now.
     index = etrue = graph()->NewNode(
         common()->TypeGuard(
-            Type::Range(0.0, length_access.type->Max() - 1.0, graph()->zone())),
+            Type::Range(0.0, length_access.type.Max() - 1.0, graph()->zone())),
         index, etrue, if_true);
 
     done_true = jsgraph()->FalseConstant();
@@ -4940,8 +5072,7 @@ Reduction JSCallReducer::ReduceStringPrototypeStringAt(
                                     index, receiver_length, effect, control);
 
   // Return the character from the {receiver} as single character string.
-  Node* masked_index = graph()->NewNode(simplified()->MaskIndexWithBound(),
-                                        index, receiver_length);
+  Node* masked_index = graph()->NewNode(simplified()->PoisonIndex(), index);
   Node* value = effect = graph()->NewNode(string_access_operator, receiver,
                                           masked_index, effect, control);
 
@@ -4977,8 +5108,7 @@ Reduction JSCallReducer::ReduceStringPrototypeCharAt(Node* node) {
                                     index, receiver_length, effect, control);
 
   // Return the character from the {receiver} as single character string.
-  Node* masked_index = graph()->NewNode(simplified()->MaskIndexWithBound(),
-                                        index, receiver_length);
+  Node* masked_index = graph()->NewNode(simplified()->PoisonIndex(), index);
   Node* value = effect =
       graph()->NewNode(simplified()->StringCharCodeAt(), receiver, masked_index,
                        effect, control);
@@ -5110,7 +5240,7 @@ Reduction JSCallReducer::ReduceStringIteratorPrototypeNext(Node* node) {
   Node* effect = NodeProperties::GetEffectInput(node);
   Node* control = NodeProperties::GetControlInput(node);
   Node* context = NodeProperties::GetContextInput(node);
-  if (NodeProperties::HasInstanceTypeWitness(receiver, effect,
+  if (NodeProperties::HasInstanceTypeWitness(isolate(), receiver, effect,
                                              JS_STRING_ITERATOR_TYPE)) {
     Node* string = effect = graph()->NewNode(
         simplified()->LoadField(AccessBuilder::ForJSStringIteratorString()),
@@ -5201,10 +5331,10 @@ Reduction JSCallReducer::ReduceStringPrototypeConcat(
 
   Callable const callable =
       CodeFactory::StringAdd(isolate(), STRING_ADD_CHECK_NONE, NOT_TENURED);
-  auto call_descriptor = Linkage::GetStubCallDescriptor(
-      isolate(), graph()->zone(), callable.descriptor(), 0,
-      CallDescriptor::kNeedsFrameState,
-      Operator::kNoDeopt | Operator::kNoWrite);
+  auto call_descriptor =
+      Linkage::GetStubCallDescriptor(graph()->zone(), callable.descriptor(), 0,
+                                     CallDescriptor::kNeedsFrameState,
+                                     Operator::kNoDeopt | Operator::kNoWrite);
 
   // TODO(turbofan): Massage the FrameState of the {node} here once we
   // have an artificial builtin frame type, so that it looks like the
@@ -5227,7 +5357,7 @@ Reduction JSCallReducer::ReduceAsyncFunctionPromiseCreate(Node* node) {
   if (!isolate()->IsPromiseHookProtectorIntact()) return NoChange();
 
   // Install a code dependency on the promise hook protector cell.
-  dependencies()->AssumePropertyCell(factory()->promise_hook_protector());
+  dependencies()->DependOnProtector(factory()->promise_hook_protector());
 
   // Morph this {node} into a JSCreatePromise node.
   RelaxControls(node);
@@ -5242,8 +5372,7 @@ Reduction JSCallReducer::ReduceAsyncFunctionPromiseRelease(Node* node) {
   DCHECK_EQ(IrOpcode::kJSCall, node->opcode());
   if (!isolate()->IsPromiseHookProtectorIntact()) return NoChange();
 
-  // Install a code dependency on the promise hook protector cell.
-  dependencies()->AssumePropertyCell(factory()->promise_hook_protector());
+  dependencies()->DependOnProtector(factory()->promise_hook_protector());
 
   // The AsyncFunctionPromiseRelease builtin is a no-op as long as neither
   // the debugger is active nor any promise hook has been installed (ever).
@@ -5252,120 +5381,6 @@ Reduction JSCallReducer::ReduceAsyncFunctionPromiseRelease(Node* node) {
   return Replace(value);
 }
 
-// ES section #sec-promise-reject-functions
-Reduction JSCallReducer::ReducePromiseCapabilityDefaultReject(Node* node) {
-  DCHECK_EQ(IrOpcode::kJSCall, node->opcode());
-  Node* target = NodeProperties::GetValueInput(node, 0);
-  Node* resolution = node->op()->ValueInputCount() > 2
-                         ? NodeProperties::GetValueInput(node, 2)
-                         : jsgraph()->UndefinedConstant();
-  Node* frame_state = NodeProperties::GetFrameStateInput(node);
-  Node* effect = NodeProperties::GetEffectInput(node);
-  Node* control = NodeProperties::GetControlInput(node);
-
-  // We need to execute in the {target}s context.
-  Node* context = effect = graph()->NewNode(
-      simplified()->LoadField(AccessBuilder::ForJSFunctionContext()), target,
-      effect, control);
-
-  // Grab the promise closed over by {target}.
-  Node* promise = effect =
-      graph()->NewNode(simplified()->LoadField(AccessBuilder::ForContextSlot(
-                           PromiseBuiltinsAssembler::kPromiseSlot)),
-                       context, effect, control);
-
-  // Check if the {promise} is still pending or already settled.
-  Node* check = graph()->NewNode(simplified()->ReferenceEqual(), promise,
-                                 jsgraph()->UndefinedConstant());
-  Node* branch =
-      graph()->NewNode(common()->Branch(BranchHint::kFalse), check, control);
-
-  Node* if_true = graph()->NewNode(common()->IfTrue(), branch);
-  Node* etrue = effect;
-
-  Node* if_false = graph()->NewNode(common()->IfFalse(), branch);
-  Node* efalse = effect;
-  {
-    // Mark the {promise} as settled.
-    efalse = graph()->NewNode(
-        simplified()->StoreField(AccessBuilder::ForContextSlot(
-            PromiseBuiltinsAssembler::kPromiseSlot)),
-        context, jsgraph()->UndefinedConstant(), efalse, if_false);
-
-    // Check if we should emit a debug event.
-    Node* debug_event = efalse =
-        graph()->NewNode(simplified()->LoadField(AccessBuilder::ForContextSlot(
-                             PromiseBuiltinsAssembler::kDebugEventSlot)),
-                         context, efalse, if_false);
-
-    // Actually reject the {promise}.
-    efalse =
-        graph()->NewNode(javascript()->RejectPromise(), promise, resolution,
-                         debug_event, context, frame_state, efalse, if_false);
-  }
-
-  control = graph()->NewNode(common()->Merge(2), if_true, if_false);
-  effect = graph()->NewNode(common()->EffectPhi(2), etrue, efalse, control);
-
-  Node* value = jsgraph()->UndefinedConstant();
-  ReplaceWithValue(node, value, effect, control);
-  return Replace(value);
-}
-
-// ES section #sec-promise-resolve-functions
-Reduction JSCallReducer::ReducePromiseCapabilityDefaultResolve(Node* node) {
-  DCHECK_EQ(IrOpcode::kJSCall, node->opcode());
-  Node* target = NodeProperties::GetValueInput(node, 0);
-  Node* resolution = node->op()->ValueInputCount() > 2
-                         ? NodeProperties::GetValueInput(node, 2)
-                         : jsgraph()->UndefinedConstant();
-  Node* frame_state = NodeProperties::GetFrameStateInput(node);
-  Node* effect = NodeProperties::GetEffectInput(node);
-  Node* control = NodeProperties::GetControlInput(node);
-
-  // We need to execute in the {target}s context.
-  Node* context = effect = graph()->NewNode(
-      simplified()->LoadField(AccessBuilder::ForJSFunctionContext()), target,
-      effect, control);
-
-  // Grab the promise closed over by {target}.
-  Node* promise = effect =
-      graph()->NewNode(simplified()->LoadField(AccessBuilder::ForContextSlot(
-                           PromiseBuiltinsAssembler::kPromiseSlot)),
-                       context, effect, control);
-
-  // Check if the {promise} is still pending or already settled.
-  Node* check = graph()->NewNode(simplified()->ReferenceEqual(), promise,
-                                 jsgraph()->UndefinedConstant());
-  Node* branch =
-      graph()->NewNode(common()->Branch(BranchHint::kFalse), check, control);
-
-  Node* if_true = graph()->NewNode(common()->IfTrue(), branch);
-  Node* etrue = effect;
-
-  Node* if_false = graph()->NewNode(common()->IfFalse(), branch);
-  Node* efalse = effect;
-  {
-    // Mark the {promise} as settled.
-    efalse = graph()->NewNode(
-        simplified()->StoreField(AccessBuilder::ForContextSlot(
-            PromiseBuiltinsAssembler::kPromiseSlot)),
-        context, jsgraph()->UndefinedConstant(), efalse, if_false);
-
-    // Actually resolve the {promise}.
-    efalse =
-        graph()->NewNode(javascript()->ResolvePromise(), promise, resolution,
-                         context, frame_state, efalse, if_false);
-  }
-
-  control = graph()->NewNode(common()->Merge(2), if_true, if_false);
-  effect = graph()->NewNode(common()->EffectPhi(2), etrue, efalse, control);
-
-  Node* value = jsgraph()->UndefinedConstant();
-  ReplaceWithValue(node, value, effect, control);
-  return Replace(value);
-}
-
 Node* JSCallReducer::CreateArtificialFrameState(
     Node* node, Node* outer_frame_state, int parameter_count,
     BailoutId bailout_id, FrameStateType frame_state_type,
@@ -5412,11 +5427,10 @@ Reduction JSCallReducer::ReducePromiseConstructor(Node* node) {
   // Only handle builtins Promises, not subclasses.
   if (target != new_target) return NoChange();
 
-  // Add a code dependency on the promise hook protector.
-  dependencies()->AssumePropertyCell(factory()->promise_hook_protector());
+  dependencies()->DependOnProtector(factory()->promise_hook_protector());
 
   Handle<SharedFunctionInfo> promise_shared(
-      handle(native_context()->promise_function()->shared()));
+      handle(native_context()->promise_function()->shared(), isolate()));
 
   // Insert a construct stub frame into the chain of frame states. This will
   // reconstruct the proper frame when deoptimizing within the constructor.
@@ -5455,14 +5469,21 @@ Reduction JSCallReducer::ReducePromiseConstructor(Node* node) {
 
   // 8. CreatePromiseResolvingFunctions
   // Allocate a promise context for the closures below.
-  Node* promise_context = effect = graph()->NewNode(
-      javascript()->CreateFunctionContext(
-          PromiseBuiltinsAssembler::kPromiseContextLength, FUNCTION_SCOPE),
-      context, context, effect, control);
+  Node* promise_context = effect =
+      graph()->NewNode(javascript()->CreateFunctionContext(
+                           handle(native_context()->scope_info(), isolate()),
+                           PromiseBuiltinsAssembler::kPromiseContextLength -
+                               Context::MIN_CONTEXT_SLOTS,
+                           FUNCTION_SCOPE),
+                       context, effect, control);
   effect =
       graph()->NewNode(simplified()->StoreField(AccessBuilder::ForContextSlot(
                            PromiseBuiltinsAssembler::kPromiseSlot)),
                        promise_context, promise, effect, control);
+  effect = graph()->NewNode(
+      simplified()->StoreField(AccessBuilder::ForContextSlot(
+          PromiseBuiltinsAssembler::kAlreadyResolvedSlot)),
+      promise_context, jsgraph()->FalseConstant(), effect, control);
   effect = graph()->NewNode(
       simplified()->StoreField(AccessBuilder::ForContextSlot(
           PromiseBuiltinsAssembler::kDebugEventSlot)),
@@ -5563,8 +5584,7 @@ Reduction JSCallReducer::ReducePromiseInternalConstructor(Node* node) {
   // Check that promises aren't being observed through (debug) hooks.
   if (!isolate()->IsPromiseHookProtectorIntact()) return NoChange();
 
-  // Install a code dependency on the promise hook protector cell.
-  dependencies()->AssumePropertyCell(factory()->promise_hook_protector());
+  dependencies()->DependOnProtector(factory()->promise_hook_protector());
 
   // Create a new pending promise.
   Node* value = effect =
@@ -5642,7 +5662,8 @@ Reduction JSCallReducer::ReducePromisePrototypeCatch(Node* node) {
   // Check if we know something about {receiver} already.
   ZoneHandleSet<Map> receiver_maps;
   NodeProperties::InferReceiverMapsResult result =
-      NodeProperties::InferReceiverMaps(receiver, effect, &receiver_maps);
+      NodeProperties::InferReceiverMaps(isolate(), receiver, effect,
+                                        &receiver_maps);
   if (result == NodeProperties::kNoReceiverMaps) return NoChange();
   DCHECK_NE(0, receiver_maps.size());
 
@@ -5655,8 +5676,7 @@ Reduction JSCallReducer::ReducePromisePrototypeCatch(Node* node) {
     }
   }
 
-  // Add a code dependency on the necessary protectors.
-  dependencies()->AssumePropertyCell(factory()->promise_then_protector());
+  dependencies()->DependOnProtector(factory()->promise_then_protector());
 
   // If the {receiver_maps} aren't reliable, we need to repeat the
   // map check here, guarded by the CALL_IC.
@@ -5670,7 +5690,8 @@ Reduction JSCallReducer::ReducePromisePrototypeCatch(Node* node) {
   // Massage the {node} to call "then" instead by first removing all inputs
   // following the onRejected parameter, and then filling up the parameters
   // to two inputs from the left with undefined.
-  Node* target = jsgraph()->Constant(handle(native_context()->promise_then()));
+  Node* target =
+      jsgraph()->Constant(handle(native_context()->promise_then(), isolate()));
   NodeProperties::ReplaceValueInput(node, target, 0);
   NodeProperties::ReplaceEffectInput(node, effect);
   for (; arity > 1; --arity) node->RemoveInput(3);
@@ -5717,7 +5738,8 @@ Reduction JSCallReducer::ReducePromisePrototypeFinally(Node* node) {
   // Check if we know something about {receiver} already.
   ZoneHandleSet<Map> receiver_maps;
   NodeProperties::InferReceiverMapsResult result =
-      NodeProperties::InferReceiverMaps(receiver, effect, &receiver_maps);
+      NodeProperties::InferReceiverMaps(isolate(), receiver, effect,
+                                        &receiver_maps);
   if (result == NodeProperties::kNoReceiverMaps) return NoChange();
   DCHECK_NE(0, receiver_maps.size());
 
@@ -5730,10 +5752,9 @@ Reduction JSCallReducer::ReducePromisePrototypeFinally(Node* node) {
     }
   }
 
-  // Add a code dependency on the necessary protectors.
-  dependencies()->AssumePropertyCell(factory()->promise_hook_protector());
-  dependencies()->AssumePropertyCell(factory()->promise_then_protector());
-  dependencies()->AssumePropertyCell(factory()->promise_species_protector());
+  dependencies()->DependOnProtector(factory()->promise_hook_protector());
+  dependencies()->DependOnProtector(factory()->promise_then_protector());
+  dependencies()->DependOnProtector(factory()->promise_species_protector());
 
   // If the {receiver_maps} aren't reliable, we need to repeat the
   // map check here, guarded by the CALL_IC.
@@ -5762,9 +5783,11 @@ Reduction JSCallReducer::ReducePromisePrototypeFinally(Node* node) {
     // Allocate shared context for the closures below.
     context = etrue = graph()->NewNode(
         javascript()->CreateFunctionContext(
-            PromiseBuiltinsAssembler::kPromiseFinallyContextLength,
+            handle(native_context()->scope_info(), isolate()),
+            PromiseBuiltinsAssembler::kPromiseFinallyContextLength -
+                Context::MIN_CONTEXT_SLOTS,
             FUNCTION_SCOPE),
-        context, context, etrue, if_true);
+        context, etrue, if_true);
     etrue =
         graph()->NewNode(simplified()->StoreField(AccessBuilder::ForContextSlot(
                              PromiseBuiltinsAssembler::kOnFinallySlot)),
@@ -5816,7 +5839,8 @@ Reduction JSCallReducer::ReducePromisePrototypeFinally(Node* node) {
   // Massage the {node} to call "then" instead by first removing all inputs
   // following the onFinally parameter, and then replacing the only parameter
   // input with the {on_finally} value.
-  Node* target = jsgraph()->Constant(handle(native_context()->promise_then()));
+  Node* target =
+      jsgraph()->Constant(handle(native_context()->promise_then(), isolate()));
   NodeProperties::ReplaceValueInput(node, target, 0);
   NodeProperties::ReplaceEffectInput(node, effect);
   NodeProperties::ReplaceControlInput(node, control);
@@ -5864,7 +5888,8 @@ Reduction JSCallReducer::ReducePromisePrototypeThen(Node* node) {
   // Check if we know something about {receiver} already.
   ZoneHandleSet<Map> receiver_maps;
   NodeProperties::InferReceiverMapsResult infer_receiver_maps_result =
-      NodeProperties::InferReceiverMaps(receiver, effect, &receiver_maps);
+      NodeProperties::InferReceiverMaps(isolate(), receiver, effect,
+                                        &receiver_maps);
   if (infer_receiver_maps_result == NodeProperties::kNoReceiverMaps) {
     return NoChange();
   }
@@ -5879,9 +5904,8 @@ Reduction JSCallReducer::ReducePromisePrototypeThen(Node* node) {
     }
   }
 
-  // Add a code dependency on the necessary protectors.
-  dependencies()->AssumePropertyCell(factory()->promise_hook_protector());
-  dependencies()->AssumePropertyCell(factory()->promise_species_protector());
+  dependencies()->DependOnProtector(factory()->promise_hook_protector());
+  dependencies()->DependOnProtector(factory()->promise_species_protector());
 
   // If the {receiver_maps} aren't reliable, we need to repeat the
   // map check here, guarded by the CALL_IC.
@@ -5931,7 +5955,8 @@ Reduction JSCallReducer::ReducePromiseResolveTrampoline(Node* node) {
   // Check if we know something about {receiver} already.
   ZoneHandleSet<Map> receiver_maps;
   NodeProperties::InferReceiverMapsResult infer_receiver_maps_result =
-      NodeProperties::InferReceiverMaps(receiver, effect, &receiver_maps);
+      NodeProperties::InferReceiverMaps(isolate(), receiver, effect,
+                                        &receiver_maps);
   if (infer_receiver_maps_result == NodeProperties::kNoReceiverMaps) {
     return NoChange();
   }
@@ -6126,7 +6151,8 @@ Reduction JSCallReducer::ReduceMapPrototypeGet(Node* node) {
   Node* control = NodeProperties::GetControlInput(node);
   Node* key = NodeProperties::GetValueInput(node, 2);
 
-  if (!NodeProperties::HasInstanceTypeWitness(receiver, effect, JS_MAP_TYPE))
+  if (!NodeProperties::HasInstanceTypeWitness(isolate(), receiver, effect,
+                                              JS_MAP_TYPE))
     return NoChange();
 
   Node* table = effect = graph()->NewNode(
@@ -6170,7 +6196,8 @@ Reduction JSCallReducer::ReduceMapPrototypeHas(Node* node) {
   Node* control = NodeProperties::GetControlInput(node);
   Node* key = NodeProperties::GetValueInput(node, 2);
 
-  if (!NodeProperties::HasInstanceTypeWitness(receiver, effect, JS_MAP_TYPE))
+  if (!NodeProperties::HasInstanceTypeWitness(isolate(), receiver, effect,
+                                              JS_MAP_TYPE))
     return NoChange();
 
   Node* table = effect = graph()->NewNode(
@@ -6210,7 +6237,8 @@ Reduction JSCallReducer::ReduceCollectionIteration(
   Node* effect = NodeProperties::GetEffectInput(node);
   Node* control = NodeProperties::GetControlInput(node);
   if (NodeProperties::HasInstanceTypeWitness(
-          receiver, effect, InstanceTypeForCollectionKind(collection_kind))) {
+          isolate(), receiver, effect,
+          InstanceTypeForCollectionKind(collection_kind))) {
     Node* js_create_iterator = effect = graph()->NewNode(
         javascript()->CreateCollectionIterator(collection_kind, iteration_kind),
         receiver, context, effect, control);
@@ -6227,7 +6255,8 @@ Reduction JSCallReducer::ReduceCollectionPrototypeSize(
   Node* effect = NodeProperties::GetEffectInput(node);
   Node* control = NodeProperties::GetControlInput(node);
   if (NodeProperties::HasInstanceTypeWitness(
-          receiver, effect, InstanceTypeForCollectionKind(collection_kind))) {
+          isolate(), receiver, effect,
+          InstanceTypeForCollectionKind(collection_kind))) {
     Node* table = effect = graph()->NewNode(
         simplified()->LoadField(AccessBuilder::ForJSCollectionTable()),
         receiver, effect, control);
@@ -6267,7 +6296,8 @@ Reduction JSCallReducer::ReduceCollectionIteratorPrototypeNext(
   InstanceType receiver_instance_type;
   ZoneHandleSet<Map> receiver_maps;
   NodeProperties::InferReceiverMapsResult result =
-      NodeProperties::InferReceiverMaps(receiver, effect, &receiver_maps);
+      NodeProperties::InferReceiverMaps(isolate(), receiver, effect,
+                                        &receiver_maps);
   if (result == NodeProperties::kNoReceiverMaps) return NoChange();
   DCHECK_NE(0, receiver_maps.size());
   receiver_instance_type = receiver_maps[0]->instance_type();
@@ -6319,8 +6349,8 @@ Reduction JSCallReducer::ReduceCollectionIteratorPrototypeNext(
     Callable const callable =
         Builtins::CallableFor(isolate(), Builtins::kOrderedHashTableHealIndex);
     auto call_descriptor = Linkage::GetStubCallDescriptor(
-        isolate(), graph()->zone(), callable.descriptor(), 0,
-        CallDescriptor::kNoFlags, Operator::kEliminatable);
+        graph()->zone(), callable.descriptor(), 0, CallDescriptor::kNoFlags,
+        Operator::kEliminatable);
     index = effect =
         graph()->NewNode(common()->Call(call_descriptor),
                          jsgraph()->HeapConstant(callable.code()), table, index,
@@ -6542,7 +6572,8 @@ Reduction JSCallReducer::ReduceArrayBufferViewAccessor(
   Node* receiver = NodeProperties::GetValueInput(node, 1);
   Node* effect = NodeProperties::GetEffectInput(node);
   Node* control = NodeProperties::GetControlInput(node);
-  if (NodeProperties::HasInstanceTypeWitness(receiver, effect, instance_type)) {
+  if (NodeProperties::HasInstanceTypeWitness(isolate(), receiver, effect,
+                                             instance_type)) {
     // Load the {receiver}s field.
     Node* value = effect = graph()->NewNode(simplified()->LoadField(access),
                                             receiver, effect, control);
@@ -6551,16 +6582,15 @@ Reduction JSCallReducer::ReduceArrayBufferViewAccessor(
     if (isolate()->IsArrayBufferNeuteringIntact()) {
       // Add a code dependency so we are deoptimized in case an ArrayBuffer
       // gets neutered.
-      dependencies()->AssumePropertyCell(
+      dependencies()->DependOnProtector(
           factory()->array_buffer_neutering_protector());
     } else {
       // Check if the {receiver}s buffer was neutered.
-      Node* receiver_buffer = effect = graph()->NewNode(
+      Node* buffer = effect = graph()->NewNode(
           simplified()->LoadField(AccessBuilder::ForJSArrayBufferViewBuffer()),
           receiver, effect, control);
-      Node* check = effect =
-          graph()->NewNode(simplified()->ArrayBufferWasNeutered(),
-                           receiver_buffer, effect, control);
+      Node* check = effect = graph()->NewNode(
+          simplified()->ArrayBufferWasNeutered(), buffer, effect, control);
 
       // Default to zero if the {receiver}s buffer was neutered.
       value = graph()->NewNode(
@@ -6574,6 +6604,559 @@ Reduction JSCallReducer::ReduceArrayBufferViewAccessor(
   return NoChange();
 }
 
+namespace {
+int ExternalArrayElementSize(const ExternalArrayType element_type) {
+  switch (element_type) {
+#define TYPED_ARRAY_CASE(Type, type, TYPE, ctype, size) \
+  case kExternal##Type##Array:                          \
+    return size;
+    TYPED_ARRAYS(TYPED_ARRAY_CASE)
+    default:
+      UNREACHABLE();
+#undef TYPED_ARRAY_CASE
+  }
+}
+}  // namespace
+
+Reduction JSCallReducer::ReduceDataViewPrototypeGet(
+    Node* node, ExternalArrayType element_type) {
+  Node* effect = NodeProperties::GetEffectInput(node);
+  Node* control = NodeProperties::GetControlInput(node);
+  Node* receiver = NodeProperties::GetValueInput(node, 1);
+
+  Node* context = NodeProperties::GetContextInput(node);
+  Node* frame_state = NodeProperties::GetFrameStateInput(node);
+
+  CallParameters const& p = CallParametersOf(node->op());
+
+  Node* offset = node->op()->ValueInputCount() > 2
+                     ? NodeProperties::GetValueInput(node, 2)
+                     : jsgraph()->ZeroConstant();
+
+  Node* is_little_endian = node->op()->ValueInputCount() > 3
+                               ? NodeProperties::GetValueInput(node, 3)
+                               : jsgraph()->FalseConstant();
+
+  // Only do stuff if the {receiver} is really a DataView.
+  if (NodeProperties::HasInstanceTypeWitness(isolate(), receiver, effect,
+                                             JS_DATA_VIEW_TYPE)) {
+    // Check that the {offset} is a positive Smi.
+    offset = effect = graph()->NewNode(simplified()->CheckSmi(p.feedback()),
+                                       offset, effect, control);
+
+    Node* is_positive = graph()->NewNode(simplified()->NumberLessThanOrEqual(),
+                                         jsgraph()->ZeroConstant(), offset);
+
+    effect = graph()->NewNode(
+        simplified()->CheckIf(DeoptimizeReason::kNotASmi, p.feedback()),
+        is_positive, effect, control);
+
+    // Coerce {is_little_endian} to boolean.
+    is_little_endian =
+        graph()->NewNode(simplified()->ToBoolean(), is_little_endian);
+
+    // Get the underlying buffer and check that it has not been neutered.
+    Node* buffer = effect = graph()->NewNode(
+        simplified()->LoadField(AccessBuilder::ForJSArrayBufferViewBuffer()),
+        receiver, effect, control);
+
+    Node* check_neutered = effect = graph()->NewNode(
+        simplified()->ArrayBufferWasNeutered(), buffer, effect, control);
+    Node* branch_neutered = graph()->NewNode(
+        common()->Branch(BranchHint::kFalse), check_neutered, control);
+
+    // Raise an error if it was neuteured.
+    Node* if_true_neutered =
+        graph()->NewNode(common()->IfTrue(), branch_neutered);
+    Node* etrue_neutered = effect;
+    {
+      if_true_neutered = etrue_neutered = graph()->NewNode(
+          javascript()->CallRuntime(Runtime::kThrowTypeError, 2),
+          jsgraph()->Constant(MessageTemplate::kDetachedOperation),
+          jsgraph()->HeapConstant(
+              factory()->NewStringFromAsciiChecked("DataView.prototype.get")),
+          context, frame_state, etrue_neutered, if_true_neutered);
+    }
+
+    // Otherwise, proceed.
+    Node* if_false_neutered =
+        graph()->NewNode(common()->IfFalse(), branch_neutered);
+    Node* efalse_neutered = effect;
+
+    // Get the byte offset and byte length of the {receiver}.
+    Node* byte_offset = efalse_neutered =
+        graph()->NewNode(simplified()->LoadField(
+                             AccessBuilder::ForJSArrayBufferViewByteOffset()),
+                         receiver, efalse_neutered, if_false_neutered);
+
+    Node* byte_length = efalse_neutered =
+        graph()->NewNode(simplified()->LoadField(
+                             AccessBuilder::ForJSArrayBufferViewByteLength()),
+                         receiver, efalse_neutered, if_false_neutered);
+
+    // The end offset is the offset plus the element size
+    // of the type that we want to load.
+    int element_size = ExternalArrayElementSize(element_type);
+    Node* end_offset = graph()->NewNode(simplified()->NumberAdd(), offset,
+                                        jsgraph()->Constant(element_size));
+
+    // We need to check that {end_offset} <= {byte_length}, ie
+    // throw a RangeError if {byte_length} < {end_offset}.
+    Node* check_range = graph()->NewNode(simplified()->NumberLessThan(),
+                                         byte_length, end_offset);
+    Node* branch_range = graph()->NewNode(common()->Branch(BranchHint::kFalse),
+                                          check_range, if_false_neutered);
+
+    Node* if_true_range = graph()->NewNode(common()->IfTrue(), branch_range);
+    Node* etrue_range = efalse_neutered;
+    {
+      if_true_range = etrue_range = graph()->NewNode(
+          javascript()->CallRuntime(Runtime::kThrowRangeError, 2),
+          jsgraph()->Constant(MessageTemplate::kInvalidDataViewAccessorOffset),
+          jsgraph()->HeapConstant(
+              factory()->NewStringFromAsciiChecked("DataView.prototype.get")),
+          context, frame_state, etrue_range, if_true_range);
+    }
+
+    Node* if_false_range = graph()->NewNode(common()->IfFalse(), branch_range);
+    Node* efalse_range = efalse_neutered;
+    Node* vfalse_range;
+    {
+      // Get the buffer's backing store.
+      Node* backing_store = efalse_range =
+          graph()->NewNode(simplified()->LoadField(
+                               AccessBuilder::ForJSArrayBufferBackingStore()),
+                           buffer, efalse_range, if_false_range);
+
+      // Compute the buffer index at which we'll read.
+      Node* buffer_index =
+          graph()->NewNode(simplified()->NumberAdd(), offset, byte_offset);
+
+      // Perform the load.
+      vfalse_range = efalse_range =
+          graph()->NewNode(simplified()->LoadDataViewElement(element_type),
+                           buffer, backing_store, buffer_index,
+                           is_little_endian, efalse_range, if_false_range);
+    }
+
+    // Rewire potential exception edges.
+    Node* on_exception = nullptr;
+    if (NodeProperties::IsExceptionalCall(node, &on_exception)) {
+      // Create appropriate {IfException} and {IfSuccess} nodes.
+      Node* extrue_neutered = graph()->NewNode(
+          common()->IfException(), etrue_neutered,
+          if_true_neutered);  // We threw because the array was neutered.
+      if_true_neutered =
+          graph()->NewNode(common()->IfSuccess(), if_true_neutered);
+
+      Node* extrue_range =
+          graph()->NewNode(common()->IfException(), etrue_range,
+                           if_true_range);  // We threw because out of bounds.
+      if_true_range = graph()->NewNode(common()->IfSuccess(), if_true_range);
+
+      // We can't throw in LoadDataViewElement(),
+      // so we don't need to handle that path here.
+
+      // Join the exception edges.
+      Node* merge =
+          graph()->NewNode(common()->Merge(2), extrue_neutered, extrue_range);
+      Node* ephi = graph()->NewNode(common()->EffectPhi(2), extrue_neutered,
+                                    extrue_range, merge);
+      Node* phi =
+          graph()->NewNode(common()->Phi(MachineRepresentation::kTagged, 2),
+                           extrue_neutered, extrue_range, merge);
+      ReplaceWithValue(on_exception, phi, ephi, merge);
+    }
+
+    // Connect the throwing paths to end.
+    if_true_neutered =
+        graph()->NewNode(common()->Throw(), etrue_neutered, if_true_neutered);
+    NodeProperties::MergeControlToEnd(graph(), common(), if_true_neutered);
+    if_true_range =
+        graph()->NewNode(common()->Throw(), etrue_range, if_true_range);
+    NodeProperties::MergeControlToEnd(graph(), common(), if_true_range);
+
+    // Continue on the regular path.
+    ReplaceWithValue(node, vfalse_range, efalse_range, if_false_range);
+    return Changed(vfalse_range);
+  }
+
+  return NoChange();
+}
+Reduction JSCallReducer::ReduceDataViewPrototypeSet(
+    Node* node, ExternalArrayType element_type) {
+  Node* effect = NodeProperties::GetEffectInput(node);
+  Node* control = NodeProperties::GetControlInput(node);
+  Node* receiver = NodeProperties::GetValueInput(node, 1);
+
+  Node* context = NodeProperties::GetContextInput(node);
+  Node* frame_state = NodeProperties::GetFrameStateInput(node);
+
+  CallParameters const& p = CallParametersOf(node->op());
+
+  Node* offset = node->op()->ValueInputCount() > 2
+                     ? NodeProperties::GetValueInput(node, 2)
+                     : jsgraph()->ZeroConstant();
+
+  Node* value = node->op()->ValueInputCount() > 3
+                    ? NodeProperties::GetValueInput(node, 3)
+                    : jsgraph()->ZeroConstant();
+
+  Node* is_little_endian = node->op()->ValueInputCount() > 4
+                               ? NodeProperties::GetValueInput(node, 4)
+                               : jsgraph()->FalseConstant();
+
+  // Only do stuff if the {receiver} is really a DataView.
+  if (NodeProperties::HasInstanceTypeWitness(isolate(), receiver, effect,
+                                             JS_DATA_VIEW_TYPE)) {
+    // Check that the {offset} is a positive Smi.
+    offset = effect = graph()->NewNode(simplified()->CheckSmi(p.feedback()),
+                                       offset, effect, control);
+
+    Node* is_positive = graph()->NewNode(simplified()->NumberLessThanOrEqual(),
+                                         jsgraph()->ZeroConstant(), offset);
+
+    effect = graph()->NewNode(
+        simplified()->CheckIf(DeoptimizeReason::kNotASmi, p.feedback()),
+        is_positive, effect, control);
+
+    // Coerce {is_little_endian} to boolean.
+    is_little_endian =
+        graph()->NewNode(simplified()->ToBoolean(), is_little_endian);
+
+    // Coerce {value} to Number.
+    value = effect = graph()->NewNode(
+        simplified()->SpeculativeToNumber(NumberOperationHint::kNumberOrOddball,
+                                          p.feedback()),
+        value, effect, control);
+
+    // Get the underlying buffer and check that it has not been neutered.
+    Node* buffer = effect = graph()->NewNode(
+        simplified()->LoadField(AccessBuilder::ForJSArrayBufferViewBuffer()),
+        receiver, effect, control);
+
+    Node* check_neutered = effect = graph()->NewNode(
+        simplified()->ArrayBufferWasNeutered(), buffer, effect, control);
+    Node* branch_neutered = graph()->NewNode(
+        common()->Branch(BranchHint::kFalse), check_neutered, control);
+
+    // Raise an error if it was neuteured.
+    Node* if_true_neutered =
+        graph()->NewNode(common()->IfTrue(), branch_neutered);
+    Node* etrue_neutered = effect;
+    {
+      if_true_neutered = etrue_neutered = graph()->NewNode(
+          javascript()->CallRuntime(Runtime::kThrowTypeError, 2),
+          jsgraph()->Constant(MessageTemplate::kDetachedOperation),
+          jsgraph()->HeapConstant(
+              factory()->NewStringFromAsciiChecked("DataView.prototype.set")),
+          context, frame_state, etrue_neutered, if_true_neutered);
+    }
+
+    // Otherwise, proceed.
+    Node* if_false_neutered =
+        graph()->NewNode(common()->IfFalse(), branch_neutered);
+    Node* efalse_neutered = effect;
+
+    // Get the byte offset and byte length of the {receiver}.
+    Node* byte_offset = efalse_neutered =
+        graph()->NewNode(simplified()->LoadField(
+                             AccessBuilder::ForJSArrayBufferViewByteOffset()),
+                         receiver, efalse_neutered, if_false_neutered);
+
+    Node* byte_length = efalse_neutered =
+        graph()->NewNode(simplified()->LoadField(
+                             AccessBuilder::ForJSArrayBufferViewByteLength()),
+                         receiver, efalse_neutered, if_false_neutered);
+
+    // The end offset is the offset plus the element size
+    // of the type that we want to store.
+    int element_size = ExternalArrayElementSize(element_type);
+    Node* end_offset = graph()->NewNode(simplified()->NumberAdd(), offset,
+                                        jsgraph()->Constant(element_size));
+
+    // We need to check that {end_offset} <= {byte_length}, ie
+    // throw a RangeError if {byte_length} < {end_offset}.
+    Node* check_range = graph()->NewNode(simplified()->NumberLessThan(),
+                                         byte_length, end_offset);
+    Node* branch_range = graph()->NewNode(common()->Branch(BranchHint::kFalse),
+                                          check_range, if_false_neutered);
+
+    Node* if_true_range = graph()->NewNode(common()->IfTrue(), branch_range);
+    Node* etrue_range = efalse_neutered;
+    {
+      if_true_range = etrue_range = graph()->NewNode(
+          javascript()->CallRuntime(Runtime::kThrowRangeError, 2),
+          jsgraph()->Constant(MessageTemplate::kInvalidDataViewAccessorOffset),
+          jsgraph()->HeapConstant(
+              factory()->NewStringFromAsciiChecked("DataView.prototype.set")),
+          context, frame_state, etrue_range, if_true_range);
+    }
+
+    Node* if_false_range = graph()->NewNode(common()->IfFalse(), branch_range);
+    Node* efalse_range = efalse_neutered;
+    Node* vfalse_range = jsgraph()->UndefinedConstant();  // Return value.
+    {
+      // Get the buffer's backing store.
+      Node* backing_store = efalse_range =
+          graph()->NewNode(simplified()->LoadField(
+                               AccessBuilder::ForJSArrayBufferBackingStore()),
+                           buffer, efalse_range, if_false_range);
+
+      // Compute the buffer index at which we'll write.
+      Node* buffer_index =
+          graph()->NewNode(simplified()->NumberAdd(), offset, byte_offset);
+
+      // Perform the store.
+      efalse_range =
+          graph()->NewNode(simplified()->StoreDataViewElement(element_type),
+                           buffer, backing_store, buffer_index, value,
+                           is_little_endian, efalse_range, if_false_range);
+    }
+
+    // Rewire potential exception edges.
+    Node* on_exception = nullptr;
+    if (NodeProperties::IsExceptionalCall(node, &on_exception)) {
+      // Create appropriate {IfException} and {IfSuccess} nodes.
+      Node* extrue_neutered = graph()->NewNode(
+          common()->IfException(), etrue_neutered,
+          if_true_neutered);  // We threw because the array was neutered.
+      if_true_neutered =
+          graph()->NewNode(common()->IfSuccess(), if_true_neutered);
+
+      Node* extrue_range =
+          graph()->NewNode(common()->IfException(), etrue_range,
+                           if_true_range);  // We threw because out of bounds.
+      if_true_range = graph()->NewNode(common()->IfSuccess(), if_true_range);
+
+      // We can't throw in StoreDataViewElement(),
+      // so we don't need to handle that path here.
+
+      // Join the exception edges.
+      Node* merge =
+          graph()->NewNode(common()->Merge(2), extrue_neutered, extrue_range);
+      Node* ephi = graph()->NewNode(common()->EffectPhi(2), extrue_neutered,
+                                    extrue_range, merge);
+      Node* phi =
+          graph()->NewNode(common()->Phi(MachineRepresentation::kTagged, 2),
+                           extrue_neutered, extrue_range, merge);
+      ReplaceWithValue(on_exception, phi, ephi, merge);
+    }
+
+    // Connect the throwing paths to end.
+    if_true_neutered =
+        graph()->NewNode(common()->Throw(), etrue_neutered, if_true_neutered);
+    NodeProperties::MergeControlToEnd(graph(), common(), if_true_neutered);
+    if_true_range =
+        graph()->NewNode(common()->Throw(), etrue_range, if_true_range);
+    NodeProperties::MergeControlToEnd(graph(), common(), if_true_range);
+
+    // Continue on the regular path.
+    ReplaceWithValue(node, vfalse_range, efalse_range, if_false_range);
+    return Changed(vfalse_range);
+  }
+
+  return NoChange();
+}
+
+// ES6 section 18.2.2 isFinite ( number )
+Reduction JSCallReducer::ReduceGlobalIsFinite(Node* node) {
+  CallParameters const& p = CallParametersOf(node->op());
+  if (p.speculation_mode() == SpeculationMode::kDisallowSpeculation) {
+    return NoChange();
+  }
+  if (node->op()->ValueInputCount() < 3) {
+    Node* value = jsgraph()->FalseConstant();
+    ReplaceWithValue(node, value);
+    return Replace(value);
+  }
+
+  Node* effect = NodeProperties::GetEffectInput(node);
+  Node* control = NodeProperties::GetControlInput(node);
+  Node* input = NodeProperties::GetValueInput(node, 2);
+
+  input = effect =
+      graph()->NewNode(simplified()->SpeculativeToNumber(
+                           NumberOperationHint::kNumberOrOddball, p.feedback()),
+                       input, effect, control);
+  Node* value = graph()->NewNode(simplified()->NumberIsFinite(), input);
+  ReplaceWithValue(node, value, effect);
+  return Replace(value);
+}
+
+// ES6 section 18.2.3 isNaN ( number )
+Reduction JSCallReducer::ReduceGlobalIsNaN(Node* node) {
+  CallParameters const& p = CallParametersOf(node->op());
+  if (p.speculation_mode() == SpeculationMode::kDisallowSpeculation) {
+    return NoChange();
+  }
+  if (node->op()->ValueInputCount() < 3) {
+    Node* value = jsgraph()->TrueConstant();
+    ReplaceWithValue(node, value);
+    return Replace(value);
+  }
+
+  Node* effect = NodeProperties::GetEffectInput(node);
+  Node* control = NodeProperties::GetControlInput(node);
+  Node* input = NodeProperties::GetValueInput(node, 2);
+
+  input = effect =
+      graph()->NewNode(simplified()->SpeculativeToNumber(
+                           NumberOperationHint::kNumberOrOddball, p.feedback()),
+                       input, effect, control);
+  Node* value = graph()->NewNode(simplified()->NumberIsNaN(), input);
+  ReplaceWithValue(node, value, effect);
+  return Replace(value);
+}
+
+// ES6 section 20.3.4.10 Date.prototype.getTime ( )
+Reduction JSCallReducer::ReduceDatePrototypeGetTime(Node* node) {
+  Node* receiver = NodeProperties::GetValueInput(node, 1);
+  Node* effect = NodeProperties::GetEffectInput(node);
+  Node* control = NodeProperties::GetControlInput(node);
+  if (NodeProperties::HasInstanceTypeWitness(isolate(), receiver, effect,
+                                             JS_DATE_TYPE)) {
+    Node* value = effect = graph()->NewNode(
+        simplified()->LoadField(AccessBuilder::ForJSDateValue()), receiver,
+        effect, control);
+    ReplaceWithValue(node, value, effect, control);
+    return Replace(value);
+  }
+  return NoChange();
+}
+
+// ES6 section 20.3.3.1 Date.now ( )
+Reduction JSCallReducer::ReduceDateNow(Node* node) {
+  Node* effect = NodeProperties::GetEffectInput(node);
+  Node* control = NodeProperties::GetControlInput(node);
+  Node* value = effect =
+      graph()->NewNode(simplified()->DateNow(), effect, control);
+  ReplaceWithValue(node, value, effect, control);
+  return Replace(value);
+}
+
+// ES6 section 20.1.2.13 Number.parseInt ( string, radix )
+Reduction JSCallReducer::ReduceNumberParseInt(Node* node) {
+  // We certainly know that undefined is not an array.
+  if (node->op()->ValueInputCount() < 3) {
+    Node* value = jsgraph()->NaNConstant();
+    ReplaceWithValue(node, value);
+    return Replace(value);
+  }
+
+  int arg_count = node->op()->ValueInputCount();
+  Node* effect = NodeProperties::GetEffectInput(node);
+  Node* control = NodeProperties::GetControlInput(node);
+  Node* context = NodeProperties::GetContextInput(node);
+  Node* frame_state = NodeProperties::GetFrameStateInput(node);
+  Node* object = NodeProperties::GetValueInput(node, 2);
+  Node* radix = arg_count >= 4 ? NodeProperties::GetValueInput(node, 3)
+                               : jsgraph()->UndefinedConstant();
+  node->ReplaceInput(0, object);
+  node->ReplaceInput(1, radix);
+  node->ReplaceInput(2, context);
+  node->ReplaceInput(3, frame_state);
+  node->ReplaceInput(4, effect);
+  node->ReplaceInput(5, control);
+  node->TrimInputCount(6);
+  NodeProperties::ChangeOp(node, javascript()->ParseInt());
+  return Changed(node);
+}
+
+Reduction JSCallReducer::ReduceRegExpPrototypeTest(Node* node) {
+  if (FLAG_force_slow_path) return NoChange();
+  if (node->op()->ValueInputCount() < 3) return NoChange();
+  CallParameters const& p = CallParametersOf(node->op());
+  if (p.speculation_mode() == SpeculationMode::kDisallowSpeculation) {
+    return NoChange();
+  }
+
+  Node* effect = NodeProperties::GetEffectInput(node);
+  Node* control = NodeProperties::GetControlInput(node);
+  Node* regexp = NodeProperties::GetValueInput(node, 1);
+
+  // Check if we know something about the {regexp}.
+  ZoneHandleSet<Map> regexp_maps;
+  NodeProperties::InferReceiverMapsResult result =
+      NodeProperties::InferReceiverMaps(isolate(), regexp, effect,
+                                        &regexp_maps);
+
+  bool need_map_check = false;
+  switch (result) {
+    case NodeProperties::kNoReceiverMaps:
+      return NoChange();
+    case NodeProperties::kUnreliableReceiverMaps:
+      need_map_check = true;
+      break;
+    case NodeProperties::kReliableReceiverMaps:
+      break;
+  }
+
+  for (auto map : regexp_maps) {
+    if (map->instance_type() != JS_REGEXP_TYPE) return NoChange();
+  }
+
+  // Compute property access info for "exec" on {resolution}.
+  PropertyAccessInfo ai_exec;
+  AccessInfoFactory access_info_factory(dependencies(), js_heap_broker(),
+                                        native_context(), graph()->zone());
+  if (!access_info_factory.ComputePropertyAccessInfo(
+          MapHandles(regexp_maps.begin(), regexp_maps.end()),
+          factory()->exec_string(), AccessMode::kLoad, &ai_exec)) {
+    return NoChange();
+  }
+  // If "exec" has been modified on {regexp}, we can't do anything.
+  if (!ai_exec.IsDataConstant()) return NoChange();
+  Handle<Object> exec_on_proto = ai_exec.constant();
+  if (*exec_on_proto != *isolate()->regexp_exec_function()) return NoChange();
+
+  PropertyAccessBuilder access_builder(jsgraph(), dependencies());
+
+  // Add proper dependencies on the {regexp}s [[Prototype]]s.
+  Handle<JSObject> holder;
+  if (ai_exec.holder().ToHandle(&holder)) {
+    dependencies()->DependOnStablePrototypeChains(
+        native_context(), ai_exec.receiver_maps(), holder);
+  }
+
+  if (need_map_check) {
+    effect =
+        graph()->NewNode(simplified()->CheckMaps(CheckMapsFlag::kNone,
+                                                 regexp_maps, p.feedback()),
+                         regexp, effect, control);
+  }
+
+  Node* context = NodeProperties::GetContextInput(node);
+  Node* frame_state = NodeProperties::GetFrameStateInput(node);
+  Node* search = NodeProperties::GetValueInput(node, 2);
+  Node* search_string = effect = graph()->NewNode(
+      simplified()->CheckString(p.feedback()), search, effect, control);
+
+  Node* lastIndex = effect = graph()->NewNode(
+      simplified()->LoadField(AccessBuilder::ForJSRegExpLastIndex()), regexp,
+      effect, control);
+
+  Node* lastIndexSmi = effect = graph()->NewNode(
+      simplified()->CheckSmi(p.feedback()), lastIndex, effect, control);
+
+  Node* is_positive = graph()->NewNode(simplified()->NumberLessThanOrEqual(),
+                                       jsgraph()->ZeroConstant(), lastIndexSmi);
+
+  effect = graph()->NewNode(
+      simplified()->CheckIf(DeoptimizeReason::kNotASmi, p.feedback()),
+      is_positive, effect, control);
+
+  node->ReplaceInput(0, regexp);
+  node->ReplaceInput(1, search_string);
+  node->ReplaceInput(2, context);
+  node->ReplaceInput(3, frame_state);
+  node->ReplaceInput(4, effect);
+  node->ReplaceInput(5, control);
+  node->TrimInputCount(6);
+  NodeProperties::ChangeOp(node, javascript()->RegExpTest());
+  return Changed(node);
+}
+
 Graph* JSCallReducer::graph() const { return jsgraph()->graph(); }
 
 Isolate* JSCallReducer::isolate() const { return jsgraph()->isolate(); }
diff --git a/deps/v8/src/compiler/js-call-reducer.h b/deps/v8/src/compiler/js-call-reducer.h
index 36a5ac2e7a5da7..6e3f53164712de 100644
--- a/deps/v8/src/compiler/js-call-reducer.h
+++ b/deps/v8/src/compiler/js-call-reducer.h
@@ -14,7 +14,6 @@ namespace v8 {
 namespace internal {
 
 // Forward declarations.
-class CompilationDependencies;
 class Factory;
 class VectorSlotPair;
 
@@ -23,8 +22,10 @@ namespace compiler {
 // Forward declarations.
 class CallFrequency;
 class CommonOperatorBuilder;
+class CompilationDependencies;
 struct FieldAccess;
 class JSGraph;
+class JSHeapBroker;
 class JSOperatorBuilder;
 class SimplifiedOperatorBuilder;
 
@@ -36,11 +37,12 @@ class V8_EXPORT_PRIVATE JSCallReducer final : public AdvancedReducer {
   enum Flag { kNoFlags = 0u, kBailoutOnUninitialized = 1u << 0 };
   typedef base::Flags<Flag> Flags;
 
-  JSCallReducer(Editor* editor, JSGraph* jsgraph, Flags flags,
-                Handle<Context> native_context,
+  JSCallReducer(Editor* editor, JSGraph* jsgraph, JSHeapBroker* js_heap_broker,
+                Flags flags, Handle<Context> native_context,
                 CompilationDependencies* dependencies)
       : AdvancedReducer(editor),
         jsgraph_(jsgraph),
+        js_heap_broker_(js_heap_broker),
         flags_(flags),
         native_context_(native_context),
         dependencies_(dependencies) {}
@@ -69,6 +71,7 @@ class V8_EXPORT_PRIVATE JSCallReducer final : public AdvancedReducer {
   Reduction ReduceObjectPrototypeGetProto(Node* node);
   Reduction ReduceObjectPrototypeHasOwnProperty(Node* node);
   Reduction ReduceObjectPrototypeIsPrototypeOf(Node* node);
+  Reduction ReduceObjectCreate(Node* node);
   Reduction ReduceReflectApply(Node* node);
   Reduction ReduceReflectConstruct(Node* node);
   Reduction ReduceReflectGet(Node* node);
@@ -91,6 +94,7 @@ class V8_EXPORT_PRIVATE JSCallReducer final : public AdvancedReducer {
   Reduction ReduceArrayPrototypePush(Node* node);
   Reduction ReduceArrayPrototypePop(Node* node);
   Reduction ReduceArrayPrototypeShift(Node* node);
+  Reduction ReduceArrayIsArray(Node* node);
   enum class ArrayIteratorKind { kArray, kTypedArray };
   Reduction ReduceArrayIterator(Node* node, IterationKind kind);
   Reduction ReduceArrayIteratorPrototypeNext(Node* node);
@@ -107,6 +111,7 @@ class V8_EXPORT_PRIVATE JSCallReducer final : public AdvancedReducer {
   Reduction ReduceJSCall(Node* node, Handle<SharedFunctionInfo> shared);
   Reduction ReduceJSCallWithArrayLike(Node* node);
   Reduction ReduceJSCallWithSpread(Node* node);
+  Reduction ReduceRegExpPrototypeTest(Node* node);
   Reduction ReduceReturnReceiver(Node* node);
   Reduction ReduceStringPrototypeIndexOf(Node* node);
   Reduction ReduceStringPrototypeSubstring(Node* node);
@@ -130,8 +135,6 @@ class V8_EXPORT_PRIVATE JSCallReducer final : public AdvancedReducer {
 
   Reduction ReduceAsyncFunctionPromiseCreate(Node* node);
   Reduction ReduceAsyncFunctionPromiseRelease(Node* node);
-  Reduction ReducePromiseCapabilityDefaultReject(Node* node);
-  Reduction ReducePromiseCapabilityDefaultResolve(Node* node);
   Reduction ReducePromiseConstructor(Node* node);
   Reduction ReducePromiseInternalConstructor(Node* node);
   Reduction ReducePromiseInternalReject(Node* node);
@@ -158,6 +161,9 @@ class V8_EXPORT_PRIVATE JSCallReducer final : public AdvancedReducer {
   Reduction ReduceNumberIsSafeInteger(Node* node);
   Reduction ReduceNumberIsNaN(Node* node);
 
+  Reduction ReduceGlobalIsFinite(Node* node);
+  Reduction ReduceGlobalIsNaN(Node* node);
+
   Reduction ReduceMapPrototypeHas(Node* node);
   Reduction ReduceMapPrototypeGet(Node* node);
   Reduction ReduceCollectionIteration(Node* node,
@@ -175,6 +181,15 @@ class V8_EXPORT_PRIVATE JSCallReducer final : public AdvancedReducer {
                                           InstanceType instance_type,
                                           FieldAccess const& access);
 
+  Reduction ReduceDataViewPrototypeGet(Node* node,
+                                       ExternalArrayType element_type);
+  Reduction ReduceDataViewPrototypeSet(Node* node,
+                                       ExternalArrayType element_type);
+
+  Reduction ReduceDatePrototypeGetTime(Node* node);
+  Reduction ReduceDateNow(Node* node);
+  Reduction ReduceNumberParseInt(Node* node);
+
   // Returns the updated {to} node, and updates control and effect along the
   // way.
   Node* DoFilterPostCallbackWork(ElementsKind kind, Node** control,
@@ -216,6 +231,7 @@ class V8_EXPORT_PRIVATE JSCallReducer final : public AdvancedReducer {
 
   Graph* graph() const;
   JSGraph* jsgraph() const { return jsgraph_; }
+  const JSHeapBroker* js_heap_broker() const { return js_heap_broker_; }
   Isolate* isolate() const;
   Factory* factory() const;
   Handle<Context> native_context() const { return native_context_; }
@@ -227,6 +243,7 @@ class V8_EXPORT_PRIVATE JSCallReducer final : public AdvancedReducer {
   CompilationDependencies* dependencies() const { return dependencies_; }
 
   JSGraph* const jsgraph_;
+  const JSHeapBroker* const js_heap_broker_;
   Flags const flags_;
   Handle<Context> const native_context_;
   CompilationDependencies* const dependencies_;
diff --git a/deps/v8/src/compiler/js-context-specialization.cc b/deps/v8/src/compiler/js-context-specialization.cc
index 9f833b60eb4194..e11be7ea4852ec 100644
--- a/deps/v8/src/compiler/js-context-specialization.cc
+++ b/deps/v8/src/compiler/js-context-specialization.cc
@@ -17,6 +17,7 @@ namespace internal {
 namespace compiler {
 
 Reduction JSContextSpecialization::Reduce(Node* node) {
+  DisallowHeapAccess no_heap_access;
   switch (node->opcode()) {
     case IrOpcode::kParameter:
       return ReduceParameter(node);
@@ -99,12 +100,13 @@ bool IsContextParameter(Node* node) {
 // context (which we want to read from or store to), try to return a
 // specialization context.  If successful, update {distance} to whatever
 // distance remains from the specialization context.
-MaybeHandle<Context> GetSpecializationContext(Node* node, size_t* distance,
-                                              Maybe<OuterContext> maybe_outer) {
+base::Optional<ContextRef> GetSpecializationContext(
+    const JSHeapBroker* broker, Node* node, size_t* distance,
+    Maybe<OuterContext> maybe_outer) {
   switch (node->opcode()) {
     case IrOpcode::kHeapConstant: {
-      Handle<Object> object = HeapConstantOf(node->op());
-      if (object->IsContext()) return Handle<Context>::cast(object);
+      HeapObjectRef object(HeapConstantOf(node->op()));
+      if (object.IsContext()) return object.AsContext();
       break;
     }
     case IrOpcode::kParameter: {
@@ -112,14 +114,14 @@ MaybeHandle<Context> GetSpecializationContext(Node* node, size_t* distance,
       if (maybe_outer.To(&outer) && IsContextParameter(node) &&
           *distance >= outer.distance) {
         *distance -= outer.distance;
-        return outer.context;
+        return ContextRef(outer.context);
       }
       break;
     }
     default:
       break;
   }
-  return MaybeHandle<Context>();
+  return base::Optional<ContextRef>();
 }
 
 }  // anonymous namespace
@@ -133,39 +135,55 @@ Reduction JSContextSpecialization::ReduceJSLoadContext(Node* node) {
   // First walk up the context chain in the graph as far as possible.
   Node* context = NodeProperties::GetOuterContext(node, &depth);
 
-  Handle<Context> concrete;
-  if (!GetSpecializationContext(context, &depth, outer()).ToHandle(&concrete)) {
+  base::Optional<ContextRef> maybe_concrete =
+      GetSpecializationContext(js_heap_broker(), context, &depth, outer());
+  if (!maybe_concrete.has_value()) {
     // We do not have a concrete context object, so we can only partially reduce
     // the load by folding-in the outer context node.
     return SimplifyJSLoadContext(node, context, depth);
   }
 
   // Now walk up the concrete context chain for the remaining depth.
+  ContextRef concrete = maybe_concrete.value();
   for (; depth > 0; --depth) {
-    concrete = handle(concrete->previous(), isolate());
+    concrete = concrete.previous(js_heap_broker()).value();
   }
 
   if (!access.immutable()) {
     // We found the requested context object but since the context slot is
     // mutable we can only partially reduce the load.
-    return SimplifyJSLoadContext(node, jsgraph()->Constant(concrete), depth);
+    return SimplifyJSLoadContext(
+        node, jsgraph()->Constant(js_heap_broker(), concrete), depth);
   }
 
-  // Even though the context slot is immutable, the context might have escaped
-  // before the function to which it belongs has initialized the slot.
-  // We must be conservative and check if the value in the slot is currently
-  // the hole or undefined. Only if it is neither of these, can we be sure that
-  // it won't change anymore.
-  Handle<Object> value(concrete->get(static_cast<int>(access.index())),
-                       isolate());
-  if (value->IsUndefined(isolate()) || value->IsTheHole(isolate())) {
-    return SimplifyJSLoadContext(node, jsgraph()->Constant(concrete), depth);
+  // This will hold the final value, if we can figure it out.
+  base::Optional<ObjectRef> maybe_value;
+
+  maybe_value =
+      concrete.get(js_heap_broker(), static_cast<int>(access.index()));
+  if (maybe_value.has_value() && !maybe_value->IsSmi()) {
+    // Even though the context slot is immutable, the context might have escaped
+    // before the function to which it belongs has initialized the slot.
+    // We must be conservative and check if the value in the slot is currently
+    // the hole or undefined. Only if it is neither of these, can we be sure
+    // that it won't change anymore.
+    OddballType oddball_type = maybe_value->oddball_type(js_heap_broker());
+    if (oddball_type == OddballType::kUndefined ||
+        oddball_type == OddballType::kHole) {
+      maybe_value.reset();
+    }
+  }
+
+  if (!maybe_value.has_value()) {
+    return SimplifyJSLoadContext(
+        node, jsgraph()->Constant(js_heap_broker(), concrete), depth);
   }
 
   // Success. The context load can be replaced with the constant.
-  // TODO(titzer): record the specialization for sharing code across multiple
-  // contexts that have the same value in the corresponding context slot.
-  Node* constant = jsgraph_->Constant(value);
+  // TODO(titzer): record the specialization for sharing code across
+  // multiple contexts that have the same value in the corresponding context
+  // slot.
+  Node* constant = jsgraph_->Constant(js_heap_broker(), *maybe_value);
   ReplaceWithValue(node, constant);
   return Replace(constant);
 }
@@ -181,19 +199,22 @@ Reduction JSContextSpecialization::ReduceJSStoreContext(Node* node) {
   // or hit a node that does not have a CreateXYZContext operator.
   Node* context = NodeProperties::GetOuterContext(node, &depth);
 
-  Handle<Context> concrete;
-  if (!GetSpecializationContext(context, &depth, outer()).ToHandle(&concrete)) {
+  base::Optional<ContextRef> maybe_concrete =
+      GetSpecializationContext(js_heap_broker(), context, &depth, outer());
+  if (!maybe_concrete.has_value()) {
     // We do not have a concrete context object, so we can only partially reduce
     // the load by folding-in the outer context node.
     return SimplifyJSStoreContext(node, context, depth);
   }
 
   // Now walk up the concrete context chain for the remaining depth.
+  ContextRef concrete = maybe_concrete.value();
   for (; depth > 0; --depth) {
-    concrete = handle(concrete->previous(), isolate());
+    concrete = concrete.previous(js_heap_broker()).value();
   }
 
-  return SimplifyJSStoreContext(node, jsgraph()->Constant(concrete), depth);
+  return SimplifyJSStoreContext(
+      node, jsgraph()->Constant(js_heap_broker(), concrete), depth);
 }
 
 
diff --git a/deps/v8/src/compiler/js-context-specialization.h b/deps/v8/src/compiler/js-context-specialization.h
index 83949fa3ccb5a9..d2f56d50f1a839 100644
--- a/deps/v8/src/compiler/js-context-specialization.h
+++ b/deps/v8/src/compiler/js-context-specialization.h
@@ -33,12 +33,14 @@ struct OuterContext {
 class JSContextSpecialization final : public AdvancedReducer {
  public:
   JSContextSpecialization(Editor* editor, JSGraph* jsgraph,
+                          JSHeapBroker* js_heap_broker,
                           Maybe<OuterContext> outer,
                           MaybeHandle<JSFunction> closure)
       : AdvancedReducer(editor),
         jsgraph_(jsgraph),
         outer_(outer),
-        closure_(closure) {}
+        closure_(closure),
+        js_heap_broker_(js_heap_broker) {}
 
   const char* reducer_name() const override {
     return "JSContextSpecialization";
@@ -60,10 +62,12 @@ class JSContextSpecialization final : public AdvancedReducer {
   JSGraph* jsgraph() const { return jsgraph_; }
   Maybe<OuterContext> outer() const { return outer_; }
   MaybeHandle<JSFunction> closure() const { return closure_; }
+  const JSHeapBroker* js_heap_broker() const { return js_heap_broker_; }
 
   JSGraph* const jsgraph_;
   Maybe<OuterContext> outer_;
   MaybeHandle<JSFunction> closure_;
+  const JSHeapBroker* const js_heap_broker_;
 
   DISALLOW_COPY_AND_ASSIGN(JSContextSpecialization);
 };
diff --git a/deps/v8/src/compiler/js-create-lowering.cc b/deps/v8/src/compiler/js-create-lowering.cc
index 1db4965f667eb7..b550f277ca4318 100644
--- a/deps/v8/src/compiler/js-create-lowering.cc
+++ b/deps/v8/src/compiler/js-create-lowering.cc
@@ -4,21 +4,25 @@
 
 #include "src/compiler/js-create-lowering.h"
 
-#include "src/allocation-site-scopes.h"
 #include "src/code-factory.h"
-#include "src/compilation-dependencies.h"
 #include "src/compiler/access-builder.h"
 #include "src/compiler/allocation-builder.h"
 #include "src/compiler/common-operator.h"
+#include "src/compiler/compilation-dependencies.h"
 #include "src/compiler/js-graph.h"
 #include "src/compiler/js-operator.h"
 #include "src/compiler/linkage.h"
+#include "src/compiler/node-matchers.h"
 #include "src/compiler/node-properties.h"
 #include "src/compiler/node.h"
 #include "src/compiler/operator-properties.h"
 #include "src/compiler/simplified-operator.h"
 #include "src/compiler/state-values-utils.h"
 #include "src/objects-inl.h"
+#include "src/objects/arguments.h"
+#include "src/objects/hash-table-inl.h"
+#include "src/objects/js-promise.h"
+#include "src/objects/js-regexp-inl.h"
 
 namespace v8 {
 namespace internal {
@@ -37,11 +41,14 @@ Node* GetArgumentsFrameState(Node* frame_state) {
 
 // Checks whether allocation using the given target and new.target can be
 // inlined.
-bool IsAllocationInlineable(Handle<JSFunction> target,
-                            Handle<JSFunction> new_target) {
-  return new_target->has_initial_map() &&
-         !new_target->initial_map()->is_dictionary_map() &&
-         new_target->initial_map()->constructor_or_backpointer() == *target;
+bool IsAllocationInlineable(const JSFunctionRef& target,
+                            const JSFunctionRef& new_target,
+                            const JSHeapBroker* broker) {
+  return new_target.has_initial_map() &&
+         !new_target.initial_map(broker).is_dictionary_map() &&
+         new_target.initial_map(broker)
+             .constructor_or_backpointer(broker)
+             .equals(target);
 }
 
 // When initializing arrays, we'll unfold the loop if the number of
@@ -52,81 +59,6 @@ const int kElementLoopUnrollLimit = 16;
 const int kFunctionContextAllocationLimit = 16;
 const int kBlockContextAllocationLimit = 16;
 
-// Determines whether the given array or object literal boilerplate satisfies
-// all limits to be considered for fast deep-copying and computes the total
-// size of all objects that are part of the graph.
-bool IsFastLiteral(Handle<JSObject> boilerplate, int max_depth,
-                   int* max_properties) {
-  DCHECK_GE(max_depth, 0);
-  DCHECK_GE(*max_properties, 0);
-
-  // Make sure the boilerplate map is not deprecated.
-  if (!JSObject::TryMigrateInstance(boilerplate)) return false;
-
-  // Check for too deep nesting.
-  if (max_depth == 0) return false;
-
-  // Check the elements.
-  Isolate* const isolate = boilerplate->GetIsolate();
-  Handle<FixedArrayBase> elements(boilerplate->elements(), isolate);
-  if (elements->length() > 0 &&
-      elements->map() != isolate->heap()->fixed_cow_array_map()) {
-    if (boilerplate->HasSmiOrObjectElements()) {
-      Handle<FixedArray> fast_elements = Handle<FixedArray>::cast(elements);
-      int length = elements->length();
-      for (int i = 0; i < length; i++) {
-        if ((*max_properties)-- == 0) return false;
-        Handle<Object> value(fast_elements->get(i), isolate);
-        if (value->IsJSObject()) {
-          Handle<JSObject> value_object = Handle<JSObject>::cast(value);
-          if (!IsFastLiteral(value_object, max_depth - 1, max_properties)) {
-            return false;
-          }
-        }
-      }
-    } else if (boilerplate->HasDoubleElements()) {
-      if (elements->Size() > kMaxRegularHeapObjectSize) return false;
-    } else {
-      return false;
-    }
-  }
-
-  // TODO(turbofan): Do we want to support out-of-object properties?
-  if (!(boilerplate->HasFastProperties() &&
-        boilerplate->property_array()->length() == 0)) {
-    return false;
-  }
-
-  // Check the in-object properties.
-  Handle<DescriptorArray> descriptors(
-      boilerplate->map()->instance_descriptors(), isolate);
-  int limit = boilerplate->map()->NumberOfOwnDescriptors();
-  for (int i = 0; i < limit; i++) {
-    PropertyDetails details = descriptors->GetDetails(i);
-    if (details.location() != kField) continue;
-    DCHECK_EQ(kData, details.kind());
-    if ((*max_properties)-- == 0) return false;
-    FieldIndex field_index = FieldIndex::ForDescriptor(boilerplate->map(), i);
-    if (boilerplate->IsUnboxedDoubleField(field_index)) continue;
-    Handle<Object> value(boilerplate->RawFastPropertyAt(field_index), isolate);
-    if (value->IsJSObject()) {
-      Handle<JSObject> value_object = Handle<JSObject>::cast(value);
-      if (!IsFastLiteral(value_object, max_depth - 1, max_properties)) {
-        return false;
-      }
-    }
-  }
-  return true;
-}
-
-// Maximum depth and total number of elements and properties for literal
-// graphs to be considered for fast deep-copying. The limit is chosen to
-// match the maximum number of inobject properties, to ensure that the
-// performance of using object literals is not worse than using constructor
-// functions, see crbug.com/v8/6211 for details.
-const int kMaxFastLiteralDepth = 3;
-const int kMaxFastLiteralProperties = JSObject::kMaxInObjectProperties;
-
 }  // namespace
 
 Reduction JSCreateLowering::Reduce(Node* node) {
@@ -172,6 +104,8 @@ Reduction JSCreateLowering::Reduce(Node* node) {
       return ReduceJSCreateBlockContext(node);
     case IrOpcode::kJSCreateGeneratorObject:
       return ReduceJSCreateGeneratorObject(node);
+    case IrOpcode::kJSCreateObject:
+      return ReduceJSCreateObject(node);
     default:
       break;
   }
@@ -179,66 +113,72 @@ Reduction JSCreateLowering::Reduce(Node* node) {
 }
 
 Reduction JSCreateLowering::ReduceJSCreate(Node* node) {
+  DisallowHeapAccess no_heap_access;
   DCHECK_EQ(IrOpcode::kJSCreate, node->opcode());
   Node* const target = NodeProperties::GetValueInput(node, 0);
-  Type* const target_type = NodeProperties::GetType(target);
+  Type const target_type = NodeProperties::GetType(target);
   Node* const new_target = NodeProperties::GetValueInput(node, 1);
-  Type* const new_target_type = NodeProperties::GetType(new_target);
+  Type const new_target_type = NodeProperties::GetType(new_target);
   Node* const effect = NodeProperties::GetEffectInput(node);
   Node* const control = NodeProperties::GetControlInput(node);
   // Extract constructor and original constructor function.
-  if (target_type->IsHeapConstant() && new_target_type->IsHeapConstant() &&
-      target_type->AsHeapConstant()->Value()->IsJSFunction() &&
-      new_target_type->AsHeapConstant()->Value()->IsJSFunction()) {
-    Handle<JSFunction> constructor =
-        Handle<JSFunction>::cast(target_type->AsHeapConstant()->Value());
-    if (!constructor->IsConstructor()) return NoChange();
-    Handle<JSFunction> original_constructor =
-        Handle<JSFunction>::cast(new_target_type->AsHeapConstant()->Value());
-    if (!original_constructor->IsConstructor()) return NoChange();
+  if (!target_type.IsHeapConstant() || !new_target_type.IsHeapConstant() ||
+      !target_type.AsHeapConstant()->Ref().IsJSFunction() ||
+      !new_target_type.AsHeapConstant()->Ref().IsJSFunction()) {
+    return NoChange();
+  }
 
-    // Check if we can inline the allocation.
-    if (IsAllocationInlineable(constructor, original_constructor)) {
-      // Force completion of inobject slack tracking before
-      // generating code to finalize the instance size.
-      original_constructor->CompleteInobjectSlackTrackingIfActive();
-      Handle<Map> initial_map(original_constructor->initial_map(), isolate());
-      int const instance_size = initial_map->instance_size();
+  JSFunctionRef constructor =
+      target_type.AsHeapConstant()->Ref().AsJSFunction();
+  if (!constructor.IsConstructor()) return NoChange();
+  JSFunctionRef original_constructor =
+      new_target_type.AsHeapConstant()->Ref().AsJSFunction();
+  if (!original_constructor.IsConstructor()) return NoChange();
 
-      // Add a dependency on the {initial_map} to make sure that this code is
-      // deoptimized whenever the {initial_map} changes.
-      dependencies()->AssumeInitialMapCantChange(initial_map);
-
-      // Emit code to allocate the JSObject instance for the
-      // {original_constructor}.
-      AllocationBuilder a(jsgraph(), effect, control);
-      a.Allocate(instance_size);
-      a.Store(AccessBuilder::ForMap(), initial_map);
-      a.Store(AccessBuilder::ForJSObjectPropertiesOrHash(),
-              jsgraph()->EmptyFixedArrayConstant());
-      a.Store(AccessBuilder::ForJSObjectElements(),
-              jsgraph()->EmptyFixedArrayConstant());
-      for (int i = 0; i < initial_map->GetInObjectProperties(); ++i) {
-        a.Store(AccessBuilder::ForJSObjectInObjectProperty(initial_map, i),
-                jsgraph()->UndefinedConstant());
-      }
-      RelaxControls(node);
-      a.FinishAndChange(node);
-      return Changed(node);
-    }
+  // Check if we can inline the allocation.
+  if (!IsAllocationInlineable(constructor, original_constructor,
+                              js_heap_broker())) {
+    return NoChange();
   }
-  return NoChange();
+
+  // Add a dependency on the {initial_map} to make sure that this code is
+  // deoptimized whenever the {initial_map} changes.
+  MapRef initial_map =
+      original_constructor.DependOnInitialMap(js_heap_broker(), dependencies());
+
+  // Force completion of inobject slack tracking before
+  // generating code to finalize the instance size.
+  int const instance_size =
+      original_constructor.GetInstanceSizeWithFinishedSlackTracking();
+
+  // Emit code to allocate the JSObject instance for the
+  // {original_constructor}.
+  AllocationBuilder a(jsgraph(), js_heap_broker(), effect, control);
+  a.Allocate(instance_size);
+  a.Store(AccessBuilder::ForMap(), initial_map);
+  a.Store(AccessBuilder::ForJSObjectPropertiesOrHash(),
+          jsgraph()->EmptyFixedArrayConstant());
+  a.Store(AccessBuilder::ForJSObjectElements(),
+          jsgraph()->EmptyFixedArrayConstant());
+  for (int i = 0; i < initial_map.GetInObjectProperties(); ++i) {
+    a.Store(AccessBuilder::ForJSObjectInObjectProperty(initial_map, i),
+            jsgraph()->UndefinedConstant());
+  }
+
+  RelaxControls(node);
+  a.FinishAndChange(node);
+  return Changed(node);
 }
 
 Reduction JSCreateLowering::ReduceJSCreateArguments(Node* node) {
+  DisallowHeapAccess no_heap_access;
   DCHECK_EQ(IrOpcode::kJSCreateArguments, node->opcode());
   CreateArgumentsType type = CreateArgumentsTypeOf(node->op());
   Node* const frame_state = NodeProperties::GetFrameStateInput(node);
   Node* const outer_state = frame_state->InputAt(kFrameStateOuterStateInput);
   Node* const control = graph()->start();
   FrameStateInfo state_info = FrameStateInfoOf(frame_state->op());
-  Handle<SharedFunctionInfo> shared =
-      state_info.shared_info().ToHandleChecked();
+  SharedFunctionInfoRef shared(state_info.shared_info().ToHandleChecked());
 
   // Use the ArgumentsAccessStub for materializing both mapped and unmapped
   // arguments object, but only for non-inlined (i.e. outermost) frames.
@@ -246,7 +186,7 @@ Reduction JSCreateLowering::ReduceJSCreateArguments(Node* node) {
     switch (type) {
       case CreateArgumentsType::kMappedArguments: {
         // TODO(mstarzinger): Duplicate parameters are not handled yet.
-        if (shared->has_duplicate_parameters()) return NoChange();
+        if (shared.has_duplicate_parameters()) return NoChange();
         Node* const callee = NodeProperties::GetValueInput(node, 0);
         Node* const context = NodeProperties::GetContextInput(node);
         Node* effect = NodeProperties::GetEffectInput(node);
@@ -254,7 +194,7 @@ Reduction JSCreateLowering::ReduceJSCreateArguments(Node* node) {
             graph()->NewNode(simplified()->ArgumentsFrame());
         Node* const arguments_length = graph()->NewNode(
             simplified()->ArgumentsLength(
-                shared->internal_formal_parameter_count(), false),
+                shared.internal_formal_parameter_count(), false),
             arguments_frame);
         // Allocate the elements backing store.
         bool has_aliased_arguments = false;
@@ -262,13 +202,14 @@ Reduction JSCreateLowering::ReduceJSCreateArguments(Node* node) {
             effect, control, context, arguments_frame, arguments_length, shared,
             &has_aliased_arguments);
         // Load the arguments object map.
-        Node* const arguments_map = jsgraph()->HeapConstant(
-            handle(has_aliased_arguments
-                       ? native_context()->fast_aliased_arguments_map()
-                       : native_context()->sloppy_arguments_map(),
-                   isolate()));
+        Node* const arguments_map = jsgraph()->Constant(
+            js_heap_broker(),
+            has_aliased_arguments
+                ? native_context_ref().fast_aliased_arguments_map(
+                      js_heap_broker())
+                : native_context_ref().sloppy_arguments_map(js_heap_broker()));
         // Actually allocate and initialize the arguments object.
-        AllocationBuilder a(jsgraph(), effect, control);
+        AllocationBuilder a(jsgraph(), js_heap_broker(), effect, control);
         Node* properties = jsgraph()->EmptyFixedArrayConstant();
         STATIC_ASSERT(JSSloppyArgumentsObject::kSize == 5 * kPointerSize);
         a.Allocate(JSSloppyArgumentsObject::kSize);
@@ -287,17 +228,18 @@ Reduction JSCreateLowering::ReduceJSCreateArguments(Node* node) {
             graph()->NewNode(simplified()->ArgumentsFrame());
         Node* const arguments_length = graph()->NewNode(
             simplified()->ArgumentsLength(
-                shared->internal_formal_parameter_count(), false),
+                shared.internal_formal_parameter_count(), false),
             arguments_frame);
         // Allocate the elements backing store.
         Node* const elements = effect =
             graph()->NewNode(simplified()->NewArgumentsElements(0),
                              arguments_frame, arguments_length, effect);
         // Load the arguments object map.
-        Node* const arguments_map = jsgraph()->HeapConstant(
-            handle(native_context()->strict_arguments_map(), isolate()));
+        Node* const arguments_map = jsgraph()->Constant(
+            js_heap_broker(),
+            native_context_ref().strict_arguments_map(js_heap_broker()));
         // Actually allocate and initialize the arguments object.
-        AllocationBuilder a(jsgraph(), effect, control);
+        AllocationBuilder a(jsgraph(), js_heap_broker(), effect, control);
         Node* properties = jsgraph()->EmptyFixedArrayConstant();
         STATIC_ASSERT(JSStrictArgumentsObject::kSize == 4 * kPointerSize);
         a.Allocate(JSStrictArgumentsObject::kSize);
@@ -315,7 +257,7 @@ Reduction JSCreateLowering::ReduceJSCreateArguments(Node* node) {
             graph()->NewNode(simplified()->ArgumentsFrame());
         Node* const rest_length = graph()->NewNode(
             simplified()->ArgumentsLength(
-                shared->internal_formal_parameter_count(), true),
+                shared.internal_formal_parameter_count(), true),
             arguments_frame);
         // Allocate the elements backing store. Since NewArgumentsElements
         // copies from the end of the arguments adapter frame, this is a suffix
@@ -324,10 +266,12 @@ Reduction JSCreateLowering::ReduceJSCreateArguments(Node* node) {
             graph()->NewNode(simplified()->NewArgumentsElements(0),
                              arguments_frame, rest_length, effect);
         // Load the JSArray object map.
-        Node* const jsarray_map = jsgraph()->HeapConstant(handle(
-            native_context()->js_array_fast_elements_map_index(), isolate()));
+        Node* const jsarray_map = jsgraph()->Constant(
+            js_heap_broker(),
+            native_context_ref().js_array_fast_elements_map_index(
+                js_heap_broker()));
         // Actually allocate and initialize the jsarray.
-        AllocationBuilder a(jsgraph(), effect, control);
+        AllocationBuilder a(jsgraph(), js_heap_broker(), effect, control);
         Node* properties = jsgraph()->EmptyFixedArrayConstant();
         STATIC_ASSERT(JSArray::kSize == 4 * kPointerSize);
         a.Allocate(JSArray::kSize);
@@ -349,7 +293,7 @@ Reduction JSCreateLowering::ReduceJSCreateArguments(Node* node) {
       Node* const context = NodeProperties::GetContextInput(node);
       Node* effect = NodeProperties::GetEffectInput(node);
       // TODO(mstarzinger): Duplicate parameters are not handled yet.
-      if (shared->has_duplicate_parameters()) return NoChange();
+      if (shared.has_duplicate_parameters()) return NoChange();
       // Choose the correct frame state and frame state info depending on
       // whether there conceptually is an arguments adaptor frame in the call
       // chain.
@@ -368,12 +312,14 @@ Reduction JSCreateLowering::ReduceJSCreateArguments(Node* node) {
           effect, control, args_state, context, shared, &has_aliased_arguments);
       effect = elements->op()->EffectOutputCount() > 0 ? elements : effect;
       // Load the arguments object map.
-      Node* const arguments_map = jsgraph()->HeapConstant(handle(
-          has_aliased_arguments ? native_context()->fast_aliased_arguments_map()
-                                : native_context()->sloppy_arguments_map(),
-          isolate()));
+      Node* const arguments_map = jsgraph()->Constant(
+          js_heap_broker(),
+          has_aliased_arguments
+              ? native_context_ref().fast_aliased_arguments_map(
+                    js_heap_broker())
+              : native_context_ref().sloppy_arguments_map(js_heap_broker()));
       // Actually allocate and initialize the arguments object.
-      AllocationBuilder a(jsgraph(), effect, control);
+      AllocationBuilder a(jsgraph(), js_heap_broker(), effect, control);
       Node* properties = jsgraph()->EmptyFixedArrayConstant();
       int length = args_state_info.parameter_count() - 1;  // Minus receiver.
       STATIC_ASSERT(JSSloppyArgumentsObject::kSize == 5 * kPointerSize);
@@ -406,10 +352,11 @@ Reduction JSCreateLowering::ReduceJSCreateArguments(Node* node) {
       Node* const elements = AllocateArguments(effect, control, args_state);
       effect = elements->op()->EffectOutputCount() > 0 ? elements : effect;
       // Load the arguments object map.
-      Node* const arguments_map = jsgraph()->HeapConstant(
-          handle(native_context()->strict_arguments_map(), isolate()));
+      Node* const arguments_map = jsgraph()->Constant(
+          js_heap_broker(),
+          native_context_ref().strict_arguments_map(js_heap_broker()));
       // Actually allocate and initialize the arguments object.
-      AllocationBuilder a(jsgraph(), effect, control);
+      AllocationBuilder a(jsgraph(), js_heap_broker(), effect, control);
       Node* properties = jsgraph()->EmptyFixedArrayConstant();
       int length = args_state_info.parameter_count() - 1;  // Minus receiver.
       STATIC_ASSERT(JSStrictArgumentsObject::kSize == 4 * kPointerSize);
@@ -422,7 +369,7 @@ Reduction JSCreateLowering::ReduceJSCreateArguments(Node* node) {
       a.FinishAndChange(node);
       return Changed(node);
     } else if (type == CreateArgumentsType::kRestParameter) {
-      int start_index = shared->internal_formal_parameter_count();
+      int start_index = shared.internal_formal_parameter_count();
       // Use inline allocation for all unmapped arguments objects within inlined
       // (i.e. non-outermost) frames, independent of the object size.
       Node* effect = NodeProperties::GetEffectInput(node);
@@ -443,10 +390,12 @@ Reduction JSCreateLowering::ReduceJSCreateArguments(Node* node) {
           AllocateRestArguments(effect, control, args_state, start_index);
       effect = elements->op()->EffectOutputCount() > 0 ? elements : effect;
       // Load the JSArray object map.
-      Node* const jsarray_map = jsgraph()->HeapConstant(handle(
-          native_context()->js_array_fast_elements_map_index(), isolate()));
+      Node* const jsarray_map = jsgraph()->Constant(
+          js_heap_broker(),
+          native_context_ref().js_array_fast_elements_map_index(
+              js_heap_broker()));
       // Actually allocate and initialize the jsarray.
-      AllocationBuilder a(jsgraph(), effect, control);
+      AllocationBuilder a(jsgraph(), js_heap_broker(), effect, control);
       Node* properties = jsgraph()->EmptyFixedArrayConstant();
 
       // -1 to minus receiver
@@ -473,39 +422,43 @@ Reduction JSCreateLowering::ReduceJSCreateGeneratorObject(Node* node) {
   Node* const closure = NodeProperties::GetValueInput(node, 0);
   Node* const receiver = NodeProperties::GetValueInput(node, 1);
   Node* const context = NodeProperties::GetContextInput(node);
-  Type* const closure_type = NodeProperties::GetType(closure);
+  Type const closure_type = NodeProperties::GetType(closure);
   Node* effect = NodeProperties::GetEffectInput(node);
   Node* const control = NodeProperties::GetControlInput(node);
-  if (closure_type->IsHeapConstant()) {
-    DCHECK(closure_type->AsHeapConstant()->Value()->IsJSFunction());
+  if (closure_type.IsHeapConstant()) {
+    DCHECK(closure_type.AsHeapConstant()->Value()->IsJSFunction());
     Handle<JSFunction> js_function =
-        Handle<JSFunction>::cast(closure_type->AsHeapConstant()->Value());
+        Handle<JSFunction>::cast(closure_type.AsHeapConstant()->Value());
     JSFunction::EnsureHasInitialMap(js_function);
 
     // Force completion of inobject slack tracking before
     // generating code to finalize the instance size.
     js_function->CompleteInobjectSlackTrackingIfActive();
-    Handle<Map> initial_map(js_function->initial_map(), isolate());
-    DCHECK(initial_map->instance_type() == JS_GENERATOR_OBJECT_TYPE ||
-           initial_map->instance_type() == JS_ASYNC_GENERATOR_OBJECT_TYPE);
 
     // Add a dependency on the {initial_map} to make sure that this code is
     // deoptimized whenever the {initial_map} changes.
-    dependencies()->AssumeInitialMapCantChange(initial_map);
+    Handle<Map> initial_map = dependencies()->DependOnInitialMap(js_function);
+    DCHECK(initial_map->instance_type() == JS_GENERATOR_OBJECT_TYPE ||
+           initial_map->instance_type() == JS_ASYNC_GENERATOR_OBJECT_TYPE);
 
     // Allocate a register file.
     DCHECK(js_function->shared()->HasBytecodeArray());
-    int size = js_function->shared()->GetBytecodeArray()->register_count();
-    AllocationBuilder ab(jsgraph(), effect, control);
+    Handle<BytecodeArray> bytecode_array(
+        js_function->shared()->GetBytecodeArray(), isolate());
+    int parameter_count_no_receiver = bytecode_array->parameter_count() - 1;
+    DCHECK_EQ(parameter_count_no_receiver,
+              js_function->shared()->internal_formal_parameter_count());
+    int size = parameter_count_no_receiver + bytecode_array->register_count();
+    AllocationBuilder ab(jsgraph(), js_heap_broker(), effect, control);
     ab.AllocateArray(size, factory()->fixed_array_map());
     for (int i = 0; i < size; ++i) {
       ab.Store(AccessBuilder::ForFixedArraySlot(i),
                jsgraph()->UndefinedConstant());
     }
-    Node* register_file = effect = ab.Finish();
+    Node* parameters_and_registers = effect = ab.Finish();
 
     // Emit code to allocate the JS[Async]GeneratorObject instance.
-    AllocationBuilder a(jsgraph(), effect, control);
+    AllocationBuilder a(jsgraph(), js_heap_broker(), effect, control);
     a.Allocate(initial_map->instance_size());
     Node* empty_fixed_array = jsgraph()->EmptyFixedArrayConstant();
     Node* undefined = jsgraph()->UndefinedConstant();
@@ -520,7 +473,8 @@ Reduction JSCreateLowering::ReduceJSCreateGeneratorObject(Node* node) {
             jsgraph()->Constant(JSGeneratorObject::kNext));
     a.Store(AccessBuilder::ForJSGeneratorObjectContinuation(),
             jsgraph()->Constant(JSGeneratorObject::kGeneratorExecuting));
-    a.Store(AccessBuilder::ForJSGeneratorObjectRegisterFile(), register_file);
+    a.Store(AccessBuilder::ForJSGeneratorObjectParametersAndRegisters(),
+            parameters_and_registers);
 
     if (initial_map->instance_type() == JS_ASYNC_GENERATOR_OBJECT_TYPE) {
       a.Store(AccessBuilder::ForJSAsyncGeneratorObjectQueue(), undefined);
@@ -530,8 +484,9 @@ Reduction JSCreateLowering::ReduceJSCreateGeneratorObject(Node* node) {
 
     // Handle in-object properties, too.
     for (int i = 0; i < initial_map->GetInObjectProperties(); ++i) {
-      a.Store(AccessBuilder::ForJSObjectInObjectProperty(initial_map, i),
-              undefined);
+      a.Store(
+          AccessBuilder::ForJSObjectInObjectProperty(MapRef(initial_map), i),
+          undefined);
     }
     a.FinishAndChange(node);
     return Changed(node);
@@ -551,8 +506,9 @@ Reduction JSCreateLowering::ReduceNewArray(Node* node, Node* length,
   // Constructing an Array via new Array(N) where N is an unsigned
   // integer, always creates a holey backing store.
   if (!IsHoleyElementsKind(initial_map->elements_kind())) {
-    initial_map = Map::AsElementsKind(
-        initial_map, GetHoleyElementsKind(initial_map->elements_kind()));
+    initial_map =
+        Map::AsElementsKind(isolate(), initial_map,
+                            GetHoleyElementsKind(initial_map->elements_kind()));
   }
 
   // Check that the {limit} is an unsigned integer in the valid range.
@@ -572,7 +528,7 @@ Reduction JSCreateLowering::ReduceNewArray(Node* node, Node* length,
   Node* properties = jsgraph()->EmptyFixedArrayConstant();
 
   // Perform the allocation of the actual JSArray object.
-  AllocationBuilder a(jsgraph(), effect, control);
+  AllocationBuilder a(jsgraph(), js_heap_broker(), effect, control);
   a.Allocate(initial_map->instance_size(), pretenure);
   a.Store(AccessBuilder::ForMap(), initial_map);
   a.Store(AccessBuilder::ForJSObjectPropertiesOrHash(), properties);
@@ -580,7 +536,7 @@ Reduction JSCreateLowering::ReduceNewArray(Node* node, Node* length,
   a.Store(AccessBuilder::ForJSArrayLength(initial_map->elements_kind()),
           length);
   for (int i = 0; i < initial_map->GetInObjectProperties(); ++i) {
-    a.Store(AccessBuilder::ForJSObjectInObjectProperty(initial_map, i),
+    a.Store(AccessBuilder::ForJSObjectInObjectProperty(MapRef(initial_map), i),
             jsgraph()->UndefinedConstant());
   }
   RelaxControls(node);
@@ -601,9 +557,9 @@ Reduction JSCreateLowering::ReduceNewArray(Node* node, Node* length,
 
   // Determine the appropriate elements kind.
   ElementsKind elements_kind = initial_map->elements_kind();
-  if (NodeProperties::GetType(length)->Max() > 0.0) {
+  if (NodeProperties::GetType(length).Max() > 0.0) {
     elements_kind = GetHoleyElementsKind(elements_kind);
-    initial_map = Map::AsElementsKind(initial_map, elements_kind);
+    initial_map = Map::AsElementsKind(isolate(), initial_map, elements_kind);
   }
   DCHECK(IsFastElementsKind(elements_kind));
 
@@ -618,14 +574,14 @@ Reduction JSCreateLowering::ReduceNewArray(Node* node, Node* length,
   Node* properties = jsgraph()->EmptyFixedArrayConstant();
 
   // Perform the allocation of the actual JSArray object.
-  AllocationBuilder a(jsgraph(), effect, control);
+  AllocationBuilder a(jsgraph(), js_heap_broker(), effect, control);
   a.Allocate(initial_map->instance_size(), pretenure);
   a.Store(AccessBuilder::ForMap(), initial_map);
   a.Store(AccessBuilder::ForJSObjectPropertiesOrHash(), properties);
   a.Store(AccessBuilder::ForJSObjectElements(), elements);
   a.Store(AccessBuilder::ForJSArrayLength(elements_kind), length);
   for (int i = 0; i < initial_map->GetInObjectProperties(); ++i) {
-    a.Store(AccessBuilder::ForJSObjectInObjectProperty(initial_map, i),
+    a.Store(AccessBuilder::ForJSObjectInObjectProperty(MapRef(initial_map), i),
             jsgraph()->UndefinedConstant());
   }
   RelaxControls(node);
@@ -650,14 +606,14 @@ Reduction JSCreateLowering::ReduceNewArray(Node* node,
   // deoptimize in this case.
   if (IsSmiElementsKind(elements_kind)) {
     for (auto& value : values) {
-      if (!NodeProperties::GetType(value)->Is(Type::SignedSmall())) {
+      if (!NodeProperties::GetType(value).Is(Type::SignedSmall())) {
         value = effect = graph()->NewNode(
             simplified()->CheckSmi(VectorSlotPair()), value, effect, control);
       }
     }
   } else if (IsDoubleElementsKind(elements_kind)) {
     for (auto& value : values) {
-      if (!NodeProperties::GetType(value)->Is(Type::Number())) {
+      if (!NodeProperties::GetType(value).Is(Type::Number())) {
         value = effect =
             graph()->NewNode(simplified()->CheckNumber(VectorSlotPair()), value,
                              effect, control);
@@ -674,14 +630,14 @@ Reduction JSCreateLowering::ReduceNewArray(Node* node,
   Node* length = jsgraph()->Constant(static_cast<int>(values.size()));
 
   // Perform the allocation of the actual JSArray object.
-  AllocationBuilder a(jsgraph(), effect, control);
+  AllocationBuilder a(jsgraph(), js_heap_broker(), effect, control);
   a.Allocate(initial_map->instance_size(), pretenure);
   a.Store(AccessBuilder::ForMap(), initial_map);
   a.Store(AccessBuilder::ForJSObjectPropertiesOrHash(), properties);
   a.Store(AccessBuilder::ForJSObjectElements(), elements);
   a.Store(AccessBuilder::ForJSArrayLength(elements_kind), length);
   for (int i = 0; i < initial_map->GetInObjectProperties(); ++i) {
-    a.Store(AccessBuilder::ForJSObjectInObjectProperty(initial_map, i),
+    a.Store(AccessBuilder::ForJSObjectInObjectProperty(MapRef(initial_map), i),
             jsgraph()->UndefinedConstant());
   }
   RelaxControls(node);
@@ -695,7 +651,7 @@ Reduction JSCreateLowering::ReduceNewArrayToStubCall(
   int const arity = static_cast<int>(p.arity());
   Node* target = NodeProperties::GetValueInput(node, 0);
   Node* new_target = NodeProperties::GetValueInput(node, 1);
-  Type* new_target_type = NodeProperties::GetType(new_target);
+  Type new_target_type = NodeProperties::GetType(new_target);
   Node* type_info = site.is_null() ? jsgraph()->UndefinedConstant()
                                    : jsgraph()->HeapConstant(site);
 
@@ -709,40 +665,40 @@ Reduction JSCreateLowering::ReduceNewArrayToStubCall(
   // The Array constructor can only trigger an observable side-effect
   // if the new.target may be a proxy.
   Operator::Properties const properties =
-      (new_target != target || new_target_type->Maybe(Type::Proxy()))
+      (new_target != target || new_target_type.Maybe(Type::Proxy()))
           ? Operator::kNoDeopt
           : Operator::kNoDeopt | Operator::kNoWrite;
 
   if (arity == 0) {
-    ArrayNoArgumentConstructorStub stub(isolate(), elements_kind,
-                                        override_mode);
+    Callable callable = CodeFactory::ArrayNoArgumentConstructor(
+        isolate(), elements_kind, override_mode);
     auto call_descriptor = Linkage::GetStubCallDescriptor(
-        isolate(), graph()->zone(), stub.GetCallInterfaceDescriptor(),
-        arity + 1, CallDescriptor::kNeedsFrameState, properties);
-    node->ReplaceInput(0, jsgraph()->HeapConstant(stub.GetCode()));
+        graph()->zone(), callable.descriptor(), arity + 1,
+        CallDescriptor::kNeedsFrameState, properties);
+    node->ReplaceInput(0, jsgraph()->HeapConstant(callable.code()));
     node->InsertInput(graph()->zone(), 2, type_info);
     node->InsertInput(graph()->zone(), 3, jsgraph()->Constant(arity));
     node->InsertInput(graph()->zone(), 4, jsgraph()->UndefinedConstant());
     NodeProperties::ChangeOp(node, common()->Call(call_descriptor));
   } else if (arity == 1) {
     // Require elements kind to "go holey".
-    ArraySingleArgumentConstructorStub stub(
+    Callable callable = CodeFactory::ArraySingleArgumentConstructor(
         isolate(), GetHoleyElementsKind(elements_kind), override_mode);
     auto call_descriptor = Linkage::GetStubCallDescriptor(
-        isolate(), graph()->zone(), stub.GetCallInterfaceDescriptor(),
-        arity + 1, CallDescriptor::kNeedsFrameState, properties);
-    node->ReplaceInput(0, jsgraph()->HeapConstant(stub.GetCode()));
+        graph()->zone(), callable.descriptor(), arity + 1,
+        CallDescriptor::kNeedsFrameState, properties);
+    node->ReplaceInput(0, jsgraph()->HeapConstant(callable.code()));
     node->InsertInput(graph()->zone(), 2, type_info);
     node->InsertInput(graph()->zone(), 3, jsgraph()->Constant(arity));
     node->InsertInput(graph()->zone(), 4, jsgraph()->UndefinedConstant());
     NodeProperties::ChangeOp(node, common()->Call(call_descriptor));
   } else {
     DCHECK_GT(arity, 1);
-    ArrayNArgumentsConstructorStub stub(isolate());
+    Handle<Code> code = BUILTIN_CODE(isolate(), ArrayNArgumentsConstructor);
     auto call_descriptor = Linkage::GetStubCallDescriptor(
-        isolate(), graph()->zone(), stub.GetCallInterfaceDescriptor(),
-        arity + 1, CallDescriptor::kNeedsFrameState);
-    node->ReplaceInput(0, jsgraph()->HeapConstant(stub.GetCode()));
+        graph()->zone(), ArrayNArgumentsConstructorDescriptor{}, arity + 1,
+        CallDescriptor::kNeedsFrameState);
+    node->ReplaceInput(0, jsgraph()->HeapConstant(code));
     node->InsertInput(graph()->zone(), 2, type_info);
     node->InsertInput(graph()->zone(), 3, jsgraph()->Constant(arity));
     node->InsertInput(graph()->zone(), 4, jsgraph()->UndefinedConstant());
@@ -760,28 +716,31 @@ Reduction JSCreateLowering::ReduceJSCreateArray(Node* node) {
   Handle<JSFunction> constructor(native_context()->array_function(), isolate());
   Node* target = NodeProperties::GetValueInput(node, 0);
   Node* new_target = NodeProperties::GetValueInput(node, 1);
-  Type* new_target_type = (target == new_target)
-                              ? Type::HeapConstant(constructor, zone())
-                              : NodeProperties::GetType(new_target);
+  Type new_target_type =
+      (target == new_target)
+          ? Type::HeapConstant(js_heap_broker(), constructor, zone())
+          : NodeProperties::GetType(new_target);
 
   // Extract original constructor function.
-  if (new_target_type->IsHeapConstant() &&
-      new_target_type->AsHeapConstant()->Value()->IsJSFunction()) {
+  if (new_target_type.IsHeapConstant() &&
+      new_target_type.AsHeapConstant()->Value()->IsJSFunction()) {
     Handle<JSFunction> original_constructor =
-        Handle<JSFunction>::cast(new_target_type->AsHeapConstant()->Value());
+        Handle<JSFunction>::cast(new_target_type.AsHeapConstant()->Value());
     DCHECK(constructor->IsConstructor());
     DCHECK(original_constructor->IsConstructor());
 
     // Check if we can inline the allocation.
-    if (IsAllocationInlineable(constructor, original_constructor)) {
+    if (IsAllocationInlineable(JSFunctionRef(constructor),
+                               JSFunctionRef(original_constructor),
+                               js_heap_broker())) {
       // Force completion of inobject slack tracking before
       // generating code to finalize the instance size.
       original_constructor->CompleteInobjectSlackTrackingIfActive();
-      Handle<Map> initial_map(original_constructor->initial_map(), isolate());
 
       // Add a dependency on the {initial_map} to make sure that this code is
       // deoptimized whenever the {initial_map} changes.
-      dependencies()->AssumeInitialMapCantChange(initial_map);
+      Handle<Map> initial_map =
+          dependencies()->DependOnInitialMap(original_constructor);
 
       // Tells whether we are protected by either the {site} or a
       // protector cell to do certain speculative optimizations.
@@ -791,13 +750,12 @@ Reduction JSCreateLowering::ReduceJSCreateArray(Node* node) {
       if (!site.is_null()) {
         ElementsKind elements_kind = site->GetElementsKind();
         if (initial_map->elements_kind() != elements_kind) {
-          initial_map = Map::AsElementsKind(initial_map, elements_kind);
+          initial_map =
+              Map::AsElementsKind(isolate(), initial_map, elements_kind);
         }
         can_inline_call = site->CanInlineCall();
-        pretenure = site->GetPretenureMode();
-
-        dependencies()->AssumeTransitionStable(site);
-        dependencies()->AssumeTenuringDecision(site);
+        pretenure = dependencies()->DependOnPretenureMode(site);
+        dependencies()->DependOnElementsKind(site);
       } else {
         can_inline_call = isolate()->IsArrayConstructorIntact();
       }
@@ -808,8 +766,8 @@ Reduction JSCreateLowering::ReduceJSCreateArray(Node* node) {
         return ReduceNewArray(node, length, capacity, initial_map, pretenure);
       } else if (arity == 1) {
         Node* length = NodeProperties::GetValueInput(node, 2);
-        Type* length_type = NodeProperties::GetType(length);
-        if (!length_type->Maybe(Type::Number())) {
+        Type length_type = NodeProperties::GetType(length);
+        if (!length_type.Maybe(Type::Number())) {
           // Handle the single argument case, where we know that the value
           // cannot be a valid Array length.
           ElementsKind elements_kind = initial_map->elements_kind();
@@ -817,17 +775,18 @@ Reduction JSCreateLowering::ReduceJSCreateArray(Node* node) {
               elements_kind, IsHoleyElementsKind(elements_kind)
                                  ? HOLEY_ELEMENTS
                                  : PACKED_ELEMENTS);
-          initial_map = Map::AsElementsKind(initial_map, elements_kind);
+          initial_map =
+              Map::AsElementsKind(isolate(), initial_map, elements_kind);
           return ReduceNewArray(node, std::vector<Node*>{length}, initial_map,
                                 pretenure);
         }
-        if (length_type->Is(Type::SignedSmall()) && length_type->Min() >= 0 &&
-            length_type->Max() <= kElementLoopUnrollLimit &&
-            length_type->Min() == length_type->Max()) {
-          int capacity = static_cast<int>(length_type->Max());
+        if (length_type.Is(Type::SignedSmall()) && length_type.Min() >= 0 &&
+            length_type.Max() <= kElementLoopUnrollLimit &&
+            length_type.Min() == length_type.Max()) {
+          int capacity = static_cast<int>(length_type.Max());
           return ReduceNewArray(node, length, capacity, initial_map, pretenure);
         }
-        if (length_type->Maybe(Type::UnsignedSmall()) && can_inline_call) {
+        if (length_type.Maybe(Type::UnsignedSmall()) && can_inline_call) {
           return ReduceNewArray(node, length, initial_map, pretenure);
         }
       } else if (arity <= JSArray::kInitialMaxFastElementArray) {
@@ -838,14 +797,14 @@ Reduction JSCreateLowering::ReduceJSCreateArray(Node* node) {
         values.reserve(p.arity());
         for (int i = 0; i < arity; ++i) {
           Node* value = NodeProperties::GetValueInput(node, 2 + i);
-          Type* value_type = NodeProperties::GetType(value);
-          if (!value_type->Is(Type::SignedSmall())) {
+          Type value_type = NodeProperties::GetType(value);
+          if (!value_type.Is(Type::SignedSmall())) {
             values_all_smis = false;
           }
-          if (!value_type->Is(Type::Number())) {
+          if (!value_type.Is(Type::Number())) {
             values_all_numbers = false;
           }
-          if (!value_type->Maybe(Type::Number())) {
+          if (!value_type.Maybe(Type::Number())) {
             values_any_nonnumber = true;
           }
           values.push_back(value);
@@ -873,7 +832,8 @@ Reduction JSCreateLowering::ReduceJSCreateArray(Node* node) {
           // we cannot inline this invocation of the Array constructor here.
           return NoChange();
         }
-        initial_map = Map::AsElementsKind(initial_map, elements_kind);
+        initial_map =
+            Map::AsElementsKind(isolate(), initial_map, elements_kind);
 
         return ReduceNewArray(node, values, initial_map, pretenure);
       }
@@ -887,6 +847,7 @@ Reduction JSCreateLowering::ReduceJSCreateArray(Node* node) {
 }
 
 Reduction JSCreateLowering::ReduceJSCreateArrayIterator(Node* node) {
+  DisallowHeapAccess no_heap_access;
   DCHECK_EQ(IrOpcode::kJSCreateArrayIterator, node->opcode());
   CreateArrayIteratorParameters const& p =
       CreateArrayIteratorParametersOf(node->op());
@@ -895,10 +856,10 @@ Reduction JSCreateLowering::ReduceJSCreateArrayIterator(Node* node) {
   Node* control = NodeProperties::GetControlInput(node);
 
   // Create the JSArrayIterator result.
-  AllocationBuilder a(jsgraph(), effect, control);
+  AllocationBuilder a(jsgraph(), js_heap_broker(), effect, control);
   a.Allocate(JSArrayIterator::kSize, NOT_TENURED, Type::OtherObject());
   a.Store(AccessBuilder::ForMap(),
-          handle(native_context()->initial_array_iterator_map(), isolate()));
+          native_context_ref().initial_array_iterator_map(js_heap_broker()));
   a.Store(AccessBuilder::ForJSObjectPropertiesOrHash(),
           jsgraph()->EmptyFixedArrayConstant());
   a.Store(AccessBuilder::ForJSObjectElements(),
@@ -915,27 +876,29 @@ Reduction JSCreateLowering::ReduceJSCreateArrayIterator(Node* node) {
 
 namespace {
 
-Context::Field ContextFieldForCollectionIterationKind(
-    CollectionKind collection_kind, IterationKind iteration_kind) {
+MapRef MapForCollectionIterationKind(const NativeContextRef& native_context,
+                                     const JSHeapBroker* broker,
+                                     CollectionKind collection_kind,
+                                     IterationKind iteration_kind) {
   switch (collection_kind) {
     case CollectionKind::kSet:
       switch (iteration_kind) {
         case IterationKind::kKeys:
           UNREACHABLE();
         case IterationKind::kValues:
-          return Context::SET_VALUE_ITERATOR_MAP_INDEX;
+          return native_context.set_value_iterator_map(broker);
         case IterationKind::kEntries:
-          return Context::SET_KEY_VALUE_ITERATOR_MAP_INDEX;
+          return native_context.set_key_value_iterator_map(broker);
       }
       break;
     case CollectionKind::kMap:
       switch (iteration_kind) {
         case IterationKind::kKeys:
-          return Context::MAP_KEY_ITERATOR_MAP_INDEX;
+          return native_context.map_key_iterator_map(broker);
         case IterationKind::kValues:
-          return Context::MAP_VALUE_ITERATOR_MAP_INDEX;
+          return native_context.map_value_iterator_map(broker);
         case IterationKind::kEntries:
-          return Context::MAP_KEY_VALUE_ITERATOR_MAP_INDEX;
+          return native_context.map_key_value_iterator_map(broker);
       }
       break;
   }
@@ -945,6 +908,7 @@ Context::Field ContextFieldForCollectionIterationKind(
 }  // namespace
 
 Reduction JSCreateLowering::ReduceJSCreateCollectionIterator(Node* node) {
+  DisallowHeapAccess no_heap_access;
   DCHECK_EQ(IrOpcode::kJSCreateCollectionIterator, node->opcode());
   CreateCollectionIteratorParameters const& p =
       CreateCollectionIteratorParametersOf(node->op());
@@ -958,12 +922,12 @@ Reduction JSCreateLowering::ReduceJSCreateCollectionIterator(Node* node) {
       iterated_object, effect, control);
 
   // Create the JSArrayIterator result.
-  AllocationBuilder a(jsgraph(), effect, control);
+  AllocationBuilder a(jsgraph(), js_heap_broker(), effect, control);
   a.Allocate(JSCollectionIterator::kSize, NOT_TENURED, Type::OtherObject());
-  a.Store(AccessBuilder::ForMap(),
-          handle(native_context()->get(ContextFieldForCollectionIterationKind(
-                     p.collection_kind(), p.iteration_kind())),
-                 isolate()));
+  a.Store(
+      AccessBuilder::ForMap(),
+      MapForCollectionIterationKind(native_context_ref(), js_heap_broker(),
+                                    p.collection_kind(), p.iteration_kind()));
   a.Store(AccessBuilder::ForJSObjectPropertiesOrHash(),
           jsgraph()->EmptyFixedArrayConstant());
   a.Store(AccessBuilder::ForJSObjectElements(),
@@ -977,11 +941,12 @@ Reduction JSCreateLowering::ReduceJSCreateCollectionIterator(Node* node) {
 }
 
 Reduction JSCreateLowering::ReduceJSCreateBoundFunction(Node* node) {
+  DisallowHeapAccess no_heap_access;
   DCHECK_EQ(IrOpcode::kJSCreateBoundFunction, node->opcode());
   CreateBoundFunctionParameters const& p =
       CreateBoundFunctionParametersOf(node->op());
   int const arity = static_cast<int>(p.arity());
-  Handle<Map> const map = p.map();
+  MapRef const map(p.map());
   Node* bound_target_function = NodeProperties::GetValueInput(node, 0);
   Node* bound_this = NodeProperties::GetValueInput(node, 1);
   Node* effect = NodeProperties::GetEffectInput(node);
@@ -990,7 +955,7 @@ Reduction JSCreateLowering::ReduceJSCreateBoundFunction(Node* node) {
   // Create the [[BoundArguments]] for the result.
   Node* bound_arguments = jsgraph()->EmptyFixedArrayConstant();
   if (arity > 0) {
-    AllocationBuilder a(jsgraph(), effect, control);
+    AllocationBuilder a(jsgraph(), js_heap_broker(), effect, control);
     a.AllocateArray(arity, factory()->fixed_array_map());
     for (int i = 0; i < arity; ++i) {
       a.Store(AccessBuilder::ForFixedArraySlot(i),
@@ -1000,7 +965,7 @@ Reduction JSCreateLowering::ReduceJSCreateBoundFunction(Node* node) {
   }
 
   // Create the JSBoundFunction result.
-  AllocationBuilder a(jsgraph(), effect, control);
+  AllocationBuilder a(jsgraph(), js_heap_broker(), effect, control);
   a.Allocate(JSBoundFunction::kSize, NOT_TENURED, Type::BoundFunction());
   a.Store(AccessBuilder::ForMap(), map);
   a.Store(AccessBuilder::ForJSObjectPropertiesOrHash(),
@@ -1017,11 +982,12 @@ Reduction JSCreateLowering::ReduceJSCreateBoundFunction(Node* node) {
 }
 
 Reduction JSCreateLowering::ReduceJSCreateClosure(Node* node) {
+  DisallowHeapAccess no_heap_access;
   DCHECK_EQ(IrOpcode::kJSCreateClosure, node->opcode());
   CreateClosureParameters const& p = CreateClosureParametersOf(node->op());
-  Handle<SharedFunctionInfo> shared = p.shared_info();
-  Handle<FeedbackCell> feedback_cell = p.feedback_cell();
-  Handle<Code> code = p.code();
+  SharedFunctionInfoRef shared(p.shared_info());
+  HeapObjectRef feedback_cell(p.feedback_cell());
+  HeapObjectRef code(p.code());
   Node* effect = NodeProperties::GetEffectInput(node);
   Node* control = NodeProperties::GetControlInput(node);
   Node* context = NodeProperties::GetContextInput(node);
@@ -1029,16 +995,15 @@ Reduction JSCreateLowering::ReduceJSCreateClosure(Node* node) {
   // Use inline allocation of closures only for instantiation sites that have
   // seen more than one instantiation, this simplifies the generated code and
   // also serves as a heuristic of which allocation sites benefit from it.
-  if (feedback_cell->map() != isolate()->heap()->many_closures_cell_map()) {
-    // The generic path can only create closures for user functions.
-    DCHECK_EQ(isolate()->builtins()->builtin(Builtins::kCompileLazy), *code);
+  if (!feedback_cell.map(js_heap_broker())
+           .equals(MapRef(factory()->many_closures_cell_map()))) {
     return NoChange();
   }
 
-  Handle<Map> function_map(
-      Map::cast(native_context()->get(shared->function_map_index())));
-  DCHECK(!function_map->IsInobjectSlackTrackingInProgress());
-  DCHECK(!function_map->is_dictionary_map());
+  MapRef function_map = native_context_ref().GetFunctionMapFromIndex(
+      js_heap_broker(), shared.function_map_index());
+  DCHECK(!function_map.IsInobjectSlackTrackingInProgress());
+  DCHECK(!function_map.is_dictionary_map());
 
   // TODO(turbofan): We should use the pretenure flag from {p} here,
   // but currently the heuristic in the parser works against us, as
@@ -1053,8 +1018,8 @@ Reduction JSCreateLowering::ReduceJSCreateClosure(Node* node) {
 
   // Emit code to allocate the JSFunction instance.
   STATIC_ASSERT(JSFunction::kSizeWithoutPrototype == 7 * kPointerSize);
-  AllocationBuilder a(jsgraph(), effect, control);
-  a.Allocate(function_map->instance_size(), pretenure, Type::Function());
+  AllocationBuilder a(jsgraph(), js_heap_broker(), effect, control);
+  a.Allocate(function_map.instance_size(), pretenure, Type::Function());
   a.Store(AccessBuilder::ForMap(), function_map);
   a.Store(AccessBuilder::ForJSObjectPropertiesOrHash(),
           jsgraph()->EmptyFixedArrayConstant());
@@ -1065,12 +1030,12 @@ Reduction JSCreateLowering::ReduceJSCreateClosure(Node* node) {
   a.Store(AccessBuilder::ForJSFunctionFeedbackCell(), feedback_cell);
   a.Store(AccessBuilder::ForJSFunctionCode(), code);
   STATIC_ASSERT(JSFunction::kSizeWithoutPrototype == 7 * kPointerSize);
-  if (function_map->has_prototype_slot()) {
+  if (function_map.has_prototype_slot()) {
     a.Store(AccessBuilder::ForJSFunctionPrototypeOrInitialMap(),
             jsgraph()->TheHoleConstant());
     STATIC_ASSERT(JSFunction::kSizeWithPrototype == 8 * kPointerSize);
   }
-  for (int i = 0; i < function_map->GetInObjectProperties(); i++) {
+  for (int i = 0; i < function_map.GetInObjectProperties(); i++) {
     a.Store(AccessBuilder::ForJSObjectInObjectProperty(function_map, i),
             jsgraph()->UndefinedConstant());
   }
@@ -1089,7 +1054,7 @@ Reduction JSCreateLowering::ReduceJSCreateIterResultObject(Node* node) {
       handle(native_context()->iterator_result_map(), isolate()));
 
   // Emit code to allocate the JSIteratorResult instance.
-  AllocationBuilder a(jsgraph(), effect, graph()->start());
+  AllocationBuilder a(jsgraph(), js_heap_broker(), effect, graph()->start());
   a.Allocate(JSIteratorResult::kSize);
   a.Store(AccessBuilder::ForMap(), iterator_result_map);
   a.Store(AccessBuilder::ForJSObjectPropertiesOrHash(),
@@ -1111,7 +1076,7 @@ Reduction JSCreateLowering::ReduceJSCreateStringIterator(Node* node) {
   Node* map = jsgraph()->HeapConstant(
       handle(native_context()->string_iterator_map(), isolate()));
   // Allocate new iterator and attach the iterator to this string.
-  AllocationBuilder a(jsgraph(), effect, graph()->start());
+  AllocationBuilder a(jsgraph(), js_heap_broker(), effect, graph()->start());
   a.Allocate(JSStringIterator::kSize, NOT_TENURED, Type::OtherObject());
   a.Store(AccessBuilder::ForMap(), map);
   a.Store(AccessBuilder::ForJSObjectPropertiesOrHash(),
@@ -1132,11 +1097,11 @@ Reduction JSCreateLowering::ReduceJSCreateKeyValueArray(Node* node) {
   Node* effect = NodeProperties::GetEffectInput(node);
 
   Node* array_map = jsgraph()->HeapConstant(
-      handle(native_context()->js_array_fast_elements_map_index()));
+      handle(native_context()->js_array_fast_elements_map_index(), isolate()));
   Node* properties = jsgraph()->EmptyFixedArrayConstant();
   Node* length = jsgraph()->Constant(2);
 
-  AllocationBuilder aa(jsgraph(), effect, graph()->start());
+  AllocationBuilder aa(jsgraph(), js_heap_broker(), effect, graph()->start());
   aa.AllocateArray(2, factory()->fixed_array_map());
   aa.Store(AccessBuilder::ForFixedArrayElement(PACKED_ELEMENTS),
            jsgraph()->ZeroConstant(), key);
@@ -1144,7 +1109,7 @@ Reduction JSCreateLowering::ReduceJSCreateKeyValueArray(Node* node) {
            jsgraph()->OneConstant(), value);
   Node* elements = aa.Finish();
 
-  AllocationBuilder a(jsgraph(), elements, graph()->start());
+  AllocationBuilder a(jsgraph(), js_heap_broker(), elements, graph()->start());
   a.Allocate(JSArray::kSize);
   a.Store(AccessBuilder::ForMap(), array_map);
   a.Store(AccessBuilder::ForJSObjectPropertiesOrHash(), properties);
@@ -1159,9 +1124,10 @@ Reduction JSCreateLowering::ReduceJSCreatePromise(Node* node) {
   DCHECK_EQ(IrOpcode::kJSCreatePromise, node->opcode());
   Node* effect = NodeProperties::GetEffectInput(node);
 
-  Handle<Map> promise_map(native_context()->promise_function()->initial_map());
+  Handle<Map> promise_map(native_context()->promise_function()->initial_map(),
+                          isolate());
 
-  AllocationBuilder a(jsgraph(), effect, graph()->start());
+  AllocationBuilder a(jsgraph(), js_heap_broker(), effect, graph()->start());
   a.Allocate(promise_map->instance_size());
   a.Store(AccessBuilder::ForMap(), promise_map);
   a.Store(AccessBuilder::ForJSObjectPropertiesOrHash(),
@@ -1190,18 +1156,21 @@ Reduction JSCreateLowering::ReduceJSCreateLiteralArrayOrObject(Node* node) {
   Node* effect = NodeProperties::GetEffectInput(node);
   Node* control = NodeProperties::GetControlInput(node);
 
-  Handle<Object> feedback(p.feedback().vector()->Get(p.feedback().slot()),
-                          isolate());
-  if (feedback->IsAllocationSite()) {
-    Handle<AllocationSite> site = Handle<AllocationSite>::cast(feedback);
-    Handle<JSObject> boilerplate(site->boilerplate(), isolate());
-    int max_properties = kMaxFastLiteralProperties;
-    if (IsFastLiteral(boilerplate, kMaxFastLiteralDepth, &max_properties)) {
-      AllocationSiteUsageContext site_context(isolate(), site, false);
-      site_context.EnterNewScope();
+  FeedbackVectorRef feedback_vector(p.feedback().vector());
+  ObjectRef feedback =
+      feedback_vector.get(js_heap_broker(), p.feedback().slot());
+  if (feedback.IsAllocationSite()) {
+    AllocationSiteRef site = feedback.AsAllocationSite();
+    if (site.IsFastLiteral(js_heap_broker())) {
+      PretenureFlag pretenure = NOT_TENURED;
+      if (FLAG_allocation_site_pretenuring) {
+        pretenure = dependencies()->DependOnPretenureMode(
+            site.object<AllocationSite>());
+      }
+      dependencies()->DependOnElementsKinds(site.object<AllocationSite>());
+      JSObjectRef boilerplate = site.boilerplate(js_heap_broker());
       Node* value = effect =
-          AllocateFastLiteral(effect, control, boilerplate, &site_context);
-      site_context.ExitScope(site, boilerplate);
+          AllocateFastLiteral(effect, control, boilerplate, pretenure);
       ReplaceWithValue(node, value, effect, control);
       return Replace(value);
     }
@@ -1212,17 +1181,16 @@ Reduction JSCreateLowering::ReduceJSCreateLiteralArrayOrObject(Node* node) {
 Reduction JSCreateLowering::ReduceJSCreateEmptyLiteralArray(Node* node) {
   DCHECK_EQ(IrOpcode::kJSCreateEmptyLiteralArray, node->opcode());
   FeedbackParameter const& p = FeedbackParameterOf(node->op());
-  Handle<Object> feedback(p.feedback().vector()->Get(p.feedback().slot()),
-                          isolate());
+  Handle<Object> feedback(
+      p.feedback().vector()->Get(p.feedback().slot())->ToObject(), isolate());
   if (feedback->IsAllocationSite()) {
     Handle<AllocationSite> site = Handle<AllocationSite>::cast(feedback);
     DCHECK(!site->PointsToLiteral());
     Handle<Map> const initial_map(
         native_context()->GetInitialJSArrayMap(site->GetElementsKind()),
         isolate());
-    PretenureFlag const pretenure = site->GetPretenureMode();
-    dependencies()->AssumeTransitionStable(site);
-    dependencies()->AssumeTenuringDecision(site);
+    PretenureFlag const pretenure = dependencies()->DependOnPretenureMode(site);
+    dependencies()->DependOnElementsKind(site);
     Node* length = jsgraph()->ZeroConstant();
     return ReduceNewArray(node, length, 0, initial_map, pretenure);
   }
@@ -1245,13 +1213,13 @@ Reduction JSCreateLowering::ReduceJSCreateEmptyLiteralObject(Node* node) {
   Node* properties = jsgraph()->EmptyFixedArrayConstant();
 
   // Perform the allocation of the actual JSArray object.
-  AllocationBuilder a(jsgraph(), effect, control);
+  AllocationBuilder a(jsgraph(), js_heap_broker(), effect, control);
   a.Allocate(map->instance_size());
   a.Store(AccessBuilder::ForMap(), js_object_map);
   a.Store(AccessBuilder::ForJSObjectPropertiesOrHash(), properties);
   a.Store(AccessBuilder::ForJSObjectElements(), elements);
   for (int i = 0; i < map->GetInObjectProperties(); i++) {
-    a.Store(AccessBuilder::ForJSObjectInObjectProperty(map, i),
+    a.Store(AccessBuilder::ForJSObjectInObjectProperty(MapRef(map), i),
             jsgraph()->UndefinedConstant());
   }
 
@@ -1261,15 +1229,17 @@ Reduction JSCreateLowering::ReduceJSCreateEmptyLiteralObject(Node* node) {
 }
 
 Reduction JSCreateLowering::ReduceJSCreateLiteralRegExp(Node* node) {
+  DisallowHeapAccess no_heap_access;
   DCHECK_EQ(IrOpcode::kJSCreateLiteralRegExp, node->opcode());
   CreateLiteralParameters const& p = CreateLiteralParametersOf(node->op());
   Node* effect = NodeProperties::GetEffectInput(node);
   Node* control = NodeProperties::GetControlInput(node);
 
-  Handle<Object> feedback(p.feedback().vector()->Get(p.feedback().slot()),
-                          isolate());
-  if (feedback->IsJSRegExp()) {
-    Handle<JSRegExp> boilerplate = Handle<JSRegExp>::cast(feedback);
+  FeedbackVectorRef feedback_vector(p.feedback().vector());
+  ObjectRef feedback =
+      feedback_vector.get(js_heap_broker(), p.feedback().slot());
+  if (feedback.IsJSRegExp()) {
+    JSRegExpRef boilerplate = feedback.AsJSRegExp();
     Node* value = effect = AllocateLiteralRegExp(effect, control, boilerplate);
     ReplaceWithValue(node, value, effect, control);
     return Replace(value);
@@ -1278,12 +1248,13 @@ Reduction JSCreateLowering::ReduceJSCreateLiteralRegExp(Node* node) {
 }
 
 Reduction JSCreateLowering::ReduceJSCreateFunctionContext(Node* node) {
+  DisallowHeapAccess no_heap_access;
   DCHECK_EQ(IrOpcode::kJSCreateFunctionContext, node->opcode());
   const CreateFunctionContextParameters& parameters =
       CreateFunctionContextParametersOf(node->op());
+  ScopeInfoRef scope_info(parameters.scope_info());
   int slot_count = parameters.slot_count();
   ScopeType scope_type = parameters.scope_type();
-  Node* const closure = NodeProperties::GetValueInput(node, 0);
 
   // Use inline allocation for function contexts up to a size limit.
   if (slot_count < kFunctionContextAllocationLimit) {
@@ -1292,7 +1263,7 @@ Reduction JSCreateLowering::ReduceJSCreateFunctionContext(Node* node) {
     Node* control = NodeProperties::GetControlInput(node);
     Node* context = NodeProperties::GetContextInput(node);
     Node* extension = jsgraph()->TheHoleConstant();
-    AllocationBuilder a(jsgraph(), effect, control);
+    AllocationBuilder a(jsgraph(), js_heap_broker(), effect, control);
     STATIC_ASSERT(Context::MIN_CONTEXT_SLOTS == 4);  // Ensure fully covered.
     int context_length = slot_count + Context::MIN_CONTEXT_SLOTS;
     Handle<Map> map;
@@ -1307,7 +1278,8 @@ Reduction JSCreateLowering::ReduceJSCreateFunctionContext(Node* node) {
         UNREACHABLE();
     }
     a.AllocateContext(context_length, map);
-    a.Store(AccessBuilder::ForContextSlot(Context::CLOSURE_INDEX), closure);
+    a.Store(AccessBuilder::ForContextSlot(Context::SCOPE_INFO_INDEX),
+            scope_info);
     a.Store(AccessBuilder::ForContextSlot(Context::PREVIOUS_INDEX), context);
     a.Store(AccessBuilder::ForContextSlot(Context::EXTENSION_INDEX), extension);
     a.Store(AccessBuilder::ForContextSlot(Context::NATIVE_CONTEXT_INDEX),
@@ -1324,25 +1296,18 @@ Reduction JSCreateLowering::ReduceJSCreateFunctionContext(Node* node) {
 }
 
 Reduction JSCreateLowering::ReduceJSCreateWithContext(Node* node) {
+  DisallowHeapAccess no_heap_access;
   DCHECK_EQ(IrOpcode::kJSCreateWithContext, node->opcode());
-  Handle<ScopeInfo> scope_info = ScopeInfoOf(node->op());
-  Node* object = NodeProperties::GetValueInput(node, 0);
-  Node* closure = NodeProperties::GetValueInput(node, 1);
+  ScopeInfoRef scope_info(ScopeInfoOf(node->op()));
+  Node* extension = NodeProperties::GetValueInput(node, 0);
   Node* effect = NodeProperties::GetEffectInput(node);
   Node* control = NodeProperties::GetControlInput(node);
   Node* context = NodeProperties::GetContextInput(node);
 
-  AllocationBuilder aa(jsgraph(), effect, control);
-  aa.Allocate(ContextExtension::kSize);
-  aa.Store(AccessBuilder::ForMap(), factory()->context_extension_map());
-  aa.Store(AccessBuilder::ForContextExtensionScopeInfo(), scope_info);
-  aa.Store(AccessBuilder::ForContextExtensionExtension(), object);
-  Node* extension = aa.Finish();
-
-  AllocationBuilder a(jsgraph(), extension, control);
+  AllocationBuilder a(jsgraph(), js_heap_broker(), effect, control);
   STATIC_ASSERT(Context::MIN_CONTEXT_SLOTS == 4);  // Ensure fully covered.
   a.AllocateContext(Context::MIN_CONTEXT_SLOTS, factory()->with_context_map());
-  a.Store(AccessBuilder::ForContextSlot(Context::CLOSURE_INDEX), closure);
+  a.Store(AccessBuilder::ForContextSlot(Context::SCOPE_INFO_INDEX), scope_info);
   a.Store(AccessBuilder::ForContextSlot(Context::PREVIOUS_INDEX), context);
   a.Store(AccessBuilder::ForContextSlot(Context::EXTENSION_INDEX), extension);
   a.Store(AccessBuilder::ForContextSlot(Context::NATIVE_CONTEXT_INDEX),
@@ -1353,29 +1318,20 @@ Reduction JSCreateLowering::ReduceJSCreateWithContext(Node* node) {
 }
 
 Reduction JSCreateLowering::ReduceJSCreateCatchContext(Node* node) {
+  DisallowHeapAccess no_heap_access;
   DCHECK_EQ(IrOpcode::kJSCreateCatchContext, node->opcode());
-  const CreateCatchContextParameters& parameters =
-      CreateCatchContextParametersOf(node->op());
+  ScopeInfoRef scope_info(ScopeInfoOf(node->op()));
   Node* exception = NodeProperties::GetValueInput(node, 0);
-  Node* closure = NodeProperties::GetValueInput(node, 1);
   Node* effect = NodeProperties::GetEffectInput(node);
   Node* control = NodeProperties::GetControlInput(node);
   Node* context = NodeProperties::GetContextInput(node);
+  Node* extension = jsgraph()->TheHoleConstant();
 
-  AllocationBuilder aa(jsgraph(), effect, control);
-  aa.Allocate(ContextExtension::kSize);
-  aa.Store(AccessBuilder::ForMap(), factory()->context_extension_map());
-  aa.Store(AccessBuilder::ForContextExtensionScopeInfo(),
-           parameters.scope_info());
-  aa.Store(AccessBuilder::ForContextExtensionExtension(),
-           parameters.catch_name());
-  Node* extension = aa.Finish();
-
-  AllocationBuilder a(jsgraph(), extension, control);
+  AllocationBuilder a(jsgraph(), js_heap_broker(), effect, control);
   STATIC_ASSERT(Context::MIN_CONTEXT_SLOTS == 4);  // Ensure fully covered.
   a.AllocateContext(Context::MIN_CONTEXT_SLOTS + 1,
                     factory()->catch_context_map());
-  a.Store(AccessBuilder::ForContextSlot(Context::CLOSURE_INDEX), closure);
+  a.Store(AccessBuilder::ForContextSlot(Context::SCOPE_INFO_INDEX), scope_info);
   a.Store(AccessBuilder::ForContextSlot(Context::PREVIOUS_INDEX), context);
   a.Store(AccessBuilder::ForContextSlot(Context::EXTENSION_INDEX), extension);
   a.Store(AccessBuilder::ForContextSlot(Context::NATIVE_CONTEXT_INDEX),
@@ -1388,10 +1344,10 @@ Reduction JSCreateLowering::ReduceJSCreateCatchContext(Node* node) {
 }
 
 Reduction JSCreateLowering::ReduceJSCreateBlockContext(Node* node) {
+  DisallowHeapAccess no_heap_access;
   DCHECK_EQ(IrOpcode::kJSCreateBlockContext, node->opcode());
-  Handle<ScopeInfo> scope_info = ScopeInfoOf(node->op());
-  int const context_length = scope_info->ContextLength();
-  Node* const closure = NodeProperties::GetValueInput(node, 0);
+  ScopeInfoRef scope_info(ScopeInfoOf(node->op()));
+  int const context_length = scope_info.ContextLength();
 
   // Use inline allocation for block contexts up to a size limit.
   if (context_length < kBlockContextAllocationLimit) {
@@ -1399,12 +1355,13 @@ Reduction JSCreateLowering::ReduceJSCreateBlockContext(Node* node) {
     Node* effect = NodeProperties::GetEffectInput(node);
     Node* control = NodeProperties::GetControlInput(node);
     Node* context = NodeProperties::GetContextInput(node);
-    Node* extension = jsgraph()->Constant(scope_info);
+    Node* extension = jsgraph()->TheHoleConstant();
 
-    AllocationBuilder a(jsgraph(), effect, control);
+    AllocationBuilder a(jsgraph(), js_heap_broker(), effect, control);
     STATIC_ASSERT(Context::MIN_CONTEXT_SLOTS == 4);  // Ensure fully covered.
     a.AllocateContext(context_length, factory()->block_context_map());
-    a.Store(AccessBuilder::ForContextSlot(Context::CLOSURE_INDEX), closure);
+    a.Store(AccessBuilder::ForContextSlot(Context::SCOPE_INFO_INDEX),
+            scope_info);
     a.Store(AccessBuilder::ForContextSlot(Context::PREVIOUS_INDEX), context);
     a.Store(AccessBuilder::ForContextSlot(Context::EXTENSION_INDEX), extension);
     a.Store(AccessBuilder::ForContextSlot(Context::NATIVE_CONTEXT_INDEX),
@@ -1420,6 +1377,88 @@ Reduction JSCreateLowering::ReduceJSCreateBlockContext(Node* node) {
   return NoChange();
 }
 
+Reduction JSCreateLowering::ReduceJSCreateObject(Node* node) {
+  DisallowHeapAccess no_heap_access;
+  DCHECK_EQ(IrOpcode::kJSCreateObject, node->opcode());
+  Node* effect = NodeProperties::GetEffectInput(node);
+  Node* control = NodeProperties::GetControlInput(node);
+  Node* prototype = NodeProperties::GetValueInput(node, 0);
+  Type prototype_type = NodeProperties::GetType(prototype);
+  if (!prototype_type.IsHeapConstant()) return NoChange();
+
+  HeapObjectRef prototype_const = prototype_type.AsHeapConstant()->Ref();
+  auto maybe_instance_map =
+      prototype_const.TryGetObjectCreateMap(js_heap_broker());
+  if (!maybe_instance_map) return NoChange();
+  MapRef instance_map = maybe_instance_map.value();
+
+  Node* properties = jsgraph()->EmptyFixedArrayConstant();
+  if (instance_map.is_dictionary_map()) {
+    DCHECK_EQ(prototype_const.type(js_heap_broker()).oddball_type(),
+              OddballType::kNull);
+    // Allocate an empty NameDictionary as backing store for the properties.
+    Handle<Map> map = isolate()->factory()->name_dictionary_map();
+    int capacity =
+        NameDictionary::ComputeCapacity(NameDictionary::kInitialCapacity);
+    DCHECK(base::bits::IsPowerOfTwo(capacity));
+    int length = NameDictionary::EntryToIndex(capacity);
+    int size = NameDictionary::SizeFor(length);
+
+    AllocationBuilder a(jsgraph(), js_heap_broker(), effect, control);
+    a.Allocate(size, NOT_TENURED, Type::Any());
+    a.Store(AccessBuilder::ForMap(), map);
+    // Initialize FixedArray fields.
+    a.Store(AccessBuilder::ForFixedArrayLength(),
+            jsgraph()->SmiConstant(length));
+    // Initialize HashTable fields.
+    a.Store(AccessBuilder::ForHashTableBaseNumberOfElements(),
+            jsgraph()->SmiConstant(0));
+    a.Store(AccessBuilder::ForHashTableBaseNumberOfDeletedElement(),
+            jsgraph()->SmiConstant(0));
+    a.Store(AccessBuilder::ForHashTableBaseCapacity(),
+            jsgraph()->SmiConstant(capacity));
+    // Initialize Dictionary fields.
+    a.Store(AccessBuilder::ForDictionaryNextEnumerationIndex(),
+            jsgraph()->SmiConstant(PropertyDetails::kInitialIndex));
+    a.Store(AccessBuilder::ForDictionaryObjectHashIndex(),
+            jsgraph()->SmiConstant(PropertyArray::kNoHashSentinel));
+    // Initialize the Properties fields.
+    Node* undefined = jsgraph()->UndefinedConstant();
+    STATIC_ASSERT(NameDictionary::kElementsStartIndex ==
+                  NameDictionary::kObjectHashIndex + 1);
+    for (int index = NameDictionary::kElementsStartIndex; index < length;
+         index++) {
+      a.Store(AccessBuilder::ForFixedArraySlot(index, kNoWriteBarrier),
+              undefined);
+    }
+    properties = effect = a.Finish();
+  }
+
+  int const instance_size = instance_map.instance_size();
+  if (instance_size > kMaxRegularHeapObjectSize) return NoChange();
+  CHECK(!instance_map.IsInobjectSlackTrackingInProgress());
+
+  // Emit code to allocate the JSObject instance for the given
+  // {instance_map}.
+  AllocationBuilder a(jsgraph(), js_heap_broker(), effect, control);
+  a.Allocate(instance_size, NOT_TENURED, Type::Any());
+  a.Store(AccessBuilder::ForMap(), instance_map);
+  a.Store(AccessBuilder::ForJSObjectPropertiesOrHash(), properties);
+  a.Store(AccessBuilder::ForJSObjectElements(),
+          jsgraph()->EmptyFixedArrayConstant());
+  // Initialize Object fields.
+  Node* undefined = jsgraph()->UndefinedConstant();
+  for (int offset = JSObject::kHeaderSize; offset < instance_size;
+       offset += kPointerSize) {
+    a.Store(AccessBuilder::ForJSObjectOffset(offset, kNoWriteBarrier),
+            undefined);
+  }
+  Node* value = effect = a.Finish();
+
+  ReplaceWithValue(node, value, effect, control);
+  return Replace(value);
+}
+
 // Helper that allocates a FixedArray holding argument values recorded in the
 // given {frame_state}. Serves as backing store for JSCreateArguments nodes.
 Node* JSCreateLowering::AllocateArguments(Node* effect, Node* control,
@@ -1434,7 +1473,7 @@ Node* JSCreateLowering::AllocateArguments(Node* effect, Node* control,
   auto parameters_it = ++parameters_access.begin();
 
   // Actually allocate the backing store.
-  AllocationBuilder a(jsgraph(), effect, control);
+  AllocationBuilder a(jsgraph(), js_heap_broker(), effect, control);
   a.AllocateArray(argument_count, factory()->fixed_array_map());
   for (int i = 0; i < argument_count; ++i, ++parameters_it) {
     DCHECK_NOT_NULL((*parameters_it).node);
@@ -1464,7 +1503,7 @@ Node* JSCreateLowering::AllocateRestArguments(Node* effect, Node* control,
   }
 
   // Actually allocate the backing store.
-  AllocationBuilder a(jsgraph(), effect, control);
+  AllocationBuilder a(jsgraph(), js_heap_broker(), effect, control);
   a.AllocateArray(num_elements, factory()->fixed_array_map());
   for (int i = 0; i < num_elements; ++i, ++parameters_it) {
     DCHECK_NOT_NULL((*parameters_it).node);
@@ -1478,14 +1517,14 @@ Node* JSCreateLowering::AllocateRestArguments(Node* effect, Node* control,
 // given {context}. Serves as backing store for JSCreateArguments nodes.
 Node* JSCreateLowering::AllocateAliasedArguments(
     Node* effect, Node* control, Node* frame_state, Node* context,
-    Handle<SharedFunctionInfo> shared, bool* has_aliased_arguments) {
+    const SharedFunctionInfoRef& shared, bool* has_aliased_arguments) {
   FrameStateInfo state_info = FrameStateInfoOf(frame_state->op());
   int argument_count = state_info.parameter_count() - 1;  // Minus receiver.
   if (argument_count == 0) return jsgraph()->EmptyFixedArrayConstant();
 
   // If there is no aliasing, the arguments object elements are not special in
   // any way, we can just return an unmapped backing store instead.
-  int parameter_count = shared->internal_formal_parameter_count();
+  int parameter_count = shared.internal_formal_parameter_count();
   if (parameter_count == 0) {
     return AllocateArguments(effect, control, frame_state);
   }
@@ -1502,7 +1541,7 @@ Node* JSCreateLowering::AllocateAliasedArguments(
   // The unmapped argument values recorded in the frame state are stored yet
   // another indirection away and then linked into the parameter map below,
   // whereas mapped argument values are replaced with a hole instead.
-  AllocationBuilder aa(jsgraph(), effect, control);
+  AllocationBuilder aa(jsgraph(), js_heap_broker(), effect, control);
   aa.AllocateArray(argument_count, factory()->fixed_array_map());
   for (int i = 0; i < mapped_count; ++i, ++parameters_it) {
     aa.Store(AccessBuilder::ForFixedArraySlot(i), jsgraph()->TheHoleConstant());
@@ -1514,7 +1553,7 @@ Node* JSCreateLowering::AllocateAliasedArguments(
   Node* arguments = aa.Finish();
 
   // Actually allocate the backing store.
-  AllocationBuilder a(jsgraph(), arguments, control);
+  AllocationBuilder a(jsgraph(), js_heap_broker(), arguments, control);
   a.AllocateArray(mapped_count + 2, factory()->sloppy_arguments_elements_map());
   a.Store(AccessBuilder::ForFixedArraySlot(0), context);
   a.Store(AccessBuilder::ForFixedArraySlot(1), arguments);
@@ -1531,11 +1570,11 @@ Node* JSCreateLowering::AllocateAliasedArguments(
 // Serves as backing store for JSCreateArguments nodes.
 Node* JSCreateLowering::AllocateAliasedArguments(
     Node* effect, Node* control, Node* context, Node* arguments_frame,
-    Node* arguments_length, Handle<SharedFunctionInfo> shared,
+    Node* arguments_length, const SharedFunctionInfoRef& shared,
     bool* has_aliased_arguments) {
   // If there is no aliasing, the arguments object elements are not
   // special in any way, we can just return an unmapped backing store.
-  int parameter_count = shared->internal_formal_parameter_count();
+  int parameter_count = shared.internal_formal_parameter_count();
   if (parameter_count == 0) {
     return graph()->NewNode(simplified()->NewArgumentsElements(0),
                             arguments_frame, arguments_length, effect);
@@ -1556,7 +1595,7 @@ Node* JSCreateLowering::AllocateAliasedArguments(
                        arguments_frame, arguments_length, effect);
 
   // Actually allocate the backing store.
-  AllocationBuilder a(jsgraph(), arguments, control);
+  AllocationBuilder a(jsgraph(), js_heap_broker(), arguments, control);
   a.AllocateArray(mapped_count + 2, factory()->sloppy_arguments_elements_map());
   a.Store(AccessBuilder::ForFixedArraySlot(0), context);
   a.Store(AccessBuilder::ForFixedArraySlot(1), arguments);
@@ -1588,7 +1627,7 @@ Node* JSCreateLowering::AllocateElements(Node* effect, Node* control,
   Node* value = jsgraph()->TheHoleConstant();
 
   // Actually allocate the backing store.
-  AllocationBuilder a(jsgraph(), effect, control);
+  AllocationBuilder a(jsgraph(), js_heap_broker(), effect, control);
   a.AllocateArray(capacity, elements_map, pretenure);
   for (int i = 0; i < capacity; ++i) {
     Node* index = jsgraph()->Constant(i);
@@ -1613,7 +1652,7 @@ Node* JSCreateLowering::AllocateElements(Node* effect, Node* control,
                              : AccessBuilder::ForFixedArrayElement();
 
   // Actually allocate the backing store.
-  AllocationBuilder a(jsgraph(), effect, control);
+  AllocationBuilder a(jsgraph(), js_heap_broker(), effect, control);
   a.AllocateArray(capacity, elements_map, pretenure);
   for (int i = 0; i < capacity; ++i) {
     Node* index = jsgraph()->Constant(i);
@@ -1622,61 +1661,44 @@ Node* JSCreateLowering::AllocateElements(Node* effect, Node* control,
   return a.Finish();
 }
 
-Node* JSCreateLowering::AllocateFastLiteral(
-    Node* effect, Node* control, Handle<JSObject> boilerplate,
-    AllocationSiteUsageContext* site_context) {
-  Handle<AllocationSite> current_site(*site_context->current(), isolate());
-  dependencies()->AssumeTransitionStable(current_site);
-
-  PretenureFlag pretenure = NOT_TENURED;
-  if (FLAG_allocation_site_pretenuring) {
-    Handle<AllocationSite> top_site(*site_context->top(), isolate());
-    pretenure = top_site->GetPretenureMode();
-    if (current_site.is_identical_to(top_site)) {
-      // We install a dependency for pretenuring only on the outermost literal.
-      dependencies()->AssumeTenuringDecision(top_site);
-    }
-  }
-
+Node* JSCreateLowering::AllocateFastLiteral(Node* effect, Node* control,
+                                            JSObjectRef boilerplate,
+                                            PretenureFlag pretenure) {
   // Setup the properties backing store.
   Node* properties = jsgraph()->EmptyFixedArrayConstant();
 
   // Compute the in-object properties to store first (might have effects).
-  Handle<Map> boilerplate_map(boilerplate->map(), isolate());
+  MapRef boilerplate_map = boilerplate.map(js_heap_broker());
   ZoneVector<std::pair<FieldAccess, Node*>> inobject_fields(zone());
-  inobject_fields.reserve(boilerplate_map->GetInObjectProperties());
-  int const boilerplate_nof = boilerplate_map->NumberOfOwnDescriptors();
+  inobject_fields.reserve(boilerplate_map.GetInObjectProperties());
+  int const boilerplate_nof = boilerplate_map.NumberOfOwnDescriptors();
   for (int i = 0; i < boilerplate_nof; ++i) {
     PropertyDetails const property_details =
-        boilerplate_map->instance_descriptors()->GetDetails(i);
+        boilerplate_map.GetPropertyDetails(i);
     if (property_details.location() != kField) continue;
     DCHECK_EQ(kData, property_details.kind());
-    Handle<Name> property_name(
-        boilerplate_map->instance_descriptors()->GetKey(i), isolate());
-    FieldIndex index = FieldIndex::ForDescriptor(*boilerplate_map, i);
-    FieldAccess access = {kTaggedBase,      index.offset(),
-                          property_name,    MaybeHandle<Map>(),
-                          Type::Any(),      MachineType::AnyTagged(),
-                          kFullWriteBarrier};
+    NameRef property_name = boilerplate_map.GetPropertyKey(js_heap_broker(), i);
+    FieldIndex index = boilerplate_map.GetFieldIndexFor(i);
+    FieldAccess access = {
+        kTaggedBase,        index.offset(), property_name.object<Name>(),
+        MaybeHandle<Map>(), Type::Any(),    MachineType::AnyTagged(),
+        kFullWriteBarrier};
     Node* value;
-    if (boilerplate->IsUnboxedDoubleField(index)) {
+    if (boilerplate.IsUnboxedDoubleField(index)) {
       access.machine_type = MachineType::Float64();
       access.type = Type::Number();
-      value = jsgraph()->Constant(boilerplate->RawFastDoublePropertyAt(index));
+      value = jsgraph()->Constant(boilerplate.RawFastDoublePropertyAt(index));
     } else {
-      Handle<Object> boilerplate_value(boilerplate->RawFastPropertyAt(index),
-                                       isolate());
-      if (boilerplate_value->IsJSObject()) {
-        Handle<JSObject> boilerplate_object =
-            Handle<JSObject>::cast(boilerplate_value);
-        Handle<AllocationSite> current_site = site_context->EnterNewScope();
-        value = effect = AllocateFastLiteral(effect, control,
-                                             boilerplate_object, site_context);
-        site_context->ExitScope(current_site, boilerplate_object);
+      ObjectRef boilerplate_value =
+          boilerplate.RawFastPropertyAt(js_heap_broker(), index);
+      if (boilerplate_value.IsJSObject()) {
+        JSObjectRef boilerplate_object = boilerplate_value.AsJSObject();
+        value = effect =
+            AllocateFastLiteral(effect, control, boilerplate_object, pretenure);
       } else if (property_details.representation().IsDouble()) {
-        double number = Handle<HeapNumber>::cast(boilerplate_value)->value();
+        double number = boilerplate_value.AsMutableHeapNumber().value();
         // Allocate a mutable HeapNumber box and store the value into it.
-        AllocationBuilder builder(jsgraph(), effect, control);
+        AllocationBuilder builder(jsgraph(), js_heap_broker(), effect, control);
         builder.Allocate(HeapNumber::kSize, pretenure);
         builder.Store(AccessBuilder::ForMap(),
                       factory()->mutable_heap_number_map());
@@ -1685,18 +1707,19 @@ Node* JSCreateLowering::AllocateFastLiteral(
         value = effect = builder.Finish();
       } else if (property_details.representation().IsSmi()) {
         // Ensure that value is stored as smi.
-        value = boilerplate_value->IsUninitialized(isolate())
+        value = boilerplate_value.oddball_type(js_heap_broker()) ==
+                        OddballType::kUninitialized
                     ? jsgraph()->ZeroConstant()
-                    : jsgraph()->Constant(boilerplate_value);
+                    : jsgraph()->Constant(boilerplate_value.AsSmi());
       } else {
-        value = jsgraph()->Constant(boilerplate_value);
+        value = jsgraph()->Constant(js_heap_broker(), boilerplate_value);
       }
     }
     inobject_fields.push_back(std::make_pair(access, value));
   }
 
   // Fill slack at the end of the boilerplate object with filler maps.
-  int const boilerplate_length = boilerplate_map->GetInObjectProperties();
+  int const boilerplate_length = boilerplate_map.GetInObjectProperties();
   for (int index = static_cast<int>(inobject_fields.size());
        index < boilerplate_length; ++index) {
     FieldAccess access =
@@ -1706,22 +1729,22 @@ Node* JSCreateLowering::AllocateFastLiteral(
   }
 
   // Setup the elements backing store.
-  Node* elements = AllocateFastLiteralElements(effect, control, boilerplate,
-                                               pretenure, site_context);
+  Node* elements =
+      AllocateFastLiteralElements(effect, control, boilerplate, pretenure);
   if (elements->op()->EffectOutputCount() > 0) effect = elements;
 
   // Actually allocate and initialize the object.
-  AllocationBuilder builder(jsgraph(), effect, control);
-  builder.Allocate(boilerplate_map->instance_size(), pretenure,
-                   Type::For(boilerplate_map));
+  AllocationBuilder builder(jsgraph(), js_heap_broker(), effect, control);
+  builder.Allocate(boilerplate_map.instance_size(), pretenure,
+                   Type::For(js_heap_broker(), boilerplate_map.object<Map>()));
   builder.Store(AccessBuilder::ForMap(), boilerplate_map);
   builder.Store(AccessBuilder::ForJSObjectPropertiesOrHash(), properties);
   builder.Store(AccessBuilder::ForJSObjectElements(), elements);
-  if (boilerplate_map->IsJSArrayMap()) {
-    Handle<JSArray> boilerplate_array = Handle<JSArray>::cast(boilerplate);
+  if (boilerplate_map.IsJSArrayMap()) {
+    JSArrayRef boilerplate_array = boilerplate.AsJSArray();
     builder.Store(
-        AccessBuilder::ForJSArrayLength(boilerplate_array->GetElementsKind()),
-        handle(boilerplate_array->length(), isolate()));
+        AccessBuilder::ForJSArrayLength(boilerplate_array.GetElementsKind()),
+        boilerplate_array.length(js_heap_broker()));
   }
   for (auto const& inobject_field : inobject_fields) {
     builder.Store(inobject_field.first, inobject_field.second);
@@ -1729,69 +1752,58 @@ Node* JSCreateLowering::AllocateFastLiteral(
   return builder.Finish();
 }
 
-Node* JSCreateLowering::AllocateFastLiteralElements(
-    Node* effect, Node* control, Handle<JSObject> boilerplate,
-    PretenureFlag pretenure, AllocationSiteUsageContext* site_context) {
-  Handle<FixedArrayBase> boilerplate_elements(boilerplate->elements(),
-                                              isolate());
+Node* JSCreateLowering::AllocateFastLiteralElements(Node* effect, Node* control,
+                                                    JSObjectRef boilerplate,
+                                                    PretenureFlag pretenure) {
+  FixedArrayBaseRef boilerplate_elements =
+      boilerplate.elements(js_heap_broker());
 
   // Empty or copy-on-write elements just store a constant.
-  if (boilerplate_elements->length() == 0 ||
-      boilerplate_elements->map() == isolate()->heap()->fixed_cow_array_map()) {
-    if (pretenure == TENURED &&
-        isolate()->heap()->InNewSpace(*boilerplate_elements)) {
-      // If we would like to pretenure a fixed cow array, we must ensure that
-      // the array is already in old space, otherwise we'll create too many
-      // old-to-new-space pointers (overflowing the store buffer).
-      boilerplate_elements = Handle<FixedArrayBase>(
-          isolate()->factory()->CopyAndTenureFixedCOWArray(
-              Handle<FixedArray>::cast(boilerplate_elements)));
-      boilerplate->set_elements(*boilerplate_elements);
+  int const elements_length = boilerplate_elements.length();
+  MapRef elements_map = boilerplate_elements.map(js_heap_broker());
+  if (boilerplate_elements.length() == 0 ||
+      elements_map.IsFixedCowArrayMap(js_heap_broker())) {
+    if (pretenure == TENURED) {
+      boilerplate.EnsureElementsTenured(js_heap_broker());
+      boilerplate_elements = boilerplate.elements(js_heap_broker());
     }
-    return jsgraph()->HeapConstant(boilerplate_elements);
+    return jsgraph()->HeapConstant(boilerplate_elements.object<HeapObject>());
   }
 
   // Compute the elements to store first (might have effects).
-  int const elements_length = boilerplate_elements->length();
-  Handle<Map> elements_map(boilerplate_elements->map(), isolate());
   ZoneVector<Node*> elements_values(elements_length, zone());
-  if (elements_map->instance_type() == FIXED_DOUBLE_ARRAY_TYPE) {
-    Handle<FixedDoubleArray> elements =
-        Handle<FixedDoubleArray>::cast(boilerplate_elements);
+  if (elements_map.instance_type() == FIXED_DOUBLE_ARRAY_TYPE) {
+    FixedDoubleArrayRef elements = boilerplate_elements.AsFixedDoubleArray();
     for (int i = 0; i < elements_length; ++i) {
-      if (elements->is_the_hole(i)) {
+      if (elements.is_the_hole(i)) {
         elements_values[i] = jsgraph()->TheHoleConstant();
       } else {
-        elements_values[i] = jsgraph()->Constant(elements->get_scalar(i));
+        elements_values[i] = jsgraph()->Constant(elements.get_scalar(i));
       }
     }
   } else {
-    Handle<FixedArray> elements =
-        Handle<FixedArray>::cast(boilerplate_elements);
+    FixedArrayRef elements = boilerplate_elements.AsFixedArray();
     for (int i = 0; i < elements_length; ++i) {
-      if (elements->is_the_hole(isolate(), i)) {
+      if (elements.is_the_hole(js_heap_broker(), i)) {
         elements_values[i] = jsgraph()->TheHoleConstant();
       } else {
-        Handle<Object> element_value(elements->get(i), isolate());
-        if (element_value->IsJSObject()) {
-          Handle<JSObject> boilerplate_object =
-              Handle<JSObject>::cast(element_value);
-          Handle<AllocationSite> current_site = site_context->EnterNewScope();
+        ObjectRef element_value = elements.get(js_heap_broker(), i);
+        if (element_value.IsJSObject()) {
           elements_values[i] = effect = AllocateFastLiteral(
-              effect, control, boilerplate_object, site_context);
-          site_context->ExitScope(current_site, boilerplate_object);
+              effect, control, element_value.AsJSObject(), pretenure);
         } else {
-          elements_values[i] = jsgraph()->Constant(element_value);
+          elements_values[i] =
+              jsgraph()->Constant(js_heap_broker(), element_value);
         }
       }
     }
   }
 
   // Allocate the backing store array and store the elements.
-  AllocationBuilder builder(jsgraph(), effect, control);
-  builder.AllocateArray(elements_length, elements_map, pretenure);
+  AllocationBuilder builder(jsgraph(), js_heap_broker(), effect, control);
+  builder.AllocateArray(elements_length, elements_map.object<Map>(), pretenure);
   ElementAccess const access =
-      (elements_map->instance_type() == FIXED_DOUBLE_ARRAY_TYPE)
+      (elements_map.instance_type() == FIXED_DOUBLE_ARRAY_TYPE)
           ? AccessBuilder::ForFixedDoubleArrayElement()
           : AccessBuilder::ForFixedArrayElement();
   for (int i = 0; i < elements_length; ++i) {
@@ -1801,8 +1813,8 @@ Node* JSCreateLowering::AllocateFastLiteralElements(
 }
 
 Node* JSCreateLowering::AllocateLiteralRegExp(Node* effect, Node* control,
-                                              Handle<JSRegExp> boilerplate) {
-  Handle<Map> boilerplate_map(boilerplate->map(), isolate());
+                                              JSRegExpRef boilerplate) {
+  MapRef boilerplate_map = boilerplate.map(js_heap_broker());
 
   // Sanity check that JSRegExp object layout hasn't changed.
   STATIC_ASSERT(JSRegExp::kDataOffset == JSObject::kHeaderSize);
@@ -1818,22 +1830,23 @@ Node* JSCreateLowering::AllocateLiteralRegExp(Node* effect, Node* control,
   const int size =
       JSRegExp::kSize + JSRegExp::kInObjectFieldCount * kPointerSize;
 
-  AllocationBuilder builder(jsgraph(), effect, control);
-  builder.Allocate(size, pretenure, Type::For(boilerplate_map));
+  AllocationBuilder builder(jsgraph(), js_heap_broker(), effect, control);
+  builder.Allocate(size, pretenure,
+                   Type::For(js_heap_broker(), boilerplate_map.object<Map>()));
   builder.Store(AccessBuilder::ForMap(), boilerplate_map);
   builder.Store(AccessBuilder::ForJSObjectPropertiesOrHash(),
-                handle(boilerplate->raw_properties_or_hash(), isolate()));
+                boilerplate.raw_properties_or_hash(js_heap_broker()));
   builder.Store(AccessBuilder::ForJSObjectElements(),
-                handle(boilerplate->elements(), isolate()));
+                boilerplate.elements(js_heap_broker()));
 
   builder.Store(AccessBuilder::ForJSRegExpData(),
-                handle(boilerplate->data(), isolate()));
+                boilerplate.data(js_heap_broker()));
   builder.Store(AccessBuilder::ForJSRegExpSource(),
-                handle(boilerplate->source(), isolate()));
+                boilerplate.source(js_heap_broker()));
   builder.Store(AccessBuilder::ForJSRegExpFlags(),
-                handle(boilerplate->flags(), isolate()));
+                boilerplate.flags(js_heap_broker()));
   builder.Store(AccessBuilder::ForJSRegExpLastIndex(),
-                handle(boilerplate->last_index(), isolate()));
+                boilerplate.last_index(js_heap_broker()));
 
   return builder.Finish();
 }
@@ -1852,6 +1865,10 @@ SimplifiedOperatorBuilder* JSCreateLowering::simplified() const {
   return jsgraph()->simplified();
 }
 
+NativeContextRef JSCreateLowering::native_context_ref() const {
+  return NativeContextRef(native_context());
+}
+
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/src/compiler/js-create-lowering.h b/deps/v8/src/compiler/js-create-lowering.h
index af245f3f631c5a..667298c2388db6 100644
--- a/deps/v8/src/compiler/js-create-lowering.h
+++ b/deps/v8/src/compiler/js-create-lowering.h
@@ -14,7 +14,6 @@ namespace internal {
 
 // Forward declarations.
 class AllocationSiteUsageContext;
-class CompilationDependencies;
 class Factory;
 class JSRegExp;
 
@@ -22,6 +21,7 @@ namespace compiler {
 
 // Forward declarations.
 class CommonOperatorBuilder;
+class CompilationDependencies;
 class JSGraph;
 class JSOperatorBuilder;
 class MachineOperatorBuilder;
@@ -33,11 +33,12 @@ class V8_EXPORT_PRIVATE JSCreateLowering final
     : public NON_EXPORTED_BASE(AdvancedReducer) {
  public:
   JSCreateLowering(Editor* editor, CompilationDependencies* dependencies,
-                   JSGraph* jsgraph,
+                   JSGraph* jsgraph, const JSHeapBroker* js_heap_broker,
                    Handle<Context> native_context, Zone* zone)
       : AdvancedReducer(editor),
         dependencies_(dependencies),
         jsgraph_(jsgraph),
+        js_heap_broker_(js_heap_broker),
         native_context_(native_context),
         zone_(zone) {}
   ~JSCreateLowering() final {}
@@ -73,16 +74,18 @@ class V8_EXPORT_PRIVATE JSCreateLowering final
                            Handle<Map> initial_map, PretenureFlag pretenure);
   Reduction ReduceNewArray(Node* node, std::vector<Node*> values,
                            Handle<Map> initial_map, PretenureFlag pretenure);
+  Reduction ReduceJSCreateObject(Node* node);
 
   Node* AllocateArguments(Node* effect, Node* control, Node* frame_state);
   Node* AllocateRestArguments(Node* effect, Node* control, Node* frame_state,
                               int start_index);
   Node* AllocateAliasedArguments(Node* effect, Node* control, Node* frame_state,
-                                 Node* context, Handle<SharedFunctionInfo>,
+                                 Node* context,
+                                 const SharedFunctionInfoRef& shared,
                                  bool* has_aliased_arguments);
   Node* AllocateAliasedArguments(Node* effect, Node* control, Node* context,
                                  Node* arguments_frame, Node* arguments_length,
-                                 Handle<SharedFunctionInfo>,
+                                 const SharedFunctionInfoRef& shared,
                                  bool* has_aliased_arguments);
   Node* AllocateElements(Node* effect, Node* control,
                          ElementsKind elements_kind, int capacity,
@@ -94,14 +97,12 @@ class V8_EXPORT_PRIVATE JSCreateLowering final
                          std::vector<Node*> const& values,
                          PretenureFlag pretenure);
   Node* AllocateFastLiteral(Node* effect, Node* control,
-                            Handle<JSObject> boilerplate,
-                            AllocationSiteUsageContext* site_context);
+                            JSObjectRef boilerplate, PretenureFlag pretenure);
   Node* AllocateFastLiteralElements(Node* effect, Node* control,
-                                    Handle<JSObject> boilerplate,
-                                    PretenureFlag pretenure,
-                                    AllocationSiteUsageContext* site_context);
+                                    JSObjectRef boilerplate,
+                                    PretenureFlag pretenure);
   Node* AllocateLiteralRegExp(Node* effect, Node* control,
-                              Handle<JSRegExp> boilerplate);
+                              JSRegExpRef boilerplate);
 
   Reduction ReduceNewArrayToStubCall(Node* node, Handle<AllocationSite> site);
 
@@ -110,13 +111,16 @@ class V8_EXPORT_PRIVATE JSCreateLowering final
   JSGraph* jsgraph() const { return jsgraph_; }
   Isolate* isolate() const;
   Handle<Context> native_context() const { return native_context_; }
+  NativeContextRef native_context_ref() const;
   CommonOperatorBuilder* common() const;
   SimplifiedOperatorBuilder* simplified() const;
   CompilationDependencies* dependencies() const { return dependencies_; }
+  const JSHeapBroker* js_heap_broker() const { return js_heap_broker_; }
   Zone* zone() const { return zone_; }
 
   CompilationDependencies* const dependencies_;
   JSGraph* const jsgraph_;
+  const JSHeapBroker* const js_heap_broker_;
   Handle<Context> const native_context_;
   Zone* const zone_;
 };
diff --git a/deps/v8/src/compiler/js-generic-lowering.cc b/deps/v8/src/compiler/js-generic-lowering.cc
index 99c905dae3a431..5e134307f423c7 100644
--- a/deps/v8/src/compiler/js-generic-lowering.cc
+++ b/deps/v8/src/compiler/js-generic-lowering.cc
@@ -101,12 +101,11 @@ void JSGenericLowering::ReplaceWithStubCall(Node* node, Callable callable,
 
 void JSGenericLowering::ReplaceWithStubCall(Node* node, Callable callable,
                                             CallDescriptor::Flags flags,
-                                            Operator::Properties properties,
-                                            int result_size) {
+                                            Operator::Properties properties) {
   const CallInterfaceDescriptor& descriptor = callable.descriptor();
   auto call_descriptor = Linkage::GetStubCallDescriptor(
-      isolate(), zone(), descriptor, descriptor.GetStackParameterCount(), flags,
-      properties, MachineType::AnyTagged(), result_size);
+      zone(), descriptor, descriptor.GetStackParameterCount(), flags,
+      properties);
   Node* stub_code = jsgraph()->HeapConstant(callable.code());
   node->InsertInput(zone(), 0, stub_code);
   NodeProperties::ChangeOp(node, common()->Call(call_descriptor));
@@ -122,7 +121,7 @@ void JSGenericLowering::ReplaceWithRuntimeCall(Node* node,
   int nargs = (nargs_override < 0) ? fun->nargs : nargs_override;
   auto call_descriptor =
       Linkage::GetRuntimeCallDescriptor(zone(), f, nargs, properties, flags);
-  Node* ref = jsgraph()->ExternalConstant(ExternalReference(f, isolate()));
+  Node* ref = jsgraph()->ExternalConstant(ExternalReference::Create(f));
   Node* arity = jsgraph()->Int32Constant(nargs);
   node->InsertInput(zone(), 0, jsgraph()->CEntryStubConstant(fun->result_size));
   node->InsertInput(zone(), nargs + 1, ref);
@@ -360,11 +359,9 @@ void JSGenericLowering::LowerJSCreateArray(Node* node) {
   CreateArrayParameters const& p = CreateArrayParametersOf(node->op());
   int const arity = static_cast<int>(p.arity());
   Handle<AllocationSite> const site = p.site();
-  ArrayConstructorDescriptor descriptor(isolate());
   auto call_descriptor = Linkage::GetStubCallDescriptor(
-      isolate(), zone(), descriptor, arity + 1,
-      CallDescriptor::kNeedsFrameState, node->op()->properties(),
-      MachineType::AnyTagged());
+      zone(), ArrayConstructorDescriptor{}, arity + 1,
+      CallDescriptor::kNeedsFrameState, node->op()->properties());
   Node* stub_code = jsgraph()->ArrayConstructorStubConstant();
   Node* stub_arity = jsgraph()->Int32Constant(arity);
   Node* type_info = site.is_null() ? jsgraph()->UndefinedConstant()
@@ -389,6 +386,30 @@ void JSGenericLowering::LowerJSCreateBoundFunction(Node* node) {
   UNREACHABLE();  // Eliminated in typed lowering.
 }
 
+void JSGenericLowering::LowerJSObjectIsArray(Node* node) {
+  UNREACHABLE();  // Eliminated in typed lowering.
+}
+
+void JSGenericLowering::LowerJSCreateObject(Node* node) {
+  CallDescriptor::Flags flags = FrameStateFlagForCall(node);
+  Callable callable = Builtins::CallableFor(
+      isolate(), Builtins::kCreateObjectWithoutProperties);
+  ReplaceWithStubCall(node, callable, flags);
+}
+
+void JSGenericLowering::LowerJSParseInt(Node* node) {
+  CallDescriptor::Flags flags = FrameStateFlagForCall(node);
+  Callable callable = Builtins::CallableFor(isolate(), Builtins::kParseInt);
+  ReplaceWithStubCall(node, callable, flags);
+}
+
+void JSGenericLowering::LowerJSRegExpTest(Node* node) {
+  CallDescriptor::Flags flags = FrameStateFlagForCall(node);
+  Callable callable =
+      Builtins::CallableFor(isolate(), Builtins::kRegExpPrototypeTestFast);
+  ReplaceWithStubCall(node, callable, flags);
+}
+
 void JSGenericLowering::LowerJSCreateClosure(Node* node) {
   CreateClosureParameters const& p = CreateClosureParametersOf(node->op());
   Handle<SharedFunctionInfo> const shared_info = p.shared_info();
@@ -411,6 +432,7 @@ void JSGenericLowering::LowerJSCreateClosure(Node* node) {
 void JSGenericLowering::LowerJSCreateFunctionContext(Node* node) {
   const CreateFunctionContextParameters& parameters =
       CreateFunctionContextParametersOf(node->op());
+  Handle<ScopeInfo> scope_info = parameters.scope_info();
   int slot_count = parameters.slot_count();
   ScopeType scope_type = parameters.scope_type();
   CallDescriptor::Flags flags = FrameStateFlagForCall(node);
@@ -418,10 +440,11 @@ void JSGenericLowering::LowerJSCreateFunctionContext(Node* node) {
   if (slot_count <= ConstructorBuiltins::MaximumFunctionContextSlots()) {
     Callable callable =
         CodeFactory::FastNewFunctionContext(isolate(), scope_type);
+    node->InsertInput(zone(), 0, jsgraph()->HeapConstant(scope_info));
     node->InsertInput(zone(), 1, jsgraph()->Int32Constant(slot_count));
     ReplaceWithStubCall(node, callable, flags);
   } else {
-    node->InsertInput(zone(), 1, jsgraph()->SmiConstant(scope_type));
+    node->InsertInput(zone(), 0, jsgraph()->HeapConstant(scope_info));
     ReplaceWithRuntimeCall(node, Runtime::kNewFunctionContext);
   }
 }
@@ -540,7 +563,6 @@ void JSGenericLowering::LowerJSCreateBlockContext(Node* node) {
   ReplaceWithRuntimeCall(node, Runtime::kPushBlockContext);
 }
 
-
 void JSGenericLowering::LowerJSConstructForwardVarargs(Node* node) {
   ConstructForwardVarargsParameters p =
       ConstructForwardVarargsParametersOf(node->op());
@@ -548,7 +570,7 @@ void JSGenericLowering::LowerJSConstructForwardVarargs(Node* node) {
   CallDescriptor::Flags flags = FrameStateFlagForCall(node);
   Callable callable = CodeFactory::ConstructForwardVarargs(isolate());
   auto call_descriptor = Linkage::GetStubCallDescriptor(
-      isolate(), zone(), callable.descriptor(), arg_count + 1, flags);
+      zone(), callable.descriptor(), arg_count + 1, flags);
   Node* stub_code = jsgraph()->HeapConstant(callable.code());
   Node* stub_arity = jsgraph()->Int32Constant(arg_count);
   Node* start_index = jsgraph()->Uint32Constant(p.start_index());
@@ -569,7 +591,7 @@ void JSGenericLowering::LowerJSConstruct(Node* node) {
   CallDescriptor::Flags flags = FrameStateFlagForCall(node);
   Callable callable = CodeFactory::Construct(isolate());
   auto call_descriptor = Linkage::GetStubCallDescriptor(
-      isolate(), zone(), callable.descriptor(), arg_count + 1, flags);
+      zone(), callable.descriptor(), arg_count + 1, flags);
   Node* stub_code = jsgraph()->HeapConstant(callable.code());
   Node* stub_arity = jsgraph()->Int32Constant(arg_count);
   Node* new_target = node->InputAt(arg_count + 1);
@@ -586,8 +608,8 @@ void JSGenericLowering::LowerJSConstructWithArrayLike(Node* node) {
   Callable callable =
       Builtins::CallableFor(isolate(), Builtins::kConstructWithArrayLike);
   CallDescriptor::Flags flags = FrameStateFlagForCall(node);
-  auto call_descriptor = Linkage::GetStubCallDescriptor(
-      isolate(), zone(), callable.descriptor(), 1, flags);
+  auto call_descriptor =
+      Linkage::GetStubCallDescriptor(zone(), callable.descriptor(), 1, flags);
   Node* stub_code = jsgraph()->HeapConstant(callable.code());
   Node* receiver = jsgraph()->UndefinedConstant();
   Node* arguments_list = node->InputAt(1);
@@ -607,7 +629,7 @@ void JSGenericLowering::LowerJSConstructWithSpread(Node* node) {
   CallDescriptor::Flags flags = FrameStateFlagForCall(node);
   Callable callable = CodeFactory::ConstructWithSpread(isolate());
   auto call_descriptor = Linkage::GetStubCallDescriptor(
-      isolate(), zone(), callable.descriptor(), arg_count, flags);
+      zone(), callable.descriptor(), arg_count, flags);
   Node* stub_code = jsgraph()->HeapConstant(callable.code());
   Node* stack_arg_count = jsgraph()->Int32Constant(arg_count - 1);
   Node* new_target = node->InputAt(new_target_index);
@@ -631,7 +653,7 @@ void JSGenericLowering::LowerJSCallForwardVarargs(Node* node) {
   CallDescriptor::Flags flags = FrameStateFlagForCall(node);
   Callable callable = CodeFactory::CallForwardVarargs(isolate());
   auto call_descriptor = Linkage::GetStubCallDescriptor(
-      isolate(), zone(), callable.descriptor(), arg_count + 1, flags);
+      zone(), callable.descriptor(), arg_count + 1, flags);
   Node* stub_code = jsgraph()->HeapConstant(callable.code());
   Node* stub_arity = jsgraph()->Int32Constant(arg_count);
   Node* start_index = jsgraph()->Uint32Constant(p.start_index());
@@ -648,7 +670,7 @@ void JSGenericLowering::LowerJSCall(Node* node) {
   Callable callable = CodeFactory::Call(isolate(), mode);
   CallDescriptor::Flags flags = FrameStateFlagForCall(node);
   auto call_descriptor = Linkage::GetStubCallDescriptor(
-      isolate(), zone(), callable.descriptor(), arg_count + 1, flags);
+      zone(), callable.descriptor(), arg_count + 1, flags);
   Node* stub_code = jsgraph()->HeapConstant(callable.code());
   Node* stub_arity = jsgraph()->Int32Constant(arg_count);
   node->InsertInput(zone(), 0, stub_code);
@@ -659,8 +681,8 @@ void JSGenericLowering::LowerJSCall(Node* node) {
 void JSGenericLowering::LowerJSCallWithArrayLike(Node* node) {
   Callable callable = CodeFactory::CallWithArrayLike(isolate());
   CallDescriptor::Flags flags = FrameStateFlagForCall(node);
-  auto call_descriptor = Linkage::GetStubCallDescriptor(
-      isolate(), zone(), callable.descriptor(), 1, flags);
+  auto call_descriptor =
+      Linkage::GetStubCallDescriptor(zone(), callable.descriptor(), 1, flags);
   Node* stub_code = jsgraph()->HeapConstant(callable.code());
   Node* receiver = node->InputAt(1);
   Node* arguments_list = node->InputAt(2);
@@ -677,7 +699,7 @@ void JSGenericLowering::LowerJSCallWithSpread(Node* node) {
   CallDescriptor::Flags flags = FrameStateFlagForCall(node);
   Callable callable = CodeFactory::CallWithSpread(isolate());
   auto call_descriptor = Linkage::GetStubCallDescriptor(
-      isolate(), zone(), callable.descriptor(), arg_count, flags);
+      zone(), callable.descriptor(), arg_count, flags);
   Node* stub_code = jsgraph()->HeapConstant(callable.code());
   // We pass the spread in a register, not on the stack.
   Node* stack_arg_count = jsgraph()->Int32Constant(arg_count - 1);
diff --git a/deps/v8/src/compiler/js-generic-lowering.h b/deps/v8/src/compiler/js-generic-lowering.h
index 8cd89fcb26ad98..09fafb4dc5e84b 100644
--- a/deps/v8/src/compiler/js-generic-lowering.h
+++ b/deps/v8/src/compiler/js-generic-lowering.h
@@ -39,8 +39,7 @@ class JSGenericLowering final : public Reducer {
   // Helpers to replace existing nodes with a generic call.
   void ReplaceWithStubCall(Node* node, Callable c, CallDescriptor::Flags flags);
   void ReplaceWithStubCall(Node* node, Callable c, CallDescriptor::Flags flags,
-                           Operator::Properties properties,
-                           int result_size = 1);
+                           Operator::Properties properties);
   void ReplaceWithRuntimeCall(Node* node, Runtime::FunctionId f, int args = -1);
 
   Zone* zone() const;
diff --git a/deps/v8/src/compiler/js-graph.cc b/deps/v8/src/compiler/js-graph.cc
index cb3c62011784f1..9feb518e463dd8 100644
--- a/deps/v8/src/compiler/js-graph.cc
+++ b/deps/v8/src/compiler/js-graph.cc
@@ -4,7 +4,7 @@
 
 #include "src/compiler/js-graph.h"
 
-#include "src/code-stubs.h"
+#include "src/code-factory.h"
 #include "src/compiler/node-properties.h"
 #include "src/compiler/typer.h"
 #include "src/objects-inl.h"
@@ -13,152 +13,39 @@ namespace v8 {
 namespace internal {
 namespace compiler {
 
-#define CACHED(name, expr) \
-  cached_nodes_[name] ? cached_nodes_[name] : (cached_nodes_[name] = (expr))
+#define GET_CACHED_FIELD(ptr, expr) (*(ptr)) ? *(ptr) : (*(ptr) = (expr))
 
-Node* JSGraph::AllocateInNewSpaceStubConstant() {
-  return CACHED(kAllocateInNewSpaceStubConstant,
-                HeapConstant(BUILTIN_CODE(isolate(), AllocateInNewSpace)));
-}
-
-Node* JSGraph::AllocateInOldSpaceStubConstant() {
-  return CACHED(kAllocateInOldSpaceStubConstant,
-                HeapConstant(BUILTIN_CODE(isolate(), AllocateInOldSpace)));
-}
-
-Node* JSGraph::ArrayConstructorStubConstant() {
-  return CACHED(kArrayConstructorStubConstant,
-                HeapConstant(ArrayConstructorStub(isolate()).GetCode()));
-}
-
-Node* JSGraph::ToNumberBuiltinConstant() {
-  return CACHED(kToNumberBuiltinConstant,
-                HeapConstant(BUILTIN_CODE(isolate(), ToNumber)));
-}
+#define DEFINE_GETTER(name, expr) \
+  Node* JSGraph::name() { return GET_CACHED_FIELD(&name##_, expr); }
 
 Node* JSGraph::CEntryStubConstant(int result_size, SaveFPRegsMode save_doubles,
                                   ArgvMode argv_mode, bool builtin_exit_frame) {
   if (save_doubles == kDontSaveFPRegs && argv_mode == kArgvOnStack) {
     DCHECK(result_size >= 1 && result_size <= 3);
     if (!builtin_exit_frame) {
-      CachedNode key;
+      Node** ptr = nullptr;
       if (result_size == 1) {
-        key = kCEntryStub1Constant;
+        ptr = &CEntryStub1Constant_;
       } else if (result_size == 2) {
-        key = kCEntryStub2Constant;
+        ptr = &CEntryStub2Constant_;
       } else {
         DCHECK_EQ(3, result_size);
-        key = kCEntryStub3Constant;
+        ptr = &CEntryStub3Constant_;
       }
-      return CACHED(
-          key, HeapConstant(CEntryStub(isolate(), result_size, save_doubles,
-                                       argv_mode, builtin_exit_frame)
-                                .GetCode()));
+      return GET_CACHED_FIELD(ptr, HeapConstant(CodeFactory::CEntry(
+                                       isolate(), result_size, save_doubles,
+                                       argv_mode, builtin_exit_frame)));
     }
-    CachedNode key = builtin_exit_frame
-                         ? kCEntryStub1WithBuiltinExitFrameConstant
-                         : kCEntryStub1Constant;
-    return CACHED(key,
-                  HeapConstant(CEntryStub(isolate(), result_size, save_doubles,
-                                          argv_mode, builtin_exit_frame)
-                                   .GetCode()));
+    Node** ptr = builtin_exit_frame ? &CEntryStub1WithBuiltinExitFrameConstant_
+                                    : &CEntryStub1Constant_;
+    return GET_CACHED_FIELD(ptr, HeapConstant(CodeFactory::CEntry(
+                                     isolate(), result_size, save_doubles,
+                                     argv_mode, builtin_exit_frame)));
   }
-  CEntryStub stub(isolate(), result_size, save_doubles, argv_mode,
-                  builtin_exit_frame);
-  return HeapConstant(stub.GetCode());
-}
-
-Node* JSGraph::EmptyFixedArrayConstant() {
-  return CACHED(kEmptyFixedArrayConstant,
-                HeapConstant(factory()->empty_fixed_array()));
-}
-
-Node* JSGraph::EmptyStringConstant() {
-  return CACHED(kEmptyStringConstant, HeapConstant(factory()->empty_string()));
-}
-
-Node* JSGraph::FixedArrayMapConstant() {
-  return CACHED(kFixedArrayMapConstant,
-                HeapConstant(factory()->fixed_array_map()));
-}
-
-Node* JSGraph::PropertyArrayMapConstant() {
-  return CACHED(kPropertyArrayMapConstant,
-                HeapConstant(factory()->property_array_map()));
-}
-
-Node* JSGraph::FixedDoubleArrayMapConstant() {
-  return CACHED(kFixedDoubleArrayMapConstant,
-                HeapConstant(factory()->fixed_double_array_map()));
-}
-
-Node* JSGraph::HeapNumberMapConstant() {
-  return CACHED(kHeapNumberMapConstant,
-                HeapConstant(factory()->heap_number_map()));
-}
-
-Node* JSGraph::OptimizedOutConstant() {
-  return CACHED(kOptimizedOutConstant,
-                HeapConstant(factory()->optimized_out()));
-}
-
-Node* JSGraph::StaleRegisterConstant() {
-  return CACHED(kStaleRegisterConstant,
-                HeapConstant(factory()->stale_register()));
-}
-
-Node* JSGraph::UndefinedConstant() {
-  return CACHED(kUndefinedConstant, HeapConstant(factory()->undefined_value()));
-}
-
-
-Node* JSGraph::TheHoleConstant() {
-  return CACHED(kTheHoleConstant, HeapConstant(factory()->the_hole_value()));
-}
-
-
-Node* JSGraph::TrueConstant() {
-  return CACHED(kTrueConstant, HeapConstant(factory()->true_value()));
+  return HeapConstant(CodeFactory::CEntry(isolate(), result_size, save_doubles,
+                                          argv_mode, builtin_exit_frame));
 }
 
-
-Node* JSGraph::FalseConstant() {
-  return CACHED(kFalseConstant, HeapConstant(factory()->false_value()));
-}
-
-
-Node* JSGraph::NullConstant() {
-  return CACHED(kNullConstant, HeapConstant(factory()->null_value()));
-}
-
-
-Node* JSGraph::ZeroConstant() {
-  return CACHED(kZeroConstant, NumberConstant(0.0));
-}
-
-Node* JSGraph::OneConstant() {
-  return CACHED(kOneConstant, NumberConstant(1.0));
-}
-
-Node* JSGraph::MinusOneConstant() {
-  return CACHED(kMinusOneConstant, NumberConstant(-1.0));
-}
-
-Node* JSGraph::NaNConstant() {
-  return CACHED(kNaNConstant,
-                NumberConstant(std::numeric_limits<double>::quiet_NaN()));
-}
-
-
-Node* JSGraph::HeapConstant(Handle<HeapObject> value) {
-  Node** loc = cache_.FindHeapConstant(value);
-  if (*loc == nullptr) {
-    *loc = graph()->NewNode(common()->HeapConstant(value));
-  }
-  return *loc;
-}
-
-
 Node* JSGraph::Constant(Handle<Object> value) {
   // Dereference the handle to determine if a number constant or other
   // canonicalized node can be used.
@@ -179,6 +66,32 @@ Node* JSGraph::Constant(Handle<Object> value) {
   }
 }
 
+Node* JSGraph::Constant(const JSHeapBroker* broker, const ObjectRef& ref) {
+  if (ref.IsSmi()) return Constant(ref.AsSmi());
+  OddballType oddball_type = ref.oddball_type(broker);
+  if (ref.IsHeapNumber()) {
+    return Constant(ref.AsHeapNumber().value());
+  } else if (oddball_type == OddballType::kUndefined) {
+    DCHECK(
+        ref.object<Object>().equals(isolate()->factory()->undefined_value()));
+    return UndefinedConstant();
+  } else if (oddball_type == OddballType::kNull) {
+    DCHECK(ref.object<Object>().equals(isolate()->factory()->null_value()));
+    return NullConstant();
+  } else if (oddball_type == OddballType::kHole) {
+    DCHECK(ref.object<Object>().equals(isolate()->factory()->the_hole_value()));
+    return TheHoleConstant();
+  } else if (oddball_type == OddballType::kBoolean) {
+    if (ref.object<Object>().equals(isolate()->factory()->true_value())) {
+      return TrueConstant();
+    } else {
+      DCHECK(ref.object<Object>().equals(isolate()->factory()->false_value()));
+      return FalseConstant();
+    }
+  } else {
+    return HeapConstant(ref.object<HeapObject>());
+  }
+}
 
 Node* JSGraph::Constant(double value) {
   if (bit_cast<int64_t>(value) == bit_cast<int64_t>(0.0)) return ZeroConstant();
@@ -199,120 +112,94 @@ Node* JSGraph::Constant(uint32_t value) {
   return NumberConstant(value);
 }
 
-Node* JSGraph::Int32Constant(int32_t value) {
-  Node** loc = cache_.FindInt32Constant(value);
+Node* JSGraph::NumberConstant(double value) {
+  Node** loc = cache_.FindNumberConstant(value);
   if (*loc == nullptr) {
-    *loc = graph()->NewNode(common()->Int32Constant(value));
+    *loc = graph()->NewNode(common()->NumberConstant(value));
   }
   return *loc;
 }
 
-
-Node* JSGraph::Int64Constant(int64_t value) {
-  Node** loc = cache_.FindInt64Constant(value);
+Node* JSGraph::HeapConstant(Handle<HeapObject> value) {
+  Node** loc = cache_.FindHeapConstant(value);
   if (*loc == nullptr) {
-    *loc = graph()->NewNode(common()->Int64Constant(value));
+    *loc = graph()->NewNode(common()->HeapConstant(value));
   }
   return *loc;
 }
 
-Node* JSGraph::RelocatableInt32Constant(int32_t value, RelocInfo::Mode rmode) {
-  Node** loc = cache_.FindRelocatableInt32Constant(
-      value, static_cast<RelocInfoMode>(rmode));
-  if (*loc == nullptr) {
-    *loc = graph()->NewNode(common()->RelocatableInt32Constant(value, rmode));
-  }
-  return *loc;
-}
+void JSGraph::GetCachedNodes(NodeVector* nodes) {
+  cache_.GetCachedNodes(nodes);
+#define DO_CACHED_FIELD(name) \
+  if (name##_) nodes->push_back(name##_);
 
-Node* JSGraph::RelocatableInt64Constant(int64_t value, RelocInfo::Mode rmode) {
-  Node** loc = cache_.FindRelocatableInt64Constant(
-      value, static_cast<RelocInfoMode>(rmode));
-  if (*loc == nullptr) {
-    *loc = graph()->NewNode(common()->RelocatableInt64Constant(value, rmode));
-  }
-  return *loc;
+  CACHED_GLOBAL_LIST(DO_CACHED_FIELD)
+  CACHED_CENTRY_LIST(DO_CACHED_FIELD)
+#undef DO_CACHED_FIELD
 }
 
-Node* JSGraph::RelocatableIntPtrConstant(intptr_t value,
-                                         RelocInfo::Mode rmode) {
-  return kPointerSize == 8
-             ? RelocatableInt64Constant(value, rmode)
-             : RelocatableInt32Constant(static_cast<int>(value), rmode);
-}
+DEFINE_GETTER(AllocateInNewSpaceStubConstant,
+              HeapConstant(BUILTIN_CODE(isolate(), AllocateInNewSpace)))
 
-Node* JSGraph::NumberConstant(double value) {
-  Node** loc = cache_.FindNumberConstant(value);
-  if (*loc == nullptr) {
-    *loc = graph()->NewNode(common()->NumberConstant(value));
-  }
-  return *loc;
-}
+DEFINE_GETTER(AllocateInOldSpaceStubConstant,
+              HeapConstant(BUILTIN_CODE(isolate(), AllocateInOldSpace)))
 
+DEFINE_GETTER(ArrayConstructorStubConstant,
+              HeapConstant(BUILTIN_CODE(isolate(), ArrayConstructorImpl)))
 
-Node* JSGraph::Float32Constant(float value) {
-  Node** loc = cache_.FindFloat32Constant(value);
-  if (*loc == nullptr) {
-    *loc = graph()->NewNode(common()->Float32Constant(value));
-  }
-  return *loc;
-}
+DEFINE_GETTER(ToNumberBuiltinConstant,
+              HeapConstant(BUILTIN_CODE(isolate(), ToNumber)))
 
+DEFINE_GETTER(EmptyFixedArrayConstant,
+              HeapConstant(factory()->empty_fixed_array()))
 
-Node* JSGraph::Float64Constant(double value) {
-  Node** loc = cache_.FindFloat64Constant(value);
-  if (*loc == nullptr) {
-    *loc = graph()->NewNode(common()->Float64Constant(value));
-  }
-  return *loc;
-}
+DEFINE_GETTER(EmptyStringConstant, HeapConstant(factory()->empty_string()))
 
-Node* JSGraph::PointerConstant(intptr_t value) {
-  Node** loc = cache_.FindPointerConstant(value);
-  if (*loc == nullptr) {
-    *loc = graph()->NewNode(common()->PointerConstant(value));
-  }
-  return *loc;
-}
+DEFINE_GETTER(FixedArrayMapConstant, HeapConstant(factory()->fixed_array_map()))
 
-Node* JSGraph::ExternalConstant(ExternalReference reference) {
-  Node** loc = cache_.FindExternalConstant(reference);
-  if (*loc == nullptr) {
-    *loc = graph()->NewNode(common()->ExternalConstant(reference));
-  }
-  return *loc;
-}
+DEFINE_GETTER(PropertyArrayMapConstant,
+              HeapConstant(factory()->property_array_map()))
 
+DEFINE_GETTER(FixedDoubleArrayMapConstant,
+              HeapConstant(factory()->fixed_double_array_map()))
 
-Node* JSGraph::ExternalConstant(Runtime::FunctionId function_id) {
-  return ExternalConstant(ExternalReference(function_id, isolate()));
-}
+DEFINE_GETTER(HeapNumberMapConstant, HeapConstant(factory()->heap_number_map()))
 
-Node* JSGraph::EmptyStateValues() {
-  return CACHED(kEmptyStateValues, graph()->NewNode(common()->StateValues(
-                                       0, SparseInputMask::Dense())));
-}
+DEFINE_GETTER(OptimizedOutConstant, HeapConstant(factory()->optimized_out()))
 
-Node* JSGraph::SingleDeadTypedStateValues() {
-  return CACHED(kSingleDeadTypedStateValues,
-                graph()->NewNode(common()->TypedStateValues(
-                    new (graph()->zone()->New(sizeof(ZoneVector<MachineType>)))
-                        ZoneVector<MachineType>(0, graph()->zone()),
-                    SparseInputMask(SparseInputMask::kEndMarker << 1))));
-}
+DEFINE_GETTER(StaleRegisterConstant, HeapConstant(factory()->stale_register()))
 
-Node* JSGraph::Dead() {
-  return CACHED(kDead, graph()->NewNode(common()->Dead()));
-}
+DEFINE_GETTER(UndefinedConstant, HeapConstant(factory()->undefined_value()))
 
-void JSGraph::GetCachedNodes(NodeVector* nodes) {
-  cache_.GetCachedNodes(nodes);
-  for (size_t i = 0; i < arraysize(cached_nodes_); i++) {
-    if (Node* node = cached_nodes_[i]) {
-      if (!node->IsDead()) nodes->push_back(node);
-    }
-  }
-}
+DEFINE_GETTER(TheHoleConstant, HeapConstant(factory()->the_hole_value()))
+
+DEFINE_GETTER(TrueConstant, HeapConstant(factory()->true_value()))
+
+DEFINE_GETTER(FalseConstant, HeapConstant(factory()->false_value()))
+
+DEFINE_GETTER(NullConstant, HeapConstant(factory()->null_value()))
+
+DEFINE_GETTER(ZeroConstant, NumberConstant(0.0))
+
+DEFINE_GETTER(OneConstant, NumberConstant(1.0))
+
+DEFINE_GETTER(MinusOneConstant, NumberConstant(-1.0))
+
+DEFINE_GETTER(NaNConstant,
+              NumberConstant(std::numeric_limits<double>::quiet_NaN()))
+
+DEFINE_GETTER(EmptyStateValues,
+              graph()->NewNode(common()->StateValues(0,
+                                                     SparseInputMask::Dense())))
+
+DEFINE_GETTER(SingleDeadTypedStateValues,
+              graph()->NewNode(common()->TypedStateValues(
+                  new (graph()->zone()->New(sizeof(ZoneVector<MachineType>)))
+                      ZoneVector<MachineType>(0, graph()->zone()),
+                  SparseInputMask(SparseInputMask::kEndMarker << 1))))
+
+#undef DEFINE_GETTER
+#undef GET_CACHED_FIELD
 
 }  // namespace compiler
 }  // namespace internal
diff --git a/deps/v8/src/compiler/js-graph.h b/deps/v8/src/compiler/js-graph.h
index 9bbe2178fb38eb..6d66e1724affea 100644
--- a/deps/v8/src/compiler/js-graph.h
+++ b/deps/v8/src/compiler/js-graph.h
@@ -5,12 +5,10 @@
 #ifndef V8_COMPILER_JS_GRAPH_H_
 #define V8_COMPILER_JS_GRAPH_H_
 
-#include "src/base/compiler-specific.h"
-#include "src/compiler/common-node-cache.h"
 #include "src/compiler/common-operator.h"
 #include "src/compiler/graph.h"
 #include "src/compiler/js-operator.h"
-#include "src/compiler/machine-operator.h"
+#include "src/compiler/machine-graph.h"
 #include "src/compiler/node-properties.h"
 #include "src/globals.h"
 #include "src/isolate.h"
@@ -25,51 +23,29 @@ class Typer;
 // Implements a facade on a Graph, enhancing the graph with JS-specific
 // notions, including various builders for operators, canonicalized global
 // constants, and various helper methods.
-class V8_EXPORT_PRIVATE JSGraph : public NON_EXPORTED_BASE(ZoneObject) {
+class V8_EXPORT_PRIVATE JSGraph : public MachineGraph {
  public:
   JSGraph(Isolate* isolate, Graph* graph, CommonOperatorBuilder* common,
           JSOperatorBuilder* javascript, SimplifiedOperatorBuilder* simplified,
           MachineOperatorBuilder* machine)
-      : isolate_(isolate),
-        graph_(graph),
-        common_(common),
+      : MachineGraph(graph, common, machine),
+        isolate_(isolate),
         javascript_(javascript),
-        simplified_(simplified),
-        machine_(machine),
-        cache_(zone()) {
-    for (int i = 0; i < kNumCachedNodes; i++) cached_nodes_[i] = nullptr;
+        simplified_(simplified) {
   }
 
-  // Canonicalized global constants.
-  Node* AllocateInNewSpaceStubConstant();
-  Node* AllocateInOldSpaceStubConstant();
-  Node* ArrayConstructorStubConstant();
-  Node* ToNumberBuiltinConstant();
+  // CEntryStubs are cached depending on the result size and other flags.
   Node* CEntryStubConstant(int result_size,
                            SaveFPRegsMode save_doubles = kDontSaveFPRegs,
                            ArgvMode argv_mode = kArgvOnStack,
                            bool builtin_exit_frame = false);
-  Node* EmptyFixedArrayConstant();
-  Node* EmptyStringConstant();
-  Node* FixedArrayMapConstant();
-  Node* PropertyArrayMapConstant();
-  Node* FixedDoubleArrayMapConstant();
-  Node* HeapNumberMapConstant();
-  Node* OptimizedOutConstant();
-  Node* StaleRegisterConstant();
-  Node* UndefinedConstant();
-  Node* TheHoleConstant();
-  Node* TrueConstant();
-  Node* FalseConstant();
-  Node* NullConstant();
-  Node* ZeroConstant();
-  Node* OneConstant();
-  Node* NaNConstant();
-  Node* MinusOneConstant();
-
-  // Used for padding frames.
+
+  // Used for padding frames. (alias: the hole)
   Node* PaddingConstant() { return TheHoleConstant(); }
 
+  // Used for stubs and runtime functions with no context. (alias: SMI zero)
+  Node* NoContextConstant() { return ZeroConstant(); }
+
   // Creates a HeapConstant node, possibly canonicalized, and may access the
   // heap to inspect the object.
   Node* HeapConstant(Handle<HeapObject> value);
@@ -79,6 +55,10 @@ class V8_EXPORT_PRIVATE JSGraph : public NON_EXPORTED_BASE(ZoneObject) {
   // canonicalized globals or a number constant should be returned.
   Node* Constant(Handle<Object> value);
 
+  // Like above, but doesn't access the heap directly.
+  // TODO(neis): Make the broker a member of JSGraph.
+  Node* Constant(const JSHeapBroker* broker, const ObjectRef& value);
+
   // Creates a NumberConstant node, usually canonicalized.
   Node* Constant(double value);
 
@@ -88,126 +68,73 @@ class V8_EXPORT_PRIVATE JSGraph : public NON_EXPORTED_BASE(ZoneObject) {
   // Creates a NumberConstant node, usually canonicalized.
   Node* Constant(uint32_t value);
 
-  // Creates a Int32Constant node, usually canonicalized.
-  Node* Int32Constant(int32_t value);
-  Node* Uint32Constant(uint32_t value) {
-    return Int32Constant(bit_cast<int32_t>(value));
-  }
-
   // Creates a HeapConstant node for either true or false.
   Node* BooleanConstant(bool is_true) {
     return is_true ? TrueConstant() : FalseConstant();
   }
 
-  // Creates a Int64Constant node, usually canonicalized.
-  Node* Int64Constant(int64_t value);
-  Node* Uint64Constant(uint64_t value) {
-    return Int64Constant(bit_cast<int64_t>(value));
-  }
-
-  // Creates a Int32Constant/Int64Constant node, depending on the word size of
-  // the target machine.
-  // TODO(turbofan): Code using Int32Constant/Int64Constant to store pointer
-  // constants is probably not serializable.
-  Node* IntPtrConstant(intptr_t value) {
-    return machine()->Is32() ? Int32Constant(static_cast<int32_t>(value))
-                             : Int64Constant(static_cast<int64_t>(value));
-  }
-
-  Node* RelocatableInt32Constant(int32_t value, RelocInfo::Mode rmode);
-  Node* RelocatableInt64Constant(int64_t value, RelocInfo::Mode rmode);
-  Node* RelocatableIntPtrConstant(intptr_t value, RelocInfo::Mode rmode);
-
-  // Creates a Float32Constant node, usually canonicalized.
-  Node* Float32Constant(float value);
-
-  // Creates a Float64Constant node, usually canonicalized.
-  Node* Float64Constant(double value);
-
-  // Creates a PointerConstant node (asm.js only).
-  Node* PointerConstant(intptr_t value);
-  template <typename T>
-  Node* PointerConstant(T* value) {
-    return PointerConstant(bit_cast<intptr_t>(value));
-  }
-
-  // Creates an ExternalConstant node, usually canonicalized.
-  Node* ExternalConstant(ExternalReference ref);
-  Node* ExternalConstant(Runtime::FunctionId function_id);
-
   Node* SmiConstant(int32_t immediate) {
     DCHECK(Smi::IsValid(immediate));
     return Constant(immediate);
   }
 
-  // Creates a dummy Constant node, used to satisfy calling conventions of
-  // stubs and runtime functions that do not require a context.
-  Node* NoContextConstant() { return ZeroConstant(); }
-
-  // Creates an empty StateValues node, used when we don't have any concrete
-  // values for a certain part of the frame state.
-  Node* EmptyStateValues();
-
-  // Typed state values with a single dead input. This is useful to represent
-  // dead accumulator.
-  Node* SingleDeadTypedStateValues();
-
-  // Create a control node that serves as dependency for dead nodes.
-  Node* Dead();
-
-  CommonOperatorBuilder* common() const { return common_; }
   JSOperatorBuilder* javascript() const { return javascript_; }
   SimplifiedOperatorBuilder* simplified() const { return simplified_; }
-  MachineOperatorBuilder* machine() const { return machine_; }
-  Graph* graph() const { return graph_; }
-  Zone* zone() const { return graph()->zone(); }
   Isolate* isolate() const { return isolate_; }
   Factory* factory() const { return isolate()->factory(); }
 
+  // Adds all the cached nodes to the given list.
   void GetCachedNodes(NodeVector* nodes);
 
- private:
-  enum CachedNode {
-    kAllocateInNewSpaceStubConstant,
-    kAllocateInOldSpaceStubConstant,
-    kArrayConstructorStubConstant,
-    kToNumberBuiltinConstant,
-    kCEntryStub1Constant,
-    kCEntryStub2Constant,
-    kCEntryStub3Constant,
-    kCEntryStub1WithBuiltinExitFrameConstant,
-    kEmptyFixedArrayConstant,
-    kEmptyStringConstant,
-    kFixedArrayMapConstant,
-    kFixedDoubleArrayMapConstant,
-    kPropertyArrayMapConstant,
-    kHeapNumberMapConstant,
-    kOptimizedOutConstant,
-    kStaleRegisterConstant,
-    kUndefinedConstant,
-    kTheHoleConstant,
-    kTrueConstant,
-    kFalseConstant,
-    kNullConstant,
-    kZeroConstant,
-    kOneConstant,
-    kMinusOneConstant,
-    kNaNConstant,
-    kEmptyStateValues,
-    kSingleDeadTypedStateValues,
-    kDead,
-    kNumCachedNodes  // Must remain last.
-  };
+// Cached global nodes.
+#define CACHED_GLOBAL_LIST(V)       \
+  V(AllocateInNewSpaceStubConstant) \
+  V(AllocateInOldSpaceStubConstant) \
+  V(ArrayConstructorStubConstant)   \
+  V(ToNumberBuiltinConstant)        \
+  V(EmptyFixedArrayConstant)        \
+  V(EmptyStringConstant)            \
+  V(FixedArrayMapConstant)          \
+  V(PropertyArrayMapConstant)       \
+  V(FixedDoubleArrayMapConstant)    \
+  V(HeapNumberMapConstant)          \
+  V(OptimizedOutConstant)           \
+  V(StaleRegisterConstant)          \
+  V(UndefinedConstant)              \
+  V(TheHoleConstant)                \
+  V(TrueConstant)                   \
+  V(FalseConstant)                  \
+  V(NullConstant)                   \
+  V(ZeroConstant)                   \
+  V(OneConstant)                    \
+  V(NaNConstant)                    \
+  V(MinusOneConstant)               \
+  V(EmptyStateValues)               \
+  V(SingleDeadTypedStateValues)
+
+// Cached global node accessor methods.
+#define DECLARE_GETTER(name) Node* name();
+  CACHED_GLOBAL_LIST(DECLARE_GETTER)
+#undef DECLARE_FIELD
 
+ private:
   Isolate* isolate_;
-  Graph* graph_;
-  CommonOperatorBuilder* common_;
   JSOperatorBuilder* javascript_;
   SimplifiedOperatorBuilder* simplified_;
-  MachineOperatorBuilder* machine_;
-  CommonNodeCache cache_;
-  Node* cached_nodes_[kNumCachedNodes];
 
+#define CACHED_CENTRY_LIST(V) \
+  V(CEntryStub1Constant)      \
+  V(CEntryStub2Constant)      \
+  V(CEntryStub3Constant)      \
+  V(CEntryStub1WithBuiltinExitFrameConstant)
+
+// Canonicalized global node fields.
+#define DECLARE_FIELD(name) Node* name##_ = nullptr;
+  CACHED_GLOBAL_LIST(DECLARE_FIELD)
+  CACHED_CENTRY_LIST(DECLARE_FIELD)
+#undef DECLARE_FIELD
+
+  // Internal helper to canonicalize a number constant.
   Node* NumberConstant(double value);
 
   DISALLOW_COPY_AND_ASSIGN(JSGraph);
diff --git a/deps/v8/src/compiler/js-heap-broker.cc b/deps/v8/src/compiler/js-heap-broker.cc
new file mode 100644
index 00000000000000..7133bb0b8d9bc9
--- /dev/null
+++ b/deps/v8/src/compiler/js-heap-broker.cc
@@ -0,0 +1,648 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "src/compiler/js-heap-broker.h"
+
+#include "src/compiler/compilation-dependencies.h"
+#include "src/objects-inl.h"
+#include "src/objects/js-regexp-inl.h"
+
+namespace v8 {
+namespace internal {
+namespace compiler {
+
+MapRef HeapObjectRef::map(const JSHeapBroker* broker) const {
+  AllowHandleAllocation handle_allocation;
+  AllowHandleDereference allow_handle_dereference;
+  return MapRef(handle(object<HeapObject>()->map(), broker->isolate()));
+}
+
+double HeapNumberRef::value() const {
+  AllowHandleDereference allow_handle_dereference;
+  return object<HeapNumber>()->value();
+}
+
+double MutableHeapNumberRef::value() const {
+  AllowHandleDereference allow_handle_dereference;
+  return object<MutableHeapNumber>()->value();
+}
+
+bool ObjectRef::IsSmi() const {
+  AllowHandleDereference allow_handle_dereference;
+  return object_->IsSmi();
+}
+
+int ObjectRef::AsSmi() const { return object<Smi>()->value(); }
+
+bool ObjectRef::equals(const ObjectRef& other) const {
+  return object<Object>().equals(other.object<Object>());
+}
+
+StringRef ObjectRef::TypeOf(const JSHeapBroker* broker) const {
+  AllowHandleDereference handle_dereference;
+  return StringRef(Object::TypeOf(broker->isolate(), object<Object>()));
+}
+
+base::Optional<ContextRef> ContextRef::previous(
+    const JSHeapBroker* broker) const {
+  AllowHandleAllocation handle_allocation;
+  AllowHandleDereference handle_dereference;
+  Context* previous = object<Context>()->previous();
+  if (previous == nullptr) return base::Optional<ContextRef>();
+  return ContextRef(handle(previous, broker->isolate()));
+}
+
+ObjectRef ContextRef::get(const JSHeapBroker* broker, int index) const {
+  AllowHandleAllocation handle_allocation;
+  AllowHandleDereference handle_dereference;
+  Handle<Object> value(object<Context>()->get(index), broker->isolate());
+  return ObjectRef(value);
+}
+
+JSHeapBroker::JSHeapBroker(Isolate* isolate) : isolate_(isolate) {}
+
+HeapObjectType JSHeapBroker::HeapObjectTypeFromMap(Map* map) const {
+  AllowHandleDereference allow_handle_dereference;
+  OddballType oddball_type = OddballType::kNone;
+  if (map->instance_type() == ODDBALL_TYPE) {
+    ReadOnlyRoots roots(isolate_);
+    if (map == roots.undefined_map()) {
+      oddball_type = OddballType::kUndefined;
+    } else if (map == roots.null_map()) {
+      oddball_type = OddballType::kNull;
+    } else if (map == roots.boolean_map()) {
+      oddball_type = OddballType::kBoolean;
+    } else if (map == roots.the_hole_map()) {
+      oddball_type = OddballType::kHole;
+    } else if (map == roots.uninitialized_map()) {
+      oddball_type = OddballType::kUninitialized;
+    } else {
+      oddball_type = OddballType::kOther;
+      DCHECK(map == roots.termination_exception_map() ||
+             map == roots.arguments_marker_map() ||
+             map == roots.optimized_out_map() ||
+             map == roots.stale_register_map());
+    }
+  }
+  HeapObjectType::Flags flags(0);
+  if (map->is_undetectable()) flags |= HeapObjectType::kUndetectable;
+  if (map->is_callable()) flags |= HeapObjectType::kCallable;
+
+  return HeapObjectType(map->instance_type(), flags, oddball_type);
+}
+
+// static
+base::Optional<int> JSHeapBroker::TryGetSmi(Handle<Object> object) {
+  AllowHandleDereference allow_handle_dereference;
+  if (!object->IsSmi()) return base::Optional<int>();
+  return Smi::cast(*object)->value();
+}
+
+#define DEFINE_IS_AND_AS(Name)                       \
+  bool ObjectRef::Is##Name() const {                 \
+    AllowHandleDereference allow_handle_dereference; \
+    return object<Object>()->Is##Name();             \
+  }                                                  \
+  Name##Ref ObjectRef::As##Name() const {            \
+    DCHECK(Is##Name());                              \
+    return Name##Ref(object<HeapObject>());          \
+  }
+HEAP_BROKER_OBJECT_LIST(DEFINE_IS_AND_AS)
+#undef DEFINE_IS_AND_AS
+
+HeapObjectType HeapObjectRef::type(const JSHeapBroker* broker) const {
+  AllowHandleDereference allow_handle_dereference;
+  return broker->HeapObjectTypeFromMap(object<HeapObject>()->map());
+}
+
+base::Optional<MapRef> HeapObjectRef::TryGetObjectCreateMap(
+    const JSHeapBroker* broker) const {
+  AllowHandleAllocation handle_allocation;
+  AllowHandleDereference allow_handle_dereference;
+  Handle<Map> instance_map;
+  if (Map::TryGetObjectCreateMap(broker->isolate(), object<HeapObject>())
+          .ToHandle(&instance_map)) {
+    return MapRef(instance_map);
+  } else {
+    return base::Optional<MapRef>();
+  }
+}
+
+bool JSFunctionRef::HasBuiltinFunctionId() const {
+  AllowHandleDereference allow_handle_dereference;
+  return object<JSFunction>()->shared()->HasBuiltinFunctionId();
+}
+
+BuiltinFunctionId JSFunctionRef::GetBuiltinFunctionId() const {
+  AllowHandleDereference allow_handle_dereference;
+  return object<JSFunction>()->shared()->builtin_function_id();
+}
+
+bool JSFunctionRef::IsConstructor() const {
+  AllowHandleDereference allow_handle_dereference;
+  return object<JSFunction>()->IsConstructor();
+}
+
+MapRef JSFunctionRef::DependOnInitialMap(
+    const JSHeapBroker* broker, CompilationDependencies* dependencies) const {
+  AllowHandleAllocation handle_allocation;
+  AllowHandleDereference allow_handle_dereference;
+  Handle<Map> initial_map =
+      dependencies->DependOnInitialMap(object<JSFunction>());
+  return MapRef(initial_map);
+}
+
+void MapRef::DependOnStableMap(const JSHeapBroker* broker,
+                               CompilationDependencies* dependencies) const {
+  AllowHandleAllocation handle_allocation;
+  AllowHandleDereference allow_handle_dereference;
+  dependencies->DependOnStableMap(object<Map>());
+}
+
+int JSFunctionRef::GetInstanceSizeWithFinishedSlackTracking() const {
+  AllowHandleAllocation handle_allocation;
+  AllowHandleDereference allow_handle_dereference;
+  object<JSFunction>()->CompleteInobjectSlackTrackingIfActive();
+  return object<JSFunction>()->initial_map()->instance_size();
+}
+
+bool JSFunctionRef::has_initial_map() const {
+  AllowHandleDereference allow_handle_dereference;
+  return object<JSFunction>()->has_initial_map();
+}
+
+MapRef JSFunctionRef::initial_map(const JSHeapBroker* broker) const {
+  AllowHandleAllocation handle_allocation;
+  AllowHandleDereference allow_handle_dereference;
+  return MapRef(handle(object<JSFunction>()->initial_map(), broker->isolate()));
+}
+
+base::Optional<ScriptContextTableRef::LookupResult>
+ScriptContextTableRef::lookup(const NameRef& name) const {
+  AllowHandleAllocation handle_allocation;
+  AllowHandleDereference handle_dereference;
+  if (!name.IsString()) return {};
+  ScriptContextTable::LookupResult lookup_result;
+  auto table = object<ScriptContextTable>();
+  if (!ScriptContextTable::Lookup(table, name.object<String>(),
+                                  &lookup_result)) {
+    return {};
+  }
+  Handle<Context> script_context =
+      ScriptContextTable::GetContext(table, lookup_result.context_index);
+  LookupResult result{ContextRef(script_context),
+                      lookup_result.mode == VariableMode::kConst,
+                      lookup_result.slot_index};
+  return result;
+}
+
+ScriptContextTableRef NativeContextRef::script_context_table(
+    const JSHeapBroker* broker) const {
+  AllowHandleAllocation handle_allocation;
+  AllowHandleDereference handle_dereference;
+  return ScriptContextTableRef(
+      handle(object<Context>()->script_context_table(), broker->isolate()));
+}
+
+OddballType ObjectRef::oddball_type(const JSHeapBroker* broker) const {
+  return IsSmi() ? OddballType::kNone
+                 : AsHeapObject().type(broker).oddball_type();
+}
+
+ObjectRef FeedbackVectorRef::get(const JSHeapBroker* broker,
+                                 FeedbackSlot slot) const {
+  AllowHandleAllocation handle_allocation;
+  AllowHandleDereference handle_dereference;
+  Handle<Object> value(object<FeedbackVector>()->Get(slot)->ToObject(),
+                       broker->isolate());
+  return ObjectRef(value);
+}
+
+JSObjectRef AllocationSiteRef::boilerplate(const JSHeapBroker* broker) const {
+  AllowHandleAllocation handle_allocation;
+  AllowHandleDereference handle_dereference;
+  Handle<JSObject> value(object<AllocationSite>()->boilerplate(),
+                         broker->isolate());
+  return JSObjectRef(value);
+}
+
+bool JSObjectRef::IsUnboxedDoubleField(FieldIndex index) const {
+  AllowHandleDereference handle_dereference;
+  return object<JSObject>()->IsUnboxedDoubleField(index);
+}
+
+double JSObjectRef::RawFastDoublePropertyAt(FieldIndex index) const {
+  AllowHandleDereference handle_dereference;
+  return object<JSObject>()->RawFastDoublePropertyAt(index);
+}
+
+ObjectRef JSObjectRef::RawFastPropertyAt(const JSHeapBroker* broker,
+                                         FieldIndex index) const {
+  AllowHandleAllocation handle_allocation;
+  AllowHandleDereference handle_dereference;
+  return ObjectRef(
+      handle(object<JSObject>()->RawFastPropertyAt(index), broker->isolate()));
+}
+
+FixedArrayBaseRef JSObjectRef::elements(const JSHeapBroker* broker) const {
+  AllowHandleAllocation handle_allocation;
+  AllowHandleDereference handle_dereference;
+  return FixedArrayBaseRef(
+      handle(object<JSObject>()->elements(), broker->isolate()));
+}
+
+namespace {
+
+// Determines whether the given array or object literal boilerplate satisfies
+// all limits to be considered for fast deep-copying and computes the total
+// size of all objects that are part of the graph.
+bool IsFastLiteralHelper(Handle<JSObject> boilerplate, int max_depth,
+                         int* max_properties) {
+  DCHECK_GE(max_depth, 0);
+  DCHECK_GE(*max_properties, 0);
+
+  // Make sure the boilerplate map is not deprecated.
+  if (!JSObject::TryMigrateInstance(boilerplate)) return false;
+
+  // Check for too deep nesting.
+  if (max_depth == 0) return false;
+
+  // Check the elements.
+  Isolate* const isolate = boilerplate->GetIsolate();
+  Handle<FixedArrayBase> elements(boilerplate->elements(), isolate);
+  if (elements->length() > 0 &&
+      elements->map() != ReadOnlyRoots(isolate).fixed_cow_array_map()) {
+    if (boilerplate->HasSmiOrObjectElements()) {
+      Handle<FixedArray> fast_elements = Handle<FixedArray>::cast(elements);
+      int length = elements->length();
+      for (int i = 0; i < length; i++) {
+        if ((*max_properties)-- == 0) return false;
+        Handle<Object> value(fast_elements->get(i), isolate);
+        if (value->IsJSObject()) {
+          Handle<JSObject> value_object = Handle<JSObject>::cast(value);
+          if (!IsFastLiteralHelper(value_object, max_depth - 1,
+                                   max_properties)) {
+            return false;
+          }
+        }
+      }
+    } else if (boilerplate->HasDoubleElements()) {
+      if (elements->Size() > kMaxRegularHeapObjectSize) return false;
+    } else {
+      return false;
+    }
+  }
+
+  // TODO(turbofan): Do we want to support out-of-object properties?
+  if (!(boilerplate->HasFastProperties() &&
+        boilerplate->property_array()->length() == 0)) {
+    return false;
+  }
+
+  // Check the in-object properties.
+  Handle<DescriptorArray> descriptors(
+      boilerplate->map()->instance_descriptors(), isolate);
+  int limit = boilerplate->map()->NumberOfOwnDescriptors();
+  for (int i = 0; i < limit; i++) {
+    PropertyDetails details = descriptors->GetDetails(i);
+    if (details.location() != kField) continue;
+    DCHECK_EQ(kData, details.kind());
+    if ((*max_properties)-- == 0) return false;
+    FieldIndex field_index = FieldIndex::ForDescriptor(boilerplate->map(), i);
+    if (boilerplate->IsUnboxedDoubleField(field_index)) continue;
+    Handle<Object> value(boilerplate->RawFastPropertyAt(field_index), isolate);
+    if (value->IsJSObject()) {
+      Handle<JSObject> value_object = Handle<JSObject>::cast(value);
+      if (!IsFastLiteralHelper(value_object, max_depth - 1, max_properties)) {
+        return false;
+      }
+    }
+  }
+  return true;
+}
+
+}  // namespace
+
+// Maximum depth and total number of elements and properties for literal
+// graphs to be considered for fast deep-copying. The limit is chosen to
+// match the maximum number of inobject properties, to ensure that the
+// performance of using object literals is not worse than using constructor
+// functions, see crbug.com/v8/6211 for details.
+const int kMaxFastLiteralDepth = 3;
+const int kMaxFastLiteralProperties = JSObject::kMaxInObjectProperties;
+
+// Determines whether the given array or object literal boilerplate satisfies
+// all limits to be considered for fast deep-copying and computes the total
+// size of all objects that are part of the graph.
+bool AllocationSiteRef::IsFastLiteral(const JSHeapBroker* broker) const {
+  AllowHandleDereference allow_handle_dereference;
+  int max_properties = kMaxFastLiteralProperties;
+  Handle<JSObject> boilerplate(object<AllocationSite>()->boilerplate(),
+                               broker->isolate());
+  return IsFastLiteralHelper(boilerplate, kMaxFastLiteralDepth,
+                             &max_properties);
+}
+
+PretenureFlag AllocationSiteRef::GetPretenureMode() const {
+  AllowHandleDereference allow_handle_dereference;
+  return object<AllocationSite>()->GetPretenureMode();
+}
+
+void JSObjectRef::EnsureElementsTenured(const JSHeapBroker* broker) {
+  // TODO(jarin) Eventually, we will pretenure the boilerplates before
+  // the compilation job starts.
+  AllowHandleDereference allow_handle_dereference;
+  Handle<FixedArrayBase> object_elements =
+      elements(broker).object<FixedArrayBase>();
+  if (Heap::InNewSpace(*object_elements)) {
+    // If we would like to pretenure a fixed cow array, we must ensure that
+    // the array is already in old space, otherwise we'll create too many
+    // old-to-new-space pointers (overflowing the store buffer).
+    object_elements = Handle<FixedArrayBase>(
+        broker->isolate()->factory()->CopyAndTenureFixedCOWArray(
+            Handle<FixedArray>::cast(object_elements)));
+    object<JSObject>()->set_elements(*object_elements);
+  }
+}
+
+int MapRef::GetInObjectProperties() const {
+  AllowHandleDereference allow_handle_dereference;
+  return object<Map>()->GetInObjectProperties();
+}
+
+int MapRef::NumberOfOwnDescriptors() const {
+  AllowHandleDereference allow_handle_dereference;
+  return object<Map>()->NumberOfOwnDescriptors();
+}
+
+FieldIndex MapRef::GetFieldIndexFor(int i) const {
+  AllowHandleDereference allow_handle_dereference;
+  return FieldIndex::ForDescriptor(*object<Map>(), i);
+}
+
+int MapRef::GetInObjectPropertyOffset(int i) const {
+  AllowHandleDereference allow_handle_dereference;
+  return object<Map>()->GetInObjectPropertyOffset(i);
+}
+
+bool MapRef::is_dictionary_map() const {
+  AllowHandleDereference allow_handle_dereference;
+  return object<Map>()->is_dictionary_map();
+}
+
+ObjectRef MapRef::constructor_or_backpointer(const JSHeapBroker* broker) const {
+  AllowHandleAllocation handle_allocation;
+  AllowHandleDereference allow_handle_dereference;
+  return ObjectRef(
+      handle(object<Map>()->constructor_or_backpointer(), broker->isolate()));
+}
+
+int MapRef::instance_size() const {
+  AllowHandleDereference allow_handle_dereference;
+  return object<Map>()->instance_size();
+}
+
+InstanceType MapRef::instance_type() const {
+  AllowHandleDereference allow_handle_dereference;
+  return object<Map>()->instance_type();
+}
+
+PropertyDetails MapRef::GetPropertyDetails(int i) const {
+  AllowHandleDereference allow_handle_dereference;
+  return object<Map>()->instance_descriptors()->GetDetails(i);
+}
+
+NameRef MapRef::GetPropertyKey(const JSHeapBroker* broker, int i) const {
+  AllowHandleAllocation handle_allocation;
+  AllowHandleDereference allow_handle_dereference;
+  return NameRef(handle(object<Map>()->instance_descriptors()->GetKey(i),
+                        broker->isolate()));
+}
+
+bool MapRef::IsJSArrayMap() const {
+  AllowHandleDereference allow_handle_dereference;
+  return object<Map>()->IsJSArrayMap();
+}
+
+bool MapRef::IsInobjectSlackTrackingInProgress() const {
+  AllowHandleDereference allow_handle_dereference;
+  return object<Map>()->IsInobjectSlackTrackingInProgress();
+}
+
+bool MapRef::IsFixedCowArrayMap(const JSHeapBroker* broker) const {
+  AllowHandleDereference allow_handle_dereference;
+  return *object<Map>() ==
+         ReadOnlyRoots(broker->isolate()).fixed_cow_array_map();
+}
+
+bool MapRef::has_prototype_slot() const {
+  AllowHandleDereference allow_handle_dereference;
+  return object<Map>()->has_prototype_slot();
+}
+
+bool MapRef::is_stable() const {
+  AllowHandleDereference allow_handle_dereference;
+  return object<Map>()->is_stable();
+}
+
+bool MapRef::CanTransition() const {
+  AllowHandleDereference allow_handle_dereference;
+  return object<Map>()->CanTransition();
+}
+
+ElementsKind JSArrayRef::GetElementsKind() const {
+  AllowHandleDereference allow_handle_dereference;
+  return object<JSArray>()->GetElementsKind();
+}
+
+ObjectRef JSArrayRef::length(const JSHeapBroker* broker) const {
+  AllowHandleAllocation handle_allocation;
+  AllowHandleDereference allow_handle_dereference;
+  return ObjectRef(handle(object<JSArray>()->length(), broker->isolate()));
+}
+
+int StringRef::length() const {
+  AllowHandleDereference allow_handle_dereference;
+  return object<String>()->length();
+}
+
+uint16_t StringRef::GetFirstChar() {
+  AllowHandleDereference allow_handle_dereference;
+  return object<String>()->Get(0);
+}
+
+ObjectRef JSRegExpRef::raw_properties_or_hash(
+    const JSHeapBroker* broker) const {
+  AllowHandleAllocation handle_allocation;
+  AllowHandleDereference allow_handle_dereference;
+  return ObjectRef(
+      handle(object<JSRegExp>()->raw_properties_or_hash(), broker->isolate()));
+}
+
+ObjectRef JSRegExpRef::data(const JSHeapBroker* broker) const {
+  AllowHandleAllocation handle_allocation;
+  AllowHandleDereference allow_handle_dereference;
+  return ObjectRef(handle(object<JSRegExp>()->data(), broker->isolate()));
+}
+
+ObjectRef JSRegExpRef::source(const JSHeapBroker* broker) const {
+  AllowHandleAllocation handle_allocation;
+  AllowHandleDereference allow_handle_dereference;
+  return ObjectRef(handle(object<JSRegExp>()->source(), broker->isolate()));
+}
+
+ObjectRef JSRegExpRef::flags(const JSHeapBroker* broker) const {
+  AllowHandleAllocation handle_allocation;
+  AllowHandleDereference allow_handle_dereference;
+  return ObjectRef(handle(object<JSRegExp>()->flags(), broker->isolate()));
+}
+
+ObjectRef JSRegExpRef::last_index(const JSHeapBroker* broker) const {
+  AllowHandleAllocation handle_allocation;
+  AllowHandleDereference allow_handle_dereference;
+  return ObjectRef(handle(object<JSRegExp>()->last_index(), broker->isolate()));
+}
+
+int FixedArrayBaseRef::length() const {
+  AllowHandleDereference allow_handle_dereference;
+  return object<FixedArrayBase>()->length();
+}
+
+bool FixedArrayRef::is_the_hole(const JSHeapBroker* broker, int i) const {
+  AllowHandleDereference allow_handle_dereference;
+  return object<FixedArray>()->is_the_hole(broker->isolate(), i);
+}
+
+ObjectRef FixedArrayRef::get(const JSHeapBroker* broker, int i) const {
+  AllowHandleAllocation handle_allocation;
+  AllowHandleDereference allow_handle_dereference;
+  return ObjectRef(handle(object<FixedArray>()->get(i), broker->isolate()));
+}
+
+bool FixedDoubleArrayRef::is_the_hole(int i) const {
+  AllowHandleDereference allow_handle_dereference;
+  return object<FixedDoubleArray>()->is_the_hole(i);
+}
+
+double FixedDoubleArrayRef::get_scalar(int i) const {
+  AllowHandleDereference allow_handle_dereference;
+  return object<FixedDoubleArray>()->get_scalar(i);
+}
+
+int ScopeInfoRef::ContextLength() const {
+  AllowHandleDereference allow_handle_dereference;
+  return object<ScopeInfo>()->ContextLength();
+}
+
+int SharedFunctionInfoRef::internal_formal_parameter_count() const {
+  AllowHandleDereference allow_handle_dereference;
+  return object<SharedFunctionInfo>()->internal_formal_parameter_count();
+}
+
+int SharedFunctionInfoRef::function_map_index() const {
+  AllowHandleDereference allow_handle_dereference;
+  return object<SharedFunctionInfo>()->function_map_index();
+}
+
+bool SharedFunctionInfoRef::has_duplicate_parameters() const {
+  AllowHandleDereference allow_handle_dereference;
+  return object<SharedFunctionInfo>()->has_duplicate_parameters();
+}
+
+MapRef NativeContextRef::fast_aliased_arguments_map(
+    const JSHeapBroker* broker) const {
+  AllowHandleAllocation handle_allocation;
+  AllowHandleDereference allow_handle_dereference;
+  return MapRef(handle(object<Context>()->fast_aliased_arguments_map(),
+                       broker->isolate()));
+}
+
+MapRef NativeContextRef::sloppy_arguments_map(
+    const JSHeapBroker* broker) const {
+  AllowHandleAllocation handle_allocation;
+  AllowHandleDereference allow_handle_dereference;
+  return MapRef(
+      handle(object<Context>()->sloppy_arguments_map(), broker->isolate()));
+}
+
+MapRef NativeContextRef::strict_arguments_map(
+    const JSHeapBroker* broker) const {
+  AllowHandleAllocation handle_allocation;
+  AllowHandleDereference allow_handle_dereference;
+  return MapRef(
+      handle(object<Context>()->strict_arguments_map(), broker->isolate()));
+}
+
+MapRef NativeContextRef::js_array_fast_elements_map_index(
+    const JSHeapBroker* broker) const {
+  AllowHandleAllocation handle_allocation;
+  AllowHandleDereference allow_handle_dereference;
+  return MapRef(handle(object<Context>()->js_array_fast_elements_map_index(),
+                       broker->isolate()));
+}
+
+MapRef NativeContextRef::initial_array_iterator_map(
+    const JSHeapBroker* broker) const {
+  AllowHandleAllocation handle_allocation;
+  AllowHandleDereference allow_handle_dereference;
+  return MapRef(handle(object<Context>()->initial_array_iterator_map(),
+                       broker->isolate()));
+}
+
+MapRef NativeContextRef::set_value_iterator_map(
+    const JSHeapBroker* broker) const {
+  AllowHandleAllocation handle_allocation;
+  AllowHandleDereference allow_handle_dereference;
+  return MapRef(
+      handle(object<Context>()->set_value_iterator_map(), broker->isolate()));
+}
+
+MapRef NativeContextRef::set_key_value_iterator_map(
+    const JSHeapBroker* broker) const {
+  AllowHandleAllocation handle_allocation;
+  AllowHandleDereference allow_handle_dereference;
+  return MapRef(handle(object<Context>()->set_key_value_iterator_map(),
+                       broker->isolate()));
+}
+
+MapRef NativeContextRef::map_key_iterator_map(
+    const JSHeapBroker* broker) const {
+  AllowHandleAllocation handle_allocation;
+  AllowHandleDereference allow_handle_dereference;
+  return MapRef(
+      handle(object<Context>()->map_key_iterator_map(), broker->isolate()));
+}
+
+MapRef NativeContextRef::map_value_iterator_map(
+    const JSHeapBroker* broker) const {
+  AllowHandleAllocation handle_allocation;
+  AllowHandleDereference allow_handle_dereference;
+  return MapRef(
+      handle(object<Context>()->map_value_iterator_map(), broker->isolate()));
+}
+
+MapRef NativeContextRef::map_key_value_iterator_map(
+    const JSHeapBroker* broker) const {
+  AllowHandleAllocation handle_allocation;
+  AllowHandleDereference allow_handle_dereference;
+  return MapRef(handle(object<Context>()->map_key_value_iterator_map(),
+                       broker->isolate()));
+}
+
+MapRef NativeContextRef::GetFunctionMapFromIndex(const JSHeapBroker* broker,
+                                                 int index) const {
+  AllowHandleDereference allow_handle_dereference;
+  DCHECK_LE(index, Context::LAST_FUNCTION_MAP_INDEX);
+  DCHECK_GE(index, Context::FIRST_FUNCTION_MAP_INDEX);
+  return get(broker, index).AsMap();
+}
+
+bool ObjectRef::BooleanValue(const JSHeapBroker* broker) {
+  AllowHandleDereference allow_handle_dereference;
+  return object<Object>()->BooleanValue(broker->isolate());
+}
+
+}  // namespace compiler
+}  // namespace internal
+}  // namespace v8
diff --git a/deps/v8/src/compiler/js-heap-broker.h b/deps/v8/src/compiler/js-heap-broker.h
new file mode 100644
index 00000000000000..b1faee0ed25406
--- /dev/null
+++ b/deps/v8/src/compiler/js-heap-broker.h
@@ -0,0 +1,359 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef V8_COMPILER_JS_HEAP_BROKER_H_
+#define V8_COMPILER_JS_HEAP_BROKER_H_
+
+#include "src/base/compiler-specific.h"
+#include "src/base/optional.h"
+#include "src/globals.h"
+#include "src/objects.h"
+
+namespace v8 {
+namespace internal {
+namespace compiler {
+
+class DisallowHeapAccess {
+  DisallowHeapAllocation no_heap_allocation_;
+  DisallowHandleAllocation no_handle_allocation_;
+  DisallowHandleDereference no_handle_dereference_;
+  DisallowCodeDependencyChange no_dependency_change_;
+};
+
+enum class OddballType : uint8_t {
+  kNone,     // Not an Oddball.
+  kBoolean,  // True or False.
+  kUndefined,
+  kNull,
+  kHole,
+  kUninitialized,
+  kOther  // Oddball, but none of the above.
+};
+
+class HeapObjectType {
+ public:
+  enum Flag : uint8_t { kUndetectable = 1 << 0, kCallable = 1 << 1 };
+
+  typedef base::Flags<Flag> Flags;
+
+  HeapObjectType(InstanceType instance_type, Flags flags,
+                 OddballType oddball_type)
+      : instance_type_(instance_type),
+        oddball_type_(oddball_type),
+        flags_(flags) {
+    DCHECK_EQ(instance_type == ODDBALL_TYPE,
+              oddball_type != OddballType::kNone);
+  }
+
+  OddballType oddball_type() const { return oddball_type_; }
+  InstanceType instance_type() const { return instance_type_; }
+  Flags flags() const { return flags_; }
+
+  bool is_callable() const { return flags_ & kCallable; }
+  bool is_undetectable() const { return flags_ & kUndetectable; }
+
+ private:
+  InstanceType const instance_type_;
+  OddballType const oddball_type_;
+  Flags const flags_;
+};
+
+#define HEAP_BROKER_OBJECT_LIST(V) \
+  V(AllocationSite)                \
+  V(Context)                       \
+  V(FeedbackVector)                \
+  V(FixedArray)                    \
+  V(FixedArrayBase)                \
+  V(FixedDoubleArray)              \
+  V(HeapNumber)                    \
+  V(HeapObject)                    \
+  V(InternalizedString)            \
+  V(JSArray)                       \
+  V(JSFunction)                    \
+  V(JSObject)                      \
+  V(JSRegExp)                      \
+  V(Map)                           \
+  V(MutableHeapNumber)             \
+  V(Name)                          \
+  V(NativeContext)                 \
+  V(ScopeInfo)                     \
+  V(ScriptContextTable)            \
+  V(SharedFunctionInfo)            \
+  V(String)
+
+class CompilationDependencies;
+class JSHeapBroker;
+#define FORWARD_DECL(Name) class Name##Ref;
+HEAP_BROKER_OBJECT_LIST(FORWARD_DECL)
+#undef FORWARD_DECL
+
+class ObjectRef {
+ public:
+  explicit ObjectRef(Handle<Object> object) : object_(object) {}
+
+  template <typename T>
+  Handle<T> object() const {
+    AllowHandleDereference handle_dereference;
+    return Handle<T>::cast(object_);
+  }
+
+  OddballType oddball_type(const JSHeapBroker* broker) const;
+
+  bool IsSmi() const;
+  int AsSmi() const;
+
+  bool equals(const ObjectRef& other) const;
+
+#define HEAP_IS_METHOD_DECL(Name) bool Is##Name() const;
+  HEAP_BROKER_OBJECT_LIST(HEAP_IS_METHOD_DECL)
+#undef HEAP_IS_METHOD_DECL
+
+#define HEAP_AS_METHOD_DECL(Name) Name##Ref As##Name() const;
+  HEAP_BROKER_OBJECT_LIST(HEAP_AS_METHOD_DECL)
+#undef HEAP_AS_METHOD_DECL
+
+  StringRef TypeOf(const JSHeapBroker* broker) const;
+  bool BooleanValue(const JSHeapBroker* broker);
+
+ private:
+  Handle<Object> object_;
+};
+
+class HeapObjectRef : public ObjectRef {
+ public:
+  using ObjectRef::ObjectRef;
+
+  HeapObjectType type(const JSHeapBroker* broker) const;
+  MapRef map(const JSHeapBroker* broker) const;
+  base::Optional<MapRef> TryGetObjectCreateMap(
+      const JSHeapBroker* broker) const;
+};
+
+class JSObjectRef : public HeapObjectRef {
+ public:
+  using HeapObjectRef::HeapObjectRef;
+
+  bool IsUnboxedDoubleField(FieldIndex index) const;
+  double RawFastDoublePropertyAt(FieldIndex index) const;
+  ObjectRef RawFastPropertyAt(const JSHeapBroker* broker,
+                              FieldIndex index) const;
+
+  FixedArrayBaseRef elements(const JSHeapBroker* broker) const;
+  void EnsureElementsTenured(const JSHeapBroker* broker);
+};
+
+class JSFunctionRef : public JSObjectRef {
+ public:
+  using JSObjectRef::JSObjectRef;
+
+  bool HasBuiltinFunctionId() const;
+  BuiltinFunctionId GetBuiltinFunctionId() const;
+  bool IsConstructor() const;
+  bool has_initial_map() const;
+  MapRef initial_map(const JSHeapBroker* broker) const;
+
+  MapRef DependOnInitialMap(const JSHeapBroker* broker,
+                            CompilationDependencies* dependencies) const;
+  int GetInstanceSizeWithFinishedSlackTracking() const;
+};
+
+class JSRegExpRef : public JSObjectRef {
+ public:
+  using JSObjectRef::JSObjectRef;
+
+  ObjectRef raw_properties_or_hash(const JSHeapBroker* broker) const;
+  ObjectRef data(const JSHeapBroker* broker) const;
+  ObjectRef source(const JSHeapBroker* broker) const;
+  ObjectRef flags(const JSHeapBroker* broker) const;
+  ObjectRef last_index(const JSHeapBroker* broker) const;
+};
+
+class HeapNumberRef : public HeapObjectRef {
+ public:
+  using HeapObjectRef::HeapObjectRef;
+
+  double value() const;
+};
+
+class MutableHeapNumberRef : public HeapObjectRef {
+ public:
+  using HeapObjectRef::HeapObjectRef;
+
+  double value() const;
+};
+
+class ContextRef : public HeapObjectRef {
+ public:
+  using HeapObjectRef::HeapObjectRef;
+
+  base::Optional<ContextRef> previous(const JSHeapBroker* broker) const;
+  ObjectRef get(const JSHeapBroker* broker, int index) const;
+};
+
+class NativeContextRef : public ContextRef {
+ public:
+  using ContextRef::ContextRef;
+
+  ScriptContextTableRef script_context_table(const JSHeapBroker* broker) const;
+
+  MapRef fast_aliased_arguments_map(const JSHeapBroker* broker) const;
+  MapRef sloppy_arguments_map(const JSHeapBroker* broker) const;
+  MapRef strict_arguments_map(const JSHeapBroker* broker) const;
+  MapRef js_array_fast_elements_map_index(const JSHeapBroker* broker) const;
+  MapRef initial_array_iterator_map(const JSHeapBroker* broker) const;
+  MapRef set_value_iterator_map(const JSHeapBroker* broker) const;
+  MapRef set_key_value_iterator_map(const JSHeapBroker* broker) const;
+  MapRef map_key_iterator_map(const JSHeapBroker* broker) const;
+  MapRef map_value_iterator_map(const JSHeapBroker* broker) const;
+  MapRef map_key_value_iterator_map(const JSHeapBroker* broker) const;
+
+  MapRef GetFunctionMapFromIndex(const JSHeapBroker* broker, int index) const;
+};
+
+class NameRef : public HeapObjectRef {
+ public:
+  using HeapObjectRef::HeapObjectRef;
+};
+
+class ScriptContextTableRef : public HeapObjectRef {
+ public:
+  using HeapObjectRef::HeapObjectRef;
+
+  struct LookupResult {
+    ContextRef context;
+    bool immutable;
+    int index;
+  };
+
+  base::Optional<LookupResult> lookup(const NameRef& name) const;
+};
+
+class FeedbackVectorRef : public HeapObjectRef {
+ public:
+  using HeapObjectRef::HeapObjectRef;
+
+  ObjectRef get(const JSHeapBroker* broker, FeedbackSlot slot) const;
+};
+
+class AllocationSiteRef : public HeapObjectRef {
+ public:
+  using HeapObjectRef::HeapObjectRef;
+
+  JSObjectRef boilerplate(const JSHeapBroker* broker) const;
+  PretenureFlag GetPretenureMode() const;
+  bool IsFastLiteral(const JSHeapBroker* broker) const;
+};
+
+class MapRef : public HeapObjectRef {
+ public:
+  using HeapObjectRef::HeapObjectRef;
+
+  int instance_size() const;
+  InstanceType instance_type() const;
+  int GetInObjectProperties() const;
+  int NumberOfOwnDescriptors() const;
+  PropertyDetails GetPropertyDetails(int i) const;
+  NameRef GetPropertyKey(const JSHeapBroker* broker, int i) const;
+  FieldIndex GetFieldIndexFor(int i) const;
+  int GetInObjectPropertyOffset(int index) const;
+  ObjectRef constructor_or_backpointer(const JSHeapBroker* broker) const;
+
+  bool is_stable() const;
+  bool has_prototype_slot() const;
+  bool CanTransition() const;
+  bool IsInobjectSlackTrackingInProgress() const;
+
+  bool is_dictionary_map() const;
+  bool IsJSArrayMap() const;
+  bool IsFixedCowArrayMap(const JSHeapBroker* broker) const;
+
+  void DependOnStableMap(const JSHeapBroker* broker,
+                         CompilationDependencies* dependencies) const;
+};
+
+class FixedArrayBaseRef : public HeapObjectRef {
+ public:
+  using HeapObjectRef::HeapObjectRef;
+
+  int length() const;
+};
+
+class FixedArrayRef : public FixedArrayBaseRef {
+ public:
+  using FixedArrayBaseRef::FixedArrayBaseRef;
+
+  ObjectRef get(const JSHeapBroker* broker, int i) const;
+  bool is_the_hole(const JSHeapBroker* broker, int i) const;
+};
+
+class FixedDoubleArrayRef : public FixedArrayBaseRef {
+ public:
+  using FixedArrayBaseRef::FixedArrayBaseRef;
+
+  double get_scalar(int i) const;
+  bool is_the_hole(int i) const;
+};
+
+class JSArrayRef : public JSObjectRef {
+ public:
+  using JSObjectRef::JSObjectRef;
+
+  ElementsKind GetElementsKind() const;
+  ObjectRef length(const JSHeapBroker* broker) const;
+};
+
+class ScopeInfoRef : public HeapObjectRef {
+ public:
+  using HeapObjectRef::HeapObjectRef;
+
+  int ContextLength() const;
+};
+
+class SharedFunctionInfoRef : public HeapObjectRef {
+ public:
+  using HeapObjectRef::HeapObjectRef;
+
+  int internal_formal_parameter_count() const;
+  bool has_duplicate_parameters() const;
+  int function_map_index() const;
+};
+
+class StringRef : public NameRef {
+ public:
+  using NameRef::NameRef;
+
+  int length() const;
+  uint16_t GetFirstChar();
+};
+
+class InternalizedStringRef : public StringRef {
+ public:
+  using StringRef::StringRef;
+};
+
+class V8_EXPORT_PRIVATE JSHeapBroker : public NON_EXPORTED_BASE(ZoneObject) {
+ public:
+  JSHeapBroker(Isolate* isolate);
+
+  HeapObjectType HeapObjectTypeFromMap(Handle<Map> map) const {
+    AllowHandleDereference handle_dereference;
+    return HeapObjectTypeFromMap(*map);
+  }
+
+  static base::Optional<int> TryGetSmi(Handle<Object> object);
+
+  Isolate* isolate() const { return isolate_; }
+
+ private:
+  friend class HeapObjectRef;
+  HeapObjectType HeapObjectTypeFromMap(Map* map) const;
+
+  Isolate* const isolate_;
+};
+
+}  // namespace compiler
+}  // namespace internal
+}  // namespace v8
+
+#endif  // V8_COMPILER_JS_HEAP_BROKER_H_
diff --git a/deps/v8/src/compiler/js-inlining-heuristic.cc b/deps/v8/src/compiler/js-inlining-heuristic.cc
index c2c09600828c85..588626e2926d11 100644
--- a/deps/v8/src/compiler/js-inlining-heuristic.cc
+++ b/deps/v8/src/compiler/js-inlining-heuristic.cc
@@ -50,7 +50,7 @@ int CollectFunctions(Node* node, Handle<JSFunction>* functions,
 }
 
 bool CanInlineFunction(Handle<SharedFunctionInfo> shared) {
-  // Built-in functions are handled by the JSBuiltinReducer.
+  // Built-in functions are handled by the JSCallReducer.
   if (shared->HasBuiltinFunctionId()) return false;
 
   // Only choose user code for inlining.
@@ -113,7 +113,7 @@ Reduction JSInliningHeuristic::Reduce(Node* node) {
     Handle<SharedFunctionInfo> shared =
         candidate.functions[i].is_null()
             ? candidate.shared_info
-            : handle(candidate.functions[i]->shared());
+            : handle(candidate.functions[i]->shared(), isolate());
     candidate.can_inline_function[i] = CanInlineFunction(shared);
     // Do not allow direct recursion i.e. f() -> f(). We still allow indirect
     // recurion like f() -> g() -> f(). The indirect recursion is helpful in
@@ -607,7 +607,7 @@ Reduction JSInliningHeuristic::InlineCandidate(Candidate const& candidate,
     Handle<SharedFunctionInfo> shared =
         candidate.functions[0].is_null()
             ? candidate.shared_info
-            : handle(candidate.functions[0]->shared());
+            : handle(candidate.functions[0]->shared(), isolate());
     Reduction const reduction = inliner_.ReduceJSCall(node);
     if (reduction.Changed()) {
       cumulative_count_ += shared->GetBytecodeArray()->length();
@@ -709,7 +709,7 @@ bool JSInliningHeuristic::CandidateCompare::operator()(
 }
 
 void JSInliningHeuristic::PrintCandidates() {
-  OFStream os(stdout);
+  StdoutStream os;
   os << "Candidates for inlining (size=" << candidates_.size() << "):\n";
   for (const Candidate& candidate : candidates_) {
     os << "  #" << candidate.node->id() << ":"
@@ -719,7 +719,7 @@ void JSInliningHeuristic::PrintCandidates() {
       Handle<SharedFunctionInfo> shared =
           candidate.functions[i].is_null()
               ? candidate.shared_info
-              : handle(candidate.functions[i]->shared());
+              : handle(candidate.functions[i]->shared(), isolate());
       PrintF("  - size:%d, name: %s\n", shared->GetBytecodeArray()->length(),
              shared->DebugName()->ToCString().get());
     }
diff --git a/deps/v8/src/compiler/js-inlining-heuristic.h b/deps/v8/src/compiler/js-inlining-heuristic.h
index af004011e3f1de..dc8d70f6aca3a2 100644
--- a/deps/v8/src/compiler/js-inlining-heuristic.h
+++ b/deps/v8/src/compiler/js-inlining-heuristic.h
@@ -80,6 +80,7 @@ class JSInliningHeuristic final : public AdvancedReducer {
   CommonOperatorBuilder* common() const;
   Graph* graph() const;
   JSGraph* jsgraph() const { return jsgraph_; }
+  Isolate* isolate() const { return jsgraph_->isolate(); }
   SimplifiedOperatorBuilder* simplified() const;
 
   Mode const mode_;
diff --git a/deps/v8/src/compiler/js-inlining.cc b/deps/v8/src/compiler/js-inlining.cc
index 139fe9afb8224c..247e36d5b39790 100644
--- a/deps/v8/src/compiler/js-inlining.cc
+++ b/deps/v8/src/compiler/js-inlining.cc
@@ -298,7 +298,7 @@ bool JSInliner::DetermineCallTarget(
       return false;
     }
 
-    shared_info_out = handle(function->shared());
+    shared_info_out = handle(function->shared(), isolate());
     return true;
   }
 
@@ -343,8 +343,8 @@ void JSInliner::DetermineCallContext(
     JSFunction::EnsureFeedbackVector(function);
 
     // The inlinee specializes to the context from the JSFunction object.
-    context_out = jsgraph()->Constant(handle(function->context()));
-    feedback_vector_out = handle(function->feedback_vector());
+    context_out = jsgraph()->Constant(handle(function->context(), isolate()));
+    feedback_vector_out = handle(function->feedback_vector(), isolate());
     return;
   }
 
@@ -358,7 +358,8 @@ void JSInliner::DetermineCallContext(
 
     // The inlinee uses the locally provided context at instantiation.
     context_out = NodeProperties::GetContextInput(match.node());
-    feedback_vector_out = handle(FeedbackVector::cast(cell->value()));
+    feedback_vector_out =
+        handle(FeedbackVector::cast(cell->value()), isolate());
     return;
   }
 
@@ -372,7 +373,7 @@ Reduction JSInliner::Reduce(Node* node) {
 }
 
 Handle<Context> JSInliner::native_context() const {
-  return handle(info_->context()->native_context());
+  return handle(info_->context()->native_context(), isolate());
 }
 
 Reduction JSInliner::ReduceJSCall(Node* node) {
@@ -548,62 +549,18 @@ Reduction JSInliner::ReduceJSCall(Node* node) {
       uncaught_subcalls.push_back(create);  // Adds {IfSuccess} & {IfException}.
       NodeProperties::ReplaceControlInput(node, create);
       NodeProperties::ReplaceEffectInput(node, create);
-      Node* node_success =
-          NodeProperties::FindSuccessfulControlProjection(node);
       // Placeholder to hold {node}'s value dependencies while {node} is
       // replaced.
       Node* dummy = graph()->NewNode(common()->Dead());
       NodeProperties::ReplaceUses(node, dummy, node, node, node);
       Node* result;
-      if (FLAG_harmony_restrict_constructor_return &&
-          IsClassConstructor(shared_info->kind())) {
-        Node* is_undefined =
-            graph()->NewNode(simplified()->ReferenceEqual(), node,
-                             jsgraph()->UndefinedConstant());
-        Node* branch_is_undefined =
-            graph()->NewNode(common()->Branch(), is_undefined, node_success);
-        Node* branch_is_undefined_true =
-            graph()->NewNode(common()->IfTrue(), branch_is_undefined);
-        Node* branch_is_undefined_false =
-            graph()->NewNode(common()->IfFalse(), branch_is_undefined);
-        Node* is_receiver =
-            graph()->NewNode(simplified()->ObjectIsReceiver(), node);
-        Node* branch_is_receiver = graph()->NewNode(
-            common()->Branch(), is_receiver, branch_is_undefined_false);
-        Node* branch_is_receiver_true =
-            graph()->NewNode(common()->IfTrue(), branch_is_receiver);
-        Node* branch_is_receiver_false =
-            graph()->NewNode(common()->IfFalse(), branch_is_receiver);
-        branch_is_receiver_false =
-            graph()->NewNode(javascript()->CallRuntime(
-                                 Runtime::kThrowConstructorReturnedNonObject),
-                             context, NodeProperties::GetFrameStateInput(node),
-                             node, branch_is_receiver_false);
-        uncaught_subcalls.push_back(branch_is_receiver_false);
-        branch_is_receiver_false =
-            graph()->NewNode(common()->Throw(), branch_is_receiver_false,
-                             branch_is_receiver_false);
-        NodeProperties::MergeControlToEnd(graph(), common(),
-                                          branch_is_receiver_false);
-        Node* merge =
-            graph()->NewNode(common()->Merge(2), branch_is_undefined_true,
-                             branch_is_receiver_true);
-        result =
-            graph()->NewNode(common()->Phi(MachineRepresentation::kTagged, 2),
-                             create, node, merge);
-        ReplaceWithValue(node_success, node_success, node_success, merge);
-        // Fix input destroyed by the above {ReplaceWithValue} call.
-        NodeProperties::ReplaceControlInput(branch_is_undefined, node_success,
-                                            0);
-      } else {
-        // Insert a check of the return value to determine whether the return
-        // value or the implicit receiver should be selected as a result of the
-        // call.
-        Node* check = graph()->NewNode(simplified()->ObjectIsReceiver(), node);
-        result =
-            graph()->NewNode(common()->Select(MachineRepresentation::kTagged),
-                             check, node, create);
-      }
+      // Insert a check of the return value to determine whether the return
+      // value or the implicit receiver should be selected as a result of the
+      // call.
+      Node* check = graph()->NewNode(simplified()->ObjectIsReceiver(), node);
+      result =
+          graph()->NewNode(common()->Select(MachineRepresentation::kTagged),
+                           check, node, create);
       receiver = create;  // The implicit receiver.
       ReplaceWithValue(dummy, result);
     } else if (IsDerivedConstructor(shared_info->kind())) {
@@ -648,10 +605,10 @@ Reduction JSInliner::ReduceJSCall(Node* node) {
   if (node->opcode() == IrOpcode::kJSCall &&
       is_sloppy(shared_info->language_mode()) && !shared_info->native()) {
     Node* effect = NodeProperties::GetEffectInput(node);
-    if (NodeProperties::CanBePrimitive(call.receiver(), effect)) {
+    if (NodeProperties::CanBePrimitive(isolate(), call.receiver(), effect)) {
       CallParameters const& p = CallParametersOf(node->op());
       Node* global_proxy = jsgraph()->HeapConstant(
-          handle(info_->native_context()->global_proxy()));
+          handle(info_->native_context()->global_proxy(), isolate()));
       Node* receiver = effect =
           graph()->NewNode(simplified()->ConvertReceiver(p.convert_mode()),
                            call.receiver(), global_proxy, effect, start);
diff --git a/deps/v8/src/compiler/js-inlining.h b/deps/v8/src/compiler/js-inlining.h
index 5fca638daf5108..1c7ee6c0b8b5b5 100644
--- a/deps/v8/src/compiler/js-inlining.h
+++ b/deps/v8/src/compiler/js-inlining.h
@@ -47,6 +47,7 @@ class JSInliner final : public AdvancedReducer {
   SimplifiedOperatorBuilder* simplified() const;
   Graph* graph() const;
   JSGraph* jsgraph() const { return jsgraph_; }
+  Isolate* isolate() const { return jsgraph_->isolate(); }
   Handle<Context> native_context() const;
 
   Zone* const local_zone_;
diff --git a/deps/v8/src/compiler/js-intrinsic-lowering.cc b/deps/v8/src/compiler/js-intrinsic-lowering.cc
index d9742e47d9fd2f..fcb9e87adb37bb 100644
--- a/deps/v8/src/compiler/js-intrinsic-lowering.cc
+++ b/deps/v8/src/compiler/js-intrinsic-lowering.cc
@@ -55,10 +55,6 @@ Reduction JSIntrinsicLowering::Reduce(Node* node) {
       return ReduceIsInstanceType(node, JS_TYPED_ARRAY_TYPE);
     case Runtime::kInlineIsJSProxy:
       return ReduceIsInstanceType(node, JS_PROXY_TYPE);
-    case Runtime::kInlineIsJSMap:
-      return ReduceIsInstanceType(node, JS_MAP_TYPE);
-    case Runtime::kInlineIsJSSet:
-      return ReduceIsInstanceType(node, JS_SET_TYPE);
     case Runtime::kInlineIsJSWeakMap:
       return ReduceIsInstanceType(node, JS_WEAK_MAP_TYPE);
     case Runtime::kInlineIsJSWeakSet:
@@ -424,7 +420,7 @@ Reduction JSIntrinsicLowering::Change(Node* node, const Operator* op, Node* a,
 Reduction JSIntrinsicLowering::Change(Node* node, Callable const& callable,
                                       int stack_parameter_count) {
   auto call_descriptor = Linkage::GetStubCallDescriptor(
-      isolate(), graph()->zone(), callable.descriptor(), stack_parameter_count,
+      graph()->zone(), callable.descriptor(), stack_parameter_count,
       CallDescriptor::kNeedsFrameState, node->op()->properties());
   node->InsertInput(graph()->zone(), 0,
                     jsgraph()->HeapConstant(callable.code()));
diff --git a/deps/v8/src/compiler/js-native-context-specialization.cc b/deps/v8/src/compiler/js-native-context-specialization.cc
index 60e47e025ffb22..7584b7913a63fc 100644
--- a/deps/v8/src/compiler/js-native-context-specialization.cc
+++ b/deps/v8/src/compiler/js-native-context-specialization.cc
@@ -7,10 +7,10 @@
 #include "src/accessors.h"
 #include "src/api.h"
 #include "src/code-factory.h"
-#include "src/compilation-dependencies.h"
 #include "src/compiler/access-builder.h"
 #include "src/compiler/access-info.h"
 #include "src/compiler/allocation-builder.h"
+#include "src/compiler/compilation-dependencies.h"
 #include "src/compiler/js-graph.h"
 #include "src/compiler/js-operator.h"
 #include "src/compiler/linkage.h"
@@ -20,6 +20,7 @@
 #include "src/feedback-vector.h"
 #include "src/field-index-inl.h"
 #include "src/isolate-inl.h"
+#include "src/objects/templates.h"
 #include "src/vector-slot-pair.h"
 
 namespace v8 {
@@ -57,14 +58,16 @@ struct JSNativeContextSpecialization::ScriptContextTableLookupResult {
 };
 
 JSNativeContextSpecialization::JSNativeContextSpecialization(
-    Editor* editor, JSGraph* jsgraph, Flags flags,
-    Handle<Context> native_context, CompilationDependencies* dependencies,
-    Zone* zone)
+    Editor* editor, JSGraph* jsgraph, const JSHeapBroker* js_heap_broker,
+    Flags flags, Handle<Context> native_context,
+    CompilationDependencies* dependencies, Zone* zone)
     : AdvancedReducer(editor),
       jsgraph_(jsgraph),
+      js_heap_broker_(js_heap_broker),
       flags_(flags),
-      global_object_(native_context->global_object()),
-      global_proxy_(JSGlobalProxy::cast(native_context->global_proxy())),
+      global_object_(native_context->global_object(), jsgraph->isolate()),
+      global_proxy_(JSGlobalProxy::cast(native_context->global_proxy()),
+                    jsgraph->isolate()),
       native_context_(native_context),
       dependencies_(dependencies),
       zone_(zone),
@@ -151,13 +154,11 @@ Reduction JSNativeContextSpecialization::ReduceJSGetSuperConstructor(
   // We can constant-fold the super constructor access if the
   // {function}s map is stable, i.e. we can use a code dependency
   // to guard against [[Prototype]] changes of {function}.
-  if (function_map->is_stable()) {
+  if (function_map->is_stable() && function_prototype->IsConstructor()) {
+    dependencies()->DependOnStableMap(function_map);
     Node* value = jsgraph()->Constant(function_prototype);
-    dependencies()->AssumeMapStable(function_map);
-    if (function_prototype->IsConstructor()) {
-      ReplaceWithValue(node, value);
-      return Replace(value);
-    }
+    ReplaceWithValue(node, value);
+    return Replace(value);
   }
 
   return NoChange();
@@ -189,7 +190,8 @@ Reduction JSNativeContextSpecialization::ReduceJSInstanceOf(Node* node) {
 
   // Compute property access info for @@hasInstance on {receiver}.
   PropertyAccessInfo access_info;
-  AccessInfoFactory access_info_factory(dependencies(), native_context(),
+  AccessInfoFactory access_info_factory(dependencies(), js_heap_broker(),
+                                        native_context().object<Context>(),
                                         graph()->zone());
   if (!access_info_factory.ComputePropertyAccessInfo(
           receiver_map, factory()->has_instance_symbol(), AccessMode::kLoad,
@@ -206,8 +208,9 @@ Reduction JSNativeContextSpecialization::ReduceJSInstanceOf(Node* node) {
       // Determine actual holder and perform prototype chain checks.
       Handle<JSObject> holder;
       if (access_info.holder().ToHandle(&holder)) {
-        access_builder.AssumePrototypesStable(
-            native_context(), access_info.receiver_maps(), holder);
+        dependencies()->DependOnStablePrototypeChains(
+            native_context().object<Context>(), access_info.receiver_maps(),
+            holder);
       }
 
       // Check that {constructor} is actually {receiver}.
@@ -231,8 +234,9 @@ Reduction JSNativeContextSpecialization::ReduceJSInstanceOf(Node* node) {
     // Determine actual holder and perform prototype chain checks.
     Handle<JSObject> holder;
     if (access_info.holder().ToHandle(&holder)) {
-      access_builder.AssumePrototypesStable(
-          native_context(), access_info.receiver_maps(), holder);
+      dependencies()->DependOnStablePrototypeChains(
+          native_context().object<Context>(), access_info.receiver_maps(),
+          holder);
     } else {
       holder = receiver;
     }
@@ -300,7 +304,8 @@ JSNativeContextSpecialization::InferHasInPrototypeChain(
     Node* receiver, Node* effect, Handle<HeapObject> prototype) {
   ZoneHandleSet<Map> receiver_maps;
   NodeProperties::InferReceiverMapsResult result =
-      NodeProperties::InferReceiverMaps(receiver, effect, &receiver_maps);
+      NodeProperties::InferReceiverMaps(isolate(), receiver, effect,
+                                        &receiver_maps);
   if (result == NodeProperties::kNoReceiverMaps) return kMayBeInPrototypeChain;
 
   // Check if either all or none of the {receiver_maps} have the given
@@ -385,7 +390,8 @@ Reduction JSNativeContextSpecialization::ReduceJSOrdinaryHasInstance(
     // invocation of the instanceof operator again.
     // ES6 section 7.3.19 OrdinaryHasInstance (C, O) step 2.
     Handle<JSBoundFunction> function = Handle<JSBoundFunction>::cast(m.Value());
-    Handle<JSReceiver> bound_target_function(function->bound_target_function());
+    Handle<JSReceiver> bound_target_function(function->bound_target_function(),
+                                             isolate());
     NodeProperties::ReplaceValueInput(node, object, 0);
     NodeProperties::ReplaceValueInput(
         node, jsgraph()->HeapConstant(bound_target_function), 1);
@@ -405,9 +411,7 @@ Reduction JSNativeContextSpecialization::ReduceJSOrdinaryHasInstance(
       // depend on that for the prototype constant-folding below.
       JSFunction::EnsureHasInitialMap(function);
 
-      // Install a code dependency on the {function}s initial map.
-      Handle<Map> initial_map(function->initial_map(), isolate());
-      dependencies()->AssumeInitialMapCantChange(initial_map);
+      Handle<Map> initial_map = dependencies()->DependOnInitialMap(function);
       Node* prototype =
           jsgraph()->Constant(handle(initial_map->prototype(), isolate()));
 
@@ -435,12 +439,14 @@ Reduction JSNativeContextSpecialization::ReduceJSPromiseResolve(Node* node) {
 
   // Check if the {constructor} is the %Promise% function.
   HeapObjectMatcher m(constructor);
-  if (!m.Is(handle(native_context()->promise_function()))) return NoChange();
+  if (!m.Is(handle(native_context().object<Context>()->promise_function(),
+                   isolate())))
+    return NoChange();
 
   // Check if we know something about the {value}.
   ZoneHandleSet<Map> value_maps;
   NodeProperties::InferReceiverMapsResult result =
-      NodeProperties::InferReceiverMaps(value, effect, &value_maps);
+      NodeProperties::InferReceiverMaps(isolate(), value, effect, &value_maps);
   if (result == NodeProperties::kNoReceiverMaps) return NoChange();
   DCHECK_NE(0, value_maps.size());
 
@@ -470,13 +476,15 @@ Reduction JSNativeContextSpecialization::ReduceJSResolvePromise(Node* node) {
   // Check if we know something about the {resolution}.
   ZoneHandleSet<Map> resolution_maps;
   NodeProperties::InferReceiverMapsResult result =
-      NodeProperties::InferReceiverMaps(resolution, effect, &resolution_maps);
+      NodeProperties::InferReceiverMaps(isolate(), resolution, effect,
+                                        &resolution_maps);
   if (result != NodeProperties::kReliableReceiverMaps) return NoChange();
   DCHECK_NE(0, resolution_maps.size());
 
   // Compute property access info for "then" on {resolution}.
   PropertyAccessInfo access_info;
-  AccessInfoFactory access_info_factory(dependencies(), native_context(),
+  AccessInfoFactory access_info_factory(dependencies(), js_heap_broker(),
+                                        native_context().object<Context>(),
                                         graph()->zone());
   if (!access_info_factory.ComputePropertyAccessInfo(
           MapHandles(resolution_maps.begin(), resolution_maps.end()),
@@ -492,8 +500,9 @@ Reduction JSNativeContextSpecialization::ReduceJSResolvePromise(Node* node) {
   // Add proper dependencies on the {resolution}s [[Prototype]]s.
   Handle<JSObject> holder;
   if (access_info.holder().ToHandle(&holder)) {
-    access_builder.AssumePrototypesStable(native_context(),
-                                          access_info.receiver_maps(), holder);
+    dependencies()->DependOnStablePrototypeChains(
+        native_context().object<Context>(), access_info.receiver_maps(),
+        holder);
   }
 
   // Simply fulfill the {promise} with the {resolution}.
@@ -511,7 +520,7 @@ Reduction JSNativeContextSpecialization::ReduceJSLoadContext(Node* node) {
   // context (if any), so we can constant-fold those fields, which is
   // safe, since the NATIVE_CONTEXT_INDEX slot is always immutable.
   if (access.index() == Context::NATIVE_CONTEXT_INDEX) {
-    Node* value = jsgraph()->HeapConstant(native_context());
+    Node* value = jsgraph()->Constant(js_heap_broker(), native_context());
     ReplaceWithValue(node, value);
     return Replace(value);
   }
@@ -521,7 +530,7 @@ Reduction JSNativeContextSpecialization::ReduceJSLoadContext(Node* node) {
 namespace {
 
 FieldAccess ForPropertyCellValue(MachineRepresentation representation,
-                                 Type* type, MaybeHandle<Map> map,
+                                 Type type, MaybeHandle<Map> map,
                                  Handle<Name> name) {
   WriteBarrierKind kind = kFullWriteBarrier;
   if (representation == MachineRepresentation::kTaggedSigned) {
@@ -599,7 +608,7 @@ Reduction JSNativeContextSpecialization::ReduceGlobalAccess(
       // can be deleted or reconfigured to an accessor property).
       if (property_details.cell_type() != PropertyCellType::kMutable ||
           property_details.IsConfigurable()) {
-        dependencies()->AssumePropertyCell(property_cell);
+        dependencies()->DependOnGlobalProperty(property_cell);
       }
 
       // Load from constant/undefined global property can be constant-folded.
@@ -609,7 +618,7 @@ Reduction JSNativeContextSpecialization::ReduceGlobalAccess(
       } else {
         // Load from constant type cell can benefit from type feedback.
         MaybeHandle<Map> map;
-        Type* property_cell_value_type = Type::NonInternal();
+        Type property_cell_value_type = Type::NonInternal();
         MachineRepresentation representation = MachineRepresentation::kTagged;
         if (property_details.cell_type() == PropertyCellType::kConstantType) {
           // Compute proper type based on the current value in the cell.
@@ -623,14 +632,15 @@ Reduction JSNativeContextSpecialization::ReduceGlobalAccess(
             Handle<Map> property_cell_value_map(
                 Handle<HeapObject>::cast(property_cell_value)->map(),
                 isolate());
-            property_cell_value_type = Type::For(property_cell_value_map);
+            property_cell_value_type =
+                Type::For(js_heap_broker(), property_cell_value_map);
             representation = MachineRepresentation::kTaggedPointer;
 
             // We can only use the property cell value map for map check
             // elimination if it's stable, i.e. the HeapObject wasn't
             // mutated without the cell state being updated.
             if (property_cell_value_map->is_stable()) {
-              dependencies()->AssumeMapStable(property_cell_value_map);
+              dependencies()->DependOnStableMap(property_cell_value_map);
               map = property_cell_value_map;
             }
           }
@@ -652,7 +662,7 @@ Reduction JSNativeContextSpecialization::ReduceGlobalAccess(
       case PropertyCellType::kConstant: {
         // Record a code dependency on the cell, and just deoptimize if the new
         // value doesn't match the previous value stored inside the cell.
-        dependencies()->AssumePropertyCell(property_cell);
+        dependencies()->DependOnGlobalProperty(property_cell);
         Node* check =
             graph()->NewNode(simplified()->ReferenceEqual(), value,
                              jsgraph()->Constant(property_cell_value));
@@ -665,8 +675,8 @@ Reduction JSNativeContextSpecialization::ReduceGlobalAccess(
         // Record a code dependency on the cell, and just deoptimize if the new
         // values' type doesn't match the type of the previous value in the
         // cell.
-        dependencies()->AssumePropertyCell(property_cell);
-        Type* property_cell_value_type;
+        dependencies()->DependOnGlobalProperty(property_cell);
+        Type property_cell_value_type;
         MachineRepresentation representation = MachineRepresentation::kTagged;
         if (property_cell_value->IsHeapObject()) {
           // We cannot do anything if the {property_cell_value}s map is no
@@ -674,7 +684,7 @@ Reduction JSNativeContextSpecialization::ReduceGlobalAccess(
           Handle<Map> property_cell_value_map(
               Handle<HeapObject>::cast(property_cell_value)->map(), isolate());
           DCHECK(property_cell_value_map->is_stable());
-          dependencies()->AssumeMapStable(property_cell_value_map);
+          dependencies()->DependOnStableMap(property_cell_value_map);
 
           // Check that the {value} is a HeapObject.
           value = effect = graph()->NewNode(simplified()->CheckHeapObject(),
@@ -705,7 +715,7 @@ Reduction JSNativeContextSpecialization::ReduceGlobalAccess(
       case PropertyCellType::kMutable: {
         // Record a code dependency on the cell, and just deoptimize if the
         // property ever becomes read-only.
-        dependencies()->AssumePropertyCell(property_cell);
+        dependencies()->DependOnGlobalProperty(property_cell);
         effect = graph()->NewNode(
             simplified()->StoreField(ForPropertyCellValue(
                 MachineRepresentation::kTagged, Type::NonInternal(),
@@ -722,46 +732,57 @@ Reduction JSNativeContextSpecialization::ReduceGlobalAccess(
 
 Reduction JSNativeContextSpecialization::ReduceJSLoadGlobal(Node* node) {
   DCHECK_EQ(IrOpcode::kJSLoadGlobal, node->opcode());
-  Handle<Name> name = LoadGlobalParametersOf(node->op()).name();
+  NameRef name(LoadGlobalParametersOf(node->op()).name());
   Node* effect = NodeProperties::GetEffectInput(node);
 
   // Try to lookup the name on the script context table first (lexical scoping).
-  ScriptContextTableLookupResult result;
-  if (LookupInScriptContextTable(name, &result)) {
-    if (result.context->is_the_hole(isolate(), result.index)) return NoChange();
-    Node* context = jsgraph()->HeapConstant(result.context);
+  base::Optional<ScriptContextTableRef::LookupResult> result =
+      native_context().script_context_table(js_heap_broker()).lookup(name);
+  if (result) {
+    ObjectRef contents = result->context.get(js_heap_broker(), result->index);
+    OddballType oddball_type = contents.oddball_type(js_heap_broker());
+    if (oddball_type == OddballType::kHole) {
+      return NoChange();
+    }
+    Node* context = jsgraph()->Constant(js_heap_broker(), result->context);
     Node* value = effect = graph()->NewNode(
-        javascript()->LoadContext(0, result.index, result.immutable), context,
+        javascript()->LoadContext(0, result->index, result->immutable), context,
         effect);
     ReplaceWithValue(node, value, effect);
     return Replace(value);
   }
 
   // Lookup the {name} on the global object instead.
-  return ReduceGlobalAccess(node, nullptr, nullptr, name, AccessMode::kLoad);
+  return ReduceGlobalAccess(node, nullptr, nullptr, name.object<Name>(),
+                            AccessMode::kLoad);
 }
 
 Reduction JSNativeContextSpecialization::ReduceJSStoreGlobal(Node* node) {
   DCHECK_EQ(IrOpcode::kJSStoreGlobal, node->opcode());
-  Handle<Name> name = StoreGlobalParametersOf(node->op()).name();
+  NameRef name(StoreGlobalParametersOf(node->op()).name());
   Node* value = NodeProperties::GetValueInput(node, 0);
   Node* effect = NodeProperties::GetEffectInput(node);
   Node* control = NodeProperties::GetControlInput(node);
 
   // Try to lookup the name on the script context table first (lexical scoping).
-  ScriptContextTableLookupResult result;
-  if (LookupInScriptContextTable(name, &result)) {
-    if (result.context->is_the_hole(isolate(), result.index)) return NoChange();
-    if (result.immutable) return NoChange();
-    Node* context = jsgraph()->HeapConstant(result.context);
-    effect = graph()->NewNode(javascript()->StoreContext(0, result.index),
+  base::Optional<ScriptContextTableRef::LookupResult> result =
+      native_context().script_context_table(js_heap_broker()).lookup(name);
+  if (result) {
+    ObjectRef contents = result->context.get(js_heap_broker(), result->index);
+    OddballType oddball_type = contents.oddball_type(js_heap_broker());
+    if (oddball_type == OddballType::kHole || result->immutable) {
+      return NoChange();
+    }
+    Node* context = jsgraph()->Constant(js_heap_broker(), result->context);
+    effect = graph()->NewNode(javascript()->StoreContext(0, result->index),
                               value, context, effect, control);
     ReplaceWithValue(node, value, effect, control);
     return Replace(value);
   }
 
   // Lookup the {name} on the global object instead.
-  return ReduceGlobalAccess(node, nullptr, value, name, AccessMode::kStore);
+  return ReduceGlobalAccess(node, nullptr, value, name.object<Name>(),
+                            AccessMode::kStore);
 }
 
 Reduction JSNativeContextSpecialization::ReduceNamedAccess(
@@ -788,7 +809,7 @@ Reduction JSNativeContextSpecialization::ReduceNamedAccess(
       // Detached global proxies have |null| as their constructor.
       if (maybe_constructor->IsJSFunction() &&
           JSFunction::cast(maybe_constructor)->native_context() ==
-              *native_context()) {
+              *native_context().object<Context>()) {
         return ReduceGlobalAccess(node, receiver, value, name, access_mode,
                                   index);
       }
@@ -796,7 +817,8 @@ Reduction JSNativeContextSpecialization::ReduceNamedAccess(
   }
 
   // Compute property access infos for the receiver maps.
-  AccessInfoFactory access_info_factory(dependencies(), native_context(),
+  AccessInfoFactory access_info_factory(dependencies(), js_heap_broker(),
+                                        native_context().object<Context>(),
                                         graph()->zone());
   ZoneVector<PropertyAccessInfo> access_infos(zone());
   if (!access_info_factory.ComputePropertyAccessInfos(
@@ -1074,8 +1096,7 @@ Reduction JSNativeContextSpecialization::ReduceJSLoadNamed(Node* node) {
         // {function} in order to be notified about changes to the
         // "prototype" of {function}.
         JSFunction::EnsureHasInitialMap(function);
-        Handle<Map> initial_map(function->initial_map(), isolate());
-        dependencies()->AssumeInitialMapCantChange(initial_map);
+        dependencies()->DependOnInitialMap(function);
         Handle<Object> prototype(function->prototype(), isolate());
         Node* value = jsgraph()->Constant(prototype);
         ReplaceWithValue(node, value);
@@ -1160,7 +1181,8 @@ Reduction JSNativeContextSpecialization::ReduceElementAccess(
   } else {
     // Retrieve the native context from the given {node}.
     // Compute element access infos for the receiver maps.
-    AccessInfoFactory access_info_factory(dependencies(), native_context(),
+    AccessInfoFactory access_info_factory(dependencies(), js_heap_broker(),
+                                          native_context().object<Context>(),
                                           graph()->zone());
     ZoneVector<ElementAccessInfo> access_infos(zone());
     if (!access_info_factory.ComputeElementAccessInfos(
@@ -1208,7 +1230,7 @@ Reduction JSNativeContextSpecialization::ReduceElementAccess(
 
       // Install dependencies on the relevant prototype maps.
       for (Handle<Map> prototype_map : prototype_maps) {
-        dependencies()->AssumeMapStable(prototype_map);
+        dependencies()->DependOnStableMap(prototype_map);
       }
     }
 
@@ -1735,25 +1757,24 @@ Node* JSNativeContextSpecialization::InlineApiCall(
   // Only setters have a value.
   int const argc = value == nullptr ? 0 : 1;
   // The stub always expects the receiver as the first param on the stack.
-  CallApiCallbackStub stub(isolate(), argc);
+  Callable call_api_callback = CodeFactory::CallApiCallback(isolate(), argc);
   CallInterfaceDescriptor call_interface_descriptor =
-      stub.GetCallInterfaceDescriptor();
+      call_api_callback.descriptor();
   auto call_descriptor = Linkage::GetStubCallDescriptor(
-      isolate(), graph()->zone(), call_interface_descriptor,
+      graph()->zone(), call_interface_descriptor,
       call_interface_descriptor.GetStackParameterCount() + argc +
           1 /* implicit receiver */,
-      CallDescriptor::kNeedsFrameState, Operator::kNoProperties,
-      MachineType::AnyTagged(), 1, Linkage::kNoContext);
+      CallDescriptor::kNeedsFrameState);
 
   Node* data = jsgraph()->Constant(call_data_object);
   ApiFunction function(v8::ToCData<Address>(call_handler_info->callback()));
   Node* function_reference =
-      graph()->NewNode(common()->ExternalConstant(ExternalReference(
-          &function, ExternalReference::DIRECT_API_CALL, isolate())));
-  Node* code = jsgraph()->HeapConstant(stub.GetCode());
+      graph()->NewNode(common()->ExternalConstant(ExternalReference::Create(
+          &function, ExternalReference::DIRECT_API_CALL)));
+  Node* code = jsgraph()->HeapConstant(call_api_callback.code());
 
   // Add CallApiCallbackStub's register argument as well.
-  Node* context = jsgraph()->Constant(native_context());
+  Node* context = jsgraph()->Constant(js_heap_broker(), native_context());
   Node* inputs[10] = {code,    context, data, holder, function_reference,
                       receiver};
   int index = 6 + argc;
@@ -1779,8 +1800,9 @@ JSNativeContextSpecialization::BuildPropertyLoad(
   Handle<JSObject> holder;
   PropertyAccessBuilder access_builder(jsgraph(), dependencies());
   if (access_info.holder().ToHandle(&holder)) {
-    access_builder.AssumePrototypesStable(native_context(),
-                                          access_info.receiver_maps(), holder);
+    dependencies()->DependOnStablePrototypeChains(
+        native_context().object<Context>(), access_info.receiver_maps(),
+        holder);
   }
 
   // Generate the actual property access.
@@ -1836,8 +1858,9 @@ JSNativeContextSpecialization::BuildPropertyStore(
   PropertyAccessBuilder access_builder(jsgraph(), dependencies());
   if (access_info.holder().ToHandle(&holder)) {
     DCHECK_NE(AccessMode::kStoreInLiteral, access_mode);
-    access_builder.AssumePrototypesStable(native_context(),
-                                          access_info.receiver_maps(), holder);
+    dependencies()->DependOnStablePrototypeChains(
+        native_context().object<Context>(), access_info.receiver_maps(),
+        holder);
   }
 
   DCHECK(!access_info.IsNotFound());
@@ -1858,7 +1881,7 @@ JSNativeContextSpecialization::BuildPropertyStore(
   } else {
     DCHECK(access_info.IsDataField() || access_info.IsDataConstantField());
     FieldIndex const field_index = access_info.field_index();
-    Type* const field_type = access_info.field_type();
+    Type const field_type = access_info.field_type();
     MachineRepresentation const field_representation =
         access_info.field_representation();
     Node* storage = receiver;
@@ -1890,7 +1913,7 @@ JSNativeContextSpecialization::BuildPropertyStore(
             !FLAG_unbox_double_fields) {
           if (access_info.HasTransitionMap()) {
             // Allocate a MutableHeapNumber for the new property.
-            AllocationBuilder a(jsgraph(), effect, control);
+            AllocationBuilder a(jsgraph(), js_heap_broker(), effect, control);
             a.Allocate(HeapNumber::kSize, NOT_TENURED, Type::OtherInternal());
             a.Store(AccessBuilder::ForMap(),
                     factory()->mutable_heap_number_map());
@@ -2053,13 +2076,15 @@ Reduction JSNativeContextSpecialization::ReduceJSStoreDataPropertyInLiteral(
   }
 
   Handle<Map> receiver_map(map, isolate());
-  if (!Map::TryUpdate(receiver_map).ToHandle(&receiver_map)) return NoChange();
+  if (!Map::TryUpdate(isolate(), receiver_map).ToHandle(&receiver_map))
+    return NoChange();
 
-  Handle<Name> cached_name =
-      handle(Name::cast(nexus.GetFeedbackExtra()), isolate());
+  Handle<Name> cached_name = handle(
+      Name::cast(nexus.GetFeedbackExtra()->ToStrongHeapObject()), isolate());
 
   PropertyAccessInfo access_info;
-  AccessInfoFactory access_info_factory(dependencies(), native_context(),
+  AccessInfoFactory access_info_factory(dependencies(), js_heap_broker(),
+                                        native_context().object<Context>(),
                                         graph()->zone());
   if (!access_info_factory.ComputePropertyAccessInfo(
           receiver_map, cached_name, AccessMode::kStoreInLiteral,
@@ -2233,7 +2258,7 @@ JSNativeContextSpecialization::BuildElementAccess(
     if (isolate()->IsArrayBufferNeuteringIntact()) {
       // Add a code dependency so we are deoptimized in case an ArrayBuffer
       // gets neutered.
-      dependencies()->AssumePropertyCell(
+      dependencies()->DependOnProtector(
           factory()->array_buffer_neutering_protector());
     } else {
       // Default to zero if the {receiver}s buffer was neutered.
@@ -2272,20 +2297,19 @@ JSNativeContextSpecialization::BuildElementAccess(
         if (load_mode == LOAD_IGNORE_OUT_OF_BOUNDS) {
           Node* check =
               graph()->NewNode(simplified()->NumberLessThan(), index, length);
-          Node* branch = graph()->NewNode(common()->Branch(BranchHint::kTrue),
-                                          check, control);
+          Node* branch = graph()->NewNode(
+              common()->Branch(BranchHint::kTrue,
+                               IsSafetyCheck::kCriticalSafetyCheck),
+              check, control);
 
           Node* if_true = graph()->NewNode(common()->IfTrue(), branch);
           Node* etrue = effect;
           Node* vtrue;
           {
-            Node* masked_index = graph()->NewNode(
-                simplified()->MaskIndexWithBound(), index, length);
-
             // Perform the actual load
             vtrue = etrue = graph()->NewNode(
                 simplified()->LoadTypedElement(external_array_type), buffer,
-                base_pointer, external_pointer, masked_index, etrue, if_true);
+                base_pointer, external_pointer, index, etrue, if_true);
           }
 
           Node* if_false = graph()->NewNode(common()->IfFalse(), branch);
@@ -2303,13 +2327,10 @@ JSNativeContextSpecialization::BuildElementAccess(
               graph()->NewNode(common()->Phi(MachineRepresentation::kTagged, 2),
                                vtrue, vfalse, control);
         } else {
-          Node* masked_index = graph()->NewNode(
-              simplified()->MaskIndexWithBound(), index, length);
-
           // Perform the actual load.
           value = effect = graph()->NewNode(
               simplified()->LoadTypedElement(external_array_type), buffer,
-              base_pointer, external_pointer, masked_index, effect, control);
+              base_pointer, external_pointer, index, effect, control);
         }
         break;
       }
@@ -2419,7 +2440,7 @@ JSNativeContextSpecialization::BuildElementAccess(
     }
 
     // Compute the element access.
-    Type* element_type = Type::NonInternal();
+    Type element_type = Type::NonInternal();
     MachineType element_machine_type = MachineType::AnyTagged();
     if (IsDoubleElementsKind(elements_kind)) {
       element_type = Type::Number();
@@ -2428,9 +2449,10 @@ JSNativeContextSpecialization::BuildElementAccess(
       element_type = Type::SignedSmall();
       element_machine_type = MachineType::TaggedSigned();
     }
-    ElementAccess element_access = {kTaggedBase, FixedArray::kHeaderSize,
-                                    element_type, element_machine_type,
-                                    kFullWriteBarrier};
+    ElementAccess element_access = {
+        kTaggedBase,       FixedArray::kHeaderSize,
+        element_type,      element_machine_type,
+        kFullWriteBarrier, LoadSensitivity::kCritical};
 
     // Access the actual element.
     if (access_mode == AccessMode::kLoad) {
@@ -2450,20 +2472,19 @@ JSNativeContextSpecialization::BuildElementAccess(
           CanTreatHoleAsUndefined(receiver_maps)) {
         Node* check =
             graph()->NewNode(simplified()->NumberLessThan(), index, length);
-        Node* branch = graph()->NewNode(common()->Branch(BranchHint::kTrue),
-                                        check, control);
+        Node* branch = graph()->NewNode(
+            common()->Branch(BranchHint::kTrue,
+                             IsSafetyCheck::kCriticalSafetyCheck),
+            check, control);
 
         Node* if_true = graph()->NewNode(common()->IfTrue(), branch);
         Node* etrue = effect;
         Node* vtrue;
         {
-          Node* masked_index = graph()->NewNode(
-              simplified()->MaskIndexWithBound(), index, length);
-
           // Perform the actual load
           vtrue = etrue =
               graph()->NewNode(simplified()->LoadElement(element_access),
-                               elements, masked_index, etrue, if_true);
+                               elements, index, etrue, if_true);
 
           // Handle loading from holey backing stores correctly, by either
           // mapping the hole to undefined if possible, or deoptimizing
@@ -2498,13 +2519,10 @@ JSNativeContextSpecialization::BuildElementAccess(
             graph()->NewNode(common()->Phi(MachineRepresentation::kTagged, 2),
                              vtrue, vfalse, control);
       } else {
-        Node* masked_index =
-            graph()->NewNode(simplified()->MaskIndexWithBound(), index, length);
-
         // Perform the actual load.
         value = effect =
             graph()->NewNode(simplified()->LoadElement(element_access),
-                             elements, masked_index, effect, control);
+                             elements, index, effect, control);
 
         // Handle loading from holey backing stores correctly, by either mapping
         // the hole to undefined if possible, or deoptimizing otherwise.
@@ -2643,8 +2661,7 @@ Node* JSNativeContextSpecialization::BuildIndexedStringLoad(
     KeyedAccessLoadMode load_mode) {
   if (load_mode == LOAD_IGNORE_OUT_OF_BOUNDS &&
       isolate()->IsNoElementsProtectorIntact()) {
-    // Add a code dependency on the "no elements" protector.
-    dependencies()->AssumePropertyCell(factory()->no_elements_protector());
+    dependencies()->DependOnProtector(factory()->no_elements_protector());
 
     // Ensure that the {index} is a valid String length.
     index = *effect = graph()->NewNode(
@@ -2656,10 +2673,11 @@ Node* JSNativeContextSpecialization::BuildIndexedStringLoad(
     Node* check =
         graph()->NewNode(simplified()->NumberLessThan(), index, length);
     Node* branch =
-        graph()->NewNode(common()->Branch(BranchHint::kTrue), check, *control);
+        graph()->NewNode(common()->Branch(BranchHint::kTrue,
+                                          IsSafetyCheck::kCriticalSafetyCheck),
+                         check, *control);
 
-    Node* masked_index =
-        graph()->NewNode(simplified()->MaskIndexWithBound(), index, length);
+    Node* masked_index = graph()->NewNode(simplified()->PoisonIndex(), index);
 
     Node* if_true = graph()->NewNode(common()->IfTrue(), branch);
     Node* etrue;
@@ -2682,8 +2700,7 @@ Node* JSNativeContextSpecialization::BuildIndexedStringLoad(
         graph()->NewNode(simplified()->CheckBounds(VectorSlotPair()), index,
                          length, *effect, *control);
 
-    Node* masked_index =
-        graph()->NewNode(simplified()->MaskIndexWithBound(), index, length);
+    Node* masked_index = graph()->NewNode(simplified()->PoisonIndex(), index);
 
     // Return the character from the {receiver} as single character string.
     Node* value = *effect =
@@ -2751,7 +2768,7 @@ Node* JSNativeContextSpecialization::BuildExtendPropertiesBackingStore(
                        new_length_and_hash, effect, control);
 
   // Allocate and initialize the new properties.
-  AllocationBuilder a(jsgraph(), effect, control);
+  AllocationBuilder a(jsgraph(), js_heap_broker(), effect, control);
   a.Allocate(PropertyArray::SizeFor(new_length), NOT_TENURED,
              Type::OtherInternal());
   a.Store(AccessBuilder::ForMap(), jsgraph()->PropertyArrayMapConstant());
@@ -2793,8 +2810,7 @@ bool JSNativeContextSpecialization::CanTreatHoleAsUndefined(
   // Check if the array prototype chain is intact.
   if (!isolate()->IsNoElementsProtectorIntact()) return false;
 
-  // Install code dependency on the array protector cell.
-  dependencies()->AssumePropertyCell(factory()->no_elements_protector());
+  dependencies()->DependOnProtector(factory()->no_elements_protector());
   return true;
 }
 
@@ -2823,11 +2839,12 @@ bool JSNativeContextSpecialization::ExtractReceiverMaps(
     Handle<Map> receiver_map;
     if (InferReceiverRootMap(receiver).ToHandle(&receiver_map)) {
       DCHECK(!receiver_map->is_abandoned_prototype_map());
+      Isolate* isolate = this->isolate();
       receiver_maps->erase(
           std::remove_if(receiver_maps->begin(), receiver_maps->end(),
-                         [receiver_map](const Handle<Map>& map) {
+                         [receiver_map, isolate](const Handle<Map>& map) {
                            return map->is_abandoned_prototype_map() ||
-                                  map->FindRootMap() != *receiver_map;
+                                  map->FindRootMap(isolate) != *receiver_map;
                          }),
           receiver_maps->end());
     }
@@ -2841,7 +2858,7 @@ bool JSNativeContextSpecialization::InferReceiverMaps(
     Node* receiver, Node* effect, MapHandles* receiver_maps) {
   ZoneHandleSet<Map> maps;
   NodeProperties::InferReceiverMapsResult result =
-      NodeProperties::InferReceiverMaps(receiver, effect, &maps);
+      NodeProperties::InferReceiverMaps(isolate(), receiver, effect, &maps);
   if (result == NodeProperties::kReliableReceiverMaps) {
     for (size_t i = 0; i < maps.size(); ++i) {
       receiver_maps->push_back(maps[i]);
@@ -2865,7 +2882,7 @@ MaybeHandle<Map> JSNativeContextSpecialization::InferReceiverRootMap(
     Node* receiver) {
   HeapObjectMatcher m(receiver);
   if (m.HasValue()) {
-    return handle(m.Value()->map()->FindRootMap(), isolate());
+    return handle(m.Value()->map()->FindRootMap(isolate()), isolate());
   } else if (m.IsJSCreate()) {
     HeapObjectMatcher mtarget(m.InputAt(0));
     HeapObjectMatcher mnewtarget(m.InputAt(1));
@@ -2875,7 +2892,7 @@ MaybeHandle<Map> JSNativeContextSpecialization::InferReceiverRootMap(
       if (constructor->has_initial_map()) {
         Handle<Map> initial_map(constructor->initial_map(), isolate());
         if (initial_map->constructor_or_backpointer() == *mnewtarget.Value()) {
-          DCHECK_EQ(*initial_map, initial_map->FindRootMap());
+          DCHECK_EQ(*initial_map, initial_map->FindRootMap(isolate()));
           return initial_map;
         }
       }
@@ -2884,24 +2901,6 @@ MaybeHandle<Map> JSNativeContextSpecialization::InferReceiverRootMap(
   return MaybeHandle<Map>();
 }
 
-bool JSNativeContextSpecialization::LookupInScriptContextTable(
-    Handle<Name> name, ScriptContextTableLookupResult* result) {
-  if (!name->IsString()) return false;
-  Handle<ScriptContextTable> script_context_table(
-      global_object()->native_context()->script_context_table(), isolate());
-  ScriptContextTable::LookupResult lookup_result;
-  if (!ScriptContextTable::Lookup(script_context_table,
-                                  Handle<String>::cast(name), &lookup_result)) {
-    return false;
-  }
-  Handle<Context> script_context = ScriptContextTable::GetContext(
-      script_context_table, lookup_result.context_index);
-  result->context = script_context;
-  result->immutable = lookup_result.mode == CONST;
-  result->index = lookup_result.slot_index;
-  return true;
-}
-
 Graph* JSNativeContextSpecialization::graph() const {
   return jsgraph()->graph();
 }
diff --git a/deps/v8/src/compiler/js-native-context-specialization.h b/deps/v8/src/compiler/js-native-context-specialization.h
index 5f357a29246db0..53fe9e2c11cc20 100644
--- a/deps/v8/src/compiler/js-native-context-specialization.h
+++ b/deps/v8/src/compiler/js-native-context-specialization.h
@@ -14,7 +14,6 @@ namespace v8 {
 namespace internal {
 
 // Forward declarations.
-class CompilationDependencies;
 class Factory;
 class FeedbackNexus;
 
@@ -23,8 +22,10 @@ namespace compiler {
 // Forward declarations.
 enum class AccessMode;
 class CommonOperatorBuilder;
+class CompilationDependencies;
 class ElementAccessInfo;
 class JSGraph;
+class JSHeapBroker;
 class JSOperatorBuilder;
 class MachineOperatorBuilder;
 class PropertyAccessInfo;
@@ -45,7 +46,8 @@ class JSNativeContextSpecialization final : public AdvancedReducer {
   };
   typedef base::Flags<Flag> Flags;
 
-  JSNativeContextSpecialization(Editor* editor, JSGraph* jsgraph, Flags flags,
+  JSNativeContextSpecialization(Editor* editor, JSGraph* jsgraph,
+                                const JSHeapBroker* js_heap_broker, Flags flags,
                                 Handle<Context> native_context,
                                 CompilationDependencies* dependencies,
                                 Zone* zone);
@@ -214,6 +216,8 @@ class JSNativeContextSpecialization final : public AdvancedReducer {
 
   Graph* graph() const;
   JSGraph* jsgraph() const { return jsgraph_; }
+
+  const JSHeapBroker* js_heap_broker() const { return js_heap_broker_; }
   Isolate* isolate() const;
   Factory* factory() const;
   CommonOperatorBuilder* common() const;
@@ -222,15 +226,16 @@ class JSNativeContextSpecialization final : public AdvancedReducer {
   Flags flags() const { return flags_; }
   Handle<JSGlobalObject> global_object() const { return global_object_; }
   Handle<JSGlobalProxy> global_proxy() const { return global_proxy_; }
-  Handle<Context> native_context() const { return native_context_; }
+  const NativeContextRef& native_context() const { return native_context_; }
   CompilationDependencies* dependencies() const { return dependencies_; }
   Zone* zone() const { return zone_; }
 
   JSGraph* const jsgraph_;
+  const JSHeapBroker* const js_heap_broker_;
   Flags const flags_;
   Handle<JSGlobalObject> global_object_;
   Handle<JSGlobalProxy> global_proxy_;
-  Handle<Context> native_context_;
+  NativeContextRef native_context_;
   CompilationDependencies* const dependencies_;
   Zone* const zone_;
   TypeCache const& type_cache_;
diff --git a/deps/v8/src/compiler/js-operator.cc b/deps/v8/src/compiler/js-operator.cc
index 515951706319ed..5d45bb7f954e85 100644
--- a/deps/v8/src/compiler/js-operator.cc
+++ b/deps/v8/src/compiler/js-operator.cc
@@ -152,45 +152,16 @@ ContextAccess const& ContextAccessOf(Operator const* op) {
   return OpParameter<ContextAccess>(op);
 }
 
-CreateCatchContextParameters::CreateCatchContextParameters(
-    Handle<String> catch_name, Handle<ScopeInfo> scope_info)
-    : catch_name_(catch_name), scope_info_(scope_info) {}
-
-bool operator==(CreateCatchContextParameters const& lhs,
-                CreateCatchContextParameters const& rhs) {
-  return lhs.catch_name().location() == rhs.catch_name().location() &&
-         lhs.scope_info().location() == rhs.scope_info().location();
-}
-
-bool operator!=(CreateCatchContextParameters const& lhs,
-                CreateCatchContextParameters const& rhs) {
-  return !(lhs == rhs);
-}
-
-size_t hash_value(CreateCatchContextParameters const& parameters) {
-  return base::hash_combine(parameters.catch_name().location(),
-                            parameters.scope_info().location());
-}
-
-std::ostream& operator<<(std::ostream& os,
-                         CreateCatchContextParameters const& parameters) {
-  return os << Brief(*parameters.catch_name()) << ", "
-            << Brief(*parameters.scope_info());
-}
-
-CreateCatchContextParameters const& CreateCatchContextParametersOf(
-    Operator const* op) {
-  DCHECK_EQ(IrOpcode::kJSCreateCatchContext, op->opcode());
-  return OpParameter<CreateCatchContextParameters>(op);
-}
-
 CreateFunctionContextParameters::CreateFunctionContextParameters(
-    int slot_count, ScopeType scope_type)
-    : slot_count_(slot_count), scope_type_(scope_type) {}
+    Handle<ScopeInfo> scope_info, int slot_count, ScopeType scope_type)
+    : scope_info_(scope_info),
+      slot_count_(slot_count),
+      scope_type_(scope_type) {}
 
 bool operator==(CreateFunctionContextParameters const& lhs,
                 CreateFunctionContextParameters const& rhs) {
-  return lhs.slot_count() == rhs.slot_count() &&
+  return lhs.scope_info().location() == rhs.scope_info().location() &&
+         lhs.slot_count() == rhs.slot_count() &&
          lhs.scope_type() == rhs.scope_type();
 }
 
@@ -200,7 +171,8 @@ bool operator!=(CreateFunctionContextParameters const& lhs,
 }
 
 size_t hash_value(CreateFunctionContextParameters const& parameters) {
-  return base::hash_combine(parameters.slot_count(),
+  return base::hash_combine(parameters.scope_info().location(),
+                            parameters.slot_count(),
                             static_cast<int>(parameters.scope_type()));
 }
 
@@ -626,6 +598,8 @@ CompareOperationHint CompareOperationHintOf(const Operator* op) {
   V(CreateKeyValueArray, Operator::kEliminatable, 2, 1)                \
   V(CreatePromise, Operator::kEliminatable, 0, 1)                      \
   V(CreateTypedArray, Operator::kNoProperties, 5, 1)                   \
+  V(CreateObject, Operator::kNoWrite, 1, 1)                            \
+  V(ObjectIsArray, Operator::kNoProperties, 1, 1)                      \
   V(HasProperty, Operator::kNoProperties, 2, 1)                        \
   V(HasInPrototypeChain, Operator::kNoProperties, 2, 1)                \
   V(OrdinaryHasInstance, Operator::kNoProperties, 2, 1)                \
@@ -642,7 +616,9 @@ CompareOperationHint CompareOperationHintOf(const Operator* op) {
   V(PromiseResolve, Operator::kNoProperties, 2, 1)                     \
   V(RejectPromise, Operator::kNoDeopt | Operator::kNoThrow, 3, 1)      \
   V(ResolvePromise, Operator::kNoDeopt | Operator::kNoThrow, 2, 1)     \
-  V(GetSuperConstructor, Operator::kNoWrite, 1, 1)
+  V(GetSuperConstructor, Operator::kNoWrite, 1, 1)                     \
+  V(ParseInt, Operator::kNoProperties, 2, 1)                           \
+  V(RegExpTest, Operator::kNoProperties, 2, 1)
 
 #define BINARY_OP_LIST(V) V(Add)
 
@@ -975,7 +951,7 @@ const Operator* JSOperatorBuilder::GeneratorStore(int register_count) {
       register_count);                                  // parameter
 }
 
-int GeneratorStoreRegisterCountOf(const Operator* op) {
+int GeneratorStoreValueCountOf(const Operator* op) {
   DCHECK_EQ(IrOpcode::kJSGeneratorStore, op->opcode());
   return OpParameter<int>(op);
 }
@@ -1166,10 +1142,10 @@ const Operator* JSOperatorBuilder::CreateClosure(
 }
 
 const Operator* JSOperatorBuilder::CreateLiteralArray(
-    Handle<ConstantElementsPair> constant_elements,
+    Handle<ArrayBoilerplateDescription> description,
     VectorSlotPair const& feedback, int literal_flags, int number_of_elements) {
-  CreateLiteralParameters parameters(constant_elements, feedback,
-                                     number_of_elements, literal_flags);
+  CreateLiteralParameters parameters(description, feedback, number_of_elements,
+                                     literal_flags);
   return new (zone()) Operator1<CreateLiteralParameters>(  // --
       IrOpcode::kJSCreateLiteralArray,                     // opcode
       Operator::kNoProperties,                             // properties
@@ -1190,7 +1166,7 @@ const Operator* JSOperatorBuilder::CreateEmptyLiteralArray(
 }
 
 const Operator* JSOperatorBuilder::CreateLiteralObject(
-    Handle<BoilerplateDescription> constant_properties,
+    Handle<ObjectBoilerplateDescription> constant_properties,
     VectorSlotPair const& feedback, int literal_flags,
     int number_of_properties) {
   CreateLiteralParameters parameters(constant_properties, feedback,
@@ -1224,24 +1200,24 @@ const Operator* JSOperatorBuilder::CreateLiteralRegExp(
       parameters);                                         // parameter
 }
 
-const Operator* JSOperatorBuilder::CreateFunctionContext(int slot_count,
-                                                         ScopeType scope_type) {
-  CreateFunctionContextParameters parameters(slot_count, scope_type);
+const Operator* JSOperatorBuilder::CreateFunctionContext(
+    Handle<ScopeInfo> scope_info, int slot_count, ScopeType scope_type) {
+  CreateFunctionContextParameters parameters(scope_info, slot_count,
+                                             scope_type);
   return new (zone()) Operator1<CreateFunctionContextParameters>(   // --
       IrOpcode::kJSCreateFunctionContext, Operator::kNoProperties,  // opcode
       "JSCreateFunctionContext",                                    // name
-      1, 1, 1, 1, 1, 2,                                             // counts
+      0, 1, 1, 1, 1, 2,                                             // counts
       parameters);                                                  // parameter
 }
 
 const Operator* JSOperatorBuilder::CreateCatchContext(
-    const Handle<String>& name, const Handle<ScopeInfo>& scope_info) {
-  CreateCatchContextParameters parameters(name, scope_info);
-  return new (zone()) Operator1<CreateCatchContextParameters>(
+    const Handle<ScopeInfo>& scope_info) {
+  return new (zone()) Operator1<Handle<ScopeInfo>>(
       IrOpcode::kJSCreateCatchContext, Operator::kNoProperties,  // opcode
       "JSCreateCatchContext",                                    // name
-      2, 1, 1, 1, 1, 2,                                          // counts
-      parameters);                                               // parameter
+      1, 1, 1, 1, 1, 2,                                          // counts
+      scope_info);                                               // parameter
 }
 
 const Operator* JSOperatorBuilder::CreateWithContext(
@@ -1249,7 +1225,7 @@ const Operator* JSOperatorBuilder::CreateWithContext(
   return new (zone()) Operator1<Handle<ScopeInfo>>(
       IrOpcode::kJSCreateWithContext, Operator::kNoProperties,  // opcode
       "JSCreateWithContext",                                    // name
-      2, 1, 1, 1, 1, 2,                                         // counts
+      1, 1, 1, 1, 1, 2,                                         // counts
       scope_info);                                              // parameter
 }
 
@@ -1258,13 +1234,14 @@ const Operator* JSOperatorBuilder::CreateBlockContext(
   return new (zone()) Operator1<Handle<ScopeInfo>>(              // --
       IrOpcode::kJSCreateBlockContext, Operator::kNoProperties,  // opcode
       "JSCreateBlockContext",                                    // name
-      1, 1, 1, 1, 1, 2,                                          // counts
+      0, 1, 1, 1, 1, 2,                                          // counts
       scope_info);                                               // parameter
 }
 
 Handle<ScopeInfo> ScopeInfoOf(const Operator* op) {
   DCHECK(IrOpcode::kJSCreateBlockContext == op->opcode() ||
-         IrOpcode::kJSCreateWithContext == op->opcode());
+         IrOpcode::kJSCreateWithContext == op->opcode() ||
+         IrOpcode::kJSCreateCatchContext == op->opcode());
   return OpParameter<Handle<ScopeInfo>>(op);
 }
 
diff --git a/deps/v8/src/compiler/js-operator.h b/deps/v8/src/compiler/js-operator.h
index 98e67a087ccbee..f73aca819f59b8 100644
--- a/deps/v8/src/compiler/js-operator.h
+++ b/deps/v8/src/compiler/js-operator.h
@@ -16,8 +16,8 @@ namespace v8 {
 namespace internal {
 
 class AllocationSite;
-class BoilerplateDescription;
-class ConstantElementsPair;
+class ObjectBoilerplateDescription;
+class ArrayBoilerplateDescription;
 class FeedbackCell;
 class SharedFunctionInfo;
 
@@ -262,44 +262,19 @@ V8_EXPORT_PRIVATE std::ostream& operator<<(std::ostream&, ContextAccess const&);
 
 V8_EXPORT_PRIVATE ContextAccess const& ContextAccessOf(Operator const*);
 
-// Defines the name and ScopeInfo for a new catch context. This is used as a
-// parameter by the JSCreateCatchContext operator.
-class CreateCatchContextParameters final {
- public:
-  CreateCatchContextParameters(Handle<String> catch_name,
-                               Handle<ScopeInfo> scope_info);
-
-  Handle<String> catch_name() const { return catch_name_; }
-  Handle<ScopeInfo> scope_info() const { return scope_info_; }
-
- private:
-  Handle<String> const catch_name_;
-  Handle<ScopeInfo> const scope_info_;
-};
-
-bool operator==(CreateCatchContextParameters const& lhs,
-                CreateCatchContextParameters const& rhs);
-bool operator!=(CreateCatchContextParameters const& lhs,
-                CreateCatchContextParameters const& rhs);
-
-size_t hash_value(CreateCatchContextParameters const& parameters);
-
-std::ostream& operator<<(std::ostream& os,
-                         CreateCatchContextParameters const& parameters);
-
-CreateCatchContextParameters const& CreateCatchContextParametersOf(
-    Operator const*);
-
 // Defines the slot count and ScopeType for a new function or eval context. This
 // is used as a parameter by the JSCreateFunctionContext operator.
 class CreateFunctionContextParameters final {
  public:
-  CreateFunctionContextParameters(int slot_count, ScopeType scope_type);
+  CreateFunctionContextParameters(Handle<ScopeInfo> scope_info, int slot_count,
+                                  ScopeType scope_type);
 
+  Handle<ScopeInfo> scope_info() const { return scope_info_; }
   int slot_count() const { return slot_count_; }
   ScopeType scope_type() const { return scope_type_; }
 
  private:
+  Handle<ScopeInfo> scope_info_;
   int const slot_count_;
   ScopeType const scope_type_;
 };
@@ -668,7 +643,7 @@ BinaryOperationHint BinaryOperationHintOf(const Operator* op);
 
 CompareOperationHint CompareOperationHintOf(const Operator* op);
 
-int GeneratorStoreRegisterCountOf(const Operator* op) V8_WARN_UNUSED_RESULT;
+int GeneratorStoreValueCountOf(const Operator* op) V8_WARN_UNUSED_RESULT;
 int RestoreRegisterIndexOf(const Operator* op) V8_WARN_UNUSED_RESULT;
 
 Handle<ScopeInfo> ScopeInfoOf(const Operator* op) V8_WARN_UNUSED_RESULT;
@@ -727,18 +702,20 @@ class V8_EXPORT_PRIVATE JSOperatorBuilder final
   const Operator* CreateIterResultObject();
   const Operator* CreateStringIterator();
   const Operator* CreateKeyValueArray();
+  const Operator* CreateObject();
   const Operator* CreatePromise();
   const Operator* CreateTypedArray();
-  const Operator* CreateLiteralArray(Handle<ConstantElementsPair> constant,
-                                     VectorSlotPair const& feedback,
-                                     int literal_flags, int number_of_elements);
+  const Operator* CreateLiteralArray(
+      Handle<ArrayBoilerplateDescription> constant,
+      VectorSlotPair const& feedback, int literal_flags,
+      int number_of_elements);
   const Operator* CreateEmptyLiteralArray(VectorSlotPair const& feedback);
   const Operator* CreateEmptyLiteralObject();
 
-  const Operator* CreateLiteralObject(Handle<BoilerplateDescription> constant,
-                                      VectorSlotPair const& feedback,
-                                      int literal_flags,
-                                      int number_of_properties);
+  const Operator* CreateLiteralObject(
+      Handle<ObjectBoilerplateDescription> constant,
+      VectorSlotPair const& feedback, int literal_flags,
+      int number_of_properties);
   const Operator* CreateLiteralRegExp(Handle<String> constant_pattern,
                                       VectorSlotPair const& feedback,
                                       int literal_flags);
@@ -813,7 +790,7 @@ class V8_EXPORT_PRIVATE JSOperatorBuilder final
   const Operator* StoreMessage();
 
   // Used to implement Ignition's SuspendGenerator bytecode.
-  const Operator* GeneratorStore(int register_count);
+  const Operator* GeneratorStore(int value_count);
 
   // Used to implement Ignition's SwitchOnGeneratorState bytecode.
   const Operator* GeneratorRestoreContinuation();
@@ -832,12 +809,16 @@ class V8_EXPORT_PRIVATE JSOperatorBuilder final
   const Operator* RejectPromise();
   const Operator* ResolvePromise();
 
-  const Operator* CreateFunctionContext(int slot_count, ScopeType scope_type);
-  const Operator* CreateCatchContext(const Handle<String>& name,
-                                     const Handle<ScopeInfo>& scope_info);
+  const Operator* CreateFunctionContext(Handle<ScopeInfo> scope_info,
+                                        int slot_count, ScopeType scope_type);
+  const Operator* CreateCatchContext(const Handle<ScopeInfo>& scope_info);
   const Operator* CreateWithContext(const Handle<ScopeInfo>& scope_info);
   const Operator* CreateBlockContext(const Handle<ScopeInfo>& scpope_info);
 
+  const Operator* ObjectIsArray();
+  const Operator* ParseInt();
+  const Operator* RegExpTest();
+
  private:
   Zone* zone() const { return zone_; }
 
diff --git a/deps/v8/src/compiler/js-type-hint-lowering.cc b/deps/v8/src/compiler/js-type-hint-lowering.cc
index d97e1dcbc75c8d..fc7fab4b54b0b2 100644
--- a/deps/v8/src/compiler/js-type-hint-lowering.cc
+++ b/deps/v8/src/compiler/js-type-hint-lowering.cc
@@ -189,6 +189,7 @@ class JSSpeculativeBinopBuilder final {
   }
 
   JSGraph* jsgraph() const { return lowering_->jsgraph(); }
+  Isolate* isolate() const { return jsgraph()->isolate(); }
   Graph* graph() const { return jsgraph()->graph(); }
   JSOperatorBuilder* javascript() { return jsgraph()->javascript(); }
   SimplifiedOperatorBuilder* simplified() { return jsgraph()->simplified(); }
@@ -212,6 +213,8 @@ JSTypeHintLowering::JSTypeHintLowering(JSGraph* jsgraph,
                                        Flags flags)
     : jsgraph_(jsgraph), flags_(flags), feedback_vector_(feedback_vector) {}
 
+Isolate* JSTypeHintLowering::isolate() const { return jsgraph()->isolate(); }
+
 JSTypeHintLowering::LoweringResult JSTypeHintLowering::ReduceUnaryOperation(
     const Operator* op, Node* operand, Node* effect, Node* control,
     FeedbackSlot slot) const {
diff --git a/deps/v8/src/compiler/js-type-hint-lowering.h b/deps/v8/src/compiler/js-type-hint-lowering.h
index 90686e524860f7..5b6da84bcf3a2f 100644
--- a/deps/v8/src/compiler/js-type-hint-lowering.h
+++ b/deps/v8/src/compiler/js-type-hint-lowering.h
@@ -157,6 +157,7 @@ class JSTypeHintLowering {
                           DeoptimizeReason reson) const;
 
   JSGraph* jsgraph() const { return jsgraph_; }
+  Isolate* isolate() const;
   Flags flags() const { return flags_; }
   const Handle<FeedbackVector>& feedback_vector() const {
     return feedback_vector_;
diff --git a/deps/v8/src/compiler/js-typed-lowering.cc b/deps/v8/src/compiler/js-typed-lowering.cc
index 98e18bc5908345..9f957b7b82864f 100644
--- a/deps/v8/src/compiler/js-typed-lowering.cc
+++ b/deps/v8/src/compiler/js-typed-lowering.cc
@@ -17,6 +17,7 @@
 #include "src/compiler/type-cache.h"
 #include "src/compiler/types.h"
 #include "src/objects-inl.h"
+#include "src/objects/module-inl.h"
 
 namespace v8 {
 namespace internal {
@@ -123,10 +124,10 @@ class JSBinopReduction final {
   // statically that one side is already a Receiver, insert a
   // CheckReceiver node.
   void CheckInputsToReceiver() {
-    if (!left_type()->Is(Type::Receiver())) {
+    if (!left_type().Is(Type::Receiver())) {
       CheckLeftInputToReceiver();
     }
-    if (!right_type()->Is(Type::Receiver())) {
+    if (!right_type().Is(Type::Receiver())) {
       Node* right_input = graph()->NewNode(simplified()->CheckReceiver(),
                                            right(), effect(), control());
       node_->ReplaceInput(1, right_input);
@@ -138,13 +139,13 @@ class JSBinopReduction final {
   // statically that one side is already a Symbol, insert a
   // CheckSymbol node.
   void CheckInputsToSymbol() {
-    if (!left_type()->Is(Type::Symbol())) {
+    if (!left_type().Is(Type::Symbol())) {
       Node* left_input = graph()->NewNode(simplified()->CheckSymbol(), left(),
                                           effect(), control());
       node_->ReplaceInput(0, left_input);
       update_effect(left_input);
     }
-    if (!right_type()->Is(Type::Symbol())) {
+    if (!right_type().Is(Type::Symbol())) {
       Node* right_input = graph()->NewNode(simplified()->CheckSymbol(), right(),
                                            effect(), control());
       node_->ReplaceInput(1, right_input);
@@ -156,14 +157,14 @@ class JSBinopReduction final {
   // statically that one side is already a String, insert a
   // CheckString node.
   void CheckInputsToString() {
-    if (!left_type()->Is(Type::String())) {
+    if (!left_type().Is(Type::String())) {
       Node* left_input =
           graph()->NewNode(simplified()->CheckString(VectorSlotPair()), left(),
                            effect(), control());
       node_->ReplaceInput(0, left_input);
       update_effect(left_input);
     }
-    if (!right_type()->Is(Type::String())) {
+    if (!right_type().Is(Type::String())) {
       Node* right_input =
           graph()->NewNode(simplified()->CheckString(VectorSlotPair()), right(),
                            effect(), control());
@@ -176,13 +177,13 @@ class JSBinopReduction final {
   // statically that one side is already an InternalizedString, insert a
   // CheckInternalizedString node.
   void CheckInputsToInternalizedString() {
-    if (!left_type()->Is(Type::UniqueName())) {
+    if (!left_type().Is(Type::UniqueName())) {
       Node* left_input = graph()->NewNode(
           simplified()->CheckInternalizedString(), left(), effect(), control());
       node_->ReplaceInput(0, left_input);
       update_effect(left_input);
     }
-    if (!right_type()->Is(Type::UniqueName())) {
+    if (!right_type().Is(Type::UniqueName())) {
       Node* right_input =
           graph()->NewNode(simplified()->CheckInternalizedString(), right(),
                            effect(), control());
@@ -192,8 +193,8 @@ class JSBinopReduction final {
   }
 
   void ConvertInputsToNumber() {
-    DCHECK(left_type()->Is(Type::PlainPrimitive()));
-    DCHECK(right_type()->Is(Type::PlainPrimitive()));
+    DCHECK(left_type().Is(Type::PlainPrimitive()));
+    DCHECK(right_type().Is(Type::PlainPrimitive()));
     node_->ReplaceInput(0, ConvertPlainPrimitiveToNumber(left()));
     node_->ReplaceInput(1, ConvertPlainPrimitiveToNumber(right()));
   }
@@ -213,7 +214,7 @@ class JSBinopReduction final {
 
   // Remove all effect and control inputs and outputs to this node and change
   // to the pure operator {op}.
-  Reduction ChangeToPureOperator(const Operator* op, Type* type = Type::Any()) {
+  Reduction ChangeToPureOperator(const Operator* op, Type type = Type::Any()) {
     DCHECK_EQ(0, op->EffectInputCount());
     DCHECK_EQ(false, OperatorProperties::HasContextInput(op));
     DCHECK_EQ(0, op->ControlInputCount());
@@ -230,13 +231,13 @@ class JSBinopReduction final {
 
     // TODO(jarin): Replace the explicit typing hack with a call to some method
     // that encapsulates changing the operator and re-typing.
-    Type* node_type = NodeProperties::GetType(node_);
+    Type node_type = NodeProperties::GetType(node_);
     NodeProperties::SetType(node_, Type::Intersect(node_type, type, zone()));
 
     return lowering_->Changed(node_);
   }
 
-  Reduction ChangeToSpeculativeOperator(const Operator* op, Type* upper_bound) {
+  Reduction ChangeToSpeculativeOperator(const Operator* op, Type upper_bound) {
     DCHECK_EQ(1, op->EffectInputCount());
     DCHECK_EQ(1, op->EffectOutputCount());
     DCHECK_EQ(false, OperatorProperties::HasContextInput(op));
@@ -263,7 +264,7 @@ class JSBinopReduction final {
     NodeProperties::ChangeOp(node_, op);
 
     // Update the type to number.
-    Type* node_type = NodeProperties::GetType(node_);
+    Type node_type = NodeProperties::GetType(node_);
     NodeProperties::SetType(node_,
                             Type::Intersect(node_type, upper_bound, zone()));
 
@@ -327,24 +328,24 @@ class JSBinopReduction final {
     UNREACHABLE();
   }
 
-  bool LeftInputIs(Type* t) { return left_type()->Is(t); }
+  bool LeftInputIs(Type t) { return left_type().Is(t); }
 
-  bool RightInputIs(Type* t) { return right_type()->Is(t); }
+  bool RightInputIs(Type t) { return right_type().Is(t); }
 
-  bool OneInputIs(Type* t) { return LeftInputIs(t) || RightInputIs(t); }
+  bool OneInputIs(Type t) { return LeftInputIs(t) || RightInputIs(t); }
 
-  bool BothInputsAre(Type* t) { return LeftInputIs(t) && RightInputIs(t); }
+  bool BothInputsAre(Type t) { return LeftInputIs(t) && RightInputIs(t); }
 
-  bool BothInputsMaybe(Type* t) {
-    return left_type()->Maybe(t) && right_type()->Maybe(t);
+  bool BothInputsMaybe(Type t) {
+    return left_type().Maybe(t) && right_type().Maybe(t);
   }
 
-  bool OneInputCannotBe(Type* t) {
-    return !left_type()->Maybe(t) || !right_type()->Maybe(t);
+  bool OneInputCannotBe(Type t) {
+    return !left_type().Maybe(t) || !right_type().Maybe(t);
   }
 
-  bool NeitherInputCanBe(Type* t) {
-    return !left_type()->Maybe(t) && !right_type()->Maybe(t);
+  bool NeitherInputCanBe(Type t) {
+    return !left_type().Maybe(t) && !right_type().Maybe(t);
   }
 
   Node* effect() { return NodeProperties::GetEffectInput(node_); }
@@ -352,13 +353,14 @@ class JSBinopReduction final {
   Node* context() { return NodeProperties::GetContextInput(node_); }
   Node* left() { return NodeProperties::GetValueInput(node_, 0); }
   Node* right() { return NodeProperties::GetValueInput(node_, 1); }
-  Type* left_type() { return NodeProperties::GetType(node_->InputAt(0)); }
-  Type* right_type() { return NodeProperties::GetType(node_->InputAt(1)); }
-  Type* type() { return NodeProperties::GetType(node_); }
+  Type left_type() { return NodeProperties::GetType(node_->InputAt(0)); }
+  Type right_type() { return NodeProperties::GetType(node_->InputAt(1)); }
+  Type type() { return NodeProperties::GetType(node_); }
 
   SimplifiedOperatorBuilder* simplified() { return lowering_->simplified(); }
   Graph* graph() const { return lowering_->graph(); }
   JSGraph* jsgraph() { return lowering_->jsgraph(); }
+  Isolate* isolate() { return jsgraph()->isolate(); }
   JSOperatorBuilder* javascript() { return lowering_->javascript(); }
   CommonOperatorBuilder* common() { return jsgraph()->common(); }
   Zone* zone() const { return graph()->zone(); }
@@ -368,11 +370,11 @@ class JSBinopReduction final {
   Node* node_;                 // The original node.
 
   Node* ConvertPlainPrimitiveToNumber(Node* node) {
-    DCHECK(NodeProperties::GetType(node)->Is(Type::PlainPrimitive()));
+    DCHECK(NodeProperties::GetType(node).Is(Type::PlainPrimitive()));
     // Avoid inserting too many eager ToNumber() operations.
     Reduction const reduction = lowering_->ReduceJSToNumberOrNumericInput(node);
     if (reduction.Changed()) return reduction.replacement();
-    if (NodeProperties::GetType(node)->Is(Type::Number())) {
+    if (NodeProperties::GetType(node).Is(Type::Number())) {
       return node;
     }
     return graph()->NewNode(simplified()->PlainPrimitiveToNumber(), node);
@@ -380,14 +382,14 @@ class JSBinopReduction final {
 
   Node* ConvertToUI32(Node* node, Signedness signedness) {
     // Avoid introducing too many eager NumberToXXnt32() operations.
-    Type* type = NodeProperties::GetType(node);
+    Type type = NodeProperties::GetType(node);
     if (signedness == kSigned) {
-      if (!type->Is(Type::Signed32())) {
+      if (!type.Is(Type::Signed32())) {
         node = graph()->NewNode(simplified()->NumberToInt32(), node);
       }
     } else {
       DCHECK_EQ(kUnsigned, signedness);
-      if (!type->Is(Type::Unsigned32())) {
+      if (!type.Is(Type::Unsigned32())) {
         node = graph()->NewNode(simplified()->NumberToUint32(), node);
       }
     }
@@ -404,12 +406,12 @@ class JSBinopReduction final {
 // - immediately put in type bounds for all new nodes
 // - relax effects from generic but not-side-effecting operations
 
-JSTypedLowering::JSTypedLowering(Editor* editor,
-                                 JSGraph* jsgraph, Zone* zone)
+JSTypedLowering::JSTypedLowering(Editor* editor, JSGraph* jsgraph,
+                                 const JSHeapBroker* js_heap_broker, Zone* zone)
     : AdvancedReducer(editor),
       jsgraph_(jsgraph),
-      empty_string_type_(
-          Type::HeapConstant(factory()->empty_string(), graph()->zone())),
+      empty_string_type_(Type::HeapConstant(
+          js_heap_broker, factory()->empty_string(), graph()->zone())),
       pointer_comparable_type_(
           Type::Union(Type::Oddball(),
                       Type::Union(Type::SymbolOrReceiver(), empty_string_type_,
@@ -434,8 +436,8 @@ Reduction JSTypedLowering::ReduceSpeculativeNumberAdd(Node* node) {
 
 Reduction JSTypedLowering::ReduceJSBitwiseNot(Node* node) {
   Node* input = NodeProperties::GetValueInput(node, 0);
-  Type* input_type = NodeProperties::GetType(input);
-  if (input_type->Is(Type::PlainPrimitive())) {
+  Type input_type = NodeProperties::GetType(input);
+  if (input_type.Is(Type::PlainPrimitive())) {
     // JSBitwiseNot(x) => NumberBitwiseXor(ToInt32(x), -1)
     node->InsertInput(graph()->zone(), 1, jsgraph()->SmiConstant(-1));
     NodeProperties::ChangeOp(node, javascript()->BitwiseXor());
@@ -449,8 +451,8 @@ Reduction JSTypedLowering::ReduceJSBitwiseNot(Node* node) {
 
 Reduction JSTypedLowering::ReduceJSDecrement(Node* node) {
   Node* input = NodeProperties::GetValueInput(node, 0);
-  Type* input_type = NodeProperties::GetType(input);
-  if (input_type->Is(Type::PlainPrimitive())) {
+  Type input_type = NodeProperties::GetType(input);
+  if (input_type.Is(Type::PlainPrimitive())) {
     // JSDecrement(x) => NumberSubtract(ToNumber(x), 1)
     node->InsertInput(graph()->zone(), 1, jsgraph()->OneConstant());
     NodeProperties::ChangeOp(node, javascript()->Subtract());
@@ -464,8 +466,8 @@ Reduction JSTypedLowering::ReduceJSDecrement(Node* node) {
 
 Reduction JSTypedLowering::ReduceJSIncrement(Node* node) {
   Node* input = NodeProperties::GetValueInput(node, 0);
-  Type* input_type = NodeProperties::GetType(input);
-  if (input_type->Is(Type::PlainPrimitive())) {
+  Type input_type = NodeProperties::GetType(input);
+  if (input_type.Is(Type::PlainPrimitive())) {
     // JSIncrement(x) => NumberAdd(ToNumber(x), 1)
     node->InsertInput(graph()->zone(), 1, jsgraph()->OneConstant());
     BinaryOperationHint hint = BinaryOperationHint::kAny;  // Dummy.
@@ -480,8 +482,8 @@ Reduction JSTypedLowering::ReduceJSIncrement(Node* node) {
 
 Reduction JSTypedLowering::ReduceJSNegate(Node* node) {
   Node* input = NodeProperties::GetValueInput(node, 0);
-  Type* input_type = NodeProperties::GetType(input);
-  if (input_type->Is(Type::PlainPrimitive())) {
+  Type input_type = NodeProperties::GetType(input);
+  if (input_type.Is(Type::PlainPrimitive())) {
     // JSNegate(x) => NumberMultiply(ToNumber(x), -1)
     node->InsertInput(graph()->zone(), 1, jsgraph()->SmiConstant(-1));
     NodeProperties::ChangeOp(node, javascript()->Multiply());
@@ -581,7 +583,7 @@ Reduction JSTypedLowering::ReduceJSAdd(Node* node) {
     Callable const callable =
         CodeFactory::StringAdd(isolate(), flags, NOT_TENURED);
     auto call_descriptor = Linkage::GetStubCallDescriptor(
-        isolate(), graph()->zone(), callable.descriptor(), 0,
+        graph()->zone(), callable.descriptor(), 0,
         CallDescriptor::kNeedsFrameState, properties);
     DCHECK_EQ(1, OperatorProperties::GetFrameStateInputCount(node->op()));
     node->InsertInput(graph()->zone(), 0,
@@ -650,16 +652,16 @@ Reduction JSTypedLowering::ReduceCreateConsString(Node* node) {
   Node* control = NodeProperties::GetControlInput(node);
 
   // Make sure {first} is actually a String.
-  Type* first_type = NodeProperties::GetType(first);
-  if (!first_type->Is(Type::String())) {
+  Type first_type = NodeProperties::GetType(first);
+  if (!first_type.Is(Type::String())) {
     first = effect = graph()->NewNode(
         simplified()->CheckString(VectorSlotPair()), first, effect, control);
     first_type = NodeProperties::GetType(first);
   }
 
   // Make sure {second} is actually a String.
-  Type* second_type = NodeProperties::GetType(second);
-  if (!second_type->Is(Type::String())) {
+  Type second_type = NodeProperties::GetType(second);
+  if (!second_type.Is(Type::String())) {
     second = effect = graph()->NewNode(
         simplified()->CheckString(VectorSlotPair()), second, effect, control);
     second_type = NodeProperties::GetType(second);
@@ -873,7 +875,7 @@ Reduction JSTypedLowering::ReduceJSStrictEqual(Node* node) {
     // For values with canonical representation (i.e. neither String nor
     // Numeric) an empty type intersection means the values cannot be strictly
     // equal.
-    if (!r.left_type()->Maybe(r.right_type())) {
+    if (!r.left_type().Maybe(r.right_type())) {
       Node* replacement = jsgraph()->FalseConstant();
       ReplaceWithValue(node, replacement);
       return Replace(replacement);
@@ -921,8 +923,8 @@ Reduction JSTypedLowering::ReduceJSStrictEqual(Node* node) {
 
 Reduction JSTypedLowering::ReduceJSToInteger(Node* node) {
   Node* const input = NodeProperties::GetValueInput(node, 0);
-  Type* const input_type = NodeProperties::GetType(input);
-  if (input_type->Is(type_cache_.kIntegerOrMinusZero)) {
+  Type const input_type = NodeProperties::GetType(input);
+  if (input_type.Is(type_cache_.kIntegerOrMinusZero)) {
     // JSToInteger(x:integer) => x
     ReplaceWithValue(node, input);
     return Replace(input);
@@ -932,8 +934,8 @@ Reduction JSTypedLowering::ReduceJSToInteger(Node* node) {
 
 Reduction JSTypedLowering::ReduceJSToName(Node* node) {
   Node* const input = NodeProperties::GetValueInput(node, 0);
-  Type* const input_type = NodeProperties::GetType(input);
-  if (input_type->Is(Type::Name())) {
+  Type const input_type = NodeProperties::GetType(input);
+  if (input_type.Is(Type::Name())) {
     // JSToName(x:name) => x
     ReplaceWithValue(node, input);
     return Replace(input);
@@ -943,18 +945,18 @@ Reduction JSTypedLowering::ReduceJSToName(Node* node) {
 
 Reduction JSTypedLowering::ReduceJSToLength(Node* node) {
   Node* input = NodeProperties::GetValueInput(node, 0);
-  Type* input_type = NodeProperties::GetType(input);
-  if (input_type->Is(type_cache_.kIntegerOrMinusZero)) {
-    if (input_type->IsNone() || input_type->Max() <= 0.0) {
+  Type input_type = NodeProperties::GetType(input);
+  if (input_type.Is(type_cache_.kIntegerOrMinusZero)) {
+    if (input_type.IsNone() || input_type.Max() <= 0.0) {
       input = jsgraph()->ZeroConstant();
-    } else if (input_type->Min() >= kMaxSafeInteger) {
+    } else if (input_type.Min() >= kMaxSafeInteger) {
       input = jsgraph()->Constant(kMaxSafeInteger);
     } else {
-      if (input_type->Min() <= 0.0) {
+      if (input_type.Min() <= 0.0) {
         input = graph()->NewNode(simplified()->NumberMax(),
                                  jsgraph()->ZeroConstant(), input);
       }
-      if (input_type->Max() > kMaxSafeInteger) {
+      if (input_type.Max() > kMaxSafeInteger) {
         input = graph()->NewNode(simplified()->NumberMin(),
                                  jsgraph()->Constant(kMaxSafeInteger), input);
       }
@@ -968,31 +970,31 @@ Reduction JSTypedLowering::ReduceJSToLength(Node* node) {
 Reduction JSTypedLowering::ReduceJSToNumberOrNumericInput(Node* input) {
   // Try constant-folding of JSToNumber/JSToNumeric with constant inputs. Here
   // we only cover cases where ToNumber and ToNumeric coincide.
-  Type* input_type = NodeProperties::GetType(input);
-  if (input_type->Is(Type::String())) {
+  Type input_type = NodeProperties::GetType(input);
+  if (input_type.Is(Type::String())) {
     HeapObjectMatcher m(input);
     if (m.HasValue() && m.Value()->IsString()) {
       Handle<Object> input_value = m.Value();
       return Replace(jsgraph()->Constant(
-          String::ToNumber(Handle<String>::cast(input_value))));
+          String::ToNumber(isolate(), Handle<String>::cast(input_value))));
     }
   }
-  if (input_type->IsHeapConstant()) {
-    Handle<Object> input_value = input_type->AsHeapConstant()->Value();
+  if (input_type.IsHeapConstant()) {
+    Handle<Object> input_value = input_type.AsHeapConstant()->Value();
     if (input_value->IsOddball()) {
       return Replace(jsgraph()->Constant(
           Oddball::ToNumber(Handle<Oddball>::cast(input_value))));
     }
   }
-  if (input_type->Is(Type::Number())) {
+  if (input_type.Is(Type::Number())) {
     // JSToNumber(x:number) => x
     return Changed(input);
   }
-  if (input_type->Is(Type::Undefined())) {
+  if (input_type.Is(Type::Undefined())) {
     // JSToNumber(undefined) => #NaN
     return Replace(jsgraph()->NaNConstant());
   }
-  if (input_type->Is(Type::Null())) {
+  if (input_type.Is(Type::Null())) {
     // JSToNumber(null) => #0
     return Replace(jsgraph()->ZeroConstant());
   }
@@ -1007,12 +1009,12 @@ Reduction JSTypedLowering::ReduceJSToNumberOrNumeric(Node* node) {
     ReplaceWithValue(node, reduction.replacement());
     return reduction;
   }
-  Type* const input_type = NodeProperties::GetType(input);
-  if (input_type->Is(Type::PlainPrimitive())) {
+  Type const input_type = NodeProperties::GetType(input);
+  if (input_type.Is(Type::PlainPrimitive())) {
     RelaxEffectsAndControls(node);
     node->TrimInputCount(1);
     // For a PlainPrimitive, ToNumeric is the same as ToNumber.
-    Type* node_type = NodeProperties::GetType(node);
+    Type node_type = NodeProperties::GetType(node);
     NodeProperties::SetType(
         node, Type::Intersect(node_type, Type::Number(), graph()->zone()));
     NodeProperties::ChangeOp(node, simplified()->PlainPrimitiveToNumber());
@@ -1029,33 +1031,33 @@ Reduction JSTypedLowering::ReduceJSToStringInput(Node* input) {
     if (result.Changed()) return result;
     return Changed(input);  // JSToString(JSToString(x)) => JSToString(x)
   }
-  Type* input_type = NodeProperties::GetType(input);
-  if (input_type->Is(Type::String())) {
+  Type input_type = NodeProperties::GetType(input);
+  if (input_type.Is(Type::String())) {
     return Changed(input);  // JSToString(x:string) => x
   }
-  if (input_type->Is(Type::Boolean())) {
+  if (input_type.Is(Type::Boolean())) {
     return Replace(graph()->NewNode(
         common()->Select(MachineRepresentation::kTagged), input,
         jsgraph()->HeapConstant(factory()->true_string()),
         jsgraph()->HeapConstant(factory()->false_string())));
   }
-  if (input_type->Is(Type::Undefined())) {
+  if (input_type.Is(Type::Undefined())) {
     return Replace(jsgraph()->HeapConstant(factory()->undefined_string()));
   }
-  if (input_type->Is(Type::Null())) {
+  if (input_type.Is(Type::Null())) {
     return Replace(jsgraph()->HeapConstant(factory()->null_string()));
   }
-  if (input_type->Is(Type::NaN())) {
+  if (input_type.Is(Type::NaN())) {
     return Replace(jsgraph()->HeapConstant(factory()->NaN_string()));
   }
-  if (input_type->Is(Type::OrderedNumber()) &&
-      input_type->Min() == input_type->Max()) {
+  if (input_type.Is(Type::OrderedNumber()) &&
+      input_type.Min() == input_type.Max()) {
     // Note that we can use Type::OrderedNumber(), since
     // both 0 and -0 map to the String "0" in JavaScript.
     return Replace(jsgraph()->HeapConstant(
-        factory()->NumberToString(factory()->NewNumber(input_type->Min()))));
+        factory()->NumberToString(factory()->NewNumber(input_type.Min()))));
   }
-  if (input_type->Is(Type::Number())) {
+  if (input_type.Is(Type::Number())) {
     return Replace(graph()->NewNode(simplified()->NumberToString(), input));
   }
   return NoChange();
@@ -1076,12 +1078,12 @@ Reduction JSTypedLowering::ReduceJSToString(Node* node) {
 Reduction JSTypedLowering::ReduceJSToObject(Node* node) {
   DCHECK_EQ(IrOpcode::kJSToObject, node->opcode());
   Node* receiver = NodeProperties::GetValueInput(node, 0);
-  Type* receiver_type = NodeProperties::GetType(receiver);
+  Type receiver_type = NodeProperties::GetType(receiver);
   Node* context = NodeProperties::GetContextInput(node);
   Node* frame_state = NodeProperties::GetFrameStateInput(node);
   Node* effect = NodeProperties::GetEffectInput(node);
   Node* control = NodeProperties::GetControlInput(node);
-  if (receiver_type->Is(Type::Receiver())) {
+  if (receiver_type.Is(Type::Receiver())) {
     ReplaceWithValue(node, receiver, effect, control);
     return Replace(receiver);
   }
@@ -1102,7 +1104,7 @@ Reduction JSTypedLowering::ReduceJSToObject(Node* node) {
     // Convert {receiver} using the ToObjectStub.
     Callable callable = Builtins::CallableFor(isolate(), Builtins::kToObject);
     auto call_descriptor = Linkage::GetStubCallDescriptor(
-        isolate(), graph()->zone(), callable.descriptor(), 0,
+        graph()->zone(), callable.descriptor(), 0,
         CallDescriptor::kNeedsFrameState, node->op()->properties());
     rfalse = efalse = if_false =
         graph()->NewNode(common()->Call(call_descriptor),
@@ -1114,7 +1116,7 @@ Reduction JSTypedLowering::ReduceJSToObject(Node* node) {
   // ToObject stub call node instead. Note that the stub can only throw on
   // receivers that can be null or undefined.
   Node* on_exception = nullptr;
-  if (receiver_type->Maybe(Type::NullOrUndefined()) &&
+  if (receiver_type.Maybe(Type::NullOrUndefined()) &&
       NodeProperties::IsExceptionalCall(node, &on_exception)) {
     NodeProperties::ReplaceControlInput(on_exception, if_false);
     NodeProperties::ReplaceEffectInput(on_exception, efalse);
@@ -1139,11 +1141,11 @@ Reduction JSTypedLowering::ReduceJSToObject(Node* node) {
 Reduction JSTypedLowering::ReduceJSLoadNamed(Node* node) {
   DCHECK_EQ(IrOpcode::kJSLoadNamed, node->opcode());
   Node* receiver = NodeProperties::GetValueInput(node, 0);
-  Type* receiver_type = NodeProperties::GetType(receiver);
+  Type receiver_type = NodeProperties::GetType(receiver);
   Handle<Name> name = NamedAccessOf(node->op()).name();
   // Optimize "length" property of strings.
   if (name.is_identical_to(factory()->length_string()) &&
-      receiver_type->Is(Type::String())) {
+      receiver_type.Is(Type::String())) {
     Node* value = graph()->NewNode(simplified()->StringLength(), receiver);
     ReplaceWithValue(node, value);
     return Replace(value);
@@ -1154,7 +1156,7 @@ Reduction JSTypedLowering::ReduceJSLoadNamed(Node* node) {
 Reduction JSTypedLowering::ReduceJSHasInPrototypeChain(Node* node) {
   DCHECK_EQ(IrOpcode::kJSHasInPrototypeChain, node->opcode());
   Node* value = NodeProperties::GetValueInput(node, 0);
-  Type* value_type = NodeProperties::GetType(value);
+  Type value_type = NodeProperties::GetType(value);
   Node* prototype = NodeProperties::GetValueInput(node, 1);
   Node* context = NodeProperties::GetContextInput(node);
   Node* frame_state = NodeProperties::GetFrameStateInput(node);
@@ -1163,7 +1165,7 @@ Reduction JSTypedLowering::ReduceJSHasInPrototypeChain(Node* node) {
 
   // If {value} cannot be a receiver, then it cannot have {prototype} in
   // it's prototype chain (all Primitive values have a null prototype).
-  if (value_type->Is(Type::Primitive())) {
+  if (value_type.Is(Type::Primitive())) {
     Node* value = jsgraph()->FalseConstant();
     ReplaceWithValue(node, value, effect, control);
     return Replace(value);
@@ -1296,13 +1298,13 @@ Reduction JSTypedLowering::ReduceJSHasInPrototypeChain(Node* node) {
 Reduction JSTypedLowering::ReduceJSOrdinaryHasInstance(Node* node) {
   DCHECK_EQ(IrOpcode::kJSOrdinaryHasInstance, node->opcode());
   Node* constructor = NodeProperties::GetValueInput(node, 0);
-  Type* constructor_type = NodeProperties::GetType(constructor);
+  Type constructor_type = NodeProperties::GetType(constructor);
   Node* object = NodeProperties::GetValueInput(node, 1);
-  Type* object_type = NodeProperties::GetType(object);
+  Type object_type = NodeProperties::GetType(object);
 
   // Check if the {constructor} cannot be callable.
   // See ES6 section 7.3.19 OrdinaryHasInstance ( C, O ) step 1.
-  if (!constructor_type->Maybe(Type::Callable())) {
+  if (!constructor_type.Maybe(Type::Callable())) {
     Node* value = jsgraph()->FalseConstant();
     ReplaceWithValue(node, value);
     return Replace(value);
@@ -1311,8 +1313,8 @@ Reduction JSTypedLowering::ReduceJSOrdinaryHasInstance(Node* node) {
   // If the {constructor} cannot be a JSBoundFunction and then {object}
   // cannot be a JSReceiver, then this can be constant-folded to false.
   // See ES6 section 7.3.19 OrdinaryHasInstance ( C, O ) step 2 and 3.
-  if (!object_type->Maybe(Type::Receiver()) &&
-      !constructor_type->Maybe(Type::BoundFunction())) {
+  if (!object_type.Maybe(Type::Receiver()) &&
+      !constructor_type.Maybe(Type::BoundFunction())) {
     Node* value = jsgraph()->FalseConstant();
     ReplaceWithValue(node, value);
     return Replace(value);
@@ -1372,11 +1374,11 @@ Node* JSTypedLowering::BuildGetModuleCell(Node* node) {
 
   int32_t cell_index = OpParameter<int32_t>(node->op());
   Node* module = NodeProperties::GetValueInput(node, 0);
-  Type* module_type = NodeProperties::GetType(module);
+  Type module_type = NodeProperties::GetType(module);
 
-  if (module_type->IsHeapConstant()) {
+  if (module_type.IsHeapConstant()) {
     Handle<Module> module_constant =
-        Handle<Module>::cast(module_type->AsHeapConstant()->Value());
+        Handle<Module>::cast(module_type.AsHeapConstant()->Value());
     Handle<Cell> cell_constant(module_constant->GetCell(cell_index), isolate());
     return jsgraph()->HeapConstant(cell_constant);
   }
@@ -1438,10 +1440,10 @@ namespace {
 
 void ReduceBuiltin(Isolate* isolate, JSGraph* jsgraph, Node* node,
                    int builtin_index, int arity, CallDescriptor::Flags flags) {
-  // Patch {node} to a direct CEntryStub call.
+  // Patch {node} to a direct CEntry call.
   //
   // ----------- A r g u m e n t s -----------
-  // -- 0: CEntryStub
+  // -- 0: CEntry
   // --- Stack args ---
   // -- 1: receiver
   // -- [2, 2 + n[: the n actual arguments passed to the builtin
@@ -1493,7 +1495,7 @@ void ReduceBuiltin(Isolate* isolate, JSGraph* jsgraph, Node* node,
   node->InsertInput(zone, cursor++, new_target);
 
   Address entry = Builtins::CppEntryOf(builtin_index);
-  ExternalReference entry_ref(ExternalReference(entry, isolate));
+  ExternalReference entry_ref = ExternalReference::Create(entry);
   Node* entry_node = jsgraph->ExternalConstant(entry_ref);
 
   node->InsertInput(zone, cursor++, entry_node);
@@ -1524,15 +1526,15 @@ Reduction JSTypedLowering::ReduceJSConstructForwardVarargs(Node* node) {
   int const arity = static_cast<int>(p.arity() - 2);
   int const start_index = static_cast<int>(p.start_index());
   Node* target = NodeProperties::GetValueInput(node, 0);
-  Type* target_type = NodeProperties::GetType(target);
+  Type target_type = NodeProperties::GetType(target);
   Node* new_target = NodeProperties::GetValueInput(node, arity + 1);
 
   // Check if {target} is a JSFunction.
-  if (target_type->IsHeapConstant() &&
-      target_type->AsHeapConstant()->Value()->IsJSFunction()) {
+  if (target_type.IsHeapConstant() &&
+      target_type.AsHeapConstant()->Value()->IsJSFunction()) {
     // Only optimize [[Construct]] here if {function} is a Constructor.
     Handle<JSFunction> function =
-        Handle<JSFunction>::cast(target_type->AsHeapConstant()->Value());
+        Handle<JSFunction>::cast(target_type.AsHeapConstant()->Value());
     if (!function->IsConstructor()) return NoChange();
     // Patch {node} to an indirect call via ConstructFunctionForwardVarargs.
     Callable callable = CodeFactory::ConstructFunctionForwardVarargs(isolate());
@@ -1545,7 +1547,7 @@ Reduction JSTypedLowering::ReduceJSConstructForwardVarargs(Node* node) {
     node->InsertInput(graph()->zone(), 5, jsgraph()->UndefinedConstant());
     NodeProperties::ChangeOp(
         node, common()->Call(Linkage::GetStubCallDescriptor(
-                  isolate(), graph()->zone(), callable.descriptor(), arity + 1,
+                  graph()->zone(), callable.descriptor(), arity + 1,
                   CallDescriptor::kNeedsFrameState)));
     return Changed(node);
   }
@@ -1559,14 +1561,14 @@ Reduction JSTypedLowering::ReduceJSConstruct(Node* node) {
   DCHECK_LE(2u, p.arity());
   int const arity = static_cast<int>(p.arity() - 2);
   Node* target = NodeProperties::GetValueInput(node, 0);
-  Type* target_type = NodeProperties::GetType(target);
+  Type target_type = NodeProperties::GetType(target);
   Node* new_target = NodeProperties::GetValueInput(node, arity + 1);
 
   // Check if {target} is a known JSFunction.
-  if (target_type->IsHeapConstant() &&
-      target_type->AsHeapConstant()->Value()->IsJSFunction()) {
+  if (target_type.IsHeapConstant() &&
+      target_type.AsHeapConstant()->Value()->IsJSFunction()) {
     Handle<JSFunction> function =
-        Handle<JSFunction>::cast(target_type->AsHeapConstant()->Value());
+        Handle<JSFunction>::cast(target_type.AsHeapConstant()->Value());
     Handle<SharedFunctionInfo> shared(function->shared(), isolate());
 
     // Only optimize [[Construct]] here if {function} is a Constructor.
@@ -1579,7 +1581,7 @@ Reduction JSTypedLowering::ReduceJSConstruct(Node* node) {
 
     Handle<Code> code = use_builtin_construct_stub
                             ? BUILTIN_CODE(isolate(), JSBuiltinsConstructStub)
-                            : isolate()->builtins()->JSConstructStubGeneric();
+                            : BUILTIN_CODE(isolate(), JSConstructStubGeneric);
 
     node->RemoveInput(arity + 1);
     node->InsertInput(graph()->zone(), 0, jsgraph()->HeapConstant(code));
@@ -1588,9 +1590,9 @@ Reduction JSTypedLowering::ReduceJSConstruct(Node* node) {
     node->InsertInput(graph()->zone(), 4, jsgraph()->UndefinedConstant());
     node->InsertInput(graph()->zone(), 5, jsgraph()->UndefinedConstant());
     NodeProperties::ChangeOp(
-        node, common()->Call(Linkage::GetStubCallDescriptor(
-                  isolate(), graph()->zone(),
-                  ConstructStubDescriptor(isolate()), 1 + arity, flags)));
+        node,
+        common()->Call(Linkage::GetStubCallDescriptor(
+            graph()->zone(), ConstructStubDescriptor{}, 1 + arity, flags)));
 
     return Changed(node);
   }
@@ -1605,10 +1607,10 @@ Reduction JSTypedLowering::ReduceJSCallForwardVarargs(Node* node) {
   int const arity = static_cast<int>(p.arity() - 2);
   int const start_index = static_cast<int>(p.start_index());
   Node* target = NodeProperties::GetValueInput(node, 0);
-  Type* target_type = NodeProperties::GetType(target);
+  Type target_type = NodeProperties::GetType(target);
 
   // Check if {target} is a JSFunction.
-  if (target_type->Is(Type::Function())) {
+  if (target_type.Is(Type::Function())) {
     // Compute flags for the call.
     CallDescriptor::Flags flags = CallDescriptor::kNeedsFrameState;
     // Patch {node} to an indirect call via CallFunctionForwardVarargs.
@@ -1619,8 +1621,7 @@ Reduction JSTypedLowering::ReduceJSCallForwardVarargs(Node* node) {
     node->InsertInput(graph()->zone(), 3, jsgraph()->Constant(start_index));
     NodeProperties::ChangeOp(
         node, common()->Call(Linkage::GetStubCallDescriptor(
-                  isolate(), graph()->zone(), callable.descriptor(), arity + 1,
-                  flags)));
+                  graph()->zone(), callable.descriptor(), arity + 1, flags)));
     return Changed(node);
   }
 
@@ -1633,24 +1634,24 @@ Reduction JSTypedLowering::ReduceJSCall(Node* node) {
   int const arity = static_cast<int>(p.arity() - 2);
   ConvertReceiverMode convert_mode = p.convert_mode();
   Node* target = NodeProperties::GetValueInput(node, 0);
-  Type* target_type = NodeProperties::GetType(target);
+  Type target_type = NodeProperties::GetType(target);
   Node* receiver = NodeProperties::GetValueInput(node, 1);
-  Type* receiver_type = NodeProperties::GetType(receiver);
+  Type receiver_type = NodeProperties::GetType(receiver);
   Node* effect = NodeProperties::GetEffectInput(node);
   Node* control = NodeProperties::GetControlInput(node);
 
   // Try to infer receiver {convert_mode} from {receiver} type.
-  if (receiver_type->Is(Type::NullOrUndefined())) {
+  if (receiver_type.Is(Type::NullOrUndefined())) {
     convert_mode = ConvertReceiverMode::kNullOrUndefined;
-  } else if (!receiver_type->Maybe(Type::NullOrUndefined())) {
+  } else if (!receiver_type.Maybe(Type::NullOrUndefined())) {
     convert_mode = ConvertReceiverMode::kNotNullOrUndefined;
   }
 
   // Check if {target} is a known JSFunction.
-  if (target_type->IsHeapConstant() &&
-      target_type->AsHeapConstant()->Value()->IsJSFunction()) {
+  if (target_type.IsHeapConstant() &&
+      target_type.AsHeapConstant()->Value()->IsJSFunction()) {
     Handle<JSFunction> function =
-        Handle<JSFunction>::cast(target_type->AsHeapConstant()->Value());
+        Handle<JSFunction>::cast(target_type.AsHeapConstant()->Value());
     Handle<SharedFunctionInfo> shared(function->shared(), isolate());
 
     if (function->shared()->HasBreakInfo()) {
@@ -1670,9 +1671,9 @@ Reduction JSTypedLowering::ReduceJSCall(Node* node) {
 
     // Check if we need to convert the {receiver}.
     if (is_sloppy(shared->language_mode()) && !shared->native() &&
-        !receiver_type->Is(Type::Receiver())) {
+        !receiver_type.Is(Type::Receiver())) {
       Node* global_proxy =
-          jsgraph()->HeapConstant(handle(function->global_proxy()));
+          jsgraph()->HeapConstant(handle(function->global_proxy(), isolate()));
       receiver = effect =
           graph()->NewNode(simplified()->ConvertReceiver(convert_mode),
                            receiver, global_proxy, effect, control);
@@ -1699,13 +1700,27 @@ Reduction JSTypedLowering::ReduceJSCall(Node* node) {
           jsgraph()->Constant(shared->internal_formal_parameter_count()));
       NodeProperties::ChangeOp(
           node, common()->Call(Linkage::GetStubCallDescriptor(
-                    isolate(), graph()->zone(), callable.descriptor(),
-                    1 + arity, flags)));
+                    graph()->zone(), callable.descriptor(), 1 + arity, flags)));
     } else if (shared->HasBuiltinId() &&
                Builtins::HasCppImplementation(shared->builtin_id())) {
-      // Patch {node} to a direct CEntryStub call.
+      // Patch {node} to a direct CEntry call.
       ReduceBuiltin(isolate(), jsgraph(), node, shared->builtin_id(), arity,
                     flags);
+    } else if (shared->HasBuiltinId() &&
+               Builtins::KindOf(shared->builtin_id()) == Builtins::TFJ) {
+      // Patch {node} to a direct code object call.
+      Callable callable = Builtins::CallableFor(
+          isolate(), static_cast<Builtins::Name>(shared->builtin_id()));
+      CallDescriptor::Flags flags = CallDescriptor::kNeedsFrameState;
+
+      const CallInterfaceDescriptor& descriptor = callable.descriptor();
+      auto call_descriptor = Linkage::GetStubCallDescriptor(
+          graph()->zone(), descriptor, 1 + arity, flags);
+      Node* stub_code = jsgraph()->HeapConstant(callable.code());
+      node->InsertInput(graph()->zone(), 0, stub_code);  // Code object.
+      node->InsertInput(graph()->zone(), 2, new_target);
+      node->InsertInput(graph()->zone(), 3, argument_count);
+      NodeProperties::ChangeOp(node, common()->Call(call_descriptor));
     } else {
       // Patch {node} to a direct call.
       node->InsertInput(graph()->zone(), arity + 2, new_target);
@@ -1718,7 +1733,7 @@ Reduction JSTypedLowering::ReduceJSCall(Node* node) {
   }
 
   // Check if {target} is a JSFunction.
-  if (target_type->Is(Type::Function())) {
+  if (target_type.Is(Type::Function())) {
     // Compute flags for the call.
     CallDescriptor::Flags flags = CallDescriptor::kNeedsFrameState;
     // Patch {node} to an indirect call via the CallFunction builtin.
@@ -1728,8 +1743,7 @@ Reduction JSTypedLowering::ReduceJSCall(Node* node) {
     node->InsertInput(graph()->zone(), 2, jsgraph()->Constant(arity));
     NodeProperties::ChangeOp(
         node, common()->Call(Linkage::GetStubCallDescriptor(
-                  isolate(), graph()->zone(), callable.descriptor(), 1 + arity,
-                  flags)));
+                  graph()->zone(), callable.descriptor(), 1 + arity, flags)));
     return Changed(node);
   }
 
@@ -1818,7 +1832,7 @@ Reduction JSTypedLowering::ReduceJSForInNext(Node* node) {
         Callable const callable =
             Builtins::CallableFor(isolate(), Builtins::kForInFilter);
         auto call_descriptor = Linkage::GetStubCallDescriptor(
-            isolate(), graph()->zone(), callable.descriptor(), 0,
+            graph()->zone(), callable.descriptor(), 0,
             CallDescriptor::kNeedsFrameState);
         vfalse = efalse = if_false =
             graph()->NewNode(common()->Call(call_descriptor),
@@ -2013,9 +2027,10 @@ Reduction JSTypedLowering::ReduceJSGeneratorStore(Node* node) {
   Node* context = NodeProperties::GetContextInput(node);
   Node* effect = NodeProperties::GetEffectInput(node);
   Node* control = NodeProperties::GetControlInput(node);
-  int register_count = GeneratorStoreRegisterCountOf(node->op());
+  int value_count = GeneratorStoreValueCountOf(node->op());
 
-  FieldAccess array_field = AccessBuilder::ForJSGeneratorObjectRegisterFile();
+  FieldAccess array_field =
+      AccessBuilder::ForJSGeneratorObjectParametersAndRegisters();
   FieldAccess context_field = AccessBuilder::ForJSGeneratorObjectContext();
   FieldAccess continuation_field =
       AccessBuilder::ForJSGeneratorObjectContinuation();
@@ -2025,7 +2040,7 @@ Reduction JSTypedLowering::ReduceJSGeneratorStore(Node* node) {
   Node* array = effect = graph()->NewNode(simplified()->LoadField(array_field),
                                           generator, effect, control);
 
-  for (int i = 0; i < register_count; ++i) {
+  for (int i = 0; i < value_count; ++i) {
     Node* value = NodeProperties::GetValueInput(node, 3 + i);
     if (value != jsgraph()->OptimizedOutConstant()) {
       effect = graph()->NewNode(
@@ -2086,7 +2101,8 @@ Reduction JSTypedLowering::ReduceJSGeneratorRestoreRegister(Node* node) {
   Node* control = NodeProperties::GetControlInput(node);
   int index = RestoreRegisterIndexOf(node->op());
 
-  FieldAccess array_field = AccessBuilder::ForJSGeneratorObjectRegisterFile();
+  FieldAccess array_field =
+      AccessBuilder::ForJSGeneratorObjectParametersAndRegisters();
   FieldAccess element_field = AccessBuilder::ForFixedArraySlot(index);
 
   Node* array = effect = graph()->NewNode(simplified()->LoadField(array_field),
@@ -2117,6 +2133,128 @@ Reduction JSTypedLowering::ReduceJSGeneratorRestoreInputOrDebugPos(Node* node) {
   return Changed(node);
 }
 
+Reduction JSTypedLowering::ReduceObjectIsArray(Node* node) {
+  Node* value = NodeProperties::GetValueInput(node, 0);
+  Type value_type = NodeProperties::GetType(value);
+  Node* context = NodeProperties::GetContextInput(node);
+  Node* frame_state = NodeProperties::GetFrameStateInput(node);
+  Node* effect = NodeProperties::GetEffectInput(node);
+  Node* control = NodeProperties::GetControlInput(node);
+
+  // Constant-fold based on {value} type.
+  if (value_type.Is(Type::Array())) {
+    Node* value = jsgraph()->TrueConstant();
+    ReplaceWithValue(node, value);
+    return Replace(value);
+  } else if (!value_type.Maybe(Type::ArrayOrProxy())) {
+    Node* value = jsgraph()->FalseConstant();
+    ReplaceWithValue(node, value);
+    return Replace(value);
+  }
+
+  int count = 0;
+  Node* values[5];
+  Node* effects[5];
+  Node* controls[4];
+
+  // Check if the {value} is a Smi.
+  Node* check = graph()->NewNode(simplified()->ObjectIsSmi(), value);
+  control =
+      graph()->NewNode(common()->Branch(BranchHint::kFalse), check, control);
+
+  // The {value} is a Smi.
+  controls[count] = graph()->NewNode(common()->IfTrue(), control);
+  effects[count] = effect;
+  values[count] = jsgraph()->FalseConstant();
+  count++;
+
+  control = graph()->NewNode(common()->IfFalse(), control);
+
+  // Load the {value}s instance type.
+  Node* value_map = effect = graph()->NewNode(
+      simplified()->LoadField(AccessBuilder::ForMap()), value, effect, control);
+  Node* value_instance_type = effect = graph()->NewNode(
+      simplified()->LoadField(AccessBuilder::ForMapInstanceType()), value_map,
+      effect, control);
+
+  // Check if the {value} is a JSArray.
+  check = graph()->NewNode(simplified()->NumberEqual(), value_instance_type,
+                           jsgraph()->Constant(JS_ARRAY_TYPE));
+  control = graph()->NewNode(common()->Branch(), check, control);
+
+  // The {value} is a JSArray.
+  controls[count] = graph()->NewNode(common()->IfTrue(), control);
+  effects[count] = effect;
+  values[count] = jsgraph()->TrueConstant();
+  count++;
+
+  control = graph()->NewNode(common()->IfFalse(), control);
+
+  // Check if the {value} is a JSProxy.
+  check = graph()->NewNode(simplified()->NumberEqual(), value_instance_type,
+                           jsgraph()->Constant(JS_PROXY_TYPE));
+  control =
+      graph()->NewNode(common()->Branch(BranchHint::kFalse), check, control);
+
+  // The {value} is neither a JSArray nor a JSProxy.
+  controls[count] = graph()->NewNode(common()->IfFalse(), control);
+  effects[count] = effect;
+  values[count] = jsgraph()->FalseConstant();
+  count++;
+
+  control = graph()->NewNode(common()->IfTrue(), control);
+
+  // Let the %ArrayIsArray runtime function deal with the JSProxy {value}.
+  value = effect = control =
+      graph()->NewNode(javascript()->CallRuntime(Runtime::kArrayIsArray), value,
+                       context, frame_state, effect, control);
+  NodeProperties::SetType(value, Type::Boolean());
+
+  // Update potential {IfException} uses of {node} to point to the above
+  // %ArrayIsArray runtime call node instead.
+  Node* on_exception = nullptr;
+  if (NodeProperties::IsExceptionalCall(node, &on_exception)) {
+    NodeProperties::ReplaceControlInput(on_exception, control);
+    NodeProperties::ReplaceEffectInput(on_exception, effect);
+    control = graph()->NewNode(common()->IfSuccess(), control);
+    Revisit(on_exception);
+  }
+
+  // The {value} is neither a JSArray nor a JSProxy.
+  controls[count] = control;
+  effects[count] = effect;
+  values[count] = value;
+  count++;
+
+  control = graph()->NewNode(common()->Merge(count), count, controls);
+  effects[count] = control;
+  values[count] = control;
+  effect = graph()->NewNode(common()->EffectPhi(count), count + 1, effects);
+  value = graph()->NewNode(common()->Phi(MachineRepresentation::kTagged, count),
+                           count + 1, values);
+  ReplaceWithValue(node, value, effect, control);
+  return Replace(value);
+}
+
+Reduction JSTypedLowering::ReduceJSParseInt(Node* node) {
+  Node* value = NodeProperties::GetValueInput(node, 0);
+  Type value_type = NodeProperties::GetType(value);
+  Node* radix = NodeProperties::GetValueInput(node, 1);
+  Type radix_type = NodeProperties::GetType(radix);
+  // We need kTenOrUndefined and kZeroOrUndefined because
+  // the type representing {0,10} would become the range 1-10.
+  if (value_type.Is(type_cache_.kSafeInteger) &&
+      (radix_type.Is(type_cache_.kTenOrUndefined) ||
+       radix_type.Is(type_cache_.kZeroOrUndefined))) {
+    // Number.parseInt(a:safe-integer) -> a
+    // Number.parseInt(a:safe-integer,b:#0\/undefined) -> a
+    // Number.parseInt(a:safe-integer,b:#10\/undefined) -> a
+    ReplaceWithValue(node, value);
+    return Replace(value);
+  }
+  return NoChange();
+}
+
 Reduction JSTypedLowering::Reduce(Node* node) {
   switch (node->opcode()) {
     case IrOpcode::kJSEqual:
@@ -2219,6 +2357,10 @@ Reduction JSTypedLowering::Reduce(Node* node) {
     case IrOpcode::kSpeculativeNumberLessThan:
     case IrOpcode::kSpeculativeNumberLessThanOrEqual:
       return ReduceSpeculativeNumberComparison(node);
+    case IrOpcode::kJSObjectIsArray:
+      return ReduceObjectIsArray(node);
+    case IrOpcode::kJSParseInt:
+      return ReduceJSParseInt(node);
     default:
       break;
   }
diff --git a/deps/v8/src/compiler/js-typed-lowering.h b/deps/v8/src/compiler/js-typed-lowering.h
index 72ce4fb8dde4c3..37d433cadfdcb1 100644
--- a/deps/v8/src/compiler/js-typed-lowering.h
+++ b/deps/v8/src/compiler/js-typed-lowering.h
@@ -31,7 +31,8 @@ enum Signedness { kSigned, kUnsigned };
 class V8_EXPORT_PRIVATE JSTypedLowering final
     : public NON_EXPORTED_BASE(AdvancedReducer) {
  public:
-  JSTypedLowering(Editor* editor, JSGraph* jsgraph, Zone* zone);
+  JSTypedLowering(Editor* editor, JSGraph* jsgraph,
+                  const JSHeapBroker* js_heap_broker, Zone* zone);
   ~JSTypedLowering() final {}
 
   const char* reducer_name() const override { return "JSTypedLowering"; }
@@ -85,6 +86,8 @@ class V8_EXPORT_PRIVATE JSTypedLowering final
   Reduction ReduceSpeculativeNumberMultiply(Node* node);
   Reduction ReduceSpeculativeNumberBinop(Node* node);
   Reduction ReduceSpeculativeNumberComparison(Node* node);
+  Reduction ReduceObjectIsArray(Node* node);
+  Reduction ReduceJSParseInt(Node* node);
 
   // Helper for ReduceJSLoadModule and ReduceJSStoreModule.
   Node* BuildGetModuleCell(Node* node);
@@ -101,8 +104,8 @@ class V8_EXPORT_PRIVATE JSTypedLowering final
   SimplifiedOperatorBuilder* simplified() const;
 
   JSGraph* jsgraph_;
-  Type* empty_string_type_;
-  Type* pointer_comparable_type_;
+  Type empty_string_type_;
+  Type pointer_comparable_type_;
   TypeCache const& type_cache_;
 };
 
diff --git a/deps/v8/src/compiler/linkage.cc b/deps/v8/src/compiler/linkage.cc
index d92e48848e2bde..99f192acdfedf8 100644
--- a/deps/v8/src/compiler/linkage.cc
+++ b/deps/v8/src/compiler/linkage.cc
@@ -19,7 +19,7 @@ namespace compiler {
 
 namespace {
 
-LinkageLocation regloc(Register reg, MachineType type) {
+inline LinkageLocation regloc(Register reg, MachineType type) {
   return LinkageLocation::ForRegister(reg.code(), type);
 }
 
@@ -123,14 +123,13 @@ int CallDescriptor::CalculateFixedFrameSize() const {
       return PushArgumentCount()
                  ? OptimizedBuiltinFrameConstants::kFixedSlotCount
                  : StandardFrameConstants::kFixedSlotCount;
-      break;
     case kCallAddress:
       return CommonFrameConstants::kFixedSlotCountAboveFp +
              CommonFrameConstants::kCPSlotCount;
-      break;
     case kCallCodeObject:
-    case kCallWasmFunction:
       return TypedFrameConstants::kFixedSlotCount;
+    case kCallWasmFunction:
+      return WasmCompiledFrameConstants::kFixedSlotCount;
   }
   UNREACHABLE();
 }
@@ -159,7 +158,6 @@ bool Linkage::NeedsFrameStateInput(Runtime::FunctionId function) {
     case Runtime::kAbort:
     case Runtime::kAllocateInTargetSpace:
     case Runtime::kCreateIterResultObject:
-    case Runtime::kGeneratorGetContinuation:
     case Runtime::kIncBlockCounter:
     case Runtime::kIsFunction:
     case Runtime::kNewClosure:
@@ -186,8 +184,6 @@ bool Linkage::NeedsFrameStateInput(Runtime::FunctionId function) {
     case Runtime::kInlineGeneratorGetResumeMode:
     case Runtime::kInlineCreateJSGeneratorObject:
     case Runtime::kInlineIsArray:
-    case Runtime::kInlineIsJSMap:
-    case Runtime::kInlineIsJSSet:
     case Runtime::kInlineIsJSWeakMap:
     case Runtime::kInlineIsJSWeakSet:
     case Runtime::kInlineIsJSReceiver:
@@ -344,32 +340,30 @@ CallDescriptor* Linkage::GetJSCallDescriptor(Zone* zone, bool is_osr,
       "js-call");
 }
 
-// TODO(all): Add support for return representations/locations to
-// CallInterfaceDescriptor.
 // TODO(turbofan): cache call descriptors for code stub calls.
 CallDescriptor* Linkage::GetStubCallDescriptor(
-    Isolate* isolate, Zone* zone, const CallInterfaceDescriptor& descriptor,
+    Zone* zone, const CallInterfaceDescriptor& descriptor,
     int stack_parameter_count, CallDescriptor::Flags flags,
-    Operator::Properties properties, MachineType return_type,
-    size_t return_count, Linkage::ContextSpecification context_spec) {
+    Operator::Properties properties, StubCallMode stub_mode) {
   const int register_parameter_count = descriptor.GetRegisterParameterCount();
   const int js_parameter_count =
       register_parameter_count + stack_parameter_count;
-  const int context_count = context_spec == kPassContext ? 1 : 0;
+  const int context_count = descriptor.HasContextParameter() ? 1 : 0;
   const size_t parameter_count =
       static_cast<size_t>(js_parameter_count + context_count);
 
+  size_t return_count = descriptor.GetReturnCount();
   LocationSignature::Builder locations(zone, return_count, parameter_count);
 
   // Add returns.
   if (locations.return_count_ > 0) {
-    locations.AddReturn(regloc(kReturnRegister0, return_type));
+    locations.AddReturn(regloc(kReturnRegister0, descriptor.GetReturnType(0)));
   }
   if (locations.return_count_ > 1) {
-    locations.AddReturn(regloc(kReturnRegister1, return_type));
+    locations.AddReturn(regloc(kReturnRegister1, descriptor.GetReturnType(1)));
   }
   if (locations.return_count_ > 2) {
-    locations.AddReturn(regloc(kReturnRegister2, return_type));
+    locations.AddReturn(regloc(kReturnRegister2, descriptor.GetReturnType(2)));
   }
 
   // Add parameters in registers and on the stack.
@@ -391,57 +385,39 @@ CallDescriptor* Linkage::GetStubCallDescriptor(
     locations.AddParam(regloc(kContextRegister, MachineType::AnyTagged()));
   }
 
-  // The target for stub calls is a code object.
-  MachineType target_type = MachineType::AnyTagged();
-  LinkageLocation target_loc =
-      LinkageLocation::ForAnyRegister(MachineType::AnyTagged());
-  return new (zone) CallDescriptor(     // --
-      CallDescriptor::kCallCodeObject,  // kind
-      target_type,                      // target MachineType
-      target_loc,                       // target location
-      locations.Build(),                // location_sig
-      stack_parameter_count,            // stack_parameter_count
-      properties,                       // properties
-      kNoCalleeSaved,                   // callee-saved registers
-      kNoCalleeSaved,                   // callee-saved fp
-      CallDescriptor::kCanUseRoots |    // flags
-          flags,                        // flags
-      descriptor.DebugName(isolate), descriptor.allocatable_registers());
-}
-
-// static
-CallDescriptor* Linkage::GetAllocateCallDescriptor(Zone* zone) {
-  LocationSignature::Builder locations(zone, 1, 1);
-
-  locations.AddParam(regloc(kAllocateSizeRegister, MachineType::Int32()));
-
-  locations.AddReturn(regloc(kReturnRegister0, MachineType::AnyTagged()));
-
-  // The target for allocate calls is a code object.
-  MachineType target_type = MachineType::AnyTagged();
-  LinkageLocation target_loc =
-      LinkageLocation::ForAnyRegister(MachineType::AnyTagged());
-  return new (zone) CallDescriptor(     // --
-      CallDescriptor::kCallCodeObject,  // kind
-      target_type,                      // target MachineType
-      target_loc,                       // target location
-      locations.Build(),                // location_sig
-      0,                                // stack_parameter_count
-      Operator::kNoThrow,               // properties
-      kNoCalleeSaved,                   // callee-saved registers
-      kNoCalleeSaved,                   // callee-saved fp
-      CallDescriptor::kCanUseRoots,     // flags
-      "Allocate");
+  // The target for stub calls depends on the requested mode.
+  CallDescriptor::Kind kind = stub_mode == StubCallMode::kCallWasmRuntimeStub
+                                  ? CallDescriptor::kCallWasmFunction
+                                  : CallDescriptor::kCallCodeObject;
+  MachineType target_type = stub_mode == StubCallMode::kCallWasmRuntimeStub
+                                ? MachineType::Pointer()
+                                : MachineType::AnyTagged();
+  LinkageLocation target_loc = LinkageLocation::ForAnyRegister(target_type);
+  return new (zone) CallDescriptor(          // --
+      kind,                                  // kind
+      target_type,                           // target MachineType
+      target_loc,                            // target location
+      locations.Build(),                     // location_sig
+      stack_parameter_count,                 // stack_parameter_count
+      properties,                            // properties
+      kNoCalleeSaved,                        // callee-saved registers
+      kNoCalleeSaved,                        // callee-saved fp
+      CallDescriptor::kCanUseRoots | flags,  // flags
+      descriptor.DebugName(),                // debug name
+      descriptor.allocatable_registers());
 }
 
 // static
 CallDescriptor* Linkage::GetBytecodeDispatchCallDescriptor(
-    Isolate* isolate, Zone* zone, const CallInterfaceDescriptor& descriptor,
+    Zone* zone, const CallInterfaceDescriptor& descriptor,
     int stack_parameter_count) {
   const int register_parameter_count = descriptor.GetRegisterParameterCount();
   const int parameter_count = register_parameter_count + stack_parameter_count;
 
-  LocationSignature::Builder locations(zone, 0, parameter_count);
+  DCHECK_EQ(descriptor.GetReturnCount(), 1);
+  LocationSignature::Builder locations(zone, 1, parameter_count);
+
+  locations.AddReturn(regloc(kReturnRegister0, descriptor.GetReturnType(0)));
 
   // Add parameters in registers and on the stack.
   for (int i = 0; i < parameter_count; i++) {
@@ -473,7 +449,7 @@ CallDescriptor* Linkage::GetBytecodeDispatchCallDescriptor(
       kNoCalleeSaved,                // callee-saved registers
       kNoCalleeSaved,                // callee-saved fp
       kFlags,                        // flags
-      descriptor.DebugName(isolate));
+      descriptor.DebugName());
 }
 
 LinkageLocation Linkage::GetOsrValueLocation(int index) const {
@@ -500,26 +476,55 @@ LinkageLocation Linkage::GetOsrValueLocation(int index) const {
   }
 }
 
+namespace {
+inline bool IsTaggedReg(const LinkageLocation& loc, Register reg) {
+  return loc.IsRegister() && loc.AsRegister() == reg.code() &&
+         loc.GetType().representation() ==
+             MachineRepresentation::kTaggedPointer;
+}
+}  // namespace
 
 bool Linkage::ParameterHasSecondaryLocation(int index) const {
-  if (!incoming_->IsJSFunctionCall()) return false;
-  LinkageLocation loc = GetParameterLocation(index);
-  return (loc == regloc(kJSFunctionRegister, MachineType::AnyTagged()) ||
-          loc == regloc(kContextRegister, MachineType::AnyTagged()));
+  // TODO(titzer): this should be configurable, not call-type specific.
+  if (incoming_->IsJSFunctionCall()) {
+    LinkageLocation loc = GetParameterLocation(index);
+    return IsTaggedReg(loc, kJSFunctionRegister) ||
+           IsTaggedReg(loc, kContextRegister);
+  }
+  if (incoming_->IsWasmFunctionCall()) {
+    LinkageLocation loc = GetParameterLocation(index);
+    return IsTaggedReg(loc, kWasmInstanceRegister);
+  }
+  return false;
 }
 
 LinkageLocation Linkage::GetParameterSecondaryLocation(int index) const {
+  // TODO(titzer): these constants are necessary due to offset/slot# mismatch
+  static const int kJSContextSlot = 2 + StandardFrameConstants::kCPSlotCount;
+  static const int kJSFunctionSlot = 3 + StandardFrameConstants::kCPSlotCount;
+  static const int kWasmInstanceSlot = 3 + StandardFrameConstants::kCPSlotCount;
+
   DCHECK(ParameterHasSecondaryLocation(index));
   LinkageLocation loc = GetParameterLocation(index);
 
-  if (loc == regloc(kJSFunctionRegister, MachineType::AnyTagged())) {
-    return LinkageLocation::ForCalleeFrameSlot(Frame::kJSFunctionSlot,
-                                               MachineType::AnyTagged());
-  } else {
-    DCHECK(loc == regloc(kContextRegister, MachineType::AnyTagged()));
-    return LinkageLocation::ForCalleeFrameSlot(Frame::kContextSlot,
+  // TODO(titzer): this should be configurable, not call-type specific.
+  if (incoming_->IsJSFunctionCall()) {
+    if (IsTaggedReg(loc, kJSFunctionRegister)) {
+      return LinkageLocation::ForCalleeFrameSlot(kJSFunctionSlot,
+                                                 MachineType::AnyTagged());
+    } else {
+      DCHECK(IsTaggedReg(loc, kContextRegister));
+      return LinkageLocation::ForCalleeFrameSlot(kJSContextSlot,
+                                                 MachineType::AnyTagged());
+    }
+  }
+  if (incoming_->IsWasmFunctionCall()) {
+    DCHECK(IsTaggedReg(loc, kWasmInstanceRegister));
+    return LinkageLocation::ForCalleeFrameSlot(kWasmInstanceSlot,
                                                MachineType::AnyTagged());
   }
+  UNREACHABLE();
+  return LinkageLocation::ForCalleeFrameSlot(0, MachineType::AnyTagged());
 }
 
 
diff --git a/deps/v8/src/compiler/linkage.h b/deps/v8/src/compiler/linkage.h
index d07e86d5b5eb15..e8c15123d403c5 100644
--- a/deps/v8/src/compiler/linkage.h
+++ b/deps/v8/src/compiler/linkage.h
@@ -14,6 +14,7 @@
 #include "src/machine-type.h"
 #include "src/reglist.h"
 #include "src/runtime/runtime.h"
+#include "src/signature.h"
 #include "src/zone/zone.h"
 
 namespace v8 {
@@ -113,6 +114,8 @@ class LinkageLocation {
   }
 
   int32_t GetLocation() const {
+    // We can't use LocationField::decode here because it doesn't work for
+    // negative values!
     return static_cast<int32_t>(bit_field_ & LocationField::kMask) >>
            LocationField::kShift;
   }
@@ -221,8 +224,11 @@ class V8_EXPORT_PRIVATE CallDescriptor final
   // Returns {true} if this descriptor is a call to a JSFunction.
   bool IsJSFunctionCall() const { return kind_ == kCallJSFunction; }
 
+  // Returns {true} if this descriptor is a call to a WebAssembly function.
+  bool IsWasmFunctionCall() const { return kind_ == kCallWasmFunction; }
+
   bool RequiresFrameAsIncoming() const {
-    return IsCFunctionCall() || IsJSFunctionCall();
+    return IsCFunctionCall() || IsJSFunctionCall() || IsWasmFunctionCall();
   }
 
   // The number of return values from this call.
@@ -356,12 +362,10 @@ V8_EXPORT_PRIVATE std::ostream& operator<<(std::ostream& os,
 //                        #0          #1     #2     [...]             #n
 // Call[CodeStub]         code,       arg 1, arg 2, [...],            context
 // Call[JSFunction]       function,   rcvr,  arg 1, [...], new, #arg, context
-// Call[Runtime]          CEntryStub, arg 1, arg 2, [...], fun, #arg, context
+// Call[Runtime]          CEntry,     arg 1, arg 2, [...], fun, #arg, context
 // Call[BytecodeDispatch] address,    arg 1, arg 2, [...]
 class V8_EXPORT_PRIVATE Linkage : public NON_EXPORTED_BASE(ZoneObject) {
  public:
-  enum ContextSpecification { kNoContext, kPassContext };
-
   explicit Linkage(CallDescriptor* incoming) : incoming_(incoming) {}
 
   static CallDescriptor* ComputeIncoming(Zone* zone,
@@ -384,16 +388,13 @@ class V8_EXPORT_PRIVATE Linkage : public NON_EXPORTED_BASE(ZoneObject) {
       CallDescriptor::Flags flags);
 
   static CallDescriptor* GetStubCallDescriptor(
-      Isolate* isolate, Zone* zone, const CallInterfaceDescriptor& descriptor,
+      Zone* zone, const CallInterfaceDescriptor& descriptor,
       int stack_parameter_count, CallDescriptor::Flags flags,
       Operator::Properties properties = Operator::kNoProperties,
-      MachineType return_type = MachineType::AnyTagged(),
-      size_t return_count = 1,
-      ContextSpecification context_spec = kPassContext);
+      StubCallMode stub_mode = StubCallMode::kCallOnHeapBuiltin);
 
-  static CallDescriptor* GetAllocateCallDescriptor(Zone* zone);
   static CallDescriptor* GetBytecodeDispatchCallDescriptor(
-      Isolate* isolate, Zone* zone, const CallInterfaceDescriptor& descriptor,
+      Zone* zone, const CallInterfaceDescriptor& descriptor,
       int stack_parameter_count);
 
   // Creates a call descriptor for simplified C calls that is appropriate
diff --git a/deps/v8/src/compiler/load-elimination.cc b/deps/v8/src/compiler/load-elimination.cc
index 0dff4e0f5d20b2..c1d857035317ef 100644
--- a/deps/v8/src/compiler/load-elimination.cc
+++ b/deps/v8/src/compiler/load-elimination.cc
@@ -36,7 +36,7 @@ Node* ResolveRenames(Node* node) {
 
 bool MayAlias(Node* a, Node* b) {
   if (a == b) return true;
-  if (!NodeProperties::GetType(a)->Maybe(NodeProperties::GetType(b))) {
+  if (!NodeProperties::GetType(a).Maybe(NodeProperties::GetType(b))) {
     return false;
   }
   switch (b->opcode()) {
@@ -252,7 +252,7 @@ LoadElimination::AbstractElements::Kill(Node* object, Node* index,
         DCHECK_NOT_NULL(element.index);
         DCHECK_NOT_NULL(element.value);
         if (!MayAlias(object, element.object) ||
-            !NodeProperties::GetType(index)->Maybe(
+            !NodeProperties::GetType(index).Maybe(
                 NodeProperties::GetType(element.index))) {
           that->elements_[that->next_index_++] = element;
         }
@@ -445,12 +445,13 @@ LoadElimination::AbstractMaps const* LoadElimination::AbstractMaps::Extend(
 }
 
 void LoadElimination::AbstractMaps::Print() const {
+  StdoutStream os;
   for (auto pair : info_for_node_) {
-    PrintF("    #%d:%s\n", pair.first->id(), pair.first->op()->mnemonic());
-    OFStream os(stdout);
+    os << "    #" << pair.first->id() << ":" << pair.first->op()->mnemonic()
+       << std::endl;
     ZoneHandleSet<Map> const& maps = pair.second;
     for (size_t i = 0; i < maps.size(); ++i) {
-      os << "     - " << Brief(*maps[i]) << "\n";
+      os << "     - " << Brief(*maps[i]) << std::endl;
     }
   }
 }
@@ -928,7 +929,7 @@ Reduction LoadElimination::ReduceLoadField(Node* node) {
         // TODO(tebbi): We should insert a {TypeGuard} for the intersection of
         // these two types here once we properly handle {Type::None} everywhere.
         if (!replacement->IsDead() && NodeProperties::GetType(replacement)
-                                          ->Is(NodeProperties::GetType(node))) {
+                                          .Is(NodeProperties::GetType(node))) {
           ReplaceWithValue(node, replacement, effect);
           return Replace(replacement);
         }
@@ -955,11 +956,11 @@ Reduction LoadElimination::ReduceStoreField(Node* node) {
     DCHECK(IsAnyTagged(access.machine_type.representation()));
     // Kill all potential knowledge about the {object}s map.
     state = state->KillMaps(object, zone());
-    Type* const new_value_type = NodeProperties::GetType(new_value);
-    if (new_value_type->IsHeapConstant()) {
+    Type const new_value_type = NodeProperties::GetType(new_value);
+    if (new_value_type.IsHeapConstant()) {
       // Record the new {object} map information.
       ZoneHandleSet<Map> object_maps(
-          bit_cast<Handle<Map>>(new_value_type->AsHeapConstant()->Value()));
+          bit_cast<Handle<Map>>(new_value_type.AsHeapConstant()->Value()));
       state = state->SetMaps(object, object_maps, zone());
     }
   } else {
@@ -1016,7 +1017,7 @@ Reduction LoadElimination::ReduceLoadElement(Node* node) {
         // TODO(tebbi): We should insert a {TypeGuard} for the intersection of
         // these two types here once we properly handle {Type::None} everywhere.
         if (!replacement->IsDead() && NodeProperties::GetType(replacement)
-                                          ->Is(NodeProperties::GetType(node))) {
+                                          .Is(NodeProperties::GetType(node))) {
           ReplaceWithValue(node, replacement, effect);
           return Replace(replacement);
         }
@@ -1368,6 +1369,8 @@ CommonOperatorBuilder* LoadElimination::common() const {
 
 Graph* LoadElimination::graph() const { return jsgraph()->graph(); }
 
+Isolate* LoadElimination::isolate() const { return jsgraph()->isolate(); }
+
 Factory* LoadElimination::factory() const { return jsgraph()->factory(); }
 
 }  // namespace compiler
diff --git a/deps/v8/src/compiler/load-elimination.h b/deps/v8/src/compiler/load-elimination.h
index f853c8f953bbca..d3b1b5c14ad4ad 100644
--- a/deps/v8/src/compiler/load-elimination.h
+++ b/deps/v8/src/compiler/load-elimination.h
@@ -302,6 +302,7 @@ class V8_EXPORT_PRIVATE LoadElimination final
 
   CommonOperatorBuilder* common() const;
   AbstractState const* empty_state() const { return &empty_state_; }
+  Isolate* isolate() const;
   Factory* factory() const;
   Graph* graph() const;
   JSGraph* jsgraph() const { return jsgraph_; }
diff --git a/deps/v8/src/compiler/loop-peeling.cc b/deps/v8/src/compiler/loop-peeling.cc
index ae5b0dfbaca42b..6cf1b96ad43967 100644
--- a/deps/v8/src/compiler/loop-peeling.cc
+++ b/deps/v8/src/compiler/loop-peeling.cc
@@ -7,6 +7,7 @@
 #include "src/compiler/compiler-source-position-table.h"
 #include "src/compiler/graph.h"
 #include "src/compiler/node-marker.h"
+#include "src/compiler/node-origin-table.h"
 #include "src/compiler/node-properties.h"
 #include "src/compiler/node.h"
 #include "src/zone/zone.h"
@@ -123,12 +124,14 @@ struct Peeling {
   }
 
   void CopyNodes(Graph* graph, Zone* tmp_zone_, Node* dead, NodeRange nodes,
-                 SourcePositionTable* source_positions) {
+                 SourcePositionTable* source_positions,
+                 NodeOriginTable* node_origins) {
     NodeVector inputs(tmp_zone_);
     // Copy all the nodes first.
     for (Node* node : nodes) {
       SourcePositionTable::Scope position(
           source_positions, source_positions->GetSourcePosition(node));
+      NodeOriginTable::Scope origin_scope(node_origins, "copy nodes", node);
       inputs.clear();
       for (Node* input : node->inputs()) {
         inputs.push_back(map(input));
@@ -226,7 +229,7 @@ PeeledIteration* LoopPeeler::Peel(LoopTree::Loop* loop) {
 
   // Copy all the nodes of loop body for the peeled iteration.
   peeling.CopyNodes(graph_, tmp_zone_, dead, loop_tree_->BodyNodes(loop),
-                    source_positions_);
+                    source_positions_, node_origins_);
 
   //============================================================================
   // Replace the entry to the loop with the output of the peeled iteration.
diff --git a/deps/v8/src/compiler/loop-peeling.h b/deps/v8/src/compiler/loop-peeling.h
index cd08900dcd7fa0..150505a5e577d2 100644
--- a/deps/v8/src/compiler/loop-peeling.h
+++ b/deps/v8/src/compiler/loop-peeling.h
@@ -13,6 +13,7 @@ namespace v8 {
 namespace internal {
 namespace compiler {
 
+class NodeOriginTable;
 class SourcePositionTable;
 
 // Represents the output of peeling a loop, which is basically the mapping
@@ -34,12 +35,14 @@ class CommonOperatorBuilder;
 class V8_EXPORT_PRIVATE LoopPeeler {
  public:
   LoopPeeler(Graph* graph, CommonOperatorBuilder* common, LoopTree* loop_tree,
-             Zone* tmp_zone, SourcePositionTable* source_positions)
+             Zone* tmp_zone, SourcePositionTable* source_positions,
+             NodeOriginTable* node_origins)
       : graph_(graph),
         common_(common),
         loop_tree_(loop_tree),
         tmp_zone_(tmp_zone),
-        source_positions_(source_positions) {}
+        source_positions_(source_positions),
+        node_origins_(node_origins) {}
   bool CanPeel(LoopTree::Loop* loop);
   PeeledIteration* Peel(LoopTree::Loop* loop);
   void PeelInnerLoopsOfTree();
@@ -53,6 +56,7 @@ class V8_EXPORT_PRIVATE LoopPeeler {
   LoopTree* const loop_tree_;
   Zone* const tmp_zone_;
   SourcePositionTable* const source_positions_;
+  NodeOriginTable* const node_origins_;
 
   void PeelInnerLoops(LoopTree::Loop* loop);
 };
diff --git a/deps/v8/src/compiler/loop-variable-optimizer.cc b/deps/v8/src/compiler/loop-variable-optimizer.cc
index c1938ca30452e1..fe5b8c7889bdd8 100644
--- a/deps/v8/src/compiler/loop-variable-optimizer.cc
+++ b/deps/v8/src/compiler/loop-variable-optimizer.cc
@@ -77,10 +77,9 @@ void LoopVariableOptimizer::Run() {
 void InductionVariable::AddUpperBound(Node* bound,
                                       InductionVariable::ConstraintKind kind) {
   if (FLAG_trace_turbo_loop) {
-    OFStream os(stdout);
-    os << "New upper bound for " << phi()->id() << " (loop "
-       << NodeProperties::GetControlInput(phi())->id() << "): " << *bound
-       << std::endl;
+    StdoutStream{} << "New upper bound for " << phi()->id() << " (loop "
+                   << NodeProperties::GetControlInput(phi())->id()
+                   << "): " << *bound << std::endl;
   }
   upper_bounds_.push_back(Bound(bound, kind));
 }
@@ -88,9 +87,9 @@ void InductionVariable::AddUpperBound(Node* bound,
 void InductionVariable::AddLowerBound(Node* bound,
                                       InductionVariable::ConstraintKind kind) {
   if (FLAG_trace_turbo_loop) {
-    OFStream os(stdout);
-    os << "New lower bound for " << phi()->id() << " (loop "
-       << NodeProperties::GetControlInput(phi())->id() << "): " << *bound;
+    StdoutStream{} << "New lower bound for " << phi()->id() << " (loop "
+                   << NodeProperties::GetControlInput(phi())->id()
+                   << "): " << *bound;
   }
   lower_bounds_.push_back(Bound(bound, kind));
 }
@@ -324,9 +323,9 @@ void LoopVariableOptimizer::ChangeToPhisAndInsertGuards() {
       // If the backedge is not a subtype of the phi's type, we insert a sigma
       // to get the typing right.
       Node* backedge_value = induction_var->phi()->InputAt(1);
-      Type* backedge_type = NodeProperties::GetType(backedge_value);
-      Type* phi_type = NodeProperties::GetType(induction_var->phi());
-      if (!backedge_type->Is(phi_type)) {
+      Type backedge_type = NodeProperties::GetType(backedge_value);
+      Type phi_type = NodeProperties::GetType(induction_var->phi());
+      if (!backedge_type.Is(phi_type)) {
         Node* loop = NodeProperties::GetControlInput(induction_var->phi());
         Node* backedge_control = loop->InputAt(1);
         Node* backedge_effect =
diff --git a/deps/v8/src/compiler/machine-graph-verifier.cc b/deps/v8/src/compiler/machine-graph-verifier.cc
index 4418a2813fcc2a..55ef35d231b0c4 100644
--- a/deps/v8/src/compiler/machine-graph-verifier.cc
+++ b/deps/v8/src/compiler/machine-graph-verifier.cc
@@ -120,7 +120,6 @@ class MachineRepresentationInferrer {
           case IrOpcode::kLoadStackPointer:
           case IrOpcode::kLoadFramePointer:
           case IrOpcode::kLoadParentFramePointer:
-          case IrOpcode::kLoadRootsPointer:
             representation_vector_[node->id()] =
                 MachineType::PointerRepresentation();
             break;
@@ -175,15 +174,20 @@ class MachineRepresentationInferrer {
           case IrOpcode::kChangeInt32ToTagged:
           case IrOpcode::kChangeUint32ToTagged:
           case IrOpcode::kBitcastWordToTagged:
-          case IrOpcode::kPoisonOnSpeculationTagged:
+          case IrOpcode::kTaggedPoisonOnSpeculation:
             representation_vector_[node->id()] = MachineRepresentation::kTagged;
             break;
+          case IrOpcode::kWord32PoisonOnSpeculation:
+            representation_vector_[node->id()] = MachineRepresentation::kWord32;
+            break;
+          case IrOpcode::kWord64PoisonOnSpeculation:
+            representation_vector_[node->id()] = MachineRepresentation::kWord64;
+            break;
           case IrOpcode::kExternalConstant:
             representation_vector_[node->id()] =
                 MachineType::PointerRepresentation();
             break;
           case IrOpcode::kBitcastTaggedToWord:
-          case IrOpcode::kPoisonOnSpeculationWord:
             representation_vector_[node->id()] =
                 MachineType::PointerRepresentation();
             break;
@@ -248,6 +252,7 @@ class MachineRepresentationInferrer {
           case IrOpcode::kRoundUint32ToFloat32:
           case IrOpcode::kRoundInt64ToFloat32:
           case IrOpcode::kRoundUint64ToFloat32:
+          case IrOpcode::kBitcastInt32ToFloat32:
           case IrOpcode::kFloat32Constant:
           case IrOpcode::kTruncateFloat64ToFloat32:
             MACHINE_FLOAT32_BINOP_LIST(LABEL)
@@ -261,6 +266,8 @@ class MachineRepresentationInferrer {
           case IrOpcode::kChangeFloat32ToFloat64:
           case IrOpcode::kChangeInt32ToFloat64:
           case IrOpcode::kChangeUint32ToFloat64:
+          case IrOpcode::kFloat64InsertLowWord32:
+          case IrOpcode::kFloat64InsertHighWord32:
           case IrOpcode::kFloat64Constant:
           case IrOpcode::kFloat64SilenceNaN:
             MACHINE_FLOAT64_BINOP_LIST(LABEL)
@@ -334,12 +341,19 @@ class MachineRepresentationChecker {
             break;
           case IrOpcode::kBitcastWordToTagged:
           case IrOpcode::kBitcastWordToTaggedSigned:
-          case IrOpcode::kPoisonOnSpeculationWord:
             CheckValueInputRepresentationIs(
                 node, 0, MachineType::PointerRepresentation());
             break;
+          case IrOpcode::kWord32PoisonOnSpeculation:
+            CheckValueInputRepresentationIs(node, 0,
+                                            MachineRepresentation::kWord32);
+            break;
+          case IrOpcode::kWord64PoisonOnSpeculation:
+            CheckValueInputRepresentationIs(node, 0,
+                                            MachineRepresentation::kWord64);
+            break;
           case IrOpcode::kBitcastTaggedToWord:
-          case IrOpcode::kPoisonOnSpeculationTagged:
+          case IrOpcode::kTaggedPoisonOnSpeculation:
             CheckValueInputIsTagged(node, 0);
             break;
           case IrOpcode::kTruncateFloat64ToWord32:
@@ -395,6 +409,7 @@ class MachineRepresentationChecker {
           case IrOpcode::kChangeUint32ToFloat64:
           case IrOpcode::kRoundInt32ToFloat32:
           case IrOpcode::kRoundUint32ToFloat32:
+          case IrOpcode::kBitcastInt32ToFloat32:
           case IrOpcode::kChangeInt32ToInt64:
           case IrOpcode::kChangeUint32ToUint64:
             MACHINE_UNOP_32_LIST(LABEL) { CheckValueInputForInt32Op(node, 0); }
@@ -458,6 +473,11 @@ class MachineRepresentationChecker {
             }
             break;
 #undef LABEL
+          case IrOpcode::kFloat64InsertLowWord32:
+          case IrOpcode::kFloat64InsertHighWord32:
+            CheckValueInputForFloat64Op(node, 0);
+            CheckValueInputForInt32Op(node, 1);
+            break;
           case IrOpcode::kParameter:
           case IrOpcode::kProjection:
             break;
diff --git a/deps/v8/src/compiler/machine-graph.cc b/deps/v8/src/compiler/machine-graph.cc
new file mode 100644
index 00000000000000..0fcd97ff90d43f
--- /dev/null
+++ b/deps/v8/src/compiler/machine-graph.cc
@@ -0,0 +1,99 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "src/compiler/machine-graph.h"
+
+#include "src/compiler/node-properties.h"
+
+namespace v8 {
+namespace internal {
+namespace compiler {
+
+Node* MachineGraph::Int32Constant(int32_t value) {
+  Node** loc = cache_.FindInt32Constant(value);
+  if (*loc == nullptr) {
+    *loc = graph()->NewNode(common()->Int32Constant(value));
+  }
+  return *loc;
+}
+
+Node* MachineGraph::Int64Constant(int64_t value) {
+  Node** loc = cache_.FindInt64Constant(value);
+  if (*loc == nullptr) {
+    *loc = graph()->NewNode(common()->Int64Constant(value));
+  }
+  return *loc;
+}
+
+Node* MachineGraph::IntPtrConstant(intptr_t value) {
+  return machine()->Is32() ? Int32Constant(static_cast<int32_t>(value))
+                           : Int64Constant(static_cast<int64_t>(value));
+}
+
+Node* MachineGraph::RelocatableInt32Constant(int32_t value,
+                                             RelocInfo::Mode rmode) {
+  Node** loc = cache_.FindRelocatableInt32Constant(
+      value, static_cast<RelocInfoMode>(rmode));
+  if (*loc == nullptr) {
+    *loc = graph()->NewNode(common()->RelocatableInt32Constant(value, rmode));
+  }
+  return *loc;
+}
+
+Node* MachineGraph::RelocatableInt64Constant(int64_t value,
+                                             RelocInfo::Mode rmode) {
+  Node** loc = cache_.FindRelocatableInt64Constant(
+      value, static_cast<RelocInfoMode>(rmode));
+  if (*loc == nullptr) {
+    *loc = graph()->NewNode(common()->RelocatableInt64Constant(value, rmode));
+  }
+  return *loc;
+}
+
+Node* MachineGraph::RelocatableIntPtrConstant(intptr_t value,
+                                              RelocInfo::Mode rmode) {
+  return kPointerSize == 8
+             ? RelocatableInt64Constant(value, rmode)
+             : RelocatableInt32Constant(static_cast<int>(value), rmode);
+}
+
+Node* MachineGraph::Float32Constant(float value) {
+  Node** loc = cache_.FindFloat32Constant(value);
+  if (*loc == nullptr) {
+    *loc = graph()->NewNode(common()->Float32Constant(value));
+  }
+  return *loc;
+}
+
+Node* MachineGraph::Float64Constant(double value) {
+  Node** loc = cache_.FindFloat64Constant(value);
+  if (*loc == nullptr) {
+    *loc = graph()->NewNode(common()->Float64Constant(value));
+  }
+  return *loc;
+}
+
+Node* MachineGraph::PointerConstant(intptr_t value) {
+  Node** loc = cache_.FindPointerConstant(value);
+  if (*loc == nullptr) {
+    *loc = graph()->NewNode(common()->PointerConstant(value));
+  }
+  return *loc;
+}
+
+Node* MachineGraph::ExternalConstant(ExternalReference reference) {
+  Node** loc = cache_.FindExternalConstant(reference);
+  if (*loc == nullptr) {
+    *loc = graph()->NewNode(common()->ExternalConstant(reference));
+  }
+  return *loc;
+}
+
+Node* MachineGraph::ExternalConstant(Runtime::FunctionId function_id) {
+  return ExternalConstant(ExternalReference::Create(function_id));
+}
+
+}  // namespace compiler
+}  // namespace internal
+}  // namespace v8
diff --git a/deps/v8/src/compiler/machine-graph.h b/deps/v8/src/compiler/machine-graph.h
new file mode 100644
index 00000000000000..bd20d8c50dcd49
--- /dev/null
+++ b/deps/v8/src/compiler/machine-graph.h
@@ -0,0 +1,92 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef V8_COMPILER_MACHINE_GRAPH_H_
+#define V8_COMPILER_MACHINE_GRAPH_H_
+
+#include "src/assembler.h"
+#include "src/base/compiler-specific.h"
+#include "src/compiler/common-node-cache.h"
+#include "src/compiler/common-operator.h"
+#include "src/compiler/graph.h"
+#include "src/compiler/machine-operator.h"
+#include "src/globals.h"
+
+namespace v8 {
+namespace internal {
+namespace compiler {
+
+// Implements a facade on a Graph, enhancing the graph with machine-specific
+// notions, including a builder for common and machine operators, as well
+// as caching primitive constants.
+class V8_EXPORT_PRIVATE MachineGraph : public NON_EXPORTED_BASE(ZoneObject) {
+ public:
+  MachineGraph(Graph* graph, CommonOperatorBuilder* common,
+               MachineOperatorBuilder* machine)
+      : graph_(graph), common_(common), machine_(machine), cache_(zone()) {}
+
+  // Creates a Int32Constant node, usually canonicalized.
+  Node* Int32Constant(int32_t value);
+  Node* Uint32Constant(uint32_t value) {
+    return Int32Constant(bit_cast<int32_t>(value));
+  }
+
+  // Creates a Int64Constant node, usually canonicalized.
+  Node* Int64Constant(int64_t value);
+  Node* Uint64Constant(uint64_t value) {
+    return Int64Constant(bit_cast<int64_t>(value));
+  }
+
+  // Creates a Int32Constant/Int64Constant node, depending on the word size of
+  // the target machine.
+  // TODO(turbofan): Code using Int32Constant/Int64Constant to store pointer
+  // constants is probably not serializable.
+  Node* IntPtrConstant(intptr_t value);
+
+  Node* RelocatableInt32Constant(int32_t value, RelocInfo::Mode rmode);
+  Node* RelocatableInt64Constant(int64_t value, RelocInfo::Mode rmode);
+  Node* RelocatableIntPtrConstant(intptr_t value, RelocInfo::Mode rmode);
+
+  // Creates a Float32Constant node, usually canonicalized.
+  Node* Float32Constant(float value);
+
+  // Creates a Float64Constant node, usually canonicalized.
+  Node* Float64Constant(double value);
+
+  // Creates a PointerConstant node.
+  Node* PointerConstant(intptr_t value);
+  template <typename T>
+  Node* PointerConstant(T* value) {
+    return PointerConstant(bit_cast<intptr_t>(value));
+  }
+
+  // Creates an ExternalConstant node, usually canonicalized.
+  Node* ExternalConstant(ExternalReference ref);
+  Node* ExternalConstant(Runtime::FunctionId function_id);
+
+  // Global cache of the dead node.
+  Node* Dead() {
+    return Dead_ ? Dead_ : Dead_ = graph_->NewNode(common_->Dead());
+  }
+
+  CommonOperatorBuilder* common() const { return common_; }
+  MachineOperatorBuilder* machine() const { return machine_; }
+  Graph* graph() const { return graph_; }
+  Zone* zone() const { return graph()->zone(); }
+
+ protected:
+  Graph* graph_;
+  CommonOperatorBuilder* common_;
+  MachineOperatorBuilder* machine_;
+  CommonNodeCache cache_;
+  Node* Dead_ = nullptr;
+
+  DISALLOW_COPY_AND_ASSIGN(MachineGraph);
+};
+
+}  // namespace compiler
+}  // namespace internal
+}  // namespace v8
+
+#endif  // V8_COMPILER_MACHINE_GRAPH_H_
diff --git a/deps/v8/src/compiler/machine-operator-reducer.cc b/deps/v8/src/compiler/machine-operator-reducer.cc
index 1fcfa52e511a90..7fcba20e2e20ce 100644
--- a/deps/v8/src/compiler/machine-operator-reducer.cc
+++ b/deps/v8/src/compiler/machine-operator-reducer.cc
@@ -9,17 +9,18 @@
 #include "src/base/ieee754.h"
 #include "src/compiler/diamond.h"
 #include "src/compiler/graph.h"
-#include "src/compiler/js-graph.h"
+#include "src/compiler/machine-graph.h"
 #include "src/compiler/node-matchers.h"
+#include "src/compiler/node-properties.h"
 #include "src/conversions-inl.h"
 
 namespace v8 {
 namespace internal {
 namespace compiler {
 
-MachineOperatorReducer::MachineOperatorReducer(JSGraph* jsgraph,
+MachineOperatorReducer::MachineOperatorReducer(MachineGraph* mcgraph,
                                                bool allow_signalling_nan)
-    : jsgraph_(jsgraph), allow_signalling_nan_(allow_signalling_nan) {}
+    : mcgraph_(mcgraph), allow_signalling_nan_(allow_signalling_nan) {}
 
 MachineOperatorReducer::~MachineOperatorReducer() {}
 
@@ -30,12 +31,12 @@ Node* MachineOperatorReducer::Float32Constant(volatile float value) {
 
 
 Node* MachineOperatorReducer::Float64Constant(volatile double value) {
-  return jsgraph()->Float64Constant(value);
+  return mcgraph()->Float64Constant(value);
 }
 
 
 Node* MachineOperatorReducer::Int32Constant(int32_t value) {
-  return jsgraph()->Int32Constant(value);
+  return mcgraph()->Int32Constant(value);
 }
 
 
@@ -613,7 +614,7 @@ Reduction MachineOperatorReducer::Reduce(Node* node) {
     }
     case IrOpcode::kChangeFloat64ToInt32: {
       Float64Matcher m(node->InputAt(0));
-      if (m.HasValue()) return ReplaceInt32(FastD2I(m.Value()));
+      if (m.HasValue()) return ReplaceInt32(FastD2IChecked(m.Value()));
       if (m.IsChangeInt32ToFloat64()) return Replace(m.node()->InputAt(0));
       break;
     }
@@ -670,7 +671,9 @@ Reduction MachineOperatorReducer::Reduce(Node* node) {
     }
     case IrOpcode::kRoundFloat64ToInt32: {
       Float64Matcher m(node->InputAt(0));
-      if (m.HasValue()) return ReplaceInt32(static_cast<int32_t>(m.Value()));
+      if (m.HasValue()) {
+        return ReplaceInt32(DoubleToInt32(m.Value()));
+      }
       if (m.IsChangeInt32ToFloat64()) return Replace(m.node()->InputAt(0));
       break;
     }
@@ -1422,16 +1425,15 @@ Reduction MachineOperatorReducer::ReduceFloat64RoundDown(Node* node) {
 }
 
 CommonOperatorBuilder* MachineOperatorReducer::common() const {
-  return jsgraph()->common();
+  return mcgraph()->common();
 }
 
 
 MachineOperatorBuilder* MachineOperatorReducer::machine() const {
-  return jsgraph()->machine();
+  return mcgraph()->machine();
 }
 
-
-Graph* MachineOperatorReducer::graph() const { return jsgraph()->graph(); }
+Graph* MachineOperatorReducer::graph() const { return mcgraph()->graph(); }
 
 }  // namespace compiler
 }  // namespace internal
diff --git a/deps/v8/src/compiler/machine-operator-reducer.h b/deps/v8/src/compiler/machine-operator-reducer.h
index 278db5324d6539..1dc2a0a106ff2f 100644
--- a/deps/v8/src/compiler/machine-operator-reducer.h
+++ b/deps/v8/src/compiler/machine-operator-reducer.h
@@ -16,15 +16,14 @@ namespace compiler {
 
 // Forward declarations.
 class CommonOperatorBuilder;
-class JSGraph;
-
+class MachineGraph;
 
 // Performs constant folding and strength reduction on nodes that have
 // machine operators.
 class V8_EXPORT_PRIVATE MachineOperatorReducer final
     : public NON_EXPORTED_BASE(Reducer) {
  public:
-  explicit MachineOperatorReducer(JSGraph* jsgraph,
+  explicit MachineOperatorReducer(MachineGraph* mcgraph,
                                   bool allow_signalling_nan = true);
   ~MachineOperatorReducer();
 
@@ -102,11 +101,11 @@ class V8_EXPORT_PRIVATE MachineOperatorReducer final
   Reduction ReduceFloat64RoundDown(Node* node);
 
   Graph* graph() const;
-  JSGraph* jsgraph() const { return jsgraph_; }
+  MachineGraph* mcgraph() const { return mcgraph_; }
   CommonOperatorBuilder* common() const;
   MachineOperatorBuilder* machine() const;
 
-  JSGraph* jsgraph_;
+  MachineGraph* mcgraph_;
   bool allow_signalling_nan_;
 };
 
diff --git a/deps/v8/src/compiler/machine-operator.cc b/deps/v8/src/compiler/machine-operator.cc
index f26176fd80e264..8eac3ed18c0b64 100644
--- a/deps/v8/src/compiler/machine-operator.cc
+++ b/deps/v8/src/compiler/machine-operator.cc
@@ -226,7 +226,6 @@ MachineType AtomicOpRepresentationOf(Operator const* op) {
   V(LoadStackPointer, Operator::kNoProperties, 0, 0, 1)                   \
   V(LoadFramePointer, Operator::kNoProperties, 0, 0, 1)                   \
   V(LoadParentFramePointer, Operator::kNoProperties, 0, 0, 1)             \
-  V(LoadRootsPointer, Operator::kNoProperties, 0, 0, 1)                   \
   V(Int32PairAdd, Operator::kNoProperties, 4, 0, 2)                       \
   V(Int32PairSub, Operator::kNoProperties, 4, 0, 2)                       \
   V(Int32PairMul, Operator::kNoProperties, 4, 0, 2)                       \
@@ -701,21 +700,37 @@ struct MachineOperatorGlobalCache {
   };
   BitcastTaggedToWordOperator kBitcastTaggedToWord;
 
-  struct PoisonOnSpeculationTagged : public Operator {
-    PoisonOnSpeculationTagged()
-        : Operator(IrOpcode::kPoisonOnSpeculationTagged,
+  struct BitcastMaybeObjectToWordOperator : public Operator {
+    BitcastMaybeObjectToWordOperator()
+        : Operator(IrOpcode::kBitcastTaggedToWord,
+                   Operator::kEliminatable | Operator::kNoWrite,
+                   "BitcastMaybeObjectToWord", 1, 1, 1, 1, 1, 0) {}
+  };
+  BitcastMaybeObjectToWordOperator kBitcastMaybeObjectToWord;
+
+  struct TaggedPoisonOnSpeculation : public Operator {
+    TaggedPoisonOnSpeculation()
+        : Operator(IrOpcode::kTaggedPoisonOnSpeculation,
                    Operator::kEliminatable | Operator::kNoWrite,
-                   "PoisonOnSpeculationTagged", 1, 1, 1, 1, 1, 0) {}
+                   "TaggedPoisonOnSpeculation", 1, 1, 1, 1, 1, 0) {}
   };
-  PoisonOnSpeculationTagged kPoisonOnSpeculationTagged;
+  TaggedPoisonOnSpeculation kTaggedPoisonOnSpeculation;
 
-  struct PoisonOnSpeculationWord : public Operator {
-    PoisonOnSpeculationWord()
-        : Operator(IrOpcode::kPoisonOnSpeculationWord,
+  struct Word32PoisonOnSpeculation : public Operator {
+    Word32PoisonOnSpeculation()
+        : Operator(IrOpcode::kWord32PoisonOnSpeculation,
                    Operator::kEliminatable | Operator::kNoWrite,
-                   "PoisonOnSpeculationWord", 1, 1, 1, 1, 1, 0) {}
+                   "Word32PoisonOnSpeculation", 1, 1, 1, 1, 1, 0) {}
   };
-  PoisonOnSpeculationWord kPoisonOnSpeculationWord;
+  Word32PoisonOnSpeculation kWord32PoisonOnSpeculation;
+
+  struct Word64PoisonOnSpeculation : public Operator {
+    Word64PoisonOnSpeculation()
+        : Operator(IrOpcode::kWord64PoisonOnSpeculation,
+                   Operator::kEliminatable | Operator::kNoWrite,
+                   "Word64PoisonOnSpeculation", 1, 1, 1, 1, 1, 0) {}
+  };
+  Word64PoisonOnSpeculation kWord64PoisonOnSpeculation;
 
   struct SpeculationFenceOperator : public Operator {
     SpeculationFenceOperator()
@@ -912,6 +927,10 @@ const Operator* MachineOperatorBuilder::BitcastTaggedToWord() {
   return &cache_.kBitcastTaggedToWord;
 }
 
+const Operator* MachineOperatorBuilder::BitcastMaybeObjectToWord() {
+  return &cache_.kBitcastMaybeObjectToWord;
+}
+
 const Operator* MachineOperatorBuilder::DebugAbort() {
   return &cache_.kDebugAbort;
 }
@@ -1017,12 +1036,16 @@ const Operator* MachineOperatorBuilder::Word32AtomicXor(MachineType rep) {
   UNREACHABLE();
 }
 
-const Operator* MachineOperatorBuilder::PoisonOnSpeculationTagged() {
-  return &cache_.kPoisonOnSpeculationTagged;
+const Operator* MachineOperatorBuilder::TaggedPoisonOnSpeculation() {
+  return &cache_.kTaggedPoisonOnSpeculation;
+}
+
+const Operator* MachineOperatorBuilder::Word32PoisonOnSpeculation() {
+  return &cache_.kWord32PoisonOnSpeculation;
 }
 
-const Operator* MachineOperatorBuilder::PoisonOnSpeculationWord() {
-  return &cache_.kPoisonOnSpeculationWord;
+const Operator* MachineOperatorBuilder::Word64PoisonOnSpeculation() {
+  return &cache_.kWord64PoisonOnSpeculation;
 }
 
 const Operator* MachineOperatorBuilder::Word64AtomicLoad(
diff --git a/deps/v8/src/compiler/machine-operator.h b/deps/v8/src/compiler/machine-operator.h
index e3a4a6c234e5d3..65217cf2a66323 100644
--- a/deps/v8/src/compiler/machine-operator.h
+++ b/deps/v8/src/compiler/machine-operator.h
@@ -10,6 +10,7 @@
 #include "src/globals.h"
 #include "src/machine-type.h"
 #include "src/utils.h"
+#include "src/zone/zone.h"
 
 namespace v8 {
 namespace internal {
@@ -301,6 +302,10 @@ class V8_EXPORT_PRIVATE MachineOperatorBuilder final
   // This operator reinterprets the bits of a tagged pointer as word.
   const Operator* BitcastTaggedToWord();
 
+  // This operator reinterprets the bits of a tagged MaybeObject pointer as
+  // word.
+  const Operator* BitcastMaybeObjectToWord();
+
   // This operator reinterprets the bits of a word as tagged pointer.
   const Operator* BitcastWordToTagged();
 
@@ -601,17 +606,15 @@ class V8_EXPORT_PRIVATE MachineOperatorBuilder final
   const Operator* StackSlot(MachineRepresentation rep, int alignment = 0);
 
   // Destroy value by masking when misspeculating.
-  const Operator* PoisonOnSpeculationTagged();
-  const Operator* PoisonOnSpeculationWord();
+  const Operator* TaggedPoisonOnSpeculation();
+  const Operator* Word32PoisonOnSpeculation();
+  const Operator* Word64PoisonOnSpeculation();
 
   // Access to the machine stack.
   const Operator* LoadStackPointer();
   const Operator* LoadFramePointer();
   const Operator* LoadParentFramePointer();
 
-  // Access to the root register.
-  const Operator* LoadRootsPointer();
-
   // atomic-load [base + index]
   const Operator* Word32AtomicLoad(LoadRepresentation rep);
   // atomic-load [base + index]
@@ -666,25 +669,26 @@ class V8_EXPORT_PRIVATE MachineOperatorBuilder final
 
 // Pseudo operators that translate to 32/64-bit operators depending on the
 // word-size of the target machine assumed by this builder.
-#define PSEUDO_OP_LIST(V) \
-  V(Word, And)            \
-  V(Word, Or)             \
-  V(Word, Xor)            \
-  V(Word, Shl)            \
-  V(Word, Shr)            \
-  V(Word, Sar)            \
-  V(Word, Ror)            \
-  V(Word, Clz)            \
-  V(Word, Equal)          \
-  V(Int, Add)             \
-  V(Int, Sub)             \
-  V(Int, Mul)             \
-  V(Int, Div)             \
-  V(Int, Mod)             \
-  V(Int, LessThan)        \
-  V(Int, LessThanOrEqual) \
-  V(Uint, Div)            \
-  V(Uint, LessThan)       \
+#define PSEUDO_OP_LIST(V)      \
+  V(Word, And)                 \
+  V(Word, Or)                  \
+  V(Word, Xor)                 \
+  V(Word, Shl)                 \
+  V(Word, Shr)                 \
+  V(Word, Sar)                 \
+  V(Word, Ror)                 \
+  V(Word, Clz)                 \
+  V(Word, Equal)               \
+  V(Word, PoisonOnSpeculation) \
+  V(Int, Add)                  \
+  V(Int, Sub)                  \
+  V(Int, Mul)                  \
+  V(Int, Div)                  \
+  V(Int, Mod)                  \
+  V(Int, LessThan)             \
+  V(Int, LessThanOrEqual)      \
+  V(Uint, Div)                 \
+  V(Uint, LessThan)            \
   V(Uint, Mod)
 #define PSEUDO_OP(Prefix, Suffix)                                \
   const Operator* Prefix##Suffix() {                             \
diff --git a/deps/v8/src/compiler/memory-optimizer.cc b/deps/v8/src/compiler/memory-optimizer.cc
index 3cc64ac73dd57f..e7ec1509857985 100644
--- a/deps/v8/src/compiler/memory-optimizer.cc
+++ b/deps/v8/src/compiler/memory-optimizer.cc
@@ -16,7 +16,7 @@ namespace internal {
 namespace compiler {
 
 MemoryOptimizer::MemoryOptimizer(JSGraph* jsgraph, Zone* zone,
-                                 PoisoningMitigationLevel poisoning_enabled,
+                                 PoisoningMitigationLevel poisoning_level,
                                  AllocationFolding allocation_folding)
     : jsgraph_(jsgraph),
       empty_state_(AllocationState::Empty(zone)),
@@ -24,7 +24,7 @@ MemoryOptimizer::MemoryOptimizer(JSGraph* jsgraph, Zone* zone,
       tokens_(zone),
       zone_(zone),
       graph_assembler_(jsgraph, nullptr, nullptr, zone),
-      poisoning_enabled_(poisoning_enabled),
+      poisoning_level_(poisoning_level),
       allocation_folding_(allocation_folding) {}
 
 void MemoryOptimizer::Optimize() {
@@ -107,6 +107,8 @@ void MemoryOptimizer::VisitNode(Node* node, AllocationState const* state) {
     case IrOpcode::kUnsafePointerAdd:
     case IrOpcode::kDebugBreak:
     case IrOpcode::kUnreachable:
+    case IrOpcode::kWord32PoisonOnSpeculation:
+    case IrOpcode::kWord64PoisonOnSpeculation:
       return VisitOtherEffect(node, state);
     default:
       break;
@@ -234,8 +236,9 @@ void MemoryOptimizer::VisitAllocateRaw(Node* node,
                                      : __
                                        AllocateInOldSpaceStubConstant();
         if (!allocate_operator_.is_set()) {
-          auto call_descriptor =
-              Linkage::GetAllocateCallDescriptor(graph()->zone());
+          auto call_descriptor = Linkage::GetStubCallDescriptor(
+              graph()->zone(), AllocateDescriptor{}, 0,
+              CallDescriptor::kCanUseRoots, Operator::kNoThrow);
           allocate_operator_.set(common()->Call(call_descriptor));
         }
         Node* vfalse = __ Call(allocate_operator_.get(), target, size);
@@ -289,8 +292,9 @@ void MemoryOptimizer::VisitAllocateRaw(Node* node,
                                  : __
                                    AllocateInOldSpaceStubConstant();
     if (!allocate_operator_.is_set()) {
-      auto call_descriptor =
-          Linkage::GetAllocateCallDescriptor(graph()->zone());
+      auto call_descriptor = Linkage::GetStubCallDescriptor(
+          graph()->zone(), AllocateDescriptor{}, 0,
+          CallDescriptor::kCanUseRoots, Operator::kNoThrow);
       allocate_operator_.set(common()->Call(call_descriptor));
     }
     __ Goto(&done, __ Call(allocate_operator_.get(), target, size));
@@ -353,7 +357,7 @@ void MemoryOptimizer::VisitLoadElement(Node* node,
   ElementAccess const& access = ElementAccessOf(node->op());
   Node* index = node->InputAt(1);
   node->ReplaceInput(1, ComputeIndex(access, index));
-  if (poisoning_enabled_ == PoisoningMitigationLevel::kOn &&
+  if (NeedsPoisoning(access.load_sensitivity) &&
       access.machine_type.representation() !=
           MachineRepresentation::kTaggedPointer) {
     NodeProperties::ChangeOp(node,
@@ -369,7 +373,7 @@ void MemoryOptimizer::VisitLoadField(Node* node, AllocationState const* state) {
   FieldAccess const& access = FieldAccessOf(node->op());
   Node* offset = jsgraph()->IntPtrConstant(access.offset - access.tag());
   node->InsertInput(graph()->zone(), 1, offset);
-  if (poisoning_enabled_ == PoisoningMitigationLevel::kOn &&
+  if (NeedsPoisoning(access.load_sensitivity) &&
       access.machine_type.representation() !=
           MachineRepresentation::kTaggedPointer) {
     NodeProperties::ChangeOp(node,
@@ -542,6 +546,21 @@ MachineOperatorBuilder* MemoryOptimizer::machine() const {
   return jsgraph()->machine();
 }
 
+bool MemoryOptimizer::NeedsPoisoning(LoadSensitivity load_sensitivity) const {
+  // Safe loads do not need poisoning.
+  if (load_sensitivity == LoadSensitivity::kSafe) return false;
+
+  switch (poisoning_level_) {
+    case PoisoningMitigationLevel::kDontPoison:
+      return false;
+    case PoisoningMitigationLevel::kPoisonAll:
+      return true;
+    case PoisoningMitigationLevel::kPoisonCriticalOnly:
+      return load_sensitivity == LoadSensitivity::kCritical;
+  }
+  UNREACHABLE();
+}
+
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/src/compiler/memory-optimizer.h b/deps/v8/src/compiler/memory-optimizer.h
index 28fdb4cc985da4..5ea79556f4fcea 100644
--- a/deps/v8/src/compiler/memory-optimizer.h
+++ b/deps/v8/src/compiler/memory-optimizer.h
@@ -34,7 +34,7 @@ class MemoryOptimizer final {
   enum class AllocationFolding { kDoAllocationFolding, kDontAllocationFolding };
 
   MemoryOptimizer(JSGraph* jsgraph, Zone* zone,
-                  PoisoningMitigationLevel poisoning_enabled,
+                  PoisoningMitigationLevel poisoning_level,
                   AllocationFolding allocation_folding);
   ~MemoryOptimizer() {}
 
@@ -130,6 +130,8 @@ class MemoryOptimizer final {
   void EnqueueUses(Node*, AllocationState const*);
   void EnqueueUse(Node*, int, AllocationState const*);
 
+  bool NeedsPoisoning(LoadSensitivity load_sensitivity) const;
+
   AllocationState const* empty_state() const { return empty_state_; }
   Graph* graph() const;
   Isolate* isolate() const;
@@ -146,7 +148,7 @@ class MemoryOptimizer final {
   ZoneQueue<Token> tokens_;
   Zone* const zone_;
   GraphAssembler graph_assembler_;
-  PoisoningMitigationLevel poisoning_enabled_;
+  PoisoningMitigationLevel poisoning_level_;
   AllocationFolding allocation_folding_;
 
   DISALLOW_IMPLICIT_CONSTRUCTORS(MemoryOptimizer);
diff --git a/deps/v8/src/compiler/mips/code-generator-mips.cc b/deps/v8/src/compiler/mips/code-generator-mips.cc
index aad88fb763550d..00575fe11717f6 100644
--- a/deps/v8/src/compiler/mips/code-generator-mips.cc
+++ b/deps/v8/src/compiler/mips/code-generator-mips.cc
@@ -307,9 +307,9 @@ FPUCondition FlagsConditionToConditionCmpFPU(bool& predicate,
   UNREACHABLE();
 }
 
-#define UNSUPPORTED_COND(opcode, condition)                                  \
-  OFStream out(stdout);                                                      \
-  out << "Unsupported " << #opcode << " condition: \"" << condition << "\""; \
+#define UNSUPPORTED_COND(opcode, condition)                                    \
+  StdoutStream{} << "Unsupported " << #opcode << " condition: \"" << condition \
+                 << "\"";                                                      \
   UNIMPLEMENTED();
 
 void EmitWordLoadPoisoningIfNeeded(CodeGenerator* codegen,
@@ -448,27 +448,25 @@ void EmitWordLoadPoisoningIfNeeded(CodeGenerator* codegen,
     __ sync();                                                                 \
   } while (0)
 
-#define ASSEMBLE_IEEE754_BINOP(name)                                          \
-  do {                                                                        \
-    FrameScope scope(tasm(), StackFrame::MANUAL);                             \
-    __ PrepareCallCFunction(0, 2, kScratchReg);                               \
-    __ MovToFloatParameters(i.InputDoubleRegister(0),                         \
-                            i.InputDoubleRegister(1));                        \
-    __ CallCFunction(ExternalReference::ieee754_##name##_function(isolate()), \
-                     0, 2);                                                   \
-    /* Move the result in the double result register. */                      \
-    __ MovFromFloatResult(i.OutputDoubleRegister());                          \
+#define ASSEMBLE_IEEE754_BINOP(name)                                        \
+  do {                                                                      \
+    FrameScope scope(tasm(), StackFrame::MANUAL);                           \
+    __ PrepareCallCFunction(0, 2, kScratchReg);                             \
+    __ MovToFloatParameters(i.InputDoubleRegister(0),                       \
+                            i.InputDoubleRegister(1));                      \
+    __ CallCFunction(ExternalReference::ieee754_##name##_function(), 0, 2); \
+    /* Move the result in the double result register. */                    \
+    __ MovFromFloatResult(i.OutputDoubleRegister());                        \
   } while (0)
 
-#define ASSEMBLE_IEEE754_UNOP(name)                                           \
-  do {                                                                        \
-    FrameScope scope(tasm(), StackFrame::MANUAL);                             \
-    __ PrepareCallCFunction(0, 1, kScratchReg);                               \
-    __ MovToFloatParameter(i.InputDoubleRegister(0));                         \
-    __ CallCFunction(ExternalReference::ieee754_##name##_function(isolate()), \
-                     0, 1);                                                   \
-    /* Move the result in the double result register. */                      \
-    __ MovFromFloatResult(i.OutputDoubleRegister());                          \
+#define ASSEMBLE_IEEE754_UNOP(name)                                         \
+  do {                                                                      \
+    FrameScope scope(tasm(), StackFrame::MANUAL);                           \
+    __ PrepareCallCFunction(0, 1, kScratchReg);                             \
+    __ MovToFloatParameter(i.InputDoubleRegister(0));                       \
+    __ CallCFunction(ExternalReference::ieee754_##name##_function(), 0, 1); \
+    /* Move the result in the double result register. */                    \
+    __ MovFromFloatResult(i.OutputDoubleRegister());                        \
   } while (0)
 
 void CodeGenerator::AssembleDeconstructFrame() {
@@ -543,9 +541,9 @@ void CodeGenerator::AssembleTailCallAfterGap(Instruction* instr,
 
 // Check that {kJavaScriptCallCodeStartRegister} is correct.
 void CodeGenerator::AssembleCodeStartRegisterCheck() {
-  __ ComputeCodeStartAddress(at);
+  __ ComputeCodeStartAddress(kScratchReg);
   __ Assert(eq, AbortReason::kWrongFunctionCodeStart,
-            kJavaScriptCallCodeStartRegister, Operand(at));
+            kJavaScriptCallCodeStartRegister, Operand(kScratchReg));
 }
 
 // Check if the code object is marked for deoptimization. If it is, then it
@@ -557,12 +555,18 @@ void CodeGenerator::AssembleCodeStartRegisterCheck() {
 //    3. if it is not zero then it jumps to the builtin.
 void CodeGenerator::BailoutIfDeoptimized() {
   int offset = Code::kCodeDataContainerOffset - Code::kHeaderSize;
-  __ lw(at, MemOperand(kJavaScriptCallCodeStartRegister, offset));
-  __ lw(at, FieldMemOperand(at, CodeDataContainer::kKindSpecificFlagsOffset));
-  __ And(at, at, Operand(1 << Code::kMarkedForDeoptimizationBit));
+  __ lw(kScratchReg, MemOperand(kJavaScriptCallCodeStartRegister, offset));
+  __ lw(kScratchReg,
+        FieldMemOperand(kScratchReg,
+                        CodeDataContainer::kKindSpecificFlagsOffset));
+  __ And(kScratchReg, kScratchReg,
+         Operand(1 << Code::kMarkedForDeoptimizationBit));
+  // Ensure we're not serializing (otherwise we'd need to use an indirection to
+  // access the builtin below).
+  DCHECK(!isolate()->ShouldLoadConstantsFromRootList());
   Handle<Code> code = isolate()->builtins()->builtin_handle(
       Builtins::kCompileLazyDeoptimizedCode);
-  __ Jump(code, RelocInfo::CODE_TARGET, ne, at, Operand(zero_reg));
+  __ Jump(code, RelocInfo::CODE_TARGET, ne, kScratchReg, Operand(zero_reg));
 }
 
 void CodeGenerator::GenerateSpeculationPoisonFromCodeStartRegister() {
@@ -570,12 +574,12 @@ void CodeGenerator::GenerateSpeculationPoisonFromCodeStartRegister() {
   // bits cleared if we are speculatively executing the wrong PC.
   //    difference = (current - expected) | (expected - current)
   //    poison = ~(difference >> (kBitsPerPointer - 1))
-  __ ComputeCodeStartAddress(at);
-  __ Move(kSpeculationPoisonRegister, at);
+  __ ComputeCodeStartAddress(kScratchReg);
+  __ Move(kSpeculationPoisonRegister, kScratchReg);
   __ subu(kSpeculationPoisonRegister, kSpeculationPoisonRegister,
           kJavaScriptCallCodeStartRegister);
   __ subu(kJavaScriptCallCodeStartRegister, kJavaScriptCallCodeStartRegister,
-          at);
+          kScratchReg);
   __ or_(kSpeculationPoisonRegister, kSpeculationPoisonRegister,
          kJavaScriptCallCodeStartRegister);
   __ sra(kSpeculationPoisonRegister, kSpeculationPoisonRegister,
@@ -601,7 +605,11 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       if (instr->InputAt(0)->IsImmediate()) {
         __ Call(i.InputCode(0), RelocInfo::CODE_TARGET);
       } else {
-        __ Call(at, i.InputRegister(0), Code::kHeaderSize - kHeapObjectTag);
+        Register reg = i.InputRegister(0);
+        DCHECK_IMPLIES(
+            HasCallDescriptorFlag(instr, CallDescriptor::kFixedTargetRegister),
+            reg == kJavaScriptCallCodeStartRegister);
+        __ Call(reg, reg, Code::kHeaderSize - kHeapObjectTag);
       }
       RecordCallPosition(instr);
       frame_access_state()->ClearSPDelta();
@@ -609,10 +617,9 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
     }
     case kArchCallWasmFunction: {
       if (instr->InputAt(0)->IsImmediate()) {
-        Address wasm_code = reinterpret_cast<Address>(
-            i.ToConstant(instr->InputAt(0)).ToInt32());
-        __ Call(wasm_code, info()->IsWasm() ? RelocInfo::WASM_CALL
-                                            : RelocInfo::JS_TO_WASM_CALL);
+        Constant constant = i.ToConstant(instr->InputAt(0));
+        Address wasm_code = static_cast<Address>(constant.ToInt32());
+        __ Call(wasm_code, constant.rmode());
       } else {
         __ Call(i.InputRegister(0));
       }
@@ -630,7 +637,12 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       if (instr->InputAt(0)->IsImmediate()) {
         __ Jump(i.InputCode(0), RelocInfo::CODE_TARGET);
       } else {
-        __ Jump(at, i.InputRegister(0), Code::kHeaderSize - kHeapObjectTag);
+        Register reg = i.InputRegister(0);
+        DCHECK_IMPLIES(
+            HasCallDescriptorFlag(instr, CallDescriptor::kFixedTargetRegister),
+            reg == kJavaScriptCallCodeStartRegister);
+        __ Addu(reg, reg, Code::kHeaderSize - kHeapObjectTag);
+        __ Jump(reg);
       }
       frame_access_state()->ClearSPDelta();
       frame_access_state()->SetFrameAccessToDefault();
@@ -638,10 +650,9 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
     }
     case kArchTailCallWasm: {
       if (instr->InputAt(0)->IsImmediate()) {
-        Address wasm_code = reinterpret_cast<Address>(
-            i.ToConstant(instr->InputAt(0)).ToInt32());
-        __ Jump(wasm_code, info()->IsWasm() ? RelocInfo::WASM_CALL
-                                            : RelocInfo::JS_TO_WASM_CALL);
+        Constant constant = i.ToConstant(instr->InputAt(0));
+        Address wasm_code = static_cast<Address>(constant.ToInt32());
+        __ Jump(wasm_code, constant.rmode());
       } else {
         __ Jump(i.InputRegister(0));
       }
@@ -651,7 +662,11 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
     }
     case kArchTailCallAddress: {
       CHECK(!instr->InputAt(0)->IsImmediate());
-      __ Jump(i.InputRegister(0));
+      Register reg = i.InputRegister(0);
+      DCHECK_IMPLIES(
+          HasCallDescriptorFlag(instr, CallDescriptor::kFixedTargetRegister),
+          reg == kJavaScriptCallCodeStartRegister);
+      __ Jump(reg);
       frame_access_state()->ClearSPDelta();
       frame_access_state()->SetFrameAccessToDefault();
       break;
@@ -739,6 +754,9 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
     case kArchJmp:
       AssembleArchJump(i.InputRpo(0));
       break;
+    case kArchBinarySearchSwitch:
+      AssembleArchBinarySearchSwitch(instr);
+      break;
     case kArchLookupSwitch:
       AssembleArchLookupSwitch(instr);
       break;
@@ -762,11 +780,9 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
     case kArchDebugBreak:
       __ stop("kArchDebugBreak");
       break;
-    case kArchComment: {
-      Address comment_string = i.InputExternalReference(0).address();
-      __ RecordComment(reinterpret_cast<const char*>(comment_string));
+    case kArchComment:
+      __ RecordComment(reinterpret_cast<const char*>(i.InputInt32(0)));
       break;
-    }
     case kArchNop:
     case kArchThrowTerminator:
       // don't emit code for nops.
@@ -795,12 +811,9 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
         __ mov(i.OutputRegister(), fp);
       }
       break;
-    case kArchRootsPointer:
-      __ mov(i.OutputRegister(), kRootRegister);
-      break;
     case kArchTruncateDoubleToI:
-      __ TruncateDoubleToIDelayed(zone(), i.OutputRegister(),
-                                  i.InputDoubleRegister(0));
+      __ TruncateDoubleToI(isolate(), zone(), i.OutputRegister(),
+                           i.InputDoubleRegister(0), DetermineStubCallMode());
       break;
     case kArchStoreWithWriteBarrier: {
       RecordWriteMode mode =
@@ -812,8 +825,8 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       Register scratch1 = i.TempRegister(1);
       auto ool = new (zone()) OutOfLineRecordWrite(this, object, index, value,
                                                    scratch0, scratch1, mode);
-      __ Addu(at, object, index);
-      __ sw(value, MemOperand(at));
+      __ Addu(kScratchReg, object, index);
+      __ sw(value, MemOperand(kScratchReg));
       __ CheckPageFlag(object, scratch0,
                        MemoryChunk::kPointersFromHereAreInterestingMask, ne,
                        ool->entry());
@@ -854,7 +867,7 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       }
       break;
     }
-    case kArchPoisonOnSpeculationWord:
+    case kArchWordPoisonOnSpeculation:
       __ And(i.OutputRegister(), i.InputRegister(0),
              kSpeculationPoisonRegister);
       break;
@@ -907,7 +920,7 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       ASSEMBLE_IEEE754_UNOP(log2);
       break;
     case kIeee754Float64Pow: {
-      __ CallStubDelayed(new (zone()) MathPowStub());
+      __ Call(BUILTIN_CODE(isolate(), MathPowInternal), RelocInfo::CODE_TARGET);
       break;
     }
     case kIeee754Float64Sin:
@@ -1139,8 +1152,7 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       __ MovToFloatParameters(i.InputDoubleRegister(0),
                               i.InputDoubleRegister(1));
       // TODO(balazs.kilvady): implement mod_two_floats_operation(isolate())
-      __ CallCFunction(ExternalReference::mod_two_doubles_operation(isolate()),
-                       0, 2);
+      __ CallCFunction(ExternalReference::mod_two_doubles_operation(), 0, 2);
       // Move the result in the double result register.
       __ MovFromFloatResult(i.OutputSingleRegister());
       break;
@@ -1174,19 +1186,18 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
     } break;
     case kMipsAddPair:
       __ AddPair(i.OutputRegister(0), i.OutputRegister(1), i.InputRegister(0),
-                 i.InputRegister(1), i.InputRegister(2), i.InputRegister(3));
+                 i.InputRegister(1), i.InputRegister(2), i.InputRegister(3),
+                 kScratchReg, kScratchReg2);
       break;
     case kMipsSubPair:
       __ SubPair(i.OutputRegister(0), i.OutputRegister(1), i.InputRegister(0),
-                 i.InputRegister(1), i.InputRegister(2), i.InputRegister(3));
+                 i.InputRegister(1), i.InputRegister(2), i.InputRegister(3),
+                 kScratchReg, kScratchReg2);
       break;
     case kMipsMulPair: {
-      __ Mulu(i.OutputRegister(1), i.OutputRegister(0), i.InputRegister(0),
-              i.InputRegister(2));
-      __ Mul(kScratchReg, i.InputRegister(0), i.InputRegister(3));
-      __ Mul(kScratchReg2, i.InputRegister(1), i.InputRegister(2));
-      __ Addu(i.OutputRegister(1), i.OutputRegister(1), kScratchReg);
-      __ Addu(i.OutputRegister(1), i.OutputRegister(1), kScratchReg2);
+      __ MulPair(i.OutputRegister(0), i.OutputRegister(1), i.InputRegister(0),
+                 i.InputRegister(1), i.InputRegister(2), i.InputRegister(3),
+                 kScratchReg, kScratchReg2);
     } break;
     case kMipsAddD:
       // TODO(plind): add special case: combine mult & add.
@@ -1233,8 +1244,7 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       __ PrepareCallCFunction(0, 2, kScratchReg);
       __ MovToFloatParameters(i.InputDoubleRegister(0),
                               i.InputDoubleRegister(1));
-      __ CallCFunction(ExternalReference::mod_two_doubles_operation(isolate()),
-                       0, 2);
+      __ CallCFunction(ExternalReference::mod_two_doubles_operation(), 0, 2);
       // Move the result in the double result register.
       __ MovFromFloatResult(i.OutputDoubleRegister());
       break;
@@ -1415,14 +1425,12 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
     }
     case kMipsTruncUwD: {
       FPURegister scratch = kScratchDoubleReg;
-      // TODO(plind): Fix wrong param order of Trunc_uw_d() macro-asm function.
-      __ Trunc_uw_d(i.InputDoubleRegister(0), i.OutputRegister(), scratch);
+      __ Trunc_uw_d(i.OutputRegister(), i.InputDoubleRegister(0), scratch);
       break;
     }
     case kMipsTruncUwS: {
       FPURegister scratch = kScratchDoubleReg;
-      // TODO(plind): Fix wrong param order of Trunc_uw_s() macro-asm function.
-      __ Trunc_uw_s(i.InputDoubleRegister(0), i.OutputRegister(), scratch);
+      __ Trunc_uw_s(i.OutputRegister(), i.InputDoubleRegister(0), scratch);
       // Avoid UINT32_MAX as an overflow indicator and use 0 instead,
       // because 0 allows easier out-of-bounds detection.
       __ Addu(kScratchReg, i.OutputRegister(), 1);
@@ -2910,7 +2918,19 @@ void CodeGenerator::AssembleBranchPoisoning(FlagsCondition condition,
       }
     }
       return;
+    case kMipsCmpS:
+    case kMipsCmpD: {
+      bool predicate;
+      FlagsConditionToConditionCmpFPU(predicate, condition);
+      if (predicate) {
+        __ LoadZeroIfFPUCondition(kSpeculationPoisonRegister);
+      } else {
+        __ LoadZeroIfNotFPUCondition(kSpeculationPoisonRegister);
+      }
+    }
+      return;
     default:
+      UNREACHABLE();
       break;
   }
 }
@@ -2928,39 +2948,26 @@ void CodeGenerator::AssembleArchTrap(Instruction* instr,
                                      FlagsCondition condition) {
   class OutOfLineTrap final : public OutOfLineCode {
    public:
-    OutOfLineTrap(CodeGenerator* gen, bool frame_elided, Instruction* instr)
-        : OutOfLineCode(gen),
-          frame_elided_(frame_elided),
-          instr_(instr),
-          gen_(gen) {}
+    OutOfLineTrap(CodeGenerator* gen, Instruction* instr)
+        : OutOfLineCode(gen), instr_(instr), gen_(gen) {}
 
     void Generate() final {
       MipsOperandConverter i(gen_, instr_);
-
-      Builtins::Name trap_id =
-          static_cast<Builtins::Name>(i.InputInt32(instr_->InputCount() - 1));
-      bool old_has_frame = __ has_frame();
-      if (frame_elided_) {
-        __ set_has_frame(true);
-        __ EnterFrame(StackFrame::WASM_COMPILED);
-      }
+      TrapId trap_id =
+          static_cast<TrapId>(i.InputInt32(instr_->InputCount() - 1));
       GenerateCallToTrap(trap_id);
-      if (frame_elided_) {
-        __ set_has_frame(old_has_frame);
-      }
     }
 
    private:
-    void GenerateCallToTrap(Builtins::Name trap_id) {
-      if (trap_id == Builtins::builtin_count) {
+    void GenerateCallToTrap(TrapId trap_id) {
+      if (trap_id == TrapId::kInvalid) {
         // We cannot test calls to the runtime in cctest/test-run-wasm.
         // Therefore we emit a call to C here instead of a call to the runtime.
         // We use the context register as the scratch register, because we do
         // not have a context here.
         __ PrepareCallCFunction(0, 0, cp);
-        __ CallCFunction(ExternalReference::wasm_call_trap_callback_for_testing(
-                             tasm()->isolate()),
-                         0);
+        __ CallCFunction(
+            ExternalReference::wasm_call_trap_callback_for_testing(), 0);
         __ LeaveFrame(StackFrame::WASM_COMPILED);
         auto call_descriptor = gen_->linkage()->GetIncomingDescriptor();
         int pop_count =
@@ -2969,8 +2976,9 @@ void CodeGenerator::AssembleArchTrap(Instruction* instr,
         __ Ret();
       } else {
         gen_->AssembleSourcePosition(instr_);
-        __ Call(tasm()->isolate()->builtins()->builtin_handle(trap_id),
-                RelocInfo::CODE_TARGET);
+        // A direct call to a wasm runtime stub defined in this module.
+        // Just encode the stub index. This will be patched at relocation.
+        __ Call(static_cast<Address>(trap_id), RelocInfo::WASM_STUB_CALL);
         ReferenceMap* reference_map =
             new (gen_->zone()) ReferenceMap(gen_->zone());
         gen_->RecordSafepoint(reference_map, Safepoint::kSimple, 0,
@@ -2981,12 +2989,10 @@ void CodeGenerator::AssembleArchTrap(Instruction* instr,
       }
     }
 
-    bool frame_elided_;
     Instruction* instr_;
     CodeGenerator* gen_;
   };
-  bool frame_elided = !frame_access_state()->has_frame();
-  auto ool = new (zone()) OutOfLineTrap(this, frame_elided, instr);
+  auto ool = new (zone()) OutOfLineTrap(this, instr);
   Label* tlabel = ool->entry();
   AssembleBranchToLabels(this, tasm(), instr, condition, tlabel, nullptr, true);
 }
@@ -3141,13 +3147,23 @@ void CodeGenerator::AssembleArchBoolean(Instruction* instr,
   }
 }
 
+void CodeGenerator::AssembleArchBinarySearchSwitch(Instruction* instr) {
+  MipsOperandConverter i(this, instr);
+  Register input = i.InputRegister(0);
+  std::vector<std::pair<int32_t, Label*>> cases;
+  for (size_t index = 2; index < instr->InputCount(); index += 2) {
+    cases.push_back({i.InputInt32(index + 0), GetLabel(i.InputRpo(index + 1))});
+  }
+  AssembleArchBinarySearchSwitchRange(input, i.InputRpo(1), cases.data(),
+                                      cases.data() + cases.size());
+}
 
 void CodeGenerator::AssembleArchLookupSwitch(Instruction* instr) {
   MipsOperandConverter i(this, instr);
   Register input = i.InputRegister(0);
   for (size_t index = 2; index < instr->InputCount(); index += 2) {
-    __ li(at, Operand(i.InputInt32(index + 0)));
-    __ Branch(GetLabel(i.InputRpo(index + 1)), eq, input, Operand(at));
+    __ li(kScratchReg, Operand(i.InputInt32(index + 0)));
+    __ Branch(GetLabel(i.InputRpo(index + 1)), eq, input, Operand(kScratchReg));
   }
   AssembleArchJump(i.InputRpo(1));
 }
@@ -3199,6 +3215,9 @@ void CodeGenerator::AssembleConstructFrame() {
       }
     } else {
       __ StubPrologue(info()->GetOutputStackFrameType());
+      if (call_descriptor->IsWasmFunctionCall()) {
+        __ Push(kWasmInstanceRegister);
+      }
     }
   }
 
@@ -3350,7 +3369,7 @@ void CodeGenerator::AssembleMove(InstructionOperand* source,
           __ li(dst, Operand::EmbeddedNumber(src.ToFloat64().value()));
           break;
         case Constant::kExternalReference:
-          __ li(dst, Operand(src.ToExternalReference()));
+          __ li(dst, src.ToExternalReference());
           break;
         case Constant::kHeapObject: {
           Handle<HeapObject> src_object = src.ToHeapObject();
diff --git a/deps/v8/src/compiler/mips/instruction-scheduler-mips.cc b/deps/v8/src/compiler/mips/instruction-scheduler-mips.cc
index af86a87ad78690..a0fe18843077fe 100644
--- a/deps/v8/src/compiler/mips/instruction-scheduler-mips.cc
+++ b/deps/v8/src/compiler/mips/instruction-scheduler-mips.cc
@@ -2,23 +2,1728 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
+#include "src/compiler/code-generator.h"
 #include "src/compiler/instruction-scheduler.h"
 
 namespace v8 {
 namespace internal {
 namespace compiler {
 
-bool InstructionScheduler::SchedulerSupported() { return false; }
-
+bool InstructionScheduler::SchedulerSupported() { return true; }
 
 int InstructionScheduler::GetTargetInstructionFlags(
     const Instruction* instr) const {
-  UNIMPLEMENTED();
+  switch (instr->arch_opcode()) {
+    case kMipsAbsD:
+    case kMipsAbsS:
+    case kMipsAdd:
+    case kMipsAddD:
+    case kMipsAddOvf:
+    case kMipsAddPair:
+    case kMipsAddS:
+    case kMipsAnd:
+    case kMipsByteSwap32:
+    case kMipsCeilWD:
+    case kMipsCeilWS:
+    case kMipsClz:
+    case kMipsCmp:
+    case kMipsCmpD:
+    case kMipsCmpS:
+    case kMipsCtz:
+    case kMipsCvtDS:
+    case kMipsCvtDUw:
+    case kMipsCvtDW:
+    case kMipsCvtSD:
+    case kMipsCvtSUw:
+    case kMipsCvtSW:
+    case kMipsDiv:
+    case kMipsDivD:
+    case kMipsDivS:
+    case kMipsDivU:
+    case kMipsExt:
+    case kMipsF32x4Abs:
+    case kMipsF32x4Add:
+    case kMipsF32x4AddHoriz:
+    case kMipsF32x4Eq:
+    case kMipsF32x4ExtractLane:
+    case kMipsF32x4Le:
+    case kMipsF32x4Lt:
+    case kMipsF32x4Max:
+    case kMipsF32x4Min:
+    case kMipsF32x4Mul:
+    case kMipsF32x4Ne:
+    case kMipsF32x4Neg:
+    case kMipsF32x4RecipApprox:
+    case kMipsF32x4RecipSqrtApprox:
+    case kMipsF32x4ReplaceLane:
+    case kMipsF32x4SConvertI32x4:
+    case kMipsF32x4Splat:
+    case kMipsF32x4Sub:
+    case kMipsF32x4UConvertI32x4:
+    case kMipsFloat32Max:
+    case kMipsFloat32Min:
+    case kMipsFloat32RoundDown:
+    case kMipsFloat32RoundTiesEven:
+    case kMipsFloat32RoundTruncate:
+    case kMipsFloat32RoundUp:
+    case kMipsFloat64ExtractHighWord32:
+    case kMipsFloat64ExtractLowWord32:
+    case kMipsFloat64InsertHighWord32:
+    case kMipsFloat64InsertLowWord32:
+    case kMipsFloat64Max:
+    case kMipsFloat64Min:
+    case kMipsFloat64RoundDown:
+    case kMipsFloat64RoundTiesEven:
+    case kMipsFloat64RoundTruncate:
+    case kMipsFloat64RoundUp:
+    case kMipsFloat64SilenceNaN:
+    case kMipsFloorWD:
+    case kMipsFloorWS:
+    case kMipsI16x8Add:
+    case kMipsI16x8AddHoriz:
+    case kMipsI16x8AddSaturateS:
+    case kMipsI16x8AddSaturateU:
+    case kMipsI16x8Eq:
+    case kMipsI16x8ExtractLane:
+    case kMipsI16x8GeS:
+    case kMipsI16x8GeU:
+    case kMipsI16x8GtS:
+    case kMipsI16x8GtU:
+    case kMipsI16x8MaxS:
+    case kMipsI16x8MaxU:
+    case kMipsI16x8MinS:
+    case kMipsI16x8MinU:
+    case kMipsI16x8Mul:
+    case kMipsI16x8Ne:
+    case kMipsI16x8Neg:
+    case kMipsI16x8ReplaceLane:
+    case kMipsI16x8SConvertI32x4:
+    case kMipsI16x8SConvertI8x16High:
+    case kMipsI16x8SConvertI8x16Low:
+    case kMipsI16x8Shl:
+    case kMipsI16x8ShrS:
+    case kMipsI16x8ShrU:
+    case kMipsI16x8Splat:
+    case kMipsI16x8Sub:
+    case kMipsI16x8SubSaturateS:
+    case kMipsI16x8SubSaturateU:
+    case kMipsI16x8UConvertI32x4:
+    case kMipsI16x8UConvertI8x16High:
+    case kMipsI16x8UConvertI8x16Low:
+    case kMipsI32x4Add:
+    case kMipsI32x4AddHoriz:
+    case kMipsI32x4Eq:
+    case kMipsI32x4ExtractLane:
+    case kMipsI32x4GeS:
+    case kMipsI32x4GeU:
+    case kMipsI32x4GtS:
+    case kMipsI32x4GtU:
+    case kMipsI32x4MaxS:
+    case kMipsI32x4MaxU:
+    case kMipsI32x4MinS:
+    case kMipsI32x4MinU:
+    case kMipsI32x4Mul:
+    case kMipsI32x4Ne:
+    case kMipsI32x4Neg:
+    case kMipsI32x4ReplaceLane:
+    case kMipsI32x4SConvertF32x4:
+    case kMipsI32x4SConvertI16x8High:
+    case kMipsI32x4SConvertI16x8Low:
+    case kMipsI32x4Shl:
+    case kMipsI32x4ShrS:
+    case kMipsI32x4ShrU:
+    case kMipsI32x4Splat:
+    case kMipsI32x4Sub:
+    case kMipsI32x4UConvertF32x4:
+    case kMipsI32x4UConvertI16x8High:
+    case kMipsI32x4UConvertI16x8Low:
+    case kMipsI8x16Add:
+    case kMipsI8x16AddSaturateS:
+    case kMipsI8x16AddSaturateU:
+    case kMipsI8x16Eq:
+    case kMipsI8x16ExtractLane:
+    case kMipsI8x16GeS:
+    case kMipsI8x16GeU:
+    case kMipsI8x16GtS:
+    case kMipsI8x16GtU:
+    case kMipsI8x16MaxS:
+    case kMipsI8x16MaxU:
+    case kMipsI8x16MinS:
+    case kMipsI8x16MinU:
+    case kMipsI8x16Mul:
+    case kMipsI8x16Ne:
+    case kMipsI8x16Neg:
+    case kMipsI8x16ReplaceLane:
+    case kMipsI8x16SConvertI16x8:
+    case kMipsI8x16Shl:
+    case kMipsI8x16ShrS:
+    case kMipsI8x16ShrU:
+    case kMipsI8x16Splat:
+    case kMipsI8x16Sub:
+    case kMipsI8x16SubSaturateS:
+    case kMipsI8x16SubSaturateU:
+    case kMipsI8x16UConvertI16x8:
+    case kMipsIns:
+    case kMipsLsa:
+    case kMipsMaddD:
+    case kMipsMaddS:
+    case kMipsMaxD:
+    case kMipsMaxS:
+    case kMipsMinD:
+    case kMipsMinS:
+    case kMipsMod:
+    case kMipsModU:
+    case kMipsMov:
+    case kMipsMsubD:
+    case kMipsMsubS:
+    case kMipsMul:
+    case kMipsMulD:
+    case kMipsMulHigh:
+    case kMipsMulHighU:
+    case kMipsMulOvf:
+    case kMipsMulPair:
+    case kMipsMulS:
+    case kMipsNegD:
+    case kMipsNegS:
+    case kMipsNor:
+    case kMipsOr:
+    case kMipsPopcnt:
+    case kMipsRor:
+    case kMipsRoundWD:
+    case kMipsRoundWS:
+    case kMipsS128And:
+    case kMipsS128Not:
+    case kMipsS128Or:
+    case kMipsS128Select:
+    case kMipsS128Xor:
+    case kMipsS128Zero:
+    case kMipsS16x2Reverse:
+    case kMipsS16x4Reverse:
+    case kMipsS16x8InterleaveEven:
+    case kMipsS16x8InterleaveLeft:
+    case kMipsS16x8InterleaveOdd:
+    case kMipsS16x8InterleaveRight:
+    case kMipsS16x8PackEven:
+    case kMipsS16x8PackOdd:
+    case kMipsS1x16AllTrue:
+    case kMipsS1x16AnyTrue:
+    case kMipsS1x4AllTrue:
+    case kMipsS1x4AnyTrue:
+    case kMipsS1x8AllTrue:
+    case kMipsS1x8AnyTrue:
+    case kMipsS32x4InterleaveEven:
+    case kMipsS32x4InterleaveLeft:
+    case kMipsS32x4InterleaveOdd:
+    case kMipsS32x4InterleaveRight:
+    case kMipsS32x4PackEven:
+    case kMipsS32x4PackOdd:
+    case kMipsS32x4Shuffle:
+    case kMipsS8x16Concat:
+    case kMipsS8x16InterleaveEven:
+    case kMipsS8x16InterleaveLeft:
+    case kMipsS8x16InterleaveOdd:
+    case kMipsS8x16InterleaveRight:
+    case kMipsS8x16PackEven:
+    case kMipsS8x16PackOdd:
+    case kMipsS8x16Shuffle:
+    case kMipsS8x2Reverse:
+    case kMipsS8x4Reverse:
+    case kMipsS8x8Reverse:
+    case kMipsSar:
+    case kMipsSarPair:
+    case kMipsSeb:
+    case kMipsSeh:
+    case kMipsShl:
+    case kMipsShlPair:
+    case kMipsShr:
+    case kMipsShrPair:
+    case kMipsSqrtD:
+    case kMipsSqrtS:
+    case kMipsSub:
+    case kMipsSubD:
+    case kMipsSubOvf:
+    case kMipsSubPair:
+    case kMipsSubS:
+    case kMipsTruncUwD:
+    case kMipsTruncUwS:
+    case kMipsTruncWD:
+    case kMipsTruncWS:
+    case kMipsTst:
+    case kMipsXor:
+      return kNoOpcodeFlags;
+
+    case kMipsLb:
+    case kMipsLbu:
+    case kMipsLdc1:
+    case kMipsLh:
+    case kMipsLhu:
+    case kMipsLw:
+    case kMipsLwc1:
+    case kMipsMsaLd:
+    case kMipsPeek:
+    case kMipsUldc1:
+    case kMipsUlh:
+    case kMipsUlhu:
+    case kMipsUlw:
+    case kMipsUlwc1:
+      return kIsLoadOperation;
+
+    case kMipsModD:
+    case kMipsModS:
+    case kMipsMsaSt:
+    case kMipsPush:
+    case kMipsSb:
+    case kMipsSdc1:
+    case kMipsSh:
+    case kMipsStackClaim:
+    case kMipsStoreToStackSlot:
+    case kMipsSw:
+    case kMipsSwc1:
+    case kMipsUsdc1:
+    case kMipsUsh:
+    case kMipsUsw:
+    case kMipsUswc1:
+      return kHasSideEffect;
+
+#define CASE(Name) case k##Name:
+      COMMON_ARCH_OPCODE_LIST(CASE)
+#undef CASE
+      // Already covered in architecture independent code.
+      UNREACHABLE();
+  }
+
+  UNREACHABLE();
+}
+
+enum Latency {
+  BRANCH = 4,  // Estimated max.
+  RINT_S = 4,  // Estimated.
+  RINT_D = 4,  // Estimated.
+
+  MULT = 4,
+  MULTU = 4,
+  MADD = 4,
+  MADDU = 4,
+  MSUB = 4,
+  MSUBU = 4,
+
+  MUL = 7,
+  MULU = 7,
+  MUH = 7,
+  MUHU = 7,
+
+  DIV = 50,  // Min:11 Max:50
+  DIVU = 50,
+
+  ABS_S = 4,
+  ABS_D = 4,
+  NEG_S = 4,
+  NEG_D = 4,
+  ADD_S = 4,
+  ADD_D = 4,
+  SUB_S = 4,
+  SUB_D = 4,
+  MAX_S = 4,  // Estimated.
+  MAX_D = 4,  // Estimated.
+  C_cond_S = 4,
+  C_cond_D = 4,
+  MUL_S = 4,
+
+  MADD_S = 4,
+  MSUB_S = 4,
+  NMADD_S = 4,
+  NMSUB_S = 4,
+
+  CABS_cond_S = 4,
+  CABS_cond_D = 4,
+
+  CVT_D_S = 4,
+  CVT_PS_PW = 4,
+
+  CVT_S_W = 4,
+  CVT_S_L = 4,
+  CVT_D_W = 4,
+  CVT_D_L = 4,
+
+  CVT_S_D = 4,
+
+  CVT_W_S = 4,
+  CVT_W_D = 4,
+  CVT_L_S = 4,
+  CVT_L_D = 4,
+
+  CEIL_W_S = 4,
+  CEIL_W_D = 4,
+  CEIL_L_S = 4,
+  CEIL_L_D = 4,
+
+  FLOOR_W_S = 4,
+  FLOOR_W_D = 4,
+  FLOOR_L_S = 4,
+  FLOOR_L_D = 4,
+
+  ROUND_W_S = 4,
+  ROUND_W_D = 4,
+  ROUND_L_S = 4,
+  ROUND_L_D = 4,
+
+  TRUNC_W_S = 4,
+  TRUNC_W_D = 4,
+  TRUNC_L_S = 4,
+  TRUNC_L_D = 4,
+
+  MOV_S = 4,
+  MOV_D = 4,
+
+  MOVF_S = 4,
+  MOVF_D = 4,
+
+  MOVN_S = 4,
+  MOVN_D = 4,
+
+  MOVT_S = 4,
+  MOVT_D = 4,
+
+  MOVZ_S = 4,
+  MOVZ_D = 4,
+
+  MUL_D = 5,
+  MADD_D = 5,
+  MSUB_D = 5,
+  NMADD_D = 5,
+  NMSUB_D = 5,
+
+  RECIP_S = 13,
+  RECIP_D = 26,
+
+  RSQRT_S = 17,
+  RSQRT_D = 36,
+
+  DIV_S = 17,
+  SQRT_S = 17,
+
+  DIV_D = 32,
+  SQRT_D = 32,
+
+  MTC1 = 4,
+  MTHC1 = 4,
+  DMTC1 = 4,
+  LWC1 = 4,
+  LDC1 = 4,
+  LDXC1 = 4,
+  LUXC1 = 4,
+  LWXC1 = 4,
+
+  MFC1 = 1,
+  MFHC1 = 1,
+  MFHI = 1,
+  MFLO = 1,
+  DMFC1 = 1,
+  SWC1 = 1,
+  SDC1 = 1,
+  SDXC1 = 1,
+  SUXC1 = 1,
+  SWXC1 = 1,
+};
+
+int ClzLatency() {
+  if (IsMipsArchVariant(kLoongson)) {
+    return (6 + 2 * Latency::BRANCH);
+  } else {
+    return 1;
+  }
+}
+
+int RorLatency(bool is_operand_register = true) {
+  if (IsMipsArchVariant(kMips32r2) || IsMipsArchVariant(kMips32r6)) {
+    return 1;
+  } else {
+    if (is_operand_register) {
+      return 4;
+    } else {
+      return 3;  // Estimated max.
+    }
+  }
+}
+
+int AdduLatency(bool is_operand_register = true) {
+  if (is_operand_register) {
+    return 1;
+  } else {
+    return 2;  // Estimated max.
+  }
+}
+
+int XorLatency(bool is_operand_register = true) {
+  return AdduLatency(is_operand_register);
+}
+
+int AndLatency(bool is_operand_register = true) {
+  return AdduLatency(is_operand_register);
+}
+
+int OrLatency(bool is_operand_register = true) {
+  return AdduLatency(is_operand_register);
+}
+
+int SubuLatency(bool is_operand_register = true) {
+  return AdduLatency(is_operand_register);
+}
+
+int MulLatency(bool is_operand_register = true) {
+  if (is_operand_register) {
+    if (IsMipsArchVariant(kLoongson)) {
+      return Latency::MULT + 1;
+    } else {
+      return Latency::MUL + 1;
+    }
+  } else {
+    if (IsMipsArchVariant(kLoongson)) {
+      return Latency::MULT + 2;
+    } else {
+      return Latency::MUL + 2;
+    }
+  }
+}
+
+int NorLatency(bool is_operand_register = true) {
+  if (is_operand_register) {
+    return 1;
+  } else {
+    return 2;
+  }
+}
+
+int InsLatency() {
+  if (IsMipsArchVariant(kMips32r2) || IsMipsArchVariant(kMips32r6)) {
+    return 1;
+  } else {
+    return SubuLatency(false) + 7;
+  }
+}
+
+int ShlPairLatency(bool is_operand_register = true) {
+  if (is_operand_register) {
+    int latency =
+        AndLatency(false) + NorLatency() + OrLatency() + AndLatency(false) + 4;
+    if (IsMipsArchVariant(kLoongson) || IsMipsArchVariant(kMips32r6)) {
+      return latency + Latency::BRANCH + 2;
+    } else {
+      return latency + 2;
+    }
+  } else {
+    return 2;
+  }
+}
+
+int ShrPairLatency(bool is_operand_register = true, uint32_t shift = 0) {
+  if (is_operand_register) {
+    int latency =
+        AndLatency(false) + NorLatency() + OrLatency() + AndLatency(false) + 4;
+    if (IsMipsArchVariant(kLoongson) || IsMipsArchVariant(kMips32r6)) {
+      return latency + Latency::BRANCH + 2;
+    } else {
+      return latency + 2;
+    }
+  } else {
+    // Estimated max.
+    return (InsLatency() + 2 > OrLatency() + 3) ? InsLatency() + 2
+                                                : OrLatency() + 3;
+  }
+}
+
+int SarPairLatency(bool is_operand_register = true, uint32_t shift = 0) {
+  if (is_operand_register) {
+    return AndLatency(false) + NorLatency() + OrLatency() + AndLatency(false) +
+           Latency::BRANCH + 6;
+  } else {
+    shift = shift & 0x3F;
+    if (shift == 0) {
+      return 2;
+    } else if (shift < 32) {
+      if (IsMipsArchVariant(kMips32r2) || IsMipsArchVariant(kMips32r6)) {
+        return InsLatency() + 2;
+      } else {
+        return OrLatency() + 3;
+      }
+    } else if (shift == 32) {
+      return 2;
+    } else {
+      return 2;
+    }
+  }
+}
+
+int ExtLatency() {
+  if (IsMipsArchVariant(kMips32r2) || IsMipsArchVariant(kMips32r6)) {
+    return 1;
+  } else {
+    // Estimated max.
+    return 2;
+  }
+}
+
+int LsaLatency() {
+  // Estimated max.
+  return AdduLatency() + 1;
+}
+
+int SltLatency(bool is_operand_register = true) {
+  if (is_operand_register) {
+    return 1;
+  } else {
+    return 2;  // Estimated max.
+  }
+}
+
+int SltuLatency(bool is_operand_register = true) {
+  return SltLatency(is_operand_register);
+}
+
+int AddPairLatency() { return 3 * AdduLatency() + SltLatency(); }
+
+int SubPairLatency() { return SltuLatency() + 3 * SubuLatency(); }
+
+int MuluLatency(bool is_operand_register = true) {
+  int latency = 0;
+  if (!is_operand_register) latency++;
+  if (!IsMipsArchVariant(kMips32r6)) {
+    return latency + Latency::MULTU + 2;
+  } else {
+    return latency + Latency::MULU + Latency::MUHU;
+  }
+}
+
+int MulPairLatency() {
+  return MuluLatency() + 2 * MulLatency() + 2 * AdduLatency();
+}
+
+int MaddSLatency() {
+  if (IsMipsArchVariant(kMips32r2)) {
+    return Latency::MADD_D;
+  } else {
+    return Latency::MUL_D + Latency::ADD_D;
+  }
+}
+
+int MaddDLatency() {
+  if (IsMipsArchVariant(kMips32r2)) {
+    return Latency::MADD_D;
+  } else {
+    return Latency::MUL_D + Latency::ADD_D;
+  }
+}
+
+int MsubSLatency() {
+  if (IsMipsArchVariant(kMips32r2)) {
+    return Latency::MSUB_S;
+  } else {
+    return Latency::MUL_S + Latency::SUB_S;
+  }
+}
+
+int MsubDLatency() {
+  if (IsMipsArchVariant(kMips32r2)) {
+    return Latency::MSUB_D;
+  } else {
+    return Latency::MUL_D + Latency::SUB_D;
+  }
+}
+
+int Mfhc1Latency() {
+  if (IsFp32Mode()) {
+    return Latency::MFC1;
+  } else {
+    return 1;
+  }
+}
+
+int Mthc1Latency() {
+  if (IsFp32Mode()) {
+    return Latency::MTC1;
+  } else {
+    return 1;
+  }
+}
+
+int MoveLatency(bool is_double_register = true) {
+  if (!is_double_register) {
+    return Latency::MTC1 + 1;
+  } else {
+    return Mthc1Latency() + 1;  // Estimated.
+  }
+}
+
+int Float64RoundLatency() {
+  if (IsMipsArchVariant(kMips32r6)) {
+    return Latency::RINT_D + 4;
+  } else {
+    // For ceil_l_d, floor_l_d, round_l_d, trunc_l_d latency is 4.
+    return Mfhc1Latency() + ExtLatency() + Latency::BRANCH + Latency::MOV_D +
+           4 + MoveLatency() + 1 + Latency::BRANCH + Latency::CVT_D_L;
+  }
+}
+
+int Float32RoundLatency() {
+  if (IsMipsArchVariant(kMips32r6)) {
+    return Latency::RINT_S + 4;
+  } else {
+    // For ceil_w_s, floor_w_s, round_w_s, trunc_w_s latency is 4.
+    return Latency::MFC1 + ExtLatency() + Latency::BRANCH + Latency::MOV_S + 4 +
+           Latency::MFC1 + Latency::BRANCH + Latency::CVT_S_W;
+  }
+}
+
+int CvtDUwLatency() {
+  if (IsFp64Mode()) {
+    return Latency::MTC1 + Mthc1Latency() + Latency::CVT_D_L;
+  } else {
+    return Latency::BRANCH + Latency::MTC1 + 1 + Latency::MTC1 +
+           Mthc1Latency() + Latency::CVT_D_W + Latency::BRANCH +
+           Latency::ADD_D + Latency::CVT_D_W;
+  }
+}
+
+int CvtSUwLatency() { return CvtDUwLatency() + Latency::CVT_S_D; }
+
+int Floor_w_dLatency() {
+  if (IsMipsArchVariant(kLoongson)) {
+    return Mfhc1Latency() + Latency::FLOOR_W_D + Mthc1Latency();
+  } else {
+    return Latency::FLOOR_W_D;
+  }
+}
+
+int FloorWDLatency() { return Floor_w_dLatency() + Latency::MFC1; }
+
+int Ceil_w_dLatency() {
+  if (IsMipsArchVariant(kLoongson)) {
+    return Mfhc1Latency() + Latency::CEIL_W_D + Mthc1Latency();
+  } else {
+    return Latency::CEIL_W_D;
+  }
+}
+
+int CeilWDLatency() { return Ceil_w_dLatency() + Latency::MFC1; }
+
+int Round_w_dLatency() {
+  if (IsMipsArchVariant(kLoongson)) {
+    return Mfhc1Latency() + Latency::ROUND_W_D + Mthc1Latency();
+  } else {
+    return Latency::ROUND_W_D;
+  }
+}
+
+int RoundWDLatency() { return Round_w_dLatency() + Latency::MFC1; }
+
+int Trunc_w_dLatency() {
+  if (IsMipsArchVariant(kLoongson)) {
+    return Mfhc1Latency() + Latency::TRUNC_W_D + Mthc1Latency();
+  } else {
+    return Latency::TRUNC_W_D;
+  }
+}
+
+int MovnLatency() {
+  if (IsMipsArchVariant(kLoongson) || IsMipsArchVariant(kMips32r6)) {
+    return Latency::BRANCH + 1;
+  } else {
+    return 1;
+  }
+}
+
+int Trunc_uw_dLatency() {
+  return 1 + Latency::MTC1 + Mthc1Latency() + Latency::BRANCH + Latency::SUB_D +
+         Latency::TRUNC_W_D + Latency::MFC1 + OrLatency(false) +
+         Latency::BRANCH + Latency::TRUNC_W_D + Latency::MFC1;
+}
+
+int Trunc_uw_sLatency() {
+  return 1 + Latency::MTC1 + Latency::BRANCH + Latency::SUB_S +
+         Latency::TRUNC_W_S + Latency::MFC1 + OrLatency(false) +
+         Latency::TRUNC_W_S + Latency::MFC1;
+}
+
+int MovzLatency() {
+  if (IsMipsArchVariant(kLoongson) || IsMipsArchVariant(kMips32r6)) {
+    return Latency::BRANCH + 1;
+  } else {
+    return 1;
+  }
+}
+
+int FmoveLowLatency() {
+  if (IsFp32Mode()) {
+    return Latency::MTC1;
+  } else {
+    return Latency::MFHC1 + Latency::MTC1 + Latency::MTHC1;
+  }
+}
+
+int SebLatency() {
+  if (IsMipsArchVariant(kMips32r2) || IsMipsArchVariant(kMips32r6)) {
+    return 1;
+  } else {
+    return 2;
+  }
+}
+
+int SehLatency() {
+  if (IsMipsArchVariant(kMips32r2) || IsMipsArchVariant(kMips32r6)) {
+    return 1;
+  } else {
+    return 2;
+  }
+}
+
+int UlhuLatency() {
+  if (IsMipsArchVariant(kMips32r6)) {
+    return 1;
+  } else {
+    return 4;
+  }
+}
+
+int UlhLatency() {
+  if (IsMipsArchVariant(kMips32r6)) {
+    return 1;
+  } else {
+    return 4;
+  }
+}
+
+int AdjustBaseAndOffsetLatency() {
+  return 3;  // Estimated max.
+}
+
+int UshLatency() {
+  if (IsMipsArchVariant(kMips32r6)) {
+    return 1;
+  } else {
+    return AdjustBaseAndOffsetLatency() + 4;  // Estimated max.
+  }
+}
+
+int UlwLatency() {
+  if (IsMipsArchVariant(kMips32r6)) {
+    return 1;
+  } else {
+    return AdjustBaseAndOffsetLatency() + 3;  // Estimated max.
+  }
 }
 
+int UswLatency() {
+  if (IsMipsArchVariant(kMips32r6)) {
+    return 1;
+  } else {
+    return AdjustBaseAndOffsetLatency() + 2;
+  }
+}
+
+int Ulwc1Latency() {
+  if (IsMipsArchVariant(kMips32r6)) {
+    return Latency::LWC1;
+  } else {
+    return UlwLatency() + Latency::MTC1;
+  }
+}
+
+int Uswc1Latency() {
+  if (IsMipsArchVariant(kMips32r6)) {
+    return Latency::SWC1;
+  } else {
+    return Latency::MFC1 + UswLatency();
+  }
+}
+
+int Ldc1Latency() {
+  int latency = AdjustBaseAndOffsetLatency() + Latency::LWC1;
+  if (IsFp32Mode()) {
+    return latency + Latency::LWC1;
+  } else {
+    return latency + 1 + Mthc1Latency();
+  }
+}
+
+int Uldc1Latency() {
+  if (IsMipsArchVariant(kMips32r6)) {
+    return Ldc1Latency();
+  } else {
+    return 2 * UlwLatency() + Latency::MTC1 + Mthc1Latency();
+  }
+}
+
+int Sdc1Latency() {
+  int latency = AdjustBaseAndOffsetLatency() + Latency::SWC1;
+  if (IsFp32Mode()) {
+    return latency + Latency::SWC1;
+  } else {
+    return latency + Mfhc1Latency() + 1;
+  }
+}
+
+int Usdc1Latency() {
+  if (IsMipsArchVariant(kMips32r6)) {
+    return Sdc1Latency();
+  } else {
+    return Latency::MFC1 + 2 * UswLatency() + Mfhc1Latency();
+  }
+}
+
+int PushRegisterLatency() { return AdduLatency(false) + 1; }
+
+int ByteSwapSignedLatency() {
+  // operand_size == 4
+  if (IsMipsArchVariant(kMips32r2) || IsMipsArchVariant(kMips32r6)) {
+    return 2;
+  } else if (IsMipsArchVariant(kMips32r1) || IsMipsArchVariant(kLoongson)) {
+    return 10;
+  }
+}
+
+int LlLatency(int offset) {
+  bool is_one_instruction =
+      IsMipsArchVariant(kMips32r6) ? is_int9(offset) : is_int16(offset);
+  if (is_one_instruction) {
+    return 1;
+  } else {
+    return 3;
+  }
+}
+
+int ExtractBitsLatency(int size, bool sign_extend) {
+  int latency = 1 + ExtLatency();
+  if (size == 8) {
+    if (sign_extend) {
+      return latency + SebLatency();
+    } else {
+      return 0;
+    }
+  } else if (size == 16) {
+    if (sign_extend) {
+      return latency + SehLatency();
+    } else {
+      return 0;
+    }
+  } else {
+    UNREACHABLE();
+  }
+}
+
+int NegLatency() { return 1; }
+
+int InsertBitsLatency() {
+  return RorLatency() + InsLatency() + SubuLatency(false) + NegLatency() +
+         RorLatency();
+}
+
+int ScLatency(int offset) {
+  bool is_one_instruction =
+      IsMipsArchVariant(kMips32r6) ? is_int9(offset) : is_int16(offset);
+  if (is_one_instruction) {
+    return 1;
+  } else {
+    return 3;
+  }
+}
+
+int BranchShortHelperR6Latency() {
+  return 2;  // Estimated max.
+}
+
+int BranchShortHelperLatency() {
+  return SltLatency() + 2;  // Estimated max.
+}
+
+int BranchShortLatency(BranchDelaySlot bdslot = PROTECT) {
+  if (IsMipsArchVariant(kMips32r6) && bdslot == PROTECT) {
+    return BranchShortHelperR6Latency();
+  } else {
+    return BranchShortHelperLatency();
+  }
+}
+
+int Word32AtomicExchangeLatency(bool sign_extend, int size) {
+  return AdduLatency() + 1 + SubuLatency() + 2 + LlLatency(0) +
+         ExtractBitsLatency(size, sign_extend) + InsertBitsLatency() +
+         ScLatency(0) + BranchShortLatency() + 1;
+}
+
+int Word32AtomicCompareExchangeLatency(bool sign_extend, int size) {
+  return AdduLatency() + 1 + SubuLatency() + 2 + LlLatency(0) +
+         ExtractBitsLatency(size, sign_extend) + BranchShortLatency() + 1;
+}
+
+int AddOverflowLatency() {
+  return 6;  // Estimated max.
+}
+
+int SubOverflowLatency() {
+  return 6;  // Estimated max.
+}
+
+int MulhLatency(bool is_operand_register = true) {
+  if (is_operand_register) {
+    if (!IsMipsArchVariant(kMips32r6)) {
+      return Latency::MULT + Latency::MFHI;
+    } else {
+      return Latency::MUH;
+    }
+  } else {
+    if (!IsMipsArchVariant(kMips32r6)) {
+      return 1 + Latency::MULT + Latency::MFHI;
+    } else {
+      return 1 + Latency::MUH;
+    }
+  }
+}
+
+int MulhuLatency(bool is_operand_register = true) {
+  if (is_operand_register) {
+    if (!IsMipsArchVariant(kMips32r6)) {
+      return Latency::MULTU + Latency::MFHI;
+    } else {
+      return Latency::MUHU;
+    }
+  } else {
+    if (!IsMipsArchVariant(kMips32r6)) {
+      return 1 + Latency::MULTU + Latency::MFHI;
+    } else {
+      return 1 + Latency::MUHU;
+    }
+  }
+}
+
+int MulOverflowLatency() {
+  return MulLatency() + 4;  // Estimated max.
+}
+
+int ModLatency(bool is_operand_register = true) {
+  if (is_operand_register) {
+    if (!IsMipsArchVariant(kMips32r6)) {
+      return Latency::DIV + Latency::MFHI;
+    } else {
+      return 1;
+    }
+  } else {
+    if (!IsMipsArchVariant(kMips32r6)) {
+      return 1 + Latency::DIV + Latency::MFHI;
+    } else {
+      return 2;
+    }
+  }
+}
+
+int ModuLatency(bool is_operand_register = true) {
+  return ModLatency(is_operand_register);
+}
+
+int DivLatency(bool is_operand_register = true) {
+  if (is_operand_register) {
+    if (!IsMipsArchVariant(kMips32r6)) {
+      return Latency::DIV + Latency::MFLO;
+    } else {
+      return Latency::DIV;
+    }
+  } else {
+    if (!IsMipsArchVariant(kMips32r6)) {
+      return 1 + Latency::DIV + Latency::MFLO;
+    } else {
+      return 1 + Latency::DIV;
+    }
+  }
+}
+
+int DivuLatency(bool is_operand_register = true) {
+  if (is_operand_register) {
+    if (!IsMipsArchVariant(kMips32r6)) {
+      return Latency::DIVU + Latency::MFLO;
+    } else {
+      return Latency::DIVU;
+    }
+  } else {
+    if (!IsMipsArchVariant(kMips32r6)) {
+      return 1 + Latency::DIVU + Latency::MFLO;
+    } else {
+      return 1 + Latency::DIVU;
+    }
+  }
+}
+
+int CtzLatency() {
+  if (IsMipsArchVariant(kMips32r6)) {
+    return RorLatency(false) + 2 + ClzLatency();
+  } else {
+    return AdduLatency(false) + XorLatency() + AndLatency() + ClzLatency() + 1 +
+           SubuLatency();
+  }
+}
+
+int PopcntLatency() {
+  return 4 * AndLatency() + SubuLatency() + 2 * AdduLatency() + MulLatency() +
+         8;
+}
+
+int CompareFLatency() { return Latency::C_cond_S; }
+
+int CompareIsNanFLatency() { return CompareFLatency(); }
+
+int CompareIsNanF32Latency() { return CompareIsNanFLatency(); }
+
+int Neg_sLatency() {
+  if (IsMipsArchVariant(kMips32r6)) {
+    return Latency::NEG_S;
+  } else {
+    // Estimated.
+    return CompareIsNanF32Latency() + 2 * Latency::BRANCH + Latency::NEG_S +
+           Latency::MFC1 + 1 + XorLatency() + Latency::MTC1;
+  }
+}
+
+int CompareIsNanF64Latency() { return CompareIsNanFLatency(); }
+
+int Neg_dLatency() {
+  if (IsMipsArchVariant(kMips32r6)) {
+    return Latency::NEG_D;
+  } else {
+    // Estimated.
+    return CompareIsNanF64Latency() + 2 * Latency::BRANCH + Latency::NEG_D +
+           Mfhc1Latency() + 1 + XorLatency() + Mthc1Latency();
+  }
+}
+
+int CompareF32Latency() { return CompareFLatency(); }
+
+int Move_sLatency() {
+  return Latency::MOV_S;  // Estimated max.
+}
+
+int Float32MaxLatency() {
+  // Estimated max.
+  int latency = CompareIsNanF32Latency() + Latency::BRANCH;
+  if (IsMipsArchVariant(kMips32r6)) {
+    return latency + Latency::MAX_S;
+  } else {
+    return latency + 5 * Latency::BRANCH + 2 * CompareF32Latency() +
+           Latency::MFC1 + Move_sLatency();
+  }
+}
+
+int CompareF64Latency() { return CompareF32Latency(); }
+
+int Move_dLatency() {
+  return Latency::MOV_D;  // Estimated max.
+}
+
+int Float64MaxLatency() {
+  // Estimated max.
+  int latency = CompareIsNanF64Latency() + Latency::BRANCH;
+  if (IsMipsArchVariant(kMips32r6)) {
+    return latency + Latency::MAX_D;
+  } else {
+    return latency + 5 * Latency::BRANCH + 2 * CompareF64Latency() +
+           Latency::MFHC1 + 2 * Move_dLatency();
+  }
+}
+
+int PrepareCallCFunctionLatency() {
+  int frame_alignment = TurboAssembler::ActivationFrameAlignment();
+  if (frame_alignment > kPointerSize) {
+    return 1 + SubuLatency(false) + AndLatency(false) + 1;
+  } else {
+    return SubuLatency(false);
+  }
+}
+
+int MovToFloatParametersLatency() { return 2 * MoveLatency(); }
+
+int CallLatency() {
+  // Estimated.
+  return AdduLatency(false) + Latency::BRANCH + 3;
+}
+
+int CallCFunctionHelperLatency() {
+  // Estimated.
+  int latency = AndLatency(false) + Latency::BRANCH + 2 + CallLatency();
+  if (base::OS::ActivationFrameAlignment() > kPointerSize) {
+    latency++;
+  } else {
+    latency += AdduLatency(false);
+  }
+  return latency;
+}
+
+int CallCFunctionLatency() { return 1 + CallCFunctionHelperLatency(); }
+
+int MovFromFloatResultLatency() { return MoveLatency(); }
+
+int Float32MinLatency() {
+  // Estimated max.
+  return CompareIsNanF32Latency() + Latency::BRANCH +
+         2 * (CompareF32Latency() + Latency::BRANCH) + Latency::MFC1 +
+         2 * Latency::BRANCH + Move_sLatency();
+}
+
+int Float64MinLatency() {
+  // Estimated max.
+  return CompareIsNanF64Latency() + Latency::BRANCH +
+         2 * (CompareF64Latency() + Latency::BRANCH) + Mfhc1Latency() +
+         2 * Latency::BRANCH + Move_dLatency();
+}
+
+int SmiUntagLatency() { return 1; }
+
+int PrepareForTailCallLatency() {
+  // Estimated max.
+  return 2 * (LsaLatency() + AdduLatency(false)) + 2 + Latency::BRANCH +
+         Latency::BRANCH + 2 * SubuLatency(false) + 2 + Latency::BRANCH + 1;
+}
+
+int AssemblePopArgumentsAdaptorFrameLatency() {
+  return 1 + Latency::BRANCH + 1 + SmiUntagLatency() +
+         PrepareForTailCallLatency();
+}
+
+int JumpLatency() {
+  // Estimated max.
+  return 1 + AdduLatency(false) + Latency::BRANCH + 2;
+}
+
+int AssertLatency() { return 1; }
+
+int MultiPushLatency() {
+  int latency = SubuLatency(false);
+  for (int16_t i = kNumRegisters - 1; i >= 0; i--) {
+    latency++;
+  }
+  return latency;
+}
+
+int MultiPushFPULatency() {
+  int latency = SubuLatency(false);
+  for (int16_t i = kNumRegisters - 1; i >= 0; i--) {
+    latency += Sdc1Latency();
+  }
+  return latency;
+}
+
+int PushCallerSavedLatency(SaveFPRegsMode fp_mode) {
+  int latency = MultiPushLatency();
+  if (fp_mode == kSaveFPRegs) {
+    latency += MultiPushFPULatency();
+  }
+  return latency;
+}
+
+int MultiPopFPULatency() {
+  int latency = 0;
+  for (int16_t i = 0; i < kNumRegisters; i++) {
+    latency += Ldc1Latency();
+  }
+  return latency++;
+}
+
+int MultiPopLatency() {
+  int latency = 0;
+  for (int16_t i = 0; i < kNumRegisters; i++) {
+    latency++;
+  }
+  return latency++;
+}
+
+int PopCallerSavedLatency(SaveFPRegsMode fp_mode) {
+  int latency = 0;
+  if (fp_mode == kSaveFPRegs) {
+    latency += MultiPopFPULatency();
+  }
+  return latency + MultiPopLatency();
+}
+
+int AssembleArchJumpLatency() {
+  // Estimated max.
+  return Latency::BRANCH;
+}
+
+int AssembleArchLookupSwitchLatency(int cases) {
+  return cases * (1 + Latency::BRANCH) + AssembleArchJumpLatency();
+}
+
+int AssembleArchBinarySearchSwitchLatency(int cases) {
+  if (cases < CodeGenerator::kBinarySearchSwitchMinimalCases) {
+    return AssembleArchLookupSwitchLatency(cases);
+  }
+  return 1 + Latency::BRANCH + AssembleArchBinarySearchSwitchLatency(cases / 2);
+}
+
+int GenerateSwitchTableLatency() {
+  int latency = 0;
+  if (kArchVariant >= kMips32r6) {
+    latency = LsaLatency() + 2;
+  } else {
+    latency = 6;
+  }
+  latency += 2;
+  return latency;
+}
+
+int AssembleArchTableSwitchLatency() {
+  return Latency::BRANCH + GenerateSwitchTableLatency();
+}
+
+int AssembleReturnLatency() {
+  // Estimated max.
+  return AdduLatency(false) + MultiPopLatency() + MultiPopFPULatency() +
+         Latency::BRANCH + 1 + AdduLatency() + 8;
+}
+
+int TryInlineTruncateDoubleToILatency() {
+  return 2 + Latency::TRUNC_W_D + Latency::MFC1 + 2 + AndLatency(false) +
+         Latency::BRANCH;
+}
+
+int CallStubDelayedLatency() { return 1 + CallLatency(); }
+
+int TruncateDoubleToIDelayedLatency() {
+  return TryInlineTruncateDoubleToILatency() + 1 + SubuLatency(false) +
+         Sdc1Latency() + CallStubDelayedLatency() + AdduLatency(false) + 1;
+}
+
+int CheckPageFlagLatency() {
+  return 2 * AndLatency(false) + 1 + Latency::BRANCH;
+}
 
 int InstructionScheduler::GetInstructionLatency(const Instruction* instr) {
-  UNIMPLEMENTED();
+  // Basic latency modeling for MIPS32 instructions. They have been determined
+  // in an empirical way.
+  switch (instr->arch_opcode()) {
+    case kArchCallCodeObject:
+    case kArchCallWasmFunction:
+      return CallLatency();
+    case kArchTailCallCodeObjectFromJSFunction:
+    case kArchTailCallCodeObject: {
+      int latency = 0;
+      if (instr->arch_opcode() == kArchTailCallCodeObjectFromJSFunction) {
+        latency = AssemblePopArgumentsAdaptorFrameLatency();
+      }
+      return latency + JumpLatency();
+    }
+    case kArchTailCallWasm:
+    case kArchTailCallAddress:
+      return JumpLatency();
+    case kArchCallJSFunction: {
+      int latency = 0;
+      if (FLAG_debug_code) {
+        latency = 1 + AssertLatency();
+      }
+      return latency + 1 + AdduLatency(false) + CallLatency();
+    }
+    case kArchPrepareCallCFunction:
+      return PrepareCallCFunctionLatency();
+    case kArchSaveCallerRegisters: {
+      auto fp_mode =
+          static_cast<SaveFPRegsMode>(MiscField::decode(instr->opcode()));
+      return PushCallerSavedLatency(fp_mode);
+    }
+    case kArchRestoreCallerRegisters: {
+      auto fp_mode =
+          static_cast<SaveFPRegsMode>(MiscField::decode(instr->opcode()));
+      return PopCallerSavedLatency(fp_mode);
+    }
+    case kArchPrepareTailCall:
+      return 2;  // Estimated max.
+    case kArchCallCFunction:
+      return CallCFunctionLatency();
+    case kArchJmp:
+      return AssembleArchJumpLatency();
+    case kArchBinarySearchSwitch:
+      return AssembleArchBinarySearchSwitchLatency((instr->InputCount() - 2) /
+                                                   2);
+    case kArchLookupSwitch:
+      return AssembleArchLookupSwitchLatency((instr->InputCount() - 2) / 2);
+    case kArchTableSwitch:
+      return AssembleArchTableSwitchLatency();
+    case kArchDebugAbort:
+      return CallLatency() + 1;
+    case kArchComment:
+    case kArchDeoptimize:
+      return 0;
+    case kArchRet:
+      return AssembleReturnLatency();
+    case kArchTruncateDoubleToI:
+      return TruncateDoubleToIDelayedLatency();
+    case kArchStoreWithWriteBarrier:
+      return AdduLatency() + 1 + CheckPageFlagLatency();
+    case kArchStackSlot: {
+      // Estimated max.
+      return AdduLatency(false) + AndLatency(false) + AssertLatency() +
+             AdduLatency(false) + AndLatency(false) + BranchShortLatency() + 1 +
+             SubuLatency() + AdduLatency();
+    }
+    case kArchWordPoisonOnSpeculation:
+      return AndLatency();
+    case kIeee754Float64Acos:
+    case kIeee754Float64Acosh:
+    case kIeee754Float64Asin:
+    case kIeee754Float64Asinh:
+    case kIeee754Float64Atan:
+    case kIeee754Float64Atanh:
+    case kIeee754Float64Atan2:
+    case kIeee754Float64Cos:
+    case kIeee754Float64Cosh:
+    case kIeee754Float64Cbrt:
+    case kIeee754Float64Exp:
+    case kIeee754Float64Expm1:
+    case kIeee754Float64Log:
+    case kIeee754Float64Log1p:
+    case kIeee754Float64Log10:
+    case kIeee754Float64Log2:
+    case kIeee754Float64Pow:
+    case kIeee754Float64Sin:
+    case kIeee754Float64Sinh:
+    case kIeee754Float64Tan:
+    case kIeee754Float64Tanh:
+      return PrepareCallCFunctionLatency() + MovToFloatParametersLatency() +
+             CallCFunctionLatency() + MovFromFloatResultLatency();
+    case kMipsAdd:
+      return AdduLatency(instr->InputAt(1)->IsRegister());
+    case kMipsAnd:
+      return AndLatency(instr->InputAt(1)->IsRegister());
+    case kMipsOr:
+      return OrLatency(instr->InputAt(1)->IsRegister());
+    case kMipsXor:
+      return XorLatency(instr->InputAt(1)->IsRegister());
+    case kMipsSub:
+      return SubuLatency(instr->InputAt(1)->IsRegister());
+    case kMipsNor:
+      return NorLatency(instr->InputAt(1)->IsRegister());
+    case kMipsAddOvf:
+      return AddOverflowLatency();
+    case kMipsSubOvf:
+      return SubOverflowLatency();
+    case kMipsMul:
+      return MulLatency(false);
+    case kMipsMulHigh:
+      return MulhLatency(instr->InputAt(1)->IsRegister());
+    case kMipsMulHighU:
+      return MulhuLatency(instr->InputAt(1)->IsRegister());
+    case kMipsMulOvf:
+      return MulOverflowLatency();
+    case kMipsMod:
+      return ModLatency(instr->InputAt(1)->IsRegister());
+    case kMipsModU:
+      return ModuLatency(instr->InputAt(1)->IsRegister());
+    case kMipsDiv: {
+      int latency = DivLatency(instr->InputAt(1)->IsRegister());
+      if (IsMipsArchVariant(kMips32r6)) {
+        return latency++;
+      } else {
+        return latency + MovzLatency();
+      }
+    }
+    case kMipsDivU: {
+      int latency = DivuLatency(instr->InputAt(1)->IsRegister());
+      if (IsMipsArchVariant(kMips32r6)) {
+        return latency++;
+      } else {
+        return latency + MovzLatency();
+      }
+    }
+    case kMipsClz:
+      return ClzLatency();
+    case kMipsCtz:
+      return CtzLatency();
+    case kMipsPopcnt:
+      return PopcntLatency();
+    case kMipsShlPair: {
+      if (instr->InputAt(2)->IsRegister()) {
+        return ShlPairLatency();
+      } else {
+        return ShlPairLatency(false);
+      }
+    }
+    case kMipsShrPair: {
+      if (instr->InputAt(2)->IsRegister()) {
+        return ShrPairLatency();
+      } else {
+        // auto immediate_operand = ImmediateOperand::cast(instr->InputAt(2));
+        // return ShrPairLatency(false, immediate_operand->inline_value());
+        return 1;
+      }
+    }
+    case kMipsSarPair: {
+      if (instr->InputAt(2)->IsRegister()) {
+        return SarPairLatency();
+      } else {
+        return SarPairLatency(false);
+      }
+    }
+    case kMipsExt:
+      return ExtLatency();
+    case kMipsIns:
+      return InsLatency();
+    case kMipsRor:
+      return RorLatency(instr->InputAt(1)->IsRegister());
+    case kMipsLsa:
+      return LsaLatency();
+    case kMipsModS:
+    case kMipsModD:
+      return PrepareCallCFunctionLatency() + MovToFloatParametersLatency() +
+             CallCFunctionLatency() + MovFromFloatResultLatency();
+    case kMipsAddPair:
+      return AddPairLatency();
+    case kMipsSubPair:
+      return SubPairLatency();
+    case kMipsMulPair:
+      return MulPairLatency();
+    case kMipsMaddS:
+      return MaddSLatency();
+    case kMipsMaddD:
+      return MaddDLatency();
+    case kMipsMsubS:
+      return MsubSLatency();
+    case kMipsMsubD:
+      return MsubDLatency();
+    case kMipsNegS:
+      return Neg_sLatency();
+    case kMipsNegD:
+      return Neg_dLatency();
+    case kMipsFloat64RoundDown:
+    case kMipsFloat64RoundTruncate:
+    case kMipsFloat64RoundUp:
+    case kMipsFloat64RoundTiesEven:
+      return Float64RoundLatency();
+    case kMipsFloat32RoundDown:
+    case kMipsFloat32RoundTruncate:
+    case kMipsFloat32RoundUp:
+    case kMipsFloat32RoundTiesEven:
+      return Float32RoundLatency();
+    case kMipsFloat32Max:
+      return Float32MaxLatency();
+    case kMipsFloat64Max:
+      return Float64MaxLatency();
+    case kMipsFloat32Min:
+      return Float32MinLatency();
+    case kMipsFloat64Min:
+      return Float64MinLatency();
+    case kMipsCvtSUw:
+      return CvtSUwLatency();
+    case kMipsCvtDUw:
+      return CvtDUwLatency();
+    case kMipsFloorWD:
+      return FloorWDLatency();
+    case kMipsCeilWD:
+      return CeilWDLatency();
+    case kMipsRoundWD:
+      return RoundWDLatency();
+    case kMipsTruncWD:
+      return Trunc_w_dLatency() + Latency::MFC1;
+    case kMipsTruncWS:
+      return Latency::TRUNC_W_S + Latency::MFC1 + AdduLatency(false) +
+             SltLatency() + MovnLatency();
+    case kMipsTruncUwD:
+      return Trunc_uw_dLatency();
+    case kMipsTruncUwS:
+      return Trunc_uw_sLatency() + AdduLatency(false) + MovzLatency();
+    case kMipsFloat64ExtractLowWord32:
+      return Latency::MFC1;
+    case kMipsFloat64ExtractHighWord32:
+      return Mfhc1Latency();
+    case kMipsFloat64InsertLowWord32: {
+      if (IsFp32Mode()) {
+        return Latency::MTC1;
+      } else {
+        return Latency::MFHC1 + Latency::MTC1 + Latency::MTHC1;
+      }
+    }
+    case kMipsFloat64InsertHighWord32:
+      return Mthc1Latency();
+    case kMipsFloat64SilenceNaN:
+      return Latency::SUB_D;
+    case kMipsSeb:
+      return SebLatency();
+    case kMipsSeh:
+      return SehLatency();
+    case kMipsUlhu:
+      return UlhuLatency();
+    case kMipsUlh:
+      return UlhLatency();
+    case kMipsUsh:
+      return UshLatency();
+    case kMipsUlw:
+      return UlwLatency();
+    case kMipsUsw:
+      return UswLatency();
+    case kMipsUlwc1:
+      return Ulwc1Latency();
+    case kMipsSwc1:
+      return MoveLatency(false) + Latency::SWC1;  // Estimated max.
+    case kMipsUswc1:
+      return MoveLatency(false) + Uswc1Latency();  // Estimated max.
+    case kMipsLdc1:
+      return Ldc1Latency();
+    case kMipsUldc1:
+      return Uldc1Latency();
+    case kMipsSdc1:
+      return MoveLatency(false) + Sdc1Latency();  // Estimated max.
+    case kMipsUsdc1:
+      return MoveLatency(false) + Usdc1Latency();  // Estimated max.
+    case kMipsPush: {
+      if (instr->InputAt(0)->IsFPRegister()) {
+        auto op = LocationOperand::cast(instr->InputAt(0));
+        switch (op->representation()) {
+          case MachineRepresentation::kFloat32:
+            return Latency::SWC1 + SubuLatency(false);
+            break;
+          case MachineRepresentation::kFloat64:
+            return Sdc1Latency() + SubuLatency(false);
+            break;
+          default: {
+            UNREACHABLE();
+            break;
+          }
+        }
+      } else {
+        return PushRegisterLatency();
+      }
+      break;
+    }
+    case kMipsPeek: {
+      if (instr->OutputAt(0)->IsFPRegister()) {
+        auto op = LocationOperand::cast(instr->OutputAt(0));
+        if (op->representation() == MachineRepresentation::kFloat64) {
+          return Ldc1Latency();
+        } else {
+          return Latency::LWC1;
+        }
+      } else {
+        return 1;
+      }
+      break;
+    }
+    case kMipsStackClaim:
+      return SubuLatency(false);
+    case kMipsStoreToStackSlot: {
+      if (instr->InputAt(0)->IsFPRegister()) {
+        auto op = LocationOperand::cast(instr->InputAt(0));
+        if (op->representation() == MachineRepresentation::kFloat64) {
+          return Sdc1Latency();
+        } else if (op->representation() == MachineRepresentation::kFloat32) {
+          return Latency::SWC1;
+        } else {
+          return 1;  // Estimated value.
+        }
+      } else {
+        return 1;
+      }
+      break;
+    }
+    case kMipsByteSwap32:
+      return ByteSwapSignedLatency();
+    case kWord32AtomicLoadInt8:
+    case kWord32AtomicLoadUint8:
+    case kWord32AtomicLoadInt16:
+    case kWord32AtomicLoadUint16:
+    case kWord32AtomicLoadWord32:
+      return 2;
+    case kWord32AtomicStoreWord8:
+    case kWord32AtomicStoreWord16:
+    case kWord32AtomicStoreWord32:
+      return 3;
+    case kWord32AtomicExchangeInt8:
+      return Word32AtomicExchangeLatency(true, 8);
+    case kWord32AtomicExchangeUint8:
+      return Word32AtomicExchangeLatency(false, 8);
+    case kWord32AtomicExchangeInt16:
+      return Word32AtomicExchangeLatency(true, 16);
+    case kWord32AtomicExchangeUint16:
+      return Word32AtomicExchangeLatency(false, 16);
+    case kWord32AtomicExchangeWord32: {
+      return 1 + AdduLatency() + Ldc1Latency() + 1 + ScLatency(0) +
+             BranchShortLatency() + 1;
+    }
+    case kWord32AtomicCompareExchangeInt8:
+      return Word32AtomicCompareExchangeLatency(true, 8);
+    case kWord32AtomicCompareExchangeUint8:
+      return Word32AtomicCompareExchangeLatency(false, 8);
+    case kWord32AtomicCompareExchangeInt16:
+      return Word32AtomicCompareExchangeLatency(true, 16);
+    case kWord32AtomicCompareExchangeUint16:
+      return Word32AtomicCompareExchangeLatency(false, 16);
+    case kWord32AtomicCompareExchangeWord32:
+      return AdduLatency() + 1 + LlLatency(0) + BranchShortLatency() + 1;
+    case kMipsTst:
+      return AndLatency(instr->InputAt(1)->IsRegister());
+    case kMipsCmpS:
+      return MoveLatency() + CompareF32Latency();
+    case kMipsCmpD:
+      return MoveLatency() + CompareF64Latency();
+    case kArchNop:
+    case kArchThrowTerminator:
+    case kMipsCmp:
+      return 0;
+    case kArchDebugBreak:
+    case kArchStackPointer:
+    case kArchFramePointer:
+    case kArchParentFramePointer:
+    case kMipsShl:
+    case kMipsShr:
+    case kMipsSar:
+    case kMipsMov:
+    case kMipsMaxS:
+    case kMipsMinS:
+    case kMipsMaxD:
+    case kMipsMinD:
+    case kMipsLbu:
+    case kMipsLb:
+    case kMipsSb:
+    case kMipsLhu:
+    case kMipsLh:
+    case kMipsSh:
+    case kMipsLw:
+    case kMipsSw:
+    case kMipsLwc1:
+      return 1;
+    case kMipsAddS:
+      return Latency::ADD_S;
+    case kMipsSubS:
+      return Latency::SUB_S;
+    case kMipsMulS:
+      return Latency::MUL_S;
+    case kMipsAbsS:
+      return Latency::ABS_S;
+    case kMipsAddD:
+      return Latency::ADD_D;
+    case kMipsSubD:
+      return Latency::SUB_D;
+    case kMipsAbsD:
+      return Latency::ABS_D;
+    case kMipsCvtSD:
+      return Latency::CVT_S_D;
+    case kMipsCvtDS:
+      return Latency::CVT_D_S;
+    case kMipsMulD:
+      return Latency::MUL_D;
+    case kMipsFloorWS:
+      return Latency::FLOOR_W_S;
+    case kMipsCeilWS:
+      return Latency::CEIL_W_S;
+    case kMipsRoundWS:
+      return Latency::ROUND_W_S;
+    case kMipsCvtDW:
+      return Latency::CVT_D_W;
+    case kMipsCvtSW:
+      return Latency::CVT_S_W;
+    case kMipsDivS:
+      return Latency::DIV_S;
+    case kMipsSqrtS:
+      return Latency::SQRT_S;
+    case kMipsDivD:
+      return Latency::DIV_D;
+    case kMipsSqrtD:
+      return Latency::SQRT_D;
+    default:
+      return 1;
+  }
 }
 
 }  // namespace compiler
diff --git a/deps/v8/src/compiler/mips/instruction-selector-mips.cc b/deps/v8/src/compiler/mips/instruction-selector-mips.cc
index f8ca119b83a0ae..cfe132338c0c40 100644
--- a/deps/v8/src/compiler/mips/instruction-selector-mips.cc
+++ b/deps/v8/src/compiler/mips/instruction-selector-mips.cc
@@ -281,7 +281,7 @@ void InstructionSelector::VisitLoad(Node* node) {
       return;
   }
   if (node->opcode() == IrOpcode::kPoisonedLoad) {
-    CHECK_EQ(poisoning_enabled_, PoisoningMitigationLevel::kOn);
+    CHECK_NE(poisoning_level_, PoisoningMitigationLevel::kDontPoison);
     opcode |= MiscField::encode(kMemoryAccessPoisoned);
   }
 
@@ -1555,11 +1555,10 @@ void InstructionSelector::VisitSwitch(Node* node, const SwitchInfo& sw) {
     }
   }
 
-  // Generate a sequence of conditional jumps.
-  return EmitLookupSwitch(sw, value_operand);
+  // Generate a tree of conditional jumps.
+  return EmitBinarySearchSwitch(std::move(sw), value_operand);
 }
 
-
 void InstructionSelector::VisitWord32Equal(Node* const node) {
   FlagsContinuation cont = FlagsContinuation::ForSet(kEqual, node);
   Int32BinopMatcher m(node);
@@ -1851,7 +1850,7 @@ void InstructionSelector::VisitWord32AtomicCompareExchange(Node* node) {
   Emit(code, 1, outputs, input_count, inputs, 3, temp);
 }
 
-void InstructionSelector::VisitAtomicBinaryOperation(
+void InstructionSelector::VisitWord32AtomicBinaryOperation(
     Node* node, ArchOpcode int8_op, ArchOpcode uint8_op, ArchOpcode int16_op,
     ArchOpcode uint16_op, ArchOpcode word32_op) {
   MipsOperandGenerator g(this);
@@ -1894,7 +1893,7 @@ void InstructionSelector::VisitAtomicBinaryOperation(
 
 #define VISIT_ATOMIC_BINOP(op)                                   \
   void InstructionSelector::VisitWord32Atomic##op(Node* node) {  \
-    VisitAtomicBinaryOperation(                                  \
+    VisitWord32AtomicBinaryOperation(                            \
         node, kWord32Atomic##op##Int8, kWord32Atomic##op##Uint8, \
         kWord32Atomic##op##Int16, kWord32Atomic##op##Uint16,     \
         kWord32Atomic##op##Word32);                              \
@@ -2133,7 +2132,9 @@ static const ShuffleEntry arch_shuffles[] = {
     {{1, 0, 3, 2, 5, 4, 7, 6, 9, 8, 11, 10, 13, 12, 15, 14}, kMipsS8x2Reverse}};
 
 bool TryMatchArchShuffle(const uint8_t* shuffle, const ShuffleEntry* table,
-                         size_t num_entries, uint8_t mask, ArchOpcode* opcode) {
+                         size_t num_entries, bool is_swizzle,
+                         ArchOpcode* opcode) {
+  uint8_t mask = is_swizzle ? kSimd128Size - 1 : 2 * kSimd128Size - 1;
   for (size_t i = 0; i < num_entries; ++i) {
     const ShuffleEntry& entry = table[i];
     int j = 0;
@@ -2153,35 +2154,35 @@ bool TryMatchArchShuffle(const uint8_t* shuffle, const ShuffleEntry* table,
 }  // namespace
 
 void InstructionSelector::VisitS8x16Shuffle(Node* node) {
-  const uint8_t* shuffle = OpParameter<uint8_t*>(node->op());
-  uint8_t mask = CanonicalizeShuffle(node);
+  uint8_t shuffle[kSimd128Size];
+  bool is_swizzle;
+  CanonicalizeShuffle(node, shuffle, &is_swizzle);
   uint8_t shuffle32x4[4];
   ArchOpcode opcode;
   if (TryMatchArchShuffle(shuffle, arch_shuffles, arraysize(arch_shuffles),
-                          mask, &opcode)) {
+                          is_swizzle, &opcode)) {
     VisitRRR(this, opcode, node);
     return;
   }
+  Node* input0 = node->InputAt(0);
+  Node* input1 = node->InputAt(1);
   uint8_t offset;
   MipsOperandGenerator g(this);
-  if (TryMatchConcat(shuffle, mask, &offset)) {
-    Emit(kMipsS8x16Concat, g.DefineSameAsFirst(node),
-         g.UseRegister(node->InputAt(1)), g.UseRegister(node->InputAt(0)),
-         g.UseImmediate(offset));
+  if (TryMatchConcat(shuffle, &offset)) {
+    Emit(kMipsS8x16Concat, g.DefineSameAsFirst(node), g.UseRegister(input0),
+         g.UseRegister(input1), g.UseImmediate(offset));
     return;
   }
   if (TryMatch32x4Shuffle(shuffle, shuffle32x4)) {
-    Emit(kMipsS32x4Shuffle, g.DefineAsRegister(node),
-         g.UseRegister(node->InputAt(0)), g.UseRegister(node->InputAt(1)),
-         g.UseImmediate(Pack4Lanes(shuffle32x4, mask)));
+    Emit(kMipsS32x4Shuffle, g.DefineAsRegister(node), g.UseRegister(input0),
+         g.UseRegister(input1), g.UseImmediate(Pack4Lanes(shuffle32x4)));
     return;
   }
-  Emit(kMipsS8x16Shuffle, g.DefineAsRegister(node),
-       g.UseRegister(node->InputAt(0)), g.UseRegister(node->InputAt(1)),
-       g.UseImmediate(Pack4Lanes(shuffle, mask)),
-       g.UseImmediate(Pack4Lanes(shuffle + 4, mask)),
-       g.UseImmediate(Pack4Lanes(shuffle + 8, mask)),
-       g.UseImmediate(Pack4Lanes(shuffle + 12, mask)));
+  Emit(kMipsS8x16Shuffle, g.DefineAsRegister(node), g.UseRegister(input0),
+       g.UseRegister(input1), g.UseImmediate(Pack4Lanes(shuffle)),
+       g.UseImmediate(Pack4Lanes(shuffle + 4)),
+       g.UseImmediate(Pack4Lanes(shuffle + 8)),
+       g.UseImmediate(Pack4Lanes(shuffle + 12)));
 }
 
 void InstructionSelector::VisitSignExtendWord8ToInt32(Node* node) {
diff --git a/deps/v8/src/compiler/mips64/code-generator-mips64.cc b/deps/v8/src/compiler/mips64/code-generator-mips64.cc
index 3d4c0163dbe6c3..7beb887b5385aa 100644
--- a/deps/v8/src/compiler/mips64/code-generator-mips64.cc
+++ b/deps/v8/src/compiler/mips64/code-generator-mips64.cc
@@ -10,6 +10,7 @@
 #include "src/compiler/node-matchers.h"
 #include "src/compiler/osr.h"
 #include "src/heap/heap-inl.h"
+#include "src/mips64/constants-mips64.h"
 #include "src/mips64/macro-assembler-mips64.h"
 #include "src/optimized-compilation-info.h"
 
@@ -466,9 +467,7 @@ void EmitWordLoadPoisoningIfNeeded(CodeGenerator* codegen,
     __ PrepareCallCFunction(0, 2, kScratchReg);                             \
     __ MovToFloatParameters(i.InputDoubleRegister(0),                       \
                             i.InputDoubleRegister(1));                      \
-    __ CallCFunction(                                                       \
-        ExternalReference::ieee754_##name##_function(tasm()->isolate()), 0, \
-        2);                                                                 \
+    __ CallCFunction(ExternalReference::ieee754_##name##_function(), 0, 2); \
     /* Move the result in the double result register. */                    \
     __ MovFromFloatResult(i.OutputDoubleRegister());                        \
   } while (0)
@@ -478,9 +477,7 @@ void EmitWordLoadPoisoningIfNeeded(CodeGenerator* codegen,
     FrameScope scope(tasm(), StackFrame::MANUAL);                           \
     __ PrepareCallCFunction(0, 1, kScratchReg);                             \
     __ MovToFloatParameter(i.InputDoubleRegister(0));                       \
-    __ CallCFunction(                                                       \
-        ExternalReference::ieee754_##name##_function(tasm()->isolate()), 0, \
-        1);                                                                 \
+    __ CallCFunction(ExternalReference::ieee754_##name##_function(), 0, 1); \
     /* Move the result in the double result register. */                    \
     __ MovFromFloatResult(i.OutputDoubleRegister());                        \
   } while (0)
@@ -557,9 +554,9 @@ void CodeGenerator::AssembleTailCallAfterGap(Instruction* instr,
 
 // Check that {kJavaScriptCallCodeStartRegister} is correct.
 void CodeGenerator::AssembleCodeStartRegisterCheck() {
-  __ ComputeCodeStartAddress(at);
+  __ ComputeCodeStartAddress(kScratchReg);
   __ Assert(eq, AbortReason::kWrongFunctionCodeStart,
-            kJavaScriptCallCodeStartRegister, Operand(at));
+            kJavaScriptCallCodeStartRegister, Operand(kScratchReg));
 }
 
 // Check if the code object is marked for deoptimization. If it is, then it
@@ -571,12 +568,18 @@ void CodeGenerator::AssembleCodeStartRegisterCheck() {
 //    3. if it is not zero then it jumps to the builtin.
 void CodeGenerator::BailoutIfDeoptimized() {
   int offset = Code::kCodeDataContainerOffset - Code::kHeaderSize;
-  __ Ld(at, MemOperand(kJavaScriptCallCodeStartRegister, offset));
-  __ Lw(at, FieldMemOperand(at, CodeDataContainer::kKindSpecificFlagsOffset));
-  __ And(at, at, Operand(1 << Code::kMarkedForDeoptimizationBit));
+  __ Ld(kScratchReg, MemOperand(kJavaScriptCallCodeStartRegister, offset));
+  __ Lw(kScratchReg,
+        FieldMemOperand(kScratchReg,
+                        CodeDataContainer::kKindSpecificFlagsOffset));
+  __ And(kScratchReg, kScratchReg,
+         Operand(1 << Code::kMarkedForDeoptimizationBit));
+  // Ensure we're not serializing (otherwise we'd need to use an indirection to
+  // access the builtin below).
+  DCHECK(!isolate()->ShouldLoadConstantsFromRootList());
   Handle<Code> code = isolate()->builtins()->builtin_handle(
       Builtins::kCompileLazyDeoptimizedCode);
-  __ Jump(code, RelocInfo::CODE_TARGET, ne, at, Operand(zero_reg));
+  __ Jump(code, RelocInfo::CODE_TARGET, ne, kScratchReg, Operand(zero_reg));
 }
 
 void CodeGenerator::GenerateSpeculationPoisonFromCodeStartRegister() {
@@ -584,12 +587,12 @@ void CodeGenerator::GenerateSpeculationPoisonFromCodeStartRegister() {
   // bits cleared if we are speculatively executing the wrong PC.
   //    difference = (current - expected) | (expected - current)
   //    poison = ~(difference >> (kBitsPerPointer - 1))
-  __ ComputeCodeStartAddress(at);
-  __ Move(kSpeculationPoisonRegister, at);
+  __ ComputeCodeStartAddress(kScratchReg);
+  __ Move(kSpeculationPoisonRegister, kScratchReg);
   __ subu(kSpeculationPoisonRegister, kSpeculationPoisonRegister,
           kJavaScriptCallCodeStartRegister);
   __ subu(kJavaScriptCallCodeStartRegister, kJavaScriptCallCodeStartRegister,
-          at);
+          kScratchReg);
   __ or_(kSpeculationPoisonRegister, kSpeculationPoisonRegister,
          kJavaScriptCallCodeStartRegister);
   __ sra(kSpeculationPoisonRegister, kSpeculationPoisonRegister,
@@ -615,8 +618,12 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       if (instr->InputAt(0)->IsImmediate()) {
         __ Call(i.InputCode(0), RelocInfo::CODE_TARGET);
       } else {
-        __ daddiu(at, i.InputRegister(0), Code::kHeaderSize - kHeapObjectTag);
-        __ Call(at);
+        Register reg = i.InputRegister(0);
+        DCHECK_IMPLIES(
+            HasCallDescriptorFlag(instr, CallDescriptor::kFixedTargetRegister),
+            reg == kJavaScriptCallCodeStartRegister);
+        __ daddiu(reg, reg, Code::kHeaderSize - kHeapObjectTag);
+        __ Call(reg);
       }
       RecordCallPosition(instr);
       frame_access_state()->ClearSPDelta();
@@ -629,13 +636,12 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
                                          i.TempRegister(2));
       }
       if (instr->InputAt(0)->IsImmediate()) {
-        Address wasm_code = reinterpret_cast<Address>(
-            i.ToConstant(instr->InputAt(0)).ToInt64());
-        __ Call(wasm_code, info()->IsWasm() ? RelocInfo::WASM_CALL
-                                            : RelocInfo::JS_TO_WASM_CALL);
+        Constant constant = i.ToConstant(instr->InputAt(0));
+        Address wasm_code = static_cast<Address>(constant.ToInt64());
+        __ Call(wasm_code, constant.rmode());
       } else {
-        __ daddiu(at, i.InputRegister(0), 0);
-        __ Call(at);
+        __ daddiu(kScratchReg, i.InputRegister(0), 0);
+        __ Call(kScratchReg);
       }
       RecordCallPosition(instr);
       frame_access_state()->ClearSPDelta();
@@ -651,8 +657,12 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       if (instr->InputAt(0)->IsImmediate()) {
         __ Jump(i.InputCode(0), RelocInfo::CODE_TARGET);
       } else {
-        __ daddiu(at, i.InputRegister(0), Code::kHeaderSize - kHeapObjectTag);
-        __ Jump(at);
+        Register reg = i.InputRegister(0);
+        DCHECK_IMPLIES(
+            HasCallDescriptorFlag(instr, CallDescriptor::kFixedTargetRegister),
+            reg == kJavaScriptCallCodeStartRegister);
+        __ daddiu(reg, reg, Code::kHeaderSize - kHeapObjectTag);
+        __ Jump(reg);
       }
       frame_access_state()->ClearSPDelta();
       frame_access_state()->SetFrameAccessToDefault();
@@ -660,13 +670,12 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
     }
     case kArchTailCallWasm: {
       if (instr->InputAt(0)->IsImmediate()) {
-        Address wasm_code = reinterpret_cast<Address>(
-            i.ToConstant(instr->InputAt(0)).ToInt64());
-        __ Jump(wasm_code, info()->IsWasm() ? RelocInfo::WASM_CALL
-                                            : RelocInfo::JS_TO_WASM_CALL);
+        Constant constant = i.ToConstant(instr->InputAt(0));
+        Address wasm_code = static_cast<Address>(constant.ToInt64());
+        __ Jump(wasm_code, constant.rmode());
       } else {
-        __ daddiu(at, i.InputRegister(0), 0);
-        __ Jump(at);
+        __ daddiu(kScratchReg, i.InputRegister(0), 0);
+        __ Jump(kScratchReg);
       }
       frame_access_state()->ClearSPDelta();
       frame_access_state()->SetFrameAccessToDefault();
@@ -674,7 +683,11 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
     }
     case kArchTailCallAddress: {
       CHECK(!instr->InputAt(0)->IsImmediate());
-      __ Jump(i.InputRegister(0));
+      Register reg = i.InputRegister(0);
+      DCHECK_IMPLIES(
+          HasCallDescriptorFlag(instr, CallDescriptor::kFixedTargetRegister),
+          reg == kJavaScriptCallCodeStartRegister);
+      __ Jump(reg);
       frame_access_state()->ClearSPDelta();
       frame_access_state()->SetFrameAccessToDefault();
       break;
@@ -761,6 +774,9 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
     case kArchJmp:
       AssembleArchJump(i.InputRpo(0));
       break;
+    case kArchBinarySearchSwitch:
+      AssembleArchBinarySearchSwitch(instr);
+      break;
     case kArchLookupSwitch:
       AssembleArchLookupSwitch(instr);
       break;
@@ -784,11 +800,9 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
     case kArchDebugBreak:
       __ stop("kArchDebugBreak");
       break;
-    case kArchComment: {
-      Address comment_string = i.InputExternalReference(0).address();
-      __ RecordComment(reinterpret_cast<const char*>(comment_string));
+    case kArchComment:
+      __ RecordComment(reinterpret_cast<const char*>(i.InputInt64(0)));
       break;
-    }
     case kArchNop:
     case kArchThrowTerminator:
       // don't emit code for nops.
@@ -817,12 +831,9 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
         __ mov(i.OutputRegister(), fp);
       }
       break;
-    case kArchRootsPointer:
-      __ mov(i.OutputRegister(), kRootRegister);
-      break;
     case kArchTruncateDoubleToI:
-      __ TruncateDoubleToIDelayed(zone(), i.OutputRegister(),
-                                  i.InputDoubleRegister(0));
+      __ TruncateDoubleToI(isolate(), zone(), i.OutputRegister(),
+                           i.InputDoubleRegister(0), DetermineStubCallMode());
       break;
     case kArchStoreWithWriteBarrier: {
       RecordWriteMode mode =
@@ -834,8 +845,8 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       Register scratch1 = i.TempRegister(1);
       auto ool = new (zone()) OutOfLineRecordWrite(this, object, index, value,
                                                    scratch0, scratch1, mode);
-      __ Daddu(at, object, index);
-      __ Sd(value, MemOperand(at));
+      __ Daddu(kScratchReg, object, index);
+      __ Sd(value, MemOperand(kScratchReg));
       __ CheckPageFlag(object, scratch0,
                        MemoryChunk::kPointersFromHereAreInterestingMask, ne,
                        ool->entry());
@@ -876,7 +887,7 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
 
       break;
     }
-    case kArchPoisonOnSpeculationWord:
+    case kArchWordPoisonOnSpeculation:
       __ And(i.OutputRegister(), i.InputRegister(0),
              kSpeculationPoisonRegister);
       break;
@@ -929,7 +940,7 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       ASSEMBLE_IEEE754_UNOP(log10);
       break;
     case kIeee754Float64Pow: {
-      __ CallStubDelayed(new (zone()) MathPowStub());
+      __ Call(BUILTIN_CODE(isolate(), MathPowInternal), RelocInfo::CODE_TARGET);
       break;
     }
     case kIeee754Float64Sin:
@@ -1280,9 +1291,7 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       __ MovToFloatParameters(i.InputDoubleRegister(0),
                               i.InputDoubleRegister(1));
       // TODO(balazs.kilvady): implement mod_two_floats_operation(isolate())
-      __ CallCFunction(
-          ExternalReference::mod_two_doubles_operation(tasm()->isolate()), 0,
-          2);
+      __ CallCFunction(ExternalReference::mod_two_doubles_operation(), 0, 2);
       // Move the result in the double result register.
       __ MovFromFloatResult(i.OutputSingleRegister());
       break;
@@ -1342,9 +1351,7 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       __ PrepareCallCFunction(0, 2, kScratchReg);
       __ MovToFloatParameters(i.InputDoubleRegister(0),
                               i.InputDoubleRegister(1));
-      __ CallCFunction(
-          ExternalReference::mod_two_doubles_operation(tasm()->isolate()), 0,
-          2);
+      __ CallCFunction(ExternalReference::mod_two_doubles_operation(), 0, 2);
       // Move the result in the double result register.
       __ MovFromFloatResult(i.OutputDoubleRegister());
       break;
@@ -1596,14 +1603,12 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
     }
     case kMips64TruncUwD: {
       FPURegister scratch = kScratchDoubleReg;
-      // TODO(plind): Fix wrong param order of Trunc_uw_d() macro-asm function.
-      __ Trunc_uw_d(i.InputDoubleRegister(0), i.OutputRegister(), scratch);
+      __ Trunc_uw_d(i.OutputRegister(), i.InputDoubleRegister(0), scratch);
       break;
     }
     case kMips64TruncUwS: {
       FPURegister scratch = kScratchDoubleReg;
-      // TODO(plind): Fix wrong param order of Trunc_uw_d() macro-asm function.
-      __ Trunc_uw_s(i.InputDoubleRegister(0), i.OutputRegister(), scratch);
+      __ Trunc_uw_s(i.OutputRegister(), i.InputDoubleRegister(0), scratch);
       // Avoid UINT32_MAX as an overflow indicator and use 0 instead,
       // because 0 allows easier out-of-bounds detection.
       __ addiu(kScratchReg, i.OutputRegister(), 1);
@@ -1613,16 +1618,14 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
     case kMips64TruncUlS: {
       FPURegister scratch = kScratchDoubleReg;
       Register result = instr->OutputCount() > 1 ? i.OutputRegister(1) : no_reg;
-      // TODO(plind): Fix wrong param order of Trunc_ul_s() macro-asm function.
-      __ Trunc_ul_s(i.InputDoubleRegister(0), i.OutputRegister(), scratch,
+      __ Trunc_ul_s(i.OutputRegister(), i.InputDoubleRegister(0), scratch,
                     result);
       break;
     }
     case kMips64TruncUlD: {
       FPURegister scratch = kScratchDoubleReg;
       Register result = instr->OutputCount() > 1 ? i.OutputRegister(1) : no_reg;
-      // TODO(plind): Fix wrong param order of Trunc_ul_d() macro-asm function.
-      __ Trunc_ul_d(i.InputDoubleRegister(0), i.OutputRegister(0), scratch,
+      __ Trunc_ul_d(i.OutputRegister(0), i.InputDoubleRegister(0), scratch,
                     result);
       break;
     }
@@ -1792,7 +1795,9 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
           __ Ldc1(i.OutputDoubleRegister(), MemOperand(fp, offset));
         } else {
           DCHECK_EQ(op->representation(), MachineRepresentation::kFloat32);
-          __ lwc1(i.OutputSingleRegister(0), MemOperand(fp, offset));
+          __ lwc1(
+              i.OutputSingleRegister(0),
+              MemOperand(fp, offset + kLessSignificantWordInDoublewordOffset));
         }
       } else {
         __ Ld(i.OutputRegister(0), MemOperand(fp, offset));
@@ -1822,8 +1827,7 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       break;
     }
     case kMips64ByteSwap32: {
-      __ ByteSwapUnsigned(i.OutputRegister(0), i.InputRegister(0), 4);
-      __ dsrl32(i.OutputRegister(0), i.OutputRegister(0), 0);
+      __ ByteSwapSigned(i.OutputRegister(0), i.InputRegister(0), 4);
       break;
     }
     case kWord32AtomicLoadInt8:
@@ -2984,13 +2988,11 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
   return kSuccess;
 }  // NOLINT(readability/fn_size)
 
-
-#define UNSUPPORTED_COND(opcode, condition)                                  \
-  OFStream out(stdout);                                                      \
-  out << "Unsupported " << #opcode << " condition: \"" << condition << "\""; \
+#define UNSUPPORTED_COND(opcode, condition)                                    \
+  StdoutStream{} << "Unsupported " << #opcode << " condition: \"" << condition \
+                 << "\"";                                                      \
   UNIMPLEMENTED();
 
-
 void AssembleBranchToLabels(CodeGenerator* gen, TurboAssembler* tasm,
                             Instruction* instr, FlagsCondition condition,
                             Label* tlabel, Label* flabel, bool fallthru) {
@@ -3013,8 +3015,8 @@ void AssembleBranchToLabels(CodeGenerator* gen, TurboAssembler* tasm,
              instr->arch_opcode() == kMips64Dsub) {
     cc = FlagsConditionToConditionOvf(condition);
     __ dsra32(kScratchReg, i.OutputRegister(), 0);
-    __ sra(at, i.OutputRegister(), 31);
-    __ Branch(tlabel, cc, at, Operand(kScratchReg));
+    __ sra(kScratchReg2, i.OutputRegister(), 31);
+    __ Branch(tlabel, cc, kScratchReg2, Operand(kScratchReg));
   } else if (instr->arch_opcode() == kMips64DaddOvf ||
              instr->arch_opcode() == kMips64DsubOvf) {
     switch (condition) {
@@ -3108,14 +3110,15 @@ void CodeGenerator::AssembleBranchPoisoning(FlagsCondition condition,
     case kMips64Dsub: {
       // Check for overflow creates 1 or 0 for result.
       __ dsrl32(kScratchReg, i.OutputRegister(), 31);
-      __ srl(at, i.OutputRegister(), 31);
-      __ xor_(at, kScratchReg, at);
+      __ srl(kScratchReg2, i.OutputRegister(), 31);
+      __ xor_(kScratchReg2, kScratchReg, kScratchReg2);
       switch (condition) {
         case kOverflow:
-          __ LoadZeroIfConditionNotZero(kSpeculationPoisonRegister, at);
+          __ LoadZeroIfConditionNotZero(kSpeculationPoisonRegister,
+                                        kScratchReg2);
           break;
         case kNotOverflow:
-          __ LoadZeroIfConditionZero(kSpeculationPoisonRegister, at);
+          __ LoadZeroIfConditionZero(kSpeculationPoisonRegister, kScratchReg2);
           break;
         default:
           UNSUPPORTED_COND(instr->arch_opcode(), condition);
@@ -3154,7 +3157,19 @@ void CodeGenerator::AssembleBranchPoisoning(FlagsCondition condition,
       }
     }
       return;
+    case kMips64CmpS:
+    case kMips64CmpD: {
+      bool predicate;
+      FlagsConditionToConditionCmpFPU(predicate, condition);
+      if (predicate) {
+        __ LoadZeroIfFPUCondition(kSpeculationPoisonRegister);
+      } else {
+        __ LoadZeroIfNotFPUCondition(kSpeculationPoisonRegister);
+      }
+    }
+      return;
     default:
+      UNREACHABLE();
       break;
   }
 }
@@ -3172,37 +3187,25 @@ void CodeGenerator::AssembleArchTrap(Instruction* instr,
                                      FlagsCondition condition) {
   class OutOfLineTrap final : public OutOfLineCode {
    public:
-    OutOfLineTrap(CodeGenerator* gen, bool frame_elided, Instruction* instr)
-        : OutOfLineCode(gen),
-          frame_elided_(frame_elided),
-          instr_(instr),
-          gen_(gen) {}
+    OutOfLineTrap(CodeGenerator* gen, Instruction* instr)
+        : OutOfLineCode(gen), instr_(instr), gen_(gen) {}
     void Generate() final {
       MipsOperandConverter i(gen_, instr_);
-      Builtins::Name trap_id =
-          static_cast<Builtins::Name>(i.InputInt32(instr_->InputCount() - 1));
-      bool old_has_frame = __ has_frame();
-      if (frame_elided_) {
-        __ set_has_frame(true);
-        __ EnterFrame(StackFrame::WASM_COMPILED);
-      }
+      TrapId trap_id =
+          static_cast<TrapId>(i.InputInt32(instr_->InputCount() - 1));
       GenerateCallToTrap(trap_id);
-      if (frame_elided_) {
-        __ set_has_frame(old_has_frame);
-      }
     }
 
    private:
-    void GenerateCallToTrap(Builtins::Name trap_id) {
-      if (trap_id == Builtins::builtin_count) {
+    void GenerateCallToTrap(TrapId trap_id) {
+      if (trap_id == TrapId::kInvalid) {
         // We cannot test calls to the runtime in cctest/test-run-wasm.
         // Therefore we emit a call to C here instead of a call to the runtime.
         // We use the context register as the scratch register, because we do
         // not have a context here.
         __ PrepareCallCFunction(0, 0, cp);
-        __ CallCFunction(ExternalReference::wasm_call_trap_callback_for_testing(
-                             tasm()->isolate()),
-                         0);
+        __ CallCFunction(
+            ExternalReference::wasm_call_trap_callback_for_testing(), 0);
         __ LeaveFrame(StackFrame::WASM_COMPILED);
         auto call_descriptor = gen_->linkage()->GetIncomingDescriptor();
         int pop_count =
@@ -3212,8 +3215,9 @@ void CodeGenerator::AssembleArchTrap(Instruction* instr,
         __ Ret();
       } else {
         gen_->AssembleSourcePosition(instr_);
-        __ Call(tasm()->isolate()->builtins()->builtin_handle(trap_id),
-                RelocInfo::CODE_TARGET);
+        // A direct call to a wasm runtime stub defined in this module.
+        // Just encode the stub index. This will be patched at relocation.
+        __ Call(static_cast<Address>(trap_id), RelocInfo::WASM_STUB_CALL);
         ReferenceMap* reference_map =
             new (gen_->zone()) ReferenceMap(gen_->zone());
         gen_->RecordSafepoint(reference_map, Safepoint::kSimple, 0,
@@ -3223,12 +3227,10 @@ void CodeGenerator::AssembleArchTrap(Instruction* instr,
         }
       }
     }
-    bool frame_elided_;
     Instruction* instr_;
     CodeGenerator* gen_;
   };
-  bool frame_elided = !frame_access_state()->has_frame();
-  auto ool = new (zone()) OutOfLineTrap(this, frame_elided, instr);
+  auto ool = new (zone()) OutOfLineTrap(this, instr);
   Label* tlabel = ool->entry();
   AssembleBranchToLabels(this, tasm(), instr, condition, tlabel, nullptr, true);
 }
@@ -3262,8 +3264,8 @@ void CodeGenerator::AssembleArchBoolean(Instruction* instr,
     cc = FlagsConditionToConditionOvf(condition);
     // Check for overflow creates 1 or 0 for result.
     __ dsrl32(kScratchReg, i.OutputRegister(), 31);
-    __ srl(at, i.OutputRegister(), 31);
-    __ xor_(result, kScratchReg, at);
+    __ srl(kScratchReg2, i.OutputRegister(), 31);
+    __ xor_(result, kScratchReg, kScratchReg2);
     if (cc == eq)  // Toggle result for not overflow.
       __ xori(result, result, 1);
     return;
@@ -3398,13 +3400,23 @@ void CodeGenerator::AssembleArchBoolean(Instruction* instr,
   }
 }
 
+void CodeGenerator::AssembleArchBinarySearchSwitch(Instruction* instr) {
+  MipsOperandConverter i(this, instr);
+  Register input = i.InputRegister(0);
+  std::vector<std::pair<int32_t, Label*>> cases;
+  for (size_t index = 2; index < instr->InputCount(); index += 2) {
+    cases.push_back({i.InputInt32(index + 0), GetLabel(i.InputRpo(index + 1))});
+  }
+  AssembleArchBinarySearchSwitchRange(input, i.InputRpo(1), cases.data(),
+                                      cases.data() + cases.size());
+}
 
 void CodeGenerator::AssembleArchLookupSwitch(Instruction* instr) {
   MipsOperandConverter i(this, instr);
   Register input = i.InputRegister(0);
   for (size_t index = 2; index < instr->InputCount(); index += 2) {
-    __ li(at, Operand(i.InputInt32(index + 0)));
-    __ Branch(GetLabel(i.InputRpo(index + 1)), eq, input, Operand(at));
+    __ li(kScratchReg, Operand(i.InputInt32(index + 0)));
+    __ Branch(GetLabel(i.InputRpo(index + 1)), eq, input, Operand(kScratchReg));
   }
   AssembleArchJump(i.InputRpo(1));
 }
@@ -3453,6 +3465,9 @@ void CodeGenerator::AssembleConstructFrame() {
       }
     } else {
       __ StubPrologue(info()->GetOutputStackFrameType());
+      if (call_descriptor->IsWasmFunctionCall()) {
+        __ Push(kWasmInstanceRegister);
+      }
     }
   }
 
@@ -3604,7 +3619,7 @@ void CodeGenerator::AssembleMove(InstructionOperand* source,
           __ li(dst, Operand::EmbeddedNumber(src.ToFloat64().value()));
           break;
         case Constant::kExternalReference:
-          __ li(dst, Operand(src.ToExternalReference()));
+          __ li(dst, src.ToExternalReference());
           break;
         case Constant::kHeapObject: {
           Handle<HeapObject> src_object = src.ToHeapObject();
@@ -3625,10 +3640,10 @@ void CodeGenerator::AssembleMove(InstructionOperand* source,
       if (destination->IsFPStackSlot()) {
         MemOperand dst = g.ToMemOperand(destination);
         if (bit_cast<int32_t>(src.ToFloat32()) == 0) {
-          __ Sw(zero_reg, dst);
+          __ Sd(zero_reg, dst);
         } else {
           __ li(kScratchReg, Operand(bit_cast<int32_t>(src.ToFloat32())));
-          __ Sw(kScratchReg, dst);
+          __ Sd(kScratchReg, dst);
         }
       } else {
         DCHECK(destination->IsFPRegister());
diff --git a/deps/v8/src/compiler/mips64/instruction-scheduler-mips64.cc b/deps/v8/src/compiler/mips64/instruction-scheduler-mips64.cc
index af86a87ad78690..b0f6d65bfe48a7 100644
--- a/deps/v8/src/compiler/mips64/instruction-scheduler-mips64.cc
+++ b/deps/v8/src/compiler/mips64/instruction-scheduler-mips64.cc
@@ -8,17 +8,1675 @@ namespace v8 {
 namespace internal {
 namespace compiler {
 
-bool InstructionScheduler::SchedulerSupported() { return false; }
-
+bool InstructionScheduler::SchedulerSupported() { return true; }
 
 int InstructionScheduler::GetTargetInstructionFlags(
     const Instruction* instr) const {
-  UNIMPLEMENTED();
+  switch (instr->arch_opcode()) {
+    case kMips64AbsD:
+    case kMips64AbsS:
+    case kMips64Add:
+    case kMips64AddD:
+    case kMips64AddS:
+    case kMips64And:
+    case kMips64And32:
+    case kMips64AssertEqual:
+    case kMips64BitcastDL:
+    case kMips64BitcastLD:
+    case kMips64ByteSwap32:
+    case kMips64ByteSwap64:
+    case kMips64CeilWD:
+    case kMips64CeilWS:
+    case kMips64Clz:
+    case kMips64Cmp:
+    case kMips64CmpD:
+    case kMips64CmpS:
+    case kMips64Ctz:
+    case kMips64CvtDL:
+    case kMips64CvtDS:
+    case kMips64CvtDUl:
+    case kMips64CvtDUw:
+    case kMips64CvtDW:
+    case kMips64CvtSD:
+    case kMips64CvtSL:
+    case kMips64CvtSUl:
+    case kMips64CvtSUw:
+    case kMips64CvtSW:
+    case kMips64DMulHigh:
+    case kMips64MulHighU:
+    case kMips64Dadd:
+    case kMips64DaddOvf:
+    case kMips64Dclz:
+    case kMips64Dctz:
+    case kMips64Ddiv:
+    case kMips64DdivU:
+    case kMips64Dext:
+    case kMips64Dins:
+    case kMips64Div:
+    case kMips64DivD:
+    case kMips64DivS:
+    case kMips64DivU:
+    case kMips64Dlsa:
+    case kMips64Dmod:
+    case kMips64DmodU:
+    case kMips64Dmul:
+    case kMips64Dpopcnt:
+    case kMips64Dror:
+    case kMips64Dsar:
+    case kMips64Dshl:
+    case kMips64Dshr:
+    case kMips64Dsub:
+    case kMips64DsubOvf:
+    case kMips64Ext:
+    case kMips64F32x4Abs:
+    case kMips64F32x4Add:
+    case kMips64F32x4AddHoriz:
+    case kMips64F32x4Eq:
+    case kMips64F32x4ExtractLane:
+    case kMips64F32x4Lt:
+    case kMips64F32x4Le:
+    case kMips64F32x4Max:
+    case kMips64F32x4Min:
+    case kMips64F32x4Mul:
+    case kMips64F32x4Ne:
+    case kMips64F32x4Neg:
+    case kMips64F32x4RecipApprox:
+    case kMips64F32x4RecipSqrtApprox:
+    case kMips64F32x4ReplaceLane:
+    case kMips64F32x4SConvertI32x4:
+    case kMips64F32x4Splat:
+    case kMips64F32x4Sub:
+    case kMips64F32x4UConvertI32x4:
+    case kMips64Float32Max:
+    case kMips64Float32Min:
+    case kMips64Float32RoundDown:
+    case kMips64Float32RoundTiesEven:
+    case kMips64Float32RoundTruncate:
+    case kMips64Float32RoundUp:
+    case kMips64Float64ExtractLowWord32:
+    case kMips64Float64ExtractHighWord32:
+    case kMips64Float64InsertLowWord32:
+    case kMips64Float64InsertHighWord32:
+    case kMips64Float64Max:
+    case kMips64Float64Min:
+    case kMips64Float64RoundDown:
+    case kMips64Float64RoundTiesEven:
+    case kMips64Float64RoundTruncate:
+    case kMips64Float64RoundUp:
+    case kMips64Float64SilenceNaN:
+    case kMips64FloorWD:
+    case kMips64FloorWS:
+    case kMips64I16x8Add:
+    case kMips64I16x8AddHoriz:
+    case kMips64I16x8AddSaturateS:
+    case kMips64I16x8AddSaturateU:
+    case kMips64I16x8Eq:
+    case kMips64I16x8ExtractLane:
+    case kMips64I16x8GeS:
+    case kMips64I16x8GeU:
+    case kMips64I16x8GtS:
+    case kMips64I16x8GtU:
+    case kMips64I16x8MaxS:
+    case kMips64I16x8MaxU:
+    case kMips64I16x8MinS:
+    case kMips64I16x8MinU:
+    case kMips64I16x8Mul:
+    case kMips64I16x8Ne:
+    case kMips64I16x8Neg:
+    case kMips64I16x8ReplaceLane:
+    case kMips64I8x16SConvertI16x8:
+    case kMips64I16x8SConvertI32x4:
+    case kMips64I16x8SConvertI8x16High:
+    case kMips64I16x8SConvertI8x16Low:
+    case kMips64I16x8Shl:
+    case kMips64I16x8ShrS:
+    case kMips64I16x8ShrU:
+    case kMips64I16x8Splat:
+    case kMips64I16x8Sub:
+    case kMips64I16x8SubSaturateS:
+    case kMips64I16x8SubSaturateU:
+    case kMips64I8x16UConvertI16x8:
+    case kMips64I16x8UConvertI32x4:
+    case kMips64I16x8UConvertI8x16High:
+    case kMips64I16x8UConvertI8x16Low:
+    case kMips64I32x4Add:
+    case kMips64I32x4AddHoriz:
+    case kMips64I32x4Eq:
+    case kMips64I32x4ExtractLane:
+    case kMips64I32x4GeS:
+    case kMips64I32x4GeU:
+    case kMips64I32x4GtS:
+    case kMips64I32x4GtU:
+    case kMips64I32x4MaxS:
+    case kMips64I32x4MaxU:
+    case kMips64I32x4MinS:
+    case kMips64I32x4MinU:
+    case kMips64I32x4Mul:
+    case kMips64I32x4Ne:
+    case kMips64I32x4Neg:
+    case kMips64I32x4ReplaceLane:
+    case kMips64I32x4SConvertF32x4:
+    case kMips64I32x4SConvertI16x8High:
+    case kMips64I32x4SConvertI16x8Low:
+    case kMips64I32x4Shl:
+    case kMips64I32x4ShrS:
+    case kMips64I32x4ShrU:
+    case kMips64I32x4Splat:
+    case kMips64I32x4Sub:
+    case kMips64I32x4UConvertF32x4:
+    case kMips64I32x4UConvertI16x8High:
+    case kMips64I32x4UConvertI16x8Low:
+    case kMips64I8x16Add:
+    case kMips64I8x16AddSaturateS:
+    case kMips64I8x16AddSaturateU:
+    case kMips64I8x16Eq:
+    case kMips64I8x16ExtractLane:
+    case kMips64I8x16GeS:
+    case kMips64I8x16GeU:
+    case kMips64I8x16GtS:
+    case kMips64I8x16GtU:
+    case kMips64I8x16MaxS:
+    case kMips64I8x16MaxU:
+    case kMips64I8x16MinS:
+    case kMips64I8x16MinU:
+    case kMips64I8x16Mul:
+    case kMips64I8x16Ne:
+    case kMips64I8x16Neg:
+    case kMips64I8x16ReplaceLane:
+    case kMips64I8x16Shl:
+    case kMips64I8x16ShrS:
+    case kMips64I8x16ShrU:
+    case kMips64I8x16Splat:
+    case kMips64I8x16Sub:
+    case kMips64I8x16SubSaturateS:
+    case kMips64I8x16SubSaturateU:
+    case kMips64Ins:
+    case kMips64Lsa:
+    case kMips64MaxD:
+    case kMips64MaxS:
+    case kMips64MinD:
+    case kMips64MinS:
+    case kMips64Mod:
+    case kMips64ModU:
+    case kMips64Mov:
+    case kMips64Mul:
+    case kMips64MulD:
+    case kMips64MulHigh:
+    case kMips64MulOvf:
+    case kMips64MulS:
+    case kMips64NegD:
+    case kMips64NegS:
+    case kMips64Nor:
+    case kMips64Nor32:
+    case kMips64Or:
+    case kMips64Or32:
+    case kMips64Popcnt:
+    case kMips64Ror:
+    case kMips64RoundWD:
+    case kMips64RoundWS:
+    case kMips64S128And:
+    case kMips64S128Or:
+    case kMips64S128Not:
+    case kMips64S128Select:
+    case kMips64S128Xor:
+    case kMips64S128Zero:
+    case kMips64S16x8InterleaveEven:
+    case kMips64S16x8InterleaveOdd:
+    case kMips64S16x8InterleaveLeft:
+    case kMips64S16x8InterleaveRight:
+    case kMips64S16x8PackEven:
+    case kMips64S16x8PackOdd:
+    case kMips64S16x2Reverse:
+    case kMips64S16x4Reverse:
+    case kMips64S1x16AllTrue:
+    case kMips64S1x16AnyTrue:
+    case kMips64S1x4AllTrue:
+    case kMips64S1x4AnyTrue:
+    case kMips64S1x8AllTrue:
+    case kMips64S1x8AnyTrue:
+    case kMips64S32x4InterleaveEven:
+    case kMips64S32x4InterleaveOdd:
+    case kMips64S32x4InterleaveLeft:
+    case kMips64S32x4InterleaveRight:
+    case kMips64S32x4PackEven:
+    case kMips64S32x4PackOdd:
+    case kMips64S32x4Shuffle:
+    case kMips64S8x16Concat:
+    case kMips64S8x16InterleaveEven:
+    case kMips64S8x16InterleaveOdd:
+    case kMips64S8x16InterleaveLeft:
+    case kMips64S8x16InterleaveRight:
+    case kMips64S8x16PackEven:
+    case kMips64S8x16PackOdd:
+    case kMips64S8x2Reverse:
+    case kMips64S8x4Reverse:
+    case kMips64S8x8Reverse:
+    case kMips64S8x16Shuffle:
+    case kMips64Sar:
+    case kMips64Seb:
+    case kMips64Seh:
+    case kMips64Shl:
+    case kMips64Shr:
+    case kMips64SqrtD:
+    case kMips64SqrtS:
+    case kMips64Sub:
+    case kMips64SubD:
+    case kMips64SubS:
+    case kMips64TruncLD:
+    case kMips64TruncLS:
+    case kMips64TruncUlD:
+    case kMips64TruncUlS:
+    case kMips64TruncUwD:
+    case kMips64TruncUwS:
+    case kMips64TruncWD:
+    case kMips64TruncWS:
+    case kMips64Tst:
+    case kMips64Xor:
+    case kMips64Xor32:
+      return kNoOpcodeFlags;
+
+    case kMips64Lb:
+    case kMips64Lbu:
+    case kMips64Ld:
+    case kMips64Ldc1:
+    case kMips64Lh:
+    case kMips64Lhu:
+    case kMips64Lw:
+    case kMips64Lwc1:
+    case kMips64Lwu:
+    case kMips64MsaLd:
+    case kMips64Peek:
+    case kMips64Uld:
+    case kMips64Uldc1:
+    case kMips64Ulh:
+    case kMips64Ulhu:
+    case kMips64Ulw:
+    case kMips64Ulwu:
+    case kMips64Ulwc1:
+      return kIsLoadOperation;
+
+    case kMips64ModD:
+    case kMips64ModS:
+    case kMips64MsaSt:
+    case kMips64Push:
+    case kMips64Sb:
+    case kMips64Sd:
+    case kMips64Sdc1:
+    case kMips64Sh:
+    case kMips64StackClaim:
+    case kMips64StoreToStackSlot:
+    case kMips64Sw:
+    case kMips64Swc1:
+    case kMips64Usd:
+    case kMips64Usdc1:
+    case kMips64Ush:
+    case kMips64Usw:
+    case kMips64Uswc1:
+      return kHasSideEffect;
+
+#define CASE(Name) case k##Name:
+      COMMON_ARCH_OPCODE_LIST(CASE)
+#undef CASE
+      // Already covered in architecture independent code.
+      UNREACHABLE();
+  }
+
+  UNREACHABLE();
+}
+
+enum Latency {
+  BRANCH = 4,  // Estimated max.
+  RINT_S = 4,  // Estimated.
+  RINT_D = 4,  // Estimated.
+
+  MULT = 4,
+  MULTU = 4,
+  DMULT = 4,
+  DMULTU = 4,
+
+  MUL = 7,
+  DMUL = 7,
+  MUH = 7,
+  MUHU = 7,
+  DMUH = 7,
+  DMUHU = 7,
+
+  DIV = 50,  // Min:11 Max:50
+  DDIV = 50,
+  DIVU = 50,
+  DDIVU = 50,
+
+  ABS_S = 4,
+  ABS_D = 4,
+  NEG_S = 4,
+  NEG_D = 4,
+  ADD_S = 4,
+  ADD_D = 4,
+  SUB_S = 4,
+  SUB_D = 4,
+  MAX_S = 4,  // Estimated.
+  MIN_S = 4,
+  MAX_D = 4,  // Estimated.
+  MIN_D = 4,
+  C_cond_S = 4,
+  C_cond_D = 4,
+  MUL_S = 4,
+
+  MADD_S = 4,
+  MSUB_S = 4,
+  NMADD_S = 4,
+  NMSUB_S = 4,
+
+  CABS_cond_S = 4,
+  CABS_cond_D = 4,
+
+  CVT_D_S = 4,
+  CVT_PS_PW = 4,
+
+  CVT_S_W = 4,
+  CVT_S_L = 4,
+  CVT_D_W = 4,
+  CVT_D_L = 4,
+
+  CVT_S_D = 4,
+
+  CVT_W_S = 4,
+  CVT_W_D = 4,
+  CVT_L_S = 4,
+  CVT_L_D = 4,
+
+  CEIL_W_S = 4,
+  CEIL_W_D = 4,
+  CEIL_L_S = 4,
+  CEIL_L_D = 4,
+
+  FLOOR_W_S = 4,
+  FLOOR_W_D = 4,
+  FLOOR_L_S = 4,
+  FLOOR_L_D = 4,
+
+  ROUND_W_S = 4,
+  ROUND_W_D = 4,
+  ROUND_L_S = 4,
+  ROUND_L_D = 4,
+
+  TRUNC_W_S = 4,
+  TRUNC_W_D = 4,
+  TRUNC_L_S = 4,
+  TRUNC_L_D = 4,
+
+  MOV_S = 4,
+  MOV_D = 4,
+
+  MOVF_S = 4,
+  MOVF_D = 4,
+
+  MOVN_S = 4,
+  MOVN_D = 4,
+
+  MOVT_S = 4,
+  MOVT_D = 4,
+
+  MOVZ_S = 4,
+  MOVZ_D = 4,
+
+  MUL_D = 5,
+  MADD_D = 5,
+  MSUB_D = 5,
+  NMADD_D = 5,
+  NMSUB_D = 5,
+
+  RECIP_S = 13,
+  RECIP_D = 26,
+
+  RSQRT_S = 17,
+  RSQRT_D = 36,
+
+  DIV_S = 17,
+  SQRT_S = 17,
+
+  DIV_D = 32,
+  SQRT_D = 32,
+
+  MTC1 = 4,
+  MTHC1 = 4,
+  DMTC1 = 4,
+  LWC1 = 4,
+  LDC1 = 4,
+
+  MFC1 = 1,
+  MFHC1 = 1,
+  DMFC1 = 1,
+  MFHI = 1,
+  MFLO = 1,
+  SWC1 = 1,
+  SDC1 = 1,
+};
+
+int DadduLatency(bool is_operand_register = true) {
+  if (is_operand_register) {
+    return 1;
+  } else {
+    return 2;  // Estimated max.
+  }
+}
+
+int DsubuLatency(bool is_operand_register = true) {
+  return DadduLatency(is_operand_register);
+}
+
+int AndLatency(bool is_operand_register = true) {
+  return DadduLatency(is_operand_register);
+}
+
+int OrLatency(bool is_operand_register = true) {
+  return DadduLatency(is_operand_register);
+}
+
+int NorLatency(bool is_operand_register = true) {
+  if (is_operand_register) {
+    return 1;
+  } else {
+    return 2;  // Estimated max.
+  }
+}
+
+int XorLatency(bool is_operand_register = true) {
+  return DadduLatency(is_operand_register);
+}
+
+int MulLatency(bool is_operand_register = true) {
+  if (is_operand_register) {
+    return Latency::MUL;
+  } else {
+    return Latency::MUL + 1;
+  }
+}
+
+int DmulLatency(bool is_operand_register = true) {
+  int latency = 0;
+  if (kArchVariant >= kMips64r6) {
+    latency = Latency::DMUL;
+  } else {
+    latency = Latency::DMULT + Latency::MFLO;
+  }
+  if (!is_operand_register) {
+    latency += 1;
+  }
+  return latency;
+}
+
+int MulhLatency(bool is_operand_register = true) {
+  int latency = 0;
+  if (kArchVariant >= kMips64r6) {
+    latency = Latency::MUH;
+  } else {
+    latency = Latency::MULT + Latency::MFHI;
+  }
+  if (!is_operand_register) {
+    latency += 1;
+  }
+  return latency;
+}
+
+int MulhuLatency(bool is_operand_register = true) {
+  int latency = 0;
+  if (kArchVariant >= kMips64r6) {
+    latency = Latency::MUH;
+  } else {
+    latency = Latency::MULTU + Latency::MFHI;
+  }
+  if (!is_operand_register) {
+    latency += 1;
+  }
+  return latency;
+}
+
+int DMulhLatency(bool is_operand_register = true) {
+  int latency = 0;
+  if (kArchVariant >= kMips64r6) {
+    latency = Latency::DMUH;
+  } else {
+    latency = Latency::DMULT + Latency::MFHI;
+  }
+  if (!is_operand_register) {
+    latency += 1;
+  }
+  return latency;
+}
+
+int DivLatency(bool is_operand_register = true) {
+  if (is_operand_register) {
+    return Latency::DIV;
+  } else {
+    return Latency::DIV + 1;
+  }
+}
+
+int DivuLatency(bool is_operand_register = true) {
+  if (is_operand_register) {
+    return Latency::DIVU;
+  } else {
+    return Latency::DIVU + 1;
+  }
+}
+
+int DdivLatency(bool is_operand_register = true) {
+  int latency = 0;
+  if (kArchVariant >= kMips64r6) {
+    latency = Latency::DDIV;
+  } else {
+    latency = Latency::DDIV + Latency::MFLO;
+  }
+  if (!is_operand_register) {
+    latency += 1;
+  }
+  return latency;
+}
+
+int DdivuLatency(bool is_operand_register = true) {
+  int latency = 0;
+  if (kArchVariant >= kMips64r6) {
+    latency = Latency::DDIVU;
+  } else {
+    latency = Latency::DDIVU + Latency::MFLO;
+  }
+  if (!is_operand_register) {
+    latency += 1;
+  }
+  return latency;
+}
+
+int ModLatency(bool is_operand_register = true) {
+  int latency = 0;
+  if (kArchVariant >= kMips64r6) {
+    latency = 1;
+  } else {
+    latency = Latency::DIV + Latency::MFHI;
+  }
+  if (!is_operand_register) {
+    latency += 1;
+  }
+  return latency;
+}
+
+int ModuLatency(bool is_operand_register = true) {
+  int latency = 0;
+  if (kArchVariant >= kMips64r6) {
+    latency = 1;
+  } else {
+    latency = Latency::DIVU + Latency::MFHI;
+  }
+  if (!is_operand_register) {
+    latency += 1;
+  }
+  return latency;
+}
+
+int DmodLatency(bool is_operand_register = true) {
+  int latency = 0;
+  if (kArchVariant >= kMips64r6) {
+    latency = 1;
+  } else {
+    latency = Latency::DDIV + Latency::MFHI;
+  }
+  if (!is_operand_register) {
+    latency += 1;
+  }
+  return latency;
+}
+
+int DmoduLatency(bool is_operand_register = true) {
+  int latency = 0;
+  if (kArchVariant >= kMips64r6) {
+    latency = 1;
+  } else {
+    latency = Latency::DDIV + Latency::MFHI;
+  }
+  if (!is_operand_register) {
+    latency += 1;
+  }
+  return latency;
+}
+
+int MovzLatency() {
+  if (kArchVariant >= kMips64r6) {
+    return Latency::BRANCH + 1;
+  } else {
+    return 1;
+  }
+}
+
+int MovnLatency() {
+  if (kArchVariant >= kMips64r6) {
+    return Latency::BRANCH + 1;
+  } else {
+    return 1;
+  }
+}
+
+int DlsaLatency() {
+  // Estimated max.
+  return DadduLatency() + 1;
+}
+
+int CallLatency() {
+  // Estimated.
+  return DadduLatency(false) + Latency::BRANCH + 5;
+}
+
+int JumpLatency() {
+  // Estimated max.
+  return 1 + DadduLatency() + Latency::BRANCH + 2;
+}
+
+int SmiUntagLatency() { return 1; }
+
+int PrepareForTailCallLatency() {
+  // Estimated max.
+  return 2 * (DlsaLatency() + DadduLatency(false)) + 2 + Latency::BRANCH +
+         Latency::BRANCH + 2 * DsubuLatency(false) + 2 + Latency::BRANCH + 1;
 }
 
+int AssemblePopArgumentsAdoptFrameLatency() {
+  return 1 + Latency::BRANCH + 1 + SmiUntagLatency() +
+         PrepareForTailCallLatency();
+}
+
+int AssertLatency() { return 1; }
+
+int PrepareCallCFunctionLatency() {
+  int frame_alignment = TurboAssembler::ActivationFrameAlignment();
+  if (frame_alignment > kPointerSize) {
+    return 1 + DsubuLatency(false) + AndLatency(false) + 1;
+  } else {
+    return DsubuLatency(false);
+  }
+}
+
+int AdjustBaseAndOffsetLatency() {
+  return 3;  // Estimated max.
+}
+
+int AlignedMemoryLatency() { return AdjustBaseAndOffsetLatency() + 1; }
+
+int UlhuLatency() {
+  if (kArchVariant >= kMips64r6) {
+    return AlignedMemoryLatency();
+  } else {
+    return AdjustBaseAndOffsetLatency() + 2 * AlignedMemoryLatency() + 2;
+  }
+}
+
+int UlwLatency() {
+  if (kArchVariant >= kMips64r6) {
+    return AlignedMemoryLatency();
+  } else {
+    // Estimated max.
+    return AdjustBaseAndOffsetLatency() + 3;
+  }
+}
+
+int UlwuLatency() {
+  if (kArchVariant >= kMips64r6) {
+    return AlignedMemoryLatency();
+  } else {
+    return UlwLatency() + 1;
+  }
+}
+
+int UldLatency() {
+  if (kArchVariant >= kMips64r6) {
+    return AlignedMemoryLatency();
+  } else {
+    // Estimated max.
+    return AdjustBaseAndOffsetLatency() + 3;
+  }
+}
+
+int Ulwc1Latency() {
+  if (kArchVariant >= kMips64r6) {
+    return AlignedMemoryLatency();
+  } else {
+    return UlwLatency() + Latency::MTC1;
+  }
+}
+
+int Uldc1Latency() {
+  if (kArchVariant >= kMips64r6) {
+    return AlignedMemoryLatency();
+  } else {
+    return UldLatency() + Latency::DMTC1;
+  }
+}
+
+int UshLatency() {
+  if (kArchVariant >= kMips64r6) {
+    return AlignedMemoryLatency();
+  } else {
+    // Estimated max.
+    return AdjustBaseAndOffsetLatency() + 2 + 2 * AlignedMemoryLatency();
+  }
+}
+
+int UswLatency() {
+  if (kArchVariant >= kMips64r6) {
+    return AlignedMemoryLatency();
+  } else {
+    return AdjustBaseAndOffsetLatency() + 2;
+  }
+}
+
+int UsdLatency() {
+  if (kArchVariant >= kMips64r6) {
+    return AlignedMemoryLatency();
+  } else {
+    return AdjustBaseAndOffsetLatency() + 2;
+  }
+}
+
+int Uswc1Latency() {
+  if (kArchVariant >= kMips64r6) {
+    return AlignedMemoryLatency();
+  } else {
+    return Latency::MFC1 + UswLatency();
+  }
+}
+
+int Usdc1Latency() {
+  if (kArchVariant >= kMips64r6) {
+    return AlignedMemoryLatency();
+  } else {
+    return Latency::DMFC1 + UsdLatency();
+  }
+}
+
+int Lwc1Latency() { return AdjustBaseAndOffsetLatency() + Latency::LWC1; }
+
+int Swc1Latency() { return AdjustBaseAndOffsetLatency() + Latency::SWC1; }
+
+int Sdc1Latency() { return AdjustBaseAndOffsetLatency() + Latency::SDC1; }
+
+int Ldc1Latency() { return AdjustBaseAndOffsetLatency() + Latency::LDC1; }
+
+int MultiPushLatency() {
+  int latency = DsubuLatency(false);
+  for (int16_t i = kNumRegisters - 1; i >= 0; i--) {
+    latency++;
+  }
+  return latency;
+}
+
+int MultiPushFPULatency() {
+  int latency = DsubuLatency(false);
+  for (int16_t i = kNumRegisters - 1; i >= 0; i--) {
+    latency += Sdc1Latency();
+  }
+  return latency;
+}
+
+int PushCallerSavedLatency(SaveFPRegsMode fp_mode) {
+  int latency = MultiPushLatency();
+  if (fp_mode == kSaveFPRegs) {
+    latency += MultiPushFPULatency();
+  }
+  return latency;
+}
+
+int MultiPopLatency() {
+  int latency = DadduLatency(false);
+  for (int16_t i = 0; i < kNumRegisters; i++) {
+    latency++;
+  }
+  return latency;
+}
+
+int MultiPopFPULatency() {
+  int latency = DadduLatency(false);
+  for (int16_t i = 0; i < kNumRegisters; i++) {
+    latency += Ldc1Latency();
+  }
+  return latency;
+}
+
+int PopCallerSavedLatency(SaveFPRegsMode fp_mode) {
+  int latency = MultiPopLatency();
+  if (fp_mode == kSaveFPRegs) {
+    latency += MultiPopFPULatency();
+  }
+  return latency;
+}
+
+int CallCFunctionHelperLatency() {
+  // Estimated.
+  int latency = AndLatency(false) + Latency::BRANCH + 2 + CallLatency();
+  if (base::OS::ActivationFrameAlignment() > kPointerSize) {
+    latency++;
+  } else {
+    latency += DadduLatency(false);
+  }
+  return latency;
+}
+
+int CallCFunctionLatency() { return 1 + CallCFunctionHelperLatency(); }
+
+int AssembleArchJumpLatency() {
+  // Estimated max.
+  return Latency::BRANCH;
+}
+
+int AssembleArchLookupSwitchLatency(const Instruction* instr) {
+  int latency = 0;
+  for (size_t index = 2; index < instr->InputCount(); index += 2) {
+    latency += 1 + Latency::BRANCH;
+  }
+  return latency + AssembleArchJumpLatency();
+}
+
+int GenerateSwitchTableLatency() {
+  int latency = 0;
+  if (kArchVariant >= kMips64r6) {
+    latency = DlsaLatency() + 2;
+  } else {
+    latency = 6;
+  }
+  latency += 2;
+  return latency;
+}
+
+int AssembleArchTableSwitchLatency() {
+  return Latency::BRANCH + GenerateSwitchTableLatency();
+}
+
+int DropAndRetLatency() {
+  // Estimated max.
+  return DadduLatency(false) + JumpLatency();
+}
+
+int AssemblerReturnLatency() {
+  // Estimated max.
+  return DadduLatency(false) + MultiPopLatency() + MultiPopFPULatency() +
+         Latency::BRANCH + DadduLatency() + 1 + DropAndRetLatency();
+}
+
+int TryInlineTruncateDoubleToILatency() {
+  return 2 + Latency::TRUNC_W_D + Latency::MFC1 + 2 + AndLatency(false) +
+         Latency::BRANCH;
+}
+
+int CallStubDelayedLatency() { return 1 + CallLatency(); }
+
+int TruncateDoubleToIDelayedLatency() {
+  return TryInlineTruncateDoubleToILatency() + 1 + DsubuLatency(false) +
+         Sdc1Latency() + CallStubDelayedLatency() + DadduLatency(false) + 1;
+}
+
+int CheckPageFlagLatency() {
+  return AndLatency(false) + AlignedMemoryLatency() + AndLatency(false) +
+         Latency::BRANCH;
+}
+
+int SltuLatency(bool is_operand_register = true) {
+  if (is_operand_register) {
+    return 1;
+  } else {
+    return 2;  // Estimated max.
+  }
+}
+
+int BranchShortHelperR6Latency() {
+  return 2;  // Estimated max.
+}
+
+int BranchShortHelperLatency() {
+  return SltuLatency() + 2;  // Estimated max.
+}
+
+int BranchShortLatency(BranchDelaySlot bdslot = PROTECT) {
+  if (kArchVariant >= kMips64r6 && bdslot == PROTECT) {
+    return BranchShortHelperR6Latency();
+  } else {
+    return BranchShortHelperLatency();
+  }
+}
+
+int MoveLatency() { return 1; }
+
+int MovToFloatParametersLatency() { return 2 * MoveLatency(); }
+
+int MovFromFloatResultLatency() { return MoveLatency(); }
+
+int DaddOverflowLatency() {
+  // Estimated max.
+  return 6;
+}
+
+int DsubOverflowLatency() {
+  // Estimated max.
+  return 6;
+}
+
+int MulOverflowLatency() {
+  // Estimated max.
+  return MulLatency() + MulhLatency() + 2;
+}
+
+int DclzLatency() { return 1; }
+
+int CtzLatency() {
+  if (kArchVariant >= kMips64r6) {
+    return 3 + DclzLatency();
+  } else {
+    return DadduLatency(false) + XorLatency() + AndLatency() + DclzLatency() +
+           1 + DsubuLatency();
+  }
+}
+
+int DctzLatency() {
+  if (kArchVariant >= kMips64r6) {
+    return 4;
+  } else {
+    return DadduLatency(false) + XorLatency() + AndLatency() + 1 +
+           DsubuLatency();
+  }
+}
+
+int PopcntLatency() {
+  return 2 + AndLatency() + DsubuLatency() + 1 + AndLatency() + 1 +
+         AndLatency() + DadduLatency() + 1 + DadduLatency() + 1 + AndLatency() +
+         1 + MulLatency() + 1;
+}
+
+int DpopcntLatency() {
+  return 2 + AndLatency() + DsubuLatency() + 1 + AndLatency() + 1 +
+         AndLatency() + DadduLatency() + 1 + DadduLatency() + 1 + AndLatency() +
+         1 + DmulLatency() + 1;
+}
+
+int CompareFLatency() { return Latency::C_cond_S; }
+
+int CompareF32Latency() { return CompareFLatency(); }
+
+int CompareF64Latency() { return CompareFLatency(); }
+
+int CompareIsNanFLatency() { return CompareFLatency(); }
+
+int CompareIsNanF32Latency() { return CompareIsNanFLatency(); }
+
+int CompareIsNanF64Latency() { return CompareIsNanFLatency(); }
+
+int NegsLatency() {
+  if (kArchVariant >= kMips64r6) {
+    return Latency::NEG_S;
+  } else {
+    // Estimated.
+    return CompareIsNanF32Latency() + 2 * Latency::BRANCH + Latency::NEG_S +
+           Latency::MFC1 + 1 + XorLatency() + Latency::MTC1;
+  }
+}
+
+int NegdLatency() {
+  if (kArchVariant >= kMips64r6) {
+    return Latency::NEG_D;
+  } else {
+    // Estimated.
+    return CompareIsNanF64Latency() + 2 * Latency::BRANCH + Latency::NEG_D +
+           Latency::DMFC1 + 1 + XorLatency() + Latency::DMTC1;
+  }
+}
+
+int Float64RoundLatency() {
+  if (kArchVariant >= kMips64r6) {
+    return Latency::RINT_D + 4;
+  } else {
+    // For ceil_l_d, floor_l_d, round_l_d, trunc_l_d latency is 4.
+    return Latency::DMFC1 + 1 + Latency::BRANCH + Latency::MOV_D + 4 +
+           Latency::DMFC1 + Latency::BRANCH + Latency::CVT_D_L + 2 +
+           Latency::MTHC1;
+  }
+}
+
+int Float32RoundLatency() {
+  if (kArchVariant >= kMips64r6) {
+    return Latency::RINT_S + 4;
+  } else {
+    // For ceil_w_s, floor_w_s, round_w_s, trunc_w_s latency is 4.
+    return Latency::MFC1 + 1 + Latency::BRANCH + Latency::MOV_S + 4 +
+           Latency::MFC1 + Latency::BRANCH + Latency::CVT_S_W + 2 +
+           Latency::MTC1;
+  }
+}
+
+int Float32MaxLatency() {
+  // Estimated max.
+  int latency = CompareIsNanF32Latency() + Latency::BRANCH;
+  if (kArchVariant >= kMips64r6) {
+    return latency + Latency::MAX_S;
+  } else {
+    return latency + 5 * Latency::BRANCH + 2 * CompareF32Latency() +
+           Latency::MFC1 + 1 + Latency::MOV_S;
+  }
+}
+
+int Float64MaxLatency() {
+  // Estimated max.
+  int latency = CompareIsNanF64Latency() + Latency::BRANCH;
+  if (kArchVariant >= kMips64r6) {
+    return latency + Latency::MAX_D;
+  } else {
+    return latency + 5 * Latency::BRANCH + 2 * CompareF64Latency() +
+           Latency::DMFC1 + Latency::MOV_D;
+  }
+}
+
+int Float32MinLatency() {
+  // Estimated max.
+  int latency = CompareIsNanF32Latency() + Latency::BRANCH;
+  if (kArchVariant >= kMips64r6) {
+    return latency + Latency::MIN_S;
+  } else {
+    return latency + 5 * Latency::BRANCH + 2 * CompareF32Latency() +
+           Latency::MFC1 + 1 + Latency::MOV_S;
+  }
+}
+
+int Float64MinLatency() {
+  // Estimated max.
+  int latency = CompareIsNanF64Latency() + Latency::BRANCH;
+  if (kArchVariant >= kMips64r6) {
+    return latency + Latency::MIN_D;
+  } else {
+    return latency + 5 * Latency::BRANCH + 2 * CompareF32Latency() +
+           Latency::DMFC1 + Latency::MOV_D;
+  }
+}
+
+int TruncLSLatency(bool load_status) {
+  int latency = Latency::TRUNC_L_S + Latency::DMFC1;
+  if (load_status) {
+    latency += SltuLatency() + 7;
+  }
+  return latency;
+}
+
+int TruncLDLatency(bool load_status) {
+  int latency = Latency::TRUNC_L_D + Latency::DMFC1;
+  if (load_status) {
+    latency += SltuLatency() + 7;
+  }
+  return latency;
+}
+
+int TruncUlSLatency() {
+  // Estimated max.
+  return 2 * CompareF32Latency() + CompareIsNanF32Latency() +
+         4 * Latency::BRANCH + Latency::SUB_S + 2 * Latency::TRUNC_L_S +
+         3 * Latency::DMFC1 + OrLatency() + Latency::MTC1 + Latency::MOV_S +
+         SltuLatency() + 4;
+}
+
+int TruncUlDLatency() {
+  // Estimated max.
+  return 2 * CompareF64Latency() + CompareIsNanF64Latency() +
+         4 * Latency::BRANCH + Latency::SUB_D + 2 * Latency::TRUNC_L_D +
+         3 * Latency::DMFC1 + OrLatency() + Latency::DMTC1 + Latency::MOV_D +
+         SltuLatency() + 4;
+}
+
+int PushLatency() { return DadduLatency() + AlignedMemoryLatency(); }
+
+int ByteSwapSignedLatency() { return 2; }
+
+int LlLatency(int offset) {
+  bool is_one_instruction =
+      (kArchVariant == kMips64r6) ? is_int9(offset) : is_int16(offset);
+  if (is_one_instruction) {
+    return 1;
+  } else {
+    return 3;
+  }
+}
+
+int ExtractBitsLatency(bool sign_extend, int size) {
+  int latency = 2;
+  if (sign_extend) {
+    switch (size) {
+      case 8:
+      case 16:
+      case 32:
+        latency += 1;
+        break;
+      default:
+        UNREACHABLE();
+    }
+  }
+  return latency;
+}
+
+int InsertBitsLatency() { return 2 + DsubuLatency(false) + 2; }
+
+int ScLatency(int offset) {
+  bool is_one_instruction =
+      (kArchVariant == kMips64r6) ? is_int9(offset) : is_int16(offset);
+  if (is_one_instruction) {
+    return 1;
+  } else {
+    return 3;
+  }
+}
+
+int Word32AtomicExchangeLatency(bool sign_extend, int size) {
+  return DadduLatency(false) + 1 + DsubuLatency() + 2 + LlLatency(0) +
+         ExtractBitsLatency(sign_extend, size) + InsertBitsLatency() +
+         ScLatency(0) + BranchShortLatency() + 1;
+}
+
+int Word32AtomicCompareExchangeLatency(bool sign_extend, int size) {
+  return 2 + DsubuLatency() + 2 + LlLatency(0) +
+         ExtractBitsLatency(sign_extend, size) + InsertBitsLatency() +
+         ScLatency(0) + BranchShortLatency() + 1;
+}
 
 int InstructionScheduler::GetInstructionLatency(const Instruction* instr) {
-  UNIMPLEMENTED();
+  // Basic latency modeling for MIPS64 instructions. They have been determined
+  // in empirical way.
+  switch (instr->arch_opcode()) {
+    case kArchCallCodeObject:
+    case kArchCallWasmFunction:
+      return CallLatency();
+    case kArchTailCallCodeObjectFromJSFunction:
+    case kArchTailCallCodeObject: {
+      int latency = 0;
+      if (instr->arch_opcode() == kArchTailCallCodeObjectFromJSFunction) {
+        latency = AssemblePopArgumentsAdoptFrameLatency();
+      }
+      return latency + JumpLatency();
+    }
+    case kArchTailCallWasm:
+    case kArchTailCallAddress:
+      return JumpLatency();
+    case kArchCallJSFunction: {
+      int latency = 0;
+      if (FLAG_debug_code) {
+        latency = 1 + AssertLatency();
+      }
+      return latency + 1 + DadduLatency(false) + CallLatency();
+    }
+    case kArchPrepareCallCFunction:
+      return PrepareCallCFunctionLatency();
+    case kArchSaveCallerRegisters: {
+      auto fp_mode =
+          static_cast<SaveFPRegsMode>(MiscField::decode(instr->opcode()));
+      return PushCallerSavedLatency(fp_mode);
+    }
+    case kArchRestoreCallerRegisters: {
+      auto fp_mode =
+          static_cast<SaveFPRegsMode>(MiscField::decode(instr->opcode()));
+      return PopCallerSavedLatency(fp_mode);
+    }
+    case kArchPrepareTailCall:
+      return 2;
+    case kArchCallCFunction:
+      return CallCFunctionLatency();
+    case kArchJmp:
+      return AssembleArchJumpLatency();
+    case kArchLookupSwitch:
+      return AssembleArchLookupSwitchLatency(instr);
+    case kArchTableSwitch:
+      return AssembleArchTableSwitchLatency();
+    case kArchDebugAbort:
+      return CallLatency() + 1;
+    case kArchDebugBreak:
+      return 1;
+    case kArchComment:
+    case kArchNop:
+    case kArchThrowTerminator:
+    case kArchDeoptimize:
+      return 0;
+    case kArchRet:
+      return AssemblerReturnLatency();
+    case kArchStackPointer:
+    case kArchFramePointer:
+      return 1;
+    case kArchParentFramePointer:
+      // Estimated max.
+      return AlignedMemoryLatency();
+    case kArchTruncateDoubleToI:
+      return TruncateDoubleToIDelayedLatency();
+    case kArchStoreWithWriteBarrier:
+      return DadduLatency() + 1 + CheckPageFlagLatency();
+    case kArchStackSlot:
+      // Estimated max.
+      return DadduLatency(false) + AndLatency(false) + AssertLatency() +
+             DadduLatency(false) + AndLatency(false) + BranchShortLatency() +
+             1 + DsubuLatency() + DadduLatency();
+    case kArchWordPoisonOnSpeculation:
+      return AndLatency();
+    case kIeee754Float64Acos:
+    case kIeee754Float64Acosh:
+    case kIeee754Float64Asin:
+    case kIeee754Float64Asinh:
+    case kIeee754Float64Atan:
+    case kIeee754Float64Atanh:
+    case kIeee754Float64Atan2:
+    case kIeee754Float64Cos:
+    case kIeee754Float64Cosh:
+    case kIeee754Float64Cbrt:
+    case kIeee754Float64Exp:
+    case kIeee754Float64Expm1:
+    case kIeee754Float64Log:
+    case kIeee754Float64Log1p:
+    case kIeee754Float64Log10:
+    case kIeee754Float64Log2:
+    case kIeee754Float64Pow:
+    case kIeee754Float64Sin:
+    case kIeee754Float64Sinh:
+    case kIeee754Float64Tan:
+    case kIeee754Float64Tanh:
+      return PrepareCallCFunctionLatency() + MovToFloatParametersLatency() +
+             CallCFunctionLatency() + MovFromFloatResultLatency();
+    case kMips64Add:
+    case kMips64Dadd:
+      return DadduLatency(instr->InputAt(1)->IsRegister());
+    case kMips64DaddOvf:
+      return DaddOverflowLatency();
+    case kMips64Sub:
+    case kMips64Dsub:
+      return DsubuLatency(instr->InputAt(1)->IsRegister());
+    case kMips64DsubOvf:
+      return DsubOverflowLatency();
+    case kMips64Mul:
+      return MulLatency();
+    case kMips64MulOvf:
+      return MulOverflowLatency();
+    case kMips64MulHigh:
+      return MulhLatency();
+    case kMips64MulHighU:
+      return MulhuLatency();
+    case kMips64DMulHigh:
+      return DMulhLatency();
+    case kMips64Div: {
+      int latency = DivLatency(instr->InputAt(1)->IsRegister());
+      if (kArchVariant >= kMips64r6) {
+        return latency++;
+      } else {
+        return latency + MovzLatency();
+      }
+    }
+    case kMips64DivU: {
+      int latency = DivuLatency(instr->InputAt(1)->IsRegister());
+      if (kArchVariant >= kMips64r6) {
+        return latency++;
+      } else {
+        return latency + MovzLatency();
+      }
+    }
+    case kMips64Mod:
+      return ModLatency();
+    case kMips64ModU:
+      return ModuLatency();
+    case kMips64Dmul:
+      return DmulLatency();
+    case kMips64Ddiv: {
+      int latency = DdivLatency();
+      if (kArchVariant >= kMips64r6) {
+        return latency++;
+      } else {
+        return latency + MovzLatency();
+      }
+    }
+    case kMips64DdivU: {
+      int latency = DdivuLatency();
+      if (kArchVariant >= kMips64r6) {
+        return latency++;
+      } else {
+        return latency + MovzLatency();
+      }
+    }
+    case kMips64Dmod:
+      return DmodLatency();
+    case kMips64DmodU:
+      return DmoduLatency();
+    case kMips64Dlsa:
+    case kMips64Lsa:
+      return DlsaLatency();
+    case kMips64And:
+      return AndLatency(instr->InputAt(1)->IsRegister());
+    case kMips64And32: {
+      bool is_operand_register = instr->InputAt(1)->IsRegister();
+      int latency = AndLatency(is_operand_register);
+      if (is_operand_register) {
+        return latency + 2;
+      } else {
+        return latency + 1;
+      }
+    }
+    case kMips64Or:
+      return OrLatency(instr->InputAt(1)->IsRegister());
+    case kMips64Or32: {
+      bool is_operand_register = instr->InputAt(1)->IsRegister();
+      int latency = OrLatency(is_operand_register);
+      if (is_operand_register) {
+        return latency + 2;
+      } else {
+        return latency + 1;
+      }
+    }
+    case kMips64Nor:
+      return NorLatency(instr->InputAt(1)->IsRegister());
+    case kMips64Nor32: {
+      bool is_operand_register = instr->InputAt(1)->IsRegister();
+      int latency = NorLatency(is_operand_register);
+      if (is_operand_register) {
+        return latency + 2;
+      } else {
+        return latency + 1;
+      }
+    }
+    case kMips64Xor:
+      return XorLatency(instr->InputAt(1)->IsRegister());
+    case kMips64Xor32: {
+      bool is_operand_register = instr->InputAt(1)->IsRegister();
+      int latency = XorLatency(is_operand_register);
+      if (is_operand_register) {
+        return latency + 2;
+      } else {
+        return latency + 1;
+      }
+    }
+    case kMips64Clz:
+    case kMips64Dclz:
+      return DclzLatency();
+    case kMips64Ctz:
+      return CtzLatency();
+    case kMips64Dctz:
+      return DctzLatency();
+    case kMips64Popcnt:
+      return PopcntLatency();
+    case kMips64Dpopcnt:
+      return DpopcntLatency();
+    case kMips64Shl:
+      return 1;
+    case kMips64Shr:
+    case kMips64Sar:
+      return 2;
+    case kMips64Ext:
+    case kMips64Ins:
+    case kMips64Dext:
+    case kMips64Dins:
+    case kMips64Dshl:
+    case kMips64Dshr:
+    case kMips64Dsar:
+    case kMips64Ror:
+    case kMips64Dror:
+      return 1;
+    case kMips64Tst:
+      return AndLatency(instr->InputAt(1)->IsRegister());
+    case kMips64Mov:
+      return 1;
+    case kMips64CmpS:
+      return MoveLatency() + CompareF32Latency();
+    case kMips64AddS:
+      return Latency::ADD_S;
+    case kMips64SubS:
+      return Latency::SUB_S;
+    case kMips64MulS:
+      return Latency::MUL_S;
+    case kMips64DivS:
+      return Latency::DIV_S;
+    case kMips64ModS:
+      return PrepareCallCFunctionLatency() + MovToFloatParametersLatency() +
+             CallCFunctionLatency() + MovFromFloatResultLatency();
+    case kMips64AbsS:
+      return Latency::ABS_S;
+    case kMips64NegS:
+      return NegdLatency();
+    case kMips64SqrtS:
+      return Latency::SQRT_S;
+    case kMips64MaxS:
+      return Latency::MAX_S;
+    case kMips64MinS:
+      return Latency::MIN_S;
+    case kMips64CmpD:
+      return MoveLatency() + CompareF64Latency();
+    case kMips64AddD:
+      return Latency::ADD_D;
+    case kMips64SubD:
+      return Latency::SUB_D;
+    case kMips64MulD:
+      return Latency::MUL_D;
+    case kMips64DivD:
+      return Latency::DIV_D;
+    case kMips64ModD:
+      return PrepareCallCFunctionLatency() + MovToFloatParametersLatency() +
+             CallCFunctionLatency() + MovFromFloatResultLatency();
+    case kMips64AbsD:
+      return Latency::ABS_D;
+    case kMips64NegD:
+      return NegdLatency();
+    case kMips64SqrtD:
+      return Latency::SQRT_D;
+    case kMips64MaxD:
+      return Latency::MAX_D;
+    case kMips64MinD:
+      return Latency::MIN_D;
+    case kMips64Float64RoundDown:
+    case kMips64Float64RoundTruncate:
+    case kMips64Float64RoundUp:
+    case kMips64Float64RoundTiesEven:
+      return Float64RoundLatency();
+    case kMips64Float32RoundDown:
+    case kMips64Float32RoundTruncate:
+    case kMips64Float32RoundUp:
+    case kMips64Float32RoundTiesEven:
+      return Float32RoundLatency();
+    case kMips64Float32Max:
+      return Float32MaxLatency();
+    case kMips64Float64Max:
+      return Float64MaxLatency();
+    case kMips64Float32Min:
+      return Float32MinLatency();
+    case kMips64Float64Min:
+      return Float64MinLatency();
+    case kMips64Float64SilenceNaN:
+      return Latency::SUB_D;
+    case kMips64CvtSD:
+      return Latency::CVT_S_D;
+    case kMips64CvtDS:
+      return Latency::CVT_D_S;
+    case kMips64CvtDW:
+      return Latency::MTC1 + Latency::CVT_D_W;
+    case kMips64CvtSW:
+      return Latency::MTC1 + Latency::CVT_S_W;
+    case kMips64CvtSUw:
+      return 1 + Latency::DMTC1 + Latency::CVT_S_L;
+    case kMips64CvtSL:
+      return Latency::DMTC1 + Latency::CVT_S_L;
+    case kMips64CvtDL:
+      return Latency::DMTC1 + Latency::CVT_D_L;
+    case kMips64CvtDUw:
+      return 1 + Latency::DMTC1 + Latency::CVT_D_L;
+    case kMips64CvtDUl:
+      return 2 * Latency::BRANCH + 3 + 2 * Latency::DMTC1 +
+             2 * Latency::CVT_D_L + Latency::ADD_D;
+    case kMips64CvtSUl:
+      return 2 * Latency::BRANCH + 3 + 2 * Latency::DMTC1 +
+             2 * Latency::CVT_S_L + Latency::ADD_S;
+    case kMips64FloorWD:
+      return Latency::FLOOR_W_D + Latency::MFC1;
+    case kMips64CeilWD:
+      return Latency::CEIL_W_D + Latency::MFC1;
+    case kMips64RoundWD:
+      return Latency::ROUND_W_D + Latency::MFC1;
+    case kMips64TruncWD:
+      return Latency::TRUNC_W_D + Latency::MFC1;
+    case kMips64FloorWS:
+      return Latency::FLOOR_W_S + Latency::MFC1;
+    case kMips64CeilWS:
+      return Latency::CEIL_W_S + Latency::MFC1;
+    case kMips64RoundWS:
+      return Latency::ROUND_W_S + Latency::MFC1;
+    case kMips64TruncWS:
+      return Latency::TRUNC_W_S + Latency::MFC1 + 2 + MovnLatency();
+    case kMips64TruncLS:
+      return TruncLSLatency(instr->OutputCount() > 1);
+    case kMips64TruncLD:
+      return TruncLDLatency(instr->OutputCount() > 1);
+    case kMips64TruncUwD:
+      // Estimated max.
+      return CompareF64Latency() + 2 * Latency::BRANCH +
+             2 * Latency::TRUNC_W_D + Latency::SUB_D + OrLatency() +
+             Latency::MTC1 + Latency::MFC1 + Latency::MTHC1 + 1;
+    case kMips64TruncUwS:
+      // Estimated max.
+      return CompareF32Latency() + 2 * Latency::BRANCH +
+             2 * Latency::TRUNC_W_S + Latency::SUB_S + OrLatency() +
+             Latency::MTC1 + 2 * Latency::MFC1 + 2 + MovzLatency();
+    case kMips64TruncUlS:
+      return TruncUlSLatency();
+    case kMips64TruncUlD:
+      return TruncUlDLatency();
+    case kMips64BitcastDL:
+      return Latency::DMFC1;
+    case kMips64BitcastLD:
+      return Latency::DMTC1;
+    case kMips64Float64ExtractLowWord32:
+      return Latency::MFC1;
+    case kMips64Float64InsertLowWord32:
+      return Latency::MFHC1 + Latency::MTC1 + Latency::MTHC1;
+    case kMips64Float64ExtractHighWord32:
+      return Latency::MFHC1;
+    case kMips64Float64InsertHighWord32:
+      return Latency::MTHC1;
+    case kMips64Seb:
+    case kMips64Seh:
+      return 1;
+    case kMips64Lbu:
+    case kMips64Lb:
+    case kMips64Lhu:
+    case kMips64Lh:
+    case kMips64Lwu:
+    case kMips64Lw:
+    case kMips64Ld:
+    case kMips64Sb:
+    case kMips64Sh:
+    case kMips64Sw:
+    case kMips64Sd:
+      return AlignedMemoryLatency();
+    case kMips64Lwc1:
+      return Lwc1Latency();
+    case kMips64Ldc1:
+      return Ldc1Latency();
+    case kMips64Swc1:
+      return Swc1Latency();
+    case kMips64Sdc1:
+      return Sdc1Latency();
+    case kMips64Ulhu:
+    case kMips64Ulh:
+      return UlhuLatency();
+    case kMips64Ulwu:
+      return UlwuLatency();
+    case kMips64Ulw:
+      return UlwLatency();
+    case kMips64Uld:
+      return UldLatency();
+    case kMips64Ulwc1:
+      return Ulwc1Latency();
+    case kMips64Uldc1:
+      return Uldc1Latency();
+    case kMips64Ush:
+      return UshLatency();
+    case kMips64Usw:
+      return UswLatency();
+    case kMips64Usd:
+      return UsdLatency();
+    case kMips64Uswc1:
+      return Uswc1Latency();
+    case kMips64Usdc1:
+      return Usdc1Latency();
+    case kMips64Push: {
+      int latency = 0;
+      if (instr->InputAt(0)->IsFPRegister()) {
+        latency = Sdc1Latency() + DsubuLatency(false);
+      } else {
+        latency = PushLatency();
+      }
+      return latency;
+    }
+    case kMips64Peek: {
+      int latency = 0;
+      if (instr->OutputAt(0)->IsFPRegister()) {
+        auto op = LocationOperand::cast(instr->OutputAt(0));
+        switch (op->representation()) {
+          case MachineRepresentation::kFloat64:
+            latency = Ldc1Latency();
+            break;
+          case MachineRepresentation::kFloat32:
+            latency = Latency::LWC1;
+            break;
+          default:
+            UNREACHABLE();
+        }
+      } else {
+        latency = AlignedMemoryLatency();
+      }
+      return latency;
+    }
+    case kMips64StackClaim:
+      return DsubuLatency(false);
+    case kMips64StoreToStackSlot: {
+      int latency = 0;
+      if (instr->InputAt(0)->IsFPRegister()) {
+        if (instr->InputAt(0)->IsSimd128Register()) {
+          latency = 1;  // Estimated value.
+        } else {
+          latency = Sdc1Latency();
+        }
+      } else {
+        latency = AlignedMemoryLatency();
+      }
+      return latency;
+    }
+    case kMips64ByteSwap64:
+      return ByteSwapSignedLatency();
+    case kMips64ByteSwap32:
+      return ByteSwapSignedLatency();
+    case kWord32AtomicLoadInt8:
+    case kWord32AtomicLoadUint8:
+    case kWord32AtomicLoadInt16:
+    case kWord32AtomicLoadUint16:
+    case kWord32AtomicLoadWord32:
+      return 2;
+    case kWord32AtomicStoreWord8:
+    case kWord32AtomicStoreWord16:
+    case kWord32AtomicStoreWord32:
+      return 3;
+    case kWord32AtomicExchangeInt8:
+      return Word32AtomicExchangeLatency(true, 8);
+    case kWord32AtomicExchangeUint8:
+      return Word32AtomicExchangeLatency(false, 8);
+    case kWord32AtomicExchangeInt16:
+      return Word32AtomicExchangeLatency(true, 16);
+    case kWord32AtomicExchangeUint16:
+      return Word32AtomicExchangeLatency(false, 16);
+    case kWord32AtomicExchangeWord32:
+      return 2 + LlLatency(0) + 1 + ScLatency(0) + BranchShortLatency() + 1;
+    case kWord32AtomicCompareExchangeInt8:
+      return Word32AtomicCompareExchangeLatency(true, 8);
+    case kWord32AtomicCompareExchangeUint8:
+      return Word32AtomicCompareExchangeLatency(false, 8);
+    case kWord32AtomicCompareExchangeInt16:
+      return Word32AtomicCompareExchangeLatency(true, 16);
+    case kWord32AtomicCompareExchangeUint16:
+      return Word32AtomicCompareExchangeLatency(false, 16);
+    case kWord32AtomicCompareExchangeWord32:
+      return 3 + LlLatency(0) + BranchShortLatency() + 1 + ScLatency(0) +
+             BranchShortLatency() + 1;
+    case kMips64AssertEqual:
+      return AssertLatency();
+    default:
+      return 1;
+  }
 }
 
 }  // namespace compiler
diff --git a/deps/v8/src/compiler/mips64/instruction-selector-mips64.cc b/deps/v8/src/compiler/mips64/instruction-selector-mips64.cc
index fab7be26258a97..ee02d30244e9e2 100644
--- a/deps/v8/src/compiler/mips64/instruction-selector-mips64.cc
+++ b/deps/v8/src/compiler/mips64/instruction-selector-mips64.cc
@@ -395,7 +395,7 @@ void InstructionSelector::VisitLoad(Node* node) {
       return;
   }
   if (node->opcode() == IrOpcode::kPoisonedLoad) {
-    CHECK_EQ(poisoning_enabled_, PoisoningMitigationLevel::kOn);
+    CHECK_NE(poisoning_level_, PoisoningMitigationLevel::kDontPoison);
     opcode |= MiscField::encode(kMemoryAccessPoisoned);
   }
 
@@ -2171,8 +2171,8 @@ void InstructionSelector::VisitSwitch(Node* node, const SwitchInfo& sw) {
     }
   }
 
-  // Generate a sequence of conditional jumps.
-  return EmitLookupSwitch(sw, value_operand);
+  // Generate a tree of conditional jumps.
+  return EmitBinarySearchSwitch(sw, value_operand);
 }
 
 
@@ -2515,7 +2515,7 @@ void InstructionSelector::VisitWord32AtomicCompareExchange(Node* node) {
   Emit(code, 1, outputs, input_count, inputs, 3, temp);
 }
 
-void InstructionSelector::VisitAtomicBinaryOperation(
+void InstructionSelector::VisitWord32AtomicBinaryOperation(
     Node* node, ArchOpcode int8_op, ArchOpcode uint8_op, ArchOpcode int16_op,
     ArchOpcode uint16_op, ArchOpcode word32_op) {
   Mips64OperandGenerator g(this);
@@ -2558,7 +2558,7 @@ void InstructionSelector::VisitAtomicBinaryOperation(
 
 #define VISIT_ATOMIC_BINOP(op)                                   \
   void InstructionSelector::VisitWord32Atomic##op(Node* node) {  \
-    VisitAtomicBinaryOperation(                                  \
+    VisitWord32AtomicBinaryOperation(                            \
         node, kWord32Atomic##op##Int8, kWord32Atomic##op##Uint8, \
         kWord32Atomic##op##Int16, kWord32Atomic##op##Uint16,     \
         kWord32Atomic##op##Word32);                              \
@@ -2802,7 +2802,9 @@ static const ShuffleEntry arch_shuffles[] = {
      kMips64S8x2Reverse}};
 
 bool TryMatchArchShuffle(const uint8_t* shuffle, const ShuffleEntry* table,
-                         size_t num_entries, uint8_t mask, ArchOpcode* opcode) {
+                         size_t num_entries, bool is_swizzle,
+                         ArchOpcode* opcode) {
+  uint8_t mask = is_swizzle ? kSimd128Size - 1 : 2 * kSimd128Size - 1;
   for (size_t i = 0; i < num_entries; ++i) {
     const ShuffleEntry& entry = table[i];
     int j = 0;
@@ -2822,35 +2824,35 @@ bool TryMatchArchShuffle(const uint8_t* shuffle, const ShuffleEntry* table,
 }  // namespace
 
 void InstructionSelector::VisitS8x16Shuffle(Node* node) {
-  const uint8_t* shuffle = OpParameter<uint8_t*>(node->op());
-  uint8_t mask = CanonicalizeShuffle(node);
+  uint8_t shuffle[kSimd128Size];
+  bool is_swizzle;
+  CanonicalizeShuffle(node, shuffle, &is_swizzle);
   uint8_t shuffle32x4[4];
   ArchOpcode opcode;
   if (TryMatchArchShuffle(shuffle, arch_shuffles, arraysize(arch_shuffles),
-                          mask, &opcode)) {
+                          is_swizzle, &opcode)) {
     VisitRRR(this, opcode, node);
     return;
   }
+  Node* input0 = node->InputAt(0);
+  Node* input1 = node->InputAt(1);
   uint8_t offset;
   Mips64OperandGenerator g(this);
-  if (TryMatchConcat(shuffle, mask, &offset)) {
-    Emit(kMips64S8x16Concat, g.DefineSameAsFirst(node),
-         g.UseRegister(node->InputAt(1)), g.UseRegister(node->InputAt(0)),
-         g.UseImmediate(offset));
+  if (TryMatchConcat(shuffle, &offset)) {
+    Emit(kMips64S8x16Concat, g.DefineSameAsFirst(node), g.UseRegister(input0),
+         g.UseRegister(input1), g.UseImmediate(offset));
     return;
   }
   if (TryMatch32x4Shuffle(shuffle, shuffle32x4)) {
-    Emit(kMips64S32x4Shuffle, g.DefineAsRegister(node),
-         g.UseRegister(node->InputAt(0)), g.UseRegister(node->InputAt(1)),
-         g.UseImmediate(Pack4Lanes(shuffle32x4, mask)));
+    Emit(kMips64S32x4Shuffle, g.DefineAsRegister(node), g.UseRegister(input0),
+         g.UseRegister(input1), g.UseImmediate(Pack4Lanes(shuffle32x4)));
     return;
   }
-  Emit(kMips64S8x16Shuffle, g.DefineAsRegister(node),
-       g.UseRegister(node->InputAt(0)), g.UseRegister(node->InputAt(1)),
-       g.UseImmediate(Pack4Lanes(shuffle, mask)),
-       g.UseImmediate(Pack4Lanes(shuffle + 4, mask)),
-       g.UseImmediate(Pack4Lanes(shuffle + 8, mask)),
-       g.UseImmediate(Pack4Lanes(shuffle + 12, mask)));
+  Emit(kMips64S8x16Shuffle, g.DefineAsRegister(node), g.UseRegister(input0),
+       g.UseRegister(input1), g.UseImmediate(Pack4Lanes(shuffle)),
+       g.UseImmediate(Pack4Lanes(shuffle + 4)),
+       g.UseImmediate(Pack4Lanes(shuffle + 8)),
+       g.UseImmediate(Pack4Lanes(shuffle + 12)));
 }
 
 void InstructionSelector::VisitSignExtendWord8ToInt32(Node* node) {
diff --git a/deps/v8/src/compiler/node-matchers.h b/deps/v8/src/compiler/node-matchers.h
index c31f9691f23287..2dd0d472b0e29a 100644
--- a/deps/v8/src/compiler/node-matchers.h
+++ b/deps/v8/src/compiler/node-matchers.h
@@ -7,12 +7,11 @@
 
 #include <cmath>
 
-// TODO(turbofan): Move ExternalReference out of assembler.h
-#include "src/assembler.h"
 #include "src/base/compiler-specific.h"
 #include "src/compiler/node.h"
 #include "src/compiler/operator.h"
 #include "src/double.h"
+#include "src/external-reference.h"
 #include "src/globals.h"
 
 namespace v8 {
@@ -391,11 +390,10 @@ struct AddMatcher : public BinopMatcher {
       return;
     }
 
-    if (this->right().opcode() == kAddOpcode &&
-        this->left().opcode() != kAddOpcode) {
-      this->SwapInputs();
-    } else if (this->right().opcode() == kSubOpcode &&
-               this->left().opcode() != kSubOpcode) {
+    if ((this->left().opcode() != kSubOpcode &&
+         this->left().opcode() != kAddOpcode) &&
+        (this->right().opcode() == kAddOpcode ||
+         this->right().opcode() == kSubOpcode)) {
       this->SwapInputs();
     }
   }
@@ -491,14 +489,14 @@ struct BaseWithIndexAndDisplacementMatcher {
     bool power_of_two_plus_one = false;
     DisplacementMode displacement_mode = kPositiveDisplacement;
     int scale = 0;
-    if (m.HasIndexInput() && left->OwnedByAddressingOperand()) {
+    if (m.HasIndexInput() && OwnedByAddressingOperand(left)) {
       index = m.IndexInput();
       scale = m.scale();
       scale_expression = left;
       power_of_two_plus_one = m.power_of_two_plus_one();
       bool match_found = false;
       if (right->opcode() == AddMatcher::kSubOpcode &&
-          right->OwnedByAddressingOperand()) {
+          OwnedByAddressingOperand(right)) {
         AddMatcher right_matcher(right);
         if (right_matcher.right().HasValue()) {
           // (S + (B - D))
@@ -510,7 +508,7 @@ struct BaseWithIndexAndDisplacementMatcher {
       }
       if (!match_found) {
         if (right->opcode() == AddMatcher::kAddOpcode &&
-            right->OwnedByAddressingOperand()) {
+            OwnedByAddressingOperand(right)) {
           AddMatcher right_matcher(right);
           if (right_matcher.right().HasValue()) {
             // (S + (B + D))
@@ -531,7 +529,7 @@ struct BaseWithIndexAndDisplacementMatcher {
     } else {
       bool match_found = false;
       if (left->opcode() == AddMatcher::kSubOpcode &&
-          left->OwnedByAddressingOperand()) {
+          OwnedByAddressingOperand(left)) {
         AddMatcher left_matcher(left);
         Node* left_left = left_matcher.left().node();
         Node* left_right = left_matcher.right().node();
@@ -557,7 +555,7 @@ struct BaseWithIndexAndDisplacementMatcher {
       }
       if (!match_found) {
         if (left->opcode() == AddMatcher::kAddOpcode &&
-            left->OwnedByAddressingOperand()) {
+            OwnedByAddressingOperand(left)) {
           AddMatcher left_matcher(left);
           Node* left_left = left_matcher.left().node();
           Node* left_right = left_matcher.right().node();
@@ -667,6 +665,29 @@ struct BaseWithIndexAndDisplacementMatcher {
     scale_ = scale;
     matches_ = true;
   }
+
+  static bool OwnedByAddressingOperand(Node* node) {
+    for (auto use : node->use_edges()) {
+      Node* from = use.from();
+      switch (from->opcode()) {
+        case IrOpcode::kLoad:
+        case IrOpcode::kPoisonedLoad:
+        case IrOpcode::kInt32Add:
+        case IrOpcode::kInt64Add:
+          // Skip addressing uses.
+          break;
+        case IrOpcode::kStore:
+          // If the stored value is this node, it is not an addressing use.
+          if (from->InputAt(2) == node) return false;
+          // Otherwise it is used as an address and skipped.
+          break;
+        default:
+          // Non-addressing use found.
+          return false;
+      }
+    }
+    return true;
+  }
 };
 
 typedef BaseWithIndexAndDisplacementMatcher<Int32AddMatcher>
@@ -722,6 +743,64 @@ struct V8_EXPORT_PRIVATE DiamondMatcher
   Node* if_false_;
 };
 
+template <class BinopMatcher, IrOpcode::Value expected_opcode>
+struct WasmStackCheckMatcher {
+  explicit WasmStackCheckMatcher(Node* compare) : compare_(compare) {}
+
+  bool Matched() {
+    if (compare_->opcode() != expected_opcode) return false;
+    BinopMatcher m(compare_);
+    return MatchedInternal(m.left(), m.right());
+  }
+
+ private:
+  bool MatchedInternal(const typename BinopMatcher::LeftMatcher& l,
+                       const typename BinopMatcher::RightMatcher& r) {
+    // In wasm, the stack check is performed by loading the value given by
+    // the address of a field stored in the instance object. That object is
+    // passed as a parameter.
+    if (l.IsLoad() && r.IsLoadStackPointer()) {
+      LoadMatcher<LoadMatcher<NodeMatcher>> mleft(l.node());
+      if (mleft.object().IsLoad() && mleft.index().Is(0) &&
+          mleft.object().object().IsParameter()) {
+        return true;
+      }
+    }
+    return false;
+  }
+  Node* compare_;
+};
+
+template <class BinopMatcher, IrOpcode::Value expected_opcode>
+struct StackCheckMatcher {
+  StackCheckMatcher(Isolate* isolate, Node* compare)
+      : isolate_(isolate), compare_(compare) {}
+  bool Matched() {
+    // TODO(jgruber): Ideally, we could be more flexible here and also match the
+    // same pattern with switched operands (i.e.: left is LoadStackPointer and
+    // right is the js_stack_limit load). But to be correct in all cases, we'd
+    // then have to invert the outcome of the stack check comparison.
+    if (compare_->opcode() != expected_opcode) return false;
+    BinopMatcher m(compare_);
+    return MatchedInternal(m.left(), m.right());
+  }
+
+ private:
+  bool MatchedInternal(const typename BinopMatcher::LeftMatcher& l,
+                       const typename BinopMatcher::RightMatcher& r) {
+    if (l.IsLoad() && r.IsLoadStackPointer()) {
+      LoadMatcher<ExternalReferenceMatcher> mleft(l.node());
+      ExternalReference js_stack_limit =
+          ExternalReference::address_of_stack_limit(isolate_);
+      if (mleft.object().Is(js_stack_limit) && mleft.index().Is(0)) return true;
+    }
+    return false;
+  }
+
+  Isolate* isolate_;
+  Node* compare_;
+};
+
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/src/compiler/node-origin-table.cc b/deps/v8/src/compiler/node-origin-table.cc
new file mode 100644
index 00000000000000..fc1f403939eb86
--- /dev/null
+++ b/deps/v8/src/compiler/node-origin-table.cc
@@ -0,0 +1,88 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "src/compiler/node-origin-table.h"
+#include "src/compiler/graph.h"
+#include "src/compiler/node-aux-data.h"
+
+namespace v8 {
+namespace internal {
+namespace compiler {
+
+void NodeOrigin::PrintJson(std::ostream& out) const {
+  out << "{ ";
+  switch (origin_kind_) {
+    case kGraphNode:
+      out << "\"nodeId\" : ";
+      break;
+    case kWasmBytecode:
+      out << "\"bytecodePosition\" : ";
+      break;
+  }
+  out << created_from();
+  out << ", \"reducer\" : \"" << reducer_name() << "\"";
+  out << ", \"phase\" : \"" << phase_name() << "\"";
+  out << "}";
+}
+
+class NodeOriginTable::Decorator final : public GraphDecorator {
+ public:
+  explicit Decorator(NodeOriginTable* origins) : origins_(origins) {}
+
+  void Decorate(Node* node) final {
+    origins_->SetNodeOrigin(node, origins_->current_origin_);
+  }
+
+ private:
+  NodeOriginTable* origins_;
+};
+
+NodeOriginTable::NodeOriginTable(Graph* graph)
+    : graph_(graph),
+      decorator_(nullptr),
+      current_origin_(NodeOrigin::Unknown()),
+      current_phase_name_("unknown"),
+      table_(graph->zone()) {}
+
+void NodeOriginTable::AddDecorator() {
+  DCHECK_NULL(decorator_);
+  decorator_ = new (graph_->zone()) Decorator(this);
+  graph_->AddDecorator(decorator_);
+}
+
+void NodeOriginTable::RemoveDecorator() {
+  DCHECK_NOT_NULL(decorator_);
+  graph_->RemoveDecorator(decorator_);
+  decorator_ = nullptr;
+}
+
+NodeOrigin NodeOriginTable::GetNodeOrigin(Node* node) const {
+  return table_.Get(node);
+}
+
+void NodeOriginTable::SetNodeOrigin(Node* node, const NodeOrigin& no) {
+  table_.Set(node, no);
+}
+
+void NodeOriginTable::PrintJson(std::ostream& os) const {
+  os << "{";
+  bool needs_comma = false;
+  for (auto i : table_) {
+    NodeOrigin no = i.second;
+    if (no.IsKnown()) {
+      if (needs_comma) {
+        os << ",";
+      }
+      os << "\"" << i.first << "\""
+         << ": ";
+      no.PrintJson(os);
+      needs_comma = true;
+    }
+  }
+  os << "}";
+}
+
+}  // namespace compiler
+}  // namespace internal
+}  // namespace v8
diff --git a/deps/v8/src/compiler/node-origin-table.h b/deps/v8/src/compiler/node-origin-table.h
new file mode 100644
index 00000000000000..8429b2f692d32b
--- /dev/null
+++ b/deps/v8/src/compiler/node-origin-table.h
@@ -0,0 +1,141 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef V8_COMPILER_NODE_ORIGIN_TABLE_H_
+#define V8_COMPILER_NODE_ORIGIN_TABLE_H_
+
+#include <limits>
+
+#include "src/base/compiler-specific.h"
+#include "src/compiler/node-aux-data.h"
+#include "src/globals.h"
+#include "src/source-position.h"
+
+namespace v8 {
+namespace internal {
+namespace compiler {
+
+class NodeOrigin {
+ public:
+  typedef enum { kWasmBytecode, kGraphNode } OriginKind;
+  NodeOrigin(const char* phase_name, const char* reducer_name,
+             NodeId created_from)
+      : phase_name_(phase_name),
+        reducer_name_(reducer_name),
+        origin_kind_(kGraphNode),
+        created_from_(created_from) {}
+
+  NodeOrigin(const char* phase_name, const char* reducer_name,
+             OriginKind origin_kind, uint64_t created_from)
+      : phase_name_(phase_name),
+        reducer_name_(reducer_name),
+        origin_kind_(origin_kind),
+        created_from_(created_from) {}
+
+  NodeOrigin(const NodeOrigin& other) = default;
+  static NodeOrigin Unknown() { return NodeOrigin(); }
+
+  bool IsKnown() { return created_from_ >= 0; }
+  int64_t created_from() const { return created_from_; }
+  const char* reducer_name() const { return reducer_name_; }
+  const char* phase_name() const { return phase_name_; }
+
+  OriginKind origin_kind() const { return origin_kind_; }
+
+  bool operator==(const NodeOrigin& o) const {
+    return reducer_name_ == o.reducer_name_ && created_from_ == o.created_from_;
+  }
+
+  void PrintJson(std::ostream& out) const;
+
+ private:
+  NodeOrigin()
+      : phase_name_(""),
+        reducer_name_(""),
+        created_from_(std::numeric_limits<int64_t>::min()) {}
+  const char* phase_name_;
+  const char* reducer_name_;
+  OriginKind origin_kind_;
+  int64_t created_from_;
+};
+
+inline bool operator!=(const NodeOrigin& lhs, const NodeOrigin& rhs) {
+  return !(lhs == rhs);
+}
+
+class V8_EXPORT_PRIVATE NodeOriginTable final
+    : public NON_EXPORTED_BASE(ZoneObject) {
+ public:
+  class Scope final {
+   public:
+    Scope(NodeOriginTable* origins, const char* reducer_name, Node* node)
+        : origins_(origins), prev_origin_(NodeOrigin::Unknown()) {
+      if (origins) {
+        prev_origin_ = origins->current_origin_;
+        origins->current_origin_ =
+            NodeOrigin(origins->current_phase_name_, reducer_name, node->id());
+      }
+    }
+
+    ~Scope() {
+      if (origins_) origins_->current_origin_ = prev_origin_;
+    }
+
+   private:
+    NodeOriginTable* const origins_;
+    NodeOrigin prev_origin_;
+    DISALLOW_COPY_AND_ASSIGN(Scope);
+  };
+
+  class PhaseScope final {
+   public:
+    PhaseScope(NodeOriginTable* origins, const char* phase_name)
+        : origins_(origins) {
+      if (origins != nullptr) {
+        prev_phase_name_ = origins->current_phase_name_;
+        origins->current_phase_name_ =
+            phase_name == nullptr ? "unnamed" : phase_name;
+      }
+    }
+
+    ~PhaseScope() {
+      if (origins_) origins_->current_phase_name_ = prev_phase_name_;
+    }
+
+   private:
+    NodeOriginTable* const origins_;
+    const char* prev_phase_name_;
+    DISALLOW_COPY_AND_ASSIGN(PhaseScope);
+  };
+
+  explicit NodeOriginTable(Graph* graph);
+
+  void AddDecorator();
+  void RemoveDecorator();
+
+  NodeOrigin GetNodeOrigin(Node* node) const;
+  void SetNodeOrigin(Node* node, const NodeOrigin& no);
+
+  void SetCurrentPosition(const NodeOrigin& no) { current_origin_ = no; }
+
+  void PrintJson(std::ostream& os) const;
+
+ private:
+  class Decorator;
+
+  Graph* const graph_;
+  Decorator* decorator_;
+  NodeOrigin current_origin_;
+
+  const char* current_phase_name_;
+  NodeAuxData<NodeOrigin, NodeOrigin::Unknown> table_;
+
+  DISALLOW_COPY_AND_ASSIGN(NodeOriginTable);
+};
+
+}  // namespace compiler
+}  // namespace internal
+}  // namespace v8
+
+#endif  // V8_COMPILER_NODE_ORIGIN_TABLE_H_
diff --git a/deps/v8/src/compiler/node-properties.cc b/deps/v8/src/compiler/node-properties.cc
index d8b23fb36243d1..0d0e4f3c97efcc 100644
--- a/deps/v8/src/compiler/node-properties.cc
+++ b/deps/v8/src/compiler/node-properties.cc
@@ -363,11 +363,11 @@ bool NodeProperties::IsSame(Node* a, Node* b) {
 
 // static
 NodeProperties::InferReceiverMapsResult NodeProperties::InferReceiverMaps(
-    Node* receiver, Node* effect, ZoneHandleSet<Map>* maps_return) {
+    Isolate* isolate, Node* receiver, Node* effect,
+    ZoneHandleSet<Map>* maps_return) {
   HeapObjectMatcher m(receiver);
   if (m.HasValue()) {
     Handle<HeapObject> receiver = m.Value();
-    Isolate* const isolate = m.Value()->GetIsolate();
     // We don't use ICs for the Array.prototype and the Object.prototype
     // because the runtime has to be able to intercept them properly, so
     // we better make sure that TurboFan doesn't outsmart the system here
@@ -416,7 +416,8 @@ NodeProperties::InferReceiverMapsResult NodeProperties::InferReceiverMaps(
             Handle<JSFunction> original_constructor =
                 Handle<JSFunction>::cast(mnewtarget.Value());
             if (original_constructor->has_initial_map()) {
-              Handle<Map> initial_map(original_constructor->initial_map());
+              Handle<Map> initial_map(original_constructor->initial_map(),
+                                      isolate);
               if (initial_map->constructor_or_backpointer() ==
                   *mtarget.Value()) {
                 *maps_return = ZoneHandleSet<Map>(initial_map);
@@ -503,12 +504,12 @@ NodeProperties::InferReceiverMapsResult NodeProperties::InferReceiverMaps(
 }
 
 // static
-MaybeHandle<Map> NodeProperties::GetMapWitness(Node* node) {
+MaybeHandle<Map> NodeProperties::GetMapWitness(Isolate* isolate, Node* node) {
   ZoneHandleSet<Map> maps;
   Node* receiver = NodeProperties::GetValueInput(node, 1);
   Node* effect = NodeProperties::GetEffectInput(node);
   NodeProperties::InferReceiverMapsResult result =
-      NodeProperties::InferReceiverMaps(receiver, effect, &maps);
+      NodeProperties::InferReceiverMaps(isolate, receiver, effect, &maps);
   if (result == NodeProperties::kReliableReceiverMaps && maps.size() == 1) {
     return maps[0];
   }
@@ -516,11 +517,13 @@ MaybeHandle<Map> NodeProperties::GetMapWitness(Node* node) {
 }
 
 // static
-bool NodeProperties::HasInstanceTypeWitness(Node* receiver, Node* effect,
+bool NodeProperties::HasInstanceTypeWitness(Isolate* isolate, Node* receiver,
+                                            Node* effect,
                                             InstanceType instance_type) {
   ZoneHandleSet<Map> receiver_maps;
   NodeProperties::InferReceiverMapsResult result =
-      NodeProperties::InferReceiverMaps(receiver, effect, &receiver_maps);
+      NodeProperties::InferReceiverMaps(isolate, receiver, effect,
+                                        &receiver_maps);
   switch (result) {
     case NodeProperties::kUnreliableReceiverMaps:
     case NodeProperties::kReliableReceiverMaps:
@@ -551,7 +554,8 @@ bool NodeProperties::NoObservableSideEffectBetween(Node* effect,
 }
 
 // static
-bool NodeProperties::CanBePrimitive(Node* receiver, Node* effect) {
+bool NodeProperties::CanBePrimitive(Isolate* isolate, Node* receiver,
+                                    Node* effect) {
   switch (receiver->opcode()) {
 #define CASE(Opcode) case IrOpcode::k##Opcode:
     JS_CONSTRUCT_OP_LIST(CASE)
@@ -571,7 +575,8 @@ bool NodeProperties::CanBePrimitive(Node* receiver, Node* effect) {
       // just the instance types, which don't change
       // across potential side-effecting operations.
       ZoneHandleSet<Map> maps;
-      if (InferReceiverMaps(receiver, effect, &maps) != kNoReceiverMaps) {
+      if (InferReceiverMaps(isolate, receiver, effect, &maps) !=
+          kNoReceiverMaps) {
         // Check if all {maps} are actually JSReceiver maps.
         for (size_t i = 0; i < maps.size(); ++i) {
           if (!maps[i]->IsJSReceiverMap()) return true;
@@ -584,8 +589,9 @@ bool NodeProperties::CanBePrimitive(Node* receiver, Node* effect) {
 }
 
 // static
-bool NodeProperties::CanBeNullOrUndefined(Node* receiver, Node* effect) {
-  if (CanBePrimitive(receiver, effect)) {
+bool NodeProperties::CanBeNullOrUndefined(Isolate* isolate, Node* receiver,
+                                          Node* effect) {
+  if (CanBePrimitive(isolate, receiver, effect)) {
     switch (receiver->opcode()) {
       case IrOpcode::kCheckInternalizedString:
       case IrOpcode::kCheckNumber:
@@ -602,7 +608,6 @@ bool NodeProperties::CanBeNullOrUndefined(Node* receiver, Node* effect) {
         return false;
       case IrOpcode::kHeapConstant: {
         Handle<HeapObject> value = HeapObjectMatcher(receiver).Value();
-        Isolate* const isolate = value->GetIsolate();
         return value->IsNullOrUndefined(isolate);
       }
       default:
@@ -624,7 +629,7 @@ Node* NodeProperties::GetOuterContext(Node* node, size_t* depth) {
 }
 
 // static
-Type* NodeProperties::GetTypeOrAny(Node* node) {
+Type NodeProperties::GetTypeOrAny(Node* node) {
   return IsTyped(node) ? node->type() : Type::Any();
 }
 
diff --git a/deps/v8/src/compiler/node-properties.h b/deps/v8/src/compiler/node-properties.h
index 7388bf94dd2527..abcee4eaf93a17 100644
--- a/deps/v8/src/compiler/node-properties.h
+++ b/deps/v8/src/compiler/node-properties.h
@@ -152,11 +152,12 @@ class V8_EXPORT_PRIVATE NodeProperties final {
                              // but instance type is reliable.
   };
   static InferReceiverMapsResult InferReceiverMaps(
-      Node* receiver, Node* effect, ZoneHandleSet<Map>* maps_return);
+      Isolate* isolate, Node* receiver, Node* effect,
+      ZoneHandleSet<Map>* maps_return);
 
-  static MaybeHandle<Map> GetMapWitness(Node* node);
-  static bool HasInstanceTypeWitness(Node* receiver, Node* effect,
-                                     InstanceType instance_type);
+  static MaybeHandle<Map> GetMapWitness(Isolate* isolate, Node* node);
+  static bool HasInstanceTypeWitness(Isolate* isolate, Node* receiver,
+                                     Node* effect, InstanceType instance_type);
 
   // Walks up the {effect} chain to check that there's no observable side-effect
   // between the {effect} and it's {dominator}. Aborts the walk if there's join
@@ -166,11 +167,12 @@ class V8_EXPORT_PRIVATE NodeProperties final {
   // Returns true if the {receiver} can be a primitive value (i.e. is not
   // definitely a JavaScript object); might walk up the {effect} chain to
   // find map checks on {receiver}.
-  static bool CanBePrimitive(Node* receiver, Node* effect);
+  static bool CanBePrimitive(Isolate* isolate, Node* receiver, Node* effect);
 
   // Returns true if the {receiver} can be null or undefined. Might walk
   // up the {effect} chain to find map checks for {receiver}.
-  static bool CanBeNullOrUndefined(Node* receiver, Node* effect);
+  static bool CanBeNullOrUndefined(Isolate* isolate, Node* receiver,
+                                   Node* effect);
 
   // ---------------------------------------------------------------------------
   // Context.
@@ -183,17 +185,17 @@ class V8_EXPORT_PRIVATE NodeProperties final {
   // ---------------------------------------------------------------------------
   // Type.
 
-  static bool IsTyped(Node* node) { return node->type() != nullptr; }
-  static Type* GetType(Node* node) {
+  static bool IsTyped(Node* node) { return !node->type().IsInvalid(); }
+  static Type GetType(Node* node) {
     DCHECK(IsTyped(node));
     return node->type();
   }
-  static Type* GetTypeOrAny(Node* node);
-  static void SetType(Node* node, Type* type) {
-    DCHECK_NOT_NULL(type);
+  static Type GetTypeOrAny(Node* node);
+  static void SetType(Node* node, Type type) {
+    DCHECK(!type.IsInvalid());
     node->set_type(type);
   }
-  static void RemoveType(Node* node) { node->set_type(nullptr); }
+  static void RemoveType(Node* node) { node->set_type(Type::Invalid()); }
   static bool AllValueInputsAreTyped(Node* node);
 
  private:
diff --git a/deps/v8/src/compiler/node.cc b/deps/v8/src/compiler/node.cc
index f988b954fb08c6..0e1ebce9bc3e2a 100644
--- a/deps/v8/src/compiler/node.cc
+++ b/deps/v8/src/compiler/node.cc
@@ -296,22 +296,8 @@ bool Node::OwnedBy(Node const* owner1, Node const* owner2) const {
   return mask == 3;
 }
 
-bool Node::OwnedByAddressingOperand() const {
-  for (Use* use = first_use_; use; use = use->next) {
-    Node* from = use->from();
-    if (from->opcode() != IrOpcode::kLoad &&
-        // If {from} is store, make sure it does not use {this} as value
-        (from->opcode() != IrOpcode::kStore || from->InputAt(2) == this) &&
-        from->opcode() != IrOpcode::kInt32Add &&
-        from->opcode() != IrOpcode::kInt64Add) {
-      return false;
-    }
-  }
-  return true;
-}
-
 void Node::Print() const {
-  OFStream os(stdout);
+  StdoutStream os;
   os << *this << std::endl;
   for (Node* input : this->inputs()) {
     os << "  " << *input << std::endl;
@@ -337,7 +323,6 @@ std::ostream& operator<<(std::ostream& os, const Node& n) {
 
 Node::Node(NodeId id, const Operator* op, int inline_count, int inline_capacity)
     : op_(op),
-      type_(nullptr),
       mark_(0),
       bit_field_(IdField::encode(id) | InlineCountField::encode(inline_count) |
                  InlineCapacityField::encode(inline_capacity)),
diff --git a/deps/v8/src/compiler/node.h b/deps/v8/src/compiler/node.h
index ded45a24f4dd96..fc5a17c19d0732 100644
--- a/deps/v8/src/compiler/node.h
+++ b/deps/v8/src/compiler/node.h
@@ -159,9 +159,6 @@ class V8_EXPORT_PRIVATE Node final {
   // Returns true if {owner1} and {owner2} are the only users of {this} node.
   bool OwnedBy(Node const* owner1, Node const* owner2) const;
 
-  // Returns true if addressing related operands (such as load, store, lea)
-  // are the only users of {this} node.
-  bool OwnedByAddressingOperand() const;
   void Print() const;
 
  private:
@@ -264,8 +261,8 @@ class V8_EXPORT_PRIVATE Node final {
   void set_op(const Operator* op) { op_ = op; }
 
   // Only NodeProperties should manipulate the type.
-  Type* type() const { return type_; }
-  void set_type(Type* type) { type_ = type; }
+  Type type() const { return type_; }
+  void set_type(Type type) { type_ = type; }
 
   // Only NodeMarkers should manipulate the marks on nodes.
   Mark mark() const { return mark_; }
@@ -285,7 +282,7 @@ class V8_EXPORT_PRIVATE Node final {
   static const int kMaxInlineCapacity = InlineCapacityField::kMax - 1;
 
   const Operator* op_;
-  Type* type_;
+  Type type_;
   Mark mark_;
   uint32_t bit_field_;
   Use* first_use_;
diff --git a/deps/v8/src/compiler/opcodes.h b/deps/v8/src/compiler/opcodes.h
index 29a0462767f4f6..7a6b19cb35d4ee 100644
--- a/deps/v8/src/compiler/opcodes.h
+++ b/deps/v8/src/compiler/opcodes.h
@@ -123,7 +123,8 @@
   V(JSToNumber)                    \
   V(JSToNumeric)                   \
   V(JSToObject)                    \
-  V(JSToString)
+  V(JSToString)                    \
+  V(JSParseInt)
 
 #define JS_SIMPLE_UNOP_LIST(V) \
   JS_CONVERSION_UNOP_LIST(V)   \
@@ -144,6 +145,7 @@
   V(JSCreateIterResultObject)   \
   V(JSCreateStringIterator)     \
   V(JSCreateKeyValueArray)      \
+  V(JSCreateObject)             \
   V(JSCreatePromise)            \
   V(JSCreateTypedArray)         \
   V(JSCreateLiteralArray)       \
@@ -206,6 +208,8 @@
   V(JSRejectPromise)                   \
   V(JSResolvePromise)                  \
   V(JSStackCheck)                      \
+  V(JSObjectIsArray)                   \
+  V(JSRegExpTest)                      \
   V(JSDebugger)
 
 #define JS_OP_LIST(V)     \
@@ -376,9 +380,11 @@
   V(LoadField)                          \
   V(LoadElement)                        \
   V(LoadTypedElement)                   \
+  V(LoadDataViewElement)                \
   V(StoreField)                         \
   V(StoreElement)                       \
   V(StoreTypedElement)                  \
+  V(StoreDataViewElement)               \
   V(StoreSignedSmallElement)            \
   V(TransitionAndStoreElement)          \
   V(TransitionAndStoreNumberElement)    \
@@ -398,6 +404,7 @@
   V(ObjectIsDetectableCallable)         \
   V(ObjectIsMinusZero)                  \
   V(ObjectIsNaN)                        \
+  V(NumberIsNaN)                        \
   V(ObjectIsNonCallable)                \
   V(ObjectIsNumber)                     \
   V(ObjectIsReceiver)                   \
@@ -417,8 +424,9 @@
   V(TransitionElementsKind)             \
   V(FindOrderedHashMapEntry)            \
   V(FindOrderedHashMapEntryForInt32Key) \
-  V(MaskIndexWithBound)                 \
-  V(RuntimeAbort)
+  V(PoisonIndex)                        \
+  V(RuntimeAbort)                       \
+  V(DateNow)
 
 #define SIMPLIFIED_OP_LIST(V)                 \
   SIMPLIFIED_CHANGE_OP_LIST(V)                \
@@ -612,12 +620,12 @@
   V(Float64ExtractHighWord32)    \
   V(Float64InsertLowWord32)      \
   V(Float64InsertHighWord32)     \
-  V(PoisonOnSpeculationTagged)   \
-  V(PoisonOnSpeculationWord)     \
+  V(TaggedPoisonOnSpeculation)   \
+  V(Word32PoisonOnSpeculation)   \
+  V(Word64PoisonOnSpeculation)   \
   V(LoadStackPointer)            \
   V(LoadFramePointer)            \
   V(LoadParentFramePointer)      \
-  V(LoadRootsPointer)            \
   V(UnalignedLoad)               \
   V(UnalignedStore)              \
   V(Int32PairAdd)                \
diff --git a/deps/v8/src/compiler/operation-typer.cc b/deps/v8/src/compiler/operation-typer.cc
index 539683b41d1e02..a9ae8c322aa6d1 100644
--- a/deps/v8/src/compiler/operation-typer.cc
+++ b/deps/v8/src/compiler/operation-typer.cc
@@ -16,28 +16,48 @@ namespace v8 {
 namespace internal {
 namespace compiler {
 
-OperationTyper::OperationTyper(Isolate* isolate, Zone* zone)
+OperationTyper::OperationTyper(Isolate* isolate,
+                               const JSHeapBroker* js_heap_broker, Zone* zone)
     : zone_(zone), cache_(TypeCache::Get()) {
   Factory* factory = isolate->factory();
-  infinity_ = Type::NewConstant(factory->infinity_value(), zone);
-  minus_infinity_ = Type::NewConstant(factory->minus_infinity_value(), zone);
-  Type* truncating_to_zero = Type::MinusZeroOrNaN();
-  DCHECK(!truncating_to_zero->Maybe(Type::Integral32()));
-
-  singleton_NaN_string_ = Type::HeapConstant(factory->NaN_string(), zone);
-  singleton_zero_string_ = Type::HeapConstant(factory->zero_string(), zone);
-  singleton_false_ = Type::HeapConstant(factory->false_value(), zone);
-  singleton_true_ = Type::HeapConstant(factory->true_value(), zone);
-  singleton_the_hole_ = Type::HeapConstant(factory->the_hole_value(), zone);
+  infinity_ =
+      Type::NewConstant(js_heap_broker, factory->infinity_value(), zone);
+  minus_infinity_ =
+      Type::NewConstant(js_heap_broker, factory->minus_infinity_value(), zone);
+  Type truncating_to_zero = Type::MinusZeroOrNaN();
+  DCHECK(!truncating_to_zero.Maybe(Type::Integral32()));
+
+  singleton_empty_string_ =
+      Type::HeapConstant(js_heap_broker, factory->empty_string(), zone);
+  singleton_NaN_string_ =
+      Type::HeapConstant(js_heap_broker, factory->NaN_string(), zone);
+  singleton_zero_string_ =
+      Type::HeapConstant(js_heap_broker, factory->zero_string(), zone);
+  singleton_false_ =
+      Type::HeapConstant(js_heap_broker, factory->false_value(), zone);
+  singleton_true_ =
+      Type::HeapConstant(js_heap_broker, factory->true_value(), zone);
+  singleton_the_hole_ =
+      Type::HeapConstant(js_heap_broker, factory->the_hole_value(), zone);
   signed32ish_ = Type::Union(Type::Signed32(), truncating_to_zero, zone);
   unsigned32ish_ = Type::Union(Type::Unsigned32(), truncating_to_zero, zone);
+
+  falsish_ = Type::Union(
+      Type::Undetectable(),
+      Type::Union(Type::Union(singleton_false_, cache_.kZeroish, zone),
+                  Type::Union(singleton_empty_string_, Type::Hole(), zone),
+                  zone),
+      zone);
+  truish_ = Type::Union(
+      singleton_true_,
+      Type::Union(Type::DetectableReceiver(), Type::Symbol(), zone), zone);
 }
 
-Type* OperationTyper::Merge(Type* left, Type* right) {
+Type OperationTyper::Merge(Type left, Type right) {
   return Type::Union(left, right, zone());
 }
 
-Type* OperationTyper::WeakenRange(Type* previous_range, Type* current_range) {
+Type OperationTyper::WeakenRange(Type previous_range, Type current_range) {
   static const double kWeakenMinLimits[] = {0.0,
                                             -1073741824.0,
                                             -2147483648.0,
@@ -82,11 +102,11 @@ Type* OperationTyper::WeakenRange(Type* previous_range, Type* current_range) {
                                             562949953421311.0};
   STATIC_ASSERT(arraysize(kWeakenMinLimits) == arraysize(kWeakenMaxLimits));
 
-  double current_min = current_range->Min();
+  double current_min = current_range.Min();
   double new_min = current_min;
   // Find the closest lower entry in the list of allowed
   // minima (or negative infinity if there is no such entry).
-  if (current_min != previous_range->Min()) {
+  if (current_min != previous_range.Min()) {
     new_min = -V8_INFINITY;
     for (double const min : kWeakenMinLimits) {
       if (min <= current_min) {
@@ -96,11 +116,11 @@ Type* OperationTyper::WeakenRange(Type* previous_range, Type* current_range) {
     }
   }
 
-  double current_max = current_range->Max();
+  double current_max = current_range.Max();
   double new_max = current_max;
   // Find the closest greater entry in the list of allowed
   // maxima (or infinity if there is no such entry).
-  if (current_max != previous_range->Max()) {
+  if (current_max != previous_range.Max()) {
     new_max = V8_INFINITY;
     for (double const max : kWeakenMaxLimits) {
       if (max >= current_max) {
@@ -113,12 +133,12 @@ Type* OperationTyper::WeakenRange(Type* previous_range, Type* current_range) {
   return Type::Range(new_min, new_max, zone());
 }
 
-Type* OperationTyper::Rangify(Type* type) {
-  if (type->IsRange()) return type;  // Shortcut.
-  if (!type->Is(cache_.kInteger)) {
+Type OperationTyper::Rangify(Type type) {
+  if (type.IsRange()) return type;  // Shortcut.
+  if (!type.Is(cache_.kInteger)) {
     return type;  // Give up on non-integer types.
   }
-  return Type::Range(type->Min(), type->Max(), zone());
+  return Type::Range(type.Min(), type.Max(), zone());
 }
 
 namespace {
@@ -155,8 +175,8 @@ double array_max(double a[], size_t n) {
 
 }  // namespace
 
-Type* OperationTyper::AddRanger(double lhs_min, double lhs_max, double rhs_min,
-                                double rhs_max) {
+Type OperationTyper::AddRanger(double lhs_min, double lhs_max, double rhs_min,
+                               double rhs_max) {
   double results[4];
   results[0] = lhs_min + rhs_min;
   results[1] = lhs_min + rhs_max;
@@ -171,8 +191,7 @@ Type* OperationTyper::AddRanger(double lhs_min, double lhs_max, double rhs_min,
     if (std::isnan(results[i])) ++nans;
   }
   if (nans == 4) return Type::NaN();
-  Type* type =
-      Type::Range(array_min(results, 4), array_max(results, 4), zone());
+  Type type = Type::Range(array_min(results, 4), array_max(results, 4), zone());
   if (nans > 0) type = Type::Union(type, Type::NaN(), zone());
   // Examples:
   //   [-inf, -inf] + [+inf, +inf] = NaN
@@ -182,8 +201,8 @@ Type* OperationTyper::AddRanger(double lhs_min, double lhs_max, double rhs_min,
   return type;
 }
 
-Type* OperationTyper::SubtractRanger(double lhs_min, double lhs_max,
-                                     double rhs_min, double rhs_max) {
+Type OperationTyper::SubtractRanger(double lhs_min, double lhs_max,
+                                    double rhs_min, double rhs_max) {
   double results[4];
   results[0] = lhs_min - rhs_min;
   results[1] = lhs_min - rhs_max;
@@ -198,8 +217,7 @@ Type* OperationTyper::SubtractRanger(double lhs_min, double lhs_max,
     if (std::isnan(results[i])) ++nans;
   }
   if (nans == 4) return Type::NaN();  // [inf..inf] - [inf..inf] (all same sign)
-  Type* type =
-      Type::Range(array_min(results, 4), array_max(results, 4), zone());
+  Type type = Type::Range(array_min(results, 4), array_max(results, 4), zone());
   return nans == 0 ? type : Type::Union(type, Type::NaN(), zone());
   // Examples:
   //   [-inf, +inf] - [-inf, +inf] = [-inf, +inf] \/ NaN
@@ -208,12 +226,12 @@ Type* OperationTyper::SubtractRanger(double lhs_min, double lhs_max,
   //   [m, +inf] - [-inf, n] = [-inf, +inf] \/ NaN
 }
 
-Type* OperationTyper::MultiplyRanger(Type* lhs, Type* rhs) {
+Type OperationTyper::MultiplyRanger(Type lhs, Type rhs) {
   double results[4];
-  double lmin = lhs->AsRange()->Min();
-  double lmax = lhs->AsRange()->Max();
-  double rmin = rhs->AsRange()->Min();
-  double rmax = rhs->AsRange()->Max();
+  double lmin = lhs.AsRange()->Min();
+  double lmax = lhs.AsRange()->Max();
+  double rmin = rhs.AsRange()->Min();
+  double rmax = rhs.AsRange()->Max();
   results[0] = lmin * rmin;
   results[1] = lmin * rmax;
   results[2] = lmax * rmin;
@@ -222,22 +240,22 @@ Type* OperationTyper::MultiplyRanger(Type* lhs, Type* rhs) {
   // the discontinuity makes it too complicated.  Note that even if none of the
   // "results" above is nan, the actual result may still be, so we have to do a
   // different check:
-  bool maybe_nan = (lhs->Maybe(cache_.kSingletonZero) &&
+  bool maybe_nan = (lhs.Maybe(cache_.kSingletonZero) &&
                     (rmin == -V8_INFINITY || rmax == +V8_INFINITY)) ||
-                   (rhs->Maybe(cache_.kSingletonZero) &&
+                   (rhs.Maybe(cache_.kSingletonZero) &&
                     (lmin == -V8_INFINITY || lmax == +V8_INFINITY));
   if (maybe_nan) return cache_.kIntegerOrMinusZeroOrNaN;  // Giving up.
-  bool maybe_minuszero = (lhs->Maybe(cache_.kSingletonZero) && rmin < 0) ||
-                         (rhs->Maybe(cache_.kSingletonZero) && lmin < 0);
-  Type* range =
+  bool maybe_minuszero = (lhs.Maybe(cache_.kSingletonZero) && rmin < 0) ||
+                         (rhs.Maybe(cache_.kSingletonZero) && lmin < 0);
+  Type range =
       Type::Range(array_min(results, 4), array_max(results, 4), zone());
   return maybe_minuszero ? Type::Union(range, Type::MinusZero(), zone())
                          : range;
 }
 
-Type* OperationTyper::ConvertReceiver(Type* type) {
-  if (type->Is(Type::Receiver())) return type;
-  bool const maybe_primitive = type->Maybe(Type::Primitive());
+Type OperationTyper::ConvertReceiver(Type type) {
+  if (type.Is(Type::Receiver())) return type;
+  bool const maybe_primitive = type.Maybe(Type::Primitive());
   type = Type::Intersect(type, Type::Receiver(), zone());
   if (maybe_primitive) {
     // ConvertReceiver maps null and undefined to the JSGlobalProxy of the
@@ -247,58 +265,58 @@ Type* OperationTyper::ConvertReceiver(Type* type) {
   return type;
 }
 
-Type* OperationTyper::ToNumberOrNumeric(Object::Conversion mode, Type* type) {
-  if (type->Is(Type::Number())) return type;
-  if (type->Is(Type::NullOrUndefined())) {
-    if (type->Is(Type::Null())) return cache_.kSingletonZero;
-    if (type->Is(Type::Undefined())) return Type::NaN();
+Type OperationTyper::ToNumberOrNumeric(Object::Conversion mode, Type type) {
+  if (type.Is(Type::Number())) return type;
+  if (type.Is(Type::NullOrUndefined())) {
+    if (type.Is(Type::Null())) return cache_.kSingletonZero;
+    if (type.Is(Type::Undefined())) return Type::NaN();
     return Type::Union(Type::NaN(), cache_.kSingletonZero, zone());
   }
-  if (type->Is(Type::Boolean())) {
-    if (type->Is(singleton_false_)) return cache_.kSingletonZero;
-    if (type->Is(singleton_true_)) return cache_.kSingletonOne;
+  if (type.Is(Type::Boolean())) {
+    if (type.Is(singleton_false_)) return cache_.kSingletonZero;
+    if (type.Is(singleton_true_)) return cache_.kSingletonOne;
     return cache_.kZeroOrOne;
   }
-  if (type->Is(Type::NumberOrOddball())) {
-    if (type->Is(Type::NumberOrUndefined())) {
+  if (type.Is(Type::NumberOrOddball())) {
+    if (type.Is(Type::NumberOrUndefined())) {
       type = Type::Union(type, Type::NaN(), zone());
-    } else if (type->Is(Type::NullOrNumber())) {
+    } else if (type.Is(Type::NullOrNumber())) {
       type = Type::Union(type, cache_.kSingletonZero, zone());
-    } else if (type->Is(Type::BooleanOrNullOrNumber())) {
+    } else if (type.Is(Type::BooleanOrNullOrNumber())) {
       type = Type::Union(type, cache_.kZeroOrOne, zone());
     } else {
       type = Type::Union(type, cache_.kZeroOrOneOrNaN, zone());
     }
     return Type::Intersect(type, Type::Number(), zone());
   }
-  if (type->Is(Type::BigInt())) {
+  if (type.Is(Type::BigInt())) {
     return mode == Object::Conversion::kToNumber ? Type::None() : type;
   }
   return mode == Object::Conversion::kToNumber ? Type::Number()
                                                : Type::Numeric();
 }
 
-Type* OperationTyper::ToNumber(Type* type) {
+Type OperationTyper::ToNumber(Type type) {
   return ToNumberOrNumeric(Object::Conversion::kToNumber, type);
 }
 
-Type* OperationTyper::ToNumeric(Type* type) {
+Type OperationTyper::ToNumeric(Type type) {
   return ToNumberOrNumeric(Object::Conversion::kToNumeric, type);
 }
 
-Type* OperationTyper::NumberAbs(Type* type) {
-  DCHECK(type->Is(Type::Number()));
-  if (type->IsNone()) return type;
+Type OperationTyper::NumberAbs(Type type) {
+  DCHECK(type.Is(Type::Number()));
+  if (type.IsNone()) return type;
 
-  bool const maybe_nan = type->Maybe(Type::NaN());
-  bool const maybe_minuszero = type->Maybe(Type::MinusZero());
+  bool const maybe_nan = type.Maybe(Type::NaN());
+  bool const maybe_minuszero = type.Maybe(Type::MinusZero());
 
   type = Type::Intersect(type, Type::PlainNumber(), zone());
-  if (!type->IsNone()) {
-    double const max = type->Max();
-    double const min = type->Min();
+  if (!type.IsNone()) {
+    double const max = type.Max();
+    double const min = type.Min();
     if (min < 0) {
-      if (type->Is(cache_.kInteger)) {
+      if (type.Is(cache_.kInteger)) {
         type =
             Type::Range(0.0, std::max(std::fabs(min), std::fabs(max)), zone());
       } else {
@@ -316,264 +334,264 @@ Type* OperationTyper::NumberAbs(Type* type) {
   return type;
 }
 
-Type* OperationTyper::NumberAcos(Type* type) {
-  DCHECK(type->Is(Type::Number()));
+Type OperationTyper::NumberAcos(Type type) {
+  DCHECK(type.Is(Type::Number()));
   return Type::Number();
 }
 
-Type* OperationTyper::NumberAcosh(Type* type) {
-  DCHECK(type->Is(Type::Number()));
+Type OperationTyper::NumberAcosh(Type type) {
+  DCHECK(type.Is(Type::Number()));
   return Type::Number();
 }
 
-Type* OperationTyper::NumberAsin(Type* type) {
-  DCHECK(type->Is(Type::Number()));
+Type OperationTyper::NumberAsin(Type type) {
+  DCHECK(type.Is(Type::Number()));
   return Type::Number();
 }
 
-Type* OperationTyper::NumberAsinh(Type* type) {
-  DCHECK(type->Is(Type::Number()));
+Type OperationTyper::NumberAsinh(Type type) {
+  DCHECK(type.Is(Type::Number()));
   return Type::Number();
 }
 
-Type* OperationTyper::NumberAtan(Type* type) {
-  DCHECK(type->Is(Type::Number()));
+Type OperationTyper::NumberAtan(Type type) {
+  DCHECK(type.Is(Type::Number()));
   return Type::Number();
 }
 
-Type* OperationTyper::NumberAtanh(Type* type) {
-  DCHECK(type->Is(Type::Number()));
+Type OperationTyper::NumberAtanh(Type type) {
+  DCHECK(type.Is(Type::Number()));
   return Type::Number();
 }
 
-Type* OperationTyper::NumberCbrt(Type* type) {
-  DCHECK(type->Is(Type::Number()));
+Type OperationTyper::NumberCbrt(Type type) {
+  DCHECK(type.Is(Type::Number()));
   return Type::Number();
 }
 
-Type* OperationTyper::NumberCeil(Type* type) {
-  DCHECK(type->Is(Type::Number()));
-  if (type->Is(cache_.kIntegerOrMinusZeroOrNaN)) return type;
+Type OperationTyper::NumberCeil(Type type) {
+  DCHECK(type.Is(Type::Number()));
+  if (type.Is(cache_.kIntegerOrMinusZeroOrNaN)) return type;
   type = Type::Intersect(type, Type::NaN(), zone());
   type = Type::Union(type, cache_.kIntegerOrMinusZero, zone());
   return type;
 }
 
-Type* OperationTyper::NumberClz32(Type* type) {
-  DCHECK(type->Is(Type::Number()));
+Type OperationTyper::NumberClz32(Type type) {
+  DCHECK(type.Is(Type::Number()));
   return cache_.kZeroToThirtyTwo;
 }
 
-Type* OperationTyper::NumberCos(Type* type) {
-  DCHECK(type->Is(Type::Number()));
+Type OperationTyper::NumberCos(Type type) {
+  DCHECK(type.Is(Type::Number()));
   return Type::Number();
 }
 
-Type* OperationTyper::NumberCosh(Type* type) {
-  DCHECK(type->Is(Type::Number()));
+Type OperationTyper::NumberCosh(Type type) {
+  DCHECK(type.Is(Type::Number()));
   return Type::Number();
 }
 
-Type* OperationTyper::NumberExp(Type* type) {
-  DCHECK(type->Is(Type::Number()));
+Type OperationTyper::NumberExp(Type type) {
+  DCHECK(type.Is(Type::Number()));
   return Type::Union(Type::PlainNumber(), Type::NaN(), zone());
 }
 
-Type* OperationTyper::NumberExpm1(Type* type) {
-  DCHECK(type->Is(Type::Number()));
+Type OperationTyper::NumberExpm1(Type type) {
+  DCHECK(type.Is(Type::Number()));
   return Type::Union(Type::PlainNumber(), Type::NaN(), zone());
 }
 
-Type* OperationTyper::NumberFloor(Type* type) {
-  DCHECK(type->Is(Type::Number()));
-  if (type->Is(cache_.kIntegerOrMinusZeroOrNaN)) return type;
+Type OperationTyper::NumberFloor(Type type) {
+  DCHECK(type.Is(Type::Number()));
+  if (type.Is(cache_.kIntegerOrMinusZeroOrNaN)) return type;
   type = Type::Intersect(type, Type::MinusZeroOrNaN(), zone());
   type = Type::Union(type, cache_.kInteger, zone());
   return type;
 }
 
-Type* OperationTyper::NumberFround(Type* type) {
-  DCHECK(type->Is(Type::Number()));
+Type OperationTyper::NumberFround(Type type) {
+  DCHECK(type.Is(Type::Number()));
   return Type::Number();
 }
 
-Type* OperationTyper::NumberLog(Type* type) {
-  DCHECK(type->Is(Type::Number()));
+Type OperationTyper::NumberLog(Type type) {
+  DCHECK(type.Is(Type::Number()));
   return Type::Number();
 }
 
-Type* OperationTyper::NumberLog1p(Type* type) {
-  DCHECK(type->Is(Type::Number()));
+Type OperationTyper::NumberLog1p(Type type) {
+  DCHECK(type.Is(Type::Number()));
   return Type::Number();
 }
 
-Type* OperationTyper::NumberLog2(Type* type) {
-  DCHECK(type->Is(Type::Number()));
+Type OperationTyper::NumberLog2(Type type) {
+  DCHECK(type.Is(Type::Number()));
   return Type::Number();
 }
 
-Type* OperationTyper::NumberLog10(Type* type) {
-  DCHECK(type->Is(Type::Number()));
+Type OperationTyper::NumberLog10(Type type) {
+  DCHECK(type.Is(Type::Number()));
   return Type::Number();
 }
 
-Type* OperationTyper::NumberRound(Type* type) {
-  DCHECK(type->Is(Type::Number()));
-  if (type->Is(cache_.kIntegerOrMinusZeroOrNaN)) return type;
+Type OperationTyper::NumberRound(Type type) {
+  DCHECK(type.Is(Type::Number()));
+  if (type.Is(cache_.kIntegerOrMinusZeroOrNaN)) return type;
   type = Type::Intersect(type, Type::NaN(), zone());
   type = Type::Union(type, cache_.kIntegerOrMinusZero, zone());
   return type;
 }
 
-Type* OperationTyper::NumberSign(Type* type) {
-  DCHECK(type->Is(Type::Number()));
-  if (type->Is(cache_.kZeroish)) return type;
-  bool maybe_minuszero = type->Maybe(Type::MinusZero());
-  bool maybe_nan = type->Maybe(Type::NaN());
+Type OperationTyper::NumberSign(Type type) {
+  DCHECK(type.Is(Type::Number()));
+  if (type.Is(cache_.kZeroish)) return type;
+  bool maybe_minuszero = type.Maybe(Type::MinusZero());
+  bool maybe_nan = type.Maybe(Type::NaN());
   type = Type::Intersect(type, Type::PlainNumber(), zone());
-  if (type->IsNone()) {
+  if (type.IsNone()) {
     // Do nothing.
-  } else if (type->Max() < 0.0) {
+  } else if (type.Max() < 0.0) {
     type = cache_.kSingletonMinusOne;
-  } else if (type->Max() <= 0.0) {
+  } else if (type.Max() <= 0.0) {
     type = cache_.kMinusOneOrZero;
-  } else if (type->Min() > 0.0) {
+  } else if (type.Min() > 0.0) {
     type = cache_.kSingletonOne;
-  } else if (type->Min() >= 0.0) {
+  } else if (type.Min() >= 0.0) {
     type = cache_.kZeroOrOne;
   } else {
     type = Type::Range(-1.0, 1.0, zone());
   }
   if (maybe_minuszero) type = Type::Union(type, Type::MinusZero(), zone());
   if (maybe_nan) type = Type::Union(type, Type::NaN(), zone());
-  DCHECK(!type->IsNone());
+  DCHECK(!type.IsNone());
   return type;
 }
 
-Type* OperationTyper::NumberSin(Type* type) {
-  DCHECK(type->Is(Type::Number()));
+Type OperationTyper::NumberSin(Type type) {
+  DCHECK(type.Is(Type::Number()));
   return Type::Number();
 }
 
-Type* OperationTyper::NumberSinh(Type* type) {
-  DCHECK(type->Is(Type::Number()));
+Type OperationTyper::NumberSinh(Type type) {
+  DCHECK(type.Is(Type::Number()));
   return Type::Number();
 }
 
-Type* OperationTyper::NumberSqrt(Type* type) {
-  DCHECK(type->Is(Type::Number()));
+Type OperationTyper::NumberSqrt(Type type) {
+  DCHECK(type.Is(Type::Number()));
   return Type::Number();
 }
 
-Type* OperationTyper::NumberTan(Type* type) {
-  DCHECK(type->Is(Type::Number()));
+Type OperationTyper::NumberTan(Type type) {
+  DCHECK(type.Is(Type::Number()));
   return Type::Number();
 }
 
-Type* OperationTyper::NumberTanh(Type* type) {
-  DCHECK(type->Is(Type::Number()));
+Type OperationTyper::NumberTanh(Type type) {
+  DCHECK(type.Is(Type::Number()));
   return Type::Number();
 }
 
-Type* OperationTyper::NumberTrunc(Type* type) {
-  DCHECK(type->Is(Type::Number()));
-  if (type->Is(cache_.kIntegerOrMinusZeroOrNaN)) return type;
+Type OperationTyper::NumberTrunc(Type type) {
+  DCHECK(type.Is(Type::Number()));
+  if (type.Is(cache_.kIntegerOrMinusZeroOrNaN)) return type;
   type = Type::Intersect(type, Type::NaN(), zone());
   type = Type::Union(type, cache_.kIntegerOrMinusZero, zone());
   return type;
 }
 
-Type* OperationTyper::NumberToBoolean(Type* type) {
-  DCHECK(type->Is(Type::Number()));
-  if (type->IsNone()) return type;
-  if (type->Is(cache_.kZeroish)) return singleton_false_;
-  if (type->Is(Type::PlainNumber()) && (type->Max() < 0 || 0 < type->Min())) {
+Type OperationTyper::NumberToBoolean(Type type) {
+  DCHECK(type.Is(Type::Number()));
+  if (type.IsNone()) return type;
+  if (type.Is(cache_.kZeroish)) return singleton_false_;
+  if (type.Is(Type::PlainNumber()) && (type.Max() < 0 || 0 < type.Min())) {
     return singleton_true_;  // Ruled out nan, -0 and +0.
   }
   return Type::Boolean();
 }
 
-Type* OperationTyper::NumberToInt32(Type* type) {
-  DCHECK(type->Is(Type::Number()));
+Type OperationTyper::NumberToInt32(Type type) {
+  DCHECK(type.Is(Type::Number()));
 
-  if (type->Is(Type::Signed32())) return type;
-  if (type->Is(cache_.kZeroish)) return cache_.kSingletonZero;
-  if (type->Is(signed32ish_)) {
+  if (type.Is(Type::Signed32())) return type;
+  if (type.Is(cache_.kZeroish)) return cache_.kSingletonZero;
+  if (type.Is(signed32ish_)) {
     return Type::Intersect(Type::Union(type, cache_.kSingletonZero, zone()),
                            Type::Signed32(), zone());
   }
   return Type::Signed32();
 }
 
-Type* OperationTyper::NumberToString(Type* type) {
-  DCHECK(type->Is(Type::Number()));
-  if (type->IsNone()) return type;
-  if (type->Is(Type::NaN())) return singleton_NaN_string_;
-  if (type->Is(cache_.kZeroOrMinusZero)) return singleton_zero_string_;
+Type OperationTyper::NumberToString(Type type) {
+  DCHECK(type.Is(Type::Number()));
+  if (type.IsNone()) return type;
+  if (type.Is(Type::NaN())) return singleton_NaN_string_;
+  if (type.Is(cache_.kZeroOrMinusZero)) return singleton_zero_string_;
   return Type::String();
 }
 
-Type* OperationTyper::NumberToUint32(Type* type) {
-  DCHECK(type->Is(Type::Number()));
+Type OperationTyper::NumberToUint32(Type type) {
+  DCHECK(type.Is(Type::Number()));
 
-  if (type->Is(Type::Unsigned32())) return type;
-  if (type->Is(cache_.kZeroish)) return cache_.kSingletonZero;
-  if (type->Is(unsigned32ish_)) {
+  if (type.Is(Type::Unsigned32())) return type;
+  if (type.Is(cache_.kZeroish)) return cache_.kSingletonZero;
+  if (type.Is(unsigned32ish_)) {
     return Type::Intersect(Type::Union(type, cache_.kSingletonZero, zone()),
                            Type::Unsigned32(), zone());
   }
   return Type::Unsigned32();
 }
 
-Type* OperationTyper::NumberToUint8Clamped(Type* type) {
-  DCHECK(type->Is(Type::Number()));
+Type OperationTyper::NumberToUint8Clamped(Type type) {
+  DCHECK(type.Is(Type::Number()));
 
-  if (type->Is(cache_.kUint8)) return type;
+  if (type.Is(cache_.kUint8)) return type;
   return cache_.kUint8;
 }
 
-Type* OperationTyper::NumberSilenceNaN(Type* type) {
-  DCHECK(type->Is(Type::Number()));
+Type OperationTyper::NumberSilenceNaN(Type type) {
+  DCHECK(type.Is(Type::Number()));
   // TODO(jarin): This is a terrible hack; we definitely need a dedicated type
   // for the hole (tagged and/or double). Otherwise if the input is the hole
   // NaN constant, we'd just eliminate this node in JSTypedLowering.
-  if (type->Maybe(Type::NaN())) return Type::Number();
+  if (type.Maybe(Type::NaN())) return Type::Number();
   return type;
 }
 
-Type* OperationTyper::NumberAdd(Type* lhs, Type* rhs) {
-  DCHECK(lhs->Is(Type::Number()));
-  DCHECK(rhs->Is(Type::Number()));
+Type OperationTyper::NumberAdd(Type lhs, Type rhs) {
+  DCHECK(lhs.Is(Type::Number()));
+  DCHECK(rhs.Is(Type::Number()));
 
-  if (lhs->IsNone() || rhs->IsNone()) return Type::None();
+  if (lhs.IsNone() || rhs.IsNone()) return Type::None();
 
   // Addition can return NaN if either input can be NaN or we try to compute
   // the sum of two infinities of opposite sign.
-  bool maybe_nan = lhs->Maybe(Type::NaN()) || rhs->Maybe(Type::NaN());
+  bool maybe_nan = lhs.Maybe(Type::NaN()) || rhs.Maybe(Type::NaN());
 
   // Addition can yield minus zero only if both inputs can be minus zero.
   bool maybe_minuszero = true;
-  if (lhs->Maybe(Type::MinusZero())) {
+  if (lhs.Maybe(Type::MinusZero())) {
     lhs = Type::Union(lhs, cache_.kSingletonZero, zone());
   } else {
     maybe_minuszero = false;
   }
-  if (rhs->Maybe(Type::MinusZero())) {
+  if (rhs.Maybe(Type::MinusZero())) {
     rhs = Type::Union(rhs, cache_.kSingletonZero, zone());
   } else {
     maybe_minuszero = false;
   }
 
   // We can give more precise types for integers.
-  Type* type = Type::None();
+  Type type = Type::None();
   lhs = Type::Intersect(lhs, Type::PlainNumber(), zone());
   rhs = Type::Intersect(rhs, Type::PlainNumber(), zone());
-  if (!lhs->IsNone() && !rhs->IsNone()) {
-    if (lhs->Is(cache_.kInteger) && rhs->Is(cache_.kInteger)) {
-      type = AddRanger(lhs->Min(), lhs->Max(), rhs->Min(), rhs->Max());
+  if (!lhs.IsNone() && !rhs.IsNone()) {
+    if (lhs.Is(cache_.kInteger) && rhs.Is(cache_.kInteger)) {
+      type = AddRanger(lhs.Min(), lhs.Max(), rhs.Min(), rhs.Max());
     } else {
-      if ((lhs->Maybe(minus_infinity_) && rhs->Maybe(infinity_)) ||
-          (rhs->Maybe(minus_infinity_) && lhs->Maybe(infinity_))) {
+      if ((lhs.Maybe(minus_infinity_) && rhs.Maybe(infinity_)) ||
+          (rhs.Maybe(minus_infinity_) && lhs.Maybe(infinity_))) {
         maybe_nan = true;
       }
       type = Type::PlainNumber();
@@ -586,37 +604,37 @@ Type* OperationTyper::NumberAdd(Type* lhs, Type* rhs) {
   return type;
 }
 
-Type* OperationTyper::NumberSubtract(Type* lhs, Type* rhs) {
-  DCHECK(lhs->Is(Type::Number()));
-  DCHECK(rhs->Is(Type::Number()));
+Type OperationTyper::NumberSubtract(Type lhs, Type rhs) {
+  DCHECK(lhs.Is(Type::Number()));
+  DCHECK(rhs.Is(Type::Number()));
 
-  if (lhs->IsNone() || rhs->IsNone()) return Type::None();
+  if (lhs.IsNone() || rhs.IsNone()) return Type::None();
 
   // Subtraction can return NaN if either input can be NaN or we try to
   // compute the sum of two infinities of opposite sign.
-  bool maybe_nan = lhs->Maybe(Type::NaN()) || rhs->Maybe(Type::NaN());
+  bool maybe_nan = lhs.Maybe(Type::NaN()) || rhs.Maybe(Type::NaN());
 
   // Subtraction can yield minus zero if {lhs} can be minus zero and {rhs}
   // can be zero.
   bool maybe_minuszero = false;
-  if (lhs->Maybe(Type::MinusZero())) {
+  if (lhs.Maybe(Type::MinusZero())) {
     lhs = Type::Union(lhs, cache_.kSingletonZero, zone());
-    maybe_minuszero = rhs->Maybe(cache_.kSingletonZero);
+    maybe_minuszero = rhs.Maybe(cache_.kSingletonZero);
   }
-  if (rhs->Maybe(Type::MinusZero())) {
+  if (rhs.Maybe(Type::MinusZero())) {
     rhs = Type::Union(rhs, cache_.kSingletonZero, zone());
   }
 
   // We can give more precise types for integers.
-  Type* type = Type::None();
+  Type type = Type::None();
   lhs = Type::Intersect(lhs, Type::PlainNumber(), zone());
   rhs = Type::Intersect(rhs, Type::PlainNumber(), zone());
-  if (!lhs->IsNone() && !rhs->IsNone()) {
-    if (lhs->Is(cache_.kInteger) && rhs->Is(cache_.kInteger)) {
-      type = SubtractRanger(lhs->Min(), lhs->Max(), rhs->Min(), rhs->Max());
+  if (!lhs.IsNone() && !rhs.IsNone()) {
+    if (lhs.Is(cache_.kInteger) && rhs.Is(cache_.kInteger)) {
+      type = SubtractRanger(lhs.Min(), lhs.Max(), rhs.Min(), rhs.Max());
     } else {
-      if ((lhs->Maybe(infinity_) && rhs->Maybe(infinity_)) ||
-          (rhs->Maybe(minus_infinity_) && lhs->Maybe(minus_infinity_))) {
+      if ((lhs.Maybe(infinity_) && rhs.Maybe(infinity_)) ||
+          (rhs.Maybe(minus_infinity_) && lhs.Maybe(minus_infinity_))) {
         maybe_nan = true;
       }
       type = Type::PlainNumber();
@@ -629,8 +647,8 @@ Type* OperationTyper::NumberSubtract(Type* lhs, Type* rhs) {
   return type;
 }
 
-Type* OperationTyper::SpeculativeSafeIntegerAdd(Type* lhs, Type* rhs) {
-  Type* result = SpeculativeNumberAdd(lhs, rhs);
+Type OperationTyper::SpeculativeSafeIntegerAdd(Type lhs, Type rhs) {
+  Type result = SpeculativeNumberAdd(lhs, rhs);
   // If we have a Smi or Int32 feedback, the representation selection will
   // either truncate or it will check the inputs (i.e., deopt if not int32).
   // In either case the result will be in the safe integer range, so we
@@ -639,8 +657,8 @@ Type* OperationTyper::SpeculativeSafeIntegerAdd(Type* lhs, Type* rhs) {
   return Type::Intersect(result, cache_.kSafeIntegerOrMinusZero, zone());
 }
 
-Type* OperationTyper::SpeculativeSafeIntegerSubtract(Type* lhs, Type* rhs) {
-  Type* result = SpeculativeNumberSubtract(lhs, rhs);
+Type OperationTyper::SpeculativeSafeIntegerSubtract(Type lhs, Type rhs) {
+  Type result = SpeculativeNumberSubtract(lhs, rhs);
   // If we have a Smi or Int32 feedback, the representation selection will
   // either truncate or it will check the inputs (i.e., deopt if not int32).
   // In either case the result will be in the safe integer range, so we
@@ -649,91 +667,90 @@ Type* OperationTyper::SpeculativeSafeIntegerSubtract(Type* lhs, Type* rhs) {
   return result = Type::Intersect(result, cache_.kSafeInteger, zone());
 }
 
-Type* OperationTyper::NumberMultiply(Type* lhs, Type* rhs) {
-  DCHECK(lhs->Is(Type::Number()));
-  DCHECK(rhs->Is(Type::Number()));
+Type OperationTyper::NumberMultiply(Type lhs, Type rhs) {
+  DCHECK(lhs.Is(Type::Number()));
+  DCHECK(rhs.Is(Type::Number()));
 
-  if (lhs->IsNone() || rhs->IsNone()) return Type::None();
+  if (lhs.IsNone() || rhs.IsNone()) return Type::None();
 
   lhs = Rangify(lhs);
   rhs = Rangify(rhs);
-  if (lhs->Is(Type::NaN()) || rhs->Is(Type::NaN())) return Type::NaN();
-  if (lhs->IsRange() && rhs->IsRange()) {
+  if (lhs.Is(Type::NaN()) || rhs.Is(Type::NaN())) return Type::NaN();
+  if (lhs.IsRange() && rhs.IsRange()) {
     return MultiplyRanger(lhs, rhs);
   }
   return Type::Number();
 }
 
-Type* OperationTyper::NumberDivide(Type* lhs, Type* rhs) {
-  DCHECK(lhs->Is(Type::Number()));
-  DCHECK(rhs->Is(Type::Number()));
+Type OperationTyper::NumberDivide(Type lhs, Type rhs) {
+  DCHECK(lhs.Is(Type::Number()));
+  DCHECK(rhs.Is(Type::Number()));
 
-  if (lhs->IsNone() || rhs->IsNone()) return Type::None();
-  if (lhs->Is(Type::NaN()) || rhs->Is(Type::NaN())) return Type::NaN();
+  if (lhs.IsNone() || rhs.IsNone()) return Type::None();
+  if (lhs.Is(Type::NaN()) || rhs.Is(Type::NaN())) return Type::NaN();
 
   // Division is tricky, so all we do is try ruling out -0 and NaN.
-  bool maybe_nan =
-      lhs->Maybe(Type::NaN()) || rhs->Maybe(cache_.kZeroish) ||
-      ((lhs->Min() == -V8_INFINITY || lhs->Max() == +V8_INFINITY) &&
-       (rhs->Min() == -V8_INFINITY || rhs->Max() == +V8_INFINITY));
+  bool maybe_nan = lhs.Maybe(Type::NaN()) || rhs.Maybe(cache_.kZeroish) ||
+                   ((lhs.Min() == -V8_INFINITY || lhs.Max() == +V8_INFINITY) &&
+                    (rhs.Min() == -V8_INFINITY || rhs.Max() == +V8_INFINITY));
   lhs = Type::Intersect(lhs, Type::OrderedNumber(), zone());
-  DCHECK(!lhs->IsNone());
+  DCHECK(!lhs.IsNone());
   rhs = Type::Intersect(rhs, Type::OrderedNumber(), zone());
-  DCHECK(!rhs->IsNone());
+  DCHECK(!rhs.IsNone());
 
   // Try to rule out -0.
   bool maybe_minuszero =
-      !lhs->Is(cache_.kInteger) ||
-      (lhs->Maybe(cache_.kZeroish) && rhs->Min() < 0.0) ||
-      (rhs->Min() == -V8_INFINITY || rhs->Max() == +V8_INFINITY);
+      !lhs.Is(cache_.kInteger) ||
+      (lhs.Maybe(cache_.kZeroish) && rhs.Min() < 0.0) ||
+      (rhs.Min() == -V8_INFINITY || rhs.Max() == +V8_INFINITY);
 
   // Take into account the -0 and NaN information computed earlier.
-  Type* type = Type::PlainNumber();
+  Type type = Type::PlainNumber();
   if (maybe_minuszero) type = Type::Union(type, Type::MinusZero(), zone());
   if (maybe_nan) type = Type::Union(type, Type::NaN(), zone());
   return type;
 }
 
-Type* OperationTyper::NumberModulus(Type* lhs, Type* rhs) {
-  DCHECK(lhs->Is(Type::Number()));
-  DCHECK(rhs->Is(Type::Number()));
+Type OperationTyper::NumberModulus(Type lhs, Type rhs) {
+  DCHECK(lhs.Is(Type::Number()));
+  DCHECK(rhs.Is(Type::Number()));
 
-  if (lhs->IsNone() || rhs->IsNone()) return Type::None();
+  if (lhs.IsNone() || rhs.IsNone()) return Type::None();
 
   // Modulus can yield NaN if either {lhs} or {rhs} are NaN, or
   // {lhs} is not finite, or the {rhs} is a zero value.
-  bool maybe_nan = lhs->Maybe(Type::NaN()) || rhs->Maybe(cache_.kZeroish) ||
-                   lhs->Min() == -V8_INFINITY || lhs->Max() == +V8_INFINITY;
+  bool maybe_nan = lhs.Maybe(Type::NaN()) || rhs.Maybe(cache_.kZeroish) ||
+                   lhs.Min() == -V8_INFINITY || lhs.Max() == +V8_INFINITY;
 
   // Deal with -0 inputs, only the signbit of {lhs} matters for the result.
   bool maybe_minuszero = false;
-  if (lhs->Maybe(Type::MinusZero())) {
+  if (lhs.Maybe(Type::MinusZero())) {
     maybe_minuszero = true;
     lhs = Type::Union(lhs, cache_.kSingletonZero, zone());
   }
-  if (rhs->Maybe(Type::MinusZero())) {
+  if (rhs.Maybe(Type::MinusZero())) {
     rhs = Type::Union(rhs, cache_.kSingletonZero, zone());
   }
 
   // Rule out NaN and -0, and check what we can do with the remaining type info.
-  Type* type = Type::None();
+  Type type = Type::None();
   lhs = Type::Intersect(lhs, Type::PlainNumber(), zone());
   rhs = Type::Intersect(rhs, Type::PlainNumber(), zone());
 
   // We can only derive a meaningful type if both {lhs} and {rhs} are inhabited,
   // and the {rhs} is not 0, otherwise the result is NaN independent of {lhs}.
-  if (!lhs->IsNone() && !rhs->Is(cache_.kSingletonZero)) {
+  if (!lhs.IsNone() && !rhs.Is(cache_.kSingletonZero)) {
     // Determine the bounds of {lhs} and {rhs}.
-    double const lmin = lhs->Min();
-    double const lmax = lhs->Max();
-    double const rmin = rhs->Min();
-    double const rmax = rhs->Max();
+    double const lmin = lhs.Min();
+    double const lmax = lhs.Max();
+    double const rmin = rhs.Min();
+    double const rmax = rhs.Max();
 
     // The sign of the result is the sign of the {lhs}.
     if (lmin < 0.0) maybe_minuszero = true;
 
     // For integer inputs {lhs} and {rhs} we can infer a precise type.
-    if (lhs->Is(cache_.kInteger) && rhs->Is(cache_.kInteger)) {
+    if (lhs.Is(cache_.kInteger) && rhs.Is(cache_.kInteger)) {
       double labs = std::max(std::abs(lmin), std::abs(lmax));
       double rabs = std::max(std::abs(rmin), std::abs(rmax)) - 1;
       double abs = std::min(labs, rabs);
@@ -763,19 +780,19 @@ Type* OperationTyper::NumberModulus(Type* lhs, Type* rhs) {
   return type;
 }
 
-Type* OperationTyper::NumberBitwiseOr(Type* lhs, Type* rhs) {
-  DCHECK(lhs->Is(Type::Number()));
-  DCHECK(rhs->Is(Type::Number()));
+Type OperationTyper::NumberBitwiseOr(Type lhs, Type rhs) {
+  DCHECK(lhs.Is(Type::Number()));
+  DCHECK(rhs.Is(Type::Number()));
 
   lhs = NumberToInt32(lhs);
   rhs = NumberToInt32(rhs);
 
-  if (lhs->IsNone() || rhs->IsNone()) return Type::None();
+  if (lhs.IsNone() || rhs.IsNone()) return Type::None();
 
-  double lmin = lhs->Min();
-  double rmin = rhs->Min();
-  double lmax = lhs->Max();
-  double rmax = rhs->Max();
+  double lmin = lhs.Min();
+  double rmin = rhs.Min();
+  double lmax = lhs.Max();
+  double rmax = rhs.Max();
   // Or-ing any two values results in a value no smaller than their minimum.
   // Even no smaller than their maximum if both values are non-negative.
   double min =
@@ -800,19 +817,19 @@ Type* OperationTyper::NumberBitwiseOr(Type* lhs, Type* rhs) {
   return Type::Range(min, max, zone());
 }
 
-Type* OperationTyper::NumberBitwiseAnd(Type* lhs, Type* rhs) {
-  DCHECK(lhs->Is(Type::Number()));
-  DCHECK(rhs->Is(Type::Number()));
+Type OperationTyper::NumberBitwiseAnd(Type lhs, Type rhs) {
+  DCHECK(lhs.Is(Type::Number()));
+  DCHECK(rhs.Is(Type::Number()));
 
   lhs = NumberToInt32(lhs);
   rhs = NumberToInt32(rhs);
 
-  if (lhs->IsNone() || rhs->IsNone()) return Type::None();
+  if (lhs.IsNone() || rhs.IsNone()) return Type::None();
 
-  double lmin = lhs->Min();
-  double rmin = rhs->Min();
-  double lmax = lhs->Max();
-  double rmax = rhs->Max();
+  double lmin = lhs.Min();
+  double rmin = rhs.Min();
+  double lmax = lhs.Max();
+  double rmax = rhs.Max();
   double min = kMinInt;
   // And-ing any two values results in a value no larger than their maximum.
   // Even no larger than their minimum if both values are non-negative.
@@ -831,19 +848,19 @@ Type* OperationTyper::NumberBitwiseAnd(Type* lhs, Type* rhs) {
   return Type::Range(min, max, zone());
 }
 
-Type* OperationTyper::NumberBitwiseXor(Type* lhs, Type* rhs) {
-  DCHECK(lhs->Is(Type::Number()));
-  DCHECK(rhs->Is(Type::Number()));
+Type OperationTyper::NumberBitwiseXor(Type lhs, Type rhs) {
+  DCHECK(lhs.Is(Type::Number()));
+  DCHECK(rhs.Is(Type::Number()));
 
   lhs = NumberToInt32(lhs);
   rhs = NumberToInt32(rhs);
 
-  if (lhs->IsNone() || rhs->IsNone()) return Type::None();
+  if (lhs.IsNone() || rhs.IsNone()) return Type::None();
 
-  double lmin = lhs->Min();
-  double rmin = rhs->Min();
-  double lmax = lhs->Max();
-  double rmax = rhs->Max();
+  double lmin = lhs.Min();
+  double rmin = rhs.Min();
+  double lmax = lhs.Max();
+  double rmax = rhs.Max();
   if ((lmin >= 0 && rmin >= 0) || (lmax < 0 && rmax < 0)) {
     // Xor-ing negative or non-negative values results in a non-negative value.
     return Type::Unsigned31();
@@ -856,19 +873,19 @@ Type* OperationTyper::NumberBitwiseXor(Type* lhs, Type* rhs) {
   return Type::Signed32();
 }
 
-Type* OperationTyper::NumberShiftLeft(Type* lhs, Type* rhs) {
-  DCHECK(lhs->Is(Type::Number()));
-  DCHECK(rhs->Is(Type::Number()));
+Type OperationTyper::NumberShiftLeft(Type lhs, Type rhs) {
+  DCHECK(lhs.Is(Type::Number()));
+  DCHECK(rhs.Is(Type::Number()));
 
   lhs = NumberToInt32(lhs);
   rhs = NumberToUint32(rhs);
 
-  if (lhs->IsNone() || rhs->IsNone()) return Type::None();
+  if (lhs.IsNone() || rhs.IsNone()) return Type::None();
 
-  int32_t min_lhs = lhs->Min();
-  int32_t max_lhs = lhs->Max();
-  uint32_t min_rhs = rhs->Min();
-  uint32_t max_rhs = rhs->Max();
+  int32_t min_lhs = lhs.Min();
+  int32_t max_lhs = lhs.Max();
+  uint32_t min_rhs = rhs.Min();
+  uint32_t max_rhs = rhs.Max();
   if (max_rhs > 31) {
     // rhs can be larger than the bitmask
     max_rhs = 31;
@@ -891,19 +908,19 @@ Type* OperationTyper::NumberShiftLeft(Type* lhs, Type* rhs) {
   return Type::Range(min, max, zone());
 }
 
-Type* OperationTyper::NumberShiftRight(Type* lhs, Type* rhs) {
-  DCHECK(lhs->Is(Type::Number()));
-  DCHECK(rhs->Is(Type::Number()));
+Type OperationTyper::NumberShiftRight(Type lhs, Type rhs) {
+  DCHECK(lhs.Is(Type::Number()));
+  DCHECK(rhs.Is(Type::Number()));
 
   lhs = NumberToInt32(lhs);
   rhs = NumberToUint32(rhs);
 
-  if (lhs->IsNone() || rhs->IsNone()) return Type::None();
+  if (lhs.IsNone() || rhs.IsNone()) return Type::None();
 
-  int32_t min_lhs = lhs->Min();
-  int32_t max_lhs = lhs->Max();
-  uint32_t min_rhs = rhs->Min();
-  uint32_t max_rhs = rhs->Max();
+  int32_t min_lhs = lhs.Min();
+  int32_t max_lhs = lhs.Max();
+  uint32_t min_rhs = rhs.Min();
+  uint32_t max_rhs = rhs.Max();
   if (max_rhs > 31) {
     // rhs can be larger than the bitmask
     max_rhs = 31;
@@ -916,19 +933,19 @@ Type* OperationTyper::NumberShiftRight(Type* lhs, Type* rhs) {
   return Type::Range(min, max, zone());
 }
 
-Type* OperationTyper::NumberShiftRightLogical(Type* lhs, Type* rhs) {
-  DCHECK(lhs->Is(Type::Number()));
-  DCHECK(rhs->Is(Type::Number()));
+Type OperationTyper::NumberShiftRightLogical(Type lhs, Type rhs) {
+  DCHECK(lhs.Is(Type::Number()));
+  DCHECK(rhs.Is(Type::Number()));
 
   lhs = NumberToUint32(lhs);
   rhs = NumberToUint32(rhs);
 
-  if (lhs->IsNone() || rhs->IsNone()) return Type::None();
+  if (lhs.IsNone() || rhs.IsNone()) return Type::None();
 
-  uint32_t min_lhs = lhs->Min();
-  uint32_t max_lhs = lhs->Max();
-  uint32_t min_rhs = rhs->Min();
-  uint32_t max_rhs = rhs->Max();
+  uint32_t min_lhs = lhs.Min();
+  uint32_t max_lhs = lhs.Max();
+  uint32_t min_rhs = rhs.Min();
+  uint32_t max_rhs = rhs.Max();
   if (max_rhs > 31) {
     // rhs can be larger than the bitmask
     max_rhs = 31;
@@ -945,38 +962,38 @@ Type* OperationTyper::NumberShiftRightLogical(Type* lhs, Type* rhs) {
   return Type::Range(min, max, zone());
 }
 
-Type* OperationTyper::NumberAtan2(Type* lhs, Type* rhs) {
-  DCHECK(lhs->Is(Type::Number()));
-  DCHECK(rhs->Is(Type::Number()));
+Type OperationTyper::NumberAtan2(Type lhs, Type rhs) {
+  DCHECK(lhs.Is(Type::Number()));
+  DCHECK(rhs.Is(Type::Number()));
   return Type::Number();
 }
 
-Type* OperationTyper::NumberImul(Type* lhs, Type* rhs) {
-  DCHECK(lhs->Is(Type::Number()));
-  DCHECK(rhs->Is(Type::Number()));
+Type OperationTyper::NumberImul(Type lhs, Type rhs) {
+  DCHECK(lhs.Is(Type::Number()));
+  DCHECK(rhs.Is(Type::Number()));
   // TODO(turbofan): We should be able to do better here.
   return Type::Signed32();
 }
 
-Type* OperationTyper::NumberMax(Type* lhs, Type* rhs) {
-  DCHECK(lhs->Is(Type::Number()));
-  DCHECK(rhs->Is(Type::Number()));
+Type OperationTyper::NumberMax(Type lhs, Type rhs) {
+  DCHECK(lhs.Is(Type::Number()));
+  DCHECK(rhs.Is(Type::Number()));
 
-  if (lhs->IsNone() || rhs->IsNone()) return Type::None();
-  if (lhs->Is(Type::NaN()) || rhs->Is(Type::NaN())) return Type::NaN();
+  if (lhs.IsNone() || rhs.IsNone()) return Type::None();
+  if (lhs.Is(Type::NaN()) || rhs.Is(Type::NaN())) return Type::NaN();
 
-  Type* type = Type::None();
+  Type type = Type::None();
   // TODO(turbofan): Improve minus zero handling here.
-  if (lhs->Maybe(Type::NaN()) || rhs->Maybe(Type::NaN())) {
+  if (lhs.Maybe(Type::NaN()) || rhs.Maybe(Type::NaN())) {
     type = Type::Union(type, Type::NaN(), zone());
   }
   lhs = Type::Intersect(lhs, Type::OrderedNumber(), zone());
-  DCHECK(!lhs->IsNone());
+  DCHECK(!lhs.IsNone());
   rhs = Type::Intersect(rhs, Type::OrderedNumber(), zone());
-  DCHECK(!rhs->IsNone());
-  if (lhs->Is(cache_.kInteger) && rhs->Is(cache_.kInteger)) {
-    double max = std::max(lhs->Max(), rhs->Max());
-    double min = std::max(lhs->Min(), rhs->Min());
+  DCHECK(!rhs.IsNone());
+  if (lhs.Is(cache_.kInteger) && rhs.Is(cache_.kInteger)) {
+    double max = std::max(lhs.Max(), rhs.Max());
+    double min = std::max(lhs.Min(), rhs.Min());
     type = Type::Union(type, Type::Range(min, max, zone()), zone());
   } else {
     type = Type::Union(type, Type::Union(lhs, rhs, zone()), zone());
@@ -984,25 +1001,25 @@ Type* OperationTyper::NumberMax(Type* lhs, Type* rhs) {
   return type;
 }
 
-Type* OperationTyper::NumberMin(Type* lhs, Type* rhs) {
-  DCHECK(lhs->Is(Type::Number()));
-  DCHECK(rhs->Is(Type::Number()));
+Type OperationTyper::NumberMin(Type lhs, Type rhs) {
+  DCHECK(lhs.Is(Type::Number()));
+  DCHECK(rhs.Is(Type::Number()));
 
-  if (lhs->IsNone() || rhs->IsNone()) return Type::None();
-  if (lhs->Is(Type::NaN()) || rhs->Is(Type::NaN())) return Type::NaN();
+  if (lhs.IsNone() || rhs.IsNone()) return Type::None();
+  if (lhs.Is(Type::NaN()) || rhs.Is(Type::NaN())) return Type::NaN();
 
-  Type* type = Type::None();
+  Type type = Type::None();
   // TODO(turbofan): Improve minus zero handling here.
-  if (lhs->Maybe(Type::NaN()) || rhs->Maybe(Type::NaN())) {
+  if (lhs.Maybe(Type::NaN()) || rhs.Maybe(Type::NaN())) {
     type = Type::Union(type, Type::NaN(), zone());
   }
   lhs = Type::Intersect(lhs, Type::OrderedNumber(), zone());
-  DCHECK(!lhs->IsNone());
+  DCHECK(!lhs.IsNone());
   rhs = Type::Intersect(rhs, Type::OrderedNumber(), zone());
-  DCHECK(!rhs->IsNone());
-  if (lhs->Is(cache_.kInteger) && rhs->Is(cache_.kInteger)) {
-    double max = std::min(lhs->Max(), rhs->Max());
-    double min = std::min(lhs->Min(), rhs->Min());
+  DCHECK(!rhs.IsNone());
+  if (lhs.Is(cache_.kInteger) && rhs.Is(cache_.kInteger)) {
+    double max = std::min(lhs.Max(), rhs.Max());
+    double min = std::min(lhs.Min(), rhs.Min());
     type = Type::Union(type, Type::Range(min, max, zone()), zone());
   } else {
     type = Type::Union(type, Type::Union(lhs, rhs, zone()), zone());
@@ -1010,18 +1027,18 @@ Type* OperationTyper::NumberMin(Type* lhs, Type* rhs) {
   return type;
 }
 
-Type* OperationTyper::NumberPow(Type* lhs, Type* rhs) {
-  DCHECK(lhs->Is(Type::Number()));
-  DCHECK(rhs->Is(Type::Number()));
+Type OperationTyper::NumberPow(Type lhs, Type rhs) {
+  DCHECK(lhs.Is(Type::Number()));
+  DCHECK(rhs.Is(Type::Number()));
   // TODO(turbofan): We should be able to do better here.
   return Type::Number();
 }
 
-#define SPECULATIVE_NUMBER_BINOP(Name)                            \
-  Type* OperationTyper::Speculative##Name(Type* lhs, Type* rhs) { \
-    lhs = SpeculativeToNumber(lhs);                               \
-    rhs = SpeculativeToNumber(rhs);                               \
-    return Name(lhs, rhs);                                        \
+#define SPECULATIVE_NUMBER_BINOP(Name)                         \
+  Type OperationTyper::Speculative##Name(Type lhs, Type rhs) { \
+    lhs = SpeculativeToNumber(lhs);                            \
+    rhs = SpeculativeToNumber(rhs);                            \
+    return Name(lhs, rhs);                                     \
   }
 SPECULATIVE_NUMBER_BINOP(NumberAdd)
 SPECULATIVE_NUMBER_BINOP(NumberSubtract)
@@ -1036,22 +1053,22 @@ SPECULATIVE_NUMBER_BINOP(NumberShiftRight)
 SPECULATIVE_NUMBER_BINOP(NumberShiftRightLogical)
 #undef SPECULATIVE_NUMBER_BINOP
 
-Type* OperationTyper::SpeculativeToNumber(Type* type) {
+Type OperationTyper::SpeculativeToNumber(Type type) {
   return ToNumber(Type::Intersect(type, Type::NumberOrOddball(), zone()));
 }
 
-Type* OperationTyper::ToPrimitive(Type* type) {
-  if (type->Is(Type::Primitive())) {
+Type OperationTyper::ToPrimitive(Type type) {
+  if (type.Is(Type::Primitive())) {
     return type;
   }
   return Type::Primitive();
 }
 
-Type* OperationTyper::Invert(Type* type) {
-  DCHECK(type->Is(Type::Boolean()));
-  DCHECK(!type->IsNone());
-  if (type->Is(singleton_false())) return singleton_true();
-  if (type->Is(singleton_true())) return singleton_false();
+Type OperationTyper::Invert(Type type) {
+  DCHECK(type.Is(Type::Boolean()));
+  DCHECK(!type.IsNone());
+  if (type.Is(singleton_false())) return singleton_true();
+  if (type.Is(singleton_true())) return singleton_false();
   return type;
 }
 
@@ -1064,7 +1081,7 @@ OperationTyper::ComparisonOutcome OperationTyper::Invert(
   return result;
 }
 
-Type* OperationTyper::FalsifyUndefined(ComparisonOutcome outcome) {
+Type OperationTyper::FalsifyUndefined(ComparisonOutcome outcome) {
   if ((outcome & kComparisonFalse) != 0 ||
       (outcome & kComparisonUndefined) != 0) {
     return (outcome & kComparisonTrue) != 0 ? Type::Boolean()
@@ -1077,52 +1094,52 @@ Type* OperationTyper::FalsifyUndefined(ComparisonOutcome outcome) {
 
 namespace {
 
-Type* JSType(Type* type) {
-  if (type->Is(Type::Boolean())) return Type::Boolean();
-  if (type->Is(Type::String())) return Type::String();
-  if (type->Is(Type::Number())) return Type::Number();
-  if (type->Is(Type::BigInt())) return Type::BigInt();
-  if (type->Is(Type::Undefined())) return Type::Undefined();
-  if (type->Is(Type::Null())) return Type::Null();
-  if (type->Is(Type::Symbol())) return Type::Symbol();
-  if (type->Is(Type::Receiver())) return Type::Receiver();  // JS "Object"
+Type JSType(Type type) {
+  if (type.Is(Type::Boolean())) return Type::Boolean();
+  if (type.Is(Type::String())) return Type::String();
+  if (type.Is(Type::Number())) return Type::Number();
+  if (type.Is(Type::BigInt())) return Type::BigInt();
+  if (type.Is(Type::Undefined())) return Type::Undefined();
+  if (type.Is(Type::Null())) return Type::Null();
+  if (type.Is(Type::Symbol())) return Type::Symbol();
+  if (type.Is(Type::Receiver())) return Type::Receiver();  // JS "Object"
   return Type::Any();
 }
 
 }  // namespace
 
-Type* OperationTyper::SameValue(Type* lhs, Type* rhs) {
-  if (!JSType(lhs)->Maybe(JSType(rhs))) return singleton_false();
-  if (lhs->Is(Type::NaN())) {
-    if (rhs->Is(Type::NaN())) return singleton_true();
-    if (!rhs->Maybe(Type::NaN())) return singleton_false();
-  } else if (rhs->Is(Type::NaN())) {
-    if (!lhs->Maybe(Type::NaN())) return singleton_false();
+Type OperationTyper::SameValue(Type lhs, Type rhs) {
+  if (!JSType(lhs).Maybe(JSType(rhs))) return singleton_false();
+  if (lhs.Is(Type::NaN())) {
+    if (rhs.Is(Type::NaN())) return singleton_true();
+    if (!rhs.Maybe(Type::NaN())) return singleton_false();
+  } else if (rhs.Is(Type::NaN())) {
+    if (!lhs.Maybe(Type::NaN())) return singleton_false();
   }
-  if (lhs->Is(Type::MinusZero())) {
-    if (rhs->Is(Type::MinusZero())) return singleton_true();
-    if (!rhs->Maybe(Type::MinusZero())) return singleton_false();
-  } else if (rhs->Is(Type::MinusZero())) {
-    if (!lhs->Maybe(Type::MinusZero())) return singleton_false();
+  if (lhs.Is(Type::MinusZero())) {
+    if (rhs.Is(Type::MinusZero())) return singleton_true();
+    if (!rhs.Maybe(Type::MinusZero())) return singleton_false();
+  } else if (rhs.Is(Type::MinusZero())) {
+    if (!lhs.Maybe(Type::MinusZero())) return singleton_false();
   }
-  if (lhs->Is(Type::OrderedNumber()) && rhs->Is(Type::OrderedNumber()) &&
-      (lhs->Max() < rhs->Min() || lhs->Min() > rhs->Max())) {
+  if (lhs.Is(Type::OrderedNumber()) && rhs.Is(Type::OrderedNumber()) &&
+      (lhs.Max() < rhs.Min() || lhs.Min() > rhs.Max())) {
     return singleton_false();
   }
   return Type::Boolean();
 }
 
-Type* OperationTyper::StrictEqual(Type* lhs, Type* rhs) {
-  if (!JSType(lhs)->Maybe(JSType(rhs))) return singleton_false();
-  if (lhs->Is(Type::NaN()) || rhs->Is(Type::NaN())) return singleton_false();
-  if (lhs->Is(Type::Number()) && rhs->Is(Type::Number()) &&
-      (lhs->Max() < rhs->Min() || lhs->Min() > rhs->Max())) {
+Type OperationTyper::StrictEqual(Type lhs, Type rhs) {
+  if (!JSType(lhs).Maybe(JSType(rhs))) return singleton_false();
+  if (lhs.Is(Type::NaN()) || rhs.Is(Type::NaN())) return singleton_false();
+  if (lhs.Is(Type::Number()) && rhs.Is(Type::Number()) &&
+      (lhs.Max() < rhs.Min() || lhs.Min() > rhs.Max())) {
     return singleton_false();
   }
-  if ((lhs->Is(Type::Hole()) || rhs->Is(Type::Hole())) && !lhs->Maybe(rhs)) {
+  if ((lhs.Is(Type::Hole()) || rhs.Is(Type::Hole())) && !lhs.Maybe(rhs)) {
     return singleton_false();
   }
-  if (lhs->IsHeapConstant() && rhs->Is(lhs)) {
+  if (lhs.IsHeapConstant() && rhs.Is(lhs)) {
     // Types are equal and are inhabited only by a single semantic value,
     // which is not nan due to the earlier check.
     return singleton_true();
@@ -1130,8 +1147,8 @@ Type* OperationTyper::StrictEqual(Type* lhs, Type* rhs) {
   return Type::Boolean();
 }
 
-Type* OperationTyper::CheckFloat64Hole(Type* type) {
-  if (type->Maybe(Type::Hole())) {
+Type OperationTyper::CheckFloat64Hole(Type type) {
+  if (type.Maybe(Type::Hole())) {
     // Turn "the hole" into undefined.
     type = Type::Intersect(type, Type::Number(), zone());
     type = Type::Union(type, Type::Undefined(), zone());
@@ -1139,23 +1156,33 @@ Type* OperationTyper::CheckFloat64Hole(Type* type) {
   return type;
 }
 
-Type* OperationTyper::CheckNumber(Type* type) {
+Type OperationTyper::CheckNumber(Type type) {
   return Type::Intersect(type, Type::Number(), zone());
 }
 
-Type* OperationTyper::TypeTypeGuard(const Operator* sigma_op, Type* input) {
+Type OperationTyper::TypeTypeGuard(const Operator* sigma_op, Type input) {
   return Type::Intersect(input, TypeGuardTypeOf(sigma_op), zone());
 }
 
-Type* OperationTyper::ConvertTaggedHoleToUndefined(Type* input) {
-  if (input->Maybe(Type::Hole())) {
+Type OperationTyper::ConvertTaggedHoleToUndefined(Type input) {
+  if (input.Maybe(Type::Hole())) {
     // Turn "the hole" into undefined.
-    Type* type = Type::Intersect(input, Type::NonInternal(), zone());
+    Type type = Type::Intersect(input, Type::NonInternal(), zone());
     return Type::Union(type, Type::Undefined(), zone());
   }
   return input;
 }
 
+Type OperationTyper::ToBoolean(Type type) {
+  if (type.Is(Type::Boolean())) return type;
+  if (type.Is(falsish_)) return singleton_false_;
+  if (type.Is(truish_)) return singleton_true_;
+  if (type.Is(Type::Number())) {
+    return NumberToBoolean(type);
+  }
+  return Type::Boolean();
+}
+
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/src/compiler/operation-typer.h b/deps/v8/src/compiler/operation-typer.h
index 282cb0c7509ce5..81f20bcda4e464 100644
--- a/deps/v8/src/compiler/operation-typer.h
+++ b/deps/v8/src/compiler/operation-typer.h
@@ -7,6 +7,7 @@
 
 #include "src/base/flags.h"
 #include "src/compiler/opcodes.h"
+#include "src/compiler/types.h"
 #include "src/objects.h"
 
 namespace v8 {
@@ -26,40 +27,42 @@ class TypeCache;
 
 class V8_EXPORT_PRIVATE OperationTyper {
  public:
-  OperationTyper(Isolate* isolate, Zone* zone);
+  OperationTyper(Isolate* isolate, const JSHeapBroker* js_heap_broker,
+                 Zone* zone);
 
   // Typing Phi.
-  Type* Merge(Type* left, Type* right);
+  Type Merge(Type left, Type right);
 
-  Type* ToPrimitive(Type* type);
-  Type* ToNumber(Type* type);
-  Type* ToNumeric(Type* type);
+  Type ToPrimitive(Type type);
+  Type ToNumber(Type type);
+  Type ToNumeric(Type type);
+  Type ToBoolean(Type type);
 
-  Type* WeakenRange(Type* current_range, Type* previous_range);
+  Type WeakenRange(Type current_range, Type previous_range);
 
-// Number unary operators.
-#define DECLARE_METHOD(Name) Type* Name(Type* type);
+// Unary operators.
+#define DECLARE_METHOD(Name) Type Name(Type type);
   SIMPLIFIED_NUMBER_UNOP_LIST(DECLARE_METHOD)
   SIMPLIFIED_SPECULATIVE_NUMBER_UNOP_LIST(DECLARE_METHOD)
   DECLARE_METHOD(ConvertReceiver)
 #undef DECLARE_METHOD
 
 // Number binary operators.
-#define DECLARE_METHOD(Name) Type* Name(Type* lhs, Type* rhs);
+#define DECLARE_METHOD(Name) Type Name(Type lhs, Type rhs);
   SIMPLIFIED_NUMBER_BINOP_LIST(DECLARE_METHOD)
   SIMPLIFIED_SPECULATIVE_NUMBER_BINOP_LIST(DECLARE_METHOD)
 #undef DECLARE_METHOD
 
   // Comparison operators.
-  Type* SameValue(Type* lhs, Type* rhs);
-  Type* StrictEqual(Type* lhs, Type* rhs);
+  Type SameValue(Type lhs, Type rhs);
+  Type StrictEqual(Type lhs, Type rhs);
 
   // Check operators.
-  Type* CheckFloat64Hole(Type* type);
-  Type* CheckNumber(Type* type);
-  Type* ConvertTaggedHoleToUndefined(Type* type);
+  Type CheckFloat64Hole(Type type);
+  Type CheckNumber(Type type);
+  Type ConvertTaggedHoleToUndefined(Type type);
 
-  Type* TypeTypeGuard(const Operator* sigma_op, Type* input);
+  Type TypeTypeGuard(const Operator* sigma_op, Type input);
 
   enum ComparisonOutcomeFlags {
     kComparisonTrue = 1,
@@ -67,40 +70,43 @@ class V8_EXPORT_PRIVATE OperationTyper {
     kComparisonUndefined = 4
   };
 
-  Type* singleton_false() const { return singleton_false_; }
-  Type* singleton_true() const { return singleton_true_; }
-  Type* singleton_the_hole() const { return singleton_the_hole_; }
+  Type singleton_false() const { return singleton_false_; }
+  Type singleton_true() const { return singleton_true_; }
+  Type singleton_the_hole() const { return singleton_the_hole_; }
 
  private:
   typedef base::Flags<ComparisonOutcomeFlags> ComparisonOutcome;
 
-  Type* ToNumberOrNumeric(Object::Conversion mode, Type* type);
+  Type ToNumberOrNumeric(Object::Conversion mode, Type type);
 
   ComparisonOutcome Invert(ComparisonOutcome);
-  Type* Invert(Type*);
-  Type* FalsifyUndefined(ComparisonOutcome);
+  Type Invert(Type);
+  Type FalsifyUndefined(ComparisonOutcome);
 
-  Type* Rangify(Type*);
-  Type* AddRanger(double lhs_min, double lhs_max, double rhs_min,
-                  double rhs_max);
-  Type* SubtractRanger(double lhs_min, double lhs_max, double rhs_min,
-                       double rhs_max);
-  Type* MultiplyRanger(Type* lhs, Type* rhs);
+  Type Rangify(Type);
+  Type AddRanger(double lhs_min, double lhs_max, double rhs_min,
+                 double rhs_max);
+  Type SubtractRanger(double lhs_min, double lhs_max, double rhs_min,
+                      double rhs_max);
+  Type MultiplyRanger(Type lhs, Type rhs);
 
   Zone* zone() const { return zone_; }
 
   Zone* const zone_;
   TypeCache const& cache_;
 
-  Type* infinity_;
-  Type* minus_infinity_;
-  Type* singleton_NaN_string_;
-  Type* singleton_zero_string_;
-  Type* singleton_false_;
-  Type* singleton_true_;
-  Type* singleton_the_hole_;
-  Type* signed32ish_;
-  Type* unsigned32ish_;
+  Type infinity_;
+  Type minus_infinity_;
+  Type singleton_NaN_string_;
+  Type singleton_zero_string_;
+  Type singleton_false_;
+  Type singleton_true_;
+  Type singleton_the_hole_;
+  Type signed32ish_;
+  Type unsigned32ish_;
+  Type singleton_empty_string_;
+  Type truish_;
+  Type falsish_;
 };
 
 }  // namespace compiler
diff --git a/deps/v8/src/compiler/operator-properties.cc b/deps/v8/src/compiler/operator-properties.cc
index df2a3e1dafe1a1..689561059cf350 100644
--- a/deps/v8/src/compiler/operator-properties.cc
+++ b/deps/v8/src/compiler/operator-properties.cc
@@ -75,6 +75,7 @@ bool OperatorProperties::HasFrameStateInput(const Operator* op) {
     case IrOpcode::kJSCreateLiteralArray:
     case IrOpcode::kJSCreateLiteralObject:
     case IrOpcode::kJSCreateLiteralRegExp:
+    case IrOpcode::kJSCreateObject:
 
     // Property access operations
     case IrOpcode::kJSLoadNamed:
@@ -95,6 +96,7 @@ bool OperatorProperties::HasFrameStateInput(const Operator* op) {
     case IrOpcode::kJSToNumeric:
     case IrOpcode::kJSToObject:
     case IrOpcode::kJSToString:
+    case IrOpcode::kJSParseInt:
 
     // Call operations
     case IrOpcode::kJSConstructForwardVarargs:
@@ -120,6 +122,8 @@ bool OperatorProperties::HasFrameStateInput(const Operator* op) {
     case IrOpcode::kJSRejectPromise:
     case IrOpcode::kJSResolvePromise:
     case IrOpcode::kJSPerformPromiseThen:
+    case IrOpcode::kJSObjectIsArray:
+    case IrOpcode::kJSRegExpTest:
       return true;
 
     default:
diff --git a/deps/v8/src/compiler/pipeline-statistics.cc b/deps/v8/src/compiler/pipeline-statistics.cc
index af8fa501400b94..099e5599b85203 100644
--- a/deps/v8/src/compiler/pipeline-statistics.cc
+++ b/deps/v8/src/compiler/pipeline-statistics.cc
@@ -6,7 +6,6 @@
 
 #include "src/compiler/pipeline-statistics.h"
 #include "src/compiler/zone-stats.h"
-#include "src/isolate.h"
 #include "src/objects/shared-function-info.h"
 #include "src/objects/string.h"
 #include "src/optimized-compilation-info.h"
@@ -46,11 +45,11 @@ void PipelineStatistics::CommonStats::End(
 }
 
 PipelineStatistics::PipelineStatistics(OptimizedCompilationInfo* info,
-                                       Isolate* isolate, ZoneStats* zone_stats)
-    : isolate_(isolate),
-      outer_zone_(info->zone()),
+                                       CompilationStatistics* compilation_stats,
+                                       ZoneStats* zone_stats)
+    : outer_zone_(info->zone()),
       zone_stats_(zone_stats),
-      compilation_stats_(isolate_->GetTurboStatistics()),
+      compilation_stats_(compilation_stats),
       source_size_(0),
       phase_kind_name_(nullptr),
       phase_name_(nullptr) {
diff --git a/deps/v8/src/compiler/pipeline-statistics.h b/deps/v8/src/compiler/pipeline-statistics.h
index 56467f496a323b..21ef2b02aa4db6 100644
--- a/deps/v8/src/compiler/pipeline-statistics.h
+++ b/deps/v8/src/compiler/pipeline-statistics.h
@@ -20,8 +20,8 @@ class PhaseScope;
 
 class PipelineStatistics : public Malloced {
  public:
-  PipelineStatistics(OptimizedCompilationInfo* info, Isolate* isolate,
-                     ZoneStats* zone_stats);
+  PipelineStatistics(OptimizedCompilationInfo* info,
+                     CompilationStatistics* turbo_stats, ZoneStats* zone_stats);
   ~PipelineStatistics();
 
   void BeginPhaseKind(const char* phase_kind_name);
@@ -56,7 +56,6 @@ class PipelineStatistics : public Malloced {
   void BeginPhase(const char* name);
   void EndPhase();
 
-  Isolate* isolate_;
   Zone* outer_zone_;
   ZoneStats* zone_stats_;
   CompilationStatistics* compilation_stats_;
diff --git a/deps/v8/src/compiler/pipeline.cc b/deps/v8/src/compiler/pipeline.cc
index 795f2c19c38ceb..45ca08199e59d4 100644
--- a/deps/v8/src/compiler/pipeline.cc
+++ b/deps/v8/src/compiler/pipeline.cc
@@ -5,6 +5,7 @@
 #include "src/compiler/pipeline.h"
 
 #include <fstream>  // NOLINT(readability/streams)
+#include <iostream>
 #include <memory>
 #include <sstream>
 
@@ -20,7 +21,9 @@
 #include "src/compiler/checkpoint-elimination.h"
 #include "src/compiler/code-generator.h"
 #include "src/compiler/common-operator-reducer.h"
+#include "src/compiler/compilation-dependencies.h"
 #include "src/compiler/compiler-source-position-table.h"
+#include "src/compiler/constant-folding-reducer.h"
 #include "src/compiler/control-flow-optimizer.h"
 #include "src/compiler/dead-code-elimination.h"
 #include "src/compiler/effect-control-linearizer.h"
@@ -31,11 +34,11 @@
 #include "src/compiler/graph-visualizer.h"
 #include "src/compiler/instruction-selector.h"
 #include "src/compiler/instruction.h"
-#include "src/compiler/js-builtin-reducer.h"
 #include "src/compiler/js-call-reducer.h"
 #include "src/compiler/js-context-specialization.h"
 #include "src/compiler/js-create-lowering.h"
 #include "src/compiler/js-generic-lowering.h"
+#include "src/compiler/js-heap-broker.h"
 #include "src/compiler/js-inlining-heuristic.h"
 #include "src/compiler/js-intrinsic-lowering.h"
 #include "src/compiler/js-native-context-specialization.h"
@@ -50,6 +53,7 @@
 #include "src/compiler/machine-operator-reducer.h"
 #include "src/compiler/memory-optimizer.h"
 #include "src/compiler/move-optimizer.h"
+#include "src/compiler/node-origin-table.h"
 #include "src/compiler/osr.h"
 #include "src/compiler/pipeline-statistics.h"
 #include "src/compiler/redundancy-elimination.h"
@@ -62,17 +66,22 @@
 #include "src/compiler/simplified-operator-reducer.h"
 #include "src/compiler/simplified-operator.h"
 #include "src/compiler/store-store-elimination.h"
+#include "src/compiler/type-narrowing-reducer.h"
 #include "src/compiler/typed-optimization.h"
 #include "src/compiler/typer.h"
 #include "src/compiler/value-numbering-reducer.h"
 #include "src/compiler/verifier.h"
+#include "src/compiler/wasm-compiler.h"
 #include "src/compiler/zone-stats.h"
+#include "src/disassembler.h"
 #include "src/isolate-inl.h"
+#include "src/objects/shared-function-info.h"
 #include "src/optimized-compilation-info.h"
 #include "src/ostreams.h"
 #include "src/parsing/parse-info.h"
 #include "src/register-configuration.h"
 #include "src/utils.h"
+#include "src/wasm/function-body-decoder.h"
 
 namespace v8 {
 namespace internal {
@@ -107,10 +116,14 @@ class PipelineData {
         codegen_zone_scope_(zone_stats_, ZONE_NAME),
         codegen_zone_(codegen_zone_scope_.zone()),
         register_allocation_zone_scope_(zone_stats_, ZONE_NAME),
-        register_allocation_zone_(register_allocation_zone_scope_.zone()) {
+        register_allocation_zone_(register_allocation_zone_scope_.zone()),
+        assembler_options_(AssemblerOptions::Default(isolate)) {
     PhaseScope scope(pipeline_statistics, "init pipeline data");
     graph_ = new (graph_zone_) Graph(graph_zone_);
     source_positions_ = new (graph_zone_) SourcePositionTable(graph_);
+    node_origins_ = info->trace_turbo_json_enabled()
+                        ? new (graph_zone_) NodeOriginTable(graph_)
+                        : nullptr;
     simplified_ = new (graph_zone_) SimplifiedOperatorBuilder(graph_zone_);
     machine_ = new (graph_zone_) MachineOperatorBuilder(
         graph_zone_, MachineType::PointerRepresentation(),
@@ -120,39 +133,49 @@ class PipelineData {
     javascript_ = new (graph_zone_) JSOperatorBuilder(graph_zone_);
     jsgraph_ = new (graph_zone_)
         JSGraph(isolate_, graph_, common_, javascript_, simplified_, machine_);
+    js_heap_broker_ = new (graph_zone_) JSHeapBroker(isolate_);
+    dependencies_ =
+        new (codegen_zone_) CompilationDependencies(isolate_, codegen_zone_);
   }
 
   // For WebAssembly compile entry point.
   PipelineData(ZoneStats* zone_stats, Isolate* isolate,
-               OptimizedCompilationInfo* info, JSGraph* jsgraph,
+               OptimizedCompilationInfo* info, MachineGraph* mcgraph,
                PipelineStatistics* pipeline_statistics,
                SourcePositionTable* source_positions,
-               WasmCompilationData* wasm_compilation_data)
+               NodeOriginTable* node_origins,
+               WasmCompilationData* wasm_compilation_data,
+               int wasm_function_index,
+               const AssemblerOptions& assembler_options)
       : isolate_(isolate),
         info_(info),
         debug_name_(info_->GetDebugName()),
+        wasm_function_index_(wasm_function_index),
         zone_stats_(zone_stats),
         pipeline_statistics_(pipeline_statistics),
         graph_zone_scope_(zone_stats_, ZONE_NAME),
-        graph_(jsgraph->graph()),
+        graph_zone_(graph_zone_scope_.zone()),
+        graph_(mcgraph->graph()),
         source_positions_(source_positions),
-        machine_(jsgraph->machine()),
-        common_(jsgraph->common()),
-        javascript_(jsgraph->javascript()),
-        jsgraph_(jsgraph),
+        node_origins_(node_origins),
+        machine_(mcgraph->machine()),
+        common_(mcgraph->common()),
+        mcgraph_(mcgraph),
         instruction_zone_scope_(zone_stats_, ZONE_NAME),
         instruction_zone_(instruction_zone_scope_.zone()),
         codegen_zone_scope_(zone_stats_, ZONE_NAME),
         codegen_zone_(codegen_zone_scope_.zone()),
         register_allocation_zone_scope_(zone_stats_, ZONE_NAME),
         register_allocation_zone_(register_allocation_zone_scope_.zone()),
-        wasm_compilation_data_(wasm_compilation_data) {}
+        wasm_compilation_data_(wasm_compilation_data),
+        assembler_options_(assembler_options) {}
 
   // For machine graph testing entry point.
   PipelineData(ZoneStats* zone_stats, OptimizedCompilationInfo* info,
                Isolate* isolate, Graph* graph, Schedule* schedule,
                SourcePositionTable* source_positions,
-               JumpOptimizationInfo* jump_opt)
+               NodeOriginTable* node_origins, JumpOptimizationInfo* jump_opt,
+               const AssemblerOptions& assembler_options)
       : isolate_(isolate),
         info_(info),
         debug_name_(info_->GetDebugName()),
@@ -160,6 +183,7 @@ class PipelineData {
         graph_zone_scope_(zone_stats_, ZONE_NAME),
         graph_(graph),
         source_positions_(source_positions),
+        node_origins_(node_origins),
         schedule_(schedule),
         instruction_zone_scope_(zone_stats_, ZONE_NAME),
         instruction_zone_(instruction_zone_scope_.zone()),
@@ -167,7 +191,8 @@ class PipelineData {
         codegen_zone_(codegen_zone_scope_.zone()),
         register_allocation_zone_scope_(zone_stats_, ZONE_NAME),
         register_allocation_zone_(register_allocation_zone_scope_.zone()),
-        jump_optimization_info_(jump_opt) {}
+        jump_optimization_info_(jump_opt),
+        assembler_options_(assembler_options) {}
 
   // For register allocation testing entry point.
   PipelineData(ZoneStats* zone_stats, OptimizedCompilationInfo* info,
@@ -183,7 +208,8 @@ class PipelineData {
         codegen_zone_scope_(zone_stats_, ZONE_NAME),
         codegen_zone_(codegen_zone_scope_.zone()),
         register_allocation_zone_scope_(zone_stats_, ZONE_NAME),
-        register_allocation_zone_(register_allocation_zone_scope_.zone()) {}
+        register_allocation_zone_(register_allocation_zone_scope_.zone()),
+        assembler_options_(AssemblerOptions::Default(isolate)) {}
 
   ~PipelineData() {
     delete code_generator_;  // Must happen before zones are destroyed.
@@ -197,6 +223,7 @@ class PipelineData {
   Isolate* isolate() const { return isolate_; }
   OptimizedCompilationInfo* info() const { return info_; }
   ZoneStats* zone_stats() const { return zone_stats_; }
+  CompilationDependencies* dependencies() const { return dependencies_; }
   PipelineStatistics* pipeline_statistics() { return pipeline_statistics_; }
   OsrHelper* osr_helper() { return &(*osr_helper_); }
   bool compilation_failed() const { return compilation_failed_; }
@@ -205,8 +232,8 @@ class PipelineData {
   bool verify_graph() const { return verify_graph_; }
   void set_verify_graph(bool value) { verify_graph_ = value; }
 
-  Handle<Code> code() { return code_; }
-  void set_code(Handle<Code> code) {
+  MaybeHandle<Code> code() { return code_; }
+  void set_code(MaybeHandle<Code> code) {
     DCHECK(code_.is_null());
     code_ = code;
   }
@@ -219,10 +246,12 @@ class PipelineData {
   Zone* graph_zone() const { return graph_zone_; }
   Graph* graph() const { return graph_; }
   SourcePositionTable* source_positions() const { return source_positions_; }
+  NodeOriginTable* node_origins() const { return node_origins_; }
   MachineOperatorBuilder* machine() const { return machine_; }
   CommonOperatorBuilder* common() const { return common_; }
   JSOperatorBuilder* javascript() const { return javascript_; }
   JSGraph* jsgraph() const { return jsgraph_; }
+  MachineGraph* mcgraph() const { return mcgraph_; }
   Handle<Context> native_context() const {
     return handle(info()->native_context(), isolate());
   }
@@ -230,6 +259,8 @@ class PipelineData {
     return handle(info()->global_object(), isolate());
   }
 
+  JSHeapBroker* js_heap_broker() const { return js_heap_broker_; }
+
   Schedule* schedule() const { return schedule_; }
   void set_schedule(Schedule* schedule) {
     DCHECK(!schedule_);
@@ -269,11 +300,13 @@ class PipelineData {
     graph_zone_ = nullptr;
     graph_ = nullptr;
     source_positions_ = nullptr;
+    node_origins_ = nullptr;
     simplified_ = nullptr;
     machine_ = nullptr;
     common_ = nullptr;
     javascript_ = nullptr;
     jsgraph_ = nullptr;
+    mcgraph_ = nullptr;
     schedule_ = nullptr;
   }
 
@@ -288,6 +321,7 @@ class PipelineData {
     if (codegen_zone_ == nullptr) return;
     codegen_zone_scope_.Destroy();
     codegen_zone_ = nullptr;
+    dependencies_ = nullptr;
     frame_ = nullptr;
   }
 
@@ -343,19 +377,11 @@ class PipelineData {
   void InitializeCodeGenerator(Linkage* linkage) {
     DCHECK_NULL(code_generator_);
 
-    CodeGeneratorPoisoningLevel poisoning =
-        CodeGeneratorPoisoningLevel::kDontPoison;
-    if (info()->has_untrusted_code_mitigations()) {
-      poisoning = CodeGeneratorPoisoningLevel::kPoisonStackPointerInPrologue;
-    }
-    if (info()->is_poison_loads()) {
-      poisoning = CodeGeneratorPoisoningLevel::kPoisonAll;
-    }
-
     code_generator_ = new CodeGenerator(
         codegen_zone(), frame(), linkage, sequence(), info(), isolate(),
         osr_helper_, start_source_position_, jump_optimization_info_,
-        wasm_compilation_data_, poisoning);
+        wasm_compilation_data_, info()->GetPoisoningMitigationLevel(),
+        assembler_options_, info_->builtin_index());
   }
 
   void BeginPhaseKind(const char* phase_kind_name) {
@@ -372,10 +398,17 @@ class PipelineData {
 
   const char* debug_name() const { return debug_name_.get(); }
 
+  WasmCompilationData* wasm_compilation_data() const {
+    return wasm_compilation_data_;
+  }
+
+  int wasm_function_index() const { return wasm_function_index_; }
+
  private:
   Isolate* const isolate_;
   OptimizedCompilationInfo* const info_;
   std::unique_ptr<char[]> debug_name_;
+  int wasm_function_index_ = -1;
   bool may_have_unverifiable_graph_ = true;
   ZoneStats* const zone_stats_;
   PipelineStatistics* pipeline_statistics_ = nullptr;
@@ -383,7 +416,7 @@ class PipelineData {
   bool verify_graph_ = false;
   int start_source_position_ = kNoSourcePosition;
   base::Optional<OsrHelper> osr_helper_;
-  Handle<Code> code_ = Handle<Code>::null();
+  MaybeHandle<Code> code_;
   CodeGenerator* code_generator_ = nullptr;
 
   // All objects in the following group of fields are allocated in graph_zone_.
@@ -392,12 +425,15 @@ class PipelineData {
   Zone* graph_zone_ = nullptr;
   Graph* graph_ = nullptr;
   SourcePositionTable* source_positions_ = nullptr;
+  NodeOriginTable* node_origins_ = nullptr;
   SimplifiedOperatorBuilder* simplified_ = nullptr;
   MachineOperatorBuilder* machine_ = nullptr;
   CommonOperatorBuilder* common_ = nullptr;
   JSOperatorBuilder* javascript_ = nullptr;
   JSGraph* jsgraph_ = nullptr;
+  MachineGraph* mcgraph_ = nullptr;
   Schedule* schedule_ = nullptr;
+  JSHeapBroker* js_heap_broker_ = nullptr;
 
   // All objects in the following group of fields are allocated in
   // instruction_zone_. They are all set to nullptr when the instruction_zone_
@@ -411,6 +447,7 @@ class PipelineData {
   // is destroyed.
   ZoneStats::Scope codegen_zone_scope_;
   Zone* codegen_zone_;
+  CompilationDependencies* dependencies_ = nullptr;
   Frame* frame_ = nullptr;
 
   // All objects in the following group of fields are allocated in
@@ -429,6 +466,7 @@ class PipelineData {
   WasmCompilationData* wasm_compilation_data_ = nullptr;
 
   JumpOptimizationInfo* jump_optimization_info_ = nullptr;
+  AssemblerOptions assembler_options_;
 
   DISALLOW_COPY_AND_ASSIGN(PipelineData);
 };
@@ -461,10 +499,14 @@ class PipelineImpl final {
   void AssembleCode(Linkage* linkage);
 
   // Step D. Run the code finalization pass.
-  Handle<Code> FinalizeCode();
+  MaybeHandle<Code> FinalizeCode();
+
+  // Step E. Install any code dependencies.
+  bool CommitDependencies(Handle<Code> code);
 
+  void VerifyGeneratedCodeIsIdempotent();
   void RunPrintAndVerify(const char* phase, bool untyped = false);
-  Handle<Code> GenerateCode(CallDescriptor* call_descriptor);
+  MaybeHandle<Code> GenerateCode(CallDescriptor* call_descriptor);
   void AllocateRegisters(const RegisterConfiguration* config,
                          CallDescriptor* call_descriptor, bool run_verifier);
 
@@ -476,24 +518,8 @@ class PipelineImpl final {
 
 namespace {
 
-// Print function's source if it was not printed before.
-// Return a sequential id under which this function was printed.
-int PrintFunctionSource(OptimizedCompilationInfo* info, Isolate* isolate,
-                        std::vector<Handle<SharedFunctionInfo>>* printed,
-                        int inlining_id, Handle<SharedFunctionInfo> shared) {
-  // Outermost function has source id -1 and inlined functions take
-  // source ids starting from 0.
-  int source_id = -1;
-  if (inlining_id != SourcePosition::kNotInlined) {
-    for (unsigned i = 0; i < printed->size(); i++) {
-      if (printed->at(i).is_identical_to(shared)) {
-        return i;
-      }
-    }
-    source_id = static_cast<int>(printed->size());
-    printed->push_back(shared);
-  }
-
+void PrintFunctionSource(OptimizedCompilationInfo* info, Isolate* isolate,
+                         int source_id, Handle<SharedFunctionInfo> shared) {
   if (!shared->script()->IsUndefined(isolate)) {
     Handle<Script> script(Script::cast(shared->script()), isolate);
 
@@ -522,8 +548,6 @@ int PrintFunctionSource(OptimizedCompilationInfo* info, Isolate* isolate,
       os << "\n--- END ---\n";
     }
   }
-
-  return source_id;
 }
 
 // Print information for the given inlining: which function was inlined and
@@ -547,38 +571,36 @@ void PrintInlinedFunctionInfo(
 
 // Print the source of all functions that participated in this optimizing
 // compilation. For inlined functions print source position of their inlining.
-void DumpParticipatingSource(OptimizedCompilationInfo* info, Isolate* isolate) {
+void PrintParticipatingSource(OptimizedCompilationInfo* info,
+                              Isolate* isolate) {
   AllowDeferredHandleDereference allow_deference_for_print_code;
 
-  std::vector<Handle<SharedFunctionInfo>> printed;
-  printed.reserve(info->inlined_functions().size());
-
-  PrintFunctionSource(info, isolate, &printed, SourcePosition::kNotInlined,
-                      info->shared_info());
+  SourceIdAssigner id_assigner(info->inlined_functions().size());
+  PrintFunctionSource(info, isolate, -1, info->shared_info());
   const auto& inlined = info->inlined_functions();
   for (unsigned id = 0; id < inlined.size(); id++) {
-    const int source_id = PrintFunctionSource(info, isolate, &printed, id,
-                                              inlined[id].shared_info);
+    const int source_id = id_assigner.GetIdFor(inlined[id].shared_info);
+    PrintFunctionSource(info, isolate, source_id, inlined[id].shared_info);
     PrintInlinedFunctionInfo(info, isolate, source_id, id, inlined[id]);
   }
 }
 
 // Print the code after compiling it.
-void PrintCode(Handle<Code> code, OptimizedCompilationInfo* info) {
-  Isolate* isolate = code->GetIsolate();
+void PrintCode(Isolate* isolate, Handle<Code> code,
+               OptimizedCompilationInfo* info) {
   if (FLAG_print_opt_source && info->IsOptimizing()) {
-    DumpParticipatingSource(info, isolate);
+    PrintParticipatingSource(info, isolate);
   }
 
 #ifdef ENABLE_DISASSEMBLER
   AllowDeferredHandleDereference allow_deference_for_print_code;
   bool print_code =
       isolate->bootstrapper()->IsActive()
-          ? FLAG_print_builtin_code
+          ? FLAG_print_builtin_code && info->shared_info()->PassesFilter(
+                                           FLAG_print_builtin_code_filter)
           : (FLAG_print_code || (info->IsStub() && FLAG_print_code_stubs) ||
              (info->IsOptimizing() && FLAG_print_opt_code &&
-              info->shared_info()->PassesFilter(FLAG_print_opt_code_filter)) ||
-             (info->IsWasm() && FLAG_print_wasm_code));
+              info->shared_info()->PassesFilter(FLAG_print_opt_code_filter)));
   if (print_code) {
     std::unique_ptr<char[]> debug_name = info->GetDebugName();
     CodeTracer::Scope tracing_scope(isolate->GetCodeTracer());
@@ -627,18 +649,13 @@ struct TurboCfgFile : public std::ofstream {
                       std::ios_base::app) {}
 };
 
-struct TurboJsonFile : public std::ofstream {
-  TurboJsonFile(OptimizedCompilationInfo* info, std::ios_base::openmode mode)
-      : std::ofstream(GetVisualizerLogFileName(info, nullptr, "json").get(),
-                      mode) {}
-};
-
 void TraceSchedule(OptimizedCompilationInfo* info, Isolate* isolate,
-                   Schedule* schedule) {
-  if (FLAG_trace_turbo) {
+                   Schedule* schedule, const char* phase_name) {
+  if (info->trace_turbo_json_enabled()) {
     AllowHandleDereference allow_deref;
     TurboJsonFile json_of(info, std::ios_base::app);
-    json_of << "{\"name\":\"Schedule\",\"type\":\"schedule\",\"data\":\"";
+    json_of << "{\"name\":\"" << phase_name << "\",\"type\":\"schedule\""
+            << ",\"data\":\"";
     std::stringstream schedule_stream;
     schedule_stream << *schedule;
     std::string schedule_string(schedule_stream.str());
@@ -647,7 +664,7 @@ void TraceSchedule(OptimizedCompilationInfo* info, Isolate* isolate,
     }
     json_of << "\"},\n";
   }
-  if (FLAG_trace_turbo_graph || FLAG_trace_turbo_scheduler) {
+  if (info->trace_turbo_graph_enabled() || FLAG_trace_turbo_scheduler) {
     AllowHandleDereference allow_deref;
     CodeTracer::Scope tracing_scope(isolate->GetCodeTracer());
     OFStream os(tracing_scope.file());
@@ -679,14 +696,27 @@ class SourcePositionWrapper final : public Reducer {
   DISALLOW_COPY_AND_ASSIGN(SourcePositionWrapper);
 };
 
-
-class JSGraphReducer final : public GraphReducer {
+class NodeOriginsWrapper final : public Reducer {
  public:
-  JSGraphReducer(JSGraph* jsgraph, Zone* zone)
-      : GraphReducer(zone, jsgraph->graph(), jsgraph->Dead()) {}
-  ~JSGraphReducer() final {}
-};
+  NodeOriginsWrapper(Reducer* reducer, NodeOriginTable* table)
+      : reducer_(reducer), table_(table) {}
+  ~NodeOriginsWrapper() final {}
+
+  const char* reducer_name() const override { return reducer_->reducer_name(); }
+
+  Reduction Reduce(Node* node) final {
+    NodeOriginTable::Scope position(table_, reducer_name(), node);
+    return reducer_->Reduce(node);
+  }
+
+  void Finalize() final { reducer_->Finalize(); }
+
+ private:
+  Reducer* const reducer_;
+  NodeOriginTable* const table_;
 
+  DISALLOW_COPY_AND_ASSIGN(NodeOriginsWrapper);
+};
 
 void AddReducer(PipelineData* data, GraphReducer* graph_reducer,
                 Reducer* reducer) {
@@ -694,12 +724,17 @@ void AddReducer(PipelineData* data, GraphReducer* graph_reducer,
     void* const buffer = data->graph_zone()->New(sizeof(SourcePositionWrapper));
     SourcePositionWrapper* const wrapper =
         new (buffer) SourcePositionWrapper(reducer, data->source_positions());
-    graph_reducer->AddReducer(wrapper);
-  } else {
-    graph_reducer->AddReducer(reducer);
+    reducer = wrapper;
+  }
+  if (data->info()->trace_turbo_json_enabled()) {
+    void* const buffer = data->graph_zone()->New(sizeof(NodeOriginsWrapper));
+    NodeOriginsWrapper* const wrapper =
+        new (buffer) NodeOriginsWrapper(reducer, data->node_origins());
+    reducer = wrapper;
   }
-}
 
+  graph_reducer->AddReducer(reducer);
+}
 
 class PipelineRunScope {
  public:
@@ -707,13 +742,15 @@ class PipelineRunScope {
       : phase_scope_(
             phase_name == nullptr ? nullptr : data->pipeline_statistics(),
             phase_name),
-        zone_scope_(data->zone_stats(), ZONE_NAME) {}
+        zone_scope_(data->zone_stats(), ZONE_NAME),
+        origin_scope_(data->node_origins(), phase_name) {}
 
   Zone* zone() { return zone_scope_.zone(); }
 
  private:
   PhaseScope phase_scope_;
   ZoneStats::Scope zone_scope_;
+  NodeOriginTable::PhaseScope origin_scope_;
 };
 
 PipelineStatistics* CreatePipelineStatistics(Handle<Script> script,
@@ -723,26 +760,57 @@ PipelineStatistics* CreatePipelineStatistics(Handle<Script> script,
   PipelineStatistics* pipeline_statistics = nullptr;
 
   if (FLAG_turbo_stats || FLAG_turbo_stats_nvp) {
-    pipeline_statistics = new PipelineStatistics(info, isolate, zone_stats);
+    pipeline_statistics =
+        new PipelineStatistics(info, isolate->GetTurboStatistics(), zone_stats);
     pipeline_statistics->BeginPhaseKind("initializing");
   }
 
-  if (FLAG_trace_turbo) {
+  if (info->trace_turbo_json_enabled()) {
+    TurboJsonFile json_of(info, std::ios_base::trunc);
+    json_of << "{\"function\" : ";
+    JsonPrintFunctionSource(json_of, -1, info->GetDebugName(), script, isolate,
+                            info->shared_info());
+    json_of << ",\n\"phases\":[";
+  }
+
+  return pipeline_statistics;
+}
+
+PipelineStatistics* CreatePipelineStatistics(wasm::WasmEngine* wasm_engine,
+                                             wasm::FunctionBody function_body,
+                                             wasm::WasmModule* wasm_module,
+                                             OptimizedCompilationInfo* info,
+                                             ZoneStats* zone_stats) {
+  PipelineStatistics* pipeline_statistics = nullptr;
+
+  if (FLAG_turbo_stats_wasm) {
+    pipeline_statistics = new PipelineStatistics(
+        info, wasm_engine->GetOrCreateTurboStatistics(), zone_stats);
+    pipeline_statistics->BeginPhaseKind("initializing");
+  }
+
+  if (info->trace_turbo_json_enabled()) {
     TurboJsonFile json_of(info, std::ios_base::trunc);
     std::unique_ptr<char[]> function_name = info->GetDebugName();
-    int pos = info->IsStub() ? 0 : info->shared_info()->StartPosition();
-    json_of << "{\"function\":\"" << function_name.get()
-            << "\", \"sourcePosition\":" << pos << ", \"source\":\"";
-    if (!script.is_null() && !script->source()->IsUndefined(isolate)) {
-      DisallowHeapAllocation no_allocation;
-      int start = info->shared_info()->StartPosition();
-      int len = info->shared_info()->EndPosition() - start;
-      String::SubStringRange source(String::cast(script->source()), start, len);
-      for (const auto& c : source) {
-        json_of << AsEscapedUC16ForJSON(c);
+    json_of << "{\"function\":\"" << function_name.get() << "\", \"source\":\"";
+    AccountingAllocator allocator;
+    std::ostringstream disassembly;
+    std::vector<int> source_positions;
+    wasm::PrintRawWasmCode(&allocator, function_body, wasm_module,
+                           wasm::kPrintLocals, disassembly, &source_positions);
+    for (const auto& c : disassembly.str()) {
+      json_of << AsEscapedUC16ForJSON(c);
+    }
+    json_of << "\",\n\"sourceLineToBytecodePosition\" : [";
+    bool insert_comma = false;
+    for (auto val : source_positions) {
+      if (insert_comma) {
+        json_of << ", ";
       }
+      json_of << val;
+      insert_comma = true;
     }
-    json_of << "\",\n\"phases\":[";
+    json_of << "],\n\"phases\":[";
   }
 
   return pipeline_statistics;
@@ -752,7 +820,8 @@ PipelineStatistics* CreatePipelineStatistics(Handle<Script> script,
 
 class PipelineCompilationJob final : public OptimizedCompilationJob {
  public:
-  PipelineCompilationJob(Handle<SharedFunctionInfo> shared_info,
+  PipelineCompilationJob(Isolate* isolate,
+                         Handle<SharedFunctionInfo> shared_info,
                          Handle<JSFunction> function)
       // Note that the OptimizedCompilationInfo is not initialized at the time
       // we pass it to the CompilationJob constructor, but it is not
@@ -765,8 +834,8 @@ class PipelineCompilationJob final : public OptimizedCompilationJob {
         compilation_info_(&zone_, function->GetIsolate(), shared_info,
                           function),
         pipeline_statistics_(CreatePipelineStatistics(
-            handle(Script::cast(shared_info->script())), compilation_info(),
-            function->GetIsolate(), &zone_stats_)),
+            handle(Script::cast(shared_info->script()), isolate),
+            compilation_info(), function->GetIsolate(), &zone_stats_)),
         data_(&zone_stats_, function->GetIsolate(), compilation_info(),
               pipeline_statistics_.get()),
         pipeline_(&data_),
@@ -811,14 +880,23 @@ PipelineCompilationJob::Status PipelineCompilationJob::PrepareJobImpl(
   if (FLAG_inline_accessors) {
     compilation_info()->MarkAsAccessorInliningEnabled();
   }
+
+  // Compute and set poisoning level.
+  PoisoningMitigationLevel load_poisoning =
+      PoisoningMitigationLevel::kDontPoison;
   if (FLAG_branch_load_poisoning) {
-    compilation_info()->MarkAsPoisonLoads();
+    load_poisoning = PoisoningMitigationLevel::kPoisonAll;
+  } else if (FLAG_untrusted_code_mitigations) {
+    load_poisoning = PoisoningMitigationLevel::kPoisonCriticalOnly;
   }
+  compilation_info()->SetPoisoningMitigationLevel(load_poisoning);
+
   if (FLAG_turbo_allocation_folding) {
     compilation_info()->MarkAsAllocationFoldingEnabled();
   }
+
   if (compilation_info()->closure()->feedback_cell()->map() ==
-      isolate->heap()->one_closure_cell_map()) {
+      ReadOnlyRoots(isolate).one_closure_cell_map()) {
     compilation_info()->MarkAsFunctionContextSpecializing();
   }
 
@@ -851,16 +929,19 @@ PipelineCompilationJob::Status PipelineCompilationJob::ExecuteJobImpl() {
 
 PipelineCompilationJob::Status PipelineCompilationJob::FinalizeJobImpl(
     Isolate* isolate) {
-  Handle<Code> code = pipeline_.FinalizeCode();
-  if (code.is_null()) {
+  MaybeHandle<Code> maybe_code = pipeline_.FinalizeCode();
+  Handle<Code> code;
+  if (!maybe_code.ToHandle(&code)) {
     if (compilation_info()->bailout_reason() == BailoutReason::kNoReason) {
       return AbortOptimization(BailoutReason::kCodeGenerationFailed);
     }
     return FAILED;
   }
-  compilation_info()->dependencies()->Commit(code);
-  compilation_info()->SetCode(code);
+  if (!pipeline_.CommitDependencies(code)) {
+    return RetryOptimization(BailoutReason::kBailedOutDueToDependencyChange);
+  }
 
+  compilation_info()->SetCode(code);
   compilation_info()->context()->native_context()->AddOptimizedCode(*code);
   RegisterWeakObjectsInOptimizedCode(code, isolate);
   return SUCCEEDED;
@@ -894,18 +975,23 @@ void PipelineCompilationJob::RegisterWeakObjectsInOptimizedCode(
 class PipelineWasmCompilationJob final : public OptimizedCompilationJob {
  public:
   explicit PipelineWasmCompilationJob(
-      OptimizedCompilationInfo* info, Isolate* isolate, JSGraph* jsgraph,
-      CallDescriptor* call_descriptor, SourcePositionTable* source_positions,
-      WasmCompilationData* wasm_compilation_data, bool asmjs_origin)
+      OptimizedCompilationInfo* info, wasm::WasmEngine* wasm_engine,
+      Isolate* isolate, MachineGraph* mcgraph, CallDescriptor* call_descriptor,
+      SourcePositionTable* source_positions, NodeOriginTable* node_origins,
+      WasmCompilationData* wasm_compilation_data,
+      wasm::FunctionBody function_body, wasm::WasmModule* wasm_module,
+      wasm::NativeModule* native_module, int function_index, bool asmjs_origin)
       : OptimizedCompilationJob(isolate->stack_guard()->real_climit(), info,
                                 "TurboFan", State::kReadyToExecute),
         zone_stats_(isolate->allocator()),
         pipeline_statistics_(CreatePipelineStatistics(
-            Handle<Script>::null(), info, isolate, &zone_stats_)),
-        data_(&zone_stats_, isolate, info, jsgraph, pipeline_statistics_.get(),
-              source_positions, wasm_compilation_data),
+            wasm_engine, function_body, wasm_module, info, &zone_stats_)),
+        data_(&zone_stats_, isolate, info, mcgraph, pipeline_statistics_.get(),
+              source_positions, node_origins, wasm_compilation_data,
+              function_index, WasmAssemblerOptions(isolate)),
         pipeline_(&data_),
         linkage_(call_descriptor),
+        native_module_(native_module),
         asmjs_origin_(asmjs_origin) {}
 
  protected:
@@ -916,17 +1002,12 @@ class PipelineWasmCompilationJob final : public OptimizedCompilationJob {
  private:
   size_t AllocatedMemory() const override;
 
-  // Temporary regression check while we get the wasm code off the GC heap, and
-  // until we decontextualize wasm code.
-  // We expect the only embedded objects to be: CEntryStub, undefined, and
-  // the various builtins for throwing exceptions like OOB.
-  void ValidateImmovableEmbeddedObjects() const;
-
   ZoneStats zone_stats_;
   std::unique_ptr<PipelineStatistics> pipeline_statistics_;
   PipelineData data_;
   PipelineImpl pipeline_;
   Linkage linkage_;
+  wasm::NativeModule* native_module_;
   bool asmjs_origin_;
 };
 
@@ -938,30 +1019,38 @@ PipelineWasmCompilationJob::Status PipelineWasmCompilationJob::PrepareJobImpl(
 
 PipelineWasmCompilationJob::Status
 PipelineWasmCompilationJob::ExecuteJobImpl() {
-  if (FLAG_trace_turbo) {
-    TurboJsonFile json_of(compilation_info(), std::ios_base::trunc);
-    json_of << "{\"function\":\"" << compilation_info()->GetDebugName().get()
-            << "\", \"source\":\"\",\n\"phases\":[";
-  }
-
   pipeline_.RunPrintAndVerify("Machine", true);
+
+  PipelineData* data = &data_;
+  data->BeginPhaseKind("wasm optimization");
   if (FLAG_wasm_opt || asmjs_origin_) {
-    PipelineData* data = &data_;
-    PipelineRunScope scope(data, "Wasm optimization");
-    JSGraphReducer graph_reducer(data->jsgraph(), scope.zone());
+    PipelineRunScope scope(data, "wasm full optimization");
+    GraphReducer graph_reducer(scope.zone(), data->graph(),
+                               data->mcgraph()->Dead());
     DeadCodeElimination dead_code_elimination(&graph_reducer, data->graph(),
                                               data->common(), scope.zone());
     ValueNumberingReducer value_numbering(scope.zone(), data->graph()->zone());
-    MachineOperatorReducer machine_reducer(data->jsgraph(), asmjs_origin_);
+    MachineOperatorReducer machine_reducer(data->mcgraph(), asmjs_origin_);
     CommonOperatorReducer common_reducer(&graph_reducer, data->graph(),
-                                         data->common(), data->machine(),
-                                         scope.zone());
+                                         data->js_heap_broker(), data->common(),
+                                         data->machine(), scope.zone());
     AddReducer(data, &graph_reducer, &dead_code_elimination);
     AddReducer(data, &graph_reducer, &machine_reducer);
     AddReducer(data, &graph_reducer, &common_reducer);
     AddReducer(data, &graph_reducer, &value_numbering);
     graph_reducer.ReduceGraph();
-    pipeline_.RunPrintAndVerify("Optimized Machine", true);
+  } else {
+    PipelineRunScope scope(data, "wasm base optimization");
+    GraphReducer graph_reducer(scope.zone(), data->graph(),
+                               data->mcgraph()->Dead());
+    ValueNumberingReducer value_numbering(scope.zone(), data->graph()->zone());
+    AddReducer(data, &graph_reducer, &value_numbering);
+    graph_reducer.ReduceGraph();
+  }
+  pipeline_.RunPrintAndVerify("wasm optimization", true);
+
+  if (data_.node_origins()) {
+    data_.node_origins()->RemoveDecorator();
   }
 
   pipeline_.ComputeScheduledGraph();
@@ -977,62 +1066,39 @@ size_t PipelineWasmCompilationJob::AllocatedMemory() const {
 PipelineWasmCompilationJob::Status PipelineWasmCompilationJob::FinalizeJobImpl(
     Isolate* isolate) {
   CodeGenerator* code_generator = pipeline_.data_->code_generator();
-  OptimizedCompilationInfo::WasmCodeDesc* wasm_code_desc =
-      compilation_info()->wasm_code_desc();
-  code_generator->tasm()->GetCode(isolate, &wasm_code_desc->code_desc);
-  wasm_code_desc->safepoint_table_offset =
-      code_generator->GetSafepointTableOffset();
-  wasm_code_desc->handler_table_offset =
-      code_generator->GetHandlerTableOffset();
-  wasm_code_desc->frame_slot_count =
-      code_generator->frame()->GetTotalFrameSlotCount();
-  wasm_code_desc->source_positions_table =
-      code_generator->GetSourcePositionTable();
-  return SUCCEEDED;
-}
+  CodeDesc code_desc;
+  code_generator->tasm()->GetCode(isolate, &code_desc);
 
-void PipelineWasmCompilationJob::ValidateImmovableEmbeddedObjects() const {
-#if DEBUG
-  // We expect the only embedded objects to be those originating from
-  // a snapshot, which are immovable.
-  DisallowHeapAllocation no_gc;
-  Handle<Code> result = pipeline_.data_->code();
-  if (result.is_null()) return;
-  // TODO(aseemgarg): remove this restriction when
-  // wasm-to-js is also internally immovable to include WASM_TO_JS
-  if (result->kind() != Code::WASM_FUNCTION) return;
-  static const int kAllGCRefs = (1 << (RelocInfo::LAST_GCED_ENUM + 1)) - 1;
-  for (RelocIterator it(*result, kAllGCRefs); !it.done(); it.next()) {
-    RelocInfo::Mode mode = it.rinfo()->rmode();
-    Object* target = nullptr;
-    switch (mode) {
-      case RelocInfo::CODE_TARGET:
-        // this would be either one of the stubs or builtins, because
-        // we didn't link yet.
-        target = Code::GetCodeFromTargetAddress(it.rinfo()->target_address());
-        break;
-      case RelocInfo::EMBEDDED_OBJECT:
-        target = it.rinfo()->target_object();
-        break;
-      default:
-        UNREACHABLE();
-    }
-    CHECK_NOT_NULL(target);
-    bool is_immovable =
-        target->IsSmi() || Heap::IsImmovable(HeapObject::cast(target));
-    bool is_wasm = target->IsCode() &&
-                   (Code::cast(target)->kind() == Code::WASM_FUNCTION ||
-                    Code::cast(target)->kind() == Code::WASM_TO_JS_FUNCTION);
-    bool is_allowed_stub = false;
-    if (target->IsCode()) {
-      Code* code = Code::cast(target);
-      is_allowed_stub =
-          code->kind() == Code::STUB &&
-          CodeStub::MajorKeyFromKey(code->stub_key()) == CodeStub::DoubleToI;
+  wasm::WasmCode* code = native_module_->AddCode(
+      data_.wasm_function_index(), code_desc,
+      code_generator->frame()->GetTotalFrameSlotCount(),
+      code_generator->GetSafepointTableOffset(),
+      code_generator->GetHandlerTableOffset(),
+      data_.wasm_compilation_data()->GetProtectedInstructions(),
+      code_generator->GetSourcePositionTable(), wasm::WasmCode::kTurbofan);
+
+  if (!code) return FAILED;
+
+  if (data_.info()->trace_turbo_json_enabled()) {
+    TurboJsonFile json_of(data_.info(), std::ios_base::app);
+    json_of << "{\"name\":\"disassembly\",\"type\":\"disassembly\",\"data\":\"";
+#ifdef ENABLE_DISASSEMBLER
+    std::stringstream disassembler_stream;
+    Disassembler::Decode(
+        isolate, &disassembler_stream, code->instructions().start(),
+        code->instructions().start() + code->safepoint_table_offset(),
+        CodeReference(code));
+    for (auto const c : disassembler_stream.str()) {
+      json_of << AsEscapedUC16ForJSON(c);
     }
-    CHECK(is_immovable || is_wasm || is_allowed_stub);
+#endif  // ENABLE_DISASSEMBLER
+    json_of << "\"}\n]";
+    json_of << "\n}";
   }
-#endif
+
+  compilation_info()->SetCode(code);
+
+  return SUCCEEDED;
 }
 
 template <typename Phase>
@@ -1057,7 +1123,7 @@ void PipelineImpl::Run(Arg0 arg_0, Arg1 arg_1) {
 }
 
 struct GraphBuilderPhase {
-  static const char* phase_name() { return "graph builder"; }
+  static const char* phase_name() { return "bytecode graph builder"; }
 
   void Run(PipelineData* data, Zone* temp_zone) {
     JSTypeHintLowering::Flags flags = JSTypeHintLowering::kNoFlags;
@@ -1066,7 +1132,7 @@ struct GraphBuilderPhase {
     }
     BytecodeGraphBuilder graph_builder(
         temp_zone, data->info()->shared_info(),
-        handle(data->info()->closure()->feedback_vector()),
+        handle(data->info()->closure()->feedback_vector(), data->isolate()),
         data->info()->osr_offset(), data->jsgraph(), CallFrequency(1.0f),
         data->source_positions(), data->native_context(),
         SourcePosition::kNotInlined, flags, true,
@@ -1082,7 +1148,8 @@ Maybe<OuterContext> GetModuleContext(Handle<JSFunction> closure) {
   size_t distance = 0;
   while (!current->IsNativeContext()) {
     if (current->IsModuleContext()) {
-      return Just(OuterContext(handle(current), distance));
+      return Just(
+          OuterContext(handle(current, current->GetIsolate()), distance));
     }
     current = current->previous();
     distance++;
@@ -1091,10 +1158,10 @@ Maybe<OuterContext> GetModuleContext(Handle<JSFunction> closure) {
 }
 
 Maybe<OuterContext> ChooseSpecializationContext(
-    OptimizedCompilationInfo* info) {
+    Isolate* isolate, OptimizedCompilationInfo* info) {
   if (info->is_function_context_specializing()) {
     DCHECK(info->has_context());
-    return Just(OuterContext(handle(info->context()), 0));
+    return Just(OuterContext(handle(info->context(), isolate), 0));
   }
   return GetModuleContext(info->closure());
 }
@@ -1105,22 +1172,24 @@ struct InliningPhase {
   static const char* phase_name() { return "inlining"; }
 
   void Run(PipelineData* data, Zone* temp_zone) {
-    JSGraphReducer graph_reducer(data->jsgraph(), temp_zone);
+    Isolate* isolate = data->isolate();
+    GraphReducer graph_reducer(temp_zone, data->graph(),
+                               data->jsgraph()->Dead());
     DeadCodeElimination dead_code_elimination(&graph_reducer, data->graph(),
                                               data->common(), temp_zone);
     CheckpointElimination checkpoint_elimination(&graph_reducer);
     CommonOperatorReducer common_reducer(&graph_reducer, data->graph(),
-                                         data->common(), data->machine(),
-                                         temp_zone);
+                                         data->js_heap_broker(), data->common(),
+                                         data->machine(), temp_zone);
     JSCallReducer call_reducer(&graph_reducer, data->jsgraph(),
+                               data->js_heap_broker(),
                                data->info()->is_bailout_on_uninitialized()
                                    ? JSCallReducer::kBailoutOnUninitialized
                                    : JSCallReducer::kNoFlags,
-                               data->native_context(),
-                               data->info()->dependencies());
+                               data->native_context(), data->dependencies());
     JSContextSpecialization context_specialization(
-        &graph_reducer, data->jsgraph(),
-        ChooseSpecializationContext(data->info()),
+        &graph_reducer, data->jsgraph(), data->js_heap_broker(),
+        ChooseSpecializationContext(isolate, data->info()),
         data->info()->is_function_context_specializing()
             ? data->info()->closure()
             : MaybeHandle<JSFunction>());
@@ -1133,8 +1202,8 @@ struct InliningPhase {
       flags |= JSNativeContextSpecialization::kBailoutOnUninitialized;
     }
     JSNativeContextSpecialization native_context_specialization(
-        &graph_reducer, data->jsgraph(), flags, data->native_context(),
-        data->info()->dependencies(), temp_zone);
+        &graph_reducer, data->jsgraph(), data->js_heap_broker(), flags,
+        data->native_context(), data->dependencies(), temp_zone);
     JSInliningHeuristic inlining(
         &graph_reducer, data->info()->is_inlining_enabled()
                             ? JSInliningHeuristic::kGeneralInlining
@@ -1189,7 +1258,8 @@ struct UntyperPhase {
       NodeProperties::RemoveType(node);
     }
 
-    JSGraphReducer graph_reducer(data->jsgraph(), temp_zone);
+    GraphReducer graph_reducer(temp_zone, data->graph(),
+                               data->jsgraph()->Dead());
     RemoveTypeReducer remove_type_reducer;
     AddReducer(data, &graph_reducer, &remove_type_reducer);
     graph_reducer.ReduceGraph();
@@ -1200,26 +1270,29 @@ struct TypedLoweringPhase {
   static const char* phase_name() { return "typed lowering"; }
 
   void Run(PipelineData* data, Zone* temp_zone) {
-    JSGraphReducer graph_reducer(data->jsgraph(), temp_zone);
+    GraphReducer graph_reducer(temp_zone, data->graph(),
+                               data->jsgraph()->Dead());
     DeadCodeElimination dead_code_elimination(&graph_reducer, data->graph(),
                                               data->common(), temp_zone);
-    JSBuiltinReducer builtin_reducer(
-        &graph_reducer, data->jsgraph(),
-        data->info()->dependencies(), data->native_context());
-    JSCreateLowering create_lowering(
-        &graph_reducer, data->info()->dependencies(), data->jsgraph(),
-        data->native_context(), temp_zone);
-    JSTypedLowering typed_lowering(&graph_reducer, data->jsgraph(), temp_zone);
-    TypedOptimization typed_optimization(
-        &graph_reducer, data->info()->dependencies(), data->jsgraph());
-    SimplifiedOperatorReducer simple_reducer(&graph_reducer, data->jsgraph());
+    JSCreateLowering create_lowering(&graph_reducer, data->dependencies(),
+                                     data->jsgraph(), data->js_heap_broker(),
+                                     data->native_context(), temp_zone);
+    JSTypedLowering typed_lowering(&graph_reducer, data->jsgraph(),
+                                   data->js_heap_broker(), temp_zone);
+    ConstantFoldingReducer constant_folding_reducer(
+        &graph_reducer, data->jsgraph(), data->js_heap_broker());
+    TypedOptimization typed_optimization(&graph_reducer, data->dependencies(),
+                                         data->jsgraph(),
+                                         data->js_heap_broker());
+    SimplifiedOperatorReducer simple_reducer(&graph_reducer, data->jsgraph(),
+                                             data->js_heap_broker());
     CheckpointElimination checkpoint_elimination(&graph_reducer);
     CommonOperatorReducer common_reducer(&graph_reducer, data->graph(),
-                                         data->common(), data->machine(),
-                                         temp_zone);
+                                         data->js_heap_broker(), data->common(),
+                                         data->machine(), temp_zone);
     AddReducer(data, &graph_reducer, &dead_code_elimination);
-    AddReducer(data, &graph_reducer, &builtin_reducer);
     AddReducer(data, &graph_reducer, &create_lowering);
+    AddReducer(data, &graph_reducer, &constant_folding_reducer);
     AddReducer(data, &graph_reducer, &typed_optimization);
     AddReducer(data, &graph_reducer, &typed_lowering);
     AddReducer(data, &graph_reducer, &simple_reducer);
@@ -1236,7 +1309,7 @@ struct EscapeAnalysisPhase {
   void Run(PipelineData* data, Zone* temp_zone) {
     EscapeAnalysis escape_analysis(data->jsgraph(), temp_zone);
     escape_analysis.ReduceGraph();
-    JSGraphReducer reducer(data->jsgraph(), temp_zone);
+    GraphReducer reducer(temp_zone, data->graph(), data->jsgraph()->Dead());
     EscapeAnalysisReducer escape_reducer(&reducer, data->jsgraph(),
                                          escape_analysis.analysis_result(),
                                          temp_zone);
@@ -1251,8 +1324,10 @@ struct SimplifiedLoweringPhase {
   static const char* phase_name() { return "simplified lowering"; }
 
   void Run(PipelineData* data, Zone* temp_zone) {
-    SimplifiedLowering lowering(data->jsgraph(), temp_zone,
-                                data->source_positions());
+    SimplifiedLowering lowering(data->jsgraph(), data->js_heap_broker(),
+                                temp_zone, data->source_positions(),
+                                data->node_origins(),
+                                data->info()->GetPoisoningMitigationLevel());
     lowering.LowerAllNodes();
   }
 };
@@ -1269,7 +1344,7 @@ struct LoopPeelingPhase {
     LoopTree* loop_tree =
         LoopFinder::BuildLoopTree(data->jsgraph()->graph(), temp_zone);
     LoopPeeler(data->graph(), data->common(), loop_tree, temp_zone,
-               data->source_positions())
+               data->source_positions(), data->node_origins())
         .PeelInnerLoopsOfTree();
   }
 };
@@ -1295,8 +1370,16 @@ struct ConcurrentOptimizationPrepPhase {
     data->jsgraph()->ArrayConstructorStubConstant();
 
     // This is needed for escape analysis.
-    NodeProperties::SetType(data->jsgraph()->FalseConstant(), Type::Boolean());
-    NodeProperties::SetType(data->jsgraph()->TrueConstant(), Type::Boolean());
+    NodeProperties::SetType(
+        data->jsgraph()->FalseConstant(),
+        Type::HeapConstant(data->js_heap_broker(),
+                           data->isolate()->factory()->false_value(),
+                           data->jsgraph()->zone()));
+    NodeProperties::SetType(
+        data->jsgraph()->TrueConstant(),
+        Type::HeapConstant(data->js_heap_broker(),
+                           data->isolate()->factory()->true_value(),
+                           data->jsgraph()->zone()));
   }
 };
 
@@ -1304,7 +1387,8 @@ struct GenericLoweringPhase {
   static const char* phase_name() { return "generic lowering"; }
 
   void Run(PipelineData* data, Zone* temp_zone) {
-    JSGraphReducer graph_reducer(data->jsgraph(), temp_zone);
+    GraphReducer graph_reducer(temp_zone, data->graph(),
+                               data->jsgraph()->Dead());
     JSGenericLowering generic_lowering(data->jsgraph());
     AddReducer(data, &graph_reducer, &generic_lowering);
     graph_reducer.ReduceGraph();
@@ -1315,16 +1399,18 @@ struct EarlyOptimizationPhase {
   static const char* phase_name() { return "early optimization"; }
 
   void Run(PipelineData* data, Zone* temp_zone) {
-    JSGraphReducer graph_reducer(data->jsgraph(), temp_zone);
+    GraphReducer graph_reducer(temp_zone, data->graph(),
+                               data->jsgraph()->Dead());
     DeadCodeElimination dead_code_elimination(&graph_reducer, data->graph(),
                                               data->common(), temp_zone);
-    SimplifiedOperatorReducer simple_reducer(&graph_reducer, data->jsgraph());
+    SimplifiedOperatorReducer simple_reducer(&graph_reducer, data->jsgraph(),
+                                             data->js_heap_broker());
     RedundancyElimination redundancy_elimination(&graph_reducer, temp_zone);
     ValueNumberingReducer value_numbering(temp_zone, data->graph()->zone());
     MachineOperatorReducer machine_reducer(data->jsgraph());
     CommonOperatorReducer common_reducer(&graph_reducer, data->graph(),
-                                         data->common(), data->machine(),
-                                         temp_zone);
+                                         data->js_heap_broker(), data->common(),
+                                         data->machine(), temp_zone);
     AddReducer(data, &graph_reducer, &dead_code_elimination);
     AddReducer(data, &graph_reducer, &simple_reducer);
     AddReducer(data, &graph_reducer, &redundancy_elimination);
@@ -1365,16 +1451,12 @@ struct EffectControlLinearizationPhase {
       Schedule* schedule = Scheduler::ComputeSchedule(temp_zone, data->graph(),
                                                       Scheduler::kTempSchedule);
       if (FLAG_turbo_verify) ScheduleVerifier::Run(schedule);
-      TraceSchedule(data->info(), data->isolate(), schedule);
+      TraceSchedule(data->info(), data->isolate(), schedule,
+                    "effect linearization schedule");
 
-      // We only insert the array masking code if
-      //   - untrusted code mitigations are on,
-      //   - general load poisoning is off.
-      // TODO(jarin) Remove the array index masking code entirely once we have
-      // restricted load poisoning.
       EffectControlLinearizer::MaskArrayIndexEnable mask_array_index =
-          (data->info()->has_untrusted_code_mitigations() &&
-           !data->info()->is_poison_loads())
+          (data->info()->GetPoisoningMitigationLevel() !=
+           PoisoningMitigationLevel::kDontPoison)
               ? EffectControlLinearizer::kMaskArrayIndex
               : EffectControlLinearizer::kDoNotMaskArrayIndex;
       // Post-pass for wiring the control/effects
@@ -1382,9 +1464,9 @@ struct EffectControlLinearizationPhase {
       //   chains and lower them,
       // - get rid of the region markers,
       // - introduce effect phis and rewire effects to get SSA again.
-      EffectControlLinearizer linearizer(data->jsgraph(), schedule, temp_zone,
-                                         data->source_positions(),
-                                         mask_array_index);
+      EffectControlLinearizer linearizer(
+          data->jsgraph(), schedule, temp_zone, data->source_positions(),
+          data->node_origins(), mask_array_index);
       linearizer.Run();
     }
     {
@@ -1393,12 +1475,13 @@ struct EffectControlLinearizationPhase {
       // Also, the following store-store elimination phase greatly benefits from
       // doing a common operator reducer and dead code elimination just before
       // it, to eliminate conditional deopts with a constant condition.
-      JSGraphReducer graph_reducer(data->jsgraph(), temp_zone);
+      GraphReducer graph_reducer(temp_zone, data->graph(),
+                                 data->jsgraph()->Dead());
       DeadCodeElimination dead_code_elimination(&graph_reducer, data->graph(),
                                                 data->common(), temp_zone);
-      CommonOperatorReducer common_reducer(&graph_reducer, data->graph(),
-                                           data->common(), data->machine(),
-                                           temp_zone);
+      CommonOperatorReducer common_reducer(
+          &graph_reducer, data->graph(), data->js_heap_broker(), data->common(),
+          data->machine(), temp_zone);
       AddReducer(data, &graph_reducer, &dead_code_elimination);
       AddReducer(data, &graph_reducer, &common_reducer);
       graph_reducer.ReduceGraph();
@@ -1423,7 +1506,8 @@ struct LoadEliminationPhase {
   static const char* phase_name() { return "load elimination"; }
 
   void Run(PipelineData* data, Zone* temp_zone) {
-    JSGraphReducer graph_reducer(data->jsgraph(), temp_zone);
+    GraphReducer graph_reducer(temp_zone, data->graph(),
+                               data->jsgraph()->Dead());
     BranchElimination branch_condition_elimination(&graph_reducer,
                                                    data->jsgraph(), temp_zone);
     DeadCodeElimination dead_code_elimination(&graph_reducer, data->graph(),
@@ -1434,12 +1518,18 @@ struct LoadEliminationPhase {
     CheckpointElimination checkpoint_elimination(&graph_reducer);
     ValueNumberingReducer value_numbering(temp_zone, data->graph()->zone());
     CommonOperatorReducer common_reducer(&graph_reducer, data->graph(),
-                                         data->common(), data->machine(),
-                                         temp_zone);
+                                         data->js_heap_broker(), data->common(),
+                                         data->machine(), temp_zone);
+    ConstantFoldingReducer constant_folding_reducer(
+        &graph_reducer, data->jsgraph(), data->js_heap_broker());
+    TypeNarrowingReducer type_narrowing_reducer(&graph_reducer, data->jsgraph(),
+                                                data->js_heap_broker());
     AddReducer(data, &graph_reducer, &branch_condition_elimination);
     AddReducer(data, &graph_reducer, &dead_code_elimination);
     AddReducer(data, &graph_reducer, &redundancy_elimination);
     AddReducer(data, &graph_reducer, &load_elimination);
+    AddReducer(data, &graph_reducer, &type_narrowing_reducer);
+    AddReducer(data, &graph_reducer, &constant_folding_reducer);
     AddReducer(data, &graph_reducer, &checkpoint_elimination);
     AddReducer(data, &graph_reducer, &common_reducer);
     AddReducer(data, &graph_reducer, &value_numbering);
@@ -1459,9 +1549,7 @@ struct MemoryOptimizationPhase {
 
     // Optimize allocations and load/store operations.
     MemoryOptimizer optimizer(
-        data->jsgraph(), temp_zone,
-        data->info()->is_poison_loads() ? PoisoningMitigationLevel::kOn
-                                        : PoisoningMitigationLevel::kOff,
+        data->jsgraph(), temp_zone, data->info()->GetPoisoningMitigationLevel(),
         data->info()->is_allocation_folding_enabled()
             ? MemoryOptimizer::AllocationFolding::kDoAllocationFolding
             : MemoryOptimizer::AllocationFolding::kDontAllocationFolding);
@@ -1473,7 +1561,8 @@ struct LateOptimizationPhase {
   static const char* phase_name() { return "late optimization"; }
 
   void Run(PipelineData* data, Zone* temp_zone) {
-    JSGraphReducer graph_reducer(data->jsgraph(), temp_zone);
+    GraphReducer graph_reducer(temp_zone, data->graph(),
+                               data->jsgraph()->Dead());
     BranchElimination branch_condition_elimination(&graph_reducer,
                                                    data->jsgraph(), temp_zone);
     DeadCodeElimination dead_code_elimination(&graph_reducer, data->graph(),
@@ -1481,8 +1570,8 @@ struct LateOptimizationPhase {
     ValueNumberingReducer value_numbering(temp_zone, data->graph()->zone());
     MachineOperatorReducer machine_reducer(data->jsgraph());
     CommonOperatorReducer common_reducer(&graph_reducer, data->graph(),
-                                         data->common(), data->machine(),
-                                         temp_zone);
+                                         data->js_heap_broker(), data->common(),
+                                         data->machine(), temp_zone);
     SelectLowering select_lowering(data->jsgraph()->graph(),
                                    data->jsgraph()->common());
     AddReducer(data, &graph_reducer, &branch_condition_elimination);
@@ -1496,7 +1585,7 @@ struct LateOptimizationPhase {
 };
 
 struct EarlyGraphTrimmingPhase {
-  static const char* phase_name() { return "early graph trimming"; }
+  static const char* phase_name() { return "early trimming"; }
   void Run(PipelineData* data, Zone* temp_zone) {
     GraphTrimmer trimmer(temp_zone, data->graph());
     NodeVector roots(temp_zone);
@@ -1532,6 +1621,37 @@ struct ComputeSchedulePhase {
   }
 };
 
+struct InstructionRangesAsJSON {
+  const InstructionSequence* sequence;
+  const ZoneVector<std::pair<int, int>>* instr_origins;
+};
+
+std::ostream& operator<<(std::ostream& out, const InstructionRangesAsJSON& s) {
+  const int max = static_cast<int>(s.sequence->LastInstructionIndex());
+
+  out << ", \"nodeIdToInstructionRange\": {";
+  bool need_comma = false;
+  for (size_t i = 0; i < s.instr_origins->size(); ++i) {
+    std::pair<int, int> offset = (*s.instr_origins)[i];
+    if (offset.first == -1) continue;
+    const int first = max - offset.first + 1;
+    const int second = max - offset.second + 1;
+    if (need_comma) out << ", ";
+    out << "\"" << i << "\": [" << first << ", " << second << "]";
+    need_comma = true;
+  }
+  out << "}";
+  out << ", \"blockIdtoInstructionRange\": {";
+  need_comma = false;
+  for (auto block : s.sequence->instruction_blocks()) {
+    if (need_comma) out << ", ";
+    out << "\"" << block->rpo_number() << "\": [" << block->code_start() << ", "
+        << block->code_end() << "]";
+    need_comma = true;
+  }
+  out << "}";
+  return out;
+}
 
 struct InstructionSelectionPhase {
   static const char* phase_name() { return "select instructions"; }
@@ -1551,13 +1671,23 @@ struct InstructionSelectionPhase {
             ? InstructionSelector::kEnableScheduling
             : InstructionSelector::kDisableScheduling,
         data->isolate()->serializer_enabled()
-            ? InstructionSelector::kEnableSerialization
-            : InstructionSelector::kDisableSerialization,
-        data->info()->is_poison_loads() ? PoisoningMitigationLevel::kOn
-                                        : PoisoningMitigationLevel::kOff);
+            ? InstructionSelector::kDisableRootsRelativeAddressing
+            : InstructionSelector::kEnableRootsRelativeAddressing,
+        data->info()->GetPoisoningMitigationLevel(),
+        data->info()->trace_turbo_json_enabled()
+            ? InstructionSelector::kEnableTraceTurboJson
+            : InstructionSelector::kDisableTraceTurboJson);
     if (!selector.SelectInstructions()) {
       data->set_compilation_failed();
     }
+    if (data->info()->trace_turbo_json_enabled()) {
+      TurboJsonFile json_of(data->info(), std::ios_base::app);
+      json_of << "{\"name\":\"" << phase_name()
+              << "\",\"type\":\"instructions\""
+              << InstructionRangesAsJSON{data->sequence(),
+                                         &selector.instr_origins()}
+              << "},\n";
+    }
   }
 };
 
@@ -1751,14 +1881,16 @@ struct PrintGraphPhase {
     OptimizedCompilationInfo* info = data->info();
     Graph* graph = data->graph();
 
-    if (FLAG_trace_turbo) {  // Print JSON.
+    if (info->trace_turbo_json_enabled()) {  // Print JSON.
       AllowHandleDereference allow_deref;
+
       TurboJsonFile json_of(info, std::ios_base::app);
       json_of << "{\"name\":\"" << phase << "\",\"type\":\"graph\",\"data\":"
-              << AsJSON(*graph, data->source_positions()) << "},\n";
+              << AsJSON(*graph, data->source_positions(), data->node_origins())
+              << "},\n";
     }
 
-    if (FLAG_trace_turbo_scheduled) {  // Scheduled textual output.
+    if (info->trace_turbo_scheduled_enabled()) {
       AccountingAllocator allocator;
       Schedule* schedule = data->schedule();
       if (schedule == nullptr) {
@@ -1771,7 +1903,7 @@ struct PrintGraphPhase {
       OFStream os(tracing_scope.file());
       os << "-- Graph after " << phase << " -- " << std::endl;
       os << AsScheduledGraph(schedule);
-    } else if (FLAG_trace_turbo_graph) {  // Simple textual RPO.
+    } else if (info->trace_turbo_graph_enabled()) {  // Simple textual RPO.
       AllowHandleDereference allow_deref;
       CodeTracer::Scope tracing_scope(data->isolate()->GetCodeTracer());
       OFStream os(tracing_scope.file());
@@ -1806,7 +1938,8 @@ struct VerifyGraphPhase {
 };
 
 void PipelineImpl::RunPrintAndVerify(const char* phase, bool untyped) {
-  if (FLAG_trace_turbo || FLAG_trace_turbo_graph) {
+  if (info()->trace_turbo_json_enabled() ||
+      info()->trace_turbo_graph_enabled()) {
     Run<PrintGraphPhase>(phase);
   }
   if (FLAG_turbo_verify) {
@@ -1819,30 +1952,34 @@ bool PipelineImpl::CreateGraph() {
 
   data->BeginPhaseKind("graph creation");
 
-  if (FLAG_trace_turbo || FLAG_trace_turbo_graph) {
+  if (info()->trace_turbo_json_enabled() ||
+      info()->trace_turbo_graph_enabled()) {
     CodeTracer::Scope tracing_scope(isolate()->GetCodeTracer());
     OFStream os(tracing_scope.file());
     os << "---------------------------------------------------\n"
        << "Begin compiling method " << info()->GetDebugName().get()
        << " using Turbofan" << std::endl;
   }
-  if (FLAG_trace_turbo) {
+  if (info()->trace_turbo_json_enabled()) {
     TurboCfgFile tcf(isolate());
     tcf << AsC1VCompilation(info());
   }
 
   data->source_positions()->AddDecorator();
+  if (data->info()->trace_turbo_json_enabled()) {
+    data->node_origins()->AddDecorator();
+  }
 
   Run<GraphBuilderPhase>();
-  RunPrintAndVerify("Initial untyped", true);
+  RunPrintAndVerify(GraphBuilderPhase::phase_name(), true);
 
   // Perform function context specialization and inlining (if enabled).
   Run<InliningPhase>();
-  RunPrintAndVerify("Inlined", true);
+  RunPrintAndVerify(InliningPhase::phase_name(), true);
 
   // Remove dead->live edges from the graph.
   Run<EarlyGraphTrimmingPhase>();
-  RunPrintAndVerify("Early trimmed", true);
+  RunPrintAndVerify(EarlyGraphTrimmingPhase::phase_name(), true);
 
   // Run the type-sensitive lowerings and optimizations on the graph.
   {
@@ -1861,13 +1998,13 @@ bool PipelineImpl::CreateGraph() {
     // Type the graph and keep the Typer running on newly created nodes within
     // this scope; the Typer is automatically unlinked from the Graph once we
     // leave this scope below.
-    Typer typer(isolate(), flags, data->graph());
+    Typer typer(isolate(), data->js_heap_broker(), flags, data->graph());
     Run<TyperPhase>(&typer);
-    RunPrintAndVerify("Typed");
+    RunPrintAndVerify(TyperPhase::phase_name());
 
     // Lower JSOperators where we can determine types.
     Run<TypedLoweringPhase>();
-    RunPrintAndVerify("Lowered typed");
+    RunPrintAndVerify(TypedLoweringPhase::phase_name());
   }
 
   // Do some hacky things to prepare for the optimization phase.
@@ -1886,15 +2023,15 @@ bool PipelineImpl::OptimizeGraph(Linkage* linkage) {
 
   if (data->info()->is_loop_peeling_enabled()) {
     Run<LoopPeelingPhase>();
-    RunPrintAndVerify("Loops peeled", true);
+    RunPrintAndVerify(LoopPeelingPhase::phase_name(), true);
   } else {
     Run<LoopExitEliminationPhase>();
-    RunPrintAndVerify("Loop exits eliminated", true);
+    RunPrintAndVerify(LoopExitEliminationPhase::phase_name(), true);
   }
 
   if (FLAG_turbo_load_elimination) {
     Run<LoadEliminationPhase>();
-    RunPrintAndVerify("Load eliminated");
+    RunPrintAndVerify(LoadEliminationPhase::phase_name());
   }
 
   if (FLAG_turbo_escape) {
@@ -1905,14 +2042,14 @@ bool PipelineImpl::OptimizeGraph(Linkage* linkage) {
       data->EndPhaseKind();
       return false;
     }
-    RunPrintAndVerify("Escape Analysed");
+    RunPrintAndVerify(EscapeAnalysisPhase::phase_name());
   }
 
   // Perform simplified lowering. This has to run w/o the Typer decorator,
   // because we cannot compute meaningful types anyways, and the computed types
   // might even conflict with the representation/truncation logic.
   Run<SimplifiedLoweringPhase>();
-  RunPrintAndVerify("Simplified lowering", true);
+  RunPrintAndVerify(SimplifiedLoweringPhase::phase_name(), true);
 
   // From now on it is invalid to look at types on the nodes, because the types
   // on the nodes might not make sense after representation selection due to the
@@ -1923,99 +2060,108 @@ bool PipelineImpl::OptimizeGraph(Linkage* linkage) {
   // remove the types from the nodes (currently only in Debug builds).
 #ifdef DEBUG
   Run<UntyperPhase>();
-  RunPrintAndVerify("Untyped", true);
+  RunPrintAndVerify(UntyperPhase::phase_name(), true);
 #endif
 
   // Run generic lowering pass.
   Run<GenericLoweringPhase>();
-  RunPrintAndVerify("Generic lowering", true);
+  RunPrintAndVerify(GenericLoweringPhase::phase_name(), true);
 
   data->BeginPhaseKind("block building");
 
   // Run early optimization pass.
   Run<EarlyOptimizationPhase>();
-  RunPrintAndVerify("Early optimized", true);
+  RunPrintAndVerify(EarlyOptimizationPhase::phase_name(), true);
 
   Run<EffectControlLinearizationPhase>();
-  RunPrintAndVerify("Effect and control linearized", true);
+  RunPrintAndVerify(EffectControlLinearizationPhase::phase_name(), true);
 
   if (FLAG_turbo_store_elimination) {
     Run<StoreStoreEliminationPhase>();
-    RunPrintAndVerify("Store-store elimination", true);
+    RunPrintAndVerify(StoreStoreEliminationPhase::phase_name(), true);
   }
 
   // Optimize control flow.
   if (FLAG_turbo_cf_optimization) {
     Run<ControlFlowOptimizationPhase>();
-    RunPrintAndVerify("Control flow optimized", true);
+    RunPrintAndVerify(ControlFlowOptimizationPhase::phase_name(), true);
   }
 
   // Optimize memory access and allocation operations.
   Run<MemoryOptimizationPhase>();
   // TODO(jarin, rossberg): Remove UNTYPED once machine typing works.
-  RunPrintAndVerify("Memory optimized", true);
+  RunPrintAndVerify(MemoryOptimizationPhase::phase_name(), true);
 
   // Lower changes that have been inserted before.
   Run<LateOptimizationPhase>();
   // TODO(jarin, rossberg): Remove UNTYPED once machine typing works.
-  RunPrintAndVerify("Late optimized", true);
+  RunPrintAndVerify(LateOptimizationPhase::phase_name(), true);
 
   data->source_positions()->RemoveDecorator();
+  if (data->info()->trace_turbo_json_enabled()) {
+    data->node_origins()->RemoveDecorator();
+  }
 
   ComputeScheduledGraph();
 
   return SelectInstructions(linkage);
 }
 
-Handle<Code> Pipeline::GenerateCodeForCodeStub(
+MaybeHandle<Code> Pipeline::GenerateCodeForCodeStub(
     Isolate* isolate, CallDescriptor* call_descriptor, Graph* graph,
     Schedule* schedule, Code::Kind kind, const char* debug_name,
     uint32_t stub_key, int32_t builtin_index, JumpOptimizationInfo* jump_opt,
-    PoisoningMitigationLevel poisoning_enabled) {
+    PoisoningMitigationLevel poisoning_level, const AssemblerOptions& options) {
   OptimizedCompilationInfo info(CStrVector(debug_name), graph->zone(), kind);
   info.set_builtin_index(builtin_index);
   info.set_stub_key(stub_key);
 
-  if (poisoning_enabled == PoisoningMitigationLevel::kOn) {
-    info.MarkAsPoisonLoads();
+  if (poisoning_level != PoisoningMitigationLevel::kDontPoison) {
+    info.SetPoisoningMitigationLevel(poisoning_level);
   }
 
   // Construct a pipeline for scheduling and code generation.
   ZoneStats zone_stats(isolate->allocator());
   SourcePositionTable source_positions(graph);
+  NodeOriginTable node_origins(graph);
   PipelineData data(&zone_stats, &info, isolate, graph, schedule,
-                    &source_positions, jump_opt);
+                    &source_positions, &node_origins, jump_opt, options);
   data.set_verify_graph(FLAG_verify_csa);
   std::unique_ptr<PipelineStatistics> pipeline_statistics;
   if (FLAG_turbo_stats || FLAG_turbo_stats_nvp) {
-    pipeline_statistics.reset(
-        new PipelineStatistics(&info, isolate, &zone_stats));
+    pipeline_statistics.reset(new PipelineStatistics(
+        &info, isolate->GetTurboStatistics(), &zone_stats));
     pipeline_statistics->BeginPhaseKind("stub codegen");
   }
 
   PipelineImpl pipeline(&data);
   DCHECK_NOT_NULL(data.schedule());
 
-  if (FLAG_trace_turbo || FLAG_trace_turbo_graph) {
+  if (info.trace_turbo_json_enabled() || info.trace_turbo_graph_enabled()) {
     CodeTracer::Scope tracing_scope(isolate->GetCodeTracer());
     OFStream os(tracing_scope.file());
     os << "---------------------------------------------------\n"
        << "Begin compiling " << debug_name << " using Turbofan" << std::endl;
-    if (FLAG_trace_turbo) {
+    if (info.trace_turbo_json_enabled()) {
       TurboJsonFile json_of(&info, std::ios_base::trunc);
-      json_of << "{\"function\":\"" << info.GetDebugName().get()
-              << "\", \"source\":\"\",\n\"phases\":[";
+      json_of << "{\"function\" : ";
+      JsonPrintFunctionSource(json_of, -1, info.GetDebugName(),
+                              Handle<Script>(), isolate,
+                              Handle<SharedFunctionInfo>());
+      json_of << ",\n\"phases\":[";
     }
     pipeline.Run<PrintGraphPhase>("Machine");
   }
 
+  TraceSchedule(data.info(), data.isolate(), data.schedule(), "schedule");
+
   pipeline.Run<VerifyGraphPhase>(false, true);
   return pipeline.GenerateCode(call_descriptor);
 }
 
 // static
-Handle<Code> Pipeline::GenerateCodeForTesting(OptimizedCompilationInfo* info,
-                                              Isolate* isolate) {
+MaybeHandle<Code> Pipeline::GenerateCodeForTesting(
+    OptimizedCompilationInfo* info, Isolate* isolate) {
   ZoneStats zone_stats(isolate->allocator());
   std::unique_ptr<PipelineStatistics> pipeline_statistics(
       CreatePipelineStatistics(Handle<Script>::null(), info, isolate,
@@ -2026,25 +2172,22 @@ Handle<Code> Pipeline::GenerateCodeForTesting(OptimizedCompilationInfo* info,
   Linkage linkage(Linkage::ComputeIncoming(data.instruction_zone(), info));
   Deoptimizer::EnsureCodeForMaxDeoptimizationEntries(isolate);
 
-  if (!pipeline.CreateGraph()) return Handle<Code>::null();
-  if (!pipeline.OptimizeGraph(&linkage)) return Handle<Code>::null();
+  if (!pipeline.CreateGraph()) return MaybeHandle<Code>();
+  if (!pipeline.OptimizeGraph(&linkage)) return MaybeHandle<Code>();
   pipeline.AssembleCode(&linkage);
-  return pipeline.FinalizeCode();
-}
-
-// static
-Handle<Code> Pipeline::GenerateCodeForTesting(OptimizedCompilationInfo* info,
-                                              Isolate* isolate, Graph* graph,
-                                              Schedule* schedule) {
-  auto call_descriptor = Linkage::ComputeIncoming(info->zone(), info);
-  return GenerateCodeForTesting(info, isolate, call_descriptor, graph,
-                                schedule);
+  Handle<Code> code;
+  if (pipeline.FinalizeCode().ToHandle(&code) &&
+      pipeline.CommitDependencies(code)) {
+    return code;
+  }
+  return MaybeHandle<Code>();
 }
 
 // static
-Handle<Code> Pipeline::GenerateCodeForTesting(
+MaybeHandle<Code> Pipeline::GenerateCodeForTesting(
     OptimizedCompilationInfo* info, Isolate* isolate,
-    CallDescriptor* call_descriptor, Graph* graph, Schedule* schedule,
+    CallDescriptor* call_descriptor, Graph* graph,
+    const AssemblerOptions& options, Schedule* schedule,
     SourcePositionTable* source_positions) {
   // Construct a pipeline for scheduling and code generation.
   ZoneStats zone_stats(isolate->allocator());
@@ -2052,49 +2195,60 @@ Handle<Code> Pipeline::GenerateCodeForTesting(
   // table, then remove this conditional allocation.
   if (!source_positions)
     source_positions = new (info->zone()) SourcePositionTable(graph);
+  NodeOriginTable* node_positions = new (info->zone()) NodeOriginTable(graph);
   PipelineData data(&zone_stats, info, isolate, graph, schedule,
-                    source_positions, nullptr);
+                    source_positions, node_positions, nullptr, options);
   std::unique_ptr<PipelineStatistics> pipeline_statistics;
   if (FLAG_turbo_stats || FLAG_turbo_stats_nvp) {
-    pipeline_statistics.reset(
-        new PipelineStatistics(info, isolate, &zone_stats));
+    pipeline_statistics.reset(new PipelineStatistics(
+        info, isolate->GetTurboStatistics(), &zone_stats));
     pipeline_statistics->BeginPhaseKind("test codegen");
   }
 
   PipelineImpl pipeline(&data);
 
-  if (FLAG_trace_turbo) {
+  if (info->trace_turbo_json_enabled()) {
     TurboJsonFile json_of(info, std::ios_base::trunc);
     json_of << "{\"function\":\"" << info->GetDebugName().get()
             << "\", \"source\":\"\",\n\"phases\":[";
   }
   // TODO(rossberg): Should this really be untyped?
-  pipeline.RunPrintAndVerify("Machine", true);
+  pipeline.RunPrintAndVerify("machine", true);
 
   // Ensure we have a schedule.
   if (data.schedule() == nullptr) {
     pipeline.ComputeScheduledGraph();
   }
 
-  return pipeline.GenerateCode(call_descriptor);
+  Handle<Code> code;
+  if (pipeline.GenerateCode(call_descriptor).ToHandle(&code) &&
+      pipeline.CommitDependencies(code)) {
+    return code;
+  }
+  return MaybeHandle<Code>();
 }
 
 // static
 OptimizedCompilationJob* Pipeline::NewCompilationJob(
-    Handle<JSFunction> function, bool has_script) {
-  Handle<SharedFunctionInfo> shared = handle(function->shared());
-  return new PipelineCompilationJob(shared, function);
+    Isolate* isolate, Handle<JSFunction> function, bool has_script) {
+  Handle<SharedFunctionInfo> shared =
+      handle(function->shared(), function->GetIsolate());
+  return new PipelineCompilationJob(isolate, shared, function);
 }
 
 // static
 OptimizedCompilationJob* Pipeline::NewWasmCompilationJob(
-    OptimizedCompilationInfo* info, Isolate* isolate, JSGraph* jsgraph,
-    CallDescriptor* call_descriptor, SourcePositionTable* source_positions,
+    OptimizedCompilationInfo* info, wasm::WasmEngine* wasm_engine,
+    Isolate* isolate, MachineGraph* mcgraph, CallDescriptor* call_descriptor,
+    SourcePositionTable* source_positions, NodeOriginTable* node_origins,
     WasmCompilationData* wasm_compilation_data,
+    wasm::FunctionBody function_body, wasm::WasmModule* wasm_module,
+    wasm::NativeModule* native_module, int function_index,
     wasm::ModuleOrigin asmjs_origin) {
-  return new PipelineWasmCompilationJob(info, isolate, jsgraph, call_descriptor,
-                                        source_positions, wasm_compilation_data,
-                                        asmjs_origin);
+  return new PipelineWasmCompilationJob(
+      info, wasm_engine, isolate, mcgraph, call_descriptor, source_positions,
+      node_origins, wasm_compilation_data, function_body, wasm_module,
+      native_module, function_index, asmjs_origin);
 }
 
 bool Pipeline::AllocateRegistersForTesting(const RegisterConfiguration* config,
@@ -2117,10 +2271,10 @@ void PipelineImpl::ComputeScheduledGraph() {
   DCHECK_NULL(data->schedule());
 
   Run<LateGraphTrimmingPhase>();
-  RunPrintAndVerify("Late trimmed", true);
+  RunPrintAndVerify(LateGraphTrimmingPhase::phase_name(), true);
 
   Run<ComputeSchedulePhase>();
-  TraceSchedule(data->info(), data->isolate(), data->schedule());
+  TraceSchedule(data->info(), data->isolate(), data->schedule(), "schedule");
 }
 
 bool PipelineImpl::SelectInstructions(Linkage* linkage) {
@@ -2178,17 +2332,19 @@ bool PipelineImpl::SelectInstructions(Linkage* linkage) {
     return false;
   }
 
-  if (FLAG_trace_turbo && !data->MayHaveUnverifiableGraph()) {
+  if (info()->trace_turbo_json_enabled() && !data->MayHaveUnverifiableGraph()) {
     AllowHandleDereference allow_deref;
     TurboCfgFile tcf(isolate());
     tcf << AsC1V("CodeGen", data->schedule(), data->source_positions(),
                  data->sequence());
   }
 
-  if (FLAG_trace_turbo) {
+  if (info()->trace_turbo_json_enabled()) {
     std::ostringstream source_position_output;
     // Output source position information before the graph is deleted.
-    data_->source_positions()->Print(source_position_output);
+    data_->source_positions()->PrintJson(source_position_output);
+    source_position_output << ",\n\"NodeOrigins\" : ";
+    data_->node_origins()->PrintJson(source_position_output);
     data_->set_source_position_output(source_position_output.str());
   }
 
@@ -2205,7 +2361,8 @@ bool PipelineImpl::SelectInstructions(Linkage* linkage) {
     std::unique_ptr<const RegisterConfiguration> config;
     config.reset(RegisterConfiguration::RestrictGeneralRegisters(registers));
     AllocateRegisters(config.get(), call_descriptor, run_verifier);
-  } else if (data->info()->is_poison_loads()) {
+  } else if (data->info()->GetPoisoningMitigationLevel() !=
+             PoisoningMitigationLevel::kDontPoison) {
     AllocateRegisters(RegisterConfiguration::Poisoning(), call_descriptor,
                       run_verifier);
   } else {
@@ -2213,6 +2370,9 @@ bool PipelineImpl::SelectInstructions(Linkage* linkage) {
                       run_verifier);
   }
 
+  // Verify the instruction sequence has the same hash in two stages.
+  VerifyGeneratedCodeIsIdempotent();
+
   Run<FrameElisionPhase>();
   if (data->compilation_failed()) {
     info()->AbortOptimization(
@@ -2234,36 +2394,106 @@ bool PipelineImpl::SelectInstructions(Linkage* linkage) {
   return true;
 }
 
+void PipelineImpl::VerifyGeneratedCodeIsIdempotent() {
+  PipelineData* data = this->data_;
+  JumpOptimizationInfo* jump_opt = data->jump_optimization_info();
+  if (jump_opt == nullptr) return;
+
+  InstructionSequence* code = data->sequence();
+  int instruction_blocks = code->InstructionBlockCount();
+  int virtual_registers = code->VirtualRegisterCount();
+  size_t hash_code = base::hash_combine(instruction_blocks, virtual_registers);
+  for (auto instr : *code) {
+    hash_code = base::hash_combine(hash_code, instr->opcode(),
+                                   instr->InputCount(), instr->OutputCount());
+  }
+  for (int i = 0; i < virtual_registers; i++) {
+    hash_code = base::hash_combine(hash_code, code->GetRepresentation(i));
+  }
+  if (jump_opt->is_collecting()) {
+    jump_opt->set_hash_code(hash_code);
+  } else {
+    CHECK_EQ(hash_code, jump_opt->hash_code());
+  }
+}
+
+struct InstructionStartsAsJSON {
+  const ZoneVector<int>* instr_starts;
+};
+
+std::ostream& operator<<(std::ostream& out, const InstructionStartsAsJSON& s) {
+  out << ", \"instructionOffsetToPCOffset\": {";
+  bool need_comma = false;
+  for (size_t i = 0; i < s.instr_starts->size(); ++i) {
+    if (need_comma) out << ", ";
+    int offset = (*s.instr_starts)[i];
+    out << "\"" << i << "\":" << offset;
+    need_comma = true;
+  }
+  out << "}";
+  return out;
+}
+
 void PipelineImpl::AssembleCode(Linkage* linkage) {
   PipelineData* data = this->data_;
   data->BeginPhaseKind("code generation");
   data->InitializeCodeGenerator(linkage);
   Run<AssembleCodePhase>();
+  if (data->info()->trace_turbo_json_enabled()) {
+    TurboJsonFile json_of(data->info(), std::ios_base::app);
+    json_of << "{\"name\":\"code generation\""
+            << ", \"type\":\"instructions\""
+            << InstructionStartsAsJSON{&data->code_generator()->instr_starts()};
+    json_of << "},\n";
+  }
   data->DeleteInstructionZone();
 }
 
-Handle<Code> PipelineImpl::FinalizeCode() {
+struct BlockStartsAsJSON {
+  const ZoneVector<int>* block_starts;
+};
+
+std::ostream& operator<<(std::ostream& out, const BlockStartsAsJSON& s) {
+  out << ", \"blockIdToOffset\": {";
+  bool need_comma = false;
+  for (size_t i = 0; i < s.block_starts->size(); ++i) {
+    if (need_comma) out << ", ";
+    int offset = (*s.block_starts)[i];
+    out << "\"" << i << "\":" << offset;
+    need_comma = true;
+  }
+  out << "},";
+  return out;
+}
+
+MaybeHandle<Code> PipelineImpl::FinalizeCode() {
   PipelineData* data = this->data_;
   Run<FinalizeCodePhase>();
 
-  Handle<Code> code = data->code();
-  if (code.is_null()) return code;
+  MaybeHandle<Code> maybe_code = data->code();
+  Handle<Code> code;
+  if (!maybe_code.ToHandle(&code)) {
+    return maybe_code;
+  }
 
   if (data->profiler_data()) {
-#if ENABLE_DISASSEMBLER
+#ifdef ENABLE_DISASSEMBLER
     std::ostringstream os;
     code->Disassemble(nullptr, os);
     data->profiler_data()->SetCode(&os);
-#endif
+#endif  // ENABLE_DISASSEMBLER
   }
 
   info()->SetCode(code);
-  PrintCode(code, info());
+  PrintCode(isolate(), code, info());
 
-  if (FLAG_trace_turbo) {
+  if (info()->trace_turbo_json_enabled()) {
     TurboJsonFile json_of(info(), std::ios_base::app);
-    json_of << "{\"name\":\"disassembly\",\"type\":\"disassembly\",\"data\":\"";
-#if ENABLE_DISASSEMBLER
+
+    json_of << "{\"name\":\"disassembly\",\"type\":\"disassembly\""
+            << BlockStartsAsJSON{&data->code_generator()->block_starts()}
+            << "\"data\":\"";
+#ifdef ENABLE_DISASSEMBLER
     std::stringstream disassembly_stream;
     code->Disassemble(nullptr, disassembly_stream);
     std::string disassembly_string(disassembly_stream.str());
@@ -2273,10 +2503,12 @@ Handle<Code> PipelineImpl::FinalizeCode() {
 #endif  // ENABLE_DISASSEMBLER
     json_of << "\"}\n],\n";
     json_of << "\"nodePositions\":";
-    json_of << data->source_position_output();
-    json_of << "}";
+    json_of << data->source_position_output() << ",\n";
+    JsonPrintAllSourceWithPositions(json_of, data->info(), isolate());
+    json_of << "\n}";
   }
-  if (FLAG_trace_turbo || FLAG_trace_turbo_graph) {
+  if (info()->trace_turbo_json_enabled() ||
+      info()->trace_turbo_graph_enabled()) {
     CodeTracer::Scope tracing_scope(isolate()->GetCodeTracer());
     OFStream os(tracing_scope.file());
     os << "---------------------------------------------------\n"
@@ -2286,17 +2518,22 @@ Handle<Code> PipelineImpl::FinalizeCode() {
   return code;
 }
 
-Handle<Code> PipelineImpl::GenerateCode(CallDescriptor* call_descriptor) {
+MaybeHandle<Code> PipelineImpl::GenerateCode(CallDescriptor* call_descriptor) {
   Linkage linkage(call_descriptor);
 
   // Perform instruction selection and register allocation.
-  if (!SelectInstructions(&linkage)) return Handle<Code>();
+  if (!SelectInstructions(&linkage)) return MaybeHandle<Code>();
 
   // Generate the final machine code.
   AssembleCode(&linkage);
   return FinalizeCode();
 }
 
+bool PipelineImpl::CommitDependencies(Handle<Code> code) {
+  return data_->dependencies() == nullptr ||
+         data_->dependencies()->Commit(code);
+}
+
 void PipelineImpl::AllocateRegisters(const RegisterConfiguration* config,
                                      CallDescriptor* call_descriptor,
                                      bool run_verifier) {
@@ -2322,7 +2559,7 @@ void PipelineImpl::AllocateRegisters(const RegisterConfiguration* config,
   Run<MeetRegisterConstraintsPhase>();
   Run<ResolvePhisPhase>();
   Run<BuildLiveRangesPhase>();
-  if (FLAG_trace_turbo_graph) {
+  if (info()->trace_turbo_graph_enabled()) {
     AllowHandleDereference allow_deref;
     CodeTracer::Scope tracing_scope(isolate()->GetCodeTracer());
     OFStream os(tracing_scope.file());
@@ -2366,7 +2603,7 @@ void PipelineImpl::AllocateRegisters(const RegisterConfiguration* config,
 
   Run<LocateSpillSlotsPhase>();
 
-  if (FLAG_trace_turbo_graph) {
+  if (info()->trace_turbo_graph_enabled()) {
     AllowHandleDereference allow_deref;
     CodeTracer::Scope tracing_scope(isolate()->GetCodeTracer());
     OFStream os(tracing_scope.file());
@@ -2379,8 +2616,8 @@ void PipelineImpl::AllocateRegisters(const RegisterConfiguration* config,
     verifier->VerifyGapMoves();
   }
 
-  if (FLAG_trace_turbo && !data->MayHaveUnverifiableGraph()) {
-    TurboCfgFile tcf(data->isolate());
+  if (info()->trace_turbo_json_enabled() && !data->MayHaveUnverifiableGraph()) {
+    TurboCfgFile tcf(isolate());
     tcf << AsC1VRegisterAllocationData("CodeGen",
                                        data->register_allocation_data());
   }
diff --git a/deps/v8/src/compiler/pipeline.h b/deps/v8/src/compiler/pipeline.h
index 33fb965c833e39..a7d8026765aa9f 100644
--- a/deps/v8/src/compiler/pipeline.h
+++ b/deps/v8/src/compiler/pipeline.h
@@ -10,11 +10,11 @@
 #include "src/globals.h"
 #include "src/objects.h"
 #include "src/objects/code.h"
-#include "src/zone/zone-containers.h"
 
 namespace v8 {
 namespace internal {
 
+struct AssemblerOptions;
 class OptimizedCompilationInfo;
 class OptimizedCompilationJob;
 class RegisterConfiguration;
@@ -22,63 +22,70 @@ class JumpOptimizationInfo;
 
 namespace wasm {
 enum ModuleOrigin : uint8_t;
+struct FunctionBody;
+class NativeModule;
+class WasmEngine;
+struct WasmModule;
 }  // namespace wasm
 
 namespace compiler {
 
 class CallDescriptor;
-class JSGraph;
 class Graph;
 class InstructionSequence;
+class MachineGraph;
+class NodeOriginTable;
 class Schedule;
 class SourcePositionTable;
 class WasmCompilationData;
 
 class Pipeline : public AllStatic {
  public:
-  // Returns a new compilation job for the given function.
-  static OptimizedCompilationJob* NewCompilationJob(Handle<JSFunction> function,
+  // Returns a new compilation job for the given JavaScript function.
+  static OptimizedCompilationJob* NewCompilationJob(Isolate* isolate,
+                                                    Handle<JSFunction> function,
                                                     bool has_script);
 
   // Returns a new compilation job for the WebAssembly compilation info.
   static OptimizedCompilationJob* NewWasmCompilationJob(
-      OptimizedCompilationInfo* info, Isolate* isolate, JSGraph* jsgraph,
-      CallDescriptor* call_descriptor, SourcePositionTable* source_positions,
+      OptimizedCompilationInfo* info, wasm::WasmEngine* wasm_engine,
+      Isolate* isolate, MachineGraph* mcgraph, CallDescriptor* call_descriptor,
+      SourcePositionTable* source_positions, NodeOriginTable* node_origins,
       WasmCompilationData* wasm_compilation_data,
+      wasm::FunctionBody function_body, wasm::WasmModule* wasm_module,
+      wasm::NativeModule* native_module, int function_index,
       wasm::ModuleOrigin wasm_origin);
 
   // Run the pipeline on a machine graph and generate code. The {schedule} must
   // be valid, hence the given {graph} does not need to be schedulable.
-  static Handle<Code> GenerateCodeForCodeStub(
+  static MaybeHandle<Code> GenerateCodeForCodeStub(
       Isolate* isolate, CallDescriptor* call_descriptor, Graph* graph,
       Schedule* schedule, Code::Kind kind, const char* debug_name,
       uint32_t stub_key, int32_t builtin_index, JumpOptimizationInfo* jump_opt,
-      PoisoningMitigationLevel poisoning_enabled);
+      PoisoningMitigationLevel poisoning_level,
+      const AssemblerOptions& options);
 
-  // Run the entire pipeline and generate a handle to a code object suitable for
-  // testing.
-  static Handle<Code> GenerateCodeForTesting(OptimizedCompilationInfo* info,
-                                             Isolate* isolate);
+  // ---------------------------------------------------------------------------
+  // The following methods are for testing purposes only. Avoid production use.
+  // ---------------------------------------------------------------------------
+
+  // Run the pipeline on JavaScript bytecode and generate code.
+  static MaybeHandle<Code> GenerateCodeForTesting(
+      OptimizedCompilationInfo* info, Isolate* isolate);
 
   // Run the pipeline on a machine graph and generate code. If {schedule} is
   // {nullptr}, then compute a new schedule for code generation.
-  static Handle<Code> GenerateCodeForTesting(OptimizedCompilationInfo* info,
-                                             Isolate* isolate, Graph* graph,
-                                             Schedule* schedule = nullptr);
+  V8_EXPORT_PRIVATE static MaybeHandle<Code> GenerateCodeForTesting(
+      OptimizedCompilationInfo* info, Isolate* isolate,
+      CallDescriptor* call_descriptor, Graph* graph,
+      const AssemblerOptions& options, Schedule* schedule = nullptr,
+      SourcePositionTable* source_positions = nullptr);
 
   // Run just the register allocator phases.
   V8_EXPORT_PRIVATE static bool AllocateRegistersForTesting(
       const RegisterConfiguration* config, InstructionSequence* sequence,
       bool run_verifier);
 
-  // Run the pipeline on a machine graph and generate code. If {schedule} is
-  // {nullptr}, then compute a new schedule for code generation.
-  V8_EXPORT_PRIVATE static Handle<Code> GenerateCodeForTesting(
-      OptimizedCompilationInfo* info, Isolate* isolate,
-      CallDescriptor* call_descriptor, Graph* graph,
-      Schedule* schedule = nullptr,
-      SourcePositionTable* source_positions = nullptr);
-
  private:
   DISALLOW_IMPLICIT_CONSTRUCTORS(Pipeline);
 };
diff --git a/deps/v8/src/compiler/ppc/code-generator-ppc.cc b/deps/v8/src/compiler/ppc/code-generator-ppc.cc
index 2a230f103ca458..57db999df124d7 100644
--- a/deps/v8/src/compiler/ppc/code-generator-ppc.cc
+++ b/deps/v8/src/compiler/ppc/code-generator-ppc.cc
@@ -417,16 +417,15 @@ void EmitWordLoadPoisoningIfNeeded(CodeGenerator* codegen, Instruction* instr,
            i.OutputRCBit());                                         \
   } while (0)
 
-#define ASSEMBLE_FLOAT_MODULO()                                            \
-  do {                                                                     \
-    FrameScope scope(tasm(), StackFrame::MANUAL);                          \
-    __ PrepareCallCFunction(0, 2, kScratchReg);                            \
-    __ MovToFloatParameters(i.InputDoubleRegister(0),                      \
-                            i.InputDoubleRegister(1));                     \
-    __ CallCFunction(                                                      \
-        ExternalReference::mod_two_doubles_operation(__ isolate()), 0, 2); \
-    __ MovFromFloatResult(i.OutputDoubleRegister());                       \
-    DCHECK_EQ(LeaveRC, i.OutputRCBit());                                   \
+#define ASSEMBLE_FLOAT_MODULO()                                             \
+  do {                                                                      \
+    FrameScope scope(tasm(), StackFrame::MANUAL);                           \
+    __ PrepareCallCFunction(0, 2, kScratchReg);                             \
+    __ MovToFloatParameters(i.InputDoubleRegister(0),                       \
+                            i.InputDoubleRegister(1));                      \
+    __ CallCFunction(ExternalReference::mod_two_doubles_operation(), 0, 2); \
+    __ MovFromFloatResult(i.OutputDoubleRegister());                        \
+    DCHECK_EQ(LeaveRC, i.OutputRCBit());                                    \
   } while (0)
 
 #define ASSEMBLE_IEEE754_UNOP(name)                                            \
@@ -436,8 +435,7 @@ void EmitWordLoadPoisoningIfNeeded(CodeGenerator* codegen, Instruction* instr,
     FrameScope scope(tasm(), StackFrame::MANUAL);                              \
     __ PrepareCallCFunction(0, 1, kScratchReg);                                \
     __ MovToFloatParameter(i.InputDoubleRegister(0));                          \
-    __ CallCFunction(                                                          \
-        ExternalReference::ieee754_##name##_function(__ isolate()), 0, 1);     \
+    __ CallCFunction(ExternalReference::ieee754_##name##_function(), 0, 1);    \
     /* Move the result in the double result register. */                       \
     __ MovFromFloatResult(i.OutputDoubleRegister());                           \
     DCHECK_EQ(LeaveRC, i.OutputRCBit());                                       \
@@ -451,8 +449,7 @@ void EmitWordLoadPoisoningIfNeeded(CodeGenerator* codegen, Instruction* instr,
     __ PrepareCallCFunction(0, 2, kScratchReg);                                \
     __ MovToFloatParameters(i.InputDoubleRegister(0),                          \
                             i.InputDoubleRegister(1));                         \
-    __ CallCFunction(                                                          \
-        ExternalReference::ieee754_##name##_function(__ isolate()), 0, 2);     \
+    __ CallCFunction(ExternalReference::ieee754_##name##_function(), 0, 2);    \
     /* Move the result in the double result register. */                       \
     __ MovFromFloatResult(i.OutputDoubleRegister());                           \
     DCHECK_EQ(LeaveRC, i.OutputRCBit());                                       \
@@ -662,6 +659,60 @@ void EmitWordLoadPoisoningIfNeeded(CodeGenerator* codegen, Instruction* instr,
     __ bne(&exchange, cr0);                                             \
   } while (0)
 
+#define ASSEMBLE_ATOMIC_BINOP(bin_inst, load_inst, store_inst)                 \
+  do {                                                                         \
+    MemOperand operand = MemOperand(i.InputRegister(0), i.InputRegister(1));   \
+    Label binop;                                                               \
+    __ bind(&binop);                                                           \
+    __ load_inst(i.OutputRegister(), operand);                                 \
+    __ bin_inst(i.InputRegister(2), i.OutputRegister(), i.InputRegister(2));   \
+    __ store_inst(i.InputRegister(2), operand);                                \
+    __ bne(&binop, cr0);                                                       \
+  } while (false)
+
+#define ASSEMBLE_ATOMIC_BINOP_SIGN_EXT(bin_inst, load_inst,                    \
+                                       store_inst, ext_instr)                  \
+  do {                                                                         \
+    MemOperand operand = MemOperand(i.InputRegister(0), i.InputRegister(1));   \
+    Label binop;                                                               \
+    __ bind(&binop);                                                           \
+    __ load_inst(i.OutputRegister(), operand);                                 \
+    __ ext_instr(i.OutputRegister(), i.OutputRegister());                      \
+    __ bin_inst(i.InputRegister(2), i.OutputRegister(), i.InputRegister(2));   \
+    __ store_inst(i.InputRegister(2), operand);                                \
+    __ bne(&binop, cr0);                                                       \
+  } while (false)
+
+#define ASSEMBLE_ATOMIC_COMPARE_EXCHANGE(cmp_inst, load_inst, store_inst)      \
+  do {                                                                         \
+    MemOperand operand = MemOperand(i.InputRegister(0), i.InputRegister(1));   \
+    Label loop;                                                                \
+    Label exit;                                                                \
+    __ bind(&loop);                                                            \
+    __ load_inst(i.OutputRegister(), operand);                                 \
+    __ cmp_inst(i.OutputRegister(), i.InputRegister(2));                       \
+    __ bne(&exit, cr0);                                                        \
+    __ store_inst(i.InputRegister(3), operand);                                \
+    __ bne(&loop, cr0);                                                        \
+    __ bind(&exit);                                                            \
+  } while (false)
+
+#define ASSEMBLE_ATOMIC_COMPARE_EXCHANGE_SIGN_EXT(cmp_inst, load_inst,         \
+                                                  store_inst, ext_instr)       \
+  do {                                                                         \
+    MemOperand operand = MemOperand(i.InputRegister(0), i.InputRegister(1));   \
+    Label loop;                                                                \
+    Label exit;                                                                \
+    __ bind(&loop);                                                            \
+    __ load_inst(i.OutputRegister(), operand);                                 \
+    __ ext_instr(i.OutputRegister(), i.OutputRegister());                      \
+    __ cmp_inst(i.OutputRegister(), i.InputRegister(2));                       \
+    __ bne(&exit, cr0);                                                        \
+    __ store_inst(i.InputRegister(3), operand);                                \
+    __ bne(&loop, cr0);                                                        \
+    __ bind(&exit);                                                            \
+  } while (false)
+
 void CodeGenerator::AssembleDeconstructFrame() {
   __ LeaveFrame(StackFrame::MANUAL);
 }
@@ -819,6 +870,9 @@ void CodeGenerator::BailoutIfDeoptimized() {
   __ LoadWordArith(
       r11, FieldMemOperand(r11, CodeDataContainer::kKindSpecificFlagsOffset));
   __ TestBit(r11, Code::kMarkedForDeoptimizationBit);
+  // Ensure we're not serializing (otherwise we'd need to use an indirection to
+  // access the builtin below).
+  DCHECK(!isolate()->ShouldLoadConstantsFromRootList());
   Handle<Code> code = isolate()->builtins()->builtin_handle(
       Builtins::kCompileLazyDeoptimizedCode);
   __ Jump(code, RelocInfo::CODE_TARGET, ne, cr0);
@@ -859,9 +913,12 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       v8::internal::Assembler::BlockTrampolinePoolScope block_trampoline_pool(
           tasm());
       if (HasRegisterInput(instr, 0)) {
-        __ addi(ip, i.InputRegister(0),
-                Operand(Code::kHeaderSize - kHeapObjectTag));
-        __ Call(ip);
+        Register reg = i.InputRegister(0);
+        DCHECK_IMPLIES(
+            HasCallDescriptorFlag(instr, CallDescriptor::kFixedTargetRegister),
+            reg == kJavaScriptCallCodeStartRegister);
+        __ addi(reg, reg, Operand(Code::kHeaderSize - kHeapObjectTag));
+        __ Call(reg);
       } else {
         __ Call(i.InputCode(0), RelocInfo::CODE_TARGET);
       }
@@ -873,20 +930,14 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
     case kArchCallWasmFunction: {
       // We must not share code targets for calls to builtins for wasm code, as
       // they might need to be patched individually.
-      RelocInfo::Mode rmode = RelocInfo::JS_TO_WASM_CALL;
-      if (info()->IsWasm()) {
-        rmode = RelocInfo::WASM_CALL;
-      }
-
       if (instr->InputAt(0)->IsImmediate()) {
+        Constant constant = i.ToConstant(instr->InputAt(0));
 #ifdef V8_TARGET_ARCH_PPC64
-        Address wasm_code = reinterpret_cast<Address>(
-            i.ToConstant(instr->InputAt(0)).ToInt64());
+        Address wasm_code = static_cast<Address>(constant.ToInt64());
 #else
-        Address wasm_code = reinterpret_cast<Address>(
-            i.ToConstant(instr->InputAt(0)).ToInt32());
+        Address wasm_code = static_cast<Address>(constant.ToInt32());
 #endif
-        __ Call(wasm_code, rmode);
+        __ Call(wasm_code, constant.rmode());
       } else {
         __ Call(i.InputRegister(0));
       }
@@ -903,9 +954,12 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
                                          i.TempRegister(2));
       }
       if (HasRegisterInput(instr, 0)) {
-        __ addi(ip, i.InputRegister(0),
-                Operand(Code::kHeaderSize - kHeapObjectTag));
-        __ Jump(ip);
+        Register reg = i.InputRegister(0);
+        DCHECK_IMPLIES(
+            HasCallDescriptorFlag(instr, CallDescriptor::kFixedTargetRegister),
+            reg == kJavaScriptCallCodeStartRegister);
+        __ addi(reg, reg, Operand(Code::kHeaderSize - kHeapObjectTag));
+        __ Jump(reg);
       } else {
         // We cannot use the constant pool to load the target since
         // we've already restored the caller's frame.
@@ -920,15 +974,14 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
     case kArchTailCallWasm: {
       // We must not share code targets for calls to builtins for wasm code, as
       // they might need to be patched individually.
-      RelocInfo::Mode rmode = RelocInfo::JS_TO_WASM_CALL;
-      if (info()->IsWasm()) {
-        rmode = RelocInfo::WASM_CALL;
-      }
-
       if (instr->InputAt(0)->IsImmediate()) {
-        Address wasm_code = reinterpret_cast<Address>(
-            i.ToConstant(instr->InputAt(0)).ToInt32());
-        __ Jump(wasm_code, rmode);
+        Constant constant = i.ToConstant(instr->InputAt(0));
+#ifdef V8_TARGET_ARCH_S390X
+        Address wasm_code = static_cast<Address>(constant.ToInt64());
+#else
+        Address wasm_code = static_cast<Address>(constant.ToInt32());
+#endif
+        __ Jump(wasm_code, constant.rmode());
       } else {
         __ Jump(i.InputRegister(0));
       }
@@ -939,7 +992,11 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
     }
     case kArchTailCallAddress: {
       CHECK(!instr->InputAt(0)->IsImmediate());
-      __ Jump(i.InputRegister(0));
+      Register reg = i.InputRegister(0);
+      DCHECK_IMPLIES(
+          HasCallDescriptorFlag(instr, CallDescriptor::kFixedTargetRegister),
+          reg == kJavaScriptCallCodeStartRegister);
+      __ Jump(reg);
       frame_access_state()->ClearSPDelta();
       frame_access_state()->SetFrameAccessToDefault();
       break;
@@ -1036,6 +1093,9 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       AssembleArchJump(i.InputRpo(0));
       DCHECK_EQ(LeaveRC, i.OutputRCBit());
       break;
+    case kArchBinarySearchSwitch:
+      AssembleArchBinarySearchSwitch(instr);
+      break;
     case kArchLookupSwitch:
       AssembleArchLookupSwitch(instr);
       DCHECK_EQ(LeaveRC, i.OutputRCBit());
@@ -1093,14 +1153,9 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
         __ mr(i.OutputRegister(), fp);
       }
       break;
-    case kArchRootsPointer:
-      __ mr(i.OutputRegister(), kRootRegister);
-      DCHECK_EQ(LeaveRC, i.OutputRCBit());
-      break;
     case kArchTruncateDoubleToI:
-      // TODO(mbrandy): move slow call to stub out of line.
-      __ TruncateDoubleToIDelayed(zone(), i.OutputRegister(),
-                                  i.InputDoubleRegister(0));
+      __ TruncateDoubleToI(isolate(), zone(), i.OutputRegister(),
+                           i.InputDoubleRegister(0), DetermineStubCallMode());
       DCHECK_EQ(LeaveRC, i.OutputRCBit());
       break;
     case kArchStoreWithWriteBarrier: {
@@ -1139,7 +1194,7 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
               Operand(offset.offset()));
       break;
     }
-    case kArchPoisonOnSpeculationWord:
+    case kArchWordPoisonOnSpeculation:
       __ and_(i.OutputRegister(), i.InputRegister(0),
               kSpeculationPoisonRegister);
       break;
@@ -1545,7 +1600,7 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       ASSEMBLE_IEEE754_UNOP(log10);
       break;
     case kIeee754Float64Pow: {
-      __ CallStubDelayed(new (zone()) MathPowStub());
+      __ Call(BUILTIN_CODE(isolate(), MathPowInternal), RelocInfo::CODE_TARGET);
       __ Move(d1, d3);
       break;
     }
@@ -1960,6 +2015,46 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
     case kWord32AtomicExchangeWord32:
       ASSEMBLE_ATOMIC_EXCHANGE_INTEGER(lwarx, stwcx);
       break;
+
+    case kWord32AtomicCompareExchangeInt8:
+      ASSEMBLE_ATOMIC_COMPARE_EXCHANGE_SIGN_EXT(cmp, lbarx, stbcx, extsb);
+      break;
+    case kWord32AtomicCompareExchangeUint8:
+      ASSEMBLE_ATOMIC_COMPARE_EXCHANGE(cmp, lbarx, stbcx);
+      break;
+    case kWord32AtomicCompareExchangeInt16:
+      ASSEMBLE_ATOMIC_COMPARE_EXCHANGE_SIGN_EXT(cmp, lharx, sthcx, extsh);
+      break;
+    case kWord32AtomicCompareExchangeUint16:
+      ASSEMBLE_ATOMIC_COMPARE_EXCHANGE(cmp, lharx, sthcx);
+      break;
+    case kWord32AtomicCompareExchangeWord32:
+      ASSEMBLE_ATOMIC_COMPARE_EXCHANGE(cmpw, lwarx, stwcx);
+      break;
+
+#define ATOMIC_BINOP_CASE(op, inst)                             \
+  case kWord32Atomic##op##Int8:                                 \
+    ASSEMBLE_ATOMIC_BINOP_SIGN_EXT(inst, lbarx, stbcx, extsb);  \
+    break;                                                      \
+  case kWord32Atomic##op##Uint8:                                \
+    ASSEMBLE_ATOMIC_BINOP(inst, lbarx, stbcx);                  \
+    break;                                                      \
+  case kWord32Atomic##op##Int16:                                \
+    ASSEMBLE_ATOMIC_BINOP_SIGN_EXT(inst, lharx, sthcx, extsh);  \
+    break;                                                      \
+  case kWord32Atomic##op##Uint16:                               \
+    ASSEMBLE_ATOMIC_BINOP(inst, lharx, sthcx);                  \
+    break;                                                      \
+  case kWord32Atomic##op##Word32:                               \
+    ASSEMBLE_ATOMIC_BINOP(inst, lwarx, stwcx);                  \
+    break;
+      ATOMIC_BINOP_CASE(Add, add)
+      ATOMIC_BINOP_CASE(Sub, sub)
+      ATOMIC_BINOP_CASE(And, and_)
+      ATOMIC_BINOP_CASE(Or, orx)
+      ATOMIC_BINOP_CASE(Xor, xor_)
+#undef ATOMIC_BINOP_CASE
+
     default:
       UNREACHABLE();
       break;
@@ -2019,39 +2114,26 @@ void CodeGenerator::AssembleArchTrap(Instruction* instr,
                                      FlagsCondition condition) {
   class OutOfLineTrap final : public OutOfLineCode {
    public:
-    OutOfLineTrap(CodeGenerator* gen, bool frame_elided, Instruction* instr)
-        : OutOfLineCode(gen),
-          frame_elided_(frame_elided),
-          instr_(instr),
-          gen_(gen) {}
+    OutOfLineTrap(CodeGenerator* gen, Instruction* instr)
+        : OutOfLineCode(gen), instr_(instr), gen_(gen) {}
 
     void Generate() final {
       PPCOperandConverter i(gen_, instr_);
-
-      Builtins::Name trap_id =
-          static_cast<Builtins::Name>(i.InputInt32(instr_->InputCount() - 1));
-      bool old_has_frame = __ has_frame();
-      if (frame_elided_) {
-        __ set_has_frame(true);
-        __ EnterFrame(StackFrame::WASM_COMPILED, true);
-      }
+      TrapId trap_id =
+          static_cast<TrapId>(i.InputInt32(instr_->InputCount() - 1));
       GenerateCallToTrap(trap_id);
-      if (frame_elided_) {
-        __ set_has_frame(old_has_frame);
-      }
     }
 
    private:
-    void GenerateCallToTrap(Builtins::Name trap_id) {
-      if (trap_id == Builtins::builtin_count) {
+    void GenerateCallToTrap(TrapId trap_id) {
+      if (trap_id == TrapId::kInvalid) {
         // We cannot test calls to the runtime in cctest/test-run-wasm.
         // Therefore we emit a call to C here instead of a call to the runtime.
         // We use the context register as the scratch register, because we do
         // not have a context here.
         __ PrepareCallCFunction(0, 0, cp);
-        __ CallCFunction(ExternalReference::wasm_call_trap_callback_for_testing(
-                             __ isolate()),
-                         0);
+        __ CallCFunction(
+            ExternalReference::wasm_call_trap_callback_for_testing(), 0);
         __ LeaveFrame(StackFrame::WASM_COMPILED);
         auto call_descriptor = gen_->linkage()->GetIncomingDescriptor();
         int pop_count =
@@ -2060,8 +2142,9 @@ void CodeGenerator::AssembleArchTrap(Instruction* instr,
         __ Ret();
       } else {
         gen_->AssembleSourcePosition(instr_);
-        __ Call(__ isolate()->builtins()->builtin_handle(trap_id),
-                RelocInfo::CODE_TARGET);
+        // A direct call to a wasm runtime stub defined in this module.
+        // Just encode the stub index. This will be patched at relocation.
+        __ Call(static_cast<Address>(trap_id), RelocInfo::WASM_STUB_CALL);
         ReferenceMap* reference_map =
             new (gen_->zone()) ReferenceMap(gen_->zone());
         gen_->RecordSafepoint(reference_map, Safepoint::kSimple, 0,
@@ -2072,12 +2155,10 @@ void CodeGenerator::AssembleArchTrap(Instruction* instr,
       }
     }
 
-    bool frame_elided_;
     Instruction* instr_;
     CodeGenerator* gen_;
   };
-  bool frame_elided = !frame_access_state()->has_frame();
-  auto ool = new (zone()) OutOfLineTrap(this, frame_elided, instr);
+  auto ool = new (zone()) OutOfLineTrap(this, instr);
   Label* tlabel = ool->entry();
   Label end;
 
@@ -2155,6 +2236,16 @@ void CodeGenerator::AssembleArchBoolean(Instruction* instr,
   __ bind(&done);
 }
 
+void CodeGenerator::AssembleArchBinarySearchSwitch(Instruction* instr) {
+  PPCOperandConverter i(this, instr);
+  Register input = i.InputRegister(0);
+  std::vector<std::pair<int32_t, Label*>> cases;
+  for (size_t index = 2; index < instr->InputCount(); index += 2) {
+    cases.push_back({i.InputInt32(index + 0), GetLabel(i.InputRpo(index + 1))});
+  }
+  AssembleArchBinarySearchSwitchRange(input, i.InputRpo(1), cases.data(),
+                                      cases.data() + cases.size());
+}
 
 void CodeGenerator::AssembleArchLookupSwitch(Instruction* instr) {
   PPCOperandConverter i(this, instr);
@@ -2166,7 +2257,6 @@ void CodeGenerator::AssembleArchLookupSwitch(Instruction* instr) {
   AssembleArchJump(i.InputRpo(1));
 }
 
-
 void CodeGenerator::AssembleArchTableSwitch(Instruction* instr) {
   PPCOperandConverter i(this, instr);
   Register input = i.InputRegister(0);
@@ -2234,6 +2324,9 @@ void CodeGenerator::AssembleConstructFrame() {
       // TODO(mbrandy): Detect cases where ip is the entrypoint (for
       // efficient intialization of the constant pool pointer register).
       __ StubPrologue(type);
+      if (call_descriptor->IsWasmFunctionCall()) {
+        __ Push(kWasmInstanceRegister);
+      }
     }
   }
 
@@ -2253,33 +2346,88 @@ void CodeGenerator::AssembleConstructFrame() {
     ResetSpeculationPoison();
   }
 
-  const RegList double_saves = call_descriptor->CalleeSavedFPRegisters();
+  const RegList saves_fp = call_descriptor->CalleeSavedFPRegisters();
+  const RegList saves = FLAG_enable_embedded_constant_pool
+                            ? call_descriptor->CalleeSavedRegisters() &
+                                  ~kConstantPoolRegister.bit()
+                            : call_descriptor->CalleeSavedRegisters();
+
   if (shrink_slots > 0) {
+    if (info()->IsWasm() && shrink_slots > 128) {
+      // For WebAssembly functions with big frames we have to do the stack
+      // overflow check before we construct the frame. Otherwise we may not
+      // have enough space on the stack to call the runtime for the stack
+      // overflow.
+      Label done;
+
+      // If the frame is bigger than the stack, we throw the stack overflow
+      // exception unconditionally. Thereby we can avoid the integer overflow
+      // check in the condition code.
+      if ((shrink_slots * kPointerSize) < (FLAG_stack_size * 1024)) {
+        Register scratch = ip;
+        __ LoadP(scratch, FieldMemOperand(
+                            kWasmInstanceRegister,
+                            WasmInstanceObject::kRealStackLimitAddressOffset));
+        __ LoadP(scratch, MemOperand(scratch), r0);
+        __ Add(scratch, scratch, shrink_slots * kPointerSize, r0);
+        __ cmpl(sp, scratch);
+        __ bge(&done);
+      }
+
+      __ LoadP(r3,
+               FieldMemOperand(kWasmInstanceRegister,
+                               WasmInstanceObject::kCEntryStubOffset),
+               r0);
+      __ Move(cp, Smi::kZero);
+      __ CallRuntimeWithCEntry(Runtime::kThrowWasmStackOverflow, r3);
+      // We come from WebAssembly, there are no references for the GC.
+      ReferenceMap* reference_map = new (zone()) ReferenceMap(zone());
+      RecordSafepoint(reference_map, Safepoint::kSimple, 0,
+                      Safepoint::kNoLazyDeopt);
+      if (FLAG_debug_code) {
+        __ stop(GetAbortReason(AbortReason::kUnexpectedReturnFromThrow));
+      }
+
+      __ bind(&done);
+    }
+
+    // Skip callee-saved and return slots, which are pushed below.
+    shrink_slots -= base::bits::CountPopulation(saves);
+    shrink_slots -= frame()->GetReturnSlotCount();
+    shrink_slots -=
+        (kDoubleSize / kPointerSize) * base::bits::CountPopulation(saves_fp);
     __ Add(sp, sp, -shrink_slots * kPointerSize, r0);
   }
 
   // Save callee-saved Double registers.
-  if (double_saves != 0) {
-    __ MultiPushDoubles(double_saves);
-    DCHECK_EQ(kNumCalleeSavedDoubles,
-              base::bits::CountPopulation(double_saves));
+  if (saves_fp != 0) {
+    __ MultiPushDoubles(saves_fp);
+    DCHECK_EQ(kNumCalleeSavedDoubles, base::bits::CountPopulation(saves_fp));
   }
 
   // Save callee-saved registers.
-  const RegList saves = FLAG_enable_embedded_constant_pool
-                            ? call_descriptor->CalleeSavedRegisters() &
-                                  ~kConstantPoolRegister.bit()
-                            : call_descriptor->CalleeSavedRegisters();
   if (saves != 0) {
     __ MultiPush(saves);
     // register save area does not include the fp or constant pool pointer.
   }
+
+  const int returns = frame()->GetReturnSlotCount();
+  if (returns != 0) {
+    // Create space for returns.
+    __ Add(sp, sp, -returns * kPointerSize, r0);
+  }
 }
 
 void CodeGenerator::AssembleReturn(InstructionOperand* pop) {
   auto call_descriptor = linkage()->GetIncomingDescriptor();
   int pop_count = static_cast<int>(call_descriptor->StackParameterCount());
 
+  const int returns = frame()->GetReturnSlotCount();
+  if (returns != 0) {
+    // Create space for returns.
+    __ Add(sp, sp, returns * kPointerSize, r0);
+  }
+
   // Restore registers.
   const RegList saves = FLAG_enable_embedded_constant_pool
                             ? call_descriptor->CalleeSavedRegisters() &
@@ -2386,7 +2534,7 @@ void CodeGenerator::AssembleMove(InstructionOperand* source,
           __ mov(dst, Operand::EmbeddedNumber(src.ToFloat64().value()));
           break;
         case Constant::kExternalReference:
-          __ mov(dst, Operand(src.ToExternalReference()));
+          __ Move(dst, src.ToExternalReference());
           break;
         case Constant::kHeapObject: {
           Handle<HeapObject> src_object = src.ToHeapObject();
diff --git a/deps/v8/src/compiler/ppc/instruction-selector-ppc.cc b/deps/v8/src/compiler/ppc/instruction-selector-ppc.cc
index b96c4d573264c5..b02e80d389a3bf 100644
--- a/deps/v8/src/compiler/ppc/instruction-selector-ppc.cc
+++ b/deps/v8/src/compiler/ppc/instruction-selector-ppc.cc
@@ -66,6 +66,17 @@ class PPCOperandGenerator final : public OperandGenerator {
     }
     return false;
   }
+
+  // Use the stack pointer if the node is LoadStackPointer, otherwise assign a
+  // register.
+  InstructionOperand UseRegisterOrStackPointer(Node* node) {
+    if (node->opcode() == IrOpcode::kLoadStackPointer) {
+      return LocationOperand(LocationOperand::EXPLICIT,
+                             LocationOperand::REGISTER,
+                             MachineRepresentation::kWord32, sp.code());
+    }
+    return UseRegister(node);
+  }
 };
 
 
@@ -219,7 +230,7 @@ void InstructionSelector::VisitLoad(Node* node) {
   }
 
   if (node->opcode() == IrOpcode::kPoisonedLoad &&
-      poisoning_enabled_ == PoisoningMitigationLevel::kOn) {
+      poisoning_level_ != PoisoningMitigationLevel::kDontPoison) {
     opcode |= MiscField::encode(kMemoryAccessPoisoned);
   }
 
@@ -1483,15 +1494,15 @@ void VisitWordCompare(InstructionSelector* selector, Node* node,
 
   // Match immediates on left or right side of comparison.
   if (g.CanBeImmediate(right, immediate_mode)) {
-    VisitCompare(selector, opcode, g.UseRegister(left), g.UseImmediate(right),
-                 cont);
+    VisitCompare(selector, opcode, g.UseRegisterOrStackPointer(left),
+                 g.UseImmediate(right), cont);
   } else if (g.CanBeImmediate(left, immediate_mode)) {
     if (!commutative) cont->Commute();
-    VisitCompare(selector, opcode, g.UseRegister(right), g.UseImmediate(left),
-                 cont);
+    VisitCompare(selector, opcode, g.UseRegisterOrStackPointer(right),
+                 g.UseImmediate(left), cont);
   } else {
-    VisitCompare(selector, opcode, g.UseRegister(left), g.UseRegister(right),
-                 cont);
+    VisitCompare(selector, opcode, g.UseRegisterOrStackPointer(left),
+                 g.UseRegisterOrStackPointer(right), cont);
   }
 }
 
@@ -1708,8 +1719,8 @@ void InstructionSelector::VisitSwitch(Node* node, const SwitchInfo& sw) {
     }
   }
 
-  // Generate a sequence of conditional jumps.
-  return EmitLookupSwitch(sw, value_operand);
+  // Generate a tree of conditional jumps.
+  return EmitBinarySearchSwitch(sw, value_operand);
 }
 
 
@@ -1995,18 +2006,100 @@ void InstructionSelector::VisitWord32AtomicExchange(Node* node) {
 }
 
 void InstructionSelector::VisitWord32AtomicCompareExchange(Node* node) {
-  UNIMPLEMENTED();
+  PPCOperandGenerator g(this);
+  Node* base = node->InputAt(0);
+  Node* index = node->InputAt(1);
+  Node* old_value = node->InputAt(2);
+  Node* new_value = node->InputAt(3);
+
+  MachineType type = AtomicOpRepresentationOf(node->op());
+  ArchOpcode opcode = kArchNop;
+  if (type == MachineType::Int8()) {
+    opcode = kWord32AtomicCompareExchangeInt8;
+  } else if (type == MachineType::Uint8()) {
+    opcode = kWord32AtomicCompareExchangeUint8;
+  } else if (type == MachineType::Int16()) {
+    opcode = kWord32AtomicCompareExchangeInt16;
+  } else if (type == MachineType::Uint16()) {
+    opcode = kWord32AtomicCompareExchangeUint16;
+  } else if (type == MachineType::Int32() || type == MachineType::Uint32()) {
+    opcode = kWord32AtomicCompareExchangeWord32;
+  } else {
+    UNREACHABLE();
+    return;
+  }
+  AddressingMode addressing_mode = kMode_MRR;
+  InstructionCode code = opcode | AddressingModeField::encode(addressing_mode);
+
+  InstructionOperand inputs[4];
+  size_t input_count = 0;
+  inputs[input_count++] = g.UseUniqueRegister(base);
+  inputs[input_count++] = g.UseUniqueRegister(index);
+  inputs[input_count++] = g.UseUniqueRegister(old_value);
+  inputs[input_count++] = g.UseUniqueRegister(new_value);
+
+  InstructionOperand outputs[1];
+  size_t output_count = 0;
+  outputs[output_count++] = g.DefineAsRegister(node);
+
+  Emit(code, output_count, outputs, input_count, inputs);
 }
 
-void InstructionSelector::VisitWord32AtomicAdd(Node* node) { UNIMPLEMENTED(); }
+void InstructionSelector::VisitWord32AtomicBinaryOperation(
+    Node* node, ArchOpcode int8_op, ArchOpcode uint8_op, ArchOpcode int16_op,
+    ArchOpcode uint16_op, ArchOpcode word32_op) {
+  PPCOperandGenerator g(this);
+  Node* base = node->InputAt(0);
+  Node* index = node->InputAt(1);
+  Node* value = node->InputAt(2);
 
-void InstructionSelector::VisitWord32AtomicSub(Node* node) { UNIMPLEMENTED(); }
+  MachineType type = AtomicOpRepresentationOf(node->op());
+  ArchOpcode opcode = kArchNop;
 
-void InstructionSelector::VisitWord32AtomicAnd(Node* node) { UNIMPLEMENTED(); }
+  if (type == MachineType::Int8()) {
+    opcode = int8_op;
+  } else if (type == MachineType::Uint8()) {
+    opcode = uint8_op;
+  } else if (type == MachineType::Int16()) {
+    opcode = int16_op;
+  } else if (type == MachineType::Uint16()) {
+    opcode = uint16_op;
+  } else if (type == MachineType::Int32() || type == MachineType::Uint32()) {
+    opcode = word32_op;
+  } else {
+    UNREACHABLE();
+    return;
+  }
+  AddressingMode addressing_mode = kMode_MRR;
+  InstructionCode code = opcode | AddressingModeField::encode(addressing_mode);
+  InstructionOperand inputs[3];
+
+  size_t input_count = 0;
+  inputs[input_count++] = g.UseUniqueRegister(base);
+  inputs[input_count++] = g.UseUniqueRegister(index);
+  inputs[input_count++] = g.UseUniqueRegister(value);
 
-void InstructionSelector::VisitWord32AtomicOr(Node* node) { UNIMPLEMENTED(); }
+  InstructionOperand outputs[1];
+  size_t output_count = 0;
+  outputs[output_count++] = g.DefineAsRegister(node);
+
+  Emit(code, output_count, outputs, input_count, inputs);
+}
+
+#define VISIT_ATOMIC_BINOP(op)                                   \
+  void InstructionSelector::VisitWord32Atomic##op(Node* node) {  \
+    VisitWord32AtomicBinaryOperation(                            \
+        node, kWord32Atomic##op##Int8, kWord32Atomic##op##Uint8, \
+        kWord32Atomic##op##Int16, kWord32Atomic##op##Uint16,     \
+        kWord32Atomic##op##Word32);                              \
+  }
+VISIT_ATOMIC_BINOP(Add)
+VISIT_ATOMIC_BINOP(Sub)
+VISIT_ATOMIC_BINOP(And)
+VISIT_ATOMIC_BINOP(Or)
+VISIT_ATOMIC_BINOP(Xor)
+#undef VISIT_ATOMIC_BINOP
 
-void InstructionSelector::VisitWord32AtomicXor(Node* node) { UNIMPLEMENTED(); }
 
 void InstructionSelector::VisitInt32AbsWithOverflow(Node* node) {
   UNREACHABLE();
diff --git a/deps/v8/src/compiler/property-access-builder.cc b/deps/v8/src/compiler/property-access-builder.cc
index 284da9350ae481..a04e44e9c2d3da 100644
--- a/deps/v8/src/compiler/property-access-builder.cc
+++ b/deps/v8/src/compiler/property-access-builder.cc
@@ -4,9 +4,9 @@
 
 #include "src/compiler/property-access-builder.h"
 
-#include "src/compilation-dependencies.h"
 #include "src/compiler/access-builder.h"
 #include "src/compiler/access-info.h"
+#include "src/compiler/compilation-dependencies.h"
 #include "src/compiler/js-graph.h"
 #include "src/compiler/node-matchers.h"
 #include "src/compiler/simplified-operator.h"
@@ -136,7 +136,7 @@ void PropertyAccessBuilder::BuildCheckMaps(
     if (receiver_map->is_stable()) {
       for (Handle<Map> map : receiver_maps) {
         if (map.is_identical_to(receiver_map)) {
-          dependencies()->AssumeMapStable(receiver_map);
+          dependencies()->DependOnStableMap(receiver_map);
           return;
         }
       }
@@ -168,22 +168,6 @@ Node* PropertyAccessBuilder::BuildCheckValue(Node* receiver, Node** effect,
   return expected;
 }
 
-void PropertyAccessBuilder::AssumePrototypesStable(
-    Handle<Context> native_context,
-    std::vector<Handle<Map>> const& receiver_maps, Handle<JSObject> holder) {
-  // Determine actual holder and perform prototype chain checks.
-  for (auto map : receiver_maps) {
-    // Perform the implicit ToObject for primitives here.
-    // Implemented according to ES6 section 7.3.2 GetV (V, P).
-    Handle<JSFunction> constructor;
-    if (Map::GetConstructorFunction(map, native_context)
-            .ToHandle(&constructor)) {
-      map = handle(constructor->initial_map(), holder->GetIsolate());
-    }
-    dependencies()->AssumePrototypeMapsStable(map, holder);
-  }
-}
-
 Node* PropertyAccessBuilder::ResolveHolder(
     PropertyAccessInfo const& access_info, Node* receiver) {
   Handle<JSObject> holder;
@@ -211,18 +195,17 @@ Node* PropertyAccessBuilder::TryBuildLoadConstantDataField(
     // but for now let's just do what Crankshaft does.
     LookupIterator it(m.Value(), name, LookupIterator::OWN_SKIP_INTERCEPTOR);
     if (it.state() == LookupIterator::DATA) {
-      bool is_reaonly_non_configurable =
+      bool is_readonly_non_configurable =
           it.IsReadOnly() && !it.IsConfigurable();
-      if (is_reaonly_non_configurable ||
+      if (is_readonly_non_configurable ||
           (FLAG_track_constant_fields && access_info.IsDataConstantField())) {
         Node* value = jsgraph()->Constant(JSReceiver::GetDataProperty(&it));
-        if (!is_reaonly_non_configurable) {
+        if (!is_readonly_non_configurable) {
           // It's necessary to add dependency on the map that introduced
           // the field.
           DCHECK(access_info.IsDataConstantField());
           DCHECK(!it.is_dictionary_holder());
-          Handle<Map> field_owner_map = it.GetFieldOwnerMap();
-          dependencies()->AssumeFieldOwner(field_owner_map);
+          dependencies()->DependOnFieldType(&it);
         }
         return value;
       }
@@ -242,7 +225,7 @@ Node* PropertyAccessBuilder::BuildLoadDataField(
   }
 
   FieldIndex const field_index = access_info.field_index();
-  Type* const field_type = access_info.field_type();
+  Type const field_type = access_info.field_type();
   MachineRepresentation const field_representation =
       access_info.field_representation();
   Node* storage = receiver;
@@ -280,7 +263,7 @@ Node* PropertyAccessBuilder::BuildLoadDataField(
     Handle<Map> field_map;
     if (access_info.field_map().ToHandle(&field_map)) {
       if (field_map->is_stable()) {
-        dependencies()->AssumeMapStable(field_map);
+        dependencies()->DependOnStableMap(field_map);
         field_access.map = field_map;
       }
     }
diff --git a/deps/v8/src/compiler/property-access-builder.h b/deps/v8/src/compiler/property-access-builder.h
index 13a0f0b46fd257..50f25f04c8045a 100644
--- a/deps/v8/src/compiler/property-access-builder.h
+++ b/deps/v8/src/compiler/property-access-builder.h
@@ -13,12 +13,10 @@
 
 namespace v8 {
 namespace internal {
-
-class CompilationDependencies;
-
 namespace compiler {
 
 class CommonOperatorBuilder;
+class CompilationDependencies;
 class Graph;
 class JSGraph;
 class Node;
@@ -44,12 +42,6 @@ class PropertyAccessBuilder {
   Node* BuildCheckValue(Node* receiver, Node** effect, Node* control,
                         Handle<HeapObject> value);
 
-  // Adds stability dependencies on all prototypes of every class in
-  // {receiver_type} up to (and including) the {holder}.
-  void AssumePrototypesStable(Handle<Context> native_context,
-                              std::vector<Handle<Map>> const& receiver_maps,
-                              Handle<JSObject> holder);
-
   // Builds the actual load for data-field and data-constant-field
   // properties (without heap-object or map checks).
   Node* BuildLoadDataField(Handle<Name> name,
diff --git a/deps/v8/src/compiler/raw-machine-assembler.cc b/deps/v8/src/compiler/raw-machine-assembler.cc
index a2b2269456a564..9e7bc9a61142b8 100644
--- a/deps/v8/src/compiler/raw-machine-assembler.cc
+++ b/deps/v8/src/compiler/raw-machine-assembler.cc
@@ -17,19 +17,24 @@ RawMachineAssembler::RawMachineAssembler(
     Isolate* isolate, Graph* graph, CallDescriptor* call_descriptor,
     MachineRepresentation word, MachineOperatorBuilder::Flags flags,
     MachineOperatorBuilder::AlignmentRequirements alignment_requirements,
-    PoisoningMitigationLevel poisoning_enabled)
+    PoisoningMitigationLevel poisoning_level)
     : isolate_(isolate),
       graph_(graph),
       schedule_(new (zone()) Schedule(zone())),
       machine_(zone(), word, flags, alignment_requirements),
       common_(zone()),
       call_descriptor_(call_descriptor),
+      target_parameter_(nullptr),
       parameters_(parameter_count(), zone()),
       current_block_(schedule()->start()),
-      poisoning_enabled_(poisoning_enabled) {
+      poisoning_level_(poisoning_level) {
   int param_count = static_cast<int>(parameter_count());
   // Add an extra input for the JSFunction parameter to the start node.
   graph->SetStart(graph->NewNode(common_.Start(param_count + 1)));
+  if (call_descriptor->IsJSFunctionCall()) {
+    target_parameter_ = AddNode(
+        common()->Parameter(Linkage::kJSCallClosureParamIndex), graph->start());
+  }
   for (size_t i = 0; i < parameter_count(); ++i) {
     parameters_[i] =
         AddNode(common()->Parameter(static_cast<int>(i)), graph->start());
@@ -55,17 +60,16 @@ Node* RawMachineAssembler::RelocatableIntPtrConstant(intptr_t value,
 Schedule* RawMachineAssembler::Export() {
   // Compute the correct codegen order.
   DCHECK(schedule_->rpo_order()->empty());
-  OFStream os(stdout);
   if (FLAG_trace_turbo_scheduler) {
     PrintF("--- RAW SCHEDULE -------------------------------------------\n");
-    os << *schedule_;
+    StdoutStream{} << *schedule_;
   }
   schedule_->EnsureCFGWellFormedness();
   Scheduler::ComputeSpecialRPO(zone(), schedule_);
   schedule_->PropagateDeferredMark();
   if (FLAG_trace_turbo_scheduler) {
     PrintF("--- EDGE SPLIT AND PROPAGATED DEFERRED SCHEDULE ------------\n");
-    os << *schedule_;
+    StdoutStream{} << *schedule_;
   }
   // Invalidate RawMachineAssembler.
   Schedule* schedule = schedule_;
@@ -73,6 +77,10 @@ Schedule* RawMachineAssembler::Export() {
   return schedule;
 }
 
+Node* RawMachineAssembler::TargetParameter() {
+  DCHECK_NOT_NULL(target_parameter_);
+  return target_parameter_;
+}
 
 Node* RawMachineAssembler::Parameter(size_t index) {
   DCHECK(index < parameter_count());
diff --git a/deps/v8/src/compiler/raw-machine-assembler.h b/deps/v8/src/compiler/raw-machine-assembler.h
index 251a13416e61ca..ff8bebc411f562 100644
--- a/deps/v8/src/compiler/raw-machine-assembler.h
+++ b/deps/v8/src/compiler/raw-machine-assembler.h
@@ -45,8 +45,8 @@ class V8_EXPORT_PRIVATE RawMachineAssembler {
       MachineOperatorBuilder::AlignmentRequirements alignment_requirements =
           MachineOperatorBuilder::AlignmentRequirements::
               FullUnalignedAccessSupport(),
-      PoisoningMitigationLevel poisoning_enabled =
-          PoisoningMitigationLevel::kOn);
+      PoisoningMitigationLevel poisoning_level =
+          PoisoningMitigationLevel::kPoisonCriticalOnly);
   ~RawMachineAssembler() {}
 
   Isolate* isolate() const { return isolate_; }
@@ -55,9 +55,7 @@ class V8_EXPORT_PRIVATE RawMachineAssembler {
   MachineOperatorBuilder* machine() { return &machine_; }
   CommonOperatorBuilder* common() { return &common_; }
   CallDescriptor* call_descriptor() const { return call_descriptor_; }
-  PoisoningMitigationLevel poisoning_enabled() const {
-    return poisoning_enabled_;
-  }
+  PoisoningMitigationLevel poisoning_level() const { return poisoning_level_; }
 
   // Finalizes the schedule and exports it to be used for code generation. Note
   // that this RawMachineAssembler becomes invalid after export.
@@ -128,8 +126,9 @@ class V8_EXPORT_PRIVATE RawMachineAssembler {
   Node* Load(MachineType rep, Node* base, Node* index,
              LoadSensitivity needs_poisoning = LoadSensitivity::kSafe) {
     const Operator* op = machine()->Load(rep);
-    if (needs_poisoning == LoadSensitivity::kNeedsPoisoning &&
-        poisoning_enabled_ == PoisoningMitigationLevel::kOn) {
+    CHECK_NE(PoisoningMitigationLevel::kPoisonAll, poisoning_level_);
+    if (needs_poisoning == LoadSensitivity::kCritical &&
+        poisoning_level_ == PoisoningMitigationLevel::kPoisonCriticalOnly) {
       op = machine()->PoisonedLoad(rep);
     }
     return AddNode(op, base, index);
@@ -578,6 +577,13 @@ class V8_EXPORT_PRIVATE RawMachineAssembler {
     return AddNode(machine()->BitcastTaggedToWord(), a);
 #else
     return a;
+#endif
+  }
+  Node* BitcastMaybeObjectToWord(Node* a) {
+#ifdef ENABLE_VERIFY_CSA
+    return AddNode(machine()->BitcastMaybeObjectToWord(), a);
+#else
+    return a;
 #endif
   }
   Node* BitcastWordToTagged(Node* a) {
@@ -735,10 +741,8 @@ class V8_EXPORT_PRIVATE RawMachineAssembler {
     return AddNode(machine()->LoadParentFramePointer());
   }
 
-  // Root pointer operations.
-  Node* LoadRootsPointer() { return AddNode(machine()->LoadRootsPointer()); }
-
   // Parameters.
+  Node* TargetParameter();
   Node* Parameter(size_t index);
 
   // Pointer utilities.
@@ -760,15 +764,17 @@ class V8_EXPORT_PRIVATE RawMachineAssembler {
     return HeapConstant(isolate()->factory()->InternalizeUtf8String(string));
   }
 
-  Node* PoisonOnSpeculationTagged(Node* value) {
-    if (poisoning_enabled_ == PoisoningMitigationLevel::kOn)
-      return AddNode(machine()->PoisonOnSpeculationTagged(), value);
+  Node* TaggedPoisonOnSpeculation(Node* value) {
+    if (poisoning_level_ != PoisoningMitigationLevel::kDontPoison) {
+      return AddNode(machine()->TaggedPoisonOnSpeculation(), value);
+    }
     return value;
   }
 
-  Node* PoisonOnSpeculationWord(Node* value) {
-    if (poisoning_enabled_ == PoisoningMitigationLevel::kOn)
-      return AddNode(machine()->PoisonOnSpeculationWord(), value);
+  Node* WordPoisonOnSpeculation(Node* value) {
+    if (poisoning_level_ != PoisoningMitigationLevel::kDontPoison) {
+      return AddNode(machine()->WordPoisonOnSpeculation(), value);
+    }
     return value;
   }
 
@@ -931,9 +937,10 @@ class V8_EXPORT_PRIVATE RawMachineAssembler {
   MachineOperatorBuilder machine_;
   CommonOperatorBuilder common_;
   CallDescriptor* call_descriptor_;
+  Node* target_parameter_;
   NodeVector parameters_;
   BasicBlock* current_block_;
-  PoisoningMitigationLevel poisoning_enabled_;
+  PoisoningMitigationLevel poisoning_level_;
 
   DISALLOW_COPY_AND_ASSIGN(RawMachineAssembler);
 };
diff --git a/deps/v8/src/compiler/redundancy-elimination.cc b/deps/v8/src/compiler/redundancy-elimination.cc
index 25f42efdcd62ca..5ecef0408be4c8 100644
--- a/deps/v8/src/compiler/redundancy-elimination.cc
+++ b/deps/v8/src/compiler/redundancy-elimination.cc
@@ -255,7 +255,7 @@ Reduction RedundancyElimination::TryReuseBoundsCheckForFirstInput(Node* node) {
     if (Node* bounds_check = checks->LookupBoundsCheckFor(left)) {
       // Only use the bounds checked type if it is better.
       if (NodeProperties::GetType(bounds_check)
-              ->Is(NodeProperties::GetType(left))) {
+              .Is(NodeProperties::GetType(left))) {
         node->ReplaceInput(0, bounds_check);
       }
     }
diff --git a/deps/v8/src/compiler/register-allocator-verifier.cc b/deps/v8/src/compiler/register-allocator-verifier.cc
index 8c150d975ad49d..f294471fd316ae 100644
--- a/deps/v8/src/compiler/register-allocator-verifier.cc
+++ b/deps/v8/src/compiler/register-allocator-verifier.cc
@@ -312,7 +312,7 @@ void BlockAssessments::DropRegisters() {
 }
 
 void BlockAssessments::Print() const {
-  OFStream os(stdout);
+  StdoutStream os;
   for (const auto pair : map()) {
     const InstructionOperand op = pair.first;
     const Assessment* assessment = pair.second;
diff --git a/deps/v8/src/compiler/register-allocator.cc b/deps/v8/src/compiler/register-allocator.cc
index a75317914ae5a4..1938ef22b63237 100644
--- a/deps/v8/src/compiler/register-allocator.cc
+++ b/deps/v8/src/compiler/register-allocator.cc
@@ -376,12 +376,7 @@ UseInterval* UseInterval::SplitAt(LifetimePosition pos, Zone* zone) {
   return after;
 }
 
-
-void LifetimePosition::Print() const {
-  OFStream os(stdout);
-  os << *this << std::endl;
-}
-
+void LifetimePosition::Print() const { StdoutStream{} << *this << std::endl; }
 
 std::ostream& operator<<(std::ostream& os, const LifetimePosition pos) {
   os << '@' << pos.ToInstructionIndex();
@@ -807,7 +802,7 @@ LifetimePosition LiveRange::FirstIntersection(LiveRange* other) const {
 
 void LiveRange::Print(const RegisterConfiguration* config,
                       bool with_children) const {
-  OFStream os(stdout);
+  StdoutStream os;
   PrintableLiveRange wrapper;
   wrapper.register_configuration_ = config;
   for (const LiveRange* i = this; i != nullptr; i = i->next()) {
@@ -1316,7 +1311,7 @@ void SpillRange::MergeDisjointIntervals(UseInterval* other) {
 
 
 void SpillRange::Print() const {
-  OFStream os(stdout);
+  StdoutStream os;
   os << "{" << std::endl;
   for (TopLevelLiveRange* range : live_ranges()) {
     os << range->vreg() << " ";
@@ -1503,7 +1498,10 @@ bool RegisterAllocationData::ExistsUseWithoutDefinition() {
 // will be transferred via a move in the Gap::END's of the last instruction
 // of a deferred block.
 bool RegisterAllocationData::RangesDefinedInDeferredStayInDeferred() {
+  const size_t live_ranges_size = live_ranges().size();
   for (const TopLevelLiveRange* range : live_ranges()) {
+    CHECK_EQ(live_ranges_size,
+             live_ranges().size());  // TODO(neis): crbug.com/831822
     if (range == nullptr || range->IsEmpty() ||
         !code()
              ->GetInstructionBlock(range->Start().ToInstructionIndex())
@@ -2407,7 +2405,10 @@ void LiveRangeBuilder::BuildLiveRanges() {
     live_in_sets()[block_id] = live;
   }
   // Postprocess the ranges.
+  const size_t live_ranges_size = data()->live_ranges().size();
   for (TopLevelLiveRange* range : data()->live_ranges()) {
+    CHECK_EQ(live_ranges_size,
+             data()->live_ranges().size());  // TODO(neis): crbug.com/831822
     if (range == nullptr) continue;
     // Give slots to all ranges with a non fixed slot use.
     if (range->has_slot_use() && range->HasNoSpillType()) {
@@ -2573,6 +2574,8 @@ LifetimePosition RegisterAllocator::GetSplitPositionForInstruction(
 void RegisterAllocator::SplitAndSpillRangesDefinedByMemoryOperand() {
   size_t initial_range_count = data()->live_ranges().size();
   for (size_t i = 0; i < initial_range_count; ++i) {
+    CHECK_EQ(initial_range_count,
+             data()->live_ranges().size());  // TODO(neis): crbug.com/831822
     TopLevelLiveRange* range = data()->live_ranges()[i];
     if (!CanProcessRange(range)) continue;
     if (range->HasNoSpillType() ||
@@ -2739,15 +2742,12 @@ const char* RegisterAllocator::RegisterName(int register_code) const {
   }
 }
 
-
 LinearScanAllocator::LinearScanAllocator(RegisterAllocationData* data,
                                          RegisterKind kind, Zone* local_zone)
     : RegisterAllocator(data, kind),
       unhandled_live_ranges_(local_zone),
       active_live_ranges_(local_zone),
       inactive_live_ranges_(local_zone) {
-  unhandled_live_ranges().reserve(
-      static_cast<size_t>(code()->VirtualRegisterCount() * 2));
   active_live_ranges().reserve(8);
   inactive_live_ranges().reserve(8);
   // TryAllocateFreeReg and AllocateBlockedReg assume this
@@ -2764,17 +2764,18 @@ void LinearScanAllocator::AllocateRegisters() {
 
   SplitAndSpillRangesDefinedByMemoryOperand();
 
+  const size_t live_ranges_size = data()->live_ranges().size();
   for (TopLevelLiveRange* range : data()->live_ranges()) {
+    CHECK_EQ(live_ranges_size,
+             data()->live_ranges().size());  // TODO(neis): crbug.com/831822
     if (!CanProcessRange(range)) continue;
     for (LiveRange* to_add = range; to_add != nullptr;
          to_add = to_add->next()) {
       if (!to_add->spilled()) {
-        AddToUnhandledUnsorted(to_add);
+        AddToUnhandled(to_add);
       }
     }
   }
-  SortUnhandled();
-  DCHECK(UnhandledIsSorted());
 
   if (mode() == GENERAL_REGISTERS) {
     for (TopLevelLiveRange* current : data()->fixed_live_ranges()) {
@@ -2795,10 +2796,8 @@ void LinearScanAllocator::AllocateRegisters() {
   }
 
   while (!unhandled_live_ranges().empty()) {
-    DCHECK(UnhandledIsSorted());
-    LiveRange* current = unhandled_live_ranges().back();
-    unhandled_live_ranges().pop_back();
-    DCHECK(UnhandledIsSorted());
+    LiveRange* current = *unhandled_live_ranges().begin();
+    unhandled_live_ranges().erase(unhandled_live_ranges().begin());
     LifetimePosition position = current->Start();
 #ifdef DEBUG
     allocation_finger_ = position;
@@ -2851,7 +2850,7 @@ bool LinearScanAllocator::TrySplitAndSpillSplinter(LiveRange* range) {
     return false;
   } else if (next_reg->pos().PrevStart() > range->Start()) {
     LiveRange* tail = SplitRangeAt(range, next_reg->pos().PrevStart());
-    AddToUnhandledSorted(tail);
+    AddToUnhandled(tail);
     Spill(range);
     return true;
   }
@@ -2882,64 +2881,14 @@ void LinearScanAllocator::AddToInactive(LiveRange* range) {
   inactive_live_ranges().push_back(range);
 }
 
-
-void LinearScanAllocator::AddToUnhandledSorted(LiveRange* range) {
+void LinearScanAllocator::AddToUnhandled(LiveRange* range) {
   if (range == nullptr || range->IsEmpty()) return;
   DCHECK(!range->HasRegisterAssigned() && !range->spilled());
   DCHECK(allocation_finger_ <= range->Start());
-  for (int i = static_cast<int>(unhandled_live_ranges().size() - 1); i >= 0;
-       --i) {
-    LiveRange* cur_range = unhandled_live_ranges().at(i);
-    if (!range->ShouldBeAllocatedBefore(cur_range)) continue;
-    TRACE("Add live range %d:%d to unhandled at %d\n",
-          range->TopLevel()->vreg(), range->relative_id(), i + 1);
-    auto it = unhandled_live_ranges().begin() + (i + 1);
-    unhandled_live_ranges().insert(it, range);
-    DCHECK(UnhandledIsSorted());
-    return;
-  }
-  TRACE("Add live range %d:%d to unhandled at start\n",
-        range->TopLevel()->vreg(), range->relative_id());
-  unhandled_live_ranges().insert(unhandled_live_ranges().begin(), range);
-  DCHECK(UnhandledIsSorted());
-}
 
-
-void LinearScanAllocator::AddToUnhandledUnsorted(LiveRange* range) {
-  if (range == nullptr || range->IsEmpty()) return;
-  DCHECK(!range->HasRegisterAssigned() && !range->spilled());
-  TRACE("Add live range %d:%d to unhandled unsorted at end\n",
-        range->TopLevel()->vreg(), range->relative_id());
-  unhandled_live_ranges().push_back(range);
-}
-
-
-static bool UnhandledSortHelper(LiveRange* a, LiveRange* b) {
-  DCHECK(!a->ShouldBeAllocatedBefore(b) || !b->ShouldBeAllocatedBefore(a));
-  if (a->ShouldBeAllocatedBefore(b)) return false;
-  if (b->ShouldBeAllocatedBefore(a)) return true;
-  return a->TopLevel()->vreg() < b->TopLevel()->vreg();
-}
-
-
-// Sort the unhandled live ranges so that the ranges to be processed first are
-// at the end of the array list.  This is convenient for the register allocation
-// algorithm because it is efficient to remove elements from the end.
-void LinearScanAllocator::SortUnhandled() {
-  TRACE("Sort unhandled\n");
-  std::sort(unhandled_live_ranges().begin(), unhandled_live_ranges().end(),
-            &UnhandledSortHelper);
-}
-
-
-bool LinearScanAllocator::UnhandledIsSorted() {
-  size_t len = unhandled_live_ranges().size();
-  for (size_t i = 1; i < len; i++) {
-    LiveRange* a = unhandled_live_ranges().at(i - 1);
-    LiveRange* b = unhandled_live_ranges().at(i);
-    if (a->Start() < b->Start()) return false;
-  }
-  return true;
+  TRACE("Add live range %d:%d to unhandled\n", range->TopLevel()->vreg(),
+        range->relative_id());
+  unhandled_live_ranges().insert(range);
 }
 
 
@@ -3140,11 +3089,22 @@ bool LinearScanAllocator::TryAllocateFreeReg(
 
   DCHECK_GE(free_until_pos.length(), num_codes);
 
-  // Find the register which stays free for the longest time.
-  int reg = codes[0];
-  for (int i = 1; i < num_codes; ++i) {
+  // Find the register which stays free for the longest time. Check for
+  // the hinted register first, as we might want to use that one. Only
+  // count full instructions for free ranges, as an instruction's internal
+  // positions do not help but might shadow a hinted register. This is
+  // typically the case for function calls, where all registered are
+  // cloberred after the call except for the argument registers, which are
+  // set before the call. Hence, the argument registers always get ignored,
+  // as their available time is shorter.
+  int reg;
+  if (current->FirstHintPosition(&reg) == nullptr) {
+    reg = codes[0];
+  }
+  for (int i = 0; i < num_codes; ++i) {
     int code = codes[i];
-    if (free_until_pos[code] > free_until_pos[reg]) {
+    if (free_until_pos[code].ToInstructionIndex() >
+        free_until_pos[reg].ToInstructionIndex()) {
       reg = code;
     }
   }
@@ -3160,7 +3120,7 @@ bool LinearScanAllocator::TryAllocateFreeReg(
     // Register reg is available at the range start but becomes blocked before
     // the range end. Split current at position where it becomes blocked.
     LiveRange* tail = SplitRangeAt(current, pos);
-    AddToUnhandledSorted(tail);
+    AddToUnhandled(tail);
 
     // Try to allocate preferred register once more.
     if (TryAllocatePreferredReg(current, free_until_pos)) return true;
@@ -3306,7 +3266,7 @@ void LinearScanAllocator::AllocateBlockedReg(LiveRange* current) {
     // position.
     LiveRange* tail =
         SplitBetween(current, current->Start(), block_pos[reg].Start());
-    AddToUnhandledSorted(tail);
+    AddToUnhandled(tail);
   }
 
   // Register reg is not blocked for the whole range.
@@ -3469,7 +3429,6 @@ bool LinearScanAllocator::TryReuseSpillForPhi(TopLevelLiveRange* range) {
     bool merged = first_op_spill->TryMerge(spill_range);
     if (!merged) return false;
     SpillBetween(range, range->Start(), pos->pos());
-    DCHECK(UnhandledIsSorted());
     return true;
   }
   return false;
@@ -3509,11 +3468,11 @@ void LinearScanAllocator::SpillBetweenUntil(LiveRange* range,
     DCHECK(third_part != second_part);
 
     Spill(second_part);
-    AddToUnhandledSorted(third_part);
+    AddToUnhandled(third_part);
   } else {
     // The split result does not intersect with [start, end[.
     // Nothing to spill. Just put it to unhandled as whole.
-    AddToUnhandledSorted(second_part);
+    AddToUnhandled(second_part);
   }
 }
 
@@ -3524,7 +3483,10 @@ SpillSlotLocator::SpillSlotLocator(RegisterAllocationData* data)
 
 void SpillSlotLocator::LocateSpillSlots() {
   const InstructionSequence* code = data()->code();
+  const size_t live_ranges_size = data()->live_ranges().size();
   for (TopLevelLiveRange* range : data()->live_ranges()) {
+    CHECK_EQ(live_ranges_size,
+             data()->live_ranges().size());  // TODO(neis): crbug.com/831822
     if (range == nullptr || range->IsEmpty()) continue;
     // We care only about ranges which spill in the frame.
     if (!range->HasSpillRange() || range->IsSpilledOnlyInDeferredBlocks()) {
@@ -3570,7 +3532,10 @@ void OperandAssigner::AssignSpillSlots() {
 
 
 void OperandAssigner::CommitAssignment() {
+  const size_t live_ranges_size = data()->live_ranges().size();
   for (TopLevelLiveRange* top_range : data()->live_ranges()) {
+    CHECK_EQ(live_ranges_size,
+             data()->live_ranges().size());  // TODO(neis): crbug.com/831822
     if (top_range == nullptr || top_range->IsEmpty()) continue;
     InstructionOperand spill_operand;
     if (top_range->HasSpillOperand()) {
@@ -3639,7 +3604,10 @@ void ReferenceMapPopulator::PopulateReferenceMaps() {
   int last_range_start = 0;
   const ReferenceMapDeque* reference_maps = data()->code()->reference_maps();
   ReferenceMapDeque::const_iterator first_it = reference_maps->begin();
+  const size_t live_ranges_size = data()->live_ranges().size();
   for (TopLevelLiveRange* range : data()->live_ranges()) {
+    CHECK_EQ(live_ranges_size,
+             data()->live_ranges().size());  // TODO(neis): crbug.com/831822
     if (range == nullptr) continue;
     // Skip non-reference values.
     if (!data()->IsReference(range)) continue;
@@ -3831,7 +3799,10 @@ void LiveRangeConnector::ResolveControlFlow(Zone* local_zone) {
   // At this stage, we collected blocks needing a spill operand from
   // ConnectRanges and from ResolveControlFlow. Time to commit the spills for
   // deferred blocks.
+  const size_t live_ranges_size = data()->live_ranges().size();
   for (TopLevelLiveRange* top : data()->live_ranges()) {
+    CHECK_EQ(live_ranges_size,
+             data()->live_ranges().size());  // TODO(neis): crbug.com/831822
     if (top == nullptr || top->IsEmpty() ||
         !top->IsSpilledOnlyInDeferredBlocks())
       continue;
@@ -3864,7 +3835,10 @@ int LiveRangeConnector::ResolveControlFlow(const InstructionBlock* block,
 
 void LiveRangeConnector::ConnectRanges(Zone* local_zone) {
   DelayedInsertionMap delayed_insertion_map(local_zone);
+  const size_t live_ranges_size = data()->live_ranges().size();
   for (TopLevelLiveRange* top_range : data()->live_ranges()) {
+    CHECK_EQ(live_ranges_size,
+             data()->live_ranges().size());  // TODO(neis): crbug.com/831822
     if (top_range == nullptr) continue;
     bool connect_spilled = top_range->IsSpilledOnlyInDeferredBlocks();
     LiveRange* first_range = top_range;
diff --git a/deps/v8/src/compiler/register-allocator.h b/deps/v8/src/compiler/register-allocator.h
index b5d73a5bba5490..b5286e8e954c03 100644
--- a/deps/v8/src/compiler/register-allocator.h
+++ b/deps/v8/src/compiler/register-allocator.h
@@ -308,7 +308,6 @@ class V8_EXPORT_PRIVATE UsePosition final
 class SpillRange;
 class RegisterAllocationData;
 class TopLevelLiveRange;
-class LiveRangeGroup;
 
 // Representation of SSA values' live ranges as a collection of (continuous)
 // intervals over the instruction ordering.
@@ -473,21 +472,6 @@ class V8_EXPORT_PRIVATE LiveRange : public NON_EXPORTED_BASE(ZoneObject) {
 };
 
 
-class LiveRangeGroup final : public ZoneObject {
- public:
-  explicit LiveRangeGroup(Zone* zone) : ranges_(zone) {}
-  ZoneVector<LiveRange*>& ranges() { return ranges_; }
-  const ZoneVector<LiveRange*>& ranges() const { return ranges_; }
-
-  int assigned_register() const { return assigned_register_; }
-  void set_assigned_register(int reg) { assigned_register_ = reg; }
-
- private:
-  ZoneVector<LiveRange*> ranges_;
-  int assigned_register_;
-  DISALLOW_COPY_AND_ASSIGN(LiveRangeGroup);
-};
-
 class V8_EXPORT_PRIVATE TopLevelLiveRange final : public LiveRange {
  public:
   explicit TopLevelLiveRange(int vreg, MachineRepresentation rep);
@@ -1056,9 +1040,13 @@ class LinearScanAllocator final : public RegisterAllocator {
   void AllocateRegisters();
 
  private:
-  ZoneVector<LiveRange*>& unhandled_live_ranges() {
-    return unhandled_live_ranges_;
-  }
+  struct LiveRangeOrdering {
+    bool operator()(LiveRange* a, LiveRange* b) {
+      return a->ShouldBeAllocatedBefore(b);
+    }
+  };
+  using LiveRangeQueue = ZoneMultiset<LiveRange*, LiveRangeOrdering>;
+  LiveRangeQueue& unhandled_live_ranges() { return unhandled_live_ranges_; }
   ZoneVector<LiveRange*>& active_live_ranges() { return active_live_ranges_; }
   ZoneVector<LiveRange*>& inactive_live_ranges() {
     return inactive_live_ranges_;
@@ -1069,10 +1057,7 @@ class LinearScanAllocator final : public RegisterAllocator {
   // Helper methods for updating the life range lists.
   void AddToActive(LiveRange* range);
   void AddToInactive(LiveRange* range);
-  void AddToUnhandledSorted(LiveRange* range);
-  void AddToUnhandledUnsorted(LiveRange* range);
-  void SortUnhandled();
-  bool UnhandledIsSorted();
+  void AddToUnhandled(LiveRange* range);
   void ActiveToHandled(LiveRange* range);
   void ActiveToInactive(LiveRange* range);
   void InactiveToHandled(LiveRange* range);
@@ -1106,7 +1091,7 @@ class LinearScanAllocator final : public RegisterAllocator {
 
   void SplitAndSpillIntersecting(LiveRange* range);
 
-  ZoneVector<LiveRange*> unhandled_live_ranges_;
+  LiveRangeQueue unhandled_live_ranges_;
   ZoneVector<LiveRange*> active_live_ranges_;
   ZoneVector<LiveRange*> inactive_live_ranges_;
 
diff --git a/deps/v8/src/compiler/representation-change.cc b/deps/v8/src/compiler/representation-change.cc
index 34b532a6c6ceb7..e3c49df7a6c144 100644
--- a/deps/v8/src/compiler/representation-change.cc
+++ b/deps/v8/src/compiler/representation-change.cc
@@ -135,9 +135,9 @@ bool IsWord(MachineRepresentation rep) {
 // out signedness for the word32->float64 conversion, then we check that the
 // uses truncate to word32 (so they do not care about signedness).
 Node* RepresentationChanger::GetRepresentationFor(
-    Node* node, MachineRepresentation output_rep, Type* output_type,
+    Node* node, MachineRepresentation output_rep, Type output_type,
     Node* use_node, UseInfo use_info) {
-  if (output_rep == MachineRepresentation::kNone && !output_type->IsNone()) {
+  if (output_rep == MachineRepresentation::kNone && !output_type.IsNone()) {
     // The output representation should be set if the type is inhabited (i.e.,
     // if the value is possible).
     return TypeError(node, output_rep, output_type, use_info.representation());
@@ -200,12 +200,12 @@ Node* RepresentationChanger::GetRepresentationFor(
 }
 
 Node* RepresentationChanger::GetTaggedSignedRepresentationFor(
-    Node* node, MachineRepresentation output_rep, Type* output_type,
+    Node* node, MachineRepresentation output_rep, Type output_type,
     Node* use_node, UseInfo use_info) {
   // Eagerly fold representation changes for constants.
   switch (node->opcode()) {
     case IrOpcode::kNumberConstant:
-      if (output_type->Is(Type::SignedSmall())) {
+      if (output_type.Is(Type::SignedSmall())) {
         return node;
       }
       break;
@@ -214,15 +214,15 @@ Node* RepresentationChanger::GetTaggedSignedRepresentationFor(
   }
   // Select the correct X -> Tagged operator.
   const Operator* op;
-  if (output_type->Is(Type::None())) {
+  if (output_type.Is(Type::None())) {
     // This is an impossible value; it should not be used at runtime.
     return jsgraph()->graph()->NewNode(
         jsgraph()->common()->DeadValue(MachineRepresentation::kTaggedSigned),
         node);
   } else if (IsWord(output_rep)) {
-    if (output_type->Is(Type::Signed31())) {
+    if (output_type.Is(Type::Signed31())) {
       op = simplified()->ChangeInt31ToTaggedSigned();
-    } else if (output_type->Is(Type::Signed32())) {
+    } else if (output_type.Is(Type::Signed32())) {
       if (SmiValuesAre32Bits()) {
         op = simplified()->ChangeInt32ToTagged();
       } else if (use_info.type_check() == TypeCheckKind::kSignedSmall) {
@@ -231,7 +231,7 @@ Node* RepresentationChanger::GetTaggedSignedRepresentationFor(
         return TypeError(node, output_rep, output_type,
                          MachineRepresentation::kTaggedSigned);
       }
-    } else if (output_type->Is(Type::Unsigned32()) &&
+    } else if (output_type.Is(Type::Unsigned32()) &&
                use_info.type_check() == TypeCheckKind::kSignedSmall) {
       op = simplified()->CheckedUint32ToTaggedSigned(use_info.feedback());
     } else {
@@ -239,11 +239,11 @@ Node* RepresentationChanger::GetTaggedSignedRepresentationFor(
                        MachineRepresentation::kTaggedSigned);
     }
   } else if (output_rep == MachineRepresentation::kFloat64) {
-    if (output_type->Is(Type::Signed31())) {
+    if (output_type.Is(Type::Signed31())) {
       // float64 -> int32 -> tagged signed
       node = InsertChangeFloat64ToInt32(node);
       op = simplified()->ChangeInt31ToTaggedSigned();
-    } else if (output_type->Is(Type::Signed32())) {
+    } else if (output_type.Is(Type::Signed32())) {
       // float64 -> int32 -> tagged signed
       node = InsertChangeFloat64ToInt32(node);
       if (SmiValuesAre32Bits()) {
@@ -254,14 +254,14 @@ Node* RepresentationChanger::GetTaggedSignedRepresentationFor(
         return TypeError(node, output_rep, output_type,
                          MachineRepresentation::kTaggedSigned);
       }
-    } else if (output_type->Is(Type::Unsigned32()) &&
+    } else if (output_type.Is(Type::Unsigned32()) &&
                use_info.type_check() == TypeCheckKind::kSignedSmall) {
       // float64 -> uint32 -> tagged signed
       node = InsertChangeFloat64ToUint32(node);
       op = simplified()->CheckedUint32ToTaggedSigned(use_info.feedback());
     } else if (use_info.type_check() == TypeCheckKind::kSignedSmall) {
       op = simplified()->CheckedFloat64ToInt32(
-          output_type->Maybe(Type::MinusZero())
+          output_type.Maybe(Type::MinusZero())
               ? CheckForMinusZeroMode::kCheckForMinusZero
               : CheckForMinusZeroMode::kDontCheckForMinusZero,
           use_info.feedback());
@@ -280,7 +280,7 @@ Node* RepresentationChanger::GetTaggedSignedRepresentationFor(
       op = machine()->ChangeFloat32ToFloat64();
       node = InsertConversion(node, op, use_node);
       op = simplified()->CheckedFloat64ToInt32(
-          output_type->Maybe(Type::MinusZero())
+          output_type.Maybe(Type::MinusZero())
               ? CheckForMinusZeroMode::kCheckForMinusZero
               : CheckForMinusZeroMode::kDontCheckForMinusZero,
           use_info.feedback());
@@ -297,7 +297,7 @@ Node* RepresentationChanger::GetTaggedSignedRepresentationFor(
   } else if (CanBeTaggedPointer(output_rep)) {
     if (use_info.type_check() == TypeCheckKind::kSignedSmall) {
       op = simplified()->CheckedTaggedToTaggedSigned(use_info.feedback());
-    } else if (output_type->Is(Type::SignedSmall())) {
+    } else if (output_type.Is(Type::SignedSmall())) {
       op = simplified()->ChangeTaggedToTaggedSigned();
     } else {
       return TypeError(node, output_rep, output_type,
@@ -321,7 +321,7 @@ Node* RepresentationChanger::GetTaggedSignedRepresentationFor(
 }
 
 Node* RepresentationChanger::GetTaggedPointerRepresentationFor(
-    Node* node, MachineRepresentation output_rep, Type* output_type,
+    Node* node, MachineRepresentation output_rep, Type output_type,
     Node* use_node, UseInfo use_info) {
   // Eagerly fold representation changes for constants.
   switch (node->opcode()) {
@@ -336,23 +336,23 @@ Node* RepresentationChanger::GetTaggedPointerRepresentationFor(
   }
   // Select the correct X -> TaggedPointer operator.
   Operator const* op;
-  if (output_type->Is(Type::None())) {
+  if (output_type.Is(Type::None())) {
     // This is an impossible value; it should not be used at runtime.
     return jsgraph()->graph()->NewNode(
         jsgraph()->common()->DeadValue(MachineRepresentation::kTaggedPointer),
         node);
   } else if (output_rep == MachineRepresentation::kBit) {
-    if (output_type->Is(Type::Boolean())) {
+    if (output_type.Is(Type::Boolean())) {
       op = simplified()->ChangeBitToTagged();
     } else {
       return TypeError(node, output_rep, output_type,
                        MachineRepresentation::kTagged);
     }
   } else if (IsWord(output_rep)) {
-    if (output_type->Is(Type::Unsigned32())) {
+    if (output_type.Is(Type::Unsigned32())) {
       // uint32 -> float64 -> tagged
       node = InsertChangeUint32ToFloat64(node);
-    } else if (output_type->Is(Type::Signed32())) {
+    } else if (output_type.Is(Type::Signed32())) {
       // int32 -> float64 -> tagged
       node = InsertChangeInt32ToFloat64(node);
     } else {
@@ -361,7 +361,7 @@ Node* RepresentationChanger::GetTaggedPointerRepresentationFor(
     }
     op = simplified()->ChangeFloat64ToTaggedPointer();
   } else if (output_rep == MachineRepresentation::kFloat32) {
-    if (output_type->Is(Type::Number())) {
+    if (output_type.Is(Type::Number())) {
       // float32 -> float64 -> tagged
       node = InsertChangeFloat32ToFloat64(node);
       op = simplified()->ChangeFloat64ToTaggedPointer();
@@ -370,7 +370,7 @@ Node* RepresentationChanger::GetTaggedPointerRepresentationFor(
                        MachineRepresentation::kTaggedPointer);
     }
   } else if (output_rep == MachineRepresentation::kFloat64) {
-    if (output_type->Is(Type::Number())) {
+    if (output_type.Is(Type::Number())) {
       // float64 -> tagged
       op = simplified()->ChangeFloat64ToTaggedPointer();
     } else {
@@ -379,7 +379,7 @@ Node* RepresentationChanger::GetTaggedPointerRepresentationFor(
     }
   } else if (CanBeTaggedSigned(output_rep) &&
              use_info.type_check() == TypeCheckKind::kHeapObject) {
-    if (!output_type->Maybe(Type::SignedSmall())) {
+    if (!output_type.Maybe(Type::SignedSmall())) {
       return node;
     }
     // TODO(turbofan): Consider adding a Bailout operator that just deopts
@@ -393,7 +393,7 @@ Node* RepresentationChanger::GetTaggedPointerRepresentationFor(
 }
 
 Node* RepresentationChanger::GetTaggedRepresentationFor(
-    Node* node, MachineRepresentation output_rep, Type* output_type,
+    Node* node, MachineRepresentation output_rep, Type output_type,
     Truncation truncation) {
   // Eagerly fold representation changes for constants.
   switch (node->opcode()) {
@@ -415,23 +415,23 @@ Node* RepresentationChanger::GetTaggedRepresentationFor(
   }
   // Select the correct X -> Tagged operator.
   const Operator* op;
-  if (output_type->Is(Type::None())) {
+  if (output_type.Is(Type::None())) {
     // This is an impossible value; it should not be used at runtime.
     return jsgraph()->graph()->NewNode(
         jsgraph()->common()->DeadValue(MachineRepresentation::kTagged), node);
   } else if (output_rep == MachineRepresentation::kBit) {
-    if (output_type->Is(Type::Boolean())) {
+    if (output_type.Is(Type::Boolean())) {
       op = simplified()->ChangeBitToTagged();
     } else {
       return TypeError(node, output_rep, output_type,
                        MachineRepresentation::kTagged);
     }
   } else if (IsWord(output_rep)) {
-    if (output_type->Is(Type::Signed31())) {
+    if (output_type.Is(Type::Signed31())) {
       op = simplified()->ChangeInt31ToTaggedSigned();
-    } else if (output_type->Is(Type::Signed32())) {
+    } else if (output_type.Is(Type::Signed32())) {
       op = simplified()->ChangeInt32ToTagged();
-    } else if (output_type->Is(Type::Unsigned32()) ||
+    } else if (output_type.Is(Type::Unsigned32()) ||
                truncation.IsUsedAsWord32()) {
       // Either the output is uint32 or the uses only care about the
       // low 32 bits (so we can pick uint32 safely).
@@ -444,24 +444,24 @@ Node* RepresentationChanger::GetTaggedRepresentationFor(
              MachineRepresentation::kFloat32) {  // float32 -> float64 -> tagged
     node = InsertChangeFloat32ToFloat64(node);
     op = simplified()->ChangeFloat64ToTagged(
-        output_type->Maybe(Type::MinusZero())
+        output_type.Maybe(Type::MinusZero())
             ? CheckForMinusZeroMode::kCheckForMinusZero
             : CheckForMinusZeroMode::kDontCheckForMinusZero);
   } else if (output_rep == MachineRepresentation::kFloat64) {
-    if (output_type->Is(Type::Signed31())) {  // float64 -> int32 -> tagged
+    if (output_type.Is(Type::Signed31())) {  // float64 -> int32 -> tagged
       node = InsertChangeFloat64ToInt32(node);
       op = simplified()->ChangeInt31ToTaggedSigned();
-    } else if (output_type->Is(
+    } else if (output_type.Is(
                    Type::Signed32())) {  // float64 -> int32 -> tagged
       node = InsertChangeFloat64ToInt32(node);
       op = simplified()->ChangeInt32ToTagged();
-    } else if (output_type->Is(
+    } else if (output_type.Is(
                    Type::Unsigned32())) {  // float64 -> uint32 -> tagged
       node = InsertChangeFloat64ToUint32(node);
       op = simplified()->ChangeUint32ToTagged();
-    } else if (output_type->Is(Type::Number())) {
+    } else if (output_type.Is(Type::Number())) {
       op = simplified()->ChangeFloat64ToTagged(
-          output_type->Maybe(Type::MinusZero())
+          output_type.Maybe(Type::MinusZero())
               ? CheckForMinusZeroMode::kCheckForMinusZero
               : CheckForMinusZeroMode::kDontCheckForMinusZero);
     } else {
@@ -475,9 +475,8 @@ Node* RepresentationChanger::GetTaggedRepresentationFor(
   return jsgraph()->graph()->NewNode(op, node);
 }
 
-
 Node* RepresentationChanger::GetFloat32RepresentationFor(
-    Node* node, MachineRepresentation output_rep, Type* output_type,
+    Node* node, MachineRepresentation output_rep, Type output_type,
     Truncation truncation) {
   // Eagerly fold representation changes for constants.
   switch (node->opcode()) {
@@ -494,17 +493,17 @@ Node* RepresentationChanger::GetFloat32RepresentationFor(
   }
   // Select the correct X -> Float32 operator.
   const Operator* op = nullptr;
-  if (output_type->Is(Type::None())) {
+  if (output_type.Is(Type::None())) {
     // This is an impossible value; it should not be used at runtime.
     return jsgraph()->graph()->NewNode(
         jsgraph()->common()->DeadValue(MachineRepresentation::kFloat32), node);
   } else if (IsWord(output_rep)) {
-    if (output_type->Is(Type::Signed32())) {
+    if (output_type.Is(Type::Signed32())) {
       // int32 -> float64 -> float32
       op = machine()->ChangeInt32ToFloat64();
       node = jsgraph()->graph()->NewNode(op, node);
       op = machine()->TruncateFloat64ToFloat32();
-    } else if (output_type->Is(Type::Unsigned32()) ||
+    } else if (output_type.Is(Type::Unsigned32()) ||
                truncation.IsUsedAsWord32()) {
       // Either the output is uint32 or the uses only care about the
       // low 32 bits (so we can pick uint32 safely).
@@ -515,9 +514,9 @@ Node* RepresentationChanger::GetFloat32RepresentationFor(
       op = machine()->TruncateFloat64ToFloat32();
     }
   } else if (IsAnyTagged(output_rep)) {
-    if (output_type->Is(Type::NumberOrOddball())) {
+    if (output_type.Is(Type::NumberOrOddball())) {
       // tagged -> float64 -> float32
-      if (output_type->Is(Type::Number())) {
+      if (output_type.Is(Type::Number())) {
         op = simplified()->ChangeTaggedToFloat64();
       } else {
         op = simplified()->TruncateTaggedToFloat64();
@@ -536,7 +535,7 @@ Node* RepresentationChanger::GetFloat32RepresentationFor(
 }
 
 Node* RepresentationChanger::GetFloat64RepresentationFor(
-    Node* node, MachineRepresentation output_rep, Type* output_type,
+    Node* node, MachineRepresentation output_rep, Type output_type,
     Node* use_node, UseInfo use_info) {
   // Eagerly fold representation changes for constants.
   if ((use_info.type_check() == TypeCheckKind::kNone)) {
@@ -555,14 +554,14 @@ Node* RepresentationChanger::GetFloat64RepresentationFor(
   }
   // Select the correct X -> Float64 operator.
   const Operator* op = nullptr;
-  if (output_type->Is(Type::None())) {
+  if (output_type.Is(Type::None())) {
     // This is an impossible value; it should not be used at runtime.
     return jsgraph()->graph()->NewNode(
         jsgraph()->common()->DeadValue(MachineRepresentation::kFloat64), node);
   } else if (IsWord(output_rep)) {
-    if (output_type->Is(Type::Signed32())) {
+    if (output_type.Is(Type::Signed32())) {
       op = machine()->ChangeInt32ToFloat64();
-    } else if (output_type->Is(Type::Unsigned32()) ||
+    } else if (output_type.Is(Type::Unsigned32()) ||
                use_info.truncation().IsUsedAsWord32()) {
       // Either the output is uint32 or the uses only care about the
       // low 32 bits (so we can pick uint32 safely).
@@ -573,21 +572,21 @@ Node* RepresentationChanger::GetFloat64RepresentationFor(
   } else if (output_rep == MachineRepresentation::kTagged ||
              output_rep == MachineRepresentation::kTaggedSigned ||
              output_rep == MachineRepresentation::kTaggedPointer) {
-    if (output_type->Is(Type::Undefined())) {
+    if (output_type.Is(Type::Undefined())) {
       return jsgraph()->Float64Constant(
           std::numeric_limits<double>::quiet_NaN());
 
     } else if (output_rep == MachineRepresentation::kTaggedSigned) {
       node = InsertChangeTaggedSignedToInt32(node);
       op = machine()->ChangeInt32ToFloat64();
-    } else if (output_type->Is(Type::Number())) {
+    } else if (output_type.Is(Type::Number())) {
       op = simplified()->ChangeTaggedToFloat64();
-    } else if (output_type->Is(Type::NumberOrOddball())) {
+    } else if (output_type.Is(Type::NumberOrOddball())) {
       // TODO(jarin) Here we should check that truncation is Number.
       op = simplified()->TruncateTaggedToFloat64();
     } else if (use_info.type_check() == TypeCheckKind::kNumber ||
                (use_info.type_check() == TypeCheckKind::kNumberOrOddball &&
-                !output_type->Maybe(Type::BooleanOrNullOrNumber()))) {
+                !output_type.Maybe(Type::BooleanOrNullOrNumber()))) {
       op = simplified()->CheckedTaggedToFloat64(CheckTaggedInputMode::kNumber,
                                                 use_info.feedback());
     } else if (use_info.type_check() == TypeCheckKind::kNumberOrOddball) {
@@ -619,7 +618,7 @@ void RepresentationChanger::InsertUnconditionalDeopt(Node* node,
 }
 
 Node* RepresentationChanger::GetWord32RepresentationFor(
-    Node* node, MachineRepresentation output_rep, Type* output_type,
+    Node* node, MachineRepresentation output_rep, Type output_type,
     Node* use_node, UseInfo use_info) {
   // Eagerly fold representation changes for constants.
   switch (node->opcode()) {
@@ -644,12 +643,12 @@ Node* RepresentationChanger::GetWord32RepresentationFor(
 
   // Select the correct X -> Word32 operator.
   const Operator* op = nullptr;
-  if (output_type->Is(Type::None())) {
+  if (output_type.Is(Type::None())) {
     // This is an impossible value; it should not be used at runtime.
     return jsgraph()->graph()->NewNode(
         jsgraph()->common()->DeadValue(MachineRepresentation::kWord32), node);
   } else if (output_rep == MachineRepresentation::kBit) {
-    CHECK(output_type->Is(Type::Boolean()));
+    CHECK(output_type.Is(Type::Boolean()));
     if (use_info.truncation().IsUsedAsWord32()) {
       return node;
     } else {
@@ -661,16 +660,16 @@ Node* RepresentationChanger::GetWord32RepresentationFor(
           jsgraph()->common()->DeadValue(MachineRepresentation::kWord32), node);
     }
   } else if (output_rep == MachineRepresentation::kFloat64) {
-    if (output_type->Is(Type::Signed32())) {
+    if (output_type.Is(Type::Signed32())) {
       op = machine()->ChangeFloat64ToInt32();
     } else if (use_info.type_check() == TypeCheckKind::kSignedSmall ||
                use_info.type_check() == TypeCheckKind::kSigned32) {
       op = simplified()->CheckedFloat64ToInt32(
-          output_type->Maybe(Type::MinusZero())
+          output_type.Maybe(Type::MinusZero())
               ? use_info.minus_zero_check()
               : CheckForMinusZeroMode::kDontCheckForMinusZero,
           use_info.feedback());
-    } else if (output_type->Is(Type::Unsigned32())) {
+    } else if (output_type.Is(Type::Unsigned32())) {
       op = machine()->ChangeFloat64ToUint32();
     } else if (use_info.truncation().IsUsedAsWord32()) {
       op = machine()->TruncateFloat64ToWord32();
@@ -680,16 +679,16 @@ Node* RepresentationChanger::GetWord32RepresentationFor(
     }
   } else if (output_rep == MachineRepresentation::kFloat32) {
     node = InsertChangeFloat32ToFloat64(node);  // float32 -> float64 -> int32
-    if (output_type->Is(Type::Signed32())) {
+    if (output_type.Is(Type::Signed32())) {
       op = machine()->ChangeFloat64ToInt32();
     } else if (use_info.type_check() == TypeCheckKind::kSignedSmall ||
                use_info.type_check() == TypeCheckKind::kSigned32) {
       op = simplified()->CheckedFloat64ToInt32(
-          output_type->Maybe(Type::MinusZero())
+          output_type.Maybe(Type::MinusZero())
               ? use_info.minus_zero_check()
               : CheckForMinusZeroMode::kDontCheckForMinusZero,
           use_info.feedback());
-    } else if (output_type->Is(Type::Unsigned32())) {
+    } else if (output_type.Is(Type::Unsigned32())) {
       op = machine()->ChangeFloat64ToUint32();
     } else if (use_info.truncation().IsUsedAsWord32()) {
       op = machine()->TruncateFloat64ToWord32();
@@ -699,22 +698,22 @@ Node* RepresentationChanger::GetWord32RepresentationFor(
     }
   } else if (IsAnyTagged(output_rep)) {
     if (output_rep == MachineRepresentation::kTaggedSigned &&
-        output_type->Is(Type::SignedSmall())) {
+        output_type.Is(Type::SignedSmall())) {
       op = simplified()->ChangeTaggedSignedToInt32();
-    } else if (output_type->Is(Type::Signed32())) {
+    } else if (output_type.Is(Type::Signed32())) {
       op = simplified()->ChangeTaggedToInt32();
     } else if (use_info.type_check() == TypeCheckKind::kSignedSmall) {
       op = simplified()->CheckedTaggedSignedToInt32(use_info.feedback());
     } else if (use_info.type_check() == TypeCheckKind::kSigned32) {
       op = simplified()->CheckedTaggedToInt32(
-          output_type->Maybe(Type::MinusZero())
+          output_type.Maybe(Type::MinusZero())
               ? use_info.minus_zero_check()
               : CheckForMinusZeroMode::kDontCheckForMinusZero,
           use_info.feedback());
-    } else if (output_type->Is(Type::Unsigned32())) {
+    } else if (output_type.Is(Type::Unsigned32())) {
       op = simplified()->ChangeTaggedToUint32();
     } else if (use_info.truncation().IsUsedAsWord32()) {
-      if (output_type->Is(Type::NumberOrOddball())) {
+      if (output_type.Is(Type::NumberOrOddball())) {
         op = simplified()->TruncateTaggedToWord32();
       } else if (use_info.type_check() == TypeCheckKind::kNumber) {
         op = simplified()->CheckedTruncateTaggedToWord32(
@@ -735,9 +734,9 @@ Node* RepresentationChanger::GetWord32RepresentationFor(
     // handled in GetRepresentationFor.
     if (use_info.type_check() == TypeCheckKind::kSignedSmall ||
         use_info.type_check() == TypeCheckKind::kSigned32) {
-      if (output_type->Is(Type::Signed32())) {
+      if (output_type.Is(Type::Signed32())) {
         return node;
-      } else if (output_type->Is(Type::Unsigned32())) {
+      } else if (output_type.Is(Type::Unsigned32())) {
         op = simplified()->CheckedUint32ToInt32(use_info.feedback());
       } else {
         return TypeError(node, output_rep, output_type,
@@ -776,9 +775,8 @@ Node* RepresentationChanger::InsertConversion(Node* node, const Operator* op,
   return jsgraph()->graph()->NewNode(op, node);
 }
 
-
 Node* RepresentationChanger::GetBitRepresentationFor(
-    Node* node, MachineRepresentation output_rep, Type* output_type) {
+    Node* node, MachineRepresentation output_rep, Type output_type) {
   // Eagerly fold representation changes for constants.
   switch (node->opcode()) {
     case IrOpcode::kHeapConstant: {
@@ -795,18 +793,18 @@ Node* RepresentationChanger::GetBitRepresentationFor(
   }
   // Select the correct X -> Bit operator.
   const Operator* op;
-  if (output_type->Is(Type::None())) {
+  if (output_type.Is(Type::None())) {
     // This is an impossible value; it should not be used at runtime.
     return jsgraph()->graph()->NewNode(
         jsgraph()->common()->DeadValue(MachineRepresentation::kBit), node);
   } else if (output_rep == MachineRepresentation::kTagged ||
              output_rep == MachineRepresentation::kTaggedPointer) {
-    if (output_type->Is(Type::BooleanOrNullOrUndefined())) {
+    if (output_type.Is(Type::BooleanOrNullOrUndefined())) {
       // true is the only trueish Oddball.
       op = simplified()->ChangeTaggedToBit();
     } else {
       if (output_rep == MachineRepresentation::kTagged &&
-          output_type->Maybe(Type::SignedSmall())) {
+          output_type.Maybe(Type::SignedSmall())) {
         op = simplified()->TruncateTaggedToBit();
       } else {
         // The {output_type} either doesn't include the Smi range,
@@ -840,8 +838,8 @@ Node* RepresentationChanger::GetBitRepresentationFor(
 }
 
 Node* RepresentationChanger::GetWord64RepresentationFor(
-    Node* node, MachineRepresentation output_rep, Type* output_type) {
-  if (output_type->Is(Type::None())) {
+    Node* node, MachineRepresentation output_rep, Type output_type) {
+  if (output_type.Is(Type::None())) {
     // This is an impossible value; it should not be used at runtime.
     return jsgraph()->graph()->NewNode(
         jsgraph()->common()->DeadValue(MachineRepresentation::kWord32), node);
@@ -1069,16 +1067,15 @@ const Operator* RepresentationChanger::Float64OperatorFor(
   }
 }
 
-
 Node* RepresentationChanger::TypeError(Node* node,
                                        MachineRepresentation output_rep,
-                                       Type* output_type,
+                                       Type output_type,
                                        MachineRepresentation use) {
   type_error_ = true;
   if (!testing_type_errors_) {
     std::ostringstream out_str;
     out_str << output_rep << " (";
-    output_type->PrintTo(out_str);
+    output_type.PrintTo(out_str);
     out_str << ")";
 
     std::ostringstream use_str;
diff --git a/deps/v8/src/compiler/representation-change.h b/deps/v8/src/compiler/representation-change.h
index ed6c0a596e9e25..85a69d92eb8e82 100644
--- a/deps/v8/src/compiler/representation-change.h
+++ b/deps/v8/src/compiler/representation-change.h
@@ -274,7 +274,7 @@ class RepresentationChanger final {
   // out signedness for the word32->float64 conversion, then we check that the
   // uses truncate to word32 (so they do not care about signedness).
   Node* GetRepresentationFor(Node* node, MachineRepresentation output_rep,
-                             Type* output_type, Node* use_node,
+                             Type output_type, Node* use_node,
                              UseInfo use_info);
   const Operator* Int32OperatorFor(IrOpcode::Value opcode);
   const Operator* Int32OverflowOperatorFor(IrOpcode::Value opcode);
@@ -304,30 +304,30 @@ class RepresentationChanger final {
 
   Node* GetTaggedSignedRepresentationFor(Node* node,
                                          MachineRepresentation output_rep,
-                                         Type* output_type, Node* use_node,
+                                         Type output_type, Node* use_node,
                                          UseInfo use_info);
   Node* GetTaggedPointerRepresentationFor(Node* node,
                                           MachineRepresentation output_rep,
-                                          Type* output_type, Node* use_node,
+                                          Type output_type, Node* use_node,
                                           UseInfo use_info);
   Node* GetTaggedRepresentationFor(Node* node, MachineRepresentation output_rep,
-                                   Type* output_type, Truncation truncation);
+                                   Type output_type, Truncation truncation);
   Node* GetFloat32RepresentationFor(Node* node,
                                     MachineRepresentation output_rep,
-                                    Type* output_type, Truncation truncation);
+                                    Type output_type, Truncation truncation);
   Node* GetFloat64RepresentationFor(Node* node,
                                     MachineRepresentation output_rep,
-                                    Type* output_type, Node* use_node,
+                                    Type output_type, Node* use_node,
                                     UseInfo use_info);
   Node* GetWord32RepresentationFor(Node* node, MachineRepresentation output_rep,
-                                   Type* output_type, Node* use_node,
+                                   Type output_type, Node* use_node,
                                    UseInfo use_info);
   Node* GetBitRepresentationFor(Node* node, MachineRepresentation output_rep,
-                                Type* output_type);
+                                Type output_type);
   Node* GetWord64RepresentationFor(Node* node, MachineRepresentation output_rep,
-                                   Type* output_type);
+                                   Type output_type);
   Node* TypeError(Node* node, MachineRepresentation output_rep,
-                  Type* output_type, MachineRepresentation use);
+                  Type output_type, MachineRepresentation use);
   Node* MakeTruncatedInt32Constant(double value);
   Node* InsertChangeBitToTagged(Node* node);
   Node* InsertChangeFloat32ToFloat64(Node* node);
diff --git a/deps/v8/src/compiler/s390/code-generator-s390.cc b/deps/v8/src/compiler/s390/code-generator-s390.cc
index 9d7c3d8a403cae..3e4ab9c1996517 100644
--- a/deps/v8/src/compiler/s390/code-generator-s390.cc
+++ b/deps/v8/src/compiler/s390/code-generator-s390.cc
@@ -605,15 +605,14 @@ static inline int AssembleUnaryOp(Instruction* instr, _R _r, _M _m, _I _i) {
     __ LoadlW(i.OutputRegister(), r0);          \
   } while (0)
 
-#define ASSEMBLE_FLOAT_MODULO()                                            \
-  do {                                                                     \
-    FrameScope scope(tasm(), StackFrame::MANUAL);                          \
-    __ PrepareCallCFunction(0, 2, kScratchReg);                            \
-    __ MovToFloatParameters(i.InputDoubleRegister(0),                      \
-                            i.InputDoubleRegister(1));                     \
-    __ CallCFunction(                                                      \
-        ExternalReference::mod_two_doubles_operation(__ isolate()), 0, 2); \
-    __ MovFromFloatResult(i.OutputDoubleRegister());                       \
+#define ASSEMBLE_FLOAT_MODULO()                                             \
+  do {                                                                      \
+    FrameScope scope(tasm(), StackFrame::MANUAL);                           \
+    __ PrepareCallCFunction(0, 2, kScratchReg);                             \
+    __ MovToFloatParameters(i.InputDoubleRegister(0),                       \
+                            i.InputDoubleRegister(1));                      \
+    __ CallCFunction(ExternalReference::mod_two_doubles_operation(), 0, 2); \
+    __ MovFromFloatResult(i.OutputDoubleRegister());                        \
   } while (0)
 
 #define ASSEMBLE_IEEE754_UNOP(name)                                            \
@@ -623,8 +622,7 @@ static inline int AssembleUnaryOp(Instruction* instr, _R _r, _M _m, _I _i) {
     FrameScope scope(tasm(), StackFrame::MANUAL);                              \
     __ PrepareCallCFunction(0, 1, kScratchReg);                                \
     __ MovToFloatParameter(i.InputDoubleRegister(0));                          \
-    __ CallCFunction(                                                          \
-        ExternalReference::ieee754_##name##_function(__ isolate()), 0, 1);     \
+    __ CallCFunction(ExternalReference::ieee754_##name##_function(), 0, 1);    \
     /* Move the result in the double result register. */                       \
     __ MovFromFloatResult(i.OutputDoubleRegister());                           \
   } while (0)
@@ -637,8 +635,7 @@ static inline int AssembleUnaryOp(Instruction* instr, _R _r, _M _m, _I _i) {
     __ PrepareCallCFunction(0, 2, kScratchReg);                                \
     __ MovToFloatParameters(i.InputDoubleRegister(0),                          \
                             i.InputDoubleRegister(1));                         \
-    __ CallCFunction(                                                          \
-        ExternalReference::ieee754_##name##_function(__ isolate()), 0, 2);     \
+    __ CallCFunction(ExternalReference::ieee754_##name##_function(), 0, 2);    \
     /* Move the result in the double result register. */                       \
     __ MovFromFloatResult(i.OutputDoubleRegister());                           \
   } while (0)
@@ -899,6 +896,252 @@ static inline int AssembleUnaryOp(Instruction* instr, _R _r, _M _m, _I _i) {
     __ asm_instr(value, operand);                        \
   } while (0)
 
+#define ATOMIC_COMP_EXCHANGE(start, end, shift_amount, offset)              \
+  {                                                                         \
+    __ LoadlW(temp0, MemOperand(addr, offset));                             \
+    __ llgfr(temp1, temp0);                                                 \
+    __ RotateInsertSelectBits(temp0, old_val, Operand(start),               \
+             Operand(end), Operand(shift_amount), false);                   \
+    __ RotateInsertSelectBits(temp1, new_val, Operand(start),               \
+             Operand(end), Operand(shift_amount), false);                   \
+    __ CmpAndSwap(temp0, temp1, MemOperand(addr, offset));                  \
+    __ RotateInsertSelectBits(output, temp0, Operand(start+shift_amount),   \
+             Operand(end+shift_amount), Operand(64-shift_amount), true);    \
+  }
+
+#ifdef V8_TARGET_BIG_ENDIAN
+#define ATOMIC_COMP_EXCHANGE_BYTE(i)                                        \
+  {                                                                         \
+    constexpr int idx = (i);                                                \
+    static_assert(idx <= 3 && idx >= 0, "idx is out of range!");            \
+    constexpr int start = 32 + 8 * idx;                                     \
+    constexpr int end = start + 7;                                          \
+    constexpr int shift_amount = (3 - idx) * 8;                             \
+    ATOMIC_COMP_EXCHANGE(start, end, shift_amount, -idx);                   \
+  }
+#define ATOMIC_COMP_EXCHANGE_HALFWORD(i)                                    \
+  {                                                                         \
+    constexpr int idx = (i);                                                \
+    static_assert(idx <= 1 && idx >= 0, "idx is out of range!");            \
+    constexpr int start = 32 + 16 * idx;                                    \
+    constexpr int end = start + 15;                                         \
+    constexpr int shift_amount = (1 - idx) * 16;                            \
+    ATOMIC_COMP_EXCHANGE(start, end, shift_amount, -idx * 2);               \
+  }
+#else
+#define ATOMIC_COMP_EXCHANGE_BYTE(i)                                        \
+  {                                                                         \
+    constexpr int idx = (i);                                                \
+    static_assert(idx <= 3 && idx >= 0, "idx is out of range!");            \
+    constexpr int start = 32 + 8 * (3 - idx);                               \
+    constexpr int end = start + 7;                                          \
+    constexpr int shift_amount = idx * 8;                                   \
+    ATOMIC_COMP_EXCHANGE(start, end, shift_amount, -idx);                   \
+  }
+#define ATOMIC_COMP_EXCHANGE_HALFWORD(i)                                    \
+  {                                                                         \
+    constexpr int idx = (i);                                                \
+    static_assert(idx <= 1 && idx >= 0, "idx is out of range!");            \
+    constexpr int start = 32 + 16 * (1 - idx);                              \
+    constexpr int end = start + 15;                                         \
+    constexpr int shift_amount = idx * 16;                                  \
+    ATOMIC_COMP_EXCHANGE(start, end, shift_amount, -idx * 2);               \
+  }
+#endif
+
+#define ASSEMBLE_ATOMIC_COMPARE_EXCHANGE_BYTE(load_and_ext)            \
+  do {                                                                 \
+    Register old_val = i.InputRegister(0);                             \
+    Register new_val = i.InputRegister(1);                             \
+    Register output = i.OutputRegister();                              \
+    Register addr = kScratchReg;                                       \
+    Register temp0 = r0;                                               \
+    Register temp1 = r1;                                               \
+    size_t index = 2;                                                  \
+    AddressingMode mode = kMode_None;                                  \
+    MemOperand op = i.MemoryOperand(&mode, &index);                    \
+    Label three, two, one, done;                                       \
+    __ lay(addr, op);                                                  \
+    __ tmll(addr, Operand(3));                                         \
+    __ b(Condition(1), &three);                                        \
+    __ b(Condition(2), &two);                                          \
+    __ b(Condition(4), &one);                                          \
+    /* ending with 0b00 */                                             \
+    ATOMIC_COMP_EXCHANGE_BYTE(0);                                      \
+    __ b(&done);                                                       \
+    /* ending with 0b01 */                                             \
+    __ bind(&one);                                                     \
+    ATOMIC_COMP_EXCHANGE_BYTE(1);                                      \
+    __ b(&done);                                                       \
+    /* ending with 0b10 */                                             \
+    __ bind(&two);                                                     \
+    ATOMIC_COMP_EXCHANGE_BYTE(2);                                      \
+    __ b(&done);                                                       \
+    /* ending with 0b11 */                                             \
+    __ bind(&three);                                                   \
+    ATOMIC_COMP_EXCHANGE_BYTE(3);                                      \
+    __ bind(&done);                                                    \
+    __ load_and_ext(output, output);                                   \
+  } while (false)
+
+#define ASSEMBLE_ATOMIC_COMPARE_EXCHANGE_HALFWORD(load_and_ext)          \
+  do {                                                                   \
+    Register old_val = i.InputRegister(0);                               \
+    Register new_val = i.InputRegister(1);                               \
+    Register output = i.OutputRegister();                                \
+    Register addr = kScratchReg;                                         \
+    Register temp0 = r0;                                                 \
+    Register temp1 = r1;                                                 \
+    size_t index = 2;                                                    \
+    AddressingMode mode = kMode_None;                                    \
+    MemOperand op = i.MemoryOperand(&mode, &index);                      \
+    Label two, done;                                                     \
+    __ lay(addr, op);                                                    \
+    __ tmll(addr, Operand(3));                                           \
+    __ b(Condition(2), &two);                                            \
+    ATOMIC_COMP_EXCHANGE_HALFWORD(0);                                    \
+    __ b(&done);                                                         \
+    __ bind(&two);                                                       \
+    ATOMIC_COMP_EXCHANGE_HALFWORD(1);                                    \
+    __ bind(&done);                                                      \
+    __ load_and_ext(output, output);                                     \
+  } while (false)
+
+#define ASSEMBLE_ATOMIC_COMPARE_EXCHANGE_WORD()                          \
+  do {                                                                   \
+    Register new_val = i.InputRegister(1);                               \
+    Register output = i.OutputRegister();                                \
+    Register addr = kScratchReg;                                         \
+    size_t index = 2;                                                    \
+    AddressingMode mode = kMode_None;                                    \
+    MemOperand op = i.MemoryOperand(&mode, &index);                      \
+    __ lay(addr, op);                                                    \
+    __ CmpAndSwap(output, new_val, MemOperand(addr));                    \
+  } while (false)
+
+#define ASSEMBLE_ATOMIC_BINOP_WORD(load_and_op)                           \
+  do {                                                                    \
+    Register value = i.InputRegister(2);                                  \
+    Register result = i.OutputRegister(0);                                \
+    Register addr = r1;                                                   \
+    AddressingMode mode = kMode_None;                                     \
+    MemOperand op = i.MemoryOperand(&mode);                               \
+    __ lay(addr, op);                                                     \
+    __ load_and_op(result, value, MemOperand(addr));                      \
+    __ LoadlW(result, result);                                            \
+  } while (false)
+
+#define ATOMIC_BIN_OP(bin_inst, offset, shift_amount, start, end)         \
+  do {                                                                    \
+    Label do_cs;                                                          \
+    __ LoadlW(prev, MemOperand(addr, offset));                            \
+    __ bind(&do_cs);                                                      \
+    __ RotateInsertSelectBits(temp, value, Operand(start), Operand(end),  \
+             Operand(static_cast<intptr_t>(shift_amount)), true);         \
+    __ bin_inst(new_val, prev, temp);                                     \
+    __ lr(temp, prev);                                                    \
+    __ RotateInsertSelectBits(temp, new_val, Operand(start),              \
+             Operand(end), Operand::Zero(), false);                       \
+    __ CmpAndSwap(prev, temp, MemOperand(addr, offset));                  \
+    __ bne(&do_cs, Label::kNear);                                         \
+  } while (false)
+
+#ifdef V8_TARGET_BIG_ENDIAN
+#define ATOMIC_BIN_OP_HALFWORD(bin_inst, index, extract_result)  \
+  {                                                              \
+    constexpr int offset = -(2 * index);                         \
+    constexpr int shift_amount = 16 - (index * 16);              \
+    constexpr int start = 48 - shift_amount;                     \
+    constexpr int end = start + 15;                              \
+    ATOMIC_BIN_OP(bin_inst, offset, shift_amount, start, end);   \
+    extract_result();                                            \
+  }
+#define ATOMIC_BIN_OP_BYTE(bin_inst, index, extract_result)      \
+  {                                                              \
+    constexpr int offset = -(index);                             \
+    constexpr int shift_amount = 24 - (index * 8);               \
+    constexpr int start = 56 - shift_amount;                     \
+    constexpr int end = start + 7;                               \
+    ATOMIC_BIN_OP(bin_inst, offset, shift_amount, start, end);   \
+    extract_result();                                            \
+  }
+#else
+#define ATOMIC_BIN_OP_HALFWORD(bin_inst, index, extract_result)  \
+  {                                                              \
+    constexpr int offset = -(2 * index);                         \
+    constexpr int shift_amount = index * 16;                     \
+    constexpr int start = 48 - shift_amount;                     \
+    constexpr int end = start + 15;                              \
+    ATOMIC_BIN_OP(bin_inst, offset, shift_amount, start, end);   \
+    extract_result();                                            \
+  }
+#define ATOMIC_BIN_OP_BYTE(bin_inst, index, extract_result)      \
+  {                                                              \
+    constexpr int offset = -(index);                             \
+    constexpr int shift_amount = index * 8;                      \
+    constexpr int start = 56 - shift_amount;                     \
+    constexpr int end = start + 7;                               \
+    ATOMIC_BIN_OP(bin_inst, offset, shift_amount, start, end);   \
+    extract_result();                                            \
+  }
+#endif  // V8_TARGET_BIG_ENDIAN
+
+#define ASSEMBLE_ATOMIC_BINOP_HALFWORD(bin_inst, extract_result)          \
+  do {                                                                    \
+    Register value = i.InputRegister(2);                                  \
+    Register result = i.OutputRegister(0);                                \
+    Register prev = i.TempRegister(0);                                    \
+    Register new_val = r0;                                                \
+    Register addr = r1;                                                   \
+    Register temp = kScratchReg;                                          \
+    AddressingMode mode = kMode_None;                                     \
+    MemOperand op = i.MemoryOperand(&mode);                               \
+    Label two, done;                                                      \
+    __ lay(addr, op);                                                     \
+    __ tmll(addr, Operand(3));                                            \
+    __ b(Condition(2), &two);                                             \
+    /* word boundary */                                                   \
+    ATOMIC_BIN_OP_HALFWORD(bin_inst, 0, extract_result);                  \
+    __ b(&done);                                                          \
+    __ bind(&two);                                                        \
+    /* halfword boundary */                                               \
+    ATOMIC_BIN_OP_HALFWORD(bin_inst, 1, extract_result);                  \
+    __ bind(&done);                                                       \
+  } while (false)
+
+#define ASSEMBLE_ATOMIC_BINOP_BYTE(bin_inst, extract_result)              \
+  do {                                                                    \
+    Register value = i.InputRegister(2);                                  \
+    Register result = i.OutputRegister(0);                                \
+    Register addr = i.TempRegister(0);                                    \
+    Register prev = r0;                                                   \
+    Register new_val = r1;                                                \
+    Register temp = kScratchReg;                                          \
+    AddressingMode mode = kMode_None;                                     \
+    MemOperand op = i.MemoryOperand(&mode);                               \
+    Label done, one, two, three;                                          \
+    __ lay(addr, op);                                                     \
+    __ tmll(addr, Operand(3));                                            \
+    __ b(Condition(1), &three);                                           \
+    __ b(Condition(2), &two);                                             \
+    __ b(Condition(4), &one);                                             \
+    /* ending with 0b00 (word boundary) */                                \
+    ATOMIC_BIN_OP_BYTE(bin_inst, 0, extract_result);                      \
+    __ b(&done);                                                          \
+    /* ending with 0b01 */                                                \
+    __ bind(&one);                                                        \
+    ATOMIC_BIN_OP_BYTE(bin_inst, 1, extract_result);                      \
+    __ b(&done);                                                          \
+    /* ending with 0b10 (hw boundary) */                                  \
+    __ bind(&two);                                                        \
+    ATOMIC_BIN_OP_BYTE(bin_inst, 2, extract_result);                      \
+    __ b(&done);                                                          \
+    /* ending with 0b11 */                                                \
+    __ bind(&three);                                                      \
+    ATOMIC_BIN_OP_BYTE(bin_inst, 3, extract_result);                      \
+    __ bind(&done);                                                       \
+  } while (false)
+
 void CodeGenerator::AssembleDeconstructFrame() {
   __ LeaveFrame(StackFrame::MANUAL);
 }
@@ -1066,6 +1309,9 @@ void CodeGenerator::BailoutIfDeoptimized() {
   __ LoadW(ip,
            FieldMemOperand(ip, CodeDataContainer::kKindSpecificFlagsOffset));
   __ TestBit(ip, Code::kMarkedForDeoptimizationBit);
+  // Ensure we're not serializing (otherwise we'd need to use an indirection to
+  // access the builtin below).
+  DCHECK(!isolate()->ShouldLoadConstantsFromRootList());
   Handle<Code> code = isolate()->builtins()->builtin_handle(
       Builtins::kCompileLazyDeoptimizedCode);
   __ Jump(code, RelocInfo::CODE_TARGET, ne);
@@ -1108,9 +1354,12 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
     }
     case kArchCallCodeObject: {
       if (HasRegisterInput(instr, 0)) {
-        __ AddP(ip, i.InputRegister(0),
-                Operand(Code::kHeaderSize - kHeapObjectTag));
-        __ Call(ip);
+        Register reg = i.InputRegister(0);
+        DCHECK_IMPLIES(
+            HasCallDescriptorFlag(instr, CallDescriptor::kFixedTargetRegister),
+            reg == kJavaScriptCallCodeStartRegister);
+        __ AddP(reg, reg, Operand(Code::kHeaderSize - kHeapObjectTag));
+        __ Call(reg);
       } else {
         __ Call(i.InputCode(0), RelocInfo::CODE_TARGET);
       }
@@ -1121,20 +1370,14 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
     case kArchCallWasmFunction: {
       // We must not share code targets for calls to builtins for wasm code, as
       // they might need to be patched individually.
-      RelocInfo::Mode rmode = RelocInfo::JS_TO_WASM_CALL;
-      if (info()->IsWasm()) {
-        rmode = RelocInfo::WASM_CALL;
-      }
-
       if (instr->InputAt(0)->IsImmediate()) {
+        Constant constant = i.ToConstant(instr->InputAt(0));
 #ifdef V8_TARGET_ARCH_S390X
-        Address wasm_code = reinterpret_cast<Address>(
-            i.ToConstant(instr->InputAt(0)).ToInt64());
+        Address wasm_code = static_cast<Address>(constant.ToInt64());
 #else
-        Address wasm_code = reinterpret_cast<Address>(
-            i.ToConstant(instr->InputAt(0)).ToInt32());
+        Address wasm_code = static_cast<Address>(constant.ToInt32());
 #endif
-        __ Call(wasm_code, rmode);
+        __ Call(wasm_code, constant.rmode());
       } else {
         __ Call(i.InputRegister(0));
       }
@@ -1150,9 +1393,12 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
                                          i.TempRegister(2));
       }
       if (HasRegisterInput(instr, 0)) {
-        __ AddP(ip, i.InputRegister(0),
-                Operand(Code::kHeaderSize - kHeapObjectTag));
-        __ Jump(ip);
+        Register reg = i.InputRegister(0);
+        DCHECK_IMPLIES(
+            HasCallDescriptorFlag(instr, CallDescriptor::kFixedTargetRegister),
+            reg == kJavaScriptCallCodeStartRegister);
+        __ AddP(reg, reg, Operand(Code::kHeaderSize - kHeapObjectTag));
+        __ Jump(reg);
       } else {
         // We cannot use the constant pool to load the target since
         // we've already restored the caller's frame.
@@ -1166,15 +1412,14 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
     case kArchTailCallWasm: {
       // We must not share code targets for calls to builtins for wasm code, as
       // they might need to be patched individually.
-      RelocInfo::Mode rmode = RelocInfo::JS_TO_WASM_CALL;
-      if (info()->IsWasm()) {
-        rmode = RelocInfo::WASM_CALL;
-      }
-
       if (instr->InputAt(0)->IsImmediate()) {
-        Address wasm_code = reinterpret_cast<Address>(
-            i.ToConstant(instr->InputAt(0)).ToInt32());
-        __ Jump(wasm_code, rmode);
+        Constant constant = i.ToConstant(instr->InputAt(0));
+#ifdef V8_TARGET_ARCH_S390X
+        Address wasm_code = static_cast<Address>(constant.ToInt64());
+#else
+        Address wasm_code = static_cast<Address>(constant.ToInt32());
+#endif
+        __ Jump(wasm_code, constant.rmode());
       } else {
         __ Jump(i.InputRegister(0));
       }
@@ -1184,7 +1429,11 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
     }
     case kArchTailCallAddress: {
       CHECK(!instr->InputAt(0)->IsImmediate());
-      __ Jump(i.InputRegister(0));
+      Register reg = i.InputRegister(0);
+      DCHECK_IMPLIES(
+          HasCallDescriptorFlag(instr, CallDescriptor::kFixedTargetRegister),
+          reg == kJavaScriptCallCodeStartRegister);
+      __ Jump(reg);
       frame_access_state()->ClearSPDelta();
       frame_access_state()->SetFrameAccessToDefault();
       break;
@@ -1272,6 +1521,9 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
     case kArchJmp:
       AssembleArchJump(i.InputRpo(0));
       break;
+    case kArchBinarySearchSwitch:
+      AssembleArchBinarySearchSwitch(instr);
+      break;
     case kArchLookupSwitch:
       AssembleArchLookupSwitch(instr);
       break;
@@ -1323,13 +1575,9 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
         __ LoadRR(i.OutputRegister(), fp);
       }
       break;
-    case kArchRootsPointer:
-      __ LoadRR(i.OutputRegister(), kRootRegister);
-      break;
     case kArchTruncateDoubleToI:
-      // TODO(mbrandy): move slow call to stub out of line.
-      __ TruncateDoubleToIDelayed(zone(), i.OutputRegister(),
-                                  i.InputDoubleRegister(0));
+      __ TruncateDoubleToI(isolate(), zone(), i.OutputRegister(),
+                           i.InputDoubleRegister(0), DetermineStubCallMode());
       break;
     case kArchStoreWithWriteBarrier: {
       RecordWriteMode mode =
@@ -1367,7 +1615,7 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
               Operand(offset.offset()));
       break;
     }
-    case kArchPoisonOnSpeculationWord:
+    case kArchWordPoisonOnSpeculation:
       DCHECK_EQ(i.OutputRegister(), i.InputRegister(0));
       __ AndP(i.InputRegister(0), kSpeculationPoisonRegister);
       break;
@@ -1559,8 +1807,8 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
         int shiftAmount = i.InputInt32(1);
         int endBit = 63 - shiftAmount;
         int startBit = 63 - i.InputInt32(2);
-        __ risbg(i.OutputRegister(), i.InputRegister(0), Operand(startBit),
-                 Operand(endBit), Operand(shiftAmount), true);
+        __ RotateInsertSelectBits(i.OutputRegister(), i.InputRegister(0),
+               Operand(startBit), Operand(endBit), Operand(shiftAmount), true);
       } else {
         int shiftAmount = i.InputInt32(1);
         int clearBit = 63 - i.InputInt32(2);
@@ -1576,8 +1824,8 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
         int shiftAmount = i.InputInt32(1);
         int endBit = 63;
         int startBit = 63 - i.InputInt32(2);
-        __ risbg(i.OutputRegister(), i.InputRegister(0), Operand(startBit),
-                 Operand(endBit), Operand(shiftAmount), true);
+        __ RotateInsertSelectBits(i.OutputRegister(), i.InputRegister(0),
+                Operand(startBit), Operand(endBit), Operand(shiftAmount), true);
       } else {
         int shiftAmount = i.InputInt32(1);
         int clearBit = 63 - i.InputInt32(2);
@@ -1591,8 +1839,8 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
         int shiftAmount = i.InputInt32(1);
         int endBit = 63 - i.InputInt32(2);
         int startBit = 0;
-        __ risbg(i.OutputRegister(), i.InputRegister(0), Operand(startBit),
-                 Operand(endBit), Operand(shiftAmount), true);
+        __ RotateInsertSelectBits(i.OutputRegister(), i.InputRegister(0),
+                Operand(startBit), Operand(endBit), Operand(shiftAmount), true);
       } else {
         int shiftAmount = i.InputInt32(1);
         int clearBit = i.InputInt32(2);
@@ -1723,16 +1971,16 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       ASSEMBLE_UNARY_OP(D_DInstr(sqdbr), nullInstr, nullInstr);
       break;
     case kS390_FloorFloat:
-      __ fiebra(i.OutputDoubleRegister(), i.InputDoubleRegister(0),
-                v8::internal::Assembler::FIDBRA_ROUND_TOWARD_NEG_INF);
+      __ fiebra(v8::internal::Assembler::FIDBRA_ROUND_TOWARD_NEG_INF,
+                i.OutputDoubleRegister(), i.InputDoubleRegister(0));
       break;
     case kS390_CeilFloat:
-      __ fiebra(i.OutputDoubleRegister(), i.InputDoubleRegister(0),
-                v8::internal::Assembler::FIDBRA_ROUND_TOWARD_POS_INF);
+      __ fiebra(v8::internal::Assembler::FIDBRA_ROUND_TOWARD_POS_INF,
+                i.OutputDoubleRegister(), i.InputDoubleRegister(0));
       break;
     case kS390_TruncateFloat:
-      __ fiebra(i.OutputDoubleRegister(), i.InputDoubleRegister(0),
-                v8::internal::Assembler::FIDBRA_ROUND_TOWARD_0);
+      __ fiebra(v8::internal::Assembler::FIDBRA_ROUND_TOWARD_0,
+                i.OutputDoubleRegister(), i.InputDoubleRegister(0));
       break;
     //  Double operations
     case kS390_ModDouble:
@@ -1799,7 +2047,7 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       ASSEMBLE_IEEE754_UNOP(log10);
       break;
     case kIeee754Float64Pow: {
-      __ CallStubDelayed(new (zone()) MathPowStub());
+      __ Call(BUILTIN_CODE(isolate(), MathPowInternal), RelocInfo::CODE_TARGET);
       __ Move(d1, d3);
       break;
     }
@@ -1826,20 +2074,20 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       __ lpdbr(i.OutputDoubleRegister(), i.InputDoubleRegister(0));
       break;
     case kS390_FloorDouble:
-      __ fidbra(i.OutputDoubleRegister(), i.InputDoubleRegister(0),
-                v8::internal::Assembler::FIDBRA_ROUND_TOWARD_NEG_INF);
+      __ fidbra(v8::internal::Assembler::FIDBRA_ROUND_TOWARD_NEG_INF,
+                i.OutputDoubleRegister(), i.InputDoubleRegister(0));
       break;
     case kS390_CeilDouble:
-      __ fidbra(i.OutputDoubleRegister(), i.InputDoubleRegister(0),
-                v8::internal::Assembler::FIDBRA_ROUND_TOWARD_POS_INF);
+      __ fidbra(v8::internal::Assembler::FIDBRA_ROUND_TOWARD_POS_INF,
+                i.OutputDoubleRegister(), i.InputDoubleRegister(0));
       break;
     case kS390_TruncateDouble:
-      __ fidbra(i.OutputDoubleRegister(), i.InputDoubleRegister(0),
-                v8::internal::Assembler::FIDBRA_ROUND_TOWARD_0);
+      __ fidbra(v8::internal::Assembler::FIDBRA_ROUND_TOWARD_0,
+                i.OutputDoubleRegister(), i.InputDoubleRegister(0));
       break;
     case kS390_RoundDouble:
-      __ fidbra(i.OutputDoubleRegister(), i.InputDoubleRegister(0),
-                v8::internal::Assembler::FIDBRA_ROUND_TO_NEAREST_AWAY_FROM_0);
+      __ fidbra(v8::internal::Assembler::FIDBRA_ROUND_TO_NEAREST_AWAY_FROM_0,
+                i.OutputDoubleRegister(), i.InputDoubleRegister(0));
       break;
     case kS390_NegFloat:
       ASSEMBLE_UNARY_OP(D_DInstr(lcebr), nullInstr, nullInstr);
@@ -2299,11 +2547,11 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
 #define ATOMIC_EXCHANGE(start, end, shift_amount, offset)                    \
   {                                                                          \
     Label do_cs;                                                             \
-    __ LoadlW(output, MemOperand(r1));                                       \
+    __ LoadlW(output, MemOperand(r1, offset));                               \
     __ bind(&do_cs);                                                         \
     __ llgfr(r0, output);                                                    \
-    __ risbg(r0, value, Operand(start), Operand(end), Operand(shift_amount), \
-             false);                                                         \
+    __ RotateInsertSelectBits(r0, value, Operand(start), Operand(end),       \
+             Operand(shift_amount), false);                                  \
     __ csy(output, r0, MemOperand(r1, offset));                              \
     __ bne(&do_cs, Label::kNear);                                            \
     __ srl(output, Operand(shift_amount));                                   \
@@ -2426,6 +2674,73 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       __ bne(&do_cs, Label::kNear);
       break;
     }
+    case kWord32AtomicCompareExchangeInt8:
+      ASSEMBLE_ATOMIC_COMPARE_EXCHANGE_BYTE(LoadB);
+      break;
+    case kWord32AtomicCompareExchangeUint8:
+      ASSEMBLE_ATOMIC_COMPARE_EXCHANGE_BYTE(LoadlB);
+      break;
+    case kWord32AtomicCompareExchangeInt16:
+      ASSEMBLE_ATOMIC_COMPARE_EXCHANGE_HALFWORD(LoadHalfWordP);
+      break;
+    case kWord32AtomicCompareExchangeUint16:
+      ASSEMBLE_ATOMIC_COMPARE_EXCHANGE_HALFWORD(LoadLogicalHalfWordP);
+      break;
+    case kWord32AtomicCompareExchangeWord32:
+      ASSEMBLE_ATOMIC_COMPARE_EXCHANGE_WORD();
+      break;
+#define ATOMIC_BINOP_CASE(op, inst)                                     \
+  case kWord32Atomic##op##Int8:                                         \
+    ASSEMBLE_ATOMIC_BINOP_BYTE(inst, [&]() {                            \
+          intptr_t shift_right = static_cast<intptr_t>(shift_amount);   \
+          __ srlk(result, prev, Operand(shift_right));                  \
+          __ LoadB(result, result);                                     \
+        });                                                             \
+    break;                                                              \
+  case kWord32Atomic##op##Uint8:                                        \
+    ASSEMBLE_ATOMIC_BINOP_BYTE(inst, [&]() {                            \
+          int rotate_left = shift_amount == 0 ? 0 : 64 - shift_amount;  \
+          __ RotateInsertSelectBits(result, prev, Operand(56),          \
+              Operand(63), Operand(static_cast<intptr_t>(rotate_left)), \
+              true);                                                    \
+        });                                                             \
+    break;                                                              \
+  case kWord32Atomic##op##Int16:                                        \
+    ASSEMBLE_ATOMIC_BINOP_HALFWORD(inst, [&]() {                        \
+          intptr_t shift_right = static_cast<intptr_t>(shift_amount);   \
+          __ srlk(result, prev, Operand(shift_right));                  \
+          __ LoadHalfWordP(result, result);                             \
+        });                                                             \
+    break;                                                              \
+  case kWord32Atomic##op##Uint16:                                       \
+    ASSEMBLE_ATOMIC_BINOP_HALFWORD(inst, [&]() {                        \
+          int rotate_left = shift_amount == 0 ? 0 : 64 - shift_amount;  \
+          __ RotateInsertSelectBits(result, prev, Operand(48),          \
+              Operand(63), Operand(static_cast<intptr_t>(rotate_left)), \
+              true);                                                    \
+        });                                                             \
+    break;
+      ATOMIC_BINOP_CASE(Add, Add32)
+      ATOMIC_BINOP_CASE(Sub, Sub32)
+      ATOMIC_BINOP_CASE(And, And)
+      ATOMIC_BINOP_CASE(Or, Or)
+      ATOMIC_BINOP_CASE(Xor, Xor)
+#undef ATOMIC_BINOP_CASE
+    case kWord32AtomicAddWord32:
+      ASSEMBLE_ATOMIC_BINOP_WORD(laa);
+      break;
+    case kWord32AtomicSubWord32:
+      ASSEMBLE_ATOMIC_BINOP_WORD(LoadAndSub32);
+      break;
+    case kWord32AtomicAndWord32:
+      ASSEMBLE_ATOMIC_BINOP_WORD(lan);
+      break;
+    case kWord32AtomicOrWord32:
+      ASSEMBLE_ATOMIC_BINOP_WORD(lao);
+      break;
+    case kWord32AtomicXorWord32:
+      ASSEMBLE_ATOMIC_BINOP_WORD(lax);
+      break;
     default:
       UNREACHABLE();
       break;
@@ -2481,39 +2796,26 @@ void CodeGenerator::AssembleArchTrap(Instruction* instr,
                                      FlagsCondition condition) {
   class OutOfLineTrap final : public OutOfLineCode {
    public:
-    OutOfLineTrap(CodeGenerator* gen, bool frame_elided, Instruction* instr)
-        : OutOfLineCode(gen),
-          frame_elided_(frame_elided),
-          instr_(instr),
-          gen_(gen) {}
+    OutOfLineTrap(CodeGenerator* gen, Instruction* instr)
+        : OutOfLineCode(gen), instr_(instr), gen_(gen) {}
 
     void Generate() final {
       S390OperandConverter i(gen_, instr_);
-
-      Builtins::Name trap_id =
-          static_cast<Builtins::Name>(i.InputInt32(instr_->InputCount() - 1));
-      bool old_has_frame = __ has_frame();
-      if (frame_elided_) {
-        __ set_has_frame(true);
-        __ EnterFrame(StackFrame::WASM_COMPILED);
-      }
+      TrapId trap_id =
+          static_cast<TrapId>(i.InputInt32(instr_->InputCount() - 1));
       GenerateCallToTrap(trap_id);
-      if (frame_elided_) {
-        __ set_has_frame(old_has_frame);
-      }
     }
 
    private:
-    void GenerateCallToTrap(Builtins::Name trap_id) {
-      if (trap_id == Builtins::builtin_count) {
+    void GenerateCallToTrap(TrapId trap_id) {
+      if (trap_id == TrapId::kInvalid) {
         // We cannot test calls to the runtime in cctest/test-run-wasm.
         // Therefore we emit a call to C here instead of a call to the runtime.
         // We use the context register as the scratch register, because we do
         // not have a context here.
         __ PrepareCallCFunction(0, 0, cp);
-        __ CallCFunction(ExternalReference::wasm_call_trap_callback_for_testing(
-                             __ isolate()),
-                         0);
+        __ CallCFunction(
+            ExternalReference::wasm_call_trap_callback_for_testing(), 0);
         __ LeaveFrame(StackFrame::WASM_COMPILED);
         auto call_descriptor = gen_->linkage()->GetIncomingDescriptor();
         int pop_count =
@@ -2522,8 +2824,9 @@ void CodeGenerator::AssembleArchTrap(Instruction* instr,
         __ Ret();
       } else {
         gen_->AssembleSourcePosition(instr_);
-        __ Call(__ isolate()->builtins()->builtin_handle(trap_id),
-                RelocInfo::CODE_TARGET);
+        // A direct call to a wasm runtime stub defined in this module.
+        // Just encode the stub index. This will be patched at relocation.
+        __ Call(static_cast<Address>(trap_id), RelocInfo::WASM_STUB_CALL);
         ReferenceMap* reference_map =
             new (gen_->zone()) ReferenceMap(gen_->zone());
         gen_->RecordSafepoint(reference_map, Safepoint::kSimple, 0,
@@ -2534,12 +2837,10 @@ void CodeGenerator::AssembleArchTrap(Instruction* instr,
       }
     }
 
-    bool frame_elided_;
     Instruction* instr_;
     CodeGenerator* gen_;
   };
-  bool frame_elided = !frame_access_state()->has_frame();
-  auto ool = new (zone()) OutOfLineTrap(this, frame_elided, instr);
+  auto ool = new (zone()) OutOfLineTrap(this, instr);
   Label* tlabel = ool->entry();
   Label end;
 
@@ -2589,6 +2890,17 @@ void CodeGenerator::AssembleArchBoolean(Instruction* instr,
   __ bind(&done);
 }
 
+void CodeGenerator::AssembleArchBinarySearchSwitch(Instruction* instr) {
+  S390OperandConverter i(this, instr);
+  Register input = i.InputRegister(0);
+  std::vector<std::pair<int32_t, Label*>> cases;
+  for (size_t index = 2; index < instr->InputCount(); index += 2) {
+    cases.push_back({i.InputInt32(index + 0), GetLabel(i.InputRpo(index + 1))});
+  }
+  AssembleArchBinarySearchSwitchRange(input, i.InputRpo(1), cases.data(),
+                                      cases.data() + cases.size());
+}
+
 void CodeGenerator::AssembleArchLookupSwitch(Instruction* instr) {
   S390OperandConverter i(this, instr);
   Register input = i.InputRegister(0);
@@ -2655,6 +2967,9 @@ void CodeGenerator::AssembleConstructFrame() {
       // TODO(mbrandy): Detect cases where ip is the entrypoint (for
       // efficient intialization of the constant pool pointer register).
       __ StubPrologue(type);
+      if (call_descriptor->IsWasmFunctionCall()) {
+        __ Push(kWasmInstanceRegister);
+      }
     }
   }
 
@@ -2674,30 +2989,83 @@ void CodeGenerator::AssembleConstructFrame() {
     ResetSpeculationPoison();
   }
 
-  const RegList double_saves = call_descriptor->CalleeSavedFPRegisters();
+  const RegList saves_fp = call_descriptor->CalleeSavedFPRegisters();
+  const RegList saves = call_descriptor->CalleeSavedRegisters();
+
   if (shrink_slots > 0) {
+    if (info()->IsWasm() && shrink_slots > 128) {
+      // For WebAssembly functions with big frames we have to do the stack
+      // overflow check before we construct the frame. Otherwise we may not
+      // have enough space on the stack to call the runtime for the stack
+      // overflow.
+      Label done;
+
+      // If the frame is bigger than the stack, we throw the stack overflow
+      // exception unconditionally. Thereby we can avoid the integer overflow
+      // check in the condition code.
+      if ((shrink_slots * kPointerSize) < (FLAG_stack_size * 1024)) {
+        Register scratch = r1;
+        __ LoadP(scratch, FieldMemOperand(
+                            kWasmInstanceRegister,
+                            WasmInstanceObject::kRealStackLimitAddressOffset));
+        __ LoadP(scratch, MemOperand(scratch));
+        __ AddP(scratch, scratch, Operand(shrink_slots * kPointerSize));
+        __ CmpLogicalP(sp, scratch);
+        __ bge(&done);
+      }
+
+      __ LoadP(r2, FieldMemOperand(kWasmInstanceRegister,
+                                   WasmInstanceObject::kCEntryStubOffset));
+      __ Move(cp, Smi::kZero);
+      __ CallRuntimeWithCEntry(Runtime::kThrowWasmStackOverflow, r2);
+      // We come from WebAssembly, there are no references for the GC.
+      ReferenceMap* reference_map = new (zone()) ReferenceMap(zone());
+      RecordSafepoint(reference_map, Safepoint::kSimple, 0,
+                      Safepoint::kNoLazyDeopt);
+      if (FLAG_debug_code) {
+        __ stop(GetAbortReason(AbortReason::kUnexpectedReturnFromThrow));
+      }
+
+      __ bind(&done);
+    }
+
+    // Skip callee-saved and return slots, which are pushed below.
+    shrink_slots -= base::bits::CountPopulation(saves);
+    shrink_slots -= frame()->GetReturnSlotCount();
+    shrink_slots -=
+        (kDoubleSize / kPointerSize) * base::bits::CountPopulation(saves_fp);
     __ lay(sp, MemOperand(sp, -shrink_slots * kPointerSize));
   }
 
   // Save callee-saved Double registers.
-  if (double_saves != 0) {
-    __ MultiPushDoubles(double_saves);
-    DCHECK_EQ(kNumCalleeSavedDoubles,
-              base::bits::CountPopulation(double_saves));
+  if (saves_fp != 0) {
+    __ MultiPushDoubles(saves_fp);
+    DCHECK_EQ(kNumCalleeSavedDoubles, base::bits::CountPopulation(saves_fp));
   }
 
   // Save callee-saved registers.
-  const RegList saves = call_descriptor->CalleeSavedRegisters();
   if (saves != 0) {
     __ MultiPush(saves);
     // register save area does not include the fp or constant pool pointer.
   }
+
+  const int returns = frame()->GetReturnSlotCount();
+  if (returns != 0) {
+    // Create space for returns.
+    __ lay(sp, MemOperand(sp, -returns * kPointerSize));
+  }
 }
 
 void CodeGenerator::AssembleReturn(InstructionOperand* pop) {
   auto call_descriptor = linkage()->GetIncomingDescriptor();
   int pop_count = static_cast<int>(call_descriptor->StackParameterCount());
 
+  const int returns = frame()->GetReturnSlotCount();
+  if (returns != 0) {
+    // Create space for returns.
+    __ lay(sp, MemOperand(sp, returns * kPointerSize));
+  }
+
   // Restore registers.
   const RegList saves = call_descriptor->CalleeSavedRegisters();
   if (saves != 0) {
@@ -2729,7 +3097,6 @@ void CodeGenerator::AssembleReturn(InstructionOperand* pop) {
     }
   }
   if (pop->IsImmediate()) {
-    DCHECK_EQ(Constant::kInt32, g.ToConstant(pop).type());
     pop_count += g.ToConstant(pop).ToInt32();
   } else {
     __ Drop(g.ToRegister(pop));
@@ -2798,7 +3165,7 @@ void CodeGenerator::AssembleMove(InstructionOperand* source,
           __ mov(dst, Operand::EmbeddedNumber(src.ToFloat64().value()));
           break;
         case Constant::kExternalReference:
-          __ mov(dst, Operand(src.ToExternalReference()));
+          __ Move(dst, src.ToExternalReference());
           break;
         case Constant::kHeapObject: {
           Handle<HeapObject> src_object = src.ToHeapObject();
diff --git a/deps/v8/src/compiler/s390/instruction-selector-s390.cc b/deps/v8/src/compiler/s390/instruction-selector-s390.cc
index 2c658880c92c77..340cbb65c1bc97 100644
--- a/deps/v8/src/compiler/s390/instruction-selector-s390.cc
+++ b/deps/v8/src/compiler/s390/instruction-selector-s390.cc
@@ -243,6 +243,17 @@ class S390OperandGenerator final : public OperandGenerator {
   bool Is64BitOperand(Node* node) {
     return MachineRepresentation::kWord64 == GetRepresentation(node);
   }
+
+  // Use the stack pointer if the node is LoadStackPointer, otherwise assign a
+  // register.
+  InstructionOperand UseRegisterOrStackPointer(Node* node) {
+    if (node->opcode() == IrOpcode::kLoadStackPointer) {
+      return LocationOperand(LocationOperand::EXPLICIT,
+                             LocationOperand::REGISTER,
+                             MachineRepresentation::kWord32, sp.code());
+    }
+    return UseRegister(node);
+  }
 };
 
 namespace {
@@ -690,7 +701,7 @@ void InstructionSelector::VisitLoad(Node* node) {
       g.GetEffectiveAddressMemoryOperand(node, inputs, &input_count);
   opcode |= AddressingModeField::encode(mode);
   if (node->opcode() == IrOpcode::kPoisonedLoad) {
-    CHECK_EQ(poisoning_enabled_, PoisoningMitigationLevel::kOn);
+    CHECK_NE(poisoning_level_, PoisoningMitigationLevel::kDontPoison);
     opcode |= MiscField::encode(kMemoryAccessPoisoned);
   }
 
@@ -1662,7 +1673,7 @@ void VisitWordCompare(InstructionSelector* selector, Node* node,
     return VisitLoadAndTest(selector, load_and_test, node, left, cont, true);
   }
 
-  inputs[input_count++] = g.UseRegister(left);
+  inputs[input_count++] = g.UseRegisterOrStackPointer(left);
   if (g.CanBeMemoryOperand(opcode, node, right, effect_level)) {
     // generate memory operand
     AddressingMode addressing_mode = g.GetEffectiveAddressMemoryOperand(
@@ -2030,8 +2041,8 @@ void InstructionSelector::VisitSwitch(Node* node, const SwitchInfo& sw) {
   }
   }
 
-  // Generate a sequence of conditional jumps.
-  return EmitLookupSwitch(sw, value_operand);
+  // Generate a tree of conditional jumps.
+  return EmitBinarySearchSwitch(sw, value_operand);
 }
 
 void InstructionSelector::VisitWord32Equal(Node* const node) {
@@ -2268,24 +2279,124 @@ void InstructionSelector::VisitWord32AtomicExchange(Node* node) {
   inputs[input_count++] = g.UseUniqueRegister(index);
   inputs[input_count++] = g.UseUniqueRegister(value);
   InstructionOperand outputs[1];
-  outputs[0] = g.UseUniqueRegister(node);
+  outputs[0] = g.DefineAsRegister(node);
   InstructionCode code = opcode | AddressingModeField::encode(addressing_mode);
   Emit(code, 1, outputs, input_count, inputs);
 }
 
 void InstructionSelector::VisitWord32AtomicCompareExchange(Node* node) {
-  UNIMPLEMENTED();
+  S390OperandGenerator g(this);
+  Node* base = node->InputAt(0);
+  Node* index = node->InputAt(1);
+  Node* old_value = node->InputAt(2);
+  Node* new_value = node->InputAt(3);
+
+  MachineType type = AtomicOpRepresentationOf(node->op());
+  ArchOpcode opcode = kArchNop;
+  if (type == MachineType::Int8()) {
+    opcode = kWord32AtomicCompareExchangeInt8;
+  } else if (type == MachineType::Uint8()) {
+    opcode = kWord32AtomicCompareExchangeUint8;
+  } else if (type == MachineType::Int16()) {
+    opcode = kWord32AtomicCompareExchangeInt16;
+  } else if (type == MachineType::Uint16()) {
+    opcode = kWord32AtomicCompareExchangeUint16;
+  } else if (type == MachineType::Int32() || type == MachineType::Uint32()) {
+    opcode = kWord32AtomicCompareExchangeWord32;
+  } else {
+    UNREACHABLE();
+    return;
+  }
+
+  InstructionOperand inputs[4];
+  size_t input_count = 0;
+  inputs[input_count++] = g.UseUniqueRegister(old_value);
+  inputs[input_count++] = g.UseUniqueRegister(new_value);
+  inputs[input_count++] = g.UseUniqueRegister(base);
+
+  AddressingMode addressing_mode;
+  if (g.CanBeImmediate(index, OperandMode::kInt20Imm)) {
+    inputs[input_count++] = g.UseImmediate(index);
+    addressing_mode = kMode_MRI;
+  } else {
+    inputs[input_count++] = g.UseUniqueRegister(index);
+    addressing_mode = kMode_MRR;
+  }
+
+  InstructionOperand outputs[1];
+  size_t output_count = 0;
+  outputs[output_count++] = g.DefineSameAsFirst(node);
+
+  InstructionCode code = opcode | AddressingModeField::encode(addressing_mode);
+  Emit(code, output_count, outputs, input_count, inputs);
 }
 
-void InstructionSelector::VisitWord32AtomicAdd(Node* node) { UNIMPLEMENTED(); }
+void InstructionSelector::VisitWord32AtomicBinaryOperation(
+    Node* node, ArchOpcode int8_op, ArchOpcode uint8_op, ArchOpcode int16_op,
+    ArchOpcode uint16_op, ArchOpcode word32_op) {
+  S390OperandGenerator g(this);
+  Node* base = node->InputAt(0);
+  Node* index = node->InputAt(1);
+  Node* value = node->InputAt(2);
 
-void InstructionSelector::VisitWord32AtomicSub(Node* node) { UNIMPLEMENTED(); }
+  MachineType type = AtomicOpRepresentationOf(node->op());
+  ArchOpcode opcode = kArchNop;
 
-void InstructionSelector::VisitWord32AtomicAnd(Node* node) { UNIMPLEMENTED(); }
+  if (type == MachineType::Int8()) {
+    opcode = int8_op;
+  } else if (type == MachineType::Uint8()) {
+    opcode = uint8_op;
+  } else if (type == MachineType::Int16()) {
+    opcode = int16_op;
+  } else if (type == MachineType::Uint16()) {
+    opcode = uint16_op;
+  } else if (type == MachineType::Int32() || type == MachineType::Uint32()) {
+    opcode = word32_op;
+  } else {
+    UNREACHABLE();
+    return;
+  }
 
-void InstructionSelector::VisitWord32AtomicOr(Node* node) { UNIMPLEMENTED(); }
+  InstructionOperand inputs[3];
+  size_t input_count = 0;
+  inputs[input_count++] = g.UseUniqueRegister(base);
+
+  AddressingMode addressing_mode;
+  if (g.CanBeImmediate(index, OperandMode::kInt20Imm)) {
+    inputs[input_count++] = g.UseImmediate(index);
+    addressing_mode = kMode_MRI;
+  } else {
+    inputs[input_count++] = g.UseUniqueRegister(index);
+    addressing_mode = kMode_MRR;
+  }
+
+  inputs[input_count++] = g.UseUniqueRegister(value);
+
+  InstructionOperand outputs[1];
+  size_t output_count = 0;
+  outputs[output_count++] = g.DefineAsRegister(node);
+
+  InstructionOperand temps[1];
+  size_t temp_count = 0;
+  temps[temp_count++] = g.TempRegister();
 
-void InstructionSelector::VisitWord32AtomicXor(Node* node) { UNIMPLEMENTED(); }
+  InstructionCode code = opcode | AddressingModeField::encode(addressing_mode);
+  Emit(code, output_count, outputs, input_count, inputs, temp_count, temps);
+}
+
+#define VISIT_ATOMIC_BINOP(op)                                   \
+  void InstructionSelector::VisitWord32Atomic##op(Node* node) {  \
+    VisitWord32AtomicBinaryOperation(                            \
+        node, kWord32Atomic##op##Int8, kWord32Atomic##op##Uint8, \
+        kWord32Atomic##op##Int16, kWord32Atomic##op##Uint16,     \
+        kWord32Atomic##op##Word32);                              \
+  }
+VISIT_ATOMIC_BINOP(Add)
+VISIT_ATOMIC_BINOP(Sub)
+VISIT_ATOMIC_BINOP(And)
+VISIT_ATOMIC_BINOP(Or)
+VISIT_ATOMIC_BINOP(Xor)
+#undef VISIT_ATOMIC_BINOP
 
 void InstructionSelector::VisitI32x4Splat(Node* node) { UNIMPLEMENTED(); }
 
diff --git a/deps/v8/src/compiler/schedule.cc b/deps/v8/src/compiler/schedule.cc
index 41fad5da6393a6..01034ffb73e48a 100644
--- a/deps/v8/src/compiler/schedule.cc
+++ b/deps/v8/src/compiler/schedule.cc
@@ -96,7 +96,7 @@ BasicBlock* BasicBlock::GetCommonDominator(BasicBlock* b1, BasicBlock* b2) {
   return b1;
 }
 
-void BasicBlock::Print() { OFStream(stdout) << this; }
+void BasicBlock::Print() { StdoutStream{} << this; }
 
 std::ostream& operator<<(std::ostream& os, const BasicBlock& block) {
   os << "B" << block.id();
@@ -194,9 +194,9 @@ BasicBlock* Schedule::NewBasicBlock() {
 
 void Schedule::PlanNode(BasicBlock* block, Node* node) {
   if (FLAG_trace_turbo_scheduler) {
-    OFStream os(stdout);
-    os << "Planning #" << node->id() << ":" << node->op()->mnemonic()
-       << " for future add to B" << block->id() << "\n";
+    StdoutStream{} << "Planning #" << node->id() << ":"
+                   << node->op()->mnemonic() << " for future add to B"
+                   << block->id() << "\n";
   }
   DCHECK_NULL(this->block(node));
   SetBlockForNode(block, node);
@@ -205,9 +205,8 @@ void Schedule::PlanNode(BasicBlock* block, Node* node) {
 
 void Schedule::AddNode(BasicBlock* block, Node* node) {
   if (FLAG_trace_turbo_scheduler) {
-    OFStream os(stdout);
-    os << "Adding #" << node->id() << ":" << node->op()->mnemonic() << " to B"
-       << block->id() << "\n";
+    StdoutStream{} << "Adding #" << node->id() << ":" << node->op()->mnemonic()
+                   << " to B" << block->id() << "\n";
   }
   DCHECK(this->block(node) == nullptr || this->block(node) == block);
   block->AddNode(node);
@@ -532,9 +531,7 @@ std::ostream& operator<<(std::ostream& os, const Schedule& s) {
     for (Node* node : *block) {
       os << "  " << *node;
       if (NodeProperties::IsTyped(node)) {
-        Type* type = NodeProperties::GetType(node);
-        os << " : ";
-        type->PrintTo(os);
+        os << " : " << NodeProperties::GetType(node);
       }
       os << "\n";
     }
diff --git a/deps/v8/src/compiler/scheduler.cc b/deps/v8/src/compiler/scheduler.cc
index 91e4e02dd3ebe9..13712a3561546a 100644
--- a/deps/v8/src/compiler/scheduler.cc
+++ b/deps/v8/src/compiler/scheduler.cc
@@ -1005,7 +1005,7 @@ class SpecialRPONumberer : public ZoneObject {
 
 #if DEBUG
   void PrintRPO() {
-    OFStream os(stdout);
+    StdoutStream os;
     os << "RPO with " << loops_.size() << " loops";
     if (loops_.size() > 0) {
       os << " (";
@@ -1732,8 +1732,7 @@ void Scheduler::SealFinalSchedule() {
 void Scheduler::FuseFloatingControl(BasicBlock* block, Node* node) {
   TRACE("--- FUSE FLOATING CONTROL ----------------------------------\n");
   if (FLAG_trace_turbo_scheduler) {
-    OFStream os(stdout);
-    os << "Schedule before control flow fusion:\n" << *schedule_;
+    StdoutStream{} << "Schedule before control flow fusion:\n" << *schedule_;
   }
 
   // Iterate on phase 1: Build control-flow graph.
@@ -1776,8 +1775,7 @@ void Scheduler::FuseFloatingControl(BasicBlock* block, Node* node) {
   MovePlannedNodes(block, schedule_->block(node));
 
   if (FLAG_trace_turbo_scheduler) {
-    OFStream os(stdout);
-    os << "Schedule after control flow fusion:\n" << *schedule_;
+    StdoutStream{} << "Schedule after control flow fusion:\n" << *schedule_;
   }
 }
 
diff --git a/deps/v8/src/compiler/simd-scalar-lowering.cc b/deps/v8/src/compiler/simd-scalar-lowering.cc
index 3316b92c0ba5ad..645f47f7065ecc 100644
--- a/deps/v8/src/compiler/simd-scalar-lowering.cc
+++ b/deps/v8/src/compiler/simd-scalar-lowering.cc
@@ -26,10 +26,10 @@ static const int32_t kShift8 = 24;
 }  // anonymous
 
 SimdScalarLowering::SimdScalarLowering(
-    JSGraph* jsgraph, Signature<MachineRepresentation>* signature)
-    : jsgraph_(jsgraph),
-      state_(jsgraph->graph(), 3),
-      stack_(jsgraph_->zone()),
+    MachineGraph* mcgraph, Signature<MachineRepresentation>* signature)
+    : mcgraph_(mcgraph),
+      state_(mcgraph->graph(), 3),
+      stack_(mcgraph_->zone()),
       replacements_(nullptr),
       signature_(signature),
       placeholder_(graph()->NewNode(common()->Parameter(-2, "placeholder"),
@@ -81,6 +81,8 @@ void SimdScalarLowering::LowerGraph() {
   V(I32x4ReplaceLane)             \
   V(I32x4SConvertF32x4)           \
   V(I32x4UConvertF32x4)           \
+  V(I32x4SConvertI16x8Low)        \
+  V(I32x4SConvertI16x8High)       \
   V(I32x4Neg)                     \
   V(I32x4Shl)                     \
   V(I32x4ShrS)                    \
@@ -99,6 +101,8 @@ void SimdScalarLowering::LowerGraph() {
   V(I32x4LeS)                     \
   V(I32x4GtS)                     \
   V(I32x4GeS)                     \
+  V(I32x4UConvertI16x8Low)        \
+  V(I32x4UConvertI16x8High)       \
   V(I32x4LtU)                     \
   V(I32x4LeU)                     \
   V(I32x4GtU)                     \
@@ -106,7 +110,13 @@ void SimdScalarLowering::LowerGraph() {
   V(S128And)                      \
   V(S128Or)                       \
   V(S128Xor)                      \
-  V(S128Not)
+  V(S128Not)                      \
+  V(S1x4AnyTrue)                  \
+  V(S1x4AllTrue)                  \
+  V(S1x8AnyTrue)                  \
+  V(S1x8AllTrue)                  \
+  V(S1x16AnyTrue)                 \
+  V(S1x16AllTrue)
 
 #define FOREACH_FLOAT32X4_OPCODE(V) \
   V(F32x4Splat)                     \
@@ -137,9 +147,12 @@ void SimdScalarLowering::LowerGraph() {
   V(I16x8Splat)                   \
   V(I16x8ExtractLane)             \
   V(I16x8ReplaceLane)             \
+  V(I16x8SConvertI8x16Low)        \
+  V(I16x8SConvertI8x16High)       \
   V(I16x8Neg)                     \
   V(I16x8Shl)                     \
   V(I16x8ShrS)                    \
+  V(I16x8SConvertI32x4)           \
   V(I16x8Add)                     \
   V(I16x8AddSaturateS)            \
   V(I16x8AddHoriz)                \
@@ -148,7 +161,10 @@ void SimdScalarLowering::LowerGraph() {
   V(I16x8Mul)                     \
   V(I16x8MinS)                    \
   V(I16x8MaxS)                    \
+  V(I16x8UConvertI8x16Low)        \
+  V(I16x8UConvertI8x16High)       \
   V(I16x8ShrU)                    \
+  V(I16x8UConvertI32x4)           \
   V(I16x8AddSaturateU)            \
   V(I16x8SubSaturateU)            \
   V(I16x8MinU)                    \
@@ -164,6 +180,7 @@ void SimdScalarLowering::LowerGraph() {
   V(I8x16Splat)                   \
   V(I8x16ExtractLane)             \
   V(I8x16ReplaceLane)             \
+  V(I8x16SConvertI16x8)           \
   V(I8x16Neg)                     \
   V(I8x16Shl)                     \
   V(I8x16ShrS)                    \
@@ -175,6 +192,7 @@ void SimdScalarLowering::LowerGraph() {
   V(I8x16MinS)                    \
   V(I8x16MaxS)                    \
   V(I8x16ShrU)                    \
+  V(I8x16UConvertI16x8)           \
   V(I8x16AddSaturateU)            \
   V(I8x16SubSaturateU)            \
   V(I8x16MinU)                    \
@@ -230,9 +248,27 @@ void SimdScalarLowering::SetLoweredType(Node* node, Node* output) {
     default: {
       switch (output->opcode()) {
         case IrOpcode::kF32x4SConvertI32x4:
-        case IrOpcode::kF32x4UConvertI32x4: {
+        case IrOpcode::kF32x4UConvertI32x4:
+        case IrOpcode::kI16x8SConvertI32x4:
+        case IrOpcode::kI16x8UConvertI32x4: {
           replacements_[node->id()].type = SimdType::kInt32x4;
           break;
+        }
+        case IrOpcode::kI8x16SConvertI16x8:
+        case IrOpcode::kI8x16UConvertI16x8:
+        case IrOpcode::kI32x4SConvertI16x8Low:
+        case IrOpcode::kI32x4SConvertI16x8High:
+        case IrOpcode::kI32x4UConvertI16x8Low:
+        case IrOpcode::kI32x4UConvertI16x8High: {
+          replacements_[node->id()].type = SimdType::kInt16x8;
+          break;
+        }
+        case IrOpcode::kI16x8SConvertI8x16Low:
+        case IrOpcode::kI16x8SConvertI8x16High:
+        case IrOpcode::kI16x8UConvertI8x16Low:
+        case IrOpcode::kI16x8UConvertI8x16High: {
+          replacements_[node->id()].type = SimdType::kInt8x16;
+          break;
         }
           FOREACH_FLOAT32X4_TO_INT32X4OPCODE(CASE_STMT)
         case IrOpcode::kI32x4SConvertF32x4:
@@ -318,8 +354,22 @@ void SimdScalarLowering::GetIndexNodes(Node* index, Node** new_indices,
   }
 }
 
-void SimdScalarLowering::LowerLoadOp(MachineRepresentation rep, Node* node,
-                                     const Operator* load_op, SimdType type) {
+void SimdScalarLowering::LowerLoadOp(Node* node, SimdType type) {
+  MachineRepresentation rep = LoadRepresentationOf(node->op()).representation();
+  const Operator* load_op;
+  switch (node->opcode()) {
+    case IrOpcode::kLoad:
+      load_op = machine()->Load(MachineTypeFrom(type));
+      break;
+    case IrOpcode::kUnalignedLoad:
+      load_op = machine()->UnalignedLoad(MachineTypeFrom(type));
+      break;
+    case IrOpcode::kProtectedLoad:
+      load_op = machine()->ProtectedLoad(MachineTypeFrom(type));
+      break;
+    default:
+      UNREACHABLE();
+  }
   if (rep == MachineRepresentation::kSimd128) {
     Node* base = node->InputAt(0);
     Node* index = node->InputAt(1);
@@ -351,9 +401,38 @@ void SimdScalarLowering::LowerLoadOp(MachineRepresentation rep, Node* node,
   }
 }
 
-void SimdScalarLowering::LowerStoreOp(MachineRepresentation rep, Node* node,
-                                      const Operator* store_op,
-                                      SimdType rep_type) {
+void SimdScalarLowering::LowerStoreOp(Node* node) {
+  // For store operation, use replacement type of its input instead of the
+  // one of its effected node.
+  DCHECK_LT(2, node->InputCount());
+  SimdType rep_type = ReplacementType(node->InputAt(2));
+  replacements_[node->id()].type = rep_type;
+  const Operator* store_op;
+  MachineRepresentation rep;
+  switch (node->opcode()) {
+    case IrOpcode::kStore: {
+      rep = StoreRepresentationOf(node->op()).representation();
+      WriteBarrierKind write_barrier_kind =
+          StoreRepresentationOf(node->op()).write_barrier_kind();
+      store_op = machine()->Store(StoreRepresentation(
+          MachineTypeFrom(rep_type).representation(), write_barrier_kind));
+      break;
+    }
+    case IrOpcode::kUnalignedStore: {
+      rep = UnalignedStoreRepresentationOf(node->op());
+      store_op =
+          machine()->UnalignedStore(MachineTypeFrom(rep_type).representation());
+      break;
+    }
+    case IrOpcode::kProtectedStore: {
+      rep = StoreRepresentationOf(node->op()).representation();
+      store_op =
+          machine()->ProtectedStore(MachineTypeFrom(rep_type).representation());
+      break;
+    }
+    default:
+      UNREACHABLE();
+  }
   if (rep == MachineRepresentation::kSimd128) {
     Node* base = node->InputAt(0);
     Node* index = node->InputAt(1);
@@ -437,13 +516,13 @@ void SimdScalarLowering::LowerCompareOp(Node* node, SimdType input_rep_type,
     }
     Diamond d_cmp(graph(), common(),
                   graph()->NewNode(machine()->Word32Equal(), cmp_result,
-                                   jsgraph_->Int32Constant(0)));
+                                   mcgraph_->Int32Constant(0)));
     MachineRepresentation rep =
         (input_rep_type == SimdType::kFloat32x4)
             ? MachineRepresentation::kWord32
             : MachineTypeFrom(input_rep_type).representation();
     rep_node[i] =
-        d_cmp.Phi(rep, jsgraph_->Int32Constant(0), jsgraph_->Int32Constant(-1));
+        d_cmp.Phi(rep, mcgraph_->Int32Constant(0), mcgraph_->Int32Constant(-1));
   }
   ReplaceNode(node, rep_node, num_lanes);
 }
@@ -451,8 +530,8 @@ void SimdScalarLowering::LowerCompareOp(Node* node, SimdType input_rep_type,
 Node* SimdScalarLowering::FixUpperBits(Node* input, int32_t shift) {
   return graph()->NewNode(machine()->Word32Sar(),
                           graph()->NewNode(machine()->Word32Shl(), input,
-                                           jsgraph_->Int32Constant(shift)),
-                          jsgraph_->Int32Constant(shift));
+                                           mcgraph_->Int32Constant(shift)),
+                          mcgraph_->Int32Constant(shift));
 }
 
 void SimdScalarLowering::LowerBinaryOpForSmallInt(Node* node,
@@ -497,7 +576,7 @@ void SimdScalarLowering::LowerBinaryOpForSmallInt(Node* node,
 
 Node* SimdScalarLowering::Mask(Node* input, int32_t mask) {
   return graph()->NewNode(machine()->Word32And(), input,
-                          jsgraph_->Int32Constant(mask));
+                          mcgraph_->Int32Constant(mask));
 }
 
 void SimdScalarLowering::LowerSaturateBinaryOp(Node* node,
@@ -546,12 +625,12 @@ void SimdScalarLowering::LowerSaturateBinaryOp(Node* node,
     op_result = graph()->NewNode(op, left, right);
     Diamond d_min(graph(), common(),
                   graph()->NewNode(machine()->Int32LessThan(), op_result,
-                                   jsgraph_->Int32Constant(min)));
-    rep_node[i] = d_min.Phi(phi_rep, jsgraph_->Int32Constant(min), op_result);
+                                   mcgraph_->Int32Constant(min)));
+    rep_node[i] = d_min.Phi(phi_rep, mcgraph_->Int32Constant(min), op_result);
     Diamond d_max(graph(), common(),
                   graph()->NewNode(machine()->Int32LessThan(),
-                                   jsgraph_->Int32Constant(max), rep_node[i]));
-    rep_node[i] = d_max.Phi(phi_rep, jsgraph_->Int32Constant(max), rep_node[i]);
+                                   mcgraph_->Int32Constant(max), rep_node[i]));
+    rep_node[i] = d_max.Phi(phi_rep, mcgraph_->Int32Constant(max), rep_node[i]);
     rep_node[i] =
         is_signed ? rep_node[i] : FixUpperBits(rep_node[i], shift_val);
   }
@@ -603,14 +682,13 @@ Node* SimdScalarLowering::BuildF64Trunc(Node* input) {
   if (machine()->Float64RoundTruncate().IsSupported()) {
     return graph()->NewNode(machine()->Float64RoundTruncate().op(), input);
   } else {
-    ExternalReference ref =
-        ExternalReference::wasm_f64_trunc(jsgraph_->isolate());
+    ExternalReference ref = ExternalReference::wasm_f64_trunc();
     Node* stack_slot =
         graph()->NewNode(machine()->StackSlot(MachineRepresentation::kFloat64));
     const Operator* store_op = machine()->Store(
         StoreRepresentation(MachineRepresentation::kFloat64, kNoWriteBarrier));
     Node* effect =
-        graph()->NewNode(store_op, stack_slot, jsgraph_->Int32Constant(0),
+        graph()->NewNode(store_op, stack_slot, mcgraph_->Int32Constant(0),
                          input, graph()->start(), graph()->start());
     Node* function = graph()->NewNode(common()->ExternalConstant(ref));
     Node** args = zone()->NewArray<Node*>(4);
@@ -624,7 +702,7 @@ Node* SimdScalarLowering::BuildF64Trunc(Node* input) {
         Linkage::GetSimplifiedCDescriptor(zone(), sig_builder.Build());
     Node* call = graph()->NewNode(common()->Call(call_descriptor), 4, args);
     return graph()->NewNode(machine()->Load(LoadRepresentation::Float64()),
-                            stack_slot, jsgraph_->Int32Constant(0), call,
+                            stack_slot, mcgraph_->Int32Constant(0), call,
                             graph()->start());
   }
 }
@@ -662,6 +740,93 @@ void SimdScalarLowering::LowerConvertFromFloat(Node* node, bool is_signed) {
   ReplaceNode(node, rep_node, kNumLanes32);
 }
 
+void SimdScalarLowering::LowerConvertFromInt(Node* node,
+                                             SimdType input_rep_type,
+                                             SimdType output_rep_type,
+                                             bool is_signed, int start_index) {
+  DCHECK_EQ(1, node->InputCount());
+  Node** rep = GetReplacementsWithType(node->InputAt(0), input_rep_type);
+
+  int32_t mask = 0;
+  if (input_rep_type == SimdType::kInt16x8) {
+    DCHECK_EQ(output_rep_type, SimdType::kInt32x4);
+    mask = kMask16;
+  } else {
+    DCHECK_EQ(output_rep_type, SimdType::kInt16x8);
+    DCHECK_EQ(input_rep_type, SimdType::kInt8x16);
+    mask = kMask8;
+  }
+
+  int num_lanes = NumLanes(output_rep_type);
+  Node** rep_node = zone()->NewArray<Node*>(num_lanes);
+  for (int i = 0; i < num_lanes; ++i) {
+    rep_node[i] =
+        is_signed ? rep[i + start_index] : Mask(rep[i + start_index], mask);
+  }
+
+  ReplaceNode(node, rep_node, num_lanes);
+}
+
+void SimdScalarLowering::LowerPack(Node* node, SimdType input_rep_type,
+                                   SimdType output_rep_type, bool is_signed) {
+  DCHECK_EQ(2, node->InputCount());
+  Node** rep_left = GetReplacementsWithType(node->InputAt(0), input_rep_type);
+  Node** rep_right = GetReplacementsWithType(node->InputAt(1), input_rep_type);
+  const Operator* less_op =
+      is_signed ? machine()->Int32LessThan() : machine()->Uint32LessThan();
+  Node* min = nullptr;
+  Node* max = nullptr;
+  int32_t shift_val = 0;
+  MachineRepresentation phi_rep;
+  if (output_rep_type == SimdType::kInt16x8) {
+    DCHECK(input_rep_type == SimdType::kInt32x4);
+    if (is_signed) {
+      min = mcgraph_->Int32Constant(std::numeric_limits<int16_t>::min());
+      max = mcgraph_->Int32Constant(std::numeric_limits<int16_t>::max());
+    } else {
+      max = mcgraph_->Uint32Constant(std::numeric_limits<uint16_t>::max());
+      shift_val = kShift16;
+    }
+    phi_rep = MachineRepresentation::kWord16;
+  } else {
+    DCHECK(output_rep_type == SimdType::kInt8x16 &&
+           input_rep_type == SimdType::kInt16x8);
+    if (is_signed) {
+      min = mcgraph_->Int32Constant(std::numeric_limits<int8_t>::min());
+      max = mcgraph_->Int32Constant(std::numeric_limits<int8_t>::max());
+    } else {
+      max = mcgraph_->Uint32Constant(std::numeric_limits<uint8_t>::max());
+      shift_val = kShift8;
+    }
+    phi_rep = MachineRepresentation::kWord8;
+  }
+  int num_lanes = NumLanes(output_rep_type);
+  Node** rep_node = zone()->NewArray<Node*>(num_lanes);
+  for (int i = 0; i < num_lanes; ++i) {
+    Node* input = nullptr;
+#if defined(V8_TARGET_BIG_ENDIAN)
+    if (i < num_lanes / 2)
+      input = rep_right[i];
+    else
+      input = rep_left[i - num_lanes / 2];
+#else
+    if (i < num_lanes / 2)
+      input = rep_left[i];
+    else
+      input = rep_right[i - num_lanes / 2];
+#endif
+    if (is_signed) {
+      Diamond d_min(graph(), common(), graph()->NewNode(less_op, input, min));
+      input = d_min.Phi(phi_rep, min, input);
+    }
+    Diamond d_max(graph(), common(), graph()->NewNode(less_op, max, input));
+    rep_node[i] = d_max.Phi(phi_rep, max, input);
+    rep_node[i] =
+        is_signed ? rep_node[i] : FixUpperBits(rep_node[i], shift_val);
+  }
+  ReplaceNode(node, rep_node, num_lanes);
+}
+
 void SimdScalarLowering::LowerShiftOp(Node* node, SimdType type) {
   DCHECK_EQ(1, node->InputCount());
   int32_t shift_amount = OpParameter<int32_t>(node->op());
@@ -726,7 +891,7 @@ void SimdScalarLowering::LowerNotEqual(Node* node, SimdType input_rep_type,
             ? MachineRepresentation::kWord32
             : MachineTypeFrom(input_rep_type).representation();
     rep_node[i] =
-        d.Phi(rep, jsgraph_->Int32Constant(0), jsgraph_->Int32Constant(-1));
+        d.Phi(rep, mcgraph_->Int32Constant(0), mcgraph_->Int32Constant(-1));
   }
   ReplaceNode(node, rep_node, num_lanes);
 }
@@ -777,52 +942,16 @@ void SimdScalarLowering::LowerNode(Node* node) {
       }
       break;
     }
-    case IrOpcode::kLoad: {
-      MachineRepresentation rep =
-          LoadRepresentationOf(node->op()).representation();
-      const Operator* load_op;
-      load_op = machine()->Load(MachineTypeFrom(rep_type));
-      LowerLoadOp(rep, node, load_op, rep_type);
-      break;
-    }
-    case IrOpcode::kUnalignedLoad: {
-      MachineRepresentation rep =
-          LoadRepresentationOf(node->op()).representation();
-      const Operator* load_op;
-      load_op = machine()->UnalignedLoad(MachineTypeFrom(rep_type));
-      LowerLoadOp(rep, node, load_op, rep_type);
+    case IrOpcode::kLoad:
+    case IrOpcode::kUnalignedLoad:
+    case IrOpcode::kProtectedLoad: {
+      LowerLoadOp(node, rep_type);
       break;
     }
-    case IrOpcode::kStore: {
-      // For store operation, use replacement type of its input instead of the
-      // one of its effected node.
-      DCHECK_LT(2, node->InputCount());
-      SimdType input_rep_type = ReplacementType(node->InputAt(2));
-      if (input_rep_type != rep_type)
-        replacements_[node->id()].type = input_rep_type;
-      MachineRepresentation rep =
-          StoreRepresentationOf(node->op()).representation();
-      WriteBarrierKind write_barrier_kind =
-          StoreRepresentationOf(node->op()).write_barrier_kind();
-      const Operator* store_op;
-      store_op = machine()->Store(
-          StoreRepresentation(MachineTypeFrom(input_rep_type).representation(),
-                              write_barrier_kind));
-      LowerStoreOp(rep, node, store_op, input_rep_type);
-      break;
-    }
-    case IrOpcode::kUnalignedStore: {
-      // For store operation, use replacement type of its input instead of the
-      // one of its effected node.
-      DCHECK_LT(2, node->InputCount());
-      SimdType input_rep_type = ReplacementType(node->InputAt(2));
-      if (input_rep_type != rep_type)
-        replacements_[node->id()].type = input_rep_type;
-      MachineRepresentation rep = UnalignedStoreRepresentationOf(node->op());
-      const Operator* store_op;
-      store_op = machine()->UnalignedStore(
-          MachineTypeFrom(input_rep_type).representation());
-      LowerStoreOp(rep, node, store_op, input_rep_type);
+    case IrOpcode::kStore:
+    case IrOpcode::kUnalignedStore:
+    case IrOpcode::kProtectedStore: {
+      LowerStoreOp(node);
       break;
     }
     case IrOpcode::kReturn: {
@@ -992,6 +1121,62 @@ void SimdScalarLowering::LowerNode(Node* node) {
       LowerConvertFromFloat(node, false);
       break;
     }
+    case IrOpcode::kI32x4SConvertI16x8Low: {
+      LowerConvertFromInt(node, SimdType::kInt16x8, SimdType::kInt32x4, true,
+                          0);
+      break;
+    }
+    case IrOpcode::kI32x4SConvertI16x8High: {
+      LowerConvertFromInt(node, SimdType::kInt16x8, SimdType::kInt32x4, true,
+                          4);
+      break;
+    }
+    case IrOpcode::kI32x4UConvertI16x8Low: {
+      LowerConvertFromInt(node, SimdType::kInt16x8, SimdType::kInt32x4, false,
+                          0);
+      break;
+    }
+    case IrOpcode::kI32x4UConvertI16x8High: {
+      LowerConvertFromInt(node, SimdType::kInt16x8, SimdType::kInt32x4, false,
+                          4);
+      break;
+    }
+    case IrOpcode::kI16x8SConvertI8x16Low: {
+      LowerConvertFromInt(node, SimdType::kInt8x16, SimdType::kInt16x8, true,
+                          0);
+      break;
+    }
+    case IrOpcode::kI16x8SConvertI8x16High: {
+      LowerConvertFromInt(node, SimdType::kInt8x16, SimdType::kInt16x8, true,
+                          8);
+      break;
+    }
+    case IrOpcode::kI16x8UConvertI8x16Low: {
+      LowerConvertFromInt(node, SimdType::kInt8x16, SimdType::kInt16x8, false,
+                          0);
+      break;
+    }
+    case IrOpcode::kI16x8UConvertI8x16High: {
+      LowerConvertFromInt(node, SimdType::kInt8x16, SimdType::kInt16x8, false,
+                          8);
+      break;
+    }
+    case IrOpcode::kI16x8SConvertI32x4: {
+      LowerPack(node, SimdType::kInt32x4, SimdType::kInt16x8, true);
+      break;
+    }
+    case IrOpcode::kI16x8UConvertI32x4: {
+      LowerPack(node, SimdType::kInt32x4, SimdType::kInt16x8, false);
+      break;
+    }
+    case IrOpcode::kI8x16SConvertI16x8: {
+      LowerPack(node, SimdType::kInt16x8, SimdType::kInt8x16, true);
+      break;
+    }
+    case IrOpcode::kI8x16UConvertI16x8: {
+      LowerPack(node, SimdType::kInt16x8, SimdType::kInt8x16, false);
+      break;
+    }
     case IrOpcode::kI32x4Shl:
     case IrOpcode::kI16x8Shl:
     case IrOpcode::kI8x16Shl:
@@ -1191,6 +1376,46 @@ void SimdScalarLowering::LowerNode(Node* node) {
       ReplaceNode(node, rep_node, 16);
       break;
     }
+    case IrOpcode::kS1x4AnyTrue:
+    case IrOpcode::kS1x4AllTrue:
+    case IrOpcode::kS1x8AnyTrue:
+    case IrOpcode::kS1x8AllTrue:
+    case IrOpcode::kS1x16AnyTrue:
+    case IrOpcode::kS1x16AllTrue: {
+      DCHECK_EQ(1, node->InputCount());
+      SimdType input_rep_type = ReplacementType(node->InputAt(0));
+      int input_num_lanes = NumLanes(input_rep_type);
+      Node** rep = GetReplacements(node->InputAt(0));
+      Node** rep_node = zone()->NewArray<Node*>(num_lanes);
+      Node* true_node = mcgraph_->Int32Constant(-1);
+      Node* false_node = mcgraph_->Int32Constant(0);
+      Node* tmp_result = false_node;
+      if (node->opcode() == IrOpcode::kS1x4AllTrue ||
+          node->opcode() == IrOpcode::kS1x8AllTrue ||
+          node->opcode() == IrOpcode::kS1x16AllTrue) {
+        tmp_result = true_node;
+      }
+      for (int i = 0; i < input_num_lanes; ++i) {
+        Diamond is_false(
+            graph(), common(),
+            graph()->NewNode(machine()->Word32Equal(), rep[i], false_node));
+        if (node->opcode() == IrOpcode::kS1x4AllTrue ||
+            node->opcode() == IrOpcode::kS1x8AllTrue ||
+            node->opcode() == IrOpcode::kS1x16AllTrue) {
+          tmp_result = is_false.Phi(MachineRepresentation::kWord32, false_node,
+                                    tmp_result);
+        } else {
+          tmp_result = is_false.Phi(MachineRepresentation::kWord32, tmp_result,
+                                    true_node);
+        }
+      }
+      rep_node[0] = tmp_result;
+      for (int i = 1; i < num_lanes; ++i) {
+        rep_node[i] = nullptr;
+      }
+      ReplaceNode(node, rep_node, num_lanes);
+      break;
+    }
     default: { DefaultLowering(node); }
   }
 }
diff --git a/deps/v8/src/compiler/simd-scalar-lowering.h b/deps/v8/src/compiler/simd-scalar-lowering.h
index ad329877e26da1..9bb6e79cbe8995 100644
--- a/deps/v8/src/compiler/simd-scalar-lowering.h
+++ b/deps/v8/src/compiler/simd-scalar-lowering.h
@@ -7,18 +7,22 @@
 
 #include "src/compiler/common-operator.h"
 #include "src/compiler/graph.h"
-#include "src/compiler/js-graph.h"
+#include "src/compiler/machine-graph.h"
 #include "src/compiler/machine-operator.h"
 #include "src/compiler/node-marker.h"
 #include "src/zone/zone-containers.h"
 
 namespace v8 {
 namespace internal {
+
+template <typename T>
+class Signature;
+
 namespace compiler {
 
 class SimdScalarLowering {
  public:
-  SimdScalarLowering(JSGraph* jsgraph,
+  SimdScalarLowering(MachineGraph* mcgraph,
                      Signature<MachineRepresentation>* signature);
 
   void LowerGraph();
@@ -48,10 +52,10 @@ class SimdScalarLowering {
     int input_index;
   };
 
-  Zone* zone() const { return jsgraph_->zone(); }
-  Graph* graph() const { return jsgraph_->graph(); }
-  MachineOperatorBuilder* machine() const { return jsgraph_->machine(); }
-  CommonOperatorBuilder* common() const { return jsgraph_->common(); }
+  Zone* zone() const { return mcgraph_->zone(); }
+  Graph* graph() const { return mcgraph_->graph(); }
+  MachineOperatorBuilder* machine() const { return mcgraph_->machine(); }
+  CommonOperatorBuilder* common() const { return mcgraph_->common(); }
   Signature<MachineRepresentation>* signature() const { return signature_; }
 
   void LowerNode(Node* node);
@@ -69,10 +73,8 @@ class SimdScalarLowering {
   void PreparePhiReplacement(Node* phi);
   void SetLoweredType(Node* node, Node* output);
   void GetIndexNodes(Node* index, Node** new_indices, SimdType type);
-  void LowerLoadOp(MachineRepresentation rep, Node* node,
-                   const Operator* load_op, SimdType type);
-  void LowerStoreOp(MachineRepresentation rep, Node* node,
-                    const Operator* store_op, SimdType rep_type);
+  void LowerLoadOp(Node* node, SimdType type);
+  void LowerStoreOp(Node* node);
   void LowerBinaryOp(Node* node, SimdType input_rep_type, const Operator* op,
                      bool not_horizontal = true);
   void LowerCompareOp(Node* node, SimdType input_rep_type, const Operator* op,
@@ -87,12 +89,17 @@ class SimdScalarLowering {
   void LowerIntMinMax(Node* node, const Operator* op, bool is_max,
                       SimdType type);
   void LowerConvertFromFloat(Node* node, bool is_signed);
+  void LowerConvertFromInt(Node* node, SimdType input_rep_type,
+                           SimdType output_rep_type, bool is_signed,
+                           int start_index);
+  void LowerPack(Node* node, SimdType input_rep_type, SimdType output_rep_type,
+                 bool is_signed);
   void LowerShiftOp(Node* node, SimdType type);
   Node* BuildF64Trunc(Node* input);
   void LowerNotEqual(Node* node, SimdType input_rep_type, const Operator* op);
   MachineType MachineTypeFrom(SimdType simdType);
 
-  JSGraph* const jsgraph_;
+  MachineGraph* const mcgraph_;
   NodeMarker<State> state_;
   ZoneDeque<NodeState> stack_;
   Replacement* replacements_;
diff --git a/deps/v8/src/compiler/simplified-lowering.cc b/deps/v8/src/compiler/simplified-lowering.cc
index 8a10ea71e274ee..74bb7fcd6b5f00 100644
--- a/deps/v8/src/compiler/simplified-lowering.cc
+++ b/deps/v8/src/compiler/simplified-lowering.cc
@@ -15,6 +15,7 @@
 #include "src/compiler/diamond.h"
 #include "src/compiler/linkage.h"
 #include "src/compiler/node-matchers.h"
+#include "src/compiler/node-origin-table.h"
 #include "src/compiler/node-properties.h"
 #include "src/compiler/operation-typer.h"
 #include "src/compiler/operator-properties.h"
@@ -211,22 +212,22 @@ class InputUseInfos {
 
 #endif  // DEBUG
 
-bool CanOverflowSigned32(const Operator* op, Type* left, Type* right,
+bool CanOverflowSigned32(const Operator* op, Type left, Type right,
                          Zone* type_zone) {
   // We assume the inputs are checked Signed32 (or known statically
   // to be Signed32). Technically, the inputs could also be minus zero, but
   // that cannot cause overflow.
   left = Type::Intersect(left, Type::Signed32(), type_zone);
   right = Type::Intersect(right, Type::Signed32(), type_zone);
-  if (left->IsNone() || right->IsNone()) return false;
+  if (left.IsNone() || right.IsNone()) return false;
   switch (op->opcode()) {
     case IrOpcode::kSpeculativeSafeIntegerAdd:
-      return (left->Max() + right->Max() > kMaxInt) ||
-             (left->Min() + right->Min() < kMinInt);
+      return (left.Max() + right.Max() > kMaxInt) ||
+             (left.Min() + right.Min() < kMinInt);
 
     case IrOpcode::kSpeculativeSafeIntegerSubtract:
-      return (left->Max() - right->Min() > kMaxInt) ||
-             (left->Min() - right->Max() < kMinInt);
+      return (left.Max() - right.Min() > kMaxInt) ||
+             (left.Min() - right.Max() < kMinInt);
 
     default:
       UNREACHABLE();
@@ -234,8 +235,8 @@ bool CanOverflowSigned32(const Operator* op, Type* left, Type* right,
   return true;
 }
 
-bool IsSomePositiveOrderedNumber(Type* type) {
-  return type->Is(Type::OrderedNumber()) && !type->IsNone() && type->Min() > 0;
+bool IsSomePositiveOrderedNumber(Type type) {
+  return type.Is(Type::OrderedNumber()) && !type.IsNone() && type.Min() > 0;
 }
 
 }  // namespace
@@ -266,12 +267,12 @@ class RepresentationSelector {
     MachineRepresentation representation() const { return representation_; }
 
     // Helpers for feedback typing.
-    void set_feedback_type(Type* type) { feedback_type_ = type; }
-    Type* feedback_type() const { return feedback_type_; }
+    void set_feedback_type(Type type) { feedback_type_ = type; }
+    Type feedback_type() const { return feedback_type_; }
     void set_weakened() { weakened_ = true; }
     bool weakened() const { return weakened_; }
-    void set_restriction_type(Type* type) { restriction_type_ = type; }
-    Type* restriction_type() const { return restriction_type_; }
+    void set_restriction_type(Type type) { restriction_type_ = type; }
+    Type restriction_type() const { return restriction_type_; }
 
    private:
     enum State : uint8_t { kUnvisited, kPushed, kVisited, kQueued };
@@ -280,14 +281,15 @@ class RepresentationSelector {
         MachineRepresentation::kNone;             // Output representation.
     Truncation truncation_ = Truncation::None();  // Information about uses.
 
-    Type* restriction_type_ = Type::Any();
-    Type* feedback_type_ = nullptr;
+    Type restriction_type_ = Type::Any();
+    Type feedback_type_;
     bool weakened_ = false;
   };
 
-  RepresentationSelector(JSGraph* jsgraph, Zone* zone,
-                         RepresentationChanger* changer,
-                         SourcePositionTable* source_positions)
+  RepresentationSelector(JSGraph* jsgraph, const JSHeapBroker* js_heap_broker,
+                         Zone* zone, RepresentationChanger* changer,
+                         SourcePositionTable* source_positions,
+                         NodeOriginTable* node_origins)
       : jsgraph_(jsgraph),
         zone_(zone),
         count_(jsgraph->graph()->NodeCount()),
@@ -302,8 +304,9 @@ class RepresentationSelector {
         queue_(zone),
         typing_stack_(zone),
         source_positions_(source_positions),
+        node_origins_(node_origins),
         type_cache_(TypeCache::Get()),
-        op_typer_(jsgraph->isolate(), graph_zone()) {
+        op_typer_(jsgraph->isolate(), js_heap_broker, graph_zone()) {
   }
 
   // Forward propagation of types from type feedback.
@@ -385,26 +388,26 @@ class RepresentationSelector {
     }
   }
 
-  Type* TypeOf(Node* node) {
-    Type* type = GetInfo(node)->feedback_type();
-    return type == nullptr ? NodeProperties::GetType(node) : type;
+  Type TypeOf(Node* node) {
+    Type type = GetInfo(node)->feedback_type();
+    return type.IsInvalid() ? NodeProperties::GetType(node) : type;
   }
 
-  Type* FeedbackTypeOf(Node* node) {
-    Type* type = GetInfo(node)->feedback_type();
-    return type == nullptr ? Type::None() : type;
+  Type FeedbackTypeOf(Node* node) {
+    Type type = GetInfo(node)->feedback_type();
+    return type.IsInvalid() ? Type::None() : type;
   }
 
-  Type* TypePhi(Node* node) {
+  Type TypePhi(Node* node) {
     int arity = node->op()->ValueInputCount();
-    Type* type = FeedbackTypeOf(node->InputAt(0));
+    Type type = FeedbackTypeOf(node->InputAt(0));
     for (int i = 1; i < arity; ++i) {
       type = op_typer_.Merge(type, FeedbackTypeOf(node->InputAt(i)));
     }
     return type;
   }
 
-  Type* TypeSelect(Node* node) {
+  Type TypeSelect(Node* node) {
     return op_typer_.Merge(FeedbackTypeOf(node->InputAt(1)),
                            FeedbackTypeOf(node->InputAt(2)));
   }
@@ -413,15 +416,15 @@ class RepresentationSelector {
     if (node->op()->ValueOutputCount() == 0) return false;
 
     NodeInfo* info = GetInfo(node);
-    Type* type = info->feedback_type();
-    Type* new_type = type;
+    Type type = info->feedback_type();
+    Type new_type = type;
 
     // For any non-phi node just wait until we get all inputs typed. We only
     // allow untyped inputs for phi nodes because phis are the only places
     // where cycles need to be broken.
     if (node->opcode() != IrOpcode::kPhi) {
       for (int i = 0; i < node->op()->ValueInputCount(); i++) {
-        if (GetInfo(node->InputAt(i))->feedback_type() == nullptr) {
+        if (GetInfo(node->InputAt(i))->feedback_type().IsInvalid()) {
           return false;
         }
       }
@@ -489,7 +492,7 @@ class RepresentationSelector {
 
       case IrOpcode::kPhi: {
         new_type = TypePhi(node);
-        if (type != nullptr) {
+        if (!type.IsInvalid()) {
           new_type = Weaken(node, type, new_type);
         }
         break;
@@ -513,7 +516,7 @@ class RepresentationSelector {
 
       default:
         // Shortcut for operations that we do not handle.
-        if (type == nullptr) {
+        if (type.IsInvalid()) {
           GetInfo(node)->set_feedback_type(NodeProperties::GetType(node));
           return true;
         }
@@ -525,7 +528,7 @@ class RepresentationSelector {
     // really sure, just intersect the upper bound with the feedback type.
     new_type = Type::Intersect(GetUpperBound(node), new_type, graph_zone());
 
-    if (type != nullptr && new_type->Is(type)) return false;
+    if (!type.IsInvalid() && new_type.Is(type)) return false;
     GetInfo(node)->set_feedback_type(new_type);
     if (FLAG_trace_representation) {
       PrintNodeFeedbackType(node);
@@ -534,7 +537,7 @@ class RepresentationSelector {
   }
 
   void PrintNodeFeedbackType(Node* n) {
-    OFStream os(stdout);
+    StdoutStream os;
     os << "#" << n->id() << ":" << *n->op() << "(";
     int j = 0;
     for (Node* const i : n->inputs()) {
@@ -543,42 +546,39 @@ class RepresentationSelector {
     }
     os << ")";
     if (NodeProperties::IsTyped(n)) {
-      os << "  [Static type: ";
-      Type* static_type = NodeProperties::GetType(n);
-      static_type->PrintTo(os);
-      Type* feedback_type = GetInfo(n)->feedback_type();
-      if (feedback_type != nullptr && feedback_type != static_type) {
-        os << ", Feedback type: ";
-        feedback_type->PrintTo(os);
+      Type static_type = NodeProperties::GetType(n);
+      os << "  [Static type: " << static_type;
+      Type feedback_type = GetInfo(n)->feedback_type();
+      if (!feedback_type.IsInvalid() && feedback_type != static_type) {
+        os << ", Feedback type: " << feedback_type;
       }
       os << "]";
     }
     os << std::endl;
   }
 
-  Type* Weaken(Node* node, Type* previous_type, Type* current_type) {
+  Type Weaken(Node* node, Type previous_type, Type current_type) {
     // If the types have nothing to do with integers, return the types.
-    Type* const integer = type_cache_.kInteger;
-    if (!previous_type->Maybe(integer)) {
+    Type const integer = type_cache_.kInteger;
+    if (!previous_type.Maybe(integer)) {
       return current_type;
     }
-    DCHECK(current_type->Maybe(integer));
+    DCHECK(current_type.Maybe(integer));
 
-    Type* current_integer =
-        Type::Intersect(current_type, integer, graph_zone());
-    DCHECK(!current_integer->IsNone());
-    Type* previous_integer =
+    Type current_integer = Type::Intersect(current_type, integer, graph_zone());
+    DCHECK(!current_integer.IsNone());
+    Type previous_integer =
         Type::Intersect(previous_type, integer, graph_zone());
-    DCHECK(!previous_integer->IsNone());
+    DCHECK(!previous_integer.IsNone());
 
     // Once we start weakening a node, we should always weaken.
     if (!GetInfo(node)->weakened()) {
       // Only weaken if there is range involved; we should converge quickly
       // for all other types (the exception is a union of many constants,
       // but we currently do not increase the number of constants in unions).
-      Type* previous = previous_integer->GetRange();
-      Type* current = current_integer->GetRange();
-      if (current == nullptr || previous == nullptr) {
+      Type previous = previous_integer.GetRange();
+      Type current = current_integer.GetRange();
+      if (current.IsInvalid() || previous.IsInvalid()) {
         return current_type;
       }
       // Range is involved => we are weakening.
@@ -624,6 +624,8 @@ class RepresentationSelector {
       // Reuse {VisitNode()} so the representation rules are in one place.
       SourcePositionTable::Scope scope(
           source_positions_, source_positions_->GetSourcePosition(node));
+      NodeOriginTable::Scope origin_scope(node_origins_, "simplified lowering",
+                                          node);
       VisitNode(node, info->truncation(), lowering);
     }
 
@@ -692,35 +694,35 @@ class RepresentationSelector {
   bool propagate() const { return phase_ == PROPAGATE; }
 
   void SetOutput(Node* node, MachineRepresentation representation,
-                 Type* restriction_type = Type::Any()) {
+                 Type restriction_type = Type::Any()) {
     NodeInfo* const info = GetInfo(node);
     switch (phase_) {
       case PROPAGATE:
         info->set_restriction_type(restriction_type);
         break;
       case RETYPE:
-        DCHECK(info->restriction_type()->Is(restriction_type));
-        DCHECK(restriction_type->Is(info->restriction_type()));
+        DCHECK(info->restriction_type().Is(restriction_type));
+        DCHECK(restriction_type.Is(info->restriction_type()));
         info->set_output(representation);
         break;
       case LOWER:
         DCHECK_EQ(info->representation(), representation);
-        DCHECK(info->restriction_type()->Is(restriction_type));
-        DCHECK(restriction_type->Is(info->restriction_type()));
+        DCHECK(info->restriction_type().Is(restriction_type));
+        DCHECK(restriction_type.Is(info->restriction_type()));
         break;
     }
   }
 
-  Type* GetUpperBound(Node* node) { return NodeProperties::GetType(node); }
+  Type GetUpperBound(Node* node) { return NodeProperties::GetType(node); }
 
-  bool InputCannotBe(Node* node, Type* type) {
+  bool InputCannotBe(Node* node, Type type) {
     DCHECK_EQ(1, node->op()->ValueInputCount());
-    return !GetUpperBound(node->InputAt(0))->Maybe(type);
+    return !GetUpperBound(node->InputAt(0)).Maybe(type);
   }
 
-  bool InputIs(Node* node, Type* type) {
+  bool InputIs(Node* node, Type type) {
     DCHECK_EQ(1, node->op()->ValueInputCount());
-    return GetUpperBound(node->InputAt(0))->Is(type);
+    return GetUpperBound(node->InputAt(0)).Is(type);
   }
 
   bool BothInputsAreSigned32(Node* node) {
@@ -731,10 +733,10 @@ class RepresentationSelector {
     return BothInputsAre(node, Type::Unsigned32());
   }
 
-  bool BothInputsAre(Node* node, Type* type) {
+  bool BothInputsAre(Node* node, Type type) {
     DCHECK_EQ(2, node->op()->ValueInputCount());
-    return GetUpperBound(node->InputAt(0))->Is(type) &&
-           GetUpperBound(node->InputAt(1))->Is(type);
+    return GetUpperBound(node->InputAt(0)).Is(type) &&
+           GetUpperBound(node->InputAt(1)).Is(type);
   }
 
   bool IsNodeRepresentationTagged(Node* node) {
@@ -742,17 +744,17 @@ class RepresentationSelector {
     return IsAnyTagged(representation);
   }
 
-  bool OneInputCannotBe(Node* node, Type* type) {
+  bool OneInputCannotBe(Node* node, Type type) {
     DCHECK_EQ(2, node->op()->ValueInputCount());
-    return !GetUpperBound(node->InputAt(0))->Maybe(type) ||
-           !GetUpperBound(node->InputAt(1))->Maybe(type);
+    return !GetUpperBound(node->InputAt(0)).Maybe(type) ||
+           !GetUpperBound(node->InputAt(1)).Maybe(type);
   }
 
   // Converts input {index} of {node} according to given UseInfo {use},
   // assuming the type of the input is {input_type}. If {input_type} is null,
   // it takes the input from the input node {TypeOf(node->InputAt(index))}.
   void ConvertInput(Node* node, int index, UseInfo use,
-                    Type* input_type = nullptr) {
+                    Type input_type = Type::Invalid()) {
     Node* input = node->InputAt(index);
     // In the change phase, insert a change before the use if necessary.
     if (use.representation() == MachineRepresentation::kNone)
@@ -770,7 +772,7 @@ class RepresentationSelector {
       TRACE(" to ");
       PrintUseInfo(use);
       TRACE("\n");
-      if (input_type == nullptr) {
+      if (input_type.IsInvalid()) {
         input_type = TypeOf(input);
       }
       Node* n = changer_->GetRepresentationFor(
@@ -864,7 +866,7 @@ class RepresentationSelector {
   // Helper for binops of the R x L -> O variety.
   void VisitBinop(Node* node, UseInfo left_use, UseInfo right_use,
                   MachineRepresentation output,
-                  Type* restriction_type = Type::Any()) {
+                  Type restriction_type = Type::Any()) {
     DCHECK_EQ(2, node->op()->ValueInputCount());
     ProcessInput(node, 0, left_use);
     ProcessInput(node, 1, right_use);
@@ -876,7 +878,7 @@ class RepresentationSelector {
 
   // Helper for binops of the I x I -> O variety.
   void VisitBinop(Node* node, UseInfo input_use, MachineRepresentation output,
-                  Type* restriction_type = Type::Any()) {
+                  Type restriction_type = Type::Any()) {
     VisitBinop(node, input_use, input_use, output, restriction_type);
   }
 
@@ -893,7 +895,7 @@ class RepresentationSelector {
 
   // Helper for unops of the I -> O variety.
   void VisitUnop(Node* node, UseInfo input_use, MachineRepresentation output,
-                 Type* restriction_type = Type::Any()) {
+                 Type restriction_type = Type::Any()) {
     DCHECK_EQ(1, node->op()->ValueInputCount());
     ProcessInput(node, 0, input_use);
     ProcessRemainingInputs(node, 1);
@@ -920,29 +922,28 @@ class RepresentationSelector {
   // The {node} parameter is only used to decide on the int64 representation.
   // Once the type system supports an external pointer type, the {node}
   // parameter can be removed.
-  MachineRepresentation GetOutputInfoForPhi(Node* node, Type* type,
+  MachineRepresentation GetOutputInfoForPhi(Node* node, Type type,
                                             Truncation use) {
     // Compute the representation.
-    if (type->Is(Type::None())) {
+    if (type.Is(Type::None())) {
       return MachineRepresentation::kNone;
-    } else if (type->Is(Type::Signed32()) || type->Is(Type::Unsigned32())) {
+    } else if (type.Is(Type::Signed32()) || type.Is(Type::Unsigned32())) {
       return MachineRepresentation::kWord32;
-    } else if (type->Is(Type::NumberOrOddball()) && use.IsUsedAsWord32()) {
+    } else if (type.Is(Type::NumberOrOddball()) && use.IsUsedAsWord32()) {
       return MachineRepresentation::kWord32;
-    } else if (type->Is(Type::Boolean())) {
+    } else if (type.Is(Type::Boolean())) {
       return MachineRepresentation::kBit;
-    } else if (type->Is(Type::NumberOrOddball()) && use.IsUsedAsFloat64()) {
+    } else if (type.Is(Type::NumberOrOddball()) && use.IsUsedAsFloat64()) {
       return MachineRepresentation::kFloat64;
-    } else if (type->Is(
-                   Type::Union(Type::SignedSmall(), Type::NaN(), zone()))) {
+    } else if (type.Is(Type::Union(Type::SignedSmall(), Type::NaN(), zone()))) {
       // TODO(turbofan): For Phis that return either NaN or some Smi, it's
       // beneficial to not go all the way to double, unless the uses are
       // double uses. For tagging that just means some potentially expensive
       // allocation code; we might want to do the same for -0 as well?
       return MachineRepresentation::kTagged;
-    } else if (type->Is(Type::Number())) {
+    } else if (type.Is(Type::Number())) {
       return MachineRepresentation::kFloat64;
-    } else if (type->Is(Type::ExternalPointer())) {
+    } else if (type.Is(Type::ExternalPointer())) {
       return MachineType::PointerRepresentation();
     }
     return MachineRepresentation::kTagged;
@@ -951,7 +952,7 @@ class RepresentationSelector {
   // Helper for handling selects.
   void VisitSelect(Node* node, Truncation truncation,
                    SimplifiedLowering* lowering) {
-    DCHECK(TypeOf(node->InputAt(0))->Is(Type::Boolean()));
+    DCHECK(TypeOf(node->InputAt(0)).Is(Type::Boolean()));
     ProcessInput(node, 0, UseInfo::Bool());
 
     MachineRepresentation output =
@@ -998,22 +999,22 @@ class RepresentationSelector {
     }
   }
 
-  void VisitObjectIs(Node* node, Type* type, SimplifiedLowering* lowering) {
-    Type* const input_type = TypeOf(node->InputAt(0));
-    if (input_type->Is(type)) {
+  void VisitObjectIs(Node* node, Type type, SimplifiedLowering* lowering) {
+    Type const input_type = TypeOf(node->InputAt(0));
+    if (input_type.Is(type)) {
       VisitUnop(node, UseInfo::None(), MachineRepresentation::kBit);
       if (lower()) {
         DeferReplacement(node, lowering->jsgraph()->Int32Constant(1));
       }
     } else {
       VisitUnop(node, UseInfo::AnyTagged(), MachineRepresentation::kBit);
-      if (lower() && !input_type->Maybe(type)) {
+      if (lower() && !input_type.Maybe(type)) {
         DeferReplacement(node, lowering->jsgraph()->Int32Constant(0));
       }
     }
   }
 
-  void VisitCheck(Node* node, Type* type, SimplifiedLowering* lowering) {
+  void VisitCheck(Node* node, Type type, SimplifiedLowering* lowering) {
     if (InputIs(node, type)) {
       VisitUnop(node, UseInfo::AnyTagged(),
                 MachineRepresentation::kTaggedPointer);
@@ -1051,25 +1052,25 @@ class RepresentationSelector {
     }
   }
 
-  static MachineSemantic DeoptValueSemanticOf(Type* type) {
+  static MachineSemantic DeoptValueSemanticOf(Type type) {
     // We only need signedness to do deopt correctly.
-    if (type->Is(Type::Signed32())) {
+    if (type.Is(Type::Signed32())) {
       return MachineSemantic::kInt32;
-    } else if (type->Is(Type::Unsigned32())) {
+    } else if (type.Is(Type::Unsigned32())) {
       return MachineSemantic::kUint32;
     } else {
       return MachineSemantic::kAny;
     }
   }
 
-  static MachineType DeoptMachineTypeOf(MachineRepresentation rep, Type* type) {
-    if (type->IsNone()) {
+  static MachineType DeoptMachineTypeOf(MachineRepresentation rep, Type type) {
+    if (type.IsNone()) {
       return MachineType::None();
     }
     // TODO(turbofan): Special treatment for ExternalPointer here,
     // to avoid incompatible truncations. We really need a story
     // for the JSFunction::entry field.
-    if (type->Is(Type::ExternalPointer())) {
+    if (type.Is(Type::ExternalPointer())) {
       return MachineType::Pointer();
     }
     // Do not distinguish between various Tagged variations.
@@ -1081,7 +1082,7 @@ class RepresentationSelector {
            machine_type.semantic() == MachineSemantic::kInt32 ||
            machine_type.semantic() == MachineSemantic::kUint32);
     DCHECK(machine_type.representation() != MachineRepresentation::kBit ||
-           type->Is(Type::Boolean()));
+           type.Is(Type::Boolean()));
     return machine_type;
   }
 
@@ -1187,26 +1188,26 @@ class RepresentationSelector {
 
   WriteBarrierKind WriteBarrierKindFor(
       BaseTaggedness base_taggedness,
-      MachineRepresentation field_representation, Type* field_type,
+      MachineRepresentation field_representation, Type field_type,
       MachineRepresentation value_representation, Node* value) {
     if (base_taggedness == kTaggedBase &&
         CanBeTaggedPointer(field_representation)) {
-      Type* value_type = NodeProperties::GetType(value);
+      Type value_type = NodeProperties::GetType(value);
       if (field_representation == MachineRepresentation::kTaggedSigned ||
           value_representation == MachineRepresentation::kTaggedSigned) {
         // Write barriers are only for stores of heap objects.
         return kNoWriteBarrier;
       }
-      if (field_type->Is(Type::BooleanOrNullOrUndefined()) ||
-          value_type->Is(Type::BooleanOrNullOrUndefined())) {
+      if (field_type.Is(Type::BooleanOrNullOrUndefined()) ||
+          value_type.Is(Type::BooleanOrNullOrUndefined())) {
         // Write barriers are not necessary when storing true, false, null or
         // undefined, because these special oddballs are always in the root set.
         return kNoWriteBarrier;
       }
-      if (value_type->IsHeapConstant()) {
+      if (value_type.IsHeapConstant()) {
         Heap::RootListIndex root_index;
         Heap* heap = jsgraph_->isolate()->heap();
-        if (heap->IsRootHandle(value_type->AsHeapConstant()->Value(),
+        if (heap->IsRootHandle(value_type.AsHeapConstant()->Value(),
                                &root_index)) {
           if (heap->RootIsImmortalImmovable(root_index)) {
             // Write barriers are unnecessary for immortal immovable roots.
@@ -1236,7 +1237,7 @@ class RepresentationSelector {
   WriteBarrierKind WriteBarrierKindFor(
       BaseTaggedness base_taggedness,
       MachineRepresentation field_representation, int field_offset,
-      Type* field_type, MachineRepresentation value_representation,
+      Type field_type, MachineRepresentation value_representation,
       Node* value) {
     WriteBarrierKind write_barrier_kind =
         WriteBarrierKindFor(base_taggedness, field_representation, field_type,
@@ -1257,7 +1258,7 @@ class RepresentationSelector {
   }
 
   void LowerToCheckedInt32Mul(Node* node, Truncation truncation,
-                              Type* input0_type, Type* input1_type) {
+                              Type input0_type, Type input1_type) {
     // If one of the inputs is positive and/or truncation is being applied,
     // there is no need to return -0.
     CheckForMinusZeroMode mz_mode =
@@ -1280,11 +1281,11 @@ class RepresentationSelector {
 
   void VisitSpeculativeIntegerAdditiveOp(Node* node, Truncation truncation,
                                          SimplifiedLowering* lowering) {
-    Type* left_upper = GetUpperBound(node->InputAt(0));
-    Type* right_upper = GetUpperBound(node->InputAt(1));
+    Type left_upper = GetUpperBound(node->InputAt(0));
+    Type right_upper = GetUpperBound(node->InputAt(1));
 
-    if (left_upper->Is(type_cache_.kAdditiveSafeIntegerOrMinusZero) &&
-        right_upper->Is(type_cache_.kAdditiveSafeIntegerOrMinusZero)) {
+    if (left_upper.Is(type_cache_.kAdditiveSafeIntegerOrMinusZero) &&
+        right_upper.Is(type_cache_.kAdditiveSafeIntegerOrMinusZero)) {
       // Only eliminate the node if its typing rule can be satisfied, namely
       // that a safe integer is produced.
       if (truncation.IsUnused()) return VisitUnused(node);
@@ -1292,8 +1293,8 @@ class RepresentationSelector {
       // If we know how to interpret the result or if the users only care
       // about the low 32-bits, we can truncate to Word32 do a wrapping
       // addition.
-      if (GetUpperBound(node)->Is(Type::Signed32()) ||
-          GetUpperBound(node)->Is(Type::Unsigned32()) ||
+      if (GetUpperBound(node).Is(Type::Signed32()) ||
+          GetUpperBound(node).Is(Type::Unsigned32()) ||
           truncation.IsUsedAsWord32()) {
         // => Int32Add/Sub
         VisitWord32TruncatingBinop(node);
@@ -1308,15 +1309,14 @@ class RepresentationSelector {
     DCHECK(hint == NumberOperationHint::kSignedSmall ||
            hint == NumberOperationHint::kSigned32);
 
-    Type* left_feedback_type = TypeOf(node->InputAt(0));
-    Type* right_feedback_type = TypeOf(node->InputAt(1));
+    Type left_feedback_type = TypeOf(node->InputAt(0));
+    Type right_feedback_type = TypeOf(node->InputAt(1));
     // Handle the case when no int32 checks on inputs are necessary (but
     // an overflow check is needed on the output). Note that we do not
     // have to do any check if at most one side can be minus zero.
-    if (left_upper->Is(Type::Signed32OrMinusZero()) &&
-        right_upper->Is(Type::Signed32OrMinusZero()) &&
-        (left_upper->Is(Type::Signed32()) ||
-         right_upper->Is(Type::Signed32()))) {
+    if (left_upper.Is(Type::Signed32OrMinusZero()) &&
+        right_upper.Is(Type::Signed32OrMinusZero()) &&
+        (left_upper.Is(Type::Signed32()) || right_upper.Is(Type::Signed32()))) {
       VisitBinop(node, UseInfo::TruncatingWord32(),
                  MachineRepresentation::kWord32, Type::Signed32());
     } else {
@@ -1326,7 +1326,7 @@ class RepresentationSelector {
       // between 0 and -0.
       IdentifyZeros left_identify_zeros = truncation.identify_zeros();
       if (node->opcode() == IrOpcode::kSpeculativeSafeIntegerAdd &&
-          !right_feedback_type->Maybe(Type::MinusZero())) {
+          !right_feedback_type.Maybe(Type::MinusZero())) {
         left_identify_zeros = kIdentifyZeros;
       }
       UseInfo left_use = CheckedUseInfoAsWord32FromHint(hint, VectorSlotPair(),
@@ -1356,8 +1356,8 @@ class RepresentationSelector {
   void VisitSpeculativeAdditiveOp(Node* node, Truncation truncation,
                                   SimplifiedLowering* lowering) {
     if (BothInputsAre(node, type_cache_.kAdditiveSafeIntegerOrMinusZero) &&
-        (GetUpperBound(node)->Is(Type::Signed32()) ||
-         GetUpperBound(node)->Is(Type::Unsigned32()) ||
+        (GetUpperBound(node).Is(Type::Signed32()) ||
+         GetUpperBound(node).Is(Type::Unsigned32()) ||
          truncation.IsUsedAsWord32())) {
       // => Int32Add/Sub
       VisitWord32TruncatingBinop(node);
@@ -1378,7 +1378,7 @@ class RepresentationSelector {
                                      SimplifiedLowering* lowering) {
     if (BothInputsAre(node, Type::Unsigned32OrMinusZeroOrNaN()) &&
         (truncation.IsUsedAsWord32() ||
-         NodeProperties::GetType(node)->Is(Type::Unsigned32()))) {
+         NodeProperties::GetType(node).Is(Type::Unsigned32()))) {
       // => unsigned Uint32Mod
       VisitWord32TruncatingBinop(node);
       if (lower()) DeferReplacement(node, lowering->Uint32Mod(node));
@@ -1386,7 +1386,7 @@ class RepresentationSelector {
     }
     if (BothInputsAre(node, Type::Signed32OrMinusZeroOrNaN()) &&
         (truncation.IsUsedAsWord32() ||
-         NodeProperties::GetType(node)->Is(Type::Signed32()))) {
+         NodeProperties::GetType(node).Is(Type::Signed32()))) {
       // => signed Int32Mod
       VisitWord32TruncatingBinop(node);
       if (lower()) DeferReplacement(node, lowering->Int32Mod(node));
@@ -1440,10 +1440,10 @@ class RepresentationSelector {
       return;
     }
 
-    if (TypeOf(node->InputAt(0))->Is(Type::Unsigned32()) &&
-        TypeOf(node->InputAt(1))->Is(Type::Unsigned32()) &&
+    if (TypeOf(node->InputAt(0)).Is(Type::Unsigned32()) &&
+        TypeOf(node->InputAt(1)).Is(Type::Unsigned32()) &&
         (truncation.IsUsedAsWord32() ||
-         NodeProperties::GetType(node)->Is(Type::Unsigned32()))) {
+         NodeProperties::GetType(node).Is(Type::Unsigned32()))) {
       // We can only promise Float64 truncation here, as the decision is
       // based on the feedback types of the inputs.
       VisitBinop(node,
@@ -1452,10 +1452,10 @@ class RepresentationSelector {
       if (lower()) DeferReplacement(node, lowering->Uint32Mod(node));
       return;
     }
-    if (TypeOf(node->InputAt(0))->Is(Type::Signed32()) &&
-        TypeOf(node->InputAt(1))->Is(Type::Signed32()) &&
+    if (TypeOf(node->InputAt(0)).Is(Type::Signed32()) &&
+        TypeOf(node->InputAt(1)).Is(Type::Signed32()) &&
         (truncation.IsUsedAsWord32() ||
-         NodeProperties::GetType(node)->Is(Type::Signed32()))) {
+         NodeProperties::GetType(node).Is(Type::Signed32()))) {
       // We can only promise Float64 truncation here, as the decision is
       // based on the feedback types of the inputs.
       VisitBinop(node,
@@ -1532,7 +1532,7 @@ class RepresentationSelector {
       }
 
       case IrOpcode::kBranch: {
-        DCHECK(TypeOf(node->InputAt(0))->Is(Type::Boolean()));
+        DCHECK(TypeOf(node->InputAt(0)).Is(Type::Boolean()));
         ProcessInput(node, 0, UseInfo::Bool());
         EnqueueInput(node, NodeProperties::FirstControlIndex(node));
         return;
@@ -1595,7 +1595,7 @@ class RepresentationSelector {
             node->AppendInput(jsgraph_->zone(), jsgraph_->FalseConstant());
             NodeProperties::ChangeOp(node, lowering->machine()->WordEqual());
           } else {
-            DCHECK(TypeOf(node->InputAt(0))->IsNone());
+            DCHECK(TypeOf(node->InputAt(0)).IsNone());
             DeferReplacement(node, lowering->jsgraph()->Int32Constant(0));
           }
         } else {
@@ -1606,13 +1606,13 @@ class RepresentationSelector {
         return;
       }
       case IrOpcode::kNumberEqual: {
-        Type* const lhs_type = TypeOf(node->InputAt(0));
-        Type* const rhs_type = TypeOf(node->InputAt(1));
+        Type const lhs_type = TypeOf(node->InputAt(0));
+        Type const rhs_type = TypeOf(node->InputAt(1));
         // Number comparisons reduce to integer comparisons for integer inputs.
-        if ((lhs_type->Is(Type::Unsigned32()) &&
-             rhs_type->Is(Type::Unsigned32())) ||
-            (lhs_type->Is(Type::Unsigned32OrMinusZeroOrNaN()) &&
-             rhs_type->Is(Type::Unsigned32OrMinusZeroOrNaN()) &&
+        if ((lhs_type.Is(Type::Unsigned32()) &&
+             rhs_type.Is(Type::Unsigned32())) ||
+            (lhs_type.Is(Type::Unsigned32OrMinusZeroOrNaN()) &&
+             rhs_type.Is(Type::Unsigned32OrMinusZeroOrNaN()) &&
              OneInputCannotBe(node, type_cache_.kZeroish))) {
           // => unsigned Int32Cmp
           VisitBinop(node, UseInfo::TruncatingWord32(),
@@ -1620,10 +1620,9 @@ class RepresentationSelector {
           if (lower()) NodeProperties::ChangeOp(node, Uint32Op(node));
           return;
         }
-        if ((lhs_type->Is(Type::Signed32()) &&
-             rhs_type->Is(Type::Signed32())) ||
-            (lhs_type->Is(Type::Signed32OrMinusZeroOrNaN()) &&
-             rhs_type->Is(Type::Signed32OrMinusZeroOrNaN()) &&
+        if ((lhs_type.Is(Type::Signed32()) && rhs_type.Is(Type::Signed32())) ||
+            (lhs_type.Is(Type::Signed32OrMinusZeroOrNaN()) &&
+             rhs_type.Is(Type::Signed32OrMinusZeroOrNaN()) &&
              OneInputCannotBe(node, type_cache_.kZeroish))) {
           // => signed Int32Cmp
           VisitBinop(node, UseInfo::TruncatingWord32(),
@@ -1640,14 +1639,14 @@ class RepresentationSelector {
       case IrOpcode::kNumberLessThan:
       case IrOpcode::kNumberLessThanOrEqual: {
         // Number comparisons reduce to integer comparisons for integer inputs.
-        if (TypeOf(node->InputAt(0))->Is(Type::Unsigned32()) &&
-            TypeOf(node->InputAt(1))->Is(Type::Unsigned32())) {
+        if (TypeOf(node->InputAt(0)).Is(Type::Unsigned32()) &&
+            TypeOf(node->InputAt(1)).Is(Type::Unsigned32())) {
           // => unsigned Int32Cmp
           VisitBinop(node, UseInfo::TruncatingWord32(),
                      MachineRepresentation::kBit);
           if (lower()) NodeProperties::ChangeOp(node, Uint32Op(node));
-        } else if (TypeOf(node->InputAt(0))->Is(Type::Signed32()) &&
-                   TypeOf(node->InputAt(1))->Is(Type::Signed32())) {
+        } else if (TypeOf(node->InputAt(0)).Is(Type::Signed32()) &&
+                   TypeOf(node->InputAt(1)).Is(Type::Signed32())) {
           // => signed Int32Cmp
           VisitBinop(node, UseInfo::TruncatingWord32(),
                      MachineRepresentation::kBit);
@@ -1673,15 +1672,15 @@ class RepresentationSelector {
       case IrOpcode::kSpeculativeNumberLessThanOrEqual:
       case IrOpcode::kSpeculativeNumberEqual: {
         // Number comparisons reduce to integer comparisons for integer inputs.
-        if (TypeOf(node->InputAt(0))->Is(Type::Unsigned32()) &&
-            TypeOf(node->InputAt(1))->Is(Type::Unsigned32())) {
+        if (TypeOf(node->InputAt(0)).Is(Type::Unsigned32()) &&
+            TypeOf(node->InputAt(1)).Is(Type::Unsigned32())) {
           // => unsigned Int32Cmp
           VisitBinop(node, UseInfo::TruncatingWord32(),
                      MachineRepresentation::kBit);
           if (lower()) ChangeToPureOp(node, Uint32Op(node));
           return;
-        } else if (TypeOf(node->InputAt(0))->Is(Type::Signed32()) &&
-                   TypeOf(node->InputAt(1))->Is(Type::Signed32())) {
+        } else if (TypeOf(node->InputAt(0)).Is(Type::Signed32()) &&
+                   TypeOf(node->InputAt(1)).Is(Type::Signed32())) {
           // => signed Int32Cmp
           VisitBinop(node, UseInfo::TruncatingWord32(),
                      MachineRepresentation::kBit);
@@ -1741,8 +1740,8 @@ class RepresentationSelector {
       case IrOpcode::kNumberAdd:
       case IrOpcode::kNumberSubtract: {
         if (BothInputsAre(node, type_cache_.kAdditiveSafeIntegerOrMinusZero) &&
-            (GetUpperBound(node)->Is(Type::Signed32()) ||
-             GetUpperBound(node)->Is(Type::Unsigned32()) ||
+            (GetUpperBound(node).Is(Type::Signed32()) ||
+             GetUpperBound(node).Is(Type::Unsigned32()) ||
              truncation.IsUsedAsWord32())) {
           // => Int32Add/Sub
           VisitWord32TruncatingBinop(node);
@@ -1756,10 +1755,10 @@ class RepresentationSelector {
       }
       case IrOpcode::kSpeculativeNumberMultiply: {
         if (BothInputsAre(node, Type::Integral32()) &&
-            (NodeProperties::GetType(node)->Is(Type::Signed32()) ||
-             NodeProperties::GetType(node)->Is(Type::Unsigned32()) ||
+            (NodeProperties::GetType(node).Is(Type::Signed32()) ||
+             NodeProperties::GetType(node).Is(Type::Unsigned32()) ||
              (truncation.IsUsedAsWord32() &&
-              NodeProperties::GetType(node)->Is(
+              NodeProperties::GetType(node).Is(
                   type_cache_.kSafeIntegerOrMinusZero)))) {
           // Multiply reduces to Int32Mul if the inputs are integers, and
           // (a) the output is either known to be Signed32, or
@@ -1772,8 +1771,8 @@ class RepresentationSelector {
         }
         // Try to use type feedback.
         NumberOperationHint hint = NumberOperationHintOf(node->op());
-        Type* input0_type = TypeOf(node->InputAt(0));
-        Type* input1_type = TypeOf(node->InputAt(1));
+        Type input0_type = TypeOf(node->InputAt(0));
+        Type input1_type = TypeOf(node->InputAt(1));
 
         // Handle the case when no int32 checks on inputs are necessary
         // (but an overflow check is needed on the output).
@@ -1810,10 +1809,10 @@ class RepresentationSelector {
       }
       case IrOpcode::kNumberMultiply: {
         if (BothInputsAre(node, Type::Integral32()) &&
-            (NodeProperties::GetType(node)->Is(Type::Signed32()) ||
-             NodeProperties::GetType(node)->Is(Type::Unsigned32()) ||
+            (NodeProperties::GetType(node).Is(Type::Signed32()) ||
+             NodeProperties::GetType(node).Is(Type::Unsigned32()) ||
              (truncation.IsUsedAsWord32() &&
-              NodeProperties::GetType(node)->Is(
+              NodeProperties::GetType(node).Is(
                   type_cache_.kSafeIntegerOrMinusZero)))) {
           // Multiply reduces to Int32Mul if the inputs are integers, and
           // (a) the output is either known to be Signed32, or
@@ -1837,7 +1836,7 @@ class RepresentationSelector {
           return;
         }
         if (BothInputsAreSigned32(node)) {
-          if (NodeProperties::GetType(node)->Is(Type::Signed32())) {
+          if (NodeProperties::GetType(node).Is(Type::Signed32())) {
             // => signed Int32Div
             VisitWord32TruncatingBinop(node);
             if (lower()) DeferReplacement(node, lowering->Int32Div(node));
@@ -1911,7 +1910,7 @@ class RepresentationSelector {
           return;
         }
         if (BothInputsAreSigned32(node)) {
-          if (NodeProperties::GetType(node)->Is(Type::Signed32())) {
+          if (NodeProperties::GetType(node).Is(Type::Signed32())) {
             // => signed Int32Div
             VisitWord32TruncatingBinop(node);
             if (lower()) DeferReplacement(node, lowering->Int32Div(node));
@@ -1934,7 +1933,7 @@ class RepresentationSelector {
       case IrOpcode::kNumberModulus: {
         if (BothInputsAre(node, Type::Unsigned32OrMinusZeroOrNaN()) &&
             (truncation.IsUsedAsWord32() ||
-             NodeProperties::GetType(node)->Is(Type::Unsigned32()))) {
+             NodeProperties::GetType(node).Is(Type::Unsigned32()))) {
           // => unsigned Uint32Mod
           VisitWord32TruncatingBinop(node);
           if (lower()) DeferReplacement(node, lowering->Uint32Mod(node));
@@ -1942,16 +1941,16 @@ class RepresentationSelector {
         }
         if (BothInputsAre(node, Type::Signed32OrMinusZeroOrNaN()) &&
             (truncation.IsUsedAsWord32() ||
-             NodeProperties::GetType(node)->Is(Type::Signed32()))) {
+             NodeProperties::GetType(node).Is(Type::Signed32()))) {
           // => signed Int32Mod
           VisitWord32TruncatingBinop(node);
           if (lower()) DeferReplacement(node, lowering->Int32Mod(node));
           return;
         }
-        if (TypeOf(node->InputAt(0))->Is(Type::Unsigned32()) &&
-            TypeOf(node->InputAt(1))->Is(Type::Unsigned32()) &&
+        if (TypeOf(node->InputAt(0)).Is(Type::Unsigned32()) &&
+            TypeOf(node->InputAt(1)).Is(Type::Unsigned32()) &&
             (truncation.IsUsedAsWord32() ||
-             NodeProperties::GetType(node)->Is(Type::Unsigned32()))) {
+             NodeProperties::GetType(node).Is(Type::Unsigned32()))) {
           // We can only promise Float64 truncation here, as the decision is
           // based on the feedback types of the inputs.
           VisitBinop(node, UseInfo(MachineRepresentation::kWord32,
@@ -1960,10 +1959,10 @@ class RepresentationSelector {
           if (lower()) DeferReplacement(node, lowering->Uint32Mod(node));
           return;
         }
-        if (TypeOf(node->InputAt(0))->Is(Type::Signed32()) &&
-            TypeOf(node->InputAt(1))->Is(Type::Signed32()) &&
+        if (TypeOf(node->InputAt(0)).Is(Type::Signed32()) &&
+            TypeOf(node->InputAt(1)).Is(Type::Signed32()) &&
             (truncation.IsUsedAsWord32() ||
-             NodeProperties::GetType(node)->Is(Type::Signed32()))) {
+             NodeProperties::GetType(node).Is(Type::Signed32()))) {
           // We can only promise Float64 truncation here, as the decision is
           // based on the feedback types of the inputs.
           VisitBinop(node, UseInfo(MachineRepresentation::kWord32,
@@ -1993,7 +1992,7 @@ class RepresentationSelector {
         }
         return;
       case IrOpcode::kNumberShiftLeft: {
-        Type* rhs_type = GetUpperBound(node->InputAt(1));
+        Type rhs_type = GetUpperBound(node->InputAt(1));
         VisitBinop(node, UseInfo::TruncatingWord32(),
                    UseInfo::TruncatingWord32(), MachineRepresentation::kWord32);
         if (lower()) {
@@ -2003,7 +2002,7 @@ class RepresentationSelector {
       }
       case IrOpcode::kSpeculativeNumberShiftLeft: {
         if (BothInputsAre(node, Type::NumberOrOddball())) {
-          Type* rhs_type = GetUpperBound(node->InputAt(1));
+          Type rhs_type = GetUpperBound(node->InputAt(1));
           VisitBinop(node, UseInfo::TruncatingWord32(),
                      UseInfo::TruncatingWord32(),
                      MachineRepresentation::kWord32);
@@ -2013,7 +2012,7 @@ class RepresentationSelector {
           return;
         }
         NumberOperationHint hint = NumberOperationHintOf(node->op());
-        Type* rhs_type = GetUpperBound(node->InputAt(1));
+        Type rhs_type = GetUpperBound(node->InputAt(1));
         VisitBinop(node, CheckedUseInfoAsWord32FromHint(hint),
                    MachineRepresentation::kWord32, Type::Signed32());
         if (lower()) {
@@ -2022,7 +2021,7 @@ class RepresentationSelector {
         return;
       }
       case IrOpcode::kNumberShiftRight: {
-        Type* rhs_type = GetUpperBound(node->InputAt(1));
+        Type rhs_type = GetUpperBound(node->InputAt(1));
         VisitBinop(node, UseInfo::TruncatingWord32(),
                    UseInfo::TruncatingWord32(), MachineRepresentation::kWord32);
         if (lower()) {
@@ -2032,7 +2031,7 @@ class RepresentationSelector {
       }
       case IrOpcode::kSpeculativeNumberShiftRight: {
         if (BothInputsAre(node, Type::NumberOrOddball())) {
-          Type* rhs_type = GetUpperBound(node->InputAt(1));
+          Type rhs_type = GetUpperBound(node->InputAt(1));
           VisitBinop(node, UseInfo::TruncatingWord32(),
                      UseInfo::TruncatingWord32(),
                      MachineRepresentation::kWord32);
@@ -2042,7 +2041,7 @@ class RepresentationSelector {
           return;
         }
         NumberOperationHint hint = NumberOperationHintOf(node->op());
-        Type* rhs_type = GetUpperBound(node->InputAt(1));
+        Type rhs_type = GetUpperBound(node->InputAt(1));
         VisitBinop(node, CheckedUseInfoAsWord32FromHint(hint),
                    MachineRepresentation::kWord32, Type::Signed32());
         if (lower()) {
@@ -2051,7 +2050,7 @@ class RepresentationSelector {
         return;
       }
       case IrOpcode::kNumberShiftRightLogical: {
-        Type* rhs_type = GetUpperBound(node->InputAt(1));
+        Type rhs_type = GetUpperBound(node->InputAt(1));
         VisitBinop(node, UseInfo::TruncatingWord32(),
                    UseInfo::TruncatingWord32(), MachineRepresentation::kWord32);
         if (lower()) {
@@ -2061,8 +2060,8 @@ class RepresentationSelector {
       }
       case IrOpcode::kSpeculativeNumberShiftRightLogical: {
         NumberOperationHint hint = NumberOperationHintOf(node->op());
-        Type* rhs_type = GetUpperBound(node->InputAt(1));
-        if (rhs_type->Is(type_cache_.kZeroish) &&
+        Type rhs_type = GetUpperBound(node->InputAt(1));
+        if (rhs_type.Is(type_cache_.kZeroish) &&
             (hint == NumberOperationHint::kSignedSmall ||
              hint == NumberOperationHint::kSigned32) &&
             !truncation.IsUsedAsWord32()) {
@@ -2096,16 +2095,16 @@ class RepresentationSelector {
         return;
       }
       case IrOpcode::kNumberAbs: {
-        if (TypeOf(node->InputAt(0))->Is(Type::Unsigned32())) {
+        if (TypeOf(node->InputAt(0)).Is(Type::Unsigned32())) {
           VisitUnop(node, UseInfo::TruncatingWord32(),
                     MachineRepresentation::kWord32);
           if (lower()) DeferReplacement(node, node->InputAt(0));
-        } else if (TypeOf(node->InputAt(0))->Is(Type::Signed32())) {
+        } else if (TypeOf(node->InputAt(0)).Is(Type::Signed32())) {
           VisitUnop(node, UseInfo::TruncatingWord32(),
                     MachineRepresentation::kWord32);
           if (lower()) DeferReplacement(node, lowering->Int32Abs(node));
         } else if (TypeOf(node->InputAt(0))
-                       ->Is(type_cache_.kPositiveIntegerOrMinusZeroOrNaN)) {
+                       .Is(type_cache_.kPositiveIntegerOrMinusZeroOrNaN)) {
           VisitUnop(node, UseInfo::TruncatingFloat64(),
                     MachineRepresentation::kFloat64);
           if (lower()) DeferReplacement(node, node->InputAt(0));
@@ -2138,24 +2137,24 @@ class RepresentationSelector {
         // It is safe to use the feedback types for left and right hand side
         // here, since we can only narrow those types and thus we can only
         // promise a more specific truncation.
-        Type* const lhs_type = TypeOf(node->InputAt(0));
-        Type* const rhs_type = TypeOf(node->InputAt(1));
-        if (lhs_type->Is(Type::Unsigned32()) &&
-            rhs_type->Is(Type::Unsigned32())) {
+        Type const lhs_type = TypeOf(node->InputAt(0));
+        Type const rhs_type = TypeOf(node->InputAt(1));
+        if (lhs_type.Is(Type::Unsigned32()) &&
+            rhs_type.Is(Type::Unsigned32())) {
           VisitWord32TruncatingBinop(node);
           if (lower()) {
             lowering->DoMax(node, lowering->machine()->Uint32LessThan(),
                             MachineRepresentation::kWord32);
           }
-        } else if (lhs_type->Is(Type::Signed32()) &&
-                   rhs_type->Is(Type::Signed32())) {
+        } else if (lhs_type.Is(Type::Signed32()) &&
+                   rhs_type.Is(Type::Signed32())) {
           VisitWord32TruncatingBinop(node);
           if (lower()) {
             lowering->DoMax(node, lowering->machine()->Int32LessThan(),
                             MachineRepresentation::kWord32);
           }
-        } else if (lhs_type->Is(Type::PlainNumber()) &&
-                   rhs_type->Is(Type::PlainNumber())) {
+        } else if (lhs_type.Is(Type::PlainNumber()) &&
+                   rhs_type.Is(Type::PlainNumber())) {
           VisitFloat64Binop(node);
           if (lower()) {
             lowering->DoMax(node, lowering->machine()->Float64LessThan(),
@@ -2171,24 +2170,24 @@ class RepresentationSelector {
         // It is safe to use the feedback types for left and right hand side
         // here, since we can only narrow those types and thus we can only
         // promise a more specific truncation.
-        Type* const lhs_type = TypeOf(node->InputAt(0));
-        Type* const rhs_type = TypeOf(node->InputAt(1));
-        if (lhs_type->Is(Type::Unsigned32()) &&
-            rhs_type->Is(Type::Unsigned32())) {
+        Type const lhs_type = TypeOf(node->InputAt(0));
+        Type const rhs_type = TypeOf(node->InputAt(1));
+        if (lhs_type.Is(Type::Unsigned32()) &&
+            rhs_type.Is(Type::Unsigned32())) {
           VisitWord32TruncatingBinop(node);
           if (lower()) {
             lowering->DoMin(node, lowering->machine()->Uint32LessThan(),
                             MachineRepresentation::kWord32);
           }
-        } else if (lhs_type->Is(Type::Signed32()) &&
-                   rhs_type->Is(Type::Signed32())) {
+        } else if (lhs_type.Is(Type::Signed32()) &&
+                   rhs_type.Is(Type::Signed32())) {
           VisitWord32TruncatingBinop(node);
           if (lower()) {
             lowering->DoMin(node, lowering->machine()->Int32LessThan(),
                             MachineRepresentation::kWord32);
           }
-        } else if (lhs_type->Is(Type::PlainNumber()) &&
-                   rhs_type->Is(Type::PlainNumber())) {
+        } else if (lhs_type.Is(Type::PlainNumber()) &&
+                   rhs_type.Is(Type::PlainNumber())) {
           VisitFloat64Binop(node);
           if (lower()) {
             lowering->DoMin(node, lowering->machine()->Float64LessThan(),
@@ -2259,12 +2258,12 @@ class RepresentationSelector {
         return;
       }
       case IrOpcode::kNumberToBoolean: {
-        Type* const input_type = TypeOf(node->InputAt(0));
-        if (input_type->Is(Type::Integral32())) {
+        Type const input_type = TypeOf(node->InputAt(0));
+        if (input_type.Is(Type::Integral32())) {
           VisitUnop(node, UseInfo::TruncatingWord32(),
                     MachineRepresentation::kBit);
           if (lower()) lowering->DoIntegral32ToBit(node);
-        } else if (input_type->Is(Type::OrderedNumber())) {
+        } else if (input_type.Is(Type::OrderedNumber())) {
           VisitUnop(node, UseInfo::TruncatingFloat64(),
                     MachineRepresentation::kBit);
           if (lower()) lowering->DoOrderedNumberToBit(node);
@@ -2295,20 +2294,20 @@ class RepresentationSelector {
         return;
       }
       case IrOpcode::kNumberToUint8Clamped: {
-        Type* const input_type = TypeOf(node->InputAt(0));
-        if (input_type->Is(type_cache_.kUint8OrMinusZeroOrNaN)) {
+        Type const input_type = TypeOf(node->InputAt(0));
+        if (input_type.Is(type_cache_.kUint8OrMinusZeroOrNaN)) {
           VisitUnop(node, UseInfo::TruncatingWord32(),
                     MachineRepresentation::kWord32);
           if (lower()) DeferReplacement(node, node->InputAt(0));
-        } else if (input_type->Is(Type::Unsigned32OrMinusZeroOrNaN())) {
+        } else if (input_type.Is(Type::Unsigned32OrMinusZeroOrNaN())) {
           VisitUnop(node, UseInfo::TruncatingWord32(),
                     MachineRepresentation::kWord32);
           if (lower()) lowering->DoUnsigned32ToUint8Clamped(node);
-        } else if (input_type->Is(Type::Signed32OrMinusZeroOrNaN())) {
+        } else if (input_type.Is(Type::Signed32OrMinusZeroOrNaN())) {
           VisitUnop(node, UseInfo::TruncatingWord32(),
                     MachineRepresentation::kWord32);
           if (lower()) lowering->DoSigned32ToUint8Clamped(node);
-        } else if (input_type->Is(type_cache_.kIntegerOrMinusZeroOrNaN)) {
+        } else if (input_type.Is(type_cache_.kIntegerOrMinusZeroOrNaN)) {
           VisitUnop(node, UseInfo::TruncatingFloat64(),
                     MachineRepresentation::kFloat64);
           if (lower()) lowering->DoIntegerToUint8Clamped(node);
@@ -2400,18 +2399,19 @@ class RepresentationSelector {
       }
       case IrOpcode::kCheckBounds: {
         const CheckParameters& p = CheckParametersOf(node->op());
-        Type* index_type = TypeOf(node->InputAt(0));
-        Type* length_type = TypeOf(node->InputAt(1));
-        if (index_type->Is(Type::Integral32OrMinusZero())) {
+        Type index_type = TypeOf(node->InputAt(0));
+        Type length_type = TypeOf(node->InputAt(1));
+        if (index_type.Is(Type::Integral32OrMinusZero())) {
           // Map -0 to 0, and the values in the [-2^31,-1] range to the
           // [2^31,2^32-1] range, which will be considered out-of-bounds
           // as well, because the {length_type} is limited to Unsigned31.
           VisitBinop(node, UseInfo::TruncatingWord32(),
                      MachineRepresentation::kWord32);
-          if (lower()) {
-            if (index_type->IsNone() || length_type->IsNone() ||
-                (index_type->Min() >= 0.0 &&
-                 index_type->Max() < length_type->Min())) {
+          if (lower() && lowering->poisoning_level_ ==
+                             PoisoningMitigationLevel::kDontPoison) {
+            if (index_type.IsNone() || length_type.IsNone() ||
+                (index_type.Min() >= 0.0 &&
+                 index_type.Max() < length_type.Min())) {
               // The bounds check is redundant if we already know that
               // the index is within the bounds of [0.0, length[.
               DeferReplacement(node, node->InputAt(0));
@@ -2425,9 +2425,9 @@ class RepresentationSelector {
         }
         return;
       }
-      case IrOpcode::kMaskIndexWithBound: {
-        VisitBinop(node, UseInfo::TruncatingWord32(),
-                   MachineRepresentation::kWord32);
+      case IrOpcode::kPoisonIndex: {
+        VisitUnop(node, UseInfo::TruncatingWord32(),
+                  MachineRepresentation::kWord32);
         return;
       }
       case IrOpcode::kCheckHeapObject: {
@@ -2452,8 +2452,8 @@ class RepresentationSelector {
         return;
       }
       case IrOpcode::kCheckNumber: {
-        Type* const input_type = TypeOf(node->InputAt(0));
-        if (input_type->Is(Type::Number())) {
+        Type const input_type = TypeOf(node->InputAt(0));
+        if (input_type.Is(Type::Number())) {
           VisitNoop(node, truncation);
         } else {
           VisitUnop(node, UseInfo::AnyTagged(), MachineRepresentation::kTagged);
@@ -2518,7 +2518,7 @@ class RepresentationSelector {
 
         // Convert to Smi if possible, such that we can avoid a write barrier.
         if (field_representation == MachineRepresentation::kTagged &&
-            TypeOf(value_node)->Is(Type::SignedSmall())) {
+            TypeOf(value_node).Is(Type::SignedSmall())) {
           field_representation = MachineRepresentation::kTaggedSigned;
         }
         WriteBarrierKind write_barrier_kind = WriteBarrierKindFor(
@@ -2556,7 +2556,7 @@ class RepresentationSelector {
 
         // Convert to Smi if possible, such that we can avoid a write barrier.
         if (element_representation == MachineRepresentation::kTagged &&
-            TypeOf(value_node)->Is(Type::SignedSmall())) {
+            TypeOf(value_node).Is(Type::SignedSmall())) {
           element_representation = MachineRepresentation::kTaggedSigned;
         }
         WriteBarrierKind write_barrier_kind = WriteBarrierKindFor(
@@ -2584,18 +2584,18 @@ class RepresentationSelector {
         return;
       }
       case IrOpcode::kTransitionAndStoreElement: {
-        Type* value_type = TypeOf(node->InputAt(2));
+        Type value_type = TypeOf(node->InputAt(2));
 
         ProcessInput(node, 0, UseInfo::AnyTagged());         // array
         ProcessInput(node, 1, UseInfo::TruncatingWord32());  // index
 
-        if (value_type->Is(Type::SignedSmall())) {
+        if (value_type.Is(Type::SignedSmall())) {
           ProcessInput(node, 2, UseInfo::TruncatingWord32());  // value
           if (lower()) {
             NodeProperties::ChangeOp(node,
                                      simplified()->StoreSignedSmallElement());
           }
-        } else if (value_type->Is(Type::Number())) {
+        } else if (value_type.Is(Type::Number())) {
           ProcessInput(node, 2, UseInfo::TruncatingFloat64());  // value
           if (lower()) {
             Handle<Map> double_map = DoubleMapParameterOf(node->op());
@@ -2603,7 +2603,7 @@ class RepresentationSelector {
                 node,
                 simplified()->TransitionAndStoreNumberElement(double_map));
           }
-        } else if (value_type->Is(Type::NonNumber())) {
+        } else if (value_type.Is(Type::NonNumber())) {
           ProcessInput(node, 2, UseInfo::AnyTagged());  // value
           if (lower()) {
             Handle<Map> fast_map = FastMapParameterOf(node->op());
@@ -2630,6 +2630,17 @@ class RepresentationSelector {
         SetOutput(node, rep);
         return;
       }
+      case IrOpcode::kLoadDataViewElement: {
+        MachineRepresentation const rep =
+            MachineRepresentationFromArrayType(ExternalArrayTypeOf(node->op()));
+        ProcessInput(node, 0, UseInfo::AnyTagged());         // buffer
+        ProcessInput(node, 1, UseInfo::PointerInt());        // external pointer
+        ProcessInput(node, 2, UseInfo::TruncatingWord32());  // index
+        ProcessInput(node, 3, UseInfo::Bool());              // little-endian
+        ProcessRemainingInputs(node, 4);
+        SetOutput(node, rep);
+        return;
+      }
       case IrOpcode::kStoreTypedElement: {
         MachineRepresentation const rep =
             MachineRepresentationFromArrayType(ExternalArrayTypeOf(node->op()));
@@ -2643,17 +2654,30 @@ class RepresentationSelector {
         SetOutput(node, MachineRepresentation::kNone);
         return;
       }
+      case IrOpcode::kStoreDataViewElement: {
+        MachineRepresentation const rep =
+            MachineRepresentationFromArrayType(ExternalArrayTypeOf(node->op()));
+        ProcessInput(node, 0, UseInfo::AnyTagged());         // buffer
+        ProcessInput(node, 1, UseInfo::PointerInt());        // external pointer
+        ProcessInput(node, 2, UseInfo::TruncatingWord32());  // index
+        ProcessInput(node, 3,
+                     TruncatingUseInfoFromRepresentation(rep));  // value
+        ProcessInput(node, 4, UseInfo::Bool());  // little-endian
+        ProcessRemainingInputs(node, 5);
+        SetOutput(node, MachineRepresentation::kNone);
+        return;
+      }
       case IrOpcode::kConvertReceiver: {
-        Type* input_type = TypeOf(node->InputAt(0));
+        Type input_type = TypeOf(node->InputAt(0));
         VisitBinop(node, UseInfo::AnyTagged(),
                    MachineRepresentation::kTaggedPointer);
         if (lower()) {
           // Try to optimize the {node} based on the input type.
-          if (input_type->Is(Type::Receiver())) {
+          if (input_type.Is(Type::Receiver())) {
             DeferReplacement(node, node->InputAt(0));
-          } else if (input_type->Is(Type::NullOrUndefined())) {
+          } else if (input_type.Is(Type::NullOrUndefined())) {
             DeferReplacement(node, node->InputAt(1));
-          } else if (!input_type->Maybe(Type::NullOrUndefined())) {
+          } else if (!input_type.Maybe(Type::NullOrUndefined())) {
             NodeProperties::ChangeOp(
                 node, lowering->simplified()->ConvertReceiver(
                           ConvertReceiverMode::kNotNullOrUndefined));
@@ -2745,18 +2769,18 @@ class RepresentationSelector {
         return;
       }
       case IrOpcode::kObjectIsFiniteNumber: {
-        Type* const input_type = GetUpperBound(node->InputAt(0));
-        if (input_type->Is(type_cache_.kSafeInteger)) {
+        Type const input_type = GetUpperBound(node->InputAt(0));
+        if (input_type.Is(type_cache_.kSafeInteger)) {
           VisitUnop(node, UseInfo::None(), MachineRepresentation::kBit);
           if (lower()) {
             DeferReplacement(node, lowering->jsgraph()->Int32Constant(1));
           }
-        } else if (!input_type->Maybe(Type::Number())) {
+        } else if (!input_type.Maybe(Type::Number())) {
           VisitUnop(node, UseInfo::Any(), MachineRepresentation::kBit);
           if (lower()) {
             DeferReplacement(node, lowering->jsgraph()->Int32Constant(0));
           }
-        } else if (input_type->Is(Type::Number())) {
+        } else if (input_type.Is(Type::Number())) {
           VisitUnop(node, UseInfo::TruncatingFloat64(),
                     MachineRepresentation::kBit);
           if (lower()) {
@@ -2769,21 +2793,23 @@ class RepresentationSelector {
         return;
       }
       case IrOpcode::kNumberIsFinite: {
-        UNREACHABLE();
+        VisitUnop(node, UseInfo::TruncatingFloat64(),
+                  MachineRepresentation::kBit);
+        return;
       }
       case IrOpcode::kObjectIsSafeInteger: {
-        Type* const input_type = GetUpperBound(node->InputAt(0));
-        if (input_type->Is(type_cache_.kSafeInteger)) {
+        Type const input_type = GetUpperBound(node->InputAt(0));
+        if (input_type.Is(type_cache_.kSafeInteger)) {
           VisitUnop(node, UseInfo::None(), MachineRepresentation::kBit);
           if (lower()) {
             DeferReplacement(node, lowering->jsgraph()->Int32Constant(1));
           }
-        } else if (!input_type->Maybe(Type::Number())) {
+        } else if (!input_type.Maybe(Type::Number())) {
           VisitUnop(node, UseInfo::Any(), MachineRepresentation::kBit);
           if (lower()) {
             DeferReplacement(node, lowering->jsgraph()->Int32Constant(0));
           }
-        } else if (input_type->Is(Type::Number())) {
+        } else if (input_type.Is(Type::Number())) {
           VisitUnop(node, UseInfo::TruncatingFloat64(),
                     MachineRepresentation::kBit);
           if (lower()) {
@@ -2799,18 +2825,18 @@ class RepresentationSelector {
         UNREACHABLE();
       }
       case IrOpcode::kObjectIsInteger: {
-        Type* const input_type = GetUpperBound(node->InputAt(0));
-        if (input_type->Is(type_cache_.kSafeInteger)) {
+        Type const input_type = GetUpperBound(node->InputAt(0));
+        if (input_type.Is(type_cache_.kSafeInteger)) {
           VisitUnop(node, UseInfo::None(), MachineRepresentation::kBit);
           if (lower()) {
             DeferReplacement(node, lowering->jsgraph()->Int32Constant(1));
           }
-        } else if (!input_type->Maybe(Type::Number())) {
+        } else if (!input_type.Maybe(Type::Number())) {
           VisitUnop(node, UseInfo::Any(), MachineRepresentation::kBit);
           if (lower()) {
             DeferReplacement(node, lowering->jsgraph()->Int32Constant(0));
           }
-        } else if (input_type->Is(Type::Number())) {
+        } else if (input_type.Is(Type::Number())) {
           VisitUnop(node, UseInfo::TruncatingFloat64(),
                     MachineRepresentation::kBit);
           if (lower()) {
@@ -2828,18 +2854,18 @@ class RepresentationSelector {
         return;
       }
       case IrOpcode::kObjectIsMinusZero: {
-        Type* const input_type = GetUpperBound(node->InputAt(0));
-        if (input_type->Is(Type::MinusZero())) {
+        Type const input_type = GetUpperBound(node->InputAt(0));
+        if (input_type.Is(Type::MinusZero())) {
           VisitUnop(node, UseInfo::None(), MachineRepresentation::kBit);
           if (lower()) {
             DeferReplacement(node, lowering->jsgraph()->Int32Constant(1));
           }
-        } else if (!input_type->Maybe(Type::MinusZero())) {
+        } else if (!input_type.Maybe(Type::MinusZero())) {
           VisitUnop(node, UseInfo::Any(), MachineRepresentation::kBit);
           if (lower()) {
             DeferReplacement(node, lowering->jsgraph()->Int32Constant(0));
           }
-        } else if (input_type->Is(Type::Number())) {
+        } else if (input_type.Is(Type::Number())) {
           VisitUnop(node, UseInfo::TruncatingFloat64(),
                     MachineRepresentation::kBit);
           if (lower()) {
@@ -2861,34 +2887,33 @@ class RepresentationSelector {
         return;
       }
       case IrOpcode::kObjectIsNaN: {
-        Type* const input_type = GetUpperBound(node->InputAt(0));
-        if (input_type->Is(Type::NaN())) {
+        Type const input_type = GetUpperBound(node->InputAt(0));
+        if (input_type.Is(Type::NaN())) {
           VisitUnop(node, UseInfo::None(), MachineRepresentation::kBit);
           if (lower()) {
             DeferReplacement(node, lowering->jsgraph()->Int32Constant(1));
           }
-        } else if (!input_type->Maybe(Type::NaN())) {
+        } else if (!input_type.Maybe(Type::NaN())) {
           VisitUnop(node, UseInfo::Any(), MachineRepresentation::kBit);
           if (lower()) {
             DeferReplacement(node, lowering->jsgraph()->Int32Constant(0));
           }
-        } else if (input_type->Is(Type::Number())) {
+        } else if (input_type.Is(Type::Number())) {
           VisitUnop(node, UseInfo::TruncatingFloat64(),
                     MachineRepresentation::kBit);
           if (lower()) {
-            // ObjectIsNaN(x:kRepFloat64) => Word32Equal(Float64Equal(x,x),#0)
-            Node* const input = node->InputAt(0);
-            node->ReplaceInput(
-                0, jsgraph_->graph()->NewNode(
-                       lowering->machine()->Float64Equal(), input, input));
-            node->AppendInput(jsgraph_->zone(), jsgraph_->Int32Constant(0));
-            NodeProperties::ChangeOp(node, lowering->machine()->Word32Equal());
+            NodeProperties::ChangeOp(node, simplified()->NumberIsNaN());
           }
         } else {
           VisitUnop(node, UseInfo::AnyTagged(), MachineRepresentation::kBit);
         }
         return;
       }
+      case IrOpcode::kNumberIsNaN: {
+        VisitUnop(node, UseInfo::TruncatingFloat64(),
+                  MachineRepresentation::kBit);
+        return;
+      }
       case IrOpcode::kObjectIsNonCallable: {
         VisitObjectIs(node, Type::NonCallable(), lowering);
         return;
@@ -2943,8 +2968,8 @@ class RepresentationSelector {
         return;
       }
       case IrOpcode::kCheckFloat64Hole: {
-        Type* const input_type = TypeOf(node->InputAt(0));
-        if (input_type->Is(Type::Number())) {
+        Type const input_type = TypeOf(node->InputAt(0));
+        if (input_type.Is(Type::Number())) {
           VisitNoop(node, truncation);
         } else {
           CheckFloat64HoleMode mode = CheckFloat64HoleModeOf(node->op());
@@ -3032,6 +3057,9 @@ class RepresentationSelector {
                   MachineRepresentation::kFloat64);
         if (lower()) NodeProperties::ChangeOp(node, Float64Op(node));
         return;
+      case IrOpcode::kDateNow:
+        VisitInputs(node);
+        return SetOutput(node, MachineRepresentation::kTaggedPointer);
       case IrOpcode::kFrameState:
         return VisitFrameState(node);
       case IrOpcode::kStateValues:
@@ -3043,7 +3071,7 @@ class RepresentationSelector {
       case IrOpcode::kTypeGuard: {
         // We just get rid of the sigma here, choosing the best representation
         // for the sigma's type.
-        Type* type = TypeOf(node);
+        Type type = TypeOf(node);
         MachineRepresentation representation =
             GetOutputInfoForPhi(node, type, truncation);
 
@@ -3071,8 +3099,8 @@ class RepresentationSelector {
         return SetOutput(node, MachineRepresentation::kTagged);
 
       case IrOpcode::kFindOrderedHashMapEntry: {
-        Type* const key_type = TypeOf(node->InputAt(1));
-        if (key_type->Is(Type::Signed32OrMinusZero())) {
+        Type const key_type = TypeOf(node->InputAt(1));
+        if (key_type.Is(Type::Signed32OrMinusZero())) {
           VisitBinop(node, UseInfo::AnyTagged(), UseInfo::TruncatingWord32(),
                      MachineRepresentation::kWord32);
           if (lower()) {
@@ -3126,6 +3154,7 @@ class RepresentationSelector {
       case IrOpcode::kJSToName:
       case IrOpcode::kJSToObject:
       case IrOpcode::kJSToString:
+      case IrOpcode::kJSParseInt:
         VisitInputs(node);
         // Assume the output is tagged.
         return SetOutput(node, MachineRepresentation::kTagged);
@@ -3183,29 +3212,26 @@ class RepresentationSelector {
 
   void PrintOutputInfo(NodeInfo* info) {
     if (FLAG_trace_representation) {
-      OFStream os(stdout);
-      os << info->representation();
+      StdoutStream{} << info->representation();
     }
   }
 
   void PrintRepresentation(MachineRepresentation rep) {
     if (FLAG_trace_representation) {
-      OFStream os(stdout);
-      os << rep;
+      StdoutStream{} << rep;
     }
   }
 
   void PrintTruncation(Truncation truncation) {
     if (FLAG_trace_representation) {
-      OFStream os(stdout);
-      os << truncation.description() << std::endl;
+      StdoutStream{} << truncation.description() << std::endl;
     }
   }
 
   void PrintUseInfo(UseInfo info) {
     if (FLAG_trace_representation) {
-      OFStream os(stdout);
-      os << info.representation() << ":" << info.truncation().description();
+      StdoutStream{} << info.representation() << ":"
+                     << info.truncation().description();
     }
   }
 
@@ -3235,6 +3261,7 @@ class RepresentationSelector {
   // lowering. Once this phase becomes a vanilla reducer, it should get source
   // position information via the SourcePositionWrapper like all other reducers.
   SourcePositionTable* source_positions_;
+  NodeOriginTable* node_origins_;
   TypeCache const& type_cache_;
   OperationTyper op_typer_;  // helper for the feedback typer
 
@@ -3246,17 +3273,24 @@ class RepresentationSelector {
   Zone* graph_zone() { return jsgraph_->zone(); }
 };
 
-SimplifiedLowering::SimplifiedLowering(JSGraph* jsgraph, Zone* zone,
-                                       SourcePositionTable* source_positions)
+SimplifiedLowering::SimplifiedLowering(JSGraph* jsgraph,
+                                       const JSHeapBroker* js_heap_broker,
+                                       Zone* zone,
+                                       SourcePositionTable* source_positions,
+                                       NodeOriginTable* node_origins,
+                                       PoisoningMitigationLevel poisoning_level)
     : jsgraph_(jsgraph),
+      js_heap_broker_(js_heap_broker),
       zone_(zone),
       type_cache_(TypeCache::Get()),
-      source_positions_(source_positions) {}
+      source_positions_(source_positions),
+      node_origins_(node_origins),
+      poisoning_level_(poisoning_level) {}
 
 void SimplifiedLowering::LowerAllNodes() {
   RepresentationChanger changer(jsgraph(), jsgraph()->isolate());
-  RepresentationSelector selector(jsgraph(), zone_, &changer,
-                                  source_positions_);
+  RepresentationSelector selector(jsgraph(), js_heap_broker_, zone_, &changer,
+                                  source_positions_, node_origins_);
   selector.Run(this);
 }
 
@@ -3778,8 +3812,8 @@ void SimplifiedLowering::DoMin(Node* node, Operator const* op,
 }
 
 void SimplifiedLowering::DoShift(Node* node, Operator const* op,
-                                 Type* rhs_type) {
-  if (!rhs_type->Is(type_cache_.kZeroToThirtyOne)) {
+                                 Type rhs_type) {
+  if (!rhs_type.Is(type_cache_.kZeroToThirtyOne)) {
     Node* const rhs = NodeProperties::GetValueInput(node, 1);
     node->ReplaceInput(1, graph()->NewNode(machine()->Word32And(), rhs,
                                            jsgraph()->Int32Constant(0x1F)));
@@ -3900,9 +3934,9 @@ Operator const* SimplifiedLowering::ToNumberOperator() {
   if (!to_number_operator_.is_set()) {
     Callable callable = Builtins::CallableFor(isolate(), Builtins::kToNumber);
     CallDescriptor::Flags flags = CallDescriptor::kNeedsFrameState;
-    auto call_descriptor = Linkage::GetStubCallDescriptor(
-        isolate(), graph()->zone(), callable.descriptor(), 0, flags,
-        Operator::kNoProperties);
+    auto call_descriptor =
+        Linkage::GetStubCallDescriptor(graph()->zone(), callable.descriptor(),
+                                       0, flags, Operator::kNoProperties);
     to_number_operator_.set(common()->Call(call_descriptor));
   }
   return to_number_operator_.get();
@@ -3912,9 +3946,9 @@ Operator const* SimplifiedLowering::ToNumericOperator() {
   if (!to_numeric_operator_.is_set()) {
     Callable callable = Builtins::CallableFor(isolate(), Builtins::kToNumeric);
     CallDescriptor::Flags flags = CallDescriptor::kNeedsFrameState;
-    auto call_descriptor = Linkage::GetStubCallDescriptor(
-        isolate(), graph()->zone(), callable.descriptor(), 0, flags,
-        Operator::kNoProperties);
+    auto call_descriptor =
+        Linkage::GetStubCallDescriptor(graph()->zone(), callable.descriptor(),
+                                       0, flags, Operator::kNoProperties);
     to_numeric_operator_.set(common()->Call(call_descriptor));
   }
   return to_numeric_operator_.get();
diff --git a/deps/v8/src/compiler/simplified-lowering.h b/deps/v8/src/compiler/simplified-lowering.h
index a78d885e6e1f1b..86ac8c75ab278b 100644
--- a/deps/v8/src/compiler/simplified-lowering.h
+++ b/deps/v8/src/compiler/simplified-lowering.h
@@ -15,6 +15,7 @@ namespace internal {
 namespace compiler {
 
 // Forward declarations.
+class NodeOriginTable;
 class RepresentationChanger;
 class RepresentationSelector;
 class SourcePositionTable;
@@ -22,8 +23,10 @@ class TypeCache;
 
 class V8_EXPORT_PRIVATE SimplifiedLowering final {
  public:
-  SimplifiedLowering(JSGraph* jsgraph, Zone* zone,
-                     SourcePositionTable* source_positions);
+  SimplifiedLowering(JSGraph* jsgraph, const JSHeapBroker* js_heap_broker,
+                     Zone* zone, SourcePositionTable* source_position,
+                     NodeOriginTable* node_origins,
+                     PoisoningMitigationLevel poisoning_level);
   ~SimplifiedLowering() {}
 
   void LowerAllNodes();
@@ -34,7 +37,7 @@ class V8_EXPORT_PRIVATE SimplifiedLowering final {
       Node* node, RepresentationSelector* selector);
   void DoJSToNumberOrNumericTruncatesToWord32(Node* node,
                                               RepresentationSelector* selector);
-  void DoShift(Node* node, Operator const* op, Type* rhs_type);
+  void DoShift(Node* node, Operator const* op, Type rhs_type);
   void DoIntegral32ToBit(Node* node);
   void DoOrderedNumberToBit(Node* node);
   void DoNumberToBit(Node* node);
@@ -45,6 +48,7 @@ class V8_EXPORT_PRIVATE SimplifiedLowering final {
 
  private:
   JSGraph* const jsgraph_;
+  const JSHeapBroker* js_heap_broker_;
   Zone* const zone_;
   TypeCache const& type_cache_;
   SetOncePointer<Node> to_number_code_;
@@ -58,6 +62,9 @@ class V8_EXPORT_PRIVATE SimplifiedLowering final {
   // lowering. Once this phase becomes a vanilla reducer, it should get source
   // position information via the SourcePositionWrapper like all other reducers.
   SourcePositionTable* source_positions_;
+  NodeOriginTable* node_origins_;
+
+  PoisoningMitigationLevel poisoning_level_;
 
   Node* Float64Round(Node* const node);
   Node* Float64Sign(Node* const node);
diff --git a/deps/v8/src/compiler/simplified-operator-reducer.cc b/deps/v8/src/compiler/simplified-operator-reducer.cc
index dcfb4851564aae..b7adc3b239b144 100644
--- a/deps/v8/src/compiler/simplified-operator-reducer.cc
+++ b/deps/v8/src/compiler/simplified-operator-reducer.cc
@@ -32,16 +32,20 @@ Decision DecideObjectIsSmi(Node* const input) {
 
 }  // namespace
 
-SimplifiedOperatorReducer::SimplifiedOperatorReducer(Editor* editor,
-                                                     JSGraph* jsgraph)
-    : AdvancedReducer(editor), jsgraph_(jsgraph) {}
+SimplifiedOperatorReducer::SimplifiedOperatorReducer(
+    Editor* editor, JSGraph* jsgraph, const JSHeapBroker* js_heap_broker)
+    : AdvancedReducer(editor),
+      jsgraph_(jsgraph),
+      js_heap_broker_(js_heap_broker) {}
 
 SimplifiedOperatorReducer::~SimplifiedOperatorReducer() {}
 
 
 Reduction SimplifiedOperatorReducer::Reduce(Node* node) {
+  DisallowHeapAccess no_heap_access;
   switch (node->opcode()) {
     case IrOpcode::kBooleanNot: {
+      // TODO(neis): Provide HeapObjectRefMatcher?
       HeapObjectMatcher m(node->InputAt(0));
       if (m.Is(factory()->true_value())) return ReplaceBoolean(false);
       if (m.Is(factory()->false_value())) return ReplaceBoolean(true);
@@ -57,7 +61,10 @@ Reduction SimplifiedOperatorReducer::Reduce(Node* node) {
     }
     case IrOpcode::kChangeTaggedToBit: {
       HeapObjectMatcher m(node->InputAt(0));
-      if (m.HasValue()) return ReplaceInt32(m.Value()->BooleanValue());
+      if (m.HasValue()) {
+        HeapObjectRef object(m.Value());
+        return ReplaceInt32(object.BooleanValue(js_heap_broker()));
+      }
       if (m.IsChangeBitToTagged()) return Replace(m.InputAt(0));
       break;
     }
diff --git a/deps/v8/src/compiler/simplified-operator-reducer.h b/deps/v8/src/compiler/simplified-operator-reducer.h
index 39c467d1bc1692..af827a27889eee 100644
--- a/deps/v8/src/compiler/simplified-operator-reducer.h
+++ b/deps/v8/src/compiler/simplified-operator-reducer.h
@@ -26,7 +26,8 @@ class SimplifiedOperatorBuilder;
 class V8_EXPORT_PRIVATE SimplifiedOperatorReducer final
     : public NON_EXPORTED_BASE(AdvancedReducer) {
  public:
-  SimplifiedOperatorReducer(Editor* editor, JSGraph* jsgraph);
+  SimplifiedOperatorReducer(Editor* editor, JSGraph* jsgraph,
+                            const JSHeapBroker* js_heap_broker);
   ~SimplifiedOperatorReducer() final;
 
   const char* reducer_name() const override {
@@ -51,11 +52,14 @@ class V8_EXPORT_PRIVATE SimplifiedOperatorReducer final
   Factory* factory() const;
   Graph* graph() const;
   Isolate* isolate() const;
-  JSGraph* jsgraph() const { return jsgraph_; }
   MachineOperatorBuilder* machine() const;
   SimplifiedOperatorBuilder* simplified() const;
 
+  JSGraph* jsgraph() const { return jsgraph_; }
+  const JSHeapBroker* js_heap_broker() const { return js_heap_broker_; }
+
   JSGraph* const jsgraph_;
+  const JSHeapBroker* const js_heap_broker_;
 
   DISALLOW_COPY_AND_ASSIGN(SimplifiedOperatorReducer);
 };
diff --git a/deps/v8/src/compiler/simplified-operator.cc b/deps/v8/src/compiler/simplified-operator.cc
index 5a09dc34ae3111..32aafa33d493eb 100644
--- a/deps/v8/src/compiler/simplified-operator.cc
+++ b/deps/v8/src/compiler/simplified-operator.cc
@@ -48,6 +48,21 @@ size_t hash_value(FieldAccess const& access) {
                             access.machine_type);
 }
 
+size_t hash_value(LoadSensitivity load_sensitivity) {
+  return static_cast<size_t>(load_sensitivity);
+}
+
+std::ostream& operator<<(std::ostream& os, LoadSensitivity load_sensitivity) {
+  switch (load_sensitivity) {
+    case LoadSensitivity::kCritical:
+      return os << "Critical";
+    case LoadSensitivity::kSafe:
+      return os << "Safe";
+    case LoadSensitivity::kUnsafe:
+      return os << "Unsafe";
+  }
+  UNREACHABLE();
+}
 
 std::ostream& operator<<(std::ostream& os, FieldAccess const& access) {
   os << "[" << access.base_is_tagged << ", " << access.offset << ", ";
@@ -62,8 +77,12 @@ std::ostream& operator<<(std::ostream& os, FieldAccess const& access) {
     os << Brief(*map) << ", ";
   }
 #endif
-  access.type->PrintTo(os);
-  os << ", " << access.machine_type << ", " << access.write_barrier_kind << "]";
+  os << access.type << ", " << access.machine_type << ", "
+     << access.write_barrier_kind;
+  if (FLAG_untrusted_code_mitigations || FLAG_branch_load_poisoning) {
+    os << ", " << access.load_sensitivity;
+  }
+  os << "]";
   return os;
 }
 
@@ -96,9 +115,12 @@ size_t hash_value(ElementAccess const& access) {
 
 
 std::ostream& operator<<(std::ostream& os, ElementAccess const& access) {
-  os << access.base_is_tagged << ", " << access.header_size << ", ";
-  access.type->PrintTo(os);
-  os << ", " << access.machine_type << ", " << access.write_barrier_kind;
+  os << access.base_is_tagged << ", " << access.header_size << ", "
+     << access.type << ", " << access.machine_type << ", "
+     << access.write_barrier_kind;
+  if (FLAG_untrusted_code_mitigations || FLAG_branch_load_poisoning) {
+    os << ", " << access.load_sensitivity;
+  }
   return os;
 }
 
@@ -119,7 +141,9 @@ const ElementAccess& ElementAccessOf(const Operator* op) {
 
 ExternalArrayType ExternalArrayTypeOf(const Operator* op) {
   DCHECK(op->opcode() == IrOpcode::kLoadTypedElement ||
-         op->opcode() == IrOpcode::kStoreTypedElement);
+         op->opcode() == IrOpcode::kLoadDataViewElement ||
+         op->opcode() == IrOpcode::kStoreTypedElement ||
+         op->opcode() == IrOpcode::kStoreDataViewElement);
   return OpParameter<ExternalArrayType>(op);
 }
 
@@ -366,19 +390,19 @@ namespace {
 class TransitionAndStoreNonNumberElementParameters final {
  public:
   TransitionAndStoreNonNumberElementParameters(Handle<Map> fast_map,
-                                               Type* value_type);
+                                               Type value_type);
 
   Handle<Map> fast_map() const { return fast_map_; }
-  Type* value_type() const { return value_type_; }
+  Type value_type() const { return value_type_; }
 
  private:
   Handle<Map> const fast_map_;
-  Type* value_type_;
+  Type value_type_;
 };
 
 TransitionAndStoreNonNumberElementParameters::
     TransitionAndStoreNonNumberElementParameters(Handle<Map> fast_map,
-                                                 Type* value_type)
+                                                 Type value_type)
     : fast_map_(fast_map), value_type_(value_type) {}
 
 bool operator==(TransitionAndStoreNonNumberElementParameters const& lhs,
@@ -394,8 +418,8 @@ size_t hash_value(TransitionAndStoreNonNumberElementParameters parameters) {
 
 std::ostream& operator<<(
     std::ostream& os, TransitionAndStoreNonNumberElementParameters parameters) {
-  parameters.value_type()->PrintTo(os);
-  return os << ", fast-map" << Brief(*parameters.fast_map());
+  return os << parameters.value_type() << ", fast-map"
+            << Brief(*parameters.fast_map());
 }
 
 }  // namespace
@@ -444,7 +468,7 @@ Handle<Map> DoubleMapParameterOf(const Operator* op) {
   return Handle<Map>::null();
 }
 
-Type* ValueTypeParameterOf(const Operator* op) {
+Type ValueTypeParameterOf(const Operator* op) {
   DCHECK_EQ(IrOpcode::kTransitionAndStoreNonNumberElement, op->opcode());
   return OpParameter<TransitionAndStoreNonNumberElementParameters>(op)
       .value_type();
@@ -526,8 +550,7 @@ size_t hash_value(AllocateParameters info) {
 
 V8_EXPORT_PRIVATE std::ostream& operator<<(std::ostream& os,
                                            AllocateParameters info) {
-  info.type()->PrintTo(os);
-  return os << ", " << info.pretenure();
+  return os << info.type() << ", " << info.pretenure();
 }
 
 bool operator==(AllocateParameters const& lhs, AllocateParameters const& rhs) {
@@ -544,7 +567,7 @@ PretenureFlag PretenureFlagOf(const Operator* op) {
   return OpParameter<AllocateParameters>(op).pretenure();
 }
 
-Type* AllocateTypeOf(const Operator* op) {
+Type AllocateTypeOf(const Operator* op) {
   DCHECK_EQ(IrOpcode::kAllocate, op->opcode());
   return OpParameter<AllocateParameters>(op).type();
 }
@@ -560,11 +583,6 @@ AbortReason AbortReasonOf(const Operator* op) {
   return static_cast<AbortReason>(OpParameter<int>(op));
 }
 
-DeoptimizeReason DeoptimizeReasonOf(const Operator* op) {
-  DCHECK_EQ(IrOpcode::kCheckIf, op->opcode());
-  return OpParameter<DeoptimizeReason>(op);
-}
-
 const CheckTaggedInputParameters& CheckTaggedInputParametersOf(
     const Operator* op) {
   DCHECK(op->opcode() == IrOpcode::kCheckedTruncateTaggedToWord32 ||
@@ -701,6 +719,7 @@ bool operator==(CheckMinusZeroParameters const& lhs,
   V(ObjectIsDetectableCallable, Operator::kNoProperties, 1, 0)   \
   V(ObjectIsMinusZero, Operator::kNoProperties, 1, 0)            \
   V(ObjectIsNaN, Operator::kNoProperties, 1, 0)                  \
+  V(NumberIsNaN, Operator::kNoProperties, 1, 0)                  \
   V(ObjectIsNonCallable, Operator::kNoProperties, 1, 0)          \
   V(ObjectIsNumber, Operator::kNoProperties, 1, 0)               \
   V(ObjectIsReceiver, Operator::kNoProperties, 1, 0)             \
@@ -723,11 +742,12 @@ bool operator==(CheckMinusZeroParameters const& lhs,
   V(StringLessThanOrEqual, Operator::kNoProperties, 2, 0)        \
   V(ToBoolean, Operator::kNoProperties, 1, 0)                    \
   V(NewConsString, Operator::kNoProperties, 3, 0)                \
-  V(MaskIndexWithBound, Operator::kNoProperties, 2, 0)
+  V(PoisonIndex, Operator::kNoProperties, 1, 0)
 
-#define EFFECT_DEPENDENT_OP_LIST(V)                     \
-  V(StringCharCodeAt, Operator::kNoProperties, 2, 1)    \
-  V(StringSubstring, Operator::kNoProperties, 3, 1)
+#define EFFECT_DEPENDENT_OP_LIST(V)                  \
+  V(StringCharCodeAt, Operator::kNoProperties, 2, 1) \
+  V(StringSubstring, Operator::kNoProperties, 3, 1)  \
+  V(DateNow, Operator::kNoProperties, 0, 1)
 
 #define SPECULATIVE_NUMBER_BINOP_LIST(V)      \
   SIMPLIFIED_SPECULATIVE_NUMBER_BINOP_LIST(V) \
@@ -811,11 +831,12 @@ struct SimplifiedOperatorGlobalCache final {
 #undef CHECKED_WITH_FEEDBACK
 
   template <DeoptimizeReason kDeoptimizeReason>
-  struct CheckIfOperator final : public Operator1<DeoptimizeReason> {
+  struct CheckIfOperator final : public Operator1<CheckIfParameters> {
     CheckIfOperator()
-        : Operator1<DeoptimizeReason>(
+        : Operator1<CheckIfParameters>(
               IrOpcode::kCheckIf, Operator::kFoldable | Operator::kNoThrow,
-              "CheckIf", 1, 1, 1, 0, 1, 0, kDeoptimizeReason) {}
+              "CheckIf", 1, 1, 1, 0, 1, 0,
+              CheckIfParameters(kDeoptimizeReason, VectorSlotPair())) {}
   };
 #define CHECK_IF(Name, message) \
   CheckIfOperator<DeoptimizeReason::k##Name> kCheckIf##Name;
@@ -1121,15 +1142,20 @@ const Operator* SimplifiedOperatorBuilder::RuntimeAbort(AbortReason reason) {
       static_cast<int>(reason));                // parameter
 }
 
-const Operator* SimplifiedOperatorBuilder::CheckIf(DeoptimizeReason reason) {
-  switch (reason) {
+const Operator* SimplifiedOperatorBuilder::CheckIf(
+    DeoptimizeReason reason, const VectorSlotPair& feedback) {
+  if (!feedback.IsValid()) {
+    switch (reason) {
 #define CHECK_IF(Name, message)   \
   case DeoptimizeReason::k##Name: \
     return &cache_.kCheckIf##Name;
     DEOPTIMIZE_REASON_LIST(CHECK_IF)
 #undef CHECK_IF
+    }
   }
-  UNREACHABLE();
+  return new (zone()) Operator1<CheckIfParameters>(
+      IrOpcode::kCheckIf, Operator::kFoldable | Operator::kNoThrow, "CheckIf",
+      1, 1, 1, 0, 1, 0, CheckIfParameters(reason, feedback));
 }
 
 const Operator* SimplifiedOperatorBuilder::ChangeFloat64ToTagged(
@@ -1389,6 +1415,23 @@ CheckParameters const& CheckParametersOf(Operator const* op) {
   return OpParameter<CheckParameters>(op);
 }
 
+bool operator==(CheckIfParameters const& lhs, CheckIfParameters const& rhs) {
+  return lhs.reason() == rhs.reason() && lhs.feedback() == rhs.feedback();
+}
+
+size_t hash_value(CheckIfParameters const& p) {
+  return base::hash_combine(p.reason(), p.feedback());
+}
+
+std::ostream& operator<<(std::ostream& os, CheckIfParameters const& p) {
+  return os << p.reason() << p.feedback();
+}
+
+CheckIfParameters const& CheckIfParametersOf(Operator const* op) {
+  CHECK(op->opcode() == IrOpcode::kCheckIf);
+  return OpParameter<CheckIfParameters>(op);
+}
+
 const Operator* SimplifiedOperatorBuilder::NewDoubleElements(
     PretenureFlag pretenure) {
   return new (zone()) Operator1<PretenureFlag>(  // --
@@ -1424,7 +1467,7 @@ int NewArgumentsElementsMappedCountOf(const Operator* op) {
   return OpParameter<int>(op);
 }
 
-const Operator* SimplifiedOperatorBuilder::Allocate(Type* type,
+const Operator* SimplifiedOperatorBuilder::Allocate(Type type,
                                                     PretenureFlag pretenure) {
   return new (zone()) Operator1<AllocateParameters>(
       IrOpcode::kAllocate,
@@ -1433,7 +1476,7 @@ const Operator* SimplifiedOperatorBuilder::Allocate(Type* type,
 }
 
 const Operator* SimplifiedOperatorBuilder::AllocateRaw(
-    Type* type, PretenureFlag pretenure) {
+    Type type, PretenureFlag pretenure) {
   return new (zone()) Operator1<AllocateParameters>(
       IrOpcode::kAllocateRaw,
       Operator::kNoDeopt | Operator::kNoThrow | Operator::kNoWrite,
@@ -1482,13 +1525,15 @@ const Operator* SimplifiedOperatorBuilder::StringFromSingleCodePoint(
 SPECULATIVE_NUMBER_BINOP_LIST(SPECULATIVE_NUMBER_BINOP)
 #undef SPECULATIVE_NUMBER_BINOP
 
-#define ACCESS_OP_LIST(V)                                             \
-  V(LoadField, FieldAccess, Operator::kNoWrite, 1, 1, 1)              \
-  V(StoreField, FieldAccess, Operator::kNoRead, 2, 1, 0)              \
-  V(LoadElement, ElementAccess, Operator::kNoWrite, 2, 1, 1)          \
-  V(StoreElement, ElementAccess, Operator::kNoRead, 3, 1, 0)          \
-  V(LoadTypedElement, ExternalArrayType, Operator::kNoWrite, 4, 1, 1) \
-  V(StoreTypedElement, ExternalArrayType, Operator::kNoRead, 5, 1, 0)
+#define ACCESS_OP_LIST(V)                                                \
+  V(LoadField, FieldAccess, Operator::kNoWrite, 1, 1, 1)                 \
+  V(StoreField, FieldAccess, Operator::kNoRead, 2, 1, 0)                 \
+  V(LoadElement, ElementAccess, Operator::kNoWrite, 2, 1, 1)             \
+  V(StoreElement, ElementAccess, Operator::kNoRead, 3, 1, 0)             \
+  V(LoadTypedElement, ExternalArrayType, Operator::kNoWrite, 4, 1, 1)    \
+  V(StoreTypedElement, ExternalArrayType, Operator::kNoRead, 5, 1, 0)    \
+  V(LoadDataViewElement, ExternalArrayType, Operator::kNoWrite, 4, 1, 1) \
+  V(StoreDataViewElement, ExternalArrayType, Operator::kNoRead, 5, 1, 0)
 
 #define ACCESS(Name, Type, properties, value_input_count, control_input_count, \
                output_count)                                                   \
@@ -1527,7 +1572,7 @@ const Operator* SimplifiedOperatorBuilder::TransitionAndStoreNumberElement(
 }
 
 const Operator* SimplifiedOperatorBuilder::TransitionAndStoreNonNumberElement(
-    Handle<Map> fast_map, Type* value_type) {
+    Handle<Map> fast_map, Type value_type) {
   TransitionAndStoreNonNumberElementParameters parameters(fast_map, value_type);
   return new (zone()) Operator1<TransitionAndStoreNonNumberElementParameters>(
       IrOpcode::kTransitionAndStoreNonNumberElement,
diff --git a/deps/v8/src/compiler/simplified-operator.h b/deps/v8/src/compiler/simplified-operator.h
index 300bdc85989c8e..1708b0e06e558d 100644
--- a/deps/v8/src/compiler/simplified-operator.h
+++ b/deps/v8/src/compiler/simplified-operator.h
@@ -23,6 +23,7 @@ namespace v8 {
 namespace internal {
 
 // Forward declarations.
+enum class AbortReason;
 class Zone;
 
 namespace compiler {
@@ -37,6 +38,10 @@ size_t hash_value(BaseTaggedness);
 
 std::ostream& operator<<(std::ostream&, BaseTaggedness);
 
+size_t hash_value(LoadSensitivity);
+
+std::ostream& operator<<(std::ostream&, LoadSensitivity);
+
 // An access descriptor for loads/stores of fixed structures like field
 // accesses of heap objects. Accesses from either tagged or untagged base
 // pointers are supported; untagging is done automatically during lowering.
@@ -45,27 +50,31 @@ struct FieldAccess {
   int offset;                     // offset of the field, without tag.
   MaybeHandle<Name> name;         // debugging only.
   MaybeHandle<Map> map;           // map of the field value (if known).
-  Type* type;                     // type of the field.
+  Type type;                      // type of the field.
   MachineType machine_type;       // machine type of the field.
   WriteBarrierKind write_barrier_kind;  // write barrier hint.
+  LoadSensitivity load_sensitivity;     // load safety for poisoning.
 
   FieldAccess()
       : base_is_tagged(kTaggedBase),
         offset(0),
         type(Type::None()),
         machine_type(MachineType::None()),
-        write_barrier_kind(kFullWriteBarrier) {}
+        write_barrier_kind(kFullWriteBarrier),
+        load_sensitivity(LoadSensitivity::kUnsafe) {}
 
   FieldAccess(BaseTaggedness base_is_tagged, int offset, MaybeHandle<Name> name,
-              MaybeHandle<Map> map, Type* type, MachineType machine_type,
-              WriteBarrierKind write_barrier_kind)
+              MaybeHandle<Map> map, Type type, MachineType machine_type,
+              WriteBarrierKind write_barrier_kind,
+              LoadSensitivity load_sensitivity = LoadSensitivity::kUnsafe)
       : base_is_tagged(base_is_tagged),
         offset(offset),
         name(name),
         map(map),
         type(type),
         machine_type(machine_type),
-        write_barrier_kind(write_barrier_kind) {}
+        write_barrier_kind(write_barrier_kind),
+        load_sensitivity(load_sensitivity) {}
 
   int tag() const { return base_is_tagged == kTaggedBase ? kHeapObjectTag : 0; }
 };
@@ -90,24 +99,28 @@ void Operator1<FieldAccess>::PrintParameter(std::ostream& os,
 struct ElementAccess {
   BaseTaggedness base_is_tagged;  // specifies if the base pointer is tagged.
   int header_size;                // size of the header, without tag.
-  Type* type;                     // type of the element.
+  Type type;                      // type of the element.
   MachineType machine_type;       // machine type of the element.
   WriteBarrierKind write_barrier_kind;  // write barrier hint.
+  LoadSensitivity load_sensitivity;     // load safety for poisoning.
 
   ElementAccess()
       : base_is_tagged(kTaggedBase),
         header_size(0),
         type(Type::None()),
         machine_type(MachineType::None()),
-        write_barrier_kind(kFullWriteBarrier) {}
+        write_barrier_kind(kFullWriteBarrier),
+        load_sensitivity(LoadSensitivity::kUnsafe) {}
 
-  ElementAccess(BaseTaggedness base_is_tagged, int header_size, Type* type,
-                MachineType machine_type, WriteBarrierKind write_barrier_kind)
+  ElementAccess(BaseTaggedness base_is_tagged, int header_size, Type type,
+                MachineType machine_type, WriteBarrierKind write_barrier_kind,
+                LoadSensitivity load_sensitivity = LoadSensitivity::kUnsafe)
       : base_is_tagged(base_is_tagged),
         header_size(header_size),
         type(type),
         machine_type(machine_type),
-        write_barrier_kind(write_barrier_kind) {}
+        write_barrier_kind(write_barrier_kind),
+        load_sensitivity(load_sensitivity) {}
 
   int tag() const { return base_is_tagged == kTaggedBase ? kHeapObjectTag : 0; }
 };
@@ -149,6 +162,29 @@ std::ostream& operator<<(std::ostream&, CheckParameters const&);
 
 CheckParameters const& CheckParametersOf(Operator const*) V8_WARN_UNUSED_RESULT;
 
+class CheckIfParameters final {
+ public:
+  explicit CheckIfParameters(DeoptimizeReason reason,
+                             const VectorSlotPair& feedback)
+      : reason_(reason), feedback_(feedback) {}
+
+  VectorSlotPair const& feedback() const { return feedback_; }
+  DeoptimizeReason reason() const { return reason_; }
+
+ private:
+  DeoptimizeReason reason_;
+  VectorSlotPair feedback_;
+};
+
+bool operator==(CheckIfParameters const&, CheckIfParameters const&);
+
+size_t hash_value(CheckIfParameters const&);
+
+std::ostream& operator<<(std::ostream&, CheckIfParameters const&);
+
+CheckIfParameters const& CheckIfParametersOf(Operator const*)
+    V8_WARN_UNUSED_RESULT;
+
 enum class CheckFloat64HoleMode : uint8_t {
   kNeverReturnHole,  // Never return the hole (deoptimize instead).
   kAllowReturnHole   // Allow to return the hole (signaling NaN).
@@ -370,7 +406,7 @@ Handle<Map> DoubleMapParameterOf(const Operator* op) V8_WARN_UNUSED_RESULT;
 Handle<Map> FastMapParameterOf(const Operator* op) V8_WARN_UNUSED_RESULT;
 
 // Parameters for TransitionAndStoreNonNumberElement.
-Type* ValueTypeParameterOf(const Operator* op) V8_WARN_UNUSED_RESULT;
+Type ValueTypeParameterOf(const Operator* op) V8_WARN_UNUSED_RESULT;
 
 // A hint for speculative number operations.
 enum class NumberOperationHint : uint8_t {
@@ -415,14 +451,14 @@ bool IsRestLengthOf(const Operator* op) V8_WARN_UNUSED_RESULT;
 
 class AllocateParameters {
  public:
-  AllocateParameters(Type* type, PretenureFlag pretenure)
+  AllocateParameters(Type type, PretenureFlag pretenure)
       : type_(type), pretenure_(pretenure) {}
 
-  Type* type() const { return type_; }
+  Type type() const { return type_; }
   PretenureFlag pretenure() const { return pretenure_; }
 
  private:
-  Type* type_;
+  Type type_;
   PretenureFlag pretenure_;
 };
 
@@ -436,7 +472,7 @@ bool operator==(AllocateParameters const&, AllocateParameters const&);
 
 PretenureFlag PretenureFlagOf(const Operator* op) V8_WARN_UNUSED_RESULT;
 
-Type* AllocateTypeOf(const Operator* op) V8_WARN_UNUSED_RESULT;
+Type AllocateTypeOf(const Operator* op) V8_WARN_UNUSED_RESULT;
 
 UnicodeEncoding UnicodeEncodingOf(const Operator*) V8_WARN_UNUSED_RESULT;
 
@@ -597,7 +633,7 @@ class V8_EXPORT_PRIVATE SimplifiedOperatorBuilder final
   const Operator* TruncateTaggedToBit();
   const Operator* TruncateTaggedPointerToBit();
 
-  const Operator* MaskIndexWithBound();
+  const Operator* PoisonIndex();
   const Operator* CompareMaps(ZoneHandleSet<Map>);
   const Operator* MapGuard(ZoneHandleSet<Map> maps);
 
@@ -606,7 +642,8 @@ class V8_EXPORT_PRIVATE SimplifiedOperatorBuilder final
   const Operator* CheckEqualsSymbol();
   const Operator* CheckFloat64Hole(CheckFloat64HoleMode);
   const Operator* CheckHeapObject();
-  const Operator* CheckIf(DeoptimizeReason deoptimize_reason);
+  const Operator* CheckIf(DeoptimizeReason deoptimize_reason,
+                          const VectorSlotPair& feedback = VectorSlotPair());
   const Operator* CheckInternalizedString();
   const Operator* CheckMaps(CheckMapsFlags, ZoneHandleSet<Map>,
                             const VectorSlotPair& = VectorSlotPair());
@@ -650,6 +687,7 @@ class V8_EXPORT_PRIVATE SimplifiedOperatorBuilder final
   const Operator* ObjectIsDetectableCallable();
   const Operator* ObjectIsMinusZero();
   const Operator* ObjectIsNaN();
+  const Operator* NumberIsNaN();
   const Operator* ObjectIsNonCallable();
   const Operator* ObjectIsNumber();
   const Operator* ObjectIsReceiver();
@@ -692,9 +730,8 @@ class V8_EXPORT_PRIVATE SimplifiedOperatorBuilder final
   // transition-elements-kind object, from-map, to-map
   const Operator* TransitionElementsKind(ElementsTransition transition);
 
-  const Operator* Allocate(Type* type, PretenureFlag pretenure = NOT_TENURED);
-  const Operator* AllocateRaw(Type* type,
-                              PretenureFlag pretenure = NOT_TENURED);
+  const Operator* Allocate(Type type, PretenureFlag pretenure = NOT_TENURED);
+  const Operator* AllocateRaw(Type type, PretenureFlag pretenure = NOT_TENURED);
 
   const Operator* LoadFieldByIndex();
   const Operator* LoadField(FieldAccess const&);
@@ -717,17 +754,25 @@ class V8_EXPORT_PRIVATE SimplifiedOperatorBuilder final
 
   // store-element [base + index], object value, only with fast arrays.
   const Operator* TransitionAndStoreNonNumberElement(Handle<Map> fast_map,
-                                                     Type* value_type);
+                                                     Type value_type);
 
   // load-typed-element buffer, [base + external + index]
   const Operator* LoadTypedElement(ExternalArrayType const&);
 
+  // load-data-view-element buffer, [base + index]
+  const Operator* LoadDataViewElement(ExternalArrayType const&);
+
   // store-typed-element buffer, [base + external + index], value
   const Operator* StoreTypedElement(ExternalArrayType const&);
 
+  // store-data-view-element buffer, [base + index], value
+  const Operator* StoreDataViewElement(ExternalArrayType const&);
+
   // Abort (for terminating execution on internal error).
   const Operator* RuntimeAbort(AbortReason reason);
 
+  const Operator* DateNow();
+
  private:
   Zone* zone() const { return zone_; }
 
diff --git a/deps/v8/src/compiler/store-store-elimination.cc b/deps/v8/src/compiler/store-store-elimination.cc
index 4679573f87229d..ce2c71a3d76ca1 100644
--- a/deps/v8/src/compiler/store-store-elimination.cc
+++ b/deps/v8/src/compiler/store-store-elimination.cc
@@ -147,6 +147,7 @@ class RedundantStoreFinder final {
   bool HasBeenVisited(Node* node);
 
   JSGraph* jsgraph() const { return jsgraph_; }
+  Isolate* isolate() { return jsgraph()->isolate(); }
   Zone* temp_zone() const { return temp_zone_; }
   ZoneVector<UnobservablesSet>& unobservable() { return unobservable_; }
   UnobservablesSet& unobservable_for_id(NodeId id) {
diff --git a/deps/v8/src/compiler/type-cache.h b/deps/v8/src/compiler/type-cache.h
index 093d9d041e0ac3..7a02c9a37cf004 100644
--- a/deps/v8/src/compiler/type-cache.h
+++ b/deps/v8/src/compiler/type-cache.h
@@ -25,146 +25,145 @@ class TypeCache final {
 
   TypeCache() : zone_(&allocator, ZONE_NAME) {}
 
-  Type* const kInt8 = CreateRange<int8_t>();
-  Type* const kUint8 = CreateRange<uint8_t>();
-  Type* const kUint8Clamped = kUint8;
-  Type* const kUint8OrMinusZeroOrNaN =
+  Type const kInt8 = CreateRange<int8_t>();
+  Type const kUint8 = CreateRange<uint8_t>();
+  Type const kUint8Clamped = kUint8;
+  Type const kUint8OrMinusZeroOrNaN =
       Type::Union(kUint8, Type::MinusZeroOrNaN(), zone());
-  Type* const kInt16 = CreateRange<int16_t>();
-  Type* const kUint16 = CreateRange<uint16_t>();
-  Type* const kInt32 = Type::Signed32();
-  Type* const kUint32 = Type::Unsigned32();
-  Type* const kFloat32 = Type::Number();
-  Type* const kFloat64 = Type::Number();
-  Type* const kBigInt64 = Type::BigInt();
-  Type* const kBigUint64 = Type::BigInt();
-
-  Type* const kHoleySmi =
-      Type::Union(Type::SignedSmall(), Type::Hole(), zone());
-
-  Type* const kSingletonZero = CreateRange(0.0, 0.0);
-  Type* const kSingletonOne = CreateRange(1.0, 1.0);
-  Type* const kSingletonTen = CreateRange(10.0, 10.0);
-  Type* const kSingletonMinusOne = CreateRange(-1.0, -1.0);
-  Type* const kZeroOrMinusZero =
+  Type const kInt16 = CreateRange<int16_t>();
+  Type const kUint16 = CreateRange<uint16_t>();
+  Type const kInt32 = Type::Signed32();
+  Type const kUint32 = Type::Unsigned32();
+  Type const kFloat32 = Type::Number();
+  Type const kFloat64 = Type::Number();
+  Type const kBigInt64 = Type::BigInt();
+  Type const kBigUint64 = Type::BigInt();
+
+  Type const kHoleySmi = Type::Union(Type::SignedSmall(), Type::Hole(), zone());
+
+  Type const kSingletonZero = CreateRange(0.0, 0.0);
+  Type const kSingletonOne = CreateRange(1.0, 1.0);
+  Type const kSingletonTen = CreateRange(10.0, 10.0);
+  Type const kSingletonMinusOne = CreateRange(-1.0, -1.0);
+  Type const kZeroOrMinusZero =
       Type::Union(kSingletonZero, Type::MinusZero(), zone());
-  Type* const kZeroOrUndefined =
+  Type const kZeroOrUndefined =
       Type::Union(kSingletonZero, Type::Undefined(), zone());
-  Type* const kTenOrUndefined =
+  Type const kTenOrUndefined =
       Type::Union(kSingletonTen, Type::Undefined(), zone());
-  Type* const kMinusOneOrZero = CreateRange(-1.0, 0.0);
-  Type* const kMinusOneToOneOrMinusZeroOrNaN = Type::Union(
+  Type const kMinusOneOrZero = CreateRange(-1.0, 0.0);
+  Type const kMinusOneToOneOrMinusZeroOrNaN = Type::Union(
       Type::Union(CreateRange(-1.0, 1.0), Type::MinusZero(), zone()),
       Type::NaN(), zone());
-  Type* const kZeroOrOne = CreateRange(0.0, 1.0);
-  Type* const kZeroOrOneOrNaN = Type::Union(kZeroOrOne, Type::NaN(), zone());
-  Type* const kZeroToThirtyOne = CreateRange(0.0, 31.0);
-  Type* const kZeroToThirtyTwo = CreateRange(0.0, 32.0);
-  Type* const kZeroish =
+  Type const kZeroOrOne = CreateRange(0.0, 1.0);
+  Type const kZeroOrOneOrNaN = Type::Union(kZeroOrOne, Type::NaN(), zone());
+  Type const kZeroToThirtyOne = CreateRange(0.0, 31.0);
+  Type const kZeroToThirtyTwo = CreateRange(0.0, 32.0);
+  Type const kZeroish =
       Type::Union(kSingletonZero, Type::MinusZeroOrNaN(), zone());
-  Type* const kInteger = CreateRange(-V8_INFINITY, V8_INFINITY);
-  Type* const kIntegerOrMinusZero =
+  Type const kInteger = CreateRange(-V8_INFINITY, V8_INFINITY);
+  Type const kIntegerOrMinusZero =
       Type::Union(kInteger, Type::MinusZero(), zone());
-  Type* const kIntegerOrMinusZeroOrNaN =
+  Type const kIntegerOrMinusZeroOrNaN =
       Type::Union(kIntegerOrMinusZero, Type::NaN(), zone());
-  Type* const kPositiveInteger = CreateRange(0.0, V8_INFINITY);
-  Type* const kPositiveIntegerOrMinusZero =
+  Type const kPositiveInteger = CreateRange(0.0, V8_INFINITY);
+  Type const kPositiveIntegerOrMinusZero =
       Type::Union(kPositiveInteger, Type::MinusZero(), zone());
-  Type* const kPositiveIntegerOrNaN =
+  Type const kPositiveIntegerOrNaN =
       Type::Union(kPositiveInteger, Type::NaN(), zone());
-  Type* const kPositiveIntegerOrMinusZeroOrNaN =
+  Type const kPositiveIntegerOrMinusZeroOrNaN =
       Type::Union(kPositiveIntegerOrMinusZero, Type::NaN(), zone());
 
-  Type* const kAdditiveSafeInteger =
+  Type const kAdditiveSafeInteger =
       CreateRange(-4503599627370496.0, 4503599627370496.0);
-  Type* const kSafeInteger = CreateRange(-kMaxSafeInteger, kMaxSafeInteger);
-  Type* const kAdditiveSafeIntegerOrMinusZero =
+  Type const kSafeInteger = CreateRange(-kMaxSafeInteger, kMaxSafeInteger);
+  Type const kAdditiveSafeIntegerOrMinusZero =
       Type::Union(kAdditiveSafeInteger, Type::MinusZero(), zone());
-  Type* const kSafeIntegerOrMinusZero =
+  Type const kSafeIntegerOrMinusZero =
       Type::Union(kSafeInteger, Type::MinusZero(), zone());
-  Type* const kPositiveSafeInteger = CreateRange(0.0, kMaxSafeInteger);
+  Type const kPositiveSafeInteger = CreateRange(0.0, kMaxSafeInteger);
 
   // The FixedArray::length property always containts a smi in the range
   // [0, FixedArray::kMaxLength].
-  Type* const kFixedArrayLengthType = CreateRange(0.0, FixedArray::kMaxLength);
+  Type const kFixedArrayLengthType = CreateRange(0.0, FixedArray::kMaxLength);
 
   // The FixedDoubleArray::length property always containts a smi in the range
   // [0, FixedDoubleArray::kMaxLength].
-  Type* const kFixedDoubleArrayLengthType =
+  Type const kFixedDoubleArrayLengthType =
       CreateRange(0.0, FixedDoubleArray::kMaxLength);
 
   // The JSArray::length property always contains a tagged number in the range
   // [0, kMaxUInt32].
-  Type* const kJSArrayLengthType = Type::Unsigned32();
+  Type const kJSArrayLengthType = Type::Unsigned32();
 
   // The JSTypedArray::length property always contains a tagged number in the
   // range [0, kMaxSmiValue].
-  Type* const kJSTypedArrayLengthType = Type::UnsignedSmall();
+  Type const kJSTypedArrayLengthType = Type::UnsignedSmall();
 
   // The String::length property always contains a smi in the range
   // [0, String::kMaxLength].
-  Type* const kStringLengthType = CreateRange(0.0, String::kMaxLength);
+  Type const kStringLengthType = CreateRange(0.0, String::kMaxLength);
 
   // A time value always contains a tagged number in the range
   // [-kMaxTimeInMs, kMaxTimeInMs].
-  Type* const kTimeValueType =
+  Type const kTimeValueType =
       CreateRange(-DateCache::kMaxTimeInMs, DateCache::kMaxTimeInMs);
 
   // The JSDate::day property always contains a tagged number in the range
   // [1, 31] or NaN.
-  Type* const kJSDateDayType =
+  Type const kJSDateDayType =
       Type::Union(CreateRange(1, 31.0), Type::NaN(), zone());
 
   // The JSDate::hour property always contains a tagged number in the range
   // [0, 23] or NaN.
-  Type* const kJSDateHourType =
+  Type const kJSDateHourType =
       Type::Union(CreateRange(0, 23.0), Type::NaN(), zone());
 
   // The JSDate::minute property always contains a tagged number in the range
   // [0, 59] or NaN.
-  Type* const kJSDateMinuteType =
+  Type const kJSDateMinuteType =
       Type::Union(CreateRange(0, 59.0), Type::NaN(), zone());
 
   // The JSDate::month property always contains a tagged number in the range
   // [0, 11] or NaN.
-  Type* const kJSDateMonthType =
+  Type const kJSDateMonthType =
       Type::Union(CreateRange(0, 11.0), Type::NaN(), zone());
 
   // The JSDate::second property always contains a tagged number in the range
   // [0, 59] or NaN.
-  Type* const kJSDateSecondType = kJSDateMinuteType;
+  Type const kJSDateSecondType = kJSDateMinuteType;
 
   // The JSDate::value property always contains a tagged number in the range
   // [-kMaxTimeInMs, kMaxTimeInMs] or NaN.
-  Type* const kJSDateValueType =
+  Type const kJSDateValueType =
       Type::Union(kTimeValueType, Type::NaN(), zone());
 
   // The JSDate::weekday property always contains a tagged number in the range
   // [0, 6] or NaN.
-  Type* const kJSDateWeekdayType =
+  Type const kJSDateWeekdayType =
       Type::Union(CreateRange(0, 6.0), Type::NaN(), zone());
 
   // The JSDate::year property always contains a tagged number in the signed
   // small range or NaN.
-  Type* const kJSDateYearType =
+  Type const kJSDateYearType =
       Type::Union(Type::SignedSmall(), Type::NaN(), zone());
 
   // The valid number of arguments for JavaScript functions.
-  Type* const kArgumentsLengthType =
+  Type const kArgumentsLengthType =
       Type::Range(0.0, Code::kMaxArguments, zone());
 
   // The JSArrayIterator::kind property always contains an integer in the
   // range [0, 2], representing the possible IterationKinds.
-  Type* const kJSArrayIteratorKindType = CreateRange(0.0, 2.0);
+  Type const kJSArrayIteratorKindType = CreateRange(0.0, 2.0);
 
  private:
   template <typename T>
-  Type* CreateRange() {
+  Type CreateRange() {
     return CreateRange(std::numeric_limits<T>::min(),
                        std::numeric_limits<T>::max());
   }
 
-  Type* CreateRange(double min, double max) {
+  Type CreateRange(double min, double max) {
     return Type::Range(min, max, zone());
   }
 
diff --git a/deps/v8/src/compiler/type-narrowing-reducer.cc b/deps/v8/src/compiler/type-narrowing-reducer.cc
new file mode 100644
index 00000000000000..1b8b5b4657a32d
--- /dev/null
+++ b/deps/v8/src/compiler/type-narrowing-reducer.cc
@@ -0,0 +1,88 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "src/compiler/type-narrowing-reducer.h"
+
+#include "src/compiler/js-graph.h"
+#include "src/objects-inl.h"
+
+namespace v8 {
+namespace internal {
+namespace compiler {
+
+TypeNarrowingReducer::TypeNarrowingReducer(Editor* editor, JSGraph* jsgraph,
+                                           const JSHeapBroker* js_heap_broker)
+    : AdvancedReducer(editor),
+      jsgraph_(jsgraph),
+      op_typer_(jsgraph->isolate(), js_heap_broker, zone()) {}
+
+TypeNarrowingReducer::~TypeNarrowingReducer() {}
+
+Reduction TypeNarrowingReducer::Reduce(Node* node) {
+  DisallowHeapAccess no_heap_access;
+
+  Type new_type = Type::Any();
+
+  switch (node->opcode()) {
+    case IrOpcode::kNumberLessThan: {
+      // TODO(turbofan) Reuse the logic from typer.cc (by integrating relational
+      // comparisons with the operation typer).
+      Type left_type = NodeProperties::GetType(node->InputAt(0));
+      Type right_type = NodeProperties::GetType(node->InputAt(1));
+      if (left_type.Is(Type::PlainNumber()) &&
+          right_type.Is(Type::PlainNumber())) {
+        if (left_type.Max() < right_type.Min()) {
+          new_type = op_typer_.singleton_true();
+        } else if (left_type.Min() >= right_type.Max()) {
+          new_type = op_typer_.singleton_false();
+        }
+      }
+      break;
+    }
+
+    case IrOpcode::kTypeGuard: {
+      new_type = op_typer_.TypeTypeGuard(
+          node->op(), NodeProperties::GetType(node->InputAt(0)));
+      break;
+    }
+
+#define DECLARE_CASE(Name)                                                \
+  case IrOpcode::k##Name: {                                               \
+    new_type = op_typer_.Name(NodeProperties::GetType(node->InputAt(0)),  \
+                              NodeProperties::GetType(node->InputAt(1))); \
+    break;                                                                \
+  }
+      SIMPLIFIED_NUMBER_BINOP_LIST(DECLARE_CASE)
+      DECLARE_CASE(SameValue)
+#undef DECLARE_CASE
+
+#define DECLARE_CASE(Name)                                                \
+  case IrOpcode::k##Name: {                                               \
+    new_type = op_typer_.Name(NodeProperties::GetType(node->InputAt(0))); \
+    break;                                                                \
+  }
+      SIMPLIFIED_NUMBER_UNOP_LIST(DECLARE_CASE)
+      DECLARE_CASE(ToBoolean)
+#undef DECLARE_CASE
+
+    default:
+      return NoChange();
+  }
+
+  Type original_type = NodeProperties::GetType(node);
+  Type restricted = Type::Intersect(new_type, original_type, zone());
+  if (!original_type.Is(restricted)) {
+    NodeProperties::SetType(node, restricted);
+    return Changed(node);
+  }
+  return NoChange();
+}
+
+Graph* TypeNarrowingReducer::graph() const { return jsgraph()->graph(); }
+
+Zone* TypeNarrowingReducer::zone() const { return graph()->zone(); }
+
+}  // namespace compiler
+}  // namespace internal
+}  // namespace v8
diff --git a/deps/v8/src/compiler/type-narrowing-reducer.h b/deps/v8/src/compiler/type-narrowing-reducer.h
new file mode 100644
index 00000000000000..77cb07e7722b8a
--- /dev/null
+++ b/deps/v8/src/compiler/type-narrowing-reducer.h
@@ -0,0 +1,45 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef V8_COMPILER_TYPE_NARROWING_REDUCER_H_
+#define V8_COMPILER_TYPE_NARROWING_REDUCER_H_
+
+#include "src/base/compiler-specific.h"
+#include "src/compiler/graph-reducer.h"
+#include "src/compiler/operation-typer.h"
+
+namespace v8 {
+namespace internal {
+namespace compiler {
+
+// Forward declarations.
+class JSGraph;
+
+class V8_EXPORT_PRIVATE TypeNarrowingReducer final
+    : public NON_EXPORTED_BASE(AdvancedReducer) {
+ public:
+  TypeNarrowingReducer(Editor* editor, JSGraph* jsgraph,
+                       const JSHeapBroker* js_heap_broker);
+  ~TypeNarrowingReducer() final;
+
+  const char* reducer_name() const override { return "TypeNarrowingReducer"; }
+
+  Reduction Reduce(Node* node) final;
+
+ private:
+  JSGraph* jsgraph() const { return jsgraph_; }
+  Graph* graph() const;
+  Zone* zone() const;
+
+  JSGraph* const jsgraph_;
+  OperationTyper op_typer_;
+
+  DISALLOW_COPY_AND_ASSIGN(TypeNarrowingReducer);
+};
+
+}  // namespace compiler
+}  // namespace internal
+}  // namespace v8
+
+#endif  // V8_COMPILER_TYPE_NARROWING_REDUCER_H_
diff --git a/deps/v8/src/compiler/typed-optimization.cc b/deps/v8/src/compiler/typed-optimization.cc
index 8cb2c666e6020e..14c850bf0e92b6 100644
--- a/deps/v8/src/compiler/typed-optimization.cc
+++ b/deps/v8/src/compiler/typed-optimization.cc
@@ -4,8 +4,10 @@
 
 #include "src/compiler/typed-optimization.h"
 
-#include "src/compilation-dependencies.h"
+#include "src/base/optional.h"
+#include "src/compiler/compilation-dependencies.h"
 #include "src/compiler/js-graph.h"
+#include "src/compiler/js-heap-broker.h"
 #include "src/compiler/node-matchers.h"
 #include "src/compiler/node-properties.h"
 #include "src/compiler/simplified-operator.h"
@@ -18,61 +20,22 @@ namespace compiler {
 
 TypedOptimization::TypedOptimization(Editor* editor,
                                      CompilationDependencies* dependencies,
-                                     JSGraph* jsgraph)
+                                     JSGraph* jsgraph,
+                                     const JSHeapBroker* js_heap_broker)
     : AdvancedReducer(editor),
       dependencies_(dependencies),
       jsgraph_(jsgraph),
-      true_type_(Type::HeapConstant(factory()->true_value(), graph()->zone())),
-      false_type_(
-          Type::HeapConstant(factory()->false_value(), graph()->zone())),
+      js_heap_broker_(js_heap_broker),
+      true_type_(Type::HeapConstant(js_heap_broker, factory()->true_value(),
+                                    graph()->zone())),
+      false_type_(Type::HeapConstant(js_heap_broker, factory()->false_value(),
+                                     graph()->zone())),
       type_cache_(TypeCache::Get()) {}
 
 TypedOptimization::~TypedOptimization() {}
 
 Reduction TypedOptimization::Reduce(Node* node) {
-  // Check if the output type is a singleton.  In that case we already know the
-  // result value and can simply replace the node if it's eliminable.
-  if (!NodeProperties::IsConstant(node) && NodeProperties::IsTyped(node) &&
-      node->op()->HasProperty(Operator::kEliminatable)) {
-    // TODO(v8:5303): We must not eliminate FinishRegion here. This special
-    // case can be removed once we have separate operators for value and
-    // effect regions.
-    if (node->opcode() == IrOpcode::kFinishRegion) return NoChange();
-    // We can only constant-fold nodes here, that are known to not cause any
-    // side-effect, may it be a JavaScript observable side-effect or a possible
-    // eager deoptimization exit (i.e. {node} has an operator that doesn't have
-    // the Operator::kNoDeopt property).
-    Type* upper = NodeProperties::GetType(node);
-    if (!upper->IsNone()) {
-      if (upper->IsHeapConstant()) {
-        Node* replacement =
-            jsgraph()->Constant(upper->AsHeapConstant()->Value());
-        ReplaceWithValue(node, replacement);
-        return Changed(replacement);
-      } else if (upper->Is(Type::MinusZero())) {
-        Node* replacement = jsgraph()->Constant(factory()->minus_zero_value());
-        ReplaceWithValue(node, replacement);
-        return Changed(replacement);
-      } else if (upper->Is(Type::NaN())) {
-        Node* replacement = jsgraph()->NaNConstant();
-        ReplaceWithValue(node, replacement);
-        return Changed(replacement);
-      } else if (upper->Is(Type::Null())) {
-        Node* replacement = jsgraph()->NullConstant();
-        ReplaceWithValue(node, replacement);
-        return Changed(replacement);
-      } else if (upper->Is(Type::PlainNumber()) &&
-                 upper->Min() == upper->Max()) {
-        Node* replacement = jsgraph()->Constant(upper->Min());
-        ReplaceWithValue(node, replacement);
-        return Changed(replacement);
-      } else if (upper->Is(Type::Undefined())) {
-        Node* replacement = jsgraph()->UndefinedConstant();
-        ReplaceWithValue(node, replacement);
-        return Changed(replacement);
-      }
-    }
-  }
+  DisallowHeapAccess no_heap_access;
   switch (node->opcode()) {
     case IrOpcode::kConvertReceiver:
       return ReduceConvertReceiver(node);
@@ -126,24 +89,26 @@ Reduction TypedOptimization::Reduce(Node* node) {
 
 namespace {
 
-MaybeHandle<Map> GetStableMapFromObjectType(Type* object_type) {
-  if (object_type->IsHeapConstant()) {
-    Handle<Map> object_map(object_type->AsHeapConstant()->Value()->map());
-    if (object_map->is_stable()) return object_map;
+base::Optional<MapRef> GetStableMapFromObjectType(
+    const JSHeapBroker* js_heap_broker, Type object_type) {
+  if (object_type.IsHeapConstant()) {
+    HeapObjectRef object = object_type.AsHeapConstant()->Ref();
+    MapRef object_map = object.map(js_heap_broker);
+    if (object_map.is_stable()) return object_map;
   }
-  return MaybeHandle<Map>();
+  return {};
 }
 
 }  // namespace
 
 Reduction TypedOptimization::ReduceConvertReceiver(Node* node) {
   Node* const value = NodeProperties::GetValueInput(node, 0);
-  Type* const value_type = NodeProperties::GetType(value);
+  Type const value_type = NodeProperties::GetType(value);
   Node* const global_proxy = NodeProperties::GetValueInput(node, 1);
-  if (value_type->Is(Type::Receiver())) {
+  if (value_type.Is(Type::Receiver())) {
     ReplaceWithValue(node, value);
     return Replace(value);
-  } else if (value_type->Is(Type::NullOrUndefined())) {
+  } else if (value_type.Is(Type::NullOrUndefined())) {
     ReplaceWithValue(node, global_proxy);
     return Replace(global_proxy);
   }
@@ -152,8 +117,8 @@ Reduction TypedOptimization::ReduceConvertReceiver(Node* node) {
 
 Reduction TypedOptimization::ReduceCheckHeapObject(Node* node) {
   Node* const input = NodeProperties::GetValueInput(node, 0);
-  Type* const input_type = NodeProperties::GetType(input);
-  if (!input_type->Maybe(Type::SignedSmall())) {
+  Type const input_type = NodeProperties::GetType(input);
+  if (!input_type.Maybe(Type::SignedSmall())) {
     ReplaceWithValue(node, input);
     return Replace(input);
   }
@@ -162,8 +127,8 @@ Reduction TypedOptimization::ReduceCheckHeapObject(Node* node) {
 
 Reduction TypedOptimization::ReduceCheckNotTaggedHole(Node* node) {
   Node* const input = NodeProperties::GetValueInput(node, 0);
-  Type* const input_type = NodeProperties::GetType(input);
-  if (!input_type->Maybe(Type::Hole())) {
+  Type const input_type = NodeProperties::GetType(input);
+  if (!input_type.Maybe(Type::Hole())) {
     ReplaceWithValue(node, input);
     return Replace(input);
   }
@@ -177,17 +142,18 @@ Reduction TypedOptimization::ReduceCheckMaps(Node* node) {
   //  (2) we can add a code dependency on the stability of map
   //      (to guard the Constant type information).
   Node* const object = NodeProperties::GetValueInput(node, 0);
-  Type* const object_type = NodeProperties::GetType(object);
+  Type const object_type = NodeProperties::GetType(object);
   Node* const effect = NodeProperties::GetEffectInput(node);
-  Handle<Map> object_map;
-  if (GetStableMapFromObjectType(object_type).ToHandle(&object_map)) {
+  base::Optional<MapRef> object_map =
+      GetStableMapFromObjectType(js_heap_broker(), object_type);
+  if (object_map.has_value()) {
     for (int i = 1; i < node->op()->ValueInputCount(); ++i) {
       Node* const map = NodeProperties::GetValueInput(node, i);
-      Type* const map_type = NodeProperties::GetType(map);
-      if (map_type->IsHeapConstant() &&
-          map_type->AsHeapConstant()->Value().is_identical_to(object_map)) {
+      Type const map_type = NodeProperties::GetType(map);
+      if (map_type.IsHeapConstant() &&
+          map_type.AsHeapConstant()->Ref().equals(*object_map)) {
         if (object_map->CanTransition()) {
-          dependencies()->AssumeMapStable(object_map);
+          object_map->DependOnStableMap(js_heap_broker(), dependencies());
         }
         return Replace(effect);
       }
@@ -198,8 +164,8 @@ Reduction TypedOptimization::ReduceCheckMaps(Node* node) {
 
 Reduction TypedOptimization::ReduceCheckNumber(Node* node) {
   Node* const input = NodeProperties::GetValueInput(node, 0);
-  Type* const input_type = NodeProperties::GetType(input);
-  if (input_type->Is(Type::Number())) {
+  Type const input_type = NodeProperties::GetType(input);
+  if (input_type.Is(Type::Number())) {
     ReplaceWithValue(node, input);
     return Replace(input);
   }
@@ -208,8 +174,8 @@ Reduction TypedOptimization::ReduceCheckNumber(Node* node) {
 
 Reduction TypedOptimization::ReduceCheckString(Node* node) {
   Node* const input = NodeProperties::GetValueInput(node, 0);
-  Type* const input_type = NodeProperties::GetType(input);
-  if (input_type->Is(Type::String())) {
+  Type const input_type = NodeProperties::GetType(input);
+  if (input_type.Is(Type::String())) {
     ReplaceWithValue(node, input);
     return Replace(input);
   }
@@ -218,11 +184,11 @@ Reduction TypedOptimization::ReduceCheckString(Node* node) {
 
 Reduction TypedOptimization::ReduceCheckEqualsInternalizedString(Node* node) {
   Node* const exp = NodeProperties::GetValueInput(node, 0);
-  Type* const exp_type = NodeProperties::GetType(exp);
+  Type const exp_type = NodeProperties::GetType(exp);
   Node* const val = NodeProperties::GetValueInput(node, 1);
-  Type* const val_type = NodeProperties::GetType(val);
+  Type const val_type = NodeProperties::GetType(val);
   Node* const effect = NodeProperties::GetEffectInput(node);
-  if (val_type->Is(exp_type)) return Replace(effect);
+  if (val_type.Is(exp_type)) return Replace(effect);
   // TODO(turbofan): Should we also try to optimize the
   // non-internalized String case for {val} here?
   return NoChange();
@@ -230,17 +196,17 @@ Reduction TypedOptimization::ReduceCheckEqualsInternalizedString(Node* node) {
 
 Reduction TypedOptimization::ReduceCheckEqualsSymbol(Node* node) {
   Node* const exp = NodeProperties::GetValueInput(node, 0);
-  Type* const exp_type = NodeProperties::GetType(exp);
+  Type const exp_type = NodeProperties::GetType(exp);
   Node* const val = NodeProperties::GetValueInput(node, 1);
-  Type* const val_type = NodeProperties::GetType(val);
+  Type const val_type = NodeProperties::GetType(val);
   Node* const effect = NodeProperties::GetEffectInput(node);
-  if (val_type->Is(exp_type)) return Replace(effect);
+  if (val_type.Is(exp_type)) return Replace(effect);
   return NoChange();
 }
 
 Reduction TypedOptimization::ReduceLoadField(Node* node) {
   Node* const object = NodeProperties::GetValueInput(node, 0);
-  Type* const object_type = NodeProperties::GetType(object);
+  Type const object_type = NodeProperties::GetType(object);
   FieldAccess const& access = FieldAccessOf(node->op());
   if (access.base_is_tagged == kTaggedBase &&
       access.offset == HeapObject::kMapOffset) {
@@ -249,12 +215,13 @@ Reduction TypedOptimization::ReduceLoadField(Node* node) {
     //  (1) map cannot transition further, or
     //  (2) deoptimization is enabled and we can add a code dependency on the
     //      stability of map (to guard the Constant type information).
-    Handle<Map> object_map;
-    if (GetStableMapFromObjectType(object_type).ToHandle(&object_map)) {
+    base::Optional<MapRef> object_map =
+        GetStableMapFromObjectType(js_heap_broker(), object_type);
+    if (object_map.has_value()) {
       if (object_map->CanTransition()) {
-        dependencies()->AssumeMapStable(object_map);
+        object_map->DependOnStableMap(js_heap_broker(), dependencies());
       }
-      Node* const value = jsgraph()->HeapConstant(object_map);
+      Node* const value = jsgraph()->Constant(js_heap_broker(), *object_map);
       ReplaceWithValue(node, value);
       return Replace(value);
     }
@@ -264,18 +231,18 @@ Reduction TypedOptimization::ReduceLoadField(Node* node) {
 
 Reduction TypedOptimization::ReduceNumberFloor(Node* node) {
   Node* const input = NodeProperties::GetValueInput(node, 0);
-  Type* const input_type = NodeProperties::GetType(input);
-  if (input_type->Is(type_cache_.kIntegerOrMinusZeroOrNaN)) {
+  Type const input_type = NodeProperties::GetType(input);
+  if (input_type.Is(type_cache_.kIntegerOrMinusZeroOrNaN)) {
     return Replace(input);
   }
-  if (input_type->Is(Type::PlainNumber()) &&
+  if (input_type.Is(Type::PlainNumber()) &&
       (input->opcode() == IrOpcode::kNumberDivide ||
        input->opcode() == IrOpcode::kSpeculativeNumberDivide)) {
     Node* const lhs = NodeProperties::GetValueInput(input, 0);
-    Type* const lhs_type = NodeProperties::GetType(lhs);
+    Type const lhs_type = NodeProperties::GetType(lhs);
     Node* const rhs = NodeProperties::GetValueInput(input, 1);
-    Type* const rhs_type = NodeProperties::GetType(rhs);
-    if (lhs_type->Is(Type::Unsigned32()) && rhs_type->Is(Type::Unsigned32())) {
+    Type const rhs_type = NodeProperties::GetType(rhs);
+    if (lhs_type.Is(Type::Unsigned32()) && rhs_type.Is(Type::Unsigned32())) {
       // We can replace
       //
       //   NumberFloor(NumberDivide(lhs: unsigned32,
@@ -285,12 +252,13 @@ Reduction TypedOptimization::ReduceNumberFloor(Node* node) {
       //
       //   NumberToUint32(NumberDivide(lhs, rhs))
       //
-      // and just smash the type of the {lhs} on the {node},
-      // as the truncated result must be in the same range as
-      // {lhs} since {rhs} cannot be less than 1 (due to the
+      // and just smash the type [0...lhs.Max] on the {node},
+      // as the truncated result must be loewr than {lhs}'s maximum
+      // value (note that {rhs} cannot be less than 1 due to the
       // plain-number type constraint on the {node}).
       NodeProperties::ChangeOp(node, simplified()->NumberToUint32());
-      NodeProperties::SetType(node, lhs_type);
+      NodeProperties::SetType(node,
+                              Type::Range(0, lhs_type.Max(), graph()->zone()));
       return Changed(node);
     }
   }
@@ -299,8 +267,8 @@ Reduction TypedOptimization::ReduceNumberFloor(Node* node) {
 
 Reduction TypedOptimization::ReduceNumberRoundop(Node* node) {
   Node* const input = NodeProperties::GetValueInput(node, 0);
-  Type* const input_type = NodeProperties::GetType(input);
-  if (input_type->Is(type_cache_.kIntegerOrMinusZeroOrNaN)) {
+  Type const input_type = NodeProperties::GetType(input);
+  if (input_type.Is(type_cache_.kIntegerOrMinusZeroOrNaN)) {
     return Replace(input);
   }
   return NoChange();
@@ -308,8 +276,8 @@ Reduction TypedOptimization::ReduceNumberRoundop(Node* node) {
 
 Reduction TypedOptimization::ReduceNumberToUint8Clamped(Node* node) {
   Node* const input = NodeProperties::GetValueInput(node, 0);
-  Type* const input_type = NodeProperties::GetType(input);
-  if (input_type->Is(type_cache_.kUint8)) {
+  Type const input_type = NodeProperties::GetType(input);
+  if (input_type.Is(type_cache_.kUint8)) {
     return Replace(input);
   }
   return NoChange();
@@ -321,13 +289,13 @@ Reduction TypedOptimization::ReducePhi(Node* node) {
   // precise type than the JSAdd that was in the graph when the Typer was run.
   DCHECK_EQ(IrOpcode::kPhi, node->opcode());
   int arity = node->op()->ValueInputCount();
-  Type* type = NodeProperties::GetType(node->InputAt(0));
+  Type type = NodeProperties::GetType(node->InputAt(0));
   for (int i = 1; i < arity; ++i) {
     type = Type::Union(type, NodeProperties::GetType(node->InputAt(i)),
                        graph()->zone());
   }
-  Type* const node_type = NodeProperties::GetType(node);
-  if (!node_type->Is(type)) {
+  Type const node_type = NodeProperties::GetType(node);
+  if (!node_type.Is(type)) {
     type = Type::Intersect(node_type, type, graph()->zone());
     NodeProperties::SetType(node, type);
     return Changed(node);
@@ -339,13 +307,13 @@ Reduction TypedOptimization::ReduceReferenceEqual(Node* node) {
   DCHECK_EQ(IrOpcode::kReferenceEqual, node->opcode());
   Node* const lhs = NodeProperties::GetValueInput(node, 0);
   Node* const rhs = NodeProperties::GetValueInput(node, 1);
-  Type* const lhs_type = NodeProperties::GetType(lhs);
-  Type* const rhs_type = NodeProperties::GetType(rhs);
-  if (!lhs_type->Maybe(rhs_type)) {
+  Type const lhs_type = NodeProperties::GetType(lhs);
+  Type const rhs_type = NodeProperties::GetType(rhs);
+  if (!lhs_type.Maybe(rhs_type)) {
     Node* replacement = jsgraph()->FalseConstant();
     // Make sure we do not widen the type.
     if (NodeProperties::GetType(replacement)
-            ->Is(NodeProperties::GetType(node))) {
+            .Is(NodeProperties::GetType(node))) {
       return Replace(jsgraph()->FalseConstant());
     }
   }
@@ -368,10 +336,10 @@ const Operator* TypedOptimization::NumberComparisonFor(const Operator* op) {
 
 Reduction TypedOptimization::
     TryReduceStringComparisonOfStringFromSingleCharCodeToConstant(
-        Node* comparison, Handle<String> string, bool inverted) {
+        Node* comparison, const StringRef& string, bool inverted) {
   switch (comparison->opcode()) {
     case IrOpcode::kStringEqual:
-      if (string->length() != 1) {
+      if (string.length() != 1) {
         // String.fromCharCode(x) always has length 1.
         return Replace(jsgraph()->BooleanConstant(false));
       }
@@ -379,7 +347,7 @@ Reduction TypedOptimization::
     case IrOpcode::kStringLessThan:
       V8_FALLTHROUGH;
     case IrOpcode::kStringLessThanOrEqual:
-      if (string->length() == 0) {
+      if (string.length() == 0) {
         // String.fromCharCode(x) <= "" is always false,
         // "" < String.fromCharCode(x) is always true.
         return Replace(jsgraph()->BooleanConstant(inverted));
@@ -396,11 +364,14 @@ Reduction TypedOptimization::
 // and {constant} {comparison} String.fromCharCode(x) if inverted is true.
 Reduction
 TypedOptimization::TryReduceStringComparisonOfStringFromSingleCharCode(
-    Node* comparison, Node* from_char_code, Node* constant, bool inverted) {
+    Node* comparison, Node* from_char_code, Type constant_type, bool inverted) {
   DCHECK_EQ(IrOpcode::kStringFromSingleCharCode, from_char_code->opcode());
-  HeapObjectMatcher m(constant);
-  if (!m.HasValue() || !m.Value()->IsString()) return NoChange();
-  Handle<String> string = Handle<String>::cast(m.Value());
+
+  if (!constant_type.IsHeapConstant()) return NoChange();
+  ObjectRef constant = constant_type.AsHeapConstant()->Ref();
+
+  if (!constant.IsString()) return NoChange();
+  StringRef string = constant.AsString();
 
   // Check if comparison can be resolved statically.
   Reduction red = TryReduceStringComparisonOfStringFromSingleCharCodeToConstant(
@@ -409,8 +380,8 @@ TypedOptimization::TryReduceStringComparisonOfStringFromSingleCharCode(
 
   const Operator* comparison_op = NumberComparisonFor(comparison->op());
   Node* from_char_code_repl = NodeProperties::GetValueInput(from_char_code, 0);
-  Type* from_char_code_repl_type = NodeProperties::GetType(from_char_code_repl);
-  if (!from_char_code_repl_type->Is(type_cache_.kUint16)) {
+  Type from_char_code_repl_type = NodeProperties::GetType(from_char_code_repl);
+  if (!from_char_code_repl_type.Is(type_cache_.kUint16)) {
     // Convert to signed int32 to satisfy type of {NumberBitwiseAnd}.
     from_char_code_repl =
         graph()->NewNode(simplified()->NumberToInt32(), from_char_code_repl);
@@ -418,12 +389,12 @@ TypedOptimization::TryReduceStringComparisonOfStringFromSingleCharCode(
         simplified()->NumberBitwiseAnd(), from_char_code_repl,
         jsgraph()->Constant(std::numeric_limits<uint16_t>::max()));
   }
-  Node* constant_repl = jsgraph()->Constant(string->Get(0));
+  Node* constant_repl = jsgraph()->Constant(string.GetFirstChar());
 
   Node* number_comparison = nullptr;
   if (inverted) {
     // "x..." <= String.fromCharCode(z) is true if x < z.
-    if (string->length() > 1 &&
+    if (string.length() > 1 &&
         comparison->opcode() == IrOpcode::kStringLessThanOrEqual) {
       comparison_op = simplified()->NumberLessThan();
     }
@@ -431,7 +402,7 @@ TypedOptimization::TryReduceStringComparisonOfStringFromSingleCharCode(
         graph()->NewNode(comparison_op, constant_repl, from_char_code_repl);
   } else {
     // String.fromCharCode(z) < "x..." is true if z <= x.
-    if (string->length() > 1 &&
+    if (string.length() > 1 &&
         comparison->opcode() == IrOpcode::kStringLessThan) {
       comparison_op = simplified()->NumberLessThanOrEqual();
     }
@@ -448,20 +419,22 @@ Reduction TypedOptimization::ReduceStringComparison(Node* node) {
          IrOpcode::kStringLessThanOrEqual == node->opcode());
   Node* const lhs = NodeProperties::GetValueInput(node, 0);
   Node* const rhs = NodeProperties::GetValueInput(node, 1);
+  Type lhs_type = NodeProperties::GetType(lhs);
+  Type rhs_type = NodeProperties::GetType(rhs);
   if (lhs->opcode() == IrOpcode::kStringFromSingleCharCode) {
     if (rhs->opcode() == IrOpcode::kStringFromSingleCharCode) {
       Node* left = NodeProperties::GetValueInput(lhs, 0);
       Node* right = NodeProperties::GetValueInput(rhs, 0);
-      Type* left_type = NodeProperties::GetType(left);
-      Type* right_type = NodeProperties::GetType(right);
-      if (!left_type->Is(type_cache_.kUint16)) {
+      Type left_type = NodeProperties::GetType(left);
+      Type right_type = NodeProperties::GetType(right);
+      if (!left_type.Is(type_cache_.kUint16)) {
         // Convert to signed int32 to satisfy type of {NumberBitwiseAnd}.
         left = graph()->NewNode(simplified()->NumberToInt32(), left);
         left = graph()->NewNode(
             simplified()->NumberBitwiseAnd(), left,
             jsgraph()->Constant(std::numeric_limits<uint16_t>::max()));
       }
-      if (!right_type->Is(type_cache_.kUint16)) {
+      if (!right_type.Is(type_cache_.kUint16)) {
         // Convert to signed int32 to satisfy type of {NumberBitwiseAnd}.
         right = graph()->NewNode(simplified()->NumberToInt32(), right);
         right = graph()->NewNode(
@@ -473,12 +446,12 @@ Reduction TypedOptimization::ReduceStringComparison(Node* node) {
       ReplaceWithValue(node, equal);
       return Replace(equal);
     } else {
-      return TryReduceStringComparisonOfStringFromSingleCharCode(node, lhs, rhs,
-                                                                 false);
+      return TryReduceStringComparisonOfStringFromSingleCharCode(
+          node, lhs, rhs_type, false);
     }
   } else if (rhs->opcode() == IrOpcode::kStringFromSingleCharCode) {
-    return TryReduceStringComparisonOfStringFromSingleCharCode(node, rhs, lhs,
-                                                               true);
+    return TryReduceStringComparisonOfStringFromSingleCharCode(node, rhs,
+                                                               lhs_type, true);
   }
   return NoChange();
 }
@@ -487,41 +460,41 @@ Reduction TypedOptimization::ReduceSameValue(Node* node) {
   DCHECK_EQ(IrOpcode::kSameValue, node->opcode());
   Node* const lhs = NodeProperties::GetValueInput(node, 0);
   Node* const rhs = NodeProperties::GetValueInput(node, 1);
-  Type* const lhs_type = NodeProperties::GetType(lhs);
-  Type* const rhs_type = NodeProperties::GetType(rhs);
+  Type const lhs_type = NodeProperties::GetType(lhs);
+  Type const rhs_type = NodeProperties::GetType(rhs);
   if (lhs == rhs) {
     // SameValue(x,x) => #true
     return Replace(jsgraph()->TrueConstant());
-  } else if (lhs_type->Is(Type::Unique()) && rhs_type->Is(Type::Unique())) {
+  } else if (lhs_type.Is(Type::Unique()) && rhs_type.Is(Type::Unique())) {
     // SameValue(x:unique,y:unique) => ReferenceEqual(x,y)
     NodeProperties::ChangeOp(node, simplified()->ReferenceEqual());
     return Changed(node);
-  } else if (lhs_type->Is(Type::String()) && rhs_type->Is(Type::String())) {
+  } else if (lhs_type.Is(Type::String()) && rhs_type.Is(Type::String())) {
     // SameValue(x:string,y:string) => StringEqual(x,y)
     NodeProperties::ChangeOp(node, simplified()->StringEqual());
     return Changed(node);
-  } else if (lhs_type->Is(Type::MinusZero())) {
+  } else if (lhs_type.Is(Type::MinusZero())) {
     // SameValue(x:minus-zero,y) => ObjectIsMinusZero(y)
     node->RemoveInput(0);
     NodeProperties::ChangeOp(node, simplified()->ObjectIsMinusZero());
     return Changed(node);
-  } else if (rhs_type->Is(Type::MinusZero())) {
+  } else if (rhs_type.Is(Type::MinusZero())) {
     // SameValue(x,y:minus-zero) => ObjectIsMinusZero(x)
     node->RemoveInput(1);
     NodeProperties::ChangeOp(node, simplified()->ObjectIsMinusZero());
     return Changed(node);
-  } else if (lhs_type->Is(Type::NaN())) {
+  } else if (lhs_type.Is(Type::NaN())) {
     // SameValue(x:nan,y) => ObjectIsNaN(y)
     node->RemoveInput(0);
     NodeProperties::ChangeOp(node, simplified()->ObjectIsNaN());
     return Changed(node);
-  } else if (rhs_type->Is(Type::NaN())) {
+  } else if (rhs_type.Is(Type::NaN())) {
     // SameValue(x,y:nan) => ObjectIsNaN(x)
     node->RemoveInput(1);
     NodeProperties::ChangeOp(node, simplified()->ObjectIsNaN());
     return Changed(node);
-  } else if (lhs_type->Is(Type::PlainNumber()) &&
-             rhs_type->Is(Type::PlainNumber())) {
+  } else if (lhs_type.Is(Type::PlainNumber()) &&
+             rhs_type.Is(Type::PlainNumber())) {
     // SameValue(x:plain-number,y:plain-number) => NumberEqual(x,y)
     NodeProperties::ChangeOp(node, simplified()->NumberEqual());
     return Changed(node);
@@ -532,24 +505,24 @@ Reduction TypedOptimization::ReduceSameValue(Node* node) {
 Reduction TypedOptimization::ReduceSelect(Node* node) {
   DCHECK_EQ(IrOpcode::kSelect, node->opcode());
   Node* const condition = NodeProperties::GetValueInput(node, 0);
-  Type* const condition_type = NodeProperties::GetType(condition);
+  Type const condition_type = NodeProperties::GetType(condition);
   Node* const vtrue = NodeProperties::GetValueInput(node, 1);
-  Type* const vtrue_type = NodeProperties::GetType(vtrue);
+  Type const vtrue_type = NodeProperties::GetType(vtrue);
   Node* const vfalse = NodeProperties::GetValueInput(node, 2);
-  Type* const vfalse_type = NodeProperties::GetType(vfalse);
-  if (condition_type->Is(true_type_)) {
+  Type const vfalse_type = NodeProperties::GetType(vfalse);
+  if (condition_type.Is(true_type_)) {
     // Select(condition:true, vtrue, vfalse) => vtrue
     return Replace(vtrue);
   }
-  if (condition_type->Is(false_type_)) {
+  if (condition_type.Is(false_type_)) {
     // Select(condition:false, vtrue, vfalse) => vfalse
     return Replace(vfalse);
   }
-  if (vtrue_type->Is(true_type_) && vfalse_type->Is(false_type_)) {
+  if (vtrue_type.Is(true_type_) && vfalse_type.Is(false_type_)) {
     // Select(condition, vtrue:true, vfalse:false) => condition
     return Replace(condition);
   }
-  if (vtrue_type->Is(false_type_) && vfalse_type->Is(true_type_)) {
+  if (vtrue_type.Is(false_type_) && vfalse_type.Is(true_type_)) {
     // Select(condition, vtrue:false, vfalse:true) => BooleanNot(condition)
     node->TrimInputCount(1);
     NodeProperties::ChangeOp(node, simplified()->BooleanNot());
@@ -557,9 +530,9 @@ Reduction TypedOptimization::ReduceSelect(Node* node) {
   }
   // Try to narrow the type of the Select {node}, which might be more precise
   // now after lowering based on types.
-  Type* type = Type::Union(vtrue_type, vfalse_type, graph()->zone());
-  Type* const node_type = NodeProperties::GetType(node);
-  if (!node_type->Is(type)) {
+  Type type = Type::Union(vtrue_type, vfalse_type, graph()->zone());
+  Type const node_type = NodeProperties::GetType(node);
+  if (!node_type.Is(type)) {
     type = Type::Intersect(node_type, type, graph()->zone());
     NodeProperties::SetType(node, type);
     return Changed(node);
@@ -570,8 +543,8 @@ Reduction TypedOptimization::ReduceSelect(Node* node) {
 Reduction TypedOptimization::ReduceSpeculativeToNumber(Node* node) {
   DCHECK_EQ(IrOpcode::kSpeculativeToNumber, node->opcode());
   Node* const input = NodeProperties::GetValueInput(node, 0);
-  Type* const input_type = NodeProperties::GetType(input);
-  if (input_type->Is(Type::Number())) {
+  Type const input_type = NodeProperties::GetType(input);
+  if (input_type.Is(Type::Number())) {
     // SpeculativeToNumber(x:number) => x
     ReplaceWithValue(node, input);
     return Replace(input);
@@ -581,51 +554,59 @@ Reduction TypedOptimization::ReduceSpeculativeToNumber(Node* node) {
 
 Reduction TypedOptimization::ReduceTypeOf(Node* node) {
   Node* const input = node->InputAt(0);
-  Type* const type = NodeProperties::GetType(input);
+  Type const type = NodeProperties::GetType(input);
   Factory* const f = factory();
-  if (type->Is(Type::Boolean())) {
-    return Replace(jsgraph()->Constant(f->boolean_string()));
-  } else if (type->Is(Type::Number())) {
-    return Replace(jsgraph()->Constant(f->number_string()));
-  } else if (type->Is(Type::String())) {
-    return Replace(jsgraph()->Constant(f->string_string()));
-  } else if (type->Is(Type::BigInt())) {
-    return Replace(jsgraph()->Constant(f->bigint_string()));
-  } else if (type->Is(Type::Symbol())) {
-    return Replace(jsgraph()->Constant(f->symbol_string()));
-  } else if (type->Is(Type::OtherUndetectableOrUndefined())) {
-    return Replace(jsgraph()->Constant(f->undefined_string()));
-  } else if (type->Is(Type::NonCallableOrNull())) {
-    return Replace(jsgraph()->Constant(f->object_string()));
-  } else if (type->Is(Type::Function())) {
-    return Replace(jsgraph()->Constant(f->function_string()));
-  } else if (type->IsHeapConstant()) {
+  if (type.Is(Type::Boolean())) {
+    return Replace(
+        jsgraph()->Constant(js_heap_broker(), ObjectRef(f->boolean_string())));
+  } else if (type.Is(Type::Number())) {
+    return Replace(
+        jsgraph()->Constant(js_heap_broker(), ObjectRef(f->number_string())));
+  } else if (type.Is(Type::String())) {
+    return Replace(
+        jsgraph()->Constant(js_heap_broker(), ObjectRef(f->string_string())));
+  } else if (type.Is(Type::BigInt())) {
+    return Replace(
+        jsgraph()->Constant(js_heap_broker(), ObjectRef(f->bigint_string())));
+  } else if (type.Is(Type::Symbol())) {
+    return Replace(
+        jsgraph()->Constant(js_heap_broker(), ObjectRef(f->symbol_string())));
+  } else if (type.Is(Type::OtherUndetectableOrUndefined())) {
+    return Replace(jsgraph()->Constant(js_heap_broker(),
+                                       ObjectRef(f->undefined_string())));
+  } else if (type.Is(Type::NonCallableOrNull())) {
+    return Replace(
+        jsgraph()->Constant(js_heap_broker(), ObjectRef(f->object_string())));
+  } else if (type.Is(Type::Function())) {
+    return Replace(
+        jsgraph()->Constant(js_heap_broker(), ObjectRef(f->function_string())));
+  } else if (type.IsHeapConstant()) {
     return Replace(jsgraph()->Constant(
-        Object::TypeOf(isolate(), type->AsHeapConstant()->Value())));
+        js_heap_broker(),
+        type.AsHeapConstant()->Ref().TypeOf(js_heap_broker())));
   }
-
   return NoChange();
 }
 
 Reduction TypedOptimization::ReduceToBoolean(Node* node) {
   Node* const input = node->InputAt(0);
-  Type* const input_type = NodeProperties::GetType(input);
-  if (input_type->Is(Type::Boolean())) {
+  Type const input_type = NodeProperties::GetType(input);
+  if (input_type.Is(Type::Boolean())) {
     // ToBoolean(x:boolean) => x
     return Replace(input);
-  } else if (input_type->Is(Type::OrderedNumber())) {
+  } else if (input_type.Is(Type::OrderedNumber())) {
     // SToBoolean(x:ordered-number) => BooleanNot(NumberEqual(x,#0))
     node->ReplaceInput(0, graph()->NewNode(simplified()->NumberEqual(), input,
                                            jsgraph()->ZeroConstant()));
     node->TrimInputCount(1);
     NodeProperties::ChangeOp(node, simplified()->BooleanNot());
     return Changed(node);
-  } else if (input_type->Is(Type::Number())) {
+  } else if (input_type.Is(Type::Number())) {
     // ToBoolean(x:number) => NumberToBoolean(x)
     node->TrimInputCount(1);
     NodeProperties::ChangeOp(node, simplified()->NumberToBoolean());
     return Changed(node);
-  } else if (input_type->Is(Type::DetectableReceiverOrNull())) {
+  } else if (input_type.Is(Type::DetectableReceiverOrNull())) {
     // ToBoolean(x:detectable receiver \/ null)
     //   => BooleanNot(ReferenceEqual(x,#null))
     node->ReplaceInput(0, graph()->NewNode(simplified()->ReferenceEqual(),
@@ -633,7 +614,7 @@ Reduction TypedOptimization::ReduceToBoolean(Node* node) {
     node->TrimInputCount(1);
     NodeProperties::ChangeOp(node, simplified()->BooleanNot());
     return Changed(node);
-  } else if (input_type->Is(Type::ReceiverOrNullOrUndefined())) {
+  } else if (input_type.Is(Type::ReceiverOrNullOrUndefined())) {
     // ToBoolean(x:receiver \/ null \/ undefined)
     //   => BooleanNot(ObjectIsUndetectable(x))
     node->ReplaceInput(
@@ -641,7 +622,7 @@ Reduction TypedOptimization::ReduceToBoolean(Node* node) {
     node->TrimInputCount(1);
     NodeProperties::ChangeOp(node, simplified()->BooleanNot());
     return Changed(node);
-  } else if (input_type->Is(Type::String())) {
+  } else if (input_type.Is(Type::String())) {
     // ToBoolean(x:string) => BooleanNot(ReferenceEqual(x,""))
     node->ReplaceInput(0,
                        graph()->NewNode(simplified()->ReferenceEqual(), input,
diff --git a/deps/v8/src/compiler/typed-optimization.h b/deps/v8/src/compiler/typed-optimization.h
index e906ab37eb01e6..3c4b6ed9cd212e 100644
--- a/deps/v8/src/compiler/typed-optimization.h
+++ b/deps/v8/src/compiler/typed-optimization.h
@@ -13,13 +13,13 @@ namespace v8 {
 namespace internal {
 
 // Forward declarations.
-class CompilationDependencies;
 class Factory;
 class Isolate;
 
 namespace compiler {
 
 // Forward declarations.
+class CompilationDependencies;
 class JSGraph;
 class SimplifiedOperatorBuilder;
 class TypeCache;
@@ -28,7 +28,7 @@ class V8_EXPORT_PRIVATE TypedOptimization final
     : public NON_EXPORTED_BASE(AdvancedReducer) {
  public:
   TypedOptimization(Editor* editor, CompilationDependencies* dependencies,
-                    JSGraph* jsgraph);
+                    JSGraph* jsgraph, const JSHeapBroker* js_heap_broker);
   ~TypedOptimization();
 
   const char* reducer_name() const override { return "TypedOptimization"; }
@@ -58,22 +58,26 @@ class V8_EXPORT_PRIVATE TypedOptimization final
   Reduction ReduceToBoolean(Node* node);
 
   Reduction TryReduceStringComparisonOfStringFromSingleCharCode(
-      Node* comparison, Node* from_char_code, Node* constant, bool inverted);
+      Node* comparison, Node* from_char_code, Type constant_type,
+      bool inverted);
   Reduction TryReduceStringComparisonOfStringFromSingleCharCodeToConstant(
-      Node* comparison, Handle<String> string, bool inverted);
+      Node* comparison, const StringRef& string, bool inverted);
   const Operator* NumberComparisonFor(const Operator* op);
 
-  CompilationDependencies* dependencies() const { return dependencies_; }
+  SimplifiedOperatorBuilder* simplified() const;
   Factory* factory() const;
   Graph* graph() const;
   Isolate* isolate() const;
+
+  CompilationDependencies* dependencies() const { return dependencies_; }
   JSGraph* jsgraph() const { return jsgraph_; }
-  SimplifiedOperatorBuilder* simplified() const;
+  const JSHeapBroker* js_heap_broker() const { return js_heap_broker_; }
 
   CompilationDependencies* const dependencies_;
   JSGraph* const jsgraph_;
-  Type* const true_type_;
-  Type* const false_type_;
+  const JSHeapBroker* js_heap_broker_;
+  Type const true_type_;
+  Type const false_type_;
   TypeCache const& type_cache_;
 
   DISALLOW_COPY_AND_ASSIGN(TypedOptimization);
diff --git a/deps/v8/src/compiler/typer.cc b/deps/v8/src/compiler/typer.cc
index 8d0265fc48f562..575d4aa8933345 100644
--- a/deps/v8/src/compiler/typer.cc
+++ b/deps/v8/src/compiler/typer.cc
@@ -33,30 +33,18 @@ class Typer::Decorator final : public GraphDecorator {
   Typer* const typer_;
 };
 
-Typer::Typer(Isolate* isolate, Flags flags, Graph* graph)
-    : isolate_(isolate),
-      flags_(flags),
+Typer::Typer(Isolate* isolate, const JSHeapBroker* js_heap_broker, Flags flags,
+             Graph* graph)
+    : flags_(flags),
       graph_(graph),
       decorator_(nullptr),
       cache_(TypeCache::Get()),
-      operation_typer_(isolate, zone()) {
-  Zone* zone = this->zone();
-  Factory* const factory = isolate->factory();
-
-  singleton_empty_string_ = Type::HeapConstant(factory->empty_string(), zone);
+      js_heap_broker_(js_heap_broker),
+      operation_typer_(isolate, js_heap_broker, zone()) {
   singleton_false_ = operation_typer_.singleton_false();
   singleton_true_ = operation_typer_.singleton_true();
-  falsish_ = Type::Union(
-      Type::Undetectable(),
-      Type::Union(Type::Union(singleton_false_, cache_.kZeroish, zone),
-                  Type::Union(singleton_empty_string_, Type::Hole(), zone),
-                  zone),
-      zone);
-  truish_ = Type::Union(
-      singleton_true_,
-      Type::Union(Type::DetectableReceiver(), Type::Symbol(), zone), zone);
-
-  decorator_ = new (zone) Decorator(this);
+
+  decorator_ = new (zone()) Decorator(this);
   graph_->AddDecorator(decorator_);
 }
 
@@ -76,6 +64,7 @@ class Typer::Visitor : public Reducer {
   const char* reducer_name() const override { return "Typer"; }
 
   Reduction Reduce(Node* node) override {
+    DisallowHeapAccess no_heap_access;
     if (node->op()->ValueOutputCount() == 0) return NoChange();
     switch (node->opcode()) {
 #define DECLARE_CASE(x) \
@@ -145,7 +134,7 @@ class Typer::Visitor : public Reducer {
     return NoChange();
   }
 
-  Type* TypeNode(Node* node) {
+  Type TypeNode(Node* node) {
     switch (node->opcode()) {
 #define DECLARE_CASE(x) \
       case IrOpcode::k##x: return TypeBinaryOp(node, x##Typer);
@@ -211,14 +200,14 @@ class Typer::Visitor : public Reducer {
     UNREACHABLE();
   }
 
-  Type* TypeConstant(Handle<Object> value);
+  Type TypeConstant(Handle<Object> value);
 
  private:
   Typer* typer_;
   LoopVariableOptimizer* induction_vars_;
   ZoneSet<NodeId> weakened_nodes_;
 
-#define DECLARE_METHOD(x) inline Type* Type##x(Node* node);
+#define DECLARE_METHOD(x) inline Type Type##x(Node* node);
   DECLARE_METHOD(Start)
   DECLARE_METHOD(IfException)
   COMMON_OP_LIST(DECLARE_METHOD)
@@ -227,20 +216,19 @@ class Typer::Visitor : public Reducer {
   JS_OP_LIST(DECLARE_METHOD)
 #undef DECLARE_METHOD
 
-  Type* TypeOrNone(Node* node) {
+  Type TypeOrNone(Node* node) {
     return NodeProperties::IsTyped(node) ? NodeProperties::GetType(node)
                                          : Type::None();
   }
 
-  Type* Operand(Node* node, int i) {
+  Type Operand(Node* node, int i) {
     Node* operand_node = NodeProperties::GetValueInput(node, i);
     return TypeOrNone(operand_node);
   }
 
-  Type* Weaken(Node* node, Type* current_type, Type* previous_type);
+  Type Weaken(Node* node, Type current_type, Type previous_type);
 
   Zone* zone() { return typer_->zone(); }
-  Isolate* isolate() { return typer_->isolate(); }
   Graph* graph() { return typer_->graph(); }
 
   void SetWeakened(NodeId node_id) { weakened_nodes_.insert(node_id); }
@@ -248,14 +236,14 @@ class Typer::Visitor : public Reducer {
     return weakened_nodes_.find(node_id) != weakened_nodes_.end();
   }
 
-  typedef Type* (*UnaryTyperFun)(Type*, Typer* t);
-  typedef Type* (*BinaryTyperFun)(Type*, Type*, Typer* t);
+  typedef Type (*UnaryTyperFun)(Type, Typer* t);
+  typedef Type (*BinaryTyperFun)(Type, Type, Typer* t);
 
-  Type* TypeUnaryOp(Node* node, UnaryTyperFun);
-  Type* TypeBinaryOp(Node* node, BinaryTyperFun);
+  Type TypeUnaryOp(Node* node, UnaryTyperFun);
+  Type TypeBinaryOp(Node* node, BinaryTyperFun);
 
-  static Type* BinaryNumberOpTyper(Type* lhs, Type* rhs, Typer* t,
-                                   BinaryTyperFun f);
+  static Type BinaryNumberOpTyper(Type lhs, Type rhs, Typer* t,
+                                  BinaryTyperFun f);
 
   enum ComparisonOutcomeFlags {
     kComparisonTrue = 1,
@@ -265,83 +253,84 @@ class Typer::Visitor : public Reducer {
   typedef base::Flags<ComparisonOutcomeFlags> ComparisonOutcome;
 
   static ComparisonOutcome Invert(ComparisonOutcome, Typer*);
-  static Type* FalsifyUndefined(ComparisonOutcome, Typer*);
-
-  static Type* BitwiseNot(Type*, Typer*);
-  static Type* Decrement(Type*, Typer*);
-  static Type* Increment(Type*, Typer*);
-  static Type* Negate(Type*, Typer*);
-
-  static Type* ToPrimitive(Type*, Typer*);
-  static Type* ToBoolean(Type*, Typer*);
-  static Type* ToInteger(Type*, Typer*);
-  static Type* ToLength(Type*, Typer*);
-  static Type* ToName(Type*, Typer*);
-  static Type* ToNumber(Type*, Typer*);
-  static Type* ToNumeric(Type*, Typer*);
-  static Type* ToObject(Type*, Typer*);
-  static Type* ToString(Type*, Typer*);
-#define DECLARE_METHOD(Name)                \
-  static Type* Name(Type* type, Typer* t) { \
-    return t->operation_typer_.Name(type);  \
+  static Type FalsifyUndefined(ComparisonOutcome, Typer*);
+
+  static Type BitwiseNot(Type, Typer*);
+  static Type Decrement(Type, Typer*);
+  static Type Increment(Type, Typer*);
+  static Type Negate(Type, Typer*);
+
+  static Type ToPrimitive(Type, Typer*);
+  static Type ToBoolean(Type, Typer*);
+  static Type ToInteger(Type, Typer*);
+  static Type ToLength(Type, Typer*);
+  static Type ToName(Type, Typer*);
+  static Type ToNumber(Type, Typer*);
+  static Type ToNumeric(Type, Typer*);
+  static Type ToObject(Type, Typer*);
+  static Type ToString(Type, Typer*);
+#define DECLARE_METHOD(Name)               \
+  static Type Name(Type type, Typer* t) {  \
+    return t->operation_typer_.Name(type); \
   }
   SIMPLIFIED_NUMBER_UNOP_LIST(DECLARE_METHOD)
   SIMPLIFIED_SPECULATIVE_NUMBER_UNOP_LIST(DECLARE_METHOD)
 #undef DECLARE_METHOD
-#define DECLARE_METHOD(Name)                          \
-  static Type* Name(Type* lhs, Type* rhs, Typer* t) { \
-    return t->operation_typer_.Name(lhs, rhs);        \
+#define DECLARE_METHOD(Name)                       \
+  static Type Name(Type lhs, Type rhs, Typer* t) { \
+    return t->operation_typer_.Name(lhs, rhs);     \
   }
   SIMPLIFIED_NUMBER_BINOP_LIST(DECLARE_METHOD)
   SIMPLIFIED_SPECULATIVE_NUMBER_BINOP_LIST(DECLARE_METHOD)
 #undef DECLARE_METHOD
 
-  static Type* ObjectIsArrayBufferView(Type*, Typer*);
-  static Type* ObjectIsBigInt(Type*, Typer*);
-  static Type* ObjectIsCallable(Type*, Typer*);
-  static Type* ObjectIsConstructor(Type*, Typer*);
-  static Type* ObjectIsDetectableCallable(Type*, Typer*);
-  static Type* ObjectIsMinusZero(Type*, Typer*);
-  static Type* ObjectIsNaN(Type*, Typer*);
-  static Type* ObjectIsNonCallable(Type*, Typer*);
-  static Type* ObjectIsNumber(Type*, Typer*);
-  static Type* ObjectIsReceiver(Type*, Typer*);
-  static Type* ObjectIsSmi(Type*, Typer*);
-  static Type* ObjectIsString(Type*, Typer*);
-  static Type* ObjectIsSymbol(Type*, Typer*);
-  static Type* ObjectIsUndetectable(Type*, Typer*);
-
-  static ComparisonOutcome JSCompareTyper(Type*, Type*, Typer*);
-  static ComparisonOutcome NumberCompareTyper(Type*, Type*, Typer*);
-
-#define DECLARE_METHOD(x) static Type* x##Typer(Type*, Type*, Typer*);
+  static Type ObjectIsArrayBufferView(Type, Typer*);
+  static Type ObjectIsBigInt(Type, Typer*);
+  static Type ObjectIsCallable(Type, Typer*);
+  static Type ObjectIsConstructor(Type, Typer*);
+  static Type ObjectIsDetectableCallable(Type, Typer*);
+  static Type ObjectIsMinusZero(Type, Typer*);
+  static Type ObjectIsNaN(Type, Typer*);
+  static Type NumberIsNaN(Type, Typer*);
+  static Type ObjectIsNonCallable(Type, Typer*);
+  static Type ObjectIsNumber(Type, Typer*);
+  static Type ObjectIsReceiver(Type, Typer*);
+  static Type ObjectIsSmi(Type, Typer*);
+  static Type ObjectIsString(Type, Typer*);
+  static Type ObjectIsSymbol(Type, Typer*);
+  static Type ObjectIsUndetectable(Type, Typer*);
+
+  static ComparisonOutcome JSCompareTyper(Type, Type, Typer*);
+  static ComparisonOutcome NumberCompareTyper(Type, Type, Typer*);
+
+#define DECLARE_METHOD(x) static Type x##Typer(Type, Type, Typer*);
   JS_SIMPLE_BINOP_LIST(DECLARE_METHOD)
 #undef DECLARE_METHOD
 
-  static Type* JSCallTyper(Type*, Typer*);
+  static Type JSCallTyper(Type, Typer*);
 
-  static Type* NumberEqualTyper(Type*, Type*, Typer*);
-  static Type* NumberLessThanTyper(Type*, Type*, Typer*);
-  static Type* NumberLessThanOrEqualTyper(Type*, Type*, Typer*);
-  static Type* ReferenceEqualTyper(Type*, Type*, Typer*);
-  static Type* SameValueTyper(Type*, Type*, Typer*);
-  static Type* StringFromSingleCharCodeTyper(Type*, Typer*);
-  static Type* StringFromSingleCodePointTyper(Type*, Typer*);
+  static Type NumberEqualTyper(Type, Type, Typer*);
+  static Type NumberLessThanTyper(Type, Type, Typer*);
+  static Type NumberLessThanOrEqualTyper(Type, Type, Typer*);
+  static Type ReferenceEqualTyper(Type, Type, Typer*);
+  static Type SameValueTyper(Type, Type, Typer*);
+  static Type StringFromSingleCharCodeTyper(Type, Typer*);
+  static Type StringFromSingleCodePointTyper(Type, Typer*);
 
-  Reduction UpdateType(Node* node, Type* current) {
+  Reduction UpdateType(Node* node, Type current) {
     if (NodeProperties::IsTyped(node)) {
       // Widen the type of a previously typed node.
-      Type* previous = NodeProperties::GetType(node);
+      Type previous = NodeProperties::GetType(node);
       if (node->opcode() == IrOpcode::kPhi ||
           node->opcode() == IrOpcode::kInductionVariablePhi) {
         // Speed up termination in the presence of range types:
         current = Weaken(node, current, previous);
       }
 
-      CHECK(previous->Is(current));
+      CHECK(previous.Is(current));
 
       NodeProperties::SetType(node, current);
-      if (!current->Is(previous)) {
+      if (!current.Is(previous)) {
         // If something changed, revisit all uses.
         return Changed(node);
       }
@@ -379,7 +368,7 @@ void Typer::Decorator::Decorate(Node* node) {
     bool is_typed = NodeProperties::IsTyped(node);
     if (is_typed || NodeProperties::AllValueInputsAreTyped(node)) {
       Visitor typing(typer_, nullptr);
-      Type* type = typing.TypeNode(node);
+      Type type = typing.TypeNode(node);
       if (is_typed) {
         type = Type::Intersect(type, NodeProperties::GetType(node),
                                typer_->zone());
@@ -396,32 +385,31 @@ void Typer::Decorator::Decorate(Node* node) {
 // and uses that to type the given node.  Note that f is never called with None
 // as an argument.
 
-
-Type* Typer::Visitor::TypeUnaryOp(Node* node, UnaryTyperFun f) {
-  Type* input = Operand(node, 0);
-  return input->IsNone() ? Type::None() : f(input, typer_);
+Type Typer::Visitor::TypeUnaryOp(Node* node, UnaryTyperFun f) {
+  Type input = Operand(node, 0);
+  return input.IsNone() ? Type::None() : f(input, typer_);
 }
 
-Type* Typer::Visitor::TypeBinaryOp(Node* node, BinaryTyperFun f) {
-  Type* left = Operand(node, 0);
-  Type* right = Operand(node, 1);
-  return left->IsNone() || right->IsNone() ? Type::None()
-                                           : f(left, right, typer_);
+Type Typer::Visitor::TypeBinaryOp(Node* node, BinaryTyperFun f) {
+  Type left = Operand(node, 0);
+  Type right = Operand(node, 1);
+  return left.IsNone() || right.IsNone() ? Type::None()
+                                         : f(left, right, typer_);
 }
 
-Type* Typer::Visitor::BinaryNumberOpTyper(Type* lhs, Type* rhs, Typer* t,
-                                          BinaryTyperFun f) {
+Type Typer::Visitor::BinaryNumberOpTyper(Type lhs, Type rhs, Typer* t,
+                                         BinaryTyperFun f) {
   lhs = ToNumeric(lhs, t);
   rhs = ToNumeric(rhs, t);
-  bool lhs_is_number = lhs->Is(Type::Number());
-  bool rhs_is_number = rhs->Is(Type::Number());
+  bool lhs_is_number = lhs.Is(Type::Number());
+  bool rhs_is_number = rhs.Is(Type::Number());
   if (lhs_is_number && rhs_is_number) {
     return f(lhs, rhs, t);
   }
   if (lhs_is_number || rhs_is_number) {
     return Type::Number();
   }
-  if (lhs->Is(Type::BigInt()) || rhs->Is(Type::BigInt())) {
+  if (lhs.Is(Type::BigInt()) || rhs.Is(Type::BigInt())) {
     return Type::BigInt();
   }
   return Type::Numeric();
@@ -436,7 +424,7 @@ Typer::Visitor::ComparisonOutcome Typer::Visitor::Invert(
   return result;
 }
 
-Type* Typer::Visitor::FalsifyUndefined(ComparisonOutcome outcome, Typer* t) {
+Type Typer::Visitor::FalsifyUndefined(ComparisonOutcome outcome, Typer* t) {
   if ((outcome & kComparisonFalse) != 0 ||
       (outcome & kComparisonUndefined) != 0) {
     return (outcome & kComparisonTrue) != 0 ? Type::Boolean()
@@ -447,33 +435,33 @@ Type* Typer::Visitor::FalsifyUndefined(ComparisonOutcome outcome, Typer* t) {
   return t->singleton_true_;
 }
 
-Type* Typer::Visitor::BitwiseNot(Type* type, Typer* t) {
+Type Typer::Visitor::BitwiseNot(Type type, Typer* t) {
   type = ToNumeric(type, t);
-  if (type->Is(Type::Number())) {
+  if (type.Is(Type::Number())) {
     return NumberBitwiseXor(type, t->cache_.kSingletonMinusOne, t);
   }
   return Type::Numeric();
 }
 
-Type* Typer::Visitor::Decrement(Type* type, Typer* t) {
+Type Typer::Visitor::Decrement(Type type, Typer* t) {
   type = ToNumeric(type, t);
-  if (type->Is(Type::Number())) {
+  if (type.Is(Type::Number())) {
     return NumberSubtract(type, t->cache_.kSingletonOne, t);
   }
   return Type::Numeric();
 }
 
-Type* Typer::Visitor::Increment(Type* type, Typer* t) {
+Type Typer::Visitor::Increment(Type type, Typer* t) {
   type = ToNumeric(type, t);
-  if (type->Is(Type::Number())) {
+  if (type.Is(Type::Number())) {
     return NumberAdd(type, t->cache_.kSingletonOne, t);
   }
   return Type::Numeric();
 }
 
-Type* Typer::Visitor::Negate(Type* type, Typer* t) {
+Type Typer::Visitor::Negate(Type type, Typer* t) {
   type = ToNumeric(type, t);
-  if (type->Is(Type::Number())) {
+  if (type.Is(Type::Number())) {
     return NumberMultiply(type, t->cache_.kSingletonMinusOne, t);
   }
   return Type::Numeric();
@@ -481,31 +469,24 @@ Type* Typer::Visitor::Negate(Type* type, Typer* t) {
 
 // Type conversion.
 
-Type* Typer::Visitor::ToPrimitive(Type* type, Typer* t) {
-  if (type->Is(Type::Primitive()) && !type->Maybe(Type::Receiver())) {
+Type Typer::Visitor::ToPrimitive(Type type, Typer* t) {
+  if (type.Is(Type::Primitive()) && !type.Maybe(Type::Receiver())) {
     return type;
   }
   return Type::Primitive();
 }
 
-
-Type* Typer::Visitor::ToBoolean(Type* type, Typer* t) {
-  if (type->Is(Type::Boolean())) return type;
-  if (type->Is(t->falsish_)) return t->singleton_false_;
-  if (type->Is(t->truish_)) return t->singleton_true_;
-  if (type->Is(Type::Number())) {
-    return t->operation_typer()->NumberToBoolean(type);
-  }
-  return Type::Boolean();
+Type Typer::Visitor::ToBoolean(Type type, Typer* t) {
+  return t->operation_typer()->ToBoolean(type);
 }
 
 
 // static
-Type* Typer::Visitor::ToInteger(Type* type, Typer* t) {
+Type Typer::Visitor::ToInteger(Type type, Typer* t) {
   // ES6 section 7.1.4 ToInteger ( argument )
   type = ToNumber(type, t);
-  if (type->Is(t->cache_.kIntegerOrMinusZero)) return type;
-  if (type->Is(t->cache_.kIntegerOrMinusZeroOrNaN)) {
+  if (type.Is(t->cache_.kIntegerOrMinusZero)) return type;
+  if (type.Is(t->cache_.kIntegerOrMinusZeroOrNaN)) {
     return Type::Union(
         Type::Intersect(type, t->cache_.kIntegerOrMinusZero, t->zone()),
         t->cache_.kSingletonZero, t->zone());
@@ -515,12 +496,12 @@ Type* Typer::Visitor::ToInteger(Type* type, Typer* t) {
 
 
 // static
-Type* Typer::Visitor::ToLength(Type* type, Typer* t) {
+Type Typer::Visitor::ToLength(Type type, Typer* t) {
   // ES6 section 7.1.15 ToLength ( argument )
   type = ToInteger(type, t);
-  if (type->IsNone()) return type;
-  double min = type->Min();
-  double max = type->Max();
+  if (type.IsNone()) return type;
+  double min = type.Min();
+  double max = type.Max();
   if (max <= 0.0) {
     return Type::NewConstant(0, t->zone());
   }
@@ -534,31 +515,31 @@ Type* Typer::Visitor::ToLength(Type* type, Typer* t) {
 
 
 // static
-Type* Typer::Visitor::ToName(Type* type, Typer* t) {
+Type Typer::Visitor::ToName(Type type, Typer* t) {
   // ES6 section 7.1.14 ToPropertyKey ( argument )
   type = ToPrimitive(type, t);
-  if (type->Is(Type::Name())) return type;
-  if (type->Maybe(Type::Symbol())) return Type::Name();
+  if (type.Is(Type::Name())) return type;
+  if (type.Maybe(Type::Symbol())) return Type::Name();
   return ToString(type, t);
 }
 
 
 // static
-Type* Typer::Visitor::ToNumber(Type* type, Typer* t) {
+Type Typer::Visitor::ToNumber(Type type, Typer* t) {
   return t->operation_typer_.ToNumber(type);
 }
 
 // static
-Type* Typer::Visitor::ToNumeric(Type* type, Typer* t) {
+Type Typer::Visitor::ToNumeric(Type type, Typer* t) {
   return t->operation_typer_.ToNumeric(type);
 }
 
 // static
-Type* Typer::Visitor::ToObject(Type* type, Typer* t) {
+Type Typer::Visitor::ToObject(Type type, Typer* t) {
   // ES6 section 7.1.13 ToObject ( argument )
-  if (type->Is(Type::Receiver())) return type;
-  if (type->Is(Type::Primitive())) return Type::OtherObject();
-  if (!type->Maybe(Type::OtherUndetectable())) {
+  if (type.Is(Type::Receiver())) return type;
+  if (type.Is(Type::Primitive())) return Type::OtherObject();
+  if (!type.Maybe(Type::OtherUndetectable())) {
     return Type::DetectableReceiver();
   }
   return Type::Receiver();
@@ -566,97 +547,101 @@ Type* Typer::Visitor::ToObject(Type* type, Typer* t) {
 
 
 // static
-Type* Typer::Visitor::ToString(Type* type, Typer* t) {
+Type Typer::Visitor::ToString(Type type, Typer* t) {
   // ES6 section 7.1.12 ToString ( argument )
   type = ToPrimitive(type, t);
-  if (type->Is(Type::String())) return type;
+  if (type.Is(Type::String())) return type;
   return Type::String();
 }
 
 // Type checks.
 
-Type* Typer::Visitor::ObjectIsArrayBufferView(Type* type, Typer* t) {
+Type Typer::Visitor::ObjectIsArrayBufferView(Type type, Typer* t) {
   // TODO(turbofan): Introduce a Type::ArrayBufferView?
-  if (!type->Maybe(Type::OtherObject())) return t->singleton_false_;
+  if (!type.Maybe(Type::OtherObject())) return t->singleton_false_;
   return Type::Boolean();
 }
 
-Type* Typer::Visitor::ObjectIsBigInt(Type* type, Typer* t) {
-  if (type->Is(Type::BigInt())) return t->singleton_true_;
-  if (!type->Maybe(Type::BigInt())) return t->singleton_false_;
+Type Typer::Visitor::ObjectIsBigInt(Type type, Typer* t) {
+  if (type.Is(Type::BigInt())) return t->singleton_true_;
+  if (!type.Maybe(Type::BigInt())) return t->singleton_false_;
   return Type::Boolean();
 }
 
-Type* Typer::Visitor::ObjectIsCallable(Type* type, Typer* t) {
-  if (type->Is(Type::Callable())) return t->singleton_true_;
-  if (!type->Maybe(Type::Callable())) return t->singleton_false_;
+Type Typer::Visitor::ObjectIsCallable(Type type, Typer* t) {
+  if (type.Is(Type::Callable())) return t->singleton_true_;
+  if (!type.Maybe(Type::Callable())) return t->singleton_false_;
   return Type::Boolean();
 }
 
-Type* Typer::Visitor::ObjectIsConstructor(Type* type, Typer* t) {
+Type Typer::Visitor::ObjectIsConstructor(Type type, Typer* t) {
   // TODO(turbofan): Introduce a Type::Constructor?
-  if (!type->Maybe(Type::Callable())) return t->singleton_false_;
+  if (!type.Maybe(Type::Callable())) return t->singleton_false_;
   return Type::Boolean();
 }
 
-Type* Typer::Visitor::ObjectIsDetectableCallable(Type* type, Typer* t) {
-  if (type->Is(Type::DetectableCallable())) return t->singleton_true_;
-  if (!type->Maybe(Type::DetectableCallable())) return t->singleton_false_;
+Type Typer::Visitor::ObjectIsDetectableCallable(Type type, Typer* t) {
+  if (type.Is(Type::DetectableCallable())) return t->singleton_true_;
+  if (!type.Maybe(Type::DetectableCallable())) return t->singleton_false_;
   return Type::Boolean();
 }
 
-Type* Typer::Visitor::ObjectIsMinusZero(Type* type, Typer* t) {
-  if (type->Is(Type::MinusZero())) return t->singleton_true_;
-  if (!type->Maybe(Type::MinusZero())) return t->singleton_false_;
+Type Typer::Visitor::ObjectIsMinusZero(Type type, Typer* t) {
+  if (type.Is(Type::MinusZero())) return t->singleton_true_;
+  if (!type.Maybe(Type::MinusZero())) return t->singleton_false_;
   return Type::Boolean();
 }
 
-Type* Typer::Visitor::ObjectIsNaN(Type* type, Typer* t) {
-  if (type->Is(Type::NaN())) return t->singleton_true_;
-  if (!type->Maybe(Type::NaN())) return t->singleton_false_;
+Type Typer::Visitor::ObjectIsNaN(Type type, Typer* t) {
+  if (type.Is(Type::NaN())) return t->singleton_true_;
+  if (!type.Maybe(Type::NaN())) return t->singleton_false_;
   return Type::Boolean();
 }
 
-Type* Typer::Visitor::ObjectIsNonCallable(Type* type, Typer* t) {
-  if (type->Is(Type::NonCallable())) return t->singleton_true_;
-  if (!type->Maybe(Type::NonCallable())) return t->singleton_false_;
+Type Typer::Visitor::NumberIsNaN(Type type, Typer* t) {
+  if (type.Is(Type::NaN())) return t->singleton_true_;
+  if (!type.Maybe(Type::NaN())) return t->singleton_false_;
   return Type::Boolean();
 }
 
-Type* Typer::Visitor::ObjectIsNumber(Type* type, Typer* t) {
-  if (type->Is(Type::Number())) return t->singleton_true_;
-  if (!type->Maybe(Type::Number())) return t->singleton_false_;
+Type Typer::Visitor::ObjectIsNonCallable(Type type, Typer* t) {
+  if (type.Is(Type::NonCallable())) return t->singleton_true_;
+  if (!type.Maybe(Type::NonCallable())) return t->singleton_false_;
   return Type::Boolean();
 }
 
-
-Type* Typer::Visitor::ObjectIsReceiver(Type* type, Typer* t) {
-  if (type->Is(Type::Receiver())) return t->singleton_true_;
-  if (!type->Maybe(Type::Receiver())) return t->singleton_false_;
+Type Typer::Visitor::ObjectIsNumber(Type type, Typer* t) {
+  if (type.Is(Type::Number())) return t->singleton_true_;
+  if (!type.Maybe(Type::Number())) return t->singleton_false_;
   return Type::Boolean();
 }
 
+Type Typer::Visitor::ObjectIsReceiver(Type type, Typer* t) {
+  if (type.Is(Type::Receiver())) return t->singleton_true_;
+  if (!type.Maybe(Type::Receiver())) return t->singleton_false_;
+  return Type::Boolean();
+}
 
-Type* Typer::Visitor::ObjectIsSmi(Type* type, Typer* t) {
-  if (!type->Maybe(Type::SignedSmall())) return t->singleton_false_;
+Type Typer::Visitor::ObjectIsSmi(Type type, Typer* t) {
+  if (!type.Maybe(Type::SignedSmall())) return t->singleton_false_;
   return Type::Boolean();
 }
 
-Type* Typer::Visitor::ObjectIsString(Type* type, Typer* t) {
-  if (type->Is(Type::String())) return t->singleton_true_;
-  if (!type->Maybe(Type::String())) return t->singleton_false_;
+Type Typer::Visitor::ObjectIsString(Type type, Typer* t) {
+  if (type.Is(Type::String())) return t->singleton_true_;
+  if (!type.Maybe(Type::String())) return t->singleton_false_;
   return Type::Boolean();
 }
 
-Type* Typer::Visitor::ObjectIsSymbol(Type* type, Typer* t) {
-  if (type->Is(Type::Symbol())) return t->singleton_true_;
-  if (!type->Maybe(Type::Symbol())) return t->singleton_false_;
+Type Typer::Visitor::ObjectIsSymbol(Type type, Typer* t) {
+  if (type.Is(Type::Symbol())) return t->singleton_true_;
+  if (!type.Maybe(Type::Symbol())) return t->singleton_false_;
   return Type::Boolean();
 }
 
-Type* Typer::Visitor::ObjectIsUndetectable(Type* type, Typer* t) {
-  if (type->Is(Type::Undetectable())) return t->singleton_true_;
-  if (!type->Maybe(Type::Undetectable())) return t->singleton_false_;
+Type Typer::Visitor::ObjectIsUndetectable(Type type, Typer* t) {
+  if (type.Is(Type::Undetectable())) return t->singleton_true_;
+  if (!type.Maybe(Type::Undetectable())) return t->singleton_false_;
   return Type::Boolean();
 }
 
@@ -666,15 +651,13 @@ Type* Typer::Visitor::ObjectIsUndetectable(Type* type, Typer* t) {
 
 // Control operators.
 
-Type* Typer::Visitor::TypeStart(Node* node) { return Type::Internal(); }
+Type Typer::Visitor::TypeStart(Node* node) { return Type::Internal(); }
 
-Type* Typer::Visitor::TypeIfException(Node* node) {
-  return Type::NonInternal();
-}
+Type Typer::Visitor::TypeIfException(Node* node) { return Type::NonInternal(); }
 
 // Common operators.
 
-Type* Typer::Visitor::TypeParameter(Node* node) {
+Type Typer::Visitor::TypeParameter(Node* node) {
   Node* const start = node->InputAt(0);
   DCHECK_EQ(IrOpcode::kStart, start->opcode());
   int const parameter_count = start->op()->ValueOutputCount() - 4;
@@ -703,85 +686,71 @@ Type* Typer::Visitor::TypeParameter(Node* node) {
   return Type::NonInternal();
 }
 
-Type* Typer::Visitor::TypeOsrValue(Node* node) { return Type::Any(); }
+Type Typer::Visitor::TypeOsrValue(Node* node) { return Type::Any(); }
 
-Type* Typer::Visitor::TypeRetain(Node* node) {
-  UNREACHABLE();
-}
+Type Typer::Visitor::TypeRetain(Node* node) { UNREACHABLE(); }
 
-Type* Typer::Visitor::TypeInt32Constant(Node* node) {
-  UNREACHABLE();
-}
+Type Typer::Visitor::TypeInt32Constant(Node* node) { UNREACHABLE(); }
 
-Type* Typer::Visitor::TypeInt64Constant(Node* node) {
-  UNREACHABLE();
-}
+Type Typer::Visitor::TypeInt64Constant(Node* node) { UNREACHABLE(); }
 
-Type* Typer::Visitor::TypeRelocatableInt32Constant(Node* node) {
-  UNREACHABLE();
-}
+Type Typer::Visitor::TypeRelocatableInt32Constant(Node* node) { UNREACHABLE(); }
 
-Type* Typer::Visitor::TypeRelocatableInt64Constant(Node* node) {
-  UNREACHABLE();
-}
+Type Typer::Visitor::TypeRelocatableInt64Constant(Node* node) { UNREACHABLE(); }
 
-Type* Typer::Visitor::TypeFloat32Constant(Node* node) {
-  UNREACHABLE();
-}
+Type Typer::Visitor::TypeFloat32Constant(Node* node) { UNREACHABLE(); }
 
-Type* Typer::Visitor::TypeFloat64Constant(Node* node) {
-  UNREACHABLE();
-}
+Type Typer::Visitor::TypeFloat64Constant(Node* node) { UNREACHABLE(); }
 
-Type* Typer::Visitor::TypeNumberConstant(Node* node) {
+Type Typer::Visitor::TypeNumberConstant(Node* node) {
   double number = OpParameter<double>(node->op());
   return Type::NewConstant(number, zone());
 }
 
-Type* Typer::Visitor::TypeHeapConstant(Node* node) {
+Type Typer::Visitor::TypeHeapConstant(Node* node) {
   return TypeConstant(HeapConstantOf(node->op()));
 }
 
-Type* Typer::Visitor::TypeExternalConstant(Node* node) {
+Type Typer::Visitor::TypeExternalConstant(Node* node) {
   return Type::ExternalPointer();
 }
 
-Type* Typer::Visitor::TypePointerConstant(Node* node) {
+Type Typer::Visitor::TypePointerConstant(Node* node) {
   return Type::ExternalPointer();
 }
 
-Type* Typer::Visitor::TypeSelect(Node* node) {
+Type Typer::Visitor::TypeSelect(Node* node) {
   return Type::Union(Operand(node, 1), Operand(node, 2), zone());
 }
 
-Type* Typer::Visitor::TypePhi(Node* node) {
+Type Typer::Visitor::TypePhi(Node* node) {
   int arity = node->op()->ValueInputCount();
-  Type* type = Operand(node, 0);
+  Type type = Operand(node, 0);
   for (int i = 1; i < arity; ++i) {
     type = Type::Union(type, Operand(node, i), zone());
   }
   return type;
 }
 
-Type* Typer::Visitor::TypeInductionVariablePhi(Node* node) {
+Type Typer::Visitor::TypeInductionVariablePhi(Node* node) {
   int arity = NodeProperties::GetControlInput(node)->op()->ControlInputCount();
   DCHECK_EQ(IrOpcode::kLoop, NodeProperties::GetControlInput(node)->opcode());
   DCHECK_EQ(2, NodeProperties::GetControlInput(node)->InputCount());
 
-  Type* initial_type = Operand(node, 0);
-  Type* increment_type = Operand(node, 2);
+  Type initial_type = Operand(node, 0);
+  Type increment_type = Operand(node, 2);
 
   // We only handle integer induction variables (otherwise ranges
   // do not apply and we cannot do anything).
-  if (!initial_type->Is(typer_->cache_.kInteger) ||
-      !increment_type->Is(typer_->cache_.kInteger)) {
+  if (!initial_type.Is(typer_->cache_.kInteger) ||
+      !increment_type.Is(typer_->cache_.kInteger)) {
     // Fallback to normal phi typing, but ensure monotonicity.
     // (Unfortunately, without baking in the previous type, monotonicity might
     // be violated because we might not yet have retyped the incrementing
     // operation even though the increment's type might been already reflected
     // in the induction variable phi.)
-    Type* type = NodeProperties::IsTyped(node) ? NodeProperties::GetType(node)
-                                               : Type::None();
+    Type type = NodeProperties::IsTyped(node) ? NodeProperties::GetType(node)
+                                              : Type::None();
     for (int i = 0; i < arity; ++i) {
       type = Type::Union(type, Operand(node, i), zone());
     }
@@ -789,8 +758,8 @@ Type* Typer::Visitor::TypeInductionVariablePhi(Node* node) {
   }
   // If we do not have enough type information for the initial value or
   // the increment, just return the initial value's type.
-  if (initial_type->IsNone() ||
-      increment_type->Is(typer_->cache_.kSingletonZero)) {
+  if (initial_type.IsNone() ||
+      increment_type.Is(typer_->cache_.kSingletonZero)) {
     return initial_type;
   }
 
@@ -807,179 +776,165 @@ Type* Typer::Visitor::TypeInductionVariablePhi(Node* node) {
   double increment_min;
   double increment_max;
   if (arithmetic_type == InductionVariable::ArithmeticType::kAddition) {
-    increment_min = increment_type->Min();
-    increment_max = increment_type->Max();
+    increment_min = increment_type.Min();
+    increment_max = increment_type.Max();
   } else {
     DCHECK_EQ(InductionVariable::ArithmeticType::kSubtraction, arithmetic_type);
-    increment_min = -increment_type->Max();
-    increment_max = -increment_type->Min();
+    increment_min = -increment_type.Max();
+    increment_max = -increment_type.Min();
   }
 
   if (increment_min >= 0) {
     // increasing sequence
-    min = initial_type->Min();
+    min = initial_type.Min();
     for (auto bound : induction_var->upper_bounds()) {
-      Type* bound_type = TypeOrNone(bound.bound);
+      Type bound_type = TypeOrNone(bound.bound);
       // If the type is not an integer, just skip the bound.
-      if (!bound_type->Is(typer_->cache_.kInteger)) continue;
+      if (!bound_type.Is(typer_->cache_.kInteger)) continue;
       // If the type is not inhabited, then we can take the initial value.
-      if (bound_type->IsNone()) {
-        max = initial_type->Max();
+      if (bound_type.IsNone()) {
+        max = initial_type.Max();
         break;
       }
-      double bound_max = bound_type->Max();
+      double bound_max = bound_type.Max();
       if (bound.kind == InductionVariable::kStrict) {
         bound_max -= 1;
       }
       max = std::min(max, bound_max + increment_max);
     }
     // The upper bound must be at least the initial value's upper bound.
-    max = std::max(max, initial_type->Max());
+    max = std::max(max, initial_type.Max());
   } else if (increment_max <= 0) {
     // decreasing sequence
-    max = initial_type->Max();
+    max = initial_type.Max();
     for (auto bound : induction_var->lower_bounds()) {
-      Type* bound_type = TypeOrNone(bound.bound);
+      Type bound_type = TypeOrNone(bound.bound);
       // If the type is not an integer, just skip the bound.
-      if (!bound_type->Is(typer_->cache_.kInteger)) continue;
+      if (!bound_type.Is(typer_->cache_.kInteger)) continue;
       // If the type is not inhabited, then we can take the initial value.
-      if (bound_type->IsNone()) {
-        min = initial_type->Min();
+      if (bound_type.IsNone()) {
+        min = initial_type.Min();
         break;
       }
-      double bound_min = bound_type->Min();
+      double bound_min = bound_type.Min();
       if (bound.kind == InductionVariable::kStrict) {
         bound_min += 1;
       }
       min = std::max(min, bound_min + increment_min);
     }
     // The lower bound must be at most the initial value's lower bound.
-    min = std::min(min, initial_type->Min());
+    min = std::min(min, initial_type.Min());
   } else {
     // Shortcut: If the increment can be both positive and negative,
     // the variable can go arbitrarily far, so just return integer.
     return typer_->cache_.kInteger;
   }
   if (FLAG_trace_turbo_loop) {
-    OFStream os(stdout);
-    os << std::setprecision(10);
-    os << "Loop (" << NodeProperties::GetControlInput(node)->id()
-       << ") variable bounds in "
-       << (arithmetic_type == InductionVariable::ArithmeticType::kAddition
-               ? "addition"
-               : "subtraction")
-       << " for phi " << node->id() << ": (" << min << ", " << max << ")\n";
+    StdoutStream{} << std::setprecision(10) << "Loop ("
+                   << NodeProperties::GetControlInput(node)->id()
+                   << ") variable bounds in "
+                   << (arithmetic_type ==
+                               InductionVariable::ArithmeticType::kAddition
+                           ? "addition"
+                           : "subtraction")
+                   << " for phi " << node->id() << ": (" << min << ", " << max
+                   << ")\n";
   }
   return Type::Range(min, max, typer_->zone());
 }
 
-Type* Typer::Visitor::TypeEffectPhi(Node* node) {
-  UNREACHABLE();
-}
+Type Typer::Visitor::TypeEffectPhi(Node* node) { UNREACHABLE(); }
 
-Type* Typer::Visitor::TypeLoopExit(Node* node) {
-  UNREACHABLE();
-}
+Type Typer::Visitor::TypeLoopExit(Node* node) { UNREACHABLE(); }
 
-Type* Typer::Visitor::TypeLoopExitValue(Node* node) { return Operand(node, 0); }
+Type Typer::Visitor::TypeLoopExitValue(Node* node) { return Operand(node, 0); }
 
-Type* Typer::Visitor::TypeLoopExitEffect(Node* node) {
-  UNREACHABLE();
-}
+Type Typer::Visitor::TypeLoopExitEffect(Node* node) { UNREACHABLE(); }
 
-Type* Typer::Visitor::TypeEnsureWritableFastElements(Node* node) {
+Type Typer::Visitor::TypeEnsureWritableFastElements(Node* node) {
   return Operand(node, 1);
 }
 
-Type* Typer::Visitor::TypeMaybeGrowFastElements(Node* node) {
+Type Typer::Visitor::TypeMaybeGrowFastElements(Node* node) {
   return Operand(node, 1);
 }
 
-Type* Typer::Visitor::TypeTransitionElementsKind(Node* node) {
-  UNREACHABLE();
-}
-
-Type* Typer::Visitor::TypeCheckpoint(Node* node) {
-  UNREACHABLE();
-}
-
-Type* Typer::Visitor::TypeBeginRegion(Node* node) {
-  UNREACHABLE();
-}
+Type Typer::Visitor::TypeTransitionElementsKind(Node* node) { UNREACHABLE(); }
 
+Type Typer::Visitor::TypeCheckpoint(Node* node) { UNREACHABLE(); }
 
-Type* Typer::Visitor::TypeFinishRegion(Node* node) { return Operand(node, 0); }
+Type Typer::Visitor::TypeBeginRegion(Node* node) { UNREACHABLE(); }
 
+Type Typer::Visitor::TypeFinishRegion(Node* node) { return Operand(node, 0); }
 
-Type* Typer::Visitor::TypeFrameState(Node* node) {
+Type Typer::Visitor::TypeFrameState(Node* node) {
   // TODO(rossberg): Ideally FrameState wouldn't have a value output.
   return Type::Internal();
 }
 
-Type* Typer::Visitor::TypeStateValues(Node* node) { return Type::Internal(); }
+Type Typer::Visitor::TypeStateValues(Node* node) { return Type::Internal(); }
 
-Type* Typer::Visitor::TypeTypedStateValues(Node* node) {
+Type Typer::Visitor::TypeTypedStateValues(Node* node) {
   return Type::Internal();
 }
 
-Type* Typer::Visitor::TypeObjectId(Node* node) { UNREACHABLE(); }
+Type Typer::Visitor::TypeObjectId(Node* node) { UNREACHABLE(); }
 
-Type* Typer::Visitor::TypeArgumentsElementsState(Node* node) {
+Type Typer::Visitor::TypeArgumentsElementsState(Node* node) {
   return Type::Internal();
 }
 
-Type* Typer::Visitor::TypeArgumentsLengthState(Node* node) {
+Type Typer::Visitor::TypeArgumentsLengthState(Node* node) {
   return Type::Internal();
 }
 
-Type* Typer::Visitor::TypeObjectState(Node* node) { return Type::Internal(); }
+Type Typer::Visitor::TypeObjectState(Node* node) { return Type::Internal(); }
 
-Type* Typer::Visitor::TypeTypedObjectState(Node* node) {
+Type Typer::Visitor::TypeTypedObjectState(Node* node) {
   return Type::Internal();
 }
 
-Type* Typer::Visitor::TypeCall(Node* node) { return Type::Any(); }
+Type Typer::Visitor::TypeCall(Node* node) { return Type::Any(); }
 
-Type* Typer::Visitor::TypeCallWithCallerSavedRegisters(Node* node) {
+Type Typer::Visitor::TypeCallWithCallerSavedRegisters(Node* node) {
   UNREACHABLE();
 }
 
-Type* Typer::Visitor::TypeProjection(Node* node) {
-  Type* const type = Operand(node, 0);
-  if (type->Is(Type::None())) return Type::None();
+Type Typer::Visitor::TypeProjection(Node* node) {
+  Type const type = Operand(node, 0);
+  if (type.Is(Type::None())) return Type::None();
   int const index = static_cast<int>(ProjectionIndexOf(node->op()));
-  if (type->IsTuple() && index < type->AsTuple()->Arity()) {
-    return type->AsTuple()->Element(index);
+  if (type.IsTuple() && index < type.AsTuple()->Arity()) {
+    return type.AsTuple()->Element(index);
   }
   return Type::Any();
 }
 
-Type* Typer::Visitor::TypeMapGuard(Node* node) { UNREACHABLE(); }
+Type Typer::Visitor::TypeMapGuard(Node* node) { UNREACHABLE(); }
 
-Type* Typer::Visitor::TypeTypeGuard(Node* node) {
-  Type* const type = Operand(node, 0);
+Type Typer::Visitor::TypeTypeGuard(Node* node) {
+  Type const type = Operand(node, 0);
   return typer_->operation_typer()->TypeTypeGuard(node->op(), type);
 }
 
-Type* Typer::Visitor::TypeDead(Node* node) { return Type::None(); }
+Type Typer::Visitor::TypeDead(Node* node) { return Type::None(); }
 
-Type* Typer::Visitor::TypeDeadValue(Node* node) { return Type::None(); }
+Type Typer::Visitor::TypeDeadValue(Node* node) { return Type::None(); }
 
-Type* Typer::Visitor::TypeUnreachable(Node* node) { return Type::None(); }
+Type Typer::Visitor::TypeUnreachable(Node* node) { return Type::None(); }
 
 // JS comparison operators.
 
-
-Type* Typer::Visitor::JSEqualTyper(Type* lhs, Type* rhs, Typer* t) {
-  if (lhs->Is(Type::NaN()) || rhs->Is(Type::NaN())) return t->singleton_false_;
-  if (lhs->Is(Type::NullOrUndefined()) && rhs->Is(Type::NullOrUndefined())) {
+Type Typer::Visitor::JSEqualTyper(Type lhs, Type rhs, Typer* t) {
+  if (lhs.Is(Type::NaN()) || rhs.Is(Type::NaN())) return t->singleton_false_;
+  if (lhs.Is(Type::NullOrUndefined()) && rhs.Is(Type::NullOrUndefined())) {
     return t->singleton_true_;
   }
-  if (lhs->Is(Type::Number()) && rhs->Is(Type::Number()) &&
-      (lhs->Max() < rhs->Min() || lhs->Min() > rhs->Max())) {
+  if (lhs.Is(Type::Number()) && rhs.Is(Type::Number()) &&
+      (lhs.Max() < rhs.Min() || lhs.Min() > rhs.Max())) {
     return t->singleton_false_;
   }
-  if (lhs->IsHeapConstant() && rhs->Is(lhs)) {
+  if (lhs.IsHeapConstant() && rhs.Is(lhs)) {
     // Types are equal and are inhabited only by a single semantic value,
     // which is not nan due to the earlier check.
     return t->singleton_true_;
@@ -987,7 +942,7 @@ Type* Typer::Visitor::JSEqualTyper(Type* lhs, Type* rhs, Typer* t) {
   return Type::Boolean();
 }
 
-Type* Typer::Visitor::JSStrictEqualTyper(Type* lhs, Type* rhs, Typer* t) {
+Type Typer::Visitor::JSStrictEqualTyper(Type lhs, Type rhs, Typer* t) {
   return t->operation_typer()->StrictEqual(lhs, rhs);
 }
 
@@ -995,18 +950,18 @@ Type* Typer::Visitor::JSStrictEqualTyper(Type* lhs, Type* rhs, Typer* t) {
 // (<, <=, >=, >) with the help of a single abstract one.  It behaves like <
 // but returns undefined when the inputs cannot be compared.
 // We implement the typing analogously.
-Typer::Visitor::ComparisonOutcome Typer::Visitor::JSCompareTyper(Type* lhs,
-                                                                 Type* rhs,
+Typer::Visitor::ComparisonOutcome Typer::Visitor::JSCompareTyper(Type lhs,
+                                                                 Type rhs,
                                                                  Typer* t) {
   lhs = ToPrimitive(lhs, t);
   rhs = ToPrimitive(rhs, t);
-  if (lhs->Maybe(Type::String()) && rhs->Maybe(Type::String())) {
+  if (lhs.Maybe(Type::String()) && rhs.Maybe(Type::String())) {
     return ComparisonOutcome(kComparisonTrue) |
            ComparisonOutcome(kComparisonFalse);
   }
   lhs = ToNumeric(lhs, t);
   rhs = ToNumeric(rhs, t);
-  if (lhs->Is(Type::Number()) && rhs->Is(Type::Number())) {
+  if (lhs.Is(Type::Number()) && rhs.Is(Type::Number())) {
     return NumberCompareTyper(lhs, rhs, t);
   }
   return ComparisonOutcome(kComparisonTrue) |
@@ -1014,22 +969,22 @@ Typer::Visitor::ComparisonOutcome Typer::Visitor::JSCompareTyper(Type* lhs,
          ComparisonOutcome(kComparisonUndefined);
 }
 
-Typer::Visitor::ComparisonOutcome Typer::Visitor::NumberCompareTyper(Type* lhs,
-                                                                     Type* rhs,
+Typer::Visitor::ComparisonOutcome Typer::Visitor::NumberCompareTyper(Type lhs,
+                                                                     Type rhs,
                                                                      Typer* t) {
-  DCHECK(lhs->Is(Type::Number()));
-  DCHECK(rhs->Is(Type::Number()));
+  DCHECK(lhs.Is(Type::Number()));
+  DCHECK(rhs.Is(Type::Number()));
 
   // Shortcut for NaNs.
-  if (lhs->Is(Type::NaN()) || rhs->Is(Type::NaN())) return kComparisonUndefined;
+  if (lhs.Is(Type::NaN()) || rhs.Is(Type::NaN())) return kComparisonUndefined;
 
   ComparisonOutcome result;
-  if (lhs->IsHeapConstant() && rhs->Is(lhs)) {
+  if (lhs.IsHeapConstant() && rhs.Is(lhs)) {
     // Types are equal and are inhabited only by a single semantic value.
     result = kComparisonFalse;
-  } else if (lhs->Min() >= rhs->Max()) {
+  } else if (lhs.Min() >= rhs.Max()) {
     result = kComparisonFalse;
-  } else if (lhs->Max() < rhs->Min()) {
+  } else if (lhs.Max() < rhs.Min()) {
     result = kComparisonTrue;
   } else {
     // We cannot figure out the result, return both true and false. (We do not
@@ -1039,69 +994,62 @@ Typer::Visitor::ComparisonOutcome Typer::Visitor::NumberCompareTyper(Type* lhs,
            ComparisonOutcome(kComparisonFalse);
   }
   // Add the undefined if we could see NaN.
-  if (lhs->Maybe(Type::NaN()) || rhs->Maybe(Type::NaN())) {
+  if (lhs.Maybe(Type::NaN()) || rhs.Maybe(Type::NaN())) {
     result |= kComparisonUndefined;
   }
   return result;
 }
 
-
-Type* Typer::Visitor::JSLessThanTyper(Type* lhs, Type* rhs, Typer* t) {
+Type Typer::Visitor::JSLessThanTyper(Type lhs, Type rhs, Typer* t) {
   return FalsifyUndefined(JSCompareTyper(lhs, rhs, t), t);
 }
 
-
-Type* Typer::Visitor::JSGreaterThanTyper(Type* lhs, Type* rhs, Typer* t) {
+Type Typer::Visitor::JSGreaterThanTyper(Type lhs, Type rhs, Typer* t) {
   return FalsifyUndefined(JSCompareTyper(rhs, lhs, t), t);
 }
 
-
-Type* Typer::Visitor::JSLessThanOrEqualTyper(Type* lhs, Type* rhs, Typer* t) {
+Type Typer::Visitor::JSLessThanOrEqualTyper(Type lhs, Type rhs, Typer* t) {
   return FalsifyUndefined(Invert(JSCompareTyper(rhs, lhs, t), t), t);
 }
 
-
-Type* Typer::Visitor::JSGreaterThanOrEqualTyper(
-    Type* lhs, Type* rhs, Typer* t) {
+Type Typer::Visitor::JSGreaterThanOrEqualTyper(Type lhs, Type rhs, Typer* t) {
   return FalsifyUndefined(Invert(JSCompareTyper(lhs, rhs, t), t), t);
 }
 
 // JS bitwise operators.
 
-
-Type* Typer::Visitor::JSBitwiseOrTyper(Type* lhs, Type* rhs, Typer* t) {
+Type Typer::Visitor::JSBitwiseOrTyper(Type lhs, Type rhs, Typer* t) {
   return BinaryNumberOpTyper(lhs, rhs, t, NumberBitwiseOr);
 }
 
-Type* Typer::Visitor::JSBitwiseAndTyper(Type* lhs, Type* rhs, Typer* t) {
+Type Typer::Visitor::JSBitwiseAndTyper(Type lhs, Type rhs, Typer* t) {
   return BinaryNumberOpTyper(lhs, rhs, t, NumberBitwiseAnd);
 }
 
-Type* Typer::Visitor::JSBitwiseXorTyper(Type* lhs, Type* rhs, Typer* t) {
+Type Typer::Visitor::JSBitwiseXorTyper(Type lhs, Type rhs, Typer* t) {
   return BinaryNumberOpTyper(lhs, rhs, t, NumberBitwiseXor);
 }
 
-Type* Typer::Visitor::JSShiftLeftTyper(Type* lhs, Type* rhs, Typer* t) {
+Type Typer::Visitor::JSShiftLeftTyper(Type lhs, Type rhs, Typer* t) {
   return BinaryNumberOpTyper(lhs, rhs, t, NumberShiftLeft);
 }
 
-Type* Typer::Visitor::JSShiftRightTyper(Type* lhs, Type* rhs, Typer* t) {
+Type Typer::Visitor::JSShiftRightTyper(Type lhs, Type rhs, Typer* t) {
   return BinaryNumberOpTyper(lhs, rhs, t, NumberShiftRight);
 }
 
-
-Type* Typer::Visitor::JSShiftRightLogicalTyper(Type* lhs, Type* rhs, Typer* t) {
+Type Typer::Visitor::JSShiftRightLogicalTyper(Type lhs, Type rhs, Typer* t) {
   return NumberShiftRightLogical(ToNumber(lhs, t), ToNumber(rhs, t), t);
 }
 
 
 // JS arithmetic operators.
 
-Type* Typer::Visitor::JSAddTyper(Type* lhs, Type* rhs, Typer* t) {
+Type Typer::Visitor::JSAddTyper(Type lhs, Type rhs, Typer* t) {
   lhs = ToPrimitive(lhs, t);
   rhs = ToPrimitive(rhs, t);
-  if (lhs->Maybe(Type::String()) || rhs->Maybe(Type::String())) {
-    if (lhs->Is(Type::String()) || rhs->Is(Type::String())) {
+  if (lhs.Maybe(Type::String()) || rhs.Maybe(Type::String())) {
+    if (lhs.Is(Type::String()) || rhs.Is(Type::String())) {
       return Type::String();
     } else {
       return Type::NumericOrString();
@@ -1111,91 +1059,89 @@ Type* Typer::Visitor::JSAddTyper(Type* lhs, Type* rhs, Typer* t) {
   return BinaryNumberOpTyper(lhs, rhs, t, NumberAdd);
 }
 
-Type* Typer::Visitor::JSSubtractTyper(Type* lhs, Type* rhs, Typer* t) {
+Type Typer::Visitor::JSSubtractTyper(Type lhs, Type rhs, Typer* t) {
   return BinaryNumberOpTyper(lhs, rhs, t, NumberSubtract);
 }
 
-Type* Typer::Visitor::JSMultiplyTyper(Type* lhs, Type* rhs, Typer* t) {
+Type Typer::Visitor::JSMultiplyTyper(Type lhs, Type rhs, Typer* t) {
   return BinaryNumberOpTyper(lhs, rhs, t, NumberMultiply);
 }
 
-Type* Typer::Visitor::JSDivideTyper(Type* lhs, Type* rhs, Typer* t) {
+Type Typer::Visitor::JSDivideTyper(Type lhs, Type rhs, Typer* t) {
   return BinaryNumberOpTyper(lhs, rhs, t, NumberDivide);
 }
 
-Type* Typer::Visitor::JSModulusTyper(Type* lhs, Type* rhs, Typer* t) {
+Type Typer::Visitor::JSModulusTyper(Type lhs, Type rhs, Typer* t) {
   return BinaryNumberOpTyper(lhs, rhs, t, NumberModulus);
 }
 
-Type* Typer::Visitor::JSExponentiateTyper(Type* lhs, Type* rhs, Typer* t) {
+Type Typer::Visitor::JSExponentiateTyper(Type lhs, Type rhs, Typer* t) {
   // TODO(neis): Refine using BinaryNumberOpTyper?
   return Type::Numeric();
 }
 
 // JS unary operators.
 
-Type* Typer::Visitor::TypeJSBitwiseNot(Node* node) {
+Type Typer::Visitor::TypeJSBitwiseNot(Node* node) {
   return TypeUnaryOp(node, BitwiseNot);
 }
 
-Type* Typer::Visitor::TypeJSDecrement(Node* node) {
+Type Typer::Visitor::TypeJSDecrement(Node* node) {
   return TypeUnaryOp(node, Decrement);
 }
 
-Type* Typer::Visitor::TypeJSIncrement(Node* node) {
+Type Typer::Visitor::TypeJSIncrement(Node* node) {
   return TypeUnaryOp(node, Increment);
 }
 
-Type* Typer::Visitor::TypeJSNegate(Node* node) {
+Type Typer::Visitor::TypeJSNegate(Node* node) {
   return TypeUnaryOp(node, Negate);
 }
 
-Type* Typer::Visitor::TypeTypeOf(Node* node) {
+Type Typer::Visitor::TypeTypeOf(Node* node) {
   return Type::InternalizedString();
 }
 
 
 // JS conversion operators.
 
-Type* Typer::Visitor::TypeToBoolean(Node* node) {
+Type Typer::Visitor::TypeToBoolean(Node* node) {
   return TypeUnaryOp(node, ToBoolean);
 }
 
-Type* Typer::Visitor::TypeJSToInteger(Node* node) {
+Type Typer::Visitor::TypeJSToInteger(Node* node) {
   return TypeUnaryOp(node, ToInteger);
 }
 
-Type* Typer::Visitor::TypeJSToLength(Node* node) {
+Type Typer::Visitor::TypeJSToLength(Node* node) {
   return TypeUnaryOp(node, ToLength);
 }
 
-Type* Typer::Visitor::TypeJSToName(Node* node) {
+Type Typer::Visitor::TypeJSToName(Node* node) {
   return TypeUnaryOp(node, ToName);
 }
 
-Type* Typer::Visitor::TypeJSToNumber(Node* node) {
+Type Typer::Visitor::TypeJSToNumber(Node* node) {
   return TypeUnaryOp(node, ToNumber);
 }
 
-Type* Typer::Visitor::TypeJSToNumeric(Node* node) {
+Type Typer::Visitor::TypeJSToNumeric(Node* node) {
   return TypeUnaryOp(node, ToNumeric);
 }
 
-Type* Typer::Visitor::TypeJSToObject(Node* node) {
+Type Typer::Visitor::TypeJSToObject(Node* node) {
   return TypeUnaryOp(node, ToObject);
 }
 
-Type* Typer::Visitor::TypeJSToString(Node* node) {
+Type Typer::Visitor::TypeJSToString(Node* node) {
   return TypeUnaryOp(node, ToString);
 }
 
 // JS object operators.
 
+Type Typer::Visitor::TypeJSCreate(Node* node) { return Type::Object(); }
 
-Type* Typer::Visitor::TypeJSCreate(Node* node) { return Type::Object(); }
-
-
-Type* Typer::Visitor::TypeJSCreateArguments(Node* node) {
+Type Typer::Visitor::TypeJSCreateArguments(Node* node) {
   switch (CreateArgumentsTypeOf(node->op())) {
     case CreateArgumentsType::kRestParameter:
       return Type::Array();
@@ -1206,90 +1152,92 @@ Type* Typer::Visitor::TypeJSCreateArguments(Node* node) {
   UNREACHABLE();
 }
 
-Type* Typer::Visitor::TypeJSCreateArray(Node* node) { return Type::Array(); }
+Type Typer::Visitor::TypeJSCreateArray(Node* node) { return Type::Array(); }
 
-Type* Typer::Visitor::TypeJSCreateArrayIterator(Node* node) {
+Type Typer::Visitor::TypeJSCreateArrayIterator(Node* node) {
   return Type::OtherObject();
 }
 
-Type* Typer::Visitor::TypeJSCreateCollectionIterator(Node* node) {
+Type Typer::Visitor::TypeJSCreateCollectionIterator(Node* node) {
   return Type::OtherObject();
 }
 
-Type* Typer::Visitor::TypeJSCreateBoundFunction(Node* node) {
+Type Typer::Visitor::TypeJSCreateBoundFunction(Node* node) {
   return Type::BoundFunction();
 }
 
-Type* Typer::Visitor::TypeJSCreateGeneratorObject(Node* node) {
+Type Typer::Visitor::TypeJSCreateGeneratorObject(Node* node) {
   return Type::OtherObject();
 }
 
-Type* Typer::Visitor::TypeJSCreateClosure(Node* node) {
+Type Typer::Visitor::TypeJSCreateClosure(Node* node) {
   return Type::Function();
 }
 
+Type Typer::Visitor::TypeJSCreateIterResultObject(Node* node) {
+  return Type::OtherObject();
+}
 
-Type* Typer::Visitor::TypeJSCreateIterResultObject(Node* node) {
+Type Typer::Visitor::TypeJSCreateStringIterator(Node* node) {
   return Type::OtherObject();
 }
 
-Type* Typer::Visitor::TypeJSCreateStringIterator(Node* node) {
+Type Typer::Visitor::TypeJSCreateKeyValueArray(Node* node) {
   return Type::OtherObject();
 }
 
-Type* Typer::Visitor::TypeJSCreateKeyValueArray(Node* node) {
+Type Typer::Visitor::TypeJSCreateObject(Node* node) {
   return Type::OtherObject();
 }
 
-Type* Typer::Visitor::TypeJSCreatePromise(Node* node) {
+Type Typer::Visitor::TypeJSCreatePromise(Node* node) {
   return Type::OtherObject();
 }
 
-Type* Typer::Visitor::TypeJSCreateTypedArray(Node* node) {
+Type Typer::Visitor::TypeJSCreateTypedArray(Node* node) {
   return Type::OtherObject();
 }
 
-Type* Typer::Visitor::TypeJSCreateLiteralArray(Node* node) {
+Type Typer::Visitor::TypeJSCreateLiteralArray(Node* node) {
   return Type::Array();
 }
 
-Type* Typer::Visitor::TypeJSCreateEmptyLiteralArray(Node* node) {
+Type Typer::Visitor::TypeJSCreateEmptyLiteralArray(Node* node) {
   return Type::Array();
 }
 
-Type* Typer::Visitor::TypeJSCreateLiteralObject(Node* node) {
+Type Typer::Visitor::TypeJSCreateLiteralObject(Node* node) {
   return Type::OtherObject();
 }
 
-Type* Typer::Visitor::TypeJSCreateEmptyLiteralObject(Node* node) {
+Type Typer::Visitor::TypeJSCreateEmptyLiteralObject(Node* node) {
   return Type::OtherObject();
 }
 
-Type* Typer::Visitor::TypeJSCreateLiteralRegExp(Node* node) {
+Type Typer::Visitor::TypeJSCreateLiteralRegExp(Node* node) {
   return Type::OtherObject();
 }
 
-
-Type* Typer::Visitor::TypeJSLoadProperty(Node* node) {
+Type Typer::Visitor::TypeJSLoadProperty(Node* node) {
   return Type::NonInternal();
 }
 
+Type Typer::Visitor::TypeJSLoadNamed(Node* node) { return Type::NonInternal(); }
 
-Type* Typer::Visitor::TypeJSLoadNamed(Node* node) {
+Type Typer::Visitor::TypeJSLoadGlobal(Node* node) {
   return Type::NonInternal();
 }
 
-Type* Typer::Visitor::TypeJSLoadGlobal(Node* node) {
-  return Type::NonInternal();
-}
+Type Typer::Visitor::TypeJSParseInt(Node* node) { return Type::Number(); }
+
+Type Typer::Visitor::TypeJSRegExpTest(Node* node) { return Type::Boolean(); }
 
 // Returns a somewhat larger range if we previously assigned
 // a (smaller) range to this node. This is used  to speed up
 // the fixpoint calculation in case there appears to be a loop
 // in the graph. In the current implementation, we are
 // increasing the limits to the closest power of two.
-Type* Typer::Visitor::Weaken(Node* node, Type* current_type,
-                             Type* previous_type) {
+Type Typer::Visitor::Weaken(Node* node, Type current_type, Type previous_type) {
   static const double kWeakenMinLimits[] = {
       0.0, -1073741824.0, -2147483648.0, -4294967296.0, -8589934592.0,
       -17179869184.0, -34359738368.0, -68719476736.0, -137438953472.0,
@@ -1307,34 +1255,34 @@ Type* Typer::Visitor::Weaken(Node* node, Type* current_type,
   STATIC_ASSERT(arraysize(kWeakenMinLimits) == arraysize(kWeakenMaxLimits));
 
   // If the types have nothing to do with integers, return the types.
-  Type* const integer = typer_->cache_.kInteger;
-  if (!previous_type->Maybe(integer)) {
+  Type const integer = typer_->cache_.kInteger;
+  if (!previous_type.Maybe(integer)) {
     return current_type;
   }
-  DCHECK(current_type->Maybe(integer));
+  DCHECK(current_type.Maybe(integer));
 
-  Type* current_integer = Type::Intersect(current_type, integer, zone());
-  Type* previous_integer = Type::Intersect(previous_type, integer, zone());
+  Type current_integer = Type::Intersect(current_type, integer, zone());
+  Type previous_integer = Type::Intersect(previous_type, integer, zone());
 
   // Once we start weakening a node, we should always weaken.
   if (!IsWeakened(node->id())) {
     // Only weaken if there is range involved; we should converge quickly
     // for all other types (the exception is a union of many constants,
     // but we currently do not increase the number of constants in unions).
-    Type* previous = previous_integer->GetRange();
-    Type* current = current_integer->GetRange();
-    if (current == nullptr || previous == nullptr) {
+    Type previous = previous_integer.GetRange();
+    Type current = current_integer.GetRange();
+    if (current.IsInvalid() || previous.IsInvalid()) {
       return current_type;
     }
     // Range is involved => we are weakening.
     SetWeakened(node->id());
   }
 
-  double current_min = current_integer->Min();
+  double current_min = current_integer.Min();
   double new_min = current_min;
   // Find the closest lower entry in the list of allowed
   // minima (or negative infinity if there is no such entry).
-  if (current_min != previous_integer->Min()) {
+  if (current_min != previous_integer.Min()) {
     new_min = -V8_INFINITY;
     for (double const min : kWeakenMinLimits) {
       if (min <= current_min) {
@@ -1344,11 +1292,11 @@ Type* Typer::Visitor::Weaken(Node* node, Type* current_type,
     }
   }
 
-  double current_max = current_integer->Max();
+  double current_max = current_integer.Max();
   double new_max = current_max;
   // Find the closest greater entry in the list of allowed
   // maxima (or infinity if there is no such entry).
-  if (current_max != previous_integer->Max()) {
+  if (current_max != previous_integer.Max()) {
     new_max = V8_INFINITY;
     for (double const max : kWeakenMaxLimits) {
       if (max >= current_max) {
@@ -1363,405 +1311,390 @@ Type* Typer::Visitor::Weaken(Node* node, Type* current_type,
                      typer_->zone());
 }
 
+Type Typer::Visitor::TypeJSStoreProperty(Node* node) { UNREACHABLE(); }
 
-Type* Typer::Visitor::TypeJSStoreProperty(Node* node) {
-  UNREACHABLE();
-}
+Type Typer::Visitor::TypeJSStoreNamed(Node* node) { UNREACHABLE(); }
 
+Type Typer::Visitor::TypeJSStoreGlobal(Node* node) { UNREACHABLE(); }
 
-Type* Typer::Visitor::TypeJSStoreNamed(Node* node) {
-  UNREACHABLE();
-}
-
+Type Typer::Visitor::TypeJSStoreNamedOwn(Node* node) { UNREACHABLE(); }
 
-Type* Typer::Visitor::TypeJSStoreGlobal(Node* node) {
+Type Typer::Visitor::TypeJSStoreDataPropertyInLiteral(Node* node) {
   UNREACHABLE();
 }
 
-Type* Typer::Visitor::TypeJSStoreNamedOwn(Node* node) {
-  UNREACHABLE();
-}
+Type Typer::Visitor::TypeJSStoreInArrayLiteral(Node* node) { UNREACHABLE(); }
 
-Type* Typer::Visitor::TypeJSStoreDataPropertyInLiteral(Node* node) {
-  UNREACHABLE();
-}
-
-Type* Typer::Visitor::TypeJSStoreInArrayLiteral(Node* node) { UNREACHABLE(); }
-
-Type* Typer::Visitor::TypeJSDeleteProperty(Node* node) {
+Type Typer::Visitor::TypeJSDeleteProperty(Node* node) {
   return Type::Boolean();
 }
 
-Type* Typer::Visitor::TypeJSHasProperty(Node* node) { return Type::Boolean(); }
+Type Typer::Visitor::TypeJSHasProperty(Node* node) { return Type::Boolean(); }
 
 // JS instanceof operator.
 
-Type* Typer::Visitor::JSHasInPrototypeChainTyper(Type* lhs, Type* rhs,
-                                                 Typer* t) {
+Type Typer::Visitor::JSHasInPrototypeChainTyper(Type lhs, Type rhs, Typer* t) {
   return Type::Boolean();
 }
 
-Type* Typer::Visitor::JSInstanceOfTyper(Type* lhs, Type* rhs, Typer* t) {
+Type Typer::Visitor::JSInstanceOfTyper(Type lhs, Type rhs, Typer* t) {
   return Type::Boolean();
 }
 
-Type* Typer::Visitor::JSOrdinaryHasInstanceTyper(Type* lhs, Type* rhs,
-                                                 Typer* t) {
+Type Typer::Visitor::JSOrdinaryHasInstanceTyper(Type lhs, Type rhs, Typer* t) {
   return Type::Boolean();
 }
 
-Type* Typer::Visitor::TypeJSGetSuperConstructor(Node* node) {
+Type Typer::Visitor::TypeJSGetSuperConstructor(Node* node) {
   return Type::Callable();
 }
 
 // JS context operators.
 
-
-Type* Typer::Visitor::TypeJSLoadContext(Node* node) {
+Type Typer::Visitor::TypeJSLoadContext(Node* node) {
   ContextAccess const& access = ContextAccessOf(node->op());
   switch (access.index()) {
     case Context::PREVIOUS_INDEX:
     case Context::NATIVE_CONTEXT_INDEX:
+    case Context::SCOPE_INFO_INDEX:
       return Type::OtherInternal();
-    case Context::CLOSURE_INDEX:
-      return Type::Function();
     default:
       return Type::Any();
   }
 }
 
+Type Typer::Visitor::TypeJSStoreContext(Node* node) { UNREACHABLE(); }
 
-Type* Typer::Visitor::TypeJSStoreContext(Node* node) {
-  UNREACHABLE();
-}
-
-
-Type* Typer::Visitor::TypeJSCreateFunctionContext(Node* node) {
+Type Typer::Visitor::TypeJSCreateFunctionContext(Node* node) {
   return Type::OtherInternal();
 }
 
-Type* Typer::Visitor::TypeJSCreateCatchContext(Node* node) {
+Type Typer::Visitor::TypeJSCreateCatchContext(Node* node) {
   return Type::OtherInternal();
 }
 
-Type* Typer::Visitor::TypeJSCreateWithContext(Node* node) {
+Type Typer::Visitor::TypeJSCreateWithContext(Node* node) {
   return Type::OtherInternal();
 }
 
-Type* Typer::Visitor::TypeJSCreateBlockContext(Node* node) {
+Type Typer::Visitor::TypeJSCreateBlockContext(Node* node) {
   return Type::OtherInternal();
 }
 
 // JS other operators.
 
-Type* Typer::Visitor::TypeJSConstructForwardVarargs(Node* node) {
+Type Typer::Visitor::TypeJSConstructForwardVarargs(Node* node) {
   return Type::Receiver();
 }
 
-Type* Typer::Visitor::TypeJSConstruct(Node* node) { return Type::Receiver(); }
+Type Typer::Visitor::TypeJSConstruct(Node* node) { return Type::Receiver(); }
 
-Type* Typer::Visitor::TypeJSConstructWithArrayLike(Node* node) {
+Type Typer::Visitor::TypeJSConstructWithArrayLike(Node* node) {
   return Type::Receiver();
 }
 
-Type* Typer::Visitor::TypeJSConstructWithSpread(Node* node) {
+Type Typer::Visitor::TypeJSConstructWithSpread(Node* node) {
   return Type::Receiver();
 }
 
-Type* Typer::Visitor::JSCallTyper(Type* fun, Typer* t) {
-  if (fun->IsHeapConstant() && fun->AsHeapConstant()->Value()->IsJSFunction()) {
-    Handle<JSFunction> function =
-        Handle<JSFunction>::cast(fun->AsHeapConstant()->Value());
-    if (function->shared()->HasBuiltinFunctionId()) {
-      switch (function->shared()->builtin_function_id()) {
-        case kMathRandom:
-          return Type::PlainNumber();
-        case kMathFloor:
-        case kMathCeil:
-        case kMathRound:
-        case kMathTrunc:
-          return t->cache_.kIntegerOrMinusZeroOrNaN;
-        // Unary math functions.
-        case kMathAbs:
-        case kMathExp:
-        case kMathExpm1:
-          return Type::Union(Type::PlainNumber(), Type::NaN(), t->zone());
-        case kMathAcos:
-        case kMathAcosh:
-        case kMathAsin:
-        case kMathAsinh:
-        case kMathAtan:
-        case kMathAtanh:
-        case kMathCbrt:
-        case kMathCos:
-        case kMathFround:
-        case kMathLog:
-        case kMathLog1p:
-        case kMathLog10:
-        case kMathLog2:
-        case kMathSin:
-        case kMathSqrt:
-        case kMathTan:
-          return Type::Number();
-        case kMathSign:
-          return t->cache_.kMinusOneToOneOrMinusZeroOrNaN;
-        // Binary math functions.
-        case kMathAtan2:
-        case kMathPow:
-        case kMathMax:
-        case kMathMin:
-          return Type::Number();
-        case kMathImul:
-          return Type::Signed32();
-        case kMathClz32:
-          return t->cache_.kZeroToThirtyTwo;
-        // Date functions.
-        case kDateNow:
-          return t->cache_.kTimeValueType;
-        case kDateGetDate:
-          return t->cache_.kJSDateDayType;
-        case kDateGetDay:
-          return t->cache_.kJSDateWeekdayType;
-        case kDateGetFullYear:
-          return t->cache_.kJSDateYearType;
-        case kDateGetHours:
-          return t->cache_.kJSDateHourType;
-        case kDateGetMilliseconds:
-          return Type::Union(Type::Range(0.0, 999.0, t->zone()), Type::NaN(),
-                             t->zone());
-        case kDateGetMinutes:
-          return t->cache_.kJSDateMinuteType;
-        case kDateGetMonth:
-          return t->cache_.kJSDateMonthType;
-        case kDateGetSeconds:
-          return t->cache_.kJSDateSecondType;
-        case kDateGetTime:
-          return t->cache_.kJSDateValueType;
-
-        // Symbol functions.
-        case kSymbolConstructor:
-          return Type::Symbol();
-
-        // BigInt functions.
-        case kBigIntConstructor:
-          return Type::BigInt();
-
-        // Number functions.
-        case kNumberConstructor:
-          return Type::Number();
-        case kNumberIsFinite:
-        case kNumberIsInteger:
-        case kNumberIsNaN:
-        case kNumberIsSafeInteger:
-          return Type::Boolean();
-        case kNumberParseFloat:
-          return Type::Number();
-        case kNumberParseInt:
-          return t->cache_.kIntegerOrMinusZeroOrNaN;
-        case kNumberToString:
-          return Type::String();
-
-        // String functions.
-        case kStringConstructor:
-          return Type::String();
-        case kStringCharCodeAt:
-          return Type::Union(Type::Range(0, kMaxUInt16, t->zone()), Type::NaN(),
-                             t->zone());
-        case kStringCharAt:
-          return Type::String();
-        case kStringCodePointAt:
-          return Type::Union(Type::Range(0.0, String::kMaxCodePoint, t->zone()),
-                             Type::Undefined(), t->zone());
-        case kStringConcat:
-        case kStringFromCharCode:
-        case kStringFromCodePoint:
-          return Type::String();
-        case kStringIndexOf:
-        case kStringLastIndexOf:
-          return Type::Range(-1.0, String::kMaxLength, t->zone());
-        case kStringEndsWith:
-        case kStringIncludes:
-          return Type::Boolean();
-        case kStringRaw:
-        case kStringRepeat:
-        case kStringSlice:
-          return Type::String();
-        case kStringStartsWith:
-          return Type::Boolean();
-        case kStringSubstr:
-        case kStringSubstring:
-        case kStringToLowerCase:
-        case kStringToString:
-        case kStringToUpperCase:
-        case kStringTrim:
-        case kStringTrimEnd:
-        case kStringTrimStart:
-        case kStringValueOf:
-          return Type::String();
-
-        case kStringIterator:
-        case kStringIteratorNext:
-          return Type::OtherObject();
-
-        case kArrayEntries:
-        case kArrayKeys:
-        case kArrayValues:
-        case kTypedArrayEntries:
-        case kTypedArrayKeys:
-        case kTypedArrayValues:
-        case kArrayIteratorNext:
-        case kMapIteratorNext:
-        case kSetIteratorNext:
-          return Type::OtherObject();
-        case kTypedArrayToStringTag:
-          return Type::Union(Type::InternalizedString(), Type::Undefined(),
-                             t->zone());
-
-        // Array functions.
-        case kArrayIsArray:
-          return Type::Boolean();
-        case kArrayConcat:
-          return Type::Receiver();
-        case kArrayEvery:
-          return Type::Boolean();
-        case kArrayFill:
-        case kArrayFilter:
-          return Type::Receiver();
-        case kArrayFindIndex:
-          return Type::Range(-1, kMaxSafeInteger, t->zone());
-        case kArrayForEach:
-          return Type::Undefined();
-        case kArrayIncludes:
-          return Type::Boolean();
-        case kArrayIndexOf:
-          return Type::Range(-1, kMaxSafeInteger, t->zone());
-        case kArrayJoin:
-          return Type::String();
-        case kArrayLastIndexOf:
-          return Type::Range(-1, kMaxSafeInteger, t->zone());
-        case kArrayMap:
-          return Type::Receiver();
-        case kArrayPush:
-          return t->cache_.kPositiveSafeInteger;
-        case kArrayReverse:
-        case kArraySlice:
-          return Type::Receiver();
-        case kArraySome:
-          return Type::Boolean();
-        case kArraySplice:
-          return Type::Receiver();
-        case kArrayUnshift:
-          return t->cache_.kPositiveSafeInteger;
-
-        // ArrayBuffer functions.
-        case kArrayBufferIsView:
-          return Type::Boolean();
-
-        // Object functions.
-        case kObjectAssign:
-          return Type::Receiver();
-        case kObjectCreate:
-          return Type::OtherObject();
-        case kObjectIs:
-        case kObjectHasOwnProperty:
-        case kObjectIsPrototypeOf:
-          return Type::Boolean();
-        case kObjectToString:
-          return Type::String();
-
-        // RegExp functions.
-        case kRegExpCompile:
-          return Type::OtherObject();
-        case kRegExpExec:
-          return Type::Union(Type::Array(), Type::Null(), t->zone());
-        case kRegExpTest:
-          return Type::Boolean();
-        case kRegExpToString:
-          return Type::String();
-
-        // Function functions.
-        case kFunctionBind:
-          return Type::BoundFunction();
-        case kFunctionHasInstance:
-          return Type::Boolean();
-
-        // Global functions.
-        case kGlobalDecodeURI:
-        case kGlobalDecodeURIComponent:
-        case kGlobalEncodeURI:
-        case kGlobalEncodeURIComponent:
-        case kGlobalEscape:
-        case kGlobalUnescape:
-          return Type::String();
-        case kGlobalIsFinite:
-        case kGlobalIsNaN:
-          return Type::Boolean();
-
-        // Map functions.
-        case kMapClear:
-        case kMapForEach:
-          return Type::Undefined();
-        case kMapDelete:
-        case kMapHas:
-          return Type::Boolean();
-        case kMapEntries:
-        case kMapKeys:
-        case kMapSet:
-        case kMapValues:
-          return Type::OtherObject();
-
-        // Set functions.
-        case kSetAdd:
-        case kSetEntries:
-        case kSetValues:
-          return Type::OtherObject();
-        case kSetClear:
-        case kSetForEach:
-          return Type::Undefined();
-        case kSetDelete:
-        case kSetHas:
-          return Type::Boolean();
-
-        // WeakMap functions.
-        case kWeakMapDelete:
-        case kWeakMapHas:
-          return Type::Boolean();
-        case kWeakMapSet:
-          return Type::OtherObject();
-
-        // WeakSet functions.
-        case kWeakSetAdd:
-          return Type::OtherObject();
-        case kWeakSetDelete:
-        case kWeakSetHas:
-          return Type::Boolean();
-        default:
-          break;
-      }
-    }
+Type Typer::Visitor::TypeJSObjectIsArray(Node* node) { return Type::Boolean(); }
+
+Type Typer::Visitor::TypeDateNow(Node* node) { return Type::Number(); }
+
+Type Typer::Visitor::JSCallTyper(Type fun, Typer* t) {
+  if (!fun.IsHeapConstant() || !fun.AsHeapConstant()->Ref().IsJSFunction()) {
+    return Type::NonInternal();
+  }
+  JSFunctionRef function = fun.AsHeapConstant()->Ref().AsJSFunction();
+  if (!function.HasBuiltinFunctionId()) {
+    return Type::NonInternal();
+  }
+  switch (function.GetBuiltinFunctionId()) {
+    case kMathRandom:
+      return Type::PlainNumber();
+    case kMathFloor:
+    case kMathCeil:
+    case kMathRound:
+    case kMathTrunc:
+      return t->cache_.kIntegerOrMinusZeroOrNaN;
+    // Unary math functions.
+    case kMathAbs:
+    case kMathExp:
+    case kMathExpm1:
+      return Type::Union(Type::PlainNumber(), Type::NaN(), t->zone());
+    case kMathAcos:
+    case kMathAcosh:
+    case kMathAsin:
+    case kMathAsinh:
+    case kMathAtan:
+    case kMathAtanh:
+    case kMathCbrt:
+    case kMathCos:
+    case kMathFround:
+    case kMathLog:
+    case kMathLog1p:
+    case kMathLog10:
+    case kMathLog2:
+    case kMathSin:
+    case kMathSqrt:
+    case kMathTan:
+      return Type::Number();
+    case kMathSign:
+      return t->cache_.kMinusOneToOneOrMinusZeroOrNaN;
+    // Binary math functions.
+    case kMathAtan2:
+    case kMathPow:
+    case kMathMax:
+    case kMathMin:
+      return Type::Number();
+    case kMathImul:
+      return Type::Signed32();
+    case kMathClz32:
+      return t->cache_.kZeroToThirtyTwo;
+    // Date functions.
+    case kDateNow:
+      return t->cache_.kTimeValueType;
+    case kDateGetDate:
+      return t->cache_.kJSDateDayType;
+    case kDateGetDay:
+      return t->cache_.kJSDateWeekdayType;
+    case kDateGetFullYear:
+      return t->cache_.kJSDateYearType;
+    case kDateGetHours:
+      return t->cache_.kJSDateHourType;
+    case kDateGetMilliseconds:
+      return Type::Union(Type::Range(0.0, 999.0, t->zone()), Type::NaN(),
+                         t->zone());
+    case kDateGetMinutes:
+      return t->cache_.kJSDateMinuteType;
+    case kDateGetMonth:
+      return t->cache_.kJSDateMonthType;
+    case kDateGetSeconds:
+      return t->cache_.kJSDateSecondType;
+    case kDateGetTime:
+      return t->cache_.kJSDateValueType;
+
+    // Symbol functions.
+    case kSymbolConstructor:
+      return Type::Symbol();
+
+    // BigInt functions.
+    case kBigIntConstructor:
+      return Type::BigInt();
+
+    // Number functions.
+    case kNumberConstructor:
+      return Type::Number();
+    case kNumberIsFinite:
+    case kNumberIsInteger:
+    case kNumberIsNaN:
+    case kNumberIsSafeInteger:
+      return Type::Boolean();
+    case kNumberParseFloat:
+      return Type::Number();
+    case kNumberParseInt:
+      return t->cache_.kIntegerOrMinusZeroOrNaN;
+    case kNumberToString:
+      return Type::String();
+
+    // String functions.
+    case kStringConstructor:
+      return Type::String();
+    case kStringCharCodeAt:
+      return Type::Union(Type::Range(0, kMaxUInt16, t->zone()), Type::NaN(),
+                         t->zone());
+    case kStringCharAt:
+      return Type::String();
+    case kStringCodePointAt:
+      return Type::Union(Type::Range(0.0, String::kMaxCodePoint, t->zone()),
+                         Type::Undefined(), t->zone());
+    case kStringConcat:
+    case kStringFromCharCode:
+    case kStringFromCodePoint:
+      return Type::String();
+    case kStringIndexOf:
+    case kStringLastIndexOf:
+      return Type::Range(-1.0, String::kMaxLength, t->zone());
+    case kStringEndsWith:
+    case kStringIncludes:
+      return Type::Boolean();
+    case kStringRaw:
+    case kStringRepeat:
+    case kStringSlice:
+      return Type::String();
+    case kStringStartsWith:
+      return Type::Boolean();
+    case kStringSubstr:
+    case kStringSubstring:
+    case kStringToLowerCase:
+    case kStringToString:
+    case kStringToUpperCase:
+    case kStringTrim:
+    case kStringTrimEnd:
+    case kStringTrimStart:
+    case kStringValueOf:
+      return Type::String();
+
+    case kStringIterator:
+    case kStringIteratorNext:
+      return Type::OtherObject();
+
+    case kArrayEntries:
+    case kArrayKeys:
+    case kArrayValues:
+    case kTypedArrayEntries:
+    case kTypedArrayKeys:
+    case kTypedArrayValues:
+    case kArrayIteratorNext:
+    case kMapIteratorNext:
+    case kSetIteratorNext:
+      return Type::OtherObject();
+    case kTypedArrayToStringTag:
+      return Type::Union(Type::InternalizedString(), Type::Undefined(),
+                         t->zone());
+
+    // Array functions.
+    case kArrayIsArray:
+      return Type::Boolean();
+    case kArrayConcat:
+      return Type::Receiver();
+    case kArrayEvery:
+      return Type::Boolean();
+    case kArrayFill:
+    case kArrayFilter:
+      return Type::Receiver();
+    case kArrayFindIndex:
+      return Type::Range(-1, kMaxSafeInteger, t->zone());
+    case kArrayForEach:
+      return Type::Undefined();
+    case kArrayIncludes:
+      return Type::Boolean();
+    case kArrayIndexOf:
+      return Type::Range(-1, kMaxSafeInteger, t->zone());
+    case kArrayJoin:
+      return Type::String();
+    case kArrayLastIndexOf:
+      return Type::Range(-1, kMaxSafeInteger, t->zone());
+    case kArrayMap:
+      return Type::Receiver();
+    case kArrayPush:
+      return t->cache_.kPositiveSafeInteger;
+    case kArrayReverse:
+    case kArraySlice:
+      return Type::Receiver();
+    case kArraySome:
+      return Type::Boolean();
+    case kArraySplice:
+      return Type::Receiver();
+    case kArrayUnshift:
+      return t->cache_.kPositiveSafeInteger;
+
+    // ArrayBuffer functions.
+    case kArrayBufferIsView:
+      return Type::Boolean();
+
+    // Object functions.
+    case kObjectAssign:
+      return Type::Receiver();
+    case kObjectCreate:
+      return Type::OtherObject();
+    case kObjectIs:
+    case kObjectHasOwnProperty:
+    case kObjectIsPrototypeOf:
+      return Type::Boolean();
+    case kObjectToString:
+      return Type::String();
+
+    // RegExp functions.
+    case kRegExpCompile:
+      return Type::OtherObject();
+    case kRegExpExec:
+      return Type::Union(Type::Array(), Type::Null(), t->zone());
+    case kRegExpTest:
+      return Type::Boolean();
+    case kRegExpToString:
+      return Type::String();
+
+    // Function functions.
+    case kFunctionBind:
+      return Type::BoundFunction();
+    case kFunctionHasInstance:
+      return Type::Boolean();
+
+    // Global functions.
+    case kGlobalDecodeURI:
+    case kGlobalDecodeURIComponent:
+    case kGlobalEncodeURI:
+    case kGlobalEncodeURIComponent:
+    case kGlobalEscape:
+    case kGlobalUnescape:
+      return Type::String();
+    case kGlobalIsFinite:
+    case kGlobalIsNaN:
+      return Type::Boolean();
+
+    // Map functions.
+    case kMapClear:
+    case kMapForEach:
+      return Type::Undefined();
+    case kMapDelete:
+    case kMapHas:
+      return Type::Boolean();
+    case kMapEntries:
+    case kMapKeys:
+    case kMapSet:
+    case kMapValues:
+      return Type::OtherObject();
+
+    // Set functions.
+    case kSetAdd:
+    case kSetEntries:
+    case kSetValues:
+      return Type::OtherObject();
+    case kSetClear:
+    case kSetForEach:
+      return Type::Undefined();
+    case kSetDelete:
+    case kSetHas:
+      return Type::Boolean();
+
+    // WeakMap functions.
+    case kWeakMapDelete:
+    case kWeakMapHas:
+      return Type::Boolean();
+    case kWeakMapSet:
+      return Type::OtherObject();
+
+    // WeakSet functions.
+    case kWeakSetAdd:
+      return Type::OtherObject();
+    case kWeakSetDelete:
+    case kWeakSetHas:
+      return Type::Boolean();
+    default:
+      return Type::NonInternal();
   }
-  return Type::NonInternal();
 }
 
-Type* Typer::Visitor::TypeJSCallForwardVarargs(Node* node) {
+Type Typer::Visitor::TypeJSCallForwardVarargs(Node* node) {
   return TypeUnaryOp(node, JSCallTyper);
 }
 
-Type* Typer::Visitor::TypeJSCall(Node* node) {
+Type Typer::Visitor::TypeJSCall(Node* node) {
   // TODO(bmeurer): We could infer better types if we wouldn't ignore the
   // argument types for the JSCallTyper above.
   return TypeUnaryOp(node, JSCallTyper);
 }
 
-Type* Typer::Visitor::TypeJSCallWithArrayLike(Node* node) {
+Type Typer::Visitor::TypeJSCallWithArrayLike(Node* node) {
   return TypeUnaryOp(node, JSCallTyper);
 }
 
-Type* Typer::Visitor::TypeJSCallWithSpread(Node* node) {
+Type Typer::Visitor::TypeJSCallWithSpread(Node* node) {
   return TypeUnaryOp(node, JSCallTyper);
 }
 
-Type* Typer::Visitor::TypeJSCallRuntime(Node* node) {
+Type Typer::Visitor::TypeJSCallRuntime(Node* node) {
   switch (CallRuntimeParametersOf(node->op()).id()) {
     case Runtime::kInlineIsJSReceiver:
       return TypeUnaryOp(node, ObjectIsReceiver);
@@ -1797,325 +1730,309 @@ Type* Typer::Visitor::TypeJSCallRuntime(Node* node) {
   return Type::Any();
 }
 
-
-Type* Typer::Visitor::TypeJSForInEnumerate(Node* node) {
+Type Typer::Visitor::TypeJSForInEnumerate(Node* node) {
   return Type::OtherInternal();
 }
 
-Type* Typer::Visitor::TypeJSForInNext(Node* node) {
+Type Typer::Visitor::TypeJSForInNext(Node* node) {
   return Type::Union(Type::String(), Type::Undefined(), zone());
 }
 
-
-Type* Typer::Visitor::TypeJSForInPrepare(Node* node) {
+Type Typer::Visitor::TypeJSForInPrepare(Node* node) {
   STATIC_ASSERT(Map::EnumLengthBits::kMax <= FixedArray::kMaxLength);
-  Type* const cache_type =
+  Type const cache_type =
       Type::Union(Type::SignedSmall(), Type::OtherInternal(), zone());
-  Type* const cache_array = Type::OtherInternal();
-  Type* const cache_length = typer_->cache_.kFixedArrayLengthType;
+  Type const cache_array = Type::OtherInternal();
+  Type const cache_length = typer_->cache_.kFixedArrayLengthType;
   return Type::Tuple(cache_type, cache_array, cache_length, zone());
 }
 
+Type Typer::Visitor::TypeJSLoadMessage(Node* node) { return Type::Any(); }
 
-Type* Typer::Visitor::TypeJSLoadMessage(Node* node) { return Type::Any(); }
+Type Typer::Visitor::TypeJSStoreMessage(Node* node) { UNREACHABLE(); }
 
+Type Typer::Visitor::TypeJSLoadModule(Node* node) { return Type::Any(); }
 
-Type* Typer::Visitor::TypeJSStoreMessage(Node* node) {
-  UNREACHABLE();
-}
+Type Typer::Visitor::TypeJSStoreModule(Node* node) { UNREACHABLE(); }
 
-Type* Typer::Visitor::TypeJSLoadModule(Node* node) { return Type::Any(); }
+Type Typer::Visitor::TypeJSGeneratorStore(Node* node) { UNREACHABLE(); }
 
-Type* Typer::Visitor::TypeJSStoreModule(Node* node) {
-  UNREACHABLE();
-}
-
-Type* Typer::Visitor::TypeJSGeneratorStore(Node* node) {
-  UNREACHABLE();
-}
-
-Type* Typer::Visitor::TypeJSGeneratorRestoreContinuation(Node* node) {
+Type Typer::Visitor::TypeJSGeneratorRestoreContinuation(Node* node) {
   return Type::SignedSmall();
 }
 
-Type* Typer::Visitor::TypeJSGeneratorRestoreContext(Node* node) {
+Type Typer::Visitor::TypeJSGeneratorRestoreContext(Node* node) {
   return Type::Any();
 }
 
-Type* Typer::Visitor::TypeJSGeneratorRestoreRegister(Node* node) {
+Type Typer::Visitor::TypeJSGeneratorRestoreRegister(Node* node) {
   return Type::Any();
 }
 
-Type* Typer::Visitor::TypeJSGeneratorRestoreInputOrDebugPos(Node* node) {
+Type Typer::Visitor::TypeJSGeneratorRestoreInputOrDebugPos(Node* node) {
   return Type::Any();
 }
 
-Type* Typer::Visitor::TypeJSStackCheck(Node* node) { return Type::Any(); }
+Type Typer::Visitor::TypeJSStackCheck(Node* node) { return Type::Any(); }
 
-Type* Typer::Visitor::TypeJSDebugger(Node* node) { return Type::Any(); }
+Type Typer::Visitor::TypeJSDebugger(Node* node) { return Type::Any(); }
 
-Type* Typer::Visitor::TypeJSFulfillPromise(Node* node) {
+Type Typer::Visitor::TypeJSFulfillPromise(Node* node) {
   return Type::Undefined();
 }
 
-Type* Typer::Visitor::TypeJSPerformPromiseThen(Node* node) {
+Type Typer::Visitor::TypeJSPerformPromiseThen(Node* node) {
   return Type::Receiver();
 }
 
-Type* Typer::Visitor::TypeJSPromiseResolve(Node* node) {
+Type Typer::Visitor::TypeJSPromiseResolve(Node* node) {
   return Type::Receiver();
 }
 
-Type* Typer::Visitor::TypeJSRejectPromise(Node* node) {
+Type Typer::Visitor::TypeJSRejectPromise(Node* node) {
   return Type::Undefined();
 }
 
-Type* Typer::Visitor::TypeJSResolvePromise(Node* node) {
+Type Typer::Visitor::TypeJSResolvePromise(Node* node) {
   return Type::Undefined();
 }
 
 // Simplified operators.
 
-Type* Typer::Visitor::TypeBooleanNot(Node* node) { return Type::Boolean(); }
+Type Typer::Visitor::TypeBooleanNot(Node* node) { return Type::Boolean(); }
 
 // static
-Type* Typer::Visitor::NumberEqualTyper(Type* lhs, Type* rhs, Typer* t) {
+Type Typer::Visitor::NumberEqualTyper(Type lhs, Type rhs, Typer* t) {
   return JSEqualTyper(ToNumber(lhs, t), ToNumber(rhs, t), t);
 }
 
 // static
-Type* Typer::Visitor::NumberLessThanTyper(Type* lhs, Type* rhs, Typer* t) {
+Type Typer::Visitor::NumberLessThanTyper(Type lhs, Type rhs, Typer* t) {
   return FalsifyUndefined(
       NumberCompareTyper(ToNumber(lhs, t), ToNumber(rhs, t), t), t);
 }
 
 // static
-Type* Typer::Visitor::NumberLessThanOrEqualTyper(Type* lhs, Type* rhs,
-                                                 Typer* t) {
+Type Typer::Visitor::NumberLessThanOrEqualTyper(Type lhs, Type rhs, Typer* t) {
   return FalsifyUndefined(
       Invert(JSCompareTyper(ToNumber(rhs, t), ToNumber(lhs, t), t), t), t);
 }
 
-Type* Typer::Visitor::TypeNumberEqual(Node* node) {
+Type Typer::Visitor::TypeNumberEqual(Node* node) {
   return TypeBinaryOp(node, NumberEqualTyper);
 }
 
-Type* Typer::Visitor::TypeNumberLessThan(Node* node) {
+Type Typer::Visitor::TypeNumberLessThan(Node* node) {
   return TypeBinaryOp(node, NumberLessThanTyper);
 }
 
-Type* Typer::Visitor::TypeNumberLessThanOrEqual(Node* node) {
+Type Typer::Visitor::TypeNumberLessThanOrEqual(Node* node) {
   return TypeBinaryOp(node, NumberLessThanOrEqualTyper);
 }
 
-Type* Typer::Visitor::TypeSpeculativeNumberEqual(Node* node) {
+Type Typer::Visitor::TypeSpeculativeNumberEqual(Node* node) {
   return TypeBinaryOp(node, NumberEqualTyper);
 }
 
-Type* Typer::Visitor::TypeSpeculativeNumberLessThan(Node* node) {
+Type Typer::Visitor::TypeSpeculativeNumberLessThan(Node* node) {
   return TypeBinaryOp(node, NumberLessThanTyper);
 }
 
-Type* Typer::Visitor::TypeSpeculativeNumberLessThanOrEqual(Node* node) {
+Type Typer::Visitor::TypeSpeculativeNumberLessThanOrEqual(Node* node) {
   return TypeBinaryOp(node, NumberLessThanOrEqualTyper);
 }
 
-Type* Typer::Visitor::TypeStringToNumber(Node* node) {
+Type Typer::Visitor::TypeStringToNumber(Node* node) {
   return TypeUnaryOp(node, ToNumber);
 }
 
-Type* Typer::Visitor::TypePlainPrimitiveToNumber(Node* node) {
+Type Typer::Visitor::TypePlainPrimitiveToNumber(Node* node) {
   return TypeUnaryOp(node, ToNumber);
 }
 
-Type* Typer::Visitor::TypePlainPrimitiveToWord32(Node* node) {
+Type Typer::Visitor::TypePlainPrimitiveToWord32(Node* node) {
   return Type::Integral32();
 }
 
-Type* Typer::Visitor::TypePlainPrimitiveToFloat64(Node* node) {
+Type Typer::Visitor::TypePlainPrimitiveToFloat64(Node* node) {
   return Type::Number();
 }
 
 // static
-Type* Typer::Visitor::ReferenceEqualTyper(Type* lhs, Type* rhs, Typer* t) {
-  if (lhs->IsHeapConstant() && rhs->Is(lhs)) {
+Type Typer::Visitor::ReferenceEqualTyper(Type lhs, Type rhs, Typer* t) {
+  if (lhs.IsHeapConstant() && rhs.Is(lhs)) {
     return t->singleton_true_;
   }
   return Type::Boolean();
 }
 
-
-Type* Typer::Visitor::TypeReferenceEqual(Node* node) {
+Type Typer::Visitor::TypeReferenceEqual(Node* node) {
   return TypeBinaryOp(node, ReferenceEqualTyper);
 }
 
 // static
-Type* Typer::Visitor::SameValueTyper(Type* lhs, Type* rhs, Typer* t) {
+Type Typer::Visitor::SameValueTyper(Type lhs, Type rhs, Typer* t) {
   return t->operation_typer()->SameValue(lhs, rhs);
 }
 
-Type* Typer::Visitor::TypeSameValue(Node* node) {
+Type Typer::Visitor::TypeSameValue(Node* node) {
   return TypeBinaryOp(node, SameValueTyper);
 }
 
-Type* Typer::Visitor::TypeStringEqual(Node* node) { return Type::Boolean(); }
+Type Typer::Visitor::TypeStringEqual(Node* node) { return Type::Boolean(); }
 
-Type* Typer::Visitor::TypeStringLessThan(Node* node) { return Type::Boolean(); }
+Type Typer::Visitor::TypeStringLessThan(Node* node) { return Type::Boolean(); }
 
-Type* Typer::Visitor::TypeStringLessThanOrEqual(Node* node) {
+Type Typer::Visitor::TypeStringLessThanOrEqual(Node* node) {
   return Type::Boolean();
 }
 
-Type* Typer::Visitor::StringFromSingleCharCodeTyper(Type* type, Typer* t) {
+Type Typer::Visitor::StringFromSingleCharCodeTyper(Type type, Typer* t) {
   return Type::String();
 }
 
-Type* Typer::Visitor::StringFromSingleCodePointTyper(Type* type, Typer* t) {
+Type Typer::Visitor::StringFromSingleCodePointTyper(Type type, Typer* t) {
   return Type::String();
 }
 
-Type* Typer::Visitor::TypeStringToLowerCaseIntl(Node* node) {
+Type Typer::Visitor::TypeStringToLowerCaseIntl(Node* node) {
   return Type::String();
 }
 
-Type* Typer::Visitor::TypeStringToUpperCaseIntl(Node* node) {
+Type Typer::Visitor::TypeStringToUpperCaseIntl(Node* node) {
   return Type::String();
 }
 
-Type* Typer::Visitor::TypeStringCharCodeAt(Node* node) {
+Type Typer::Visitor::TypeStringCharCodeAt(Node* node) {
   return typer_->cache_.kUint16;
 }
 
-Type* Typer::Visitor::TypeStringCodePointAt(Node* node) {
+Type Typer::Visitor::TypeStringCodePointAt(Node* node) {
   return Type::Range(0.0, String::kMaxCodePoint, zone());
 }
 
-Type* Typer::Visitor::TypeStringFromSingleCharCode(Node* node) {
+Type Typer::Visitor::TypeStringFromSingleCharCode(Node* node) {
   return TypeUnaryOp(node, StringFromSingleCharCodeTyper);
 }
 
-Type* Typer::Visitor::TypeStringFromSingleCodePoint(Node* node) {
+Type Typer::Visitor::TypeStringFromSingleCodePoint(Node* node) {
   return TypeUnaryOp(node, StringFromSingleCodePointTyper);
 }
 
-Type* Typer::Visitor::TypeStringIndexOf(Node* node) {
+Type Typer::Visitor::TypeStringIndexOf(Node* node) {
   return Type::Range(-1.0, String::kMaxLength, zone());
 }
 
-Type* Typer::Visitor::TypeStringLength(Node* node) {
+Type Typer::Visitor::TypeStringLength(Node* node) {
   return typer_->cache_.kStringLengthType;
 }
 
-Type* Typer::Visitor::TypeStringSubstring(Node* node) { return Type::String(); }
+Type Typer::Visitor::TypeStringSubstring(Node* node) { return Type::String(); }
 
-Type* Typer::Visitor::TypeMaskIndexWithBound(Node* node) {
+Type Typer::Visitor::TypePoisonIndex(Node* node) {
   return Type::Union(Operand(node, 0), typer_->cache_.kSingletonZero, zone());
 }
 
-Type* Typer::Visitor::TypeCheckBounds(Node* node) {
-  Type* index = Operand(node, 0);
-  Type* length = Operand(node, 1);
-  DCHECK(length->Is(Type::Unsigned31()));
-  if (index->Maybe(Type::MinusZero())) {
+Type Typer::Visitor::TypeCheckBounds(Node* node) {
+  Type index = Operand(node, 0);
+  Type length = Operand(node, 1);
+  DCHECK(length.Is(Type::Unsigned31()));
+  if (index.Maybe(Type::MinusZero())) {
     index = Type::Union(index, typer_->cache_.kSingletonZero, zone());
   }
   index = Type::Intersect(index, Type::Integral32(), zone());
-  if (index->IsNone() || length->IsNone()) return Type::None();
-  double min = std::max(index->Min(), 0.0);
-  double max = std::min(index->Max(), length->Max() - 1);
+  if (index.IsNone() || length.IsNone()) return Type::None();
+  double min = std::max(index.Min(), 0.0);
+  double max = std::min(index.Max(), length.Max() - 1);
   if (max < min) return Type::None();
   return Type::Range(min, max, zone());
 }
 
-Type* Typer::Visitor::TypeCheckHeapObject(Node* node) {
-  Type* type = Operand(node, 0);
+Type Typer::Visitor::TypeCheckHeapObject(Node* node) {
+  Type type = Operand(node, 0);
   return type;
 }
 
-Type* Typer::Visitor::TypeCheckIf(Node* node) {
-  UNREACHABLE();
-}
+Type Typer::Visitor::TypeCheckIf(Node* node) { UNREACHABLE(); }
 
-Type* Typer::Visitor::TypeCheckInternalizedString(Node* node) {
-  Type* arg = Operand(node, 0);
+Type Typer::Visitor::TypeCheckInternalizedString(Node* node) {
+  Type arg = Operand(node, 0);
   return Type::Intersect(arg, Type::InternalizedString(), zone());
 }
 
-Type* Typer::Visitor::TypeCheckMaps(Node* node) {
-  UNREACHABLE();
-}
+Type Typer::Visitor::TypeCheckMaps(Node* node) { UNREACHABLE(); }
 
-Type* Typer::Visitor::TypeCompareMaps(Node* node) { return Type::Boolean(); }
+Type Typer::Visitor::TypeCompareMaps(Node* node) { return Type::Boolean(); }
 
-Type* Typer::Visitor::TypeCheckNumber(Node* node) {
+Type Typer::Visitor::TypeCheckNumber(Node* node) {
   return typer_->operation_typer_.CheckNumber(Operand(node, 0));
 }
 
-Type* Typer::Visitor::TypeCheckReceiver(Node* node) {
-  Type* arg = Operand(node, 0);
+Type Typer::Visitor::TypeCheckReceiver(Node* node) {
+  Type arg = Operand(node, 0);
   return Type::Intersect(arg, Type::Receiver(), zone());
 }
 
-Type* Typer::Visitor::TypeCheckSmi(Node* node) {
-  Type* arg = Operand(node, 0);
+Type Typer::Visitor::TypeCheckSmi(Node* node) {
+  Type arg = Operand(node, 0);
   return Type::Intersect(arg, Type::SignedSmall(), zone());
 }
 
-Type* Typer::Visitor::TypeCheckString(Node* node) {
-  Type* arg = Operand(node, 0);
+Type Typer::Visitor::TypeCheckString(Node* node) {
+  Type arg = Operand(node, 0);
   return Type::Intersect(arg, Type::String(), zone());
 }
 
-Type* Typer::Visitor::TypeCheckSymbol(Node* node) {
-  Type* arg = Operand(node, 0);
+Type Typer::Visitor::TypeCheckSymbol(Node* node) {
+  Type arg = Operand(node, 0);
   return Type::Intersect(arg, Type::Symbol(), zone());
 }
 
-Type* Typer::Visitor::TypeCheckFloat64Hole(Node* node) {
+Type Typer::Visitor::TypeCheckFloat64Hole(Node* node) {
   return typer_->operation_typer_.CheckFloat64Hole(Operand(node, 0));
 }
 
-Type* Typer::Visitor::TypeCheckNotTaggedHole(Node* node) {
-  Type* type = Operand(node, 0);
+Type Typer::Visitor::TypeCheckNotTaggedHole(Node* node) {
+  Type type = Operand(node, 0);
   type = Type::Intersect(type, Type::NonInternal(), zone());
   return type;
 }
 
-Type* Typer::Visitor::TypeConvertReceiver(Node* node) {
-  Type* arg = Operand(node, 0);
+Type Typer::Visitor::TypeConvertReceiver(Node* node) {
+  Type arg = Operand(node, 0);
   return typer_->operation_typer_.ConvertReceiver(arg);
 }
 
-Type* Typer::Visitor::TypeConvertTaggedHoleToUndefined(Node* node) {
-  Type* type = Operand(node, 0);
+Type Typer::Visitor::TypeConvertTaggedHoleToUndefined(Node* node) {
+  Type type = Operand(node, 0);
   return typer_->operation_typer()->ConvertTaggedHoleToUndefined(type);
 }
 
-Type* Typer::Visitor::TypeCheckEqualsInternalizedString(Node* node) {
+Type Typer::Visitor::TypeCheckEqualsInternalizedString(Node* node) {
   UNREACHABLE();
 }
 
-Type* Typer::Visitor::TypeCheckEqualsSymbol(Node* node) { UNREACHABLE(); }
+Type Typer::Visitor::TypeCheckEqualsSymbol(Node* node) { UNREACHABLE(); }
 
-Type* Typer::Visitor::TypeAllocate(Node* node) {
+Type Typer::Visitor::TypeAllocate(Node* node) {
   return AllocateTypeOf(node->op());
 }
 
-Type* Typer::Visitor::TypeAllocateRaw(Node* node) { UNREACHABLE(); }
+Type Typer::Visitor::TypeAllocateRaw(Node* node) { UNREACHABLE(); }
 
-Type* Typer::Visitor::TypeLoadFieldByIndex(Node* node) {
+Type Typer::Visitor::TypeLoadFieldByIndex(Node* node) {
   return Type::NonInternal();
 }
 
-Type* Typer::Visitor::TypeLoadField(Node* node) {
+Type Typer::Visitor::TypeLoadField(Node* node) {
   return FieldAccessOf(node->op()).type;
 }
 
-Type* Typer::Visitor::TypeLoadElement(Node* node) {
+Type Typer::Visitor::TypeLoadElement(Node* node) {
   return ElementAccessOf(node->op()).type;
 }
 
-Type* Typer::Visitor::TypeLoadTypedElement(Node* node) {
+Type Typer::Visitor::TypeLoadTypedElement(Node* node) {
   switch (ExternalArrayTypeOf(node->op())) {
 #define TYPED_ARRAY_CASE(ElemType, type, TYPE, ctype, size) \
   case kExternal##ElemType##Array:                          \
@@ -2126,155 +2043,159 @@ Type* Typer::Visitor::TypeLoadTypedElement(Node* node) {
   UNREACHABLE();
 }
 
-Type* Typer::Visitor::TypeStoreField(Node* node) {
+Type Typer::Visitor::TypeLoadDataViewElement(Node* node) {
+  switch (ExternalArrayTypeOf(node->op())) {
+#define TYPED_ARRAY_CASE(ElemType, type, TYPE, ctype, size) \
+  case kExternal##ElemType##Array:                          \
+    return typer_->cache_.k##ElemType;
+    TYPED_ARRAYS(TYPED_ARRAY_CASE)
+#undef TYPED_ARRAY_CASE
+  }
   UNREACHABLE();
 }
 
-Type* Typer::Visitor::TypeStoreElement(Node* node) {
-  UNREACHABLE();
-}
+Type Typer::Visitor::TypeStoreField(Node* node) { UNREACHABLE(); }
+
+Type Typer::Visitor::TypeStoreElement(Node* node) { UNREACHABLE(); }
 
-Type* Typer::Visitor::TypeTransitionAndStoreElement(Node* node) {
+Type Typer::Visitor::TypeTransitionAndStoreElement(Node* node) {
   UNREACHABLE();
 }
 
-Type* Typer::Visitor::TypeTransitionAndStoreNumberElement(Node* node) {
+Type Typer::Visitor::TypeTransitionAndStoreNumberElement(Node* node) {
   UNREACHABLE();
 }
 
-Type* Typer::Visitor::TypeTransitionAndStoreNonNumberElement(Node* node) {
+Type Typer::Visitor::TypeTransitionAndStoreNonNumberElement(Node* node) {
   UNREACHABLE();
 }
 
-Type* Typer::Visitor::TypeStoreSignedSmallElement(Node* node) { UNREACHABLE(); }
+Type Typer::Visitor::TypeStoreSignedSmallElement(Node* node) { UNREACHABLE(); }
 
-Type* Typer::Visitor::TypeStoreTypedElement(Node* node) {
-  UNREACHABLE();
-}
+Type Typer::Visitor::TypeStoreTypedElement(Node* node) { UNREACHABLE(); }
+
+Type Typer::Visitor::TypeStoreDataViewElement(Node* node) { UNREACHABLE(); }
 
-Type* Typer::Visitor::TypeObjectIsArrayBufferView(Node* node) {
+Type Typer::Visitor::TypeObjectIsArrayBufferView(Node* node) {
   return TypeUnaryOp(node, ObjectIsArrayBufferView);
 }
 
-Type* Typer::Visitor::TypeObjectIsBigInt(Node* node) {
+Type Typer::Visitor::TypeObjectIsBigInt(Node* node) {
   return TypeUnaryOp(node, ObjectIsBigInt);
 }
 
-Type* Typer::Visitor::TypeObjectIsCallable(Node* node) {
+Type Typer::Visitor::TypeObjectIsCallable(Node* node) {
   return TypeUnaryOp(node, ObjectIsCallable);
 }
 
-Type* Typer::Visitor::TypeObjectIsConstructor(Node* node) {
+Type Typer::Visitor::TypeObjectIsConstructor(Node* node) {
   return TypeUnaryOp(node, ObjectIsConstructor);
 }
 
-Type* Typer::Visitor::TypeObjectIsDetectableCallable(Node* node) {
+Type Typer::Visitor::TypeObjectIsDetectableCallable(Node* node) {
   return TypeUnaryOp(node, ObjectIsDetectableCallable);
 }
 
-Type* Typer::Visitor::TypeObjectIsMinusZero(Node* node) {
+Type Typer::Visitor::TypeObjectIsMinusZero(Node* node) {
   return TypeUnaryOp(node, ObjectIsMinusZero);
 }
 
-Type* Typer::Visitor::TypeNumberIsFloat64Hole(Node* node) {
+Type Typer::Visitor::TypeNumberIsFloat64Hole(Node* node) {
   return Type::Boolean();
 }
 
-Type* Typer::Visitor::TypeNumberIsFinite(Node* node) { UNREACHABLE(); }
+Type Typer::Visitor::TypeNumberIsFinite(Node* node) { return Type::Boolean(); }
 
-Type* Typer::Visitor::TypeObjectIsFiniteNumber(Node* node) {
+Type Typer::Visitor::TypeObjectIsFiniteNumber(Node* node) {
   return Type::Boolean();
 }
 
-Type* Typer::Visitor::TypeNumberIsInteger(Node* node) { UNREACHABLE(); }
+Type Typer::Visitor::TypeNumberIsInteger(Node* node) { UNREACHABLE(); }
 
-Type* Typer::Visitor::TypeObjectIsSafeInteger(Node* node) {
+Type Typer::Visitor::TypeObjectIsSafeInteger(Node* node) {
   return Type::Boolean();
 }
 
-Type* Typer::Visitor::TypeNumberIsSafeInteger(Node* node) { UNREACHABLE(); }
+Type Typer::Visitor::TypeNumberIsSafeInteger(Node* node) { UNREACHABLE(); }
 
-Type* Typer::Visitor::TypeObjectIsInteger(Node* node) {
-  return Type::Boolean();
-}
+Type Typer::Visitor::TypeObjectIsInteger(Node* node) { return Type::Boolean(); }
 
-Type* Typer::Visitor::TypeObjectIsNaN(Node* node) {
+Type Typer::Visitor::TypeObjectIsNaN(Node* node) {
   return TypeUnaryOp(node, ObjectIsNaN);
 }
 
-Type* Typer::Visitor::TypeObjectIsNonCallable(Node* node) {
+Type Typer::Visitor::TypeNumberIsNaN(Node* node) {
+  return TypeUnaryOp(node, NumberIsNaN);
+}
+
+Type Typer::Visitor::TypeObjectIsNonCallable(Node* node) {
   return TypeUnaryOp(node, ObjectIsNonCallable);
 }
 
-Type* Typer::Visitor::TypeObjectIsNumber(Node* node) {
+Type Typer::Visitor::TypeObjectIsNumber(Node* node) {
   return TypeUnaryOp(node, ObjectIsNumber);
 }
 
-
-Type* Typer::Visitor::TypeObjectIsReceiver(Node* node) {
+Type Typer::Visitor::TypeObjectIsReceiver(Node* node) {
   return TypeUnaryOp(node, ObjectIsReceiver);
 }
 
-
-Type* Typer::Visitor::TypeObjectIsSmi(Node* node) {
+Type Typer::Visitor::TypeObjectIsSmi(Node* node) {
   return TypeUnaryOp(node, ObjectIsSmi);
 }
 
-Type* Typer::Visitor::TypeObjectIsString(Node* node) {
+Type Typer::Visitor::TypeObjectIsString(Node* node) {
   return TypeUnaryOp(node, ObjectIsString);
 }
 
-Type* Typer::Visitor::TypeObjectIsSymbol(Node* node) {
+Type Typer::Visitor::TypeObjectIsSymbol(Node* node) {
   return TypeUnaryOp(node, ObjectIsSymbol);
 }
 
-Type* Typer::Visitor::TypeObjectIsUndetectable(Node* node) {
+Type Typer::Visitor::TypeObjectIsUndetectable(Node* node) {
   return TypeUnaryOp(node, ObjectIsUndetectable);
 }
 
-Type* Typer::Visitor::TypeArgumentsLength(Node* node) {
+Type Typer::Visitor::TypeArgumentsLength(Node* node) {
   return TypeCache::Get().kArgumentsLengthType;
 }
 
-Type* Typer::Visitor::TypeArgumentsFrame(Node* node) {
+Type Typer::Visitor::TypeArgumentsFrame(Node* node) {
   return Type::ExternalPointer();
 }
 
-Type* Typer::Visitor::TypeNewDoubleElements(Node* node) {
+Type Typer::Visitor::TypeNewDoubleElements(Node* node) {
   return Type::OtherInternal();
 }
 
-Type* Typer::Visitor::TypeNewSmiOrObjectElements(Node* node) {
+Type Typer::Visitor::TypeNewSmiOrObjectElements(Node* node) {
   return Type::OtherInternal();
 }
 
-Type* Typer::Visitor::TypeNewArgumentsElements(Node* node) {
+Type Typer::Visitor::TypeNewArgumentsElements(Node* node) {
   return Type::OtherInternal();
 }
 
-Type* Typer::Visitor::TypeNewConsString(Node* node) { return Type::String(); }
+Type Typer::Visitor::TypeNewConsString(Node* node) { return Type::String(); }
 
-Type* Typer::Visitor::TypeArrayBufferWasNeutered(Node* node) {
+Type Typer::Visitor::TypeArrayBufferWasNeutered(Node* node) {
   return Type::Boolean();
 }
 
-Type* Typer::Visitor::TypeFindOrderedHashMapEntry(Node* node) {
+Type Typer::Visitor::TypeFindOrderedHashMapEntry(Node* node) {
   return Type::Range(-1.0, FixedArray::kMaxLength, zone());
 }
 
-Type* Typer::Visitor::TypeFindOrderedHashMapEntryForInt32Key(Node* node) {
+Type Typer::Visitor::TypeFindOrderedHashMapEntryForInt32Key(Node* node) {
   return Type::Range(-1.0, FixedArray::kMaxLength, zone());
 }
 
-Type* Typer::Visitor::TypeRuntimeAbort(Node* node) { UNREACHABLE(); }
+Type Typer::Visitor::TypeRuntimeAbort(Node* node) { UNREACHABLE(); }
 
 // Heap constants.
 
-Type* Typer::Visitor::TypeConstant(Handle<Object> value) {
-  if (Type::IsInteger(*value)) {
-    return Type::Range(value->Number(), value->Number(), zone());
-  }
-  return Type::NewConstant(value, zone());
+Type Typer::Visitor::TypeConstant(Handle<Object> value) {
+  return Type::NewConstant(typer_->js_heap_broker(), value, zone());
 }
 
 }  // namespace compiler
diff --git a/deps/v8/src/compiler/typer.h b/deps/v8/src/compiler/typer.h
index 09b0b4d81b8967..1720bc776f49fc 100644
--- a/deps/v8/src/compiler/typer.h
+++ b/deps/v8/src/compiler/typer.h
@@ -25,7 +25,8 @@ class V8_EXPORT_PRIVATE Typer {
   };
   typedef base::Flags<Flag> Flags;
 
-  Typer(Isolate* isolate, Flags flags, Graph* graph);
+  Typer(Isolate* isolate, const JSHeapBroker* js_heap_broker, Flags flags,
+        Graph* graph);
   ~Typer();
 
   void Run();
@@ -40,21 +41,18 @@ class V8_EXPORT_PRIVATE Typer {
   Flags flags() const { return flags_; }
   Graph* graph() const { return graph_; }
   Zone* zone() const { return graph()->zone(); }
-  Isolate* isolate() const { return isolate_; }
   OperationTyper* operation_typer() { return &operation_typer_; }
+  const JSHeapBroker* js_heap_broker() const { return js_heap_broker_; }
 
-  Isolate* const isolate_;
   Flags const flags_;
   Graph* const graph_;
   Decorator* decorator_;
   TypeCache const& cache_;
+  const JSHeapBroker* js_heap_broker_;
   OperationTyper operation_typer_;
 
-  Type* singleton_empty_string_;
-  Type* singleton_false_;
-  Type* singleton_true_;
-  Type* falsish_;
-  Type* truish_;
+  Type singleton_false_;
+  Type singleton_true_;
 
   DISALLOW_COPY_AND_ASSIGN(Typer);
 };
diff --git a/deps/v8/src/compiler/types.cc b/deps/v8/src/compiler/types.cc
index 87a450f0713439..420a923b14d041 100644
--- a/deps/v8/src/compiler/types.cc
+++ b/deps/v8/src/compiler/types.cc
@@ -14,14 +14,6 @@ namespace v8 {
 namespace internal {
 namespace compiler {
 
-// NOTE: If code is marked as being a "shortcut", this means that removing
-// the code won't affect the semantics of the surrounding function definition.
-
-// static
-bool Type::IsInteger(i::Object* x) {
-  return x->IsNumber() && Type::IsInteger(x->Number());
-}
-
 // -----------------------------------------------------------------------------
 // Range-related helper functions.
 
@@ -45,38 +37,32 @@ RangeType::Limits RangeType::Limits::Union(Limits lhs, Limits rhs) {
   return result;
 }
 
-bool Type::Overlap(RangeType* lhs, RangeType* rhs) {
+bool Type::Overlap(const RangeType* lhs, const RangeType* rhs) {
   DisallowHeapAllocation no_allocation;
   return !RangeType::Limits::Intersect(RangeType::Limits(lhs),
                                        RangeType::Limits(rhs))
               .IsEmpty();
 }
 
-bool Type::Contains(RangeType* lhs, RangeType* rhs) {
+bool Type::Contains(const RangeType* lhs, const RangeType* rhs) {
   DisallowHeapAllocation no_allocation;
   return lhs->Min() <= rhs->Min() && rhs->Max() <= lhs->Max();
 }
 
-bool Type::Contains(RangeType* range, i::Object* val) {
-  DisallowHeapAllocation no_allocation;
-  return IsInteger(val) && range->Min() <= val->Number() &&
-         val->Number() <= range->Max();
-}
-
 // -----------------------------------------------------------------------------
 // Min and Max computation.
 
-double Type::Min() {
+double Type::Min() const {
   DCHECK(this->Is(Number()));
   DCHECK(!this->Is(NaN()));
   if (this->IsBitset()) return BitsetType::Min(this->AsBitset());
   if (this->IsUnion()) {
     double min = +V8_INFINITY;
-    for (int i = 1, n = this->AsUnion()->Length(); i < n; ++i) {
-      min = std::min(min, this->AsUnion()->Get(i)->Min());
+    for (int i = 1, n = AsUnion()->Length(); i < n; ++i) {
+      min = std::min(min, AsUnion()->Get(i).Min());
     }
-    Type* bitset = this->AsUnion()->Get(0);
-    if (!bitset->Is(NaN())) min = std::min(min, bitset->Min());
+    Type bitset = AsUnion()->Get(0);
+    if (!bitset.Is(NaN())) min = std::min(min, bitset.Min());
     return min;
   }
   if (this->IsRange()) return this->AsRange()->Min();
@@ -84,17 +70,17 @@ double Type::Min() {
   return this->AsOtherNumberConstant()->Value();
 }
 
-double Type::Max() {
+double Type::Max() const {
   DCHECK(this->Is(Number()));
   DCHECK(!this->Is(NaN()));
   if (this->IsBitset()) return BitsetType::Max(this->AsBitset());
   if (this->IsUnion()) {
     double max = -V8_INFINITY;
     for (int i = 1, n = this->AsUnion()->Length(); i < n; ++i) {
-      max = std::max(max, this->AsUnion()->Get(i)->Max());
+      max = std::max(max, this->AsUnion()->Get(i).Max());
     }
-    Type* bitset = this->AsUnion()->Get(0);
-    if (!bitset->Is(NaN())) max = std::max(max, bitset->Max());
+    Type bitset = this->AsUnion()->Get(0);
+    if (!bitset.Is(NaN())) max = std::max(max, bitset.Max());
     return max;
   }
   if (this->IsRange()) return this->AsRange()->Max();
@@ -106,49 +92,48 @@ double Type::Max() {
 // Glb and lub computation.
 
 // The largest bitset subsumed by this type.
-Type::bitset BitsetType::Glb(Type* type) {
+Type::bitset Type::BitsetGlb() const {
   DisallowHeapAllocation no_allocation;
   // Fast case.
-  if (IsBitset(type)) {
-    return type->AsBitset();
-  } else if (type->IsUnion()) {
-    SLOW_DCHECK(type->AsUnion()->Wellformed());
-    return type->AsUnion()->Get(0)->BitsetGlb() |
-           type->AsUnion()->Get(1)->BitsetGlb();  // Shortcut.
-  } else if (type->IsRange()) {
-    bitset glb =
-        BitsetType::Glb(type->AsRange()->Min(), type->AsRange()->Max());
+  if (IsBitset()) {
+    return AsBitset();
+  } else if (IsUnion()) {
+    SLOW_DCHECK(AsUnion()->Wellformed());
+    return AsUnion()->Get(0).BitsetGlb() |
+           AsUnion()->Get(1).BitsetGlb();  // Shortcut.
+  } else if (IsRange()) {
+    bitset glb = BitsetType::Glb(AsRange()->Min(), AsRange()->Max());
     return glb;
   } else {
-    return kNone;
+    return BitsetType::kNone;
   }
 }
 
 // The smallest bitset subsuming this type, possibly not a proper one.
-Type::bitset BitsetType::Lub(Type* type) {
+Type::bitset Type::BitsetLub() const {
   DisallowHeapAllocation no_allocation;
-  if (IsBitset(type)) return type->AsBitset();
-  if (type->IsUnion()) {
+  if (IsBitset()) return AsBitset();
+  if (IsUnion()) {
     // Take the representation from the first element, which is always
     // a bitset.
-    int bitset = type->AsUnion()->Get(0)->BitsetLub();
-    for (int i = 0, n = type->AsUnion()->Length(); i < n; ++i) {
+    int bitset = AsUnion()->Get(0).BitsetLub();
+    for (int i = 0, n = AsUnion()->Length(); i < n; ++i) {
       // Other elements only contribute their semantic part.
-      bitset |= type->AsUnion()->Get(i)->BitsetLub();
+      bitset |= AsUnion()->Get(i).BitsetLub();
     }
     return bitset;
   }
-  if (type->IsHeapConstant()) return type->AsHeapConstant()->Lub();
-  if (type->IsOtherNumberConstant())
-    return type->AsOtherNumberConstant()->Lub();
-  if (type->IsRange()) return type->AsRange()->Lub();
-  if (type->IsTuple()) return kOtherInternal;
+  if (IsHeapConstant()) return AsHeapConstant()->Lub();
+  if (IsOtherNumberConstant()) {
+    return AsOtherNumberConstant()->Lub();
+  }
+  if (IsRange()) return AsRange()->Lub();
+  if (IsTuple()) return BitsetType::kOtherInternal;
   UNREACHABLE();
 }
 
-Type::bitset BitsetType::Lub(i::Map* map) {
-  DisallowHeapAllocation no_allocation;
-  switch (map->instance_type()) {
+Type::bitset BitsetType::Lub(HeapObjectType const& type) {
+  switch (type.instance_type()) {
     case CONS_STRING_TYPE:
     case CONS_ONE_BYTE_STRING_TYPE:
     case THIN_STRING_TYPE:
@@ -177,19 +162,24 @@ Type::bitset BitsetType::Lub(i::Map* map) {
       return kSymbol;
     case BIGINT_TYPE:
       return kBigInt;
-    case ODDBALL_TYPE: {
-      Heap* heap = map->GetHeap();
-      if (map == heap->undefined_map()) return kUndefined;
-      if (map == heap->null_map()) return kNull;
-      if (map == heap->boolean_map()) return kBoolean;
-      if (map == heap->the_hole_map()) return kHole;
-      DCHECK(map == heap->uninitialized_map() ||
-             map == heap->termination_exception_map() ||
-             map == heap->arguments_marker_map() ||
-             map == heap->optimized_out_map() ||
-             map == heap->stale_register_map());
-      return kOtherInternal;
-    }
+    case ODDBALL_TYPE:
+      switch (type.oddball_type()) {
+        case OddballType::kNone:
+          break;
+        case OddballType::kHole:
+          return kHole;
+        case OddballType::kBoolean:
+          return kBoolean;
+        case OddballType::kNull:
+          return kNull;
+        case OddballType::kUndefined:
+          return kUndefined;
+        case OddballType::kUninitialized:
+        case OddballType::kOther:
+          // TODO(neis): We should add a kOtherOddball type.
+          return kOtherInternal;
+      }
+      UNREACHABLE();
     case HEAP_NUMBER_TYPE:
       return kNumber;
     case JS_OBJECT_TYPE:
@@ -199,15 +189,15 @@ Type::bitset BitsetType::Lub(i::Map* map) {
     case JS_GLOBAL_PROXY_TYPE:
     case JS_API_OBJECT_TYPE:
     case JS_SPECIAL_API_OBJECT_TYPE:
-      if (map->is_undetectable()) {
+      if (type.is_undetectable()) {
         // Currently we assume that every undetectable receiver is also
         // callable, which is what we need to support document.all.  We
         // could add another Type bit to support other use cases in the
         // future if necessary.
-        DCHECK(map->is_callable());
+        DCHECK(type.is_callable());
         return kOtherUndetectable;
       }
-      if (map->is_callable()) {
+      if (type.is_callable()) {
         return kOtherCallable;
       }
       return kOtherObject;
@@ -216,6 +206,10 @@ Type::bitset BitsetType::Lub(i::Map* map) {
     case JS_VALUE_TYPE:
     case JS_MESSAGE_OBJECT_TYPE:
     case JS_DATE_TYPE:
+#ifdef V8_INTL_SUPPORT
+    case JS_INTL_LOCALE_TYPE:
+    case JS_INTL_RELATIVE_TIME_FORMAT_TYPE:
+#endif  // V8_INTL_SUPPORT
     case JS_CONTEXT_EXTENSION_OBJECT_TYPE:
     case JS_GENERATOR_OBJECT_TYPE:
     case JS_ASYNC_GENERATOR_OBJECT_TYPE:
@@ -243,18 +237,18 @@ Type::bitset BitsetType::Lub(i::Map* map) {
     case WASM_INSTANCE_TYPE:
     case WASM_MEMORY_TYPE:
     case WASM_TABLE_TYPE:
-      DCHECK(!map->is_callable());
-      DCHECK(!map->is_undetectable());
+      DCHECK(!type.is_callable());
+      DCHECK(!type.is_undetectable());
       return kOtherObject;
     case JS_BOUND_FUNCTION_TYPE:
-      DCHECK(!map->is_undetectable());
+      DCHECK(!type.is_undetectable());
       return kBoundFunction;
     case JS_FUNCTION_TYPE:
-      DCHECK(!map->is_undetectable());
+      DCHECK(!type.is_undetectable());
       return kFunction;
     case JS_PROXY_TYPE:
-      DCHECK(!map->is_undetectable());
-      if (map->is_callable()) return kCallableProxy;
+      DCHECK(!type.is_undetectable());
+      if (type.is_callable()) return kCallableProxy;
       return kOtherProxy;
     case MAP_TYPE:
     case ALLOCATION_SITE_TYPE:
@@ -264,12 +258,21 @@ Type::bitset BitsetType::Lub(i::Map* map) {
     case ACCESSOR_PAIR_TYPE:
     case FIXED_ARRAY_TYPE:
     case HASH_TABLE_TYPE:
+    case ORDERED_HASH_MAP_TYPE:
+    case ORDERED_HASH_SET_TYPE:
+    case NAME_DICTIONARY_TYPE:
+    case GLOBAL_DICTIONARY_TYPE:
+    case NUMBER_DICTIONARY_TYPE:
+    case SIMPLE_NUMBER_DICTIONARY_TYPE:
+    case STRING_TABLE_TYPE:
+    case EPHEMERON_HASH_TABLE_TYPE:
     case WEAK_FIXED_ARRAY_TYPE:
+    case WEAK_ARRAY_LIST_TYPE:
     case FIXED_DOUBLE_ARRAY_TYPE:
     case FEEDBACK_METADATA_TYPE:
     case BYTE_ARRAY_TYPE:
     case BYTECODE_ARRAY_TYPE:
-    case BOILERPLATE_DESCRIPTION_TYPE:
+    case OBJECT_BOILERPLATE_DESCRIPTION_TYPE:
     case DESCRIPTOR_ARRAY_TYPE:
     case TRANSITION_ARRAY_TYPE:
     case FEEDBACK_CELL_TYPE:
@@ -277,6 +280,7 @@ Type::bitset BitsetType::Lub(i::Map* map) {
     case PROPERTY_ARRAY_TYPE:
     case FOREIGN_TYPE:
     case SCOPE_INFO_TYPE:
+    case SCRIPT_CONTEXT_TABLE_TYPE:
     case BLOCK_CONTEXT_TYPE:
     case CATCH_CONTEXT_TYPE:
     case DEBUG_EVALUATE_CONTEXT_TYPE:
@@ -292,6 +296,8 @@ Type::bitset BitsetType::Lub(i::Map* map) {
     case MODULE_TYPE:
     case MODULE_INFO_ENTRY_TYPE:
     case CELL_TYPE:
+    case UNCOMPILED_DATA_WITHOUT_PRE_PARSED_SCOPE_TYPE:
+    case UNCOMPILED_DATA_WITH_PRE_PARSED_SCOPE_TYPE:
       return kOtherInternal;
 
     // Remaining instance types are unsupported for now. If any of them do
@@ -321,12 +327,11 @@ Type::bitset BitsetType::Lub(i::Map* map) {
     case INTERPRETER_DATA_TYPE:
     case TUPLE2_TYPE:
     case TUPLE3_TYPE:
-    case WASM_COMPILED_MODULE_TYPE:
+    case ARRAY_BOILERPLATE_DESCRIPTION_TYPE:
     case WASM_DEBUG_INFO_TYPE:
-    case WASM_SHARED_MODULE_DATA_TYPE:
+    case WASM_EXPORTED_FUNCTION_DATA_TYPE:
     case LOAD_HANDLER_TYPE:
     case STORE_HANDLER_TYPE:
-    case CONTEXT_EXTENSION_TYPE:
     case ASYNC_GENERATOR_REQUEST_TYPE:
     case CODE_DATA_CONTAINER_TYPE:
     case CALLBACK_TASK_TYPE:
@@ -339,17 +344,9 @@ Type::bitset BitsetType::Lub(i::Map* map) {
   UNREACHABLE();
 }
 
-Type::bitset BitsetType::Lub(i::Object* value) {
-  DisallowHeapAllocation no_allocation;
-  if (value->IsNumber()) {
-    return Lub(value->Number());
-  }
-  return Lub(i::HeapObject::cast(value)->map());
-}
-
 Type::bitset BitsetType::Lub(double value) {
   DisallowHeapAllocation no_allocation;
-  if (i::IsMinusZero(value)) return kMinusZero;
+  if (IsMinusZero(value)) return kMinusZero;
   if (std::isnan(value)) return kNaN;
   if (IsUint32Double(value) || IsInt32Double(value)) return Lub(value, value);
   return kOtherNumber;
@@ -456,50 +453,45 @@ double BitsetType::Max(bitset bits) {
 // static
 bool OtherNumberConstantType::IsOtherNumberConstant(double value) {
   // Not an integer, not NaN, and not -0.
-  return !std::isnan(value) && !Type::IsInteger(value) &&
-         !i::IsMinusZero(value);
-}
-
-// static
-bool OtherNumberConstantType::IsOtherNumberConstant(Object* value) {
-  return value->IsHeapNumber() &&
-         IsOtherNumberConstant(HeapNumber::cast(value)->value());
+  return !std::isnan(value) && !RangeType::IsInteger(value) &&
+         !IsMinusZero(value);
 }
 
 HeapConstantType::HeapConstantType(BitsetType::bitset bitset,
-                                   i::Handle<i::HeapObject> object)
-    : TypeBase(kHeapConstant), bitset_(bitset), object_(object) {
-  DCHECK(!object->IsHeapNumber());
-  DCHECK_IMPLIES(object->IsString(), object->IsInternalizedString());
+                                   const HeapObjectRef& heap_ref)
+    : TypeBase(kHeapConstant), bitset_(bitset), heap_ref_(heap_ref) {}
+
+Handle<HeapObject> HeapConstantType::Value() const {
+  return heap_ref_.object<HeapObject>();
 }
 
 // -----------------------------------------------------------------------------
 // Predicates.
 
-bool Type::SimplyEquals(Type* that) {
+bool Type::SimplyEquals(Type that) const {
   DisallowHeapAllocation no_allocation;
   if (this->IsHeapConstant()) {
-    return that->IsHeapConstant() &&
+    return that.IsHeapConstant() &&
            this->AsHeapConstant()->Value().address() ==
-               that->AsHeapConstant()->Value().address();
+               that.AsHeapConstant()->Value().address();
   }
   if (this->IsOtherNumberConstant()) {
-    return that->IsOtherNumberConstant() &&
+    return that.IsOtherNumberConstant() &&
            this->AsOtherNumberConstant()->Value() ==
-               that->AsOtherNumberConstant()->Value();
+               that.AsOtherNumberConstant()->Value();
   }
   if (this->IsRange()) {
-    if (that->IsHeapConstant() || that->IsOtherNumberConstant()) return false;
+    if (that.IsHeapConstant() || that.IsOtherNumberConstant()) return false;
   }
   if (this->IsTuple()) {
-    if (!that->IsTuple()) return false;
-    TupleType* this_tuple = this->AsTuple();
-    TupleType* that_tuple = that->AsTuple();
+    if (!that.IsTuple()) return false;
+    const TupleType* this_tuple = this->AsTuple();
+    const TupleType* that_tuple = that.AsTuple();
     if (this_tuple->Arity() != that_tuple->Arity()) {
       return false;
     }
     for (int i = 0, n = this_tuple->Arity(); i < n; ++i) {
-      if (!this_tuple->Element(i)->Equals(that_tuple->Element(i))) return false;
+      if (!this_tuple->Element(i).Equals(that_tuple->Element(i))) return false;
     }
     return true;
   }
@@ -507,37 +499,37 @@ bool Type::SimplyEquals(Type* that) {
 }
 
 // Check if [this] <= [that].
-bool Type::SlowIs(Type* that) {
+bool Type::SlowIs(Type that) const {
   DisallowHeapAllocation no_allocation;
 
   // Fast bitset cases
-  if (that->IsBitset()) {
-    return BitsetType::Is(this->BitsetLub(), that->AsBitset());
+  if (that.IsBitset()) {
+    return BitsetType::Is(this->BitsetLub(), that.AsBitset());
   }
 
   if (this->IsBitset()) {
-    return BitsetType::Is(this->AsBitset(), that->BitsetGlb());
+    return BitsetType::Is(this->AsBitset(), that.BitsetGlb());
   }
 
   // (T1 \/ ... \/ Tn) <= T  if  (T1 <= T) /\ ... /\ (Tn <= T)
   if (this->IsUnion()) {
     for (int i = 0, n = this->AsUnion()->Length(); i < n; ++i) {
-      if (!this->AsUnion()->Get(i)->Is(that)) return false;
+      if (!this->AsUnion()->Get(i).Is(that)) return false;
     }
     return true;
   }
 
   // T <= (T1 \/ ... \/ Tn)  if  (T <= T1) \/ ... \/ (T <= Tn)
-  if (that->IsUnion()) {
-    for (int i = 0, n = that->AsUnion()->Length(); i < n; ++i) {
-      if (this->Is(that->AsUnion()->Get(i))) return true;
+  if (that.IsUnion()) {
+    for (int i = 0, n = that.AsUnion()->Length(); i < n; ++i) {
+      if (this->Is(that.AsUnion()->Get(i))) return true;
       if (i > 1 && this->IsRange()) return false;  // Shortcut.
     }
     return false;
   }
 
-  if (that->IsRange()) {
-    return (this->IsRange() && Contains(that->AsRange(), this->AsRange()));
+  if (that.IsRange()) {
+    return (this->IsRange() && Contains(that.AsRange(), this->AsRange()));
   }
   if (this->IsRange()) return false;
 
@@ -545,35 +537,35 @@ bool Type::SlowIs(Type* that) {
 }
 
 // Check if [this] and [that] overlap.
-bool Type::Maybe(Type* that) {
+bool Type::Maybe(Type that) const {
   DisallowHeapAllocation no_allocation;
 
-  if (BitsetType::IsNone(this->BitsetLub() & that->BitsetLub())) return false;
+  if (BitsetType::IsNone(this->BitsetLub() & that.BitsetLub())) return false;
 
   // (T1 \/ ... \/ Tn) overlaps T  if  (T1 overlaps T) \/ ... \/ (Tn overlaps T)
   if (this->IsUnion()) {
     for (int i = 0, n = this->AsUnion()->Length(); i < n; ++i) {
-      if (this->AsUnion()->Get(i)->Maybe(that)) return true;
+      if (this->AsUnion()->Get(i).Maybe(that)) return true;
     }
     return false;
   }
 
   // T overlaps (T1 \/ ... \/ Tn)  if  (T overlaps T1) \/ ... \/ (T overlaps Tn)
-  if (that->IsUnion()) {
-    for (int i = 0, n = that->AsUnion()->Length(); i < n; ++i) {
-      if (this->Maybe(that->AsUnion()->Get(i))) return true;
+  if (that.IsUnion()) {
+    for (int i = 0, n = that.AsUnion()->Length(); i < n; ++i) {
+      if (this->Maybe(that.AsUnion()->Get(i))) return true;
     }
     return false;
   }
 
-  if (this->IsBitset() && that->IsBitset()) return true;
+  if (this->IsBitset() && that.IsBitset()) return true;
 
   if (this->IsRange()) {
-    if (that->IsRange()) {
-      return Overlap(this->AsRange(), that->AsRange());
+    if (that.IsRange()) {
+      return Overlap(this->AsRange(), that.AsRange());
     }
-    if (that->IsBitset()) {
-      bitset number_bits = BitsetType::NumberBits(that->AsBitset());
+    if (that.IsBitset()) {
+      bitset number_bits = BitsetType::NumberBits(that.AsBitset());
       if (number_bits == BitsetType::kNone) {
         return false;
       }
@@ -582,26 +574,26 @@ bool Type::Maybe(Type* that) {
       return min <= max;
     }
   }
-  if (that->IsRange()) {
-    return that->Maybe(this);  // This case is handled above.
+  if (that.IsRange()) {
+    return that.Maybe(*this);  // This case is handled above.
   }
 
-  if (this->IsBitset() || that->IsBitset()) return true;
+  if (this->IsBitset() || that.IsBitset()) return true;
 
   return this->SimplyEquals(that);
 }
 
 // Return the range in [this], or [nullptr].
-Type* Type::GetRange() {
+Type Type::GetRange() const {
   DisallowHeapAllocation no_allocation;
-  if (this->IsRange()) return this;
-  if (this->IsUnion() && this->AsUnion()->Get(1)->IsRange()) {
+  if (this->IsRange()) return *this;
+  if (this->IsUnion() && this->AsUnion()->Get(1).IsRange()) {
     return this->AsUnion()->Get(1);
   }
   return nullptr;
 }
 
-bool UnionType::Wellformed() {
+bool UnionType::Wellformed() const {
   DisallowHeapAllocation no_allocation;
   // This checks the invariants of the union representation:
   // 1. There are at least two elements.
@@ -612,18 +604,18 @@ bool UnionType::Wellformed() {
   // 6. If there is a range, then the bitset type does not contain
   //    plain number bits.
   DCHECK_LE(2, this->Length());      // (1)
-  DCHECK(this->Get(0)->IsBitset());  // (2a)
+  DCHECK(this->Get(0).IsBitset());   // (2a)
 
   for (int i = 0; i < this->Length(); ++i) {
-    if (i != 0) DCHECK(!this->Get(i)->IsBitset());  // (2b)
-    if (i != 1) DCHECK(!this->Get(i)->IsRange());   // (3)
-    DCHECK(!this->Get(i)->IsUnion());               // (4)
+    if (i != 0) DCHECK(!this->Get(i).IsBitset());  // (2b)
+    if (i != 1) DCHECK(!this->Get(i).IsRange());   // (3)
+    DCHECK(!this->Get(i).IsUnion());               // (4)
     for (int j = 0; j < this->Length(); ++j) {
-      if (i != j && i != 0) DCHECK(!this->Get(i)->Is(this->Get(j)));  // (5)
+      if (i != j && i != 0) DCHECK(!this->Get(i).Is(this->Get(j)));  // (5)
     }
   }
-  DCHECK(!this->Get(1)->IsRange() ||
-         (BitsetType::NumberBits(this->Get(0)->AsBitset()) ==
+  DCHECK(!this->Get(1).IsRange() ||
+         (BitsetType::NumberBits(this->Get(0).AsBitset()) ==
           BitsetType::kNone));  // (6)
   return true;
 }
@@ -631,42 +623,41 @@ bool UnionType::Wellformed() {
 // -----------------------------------------------------------------------------
 // Union and intersection
 
-Type* Type::Intersect(Type* type1, Type* type2, Zone* zone) {
+Type Type::Intersect(Type type1, Type type2, Zone* zone) {
   // Fast case: bit sets.
-  if (type1->IsBitset() && type2->IsBitset()) {
-    return BitsetType::New(type1->AsBitset() & type2->AsBitset());
+  if (type1.IsBitset() && type2.IsBitset()) {
+    return NewBitset(type1.AsBitset() & type2.AsBitset());
   }
 
   // Fast case: top or bottom types.
-  if (type1->IsNone() || type2->IsAny()) return type1;  // Shortcut.
-  if (type2->IsNone() || type1->IsAny()) return type2;  // Shortcut.
+  if (type1.IsNone() || type2.IsAny()) return type1;  // Shortcut.
+  if (type2.IsNone() || type1.IsAny()) return type2;  // Shortcut.
 
   // Semi-fast case.
-  if (type1->Is(type2)) return type1;
-  if (type2->Is(type1)) return type2;
+  if (type1.Is(type2)) return type1;
+  if (type2.Is(type1)) return type2;
 
   // Slow case: create union.
 
   // Semantic subtyping check - this is needed for consistency with the
   // semi-fast case above.
-  if (type1->Is(type2)) {
+  if (type1.Is(type2)) {
     type2 = Any();
-  } else if (type2->Is(type1)) {
+  } else if (type2.Is(type1)) {
     type1 = Any();
   }
 
-  bitset bits = type1->BitsetGlb() & type2->BitsetGlb();
-  int size1 = type1->IsUnion() ? type1->AsUnion()->Length() : 1;
-  int size2 = type2->IsUnion() ? type2->AsUnion()->Length() : 1;
+  bitset bits = type1.BitsetGlb() & type2.BitsetGlb();
+  int size1 = type1.IsUnion() ? type1.AsUnion()->Length() : 1;
+  int size2 = type2.IsUnion() ? type2.AsUnion()->Length() : 1;
   int size;
   if (base::bits::SignedAddOverflow32(size1, size2, &size)) return Any();
   if (base::bits::SignedAddOverflow32(size, 2, &size)) return Any();
-  Type* result_type = UnionType::New(size, zone);
-  UnionType* result = result_type->AsUnion();
+  UnionType* result = UnionType::New(size, zone);
   size = 0;
 
   // Deal with bitsets.
-  result->Set(size++, BitsetType::New(bits));
+  result->Set(size++, NewBitset(bits));
 
   RangeType::Limits lims = RangeType::Limits::Empty();
   size = IntersectAux(type1, type2, result, size, &lims, zone);
@@ -674,17 +665,17 @@ Type* Type::Intersect(Type* type1, Type* type2, Zone* zone) {
   // If the range is not empty, then insert it into the union and
   // remove the number bits from the bitset.
   if (!lims.IsEmpty()) {
-    size = UpdateRange(RangeType::New(lims, zone), result, size, zone);
+    size = UpdateRange(Type::Range(lims, zone), result, size, zone);
 
     // Remove the number bits.
     bitset number_bits = BitsetType::NumberBits(bits);
     bits &= ~number_bits;
-    result->Set(0, BitsetType::New(bits));
+    result->Set(0, NewBitset(bits));
   }
-  return NormalizeUnion(result_type, size, zone);
+  return NormalizeUnion(result, size, zone);
 }
 
-int Type::UpdateRange(Type* range, UnionType* result, int size, Zone* zone) {
+int Type::UpdateRange(Type range, UnionType* result, int size, Zone* zone) {
   if (size == 1) {
     result->Set(size++, range);
   } else {
@@ -695,7 +686,7 @@ int Type::UpdateRange(Type* range, UnionType* result, int size, Zone* zone) {
 
   // Remove any components that just got subsumed.
   for (int i = 2; i < size;) {
-    if (result->Get(i)->Is(range)) {
+    if (result->Get(i).Is(range)) {
       result->Set(i, result->Get(--size));
     } else {
       ++i;
@@ -715,34 +706,32 @@ RangeType::Limits Type::ToLimits(bitset bits, Zone* zone) {
                            BitsetType::Max(number_bits));
 }
 
-RangeType::Limits Type::IntersectRangeAndBitset(Type* range, Type* bitset,
+RangeType::Limits Type::IntersectRangeAndBitset(Type range, Type bitset,
                                                 Zone* zone) {
-  RangeType::Limits range_lims(range->AsRange());
-  RangeType::Limits bitset_lims = ToLimits(bitset->AsBitset(), zone);
+  RangeType::Limits range_lims(range.AsRange());
+  RangeType::Limits bitset_lims = ToLimits(bitset.AsBitset(), zone);
   return RangeType::Limits::Intersect(range_lims, bitset_lims);
 }
 
-int Type::IntersectAux(Type* lhs, Type* rhs, UnionType* result, int size,
+int Type::IntersectAux(Type lhs, Type rhs, UnionType* result, int size,
                        RangeType::Limits* lims, Zone* zone) {
-  if (lhs->IsUnion()) {
-    for (int i = 0, n = lhs->AsUnion()->Length(); i < n; ++i) {
-      size =
-          IntersectAux(lhs->AsUnion()->Get(i), rhs, result, size, lims, zone);
+  if (lhs.IsUnion()) {
+    for (int i = 0, n = lhs.AsUnion()->Length(); i < n; ++i) {
+      size = IntersectAux(lhs.AsUnion()->Get(i), rhs, result, size, lims, zone);
     }
     return size;
   }
-  if (rhs->IsUnion()) {
-    for (int i = 0, n = rhs->AsUnion()->Length(); i < n; ++i) {
-      size =
-          IntersectAux(lhs, rhs->AsUnion()->Get(i), result, size, lims, zone);
+  if (rhs.IsUnion()) {
+    for (int i = 0, n = rhs.AsUnion()->Length(); i < n; ++i) {
+      size = IntersectAux(lhs, rhs.AsUnion()->Get(i), result, size, lims, zone);
     }
     return size;
   }
 
-  if (BitsetType::IsNone(lhs->BitsetLub() & rhs->BitsetLub())) return size;
+  if (BitsetType::IsNone(lhs.BitsetLub() & rhs.BitsetLub())) return size;
 
-  if (lhs->IsRange()) {
-    if (rhs->IsBitset()) {
+  if (lhs.IsRange()) {
+    if (rhs.IsBitset()) {
       RangeType::Limits lim = IntersectRangeAndBitset(lhs, rhs, zone);
 
       if (!lim.IsEmpty()) {
@@ -750,23 +739,23 @@ int Type::IntersectAux(Type* lhs, Type* rhs, UnionType* result, int size,
       }
       return size;
     }
-    if (rhs->IsRange()) {
+    if (rhs.IsRange()) {
       RangeType::Limits lim = RangeType::Limits::Intersect(
-          RangeType::Limits(lhs->AsRange()), RangeType::Limits(rhs->AsRange()));
+          RangeType::Limits(lhs.AsRange()), RangeType::Limits(rhs.AsRange()));
       if (!lim.IsEmpty()) {
         *lims = RangeType::Limits::Union(lim, *lims);
       }
     }
     return size;
   }
-  if (rhs->IsRange()) {
+  if (rhs.IsRange()) {
     // This case is handled symmetrically above.
     return IntersectAux(rhs, lhs, result, size, lims, zone);
   }
-  if (lhs->IsBitset() || rhs->IsBitset()) {
-    return AddToUnion(lhs->IsBitset() ? rhs : lhs, result, size, zone);
+  if (lhs.IsBitset() || rhs.IsBitset()) {
+    return AddToUnion(lhs.IsBitset() ? rhs : lhs, result, size, zone);
   }
-  if (lhs->SimplyEquals(rhs)) {
+  if (lhs.SimplyEquals(rhs)) {
     return AddToUnion(lhs, result, size, zone);
   }
   return size;
@@ -776,7 +765,7 @@ int Type::IntersectAux(Type* lhs, Type* rhs, UnionType* result, int size,
 // If the range is non-empty, the number bits in the bitset should be
 // clear. Moreover, if we have a canonical range (such as Signed32),
 // we want to produce a bitset rather than a range.
-Type* Type::NormalizeRangeAndBitset(Type* range, bitset* bits, Zone* zone) {
+Type Type::NormalizeRangeAndBitset(Type range, bitset* bits, Zone* zone) {
   // Fast path: If the bitset does not mention numbers, we can just keep the
   // range.
   bitset number_bits = BitsetType::NumberBits(*bits);
@@ -786,7 +775,7 @@ Type* Type::NormalizeRangeAndBitset(Type* range, bitset* bits, Zone* zone) {
 
   // If the range is semantically contained within the bitset, return None and
   // leave the bitset untouched.
-  bitset range_lub = range->BitsetLub();
+  bitset range_lub = range.BitsetLub();
   if (BitsetType::Is(range_lub, *bits)) {
     return None();
   }
@@ -795,8 +784,8 @@ Type* Type::NormalizeRangeAndBitset(Type* range, bitset* bits, Zone* zone) {
   double bitset_min = BitsetType::Min(number_bits);
   double bitset_max = BitsetType::Max(number_bits);
 
-  double range_min = range->Min();
-  double range_max = range->Max();
+  double range_min = range.Min();
+  double range_max = range.Max();
 
   // Remove the number bits from the bitset, they would just confuse us now.
   // NOTE: bits contains OtherNumber iff bits contains PlainNumber, in which
@@ -814,13 +803,13 @@ Type* Type::NormalizeRangeAndBitset(Type* range, bitset* bits, Zone* zone) {
   if (bitset_max > range_max) {
     range_max = bitset_max;
   }
-  return RangeType::New(range_min, range_max, zone);
+  return Type::Range(range_min, range_max, zone);
 }
 
-Type* Type::NewConstant(double value, Zone* zone) {
-  if (IsInteger(value)) {
+Type Type::NewConstant(double value, Zone* zone) {
+  if (RangeType::IsInteger(value)) {
     return Range(value, value, zone);
-  } else if (i::IsMinusZero(value)) {
+  } else if (IsMinusZero(value)) {
     return Type::MinusZero();
   } else if (std::isnan(value)) {
     return Type::NaN();
@@ -830,115 +819,119 @@ Type* Type::NewConstant(double value, Zone* zone) {
   return OtherNumberConstant(value, zone);
 }
 
-Type* Type::NewConstant(i::Handle<i::Object> value, Zone* zone) {
-  if (IsInteger(*value)) {
-    double v = value->Number();
-    return Range(v, v, zone);
-  } else if (value->IsHeapNumber()) {
-    return NewConstant(value->Number(), zone);
-  } else if (value->IsString() && !value->IsInternalizedString()) {
+Type Type::NewConstant(const JSHeapBroker* js_heap_broker,
+                       Handle<i::Object> value, Zone* zone) {
+  auto maybe_smi = JSHeapBroker::TryGetSmi(value);
+  if (maybe_smi.has_value()) {
+    return NewConstant(static_cast<double>(maybe_smi.value()), zone);
+  }
+
+  HeapObjectRef heap_ref(value);
+  if (heap_ref.IsHeapNumber()) {
+    return NewConstant(heap_ref.AsHeapNumber().value(), zone);
+  }
+
+  if (heap_ref.IsString() && !heap_ref.IsInternalizedString()) {
     return Type::String();
   }
-  return HeapConstant(i::Handle<i::HeapObject>::cast(value), zone);
+  return HeapConstant(js_heap_broker, value, zone);
 }
 
-Type* Type::Union(Type* type1, Type* type2, Zone* zone) {
+Type Type::Union(Type type1, Type type2, Zone* zone) {
   // Fast case: bit sets.
-  if (type1->IsBitset() && type2->IsBitset()) {
-    return BitsetType::New(type1->AsBitset() | type2->AsBitset());
+  if (type1.IsBitset() && type2.IsBitset()) {
+    return NewBitset(type1.AsBitset() | type2.AsBitset());
   }
 
   // Fast case: top or bottom types.
-  if (type1->IsAny() || type2->IsNone()) return type1;
-  if (type2->IsAny() || type1->IsNone()) return type2;
+  if (type1.IsAny() || type2.IsNone()) return type1;
+  if (type2.IsAny() || type1.IsNone()) return type2;
 
   // Semi-fast case.
-  if (type1->Is(type2)) return type2;
-  if (type2->Is(type1)) return type1;
+  if (type1.Is(type2)) return type2;
+  if (type2.Is(type1)) return type1;
 
   // Slow case: create union.
-  int size1 = type1->IsUnion() ? type1->AsUnion()->Length() : 1;
-  int size2 = type2->IsUnion() ? type2->AsUnion()->Length() : 1;
+  int size1 = type1.IsUnion() ? type1.AsUnion()->Length() : 1;
+  int size2 = type2.IsUnion() ? type2.AsUnion()->Length() : 1;
   int size;
   if (base::bits::SignedAddOverflow32(size1, size2, &size)) return Any();
   if (base::bits::SignedAddOverflow32(size, 2, &size)) return Any();
-  Type* result_type = UnionType::New(size, zone);
-  UnionType* result = result_type->AsUnion();
+  UnionType* result = UnionType::New(size, zone);
   size = 0;
 
   // Compute the new bitset.
-  bitset new_bitset = type1->BitsetGlb() | type2->BitsetGlb();
+  bitset new_bitset = type1.BitsetGlb() | type2.BitsetGlb();
 
   // Deal with ranges.
-  Type* range = None();
-  Type* range1 = type1->GetRange();
-  Type* range2 = type2->GetRange();
+  Type range = None();
+  Type range1 = type1.GetRange();
+  Type range2 = type2.GetRange();
   if (range1 != nullptr && range2 != nullptr) {
     RangeType::Limits lims =
-        RangeType::Limits::Union(RangeType::Limits(range1->AsRange()),
-                                 RangeType::Limits(range2->AsRange()));
-    Type* union_range = RangeType::New(lims, zone);
+        RangeType::Limits::Union(RangeType::Limits(range1.AsRange()),
+                                 RangeType::Limits(range2.AsRange()));
+    Type union_range = Type::Range(lims, zone);
     range = NormalizeRangeAndBitset(union_range, &new_bitset, zone);
   } else if (range1 != nullptr) {
     range = NormalizeRangeAndBitset(range1, &new_bitset, zone);
   } else if (range2 != nullptr) {
     range = NormalizeRangeAndBitset(range2, &new_bitset, zone);
   }
-  Type* bits = BitsetType::New(new_bitset);
+  Type bits = NewBitset(new_bitset);
   result->Set(size++, bits);
-  if (!range->IsNone()) result->Set(size++, range);
+  if (!range.IsNone()) result->Set(size++, range);
 
   size = AddToUnion(type1, result, size, zone);
   size = AddToUnion(type2, result, size, zone);
-  return NormalizeUnion(result_type, size, zone);
+  return NormalizeUnion(result, size, zone);
 }
 
 // Add [type] to [result] unless [type] is bitset, range, or already subsumed.
 // Return new size of [result].
-int Type::AddToUnion(Type* type, UnionType* result, int size, Zone* zone) {
-  if (type->IsBitset() || type->IsRange()) return size;
-  if (type->IsUnion()) {
-    for (int i = 0, n = type->AsUnion()->Length(); i < n; ++i) {
-      size = AddToUnion(type->AsUnion()->Get(i), result, size, zone);
+int Type::AddToUnion(Type type, UnionType* result, int size, Zone* zone) {
+  if (type.IsBitset() || type.IsRange()) return size;
+  if (type.IsUnion()) {
+    for (int i = 0, n = type.AsUnion()->Length(); i < n; ++i) {
+      size = AddToUnion(type.AsUnion()->Get(i), result, size, zone);
     }
     return size;
   }
   for (int i = 0; i < size; ++i) {
-    if (type->Is(result->Get(i))) return size;
+    if (type.Is(result->Get(i))) return size;
   }
   result->Set(size++, type);
   return size;
 }
 
-Type* Type::NormalizeUnion(Type* union_type, int size, Zone* zone) {
-  UnionType* unioned = union_type->AsUnion();
+Type Type::NormalizeUnion(UnionType* unioned, int size, Zone* zone) {
   DCHECK_LE(1, size);
-  DCHECK(unioned->Get(0)->IsBitset());
+  DCHECK(unioned->Get(0).IsBitset());
   // If the union has just one element, return it.
   if (size == 1) {
     return unioned->Get(0);
   }
-  bitset bits = unioned->Get(0)->AsBitset();
+  bitset bits = unioned->Get(0).AsBitset();
   // If the union only consists of a range, we can get rid of the union.
   if (size == 2 && bits == BitsetType::kNone) {
-    if (unioned->Get(1)->IsRange()) {
-      return RangeType::New(unioned->Get(1)->AsRange()->Min(),
-                            unioned->Get(1)->AsRange()->Max(), zone);
+    if (unioned->Get(1).IsRange()) {
+      return Type::Range(unioned->Get(1).AsRange()->Min(),
+                         unioned->Get(1).AsRange()->Max(), zone);
     }
   }
   unioned->Shrink(size);
   SLOW_DCHECK(unioned->Wellformed());
-  return union_type;
+  return Type(unioned);
 }
 
-int Type::NumConstants() {
+int Type::NumConstants() const {
   DisallowHeapAllocation no_allocation;
   if (this->IsHeapConstant() || this->IsOtherNumberConstant()) {
     return 1;
   } else if (this->IsUnion()) {
     int result = 0;
     for (int i = 0, n = this->AsUnion()->Length(); i < n; ++i) {
-      if (this->AsUnion()->Get(i)->IsHeapConstant()) ++result;
+      if (this->AsUnion()->Get(i).IsHeapConstant()) ++result;
     }
     return result;
   } else {
@@ -996,7 +989,7 @@ void BitsetType::Print(std::ostream& os,  // NOLINT
   os << ")";
 }
 
-void Type::PrintTo(std::ostream& os) {
+void Type::PrintTo(std::ostream& os) const {
   DisallowHeapAllocation no_allocation;
   if (this->IsBitset()) {
     BitsetType::Print(os, this->AsBitset());
@@ -1015,17 +1008,15 @@ void Type::PrintTo(std::ostream& os) {
   } else if (this->IsUnion()) {
     os << "(";
     for (int i = 0, n = this->AsUnion()->Length(); i < n; ++i) {
-      Type* type_i = this->AsUnion()->Get(i);
-      if (i > 0) os << " | ";
-      type_i->PrintTo(os);
+      Type type_i = this->AsUnion()->Get(i);
+      if (i > 0) os << " | " << type_i;
     }
     os << ")";
   } else if (this->IsTuple()) {
     os << "<";
     for (int i = 0, n = this->AsTuple()->Arity(); i < n; ++i) {
-      Type* type_i = this->AsTuple()->Element(i);
-      if (i > 0) os << ", ";
-      type_i->PrintTo(os);
+      Type type_i = this->AsTuple()->Element(i);
+      if (i > 0) os << ", " << type_i;
     }
     os << ">";
   } else {
@@ -1034,24 +1025,90 @@ void Type::PrintTo(std::ostream& os) {
 }
 
 #ifdef DEBUG
-void Type::Print() {
-  OFStream os(stdout);
+void Type::Print() const {
+  StdoutStream os;
   PrintTo(os);
   os << std::endl;
 }
 void BitsetType::Print(bitset bits) {
-  OFStream os(stdout);
+  StdoutStream os;
   Print(os, bits);
   os << std::endl;
 }
 #endif
 
 BitsetType::bitset BitsetType::SignedSmall() {
-  return i::SmiValuesAre31Bits() ? kSigned31 : kSigned32;
+  return SmiValuesAre31Bits() ? kSigned31 : kSigned32;
 }
 
 BitsetType::bitset BitsetType::UnsignedSmall() {
-  return i::SmiValuesAre31Bits() ? kUnsigned30 : kUnsigned31;
+  return SmiValuesAre31Bits() ? kUnsigned30 : kUnsigned31;
+}
+
+// static
+Type Type::Tuple(Type first, Type second, Type third, Zone* zone) {
+  TupleType* tuple = TupleType::New(3, zone);
+  tuple->InitElement(0, first);
+  tuple->InitElement(1, second);
+  tuple->InitElement(2, third);
+  return FromTypeBase(tuple);
+}
+
+// static
+Type Type::OtherNumberConstant(double value, Zone* zone) {
+  return FromTypeBase(OtherNumberConstantType::New(value, zone));
+}
+
+// static
+Type Type::HeapConstant(const JSHeapBroker* js_heap_broker,
+                        Handle<i::Object> value, Zone* zone) {
+  return FromTypeBase(
+      HeapConstantType::New(js_heap_broker, HeapObjectRef(value), zone));
+}
+
+// static
+Type Type::Range(double min, double max, Zone* zone) {
+  return FromTypeBase(RangeType::New(min, max, zone));
+}
+
+// static
+Type Type::Range(RangeType::Limits lims, Zone* zone) {
+  return FromTypeBase(RangeType::New(lims, zone));
+}
+
+// static
+Type Type::Union(int length, Zone* zone) {
+  return FromTypeBase(UnionType::New(length, zone));
+}
+
+const HeapConstantType* Type::AsHeapConstant() const {
+  DCHECK(IsKind(TypeBase::kHeapConstant));
+  return static_cast<const HeapConstantType*>(ToTypeBase());
+}
+
+const OtherNumberConstantType* Type::AsOtherNumberConstant() const {
+  DCHECK(IsKind(TypeBase::kOtherNumberConstant));
+  return static_cast<const OtherNumberConstantType*>(ToTypeBase());
+}
+
+const RangeType* Type::AsRange() const {
+  DCHECK(IsKind(TypeBase::kRange));
+  return static_cast<const RangeType*>(ToTypeBase());
+}
+
+const TupleType* Type::AsTuple() const {
+  DCHECK(IsKind(TypeBase::kTuple));
+  return static_cast<const TupleType*>(ToTypeBase());
+}
+
+const UnionType* Type::AsUnion() const {
+  DCHECK(IsKind(TypeBase::kUnion));
+  return static_cast<const UnionType*>(ToTypeBase());
+}
+
+std::ostream& operator<<(std::ostream& os, Type type) {
+  type.PrintTo(os);
+  return os;
 }
 
 }  // namespace compiler
diff --git a/deps/v8/src/compiler/types.h b/deps/v8/src/compiler/types.h
index 32ce987cea3b7f..dcd1075a6174ef 100644
--- a/deps/v8/src/compiler/types.h
+++ b/deps/v8/src/compiler/types.h
@@ -6,6 +6,7 @@
 #define V8_COMPILER_TYPES_H_
 
 #include "src/base/compiler-specific.h"
+#include "src/compiler/js-heap-broker.h"
 #include "src/conversions.h"
 #include "src/globals.h"
 #include "src/handles.h"
@@ -58,12 +59,12 @@ namespace compiler {
 //
 // There are two main functions for testing types:
 //
-//   T1->Is(T2)     -- tests whether T1 is included in T2 (i.e., T1 <= T2)
-//   T1->Maybe(T2)  -- tests whether T1 and T2 overlap (i.e., T1 /\ T2 =/= 0)
+//   T1.Is(T2)     -- tests whether T1 is included in T2 (i.e., T1 <= T2)
+//   T1.Maybe(T2)  -- tests whether T1 and T2 overlap (i.e., T1 /\ T2 =/= 0)
 //
 // Typically, the former is to be used to select representations (e.g., via
-// T->Is(SignedSmall())), and the latter to check whether a specific case needs
-// handling (e.g., via T->Maybe(Number())).
+// T.Is(SignedSmall())), and the latter to check whether a specific case needs
+// handling (e.g., via T.Maybe(Number())).
 //
 // There is no functionality to discover whether a type is a leaf in the
 // lattice. That is intentional. It should always be possible to refine the
@@ -217,7 +218,11 @@ namespace compiler {
   INTERNAL_BITSET_TYPE_LIST(V) \
   PROPER_BITSET_TYPE_LIST(V)
 
+class HeapConstantType;
+class OtherNumberConstantType;
+class TupleType;
 class Type;
+class UnionType;
 
 // -----------------------------------------------------------------------------
 // Bitset types (internal).
@@ -236,10 +241,6 @@ class V8_EXPORT_PRIVATE BitsetType {
   static bitset SignedSmall();
   static bitset UnsignedSmall();
 
-  bitset Bitset() {
-    return static_cast<bitset>(reinterpret_cast<uintptr_t>(this) ^ 1u);
-  }
-
   static bool IsNone(bitset bits) { return bits == kNone; }
 
   static bool Is(bitset bits1, bitset bits2) {
@@ -249,11 +250,8 @@ class V8_EXPORT_PRIVATE BitsetType {
   static double Min(bitset);
   static double Max(bitset);
 
-  static bitset Glb(Type* type);  // greatest lower bound that's a bitset
   static bitset Glb(double min, double max);
-  static bitset Lub(Type* type);  // least upper bound that's a bitset
-  static bitset Lub(i::Map* map);
-  static bitset Lub(i::Object* value);
+  static bitset Lub(HeapObjectType const& type);
   static bitset Lub(double value);
   static bitset Lub(double min, double max);
   static bitset ExpandInternals(bitset bits);
@@ -266,19 +264,7 @@ class V8_EXPORT_PRIVATE BitsetType {
 
   static bitset NumberBits(bitset bits);
 
-  static bool IsBitset(Type* type) {
-    return reinterpret_cast<uintptr_t>(type) & 1;
-  }
-
-  static Type* NewForTesting(bitset bits) { return New(bits); }
-
  private:
-  friend class Type;
-
-  static Type* New(bitset bits) {
-    return reinterpret_cast<Type*>(static_cast<uintptr_t>(bits | 1u));
-  }
-
   struct Boundary {
     bitset internal;
     bitset external;
@@ -300,154 +286,295 @@ class TypeBase {
   Kind kind() const { return kind_; }
   explicit TypeBase(Kind kind) : kind_(kind) {}
 
-  static bool IsKind(Type* type, Kind kind) {
-    if (BitsetType::IsBitset(type)) return false;
-    TypeBase* base = reinterpret_cast<TypeBase*>(type);
-    return base->kind() == kind;
-  }
-
-  // The hacky conversion to/from Type*.
-  static Type* AsType(TypeBase* type) { return reinterpret_cast<Type*>(type); }
-  static TypeBase* FromType(Type* type) {
-    return reinterpret_cast<TypeBase*>(type);
-  }
+  static bool IsKind(Type type, Kind kind);
 
  private:
   Kind kind_;
 };
 
 // -----------------------------------------------------------------------------
-// Constant types.
+// Range types.
 
-class OtherNumberConstantType : public TypeBase {
+class RangeType : public TypeBase {
  public:
-  double Value() { return value_; }
+  struct Limits {
+    double min;
+    double max;
+    Limits(double min, double max) : min(min), max(max) {}
+    explicit Limits(const RangeType* range)
+        : min(range->Min()), max(range->Max()) {}
+    bool IsEmpty();
+    static Limits Empty() { return Limits(1, 0); }
+    static Limits Intersect(Limits lhs, Limits rhs);
+    static Limits Union(Limits lhs, Limits rhs);
+  };
 
-  static bool IsOtherNumberConstant(double value);
-  static bool IsOtherNumberConstant(Object* value);
+  double Min() const { return limits_.min; }
+  double Max() const { return limits_.max; }
+
+  static bool IsInteger(double x) {
+    return nearbyint(x) == x && !IsMinusZero(x);  // Allows for infinities.
+  }
 
  private:
   friend class Type;
   friend class BitsetType;
+  friend class UnionType;
 
-  static Type* New(double value, Zone* zone) {
-    return AsType(new (zone->New(sizeof(OtherNumberConstantType)))
-                      OtherNumberConstantType(value));  // NOLINT
+  static RangeType* New(double min, double max, Zone* zone) {
+    return New(Limits(min, max), zone);
   }
 
-  static OtherNumberConstantType* cast(Type* type) {
-    DCHECK(IsKind(type, kOtherNumberConstant));
-    return static_cast<OtherNumberConstantType*>(FromType(type));
-  }
+  static RangeType* New(Limits lim, Zone* zone) {
+    DCHECK(IsInteger(lim.min) && IsInteger(lim.max));
+    DCHECK(lim.min <= lim.max);
+    BitsetType::bitset bits = BitsetType::Lub(lim.min, lim.max);
 
-  explicit OtherNumberConstantType(double value)
-      : TypeBase(kOtherNumberConstant), value_(value) {
-    CHECK(IsOtherNumberConstant(value));
+    return new (zone->New(sizeof(RangeType))) RangeType(bits, lim);
   }
 
-  BitsetType::bitset Lub() { return BitsetType::kOtherNumber; }
+  RangeType(BitsetType::bitset bitset, Limits limits)
+      : TypeBase(kRange), bitset_(bitset), limits_(limits) {}
 
-  double value_;
+  BitsetType::bitset Lub() const { return bitset_; }
+
+  BitsetType::bitset bitset_;
+  Limits limits_;
 };
 
-class V8_EXPORT_PRIVATE HeapConstantType : public NON_EXPORTED_BASE(TypeBase) {
+// -----------------------------------------------------------------------------
+// The actual type.
+
+class V8_EXPORT_PRIVATE Type {
  public:
-  i::Handle<i::HeapObject> Value() { return object_; }
+  typedef BitsetType::bitset bitset;  // Internal
+
+// Constructors.
+#define DEFINE_TYPE_CONSTRUCTOR(type, value) \
+  static Type type() { return NewBitset(BitsetType::k##type); }
+  PROPER_BITSET_TYPE_LIST(DEFINE_TYPE_CONSTRUCTOR)
+#undef DEFINE_TYPE_CONSTRUCTOR
+
+  Type() : payload_(0) {}
+
+  static Type SignedSmall() { return NewBitset(BitsetType::SignedSmall()); }
+  static Type UnsignedSmall() { return NewBitset(BitsetType::UnsignedSmall()); }
+
+  static Type OtherNumberConstant(double value, Zone* zone);
+  static Type HeapConstant(const JSHeapBroker* js_heap_broker,
+                           Handle<i::Object> value, Zone* zone);
+  static Type Range(double min, double max, Zone* zone);
+  static Type Range(RangeType::Limits lims, Zone* zone);
+  static Type Tuple(Type first, Type second, Type third, Zone* zone);
+  static Type Union(int length, Zone* zone);
+
+  // NewConstant is a factory that returns Constant, Range or Number.
+  static Type NewConstant(const JSHeapBroker* js_heap_broker,
+                          Handle<i::Object> value, Zone* zone);
+  static Type NewConstant(double value, Zone* zone);
+
+  static Type Union(Type type1, Type type2, Zone* zone);
+  static Type Intersect(Type type1, Type type2, Zone* zone);
+
+  static Type For(const JSHeapBroker* js_heap_broker, Handle<i::Map> map) {
+    HeapObjectType type = js_heap_broker->HeapObjectTypeFromMap(map);
+    return NewBitset(BitsetType::ExpandInternals(BitsetType::Lub(type)));
+  }
+
+  // Predicates.
+  bool IsNone() const { return payload_ == None().payload_; }
+  bool IsInvalid() const { return payload_ == 0u; }
+
+  bool Is(Type that) const {
+    return payload_ == that.payload_ || this->SlowIs(that);
+  }
+  bool Maybe(Type that) const;
+  bool Equals(Type that) const { return this->Is(that) && that.Is(*this); }
+
+  // Inspection.
+  bool IsBitset() const { return payload_ & 1; }
+  bool IsRange() const { return IsKind(TypeBase::kRange); }
+  bool IsHeapConstant() const { return IsKind(TypeBase::kHeapConstant); }
+  bool IsOtherNumberConstant() const {
+    return IsKind(TypeBase::kOtherNumberConstant);
+  }
+  bool IsTuple() const { return IsKind(TypeBase::kTuple); }
+
+  const HeapConstantType* AsHeapConstant() const;
+  const OtherNumberConstantType* AsOtherNumberConstant() const;
+  const RangeType* AsRange() const;
+  const TupleType* AsTuple() const;
+
+  // Minimum and maximum of a numeric type.
+  // These functions do not distinguish between -0 and +0.  NaN is ignored.
+  // Only call them on subtypes of Number whose intersection with OrderedNumber
+  // is not empty.
+  double Min() const;
+  double Max() const;
+
+  // Extracts a range from the type: if the type is a range or a union
+  // containing a range, that range is returned; otherwise, nullptr is returned.
+  Type GetRange() const;
+
+  int NumConstants() const;
+
+  static Type Invalid() { return Type(); }
+
+  bool operator==(Type other) const { return payload_ == other.payload_; }
+  bool operator!=(Type other) const { return payload_ != other.payload_; }
+
+  // Printing.
+
+  void PrintTo(std::ostream& os) const;
+
+#ifdef DEBUG
+  void Print() const;
+#endif
+
+  // Helpers for testing.
+  bool IsUnionForTesting() { return IsUnion(); }
+  bitset AsBitsetForTesting() { return AsBitset(); }
+  const UnionType* AsUnionForTesting() { return AsUnion(); }
+  Type BitsetGlbForTesting() { return NewBitset(BitsetGlb()); }
+  Type BitsetLubForTesting() { return NewBitset(BitsetLub()); }
 
  private:
-  friend class Type;
-  friend class BitsetType;
+  // Friends.
+  template <class>
+  friend class Iterator;
+  friend BitsetType;
+  friend UnionType;
+  friend size_t hash_value(Type type);
 
-  static Type* New(i::Handle<i::HeapObject> value, Zone* zone) {
-    BitsetType::bitset bitset = BitsetType::Lub(*value);
-    return AsType(new (zone->New(sizeof(HeapConstantType)))
-                      HeapConstantType(bitset, value));
+  Type(bitset bits) : payload_(bits | 1u) {}
+  Type(TypeBase* type_base)
+      : payload_(reinterpret_cast<uintptr_t>(type_base)) {}
+
+  // Internal inspection.
+  bool IsKind(TypeBase::Kind kind) const {
+    if (IsBitset()) return false;
+    const TypeBase* base = ToTypeBase();
+    return base->kind() == kind;
   }
 
-  static HeapConstantType* cast(Type* type) {
-    DCHECK(IsKind(type, kHeapConstant));
-    return static_cast<HeapConstantType*>(FromType(type));
+  const TypeBase* ToTypeBase() const {
+    return reinterpret_cast<TypeBase*>(payload_);
   }
+  static Type FromTypeBase(TypeBase* type) { return Type(type); }
 
-  HeapConstantType(BitsetType::bitset bitset, i::Handle<i::HeapObject> object);
+  bool IsAny() const { return payload_ == Any().payload_; }
+  bool IsUnion() const { return IsKind(TypeBase::kUnion); }
 
-  BitsetType::bitset Lub() { return bitset_; }
+  bitset AsBitset() const {
+    DCHECK(IsBitset());
+    return static_cast<bitset>(payload_) ^ 1u;
+  }
 
-  BitsetType::bitset bitset_;
-  Handle<i::HeapObject> object_;
+  const UnionType* AsUnion() const;
+
+  bitset BitsetGlb() const;  // greatest lower bound that's a bitset
+  bitset BitsetLub() const;  // least upper bound that's a bitset
+
+  bool SlowIs(Type that) const;
+
+  static Type NewBitset(bitset bits) { return Type(bits); }
+
+  static bool Overlap(const RangeType* lhs, const RangeType* rhs);
+  static bool Contains(const RangeType* lhs, const RangeType* rhs);
+
+  static int UpdateRange(Type type, UnionType* result, int size, Zone* zone);
+
+  static RangeType::Limits IntersectRangeAndBitset(Type range, Type bits,
+                                                   Zone* zone);
+  static RangeType::Limits ToLimits(bitset bits, Zone* zone);
+
+  bool SimplyEquals(Type that) const;
+
+  static int AddToUnion(Type type, UnionType* result, int size, Zone* zone);
+  static int IntersectAux(Type type, Type other, UnionType* result, int size,
+                          RangeType::Limits* limits, Zone* zone);
+  static Type NormalizeUnion(UnionType* unioned, int size, Zone* zone);
+  static Type NormalizeRangeAndBitset(Type range, bitset* bits, Zone* zone);
+
+  // If LSB is set, the payload is a bitset; if LSB is clear, the payload is
+  // a pointer to a subtype of the TypeBase class.
+  uintptr_t payload_;
 };
 
+inline size_t hash_value(Type type) { return type.payload_; }
+V8_EXPORT_PRIVATE std::ostream& operator<<(std::ostream& os, Type type);
+
 // -----------------------------------------------------------------------------
-// Range types.
+// Constant types.
 
-class RangeType : public TypeBase {
+class OtherNumberConstantType : public TypeBase {
  public:
-  struct Limits {
-    double min;
-    double max;
-    Limits(double min, double max) : min(min), max(max) {}
-    explicit Limits(RangeType* range) : min(range->Min()), max(range->Max()) {}
-    bool IsEmpty();
-    static Limits Empty() { return Limits(1, 0); }
-    static Limits Intersect(Limits lhs, Limits rhs);
-    static Limits Union(Limits lhs, Limits rhs);
-  };
+  double Value() const { return value_; }
 
-  double Min() { return limits_.min; }
-  double Max() { return limits_.max; }
+  static bool IsOtherNumberConstant(double value);
 
  private:
   friend class Type;
   friend class BitsetType;
-  friend class UnionType;
 
-  static Type* New(double min, double max, Zone* zone) {
-    return New(Limits(min, max), zone);
+  static OtherNumberConstantType* New(double value, Zone* zone) {
+    return new (zone->New(sizeof(OtherNumberConstantType)))
+        OtherNumberConstantType(value);  // NOLINT
   }
 
-  static bool IsInteger(double x) {
-    return nearbyint(x) == x && !i::IsMinusZero(x);  // Allows for infinities.
+  explicit OtherNumberConstantType(double value)
+      : TypeBase(kOtherNumberConstant), value_(value) {
+    CHECK(IsOtherNumberConstant(value));
   }
 
-  static Type* New(Limits lim, Zone* zone) {
-    DCHECK(IsInteger(lim.min) && IsInteger(lim.max));
-    DCHECK(lim.min <= lim.max);
-    BitsetType::bitset bits = BitsetType::Lub(lim.min, lim.max);
+  BitsetType::bitset Lub() const { return BitsetType::kOtherNumber; }
 
-    return AsType(new (zone->New(sizeof(RangeType))) RangeType(bits, lim));
-  }
+  double value_;
+};
+
+class V8_EXPORT_PRIVATE HeapConstantType : public NON_EXPORTED_BASE(TypeBase) {
+ public:
+  Handle<HeapObject> Value() const;
+  const HeapObjectRef& Ref() const { return heap_ref_; }
+
+ private:
+  friend class Type;
+  friend class BitsetType;
 
-  static RangeType* cast(Type* type) {
-    DCHECK(IsKind(type, kRange));
-    return static_cast<RangeType*>(FromType(type));
+  static HeapConstantType* New(const JSHeapBroker* broker,
+                               const HeapObjectRef& heap_ref, Zone* zone) {
+    DCHECK(!heap_ref.IsHeapNumber());
+    DCHECK_IMPLIES(heap_ref.IsString(), heap_ref.IsInternalizedString());
+    BitsetType::bitset bitset = BitsetType::Lub(heap_ref.type(broker));
+    return new (zone->New(sizeof(HeapConstantType)))
+        HeapConstantType(bitset, heap_ref);
   }
 
-  RangeType(BitsetType::bitset bitset, Limits limits)
-      : TypeBase(kRange), bitset_(bitset), limits_(limits) {}
+  HeapConstantType(BitsetType::bitset bitset, const HeapObjectRef& heap_ref);
 
-  BitsetType::bitset Lub() { return bitset_; }
+  BitsetType::bitset Lub() const { return bitset_; }
 
   BitsetType::bitset bitset_;
-  Limits limits_;
+  HeapObjectRef heap_ref_;
 };
 
 // -----------------------------------------------------------------------------
 // Superclass for types with variable number of type fields.
 class StructuralType : public TypeBase {
  public:
-  int LengthForTesting() { return Length(); }
+  int LengthForTesting() const { return Length(); }
 
  protected:
   friend class Type;
 
-  int Length() { return length_; }
+  int Length() const { return length_; }
 
-  Type* Get(int i) {
+  Type Get(int i) const {
     DCHECK(0 <= i && i < this->Length());
     return elements_[i];
   }
 
-  void Set(int i, Type* type) {
+  void Set(int i, Type type) {
     DCHECK(0 <= i && i < this->Length());
     elements_[i] = type;
   }
@@ -457,14 +584,14 @@ class StructuralType : public TypeBase {
     length_ = length;
   }
 
-  StructuralType(Kind kind, int length, i::Zone* zone)
+  StructuralType(Kind kind, int length, Zone* zone)
       : TypeBase(kind), length_(length) {
-    elements_ = reinterpret_cast<Type**>(zone->New(sizeof(Type*) * length));
+    elements_ = reinterpret_cast<Type*>(zone->New(sizeof(Type) * length));
   }
 
  private:
   int length_;
-  Type** elements_;
+  Type* elements_;
 };
 
 // -----------------------------------------------------------------------------
@@ -472,23 +599,18 @@ class StructuralType : public TypeBase {
 
 class TupleType : public StructuralType {
  public:
-  int Arity() { return this->Length(); }
-  Type* Element(int i) { return this->Get(i); }
+  int Arity() const { return this->Length(); }
+  Type Element(int i) const { return this->Get(i); }
 
-  void InitElement(int i, Type* type) { this->Set(i, type); }
+  void InitElement(int i, Type type) { this->Set(i, type); }
 
  private:
   friend class Type;
 
   TupleType(int length, Zone* zone) : StructuralType(kTuple, length, zone) {}
 
-  static Type* New(int length, Zone* zone) {
-    return AsType(new (zone->New(sizeof(TupleType))) TupleType(length, zone));
-  }
-
-  static TupleType* cast(Type* type) {
-    DCHECK(IsKind(type, kTuple));
-    return static_cast<TupleType*>(FromType(type));
+  static TupleType* New(int length, Zone* zone) {
+    return new (zone->New(sizeof(TupleType))) TupleType(length, zone);
   }
 };
 
@@ -506,170 +628,11 @@ class UnionType : public StructuralType {
 
   UnionType(int length, Zone* zone) : StructuralType(kUnion, length, zone) {}
 
-  static Type* New(int length, Zone* zone) {
-    return AsType(new (zone->New(sizeof(UnionType))) UnionType(length, zone));
-  }
-
-  static UnionType* cast(Type* type) {
-    DCHECK(IsKind(type, kUnion));
-    return static_cast<UnionType*>(FromType(type));
-  }
-
-  bool Wellformed();
-};
-
-class V8_EXPORT_PRIVATE Type {
- public:
-  typedef BitsetType::bitset bitset;  // Internal
-
-// Constructors.
-#define DEFINE_TYPE_CONSTRUCTOR(type, value) \
-  static Type* type() { return BitsetType::New(BitsetType::k##type); }
-  PROPER_BITSET_TYPE_LIST(DEFINE_TYPE_CONSTRUCTOR)
-#undef DEFINE_TYPE_CONSTRUCTOR
-
-  static Type* SignedSmall() {
-    return BitsetType::New(BitsetType::SignedSmall());
-  }
-  static Type* UnsignedSmall() {
-    return BitsetType::New(BitsetType::UnsignedSmall());
+  static UnionType* New(int length, Zone* zone) {
+    return new (zone->New(sizeof(UnionType))) UnionType(length, zone);
   }
 
-  static Type* OtherNumberConstant(double value, Zone* zone) {
-    return OtherNumberConstantType::New(value, zone);
-  }
-  static Type* HeapConstant(i::Handle<i::HeapObject> value, Zone* zone) {
-    return HeapConstantType::New(value, zone);
-  }
-  static Type* Range(double min, double max, Zone* zone) {
-    return RangeType::New(min, max, zone);
-  }
-  static Type* Tuple(Type* first, Type* second, Type* third, Zone* zone) {
-    Type* tuple = TupleType::New(3, zone);
-    tuple->AsTuple()->InitElement(0, first);
-    tuple->AsTuple()->InitElement(1, second);
-    tuple->AsTuple()->InitElement(2, third);
-    return tuple;
-  }
-
-  // NewConstant is a factory that returns Constant, Range or Number.
-  static Type* NewConstant(i::Handle<i::Object> value, Zone* zone);
-  static Type* NewConstant(double value, Zone* zone);
-
-  static Type* Union(Type* type1, Type* type2, Zone* zone);
-  static Type* Intersect(Type* type1, Type* type2, Zone* zone);
-
-  static Type* Of(double value, Zone* zone) {
-    return BitsetType::New(BitsetType::ExpandInternals(BitsetType::Lub(value)));
-  }
-  static Type* Of(i::Object* value, Zone* zone) {
-    return BitsetType::New(BitsetType::ExpandInternals(BitsetType::Lub(value)));
-  }
-  static Type* Of(i::Handle<i::Object> value, Zone* zone) {
-    return Of(*value, zone);
-  }
-
-  static Type* For(i::Map* map) {
-    return BitsetType::New(BitsetType::ExpandInternals(BitsetType::Lub(map)));
-  }
-  static Type* For(i::Handle<i::Map> map) { return For(*map); }
-
-  // Predicates.
-  bool IsNone() { return this == None(); }
-
-  bool Is(Type* that) { return this == that || this->SlowIs(that); }
-  bool Maybe(Type* that);
-  bool Equals(Type* that) { return this->Is(that) && that->Is(this); }
-
-  // Inspection.
-  bool IsRange() { return IsKind(TypeBase::kRange); }
-  bool IsHeapConstant() { return IsKind(TypeBase::kHeapConstant); }
-  bool IsOtherNumberConstant() {
-    return IsKind(TypeBase::kOtherNumberConstant);
-  }
-  bool IsTuple() { return IsKind(TypeBase::kTuple); }
-
-  HeapConstantType* AsHeapConstant() { return HeapConstantType::cast(this); }
-  OtherNumberConstantType* AsOtherNumberConstant() {
-    return OtherNumberConstantType::cast(this);
-  }
-  RangeType* AsRange() { return RangeType::cast(this); }
-  TupleType* AsTuple() { return TupleType::cast(this); }
-
-  // Minimum and maximum of a numeric type.
-  // These functions do not distinguish between -0 and +0.  NaN is ignored.
-  // Only call them on subtypes of Number whose intersection with OrderedNumber
-  // is not empty.
-  double Min();
-  double Max();
-
-  // Extracts a range from the type: if the type is a range or a union
-  // containing a range, that range is returned; otherwise, nullptr is returned.
-  Type* GetRange();
-
-  static bool IsInteger(i::Object* x);
-  static bool IsInteger(double x) {
-    return nearbyint(x) == x && !i::IsMinusZero(x);  // Allows for infinities.
-  }
-
-  int NumConstants();
-
-  // Printing.
-
-  void PrintTo(std::ostream& os);
-
-#ifdef DEBUG
-  void Print();
-#endif
-
-  // Helpers for testing.
-  bool IsBitsetForTesting() { return IsBitset(); }
-  bool IsUnionForTesting() { return IsUnion(); }
-  bitset AsBitsetForTesting() { return AsBitset(); }
-  UnionType* AsUnionForTesting() { return AsUnion(); }
-
- private:
-  // Friends.
-  template <class>
-  friend class Iterator;
-  friend BitsetType;
-  friend UnionType;
-
-  // Internal inspection.
-  bool IsKind(TypeBase::Kind kind) { return TypeBase::IsKind(this, kind); }
-
-  bool IsAny() { return this == Any(); }
-  bool IsBitset() { return BitsetType::IsBitset(this); }
-  bool IsUnion() { return IsKind(TypeBase::kUnion); }
-
-  bitset AsBitset() {
-    DCHECK(this->IsBitset());
-    return reinterpret_cast<BitsetType*>(this)->Bitset();
-  }
-  UnionType* AsUnion() { return UnionType::cast(this); }
-
-  bitset BitsetGlb() { return BitsetType::Glb(this); }
-  bitset BitsetLub() { return BitsetType::Lub(this); }
-
-  bool SlowIs(Type* that);
-
-  static bool Overlap(RangeType* lhs, RangeType* rhs);
-  static bool Contains(RangeType* lhs, RangeType* rhs);
-  static bool Contains(RangeType* range, i::Object* val);
-
-  static int UpdateRange(Type* type, UnionType* result, int size, Zone* zone);
-
-  static RangeType::Limits IntersectRangeAndBitset(Type* range, Type* bits,
-                                                   Zone* zone);
-  static RangeType::Limits ToLimits(bitset bits, Zone* zone);
-
-  bool SimplyEquals(Type* that);
-
-  static int AddToUnion(Type* type, UnionType* result, int size, Zone* zone);
-  static int IntersectAux(Type* type, Type* other, UnionType* result, int size,
-                          RangeType::Limits* limits, Zone* zone);
-  static Type* NormalizeUnion(Type* unioned, int size, Zone* zone);
-  static Type* NormalizeRangeAndBitset(Type* range, bitset* bits, Zone* zone);
+  bool Wellformed() const;
 };
 
 }  // namespace compiler
diff --git a/deps/v8/src/compiler/value-numbering-reducer.cc b/deps/v8/src/compiler/value-numbering-reducer.cc
index 5b253ae3d0ab68..864d33bc201eb3 100644
--- a/deps/v8/src/compiler/value-numbering-reducer.cc
+++ b/deps/v8/src/compiler/value-numbering-reducer.cc
@@ -128,15 +128,15 @@ Reduction ValueNumberingReducer::ReplaceIfTypesMatch(Node* node,
                                                      Node* replacement) {
   // Make sure the replacement has at least as good type as the original node.
   if (NodeProperties::IsTyped(replacement) && NodeProperties::IsTyped(node)) {
-    Type* replacement_type = NodeProperties::GetType(replacement);
-    Type* node_type = NodeProperties::GetType(node);
-    if (!replacement_type->Is(node_type)) {
+    Type replacement_type = NodeProperties::GetType(replacement);
+    Type node_type = NodeProperties::GetType(node);
+    if (!replacement_type.Is(node_type)) {
       // Ideally, we would set an intersection of {replacement_type} and
       // {node_type} here. However, typing of NumberConstants assigns different
       // types to constants with the same value (it creates a fresh heap
       // number), which would make the intersection empty. To be safe, we use
       // the smaller type if the types are comparable.
-      if (node_type->Is(replacement_type)) {
+      if (node_type.Is(replacement_type)) {
         NodeProperties::SetType(replacement, node_type);
       } else {
         // Types are not comparable => do not replace.
diff --git a/deps/v8/src/compiler/verifier.cc b/deps/v8/src/compiler/verifier.cc
index 54a0e47dd91b28..52cbd6e0b72d55 100644
--- a/deps/v8/src/compiler/verifier.cc
+++ b/deps/v8/src/compiler/verifier.cc
@@ -54,38 +54,30 @@ class Verifier::Visitor {
       FATAL("%s", str.str().c_str());
     }
   }
-  void CheckTypeIs(Node* node, Type* type) {
-    if (typing == TYPED && !NodeProperties::GetType(node)->Is(type)) {
+  void CheckTypeIs(Node* node, Type type) {
+    if (typing == TYPED && !NodeProperties::GetType(node).Is(type)) {
       std::ostringstream str;
-      str << "TypeError: node #" << node->id() << ":" << *node->op()
-          << " type ";
-      NodeProperties::GetType(node)->PrintTo(str);
-      str << " is not ";
-      type->PrintTo(str);
+      str << "TypeError: node #" << node->id() << ":" << *node->op() << " type "
+          << NodeProperties::GetType(node) << " is not " << type;
       FATAL("%s", str.str().c_str());
     }
   }
-  void CheckTypeMaybe(Node* node, Type* type) {
-    if (typing == TYPED && !NodeProperties::GetType(node)->Maybe(type)) {
+  void CheckTypeMaybe(Node* node, Type type) {
+    if (typing == TYPED && !NodeProperties::GetType(node).Maybe(type)) {
       std::ostringstream str;
-      str << "TypeError: node #" << node->id() << ":" << *node->op()
-          << " type ";
-      NodeProperties::GetType(node)->PrintTo(str);
-      str << " must intersect ";
-      type->PrintTo(str);
+      str << "TypeError: node #" << node->id() << ":" << *node->op() << " type "
+          << NodeProperties::GetType(node) << " must intersect " << type;
       FATAL("%s", str.str().c_str());
     }
   }
-  void CheckValueInputIs(Node* node, int i, Type* type) {
+  void CheckValueInputIs(Node* node, int i, Type type) {
     Node* input = NodeProperties::GetValueInput(node, i);
-    if (typing == TYPED && !NodeProperties::GetType(input)->Is(type)) {
+    if (typing == TYPED && !NodeProperties::GetType(input).Is(type)) {
       std::ostringstream str;
       str << "TypeError: node #" << node->id() << ":" << *node->op()
           << "(input @" << i << " = " << input->opcode() << ":"
-          << input->op()->mnemonic() << ") type ";
-      NodeProperties::GetType(input)->PrintTo(str);
-      str << " is not ";
-      type->PrintTo(str);
+          << input->op()->mnemonic() << ") type "
+          << NodeProperties::GetType(input) << " is not " << type;
       FATAL("%s", str.str().c_str());
     }
   }
@@ -544,7 +536,7 @@ void Verifier::Visitor::Check(Node* node, const AllNodes& all) {
       // Type must be subsumed by input type.
       if (typing == TYPED) {
         Node* val = NodeProperties::GetValueInput(node, 0);
-        CHECK(NodeProperties::GetType(val)->Is(NodeProperties::GetType(node)));
+        CHECK(NodeProperties::GetType(val).Is(NodeProperties::GetType(node)));
       }
       break;
     }
@@ -652,7 +644,16 @@ void Verifier::Visitor::Check(Node* node, const AllNodes& all) {
       // Type is Receiver.
       CheckTypeIs(node, Type::Receiver());
       break;
-
+    case IrOpcode::kJSParseInt:
+      CheckValueInputIs(node, 0, Type::Any());
+      CheckValueInputIs(node, 1, Type::Any());
+      CheckTypeIs(node, Type::Number());
+      break;
+    case IrOpcode::kJSRegExpTest:
+      CheckValueInputIs(node, 0, Type::Any());
+      CheckValueInputIs(node, 1, Type::String());
+      CheckTypeIs(node, Type::Boolean());
+      break;
     case IrOpcode::kJSCreate:
       // Type is Object.
       CheckTypeIs(node, Type::Object());
@@ -693,6 +694,10 @@ void Verifier::Visitor::Check(Node* node, const AllNodes& all) {
       // Type is OtherObject.
       CheckTypeIs(node, Type::OtherObject());
       break;
+    case IrOpcode::kJSCreateObject:
+      // Type is Object.
+      CheckTypeIs(node, Type::OtherObject());
+      break;
     case IrOpcode::kJSCreatePromise:
       // Type is OtherObject.
       CheckTypeIs(node, Type::OtherObject());
@@ -895,6 +900,10 @@ void Verifier::Visitor::Check(Node* node, const AllNodes& all) {
       CheckValueInputIs(node, 1, Type::Any());
       CheckTypeIs(node, Type::Undefined());
       break;
+    case IrOpcode::kJSObjectIsArray:
+      CheckValueInputIs(node, 0, Type::Any());
+      CheckTypeIs(node, Type::Boolean());
+      break;
 
     case IrOpcode::kComment:
     case IrOpcode::kDebugAbort:
@@ -1174,6 +1183,10 @@ void Verifier::Visitor::Check(Node* node, const AllNodes& all) {
       CheckValueInputIs(node, 0, Type::Number());
       CheckTypeIs(node, Type::Boolean());
       break;
+    case IrOpcode::kNumberIsNaN:
+      CheckValueInputIs(node, 0, Type::Number());
+      CheckTypeIs(node, Type::Boolean());
+      break;
     case IrOpcode::kObjectIsFiniteNumber:
       CheckValueInputIs(node, 0, Type::Any());
       CheckTypeIs(node, Type::Boolean());
@@ -1254,8 +1267,8 @@ void Verifier::Visitor::Check(Node* node, const AllNodes& all) {
     case IrOpcode::kChangeTaggedSignedToInt32: {
       // Signed32 /\ Tagged -> Signed32 /\ UntaggedInt32
       // TODO(neis): Activate once ChangeRepresentation works in typer.
-      // Type* from = Type::Intersect(Type::Signed32(), Type::Tagged());
-      // Type* to = Type::Intersect(Type::Signed32(), Type::UntaggedInt32());
+      // Type from = Type::Intersect(Type::Signed32(), Type::Tagged());
+      // Type to = Type::Intersect(Type::Signed32(), Type::UntaggedInt32());
       // CheckValueInputIs(node, 0, from));
       // CheckTypeIs(node, to));
       break;
@@ -1263,8 +1276,8 @@ void Verifier::Visitor::Check(Node* node, const AllNodes& all) {
     case IrOpcode::kChangeTaggedToInt32: {
       // Signed32 /\ Tagged -> Signed32 /\ UntaggedInt32
       // TODO(neis): Activate once ChangeRepresentation works in typer.
-      // Type* from = Type::Intersect(Type::Signed32(), Type::Tagged());
-      // Type* to = Type::Intersect(Type::Signed32(), Type::UntaggedInt32());
+      // Type from = Type::Intersect(Type::Signed32(), Type::Tagged());
+      // Type to = Type::Intersect(Type::Signed32(), Type::UntaggedInt32());
       // CheckValueInputIs(node, 0, from));
       // CheckTypeIs(node, to));
       break;
@@ -1272,8 +1285,8 @@ void Verifier::Visitor::Check(Node* node, const AllNodes& all) {
     case IrOpcode::kChangeTaggedToUint32: {
       // Unsigned32 /\ Tagged -> Unsigned32 /\ UntaggedInt32
       // TODO(neis): Activate once ChangeRepresentation works in typer.
-      // Type* from = Type::Intersect(Type::Unsigned32(), Type::Tagged());
-      // Type* to =Type::Intersect(Type::Unsigned32(), Type::UntaggedInt32());
+      // Type from = Type::Intersect(Type::Unsigned32(), Type::Tagged());
+      // Type to =Type::Intersect(Type::Unsigned32(), Type::UntaggedInt32());
       // CheckValueInputIs(node, 0, from));
       // CheckTypeIs(node, to));
       break;
@@ -1281,8 +1294,8 @@ void Verifier::Visitor::Check(Node* node, const AllNodes& all) {
     case IrOpcode::kChangeTaggedToFloat64: {
       // NumberOrUndefined /\ Tagged -> Number /\ UntaggedFloat64
       // TODO(neis): Activate once ChangeRepresentation works in typer.
-      // Type* from = Type::Intersect(Type::Number(), Type::Tagged());
-      // Type* to = Type::Intersect(Type::Number(), Type::UntaggedFloat64());
+      // Type from = Type::Intersect(Type::Number(), Type::Tagged());
+      // Type to = Type::Intersect(Type::Number(), Type::UntaggedFloat64());
       // CheckValueInputIs(node, 0, from));
       // CheckTypeIs(node, to));
       break;
@@ -1292,9 +1305,9 @@ void Verifier::Visitor::Check(Node* node, const AllNodes& all) {
     case IrOpcode::kTruncateTaggedToFloat64: {
       // NumberOrUndefined /\ Tagged -> Number /\ UntaggedFloat64
       // TODO(neis): Activate once ChangeRepresentation works in typer.
-      // Type* from = Type::Intersect(Type::NumberOrUndefined(),
+      // Type from = Type::Intersect(Type::NumberOrUndefined(),
       // Type::Tagged());
-      // Type* to = Type::Intersect(Type::Number(), Type::UntaggedFloat64());
+      // Type to = Type::Intersect(Type::Number(), Type::UntaggedFloat64());
       // CheckValueInputIs(node, 0, from));
       // CheckTypeIs(node, to));
       break;
@@ -1302,8 +1315,8 @@ void Verifier::Visitor::Check(Node* node, const AllNodes& all) {
     case IrOpcode::kChangeInt31ToTaggedSigned: {
       // Signed31 /\ UntaggedInt32 -> Signed31 /\ Tagged
       // TODO(neis): Activate once ChangeRepresentation works in typer.
-      // Type* from =Type::Intersect(Type::Signed31(), Type::UntaggedInt32());
-      // Type* to = Type::Intersect(Type::Signed31(), Type::Tagged());
+      // Type from =Type::Intersect(Type::Signed31(), Type::UntaggedInt32());
+      // Type to = Type::Intersect(Type::Signed31(), Type::Tagged());
       // CheckValueInputIs(node, 0, from));
       // CheckTypeIs(node, to));
       break;
@@ -1311,8 +1324,8 @@ void Verifier::Visitor::Check(Node* node, const AllNodes& all) {
     case IrOpcode::kChangeInt32ToTagged: {
       // Signed32 /\ UntaggedInt32 -> Signed32 /\ Tagged
       // TODO(neis): Activate once ChangeRepresentation works in typer.
-      // Type* from =Type::Intersect(Type::Signed32(), Type::UntaggedInt32());
-      // Type* to = Type::Intersect(Type::Signed32(), Type::Tagged());
+      // Type from =Type::Intersect(Type::Signed32(), Type::UntaggedInt32());
+      // Type to = Type::Intersect(Type::Signed32(), Type::Tagged());
       // CheckValueInputIs(node, 0, from));
       // CheckTypeIs(node, to));
       break;
@@ -1320,8 +1333,8 @@ void Verifier::Visitor::Check(Node* node, const AllNodes& all) {
     case IrOpcode::kChangeUint32ToTagged: {
       // Unsigned32 /\ UntaggedInt32 -> Unsigned32 /\ Tagged
       // TODO(neis): Activate once ChangeRepresentation works in typer.
-      // Type* from=Type::Intersect(Type::Unsigned32(),Type::UntaggedInt32());
-      // Type* to = Type::Intersect(Type::Unsigned32(), Type::Tagged());
+      // Type from=Type::Intersect(Type::Unsigned32(),Type::UntaggedInt32());
+      // Type to = Type::Intersect(Type::Unsigned32(), Type::Tagged());
       // CheckValueInputIs(node, 0, from));
       // CheckTypeIs(node, to));
       break;
@@ -1329,8 +1342,8 @@ void Verifier::Visitor::Check(Node* node, const AllNodes& all) {
     case IrOpcode::kChangeFloat64ToTagged: {
       // Number /\ UntaggedFloat64 -> Number /\ Tagged
       // TODO(neis): Activate once ChangeRepresentation works in typer.
-      // Type* from =Type::Intersect(Type::Number(), Type::UntaggedFloat64());
-      // Type* to = Type::Intersect(Type::Number(), Type::Tagged());
+      // Type from =Type::Intersect(Type::Number(), Type::UntaggedFloat64());
+      // Type to = Type::Intersect(Type::Number(), Type::Tagged());
       // CheckValueInputIs(node, 0, from));
       // CheckTypeIs(node, to));
       break;
@@ -1340,8 +1353,8 @@ void Verifier::Visitor::Check(Node* node, const AllNodes& all) {
     case IrOpcode::kChangeTaggedToBit: {
       // Boolean /\ TaggedPtr -> Boolean /\ UntaggedInt1
       // TODO(neis): Activate once ChangeRepresentation works in typer.
-      // Type* from = Type::Intersect(Type::Boolean(), Type::TaggedPtr());
-      // Type* to = Type::Intersect(Type::Boolean(), Type::UntaggedInt1());
+      // Type from = Type::Intersect(Type::Boolean(), Type::TaggedPtr());
+      // Type to = Type::Intersect(Type::Boolean(), Type::UntaggedInt1());
       // CheckValueInputIs(node, 0, from));
       // CheckTypeIs(node, to));
       break;
@@ -1349,8 +1362,8 @@ void Verifier::Visitor::Check(Node* node, const AllNodes& all) {
     case IrOpcode::kChangeBitToTagged: {
       // Boolean /\ UntaggedInt1 -> Boolean /\ TaggedPtr
       // TODO(neis): Activate once ChangeRepresentation works in typer.
-      // Type* from = Type::Intersect(Type::Boolean(), Type::UntaggedInt1());
-      // Type* to = Type::Intersect(Type::Boolean(), Type::TaggedPtr());
+      // Type from = Type::Intersect(Type::Boolean(), Type::UntaggedInt1());
+      // Type to = Type::Intersect(Type::Boolean(), Type::TaggedPtr());
       // CheckValueInputIs(node, 0, from));
       // CheckTypeIs(node, to));
       break;
@@ -1358,8 +1371,8 @@ void Verifier::Visitor::Check(Node* node, const AllNodes& all) {
     case IrOpcode::kTruncateTaggedToWord32: {
       // Number /\ Tagged -> Signed32 /\ UntaggedInt32
       // TODO(neis): Activate once ChangeRepresentation works in typer.
-      // Type* from = Type::Intersect(Type::Number(), Type::Tagged());
-      // Type* to = Type::Intersect(Type::Number(), Type::UntaggedInt32());
+      // Type from = Type::Intersect(Type::Number(), Type::Tagged());
+      // Type to = Type::Intersect(Type::Number(), Type::UntaggedInt32());
       // CheckValueInputIs(node, 0, from));
       // CheckTypeIs(node, to));
       break;
@@ -1373,9 +1386,8 @@ void Verifier::Visitor::Check(Node* node, const AllNodes& all) {
       CheckValueInputIs(node, 1, Type::Unsigned31());
       CheckTypeIs(node, Type::Unsigned31());
       break;
-    case IrOpcode::kMaskIndexWithBound:
+    case IrOpcode::kPoisonIndex:
       CheckValueInputIs(node, 0, Type::Unsigned32());
-      CheckValueInputIs(node, 1, Type::Unsigned31());
       CheckTypeIs(node, Type::Unsigned32());
       break;
     case IrOpcode::kCheckHeapObject:
@@ -1486,6 +1498,8 @@ void Verifier::Visitor::Check(Node* node, const AllNodes& all) {
       break;
     case IrOpcode::kLoadTypedElement:
       break;
+    case IrOpcode::kLoadDataViewElement:
+      break;
     case IrOpcode::kStoreField:
       // (Object, fieldtype) -> _|_
       // TODO(rossberg): activate once machine ops are typed.
@@ -1515,6 +1529,9 @@ void Verifier::Visitor::Check(Node* node, const AllNodes& all) {
     case IrOpcode::kStoreTypedElement:
       CheckNotTyped(node);
       break;
+    case IrOpcode::kStoreDataViewElement:
+      CheckNotTyped(node);
+      break;
     case IrOpcode::kNumberSilenceNaN:
       CheckValueInputIs(node, 0, Type::Number());
       CheckTypeIs(node, Type::Number());
@@ -1525,6 +1542,10 @@ void Verifier::Visitor::Check(Node* node, const AllNodes& all) {
     case IrOpcode::kTypeGuard:
       CheckTypeIs(node, TypeGuardTypeOf(node->op()));
       break;
+    case IrOpcode::kDateNow:
+      CHECK_EQ(0, value_count);
+      CheckTypeIs(node, Type::Number());
+      break;
 
     // Machine operators
     // -----------------------
@@ -1689,12 +1710,12 @@ void Verifier::Visitor::Check(Node* node, const AllNodes& all) {
     case IrOpcode::kWord32PairShl:
     case IrOpcode::kWord32PairShr:
     case IrOpcode::kWord32PairSar:
-    case IrOpcode::kPoisonOnSpeculationTagged:
-    case IrOpcode::kPoisonOnSpeculationWord:
+    case IrOpcode::kTaggedPoisonOnSpeculation:
+    case IrOpcode::kWord32PoisonOnSpeculation:
+    case IrOpcode::kWord64PoisonOnSpeculation:
     case IrOpcode::kLoadStackPointer:
     case IrOpcode::kLoadFramePointer:
     case IrOpcode::kLoadParentFramePointer:
-    case IrOpcode::kLoadRootsPointer:
     case IrOpcode::kUnalignedLoad:
     case IrOpcode::kUnalignedStore:
     case IrOpcode::kWord32AtomicLoad:
diff --git a/deps/v8/src/compiler/wasm-compiler.cc b/deps/v8/src/compiler/wasm-compiler.cc
index 85bedd3c53c862..a1c6cb003edf1f 100644
--- a/deps/v8/src/compiler/wasm-compiler.cc
+++ b/deps/v8/src/compiler/wasm-compiler.cc
@@ -7,12 +7,14 @@
 #include <memory>
 
 #include "src/assembler-inl.h"
+#include "src/assembler.h"
 #include "src/base/optional.h"
 #include "src/base/platform/elapsed-timer.h"
 #include "src/base/platform/platform.h"
 #include "src/base/v8-fallthrough.h"
 #include "src/builtins/builtins.h"
 #include "src/code-factory.h"
+#include "src/compiler.h"
 #include "src/compiler/access-builder.h"
 #include "src/compiler/code-generator.h"
 #include "src/compiler/common-operator.h"
@@ -27,6 +29,7 @@
 #include "src/compiler/linkage.h"
 #include "src/compiler/machine-operator.h"
 #include "src/compiler/node-matchers.h"
+#include "src/compiler/node-origin-table.h"
 #include "src/compiler/pipeline.h"
 #include "src/compiler/simd-scalar-lowering.h"
 #include "src/compiler/zone-stats.h"
@@ -35,9 +38,12 @@
 #include "src/log-inl.h"
 #include "src/trap-handler/trap-handler.h"
 #include "src/wasm/function-body-decoder.h"
+#include "src/wasm/function-compiler.h"
+#include "src/wasm/jump-table-assembler.h"
 #include "src/wasm/memory-tracing.h"
 #include "src/wasm/wasm-code-manager.h"
 #include "src/wasm/wasm-limits.h"
+#include "src/wasm/wasm-linkage.h"
 #include "src/wasm/wasm-module.h"
 #include "src/wasm/wasm-objects-inl.h"
 #include "src/wasm/wasm-opcodes.h"
@@ -63,80 +69,87 @@ namespace compiler {
 
 #define LOAD_INSTANCE_FIELD(name, type)                                      \
   graph()->NewNode(                                                          \
-      jsgraph()->machine()->Load(type), instance_node_.get(),                \
-      jsgraph()->Int32Constant(WASM_INSTANCE_OBJECT_OFFSET(name)), *effect_, \
+      mcgraph()->machine()->Load(type), instance_node_.get(),                \
+      mcgraph()->Int32Constant(WASM_INSTANCE_OBJECT_OFFSET(name)), *effect_, \
       *control_)
 
 #define LOAD_FIXED_ARRAY_SLOT(array_node, index)                              \
-  graph()->NewNode(jsgraph()->machine()->Load(MachineType::TaggedPointer()),  \
+  graph()->NewNode(mcgraph()->machine()->Load(MachineType::TaggedPointer()),  \
                    array_node,                                                \
-                   jsgraph()->Int32Constant(FixedArrayOffsetMinusTag(index)), \
+                   mcgraph()->Int32Constant(FixedArrayOffsetMinusTag(index)), \
                    *effect_, *control_);
 
+int FixedArrayOffsetMinusTag(uint32_t index) {
+  auto access = AccessBuilder::ForFixedArraySlot(index);
+  return access.offset - access.tag();
+}
+
 namespace {
 
 constexpr uint32_t kBytesPerExceptionValuesArrayElement = 2;
 
-void MergeControlToEnd(JSGraph* jsgraph, Node* node) {
-  Graph* g = jsgraph->graph();
+void MergeControlToEnd(MachineGraph* mcgraph, Node* node) {
+  Graph* g = mcgraph->graph();
   if (g->end()) {
-    NodeProperties::MergeControlToEnd(g, jsgraph->common(), node);
+    NodeProperties::MergeControlToEnd(g, mcgraph->common(), node);
   } else {
-    g->SetEnd(g->NewNode(jsgraph->common()->End(1), node));
+    g->SetEnd(g->NewNode(mcgraph->common()->End(1), node));
   }
 }
 
 bool ContainsSimd(wasm::FunctionSig* sig) {
-  for (wasm::ValueType t : sig->all()) {
-    if (t == wasm::kWasmS128) return true;
+  for (auto type : sig->all()) {
+    if (type == wasm::kWasmS128) return true;
   }
   return false;
 }
 
+bool ContainsInt64(wasm::FunctionSig* sig) {
+  for (auto type : sig->all()) {
+    if (type == wasm::kWasmI64) return true;
+  }
+  return false;
+}
 }  // namespace
 
 WasmGraphBuilder::WasmGraphBuilder(
-    ModuleEnv* env, Zone* zone, JSGraph* jsgraph, Handle<Code> centry_stub,
-    Handle<Oddball> anyref_null, wasm::FunctionSig* sig,
-    compiler::SourcePositionTable* source_position_table,
-    RuntimeExceptionSupport exception_support)
+    wasm::ModuleEnv* env, Zone* zone, MachineGraph* mcgraph,
+    wasm::FunctionSig* sig,
+    compiler::SourcePositionTable* source_position_table)
     : zone_(zone),
-      jsgraph_(jsgraph),
-      centry_stub_node_(jsgraph_->HeapConstant(centry_stub)),
-      anyref_null_node_(jsgraph_->HeapConstant(anyref_null)),
+      mcgraph_(mcgraph),
       env_(env),
       cur_buffer_(def_buffer_),
       cur_bufsize_(kDefaultBufferSize),
       has_simd_(ContainsSimd(sig)),
       untrusted_code_mitigations_(FLAG_untrusted_code_mitigations),
-      runtime_exception_support_(exception_support),
       sig_(sig),
       source_position_table_(source_position_table) {
   DCHECK_IMPLIES(use_trap_handler(), trap_handler::IsTrapHandlerEnabled());
-  DCHECK_NOT_NULL(jsgraph_);
+  DCHECK_NOT_NULL(mcgraph_);
 }
 
-Node* WasmGraphBuilder::Error() { return jsgraph()->Dead(); }
+Node* WasmGraphBuilder::Error() { return mcgraph()->Dead(); }
 
 Node* WasmGraphBuilder::Start(unsigned params) {
-  Node* start = graph()->NewNode(jsgraph()->common()->Start(params));
+  Node* start = graph()->NewNode(mcgraph()->common()->Start(params));
   graph()->SetStart(start);
   return start;
 }
 
 Node* WasmGraphBuilder::Param(unsigned index) {
-  return graph()->NewNode(jsgraph()->common()->Parameter(index),
+  return graph()->NewNode(mcgraph()->common()->Parameter(index),
                           graph()->start());
 }
 
 Node* WasmGraphBuilder::Loop(Node* entry) {
-  return graph()->NewNode(jsgraph()->common()->Loop(1), entry);
+  return graph()->NewNode(mcgraph()->common()->Loop(1), entry);
 }
 
 Node* WasmGraphBuilder::Terminate(Node* effect, Node* control) {
   Node* terminate =
-      graph()->NewNode(jsgraph()->common()->Terminate(), effect, control);
-  MergeControlToEnd(jsgraph(), terminate);
+      graph()->NewNode(mcgraph()->common()->Terminate(), effect, control);
+  MergeControlToEnd(mcgraph(), terminate);
   return terminate;
 }
 
@@ -151,31 +164,31 @@ bool WasmGraphBuilder::ThrowsException(Node* node, Node** if_success,
     return false;
   }
 
-  *if_success = graph()->NewNode(jsgraph()->common()->IfSuccess(), node);
+  *if_success = graph()->NewNode(mcgraph()->common()->IfSuccess(), node);
   *if_exception =
-      graph()->NewNode(jsgraph()->common()->IfException(), node, node);
+      graph()->NewNode(mcgraph()->common()->IfException(), node, node);
 
   return true;
 }
 
 void WasmGraphBuilder::AppendToMerge(Node* merge, Node* from) {
   DCHECK(IrOpcode::IsMergeOpcode(merge->opcode()));
-  merge->AppendInput(jsgraph()->zone(), from);
+  merge->AppendInput(mcgraph()->zone(), from);
   int new_size = merge->InputCount();
   NodeProperties::ChangeOp(
-      merge, jsgraph()->common()->ResizeMergeOrPhi(merge->op(), new_size));
+      merge, mcgraph()->common()->ResizeMergeOrPhi(merge->op(), new_size));
 }
 
 void WasmGraphBuilder::AppendToPhi(Node* phi, Node* from) {
   DCHECK(IrOpcode::IsPhiOpcode(phi->opcode()));
   int new_size = phi->InputCount();
-  phi->InsertInput(jsgraph()->zone(), phi->InputCount() - 1, from);
+  phi->InsertInput(mcgraph()->zone(), phi->InputCount() - 1, from);
   NodeProperties::ChangeOp(
-      phi, jsgraph()->common()->ResizeMergeOrPhi(phi->op(), new_size));
+      phi, mcgraph()->common()->ResizeMergeOrPhi(phi->op(), new_size));
 }
 
 Node* WasmGraphBuilder::Merge(unsigned count, Node** controls) {
-  return graph()->NewNode(jsgraph()->common()->Merge(count), count, controls);
+  return graph()->NewNode(mcgraph()->common()->Merge(count), count, controls);
 }
 
 Node* WasmGraphBuilder::Phi(wasm::ValueType type, unsigned count, Node** vals,
@@ -183,8 +196,10 @@ Node* WasmGraphBuilder::Phi(wasm::ValueType type, unsigned count, Node** vals,
   DCHECK(IrOpcode::IsMergeOpcode(control->opcode()));
   Node** buf = Realloc(vals, count, count + 1);
   buf[count] = control;
-  return graph()->NewNode(jsgraph()->common()->Phi(type, count), count + 1,
-                          buf);
+  return graph()->NewNode(
+      mcgraph()->common()->Phi(wasm::ValueTypes::MachineRepresentationFor(type),
+                               count),
+      count + 1, buf);
 }
 
 Node* WasmGraphBuilder::EffectPhi(unsigned count, Node** effects,
@@ -192,70 +207,90 @@ Node* WasmGraphBuilder::EffectPhi(unsigned count, Node** effects,
   DCHECK(IrOpcode::IsMergeOpcode(control->opcode()));
   Node** buf = Realloc(effects, count, count + 1);
   buf[count] = control;
-  return graph()->NewNode(jsgraph()->common()->EffectPhi(count), count + 1,
+  return graph()->NewNode(mcgraph()->common()->EffectPhi(count), count + 1,
                           buf);
 }
 
-Node* WasmGraphBuilder::NumberConstant(int32_t value) {
-  return jsgraph()->Constant(value);
+Node* WasmGraphBuilder::RefNull() {
+  Node* null = LOAD_INSTANCE_FIELD(NullValue, MachineType::TaggedPointer());
+  *effect_ = null;
+  return null;
+}
+
+Node* WasmGraphBuilder::NoContextConstant() {
+  // TODO(titzer): avoiding a dependency on JSGraph here. Refactor.
+  return mcgraph()->IntPtrConstant(0);
 }
 
 Node* WasmGraphBuilder::Uint32Constant(uint32_t value) {
-  return jsgraph()->Uint32Constant(value);
+  return mcgraph()->Uint32Constant(value);
 }
 
 Node* WasmGraphBuilder::Int32Constant(int32_t value) {
-  return jsgraph()->Int32Constant(value);
+  return mcgraph()->Int32Constant(value);
 }
 
 Node* WasmGraphBuilder::Int64Constant(int64_t value) {
-  return jsgraph()->Int64Constant(value);
+  return mcgraph()->Int64Constant(value);
 }
 
 Node* WasmGraphBuilder::IntPtrConstant(intptr_t value) {
-  return jsgraph()->IntPtrConstant(value);
+  return mcgraph()->IntPtrConstant(value);
 }
 
 void WasmGraphBuilder::StackCheck(wasm::WasmCodePosition position,
                                   Node** effect, Node** control) {
-  // TODO(mtrofin): "!env_" happens when we generate a wrapper.
-  // We should factor wrappers separately from wasm codegen.
-  if (FLAG_wasm_no_stack_checks || !env_ || !runtime_exception_support_) {
+  DCHECK_NOT_NULL(env_);  // Wrappers don't get stack checks.
+  if (FLAG_wasm_no_stack_checks || !env_->runtime_exception_support) {
     return;
   }
   if (effect == nullptr) effect = effect_;
   if (control == nullptr) control = control_;
 
+  // This instruction sequence is matched in the instruction selector to
+  // load the stack pointer directly on some platforms. Hence, when modifying
+  // please also fix WasmStackCheckMatcher in node-matchers.h
+
+  Node* limit_address = graph()->NewNode(
+      mcgraph()->machine()->Load(MachineType::Pointer()), instance_node_.get(),
+      mcgraph()->Int32Constant(WASM_INSTANCE_OBJECT_OFFSET(StackLimitAddress)),
+      *effect, *control);
   Node* limit = graph()->NewNode(
-      jsgraph()->machine()->Load(MachineType::Pointer()),
-      jsgraph()->ExternalConstant(
-          ExternalReference::address_of_stack_limit(jsgraph()->isolate())),
-      jsgraph()->IntPtrConstant(0), *effect, *control);
+      mcgraph()->machine()->Load(MachineType::Pointer()), limit_address,
+      mcgraph()->IntPtrConstant(0), *effect, *control);
   *effect = limit;
-  Node* pointer = graph()->NewNode(jsgraph()->machine()->LoadStackPointer());
+  Node* pointer = graph()->NewNode(mcgraph()->machine()->LoadStackPointer());
 
   Node* check =
-      graph()->NewNode(jsgraph()->machine()->UintLessThan(), limit, pointer);
+      graph()->NewNode(mcgraph()->machine()->UintLessThan(), limit, pointer);
 
-  Diamond stack_check(graph(), jsgraph()->common(), check, BranchHint::kTrue);
+  Diamond stack_check(graph(), mcgraph()->common(), check, BranchHint::kTrue);
   stack_check.Chain(*control);
 
-  Handle<Code> code = BUILTIN_CODE(jsgraph()->isolate(), WasmStackGuard);
-  CallInterfaceDescriptor idesc =
-      WasmRuntimeCallDescriptor(jsgraph()->isolate());
-  auto call_descriptor = Linkage::GetStubCallDescriptor(
-      jsgraph()->isolate(), jsgraph()->zone(), idesc, 0,
-      CallDescriptor::kNoFlags, Operator::kNoProperties,
-      MachineType::AnyTagged(), 1, Linkage::kNoContext);
-  Node* stub_code = jsgraph()->HeapConstant(code);
-
-  Node* call = graph()->NewNode(jsgraph()->common()->Call(call_descriptor),
-                                stub_code, *effect, stack_check.if_false);
+  if (stack_check_call_operator_ == nullptr) {
+    // Build and cache the stack check call operator and the constant
+    // representing the stack check code.
+    auto call_descriptor = Linkage::GetStubCallDescriptor(
+        mcgraph()->zone(),                    // zone
+        NoContextDescriptor{},                // descriptor
+        0,                                    // stack parameter count
+        CallDescriptor::kNoFlags,             // flags
+        Operator::kNoProperties,              // properties
+        StubCallMode::kCallWasmRuntimeStub);  // stub call mode
+    // A direct call to a wasm runtime stub defined in this module.
+    // Just encode the stub index. This will be patched at relocation.
+    stack_check_code_node_.set(mcgraph()->RelocatableIntPtrConstant(
+        wasm::WasmCode::kWasmStackGuard, RelocInfo::WASM_STUB_CALL));
+    stack_check_call_operator_ = mcgraph()->common()->Call(call_descriptor);
+  }
+
+  Node* call = graph()->NewNode(stack_check_call_operator_.get(),
+                                stack_check_code_node_.get(), *effect,
+                                stack_check.if_false);
 
   SetSourcePosition(call, position);
 
-  Node* ephi = graph()->NewNode(jsgraph()->common()->EffectPhi(2), *effect,
-                                call, stack_check.merge);
+  Node* ephi = stack_check.EffectPhi(*effect, call);
 
   *control = stack_check.merge;
   *effect = ephi;
@@ -266,7 +301,7 @@ void WasmGraphBuilder::PatchInStackCheckIfNeeded() {
 
   Node* start = graph()->start();
   // Place a stack check which uses a dummy node as control and effect.
-  Node* dummy = graph()->NewNode(jsgraph()->common()->Dead());
+  Node* dummy = graph()->NewNode(mcgraph()->common()->Dead());
   Node* control = dummy;
   Node* effect = dummy;
   // The function-prologue stack check is associated with position 0, which
@@ -285,7 +320,7 @@ void WasmGraphBuilder::PatchInStackCheckIfNeeded() {
 Node* WasmGraphBuilder::Binop(wasm::WasmOpcode opcode, Node* left, Node* right,
                               wasm::WasmCodePosition position) {
   const Operator* op;
-  MachineOperatorBuilder* m = jsgraph()->machine();
+  MachineOperatorBuilder* m = mcgraph()->machine();
   switch (opcode) {
     case wasm::kExprI32Add:
       op = m->Int32Add();
@@ -554,11 +589,11 @@ Node* WasmGraphBuilder::Binop(wasm::WasmOpcode opcode, Node* left, Node* right,
 Node* WasmGraphBuilder::Unop(wasm::WasmOpcode opcode, Node* input,
                              wasm::WasmCodePosition position) {
   const Operator* op;
-  MachineOperatorBuilder* m = jsgraph()->machine();
+  MachineOperatorBuilder* m = mcgraph()->machine();
   switch (opcode) {
     case wasm::kExprI32Eqz:
       op = m->Word32Equal();
-      return graph()->NewNode(op, input, jsgraph()->Int32Constant(0));
+      return graph()->NewNode(op, input, mcgraph()->Int32Constant(0));
     case wasm::kExprF32Abs:
       op = m->Float32Abs();
       break;
@@ -760,7 +795,7 @@ Node* WasmGraphBuilder::Unop(wasm::WasmOpcode opcode, Node* input,
     }
     case wasm::kExprI64Eqz:
       op = m->Word64Equal();
-      return graph()->NewNode(op, input, jsgraph()->Int64Constant(0));
+      return graph()->NewNode(op, input, mcgraph()->Int64Constant(0));
     case wasm::kExprF32SConvertI64:
       if (m->Is32()) {
         return BuildF32SConvertI64(input);
@@ -808,11 +843,11 @@ Node* WasmGraphBuilder::Unop(wasm::WasmOpcode opcode, Node* input,
     case wasm::kExprI64UConvertSatF32:
     case wasm::kExprI64SConvertSatF64:
     case wasm::kExprI64UConvertSatF64:
-      return jsgraph()->machine()->Is32()
+      return mcgraph()->machine()->Is32()
                  ? BuildCcallConvertFloat(input, position, opcode)
                  : BuildIntConvertFloat(input, position, opcode);
     case wasm::kExprRefIsNull:
-      return graph()->NewNode(m->WordEqual(), input, anyref_null_node_);
+      return graph()->NewNode(m->WordEqual(), input, RefNull());
     case wasm::kExprI32AsmjsLoadMem8S:
       return BuildAsmjsLoadMem(MachineType::Int8(), input);
     case wasm::kExprI32AsmjsLoadMem8U:
@@ -834,62 +869,63 @@ Node* WasmGraphBuilder::Unop(wasm::WasmOpcode opcode, Node* input,
 }
 
 Node* WasmGraphBuilder::Float32Constant(float value) {
-  return jsgraph()->Float32Constant(value);
+  return mcgraph()->Float32Constant(value);
 }
 
 Node* WasmGraphBuilder::Float64Constant(double value) {
-  return jsgraph()->Float64Constant(value);
-}
-
-Node* WasmGraphBuilder::HeapConstant(Handle<HeapObject> value) {
-  return jsgraph()->HeapConstant(value);
+  return mcgraph()->Float64Constant(value);
 }
 
 namespace {
-Node* Branch(JSGraph* jsgraph, Node* cond, Node** true_node, Node** false_node,
-             Node* control, BranchHint hint) {
+Node* Branch(MachineGraph* mcgraph, Node* cond, Node** true_node,
+             Node** false_node, Node* control, BranchHint hint) {
   DCHECK_NOT_NULL(cond);
   DCHECK_NOT_NULL(control);
   Node* branch =
-      jsgraph->graph()->NewNode(jsgraph->common()->Branch(hint), cond, control);
-  *true_node = jsgraph->graph()->NewNode(jsgraph->common()->IfTrue(), branch);
-  *false_node = jsgraph->graph()->NewNode(jsgraph->common()->IfFalse(), branch);
+      mcgraph->graph()->NewNode(mcgraph->common()->Branch(hint), cond, control);
+  *true_node = mcgraph->graph()->NewNode(mcgraph->common()->IfTrue(), branch);
+  *false_node = mcgraph->graph()->NewNode(mcgraph->common()->IfFalse(), branch);
   return branch;
 }
 }  // namespace
 
 Node* WasmGraphBuilder::BranchNoHint(Node* cond, Node** true_node,
                                      Node** false_node) {
-  return Branch(jsgraph(), cond, true_node, false_node, *control_,
+  return Branch(mcgraph(), cond, true_node, false_node, *control_,
                 BranchHint::kNone);
 }
 
 Node* WasmGraphBuilder::BranchExpectTrue(Node* cond, Node** true_node,
                                          Node** false_node) {
-  return Branch(jsgraph(), cond, true_node, false_node, *control_,
+  return Branch(mcgraph(), cond, true_node, false_node, *control_,
                 BranchHint::kTrue);
 }
 
 Node* WasmGraphBuilder::BranchExpectFalse(Node* cond, Node** true_node,
                                           Node** false_node) {
-  return Branch(jsgraph(), cond, true_node, false_node, *control_,
+  return Branch(mcgraph(), cond, true_node, false_node, *control_,
                 BranchHint::kFalse);
 }
 
-Builtins::Name WasmGraphBuilder::GetBuiltinIdForTrap(wasm::TrapReason reason) {
-  if (runtime_exception_support_ == kNoRuntimeExceptionSupport) {
-    // We use Builtins::builtin_count as a marker to tell the code generator
+TrapId WasmGraphBuilder::GetTrapIdForTrap(wasm::TrapReason reason) {
+  // TODO(wasm): "!env_" should not happen when compiling an actual wasm
+  // function.
+  if (!env_ || !env_->runtime_exception_support) {
+    // We use TrapId::kInvalid as a marker to tell the code generator
     // to generate a call to a testing c-function instead of a runtime
-    // function. This code should only be called from a cctest.
-    return Builtins::builtin_count;
+    // stub. This code should only be called from a cctest.
+    return TrapId::kInvalid;
   }
 
   switch (reason) {
-#define TRAPREASON_TO_MESSAGE(name) \
-  case wasm::k##name:               \
-    return Builtins::kThrowWasm##name;
-    FOREACH_WASM_TRAPREASON(TRAPREASON_TO_MESSAGE)
-#undef TRAPREASON_TO_MESSAGE
+#define TRAPREASON_TO_TRAPID(name)                                             \
+  case wasm::k##name:                                                          \
+    static_assert(                                                             \
+        static_cast<int>(TrapId::k##name) == wasm::WasmCode::kThrowWasm##name, \
+        "trap id mismatch");                                                   \
+    return TrapId::k##name;
+    FOREACH_WASM_TRAPREASON(TRAPREASON_TO_TRAPID)
+#undef TRAPREASON_TO_TRAPID
     default:
       UNREACHABLE();
   }
@@ -897,8 +933,8 @@ Builtins::Name WasmGraphBuilder::GetBuiltinIdForTrap(wasm::TrapReason reason) {
 
 Node* WasmGraphBuilder::TrapIfTrue(wasm::TrapReason reason, Node* cond,
                                    wasm::WasmCodePosition position) {
-  Builtins::Name trap_id = GetBuiltinIdForTrap(reason);
-  Node* node = graph()->NewNode(jsgraph()->common()->TrapIf(trap_id), cond,
+  TrapId trap_id = GetTrapIdForTrap(reason);
+  Node* node = graph()->NewNode(mcgraph()->common()->TrapIf(trap_id), cond,
                                 Effect(), Control());
   *control_ = node;
   SetSourcePosition(node, position);
@@ -907,9 +943,8 @@ Node* WasmGraphBuilder::TrapIfTrue(wasm::TrapReason reason, Node* cond,
 
 Node* WasmGraphBuilder::TrapIfFalse(wasm::TrapReason reason, Node* cond,
                                     wasm::WasmCodePosition position) {
-  Builtins::Name trap_id = GetBuiltinIdForTrap(reason);
-
-  Node* node = graph()->NewNode(jsgraph()->common()->TrapUnless(trap_id), cond,
+  TrapId trap_id = GetTrapIdForTrap(reason);
+  Node* node = graph()->NewNode(mcgraph()->common()->TrapUnless(trap_id), cond,
                                 Effect(), Control());
   *control_ = node;
   SetSourcePosition(node, position);
@@ -926,8 +961,8 @@ Node* WasmGraphBuilder::TrapIfEq32(wasm::TrapReason reason, Node* node,
     return TrapIfFalse(reason, node, position);
   } else {
     return TrapIfTrue(reason,
-                      graph()->NewNode(jsgraph()->machine()->Word32Equal(),
-                                       node, jsgraph()->Int32Constant(val)),
+                      graph()->NewNode(mcgraph()->machine()->Word32Equal(),
+                                       node, mcgraph()->Int32Constant(val)),
                       position);
   }
 }
@@ -945,8 +980,8 @@ Node* WasmGraphBuilder::TrapIfEq64(wasm::TrapReason reason, Node* node,
   Int64Matcher m(node);
   if (m.HasValue() && !m.Is(val)) return graph()->start();
   return TrapIfTrue(reason,
-                    graph()->NewNode(jsgraph()->machine()->Word64Equal(), node,
-                                     jsgraph()->Int64Constant(val)),
+                    graph()->NewNode(mcgraph()->machine()->Word64Equal(), node,
+                                     mcgraph()->Int64Constant(val)),
                     position);
 }
 
@@ -957,17 +992,17 @@ Node* WasmGraphBuilder::ZeroCheck64(wasm::TrapReason reason, Node* node,
 }
 
 Node* WasmGraphBuilder::Switch(unsigned count, Node* key) {
-  return graph()->NewNode(jsgraph()->common()->Switch(count), key, *control_);
+  return graph()->NewNode(mcgraph()->common()->Switch(count), key, *control_);
 }
 
 Node* WasmGraphBuilder::IfValue(int32_t value, Node* sw) {
   DCHECK_EQ(IrOpcode::kSwitch, sw->opcode());
-  return graph()->NewNode(jsgraph()->common()->IfValue(value), sw);
+  return graph()->NewNode(mcgraph()->common()->IfValue(value), sw);
 }
 
 Node* WasmGraphBuilder::IfDefault(Node* sw) {
   DCHECK_EQ(IrOpcode::kSwitch, sw->opcode());
-  return graph()->NewNode(jsgraph()->common()->IfDefault(), sw);
+  return graph()->NewNode(mcgraph()->common()->IfDefault(), sw);
 }
 
 Node* WasmGraphBuilder::Return(unsigned count, Node** vals) {
@@ -984,14 +1019,14 @@ Node* WasmGraphBuilder::Return(unsigned count, Node** vals) {
     buf = heap_buffer.data();
   }
 
-  buf[0] = jsgraph()->Int32Constant(0);
+  buf[0] = mcgraph()->Int32Constant(0);
   memcpy(buf + 1, vals, sizeof(void*) * count);
   buf[count + 1] = *effect_;
   buf[count + 2] = *control_;
   Node* ret =
-      graph()->NewNode(jsgraph()->common()->Return(count), count + 3, buf);
+      graph()->NewNode(mcgraph()->common()->Return(count), count + 3, buf);
 
-  MergeControlToEnd(jsgraph(), ret);
+  MergeControlToEnd(mcgraph(), ret);
   return ret;
 }
 
@@ -1005,15 +1040,15 @@ Node* WasmGraphBuilder::Unreachable(wasm::WasmCodePosition position) {
 
 Node* WasmGraphBuilder::MaskShiftCount32(Node* node) {
   static const int32_t kMask32 = 0x1F;
-  if (!jsgraph()->machine()->Word32ShiftIsSafe()) {
+  if (!mcgraph()->machine()->Word32ShiftIsSafe()) {
     // Shifts by constants are so common we pattern-match them here.
     Int32Matcher match(node);
     if (match.HasValue()) {
       int32_t masked = (match.Value() & kMask32);
-      if (match.Value() != masked) node = jsgraph()->Int32Constant(masked);
+      if (match.Value() != masked) node = mcgraph()->Int32Constant(masked);
     } else {
-      node = graph()->NewNode(jsgraph()->machine()->Word32And(), node,
-                              jsgraph()->Int32Constant(kMask32));
+      node = graph()->NewNode(mcgraph()->machine()->Word32And(), node,
+                              mcgraph()->Int32Constant(kMask32));
     }
   }
   return node;
@@ -1021,15 +1056,15 @@ Node* WasmGraphBuilder::MaskShiftCount32(Node* node) {
 
 Node* WasmGraphBuilder::MaskShiftCount64(Node* node) {
   static const int64_t kMask64 = 0x3F;
-  if (!jsgraph()->machine()->Word32ShiftIsSafe()) {
+  if (!mcgraph()->machine()->Word32ShiftIsSafe()) {
     // Shifts by constants are so common we pattern-match them here.
     Int64Matcher match(node);
     if (match.HasValue()) {
       int64_t masked = (match.Value() & kMask64);
-      if (match.Value() != masked) node = jsgraph()->Int64Constant(masked);
+      if (match.Value() != masked) node = mcgraph()->Int64Constant(masked);
     } else {
-      node = graph()->NewNode(jsgraph()->machine()->Word64And(), node,
-                              jsgraph()->Int64Constant(kMask64));
+      node = graph()->NewNode(mcgraph()->machine()->Word64And(), node,
+                              mcgraph()->Int64Constant(kMask64));
     }
   }
   return node;
@@ -1053,8 +1088,8 @@ Node* WasmGraphBuilder::BuildChangeEndiannessStore(
     Node* node, MachineRepresentation mem_rep, wasm::ValueType wasmtype) {
   Node* result;
   Node* value = node;
-  MachineOperatorBuilder* m = jsgraph()->machine();
-  int valueSizeInBytes = 1 << ElementSizeLog2Of(wasmtype);
+  MachineOperatorBuilder* m = mcgraph()->machine();
+  int valueSizeInBytes = wasm::ValueTypes::ElementSizeInBytes(wasmtype);
   int valueSizeInBits = 8 * valueSizeInBytes;
   bool isFloat = false;
 
@@ -1064,14 +1099,14 @@ Node* WasmGraphBuilder::BuildChangeEndiannessStore(
       isFloat = true;
       V8_FALLTHROUGH;
     case wasm::kWasmI64:
-      result = jsgraph()->Int64Constant(0);
+      result = mcgraph()->Int64Constant(0);
       break;
     case wasm::kWasmF32:
       value = graph()->NewNode(m->BitcastFloat32ToInt32(), node);
       isFloat = true;
       V8_FALLTHROUGH;
     case wasm::kWasmI32:
-      result = jsgraph()->Int32Constant(0);
+      result = mcgraph()->Int32Constant(0);
       break;
     case wasm::kWasmS128:
       DCHECK(ReverseBytesSupported(m, valueSizeInBytes));
@@ -1089,16 +1124,16 @@ Node* WasmGraphBuilder::BuildChangeEndiannessStore(
     // In case we store lower part of WasmI64 expression, we can truncate
     // upper 32bits
     value = graph()->NewNode(m->TruncateInt64ToInt32(), value);
-    valueSizeInBytes = 1 << ElementSizeLog2Of(wasm::kWasmI32);
+    valueSizeInBytes = wasm::ValueTypes::ElementSizeInBytes(wasm::kWasmI32);
     valueSizeInBits = 8 * valueSizeInBytes;
     if (mem_rep == MachineRepresentation::kWord16) {
       value =
-          graph()->NewNode(m->Word32Shl(), value, jsgraph()->Int32Constant(16));
+          graph()->NewNode(m->Word32Shl(), value, mcgraph()->Int32Constant(16));
     }
   } else if (wasmtype == wasm::kWasmI32 &&
              mem_rep == MachineRepresentation::kWord16) {
     value =
-        graph()->NewNode(m->Word32Shl(), value, jsgraph()->Int32Constant(16));
+        graph()->NewNode(m->Word32Shl(), value, mcgraph()->Int32Constant(16));
   }
 
   int i;
@@ -1117,17 +1152,17 @@ Node* WasmGraphBuilder::BuildChangeEndiannessStore(
         for (int lane = 0; lane < 4; lane++) {
           byte_reversed_lanes[lane] = graph()->NewNode(
               m->Word32ReverseBytes().op(),
-              graph()->NewNode(jsgraph()->machine()->I32x4ExtractLane(lane),
+              graph()->NewNode(mcgraph()->machine()->I32x4ExtractLane(lane),
                                value));
         }
 
         // This is making a copy of the value.
         result =
-            graph()->NewNode(jsgraph()->machine()->S128And(), value, value);
+            graph()->NewNode(mcgraph()->machine()->S128And(), value, value);
 
         for (int lane = 0; lane < 4; lane++) {
           result =
-              graph()->NewNode(jsgraph()->machine()->I32x4ReplaceLane(3 - lane),
+              graph()->NewNode(mcgraph()->machine()->I32x4ReplaceLane(3 - lane),
                                result, byte_reversed_lanes[lane]);
         }
 
@@ -1150,30 +1185,30 @@ Node* WasmGraphBuilder::BuildChangeEndiannessStore(
 
       if (valueSizeInBits > 32) {
         shiftLower = graph()->NewNode(m->Word64Shl(), value,
-                                      jsgraph()->Int64Constant(shiftCount));
+                                      mcgraph()->Int64Constant(shiftCount));
         shiftHigher = graph()->NewNode(m->Word64Shr(), value,
-                                       jsgraph()->Int64Constant(shiftCount));
+                                       mcgraph()->Int64Constant(shiftCount));
         lowerByte = graph()->NewNode(
             m->Word64And(), shiftLower,
-            jsgraph()->Int64Constant(static_cast<uint64_t>(0xFF)
+            mcgraph()->Int64Constant(static_cast<uint64_t>(0xFF)
                                      << (valueSizeInBits - 8 - i)));
         higherByte = graph()->NewNode(
             m->Word64And(), shiftHigher,
-            jsgraph()->Int64Constant(static_cast<uint64_t>(0xFF) << i));
+            mcgraph()->Int64Constant(static_cast<uint64_t>(0xFF) << i));
         result = graph()->NewNode(m->Word64Or(), result, lowerByte);
         result = graph()->NewNode(m->Word64Or(), result, higherByte);
       } else {
         shiftLower = graph()->NewNode(m->Word32Shl(), value,
-                                      jsgraph()->Int32Constant(shiftCount));
+                                      mcgraph()->Int32Constant(shiftCount));
         shiftHigher = graph()->NewNode(m->Word32Shr(), value,
-                                       jsgraph()->Int32Constant(shiftCount));
+                                       mcgraph()->Int32Constant(shiftCount));
         lowerByte = graph()->NewNode(
             m->Word32And(), shiftLower,
-            jsgraph()->Int32Constant(static_cast<uint32_t>(0xFF)
+            mcgraph()->Int32Constant(static_cast<uint32_t>(0xFF)
                                      << (valueSizeInBits - 8 - i)));
         higherByte = graph()->NewNode(
             m->Word32And(), shiftHigher,
-            jsgraph()->Int32Constant(static_cast<uint32_t>(0xFF) << i));
+            mcgraph()->Int32Constant(static_cast<uint32_t>(0xFF) << i));
         result = graph()->NewNode(m->Word32Or(), result, lowerByte);
         result = graph()->NewNode(m->Word32Or(), result, higherByte);
       }
@@ -1202,8 +1237,8 @@ Node* WasmGraphBuilder::BuildChangeEndiannessLoad(Node* node,
                                                   wasm::ValueType wasmtype) {
   Node* result;
   Node* value = node;
-  MachineOperatorBuilder* m = jsgraph()->machine();
-  int valueSizeInBytes = 1 << ElementSizeLog2Of(memtype.representation());
+  MachineOperatorBuilder* m = mcgraph()->machine();
+  int valueSizeInBytes = ElementSizeInBytes(memtype.representation());
   int valueSizeInBits = 8 * valueSizeInBytes;
   bool isFloat = false;
 
@@ -1213,7 +1248,7 @@ Node* WasmGraphBuilder::BuildChangeEndiannessLoad(Node* node,
       isFloat = true;
       V8_FALLTHROUGH;
     case MachineRepresentation::kWord64:
-      result = jsgraph()->Int64Constant(0);
+      result = mcgraph()->Int64Constant(0);
       break;
     case MachineRepresentation::kFloat32:
       value = graph()->NewNode(m->BitcastFloat32ToInt32(), node);
@@ -1221,7 +1256,7 @@ Node* WasmGraphBuilder::BuildChangeEndiannessLoad(Node* node,
       V8_FALLTHROUGH;
     case MachineRepresentation::kWord32:
     case MachineRepresentation::kWord16:
-      result = jsgraph()->Int32Constant(0);
+      result = mcgraph()->Int32Constant(0);
       break;
     case MachineRepresentation::kWord8:
       // No need to change endianness for byte size, return original node
@@ -1244,7 +1279,7 @@ Node* WasmGraphBuilder::BuildChangeEndiannessLoad(Node* node,
         result =
             graph()->NewNode(m->Word32ReverseBytes().op(),
                              graph()->NewNode(m->Word32Shl(), value,
-                                              jsgraph()->Int32Constant(16)));
+                                              mcgraph()->Int32Constant(16)));
         break;
       case 4:
         result = graph()->NewNode(m->Word32ReverseBytes().op(), value);
@@ -1257,17 +1292,17 @@ Node* WasmGraphBuilder::BuildChangeEndiannessLoad(Node* node,
         for (int lane = 0; lane < 4; lane++) {
           byte_reversed_lanes[lane] = graph()->NewNode(
               m->Word32ReverseBytes().op(),
-              graph()->NewNode(jsgraph()->machine()->I32x4ExtractLane(lane),
+              graph()->NewNode(mcgraph()->machine()->I32x4ExtractLane(lane),
                                value));
         }
 
         // This is making a copy of the value.
         result =
-            graph()->NewNode(jsgraph()->machine()->S128And(), value, value);
+            graph()->NewNode(mcgraph()->machine()->S128And(), value, value);
 
         for (int lane = 0; lane < 4; lane++) {
           result =
-              graph()->NewNode(jsgraph()->machine()->I32x4ReplaceLane(3 - lane),
+              graph()->NewNode(mcgraph()->machine()->I32x4ReplaceLane(3 - lane),
                                result, byte_reversed_lanes[lane]);
         }
 
@@ -1289,30 +1324,30 @@ Node* WasmGraphBuilder::BuildChangeEndiannessLoad(Node* node,
 
       if (valueSizeInBits > 32) {
         shiftLower = graph()->NewNode(m->Word64Shl(), value,
-                                      jsgraph()->Int64Constant(shiftCount));
+                                      mcgraph()->Int64Constant(shiftCount));
         shiftHigher = graph()->NewNode(m->Word64Shr(), value,
-                                       jsgraph()->Int64Constant(shiftCount));
+                                       mcgraph()->Int64Constant(shiftCount));
         lowerByte = graph()->NewNode(
             m->Word64And(), shiftLower,
-            jsgraph()->Int64Constant(static_cast<uint64_t>(0xFF)
+            mcgraph()->Int64Constant(static_cast<uint64_t>(0xFF)
                                      << (valueSizeInBits - 8 - i)));
         higherByte = graph()->NewNode(
             m->Word64And(), shiftHigher,
-            jsgraph()->Int64Constant(static_cast<uint64_t>(0xFF) << i));
+            mcgraph()->Int64Constant(static_cast<uint64_t>(0xFF) << i));
         result = graph()->NewNode(m->Word64Or(), result, lowerByte);
         result = graph()->NewNode(m->Word64Or(), result, higherByte);
       } else {
         shiftLower = graph()->NewNode(m->Word32Shl(), value,
-                                      jsgraph()->Int32Constant(shiftCount));
+                                      mcgraph()->Int32Constant(shiftCount));
         shiftHigher = graph()->NewNode(m->Word32Shr(), value,
-                                       jsgraph()->Int32Constant(shiftCount));
+                                       mcgraph()->Int32Constant(shiftCount));
         lowerByte = graph()->NewNode(
             m->Word32And(), shiftLower,
-            jsgraph()->Int32Constant(static_cast<uint32_t>(0xFF)
+            mcgraph()->Int32Constant(static_cast<uint32_t>(0xFF)
                                      << (valueSizeInBits - 8 - i)));
         higherByte = graph()->NewNode(
             m->Word32And(), shiftHigher,
-            jsgraph()->Int32Constant(static_cast<uint32_t>(0xFF) << i));
+            mcgraph()->Int32Constant(static_cast<uint32_t>(0xFF) << i));
         result = graph()->NewNode(m->Word32Or(), result, lowerByte);
         result = graph()->NewNode(m->Word32Or(), result, higherByte);
       }
@@ -1342,7 +1377,7 @@ Node* WasmGraphBuilder::BuildChangeEndiannessLoad(Node* node,
       // result = (x << machine_width - type_width) >> (machine_width -
       // type_width)
       if (wasmtype == wasm::kWasmI64) {
-        shiftBitCount = jsgraph()->Int32Constant(64 - valueSizeInBits);
+        shiftBitCount = mcgraph()->Int32Constant(64 - valueSizeInBits);
         result = graph()->NewNode(
             m->Word64Sar(),
             graph()->NewNode(m->Word64Shl(),
@@ -1350,7 +1385,7 @@ Node* WasmGraphBuilder::BuildChangeEndiannessLoad(Node* node,
                              shiftBitCount),
             shiftBitCount);
       } else if (wasmtype == wasm::kWasmI32) {
-        shiftBitCount = jsgraph()->Int32Constant(32 - valueSizeInBits);
+        shiftBitCount = mcgraph()->Int32Constant(32 - valueSizeInBits);
         result = graph()->NewNode(
             m->Word32Sar(),
             graph()->NewNode(m->Word32Shl(), result, shiftBitCount),
@@ -1367,9 +1402,9 @@ Node* WasmGraphBuilder::BuildF32CopySign(Node* left, Node* right) {
       wasm::kExprF32ReinterpretI32,
       Binop(wasm::kExprI32Ior,
             Binop(wasm::kExprI32And, Unop(wasm::kExprI32ReinterpretF32, left),
-                  jsgraph()->Int32Constant(0x7FFFFFFF)),
+                  mcgraph()->Int32Constant(0x7FFFFFFF)),
             Binop(wasm::kExprI32And, Unop(wasm::kExprI32ReinterpretF32, right),
-                  jsgraph()->Int32Constant(0x80000000))));
+                  mcgraph()->Int32Constant(0x80000000))));
 
   return result;
 }
@@ -1380,13 +1415,13 @@ Node* WasmGraphBuilder::BuildF64CopySign(Node* left, Node* right) {
       wasm::kExprF64ReinterpretI64,
       Binop(wasm::kExprI64Ior,
             Binop(wasm::kExprI64And, Unop(wasm::kExprI64ReinterpretF64, left),
-                  jsgraph()->Int64Constant(0x7FFFFFFFFFFFFFFF)),
+                  mcgraph()->Int64Constant(0x7FFFFFFFFFFFFFFF)),
             Binop(wasm::kExprI64And, Unop(wasm::kExprI64ReinterpretF64, right),
-                  jsgraph()->Int64Constant(0x8000000000000000))));
+                  mcgraph()->Int64Constant(0x8000000000000000))));
 
   return result;
 #else
-  MachineOperatorBuilder* m = jsgraph()->machine();
+  MachineOperatorBuilder* m = mcgraph()->machine();
 
   Node* high_word_left = graph()->NewNode(m->Float64ExtractHighWord32(), left);
   Node* high_word_right =
@@ -1394,9 +1429,9 @@ Node* WasmGraphBuilder::BuildF64CopySign(Node* left, Node* right) {
 
   Node* new_high_word = Binop(wasm::kExprI32Ior,
                               Binop(wasm::kExprI32And, high_word_left,
-                                    jsgraph()->Int32Constant(0x7FFFFFFF)),
+                                    mcgraph()->Int32Constant(0x7FFFFFFF)),
                               Binop(wasm::kExprI32And, high_word_right,
-                                    jsgraph()->Int32Constant(0x80000000)));
+                                    mcgraph()->Int32Constant(0x80000000)));
 
   return graph()->NewNode(m->Float64InsertHighWord32(), left, new_high_word);
 #endif
@@ -1460,28 +1495,28 @@ const Operator* ConvertOp(WasmGraphBuilder* builder, wasm::WasmOpcode opcode) {
   switch (opcode) {
     case wasm::kExprI32SConvertF32:
     case wasm::kExprI32SConvertSatF32:
-      return builder->jsgraph()->machine()->TruncateFloat32ToInt32();
+      return builder->mcgraph()->machine()->TruncateFloat32ToInt32();
     case wasm::kExprI32UConvertF32:
     case wasm::kExprI32UConvertSatF32:
-      return builder->jsgraph()->machine()->TruncateFloat32ToUint32();
+      return builder->mcgraph()->machine()->TruncateFloat32ToUint32();
     case wasm::kExprI32SConvertF64:
     case wasm::kExprI32SConvertSatF64:
-      return builder->jsgraph()->machine()->ChangeFloat64ToInt32();
+      return builder->mcgraph()->machine()->ChangeFloat64ToInt32();
     case wasm::kExprI32UConvertF64:
     case wasm::kExprI32UConvertSatF64:
-      return builder->jsgraph()->machine()->TruncateFloat64ToUint32();
+      return builder->mcgraph()->machine()->TruncateFloat64ToUint32();
     case wasm::kExprI64SConvertF32:
     case wasm::kExprI64SConvertSatF32:
-      return builder->jsgraph()->machine()->TryTruncateFloat32ToInt64();
+      return builder->mcgraph()->machine()->TryTruncateFloat32ToInt64();
     case wasm::kExprI64UConvertF32:
     case wasm::kExprI64UConvertSatF32:
-      return builder->jsgraph()->machine()->TryTruncateFloat32ToUint64();
+      return builder->mcgraph()->machine()->TryTruncateFloat32ToUint64();
     case wasm::kExprI64SConvertF64:
     case wasm::kExprI64SConvertSatF64:
-      return builder->jsgraph()->machine()->TryTruncateFloat64ToInt64();
+      return builder->mcgraph()->machine()->TryTruncateFloat64ToInt64();
     case wasm::kExprI64UConvertF64:
     case wasm::kExprI64UConvertSatF64:
-      return builder->jsgraph()->machine()->TryTruncateFloat64ToUint64();
+      return builder->mcgraph()->machine()->TryTruncateFloat64ToUint64();
     default:
       UNREACHABLE();
   }
@@ -1616,7 +1651,7 @@ Node* ConvertTrapTest(WasmGraphBuilder* builder, wasm::WasmOpcode opcode,
     Node* check = builder->Unop(ConvertBackOp(opcode), converted_value);
     return builder->Binop(NeOp(float_ty), trunc, check);
   }
-  return builder->graph()->NewNode(builder->jsgraph()->common()->Projection(1),
+  return builder->graph()->NewNode(builder->mcgraph()->common()->Projection(1),
                                    trunc, builder->graph()->start());
 }
 
@@ -1649,7 +1684,7 @@ Node* WasmGraphBuilder::BuildIntConvertFloat(Node* input,
     converted_value = graph()->NewNode(conv_op, trunc);
   } else {
     trunc = graph()->NewNode(conv_op, input);
-    converted_value = graph()->NewNode(jsgraph()->common()->Projection(0),
+    converted_value = graph()->NewNode(mcgraph()->common()->Projection(0),
                                        trunc, graph()->start());
   }
   if (IsTrappingConvertOp(opcode)) {
@@ -1664,13 +1699,13 @@ Node* WasmGraphBuilder::BuildIntConvertFloat(Node* input,
   }
   Node* test = ConvertSaturateTest(this, opcode, int_ty, float_ty, trunc,
                                    converted_value);
-  Diamond tl_d(graph(), jsgraph()->common(), test, BranchHint::kFalse);
+  Diamond tl_d(graph(), mcgraph()->common(), test, BranchHint::kFalse);
   tl_d.Chain(Control());
   Node* nan_test = Binop(NeOp(float_ty), input, input);
-  Diamond nan_d(graph(), jsgraph()->common(), nan_test, BranchHint::kFalse);
+  Diamond nan_d(graph(), mcgraph()->common(), nan_test, BranchHint::kFalse);
   nan_d.Nest(tl_d, true);
   Node* neg_test = Binop(LtOp(float_ty), input, Zero(this, float_ty));
-  Diamond sat_d(graph(), jsgraph()->common(), neg_test, BranchHint::kNone);
+  Diamond sat_d(graph(), mcgraph()->common(), neg_test, BranchHint::kNone);
   sat_d.Nest(nan_d, false);
   Node* sat_val =
       sat_d.Phi(int_ty.representation(), Min(this, int_ty), Max(this, int_ty));
@@ -1680,27 +1715,27 @@ Node* WasmGraphBuilder::BuildIntConvertFloat(Node* input,
 }
 
 Node* WasmGraphBuilder::BuildI32AsmjsSConvertF32(Node* input) {
-  MachineOperatorBuilder* m = jsgraph()->machine();
+  MachineOperatorBuilder* m = mcgraph()->machine();
   // asm.js must use the wacky JS semantics.
   input = graph()->NewNode(m->ChangeFloat32ToFloat64(), input);
   return graph()->NewNode(m->TruncateFloat64ToWord32(), input);
 }
 
 Node* WasmGraphBuilder::BuildI32AsmjsSConvertF64(Node* input) {
-  MachineOperatorBuilder* m = jsgraph()->machine();
+  MachineOperatorBuilder* m = mcgraph()->machine();
   // asm.js must use the wacky JS semantics.
   return graph()->NewNode(m->TruncateFloat64ToWord32(), input);
 }
 
 Node* WasmGraphBuilder::BuildI32AsmjsUConvertF32(Node* input) {
-  MachineOperatorBuilder* m = jsgraph()->machine();
+  MachineOperatorBuilder* m = mcgraph()->machine();
   // asm.js must use the wacky JS semantics.
   input = graph()->NewNode(m->ChangeFloat32ToFloat64(), input);
   return graph()->NewNode(m->TruncateFloat64ToWord32(), input);
 }
 
 Node* WasmGraphBuilder::BuildI32AsmjsUConvertF64(Node* input) {
-  MachineOperatorBuilder* m = jsgraph()->machine();
+  MachineOperatorBuilder* m = mcgraph()->machine();
   // asm.js must use the wacky JS semantics.
   return graph()->NewNode(m->TruncateFloat64ToWord32(), input);
 }
@@ -1708,133 +1743,115 @@ Node* WasmGraphBuilder::BuildI32AsmjsUConvertF64(Node* input) {
 Node* WasmGraphBuilder::BuildBitCountingCall(Node* input, ExternalReference ref,
                                              MachineRepresentation input_type) {
   Node* stack_slot_param =
-      graph()->NewNode(jsgraph()->machine()->StackSlot(input_type));
+      graph()->NewNode(mcgraph()->machine()->StackSlot(input_type));
 
-  const Operator* store_op = jsgraph()->machine()->Store(
+  const Operator* store_op = mcgraph()->machine()->Store(
       StoreRepresentation(input_type, kNoWriteBarrier));
   *effect_ =
-      graph()->NewNode(store_op, stack_slot_param, jsgraph()->Int32Constant(0),
+      graph()->NewNode(store_op, stack_slot_param, mcgraph()->Int32Constant(0),
                        input, *effect_, *control_);
 
-  MachineSignature::Builder sig_builder(jsgraph()->zone(), 1, 1);
-  sig_builder.AddReturn(MachineType::Int32());
-  sig_builder.AddParam(MachineType::Pointer());
+  MachineType sig_types[] = {MachineType::Int32(), MachineType::Pointer()};
+  MachineSignature sig(1, 1, sig_types);
 
-  Node* function = graph()->NewNode(jsgraph()->common()->ExternalConstant(ref));
+  Node* function = graph()->NewNode(mcgraph()->common()->ExternalConstant(ref));
 
-  return BuildCCall(sig_builder.Build(), function, stack_slot_param);
+  return BuildCCall(&sig, function, stack_slot_param);
 }
 
 Node* WasmGraphBuilder::BuildI32Ctz(Node* input) {
-  return BuildBitCountingCall(
-      input, ExternalReference::wasm_word32_ctz(jsgraph()->isolate()),
-      MachineRepresentation::kWord32);
+  return BuildBitCountingCall(input, ExternalReference::wasm_word32_ctz(),
+                              MachineRepresentation::kWord32);
 }
 
 Node* WasmGraphBuilder::BuildI64Ctz(Node* input) {
-  return Unop(
-      wasm::kExprI64UConvertI32,
-      BuildBitCountingCall(
-          input, ExternalReference::wasm_word64_ctz(jsgraph()->isolate()),
-          MachineRepresentation::kWord64));
+  return Unop(wasm::kExprI64UConvertI32,
+              BuildBitCountingCall(input, ExternalReference::wasm_word64_ctz(),
+                                   MachineRepresentation::kWord64));
 }
 
 Node* WasmGraphBuilder::BuildI32Popcnt(Node* input) {
-  return BuildBitCountingCall(
-      input, ExternalReference::wasm_word32_popcnt(jsgraph()->isolate()),
-      MachineRepresentation::kWord32);
+  return BuildBitCountingCall(input, ExternalReference::wasm_word32_popcnt(),
+                              MachineRepresentation::kWord32);
 }
 
 Node* WasmGraphBuilder::BuildI64Popcnt(Node* input) {
   return Unop(
       wasm::kExprI64UConvertI32,
-      BuildBitCountingCall(
-          input, ExternalReference::wasm_word64_popcnt(jsgraph()->isolate()),
-          MachineRepresentation::kWord64));
+      BuildBitCountingCall(input, ExternalReference::wasm_word64_popcnt(),
+                           MachineRepresentation::kWord64));
 }
 
 Node* WasmGraphBuilder::BuildF32Trunc(Node* input) {
   MachineType type = MachineType::Float32();
-  ExternalReference ref =
-      ExternalReference::wasm_f32_trunc(jsgraph()->isolate());
+  ExternalReference ref = ExternalReference::wasm_f32_trunc();
 
   return BuildCFuncInstruction(ref, type, input);
 }
 
 Node* WasmGraphBuilder::BuildF32Floor(Node* input) {
   MachineType type = MachineType::Float32();
-  ExternalReference ref =
-      ExternalReference::wasm_f32_floor(jsgraph()->isolate());
+  ExternalReference ref = ExternalReference::wasm_f32_floor();
   return BuildCFuncInstruction(ref, type, input);
 }
 
 Node* WasmGraphBuilder::BuildF32Ceil(Node* input) {
   MachineType type = MachineType::Float32();
-  ExternalReference ref =
-      ExternalReference::wasm_f32_ceil(jsgraph()->isolate());
+  ExternalReference ref = ExternalReference::wasm_f32_ceil();
   return BuildCFuncInstruction(ref, type, input);
 }
 
 Node* WasmGraphBuilder::BuildF32NearestInt(Node* input) {
   MachineType type = MachineType::Float32();
-  ExternalReference ref =
-      ExternalReference::wasm_f32_nearest_int(jsgraph()->isolate());
+  ExternalReference ref = ExternalReference::wasm_f32_nearest_int();
   return BuildCFuncInstruction(ref, type, input);
 }
 
 Node* WasmGraphBuilder::BuildF64Trunc(Node* input) {
   MachineType type = MachineType::Float64();
-  ExternalReference ref =
-      ExternalReference::wasm_f64_trunc(jsgraph()->isolate());
+  ExternalReference ref = ExternalReference::wasm_f64_trunc();
   return BuildCFuncInstruction(ref, type, input);
 }
 
 Node* WasmGraphBuilder::BuildF64Floor(Node* input) {
   MachineType type = MachineType::Float64();
-  ExternalReference ref =
-      ExternalReference::wasm_f64_floor(jsgraph()->isolate());
+  ExternalReference ref = ExternalReference::wasm_f64_floor();
   return BuildCFuncInstruction(ref, type, input);
 }
 
 Node* WasmGraphBuilder::BuildF64Ceil(Node* input) {
   MachineType type = MachineType::Float64();
-  ExternalReference ref =
-      ExternalReference::wasm_f64_ceil(jsgraph()->isolate());
+  ExternalReference ref = ExternalReference::wasm_f64_ceil();
   return BuildCFuncInstruction(ref, type, input);
 }
 
 Node* WasmGraphBuilder::BuildF64NearestInt(Node* input) {
   MachineType type = MachineType::Float64();
-  ExternalReference ref =
-      ExternalReference::wasm_f64_nearest_int(jsgraph()->isolate());
+  ExternalReference ref = ExternalReference::wasm_f64_nearest_int();
   return BuildCFuncInstruction(ref, type, input);
 }
 
 Node* WasmGraphBuilder::BuildF64Acos(Node* input) {
   MachineType type = MachineType::Float64();
-  ExternalReference ref =
-      ExternalReference::f64_acos_wrapper_function(jsgraph()->isolate());
+  ExternalReference ref = ExternalReference::f64_acos_wrapper_function();
   return BuildCFuncInstruction(ref, type, input);
 }
 
 Node* WasmGraphBuilder::BuildF64Asin(Node* input) {
   MachineType type = MachineType::Float64();
-  ExternalReference ref =
-      ExternalReference::f64_asin_wrapper_function(jsgraph()->isolate());
+  ExternalReference ref = ExternalReference::f64_asin_wrapper_function();
   return BuildCFuncInstruction(ref, type, input);
 }
 
 Node* WasmGraphBuilder::BuildF64Pow(Node* left, Node* right) {
   MachineType type = MachineType::Float64();
-  ExternalReference ref =
-      ExternalReference::wasm_float64_pow(jsgraph()->isolate());
+  ExternalReference ref = ExternalReference::wasm_float64_pow();
   return BuildCFuncInstruction(ref, type, left, right);
 }
 
 Node* WasmGraphBuilder::BuildF64Mod(Node* left, Node* right) {
   MachineType type = MachineType::Float64();
-  ExternalReference ref =
-      ExternalReference::f64_mod_wrapper_function(jsgraph()->isolate());
+  ExternalReference ref = ExternalReference::f64_mod_wrapper_function();
   return BuildCFuncInstruction(ref, type, left, right);
 }
 
@@ -1842,52 +1859,37 @@ Node* WasmGraphBuilder::BuildCFuncInstruction(ExternalReference ref,
                                               MachineType type, Node* input0,
                                               Node* input1) {
   // We do truncation by calling a C function which calculates the result.
-  // The input is passed to the C function as a double*'s to avoid double
-  // parameters. For this we reserve slots on the stack, store the parameters
-  // in those slots, pass pointers to the slot to the C function,
-  // and after calling the C function we collect the return value from
-  // the stack slot.
-
-  Node* stack_slot_param0 =
-      graph()->NewNode(jsgraph()->machine()->StackSlot(type.representation()));
-
-  const Operator* store_op0 = jsgraph()->machine()->Store(
+  // The input is passed to the C function as a byte buffer holding the two
+  // input doubles. We reserve this byte buffer as a stack slot, store the
+  // parameters in this buffer slots, pass a pointer to the buffer to the C
+  // function, and after calling the C function we collect the return value from
+  // the buffer.
+
+  const int type_size = ElementSizeInBytes(type.representation());
+  const int stack_slot_bytes = (input1 == nullptr ? 1 : 2) * type_size;
+  Node* stack_slot =
+      graph()->NewNode(mcgraph()->machine()->StackSlot(stack_slot_bytes));
+
+  const Operator* store_op = mcgraph()->machine()->Store(
       StoreRepresentation(type.representation(), kNoWriteBarrier));
-  *effect_ = graph()->NewNode(store_op0, stack_slot_param0,
-                              jsgraph()->Int32Constant(0), input0, *effect_,
-                              *control_);
-
-  Node* function = graph()->NewNode(jsgraph()->common()->ExternalConstant(ref));
-
-  if (input1 == nullptr) {
-    const int input_count = 1;
-    Signature<MachineType>::Builder sig_builder(jsgraph()->zone(), 0,
-                                                input_count);
-    sig_builder.AddParam(MachineType::Pointer());
-    BuildCCall(sig_builder.Build(), function, stack_slot_param0);
-  } else {
-    Node* stack_slot_param1 = graph()->NewNode(
-        jsgraph()->machine()->StackSlot(type.representation()));
-    const Operator* store_op1 = jsgraph()->machine()->Store(
-        StoreRepresentation(type.representation(), kNoWriteBarrier));
-    *effect_ = graph()->NewNode(store_op1, stack_slot_param1,
-                                jsgraph()->Int32Constant(0), input1, *effect_,
-                                *control_);
+  *effect_ = graph()->NewNode(store_op, stack_slot, mcgraph()->Int32Constant(0),
+                              input0, *effect_, *control_);
 
-    const int input_count = 2;
-    Signature<MachineType>::Builder sig_builder(jsgraph()->zone(), 0,
-                                                input_count);
-    sig_builder.AddParam(MachineType::Pointer());
-    sig_builder.AddParam(MachineType::Pointer());
-    BuildCCall(sig_builder.Build(), function, stack_slot_param0,
-               stack_slot_param1);
+  Node* function = graph()->NewNode(mcgraph()->common()->ExternalConstant(ref));
+
+  if (input1 != nullptr) {
+    *effect_ = graph()->NewNode(store_op, stack_slot,
+                                mcgraph()->Int32Constant(type_size), input1,
+                                *effect_, *control_);
   }
 
-  const Operator* load_op = jsgraph()->machine()->Load(type);
+  MachineType sig_types[] = {MachineType::Pointer()};
+  MachineSignature sig(0, 1, sig_types);
+  BuildCCall(&sig, function, stack_slot);
 
-  Node* load =
-      graph()->NewNode(load_op, stack_slot_param0, jsgraph()->Int32Constant(0),
-                       *effect_, *control_);
+  const Operator* load_op = mcgraph()->machine()->Load(type);
+  Node* load = graph()->NewNode(
+      load_op, stack_slot, mcgraph()->Int32Constant(0), *effect_, *control_);
   *effect_ = load;
   return load;
 }
@@ -1895,23 +1897,23 @@ Node* WasmGraphBuilder::BuildCFuncInstruction(ExternalReference ref,
 Node* WasmGraphBuilder::BuildF32SConvertI64(Node* input) {
   // TODO(titzer/bradnelson): Check handlng of asm.js case.
   return BuildIntToFloatConversionInstruction(
-      input, ExternalReference::wasm_int64_to_float32(jsgraph()->isolate()),
+      input, ExternalReference::wasm_int64_to_float32(),
       MachineRepresentation::kWord64, MachineType::Float32());
 }
 Node* WasmGraphBuilder::BuildF32UConvertI64(Node* input) {
   // TODO(titzer/bradnelson): Check handlng of asm.js case.
   return BuildIntToFloatConversionInstruction(
-      input, ExternalReference::wasm_uint64_to_float32(jsgraph()->isolate()),
+      input, ExternalReference::wasm_uint64_to_float32(),
       MachineRepresentation::kWord64, MachineType::Float32());
 }
 Node* WasmGraphBuilder::BuildF64SConvertI64(Node* input) {
   return BuildIntToFloatConversionInstruction(
-      input, ExternalReference::wasm_int64_to_float64(jsgraph()->isolate()),
+      input, ExternalReference::wasm_int64_to_float64(),
       MachineRepresentation::kWord64, MachineType::Float64());
 }
 Node* WasmGraphBuilder::BuildF64UConvertI64(Node* input) {
   return BuildIntToFloatConversionInstruction(
-      input, ExternalReference::wasm_uint64_to_float64(jsgraph()->isolate()),
+      input, ExternalReference::wasm_uint64_to_float64(),
       MachineRepresentation::kWord64, MachineType::Float64());
 }
 
@@ -1919,25 +1921,22 @@ Node* WasmGraphBuilder::BuildIntToFloatConversionInstruction(
     Node* input, ExternalReference ref,
     MachineRepresentation parameter_representation,
     const MachineType result_type) {
-  Node* stack_slot_param = graph()->NewNode(
-      jsgraph()->machine()->StackSlot(parameter_representation));
-  Node* stack_slot_result = graph()->NewNode(
-      jsgraph()->machine()->StackSlot(result_type.representation()));
-  const Operator* store_op = jsgraph()->machine()->Store(
+  int stack_slot_size =
+      std::max(ElementSizeInBytes(parameter_representation),
+               ElementSizeInBytes(result_type.representation()));
+  Node* stack_slot =
+      graph()->NewNode(mcgraph()->machine()->StackSlot(stack_slot_size));
+  const Operator* store_op = mcgraph()->machine()->Store(
       StoreRepresentation(parameter_representation, kNoWriteBarrier));
-  *effect_ =
-      graph()->NewNode(store_op, stack_slot_param, jsgraph()->Int32Constant(0),
-                       input, *effect_, *control_);
-  MachineSignature::Builder sig_builder(jsgraph()->zone(), 0, 2);
-  sig_builder.AddParam(MachineType::Pointer());
-  sig_builder.AddParam(MachineType::Pointer());
-  Node* function = graph()->NewNode(jsgraph()->common()->ExternalConstant(ref));
-  BuildCCall(sig_builder.Build(), function, stack_slot_param,
-             stack_slot_result);
-  const Operator* load_op = jsgraph()->machine()->Load(result_type);
-  Node* load =
-      graph()->NewNode(load_op, stack_slot_result, jsgraph()->Int32Constant(0),
-                       *effect_, *control_);
+  *effect_ = graph()->NewNode(store_op, stack_slot, mcgraph()->Int32Constant(0),
+                              input, *effect_, *control_);
+  MachineType sig_types[] = {MachineType::Pointer()};
+  MachineSignature sig(0, 1, sig_types);
+  Node* function = graph()->NewNode(mcgraph()->common()->ExternalConstant(ref));
+  BuildCCall(&sig, function, stack_slot);
+  const Operator* load_op = mcgraph()->machine()->Load(result_type);
+  Node* load = graph()->NewNode(
+      load_op, stack_slot, mcgraph()->Int32Constant(0), *effect_, *control_);
   *effect_ = load;
   return load;
 }
@@ -1949,20 +1948,16 @@ ExternalReference convert_ccall_ref(WasmGraphBuilder* builder,
   switch (opcode) {
     case wasm::kExprI64SConvertF32:
     case wasm::kExprI64SConvertSatF32:
-      return ExternalReference::wasm_float32_to_int64(
-          builder->jsgraph()->isolate());
+      return ExternalReference::wasm_float32_to_int64();
     case wasm::kExprI64UConvertF32:
     case wasm::kExprI64UConvertSatF32:
-      return ExternalReference::wasm_float32_to_uint64(
-          builder->jsgraph()->isolate());
+      return ExternalReference::wasm_float32_to_uint64();
     case wasm::kExprI64SConvertF64:
     case wasm::kExprI64SConvertSatF64:
-      return ExternalReference::wasm_float64_to_int64(
-          builder->jsgraph()->isolate());
+      return ExternalReference::wasm_float64_to_int64();
     case wasm::kExprI64UConvertF64:
     case wasm::kExprI64UConvertSatF64:
-      return ExternalReference::wasm_float64_to_uint64(
-          builder->jsgraph()->isolate());
+      return ExternalReference::wasm_float64_to_uint64();
     default:
       UNREACHABLE();
   }
@@ -1976,44 +1971,41 @@ Node* WasmGraphBuilder::BuildCcallConvertFloat(Node* input,
   const MachineType int_ty = IntConvertType(opcode);
   const MachineType float_ty = FloatConvertType(opcode);
   ExternalReference call_ref = convert_ccall_ref(this, opcode);
-  Node* stack_slot_param = graph()->NewNode(
-      jsgraph()->machine()->StackSlot(float_ty.representation()));
-  Node* stack_slot_result = graph()->NewNode(
-      jsgraph()->machine()->StackSlot(int_ty.representation()));
-  const Operator* store_op = jsgraph()->machine()->Store(
+  int stack_slot_size = std::max(ElementSizeInBytes(int_ty.representation()),
+                                 ElementSizeInBytes(float_ty.representation()));
+  Node* stack_slot =
+      graph()->NewNode(mcgraph()->machine()->StackSlot(stack_slot_size));
+  const Operator* store_op = mcgraph()->machine()->Store(
       StoreRepresentation(float_ty.representation(), kNoWriteBarrier));
-  *effect_ = graph()->NewNode(store_op, stack_slot_param, Int32Constant(0),
-                              input, *effect_, *control_);
-  MachineSignature::Builder sig_builder(jsgraph()->zone(), 1, 2);
-  sig_builder.AddReturn(MachineType::Int32());
-  sig_builder.AddParam(MachineType::Pointer());
-  sig_builder.AddParam(MachineType::Pointer());
+  *effect_ = graph()->NewNode(store_op, stack_slot, Int32Constant(0), input,
+                              *effect_, *control_);
+  MachineType sig_types[] = {MachineType::Int32(), MachineType::Pointer()};
+  MachineSignature sig(1, 1, sig_types);
   Node* function =
-      graph()->NewNode(jsgraph()->common()->ExternalConstant(call_ref));
-  Node* overflow = BuildCCall(sig_builder.Build(), function, stack_slot_param,
-                              stack_slot_result);
+      graph()->NewNode(mcgraph()->common()->ExternalConstant(call_ref));
+  Node* overflow = BuildCCall(&sig, function, stack_slot);
   if (IsTrappingConvertOp(opcode)) {
     ZeroCheck32(wasm::kTrapFloatUnrepresentable, overflow, position);
-    const Operator* load_op = jsgraph()->machine()->Load(int_ty);
-    Node* load = graph()->NewNode(load_op, stack_slot_result, Int32Constant(0),
+    const Operator* load_op = mcgraph()->machine()->Load(int_ty);
+    Node* load = graph()->NewNode(load_op, stack_slot, Int32Constant(0),
                                   *effect_, *control_);
     *effect_ = load;
     return load;
   }
   Node* test = Binop(wasm::kExprI32Eq, overflow, Int32Constant(0), position);
-  Diamond tl_d(graph(), jsgraph()->common(), test, BranchHint::kFalse);
+  Diamond tl_d(graph(), mcgraph()->common(), test, BranchHint::kFalse);
   tl_d.Chain(Control());
   Node* nan_test = Binop(NeOp(float_ty), input, input);
-  Diamond nan_d(graph(), jsgraph()->common(), nan_test, BranchHint::kFalse);
+  Diamond nan_d(graph(), mcgraph()->common(), nan_test, BranchHint::kFalse);
   nan_d.Nest(tl_d, true);
   Node* neg_test = Binop(LtOp(float_ty), input, Zero(this, float_ty));
-  Diamond sat_d(graph(), jsgraph()->common(), neg_test, BranchHint::kNone);
+  Diamond sat_d(graph(), mcgraph()->common(), neg_test, BranchHint::kNone);
   sat_d.Nest(nan_d, false);
   Node* sat_val =
       sat_d.Phi(int_ty.representation(), Min(this, int_ty), Max(this, int_ty));
-  const Operator* load_op = jsgraph()->machine()->Load(int_ty);
-  Node* load = graph()->NewNode(load_op, stack_slot_result, Int32Constant(0),
-                                *effect_, *control_);
+  const Operator* load_op = mcgraph()->machine()->Load(int_ty);
+  Node* load = graph()->NewNode(load_op, stack_slot, Int32Constant(0), *effect_,
+                                *control_);
   Node* nan_val =
       nan_d.Phi(int_ty.representation(), Zero(this, int_ty), sat_val);
   return tl_d.Phi(int_ty.representation(), nan_val, load);
@@ -2021,28 +2013,25 @@ Node* WasmGraphBuilder::BuildCcallConvertFloat(Node* input,
 
 Node* WasmGraphBuilder::GrowMemory(Node* input) {
   SetNeedsStackCheck();
-  Diamond check_input_range(
-      graph(), jsgraph()->common(),
-      graph()->NewNode(jsgraph()->machine()->Uint32LessThanOrEqual(), input,
-                       jsgraph()->Uint32Constant(FLAG_wasm_max_mem_pages)),
-      BranchHint::kTrue);
-
-  check_input_range.Chain(*control_);
 
-  Node* parameters[] = {BuildChangeUint32ToSmi(input)};
-  Node* old_effect = *effect_;
-  *control_ = check_input_range.if_true;
-  Node* call = BuildCallToRuntime(Runtime::kWasmGrowMemory, parameters,
-                                  arraysize(parameters));
-
-  Node* result = BuildChangeSmiToInt32(call);
+  WasmGrowMemoryDescriptor interface_descriptor;
+  auto call_descriptor = Linkage::GetStubCallDescriptor(
+      mcgraph()->zone(),                              // zone
+      interface_descriptor,                           // descriptor
+      interface_descriptor.GetStackParameterCount(),  // stack parameter count
+      CallDescriptor::kNoFlags,                       // flags
+      Operator::kNoProperties,                        // properties
+      StubCallMode::kCallWasmRuntimeStub);            // stub call mode
+  // A direct call to a wasm runtime stub defined in this module.
+  // Just encode the stub index. This will be patched at relocation.
+  Node* call_target = mcgraph()->RelocatableIntPtrConstant(
+      wasm::WasmCode::kWasmGrowMemory, RelocInfo::WASM_STUB_CALL);
+  Node* call = graph()->NewNode(mcgraph()->common()->Call(call_descriptor),
+                                call_target, input, *effect_, *control_);
 
-  result = check_input_range.Phi(MachineRepresentation::kWord32, result,
-                                 jsgraph()->Int32Constant(-1));
-  *effect_ = graph()->NewNode(jsgraph()->common()->EffectPhi(2), *effect_,
-                              old_effect, check_input_range.merge);
-  *control_ = check_input_range.merge;
-  return result;
+  *effect_ = call;
+  *control_ = call;
+  return call;
 }
 
 uint32_t WasmGraphBuilder::GetExceptionEncodedSize(
@@ -2050,7 +2039,8 @@ uint32_t WasmGraphBuilder::GetExceptionEncodedSize(
   const wasm::WasmExceptionSig* sig = exception->sig;
   uint32_t encoded_size = 0;
   for (size_t i = 0; i < sig->parameter_count(); ++i) {
-    size_t byte_size = size_t(1) << ElementSizeLog2Of(sig->GetParam(i));
+    size_t byte_size = static_cast<size_t>(
+        wasm::ValueTypes::ElementSizeInBytes(sig->GetParam(i)));
     DCHECK_EQ(byte_size % kBytesPerExceptionValuesArrayElement, 0);
     DCHECK_LE(1, byte_size / kBytesPerExceptionValuesArrayElement);
     encoded_size += byte_size / kBytesPerExceptionValuesArrayElement;
@@ -2064,13 +2054,13 @@ Node* WasmGraphBuilder::Throw(uint32_t tag,
   SetNeedsStackCheck();
   uint32_t encoded_size = GetExceptionEncodedSize(exception);
   Node* create_parameters[] = {
-      BuildChangeUint32ToSmi(ConvertExceptionTagToRuntimeId(tag)),
-      BuildChangeUint32ToSmi(Uint32Constant(encoded_size))};
+      BuildChangeUint31ToSmi(ConvertExceptionTagToRuntimeId(tag)),
+      BuildChangeUint31ToSmi(Uint32Constant(encoded_size))};
   BuildCallToRuntime(Runtime::kWasmThrowCreate, create_parameters,
                      arraysize(create_parameters));
   uint32_t index = 0;
   const wasm::WasmExceptionSig* sig = exception->sig;
-  MachineOperatorBuilder* m = jsgraph()->machine();
+  MachineOperatorBuilder* m = mcgraph()->machine();
   for (size_t i = 0; i < sig->parameter_count(); ++i) {
     Node* value = values[i];
     switch (sig->GetParam(i)) {
@@ -2102,18 +2092,18 @@ Node* WasmGraphBuilder::Throw(uint32_t tag,
 
 void WasmGraphBuilder::BuildEncodeException32BitValue(uint32_t* index,
                                                       Node* value) {
-  MachineOperatorBuilder* machine = jsgraph()->machine();
+  MachineOperatorBuilder* machine = mcgraph()->machine();
   Node* upper_parameters[] = {
-      BuildChangeUint32ToSmi(Int32Constant(*index)),
-      BuildChangeUint32ToSmi(
+      BuildChangeUint31ToSmi(Int32Constant(*index)),
+      BuildChangeUint31ToSmi(
           graph()->NewNode(machine->Word32Shr(), value, Int32Constant(16))),
   };
   BuildCallToRuntime(Runtime::kWasmExceptionSetElement, upper_parameters,
                      arraysize(upper_parameters));
   ++(*index);
   Node* lower_parameters[] = {
-      BuildChangeUint32ToSmi(Int32Constant(*index)),
-      BuildChangeUint32ToSmi(graph()->NewNode(machine->Word32And(), value,
+      BuildChangeUint31ToSmi(Int32Constant(*index)),
+      BuildChangeUint31ToSmi(graph()->NewNode(machine->Word32And(), value,
                                               Int32Constant(0xFFFFu))),
   };
   BuildCallToRuntime(Runtime::kWasmExceptionSetElement, lower_parameters,
@@ -2123,7 +2113,7 @@ void WasmGraphBuilder::BuildEncodeException32BitValue(uint32_t* index,
 
 Node* WasmGraphBuilder::BuildDecodeException32BitValue(Node* const* values,
                                                        uint32_t* index) {
-  MachineOperatorBuilder* machine = jsgraph()->machine();
+  MachineOperatorBuilder* machine = mcgraph()->machine();
   Node* upper = BuildChangeSmiToInt32(values[*index]);
   (*index)++;
   upper = graph()->NewNode(machine->Word32Shl(), upper, Int32Constant(16));
@@ -2161,7 +2151,7 @@ Node** WasmGraphBuilder::GetExceptionValues(
   uint32_t encoded_size = GetExceptionEncodedSize(except_decl);
   Node** values = Buffer(encoded_size);
   for (uint32_t i = 0; i < encoded_size; ++i) {
-    Node* parameters[] = {BuildChangeUint32ToSmi(Uint32Constant(i))};
+    Node* parameters[] = {BuildChangeUint31ToSmi(Uint32Constant(i))};
     values[i] = BuildCallToRuntime(Runtime::kWasmExceptionGetElement,
                                    parameters, arraysize(parameters));
   }
@@ -2202,18 +2192,18 @@ Node** WasmGraphBuilder::GetExceptionValues(
 
 Node* WasmGraphBuilder::BuildI32DivS(Node* left, Node* right,
                                      wasm::WasmCodePosition position) {
-  MachineOperatorBuilder* m = jsgraph()->machine();
+  MachineOperatorBuilder* m = mcgraph()->machine();
   ZeroCheck32(wasm::kTrapDivByZero, right, position);
   Node* before = *control_;
   Node* denom_is_m1;
   Node* denom_is_not_m1;
   BranchExpectFalse(
-      graph()->NewNode(m->Word32Equal(), right, jsgraph()->Int32Constant(-1)),
+      graph()->NewNode(m->Word32Equal(), right, mcgraph()->Int32Constant(-1)),
       &denom_is_m1, &denom_is_not_m1);
   *control_ = denom_is_m1;
   TrapIfEq32(wasm::kTrapDivUnrepresentable, left, kMinInt, position);
   if (*control_ != denom_is_m1) {
-    *control_ = graph()->NewNode(jsgraph()->common()->Merge(2), denom_is_not_m1,
+    *control_ = graph()->NewNode(mcgraph()->common()->Merge(2), denom_is_not_m1,
                                  *control_);
   } else {
     *control_ = before;
@@ -2223,44 +2213,44 @@ Node* WasmGraphBuilder::BuildI32DivS(Node* left, Node* right,
 
 Node* WasmGraphBuilder::BuildI32RemS(Node* left, Node* right,
                                      wasm::WasmCodePosition position) {
-  MachineOperatorBuilder* m = jsgraph()->machine();
+  MachineOperatorBuilder* m = mcgraph()->machine();
 
   ZeroCheck32(wasm::kTrapRemByZero, right, position);
 
   Diamond d(
-      graph(), jsgraph()->common(),
-      graph()->NewNode(m->Word32Equal(), right, jsgraph()->Int32Constant(-1)),
+      graph(), mcgraph()->common(),
+      graph()->NewNode(m->Word32Equal(), right, mcgraph()->Int32Constant(-1)),
       BranchHint::kFalse);
   d.Chain(*control_);
 
-  return d.Phi(MachineRepresentation::kWord32, jsgraph()->Int32Constant(0),
+  return d.Phi(MachineRepresentation::kWord32, mcgraph()->Int32Constant(0),
                graph()->NewNode(m->Int32Mod(), left, right, d.if_false));
 }
 
 Node* WasmGraphBuilder::BuildI32DivU(Node* left, Node* right,
                                      wasm::WasmCodePosition position) {
-  MachineOperatorBuilder* m = jsgraph()->machine();
+  MachineOperatorBuilder* m = mcgraph()->machine();
   return graph()->NewNode(m->Uint32Div(), left, right,
                           ZeroCheck32(wasm::kTrapDivByZero, right, position));
 }
 
 Node* WasmGraphBuilder::BuildI32RemU(Node* left, Node* right,
                                      wasm::WasmCodePosition position) {
-  MachineOperatorBuilder* m = jsgraph()->machine();
+  MachineOperatorBuilder* m = mcgraph()->machine();
   return graph()->NewNode(m->Uint32Mod(), left, right,
                           ZeroCheck32(wasm::kTrapRemByZero, right, position));
 }
 
 Node* WasmGraphBuilder::BuildI32AsmjsDivS(Node* left, Node* right) {
-  MachineOperatorBuilder* m = jsgraph()->machine();
+  MachineOperatorBuilder* m = mcgraph()->machine();
 
   Int32Matcher mr(right);
   if (mr.HasValue()) {
     if (mr.Value() == 0) {
-      return jsgraph()->Int32Constant(0);
+      return mcgraph()->Int32Constant(0);
     } else if (mr.Value() == -1) {
       // The result is the negation of the left input.
-      return graph()->NewNode(m->Int32Sub(), jsgraph()->Int32Constant(0), left);
+      return graph()->NewNode(m->Int32Sub(), mcgraph()->Int32Constant(0), left);
     }
     return graph()->NewNode(m->Int32Div(), left, right, *control_);
   }
@@ -2273,29 +2263,29 @@ Node* WasmGraphBuilder::BuildI32AsmjsDivS(Node* left, Node* right) {
 
   // Check denominator for zero.
   Diamond z(
-      graph(), jsgraph()->common(),
-      graph()->NewNode(m->Word32Equal(), right, jsgraph()->Int32Constant(0)),
+      graph(), mcgraph()->common(),
+      graph()->NewNode(m->Word32Equal(), right, mcgraph()->Int32Constant(0)),
       BranchHint::kFalse);
 
   // Check numerator for -1. (avoid minint / -1 case).
   Diamond n(
-      graph(), jsgraph()->common(),
-      graph()->NewNode(m->Word32Equal(), right, jsgraph()->Int32Constant(-1)),
+      graph(), mcgraph()->common(),
+      graph()->NewNode(m->Word32Equal(), right, mcgraph()->Int32Constant(-1)),
       BranchHint::kFalse);
 
   Node* div = graph()->NewNode(m->Int32Div(), left, right, z.if_false);
   Node* neg =
-      graph()->NewNode(m->Int32Sub(), jsgraph()->Int32Constant(0), left);
+      graph()->NewNode(m->Int32Sub(), mcgraph()->Int32Constant(0), left);
 
   return n.Phi(
       MachineRepresentation::kWord32, neg,
-      z.Phi(MachineRepresentation::kWord32, jsgraph()->Int32Constant(0), div));
+      z.Phi(MachineRepresentation::kWord32, mcgraph()->Int32Constant(0), div));
 }
 
 Node* WasmGraphBuilder::BuildI32AsmjsRemS(Node* left, Node* right) {
-  CommonOperatorBuilder* c = jsgraph()->common();
-  MachineOperatorBuilder* m = jsgraph()->machine();
-  Node* const zero = jsgraph()->Int32Constant(0);
+  CommonOperatorBuilder* c = mcgraph()->common();
+  MachineOperatorBuilder* m = mcgraph()->machine();
+  Node* const zero = mcgraph()->Int32Constant(0);
 
   Int32Matcher mr(right);
   if (mr.HasValue()) {
@@ -2325,7 +2315,7 @@ Node* WasmGraphBuilder::BuildI32AsmjsRemS(Node* left, Node* right) {
   //
   // Note: We do not use the Diamond helper class here, because it really hurts
   // readability with nested diamonds.
-  Node* const minus_one = jsgraph()->Int32Constant(-1);
+  Node* const minus_one = mcgraph()->Int32Constant(-1);
 
   const Operator* const merge_op = c->Merge(2);
   const Operator* const phi_op = c->Phi(MachineRepresentation::kWord32, 2);
@@ -2391,7 +2381,7 @@ Node* WasmGraphBuilder::BuildI32AsmjsRemS(Node* left, Node* right) {
 }
 
 Node* WasmGraphBuilder::BuildI32AsmjsDivU(Node* left, Node* right) {
-  MachineOperatorBuilder* m = jsgraph()->machine();
+  MachineOperatorBuilder* m = mcgraph()->machine();
   // asm.js semantics return 0 on divide or mod by zero.
   if (m->Uint32DivIsSafe()) {
     // The hardware instruction does the right thing (e.g. arm).
@@ -2400,132 +2390,122 @@ Node* WasmGraphBuilder::BuildI32AsmjsDivU(Node* left, Node* right) {
 
   // Explicit check for x % 0.
   Diamond z(
-      graph(), jsgraph()->common(),
-      graph()->NewNode(m->Word32Equal(), right, jsgraph()->Int32Constant(0)),
+      graph(), mcgraph()->common(),
+      graph()->NewNode(m->Word32Equal(), right, mcgraph()->Int32Constant(0)),
       BranchHint::kFalse);
 
-  return z.Phi(MachineRepresentation::kWord32, jsgraph()->Int32Constant(0),
-               graph()->NewNode(jsgraph()->machine()->Uint32Div(), left, right,
+  return z.Phi(MachineRepresentation::kWord32, mcgraph()->Int32Constant(0),
+               graph()->NewNode(mcgraph()->machine()->Uint32Div(), left, right,
                                 z.if_false));
 }
 
 Node* WasmGraphBuilder::BuildI32AsmjsRemU(Node* left, Node* right) {
-  MachineOperatorBuilder* m = jsgraph()->machine();
+  MachineOperatorBuilder* m = mcgraph()->machine();
   // asm.js semantics return 0 on divide or mod by zero.
   // Explicit check for x % 0.
   Diamond z(
-      graph(), jsgraph()->common(),
-      graph()->NewNode(m->Word32Equal(), right, jsgraph()->Int32Constant(0)),
+      graph(), mcgraph()->common(),
+      graph()->NewNode(m->Word32Equal(), right, mcgraph()->Int32Constant(0)),
       BranchHint::kFalse);
 
-  Node* rem = graph()->NewNode(jsgraph()->machine()->Uint32Mod(), left, right,
+  Node* rem = graph()->NewNode(mcgraph()->machine()->Uint32Mod(), left, right,
                                z.if_false);
-  return z.Phi(MachineRepresentation::kWord32, jsgraph()->Int32Constant(0),
+  return z.Phi(MachineRepresentation::kWord32, mcgraph()->Int32Constant(0),
                rem);
 }
 
 Node* WasmGraphBuilder::BuildI64DivS(Node* left, Node* right,
                                      wasm::WasmCodePosition position) {
-  if (jsgraph()->machine()->Is32()) {
-    return BuildDiv64Call(
-        left, right, ExternalReference::wasm_int64_div(jsgraph()->isolate()),
-        MachineType::Int64(), wasm::kTrapDivByZero, position);
+  if (mcgraph()->machine()->Is32()) {
+    return BuildDiv64Call(left, right, ExternalReference::wasm_int64_div(),
+                          MachineType::Int64(), wasm::kTrapDivByZero, position);
   }
   ZeroCheck64(wasm::kTrapDivByZero, right, position);
   Node* before = *control_;
   Node* denom_is_m1;
   Node* denom_is_not_m1;
-  BranchExpectFalse(graph()->NewNode(jsgraph()->machine()->Word64Equal(), right,
-                                     jsgraph()->Int64Constant(-1)),
+  BranchExpectFalse(graph()->NewNode(mcgraph()->machine()->Word64Equal(), right,
+                                     mcgraph()->Int64Constant(-1)),
                     &denom_is_m1, &denom_is_not_m1);
   *control_ = denom_is_m1;
   TrapIfEq64(wasm::kTrapDivUnrepresentable, left,
              std::numeric_limits<int64_t>::min(), position);
   if (*control_ != denom_is_m1) {
-    *control_ = graph()->NewNode(jsgraph()->common()->Merge(2), denom_is_not_m1,
+    *control_ = graph()->NewNode(mcgraph()->common()->Merge(2), denom_is_not_m1,
                                  *control_);
   } else {
     *control_ = before;
   }
-  return graph()->NewNode(jsgraph()->machine()->Int64Div(), left, right,
+  return graph()->NewNode(mcgraph()->machine()->Int64Div(), left, right,
                           *control_);
 }
 
 Node* WasmGraphBuilder::BuildI64RemS(Node* left, Node* right,
                                      wasm::WasmCodePosition position) {
-  if (jsgraph()->machine()->Is32()) {
-    return BuildDiv64Call(
-        left, right, ExternalReference::wasm_int64_mod(jsgraph()->isolate()),
-        MachineType::Int64(), wasm::kTrapRemByZero, position);
+  if (mcgraph()->machine()->Is32()) {
+    return BuildDiv64Call(left, right, ExternalReference::wasm_int64_mod(),
+                          MachineType::Int64(), wasm::kTrapRemByZero, position);
   }
   ZeroCheck64(wasm::kTrapRemByZero, right, position);
-  Diamond d(jsgraph()->graph(), jsgraph()->common(),
-            graph()->NewNode(jsgraph()->machine()->Word64Equal(), right,
-                             jsgraph()->Int64Constant(-1)));
+  Diamond d(mcgraph()->graph(), mcgraph()->common(),
+            graph()->NewNode(mcgraph()->machine()->Word64Equal(), right,
+                             mcgraph()->Int64Constant(-1)));
 
   d.Chain(*control_);
 
-  Node* rem = graph()->NewNode(jsgraph()->machine()->Int64Mod(), left, right,
+  Node* rem = graph()->NewNode(mcgraph()->machine()->Int64Mod(), left, right,
                                d.if_false);
 
-  return d.Phi(MachineRepresentation::kWord64, jsgraph()->Int64Constant(0),
+  return d.Phi(MachineRepresentation::kWord64, mcgraph()->Int64Constant(0),
                rem);
 }
 
 Node* WasmGraphBuilder::BuildI64DivU(Node* left, Node* right,
                                      wasm::WasmCodePosition position) {
-  if (jsgraph()->machine()->Is32()) {
-    return BuildDiv64Call(
-        left, right, ExternalReference::wasm_uint64_div(jsgraph()->isolate()),
-        MachineType::Int64(), wasm::kTrapDivByZero, position);
+  if (mcgraph()->machine()->Is32()) {
+    return BuildDiv64Call(left, right, ExternalReference::wasm_uint64_div(),
+                          MachineType::Int64(), wasm::kTrapDivByZero, position);
   }
-  return graph()->NewNode(jsgraph()->machine()->Uint64Div(), left, right,
+  return graph()->NewNode(mcgraph()->machine()->Uint64Div(), left, right,
                           ZeroCheck64(wasm::kTrapDivByZero, right, position));
 }
 Node* WasmGraphBuilder::BuildI64RemU(Node* left, Node* right,
                                      wasm::WasmCodePosition position) {
-  if (jsgraph()->machine()->Is32()) {
-    return BuildDiv64Call(
-        left, right, ExternalReference::wasm_uint64_mod(jsgraph()->isolate()),
-        MachineType::Int64(), wasm::kTrapRemByZero, position);
+  if (mcgraph()->machine()->Is32()) {
+    return BuildDiv64Call(left, right, ExternalReference::wasm_uint64_mod(),
+                          MachineType::Int64(), wasm::kTrapRemByZero, position);
   }
-  return graph()->NewNode(jsgraph()->machine()->Uint64Mod(), left, right,
+  return graph()->NewNode(mcgraph()->machine()->Uint64Mod(), left, right,
                           ZeroCheck64(wasm::kTrapRemByZero, right, position));
 }
 
 Node* WasmGraphBuilder::BuildDiv64Call(Node* left, Node* right,
                                        ExternalReference ref,
-                                       MachineType result_type, int trap_zero,
+                                       MachineType result_type,
+                                       wasm::TrapReason trap_zero,
                                        wasm::WasmCodePosition position) {
-  Node* stack_slot_dst = graph()->NewNode(
-      jsgraph()->machine()->StackSlot(MachineRepresentation::kWord64));
-  Node* stack_slot_src = graph()->NewNode(
-      jsgraph()->machine()->StackSlot(MachineRepresentation::kWord64));
+  Node* stack_slot =
+      graph()->NewNode(mcgraph()->machine()->StackSlot(2 * sizeof(double)));
 
-  const Operator* store_op = jsgraph()->machine()->Store(
+  const Operator* store_op = mcgraph()->machine()->Store(
       StoreRepresentation(MachineRepresentation::kWord64, kNoWriteBarrier));
-  *effect_ =
-      graph()->NewNode(store_op, stack_slot_dst, jsgraph()->Int32Constant(0),
-                       left, *effect_, *control_);
-  *effect_ =
-      graph()->NewNode(store_op, stack_slot_src, jsgraph()->Int32Constant(0),
-                       right, *effect_, *control_);
+  *effect_ = graph()->NewNode(store_op, stack_slot, mcgraph()->Int32Constant(0),
+                              left, *effect_, *control_);
+  *effect_ = graph()->NewNode(store_op, stack_slot,
+                              mcgraph()->Int32Constant(sizeof(double)), right,
+                              *effect_, *control_);
 
-  MachineSignature::Builder sig_builder(jsgraph()->zone(), 1, 2);
-  sig_builder.AddReturn(MachineType::Int32());
-  sig_builder.AddParam(MachineType::Pointer());
-  sig_builder.AddParam(MachineType::Pointer());
+  MachineType sig_types[] = {MachineType::Int32(), MachineType::Pointer()};
+  MachineSignature sig(1, 1, sig_types);
 
-  Node* function = graph()->NewNode(jsgraph()->common()->ExternalConstant(ref));
-  Node* call =
-      BuildCCall(sig_builder.Build(), function, stack_slot_dst, stack_slot_src);
+  Node* function = graph()->NewNode(mcgraph()->common()->ExternalConstant(ref));
+  Node* call = BuildCCall(&sig, function, stack_slot);
 
-  ZeroCheck32(static_cast<wasm::TrapReason>(trap_zero), call, position);
+  ZeroCheck32(trap_zero, call, position);
   TrapIfEq32(wasm::kTrapDivUnrepresentable, call, -1, position);
-  const Operator* load_op = jsgraph()->machine()->Load(result_type);
-  Node* load =
-      graph()->NewNode(load_op, stack_slot_dst, jsgraph()->Int32Constant(0),
-                       *effect_, *control_);
+  const Operator* load_op = mcgraph()->machine()->Load(result_type);
+  Node* load = graph()->NewNode(
+      load_op, stack_slot, mcgraph()->Int32Constant(0), *effect_, *control_);
   *effect_ = load;
   return load;
 }
@@ -2538,9 +2518,9 @@ Node* WasmGraphBuilder::BuildCCall(MachineSignature* sig, Node* function,
   Node* const call_args[] = {function, args..., *effect_, *control_};
 
   auto call_descriptor =
-      Linkage::GetSimplifiedCDescriptor(jsgraph()->zone(), sig);
+      Linkage::GetSimplifiedCDescriptor(mcgraph()->zone(), sig);
 
-  const Operator* op = jsgraph()->common()->Call(call_descriptor);
+  const Operator* op = mcgraph()->common()->Call(call_descriptor);
   Node* call = graph()->NewNode(op, arraysize(call_args), call_args);
   *effect_ = call;
   return call;
@@ -2572,10 +2552,11 @@ Node* WasmGraphBuilder::BuildWasmCall(wasm::FunctionSig* sig, Node** args,
   args[params + 3] = *control_;
 
   auto call_descriptor =
-      GetWasmCallDescriptor(jsgraph()->zone(), sig, use_retpoline);
-  const Operator* op = jsgraph()->common()->Call(call_descriptor);
+      GetWasmCallDescriptor(mcgraph()->zone(), sig, use_retpoline);
+  const Operator* op = mcgraph()->common()->Call(call_descriptor);
   Node* call = graph()->NewNode(op, static_cast<int>(count), args);
-  SetSourcePosition(call, position);
+  DCHECK(position == wasm::kNoCodePosition || position > 0);
+  if (position > 0) SetSourcePosition(call, position);
 
   *effect_ = call;
   size_t ret_count = sig->return_count();
@@ -2588,46 +2569,82 @@ Node* WasmGraphBuilder::BuildWasmCall(wasm::FunctionSig* sig, Node** args,
   } else {
     // Create projections for all return values.
     for (size_t i = 0; i < ret_count; i++) {
-      (*rets)[i] = graph()->NewNode(jsgraph()->common()->Projection(i), call,
+      (*rets)[i] = graph()->NewNode(mcgraph()->common()->Projection(i), call,
                                     graph()->start());
     }
   }
   return call;
 }
 
+Node* WasmGraphBuilder::BuildImportWasmCall(wasm::FunctionSig* sig, Node** args,
+                                            Node*** rets,
+                                            wasm::WasmCodePosition position,
+                                            int func_index) {
+  // Load the instance from the imported_instances array at a known offset.
+  Node* imported_instances = LOAD_INSTANCE_FIELD(ImportedFunctionInstances,
+                                                 MachineType::TaggedPointer());
+  Node* instance_node = LOAD_FIXED_ARRAY_SLOT(imported_instances, func_index);
+
+  // Load the target from the imported_targets array at a known offset.
+  Node* imported_targets =
+      LOAD_INSTANCE_FIELD(ImportedFunctionTargets, MachineType::Pointer());
+  Node* target_node = graph()->NewNode(
+      mcgraph()->machine()->Load(MachineType::Pointer()), imported_targets,
+      mcgraph()->Int32Constant(func_index * kPointerSize),
+      mcgraph()->graph()->start(), mcgraph()->graph()->start());
+  args[0] = target_node;
+  return BuildWasmCall(sig, args, rets, position, instance_node,
+                       untrusted_code_mitigations_ ? kRetpoline : kNoRetpoline);
+}
+
+Node* WasmGraphBuilder::BuildImportWasmCall(wasm::FunctionSig* sig, Node** args,
+                                            Node*** rets,
+                                            wasm::WasmCodePosition position,
+                                            Node* func_index) {
+  // Load the instance from the imported_instances array.
+  Node* imported_instances = LOAD_INSTANCE_FIELD(ImportedFunctionInstances,
+                                                 MachineType::TaggedPointer());
+  // Access fixed array at {header_size - tag + func_index * kPointerSize}.
+  Node* imported_instances_data =
+      graph()->NewNode(mcgraph()->machine()->IntAdd(), imported_instances,
+                       mcgraph()->IntPtrConstant(FixedArrayOffsetMinusTag(0)));
+  Node* func_index_times_pointersize = graph()->NewNode(
+      mcgraph()->machine()->IntMul(), Uint32ToUintptr(func_index),
+      mcgraph()->Int32Constant(kPointerSize));
+  Node* instance_node =
+      graph()->NewNode(mcgraph()->machine()->Load(MachineType::TaggedPointer()),
+                       imported_instances_data, func_index_times_pointersize,
+                       *effect_, *control_);
+
+  // Load the target from the imported_targets array at the offset of
+  // {func_index}.
+  Node* imported_targets =
+      LOAD_INSTANCE_FIELD(ImportedFunctionTargets, MachineType::Pointer());
+  Node* target_node = graph()->NewNode(
+      mcgraph()->machine()->Load(MachineType::Pointer()), imported_targets,
+      func_index_times_pointersize, mcgraph()->graph()->start(),
+      mcgraph()->graph()->start());
+  args[0] = target_node;
+  return BuildWasmCall(sig, args, rets, position, instance_node,
+                       untrusted_code_mitigations_ ? kRetpoline : kNoRetpoline);
+}
+
 Node* WasmGraphBuilder::CallDirect(uint32_t index, Node** args, Node*** rets,
                                    wasm::WasmCodePosition position) {
   DCHECK_NULL(args[0]);
   wasm::FunctionSig* sig = env_->module->functions[index].sig;
 
   if (env_ && index < env_->module->num_imported_functions) {
-    // A call to an imported function.
-    // Load the instance from the imported_instances array at a known offset.
-    Node* imported_instances = LOAD_INSTANCE_FIELD(
-        ImportedFunctionInstances, MachineType::TaggedPointer());
-    Node* instance_node = LOAD_FIXED_ARRAY_SLOT(imported_instances, index);
-
-    // Load the target from the imported_targets array at a known offset.
-    Node* imported_targets =
-        LOAD_INSTANCE_FIELD(ImportedFunctionTargets, MachineType::Pointer());
-    Node* target_node = graph()->NewNode(
-        jsgraph()->machine()->Load(MachineType::Pointer()), imported_targets,
-        jsgraph()->Int32Constant(index * sizeof(Address)),
-        jsgraph()->graph()->start(), jsgraph()->graph()->start());
-    args[0] = target_node;
-    return BuildWasmCall(
-        sig, args, rets, position, instance_node,
-        untrusted_code_mitigations_ ? kRetpoline : kNoRetpoline);
+    // Call to an imported function.
+    return BuildImportWasmCall(sig, args, rets, position, index);
+  }
 
-  } else {
-    // A call to a function in this module.
-    // Just encode the function index. This will be patched at instantiation.
-    Address code = reinterpret_cast<Address>(index);
-    args[0] = jsgraph()->RelocatableIntPtrConstant(
-        reinterpret_cast<intptr_t>(code), RelocInfo::WASM_CALL);
+  // A direct call to a wasm function defined in this module.
+  // Just encode the function index. This will be patched at instantiation.
+  Address code = static_cast<Address>(index);
+  args[0] = mcgraph()->RelocatableIntPtrConstant(code, RelocInfo::WASM_CALL);
 
-    return BuildWasmCall(sig, args, rets, position, nullptr, kNoRetpoline);
-  }
+  return BuildWasmCall(sig, args, rets, position, nullptr, kNoRetpoline);
 }
 
 Node* WasmGraphBuilder::CallIndirect(uint32_t sig_index, Node** args,
@@ -2642,7 +2659,7 @@ Node* WasmGraphBuilder::CallIndirect(uint32_t sig_index, Node** args,
   Node* ift_size =
       LOAD_INSTANCE_FIELD(IndirectFunctionTableSize, MachineType::Uint32());
 
-  MachineOperatorBuilder* machine = jsgraph()->machine();
+  MachineOperatorBuilder* machine = mcgraph()->machine();
   Node* key = args[0];
 
   // Bounds check against the table size.
@@ -2714,10 +2731,10 @@ Node* WasmGraphBuilder::BuildI32Rol(Node* left, Node* right) {
   Int32Matcher m(right);
   if (m.HasValue()) {
     return Binop(wasm::kExprI32Ror, left,
-                 jsgraph()->Int32Constant(32 - m.Value()));
+                 mcgraph()->Int32Constant(32 - m.Value()));
   } else {
     return Binop(wasm::kExprI32Ror, left,
-                 Binop(wasm::kExprI32Sub, jsgraph()->Int32Constant(32), right));
+                 Binop(wasm::kExprI32Sub, mcgraph()->Int32Constant(32), right));
   }
 }
 
@@ -2727,10 +2744,10 @@ Node* WasmGraphBuilder::BuildI64Rol(Node* left, Node* right) {
   Int64Matcher m(right);
   if (m.HasValue()) {
     return Binop(wasm::kExprI64Ror, left,
-                 jsgraph()->Int64Constant(64 - m.Value()));
+                 mcgraph()->Int64Constant(64 - m.Value()));
   } else {
     return Binop(wasm::kExprI64Ror, left,
-                 Binop(wasm::kExprI64Sub, jsgraph()->Int64Constant(64), right));
+                 Binop(wasm::kExprI64Sub, mcgraph()->Int64Constant(64), right));
   }
 }
 
@@ -2738,143 +2755,6 @@ Node* WasmGraphBuilder::Invert(Node* node) {
   return Unop(wasm::kExprI32Eqz, node);
 }
 
-Node* WasmGraphBuilder::BuildChangeInt32ToTagged(Node* value) {
-  MachineOperatorBuilder* machine = jsgraph()->machine();
-  CommonOperatorBuilder* common = jsgraph()->common();
-
-  if (machine->Is64()) {
-    return BuildChangeInt32ToSmi(value);
-  }
-
-  Node* add = graph()->NewNode(machine->Int32AddWithOverflow(), value, value,
-                               graph()->start());
-
-  Node* ovf = graph()->NewNode(common->Projection(1), add, graph()->start());
-  Node* branch = graph()->NewNode(common->Branch(BranchHint::kFalse), ovf,
-                                  graph()->start());
-
-  Node* if_true = graph()->NewNode(common->IfTrue(), branch);
-  Node* vtrue = BuildAllocateHeapNumberWithValue(
-      graph()->NewNode(machine->ChangeInt32ToFloat64(), value), if_true);
-
-  Node* if_false = graph()->NewNode(common->IfFalse(), branch);
-  Node* vfalse = graph()->NewNode(common->Projection(0), add, if_false);
-
-  Node* merge = graph()->NewNode(common->Merge(2), if_true, if_false);
-  Node* phi = graph()->NewNode(common->Phi(MachineRepresentation::kTagged, 2),
-                               vtrue, vfalse, merge);
-  return phi;
-}
-
-Node* WasmGraphBuilder::BuildChangeFloat64ToTagged(Node* value) {
-  MachineOperatorBuilder* machine = jsgraph()->machine();
-  CommonOperatorBuilder* common = jsgraph()->common();
-
-  Node* value32 = graph()->NewNode(machine->RoundFloat64ToInt32(), value);
-  Node* check_same = graph()->NewNode(
-      machine->Float64Equal(), value,
-      graph()->NewNode(machine->ChangeInt32ToFloat64(), value32));
-  Node* branch_same =
-      graph()->NewNode(common->Branch(), check_same, graph()->start());
-
-  Node* if_smi = graph()->NewNode(common->IfTrue(), branch_same);
-  Node* vsmi;
-  Node* if_box = graph()->NewNode(common->IfFalse(), branch_same);
-  Node* vbox;
-
-  // We only need to check for -0 if the {value} can potentially contain -0.
-  Node* check_zero = graph()->NewNode(machine->Word32Equal(), value32,
-                                      jsgraph()->Int32Constant(0));
-  Node* branch_zero =
-      graph()->NewNode(common->Branch(BranchHint::kFalse), check_zero, if_smi);
-
-  Node* if_zero = graph()->NewNode(common->IfTrue(), branch_zero);
-  Node* if_notzero = graph()->NewNode(common->IfFalse(), branch_zero);
-
-  // In case of 0, we need to check the high bits for the IEEE -0 pattern.
-  Node* check_negative = graph()->NewNode(
-      machine->Int32LessThan(),
-      graph()->NewNode(machine->Float64ExtractHighWord32(), value),
-      jsgraph()->Int32Constant(0));
-  Node* branch_negative = graph()->NewNode(common->Branch(BranchHint::kFalse),
-                                           check_negative, if_zero);
-
-  Node* if_negative = graph()->NewNode(common->IfTrue(), branch_negative);
-  Node* if_notnegative = graph()->NewNode(common->IfFalse(), branch_negative);
-
-  // We need to create a box for negative 0.
-  if_smi = graph()->NewNode(common->Merge(2), if_notzero, if_notnegative);
-  if_box = graph()->NewNode(common->Merge(2), if_box, if_negative);
-
-  // On 64-bit machines we can just wrap the 32-bit integer in a smi, for 32-bit
-  // machines we need to deal with potential overflow and fallback to boxing.
-  if (machine->Is64()) {
-    vsmi = BuildChangeInt32ToSmi(value32);
-  } else {
-    Node* smi_tag = graph()->NewNode(machine->Int32AddWithOverflow(), value32,
-                                     value32, if_smi);
-
-    Node* check_ovf = graph()->NewNode(common->Projection(1), smi_tag, if_smi);
-    Node* branch_ovf =
-        graph()->NewNode(common->Branch(BranchHint::kFalse), check_ovf, if_smi);
-
-    Node* if_ovf = graph()->NewNode(common->IfTrue(), branch_ovf);
-    if_box = graph()->NewNode(common->Merge(2), if_ovf, if_box);
-
-    if_smi = graph()->NewNode(common->IfFalse(), branch_ovf);
-    vsmi = graph()->NewNode(common->Projection(0), smi_tag, if_smi);
-  }
-
-  // Allocate the box for the {value}.
-  vbox = BuildAllocateHeapNumberWithValue(value, if_box);
-
-  Node* control = graph()->NewNode(common->Merge(2), if_smi, if_box);
-  value = graph()->NewNode(common->Phi(MachineRepresentation::kTagged, 2), vsmi,
-                           vbox, control);
-  return value;
-}
-
-Node* WasmGraphBuilder::ToJS(Node* node, wasm::ValueType type) {
-  switch (type) {
-    case wasm::kWasmI32:
-      return BuildChangeInt32ToTagged(node);
-    case wasm::kWasmS128:
-    case wasm::kWasmI64:
-      UNREACHABLE();
-    case wasm::kWasmF32:
-      node = graph()->NewNode(jsgraph()->machine()->ChangeFloat32ToFloat64(),
-                              node);
-      return BuildChangeFloat64ToTagged(node);
-    case wasm::kWasmF64:
-      return BuildChangeFloat64ToTagged(node);
-    case wasm::kWasmAnyRef:
-      return node;
-    case wasm::kWasmStmt:
-      return jsgraph()->UndefinedConstant();
-    default:
-      UNREACHABLE();
-  }
-}
-
-Node* WasmGraphBuilder::BuildJavaScriptToNumber(Node* node, Node* js_context) {
-  Callable callable =
-      Builtins::CallableFor(jsgraph()->isolate(), Builtins::kToNumber);
-  auto call_descriptor = Linkage::GetStubCallDescriptor(
-      jsgraph()->isolate(), jsgraph()->zone(), callable.descriptor(), 0,
-      CallDescriptor::kNoFlags, Operator::kNoProperties);
-  Node* stub_code = jsgraph()->HeapConstant(callable.code());
-
-  Node* result =
-      graph()->NewNode(jsgraph()->common()->Call(call_descriptor), stub_code,
-                       node, js_context, *effect_, *control_);
-
-  SetSourcePosition(result, 1);
-
-  *effect_ = result;
-
-  return result;
-}
-
 bool CanCover(Node* value, IrOpcode::Value opcode) {
   if (value->opcode() != opcode) return false;
   bool first = true;
@@ -2888,574 +2768,36 @@ bool CanCover(Node* value, IrOpcode::Value opcode) {
   return true;
 }
 
-Node* WasmGraphBuilder::BuildChangeTaggedToFloat64(Node* value) {
-  MachineOperatorBuilder* machine = jsgraph()->machine();
-  CommonOperatorBuilder* common = jsgraph()->common();
-
-  Node* check = BuildTestNotSmi(value);
-  Node* branch = graph()->NewNode(common->Branch(BranchHint::kFalse), check,
-                                  graph()->start());
-
-  Node* if_not_smi = graph()->NewNode(common->IfTrue(), branch);
-
-  Node* vnot_smi;
-  Node* check_undefined = graph()->NewNode(machine->WordEqual(), value,
-                                           jsgraph()->UndefinedConstant());
-  Node* branch_undefined = graph()->NewNode(common->Branch(BranchHint::kFalse),
-                                            check_undefined, if_not_smi);
-
-  Node* if_undefined = graph()->NewNode(common->IfTrue(), branch_undefined);
-  Node* vundefined =
-      jsgraph()->Float64Constant(std::numeric_limits<double>::quiet_NaN());
-
-  Node* if_not_undefined =
-      graph()->NewNode(common->IfFalse(), branch_undefined);
-  Node* vheap_number = BuildLoadHeapNumberValue(value, if_not_undefined);
-
-  if_not_smi =
-      graph()->NewNode(common->Merge(2), if_undefined, if_not_undefined);
-  vnot_smi = graph()->NewNode(common->Phi(MachineRepresentation::kFloat64, 2),
-                              vundefined, vheap_number, if_not_smi);
-
-  Node* if_smi = graph()->NewNode(common->IfFalse(), branch);
-  Node* vfrom_smi = BuildChangeSmiToFloat64(value);
-
-  Node* merge = graph()->NewNode(common->Merge(2), if_not_smi, if_smi);
-  Node* phi = graph()->NewNode(common->Phi(MachineRepresentation::kFloat64, 2),
-                               vnot_smi, vfrom_smi, merge);
-
-  return phi;
-}
-
-Node* WasmGraphBuilder::FromJS(Node* node, Node* js_context,
-                               wasm::ValueType type) {
-  DCHECK_NE(wasm::kWasmStmt, type);
-
-  // The parameter is of type AnyRef, we take it as is.
-  if (type == wasm::kWasmAnyRef) {
-    return node;
-  }
-
-  // Do a JavaScript ToNumber.
-  Node* num = BuildJavaScriptToNumber(node, js_context);
-
-  // Change representation.
-  SimplifiedOperatorBuilder simplified(jsgraph()->zone());
-  num = BuildChangeTaggedToFloat64(num);
-
-  switch (type) {
-    case wasm::kWasmI32: {
-      num = graph()->NewNode(jsgraph()->machine()->TruncateFloat64ToWord32(),
-                             num);
-      break;
-    }
-    case wasm::kWasmS128:
-    case wasm::kWasmI64:
-      UNREACHABLE();
-    case wasm::kWasmF32:
-      num = graph()->NewNode(jsgraph()->machine()->TruncateFloat64ToFloat32(),
-                             num);
-      break;
-    case wasm::kWasmF64:
-      break;
-    default:
-      UNREACHABLE();
+Node* WasmGraphBuilder::BuildChangeInt32ToIntPtr(Node* value) {
+  if (mcgraph()->machine()->Is64()) {
+    value = graph()->NewNode(mcgraph()->machine()->ChangeInt32ToInt64(), value);
   }
-  return num;
+  return value;
 }
 
 Node* WasmGraphBuilder::BuildChangeInt32ToSmi(Node* value) {
-  if (jsgraph()->machine()->Is64()) {
-    value = graph()->NewNode(jsgraph()->machine()->ChangeInt32ToInt64(), value);
-  }
-  return graph()->NewNode(jsgraph()->machine()->WordShl(), value,
+  value = BuildChangeInt32ToIntPtr(value);
+  return graph()->NewNode(mcgraph()->machine()->WordShl(), value,
                           BuildSmiShiftBitsConstant());
 }
 
-Node* WasmGraphBuilder::BuildChangeSmiToInt32(Node* value) {
-  value = graph()->NewNode(jsgraph()->machine()->WordSar(), value,
-                           BuildSmiShiftBitsConstant());
-  if (jsgraph()->machine()->Is64()) {
-    value =
-        graph()->NewNode(jsgraph()->machine()->TruncateInt64ToInt32(), value);
-  }
-  return value;
-}
-
-Node* WasmGraphBuilder::BuildChangeUint32ToSmi(Node* value) {
-  return graph()->NewNode(jsgraph()->machine()->WordShl(),
+Node* WasmGraphBuilder::BuildChangeUint31ToSmi(Node* value) {
+  return graph()->NewNode(mcgraph()->machine()->WordShl(),
                           Uint32ToUintptr(value), BuildSmiShiftBitsConstant());
 }
 
-Node* WasmGraphBuilder::BuildChangeSmiToFloat64(Node* value) {
-  return graph()->NewNode(jsgraph()->machine()->ChangeInt32ToFloat64(),
-                          BuildChangeSmiToInt32(value));
-}
-
-Node* WasmGraphBuilder::BuildTestNotSmi(Node* value) {
-  STATIC_ASSERT(kSmiTag == 0);
-  STATIC_ASSERT(kSmiTagMask == 1);
-  return graph()->NewNode(jsgraph()->machine()->WordAnd(), value,
-                          jsgraph()->IntPtrConstant(kSmiTagMask));
-}
-
 Node* WasmGraphBuilder::BuildSmiShiftBitsConstant() {
-  return jsgraph()->IntPtrConstant(kSmiShiftSize + kSmiTagSize);
-}
-
-Node* WasmGraphBuilder::BuildAllocateHeapNumberWithValue(Node* value,
-                                                         Node* control) {
-  MachineOperatorBuilder* machine = jsgraph()->machine();
-  CommonOperatorBuilder* common = jsgraph()->common();
-  // The AllocateHeapNumber builtin does not use the js_context, so we can
-  // safely pass in Smi zero here.
-  Callable callable = Builtins::CallableFor(jsgraph()->isolate(),
-                                            Builtins::kAllocateHeapNumber);
-  Node* target = jsgraph()->HeapConstant(callable.code());
-  Node* js_context = jsgraph()->NoContextConstant();
-  Node* effect =
-      graph()->NewNode(common->BeginRegion(RegionObservability::kNotObservable),
-                       graph()->start());
-  if (!allocate_heap_number_operator_.is_set()) {
-    auto call_descriptor = Linkage::GetStubCallDescriptor(
-        jsgraph()->isolate(), jsgraph()->zone(), callable.descriptor(), 0,
-        CallDescriptor::kNoFlags, Operator::kNoThrow);
-    allocate_heap_number_operator_.set(common->Call(call_descriptor));
-  }
-  Node* heap_number = graph()->NewNode(allocate_heap_number_operator_.get(),
-                                       target, js_context, effect, control);
-  Node* store =
-      graph()->NewNode(machine->Store(StoreRepresentation(
-                           MachineRepresentation::kFloat64, kNoWriteBarrier)),
-                       heap_number, BuildHeapNumberValueIndexConstant(), value,
-                       heap_number, control);
-  return graph()->NewNode(common->FinishRegion(), heap_number, store);
-}
-
-Node* WasmGraphBuilder::BuildLoadHeapNumberValue(Node* value, Node* control) {
-  return graph()->NewNode(jsgraph()->machine()->Load(MachineType::Float64()),
-                          value, BuildHeapNumberValueIndexConstant(),
-                          graph()->start(), control);
-}
-
-Node* WasmGraphBuilder::BuildHeapNumberValueIndexConstant() {
-  return jsgraph()->IntPtrConstant(HeapNumber::kValueOffset - kHeapObjectTag);
-}
-
-void WasmGraphBuilder::BuildJSToWasmWrapper(Handle<WeakCell> weak_instance,
-                                            wasm::WasmCode* wasm_code) {
-  const int wasm_count = static_cast<int>(sig_->parameter_count());
-  const int count =
-      wasm_count + 4;  // wasm_code, instance_node, effect, and control.
-  Node** args = Buffer(count);
-
-  // Build the start and the JS parameter nodes.
-  Node* start = Start(wasm_count + 5);
-  *control_ = start;
-  *effect_ = start;
-
-  // Create the js_context parameter
-  Node* js_context = graph()->NewNode(
-      jsgraph()->common()->Parameter(
-          Linkage::GetJSCallContextParamIndex(wasm_count + 1), "%context"),
-      graph()->start());
-
-  // Create the instance_node node to pass as parameter. This is either
-  // an actual reference to an instance or a placeholder reference,
-  // since JSToWasm wrappers can be compiled at module compile time and
-  // patched at instance build time.
-  DCHECK_NULL(instance_node_);
-  // TODO(titzer): JSToWasmWrappers should load the instance from the
-  // incoming JSFunction, but this is currently too slow/too complex because
-  // we use a regular JS property with a private symbol.
-  instance_node_ = graph()->NewNode(
-      jsgraph()->machine()->Load(MachineType::TaggedPointer()),
-      jsgraph()->HeapConstant(weak_instance),
-      jsgraph()->Int32Constant(WeakCell::kValueOffset - kHeapObjectTag),
-      *effect_, *control_);
-
-  Address instr_start =
-      wasm_code == nullptr ? nullptr : wasm_code->instructions().start();
-  Node* wasm_code_node = jsgraph()->RelocatableIntPtrConstant(
-      reinterpret_cast<intptr_t>(instr_start), RelocInfo::JS_TO_WASM_CALL);
-  if (!wasm::IsJSCompatibleSignature(sig_)) {
-    // Throw a TypeError. Use the js_context of the calling javascript function
-    // (passed as a parameter), such that the generated code is js_context
-    // independent.
-    BuildCallToRuntimeWithContext(Runtime::kWasmThrowTypeError, js_context,
-                                  nullptr, 0);
-
-    // TODO(titzer): remove the below weird special case.
-    // Add a dummy call to the wasm function so that the generated wrapper
-    // contains a reference to the wrapped wasm function. Without this reference
-    // the wasm function could not be re-imported into another wasm module.
-    int pos = 0;
-    args[pos++] = wasm_code_node;
-    args[pos++] = instance_node_.get();
-    args[pos++] = *effect_;
-    args[pos++] = *control_;
-
-    // We only need a dummy call descriptor.
-    wasm::FunctionSig::Builder dummy_sig_builder(jsgraph()->zone(), 0, 0);
-    auto call_descriptor =
-        GetWasmCallDescriptor(jsgraph()->zone(), dummy_sig_builder.Build());
-    *effect_ =
-        graph()->NewNode(jsgraph()->common()->Call(call_descriptor), pos, args);
-    Return(jsgraph()->UndefinedConstant());
-    return;
-  }
-
-  int pos = 0;
-  args[pos++] = wasm_code_node;
-  args[pos++] = instance_node_.get();
-
-  // Convert JS parameters to wasm numbers.
-  for (int i = 0; i < wasm_count; ++i) {
-    Node* param = Param(i + 1);
-    Node* wasm_param = FromJS(param, js_context, sig_->GetParam(i));
-    args[pos++] = wasm_param;
-  }
-
-  // Set the ThreadInWasm flag before we do the actual call.
-  BuildModifyThreadInWasmFlag(true);
-
-  args[pos++] = *effect_;
-  args[pos++] = *control_;
-
-  // Call the wasm code.
-  auto call_descriptor = GetWasmCallDescriptor(jsgraph()->zone(), sig_);
-
-  Node* call =
-      graph()->NewNode(jsgraph()->common()->Call(call_descriptor), count, args);
-  *effect_ = call;
-
-  // Clear the ThreadInWasmFlag
-  BuildModifyThreadInWasmFlag(false);
-
-  Node* retval = call;
-  Node* jsval = ToJS(
-      retval, sig_->return_count() == 0 ? wasm::kWasmStmt : sig_->GetReturn());
-  Return(jsval);
-}
-
-int WasmGraphBuilder::AddParameterNodes(Node** args, int pos, int param_count,
-                                        wasm::FunctionSig* sig) {
-  // Convert wasm numbers to JS values.
-  for (int i = 0; i < param_count; ++i) {
-    Node* param =
-        Param(i + 1);  // Start from index 1 to drop the instance_node.
-    args[pos++] = ToJS(param, sig->GetParam(i));
-  }
-  return pos;
-}
-
-bool WasmGraphBuilder::BuildWasmToJSWrapper(Handle<JSReceiver> target,
-                                            int index) {
-  DCHECK(target->IsCallable());
-
-  int wasm_count = static_cast<int>(sig_->parameter_count());
-
-  // Build the start and the parameter nodes.
-  Isolate* isolate = jsgraph()->isolate();
-  CallDescriptor* call_descriptor;
-  Node* start = Start(wasm_count + 3);
-  *effect_ = start;
-  *control_ = start;
-
-  instance_node_.set(Param(compiler::kWasmInstanceParameterIndex));
-  Node* callables_node = LOAD_INSTANCE_FIELD(ImportedFunctionCallables,
-                                             MachineType::TaggedPointer());
-  Node* callable_node = LOAD_FIXED_ARRAY_SLOT(callables_node, index);
-  Node* undefined_node =
-      jsgraph()->Constant(handle(isolate->heap()->undefined_value(), isolate));
-
-  Node* compiled_module =
-      LOAD_INSTANCE_FIELD(CompiledModule, MachineType::TaggedPointer());
-  // TODO(wasm): native context is only weak because of recycling compiled
-  // modules.
-  Node* weak_native_context = graph()->NewNode(
-      jsgraph()->machine()->Load(MachineType::TaggedPointer()), compiled_module,
-      jsgraph()->Int32Constant(WasmCompiledModule::kNativeContextOffset -
-                               kHeapObjectTag),
-      *effect_, *control_);
-  Node* native_context = graph()->NewNode(
-      jsgraph()->machine()->Load(MachineType::TaggedPointer()),
-      weak_native_context,
-      jsgraph()->Int32Constant(WeakCell::kValueOffset - kHeapObjectTag),
-      *effect_, *control_);
-
-  if (!wasm::IsJSCompatibleSignature(sig_)) {
-    // Throw a TypeError.
-    BuildCallToRuntimeWithContext(Runtime::kWasmThrowTypeError, native_context,
-                                  nullptr, 0);
-    // We don't need to return a value here, as the runtime call will not return
-    // anyway (the c entry stub will trigger stack unwinding).
-    ReturnVoid();
-    return false;
-  }
-
-  Node** args = Buffer(wasm_count + 9);
-  Node* call = nullptr;
-
-  BuildModifyThreadInWasmFlag(false);
-
-  if (target->IsJSFunction()) {
-    Handle<JSFunction> function = Handle<JSFunction>::cast(target);
-    FieldAccess field_access = AccessBuilder::ForJSFunctionContext();
-    Node* function_context = graph()->NewNode(
-        jsgraph()->machine()->Load(MachineType::TaggedPointer()), callable_node,
-        jsgraph()->Int32Constant(field_access.offset - field_access.tag()),
-        *effect_, *control_);
-
-    if (!IsClassConstructor(function->shared()->kind())) {
-      if (function->shared()->internal_formal_parameter_count() == wasm_count) {
-        int pos = 0;
-        args[pos++] = callable_node;  // target callable.
-        // Receiver.
-        if (is_sloppy(function->shared()->language_mode()) &&
-            !function->shared()->native()) {
-          Node* global_proxy = LOAD_FIXED_ARRAY_SLOT(
-              native_context, Context::GLOBAL_PROXY_INDEX);
-          args[pos++] = global_proxy;
-        } else {
-          args[pos++] = undefined_node;
-        }
-
-        call_descriptor = Linkage::GetJSCallDescriptor(
-            graph()->zone(), false, wasm_count + 1, CallDescriptor::kNoFlags);
-
-        // Convert wasm numbers to JS values.
-        pos = AddParameterNodes(args, pos, wasm_count, sig_);
-
-        args[pos++] = undefined_node;                        // new target
-        args[pos++] = jsgraph()->Int32Constant(wasm_count);  // argument count
-        args[pos++] = function_context;
-        args[pos++] = *effect_;
-        args[pos++] = *control_;
-
-        call = graph()->NewNode(jsgraph()->common()->Call(call_descriptor), pos,
-                                args);
-      } else if (function->shared()->internal_formal_parameter_count() >= 0) {
-        Callable callable = CodeFactory::ArgumentAdaptor(isolate);
-        int pos = 0;
-        args[pos++] = jsgraph()->HeapConstant(callable.code());
-        args[pos++] = callable_node;                         // target callable
-        args[pos++] = undefined_node;                        // new target
-        args[pos++] = jsgraph()->Int32Constant(wasm_count);  // argument count
-        args[pos++] = jsgraph()->Int32Constant(
-            function->shared()->internal_formal_parameter_count());
-        // Receiver.
-        if (is_sloppy(function->shared()->language_mode()) &&
-            !function->shared()->native()) {
-          Node* global_proxy = LOAD_FIXED_ARRAY_SLOT(
-              native_context, Context::GLOBAL_PROXY_INDEX);
-          args[pos++] = global_proxy;
-        } else {
-          args[pos++] = undefined_node;
-        }
-
-        // Convert wasm numbers to JS values.
-        pos = AddParameterNodes(args, pos, wasm_count, sig_);
-        args[pos++] = function_context;
-        args[pos++] = *effect_;
-        args[pos++] = *control_;
-        call = graph()->NewNode(
-            jsgraph()->common()->Call(Linkage::GetStubCallDescriptor(
-                isolate, jsgraph()->zone(), callable.descriptor(),
-                1 + wasm_count, CallDescriptor::kNoFlags)),
-            pos, args);
-      }
-    }
-  }
-
-  // We cannot call the target directly, we have to use the Call builtin.
-  if (!call) {
-    int pos = 0;
-    // We cannot call the target directly, we have to use the Call builtin.
-    Callable callable = CodeFactory::Call(isolate);
-    args[pos++] = jsgraph()->HeapConstant(callable.code());
-    args[pos++] = callable_node;
-    args[pos++] = jsgraph()->Int32Constant(wasm_count);  // argument count
-    args[pos++] = undefined_node;                        // receiver
-
-    call_descriptor = Linkage::GetStubCallDescriptor(
-        isolate, graph()->zone(), callable.descriptor(), wasm_count + 1,
-        CallDescriptor::kNoFlags);
-
-    // Convert wasm numbers to JS values.
-    pos = AddParameterNodes(args, pos, wasm_count, sig_);
-
-    // The native_context is sufficient here, because all kind of callables
-    // which depend on the context provide their own context. The context here
-    // is only needed if the target is a constructor to throw a TypeError, if
-    // the target is a native function, or if the target is a callable JSObject,
-    // which can only be constructed by the runtime.
-    args[pos++] = native_context;
-    args[pos++] = *effect_;
-    args[pos++] = *control_;
-
-    call =
-        graph()->NewNode(jsgraph()->common()->Call(call_descriptor), pos, args);
-  }
-
-  *effect_ = call;
-  SetSourcePosition(call, 0);
-
-  // Convert the return value back.
-  Node* val = sig_->return_count() == 0
-                  ? jsgraph()->Int32Constant(0)
-                  : FromJS(call, native_context, sig_->GetReturn());
-
-  BuildModifyThreadInWasmFlag(true);
-
-  Return(val);
-  return true;
-}
-
-namespace {
-bool HasInt64ParamOrReturn(wasm::FunctionSig* sig) {
-  for (auto type : sig->all()) {
-    if (type == wasm::kWasmI64) return true;
-  }
-  return false;
+  return mcgraph()->IntPtrConstant(kSmiShiftSize + kSmiTagSize);
 }
-}  // namespace
-
-void WasmGraphBuilder::BuildWasmInterpreterEntry(uint32_t func_index) {
-  int param_count = static_cast<int>(sig_->parameter_count());
-
-  // Build the start and the parameter nodes.
-  Node* start = Start(param_count + 3);
-  *effect_ = start;
-  *control_ = start;
-
-  // Compute size for the argument buffer.
-  int args_size_bytes = 0;
-  for (wasm::ValueType type : sig_->parameters()) {
-    args_size_bytes += 1 << ElementSizeLog2Of(type);
-  }
-
-  // The return value is also passed via this buffer:
-  DCHECK_GE(wasm::kV8MaxWasmFunctionReturns, sig_->return_count());
-  // TODO(wasm): Handle multi-value returns.
-  DCHECK_EQ(1, wasm::kV8MaxWasmFunctionReturns);
-  int return_size_bytes =
-      sig_->return_count() == 0 ? 0 : 1 << ElementSizeLog2Of(sig_->GetReturn());
-
-  // Get a stack slot for the arguments.
-  Node* arg_buffer =
-      args_size_bytes == 0 && return_size_bytes == 0
-          ? jsgraph()->IntPtrConstant(0)
-          : graph()->NewNode(jsgraph()->machine()->StackSlot(
-                std::max(args_size_bytes, return_size_bytes), 8));
-
-  // Now store all our arguments to the buffer.
-  int offset = 0;
-
-  for (int i = 0; i < param_count; ++i) {
-    wasm::ValueType type = sig_->GetParam(i);
-    // Start from the parameter with index 1 to drop the instance_node.
-    *effect_ = graph()->NewNode(GetSafeStoreOperator(offset, type), arg_buffer,
-                                Int32Constant(offset), Param(i + 1), *effect_,
-                                *control_);
-    offset += 1 << ElementSizeLog2Of(type);
-  }
-  DCHECK_EQ(args_size_bytes, offset);
-
-  // We are passing the raw arg_buffer here. To the GC and other parts, it looks
-  // like a Smi (lowest bit not set). In the runtime function however, don't
-  // call Smi::value on it, but just cast it to a byte pointer.
-  Node* parameters[] = {
-      jsgraph()->SmiConstant(func_index),  // function index
-      arg_buffer,                          // argument buffer
-  };
-  BuildCallToRuntime(Runtime::kWasmRunInterpreter, parameters,
-                     arraysize(parameters));
-
-  // Read back the return value.
-  if (sig_->return_count() == 0) {
-    Return(Int32Constant(0));
-  } else {
-    // TODO(wasm): Implement multi-return.
-    DCHECK_EQ(1, sig_->return_count());
-    MachineType load_rep = wasm::WasmOpcodes::MachineTypeFor(sig_->GetReturn());
-    Node* val =
-        graph()->NewNode(jsgraph()->machine()->Load(load_rep), arg_buffer,
-                         Int32Constant(0), *effect_, *control_);
-    Return(val);
-  }
-
-  if (HasInt64ParamOrReturn(sig_)) LowerInt64();
-}
-
-void WasmGraphBuilder::BuildCWasmEntry() {
-  // Build the start and the JS parameter nodes.
-  Node* start = Start(CWasmEntryParameters::kNumParameters + 5);
-  *control_ = start;
-  *effect_ = start;
-
-  // Create parameter nodes (offset by 1 for the receiver parameter).
-  Node* foreign_code_obj = Param(CWasmEntryParameters::kCodeObject + 1);
-  MachineOperatorBuilder* machine = jsgraph()->machine();
-  Node* code_obj = graph()->NewNode(
-      machine->Load(MachineType::Pointer()), foreign_code_obj,
-      Int32Constant(Foreign::kForeignAddressOffset - kHeapObjectTag), *effect_,
-      *control_);
-  Node* instance_node = Param(CWasmEntryParameters::kWasmInstance + 1);
-  Node* arg_buffer = Param(CWasmEntryParameters::kArgumentsBuffer + 1);
-
-  int wasm_arg_count = static_cast<int>(sig_->parameter_count());
-  int arg_count = wasm_arg_count + 4;  // code, instance_node, control, effect
-  Node** args = Buffer(arg_count);
-
-  int pos = 0;
-  args[pos++] = code_obj;
-  args[pos++] = instance_node;
 
-  int offset = 0;
-  for (wasm::ValueType type : sig_->parameters()) {
-    Node* arg_load =
-        graph()->NewNode(GetSafeLoadOperator(offset, type), arg_buffer,
-                         Int32Constant(offset), *effect_, *control_);
-    *effect_ = arg_load;
-    args[pos++] = arg_load;
-    offset += 1 << ElementSizeLog2Of(type);
-  }
-
-  args[pos++] = *effect_;
-  args[pos++] = *control_;
-  DCHECK_EQ(arg_count, pos);
-
-  // Call the wasm code.
-  auto call_descriptor = GetWasmCallDescriptor(jsgraph()->zone(), sig_);
-
-  Node* call = graph()->NewNode(jsgraph()->common()->Call(call_descriptor),
-                                arg_count, args);
-  *effect_ = call;
-
-  // Store the return value.
-  DCHECK_GE(1, sig_->return_count());
-  if (sig_->return_count() == 1) {
-    StoreRepresentation store_rep(sig_->GetReturn(), kNoWriteBarrier);
-    Node* store =
-        graph()->NewNode(jsgraph()->machine()->Store(store_rep), arg_buffer,
-                         Int32Constant(0), call, *effect_, *control_);
-    *effect_ = store;
-  }
-  Return(jsgraph()->SmiConstant(0));
-
-  if (jsgraph()->machine()->Is32() && HasInt64ParamOrReturn(sig_)) {
-    MachineRepresentation sig_reps[] = {
-        MachineRepresentation::kWord32,  // return value
-        MachineRepresentation::kTagged,  // receiver
-        MachineRepresentation::kTagged,  // arg0 (code)
-        MachineRepresentation::kTagged   // arg1 (buffer)
-    };
-    wasm::FunctionSig c_entry_sig(1, 2, sig_reps);
-    Int64Lowering r(jsgraph()->graph(), jsgraph()->machine(),
-                    jsgraph()->common(), jsgraph()->zone(), &c_entry_sig);
-    r.LowerGraph();
+Node* WasmGraphBuilder::BuildChangeSmiToInt32(Node* value) {
+  value = graph()->NewNode(mcgraph()->machine()->WordSar(), value,
+                           BuildSmiShiftBitsConstant());
+  if (mcgraph()->machine()->Is64()) {
+    value =
+        graph()->NewNode(mcgraph()->machine()->TruncateInt64ToInt32(), value);
   }
+  return value;
 }
 
 void WasmGraphBuilder::InitInstanceCache(
@@ -3466,16 +2808,16 @@ void WasmGraphBuilder::InitInstanceCache(
 
   // Load the memory start.
   Node* mem_start = graph()->NewNode(
-      jsgraph()->machine()->Load(MachineType::UintPtr()), instance_node_.get(),
-      jsgraph()->Int32Constant(WASM_INSTANCE_OBJECT_OFFSET(MemoryStart)),
+      mcgraph()->machine()->Load(MachineType::UintPtr()), instance_node_.get(),
+      mcgraph()->Int32Constant(WASM_INSTANCE_OBJECT_OFFSET(MemoryStart)),
       *effect_, *control_);
   *effect_ = mem_start;
   instance_cache->mem_start = mem_start;
 
   // Load the memory size.
   Node* mem_size = graph()->NewNode(
-      jsgraph()->machine()->Load(MachineType::Uint32()), instance_node_.get(),
-      jsgraph()->Int32Constant(WASM_INSTANCE_OBJECT_OFFSET(MemorySize)),
+      mcgraph()->machine()->Load(MachineType::Uint32()), instance_node_.get(),
+      mcgraph()->Int32Constant(WASM_INSTANCE_OBJECT_OFFSET(MemorySize)),
       *effect_, *control_);
   *effect_ = mem_size;
   instance_cache->mem_size = mem_size;
@@ -3483,8 +2825,8 @@ void WasmGraphBuilder::InitInstanceCache(
   if (untrusted_code_mitigations_) {
     // Load the memory mask.
     Node* mem_mask = graph()->NewNode(
-        jsgraph()->machine()->Load(MachineType::Uint32()), instance_node_.get(),
-        jsgraph()->Int32Constant(WASM_INSTANCE_OBJECT_OFFSET(MemoryMask)),
+        mcgraph()->machine()->Load(MachineType::Uint32()), instance_node_.get(),
+        mcgraph()->Int32Constant(WASM_INSTANCE_OBJECT_OFFSET(MemoryMask)),
         *effect_, *control_);
     *effect_ = mem_mask;
     instance_cache->mem_mask = mem_mask;
@@ -3496,8 +2838,9 @@ void WasmGraphBuilder::InitInstanceCache(
 
 void WasmGraphBuilder::PrepareInstanceCacheForLoop(
     WasmInstanceCacheNodes* instance_cache, Node* control) {
-#define INTRODUCE_PHI(field, rep) \
-  instance_cache->field = Phi(rep, 1, &instance_cache->field, control);
+#define INTRODUCE_PHI(field, rep)                                            \
+  instance_cache->field = graph()->NewNode(mcgraph()->common()->Phi(rep, 1), \
+                                           instance_cache->field, control);
 
   INTRODUCE_PHI(mem_start, MachineType::PointerRepresentation());
   INTRODUCE_PHI(mem_size, MachineRepresentation::kWord32);
@@ -3511,10 +2854,10 @@ void WasmGraphBuilder::PrepareInstanceCacheForLoop(
 void WasmGraphBuilder::NewInstanceCacheMerge(WasmInstanceCacheNodes* to,
                                              WasmInstanceCacheNodes* from,
                                              Node* merge) {
-#define INTRODUCE_PHI(field, rep)            \
-  if (to->field != from->field) {            \
-    Node* vals[] = {to->field, from->field}; \
-    to->field = Phi(rep, 2, vals, merge);    \
+#define INTRODUCE_PHI(field, rep)                                            \
+  if (to->field != from->field) {                                            \
+    Node* vals[] = {to->field, from->field, merge};                          \
+    to->field = graph()->NewNode(mcgraph()->common()->Phi(rep, 2), 3, vals); \
   }
 
   INTRODUCE_PHI(mem_start, MachineType::PointerRepresentation());
@@ -3539,16 +2882,20 @@ void WasmGraphBuilder::MergeInstanceCacheInto(WasmInstanceCacheNodes* to,
   }
 }
 
-Node* WasmGraphBuilder::CreateOrMergeIntoPhi(wasm::ValueType type, Node* merge,
-                                             Node* tnode, Node* fnode) {
+Node* WasmGraphBuilder::CreateOrMergeIntoPhi(MachineRepresentation rep,
+                                             Node* merge, Node* tnode,
+                                             Node* fnode) {
   if (IsPhiWithMerge(tnode, merge)) {
     AppendToPhi(tnode, fnode);
   } else if (tnode != fnode) {
     uint32_t count = merge->InputCount();
-    Node** vals = Buffer(count);
+    // + 1 for the merge node.
+    Node** vals = Buffer(count + 1);
     for (uint32_t j = 0; j < count - 1; j++) vals[j] = tnode;
     vals[count - 1] = fnode;
-    return Phi(type, count, vals, merge);
+    vals[count] = merge;
+    return graph()->NewNode(mcgraph()->common()->Phi(rep, count), count + 1,
+                            vals);
   }
   return tnode;
 }
@@ -3570,35 +2917,54 @@ Node* WasmGraphBuilder::CreateOrMergeIntoEffectPhi(Node* merge, Node* tnode,
 }
 
 void WasmGraphBuilder::GetGlobalBaseAndOffset(MachineType mem_type,
-                                              uint32_t offset, Node** base_node,
+                                              const wasm::WasmGlobal& global,
+                                              Node** base_node,
                                               Node** offset_node) {
   DCHECK_NOT_NULL(instance_node_);
-  if (globals_start_ == nullptr) {
-    // Load globals_start from the instance object at runtime.
-    // TODO(wasm): we currently generate only one load of the {globals_start}
-    // start per graph, which means it can be placed anywhere by the scheduler.
-    // This is legal because the globals_start should never change.
-    // However, in some cases (e.g. if the instance object is already in a
-    // register), it is slightly more efficient to reload this value from the
-    // instance object. Since this depends on register allocation, it is not
-    // possible to express in the graph, and would essentially constitute a
-    // "mem2reg" optimization in TurboFan.
-    globals_start_ = graph()->NewNode(
-        jsgraph()->machine()->Load(MachineType::UintPtr()),
-        instance_node_.get(),
-        jsgraph()->Int32Constant(WASM_INSTANCE_OBJECT_OFFSET(GlobalsStart)),
-        graph()->start(), graph()->start());
-  }
-  *base_node = globals_start_.get();
-  *offset_node = jsgraph()->Int32Constant(offset);
-
-  if (mem_type == MachineType::Simd128() && offset != 0) {
-    // TODO(titzer,bbudge): code generation for SIMD memory offsets is broken.
-    *base_node =
-        graph()->NewNode(kPointerSize == 4 ? jsgraph()->machine()->Int32Add()
-                                           : jsgraph()->machine()->Int64Add(),
-                         *base_node, *offset_node);
-    *offset_node = jsgraph()->Int32Constant(0);
+  if (global.mutability && global.imported) {
+    DCHECK(FLAG_experimental_wasm_mut_global);
+    if (imported_mutable_globals_ == nullptr) {
+      // Load imported_mutable_globals_ from the instance object at runtime.
+      imported_mutable_globals_ = graph()->NewNode(
+          mcgraph()->machine()->Load(MachineType::UintPtr()),
+          instance_node_.get(),
+          mcgraph()->Int32Constant(
+              WASM_INSTANCE_OBJECT_OFFSET(ImportedMutableGlobals)),
+          graph()->start(), graph()->start());
+    }
+    *base_node = graph()->NewNode(
+        mcgraph()->machine()->Load(MachineType::UintPtr()),
+        imported_mutable_globals_.get(),
+        mcgraph()->Int32Constant(global.index * sizeof(Address)), *effect_,
+        *control_);
+    *offset_node = mcgraph()->Int32Constant(0);
+    *effect_ = *base_node;
+  } else {
+    if (globals_start_ == nullptr) {
+      // Load globals_start from the instance object at runtime.
+      // TODO(wasm): we currently generate only one load of the {globals_start}
+      // start per graph, which means it can be placed anywhere by the
+      // scheduler. This is legal because the globals_start should never change.
+      // However, in some cases (e.g. if the instance object is already in a
+      // register), it is slightly more efficient to reload this value from the
+      // instance object. Since this depends on register allocation, it is not
+      // possible to express in the graph, and would essentially constitute a
+      // "mem2reg" optimization in TurboFan.
+      globals_start_ = graph()->NewNode(
+          mcgraph()->machine()->Load(MachineType::UintPtr()),
+          instance_node_.get(),
+          mcgraph()->Int32Constant(WASM_INSTANCE_OBJECT_OFFSET(GlobalsStart)),
+          graph()->start(), graph()->start());
+    }
+    *base_node = globals_start_.get();
+    *offset_node = mcgraph()->Int32Constant(global.offset);
+
+    if (mem_type == MachineType::Simd128() && global.offset != 0) {
+      // TODO(titzer,bbudge): code generation for SIMD memory offsets is broken.
+      *base_node = graph()->NewNode(mcgraph()->machine()->IntAdd(), *base_node,
+                                    *offset_node);
+      *offset_node = mcgraph()->Int32Constant(0);
+    }
   }
 }
 
@@ -3607,43 +2973,19 @@ Node* WasmGraphBuilder::MemBuffer(uint32_t offset) {
   Node* mem_start = instance_cache_->mem_start;
   DCHECK_NOT_NULL(mem_start);
   if (offset == 0) return mem_start;
-  return graph()->NewNode(jsgraph()->machine()->IntAdd(), mem_start,
-                          jsgraph()->IntPtrConstant(offset));
+  return graph()->NewNode(mcgraph()->machine()->IntAdd(), mem_start,
+                          mcgraph()->IntPtrConstant(offset));
 }
 
 Node* WasmGraphBuilder::CurrentMemoryPages() {
   // CurrentMemoryPages can not be called from asm.js.
-  DCHECK_EQ(wasm::kWasmOrigin, env_->module->origin());
+  DCHECK_EQ(wasm::kWasmOrigin, env_->module->origin);
   DCHECK_NOT_NULL(instance_cache_);
   Node* mem_size = instance_cache_->mem_size;
   DCHECK_NOT_NULL(mem_size);
-  if (jsgraph()->machine()->Is64()) {
-    mem_size = graph()->NewNode(jsgraph()->machine()->TruncateInt64ToInt32(),
-                                mem_size);
-  }
   return graph()->NewNode(
-      jsgraph()->machine()->Word32Shr(), mem_size,
-      jsgraph()->Int32Constant(WhichPowerOf2(wasm::kWasmPageSize)));
-}
-
-Node* WasmGraphBuilder::BuildModifyThreadInWasmFlag(bool new_value) {
-  // TODO(eholk): generate code to modify the thread-local storage directly,
-  // rather than calling the runtime.
-  if (!use_trap_handler()) {
-    return *control_;
-  }
-
-  // Using two functions instead of taking the new value as a parameter saves
-  // one instruction on each call to set up the parameter.
-  ExternalReference ref =
-      new_value ? ExternalReference::wasm_set_thread_in_wasm_flag(
-                      jsgraph()->isolate())
-                : ExternalReference::wasm_clear_thread_in_wasm_flag(
-                      jsgraph()->isolate());
-  MachineSignature::Builder sig_builder(jsgraph()->zone(), 0, 0);
-  return BuildCCall(
-      sig_builder.Build(),
-      graph()->NewNode(jsgraph()->common()->ExternalConstant(ref)));
+      mcgraph()->machine()->Word32Shr(), mem_size,
+      mcgraph()->Int32Constant(WhichPowerOf2(wasm::kWasmPageSize)));
 }
 
 // Only call this function for code which is not reused across instantiations,
@@ -3654,30 +2996,32 @@ Node* WasmGraphBuilder::BuildCallToRuntimeWithContext(Runtime::FunctionId f,
                                                       int parameter_count) {
   const Runtime::Function* fun = Runtime::FunctionForId(f);
   auto call_descriptor = Linkage::GetRuntimeCallDescriptor(
-      jsgraph()->zone(), f, fun->nargs, Operator::kNoProperties,
+      mcgraph()->zone(), f, fun->nargs, Operator::kNoProperties,
       CallDescriptor::kNoFlags);
-  // CEntryStubConstant nodes have to be created and cached in the main
-  // thread. At the moment this is only done for CEntryStubConstant(1).
+  // The CEntryStub is loaded from the instance_node so that generated code is
+  // Isolate independent. At the moment this is only done for CEntryStub(1).
   DCHECK_EQ(1, fun->result_size);
+  Node* centry_stub = *effect_ =
+      LOAD_INSTANCE_FIELD(CEntryStub, MachineType::TaggedPointer());
   // At the moment we only allow 4 parameters. If more parameters are needed,
   // increase this constant accordingly.
   static const int kMaxParams = 4;
   DCHECK_GE(kMaxParams, parameter_count);
   Node* inputs[kMaxParams + 6];
   int count = 0;
-  inputs[count++] = centry_stub_node_;
+  inputs[count++] = centry_stub;
   for (int i = 0; i < parameter_count; i++) {
     inputs[count++] = parameters[i];
   }
-  inputs[count++] = jsgraph()->ExternalConstant(
-      ExternalReference(f, jsgraph()->isolate()));         // ref
-  inputs[count++] = jsgraph()->Int32Constant(fun->nargs);  // arity
-  inputs[count++] = js_context;                            // js_context
+  inputs[count++] =
+      mcgraph()->ExternalConstant(ExternalReference::Create(f));  // ref
+  inputs[count++] = mcgraph()->Int32Constant(fun->nargs);         // arity
+  inputs[count++] = js_context;                                   // js_context
   inputs[count++] = *effect_;
   inputs[count++] = *control_;
 
-  Node* node = jsgraph()->graph()->NewNode(
-      jsgraph()->common()->Call(call_descriptor), count, inputs);
+  Node* node = mcgraph()->graph()->NewNode(
+      mcgraph()->common()->Call(call_descriptor), count, inputs);
   *effect_ = node;
 
   return node;
@@ -3686,18 +3030,18 @@ Node* WasmGraphBuilder::BuildCallToRuntimeWithContext(Runtime::FunctionId f,
 Node* WasmGraphBuilder::BuildCallToRuntime(Runtime::FunctionId f,
                                            Node** parameters,
                                            int parameter_count) {
-  return BuildCallToRuntimeWithContext(f, jsgraph()->NoContextConstant(),
-                                       parameters, parameter_count);
+  return BuildCallToRuntimeWithContext(f, NoContextConstant(), parameters,
+                                       parameter_count);
 }
 
 Node* WasmGraphBuilder::GetGlobal(uint32_t index) {
   MachineType mem_type =
-      wasm::WasmOpcodes::MachineTypeFor(env_->module->globals[index].type);
+      wasm::ValueTypes::MachineTypeFor(env_->module->globals[index].type);
   Node* base = nullptr;
   Node* offset = nullptr;
-  GetGlobalBaseAndOffset(mem_type, env_->module->globals[index].offset, &base,
+  GetGlobalBaseAndOffset(mem_type, env_->module->globals[index], &base,
                          &offset);
-  Node* node = graph()->NewNode(jsgraph()->machine()->Load(mem_type), base,
+  Node* node = graph()->NewNode(mcgraph()->machine()->Load(mem_type), base,
                                 offset, *effect_, *control_);
   *effect_ = node;
   return node;
@@ -3705,12 +3049,12 @@ Node* WasmGraphBuilder::GetGlobal(uint32_t index) {
 
 Node* WasmGraphBuilder::SetGlobal(uint32_t index, Node* val) {
   MachineType mem_type =
-      wasm::WasmOpcodes::MachineTypeFor(env_->module->globals[index].type);
+      wasm::ValueTypes::MachineTypeFor(env_->module->globals[index].type);
   Node* base = nullptr;
   Node* offset = nullptr;
-  GetGlobalBaseAndOffset(mem_type, env_->module->globals[index].offset, &base,
+  GetGlobalBaseAndOffset(mem_type, env_->module->globals[index], &base,
                          &offset);
-  const Operator* op = jsgraph()->machine()->Store(
+  const Operator* op = mcgraph()->machine()->Store(
       StoreRepresentation(mem_type.representation(), kNoWriteBarrier));
   Node* node = graph()->NewNode(op, base, offset, val, *effect_, *control_);
   *effect_ = node;
@@ -3726,7 +3070,7 @@ Node* WasmGraphBuilder::BoundsCheckMem(uint8_t access_size, Node* index,
   Node* mem_size = instance_cache_->mem_size;
   DCHECK_NOT_NULL(mem_size);
 
-  auto m = jsgraph()->machine();
+  auto m = mcgraph()->machine();
   if (use_trap_handler() && enforce_check == kCanOmitBoundsCheck) {
     // Simply zero out the 32-bits on 64-bit targets and let the trap handler
     // do its job.
@@ -3742,7 +3086,7 @@ Node* WasmGraphBuilder::BoundsCheckMem(uint8_t access_size, Node* index,
   if (access_size > max_size || offset > max_size - access_size) {
     // The access will be out of bounds, even for the largest memory.
     TrapIfEq32(wasm::kTrapMemOutOfBounds, Int32Constant(0), 0, position);
-    return jsgraph()->IntPtrConstant(0);
+    return mcgraph()->IntPtrConstant(0);
   }
   DCHECK_LE(1, access_size);
   // This computation cannot overflow, since
@@ -3764,7 +3108,7 @@ Node* WasmGraphBuilder::BoundsCheckMem(uint8_t access_size, Node* index,
     // The end offset is larger than the smallest memory.
     // Dynamically check the end offset against the actual memory size, which
     // is not known at compile time.
-    Node* cond = graph()->NewNode(jsgraph()->machine()->Uint32LessThan(),
+    Node* cond = graph()->NewNode(mcgraph()->machine()->Uint32LessThan(),
                                   end_offset_node, mem_size);
     TrapIfFalse(wasm::kTrapMemOutOfBounds, cond, position);
   } else {
@@ -3782,7 +3126,7 @@ Node* WasmGraphBuilder::BoundsCheckMem(uint8_t access_size, Node* index,
   }
 
   // This produces a positive number, since {end_offset < min_size <= mem_size}.
-  Node* effective_size = graph()->NewNode(jsgraph()->machine()->Int32Sub(),
+  Node* effective_size = graph()->NewNode(mcgraph()->machine()->Int32Sub(),
                                           mem_size, end_offset_node);
 
   // Introduce the actual bounds check.
@@ -3800,23 +3144,25 @@ Node* WasmGraphBuilder::BoundsCheckMem(uint8_t access_size, Node* index,
 
 const Operator* WasmGraphBuilder::GetSafeLoadOperator(int offset,
                                                       wasm::ValueType type) {
-  int alignment = offset % (1 << ElementSizeLog2Of(type));
-  MachineType mach_type = wasm::WasmOpcodes::MachineTypeFor(type);
-  if (alignment == 0 || jsgraph()->machine()->UnalignedLoadSupported(type)) {
-    return jsgraph()->machine()->Load(mach_type);
+  int alignment = offset % (wasm::ValueTypes::ElementSizeInBytes(type));
+  MachineType mach_type = wasm::ValueTypes::MachineTypeFor(type);
+  if (alignment == 0 || mcgraph()->machine()->UnalignedLoadSupported(
+                            wasm::ValueTypes::MachineRepresentationFor(type))) {
+    return mcgraph()->machine()->Load(mach_type);
   }
-  return jsgraph()->machine()->UnalignedLoad(mach_type);
+  return mcgraph()->machine()->UnalignedLoad(mach_type);
 }
 
 const Operator* WasmGraphBuilder::GetSafeStoreOperator(int offset,
                                                        wasm::ValueType type) {
-  int alignment = offset % (1 << ElementSizeLog2Of(type));
-  if (alignment == 0 || jsgraph()->machine()->UnalignedStoreSupported(type)) {
-    StoreRepresentation rep(type, WriteBarrierKind::kNoWriteBarrier);
-    return jsgraph()->machine()->Store(rep);
+  int alignment = offset % (wasm::ValueTypes::ElementSizeInBytes(type));
+  MachineRepresentation rep = wasm::ValueTypes::MachineRepresentationFor(type);
+  if (alignment == 0 || mcgraph()->machine()->UnalignedStoreSupported(rep)) {
+    StoreRepresentation store_rep(rep, WriteBarrierKind::kNoWriteBarrier);
+    return mcgraph()->machine()->Store(store_rep);
   }
-  UnalignedStoreRepresentation rep(type);
-  return jsgraph()->machine()->UnalignedStore(rep);
+  UnalignedStoreRepresentation store_rep(rep);
+  return mcgraph()->machine()->UnalignedStore(store_rep);
 }
 
 Node* WasmGraphBuilder::TraceMemoryOperation(bool is_store,
@@ -3825,24 +3171,24 @@ Node* WasmGraphBuilder::TraceMemoryOperation(bool is_store,
                                              wasm::WasmCodePosition position) {
   int kAlign = 4;  // Ensure that the LSB is 0, such that this looks like a Smi.
   Node* info = graph()->NewNode(
-      jsgraph()->machine()->StackSlot(sizeof(wasm::MemoryTracingInfo), kAlign));
+      mcgraph()->machine()->StackSlot(sizeof(wasm::MemoryTracingInfo), kAlign));
 
-  Node* address = graph()->NewNode(jsgraph()->machine()->Int32Add(),
+  Node* address = graph()->NewNode(mcgraph()->machine()->Int32Add(),
                                    Int32Constant(offset), index);
   auto store = [&](int offset, MachineRepresentation rep, Node* data) {
     *effect_ = graph()->NewNode(
-        jsgraph()->machine()->Store(StoreRepresentation(rep, kNoWriteBarrier)),
-        info, jsgraph()->Int32Constant(offset), data, *effect_, *control_);
+        mcgraph()->machine()->Store(StoreRepresentation(rep, kNoWriteBarrier)),
+        info, mcgraph()->Int32Constant(offset), data, *effect_, *control_);
   };
   // Store address, is_store, and mem_rep.
   store(offsetof(wasm::MemoryTracingInfo, address),
         MachineRepresentation::kWord32, address);
   store(offsetof(wasm::MemoryTracingInfo, is_store),
         MachineRepresentation::kWord8,
-        jsgraph()->Int32Constant(is_store ? 1 : 0));
+        mcgraph()->Int32Constant(is_store ? 1 : 0));
   store(offsetof(wasm::MemoryTracingInfo, mem_rep),
         MachineRepresentation::kWord8,
-        jsgraph()->Int32Constant(static_cast<int>(rep)));
+        mcgraph()->Int32Constant(static_cast<int>(rep)));
 
   Node* call = BuildCallToRuntime(Runtime::kWasmTraceMemory, &info, 1);
   SetSourcePosition(call, position);
@@ -3857,23 +3203,23 @@ Node* WasmGraphBuilder::LoadMem(wasm::ValueType type, MachineType memtype,
 
   // Wasm semantics throw on OOB. Introduce explicit bounds check and
   // conditioning when not using the trap handler.
-  index = BoundsCheckMem(wasm::WasmOpcodes::MemSize(memtype), index, offset,
+  index = BoundsCheckMem(wasm::ValueTypes::MemSize(memtype), index, offset,
                          position, kCanOmitBoundsCheck);
 
   if (memtype.representation() == MachineRepresentation::kWord8 ||
-      jsgraph()->machine()->UnalignedLoadSupported(memtype.representation())) {
+      mcgraph()->machine()->UnalignedLoadSupported(memtype.representation())) {
     if (use_trap_handler()) {
-      load = graph()->NewNode(jsgraph()->machine()->ProtectedLoad(memtype),
+      load = graph()->NewNode(mcgraph()->machine()->ProtectedLoad(memtype),
                               MemBuffer(offset), index, *effect_, *control_);
       SetSourcePosition(load, position);
     } else {
-      load = graph()->NewNode(jsgraph()->machine()->Load(memtype),
+      load = graph()->NewNode(mcgraph()->machine()->Load(memtype),
                               MemBuffer(offset), index, *effect_, *control_);
     }
   } else {
     // TODO(eholk): Support unaligned loads with trap handlers.
     DCHECK(!use_trap_handler());
-    load = graph()->NewNode(jsgraph()->machine()->UnalignedLoad(memtype),
+    load = graph()->NewNode(mcgraph()->machine()->UnalignedLoad(memtype),
                             MemBuffer(offset), index, *effect_, *control_);
   }
 
@@ -3884,15 +3230,15 @@ Node* WasmGraphBuilder::LoadMem(wasm::ValueType type, MachineType memtype,
 #endif
 
   if (type == wasm::kWasmI64 &&
-      ElementSizeLog2Of(memtype.representation()) < 3) {
+      ElementSizeInBytes(memtype.representation()) < 8) {
     // TODO(titzer): TF zeroes the upper bits of 64-bit loads for subword sizes.
     if (memtype.IsSigned()) {
       // sign extend
-      load = graph()->NewNode(jsgraph()->machine()->ChangeInt32ToInt64(), load);
+      load = graph()->NewNode(mcgraph()->machine()->ChangeInt32ToInt64(), load);
     } else {
       // zero extend
       load =
-          graph()->NewNode(jsgraph()->machine()->ChangeUint32ToUint64(), load);
+          graph()->NewNode(mcgraph()->machine()->ChangeUint32ToUint64(), load);
     }
   }
 
@@ -3910,7 +3256,7 @@ Node* WasmGraphBuilder::StoreMem(MachineRepresentation mem_rep, Node* index,
                                  wasm::ValueType type) {
   Node* store;
 
-  index = BoundsCheckMem(wasm::WasmOpcodes::MemSize(mem_rep), index, offset,
+  index = BoundsCheckMem(i::ElementSizeInBytes(mem_rep), index, offset,
                          position, kCanOmitBoundsCheck);
 
 #if defined(V8_TARGET_BIG_ENDIAN)
@@ -3918,16 +3264,16 @@ Node* WasmGraphBuilder::StoreMem(MachineRepresentation mem_rep, Node* index,
 #endif
 
   if (mem_rep == MachineRepresentation::kWord8 ||
-      jsgraph()->machine()->UnalignedStoreSupported(mem_rep)) {
+      mcgraph()->machine()->UnalignedStoreSupported(mem_rep)) {
     if (use_trap_handler()) {
       store =
-          graph()->NewNode(jsgraph()->machine()->ProtectedStore(mem_rep),
+          graph()->NewNode(mcgraph()->machine()->ProtectedStore(mem_rep),
                            MemBuffer(offset), index, val, *effect_, *control_);
       SetSourcePosition(store, position);
     } else {
       StoreRepresentation rep(mem_rep, kNoWriteBarrier);
       store =
-          graph()->NewNode(jsgraph()->machine()->Store(rep), MemBuffer(offset),
+          graph()->NewNode(mcgraph()->machine()->Store(rep), MemBuffer(offset),
                            index, val, *effect_, *control_);
     }
   } else {
@@ -3935,7 +3281,7 @@ Node* WasmGraphBuilder::StoreMem(MachineRepresentation mem_rep, Node* index,
     DCHECK(!use_trap_handler());
     UnalignedStoreRepresentation rep(mem_rep);
     store =
-        graph()->NewNode(jsgraph()->machine()->UnalignedStore(rep),
+        graph()->NewNode(mcgraph()->machine()->UnalignedStore(rep),
                          MemBuffer(offset), index, val, *effect_, *control_);
   }
 
@@ -3949,18 +3295,18 @@ Node* WasmGraphBuilder::StoreMem(MachineRepresentation mem_rep, Node* index,
 }
 
 namespace {
-Node* GetAsmJsOOBValue(MachineRepresentation rep, JSGraph* jsgraph) {
+Node* GetAsmJsOOBValue(MachineRepresentation rep, MachineGraph* mcgraph) {
   switch (rep) {
     case MachineRepresentation::kWord8:
     case MachineRepresentation::kWord16:
     case MachineRepresentation::kWord32:
-      return jsgraph->Int32Constant(0);
+      return mcgraph->Int32Constant(0);
     case MachineRepresentation::kWord64:
-      return jsgraph->Int64Constant(0);
+      return mcgraph->Int64Constant(0);
     case MachineRepresentation::kFloat32:
-      return jsgraph->Float32Constant(std::numeric_limits<float>::quiet_NaN());
+      return mcgraph->Float32Constant(std::numeric_limits<float>::quiet_NaN());
     case MachineRepresentation::kFloat64:
-      return jsgraph->Float64Constant(std::numeric_limits<double>::quiet_NaN());
+      return mcgraph->Float64Constant(std::numeric_limits<double>::quiet_NaN());
     default:
       UNREACHABLE();
   }
@@ -3981,8 +3327,8 @@ Node* WasmGraphBuilder::BuildAsmjsLoadMem(MachineType type, Node* index) {
   // stored value, which is conservative if misaligned. Technically, asm.js
   // should never have misaligned accesses.
   Diamond bounds_check(
-      graph(), jsgraph()->common(),
-      graph()->NewNode(jsgraph()->machine()->Uint32LessThan(), index, mem_size),
+      graph(), mcgraph()->common(),
+      graph()->NewNode(mcgraph()->machine()->Uint32LessThan(), index, mem_size),
       BranchHint::kTrue);
   bounds_check.Chain(*control_);
 
@@ -3991,25 +3337,30 @@ Node* WasmGraphBuilder::BuildAsmjsLoadMem(MachineType type, Node* index) {
     Node* mem_mask = instance_cache_->mem_mask;
     DCHECK_NOT_NULL(mem_mask);
     index =
-        graph()->NewNode(jsgraph()->machine()->Word32And(), index, mem_mask);
+        graph()->NewNode(mcgraph()->machine()->Word32And(), index, mem_mask);
   }
 
   index = Uint32ToUintptr(index);
-  Node* load = graph()->NewNode(jsgraph()->machine()->Load(type), mem_start,
+  Node* load = graph()->NewNode(mcgraph()->machine()->Load(type), mem_start,
                                 index, *effect_, bounds_check.if_true);
   Node* value_phi =
       bounds_check.Phi(type.representation(), load,
-                       GetAsmJsOOBValue(type.representation(), jsgraph()));
-  Node* effect_phi = graph()->NewNode(jsgraph()->common()->EffectPhi(2), load,
-                                      *effect_, bounds_check.merge);
+                       GetAsmJsOOBValue(type.representation(), mcgraph()));
+  Node* effect_phi = bounds_check.EffectPhi(load, *effect_);
   *effect_ = effect_phi;
   *control_ = bounds_check.merge;
   return value_phi;
 }
 
 Node* WasmGraphBuilder::Uint32ToUintptr(Node* node) {
-  if (jsgraph()->machine()->Is32()) return node;
-  return graph()->NewNode(jsgraph()->machine()->ChangeUint32ToUint64(), node);
+  if (mcgraph()->machine()->Is32()) return node;
+  // Fold instances of ChangeUint32ToUint64(IntConstant) directly.
+  UintPtrMatcher matcher(node);
+  if (matcher.HasValue()) {
+    uintptr_t value = matcher.Value();
+    return mcgraph()->IntPtrConstant(bit_cast<intptr_t>(value));
+  }
+  return graph()->NewNode(mcgraph()->machine()->ChangeUint32ToUint64(), node);
 }
 
 Node* WasmGraphBuilder::BuildAsmjsStoreMem(MachineType type, Node* index,
@@ -4025,8 +3376,8 @@ Node* WasmGraphBuilder::BuildAsmjsStoreMem(MachineType type, Node* index,
   // stored value, which is conservative if misaligned. Technically, asm.js
   // should never have misaligned accesses.
   Diamond bounds_check(
-      graph(), jsgraph()->common(),
-      graph()->NewNode(jsgraph()->machine()->Uint32LessThan(), index, mem_size),
+      graph(), mcgraph()->common(),
+      graph()->NewNode(mcgraph()->machine()->Uint32LessThan(), index, mem_size),
       BranchHint::kTrue);
   bounds_check.Chain(*control_);
 
@@ -4035,16 +3386,15 @@ Node* WasmGraphBuilder::BuildAsmjsStoreMem(MachineType type, Node* index,
     Node* mem_mask = instance_cache_->mem_mask;
     DCHECK_NOT_NULL(mem_mask);
     index =
-        graph()->NewNode(jsgraph()->machine()->Word32And(), index, mem_mask);
+        graph()->NewNode(mcgraph()->machine()->Word32And(), index, mem_mask);
   }
 
   index = Uint32ToUintptr(index);
-  const Operator* store_op = jsgraph()->machine()->Store(StoreRepresentation(
+  const Operator* store_op = mcgraph()->machine()->Store(StoreRepresentation(
       type.representation(), WriteBarrierKind::kNoWriteBarrier));
   Node* store = graph()->NewNode(store_op, mem_start, index, val, *effect_,
                                  bounds_check.if_true);
-  Node* effect_phi = graph()->NewNode(jsgraph()->common()->EffectPhi(2), store,
-                                      *effect_, bounds_check.merge);
+  Node* effect_phi = bounds_check.EffectPhi(store, *effect_);
   *effect_ = effect_phi;
   *control_ = bounds_check.merge;
   return val;
@@ -4054,22 +3404,35 @@ void WasmGraphBuilder::PrintDebugName(Node* node) {
   PrintF("#%d:%s", node->id(), node->op()->mnemonic());
 }
 
-Node* WasmGraphBuilder::String(const char* string) {
-  return jsgraph()->Constant(
-      jsgraph()->isolate()->factory()->NewStringFromAsciiChecked(string));
-}
+Graph* WasmGraphBuilder::graph() { return mcgraph()->graph(); }
+
+namespace {
+Signature<MachineRepresentation>* CreateMachineSignature(
+    Zone* zone, wasm::FunctionSig* sig) {
+  Signature<MachineRepresentation>::Builder builder(zone, sig->return_count(),
+                                                    sig->parameter_count());
+  for (auto ret : sig->returns()) {
+    builder.AddReturn(wasm::ValueTypes::MachineRepresentationFor(ret));
+  }
 
-Graph* WasmGraphBuilder::graph() { return jsgraph()->graph(); }
+  for (auto param : sig->parameters()) {
+    builder.AddParam(wasm::ValueTypes::MachineRepresentationFor(param));
+  }
+  return builder.Build();
+}
+}  // namespace
 
 void WasmGraphBuilder::LowerInt64() {
-  if (jsgraph()->machine()->Is64()) return;
-  Int64Lowering r(jsgraph()->graph(), jsgraph()->machine(), jsgraph()->common(),
-                  jsgraph()->zone(), sig_);
+  if (mcgraph()->machine()->Is64()) return;
+  Int64Lowering r(mcgraph()->graph(), mcgraph()->machine(), mcgraph()->common(),
+                  mcgraph()->zone(),
+                  CreateMachineSignature(mcgraph()->zone(), sig_));
   r.LowerGraph();
 }
 
 void WasmGraphBuilder::SimdScalarLoweringForTesting() {
-  SimdScalarLowering(jsgraph(), sig_).LowerGraph();
+  SimdScalarLowering(mcgraph(), CreateMachineSignature(mcgraph()->zone(), sig_))
+      .LowerGraph();
 }
 
 void WasmGraphBuilder::SetSourcePosition(Node* node,
@@ -4081,329 +3444,329 @@ void WasmGraphBuilder::SetSourcePosition(Node* node,
 
 Node* WasmGraphBuilder::S128Zero() {
   has_simd_ = true;
-  return graph()->NewNode(jsgraph()->machine()->S128Zero());
+  return graph()->NewNode(mcgraph()->machine()->S128Zero());
 }
 
 Node* WasmGraphBuilder::SimdOp(wasm::WasmOpcode opcode, Node* const* inputs) {
   has_simd_ = true;
   switch (opcode) {
     case wasm::kExprF32x4Splat:
-      return graph()->NewNode(jsgraph()->machine()->F32x4Splat(), inputs[0]);
+      return graph()->NewNode(mcgraph()->machine()->F32x4Splat(), inputs[0]);
     case wasm::kExprF32x4SConvertI32x4:
-      return graph()->NewNode(jsgraph()->machine()->F32x4SConvertI32x4(),
+      return graph()->NewNode(mcgraph()->machine()->F32x4SConvertI32x4(),
                               inputs[0]);
     case wasm::kExprF32x4UConvertI32x4:
-      return graph()->NewNode(jsgraph()->machine()->F32x4UConvertI32x4(),
+      return graph()->NewNode(mcgraph()->machine()->F32x4UConvertI32x4(),
                               inputs[0]);
     case wasm::kExprF32x4Abs:
-      return graph()->NewNode(jsgraph()->machine()->F32x4Abs(), inputs[0]);
+      return graph()->NewNode(mcgraph()->machine()->F32x4Abs(), inputs[0]);
     case wasm::kExprF32x4Neg:
-      return graph()->NewNode(jsgraph()->machine()->F32x4Neg(), inputs[0]);
+      return graph()->NewNode(mcgraph()->machine()->F32x4Neg(), inputs[0]);
     case wasm::kExprF32x4RecipApprox:
-      return graph()->NewNode(jsgraph()->machine()->F32x4RecipApprox(),
+      return graph()->NewNode(mcgraph()->machine()->F32x4RecipApprox(),
                               inputs[0]);
     case wasm::kExprF32x4RecipSqrtApprox:
-      return graph()->NewNode(jsgraph()->machine()->F32x4RecipSqrtApprox(),
+      return graph()->NewNode(mcgraph()->machine()->F32x4RecipSqrtApprox(),
                               inputs[0]);
     case wasm::kExprF32x4Add:
-      return graph()->NewNode(jsgraph()->machine()->F32x4Add(), inputs[0],
+      return graph()->NewNode(mcgraph()->machine()->F32x4Add(), inputs[0],
                               inputs[1]);
     case wasm::kExprF32x4AddHoriz:
-      return graph()->NewNode(jsgraph()->machine()->F32x4AddHoriz(), inputs[0],
+      return graph()->NewNode(mcgraph()->machine()->F32x4AddHoriz(), inputs[0],
                               inputs[1]);
     case wasm::kExprF32x4Sub:
-      return graph()->NewNode(jsgraph()->machine()->F32x4Sub(), inputs[0],
+      return graph()->NewNode(mcgraph()->machine()->F32x4Sub(), inputs[0],
                               inputs[1]);
     case wasm::kExprF32x4Mul:
-      return graph()->NewNode(jsgraph()->machine()->F32x4Mul(), inputs[0],
+      return graph()->NewNode(mcgraph()->machine()->F32x4Mul(), inputs[0],
                               inputs[1]);
     case wasm::kExprF32x4Min:
-      return graph()->NewNode(jsgraph()->machine()->F32x4Min(), inputs[0],
+      return graph()->NewNode(mcgraph()->machine()->F32x4Min(), inputs[0],
                               inputs[1]);
     case wasm::kExprF32x4Max:
-      return graph()->NewNode(jsgraph()->machine()->F32x4Max(), inputs[0],
+      return graph()->NewNode(mcgraph()->machine()->F32x4Max(), inputs[0],
                               inputs[1]);
     case wasm::kExprF32x4Eq:
-      return graph()->NewNode(jsgraph()->machine()->F32x4Eq(), inputs[0],
+      return graph()->NewNode(mcgraph()->machine()->F32x4Eq(), inputs[0],
                               inputs[1]);
     case wasm::kExprF32x4Ne:
-      return graph()->NewNode(jsgraph()->machine()->F32x4Ne(), inputs[0],
+      return graph()->NewNode(mcgraph()->machine()->F32x4Ne(), inputs[0],
                               inputs[1]);
     case wasm::kExprF32x4Lt:
-      return graph()->NewNode(jsgraph()->machine()->F32x4Lt(), inputs[0],
+      return graph()->NewNode(mcgraph()->machine()->F32x4Lt(), inputs[0],
                               inputs[1]);
     case wasm::kExprF32x4Le:
-      return graph()->NewNode(jsgraph()->machine()->F32x4Le(), inputs[0],
+      return graph()->NewNode(mcgraph()->machine()->F32x4Le(), inputs[0],
                               inputs[1]);
     case wasm::kExprF32x4Gt:
-      return graph()->NewNode(jsgraph()->machine()->F32x4Lt(), inputs[1],
+      return graph()->NewNode(mcgraph()->machine()->F32x4Lt(), inputs[1],
                               inputs[0]);
     case wasm::kExprF32x4Ge:
-      return graph()->NewNode(jsgraph()->machine()->F32x4Le(), inputs[1],
+      return graph()->NewNode(mcgraph()->machine()->F32x4Le(), inputs[1],
                               inputs[0]);
     case wasm::kExprI32x4Splat:
-      return graph()->NewNode(jsgraph()->machine()->I32x4Splat(), inputs[0]);
+      return graph()->NewNode(mcgraph()->machine()->I32x4Splat(), inputs[0]);
     case wasm::kExprI32x4SConvertF32x4:
-      return graph()->NewNode(jsgraph()->machine()->I32x4SConvertF32x4(),
+      return graph()->NewNode(mcgraph()->machine()->I32x4SConvertF32x4(),
                               inputs[0]);
     case wasm::kExprI32x4UConvertF32x4:
-      return graph()->NewNode(jsgraph()->machine()->I32x4UConvertF32x4(),
+      return graph()->NewNode(mcgraph()->machine()->I32x4UConvertF32x4(),
                               inputs[0]);
     case wasm::kExprI32x4SConvertI16x8Low:
-      return graph()->NewNode(jsgraph()->machine()->I32x4SConvertI16x8Low(),
+      return graph()->NewNode(mcgraph()->machine()->I32x4SConvertI16x8Low(),
                               inputs[0]);
     case wasm::kExprI32x4SConvertI16x8High:
-      return graph()->NewNode(jsgraph()->machine()->I32x4SConvertI16x8High(),
+      return graph()->NewNode(mcgraph()->machine()->I32x4SConvertI16x8High(),
                               inputs[0]);
     case wasm::kExprI32x4Neg:
-      return graph()->NewNode(jsgraph()->machine()->I32x4Neg(), inputs[0]);
+      return graph()->NewNode(mcgraph()->machine()->I32x4Neg(), inputs[0]);
     case wasm::kExprI32x4Add:
-      return graph()->NewNode(jsgraph()->machine()->I32x4Add(), inputs[0],
+      return graph()->NewNode(mcgraph()->machine()->I32x4Add(), inputs[0],
                               inputs[1]);
     case wasm::kExprI32x4AddHoriz:
-      return graph()->NewNode(jsgraph()->machine()->I32x4AddHoriz(), inputs[0],
+      return graph()->NewNode(mcgraph()->machine()->I32x4AddHoriz(), inputs[0],
                               inputs[1]);
     case wasm::kExprI32x4Sub:
-      return graph()->NewNode(jsgraph()->machine()->I32x4Sub(), inputs[0],
+      return graph()->NewNode(mcgraph()->machine()->I32x4Sub(), inputs[0],
                               inputs[1]);
     case wasm::kExprI32x4Mul:
-      return graph()->NewNode(jsgraph()->machine()->I32x4Mul(), inputs[0],
+      return graph()->NewNode(mcgraph()->machine()->I32x4Mul(), inputs[0],
                               inputs[1]);
     case wasm::kExprI32x4MinS:
-      return graph()->NewNode(jsgraph()->machine()->I32x4MinS(), inputs[0],
+      return graph()->NewNode(mcgraph()->machine()->I32x4MinS(), inputs[0],
                               inputs[1]);
     case wasm::kExprI32x4MaxS:
-      return graph()->NewNode(jsgraph()->machine()->I32x4MaxS(), inputs[0],
+      return graph()->NewNode(mcgraph()->machine()->I32x4MaxS(), inputs[0],
                               inputs[1]);
     case wasm::kExprI32x4Eq:
-      return graph()->NewNode(jsgraph()->machine()->I32x4Eq(), inputs[0],
+      return graph()->NewNode(mcgraph()->machine()->I32x4Eq(), inputs[0],
                               inputs[1]);
     case wasm::kExprI32x4Ne:
-      return graph()->NewNode(jsgraph()->machine()->I32x4Ne(), inputs[0],
+      return graph()->NewNode(mcgraph()->machine()->I32x4Ne(), inputs[0],
                               inputs[1]);
     case wasm::kExprI32x4LtS:
-      return graph()->NewNode(jsgraph()->machine()->I32x4GtS(), inputs[1],
+      return graph()->NewNode(mcgraph()->machine()->I32x4GtS(), inputs[1],
                               inputs[0]);
     case wasm::kExprI32x4LeS:
-      return graph()->NewNode(jsgraph()->machine()->I32x4GeS(), inputs[1],
+      return graph()->NewNode(mcgraph()->machine()->I32x4GeS(), inputs[1],
                               inputs[0]);
     case wasm::kExprI32x4GtS:
-      return graph()->NewNode(jsgraph()->machine()->I32x4GtS(), inputs[0],
+      return graph()->NewNode(mcgraph()->machine()->I32x4GtS(), inputs[0],
                               inputs[1]);
     case wasm::kExprI32x4GeS:
-      return graph()->NewNode(jsgraph()->machine()->I32x4GeS(), inputs[0],
+      return graph()->NewNode(mcgraph()->machine()->I32x4GeS(), inputs[0],
                               inputs[1]);
     case wasm::kExprI32x4UConvertI16x8Low:
-      return graph()->NewNode(jsgraph()->machine()->I32x4UConvertI16x8Low(),
+      return graph()->NewNode(mcgraph()->machine()->I32x4UConvertI16x8Low(),
                               inputs[0]);
     case wasm::kExprI32x4UConvertI16x8High:
-      return graph()->NewNode(jsgraph()->machine()->I32x4UConvertI16x8High(),
+      return graph()->NewNode(mcgraph()->machine()->I32x4UConvertI16x8High(),
                               inputs[0]);
     case wasm::kExprI32x4MinU:
-      return graph()->NewNode(jsgraph()->machine()->I32x4MinU(), inputs[0],
+      return graph()->NewNode(mcgraph()->machine()->I32x4MinU(), inputs[0],
                               inputs[1]);
     case wasm::kExprI32x4MaxU:
-      return graph()->NewNode(jsgraph()->machine()->I32x4MaxU(), inputs[0],
+      return graph()->NewNode(mcgraph()->machine()->I32x4MaxU(), inputs[0],
                               inputs[1]);
     case wasm::kExprI32x4LtU:
-      return graph()->NewNode(jsgraph()->machine()->I32x4GtU(), inputs[1],
+      return graph()->NewNode(mcgraph()->machine()->I32x4GtU(), inputs[1],
                               inputs[0]);
     case wasm::kExprI32x4LeU:
-      return graph()->NewNode(jsgraph()->machine()->I32x4GeU(), inputs[1],
+      return graph()->NewNode(mcgraph()->machine()->I32x4GeU(), inputs[1],
                               inputs[0]);
     case wasm::kExprI32x4GtU:
-      return graph()->NewNode(jsgraph()->machine()->I32x4GtU(), inputs[0],
+      return graph()->NewNode(mcgraph()->machine()->I32x4GtU(), inputs[0],
                               inputs[1]);
     case wasm::kExprI32x4GeU:
-      return graph()->NewNode(jsgraph()->machine()->I32x4GeU(), inputs[0],
+      return graph()->NewNode(mcgraph()->machine()->I32x4GeU(), inputs[0],
                               inputs[1]);
     case wasm::kExprI16x8Splat:
-      return graph()->NewNode(jsgraph()->machine()->I16x8Splat(), inputs[0]);
+      return graph()->NewNode(mcgraph()->machine()->I16x8Splat(), inputs[0]);
     case wasm::kExprI16x8SConvertI8x16Low:
-      return graph()->NewNode(jsgraph()->machine()->I16x8SConvertI8x16Low(),
+      return graph()->NewNode(mcgraph()->machine()->I16x8SConvertI8x16Low(),
                               inputs[0]);
     case wasm::kExprI16x8SConvertI8x16High:
-      return graph()->NewNode(jsgraph()->machine()->I16x8SConvertI8x16High(),
+      return graph()->NewNode(mcgraph()->machine()->I16x8SConvertI8x16High(),
                               inputs[0]);
     case wasm::kExprI16x8Neg:
-      return graph()->NewNode(jsgraph()->machine()->I16x8Neg(), inputs[0]);
+      return graph()->NewNode(mcgraph()->machine()->I16x8Neg(), inputs[0]);
     case wasm::kExprI16x8SConvertI32x4:
-      return graph()->NewNode(jsgraph()->machine()->I16x8SConvertI32x4(),
+      return graph()->NewNode(mcgraph()->machine()->I16x8SConvertI32x4(),
                               inputs[0], inputs[1]);
     case wasm::kExprI16x8Add:
-      return graph()->NewNode(jsgraph()->machine()->I16x8Add(), inputs[0],
+      return graph()->NewNode(mcgraph()->machine()->I16x8Add(), inputs[0],
                               inputs[1]);
     case wasm::kExprI16x8AddSaturateS:
-      return graph()->NewNode(jsgraph()->machine()->I16x8AddSaturateS(),
+      return graph()->NewNode(mcgraph()->machine()->I16x8AddSaturateS(),
                               inputs[0], inputs[1]);
     case wasm::kExprI16x8AddHoriz:
-      return graph()->NewNode(jsgraph()->machine()->I16x8AddHoriz(), inputs[0],
+      return graph()->NewNode(mcgraph()->machine()->I16x8AddHoriz(), inputs[0],
                               inputs[1]);
     case wasm::kExprI16x8Sub:
-      return graph()->NewNode(jsgraph()->machine()->I16x8Sub(), inputs[0],
+      return graph()->NewNode(mcgraph()->machine()->I16x8Sub(), inputs[0],
                               inputs[1]);
     case wasm::kExprI16x8SubSaturateS:
-      return graph()->NewNode(jsgraph()->machine()->I16x8SubSaturateS(),
+      return graph()->NewNode(mcgraph()->machine()->I16x8SubSaturateS(),
                               inputs[0], inputs[1]);
     case wasm::kExprI16x8Mul:
-      return graph()->NewNode(jsgraph()->machine()->I16x8Mul(), inputs[0],
+      return graph()->NewNode(mcgraph()->machine()->I16x8Mul(), inputs[0],
                               inputs[1]);
     case wasm::kExprI16x8MinS:
-      return graph()->NewNode(jsgraph()->machine()->I16x8MinS(), inputs[0],
+      return graph()->NewNode(mcgraph()->machine()->I16x8MinS(), inputs[0],
                               inputs[1]);
     case wasm::kExprI16x8MaxS:
-      return graph()->NewNode(jsgraph()->machine()->I16x8MaxS(), inputs[0],
+      return graph()->NewNode(mcgraph()->machine()->I16x8MaxS(), inputs[0],
                               inputs[1]);
     case wasm::kExprI16x8Eq:
-      return graph()->NewNode(jsgraph()->machine()->I16x8Eq(), inputs[0],
+      return graph()->NewNode(mcgraph()->machine()->I16x8Eq(), inputs[0],
                               inputs[1]);
     case wasm::kExprI16x8Ne:
-      return graph()->NewNode(jsgraph()->machine()->I16x8Ne(), inputs[0],
+      return graph()->NewNode(mcgraph()->machine()->I16x8Ne(), inputs[0],
                               inputs[1]);
     case wasm::kExprI16x8LtS:
-      return graph()->NewNode(jsgraph()->machine()->I16x8GtS(), inputs[1],
+      return graph()->NewNode(mcgraph()->machine()->I16x8GtS(), inputs[1],
                               inputs[0]);
     case wasm::kExprI16x8LeS:
-      return graph()->NewNode(jsgraph()->machine()->I16x8GeS(), inputs[1],
+      return graph()->NewNode(mcgraph()->machine()->I16x8GeS(), inputs[1],
                               inputs[0]);
     case wasm::kExprI16x8GtS:
-      return graph()->NewNode(jsgraph()->machine()->I16x8GtS(), inputs[0],
+      return graph()->NewNode(mcgraph()->machine()->I16x8GtS(), inputs[0],
                               inputs[1]);
     case wasm::kExprI16x8GeS:
-      return graph()->NewNode(jsgraph()->machine()->I16x8GeS(), inputs[0],
+      return graph()->NewNode(mcgraph()->machine()->I16x8GeS(), inputs[0],
                               inputs[1]);
     case wasm::kExprI16x8UConvertI8x16Low:
-      return graph()->NewNode(jsgraph()->machine()->I16x8UConvertI8x16Low(),
+      return graph()->NewNode(mcgraph()->machine()->I16x8UConvertI8x16Low(),
                               inputs[0]);
     case wasm::kExprI16x8UConvertI8x16High:
-      return graph()->NewNode(jsgraph()->machine()->I16x8UConvertI8x16High(),
+      return graph()->NewNode(mcgraph()->machine()->I16x8UConvertI8x16High(),
                               inputs[0]);
     case wasm::kExprI16x8UConvertI32x4:
-      return graph()->NewNode(jsgraph()->machine()->I16x8UConvertI32x4(),
+      return graph()->NewNode(mcgraph()->machine()->I16x8UConvertI32x4(),
                               inputs[0], inputs[1]);
     case wasm::kExprI16x8AddSaturateU:
-      return graph()->NewNode(jsgraph()->machine()->I16x8AddSaturateU(),
+      return graph()->NewNode(mcgraph()->machine()->I16x8AddSaturateU(),
                               inputs[0], inputs[1]);
     case wasm::kExprI16x8SubSaturateU:
-      return graph()->NewNode(jsgraph()->machine()->I16x8SubSaturateU(),
+      return graph()->NewNode(mcgraph()->machine()->I16x8SubSaturateU(),
                               inputs[0], inputs[1]);
     case wasm::kExprI16x8MinU:
-      return graph()->NewNode(jsgraph()->machine()->I16x8MinU(), inputs[0],
+      return graph()->NewNode(mcgraph()->machine()->I16x8MinU(), inputs[0],
                               inputs[1]);
     case wasm::kExprI16x8MaxU:
-      return graph()->NewNode(jsgraph()->machine()->I16x8MaxU(), inputs[0],
+      return graph()->NewNode(mcgraph()->machine()->I16x8MaxU(), inputs[0],
                               inputs[1]);
     case wasm::kExprI16x8LtU:
-      return graph()->NewNode(jsgraph()->machine()->I16x8GtU(), inputs[1],
+      return graph()->NewNode(mcgraph()->machine()->I16x8GtU(), inputs[1],
                               inputs[0]);
     case wasm::kExprI16x8LeU:
-      return graph()->NewNode(jsgraph()->machine()->I16x8GeU(), inputs[1],
+      return graph()->NewNode(mcgraph()->machine()->I16x8GeU(), inputs[1],
                               inputs[0]);
     case wasm::kExprI16x8GtU:
-      return graph()->NewNode(jsgraph()->machine()->I16x8GtU(), inputs[0],
+      return graph()->NewNode(mcgraph()->machine()->I16x8GtU(), inputs[0],
                               inputs[1]);
     case wasm::kExprI16x8GeU:
-      return graph()->NewNode(jsgraph()->machine()->I16x8GeU(), inputs[0],
+      return graph()->NewNode(mcgraph()->machine()->I16x8GeU(), inputs[0],
                               inputs[1]);
     case wasm::kExprI8x16Splat:
-      return graph()->NewNode(jsgraph()->machine()->I8x16Splat(), inputs[0]);
+      return graph()->NewNode(mcgraph()->machine()->I8x16Splat(), inputs[0]);
     case wasm::kExprI8x16Neg:
-      return graph()->NewNode(jsgraph()->machine()->I8x16Neg(), inputs[0]);
+      return graph()->NewNode(mcgraph()->machine()->I8x16Neg(), inputs[0]);
     case wasm::kExprI8x16SConvertI16x8:
-      return graph()->NewNode(jsgraph()->machine()->I8x16SConvertI16x8(),
+      return graph()->NewNode(mcgraph()->machine()->I8x16SConvertI16x8(),
                               inputs[0], inputs[1]);
     case wasm::kExprI8x16Add:
-      return graph()->NewNode(jsgraph()->machine()->I8x16Add(), inputs[0],
+      return graph()->NewNode(mcgraph()->machine()->I8x16Add(), inputs[0],
                               inputs[1]);
     case wasm::kExprI8x16AddSaturateS:
-      return graph()->NewNode(jsgraph()->machine()->I8x16AddSaturateS(),
+      return graph()->NewNode(mcgraph()->machine()->I8x16AddSaturateS(),
                               inputs[0], inputs[1]);
     case wasm::kExprI8x16Sub:
-      return graph()->NewNode(jsgraph()->machine()->I8x16Sub(), inputs[0],
+      return graph()->NewNode(mcgraph()->machine()->I8x16Sub(), inputs[0],
                               inputs[1]);
     case wasm::kExprI8x16SubSaturateS:
-      return graph()->NewNode(jsgraph()->machine()->I8x16SubSaturateS(),
+      return graph()->NewNode(mcgraph()->machine()->I8x16SubSaturateS(),
                               inputs[0], inputs[1]);
     case wasm::kExprI8x16Mul:
-      return graph()->NewNode(jsgraph()->machine()->I8x16Mul(), inputs[0],
+      return graph()->NewNode(mcgraph()->machine()->I8x16Mul(), inputs[0],
                               inputs[1]);
     case wasm::kExprI8x16MinS:
-      return graph()->NewNode(jsgraph()->machine()->I8x16MinS(), inputs[0],
+      return graph()->NewNode(mcgraph()->machine()->I8x16MinS(), inputs[0],
                               inputs[1]);
     case wasm::kExprI8x16MaxS:
-      return graph()->NewNode(jsgraph()->machine()->I8x16MaxS(), inputs[0],
+      return graph()->NewNode(mcgraph()->machine()->I8x16MaxS(), inputs[0],
                               inputs[1]);
     case wasm::kExprI8x16Eq:
-      return graph()->NewNode(jsgraph()->machine()->I8x16Eq(), inputs[0],
+      return graph()->NewNode(mcgraph()->machine()->I8x16Eq(), inputs[0],
                               inputs[1]);
     case wasm::kExprI8x16Ne:
-      return graph()->NewNode(jsgraph()->machine()->I8x16Ne(), inputs[0],
+      return graph()->NewNode(mcgraph()->machine()->I8x16Ne(), inputs[0],
                               inputs[1]);
     case wasm::kExprI8x16LtS:
-      return graph()->NewNode(jsgraph()->machine()->I8x16GtS(), inputs[1],
+      return graph()->NewNode(mcgraph()->machine()->I8x16GtS(), inputs[1],
                               inputs[0]);
     case wasm::kExprI8x16LeS:
-      return graph()->NewNode(jsgraph()->machine()->I8x16GeS(), inputs[1],
+      return graph()->NewNode(mcgraph()->machine()->I8x16GeS(), inputs[1],
                               inputs[0]);
     case wasm::kExprI8x16GtS:
-      return graph()->NewNode(jsgraph()->machine()->I8x16GtS(), inputs[0],
+      return graph()->NewNode(mcgraph()->machine()->I8x16GtS(), inputs[0],
                               inputs[1]);
     case wasm::kExprI8x16GeS:
-      return graph()->NewNode(jsgraph()->machine()->I8x16GeS(), inputs[0],
+      return graph()->NewNode(mcgraph()->machine()->I8x16GeS(), inputs[0],
                               inputs[1]);
     case wasm::kExprI8x16UConvertI16x8:
-      return graph()->NewNode(jsgraph()->machine()->I8x16UConvertI16x8(),
+      return graph()->NewNode(mcgraph()->machine()->I8x16UConvertI16x8(),
                               inputs[0], inputs[1]);
     case wasm::kExprI8x16AddSaturateU:
-      return graph()->NewNode(jsgraph()->machine()->I8x16AddSaturateU(),
+      return graph()->NewNode(mcgraph()->machine()->I8x16AddSaturateU(),
                               inputs[0], inputs[1]);
     case wasm::kExprI8x16SubSaturateU:
-      return graph()->NewNode(jsgraph()->machine()->I8x16SubSaturateU(),
+      return graph()->NewNode(mcgraph()->machine()->I8x16SubSaturateU(),
                               inputs[0], inputs[1]);
     case wasm::kExprI8x16MinU:
-      return graph()->NewNode(jsgraph()->machine()->I8x16MinU(), inputs[0],
+      return graph()->NewNode(mcgraph()->machine()->I8x16MinU(), inputs[0],
                               inputs[1]);
     case wasm::kExprI8x16MaxU:
-      return graph()->NewNode(jsgraph()->machine()->I8x16MaxU(), inputs[0],
+      return graph()->NewNode(mcgraph()->machine()->I8x16MaxU(), inputs[0],
                               inputs[1]);
     case wasm::kExprI8x16LtU:
-      return graph()->NewNode(jsgraph()->machine()->I8x16GtU(), inputs[1],
+      return graph()->NewNode(mcgraph()->machine()->I8x16GtU(), inputs[1],
                               inputs[0]);
     case wasm::kExprI8x16LeU:
-      return graph()->NewNode(jsgraph()->machine()->I8x16GeU(), inputs[1],
+      return graph()->NewNode(mcgraph()->machine()->I8x16GeU(), inputs[1],
                               inputs[0]);
     case wasm::kExprI8x16GtU:
-      return graph()->NewNode(jsgraph()->machine()->I8x16GtU(), inputs[0],
+      return graph()->NewNode(mcgraph()->machine()->I8x16GtU(), inputs[0],
                               inputs[1]);
     case wasm::kExprI8x16GeU:
-      return graph()->NewNode(jsgraph()->machine()->I8x16GeU(), inputs[0],
+      return graph()->NewNode(mcgraph()->machine()->I8x16GeU(), inputs[0],
                               inputs[1]);
     case wasm::kExprS128And:
-      return graph()->NewNode(jsgraph()->machine()->S128And(), inputs[0],
+      return graph()->NewNode(mcgraph()->machine()->S128And(), inputs[0],
                               inputs[1]);
     case wasm::kExprS128Or:
-      return graph()->NewNode(jsgraph()->machine()->S128Or(), inputs[0],
+      return graph()->NewNode(mcgraph()->machine()->S128Or(), inputs[0],
                               inputs[1]);
     case wasm::kExprS128Xor:
-      return graph()->NewNode(jsgraph()->machine()->S128Xor(), inputs[0],
+      return graph()->NewNode(mcgraph()->machine()->S128Xor(), inputs[0],
                               inputs[1]);
     case wasm::kExprS128Not:
-      return graph()->NewNode(jsgraph()->machine()->S128Not(), inputs[0]);
+      return graph()->NewNode(mcgraph()->machine()->S128Not(), inputs[0]);
     case wasm::kExprS128Select:
-      return graph()->NewNode(jsgraph()->machine()->S128Select(), inputs[0],
+      return graph()->NewNode(mcgraph()->machine()->S128Select(), inputs[0],
                               inputs[1], inputs[2]);
     case wasm::kExprS1x4AnyTrue:
-      return graph()->NewNode(jsgraph()->machine()->S1x4AnyTrue(), inputs[0]);
+      return graph()->NewNode(mcgraph()->machine()->S1x4AnyTrue(), inputs[0]);
     case wasm::kExprS1x4AllTrue:
-      return graph()->NewNode(jsgraph()->machine()->S1x4AllTrue(), inputs[0]);
+      return graph()->NewNode(mcgraph()->machine()->S1x4AllTrue(), inputs[0]);
     case wasm::kExprS1x8AnyTrue:
-      return graph()->NewNode(jsgraph()->machine()->S1x8AnyTrue(), inputs[0]);
+      return graph()->NewNode(mcgraph()->machine()->S1x8AnyTrue(), inputs[0]);
     case wasm::kExprS1x8AllTrue:
-      return graph()->NewNode(jsgraph()->machine()->S1x8AllTrue(), inputs[0]);
+      return graph()->NewNode(mcgraph()->machine()->S1x8AllTrue(), inputs[0]);
     case wasm::kExprS1x16AnyTrue:
-      return graph()->NewNode(jsgraph()->machine()->S1x16AnyTrue(), inputs[0]);
+      return graph()->NewNode(mcgraph()->machine()->S1x16AnyTrue(), inputs[0]);
     case wasm::kExprS1x16AllTrue:
-      return graph()->NewNode(jsgraph()->machine()->S1x16AllTrue(), inputs[0]);
+      return graph()->NewNode(mcgraph()->machine()->S1x16AllTrue(), inputs[0]);
     default:
       FATAL_UNSUPPORTED_OPCODE(opcode);
   }
@@ -4414,28 +3777,28 @@ Node* WasmGraphBuilder::SimdLaneOp(wasm::WasmOpcode opcode, uint8_t lane,
   has_simd_ = true;
   switch (opcode) {
     case wasm::kExprF32x4ExtractLane:
-      return graph()->NewNode(jsgraph()->machine()->F32x4ExtractLane(lane),
+      return graph()->NewNode(mcgraph()->machine()->F32x4ExtractLane(lane),
                               inputs[0]);
     case wasm::kExprF32x4ReplaceLane:
-      return graph()->NewNode(jsgraph()->machine()->F32x4ReplaceLane(lane),
+      return graph()->NewNode(mcgraph()->machine()->F32x4ReplaceLane(lane),
                               inputs[0], inputs[1]);
     case wasm::kExprI32x4ExtractLane:
-      return graph()->NewNode(jsgraph()->machine()->I32x4ExtractLane(lane),
+      return graph()->NewNode(mcgraph()->machine()->I32x4ExtractLane(lane),
                               inputs[0]);
     case wasm::kExprI32x4ReplaceLane:
-      return graph()->NewNode(jsgraph()->machine()->I32x4ReplaceLane(lane),
+      return graph()->NewNode(mcgraph()->machine()->I32x4ReplaceLane(lane),
                               inputs[0], inputs[1]);
     case wasm::kExprI16x8ExtractLane:
-      return graph()->NewNode(jsgraph()->machine()->I16x8ExtractLane(lane),
+      return graph()->NewNode(mcgraph()->machine()->I16x8ExtractLane(lane),
                               inputs[0]);
     case wasm::kExprI16x8ReplaceLane:
-      return graph()->NewNode(jsgraph()->machine()->I16x8ReplaceLane(lane),
+      return graph()->NewNode(mcgraph()->machine()->I16x8ReplaceLane(lane),
                               inputs[0], inputs[1]);
     case wasm::kExprI8x16ExtractLane:
-      return graph()->NewNode(jsgraph()->machine()->I8x16ExtractLane(lane),
+      return graph()->NewNode(mcgraph()->machine()->I8x16ExtractLane(lane),
                               inputs[0]);
     case wasm::kExprI8x16ReplaceLane:
-      return graph()->NewNode(jsgraph()->machine()->I8x16ReplaceLane(lane),
+      return graph()->NewNode(mcgraph()->machine()->I8x16ReplaceLane(lane),
                               inputs[0], inputs[1]);
     default:
       FATAL_UNSUPPORTED_OPCODE(opcode);
@@ -4447,28 +3810,28 @@ Node* WasmGraphBuilder::SimdShiftOp(wasm::WasmOpcode opcode, uint8_t shift,
   has_simd_ = true;
   switch (opcode) {
     case wasm::kExprI32x4Shl:
-      return graph()->NewNode(jsgraph()->machine()->I32x4Shl(shift), inputs[0]);
+      return graph()->NewNode(mcgraph()->machine()->I32x4Shl(shift), inputs[0]);
     case wasm::kExprI32x4ShrS:
-      return graph()->NewNode(jsgraph()->machine()->I32x4ShrS(shift),
+      return graph()->NewNode(mcgraph()->machine()->I32x4ShrS(shift),
                               inputs[0]);
     case wasm::kExprI32x4ShrU:
-      return graph()->NewNode(jsgraph()->machine()->I32x4ShrU(shift),
+      return graph()->NewNode(mcgraph()->machine()->I32x4ShrU(shift),
                               inputs[0]);
     case wasm::kExprI16x8Shl:
-      return graph()->NewNode(jsgraph()->machine()->I16x8Shl(shift), inputs[0]);
+      return graph()->NewNode(mcgraph()->machine()->I16x8Shl(shift), inputs[0]);
     case wasm::kExprI16x8ShrS:
-      return graph()->NewNode(jsgraph()->machine()->I16x8ShrS(shift),
+      return graph()->NewNode(mcgraph()->machine()->I16x8ShrS(shift),
                               inputs[0]);
     case wasm::kExprI16x8ShrU:
-      return graph()->NewNode(jsgraph()->machine()->I16x8ShrU(shift),
+      return graph()->NewNode(mcgraph()->machine()->I16x8ShrU(shift),
                               inputs[0]);
     case wasm::kExprI8x16Shl:
-      return graph()->NewNode(jsgraph()->machine()->I8x16Shl(shift), inputs[0]);
+      return graph()->NewNode(mcgraph()->machine()->I8x16Shl(shift), inputs[0]);
     case wasm::kExprI8x16ShrS:
-      return graph()->NewNode(jsgraph()->machine()->I8x16ShrS(shift),
+      return graph()->NewNode(mcgraph()->machine()->I8x16ShrS(shift),
                               inputs[0]);
     case wasm::kExprI8x16ShrU:
-      return graph()->NewNode(jsgraph()->machine()->I8x16ShrU(shift),
+      return graph()->NewNode(mcgraph()->machine()->I8x16ShrU(shift),
                               inputs[0]);
     default:
       FATAL_UNSUPPORTED_OPCODE(opcode);
@@ -4478,7 +3841,7 @@ Node* WasmGraphBuilder::SimdShiftOp(wasm::WasmOpcode opcode, uint8_t shift,
 Node* WasmGraphBuilder::Simd8x16ShuffleOp(const uint8_t shuffle[16],
                                           Node* const* inputs) {
   has_simd_ = true;
-  return graph()->NewNode(jsgraph()->machine()->S8x16Shuffle(shuffle),
+  return graph()->NewNode(mcgraph()->machine()->S8x16Shuffle(shuffle),
                           inputs[0], inputs[1]);
 }
 
@@ -4562,10 +3925,10 @@ Node* WasmGraphBuilder::AtomicOp(wasm::WasmOpcode opcode, Node* const* inputs,
 #define BUILD_ATOMIC_BINOP(Name, Operation, Type, Prefix)                     \
   case wasm::kExpr##Name: {                                                   \
     Node* index =                                                             \
-        BoundsCheckMem(wasm::WasmOpcodes::MemSize(MachineType::Type()),       \
+        BoundsCheckMem(wasm::ValueTypes::MemSize(MachineType::Type()),        \
                        inputs[0], offset, position, kNeedsBoundsCheck);       \
     node = graph()->NewNode(                                                  \
-        jsgraph()->machine()->Prefix##Atomic##Operation(MachineType::Type()), \
+        mcgraph()->machine()->Prefix##Atomic##Operation(MachineType::Type()), \
         MemBuffer(offset), index, inputs[1], *effect_, *control_);            \
     break;                                                                    \
   }
@@ -4575,10 +3938,10 @@ Node* WasmGraphBuilder::AtomicOp(wasm::WasmOpcode opcode, Node* const* inputs,
 #define BUILD_ATOMIC_CMP_EXCHG(Name, Type, Prefix)                            \
   case wasm::kExpr##Name: {                                                   \
     Node* index =                                                             \
-        BoundsCheckMem(wasm::WasmOpcodes::MemSize(MachineType::Type()),       \
+        BoundsCheckMem(wasm::ValueTypes::MemSize(MachineType::Type()),        \
                        inputs[0], offset, position, kNeedsBoundsCheck);       \
     node = graph()->NewNode(                                                  \
-        jsgraph()->machine()->Prefix##AtomicCompareExchange(                  \
+        mcgraph()->machine()->Prefix##AtomicCompareExchange(                  \
             MachineType::Type()),                                             \
         MemBuffer(offset), index, inputs[1], inputs[2], *effect_, *control_); \
     break;                                                                    \
@@ -4589,10 +3952,10 @@ Node* WasmGraphBuilder::AtomicOp(wasm::WasmOpcode opcode, Node* const* inputs,
 #define BUILD_ATOMIC_LOAD_OP(Name, Type, Prefix)                        \
   case wasm::kExpr##Name: {                                             \
     Node* index =                                                       \
-        BoundsCheckMem(wasm::WasmOpcodes::MemSize(MachineType::Type()), \
+        BoundsCheckMem(wasm::ValueTypes::MemSize(MachineType::Type()),  \
                        inputs[0], offset, position, kNeedsBoundsCheck); \
     node = graph()->NewNode(                                            \
-        jsgraph()->machine()->Prefix##AtomicLoad(MachineType::Type()),  \
+        mcgraph()->machine()->Prefix##AtomicLoad(MachineType::Type()),  \
         MemBuffer(offset), index, *effect_, *control_);                 \
     break;                                                              \
   }
@@ -4602,10 +3965,10 @@ Node* WasmGraphBuilder::AtomicOp(wasm::WasmOpcode opcode, Node* const* inputs,
 #define BUILD_ATOMIC_STORE_OP(Name, Type, Rep, Prefix)                         \
   case wasm::kExpr##Name: {                                                    \
     Node* index =                                                              \
-        BoundsCheckMem(wasm::WasmOpcodes::MemSize(MachineType::Type()),        \
+        BoundsCheckMem(wasm::ValueTypes::MemSize(MachineType::Type()),         \
                        inputs[0], offset, position, kNeedsBoundsCheck);        \
     node = graph()->NewNode(                                                   \
-        jsgraph()->machine()->Prefix##AtomicStore(MachineRepresentation::Rep), \
+        mcgraph()->machine()->Prefix##AtomicStore(MachineRepresentation::Rep), \
         MemBuffer(offset), index, inputs[1], *effect_, *control_);             \
     break;                                                                     \
   }
@@ -4623,6 +3986,35 @@ Node* WasmGraphBuilder::AtomicOp(wasm::WasmOpcode opcode, Node* const* inputs,
 #undef ATOMIC_LOAD_LIST
 #undef ATOMIC_STORE_LIST
 
+class WasmDecorator final : public GraphDecorator {
+ public:
+  explicit WasmDecorator(NodeOriginTable* origins, wasm::Decoder* decoder)
+      : origins_(origins), decoder_(decoder) {}
+
+  void Decorate(Node* node) final {
+    origins_->SetNodeOrigin(
+        node, NodeOrigin("wasm graph creation", "n/a",
+                         NodeOrigin::kWasmBytecode, decoder_->position()));
+  }
+
+ private:
+  compiler::NodeOriginTable* origins_;
+  wasm::Decoder* decoder_;
+};
+
+void WasmGraphBuilder::AddBytecodePositionDecorator(
+    NodeOriginTable* node_origins, wasm::Decoder* decoder) {
+  DCHECK_NULL(decorator_);
+  decorator_ = new (graph()->zone()) WasmDecorator(node_origins, decoder);
+  graph()->AddDecorator(decorator_);
+}
+
+void WasmGraphBuilder::RemoveBytecodePositionDecorator() {
+  DCHECK_NOT_NULL(decorator_);
+  graph()->RemoveDecorator(decorator_);
+  decorator_ = nullptr;
+}
+
 namespace {
 bool must_record_function_compilation(Isolate* isolate) {
   return isolate->logger()->is_listening_to_code_events() ||
@@ -4645,16 +4037,775 @@ void RecordFunctionCompilation(CodeEventListener::LogEventsAndTags tag,
       isolate->factory()->NewStringFromAsciiChecked(buffer.start());
   PROFILE(isolate, CodeCreateEvent(tag, AbstractCode::cast(*code), *name_str));
 }
+
+class WasmWrapperGraphBuilder : public WasmGraphBuilder {
+ public:
+  WasmWrapperGraphBuilder(Zone* zone, wasm::ModuleEnv* env, JSGraph* jsgraph,
+                          wasm::FunctionSig* sig,
+                          compiler::SourcePositionTable* spt,
+                          StubCallMode stub_mode)
+      : WasmGraphBuilder(env, zone, jsgraph, sig, spt),
+        isolate_(jsgraph->isolate()),
+        jsgraph_(jsgraph),
+        stub_mode_(stub_mode) {}
+
+  Node* BuildAllocateHeapNumberWithValue(Node* value, Node* control) {
+    MachineOperatorBuilder* machine = mcgraph()->machine();
+    CommonOperatorBuilder* common = mcgraph()->common();
+    Node* target = (stub_mode_ == StubCallMode::kCallWasmRuntimeStub)
+                       ? mcgraph()->RelocatableIntPtrConstant(
+                             wasm::WasmCode::kWasmAllocateHeapNumber,
+                             RelocInfo::WASM_STUB_CALL)
+                       : jsgraph()->HeapConstant(
+                             BUILTIN_CODE(isolate_, AllocateHeapNumber));
+    if (!allocate_heap_number_operator_.is_set()) {
+      auto call_descriptor = Linkage::GetStubCallDescriptor(
+          mcgraph()->zone(), AllocateHeapNumberDescriptor(), 0,
+          CallDescriptor::kNoFlags, Operator::kNoThrow, stub_mode_);
+      allocate_heap_number_operator_.set(common->Call(call_descriptor));
+    }
+    Node* heap_number = graph()->NewNode(allocate_heap_number_operator_.get(),
+                                         target, *effect_, control);
+    Node* store =
+        graph()->NewNode(machine->Store(StoreRepresentation(
+                             MachineRepresentation::kFloat64, kNoWriteBarrier)),
+                         heap_number, BuildHeapNumberValueIndexConstant(),
+                         value, heap_number, control);
+    *effect_ = store;
+    return heap_number;
+  }
+
+  Node* BuildChangeSmiToFloat64(Node* value) {
+    return graph()->NewNode(mcgraph()->machine()->ChangeInt32ToFloat64(),
+                            BuildChangeSmiToInt32(value));
+  }
+
+  Node* BuildTestHeapObject(Node* value) {
+    return graph()->NewNode(mcgraph()->machine()->WordAnd(), value,
+                            mcgraph()->IntPtrConstant(kHeapObjectTag));
+  }
+
+  Node* BuildLoadHeapNumberValue(Node* value) {
+    return *effect_ = graph()->NewNode(
+               mcgraph()->machine()->Load(MachineType::Float64()), value,
+               BuildHeapNumberValueIndexConstant(), *effect_, *control_);
+  }
+
+  Node* BuildHeapNumberValueIndexConstant() {
+    return mcgraph()->IntPtrConstant(HeapNumber::kValueOffset - kHeapObjectTag);
+  }
+
+  Node* BuildChangeInt32ToTagged(Node* value) {
+    MachineOperatorBuilder* machine = mcgraph()->machine();
+    CommonOperatorBuilder* common = mcgraph()->common();
+
+    if (SmiValuesAre32Bits()) {
+      return BuildChangeInt32ToSmi(value);
+    }
+    DCHECK(SmiValuesAre31Bits());
+
+    Node* effect = *effect_;
+    Node* control = *control_;
+    Node* add = graph()->NewNode(machine->Int32AddWithOverflow(), value, value,
+                                 graph()->start());
+
+    Node* ovf = graph()->NewNode(common->Projection(1), add, graph()->start());
+    Node* branch =
+        graph()->NewNode(common->Branch(BranchHint::kFalse), ovf, control);
+
+    Node* if_true = graph()->NewNode(common->IfTrue(), branch);
+    Node* vtrue = BuildAllocateHeapNumberWithValue(
+        graph()->NewNode(machine->ChangeInt32ToFloat64(), value), if_true);
+    Node* etrue = *effect_;
+
+    Node* if_false = graph()->NewNode(common->IfFalse(), branch);
+    Node* vfalse = graph()->NewNode(common->Projection(0), add, if_false);
+    vfalse = BuildChangeInt32ToIntPtr(vfalse);
+
+    Node* merge = graph()->NewNode(common->Merge(2), if_true, if_false);
+    Node* phi = graph()->NewNode(common->Phi(MachineRepresentation::kTagged, 2),
+                                 vtrue, vfalse, merge);
+    *effect_ = graph()->NewNode(common->EffectPhi(2), etrue, effect, merge);
+    *control_ = merge;
+    return phi;
+  }
+
+  Node* BuildChangeFloat64ToTagged(Node* value) {
+    MachineOperatorBuilder* machine = mcgraph()->machine();
+    CommonOperatorBuilder* common = mcgraph()->common();
+
+    // Check several conditions:
+    //  i32?
+    //  ├─ true: zero?
+    //  │        ├─ true: negative?
+    //  │        │        ├─ true: box
+    //  │        │        └─ false: potentially Smi
+    //  │        └─ false: potentially Smi
+    //  └─ false: box
+    // For potential Smi values, depending on whether Smis are 31 or 32 bit, we
+    // still need to check whether the value fits in a Smi.
+
+    Node* effect = *effect_;
+    Node* control = *control_;
+    Node* value32 = graph()->NewNode(machine->RoundFloat64ToInt32(), value);
+    Node* check_i32 = graph()->NewNode(
+        machine->Float64Equal(), value,
+        graph()->NewNode(machine->ChangeInt32ToFloat64(), value32));
+    Node* branch_i32 = graph()->NewNode(common->Branch(), check_i32, control);
+
+    Node* if_i32 = graph()->NewNode(common->IfTrue(), branch_i32);
+    Node* if_not_i32 = graph()->NewNode(common->IfFalse(), branch_i32);
+
+    // We only need to check for -0 if the {value} can potentially contain -0.
+    Node* check_zero = graph()->NewNode(machine->Word32Equal(), value32,
+                                        mcgraph()->Int32Constant(0));
+    Node* branch_zero = graph()->NewNode(common->Branch(BranchHint::kFalse),
+                                         check_zero, if_i32);
+
+    Node* if_zero = graph()->NewNode(common->IfTrue(), branch_zero);
+    Node* if_not_zero = graph()->NewNode(common->IfFalse(), branch_zero);
+
+    // In case of 0, we need to check the high bits for the IEEE -0 pattern.
+    Node* check_negative = graph()->NewNode(
+        machine->Int32LessThan(),
+        graph()->NewNode(machine->Float64ExtractHighWord32(), value),
+        mcgraph()->Int32Constant(0));
+    Node* branch_negative = graph()->NewNode(common->Branch(BranchHint::kFalse),
+                                             check_negative, if_zero);
+
+    Node* if_negative = graph()->NewNode(common->IfTrue(), branch_negative);
+    Node* if_not_negative =
+        graph()->NewNode(common->IfFalse(), branch_negative);
+
+    // We need to create a box for negative 0.
+    Node* if_smi =
+        graph()->NewNode(common->Merge(2), if_not_zero, if_not_negative);
+    Node* if_box = graph()->NewNode(common->Merge(2), if_not_i32, if_negative);
+
+    // On 64-bit machines we can just wrap the 32-bit integer in a smi, for
+    // 32-bit machines we need to deal with potential overflow and fallback to
+    // boxing.
+    Node* vsmi;
+    if (SmiValuesAre32Bits()) {
+      vsmi = BuildChangeInt32ToSmi(value32);
+    } else {
+      DCHECK(SmiValuesAre31Bits());
+      Node* smi_tag = graph()->NewNode(machine->Int32AddWithOverflow(), value32,
+                                       value32, if_smi);
+
+      Node* check_ovf =
+          graph()->NewNode(common->Projection(1), smi_tag, if_smi);
+      Node* branch_ovf = graph()->NewNode(common->Branch(BranchHint::kFalse),
+                                          check_ovf, if_smi);
+
+      Node* if_ovf = graph()->NewNode(common->IfTrue(), branch_ovf);
+      if_box = graph()->NewNode(common->Merge(2), if_ovf, if_box);
+
+      if_smi = graph()->NewNode(common->IfFalse(), branch_ovf);
+      vsmi = graph()->NewNode(common->Projection(0), smi_tag, if_smi);
+      vsmi = BuildChangeInt32ToIntPtr(vsmi);
+    }
+
+    // Allocate the box for the {value}.
+    Node* vbox = BuildAllocateHeapNumberWithValue(value, if_box);
+    Node* ebox = *effect_;
+
+    Node* merge = graph()->NewNode(common->Merge(2), if_smi, if_box);
+    value = graph()->NewNode(common->Phi(MachineRepresentation::kTagged, 2),
+                             vsmi, vbox, merge);
+    *effect_ = graph()->NewNode(common->EffectPhi(2), effect, ebox, merge);
+    *control_ = merge;
+    return value;
+  }
+
+  int AddArgumentNodes(Node** args, int pos, int param_count,
+                       wasm::FunctionSig* sig) {
+    // Convert wasm numbers to JS values.
+    for (int i = 0; i < param_count; ++i) {
+      Node* param =
+          Param(i + 1);  // Start from index 1 to drop the instance_node.
+      args[pos++] = ToJS(param, sig->GetParam(i));
+    }
+    return pos;
+  }
+
+  Node* BuildJavaScriptToNumber(Node* node, Node* js_context) {
+    auto call_descriptor = Linkage::GetStubCallDescriptor(
+        mcgraph()->zone(), TypeConversionDescriptor{}, 0,
+        CallDescriptor::kNoFlags, Operator::kNoProperties, stub_mode_);
+    Node* stub_code =
+        (stub_mode_ == StubCallMode::kCallWasmRuntimeStub)
+            ? mcgraph()->RelocatableIntPtrConstant(
+                  wasm::WasmCode::kWasmToNumber, RelocInfo::WASM_STUB_CALL)
+            : jsgraph()->HeapConstant(BUILTIN_CODE(isolate_, ToNumber));
+
+    Node* result =
+        graph()->NewNode(mcgraph()->common()->Call(call_descriptor), stub_code,
+                         node, js_context, *effect_, *control_);
+
+    SetSourcePosition(result, 1);
+
+    *effect_ = result;
+
+    return result;
+  }
+
+  Node* BuildChangeTaggedToFloat64(Node* value) {
+    MachineOperatorBuilder* machine = mcgraph()->machine();
+    CommonOperatorBuilder* common = mcgraph()->common();
+
+    // Implement the following decision tree:
+    //  heap object?
+    //  ├─ true: undefined?
+    //  │        ├─ true: f64 const
+    //  │        └─ false: load heap number value
+    //  └─ false: smi to float64
+
+    Node* check_heap_object = BuildTestHeapObject(value);
+    Diamond is_heap_object(graph(), common, check_heap_object,
+                           BranchHint::kFalse);
+    is_heap_object.Chain(*control_);
+
+    *control_ = is_heap_object.if_true;
+    Node* orig_effect = *effect_;
+
+    Node* undefined_node = *effect_ =
+        LOAD_INSTANCE_FIELD(UndefinedValue, MachineType::TaggedPointer());
+    Node* check_undefined =
+        graph()->NewNode(machine->WordEqual(), value, undefined_node);
+    Node* effect_tagged = *effect_;
+
+    Diamond is_undefined(graph(), common, check_undefined, BranchHint::kFalse);
+    is_undefined.Nest(is_heap_object, true);
+
+    *control_ = is_undefined.if_false;
+    Node* vheap_number = BuildLoadHeapNumberValue(value);
+    Node* effect_undefined = *effect_;
+
+    *control_ = is_undefined.merge;
+    Node* vundefined =
+        mcgraph()->Float64Constant(std::numeric_limits<double>::quiet_NaN());
+    Node* vtagged = is_undefined.Phi(MachineRepresentation::kFloat64,
+                                     vundefined, vheap_number);
+
+    effect_tagged = is_undefined.EffectPhi(effect_tagged, effect_undefined);
+
+    // If input is Smi: just convert to float64.
+    Node* vfrom_smi = BuildChangeSmiToFloat64(value);
+
+    *control_ = is_heap_object.merge;
+    *effect_ = is_heap_object.EffectPhi(effect_tagged, orig_effect);
+    return is_heap_object.Phi(MachineRepresentation::kFloat64, vtagged,
+                              vfrom_smi);
+  }
+
+  Node* ToJS(Node* node, wasm::ValueType type) {
+    switch (type) {
+      case wasm::kWasmI32:
+        return BuildChangeInt32ToTagged(node);
+      case wasm::kWasmS128:
+      case wasm::kWasmI64:
+        UNREACHABLE();
+      case wasm::kWasmF32:
+        node = graph()->NewNode(mcgraph()->machine()->ChangeFloat32ToFloat64(),
+                                node);
+        return BuildChangeFloat64ToTagged(node);
+      case wasm::kWasmF64:
+        return BuildChangeFloat64ToTagged(node);
+      case wasm::kWasmAnyRef:
+        return node;
+      default:
+        UNREACHABLE();
+    }
+  }
+
+  Node* FromJS(Node* node, Node* js_context, wasm::ValueType type) {
+    DCHECK_NE(wasm::kWasmStmt, type);
+
+    // The parameter is of type AnyRef, we take it as is.
+    if (type == wasm::kWasmAnyRef) {
+      return node;
+    }
+
+    // Do a JavaScript ToNumber.
+    Node* num = BuildJavaScriptToNumber(node, js_context);
+
+    // Change representation.
+    num = BuildChangeTaggedToFloat64(num);
+
+    switch (type) {
+      case wasm::kWasmI32: {
+        num = graph()->NewNode(mcgraph()->machine()->TruncateFloat64ToWord32(),
+                               num);
+        break;
+      }
+      case wasm::kWasmS128:
+      case wasm::kWasmI64:
+        UNREACHABLE();
+      case wasm::kWasmF32:
+        num = graph()->NewNode(mcgraph()->machine()->TruncateFloat64ToFloat32(),
+                               num);
+        break;
+      case wasm::kWasmF64:
+        break;
+      default:
+        UNREACHABLE();
+    }
+    return num;
+  }
+
+  Node* BuildModifyThreadInWasmFlag(bool new_value) {
+    // TODO(eholk): generate code to modify the thread-local storage directly,
+    // rather than calling the runtime.
+    if (!use_trap_handler()) {
+      return *control_;
+    }
+
+    // Using two functions instead of taking the new value as a parameter saves
+    // one instruction on each call to set up the parameter.
+    ExternalReference ref =
+        new_value ? ExternalReference::wasm_set_thread_in_wasm_flag()
+                  : ExternalReference::wasm_clear_thread_in_wasm_flag();
+    MachineSignature sig(0, 0, nullptr);
+    return BuildCCall(
+        &sig, graph()->NewNode(mcgraph()->common()->ExternalConstant(ref)));
+  }
+
+  Node* BuildLoadFunctionDataFromExportedFunction(Node* closure) {
+    Node* shared = *effect_ = graph()->NewNode(
+        jsgraph()->machine()->Load(MachineType::AnyTagged()), closure,
+        jsgraph()->Int32Constant(JSFunction::kSharedFunctionInfoOffset -
+                                 kHeapObjectTag),
+        *effect_, *control_);
+    Node* function_data = *effect_ = graph()->NewNode(
+        jsgraph()->machine()->Load(MachineType::AnyTagged()), shared,
+        jsgraph()->Int32Constant(SharedFunctionInfo::kFunctionDataOffset -
+                                 kHeapObjectTag),
+        *effect_, *control_);
+    return function_data;
+  }
+
+  Node* BuildLoadInstanceFromExportedFunctionData(Node* function_data) {
+    Node* instance = *effect_ = graph()->NewNode(
+        jsgraph()->machine()->Load(MachineType::AnyTagged()), function_data,
+        jsgraph()->Int32Constant(WasmExportedFunctionData::kInstanceOffset -
+                                 kHeapObjectTag),
+        *effect_, *control_);
+    return instance;
+  }
+
+  Node* BuildLoadFunctionIndexFromExportedFunctionData(Node* function_data) {
+    Node* function_index_smi = *effect_ = graph()->NewNode(
+        jsgraph()->machine()->Load(MachineType::AnyTagged()), function_data,
+        jsgraph()->Int32Constant(
+            WasmExportedFunctionData::kFunctionIndexOffset - kHeapObjectTag),
+        *effect_, *control_);
+    Node* function_index = BuildChangeSmiToInt32(function_index_smi);
+    return function_index;
+  }
+
+  void BuildJSToWasmWrapper(bool is_import) {
+    const int wasm_count = static_cast<int>(sig_->parameter_count());
+
+    // Build the start and the JS parameter nodes.
+    Node* start = Start(wasm_count + 5);
+    *control_ = start;
+    *effect_ = start;
+
+    // Create the js_closure and js_context parameters.
+    Node* js_closure =
+        graph()->NewNode(jsgraph()->common()->Parameter(
+                             Linkage::kJSCallClosureParamIndex, "%closure"),
+                         graph()->start());
+    Node* js_context = graph()->NewNode(
+        mcgraph()->common()->Parameter(
+            Linkage::GetJSCallContextParamIndex(wasm_count + 1), "%context"),
+        graph()->start());
+
+    // Create the instance_node node to pass as parameter. It is loaded from
+    // an actual reference to an instance or a placeholder reference,
+    // called {WasmExportedFunction} via the {WasmExportedFunctionData}
+    // structure.
+    Node* function_data = BuildLoadFunctionDataFromExportedFunction(js_closure);
+    instance_node_.set(
+        BuildLoadInstanceFromExportedFunctionData(function_data));
+
+    if (!wasm::IsJSCompatibleSignature(sig_)) {
+      // Throw a TypeError. Use the js_context of the calling javascript
+      // function (passed as a parameter), such that the generated code is
+      // js_context independent.
+      BuildCallToRuntimeWithContext(Runtime::kWasmThrowTypeError, js_context,
+                                    nullptr, 0);
+      Return(jsgraph()->SmiConstant(0));
+      return;
+    }
+
+    const int args_count = wasm_count + 1;  // +1 for wasm_code.
+    Node** args = Buffer(args_count);
+    Node** rets;
+
+    // Convert JS parameters to wasm numbers.
+    for (int i = 0; i < wasm_count; ++i) {
+      Node* param = Param(i + 1);
+      Node* wasm_param = FromJS(param, js_context, sig_->GetParam(i));
+      args[i + 1] = wasm_param;
+    }
+
+    // Set the ThreadInWasm flag before we do the actual call.
+    BuildModifyThreadInWasmFlag(true);
+
+    // Load function index from {WasmExportedFunctionData}.
+    Node* function_index =
+        BuildLoadFunctionIndexFromExportedFunctionData(function_data);
+
+    if (is_import) {
+      // Call to an imported function.
+      BuildImportWasmCall(sig_, args, &rets, wasm::kNoCodePosition,
+                          function_index);
+    } else {
+      // Call to a wasm function defined in this module.
+      // The call target is the jump table slot for that function. This is
+      // {jump_table + (func_index - num_imports) * kJumpTableSlotSize}
+      // == {jump_table_adjusted + func_index * kJumpTableSlotSize}.
+      Node* jump_table_adjusted =
+          LOAD_INSTANCE_FIELD(JumpTableAdjustedStart, MachineType::Pointer());
+      Node* jump_table_offset = graph()->NewNode(
+          mcgraph()->machine()->IntMul(), Uint32ToUintptr(function_index),
+          mcgraph()->IntPtrConstant(
+              wasm::JumpTableAssembler::kJumpTableSlotSize));
+      Node* jump_table_slot =
+          graph()->NewNode(mcgraph()->machine()->IntAdd(), jump_table_adjusted,
+                           jump_table_offset);
+      args[0] = jump_table_slot;
+
+      BuildWasmCall(sig_, args, &rets, wasm::kNoCodePosition, nullptr,
+                    kNoRetpoline);
+    }
+
+    // Clear the ThreadInWasm flag.
+    BuildModifyThreadInWasmFlag(false);
+
+    Node* jsval = sig_->return_count() == 0 ? jsgraph()->UndefinedConstant()
+                                            : ToJS(rets[0], sig_->GetReturn());
+    Return(jsval);
+  }
+
+  bool BuildWasmToJSWrapper(Handle<JSReceiver> target, int index) {
+    DCHECK(target->IsCallable());
+
+    int wasm_count = static_cast<int>(sig_->parameter_count());
+
+    // Build the start and the parameter nodes.
+    Node* start = Start(wasm_count + 3);
+    *effect_ = start;
+    *control_ = start;
+
+    // Create the instance_node from the passed parameter.
+    instance_node_.set(Param(wasm::kWasmInstanceParameterIndex));
+
+    Node* callables_node = LOAD_INSTANCE_FIELD(ImportedFunctionCallables,
+                                               MachineType::TaggedPointer());
+    Node* callable_node = LOAD_FIXED_ARRAY_SLOT(callables_node, index);
+    Node* undefined_node =
+        LOAD_INSTANCE_FIELD(UndefinedValue, MachineType::TaggedPointer());
+    Node* native_context =
+        LOAD_INSTANCE_FIELD(NativeContext, MachineType::TaggedPointer());
+
+    if (!wasm::IsJSCompatibleSignature(sig_)) {
+      // Throw a TypeError.
+      BuildCallToRuntimeWithContext(Runtime::kWasmThrowTypeError,
+                                    native_context, nullptr, 0);
+      // We don't need to return a value here, as the runtime call will not
+      // return anyway (the c entry stub will trigger stack unwinding).
+      ReturnVoid();
+      return false;
+    }
+
+    CallDescriptor* call_descriptor;
+    Node** args = Buffer(wasm_count + 9);
+    Node* call = nullptr;
+
+    BuildModifyThreadInWasmFlag(false);
+
+    if (target->IsJSFunction()) {
+      Handle<JSFunction> function = Handle<JSFunction>::cast(target);
+      FieldAccess field_access = AccessBuilder::ForJSFunctionContext();
+      Node* function_context = graph()->NewNode(
+          mcgraph()->machine()->Load(MachineType::TaggedPointer()),
+          callable_node,
+          mcgraph()->Int32Constant(field_access.offset - field_access.tag()),
+          *effect_, *control_);
+
+      if (!IsClassConstructor(function->shared()->kind())) {
+        if (function->shared()->internal_formal_parameter_count() ==
+            wasm_count) {
+          int pos = 0;
+          args[pos++] = callable_node;  // target callable.
+          // Receiver.
+          if (is_sloppy(function->shared()->language_mode()) &&
+              !function->shared()->native()) {
+            Node* global_proxy = LOAD_FIXED_ARRAY_SLOT(
+                native_context, Context::GLOBAL_PROXY_INDEX);
+            args[pos++] = global_proxy;
+          } else {
+            args[pos++] = undefined_node;
+          }
+
+          call_descriptor = Linkage::GetJSCallDescriptor(
+              graph()->zone(), false, wasm_count + 1, CallDescriptor::kNoFlags);
+
+          // Convert wasm numbers to JS values.
+          pos = AddArgumentNodes(args, pos, wasm_count, sig_);
+
+          args[pos++] = undefined_node;                        // new target
+          args[pos++] = mcgraph()->Int32Constant(wasm_count);  // argument count
+          args[pos++] = function_context;
+          args[pos++] = *effect_;
+          args[pos++] = *control_;
+
+          call = graph()->NewNode(mcgraph()->common()->Call(call_descriptor),
+                                  pos, args);
+        } else if (function->shared()->internal_formal_parameter_count() >= 0) {
+          int pos = 0;
+          args[pos++] = mcgraph()->RelocatableIntPtrConstant(
+              wasm::WasmCode::kWasmArgumentsAdaptor, RelocInfo::WASM_STUB_CALL);
+          args[pos++] = callable_node;   // target callable
+          args[pos++] = undefined_node;  // new target
+          args[pos++] = mcgraph()->Int32Constant(wasm_count);  // argument count
+          args[pos++] = mcgraph()->Int32Constant(
+              function->shared()->internal_formal_parameter_count());
+          // Receiver.
+          if (is_sloppy(function->shared()->language_mode()) &&
+              !function->shared()->native()) {
+            Node* global_proxy = LOAD_FIXED_ARRAY_SLOT(
+                native_context, Context::GLOBAL_PROXY_INDEX);
+            args[pos++] = global_proxy;
+          } else {
+            args[pos++] = undefined_node;
+          }
+
+          call_descriptor = Linkage::GetStubCallDescriptor(
+              mcgraph()->zone(), ArgumentAdaptorDescriptor{}, 1 + wasm_count,
+              CallDescriptor::kNoFlags, Operator::kNoProperties,
+              StubCallMode::kCallWasmRuntimeStub);
+
+          // Convert wasm numbers to JS values.
+          pos = AddArgumentNodes(args, pos, wasm_count, sig_);
+          args[pos++] = function_context;
+          args[pos++] = *effect_;
+          args[pos++] = *control_;
+          call = graph()->NewNode(mcgraph()->common()->Call(call_descriptor),
+                                  pos, args);
+        }
+      }
+    }
+
+    // We cannot call the target directly, we have to use the Call builtin.
+    if (!call) {
+      int pos = 0;
+      args[pos++] = mcgraph()->RelocatableIntPtrConstant(
+          wasm::WasmCode::kWasmCallJavaScript, RelocInfo::WASM_STUB_CALL);
+      args[pos++] = callable_node;
+      args[pos++] = mcgraph()->Int32Constant(wasm_count);  // argument count
+      args[pos++] = undefined_node;                        // receiver
+
+      call_descriptor = Linkage::GetStubCallDescriptor(
+          graph()->zone(), CallTrampolineDescriptor{}, wasm_count + 1,
+          CallDescriptor::kNoFlags, Operator::kNoProperties,
+          StubCallMode::kCallWasmRuntimeStub);
+
+      // Convert wasm numbers to JS values.
+      pos = AddArgumentNodes(args, pos, wasm_count, sig_);
+
+      // The native_context is sufficient here, because all kind of callables
+      // which depend on the context provide their own context. The context here
+      // is only needed if the target is a constructor to throw a TypeError, if
+      // the target is a native function, or if the target is a callable
+      // JSObject, which can only be constructed by the runtime.
+      args[pos++] = native_context;
+      args[pos++] = *effect_;
+      args[pos++] = *control_;
+
+      call = graph()->NewNode(mcgraph()->common()->Call(call_descriptor), pos,
+                              args);
+    }
+
+    *effect_ = call;
+    SetSourcePosition(call, 0);
+
+    // Convert the return value back.
+    Node* val = sig_->return_count() == 0
+                    ? mcgraph()->Int32Constant(0)
+                    : FromJS(call, native_context, sig_->GetReturn());
+
+    BuildModifyThreadInWasmFlag(true);
+
+    Return(val);
+    return true;
+  }
+
+  void BuildWasmInterpreterEntry(uint32_t func_index) {
+    int param_count = static_cast<int>(sig_->parameter_count());
+
+    // Build the start and the parameter nodes.
+    Node* start = Start(param_count + 3);
+    *effect_ = start;
+    *control_ = start;
+
+    // Create the instance_node from the passed parameter.
+    instance_node_.set(Param(wasm::kWasmInstanceParameterIndex));
+
+    // Compute size for the argument buffer.
+    int args_size_bytes = 0;
+    for (wasm::ValueType type : sig_->parameters()) {
+      args_size_bytes += wasm::ValueTypes::ElementSizeInBytes(type);
+    }
+
+    // The return value is also passed via this buffer:
+    DCHECK_GE(wasm::kV8MaxWasmFunctionReturns, sig_->return_count());
+    // TODO(wasm): Handle multi-value returns.
+    DCHECK_EQ(1, wasm::kV8MaxWasmFunctionReturns);
+    int return_size_bytes =
+        sig_->return_count() == 0
+            ? 0
+            : wasm::ValueTypes::ElementSizeInBytes(sig_->GetReturn());
+
+    // Get a stack slot for the arguments.
+    Node* arg_buffer =
+        args_size_bytes == 0 && return_size_bytes == 0
+            ? mcgraph()->IntPtrConstant(0)
+            : graph()->NewNode(mcgraph()->machine()->StackSlot(
+                  std::max(args_size_bytes, return_size_bytes), 8));
+
+    // Now store all our arguments to the buffer.
+    int offset = 0;
+
+    for (int i = 0; i < param_count; ++i) {
+      wasm::ValueType type = sig_->GetParam(i);
+      // Start from the parameter with index 1 to drop the instance_node.
+      *effect_ = graph()->NewNode(GetSafeStoreOperator(offset, type),
+                                  arg_buffer, Int32Constant(offset),
+                                  Param(i + 1), *effect_, *control_);
+      offset += wasm::ValueTypes::ElementSizeInBytes(type);
+    }
+    DCHECK_EQ(args_size_bytes, offset);
+
+    // We are passing the raw arg_buffer here. To the GC and other parts, it
+    // looks like a Smi (lowest bit not set). In the runtime function however,
+    // don't call Smi::value on it, but just cast it to a byte pointer.
+    Node* parameters[] = {
+        jsgraph()->SmiConstant(func_index), arg_buffer,
+    };
+    BuildCallToRuntime(Runtime::kWasmRunInterpreter, parameters,
+                       arraysize(parameters));
+
+    // Read back the return value.
+    if (sig_->return_count() == 0) {
+      Return(Int32Constant(0));
+    } else {
+      // TODO(wasm): Implement multi-return.
+      DCHECK_EQ(1, sig_->return_count());
+      MachineType load_rep =
+          wasm::ValueTypes::MachineTypeFor(sig_->GetReturn());
+      Node* val =
+          graph()->NewNode(mcgraph()->machine()->Load(load_rep), arg_buffer,
+                           Int32Constant(0), *effect_, *control_);
+      Return(val);
+    }
+
+    if (ContainsInt64(sig_)) LowerInt64();
+  }
+
+  void BuildCWasmEntry() {
+    // Build the start and the JS parameter nodes.
+    Node* start = Start(CWasmEntryParameters::kNumParameters + 5);
+    *control_ = start;
+    *effect_ = start;
+
+    // Create parameter nodes (offset by 1 for the receiver parameter).
+    Node* foreign_code_obj = Param(CWasmEntryParameters::kCodeObject + 1);
+    MachineOperatorBuilder* machine = mcgraph()->machine();
+    Node* code_obj = graph()->NewNode(
+        machine->Load(MachineType::Pointer()), foreign_code_obj,
+        Int32Constant(Foreign::kForeignAddressOffset - kHeapObjectTag),
+        *effect_, *control_);
+    Node* instance_node = Param(CWasmEntryParameters::kWasmInstance + 1);
+    Node* arg_buffer = Param(CWasmEntryParameters::kArgumentsBuffer + 1);
+
+    int wasm_arg_count = static_cast<int>(sig_->parameter_count());
+    int arg_count = wasm_arg_count + 4;  // code, instance_node, control, effect
+    Node** args = Buffer(arg_count);
+
+    int pos = 0;
+    args[pos++] = code_obj;
+    args[pos++] = instance_node;
+
+    int offset = 0;
+    for (wasm::ValueType type : sig_->parameters()) {
+      Node* arg_load =
+          graph()->NewNode(GetSafeLoadOperator(offset, type), arg_buffer,
+                           Int32Constant(offset), *effect_, *control_);
+      *effect_ = arg_load;
+      args[pos++] = arg_load;
+      offset += wasm::ValueTypes::ElementSizeInBytes(type);
+    }
+
+    args[pos++] = *effect_;
+    args[pos++] = *control_;
+    DCHECK_EQ(arg_count, pos);
+
+    // Call the wasm code.
+    auto call_descriptor = GetWasmCallDescriptor(mcgraph()->zone(), sig_);
+
+    Node* call = graph()->NewNode(mcgraph()->common()->Call(call_descriptor),
+                                  arg_count, args);
+    *effect_ = call;
+
+    // Store the return value.
+    DCHECK_GE(1, sig_->return_count());
+    if (sig_->return_count() == 1) {
+      StoreRepresentation store_rep(
+          wasm::ValueTypes::MachineRepresentationFor(sig_->GetReturn()),
+          kNoWriteBarrier);
+      Node* store =
+          graph()->NewNode(mcgraph()->machine()->Store(store_rep), arg_buffer,
+                           Int32Constant(0), call, *effect_, *control_);
+      *effect_ = store;
+    }
+    Return(jsgraph()->SmiConstant(0));
+
+    if (mcgraph()->machine()->Is32() && ContainsInt64(sig_)) {
+      MachineRepresentation sig_reps[] = {
+          MachineRepresentation::kWord32,  // return value
+          MachineRepresentation::kTagged,  // receiver
+          MachineRepresentation::kTagged,  // arg0 (code)
+          MachineRepresentation::kTagged   // arg1 (buffer)
+      };
+      Signature<MachineRepresentation> c_entry_sig(1, 2, sig_reps);
+      Int64Lowering r(mcgraph()->graph(), mcgraph()->machine(),
+                      mcgraph()->common(), mcgraph()->zone(), &c_entry_sig);
+      r.LowerGraph();
+    }
+  }
+
+  JSGraph* jsgraph() { return jsgraph_; }
+
+ private:
+  Isolate* const isolate_;
+  JSGraph* jsgraph_;
+  StubCallMode stub_mode_;
+  SetOncePointer<const Operator> allocate_heap_number_operator_;
+};
 }  // namespace
 
-Handle<Code> CompileJSToWasmWrapper(Isolate* isolate, wasm::WasmModule* module,
-                                    Handle<WeakCell> weak_instance,
-                                    wasm::WasmCode* wasm_code, uint32_t index,
-                                    bool use_trap_handler) {
-  const wasm::WasmFunction* func = &module->functions[index];
+MaybeHandle<Code> CompileJSToWasmWrapper(
+    Isolate* isolate, const wasm::NativeModule* native_module,
+    wasm::FunctionSig* sig, bool is_import,
+    wasm::UseTrapHandler use_trap_handler) {
+  const wasm::WasmModule* module = native_module->module();
 
   //----------------------------------------------------------------------------
-  // Create the Graph
+  // Create the Graph.
   //----------------------------------------------------------------------------
   Zone zone(isolate->allocator(), ZONE_NAME);
   Graph graph(&zone);
@@ -4668,31 +4819,16 @@ Handle<Code> CompileJSToWasmWrapper(Isolate* isolate, wasm::WasmModule* module,
   Node* control = nullptr;
   Node* effect = nullptr;
 
-  // TODO(titzer): compile JS to WASM wrappers without a {ModuleEnv}.
-  ModuleEnv env(module, use_trap_handler);
-
-  WasmGraphBuilder builder(&env, &zone, &jsgraph,
-                           CEntryStub(isolate, 1).GetCode(),
-                           isolate->factory()->null_value(), func->sig);
+  wasm::ModuleEnv env(module, use_trap_handler, wasm::kRuntimeExceptionSupport);
+  WasmWrapperGraphBuilder builder(&zone, &env, &jsgraph, sig, nullptr,
+                                  StubCallMode::kCallOnHeapBuiltin);
   builder.set_control_ptr(&control);
   builder.set_effect_ptr(&effect);
-  builder.BuildJSToWasmWrapper(weak_instance, wasm_code);
+  builder.BuildJSToWasmWrapper(is_import);
 
   //----------------------------------------------------------------------------
   // Run the compilation pipeline.
   //----------------------------------------------------------------------------
-  if (FLAG_trace_turbo_graph) {  // Simple textual RPO.
-    OFStream os(stdout);
-    os << "-- Graph after change lowering -- " << std::endl;
-    os << AsRPO(graph);
-  }
-
-  // Schedule and compile to machine code.
-  int params =
-      static_cast<int>(module->functions[index].sig->parameter_count());
-  CallDescriptor* incoming = Linkage::GetJSCallDescriptor(
-      &zone, false, params + 1, CallDescriptor::kNoFlags);
-
 #ifdef DEBUG
   EmbeddedVector<char, 32> func_name;
   static unsigned id = 0;
@@ -4702,10 +4838,25 @@ Handle<Code> CompileJSToWasmWrapper(Isolate* isolate, wasm::WasmModule* module,
 #endif
 
   OptimizedCompilationInfo info(func_name, &zone, Code::JS_TO_WASM_FUNCTION);
-  Handle<Code> code =
-      Pipeline::GenerateCodeForTesting(&info, isolate, incoming, &graph);
+
+  if (info.trace_turbo_graph_enabled()) {  // Simple textual RPO.
+    StdoutStream{} << "-- Graph after change lowering -- " << std::endl
+                   << AsRPO(graph);
+  }
+
+  // Schedule and compile to machine code.
+  int params = static_cast<int>(sig->parameter_count());
+  CallDescriptor* incoming = Linkage::GetJSCallDescriptor(
+      &zone, false, params + 1, CallDescriptor::kNoFlags);
+
+  MaybeHandle<Code> maybe_code = Pipeline::GenerateCodeForTesting(
+      &info, isolate, incoming, &graph, WasmAssemblerOptions(isolate));
+  Handle<Code> code;
+  if (!maybe_code.ToHandle(&code)) {
+    return maybe_code;
+  }
 #ifdef ENABLE_DISASSEMBLER
-  if (FLAG_print_opt_code && !code.is_null()) {
+  if (FLAG_print_opt_code) {
     CodeTracer::Scope tracing_scope(isolate->GetCodeTracer());
     OFStream os(tracing_scope.file());
     code->Disassemble(func_name.start(), os);
@@ -4720,51 +4871,10 @@ Handle<Code> CompileJSToWasmWrapper(Isolate* isolate, wasm::WasmModule* module,
   return code;
 }
 
-namespace {
-
-void ValidateImportWrapperReferencesImmovables(Handle<Code> wrapper) {
-#ifdef DEBUG
-  // We expect the only embedded objects to be those originating from
-  // a snapshot, which are immovable.
-  DisallowHeapAllocation no_gc;
-  if (wrapper.is_null()) return;
-  static constexpr int kAllGCRefs = (1 << (RelocInfo::LAST_GCED_ENUM + 1)) - 1;
-  for (RelocIterator it(*wrapper, kAllGCRefs); !it.done(); it.next()) {
-    RelocInfo::Mode mode = it.rinfo()->rmode();
-    Object* target = nullptr;
-    switch (mode) {
-      case RelocInfo::CODE_TARGET:
-        // this would be either one of the stubs or builtins, because
-        // we didn't link yet.
-        target = Code::GetCodeFromTargetAddress(it.rinfo()->target_address());
-        break;
-      case RelocInfo::EMBEDDED_OBJECT:
-        target = it.rinfo()->target_object();
-        break;
-      default:
-        UNREACHABLE();
-    }
-    DCHECK_NOT_NULL(target);
-    bool is_immovable =
-        target->IsSmi() || Heap::IsImmovable(HeapObject::cast(target));
-    bool is_allowed_stub = false;
-    if (target->IsCode()) {
-      Code* code = Code::cast(target);
-      is_allowed_stub =
-          code->kind() == Code::STUB &&
-          CodeStub::MajorKeyFromKey(code->stub_key()) == CodeStub::DoubleToI;
-    }
-    DCHECK(is_immovable || is_allowed_stub);
-  }
-#endif
-}
-
-}  // namespace
-
-Handle<Code> CompileWasmToJSWrapper(Isolate* isolate, Handle<JSReceiver> target,
-                                    wasm::FunctionSig* sig, uint32_t index,
-                                    wasm::ModuleOrigin origin,
-                                    bool use_trap_handler) {
+MaybeHandle<Code> CompileWasmToJSWrapper(
+    Isolate* isolate, Handle<JSReceiver> target, wasm::FunctionSig* sig,
+    uint32_t index, wasm::ModuleOrigin origin,
+    wasm::UseTrapHandler use_trap_handler) {
   //----------------------------------------------------------------------------
   // Create the Graph
   //----------------------------------------------------------------------------
@@ -4784,26 +4894,16 @@ Handle<Code> CompileWasmToJSWrapper(Isolate* isolate, Handle<JSReceiver> target,
       origin == wasm::kAsmJsOrigin ? new (&zone) SourcePositionTable(&graph)
                                    : nullptr;
 
-  ModuleEnv env(nullptr, use_trap_handler);
-  WasmGraphBuilder builder(
-      &env, &zone, &jsgraph, CEntryStub(isolate, 1).GetCode(),
-      isolate->factory()->null_value(), sig, source_position_table);
+  wasm::ModuleEnv env(nullptr, use_trap_handler,
+                      wasm::kRuntimeExceptionSupport);
+
+  WasmWrapperGraphBuilder builder(&zone, &env, &jsgraph, sig,
+                                  source_position_table,
+                                  StubCallMode::kCallWasmRuntimeStub);
   builder.set_control_ptr(&control);
   builder.set_effect_ptr(&effect);
   builder.BuildWasmToJSWrapper(target, index);
 
-  if (FLAG_trace_turbo_graph) {  // Simple textual RPO.
-    OFStream os(stdout);
-    os << "-- Graph after change lowering -- " << std::endl;
-    os << AsRPO(graph);
-  }
-
-  // Schedule and compile to machine code.
-  CallDescriptor* incoming = GetWasmCallDescriptor(&zone, sig);
-  if (machine.Is32()) {
-    incoming = GetI32WasmCallDescriptor(&zone, incoming);
-  }
-
 #ifdef DEBUG
   EmbeddedVector<char, 32> func_name;
   static unsigned id = 0;
@@ -4813,12 +4913,26 @@ Handle<Code> CompileWasmToJSWrapper(Isolate* isolate, Handle<JSReceiver> target,
 #endif
 
   OptimizedCompilationInfo info(func_name, &zone, Code::WASM_TO_JS_FUNCTION);
-  Handle<Code> code = Pipeline::GenerateCodeForTesting(
-      &info, isolate, incoming, &graph, nullptr, source_position_table);
-  ValidateImportWrapperReferencesImmovables(code);
 
+  if (info.trace_turbo_graph_enabled()) {  // Simple textual RPO.
+    StdoutStream{} << "-- Graph after change lowering -- " << std::endl
+                   << AsRPO(graph);
+  }
+
+  // Schedule and compile to machine code.
+  CallDescriptor* incoming = GetWasmCallDescriptor(&zone, sig);
+  if (machine.Is32()) {
+    incoming = GetI32WasmCallDescriptor(&zone, incoming);
+  }
+  MaybeHandle<Code> maybe_code = Pipeline::GenerateCodeForTesting(
+      &info, isolate, incoming, &graph, AssemblerOptions::Default(isolate),
+      nullptr, source_position_table);
+  Handle<Code> code;
+  if (!maybe_code.ToHandle(&code)) {
+    return maybe_code;
+  }
 #ifdef ENABLE_DISASSEMBLER
-  if (FLAG_print_opt_code && !code.is_null()) {
+  if (FLAG_print_opt_code) {
     CodeTracer::Scope tracing_scope(isolate->GetCodeTracer());
     OFStream os(tracing_scope.file());
     code->Disassemble(func_name.start(), os);
@@ -4833,8 +4947,9 @@ Handle<Code> CompileWasmToJSWrapper(Isolate* isolate, Handle<JSReceiver> target,
   return code;
 }
 
-Handle<Code> CompileWasmInterpreterEntry(Isolate* isolate, uint32_t func_index,
-                                         wasm::FunctionSig* sig) {
+MaybeHandle<Code> CompileWasmInterpreterEntry(Isolate* isolate,
+                                              uint32_t func_index,
+                                              wasm::FunctionSig* sig) {
   //----------------------------------------------------------------------------
   // Create the Graph
   //----------------------------------------------------------------------------
@@ -4850,56 +4965,56 @@ Handle<Code> CompileWasmInterpreterEntry(Isolate* isolate, uint32_t func_index,
   Node* control = nullptr;
   Node* effect = nullptr;
 
-  WasmGraphBuilder builder(nullptr, &zone, &jsgraph,
-                           CEntryStub(isolate, 1).GetCode(),
-                           isolate->factory()->null_value(), sig);
+  WasmWrapperGraphBuilder builder(&zone, nullptr, &jsgraph, sig, nullptr,
+                                  StubCallMode::kCallWasmRuntimeStub);
   builder.set_control_ptr(&control);
   builder.set_effect_ptr(&effect);
   builder.BuildWasmInterpreterEntry(func_index);
 
-  Handle<Code> code = Handle<Code>::null();
-  {
-    if (FLAG_trace_turbo_graph) {  // Simple textual RPO.
-      OFStream os(stdout);
-      os << "-- Wasm interpreter entry graph -- " << std::endl;
-      os << AsRPO(graph);
-    }
-
-    // Schedule and compile to machine code.
-    CallDescriptor* incoming = GetWasmCallDescriptor(&zone, sig);
-    if (machine.Is32()) {
-      incoming = GetI32WasmCallDescriptor(&zone, incoming);
-    }
+  // Schedule and compile to machine code.
+  CallDescriptor* incoming = GetWasmCallDescriptor(&zone, sig);
+  if (machine.Is32()) {
+    incoming = GetI32WasmCallDescriptor(&zone, incoming);
+  }
 #ifdef DEBUG
-    EmbeddedVector<char, 32> func_name;
-    func_name.Truncate(
-        SNPrintF(func_name, "wasm-interpreter-entry#%d", func_index));
+  EmbeddedVector<char, 32> func_name;
+  func_name.Truncate(
+      SNPrintF(func_name, "wasm-interpreter-entry#%d", func_index));
 #else
-    Vector<const char> func_name = CStrVector("wasm-interpreter-entry");
+  Vector<const char> func_name = CStrVector("wasm-interpreter-entry");
 #endif
 
-    OptimizedCompilationInfo info(func_name, &zone,
-                                  Code::WASM_INTERPRETER_ENTRY);
-    code = Pipeline::GenerateCodeForTesting(&info, isolate, incoming, &graph,
-                                            nullptr);
+  OptimizedCompilationInfo info(func_name, &zone, Code::WASM_INTERPRETER_ENTRY);
+
+  if (info.trace_turbo_graph_enabled()) {  // Simple textual RPO.
+    StdoutStream{} << "-- Wasm interpreter entry graph -- " << std::endl
+                   << AsRPO(graph);
+  }
+
+  MaybeHandle<Code> maybe_code = Pipeline::GenerateCodeForTesting(
+      &info, isolate, incoming, &graph, AssemblerOptions::Default(isolate),
+      nullptr);
+  Handle<Code> code;
+  if (!maybe_code.ToHandle(&code)) {
+    return maybe_code;
+  }
 #ifdef ENABLE_DISASSEMBLER
-    if (FLAG_print_opt_code && !code.is_null()) {
-      CodeTracer::Scope tracing_scope(isolate->GetCodeTracer());
-      OFStream os(tracing_scope.file());
-      code->Disassemble(func_name.start(), os);
-    }
+  if (FLAG_print_opt_code) {
+    CodeTracer::Scope tracing_scope(isolate->GetCodeTracer());
+    OFStream os(tracing_scope.file());
+    code->Disassemble(func_name.start(), os);
+  }
 #endif
 
-    if (must_record_function_compilation(isolate)) {
-      RecordFunctionCompilation(CodeEventListener::STUB_TAG, isolate, code,
-                                "%.*s", func_name.length(), func_name.start());
-    }
+  if (must_record_function_compilation(isolate)) {
+    RecordFunctionCompilation(CodeEventListener::STUB_TAG, isolate, code,
+                              "%.*s", func_name.length(), func_name.start());
   }
 
-  return code;
+  return maybe_code;
 }
 
-Handle<Code> CompileCWasmEntry(Isolate* isolate, wasm::FunctionSig* sig) {
+MaybeHandle<Code> CompileCWasmEntry(Isolate* isolate, wasm::FunctionSig* sig) {
   Zone zone(isolate->allocator(), ZONE_NAME);
   Graph graph(&zone);
   CommonOperatorBuilder common(&zone);
@@ -4912,19 +5027,12 @@ Handle<Code> CompileCWasmEntry(Isolate* isolate, wasm::FunctionSig* sig) {
   Node* control = nullptr;
   Node* effect = nullptr;
 
-  WasmGraphBuilder builder(nullptr, &zone, &jsgraph,
-                           CEntryStub(isolate, 1).GetCode(),
-                           isolate->factory()->null_value(), sig);
+  WasmWrapperGraphBuilder builder(&zone, nullptr, &jsgraph, sig, nullptr,
+                                  StubCallMode::kCallOnHeapBuiltin);
   builder.set_control_ptr(&control);
   builder.set_effect_ptr(&effect);
   builder.BuildCWasmEntry();
 
-  if (FLAG_trace_turbo_graph) {  // Simple textual RPO.
-    OFStream os(stdout);
-    os << "-- C Wasm entry graph -- " << std::endl;
-    os << AsRPO(graph);
-  }
-
   // Schedule and compile to machine code.
   CallDescriptor* incoming = Linkage::GetJSCallDescriptor(
       &zone, false, CWasmEntryParameters::kNumParameters + 1,
@@ -4938,20 +5046,29 @@ Handle<Code> CompileCWasmEntry(Isolate* isolate, wasm::FunctionSig* sig) {
     if (name_len + 1 < kMaxNameLen) debug_name[name_len++] = c;
   };
   for (wasm::ValueType t : sig->parameters()) {
-    append_name_char(wasm::WasmOpcodes::ShortNameOf(t));
+    append_name_char(wasm::ValueTypes::ShortNameOf(t));
   }
   append_name_char(':');
   for (wasm::ValueType t : sig->returns()) {
-    append_name_char(wasm::WasmOpcodes::ShortNameOf(t));
+    append_name_char(wasm::ValueTypes::ShortNameOf(t));
   }
   debug_name[name_len] = '\0';
   Vector<const char> debug_name_vec(debug_name, name_len);
 
   OptimizedCompilationInfo info(debug_name_vec, &zone, Code::C_WASM_ENTRY);
-  Handle<Code> code =
-      Pipeline::GenerateCodeForTesting(&info, isolate, incoming, &graph);
+
+  if (info.trace_turbo_graph_enabled()) {  // Simple textual RPO.
+    StdoutStream{} << "-- C Wasm entry graph -- " << std::endl << AsRPO(graph);
+  }
+
+  MaybeHandle<Code> maybe_code = Pipeline::GenerateCodeForTesting(
+      &info, isolate, incoming, &graph, AssemblerOptions::Default(isolate));
+  Handle<Code> code;
+  if (!maybe_code.ToHandle(&code)) {
+    return maybe_code;
+  }
 #ifdef ENABLE_DISASSEMBLER
-  if (FLAG_print_opt_code && !code.is_null()) {
+  if (FLAG_print_opt_code) {
     CodeTracer::Scope tracing_scope(isolate->GetCodeTracer());
     OFStream os(tracing_scope.file());
     code->Disassemble(debug_name, os);
@@ -4961,47 +5078,33 @@ Handle<Code> CompileCWasmEntry(Isolate* isolate, wasm::FunctionSig* sig) {
   return code;
 }
 
-WasmCompilationData::WasmCompilationData(
-    RuntimeExceptionSupport runtime_exception_support)
-    : protected_instructions_(
-          new std::vector<trap_handler::ProtectedInstructionData>()),
-      runtime_exception_support_(runtime_exception_support) {}
+TurbofanWasmCompilationUnit::TurbofanWasmCompilationUnit(
+    wasm::WasmCompilationUnit* wasm_unit)
+    : wasm_unit_(wasm_unit),
+      wasm_compilation_data_(wasm_unit->env_->runtime_exception_support) {}
 
-void WasmCompilationData::AddProtectedInstruction(uint32_t instr_offset,
-                                                  uint32_t landing_offset) {
-  protected_instructions_->emplace_back(
-      trap_handler::ProtectedInstructionData{instr_offset, landing_offset});
-}
-
-int FixedArrayOffsetMinusTag(uint32_t index) {
-  auto access = AccessBuilder::ForFixedArraySlot(index);
-  return access.offset - access.tag();
-}
+// Clears unique_ptrs, but (part of) the type is forward declared in the header.
+TurbofanWasmCompilationUnit::~TurbofanWasmCompilationUnit() = default;
 
-SourcePositionTable* WasmCompilationUnit::BuildGraphForWasmFunction(
-    double* decode_ms) {
+SourcePositionTable* TurbofanWasmCompilationUnit::BuildGraphForWasmFunction(
+    double* decode_ms, NodeOriginTable* node_origins) {
   base::ElapsedTimer decode_timer;
   if (FLAG_trace_wasm_decode_time) {
     decode_timer.Start();
   }
-  // Create a TF graph during decoding.
 
+  // Create a TF graph during decoding.
   SourcePositionTable* source_position_table =
-      new (tf_.jsgraph_->zone()) SourcePositionTable(tf_.jsgraph_->graph());
-  // We get the handle for {null_value()} directly from the isolate although we
-  // are on a background task because the handle is stored in the isolate
-  // anyways, and it is immortal and immovable.
-  WasmGraphBuilder builder(env_, tf_.jsgraph_->zone(), tf_.jsgraph_,
-                           centry_stub_, isolate_->factory()->null_value(),
-                           func_body_.sig, source_position_table,
-                           wasm_compilation_data_.runtime_exception_support());
-  tf_.graph_construction_result_ =
-      wasm::BuildTFGraph(isolate_->allocator(), &builder, func_body_);
-  if (tf_.graph_construction_result_.failed()) {
+      new (mcgraph_->zone()) SourcePositionTable(mcgraph_->graph());
+  WasmGraphBuilder builder(wasm_unit_->env_, mcgraph_->zone(), mcgraph_,
+                           wasm_unit_->func_body_.sig, source_position_table);
+  graph_construction_result_ =
+      wasm::BuildTFGraph(wasm_unit_->isolate_->allocator(), &builder,
+                         wasm_unit_->func_body_, node_origins);
+  if (graph_construction_result_.failed()) {
     if (FLAG_trace_wasm_compiler) {
-      OFStream os(stdout);
-      os << "Compilation failed: " << tf_.graph_construction_result_.error_msg()
-         << std::endl;
+      StdoutStream{} << "Compilation failed: "
+                     << graph_construction_result_.error_msg() << std::endl;
     }
     return nullptr;
   }
@@ -5009,14 +5112,17 @@ SourcePositionTable* WasmCompilationUnit::BuildGraphForWasmFunction(
   builder.LowerInt64();
 
   if (builder.has_simd() &&
-      (!CpuFeatures::SupportsWasmSimd128() || lower_simd_)) {
-    SimdScalarLowering(tf_.jsgraph_, func_body_.sig).LowerGraph();
+      (!CpuFeatures::SupportsWasmSimd128() || wasm_unit_->lower_simd_)) {
+    SimdScalarLowering(
+        mcgraph_,
+        CreateMachineSignature(mcgraph_->zone(), wasm_unit_->func_body_.sig))
+        .LowerGraph();
   }
 
-  if (func_index_ >= FLAG_trace_wasm_ast_start &&
-      func_index_ < FLAG_trace_wasm_ast_end) {
-    PrintRawWasmCode(isolate_->allocator(), func_body_, env_->module,
-                     wasm::kPrintLocals);
+  if (wasm_unit_->func_index_ >= FLAG_trace_wasm_ast_start &&
+      wasm_unit_->func_index_ < FLAG_trace_wasm_ast_end) {
+    PrintRawWasmCode(wasm_unit_->isolate_->allocator(), wasm_unit_->func_body_,
+                     wasm_unit_->env_->module, wasm::kPrintLocals);
   }
   if (FLAG_trace_wasm_decode_time) {
     *decode_ms = decode_timer.Elapsed().InMillisecondsF();
@@ -5046,181 +5152,105 @@ Vector<const char> GetDebugName(Zone* zone, wasm::WasmName name, int index) {
 
 }  // namespace
 
-// static
-WasmCompilationUnit::CompilationMode
-WasmCompilationUnit::GetDefaultCompilationMode() {
-  return FLAG_liftoff ? WasmCompilationUnit::CompilationMode::kLiftoff
-                      : WasmCompilationUnit::CompilationMode::kTurbofan;
-}
-
-WasmCompilationUnit::WasmCompilationUnit(
-    Isolate* isolate, ModuleEnv* env, wasm::NativeModule* native_module,
-    wasm::FunctionBody body, wasm::WasmName name, int index,
-    Handle<Code> centry_stub, CompilationMode mode, Counters* counters,
-    RuntimeExceptionSupport exception_support, bool lower_simd)
-    : isolate_(isolate),
-      env_(env),
-      func_body_(body),
-      func_name_(name),
-      counters_(counters ? counters : isolate->counters()),
-      centry_stub_(centry_stub),
-      func_index_(index),
-      native_module_(native_module),
-      lower_simd_(lower_simd),
-      wasm_compilation_data_(exception_support),
-      mode_(mode) {
-  switch (mode_) {
-    case WasmCompilationUnit::CompilationMode::kLiftoff:
-      new (&liftoff_) LiftoffData(isolate);
-      break;
-    case WasmCompilationUnit::CompilationMode::kTurbofan:
-      new (&tf_) TurbofanData();
-      break;
-  }
-}
-
-WasmCompilationUnit::~WasmCompilationUnit() {
-  switch (mode_) {
-    case WasmCompilationUnit::CompilationMode::kLiftoff:
-      liftoff_.~LiftoffData();
-      break;
-    case WasmCompilationUnit::CompilationMode::kTurbofan:
-      tf_.~TurbofanData();
-      break;
-  }
-}
-
-void WasmCompilationUnit::ExecuteCompilation() {
-  auto size_histogram = env_->module->is_wasm()
-                            ? counters()->wasm_wasm_function_size_bytes()
-                            : counters()->wasm_asm_function_size_bytes();
-  size_histogram->AddSample(
-      static_cast<int>(func_body_.end - func_body_.start));
-  auto timed_histogram = env_->module->is_wasm()
-                             ? counters()->wasm_compile_wasm_function_time()
-                             : counters()->wasm_compile_asm_function_time();
-  TimedHistogramScope wasm_compile_function_time_scope(timed_histogram);
-
-  if (FLAG_trace_wasm_compiler) {
-    PrintF("Compiling wasm function %d\n\n", func_index_);
-  }
-
-  switch (mode_) {
-    case WasmCompilationUnit::CompilationMode::kLiftoff:
-      if (ExecuteLiftoffCompilation()) break;
-      // Otherwise, fall back to turbofan.
-      liftoff_.~LiftoffData();
-      mode_ = WasmCompilationUnit::CompilationMode::kTurbofan;
-      new (&tf_) TurbofanData();
-      V8_FALLTHROUGH;
-    case WasmCompilationUnit::CompilationMode::kTurbofan:
-      ExecuteTurbofanCompilation();
-      break;
-  }
-}
-
-void WasmCompilationUnit::ExecuteTurbofanCompilation() {
+void TurbofanWasmCompilationUnit::ExecuteCompilation() {
   double decode_ms = 0;
   size_t node_count = 0;
 
   // Scope for the {graph_zone}.
   {
-    Zone graph_zone(isolate_->allocator(), ZONE_NAME);
-    tf_.jsgraph_ = new (&graph_zone) JSGraph(
-        isolate_, new (&graph_zone) Graph(&graph_zone),
-        new (&graph_zone) CommonOperatorBuilder(&graph_zone), nullptr, nullptr,
-        new (&graph_zone) MachineOperatorBuilder(
-            &graph_zone, MachineType::PointerRepresentation(),
-            InstructionSelector::SupportedMachineOperatorFlags(),
-            InstructionSelector::AlignmentRequirements()));
+    Zone graph_zone(wasm_unit_->isolate_->allocator(), ZONE_NAME);
+    mcgraph_ = new (&graph_zone)
+        MachineGraph(new (&graph_zone) Graph(&graph_zone),
+                     new (&graph_zone) CommonOperatorBuilder(&graph_zone),
+                     new (&graph_zone) MachineOperatorBuilder(
+                         &graph_zone, MachineType::PointerRepresentation(),
+                         InstructionSelector::SupportedMachineOperatorFlags(),
+                         InstructionSelector::AlignmentRequirements()));
+
+    compilation_zone_.reset(
+        new Zone(wasm_unit_->isolate_->allocator(), ZONE_NAME));
+
+    info_.reset(new OptimizedCompilationInfo(
+        GetDebugName(compilation_zone_.get(), wasm_unit_->func_name_,
+                     wasm_unit_->func_index_),
+        compilation_zone_.get(), Code::WASM_FUNCTION));
+
+    NodeOriginTable* node_origins = info_->trace_turbo_json_enabled()
+                                        ? new (&graph_zone)
+                                              NodeOriginTable(mcgraph_->graph())
+                                        : nullptr;
     SourcePositionTable* source_positions =
-        BuildGraphForWasmFunction(&decode_ms);
+        BuildGraphForWasmFunction(&decode_ms, node_origins);
 
-    if (tf_.graph_construction_result_.failed()) {
+    if (graph_construction_result_.failed()) {
       ok_ = false;
       return;
     }
 
+    if (node_origins) {
+      node_origins->AddDecorator();
+    }
+
     base::ElapsedTimer pipeline_timer;
     if (FLAG_trace_wasm_decode_time) {
-      node_count = tf_.jsgraph_->graph()->NodeCount();
+      node_count = mcgraph_->graph()->NodeCount();
       pipeline_timer.Start();
     }
 
-    tf_.compilation_zone_.reset(new Zone(isolate_->allocator(), ZONE_NAME));
-
     // Run the compiler pipeline to generate machine code.
-    auto call_descriptor =
-        GetWasmCallDescriptor(tf_.compilation_zone_.get(), func_body_.sig);
-    if (tf_.jsgraph_->machine()->Is32()) {
-      call_descriptor = GetI32WasmCallDescriptor(tf_.compilation_zone_.get(),
-                                                 call_descriptor);
+    auto call_descriptor = GetWasmCallDescriptor(compilation_zone_.get(),
+                                                 wasm_unit_->func_body_.sig);
+    if (mcgraph_->machine()->Is32()) {
+      call_descriptor =
+          GetI32WasmCallDescriptor(compilation_zone_.get(), call_descriptor);
     }
-    tf_.info_.reset(new OptimizedCompilationInfo(
-        GetDebugName(tf_.compilation_zone_.get(), func_name_, func_index_),
-        tf_.compilation_zone_.get(), Code::WASM_FUNCTION));
-
-    tf_.job_.reset(Pipeline::NewWasmCompilationJob(
-        tf_.info_.get(), isolate_, tf_.jsgraph_, call_descriptor,
-        source_positions, &wasm_compilation_data_, env_->module->origin()));
-    ok_ = tf_.job_->ExecuteJob() == CompilationJob::SUCCEEDED;
+
+    job_.reset(Pipeline::NewWasmCompilationJob(
+        info_.get(), wasm_unit_->isolate_->wasm_engine(), wasm_unit_->isolate_,
+        mcgraph_, call_descriptor, source_positions, node_origins,
+        &wasm_compilation_data_, wasm_unit_->func_body_,
+        const_cast<wasm::WasmModule*>(wasm_unit_->env_->module),
+        wasm_unit_->native_module_, wasm_unit_->func_index_,
+        wasm_unit_->env_->module->origin));
+    ok_ = job_->ExecuteJob() == CompilationJob::SUCCEEDED;
     // TODO(bradnelson): Improve histogram handling of size_t.
-    counters()->wasm_compile_function_peak_memory_bytes()->AddSample(
-        static_cast<int>(tf_.jsgraph_->graph()->zone()->allocation_size()));
+    wasm_unit_->counters_->wasm_compile_function_peak_memory_bytes()->AddSample(
+        static_cast<int>(mcgraph_->graph()->zone()->allocation_size()));
 
     if (FLAG_trace_wasm_decode_time) {
       double pipeline_ms = pipeline_timer.Elapsed().InMillisecondsF();
       PrintF(
           "wasm-compilation phase 1 ok: %u bytes, %0.3f ms decode, %zu nodes, "
           "%0.3f ms pipeline\n",
-          static_cast<unsigned>(func_body_.end - func_body_.start), decode_ms,
-          node_count, pipeline_ms);
+          static_cast<unsigned>(wasm_unit_->func_body_.end -
+                                wasm_unit_->func_body_.start),
+          decode_ms, node_count, pipeline_ms);
     }
     // The graph zone is about to get out of scope. Avoid invalid references.
-    tf_.jsgraph_ = nullptr;
+    mcgraph_ = nullptr;
   }
 
   // Record the memory cost this unit places on the system until
   // it is finalized.
-  memory_cost_ = tf_.job_->AllocatedMemory();
-}
-
-// WasmCompilationUnit::ExecuteLiftoffCompilation() is defined in
-// liftoff-compiler.cc.
-
-wasm::WasmCode* WasmCompilationUnit::FinishCompilation(
-    wasm::ErrorThrower* thrower) {
-  wasm::WasmCode* ret;
-  switch (mode_) {
-    case WasmCompilationUnit::CompilationMode::kLiftoff:
-      ret = FinishLiftoffCompilation(thrower);
-      break;
-    case WasmCompilationUnit::CompilationMode::kTurbofan:
-      ret = FinishTurbofanCompilation(thrower);
-      break;
-    default:
-      UNREACHABLE();
-  }
-  if (ret == nullptr) {
-    thrower->RuntimeError("Error finalizing code.");
-  }
-  return ret;
+  wasm_unit_->memory_cost_ = job_->AllocatedMemory();
 }
 
-wasm::WasmCode* WasmCompilationUnit::FinishTurbofanCompilation(
+wasm::WasmCode* TurbofanWasmCompilationUnit::FinishCompilation(
     wasm::ErrorThrower* thrower) {
   if (!ok_) {
-    if (tf_.graph_construction_result_.failed()) {
+    if (graph_construction_result_.failed()) {
       // Add the function as another context for the exception.
       EmbeddedVector<char, 128> message;
-      if (func_name_.start() == nullptr) {
-        SNPrintF(message, "Compiling wasm function #%d failed", func_index_);
+      if (wasm_unit_->func_name_.start() == nullptr) {
+        SNPrintF(message, "Compiling wasm function #%d failed",
+                 wasm_unit_->func_index_);
       } else {
-        wasm::TruncatedUserString<> trunc_name(func_name_);
+        wasm::TruncatedUserString<> trunc_name(wasm_unit_->func_name_);
         SNPrintF(message, "Compiling wasm function #%d:%.*s failed",
-                 func_index_, trunc_name.length(), trunc_name.start());
+                 wasm_unit_->func_index_, trunc_name.length(),
+                 trunc_name.start());
       }
-      thrower->CompileFailed(message.start(), tf_.graph_construction_result_);
+      thrower->CompileFailed(message.start(), graph_construction_result_);
     }
 
     return nullptr;
@@ -5230,67 +5260,213 @@ wasm::WasmCode* WasmCompilationUnit::FinishTurbofanCompilation(
     codegen_timer.Start();
   }
 
-  if (tf_.job_->FinalizeJob(isolate_) != CompilationJob::SUCCEEDED) {
+  if (job_->FinalizeJob(wasm_unit_->isolate_) != CompilationJob::SUCCEEDED) {
     return nullptr;
   }
 
-  // TODO(mtrofin): when we crystalize a design in lieu of WasmCodeDesc, that
-  // works for both wasm and non-wasm, we can simplify AddCode to just take
-  // that as a parameter.
-  const CodeDesc& desc =
-      tf_.job_->compilation_info()->wasm_code_desc()->code_desc;
-  wasm::WasmCode* code = native_module_->AddCode(
-      desc, tf_.job_->compilation_info()->wasm_code_desc()->frame_slot_count,
-      func_index_,
-      tf_.job_->compilation_info()->wasm_code_desc()->safepoint_table_offset,
-      tf_.job_->compilation_info()->wasm_code_desc()->handler_table_offset,
-      wasm_compilation_data_.ReleaseProtectedInstructions(),
-      tf_.job_->compilation_info()->wasm_code_desc()->source_positions_table,
-      wasm::WasmCode::kTurbofan);
-  if (!code) return code;
   if (FLAG_trace_wasm_decode_time) {
     double codegen_ms = codegen_timer.Elapsed().InMillisecondsF();
     PrintF("wasm-code-generation ok: %u bytes, %0.3f ms code generation\n",
-           static_cast<unsigned>(func_body_.end - func_body_.start),
+           static_cast<unsigned>(wasm_unit_->func_body_.end -
+                                 wasm_unit_->func_body_.start),
            codegen_ms);
   }
 
-  return code;
+  return job_->compilation_info()->wasm_code();
 }
 
-wasm::WasmCode* WasmCompilationUnit::FinishLiftoffCompilation(
-    wasm::ErrorThrower* thrower) {
-  CodeDesc desc;
-  liftoff_.asm_.GetCode(isolate_, &desc);
+namespace {
+// Helper for allocating either an GP or FP reg, or the next stack slot.
+class LinkageLocationAllocator {
+ public:
+  template <size_t kNumGpRegs, size_t kNumFpRegs>
+  constexpr LinkageLocationAllocator(const Register (&gp)[kNumGpRegs],
+                                     const DoubleRegister (&fp)[kNumFpRegs])
+      : allocator_(wasm::LinkageAllocator(gp, fp)) {}
+
+  LinkageLocation Next(MachineRepresentation type) {
+    MachineType mach_type = MachineType::TypeForRepresentation(type);
+    if (type == MachineRepresentation::kFloat32 ||
+        type == MachineRepresentation::kFloat64) {
+      if (allocator_.has_more_fp_regs()) {
+        DoubleRegister reg = allocator_.NextFpReg();
+#if V8_TARGET_ARCH_ARM
+        // Allocate floats using a double register, but modify the code to
+        // reflect how ARM FP registers alias.
+        // TODO(bbudge) Modify wasm linkage to allow use of all float regs.
+        if (type == MachineRepresentation::kFloat32) {
+          int float_reg_code = reg.code() * 2;
+          DCHECK_GT(RegisterConfiguration::kMaxFPRegisters, float_reg_code);
+          return LinkageLocation::ForRegister(
+              DoubleRegister::from_code(float_reg_code).code(), mach_type);
+        }
+#endif
+        return LinkageLocation::ForRegister(reg.code(), mach_type);
+      }
+    } else if (allocator_.has_more_gp_regs()) {
+      return LinkageLocation::ForRegister(allocator_.NextGpReg().code(),
+                                          mach_type);
+    }
+    // Cannot use register; use stack slot.
+    int index = -1 - allocator_.NextStackSlot(type);
+    return LinkageLocation::ForCallerFrameSlot(index, mach_type);
+  }
 
-  Handle<ByteArray> source_positions =
-      liftoff_.source_position_table_builder_.ToSourcePositionTable(isolate_);
+  void SetStackOffset(int offset) { allocator_.SetStackOffset(offset); }
+  int NumStackSlots() const { return allocator_.NumStackSlots(); }
 
-  wasm::WasmCode* code = native_module_->AddCode(
-      desc, liftoff_.asm_.GetTotalFrameSlotCount(), func_index_,
-      liftoff_.safepoint_table_offset_, 0,
-      wasm_compilation_data_.ReleaseProtectedInstructions(), source_positions,
-      wasm::WasmCode::kLiftoff);
+ private:
+  wasm::LinkageAllocator allocator_;
+};
+}  // namespace
 
-  return code;
+// General code uses the above configuration data.
+CallDescriptor* GetWasmCallDescriptor(
+    Zone* zone, wasm::FunctionSig* fsig,
+    WasmGraphBuilder::UseRetpoline use_retpoline) {
+  // The '+ 1' here is to accomodate the instance object as first parameter.
+  LocationSignature::Builder locations(zone, fsig->return_count(),
+                                       fsig->parameter_count() + 1);
+
+  // Add register and/or stack parameter(s).
+  LinkageLocationAllocator params(wasm::kGpParamRegisters,
+                                  wasm::kFpParamRegisters);
+
+  // The instance object.
+  locations.AddParam(params.Next(MachineRepresentation::kTaggedPointer));
+
+  const int parameter_count = static_cast<int>(fsig->parameter_count());
+  for (int i = 0; i < parameter_count; i++) {
+    MachineRepresentation param =
+        wasm::ValueTypes::MachineRepresentationFor(fsig->GetParam(i));
+    auto l = params.Next(param);
+    locations.AddParam(l);
+  }
+
+  // Add return location(s).
+  LinkageLocationAllocator rets(wasm::kGpReturnRegisters,
+                                wasm::kFpReturnRegisters);
+  rets.SetStackOffset(params.NumStackSlots());
+
+  const int return_count = static_cast<int>(locations.return_count_);
+  for (int i = 0; i < return_count; i++) {
+    MachineRepresentation ret =
+        wasm::ValueTypes::MachineRepresentationFor(fsig->GetReturn(i));
+    auto l = rets.Next(ret);
+    locations.AddReturn(l);
+  }
+
+  const RegList kCalleeSaveRegisters = 0;
+  const RegList kCalleeSaveFPRegisters = 0;
+
+  // The target for wasm calls is always a code object.
+  MachineType target_type = MachineType::Pointer();
+  LinkageLocation target_loc = LinkageLocation::ForAnyRegister(target_type);
+
+  CallDescriptor::Kind kind = CallDescriptor::kCallWasmFunction;
+
+  CallDescriptor::Flags flags =
+      use_retpoline ? CallDescriptor::kRetpoline : CallDescriptor::kNoFlags;
+  return new (zone) CallDescriptor(                    // --
+      kind,                                            // kind
+      target_type,                                     // target MachineType
+      target_loc,                                      // target location
+      locations.Build(),                               // location_sig
+      params.NumStackSlots(),                          // stack_parameter_count
+      compiler::Operator::kNoProperties,               // properties
+      kCalleeSaveRegisters,                            // callee-saved registers
+      kCalleeSaveFPRegisters,                          // callee-saved fp regs
+      flags,                                           // flags
+      "wasm-call",                                     // debug name
+      0,                                               // allocatable registers
+      rets.NumStackSlots() - params.NumStackSlots());  // stack_return_count
+}
+
+namespace {
+CallDescriptor* ReplaceTypeInCallDescriptorWith(
+    Zone* zone, CallDescriptor* call_descriptor, size_t num_replacements,
+    MachineType input_type, MachineRepresentation output_type) {
+  size_t parameter_count = call_descriptor->ParameterCount();
+  size_t return_count = call_descriptor->ReturnCount();
+  for (size_t i = 0; i < call_descriptor->ParameterCount(); i++) {
+    if (call_descriptor->GetParameterType(i) == input_type) {
+      parameter_count += num_replacements - 1;
+    }
+  }
+  for (size_t i = 0; i < call_descriptor->ReturnCount(); i++) {
+    if (call_descriptor->GetReturnType(i) == input_type) {
+      return_count += num_replacements - 1;
+    }
+  }
+  if (parameter_count == call_descriptor->ParameterCount() &&
+      return_count == call_descriptor->ReturnCount()) {
+    return call_descriptor;
+  }
+
+  LocationSignature::Builder locations(zone, return_count, parameter_count);
+
+  LinkageLocationAllocator params(wasm::kGpParamRegisters,
+                                  wasm::kFpParamRegisters);
+  for (size_t i = 0; i < call_descriptor->ParameterCount(); i++) {
+    if (call_descriptor->GetParameterType(i) == input_type) {
+      for (size_t j = 0; j < num_replacements; j++) {
+        locations.AddParam(params.Next(output_type));
+      }
+    } else {
+      locations.AddParam(
+          params.Next(call_descriptor->GetParameterType(i).representation()));
+    }
+  }
+
+  LinkageLocationAllocator rets(wasm::kGpReturnRegisters,
+                                wasm::kFpReturnRegisters);
+  rets.SetStackOffset(params.NumStackSlots());
+  for (size_t i = 0; i < call_descriptor->ReturnCount(); i++) {
+    if (call_descriptor->GetReturnType(i) == input_type) {
+      for (size_t j = 0; j < num_replacements; j++) {
+        locations.AddReturn(rets.Next(output_type));
+      }
+    } else {
+      locations.AddReturn(
+          rets.Next(call_descriptor->GetReturnType(i).representation()));
+    }
+  }
+
+  return new (zone) CallDescriptor(                    // --
+      call_descriptor->kind(),                         // kind
+      call_descriptor->GetInputType(0),                // target MachineType
+      call_descriptor->GetInputLocation(0),            // target location
+      locations.Build(),                               // location_sig
+      params.NumStackSlots(),                          // stack_parameter_count
+      call_descriptor->properties(),                   // properties
+      call_descriptor->CalleeSavedRegisters(),         // callee-saved registers
+      call_descriptor->CalleeSavedFPRegisters(),       // callee-saved fp regs
+      call_descriptor->flags(),                        // flags
+      call_descriptor->debug_name(),                   // debug name
+      call_descriptor->AllocatableRegisters(),         // allocatable registers
+      rets.NumStackSlots() - params.NumStackSlots());  // stack_return_count
+}
+}  // namespace
+
+CallDescriptor* GetI32WasmCallDescriptor(Zone* zone,
+                                         CallDescriptor* call_descriptor) {
+  return ReplaceTypeInCallDescriptorWith(zone, call_descriptor, 2,
+                                         MachineType::Int64(),
+                                         MachineRepresentation::kWord32);
+}
+
+CallDescriptor* GetI32WasmCallDescriptorForSimd(
+    Zone* zone, CallDescriptor* call_descriptor) {
+  return ReplaceTypeInCallDescriptorWith(zone, call_descriptor, 4,
+                                         MachineType::Simd128(),
+                                         MachineRepresentation::kWord32);
 }
 
-// static
-wasm::WasmCode* WasmCompilationUnit::CompileWasmFunction(
-    wasm::NativeModule* native_module, wasm::ErrorThrower* thrower,
-    Isolate* isolate, const wasm::ModuleWireBytes& wire_bytes, ModuleEnv* env,
-    const wasm::WasmFunction* function, CompilationMode mode) {
-  wasm::FunctionBody function_body{
-      function->sig, function->code.offset(),
-      wire_bytes.start() + function->code.offset(),
-      wire_bytes.start() + function->code.end_offset()};
-
-  WasmCompilationUnit unit(isolate, env, native_module, function_body,
-                           wire_bytes.GetNameOrNull(function, env->module),
-                           function->func_index,
-                           CEntryStub(isolate, 1).GetCode(), mode);
-  unit.ExecuteCompilation();
-  return unit.FinishCompilation(thrower);
+AssemblerOptions WasmAssemblerOptions(Isolate* isolate) {
+  AssemblerOptions options = AssemblerOptions::Default(isolate);
+  options.record_reloc_info_for_serialization = true;
+  options.enable_root_array_delta_access = false;
+  return options;
 }
 
 #undef WASM_64
diff --git a/deps/v8/src/compiler/wasm-compiler.h b/deps/v8/src/compiler/wasm-compiler.h
index 7ca36b56c0fb76..857eaf7284ab9e 100644
--- a/deps/v8/src/compiler/wasm-compiler.h
+++ b/deps/v8/src/compiler/wasm-compiler.h
@@ -9,11 +9,11 @@
 
 // Clients of this interface shouldn't depend on lots of compiler internals.
 // Do not include anything from src/compiler here!
-#include "src/compiler.h"
 #include "src/optimized-compilation-info.h"
+#include "src/runtime/runtime.h"
 #include "src/trap-handler/trap-handler.h"
-#include "src/wasm/baseline/liftoff-assembler.h"
 #include "src/wasm/function-body-decoder.h"
+#include "src/wasm/function-compiler.h"
 #include "src/wasm/wasm-module.h"
 #include "src/wasm/wasm-opcodes.h"
 #include "src/wasm/wasm-result.h"
@@ -21,178 +21,111 @@
 
 namespace v8 {
 namespace internal {
+struct AssemblerOptions;
+class OptimizedCompilationJob;
 
 namespace compiler {
 // Forward declarations for some compiler data structures.
-class Node;
-class JSGraph;
+class CallDescriptor;
 class Graph;
+class MachineGraph;
+class Node;
+class NodeOriginTable;
 class Operator;
 class SourcePositionTable;
+class WasmDecorator;
+enum class TrapId : uint32_t;
 }  // namespace compiler
 
 namespace wasm {
 struct DecodeStruct;
-class SignatureMap;
 // Expose {Node} and {Graph} opaquely as {wasm::TFNode} and {wasm::TFGraph}.
 typedef compiler::Node TFNode;
-typedef compiler::JSGraph TFGraph;
-class NativeModule;
+typedef compiler::MachineGraph TFGraph;
 class WasmCode;
 }  // namespace wasm
 
 namespace compiler {
 
-// The {ModuleEnv} encapsulates the module data that is used by the
-// {WasmGraphBuilder} during graph building.
-// ModuleEnvs are shareable across multiple compilations.
-struct ModuleEnv {
-  // A pointer to the decoded module's static representation.
-  const wasm::WasmModule* module;
-
-  // True if trap handling should be used in compiled code, rather than
-  // compiling in bounds checks for each memory access.
-  const bool use_trap_handler;
-
-  ModuleEnv(const wasm::WasmModule* module, bool use_trap_handler)
-      : module(module), use_trap_handler(use_trap_handler) {}
-};
-
-enum RuntimeExceptionSupport : bool {
-  kRuntimeExceptionSupport = true,
-  kNoRuntimeExceptionSupport = false
-};
-
 // Information about Wasm compilation that needs to be plumbed through the
 // different layers of the compiler.
 class WasmCompilationData {
  public:
-  explicit WasmCompilationData(RuntimeExceptionSupport);
+  explicit WasmCompilationData(
+      wasm::RuntimeExceptionSupport runtime_exception_support)
+      : runtime_exception_support_(runtime_exception_support) {}
 
-  void AddProtectedInstruction(uint32_t instr_offset, uint32_t landing_offset);
+  void AddProtectedInstruction(uint32_t instr_offset, uint32_t landing_offset) {
+    protected_instructions_.push_back({instr_offset, landing_offset});
+  }
 
-  std::unique_ptr<std::vector<trap_handler::ProtectedInstructionData>>
-  ReleaseProtectedInstructions() {
-    return std::move(protected_instructions_);
+  OwnedVector<trap_handler::ProtectedInstructionData>
+  GetProtectedInstructions() {
+    return OwnedVector<trap_handler::ProtectedInstructionData>::Of(
+        protected_instructions_);
   }
 
-  RuntimeExceptionSupport runtime_exception_support() const {
+  wasm::RuntimeExceptionSupport runtime_exception_support() const {
     return runtime_exception_support_;
   }
 
  private:
-  std::unique_ptr<std::vector<trap_handler::ProtectedInstructionData>>
-      protected_instructions_;
+  std::vector<trap_handler::ProtectedInstructionData> protected_instructions_;
 
-  // See WasmGraphBuilder::runtime_exception_support_.
-  const RuntimeExceptionSupport runtime_exception_support_;
+  // See ModuleEnv::runtime_exception_support_.
+  wasm::RuntimeExceptionSupport runtime_exception_support_;
 
   DISALLOW_COPY_AND_ASSIGN(WasmCompilationData);
 };
 
-class WasmCompilationUnit final {
+class TurbofanWasmCompilationUnit {
  public:
-  enum class CompilationMode : uint8_t { kLiftoff, kTurbofan };
-  static CompilationMode GetDefaultCompilationMode();
-
-  // If constructing from a background thread, pass in a Counters*, and ensure
-  // that the Counters live at least as long as this compilation unit (which
-  // typically means to hold a std::shared_ptr<Counters>).
-  // If no such pointer is passed, Isolate::counters() will be called. This is
-  // only allowed to happen on the foreground thread.
-  WasmCompilationUnit(Isolate*, ModuleEnv*, wasm::NativeModule*,
-                      wasm::FunctionBody, wasm::WasmName, int index,
-                      Handle<Code> centry_stub,
-                      CompilationMode = GetDefaultCompilationMode(),
-                      Counters* = nullptr,
-                      RuntimeExceptionSupport = kRuntimeExceptionSupport,
-                      bool lower_simd = false);
-
-  ~WasmCompilationUnit();
+  explicit TurbofanWasmCompilationUnit(wasm::WasmCompilationUnit* wasm_unit);
+  ~TurbofanWasmCompilationUnit();
 
-  void ExecuteCompilation();
-  wasm::WasmCode* FinishCompilation(wasm::ErrorThrower* thrower);
+  SourcePositionTable* BuildGraphForWasmFunction(double* decode_ms,
+                                                 NodeOriginTable* node_origins);
 
-  static wasm::WasmCode* CompileWasmFunction(
-      wasm::NativeModule* native_module, wasm::ErrorThrower* thrower,
-      Isolate* isolate, const wasm::ModuleWireBytes& wire_bytes, ModuleEnv* env,
-      const wasm::WasmFunction* function,
-      CompilationMode = GetDefaultCompilationMode());
+  void ExecuteCompilation();
 
-  size_t memory_cost() const { return memory_cost_; }
-  wasm::NativeModule* native_module() const { return native_module_; }
+  wasm::WasmCode* FinishCompilation(wasm::ErrorThrower*);
 
  private:
-  struct LiftoffData {
-    wasm::LiftoffAssembler asm_;
-    int safepoint_table_offset_;
-    SourcePositionTableBuilder source_position_table_builder_;
-    // The {codegen_zone_} needs to survive until FinishCompilation. It's only
-    // rarely used (e.g. for runtime calls), so it's only allocated when needed.
-    std::unique_ptr<Zone> codegen_zone_;
-    explicit LiftoffData(Isolate* isolate) : asm_(isolate) {}
-  };
-  struct TurbofanData {
-    // The graph zone is deallocated at the end of ExecuteCompilation by virtue
-    // of it being zone allocated.
-    JSGraph* jsgraph_ = nullptr;
-    // The compilation_zone_, info_, and job_ fields need to survive past
-    // ExecuteCompilation, onto FinishCompilation (which happens on the main
-    // thread).
-    std::unique_ptr<Zone> compilation_zone_;
-    std::unique_ptr<OptimizedCompilationInfo> info_;
-    std::unique_ptr<OptimizedCompilationJob> job_;
-    wasm::Result<wasm::DecodeStruct*> graph_construction_result_;
-  };
-
-  // Turbofan.
-  SourcePositionTable* BuildGraphForWasmFunction(double* decode_ms);
-  void ExecuteTurbofanCompilation();
-  wasm::WasmCode* FinishTurbofanCompilation(wasm::ErrorThrower*);
-
-  // Liftoff.
-  bool ExecuteLiftoffCompilation();
-  wasm::WasmCode* FinishLiftoffCompilation(wasm::ErrorThrower*);
-
-  Isolate* isolate_;
-  ModuleEnv* env_;
-  wasm::FunctionBody func_body_;
-  wasm::WasmName func_name_;
-  Counters* counters_;
-  Handle<Code> centry_stub_;
-  int func_index_;
-  bool ok_ = true;
-  size_t memory_cost_ = 0;
-  wasm::NativeModule* native_module_;
-  bool lower_simd_;
+  wasm::WasmCompilationUnit* const wasm_unit_;
   WasmCompilationData wasm_compilation_data_;
-  CompilationMode mode_;
-  // {liftoff_} is valid if mode_ == kLiftoff, tf_ if mode_ == kTurbofan.
-  union {
-    LiftoffData liftoff_;
-    TurbofanData tf_;
-  };
-
-  Counters* counters() { return counters_; }
-
-  DISALLOW_COPY_AND_ASSIGN(WasmCompilationUnit);
+  bool ok_ = true;
+  // The graph zone is deallocated at the end of {ExecuteCompilation} by virtue
+  // of it being zone allocated.
+  MachineGraph* mcgraph_ = nullptr;
+  // The compilation_zone_, info_, and job_ fields need to survive past
+  // {ExecuteCompilation}, onto {FinishCompilation} (which happens on the main
+  // thread).
+  std::unique_ptr<Zone> compilation_zone_;
+  std::unique_ptr<OptimizedCompilationInfo> info_;
+  std::unique_ptr<OptimizedCompilationJob> job_;
+  wasm::Result<wasm::DecodeStruct*> graph_construction_result_;
+
+  DISALLOW_COPY_AND_ASSIGN(TurbofanWasmCompilationUnit);
 };
 
 // Wraps a JS function, producing a code object that can be called from wasm.
-Handle<Code> CompileWasmToJSWrapper(Isolate* isolate, Handle<JSReceiver> target,
-                                    wasm::FunctionSig* sig, uint32_t index,
-                                    wasm::ModuleOrigin origin,
-                                    bool use_trap_handler);
-
-// Wraps a given wasm code object, producing a code object.
-V8_EXPORT_PRIVATE Handle<Code> CompileJSToWasmWrapper(
-    Isolate* isolate, wasm::WasmModule* module, Handle<WeakCell> weak_instance,
-    wasm::WasmCode* wasm_code, uint32_t index, bool use_trap_handler);
+MaybeHandle<Code> CompileWasmToJSWrapper(Isolate*, Handle<JSReceiver> target,
+                                         wasm::FunctionSig*, uint32_t index,
+                                         wasm::ModuleOrigin,
+                                         wasm::UseTrapHandler);
+
+// Creates a code object calling a wasm function with the given signature,
+// callable from JS.
+// TODO(clemensh): Remove the {UseTrapHandler} parameter to make js-to-wasm
+// wrappers sharable across instances.
+V8_EXPORT_PRIVATE MaybeHandle<Code> CompileJSToWasmWrapper(
+    Isolate*, const wasm::NativeModule*, wasm::FunctionSig*, bool is_import,
+    wasm::UseTrapHandler);
 
 // Compiles a stub that redirects a call to a wasm function to the wasm
 // interpreter. It's ABI compatible with the compiled wasm function.
-Handle<Code> CompileWasmInterpreterEntry(Isolate* isolate, uint32_t func_index,
-                                         wasm::FunctionSig* sig);
+MaybeHandle<Code> CompileWasmInterpreterEntry(Isolate*, uint32_t func_index,
+                                              wasm::FunctionSig*);
 
 // Helper function to get the offset into a fixed array for a given {index}.
 // TODO(titzer): access-builder.h is not accessible outside compiler. Move?
@@ -209,7 +142,7 @@ enum CWasmEntryParameters {
 // Compiles a stub with JS linkage, taking parameters as described by
 // {CWasmEntryParameters}. It loads the wasm parameters from the argument
 // buffer and calls the wasm function given as first parameter.
-Handle<Code> CompileCWasmEntry(Isolate* isolate, wasm::FunctionSig* sig);
+MaybeHandle<Code> CompileCWasmEntry(Isolate* isolate, wasm::FunctionSig* sig);
 
 // Values from the instance object are cached between WASM-level function calls.
 // This struct allows the SSA environment handling this cache to be defined
@@ -223,7 +156,6 @@ struct WasmInstanceCacheNodes {
 
 // Abstracts details of building TurboFan graph nodes for wasm to separate
 // the wasm decoder from the internal details of TurboFan.
-typedef ZoneVector<Node*> NodeVector;
 class WasmGraphBuilder {
  public:
   enum EnforceBoundsCheck : bool {
@@ -232,11 +164,9 @@ class WasmGraphBuilder {
   };
   enum UseRetpoline : bool { kRetpoline = true, kNoRetpoline = false };
 
-  WasmGraphBuilder(ModuleEnv* env, Zone* zone, JSGraph* graph,
-                   Handle<Code> centry_stub, Handle<Oddball> anyref_null,
+  WasmGraphBuilder(wasm::ModuleEnv* env, Zone* zone, MachineGraph* mcgraph,
                    wasm::FunctionSig* sig,
-                   compiler::SourcePositionTable* spt = nullptr,
-                   RuntimeExceptionSupport res = kRuntimeExceptionSupport);
+                   compiler::SourcePositionTable* spt = nullptr);
 
   Node** Buffer(size_t count) {
     if (count > cur_bufsize_) {
@@ -258,19 +188,17 @@ class WasmGraphBuilder {
   Node* Terminate(Node* effect, Node* control);
   Node* Merge(unsigned count, Node** controls);
   Node* Phi(wasm::ValueType type, unsigned count, Node** vals, Node* control);
-  Node* CreateOrMergeIntoPhi(wasm::ValueType type, Node* merge, Node* tnode,
-                             Node* fnode);
+  Node* CreateOrMergeIntoPhi(MachineRepresentation rep, Node* merge,
+                             Node* tnode, Node* fnode);
   Node* CreateOrMergeIntoEffectPhi(Node* merge, Node* tnode, Node* fnode);
   Node* EffectPhi(unsigned count, Node** effects, Node* control);
-  Node* NumberConstant(int32_t value);
+  Node* RefNull();
   Node* Uint32Constant(uint32_t value);
   Node* Int32Constant(int32_t value);
   Node* Int64Constant(int64_t value);
   Node* IntPtrConstant(intptr_t value);
   Node* Float32Constant(float value);
   Node* Float64Constant(double value);
-  Node* RefNull() { return anyref_null_node_; }
-  Node* HeapConstant(Handle<HeapObject> value);
   Node* Binop(wasm::WasmOpcode opcode, Node* left, Node* right,
               wasm::WasmCodePosition position = wasm::kNoCodePosition);
   Node* Unop(wasm::WasmOpcode opcode, Node* input,
@@ -329,15 +257,6 @@ class WasmGraphBuilder {
   Node* CallIndirect(uint32_t index, Node** args, Node*** rets,
                      wasm::WasmCodePosition position);
 
-  void BuildJSToWasmWrapper(Handle<WeakCell> weak_instance,
-                            wasm::WasmCode* wasm_code);
-  bool BuildWasmToJSWrapper(Handle<JSReceiver> target,
-                            int index);
-  void BuildWasmInterpreterEntry(uint32_t func_index);
-  void BuildCWasmEntry();
-
-  Node* ToJS(Node* node, wasm::ValueType type);
-  Node* FromJS(Node* node, Node* js_context, wasm::ValueType type);
   Node* Invert(Node* node);
 
   //-----------------------------------------------------------------------
@@ -367,7 +286,7 @@ class WasmGraphBuilder {
 
   void set_effect_ptr(Node** effect) { this->effect_ = effect; }
 
-  void GetGlobalBaseAndOffset(MachineType mem_type, uint32_t offset,
+  void GetGlobalBaseAndOffset(MachineType mem_type, const wasm::WasmGlobal&,
                               Node** base_node, Node** offset_node);
 
   // Utilities to manipulate sets of instance cache nodes.
@@ -415,45 +334,46 @@ class WasmGraphBuilder {
 
   bool use_trap_handler() const { return env_ && env_->use_trap_handler; }
 
-  JSGraph* jsgraph() { return jsgraph_; }
+  MachineGraph* mcgraph() { return mcgraph_; }
   Graph* graph();
 
- private:
+  void AddBytecodePositionDecorator(NodeOriginTable* node_origins,
+                                    wasm::Decoder* decoder);
+
+  void RemoveBytecodePositionDecorator();
+
+ protected:
   static const int kDefaultBufferSize = 16;
 
   Zone* const zone_;
-  JSGraph* const jsgraph_;
-  Node* const centry_stub_node_;
-  Node* const anyref_null_node_;
-  // env_ == nullptr means we're not compiling Wasm functions, such as for
-  // wrappers or interpreter stubs.
-  ModuleEnv* const env_ = nullptr;
-  SetOncePointer<Node> instance_node_;
-  struct FunctionTableNodes {
-    Node* table_addr;
-    Node* size;
-  };
+  MachineGraph* const mcgraph_;
+  wasm::ModuleEnv* const env_;
+
   Node** control_ = nullptr;
   Node** effect_ = nullptr;
   WasmInstanceCacheNodes* instance_cache_ = nullptr;
+
+  SetOncePointer<Node> instance_node_;
   SetOncePointer<Node> globals_start_;
+  SetOncePointer<Node> imported_mutable_globals_;
+  SetOncePointer<Node> stack_check_code_node_;
+  SetOncePointer<const Operator> stack_check_call_operator_;
+
   Node** cur_buffer_;
   size_t cur_bufsize_;
   Node* def_buffer_[kDefaultBufferSize];
   bool has_simd_ = false;
   bool needs_stack_check_ = false;
   const bool untrusted_code_mitigations_ = true;
-  // If the runtime doesn't support exception propagation,
-  // we won't generate stack checks, and trap handling will also
-  // be generated differently.
-  const RuntimeExceptionSupport runtime_exception_support_;
 
   wasm::FunctionSig* const sig_;
-  SetOncePointer<const Operator> allocate_heap_number_operator_;
+
+  compiler::WasmDecorator* decorator_ = nullptr;
 
   compiler::SourcePositionTable* const source_position_table_ = nullptr;
 
-  Node* String(const char* string);
+  Node* NoContextConstant();
+
   Node* MemBuffer(uint32_t offset);
   // BoundsCheckMem receives a uint32 {index} node and returns a ptrsize index.
   Node* BoundsCheckMem(uint8_t access_size, Node* index, uint32_t offset,
@@ -474,6 +394,10 @@ class WasmGraphBuilder {
   Node* BuildWasmCall(wasm::FunctionSig* sig, Node** args, Node*** rets,
                       wasm::WasmCodePosition position, Node* instance_node,
                       UseRetpoline use_retpoline);
+  Node* BuildImportWasmCall(wasm::FunctionSig* sig, Node** args, Node*** rets,
+                            wasm::WasmCodePosition position, int func_index);
+  Node* BuildImportWasmCall(wasm::FunctionSig* sig, Node** args, Node*** rets,
+                            wasm::WasmCodePosition position, Node* func_index);
 
   Node* BuildF32CopySign(Node* left, Node* right);
   Node* BuildF64CopySign(Node* left, Node* right);
@@ -527,25 +451,16 @@ class WasmGraphBuilder {
   Node* BuildI64DivU(Node* left, Node* right, wasm::WasmCodePosition position);
   Node* BuildI64RemU(Node* left, Node* right, wasm::WasmCodePosition position);
   Node* BuildDiv64Call(Node* left, Node* right, ExternalReference ref,
-                       MachineType result_type, int trap_zero,
+                       MachineType result_type, wasm::TrapReason trap_zero,
                        wasm::WasmCodePosition position);
 
-  Node* BuildJavaScriptToNumber(Node* node, Node* js_context);
-
-  Node* BuildChangeInt32ToTagged(Node* value);
-  Node* BuildChangeFloat64ToTagged(Node* value);
-  Node* BuildChangeTaggedToFloat64(Node* value);
-
+  Node* BuildChangeInt32ToIntPtr(Node* value);
   Node* BuildChangeInt32ToSmi(Node* value);
-  Node* BuildChangeSmiToInt32(Node* value);
-  Node* BuildChangeUint32ToSmi(Node* value);
-  Node* BuildChangeSmiToFloat64(Node* value);
-  Node* BuildTestNotSmi(Node* value);
+  Node* BuildChangeUint31ToSmi(Node* value);
   Node* BuildSmiShiftBitsConstant();
+  Node* BuildChangeSmiToInt32(Node* value);
 
-  Node* BuildAllocateHeapNumberWithValue(Node* value, Node* control);
-  Node* BuildLoadHeapNumberValue(Node* value, Node* control);
-  Node* BuildHeapNumberValueIndexConstant();
+  Node* BuildLoadInstanceFromExportedFunction(Node* closure);
 
   // Asm.js specific functionality.
   Node* BuildI32AsmjsSConvertF32(Node* input);
@@ -569,13 +484,10 @@ class WasmGraphBuilder {
     return buf;
   }
 
-  int AddParameterNodes(Node** args, int pos, int param_count,
-                        wasm::FunctionSig* sig);
-
   void SetNeedsStackCheck() { needs_stack_check_ = true; }
 
   //-----------------------------------------------------------------------
-  // Operations involving the CEntryStub, a dependency we want to remove
+  // Operations involving the CEntry, a dependency we want to remove
   // to get off the GC heap.
   //-----------------------------------------------------------------------
   Node* BuildCallToRuntime(Runtime::FunctionId f, Node** parameters,
@@ -587,14 +499,9 @@ class WasmGraphBuilder {
                                             Node* js_context,
                                             Node* const* parameters,
                                             int parameter_count);
-  Node* BuildModifyThreadInWasmFlag(bool new_value);
-  Builtins::Name GetBuiltinIdForTrap(wasm::TrapReason reason);
+  TrapId GetTrapIdForTrap(wasm::TrapReason reason);
 };
 
-// The parameter index where the instance parameter should be placed in wasm
-// call descriptors. This is used by the Int64Lowering::LowerNode method.
-constexpr int kWasmInstanceParameterIndex = 0;
-
 V8_EXPORT_PRIVATE CallDescriptor* GetWasmCallDescriptor(
     Zone* zone, wasm::FunctionSig* signature,
     WasmGraphBuilder::UseRetpoline use_retpoline =
@@ -602,9 +509,12 @@ V8_EXPORT_PRIVATE CallDescriptor* GetWasmCallDescriptor(
 
 V8_EXPORT_PRIVATE CallDescriptor* GetI32WasmCallDescriptor(
     Zone* zone, CallDescriptor* call_descriptor);
+
 V8_EXPORT_PRIVATE CallDescriptor* GetI32WasmCallDescriptorForSimd(
     Zone* zone, CallDescriptor* call_descriptor);
 
+AssemblerOptions WasmAssemblerOptions(Isolate* isolate);
+
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/src/compiler/wasm-linkage.cc b/deps/v8/src/compiler/wasm-linkage.cc
deleted file mode 100644
index caf38c8d8c9cee..00000000000000
--- a/deps/v8/src/compiler/wasm-linkage.cc
+++ /dev/null
@@ -1,367 +0,0 @@
-// Copyright 2015 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "src/assembler-inl.h"
-#include "src/base/lazy-instance.h"
-#include "src/macro-assembler.h"
-#include "src/register-configuration.h"
-
-#include "src/compiler/linkage.h"
-#include "src/compiler/wasm-compiler.h"
-
-#include "src/zone/zone.h"
-
-namespace v8 {
-namespace internal {
-namespace compiler {
-
-using wasm::ValueType;
-
-namespace {
-
-MachineType MachineTypeFor(ValueType type) {
-  switch (type) {
-    case wasm::kWasmI32:
-      return MachineType::Int32();
-    case wasm::kWasmI64:
-      return MachineType::Int64();
-    case wasm::kWasmF64:
-      return MachineType::Float64();
-    case wasm::kWasmF32:
-      return MachineType::Float32();
-    case wasm::kWasmS128:
-      return MachineType::Simd128();
-    case wasm::kWasmAnyRef:
-      return MachineType::TaggedPointer();
-    default:
-      UNREACHABLE();
-  }
-}
-
-LinkageLocation stackloc(int i, MachineType type) {
-  return LinkageLocation::ForCallerFrameSlot(i, type);
-}
-
-
-#if V8_TARGET_ARCH_IA32
-// ===========================================================================
-// == ia32 ===================================================================
-// ===========================================================================
-#define GP_PARAM_REGISTERS esi, eax, edx, ecx, ebx
-#define GP_RETURN_REGISTERS eax, edx
-#define FP_PARAM_REGISTERS xmm1, xmm2, xmm3, xmm4, xmm5, xmm6
-#define FP_RETURN_REGISTERS xmm1, xmm2
-
-#elif V8_TARGET_ARCH_X64
-// ===========================================================================
-// == x64 ====================================================================
-// ===========================================================================
-#define GP_PARAM_REGISTERS rsi, rax, rdx, rcx, rbx, rdi
-#define GP_RETURN_REGISTERS rax, rdx
-#define FP_PARAM_REGISTERS xmm1, xmm2, xmm3, xmm4, xmm5, xmm6
-#define FP_RETURN_REGISTERS xmm1, xmm2
-
-#elif V8_TARGET_ARCH_ARM
-// ===========================================================================
-// == arm ====================================================================
-// ===========================================================================
-#define GP_PARAM_REGISTERS r3, r0, r1, r2
-#define GP_RETURN_REGISTERS r0, r1
-#define FP_PARAM_REGISTERS d0, d1, d2, d3, d4, d5, d6, d7
-#define FP_RETURN_REGISTERS d0, d1
-
-#elif V8_TARGET_ARCH_ARM64
-// ===========================================================================
-// == arm64 ====================================================================
-// ===========================================================================
-#define GP_PARAM_REGISTERS x7, x0, x1, x2, x3, x4, x5, x6
-#define GP_RETURN_REGISTERS x0, x1
-#define FP_PARAM_REGISTERS d0, d1, d2, d3, d4, d5, d6, d7
-#define FP_RETURN_REGISTERS d0, d1
-
-#elif V8_TARGET_ARCH_MIPS
-// ===========================================================================
-// == mips ===================================================================
-// ===========================================================================
-#define GP_PARAM_REGISTERS a0, a1, a2, a3
-#define GP_RETURN_REGISTERS v0, v1
-#define FP_PARAM_REGISTERS f2, f4, f6, f8, f10, f12, f14
-#define FP_RETURN_REGISTERS f2, f4
-
-#elif V8_TARGET_ARCH_MIPS64
-// ===========================================================================
-// == mips64 =================================================================
-// ===========================================================================
-#define GP_PARAM_REGISTERS a0, a1, a2, a3, a4, a5, a6, a7
-#define GP_RETURN_REGISTERS v0, v1
-#define FP_PARAM_REGISTERS f2, f4, f6, f8, f10, f12, f14
-#define FP_RETURN_REGISTERS f2, f4
-
-#elif V8_TARGET_ARCH_PPC || V8_TARGET_ARCH_PPC64
-// ===========================================================================
-// == ppc & ppc64 ============================================================
-// ===========================================================================
-#define GP_PARAM_REGISTERS r10, r3, r4, r5, r6, r7, r8, r9
-#define GP_RETURN_REGISTERS r3, r4
-#define FP_PARAM_REGISTERS d1, d2, d3, d4, d5, d6, d7, d8
-#define FP_RETURN_REGISTERS d1, d2
-
-#elif V8_TARGET_ARCH_S390X
-// ===========================================================================
-// == s390x ==================================================================
-// ===========================================================================
-#define GP_PARAM_REGISTERS r6, r2, r3, r4, r5
-#define GP_RETURN_REGISTERS r2, r3
-#define FP_PARAM_REGISTERS d0, d2, d4, d6
-#define FP_RETURN_REGISTERS d0, d2, d4, d6
-
-#elif V8_TARGET_ARCH_S390
-// ===========================================================================
-// == s390 ===================================================================
-// ===========================================================================
-#define GP_PARAM_REGISTERS r6, r2, r3, r4, r5
-#define GP_RETURN_REGISTERS r2, r3
-#define FP_PARAM_REGISTERS d0, d2
-#define FP_RETURN_REGISTERS d0, d2
-
-#else
-// ===========================================================================
-// == unknown ================================================================
-// ===========================================================================
-// Do not use any registers, we will just always use the stack.
-#define GP_PARAM_REGISTERS
-#define GP_RETURN_REGISTERS
-#define FP_PARAM_REGISTERS
-#define FP_RETURN_REGISTERS
-
-#endif
-
-
-// Helper for allocating either an GP or FP reg, or the next stack slot.
-struct Allocator {
-  constexpr Allocator(const Register* gp, int gpc, const DoubleRegister* fp,
-                      int fpc)
-      : gp_count(gpc),
-        gp_offset(0),
-        gp_regs(gp),
-        fp_count(fpc),
-        fp_offset(0),
-        fp_regs(fp),
-        stack_offset(0) {}
-
-  int gp_count;
-  int gp_offset;
-  const Register* gp_regs;
-
-  int fp_count;
-  int fp_offset;
-  const DoubleRegister* fp_regs;
-
-  int stack_offset;
-
-  void AdjustStackOffset(int offset) { stack_offset += offset; }
-
-  LinkageLocation Next(ValueType type) {
-    if (IsFloatingPoint(type)) {
-      // Allocate a floating point register/stack location.
-      if (fp_offset < fp_count) {
-        DoubleRegister reg = fp_regs[fp_offset++];
-#if V8_TARGET_ARCH_ARM
-        // Allocate floats using a double register, but modify the code to
-        // reflect how ARM FP registers alias.
-        // TODO(bbudge) Modify wasm linkage to allow use of all float regs.
-        if (type == wasm::kWasmF32) {
-          int float_reg_code = reg.code() * 2;
-          DCHECK_GT(RegisterConfiguration::kMaxFPRegisters, float_reg_code);
-          return LinkageLocation::ForRegister(
-              DoubleRegister::from_code(float_reg_code).code(),
-              MachineTypeFor(type));
-        }
-#endif
-        return LinkageLocation::ForRegister(reg.code(), MachineTypeFor(type));
-      } else {
-        int offset = -1 - stack_offset;
-        stack_offset += Words(type);
-        return stackloc(offset, MachineTypeFor(type));
-      }
-    } else {
-      // Allocate a general purpose register/stack location.
-      if (gp_offset < gp_count) {
-        return LinkageLocation::ForRegister(gp_regs[gp_offset++].code(),
-                                            MachineTypeFor(type));
-      } else {
-        int offset = -1 - stack_offset;
-        stack_offset += Words(type);
-        return stackloc(offset, MachineTypeFor(type));
-      }
-    }
-  }
-  bool IsFloatingPoint(ValueType type) {
-    return type == wasm::kWasmF32 || type == wasm::kWasmF64;
-  }
-  int Words(ValueType type) {
-    if (kPointerSize < 8 &&
-        (type == wasm::kWasmI64 || type == wasm::kWasmF64)) {
-      return 2;
-    }
-    return 1;
-  }
-};
-
-static constexpr Register kGPReturnRegisters[] = {GP_RETURN_REGISTERS};
-static constexpr DoubleRegister kFPReturnRegisters[] = {FP_RETURN_REGISTERS};
-static constexpr Register kGPParamRegisters[] = {GP_PARAM_REGISTERS};
-static constexpr DoubleRegister kFPParamRegisters[] = {FP_PARAM_REGISTERS};
-static constexpr Allocator return_registers(kGPReturnRegisters,
-                                            arraysize(kGPReturnRegisters),
-                                            kFPReturnRegisters,
-                                            arraysize(kFPReturnRegisters));
-static constexpr Allocator parameter_registers(kGPParamRegisters,
-                                               arraysize(kGPParamRegisters),
-                                               kFPParamRegisters,
-                                               arraysize(kFPParamRegisters));
-
-}  // namespace
-
-// General code uses the above configuration data.
-CallDescriptor* GetWasmCallDescriptor(
-    Zone* zone, wasm::FunctionSig* fsig,
-    WasmGraphBuilder::UseRetpoline use_retpoline) {
-  // The '+ 1' here is to accomodate the instance object as first parameter.
-  LocationSignature::Builder locations(zone, fsig->return_count(),
-                                       fsig->parameter_count() + 1);
-
-  // Add register and/or stack parameter(s).
-  Allocator params = parameter_registers;
-
-  // The instance object.
-  locations.AddParam(params.Next(MachineRepresentation::kTaggedPointer));
-
-  const int parameter_count = static_cast<int>(fsig->parameter_count());
-  for (int i = 0; i < parameter_count; i++) {
-    ValueType param = fsig->GetParam(i);
-    auto l = params.Next(param);
-    locations.AddParam(l);
-  }
-
-  // Add return location(s).
-  Allocator rets = return_registers;
-  rets.AdjustStackOffset(params.stack_offset);
-
-  const int return_count = static_cast<int>(locations.return_count_);
-  for (int i = 0; i < return_count; i++) {
-    ValueType ret = fsig->GetReturn(i);
-    auto l = rets.Next(ret);
-    locations.AddReturn(l);
-  }
-
-  const RegList kCalleeSaveRegisters = 0;
-  const RegList kCalleeSaveFPRegisters = 0;
-
-  // The target for wasm calls is always a code object.
-  MachineType target_type = MachineType::Pointer();
-  LinkageLocation target_loc = LinkageLocation::ForAnyRegister(target_type);
-
-  CallDescriptor::Kind kind = CallDescriptor::kCallWasmFunction;
-
-  return new (zone) CallDescriptor(       // --
-      kind,                               // kind
-      target_type,                        // target MachineType
-      target_loc,                         // target location
-      locations.Build(),                  // location_sig
-      params.stack_offset,                // stack_parameter_count
-      compiler::Operator::kNoProperties,  // properties
-      kCalleeSaveRegisters,               // callee-saved registers
-      kCalleeSaveFPRegisters,             // callee-saved fp regs
-      use_retpoline ? CallDescriptor::kRetpoline
-                    : CallDescriptor::kNoFlags,  // flags
-      "wasm-call",                               // debug name
-      0,                                         // allocatable registers
-      rets.stack_offset - params.stack_offset);  // stack_return_count
-}
-
-CallDescriptor* ReplaceTypeInCallDescriptorWith(
-    Zone* zone, CallDescriptor* call_descriptor, size_t num_replacements,
-    MachineType input_type, MachineRepresentation output_type) {
-  size_t parameter_count = call_descriptor->ParameterCount();
-  size_t return_count = call_descriptor->ReturnCount();
-  for (size_t i = 0; i < call_descriptor->ParameterCount(); i++) {
-    if (call_descriptor->GetParameterType(i) == input_type) {
-      parameter_count += num_replacements - 1;
-    }
-  }
-  for (size_t i = 0; i < call_descriptor->ReturnCount(); i++) {
-    if (call_descriptor->GetReturnType(i) == input_type) {
-      return_count += num_replacements - 1;
-    }
-  }
-  if (parameter_count == call_descriptor->ParameterCount() &&
-      return_count == call_descriptor->ReturnCount()) {
-    return call_descriptor;
-  }
-
-  LocationSignature::Builder locations(zone, return_count, parameter_count);
-
-  Allocator params = parameter_registers;
-  for (size_t i = 0; i < call_descriptor->ParameterCount(); i++) {
-    if (call_descriptor->GetParameterType(i) == input_type) {
-      for (size_t j = 0; j < num_replacements; j++) {
-        locations.AddParam(params.Next(output_type));
-      }
-    } else {
-      locations.AddParam(
-          params.Next(call_descriptor->GetParameterType(i).representation()));
-    }
-  }
-
-  Allocator rets = return_registers;
-  rets.AdjustStackOffset(params.stack_offset);
-  for (size_t i = 0; i < call_descriptor->ReturnCount(); i++) {
-    if (call_descriptor->GetReturnType(i) == input_type) {
-      for (size_t j = 0; j < num_replacements; j++) {
-        locations.AddReturn(rets.Next(output_type));
-      }
-    } else {
-      locations.AddReturn(
-          rets.Next(call_descriptor->GetReturnType(i).representation()));
-    }
-  }
-
-  return new (zone) CallDescriptor(               // --
-      call_descriptor->kind(),                    // kind
-      call_descriptor->GetInputType(0),           // target MachineType
-      call_descriptor->GetInputLocation(0),       // target location
-      locations.Build(),                          // location_sig
-      params.stack_offset,                        // stack_parameter_count
-      call_descriptor->properties(),              // properties
-      call_descriptor->CalleeSavedRegisters(),    // callee-saved registers
-      call_descriptor->CalleeSavedFPRegisters(),  // callee-saved fp regs
-      call_descriptor->flags(),                   // flags
-      call_descriptor->debug_name(),              // debug name
-      call_descriptor->AllocatableRegisters(),    // allocatable registers
-      rets.stack_offset - params.stack_offset);   // stack_return_count
-}
-
-CallDescriptor* GetI32WasmCallDescriptor(Zone* zone,
-                                         CallDescriptor* call_descriptor) {
-  return ReplaceTypeInCallDescriptorWith(zone, call_descriptor, 2,
-                                         MachineType::Int64(),
-                                         MachineRepresentation::kWord32);
-}
-
-CallDescriptor* GetI32WasmCallDescriptorForSimd(
-    Zone* zone, CallDescriptor* call_descriptor) {
-  return ReplaceTypeInCallDescriptorWith(zone, call_descriptor, 4,
-                                         MachineType::Simd128(),
-                                         MachineRepresentation::kWord32);
-}
-
-#undef GP_PARAM_REGISTERS
-#undef GP_RETURN_REGISTERS
-#undef FP_PARAM_REGISTERS
-#undef FP_RETURN_REGISTERS
-
-}  // namespace compiler
-}  // namespace internal
-}  // namespace v8
diff --git a/deps/v8/src/compiler/x64/code-generator-x64.cc b/deps/v8/src/compiler/x64/code-generator-x64.cc
index 43d6cbefb65ce1..dbe127e0e81dbe 100644
--- a/deps/v8/src/compiler/x64/code-generator-x64.cc
+++ b/deps/v8/src/compiler/x64/code-generator-x64.cc
@@ -187,12 +187,14 @@ class OutOfLineLoadFloat64NaN final : public OutOfLineCode {
 class OutOfLineTruncateDoubleToI final : public OutOfLineCode {
  public:
   OutOfLineTruncateDoubleToI(CodeGenerator* gen, Register result,
-                             XMMRegister input,
+                             XMMRegister input, StubCallMode stub_mode,
                              UnwindingInfoWriter* unwinding_info_writer)
       : OutOfLineCode(gen),
         result_(result),
         input_(input),
+        stub_mode_(stub_mode),
         unwinding_info_writer_(unwinding_info_writer),
+        isolate_(gen->isolate()),
         zone_(gen->zone()) {}
 
   void Generate() final {
@@ -200,7 +202,14 @@ class OutOfLineTruncateDoubleToI final : public OutOfLineCode {
     unwinding_info_writer_->MaybeIncreaseBaseOffsetAt(__ pc_offset(),
                                                       kDoubleSize);
     __ Movsd(MemOperand(rsp, 0), input_);
-    __ SlowTruncateToIDelayed(zone_, result_);
+    if (stub_mode_ == StubCallMode::kCallWasmRuntimeStub) {
+      // A direct call to a wasm runtime stub defined in this module.
+      // Just encode the stub index. This will be patched at relocation.
+      __ near_call(wasm::WasmCode::kDoubleToI, RelocInfo::WASM_STUB_CALL);
+    } else {
+      __ Call(BUILTIN_CODE(isolate_, DoubleToI), RelocInfo::CODE_TARGET);
+    }
+    __ movl(result_, MemOperand(rsp, 0));
     __ addp(rsp, Immediate(kDoubleSize));
     unwinding_info_writer_->MaybeIncreaseBaseOffsetAt(__ pc_offset(),
                                                       -kDoubleSize);
@@ -209,7 +218,9 @@ class OutOfLineTruncateDoubleToI final : public OutOfLineCode {
  private:
   Register const result_;
   XMMRegister const input_;
+  StubCallMode stub_mode_;
   UnwindingInfoWriter* const unwinding_info_writer_;
+  Isolate* isolate_;
   Zone* zone_;
 };
 
@@ -259,44 +270,29 @@ class OutOfLineRecordWrite final : public OutOfLineCode {
 
 class WasmOutOfLineTrap : public OutOfLineCode {
  public:
-  WasmOutOfLineTrap(CodeGenerator* gen, bool frame_elided, Instruction* instr)
-      : OutOfLineCode(gen),
-        gen_(gen),
-        frame_elided_(frame_elided),
-        instr_(instr) {}
+  WasmOutOfLineTrap(CodeGenerator* gen, Instruction* instr)
+      : OutOfLineCode(gen), gen_(gen), instr_(instr) {}
 
   void Generate() override {
     X64OperandConverter i(gen_, instr_);
-
-    Builtins::Name trap_id =
-        static_cast<Builtins::Name>(i.InputInt32(instr_->InputCount() - 1));
+    TrapId trap_id =
+        static_cast<TrapId>(i.InputInt32(instr_->InputCount() - 1));
     GenerateWithTrapId(trap_id);
   }
 
  protected:
   CodeGenerator* gen_;
 
-  void GenerateWithTrapId(Builtins::Name trap_id) {
-    bool old_has_frame = __ has_frame();
-    if (frame_elided_) {
-      __ set_has_frame(true);
-      __ EnterFrame(StackFrame::WASM_COMPILED);
-    }
-    GenerateCallToTrap(trap_id);
-    if (frame_elided_) {
-      __ set_has_frame(old_has_frame);
-    }
-  }
+  void GenerateWithTrapId(TrapId trap_id) { GenerateCallToTrap(trap_id); }
 
  private:
-  void GenerateCallToTrap(Builtins::Name trap_id) {
+  void GenerateCallToTrap(TrapId trap_id) {
     if (!gen_->wasm_runtime_exception_support()) {
       // We cannot test calls to the runtime in cctest/test-run-wasm.
       // Therefore we emit a call to C here instead of a call to the runtime.
       __ PrepareCallCFunction(0);
-      __ CallCFunction(
-          ExternalReference::wasm_call_trap_callback_for_testing(__ isolate()),
-          0);
+      __ CallCFunction(ExternalReference::wasm_call_trap_callback_for_testing(),
+                       0);
       __ LeaveFrame(StackFrame::WASM_COMPILED);
       auto call_descriptor = gen_->linkage()->GetIncomingDescriptor();
       size_t pop_size = call_descriptor->StackParameterCount() * kPointerSize;
@@ -304,8 +300,9 @@ class WasmOutOfLineTrap : public OutOfLineCode {
       __ Ret(static_cast<int>(pop_size), rcx);
     } else {
       gen_->AssembleSourcePosition(instr_);
-      __ Call(__ isolate()->builtins()->builtin_handle(trap_id),
-              RelocInfo::CODE_TARGET);
+      // A direct call to a wasm runtime stub defined in this module.
+      // Just encode the stub index. This will be patched at relocation.
+      __ near_call(static_cast<Address>(trap_id), RelocInfo::WASM_STUB_CALL);
       ReferenceMap* reference_map =
           new (gen_->zone()) ReferenceMap(gen_->zone());
       gen_->RecordSafepoint(reference_map, Safepoint::kSimple, 0,
@@ -314,20 +311,17 @@ class WasmOutOfLineTrap : public OutOfLineCode {
     }
   }
 
-  bool frame_elided_;
   Instruction* instr_;
 };
 
 class WasmProtectedInstructionTrap final : public WasmOutOfLineTrap {
  public:
-  WasmProtectedInstructionTrap(CodeGenerator* gen, int pc, bool frame_elided,
-                               Instruction* instr)
-      : WasmOutOfLineTrap(gen, frame_elided, instr), pc_(pc) {}
+  WasmProtectedInstructionTrap(CodeGenerator* gen, int pc, Instruction* instr)
+      : WasmOutOfLineTrap(gen, instr), pc_(pc) {}
 
   void Generate() final {
     gen_->AddProtectedInstructionLanding(pc_, __ pc_offset());
-
-    GenerateWithTrapId(Builtins::kThrowWasmTrapMemOutOfBounds);
+    GenerateWithTrapId(TrapId::kTrapMemOutOfBounds);
   }
 
  private:
@@ -340,8 +334,7 @@ void EmitOOLTrapIfNeeded(Zone* zone, CodeGenerator* codegen,
   const MemoryAccessMode access_mode =
       static_cast<MemoryAccessMode>(MiscField::decode(opcode));
   if (access_mode == kMemoryAccessProtected) {
-    const bool frame_elided = !codegen->frame_access_state()->has_frame();
-    new (zone) WasmProtectedInstructionTrap(codegen, pc, frame_elided, instr);
+    new (zone) WasmProtectedInstructionTrap(codegen, pc, instr);
   }
 }
 
@@ -497,18 +490,16 @@ void EmitWordLoadPoisoningIfNeeded(CodeGenerator* codegen,
     }                                                                  \
   } while (0)
 
-#define ASSEMBLE_IEEE754_BINOP(name)                                    \
-  do {                                                                  \
-    __ PrepareCallCFunction(2);                                         \
-    __ CallCFunction(                                                   \
-        ExternalReference::ieee754_##name##_function(__ isolate()), 2); \
+#define ASSEMBLE_IEEE754_BINOP(name)                                     \
+  do {                                                                   \
+    __ PrepareCallCFunction(2);                                          \
+    __ CallCFunction(ExternalReference::ieee754_##name##_function(), 2); \
   } while (false)
 
-#define ASSEMBLE_IEEE754_UNOP(name)                                     \
-  do {                                                                  \
-    __ PrepareCallCFunction(1);                                         \
-    __ CallCFunction(                                                   \
-        ExternalReference::ieee754_##name##_function(__ isolate()), 1); \
+#define ASSEMBLE_IEEE754_UNOP(name)                                      \
+  do {                                                                   \
+    __ PrepareCallCFunction(1);                                          \
+    __ CallCFunction(ExternalReference::ieee754_##name##_function(), 1); \
   } while (false)
 
 #define ASSEMBLE_ATOMIC_BINOP(bin_inst, mov_inst, cmpxchg_inst) \
@@ -563,9 +554,8 @@ void CodeGenerator::AssemblePopArgumentsAdaptorFrame(Register args_reg,
   // Load arguments count from current arguments adaptor frame (note, it
   // does not include receiver).
   Register caller_args_count_reg = scratch1;
-  __ SmiToInteger32(
-      caller_args_count_reg,
-      Operand(rbp, ArgumentsAdaptorFrameConstants::kLengthOffset));
+  __ SmiUntag(caller_args_count_reg,
+              Operand(rbp, ArgumentsAdaptorFrameConstants::kLengthOffset));
 
   ParameterCount callee_args_count(args_reg);
   __ PrepareForTailCall(callee_args_count, caller_args_count_reg, scratch2,
@@ -654,6 +644,9 @@ void CodeGenerator::BailoutIfDeoptimized() {
   __ movp(rbx, Operand(kJavaScriptCallCodeStartRegister, offset));
   __ testl(FieldOperand(rbx, CodeDataContainer::kKindSpecificFlagsOffset),
            Immediate(1 << Code::kMarkedForDeoptimizationBit));
+  // Ensure we're not serializing (otherwise we'd need to use an indirection to
+  // access the builtin below).
+  DCHECK(!isolate()->ShouldLoadConstantsFromRootList());
   Handle<Code> code = isolate()->builtins()->builtin_handle(
       Builtins::kCompileLazyDeoptimizedCode);
   __ j(not_zero, code, RelocInfo::CODE_TARGET);
@@ -688,6 +681,9 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
         __ Call(code, RelocInfo::CODE_TARGET);
       } else {
         Register reg = i.InputRegister(0);
+        DCHECK_IMPLIES(
+            HasCallDescriptorFlag(instr, CallDescriptor::kFixedTargetRegister),
+            reg == kJavaScriptCallCodeStartRegister);
         __ addp(reg, Immediate(Code::kHeaderSize - kHeapObjectTag));
         if (HasCallDescriptorFlag(instr, CallDescriptor::kRetpoline)) {
           __ RetpolineCall(reg);
@@ -701,15 +697,15 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
     }
     case kArchCallWasmFunction: {
       if (HasImmediateInput(instr, 0)) {
-        Address wasm_code = reinterpret_cast<Address>(
-            i.ToConstant(instr->InputAt(0)).ToInt64());
-        if (info()->IsWasm()) {
-          __ near_call(wasm_code, RelocInfo::WASM_CALL);
+        Constant constant = i.ToConstant(instr->InputAt(0));
+        Address wasm_code = static_cast<Address>(constant.ToInt64());
+        if (DetermineStubCallMode() == StubCallMode::kCallWasmRuntimeStub) {
+          __ near_call(wasm_code, constant.rmode());
         } else {
           if (HasCallDescriptorFlag(instr, CallDescriptor::kRetpoline)) {
-            __ RetpolineCall(wasm_code, RelocInfo::JS_TO_WASM_CALL);
+            __ RetpolineCall(wasm_code, constant.rmode());
           } else {
-            __ Call(wasm_code, RelocInfo::JS_TO_WASM_CALL);
+            __ Call(wasm_code, constant.rmode());
           }
         }
       } else {
@@ -733,9 +729,12 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       }
       if (HasImmediateInput(instr, 0)) {
         Handle<Code> code = i.InputCode(0);
-        __ jmp(code, RelocInfo::CODE_TARGET);
+        __ Jump(code, RelocInfo::CODE_TARGET);
       } else {
         Register reg = i.InputRegister(0);
+        DCHECK_IMPLIES(
+            HasCallDescriptorFlag(instr, CallDescriptor::kFixedTargetRegister),
+            reg == kJavaScriptCallCodeStartRegister);
         __ addp(reg, Immediate(Code::kHeaderSize - kHeapObjectTag));
         if (HasCallDescriptorFlag(instr, CallDescriptor::kRetpoline)) {
           __ RetpolineJump(reg);
@@ -750,12 +749,12 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
     }
     case kArchTailCallWasm: {
       if (HasImmediateInput(instr, 0)) {
-        Address wasm_code = reinterpret_cast<Address>(
-            i.ToConstant(instr->InputAt(0)).ToInt64());
-        if (info()->IsWasm()) {
-          __ near_jmp(wasm_code, RelocInfo::WASM_CALL);
+        Constant constant = i.ToConstant(instr->InputAt(0));
+        Address wasm_code = static_cast<Address>(constant.ToInt64());
+        if (DetermineStubCallMode() == StubCallMode::kCallWasmRuntimeStub) {
+          __ near_jmp(wasm_code, constant.rmode());
         } else {
-          __ Move(kScratchRegister, wasm_code, RelocInfo::JS_TO_WASM_CALL);
+          __ Move(kScratchRegister, wasm_code, constant.rmode());
           __ jmp(kScratchRegister);
         }
       } else {
@@ -774,10 +773,9 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
     case kArchTailCallAddress: {
       CHECK(!HasImmediateInput(instr, 0));
       Register reg = i.InputRegister(0);
-      if (HasCallDescriptorFlag(instr, CallDescriptor::kFixedTargetRegister)) {
-        static_assert(kJavaScriptCallCodeStartRegister == rcx, "ABI mismatch");
-        DCHECK_EQ(rcx, reg);
-      }
+      DCHECK_IMPLIES(
+          HasCallDescriptorFlag(instr, CallDescriptor::kFixedTargetRegister),
+          reg == kJavaScriptCallCodeStartRegister);
       if (HasCallDescriptorFlag(instr, CallDescriptor::kRetpoline)) {
         __ RetpolineJump(reg);
       } else {
@@ -870,17 +868,18 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
     case kArchJmp:
       AssembleArchJump(i.InputRpo(0));
       break;
+    case kArchBinarySearchSwitch:
+      AssembleArchBinarySearchSwitch(instr);
+      break;
     case kArchLookupSwitch:
       AssembleArchLookupSwitch(instr);
       break;
     case kArchTableSwitch:
       AssembleArchTableSwitch(instr);
       break;
-    case kArchComment: {
-      Address comment_string = i.InputExternalReference(0).address();
-      __ RecordComment(reinterpret_cast<const char*>(comment_string));
+    case kArchComment:
+      __ RecordComment(reinterpret_cast<const char*>(i.InputInt64(0)));
       break;
-    }
     case kArchDebugAbort:
       DCHECK(i.InputRegister(0) == rdx);
       if (!frame_access_state()->has_frame()) {
@@ -894,12 +893,15 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
                 RelocInfo::CODE_TARGET);
       }
       __ int3();
+      unwinding_info_writer_.MarkBlockWillExit();
       break;
     case kArchDebugBreak:
       __ int3();
       break;
-    case kArchNop:
     case kArchThrowTerminator:
+      unwinding_info_writer_.MarkBlockWillExit();
+      break;
+    case kArchNop:
       // don't emit code for nops.
       break;
     case kArchDeoptimize: {
@@ -908,6 +910,7 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       CodeGenResult result =
           AssembleDeoptimizerCall(deopt_state_id, current_source_position_);
       if (result != kSuccess) return result;
+      unwinding_info_writer_.MarkBlockWillExit();
       break;
     }
     case kArchRet:
@@ -926,14 +929,12 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
         __ movq(i.OutputRegister(), rbp);
       }
       break;
-    case kArchRootsPointer:
-      __ movq(i.OutputRegister(), kRootRegister);
-      break;
     case kArchTruncateDoubleToI: {
       auto result = i.OutputRegister();
       auto input = i.InputDoubleRegister(0);
       auto ool = new (zone()) OutOfLineTruncateDoubleToI(
-          this, result, input, &unwinding_info_writer_);
+          this, result, input, DetermineStubCallMode(),
+          &unwinding_info_writer_);
       // We use Cvttsd2siq instead of Cvttsd2si due to performance reasons. The
       // use of Cvttsd2siq requires the movl below to avoid sign extension.
       __ Cvttsd2siq(result, input);
@@ -961,7 +962,7 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       __ bind(ool->exit());
       break;
     }
-    case kArchPoisonOnSpeculationWord:
+    case kArchWordPoisonOnSpeculation:
       DCHECK_EQ(i.OutputRegister(), i.InputRegister(0));
       __ andq(i.InputRegister(0), kSpeculationPoisonRegister);
       break;
@@ -1026,7 +1027,7 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
     case kIeee754Float64Pow: {
       // TODO(bmeurer): Improve integration of the stub.
       __ Movsd(xmm2, xmm0);
-      __ CallStubDelayed(new (zone()) MathPowStub());
+      __ Call(BUILTIN_CODE(isolate(), MathPowInternal), RelocInfo::CODE_TARGET);
       __ Movsd(xmm0, xmm3);
       break;
     }
@@ -1542,89 +1543,27 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       }
       break;
     case kSSEFloat32ToUint64: {
-      Label done;
-      Label success;
-      if (instr->OutputCount() > 1) {
-        __ Set(i.OutputRegister(1), 0);
-      }
-      // There does not exist a Float32ToUint64 instruction, so we have to use
-      // the Float32ToInt64 instruction.
+      Label fail;
+      if (instr->OutputCount() > 1) __ Set(i.OutputRegister(1), 0);
       if (instr->InputAt(0)->IsFPRegister()) {
-        __ Cvttss2siq(i.OutputRegister(), i.InputDoubleRegister(0));
+        __ Cvttss2uiq(i.OutputRegister(), i.InputDoubleRegister(0), &fail);
       } else {
-        __ Cvttss2siq(i.OutputRegister(), i.InputOperand(0));
+        __ Cvttss2uiq(i.OutputRegister(), i.InputOperand(0), &fail);
       }
-      // Check if the result of the Float32ToInt64 conversion is positive, we
-      // are already done.
-      __ testq(i.OutputRegister(), i.OutputRegister());
-      __ j(positive, &success);
-      // The result of the first conversion was negative, which means that the
-      // input value was not within the positive int64 range. We subtract 2^64
-      // and convert it again to see if it is within the uint64 range.
-      __ Move(kScratchDoubleReg, -9223372036854775808.0f);
-      if (instr->InputAt(0)->IsFPRegister()) {
-        __ addss(kScratchDoubleReg, i.InputDoubleRegister(0));
-      } else {
-        __ addss(kScratchDoubleReg, i.InputOperand(0));
-      }
-      __ Cvttss2siq(i.OutputRegister(), kScratchDoubleReg);
-      __ testq(i.OutputRegister(), i.OutputRegister());
-      // The only possible negative value here is 0x80000000000000000, which is
-      // used on x64 to indicate an integer overflow.
-      __ j(negative, &done);
-      // The input value is within uint64 range and the second conversion worked
-      // successfully, but we still have to undo the subtraction we did
-      // earlier.
-      __ Set(kScratchRegister, 0x8000000000000000);
-      __ orq(i.OutputRegister(), kScratchRegister);
-      __ bind(&success);
-      if (instr->OutputCount() > 1) {
-        __ Set(i.OutputRegister(1), 1);
-      }
-      __ bind(&done);
+      if (instr->OutputCount() > 1) __ Set(i.OutputRegister(1), 1);
+      __ bind(&fail);
       break;
     }
     case kSSEFloat64ToUint64: {
-      Label done;
-      Label success;
-      if (instr->OutputCount() > 1) {
-        __ Set(i.OutputRegister(1), 0);
-      }
-      // There does not exist a Float64ToUint64 instruction, so we have to use
-      // the Float64ToInt64 instruction.
+      Label fail;
+      if (instr->OutputCount() > 1) __ Set(i.OutputRegister(1), 0);
       if (instr->InputAt(0)->IsFPRegister()) {
-        __ Cvttsd2siq(i.OutputRegister(), i.InputDoubleRegister(0));
+        __ Cvttsd2uiq(i.OutputRegister(), i.InputDoubleRegister(0), &fail);
       } else {
-        __ Cvttsd2siq(i.OutputRegister(), i.InputOperand(0));
+        __ Cvttsd2uiq(i.OutputRegister(), i.InputOperand(0), &fail);
       }
-      // Check if the result of the Float64ToInt64 conversion is positive, we
-      // are already done.
-      __ testq(i.OutputRegister(), i.OutputRegister());
-      __ j(positive, &success);
-      // The result of the first conversion was negative, which means that the
-      // input value was not within the positive int64 range. We subtract 2^64
-      // and convert it again to see if it is within the uint64 range.
-      __ Move(kScratchDoubleReg, -9223372036854775808.0);
-      if (instr->InputAt(0)->IsFPRegister()) {
-        __ addsd(kScratchDoubleReg, i.InputDoubleRegister(0));
-      } else {
-        __ addsd(kScratchDoubleReg, i.InputOperand(0));
-      }
-      __ Cvttsd2siq(i.OutputRegister(), kScratchDoubleReg);
-      __ testq(i.OutputRegister(), i.OutputRegister());
-      // The only possible negative value here is 0x80000000000000000, which is
-      // used on x64 to indicate an integer overflow.
-      __ j(negative, &done);
-      // The input value is within uint64 range and the second conversion worked
-      // successfully, but we still have to undo the subtraction we did
-      // earlier.
-      __ Set(kScratchRegister, 0x8000000000000000);
-      __ orq(i.OutputRegister(), kScratchRegister);
-      __ bind(&success);
-      if (instr->OutputCount() > 1) {
-        __ Set(i.OutputRegister(1), 1);
-      }
-      __ bind(&done);
+      if (instr->OutputCount() > 1) __ Set(i.OutputRegister(1), 1);
+      __ bind(&fail);
       break;
     }
     case kSSEInt32ToFloat64:
@@ -1657,37 +1596,31 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       break;
     case kSSEUint64ToFloat32:
       if (instr->InputAt(0)->IsRegister()) {
-        __ movq(kScratchRegister, i.InputRegister(0));
+        __ Cvtqui2ss(i.OutputDoubleRegister(), i.InputRegister(0));
       } else {
-        __ movq(kScratchRegister, i.InputOperand(0));
+        __ Cvtqui2ss(i.OutputDoubleRegister(), i.InputOperand(0));
       }
-      __ Cvtqui2ss(i.OutputDoubleRegister(), kScratchRegister,
-                   i.TempRegister(0));
       break;
     case kSSEUint64ToFloat64:
       if (instr->InputAt(0)->IsRegister()) {
-        __ movq(kScratchRegister, i.InputRegister(0));
+        __ Cvtqui2sd(i.OutputDoubleRegister(), i.InputRegister(0));
       } else {
-        __ movq(kScratchRegister, i.InputOperand(0));
+        __ Cvtqui2sd(i.OutputDoubleRegister(), i.InputOperand(0));
       }
-      __ Cvtqui2sd(i.OutputDoubleRegister(), kScratchRegister,
-                   i.TempRegister(0));
       break;
     case kSSEUint32ToFloat64:
       if (instr->InputAt(0)->IsRegister()) {
-        __ movl(kScratchRegister, i.InputRegister(0));
+        __ Cvtlui2sd(i.OutputDoubleRegister(), i.InputRegister(0));
       } else {
-        __ movl(kScratchRegister, i.InputOperand(0));
+        __ Cvtlui2sd(i.OutputDoubleRegister(), i.InputOperand(0));
       }
-      __ Cvtqsi2sd(i.OutputDoubleRegister(), kScratchRegister);
       break;
     case kSSEUint32ToFloat32:
       if (instr->InputAt(0)->IsRegister()) {
-        __ movl(kScratchRegister, i.InputRegister(0));
+        __ Cvtlui2ss(i.OutputDoubleRegister(), i.InputRegister(0));
       } else {
-        __ movl(kScratchRegister, i.InputOperand(0));
+        __ Cvtlui2ss(i.OutputDoubleRegister(), i.InputOperand(0));
       }
-      __ Cvtqsi2ss(i.OutputDoubleRegister(), kScratchRegister);
       break;
     case kSSEFloat64ExtractLowWord32:
       if (instr->InputAt(0)->IsFPStackSlot()) {
@@ -3007,8 +2940,7 @@ void CodeGenerator::AssembleArchJump(RpoNumber target) {
 
 void CodeGenerator::AssembleArchTrap(Instruction* instr,
                                      FlagsCondition condition) {
-  bool frame_elided = !frame_access_state()->has_frame();
-  auto ool = new (zone()) WasmOutOfLineTrap(this, frame_elided, instr);
+  auto ool = new (zone()) WasmOutOfLineTrap(this, instr);
   Label* tlabel = ool->entry();
   Label end;
   if (condition == kUnorderedEqual) {
@@ -3046,6 +2978,17 @@ void CodeGenerator::AssembleArchBoolean(Instruction* instr,
   __ bind(&done);
 }
 
+void CodeGenerator::AssembleArchBinarySearchSwitch(Instruction* instr) {
+  X64OperandConverter i(this, instr);
+  Register input = i.InputRegister(0);
+  std::vector<std::pair<int32_t, Label*>> cases;
+  for (size_t index = 2; index < instr->InputCount(); index += 2) {
+    cases.push_back({i.InputInt32(index + 0), GetLabel(i.InputRpo(index + 1))});
+  }
+  AssembleArchBinarySearchSwitchRange(input, i.InputRpo(1), cases.data(),
+                                      cases.data() + cases.size());
+}
+
 void CodeGenerator::AssembleArchLookupSwitch(Instruction* instr) {
   X64OperandConverter i(this, instr);
   Register input = i.InputRegister(0);
@@ -3056,7 +2999,6 @@ void CodeGenerator::AssembleArchLookupSwitch(Instruction* instr) {
   AssembleArchJump(i.InputRpo(1));
 }
 
-
 void CodeGenerator::AssembleArchTableSwitch(Instruction* instr) {
   X64OperandConverter i(this, instr);
   Register input = i.InputRegister(0);
@@ -3117,6 +3059,9 @@ void CodeGenerator::AssembleConstructFrame() {
       }
     } else {
       __ StubPrologue(info()->GetOutputStackFrameType());
+      if (call_descriptor->IsWasmFunctionCall()) {
+        __ pushq(kWasmInstanceRegister);
+      }
     }
 
     unwinding_info_writer_.MarkFrameConstructed(pc_base);
@@ -3142,6 +3087,7 @@ void CodeGenerator::AssembleConstructFrame() {
   const RegList saves_fp = call_descriptor->CalleeSavedFPRegisters();
 
   if (shrink_slots > 0) {
+    DCHECK(frame_access_state()->has_frame());
     if (info()->IsWasm() && shrink_slots > 128) {
       // For WebAssembly functions with big frames we have to do the stack
       // overflow check before we construct the frame. Otherwise we may not
@@ -3153,19 +3099,18 @@ void CodeGenerator::AssembleConstructFrame() {
       // exception unconditionally. Thereby we can avoid the integer overflow
       // check in the condition code.
       if (shrink_slots * kPointerSize < FLAG_stack_size * 1024) {
-        __ Move(kScratchRegister,
-                ExternalReference::address_of_real_stack_limit(__ isolate()));
+        __ movq(kScratchRegister,
+                FieldOperand(kWasmInstanceRegister,
+                             WasmInstanceObject::kRealStackLimitAddressOffset));
         __ movq(kScratchRegister, Operand(kScratchRegister, 0));
         __ addq(kScratchRegister, Immediate(shrink_slots * kPointerSize));
         __ cmpq(rsp, kScratchRegister);
         __ j(above_equal, &done);
       }
-      if (!frame_access_state()->has_frame()) {
-        __ set_has_frame(true);
-        __ EnterFrame(StackFrame::WASM_COMPILED);
-      }
+      __ movp(rcx, FieldOperand(kWasmInstanceRegister,
+                                WasmInstanceObject::kCEntryStubOffset));
       __ Move(rsi, Smi::kZero);
-      __ CallRuntimeDelayed(zone(), Runtime::kThrowWasmStackOverflow);
+      __ CallRuntimeWithCEntry(Runtime::kThrowWasmStackOverflow, rcx);
       ReferenceMap* reference_map = new (zone()) ReferenceMap(zone());
       RecordSafepoint(reference_map, Safepoint::kSimple, 0,
                       Safepoint::kNoLazyDeopt);
@@ -3332,6 +3277,23 @@ void CodeGenerator::AssembleMove(InstructionOperand* source,
         break;
     }
   };
+  // Helper function to write the given constant to the stack.
+  auto MoveConstantToSlot = [&](Operand dst, Constant src) {
+    if (!RelocInfo::IsWasmPtrReference(src.rmode())) {
+      switch (src.type()) {
+        case Constant::kInt32:
+          __ movq(dst, Immediate(src.ToInt32()));
+          return;
+        case Constant::kInt64:
+          __ Set(dst, src.ToInt64());
+          return;
+        default:
+          break;
+      }
+    }
+    MoveConstantToRegister(kScratchRegister, src);
+    __ movq(dst, kScratchRegister);
+  };
   // Dispatch on the source and destination operand kinds.
   switch (MoveType::InferMove(source, destination)) {
     case MoveType::kRegisterToRegister:
@@ -3419,8 +3381,7 @@ void CodeGenerator::AssembleMove(InstructionOperand* source,
       Constant src = g.ToConstant(source);
       Operand dst = g.ToOperand(destination);
       if (destination->IsStackSlot()) {
-        MoveConstantToRegister(kScratchRegister, src);
-        __ movq(dst, kScratchRegister);
+        MoveConstantToSlot(dst, src);
       } else {
         DCHECK(destination->IsFPStackSlot());
         if (src.type() == Constant::kFloat32) {
diff --git a/deps/v8/src/compiler/x64/instruction-selector-x64.cc b/deps/v8/src/compiler/x64/instruction-selector-x64.cc
index db7584ccf93d8a..975d7b7c88e9d9 100644
--- a/deps/v8/src/compiler/x64/instruction-selector-x64.cc
+++ b/deps/v8/src/compiler/x64/instruction-selector-x64.cc
@@ -8,6 +8,7 @@
 #include "src/compiler/instruction-selector-impl.h"
 #include "src/compiler/node-matchers.h"
 #include "src/compiler/node-properties.h"
+#include "src/turbo-assembler.h"
 
 namespace v8 {
 namespace internal {
@@ -165,30 +166,16 @@ class X64OperandGenerator final : public OperandGenerator {
     if (selector()->CanAddressRelativeToRootsRegister()) {
       LoadMatcher<ExternalReferenceMatcher> m(operand);
       if (m.index().HasValue() && m.object().HasValue()) {
-        Address const kRootsRegisterValue =
-            kRootRegisterBias +
-            reinterpret_cast<Address>(
-                selector()->isolate()->heap()->roots_array_start());
         ptrdiff_t const delta =
             m.index().Value() +
-            (m.object().Value().address() - kRootsRegisterValue);
+            TurboAssemblerBase::RootRegisterOffsetForExternalReference(
+                selector()->isolate(), m.object().Value());
         if (is_int32(delta)) {
           inputs[(*input_count)++] = TempImmediate(static_cast<int32_t>(delta));
           return kMode_Root;
         }
       }
     }
-    if (operand->InputCount() == 2) {
-      Node* left = operand->InputAt(0);
-      Node* right = operand->InputAt(1);
-      if (left->opcode() == IrOpcode::kLoadRootsPointer &&
-          right->opcode() == IrOpcode::kInt64Constant) {
-        int64_t offset = OpParameter<int64_t>(right->op());
-        DCHECK(is_int32(offset));
-        inputs[(*input_count)++] = TempImmediate(static_cast<int32_t>(offset));
-        return kMode_Root;
-      }
-    }
     BaseWithIndexAndDisplacement64Matcher m(operand, AddressOption::kAllowAll);
     DCHECK(m.matches());
     if (m.displacement() == nullptr || CanBeImmediate(m.displacement())) {
@@ -320,7 +307,7 @@ void InstructionSelector::VisitLoad(Node* node) {
   if (node->opcode() == IrOpcode::kProtectedLoad) {
     code |= MiscField::encode(kMemoryAccessProtected);
   } else if (node->opcode() == IrOpcode::kPoisonedLoad) {
-    CHECK_EQ(poisoning_enabled_, PoisoningMitigationLevel::kOn);
+    CHECK_NE(poisoning_level_, PoisoningMitigationLevel::kDontPoison);
     code |= MiscField::encode(kMemoryAccessPoisoned);
   }
   Emit(code, 1, outputs, input_count, inputs);
@@ -427,7 +414,7 @@ static void VisitBinop(InstructionSelector* selector, Node* node,
   Int32BinopMatcher m(node);
   Node* left = m.left().node();
   Node* right = m.right().node();
-  InstructionOperand inputs[4];
+  InstructionOperand inputs[8];
   size_t input_count = 0;
   InstructionOperand outputs[1];
   size_t output_count = 0;
@@ -589,6 +576,28 @@ void VisitWord64Shift(InstructionSelector* selector, Node* node,
   }
 }
 
+// Shared routine for multiple shift operations with continuation.
+template <typename BinopMatcher, int Bits>
+bool TryVisitWordShift(InstructionSelector* selector, Node* node,
+                       ArchOpcode opcode, FlagsContinuation* cont) {
+  X64OperandGenerator g(selector);
+  BinopMatcher m(node);
+  Node* left = m.left().node();
+  Node* right = m.right().node();
+
+  // If the shift count is 0, the flags are not affected.
+  if (!g.CanBeImmediate(right) ||
+      (g.GetImmediateIntegerValue(right) & (Bits - 1)) == 0) {
+    return false;
+  }
+  InstructionOperand output = g.DefineSameAsFirst(node);
+  InstructionOperand inputs[2];
+  inputs[0] = g.UseRegister(left);
+  inputs[1] = g.UseImmediate(right);
+  selector->EmitWithContinuation(opcode, 1, &output, 2, inputs, cont);
+  return true;
+}
+
 void EmitLea(InstructionSelector* selector, InstructionCode opcode,
              Node* result, Node* index, int scale, Node* base,
              Node* displacement, DisplacementMode displacement_mode) {
@@ -832,6 +841,19 @@ void InstructionSelector::VisitInt64AddWithOverflow(Node* node) {
 
 void InstructionSelector::VisitInt32Sub(Node* node) {
   X64OperandGenerator g(this);
+  DCHECK_EQ(node->InputCount(), 2);
+  Node* input1 = node->InputAt(0);
+  Node* input2 = node->InputAt(1);
+  if (input1->opcode() == IrOpcode::kTruncateInt64ToInt32 &&
+      g.CanBeImmediate(input2)) {
+    // Omit truncation and turn subtractions of constant values into immediate
+    // "leal" instructions by negating the value.
+    Emit(kX64Lea32 | AddressingModeField::encode(kMode_MRI),
+         g.DefineAsRegister(node), g.UseRegister(input1->InputAt(0)),
+         g.TempImmediate(-g.GetImmediateIntegerValue(input2)));
+    return;
+  }
+
   Int32BinopMatcher m(node);
   if (m.left().Is(0)) {
     Emit(kX64Neg32, g.DefineSameAsFirst(node), g.UseRegister(m.right().node()));
@@ -1248,7 +1270,9 @@ void VisitFloatUnop(InstructionSelector* selector, Node* node, Node* input,
   V(RoundFloat64ToInt32, kSSEFloat64ToInt32)                             \
   V(RoundInt32ToFloat32, kSSEInt32ToFloat32)                             \
   V(RoundInt64ToFloat32, kSSEInt64ToFloat32)                             \
+  V(RoundUint64ToFloat32, kSSEUint64ToFloat32)                           \
   V(RoundInt64ToFloat64, kSSEInt64ToFloat64)                             \
+  V(RoundUint64ToFloat64, kSSEUint64ToFloat64)                           \
   V(RoundUint32ToFloat32, kSSEUint32ToFloat32)                           \
   V(BitcastFloat32ToInt32, kX64BitcastFI)                                \
   V(BitcastFloat64ToInt64, kX64BitcastDL)                                \
@@ -1318,21 +1342,6 @@ void InstructionSelector::VisitTruncateInt64ToInt32(Node* node) {
   Emit(kX64Movl, g.DefineAsRegister(node), g.Use(value));
 }
 
-void InstructionSelector::VisitRoundUint64ToFloat32(Node* node) {
-  X64OperandGenerator g(this);
-  InstructionOperand temps[] = {g.TempRegister()};
-  Emit(kSSEUint64ToFloat32, g.DefineAsRegister(node), g.Use(node->InputAt(0)),
-       arraysize(temps), temps);
-}
-
-
-void InstructionSelector::VisitRoundUint64ToFloat64(Node* node) {
-  X64OperandGenerator g(this);
-  InstructionOperand temps[] = {g.TempRegister()};
-  Emit(kSSEUint64ToFloat64, g.DefineAsRegister(node), g.Use(node->InputAt(0)),
-       arraysize(temps), temps);
-}
-
 void InstructionSelector::VisitFloat32Add(Node* node) {
   VisitFloatBinop(this, node, kAVXFloat32Add, kSSEFloat32Add);
 }
@@ -1693,7 +1702,7 @@ void VisitWord64Compare(InstructionSelector* selector, Node* node,
           kX64Cmp | AddressingModeField::encode(kMode_Root);
       return VisitCompare(
           selector, opcode,
-          g.TempImmediate((root_index * kPointerSize) - kRootRegisterBias),
+          g.TempImmediate(TurboAssemblerBase::RootRegisterOffset(root_index)),
           g.UseRegister(m.left().node()), cont);
     } else if (m.left().HasValue() &&
                heap->IsRootHandle(m.left().Value(), &root_index)) {
@@ -1701,32 +1710,84 @@ void VisitWord64Compare(InstructionSelector* selector, Node* node,
           kX64Cmp | AddressingModeField::encode(kMode_Root);
       return VisitCompare(
           selector, opcode,
-          g.TempImmediate((root_index * kPointerSize) - kRootRegisterBias),
+          g.TempImmediate(TurboAssemblerBase::RootRegisterOffset(root_index)),
           g.UseRegister(m.right().node()), cont);
     }
   }
-  Int64BinopMatcher m(node);
-  if (m.left().IsLoad() && m.right().IsLoadStackPointer()) {
-    LoadMatcher<ExternalReferenceMatcher> mleft(m.left().node());
-    ExternalReference js_stack_limit =
-        ExternalReference::address_of_stack_limit(selector->isolate());
-    if (mleft.object().Is(js_stack_limit) && mleft.index().Is(0)) {
-      // Compare(Load(js_stack_limit), LoadStackPointer)
-      if (!node->op()->HasProperty(Operator::kCommutative)) cont->Commute();
-      InstructionCode opcode = cont->Encode(kX64StackCheck);
-      CHECK(cont->IsBranch());
-      selector->EmitWithContinuation(opcode, cont);
-      return;
-    }
+  StackCheckMatcher<Int64BinopMatcher, IrOpcode::kUint64LessThan> m(
+      selector->isolate(), node);
+  if (m.Matched()) {
+    // Compare(Load(js_stack_limit), LoadStackPointer)
+    if (!node->op()->HasProperty(Operator::kCommutative)) cont->Commute();
+    InstructionCode opcode = cont->Encode(kX64StackCheck);
+    CHECK(cont->IsBranch());
+    selector->EmitWithContinuation(opcode, cont);
+    return;
+  }
+  WasmStackCheckMatcher<Int64BinopMatcher, IrOpcode::kUint64LessThan> wasm_m(
+      node);
+  if (wasm_m.Matched()) {
+    // This is a wasm stack check. By structure, we know that we can use the
+    // stack pointer directly, as wasm code does not modify the stack at points
+    // where stack checks are performed.
+    Node* left = node->InputAt(0);
+    LocationOperand rsp(InstructionOperand::EXPLICIT, LocationOperand::REGISTER,
+                        InstructionSequence::DefaultRepresentation(),
+                        RegisterCode::kRegCode_rsp);
+    return VisitCompareWithMemoryOperand(selector, kX64Cmp, left, rsp, cont);
   }
   VisitWordCompare(selector, node, kX64Cmp, cont);
 }
 
-
 // Shared routine for comparison with zero.
-void VisitCompareZero(InstructionSelector* selector, Node* node,
+void VisitCompareZero(InstructionSelector* selector, Node* user, Node* node,
                       InstructionCode opcode, FlagsContinuation* cont) {
   X64OperandGenerator g(selector);
+  if (cont->IsBranch() &&
+      (cont->condition() == kNotEqual || cont->condition() == kEqual)) {
+    switch (node->opcode()) {
+#define FLAGS_SET_BINOP_LIST(V)        \
+  V(kInt32Add, VisitBinop, kX64Add32)  \
+  V(kInt32Sub, VisitBinop, kX64Sub32)  \
+  V(kWord32And, VisitBinop, kX64And32) \
+  V(kWord32Or, VisitBinop, kX64Or32)   \
+  V(kInt64Add, VisitBinop, kX64Add)    \
+  V(kInt64Sub, VisitBinop, kX64Sub)    \
+  V(kWord64And, VisitBinop, kX64And)   \
+  V(kWord64Or, VisitBinop, kX64Or)
+#define FLAGS_SET_BINOP(opcode, Visit, archOpcode)           \
+  case IrOpcode::opcode:                                     \
+    if (selector->IsOnlyUserOfNodeInSameBlock(user, node)) { \
+      return Visit(selector, node, archOpcode, cont);        \
+    }                                                        \
+    break;
+      FLAGS_SET_BINOP_LIST(FLAGS_SET_BINOP)
+#undef FLAGS_SET_BINOP_LIST
+#undef FLAGS_SET_BINOP
+
+#define TRY_VISIT_WORD32_SHIFT TryVisitWordShift<Int32BinopMatcher, 32>
+#define TRY_VISIT_WORD64_SHIFT TryVisitWordShift<Int64BinopMatcher, 64>
+// Skip Word64Sar/Word32Sar since no instruction reduction in most cases.
+#define FLAGS_SET_SHIFT_LIST(V)                    \
+  V(kWord32Shl, TRY_VISIT_WORD32_SHIFT, kX64Shl32) \
+  V(kWord32Shr, TRY_VISIT_WORD32_SHIFT, kX64Shr32) \
+  V(kWord64Shl, TRY_VISIT_WORD64_SHIFT, kX64Shl)   \
+  V(kWord64Shr, TRY_VISIT_WORD64_SHIFT, kX64Shr)
+#define FLAGS_SET_SHIFT(opcode, TryVisit, archOpcode)         \
+  case IrOpcode::opcode:                                      \
+    if (selector->IsOnlyUserOfNodeInSameBlock(user, node)) {  \
+      if (TryVisit(selector, node, archOpcode, cont)) return; \
+    }                                                         \
+    break;
+      FLAGS_SET_SHIFT_LIST(FLAGS_SET_SHIFT)
+#undef TRY_VISIT_WORD32_SHIFT
+#undef TRY_VISIT_WORD64_SHIFT
+#undef FLAGS_SET_SHIFT_LIST
+#undef FLAGS_SET_SHIFT
+      default:
+        break;
+    }
+  }
   VisitCompare(selector, opcode, g.Use(node), g.TempImmediate(0), cont);
 }
 
@@ -1752,6 +1813,102 @@ void VisitFloat64Compare(InstructionSelector* selector, Node* node,
   VisitCompare(selector, opcode, right, left, cont, false);
 }
 
+// Shared routine for Word32/Word64 Atomic Binops
+void VisitAtomicBinop(InstructionSelector* selector, Node* node,
+                      ArchOpcode opcode) {
+  X64OperandGenerator g(selector);
+  Node* base = node->InputAt(0);
+  Node* index = node->InputAt(1);
+  Node* value = node->InputAt(2);
+  AddressingMode addressing_mode;
+  InstructionOperand index_operand;
+  if (g.CanBeImmediate(index)) {
+    index_operand = g.UseImmediate(index);
+    addressing_mode = kMode_MRI;
+  } else {
+    index_operand = g.UseUniqueRegister(index);
+    addressing_mode = kMode_MR1;
+  }
+  InstructionOperand inputs[] = {g.UseUniqueRegister(value),
+                                 g.UseUniqueRegister(base), index_operand};
+  InstructionOperand outputs[] = {g.DefineAsFixed(node, rax)};
+  InstructionOperand temps[] = {g.TempRegister()};
+  InstructionCode code = opcode | AddressingModeField::encode(addressing_mode);
+  selector->Emit(code, arraysize(outputs), outputs, arraysize(inputs), inputs,
+                 arraysize(temps), temps);
+}
+
+// Shared routine for Word32/Word64 Atomic CmpExchg
+void VisitAtomicCompareExchange(InstructionSelector* selector, Node* node,
+                                ArchOpcode opcode) {
+  X64OperandGenerator g(selector);
+  Node* base = node->InputAt(0);
+  Node* index = node->InputAt(1);
+  Node* old_value = node->InputAt(2);
+  Node* new_value = node->InputAt(3);
+  AddressingMode addressing_mode;
+  InstructionOperand index_operand;
+  if (g.CanBeImmediate(index)) {
+    index_operand = g.UseImmediate(index);
+    addressing_mode = kMode_MRI;
+  } else {
+    index_operand = g.UseUniqueRegister(index);
+    addressing_mode = kMode_MR1;
+  }
+  InstructionOperand inputs[] = {g.UseFixed(old_value, rax),
+                                 g.UseUniqueRegister(new_value),
+                                 g.UseUniqueRegister(base), index_operand};
+  InstructionOperand outputs[] = {g.DefineAsFixed(node, rax)};
+  InstructionCode code = opcode | AddressingModeField::encode(addressing_mode);
+  selector->Emit(code, arraysize(outputs), outputs, arraysize(inputs), inputs);
+}
+
+// Shared routine for Word32/Word64 Atomic Exchange
+void VisitAtomicExchange(InstructionSelector* selector, Node* node,
+                         ArchOpcode opcode) {
+  X64OperandGenerator g(selector);
+  Node* base = node->InputAt(0);
+  Node* index = node->InputAt(1);
+  Node* value = node->InputAt(2);
+  AddressingMode addressing_mode;
+  InstructionOperand index_operand;
+  if (g.CanBeImmediate(index)) {
+    index_operand = g.UseImmediate(index);
+    addressing_mode = kMode_MRI;
+  } else {
+    index_operand = g.UseUniqueRegister(index);
+    addressing_mode = kMode_MR1;
+  }
+  InstructionOperand inputs[] = {g.UseUniqueRegister(value),
+                                 g.UseUniqueRegister(base), index_operand};
+  InstructionOperand outputs[] = {g.DefineSameAsFirst(node)};
+  InstructionCode code = opcode | AddressingModeField::encode(addressing_mode);
+  selector->Emit(code, arraysize(outputs), outputs, arraysize(inputs), inputs);
+}
+
+// Shared routine for Word32/Word64 Atomic Store
+void VisitAtomicStore(InstructionSelector* selector, Node* node,
+                      ArchOpcode opcode) {
+  X64OperandGenerator g(selector);
+  Node* base = node->InputAt(0);
+  Node* index = node->InputAt(1);
+  Node* value = node->InputAt(2);
+  AddressingMode addressing_mode;
+  InstructionOperand index_operand;
+  if (g.CanBeImmediate(index)) {
+    index_operand = g.UseImmediate(index);
+    addressing_mode = kMode_MRI;
+  } else {
+    index_operand = g.UseUniqueRegister(index);
+    addressing_mode = kMode_MR1;
+  }
+  InstructionOperand inputs[] = {g.UseUniqueRegister(value),
+                                 g.UseUniqueRegister(base), index_operand};
+  InstructionCode code = opcode | AddressingModeField::encode(addressing_mode);
+  selector->Emit(code, 0, static_cast<InstructionOperand*>(nullptr),
+                 arraysize(inputs), inputs);
+}
+
 }  // namespace
 
 // Shared routine for word comparison against zero.
@@ -1801,7 +1958,7 @@ void InstructionSelector::VisitWordCompareZero(Node* user, Node* value,
                 break;
             }
           }
-          return VisitCompareZero(this, value, kX64Cmp, cont);
+          return VisitCompareZero(this, user, value, kX64Cmp, cont);
         }
         return VisitWord64Compare(this, value, cont);
       }
@@ -1896,7 +2053,7 @@ void InstructionSelector::VisitWordCompareZero(Node* user, Node* value,
   }
 
   // Branch could not be combined with a compare, emit compare against 0.
-  VisitCompareZero(this, value, kX64Cmp32, cont);
+  VisitCompareZero(this, user, value, kX64Cmp32, cont);
 }
 
 void InstructionSelector::VisitSwitch(Node* node, const SwitchInfo& sw) {
@@ -1930,8 +2087,8 @@ void InstructionSelector::VisitSwitch(Node* node, const SwitchInfo& sw) {
     }
   }
 
-  // Generate a sequence of conditional jumps.
-  return EmitLookupSwitch(sw, value_operand);
+  // Generate a tree of conditional jumps.
+  return EmitBinarySearchSwitch(sw, value_operand);
 }
 
 
@@ -2137,11 +2294,6 @@ void InstructionSelector::VisitWord64AtomicLoad(Node* node) {
 }
 
 void InstructionSelector::VisitWord32AtomicStore(Node* node) {
-  X64OperandGenerator g(this);
-  Node* base = node->InputAt(0);
-  Node* index = node->InputAt(1);
-  Node* value = node->InputAt(2);
-
   MachineRepresentation rep = AtomicStoreRepresentationOf(node->op());
   ArchOpcode opcode = kArchNop;
   switch (rep) {
@@ -2158,28 +2310,10 @@ void InstructionSelector::VisitWord32AtomicStore(Node* node) {
       UNREACHABLE();
       return;
   }
-  AddressingMode addressing_mode;
-  InstructionOperand inputs[4];
-  size_t input_count = 0;
-  inputs[input_count++] = g.UseUniqueRegister(value);
-  inputs[input_count++] = g.UseUniqueRegister(base);
-  if (g.CanBeImmediate(index)) {
-    inputs[input_count++] = g.UseImmediate(index);
-    addressing_mode = kMode_MRI;
-  } else {
-    inputs[input_count++] = g.UseUniqueRegister(index);
-    addressing_mode = kMode_MR1;
-  }
-  InstructionCode code = opcode | AddressingModeField::encode(addressing_mode);
-  Emit(code, 0, static_cast<InstructionOperand*>(nullptr), input_count, inputs);
+  VisitAtomicStore(this, node, opcode);
 }
 
 void InstructionSelector::VisitWord64AtomicStore(Node* node) {
-  X64OperandGenerator g(this);
-  Node* base = node->InputAt(0);
-  Node* index = node->InputAt(1);
-  Node* value = node->InputAt(2);
-
   MachineRepresentation rep = AtomicStoreRepresentationOf(node->op());
   ArchOpcode opcode = kArchNop;
   switch (rep) {
@@ -2199,29 +2333,10 @@ void InstructionSelector::VisitWord64AtomicStore(Node* node) {
       UNREACHABLE();
       return;
   }
-  AddressingMode addressing_mode;
-  InstructionOperand inputs[4];
-  size_t input_count = 0;
-  inputs[input_count++] = g.UseUniqueRegister(value);
-  inputs[input_count++] = g.UseUniqueRegister(base);
-  if (g.CanBeImmediate(index)) {
-    inputs[input_count++] = g.UseImmediate(index);
-    addressing_mode = kMode_MRI;
-  } else {
-    inputs[input_count++] = g.UseUniqueRegister(index);
-    addressing_mode = kMode_MR1;
-  }
-  InstructionCode code = opcode | AddressingModeField::encode(addressing_mode);
-  DCHECK_LE(input_count, arraysize(inputs));
-  Emit(code, 0, static_cast<InstructionOperand*>(nullptr), input_count, inputs);
+  VisitAtomicStore(this, node, opcode);
 }
 
 void InstructionSelector::VisitWord32AtomicExchange(Node* node) {
-  X64OperandGenerator g(this);
-  Node* base = node->InputAt(0);
-  Node* index = node->InputAt(1);
-  Node* value = node->InputAt(2);
-
   MachineType type = AtomicOpRepresentationOf(node->op());
   ArchOpcode opcode = kArchNop;
   if (type == MachineType::Int8()) {
@@ -2238,30 +2353,10 @@ void InstructionSelector::VisitWord32AtomicExchange(Node* node) {
     UNREACHABLE();
     return;
   }
-  InstructionOperand outputs[1];
-  AddressingMode addressing_mode;
-  InstructionOperand inputs[3];
-  size_t input_count = 0;
-  inputs[input_count++] = g.UseUniqueRegister(value);
-  inputs[input_count++] = g.UseUniqueRegister(base);
-  if (g.CanBeImmediate(index)) {
-    inputs[input_count++] = g.UseImmediate(index);
-    addressing_mode = kMode_MRI;
-  } else {
-    inputs[input_count++] = g.UseUniqueRegister(index);
-    addressing_mode = kMode_MR1;
-  }
-  outputs[0] = g.DefineSameAsFirst(node);
-  InstructionCode code = opcode | AddressingModeField::encode(addressing_mode);
-  Emit(code, 1, outputs, input_count, inputs);
+  VisitAtomicExchange(this, node, opcode);
 }
 
 void InstructionSelector::VisitWord64AtomicExchange(Node* node) {
-  X64OperandGenerator g(this);
-  Node* base = node->InputAt(0);
-  Node* index = node->InputAt(1);
-  Node* value = node->InputAt(2);
-
   MachineType type = AtomicOpRepresentationOf(node->op());
   ArchOpcode opcode = kArchNop;
   if (type == MachineType::Uint8()) {
@@ -2276,31 +2371,10 @@ void InstructionSelector::VisitWord64AtomicExchange(Node* node) {
     UNREACHABLE();
     return;
   }
-  InstructionOperand outputs[1];
-  AddressingMode addressing_mode;
-  InstructionOperand inputs[3];
-  size_t input_count = 0;
-  inputs[input_count++] = g.UseUniqueRegister(value);
-  inputs[input_count++] = g.UseUniqueRegister(base);
-  if (g.CanBeImmediate(index)) {
-    inputs[input_count++] = g.UseImmediate(index);
-    addressing_mode = kMode_MRI;
-  } else {
-    inputs[input_count++] = g.UseUniqueRegister(index);
-    addressing_mode = kMode_MR1;
-  }
-  outputs[0] = g.DefineSameAsFirst(node);
-  InstructionCode code = opcode | AddressingModeField::encode(addressing_mode);
-  Emit(code, 1, outputs, input_count, inputs);
+  VisitAtomicExchange(this, node, opcode);
 }
 
 void InstructionSelector::VisitWord32AtomicCompareExchange(Node* node) {
-  X64OperandGenerator g(this);
-  Node* base = node->InputAt(0);
-  Node* index = node->InputAt(1);
-  Node* old_value = node->InputAt(2);
-  Node* new_value = node->InputAt(3);
-
   MachineType type = AtomicOpRepresentationOf(node->op());
   ArchOpcode opcode = kArchNop;
   if (type == MachineType::Int8()) {
@@ -2317,32 +2391,10 @@ void InstructionSelector::VisitWord32AtomicCompareExchange(Node* node) {
     UNREACHABLE();
     return;
   }
-  InstructionOperand outputs[1];
-  AddressingMode addressing_mode;
-  InstructionOperand inputs[4];
-  size_t input_count = 0;
-  inputs[input_count++] = g.UseFixed(old_value, rax);
-  inputs[input_count++] = g.UseUniqueRegister(new_value);
-  inputs[input_count++] = g.UseUniqueRegister(base);
-  if (g.CanBeImmediate(index)) {
-    inputs[input_count++] = g.UseImmediate(index);
-    addressing_mode = kMode_MRI;
-  } else {
-    inputs[input_count++] = g.UseUniqueRegister(index);
-    addressing_mode = kMode_MR1;
-  }
-  outputs[0] = g.DefineAsFixed(node, rax);
-  InstructionCode code = opcode | AddressingModeField::encode(addressing_mode);
-  Emit(code, 1, outputs, input_count, inputs);
+  VisitAtomicCompareExchange(this, node, opcode);
 }
 
 void InstructionSelector::VisitWord64AtomicCompareExchange(Node* node) {
-  X64OperandGenerator g(this);
-  Node* base = node->InputAt(0);
-  Node* index = node->InputAt(1);
-  Node* old_value = node->InputAt(2);
-  Node* new_value = node->InputAt(3);
-
   MachineType type = AtomicOpRepresentationOf(node->op());
   ArchOpcode opcode = kArchNop;
   if (type == MachineType::Uint8()) {
@@ -2357,33 +2409,12 @@ void InstructionSelector::VisitWord64AtomicCompareExchange(Node* node) {
     UNREACHABLE();
     return;
   }
-  InstructionOperand outputs[1];
-  AddressingMode addressing_mode;
-  InstructionOperand inputs[4];
-  size_t input_count = 0;
-  inputs[input_count++] = g.UseFixed(old_value, rax);
-  inputs[input_count++] = g.UseUniqueRegister(new_value);
-  inputs[input_count++] = g.UseUniqueRegister(base);
-  if (g.CanBeImmediate(index)) {
-    inputs[input_count++] = g.UseImmediate(index);
-    addressing_mode = kMode_MRI;
-  } else {
-    inputs[input_count++] = g.UseUniqueRegister(index);
-    addressing_mode = kMode_MR1;
-  }
-  outputs[0] = g.DefineAsFixed(node, rax);
-  InstructionCode code = opcode | AddressingModeField::encode(addressing_mode);
-  Emit(code, 1, outputs, input_count, inputs);
+  VisitAtomicCompareExchange(this, node, opcode);
 }
 
-void InstructionSelector::VisitAtomicBinaryOperation(
+void InstructionSelector::VisitWord32AtomicBinaryOperation(
     Node* node, ArchOpcode int8_op, ArchOpcode uint8_op, ArchOpcode int16_op,
     ArchOpcode uint16_op, ArchOpcode word32_op) {
-  X64OperandGenerator g(this);
-  Node* base = node->InputAt(0);
-  Node* index = node->InputAt(1);
-  Node* value = node->InputAt(2);
-
   MachineType type = AtomicOpRepresentationOf(node->op());
   ArchOpcode opcode = kArchNop;
   if (type == MachineType::Int8()) {
@@ -2400,29 +2431,12 @@ void InstructionSelector::VisitAtomicBinaryOperation(
     UNREACHABLE();
     return;
   }
-  InstructionOperand outputs[1];
-  AddressingMode addressing_mode;
-  InstructionOperand inputs[3];
-  size_t input_count = 0;
-  inputs[input_count++] = g.UseUniqueRegister(value);
-  inputs[input_count++] = g.UseUniqueRegister(base);
-  if (g.CanBeImmediate(index)) {
-    inputs[input_count++] = g.UseImmediate(index);
-    addressing_mode = kMode_MRI;
-  } else {
-    inputs[input_count++] = g.UseUniqueRegister(index);
-    addressing_mode = kMode_MR1;
-  }
-  outputs[0] = g.DefineAsFixed(node, rax);
-  InstructionOperand temp[1];
-  temp[0] = g.TempRegister();
-  InstructionCode code = opcode | AddressingModeField::encode(addressing_mode);
-  Emit(code, 1, outputs, input_count, inputs, 1, temp);
+  VisitAtomicBinop(this, node, opcode);
 }
 
 #define VISIT_ATOMIC_BINOP(op)                                   \
   void InstructionSelector::VisitWord32Atomic##op(Node* node) {  \
-    VisitAtomicBinaryOperation(                                  \
+    VisitWord32AtomicBinaryOperation(                            \
         node, kWord32Atomic##op##Int8, kWord32Atomic##op##Uint8, \
         kWord32Atomic##op##Int16, kWord32Atomic##op##Uint16,     \
         kWord32Atomic##op##Word32);                              \
@@ -2437,11 +2451,6 @@ VISIT_ATOMIC_BINOP(Xor)
 void InstructionSelector::VisitWord64AtomicBinaryOperation(
     Node* node, ArchOpcode uint8_op, ArchOpcode uint16_op, ArchOpcode uint32_op,
     ArchOpcode word64_op) {
-  X64OperandGenerator g(this);
-  Node* base = node->InputAt(0);
-  Node* index = node->InputAt(1);
-  Node* value = node->InputAt(2);
-
   MachineType type = AtomicOpRepresentationOf(node->op());
   ArchOpcode opcode = kArchNop;
   if (type == MachineType::Uint8()) {
@@ -2456,24 +2465,7 @@ void InstructionSelector::VisitWord64AtomicBinaryOperation(
     UNREACHABLE();
     return;
   }
-  InstructionOperand outputs[1];
-  AddressingMode addressing_mode;
-  InstructionOperand inputs[3];
-  size_t input_count = 0;
-  inputs[input_count++] = g.UseUniqueRegister(value);
-  inputs[input_count++] = g.UseUniqueRegister(base);
-  if (g.CanBeImmediate(index)) {
-    inputs[input_count++] = g.UseImmediate(index);
-    addressing_mode = kMode_MRI;
-  } else {
-    inputs[input_count++] = g.UseUniqueRegister(index);
-    addressing_mode = kMode_MR1;
-  }
-  outputs[0] = g.DefineAsFixed(node, rax);
-  InstructionOperand temp[1];
-  temp[0] = g.TempRegister();
-  InstructionCode code = opcode | AddressingModeField::encode(addressing_mode);
-  Emit(code, 1, outputs, input_count, inputs, 1, temp);
+  VisitAtomicBinop(this, node, opcode);
 }
 
 #define VISIT_ATOMIC_BINOP(op)                                           \
diff --git a/deps/v8/src/contexts-inl.h b/deps/v8/src/contexts-inl.h
index 3ff737e5f4ee86..b954fd3b8ea88b 100644
--- a/deps/v8/src/contexts-inl.h
+++ b/deps/v8/src/contexts-inl.h
@@ -39,17 +39,15 @@ Handle<Context> ScriptContextTable::GetContext(Handle<ScriptContextTable> table,
       FixedArray::get(*table, i + kFirstContextSlotIndex, table->GetIsolate()));
 }
 
-
 // static
 Context* Context::cast(Object* context) {
   DCHECK(context->IsContext());
   return reinterpret_cast<Context*>(context);
 }
 
-
-JSFunction* Context::closure() { return JSFunction::cast(get(CLOSURE_INDEX)); }
-void Context::set_closure(JSFunction* closure) { set(CLOSURE_INDEX, closure); }
-
+void Context::set_scope_info(ScopeInfo* scope_info) {
+  set(SCOPE_INFO_INDEX, scope_info);
+}
 
 Context* Context::previous() {
   Object* result = get(PREVIOUS_INDEX);
@@ -60,7 +58,7 @@ void Context::set_previous(Context* context) { set(PREVIOUS_INDEX, context); }
 
 Object* Context::next_context_link() { return get(Context::NEXT_CONTEXT_LINK); }
 
-bool Context::has_extension() { return !extension()->IsTheHole(GetIsolate()); }
+bool Context::has_extension() { return !extension()->IsTheHole(); }
 HeapObject* Context::extension() {
   return HeapObject::cast(get(EXTENSION_INDEX));
 }
@@ -209,7 +207,7 @@ Map* Context::GetInitialJSArrayMap(ElementsKind kind) const {
   if (!IsFastElementsKind(kind)) return nullptr;
   DisallowHeapAllocation no_gc;
   Object* const initial_js_array_map = get(Context::ArrayMapIndex(kind));
-  DCHECK(!initial_js_array_map->IsUndefined(GetIsolate()));
+  DCHECK(!initial_js_array_map->IsUndefined());
   return Map::cast(initial_js_array_map);
 }
 
diff --git a/deps/v8/src/contexts.cc b/deps/v8/src/contexts.cc
index 04c4b4899d57b9..977f4aec2bcd26 100644
--- a/deps/v8/src/contexts.cc
+++ b/deps/v8/src/contexts.cc
@@ -8,6 +8,7 @@
 #include "src/bootstrapper.h"
 #include "src/debug/debug.h"
 #include "src/isolate-inl.h"
+#include "src/objects/module-inl.h"
 
 namespace v8 {
 namespace internal {
@@ -21,10 +22,10 @@ Handle<ScriptContextTable> ScriptContextTable::Extend(
   CHECK(used >= 0 && length > 0 && used < length);
   if (used + kFirstContextSlotIndex == length) {
     CHECK(length < Smi::kMaxValue / 2);
-    Isolate* isolate = table->GetIsolate();
+    Isolate* isolate = script_context->GetIsolate();
     Handle<FixedArray> copy =
         isolate->factory()->CopyFixedArrayAndGrow(table, length);
-    copy->set_map(isolate->heap()->script_context_table_map());
+    copy->set_map(ReadOnlyRoots(isolate).script_context_table_map());
     result = Handle<ScriptContextTable>::cast(copy);
   } else {
     result = table;
@@ -42,7 +43,7 @@ bool ScriptContextTable::Lookup(Handle<ScriptContextTable> table,
   for (int i = 0; i < table->used(); i++) {
     Handle<Context> context = GetContext(table, i);
     DCHECK(context->IsScriptContext());
-    Handle<ScopeInfo> scope_info(context->scope_info());
+    Handle<ScopeInfo> scope_info(context->scope_info(), context->GetIsolate());
     int slot_index = ScopeInfo::ContextSlotIndex(
         scope_info, name, &result->mode, &result->init_flag,
         &result->maybe_assigned_flag);
@@ -62,14 +63,11 @@ bool Context::is_declaration_context() {
       IsModuleContext()) {
     return true;
   }
-  if (IsEvalContext())
-    return closure()->shared()->language_mode() == LanguageMode::kStrict;
+  if (IsEvalContext()) {
+    return scope_info()->language_mode() == LanguageMode::kStrict;
+  }
   if (!IsBlockContext()) return false;
-  Object* ext = extension();
-  // If we have the special extension, we immediately know it must be a
-  // declaration scope. That's just a small performance shortcut.
-  return ext->IsContextExtension() ||
-         ScopeInfo::cast(ext)->is_declaration_scope();
+  return scope_info()->is_declaration_scope();
 }
 
 
@@ -87,20 +85,15 @@ Context* Context::closure_context() {
          !current->IsModuleContext() && !current->IsNativeContext() &&
          !current->IsEvalContext()) {
     current = current->previous();
-    DCHECK(current->closure() == closure());
   }
   return current;
 }
 
 JSObject* Context::extension_object() {
   DCHECK(IsNativeContext() || IsFunctionContext() || IsBlockContext() ||
-         IsEvalContext());
+         IsEvalContext() || IsCatchContext());
   HeapObject* object = extension();
-  if (object->IsTheHole(GetIsolate())) return nullptr;
-  if (IsBlockContext()) {
-    if (!object->IsContextExtension()) return nullptr;
-    object = JSObject::cast(ContextExtension::cast(object)->extension());
-  }
+  if (object->IsTheHole()) return nullptr;
   DCHECK(object->IsJSContextExtensionObject() ||
          (IsNativeContext() && object->IsJSGlobalObject()));
   return JSObject::cast(object);
@@ -109,23 +102,11 @@ JSObject* Context::extension_object() {
 JSReceiver* Context::extension_receiver() {
   DCHECK(IsNativeContext() || IsWithContext() || IsEvalContext() ||
          IsFunctionContext() || IsBlockContext());
-  return IsWithContext() ? JSReceiver::cast(
-                               ContextExtension::cast(extension())->extension())
-                         : extension_object();
+  return IsWithContext() ? JSReceiver::cast(extension()) : extension_object();
 }
 
 ScopeInfo* Context::scope_info() {
-  DCHECK(!IsNativeContext());
-  if (IsFunctionContext() || IsModuleContext() || IsEvalContext()) {
-    return closure()->shared()->scope_info();
-  }
-  HeapObject* object = extension();
-  if (object->IsContextExtension()) {
-    DCHECK(IsBlockContext() || IsCatchContext() || IsWithContext() ||
-           IsDebugEvaluateContext());
-    object = ContextExtension::cast(object)->scope_info();
-  }
-  return ScopeInfo::cast(object);
+  return ScopeInfo::cast(get(SCOPE_INFO_INDEX));
 }
 
 Module* Context::module() {
@@ -136,12 +117,6 @@ Module* Context::module() {
   return Module::cast(current->extension());
 }
 
-String* Context::catch_name() {
-  DCHECK(IsCatchContext());
-  return String::cast(ContextExtension::cast(extension())->extension());
-}
-
-
 JSGlobalObject* Context::global_object() {
   return JSGlobalObject::cast(native_context()->extension());
 }
@@ -179,22 +154,23 @@ static Maybe<bool> UnscopableLookup(LookupIterator* it) {
   Handle<Object> unscopables;
   ASSIGN_RETURN_ON_EXCEPTION_VALUE(
       isolate, unscopables,
-      JSReceiver::GetProperty(Handle<JSReceiver>::cast(it->GetReceiver()),
+      JSReceiver::GetProperty(isolate,
+                              Handle<JSReceiver>::cast(it->GetReceiver()),
                               isolate->factory()->unscopables_symbol()),
       Nothing<bool>());
   if (!unscopables->IsJSReceiver()) return Just(true);
   Handle<Object> blacklist;
   ASSIGN_RETURN_ON_EXCEPTION_VALUE(
       isolate, blacklist,
-      JSReceiver::GetProperty(Handle<JSReceiver>::cast(unscopables),
+      JSReceiver::GetProperty(isolate, Handle<JSReceiver>::cast(unscopables),
                               it->name()),
       Nothing<bool>());
-  return Just(!blacklist->BooleanValue());
+  return Just(!blacklist->BooleanValue(isolate));
 }
 
 static PropertyAttributes GetAttributesForMode(VariableMode mode) {
   DCHECK(IsDeclaredVariableMode(mode));
-  return mode == CONST ? READ_ONLY : NONE;
+  return mode == VariableMode::kConst ? READ_ONLY : NONE;
 }
 
 Handle<Object> Context::Lookup(Handle<String> name, ContextLookupFlags flags,
@@ -210,7 +186,7 @@ Handle<Object> Context::Lookup(Handle<String> name, ContextLookupFlags flags,
   *index = kNotFound;
   *attributes = ABSENT;
   *init_flag = kCreatedInitialized;
-  *variable_mode = VAR;
+  *variable_mode = VariableMode::kVar;
   if (is_sloppy_function_name != nullptr) {
     *is_sloppy_function_name = false;
   }
@@ -236,7 +212,7 @@ Handle<Object> Context::Lookup(Handle<String> name, ContextLookupFlags flags,
          (context->IsWithContext() && ((flags & SKIP_WITH_CONTEXT) == 0)) ||
          context->IsFunctionContext() || context->IsBlockContext()) &&
         context->extension_receiver() != nullptr) {
-      Handle<JSReceiver> object(context->extension_receiver());
+      Handle<JSReceiver> object(context->extension_receiver(), isolate);
 
       if (context->IsNativeContext()) {
         if (FLAG_trace_contexts) {
@@ -244,7 +220,8 @@ Handle<Object> Context::Lookup(Handle<String> name, ContextLookupFlags flags,
         }
         // Try other script contexts.
         Handle<ScriptContextTable> script_contexts(
-            context->global_object()->native_context()->script_context_table());
+            context->global_object()->native_context()->script_context_table(),
+            isolate);
         ScriptContextTable::LookupResult r;
         if (ScriptContextTable::Lookup(script_contexts, name, &r)) {
           if (FLAG_trace_contexts) {
@@ -272,9 +249,9 @@ Handle<Object> Context::Lookup(Handle<String> name, ContextLookupFlags flags,
       } else if (context->IsWithContext()) {
         // A with context will never bind "this", but debug-eval may look into
         // a with context when resolving "this". Other synthetic variables such
-        // as new.target may be resolved as DYNAMIC_LOCAL due to bug v8:5405 ,
-        // skipping them here serves as a workaround until a more thorough
-        // fix can be applied.
+        // as new.target may be resolved as VariableMode::kDynamicLocal due to
+        // bug v8:5405 , skipping them here serves as a workaround until a more
+        // thorough fix can be applied.
         // TODO(v8:5405): Replace this check with a DCHECK when resolution of
         // of synthetic variables does not go through this code path.
         if (ScopeInfo::VariableIsSynthetic(*name)) {
@@ -311,10 +288,10 @@ Handle<Object> Context::Lookup(Handle<String> name, ContextLookupFlags flags,
     // 2. Check the context proper if it has slots.
     if (context->IsFunctionContext() || context->IsBlockContext() ||
         context->IsScriptContext() || context->IsEvalContext() ||
-        context->IsModuleContext()) {
+        context->IsModuleContext() || context->IsCatchContext()) {
       // Use serialized scope information of functions and blocks to search
       // for the context index.
-      Handle<ScopeInfo> scope_info(context->scope_info());
+      Handle<ScopeInfo> scope_info(context->scope_info(), isolate);
       VariableMode mode;
       InitializationFlag flag;
       MaybeAssignedFlag maybe_assigned_flag;
@@ -323,8 +300,8 @@ Handle<Object> Context::Lookup(Handle<String> name, ContextLookupFlags flags,
       DCHECK(slot_index < 0 || slot_index >= MIN_CONTEXT_SLOTS);
       if (slot_index >= 0) {
         if (FLAG_trace_contexts) {
-          PrintF("=> found local in context slot %d (mode = %d)\n",
-                 slot_index, mode);
+          PrintF("=> found local in context slot %d (mode = %hhu)\n",
+                 slot_index, static_cast<uint8_t>(mode));
         }
         *index = slot_index;
         *variable_mode = mode;
@@ -347,7 +324,7 @@ Handle<Object> Context::Lookup(Handle<String> name, ContextLookupFlags flags,
           *index = function_index;
           *attributes = READ_ONLY;
           *init_flag = kCreatedInitialized;
-          *variable_mode = CONST;
+          *variable_mode = VariableMode::kConst;
           if (is_sloppy_function_name != nullptr &&
               is_sloppy(scope_info->language_mode())) {
             *is_sloppy_function_name = true;
@@ -377,31 +354,16 @@ Handle<Object> Context::Lookup(Handle<String> name, ContextLookupFlags flags,
           return handle(context->module(), isolate);
         }
       }
-    } else if (context->IsCatchContext()) {
-      // Catch contexts have the variable name in the extension slot.
-      if (String::Equals(name, handle(context->catch_name()))) {
-        if (FLAG_trace_contexts) {
-          PrintF("=> found in catch context\n");
-        }
-        *index = Context::THROWN_OBJECT_INDEX;
-        *attributes = NONE;
-        *init_flag = kCreatedInitialized;
-        *variable_mode = VAR;
-        return context;
-      }
     } else if (context->IsDebugEvaluateContext()) {
       // Check materialized locals.
       Object* ext = context->get(EXTENSION_INDEX);
-      if (ext->IsContextExtension()) {
-        Object* obj = ContextExtension::cast(ext)->extension();
-        if (obj->IsJSReceiver()) {
-          Handle<JSReceiver> extension(JSReceiver::cast(obj));
-          LookupIterator it(extension, name, extension);
-          Maybe<bool> found = JSReceiver::HasProperty(&it);
-          if (found.FromMaybe(false)) {
-            *attributes = NONE;
-            return extension;
-          }
+      if (ext->IsJSReceiver()) {
+        Handle<JSReceiver> extension(JSReceiver::cast(ext), isolate);
+        LookupIterator it(extension, name, extension);
+        Maybe<bool> found = JSReceiver::HasProperty(&it);
+        if (found.FromMaybe(false)) {
+          *attributes = NONE;
+          return extension;
         }
       }
       // Check the original context, but do not follow its context chain.
@@ -447,7 +409,7 @@ Handle<Object> Context::Lookup(Handle<String> name, ContextLookupFlags flags,
 void Context::AddOptimizedCode(Code* code) {
   DCHECK(IsNativeContext());
   DCHECK(code->kind() == Code::OPTIMIZED_FUNCTION);
-  DCHECK(code->next_code_link()->IsUndefined(GetIsolate()));
+  DCHECK(code->next_code_link()->IsUndefined());
   code->set_next_code_link(get(OPTIMIZED_CODE_LIST));
   set(OPTIMIZED_CODE_LIST, code, UPDATE_WEAK_WRITE_BARRIER);
 }
diff --git a/deps/v8/src/contexts.h b/deps/v8/src/contexts.h
index fcfeccdc44e08f..92fea766c8b8e0 100644
--- a/deps/v8/src/contexts.h
+++ b/deps/v8/src/contexts.h
@@ -22,7 +22,6 @@ enum ContextLookupFlags {
   FOLLOW_CHAINS = FOLLOW_CONTEXT_CHAIN | FOLLOW_PROTOTYPE_CHAIN,
 };
 
-
 // Heap-allocated activation contexts.
 //
 // Contexts are implemented as FixedArray objects; the Context
@@ -72,8 +71,6 @@ enum ContextLookupFlags {
   V(ASYNC_GENERATOR_AWAIT_UNCAUGHT, JSFunction, async_generator_await_uncaught)
 
 #define NATIVE_CONTEXT_IMPORTED_FIELDS(V)                                 \
-  V(ARRAY_POP_INDEX, JSFunction, array_pop)                               \
-  V(ARRAY_PUSH_INDEX, JSFunction, array_push)                             \
   V(ARRAY_SHIFT_INDEX, JSFunction, array_shift)                           \
   V(ARRAY_SPLICE_INDEX, JSFunction, array_splice)                         \
   V(ARRAY_UNSHIFT_INDEX, JSFunction, array_unshift)                       \
@@ -97,6 +94,7 @@ enum ContextLookupFlags {
   V(PROMISE_FUNCTION_INDEX, JSFunction, promise_function)                 \
   V(RANGE_ERROR_FUNCTION_INDEX, JSFunction, range_error_function)         \
   V(REFERENCE_ERROR_FUNCTION_INDEX, JSFunction, reference_error_function) \
+  V(RESOLVE_LOCALE_FUNCTION_INDEX, JSFunction, resolve_locale)            \
   V(SET_ADD_INDEX, JSFunction, set_add)                                   \
   V(SET_DELETE_INDEX, JSFunction, set_delete)                             \
   V(SET_HAS_INDEX, JSFunction, set_has)                                   \
@@ -162,6 +160,7 @@ enum ContextLookupFlags {
   V(DATA_VIEW_FUN_INDEX, JSFunction, data_view_fun)                            \
   V(DATE_FUNCTION_INDEX, JSFunction, date_function)                            \
   V(DEBUG_CONTEXT_ID_INDEX, Object, debug_context_id)                          \
+  V(EMPTY_FUNCTION_INDEX, JSFunction, empty_function)                          \
   V(ERROR_MESSAGE_FOR_CODE_GEN_FROM_STRINGS_INDEX, Object,                     \
     error_message_for_code_gen_from_strings)                                   \
   V(ERRORS_THROWN_INDEX, Smi, errors_thrown)                                   \
@@ -182,7 +181,6 @@ enum ContextLookupFlags {
   V(INITIAL_ARRAY_ITERATOR_PROTOTYPE_INDEX, JSObject,                          \
     initial_array_iterator_prototype)                                          \
   V(INITIAL_ARRAY_PROTOTYPE_INDEX, JSObject, initial_array_prototype)          \
-  V(INITIAL_ARRAY_PROTOTYPE_MAP_INDEX, Map, initial_array_prototype_map)       \
   V(INITIAL_ERROR_PROTOTYPE_INDEX, JSObject, initial_error_prototype)          \
   V(INITIAL_GENERATOR_PROTOTYPE_INDEX, JSObject, initial_generator_prototype)  \
   V(INITIAL_ASYNC_GENERATOR_PROTOTYPE_INDEX, JSObject,                         \
@@ -203,6 +201,9 @@ enum ContextLookupFlags {
     intl_date_time_format_function)                                            \
   V(INTL_NUMBER_FORMAT_FUNCTION_INDEX, JSFunction,                             \
     intl_number_format_function)                                               \
+  V(INTL_NUMBER_FORMAT_INTERNAL_FORMAT_NUMBER_SHARED_FUN, SharedFunctionInfo,  \
+    number_format_internal_format_number_shared_fun)                           \
+  V(INTL_LOCALE_FUNCTION_INDEX, JSFunction, intl_locale_function)              \
   V(INTL_COLLATOR_FUNCTION_INDEX, JSFunction, intl_collator_function)          \
   V(INTL_PLURAL_RULES_FUNCTION_INDEX, JSFunction, intl_plural_rules_function)  \
   V(INTL_V8_BREAK_ITERATOR_FUNCTION_INDEX, JSFunction,                         \
@@ -271,7 +272,6 @@ enum ContextLookupFlags {
     initial_regexp_string_iterator_prototype_map_index)                        \
   V(REGEXP_RESULT_MAP_INDEX, Map, regexp_result_map)                           \
   V(SCRIPT_CONTEXT_TABLE_INDEX, ScriptContextTable, script_context_table)      \
-  V(SCRIPT_FUNCTION_INDEX, JSFunction, script_function)                        \
   V(SECURITY_TOKEN_INDEX, Object, security_token)                              \
   V(SELF_WEAK_CELL_INDEX, WeakCell, self_weak_cell)                            \
   V(SERIALIZED_OBJECTS, FixedArray, serialized_objects)                        \
@@ -396,40 +396,30 @@ class ScriptContextTable : public FixedArray {
 // stack, with the top-most context being the current context. All contexts
 // have the following slots:
 //
-// [ closure   ]  This is the current function. It is the same for all
-//                contexts inside a function. It provides access to the
-//                incoming context (i.e., the outer context, which may
-//                or may not become the current function's context), and
-//                it provides access to the functions code and thus it's
-//                scope information, which in turn contains the names of
-//                statically allocated context slots. The names are needed
-//                for dynamic lookups in the presence of 'with' or 'eval'.
-//
-// [ previous  ]  A pointer to the previous context.
-//
-// [ extension ]  Additional data.
+// [ scope_info     ]  This is the scope info describing the current context. It
+//                     contains the names of statically allocated context slots,
+//                     and stack-allocated locals.  The names are needed for
+//                     dynamic lookups in the presence of 'with' or 'eval', and
+//                     for the debugger.
 //
-//                For script contexts, it contains the respective ScopeInfo.
+// [ previous       ]  A pointer to the previous context.
 //
-//                For catch contexts, it contains a ContextExtension object
-//                consisting of the ScopeInfo and the name of the catch
-//                variable.
+// [ extension      ]  Additional data.
 //
-//                For module contexts, it contains the module object.
+//                     For module contexts, it contains the module object.
 //
-//                For block contexts, it contains either the respective
-//                ScopeInfo or a ContextExtension object consisting of the
-//                ScopeInfo and an "extension object" (see below).
+//                     For block contexts, it may contain an "extension object"
+//                     (see below).
 //
-//                For with contexts, it contains a ContextExtension object
-//                consisting of the ScopeInfo and an "extension object".
+//                     For with contexts, it contains an "extension object".
 //
-//                An "extension object" is used to dynamically extend a context
-//                with additional variables, namely in the implementation of the
-//                'with' construct and the 'eval' construct.  For instance,
-//                Context::Lookup also searches the extension object for
-//                properties.  (Storing the extension object is the original
-//                purpose of this context slot, hence the name.)
+//                     An "extension object" is used to dynamically extend a
+//                     context with additional variables, namely in the
+//                     implementation of the 'with' construct and the 'eval'
+//                     construct.  For instance, Context::Lookup also searches
+//                     the extension object for properties.  (Storing the
+//                     extension object is the original purpose of this context
+//                     slot, hence the name.)
 //
 // [ native_context ]  A pointer to the native context.
 //
@@ -444,15 +434,20 @@ class ScriptContextTable : public FixedArray {
 // Script contexts from all top-level scripts are gathered in
 // ScriptContextTable.
 
-class Context: public FixedArray {
+class Context : public FixedArray, public NeverReadOnlySpaceObject {
  public:
+  // Use the mixin methods over the HeapObject methods.
+  // TODO(v8:7786) Remove once the HeapObject methods are gone.
+  using NeverReadOnlySpaceObject::GetHeap;
+  using NeverReadOnlySpaceObject::GetIsolate;
+
   // Conversions.
   static inline Context* cast(Object* context);
 
   // The default context slot layout; indices are FixedArray slot indices.
   enum Field {
     // These slots are in all contexts.
-    CLOSURE_INDEX,
+    SCOPE_INFO_INDEX,
     PREVIOUS_INDEX,
     // The extension slot is used for either the global object (in native
     // contexts), eval extension object (function contexts), subject of with
@@ -461,7 +456,7 @@ class Context: public FixedArray {
     EXTENSION_INDEX,
     NATIVE_CONTEXT_INDEX,
 
-    // These slots are only in native contexts.
+// These slots are only in native contexts.
 #define NATIVE_CONTEXT_SLOT(index, type, name) index,
     NATIVE_CONTEXT_FIELDS(NATIVE_CONTEXT_SLOT)
 #undef NATIVE_CONTEXT_SLOT
@@ -499,9 +494,7 @@ class Context: public FixedArray {
   int GetErrorsThrown();
 
   // Direct slot access.
-  inline JSFunction* closure();
-  inline void set_closure(JSFunction* closure);
-
+  inline void set_scope_info(ScopeInfo* scope_info);
   inline Context* previous();
   inline void set_previous(Context* context);
 
@@ -513,7 +506,6 @@ class Context: public FixedArray {
   JSObject* extension_object();
   JSReceiver* extension_receiver();
   ScopeInfo* scope_info();
-  String* catch_name();
 
   // Find the module context (assuming there is one) and return the associated
   // module object.
diff --git a/deps/v8/src/conversions-inl.h b/deps/v8/src/conversions-inl.h
index b64f016df27e0b..f2a6be42279f52 100644
--- a/deps/v8/src/conversions-inl.h
+++ b/deps/v8/src/conversions-inl.h
@@ -43,9 +43,10 @@ inline unsigned int FastD2UI(double x) {
     x += k2Pow52;
     uint32_t result;
 #ifndef V8_TARGET_BIG_ENDIAN
-    Address mantissa_ptr = reinterpret_cast<Address>(&x);
+    void* mantissa_ptr = reinterpret_cast<void*>(&x);
 #else
-    Address mantissa_ptr = reinterpret_cast<Address>(&x) + kInt32Size;
+    void* mantissa_ptr =
+        reinterpret_cast<void*>(reinterpret_cast<Address>(&x) + kInt32Size);
 #endif
     // Copy least significant 32 bits of mantissa.
     memcpy(&result, mantissa_ptr, sizeof(result));
@@ -88,23 +89,21 @@ int32_t DoubleToInt32(double x) {
 }
 
 bool DoubleToSmiInteger(double value, int* smi_int_value) {
-  if (IsMinusZero(value)) return false;
-  int i = FastD2IChecked(value);
-  if (value != i || !Smi::IsValid(i)) return false;
-  *smi_int_value = i;
+  if (!IsSmiDouble(value)) return false;
+  *smi_int_value = FastD2I(value);
+  DCHECK(Smi::IsValid(*smi_int_value));
   return true;
 }
 
 bool IsSmiDouble(double value) {
-  return std::isfinite(value) && !IsMinusZero(value) &&
-         value >= Smi::kMinValue && value <= Smi::kMaxValue &&
-         value == FastI2D(FastD2I(value));
+  return value >= Smi::kMinValue && value <= Smi::kMaxValue &&
+         !IsMinusZero(value) && value == FastI2D(FastD2I(value));
 }
 
 
 bool IsInt32Double(double value) {
-  return std::isfinite(value) && !IsMinusZero(value) && value >= kMinInt &&
-         value <= kMaxInt && value == FastI2D(FastD2I(value));
+  return value >= kMinInt && value <= kMaxInt && !IsMinusZero(value) &&
+         value == FastI2D(FastD2I(value));
 }
 
 
diff --git a/deps/v8/src/conversions.cc b/deps/v8/src/conversions.cc
index 8aa4abccda1cec..baf8b3a6d5d6bb 100644
--- a/deps/v8/src/conversions.cc
+++ b/deps/v8/src/conversions.cc
@@ -941,7 +941,7 @@ class StringToBigIntHelper : public StringToIntHelper {
 };
 
 MaybeHandle<BigInt> StringToBigInt(Isolate* isolate, Handle<String> string) {
-  string = String::Flatten(string);
+  string = String::Flatten(isolate, string);
   StringToBigIntHelper helper(isolate, string);
   return helper.GetResult();
 }
@@ -1330,9 +1330,10 @@ char* DoubleToRadixCString(double value, int radix) {
 
 
 // ES6 18.2.4 parseFloat(string)
-double StringToDouble(UnicodeCache* unicode_cache, Handle<String> string,
-                      int flags, double empty_string_val) {
-  Handle<String> flattened = String::Flatten(string);
+double StringToDouble(Isolate* isolate, UnicodeCache* unicode_cache,
+                      Handle<String> string, int flags,
+                      double empty_string_val) {
+  Handle<String> flattened = String::Flatten(isolate, string);
   {
     DisallowHeapAllocation no_gc;
     String::FlatContent flat = flattened->GetFlatContent();
diff --git a/deps/v8/src/conversions.h b/deps/v8/src/conversions.h
index 6189fe0aa10afa..3077ae4204a945 100644
--- a/deps/v8/src/conversions.h
+++ b/deps/v8/src/conversions.h
@@ -32,12 +32,13 @@ inline int FastD2IChecked(double x) {
   return static_cast<int>(x);
 }
 
-
 // The fast double-to-(unsigned-)int conversion routine does not guarantee
 // rounding towards zero.
-// The result is unspecified if x is infinite or NaN, or if the rounded
+// The result is undefined if x is infinite or NaN, or if the rounded
 // integer value is outside the range of type int.
 inline int FastD2I(double x) {
+  DCHECK(x <= INT_MAX);
+  DCHECK(x >= INT_MIN);
   return static_cast<int32_t>(x);
 }
 
@@ -169,8 +170,9 @@ inline uint32_t NumberToUint32(Object* number);
 inline int64_t NumberToInt64(Object* number);
 inline uint64_t PositiveNumberToUint64(Object* number);
 
-double StringToDouble(UnicodeCache* unicode_cache, Handle<String> string,
-                      int flags, double empty_string_val = 0.0);
+double StringToDouble(Isolate* isolate, UnicodeCache* unicode_cache,
+                      Handle<String> string, int flags,
+                      double empty_string_val = 0.0);
 
 inline bool TryNumberToSize(Object* number, size_t* result);
 
diff --git a/deps/v8/src/counters.cc b/deps/v8/src/counters.cc
index 001beb938e25c3..580536d3d6288f 100644
--- a/deps/v8/src/counters.cc
+++ b/deps/v8/src/counters.cc
@@ -508,7 +508,7 @@ bool RuntimeCallStats::IsCalledOnTheSameThread() {
 }
 
 void RuntimeCallStats::Print() {
-  OFStream os(stdout);
+  StdoutStream os;
   Print(os);
 }
 
diff --git a/deps/v8/src/counters.h b/deps/v8/src/counters.h
index 3318055185521e..9a329bfe63aab8 100644
--- a/deps/v8/src/counters.h
+++ b/deps/v8/src/counters.h
@@ -406,8 +406,7 @@ class HistogramTimerScope BASE_EMBEDDED {
   explicit HistogramTimerScope(HistogramTimer* timer,
                                bool allow_nesting = false)
 #ifdef DEBUG
-      : timer_(timer),
-        skipped_timer_start_(false) {
+      : timer_(timer), skipped_timer_start_(false) {
     if (timer_->timer()->IsStarted() && allow_nesting) {
       skipped_timer_start_ = true;
     } else {
@@ -436,6 +435,27 @@ class HistogramTimerScope BASE_EMBEDDED {
 #endif
 };
 
+enum class OptionalHistogramTimerScopeMode { TAKE_TIME, DONT_TAKE_TIME };
+
+// Helper class for scoping a HistogramTimer.
+// It will not take time if take_time is set to false.
+class OptionalHistogramTimerScope BASE_EMBEDDED {
+ public:
+  OptionalHistogramTimerScope(HistogramTimer* timer,
+                              OptionalHistogramTimerScopeMode mode)
+      : timer_(timer), mode_(mode) {
+    if (mode == OptionalHistogramTimerScopeMode::TAKE_TIME) timer_->Start();
+  }
+
+  ~OptionalHistogramTimerScope() {
+    if (mode_ == OptionalHistogramTimerScopeMode::TAKE_TIME) timer_->Stop();
+  }
+
+ private:
+  HistogramTimer* timer_;
+  OptionalHistogramTimerScopeMode mode_;
+};
+
 // A histogram timer that can aggregate events within a larger scope.
 //
 // Intended use of this timer is to have an outer (aggregating) and an inner
@@ -1109,6 +1129,13 @@ class RuntimeCallTimerScope {
   HR(incremental_marking_reason, V8.GCIncrementalMarkingReason, 0, 21, 22)     \
   HR(incremental_marking_sum, V8.GCIncrementalMarkingSum, 0, 10000, 101)       \
   HR(mark_compact_reason, V8.GCMarkCompactReason, 0, 21, 22)                   \
+  HR(gc_finalize_clear, V8.GCFinalizeMC.Clear, 0, 10000, 101)                  \
+  HR(gc_finalize_epilogue, V8.GCFinalizeMC.Epilogue, 0, 10000, 101)            \
+  HR(gc_finalize_evacuate, V8.GCFinalizeMC.Evacuate, 0, 10000, 101)            \
+  HR(gc_finalize_finish, V8.GCFinalizeMC.Finish, 0, 10000, 101)                \
+  HR(gc_finalize_mark, V8.GCFinalizeMC.Mark, 0, 10000, 101)                    \
+  HR(gc_finalize_prologue, V8.GCFinalizeMC.Prologue, 0, 10000, 101)            \
+  HR(gc_finalize_sweep, V8.GCFinalizeMC.Sweep, 0, 10000, 101)                  \
   HR(scavenge_reason, V8.GCScavengeReason, 0, 21, 22)                          \
   HR(young_generation_handling, V8.GCYoungGenerationHandling, 0, 2, 3)         \
   /* Asm/Wasm. */                                                              \
@@ -1144,7 +1171,12 @@ class RuntimeCallTimerScope {
      20)                                                                       \
   HR(wasm_lazy_compilation_throughput, V8.WasmLazyCompilationThroughput, 1,    \
      10000, 50)                                                                \
-  HR(compile_script_cache_behaviour, V8.CompileScript.CacheBehaviour, 0, 19, 20)
+  HR(compile_script_cache_behaviour, V8.CompileScript.CacheBehaviour, 0, 19,   \
+     20)                                                                       \
+  HR(wasm_memory_allocation_result, V8.WasmMemoryAllocationResult, 0, 3, 4)    \
+  HR(wasm_address_space_usage_mb, V8.WasmAddressSpaceUsageMiB, 0, 1 << 20,     \
+     128)                                                                      \
+  HR(wasm_module_code_size_mb, V8.WasmModuleCodeSizeMiB, 0, 256, 64)
 
 #define HISTOGRAM_TIMER_LIST(HT)                                               \
   /* Garbage collection timers. */                                             \
@@ -1284,7 +1316,6 @@ class RuntimeCallTimerScope {
   SC(objs_since_last_full, V8.ObjsSinceLastFull)                    \
   SC(string_table_capacity, V8.StringTableCapacity)                 \
   SC(number_of_symbols, V8.NumberOfSymbols)                         \
-  SC(script_wrappers, V8.ScriptWrappers)                            \
   SC(inlined_copied_elements, V8.InlinedCopiedElements)             \
   SC(arguments_adaptors, V8.ArgumentsAdaptors)                      \
   SC(compilation_cache_hits, V8.CompilationCacheHits)               \
diff --git a/deps/v8/src/d8.cc b/deps/v8/src/d8.cc
index d9ae952c5c176e..975dd03414f5ab 100644
--- a/deps/v8/src/d8.cc
+++ b/deps/v8/src/d8.cc
@@ -154,9 +154,9 @@ class MockArrayBufferAllocator : public ArrayBufferAllocatorBase {
   }
 };
 
-// Predictable v8::Platform implementation. Background tasks and idle tasks are
-// disallowed, and the time reported by {MonotonicallyIncreasingTime} is
-// deterministic.
+// Predictable v8::Platform implementation. Worker threads are disabled, idle
+// tasks are disallowed, and the time reported by {MonotonicallyIncreasingTime}
+// is deterministic.
 class PredictablePlatform : public Platform {
  public:
   explicit PredictablePlatform(std::unique_ptr<Platform> platform)
@@ -181,12 +181,7 @@ class PredictablePlatform : public Platform {
     return platform_->GetForegroundTaskRunner(isolate);
   }
 
-  std::shared_ptr<TaskRunner> GetWorkerThreadsTaskRunner(
-      v8::Isolate* isolate) override {
-    // Return the foreground task runner here, so that all tasks get executed
-    // sequentially in a predictable order.
-    return platform_->GetForegroundTaskRunner(isolate);
-  }
+  int NumberOfWorkerThreads() override { return 0; }
 
   void CallOnWorkerThread(std::unique_ptr<Task> task) override {
     // It's not defined when background tasks are being executed, so we can just
@@ -194,6 +189,11 @@ class PredictablePlatform : public Platform {
     task->Run();
   }
 
+  void CallDelayedOnWorkerThread(std::unique_ptr<Task> task,
+                                 double delay_in_seconds) override {
+    // Never run delayed tasks.
+  }
+
   void CallOnForegroundThread(v8::Isolate* isolate, Task* task) override {
     platform_->CallOnForegroundThread(isolate, task);
   }
@@ -383,64 +383,6 @@ static platform::tracing::TraceConfig* CreateTraceConfigFromJSON(
 
 }  // namespace tracing
 
-class PerIsolateData {
- public:
-  explicit PerIsolateData(Isolate* isolate)
-      : isolate_(isolate), realms_(nullptr) {
-    isolate->SetData(0, this);
-  }
-
-  ~PerIsolateData() {
-    isolate_->SetData(0, nullptr);  // Not really needed, just to be sure...
-  }
-
-  inline static PerIsolateData* Get(Isolate* isolate) {
-    return reinterpret_cast<PerIsolateData*>(isolate->GetData(0));
-  }
-
-  class RealmScope {
-   public:
-    explicit RealmScope(PerIsolateData* data);
-    ~RealmScope();
-   private:
-    PerIsolateData* data_;
-  };
-
-  inline void SetTimeout(Local<Function> callback, Local<Context> context) {
-    set_timeout_callbacks_.emplace(isolate_, callback);
-    set_timeout_contexts_.emplace(isolate_, context);
-  }
-
-  inline MaybeLocal<Function> GetTimeoutCallback() {
-    if (set_timeout_callbacks_.empty()) return MaybeLocal<Function>();
-    Local<Function> result = set_timeout_callbacks_.front().Get(isolate_);
-    set_timeout_callbacks_.pop();
-    return result;
-  }
-
-  inline MaybeLocal<Context> GetTimeoutContext() {
-    if (set_timeout_contexts_.empty()) return MaybeLocal<Context>();
-    Local<Context> result = set_timeout_contexts_.front().Get(isolate_);
-    set_timeout_contexts_.pop();
-    return result;
-  }
-
- private:
-  friend class Shell;
-  friend class RealmScope;
-  Isolate* isolate_;
-  int realm_count_;
-  int realm_current_;
-  int realm_switch_;
-  Global<Context>* realms_;
-  Global<Value> realm_shared_;
-  std::queue<Global<Function>> set_timeout_callbacks_;
-  std::queue<Global<Context>> set_timeout_contexts_;
-
-  int RealmIndexOrThrow(const v8::FunctionCallbackInfo<v8::Value>& args,
-                        int arg_offset);
-  int RealmFind(Local<Context> context);
-};
 
 class ExternalOwningOneByteStringResource
     : public String::ExternalOneByteStringResource {
@@ -480,12 +422,6 @@ ArrayBuffer::Allocator* Shell::array_buffer_allocator;
 ShellOptions Shell::options;
 base::OnceType Shell::quit_once_ = V8_ONCE_INIT;
 
-bool CounterMap::Match(void* key1, void* key2) {
-  const char* name1 = reinterpret_cast<const char*>(key1);
-  const char* name2 = reinterpret_cast<const char*>(key2);
-  return strcmp(name1, name2) == 0;
-}
-
 // Dummy external source stream which returns the whole source in one go.
 class DummySourceStream : public v8::ScriptCompiler::ExternalSourceStream {
  public:
@@ -996,6 +932,41 @@ bool Shell::ExecuteModule(Isolate* isolate, const char* file_name) {
   return true;
 }
 
+PerIsolateData::PerIsolateData(Isolate* isolate)
+    : isolate_(isolate), realms_(nullptr) {
+  isolate->SetData(0, this);
+  if (i::FLAG_expose_async_hooks) {
+    async_hooks_wrapper_ = new AsyncHooks(isolate);
+  }
+}
+
+PerIsolateData::~PerIsolateData() {
+  isolate_->SetData(0, nullptr);  // Not really needed, just to be sure...
+  if (i::FLAG_expose_async_hooks) {
+    delete async_hooks_wrapper_;  // This uses the isolate
+  }
+}
+
+void PerIsolateData::SetTimeout(Local<Function> callback,
+                                Local<Context> context) {
+  set_timeout_callbacks_.emplace(isolate_, callback);
+  set_timeout_contexts_.emplace(isolate_, context);
+}
+
+MaybeLocal<Function> PerIsolateData::GetTimeoutCallback() {
+  if (set_timeout_callbacks_.empty()) return MaybeLocal<Function>();
+  Local<Function> result = set_timeout_callbacks_.front().Get(isolate_);
+  set_timeout_callbacks_.pop();
+  return result;
+}
+
+MaybeLocal<Context> PerIsolateData::GetTimeoutContext() {
+  if (set_timeout_contexts_.empty()) return MaybeLocal<Context>();
+  Local<Context> result = set_timeout_contexts_.front().Get(isolate_);
+  set_timeout_contexts_.pop();
+  return result;
+}
+
 PerIsolateData::RealmScope::RealmScope(PerIsolateData* data) : data_(data) {
   data_->realm_count_ = 1;
   data_->realm_current_ = 0;
@@ -1250,6 +1221,35 @@ void Shell::RealmSharedSet(Local<String> property,
   data->realm_shared_.Reset(isolate, value);
 }
 
+// async_hooks.createHook() registers functions to be called for different
+// lifetime events of each async operation.
+void Shell::AsyncHooksCreateHook(
+    const v8::FunctionCallbackInfo<v8::Value>& args) {
+  Local<Object> wrap =
+      PerIsolateData::Get(args.GetIsolate())->GetAsyncHooks()->CreateHook(args);
+  args.GetReturnValue().Set(wrap);
+}
+
+// async_hooks.executionAsyncId() returns the asyncId of the current execution
+// context.
+void Shell::AsyncHooksExecutionAsyncId(
+    const v8::FunctionCallbackInfo<v8::Value>& args) {
+  Isolate* isolate = args.GetIsolate();
+  HandleScope handle_scope(isolate);
+  args.GetReturnValue().Set(v8::Number::New(
+      isolate,
+      PerIsolateData::Get(isolate)->GetAsyncHooks()->GetExecutionAsyncId()));
+}
+
+void Shell::AsyncHooksTriggerAsyncId(
+    const v8::FunctionCallbackInfo<v8::Value>& args) {
+  Isolate* isolate = args.GetIsolate();
+  HandleScope handle_scope(isolate);
+  args.GetReturnValue().Set(v8::Number::New(
+      isolate,
+      PerIsolateData::Get(isolate)->GetAsyncHooks()->GetTriggerAsyncId()));
+}
+
 void WriteToFile(FILE* file, const v8::FunctionCallbackInfo<v8::Value>& args) {
   for (int i = 0; i < args.Length(); i++) {
     HandleScope handle_scope(args.GetIsolate());
@@ -1629,25 +1629,15 @@ void Shell::MapCounters(v8::Isolate* isolate, const char* name) {
   isolate->SetAddHistogramSampleFunction(AddHistogramSample);
 }
 
-
-int CounterMap::Hash(const char* name) {
-  int h = 0;
-  int c;
-  while ((c = *name++) != 0) {
-    h += h << 5;
-    h += c;
-  }
-  return h;
-}
-
-
 Counter* Shell::GetCounter(const char* name, bool is_histogram) {
-  Counter* counter = counter_map_->Lookup(name);
+  auto map_entry = counter_map_->find(name);
+  Counter* counter =
+      map_entry != counter_map_->end() ? map_entry->second : nullptr;
 
   if (counter == nullptr) {
     counter = counters_->GetNextCounter();
     if (counter != nullptr) {
-      counter_map_->Set(name, counter);
+      (*counter_map_)[name] = counter;
       counter->Bind(name, is_histogram);
     }
   } else {
@@ -1873,6 +1863,26 @@ Local<ObjectTemplate> Shell::CreateGlobalTemplate(Isolate* isolate) {
           .ToLocalChecked(),
       os_templ);
 
+  if (i::FLAG_expose_async_hooks) {
+    Local<ObjectTemplate> async_hooks_templ = ObjectTemplate::New(isolate);
+    async_hooks_templ->Set(
+        String::NewFromUtf8(isolate, "createHook", NewStringType::kNormal)
+            .ToLocalChecked(),
+        FunctionTemplate::New(isolate, AsyncHooksCreateHook));
+    async_hooks_templ->Set(
+        String::NewFromUtf8(isolate, "executionAsyncId", NewStringType::kNormal)
+            .ToLocalChecked(),
+        FunctionTemplate::New(isolate, AsyncHooksExecutionAsyncId));
+    async_hooks_templ->Set(
+        String::NewFromUtf8(isolate, "triggerAsyncId", NewStringType::kNormal)
+            .ToLocalChecked(),
+        FunctionTemplate::New(isolate, AsyncHooksTriggerAsyncId));
+    global_template->Set(
+        String::NewFromUtf8(isolate, "async_hooks", NewStringType::kNormal)
+            .ToLocalChecked(),
+        async_hooks_templ);
+  }
+
   return global_template;
 }
 
@@ -2077,21 +2087,18 @@ void Shell::OnExit(v8::Isolate* isolate) {
   // Dump basic block profiling data.
   if (i::BasicBlockProfiler* profiler =
           reinterpret_cast<i::Isolate*>(isolate)->basic_block_profiler()) {
-    i::OFStream os(stdout);
-    os << *profiler;
+    i::StdoutStream{} << *profiler;
   }
   isolate->Dispose();
 
   if (i::FLAG_dump_counters || i::FLAG_dump_counters_nvp) {
-    int number_of_counters = 0;
-    for (CounterMap::Iterator i(counter_map_); i.More(); i.Next()) {
-      number_of_counters++;
-    }
+    const int number_of_counters = static_cast<int>(counter_map_->size());
     CounterAndKey* counters = new CounterAndKey[number_of_counters];
     int j = 0;
-    for (CounterMap::Iterator i(counter_map_); i.More(); i.Next(), j++) {
-      counters[j].counter = i.CurrentValue();
-      counters[j].key = i.CurrentKey();
+    for (auto map_entry : *counter_map_) {
+      counters[j].counter = map_entry.second;
+      counters[j].key = map_entry.first;
+      j++;
     }
     std::sort(counters, counters + number_of_counters);
 
@@ -2369,8 +2376,6 @@ class InspectorClient : public v8_inspector::V8InspectorClient {
             .ToLocalChecked();
     CHECK(context->Global()->Set(context, function_name, function).FromJust());
 
-    v8::debug::SetLiveEditEnabled(isolate_, true);
-
     context_.Reset(isolate_, context);
   }
 
@@ -2699,7 +2704,9 @@ void Worker::ExecuteInThread() {
               if (Shell::DeserializeValue(isolate, std::move(data))
                       .ToLocal(&value)) {
                 Local<Value> argv[] = {value};
-                (void)onmessage_fun->Call(context, global, 1, argv);
+                MaybeLocal<Value> result =
+                    onmessage_fun->Call(context, global, 1, argv);
+                USE(result);
               }
               if (try_catch.HasCaught()) {
                 Shell::ReportException(isolate, &try_catch);
@@ -3016,11 +3023,10 @@ void Shell::CompleteMessageLoop(Isolate* isolate) {
     base::LockGuard<base::Mutex> guard(isolate_status_lock_.Pointer());
     DCHECK_GT(isolate_status_.count(isolate), 0);
     i::Isolate* i_isolate = reinterpret_cast<i::Isolate*>(isolate);
-    i::wasm::CompilationManager* wasm_compilation_manager =
-        i_isolate->wasm_engine()->compilation_manager();
-    bool should_wait = (options.wait_for_wasm &&
-                        wasm_compilation_manager->HasRunningCompileJob()) ||
-                       isolate_status_[isolate];
+    i::wasm::WasmEngine* wasm_engine = i_isolate->wasm_engine();
+    bool should_wait =
+        (options.wait_for_wasm && wasm_engine->HasRunningCompileJob()) ||
+        isolate_status_[isolate];
     return should_wait ? platform::MessageLoopBehavior::kWaitForWork
                        : platform::MessageLoopBehavior::kDoNotWait;
   };
@@ -3095,6 +3101,21 @@ class Serializer : public ValueSerializer::Delegate {
     return Just<uint32_t>(static_cast<uint32_t>(index));
   }
 
+  Maybe<uint32_t> GetWasmModuleTransferId(
+      Isolate* isolate, Local<WasmCompiledModule> module) override {
+    DCHECK_NOT_NULL(data_);
+    for (size_t index = 0; index < wasm_modules_.size(); ++index) {
+      if (wasm_modules_[index] == module) {
+        return Just<uint32_t>(static_cast<uint32_t>(index));
+      }
+    }
+
+    size_t index = wasm_modules_.size();
+    wasm_modules_.emplace_back(isolate_, module);
+    data_->transferrable_modules_.push_back(module->GetTransferrableModule());
+    return Just<uint32_t>(static_cast<uint32_t>(index));
+  }
+
   void* ReallocateBufferMemory(void* old_buffer, size_t size,
                                size_t* actual_size) override {
     // Not accurate, because we don't take into account reallocated buffers,
@@ -3172,6 +3193,7 @@ class Serializer : public ValueSerializer::Delegate {
   std::unique_ptr<SerializationData> data_;
   std::vector<Global<ArrayBuffer>> array_buffers_;
   std::vector<Global<SharedArrayBuffer>> shared_array_buffers_;
+  std::vector<Global<WasmCompiledModule>> wasm_modules_;
   std::vector<ExternalizedContents> externalized_contents_;
   size_t current_memory_usage_;
 
@@ -3215,6 +3237,16 @@ class Deserializer : public ValueDeserializer::Delegate {
     return MaybeLocal<SharedArrayBuffer>();
   }
 
+  MaybeLocal<WasmCompiledModule> GetWasmModuleFromId(
+      Isolate* isolate, uint32_t transfer_id) override {
+    DCHECK_NOT_NULL(data_);
+    if (transfer_id < data_->transferrable_modules().size()) {
+      return WasmCompiledModule::FromTransferrableModule(
+          isolate_, data_->transferrable_modules().at(transfer_id));
+    }
+    return MaybeLocal<WasmCompiledModule>();
+  }
+
  private:
   Isolate* isolate_;
   ValueDeserializer deserializer_;
@@ -3309,7 +3341,9 @@ int Shell::Main(int argc, char* argv[]) {
   } else {
     v8::V8::InitializeExternalStartupData(argv[0]);
   }
-  SetFlagsFromString("--trace-turbo-cfg-file=turbo.cfg");
+  if (i::FLAG_trace_turbo_cfg_file == nullptr) {
+    SetFlagsFromString("--trace-turbo-cfg-file=turbo.cfg");
+  }
   SetFlagsFromString("--redirect-code-traces-to=code.asm");
   int result = 0;
   Isolate::CreateParams create_params;
@@ -3336,10 +3370,9 @@ int Shell::Main(int argc, char* argv[]) {
   }
 
   if (V8_TRAP_HANDLER_SUPPORTED && i::FLAG_wasm_trap_handler) {
-    constexpr bool use_default_signal_handler = true;
-    if (!v8::V8::EnableWebAssemblyTrapHandler(use_default_signal_handler)) {
-      fprintf(stderr, "Could not register signal handler");
-      exit(1);
+    constexpr bool use_default_trap_handler = true;
+    if (!v8::V8::EnableWebAssemblyTrapHandler(use_default_trap_handler)) {
+      FATAL("Could not register trap handler");
     }
   }
 
diff --git a/deps/v8/src/d8.h b/deps/v8/src/d8.h
index 731b080880d619..ef0ea7d89869e0 100644
--- a/deps/v8/src/d8.h
+++ b/deps/v8/src/d8.h
@@ -8,12 +8,15 @@
 #include <iterator>
 #include <map>
 #include <memory>
+#include <queue>
 #include <string>
+#include <unordered_map>
 #include <vector>
 
 #include "src/allocation.h"
-#include "src/base/hashmap.h"
+#include "src/async-hooks-wrapper.h"
 #include "src/base/platform/time.h"
+#include "src/string-hasher.h"
 #include "src/utils.h"
 
 #include "src/base/once.h"
@@ -56,41 +59,21 @@ class CounterCollection {
   Counter counters_[kMaxCounters];
 };
 
-
-class CounterMap {
- public:
-  CounterMap(): hash_map_(Match) { }
-  Counter* Lookup(const char* name) {
-    base::HashMap::Entry* answer =
-        hash_map_.Lookup(const_cast<char*>(name), Hash(name));
-    if (!answer) return nullptr;
-    return reinterpret_cast<Counter*>(answer->value);
-  }
-  void Set(const char* name, Counter* value) {
-    base::HashMap::Entry* answer =
-        hash_map_.LookupOrInsert(const_cast<char*>(name), Hash(name));
-    DCHECK_NOT_NULL(answer);
-    answer->value = value;
+struct CStringHasher {
+  std::size_t operator()(const char* name) const {
+    size_t h = 0;
+    size_t c;
+    while ((c = *name++) != 0) {
+      h += h << 5;
+      h += c;
+    }
+    return h;
   }
-  class Iterator {
-   public:
-    explicit Iterator(CounterMap* map)
-        : map_(&map->hash_map_), entry_(map_->Start()) { }
-    void Next() { entry_ = map_->Next(entry_); }
-    bool More() { return entry_ != nullptr; }
-    const char* CurrentKey() { return static_cast<const char*>(entry_->key); }
-    Counter* CurrentValue() { return static_cast<Counter*>(entry_->value); }
-   private:
-    base::CustomMatcherHashMap* map_;
-    base::CustomMatcherHashMap::Entry* entry_;
-  };
-
- private:
-  static int Hash(const char* name);
-  static bool Match(void* key1, void* key2);
-  base::CustomMatcherHashMap hash_map_;
 };
 
+typedef std::unordered_map<const char*, Counter*, CStringHasher,
+                           i::StringEquals>
+    CounterMap;
 
 class SourceGroup {
  public:
@@ -196,7 +179,10 @@ class SerializationData {
   shared_array_buffer_contents() {
     return shared_array_buffer_contents_;
   }
-
+  const std::vector<WasmCompiledModule::TransferrableModule>&
+  transferrable_modules() {
+    return transferrable_modules_;
+  }
 
  private:
   struct DataDeleter {
@@ -207,6 +193,7 @@ class SerializationData {
   size_t size_;
   std::vector<ArrayBuffer::Contents> array_buffer_contents_;
   std::vector<SharedArrayBuffer::Contents> shared_array_buffer_contents_;
+  std::vector<WasmCompiledModule::TransferrableModule> transferrable_modules_;
 
  private:
   friend class Serializer;
@@ -279,6 +266,49 @@ class Worker {
   base::Atomic32 running_;
 };
 
+class PerIsolateData {
+ public:
+  explicit PerIsolateData(Isolate* isolate);
+
+  ~PerIsolateData();
+
+  inline static PerIsolateData* Get(Isolate* isolate) {
+    return reinterpret_cast<PerIsolateData*>(isolate->GetData(0));
+  }
+
+  class RealmScope {
+   public:
+    explicit RealmScope(PerIsolateData* data);
+    ~RealmScope();
+
+   private:
+    PerIsolateData* data_;
+  };
+
+  inline void SetTimeout(Local<Function> callback, Local<Context> context);
+  inline MaybeLocal<Function> GetTimeoutCallback();
+  inline MaybeLocal<Context> GetTimeoutContext();
+
+  AsyncHooks* GetAsyncHooks() { return async_hooks_wrapper_; }
+
+ private:
+  friend class Shell;
+  friend class RealmScope;
+  Isolate* isolate_;
+  int realm_count_;
+  int realm_current_;
+  int realm_switch_;
+  Global<Context>* realms_;
+  Global<Value> realm_shared_;
+  std::queue<Global<Function>> set_timeout_callbacks_;
+  std::queue<Global<Context>> set_timeout_contexts_;
+  AsyncHooks* async_hooks_wrapper_;
+
+  int RealmIndexOrThrow(const v8::FunctionCallbackInfo<v8::Value>& args,
+                        int arg_offset);
+  int RealmFind(Local<Context> context);
+};
+
 class ShellOptions {
  public:
   enum CodeCacheOptions {
@@ -415,6 +445,13 @@ class Shell : public i::AllStatic {
                              Local<Value> value,
                              const  PropertyCallbackInfo<void>& info);
 
+  static void AsyncHooksCreateHook(
+      const v8::FunctionCallbackInfo<v8::Value>& args);
+  static void AsyncHooksExecutionAsyncId(
+      const v8::FunctionCallbackInfo<v8::Value>& args);
+  static void AsyncHooksTriggerAsyncId(
+      const v8::FunctionCallbackInfo<v8::Value>& args);
+
   static void Print(const v8::FunctionCallbackInfo<v8::Value>& args);
   static void PrintErr(const v8::FunctionCallbackInfo<v8::Value>& args);
   static void Write(const v8::FunctionCallbackInfo<v8::Value>& args);
diff --git a/deps/v8/src/d8.js b/deps/v8/src/d8.js
index 287571b9376057..a5486ccd1e933b 100644
--- a/deps/v8/src/d8.js
+++ b/deps/v8/src/d8.js
@@ -42,8 +42,7 @@ function Stringify(x, depth) {
     case "string":
       return "\"" + x.toString() + "\"";
     case "bigint":
-      // TODO(neis): Use x.toString() once we have it.
-      return String(x) + "n";
+      return x.toString() + "n";
     case "object":
       if (IS_NULL(x)) return "null";
       if (x.constructor && x.constructor.name === "Array") {
diff --git a/deps/v8/src/date.cc b/deps/v8/src/date.cc
index c317810dbbcf84..d98d4f6f87b7c0 100644
--- a/deps/v8/src/date.cc
+++ b/deps/v8/src/date.cc
@@ -4,8 +4,9 @@
 
 #include "src/date.h"
 
-#include "src/objects.h"
+#include "src/conversions.h"
 #include "src/objects-inl.h"
+#include "src/objects.h"
 
 #ifdef V8_INTL_SUPPORT
 #include "src/intl.h"
@@ -65,6 +66,13 @@ void DateCache::ResetDateCache() {
   dst_tz_name_ = nullptr;
 }
 
+// ECMA 262 - ES#sec-timeclip TimeClip (time)
+double DateCache::TimeClip(double time) {
+  if (-kMaxTimeInMs <= time && time <= kMaxTimeInMs) {
+    return DoubleToInteger(time) + 0.0;
+  }
+  return std::numeric_limits<double>::quiet_NaN();
+}
 
 void DateCache::ClearSegment(DST* segment) {
   segment->start_sec = kMaxEpochTimeInSec;
diff --git a/deps/v8/src/date.h b/deps/v8/src/date.h
index d25b6080a1c2ae..28947ebcbe344c 100644
--- a/deps/v8/src/date.h
+++ b/deps/v8/src/date.h
@@ -62,6 +62,8 @@ class DateCache {
     return static_cast<int>(time_ms - days * kMsPerDay);
   }
 
+  // ECMA 262 - ES#sec-timeclip TimeClip (time)
+  static double TimeClip(double time);
 
   // Given the number of days since the epoch, computes the weekday.
   // ECMA 262 - 15.9.1.6.
diff --git a/deps/v8/src/debug/arm/debug-arm.cc b/deps/v8/src/debug/arm/debug-arm.cc
index ca00606247f99a..6844fe28a9070f 100644
--- a/deps/v8/src/debug/arm/debug-arm.cc
+++ b/deps/v8/src/debug/arm/debug-arm.cc
@@ -40,8 +40,8 @@ void DebugCodegen::GenerateFrameDropperTrampoline(MacroAssembler* masm) {
   __ LeaveFrame(StackFrame::INTERNAL);
 
   __ ldr(r0, FieldMemOperand(r1, JSFunction::kSharedFunctionInfoOffset));
-  __ ldr(r0,
-         FieldMemOperand(r0, SharedFunctionInfo::kFormalParameterCountOffset));
+  __ ldrh(r0,
+          FieldMemOperand(r0, SharedFunctionInfo::kFormalParameterCountOffset));
   __ mov(r2, r0);
 
   ParameterCount dummy1(r2);
diff --git a/deps/v8/src/debug/arm64/debug-arm64.cc b/deps/v8/src/debug/arm64/debug-arm64.cc
index e2c3f4738d045d..c130524f37498b 100644
--- a/deps/v8/src/debug/arm64/debug-arm64.cc
+++ b/deps/v8/src/debug/arm64/debug-arm64.cc
@@ -41,8 +41,8 @@ void DebugCodegen::GenerateFrameDropperTrampoline(MacroAssembler* masm) {
   __ Pop(fp, lr);  // Frame, Return address.
 
   __ Ldr(x0, FieldMemOperand(x1, JSFunction::kSharedFunctionInfoOffset));
-  __ Ldr(x0,
-         FieldMemOperand(x0, SharedFunctionInfo::kFormalParameterCountOffset));
+  __ Ldrh(x0,
+          FieldMemOperand(x0, SharedFunctionInfo::kFormalParameterCountOffset));
   __ mov(x2, x0);
 
   ParameterCount dummy1(x2);
diff --git a/deps/v8/src/debug/debug-coverage.cc b/deps/v8/src/debug/debug-coverage.cc
index f27e22cfbbb0da..9e7195b1f3ea84 100644
--- a/deps/v8/src/debug/debug-coverage.cc
+++ b/deps/v8/src/debug/debug-coverage.cc
@@ -505,7 +505,7 @@ std::unique_ptr<Coverage> Coverage::Collect(
 
     {
       // Sort functions by start position, from outer to inner functions.
-      SharedFunctionInfo::ScriptIterator infos(script_handle);
+      SharedFunctionInfo::ScriptIterator infos(isolate, *script_handle);
       while (SharedFunctionInfo* info = infos.Next()) {
         sorted.push_back(info);
       }
@@ -575,7 +575,7 @@ void Coverage::SelectMode(Isolate* isolate, debug::Coverage::Mode mode) {
       isolate->debug()->RemoveAllCoverageInfos();
       if (!isolate->is_collecting_type_profile()) {
         isolate->SetFeedbackVectorsForProfilingTools(
-            isolate->heap()->undefined_value());
+            ReadOnlyRoots(isolate).undefined_value());
       }
       break;
     case debug::Coverage::kBlockBinary:
diff --git a/deps/v8/src/debug/debug-evaluate.cc b/deps/v8/src/debug/debug-evaluate.cc
index be456678299f6a..161f95d6a47b14 100644
--- a/deps/v8/src/debug/debug-evaluate.cc
+++ b/deps/v8/src/debug/debug-evaluate.cc
@@ -16,6 +16,7 @@
 #include "src/interpreter/bytecode-array-iterator.h"
 #include "src/interpreter/bytecodes.h"
 #include "src/isolate-inl.h"
+#include "src/objects/api-callbacks.h"
 #include "src/snapshot/snapshot.h"
 
 namespace v8 {
@@ -43,7 +44,8 @@ MaybeHandle<Object> DebugEvaluate::Global(Isolate* isolate,
                                                             context);
   if (throw_on_side_effect) isolate->debug()->StartSideEffectCheckMode();
   MaybeHandle<Object> result = Execution::Call(
-      isolate, fun, Handle<JSObject>(context->global_proxy()), 0, nullptr);
+      isolate, fun, Handle<JSObject>(context->global_proxy(), isolate), 0,
+      nullptr);
   if (throw_on_side_effect) isolate->debug()->StopSideEffectCheckMode();
   return result;
 }
@@ -71,7 +73,7 @@ MaybeHandle<Object> DebugEvaluate::Local(Isolate* isolate,
   if (isolate->has_pending_exception()) return MaybeHandle<Object>();
 
   Handle<Context> context = context_builder.evaluation_context();
-  Handle<JSObject> receiver(context->global_proxy());
+  Handle<JSObject> receiver(context->global_proxy(), isolate);
   MaybeHandle<Object> maybe_result =
       Evaluate(isolate, context_builder.outer_info(), context, receiver, source,
                throw_on_side_effect);
@@ -112,9 +114,9 @@ MaybeHandle<Object> DebugEvaluate::WithTopmostArguments(Isolate* isolate,
   Handle<Context> evaluation_context =
       factory->NewDebugEvaluateContext(native_context, scope_info, materialized,
                                        Handle<Context>(), Handle<StringSet>());
-  Handle<SharedFunctionInfo> outer_info(native_context->closure()->shared(),
-                                        isolate);
-  Handle<JSObject> receiver(native_context->global_proxy());
+  Handle<SharedFunctionInfo> outer_info(
+      native_context->empty_function()->shared(), isolate);
+  Handle<JSObject> receiver(native_context->global_proxy(), isolate);
   const bool throw_on_side_effect = false;
   MaybeHandle<Object> maybe_result =
       Evaluate(isolate, outer_info, evaluation_context, receiver, source,
@@ -158,20 +160,24 @@ MaybeHandle<Object> DebugEvaluate::Evaluate(
   return result;
 }
 
+Handle<SharedFunctionInfo> DebugEvaluate::ContextBuilder::outer_info() const {
+  return handle(frame_inspector_.GetFunction()->shared(), isolate_);
+}
 
 DebugEvaluate::ContextBuilder::ContextBuilder(Isolate* isolate,
                                               JavaScriptFrame* frame,
                                               int inlined_jsframe_index)
     : isolate_(isolate),
-      frame_(frame),
-      inlined_jsframe_index_(inlined_jsframe_index) {
-  FrameInspector frame_inspector(frame, inlined_jsframe_index, isolate);
-  Handle<JSFunction> local_function = frame_inspector.GetFunction();
-  Handle<Context> outer_context(local_function->context());
+      frame_inspector_(frame, inlined_jsframe_index, isolate),
+      scope_iterator_(isolate, &frame_inspector_,
+                      ScopeIterator::COLLECT_NON_LOCALS) {
+  Handle<Context> outer_context(frame_inspector_.GetFunction()->context(),
+                                isolate);
   evaluation_context_ = outer_context;
-  outer_info_ = handle(local_function->shared());
   Factory* factory = isolate->factory();
 
+  if (scope_iterator_.Done()) return;
+
   // To evaluate as if we were running eval at the point of the debug break,
   // we reconstruct the context chain as follows:
   //  - To make stack-allocated variables visible, we materialize them and
@@ -188,64 +194,32 @@ DebugEvaluate::ContextBuilder::ContextBuilder(Isolate* isolate,
   //  - Look up in the materialized stack variables.
   //  - Look up in the original context.
   //  - Check the whitelist to find out whether to skip contexts during lookup.
-  const ScopeIterator::Option option = ScopeIterator::COLLECT_NON_LOCALS;
-  for (ScopeIterator it(isolate, &frame_inspector, option); !it.Done();
-       it.Next()) {
-    ScopeIterator::ScopeType scope_type = it.Type();
+  for (; scope_iterator_.InInnerScope(); scope_iterator_.Next()) {
+    ScopeIterator::ScopeType scope_type = scope_iterator_.Type();
+    if (scope_type == ScopeIterator::ScopeTypeScript) break;
+    ContextChainElement context_chain_element;
+    if (scope_type == ScopeIterator::ScopeTypeLocal ||
+        scope_iterator_.DeclaresLocals(ScopeIterator::Mode::STACK)) {
+      context_chain_element.materialized_object =
+          scope_iterator_.ScopeObject(ScopeIterator::Mode::STACK);
+    }
+    if (scope_iterator_.HasContext()) {
+      context_chain_element.wrapped_context = scope_iterator_.CurrentContext();
+    }
     if (scope_type == ScopeIterator::ScopeTypeLocal) {
-      DCHECK_EQ(FUNCTION_SCOPE, it.CurrentScopeInfo()->scope_type());
-      Handle<JSObject> materialized = factory->NewJSObjectWithNullProto();
-      Handle<Context> local_context =
-          it.HasContext() ? it.CurrentContext() : outer_context;
-      Handle<StringSet> non_locals = it.GetNonLocals();
-      MaterializeReceiver(materialized, local_context, local_function,
-                          non_locals);
-      MaterializeStackLocals(materialized, local_function, &frame_inspector);
-      ContextChainElement context_chain_element;
-      context_chain_element.scope_info = it.CurrentScopeInfo();
-      context_chain_element.materialized_object = materialized;
-      // Non-locals that are already being referenced by the current function
-      // are guaranteed to be correctly resolved.
-      context_chain_element.whitelist = non_locals;
-      if (it.HasContext()) {
-        context_chain_element.wrapped_context = it.CurrentContext();
-      }
-      context_chain_.push_back(context_chain_element);
-      evaluation_context_ = outer_context;
-      break;
-    } else if (scope_type == ScopeIterator::ScopeTypeCatch ||
-               scope_type == ScopeIterator::ScopeTypeWith ||
-               scope_type == ScopeIterator::ScopeTypeModule) {
-      ContextChainElement context_chain_element;
-      Handle<Context> current_context = it.CurrentContext();
-      if (!current_context->IsDebugEvaluateContext()) {
-        context_chain_element.wrapped_context = current_context;
-      }
-      context_chain_.push_back(context_chain_element);
-    } else if (scope_type == ScopeIterator::ScopeTypeBlock ||
-               scope_type == ScopeIterator::ScopeTypeEval) {
-      Handle<JSObject> materialized = factory->NewJSObjectWithNullProto();
-      frame_inspector.MaterializeStackLocals(materialized,
-                                             it.CurrentScopeInfo());
-      ContextChainElement context_chain_element;
-      context_chain_element.scope_info = it.CurrentScopeInfo();
-      context_chain_element.materialized_object = materialized;
-      if (it.HasContext()) {
-        context_chain_element.wrapped_context = it.CurrentContext();
-      }
-      context_chain_.push_back(context_chain_element);
-    } else {
-      break;
+      context_chain_element.whitelist = scope_iterator_.GetNonLocals();
     }
+    context_chain_.push_back(context_chain_element);
   }
 
+  Handle<ScopeInfo> scope_info =
+      evaluation_context_->IsNativeContext()
+          ? Handle<ScopeInfo>::null()
+          : handle(evaluation_context_->scope_info(), isolate);
   for (auto rit = context_chain_.rbegin(); rit != context_chain_.rend();
        rit++) {
     ContextChainElement element = *rit;
-    Handle<ScopeInfo> scope_info(ScopeInfo::CreateForWithScope(
-        isolate, evaluation_context_->IsNativeContext()
-                     ? Handle<ScopeInfo>::null()
-                     : Handle<ScopeInfo>(evaluation_context_->scope_info())));
+    scope_info = ScopeInfo::CreateForWithScope(isolate, scope_info);
     scope_info->SetIsDebugEvaluateScope();
     evaluation_context_ = factory->NewDebugEvaluateContext(
         evaluation_context_, scope_info, element.materialized_object,
@@ -255,62 +229,24 @@ DebugEvaluate::ContextBuilder::ContextBuilder(Isolate* isolate,
 
 
 void DebugEvaluate::ContextBuilder::UpdateValues() {
+  scope_iterator_.Restart();
   for (ContextChainElement& element : context_chain_) {
     if (!element.materialized_object.is_null()) {
-      // Write back potential changes to materialized stack locals to the stack.
-      FrameInspector(frame_, inlined_jsframe_index_, isolate_)
-          .UpdateStackLocalsFromMaterializedObject(element.materialized_object,
-                                                   element.scope_info);
+      Handle<FixedArray> keys =
+          KeyAccumulator::GetKeys(element.materialized_object,
+                                  KeyCollectionMode::kOwnOnly,
+                                  ENUMERABLE_STRINGS)
+              .ToHandleChecked();
+
+      for (int i = 0; i < keys->length(); i++) {
+        DCHECK(keys->get(i)->IsString());
+        Handle<String> key(String::cast(keys->get(i)), isolate_);
+        Handle<Object> value =
+            JSReceiver::GetDataProperty(element.materialized_object, key);
+        scope_iterator_.SetVariableValue(key, value);
+      }
     }
-  }
-}
-
-
-void DebugEvaluate::ContextBuilder::MaterializeReceiver(
-    Handle<JSObject> target, Handle<Context> local_context,
-    Handle<JSFunction> local_function, Handle<StringSet> non_locals) {
-  Handle<Object> recv = isolate_->factory()->undefined_value();
-  Handle<String> name = isolate_->factory()->this_string();
-  if (non_locals->Has(name)) {
-    // 'this' is allocated in an outer context and is is already being
-    // referenced by the current function, so it can be correctly resolved.
-    return;
-  } else if (local_function->shared()->scope_info()->HasReceiver() &&
-             !frame_->receiver()->IsTheHole(isolate_)) {
-    recv = handle(frame_->receiver(), isolate_);
-  }
-  JSObject::SetOwnPropertyIgnoreAttributes(target, name, recv, NONE).Check();
-}
-
-void DebugEvaluate::ContextBuilder::MaterializeStackLocals(
-    Handle<JSObject> target, Handle<JSFunction> function,
-    FrameInspector* frame_inspector) {
-  bool materialize_arguments_object = true;
-
-  // Do not materialize the arguments object for eval or top-level code.
-  if (function->shared()->is_toplevel()) materialize_arguments_object = false;
-
-  // First materialize stack locals (modulo arguments object).
-  Handle<SharedFunctionInfo> shared(function->shared());
-  Handle<ScopeInfo> scope_info(shared->scope_info());
-  frame_inspector->MaterializeStackLocals(target, scope_info,
-                                          materialize_arguments_object);
-
-  // Then materialize the arguments object.
-  if (materialize_arguments_object) {
-    // Skip if "arguments" is already taken and wasn't optimized out (which
-    // causes {MaterializeStackLocals} above to skip the local variable).
-    Handle<String> arguments_str = isolate_->factory()->arguments_string();
-    Maybe<bool> maybe = JSReceiver::HasOwnProperty(target, arguments_str);
-    DCHECK(maybe.IsJust());
-    if (maybe.FromJust()) return;
-
-    // FunctionGetArguments can't throw an exception.
-    Handle<JSObject> arguments =
-        Accessors::FunctionGetArguments(frame_, inlined_jsframe_index_);
-    JSObject::SetOwnPropertyIgnoreAttributes(target, arguments_str, arguments,
-                                             NONE)
-        .Check();
+    scope_iterator_.Next();
   }
 }
 
@@ -331,10 +267,8 @@ bool IntrinsicHasNoSideEffect(Runtime::FunctionId id) {
   V(IsArray)                             \
   V(IsDate)                              \
   V(IsFunction)                          \
-  V(IsJSMap)                             \
   V(IsJSProxy)                           \
   V(IsJSReceiver)                        \
-  V(IsJSSet)                             \
   V(IsJSWeakMap)                         \
   V(IsJSWeakSet)                         \
   V(IsRegExp)                            \
@@ -347,8 +281,10 @@ bool IntrinsicHasNoSideEffect(Runtime::FunctionId id) {
   V(EstimateNumberOfElements)            \
   V(GetArrayKeys)                        \
   V(HasComplexElements)                  \
+  V(HasFastPackedElements)               \
   V(NewArray)                            \
   V(NormalizeElements)                   \
+  V(PrepareElementsForSort)              \
   V(TrySliceSimpleNonFastElements)       \
   V(TypedArrayGetBuffer)                 \
   /* Errors */                           \
@@ -395,6 +331,8 @@ bool IntrinsicHasNoSideEffect(Runtime::FunctionId id) {
   V(ObjectHasOwnProperty)                \
   V(ObjectValues)                        \
   V(ObjectValuesSkipFastPath)            \
+  V(ObjectGetOwnPropertyNames)           \
+  V(ObjectGetOwnPropertyNamesTryFast)    \
   V(RegExpInitializeAndCompile)          \
   V(StackGuard)                          \
   V(StringAdd)                           \
@@ -407,13 +345,16 @@ bool IntrinsicHasNoSideEffect(Runtime::FunctionId id) {
   V(ThrowRangeError)                     \
   V(ThrowTypeError)                      \
   V(ToName)                              \
+  V(TransitionElementsKind)              \
   /* Misc. */                            \
   V(Call)                                \
   V(CompleteInobjectSlackTrackingForMap) \
   V(HasInPrototypeChain)                 \
   V(MaxSmi)                              \
   V(NewObject)                           \
+  V(SmiLexicographicCompare)             \
   V(StringMaxLength)                     \
+  V(StringToArray)                       \
   /* Test */                             \
   V(GetOptimizationStatus)               \
   V(OptimizeFunctionOnNextCall)          \
@@ -491,6 +432,8 @@ bool BytecodeHasNoSideEffect(interpreter::Bytecode bytecode) {
     case Bytecode::kLdaGlobal:
     case Bytecode::kLdaNamedProperty:
     case Bytecode::kLdaKeyedProperty:
+    case Bytecode::kLdaGlobalInsideTypeof:
+    case Bytecode::kLdaLookupSlotInsideTypeof:
     // Arithmetics.
     case Bytecode::kAdd:
     case Bytecode::kAddSmi:
@@ -548,15 +491,16 @@ bool BytecodeHasNoSideEffect(interpreter::Bytecode bytecode) {
     case Bytecode::kTestGreaterThanOrEqual:
     case Bytecode::kTestInstanceOf:
     case Bytecode::kTestIn:
-    case Bytecode::kTestEqualStrictNoFeedback:
+    case Bytecode::kTestReferenceEqual:
     case Bytecode::kTestUndetectable:
     case Bytecode::kTestTypeOf:
     case Bytecode::kTestUndefined:
     case Bytecode::kTestNull:
     // Conversions.
     case Bytecode::kToObject:
-    case Bytecode::kToNumber:
     case Bytecode::kToName:
+    case Bytecode::kToNumber:
+    case Bytecode::kToNumeric:
     case Bytecode::kToString:
     // Misc.
     case Bytecode::kForInEnumerate:
@@ -580,7 +524,7 @@ bool BytecodeHasNoSideEffect(interpreter::Bytecode bytecode) {
   }
 }
 
-bool BuiltinHasNoSideEffect(Builtins::Name id) {
+DebugInfo::SideEffectState BuiltinGetSideEffectState(Builtins::Name id) {
   switch (id) {
     // Whitelist for builtins.
     // Object builtins.
@@ -611,6 +555,8 @@ bool BuiltinHasNoSideEffect(Builtins::Name id) {
     case Builtins::kArrayPrototypeEntries:
     case Builtins::kArrayPrototypeFind:
     case Builtins::kArrayPrototypeFindIndex:
+    case Builtins::kArrayPrototypeFlat:
+    case Builtins::kArrayPrototypeFlatMap:
     case Builtins::kArrayPrototypeKeys:
     case Builtins::kArrayPrototypeSlice:
     case Builtins::kArrayForEach:
@@ -852,13 +798,44 @@ bool BuiltinHasNoSideEffect(Builtins::Name id) {
     case Builtins::kMakeSyntaxError:
     case Builtins::kMakeRangeError:
     case Builtins::kMakeURIError:
-      return true;
+    // RegExp builtins.
+    case Builtins::kRegExpConstructor:
+      return DebugInfo::kHasNoSideEffect;
+    // Set builtins.
+    case Builtins::kSetIteratorPrototypeNext:
+    case Builtins::kSetPrototypeAdd:
+    case Builtins::kSetPrototypeClear:
+    case Builtins::kSetPrototypeDelete:
+    // Array builtins.
+    case Builtins::kArrayIteratorPrototypeNext:
+    case Builtins::kArrayPrototypePop:
+    case Builtins::kArrayPrototypePush:
+    case Builtins::kArrayPrototypeShift:
+    case Builtins::kArraySplice:
+    case Builtins::kArrayUnshift:
+    // Map builtins.
+    case Builtins::kMapIteratorPrototypeNext:
+    case Builtins::kMapPrototypeClear:
+    case Builtins::kMapPrototypeDelete:
+    case Builtins::kMapPrototypeSet:
+    // RegExp builtins.
+    case Builtins::kRegExpPrototypeTest:
+    case Builtins::kRegExpPrototypeExec:
+    case Builtins::kRegExpPrototypeSplit:
+    case Builtins::kRegExpPrototypeFlagsGetter:
+    case Builtins::kRegExpPrototypeGlobalGetter:
+    case Builtins::kRegExpPrototypeIgnoreCaseGetter:
+    case Builtins::kRegExpPrototypeMultilineGetter:
+    case Builtins::kRegExpPrototypeDotAllGetter:
+    case Builtins::kRegExpPrototypeUnicodeGetter:
+    case Builtins::kRegExpPrototypeStickyGetter:
+      return DebugInfo::kRequiresRuntimeChecks;
     default:
       if (FLAG_trace_side_effect_free_debug_evaluate) {
         PrintF("[debug-evaluate] built-in %s may cause side effect.\n",
                Builtins::name(id));
       }
-      return false;
+      return DebugInfo::kHasSideEffects;
   }
 }
 
@@ -880,8 +857,8 @@ bool BytecodeRequiresRuntimeCheck(interpreter::Bytecode bytecode) {
 }  // anonymous namespace
 
 // static
-DebugEvaluate::SideEffectState DebugEvaluate::FunctionGetSideEffectState(
-    Handle<SharedFunctionInfo> info) {
+DebugInfo::SideEffectState DebugEvaluate::FunctionGetSideEffectState(
+    Isolate* isolate, Handle<SharedFunctionInfo> info) {
   if (FLAG_trace_side_effect_free_debug_evaluate) {
     PrintF("[debug-evaluate] Checking function %s for side effect.\n",
            info->DebugName()->ToCString().get());
@@ -890,8 +867,10 @@ DebugEvaluate::SideEffectState DebugEvaluate::FunctionGetSideEffectState(
   DCHECK(info->is_compiled());
   if (info->HasBytecodeArray()) {
     // Check bytecodes against whitelist.
-    Handle<BytecodeArray> bytecode_array(info->GetBytecodeArray());
-    if (FLAG_trace_side_effect_free_debug_evaluate) bytecode_array->Print();
+    Handle<BytecodeArray> bytecode_array(info->GetBytecodeArray(), isolate);
+    if (FLAG_trace_side_effect_free_debug_evaluate) {
+      bytecode_array->Print(isolate);
+    }
     bool requires_runtime_checks = false;
     for (interpreter::BytecodeArrayIterator it(bytecode_array); !it.done();
          it.Advance()) {
@@ -903,7 +882,7 @@ DebugEvaluate::SideEffectState DebugEvaluate::FunctionGetSideEffectState(
                 ? it.GetIntrinsicIdOperand(0)
                 : it.GetRuntimeIdOperand(0);
         if (IntrinsicHasNoSideEffect(id)) continue;
-        return kHasSideEffects;
+        return DebugInfo::kHasSideEffects;
       }
 
       if (BytecodeHasNoSideEffect(bytecode)) continue;
@@ -918,24 +897,27 @@ DebugEvaluate::SideEffectState DebugEvaluate::FunctionGetSideEffectState(
       }
 
       // Did not match whitelist.
-      return kHasSideEffects;
+      return DebugInfo::kHasSideEffects;
     }
-    return requires_runtime_checks ? kRequiresRuntimeChecks : kHasNoSideEffect;
+    return requires_runtime_checks ? DebugInfo::kRequiresRuntimeChecks
+                                   : DebugInfo::kHasNoSideEffect;
   } else if (info->IsApiFunction()) {
     if (info->GetCode()->is_builtin()) {
       return info->GetCode()->builtin_index() == Builtins::kHandleApiCall
-                 ? kHasNoSideEffect
-                 : kHasSideEffects;
+                 ? DebugInfo::kHasNoSideEffect
+                 : DebugInfo::kHasSideEffects;
     }
   } else {
     // Check built-ins against whitelist.
     int builtin_index =
         info->HasBuiltinId() ? info->builtin_id() : Builtins::kNoBuiltinId;
     DCHECK_NE(Builtins::kDeserializeLazy, builtin_index);
-    if (Builtins::IsBuiltinId(builtin_index) &&
-        BuiltinHasNoSideEffect(static_cast<Builtins::Name>(builtin_index))) {
+    if (!Builtins::IsBuiltinId(builtin_index))
+      return DebugInfo::kHasSideEffects;
+    DebugInfo::SideEffectState state =
+        BuiltinGetSideEffectState(static_cast<Builtins::Name>(builtin_index));
 #ifdef DEBUG
-      Isolate* isolate = info->GetIsolate();
+    if (state == DebugInfo::kHasNoSideEffect) {
       Code* code = isolate->builtins()->builtin(builtin_index);
       if (code->builtin_index() == Builtins::kDeserializeLazy) {
         // Target builtin is not yet deserialized. Deserialize it now.
@@ -963,12 +945,12 @@ DebugEvaluate::SideEffectState DebugEvaluate::FunctionGetSideEffectState(
         }
         DCHECK(!failed);
       }
-#endif  // DEBUG
-      return kHasNoSideEffect;
     }
+#endif  // DEBUG
+    return state;
   }
 
-  return kHasSideEffects;
+  return DebugInfo::kHasSideEffects;
 }
 
 // static
diff --git a/deps/v8/src/debug/debug-evaluate.h b/deps/v8/src/debug/debug-evaluate.h
index 6cfa5a2e1df0f6..420c6c208b650e 100644
--- a/deps/v8/src/debug/debug-evaluate.h
+++ b/deps/v8/src/debug/debug-evaluate.h
@@ -7,8 +7,10 @@
 
 #include <vector>
 
-#include "src/frames.h"
+#include "src/debug/debug-frames.h"
+#include "src/debug/debug-scopes.h"
 #include "src/objects.h"
+#include "src/objects/shared-function-info.h"
 #include "src/objects/string-table.h"
 
 namespace v8 {
@@ -37,13 +39,8 @@ class DebugEvaluate : public AllStatic {
   static MaybeHandle<Object> WithTopmostArguments(Isolate* isolate,
                                                   Handle<String> source);
 
-  enum SideEffectState {
-    kHasSideEffects,
-    kRequiresRuntimeChecks,
-    kHasNoSideEffect
-  };
-  static SideEffectState FunctionGetSideEffectState(
-      Handle<SharedFunctionInfo> info);
+  static DebugInfo::SideEffectState FunctionGetSideEffectState(
+      Isolate* isolate, Handle<SharedFunctionInfo> info);
   static bool CallbackHasNoSideEffect(Object* callback_info);
   static void ApplySideEffectChecks(Handle<BytecodeArray> bytecode_array);
 
@@ -74,31 +71,20 @@ class DebugEvaluate : public AllStatic {
     void UpdateValues();
 
     Handle<Context> evaluation_context() const { return evaluation_context_; }
-    Handle<SharedFunctionInfo> outer_info() const { return outer_info_; }
+    Handle<SharedFunctionInfo> outer_info() const;
 
    private:
     struct ContextChainElement {
-      Handle<ScopeInfo> scope_info;
       Handle<Context> wrapped_context;
       Handle<JSObject> materialized_object;
       Handle<StringSet> whitelist;
     };
 
-    void MaterializeReceiver(Handle<JSObject> target,
-                             Handle<Context> local_context,
-                             Handle<JSFunction> local_function,
-                             Handle<StringSet> non_locals);
-
-    void MaterializeStackLocals(Handle<JSObject> target,
-                                Handle<JSFunction> function,
-                                FrameInspector* frame_inspector);
-
-    Handle<SharedFunctionInfo> outer_info_;
     Handle<Context> evaluation_context_;
     std::vector<ContextChainElement> context_chain_;
     Isolate* isolate_;
-    JavaScriptFrame* frame_;
-    int inlined_jsframe_index_;
+    FrameInspector frame_inspector_;
+    ScopeIterator scope_iterator_;
   };
 
   static MaybeHandle<Object> Evaluate(Isolate* isolate,
diff --git a/deps/v8/src/debug/debug-frames.cc b/deps/v8/src/debug/debug-frames.cc
index a7426eb96e9455..e474056107348b 100644
--- a/deps/v8/src/debug/debug-frames.cc
+++ b/deps/v8/src/debug/debug-frames.cc
@@ -15,6 +15,7 @@ namespace internal {
 FrameInspector::FrameInspector(StandardFrame* frame, int inlined_frame_index,
                                Isolate* isolate)
     : frame_(frame),
+      inlined_frame_index_(inlined_frame_index),
       isolate_(isolate) {
   // Extract the relevant information from the frame summary and discard it.
   FrameSummary summary = FrameSummary::Get(frame, inlined_frame_index);
@@ -82,97 +83,6 @@ bool FrameInspector::IsWasm() { return frame_->is_wasm(); }
 
 bool FrameInspector::IsJavaScript() { return frame_->is_java_script(); }
 
-// To inspect all the provided arguments the frame might need to be
-// replaced with the arguments frame.
-void FrameInspector::SetArgumentsFrame(StandardFrame* frame) {
-  DCHECK(has_adapted_arguments_);
-  DCHECK(frame->is_arguments_adaptor());
-  frame_ = frame;
-  is_optimized_ = frame_->is_optimized();
-  is_interpreted_ = frame_->is_interpreted();
-  DCHECK(!is_optimized_);
-}
-
-
-// Create a plain JSObject which materializes the local scope for the specified
-// frame.
-void FrameInspector::MaterializeStackLocals(Handle<JSObject> target,
-                                            Handle<ScopeInfo> scope_info,
-                                            bool materialize_arguments_object) {
-  HandleScope scope(isolate_);
-  // First fill all parameters.
-  for (int i = 0; i < scope_info->ParameterCount(); ++i) {
-    // Do not materialize the parameter if it is shadowed by a context local.
-    // TODO(yangguo): check whether this is necessary, now that we materialize
-    //                context locals as well.
-    Handle<String> name(scope_info->ParameterName(i));
-    if (ScopeInfo::VariableIsSynthetic(*name)) continue;
-    if (ParameterIsShadowedByContextLocal(scope_info, name)) continue;
-
-    Handle<Object> value =
-        i < GetParametersCount()
-            ? GetParameter(i)
-            : Handle<Object>::cast(isolate_->factory()->undefined_value());
-    DCHECK(!value->IsTheHole(isolate_));
-
-    JSObject::SetOwnPropertyIgnoreAttributes(target, name, value, NONE).Check();
-  }
-
-  // Second fill all stack locals.
-  for (int i = 0; i < scope_info->StackLocalCount(); ++i) {
-    Handle<String> name(scope_info->StackLocalName(i));
-    if (ScopeInfo::VariableIsSynthetic(*name)) continue;
-    Handle<Object> value = GetExpression(scope_info->StackLocalIndex(i));
-    // TODO(yangguo): We convert optimized out values to {undefined} when they
-    // are passed to the debugger. Eventually we should handle them somehow.
-    if (value->IsTheHole(isolate_)) {
-      value = isolate_->factory()->undefined_value();
-    }
-    if (value->IsOptimizedOut(isolate_)) {
-      if (materialize_arguments_object) {
-        Handle<String> arguments_str = isolate_->factory()->arguments_string();
-        if (String::Equals(name, arguments_str)) continue;
-      }
-      value = isolate_->factory()->undefined_value();
-    }
-    JSObject::SetOwnPropertyIgnoreAttributes(target, name, value, NONE).Check();
-  }
-}
-
-
-void FrameInspector::UpdateStackLocalsFromMaterializedObject(
-    Handle<JSObject> target, Handle<ScopeInfo> scope_info) {
-  // Optimized frames and wasm frames are not supported. Simply give up.
-  if (is_optimized_ || frame_->is_wasm()) return;
-
-  HandleScope scope(isolate_);
-
-  // Parameters.
-  for (int i = 0; i < scope_info->ParameterCount(); ++i) {
-    // Shadowed parameters were not materialized.
-    Handle<String> name(scope_info->ParameterName(i));
-    if (ScopeInfo::VariableIsSynthetic(*name)) continue;
-    if (ParameterIsShadowedByContextLocal(scope_info, name)) continue;
-
-    DCHECK(!javascript_frame()->GetParameter(i)->IsTheHole(isolate_));
-    Handle<Object> value =
-        Object::GetPropertyOrElement(target, name).ToHandleChecked();
-    javascript_frame()->SetParameterValue(i, *value);
-  }
-
-  // Stack locals.
-  for (int i = 0; i < scope_info->StackLocalCount(); ++i) {
-    Handle<String> name(scope_info->StackLocalName(i));
-    if (ScopeInfo::VariableIsSynthetic(*name)) continue;
-    int index = scope_info->StackLocalIndex(i);
-    if (frame_->GetExpression(index)->IsTheHole(isolate_)) continue;
-    Handle<Object> value =
-        Object::GetPropertyOrElement(target, name).ToHandleChecked();
-    frame_->SetExpression(index, *value);
-  }
-}
-
-
 bool FrameInspector::ParameterIsShadowedByContextLocal(
     Handle<ScopeInfo> info, Handle<String> parameter_name) {
   VariableMode mode;
@@ -181,32 +91,5 @@ bool FrameInspector::ParameterIsShadowedByContextLocal(
   return ScopeInfo::ContextSlotIndex(info, parameter_name, &mode, &init_flag,
                                      &maybe_assigned_flag) != -1;
 }
-
-SaveContext* DebugFrameHelper::FindSavedContextForFrame(Isolate* isolate,
-                                                        StandardFrame* frame) {
-  SaveContext* save = isolate->save_context();
-  while (save != nullptr && !save->IsBelowFrame(frame)) {
-    save = save->prev();
-  }
-  DCHECK(save != nullptr);
-  return save;
-}
-
-int DebugFrameHelper::FindIndexedNonNativeFrame(StackTraceFrameIterator* it,
-                                                int index) {
-  int count = -1;
-  for (; !it->done(); it->Advance()) {
-    std::vector<FrameSummary> frames;
-    it->frame()->Summarize(&frames);
-    for (size_t i = frames.size(); i != 0; i--) {
-      // Omit functions from native and extension scripts.
-      if (!frames[i - 1].is_subject_to_debugging()) continue;
-      if (++count == index) return static_cast<int>(i) - 1;
-    }
-  }
-  return -1;
-}
-
-
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/src/debug/debug-frames.h b/deps/v8/src/debug/debug-frames.h
index 6b4f8c23f6a95e..6a613dbae911dd 100644
--- a/deps/v8/src/debug/debug-frames.h
+++ b/deps/v8/src/debug/debug-frames.h
@@ -22,7 +22,7 @@ class FrameInspector {
   ~FrameInspector();
 
   int GetParametersCount();
-  Handle<JSFunction> GetFunction() { return function_; }
+  Handle<JSFunction> GetFunction() const { return function_; }
   Handle<Script> GetScript() { return script_; }
   Handle<Object> GetParameter(int index);
   Handle<Object> GetExpression(int index);
@@ -41,21 +41,14 @@ class FrameInspector {
                                           : JavaScriptFrame::cast(frame_);
   }
 
-  JavaScriptFrame* GetArgumentsFrame() { return javascript_frame(); }
-  void SetArgumentsFrame(StandardFrame* frame);
-
-  void MaterializeStackLocals(Handle<JSObject> target,
-                              Handle<ScopeInfo> scope_info,
-                              bool materialize_arguments_object = false);
-
-  void UpdateStackLocalsFromMaterializedObject(Handle<JSObject> object,
-                                               Handle<ScopeInfo> scope_info);
+  int inlined_frame_index() const { return inlined_frame_index_; }
 
  private:
   bool ParameterIsShadowedByContextLocal(Handle<ScopeInfo> info,
                                          Handle<String> parameter_name);
 
   StandardFrame* frame_;
+  int inlined_frame_index_;
   std::unique_ptr<DeoptimizedFrameInfo> deoptimized_frame_;
   wasm::WasmInterpreter::FramePtr wasm_interpreted_frame_;
   Isolate* isolate_;
@@ -71,27 +64,6 @@ class FrameInspector {
 
   DISALLOW_COPY_AND_ASSIGN(FrameInspector);
 };
-
-
-class DebugFrameHelper : public AllStatic {
- public:
-  static SaveContext* FindSavedContextForFrame(Isolate* isolate,
-                                               StandardFrame* frame);
-  // Advances the iterator to the frame that matches the index and returns the
-  // inlined frame index, or -1 if not found.  Skips native JS functions.
-  static int FindIndexedNonNativeFrame(StackTraceFrameIterator* it, int index);
-
-  // Helper functions for wrapping and unwrapping stack frame ids.
-  static Smi* WrapFrameId(StackFrame::Id id) {
-    DCHECK(IsAligned(OffsetFrom(id), static_cast<intptr_t>(4)));
-    return Smi::FromInt(id >> 2);
-  }
-
-  static StackFrame::Id UnwrapFrameId(int wrapped) {
-    return static_cast<StackFrame::Id>(wrapped << 2);
-  }
-};
-
 }  // namespace internal
 }  // namespace v8
 
diff --git a/deps/v8/src/debug/debug-interface.h b/deps/v8/src/debug/debug-interface.h
index ec1a693550237a..ac8073e02c793a 100644
--- a/deps/v8/src/debug/debug-interface.h
+++ b/deps/v8/src/debug/debug-interface.h
@@ -21,6 +21,7 @@ struct CoverageScript;
 struct TypeProfileEntry;
 struct TypeProfileScript;
 class Coverage;
+class PostponeInterruptsScope;
 class Script;
 class TypeProfile;
 }  // namespace internal
@@ -33,51 +34,13 @@ int GetContextId(Local<Context> context);
 void SetInspector(Isolate* isolate, v8_inspector::V8Inspector*);
 v8_inspector::V8Inspector* GetInspector(Isolate* isolate);
 
-/**
- * Debugger is running in its own context which is entered while debugger
- * messages are being dispatched. This is an explicit getter for this
- * debugger context. Note that the content of the debugger context is subject
- * to change. The Context exists only when the debugger is active, i.e. at
- * least one DebugEventListener or MessageHandler is set.
- */
-Local<Context> GetDebugContext(Isolate* isolate);
-
-/**
- * Run a JavaScript function in the debugger.
- * \param fun the function to call
- * \param data passed as second argument to the function
- * With this call the debugger is entered and the function specified is called
- * with the execution state as the first argument. This makes it possible to
- * get access to information otherwise not available during normal JavaScript
- * execution e.g. details on stack frames. Receiver of the function call will
- * be the debugger context global object, however this is a subject to change.
- * The following example shows a JavaScript function which when passed to
- * v8::Debug::Call will return the current line of JavaScript execution.
- *
- * \code
- *   function frame_source_line(exec_state) {
- *     return exec_state.frame(0).sourceLine();
- *   }
- * \endcode
- */
-// TODO(dcarney): data arg should be a MaybeLocal
-MaybeLocal<Value> Call(Local<Context> context, v8::Local<v8::Function> fun,
-                       Local<Value> data = Local<Value>());
-
-/**
- * Enable/disable LiveEdit functionality for the given Isolate
- * (default Isolate if not provided). V8 will abort if LiveEdit is
- * unexpectedly used. LiveEdit is enabled by default.
- */
-V8_EXPORT_PRIVATE void SetLiveEditEnabled(Isolate* isolate, bool enable);
-
-// Schedule a debugger break to happen when JavaScript code is run
-// in the given isolate.
-void DebugBreak(Isolate* isolate);
+// Schedule a debugger break to happen when function is called inside given
+// isolate.
+void SetBreakOnNextFunctionCall(Isolate* isolate);
 
 // Remove scheduled debugger break in given isolate if it has not
 // happened yet.
-void CancelDebugBreak(Isolate* isolate);
+void ClearBreakOnNextFunctionCall(Isolate* isolate);
 
 /**
  * Returns array of internal properties specific to the value type. Result has
@@ -116,18 +79,28 @@ void BreakRightNow(Isolate* isolate);
 
 bool AllFramesOnStackAreBlackboxed(Isolate* isolate);
 
-/**
- * Out-of-memory callback function.
- * The function is invoked when the heap size is close to the hard limit.
- *
- * \param data the parameter provided during callback installation.
- */
-typedef void (*OutOfMemoryCallback)(void* data);
+class Script;
 
-V8_DEPRECATED("Use v8::Isolate::AddNearHeapLimitCallback",
-              void SetOutOfMemoryCallback(Isolate* isolate,
-                                          OutOfMemoryCallback callback,
-                                          void* data));
+struct LiveEditResult {
+  enum Status {
+    OK,
+    COMPILE_ERROR,
+    BLOCKED_BY_RUNNING_GENERATOR,
+    BLOCKED_BY_FUNCTION_ABOVE_BREAK_FRAME,
+    BLOCKED_BY_FUNCTION_BELOW_NON_DROPPABLE_FRAME,
+    BLOCKED_BY_ACTIVE_FUNCTION,
+    BLOCKED_BY_NEW_TARGET_IN_RESTART_FRAME,
+    FRAME_RESTART_IS_NOT_SUPPORTED
+  };
+  Status status = OK;
+  bool stack_changed = false;
+  // Available only for OK.
+  v8::Local<v8::debug::Script> script;
+  // Fields below are available only for COMPILE_ERROR.
+  v8::Local<v8::String> message;
+  int line_number = -1;
+  int column_number = -1;
+};
 
 /**
  * Native wrapper around v8::internal::Script object.
@@ -157,7 +130,7 @@ class V8_EXPORT_PRIVATE Script {
   int GetSourceOffset(const debug::Location& location) const;
   v8::debug::Location GetSourceLocation(int offset) const;
   bool SetScriptSource(v8::Local<v8::String> newSource, bool preview,
-                       bool* stack_changed) const;
+                       LiveEditResult* result) const;
   bool SetBreakpoint(v8::Local<v8::String> condition, debug::Location* location,
                      BreakpointId* id) const;
 };
@@ -184,17 +157,14 @@ MaybeLocal<UnboundScript> CompileInspectorScript(Isolate* isolate,
 class DebugDelegate {
  public:
   virtual ~DebugDelegate() {}
-  virtual void PromiseEventOccurred(debug::PromiseDebugActionType type, int id,
-                                    bool is_blackboxed) {}
   virtual void ScriptCompiled(v8::Local<Script> script, bool is_live_edited,
                               bool has_compile_error) {}
   // |inspector_break_points_hit| contains id of breakpoints installed with
   // debug::Script::SetBreakpoint API.
   virtual void BreakProgramRequested(
-      v8::Local<v8::Context> paused_context, v8::Local<v8::Object> exec_state,
+      v8::Local<v8::Context> paused_context,
       const std::vector<debug::BreakpointId>& inspector_break_points_hit) {}
   virtual void ExceptionThrown(v8::Local<v8::Context> paused_context,
-                               v8::Local<v8::Object> exec_state,
                                v8::Local<v8::Value> exception,
                                v8::Local<v8::Value> promise, bool is_uncaught) {
   }
@@ -207,6 +177,15 @@ class DebugDelegate {
 
 void SetDebugDelegate(Isolate* isolate, DebugDelegate* listener);
 
+class AsyncEventDelegate {
+ public:
+  virtual ~AsyncEventDelegate() {}
+  virtual void AsyncEventOccurred(debug::DebugAsyncActionType type, int id,
+                                  bool is_blackboxed) = 0;
+};
+
+void SetAsyncEventDelegate(Isolate* isolate, AsyncEventDelegate* delegate);
+
 void ResetBlackboxedStateCache(Isolate* isolate,
                                v8::Local<debug::Script> script);
 
@@ -435,7 +414,9 @@ class ScopeIterator {
   virtual void Advance() = 0;
   virtual ScopeType GetType() = 0;
   virtual v8::Local<v8::Object> GetObject() = 0;
-  virtual v8::Local<v8::Function> GetFunction() = 0;
+  virtual v8::Local<v8::Value> GetFunctionDebugName() = 0;
+  virtual int GetScriptId() = 0;
+  virtual bool HasLocationInfo() = 0;
   virtual debug::Location GetStartLocation() = 0;
   virtual debug::Location GetEndLocation() = 0;
 
@@ -459,7 +440,7 @@ class StackTraceIterator {
   virtual int GetContextId() const = 0;
   virtual v8::MaybeLocal<v8::Value> GetReceiver() const = 0;
   virtual v8::Local<v8::Value> GetReturnValue() const = 0;
-  virtual v8::Local<v8::String> GetFunctionName() const = 0;
+  virtual v8::Local<v8::String> GetFunctionDebugName() const = 0;
   virtual v8::Local<v8::debug::Script> GetScript() const = 0;
   virtual debug::Location GetSourceLocation() const = 0;
   virtual v8::Local<v8::Function> GetFunction() const = 0;
@@ -510,6 +491,17 @@ int GetDebuggingId(v8::Local<v8::Function> function);
 bool SetFunctionBreakpoint(v8::Local<v8::Function> function,
                            v8::Local<v8::String> condition, BreakpointId* id);
 
+v8::Platform* GetCurrentPlatform();
+
+class PostponeInterruptsScope {
+ public:
+  explicit PostponeInterruptsScope(v8::Isolate* isolate);
+  ~PostponeInterruptsScope();
+
+ private:
+  std::unique_ptr<i::PostponeInterruptsScope> scope_;
+};
+
 }  // namespace debug
 }  // namespace v8
 
diff --git a/deps/v8/src/debug/debug-scope-iterator.cc b/deps/v8/src/debug/debug-scope-iterator.cc
index 9d843ed17ee2fd..dbade081cbb888 100644
--- a/deps/v8/src/debug/debug-scope-iterator.cc
+++ b/deps/v8/src/debug/debug-scope-iterator.cc
@@ -75,26 +75,8 @@ void DebugScopeIterator::Advance() {
 }
 
 bool DebugScopeIterator::ShouldIgnore() {
-  // Almost always Script scope will be empty, so just filter out that noise.
-  // Also drop empty Block, Eval and Script scopes, should we get any.
-  DCHECK(!Done());
-  debug::ScopeIterator::ScopeType type = GetType();
-  if (type != debug::ScopeIterator::ScopeTypeBlock &&
-      type != debug::ScopeIterator::ScopeTypeScript &&
-      type != debug::ScopeIterator::ScopeTypeEval &&
-      type != debug::ScopeIterator::ScopeTypeModule) {
-    return false;
-  }
-
-  // TODO(kozyatinskiy): make this function faster.
-  Handle<JSObject> value;
-  if (!iterator_.ScopeObject().ToHandle(&value)) return false;
-  Handle<FixedArray> keys =
-      KeyAccumulator::GetKeys(value, KeyCollectionMode::kOwnOnly,
-                              ENUMERABLE_STRINGS,
-                              GetKeysConversion::kConvertToString)
-          .ToHandleChecked();
-  return keys->length() == 0;
+  if (GetType() == debug::ScopeIterator::ScopeTypeLocal) return false;
+  return !iterator_.DeclaresLocals(i::ScopeIterator::Mode::ALL);
 }
 
 v8::debug::ScopeIterator::ScopeType DebugScopeIterator::GetType() {
@@ -104,37 +86,34 @@ v8::debug::ScopeIterator::ScopeType DebugScopeIterator::GetType() {
 
 v8::Local<v8::Object> DebugScopeIterator::GetObject() {
   DCHECK(!Done());
-  Handle<JSObject> value;
-  if (iterator_.ScopeObject().ToHandle(&value)) {
-    return Utils::ToLocal(value);
-  }
-  return v8::Local<v8::Object>();
+  Handle<JSObject> value = iterator_.ScopeObject(i::ScopeIterator::Mode::ALL);
+  return Utils::ToLocal(value);
+}
+
+int DebugScopeIterator::GetScriptId() {
+  DCHECK(!Done());
+  return iterator_.GetScript()->id();
 }
 
-v8::Local<v8::Function> DebugScopeIterator::GetFunction() {
+v8::Local<v8::Value> DebugScopeIterator::GetFunctionDebugName() {
   DCHECK(!Done());
-  Handle<JSFunction> closure = iterator_.GetClosure();
-  if (closure.is_null()) return v8::Local<v8::Function>();
-  return Utils::ToLocal(closure);
+  Handle<Object> name = iterator_.GetFunctionDebugName();
+  return Utils::ToLocal(name);
+}
+
+bool DebugScopeIterator::HasLocationInfo() {
+  return iterator_.HasPositionInfo();
 }
 
 debug::Location DebugScopeIterator::GetStartLocation() {
   DCHECK(!Done());
-  Handle<JSFunction> closure = iterator_.GetClosure();
-  if (closure.is_null()) return debug::Location();
-  Object* obj = closure->shared()->script();
-  if (!obj->IsScript()) return debug::Location();
-  return ToApiHandle<v8::debug::Script>(handle(Script::cast(obj)))
+  return ToApiHandle<v8::debug::Script>(iterator_.GetScript())
       ->GetSourceLocation(iterator_.start_position());
 }
 
 debug::Location DebugScopeIterator::GetEndLocation() {
   DCHECK(!Done());
-  Handle<JSFunction> closure = iterator_.GetClosure();
-  if (closure.is_null()) return debug::Location();
-  Object* obj = closure->shared()->script();
-  if (!obj->IsScript()) return debug::Location();
-  return ToApiHandle<v8::debug::Script>(handle(Script::cast(obj)))
+  return ToApiHandle<v8::debug::Script>(iterator_.GetScript())
       ->GetSourceLocation(iterator_.end_position());
 }
 
@@ -190,11 +169,18 @@ v8::Local<v8::Object> DebugWasmScopeIterator::GetObject() {
   return v8::Local<v8::Object>();
 }
 
-v8::Local<v8::Function> DebugWasmScopeIterator::GetFunction() {
+int DebugWasmScopeIterator::GetScriptId() {
+  DCHECK(!Done());
+  return -1;
+}
+
+v8::Local<v8::Value> DebugWasmScopeIterator::GetFunctionDebugName() {
   DCHECK(!Done());
-  return v8::Local<v8::Function>();
+  return Utils::ToLocal(isolate_->factory()->empty_string());
 }
 
+bool DebugWasmScopeIterator::HasLocationInfo() { return false; }
+
 debug::Location DebugWasmScopeIterator::GetStartLocation() {
   DCHECK(!Done());
   return debug::Location();
diff --git a/deps/v8/src/debug/debug-scope-iterator.h b/deps/v8/src/debug/debug-scope-iterator.h
index 7500272535d567..912d6858fd6c8b 100644
--- a/deps/v8/src/debug/debug-scope-iterator.h
+++ b/deps/v8/src/debug/debug-scope-iterator.h
@@ -23,7 +23,9 @@ class DebugScopeIterator final : public debug::ScopeIterator {
   void Advance() override;
   ScopeType GetType() override;
   v8::Local<v8::Object> GetObject() override;
-  v8::Local<v8::Function> GetFunction() override;
+  v8::Local<v8::Value> GetFunctionDebugName() override;
+  int GetScriptId() override;
+  bool HasLocationInfo() override;
   debug::Location GetStartLocation() override;
   debug::Location GetEndLocation() override;
 
@@ -45,13 +47,14 @@ class DebugWasmScopeIterator final : public debug::ScopeIterator {
   void Advance() override;
   ScopeType GetType() override;
   v8::Local<v8::Object> GetObject() override;
-  v8::Local<v8::Function> GetFunction() override;
+  v8::Local<v8::Value> GetFunctionDebugName() override;
+  int GetScriptId() override;
+  bool HasLocationInfo() override;
   debug::Location GetStartLocation() override;
   debug::Location GetEndLocation() override;
 
   bool SetVariableValue(v8::Local<v8::String> name,
                         v8::Local<v8::Value> value) override;
-
  private:
   Isolate* isolate_;
   StandardFrame* frame_;
diff --git a/deps/v8/src/debug/debug-scopes.cc b/deps/v8/src/debug/debug-scopes.cc
index fa93341e9118fb..104bf2a8a5c0ef 100644
--- a/deps/v8/src/debug/debug-scopes.cc
+++ b/deps/v8/src/debug/debug-scopes.cc
@@ -12,6 +12,7 @@
 #include "src/frames-inl.h"
 #include "src/globals.h"
 #include "src/isolate-inl.h"
+#include "src/objects/module.h"
 #include "src/parsing/parse-info.h"
 #include "src/parsing/parsing.h"
 #include "src/parsing/rewriter.h"
@@ -23,49 +24,89 @@ ScopeIterator::ScopeIterator(Isolate* isolate, FrameInspector* frame_inspector,
                              ScopeIterator::Option option)
     : isolate_(isolate),
       frame_inspector_(frame_inspector),
-      seen_script_scope_(false) {
+      function_(frame_inspector_->GetFunction()),
+      script_(frame_inspector_->GetScript()) {
   if (!frame_inspector->GetContext()->IsContext()) {
     // Optimized frame, context or function cannot be materialized. Give up.
     return;
   }
+  context_ = Handle<Context>::cast(frame_inspector->GetContext());
 
   // We should not instantiate a ScopeIterator for wasm frames.
-  DCHECK(frame_inspector->GetScript()->type() != Script::TYPE_WASM);
+  DCHECK_NE(Script::TYPE_WASM, frame_inspector->GetScript()->type());
 
   TryParseAndRetrieveScopes(option);
 }
 
-void ScopeIterator::TryParseAndRetrieveScopes(ScopeIterator::Option option) {
-  context_ = GetContext();
+ScopeIterator::~ScopeIterator() { delete info_; }
+
+Handle<Object> ScopeIterator::GetFunctionDebugName() const {
+  if (!function_.is_null()) return JSFunction::GetDebugName(function_);
+
+  if (!context_->IsNativeContext()) {
+    DisallowHeapAllocation no_gc;
+    ScopeInfo* closure_info = context_->closure_context()->scope_info();
+    Handle<String> debug_name(closure_info->FunctionDebugName(), isolate_);
+    if (debug_name->length() > 0) return debug_name;
+  }
+  return isolate_->factory()->undefined_value();
+}
+
+ScopeIterator::ScopeIterator(Isolate* isolate, Handle<JSFunction> function)
+    : isolate_(isolate),
+      context_(function->context(), isolate),
+      script_(Script::cast(function->shared()->script()), isolate) {
+  if (!function->shared()->IsSubjectToDebugging()) {
+    context_ = Handle<Context>();
+    return;
+  }
+  UnwrapEvaluationContext();
+}
+
+ScopeIterator::ScopeIterator(Isolate* isolate,
+                             Handle<JSGeneratorObject> generator)
+    : isolate_(isolate),
+      generator_(generator),
+      function_(generator->function(), isolate),
+      context_(generator->context(), isolate),
+      script_(Script::cast(function_->shared()->script()), isolate) {
+  if (!function_->shared()->IsSubjectToDebugging()) {
+    context_ = Handle<Context>();
+    return;
+  }
+  TryParseAndRetrieveScopes(DEFAULT);
+}
 
+void ScopeIterator::Restart() {
+  DCHECK_NOT_NULL(frame_inspector_);
+  function_ = frame_inspector_->GetFunction();
+  context_ = Handle<Context>::cast(frame_inspector_->GetContext());
+  current_scope_ = start_scope_;
+  DCHECK_NOT_NULL(current_scope_);
+  UnwrapEvaluationContext();
+}
+
+void ScopeIterator::TryParseAndRetrieveScopes(ScopeIterator::Option option) {
   // Catch the case when the debugger stops in an internal function.
-  Handle<JSFunction> function = GetFunction();
-  Handle<SharedFunctionInfo> shared_info(function->shared());
-  Handle<ScopeInfo> scope_info(shared_info->scope_info());
+  Handle<SharedFunctionInfo> shared_info(function_->shared(), isolate_);
+  Handle<ScopeInfo> scope_info(shared_info->scope_info(), isolate_);
   if (shared_info->script()->IsUndefined(isolate_)) {
-    while (context_->closure() == *function) {
-      context_ = Handle<Context>(context_->previous(), isolate_);
-    }
+    current_scope_ = closure_scope_ = nullptr;
+    context_ = handle(function_->context(), isolate_);
+    function_ = Handle<JSFunction>();
     return;
   }
 
-  // Currently it takes too much time to find nested scopes due to script
-  // parsing. Sometimes we want to run the ScopeIterator as fast as possible
-  // (for example, while collecting async call stacks on every
-  // addEventListener call), even if we drop some nested scopes.
-  // Later we may optimize getting the nested scopes (cache the result?)
-  // and include nested scopes into the "fast" iteration case as well.
-  bool ignore_nested_scopes = (option == IGNORE_NESTED_SCOPES);
-  bool collect_non_locals = (option == COLLECT_NON_LOCALS);
-  if (!ignore_nested_scopes && shared_info->HasBreakInfo() &&
-      frame_inspector_ != nullptr) {
+  DCHECK_NE(IGNORE_NESTED_SCOPES, option);
+  bool ignore_nested_scopes = false;
+  if (shared_info->HasBreakInfo() && frame_inspector_ != nullptr) {
     // The source position at return is always the end of the function,
     // which is not consistent with the current scope chain. Therefore all
     // nested with, catch and block contexts are skipped, and we can only
     // inspect the function scope.
     // This can only happen if we set a break point inside right before the
     // return, which requires a debug info to be available.
-    Handle<DebugInfo> debug_info(shared_info->GetDebugInfo());
+    Handle<DebugInfo> debug_info(shared_info->GetDebugInfo(), isolate_);
 
     // Find the break point where execution has stopped.
     BreakLocation location = BreakLocation::FromFrame(debug_info, GetFrame());
@@ -73,59 +114,52 @@ void ScopeIterator::TryParseAndRetrieveScopes(ScopeIterator::Option option) {
     ignore_nested_scopes = location.IsReturn();
   }
 
-  if (ignore_nested_scopes) {
-    if (scope_info->HasContext()) {
-      context_ = Handle<Context>(context_->declaration_context(), isolate_);
-    } else {
-      while (context_->closure() == *function) {
-        context_ = Handle<Context>(context_->previous(), isolate_);
-      }
-    }
-    if (scope_info->scope_type() == FUNCTION_SCOPE) {
-      nested_scope_chain_.emplace_back(scope_info, shared_info->StartPosition(),
-                                       shared_info->EndPosition());
-    }
-    if (!collect_non_locals) return;
-  }
-
   // Reparse the code and analyze the scopes.
   // Check whether we are in global, eval or function code.
-  std::unique_ptr<ParseInfo> info;
-  if (scope_info->scope_type() != FUNCTION_SCOPE) {
+  if (scope_info->scope_type() == FUNCTION_SCOPE) {
+    // Inner function.
+    info_ = new ParseInfo(isolate_, shared_info);
+  } else {
     // Global or eval code.
-    Handle<Script> script(Script::cast(shared_info->script()));
-    info.reset(new ParseInfo(script));
+    Handle<Script> script(Script::cast(shared_info->script()), isolate_);
+    info_ = new ParseInfo(isolate_, script);
     if (scope_info->scope_type() == EVAL_SCOPE) {
-      info->set_eval();
-      if (!function->context()->IsNativeContext()) {
-        info->set_outer_scope_info(handle(function->context()->scope_info()));
+      info_->set_eval();
+      if (!context_->IsNativeContext()) {
+        info_->set_outer_scope_info(handle(context_->scope_info(), isolate_));
       }
       // Language mode may be inherited from the eval caller.
       // Retrieve it from shared function info.
-      info->set_language_mode(shared_info->language_mode());
+      info_->set_language_mode(shared_info->language_mode());
     } else if (scope_info->scope_type() == MODULE_SCOPE) {
-      DCHECK(info->is_module());
+      DCHECK(info_->is_module());
     } else {
-      DCHECK(scope_info->scope_type() == SCRIPT_SCOPE);
+      DCHECK_EQ(SCRIPT_SCOPE, scope_info->scope_type());
     }
-  } else {
-    // Inner function.
-    info.reset(new ParseInfo(shared_info));
-  }
-  if (parsing::ParseAny(info.get(), shared_info, isolate_) &&
-      Rewriter::Rewrite(info.get())) {
-    info->ast_value_factory()->Internalize(isolate_);
-    DeclarationScope* scope = info->literal()->scope();
-    if (!ignore_nested_scopes || collect_non_locals) {
-      CollectNonLocals(info.get(), scope);
+  }
+
+  if (parsing::ParseAny(info_, shared_info, isolate_) &&
+      Rewriter::Rewrite(info_)) {
+    info_->ast_value_factory()->Internalize(isolate_);
+    closure_scope_ = info_->literal()->scope();
+
+    if (option == COLLECT_NON_LOCALS) {
+      DCHECK(non_locals_.is_null());
+      non_locals_ = info_->literal()->scope()->CollectNonLocals(
+          isolate_, info_, StringSet::New(isolate_));
     }
-    if (!ignore_nested_scopes) {
-      if (DeclarationScope::Analyze(info.get())) {
-        DeclarationScope::AllocateScopeInfos(info.get(), isolate_,
-                                             AnalyzeMode::kDebugger);
-        RetrieveScopeChain(scope);
+
+    CHECK(DeclarationScope::Analyze(info_));
+    if (ignore_nested_scopes) {
+      current_scope_ = closure_scope_;
+      start_scope_ = current_scope_;
+      if (closure_scope_->NeedsContext()) {
+        context_ = handle(context_->closure_context(), isolate_);
       }
+    } else {
+      RetrieveScopeChain(closure_scope_);
     }
+    UnwrapEvaluationContext();
   } else {
     // A failed reparse indicates that the preparser has diverged from the
     // parser or that the preparse data given to the initial parse has been
@@ -138,159 +172,156 @@ void ScopeIterator::TryParseAndRetrieveScopes(ScopeIterator::Option option) {
     isolate_->clear_pending_exception();
     context_ = Handle<Context>();
   }
-  UnwrapEvaluationContext();
-}
-
-ScopeIterator::ScopeIterator(Isolate* isolate, Handle<JSFunction> function)
-    : isolate_(isolate),
-      context_(function->context()),
-      seen_script_scope_(false) {
-  if (!function->shared()->IsSubjectToDebugging()) context_ = Handle<Context>();
-  UnwrapEvaluationContext();
-}
-
-ScopeIterator::ScopeIterator(Isolate* isolate,
-                             Handle<JSGeneratorObject> generator)
-    : isolate_(isolate),
-      generator_(generator),
-      context_(generator->context()),
-      seen_script_scope_(false) {
-  if (!generator->function()->shared()->IsSubjectToDebugging()) {
-    context_ = Handle<Context>();
-    return;
-  }
-  TryParseAndRetrieveScopes(DEFAULT);
 }
 
 void ScopeIterator::UnwrapEvaluationContext() {
-  while (true) {
-    if (context_.is_null()) return;
-    if (!context_->IsDebugEvaluateContext()) return;
-    Handle<Object> wrapped(context_->get(Context::WRAPPED_CONTEXT_INDEX),
-                           isolate_);
+  if (!context_->IsDebugEvaluateContext()) return;
+  Context* current = *context_;
+  do {
+    Object* wrapped = current->get(Context::WRAPPED_CONTEXT_INDEX);
     if (wrapped->IsContext()) {
-      context_ = Handle<Context>::cast(wrapped);
+      current = Context::cast(wrapped);
     } else {
-      context_ = Handle<Context>(context_->previous(), isolate_);
+      DCHECK_NOT_NULL(current->previous());
+      current = current->previous();
     }
-  }
+  } while (current->IsDebugEvaluateContext());
+  context_ = handle(current, isolate_);
 }
 
-V8_WARN_UNUSED_RESULT MaybeHandle<JSObject>
-ScopeIterator::MaterializeScopeDetails() {
+Handle<JSObject> ScopeIterator::MaterializeScopeDetails() {
   // Calculate the size of the result.
   Handle<FixedArray> details =
       isolate_->factory()->NewFixedArray(kScopeDetailsSize);
   // Fill in scope details.
   details->set(kScopeDetailsTypeIndex, Smi::FromInt(Type()));
-  Handle<JSObject> scope_object;
-  ASSIGN_RETURN_ON_EXCEPTION(isolate_, scope_object, ScopeObject(), JSObject);
+  Handle<JSObject> scope_object = ScopeObject(Mode::ALL);
   details->set(kScopeDetailsObjectIndex, *scope_object);
   if (Type() == ScopeTypeGlobal || Type() == ScopeTypeScript) {
     return isolate_->factory()->NewJSArrayWithElements(details);
-  }
-
-  Handle<JSFunction> js_function = GetClosure();
-  if (!js_function.is_null()) {
-    Handle<String> closure_name = JSFunction::GetDebugName(js_function);
-    if (!closure_name.is_null() && closure_name->length() != 0) {
-      details->set(kScopeDetailsNameIndex, *closure_name);
-    }
+  } else if (HasContext()) {
+    Handle<Object> closure_name = GetFunctionDebugName();
+    details->set(kScopeDetailsNameIndex, *closure_name);
     details->set(kScopeDetailsStartPositionIndex,
                  Smi::FromInt(start_position()));
     details->set(kScopeDetailsEndPositionIndex, Smi::FromInt(end_position()));
-    details->set(kScopeDetailsFunctionIndex, *js_function);
+    if (InInnerScope()) {
+      details->set(kScopeDetailsFunctionIndex, *function_);
+    }
   }
   return isolate_->factory()->NewJSArrayWithElements(details);
 }
 
-Handle<JSFunction> ScopeIterator::GetClosure() {
-  if (Type() == ScopeTypeGlobal || Type() == ScopeTypeScript)
-    return Handle<JSFunction>::null();
-  if (HasNestedScopeChain()) return GetFunction();
-  return HasContext() ? handle(CurrentContext()->closure())
-                      : Handle<JSFunction>::null();
+bool ScopeIterator::HasPositionInfo() {
+  return InInnerScope() || !context_->IsNativeContext();
 }
 
 int ScopeIterator::start_position() {
-  if (HasNestedScopeChain()) {
-    return LastNestedScopeChain().start_position;
-  }
-  if (!HasContext()) return 0;
-  Handle<JSFunction> js_function = handle(CurrentContext()->closure());
-  return js_function.is_null() ? 0 : js_function->shared()->StartPosition();
+  if (InInnerScope()) return current_scope_->start_position();
+  if (context_->IsNativeContext()) return 0;
+  return context_->closure_context()->scope_info()->StartPosition();
 }
 
 int ScopeIterator::end_position() {
-  if (HasNestedScopeChain()) {
-    return LastNestedScopeChain().end_position;
-  }
-  if (!HasContext()) return 0;
-  Handle<JSFunction> js_function = handle(CurrentContext()->closure());
-  return js_function.is_null() ? 0 : js_function->shared()->EndPosition();
+  if (InInnerScope()) return current_scope_->end_position();
+  if (context_->IsNativeContext()) return 0;
+  return context_->closure_context()->scope_info()->EndPosition();
+}
+
+bool ScopeIterator::DeclaresLocals(Mode mode) const {
+  ScopeType type = Type();
+
+  if (type == ScopeTypeWith) return mode == Mode::ALL;
+  if (type == ScopeTypeGlobal) return mode == Mode::ALL;
+
+  bool declares_local = false;
+  auto visitor = [&](Handle<String> name, Handle<Object> value) {
+    declares_local = true;
+    return true;
+  };
+  VisitScope(visitor, mode);
+  return declares_local;
+}
+
+bool ScopeIterator::HasContext() const {
+  return !InInnerScope() || current_scope_->NeedsContext();
 }
 
 void ScopeIterator::Next() {
   DCHECK(!Done());
+
   ScopeType scope_type = Type();
+
   if (scope_type == ScopeTypeGlobal) {
     // The global scope is always the last in the chain.
     DCHECK(context_->IsNativeContext());
     context_ = Handle<Context>();
-  } else if (scope_type == ScopeTypeScript) {
+    DCHECK(Done());
+    return;
+  }
+
+  bool inner = InInnerScope();
+  if (current_scope_ == closure_scope_) function_ = Handle<JSFunction>();
+
+  if (scope_type == ScopeTypeScript) {
+    DCHECK_IMPLIES(InInnerScope(), current_scope_->is_script_scope());
     seen_script_scope_ = true;
     if (context_->IsScriptContext()) {
-      context_ = Handle<Context>(context_->previous(), isolate_);
-    }
-    if (HasNestedScopeChain()) {
-      DCHECK_EQ(LastNestedScopeChain().scope_info->scope_type(), SCRIPT_SCOPE);
-      nested_scope_chain_.pop_back();
-      DCHECK(!HasNestedScopeChain());
+      context_ = handle(context_->previous(), isolate_);
     }
-    CHECK(context_->IsNativeContext());
-  } else if (!HasNestedScopeChain()) {
-    context_ = Handle<Context>(context_->previous(), isolate_);
+  } else if (!inner) {
+    DCHECK(!context_->IsNativeContext());
+    context_ = handle(context_->previous(), isolate_);
   } else {
+    DCHECK_NOT_NULL(current_scope_);
     do {
-      if (LastNestedScopeChain().scope_info->HasContext()) {
-        DCHECK(context_->previous() != nullptr);
-        context_ = Handle<Context>(context_->previous(), isolate_);
+      if (current_scope_->NeedsContext()) {
+        DCHECK_NOT_NULL(context_->previous());
+        context_ = handle(context_->previous(), isolate_);
       }
-      nested_scope_chain_.pop_back();
-      if (!HasNestedScopeChain()) break;
+      DCHECK_IMPLIES(InInnerScope(), current_scope_->outer_scope() != nullptr);
+      current_scope_ = current_scope_->outer_scope();
       // Repeat to skip hidden scopes.
-    } while (LastNestedScopeChain().is_hidden());
+    } while (current_scope_->is_hidden());
   }
+
   UnwrapEvaluationContext();
 }
 
 
 // Return the type of the current scope.
-ScopeIterator::ScopeType ScopeIterator::Type() {
+ScopeIterator::ScopeType ScopeIterator::Type() const {
   DCHECK(!Done());
-  if (HasNestedScopeChain()) {
-    Handle<ScopeInfo> scope_info = LastNestedScopeChain().scope_info;
-    switch (scope_info->scope_type()) {
+  if (InInnerScope()) {
+    switch (current_scope_->scope_type()) {
       case FUNCTION_SCOPE:
-        DCHECK(context_->IsFunctionContext() || !scope_info->HasContext());
+        DCHECK_IMPLIES(current_scope_->NeedsContext(),
+                       context_->IsFunctionContext());
         return ScopeTypeLocal;
       case MODULE_SCOPE:
-        DCHECK(context_->IsModuleContext());
+        DCHECK_IMPLIES(current_scope_->NeedsContext(),
+                       context_->IsModuleContext());
         return ScopeTypeModule;
       case SCRIPT_SCOPE:
-        DCHECK(context_->IsScriptContext() || context_->IsNativeContext());
+        DCHECK_IMPLIES(
+            current_scope_->NeedsContext(),
+            context_->IsScriptContext() || context_->IsNativeContext());
         return ScopeTypeScript;
       case WITH_SCOPE:
-        DCHECK(context_->IsWithContext() || context_->IsDebugEvaluateContext());
+        DCHECK_IMPLIES(
+            current_scope_->NeedsContext(),
+            context_->IsWithContext() || context_->IsDebugEvaluateContext());
         return ScopeTypeWith;
       case CATCH_SCOPE:
         DCHECK(context_->IsCatchContext());
         return ScopeTypeCatch;
       case BLOCK_SCOPE:
-        DCHECK(!scope_info->HasContext() || context_->IsBlockContext());
+        DCHECK_IMPLIES(current_scope_->NeedsContext(),
+                       context_->IsBlockContext());
         return ScopeTypeBlock;
       case EVAL_SCOPE:
-        DCHECK(!scope_info->HasContext() || context_->IsEvalContext());
+        DCHECK_IMPLIES(current_scope_->NeedsContext(),
+                       context_->IsEvalContext());
         return ScopeTypeEval;
     }
     UNREACHABLE();
@@ -320,96 +351,91 @@ ScopeIterator::ScopeType ScopeIterator::Type() {
   return ScopeTypeWith;
 }
 
-
-MaybeHandle<JSObject> ScopeIterator::ScopeObject() {
+Handle<JSObject> ScopeIterator::ScopeObject(Mode mode) {
   DCHECK(!Done());
-  switch (Type()) {
-    case ScopeIterator::ScopeTypeGlobal:
-      return Handle<JSObject>(CurrentContext()->global_proxy());
-    case ScopeIterator::ScopeTypeScript:
-      return MaterializeScriptScope();
-    case ScopeIterator::ScopeTypeLocal:
-      // Materialize the content of the local scope into a JSObject.
-      DCHECK_EQ(1, nested_scope_chain_.size());
-      return MaterializeLocalScope();
-    case ScopeIterator::ScopeTypeWith:
-      return WithContextExtension();
-    case ScopeIterator::ScopeTypeCatch:
-      return MaterializeCatchScope();
-    case ScopeIterator::ScopeTypeClosure:
-      // Materialize the content of the closure scope into a JSObject.
-      return MaterializeClosure();
-    case ScopeIterator::ScopeTypeBlock:
-    case ScopeIterator::ScopeTypeEval:
-      return MaterializeInnerScope();
-    case ScopeIterator::ScopeTypeModule:
-      return MaterializeModuleScope();
-  }
-  UNREACHABLE();
-}
-
 
-bool ScopeIterator::HasContext() {
   ScopeType type = Type();
-  if (type == ScopeTypeBlock || type == ScopeTypeLocal ||
-      type == ScopeTypeEval) {
-    if (HasNestedScopeChain()) {
-      return LastNestedScopeChain().scope_info->HasContext();
-    }
+  if (type == ScopeTypeGlobal) {
+    DCHECK_EQ(Mode::ALL, mode);
+    return handle(context_->global_proxy(), isolate_);
+  }
+  if (type == ScopeTypeWith) {
+    DCHECK_EQ(Mode::ALL, mode);
+    return WithContextExtension();
   }
-  return true;
-}
 
+  Handle<JSObject> scope = isolate_->factory()->NewJSObjectWithNullProto();
+  auto visitor = [=](Handle<String> name, Handle<Object> value) {
+    JSObject::AddProperty(isolate_, scope, name, value, NONE);
+    return false;
+  };
 
-bool ScopeIterator::SetVariableValue(Handle<String> variable_name,
-                                     Handle<Object> new_value) {
-  DCHECK(!Done());
+  VisitScope(visitor, mode);
+  return scope;
+}
+
+void ScopeIterator::VisitScope(const Visitor& visitor, Mode mode) const {
   switch (Type()) {
-    case ScopeIterator::ScopeTypeGlobal:
-      break;
-    case ScopeIterator::ScopeTypeLocal:
-      return SetLocalVariableValue(variable_name, new_value);
-    case ScopeIterator::ScopeTypeWith:
-      break;
-    case ScopeIterator::ScopeTypeCatch:
-      return SetCatchVariableValue(variable_name, new_value);
-    case ScopeIterator::ScopeTypeClosure:
-      return SetClosureVariableValue(variable_name, new_value);
-    case ScopeIterator::ScopeTypeScript:
-      return SetScriptVariableValue(variable_name, new_value);
-    case ScopeIterator::ScopeTypeBlock:
-    case ScopeIterator::ScopeTypeEval:
-      return SetInnerScopeVariableValue(variable_name, new_value);
-    case ScopeIterator::ScopeTypeModule:
-      return SetModuleVariableValue(variable_name, new_value);
-      break;
+    case ScopeTypeLocal:
+    case ScopeTypeClosure:
+    case ScopeTypeCatch:
+    case ScopeTypeBlock:
+    case ScopeTypeEval:
+      return VisitLocalScope(visitor, mode);
+    case ScopeTypeModule:
+      if (InInnerScope()) {
+        return VisitLocalScope(visitor, mode);
+      }
+      DCHECK_EQ(Mode::ALL, mode);
+      return VisitModuleScope(visitor);
+    case ScopeTypeScript:
+      DCHECK_EQ(Mode::ALL, mode);
+      return VisitScriptScope(visitor);
+    case ScopeTypeWith:
+    case ScopeTypeGlobal:
+      UNREACHABLE();
   }
-  return false;
 }
 
-
-Handle<ScopeInfo> ScopeIterator::CurrentScopeInfo() {
+bool ScopeIterator::SetVariableValue(Handle<String> name,
+                                     Handle<Object> value) {
   DCHECK(!Done());
-  if (HasNestedScopeChain()) {
-    return LastNestedScopeChain().scope_info;
-  } else if (context_->IsBlockContext() || context_->IsFunctionContext() ||
-             context_->IsEvalContext()) {
-    return Handle<ScopeInfo>(context_->scope_info());
-  }
-  return Handle<ScopeInfo>::null();
-}
+  name = isolate_->factory()->InternalizeString(name);
+  switch (Type()) {
+    case ScopeTypeGlobal:
+    case ScopeTypeWith:
+      break;
 
+    case ScopeTypeEval:
+    case ScopeTypeBlock:
+    case ScopeTypeCatch:
+    case ScopeTypeModule:
+      if (InInnerScope()) return SetLocalVariableValue(name, value);
+      if (Type() == ScopeTypeModule && SetModuleVariableValue(name, value)) {
+        return true;
+      }
+      return SetContextVariableValue(name, value);
+
+    case ScopeTypeLocal:
+    case ScopeTypeClosure:
+      if (InInnerScope()) {
+        DCHECK_EQ(ScopeTypeLocal, Type());
+        if (SetLocalVariableValue(name, value)) return true;
+        // There may not be an associated context since we're InInnerScope().
+        if (!current_scope_->NeedsContext()) return false;
+      } else {
+        DCHECK_EQ(ScopeTypeClosure, Type());
+        if (SetContextVariableValue(name, value)) return true;
+      }
+      // The above functions only set variables statically declared in the
+      // function. There may be eval-introduced variables. Check them in
+      // SetContextExtensionValue.
+      return SetContextExtensionValue(name, value);
 
-Handle<Context> ScopeIterator::CurrentContext() {
-  DCHECK(!Done());
-  if (Type() == ScopeTypeGlobal || Type() == ScopeTypeScript ||
-      !HasNestedScopeChain()) {
-    return context_;
-  } else if (LastNestedScopeChain().scope_info->HasContext()) {
-    return context_;
-  } else {
-    return Handle<Context>::null();
+    case ScopeTypeScript:
+      return SetScriptVariableValue(name, value);
   }
+  return false;
 }
 
 Handle<StringSet> ScopeIterator::GetNonLocals() { return non_locals_; }
@@ -417,24 +443,22 @@ Handle<StringSet> ScopeIterator::GetNonLocals() { return non_locals_; }
 #ifdef DEBUG
 // Debug print of the content of the current scope.
 void ScopeIterator::DebugPrint() {
-  OFStream os(stdout);
+  StdoutStream os;
   DCHECK(!Done());
   switch (Type()) {
     case ScopeIterator::ScopeTypeGlobal:
       os << "Global:\n";
-      CurrentContext()->Print(os);
+      context_->Print(isolate_, os);
       break;
 
     case ScopeIterator::ScopeTypeLocal: {
       os << "Local:\n";
-      GetFunction()->shared()->scope_info()->Print();
-      if (!CurrentContext().is_null()) {
-        CurrentContext()->Print(os);
-        if (CurrentContext()->has_extension()) {
-          Handle<HeapObject> extension(CurrentContext()->extension(), isolate_);
-          if (extension->IsJSContextExtensionObject()) {
-            extension->Print(os);
-          }
+      if (current_scope_->NeedsContext()) {
+        context_->Print(isolate_, os);
+        if (context_->has_extension()) {
+          Handle<HeapObject> extension(context_->extension(), isolate_);
+          DCHECK(extension->IsJSContextExtensionObject());
+          extension->Print(isolate_, os);
         }
       }
       break;
@@ -442,33 +466,31 @@ void ScopeIterator::DebugPrint() {
 
     case ScopeIterator::ScopeTypeWith:
       os << "With:\n";
-      CurrentContext()->extension()->Print(os);
+      context_->extension()->Print(isolate_, os);
       break;
 
     case ScopeIterator::ScopeTypeCatch:
       os << "Catch:\n";
-      CurrentContext()->extension()->Print(os);
-      CurrentContext()->get(Context::THROWN_OBJECT_INDEX)->Print(os);
+      context_->extension()->Print(isolate_, os);
+      context_->get(Context::THROWN_OBJECT_INDEX)->Print(isolate_, os);
       break;
 
     case ScopeIterator::ScopeTypeClosure:
       os << "Closure:\n";
-      CurrentContext()->Print(os);
-      if (CurrentContext()->has_extension()) {
-        Handle<HeapObject> extension(CurrentContext()->extension(), isolate_);
-        if (extension->IsJSContextExtensionObject()) {
-          extension->Print(os);
-        }
+      context_->Print(isolate_, os);
+      if (context_->has_extension()) {
+        Handle<HeapObject> extension(context_->extension(), isolate_);
+        DCHECK(extension->IsJSContextExtensionObject());
+        extension->Print(isolate_, os);
       }
       break;
 
     case ScopeIterator::ScopeTypeScript:
       os << "Script:\n";
-      CurrentContext()
-          ->global_object()
+      context_->global_object()
           ->native_context()
           ->script_context_table()
-          ->Print(os);
+          ->Print(isolate_, os);
       break;
 
     default:
@@ -478,24 +500,6 @@ void ScopeIterator::DebugPrint() {
 }
 #endif
 
-inline Handle<Context> ScopeIterator::GetContext() {
-  if (frame_inspector_) {
-    return Handle<Context>::cast(frame_inspector_->GetContext());
-  } else {
-    DCHECK(!generator_.is_null());
-    return handle(generator_->context());
-  }
-}
-
-Handle<JSFunction> ScopeIterator::GetFunction() {
-  if (frame_inspector_) {
-    return frame_inspector_->GetFunction();
-  } else {
-    DCHECK(!generator_.is_null());
-    return handle(generator_->function());
-  }
-}
-
 int ScopeIterator::GetSourcePosition() {
   if (frame_inspector_) {
     return frame_inspector_->GetSourcePosition();
@@ -507,355 +511,389 @@ int ScopeIterator::GetSourcePosition() {
 
 void ScopeIterator::RetrieveScopeChain(DeclarationScope* scope) {
   DCHECK_NOT_NULL(scope);
-  GetNestedScopeChain(isolate_, scope, GetSourcePosition());
-}
 
-void ScopeIterator::CollectNonLocals(ParseInfo* info, DeclarationScope* scope) {
-  DCHECK_NOT_NULL(scope);
-  DCHECK(non_locals_.is_null());
-  non_locals_ = scope->CollectNonLocals(info, StringSet::New(isolate_));
-}
+  const int position = GetSourcePosition();
+
+  Scope* parent = nullptr;
+  Scope* current = scope;
+  while (parent != current) {
+    parent = current;
+    for (Scope* inner_scope = current->inner_scope(); inner_scope != nullptr;
+         inner_scope = inner_scope->sibling()) {
+      int beg_pos = inner_scope->start_position();
+      int end_pos = inner_scope->end_position();
+      DCHECK((beg_pos >= 0 && end_pos >= 0) || inner_scope->is_hidden());
+      if (beg_pos <= position && position < end_pos) {
+        // Don't walk into inner functions.
+        if (!inner_scope->is_function_scope()) {
+          current = inner_scope;
+        }
+        break;
+      }
+    }
+  }
 
+  start_scope_ = current;
+  current_scope_ = current;
+}
 
-MaybeHandle<JSObject> ScopeIterator::MaterializeScriptScope() {
-  Handle<JSGlobalObject> global(CurrentContext()->global_object());
+void ScopeIterator::VisitScriptScope(const Visitor& visitor) const {
+  Handle<JSGlobalObject> global(context_->global_object(), isolate_);
   Handle<ScriptContextTable> script_contexts(
-      global->native_context()->script_context_table());
+      global->native_context()->script_context_table(), isolate_);
 
-  Handle<JSObject> script_scope =
-      isolate_->factory()->NewJSObjectWithNullProto();
-
-  for (int context_index = 0; context_index < script_contexts->used();
+  // Skip the first script since that just declares 'this'.
+  for (int context_index = 1; context_index < script_contexts->used();
        context_index++) {
     Handle<Context> context =
         ScriptContextTable::GetContext(script_contexts, context_index);
-    Handle<ScopeInfo> scope_info(context->scope_info());
-    CopyContextLocalsToScopeObject(scope_info, context, script_scope);
-  }
-  return script_scope;
-}
-
-void ScopeIterator::MaterializeStackLocals(Handle<JSObject> local_scope,
-                                           Handle<ScopeInfo> scope_info) {
-  if (frame_inspector_) {
-    return frame_inspector_->MaterializeStackLocals(local_scope, scope_info);
-  }
-
-  DCHECK(!generator_.is_null());
-  // Fill all stack locals.
-  Handle<FixedArray> register_file(generator_->register_file());
-  for (int i = 0; i < scope_info->StackLocalCount(); ++i) {
-    Handle<String> name = handle(scope_info->StackLocalName(i));
-    if (ScopeInfo::VariableIsSynthetic(*name)) continue;
-    Handle<Object> value(register_file->get(scope_info->StackLocalIndex(i)),
-                         isolate_);
-    // TODO(yangguo): We convert optimized out values to {undefined} when they
-    // are passed to the debugger. Eventually we should handle them somehow.
-    if (value->IsTheHole(isolate_) || value->IsOptimizedOut(isolate_)) {
-      DCHECK(!value.is_identical_to(isolate_->factory()->stale_register()));
-      value = isolate_->factory()->undefined_value();
-    }
-    JSObject::SetOwnPropertyIgnoreAttributes(local_scope, name, value, NONE)
-        .Check();
+    Handle<ScopeInfo> scope_info(context->scope_info(), isolate_);
+    if (VisitContextLocals(visitor, scope_info, context)) return;
   }
 }
 
-MaybeHandle<JSObject> ScopeIterator::MaterializeLocalScope() {
-  Handle<JSFunction> function(GetFunction());
-  Handle<SharedFunctionInfo> shared(function->shared());
-  Handle<ScopeInfo> scope_info(shared->scope_info());
+void ScopeIterator::VisitModuleScope(const Visitor& visitor) const {
+  DCHECK(context_->IsModuleContext());
 
-  Handle<JSObject> local_scope =
-      isolate_->factory()->NewJSObjectWithNullProto();
-  MaterializeStackLocals(local_scope, scope_info);
+  Handle<ScopeInfo> scope_info(context_->scope_info(), isolate_);
+  if (VisitContextLocals(visitor, scope_info, context_)) return;
 
-  Handle<Context> frame_context = GetContext();
+  int count_index = scope_info->ModuleVariableCountIndex();
+  int module_variable_count = Smi::cast(scope_info->get(count_index))->value();
 
-  if (!scope_info->HasContext()) return local_scope;
+  Handle<Module> module(context_->module(), isolate_);
 
-  // Fill all context locals.
-  Handle<Context> function_context(frame_context->closure_context());
-  CopyContextLocalsToScopeObject(scope_info, function_context, local_scope);
+  for (int i = 0; i < module_variable_count; ++i) {
+    int index;
+    Handle<String> name;
+    {
+      String* raw_name;
+      scope_info->ModuleVariable(i, &raw_name, &index);
+      CHECK(!ScopeInfo::VariableIsSynthetic(raw_name));
+      name = handle(raw_name, isolate_);
+    }
+    Handle<Object> value = Module::LoadVariable(isolate_, module, index);
 
-  // Finally copy any properties from the function context extension.
-  // These will be variables introduced by eval.
-  if (function_context->closure() == *function &&
-      !function_context->IsNativeContext()) {
-    CopyContextExtensionToScopeObject(function_context, local_scope,
-                                      KeyCollectionMode::kIncludePrototypes);
+    // Reflect variables under TDZ as undeclared in scope object.
+    if (value->IsTheHole(isolate_)) continue;
+    if (visitor(name, value)) return;
   }
-
-  return local_scope;
 }
 
-
-// Create a plain JSObject which materializes the closure content for the
-// context.
-Handle<JSObject> ScopeIterator::MaterializeClosure() {
-  Handle<Context> context = CurrentContext();
-  DCHECK(context->IsFunctionContext() || context->IsEvalContext());
-
-  Handle<SharedFunctionInfo> shared(context->closure()->shared());
-  Handle<ScopeInfo> scope_info(shared->scope_info());
-
-  // Allocate and initialize a JSObject with all the content of this function
-  // closure.
-  Handle<JSObject> closure_scope =
-      isolate_->factory()->NewJSObjectWithNullProto();
-
+bool ScopeIterator::VisitContextLocals(const Visitor& visitor,
+                                       Handle<ScopeInfo> scope_info,
+                                       Handle<Context> context) const {
   // Fill all context locals to the context extension.
-  CopyContextLocalsToScopeObject(scope_info, context, closure_scope);
+  for (int i = 0; i < scope_info->ContextLocalCount(); ++i) {
+    Handle<String> name(scope_info->ContextLocalName(i), isolate_);
+    if (ScopeInfo::VariableIsSynthetic(*name)) continue;
+    int context_index = Context::MIN_CONTEXT_SLOTS + i;
+    Handle<Object> value(context->get(context_index), isolate_);
+    // Reflect variables under TDZ as undefined in scope object.
+    if (value->IsTheHole(isolate_)) continue;
+    if (visitor(name, value)) return true;
+  }
+  return false;
+}
 
-  // Finally copy any properties from the function context extension. This will
-  // be variables introduced by eval.
-  CopyContextExtensionToScopeObject(context, closure_scope,
-                                    KeyCollectionMode::kOwnOnly);
+bool ScopeIterator::VisitLocals(const Visitor& visitor, Mode mode) const {
+  for (Variable* var : *current_scope_->locals()) {
+    if (!var->is_this() && ScopeInfo::VariableIsSynthetic(*var->name())) {
+      continue;
+    }
 
-  return closure_scope;
-}
+    int index = var->index();
+    Handle<Object> value;
+    switch (var->location()) {
+      case VariableLocation::LOOKUP:
+        UNREACHABLE();
+        break;
+
+      case VariableLocation::UNALLOCATED:
+        if (!var->is_this()) continue;
+        // No idea why we only add it sometimes.
+        if (mode == Mode::ALL) continue;
+        // No idea why this diverges...
+        value = frame_inspector_->GetReceiver();
+        break;
+
+      case VariableLocation::PARAMETER: {
+        if (frame_inspector_ == nullptr) {
+          // Get the variable from the suspended generator.
+          DCHECK(!generator_.is_null());
+          if (var->is_this()) {
+            value = handle(generator_->receiver(), isolate_);
+          } else {
+            FixedArray* parameters_and_registers =
+                generator_->parameters_and_registers();
+            DCHECK_LT(index, parameters_and_registers->length());
+            value = handle(parameters_and_registers->get(index), isolate_);
+          }
+        } else {
+          value = var->is_this() ? frame_inspector_->GetReceiver()
+                                 : frame_inspector_->GetParameter(index);
+
+          if (value->IsOptimizedOut(isolate_)) {
+            value = isolate_->factory()->undefined_value();
+          } else if (var->is_this() && value->IsTheHole(isolate_)) {
+            value = isolate_->factory()->undefined_value();
+          }
+        }
+        break;
+      }
 
+      case VariableLocation::LOCAL:
+        if (frame_inspector_ == nullptr) {
+          // Get the variable from the suspended generator.
+          DCHECK(!generator_.is_null());
+          FixedArray* parameters_and_registers =
+              generator_->parameters_and_registers();
+          int parameter_count =
+              function_->shared()->scope_info()->ParameterCount();
+          index += parameter_count;
+          DCHECK_LT(index, parameters_and_registers->length());
+          value = handle(parameters_and_registers->get(index), isolate_);
+          if (value->IsTheHole(isolate_)) {
+            value = isolate_->factory()->undefined_value();
+          }
+        } else {
+          value = frame_inspector_->GetExpression(index);
+          if (value->IsOptimizedOut(isolate_)) {
+            // We'll rematerialize this later.
+            if (current_scope_->is_declaration_scope() &&
+                current_scope_->AsDeclarationScope()->arguments() == var) {
+              continue;
+            }
+            value = isolate_->factory()->undefined_value();
+          } else if (value->IsTheHole(isolate_)) {
+            // Reflect variables under TDZ as undeclared in scope object.
+            continue;
+          }
+        }
+        break;
+
+      case VariableLocation::CONTEXT:
+        if (mode == Mode::STACK) continue;
+        // TODO(verwaest): Why don't we want to show it if it's there?...
+        if (var->is_this()) continue;
+        DCHECK(var->IsContextSlot());
+        value = handle(context_->get(index), isolate_);
+        // Reflect variables under TDZ as undeclared in scope object.
+        if (value->IsTheHole(isolate_)) continue;
+        break;
+
+      case VariableLocation::MODULE: {
+        if (mode == Mode::STACK) continue;
+        // if (var->IsExport()) continue;
+        Handle<Module> module(context_->module(), isolate_);
+        value = Module::LoadVariable(isolate_, module, var->index());
+        // Reflect variables under TDZ as undeclared in scope object.
+        if (value->IsTheHole(isolate_)) continue;
+        break;
+      }
+    }
 
-// Create a plain JSObject which materializes the scope for the specified
-// catch context.
-Handle<JSObject> ScopeIterator::MaterializeCatchScope() {
-  Handle<Context> context = CurrentContext();
-  DCHECK(context->IsCatchContext());
-  Handle<String> name(context->catch_name());
-  Handle<Object> thrown_object(context->get(Context::THROWN_OBJECT_INDEX),
-                               isolate_);
-  Handle<JSObject> catch_scope =
-      isolate_->factory()->NewJSObjectWithNullProto();
-  JSObject::SetOwnPropertyIgnoreAttributes(catch_scope, name, thrown_object,
-                                           NONE)
-      .Check();
-  return catch_scope;
+    if (visitor(var->name(), value)) return true;
+  }
+  return false;
 }
 
 // Retrieve the with-context extension object. If the extension object is
 // a proxy, return an empty object.
 Handle<JSObject> ScopeIterator::WithContextExtension() {
-  Handle<Context> context = CurrentContext();
-  DCHECK(context->IsWithContext());
-  if (context->extension_receiver()->IsJSProxy()) {
+  DCHECK(context_->IsWithContext());
+  if (context_->extension_receiver()->IsJSProxy()) {
     return isolate_->factory()->NewJSObjectWithNullProto();
   }
-  return handle(JSObject::cast(context->extension_receiver()));
+  return handle(JSObject::cast(context_->extension_receiver()), isolate_);
 }
 
 // Create a plain JSObject which materializes the block scope for the specified
 // block context.
-Handle<JSObject> ScopeIterator::MaterializeInnerScope() {
-  Handle<JSObject> inner_scope =
-      isolate_->factory()->NewJSObjectWithNullProto();
-
-  Handle<Context> context = Handle<Context>::null();
-  if (HasNestedScopeChain()) {
-    Handle<ScopeInfo> scope_info = LastNestedScopeChain().scope_info;
-    MaterializeStackLocals(inner_scope, scope_info);
-    if (scope_info->HasContext()) context = CurrentContext();
-  } else {
-    context = CurrentContext();
-  }
-
-  if (!context.is_null()) {
-    // Fill all context locals.
-    CopyContextLocalsToScopeObject(CurrentScopeInfo(), context, inner_scope);
-    CopyContextExtensionToScopeObject(context, inner_scope,
-                                      KeyCollectionMode::kOwnOnly);
-  }
-  return inner_scope;
-}
-
-
-// Create a plain JSObject which materializes the module scope for the specified
-// module context.
-MaybeHandle<JSObject> ScopeIterator::MaterializeModuleScope() {
-  Handle<Context> context = CurrentContext();
-  DCHECK(context->IsModuleContext());
-  Handle<ScopeInfo> scope_info(context->scope_info());
-  Handle<JSObject> module_scope =
-      isolate_->factory()->NewJSObjectWithNullProto();
-  CopyContextLocalsToScopeObject(scope_info, context, module_scope);
-  CopyModuleVarsToScopeObject(scope_info, context, module_scope);
-  return module_scope;
-}
-
-bool ScopeIterator::SetParameterValue(Handle<ScopeInfo> scope_info,
-                                      Handle<String> parameter_name,
-                                      Handle<Object> new_value) {
-  // Setting stack locals of optimized frames is not supported.
-  HandleScope scope(isolate_);
-  for (int i = 0; i < scope_info->ParameterCount(); ++i) {
-    if (String::Equals(handle(scope_info->ParameterName(i)), parameter_name)) {
-      // Suspended generators should not get here because all parameters should
-      // be context-allocated.
-      DCHECK_NOT_NULL(frame_inspector_);
-      JavaScriptFrame* frame = GetFrame();
-      if (frame->is_optimized()) {
-        return false;
+void ScopeIterator::VisitLocalScope(const Visitor& visitor, Mode mode) const {
+  if (InInnerScope()) {
+    if (VisitLocals(visitor, mode)) return;
+    if (mode == Mode::STACK && Type() == ScopeTypeLocal) {
+      // Hide |this| in arrow functions that may be embedded in other functions
+      // but don't force |this| to be context-allocated. Otherwise we'd find the
+      // wrong |this| value.
+      if (!closure_scope_->has_this_declaration() &&
+          !non_locals_->Has(isolate_->factory()->this_string())) {
+        if (visitor(isolate_->factory()->this_string(),
+                    isolate_->factory()->undefined_value()))
+          return;
       }
-      frame->SetParameterValue(i, *new_value);
-      return true;
-    }
-  }
-  return false;
-}
-
-bool ScopeIterator::SetStackVariableValue(Handle<ScopeInfo> scope_info,
-                                          Handle<String> variable_name,
-                                          Handle<Object> new_value) {
-  // Setting stack locals of optimized frames is not supported. Suspended
-  // generators are supported.
-  HandleScope scope(isolate_);
-  for (int i = 0; i < scope_info->StackLocalCount(); ++i) {
-    if (String::Equals(handle(scope_info->StackLocalName(i)), variable_name)) {
-      int stack_local_index = scope_info->StackLocalIndex(i);
-      if (frame_inspector_ != nullptr) {
-        // Set the variable on the stack.
+      // Add |arguments| to the function scope even if it wasn't used.
+      // Currently we don't yet support materializing the arguments object of
+      // suspended generators. We'd need to read the arguments out from the
+      // suspended generator rather than from an activation as
+      // FunctionGetArguments does.
+      if (frame_inspector_ != nullptr && !closure_scope_->is_arrow_scope() &&
+          (closure_scope_->arguments() == nullptr ||
+           frame_inspector_->GetExpression(closure_scope_->arguments()->index())
+               ->IsOptimizedOut(isolate_))) {
         JavaScriptFrame* frame = GetFrame();
-        if (frame->is_optimized()) return false;
-        frame->SetExpression(stack_local_index, *new_value);
-      } else {
-        // Set the variable in the suspended generator.
-        DCHECK(!generator_.is_null());
-        Handle<FixedArray> register_file(generator_->register_file());
-        DCHECK_LT(stack_local_index, register_file->length());
-        register_file->set(stack_local_index, *new_value);
+        Handle<JSObject> arguments = Accessors::FunctionGetArguments(
+            frame, frame_inspector_->inlined_frame_index());
+        if (visitor(isolate_->factory()->arguments_string(), arguments)) return;
       }
-      return true;
+    }
+  } else {
+    DCHECK_EQ(Mode::ALL, mode);
+    Handle<ScopeInfo> scope_info(context_->scope_info(), isolate_);
+    if (VisitContextLocals(visitor, scope_info, context_)) return;
+  }
+
+  if (mode == Mode::ALL && HasContext()) {
+    DCHECK(!context_->IsScriptContext());
+    DCHECK(!context_->IsNativeContext());
+    DCHECK(!context_->IsWithContext());
+    if (!context_->scope_info()->CallsSloppyEval()) return;
+    if (context_->extension_object() == nullptr) return;
+    Handle<JSObject> extension(context_->extension_object(), isolate_);
+    Handle<FixedArray> keys =
+        KeyAccumulator::GetKeys(extension, KeyCollectionMode::kOwnOnly,
+                                ENUMERABLE_STRINGS)
+            .ToHandleChecked();
+
+    for (int i = 0; i < keys->length(); i++) {
+      // Names of variables introduced by eval are strings.
+      DCHECK(keys->get(i)->IsString());
+      Handle<String> key(String::cast(keys->get(i)), isolate_);
+      Handle<Object> value = JSReceiver::GetDataProperty(extension, key);
+      if (visitor(key, value)) return;
     }
   }
-  return false;
 }
 
-bool ScopeIterator::SetContextVariableValue(Handle<ScopeInfo> scope_info,
-                                            Handle<Context> context,
-                                            Handle<String> variable_name,
-                                            Handle<Object> new_value) {
-  HandleScope scope(isolate_);
-  for (int i = 0; i < scope_info->ContextLocalCount(); i++) {
-    Handle<String> next_name(scope_info->ContextLocalName(i));
-    if (String::Equals(variable_name, next_name)) {
-      VariableMode mode;
-      InitializationFlag init_flag;
-      MaybeAssignedFlag maybe_assigned_flag;
-      int context_index = ScopeInfo::ContextSlotIndex(
-          scope_info, next_name, &mode, &init_flag, &maybe_assigned_flag);
-      context->set(context_index, *new_value);
-      return true;
-    }
-  }
+bool ScopeIterator::SetLocalVariableValue(Handle<String> variable_name,
+                                          Handle<Object> new_value) {
+  // TODO(verwaest): Walk parameters backwards, not forwards.
+  // TODO(verwaest): Use VariableMap rather than locals() list for lookup.
+  for (Variable* var : *current_scope_->locals()) {
+    if (String::Equals(isolate_, var->name(), variable_name)) {
+      int index = var->index();
+      switch (var->location()) {
+        case VariableLocation::LOOKUP:
+        case VariableLocation::UNALLOCATED:
+          // Drop assignments to unallocated locals.
+          DCHECK(var->is_this() ||
+                 *variable_name == ReadOnlyRoots(isolate_).arguments_string());
+          return false;
+
+        case VariableLocation::PARAMETER: {
+          if (var->is_this()) return false;
+          if (frame_inspector_ == nullptr) {
+            // Set the variable in the suspended generator.
+            DCHECK(!generator_.is_null());
+            Handle<FixedArray> parameters_and_registers(
+                generator_->parameters_and_registers(), isolate_);
+            DCHECK_LT(index, parameters_and_registers->length());
+            parameters_and_registers->set(index, *new_value);
+          } else {
+            JavaScriptFrame* frame = GetFrame();
+            if (frame->is_optimized()) return false;
+
+            frame->SetParameterValue(index, *new_value);
+          }
+          return true;
+        }
 
-  // TODO(neis): Clean up context "extension" mess.
-  if (!context->IsModuleContext() && context->has_extension()) {
-    Handle<JSObject> ext(context->extension_object());
-    Maybe<bool> maybe = JSReceiver::HasOwnProperty(ext, variable_name);
-    DCHECK(maybe.IsJust());
-    if (maybe.FromJust()) {
-      // We don't expect this to do anything except replacing property value.
-      JSObject::SetOwnPropertyIgnoreAttributes(ext, variable_name, new_value,
-                                               NONE)
-          .Check();
-      return true;
+        case VariableLocation::LOCAL:
+          if (frame_inspector_ == nullptr) {
+            // Set the variable in the suspended generator.
+            DCHECK(!generator_.is_null());
+            int parameter_count =
+                function_->shared()->scope_info()->ParameterCount();
+            index += parameter_count;
+            Handle<FixedArray> parameters_and_registers(
+                generator_->parameters_and_registers(), isolate_);
+            DCHECK_LT(index, parameters_and_registers->length());
+            parameters_and_registers->set(index, *new_value);
+          } else {
+            // Set the variable on the stack.
+            JavaScriptFrame* frame = GetFrame();
+            if (frame->is_optimized()) return false;
+
+            frame->SetExpression(index, *new_value);
+          }
+          return true;
+
+        case VariableLocation::CONTEXT:
+          DCHECK(var->IsContextSlot());
+          context_->set(index, *new_value);
+          return true;
+
+        case VariableLocation::MODULE:
+          if (!var->IsExport()) return false;
+          Handle<Module> module(context_->module(), isolate_);
+          Module::StoreVariable(module, var->index(), new_value);
+          return true;
+      }
+      UNREACHABLE();
     }
   }
 
   return false;
 }
 
-bool ScopeIterator::SetLocalVariableValue(Handle<String> variable_name,
-                                          Handle<Object> new_value) {
-  Handle<ScopeInfo> scope_info(GetFunction()->shared()->scope_info());
+bool ScopeIterator::SetContextExtensionValue(Handle<String> variable_name,
+                                             Handle<Object> new_value) {
+  if (!context_->has_extension()) return false;
 
-  // Parameter might be shadowed in context. Don't stop here.
-  bool result = SetParameterValue(scope_info, variable_name, new_value);
+  DCHECK(context_->extension_object()->IsJSContextExtensionObject());
+  Handle<JSObject> ext(context_->extension_object(), isolate_);
+  LookupIterator it(ext, variable_name, LookupIterator::OWN);
+  Maybe<bool> maybe = JSReceiver::HasOwnProperty(ext, variable_name);
+  DCHECK(maybe.IsJust());
+  if (!maybe.FromJust()) return false;
 
-  // Stack locals.
-  if (SetStackVariableValue(scope_info, variable_name, new_value)) {
-    return true;
-  }
+  CHECK(Object::SetDataProperty(&it, new_value).ToChecked());
+  return true;
+}
 
-  if (scope_info->HasContext() &&
-      SetContextVariableValue(scope_info, CurrentContext(), variable_name,
-                              new_value)) {
-    return true;
-  }
+bool ScopeIterator::SetContextVariableValue(Handle<String> variable_name,
+                                            Handle<Object> new_value) {
+  Handle<ScopeInfo> scope_info(context_->scope_info(), isolate_);
 
-  return result;
+  VariableMode mode;
+  InitializationFlag flag;
+  MaybeAssignedFlag maybe_assigned_flag;
+  int slot_index = ScopeInfo::ContextSlotIndex(scope_info, variable_name, &mode,
+                                               &flag, &maybe_assigned_flag);
+  if (slot_index < 0) return false;
+
+  context_->set(slot_index, *new_value);
+  return true;
 }
 
 bool ScopeIterator::SetModuleVariableValue(Handle<String> variable_name,
                                            Handle<Object> new_value) {
-  DCHECK_NOT_NULL(frame_inspector_);
-
-  // Get module context and its scope info.
-  Handle<Context> context = CurrentContext();
-  while (!context->IsModuleContext()) {
-    context = handle(context->previous(), isolate_);
-  }
-  Handle<ScopeInfo> scope_info(context->scope_info(), isolate_);
-  DCHECK_EQ(scope_info->scope_type(), MODULE_SCOPE);
-
-  if (SetContextVariableValue(scope_info, context, variable_name, new_value)) {
-    return true;
-  }
-
   int cell_index;
-  {
-    VariableMode mode;
-    InitializationFlag init_flag;
-    MaybeAssignedFlag maybe_assigned_flag;
-    cell_index = scope_info->ModuleIndex(variable_name, &mode, &init_flag,
-                                         &maybe_assigned_flag);
-  }
+  VariableMode mode;
+  InitializationFlag init_flag;
+  MaybeAssignedFlag maybe_assigned_flag;
+  cell_index = context_->scope_info()->ModuleIndex(
+      variable_name, &mode, &init_flag, &maybe_assigned_flag);
 
   // Setting imports is currently not supported.
-  bool found = ModuleDescriptor::GetCellIndexKind(cell_index) ==
-               ModuleDescriptor::kExport;
-  if (found) {
-    Module::StoreVariable(handle(context->module(), isolate_), cell_index,
-                          new_value);
-  }
-  return found;
-}
-
-bool ScopeIterator::SetInnerScopeVariableValue(Handle<String> variable_name,
-                                               Handle<Object> new_value) {
-  Handle<ScopeInfo> scope_info = CurrentScopeInfo();
-  DCHECK(scope_info->scope_type() == BLOCK_SCOPE ||
-         scope_info->scope_type() == EVAL_SCOPE);
-
-  // Setting stack locals of optimized frames is not supported.
-  if (SetStackVariableValue(scope_info, variable_name, new_value)) {
-    return true;
-  }
-
-  if (HasContext() && SetContextVariableValue(scope_info, CurrentContext(),
-                                              variable_name, new_value)) {
-    return true;
+  if (ModuleDescriptor::GetCellIndexKind(cell_index) !=
+      ModuleDescriptor::kExport) {
+    return false;
   }
 
-  return false;
-}
-
-// This method copies structure of MaterializeClosure method above.
-bool ScopeIterator::SetClosureVariableValue(Handle<String> variable_name,
-                                            Handle<Object> new_value) {
-  DCHECK(CurrentContext()->IsFunctionContext() ||
-         CurrentContext()->IsEvalContext());
-  return SetContextVariableValue(CurrentScopeInfo(), CurrentContext(),
-                                 variable_name, new_value);
+  Handle<Module> module(context_->module(), isolate_);
+  Module::StoreVariable(module, cell_index, new_value);
+  return true;
 }
 
 bool ScopeIterator::SetScriptVariableValue(Handle<String> variable_name,
                                            Handle<Object> new_value) {
-  Handle<String> internalized_variable_name =
-      isolate_->factory()->InternalizeString(variable_name);
-  Handle<Context> context = CurrentContext();
   Handle<ScriptContextTable> script_contexts(
-      context->global_object()->native_context()->script_context_table());
+      context_->global_object()->native_context()->script_context_table(),
+      isolate_);
   ScriptContextTable::LookupResult lookup_result;
-  if (ScriptContextTable::Lookup(script_contexts, internalized_variable_name,
+  if (ScriptContextTable::Lookup(script_contexts, variable_name,
                                  &lookup_result)) {
     Handle<Context> script_context = ScriptContextTable::GetContext(
         script_contexts, lookup_result.context_index);
@@ -866,129 +904,5 @@ bool ScopeIterator::SetScriptVariableValue(Handle<String> variable_name,
   return false;
 }
 
-bool ScopeIterator::SetCatchVariableValue(Handle<String> variable_name,
-                                          Handle<Object> new_value) {
-  Handle<Context> context = CurrentContext();
-  DCHECK(context->IsCatchContext());
-  Handle<String> name(context->catch_name());
-  if (!String::Equals(name, variable_name)) {
-    return false;
-  }
-  context->set(Context::THROWN_OBJECT_INDEX, *new_value);
-  return true;
-}
-
-
-void ScopeIterator::CopyContextLocalsToScopeObject(
-    Handle<ScopeInfo> scope_info, Handle<Context> context,
-    Handle<JSObject> scope_object) {
-  Isolate* isolate = scope_info->GetIsolate();
-  int local_count = scope_info->ContextLocalCount();
-  if (local_count == 0) return;
-  // Fill all context locals to the context extension.
-  for (int i = 0; i < local_count; ++i) {
-    Handle<String> name(scope_info->ContextLocalName(i));
-    if (ScopeInfo::VariableIsSynthetic(*name)) continue;
-    int context_index = Context::MIN_CONTEXT_SLOTS + i;
-    Handle<Object> value = Handle<Object>(context->get(context_index), isolate);
-    // Reflect variables under TDZ as undefined in scope object.
-    if (value->IsTheHole(isolate)) continue;
-    // This should always succeed.
-    // TODO(verwaest): Use AddDataProperty instead.
-    JSObject::SetOwnPropertyIgnoreAttributes(scope_object, name, value, NONE)
-        .Check();
-  }
-}
-
-void ScopeIterator::CopyModuleVarsToScopeObject(Handle<ScopeInfo> scope_info,
-                                                Handle<Context> context,
-                                                Handle<JSObject> scope_object) {
-  Isolate* isolate = scope_info->GetIsolate();
-
-  int module_variable_count =
-      Smi::cast(scope_info->get(scope_info->ModuleVariableCountIndex()))
-          ->value();
-  for (int i = 0; i < module_variable_count; ++i) {
-    Handle<String> local_name;
-    Handle<Object> value;
-    {
-      String* name;
-      int index;
-      scope_info->ModuleVariable(i, &name, &index);
-      CHECK(!ScopeInfo::VariableIsSynthetic(name));
-      local_name = handle(name, isolate);
-      value = Module::LoadVariable(handle(context->module(), isolate), index);
-    }
-
-    // Reflect variables under TDZ as undefined in scope object.
-    if (value->IsTheHole(isolate)) continue;
-    // This should always succeed.
-    // TODO(verwaest): Use AddDataProperty instead.
-    JSObject::SetOwnPropertyIgnoreAttributes(scope_object, local_name, value,
-                                             NONE)
-        .Check();
-  }
-}
-
-void ScopeIterator::CopyContextExtensionToScopeObject(
-    Handle<Context> context, Handle<JSObject> scope_object,
-    KeyCollectionMode mode) {
-  if (context->extension_object() == nullptr) return;
-  Handle<JSObject> extension(context->extension_object());
-  Handle<FixedArray> keys =
-      KeyAccumulator::GetKeys(extension, mode, ENUMERABLE_STRINGS)
-          .ToHandleChecked();
-
-  for (int i = 0; i < keys->length(); i++) {
-    // Names of variables introduced by eval are strings.
-    DCHECK(keys->get(i)->IsString());
-    Handle<String> key(String::cast(keys->get(i)));
-    Handle<Object> value =
-        Object::GetPropertyOrElement(extension, key).ToHandleChecked();
-    JSObject::SetOwnPropertyIgnoreAttributes(scope_object, key, value, NONE)
-        .Check();
-  }
-}
-
-void ScopeIterator::GetNestedScopeChain(Isolate* isolate, Scope* scope,
-                                        int position) {
-  if (scope->is_function_scope()) {
-    // Do not collect scopes of nested inner functions inside the current one.
-    // Nested arrow functions could have the same end positions.
-    Handle<JSFunction> function = GetFunction();
-    if (scope->start_position() > function->shared()->StartPosition() &&
-        scope->end_position() <= function->shared()->EndPosition()) {
-      return;
-    }
-  }
-  if (scope->is_hidden()) {
-    // We need to add this chain element in case the scope has a context
-    // associated. We need to keep the scope chain and context chain in sync.
-    nested_scope_chain_.emplace_back(scope->scope_info());
-  } else {
-    nested_scope_chain_.emplace_back(
-        scope->scope_info(), scope->start_position(), scope->end_position());
-  }
-  for (Scope* inner_scope = scope->inner_scope(); inner_scope != nullptr;
-       inner_scope = inner_scope->sibling()) {
-    int beg_pos = inner_scope->start_position();
-    int end_pos = inner_scope->end_position();
-    DCHECK((beg_pos >= 0 && end_pos >= 0) || inner_scope->is_hidden());
-    if (beg_pos <= position && position < end_pos) {
-      GetNestedScopeChain(isolate, inner_scope, position);
-      return;
-    }
-  }
-}
-
-bool ScopeIterator::HasNestedScopeChain() {
-  return !nested_scope_chain_.empty();
-}
-
-ScopeIterator::ExtendedScopeInfo& ScopeIterator::LastNestedScopeChain() {
-  DCHECK(HasNestedScopeChain());
-  return nested_scope_chain_.back();
-}
-
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/src/debug/debug-scopes.h b/deps/v8/src/debug/debug-scopes.h
index ba1274f62c7c0b..f598f3e9947937 100644
--- a/deps/v8/src/debug/debug-scopes.h
+++ b/deps/v8/src/debug/debug-scopes.h
@@ -48,37 +48,45 @@ class ScopeIterator {
 
   ScopeIterator(Isolate* isolate, Handle<JSFunction> function);
   ScopeIterator(Isolate* isolate, Handle<JSGeneratorObject> generator);
+  ~ScopeIterator();
 
-  V8_WARN_UNUSED_RESULT MaybeHandle<JSObject> MaterializeScopeDetails();
+  Handle<JSObject> MaterializeScopeDetails();
 
   // More scopes?
-  bool Done() { return context_.is_null(); }
+  bool Done() const { return context_.is_null(); }
 
   // Move to the next scope.
   void Next();
 
+  // Restart to the first scope and context.
+  void Restart();
+
   // Return the type of the current scope.
-  ScopeType Type();
+  ScopeType Type() const;
+
+  // Indicates which variables should be visited. Either only variables from the
+  // scope that are available on the stack, or all variables.
+  enum class Mode { STACK, ALL };
 
   // Return the JavaScript object with the content of the current scope.
-  MaybeHandle<JSObject> ScopeObject();
+  Handle<JSObject> ScopeObject(Mode mode);
 
-  bool HasContext();
+  // Returns whether the current scope declares any variables.
+  bool DeclaresLocals(Mode mode) const;
 
   // Set variable value and return true on success.
   bool SetVariableValue(Handle<String> variable_name, Handle<Object> new_value);
 
-  Handle<ScopeInfo> CurrentScopeInfo();
-
-  // Return the context for this scope. For the local context there might not
-  // be an actual context.
-  Handle<Context> CurrentContext();
-
   // Populate the set with collected non-local variable names.
   Handle<StringSet> GetNonLocals();
 
-  // Return function which represents closure for current scope.
-  Handle<JSFunction> GetClosure();
+  // Similar to JSFunction::GetName return the function's name or it's inferred
+  // name.
+  Handle<Object> GetFunctionDebugName() const;
+
+  Handle<Script> GetScript() const { return script_; }
+
+  bool HasPositionInfo();
   int start_position();
   int end_position();
 
@@ -87,97 +95,63 @@ class ScopeIterator {
   void DebugPrint();
 #endif
 
- private:
-  struct ExtendedScopeInfo {
-    ExtendedScopeInfo(Handle<ScopeInfo> info, int start, int end)
-        : scope_info(info), start_position(start), end_position(end) {}
-    explicit ExtendedScopeInfo(Handle<ScopeInfo> info)
-        : scope_info(info), start_position(-1), end_position(-1) {}
-    Handle<ScopeInfo> scope_info;
-    int start_position;
-    int end_position;
-    bool is_hidden() { return start_position == -1 && end_position == -1; }
-  };
+  bool InInnerScope() const { return !function_.is_null(); }
+  bool HasContext() const;
+  Handle<Context> CurrentContext() const {
+    DCHECK(HasContext());
+    return context_;
+  }
 
+ private:
   Isolate* isolate_;
+  ParseInfo* info_ = nullptr;
   FrameInspector* const frame_inspector_ = nullptr;
   Handle<JSGeneratorObject> generator_;
+  Handle<JSFunction> function_;
   Handle<Context> context_;
-  std::vector<ExtendedScopeInfo> nested_scope_chain_;
+  Handle<Script> script_;
   Handle<StringSet> non_locals_;
-  bool seen_script_scope_;
+  DeclarationScope* closure_scope_ = nullptr;
+  Scope* start_scope_ = nullptr;
+  Scope* current_scope_ = nullptr;
+  bool seen_script_scope_ = false;
 
-  inline JavaScriptFrame* GetFrame() {
-    return frame_inspector_->GetArgumentsFrame();
+  inline JavaScriptFrame* GetFrame() const {
+    return frame_inspector_->javascript_frame();
   }
 
-  Handle<Context> GetContext();
-  Handle<JSFunction> GetFunction();
   int GetSourcePosition();
 
-  void MaterializeStackLocals(Handle<JSObject> local_scope,
-                              Handle<ScopeInfo> scope_info);
-
   void TryParseAndRetrieveScopes(ScopeIterator::Option option);
 
   void RetrieveScopeChain(DeclarationScope* scope);
 
-  void CollectNonLocals(ParseInfo* info, DeclarationScope* scope);
-
   void UnwrapEvaluationContext();
 
-  V8_WARN_UNUSED_RESULT MaybeHandle<JSObject> MaterializeScriptScope();
-  V8_WARN_UNUSED_RESULT MaybeHandle<JSObject> MaterializeLocalScope();
-  V8_WARN_UNUSED_RESULT MaybeHandle<JSObject> MaterializeModuleScope();
-  Handle<JSObject> MaterializeClosure();
-  Handle<JSObject> MaterializeCatchScope();
-  Handle<JSObject> MaterializeInnerScope();
+  typedef std::function<bool(Handle<String> name, Handle<Object> value)>
+      Visitor;
+
   Handle<JSObject> WithContextExtension();
 
   bool SetLocalVariableValue(Handle<String> variable_name,
                              Handle<Object> new_value);
-  bool SetInnerScopeVariableValue(Handle<String> variable_name,
-                                  Handle<Object> new_value);
-  bool SetClosureVariableValue(Handle<String> variable_name,
+  bool SetContextVariableValue(Handle<String> variable_name,
                                Handle<Object> new_value);
+  bool SetContextExtensionValue(Handle<String> variable_name,
+                                Handle<Object> new_value);
   bool SetScriptVariableValue(Handle<String> variable_name,
                               Handle<Object> new_value);
-  bool SetCatchVariableValue(Handle<String> variable_name,
-                             Handle<Object> new_value);
   bool SetModuleVariableValue(Handle<String> variable_name,
                               Handle<Object> new_value);
 
   // Helper functions.
-  bool SetParameterValue(Handle<ScopeInfo> scope_info,
-                         Handle<String> parameter_name,
-                         Handle<Object> new_value);
-  bool SetStackVariableValue(Handle<ScopeInfo> scope_info,
-                             Handle<String> variable_name,
-                             Handle<Object> new_value);
-  bool SetContextVariableValue(Handle<ScopeInfo> scope_info,
-                               Handle<Context> context,
-                               Handle<String> variable_name,
-                               Handle<Object> new_value);
-
-  void CopyContextLocalsToScopeObject(Handle<ScopeInfo> scope_info,
-                                      Handle<Context> context,
-                                      Handle<JSObject> scope_object);
-  void CopyModuleVarsToScopeObject(Handle<ScopeInfo> scope_info,
-                                   Handle<Context> context,
-                                   Handle<JSObject> scope_object);
-  void CopyContextExtensionToScopeObject(Handle<Context> context,
-                                         Handle<JSObject> scope_object,
-                                         KeyCollectionMode mode);
-
-  // Get the chain of nested scopes within this scope for the source statement
-  // position. The scopes will be added to the list from the outermost scope to
-  // the innermost scope. Only nested block, catch or with scopes are tracked
-  // and will be returned, but no inner function scopes.
-  void GetNestedScopeChain(Isolate* isolate, Scope* scope,
-                           int statement_position);
-
-  bool HasNestedScopeChain();
-  ExtendedScopeInfo& LastNestedScopeChain();
+  void VisitScope(const Visitor& visitor, Mode mode) const;
+  void VisitLocalScope(const Visitor& visitor, Mode mode) const;
+  void VisitScriptScope(const Visitor& visitor) const;
+  void VisitModuleScope(const Visitor& visitor) const;
+  bool VisitLocals(const Visitor& visitor, Mode mode) const;
+  bool VisitContextLocals(const Visitor& visitor, Handle<ScopeInfo> scope_info,
+                          Handle<Context> context) const;
 
   DISALLOW_IMPLICIT_CONSTRUCTORS(ScopeIterator);
 };
diff --git a/deps/v8/src/debug/debug-stack-trace-iterator.cc b/deps/v8/src/debug/debug-stack-trace-iterator.cc
index 7b0c1690c7cfc8..f12c8d920d7775 100644
--- a/deps/v8/src/debug/debug-stack-trace-iterator.cc
+++ b/deps/v8/src/debug/debug-stack-trace-iterator.cc
@@ -84,7 +84,7 @@ v8::MaybeLocal<v8::Value> DebugStackTraceIterator::GetReceiver() const {
     // So let's try to fetch it using same logic as is used to retrieve 'this'
     // during DebugEvaluate::Local.
     Handle<JSFunction> function = frame_inspector_->GetFunction();
-    Handle<Context> context(function->context());
+    Handle<Context> context(function->context(), isolate_);
     // Arrow function defined in top level function without references to
     // variables may have NativeContext as context.
     if (!context->IsFunctionContext()) return v8::MaybeLocal<v8::Value>();
@@ -95,7 +95,7 @@ v8::MaybeLocal<v8::Value> DebugStackTraceIterator::GetReceiver() const {
     if (!scope_iterator.GetNonLocals()->Has(isolate_->factory()->this_string()))
       return v8::MaybeLocal<v8::Value>();
 
-    Handle<ScopeInfo> scope_info(context->scope_info());
+    Handle<ScopeInfo> scope_info(context->scope_info(), isolate_);
     VariableMode mode;
     InitializationFlag flag;
     MaybeAssignedFlag maybe_assigned_flag;
@@ -125,7 +125,7 @@ v8::Local<v8::Value> DebugStackTraceIterator::GetReturnValue() const {
   return Utils::ToLocal(isolate_->debug()->return_value_handle());
 }
 
-v8::Local<v8::String> DebugStackTraceIterator::GetFunctionName() const {
+v8::Local<v8::String> DebugStackTraceIterator::GetFunctionDebugName() const {
   DCHECK(!Done());
   return Utils::ToLocal(frame_inspector_->GetFunctionName());
 }
@@ -172,6 +172,8 @@ v8::MaybeLocal<v8::Value> DebugStackTraceIterator::Evaluate(
     v8::Local<v8::String> source, bool throw_on_side_effect) {
   DCHECK(!Done());
   Handle<Object> value;
+  i::SafeForInterruptsScope safe_for_interrupt_scope(
+      isolate_, i::StackGuard::TERMINATE_EXECUTION);
   if (!DebugEvaluate::Local(isolate_, iterator_.frame()->id(),
                             inlined_frame_index_, Utils::OpenHandle(*source),
                             throw_on_side_effect)
diff --git a/deps/v8/src/debug/debug-stack-trace-iterator.h b/deps/v8/src/debug/debug-stack-trace-iterator.h
index 4da552ffcb4837..0c09afa87c37e5 100644
--- a/deps/v8/src/debug/debug-stack-trace-iterator.h
+++ b/deps/v8/src/debug/debug-stack-trace-iterator.h
@@ -23,7 +23,7 @@ class DebugStackTraceIterator final : public debug::StackTraceIterator {
   int GetContextId() const override;
   v8::MaybeLocal<v8::Value> GetReceiver() const override;
   v8::Local<v8::Value> GetReturnValue() const override;
-  v8::Local<v8::String> GetFunctionName() const override;
+  v8::Local<v8::String> GetFunctionDebugName() const override;
   v8::Local<v8::debug::Script> GetScript() const override;
   debug::Location GetSourceLocation() const override;
   v8::Local<v8::Function> GetFunction() const override;
diff --git a/deps/v8/src/debug/debug-type-profile.cc b/deps/v8/src/debug/debug-type-profile.cc
index cc30ddee61db3a..794087115f022f 100644
--- a/deps/v8/src/debug/debug-type-profile.cc
+++ b/deps/v8/src/debug/debug-type-profile.cc
@@ -100,7 +100,7 @@ void TypeProfile::SelectMode(Isolate* isolate, debug::TypeProfile::Mode mode) {
       // coverage.
       if (isolate->is_best_effort_code_coverage()) {
         isolate->SetFeedbackVectorsForProfilingTools(
-            isolate->heap()->undefined_value());
+            ReadOnlyRoots(isolate).undefined_value());
       }
     }
   } else {
diff --git a/deps/v8/src/debug/debug.cc b/deps/v8/src/debug/debug.cc
index ae275538d76424..8f127be35c0946 100644
--- a/deps/v8/src/debug/debug.cc
+++ b/deps/v8/src/debug/debug.cc
@@ -30,6 +30,7 @@
 #include "src/log.h"
 #include "src/messages.h"
 #include "src/objects/debug-objects-inl.h"
+#include "src/objects/js-promise-inl.h"
 #include "src/snapshot/natives.h"
 #include "src/snapshot/snapshot.h"
 #include "src/wasm/wasm-objects-inl.h"
@@ -59,8 +60,16 @@ class Debug::TemporaryObjectsTracker : public HeapObjectAllocationTracker {
     objects_.insert(to);
   }
 
-  bool HasObject(Address addr) const {
-    return objects_.find(addr) != objects_.end();
+  bool HasObject(Handle<HeapObject> obj) const {
+    if (obj->IsJSObject() &&
+        Handle<JSObject>::cast(obj)->GetEmbedderFieldCount()) {
+      // Embedder may store any pointers using embedder fields and implements
+      // non trivial logic, e.g. create wrappers lazily and store pointer to
+      // native object inside embedder field. We should consider all objects
+      // with embedder fields as non temporary.
+      return false;
+    }
+    return objects_.find(obj->address()) != objects_.end();
   }
 
  private:
@@ -70,11 +79,9 @@ class Debug::TemporaryObjectsTracker : public HeapObjectAllocationTracker {
 };
 
 Debug::Debug(Isolate* isolate)
-    : debug_context_(Handle<Context>()),
-      is_active_(false),
+    : is_active_(false),
       hook_on_function_call_(false),
       is_suppressed_(false),
-      live_edit_enabled_(false),
       break_disabled_(false),
       break_points_active_(true),
       break_on_exception_(false),
@@ -153,9 +160,10 @@ int BreakLocation::BreakIndexFromCodeOffset(Handle<DebugInfo> debug_info,
   return closest_break;
 }
 
-bool BreakLocation::HasBreakPoint(Handle<DebugInfo> debug_info) const {
+bool BreakLocation::HasBreakPoint(Isolate* isolate,
+                                  Handle<DebugInfo> debug_info) const {
   // First check whether there is a break point with the same source position.
-  if (!debug_info->HasBreakPoint(position_)) return false;
+  if (!debug_info->HasBreakPoint(isolate, position_)) return false;
   if (debug_info->CanBreakAtEntry()) {
     DCHECK_EQ(Debug::kBreakAtEntryPosition, position_);
     return debug_info->BreakAtEntry();
@@ -292,7 +300,7 @@ void BreakIterator::ClearDebugBreak() {
 
 BreakLocation BreakIterator::GetBreakLocation() {
   Handle<AbstractCode> code(
-      AbstractCode::cast(debug_info_->DebugBytecodeArray()));
+      AbstractCode::cast(debug_info_->DebugBytecodeArray()), isolate());
   DebugBreakType type = GetDebugBreakType();
   int generator_object_reg_index = -1;
   if (type == DEBUG_BREAK_SLOT_AT_SUSPEND) {
@@ -302,8 +310,8 @@ BreakLocation BreakIterator::GetBreakLocation() {
     // bytecode array, and we'll read the actual generator object off the
     // interpreter stack frame in GetGeneratorObjectForSuspendedFrame.
     BytecodeArray* bytecode_array = debug_info_->OriginalBytecodeArray();
-    interpreter::BytecodeArrayAccessor accessor(handle(bytecode_array),
-                                                code_offset());
+    interpreter::BytecodeArrayAccessor accessor(
+        handle(bytecode_array, isolate()), code_offset());
 
     DCHECK_EQ(accessor.current_bytecode(),
               interpreter::Bytecode::kSuspendGenerator);
@@ -336,12 +344,12 @@ void Debug::ThreadInit() {
   thread_local_.ignore_step_into_function_ = Smi::kZero;
   thread_local_.target_frame_count_ = -1;
   thread_local_.return_value_ = Smi::kZero;
-  thread_local_.async_task_count_ = 0;
   thread_local_.last_breakpoint_id_ = 0;
   clear_suspended_generator();
-  thread_local_.restart_fp_ = nullptr;
+  thread_local_.restart_fp_ = kNullAddress;
   base::Relaxed_Store(&thread_local_.current_debug_scope_,
                       static_cast<base::AtomicWord>(0));
+  thread_local_.break_on_next_function_call_ = false;
   UpdateHookOnFunctionCall();
 }
 
@@ -369,9 +377,10 @@ void Debug::Iterate(RootVisitor* v) {
                       &thread_local_.ignore_step_into_function_);
 }
 
-DebugInfoListNode::DebugInfoListNode(DebugInfo* debug_info) : next_(nullptr) {
+DebugInfoListNode::DebugInfoListNode(Isolate* isolate, DebugInfo* debug_info)
+    : next_(nullptr) {
   // Globalize the request debug info object and make it weak.
-  GlobalHandles* global_handles = debug_info->GetIsolate()->global_handles();
+  GlobalHandles* global_handles = isolate->global_handles();
   debug_info_ = global_handles->Create(debug_info).location();
 }
 
@@ -382,59 +391,12 @@ DebugInfoListNode::~DebugInfoListNode() {
   debug_info_ = nullptr;
 }
 
-
-bool Debug::Load() {
-  // Return if debugger is already loaded.
-  if (is_loaded()) return true;
-
-  // Bail out if we're already in the process of compiling the native
-  // JavaScript source code for the debugger.
-  if (is_suppressed_) return false;
-  SuppressDebug while_loading(this);
-
-  // Disable breakpoints and interrupts while compiling and running the
-  // debugger scripts including the context creation code.
-  DisableBreak disable(this);
-  PostponeInterruptsScope postpone(isolate_);
-
-  // Create the debugger context.
-  HandleScope scope(isolate_);
-  ExtensionConfiguration no_extensions;
-  // TODO(yangguo): we rely on the fact that first context snapshot is usable
-  //                as debug context. This dependency is gone once we remove
-  //                debug context completely.
-  static const int kFirstContextSnapshotIndex = 0;
-  Handle<Context> context = isolate_->bootstrapper()->CreateEnvironment(
-      MaybeHandle<JSGlobalProxy>(), v8::Local<ObjectTemplate>(), &no_extensions,
-      kFirstContextSnapshotIndex, v8::DeserializeEmbedderFieldsCallback(),
-      DEBUG_CONTEXT);
-
-  // Fail if no context could be created.
-  if (context.is_null()) return false;
-
-  debug_context_ = isolate_->global_handles()->Create(*context);
-  GlobalHandles::AnnotateStrongRetainer(
-      Handle<Object>::cast(debug_context_).location(),
-      "v8::internal::Debug::debug_context_");
-
-  feature_tracker()->Track(DebugFeatureTracker::kActive);
-
-  return true;
-}
-
-
 void Debug::Unload() {
   ClearAllBreakPoints();
   ClearStepping();
   RemoveAllCoverageInfos();
-  RemoveDebugDelegate();
-
-  // Return debugger is not loaded.
-  if (!is_loaded()) return;
-
-  // Clear debugger context global handle.
-  GlobalHandles::Destroy(Handle<Object>::cast(debug_context_).location());
-  debug_context_ = Handle<Context>();
+  ClearAllDebuggerHints();
+  debug_delegate_ = nullptr;
 }
 
 void Debug::Break(JavaScriptFrame* frame, Handle<JSFunction> break_target) {
@@ -446,14 +408,13 @@ void Debug::Break(JavaScriptFrame* frame, Handle<JSFunction> break_target) {
 
   // Enter the debugger.
   DebugScope debug_scope(this);
-  if (debug_scope.failed()) return;
 
   // Postpone interrupt during breakpoint processing.
   PostponeInterruptsScope postpone(isolate_);
   DisableBreak no_recursive_break(this);
 
   // Return if we fail to retrieve debug info.
-  Handle<SharedFunctionInfo> shared(break_target->shared());
+  Handle<SharedFunctionInfo> shared(break_target->shared(), isolate_);
   if (!EnsureBreakInfo(shared)) return;
   PrepareFunctionForDebugExecution(shared);
 
@@ -465,11 +426,13 @@ void Debug::Break(JavaScriptFrame* frame, Handle<JSFunction> break_target) {
   // Find actual break points, if any, and trigger debug break event.
   MaybeHandle<FixedArray> break_points_hit =
       CheckBreakPoints(debug_info, &location);
-  if (!break_points_hit.is_null()) {
+  if (!break_points_hit.is_null() || break_on_next_function_call()) {
     // Clear all current stepping setup.
     ClearStepping();
     // Notify the debug event listeners.
-    OnDebugBreak(break_points_hit.ToHandleChecked());
+    OnDebugBreak(!break_points_hit.is_null()
+                     ? break_points_hit.ToHandleChecked()
+                     : isolate_->factory()->empty_fixed_array());
     return;
   }
 
@@ -550,7 +513,7 @@ MaybeHandle<FixedArray> Debug::CheckBreakPoints(Handle<DebugInfo> debug_info,
                                                 BreakLocation* location,
                                                 bool* has_break_points) {
   bool has_break_points_to_check =
-      break_points_active_ && location->HasBreakPoint(debug_info);
+      break_points_active_ && location->HasBreakPoint(isolate_, debug_info);
   if (has_break_points) *has_break_points = has_break_points_to_check;
   if (!has_break_points_to_check) return {};
 
@@ -569,10 +532,9 @@ bool Debug::IsMutedAtCurrentLocation(JavaScriptFrame* frame) {
   DCHECK(!summary.IsWasm());
   Handle<JSFunction> function = summary.AsJavaScript().function();
   if (!function->shared()->HasBreakInfo()) return false;
-  Handle<DebugInfo> debug_info(function->shared()->GetDebugInfo());
+  Handle<DebugInfo> debug_info(function->shared()->GetDebugInfo(), isolate_);
   // Enter the debugger.
   DebugScope debug_scope(this);
-  if (debug_scope.failed()) return false;
   std::vector<BreakLocation> break_locations;
   BreakLocation::AllAtCurrentStatement(debug_info, frame, &break_locations);
   bool has_break_points_at_all = false;
@@ -586,35 +548,13 @@ bool Debug::IsMutedAtCurrentLocation(JavaScriptFrame* frame) {
   return has_break_points_at_all;
 }
 
-MaybeHandle<Object> Debug::CallFunction(const char* name, int argc,
-                                        Handle<Object> args[],
-                                        bool catch_exceptions) {
-  AllowJavascriptExecutionDebugOnly allow_script(isolate_);
-  PostponeInterruptsScope no_interrupts(isolate_);
-  AssertDebugContext();
-  Handle<JSReceiver> holder =
-      Handle<JSReceiver>::cast(isolate_->natives_utils_object());
-  Handle<JSFunction> fun = Handle<JSFunction>::cast(
-      JSReceiver::GetProperty(isolate_, holder, name).ToHandleChecked());
-  Handle<Object> undefined = isolate_->factory()->undefined_value();
-  if (catch_exceptions) {
-    MaybeHandle<Object> maybe_exception;
-    return Execution::TryCall(isolate_, fun, undefined, argc, args,
-                              Execution::MessageHandling::kReport,
-                              &maybe_exception);
-  } else {
-    return Execution::Call(isolate_, fun, undefined, argc, args);
-  }
-}
-
-
 // Check whether a single break point object is triggered.
 bool Debug::CheckBreakPoint(Handle<BreakPoint> break_point,
                             bool is_break_at_entry) {
   HandleScope scope(isolate_);
 
   if (!break_point->condition()->length()) return true;
-  Handle<String> condition(break_point->condition());
+  Handle<String> condition(break_point->condition(), isolate_);
   MaybeHandle<Object> maybe_result;
   Handle<Object> result;
 
@@ -636,7 +576,7 @@ bool Debug::CheckBreakPoint(Handle<BreakPoint> break_point,
     }
     return false;
   }
-  return result->BooleanValue();
+  return result->BooleanValue(isolate_);
 }
 
 bool Debug::SetBreakPoint(Handle<JSFunction> function,
@@ -645,19 +585,19 @@ bool Debug::SetBreakPoint(Handle<JSFunction> function,
   HandleScope scope(isolate_);
 
   // Make sure the function is compiled and has set up the debug info.
-  Handle<SharedFunctionInfo> shared(function->shared());
+  Handle<SharedFunctionInfo> shared(function->shared(), isolate_);
   if (!EnsureBreakInfo(shared)) return false;
   PrepareFunctionForDebugExecution(shared);
 
-  Handle<DebugInfo> debug_info(shared->GetDebugInfo());
+  Handle<DebugInfo> debug_info(shared->GetDebugInfo(), isolate_);
   // Source positions starts with zero.
   DCHECK_LE(0, *source_position);
 
   // Find the break point and change it.
   *source_position = FindBreakablePosition(debug_info, *source_position);
-  DebugInfo::SetBreakPoint(debug_info, *source_position, break_point);
+  DebugInfo::SetBreakPoint(isolate_, debug_info, *source_position, break_point);
   // At least one active break point now.
-  DCHECK_LT(0, debug_info->GetBreakPointCount());
+  DCHECK_LT(0, debug_info->GetBreakPointCount(isolate_));
 
   ClearBreakPoints(debug_info);
   ApplyBreakPoints(debug_info);
@@ -673,10 +613,10 @@ bool Debug::SetBreakPointForScript(Handle<Script> script,
   Handle<BreakPoint> break_point =
       isolate_->factory()->NewBreakPoint(*id, condition);
   if (script->type() == Script::TYPE_WASM) {
-    Handle<WasmCompiledModule> compiled_module(
-        WasmCompiledModule::cast(script->wasm_compiled_module()), isolate_);
-    return WasmCompiledModule::SetBreakPoint(compiled_module, source_position,
-                                             break_point);
+    Handle<WasmModuleObject> module_object(
+        WasmModuleObject::cast(script->wasm_module_object()), isolate_);
+    return WasmModuleObject::SetBreakPoint(module_object, source_position,
+                                           break_point);
   }
 
   HandleScope scope(isolate_);
@@ -697,7 +637,7 @@ bool Debug::SetBreakPointForScript(Handle<Script> script,
     *source_position = shared->StartPosition();
   }
 
-  Handle<DebugInfo> debug_info(shared->GetDebugInfo());
+  Handle<DebugInfo> debug_info(shared->GetDebugInfo(), isolate_);
 
   // Find breakable position returns first breakable position after
   // *source_position, it can return 0 if no break location is found after
@@ -706,9 +646,9 @@ bool Debug::SetBreakPointForScript(Handle<Script> script,
   if (breakable_position < *source_position) return false;
   *source_position = breakable_position;
 
-  DebugInfo::SetBreakPoint(debug_info, *source_position, break_point);
+  DebugInfo::SetBreakPoint(isolate_, debug_info, *source_position, break_point);
   // At least one active break point now.
-  DCHECK_LT(0, debug_info->GetBreakPointCount());
+  DCHECK_LT(0, debug_info->GetBreakPointCount(isolate_));
 
   ClearBreakPoints(debug_info);
   ApplyBreakPoints(debug_info);
@@ -722,38 +662,25 @@ int Debug::FindBreakablePosition(Handle<DebugInfo> debug_info,
   if (debug_info->CanBreakAtEntry()) {
     return kBreakAtEntryPosition;
   } else {
-    DCHECK(debug_info->HasDebugBytecodeArray());
+    DCHECK(debug_info->HasInstrumentedBytecodeArray());
     BreakIterator it(debug_info);
     it.SkipToPosition(source_position);
     return it.position();
   }
 }
 
-void Debug::ApplyInstrumentation(Handle<SharedFunctionInfo> shared) {
-  DCHECK(shared->HasBytecodeArray());
-  Handle<DebugInfo> debug_info(GetOrCreateDebugInfo(shared));
-  DCHECK_NE(debug_info->DebugExecutionMode(), isolate_->debug_execution_mode());
-  if (isolate_->debug_execution_mode() == DebugInfo::kBreakpoints) {
-    ClearSideEffectChecks(debug_info);
-    ApplyBreakPoints(debug_info);
-  } else {
-    ClearBreakPoints(debug_info);
-    ApplySideEffectChecks(debug_info);
-  }
-}
-
 void Debug::ApplyBreakPoints(Handle<DebugInfo> debug_info) {
   DisallowHeapAllocation no_gc;
   if (debug_info->CanBreakAtEntry()) {
     debug_info->SetBreakAtEntry();
   } else {
-    if (!debug_info->HasDebugBytecodeArray()) return;
+    if (!debug_info->HasInstrumentedBytecodeArray()) return;
     FixedArray* break_points = debug_info->break_points();
     for (int i = 0; i < break_points->length(); i++) {
       if (break_points->get(i)->IsUndefined(isolate_)) continue;
       BreakPointInfo* info = BreakPointInfo::cast(break_points->get(i));
-      if (info->GetBreakPointCount() == 0) continue;
-      DCHECK(debug_info->HasDebugBytecodeArray());
+      if (info->GetBreakPointCount(isolate_) == 0) continue;
+      DCHECK(debug_info->HasInstrumentedBytecodeArray());
       BreakIterator it(debug_info);
       it.SkipToPosition(info->source_position());
       it.SetDebugBreak();
@@ -768,7 +695,8 @@ void Debug::ClearBreakPoints(Handle<DebugInfo> debug_info) {
   } else {
     // If we attempt to clear breakpoints but none exist, simply return. This
     // can happen e.g. CoverageInfos exist but no breakpoints are set.
-    if (!debug_info->HasDebugBytecodeArray() || !debug_info->HasBreakInfo()) {
+    if (!debug_info->HasInstrumentedBytecodeArray() ||
+        !debug_info->HasBreakInfo()) {
       return;
     }
 
@@ -785,13 +713,13 @@ void Debug::ClearBreakPoint(Handle<BreakPoint> break_point) {
   for (DebugInfoListNode* node = debug_info_list_; node != nullptr;
        node = node->next()) {
     if (!node->debug_info()->HasBreakInfo()) continue;
-    Handle<Object> result =
-        DebugInfo::FindBreakPointInfo(node->debug_info(), break_point);
+    Handle<Object> result = DebugInfo::FindBreakPointInfo(
+        isolate_, node->debug_info(), break_point);
     if (result->IsUndefined(isolate_)) continue;
     Handle<DebugInfo> debug_info = node->debug_info();
-    if (DebugInfo::ClearBreakPoint(debug_info, break_point)) {
+    if (DebugInfo::ClearBreakPoint(isolate_, debug_info, break_point)) {
       ClearBreakPoints(debug_info);
-      if (debug_info->GetBreakPointCount() == 0) {
+      if (debug_info->GetBreakPointCount(isolate_) == 0) {
         RemoveBreakInfoAndMaybeFree(debug_info);
       } else {
         ApplyBreakPoints(debug_info);
@@ -801,6 +729,17 @@ void Debug::ClearBreakPoint(Handle<BreakPoint> break_point) {
   }
 }
 
+int Debug::GetFunctionDebuggingId(Handle<JSFunction> function) {
+  Handle<SharedFunctionInfo> shared = handle(function->shared(), isolate_);
+  Handle<DebugInfo> debug_info = GetOrCreateDebugInfo(shared);
+  int id = debug_info->debugging_id();
+  if (id == DebugInfo::kNoDebuggingId) {
+    id = isolate_->heap()->NextDebuggingId();
+    debug_info->set_debugging_id(id);
+  }
+  return id;
+}
+
 bool Debug::SetBreakpointForFunction(Handle<JSFunction> function,
                                      Handle<String> condition, int* id) {
   *id = ++thread_local_.last_breakpoint_id_;
@@ -820,7 +759,7 @@ void Debug::RemoveBreakpoint(int id) {
 void Debug::ClearAllBreakPoints() {
   ClearAllDebugInfos([=](Handle<DebugInfo> info) {
     ClearBreakPoints(info);
-    return info->ClearBreakInfo();
+    info->ClearBreakInfo(isolate_);
   });
 }
 
@@ -831,9 +770,9 @@ void Debug::FloodWithOneShot(Handle<SharedFunctionInfo> shared,
   if (!EnsureBreakInfo(shared)) return;
   PrepareFunctionForDebugExecution(shared);
 
-  Handle<DebugInfo> debug_info(shared->GetDebugInfo());
+  Handle<DebugInfo> debug_info(shared->GetDebugInfo(), isolate_);
   // Flood the function with break points.
-  DCHECK(debug_info->HasDebugBytecodeArray());
+  DCHECK(debug_info->HasInstrumentedBytecodeArray());
   for (BreakIterator it(debug_info); !it.Done(); it.Next()) {
     if (returns_only && !it.GetBreakLocation().IsReturnOrSuspend()) continue;
     it.SetDebugBreak();
@@ -859,7 +798,7 @@ bool Debug::IsBreakOnException(ExceptionBreakType type) {
 
 MaybeHandle<FixedArray> Debug::GetHitBreakPoints(Handle<DebugInfo> debug_info,
                                                  int position) {
-  Handle<Object> break_points = debug_info->GetBreakPoints(position);
+  Handle<Object> break_points = debug_info->GetBreakPoints(isolate_, position);
   bool is_break_at_entry = debug_info->BreakAtEntry();
   DCHECK(!break_points->IsUndefined(isolate_));
   if (!break_points->IsFixedArray()) {
@@ -872,7 +811,7 @@ MaybeHandle<FixedArray> Debug::GetHitBreakPoints(Handle<DebugInfo> debug_info,
     return break_points_hit;
   }
 
-  Handle<FixedArray> array(FixedArray::cast(*break_points));
+  Handle<FixedArray> array(FixedArray::cast(*break_points), isolate_);
   int num_objects = array->length();
   Handle<FixedArray> break_points_hit =
       isolate_->factory()->NewFixedArray(num_objects);
@@ -889,12 +828,28 @@ MaybeHandle<FixedArray> Debug::GetHitBreakPoints(Handle<DebugInfo> debug_info,
   return break_points_hit;
 }
 
+void Debug::SetBreakOnNextFunctionCall() {
+  // This method forces V8 to break on next function call regardless current
+  // last_step_action_. If any break happens between SetBreakOnNextFunctionCall
+  // and ClearBreakOnNextFunctionCall, we will clear this flag and stepping. If
+  // break does not happen, e.g. all called functions are blackboxed or no
+  // function is called, then we will clear this flag and let stepping continue
+  // its normal business.
+  thread_local_.break_on_next_function_call_ = true;
+  UpdateHookOnFunctionCall();
+}
+
+void Debug::ClearBreakOnNextFunctionCall() {
+  thread_local_.break_on_next_function_call_ = false;
+  UpdateHookOnFunctionCall();
+}
+
 void Debug::PrepareStepIn(Handle<JSFunction> function) {
-  CHECK(last_step_action() >= StepIn);
+  CHECK(last_step_action() >= StepIn || break_on_next_function_call());
   if (ignore_events()) return;
   if (in_debug_scope()) return;
   if (break_disabled()) return;
-  Handle<SharedFunctionInfo> shared(function->shared());
+  Handle<SharedFunctionInfo> shared(function->shared(), isolate_);
   if (IsBlackboxed(shared)) return;
   if (*function == thread_local_.ignore_step_into_function_) return;
   thread_local_.ignore_step_into_function_ = Smi::kZero;
@@ -909,7 +864,8 @@ void Debug::PrepareStepInSuspendedGenerator() {
   thread_local_.last_step_action_ = StepIn;
   UpdateHookOnFunctionCall();
   Handle<JSFunction> function(
-      JSGeneratorObject::cast(thread_local_.suspended_generator_)->function());
+      JSGeneratorObject::cast(thread_local_.suspended_generator_)->function(),
+      isolate_);
   FloodWithOneShot(Handle<SharedFunctionInfo>(function->shared(), isolate_));
   clear_suspended_generator();
 }
@@ -976,7 +932,7 @@ void Debug::PrepareStepOnThrow() {
           continue;
         }
         Handle<SharedFunctionInfo> info(
-            summary.AsJavaScript().function()->shared());
+            summary.AsJavaScript().function()->shared(), isolate_);
         if (IsBlackboxed(info)) continue;
         FloodWithOneShot(info);
         return;
@@ -1022,11 +978,11 @@ void Debug::PrepareStep(StepAction step_action) {
   // Get the debug info (create it if it does not exist).
   auto summary = FrameSummary::GetTop(frame).AsJavaScript();
   Handle<JSFunction> function(summary.function());
-  Handle<SharedFunctionInfo> shared(function->shared());
+  Handle<SharedFunctionInfo> shared(function->shared(), isolate_);
   if (!EnsureBreakInfo(shared)) return;
   PrepareFunctionForDebugExecution(shared);
 
-  Handle<DebugInfo> debug_info(shared->GetDebugInfo());
+  Handle<DebugInfo> debug_info(shared->GetDebugInfo(), isolate_);
 
   BreakLocation location = BreakLocation::FromFrame(debug_info, js_frame);
 
@@ -1113,23 +1069,23 @@ void Debug::PrepareStep(StepAction step_action) {
 
 // Simple function for returning the source positions for active break points.
 Handle<Object> Debug::GetSourceBreakLocations(
-    Handle<SharedFunctionInfo> shared) {
-  Isolate* isolate = shared->GetIsolate();
+    Isolate* isolate, Handle<SharedFunctionInfo> shared) {
   if (!shared->HasBreakInfo()) {
     return isolate->factory()->undefined_value();
   }
-  Handle<DebugInfo> debug_info(shared->GetDebugInfo());
-  if (debug_info->GetBreakPointCount() == 0) {
+
+  Handle<DebugInfo> debug_info(shared->GetDebugInfo(), isolate);
+  if (debug_info->GetBreakPointCount(isolate) == 0) {
     return isolate->factory()->undefined_value();
   }
-  Handle<FixedArray> locations =
-      isolate->factory()->NewFixedArray(debug_info->GetBreakPointCount());
+  Handle<FixedArray> locations = isolate->factory()->NewFixedArray(
+      debug_info->GetBreakPointCount(isolate));
   int count = 0;
   for (int i = 0; i < debug_info->break_points()->length(); ++i) {
     if (!debug_info->break_points()->get(i)->IsUndefined(isolate)) {
       BreakPointInfo* break_point_info =
           BreakPointInfo::cast(debug_info->break_points()->get(i));
-      int break_points = break_point_info->GetBreakPointCount();
+      int break_points = break_point_info->GetBreakPointCount(isolate);
       if (break_points == 0) continue;
       for (int j = 0; j < break_points; ++j) {
         locations->set(count++,
@@ -1150,6 +1106,7 @@ void Debug::ClearStepping() {
   thread_local_.fast_forward_to_return_ = false;
   thread_local_.last_frame_count_ = -1;
   thread_local_.target_frame_count_ = -1;
+  thread_local_.break_on_next_function_call_ = false;
   UpdateHookOnFunctionCall();
 }
 
@@ -1229,14 +1186,17 @@ void Debug::PrepareFunctionForDebugExecution(
   if (debug_info->flags() & DebugInfo::kPreparedForDebugExecution) return;
 
   // Make a copy of the bytecode array if available.
-  Handle<Object> maybe_debug_bytecode_array =
+  Handle<Object> maybe_original_bytecode_array =
       isolate_->factory()->undefined_value();
   if (shared->HasBytecodeArray()) {
-    Handle<BytecodeArray> original(shared->GetBytecodeArray());
-    maybe_debug_bytecode_array =
-        isolate_->factory()->CopyBytecodeArray(original);
+    Handle<BytecodeArray> original_bytecode_array =
+        handle(shared->GetBytecodeArray(), isolate_);
+    Handle<BytecodeArray> debug_bytecode_array =
+        isolate_->factory()->CopyBytecodeArray(original_bytecode_array);
+    shared->SetDebugBytecodeArray(*debug_bytecode_array);
+    maybe_original_bytecode_array = original_bytecode_array;
   }
-  debug_info->set_debug_bytecode_array(*maybe_debug_bytecode_array);
+  debug_info->set_original_bytecode_array(*maybe_original_bytecode_array);
 
   if (debug_info->CanBreakAtEntry()) {
     // Deopt everything in case the function is inlined anywhere.
@@ -1289,7 +1249,7 @@ void Debug::InstallDebugBreakTrampoline() {
         if (!shared->HasDebugInfo()) continue;
         if (!shared->GetDebugInfo()->CanBreakAtEntry()) continue;
         if (!fun->is_compiled()) {
-          needs_compile.push_back(handle(fun));
+          needs_compile.push_back(handle(fun, isolate_));
         } else {
           fun->set_code(*trampoline);
         }
@@ -1319,7 +1279,7 @@ void GetBreakablePositions(Iterator* it, int start_position, int end_position,
 void FindBreakablePositions(Handle<DebugInfo> debug_info, int start_position,
                             int end_position,
                             std::vector<BreakLocation>* locations) {
-  DCHECK(debug_info->HasDebugBytecodeArray());
+  DCHECK(debug_info->HasInstrumentedBytecodeArray());
   BreakIterator it(debug_info);
   GetBreakablePositions(&it, start_position, end_position, locations);
 }
@@ -1339,7 +1299,7 @@ bool Debug::GetPossibleBreakpoints(Handle<Script> script, int start_position,
     if (!EnsureBreakInfo(shared)) return false;
     PrepareFunctionForDebugExecution(shared);
 
-    Handle<DebugInfo> debug_info(shared->GetDebugInfo());
+    Handle<DebugInfo> debug_info(shared->GetDebugInfo(), isolate_);
     FindBreakablePositions(debug_info, start_position, end_position, locations);
     return true;
   }
@@ -1347,7 +1307,7 @@ bool Debug::GetPossibleBreakpoints(Handle<Script> script, int start_position,
   while (true) {
     HandleScope scope(isolate_);
     std::vector<Handle<SharedFunctionInfo>> candidates;
-    SharedFunctionInfo::ScriptIterator iterator(script);
+    SharedFunctionInfo::ScriptIterator iterator(isolate_, *script);
     for (SharedFunctionInfo* info = iterator.Next(); info != nullptr;
          info = iterator.Next()) {
       if (info->EndPosition() < start_position ||
@@ -1356,7 +1316,7 @@ bool Debug::GetPossibleBreakpoints(Handle<Script> script, int start_position,
       }
       if (!info->IsSubjectToDebugging()) continue;
       if (!info->is_compiled() && !info->allows_lazy_compilation()) continue;
-      candidates.push_back(i::handle(info));
+      candidates.push_back(i::handle(info, isolate_));
     }
 
     bool was_compiled = false;
@@ -1377,7 +1337,7 @@ bool Debug::GetPossibleBreakpoints(Handle<Script> script, int start_position,
 
     for (const auto& candidate : candidates) {
       CHECK(candidate->HasBreakInfo());
-      Handle<DebugInfo> debug_info(candidate->GetDebugInfo());
+      Handle<DebugInfo> debug_info(candidate->GetDebugInfo(), isolate_);
       FindBreakablePositions(debug_info, start_position, end_position,
                              locations);
     }
@@ -1454,7 +1414,7 @@ Handle<Object> Debug::FindSharedFunctionInfoInScript(Handle<Script> script,
     SharedFunctionInfo* shared;
     {
       SharedFunctionInfoFinder finder(position);
-      SharedFunctionInfo::ScriptIterator iterator(script);
+      SharedFunctionInfo::ScriptIterator iterator(isolate_, *script);
       for (SharedFunctionInfo* info = iterator.Next(); info != nullptr;
            info = iterator.Next()) {
         finder.NewCandidate(info);
@@ -1463,7 +1423,7 @@ Handle<Object> Debug::FindSharedFunctionInfoInScript(Handle<Script> script,
       if (shared == nullptr) break;
       // We found it if it's already compiled.
       if (shared->is_compiled()) {
-        Handle<SharedFunctionInfo> shared_handle(shared);
+        Handle<SharedFunctionInfo> shared_handle(shared, isolate_);
         // If the iteration count is larger than 1, we had to compile the outer
         // function in order to create this shared function info. So there can
         // be no JSFunction referencing it. We can anticipate creating a debug
@@ -1479,7 +1439,8 @@ Handle<Object> Debug::FindSharedFunctionInfoInScript(Handle<Script> script,
     HandleScope scope(isolate_);
     // Code that cannot be compiled lazily are internal and not debuggable.
     DCHECK(shared->allows_lazy_compilation());
-    if (!Compiler::Compile(handle(shared), Compiler::CLEAR_EXCEPTION)) break;
+    if (!Compiler::Compile(handle(shared, isolate_), Compiler::CLEAR_EXCEPTION))
+      break;
   }
   return isolate_->factory()->undefined_value();
 }
@@ -1525,11 +1486,11 @@ void Debug::CreateBreakInfo(Handle<SharedFunctionInfo> shared) {
 
 Handle<DebugInfo> Debug::GetOrCreateDebugInfo(
     Handle<SharedFunctionInfo> shared) {
-  if (shared->HasDebugInfo()) return handle(shared->GetDebugInfo());
+  if (shared->HasDebugInfo()) return handle(shared->GetDebugInfo(), isolate_);
 
   // Create debug info and add it to the list.
   Handle<DebugInfo> debug_info = isolate_->factory()->NewDebugInfo(shared);
-  DebugInfoListNode* node = new DebugInfoListNode(*debug_info);
+  DebugInfoListNode* node = new DebugInfoListNode(isolate_, *debug_info);
   node->set_next(debug_info_list_);
   debug_info_list_ = node;
 
@@ -1550,7 +1511,12 @@ void Debug::InstallCoverageInfo(Handle<SharedFunctionInfo> shared,
 
 void Debug::RemoveAllCoverageInfos() {
   ClearAllDebugInfos(
-      [=](Handle<DebugInfo> info) { return info->ClearCoverageInfo(); });
+      [=](Handle<DebugInfo> info) { info->ClearCoverageInfo(isolate_); });
+}
+
+void Debug::ClearAllDebuggerHints() {
+  ClearAllDebugInfos(
+      [=](Handle<DebugInfo> info) { info->set_debugger_hints(0); });
 }
 
 void Debug::FindDebugInfo(Handle<DebugInfo> debug_info,
@@ -1573,7 +1539,8 @@ void Debug::ClearAllDebugInfos(DebugInfoClearFunction clear_function) {
   while (current != nullptr) {
     DebugInfoListNode* next = current->next();
     Handle<DebugInfo> debug_info = current->debug_info();
-    if (clear_function(debug_info)) {
+    clear_function(debug_info);
+    if (debug_info->IsEmpty()) {
       FreeDebugInfoListNode(prev, current);
       current = next;
     } else {
@@ -1584,8 +1551,8 @@ void Debug::ClearAllDebugInfos(DebugInfoClearFunction clear_function) {
 }
 
 void Debug::RemoveBreakInfoAndMaybeFree(Handle<DebugInfo> debug_info) {
-  bool should_unlink = debug_info->ClearBreakInfo();
-  if (should_unlink) {
+  debug_info->ClearBreakInfo(isolate_);
+  if (debug_info->IsEmpty()) {
     DebugInfoListNode* prev;
     DebugInfoListNode* node;
     FindDebugInfo(debug_info, &prev, &node);
@@ -1604,10 +1571,11 @@ void Debug::FreeDebugInfoListNode(DebugInfoListNode* prev,
     prev->set_next(node->next());
   }
 
-  // Pack debugger hints back into the SFI::debug_info field.
+  // Pack function_identifier back into the
+  // SFI::function_identifier_or_debug_info field.
   Handle<DebugInfo> debug_info(node->debug_info());
-  debug_info->shared()->set_debug_info(
-      Smi::FromInt(debug_info->debugger_hints()));
+  debug_info->shared()->set_function_identifier_or_debug_info(
+      debug_info->function_identifier());
 
   delete node;
 }
@@ -1616,13 +1584,13 @@ bool Debug::IsBreakAtReturn(JavaScriptFrame* frame) {
   HandleScope scope(isolate_);
 
   // Get the executing function in which the debug break occurred.
-  Handle<SharedFunctionInfo> shared(frame->function()->shared());
+  Handle<SharedFunctionInfo> shared(frame->function()->shared(), isolate_);
 
   // With no debug info there are no break points, so we can't be at a return.
   if (!shared->HasBreakInfo()) return false;
 
   DCHECK(!frame->is_optimized());
-  Handle<DebugInfo> debug_info(shared->GetDebugInfo());
+  Handle<DebugInfo> debug_info(shared->GetDebugInfo(), isolate_);
   BreakLocation location = BreakLocation::FromFrame(debug_info, frame);
   return location.IsReturn();
 }
@@ -1648,12 +1616,6 @@ void Debug::ScheduleFrameRestart(StackFrame* frame) {
   }
 }
 
-
-bool Debug::IsDebugGlobal(JSGlobalObject* global) {
-  return is_loaded() && global == debug_context()->global_object();
-}
-
-
 Handle<FixedArray> Debug::GetLoadedScripts() {
   isolate_->heap()->CollectAllGarbage(Heap::kFinalizeIncrementalMarkingMask,
                                       GarbageCollectionReason::kDebugger);
@@ -1672,48 +1634,9 @@ Handle<FixedArray> Debug::GetLoadedScripts() {
       if (script->HasValidSource()) results->set(length++, script);
     }
   }
-  results->Shrink(length);
-  return results;
-}
-
-
-MaybeHandle<Object> Debug::MakeExecutionState() {
-  // Create the execution state object.
-  Handle<Object> argv[] = { isolate_->factory()->NewNumberFromInt(break_id()) };
-  return CallFunction("MakeExecutionState", arraysize(argv), argv);
-}
-
-
-MaybeHandle<Object> Debug::MakeExceptionEvent(Handle<Object> exception,
-                                              bool uncaught,
-                                              Handle<Object> promise) {
-  // Create the new exception event object.
-  Handle<Object> argv[] = { isolate_->factory()->NewNumberFromInt(break_id()),
-                            exception,
-                            isolate_->factory()->ToBoolean(uncaught),
-                            promise };
-  return CallFunction("MakeExceptionEvent", arraysize(argv), argv);
-}
-
-
-MaybeHandle<Object> Debug::MakeCompileEvent(Handle<Script> script,
-                                            v8::DebugEvent type) {
-  // Create the compile event object.
-  Handle<Object> script_wrapper = Script::GetWrapper(script);
-  Handle<Object> argv[] = { script_wrapper,
-                            isolate_->factory()->NewNumberFromInt(type) };
-  return CallFunction("MakeCompileEvent", arraysize(argv), argv);
+  return FixedArray::ShrinkOrEmpty(results, length);
 }
 
-MaybeHandle<Object> Debug::MakeAsyncTaskEvent(
-    v8::debug::PromiseDebugActionType type, int id) {
-  // Create the async task event object.
-  Handle<Object> argv[] = {Handle<Smi>(Smi::FromInt(type), isolate_),
-                           Handle<Smi>(Smi::FromInt(id), isolate_)};
-  return CallFunction("MakeAsyncTaskEvent", arraysize(argv), argv);
-}
-
-
 void Debug::OnThrow(Handle<Object> exception) {
   if (in_debug_scope() || ignore_events()) return;
   // Temporarily clear any scheduled_exception to allow evaluating
@@ -1743,17 +1666,6 @@ void Debug::OnPromiseReject(Handle<Object> promise, Handle<Object> value) {
   }
 }
 
-namespace {
-v8::Local<v8::Context> GetDebugEventContext(Isolate* isolate) {
-  Handle<Context> context = isolate->debug()->debugger_entry()->GetContext();
-  // Isolate::context() may have been nullptr when "script collected" event
-  // occurred.
-  if (context.is_null()) return v8::Local<v8::Context>();
-  Handle<Context> native_context(context->native_context());
-  return v8::Utils::ToLocal(native_context);
-}
-}  // anonymous namespace
-
 bool Debug::IsExceptionBlackboxed(bool uncaught) {
   // Uncaught exception is blackboxed if all current frames are blackboxed,
   // caught exception if top frame is blackboxed.
@@ -1776,9 +1688,7 @@ bool Debug::IsFrameBlackboxed(JavaScriptFrame* frame) {
 }
 
 void Debug::OnException(Handle<Object> exception, Handle<Object> promise) {
-  // We cannot generate debug events when JS execution is disallowed.
-  // TODO(5530): Reenable debug events within DisallowJSScopes once relevant
-  // code (MakeExceptionEvent and ProcessDebugEvent) have been moved to C++.
+  // TODO(kozyatinskiy): regress-662674.js test fails on arm without this.
   if (!AllowJavascriptExecution::IsAllowed(isolate_)) return;
 
   Isolate::CatchType catch_type = isolate_->PredictExceptionCatcher();
@@ -1818,20 +1728,14 @@ void Debug::OnException(Handle<Object> exception, Handle<Object> promise) {
   }
 
   DebugScope debug_scope(this);
-  if (debug_scope.failed()) return;
   HandleScope scope(isolate_);
   PostponeInterruptsScope postpone(isolate_);
   DisableBreak no_recursive_break(this);
 
-  // Create the execution state.
-  Handle<Object> exec_state;
-  // Bail out and don't call debugger if exception.
-  if (!MakeExecutionState().ToHandle(&exec_state)) return;
-
-  debug_delegate_->ExceptionThrown(
-      GetDebugEventContext(isolate_),
-      v8::Utils::ToLocal(Handle<JSObject>::cast(exec_state)),
-      v8::Utils::ToLocal(exception), v8::Utils::ToLocal(promise), uncaught);
+  Handle<Context> native_context(isolate_->native_context());
+  debug_delegate_->ExceptionThrown(v8::Utils::ToLocal(native_context),
+                                   v8::Utils::ToLocal(exception),
+                                   v8::Utils::ToLocal(promise), uncaught);
 }
 
 void Debug::OnDebugBreak(Handle<FixedArray> break_points_hit) {
@@ -1850,11 +1754,6 @@ void Debug::OnDebugBreak(Handle<FixedArray> break_points_hit) {
   PostponeInterruptsScope no_interrupts(isolate_);
   DisableBreak no_recursive_break(this);
 
-  // Create the execution state.
-  Handle<Object> exec_state;
-  // Bail out and don't call debugger if exception.
-  if (!MakeExecutionState().ToHandle(&exec_state)) return;
-
   std::vector<int> inspector_break_points_hit;
   int inspector_break_points_count = 0;
   // This array contains breakpoints installed using JS debug API.
@@ -1864,122 +1763,9 @@ void Debug::OnDebugBreak(Handle<FixedArray> break_points_hit) {
     ++inspector_break_points_count;
   }
 
-  debug_delegate_->BreakProgramRequested(
-      GetDebugEventContext(isolate_),
-      v8::Utils::ToLocal(Handle<JSObject>::cast(exec_state)),
-      inspector_break_points_hit);
-}
-
-
-void Debug::OnCompileError(Handle<Script> script) {
-  ProcessCompileEvent(v8::CompileError, script);
-}
-
-
-// Handle debugger actions when a new script is compiled.
-void Debug::OnAfterCompile(Handle<Script> script) {
-  ProcessCompileEvent(v8::AfterCompile, script);
-}
-
-namespace {
-// In an async function, reuse the existing stack related to the outer
-// Promise. Otherwise, e.g. in a direct call to then, save a new stack.
-// Promises with multiple reactions with one or more of them being async
-// functions will not get a good stack trace, as async functions require
-// different stacks from direct Promise use, but we save and restore a
-// stack once for all reactions.
-//
-// If this isn't a case of async function, we return false, otherwise
-// we set the correct id and return true.
-//
-// TODO(littledan): Improve this case.
-int GetReferenceAsyncTaskId(Isolate* isolate, Handle<JSPromise> promise) {
-  Handle<Symbol> handled_by_symbol =
-      isolate->factory()->promise_handled_by_symbol();
-  Handle<Object> handled_by_promise =
-      JSObject::GetDataProperty(promise, handled_by_symbol);
-  if (!handled_by_promise->IsJSPromise()) {
-    return isolate->debug()->NextAsyncTaskId(promise);
-  }
-  Handle<JSPromise> handled_by_promise_js =
-      Handle<JSPromise>::cast(handled_by_promise);
-  Handle<Symbol> async_stack_id_symbol =
-      isolate->factory()->promise_async_stack_id_symbol();
-  Handle<Object> async_task_id =
-      JSObject::GetDataProperty(handled_by_promise_js, async_stack_id_symbol);
-  if (!async_task_id->IsSmi()) {
-    return isolate->debug()->NextAsyncTaskId(promise);
-  }
-  return Handle<Smi>::cast(async_task_id)->value();
-}
-}  //  namespace
-
-void Debug::RunPromiseHook(PromiseHookType hook_type, Handle<JSPromise> promise,
-                           Handle<Object> parent) {
-  if (hook_type == PromiseHookType::kResolve) return;
-  if (in_debug_scope() || ignore_events()) return;
-  if (!debug_delegate_) return;
-  PostponeInterruptsScope no_interrupts(isolate_);
-
-  int id = GetReferenceAsyncTaskId(isolate_, promise);
-  if (hook_type == PromiseHookType::kBefore) {
-    debug_delegate_->PromiseEventOccurred(debug::kDebugWillHandle, id, false);
-  } else if (hook_type == PromiseHookType::kAfter) {
-    debug_delegate_->PromiseEventOccurred(debug::kDebugDidHandle, id, false);
-  } else {
-    DCHECK(hook_type == PromiseHookType::kInit);
-    debug::PromiseDebugActionType type = debug::kDebugPromiseThen;
-    bool last_frame_was_promise_builtin = false;
-    JavaScriptFrameIterator it(isolate_);
-    while (!it.done()) {
-      std::vector<Handle<SharedFunctionInfo>> infos;
-      it.frame()->GetFunctions(&infos);
-      for (size_t i = 1; i <= infos.size(); ++i) {
-        Handle<SharedFunctionInfo> info = infos[infos.size() - i];
-        if (info->IsUserJavaScript()) {
-          // We should not report PromiseThen and PromiseCatch which is called
-          // indirectly, e.g. Promise.all calls Promise.then internally.
-          if (type == debug::kDebugAsyncFunctionPromiseCreated ||
-              last_frame_was_promise_builtin) {
-            debug_delegate_->PromiseEventOccurred(type, id, IsBlackboxed(info));
-          }
-          return;
-        }
-        last_frame_was_promise_builtin = false;
-        if (info->HasBuiltinId()) {
-          if (info->builtin_id() == Builtins::kAsyncFunctionPromiseCreate) {
-            type = debug::kDebugAsyncFunctionPromiseCreated;
-            last_frame_was_promise_builtin = true;
-          } else if (info->builtin_id() == Builtins::kPromisePrototypeThen) {
-            type = debug::kDebugPromiseThen;
-            last_frame_was_promise_builtin = true;
-          } else if (info->builtin_id() == Builtins::kPromisePrototypeCatch) {
-            type = debug::kDebugPromiseCatch;
-            last_frame_was_promise_builtin = true;
-          } else if (info->builtin_id() == Builtins::kPromisePrototypeFinally) {
-            type = debug::kDebugPromiseFinally;
-            last_frame_was_promise_builtin = true;
-          }
-        }
-      }
-      it.Advance();
-    }
-  }
-}
-
-int Debug::NextAsyncTaskId(Handle<JSObject> promise) {
-  LookupIterator it(promise, isolate_->factory()->promise_async_id_symbol());
-  Maybe<bool> maybe = JSReceiver::HasProperty(&it);
-  if (maybe.ToChecked()) {
-    MaybeHandle<Object> result = Object::GetProperty(&it);
-    return Handle<Smi>::cast(result.ToHandleChecked())->value();
-  }
-  Handle<Smi> async_id =
-      handle(Smi::FromInt(++thread_local_.async_task_count_), isolate_);
-  Object::SetProperty(&it, async_id, LanguageMode::kSloppy,
-                      Object::MAY_BE_STORE_FROM_KEYED)
-      .ToChecked();
-  return async_id->value();
+  Handle<Context> native_context(isolate_->native_context());
+  debug_delegate_->BreakProgramRequested(v8::Utils::ToLocal(native_context),
+                                         inspector_break_points_hit);
 }
 
 namespace {
@@ -1998,7 +1784,8 @@ debug::Location GetDebugLocation(Handle<Script> script, int source_position) {
 
 bool Debug::IsBlackboxed(Handle<SharedFunctionInfo> shared) {
   if (!debug_delegate_) return !shared->IsSubjectToDebugging();
-  if (!shared->computed_debug_is_blackboxed()) {
+  Handle<DebugInfo> debug_info = GetOrCreateDebugInfo(shared);
+  if (!debug_info->computed_debug_is_blackboxed()) {
     bool is_blackboxed =
         !shared->IsSubjectToDebugging() || !shared->script()->IsScript();
     if (!is_blackboxed) {
@@ -2007,17 +1794,17 @@ bool Debug::IsBlackboxed(Handle<SharedFunctionInfo> shared) {
       PostponeInterruptsScope no_interrupts(isolate_);
       DisableBreak no_recursive_break(this);
       DCHECK(shared->script()->IsScript());
-      Handle<Script> script(Script::cast(shared->script()));
+      Handle<Script> script(Script::cast(shared->script()), isolate_);
       DCHECK(script->IsUserJavaScript());
       debug::Location start = GetDebugLocation(script, shared->StartPosition());
       debug::Location end = GetDebugLocation(script, shared->EndPosition());
       is_blackboxed = debug_delegate_->IsFunctionBlackboxed(
           ToApiHandle<debug::Script>(script), start, end);
     }
-    shared->set_debug_is_blackboxed(is_blackboxed);
-    shared->set_computed_debug_is_blackboxed(true);
+    debug_info->set_debug_is_blackboxed(is_blackboxed);
+    debug_info->set_computed_debug_is_blackboxed(true);
   }
-  return shared->debug_is_blackboxed();
+  return debug_info->debug_is_blackboxed();
 }
 
 bool Debug::AllFramesOnStackAreBlackboxed() {
@@ -2039,30 +1826,26 @@ bool Debug::CanBreakAtEntry(Handle<SharedFunctionInfo> shared) {
 }
 
 bool Debug::SetScriptSource(Handle<Script> script, Handle<String> source,
-                            bool preview, bool* stack_changed) {
+                            bool preview, debug::LiveEditResult* result) {
   DebugScope debug_scope(this);
-  set_live_edit_enabled(true);
-  Handle<Object> script_wrapper = Script::GetWrapper(script);
-  Handle<Object> argv[] = {script_wrapper, source,
-                           isolate_->factory()->ToBoolean(preview),
-                           isolate_->factory()->NewJSArray(0)};
-  Handle<Object> result;
-  if (!CallFunction("SetScriptSource", arraysize(argv), argv, false)
-           .ToHandle(&result)) {
-    isolate_->OptionalRescheduleException(false);
-    set_live_edit_enabled(false);
-    return false;
-  }
-  set_live_edit_enabled(false);
-  Handle<Object> stack_changed_value =
-      JSReceiver::GetProperty(isolate_, Handle<JSObject>::cast(result),
-                              "stack_modified")
-          .ToHandleChecked();
-  *stack_changed = stack_changed_value->IsTrue(isolate_);
-  return true;
+  running_live_edit_ = true;
+  LiveEdit::PatchScript(isolate_, script, source, preview, result);
+  running_live_edit_ = false;
+  return result->status == debug::LiveEditResult::OK;
 }
 
-void Debug::ProcessCompileEvent(v8::DebugEvent event, Handle<Script> script) {
+void Debug::OnCompileError(Handle<Script> script) {
+  ProcessCompileEvent(true, script);
+}
+
+void Debug::OnAfterCompile(Handle<Script> script) {
+  ProcessCompileEvent(false, script);
+}
+
+void Debug::ProcessCompileEvent(bool has_compile_error, Handle<Script> script) {
+  // TODO(kozyatinskiy): teach devtools to work with liveedit scripts better
+  // first and then remove this fast return.
+  if (running_live_edit_) return;
   // Attach the correct debug id to the script. The debug id is used by the
   // inspector to filter scripts by native context.
   script->set_context_data(isolate_->native_context()->debug_context_id());
@@ -2073,23 +1856,12 @@ void Debug::ProcessCompileEvent(v8::DebugEvent event, Handle<Script> script) {
   if (!debug_delegate_) return;
   SuppressDebug while_processing(this);
   DebugScope debug_scope(this);
-  if (debug_scope.failed()) return;
   HandleScope scope(isolate_);
   PostponeInterruptsScope postpone(isolate_);
   DisableBreak no_recursive_break(this);
   AllowJavascriptExecution allow_script(isolate_);
   debug_delegate_->ScriptCompiled(ToApiHandle<debug::Script>(script),
-                                  live_edit_enabled(),
-                                  event != v8::AfterCompile);
-}
-
-
-Handle<Context> Debug::GetDebugContext() {
-  if (!is_loaded()) return Handle<Context>();
-  DebugScope debug_scope(this);
-  if (debug_scope.failed()) return Handle<Context>();
-  // The global handle may be destroyed soon after.  Return it reboxed.
-  return handle(*debug_context(), isolate_);
+                                  running_live_edit_, has_compile_error);
 }
 
 int Debug::CurrentFrameCount() {
@@ -2113,63 +1885,36 @@ int Debug::CurrentFrameCount() {
   return counter;
 }
 
-void Debug::SetDebugDelegate(debug::DebugDelegate* delegate,
-                             bool pass_ownership) {
-  RemoveDebugDelegate();
+void Debug::SetDebugDelegate(debug::DebugDelegate* delegate) {
   debug_delegate_ = delegate;
-  owns_debug_delegate_ = pass_ownership;
   UpdateState();
 }
 
-void Debug::RemoveDebugDelegate() {
-  if (debug_delegate_ == nullptr) return;
-  if (owns_debug_delegate_) {
-    owns_debug_delegate_ = false;
-    delete debug_delegate_;
-  }
-  debug_delegate_ = nullptr;
-}
-
 void Debug::UpdateState() {
   bool is_active = debug_delegate_ != nullptr;
-  if (is_active || in_debug_scope()) {
+  if (is_active == is_active_) return;
+  if (is_active) {
     // Note that the debug context could have already been loaded to
     // bootstrap test cases.
     isolate_->compilation_cache()->Disable();
-    is_active = Load();
-  } else if (is_loaded()) {
+    is_active = true;
+    feature_tracker()->Track(DebugFeatureTracker::kActive);
+  } else {
     isolate_->compilation_cache()->Enable();
     Unload();
   }
   is_active_ = is_active;
-  isolate_->DebugStateUpdated();
+  if (is_active && isolate_->IsPromiseHookProtectorIntact()) {
+    isolate_->InvalidatePromiseHookProtector();
+  }
 }
 
 void Debug::UpdateHookOnFunctionCall() {
   STATIC_ASSERT(LastStepAction == StepIn);
   hook_on_function_call_ =
       thread_local_.last_step_action_ == StepIn ||
-      isolate_->debug_execution_mode() == DebugInfo::kSideEffects;
-}
-
-MaybeHandle<Object> Debug::Call(Handle<Object> fun, Handle<Object> data) {
-  AllowJavascriptExecutionDebugOnly allow_script(isolate_);
-  DebugScope debug_scope(this);
-  if (debug_scope.failed()) return isolate_->factory()->undefined_value();
-
-  // Create the execution state.
-  Handle<Object> exec_state;
-  if (!MakeExecutionState().ToHandle(&exec_state)) {
-    return isolate_->factory()->undefined_value();
-  }
-
-  Handle<Object> argv[] = { exec_state, data };
-  return Execution::Call(
-      isolate_,
-      fun,
-      Handle<Object>(debug_context()->global_proxy(), isolate_),
-      arraysize(argv),
-      argv);
+      isolate_->debug_execution_mode() == DebugInfo::kSideEffects ||
+      thread_local_.break_on_next_function_call_;
 }
 
 void Debug::HandleDebugBreak(IgnoreBreakMode ignore_break_mode) {
@@ -2196,35 +1941,17 @@ void Debug::HandleDebugBreak(IgnoreBreakMode ignore_break_mode) {
       bool ignore_break = ignore_break_mode == kIgnoreIfTopFrameBlackboxed
                               ? IsBlackboxed(shared)
                               : AllFramesOnStackAreBlackboxed();
-      if (ignore_break) {
-        // Inspector uses pause on next statement for asynchronous breakpoints.
-        // When breakpoint is fired we try to break on first not blackboxed
-        // statement. To achieve this goal we need to deoptimize current
-        // function and don't clear requested DebugBreak even if it's blackboxed
-        // to be able to break on not blackboxed function call.
-        // TODO(yangguo): introduce break_on_function_entry since current
-        // implementation is slow.
-        if (isolate_->stack_guard()->CheckDebugBreak()) {
-          Deoptimizer::DeoptimizeFunction(*function);
-        }
-        return;
-      }
-      JSGlobalObject* global = function->context()->global_object();
-      // Don't stop in debugger functions.
-      if (IsDebugGlobal(global)) return;
+      if (ignore_break) return;
       // Don't stop if the break location is muted.
       if (IsMutedAtCurrentLocation(it.frame())) return;
     }
   }
 
-  isolate_->stack_guard()->ClearDebugBreak();
-
   // Clear stepping to avoid duplicate breaks.
   ClearStepping();
 
   HandleScope scope(isolate_);
   DebugScope debug_scope(this);
-  if (debug_scope.failed()) return;
 
   OnDebugBreak(isolate_->factory()->empty_fixed_array());
 }
@@ -2244,13 +1971,14 @@ void Debug::PrintBreakLocation() {
   PrintF("'.\n");
   if (script_obj->IsScript()) {
     Handle<Script> script = Handle<Script>::cast(script_obj);
-    Handle<String> source(String::cast(script->source()));
+    Handle<String> source(String::cast(script->source()), isolate_);
     Script::InitLineEnds(script);
     int line =
         Script::GetLineNumber(script, source_position) - script->line_offset();
     int column = Script::GetColumnNumber(script, source_position) -
                  (line == 0 ? script->column_offset() : 0);
-    Handle<FixedArray> line_ends(FixedArray::cast(script->line_ends()));
+    Handle<FixedArray> line_ends(FixedArray::cast(script->line_ends()),
+                                 isolate_);
     int line_start = line == 0 ? 0 : Smi::ToInt(line_ends->get(line - 1)) + 1;
     int line_end = Smi::ToInt(line_ends->get(line));
     DisallowHeapAllocation no_gc;
@@ -2271,7 +1999,6 @@ void Debug::PrintBreakLocation() {
 DebugScope::DebugScope(Debug* debug)
     : debug_(debug),
       prev_(debug->debugger_entry()),
-      save_(debug_->isolate_),
       no_termination_exceptons_(debug_->isolate_,
                                 StackGuard::TERMINATE_EXECUTION) {
   // Link recursive debugger entry.
@@ -2291,10 +2018,6 @@ DebugScope::DebugScope(Debug* debug)
   debug_->SetNextBreakId();
 
   debug_->UpdateState();
-  // Make sure that debugger is loaded and enter the debugger context.
-  // The previous context is kept in save_.
-  failed_ = !debug_->is_loaded();
-  if (!failed_) isolate()->set_context(*debug->debug_context());
 }
 
 
@@ -2318,6 +2041,27 @@ ReturnValueScope::~ReturnValueScope() {
   debug_->set_return_value(*return_value_);
 }
 
+void Debug::UpdateDebugInfosForExecutionMode() {
+  // Walk all debug infos and update their execution mode if it is different
+  // from the isolate execution mode.
+  DebugInfoListNode* current = debug_info_list_;
+  while (current != nullptr) {
+    Handle<DebugInfo> debug_info = current->debug_info();
+    if (debug_info->HasInstrumentedBytecodeArray() &&
+        debug_info->DebugExecutionMode() != isolate_->debug_execution_mode()) {
+      DCHECK(debug_info->shared()->HasBytecodeArray());
+      if (isolate_->debug_execution_mode() == DebugInfo::kBreakpoints) {
+        ClearSideEffectChecks(debug_info);
+        ApplyBreakPoints(debug_info);
+      } else {
+        ClearBreakPoints(debug_info);
+        ApplySideEffectChecks(debug_info);
+      }
+    }
+    current = current->next();
+  }
+}
+
 void Debug::StartSideEffectCheckMode() {
   DCHECK(isolate_->debug_execution_mode() != DebugInfo::kSideEffects);
   isolate_->set_debug_execution_mode(DebugInfo::kSideEffects);
@@ -2327,13 +2071,20 @@ void Debug::StartSideEffectCheckMode() {
   DCHECK(!temporary_objects_);
   temporary_objects_.reset(new TemporaryObjectsTracker());
   isolate_->heap()->AddHeapObjectAllocationTracker(temporary_objects_.get());
+  Handle<FixedArray> array(isolate_->native_context()->regexp_last_match_info(),
+                           isolate_);
+  regexp_match_info_ =
+      Handle<RegExpMatchInfo>::cast(isolate_->factory()->CopyFixedArray(array));
+
+  // Update debug infos to have correct execution mode.
+  UpdateDebugInfosForExecutionMode();
 }
 
 void Debug::StopSideEffectCheckMode() {
   DCHECK(isolate_->debug_execution_mode() == DebugInfo::kSideEffects);
   if (side_effect_check_failed_) {
     DCHECK(isolate_->has_pending_exception());
-    DCHECK_EQ(isolate_->heap()->termination_exception(),
+    DCHECK_EQ(ReadOnlyRoots(isolate_).termination_exception(),
               isolate_->pending_exception());
     // Convert the termination exception into a regular exception.
     isolate_->CancelTerminateExecution();
@@ -2347,19 +2098,26 @@ void Debug::StopSideEffectCheckMode() {
   DCHECK(temporary_objects_);
   isolate_->heap()->RemoveHeapObjectAllocationTracker(temporary_objects_.get());
   temporary_objects_.reset();
+  isolate_->native_context()->set_regexp_last_match_info(*regexp_match_info_);
+  regexp_match_info_ = Handle<RegExpMatchInfo>::null();
+
+  // Update debug infos to have correct execution mode.
+  UpdateDebugInfosForExecutionMode();
 }
 
 void Debug::ApplySideEffectChecks(Handle<DebugInfo> debug_info) {
-  DCHECK(debug_info->HasDebugBytecodeArray());
-  Handle<BytecodeArray> debug_bytecode(debug_info->DebugBytecodeArray());
+  DCHECK(debug_info->HasInstrumentedBytecodeArray());
+  Handle<BytecodeArray> debug_bytecode(debug_info->DebugBytecodeArray(),
+                                       isolate_);
   DebugEvaluate::ApplySideEffectChecks(debug_bytecode);
   debug_info->SetDebugExecutionMode(DebugInfo::kSideEffects);
 }
 
 void Debug::ClearSideEffectChecks(Handle<DebugInfo> debug_info) {
-  DCHECK(debug_info->HasDebugBytecodeArray());
-  Handle<BytecodeArray> debug_bytecode(debug_info->DebugBytecodeArray());
-  Handle<BytecodeArray> original(debug_info->OriginalBytecodeArray());
+  DCHECK(debug_info->HasInstrumentedBytecodeArray());
+  Handle<BytecodeArray> debug_bytecode(debug_info->DebugBytecodeArray(),
+                                       isolate_);
+  Handle<BytecodeArray> original(debug_info->OriginalBytecodeArray(), isolate_);
   for (interpreter::BytecodeArrayIterator it(debug_bytecode); !it.done();
        it.Advance()) {
     debug_bytecode->set(it.current_offset(),
@@ -2367,40 +2125,59 @@ void Debug::ClearSideEffectChecks(Handle<DebugInfo> debug_info) {
   }
 }
 
-bool Debug::PerformSideEffectCheck(Handle<JSFunction> function) {
+bool Debug::PerformSideEffectCheck(Handle<JSFunction> function,
+                                   Handle<Object> receiver) {
   DCHECK_EQ(isolate_->debug_execution_mode(), DebugInfo::kSideEffects);
   DisallowJavascriptExecution no_js(isolate_);
   if (!function->is_compiled() &&
       !Compiler::Compile(function, Compiler::KEEP_EXCEPTION)) {
     return false;
   }
-  if (!SharedFunctionInfo::HasNoSideEffect(handle(function->shared()))) {
-    if (FLAG_trace_side_effect_free_debug_evaluate) {
-      PrintF("[debug-evaluate] Function %s failed side effect check.\n",
-             function->shared()->DebugName()->ToCString().get());
-    }
-    side_effect_check_failed_ = true;
-    // Throw an uncatchable termination exception.
-    isolate_->TerminateExecution();
-    return false;
-  }
-  // If function has bytecode array then prepare function for debug execution
-  // to perform runtime side effect checks.
-  if (function->shared()->requires_runtime_side_effect_checks()) {
-    Handle<SharedFunctionInfo> shared(function->shared());
-    DCHECK(shared->is_compiled());
-    if (shared->GetCode() ==
-        isolate_->builtins()->builtin(Builtins::kDeserializeLazy)) {
-      Snapshot::EnsureBuiltinIsDeserialized(isolate_, shared);
+  Handle<SharedFunctionInfo> shared(function->shared(), isolate_);
+  Handle<DebugInfo> debug_info = GetOrCreateDebugInfo(shared);
+  DebugInfo::SideEffectState side_effect_state =
+      debug_info->GetSideEffectState(isolate_);
+  switch (side_effect_state) {
+    case DebugInfo::kHasSideEffects:
+      if (FLAG_trace_side_effect_free_debug_evaluate) {
+        PrintF("[debug-evaluate] Function %s failed side effect check.\n",
+               function->shared()->DebugName()->ToCString().get());
+      }
+      side_effect_check_failed_ = true;
+      // Throw an uncatchable termination exception.
+      isolate_->TerminateExecution();
+      return false;
+    case DebugInfo::kRequiresRuntimeChecks: {
+      if (!shared->HasBytecodeArray()) {
+        return PerformSideEffectCheckForObject(receiver);
+      }
+      // If function has bytecode array then prepare function for debug
+      // execution to perform runtime side effect checks.
+      DCHECK(shared->is_compiled());
+      if (shared->GetCode() ==
+          isolate_->builtins()->builtin(Builtins::kDeserializeLazy)) {
+        Snapshot::EnsureBuiltinIsDeserialized(isolate_, shared);
+      }
+      PrepareFunctionForDebugExecution(shared);
+      ApplySideEffectChecks(debug_info);
+      return true;
     }
-    GetOrCreateDebugInfo(shared);
-    PrepareFunctionForDebugExecution(shared);
+    case DebugInfo::kHasNoSideEffect:
+      return true;
+    case DebugInfo::kNotComputed:
+      UNREACHABLE();
+      return false;
   }
-  return true;
+  UNREACHABLE();
+  return false;
 }
 
 bool Debug::PerformSideEffectCheckForCallback(Handle<Object> callback_info) {
   DCHECK_EQ(isolate_->debug_execution_mode(), DebugInfo::kSideEffects);
+  if (!callback_info.is_null() && callback_info->IsCallHandlerInfo() &&
+      i::CallHandlerInfo::cast(*callback_info)->NextCallHasNoSideEffect()) {
+    return true;
+  }
   // TODO(7515): always pass a valid callback info object.
   if (!callback_info.is_null() &&
       DebugEvaluate::CallbackHasNoSideEffect(*callback_info)) {
@@ -2420,8 +2197,8 @@ bool Debug::PerformSideEffectCheckAtBytecode(InterpretedFrame* frame) {
   SharedFunctionInfo* shared = frame->function()->shared();
   BytecodeArray* bytecode_array = shared->GetBytecodeArray();
   int offset = frame->GetBytecodeOffset();
-  interpreter::BytecodeArrayAccessor bytecode_accessor(handle(bytecode_array),
-                                                       offset);
+  interpreter::BytecodeArrayAccessor bytecode_accessor(
+      handle(bytecode_array, isolate_), offset);
 
   Bytecode bytecode = bytecode_accessor.current_bytecode();
   interpreter::Register reg;
@@ -2435,131 +2212,24 @@ bool Debug::PerformSideEffectCheckAtBytecode(InterpretedFrame* frame) {
   }
   Handle<Object> object =
       handle(frame->ReadInterpreterRegister(reg.index()), isolate_);
+  return PerformSideEffectCheckForObject(object);
+}
+
+bool Debug::PerformSideEffectCheckForObject(Handle<Object> object) {
+  DCHECK_EQ(isolate_->debug_execution_mode(), DebugInfo::kSideEffects);
+
   if (object->IsHeapObject()) {
-    Address address = Handle<HeapObject>::cast(object)->address();
-    if (temporary_objects_->HasObject(address)) {
+    if (temporary_objects_->HasObject(Handle<HeapObject>::cast(object))) {
       return true;
     }
   }
   if (FLAG_trace_side_effect_free_debug_evaluate) {
-    PrintF("[debug-evaluate] %s failed runtime side effect check.\n",
-           interpreter::Bytecodes::ToString(bytecode));
+    PrintF("[debug-evaluate] failed runtime side effect check.\n");
   }
   side_effect_check_failed_ = true;
   // Throw an uncatchable termination exception.
   isolate_->TerminateExecution();
   return false;
 }
-
-void LegacyDebugDelegate::PromiseEventOccurred(
-    v8::debug::PromiseDebugActionType type, int id, bool is_blackboxed) {
-  DebugScope debug_scope(isolate_->debug());
-  if (debug_scope.failed()) return;
-  HandleScope scope(isolate_);
-  Handle<Object> event_data;
-  if (isolate_->debug()->MakeAsyncTaskEvent(type, id).ToHandle(&event_data)) {
-    ProcessDebugEvent(v8::AsyncTaskEvent, Handle<JSObject>::cast(event_data));
-  }
-}
-
-void LegacyDebugDelegate::ScriptCompiled(v8::Local<v8::debug::Script> script,
-                                         bool is_live_edited,
-                                         bool is_compile_error) {
-  Handle<Object> event_data;
-  v8::DebugEvent event = is_compile_error ? v8::CompileError : v8::AfterCompile;
-  if (isolate_->debug()
-          ->MakeCompileEvent(v8::Utils::OpenHandle(*script), event)
-          .ToHandle(&event_data)) {
-    ProcessDebugEvent(event, Handle<JSObject>::cast(event_data));
-  }
-}
-
-void LegacyDebugDelegate::BreakProgramRequested(
-    v8::Local<v8::Context> paused_context, v8::Local<v8::Object> exec_state,
-    const std::vector<debug::BreakpointId>&) {
-  ProcessDebugEvent(v8::Break, isolate_->factory()->NewJSObjectWithNullProto(),
-                    Handle<JSObject>::cast(v8::Utils::OpenHandle(*exec_state)));
-}
-
-void LegacyDebugDelegate::ExceptionThrown(v8::Local<v8::Context> paused_context,
-                                          v8::Local<v8::Object> exec_state,
-                                          v8::Local<v8::Value> exception,
-                                          v8::Local<v8::Value> promise,
-                                          bool is_uncaught) {
-  Handle<Object> event_data;
-  if (isolate_->debug()
-          ->MakeExceptionEvent(v8::Utils::OpenHandle(*exception), is_uncaught,
-                               v8::Utils::OpenHandle(*promise))
-          .ToHandle(&event_data)) {
-    ProcessDebugEvent(
-        v8::Exception, Handle<JSObject>::cast(event_data),
-        Handle<JSObject>::cast(v8::Utils::OpenHandle(*exec_state)));
-  }
-}
-
-void LegacyDebugDelegate::ProcessDebugEvent(v8::DebugEvent event,
-                                            Handle<JSObject> event_data) {
-  Handle<Object> exec_state;
-  if (isolate_->debug()->MakeExecutionState().ToHandle(&exec_state)) {
-    ProcessDebugEvent(event, event_data, Handle<JSObject>::cast(exec_state));
-  }
-}
-
-NativeDebugDelegate::NativeDebugDelegate(Isolate* isolate,
-                                         v8::Debug::EventCallback callback,
-                                         Handle<Object> data)
-    : LegacyDebugDelegate(isolate), callback_(callback) {
-  data_ = isolate->global_handles()->Create(*data);
-}
-
-NativeDebugDelegate::~NativeDebugDelegate() {
-  GlobalHandles::Destroy(data_.location());
-}
-
-NativeDebugDelegate::EventDetails::EventDetails(DebugEvent event,
-                                                Handle<JSObject> exec_state,
-                                                Handle<JSObject> event_data,
-                                                Handle<Object> callback_data)
-    : event_(event),
-      exec_state_(exec_state),
-      event_data_(event_data),
-      callback_data_(callback_data) {}
-
-DebugEvent NativeDebugDelegate::EventDetails::GetEvent() const {
-  return event_;
-}
-
-v8::Local<v8::Object> NativeDebugDelegate::EventDetails::GetExecutionState()
-    const {
-  return v8::Utils::ToLocal(exec_state_);
-}
-
-v8::Local<v8::Object> NativeDebugDelegate::EventDetails::GetEventData() const {
-  return v8::Utils::ToLocal(event_data_);
-}
-
-v8::Local<v8::Context> NativeDebugDelegate::EventDetails::GetEventContext()
-    const {
-  return GetDebugEventContext(exec_state_->GetIsolate());
-}
-
-v8::Local<v8::Value> NativeDebugDelegate::EventDetails::GetCallbackData()
-    const {
-  return v8::Utils::ToLocal(callback_data_);
-}
-
-v8::Isolate* NativeDebugDelegate::EventDetails::GetIsolate() const {
-  return reinterpret_cast<v8::Isolate*>(exec_state_->GetIsolate());
-}
-
-void NativeDebugDelegate::ProcessDebugEvent(v8::DebugEvent event,
-                                            Handle<JSObject> event_data,
-                                            Handle<JSObject> exec_state) {
-  EventDetails event_details(event, exec_state, event_data, data_);
-  Isolate* isolate = isolate_;
-  callback_(event_details);
-  CHECK(!isolate->has_scheduled_exception());
-}
-
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/src/debug/debug.h b/deps/v8/src/debug/debug.h
index 035a4809192f08..31881fe10696ab 100644
--- a/deps/v8/src/debug/debug.h
+++ b/deps/v8/src/debug/debug.h
@@ -31,7 +31,6 @@ namespace internal {
 // Forward declarations.
 class DebugScope;
 
-
 // Step actions. NOTE: These values are in macros.py as well.
 enum StepAction : int8_t {
   StepNone = -1,  // Stepping not prepared.
@@ -87,7 +86,7 @@ class BreakLocation {
     return result;
   }
 
-  bool HasBreakPoint(Handle<DebugInfo> debug_info) const;
+  bool HasBreakPoint(Isolate* isolate, Handle<DebugInfo> debug_info) const;
 
   inline int position() const { return position_; }
 
@@ -171,7 +170,7 @@ class BreakIterator {
 // weak handles to avoid a debug info object to keep a function alive.
 class DebugInfoListNode {
  public:
-  explicit DebugInfoListNode(DebugInfo* debug_info);
+  DebugInfoListNode(Isolate* isolate, DebugInfo* debug_info);
   ~DebugInfoListNode();
 
   DebugInfoListNode* next() { return next_; }
@@ -225,13 +224,8 @@ class Debug {
   void OnCompileError(Handle<Script> script);
   void OnAfterCompile(Handle<Script> script);
 
-  V8_WARN_UNUSED_RESULT MaybeHandle<Object> Call(Handle<Object> fun,
-                                                 Handle<Object> data);
-  Handle<Context> GetDebugContext();
   void HandleDebugBreak(IgnoreBreakMode ignore_break_mode);
 
-  // Internal logic
-  bool Load();
   // The break target may not be the top-most frame, since we may be
   // breaking before entering a function that cannot contain break points.
   void Break(JavaScriptFrame* frame, Handle<JSFunction> break_target);
@@ -264,7 +258,9 @@ class Debug {
   void PrepareStepInSuspendedGenerator();
   void PrepareStepOnThrow();
   void ClearStepping();
-  void ClearStepOut();
+
+  void SetBreakOnNextFunctionCall();
+  void ClearBreakOnNextFunctionCall();
 
   void DeoptimizeFunction(Handle<SharedFunctionInfo> shared);
   void PrepareFunctionForDebugExecution(Handle<SharedFunctionInfo> shared);
@@ -273,16 +269,11 @@ class Debug {
                               int end_position, bool restrict_to_function,
                               std::vector<BreakLocation>* locations);
 
-  void RunPromiseHook(PromiseHookType hook_type, Handle<JSPromise> promise,
-                      Handle<Object> parent);
-
-  int NextAsyncTaskId(Handle<JSObject> promise);
-
   bool IsBlackboxed(Handle<SharedFunctionInfo> shared);
 
   bool CanBreakAtEntry(Handle<SharedFunctionInfo> shared);
 
-  void SetDebugDelegate(debug::DebugDelegate* delegate, bool pass_ownership);
+  void SetDebugDelegate(debug::DebugDelegate* delegate);
 
   // Returns whether the operation succeeded.
   bool EnsureBreakInfo(Handle<SharedFunctionInfo> shared);
@@ -293,18 +284,12 @@ class Debug {
                            Handle<CoverageInfo> coverage_info);
   void RemoveAllCoverageInfos();
 
-  template <typename C>
-  bool CompileToRevealInnerFunctions(C* compilable);
-
   // This function is used in FunctionNameUsing* tests.
   Handle<Object> FindSharedFunctionInfoInScript(Handle<Script> script,
                                                 int position);
 
   static Handle<Object> GetSourceBreakLocations(
-      Handle<SharedFunctionInfo> shared);
-
-  // Check whether a global object is the debug global object.
-  bool IsDebugGlobal(JSGlobalObject* global);
+      Isolate* isolate, Handle<SharedFunctionInfo> shared);
 
   // Check whether this frame is just about to return.
   bool IsBreakAtReturn(JavaScriptFrame* frame);
@@ -319,7 +304,9 @@ class Debug {
   // change. stack_changed is true if after editing script on pause stack is
   // changed and client should request stack trace again.
   bool SetScriptSource(Handle<Script> script, Handle<String> source,
-                       bool preview, bool* stack_changed);
+                       bool preview, debug::LiveEditResult* result);
+
+  int GetFunctionDebuggingId(Handle<JSFunction> function);
 
   // Threading support.
   char* ArchiveDebug(char* to);
@@ -328,16 +315,7 @@ class Debug {
   void FreeThreadResources() { }
   void Iterate(RootVisitor* v);
 
-  bool CheckExecutionState(int id) {
-    return CheckExecutionState() && break_id() == id;
-  }
-
-  bool CheckExecutionState() {
-    return is_active() && !debug_context().is_null() && break_id() != 0;
-  }
-
-  // Apply proper instrumentation depends on debug_execution_mode.
-  void ApplyInstrumentation(Handle<SharedFunctionInfo> shared);
+  bool CheckExecutionState() { return is_active() && break_id() != 0; }
 
   void StartSideEffectCheckMode();
   void StopSideEffectCheckMode();
@@ -345,24 +323,19 @@ class Debug {
   void ApplySideEffectChecks(Handle<DebugInfo> debug_info);
   void ClearSideEffectChecks(Handle<DebugInfo> debug_info);
 
-  bool PerformSideEffectCheck(Handle<JSFunction> function);
+  bool PerformSideEffectCheck(Handle<JSFunction> function,
+                              Handle<Object> receiver);
   bool PerformSideEffectCheckForCallback(Handle<Object> callback_info);
   bool PerformSideEffectCheckAtBytecode(InterpretedFrame* frame);
+  bool PerformSideEffectCheckForObject(Handle<Object> object);
 
   // Flags and states.
   DebugScope* debugger_entry() {
     return reinterpret_cast<DebugScope*>(
         base::Relaxed_Load(&thread_local_.current_debug_scope_));
   }
-  inline Handle<Context> debug_context() { return debug_context_; }
-
-  void set_live_edit_enabled(bool v) { live_edit_enabled_ = v; }
-  bool live_edit_enabled() const {
-    return FLAG_enable_liveedit && live_edit_enabled_;
-  }
 
   inline bool is_active() const { return is_active_; }
-  inline bool is_loaded() const { return !debug_context_.is_null(); }
   inline bool in_debug_scope() const {
     return !!base::Relaxed_Load(&thread_local_.current_debug_scope_);
   }
@@ -391,10 +364,6 @@ class Debug {
     return reinterpret_cast<Address>(&hook_on_function_call_);
   }
 
-  Address last_step_action_address() {
-    return reinterpret_cast<Address>(&thread_local_.last_step_action_);
-  }
-
   Address suspended_generator_address() {
     return reinterpret_cast<Address>(&thread_local_.suspended_generator_);
   }
@@ -404,6 +373,9 @@ class Debug {
   }
 
   StepAction last_step_action() { return thread_local_.last_step_action_; }
+  bool break_on_next_function_call() const {
+    return thread_local_.break_on_next_function_call_;
+  }
 
   DebugFeatureTracker* feature_tracker() { return &feature_tracker_; }
 
@@ -411,13 +383,15 @@ class Debug {
   // source position for break points.
   static const int kBreakAtEntryPosition = 0;
 
+  void RemoveBreakInfoAndMaybeFree(Handle<DebugInfo> debug_info);
+
  private:
   explicit Debug(Isolate* isolate);
   ~Debug();
 
+  void UpdateDebugInfosForExecutionMode();
   void UpdateState();
   void UpdateHookOnFunctionCall();
-  void RemoveDebugDelegate();
   void Unload();
   void SetNextBreakId() {
     thread_local_.break_id_ = ++thread_local_.break_count_;
@@ -444,17 +418,7 @@ class Debug {
 
   void OnException(Handle<Object> exception, Handle<Object> promise);
 
-  // Constructors for debug event objects.
-  V8_WARN_UNUSED_RESULT MaybeHandle<Object> MakeExecutionState();
-  V8_WARN_UNUSED_RESULT MaybeHandle<Object> MakeExceptionEvent(
-      Handle<Object> exception, bool uncaught, Handle<Object> promise);
-  V8_WARN_UNUSED_RESULT MaybeHandle<Object> MakeCompileEvent(
-      Handle<Script> script, v8::DebugEvent type);
-  V8_WARN_UNUSED_RESULT MaybeHandle<Object> MakeAsyncTaskEvent(
-      v8::debug::PromiseDebugActionType type, int id);
-
-  void ProcessCompileEvent(v8::DebugEvent event, Handle<Script> script);
-  void ProcessDebugEvent(v8::DebugEvent event, Handle<JSObject> event_data);
+  void ProcessCompileEvent(bool has_compile_error, Handle<Script> script);
 
   // Find the closest source position for a break point for a given position.
   int FindBreakablePosition(Handle<DebugInfo> debug_info, int source_position);
@@ -480,12 +444,8 @@ class Debug {
   // Check whether a BreakPoint object is hit. Evaluate condition depending
   // on whether this is a regular break location or a break at function entry.
   bool CheckBreakPoint(Handle<BreakPoint> break_point, bool is_break_at_entry);
-  MaybeHandle<Object> CallFunction(const char* name, int argc,
-                                   Handle<Object> args[],
-                                   bool catch_exceptions = true);
 
   inline void AssertDebugContext() {
-    DCHECK(isolate_->context() == *debug_context());
     DCHECK(in_debug_scope());
   }
 
@@ -493,20 +453,17 @@ class Debug {
 
   void PrintBreakLocation();
 
+  void ClearAllDebuggerHints();
+
   // Wraps logic for clearing and maybe freeing all debug infos.
-  typedef std::function<bool(Handle<DebugInfo>)> DebugInfoClearFunction;
+  typedef std::function<void(Handle<DebugInfo>)> DebugInfoClearFunction;
   void ClearAllDebugInfos(DebugInfoClearFunction clear_function);
 
-  void RemoveBreakInfoAndMaybeFree(Handle<DebugInfo> debug_info);
   void FindDebugInfo(Handle<DebugInfo> debug_info, DebugInfoListNode** prev,
                      DebugInfoListNode** curr);
   void FreeDebugInfoListNode(DebugInfoListNode* prev, DebugInfoListNode* node);
 
-  // Global handles.
-  Handle<Context> debug_context_;
-
   debug::DebugDelegate* debug_delegate_ = nullptr;
-  bool owns_debug_delegate_ = false;
 
   // Debugger is active, i.e. there is a debug event listener attached.
   bool is_active_;
@@ -515,8 +472,8 @@ class Debug {
   bool hook_on_function_call_;
   // Suppress debug events.
   bool is_suppressed_;
-  // LiveEdit is enabled.
-  bool live_edit_enabled_;
+  // Running liveedit.
+  bool running_live_edit_ = false;
   // Do not trigger debug break events.
   bool break_disabled_;
   // Do not break on break points.
@@ -535,6 +492,8 @@ class Debug {
   class TemporaryObjectsTracker;
   std::unique_ptr<TemporaryObjectsTracker> temporary_objects_;
 
+  Handle<RegExpMatchInfo> regexp_match_info_;
+
   // Used to collect histogram data on debugger feature usage.
   DebugFeatureTracker feature_tracker_;
 
@@ -581,10 +540,12 @@ class Debug {
     // The new frame pointer to drop to when restarting a frame.
     Address restart_fp_;
 
-    int async_task_count_;
-
     // Last used inspector breakpoint id.
     int last_breakpoint_id_;
+
+    // This flag is true when SetBreakOnNextFunctionCall is called and it forces
+    // debugger to break on next function call.
+    bool break_on_next_function_call_;
   };
 
   // Storage location for registers when handling debug break calls
@@ -597,8 +558,6 @@ class Debug {
   friend class DisableBreak;
   friend class LiveEdit;
   friend class SuppressDebug;
-  friend class NoSideEffectScope;
-  friend class LegacyDebugDelegate;
 
   friend Handle<FixedArray> GetDebuggedFunctions();  // In test-debug.cc
   friend void CheckDebuggerUnloaded();               // In test-debug.cc
@@ -606,84 +565,13 @@ class Debug {
   DISALLOW_COPY_AND_ASSIGN(Debug);
 };
 
-class LegacyDebugDelegate : public v8::debug::DebugDelegate {
- public:
-  explicit LegacyDebugDelegate(Isolate* isolate) : isolate_(isolate) {}
-  void PromiseEventOccurred(v8::debug::PromiseDebugActionType type, int id,
-                            bool is_blackboxed) override;
-  void ScriptCompiled(v8::Local<v8::debug::Script> script, bool is_live_edited,
-                      bool has_compile_error) override;
-  void BreakProgramRequested(v8::Local<v8::Context> paused_context,
-                             v8::Local<v8::Object> exec_state,
-                             const std::vector<debug::BreakpointId>&) override;
-  void ExceptionThrown(v8::Local<v8::Context> paused_context,
-                       v8::Local<v8::Object> exec_state,
-                       v8::Local<v8::Value> exception,
-                       v8::Local<v8::Value> promise, bool is_uncaught) override;
-  bool IsFunctionBlackboxed(v8::Local<v8::debug::Script> script,
-                            const v8::debug::Location& start,
-                            const v8::debug::Location& end) override {
-    return false;
-  }
-
- protected:
-  Isolate* isolate_;
-
- private:
-  void ProcessDebugEvent(v8::DebugEvent event, Handle<JSObject> event_data);
-  virtual void ProcessDebugEvent(v8::DebugEvent event,
-                                 Handle<JSObject> event_data,
-                                 Handle<JSObject> exec_state) = 0;
-};
-
-class NativeDebugDelegate : public LegacyDebugDelegate {
- public:
-  NativeDebugDelegate(Isolate* isolate, v8::Debug::EventCallback callback,
-                      Handle<Object> data);
-  virtual ~NativeDebugDelegate();
-
- private:
-  // Details of the debug event delivered to the debug event listener.
-  class EventDetails : public v8::Debug::EventDetails {
-   public:
-    EventDetails(DebugEvent event, Handle<JSObject> exec_state,
-                 Handle<JSObject> event_data, Handle<Object> callback_data);
-    virtual DebugEvent GetEvent() const;
-    virtual v8::Local<v8::Object> GetExecutionState() const;
-    virtual v8::Local<v8::Object> GetEventData() const;
-    virtual v8::Local<v8::Context> GetEventContext() const;
-    virtual v8::Local<v8::Value> GetCallbackData() const;
-    virtual v8::Isolate* GetIsolate() const;
-
-   private:
-    DebugEvent event_;              // Debug event causing the break.
-    Handle<JSObject> exec_state_;   // Current execution state.
-    Handle<JSObject> event_data_;   // Data associated with the event.
-    Handle<Object> callback_data_;  // User data passed with the callback
-                                    // when it was registered.
-  };
-
-  void ProcessDebugEvent(v8::DebugEvent event, Handle<JSObject> event_data,
-                         Handle<JSObject> exec_state) override;
-
-  v8::Debug::EventCallback callback_;
-  Handle<Object> data_;
-};
-
 // This scope is used to load and enter the debug context and create a new
 // break state.  Leaving the scope will restore the previous state.
-// On failure to load, FailedToEnter returns true.
 class DebugScope BASE_EMBEDDED {
  public:
   explicit DebugScope(Debug* debug);
   ~DebugScope();
 
-  // Check whether loading was successful.
-  inline bool failed() { return failed_; }
-
-  // Get the active context from before entering the debugger.
-  inline Handle<Context> GetContext() { return save_.context(); }
-
  private:
   Isolate* isolate() { return debug_->isolate_; }
 
@@ -691,8 +579,6 @@ class DebugScope BASE_EMBEDDED {
   DebugScope* prev_;               // Previous scope if entered recursively.
   StackFrame::Id break_frame_id_;  // Previous break frame id.
   int break_id_;                   // Previous break id.
-  bool failed_;                    // Did the debug context fail to load?
-  SaveContext save_;               // Saves previous context.
   PostponeInterruptsScope no_termination_exceptons_;
 };
 
diff --git a/deps/v8/src/debug/debug.js b/deps/v8/src/debug/debug.js
deleted file mode 100644
index 97a0886ca78ff4..00000000000000
--- a/deps/v8/src/debug/debug.js
+++ /dev/null
@@ -1,379 +0,0 @@
-// Copyright 2012 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-(function (global, utils) {
-"use strict";
-
-// ----------------------------------------------------------------------------
-// Imports
-
-var FrameMirror = global.FrameMirror;
-var GlobalArray = global.Array;
-var GlobalRegExp = global.RegExp;
-var IsNaN = global.isNaN;
-var MakeMirror = global.MakeMirror;
-var MathMin = global.Math.min;
-var Mirror = global.Mirror;
-var ValueMirror = global.ValueMirror;
-
-//----------------------------------------------------------------------------
-
-var Debug = {};
-
-// Debug events which can occur in the V8 JavaScript engine. These originate
-// from the API include file debug.h.
-Debug.DebugEvent = { Break: 1,
-                     Exception: 2,
-                     AfterCompile: 3,
-                     CompileError: 4,
-                     AsyncTaskEvent: 5 };
-
-// Types of exceptions that can be broken upon.
-Debug.ExceptionBreak = { Caught : 0,
-                         Uncaught: 1 };
-
-// The different types of steps.
-Debug.StepAction = { StepOut: 0,
-                     StepNext: 1,
-                     StepIn: 2 };
-
-// The different types of scripts matching enum ScriptType in objects.h.
-Debug.ScriptType = { Native: 0,
-                     Extension: 1,
-                     Normal: 2,
-                     Wasm: 3};
-
-// The different types of script compilations matching enum
-// Script::CompilationType in objects.h.
-Debug.ScriptCompilationType = { Host: 0,
-                                Eval: 1,
-                                JSON: 2 };
-
-function ScriptTypeFlag(type) {
-  return (1 << type);
-}
-
-// Globals.
-var debugger_flags = {
-  breakOnCaughtException: {
-    getValue: function() { return Debug.isBreakOnException(); },
-    setValue: function(value) {
-      if (value) {
-        Debug.setBreakOnException();
-      } else {
-        Debug.clearBreakOnException();
-      }
-    }
-  },
-  breakOnUncaughtException: {
-    getValue: function() { return Debug.isBreakOnUncaughtException(); },
-    setValue: function(value) {
-      if (value) {
-        Debug.setBreakOnUncaughtException();
-      } else {
-        Debug.clearBreakOnUncaughtException();
-      }
-    }
-  },
-};
-
-
-// Returns a Script object. If the parameter is a function the return value
-// is the script in which the function is defined. If the parameter is a string
-// the return value is the script for which the script name has that string
-// value.  If it is a regexp and there is a unique script whose name matches
-// we return that, otherwise undefined.
-Debug.findScript = function(func_or_script_name) {
-  if (IS_FUNCTION(func_or_script_name)) {
-    return %FunctionGetScript(func_or_script_name);
-  } else if (%IsRegExp(func_or_script_name)) {
-    var scripts = this.scripts();
-    var last_result = null;
-    var result_count = 0;
-    for (var i in scripts) {
-      var script = scripts[i];
-      if (func_or_script_name.test(script.name)) {
-        last_result = script;
-        result_count++;
-      }
-    }
-    // Return the unique script matching the regexp.  If there are more
-    // than one we don't return a value since there is no good way to
-    // decide which one to return.  Returning a "random" one, say the
-    // first, would introduce nondeterminism (or something close to it)
-    // because the order is the heap iteration order.
-    if (result_count == 1) {
-      return last_result;
-    } else {
-      return UNDEFINED;
-    }
-  } else {
-    return %GetScript(func_or_script_name);
-  }
-};
-
-// Returns the script source. If the parameter is a function the return value
-// is the script source for the script in which the function is defined. If the
-// parameter is a string the return value is the script for which the script
-// name has that string value.
-Debug.scriptSource = function(func_or_script_name) {
-  return this.findScript(func_or_script_name).source;
-};
-
-
-Debug.source = function(f) {
-  if (!IS_FUNCTION(f)) throw %make_type_error(kDebuggerType);
-  return %FunctionGetSourceCode(f);
-};
-
-
-Debug.sourcePosition = function(f) {
-  if (!IS_FUNCTION(f)) throw %make_type_error(kDebuggerType);
-  return %FunctionGetScriptSourcePosition(f);
-};
-
-
-Debug.findFunctionSourceLocation = function(func, opt_line, opt_column) {
-  var script = %FunctionGetScript(func);
-  var script_offset = %FunctionGetScriptSourcePosition(func);
-  return %ScriptLocationFromLine(script, opt_line, opt_column, script_offset);
-};
-
-
-// Returns the character position in a script based on a line number and an
-// optional position within that line.
-Debug.findScriptSourcePosition = function(script, opt_line, opt_column) {
-  var location = %ScriptLocationFromLine(script, opt_line, opt_column, 0);
-  return location ? location.position : null;
-};
-
-Debug.clearStepping = function() {
-  %ClearStepping();
-};
-
-Debug.setBreakOnException = function() {
-  return %ChangeBreakOnException(Debug.ExceptionBreak.Caught, true);
-};
-
-Debug.clearBreakOnException = function() {
-  return %ChangeBreakOnException(Debug.ExceptionBreak.Caught, false);
-};
-
-Debug.isBreakOnException = function() {
-  return !!%IsBreakOnException(Debug.ExceptionBreak.Caught);
-};
-
-Debug.setBreakOnUncaughtException = function() {
-  return %ChangeBreakOnException(Debug.ExceptionBreak.Uncaught, true);
-};
-
-Debug.clearBreakOnUncaughtException = function() {
-  return %ChangeBreakOnException(Debug.ExceptionBreak.Uncaught, false);
-};
-
-Debug.isBreakOnUncaughtException = function() {
-  return !!%IsBreakOnException(Debug.ExceptionBreak.Uncaught);
-};
-
-// Get all the scripts currently loaded. Locating all the scripts is based on
-// scanning the heap.
-Debug.scripts = function() {
-  // Collect all scripts in the heap.
-  return %DebugGetLoadedScripts();
-};
-
-
-// Get a specific script currently loaded. This is based on scanning the heap.
-// TODO(clemensh): Create a runtime function for this.
-function scriptById(scriptId) {
-  var scripts = Debug.scripts();
-  for (var script of scripts) {
-    if (script.id == scriptId) return script;
-  }
-  return UNDEFINED;
-};
-
-
-Debug.debuggerFlags = function() {
-  return debugger_flags;
-};
-
-Debug.MakeMirror = MakeMirror;
-
-function MakeExecutionState(break_id) {
-  return new ExecutionState(break_id);
-}
-
-function ExecutionState(break_id) {
-  this.break_id = break_id;
-  this.selected_frame = 0;
-}
-
-ExecutionState.prototype.prepareStep = function(action) {
-  if (action === Debug.StepAction.StepIn ||
-      action === Debug.StepAction.StepOut ||
-      action === Debug.StepAction.StepNext) {
-    return %PrepareStep(this.break_id, action);
-  }
-  throw %make_type_error(kDebuggerType);
-};
-
-ExecutionState.prototype.evaluateGlobal = function(source) {
-  return MakeMirror(%DebugEvaluateGlobal(this.break_id, source));
-};
-
-ExecutionState.prototype.frameCount = function() {
-  return %GetFrameCount(this.break_id);
-};
-
-ExecutionState.prototype.frame = function(opt_index) {
-  // If no index supplied return the selected frame.
-  if (opt_index == null) opt_index = this.selected_frame;
-  if (opt_index < 0 || opt_index >= this.frameCount()) {
-    throw %make_type_error(kDebuggerFrame);
-  }
-  return new FrameMirror(this.break_id, opt_index);
-};
-
-ExecutionState.prototype.setSelectedFrame = function(index) {
-  var i = TO_NUMBER(index);
-  if (i < 0 || i >= this.frameCount()) {
-    throw %make_type_error(kDebuggerFrame);
-  }
-  this.selected_frame = i;
-};
-
-ExecutionState.prototype.selectedFrame = function() {
-  return this.selected_frame;
-};
-
-
-function MakeExceptionEvent(break_id, exception, uncaught, promise) {
-  return new ExceptionEvent(break_id, exception, uncaught, promise);
-}
-
-
-function ExceptionEvent(break_id, exception, uncaught, promise) {
-  this.exec_state_ = new ExecutionState(break_id);
-  this.exception_ = exception;
-  this.uncaught_ = uncaught;
-  this.promise_ = promise;
-}
-
-
-ExceptionEvent.prototype.eventType = function() {
-  return Debug.DebugEvent.Exception;
-};
-
-
-ExceptionEvent.prototype.exception = function() {
-  return this.exception_;
-};
-
-
-ExceptionEvent.prototype.uncaught = function() {
-  return this.uncaught_;
-};
-
-
-ExceptionEvent.prototype.promise = function() {
-  return this.promise_;
-};
-
-
-ExceptionEvent.prototype.func = function() {
-  return this.exec_state_.frame(0).func();
-};
-
-
-ExceptionEvent.prototype.sourceLine = function() {
-  return this.exec_state_.frame(0).sourceLine();
-};
-
-
-ExceptionEvent.prototype.sourceColumn = function() {
-  return this.exec_state_.frame(0).sourceColumn();
-};
-
-
-ExceptionEvent.prototype.sourceLineText = function() {
-  return this.exec_state_.frame(0).sourceLineText();
-};
-
-
-function MakeCompileEvent(script, type) {
-  return new CompileEvent(script, type);
-}
-
-
-function CompileEvent(script, type) {
-  this.script_ = MakeMirror(script);
-  this.type_ = type;
-}
-
-
-CompileEvent.prototype.eventType = function() {
-  return this.type_;
-};
-
-
-CompileEvent.prototype.script = function() {
-  return this.script_;
-};
-
-
-function MakeScriptObject_(script, include_source) {
-  var o = { id: script.id(),
-            name: script.name(),
-            lineOffset: script.lineOffset(),
-            columnOffset: script.columnOffset(),
-            lineCount: script.lineCount(),
-          };
-  if (!IS_UNDEFINED(script.data())) {
-    o.data = script.data();
-  }
-  if (include_source) {
-    o.source = script.source();
-  }
-  return o;
-}
-
-
-function MakeAsyncTaskEvent(type, id) {
-  return new AsyncTaskEvent(type, id);
-}
-
-
-function AsyncTaskEvent(type, id) {
-  this.type_ = type;
-  this.id_ = id;
-}
-
-
-AsyncTaskEvent.prototype.type = function() {
-  return this.type_;
-}
-
-
-AsyncTaskEvent.prototype.id = function() {
-  return this.id_;
-}
-
-// -------------------------------------------------------------------
-// Exports
-
-utils.InstallConstants(global, [
-  "Debug", Debug,
-  "CompileEvent", CompileEvent,
-]);
-
-// Functions needed by the debugger runtime.
-utils.InstallConstants(utils, [
-  "MakeExecutionState", MakeExecutionState,
-  "MakeExceptionEvent", MakeExceptionEvent,
-  "MakeCompileEvent", MakeCompileEvent,
-  "MakeAsyncTaskEvent", MakeAsyncTaskEvent,
-]);
-
-})
diff --git a/deps/v8/src/debug/ia32/debug-ia32.cc b/deps/v8/src/debug/ia32/debug-ia32.cc
index d8dcb0e5d54091..03a60d269e1883 100644
--- a/deps/v8/src/debug/ia32/debug-ia32.cc
+++ b/deps/v8/src/debug/ia32/debug-ia32.cc
@@ -37,8 +37,8 @@ void DebugCodegen::GenerateFrameDropperTrampoline(MacroAssembler* masm) {
   __ leave();
 
   __ mov(ebx, FieldOperand(edi, JSFunction::kSharedFunctionInfoOffset));
-  __ mov(ebx,
-         FieldOperand(ebx, SharedFunctionInfo::kFormalParameterCountOffset));
+  __ movzx_w(
+      ebx, FieldOperand(ebx, SharedFunctionInfo::kFormalParameterCountOffset));
 
   ParameterCount dummy(ebx);
   __ InvokeFunction(edi, dummy, dummy, JUMP_FUNCTION);
diff --git a/deps/v8/src/debug/interface-types.h b/deps/v8/src/debug/interface-types.h
index 7f5cd5f8059fc4..f0b47e6238acd6 100644
--- a/deps/v8/src/debug/interface-types.h
+++ b/deps/v8/src/debug/interface-types.h
@@ -69,13 +69,14 @@ struct WasmDisassembly {
   OffsetTable offset_table;
 };
 
-enum PromiseDebugActionType {
-  kDebugAsyncFunctionPromiseCreated,
+enum DebugAsyncActionType {
   kDebugPromiseThen,
   kDebugPromiseCatch,
   kDebugPromiseFinally,
   kDebugWillHandle,
   kDebugDidHandle,
+  kAsyncFunctionSuspended,
+  kAsyncFunctionFinished
 };
 
 enum BreakLocationType {
@@ -150,18 +151,14 @@ class ConsoleDelegate {
                      const ConsoleContext& context) {}
   virtual void Count(const ConsoleCallArguments& args,
                      const ConsoleContext& context) {}
+  virtual void CountReset(const ConsoleCallArguments& args,
+                          const ConsoleContext& context) {}
   virtual void Assert(const ConsoleCallArguments& args,
                       const ConsoleContext& context) {}
-  virtual void MarkTimeline(const ConsoleCallArguments& args,
-                            const ConsoleContext& context) {}
   virtual void Profile(const ConsoleCallArguments& args,
                        const ConsoleContext& context) {}
   virtual void ProfileEnd(const ConsoleCallArguments& args,
                           const ConsoleContext& context) {}
-  virtual void Timeline(const ConsoleCallArguments& args,
-                        const ConsoleContext& context) {}
-  virtual void TimelineEnd(const ConsoleCallArguments& args,
-                           const ConsoleContext& context) {}
   virtual void Time(const ConsoleCallArguments& args,
                     const ConsoleContext& context) {}
   virtual void TimeEnd(const ConsoleCallArguments& args,
@@ -176,34 +173,4 @@ typedef int BreakpointId;
 }  // namespace debug
 }  // namespace v8
 
-// TODO(yangguo): this is legacy left over from removing v8-debug.h, and still
-//                used in cctests. Let's get rid of these soon.
-namespace v8 {
-enum DebugEvent {
-  Break = 1,
-  Exception = 2,
-  AfterCompile = 3,
-  CompileError = 4,
-  AsyncTaskEvent = 5,
-};
-
-class Debug {
- public:
-  class EventDetails {
-   public:
-    virtual DebugEvent GetEvent() const = 0;
-    virtual Local<Object> GetExecutionState() const = 0;
-    virtual Local<Object> GetEventData() const = 0;
-    virtual Local<Context> GetEventContext() const = 0;
-    virtual Local<Value> GetCallbackData() const = 0;
-
-    virtual Isolate* GetIsolate() const = 0;
-
-    virtual ~EventDetails() {}
-  };
-
-  typedef void (*EventCallback)(const EventDetails& event_details);
-};
-}  // namespace v8
-
 #endif  // V8_DEBUG_INTERFACE_TYPES_H_
diff --git a/deps/v8/src/debug/liveedit.cc b/deps/v8/src/debug/liveedit.cc
index 68be1a39dd65a9..dd0eeeecee9c87 100644
--- a/deps/v8/src/debug/liveedit.cc
+++ b/deps/v8/src/debug/liveedit.cc
@@ -4,36 +4,56 @@
 
 #include "src/debug/liveedit.h"
 
-#include "src/assembler-inl.h"
+#include "src/api.h"
+#include "src/ast/ast-traversal-visitor.h"
+#include "src/ast/ast.h"
 #include "src/ast/scopes.h"
-#include "src/code-stubs.h"
 #include "src/compilation-cache.h"
 #include "src/compiler.h"
+#include "src/debug/debug-interface.h"
 #include "src/debug/debug.h"
-#include "src/deoptimizer.h"
 #include "src/frames-inl.h"
-#include "src/global-handles.h"
 #include "src/isolate-inl.h"
 #include "src/messages.h"
 #include "src/objects-inl.h"
+#include "src/objects/hash-table-inl.h"
+#include "src/parsing/parse-info.h"
+#include "src/parsing/parsing.h"
 #include "src/source-position-table.h"
 #include "src/v8.h"
-#include "src/v8memory.h"
 
 namespace v8 {
 namespace internal {
+namespace {
+// A general-purpose comparator between 2 arrays.
+class Comparator {
+ public:
+  // Holds 2 arrays of some elements allowing to compare any pair of
+  // element from the first array and element from the second array.
+  class Input {
+   public:
+    virtual int GetLength1() = 0;
+    virtual int GetLength2() = 0;
+    virtual bool Equals(int index1, int index2) = 0;
 
-void SetElementSloppy(Handle<JSObject> object,
-                      uint32_t index,
-                      Handle<Object> value) {
-  // Ignore return value from SetElement. It can only be a failure if there
-  // are element setters causing exceptions and the debugger context has none
-  // of these.
-  Object::SetElement(object->GetIsolate(), object, index, value,
-                     LanguageMode::kSloppy)
-      .Assert();
-}
+   protected:
+    virtual ~Input() = default;
+  };
 
+  // Receives compare result as a series of chunks.
+  class Output {
+   public:
+    // Puts another chunk in result list. Note that technically speaking
+    // only 3 arguments actually needed with 4th being derivable.
+    virtual void AddChunk(int pos1, int pos2, int len1, int len2) = 0;
+
+   protected:
+    virtual ~Output() = default;
+  };
+
+  // Finds the difference between 2 arrays of elements.
+  static void CalculateDifference(Input* input, Output* result_writer);
+};
 
 // A simple implementation of dynamic programming algorithm. It solves
 // the problem of finding the difference of 2 arrays. It uses a table of results
@@ -234,7 +254,6 @@ class Differencer {
   };
 };
 
-
 void Comparator::CalculateDifference(Comparator::Input* input,
                                      Comparator::Output* result_writer) {
   Differencer differencer(input);
@@ -243,18 +262,14 @@ void Comparator::CalculateDifference(Comparator::Input* input,
   differencer.SaveResult(result_writer);
 }
 
-
-static bool CompareSubstrings(Handle<String> s1, int pos1,
-                              Handle<String> s2, int pos2, int len) {
+bool CompareSubstrings(Handle<String> s1, int pos1, Handle<String> s2, int pos2,
+                       int len) {
   for (int i = 0; i < len; i++) {
-    if (s1->Get(i + pos1) != s2->Get(i + pos2)) {
-      return false;
-    }
+    if (s1->Get(i + pos1) != s2->Get(i + pos2)) return false;
   }
   return true;
 }
 
-
 // Additional to Input interface. Lets switch Input range to subrange.
 // More elegant way would be to wrap one Input as another Input object
 // and translate positions there, but that would cost us additional virtual
@@ -272,16 +287,9 @@ class SubrangableOutput : public Comparator::Output {
   virtual void SetSubrange2(int offset, int len) = 0;
 };
 
-
-static int min(int a, int b) {
-  return a < b ? a : b;
-}
-
-
 // Finds common prefix and suffix in input. This parts shouldn't take space in
 // linear programming table. Enable subranging in input and output.
-static void NarrowDownInput(SubrangableInput* input,
-    SubrangableOutput* output) {
+void NarrowDownInput(SubrangableInput* input, SubrangableOutput* output) {
   const int len1 = input->GetLength1();
   const int len2 = input->GetLength2();
 
@@ -290,14 +298,15 @@ static void NarrowDownInput(SubrangableInput* input,
 
   {
     common_prefix_len = 0;
-    int prefix_limit = min(len1, len2);
+    int prefix_limit = std::min(len1, len2);
     while (common_prefix_len < prefix_limit &&
         input->Equals(common_prefix_len, common_prefix_len)) {
       common_prefix_len++;
     }
 
     common_suffix_len = 0;
-    int suffix_limit = min(len1 - common_prefix_len, len2 - common_prefix_len);
+    int suffix_limit =
+        std::min(len1 - common_prefix_len, len2 - common_prefix_len);
 
     while (common_suffix_len < suffix_limit &&
         input->Equals(len1 - common_suffix_len - 1,
@@ -318,40 +327,6 @@ static void NarrowDownInput(SubrangableInput* input,
   }
 }
 
-
-// A helper class that writes chunk numbers into JSArray.
-// Each chunk is stored as 3 array elements: (pos1_begin, pos1_end, pos2_end).
-class CompareOutputArrayWriter {
- public:
-  explicit CompareOutputArrayWriter(Isolate* isolate)
-      : array_(isolate->factory()->NewJSArray(10)), current_size_(0) {}
-
-  Handle<JSArray> GetResult() {
-    return array_;
-  }
-
-  void WriteChunk(int char_pos1, int char_pos2, int char_len1, int char_len2) {
-    Isolate* isolate = array_->GetIsolate();
-    SetElementSloppy(array_,
-                     current_size_,
-                     Handle<Object>(Smi::FromInt(char_pos1), isolate));
-    SetElementSloppy(array_,
-                     current_size_ + 1,
-                     Handle<Object>(Smi::FromInt(char_pos1 + char_len1),
-                                    isolate));
-    SetElementSloppy(array_,
-                     current_size_ + 2,
-                     Handle<Object>(Smi::FromInt(char_pos2 + char_len2),
-                                    isolate));
-    current_size_ += 3;
-  }
-
- private:
-  Handle<JSArray> array_;
-  int current_size_;
-};
-
-
 // Represents 2 strings as 2 arrays of tokens.
 // TODO(LiveEdit): Currently it's actually an array of charactres.
 //     Make array of tokens instead.
@@ -362,13 +337,9 @@ class TokensCompareInput : public Comparator::Input {
       : s1_(s1), offset1_(offset1), len1_(len1),
         s2_(s2), offset2_(offset2), len2_(len2) {
   }
-  virtual int GetLength1() {
-    return len1_;
-  }
-  virtual int GetLength2() {
-    return len2_;
-  }
-  bool Equals(int index1, int index2) {
+  int GetLength1() override { return len1_; }
+  int GetLength2() override { return len2_; }
+  bool Equals(int index1, int index2) override {
     return s1_->Get(offset1_ + index1) == s2_->Get(offset2_ + index2);
   }
 
@@ -381,47 +352,39 @@ class TokensCompareInput : public Comparator::Input {
   int len2_;
 };
 
-
-// Stores compare result in JSArray. Converts substring positions
+// Stores compare result in std::vector. Converts substring positions
 // to absolute positions.
 class TokensCompareOutput : public Comparator::Output {
  public:
-  TokensCompareOutput(CompareOutputArrayWriter* array_writer,
-                      int offset1, int offset2)
-        : array_writer_(array_writer), offset1_(offset1), offset2_(offset2) {
-  }
+  TokensCompareOutput(int offset1, int offset2,
+                      std::vector<SourceChangeRange>* output)
+      : output_(output), offset1_(offset1), offset2_(offset2) {}
 
-  void AddChunk(int pos1, int pos2, int len1, int len2) {
-    array_writer_->WriteChunk(pos1 + offset1_, pos2 + offset2_, len1, len2);
+  void AddChunk(int pos1, int pos2, int len1, int len2) override {
+    output_->emplace_back(
+        SourceChangeRange{pos1 + offset1_, pos1 + len1 + offset1_,
+                          pos2 + offset2_, pos2 + offset2_ + len2});
   }
 
  private:
-  CompareOutputArrayWriter* array_writer_;
+  std::vector<SourceChangeRange>* output_;
   int offset1_;
   int offset2_;
 };
 
-
 // Wraps raw n-elements line_ends array as a list of n+1 lines. The last line
 // never has terminating new line character.
 class LineEndsWrapper {
  public:
-  explicit LineEndsWrapper(Handle<String> string)
-      : ends_array_(String::CalculateLineEnds(string, false)),
-        string_len_(string->length()) {
-  }
+  explicit LineEndsWrapper(Isolate* isolate, Handle<String> string)
+      : ends_array_(String::CalculateLineEnds(isolate, string, false)),
+        string_len_(string->length()) {}
   int length() {
     return ends_array_->length() + 1;
   }
   // Returns start for any line including start of the imaginary line after
   // the last line.
-  int GetLineStart(int index) {
-    if (index == 0) {
-      return 0;
-    } else {
-      return GetLineEnd(index - 1);
-    }
-  }
+  int GetLineStart(int index) { return index == 0 ? 0 : GetLineEnd(index - 1); }
   int GetLineEnd(int index) {
     if (index == ends_array_->length()) {
       // End of the last line is always an end of the whole string.
@@ -442,7 +405,6 @@ class LineEndsWrapper {
   }
 };
 
-
 // Represents 2 strings as 2 arrays of lines.
 class LineArrayCompareInput : public SubrangableInput {
  public:
@@ -454,13 +416,9 @@ class LineArrayCompareInput : public SubrangableInput {
         subrange_len1_(line_ends1_.length()),
         subrange_len2_(line_ends2_.length()) {
   }
-  int GetLength1() {
-    return subrange_len1_;
-  }
-  int GetLength2() {
-    return subrange_len2_;
-  }
-  bool Equals(int index1, int index2) {
+  int GetLength1() override { return subrange_len1_; }
+  int GetLength2() override { return subrange_len2_; }
+  bool Equals(int index1, int index2) override {
     index1 += subrange_offset1_;
     index2 += subrange_offset2_;
 
@@ -476,11 +434,11 @@ class LineArrayCompareInput : public SubrangableInput {
     return CompareSubstrings(s1_, line_start1, s2_, line_start2,
                              len1);
   }
-  void SetSubrange1(int offset, int len) {
+  void SetSubrange1(int offset, int len) override {
     subrange_offset1_ = offset;
     subrange_len1_ = len;
   }
-  void SetSubrange2(int offset, int len) {
+  void SetSubrange2(int offset, int len) override {
     subrange_offset2_ = offset;
     subrange_len2_ = len;
   }
@@ -496,20 +454,25 @@ class LineArrayCompareInput : public SubrangableInput {
   int subrange_len2_;
 };
 
-
-// Stores compare result in JSArray. For each chunk tries to conduct
+// Stores compare result in std::vector. For each chunk tries to conduct
 // a fine-grained nested diff token-wise.
 class TokenizingLineArrayCompareOutput : public SubrangableOutput {
  public:
-  TokenizingLineArrayCompareOutput(LineEndsWrapper line_ends1,
+  TokenizingLineArrayCompareOutput(Isolate* isolate, LineEndsWrapper line_ends1,
                                    LineEndsWrapper line_ends2,
-                                   Handle<String> s1, Handle<String> s2)
-      : array_writer_(s1->GetIsolate()),
-        line_ends1_(line_ends1), line_ends2_(line_ends2), s1_(s1), s2_(s2),
-        subrange_offset1_(0), subrange_offset2_(0) {
-  }
-
-  void AddChunk(int line_pos1, int line_pos2, int line_len1, int line_len2) {
+                                   Handle<String> s1, Handle<String> s2,
+                                   std::vector<SourceChangeRange>* output)
+      : isolate_(isolate),
+        line_ends1_(line_ends1),
+        line_ends2_(line_ends2),
+        s1_(s1),
+        s2_(s2),
+        subrange_offset1_(0),
+        subrange_offset2_(0),
+        output_(output) {}
+
+  void AddChunk(int line_pos1, int line_pos2, int line_len1,
+                int line_len2) override {
     line_pos1 += subrange_offset1_;
     line_pos2 += subrange_offset2_;
 
@@ -520,443 +483,477 @@ class TokenizingLineArrayCompareOutput : public SubrangableOutput {
 
     if (char_len1 < CHUNK_LEN_LIMIT && char_len2 < CHUNK_LEN_LIMIT) {
       // Chunk is small enough to conduct a nested token-level diff.
-      HandleScope subTaskScope(s1_->GetIsolate());
+      HandleScope subTaskScope(isolate_);
 
       TokensCompareInput tokens_input(s1_, char_pos1, char_len1,
                                       s2_, char_pos2, char_len2);
-      TokensCompareOutput tokens_output(&array_writer_, char_pos1,
-                                          char_pos2);
+      TokensCompareOutput tokens_output(char_pos1, char_pos2, output_);
 
       Comparator::CalculateDifference(&tokens_input, &tokens_output);
     } else {
-      array_writer_.WriteChunk(char_pos1, char_pos2, char_len1, char_len2);
+      output_->emplace_back(SourceChangeRange{
+          char_pos1, char_pos1 + char_len1, char_pos2, char_pos2 + char_len2});
     }
   }
-  void SetSubrange1(int offset, int len) {
+  void SetSubrange1(int offset, int len) override {
     subrange_offset1_ = offset;
   }
-  void SetSubrange2(int offset, int len) {
+  void SetSubrange2(int offset, int len) override {
     subrange_offset2_ = offset;
   }
 
-  Handle<JSArray> GetResult() {
-    return array_writer_.GetResult();
-  }
-
  private:
   static const int CHUNK_LEN_LIMIT = 800;
 
-  CompareOutputArrayWriter array_writer_;
+  Isolate* isolate_;
   LineEndsWrapper line_ends1_;
   LineEndsWrapper line_ends2_;
   Handle<String> s1_;
   Handle<String> s2_;
   int subrange_offset1_;
   int subrange_offset2_;
+  std::vector<SourceChangeRange>* output_;
 };
 
+struct SourcePositionEvent {
+  enum Type { LITERAL_STARTS, LITERAL_ENDS, DIFF_STARTS, DIFF_ENDS };
 
-Handle<JSArray> LiveEdit::CompareStrings(Handle<String> s1,
-                                         Handle<String> s2) {
-  s1 = String::Flatten(s1);
-  s2 = String::Flatten(s2);
-
-  LineEndsWrapper line_ends1(s1);
-  LineEndsWrapper line_ends2(s2);
-
-  LineArrayCompareInput input(s1, s2, line_ends1, line_ends2);
-  TokenizingLineArrayCompareOutput output(line_ends1, line_ends2, s1, s2);
-
-  NarrowDownInput(&input, &output);
-
-  Comparator::CalculateDifference(&input, &output);
-
-  return output.GetResult();
-}
-
-
-// Unwraps JSValue object, returning its field "value"
-static Handle<Object> UnwrapJSValue(Handle<JSValue> jsValue) {
-  return Handle<Object>(jsValue->value(), jsValue->GetIsolate());
-}
-
-
-// Wraps any object into a OpaqueReference, that will hide the object
-// from JavaScript.
-static Handle<JSValue> WrapInJSValue(Handle<HeapObject> object) {
-  Isolate* isolate = object->GetIsolate();
-  Handle<JSFunction> constructor = isolate->opaque_reference_function();
-  Handle<JSValue> result =
-      Handle<JSValue>::cast(isolate->factory()->NewJSObject(constructor));
-  result->set_value(*object);
-  return result;
-}
-
-
-static Handle<SharedFunctionInfo> UnwrapSharedFunctionInfoFromJSValue(
-    Handle<JSValue> jsValue) {
-  Object* shared = jsValue->value();
-  CHECK(shared->IsSharedFunctionInfo());
-  return Handle<SharedFunctionInfo>(SharedFunctionInfo::cast(shared));
-}
-
-
-static int GetArrayLength(Handle<JSArray> array) {
-  Object* length = array->length();
-  CHECK(length->IsSmi());
-  return Smi::ToInt(length);
-}
-
-void FunctionInfoWrapper::SetInitialProperties(Handle<String> name,
-                                               int start_position,
-                                               int end_position, int param_num,
-                                               int parent_index,
-                                               int function_literal_id) {
-  HandleScope scope(isolate());
-  this->SetField(kFunctionNameOffset_, name);
-  this->SetSmiValueField(kStartPositionOffset_, start_position);
-  this->SetSmiValueField(kEndPositionOffset_, end_position);
-  this->SetSmiValueField(kParamNumOffset_, param_num);
-  this->SetSmiValueField(kParentIndexOffset_, parent_index);
-  this->SetSmiValueField(kFunctionLiteralIdOffset_, function_literal_id);
-}
-
-void FunctionInfoWrapper::SetSharedFunctionInfo(
-    Handle<SharedFunctionInfo> info) {
-  Handle<JSValue> info_holder = WrapInJSValue(info);
-  this->SetField(kSharedFunctionInfoOffset_, info_holder);
-}
-
-Handle<SharedFunctionInfo> FunctionInfoWrapper::GetSharedFunctionInfo() {
-  Handle<Object> element = this->GetField(kSharedFunctionInfoOffset_);
-  Handle<JSValue> value_wrapper = Handle<JSValue>::cast(element);
-  Handle<Object> raw_result = UnwrapJSValue(value_wrapper);
-  CHECK(raw_result->IsSharedFunctionInfo());
-  return Handle<SharedFunctionInfo>::cast(raw_result);
-}
-
-void SharedInfoWrapper::SetProperties(Handle<String> name,
-                                      int start_position,
-                                      int end_position,
-                                      Handle<SharedFunctionInfo> info) {
-  HandleScope scope(isolate());
-  this->SetField(kFunctionNameOffset_, name);
-  Handle<JSValue> info_holder = WrapInJSValue(info);
-  this->SetField(kSharedInfoOffset_, info_holder);
-  this->SetSmiValueField(kStartPositionOffset_, start_position);
-  this->SetSmiValueField(kEndPositionOffset_, end_position);
-}
-
-
-Handle<SharedFunctionInfo> SharedInfoWrapper::GetInfo() {
-  Handle<Object> element = this->GetField(kSharedInfoOffset_);
-  Handle<JSValue> value_wrapper = Handle<JSValue>::cast(element);
-  return UnwrapSharedFunctionInfoFromJSValue(value_wrapper);
-}
-
-
-void LiveEdit::InitializeThreadLocal(Debug* debug) {
-  debug->thread_local_.restart_fp_ = 0;
-}
-
-
-MaybeHandle<JSArray> LiveEdit::GatherCompileInfo(Handle<Script> script,
-                                                 Handle<String> source) {
-  Isolate* isolate = script->GetIsolate();
+  int position;
+  Type type;
 
-  MaybeHandle<JSArray> infos;
-  Handle<Object> original_source =
-      Handle<Object>(script->source(), isolate);
-  script->set_source(*source);
+  union {
+    FunctionLiteral* literal;
+    int pos_diff;
+  };
 
-  {
-    // Creating verbose TryCatch from public API is currently the only way to
-    // force code save location. We do not use this the object directly.
-    v8::TryCatch try_catch(reinterpret_cast<v8::Isolate*>(isolate));
-    try_catch.SetVerbose(true);
-
-    // A logical 'try' section.
-    infos = Compiler::CompileForLiveEdit(script);
-  }
-
-  // A logical 'catch' section.
-  Handle<JSObject> rethrow_exception;
-  if (isolate->has_pending_exception()) {
-    Handle<Object> exception(isolate->pending_exception(), isolate);
-    MessageLocation message_location = isolate->GetMessageLocation();
-
-    isolate->clear_pending_message();
-    isolate->clear_pending_exception();
-
-    // If possible, copy positions from message object to exception object.
-    if (exception->IsJSObject() && !message_location.script().is_null()) {
-      rethrow_exception = Handle<JSObject>::cast(exception);
-
-      Factory* factory = isolate->factory();
-      Handle<String> start_pos_key = factory->InternalizeOneByteString(
-          STATIC_CHAR_VECTOR("startPosition"));
-      Handle<String> end_pos_key =
-          factory->InternalizeOneByteString(STATIC_CHAR_VECTOR("endPosition"));
-      Handle<String> script_obj_key =
-          factory->InternalizeOneByteString(STATIC_CHAR_VECTOR("scriptObject"));
-      Handle<Smi> start_pos(
-          Smi::FromInt(message_location.start_pos()), isolate);
-      Handle<Smi> end_pos(Smi::FromInt(message_location.end_pos()), isolate);
-      Handle<JSObject> script_obj =
-          Script::GetWrapper(message_location.script());
-      Object::SetProperty(rethrow_exception, start_pos_key, start_pos,
-                          LanguageMode::kSloppy)
-          .Assert();
-      Object::SetProperty(rethrow_exception, end_pos_key, end_pos,
-                          LanguageMode::kSloppy)
-          .Assert();
-      Object::SetProperty(rethrow_exception, script_obj_key, script_obj,
-                          LanguageMode::kSloppy)
-          .Assert();
+  SourcePositionEvent(FunctionLiteral* literal, bool is_start)
+      : position(is_start ? literal->start_position()
+                          : literal->end_position()),
+        type(is_start ? LITERAL_STARTS : LITERAL_ENDS),
+        literal(literal) {}
+  SourcePositionEvent(const SourceChangeRange& change, bool is_start)
+      : position(is_start ? change.start_position : change.end_position),
+        type(is_start ? DIFF_STARTS : DIFF_ENDS),
+        pos_diff((change.new_end_position - change.new_start_position) -
+                 (change.end_position - change.start_position)) {}
+
+  static bool LessThan(const SourcePositionEvent& a,
+                       const SourcePositionEvent& b) {
+    if (a.position != b.position) return a.position < b.position;
+    if (a.type != b.type) return a.type < b.type;
+    if (a.type == LITERAL_STARTS && b.type == LITERAL_STARTS) {
+      return a.literal->end_position() < b.literal->end_position();
+    } else if (a.type == LITERAL_ENDS && b.type == LITERAL_ENDS) {
+      return a.literal->start_position() > b.literal->start_position();
+    } else {
+      return a.pos_diff < b.pos_diff;
     }
   }
+};
 
-  // A logical 'finally' section.
-  script->set_source(*original_source);
+struct FunctionLiteralChange {
+  // If any of start/end position is kNoSourcePosition, this literal is
+  // considered damaged and will not be mapped and edited at all.
+  int new_start_position;
+  int new_end_position;
+  bool has_changes;
+  FunctionLiteral* outer_literal;
+
+  explicit FunctionLiteralChange(int new_start_position, FunctionLiteral* outer)
+      : new_start_position(new_start_position),
+        new_end_position(kNoSourcePosition),
+        has_changes(false),
+        outer_literal(outer) {}
+};
 
-  if (rethrow_exception.is_null()) {
-    return infos.ToHandleChecked();
-  } else {
-    return isolate->Throw<JSArray>(rethrow_exception);
+using FunctionLiteralChanges =
+    std::unordered_map<FunctionLiteral*, FunctionLiteralChange>;
+void CalculateFunctionLiteralChanges(
+    const std::vector<FunctionLiteral*>& literals,
+    const std::vector<SourceChangeRange>& diffs,
+    FunctionLiteralChanges* result) {
+  std::vector<SourcePositionEvent> events;
+  events.reserve(literals.size() * 2 + diffs.size() * 2);
+  for (FunctionLiteral* literal : literals) {
+    events.emplace_back(literal, true);
+    events.emplace_back(literal, false);
+  }
+  for (const SourceChangeRange& diff : diffs) {
+    events.emplace_back(diff, true);
+    events.emplace_back(diff, false);
+  }
+  std::sort(events.begin(), events.end(), SourcePositionEvent::LessThan);
+  bool inside_diff = false;
+  int delta = 0;
+  std::stack<std::pair<FunctionLiteral*, FunctionLiteralChange>> literal_stack;
+  for (const SourcePositionEvent& event : events) {
+    switch (event.type) {
+      case SourcePositionEvent::DIFF_ENDS:
+        DCHECK(inside_diff);
+        inside_diff = false;
+        delta += event.pos_diff;
+        break;
+      case SourcePositionEvent::LITERAL_ENDS: {
+        DCHECK_EQ(literal_stack.top().first, event.literal);
+        FunctionLiteralChange& change = literal_stack.top().second;
+        change.new_end_position = inside_diff
+                                      ? kNoSourcePosition
+                                      : event.literal->end_position() + delta;
+        result->insert(literal_stack.top());
+        literal_stack.pop();
+        break;
+      }
+      case SourcePositionEvent::LITERAL_STARTS:
+        literal_stack.push(std::make_pair(
+            event.literal,
+            FunctionLiteralChange(
+                inside_diff ? kNoSourcePosition
+                            : event.literal->start_position() + delta,
+                literal_stack.empty() ? nullptr : literal_stack.top().first)));
+        break;
+      case SourcePositionEvent::DIFF_STARTS:
+        DCHECK(!inside_diff);
+        inside_diff = true;
+        if (!literal_stack.empty()) {
+          // Note that outer literal has not necessarily changed, unless the
+          // diff goes past the end of this literal. In this case, we'll mark
+          // this function as damaged and parent as changed later in
+          // MapLiterals.
+          literal_stack.top().second.has_changes = true;
+        }
+        break;
+    }
   }
 }
 
-// Patch function feedback vector.
-// The feedback vector is a cache for complex object boilerplates and for a
-// native context. We must clean cached values, or if the structure of the
-// vector itself changes we need to allocate a new one.
-class FeedbackVectorFixer {
- public:
-  static void PatchFeedbackVector(FunctionInfoWrapper* compile_info_wrapper,
-                                  Handle<SharedFunctionInfo> shared_info,
-                                  Isolate* isolate) {
-    // When feedback metadata changes, we have to create new array instances.
-    // Since we cannot create instances when iterating heap, we should first
-    // collect all functions and fix their literal arrays.
-    Handle<FixedArray> function_instances =
-        CollectJSFunctions(shared_info, isolate);
-
-    for (int i = 0; i < function_instances->length(); i++) {
-      Handle<JSFunction> fun(JSFunction::cast(function_instances->get(i)));
-      Handle<FeedbackCell> feedback_cell =
-          isolate->factory()->NewManyClosuresCell(
-              isolate->factory()->undefined_value());
-      fun->set_feedback_cell(*feedback_cell);
-      // Only create feedback vectors if we already have the metadata.
-      if (shared_info->is_compiled()) JSFunction::EnsureFeedbackVector(fun);
+// Function which has not changed itself, but if any variable in its
+// outer context has been added/removed, we must consider this function
+// as damaged and not update references to it.
+// This is because old compiled function has hardcoded references to
+// it's outer context.
+bool HasChangedScope(FunctionLiteral* a, FunctionLiteral* b) {
+  Scope* scope_a = a->scope()->outer_scope();
+  Scope* scope_b = b->scope()->outer_scope();
+  while (scope_a && scope_b) {
+    std::unordered_map<int, Handle<String>> vars;
+    for (Variable* var : *scope_a->locals()) {
+      if (!var->IsContextSlot()) continue;
+      vars[var->index()] = var->name();
+    }
+    for (Variable* var : *scope_b->locals()) {
+      if (!var->IsContextSlot()) continue;
+      auto it = vars.find(var->index());
+      if (it == vars.end()) return true;
+      if (*it->second != *var->name()) return true;
     }
+    scope_a = scope_a->outer_scope();
+    scope_b = scope_b->outer_scope();
   }
+  return scope_a != scope_b;
+}
 
- private:
-  // Iterates all function instances in the HEAP that refers to the
-  // provided shared_info.
-  template<typename Visitor>
-  static void IterateJSFunctions(Handle<SharedFunctionInfo> shared_info,
-                                 Visitor* visitor) {
-    HeapIterator iterator(shared_info->GetHeap());
-    for (HeapObject* obj = iterator.next(); obj != nullptr;
-         obj = iterator.next()) {
-      if (obj->IsJSFunction()) {
-        JSFunction* function = JSFunction::cast(obj);
-        if (function->shared() == *shared_info) {
-          visitor->visit(function);
-        }
+enum ChangeState { UNCHANGED, CHANGED, DAMAGED };
+
+using LiteralMap = std::unordered_map<FunctionLiteral*, FunctionLiteral*>;
+void MapLiterals(const FunctionLiteralChanges& changes,
+                 const std::vector<FunctionLiteral*>& new_literals,
+                 LiteralMap* unchanged, LiteralMap* changed) {
+  std::map<std::pair<int, int>, FunctionLiteral*> position_to_new_literal;
+  for (FunctionLiteral* literal : new_literals) {
+    DCHECK(literal->start_position() != kNoSourcePosition);
+    DCHECK(literal->end_position() != kNoSourcePosition);
+    position_to_new_literal[std::make_pair(literal->start_position(),
+                                           literal->end_position())] = literal;
+  }
+  LiteralMap mappings;
+  std::unordered_map<FunctionLiteral*, ChangeState> change_state;
+  for (const auto& change_pair : changes) {
+    FunctionLiteral* literal = change_pair.first;
+    const FunctionLiteralChange& change = change_pair.second;
+    auto it = position_to_new_literal.find(
+        std::make_pair(change.new_start_position, change.new_end_position));
+    if (it == position_to_new_literal.end() ||
+        HasChangedScope(literal, it->second)) {
+      change_state[literal] = ChangeState::DAMAGED;
+      if (!change.outer_literal) continue;
+      if (change_state[change.outer_literal] != ChangeState::DAMAGED) {
+        change_state[change.outer_literal] = ChangeState::CHANGED;
+      }
+    } else {
+      mappings[literal] = it->second;
+      if (change_state.find(literal) == change_state.end()) {
+        change_state[literal] =
+            change.has_changes ? ChangeState::CHANGED : ChangeState::UNCHANGED;
       }
     }
   }
-
-  // Finds all instances of JSFunction that refers to the provided shared_info
-  // and returns array with them.
-  static Handle<FixedArray> CollectJSFunctions(
-      Handle<SharedFunctionInfo> shared_info, Isolate* isolate) {
-    CountVisitor count_visitor;
-    count_visitor.count = 0;
-    IterateJSFunctions(shared_info, &count_visitor);
-    int size = count_visitor.count;
-
-    Handle<FixedArray> result = isolate->factory()->NewFixedArray(size);
-    if (size > 0) {
-      CollectVisitor collect_visitor(result);
-      IterateJSFunctions(shared_info, &collect_visitor);
+  for (const auto& mapping : mappings) {
+    if (change_state[mapping.first] == ChangeState::UNCHANGED) {
+      (*unchanged)[mapping.first] = mapping.second;
+    } else if (change_state[mapping.first] == ChangeState::CHANGED) {
+      (*changed)[mapping.first] = mapping.second;
     }
-    return result;
   }
+}
 
-  class CountVisitor {
-   public:
-    void visit(JSFunction* fun) {
-      count++;
-    }
-    int count;
-  };
+class CollectFunctionLiterals final
+    : public AstTraversalVisitor<CollectFunctionLiterals> {
+ public:
+  CollectFunctionLiterals(Isolate* isolate, AstNode* root)
+      : AstTraversalVisitor<CollectFunctionLiterals>(isolate, root) {}
+  void VisitFunctionLiteral(FunctionLiteral* lit) {
+    AstTraversalVisitor::VisitFunctionLiteral(lit);
+    literals_->push_back(lit);
+  }
+  void Run(std::vector<FunctionLiteral*>* literals) {
+    literals_ = literals;
+    AstTraversalVisitor::Run();
+    literals_ = nullptr;
+  }
 
-  class CollectVisitor {
-   public:
-    explicit CollectVisitor(Handle<FixedArray> output)
-        : m_output(output), m_pos(0) {}
+ private:
+  std::vector<FunctionLiteral*>* literals_;
+};
 
-    void visit(JSFunction* fun) {
-      m_output->set(m_pos, fun);
-      m_pos++;
+bool ParseScript(Isolate* isolate, ParseInfo* parse_info, bool compile_as_well,
+                 std::vector<FunctionLiteral*>* literals,
+                 debug::LiveEditResult* result) {
+  parse_info->set_eager();
+  v8::TryCatch try_catch(reinterpret_cast<v8::Isolate*>(isolate));
+  Handle<SharedFunctionInfo> shared;
+  bool success = false;
+  if (compile_as_well) {
+    success =
+        Compiler::CompileForLiveEdit(parse_info, isolate).ToHandle(&shared);
+  } else {
+    success = parsing::ParseProgram(parse_info, isolate);
+    if (success) {
+      success = Compiler::Analyze(parse_info);
+      parse_info->ast_value_factory()->Internalize(isolate);
     }
-   private:
-    Handle<FixedArray> m_output;
-    int m_pos;
+  }
+  if (!success) {
+    isolate->OptionalRescheduleException(false);
+    DCHECK(try_catch.HasCaught());
+    result->message = try_catch.Message()->Get();
+    auto self = Utils::OpenHandle(*try_catch.Message());
+    auto msg = i::Handle<i::JSMessageObject>::cast(self);
+    result->line_number = msg->GetLineNumber();
+    result->column_number = msg->GetColumnNumber();
+    result->status = debug::LiveEditResult::COMPILE_ERROR;
+    return false;
+  }
+  CollectFunctionLiterals(isolate, parse_info->literal()).Run(literals);
+  return true;
+}
+
+struct FunctionData {
+  FunctionData(FunctionLiteral* literal, bool should_restart)
+      : literal(literal),
+        stack_position(NOT_ON_STACK),
+        should_restart(should_restart) {}
+
+  FunctionLiteral* literal;
+  MaybeHandle<SharedFunctionInfo> shared;
+  std::vector<Handle<JSFunction>> js_functions;
+  std::vector<Handle<JSGeneratorObject>> running_generators;
+  // In case of multiple functions with different stack position, the latest
+  // one (in the order below) is used, since it is the most restrictive.
+  // This is important only for functions to be restarted.
+  enum StackPosition {
+    NOT_ON_STACK,
+    ABOVE_BREAK_FRAME,
+    PATCHABLE,
+    BELOW_NON_DROPPABLE_FRAME,
+    ARCHIVED_THREAD,
   };
+  StackPosition stack_position;
+  bool should_restart;
 };
 
+class FunctionDataMap : public ThreadVisitor {
+ public:
+  void AddInterestingLiteral(int script_id, FunctionLiteral* literal,
+                             bool should_restart) {
+    map_.emplace(std::make_pair(script_id, literal->function_literal_id()),
+                 FunctionData{literal, should_restart});
+  }
 
-void LiveEdit::ReplaceFunctionCode(
-    Handle<JSArray> new_compile_info_array,
-    Handle<JSArray> shared_info_array) {
-  Isolate* isolate = new_compile_info_array->GetIsolate();
-
-  FunctionInfoWrapper compile_info_wrapper(new_compile_info_array);
-  SharedInfoWrapper shared_info_wrapper(shared_info_array);
-
-  Handle<SharedFunctionInfo> shared_info = shared_info_wrapper.GetInfo();
-  Handle<SharedFunctionInfo> new_shared_info =
-      compile_info_wrapper.GetSharedFunctionInfo();
-
-  if (shared_info->is_compiled()) {
-    // Clear old bytecode. This will trigger self-healing if we do not install
-    // new bytecode.
-    shared_info->FlushCompiled();
-    if (new_shared_info->HasInterpreterData()) {
-      shared_info->set_interpreter_data(new_shared_info->interpreter_data());
-    } else {
-      shared_info->set_bytecode_array(new_shared_info->GetBytecodeArray());
+  bool Lookup(SharedFunctionInfo* sfi, FunctionData** data) {
+    if (!sfi->script()->IsScript() || sfi->function_literal_id() == -1) {
+      return false;
     }
-
-    if (shared_info->HasBreakInfo()) {
-      // Existing break points will be re-applied. Reset the debug info here.
-      isolate->debug()->RemoveBreakInfoAndMaybeFree(
-          handle(shared_info->GetDebugInfo()));
+    Script* script = Script::cast(sfi->script());
+    return Lookup(script->id(), sfi->function_literal_id(), data);
+  }
+
+  bool Lookup(Handle<Script> script, FunctionLiteral* literal,
+              FunctionData** data) {
+    return Lookup(script->id(), literal->function_literal_id(), data);
+  }
+
+  void Fill(Isolate* isolate, Address* restart_frame_fp) {
+    {
+      HeapIterator iterator(isolate->heap(), HeapIterator::kFilterUnreachable);
+      while (HeapObject* obj = iterator.next()) {
+        if (obj->IsSharedFunctionInfo()) {
+          SharedFunctionInfo* sfi = SharedFunctionInfo::cast(obj);
+          FunctionData* data = nullptr;
+          if (!Lookup(sfi, &data)) continue;
+          data->shared = handle(sfi, isolate);
+        } else if (obj->IsJSFunction()) {
+          JSFunction* js_function = JSFunction::cast(obj);
+          SharedFunctionInfo* sfi = js_function->shared();
+          FunctionData* data = nullptr;
+          if (!Lookup(sfi, &data)) continue;
+          data->js_functions.emplace_back(js_function, isolate);
+        } else if (obj->IsJSGeneratorObject()) {
+          JSGeneratorObject* gen = JSGeneratorObject::cast(obj);
+          if (gen->is_closed()) continue;
+          SharedFunctionInfo* sfi = gen->function()->shared();
+          FunctionData* data = nullptr;
+          if (!Lookup(sfi, &data)) continue;
+          data->running_generators.emplace_back(gen, isolate);
+        }
+      }
+    }
+    FunctionData::StackPosition stack_position =
+        isolate->debug()->break_frame_id() == StackFrame::NO_ID
+            ? FunctionData::PATCHABLE
+            : FunctionData::ABOVE_BREAK_FRAME;
+    for (StackFrameIterator it(isolate); !it.done(); it.Advance()) {
+      StackFrame* frame = it.frame();
+      if (stack_position == FunctionData::ABOVE_BREAK_FRAME) {
+        if (frame->id() == isolate->debug()->break_frame_id()) {
+          stack_position = FunctionData::PATCHABLE;
+        }
+      }
+      if (stack_position == FunctionData::PATCHABLE &&
+          (frame->is_exit() || frame->is_builtin_exit())) {
+        stack_position = FunctionData::BELOW_NON_DROPPABLE_FRAME;
+        continue;
+      }
+      if (!frame->is_java_script()) continue;
+      std::vector<Handle<SharedFunctionInfo>> sfis;
+      JavaScriptFrame::cast(frame)->GetFunctions(&sfis);
+      for (auto& sfi : sfis) {
+        if (stack_position == FunctionData::PATCHABLE &&
+            IsResumableFunction(sfi->kind())) {
+          stack_position = FunctionData::BELOW_NON_DROPPABLE_FRAME;
+        }
+        FunctionData* data = nullptr;
+        if (!Lookup(*sfi, &data)) continue;
+        if (!data->should_restart) continue;
+        data->stack_position = stack_position;
+        *restart_frame_fp = frame->fp();
+      }
     }
-    shared_info->set_scope_info(new_shared_info->scope_info());
-    shared_info->set_feedback_metadata(new_shared_info->feedback_metadata());
-    shared_info->DisableOptimization(BailoutReason::kLiveEdit);
-  } else {
-    // There should not be any feedback metadata. Keep the outer scope info the
-    // same.
-    DCHECK(!shared_info->HasFeedbackMetadata());
-  }
 
-  int start_position = compile_info_wrapper.GetStartPosition();
-  int end_position = compile_info_wrapper.GetEndPosition();
-  // TODO(cbruni): only store position information on the SFI.
-  shared_info->set_raw_start_position(start_position);
-  shared_info->set_raw_end_position(end_position);
-  if (shared_info->scope_info()->HasPositionInfo()) {
-    shared_info->scope_info()->SetPositionInfo(start_position, end_position);
+    isolate->thread_manager()->IterateArchivedThreads(this);
   }
 
-  FeedbackVectorFixer::PatchFeedbackVector(&compile_info_wrapper, shared_info,
-                                           isolate);
-
-  isolate->debug()->DeoptimizeFunction(shared_info);
-}
-
-void LiveEdit::FunctionSourceUpdated(Handle<JSArray> shared_info_array,
-                                     int new_function_literal_id) {
-  SharedInfoWrapper shared_info_wrapper(shared_info_array);
-  Handle<SharedFunctionInfo> shared_info = shared_info_wrapper.GetInfo();
-
-  shared_info->set_function_literal_id(new_function_literal_id);
-  shared_info_array->GetIsolate()->debug()->DeoptimizeFunction(shared_info);
-}
-
-void LiveEdit::FixupScript(Handle<Script> script, int max_function_literal_id) {
-  Isolate* isolate = script->GetIsolate();
-  Handle<WeakFixedArray> old_infos(script->shared_function_infos(), isolate);
-  Handle<WeakFixedArray> new_infos(
-      isolate->factory()->NewWeakFixedArray(max_function_literal_id + 1));
-  script->set_shared_function_infos(*new_infos);
-  SharedFunctionInfo::ScriptIterator iterator(isolate, old_infos);
-  while (SharedFunctionInfo* shared = iterator.Next()) {
-    // We can't use SharedFunctionInfo::SetScript(info, undefined_value()) here,
-    // as we severed the link from the Script to the SharedFunctionInfo above.
-    Handle<SharedFunctionInfo> info(shared, isolate);
-    info->set_script(isolate->heap()->undefined_value());
-    Handle<Object> new_noscript_list = FixedArrayOfWeakCells::Add(
-        isolate->factory()->noscript_shared_function_infos(), info);
-    isolate->heap()->SetRootNoScriptSharedFunctionInfos(*new_noscript_list);
-
-    // Put the SharedFunctionInfo at its new, correct location.
-    SharedFunctionInfo::SetScript(info, script);
+ private:
+  bool Lookup(int script_id, int function_literal_id, FunctionData** data) {
+    auto it = map_.find(std::make_pair(script_id, function_literal_id));
+    if (it == map_.end()) return false;
+    *data = &it->second;
+    return true;
+  }
+
+  void VisitThread(Isolate* isolate, ThreadLocalTop* top) override {
+    for (JavaScriptFrameIterator it(isolate, top); !it.done(); it.Advance()) {
+      std::vector<Handle<SharedFunctionInfo>> sfis;
+      it.frame()->GetFunctions(&sfis);
+      for (auto& sfi : sfis) {
+        FunctionData* data = nullptr;
+        if (!Lookup(*sfi, &data)) continue;
+        data->stack_position = FunctionData::ARCHIVED_THREAD;
+      }
+    }
   }
-}
 
-void LiveEdit::SetFunctionScript(Handle<JSValue> function_wrapper,
-                                 Handle<Object> script_handle) {
-  Handle<SharedFunctionInfo> shared_info =
-      UnwrapSharedFunctionInfoFromJSValue(function_wrapper);
-  Isolate* isolate = function_wrapper->GetIsolate();
-  CHECK(script_handle->IsScript() || script_handle->IsUndefined(isolate));
-  SharedFunctionInfo::SetScript(shared_info, script_handle);
-  shared_info->DisableOptimization(BailoutReason::kLiveEdit);
+  using UniqueLiteralId = std::pair<int, int>;  // script_id + literal_id
+  std::map<UniqueLiteralId, FunctionData> map_;
+};
 
-  function_wrapper->GetIsolate()->compilation_cache()->Remove(shared_info);
+bool CanPatchScript(const LiteralMap& changed, Handle<Script> script,
+                    Handle<Script> new_script,
+                    FunctionDataMap& function_data_map,
+                    debug::LiveEditResult* result) {
+  debug::LiveEditResult::Status status = debug::LiveEditResult::OK;
+  for (const auto& mapping : changed) {
+    FunctionData* data = nullptr;
+    function_data_map.Lookup(script, mapping.first, &data);
+    FunctionData* new_data = nullptr;
+    function_data_map.Lookup(new_script, mapping.second, &new_data);
+    Handle<SharedFunctionInfo> sfi;
+    if (!data->shared.ToHandle(&sfi)) {
+      continue;
+    } else if (!data->should_restart) {
+      UNREACHABLE();
+    } else if (data->stack_position == FunctionData::ABOVE_BREAK_FRAME) {
+      status = debug::LiveEditResult::BLOCKED_BY_FUNCTION_ABOVE_BREAK_FRAME;
+    } else if (data->stack_position ==
+               FunctionData::BELOW_NON_DROPPABLE_FRAME) {
+      status =
+          debug::LiveEditResult::BLOCKED_BY_FUNCTION_BELOW_NON_DROPPABLE_FRAME;
+    } else if (!data->running_generators.empty()) {
+      status = debug::LiveEditResult::BLOCKED_BY_RUNNING_GENERATOR;
+    } else if (data->stack_position == FunctionData::ARCHIVED_THREAD) {
+      status = debug::LiveEditResult::BLOCKED_BY_ACTIVE_FUNCTION;
+    }
+    if (status != debug::LiveEditResult::OK) {
+      result->status = status;
+      return false;
+    }
+  }
+  return true;
 }
 
-namespace {
-// For a script text change (defined as position_change_array), translates
-// position in unchanged text to position in changed text.
-// Text change is a set of non-overlapping regions in text, that have changed
-// their contents and length. It is specified as array of groups of 3 numbers:
-// (change_begin, change_end, change_end_new_position).
-// Each group describes a change in text; groups are sorted by change_begin.
-// Only position in text beyond any changes may be successfully translated.
-// If a positions is inside some region that changed, result is currently
-// undefined.
-static int TranslatePosition(int original_position,
-                             Handle<JSArray> position_change_array) {
-  int position_diff = 0;
-  int array_len = GetArrayLength(position_change_array);
-  Isolate* isolate = position_change_array->GetIsolate();
-  // TODO(635): binary search may be used here
-  for (int i = 0; i < array_len; i += 3) {
-    HandleScope scope(isolate);
-    Handle<Object> element =
-        JSReceiver::GetElement(isolate, position_change_array, i)
-            .ToHandleChecked();
-    CHECK(element->IsSmi());
-    int chunk_start = Handle<Smi>::cast(element)->value();
-    if (original_position < chunk_start) {
+bool CanRestartFrame(Isolate* isolate, Address fp,
+                     FunctionDataMap& function_data_map,
+                     const LiteralMap& changed, debug::LiveEditResult* result) {
+  DCHECK_GT(fp, 0);
+  StackFrame* restart_frame = nullptr;
+  StackFrameIterator it(isolate);
+  for (; !it.done(); it.Advance()) {
+    if (it.frame()->fp() == fp) {
+      restart_frame = it.frame();
       break;
     }
-    element = JSReceiver::GetElement(isolate, position_change_array, i + 1)
-                  .ToHandleChecked();
-    CHECK(element->IsSmi());
-    int chunk_end = Handle<Smi>::cast(element)->value();
-    // Position mustn't be inside a chunk.
-    DCHECK(original_position >= chunk_end);
-    element = JSReceiver::GetElement(isolate, position_change_array, i + 2)
-                  .ToHandleChecked();
-    CHECK(element->IsSmi());
-    int chunk_changed_end = Handle<Smi>::cast(element)->value();
-    position_diff = chunk_changed_end - chunk_end;
-  }
-
-  return original_position + position_diff;
+  }
+  DCHECK(restart_frame && restart_frame->is_java_script());
+  if (!LiveEdit::kFrameDropperSupported) {
+    result->status = debug::LiveEditResult::FRAME_RESTART_IS_NOT_SUPPORTED;
+    return false;
+  }
+  std::vector<Handle<SharedFunctionInfo>> sfis;
+  JavaScriptFrame::cast(restart_frame)->GetFunctions(&sfis);
+  for (auto& sfi : sfis) {
+    FunctionData* data = nullptr;
+    if (!function_data_map.Lookup(*sfi, &data)) continue;
+    auto new_literal_it = changed.find(data->literal);
+    if (new_literal_it == changed.end()) continue;
+    if (new_literal_it->second->scope()->new_target_var()) {
+      result->status =
+          debug::LiveEditResult::BLOCKED_BY_NEW_TARGET_IN_RESTART_FRAME;
+      return false;
+    }
+  }
+  return true;
 }
 
 void TranslateSourcePositionTable(Handle<BytecodeArray> code,
-                                  Handle<JSArray> position_change_array) {
+                                  const std::vector<SourceChangeRange>& diffs) {
   Isolate* isolate = code->GetIsolate();
   SourcePositionTableBuilder builder;
 
-  Handle<ByteArray> source_position_table(code->SourcePositionTable());
+  Handle<ByteArray> source_position_table(code->SourcePositionTable(), isolate);
   for (SourcePositionTableIterator iterator(*source_position_table);
        !iterator.done(); iterator.Advance()) {
     SourcePosition position = iterator.source_position();
     position.SetScriptOffset(
-        TranslatePosition(position.ScriptOffset(), position_change_array));
+        LiveEdit::TranslatePosition(diffs, position.ScriptOffset()));
     builder.AddPosition(iterator.code_offset(), position,
                         iterator.is_statement());
   }
@@ -968,608 +965,319 @@ void TranslateSourcePositionTable(Handle<BytecodeArray> code,
                  CodeLinePosInfoRecordEvent(code->GetFirstBytecodeAddress(),
                                             *new_source_position_table));
 }
-}  // namespace
-
-void LiveEdit::PatchFunctionPositions(Handle<JSArray> shared_info_array,
-                                      Handle<JSArray> position_change_array) {
-  SharedInfoWrapper shared_info_wrapper(shared_info_array);
-  Handle<SharedFunctionInfo> info = shared_info_wrapper.GetInfo();
-
-  int old_function_start = info->StartPosition();
-  int new_function_start = TranslatePosition(old_function_start,
-                                             position_change_array);
-  int new_function_end =
-      TranslatePosition(info->EndPosition(), position_change_array);
-  int new_function_token_pos =
-      TranslatePosition(info->function_token_position(), position_change_array);
-
-  info->set_raw_start_position(new_function_start);
-  info->set_raw_end_position(new_function_end);
-  // TODO(cbruni): Allocate helper ScopeInfo once the position fields are gone
-  // on the SFI.
-  if (info->scope_info()->HasPositionInfo()) {
-    info->scope_info()->SetPositionInfo(new_function_start, new_function_end);
-  }
-  info->set_function_token_position(new_function_token_pos);
-
-  if (info->HasBytecodeArray()) {
-    TranslateSourcePositionTable(handle(info->GetBytecodeArray()),
-                                 position_change_array);
-  }
-  if (info->HasBreakInfo()) {
-    // Existing break points will be re-applied. Reset the debug info here.
-    info->GetIsolate()->debug()->RemoveBreakInfoAndMaybeFree(
-        handle(info->GetDebugInfo()));
-  }
-}
-
-
-static Handle<Script> CreateScriptCopy(Handle<Script> original) {
-  Isolate* isolate = original->GetIsolate();
-
-  Handle<String> original_source(String::cast(original->source()));
-  Handle<Script> copy = isolate->factory()->NewScript(original_source);
 
-  copy->set_name(original->name());
-  copy->set_line_offset(original->line_offset());
-  copy->set_column_offset(original->column_offset());
-  copy->set_type(original->type());
-  copy->set_context_data(original->context_data());
-  copy->set_eval_from_shared_or_wrapped_arguments(
-      original->eval_from_shared_or_wrapped_arguments());
-  copy->set_eval_from_position(original->eval_from_position());
-
-  Handle<WeakFixedArray> infos(isolate->factory()->NewWeakFixedArray(
-      original->shared_function_infos()->length()));
-  copy->set_shared_function_infos(*infos);
-
-  // Copy all the flags, but clear compilation state.
-  copy->set_flags(original->flags());
-  copy->set_compilation_state(Script::COMPILATION_STATE_INITIAL);
-
-  return copy;
+void UpdatePositions(Isolate* isolate, Handle<SharedFunctionInfo> sfi,
+                     const std::vector<SourceChangeRange>& diffs) {
+  int old_start_position = sfi->StartPosition();
+  int new_start_position =
+      LiveEdit::TranslatePosition(diffs, old_start_position);
+  int new_end_position = LiveEdit::TranslatePosition(diffs, sfi->EndPosition());
+  int new_function_token_position =
+      LiveEdit::TranslatePosition(diffs, sfi->function_token_position());
+  sfi->SetPosition(new_start_position, new_end_position);
+  sfi->SetFunctionTokenPosition(new_function_token_position,
+                                new_start_position);
+  if (sfi->HasBytecodeArray()) {
+    TranslateSourcePositionTable(handle(sfi->GetBytecodeArray(), isolate),
+                                 diffs);
+  }
 }
+}  // anonymous namespace
 
-Handle<Object> LiveEdit::ChangeScriptSource(Handle<Script> original_script,
-                                            Handle<String> new_source,
-                                            Handle<Object> old_script_name) {
-  Isolate* isolate = original_script->GetIsolate();
-  Handle<Object> old_script_object;
-  if (old_script_name->IsString()) {
-    Handle<Script> old_script = CreateScriptCopy(original_script);
-    old_script->set_name(String::cast(*old_script_name));
-    old_script_object = old_script;
-    isolate->debug()->OnAfterCompile(old_script);
-  } else {
-    old_script_object = isolate->factory()->null_value();
+void LiveEdit::PatchScript(Isolate* isolate, Handle<Script> script,
+                           Handle<String> new_source, bool preview,
+                           debug::LiveEditResult* result) {
+  std::vector<SourceChangeRange> diffs;
+  LiveEdit::CompareStrings(isolate,
+                           handle(String::cast(script->source()), isolate),
+                           new_source, &diffs);
+  if (diffs.empty()) {
+    result->status = debug::LiveEditResult::OK;
+    return;
   }
 
-  original_script->set_source(*new_source);
+  ParseInfo parse_info(isolate, script);
+  std::vector<FunctionLiteral*> literals;
+  if (!ParseScript(isolate, &parse_info, false, &literals, result)) return;
 
-  // Drop line ends so that they will be recalculated.
-  original_script->set_line_ends(isolate->heap()->undefined_value());
-
-  return old_script_object;
-}
+  Handle<Script> new_script = isolate->factory()->CloneScript(script);
+  new_script->set_source(*new_source);
+  std::vector<FunctionLiteral*> new_literals;
+  ParseInfo new_parse_info(isolate, new_script);
+  if (!ParseScript(isolate, &new_parse_info, true, &new_literals, result)) {
+    return;
+  }
 
+  FunctionLiteralChanges literal_changes;
+  CalculateFunctionLiteralChanges(literals, diffs, &literal_changes);
 
+  LiteralMap changed;
+  LiteralMap unchanged;
+  MapLiterals(literal_changes, new_literals, &unchanged, &changed);
 
-void LiveEdit::ReplaceRefToNestedFunction(
-    Handle<JSValue> parent_function_wrapper,
-    Handle<JSValue> orig_function_wrapper,
-    Handle<JSValue> subst_function_wrapper) {
+  FunctionDataMap function_data_map;
+  for (const auto& mapping : changed) {
+    function_data_map.AddInterestingLiteral(script->id(), mapping.first, true);
+    function_data_map.AddInterestingLiteral(new_script->id(), mapping.second,
+                                            false);
+  }
+  for (const auto& mapping : unchanged) {
+    function_data_map.AddInterestingLiteral(script->id(), mapping.first, false);
+  }
+  Address restart_frame_fp = 0;
+  function_data_map.Fill(isolate, &restart_frame_fp);
 
-  Handle<SharedFunctionInfo> parent_shared =
-      UnwrapSharedFunctionInfoFromJSValue(parent_function_wrapper);
-  Handle<SharedFunctionInfo> orig_shared =
-      UnwrapSharedFunctionInfoFromJSValue(orig_function_wrapper);
-  Handle<SharedFunctionInfo> subst_shared =
-      UnwrapSharedFunctionInfoFromJSValue(subst_function_wrapper);
+  if (!CanPatchScript(changed, script, new_script, function_data_map, result)) {
+    return;
+  }
+  if (restart_frame_fp &&
+      !CanRestartFrame(isolate, restart_frame_fp, function_data_map, changed,
+                       result)) {
+    return;
+  }
 
-  for (RelocIterator it(parent_shared->GetCode()); !it.done(); it.next()) {
-    if (it.rinfo()->rmode() == RelocInfo::EMBEDDED_OBJECT) {
-      if (it.rinfo()->target_object() == *orig_shared) {
-        it.rinfo()->set_target_object(*subst_shared);
-      }
-    }
+  if (preview) {
+    result->status = debug::LiveEditResult::OK;
+    return;
   }
-}
 
+  for (const auto& mapping : unchanged) {
+    FunctionData* data = nullptr;
+    if (!function_data_map.Lookup(script, mapping.first, &data)) continue;
+    Handle<SharedFunctionInfo> sfi;
+    if (!data->shared.ToHandle(&sfi)) continue;
+    DCHECK_EQ(sfi->script(), *script);
 
-// Check an activation against list of functions. If there is a function
-// that matches, its status in result array is changed to status argument value.
-static bool CheckActivation(Handle<JSArray> shared_info_array,
-                            Handle<JSArray> result,
-                            StackFrame* frame,
-                            LiveEdit::FunctionPatchabilityStatus status) {
-  if (!frame->is_java_script()) return false;
+    isolate->compilation_cache()->Remove(sfi);
+    isolate->debug()->DeoptimizeFunction(sfi);
+    if (sfi->HasDebugInfo()) {
+      Handle<DebugInfo> debug_info(sfi->GetDebugInfo(), isolate);
+      isolate->debug()->RemoveBreakInfoAndMaybeFree(debug_info);
+    }
+    UpdatePositions(isolate, sfi, diffs);
+
+    MaybeObject* weak_redundant_new_sfi =
+        new_script->shared_function_infos()->Get(
+            mapping.second->function_literal_id());
+
+    sfi->set_function_literal_id(mapping.second->function_literal_id());
+    sfi->set_script(*new_script);
+    new_script->shared_function_infos()->Set(
+        mapping.second->function_literal_id(), HeapObjectReference::Weak(*sfi));
+    DCHECK_EQ(sfi->function_literal_id(),
+              mapping.second->function_literal_id());
+
+    // Swap the now-redundant, newly compiled SFI into the old script, so that
+    // we can look up the old function_literal_id using the new SFI when
+    // processing changed functions.
+    HeapObject* redundant_new_sfi_obj;
+    if (weak_redundant_new_sfi->ToStrongOrWeakHeapObject(
+            &redundant_new_sfi_obj)) {
+      SharedFunctionInfo* redundant_new_sfi =
+          SharedFunctionInfo::cast(redundant_new_sfi_obj);
+
+      redundant_new_sfi->set_function_literal_id(
+          mapping.first->function_literal_id());
+      redundant_new_sfi->set_script(*script);
+      script->shared_function_infos()->Set(
+          mapping.first->function_literal_id(),
+          HeapObjectReference::Weak(redundant_new_sfi));
+    }
 
-  Handle<JSFunction> function(JavaScriptFrame::cast(frame)->function());
+    if (sfi->HasUncompiledDataWithPreParsedScope()) {
+      sfi->ClearPreParsedScopeData();
+    }
 
-  Isolate* isolate = shared_info_array->GetIsolate();
-  int len = GetArrayLength(shared_info_array);
-  for (int i = 0; i < len; i++) {
-    HandleScope scope(isolate);
-    Handle<Object> element =
-        JSReceiver::GetElement(isolate, shared_info_array, i).ToHandleChecked();
-    Handle<JSValue> jsvalue = Handle<JSValue>::cast(element);
-    Handle<SharedFunctionInfo> shared =
-        UnwrapSharedFunctionInfoFromJSValue(jsvalue);
-
-    if (function->shared() == *shared ||
-        (function->code()->is_optimized_code() &&
-         function->code()->Inlines(*shared))) {
-      SetElementSloppy(result, i, Handle<Smi>(Smi::FromInt(status), isolate));
-      return true;
+    for (auto& js_function : data->js_functions) {
+      js_function->set_feedback_cell(*isolate->factory()->many_closures_cell());
+      if (!js_function->is_compiled()) continue;
+      JSFunction::EnsureFeedbackVector(js_function);
     }
-  }
-  return false;
-}
 
-// Describes a set of call frames that execute any of listed functions.
-// Finding no such frames does not mean error.
-class MultipleFunctionTarget {
- public:
-  MultipleFunctionTarget(Handle<JSArray> old_shared_array,
-                         Handle<JSArray> new_shared_array,
-                         Handle<JSArray> result)
-      : old_shared_array_(old_shared_array),
-        new_shared_array_(new_shared_array),
-        result_(result) {}
-  bool MatchActivation(StackFrame* frame,
-      LiveEdit::FunctionPatchabilityStatus status) {
-    return CheckActivation(old_shared_array_, result_, frame, status);
-  }
-  const char* GetNotFoundMessage() const { return nullptr; }
-  bool FrameUsesNewTarget(StackFrame* frame) {
-    if (!frame->is_java_script()) return false;
-    JavaScriptFrame* jsframe = JavaScriptFrame::cast(frame);
-    Handle<SharedFunctionInfo> old_shared(jsframe->function()->shared());
-    Isolate* isolate = old_shared->GetIsolate();
-    int len = GetArrayLength(old_shared_array_);
-    // Find corresponding new shared function info and return whether it
-    // references new.target.
-    for (int i = 0; i < len; i++) {
-      HandleScope scope(isolate);
-      Handle<Object> old_element =
-          JSReceiver::GetElement(isolate, old_shared_array_, i)
-              .ToHandleChecked();
-      if (!old_shared.is_identical_to(UnwrapSharedFunctionInfoFromJSValue(
-              Handle<JSValue>::cast(old_element)))) {
+    if (!sfi->HasBytecodeArray()) continue;
+    Handle<BytecodeArray> bytecode(sfi->GetBytecodeArray(), isolate);
+    Handle<FixedArray> constants(bytecode->constant_pool(), isolate);
+    for (int i = 0; i < constants->length(); ++i) {
+      if (!constants->get(i)->IsSharedFunctionInfo()) continue;
+      FunctionData* data = nullptr;
+      if (!function_data_map.Lookup(SharedFunctionInfo::cast(constants->get(i)),
+                                    &data)) {
         continue;
       }
-
-      Handle<Object> new_element =
-          JSReceiver::GetElement(isolate, new_shared_array_, i)
-              .ToHandleChecked();
-      if (new_element->IsUndefined(isolate)) return false;
-      Handle<SharedFunctionInfo> new_shared =
-          UnwrapSharedFunctionInfoFromJSValue(
-              Handle<JSValue>::cast(new_element));
-      if (new_shared->scope_info()->HasNewTarget()) {
-        SetElementSloppy(
-            result_, i,
-            Handle<Smi>(
-                Smi::FromInt(
-                    LiveEdit::FUNCTION_BLOCKED_NO_NEW_TARGET_ON_RESTART),
-                isolate));
-        return true;
+      auto change_it = changed.find(data->literal);
+      if (change_it == changed.end()) continue;
+      if (!function_data_map.Lookup(new_script, change_it->second, &data)) {
+        continue;
       }
-      return false;
+      Handle<SharedFunctionInfo> new_sfi;
+      if (!data->shared.ToHandle(&new_sfi)) continue;
+      constants->set(i, *new_sfi);
     }
-    return false;
   }
-
-  void set_status(LiveEdit::FunctionPatchabilityStatus status) {
-    Isolate* isolate = old_shared_array_->GetIsolate();
-    int len = GetArrayLength(old_shared_array_);
-    for (int i = 0; i < len; ++i) {
-      Handle<Object> old_element =
-          JSReceiver::GetElement(isolate, result_, i).ToHandleChecked();
-      if (!old_element->IsSmi() ||
-          Smi::ToInt(*old_element) == LiveEdit::FUNCTION_AVAILABLE_FOR_PATCH) {
-        SetElementSloppy(result_, i,
-                         Handle<Smi>(Smi::FromInt(status), isolate));
-      }
+  for (const auto& mapping : changed) {
+    FunctionData* data = nullptr;
+    if (!function_data_map.Lookup(new_script, mapping.second, &data)) continue;
+    Handle<SharedFunctionInfo> new_sfi = data->shared.ToHandleChecked();
+    DCHECK_EQ(new_sfi->script(), *new_script);
+
+    if (!function_data_map.Lookup(script, mapping.first, &data)) continue;
+    Handle<SharedFunctionInfo> sfi;
+    if (!data->shared.ToHandle(&sfi)) continue;
+
+    isolate->debug()->DeoptimizeFunction(sfi);
+    isolate->compilation_cache()->Remove(sfi);
+    for (auto& js_function : data->js_functions) {
+      js_function->set_shared(*new_sfi);
+      js_function->set_code(js_function->shared()->GetCode());
+
+      js_function->set_feedback_cell(*isolate->factory()->many_closures_cell());
+      if (!js_function->is_compiled()) continue;
+      JSFunction::EnsureFeedbackVector(js_function);
     }
-  }
-
- private:
-  Handle<JSArray> old_shared_array_;
-  Handle<JSArray> new_shared_array_;
-  Handle<JSArray> result_;
-};
-
 
-// Drops all call frame matched by target and all frames above them.
-template <typename TARGET>
-static const char* DropActivationsInActiveThreadImpl(Isolate* isolate,
-                                                     TARGET& target,  // NOLINT
-                                                     bool do_drop) {
-  Debug* debug = isolate->debug();
-  Zone zone(isolate->allocator(), ZONE_NAME);
-  Vector<StackFrame*> frames = CreateStackMap(isolate, &zone);
-
-  int top_frame_index = -1;
-  int frame_index = 0;
-  for (; frame_index < frames.length(); frame_index++) {
-    StackFrame* frame = frames[frame_index];
-    if (frame->id() == debug->break_frame_id()) {
-      top_frame_index = frame_index;
-      break;
-    }
-    if (target.MatchActivation(
-            frame, LiveEdit::FUNCTION_BLOCKED_UNDER_NATIVE_CODE)) {
-      // We are still above break_frame. It is not a target frame,
-      // it is a problem.
-      return "Debugger mark-up on stack is not found";
+    if (!new_sfi->HasBytecodeArray()) continue;
+    FixedArray* constants = new_sfi->GetBytecodeArray()->constant_pool();
+    for (int i = 0; i < constants->length(); ++i) {
+      if (!constants->get(i)->IsSharedFunctionInfo()) continue;
+      SharedFunctionInfo* inner_sfi =
+          SharedFunctionInfo::cast(constants->get(i));
+      if (inner_sfi->script() != *script) continue;
+
+      // If the inner SFI's script is the old script, then this is actually a
+      // redundant new_script SFI where the old script SFI was unchanged, so we
+      // swapped their scripts in the unchanged iteration. This means that we
+      // have to update this changed SFI's inner SFI constant to point at the
+      // old inner SFI, which has already been patched to be on the new script.
+      //
+      // So, we look up FunctionData using the current, newly compiled
+      // inner_sfi, but the resulting FunctionData will still be referring to
+      // the old, unchanged SFI.
+      FunctionData* data = nullptr;
+      if (!function_data_map.Lookup(inner_sfi, &data)) continue;
+      Handle<SharedFunctionInfo> old_unchanged_inner_sfi =
+          data->shared.ToHandleChecked();
+      // Now some sanity checks. Make sure that this inner_sfi is not the
+      // unchanged SFI yet...
+      DCHECK_NE(*old_unchanged_inner_sfi, inner_sfi);
+      // ... that the unchanged SFI has already been processed and patched to be
+      // on the new script ...
+      DCHECK_EQ(old_unchanged_inner_sfi->script(), *new_script);
+      // ... and that the id of the unchanged SFI matches the unchanged target
+      // literal's id.
+      DCHECK_EQ(old_unchanged_inner_sfi->function_literal_id(),
+                unchanged[data->literal]->function_literal_id());
+      constants->set(i, *old_unchanged_inner_sfi);
     }
   }
-
-  if (top_frame_index == -1) {
-    // We haven't found break frame, but no function is blocking us anyway.
-    return target.GetNotFoundMessage();
-  }
-
-  bool target_frame_found = false;
-  int bottom_js_frame_index = top_frame_index;
-  bool non_droppable_frame_found = false;
-  LiveEdit::FunctionPatchabilityStatus non_droppable_reason;
-
-  for (; frame_index < frames.length(); frame_index++) {
-    StackFrame* frame = frames[frame_index];
-    if (frame->is_exit() || frame->is_builtin_exit()) {
-      non_droppable_frame_found = true;
-      non_droppable_reason = LiveEdit::FUNCTION_BLOCKED_UNDER_NATIVE_CODE;
-      break;
-    }
-    if (frame->is_java_script()) {
-      SharedFunctionInfo* shared =
-          JavaScriptFrame::cast(frame)->function()->shared();
-      if (IsResumableFunction(shared->kind())) {
-        non_droppable_frame_found = true;
-        non_droppable_reason = LiveEdit::FUNCTION_BLOCKED_UNDER_GENERATOR;
-        break;
+#ifdef DEBUG
+  {
+    // Check that all the functions in the new script are valid.
+    SharedFunctionInfo::ScriptIterator it(isolate, *new_script);
+    while (SharedFunctionInfo* sfi = it.Next()) {
+      DCHECK_EQ(sfi->script(), *new_script);
+
+      if (!sfi->HasBytecodeArray()) continue;
+      // Check that all the functions in this function's constant pool are also
+      // on the new script, and that their id matches their index in the new
+      // scripts function list.
+      FixedArray* constants = sfi->GetBytecodeArray()->constant_pool();
+      for (int i = 0; i < constants->length(); ++i) {
+        if (!constants->get(i)->IsSharedFunctionInfo()) continue;
+        SharedFunctionInfo* inner_sfi =
+            SharedFunctionInfo::cast(constants->get(i));
+        DCHECK_EQ(inner_sfi->script(), *new_script);
+        DCHECK_EQ(inner_sfi, new_script->shared_function_infos()
+                                 ->Get(inner_sfi->function_literal_id())
+                                 ->GetHeapObject());
       }
     }
-    if (target.MatchActivation(
-            frame, LiveEdit::FUNCTION_BLOCKED_ON_ACTIVE_STACK)) {
-      target_frame_found = true;
-      bottom_js_frame_index = frame_index;
-    }
   }
+#endif
 
-  if (non_droppable_frame_found) {
-    // There is a C or generator frame on stack.  We can't drop C frames, and we
-    // can't restart generators.  Check that there are no target frames below
-    // them.
-    for (; frame_index < frames.length(); frame_index++) {
-      StackFrame* frame = frames[frame_index];
-      if (frame->is_java_script()) {
-        if (target.MatchActivation(frame, non_droppable_reason)) {
-          // Fail.
-          return nullptr;
-        }
-        if (non_droppable_reason ==
-                LiveEdit::FUNCTION_BLOCKED_UNDER_GENERATOR &&
-            !target_frame_found) {
-          // Fail.
-          target.set_status(non_droppable_reason);
-          return nullptr;
-        }
+  if (restart_frame_fp) {
+    for (StackFrameIterator it(isolate); !it.done(); it.Advance()) {
+      if (it.frame()->fp() == restart_frame_fp) {
+        isolate->debug()->ScheduleFrameRestart(it.frame());
+        result->stack_changed = true;
+        break;
       }
     }
   }
 
-  // We cannot restart a frame that uses new.target.
-  if (target.FrameUsesNewTarget(frames[bottom_js_frame_index])) return nullptr;
-
-  if (!do_drop) {
-    // We are in check-only mode.
-    return nullptr;
-  }
-
-  if (!target_frame_found) {
-    // Nothing to drop.
-    return target.GetNotFoundMessage();
-  }
-
-  if (!LiveEdit::kFrameDropperSupported) {
-    return "Stack manipulations are not supported in this architecture.";
-  }
-
-  debug->ScheduleFrameRestart(frames[bottom_js_frame_index]);
-  return nullptr;
+  int script_id = script->id();
+  script->set_id(new_script->id());
+  new_script->set_id(script_id);
+  result->status = debug::LiveEditResult::OK;
+  result->script = ToApiHandle<v8::debug::Script>(new_script);
 }
 
-
-// Fills result array with statuses of functions. Modifies the stack
-// removing all listed function if possible and if do_drop is true.
-static const char* DropActivationsInActiveThread(
-    Handle<JSArray> old_shared_array, Handle<JSArray> new_shared_array,
-    Handle<JSArray> result, bool do_drop) {
-  MultipleFunctionTarget target(old_shared_array, new_shared_array, result);
-  Isolate* isolate = old_shared_array->GetIsolate();
-
-  const char* message =
-      DropActivationsInActiveThreadImpl(isolate, target, do_drop);
-  if (message) {
-    return message;
-  }
-
-  int array_len = GetArrayLength(old_shared_array);
-
-  // Replace "blocked on active" with "replaced on active" status.
-  for (int i = 0; i < array_len; i++) {
-    Handle<Object> obj =
-        JSReceiver::GetElement(isolate, result, i).ToHandleChecked();
-    if (*obj == Smi::FromInt(LiveEdit::FUNCTION_BLOCKED_ON_ACTIVE_STACK)) {
-      Handle<Object> replaced(
-          Smi::FromInt(LiveEdit::FUNCTION_REPLACED_ON_ACTIVE_STACK), isolate);
-      SetElementSloppy(result, i, replaced);
-    }
-  }
-  return nullptr;
+void LiveEdit::InitializeThreadLocal(Debug* debug) {
+  debug->thread_local_.restart_fp_ = 0;
 }
 
-
-bool LiveEdit::FindActiveGenerators(Handle<FixedArray> shared_info_array,
-                                    Handle<FixedArray> result,
-                                    int len) {
-  Isolate* isolate = shared_info_array->GetIsolate();
-  bool found_suspended_activations = false;
-
-  DCHECK_LE(len, result->length());
-
-  FunctionPatchabilityStatus active = FUNCTION_BLOCKED_ACTIVE_GENERATOR;
-
-  Heap* heap = isolate->heap();
-  HeapIterator iterator(heap, HeapIterator::kFilterUnreachable);
-  HeapObject* obj = nullptr;
-  while ((obj = iterator.next()) != nullptr) {
-    if (!obj->IsJSGeneratorObject()) continue;
-
-    JSGeneratorObject* gen = JSGeneratorObject::cast(obj);
-    if (gen->is_closed()) continue;
-
-    HandleScope scope(isolate);
-
-    for (int i = 0; i < len; i++) {
-      Handle<JSValue> jsvalue = Handle<JSValue>::cast(
-          FixedArray::get(*shared_info_array, i, isolate));
-      Handle<SharedFunctionInfo> shared =
-          UnwrapSharedFunctionInfoFromJSValue(jsvalue);
-
-      if (gen->function()->shared() == *shared) {
-        result->set(i, Smi::FromInt(active));
-        found_suspended_activations = true;
+bool LiveEdit::RestartFrame(JavaScriptFrame* frame) {
+  if (!LiveEdit::kFrameDropperSupported) return false;
+  Isolate* isolate = frame->isolate();
+  StackFrame::Id break_frame_id = isolate->debug()->break_frame_id();
+  bool break_frame_found = break_frame_id == StackFrame::NO_ID;
+  for (StackFrameIterator it(isolate); !it.done(); it.Advance()) {
+    StackFrame* current = it.frame();
+    break_frame_found = break_frame_found || break_frame_id == current->id();
+    if (current->fp() == frame->fp()) {
+      if (break_frame_found) {
+        isolate->debug()->ScheduleFrameRestart(current);
+        return true;
+      } else {
+        return false;
       }
     }
-  }
-
-  return found_suspended_activations;
-}
-
-
-class InactiveThreadActivationsChecker : public ThreadVisitor {
- public:
-  InactiveThreadActivationsChecker(Handle<JSArray> old_shared_array,
-                                   Handle<JSArray> result)
-      : old_shared_array_(old_shared_array),
-        result_(result),
-        has_blocked_functions_(false) {}
-  void VisitThread(Isolate* isolate, ThreadLocalTop* top) {
-    for (StackFrameIterator it(isolate, top); !it.done(); it.Advance()) {
-      has_blocked_functions_ |=
-          CheckActivation(old_shared_array_, result_, it.frame(),
-                          LiveEdit::FUNCTION_BLOCKED_ON_OTHER_STACK);
+    if (!break_frame_found) continue;
+    if (current->is_exit() || current->is_builtin_exit()) {
+      return false;
     }
-  }
-  bool HasBlockedFunctions() {
-    return has_blocked_functions_;
-  }
-
- private:
-  Handle<JSArray> old_shared_array_;
-  Handle<JSArray> result_;
-  bool has_blocked_functions_;
-};
-
-
-Handle<JSArray> LiveEdit::CheckAndDropActivations(
-    Handle<JSArray> old_shared_array, Handle<JSArray> new_shared_array,
-    bool do_drop) {
-  Isolate* isolate = old_shared_array->GetIsolate();
-  int len = GetArrayLength(old_shared_array);
-
-  DCHECK(old_shared_array->HasFastElements());
-  Handle<FixedArray> old_shared_array_elements(
-      FixedArray::cast(old_shared_array->elements()));
-
-  Handle<JSArray> result = isolate->factory()->NewJSArray(len);
-  result->set_length(Smi::FromInt(len));
-  JSObject::EnsureWritableFastElements(result);
-  Handle<FixedArray> result_elements =
-      handle(FixedArray::cast(result->elements()), isolate);
-
-  // Fill the default values.
-  for (int i = 0; i < len; i++) {
-    FunctionPatchabilityStatus status = FUNCTION_AVAILABLE_FOR_PATCH;
-    result_elements->set(i, Smi::FromInt(status));
-  }
-
-  // Scan the heap for active generators -- those that are either currently
-  // running (as we wouldn't want to restart them, because we don't know where
-  // to restart them from) or suspended.  Fail if any one corresponds to the set
-  // of functions being edited.
-  if (FindActiveGenerators(old_shared_array_elements, result_elements, len)) {
-    return result;
-  }
-
-  // Check inactive threads. Fail if some functions are blocked there.
-  InactiveThreadActivationsChecker inactive_threads_checker(old_shared_array,
-                                                            result);
-  isolate->thread_manager()->IterateArchivedThreads(
-      &inactive_threads_checker);
-  if (inactive_threads_checker.HasBlockedFunctions()) {
-    return result;
-  }
-
-  // Try to drop activations from the current stack.
-  const char* error_message = DropActivationsInActiveThread(
-      old_shared_array, new_shared_array, result, do_drop);
-  if (error_message != nullptr) {
-    // Add error message as an array extra element.
-    Handle<String> str =
-        isolate->factory()->NewStringFromAsciiChecked(error_message);
-    SetElementSloppy(result, len, str);
-  }
-  return result;
-}
-
-
-// Describes a single callframe a target. Not finding this frame
-// means an error.
-class SingleFrameTarget {
- public:
-  explicit SingleFrameTarget(JavaScriptFrame* frame)
-      : m_frame(frame),
-        m_saved_status(LiveEdit::FUNCTION_AVAILABLE_FOR_PATCH) {}
-
-  bool MatchActivation(StackFrame* frame,
-      LiveEdit::FunctionPatchabilityStatus status) {
-    if (frame->fp() == m_frame->fp()) {
-      m_saved_status = status;
-      return true;
+    if (!current->is_java_script()) continue;
+    std::vector<Handle<SharedFunctionInfo>> shareds;
+    JavaScriptFrame::cast(current)->GetFunctions(&shareds);
+    for (auto& shared : shareds) {
+      if (IsResumableFunction(shared->kind())) {
+        return false;
+      }
     }
-    return false;
   }
-  const char* GetNotFoundMessage() const {
-    return "Failed to found requested frame";
-  }
-  LiveEdit::FunctionPatchabilityStatus saved_status() {
-    return m_saved_status;
-  }
-  void set_status(LiveEdit::FunctionPatchabilityStatus status) {
-    m_saved_status = status;
-  }
-
-  bool FrameUsesNewTarget(StackFrame* frame) {
-    if (!frame->is_java_script()) return false;
-    JavaScriptFrame* jsframe = JavaScriptFrame::cast(frame);
-    Handle<SharedFunctionInfo> shared(jsframe->function()->shared());
-    return shared->scope_info()->HasNewTarget();
-  }
-
- private:
-  JavaScriptFrame* m_frame;
-  LiveEdit::FunctionPatchabilityStatus m_saved_status;
-};
-
-// Finds a drops required frame and all frames above.
-// Returns error message or nullptr.
-const char* LiveEdit::RestartFrame(JavaScriptFrame* frame) {
-  SingleFrameTarget target(frame);
-
-  const char* result =
-      DropActivationsInActiveThreadImpl(frame->isolate(), target, true);
-  if (result != nullptr) {
-    return result;
-  }
-  if (target.saved_status() == LiveEdit::FUNCTION_BLOCKED_UNDER_NATIVE_CODE) {
-    return "Function is blocked under native code";
-  }
-  if (target.saved_status() == LiveEdit::FUNCTION_BLOCKED_UNDER_GENERATOR) {
-    return "Function is blocked under a generator activation";
-  }
-  return nullptr;
-}
-
-Handle<JSArray> LiveEditFunctionTracker::Collect(FunctionLiteral* node,
-                                                 Handle<Script> script,
-                                                 Zone* zone, Isolate* isolate) {
-  LiveEditFunctionTracker visitor(script, zone, isolate);
-  visitor.VisitFunctionLiteral(node);
-  return visitor.result_;
+  return false;
 }
 
-LiveEditFunctionTracker::LiveEditFunctionTracker(Handle<Script> script,
-                                                 Zone* zone, Isolate* isolate)
-    : AstTraversalVisitor<LiveEditFunctionTracker>(isolate) {
-  current_parent_index_ = -1;
-  isolate_ = isolate;
-  len_ = 0;
-  result_ = isolate->factory()->NewJSArray(10);
-  script_ = script;
-  zone_ = zone;
-}
+void LiveEdit::CompareStrings(Isolate* isolate, Handle<String> s1,
+                              Handle<String> s2,
+                              std::vector<SourceChangeRange>* diffs) {
+  s1 = String::Flatten(isolate, s1);
+  s2 = String::Flatten(isolate, s2);
 
-void LiveEditFunctionTracker::VisitFunctionLiteral(FunctionLiteral* node) {
-  // FunctionStarted is called in pre-order.
-  FunctionStarted(node);
-  // Recurse using the regular traversal.
-  AstTraversalVisitor::VisitFunctionLiteral(node);
-  // FunctionDone are called in post-order.
-  Handle<SharedFunctionInfo> info =
-      script_->FindSharedFunctionInfo(isolate_, node).ToHandleChecked();
-  FunctionDone(info, node->scope());
-}
-
-void LiveEditFunctionTracker::FunctionStarted(FunctionLiteral* fun) {
-  HandleScope handle_scope(isolate_);
-  FunctionInfoWrapper info = FunctionInfoWrapper::Create(isolate_);
-  info.SetInitialProperties(fun->name(isolate_), fun->start_position(),
-                            fun->end_position(), fun->parameter_count(),
-                            current_parent_index_, fun->function_literal_id());
-  current_parent_index_ = len_;
-  SetElementSloppy(result_, len_, info.GetJSArray());
-  len_++;
-}
+  LineEndsWrapper line_ends1(isolate, s1);
+  LineEndsWrapper line_ends2(isolate, s2);
 
-// Saves full information about a function: its code, its scope info
-// and a SharedFunctionInfo object.
-void LiveEditFunctionTracker::FunctionDone(Handle<SharedFunctionInfo> shared,
-                                           Scope* scope) {
-  HandleScope handle_scope(isolate_);
-  FunctionInfoWrapper info = FunctionInfoWrapper::cast(
-      *JSReceiver::GetElement(isolate_, result_, current_parent_index_)
-           .ToHandleChecked());
-  info.SetSharedFunctionInfo(shared);
+  LineArrayCompareInput input(s1, s2, line_ends1, line_ends2);
+  TokenizingLineArrayCompareOutput output(isolate, line_ends1, line_ends2, s1,
+                                          s2, diffs);
 
-  Handle<Object> scope_info_list = SerializeFunctionScope(scope);
-  info.SetFunctionScopeInfo(scope_info_list);
+  NarrowDownInput(&input, &output);
 
-  current_parent_index_ = info.GetParentIndex();
+  Comparator::CalculateDifference(&input, &output);
 }
 
-Handle<Object> LiveEditFunctionTracker::SerializeFunctionScope(Scope* scope) {
-  Handle<JSArray> scope_info_list = isolate_->factory()->NewJSArray(10);
-  int scope_info_length = 0;
-
-  // Saves some description of scope. It stores name and indexes of
-  // variables in the whole scope chain. Null-named slots delimit
-  // scopes of this chain.
-  Scope* current_scope = scope;
-  while (current_scope != nullptr) {
-    HandleScope handle_scope(isolate_);
-    for (Variable* var : *current_scope->locals()) {
-      if (!var->IsContextSlot()) continue;
-      int context_index = var->index() - Context::MIN_CONTEXT_SLOTS;
-      int location = scope_info_length + context_index * 2;
-      SetElementSloppy(scope_info_list, location, var->name());
-      SetElementSloppy(scope_info_list, location + 1,
-                       handle(Smi::FromInt(var->index()), isolate_));
-    }
-    scope_info_length += current_scope->ContextLocalCount() * 2;
-    SetElementSloppy(scope_info_list, scope_info_length,
-                     isolate_->factory()->null_value());
-    scope_info_length++;
-
-    current_scope = current_scope->outer_scope();
-  }
-
-  return scope_info_list;
+int LiveEdit::TranslatePosition(const std::vector<SourceChangeRange>& diffs,
+                                int position) {
+  auto it = std::lower_bound(diffs.begin(), diffs.end(), position,
+                             [](const SourceChangeRange& change, int position) {
+                               return change.end_position < position;
+                             });
+  if (it != diffs.end() && position == it->end_position) {
+    return it->new_end_position;
+  }
+  if (it == diffs.begin()) return position;
+  DCHECK(it == diffs.end() || position <= it->start_position);
+  it = std::prev(it);
+  return position + (it->new_end_position - it->end_position);
 }
-
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/src/debug/liveedit.h b/deps/v8/src/debug/liveedit.h
index 120b9c87ebd2f1..1b053e45197d69 100644
--- a/deps/v8/src/debug/liveedit.h
+++ b/deps/v8/src/debug/liveedit.h
@@ -5,318 +5,73 @@
 #ifndef V8_DEBUG_LIVEEDIT_H_
 #define V8_DEBUG_LIVEEDIT_H_
 
+#include <vector>
 
-// Live Edit feature implementation.
-// User should be able to change script on already running VM. This feature
-// matches hot swap features in other frameworks.
-//
-// The basic use-case is when user spots some mistake in function body
-// from debugger and wishes to change the algorithm without restart.
-//
-// A single change always has a form of a simple replacement (in pseudo-code):
-//   script.source[positions, positions+length] = new_string;
-// Implementation first determines, which function's body includes this
-// change area. Then both old and new versions of script are fully compiled
-// in order to analyze, whether the function changed its outer scope
-// expectations (or number of parameters). If it didn't, function's code is
-// patched with a newly compiled code. If it did change, enclosing function
-// gets patched. All inner functions are left untouched, whatever happened
-// to them in a new script version. However, new version of code will
-// instantiate newly compiled functions.
-
-
-#include "src/allocation.h"
-#include "src/ast/ast-traversal-visitor.h"
+#include "src/globals.h"
+#include "src/handles.h"
 
 namespace v8 {
+namespace debug {
+struct LiveEditResult;
+}
 namespace internal {
 
+class Script;
+class String;
+class Debug;
 class JavaScriptFrame;
 
-// This class collects some specific information on structure of functions
-// in a particular script.
-//
-// The primary interest of the Tracker is to record function scope structures
-// in order to analyze whether function code may be safely patched (with new
-// code successfully reading existing data from function scopes). The Tracker
-// also collects compiled function codes.
-class LiveEditFunctionTracker
-    : public AstTraversalVisitor<LiveEditFunctionTracker> {
- public:
-  // Traverses the entire AST, and records information about all
-  // FunctionLiterals for further use by LiveEdit code patching. The collected
-  // information is returned as a serialized array.
-  static Handle<JSArray> Collect(FunctionLiteral* node, Handle<Script> script,
-                                 Zone* zone, Isolate* isolate);
-
- protected:
-  friend AstTraversalVisitor<LiveEditFunctionTracker>;
-  void VisitFunctionLiteral(FunctionLiteral* node);
-
- private:
-  LiveEditFunctionTracker(Handle<Script> script, Zone* zone, Isolate* isolate);
-
-  void FunctionStarted(FunctionLiteral* fun);
-  void FunctionDone(Handle<SharedFunctionInfo> shared, Scope* scope);
-  Handle<Object> SerializeFunctionScope(Scope* scope);
-
-  Handle<Script> script_;
-  Zone* zone_;
-  Isolate* isolate_;
-
-  Handle<JSArray> result_;
-  int len_;
-  int current_parent_index_;
-
-  DISALLOW_COPY_AND_ASSIGN(LiveEditFunctionTracker);
+struct SourceChangeRange {
+  int start_position;
+  int end_position;
+  int new_start_position;
+  int new_end_position;
 };
 
+/**
+  Liveedit step-by-step:
+  1. calculate diff between old source and new source,
+  2. map function literals from old source to new source,
+  3. create new script for new_source,
+  4. mark literals with changed code as changed, all others as unchanged,
+  5. check that for changed literals there are no:
+    - running generators in the heap,
+    - non droppable frames (e.g. running generator) above them on stack.
+  6. mark the bottom most frame with changed function as scheduled for restart
+     if any,
+  7. for unchanged functions:
+    - deoptimize,
+    - remove from cache,
+    - update source positions,
+    - move to new script,
+    - reset feedback information and preparsed scope information if any,
+    - replace any sfi in constant pool with changed one if any.
+  8. for changed functions:
+    - deoptimize
+    - remove from cache,
+    - reset feedback information,
+    - update all links from js functions to old shared with new one.
+  9. swap scripts.
+ */
 
 class LiveEdit : AllStatic {
  public:
   static void InitializeThreadLocal(Debug* debug);
 
-  V8_WARN_UNUSED_RESULT static MaybeHandle<JSArray> GatherCompileInfo(
-      Handle<Script> script, Handle<String> source);
-
-  static void ReplaceFunctionCode(Handle<JSArray> new_compile_info_array,
-                                  Handle<JSArray> shared_info_array);
-
-  static void FixupScript(Handle<Script> script, int max_function_literal_id);
-
-  static void FunctionSourceUpdated(Handle<JSArray> shared_info_array,
-                                    int new_function_literal_id);
-
-  // Updates script field in FunctionSharedInfo.
-  static void SetFunctionScript(Handle<JSValue> function_wrapper,
-                                Handle<Object> script_handle);
-
-  static void PatchFunctionPositions(Handle<JSArray> shared_info_array,
-                                     Handle<JSArray> position_change_array);
-
-  // For a script updates its source field. If old_script_name is provided
-  // (i.e. is a String), also creates a copy of the script with its original
-  // source and sends notification to debugger.
-  static Handle<Object> ChangeScriptSource(Handle<Script> original_script,
-                                           Handle<String> new_source,
-                                           Handle<Object> old_script_name);
-
-  // In a code of a parent function replaces original function as embedded
-  // object with a substitution one.
-  static void ReplaceRefToNestedFunction(Handle<JSValue> parent_function_shared,
-                                         Handle<JSValue> orig_function_shared,
-                                         Handle<JSValue> subst_function_shared);
-
-  // Find open generator activations, and set corresponding "result" elements to
-  // FUNCTION_BLOCKED_ACTIVE_GENERATOR.
-  static bool FindActiveGenerators(Handle<FixedArray> shared_info_array,
-                                   Handle<FixedArray> result, int len);
-
-  // Checks listed functions on stack and return array with corresponding
-  // FunctionPatchabilityStatus statuses; extra array element may
-  // contain general error message. Modifies the current stack and
-  // has restart the lowest found frames and drops all other frames above
-  // if possible and if do_drop is true.
-  static Handle<JSArray> CheckAndDropActivations(
-      Handle<JSArray> old_shared_array, Handle<JSArray> new_shared_array,
-      bool do_drop);
-
   // Restarts the call frame and completely drops all frames above it.
-  // Return error message or nullptr.
-  static const char* RestartFrame(JavaScriptFrame* frame);
-
-  // A copy of this is in liveedit.js.
-  enum FunctionPatchabilityStatus {
-    FUNCTION_AVAILABLE_FOR_PATCH = 1,
-    FUNCTION_BLOCKED_ON_ACTIVE_STACK = 2,
-    FUNCTION_BLOCKED_ON_OTHER_STACK = 3,
-    FUNCTION_BLOCKED_UNDER_NATIVE_CODE = 4,
-    FUNCTION_REPLACED_ON_ACTIVE_STACK = 5,
-    FUNCTION_BLOCKED_UNDER_GENERATOR = 6,
-    FUNCTION_BLOCKED_ACTIVE_GENERATOR = 7,
-    FUNCTION_BLOCKED_NO_NEW_TARGET_ON_RESTART = 8
-  };
-
-  // Compares 2 strings line-by-line, then token-wise and returns diff in form
-  // of array of triplets (pos1, pos1_end, pos2_end) describing list
-  // of diff chunks.
-  static Handle<JSArray> CompareStrings(Handle<String> s1,
-                                        Handle<String> s2);
-
+  static bool RestartFrame(JavaScriptFrame* frame);
+
+  static void CompareStrings(Isolate* isolate, Handle<String> a,
+                             Handle<String> b,
+                             std::vector<SourceChangeRange>* diffs);
+  static int TranslatePosition(const std::vector<SourceChangeRange>& changed,
+                               int position);
+  static void PatchScript(Isolate* isolate, Handle<Script> script,
+                          Handle<String> source, bool preview,
+                          debug::LiveEditResult* result);
   // Architecture-specific constant.
   static const bool kFrameDropperSupported;
 };
-
-
-// A general-purpose comparator between 2 arrays.
-class Comparator {
- public:
-  // Holds 2 arrays of some elements allowing to compare any pair of
-  // element from the first array and element from the second array.
-  class Input {
-   public:
-    virtual int GetLength1() = 0;
-    virtual int GetLength2() = 0;
-    virtual bool Equals(int index1, int index2) = 0;
-
-   protected:
-    virtual ~Input() {}
-  };
-
-  // Receives compare result as a series of chunks.
-  class Output {
-   public:
-    // Puts another chunk in result list. Note that technically speaking
-    // only 3 arguments actually needed with 4th being derivable.
-    virtual void AddChunk(int pos1, int pos2, int len1, int len2) = 0;
-
-   protected:
-    virtual ~Output() {}
-  };
-
-  // Finds the difference between 2 arrays of elements.
-  static void CalculateDifference(Input* input,
-                                  Output* result_writer);
-};
-
-
-
-// Simple helper class that creates more or less typed structures over
-// JSArray object. This is an adhoc method of passing structures from C++
-// to JavaScript.
-template<typename S>
-class JSArrayBasedStruct {
- public:
-  static S Create(Isolate* isolate) {
-    Factory* factory = isolate->factory();
-    Handle<JSArray> array = factory->NewJSArray(S::kSize_);
-    return S(array);
-  }
-
-  static S cast(Object* object) {
-    JSArray* array = JSArray::cast(object);
-    Handle<JSArray> array_handle(array);
-    return S(array_handle);
-  }
-
-  explicit JSArrayBasedStruct(Handle<JSArray> array) : array_(array) {
-  }
-
-  Handle<JSArray> GetJSArray() {
-    return array_;
-  }
-
-  Isolate* isolate() const {
-    return array_->GetIsolate();
-  }
-
- protected:
-  void SetField(int field_position, Handle<Object> value) {
-    Object::SetElement(isolate(), array_, field_position, value,
-                       LanguageMode::kSloppy)
-        .Assert();
-  }
-
-  void SetSmiValueField(int field_position, int value) {
-    SetField(field_position, Handle<Smi>(Smi::FromInt(value), isolate()));
-  }
-
-  Handle<Object> GetField(int field_position) {
-    return JSReceiver::GetElement(isolate(), array_, field_position)
-        .ToHandleChecked();
-  }
-
-  int GetSmiValueField(int field_position) {
-    Handle<Object> res = GetField(field_position);
-    return Handle<Smi>::cast(res)->value();
-  }
-
- private:
-  Handle<JSArray> array_;
-};
-
-
-// Represents some function compilation details. This structure will be used
-// from JavaScript. It contains Code object, which is kept wrapped
-// into a BlindReference for sanitizing reasons.
-class FunctionInfoWrapper : public JSArrayBasedStruct<FunctionInfoWrapper> {
- public:
-  explicit FunctionInfoWrapper(Handle<JSArray> array)
-      : JSArrayBasedStruct<FunctionInfoWrapper>(array) {
-  }
-
-  void SetInitialProperties(Handle<String> name, int start_position,
-                            int end_position, int param_num, int parent_index,
-                            int function_literal_id);
-
-  void SetFunctionScopeInfo(Handle<Object> scope_info_array) {
-    this->SetField(kFunctionScopeInfoOffset_, scope_info_array);
-  }
-
-  void SetSharedFunctionInfo(Handle<SharedFunctionInfo> info);
-
-  Handle<SharedFunctionInfo> GetSharedFunctionInfo();
-
-  int GetParentIndex() {
-    return this->GetSmiValueField(kParentIndexOffset_);
-  }
-
-  int GetStartPosition() {
-    return this->GetSmiValueField(kStartPositionOffset_);
-  }
-
-  int GetEndPosition() { return this->GetSmiValueField(kEndPositionOffset_); }
-
- private:
-  static const int kFunctionNameOffset_ = 0;
-  static const int kStartPositionOffset_ = 1;
-  static const int kEndPositionOffset_ = 2;
-  static const int kParamNumOffset_ = 3;
-  static const int kFunctionScopeInfoOffset_ = 4;
-  static const int kParentIndexOffset_ = 5;
-  static const int kSharedFunctionInfoOffset_ = 6;
-  static const int kFunctionLiteralIdOffset_ = 7;
-  static const int kSize_ = 8;
-
-  friend class JSArrayBasedStruct<FunctionInfoWrapper>;
-};
-
-
-// Wraps SharedFunctionInfo along with some of its fields for passing it
-// back to JavaScript. SharedFunctionInfo object itself is additionally
-// wrapped into BlindReference for sanitizing reasons.
-class SharedInfoWrapper : public JSArrayBasedStruct<SharedInfoWrapper> {
- public:
-  static bool IsInstance(Handle<JSArray> array) {
-    if (array->length() != Smi::FromInt(kSize_)) return false;
-    Handle<Object> element(
-        JSReceiver::GetElement(array->GetIsolate(), array, kSharedInfoOffset_)
-            .ToHandleChecked());
-    if (!element->IsJSValue()) return false;
-    return Handle<JSValue>::cast(element)->value()->IsSharedFunctionInfo();
-  }
-
-  explicit SharedInfoWrapper(Handle<JSArray> array)
-      : JSArrayBasedStruct<SharedInfoWrapper>(array) {
-  }
-
-  void SetProperties(Handle<String> name,
-                     int start_position,
-                     int end_position,
-                     Handle<SharedFunctionInfo> info);
-
-  Handle<SharedFunctionInfo> GetInfo();
-
- private:
-  static const int kFunctionNameOffset_ = 0;
-  static const int kStartPositionOffset_ = 1;
-  static const int kEndPositionOffset_ = 2;
-  static const int kSharedInfoOffset_ = 3;
-  static const int kSize_ = 4;
-
-  friend class JSArrayBasedStruct<SharedInfoWrapper>;
-};
-
 }  // namespace internal
 }  // namespace v8
 
diff --git a/deps/v8/src/debug/liveedit.js b/deps/v8/src/debug/liveedit.js
deleted file mode 100644
index db0aaf8177402f..00000000000000
--- a/deps/v8/src/debug/liveedit.js
+++ /dev/null
@@ -1,1058 +0,0 @@
-// Copyright 2012 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-// LiveEdit feature implementation. The script should be executed after
-// debug.js.
-
-// A LiveEdit namespace. It contains functions that modifies JavaScript code
-// according to changes of script source (if possible).
-//
-// When new script source is put in, the difference is calculated textually,
-// in form of list of delete/add/change chunks. The functions that include
-// change chunk(s) get recompiled, or their enclosing functions are
-// recompiled instead.
-// If the function may not be recompiled (e.g. it was completely erased in new
-// version of the script) it remains unchanged, but the code that could
-// create a new instance of this function goes away. An old version of script
-// is created to back up this obsolete function.
-// All unchanged functions have their positions updated accordingly.
-//
-// LiveEdit namespace is declared inside a single function constructor.
-
-(function(global, utils) {
-  "use strict";
-
-  // -------------------------------------------------------------------
-  // Imports
-
-  var FindScriptSourcePosition = global.Debug.findScriptSourcePosition;
-  var GlobalArray = global.Array;
-  var MathFloor = global.Math.floor;
-  var MathMax = global.Math.max;
-  var SyntaxError = global.SyntaxError;
-
-  // -------------------------------------------------------------------
-
-  // Forward declaration for minifier.
-  var FunctionStatus;
-
-  // Applies the change to the script.
-  // The change is in form of list of chunks encoded in a single array as
-  // a series of triplets (pos1_start, pos1_end, pos2_end)
-  function ApplyPatchMultiChunk(script, diff_array, new_source, preview_only,
-      change_log) {
-
-    var old_source = script.source;
-
-    // Gather compile information about old version of script.
-    var old_compile_info = GatherCompileInfo(old_source, script);
-
-    // Build tree structures for old and new versions of the script.
-    var root_old_node = BuildCodeInfoTree(old_compile_info);
-
-    var pos_translator = new PosTranslator(diff_array);
-
-    // Analyze changes.
-    MarkChangedFunctions(root_old_node, pos_translator.GetChunks());
-
-    // Find all SharedFunctionInfo's that were compiled from this script.
-    FindLiveSharedInfos(root_old_node, script);
-
-    // Gather compile information about new version of script.
-    var new_compile_info;
-    try {
-      new_compile_info = GatherCompileInfo(new_source, script);
-    } catch (e) {
-      var failure =
-          new Failure("Failed to compile new version of script: " + e);
-      if (e instanceof SyntaxError) {
-        var details = {
-          type: "liveedit_compile_error",
-          syntaxErrorMessage: e.message
-        };
-        CopyErrorPositionToDetails(e, details);
-        failure.details = details;
-      }
-      throw failure;
-    }
-
-    var max_function_literal_id = new_compile_info.reduce(
-        (max, info) => MathMax(max, info.function_literal_id), 0);
-
-    var root_new_node = BuildCodeInfoTree(new_compile_info);
-
-    // Link recompiled script data with other data.
-    FindCorrespondingFunctions(root_old_node, root_new_node);
-
-    // Prepare to-do lists.
-    var replace_code_list = new GlobalArray();
-    var link_to_old_script_list = new GlobalArray();
-    var link_to_original_script_list = new GlobalArray();
-    var update_positions_list = new GlobalArray();
-
-    function HarvestTodo(old_node) {
-      function CollectDamaged(node) {
-        link_to_old_script_list.push(node);
-        for (var i = 0; i < node.children.length; i++) {
-          CollectDamaged(node.children[i]);
-        }
-      }
-
-      // Recursively collects all newly compiled functions that are going into
-      // business and should have link to the actual script updated.
-      function CollectNew(node_list) {
-        for (var i = 0; i < node_list.length; i++) {
-          link_to_original_script_list.push(node_list[i]);
-          CollectNew(node_list[i].children);
-        }
-      }
-
-      if (old_node.status == FunctionStatus.DAMAGED) {
-        CollectDamaged(old_node);
-        return;
-      }
-      if (old_node.status == FunctionStatus.UNCHANGED) {
-        update_positions_list.push(old_node);
-      } else if (old_node.status == FunctionStatus.SOURCE_CHANGED) {
-        update_positions_list.push(old_node);
-      } else if (old_node.status == FunctionStatus.CHANGED) {
-        replace_code_list.push(old_node);
-        CollectNew(old_node.unmatched_new_nodes);
-      }
-      for (var i = 0; i < old_node.children.length; i++) {
-        HarvestTodo(old_node.children[i]);
-      }
-    }
-
-    var preview_description = {
-        change_tree: DescribeChangeTree(root_old_node),
-        textual_diff: {
-          old_len: old_source.length,
-          new_len: new_source.length,
-          chunks: diff_array
-        },
-        updated: false
-    };
-
-    if (preview_only) {
-      return preview_description;
-    }
-
-    HarvestTodo(root_old_node);
-
-    // Collect shared infos for functions whose code need to be patched.
-    var replaced_function_old_infos = new GlobalArray();
-    var replaced_function_new_infos = new GlobalArray();
-    for (var i = 0; i < replace_code_list.length; i++) {
-      var old_infos = replace_code_list[i].live_shared_function_infos;
-      var new_info =
-          replace_code_list[i].corresponding_node.info.shared_function_info;
-
-      if (old_infos) {
-        for (var j = 0; j < old_infos.length; j++) {
-          replaced_function_old_infos.push(old_infos[j]);
-          replaced_function_new_infos.push(new_info);
-        }
-      }
-    }
-
-    // We haven't changed anything before this line yet.
-    // Committing all changes.
-
-    // Check that function being patched is not currently on stack or drop them.
-    var dropped_functions_number =
-        CheckStackActivations(replaced_function_old_infos,
-                              replaced_function_new_infos,
-                              change_log);
-
-    // Our current implementation requires client to manually issue "step in"
-    // command for correct stack state if the stack was modified.
-    preview_description.stack_modified = dropped_functions_number != 0;
-
-    var old_script;
-
-    // Create an old script only if there are function that should be linked
-    // to old version.
-    if (link_to_old_script_list.length == 0) {
-      %LiveEditReplaceScript(script, new_source, null);
-      old_script = UNDEFINED;
-    } else {
-      var old_script_name = CreateNameForOldScript(script);
-
-      // Update the script text and create a new script representing an old
-      // version of the script.
-      old_script = %LiveEditReplaceScript(script, new_source, old_script_name);
-
-      var link_to_old_script_report = new GlobalArray();
-      change_log.push( { linked_to_old_script: link_to_old_script_report } );
-
-      // We need to link to old script all former nested functions.
-      for (var i = 0; i < link_to_old_script_list.length; i++) {
-        LinkToOldScript(link_to_old_script_list[i], old_script,
-            link_to_old_script_report);
-      }
-
-      preview_description.created_script_name = old_script_name;
-    }
-
-    for (var i = 0; i < replace_code_list.length; i++) {
-      PatchFunctionCode(replace_code_list[i], change_log);
-    }
-
-    var position_patch_report = new GlobalArray();
-    change_log.push( {position_patched: position_patch_report} );
-
-    for (var i = 0; i < update_positions_list.length; i++) {
-      // TODO(LiveEdit): take into account whether it's source_changed or
-      // unchanged and whether positions changed at all.
-      PatchPositions(update_positions_list[i], diff_array,
-          position_patch_report);
-
-      if (update_positions_list[i].live_shared_function_infos) {
-        var new_function_literal_id =
-            update_positions_list[i]
-                .corresponding_node.info.function_literal_id;
-        update_positions_list[i].live_shared_function_infos.forEach(function(
-            info) {
-          %LiveEditFunctionSourceUpdated(
-              info.raw_array, new_function_literal_id);
-        });
-      }
-    }
-
-    %LiveEditFixupScript(script, max_function_literal_id);
-
-    // Link all the functions we're going to use to an actual script.
-    for (var i = 0; i < link_to_original_script_list.length; i++) {
-      %LiveEditFunctionSetScript(
-          link_to_original_script_list[i].info.shared_function_info, script);
-    }
-
-    preview_description.updated = true;
-    return preview_description;
-  }
-
-  // Fully compiles source string as a script. Returns Array of
-  // FunctionCompileInfo -- a descriptions of all functions of the script.
-  // Elements of array are ordered by start positions of functions (from top
-  // to bottom) in the source. Fields outer_index and next_sibling_index help
-  // to navigate the nesting structure of functions.
-  //
-  // All functions get compiled linked to script provided as parameter script.
-  // TODO(LiveEdit): consider not using actual scripts as script, because
-  // we have to manually erase all links right after compile.
-  function GatherCompileInfo(source, script) {
-    // Get function info, elements are partially sorted (it is a tree of
-    // nested functions serialized as parent followed by serialized children.
-    var raw_compile_info = %LiveEditGatherCompileInfo(script, source);
-
-    // Sort function infos by start position field.
-    var compile_info = new GlobalArray();
-    var old_index_map = new GlobalArray();
-    for (var i = 0; i < raw_compile_info.length; i++) {
-      var info = new FunctionCompileInfo(raw_compile_info[i]);
-      // Remove all links to the actual script. Breakpoints system and
-      // LiveEdit itself believe that any function in heap that points to a
-      // particular script is a regular function.
-      // For some functions we will restore this link later.
-      %LiveEditFunctionSetScript(info.shared_function_info, UNDEFINED);
-      compile_info.push(info);
-      old_index_map.push(i);
-    }
-
-    for (var i = 0; i < compile_info.length; i++) {
-      var k = i;
-      for (var j = i + 1; j < compile_info.length; j++) {
-        if (compile_info[k].start_position > compile_info[j].start_position) {
-          k = j;
-        }
-      }
-      if (k != i) {
-        var temp_info = compile_info[k];
-        var temp_index = old_index_map[k];
-        compile_info[k] = compile_info[i];
-        old_index_map[k] = old_index_map[i];
-        compile_info[i] = temp_info;
-        old_index_map[i] = temp_index;
-      }
-    }
-
-    // After sorting update outer_index field using old_index_map. Also
-    // set next_sibling_index field.
-    var current_index = 0;
-
-    // The recursive function, that goes over all children of a particular
-    // node (i.e. function info).
-    function ResetIndexes(new_parent_index, old_parent_index) {
-      var previous_sibling = -1;
-      while (current_index < compile_info.length &&
-          compile_info[current_index].outer_index == old_parent_index) {
-        var saved_index = current_index;
-        compile_info[saved_index].outer_index = new_parent_index;
-        if (previous_sibling != -1) {
-          compile_info[previous_sibling].next_sibling_index = saved_index;
-        }
-        previous_sibling = saved_index;
-        current_index++;
-        ResetIndexes(saved_index, old_index_map[saved_index]);
-      }
-      if (previous_sibling != -1) {
-        compile_info[previous_sibling].next_sibling_index = -1;
-      }
-    }
-
-    ResetIndexes(-1, -1);
-    Assert(current_index == compile_info.length);
-
-    return compile_info;
-  }
-
-
-  // Replaces function's Code.
-  function PatchFunctionCode(old_node, change_log) {
-    var new_info = old_node.corresponding_node.info;
-    if (old_node.live_shared_function_infos) {
-      old_node.live_shared_function_infos.forEach(function (old_info) {
-        %LiveEditReplaceFunctionCode(new_info.raw_array,
-                                     old_info.raw_array);
-
-        // The function got a new code. However, this new code brings all new
-        // instances of SharedFunctionInfo for nested functions. However,
-        // we want the original instances to be used wherever possible.
-        // (This is because old instances and new instances will be both
-        // linked to a script and breakpoints subsystem does not really
-        // expects this; neither does LiveEdit subsystem on next call).
-        for (var i = 0; i < old_node.children.length; i++) {
-          if (old_node.children[i].corresponding_node) {
-            var corresponding_child_info =
-                old_node.children[i].corresponding_node.info.
-                    shared_function_info;
-
-            if (old_node.children[i].live_shared_function_infos) {
-              old_node.children[i].live_shared_function_infos.
-                  forEach(function (old_child_info) {
-                    %LiveEditReplaceRefToNestedFunction(
-                        old_info.info,
-                        corresponding_child_info,
-                        old_child_info.info);
-                  });
-            }
-          }
-        }
-      });
-
-      change_log.push( {function_patched: new_info.function_name} );
-    } else {
-      change_log.push( {function_patched: new_info.function_name,
-          function_info_not_found: true} );
-    }
-  }
-
-
-  // Makes a function associated with another instance of a script (the
-  // one representing its old version). This way the function still
-  // may access its own text.
-  function LinkToOldScript(old_info_node, old_script, report_array) {
-    if (old_info_node.live_shared_function_infos) {
-      old_info_node.live_shared_function_infos.
-          forEach(function (info) {
-            %LiveEditFunctionSetScript(info.info, old_script);
-          });
-
-      report_array.push( { name: old_info_node.info.function_name } );
-    } else {
-      report_array.push(
-          { name: old_info_node.info.function_name, not_found: true } );
-    }
-  }
-
-  function Assert(condition, message) {
-    if (!condition) {
-      if (message) {
-        throw "Assert " + message;
-      } else {
-        throw "Assert";
-      }
-    }
-  }
-
-  function DiffChunk(pos1, pos2, len1, len2) {
-    this.pos1 = pos1;
-    this.pos2 = pos2;
-    this.len1 = len1;
-    this.len2 = len2;
-  }
-
-  function PosTranslator(diff_array) {
-    var chunks = new GlobalArray();
-    var current_diff = 0;
-    for (var i = 0; i < diff_array.length; i += 3) {
-      var pos1_begin = diff_array[i];
-      var pos2_begin = pos1_begin + current_diff;
-      var pos1_end = diff_array[i + 1];
-      var pos2_end = diff_array[i + 2];
-      chunks.push(new DiffChunk(pos1_begin, pos2_begin, pos1_end - pos1_begin,
-          pos2_end - pos2_begin));
-      current_diff = pos2_end - pos1_end;
-    }
-    this.chunks = chunks;
-  }
-  PosTranslator.prototype.GetChunks = function() {
-    return this.chunks;
-  };
-
-  PosTranslator.prototype.Translate = function(pos, inside_chunk_handler) {
-    var array = this.chunks;
-    if (array.length == 0 || pos < array[0].pos1) {
-      return pos;
-    }
-    var chunk_index1 = 0;
-    var chunk_index2 = array.length - 1;
-
-    while (chunk_index1 < chunk_index2) {
-      var middle_index = MathFloor((chunk_index1 + chunk_index2) / 2);
-      if (pos < array[middle_index + 1].pos1) {
-        chunk_index2 = middle_index;
-      } else {
-        chunk_index1 = middle_index + 1;
-      }
-    }
-    var chunk = array[chunk_index1];
-    if (pos >= chunk.pos1 + chunk.len1) {
-      return pos + chunk.pos2 + chunk.len2 - chunk.pos1 - chunk.len1;
-    }
-
-    if (!inside_chunk_handler) {
-      inside_chunk_handler = PosTranslator.DefaultInsideChunkHandler;
-    }
-    return inside_chunk_handler(pos, chunk);
-  };
-
-  PosTranslator.DefaultInsideChunkHandler = function(pos, diff_chunk) {
-    Assert(false, "Cannot translate position in changed area");
-  };
-
-  PosTranslator.ShiftWithTopInsideChunkHandler =
-      function(pos, diff_chunk) {
-    // We carelessly do not check whether we stay inside the chunk after
-    // translation.
-    return pos - diff_chunk.pos1 + diff_chunk.pos2;
-  };
-
-  var FunctionStatus = {
-      // No change to function or its inner functions; however its positions
-      // in script may have been shifted.
-      UNCHANGED: "unchanged",
-      // The code of a function remains unchanged, but something happened inside
-      // some inner functions.
-      SOURCE_CHANGED: "source changed",
-      // The code of a function is changed or some nested function cannot be
-      // properly patched so this function must be recompiled.
-      CHANGED: "changed",
-      // Function is changed but cannot be patched.
-      DAMAGED: "damaged"
-  };
-
-  function CodeInfoTreeNode(code_info, children, array_index) {
-    this.info = code_info;
-    this.children = children;
-    // an index in array of compile_info
-    this.array_index = array_index;
-    this.parent = UNDEFINED;
-
-    this.status = FunctionStatus.UNCHANGED;
-    // Status explanation is used for debugging purposes and will be shown
-    // in user UI if some explanations are needed.
-    this.status_explanation = UNDEFINED;
-    this.new_start_pos = UNDEFINED;
-    this.new_end_pos = UNDEFINED;
-    this.corresponding_node = UNDEFINED;
-    this.unmatched_new_nodes = UNDEFINED;
-
-    // 'Textual' correspondence/matching is weaker than 'pure'
-    // correspondence/matching. We need 'textual' level for visual presentation
-    // in UI, we use 'pure' level for actual code manipulation.
-    // Sometimes only function body is changed (functions in old and new script
-    // textually correspond), but we cannot patch the code, so we see them
-    // as an old function deleted and new function created.
-    this.textual_corresponding_node = UNDEFINED;
-    this.textually_unmatched_new_nodes = UNDEFINED;
-
-    this.live_shared_function_infos = UNDEFINED;
-  }
-
-  // From array of function infos that is implicitly a tree creates
-  // an actual tree of functions in script.
-  function BuildCodeInfoTree(code_info_array) {
-    // Throughtout all function we iterate over input array.
-    var index = 0;
-
-    // Recursive function that builds a branch of tree.
-    function BuildNode() {
-      var my_index = index;
-      index++;
-      var child_array = new GlobalArray();
-      while (index < code_info_array.length &&
-          code_info_array[index].outer_index == my_index) {
-        child_array.push(BuildNode());
-      }
-      var node = new CodeInfoTreeNode(code_info_array[my_index], child_array,
-          my_index);
-      for (var i = 0; i < child_array.length; i++) {
-        child_array[i].parent = node;
-      }
-      return node;
-    }
-
-    var root = BuildNode();
-    Assert(index == code_info_array.length);
-    return root;
-  }
-
-  // Applies a list of the textual diff chunks onto the tree of functions.
-  // Determines status of each function (from unchanged to damaged). However
-  // children of unchanged functions are ignored.
-  function MarkChangedFunctions(code_info_tree, chunks) {
-
-    // A convenient iterator over diff chunks that also translates
-    // positions from old to new in a current non-changed part of script.
-    var chunk_it = new function() {
-      var chunk_index = 0;
-      var pos_diff = 0;
-      this.current = function() { return chunks[chunk_index]; };
-      this.next = function() {
-        var chunk = chunks[chunk_index];
-        pos_diff = chunk.pos2 + chunk.len2 - (chunk.pos1 + chunk.len1);
-        chunk_index++;
-      };
-      this.done = function() { return chunk_index >= chunks.length; };
-      this.TranslatePos = function(pos) { return pos + pos_diff; };
-    };
-
-    // A recursive function that processes internals of a function and all its
-    // inner functions. Iterator chunk_it initially points to a chunk that is
-    // below function start.
-    function ProcessInternals(info_node) {
-      info_node.new_start_pos = chunk_it.TranslatePos(
-          info_node.info.start_position);
-      var child_index = 0;
-      var code_changed = false;
-      var source_changed = false;
-      // Simultaneously iterates over child functions and over chunks.
-      while (!chunk_it.done() &&
-          chunk_it.current().pos1 < info_node.info.end_position) {
-        if (child_index < info_node.children.length) {
-          var child = info_node.children[child_index];
-
-          if (child.info.end_position <= chunk_it.current().pos1) {
-            ProcessUnchangedChild(child);
-            child_index++;
-            continue;
-          } else if (child.info.start_position >=
-              chunk_it.current().pos1 + chunk_it.current().len1) {
-            code_changed = true;
-            chunk_it.next();
-            continue;
-          } else if (child.info.start_position <= chunk_it.current().pos1 &&
-              child.info.end_position >= chunk_it.current().pos1 +
-              chunk_it.current().len1) {
-            ProcessInternals(child);
-            source_changed = source_changed ||
-                ( child.status != FunctionStatus.UNCHANGED );
-            code_changed = code_changed ||
-                ( child.status == FunctionStatus.DAMAGED );
-            child_index++;
-            continue;
-          } else {
-            code_changed = true;
-            child.status = FunctionStatus.DAMAGED;
-            child.status_explanation =
-                "Text diff overlaps with function boundary";
-            child_index++;
-            continue;
-          }
-        } else {
-          if (chunk_it.current().pos1 + chunk_it.current().len1 <=
-              info_node.info.end_position) {
-            info_node.status = FunctionStatus.CHANGED;
-            chunk_it.next();
-            continue;
-          } else {
-            info_node.status = FunctionStatus.DAMAGED;
-            info_node.status_explanation =
-                "Text diff overlaps with function boundary";
-            return;
-          }
-        }
-        Assert("Unreachable", false);
-      }
-      while (child_index < info_node.children.length) {
-        var child = info_node.children[child_index];
-        ProcessUnchangedChild(child);
-        child_index++;
-      }
-      if (code_changed) {
-        info_node.status = FunctionStatus.CHANGED;
-      } else if (source_changed) {
-        info_node.status = FunctionStatus.SOURCE_CHANGED;
-      }
-      info_node.new_end_pos =
-          chunk_it.TranslatePos(info_node.info.end_position);
-    }
-
-    function ProcessUnchangedChild(node) {
-      node.new_start_pos = chunk_it.TranslatePos(node.info.start_position);
-      node.new_end_pos = chunk_it.TranslatePos(node.info.end_position);
-    }
-
-    ProcessInternals(code_info_tree);
-  }
-
-  // For each old function (if it is not damaged) tries to find a corresponding
-  // function in new script. Typically it should succeed (non-damaged functions
-  // by definition may only have changes inside their bodies). However there are
-  // reasons for correspondence not to be found; function with unmodified text
-  // in new script may become enclosed into other function; the innocent change
-  // inside function body may in fact be something like "} function B() {" that
-  // splits a function into 2 functions.
-  function FindCorrespondingFunctions(old_code_tree, new_code_tree) {
-
-    // A recursive function that tries to find a correspondence for all
-    // child functions and for their inner functions.
-    function ProcessNode(old_node, new_node) {
-      var scope_change_description =
-          IsFunctionContextLocalsChanged(old_node.info, new_node.info);
-      if (scope_change_description) {
-        old_node.status = FunctionStatus.CHANGED;
-      }
-
-      var old_children = old_node.children;
-      var new_children = new_node.children;
-
-      var unmatched_new_nodes_list = [];
-      var textually_unmatched_new_nodes_list = [];
-
-      var old_index = 0;
-      var new_index = 0;
-      while (old_index < old_children.length) {
-        if (old_children[old_index].status == FunctionStatus.DAMAGED) {
-          old_index++;
-        } else if (new_index < new_children.length) {
-          if (new_children[new_index].info.start_position <
-              old_children[old_index].new_start_pos) {
-            unmatched_new_nodes_list.push(new_children[new_index]);
-            textually_unmatched_new_nodes_list.push(new_children[new_index]);
-            new_index++;
-          } else if (new_children[new_index].info.start_position ==
-              old_children[old_index].new_start_pos) {
-            if (new_children[new_index].info.end_position ==
-                old_children[old_index].new_end_pos) {
-              old_children[old_index].corresponding_node =
-                  new_children[new_index];
-              old_children[old_index].textual_corresponding_node =
-                  new_children[new_index];
-              if (scope_change_description) {
-                old_children[old_index].status = FunctionStatus.DAMAGED;
-                old_children[old_index].status_explanation =
-                    "Enclosing function is now incompatible. " +
-                    scope_change_description;
-                old_children[old_index].corresponding_node = UNDEFINED;
-              } else if (old_children[old_index].status !=
-                  FunctionStatus.UNCHANGED) {
-                ProcessNode(old_children[old_index],
-                    new_children[new_index]);
-                if (old_children[old_index].status == FunctionStatus.DAMAGED) {
-                  unmatched_new_nodes_list.push(
-                      old_children[old_index].corresponding_node);
-                  old_children[old_index].corresponding_node = UNDEFINED;
-                  old_node.status = FunctionStatus.CHANGED;
-                }
-              } else {
-                ProcessNode(old_children[old_index], new_children[new_index]);
-              }
-            } else {
-              old_children[old_index].status = FunctionStatus.DAMAGED;
-              old_children[old_index].status_explanation =
-                  "No corresponding function in new script found";
-              old_node.status = FunctionStatus.CHANGED;
-              unmatched_new_nodes_list.push(new_children[new_index]);
-              textually_unmatched_new_nodes_list.push(new_children[new_index]);
-            }
-            new_index++;
-            old_index++;
-          } else {
-            old_children[old_index].status = FunctionStatus.DAMAGED;
-            old_children[old_index].status_explanation =
-                "No corresponding function in new script found";
-            old_node.status = FunctionStatus.CHANGED;
-            old_index++;
-          }
-        } else {
-          old_children[old_index].status = FunctionStatus.DAMAGED;
-          old_children[old_index].status_explanation =
-              "No corresponding function in new script found";
-          old_node.status = FunctionStatus.CHANGED;
-          old_index++;
-        }
-      }
-
-      while (new_index < new_children.length) {
-        unmatched_new_nodes_list.push(new_children[new_index]);
-        textually_unmatched_new_nodes_list.push(new_children[new_index]);
-        new_index++;
-      }
-
-      if (old_node.status == FunctionStatus.CHANGED) {
-        if (old_node.info.param_num != new_node.info.param_num) {
-          old_node.status = FunctionStatus.DAMAGED;
-          old_node.status_explanation = "Changed parameter number: " +
-              old_node.info.param_num + " and " + new_node.info.param_num;
-        }
-      }
-      old_node.unmatched_new_nodes = unmatched_new_nodes_list;
-      old_node.textually_unmatched_new_nodes =
-          textually_unmatched_new_nodes_list;
-    }
-
-    ProcessNode(old_code_tree, new_code_tree);
-
-    old_code_tree.corresponding_node = new_code_tree;
-    old_code_tree.textual_corresponding_node = new_code_tree;
-
-    Assert(old_code_tree.status != FunctionStatus.DAMAGED,
-        "Script became damaged");
-  }
-
-  function FindLiveSharedInfos(old_code_tree, script) {
-    var shared_raw_list = %LiveEditFindSharedFunctionInfosForScript(script);
-
-    var shared_infos = new GlobalArray();
-
-    for (var i = 0; i < shared_raw_list.length; i++) {
-      shared_infos.push(new SharedInfoWrapper(shared_raw_list[i]));
-    }
-
-    // Finds all SharedFunctionInfos that corresponds to compile info
-    // in old version of the script.
-    function FindFunctionInfos(compile_info) {
-      var wrappers = [];
-
-      for (var i = 0; i < shared_infos.length; i++) {
-        var wrapper = shared_infos[i];
-        if (wrapper.start_position == compile_info.start_position &&
-            wrapper.end_position == compile_info.end_position) {
-          wrappers.push(wrapper);
-        }
-      }
-
-      if (wrappers.length > 0) {
-        return wrappers;
-      }
-    }
-
-    function TraverseTree(node) {
-      node.live_shared_function_infos = FindFunctionInfos(node.info);
-
-      for (var i = 0; i < node.children.length; i++) {
-        TraverseTree(node.children[i]);
-      }
-    }
-
-    TraverseTree(old_code_tree);
-  }
-
-
-  // An object describing function compilation details. Its index fields
-  // apply to indexes inside array that stores these objects.
-  function FunctionCompileInfo(raw_array) {
-    this.function_name = raw_array[0];
-    this.start_position = raw_array[1];
-    this.end_position = raw_array[2];
-    this.param_num = raw_array[3];
-    this.scope_info = raw_array[4];
-    this.outer_index = raw_array[5];
-    this.shared_function_info = raw_array[6];
-    this.function_literal_id = raw_array[7];
-    this.next_sibling_index = null;
-    this.raw_array = raw_array;
-  }
-
-  function SharedInfoWrapper(raw_array) {
-    this.function_name = raw_array[0];
-    this.start_position = raw_array[1];
-    this.end_position = raw_array[2];
-    this.info = raw_array[3];
-    this.raw_array = raw_array;
-  }
-
-  // Changes positions (including all statements) in function.
-  function PatchPositions(old_info_node, diff_array, report_array) {
-    if (old_info_node.live_shared_function_infos) {
-      old_info_node.live_shared_function_infos.forEach(function (info) {
-          %LiveEditPatchFunctionPositions(info.raw_array,
-                                          diff_array);
-      });
-
-      report_array.push( { name: old_info_node.info.function_name } );
-    } else {
-      // TODO(LiveEdit): function is not compiled yet or is already collected.
-      report_array.push(
-          { name: old_info_node.info.function_name, info_not_found: true } );
-    }
-  }
-
-  // Adds a suffix to script name to mark that it is old version.
-  function CreateNameForOldScript(script) {
-    // TODO(635): try better than this; support several changes.
-    return script.name + " (old)";
-  }
-
-  // Compares a function scope heap structure, old and new version, whether it
-  // changed or not. Returns explanation if they differ.
-  function IsFunctionContextLocalsChanged(function_info1, function_info2) {
-    var scope_info1 = function_info1.scope_info;
-    var scope_info2 = function_info2.scope_info;
-
-    var scope_info1_text;
-    var scope_info2_text;
-
-    if (scope_info1) {
-      scope_info1_text = scope_info1.toString();
-    } else {
-      scope_info1_text = "";
-    }
-    if (scope_info2) {
-      scope_info2_text = scope_info2.toString();
-    } else {
-      scope_info2_text = "";
-    }
-
-    if (scope_info1_text != scope_info2_text) {
-      return "Variable map changed: [" + scope_info1_text +
-          "] => [" + scope_info2_text + "]";
-    }
-    // No differences. Return undefined.
-    return;
-  }
-
-  // Minifier forward declaration.
-  var FunctionPatchabilityStatus;
-
-  // For array of wrapped shared function infos checks that none of them
-  // have activations on stack (of any thread). Throws a Failure exception
-  // if this proves to be false.
-  function CheckStackActivations(old_shared_wrapper_list,
-                                 new_shared_list,
-                                 change_log) {
-    var old_shared_list = new GlobalArray();
-    for (var i = 0; i < old_shared_wrapper_list.length; i++) {
-      old_shared_list[i] = old_shared_wrapper_list[i].info;
-    }
-    var result = %LiveEditCheckAndDropActivations(
-                     old_shared_list, new_shared_list, true);
-    if (result[old_shared_wrapper_list.length]) {
-      // Extra array element may contain error message.
-      throw new Failure(result[old_shared_wrapper_list.length]);
-    }
-
-    var problems = new GlobalArray();
-    var dropped = new GlobalArray();
-    for (var i = 0; i < old_shared_list.length; i++) {
-      var shared = old_shared_wrapper_list[i];
-      if (result[i] == FunctionPatchabilityStatus.REPLACED_ON_ACTIVE_STACK) {
-        dropped.push({ name: shared.function_name } );
-      } else if (result[i] != FunctionPatchabilityStatus.AVAILABLE_FOR_PATCH) {
-        var description = {
-            name: shared.function_name,
-            start_pos: shared.start_position,
-            end_pos: shared.end_position,
-            replace_problem:
-                FunctionPatchabilityStatus.SymbolName(result[i])
-        };
-        problems.push(description);
-      }
-    }
-    if (dropped.length > 0) {
-      change_log.push({ dropped_from_stack: dropped });
-    }
-    if (problems.length > 0) {
-      change_log.push( { functions_on_stack: problems } );
-      throw new Failure("Blocked by functions on stack");
-    }
-
-    return dropped.length;
-  }
-
-  // A copy of the FunctionPatchabilityStatus enum from liveedit.h
-  var FunctionPatchabilityStatus = {
-      AVAILABLE_FOR_PATCH: 1,
-      BLOCKED_ON_ACTIVE_STACK: 2,
-      BLOCKED_ON_OTHER_STACK: 3,
-      BLOCKED_UNDER_NATIVE_CODE: 4,
-      REPLACED_ON_ACTIVE_STACK: 5,
-      BLOCKED_UNDER_GENERATOR: 6,
-      BLOCKED_ACTIVE_GENERATOR: 7,
-      BLOCKED_NO_NEW_TARGET_ON_RESTART: 8
-  };
-
-  FunctionPatchabilityStatus.SymbolName = function(code) {
-    var enumeration = FunctionPatchabilityStatus;
-    for (var name in enumeration) {
-      if (enumeration[name] == code) {
-        return name;
-      }
-    }
-  };
-
-
-  // A logical failure in liveedit process. This means that change_log
-  // is valid and consistent description of what happened.
-  function Failure(message) {
-    this.message = message;
-  }
-
-  Failure.prototype.toString = function() {
-    return "LiveEdit Failure: " + this.message;
-  };
-
-  function CopyErrorPositionToDetails(e, details) {
-    function createPositionStruct(script, position) {
-      if (position == -1) return;
-      var location = %ScriptPositionInfo(script, position, true);
-      if (location == null) return;
-      return {
-        line: location.line + 1,
-        column: location.column + 1,
-        position: position
-      };
-    }
-
-    if (!("scriptObject" in e) || !("startPosition" in e)) {
-      return;
-    }
-
-    var script = e.scriptObject;
-
-    var position_struct = {
-      start: createPositionStruct(script, e.startPosition),
-      end: createPositionStruct(script, e.endPosition)
-    };
-    details.position = position_struct;
-  }
-
-  // LiveEdit main entry point: changes a script text to a new string.
-  function SetScriptSource(script, new_source, preview_only, change_log) {
-    var old_source = script.source;
-    var diff = CompareStrings(old_source, new_source);
-    return ApplyPatchMultiChunk(script, diff, new_source, preview_only,
-        change_log);
-  }
-
-  function CompareStrings(s1, s2) {
-    return %LiveEditCompareStrings(s1, s2);
-  }
-
-  // Applies the change to the script.
-  // The change is always a substring (change_pos, change_pos + change_len)
-  // being replaced with a completely different string new_str.
-  // This API is a legacy and is obsolete.
-  //
-  // @param {Script} script that is being changed
-  // @param {Array} change_log a list that collects engineer-readable
-  //     description of what happened.
-  function ApplySingleChunkPatch(script, change_pos, change_len, new_str,
-      change_log) {
-    var old_source = script.source;
-
-    // Prepare new source string.
-    var new_source = old_source.substring(0, change_pos) +
-        new_str + old_source.substring(change_pos + change_len);
-
-    return ApplyPatchMultiChunk(script,
-        [ change_pos, change_pos + change_len, change_pos + new_str.length],
-        new_source, false, change_log);
-  }
-
-  // Creates JSON description for a change tree.
-  function DescribeChangeTree(old_code_tree) {
-
-    function ProcessOldNode(node) {
-      var child_infos = [];
-      for (var i = 0; i < node.children.length; i++) {
-        var child = node.children[i];
-        if (child.status != FunctionStatus.UNCHANGED) {
-          child_infos.push(ProcessOldNode(child));
-        }
-      }
-      var new_child_infos = [];
-      if (node.textually_unmatched_new_nodes) {
-        for (var i = 0; i < node.textually_unmatched_new_nodes.length; i++) {
-          var child = node.textually_unmatched_new_nodes[i];
-          new_child_infos.push(ProcessNewNode(child));
-        }
-      }
-      var res = {
-        name: node.info.function_name,
-        positions: DescribePositions(node),
-        status: node.status,
-        children: child_infos,
-        new_children: new_child_infos
-      };
-      if (node.status_explanation) {
-        res.status_explanation = node.status_explanation;
-      }
-      if (node.textual_corresponding_node) {
-        res.new_positions = DescribePositions(node.textual_corresponding_node);
-      }
-      return res;
-    }
-
-    function ProcessNewNode(node) {
-      var child_infos = [];
-      // Do not list ancestors.
-      if (false) {
-        for (var i = 0; i < node.children.length; i++) {
-          child_infos.push(ProcessNewNode(node.children[i]));
-        }
-      }
-      var res = {
-        name: node.info.function_name,
-        positions: DescribePositions(node),
-        children: child_infos,
-      };
-      return res;
-    }
-
-    function DescribePositions(node) {
-      return {
-        start_position: node.info.start_position,
-        end_position: node.info.end_position
-      };
-    }
-
-    return ProcessOldNode(old_code_tree);
-  }
-
-  // -------------------------------------------------------------------
-  // Exports
-
-  var LiveEdit = {};
-  LiveEdit.SetScriptSource = SetScriptSource;
-  LiveEdit.ApplyPatchMultiChunk = ApplyPatchMultiChunk;
-  LiveEdit.Failure = Failure;
-
-  LiveEdit.TestApi = {
-    PosTranslator: PosTranslator,
-    CompareStrings: CompareStrings,
-    ApplySingleChunkPatch: ApplySingleChunkPatch
-  };
-
-  // Functions needed by the debugger runtime.
-  utils.InstallConstants(utils, [
-    "SetScriptSource", LiveEdit.SetScriptSource,
-  ]);
-
-  global.Debug.LiveEdit = LiveEdit;
-
-})
diff --git a/deps/v8/src/debug/mips/debug-mips.cc b/deps/v8/src/debug/mips/debug-mips.cc
index 9767ab0fd840a6..b84779a4fb2e0f 100644
--- a/deps/v8/src/debug/mips/debug-mips.cc
+++ b/deps/v8/src/debug/mips/debug-mips.cc
@@ -39,8 +39,8 @@ void DebugCodegen::GenerateFrameDropperTrampoline(MacroAssembler* masm) {
   __ LeaveFrame(StackFrame::INTERNAL);
 
   __ lw(a0, FieldMemOperand(a1, JSFunction::kSharedFunctionInfoOffset));
-  __ lw(a0,
-        FieldMemOperand(a0, SharedFunctionInfo::kFormalParameterCountOffset));
+  __ lhu(a0,
+         FieldMemOperand(a0, SharedFunctionInfo::kFormalParameterCountOffset));
   __ mov(a2, a0);
 
   ParameterCount dummy1(a2);
diff --git a/deps/v8/src/debug/mips64/debug-mips64.cc b/deps/v8/src/debug/mips64/debug-mips64.cc
index 8bfb31e3a2eb7c..ebd8db26d7d389 100644
--- a/deps/v8/src/debug/mips64/debug-mips64.cc
+++ b/deps/v8/src/debug/mips64/debug-mips64.cc
@@ -39,8 +39,8 @@ void DebugCodegen::GenerateFrameDropperTrampoline(MacroAssembler* masm) {
   __ LeaveFrame(StackFrame::INTERNAL);
 
   __ Ld(a0, FieldMemOperand(a1, JSFunction::kSharedFunctionInfoOffset));
-  __ Lw(a0,
-        FieldMemOperand(a0, SharedFunctionInfo::kFormalParameterCountOffset));
+  __ Lhu(a0,
+         FieldMemOperand(a0, SharedFunctionInfo::kFormalParameterCountOffset));
   __ mov(a2, a0);
 
   ParameterCount dummy1(a2);
diff --git a/deps/v8/src/debug/mirrors.js b/deps/v8/src/debug/mirrors.js
deleted file mode 100644
index 99b6414f3a42a0..00000000000000
--- a/deps/v8/src/debug/mirrors.js
+++ /dev/null
@@ -1,2439 +0,0 @@
-// Copyright 2006-2012 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-(function(global, utils) {
-"use strict";
-
-// ----------------------------------------------------------------------------
-// Imports
-
-var GlobalArray = global.Array;
-var IsNaN = global.isNaN;
-var JSONStringify = global.JSON.stringify;
-var MapEntries = global.Map.prototype.entries;
-var MapIteratorNext = (new global.Map).entries().next;
-var SetIteratorNext = (new global.Set).values().next;
-var SetValues = global.Set.prototype.values;
-
-// ----------------------------------------------------------------------------
-
-// Mirror hierarchy:
-// - Mirror
-//   - ValueMirror
-//     - UndefinedMirror
-//     - NullMirror
-//     - BooleanMirror
-//     - NumberMirror
-//     - StringMirror
-//     - SymbolMirror
-//     - ObjectMirror
-//       - FunctionMirror
-//         - UnresolvedFunctionMirror
-//       - ArrayMirror
-//       - DateMirror
-//       - RegExpMirror
-//       - ErrorMirror
-//       - PromiseMirror
-//       - MapMirror
-//       - SetMirror
-//       - IteratorMirror
-//       - GeneratorMirror
-//   - PropertyMirror
-//   - InternalPropertyMirror
-//   - FrameMirror
-//   - ScriptMirror
-//   - ScopeMirror
-
-macro IS_BOOLEAN(arg)
-(typeof(arg) === 'boolean')
-endmacro
-
-macro IS_DATE(arg)
-(%IsDate(arg))
-endmacro
-
-macro IS_ERROR(arg)
-(%IsJSError(arg))
-endmacro
-
-macro IS_GENERATOR(arg)
-(%IsJSGeneratorObject(arg))
-endmacro
-
-macro IS_MAP(arg)
-(%_IsJSMap(arg))
-endmacro
-
-macro IS_MAP_ITERATOR(arg)
-(%IsJSMapIterator(arg))
-endmacro
-
-macro IS_SCRIPT(arg)
-(%IsScriptWrapper(arg))
-endmacro
-
-macro IS_SET(arg)
-(%_IsJSSet(arg))
-endmacro
-
-macro IS_SET_ITERATOR(arg)
-(%IsJSSetIterator(arg))
-endmacro
-
-// Must match PropertyFilter in property-details.h
-define PROPERTY_FILTER_NONE = 0;
-
-// Type names of the different mirrors.
-var MirrorType = {
-  UNDEFINED_TYPE : 'undefined',
-  NULL_TYPE : 'null',
-  BOOLEAN_TYPE : 'boolean',
-  NUMBER_TYPE : 'number',
-  STRING_TYPE : 'string',
-  SYMBOL_TYPE : 'symbol',
-  OBJECT_TYPE : 'object',
-  FUNCTION_TYPE : 'function',
-  REGEXP_TYPE : 'regexp',
-  ERROR_TYPE : 'error',
-  PROPERTY_TYPE : 'property',
-  INTERNAL_PROPERTY_TYPE : 'internalProperty',
-  FRAME_TYPE : 'frame',
-  SCRIPT_TYPE : 'script',
-  CONTEXT_TYPE : 'context',
-  SCOPE_TYPE : 'scope',
-  PROMISE_TYPE : 'promise',
-  MAP_TYPE : 'map',
-  SET_TYPE : 'set',
-  ITERATOR_TYPE : 'iterator',
-  GENERATOR_TYPE : 'generator',
-}
-
-/**
- * Returns the mirror for a specified value or object.
- *
- * @param {value or Object} value the value or object to retrieve the mirror for
- * @returns {Mirror} the mirror reflects the passed value or object
- */
-function MakeMirror(value) {
-  var mirror;
-
-  if (IS_UNDEFINED(value)) {
-    mirror = new UndefinedMirror();
-  } else if (IS_NULL(value)) {
-    mirror = new NullMirror();
-  } else if (IS_BOOLEAN(value)) {
-    mirror = new BooleanMirror(value);
-  } else if (IS_NUMBER(value)) {
-    mirror = new NumberMirror(value);
-  } else if (IS_STRING(value)) {
-    mirror = new StringMirror(value);
-  } else if (IS_SYMBOL(value)) {
-    mirror = new SymbolMirror(value);
-  } else if (IS_ARRAY(value)) {
-    mirror = new ArrayMirror(value);
-  } else if (IS_DATE(value)) {
-    mirror = new DateMirror(value);
-  } else if (IS_FUNCTION(value)) {
-    mirror = new FunctionMirror(value);
-  } else if (%IsRegExp(value)) {
-    mirror = new RegExpMirror(value);
-  } else if (IS_ERROR(value)) {
-    mirror = new ErrorMirror(value);
-  } else if (IS_SCRIPT(value)) {
-    mirror = new ScriptMirror(value);
-  } else if (IS_MAP(value) || IS_WEAKMAP(value)) {
-    mirror = new MapMirror(value);
-  } else if (IS_SET(value) || IS_WEAKSET(value)) {
-    mirror = new SetMirror(value);
-  } else if (IS_MAP_ITERATOR(value) || IS_SET_ITERATOR(value)) {
-    mirror = new IteratorMirror(value);
-  } else if (%is_promise(value)) {
-    mirror = new PromiseMirror(value);
-  } else if (IS_GENERATOR(value)) {
-    mirror = new GeneratorMirror(value);
-  } else {
-    mirror = new ObjectMirror(value, MirrorType.OBJECT_TYPE);
-  }
-
-  return mirror;
-}
-
-
-/**
- * Returns the mirror for the undefined value.
- *
- * @returns {Mirror} the mirror reflects the undefined value
- */
-function GetUndefinedMirror() {
-  return MakeMirror(UNDEFINED);
-}
-
-
-/**
- * Inherit the prototype methods from one constructor into another.
- *
- * The Function.prototype.inherits from lang.js rewritten as a standalone
- * function (not on Function.prototype). NOTE: If this file is to be loaded
- * during bootstrapping this function needs to be revritten using some native
- * functions as prototype setup using normal JavaScript does not work as
- * expected during bootstrapping (see mirror.js in r114903).
- *
- * @param {function} ctor Constructor function which needs to inherit the
- *     prototype
- * @param {function} superCtor Constructor function to inherit prototype from
- */
-function inherits(ctor, superCtor) {
-  var tempCtor = function(){};
-  tempCtor.prototype = superCtor.prototype;
-  ctor.super_ = superCtor.prototype;
-  ctor.prototype = new tempCtor();
-  ctor.prototype.constructor = ctor;
-}
-
-// Maximum length when sending strings through the JSON protocol.
-var kMaxProtocolStringLength = 80;
-
-
-// A copy of the PropertyKind enum from property-details.h
-var PropertyType = {};
-PropertyType.Data     = 0;
-PropertyType.Accessor = 1;
-
-
-// Different attributes for a property.
-var PropertyAttribute = {};
-PropertyAttribute.None       = NONE;
-PropertyAttribute.ReadOnly   = READ_ONLY;
-PropertyAttribute.DontEnum   = DONT_ENUM;
-PropertyAttribute.DontDelete = DONT_DELETE;
-
-
-// A copy of the scope types from runtime-debug.cc.
-// NOTE: these constants should be backward-compatible, so
-// add new ones to the end of this list.
-var ScopeType = { Global:  0,
-                  Local:   1,
-                  With:    2,
-                  Closure: 3,
-                  Catch:   4,
-                  Block:   5,
-                  Script:  6,
-                  Eval:    7,
-                  Module:  8,
-                };
-
-/**
- * Base class for all mirror objects.
- * @param {string} type The type of the mirror
- * @constructor
- */
-function Mirror(type) {
-  this.type_ = type;
-}
-
-
-Mirror.prototype.type = function() {
-  return this.type_;
-};
-
-
-/**
- * Check whether the mirror reflects a value.
- * @returns {boolean} True if the mirror reflects a value.
- */
-Mirror.prototype.isValue = function() {
-  return this instanceof ValueMirror;
-};
-
-
-/**
- * Check whether the mirror reflects the undefined value.
- * @returns {boolean} True if the mirror reflects the undefined value.
- */
-Mirror.prototype.isUndefined = function() {
-  return this instanceof UndefinedMirror;
-};
-
-
-/**
- * Check whether the mirror reflects the null value.
- * @returns {boolean} True if the mirror reflects the null value
- */
-Mirror.prototype.isNull = function() {
-  return this instanceof NullMirror;
-};
-
-
-/**
- * Check whether the mirror reflects a boolean value.
- * @returns {boolean} True if the mirror reflects a boolean value
- */
-Mirror.prototype.isBoolean = function() {
-  return this instanceof BooleanMirror;
-};
-
-
-/**
- * Check whether the mirror reflects a number value.
- * @returns {boolean} True if the mirror reflects a number value
- */
-Mirror.prototype.isNumber = function() {
-  return this instanceof NumberMirror;
-};
-
-
-/**
- * Check whether the mirror reflects a string value.
- * @returns {boolean} True if the mirror reflects a string value
- */
-Mirror.prototype.isString = function() {
-  return this instanceof StringMirror;
-};
-
-
-/**
- * Check whether the mirror reflects a symbol.
- * @returns {boolean} True if the mirror reflects a symbol
- */
-Mirror.prototype.isSymbol = function() {
-  return this instanceof SymbolMirror;
-};
-
-
-/**
- * Check whether the mirror reflects an object.
- * @returns {boolean} True if the mirror reflects an object
- */
-Mirror.prototype.isObject = function() {
-  return this instanceof ObjectMirror;
-};
-
-
-/**
- * Check whether the mirror reflects a function.
- * @returns {boolean} True if the mirror reflects a function
- */
-Mirror.prototype.isFunction = function() {
-  return this instanceof FunctionMirror;
-};
-
-
-/**
- * Check whether the mirror reflects an unresolved function.
- * @returns {boolean} True if the mirror reflects an unresolved function
- */
-Mirror.prototype.isUnresolvedFunction = function() {
-  return this instanceof UnresolvedFunctionMirror;
-};
-
-
-/**
- * Check whether the mirror reflects an array.
- * @returns {boolean} True if the mirror reflects an array
- */
-Mirror.prototype.isArray = function() {
-  return this instanceof ArrayMirror;
-};
-
-
-/**
- * Check whether the mirror reflects a date.
- * @returns {boolean} True if the mirror reflects a date
- */
-Mirror.prototype.isDate = function() {
-  return this instanceof DateMirror;
-};
-
-
-/**
- * Check whether the mirror reflects a regular expression.
- * @returns {boolean} True if the mirror reflects a regular expression
- */
-Mirror.prototype.isRegExp = function() {
-  return this instanceof RegExpMirror;
-};
-
-
-/**
- * Check whether the mirror reflects an error.
- * @returns {boolean} True if the mirror reflects an error
- */
-Mirror.prototype.isError = function() {
-  return this instanceof ErrorMirror;
-};
-
-
-/**
- * Check whether the mirror reflects a promise.
- * @returns {boolean} True if the mirror reflects a promise
- */
-Mirror.prototype.isPromise = function() {
-  return this instanceof PromiseMirror;
-};
-
-
-/**
- * Check whether the mirror reflects a generator object.
- * @returns {boolean} True if the mirror reflects a generator object
- */
-Mirror.prototype.isGenerator = function() {
-  return this instanceof GeneratorMirror;
-};
-
-
-/**
- * Check whether the mirror reflects a property.
- * @returns {boolean} True if the mirror reflects a property
- */
-Mirror.prototype.isProperty = function() {
-  return this instanceof PropertyMirror;
-};
-
-
-/**
- * Check whether the mirror reflects an internal property.
- * @returns {boolean} True if the mirror reflects an internal property
- */
-Mirror.prototype.isInternalProperty = function() {
-  return this instanceof InternalPropertyMirror;
-};
-
-
-/**
- * Check whether the mirror reflects a stack frame.
- * @returns {boolean} True if the mirror reflects a stack frame
- */
-Mirror.prototype.isFrame = function() {
-  return this instanceof FrameMirror;
-};
-
-
-/**
- * Check whether the mirror reflects a script.
- * @returns {boolean} True if the mirror reflects a script
- */
-Mirror.prototype.isScript = function() {
-  return this instanceof ScriptMirror;
-};
-
-
-/**
- * Check whether the mirror reflects a context.
- * @returns {boolean} True if the mirror reflects a context
- */
-Mirror.prototype.isContext = function() {
-  return this instanceof ContextMirror;
-};
-
-
-/**
- * Check whether the mirror reflects a scope.
- * @returns {boolean} True if the mirror reflects a scope
- */
-Mirror.prototype.isScope = function() {
-  return this instanceof ScopeMirror;
-};
-
-
-/**
- * Check whether the mirror reflects a map.
- * @returns {boolean} True if the mirror reflects a map
- */
-Mirror.prototype.isMap = function() {
-  return this instanceof MapMirror;
-};
-
-
-/**
- * Check whether the mirror reflects a set.
- * @returns {boolean} True if the mirror reflects a set
- */
-Mirror.prototype.isSet = function() {
-  return this instanceof SetMirror;
-};
-
-
-/**
- * Check whether the mirror reflects an iterator.
- * @returns {boolean} True if the mirror reflects an iterator
- */
-Mirror.prototype.isIterator = function() {
-  return this instanceof IteratorMirror;
-};
-
-
-Mirror.prototype.toText = function() {
-  // Simpel to text which is used when on specialization in subclass.
-  return "#<" + this.constructor.name + ">";
-};
-
-
-/**
- * Base class for all value mirror objects.
- * @param {string} type The type of the mirror
- * @param {value} value The value reflected by this mirror
- * @constructor
- * @extends Mirror
- */
-function ValueMirror(type, value) {
-  %_Call(Mirror, this, type);
-  this.value_ = value;
-}
-inherits(ValueMirror, Mirror);
-
-
-/**
- * Check whether this is a primitive value.
- * @return {boolean} True if the mirror reflects a primitive value
- */
-ValueMirror.prototype.isPrimitive = function() {
-  var type = this.type();
-  return type === 'undefined' ||
-         type === 'null' ||
-         type === 'boolean' ||
-         type === 'number' ||
-         type === 'string' ||
-         type === 'symbol';
-};
-
-
-/**
- * Get the actual value reflected by this mirror.
- * @return {value} The value reflected by this mirror
- */
-ValueMirror.prototype.value = function() {
-  return this.value_;
-};
-
-
-/**
- * Mirror object for Undefined.
- * @constructor
- * @extends ValueMirror
- */
-function UndefinedMirror() {
-  %_Call(ValueMirror, this, MirrorType.UNDEFINED_TYPE, UNDEFINED);
-}
-inherits(UndefinedMirror, ValueMirror);
-
-
-UndefinedMirror.prototype.toText = function() {
-  return 'undefined';
-};
-
-
-/**
- * Mirror object for null.
- * @constructor
- * @extends ValueMirror
- */
-function NullMirror() {
-  %_Call(ValueMirror, this, MirrorType.NULL_TYPE, null);
-}
-inherits(NullMirror, ValueMirror);
-
-
-NullMirror.prototype.toText = function() {
-  return 'null';
-};
-
-
-/**
- * Mirror object for boolean values.
- * @param {boolean} value The boolean value reflected by this mirror
- * @constructor
- * @extends ValueMirror
- */
-function BooleanMirror(value) {
-  %_Call(ValueMirror, this, MirrorType.BOOLEAN_TYPE, value);
-}
-inherits(BooleanMirror, ValueMirror);
-
-
-BooleanMirror.prototype.toText = function() {
-  return this.value_ ? 'true' : 'false';
-};
-
-
-/**
- * Mirror object for number values.
- * @param {number} value The number value reflected by this mirror
- * @constructor
- * @extends ValueMirror
- */
-function NumberMirror(value) {
-  %_Call(ValueMirror, this, MirrorType.NUMBER_TYPE, value);
-}
-inherits(NumberMirror, ValueMirror);
-
-
-NumberMirror.prototype.toText = function() {
-  return '' + this.value_;
-};
-
-
-/**
- * Mirror object for string values.
- * @param {string} value The string value reflected by this mirror
- * @constructor
- * @extends ValueMirror
- */
-function StringMirror(value) {
-  %_Call(ValueMirror, this, MirrorType.STRING_TYPE, value);
-}
-inherits(StringMirror, ValueMirror);
-
-
-StringMirror.prototype.length = function() {
-  return this.value_.length;
-};
-
-StringMirror.prototype.getTruncatedValue = function(maxLength) {
-  if (maxLength != -1 && this.length() > maxLength) {
-    return this.value_.substring(0, maxLength) +
-           '... (length: ' + this.length() + ')';
-  }
-  return this.value_;
-};
-
-StringMirror.prototype.toText = function() {
-  return this.getTruncatedValue(kMaxProtocolStringLength);
-};
-
-
-/**
- * Mirror object for a Symbol
- * @param {Object} value The Symbol
- * @constructor
- * @extends Mirror
- */
-function SymbolMirror(value) {
-  %_Call(ValueMirror, this, MirrorType.SYMBOL_TYPE, value);
-}
-inherits(SymbolMirror, ValueMirror);
-
-
-SymbolMirror.prototype.description = function() {
-  return %SymbolDescription(%ValueOf(this.value_));
-}
-
-
-SymbolMirror.prototype.toText = function() {
-  return %SymbolDescriptiveString(%ValueOf(this.value_));
-}
-
-
-/**
- * Mirror object for objects.
- * @param {object} value The object reflected by this mirror
- * @constructor
- * @extends ValueMirror
- */
-function ObjectMirror(value, type) {
-  type = type || MirrorType.OBJECT_TYPE;
-  %_Call(ValueMirror, this, type, value);
-}
-inherits(ObjectMirror, ValueMirror);
-
-
-ObjectMirror.prototype.className = function() {
-  return %ClassOf(this.value_);
-};
-
-
-ObjectMirror.prototype.constructorFunction = function() {
-  return MakeMirror(%DebugGetProperty(this.value_, 'constructor'));
-};
-
-
-ObjectMirror.prototype.prototypeObject = function() {
-  return MakeMirror(%DebugGetProperty(this.value_, 'prototype'));
-};
-
-
-ObjectMirror.prototype.protoObject = function() {
-  return MakeMirror(%DebugGetPrototype(this.value_));
-};
-
-
-ObjectMirror.prototype.hasNamedInterceptor = function() {
-  // Get information on interceptors for this object.
-  var x = %GetInterceptorInfo(this.value_);
-  return (x & 2) != 0;
-};
-
-
-ObjectMirror.prototype.hasIndexedInterceptor = function() {
-  // Get information on interceptors for this object.
-  var x = %GetInterceptorInfo(this.value_);
-  return (x & 1) != 0;
-};
-
-
-/**
- * Return the property names for this object.
- * @param {number} kind Indicate whether named, indexed or both kinds of
- *     properties are requested
- * @param {number} limit Limit the number of names returend to the specified
-       value
- * @return {Array} Property names for this object
- */
-ObjectMirror.prototype.propertyNames = function() {
-  return %GetOwnPropertyKeys(this.value_, PROPERTY_FILTER_NONE);
-};
-
-
-/**
- * Return the properties for this object as an array of PropertyMirror objects.
- * @param {number} kind Indicate whether named, indexed or both kinds of
- *     properties are requested
- * @param {number} limit Limit the number of properties returned to the
-       specified value
- * @return {Array} Property mirrors for this object
- */
-ObjectMirror.prototype.properties = function() {
-  var names = this.propertyNames();
-  var properties = new GlobalArray(names.length);
-  for (var i = 0; i < names.length; i++) {
-    properties[i] = this.property(names[i]);
-  }
-
-  return properties;
-};
-
-
-/**
- * Return the internal properties for this object as an array of
- * InternalPropertyMirror objects.
- * @return {Array} Property mirrors for this object
- */
-ObjectMirror.prototype.internalProperties = function() {
-  return ObjectMirror.GetInternalProperties(this.value_);
-}
-
-
-ObjectMirror.prototype.property = function(name) {
-  var details = %DebugGetPropertyDetails(this.value_, name);
-  if (details) {
-    return new PropertyMirror(this, name, details);
-  }
-
-  // Nothing found.
-  return GetUndefinedMirror();
-};
-
-
-
-/**
- * Try to find a property from its value.
- * @param {Mirror} value The property value to look for
- * @return {PropertyMirror} The property with the specified value. If no
- *     property was found with the specified value UndefinedMirror is returned
- */
-ObjectMirror.prototype.lookupProperty = function(value) {
-  var properties = this.properties();
-
-  // Look for property value in properties.
-  for (var i = 0; i < properties.length; i++) {
-
-    // Skip properties which are defined through accessors.
-    var property = properties[i];
-    if (property.propertyType() == PropertyType.Data) {
-      if (property.value_ === value.value_) {
-        return property;
-      }
-    }
-  }
-
-  // Nothing found.
-  return GetUndefinedMirror();
-};
-
-
-/**
- * Returns objects which has direct references to this object
- * @param {number} opt_max_objects Optional parameter specifying the maximum
- *     number of referencing objects to return.
- * @return {Array} The objects which has direct references to this object.
- */
-ObjectMirror.prototype.referencedBy = function(opt_max_objects) {
-  // Find all objects with direct references to this object.
-  var result = %DebugReferencedBy(this.value_,
-                                  Mirror.prototype, opt_max_objects || 0);
-
-  // Make mirrors for all the references found.
-  for (var i = 0; i < result.length; i++) {
-    result[i] = MakeMirror(result[i]);
-  }
-
-  return result;
-};
-
-
-ObjectMirror.prototype.toText = function() {
-  var name;
-  var ctor = this.constructorFunction();
-  if (!ctor.isFunction()) {
-    name = this.className();
-  } else {
-    name = ctor.name();
-    if (!name) {
-      name = this.className();
-    }
-  }
-  return '#<' + name + '>';
-};
-
-
-/**
- * Return the internal properties of the value, such as [[PrimitiveValue]] of
- * scalar wrapper objects, properties of the bound function and properties of
- * the promise.
- * This method is done static to be accessible from Debug API with the bare
- * values without mirrors.
- * @return {Array} array (possibly empty) of InternalProperty instances
- */
-ObjectMirror.GetInternalProperties = function(value) {
-  var properties = %DebugGetInternalProperties(value);
-  var result = [];
-  for (var i = 0; i < properties.length; i += 2) {
-    result.push(new InternalPropertyMirror(properties[i], properties[i + 1]));
-  }
-  return result;
-}
-
-
-/**
- * Mirror object for functions.
- * @param {function} value The function object reflected by this mirror.
- * @constructor
- * @extends ObjectMirror
- */
-function FunctionMirror(value) {
-  %_Call(ObjectMirror, this, value, MirrorType.FUNCTION_TYPE);
-  this.resolved_ = true;
-}
-inherits(FunctionMirror, ObjectMirror);
-
-
-/**
- * Returns whether the function is resolved.
- * @return {boolean} True if the function is resolved. Unresolved functions can
- *     only originate as functions from stack frames
- */
-FunctionMirror.prototype.resolved = function() {
-  return this.resolved_;
-};
-
-
-/**
- * Returns the name of the function.
- * @return {string} Name of the function
- */
-FunctionMirror.prototype.name = function() {
-  return %FunctionGetName(this.value_);
-};
-
-
-/**
- * Returns the displayName if it is set, otherwise name, otherwise inferred
- * name.
- * @return {string} Name of the function
- */
-FunctionMirror.prototype.debugName = function() {
-  return %FunctionGetDebugName(this.value_);
-}
-
-
-/**
- * Returns the inferred name of the function.
- * @return {string} Name of the function
- */
-FunctionMirror.prototype.inferredName = function() {
-  return %FunctionGetInferredName(this.value_);
-};
-
-
-/**
- * Returns the source code for the function.
- * @return {string or undefined} The source code for the function. If the
- *     function is not resolved undefined will be returned.
- */
-FunctionMirror.prototype.source = function() {
-  // Return source if function is resolved. Otherwise just fall through to
-  // return undefined.
-  if (this.resolved()) {
-    return %FunctionToString(this.value_);
-  }
-};
-
-
-/**
- * Returns the script object for the function.
- * @return {ScriptMirror or undefined} Script object for the function or
- *     undefined if the function has no script
- */
-FunctionMirror.prototype.script = function() {
-  // Return script if function is resolved. Otherwise just fall through
-  // to return undefined.
-  if (this.resolved()) {
-    if (this.script_) {
-      return this.script_;
-    }
-    var script = %FunctionGetScript(this.value_);
-    if (script) {
-      return this.script_ = MakeMirror(script);
-    }
-  }
-};
-
-
-/**
- * Returns the script source position for the function. Only makes sense
- * for functions which has a script defined.
- * @return {Number or undefined} in-script position for the function
- */
-FunctionMirror.prototype.sourcePosition_ = function() {
-  // Return position if function is resolved. Otherwise just fall
-  // through to return undefined.
-  if (this.resolved()) {
-    return %FunctionGetScriptSourcePosition(this.value_);
-  }
-};
-
-
-/**
- * Returns the script source location object for the function. Only makes sense
- * for functions which has a script defined.
- * @return {Location or undefined} in-script location for the function begin
- */
-FunctionMirror.prototype.sourceLocation = function() {
-  if (this.resolved()) {
-    var script = this.script();
-    if (script) {
-      return script.locationFromPosition(this.sourcePosition_(), true);
-    }
-  }
-};
-
-
-/**
- * Returns objects constructed by this function.
- * @param {number} opt_max_instances Optional parameter specifying the maximum
- *     number of instances to return.
- * @return {Array or undefined} The objects constructed by this function.
- */
-FunctionMirror.prototype.constructedBy = function(opt_max_instances) {
-  if (this.resolved()) {
-    // Find all objects constructed from this function.
-    var result = %DebugConstructedBy(this.value_, opt_max_instances || 0);
-
-    // Make mirrors for all the instances found.
-    for (var i = 0; i < result.length; i++) {
-      result[i] = MakeMirror(result[i]);
-    }
-
-    return result;
-  } else {
-    return [];
-  }
-};
-
-
-FunctionMirror.prototype.scopeCount = function() {
-  if (this.resolved()) {
-    if (IS_UNDEFINED(this.scopeCount_)) {
-      this.scopeCount_ = %GetFunctionScopeCount(this.value());
-    }
-    return this.scopeCount_;
-  } else {
-    return 0;
-  }
-};
-
-
-FunctionMirror.prototype.scope = function(index) {
-  if (this.resolved()) {
-    return new ScopeMirror(UNDEFINED, this, UNDEFINED, index);
-  }
-};
-
-
-FunctionMirror.prototype.toText = function() {
-  return this.source();
-};
-
-
-FunctionMirror.prototype.context = function() {
-  if (this.resolved()) {
-    if (!this._context)
-      this._context = new ContextMirror(%FunctionGetContextData(this.value_));
-    return this._context;
-  }
-};
-
-
-/**
- * Mirror object for unresolved functions.
- * @param {string} value The name for the unresolved function reflected by this
- *     mirror.
- * @constructor
- * @extends ObjectMirror
- */
-function UnresolvedFunctionMirror(value) {
-  // Construct this using the ValueMirror as an unresolved function is not a
-  // real object but just a string.
-  %_Call(ValueMirror, this, MirrorType.FUNCTION_TYPE, value);
-  this.propertyCount_ = 0;
-  this.elementCount_ = 0;
-  this.resolved_ = false;
-}
-inherits(UnresolvedFunctionMirror, FunctionMirror);
-
-
-UnresolvedFunctionMirror.prototype.className = function() {
-  return 'Function';
-};
-
-
-UnresolvedFunctionMirror.prototype.constructorFunction = function() {
-  return GetUndefinedMirror();
-};
-
-
-UnresolvedFunctionMirror.prototype.prototypeObject = function() {
-  return GetUndefinedMirror();
-};
-
-
-UnresolvedFunctionMirror.prototype.protoObject = function() {
-  return GetUndefinedMirror();
-};
-
-
-UnresolvedFunctionMirror.prototype.name = function() {
-  return this.value_;
-};
-
-
-UnresolvedFunctionMirror.prototype.debugName = function() {
-  return this.value_;
-};
-
-
-UnresolvedFunctionMirror.prototype.inferredName = function() {
-  return UNDEFINED;
-};
-
-
-UnresolvedFunctionMirror.prototype.propertyNames = function(kind, limit) {
-  return [];
-};
-
-
-/**
- * Mirror object for arrays.
- * @param {Array} value The Array object reflected by this mirror
- * @constructor
- * @extends ObjectMirror
- */
-function ArrayMirror(value) {
-  %_Call(ObjectMirror, this, value);
-}
-inherits(ArrayMirror, ObjectMirror);
-
-
-ArrayMirror.prototype.length = function() {
-  return this.value_.length;
-};
-
-
-ArrayMirror.prototype.indexedPropertiesFromRange = function(opt_from_index,
-                                                            opt_to_index) {
-  var from_index = opt_from_index || 0;
-  var to_index = opt_to_index || this.length() - 1;
-  if (from_index > to_index) return new GlobalArray();
-  var values = new GlobalArray(to_index - from_index + 1);
-  for (var i = from_index; i <= to_index; i++) {
-    var details = %DebugGetPropertyDetails(this.value_, TO_STRING(i));
-    var value;
-    if (details) {
-      value = new PropertyMirror(this, i, details);
-    } else {
-      value = GetUndefinedMirror();
-    }
-    values[i - from_index] = value;
-  }
-  return values;
-};
-
-
-/**
- * Mirror object for dates.
- * @param {Date} value The Date object reflected by this mirror
- * @constructor
- * @extends ObjectMirror
- */
-function DateMirror(value) {
-  %_Call(ObjectMirror, this, value);
-}
-inherits(DateMirror, ObjectMirror);
-
-
-DateMirror.prototype.toText = function() {
-  var s = JSONStringify(this.value_);
-  return s.substring(1, s.length - 1);  // cut quotes
-};
-
-
-/**
- * Mirror object for regular expressions.
- * @param {RegExp} value The RegExp object reflected by this mirror
- * @constructor
- * @extends ObjectMirror
- */
-function RegExpMirror(value) {
-  %_Call(ObjectMirror, this, value, MirrorType.REGEXP_TYPE);
-}
-inherits(RegExpMirror, ObjectMirror);
-
-
-/**
- * Returns the source to the regular expression.
- * @return {string or undefined} The source to the regular expression
- */
-RegExpMirror.prototype.source = function() {
-  return this.value_.source;
-};
-
-
-/**
- * Returns whether this regular expression has the global (g) flag set.
- * @return {boolean} Value of the global flag
- */
-RegExpMirror.prototype.global = function() {
-  return this.value_.global;
-};
-
-
-/**
- * Returns whether this regular expression has the ignore case (i) flag set.
- * @return {boolean} Value of the ignore case flag
- */
-RegExpMirror.prototype.ignoreCase = function() {
-  return this.value_.ignoreCase;
-};
-
-
-/**
- * Returns whether this regular expression has the multiline (m) flag set.
- * @return {boolean} Value of the multiline flag
- */
-RegExpMirror.prototype.multiline = function() {
-  return this.value_.multiline;
-};
-
-
-/**
- * Returns whether this regular expression has the sticky (y) flag set.
- * @return {boolean} Value of the sticky flag
- */
-RegExpMirror.prototype.sticky = function() {
-  return this.value_.sticky;
-};
-
-
-/**
- * Returns whether this regular expression has the unicode (u) flag set.
- * @return {boolean} Value of the unicode flag
- */
-RegExpMirror.prototype.unicode = function() {
-  return this.value_.unicode;
-};
-
-
-RegExpMirror.prototype.toText = function() {
-  // Simpel to text which is used when on specialization in subclass.
-  return "/" + this.source() + "/";
-};
-
-
-/**
- * Mirror object for error objects.
- * @param {Error} value The error object reflected by this mirror
- * @constructor
- * @extends ObjectMirror
- */
-function ErrorMirror(value) {
-  %_Call(ObjectMirror, this, value, MirrorType.ERROR_TYPE);
-}
-inherits(ErrorMirror, ObjectMirror);
-
-
-/**
- * Returns the message for this eror object.
- * @return {string or undefined} The message for this eror object
- */
-ErrorMirror.prototype.message = function() {
-  return this.value_.message;
-};
-
-
-ErrorMirror.prototype.toText = function() {
-  // Use the same text representation as in messages.js.
-  var text;
-  try {
-    text = %ErrorToString(this.value_);
-  } catch (e) {
-    text = '#<Error>';
-  }
-  return text;
-};
-
-
-/**
- * Mirror object for a Promise object.
- * @param {Object} value The Promise object
- * @constructor
- * @extends ObjectMirror
- */
-function PromiseMirror(value) {
-  %_Call(ObjectMirror, this, value, MirrorType.PROMISE_TYPE);
-}
-inherits(PromiseMirror, ObjectMirror);
-
-
-function PromiseGetStatus_(value) {
-  var status = %PromiseStatus(value);
-  if (status == 0) return "pending";
-  if (status == 1) return "resolved";
-  return "rejected";
-}
-
-
-function PromiseGetValue_(value) {
-  return %PromiseResult(value);
-}
-
-
-PromiseMirror.prototype.status = function() {
-  return PromiseGetStatus_(this.value_);
-};
-
-
-PromiseMirror.prototype.promiseValue = function() {
-  return MakeMirror(PromiseGetValue_(this.value_));
-};
-
-
-function MapMirror(value) {
-  %_Call(ObjectMirror, this, value, MirrorType.MAP_TYPE);
-}
-inherits(MapMirror, ObjectMirror);
-
-
-/**
- * Returns an array of key/value pairs of a map.
- * This will keep keys alive for WeakMaps.
- *
- * @param {number=} opt_limit Max elements to return.
- * @returns {Array.<Object>} Array of key/value pairs of a map.
- */
-MapMirror.prototype.entries = function(opt_limit) {
-  var result = [];
-
-  if (IS_WEAKMAP(this.value_)) {
-    var entries = %GetWeakMapEntries(this.value_, opt_limit || 0);
-    for (var i = 0; i < entries.length; i += 2) {
-      result.push({
-        key: entries[i],
-        value: entries[i + 1]
-      });
-    }
-    return result;
-  }
-
-  var iter = %_Call(MapEntries, this.value_);
-  var next;
-  while ((!opt_limit || result.length < opt_limit) &&
-         !(next = iter.next()).done) {
-    result.push({
-      key: next.value[0],
-      value: next.value[1]
-    });
-  }
-  return result;
-};
-
-
-function SetMirror(value) {
-  %_Call(ObjectMirror, this, value, MirrorType.SET_TYPE);
-}
-inherits(SetMirror, ObjectMirror);
-
-
-function IteratorGetValues_(iter, next_function, opt_limit) {
-  var result = [];
-  var next;
-  while ((!opt_limit || result.length < opt_limit) &&
-         !(next = %_Call(next_function, iter)).done) {
-    result.push(next.value);
-  }
-  return result;
-}
-
-
-/**
- * Returns an array of elements of a set.
- * This will keep elements alive for WeakSets.
- *
- * @param {number=} opt_limit Max elements to return.
- * @returns {Array.<Object>} Array of elements of a set.
- */
-SetMirror.prototype.values = function(opt_limit) {
-  if (IS_WEAKSET(this.value_)) {
-    return %GetWeakSetValues(this.value_, opt_limit || 0);
-  }
-
-  var iter = %_Call(SetValues, this.value_);
-  return IteratorGetValues_(iter, SetIteratorNext, opt_limit);
-};
-
-
-function IteratorMirror(value) {
-  %_Call(ObjectMirror, this, value, MirrorType.ITERATOR_TYPE);
-}
-inherits(IteratorMirror, ObjectMirror);
-
-
-/**
- * Returns a preview of elements of an iterator.
- * Does not change the backing iterator state.
- *
- * @param {number=} opt_limit Max elements to return.
- * @returns {Array.<Object>} Array of elements of an iterator.
- */
-IteratorMirror.prototype.preview = function(opt_limit) {
-  if (IS_MAP_ITERATOR(this.value_)) {
-    return IteratorGetValues_(%MapIteratorClone(this.value_),
-                              MapIteratorNext,
-                              opt_limit);
-  } else if (IS_SET_ITERATOR(this.value_)) {
-    return IteratorGetValues_(%SetIteratorClone(this.value_),
-                              SetIteratorNext,
-                              opt_limit);
-  }
-};
-
-
-/**
- * Mirror object for a Generator object.
- * @param {Object} data The Generator object
- * @constructor
- * @extends Mirror
- */
-function GeneratorMirror(value) {
-  %_Call(ObjectMirror, this, value, MirrorType.GENERATOR_TYPE);
-}
-inherits(GeneratorMirror, ObjectMirror);
-
-
-function GeneratorGetStatus_(value) {
-  var continuation = %GeneratorGetContinuation(value);
-  if (continuation < -1) return "running";
-  if (continuation == -1) return "closed";
-  return "suspended";
-}
-
-
-GeneratorMirror.prototype.status = function() {
-  return GeneratorGetStatus_(this.value_);
-};
-
-
-GeneratorMirror.prototype.sourcePosition_ = function() {
-  return %GeneratorGetSourcePosition(this.value_);
-};
-
-
-GeneratorMirror.prototype.sourceLocation = function() {
-  var pos = this.sourcePosition_();
-  if (!IS_UNDEFINED(pos)) {
-    var script = this.func().script();
-    if (script) {
-      return script.locationFromPosition(pos, true);
-    }
-  }
-};
-
-
-GeneratorMirror.prototype.func = function() {
-  if (!this.func_) {
-    this.func_ = MakeMirror(%GeneratorGetFunction(this.value_));
-  }
-  return this.func_;
-};
-
-
-GeneratorMirror.prototype.receiver = function() {
-  if (!this.receiver_) {
-    this.receiver_ = MakeMirror(%GeneratorGetReceiver(this.value_));
-  }
-  return this.receiver_;
-};
-
-
-GeneratorMirror.prototype.scopeCount = function() {
-  // This value can change over time as the underlying generator is suspended
-  // at different locations.
-  return %GetGeneratorScopeCount(this.value());
-};
-
-
-GeneratorMirror.prototype.scope = function(index) {
-  return new ScopeMirror(UNDEFINED, UNDEFINED, this, index);
-};
-
-
-GeneratorMirror.prototype.allScopes = function() {
-  var scopes = [];
-  for (let i = 0; i < this.scopeCount(); i++) {
-    scopes.push(this.scope(i));
-  }
-  return scopes;
-};
-
-
-/**
- * Base mirror object for properties.
- * @param {ObjectMirror} mirror The mirror object having this property
- * @param {string} name The name of the property
- * @param {Array} details Details about the property
- * @constructor
- * @extends Mirror
- */
-function PropertyMirror(mirror, name, details) {
-  %_Call(Mirror, this, MirrorType.PROPERTY_TYPE);
-  this.mirror_ = mirror;
-  this.name_ = name;
-  this.value_ = details[0];
-  this.details_ = details[1];
-  this.is_interceptor_ = details[2];
-  if (details.length > 3) {
-    this.exception_ = details[3];
-    this.getter_ = details[4];
-    this.setter_ = details[5];
-  }
-}
-inherits(PropertyMirror, Mirror);
-
-
-PropertyMirror.prototype.isReadOnly = function() {
-  return (this.attributes() & PropertyAttribute.ReadOnly) != 0;
-};
-
-
-PropertyMirror.prototype.isEnum = function() {
-  return (this.attributes() & PropertyAttribute.DontEnum) == 0;
-};
-
-
-PropertyMirror.prototype.canDelete = function() {
-  return (this.attributes() & PropertyAttribute.DontDelete) == 0;
-};
-
-
-PropertyMirror.prototype.name = function() {
-  return this.name_;
-};
-
-
-PropertyMirror.prototype.toText = function() {
-  if (IS_SYMBOL(this.name_)) return %SymbolDescriptiveString(this.name_);
-  return this.name_;
-};
-
-
-PropertyMirror.prototype.isIndexed = function() {
-  for (var i = 0; i < this.name_.length; i++) {
-    if (this.name_[i] < '0' || '9' < this.name_[i]) {
-      return false;
-    }
-  }
-  return true;
-};
-
-
-PropertyMirror.prototype.value = function() {
-  return MakeMirror(this.value_, false);
-};
-
-
-/**
- * Returns whether this property value is an exception.
- * @return {boolean} True if this property value is an exception
- */
-PropertyMirror.prototype.isException = function() {
-  return this.exception_ ? true : false;
-};
-
-
-PropertyMirror.prototype.attributes = function() {
-  return %DebugPropertyAttributesFromDetails(this.details_);
-};
-
-
-PropertyMirror.prototype.propertyType = function() {
-  return %DebugPropertyKindFromDetails(this.details_);
-};
-
-
-/**
- * Returns whether this property has a getter defined through __defineGetter__.
- * @return {boolean} True if this property has a getter
- */
-PropertyMirror.prototype.hasGetter = function() {
-  return this.getter_ ? true : false;
-};
-
-
-/**
- * Returns whether this property has a setter defined through __defineSetter__.
- * @return {boolean} True if this property has a setter
- */
-PropertyMirror.prototype.hasSetter = function() {
-  return this.setter_ ? true : false;
-};
-
-
-/**
- * Returns the getter for this property defined through __defineGetter__.
- * @return {Mirror} FunctionMirror reflecting the getter function or
- *     UndefinedMirror if there is no getter for this property
- */
-PropertyMirror.prototype.getter = function() {
-  if (this.hasGetter()) {
-    return MakeMirror(this.getter_);
-  } else {
-    return GetUndefinedMirror();
-  }
-};
-
-
-/**
- * Returns the setter for this property defined through __defineSetter__.
- * @return {Mirror} FunctionMirror reflecting the setter function or
- *     UndefinedMirror if there is no setter for this property
- */
-PropertyMirror.prototype.setter = function() {
-  if (this.hasSetter()) {
-    return MakeMirror(this.setter_);
-  } else {
-    return GetUndefinedMirror();
-  }
-};
-
-
-/**
- * Returns whether this property is natively implemented by the host or a set
- * through JavaScript code.
- * @return {boolean} True if the property is
- *     UndefinedMirror if there is no setter for this property
- */
-PropertyMirror.prototype.isNative = function() {
-  return this.is_interceptor_ ||
-         ((this.propertyType() == PropertyType.Accessor) &&
-          !this.hasGetter() && !this.hasSetter());
-};
-
-
-/**
- * Mirror object for internal properties. Internal property reflects properties
- * not accessible from user code such as [[BoundThis]] in bound function.
- * Their names are merely symbolic.
- * @param {string} name The name of the property
- * @param {value} property value
- * @constructor
- * @extends Mirror
- */
-function InternalPropertyMirror(name, value) {
-  %_Call(Mirror, this, MirrorType.INTERNAL_PROPERTY_TYPE);
-  this.name_ = name;
-  this.value_ = value;
-}
-inherits(InternalPropertyMirror, Mirror);
-
-
-InternalPropertyMirror.prototype.name = function() {
-  return this.name_;
-};
-
-
-InternalPropertyMirror.prototype.value = function() {
-  return MakeMirror(this.value_, false);
-};
-
-
-var kFrameDetailsFrameIdIndex = 0;
-var kFrameDetailsReceiverIndex = 1;
-var kFrameDetailsFunctionIndex = 2;
-var kFrameDetailsScriptIndex = 3;
-var kFrameDetailsArgumentCountIndex = 4;
-var kFrameDetailsLocalCountIndex = 5;
-var kFrameDetailsSourcePositionIndex = 6;
-var kFrameDetailsConstructCallIndex = 7;
-var kFrameDetailsAtReturnIndex = 8;
-var kFrameDetailsFlagsIndex = 9;
-var kFrameDetailsFirstDynamicIndex = 10;
-
-var kFrameDetailsNameIndex = 0;
-var kFrameDetailsValueIndex = 1;
-var kFrameDetailsNameValueSize = 2;
-
-var kFrameDetailsFlagDebuggerFrameMask = 1 << 0;
-var kFrameDetailsFlagOptimizedFrameMask = 1 << 1;
-var kFrameDetailsFlagInlinedFrameIndexMask = 7 << 2;
-
-/**
- * Wrapper for the frame details information retreived from the VM. The frame
- * details from the VM is an array with the following content. See runtime.cc
- * Runtime_GetFrameDetails.
- *     0: Id
- *     1: Receiver
- *     2: Function
- *     3: Script
- *     4: Argument count
- *     5: Local count
- *     6: Source position
- *     7: Construct call
- *     8: Is at return
- *     9: Flags (debugger frame, optimized frame, inlined frame index)
- *     Arguments name, value
- *     Locals name, value
- *     Return value if any
- * @param {number} break_id Current break id
- * @param {number} index Frame number
- * @constructor
- */
-function FrameDetails(break_id, index) {
-  this.break_id_ = break_id;
-  this.details_ = %GetFrameDetails(break_id, index);
-}
-
-
-FrameDetails.prototype.frameId = function() {
-  %CheckExecutionState(this.break_id_);
-  return this.details_[kFrameDetailsFrameIdIndex];
-};
-
-
-FrameDetails.prototype.receiver = function() {
-  %CheckExecutionState(this.break_id_);
-  return this.details_[kFrameDetailsReceiverIndex];
-};
-
-
-FrameDetails.prototype.func = function() {
-  %CheckExecutionState(this.break_id_);
-  return this.details_[kFrameDetailsFunctionIndex];
-};
-
-
-FrameDetails.prototype.script = function() {
-  %CheckExecutionState(this.break_id_);
-  return this.details_[kFrameDetailsScriptIndex];
-};
-
-
-FrameDetails.prototype.isConstructCall = function() {
-  %CheckExecutionState(this.break_id_);
-  return this.details_[kFrameDetailsConstructCallIndex];
-};
-
-
-FrameDetails.prototype.isAtReturn = function() {
-  %CheckExecutionState(this.break_id_);
-  return this.details_[kFrameDetailsAtReturnIndex];
-};
-
-
-FrameDetails.prototype.isDebuggerFrame = function() {
-  %CheckExecutionState(this.break_id_);
-  var f = kFrameDetailsFlagDebuggerFrameMask;
-  return (this.details_[kFrameDetailsFlagsIndex] & f) == f;
-};
-
-
-FrameDetails.prototype.isOptimizedFrame = function() {
-  %CheckExecutionState(this.break_id_);
-  var f = kFrameDetailsFlagOptimizedFrameMask;
-  return (this.details_[kFrameDetailsFlagsIndex] & f) == f;
-};
-
-
-FrameDetails.prototype.isInlinedFrame = function() {
-  return this.inlinedFrameIndex() > 0;
-};
-
-
-FrameDetails.prototype.inlinedFrameIndex = function() {
-  %CheckExecutionState(this.break_id_);
-  var f = kFrameDetailsFlagInlinedFrameIndexMask;
-  return (this.details_[kFrameDetailsFlagsIndex] & f) >> 2;
-};
-
-
-FrameDetails.prototype.argumentCount = function() {
-  %CheckExecutionState(this.break_id_);
-  return this.details_[kFrameDetailsArgumentCountIndex];
-};
-
-
-FrameDetails.prototype.argumentName = function(index) {
-  %CheckExecutionState(this.break_id_);
-  if (index >= 0 && index < this.argumentCount()) {
-    return this.details_[kFrameDetailsFirstDynamicIndex +
-                         index * kFrameDetailsNameValueSize +
-                         kFrameDetailsNameIndex];
-  }
-};
-
-
-FrameDetails.prototype.argumentValue = function(index) {
-  %CheckExecutionState(this.break_id_);
-  if (index >= 0 && index < this.argumentCount()) {
-    return this.details_[kFrameDetailsFirstDynamicIndex +
-                         index * kFrameDetailsNameValueSize +
-                         kFrameDetailsValueIndex];
-  }
-};
-
-
-FrameDetails.prototype.localCount = function() {
-  %CheckExecutionState(this.break_id_);
-  return this.details_[kFrameDetailsLocalCountIndex];
-};
-
-
-FrameDetails.prototype.sourcePosition = function() {
-  %CheckExecutionState(this.break_id_);
-  return this.details_[kFrameDetailsSourcePositionIndex];
-};
-
-
-FrameDetails.prototype.localName = function(index) {
-  %CheckExecutionState(this.break_id_);
-  if (index >= 0 && index < this.localCount()) {
-    var locals_offset = kFrameDetailsFirstDynamicIndex +
-                        this.argumentCount() * kFrameDetailsNameValueSize;
-    return this.details_[locals_offset +
-                         index * kFrameDetailsNameValueSize +
-                         kFrameDetailsNameIndex];
-  }
-};
-
-
-FrameDetails.prototype.localValue = function(index) {
-  %CheckExecutionState(this.break_id_);
-  if (index >= 0 && index < this.localCount()) {
-    var locals_offset = kFrameDetailsFirstDynamicIndex +
-                        this.argumentCount() * kFrameDetailsNameValueSize;
-    return this.details_[locals_offset +
-                         index * kFrameDetailsNameValueSize +
-                         kFrameDetailsValueIndex];
-  }
-};
-
-
-FrameDetails.prototype.returnValue = function() {
-  %CheckExecutionState(this.break_id_);
-  var return_value_offset =
-      kFrameDetailsFirstDynamicIndex +
-      (this.argumentCount() + this.localCount()) * kFrameDetailsNameValueSize;
-  if (this.details_[kFrameDetailsAtReturnIndex]) {
-    return this.details_[return_value_offset];
-  }
-};
-
-
-FrameDetails.prototype.scopeCount = function() {
-  if (IS_UNDEFINED(this.scopeCount_)) {
-    this.scopeCount_ = %GetScopeCount(this.break_id_, this.frameId());
-  }
-  return this.scopeCount_;
-};
-
-
-/**
- * Mirror object for stack frames.
- * @param {number} break_id The break id in the VM for which this frame is
-       valid
- * @param {number} index The frame index (top frame is index 0)
- * @constructor
- * @extends Mirror
- */
-function FrameMirror(break_id, index) {
-  %_Call(Mirror, this, MirrorType.FRAME_TYPE);
-  this.break_id_ = break_id;
-  this.index_ = index;
-  this.details_ = new FrameDetails(break_id, index);
-}
-inherits(FrameMirror, Mirror);
-
-
-FrameMirror.prototype.details = function() {
-  return this.details_;
-};
-
-
-FrameMirror.prototype.index = function() {
-  return this.index_;
-};
-
-
-FrameMirror.prototype.func = function() {
-  if (this.func_) {
-    return this.func_;
-  }
-
-  // Get the function for this frame from the VM.
-  var f = this.details_.func();
-
-  // Create a function mirror. NOTE: MakeMirror cannot be used here as the
-  // value returned from the VM might be a string if the function for the
-  // frame is unresolved.
-  if (IS_FUNCTION(f)) {
-    return this.func_ = MakeMirror(f);
-  } else {
-    return new UnresolvedFunctionMirror(f);
-  }
-};
-
-
-FrameMirror.prototype.script = function() {
-  if (!this.script_) {
-    this.script_ = MakeMirror(this.details_.script());
-  }
-
-  return this.script_;
-}
-
-
-FrameMirror.prototype.receiver = function() {
-  return MakeMirror(this.details_.receiver());
-};
-
-
-FrameMirror.prototype.isConstructCall = function() {
-  return this.details_.isConstructCall();
-};
-
-
-FrameMirror.prototype.isAtReturn = function() {
-  return this.details_.isAtReturn();
-};
-
-
-FrameMirror.prototype.isDebuggerFrame = function() {
-  return this.details_.isDebuggerFrame();
-};
-
-
-FrameMirror.prototype.isOptimizedFrame = function() {
-  return this.details_.isOptimizedFrame();
-};
-
-
-FrameMirror.prototype.isInlinedFrame = function() {
-  return this.details_.isInlinedFrame();
-};
-
-
-FrameMirror.prototype.inlinedFrameIndex = function() {
-  return this.details_.inlinedFrameIndex();
-};
-
-
-FrameMirror.prototype.argumentCount = function() {
-  return this.details_.argumentCount();
-};
-
-
-FrameMirror.prototype.argumentName = function(index) {
-  return this.details_.argumentName(index);
-};
-
-
-FrameMirror.prototype.argumentValue = function(index) {
-  return MakeMirror(this.details_.argumentValue(index));
-};
-
-
-FrameMirror.prototype.localCount = function() {
-  return this.details_.localCount();
-};
-
-
-FrameMirror.prototype.localName = function(index) {
-  return this.details_.localName(index);
-};
-
-
-FrameMirror.prototype.localValue = function(index) {
-  return MakeMirror(this.details_.localValue(index));
-};
-
-
-FrameMirror.prototype.returnValue = function() {
-  return MakeMirror(this.details_.returnValue());
-};
-
-
-FrameMirror.prototype.sourcePosition = function() {
-  return this.details_.sourcePosition();
-};
-
-
-FrameMirror.prototype.sourceLocation = function() {
-  var script = this.script();
-  if (script) {
-    return script.locationFromPosition(this.sourcePosition(), true);
-  }
-};
-
-
-FrameMirror.prototype.sourceLine = function() {
-  var location = this.sourceLocation();
-  if (location) {
-    return location.line;
-  }
-};
-
-
-FrameMirror.prototype.sourceColumn = function() {
-  var location = this.sourceLocation();
-  if (location) {
-    return location.column;
-  }
-};
-
-
-FrameMirror.prototype.sourceLineText = function() {
-  var location = this.sourceLocation();
-  if (location) {
-    return location.sourceText;
-  }
-};
-
-
-FrameMirror.prototype.scopeCount = function() {
-  return this.details_.scopeCount();
-};
-
-
-FrameMirror.prototype.scope = function(index) {
-  return new ScopeMirror(this, UNDEFINED, UNDEFINED, index);
-};
-
-
-FrameMirror.prototype.allScopes = function(opt_ignore_nested_scopes) {
-  var scopeDetails = %GetAllScopesDetails(this.break_id_,
-                                          this.details_.frameId(),
-                                          this.details_.inlinedFrameIndex(),
-                                          !!opt_ignore_nested_scopes);
-  var result = [];
-  for (var i = 0; i < scopeDetails.length; ++i) {
-    result.push(new ScopeMirror(this, UNDEFINED, UNDEFINED, i,
-                                scopeDetails[i]));
-  }
-  return result;
-};
-
-
-FrameMirror.prototype.evaluate = function(source, throw_on_side_effect = false) {
-  return MakeMirror(%DebugEvaluate(this.break_id_,
-                                   this.details_.frameId(),
-                                   this.details_.inlinedFrameIndex(),
-                                   source,
-                                   throw_on_side_effect));
-};
-
-
-FrameMirror.prototype.invocationText = function() {
-  // Format frame invoaction (receiver, function and arguments).
-  var result = '';
-  var func = this.func();
-  var receiver = this.receiver();
-  if (this.isConstructCall()) {
-    // For constructor frames display new followed by the function name.
-    result += 'new ';
-    result += func.name() ? func.name() : '[anonymous]';
-  } else if (this.isDebuggerFrame()) {
-    result += '[debugger]';
-  } else {
-    // If the receiver has a className which is 'global' don't display it.
-    var display_receiver =
-      !receiver.className || (receiver.className() != 'global');
-    if (display_receiver) {
-      result += receiver.toText();
-    }
-    // Try to find the function as a property in the receiver. Include the
-    // prototype chain in the lookup.
-    var property = GetUndefinedMirror();
-    if (receiver.isObject()) {
-      for (var r = receiver;
-           !r.isNull() && property.isUndefined();
-           r = r.protoObject()) {
-        property = r.lookupProperty(func);
-      }
-    }
-    if (!property.isUndefined()) {
-      // The function invoked was found on the receiver. Use the property name
-      // for the backtrace.
-      if (!property.isIndexed()) {
-        if (display_receiver) {
-          result += '.';
-        }
-        result += property.toText();
-      } else {
-        result += '[';
-        result += property.toText();
-        result += ']';
-      }
-      // Also known as - if the name in the function doesn't match the name
-      // under which it was looked up.
-      if (func.name() && func.name() != property.name()) {
-        result += '(aka ' + func.name() + ')';
-      }
-    } else {
-      // The function invoked was not found on the receiver. Use the function
-      // name if available for the backtrace.
-      if (display_receiver) {
-        result += '.';
-      }
-      result += func.name() ? func.name() : '[anonymous]';
-    }
-  }
-
-  // Render arguments for normal frames.
-  if (!this.isDebuggerFrame()) {
-    result += '(';
-    for (var i = 0; i < this.argumentCount(); i++) {
-      if (i != 0) result += ', ';
-      if (this.argumentName(i)) {
-        result += this.argumentName(i);
-        result += '=';
-      }
-      result += this.argumentValue(i).toText();
-    }
-    result += ')';
-  }
-
-  if (this.isAtReturn()) {
-    result += ' returning ';
-    result += this.returnValue().toText();
-  }
-
-  return result;
-};
-
-
-FrameMirror.prototype.sourceAndPositionText = function() {
-  // Format source and position.
-  var result = '';
-  var func = this.func();
-  if (func.resolved()) {
-    var script = func.script();
-    if (script) {
-      if (script.name()) {
-        result += script.name();
-      } else {
-        result += '[unnamed]';
-      }
-      if (!this.isDebuggerFrame()) {
-        var location = this.sourceLocation();
-        result += ' line ';
-        result += !IS_UNDEFINED(location) ? (location.line + 1) : '?';
-        result += ' column ';
-        result += !IS_UNDEFINED(location) ? (location.column + 1) : '?';
-        if (!IS_UNDEFINED(this.sourcePosition())) {
-          result += ' (position ' + (this.sourcePosition() + 1) + ')';
-        }
-      }
-    } else {
-      result += '[no source]';
-    }
-  } else {
-    result += '[unresolved]';
-  }
-
-  return result;
-};
-
-
-FrameMirror.prototype.localsText = function() {
-  // Format local variables.
-  var result = '';
-  var locals_count = this.localCount();
-  if (locals_count > 0) {
-    for (var i = 0; i < locals_count; ++i) {
-      result += '      var ';
-      result += this.localName(i);
-      result += ' = ';
-      result += this.localValue(i).toText();
-      if (i < locals_count - 1) result += '\n';
-    }
-  }
-
-  return result;
-};
-
-
-FrameMirror.prototype.restart = function() {
-  var result = %LiveEditRestartFrame(this.break_id_, this.index_);
-  if (IS_UNDEFINED(result)) {
-    result = "Failed to find requested frame";
-  }
-  return result;
-};
-
-
-FrameMirror.prototype.toText = function(opt_locals) {
-  var result = '';
-  result += '#' + (this.index() <= 9 ? '0' : '') + this.index();
-  result += ' ';
-  result += this.invocationText();
-  result += ' ';
-  result += this.sourceAndPositionText();
-  if (opt_locals) {
-    result += '\n';
-    result += this.localsText();
-  }
-  return result;
-};
-
-
-// This indexes correspond definitions in debug-scopes.h.
-var kScopeDetailsTypeIndex = 0;
-var kScopeDetailsObjectIndex = 1;
-var kScopeDetailsNameIndex = 2;
-var kScopeDetailsStartPositionIndex = 3;
-var kScopeDetailsEndPositionIndex = 4;
-var kScopeDetailsFunctionIndex = 5;
-
-function ScopeDetails(frame, fun, gen, index, opt_details) {
-  if (frame) {
-    this.break_id_ = frame.break_id_;
-    this.details_ = opt_details ||
-                    %GetScopeDetails(frame.break_id_,
-                                     frame.details_.frameId(),
-                                     frame.details_.inlinedFrameIndex(),
-                                     index);
-    this.frame_id_ = frame.details_.frameId();
-    this.inlined_frame_id_ = frame.details_.inlinedFrameIndex();
-  } else if (fun) {
-    this.details_ = opt_details || %GetFunctionScopeDetails(fun.value(), index);
-    this.fun_value_ = fun.value();
-    this.break_id_ = UNDEFINED;
-  } else {
-    this.details_ =
-      opt_details || %GetGeneratorScopeDetails(gen.value(), index);
-    this.gen_value_ = gen.value();
-    this.break_id_ = UNDEFINED;
-  }
-  this.index_ = index;
-}
-
-
-ScopeDetails.prototype.type = function() {
-  if (!IS_UNDEFINED(this.break_id_)) {
-    %CheckExecutionState(this.break_id_);
-  }
-  return this.details_[kScopeDetailsTypeIndex];
-};
-
-
-ScopeDetails.prototype.object = function() {
-  if (!IS_UNDEFINED(this.break_id_)) {
-    %CheckExecutionState(this.break_id_);
-  }
-  return this.details_[kScopeDetailsObjectIndex];
-};
-
-
-ScopeDetails.prototype.name = function() {
-  if (!IS_UNDEFINED(this.break_id_)) {
-    %CheckExecutionState(this.break_id_);
-  }
-  return this.details_[kScopeDetailsNameIndex];
-};
-
-
-ScopeDetails.prototype.startPosition = function() {
-  if (!IS_UNDEFINED(this.break_id_)) {
-    %CheckExecutionState(this.break_id_);
-  }
-  return this.details_[kScopeDetailsStartPositionIndex];
-}
-
-
-ScopeDetails.prototype.endPosition = function() {
-  if (!IS_UNDEFINED(this.break_id_)) {
-    %CheckExecutionState(this.break_id_);
-  }
-  return this.details_[kScopeDetailsEndPositionIndex];
-}
-
-ScopeDetails.prototype.func = function() {
-  if (!IS_UNDEFINED(this.break_id_)) {
-    %CheckExecutionState(this.break_id_);
-  }
-  return this.details_[kScopeDetailsFunctionIndex];
-}
-
-
-ScopeDetails.prototype.setVariableValueImpl = function(name, new_value) {
-  var raw_res;
-  if (!IS_UNDEFINED(this.break_id_)) {
-    %CheckExecutionState(this.break_id_);
-    raw_res = %SetScopeVariableValue(this.break_id_, this.frame_id_,
-        this.inlined_frame_id_, this.index_, name, new_value);
-  } else if (!IS_UNDEFINED(this.fun_value_)) {
-    raw_res = %SetScopeVariableValue(this.fun_value_, null, null, this.index_,
-        name, new_value);
-  } else {
-    raw_res = %SetScopeVariableValue(this.gen_value_, null, null, this.index_,
-        name, new_value);
-  }
-  if (!raw_res) throw %make_error(kDebugger, "Failed to set variable value");
-};
-
-
-/**
- * Mirror object for scope of frame or function. Either frame or function must
- * be specified.
- * @param {FrameMirror} frame The frame this scope is a part of
- * @param {FunctionMirror} function The function this scope is a part of
- * @param {GeneratorMirror} gen The generator this scope is a part of
- * @param {number} index The scope index in the frame
- * @param {Array=} opt_details Raw scope details data
- * @constructor
- * @extends Mirror
- */
-function ScopeMirror(frame, fun, gen, index, opt_details) {
-  %_Call(Mirror, this, MirrorType.SCOPE_TYPE);
-  if (frame) {
-    this.frame_index_ = frame.index_;
-  } else {
-    this.frame_index_ = UNDEFINED;
-  }
-  this.scope_index_ = index;
-  this.details_ = new ScopeDetails(frame, fun, gen, index, opt_details);
-}
-inherits(ScopeMirror, Mirror);
-
-
-ScopeMirror.prototype.details = function() {
-  return this.details_;
-};
-
-
-ScopeMirror.prototype.frameIndex = function() {
-  return this.frame_index_;
-};
-
-
-ScopeMirror.prototype.scopeIndex = function() {
-  return this.scope_index_;
-};
-
-
-ScopeMirror.prototype.scopeType = function() {
-  return this.details_.type();
-};
-
-
-ScopeMirror.prototype.scopeObject = function() {
-  // For local, closure and script scopes create a mirror
-  // as these objects are created on the fly materializing the local
-  // or closure scopes and therefore will not preserve identity.
-  return MakeMirror(this.details_.object());
-};
-
-
-ScopeMirror.prototype.setVariableValue = function(name, new_value) {
-  this.details_.setVariableValueImpl(name, new_value);
-};
-
-
-/**
- * Mirror object for script source.
- * @param {Script} script The script object
- * @constructor
- * @extends Mirror
- */
-function ScriptMirror(script) {
-  %_Call(Mirror, this, MirrorType.SCRIPT_TYPE);
-  this.script_ = script;
-  this.context_ = new ContextMirror(script.context_data);
-}
-inherits(ScriptMirror, Mirror);
-
-
-ScriptMirror.prototype.value = function() {
-  return this.script_;
-};
-
-
-ScriptMirror.prototype.name = function() {
-  return this.script_.name || this.script_.source_url;
-};
-
-
-ScriptMirror.prototype.id = function() {
-  return this.script_.id;
-};
-
-
-ScriptMirror.prototype.source = function() {
-  return this.script_.source;
-};
-
-
-ScriptMirror.prototype.setSource = function(source) {
-  if (!IS_STRING(source)) throw %make_error(kDebugger, "Source is not a string");
-  %DebugSetScriptSource(this.script_, source);
-};
-
-
-ScriptMirror.prototype.lineOffset = function() {
-  return this.script_.line_offset;
-};
-
-
-ScriptMirror.prototype.columnOffset = function() {
-  return this.script_.column_offset;
-};
-
-
-ScriptMirror.prototype.data = function() {
-  return this.script_.data;
-};
-
-
-ScriptMirror.prototype.scriptType = function() {
-  return this.script_.type;
-};
-
-
-ScriptMirror.prototype.compilationType = function() {
-  return this.script_.compilation_type;
-};
-
-
-ScriptMirror.prototype.lineCount = function() {
-  return %ScriptLineCount(this.script_);
-};
-
-
-ScriptMirror.prototype.locationFromPosition = function(
-    position, include_resource_offset) {
-  return %ScriptPositionInfo(this.script_, position, !!include_resource_offset);
-};
-
-
-ScriptMirror.prototype.context = function() {
-  return this.context_;
-};
-
-
-ScriptMirror.prototype.evalFromScript = function() {
-  return MakeMirror(this.script_.eval_from_script);
-};
-
-
-ScriptMirror.prototype.evalFromFunctionName = function() {
-  return MakeMirror(this.script_.eval_from_function_name);
-};
-
-
-ScriptMirror.prototype.evalFromLocation = function() {
-  var eval_from_script = this.evalFromScript();
-  if (!eval_from_script.isUndefined()) {
-    var position = this.script_.eval_from_script_position;
-    return eval_from_script.locationFromPosition(position, true);
-  }
-};
-
-
-ScriptMirror.prototype.toText = function() {
-  var result = '';
-  result += this.name();
-  result += ' (lines: ';
-  if (this.lineOffset() > 0) {
-    result += this.lineOffset();
-    result += '-';
-    result += this.lineOffset() + this.lineCount() - 1;
-  } else {
-    result += this.lineCount();
-  }
-  result += ')';
-  return result;
-};
-
-
-/**
- * Mirror object for context.
- * @param {Object} data The context data
- * @constructor
- * @extends Mirror
- */
-function ContextMirror(data) {
-  %_Call(Mirror, this, MirrorType.CONTEXT_TYPE);
-  this.data_ = data;
-}
-inherits(ContextMirror, Mirror);
-
-
-ContextMirror.prototype.data = function() {
-  return this.data_;
-};
-
-// ----------------------------------------------------------------------------
-// Exports
-
-utils.InstallConstants(global, [
-  "MakeMirror", MakeMirror,
-  "ScopeType", ScopeType,
-  "PropertyType", PropertyType,
-  "PropertyAttribute", PropertyAttribute,
-  "Mirror", Mirror,
-  "ValueMirror", ValueMirror,
-  "UndefinedMirror", UndefinedMirror,
-  "NullMirror", NullMirror,
-  "BooleanMirror", BooleanMirror,
-  "NumberMirror", NumberMirror,
-  "StringMirror", StringMirror,
-  "SymbolMirror", SymbolMirror,
-  "ObjectMirror", ObjectMirror,
-  "FunctionMirror", FunctionMirror,
-  "UnresolvedFunctionMirror", UnresolvedFunctionMirror,
-  "ArrayMirror", ArrayMirror,
-  "DateMirror", DateMirror,
-  "RegExpMirror", RegExpMirror,
-  "ErrorMirror", ErrorMirror,
-  "PromiseMirror", PromiseMirror,
-  "MapMirror", MapMirror,
-  "SetMirror", SetMirror,
-  "IteratorMirror", IteratorMirror,
-  "GeneratorMirror", GeneratorMirror,
-  "PropertyMirror", PropertyMirror,
-  "InternalPropertyMirror", InternalPropertyMirror,
-  "FrameMirror", FrameMirror,
-  "ScriptMirror", ScriptMirror,
-  "ScopeMirror", ScopeMirror,
-  "FrameDetails", FrameDetails,
-]);
-
-})
diff --git a/deps/v8/src/debug/ppc/debug-ppc.cc b/deps/v8/src/debug/ppc/debug-ppc.cc
index 047f76a1deaf10..4a6d0a67d52e81 100644
--- a/deps/v8/src/debug/ppc/debug-ppc.cc
+++ b/deps/v8/src/debug/ppc/debug-ppc.cc
@@ -37,8 +37,8 @@ void DebugCodegen::GenerateFrameDropperTrampoline(MacroAssembler* masm) {
   __ LoadP(r4, MemOperand(fp, JavaScriptFrameConstants::kFunctionOffset));
   __ LeaveFrame(StackFrame::INTERNAL);
   __ LoadP(r3, FieldMemOperand(r4, JSFunction::kSharedFunctionInfoOffset));
-  __ LoadP(
-      r3, FieldMemOperand(r3, SharedFunctionInfo::kFormalParameterCountOffset));
+  __ lhz(r3,
+         FieldMemOperand(r3, SharedFunctionInfo::kFormalParameterCountOffset));
   __ mr(r5, r3);
 
   ParameterCount dummy1(r5);
diff --git a/deps/v8/src/debug/s390/debug-s390.cc b/deps/v8/src/debug/s390/debug-s390.cc
index 2fdbcc8fd0c520..f7aabe39b645f5 100644
--- a/deps/v8/src/debug/s390/debug-s390.cc
+++ b/deps/v8/src/debug/s390/debug-s390.cc
@@ -39,7 +39,7 @@ void DebugCodegen::GenerateFrameDropperTrampoline(MacroAssembler* masm) {
   __ LoadP(r3, MemOperand(fp, JavaScriptFrameConstants::kFunctionOffset));
   __ LeaveFrame(StackFrame::INTERNAL);
   __ LoadP(r2, FieldMemOperand(r3, JSFunction::kSharedFunctionInfoOffset));
-  __ LoadP(
+  __ LoadLogicalHalfWordP(
       r2, FieldMemOperand(r2, SharedFunctionInfo::kFormalParameterCountOffset));
   __ LoadRR(r4, r2);
 
diff --git a/deps/v8/src/debug/x64/debug-x64.cc b/deps/v8/src/debug/x64/debug-x64.cc
index 337fec3515bd1d..6667a5f3a74e8f 100644
--- a/deps/v8/src/debug/x64/debug-x64.cc
+++ b/deps/v8/src/debug/x64/debug-x64.cc
@@ -39,7 +39,7 @@ void DebugCodegen::GenerateFrameDropperTrampoline(MacroAssembler* masm) {
   __ leave();
 
   __ movp(rbx, FieldOperand(rdi, JSFunction::kSharedFunctionInfoOffset));
-  __ movsxlq(
+  __ movzxwq(
       rbx, FieldOperand(rbx, SharedFunctionInfo::kFormalParameterCountOffset));
 
   ParameterCount dummy(rbx);
diff --git a/deps/v8/src/deoptimizer.cc b/deps/v8/src/deoptimizer.cc
index 853223489adcf5..8106abea60dbeb 100644
--- a/deps/v8/src/deoptimizer.cc
+++ b/deps/v8/src/deoptimizer.cc
@@ -25,30 +25,142 @@
 namespace v8 {
 namespace internal {
 
+// {FrameWriter} offers a stack writer abstraction for writing
+// FrameDescriptions. The main service the class provides is managing
+// {top_offset_}, i.e. the offset of the next slot to write to.
+class FrameWriter {
+ public:
+  static const int NO_INPUT_INDEX = -1;
+  FrameWriter(Deoptimizer* deoptimizer, FrameDescription* frame,
+              CodeTracer::Scope* trace_scope)
+      : deoptimizer_(deoptimizer),
+        frame_(frame),
+        trace_scope_(trace_scope),
+        top_offset_(frame->GetFrameSize()) {}
+
+  void PushRawValue(intptr_t value, const char* debug_hint) {
+    PushValue(value);
+
+    if (trace_scope_ != nullptr) {
+      DebugPrintOutputValue(value, debug_hint);
+    }
+  }
+
+  void PushRawObject(Object* obj, const char* debug_hint) {
+    intptr_t value = reinterpret_cast<intptr_t>(obj);
+    PushValue(value);
+    if (trace_scope_ != nullptr) {
+      DebugPrintOutputObject(obj, top_offset_, debug_hint);
+    }
+  }
+
+  void PushCallerPc(intptr_t pc) {
+    top_offset_ -= kPCOnStackSize;
+    frame_->SetCallerPc(top_offset_, pc);
+    DebugPrintOutputValue(pc, "caller's pc\n");
+  }
+
+  void PushCallerFp(intptr_t fp) {
+    top_offset_ -= kFPOnStackSize;
+    frame_->SetCallerFp(top_offset_, fp);
+    DebugPrintOutputValue(fp, "caller's fp\n");
+  }
+
+  void PushCallerConstantPool(intptr_t cp) {
+    top_offset_ -= kPointerSize;
+    frame_->SetCallerConstantPool(top_offset_, cp);
+    DebugPrintOutputValue(cp, "caller's constant_pool\n");
+  }
+
+  void PushTranslatedValue(const TranslatedFrame::iterator& iterator,
+                           const char* debug_hint = "") {
+    Object* obj = iterator->GetRawValue();
+
+    PushRawObject(obj, debug_hint);
+
+    if (trace_scope_) {
+      PrintF(trace_scope_->file(), " (input #%d)\n", iterator.input_index());
+    }
+
+    deoptimizer_->QueueValueForMaterialization(output_address(top_offset_), obj,
+                                               iterator);
+  }
+
+  unsigned top_offset() const { return top_offset_; }
+
+ private:
+  void PushValue(intptr_t value) {
+    CHECK_GE(top_offset_, 0);
+    top_offset_ -= kPointerSize;
+    frame_->SetFrameSlot(top_offset_, value);
+  }
+
+  Address output_address(unsigned output_offset) {
+    Address output_address =
+        static_cast<Address>(frame_->GetTop()) + output_offset;
+    return output_address;
+  }
+
+  void DebugPrintOutputValue(intptr_t value, const char* debug_hint = "") {
+    if (trace_scope_ != nullptr) {
+      PrintF(trace_scope_->file(),
+             "    " V8PRIxPTR_FMT ": [top + %3d] <- " V8PRIxPTR_FMT " ;  %s",
+             output_address(top_offset_), top_offset_, value, debug_hint);
+    }
+  }
+
+  void DebugPrintOutputObject(Object* obj, unsigned output_offset,
+                              const char* debug_hint = "") {
+    if (trace_scope_ != nullptr) {
+      PrintF(trace_scope_->file(), "    " V8PRIxPTR_FMT ": [top + %3d] <- ",
+             output_address(output_offset), output_offset);
+      if (obj->IsSmi()) {
+        PrintF(V8PRIxPTR_FMT " <Smi %d>", reinterpret_cast<Address>(obj),
+               Smi::cast(obj)->value());
+      } else {
+        obj->ShortPrint(trace_scope_->file());
+      }
+      PrintF(trace_scope_->file(), " ;  %s", debug_hint);
+    }
+  }
+
+  Deoptimizer* deoptimizer_;
+  FrameDescription* frame_;
+  CodeTracer::Scope* trace_scope_;
+  unsigned top_offset_;
+};
+
 DeoptimizerData::DeoptimizerData(Heap* heap) : heap_(heap), current_(nullptr) {
-  for (int i = 0; i <= Deoptimizer::kLastBailoutType; ++i) {
+  for (int i = 0; i <= DeoptimizerData::kLastDeoptimizeKind; ++i) {
     deopt_entry_code_[i] = nullptr;
   }
   Code** start = &deopt_entry_code_[0];
-  Code** end = &deopt_entry_code_[Deoptimizer::kLastBailoutType + 1];
+  Code** end = &deopt_entry_code_[DeoptimizerData::kLastDeoptimizeKind + 1];
   heap_->RegisterStrongRoots(reinterpret_cast<Object**>(start),
                              reinterpret_cast<Object**>(end));
 }
 
 
 DeoptimizerData::~DeoptimizerData() {
-  for (int i = 0; i <= Deoptimizer::kLastBailoutType; ++i) {
+  for (int i = 0; i <= DeoptimizerData::kLastDeoptimizeKind; ++i) {
     deopt_entry_code_[i] = nullptr;
   }
   Code** start = &deopt_entry_code_[0];
   heap_->UnregisterStrongRoots(reinterpret_cast<Object**>(start));
 }
 
+Code* DeoptimizerData::deopt_entry_code(DeoptimizeKind kind) {
+  return deopt_entry_code_[static_cast<int>(kind)];
+}
+
+void DeoptimizerData::set_deopt_entry_code(DeoptimizeKind kind, Code* code) {
+  deopt_entry_code_[static_cast<int>(kind)] = code;
+}
 
 Code* Deoptimizer::FindDeoptimizingCode(Address addr) {
   if (function_->IsHeapObject()) {
     // Search all deoptimizing code in the native context of the function.
-    Isolate* isolate = function_->GetIsolate();
+    Isolate* isolate = isolate_;
     Context* native_context = function_->context()->native_context();
     Object* element = native_context->DeoptimizedCodeListHead();
     while (!element->IsUndefined(isolate)) {
@@ -64,13 +176,10 @@ Code* Deoptimizer::FindDeoptimizingCode(Address addr) {
 
 // We rely on this function not causing a GC.  It is called from generated code
 // without having a real stack frame in place.
-Deoptimizer* Deoptimizer::New(JSFunction* function,
-                              BailoutType type,
-                              unsigned bailout_id,
-                              Address from,
-                              int fp_to_sp_delta,
-                              Isolate* isolate) {
-  Deoptimizer* deoptimizer = new Deoptimizer(isolate, function, type,
+Deoptimizer* Deoptimizer::New(JSFunction* function, DeoptimizeKind kind,
+                              unsigned bailout_id, Address from,
+                              int fp_to_sp_delta, Isolate* isolate) {
+  Deoptimizer* deoptimizer = new Deoptimizer(isolate, function, kind,
                                              bailout_id, from, fp_to_sp_delta);
   CHECK_NULL(isolate->deoptimizer_data()->current_);
   isolate->deoptimizer_data()->current_ = deoptimizer;
@@ -121,10 +230,10 @@ DeoptimizedFrameInfo* Deoptimizer::DebuggerInspectableFrame(
   return info;
 }
 
-void Deoptimizer::GenerateDeoptimizationEntries(MacroAssembler* masm,
-                                                int count,
-                                                BailoutType type) {
-  TableEntryGenerator generator(masm, type, count);
+void Deoptimizer::GenerateDeoptimizationEntries(MacroAssembler* masm, int count,
+                                                DeoptimizeKind kind) {
+  NoRootArrayScope no_root_array(masm);
+  TableEntryGenerator generator(masm, kind, count);
   generator.Generate();
 }
 
@@ -351,41 +460,26 @@ void Deoptimizer::ComputeOutputFrames(Deoptimizer* deoptimizer) {
   deoptimizer->DoComputeOutputFrames();
 }
 
-
-const char* Deoptimizer::MessageFor(BailoutType type) {
-  switch (type) {
-    case EAGER: return "eager";
-    case SOFT: return "soft";
-    case LAZY: return "lazy";
+const char* Deoptimizer::MessageFor(DeoptimizeKind kind) {
+  switch (kind) {
+    case DeoptimizeKind::kEager:
+      return "eager";
+    case DeoptimizeKind::kSoft:
+      return "soft";
+    case DeoptimizeKind::kLazy:
+      return "lazy";
   }
-  FATAL("Unsupported deopt type");
+  FATAL("Unsupported deopt kind");
   return nullptr;
 }
 
-namespace {
-
-CodeEventListener::DeoptKind DeoptKindOfBailoutType(
-    Deoptimizer::BailoutType bailout_type) {
-  switch (bailout_type) {
-    case Deoptimizer::EAGER:
-      return CodeEventListener::kEager;
-    case Deoptimizer::SOFT:
-      return CodeEventListener::kSoft;
-    case Deoptimizer::LAZY:
-      return CodeEventListener::kLazy;
-  }
-  UNREACHABLE();
-}
-
-}  // namespace
-
 Deoptimizer::Deoptimizer(Isolate* isolate, JSFunction* function,
-                         BailoutType type, unsigned bailout_id, Address from,
+                         DeoptimizeKind kind, unsigned bailout_id, Address from,
                          int fp_to_sp_delta)
     : isolate_(isolate),
       function_(function),
       bailout_id_(bailout_id),
-      bailout_type_(type),
+      deopt_kind_(kind),
       from_(from),
       fp_to_sp_delta_(fp_to_sp_delta),
       deoptimizing_throw_(false),
@@ -407,7 +501,7 @@ Deoptimizer::Deoptimizer(Isolate* isolate, JSFunction* function,
     deoptimizing_throw_ = true;
   }
 
-  DCHECK_NOT_NULL(from);
+  DCHECK_NE(from, kNullAddress);
   compiled_code_ = FindOptimizedCode();
   DCHECK_NOT_NULL(compiled_code_);
 
@@ -425,7 +519,7 @@ Deoptimizer::Deoptimizer(Isolate* isolate, JSFunction* function,
     // increment the function's deopt count so that we can avoid optimising
     // functions that deopt too often.
 
-    if (bailout_type_ == Deoptimizer::SOFT) {
+    if (deopt_kind_ == DeoptimizeKind::kSoft) {
       // Soft deopts shouldn't count against the overall deoptimization count
       // that can eventually lead to disabling optimization for a function.
       isolate->counters()->soft_deopts_executed()->Increment();
@@ -436,8 +530,7 @@ Deoptimizer::Deoptimizer(Isolate* isolate, JSFunction* function,
   if (compiled_code_->kind() == Code::OPTIMIZED_FUNCTION) {
     compiled_code_->set_deopt_already_counted(true);
     PROFILE(isolate_,
-            CodeDeoptEvent(compiled_code_, DeoptKindOfBailoutType(type), from_,
-                           fp_to_sp_delta_));
+            CodeDeoptEvent(compiled_code_, kind, from_, fp_to_sp_delta_));
   }
   unsigned size = ComputeInputFrameSize();
   int parameter_count =
@@ -463,10 +556,10 @@ void Deoptimizer::PrintFunctionName() {
 }
 
 Handle<JSFunction> Deoptimizer::function() const {
-  return Handle<JSFunction>(function_);
+  return Handle<JSFunction>(function_, isolate());
 }
 Handle<Code> Deoptimizer::compiled_code() const {
-  return Handle<Code>(compiled_code_);
+  return Handle<Code>(compiled_code_, isolate());
 }
 
 Deoptimizer::~Deoptimizer() {
@@ -493,34 +586,56 @@ void Deoptimizer::DeleteFrameDescriptions() {
 }
 
 Address Deoptimizer::GetDeoptimizationEntry(Isolate* isolate, int id,
-                                            BailoutType type) {
+                                            DeoptimizeKind kind) {
   CHECK_GE(id, 0);
-  if (id >= kMaxNumberOfEntries) return nullptr;
+  if (id >= kMaxNumberOfEntries) return kNullAddress;
   DeoptimizerData* data = isolate->deoptimizer_data();
-  CHECK_LE(type, kLastBailoutType);
-  CHECK_NOT_NULL(data->deopt_entry_code_[type]);
-  Code* code = data->deopt_entry_code_[type];
+  CHECK_LE(kind, DeoptimizerData::kLastDeoptimizeKind);
+  CHECK_NOT_NULL(data->deopt_entry_code(kind));
+  Code* code = data->deopt_entry_code(kind);
   return code->raw_instruction_start() + (id * table_entry_size_);
 }
 
-
-int Deoptimizer::GetDeoptimizationId(Isolate* isolate,
-                                     Address addr,
-                                     BailoutType type) {
+int Deoptimizer::GetDeoptimizationId(Isolate* isolate, Address addr,
+                                     DeoptimizeKind kind) {
   DeoptimizerData* data = isolate->deoptimizer_data();
-  CHECK_LE(type, kLastBailoutType);
-  Code* code = data->deopt_entry_code_[type];
-  if (code == nullptr) return kNotDeoptimizationEntry;
+  CHECK_LE(kind, DeoptimizerData::kLastDeoptimizeKind);
+  DCHECK(IsInDeoptimizationTable(isolate, addr, kind));
+  Code* code = data->deopt_entry_code(kind);
   Address start = code->raw_instruction_start();
-  if (addr < start ||
-      addr >= start + (kMaxNumberOfEntries * table_entry_size_)) {
-    return kNotDeoptimizationEntry;
-  }
   DCHECK_EQ(0,
             static_cast<int>(addr - start) % table_entry_size_);
   return static_cast<int>(addr - start) / table_entry_size_;
 }
 
+bool Deoptimizer::IsInDeoptimizationTable(Isolate* isolate, Address addr,
+                                          DeoptimizeKind type) {
+  DeoptimizerData* data = isolate->deoptimizer_data();
+  CHECK_LE(type, DeoptimizerData::kLastDeoptimizeKind);
+  Code* code = data->deopt_entry_code(type);
+  if (code == nullptr) return false;
+  Address start = code->raw_instruction_start();
+  return ((table_entry_size_ == 0 && addr == start) ||
+          (addr >= start &&
+           addr < start + (kMaxNumberOfEntries * table_entry_size_)));
+}
+
+bool Deoptimizer::IsDeoptimizationEntry(Isolate* isolate, Address addr,
+                                        DeoptimizeKind* type) {
+  if (IsInDeoptimizationTable(isolate, addr, DeoptimizeKind::kEager)) {
+    *type = DeoptimizeKind::kEager;
+    return true;
+  }
+  if (IsInDeoptimizationTable(isolate, addr, DeoptimizeKind::kSoft)) {
+    *type = DeoptimizeKind::kSoft;
+    return true;
+  }
+  if (IsInDeoptimizationTable(isolate, addr, DeoptimizeKind::kLazy)) {
+    *type = DeoptimizeKind::kLazy;
+    return true;
+  }
+  return false;
+}
 
 int Deoptimizer::GetDeoptimizedCodeCount(Isolate* isolate) {
   int length = 0;
@@ -602,14 +717,15 @@ void Deoptimizer::DoComputeOutputFrames() {
   if (trace_scope_ != nullptr) {
     timer.Start();
     PrintF(trace_scope_->file(), "[deoptimizing (DEOPT %s): begin ",
-           MessageFor(bailout_type_));
+           MessageFor(deopt_kind_));
     PrintFunctionName();
     PrintF(trace_scope_->file(),
-           " (opt #%d) @%d, FP to SP delta: %d, caller sp: 0x%08" V8PRIxPTR
+           " (opt #%d) @%d, FP to SP delta: %d, caller sp: " V8PRIxPTR_FMT
            "]\n",
            input_data->OptimizationId()->value(), bailout_id_, fp_to_sp_delta_,
            caller_frame_top_);
-    if (bailout_type_ == EAGER || bailout_type_ == SOFT) {
+    if (deopt_kind_ == DeoptimizeKind::kEager ||
+        deopt_kind_ == DeoptimizeKind::kSoft) {
       compiled_code_->PrintDeoptLocation(
           trace_scope_->file(), "            ;;; deoptimize at ", from_);
     }
@@ -622,7 +738,7 @@ void Deoptimizer::DoComputeOutputFrames() {
 
   TranslationIterator state_iterator(translations, translation_index);
   translated_state_.Init(
-      input_->GetFramePointerAddress(), &state_iterator,
+      isolate_, input_->GetFramePointerAddress(), &state_iterator,
       input_data->LiteralArray(), input_->GetRegisterValues(),
       trace_scope_ == nullptr ? nullptr : trace_scope_->file(),
       function_->IsHeapObject()
@@ -698,10 +814,10 @@ void Deoptimizer::DoComputeOutputFrames() {
     double ms = timer.Elapsed().InMillisecondsF();
     int index = output_count_ - 1;  // Index of the topmost frame.
     PrintF(trace_scope_->file(), "[deoptimizing (%s): end ",
-           MessageFor(bailout_type_));
+           MessageFor(deopt_kind_));
     PrintFunctionName();
     PrintF(trace_scope_->file(),
-           " @%d => node=%d, pc=0x%08" V8PRIxPTR ", caller sp=0x%08" V8PRIxPTR
+           " @%d => node=%d, pc=" V8PRIxPTR_FMT ", caller sp=" V8PRIxPTR_FMT
            ", took %0.3f ms]\n",
            bailout_id_, node_id.ToInt(), output_[index]->GetPc(),
            caller_frame_top_, ms);
@@ -716,7 +832,6 @@ void Deoptimizer::DoComputeInterpretedFrame(TranslatedFrame* translated_frame,
   TranslatedFrame::iterator value_iterator = translated_frame->begin();
   bool is_bottommost = (0 == frame_index);
   bool is_topmost = (output_count_ - 1 == frame_index);
-  int input_index = 0;
 
   int bytecode_offset = translated_frame->node_id().ToInt();
   int height = translated_frame->height();
@@ -731,10 +846,7 @@ void Deoptimizer::DoComputeInterpretedFrame(TranslatedFrame* translated_frame,
     if (PadTopOfStackRegister()) height_in_bytes += kPointerSize;
   }
 
-  TranslatedFrame::iterator function_iterator = value_iterator;
-  Object* function = value_iterator->GetRawValue();
-  value_iterator++;
-  input_index++;
+  TranslatedFrame::iterator function_iterator = value_iterator++;
   if (trace_scope_ != nullptr) {
     PrintF(trace_scope_->file(), "  translating interpreted frame ");
     std::unique_ptr<char[]> name = shared->DebugName()->ToCString();
@@ -757,6 +869,7 @@ void Deoptimizer::DoComputeInterpretedFrame(TranslatedFrame* translated_frame,
   int parameter_count = shared->internal_formal_parameter_count() + 1;
   FrameDescription* output_frame = new (output_frame_size)
       FrameDescription(output_frame_size, parameter_count);
+  FrameWriter frame_writer(this, output_frame, trace_scope_);
 
   CHECK(frame_index >= 0 && frame_index < output_count_);
   CHECK_NULL(output_[frame_index]);
@@ -773,21 +886,18 @@ void Deoptimizer::DoComputeInterpretedFrame(TranslatedFrame* translated_frame,
   output_frame->SetTop(top_address);
 
   // Compute the incoming parameter translation.
-  unsigned output_offset = output_frame_size;
 
+  ReadOnlyRoots roots(isolate());
   if (ShouldPadArguments(parameter_count)) {
-    output_offset -= kPointerSize;
-    WriteValueToOutput(isolate()->heap()->the_hole_value(), 0, frame_index,
-                       output_offset, "padding ");
+    frame_writer.PushRawObject(roots.the_hole_value(), "padding\n");
   }
 
-  for (int i = 0; i < parameter_count; ++i) {
-    output_offset -= kPointerSize;
-    WriteTranslatedValueToOutput(&value_iterator, &input_index, frame_index,
-                                 output_offset);
+  for (int i = 0; i < parameter_count; ++i, ++value_iterator) {
+    frame_writer.PushTranslatedValue(value_iterator, "stack parameter");
   }
 
-  DCHECK_EQ(output_offset, output_frame->GetLastArgumentSlotOffset());
+  DCHECK_EQ(output_frame->GetLastArgumentSlotOffset(),
+            frame_writer.top_offset());
   if (trace_scope_ != nullptr) {
     PrintF(trace_scope_->file(), "    -------------------------\n");
   }
@@ -801,123 +911,76 @@ void Deoptimizer::DoComputeInterpretedFrame(TranslatedFrame* translated_frame,
   // input frame.  For all subsequent output frames, it can be read from the
   // previous one.  This frame's pc can be computed from the non-optimized
   // function code and AST id of the bailout.
-  output_offset -= kPCOnStackSize;
-  intptr_t value;
-  if (is_bottommost) {
-    value = caller_pc_;
-  } else {
-    value = output_[frame_index - 1]->GetPc();
-  }
-  output_frame->SetCallerPc(output_offset, value);
-  DebugPrintOutputSlot(value, frame_index, output_offset, "caller's pc\n");
+  const intptr_t caller_pc =
+      is_bottommost ? caller_pc_ : output_[frame_index - 1]->GetPc();
+  frame_writer.PushCallerPc(caller_pc);
 
   // The caller's frame pointer for the bottommost output frame is the same
   // as in the input frame.  For all subsequent output frames, it can be
   // read from the previous one.  Also compute and set this frame's frame
   // pointer.
-  output_offset -= kFPOnStackSize;
-  if (is_bottommost) {
-    value = caller_fp_;
-  } else {
-    value = output_[frame_index - 1]->GetFp();
-  }
-  output_frame->SetCallerFp(output_offset, value);
-  intptr_t fp_value = top_address + output_offset;
+  const intptr_t caller_fp =
+      is_bottommost ? caller_fp_ : output_[frame_index - 1]->GetFp();
+  frame_writer.PushCallerFp(caller_fp);
+
+  intptr_t fp_value = top_address + frame_writer.top_offset();
   output_frame->SetFp(fp_value);
   if (is_topmost) {
     Register fp_reg = InterpretedFrame::fp_register();
     output_frame->SetRegister(fp_reg.code(), fp_value);
   }
-  DebugPrintOutputSlot(value, frame_index, output_offset, "caller's fp\n");
 
   if (FLAG_enable_embedded_constant_pool) {
     // For the bottommost output frame the constant pool pointer can be gotten
     // from the input frame. For subsequent output frames, it can be read from
     // the previous frame.
-    output_offset -= kPointerSize;
-    if (is_bottommost) {
-      value = caller_constant_pool_;
-    } else {
-      value = output_[frame_index - 1]->GetConstantPool();
-    }
-    output_frame->SetCallerConstantPool(output_offset, value);
-    DebugPrintOutputSlot(value, frame_index, output_offset,
-                         "caller's constant_pool\n");
+    const intptr_t caller_cp =
+        is_bottommost ? caller_constant_pool_
+                      : output_[frame_index - 1]->GetConstantPool();
+    frame_writer.PushCallerConstantPool(caller_cp);
   }
 
   // For the bottommost output frame the context can be gotten from the input
   // frame. For all subsequent output frames it can be gotten from the function
   // so long as we don't inline functions that need local contexts.
-  output_offset -= kPointerSize;
 
   // When deoptimizing into a catch block, we need to take the context
   // from a register that was specified in the handler table.
-  TranslatedFrame::iterator context_pos = value_iterator;
-  int context_input_index = input_index;
+  TranslatedFrame::iterator context_pos = value_iterator++;
   if (goto_catch_handler) {
     // Skip to the translated value of the register specified
     // in the handler table.
     for (int i = 0; i < catch_handler_data_ + 1; ++i) {
       context_pos++;
-      context_input_index++;
     }
   }
   // Read the context from the translations.
   Object* context = context_pos->GetRawValue();
-  value = reinterpret_cast<intptr_t>(context);
-  output_frame->SetContext(value);
-  WriteValueToOutput(context, context_input_index, frame_index, output_offset,
-                     "context    ");
-  if (context == isolate_->heap()->arguments_marker()) {
-    Address output_address =
-        reinterpret_cast<Address>(output_[frame_index]->GetTop()) +
-        output_offset;
-    values_to_materialize_.push_back({output_address, context_pos});
-  }
-  value_iterator++;
-  input_index++;
+  output_frame->SetContext(reinterpret_cast<intptr_t>(context));
+  frame_writer.PushTranslatedValue(context_pos, "context\n");
 
   // The function was mentioned explicitly in the BEGIN_FRAME.
-  output_offset -= kPointerSize;
-  value = reinterpret_cast<intptr_t>(function);
-  WriteValueToOutput(function, 0, frame_index, output_offset, "function    ");
-  if (function == isolate_->heap()->arguments_marker()) {
-    Address output_address =
-        reinterpret_cast<Address>(output_[frame_index]->GetTop()) +
-        output_offset;
-    values_to_materialize_.push_back({output_address, function_iterator});
-  }
+  frame_writer.PushTranslatedValue(function_iterator, "function\n");
 
   // Set the bytecode array pointer.
-  output_offset -= kPointerSize;
   Object* bytecode_array = shared->HasBreakInfo()
                                ? shared->GetDebugInfo()->DebugBytecodeArray()
                                : shared->GetBytecodeArray();
-  WriteValueToOutput(bytecode_array, 0, frame_index, output_offset,
-                     "bytecode array ");
+  frame_writer.PushRawObject(bytecode_array, "bytecode array\n");
 
   // The bytecode offset was mentioned explicitly in the BEGIN_FRAME.
-  output_offset -= kPointerSize;
-
   int raw_bytecode_offset =
       BytecodeArray::kHeaderSize - kHeapObjectTag + bytecode_offset;
   Smi* smi_bytecode_offset = Smi::FromInt(raw_bytecode_offset);
-  output_[frame_index]->SetFrameSlot(
-      output_offset, reinterpret_cast<intptr_t>(smi_bytecode_offset));
+  frame_writer.PushRawObject(smi_bytecode_offset, "bytecode offset\n");
 
   if (trace_scope_ != nullptr) {
-    DebugPrintOutputSlot(reinterpret_cast<intptr_t>(smi_bytecode_offset),
-                         frame_index, output_offset, "bytecode offset @ ");
-    PrintF(trace_scope_->file(), "%d\n", bytecode_offset);
-    PrintF(trace_scope_->file(), "  (input #0)\n");
     PrintF(trace_scope_->file(), "    -------------------------\n");
   }
 
   // Translate the rest of the interpreter registers in the frame.
-  for (int i = 0; i < register_count; ++i) {
-    output_offset -= kPointerSize;
-    WriteTranslatedValueToOutput(&value_iterator, &input_index, frame_index,
-                                 output_offset);
+  for (int i = 0; i < register_count; ++i, ++value_iterator) {
+    frame_writer.PushTranslatedValue(value_iterator, "stack parameter");
   }
 
   int register_slots_written = register_count;
@@ -926,41 +989,35 @@ void Deoptimizer::DoComputeInterpretedFrame(TranslatedFrame* translated_frame,
   // to ensure the stack frame is aligned. Do this now.
   while (register_slots_written < register_stack_slot_count) {
     register_slots_written++;
-    output_offset -= kPointerSize;
-    WriteValueToOutput(isolate()->heap()->the_hole_value(), 0, frame_index,
-                       output_offset, "padding ");
+    frame_writer.PushRawObject(roots.the_hole_value(), "padding\n");
   }
 
   // Translate the accumulator register (depending on frame position).
   if (is_topmost) {
     if (PadTopOfStackRegister()) {
-      output_offset -= kPointerSize;
-      WriteValueToOutput(isolate()->heap()->the_hole_value(), 0, frame_index,
-                         output_offset, "padding ");
+      frame_writer.PushRawObject(roots.the_hole_value(), "padding\n");
     }
     // For topmost frame, put the accumulator on the stack. The
     // {NotifyDeoptimized} builtin pops it off the topmost frame (possibly
     // after materialization).
-    output_offset -= kPointerSize;
     if (goto_catch_handler) {
       // If we are lazy deopting to a catch handler, we set the accumulator to
       // the exception (which lives in the result register).
       intptr_t accumulator_value =
           input_->GetRegister(kInterpreterAccumulatorRegister.code());
-      WriteValueToOutput(reinterpret_cast<Object*>(accumulator_value), 0,
-                         frame_index, output_offset, "accumulator ");
-      value_iterator++;
+      frame_writer.PushRawObject(reinterpret_cast<Object*>(accumulator_value),
+                                 "accumulator\n");
+      ++value_iterator;  // Skip the accumulator.
     } else {
-      WriteTranslatedValueToOutput(&value_iterator, &input_index, frame_index,
-                                   output_offset, "accumulator ");
+      frame_writer.PushTranslatedValue(value_iterator++, "accumulator");
     }
   } else {
     // For non-topmost frames, skip the accumulator translation. For those
     // frames, the return value from the callee will become the accumulator.
-    value_iterator++;
-    input_index++;
+    ++value_iterator;
   }
-  CHECK_EQ(0u, output_offset);
+  CHECK_EQ(translated_frame->end(), value_iterator);
+  CHECK_EQ(0u, frame_writer.top_offset());
 
   // Compute this frame's PC and state. The PC will be a special builtin that
   // continues the bytecode dispatch. Note that non-topmost and lazy-style
@@ -968,16 +1025,17 @@ void Deoptimizer::DoComputeInterpretedFrame(TranslatedFrame* translated_frame,
   // simulating what normal handlers do upon completion of the operation.
   Builtins* builtins = isolate_->builtins();
   Code* dispatch_builtin =
-      (!is_topmost || (bailout_type_ == LAZY)) && !goto_catch_handler
+      (!is_topmost || (deopt_kind_ == DeoptimizeKind::kLazy)) &&
+              !goto_catch_handler
           ? builtins->builtin(Builtins::kInterpreterEnterBytecodeAdvance)
           : builtins->builtin(Builtins::kInterpreterEnterBytecodeDispatch);
   output_frame->SetPc(
-      reinterpret_cast<intptr_t>(dispatch_builtin->InstructionStart()));
+      static_cast<intptr_t>(dispatch_builtin->InstructionStart()));
 
   // Update constant pool.
   if (FLAG_enable_embedded_constant_pool) {
     intptr_t constant_pool_value =
-        reinterpret_cast<intptr_t>(dispatch_builtin->constant_pool());
+        static_cast<intptr_t>(dispatch_builtin->constant_pool());
     output_frame->SetConstantPool(constant_pool_value);
     if (is_topmost) {
       Register constant_pool_reg =
@@ -996,7 +1054,7 @@ void Deoptimizer::DoComputeInterpretedFrame(TranslatedFrame* translated_frame,
     // Set the continuation for the topmost frame.
     Code* continuation = builtins->builtin(Builtins::kNotifyDeoptimized);
     output_frame->SetContinuation(
-        reinterpret_cast<intptr_t>(continuation->InstructionStart()));
+        static_cast<intptr_t>(continuation->InstructionStart()));
   }
 }
 
@@ -1004,17 +1062,13 @@ void Deoptimizer::DoComputeArgumentsAdaptorFrame(
     TranslatedFrame* translated_frame, int frame_index) {
   TranslatedFrame::iterator value_iterator = translated_frame->begin();
   bool is_bottommost = (0 == frame_index);
-  int input_index = 0;
 
   unsigned height = translated_frame->height();
   unsigned height_in_bytes = height * kPointerSize;
   int parameter_count = height;
   if (ShouldPadArguments(parameter_count)) height_in_bytes += kPointerSize;
 
-  TranslatedFrame::iterator function_iterator = value_iterator;
-  Object* function = value_iterator->GetRawValue();
-  value_iterator++;
-  input_index++;
+  TranslatedFrame::iterator function_iterator = value_iterator++;
   if (trace_scope_ != nullptr) {
     PrintF(trace_scope_->file(),
            "  translating arguments adaptor => height=%d\n", height_in_bytes);
@@ -1026,6 +1080,7 @@ void Deoptimizer::DoComputeArgumentsAdaptorFrame(
   // Allocate and store the output frame description.
   FrameDescription* output_frame = new (output_frame_size)
       FrameDescription(output_frame_size, parameter_count);
+  FrameWriter frame_writer(this, output_frame, trace_scope_);
 
   // Arguments adaptor can not be topmost.
   CHECK(frame_index < output_count_ - 1);
@@ -1042,100 +1097,65 @@ void Deoptimizer::DoComputeArgumentsAdaptorFrame(
   }
   output_frame->SetTop(top_address);
 
-  unsigned output_offset = output_frame_size;
+  ReadOnlyRoots roots(isolate());
   if (ShouldPadArguments(parameter_count)) {
-    output_offset -= kPointerSize;
-    WriteValueToOutput(isolate()->heap()->the_hole_value(), 0, frame_index,
-                       output_offset, "padding ");
+    frame_writer.PushRawObject(roots.the_hole_value(), "padding\n");
   }
 
   // Compute the incoming parameter translation.
-  for (int i = 0; i < parameter_count; ++i) {
-    output_offset -= kPointerSize;
-    WriteTranslatedValueToOutput(&value_iterator, &input_index, frame_index,
-                                 output_offset);
+  for (int i = 0; i < parameter_count; ++i, ++value_iterator) {
+    frame_writer.PushTranslatedValue(value_iterator, "stack parameter");
   }
 
-  DCHECK_EQ(output_offset, output_frame->GetLastArgumentSlotOffset());
+  DCHECK_EQ(output_frame->GetLastArgumentSlotOffset(),
+            frame_writer.top_offset());
+
   // Read caller's PC from the previous frame.
-  output_offset -= kPCOnStackSize;
-  intptr_t value;
-  if (is_bottommost) {
-    value = caller_pc_;
-  } else {
-    value = output_[frame_index - 1]->GetPc();
-  }
-  output_frame->SetCallerPc(output_offset, value);
-  DebugPrintOutputSlot(value, frame_index, output_offset, "caller's pc\n");
+  const intptr_t caller_pc =
+      is_bottommost ? caller_pc_ : output_[frame_index - 1]->GetPc();
+  frame_writer.PushCallerPc(caller_pc);
 
   // Read caller's FP from the previous frame, and set this frame's FP.
-  output_offset -= kFPOnStackSize;
-  if (is_bottommost) {
-    value = caller_fp_;
-  } else {
-    value = output_[frame_index - 1]->GetFp();
-  }
-  output_frame->SetCallerFp(output_offset, value);
-  intptr_t fp_value = top_address + output_offset;
+  const intptr_t caller_fp =
+      is_bottommost ? caller_fp_ : output_[frame_index - 1]->GetFp();
+  frame_writer.PushCallerFp(caller_fp);
+
+  intptr_t fp_value = top_address + frame_writer.top_offset();
   output_frame->SetFp(fp_value);
-  DebugPrintOutputSlot(value, frame_index, output_offset, "caller's fp\n");
 
   if (FLAG_enable_embedded_constant_pool) {
     // Read the caller's constant pool from the previous frame.
-    output_offset -= kPointerSize;
-    if (is_bottommost) {
-      value = caller_constant_pool_;
-    } else {
-      value = output_[frame_index - 1]->GetConstantPool();
-    }
-    output_frame->SetCallerConstantPool(output_offset, value);
-    DebugPrintOutputSlot(value, frame_index, output_offset,
-                         "caller's constant_pool\n");
+    const intptr_t caller_cp =
+        is_bottommost ? caller_constant_pool_
+                      : output_[frame_index - 1]->GetConstantPool();
+    frame_writer.PushCallerConstantPool(caller_cp);
   }
 
   // A marker value is used in place of the context.
-  output_offset -= kPointerSize;
-  intptr_t context = StackFrame::TypeToMarker(StackFrame::ARGUMENTS_ADAPTOR);
-  output_frame->SetFrameSlot(output_offset, context);
-  DebugPrintOutputSlot(context, frame_index, output_offset,
-                       "context (adaptor sentinel)\n");
+  intptr_t marker = StackFrame::TypeToMarker(StackFrame::ARGUMENTS_ADAPTOR);
+  frame_writer.PushRawValue(marker, "context (adaptor sentinel)\n");
 
   // The function was mentioned explicitly in the ARGUMENTS_ADAPTOR_FRAME.
-  output_offset -= kPointerSize;
-  value = reinterpret_cast<intptr_t>(function);
-  WriteValueToOutput(function, 0, frame_index, output_offset, "function    ");
-  if (function == isolate_->heap()->arguments_marker()) {
-    Address output_address =
-        reinterpret_cast<Address>(output_[frame_index]->GetTop()) +
-        output_offset;
-    values_to_materialize_.push_back({output_address, function_iterator});
-  }
+  frame_writer.PushTranslatedValue(function_iterator, "function\n");
 
   // Number of incoming arguments.
-  output_offset -= kPointerSize;
-  value = reinterpret_cast<intptr_t>(Smi::FromInt(height - 1));
-  output_frame->SetFrameSlot(output_offset, value);
-  DebugPrintOutputSlot(value, frame_index, output_offset, "argc ");
-  if (trace_scope_ != nullptr) {
-    PrintF(trace_scope_->file(), "(%d)\n", height - 1);
-  }
+  frame_writer.PushRawObject(Smi::FromInt(height - 1), "argc\n");
 
-  output_offset -= kPointerSize;
-  WriteValueToOutput(isolate()->heap()->the_hole_value(), 0, frame_index,
-                     output_offset, "padding ");
+  frame_writer.PushRawObject(roots.the_hole_value(), "padding\n");
 
-  DCHECK_EQ(0, output_offset);
+  CHECK_EQ(translated_frame->end(), value_iterator);
+  DCHECK_EQ(0, frame_writer.top_offset());
 
   Builtins* builtins = isolate_->builtins();
   Code* adaptor_trampoline =
       builtins->builtin(Builtins::kArgumentsAdaptorTrampoline);
-  intptr_t pc_value = reinterpret_cast<intptr_t>(
+  intptr_t pc_value = static_cast<intptr_t>(
       adaptor_trampoline->InstructionStart() +
       isolate_->heap()->arguments_adaptor_deopt_pc_offset()->value());
   output_frame->SetPc(pc_value);
   if (FLAG_enable_embedded_constant_pool) {
     intptr_t constant_pool_value =
-        reinterpret_cast<intptr_t>(adaptor_trampoline->constant_pool());
+        static_cast<intptr_t>(adaptor_trampoline->constant_pool());
     output_frame->SetConstantPool(constant_pool_value);
   }
 }
@@ -1146,15 +1166,11 @@ void Deoptimizer::DoComputeConstructStubFrame(TranslatedFrame* translated_frame,
   bool is_topmost = (output_count_ - 1 == frame_index);
   // The construct frame could become topmost only if we inlined a constructor
   // call which does a tail call (otherwise the tail callee's frame would be
-  // the topmost one). So it could only be the LAZY case.
-  CHECK(!is_topmost || bailout_type_ == LAZY);
-  int input_index = 0;
+  // the topmost one). So it could only be the DeoptimizeKind::kLazy case.
+  CHECK(!is_topmost || deopt_kind_ == DeoptimizeKind::kLazy);
 
   Builtins* builtins = isolate_->builtins();
-  Code* construct_stub = builtins->builtin(
-      FLAG_harmony_restrict_constructor_return
-          ? Builtins::kJSConstructStubGenericRestrictedReturn
-          : Builtins::kJSConstructStubGenericUnrestrictedReturn);
+  Code* construct_stub = builtins->builtin(Builtins::kJSConstructStubGeneric);
   BailoutId bailout_id = translated_frame->node_id();
   unsigned height = translated_frame->height();
   unsigned height_in_bytes = height * kPointerSize;
@@ -1172,9 +1188,7 @@ void Deoptimizer::DoComputeConstructStubFrame(TranslatedFrame* translated_frame,
   int parameter_count = height;
   if (ShouldPadArguments(parameter_count)) height_in_bytes += kPointerSize;
 
-  JSFunction* function = JSFunction::cast(value_iterator->GetRawValue());
-  value_iterator++;
-  input_index++;
+  TranslatedFrame::iterator function_iterator = value_iterator++;
   if (trace_scope_ != nullptr) {
     PrintF(trace_scope_->file(),
            "  translating construct stub => bailout_id=%d (%s), height=%d\n",
@@ -1189,6 +1203,7 @@ void Deoptimizer::DoComputeConstructStubFrame(TranslatedFrame* translated_frame,
   // Allocate and store the output frame description.
   FrameDescription* output_frame = new (output_frame_size)
       FrameDescription(output_frame_size, parameter_count);
+  FrameWriter frame_writer(this, output_frame, trace_scope_);
 
   // Construct stub can not be topmost.
   DCHECK(frame_index > 0 && frame_index < output_count_);
@@ -1201,121 +1216,86 @@ void Deoptimizer::DoComputeConstructStubFrame(TranslatedFrame* translated_frame,
   top_address = output_[frame_index - 1]->GetTop() - output_frame_size;
   output_frame->SetTop(top_address);
 
-  unsigned output_offset = output_frame_size;
-
+  ReadOnlyRoots roots(isolate());
   if (ShouldPadArguments(parameter_count)) {
-    output_offset -= kPointerSize;
-    WriteValueToOutput(isolate()->heap()->the_hole_value(), 0, frame_index,
-                       output_offset, "padding ");
+    frame_writer.PushRawObject(roots.the_hole_value(), "padding\n");
   }
 
+  // The allocated receiver of a construct stub frame is passed as the
+  // receiver parameter through the translation. It might be encoding
+  // a captured object, so we need save it for later.
+  TranslatedFrame::iterator receiver_iterator = value_iterator;
+
   // Compute the incoming parameter translation.
-  for (int i = 0; i < parameter_count; ++i) {
-    output_offset -= kPointerSize;
-    // The allocated receiver of a construct stub frame is passed as the
-    // receiver parameter through the translation. It might be encoding
-    // a captured object, override the slot address for a captured object.
-    WriteTranslatedValueToOutput(
-        &value_iterator, &input_index, frame_index, output_offset, nullptr,
-        (i == 0) ? reinterpret_cast<Address>(top_address) : nullptr);
+  for (int i = 0; i < parameter_count; ++i, ++value_iterator) {
+    frame_writer.PushTranslatedValue(value_iterator, "stack parameter");
   }
 
-  DCHECK_EQ(output_offset, output_frame->GetLastArgumentSlotOffset());
+  DCHECK_EQ(output_frame->GetLastArgumentSlotOffset(),
+            frame_writer.top_offset());
+
   // Read caller's PC from the previous frame.
-  output_offset -= kPCOnStackSize;
-  intptr_t callers_pc = output_[frame_index - 1]->GetPc();
-  output_frame->SetCallerPc(output_offset, callers_pc);
-  DebugPrintOutputSlot(callers_pc, frame_index, output_offset, "caller's pc\n");
+  const intptr_t caller_pc = output_[frame_index - 1]->GetPc();
+  frame_writer.PushCallerPc(caller_pc);
 
   // Read caller's FP from the previous frame, and set this frame's FP.
-  output_offset -= kFPOnStackSize;
-  intptr_t value = output_[frame_index - 1]->GetFp();
-  output_frame->SetCallerFp(output_offset, value);
-  intptr_t fp_value = top_address + output_offset;
+  const intptr_t caller_fp = output_[frame_index - 1]->GetFp();
+  frame_writer.PushCallerFp(caller_fp);
+
+  intptr_t fp_value = top_address + frame_writer.top_offset();
   output_frame->SetFp(fp_value);
   if (is_topmost) {
     Register fp_reg = JavaScriptFrame::fp_register();
     output_frame->SetRegister(fp_reg.code(), fp_value);
   }
-  DebugPrintOutputSlot(value, frame_index, output_offset, "caller's fp\n");
 
   if (FLAG_enable_embedded_constant_pool) {
     // Read the caller's constant pool from the previous frame.
-    output_offset -= kPointerSize;
-    value = output_[frame_index - 1]->GetConstantPool();
-    output_frame->SetCallerConstantPool(output_offset, value);
-    DebugPrintOutputSlot(value, frame_index, output_offset,
-                         "caller's constant_pool\n");
+    const intptr_t caller_cp = output_[frame_index - 1]->GetConstantPool();
+    frame_writer.PushCallerConstantPool(caller_cp);
   }
 
   // A marker value is used to mark the frame.
-  output_offset -= kPointerSize;
-  value = StackFrame::TypeToMarker(StackFrame::CONSTRUCT);
-  output_frame->SetFrameSlot(output_offset, value);
-  DebugPrintOutputSlot(value, frame_index, output_offset,
-                       "typed frame marker\n");
+  intptr_t marker = StackFrame::TypeToMarker(StackFrame::CONSTRUCT);
+  frame_writer.PushRawValue(marker, "context (construct stub sentinel)\n");
 
   // The context can be gotten from the previous frame.
-  output_offset -= kPointerSize;
-  value = output_[frame_index - 1]->GetContext();
-  output_frame->SetFrameSlot(output_offset, value);
-  DebugPrintOutputSlot(value, frame_index, output_offset, "context\n");
+  Object* context =
+      reinterpret_cast<Object*>(output_[frame_index - 1]->GetContext());
+  frame_writer.PushRawObject(context, "context\n");
 
   // Number of incoming arguments.
-  output_offset -= kPointerSize;
-  value = reinterpret_cast<intptr_t>(Smi::FromInt(height - 1));
-  output_frame->SetFrameSlot(output_offset, value);
-  DebugPrintOutputSlot(value, frame_index, output_offset, "argc ");
-  if (trace_scope_ != nullptr) {
-    PrintF(trace_scope_->file(), "(%d)\n", height - 1);
-  }
+  frame_writer.PushRawObject(Smi::FromInt(height - 1), "argc\n");
 
   // The constructor function was mentioned explicitly in the
   // CONSTRUCT_STUB_FRAME.
-  output_offset -= kPointerSize;
-  value = reinterpret_cast<intptr_t>(function);
-  WriteValueToOutput(function, 0, frame_index, output_offset,
-                     "constructor function ");
+  frame_writer.PushTranslatedValue(function_iterator, "constuctor function\n");
 
   // The deopt info contains the implicit receiver or the new target at the
   // position of the receiver. Copy it to the top of stack, with the hole value
   // as padding to maintain alignment.
-  output_offset -= kPointerSize;
-  WriteValueToOutput(isolate()->heap()->the_hole_value(), 0, frame_index,
-                     output_offset, "padding");
 
-  output_offset -= kPointerSize;
+  frame_writer.PushRawObject(roots.the_hole_value(), "padding\n");
 
-  if (ShouldPadArguments(parameter_count)) {
-    value = output_frame->GetFrameSlot(output_frame_size - 2 * kPointerSize);
-  } else {
-    value = output_frame->GetFrameSlot(output_frame_size - kPointerSize);
-  }
-  output_frame->SetFrameSlot(output_offset, value);
-
-  if (bailout_id == BailoutId::ConstructStubCreate()) {
-    DebugPrintOutputSlot(value, frame_index, output_offset, "new target\n");
-  } else {
-    CHECK(bailout_id == BailoutId::ConstructStubInvoke());
-    DebugPrintOutputSlot(value, frame_index, output_offset,
-                         "allocated receiver\n");
-  }
+  CHECK(bailout_id == BailoutId::ConstructStubCreate() ||
+        bailout_id == BailoutId::ConstructStubInvoke());
+  const char* debug_hint = bailout_id == BailoutId::ConstructStubCreate()
+                               ? "new target\n"
+                               : "allocated receiver\n";
+  frame_writer.PushTranslatedValue(receiver_iterator, debug_hint);
 
   if (is_topmost) {
     if (PadTopOfStackRegister()) {
-      output_offset -= kPointerSize;
-      WriteValueToOutput(isolate()->heap()->the_hole_value(), 0, frame_index,
-                         output_offset, "padding ");
+      frame_writer.PushRawObject(roots.the_hole_value(), "padding\n");
     }
     // Ensure the result is restored back when we return to the stub.
-    output_offset -= kPointerSize;
     Register result_reg = kReturnRegister0;
-    value = input_->GetRegister(result_reg.code());
-    output_frame->SetFrameSlot(output_offset, value);
-    DebugPrintOutputSlot(value, frame_index, output_offset, "subcall result\n");
+    intptr_t result = input_->GetRegister(result_reg.code());
+    frame_writer.PushRawValue(result, "subcall result\n");
   }
 
-  CHECK_EQ(0u, output_offset);
+  CHECK_EQ(translated_frame->end(), value_iterator);
+  CHECK_EQ(0u, frame_writer.top_offset());
 
   // Compute this frame's PC.
   DCHECK(bailout_id.IsValidForConstructStub());
@@ -1324,18 +1304,18 @@ void Deoptimizer::DoComputeConstructStubFrame(TranslatedFrame* translated_frame,
       bailout_id == BailoutId::ConstructStubCreate()
           ? isolate_->heap()->construct_stub_create_deopt_pc_offset()->value()
           : isolate_->heap()->construct_stub_invoke_deopt_pc_offset()->value();
-  intptr_t pc_value = reinterpret_cast<intptr_t>(start + pc_offset);
+  intptr_t pc_value = static_cast<intptr_t>(start + pc_offset);
   output_frame->SetPc(pc_value);
 
   // Update constant pool.
   if (FLAG_enable_embedded_constant_pool) {
     intptr_t constant_pool_value =
-        reinterpret_cast<intptr_t>(construct_stub->constant_pool());
+        static_cast<intptr_t>(construct_stub->constant_pool());
     output_frame->SetConstantPool(constant_pool_value);
     if (is_topmost) {
       Register constant_pool_reg =
           JavaScriptFrame::constant_pool_pointer_register();
-      output_frame->SetRegister(constant_pool_reg.code(), fp_value);
+      output_frame->SetRegister(constant_pool_reg.code(), constant_pool_value);
     }
   }
 
@@ -1351,10 +1331,10 @@ void Deoptimizer::DoComputeConstructStubFrame(TranslatedFrame* translated_frame,
   // Set the continuation for the topmost frame.
   if (is_topmost) {
     Builtins* builtins = isolate_->builtins();
-    DCHECK_EQ(LAZY, bailout_type_);
+    DCHECK_EQ(DeoptimizeKind::kLazy, deopt_kind_);
     Code* continuation = builtins->builtin(Builtins::kNotifyDeoptimized);
     output_frame->SetContinuation(
-        reinterpret_cast<intptr_t>(continuation->InstructionStart()));
+        static_cast<intptr_t>(continuation->InstructionStart()));
   }
 }
 
@@ -1477,7 +1457,6 @@ void Deoptimizer::DoComputeBuiltinContinuation(
     TranslatedFrame* translated_frame, int frame_index,
     BuiltinContinuationMode mode) {
   TranslatedFrame::iterator value_iterator = translated_frame->begin();
-  int input_index = 0;
 
   // The output frame must have room for all of the parameters that need to be
   // passed to the builtin continuation.
@@ -1494,7 +1473,8 @@ void Deoptimizer::DoComputeBuiltinContinuation(
 
   const bool is_bottommost = (0 == frame_index);
   const bool is_topmost = (output_count_ - 1 == frame_index);
-  const bool must_handle_result = !is_topmost || bailout_type_ == LAZY;
+  const bool must_handle_result =
+      !is_topmost || deopt_kind_ == DeoptimizeKind::kLazy;
 
   const RegisterConfiguration* config(RegisterConfiguration::Default());
   const int allocatable_register_count =
@@ -1565,6 +1545,7 @@ void Deoptimizer::DoComputeBuiltinContinuation(
   FrameDescription* output_frame = new (output_frame_size)
       FrameDescription(output_frame_size, stack_param_count);
   output_[frame_index] = output_frame;
+  FrameWriter frame_writer(this, output_frame, trace_scope_);
 
   // The top address of the frame is computed from the previous frame's top and
   // this frame's size.
@@ -1579,32 +1560,17 @@ void Deoptimizer::DoComputeBuiltinContinuation(
   // Get the possible JSFunction for the case that this is a
   // JavaScriptBuiltinContinuationFrame, which needs the JSFunction pointer
   // like a normal JavaScriptFrame.
-  intptr_t maybe_function =
+  const intptr_t maybe_function =
       reinterpret_cast<intptr_t>(value_iterator->GetRawValue());
-  ++input_index;
   ++value_iterator;
 
-  struct RegisterValue {
-    Object* raw_value_;
-    TranslatedFrame::iterator iterator_;
-  };
-  std::vector<RegisterValue> register_values;
-  int total_registers = config->num_general_registers();
-  register_values.resize(total_registers, {Smi::kZero, value_iterator});
-
-  intptr_t value;
-
-  unsigned output_frame_offset = output_frame_size;
+  ReadOnlyRoots roots(isolate());
   if (ShouldPadArguments(stack_param_count)) {
-    output_frame_offset -= kPointerSize;
-    WriteValueToOutput(isolate()->heap()->the_hole_value(), 0, frame_index,
-                       output_frame_offset, "padding ");
+    frame_writer.PushRawObject(roots.the_hole_value(), "padding\n");
   }
 
-  for (int i = 0; i < translated_stack_parameters; ++i) {
-    output_frame_offset -= kPointerSize;
-    WriteTranslatedValueToOutput(&value_iterator, &input_index, frame_index,
-                                 output_frame_offset);
+  for (int i = 0; i < translated_stack_parameters; ++i, ++value_iterator) {
+    frame_writer.PushTranslatedValue(value_iterator, "stack parameter");
   }
 
   switch (mode) {
@@ -1613,36 +1579,32 @@ void Deoptimizer::DoComputeBuiltinContinuation(
     case BuiltinContinuationMode::JAVASCRIPT:
       break;
     case BuiltinContinuationMode::JAVASCRIPT_WITH_CATCH: {
-      output_frame_offset -= kPointerSize;
-      WriteValueToOutput(isolate()->heap()->the_hole_value(), input_index,
-                         frame_index, output_frame_offset,
-                         "placeholder for exception on lazy deopt ");
+      frame_writer.PushRawObject(roots.the_hole_value(),
+                                 "placeholder for exception on lazy deopt\n");
     } break;
     case BuiltinContinuationMode::JAVASCRIPT_HANDLE_EXCEPTION: {
-      output_frame_offset -= kPointerSize;
       intptr_t accumulator_value =
           input_->GetRegister(kInterpreterAccumulatorRegister.code());
-      WriteValueToOutput(reinterpret_cast<Object*>(accumulator_value), 0,
-                         frame_index, output_frame_offset,
-                         "exception (from accumulator)");
+      frame_writer.PushRawObject(reinterpret_cast<Object*>(accumulator_value),
+                                 "exception (from accumulator)\n");
     } break;
   }
 
   if (must_handle_result) {
-    output_frame_offset -= kPointerSize;
-    WriteValueToOutput(isolate()->heap()->the_hole_value(), input_index,
-                       frame_index, output_frame_offset,
-                       "placeholder for return result on lazy deopt ");
+    frame_writer.PushRawObject(roots.the_hole_value(),
+                               "placeholder for return result on lazy deopt\n");
   }
 
-  DCHECK_EQ(output_frame_offset, output_frame->GetLastArgumentSlotOffset());
+  DCHECK_EQ(output_frame->GetLastArgumentSlotOffset(),
+            frame_writer.top_offset());
 
-  for (int i = 0; i < register_parameter_count; ++i) {
-    Object* object = value_iterator->GetRawValue();
+  std::vector<TranslatedFrame::iterator> register_values;
+  int total_registers = config->num_general_registers();
+  register_values.resize(total_registers, {value_iterator});
+
+  for (int i = 0; i < register_parameter_count; ++i, ++value_iterator) {
     int code = continuation_descriptor.GetRegisterParameter(i).code();
-    register_values[code] = {object, value_iterator};
-    ++input_index;
-    ++value_iterator;
+    register_values[code] = value_iterator;
   }
 
   // The context register is always implicit in the CallInterfaceDescriptor but
@@ -1651,107 +1613,64 @@ void Deoptimizer::DoComputeBuiltinContinuation(
   // set (it was automatically added at the end of the FrameState by the
   // instruction selector).
   Object* context = value_iterator->GetRawValue();
-  value = reinterpret_cast<intptr_t>(context);
-  const RegisterValue context_register_value = {context, value_iterator};
+  const intptr_t value = reinterpret_cast<intptr_t>(context);
+  TranslatedFrame::iterator context_register_value = value_iterator++;
   register_values[kContextRegister.code()] = context_register_value;
   output_frame->SetContext(value);
   output_frame->SetRegister(kContextRegister.code(), value);
-  ++input_index;
-  ++value_iterator;
 
   // Set caller's PC (JSFunction continuation).
-  output_frame_offset -= kPCOnStackSize;
-  if (is_bottommost) {
-    value = caller_pc_;
-  } else {
-    value = output_[frame_index - 1]->GetPc();
-  }
-  output_frame->SetCallerPc(output_frame_offset, value);
-  DebugPrintOutputSlot(value, frame_index, output_frame_offset,
-                       "caller's pc\n");
+  const intptr_t caller_pc =
+      is_bottommost ? caller_pc_ : output_[frame_index - 1]->GetPc();
+  frame_writer.PushCallerPc(caller_pc);
 
   // Read caller's FP from the previous frame, and set this frame's FP.
-  output_frame_offset -= kFPOnStackSize;
-  if (is_bottommost) {
-    value = caller_fp_;
-  } else {
-    value = output_[frame_index - 1]->GetFp();
-  }
-  output_frame->SetCallerFp(output_frame_offset, value);
-  const intptr_t fp_value = top_address + output_frame_offset;
+  const intptr_t caller_fp =
+      is_bottommost ? caller_fp_ : output_[frame_index - 1]->GetFp();
+  frame_writer.PushCallerFp(caller_fp);
+
+  const intptr_t fp_value = top_address + frame_writer.top_offset();
   output_frame->SetFp(fp_value);
-  DebugPrintOutputSlot(value, frame_index, output_frame_offset,
-                       "caller's fp\n");
 
-  DCHECK_EQ(output_frame_size_above_fp, output_frame_offset);
+  DCHECK_EQ(output_frame_size_above_fp, frame_writer.top_offset());
 
   if (FLAG_enable_embedded_constant_pool) {
     // Read the caller's constant pool from the previous frame.
-    output_frame_offset -= kPointerSize;
-    if (is_bottommost) {
-      value = caller_constant_pool_;
-    } else {
-      value = output_[frame_index - 1]->GetConstantPool();
-    }
-    output_frame->SetCallerConstantPool(output_frame_offset, value);
-    DebugPrintOutputSlot(value, frame_index, output_frame_offset,
-                         "caller's constant_pool\n");
+    const intptr_t caller_cp =
+        is_bottommost ? caller_constant_pool_
+                      : output_[frame_index - 1]->GetConstantPool();
+    frame_writer.PushCallerConstantPool(caller_cp);
   }
 
   // A marker value is used in place of the context.
-  output_frame_offset -= kPointerSize;
-  intptr_t marker =
+  const intptr_t marker =
       StackFrame::TypeToMarker(BuiltinContinuationModeToFrameType(mode));
+  frame_writer.PushRawValue(marker,
+                            "context (builtin continuation sentinel)\n");
 
-  output_frame->SetFrameSlot(output_frame_offset, marker);
-  DebugPrintOutputSlot(marker, frame_index, output_frame_offset,
-                       "context (builtin continuation sentinel)\n");
-
-  output_frame_offset -= kPointerSize;
-  value = BuiltinContinuationModeIsJavaScript(mode) ? maybe_function : 0;
-  output_frame->SetFrameSlot(output_frame_offset, value);
-  DebugPrintOutputSlot(
-      value, frame_index, output_frame_offset,
-      BuiltinContinuationModeIsJavaScript(mode) ? "JSFunction\n" : "unused\n");
+  if (BuiltinContinuationModeIsJavaScript(mode)) {
+    frame_writer.PushRawValue(maybe_function, "JSFunction\n");
+  } else {
+    frame_writer.PushRawValue(0, "unused\n");
+  }
 
   // The delta from the SP to the FP; used to reconstruct SP in
   // Isolate::UnwindAndFindHandler.
-  output_frame_offset -= kPointerSize;
-  value = reinterpret_cast<intptr_t>(Smi::FromInt(output_frame_size_above_fp));
-  output_frame->SetFrameSlot(output_frame_offset, value);
-  DebugPrintOutputSlot(value, frame_index, output_frame_offset,
-                       "frame height at deoptimization\n");
+  frame_writer.PushRawObject(Smi::FromInt(output_frame_size_above_fp),
+                             "frame height at deoptimization\n");
 
   // The context even if this is a stub contininuation frame. We can't use the
   // usual context slot, because we must store the frame marker there.
-  output_frame_offset -= kPointerSize;
-  value = reinterpret_cast<intptr_t>(context);
-  output_frame->SetFrameSlot(output_frame_offset, value);
-  DebugPrintOutputSlot(value, frame_index, output_frame_offset,
-                       "builtin JavaScript context\n");
-  if (context == isolate_->heap()->arguments_marker()) {
-    Address output_address =
-        reinterpret_cast<Address>(output_[frame_index]->GetTop()) +
-        output_frame_offset;
-    values_to_materialize_.push_back(
-        {output_address, context_register_value.iterator_});
-  }
+  frame_writer.PushTranslatedValue(context_register_value,
+                                   "builtin JavaScript context\n");
 
   // The builtin to continue to.
-  output_frame_offset -= kPointerSize;
-  value = reinterpret_cast<intptr_t>(builtin);
-  output_frame->SetFrameSlot(output_frame_offset, value);
-  DebugPrintOutputSlot(value, frame_index, output_frame_offset,
-                       "builtin address\n");
+  frame_writer.PushRawObject(builtin, "builtin address\n");
 
   for (int i = 0; i < allocatable_register_count; ++i) {
-    output_frame_offset -= kPointerSize;
     int code = config->GetAllocatableGeneralCode(i);
-    Object* object = register_values[code].raw_value_;
-    value = reinterpret_cast<intptr_t>(object);
-    output_frame->SetFrameSlot(output_frame_offset, value);
+    ScopedVector<char> str(128);
     if (trace_scope_ != nullptr) {
-      ScopedVector<char> str(128);
       if (BuiltinContinuationModeIsJavaScript(mode) &&
           code == kJavaScriptCallArgCountRegister.code()) {
         SNPrintF(
@@ -1762,46 +1681,34 @@ void Deoptimizer::DoComputeBuiltinContinuation(
         SNPrintF(str, "builtin register argument %s\n",
                  config->GetGeneralRegisterName(code));
       }
-      DebugPrintOutputSlot(value, frame_index, output_frame_offset,
-                           str.start());
-    }
-    if (object == isolate_->heap()->arguments_marker()) {
-      Address output_address =
-          reinterpret_cast<Address>(output_[frame_index]->GetTop()) +
-          output_frame_offset;
-      values_to_materialize_.push_back(
-          {output_address, register_values[code].iterator_});
     }
+    frame_writer.PushTranslatedValue(
+        register_values[code], trace_scope_ != nullptr ? str.start() : "");
   }
 
   // Some architectures must pad the stack frame with extra stack slots
   // to ensure the stack frame is aligned.
   for (int i = 0; i < padding_slot_count; ++i) {
-    output_frame_offset -= kPointerSize;
-    WriteValueToOutput(isolate()->heap()->the_hole_value(), 0, frame_index,
-                       output_frame_offset, "padding ");
+    frame_writer.PushRawObject(roots.the_hole_value(), "padding\n");
   }
 
   if (is_topmost) {
     if (PadTopOfStackRegister()) {
-      output_frame_offset -= kPointerSize;
-      WriteValueToOutput(isolate()->heap()->the_hole_value(), 0, frame_index,
-                         output_frame_offset, "padding ");
+      frame_writer.PushRawObject(roots.the_hole_value(), "padding\n");
     }
     // Ensure the result is restored back when we return to the stub.
-    output_frame_offset -= kPointerSize;
-    Register result_reg = kReturnRegister0;
+
     if (must_handle_result) {
-      value = input_->GetRegister(result_reg.code());
+      Register result_reg = kReturnRegister0;
+      frame_writer.PushRawValue(input_->GetRegister(result_reg.code()),
+                                "callback result\n");
     } else {
-      value = reinterpret_cast<intptr_t>(isolate()->heap()->undefined_value());
+      frame_writer.PushRawObject(roots.undefined_value(), "callback result\n");
     }
-    output_frame->SetFrameSlot(output_frame_offset, value);
-    DebugPrintOutputSlot(value, frame_index, output_frame_offset,
-                         "callback result\n");
   }
 
-  CHECK_EQ(0u, output_frame_offset);
+  CHECK_EQ(translated_frame->end(), value_iterator);
+  CHECK_EQ(0u, frame_writer.top_offset());
 
   // Clear the context register. The context might be a de-materialized object
   // and will be materialized by {Runtime_NotifyDeoptimized}. For additional
@@ -1820,16 +1727,16 @@ void Deoptimizer::DoComputeBuiltinContinuation(
   Code* continue_to_builtin = isolate()->builtins()->builtin(
       TrampolineForBuiltinContinuation(mode, must_handle_result));
   output_frame->SetPc(
-      reinterpret_cast<intptr_t>(continue_to_builtin->InstructionStart()));
+      static_cast<intptr_t>(continue_to_builtin->InstructionStart()));
 
   Code* continuation =
       isolate()->builtins()->builtin(Builtins::kNotifyDeoptimized);
   output_frame->SetContinuation(
-      reinterpret_cast<intptr_t>(continuation->InstructionStart()));
+      static_cast<intptr_t>(continuation->InstructionStart()));
 }
 
 void Deoptimizer::MaterializeHeapObjects() {
-  translated_state_.Prepare(reinterpret_cast<Address>(stack_fp_));
+  translated_state_.Prepare(static_cast<Address>(stack_fp_));
   if (FLAG_deopt_every_n_times > 0) {
     // Doing a GC here will find problems with the deoptimized frames.
     isolate_->heap()->CollectAllGarbage(Heap::kFinalizeIncrementalMarkingMask,
@@ -1840,8 +1747,8 @@ void Deoptimizer::MaterializeHeapObjects() {
     Handle<Object> value = materialization.value_->GetValue();
 
     if (trace_scope_ != nullptr) {
-      PrintF("Materialization [0x%08" V8PRIxPTR "] <- 0x%08" V8PRIxPTR " ;  ",
-             reinterpret_cast<intptr_t>(materialization.output_slot_address_),
+      PrintF("Materialization [" V8PRIxPTR_FMT "] <- " V8PRIxPTR_FMT " ;  ",
+             static_cast<intptr_t>(materialization.output_slot_address_),
              reinterpret_cast<intptr_t>(*value));
       value->ShortPrint(trace_scope_->file());
       PrintF(trace_scope_->file(), "\n");
@@ -1861,61 +1768,14 @@ void Deoptimizer::MaterializeHeapObjects() {
   }
 
   isolate_->materialized_object_store()->Remove(
-      reinterpret_cast<Address>(stack_fp_));
-}
-
-
-void Deoptimizer::WriteTranslatedValueToOutput(
-    TranslatedFrame::iterator* iterator, int* input_index, int frame_index,
-    unsigned output_offset, const char* debug_hint_string,
-    Address output_address_for_materialization) {
-  Object* value = (*iterator)->GetRawValue();
-
-  WriteValueToOutput(value, *input_index, frame_index, output_offset,
-                     debug_hint_string);
-
-  if (value == isolate_->heap()->arguments_marker()) {
-    Address output_address =
-        reinterpret_cast<Address>(output_[frame_index]->GetTop()) +
-        output_offset;
-    if (output_address_for_materialization == nullptr) {
-      output_address_for_materialization = output_address;
-    }
-    values_to_materialize_.push_back(
-        {output_address_for_materialization, *iterator});
-  }
-
-  (*iterator)++;
-  (*input_index)++;
+      static_cast<Address>(stack_fp_));
 }
 
-
-void Deoptimizer::WriteValueToOutput(Object* value, int input_index,
-                                     int frame_index, unsigned output_offset,
-                                     const char* debug_hint_string) {
-  output_[frame_index]->SetFrameSlot(output_offset,
-                                     reinterpret_cast<intptr_t>(value));
-
-  if (trace_scope_ != nullptr) {
-    DebugPrintOutputSlot(reinterpret_cast<intptr_t>(value), frame_index,
-                         output_offset, debug_hint_string);
-    value->ShortPrint(trace_scope_->file());
-    PrintF(trace_scope_->file(), "  (input #%d)\n", input_index);
-  }
-}
-
-
-void Deoptimizer::DebugPrintOutputSlot(intptr_t value, int frame_index,
-                                       unsigned output_offset,
-                                       const char* debug_hint_string) {
-  if (trace_scope_ != nullptr) {
-    Address output_address =
-        reinterpret_cast<Address>(output_[frame_index]->GetTop()) +
-        output_offset;
-    PrintF(trace_scope_->file(),
-           "    0x%08" V8PRIxPTR ": [top + %d] <- 0x%08" V8PRIxPTR " ;  %s",
-           reinterpret_cast<intptr_t>(output_address), output_offset, value,
-           debug_hint_string == nullptr ? "" : debug_hint_string);
+void Deoptimizer::QueueValueForMaterialization(
+    Address output_address, Object* obj,
+    const TranslatedFrame::iterator& iterator) {
+  if (obj == ReadOnlyRoots(isolate_).arguments_marker()) {
+    values_to_materialize_.push_back({output_address, iterator});
   }
 }
 
@@ -1959,14 +1819,15 @@ unsigned Deoptimizer::ComputeIncomingArgumentSize(SharedFunctionInfo* shared) {
 }
 
 void Deoptimizer::EnsureCodeForDeoptimizationEntry(Isolate* isolate,
-                                                   BailoutType type) {
-  CHECK(type == EAGER || type == SOFT || type == LAZY);
+                                                   DeoptimizeKind kind) {
+  CHECK(kind == DeoptimizeKind::kEager || kind == DeoptimizeKind::kSoft ||
+        kind == DeoptimizeKind::kLazy);
   DeoptimizerData* data = isolate->deoptimizer_data();
-  if (data->deopt_entry_code_[type] != nullptr) return;
+  if (data->deopt_entry_code(kind) != nullptr) return;
 
   MacroAssembler masm(isolate, nullptr, 16 * KB, CodeObjectRequired::kYes);
   masm.set_emit_debug_code(false);
-  GenerateDeoptimizationEntries(&masm, kMaxNumberOfEntries, type);
+  GenerateDeoptimizationEntries(&masm, kMaxNumberOfEntries, kind);
   CodeDesc desc;
   masm.GetCode(isolate, &desc);
   DCHECK(!RelocInfo::RequiresRelocation(desc));
@@ -1978,14 +1839,14 @@ void Deoptimizer::EnsureCodeForDeoptimizationEntry(Isolate* isolate,
       MaybeHandle<ByteArray>(), MaybeHandle<DeoptimizationData>(), kImmovable);
   CHECK(Heap::IsImmovable(*code));
 
-  CHECK_NULL(data->deopt_entry_code_[type]);
-  data->deopt_entry_code_[type] = *code;
+  CHECK_NULL(data->deopt_entry_code(kind));
+  data->set_deopt_entry_code(kind, *code);
 }
 
 void Deoptimizer::EnsureCodeForMaxDeoptimizationEntries(Isolate* isolate) {
-  EnsureCodeForDeoptimizationEntry(isolate, EAGER);
-  EnsureCodeForDeoptimizationEntry(isolate, LAZY);
-  EnsureCodeForDeoptimizationEntry(isolate, SOFT);
+  EnsureCodeForDeoptimizationEntry(isolate, DeoptimizeKind::kEager);
+  EnsureCodeForDeoptimizationEntry(isolate, DeoptimizeKind::kLazy);
+  EnsureCodeForDeoptimizationEntry(isolate, DeoptimizeKind::kSoft);
 }
 
 FrameDescription::FrameDescription(uint32_t frame_size, int parameter_count)
@@ -2015,8 +1876,8 @@ void TranslationBuffer::Add(int32_t value) {
   DCHECK_NE(value, kMinInt);
   // Encode the sign bit in the least significant bit.
   bool is_negative = (value < 0);
-  uint32_t bits = ((is_negative ? -value : value) << 1) |
-      static_cast<int32_t>(is_negative);
+  uint32_t bits = (static_cast<uint32_t>(is_negative ? -value : value) << 1) |
+                  static_cast<uint32_t>(is_negative);
   // Encode the individual bytes using the least significant bit of
   // each byte to indicate whether or not more bytes follow.
   do {
@@ -2298,7 +2159,7 @@ bool MaterializedObjectStore::Remove(Address fp) {
   for (int i = index; i < fps_size; i++) {
     array->set(i, array->get(i + 1));
   }
-  array->set(fps_size, isolate()->heap()->undefined_value());
+  array->set(fps_size, ReadOnlyRoots(isolate()).undefined_value());
   return true;
 }
 
@@ -2312,7 +2173,8 @@ int MaterializedObjectStore::StackIdToIndex(Address fp) {
 
 
 Handle<FixedArray> MaterializedObjectStore::GetStackEntries() {
-  return Handle<FixedArray>(isolate()->heap()->materialized_objects());
+  return Handle<FixedArray>(isolate()->heap()->materialized_objects(),
+                            isolate());
 }
 
 
@@ -2332,8 +2194,9 @@ Handle<FixedArray> MaterializedObjectStore::EnsureStackEntries(int length) {
   for (int i = 0; i < array->length(); i++) {
     new_array->set(i, array->get(i));
   }
+  HeapObject* undefined_value = ReadOnlyRoots(isolate()).undefined_value();
   for (int i = array->length(); i < length; i++) {
-    new_array->set(i, isolate()->heap()->undefined_value());
+    new_array->set(i, undefined_value);
   }
   isolate()->heap()->SetRootMaterializedObjects(*new_array);
   return new_array;
@@ -2343,7 +2206,7 @@ namespace {
 
 Handle<Object> GetValueForDebugger(TranslatedFrame::iterator it,
                                    Isolate* isolate) {
-  if (it->GetRawValue() == isolate->heap()->arguments_marker()) {
+  if (it->GetRawValue() == ReadOnlyRoots(isolate).arguments_marker()) {
     if (!it->IsMaterializableByDebugger()) {
       return isolate->factory()->optimized_out();
     }
@@ -2356,52 +2219,28 @@ Handle<Object> GetValueForDebugger(TranslatedFrame::iterator it,
 DeoptimizedFrameInfo::DeoptimizedFrameInfo(TranslatedState* state,
                                            TranslatedState::iterator frame_it,
                                            Isolate* isolate) {
-  // If the previous frame is an adaptor frame, we will take the parameters
-  // from there.
-  TranslatedState::iterator parameter_frame = frame_it;
-  if (parameter_frame != state->begin()) {
-    parameter_frame--;
-  }
-  int parameter_count;
-  if (parameter_frame->kind() == TranslatedFrame::kArgumentsAdaptor) {
-    parameter_count = parameter_frame->height() - 1;  // Ignore the receiver.
-  } else {
-    parameter_frame = frame_it;
-    parameter_count =
-        frame_it->shared_info()->internal_formal_parameter_count();
-  }
-  TranslatedFrame::iterator parameter_it = parameter_frame->begin();
-  parameter_it++;  // Skip the function.
-  parameter_it++;  // Skip the receiver.
+  int parameter_count =
+      frame_it->shared_info()->internal_formal_parameter_count();
+  TranslatedFrame::iterator stack_it = frame_it->begin();
 
-  // Figure out whether there is a construct stub frame on top of
-  // the parameter frame.
-  has_construct_stub_ =
-      parameter_frame != state->begin() &&
-      (parameter_frame - 1)->kind() == TranslatedFrame::kConstructStub;
+  // Get the function. Note that this might materialize the function.
+  // In case the debugger mutates this value, we should deoptimize
+  // the function and remember the value in the materialized value store.
+  function_ = Handle<JSFunction>::cast(stack_it->GetValue());
+  stack_it++;  // Skip the function.
+  stack_it++;  // Skip the receiver.
 
   DCHECK_EQ(TranslatedFrame::kInterpretedFunction, frame_it->kind());
   source_position_ = Deoptimizer::ComputeSourcePositionFromBytecodeArray(
       *frame_it->shared_info(), frame_it->node_id());
 
-  TranslatedFrame::iterator value_it = frame_it->begin();
-  // Get the function. Note that this might materialize the function.
-  // In case the debugger mutates this value, we should deoptimize
-  // the function and remember the value in the materialized value store.
-  function_ = Handle<JSFunction>::cast(value_it->GetValue());
+  DCHECK_EQ(parameter_count,
+            function_->shared()->internal_formal_parameter_count());
 
   parameters_.resize(static_cast<size_t>(parameter_count));
   for (int i = 0; i < parameter_count; i++) {
-    Handle<Object> parameter = GetValueForDebugger(parameter_it, isolate);
+    Handle<Object> parameter = GetValueForDebugger(stack_it, isolate);
     SetParameter(i, parameter);
-    parameter_it++;
-  }
-
-  // Skip the function, the receiver and the arguments.
-  int skip_count =
-      frame_it->shared_info()->internal_formal_parameter_count() + 2;
-  TranslatedFrame::iterator stack_it = frame_it->begin();
-  for (int i = 0; i < skip_count; i++) {
     stack_it++;
   }
 
@@ -2617,10 +2456,10 @@ Object* TranslatedValue::GetRawValue() const {
 
     case kBoolBit: {
       if (uint32_value() == 0) {
-        return isolate()->heap()->false_value();
+        return ReadOnlyRoots(isolate()).false_value();
       } else {
         CHECK_EQ(1U, uint32_value());
-        return isolate()->heap()->true_value();
+        return ReadOnlyRoots(isolate()).true_value();
       }
     }
 
@@ -2630,7 +2469,7 @@ Object* TranslatedValue::GetRawValue() const {
 
   // If we could not get the value without allocation, return the arguments
   // marker.
-  return isolate()->heap()->arguments_marker();
+  return ReadOnlyRoots(isolate()).arguments_marker();
 }
 
 void TranslatedValue::set_initialized_storage(Handle<Object> storage) {
@@ -2688,7 +2527,7 @@ void TranslatedValue::MaterializeSimple() {
   if (materialization_state() == kFinished) return;
 
   Object* raw_value = GetRawValue();
-  if (raw_value != isolate()->heap()->arguments_marker()) {
+  if (raw_value != ReadOnlyRoots(isolate()).arguments_marker()) {
     // We can get the value without allocation, just return it here.
     set_initialized_storage(Handle<Object>(raw_value, isolate()));
     return;
@@ -2851,7 +2690,8 @@ int TranslatedFrame::GetValueCount() {
 
 void TranslatedFrame::Handlify() {
   if (raw_shared_info_ != nullptr) {
-    shared_info_ = Handle<SharedFunctionInfo>(raw_shared_info_);
+    shared_info_ = Handle<SharedFunctionInfo>(raw_shared_info_,
+                                              raw_shared_info_->GetIsolate());
     raw_shared_info_ = nullptr;
   }
   for (auto& value : values_) {
@@ -3061,8 +2901,8 @@ void TranslatedState::CreateArgumentsElementsTranslatedValues(
   frame.Add(TranslatedValue::NewDeferredObject(
       this, length + FixedArray::kHeaderSize / kPointerSize, object_index));
 
-  frame.Add(
-      TranslatedValue::NewTagged(this, isolate_->heap()->fixed_array_map()));
+  ReadOnlyRoots roots(isolate_);
+  frame.Add(TranslatedValue::NewTagged(this, roots.fixed_array_map()));
   frame.Add(TranslatedValue::NewInt32(this, length));
 
   int number_of_holes = 0;
@@ -3072,8 +2912,7 @@ void TranslatedState::CreateArgumentsElementsTranslatedValues(
     number_of_holes = Min(formal_parameter_count_, length);
   }
   for (int i = 0; i < number_of_holes; ++i) {
-    frame.Add(
-        TranslatedValue::NewTagged(this, isolate_->heap()->the_hole_value()));
+    frame.Add(TranslatedValue::NewTagged(this, roots.the_hole_value()));
   }
   for (int i = length - number_of_holes - 1; i >= 0; --i) {
     Address argument_slot = arguments_frame +
@@ -3171,7 +3010,7 @@ int TranslatedState::CreateNextTranslatedValue(
       }
       intptr_t value = registers->GetRegister(input_reg);
       if (trace_file != nullptr) {
-        PrintF(trace_file, "0x%08" V8PRIxPTR " ; %s ", value,
+        PrintF(trace_file, V8PRIxPTR_FMT " ; %s ", value,
                converter.NameOfCPURegister(input_reg));
         reinterpret_cast<Object*>(value)->ShortPrint(trace_file);
       }
@@ -3277,7 +3116,7 @@ int TranslatedState::CreateNextTranslatedValue(
           OptimizedFrame::StackSlotOffsetRelativeToFp(iterator->Next());
       intptr_t value = *(reinterpret_cast<intptr_t*>(fp + slot_offset));
       if (trace_file != nullptr) {
-        PrintF(trace_file, "0x%08" V8PRIxPTR " ; [fp %c %d] ", value,
+        PrintF(trace_file, V8PRIxPTR_FMT " ;  [fp %c %3d]  ", value,
                slot_offset < 0 ? '-' : '+', std::abs(slot_offset));
         reinterpret_cast<Object*>(value)->ShortPrint(trace_file);
       }
@@ -3292,7 +3131,7 @@ int TranslatedState::CreateNextTranslatedValue(
           OptimizedFrame::StackSlotOffsetRelativeToFp(iterator->Next());
       uint32_t value = GetUInt32Slot(fp, slot_offset);
       if (trace_file != nullptr) {
-        PrintF(trace_file, "%d ; (int) [fp %c %d] ",
+        PrintF(trace_file, "%d ; (int) [fp %c %3d] ",
                static_cast<int32_t>(value), slot_offset < 0 ? '-' : '+',
                std::abs(slot_offset));
       }
@@ -3306,7 +3145,7 @@ int TranslatedState::CreateNextTranslatedValue(
           OptimizedFrame::StackSlotOffsetRelativeToFp(iterator->Next());
       uint32_t value = GetUInt32Slot(fp, slot_offset);
       if (trace_file != nullptr) {
-        PrintF(trace_file, "%u ; (uint) [fp %c %d] ", value,
+        PrintF(trace_file, "%u ; (uint) [fp %c %3d] ", value,
                slot_offset < 0 ? '-' : '+', std::abs(slot_offset));
       }
       TranslatedValue translated_value =
@@ -3320,7 +3159,7 @@ int TranslatedState::CreateNextTranslatedValue(
           OptimizedFrame::StackSlotOffsetRelativeToFp(iterator->Next());
       uint32_t value = GetUInt32Slot(fp, slot_offset);
       if (trace_file != nullptr) {
-        PrintF(trace_file, "%u ; (bool) [fp %c %d] ", value,
+        PrintF(trace_file, "%u ; (bool) [fp %c %3d] ", value,
                slot_offset < 0 ? '-' : '+', std::abs(slot_offset));
       }
       TranslatedValue translated_value = TranslatedValue::NewBool(this, value);
@@ -3333,7 +3172,7 @@ int TranslatedState::CreateNextTranslatedValue(
           OptimizedFrame::StackSlotOffsetRelativeToFp(iterator->Next());
       Float32 value = GetFloatSlot(fp, slot_offset);
       if (trace_file != nullptr) {
-        PrintF(trace_file, "%e ; (float) [fp %c %d] ", value.get_scalar(),
+        PrintF(trace_file, "%e ; (float) [fp %c %3d] ", value.get_scalar(),
                slot_offset < 0 ? '-' : '+', std::abs(slot_offset));
       }
       TranslatedValue translated_value = TranslatedValue::NewFloat(this, value);
@@ -3359,7 +3198,7 @@ int TranslatedState::CreateNextTranslatedValue(
       int literal_index = iterator->Next();
       Object* value = literal_array->get(literal_index);
       if (trace_file != nullptr) {
-        PrintF(trace_file, "0x%08" V8PRIxPTR " ; (literal %d) ",
+        PrintF(trace_file, V8PRIxPTR_FMT " ; (literal %2d) ",
                reinterpret_cast<intptr_t>(value), literal_index);
         reinterpret_cast<Object*>(value)->ShortPrint(trace_file);
       }
@@ -3382,20 +3221,20 @@ TranslatedState::TranslatedState(const JavaScriptFrame* frame) {
   DCHECK(data != nullptr && deopt_index != Safepoint::kNoDeoptimizationIndex);
   TranslationIterator it(data->TranslationByteArray(),
                          data->TranslationIndex(deopt_index)->value());
-  Init(frame->fp(), &it, data->LiteralArray(), nullptr /* registers */,
-       nullptr /* trace file */,
+  Init(frame->isolate(), frame->fp(), &it, data->LiteralArray(),
+       nullptr /* registers */, nullptr /* trace file */,
        frame->function()->shared()->internal_formal_parameter_count());
 }
 
-void TranslatedState::Init(Address input_frame_pointer,
+void TranslatedState::Init(Isolate* isolate, Address input_frame_pointer,
                            TranslationIterator* iterator,
                            FixedArray* literal_array, RegisterValues* registers,
                            FILE* trace_file, int formal_parameter_count) {
   DCHECK(frames_.empty());
 
   formal_parameter_count_ = formal_parameter_count;
+  isolate_ = isolate;
 
-  isolate_ = literal_array->GetIsolate();
   // Read out the 'header' translation.
   Translation::Opcode opcode =
       static_cast<Translation::Opcode>(iterator->Next());
@@ -3559,10 +3398,17 @@ void TranslatedState::InitializeCapturedObjectAt(
     case NATIVE_CONTEXT_TYPE:
     case SCRIPT_CONTEXT_TYPE:
     case WITH_CONTEXT_TYPE:
-    case BOILERPLATE_DESCRIPTION_TYPE:
+    case OBJECT_BOILERPLATE_DESCRIPTION_TYPE:
     case HASH_TABLE_TYPE:
+    case ORDERED_HASH_MAP_TYPE:
+    case ORDERED_HASH_SET_TYPE:
+    case NAME_DICTIONARY_TYPE:
+    case GLOBAL_DICTIONARY_TYPE:
+    case NUMBER_DICTIONARY_TYPE:
+    case SIMPLE_NUMBER_DICTIONARY_TYPE:
+    case STRING_TABLE_TYPE:
     case PROPERTY_ARRAY_TYPE:
-    case CONTEXT_EXTENSION_TYPE:
+    case SCRIPT_CONTEXT_TABLE_TYPE:
       InitializeObjectWithTaggedFieldsAt(frame, &value_index, slot, map,
                                          no_allocation);
       break;
@@ -3621,9 +3467,9 @@ void TranslatedState::MaterializeMutableHeapNumber(TranslatedFrame* frame,
   CHECK_NE(TranslatedValue::kCapturedObject,
            frame->values_[*value_index].kind());
   Handle<Object> value = frame->values_[*value_index].GetValue();
-  Handle<HeapNumber> box;
   CHECK(value->IsNumber());
-  box = isolate()->factory()->NewHeapNumber(value->Number(), MUTABLE);
+  Handle<MutableHeapNumber> box =
+      isolate()->factory()->NewMutableHeapNumber(value->Number());
   (*value_index)++;
   slot->set_storage(box);
 }
@@ -3685,6 +3531,7 @@ void TranslatedState::EnsureCapturedObjectAllocatedAt(
       return MaterializeMutableHeapNumber(frame, &value_index, slot);
 
     case FIXED_ARRAY_TYPE:
+    case SCRIPT_CONTEXT_TABLE_TYPE:
     case BLOCK_CONTEXT_TYPE:
     case CATCH_CONTEXT_TYPE:
     case DEBUG_EVALUATE_CONTEXT_TYPE:
@@ -3694,7 +3541,14 @@ void TranslatedState::EnsureCapturedObjectAllocatedAt(
     case NATIVE_CONTEXT_TYPE:
     case SCRIPT_CONTEXT_TYPE:
     case WITH_CONTEXT_TYPE:
-    case HASH_TABLE_TYPE: {
+    case HASH_TABLE_TYPE:
+    case ORDERED_HASH_MAP_TYPE:
+    case ORDERED_HASH_SET_TYPE:
+    case NAME_DICTIONARY_TYPE:
+    case GLOBAL_DICTIONARY_TYPE:
+    case NUMBER_DICTIONARY_TYPE:
+    case SIMPLE_NUMBER_DICTIONARY_TYPE:
+    case STRING_TABLE_TYPE: {
       // Check we have the right size.
       int array_length =
           Smi::cast(frame->values_[value_index].GetRawValue())->value();
@@ -3703,7 +3557,7 @@ void TranslatedState::EnsureCapturedObjectAllocatedAt(
       CHECK_EQ(instance_size, slot->GetChildrenCount() * kPointerSize);
 
       // Canonicalize empty fixed array.
-      if (*map == isolate()->heap()->empty_fixed_array()->map() &&
+      if (*map == ReadOnlyRoots(isolate()).empty_fixed_array()->map() &&
           array_length == 0) {
         slot->set_storage(isolate()->factory()->empty_fixed_array());
       } else {
@@ -3729,14 +3583,6 @@ void TranslatedState::EnsureCapturedObjectAllocatedAt(
                                      &value_index, worklist);
     }
 
-    case CONTEXT_EXTENSION_TYPE: {
-      CHECK_EQ(map->instance_size(), slot->GetChildrenCount() * kPointerSize);
-      slot->set_storage(AllocateStorageFor(slot));
-      // Make sure all the remaining children (after the map) are allocated.
-      return EnsureChildrenAllocated(slot->GetChildrenCount() - 1, frame,
-                                     &value_index, worklist);
-    }
-
     default:
       CHECK(map->IsJSObjectMap());
       EnsureJSObjectAllocated(slot, map);
@@ -3792,7 +3638,7 @@ void TranslatedState::EnsurePropertiesAllocatedAndMarked(
   properties_slot->set_storage(object_storage);
 
   // Set markers for the double properties.
-  Handle<DescriptorArray> descriptors(map->instance_descriptors());
+  Handle<DescriptorArray> descriptors(map->instance_descriptors(), isolate());
   int field_count = map->NumberOfOwnDescriptors();
   for (int i = 0; i < field_count; i++) {
     FieldIndex index = FieldIndex::ForDescriptor(*map, i);
@@ -3825,7 +3671,7 @@ void TranslatedState::EnsureJSObjectAllocated(TranslatedValue* slot,
 
   Handle<ByteArray> object_storage = AllocateStorageFor(slot);
   // Now we handle the interesting (JSObject) case.
-  Handle<DescriptorArray> descriptors(map->instance_descriptors());
+  Handle<DescriptorArray> descriptors(map->instance_descriptors(), isolate());
   int field_count = map->NumberOfOwnDescriptors();
 
   // Set markers for the double properties.
@@ -3917,7 +3763,7 @@ void TranslatedState::InitializeObjectWithTaggedFieldsAt(
   Handle<HeapObject> object_storage = Handle<HeapObject>::cast(slot->storage_);
 
   // Skip the writes if we already have the canonical empty fixed array.
-  if (*object_storage == isolate()->heap()->empty_fixed_array()) {
+  if (*object_storage == ReadOnlyRoots(isolate()).empty_fixed_array()) {
     CHECK_EQ(2, slot->GetChildrenCount());
     Handle<Object> length_value = GetValueAndAdvance(frame, value_index);
     CHECK_EQ(*length_value, Smi::FromInt(0));
@@ -4089,7 +3935,7 @@ void TranslatedState::VerifyMaterializedObjects() {
     if (slot->kind() == TranslatedValue::kCapturedObject) {
       CHECK_EQ(slot, GetValueByObjectIndex(slot->object_index()));
       if (slot->materialization_state() == TranslatedValue::kFinished) {
-        slot->GetStorage()->ObjectVerify();
+        slot->GetStorage()->ObjectVerify(isolate());
       } else {
         CHECK_EQ(slot->materialization_state(),
                  TranslatedValue::kUninitialized);
diff --git a/deps/v8/src/deoptimizer.h b/deps/v8/src/deoptimizer.h
index 8f84c89bee8356..8a24a272c3449f 100644
--- a/deps/v8/src/deoptimizer.h
+++ b/deps/v8/src/deoptimizer.h
@@ -14,6 +14,7 @@
 #include "src/deoptimize-reason.h"
 #include "src/feedback-vector.h"
 #include "src/frame-constants.h"
+#include "src/globals.h"
 #include "src/isolate.h"
 #include "src/macro-assembler.h"
 #include "src/source-position.h"
@@ -31,8 +32,8 @@ class RegisterValues;
 class TranslatedValue {
  public:
   // Allocation-less getter of the value.
-  // Returns heap()->arguments_marker() if allocation would be
-  // necessary to get the value.
+  // Returns ReadOnlyRoots::arguments_marker() if allocation would be necessary
+  // to get the value.
   Object* GetRawValue() const;
 
   // Getter for the value, takes care of materializing the subgraph
@@ -171,31 +172,39 @@ class TranslatedFrame {
   class iterator {
    public:
     iterator& operator++() {
+      ++input_index_;
       AdvanceIterator(&position_);
       return *this;
     }
 
     iterator operator++(int) {
+      ++input_index_;
       iterator original(position_);
       AdvanceIterator(&position_);
       return original;
     }
 
     bool operator==(const iterator& other) const {
+      // Ignore {input_index_} for equality.
       return position_ == other.position_;
     }
     bool operator!=(const iterator& other) const { return !(*this == other); }
 
     TranslatedValue& operator*() { return (*position_); }
     TranslatedValue* operator->() { return &(*position_); }
+    const TranslatedValue& operator*() const { return (*position_); }
+    const TranslatedValue* operator->() const { return &(*position_); }
+
+    int input_index() const { return input_index_; }
 
    private:
     friend TranslatedFrame;
 
     explicit iterator(std::deque<TranslatedValue>::iterator position)
-        : position_(position) {}
+        : position_(position), input_index_(0) {}
 
     std::deque<TranslatedValue>::iterator position_;
+    int input_index_;
   };
 
   typedef TranslatedValue& reference;
@@ -297,9 +306,9 @@ class TranslatedState {
 
   Isolate* isolate() { return isolate_; }
 
-  void Init(Address input_frame_pointer, TranslationIterator* iterator,
-            FixedArray* literal_array, RegisterValues* registers,
-            FILE* trace_file, int parameter_count);
+  void Init(Isolate* isolate, Address input_frame_pointer,
+            TranslationIterator* iterator, FixedArray* literal_array,
+            RegisterValues* registers, FILE* trace_file, int parameter_count);
 
   void VerifyMaterializedObjects();
   bool DoUpdateFeedback();
@@ -362,7 +371,7 @@ class TranslatedState {
 
   std::vector<TranslatedFrame> frames_;
   Isolate* isolate_ = nullptr;
-  Address stack_frame_pointer_ = nullptr;
+  Address stack_frame_pointer_ = kNullAddress;
   int formal_parameter_count_;
 
   struct ObjectPosition {
@@ -384,8 +393,6 @@ class OptimizedFunctionVisitor BASE_EMBEDDED {
 
 class Deoptimizer : public Malloced {
  public:
-  enum BailoutType { EAGER, LAZY, SOFT, kLastBailoutType = SOFT };
-
   struct DeoptInfo {
     DeoptInfo(SourcePosition position, DeoptimizeReason deopt_reason,
               int deopt_id)
@@ -398,48 +405,45 @@ class Deoptimizer : public Malloced {
     static const int kNoDeoptId = -1;
   };
 
-  static DeoptInfo GetDeoptInfo(Code* code, byte* from);
+  static DeoptInfo GetDeoptInfo(Code* code, Address from);
 
   static int ComputeSourcePositionFromBytecodeArray(SharedFunctionInfo* shared,
                                                     BailoutId node_id);
 
   struct JumpTableEntry : public ZoneObject {
     inline JumpTableEntry(Address entry, const DeoptInfo& deopt_info,
-                          Deoptimizer::BailoutType type, bool frame)
+                          DeoptimizeKind kind, bool frame)
         : label(),
           address(entry),
           deopt_info(deopt_info),
-          bailout_type(type),
+          deopt_kind(kind),
           needs_frame(frame) {}
 
     bool IsEquivalentTo(const JumpTableEntry& other) const {
-      return address == other.address && bailout_type == other.bailout_type &&
+      return address == other.address && deopt_kind == other.deopt_kind &&
              needs_frame == other.needs_frame;
     }
 
     Label label;
     Address address;
     DeoptInfo deopt_info;
-    Deoptimizer::BailoutType bailout_type;
+    DeoptimizeKind deopt_kind;
     bool needs_frame;
   };
 
-  static const char* MessageFor(BailoutType type);
+  static const char* MessageFor(DeoptimizeKind kind);
 
   int output_count() const { return output_count_; }
 
   Handle<JSFunction> function() const;
   Handle<Code> compiled_code() const;
-  BailoutType bailout_type() const { return bailout_type_; }
+  DeoptimizeKind deopt_kind() const { return deopt_kind_; }
 
   // Number of created JS frames. Not all created frames are necessarily JS.
   int jsframe_count() const { return jsframe_count_; }
 
-  static Deoptimizer* New(JSFunction* function,
-                          BailoutType type,
-                          unsigned bailout_id,
-                          Address from,
-                          int fp_to_sp_delta,
+  static Deoptimizer* New(JSFunction* function, DeoptimizeKind kind,
+                          unsigned bailout_id, Address from, int fp_to_sp_delta,
                           Isolate* isolate);
   static Deoptimizer* Grab(Isolate* isolate);
 
@@ -470,10 +474,14 @@ class Deoptimizer : public Malloced {
   static void ComputeOutputFrames(Deoptimizer* deoptimizer);
 
   static Address GetDeoptimizationEntry(Isolate* isolate, int id,
-                                        BailoutType type);
-  static int GetDeoptimizationId(Isolate* isolate,
-                                 Address addr,
-                                 BailoutType type);
+                                        DeoptimizeKind kind);
+  static int GetDeoptimizationId(Isolate* isolate, Address addr,
+                                 DeoptimizeKind kind);
+
+  // Returns true if {addr} is a deoptimization entry and stores its type in
+  // {type}. Returns false if {addr} is not a deoptimization entry.
+  static bool IsDeoptimizationEntry(Isolate* isolate, Address addr,
+                                    DeoptimizeKind* type);
 
   // Code generation support.
   static int input_offset() { return OFFSET_OF(Deoptimizer, input_); }
@@ -493,14 +501,14 @@ class Deoptimizer : public Malloced {
   // Generators for the deoptimization entry code.
   class TableEntryGenerator BASE_EMBEDDED {
    public:
-    TableEntryGenerator(MacroAssembler* masm, BailoutType type, int count)
-        : masm_(masm), type_(type), count_(count) {}
+    TableEntryGenerator(MacroAssembler* masm, DeoptimizeKind kind, int count)
+        : masm_(masm), deopt_kind_(kind), count_(count) {}
 
     void Generate();
 
    protected:
     MacroAssembler* masm() const { return masm_; }
-    BailoutType type() const { return type_; }
+    DeoptimizeKind deopt_kind() const { return deopt_kind_; }
     Isolate* isolate() const { return masm_->isolate(); }
 
     void GeneratePrologue();
@@ -509,26 +517,33 @@ class Deoptimizer : public Malloced {
     int count() const { return count_; }
 
     MacroAssembler* masm_;
-    Deoptimizer::BailoutType type_;
+    DeoptimizeKind deopt_kind_;
     int count_;
   };
 
   static void EnsureCodeForDeoptimizationEntry(Isolate* isolate,
-                                               BailoutType type);
+                                               DeoptimizeKind kind);
   static void EnsureCodeForMaxDeoptimizationEntries(Isolate* isolate);
 
   Isolate* isolate() const { return isolate_; }
 
  private:
+  friend class FrameWriter;
+  void QueueValueForMaterialization(Address output_address, Object* obj,
+                                    const TranslatedFrame::iterator& iterator);
+
   static const int kMinNumberOfEntries = 64;
   static const int kMaxNumberOfEntries = 16384;
 
-  Deoptimizer(Isolate* isolate, JSFunction* function, BailoutType type,
+  Deoptimizer(Isolate* isolate, JSFunction* function, DeoptimizeKind kind,
               unsigned bailout_id, Address from, int fp_to_sp_delta);
   Code* FindOptimizedCode();
   void PrintFunctionName();
   void DeleteFrameDescriptions();
 
+  static bool IsInDeoptimizationTable(Isolate* isolate, Address addr,
+                                      DeoptimizeKind type);
+
   void DoComputeOutputFrames();
   void DoComputeInterpretedFrame(TranslatedFrame* translated_frame,
                                  int frame_index, bool goto_catch_handler);
@@ -554,17 +569,6 @@ class Deoptimizer : public Malloced {
                                     int frame_index,
                                     BuiltinContinuationMode mode);
 
-  void WriteTranslatedValueToOutput(
-      TranslatedFrame::iterator* iterator, int* input_index, int frame_index,
-      unsigned output_offset, const char* debug_hint_string = nullptr,
-      Address output_address_for_materialization = nullptr);
-  void WriteValueToOutput(Object* value, int input_index, int frame_index,
-                          unsigned output_offset,
-                          const char* debug_hint_string);
-  void DebugPrintOutputSlot(intptr_t value, int frame_index,
-                            unsigned output_offset,
-                            const char* debug_hint_string);
-
   unsigned ComputeInputFrameAboveFpFixedSize() const;
   unsigned ComputeInputFrameSize() const;
   static unsigned ComputeInterpretedFixedSize(SharedFunctionInfo* shared);
@@ -572,8 +576,8 @@ class Deoptimizer : public Malloced {
   static unsigned ComputeIncomingArgumentSize(SharedFunctionInfo* shared);
   static unsigned ComputeOutgoingArgumentSize(Code* code, unsigned bailout_id);
 
-  static void GenerateDeoptimizationEntries(
-      MacroAssembler* masm, int count, BailoutType type);
+  static void GenerateDeoptimizationEntries(MacroAssembler* masm, int count,
+                                            DeoptimizeKind kind);
 
   // Marks all the code in the given context for deoptimization.
   static void MarkAllCodeForContext(Context* native_context);
@@ -594,7 +598,7 @@ class Deoptimizer : public Malloced {
   JSFunction* function_;
   Code* compiled_code_;
   unsigned bailout_id_;
-  BailoutType bailout_type_;
+  DeoptimizeKind deopt_kind_;
   Address from_;
   int fp_to_sp_delta_;
   bool deoptimizing_throw_;
@@ -845,7 +849,11 @@ class DeoptimizerData {
 
  private:
   Heap* heap_;
-  Code* deopt_entry_code_[Deoptimizer::kLastBailoutType + 1];
+  static const int kLastDeoptimizeKind =
+      static_cast<int>(DeoptimizeKind::kLastDeoptimizeKind);
+  Code* deopt_entry_code_[kLastDeoptimizeKind + 1];
+  Code* deopt_entry_code(DeoptimizeKind kind);
+  void set_deopt_entry_code(DeoptimizeKind kind, Code* code);
 
   Deoptimizer* current_;
 
@@ -1025,12 +1033,6 @@ class DeoptimizedFrameInfo : public Malloced {
   // Get the frame context.
   Handle<Object> GetContext() { return context_; }
 
-  // Check if this frame is preceded by construct stub frame.  The bottom-most
-  // inlined frame might still be called by an uninlined construct stub.
-  bool HasConstructStub() {
-    return has_construct_stub_;
-  }
-
   // Get an incoming argument.
   Handle<Object> GetParameter(int index) {
     DCHECK(0 <= index && index < parameters_count());
@@ -1062,7 +1064,6 @@ class DeoptimizedFrameInfo : public Malloced {
 
   Handle<JSFunction> function_;
   Handle<Object> context_;
-  bool has_construct_stub_;
   std::vector<Handle<Object> > parameters_;
   std::vector<Handle<Object> > expression_stack_;
   int source_position_;
diff --git a/deps/v8/src/disassembler.cc b/deps/v8/src/disassembler.cc
index 263f502a9f52c7..6a9d8deee0622c 100644
--- a/deps/v8/src/disassembler.cc
+++ b/deps/v8/src/disassembler.cc
@@ -8,6 +8,7 @@
 #include <vector>
 
 #include "src/assembler-inl.h"
+#include "src/code-reference.h"
 #include "src/code-stubs.h"
 #include "src/debug/debug.h"
 #include "src/deoptimizer.h"
@@ -27,39 +28,46 @@ namespace internal {
 
 class V8NameConverter: public disasm::NameConverter {
  public:
-  explicit V8NameConverter(Code* code) : code_(code) {}
+  explicit V8NameConverter(Isolate* isolate, CodeReference code = {})
+      : isolate_(isolate), code_(code) {}
   virtual const char* NameOfAddress(byte* pc) const;
   virtual const char* NameInCode(byte* addr) const;
-  Code* code() const { return code_; }
+  const CodeReference& code() const { return code_; }
+
  private:
-  Code* code_;
+  Isolate* isolate_;
+  CodeReference code_;
 
   EmbeddedVector<char, 128> v8_buffer_;
 };
 
 
 const char* V8NameConverter::NameOfAddress(byte* pc) const {
-  if (code_ != nullptr) {
-    Isolate* isolate = code_->GetIsolate();
-    const char* name = isolate->builtins()->Lookup(pc);
+  if (!code_.is_null()) {
+    const char* name =
+        isolate_ ? isolate_->builtins()->Lookup(reinterpret_cast<Address>(pc))
+                 : nullptr;
 
     if (name != nullptr) {
       SNPrintF(v8_buffer_, "%p  (%s)", static_cast<void*>(pc), name);
       return v8_buffer_.start();
     }
 
-    int offs = static_cast<int>(pc - code_->raw_instruction_start());
+    int offs = static_cast<int>(reinterpret_cast<Address>(pc) -
+                                code_.instruction_start());
     // print as code offset, if it seems reasonable
-    if (0 <= offs && offs < code_->raw_instruction_size()) {
+    if (0 <= offs && offs < code_.instruction_size()) {
       SNPrintF(v8_buffer_, "%p  <+0x%x>", static_cast<void*>(pc), offs);
       return v8_buffer_.start();
     }
 
     wasm::WasmCode* wasm_code =
-        isolate->wasm_engine()->code_manager()->LookupCode(pc);
+        isolate_ ? isolate_->wasm_engine()->code_manager()->LookupCode(
+                       reinterpret_cast<Address>(pc))
+                 : nullptr;
     if (wasm_code != nullptr) {
       SNPrintF(v8_buffer_, "%p  (%s)", static_cast<void*>(pc),
-               GetWasmCodeKindAsString(wasm_code->kind()));
+               wasm::GetWasmCodeKindAsString(wasm_code->kind()));
       return v8_buffer_.start();
     }
   }
@@ -71,7 +79,7 @@ const char* V8NameConverter::NameOfAddress(byte* pc) const {
 const char* V8NameConverter::NameInCode(byte* addr) const {
   // The V8NameConverter is used for well known code, so we can "safely"
   // dereference pointers in generated code.
-  return (code_ != nullptr) ? reinterpret_cast<const char*>(addr) : "";
+  return code_.is_null() ? "" : reinterpret_cast<const char*>(addr);
 }
 
 
@@ -85,7 +93,7 @@ static const int kOutBufferSize = 2048 + String::kMaxShortPrintLength;
 static const int kRelocInfoPosition = 57;
 
 static void PrintRelocInfo(StringBuilder* out, Isolate* isolate,
-                           const ExternalReferenceEncoder& ref_encoder,
+                           const ExternalReferenceEncoder* ref_encoder,
                            std::ostream* os, RelocInfo* relocinfo,
                            bool first_reloc_info = true) {
   // Indent the printing of the reloc info.
@@ -119,12 +127,15 @@ static void PrintRelocInfo(StringBuilder* out, Isolate* isolate,
     std::unique_ptr<char[]> obj_name = accumulator.ToCString();
     out->AddFormatted("    ;; object: %s", obj_name.get());
   } else if (rmode == RelocInfo::EXTERNAL_REFERENCE) {
-    const char* reference_name = ref_encoder.NameOfAddress(
-        isolate, relocinfo->target_external_reference());
+    const char* reference_name =
+        ref_encoder ? ref_encoder->NameOfAddress(
+                          isolate, relocinfo->target_external_reference())
+                    : "unknown";
     out->AddFormatted("    ;; external reference (%s)", reference_name);
-  } else if (RelocInfo::IsCodeTarget(rmode)) {
+  } else if (RelocInfo::IsCodeTargetMode(rmode)) {
     out->AddFormatted("    ;; code:");
-    Code* code = Code::GetCodeFromTargetAddress(relocinfo->target_address());
+    Code* code = isolate->heap()->GcSafeFindCodeForInnerPointer(
+        relocinfo->target_address());
     Code::Kind kind = code->kind();
     if (kind == Code::STUB) {
       // Get the STUB key and extract major and minor key.
@@ -140,46 +151,33 @@ static void PrintRelocInfo(StringBuilder* out, Isolate* isolate,
     } else {
       out->AddFormatted(" %s", Code::Kind2String(kind));
     }
-  } else if (RelocInfo::IsRuntimeEntry(rmode) &&
+  } else if (RelocInfo::IsRuntimeEntry(rmode) && isolate &&
              isolate->deoptimizer_data() != nullptr) {
-    // A runtime entry reloinfo might be a deoptimization bailout->
+    // A runtime entry relocinfo might be a deoptimization bailout.
     Address addr = relocinfo->target_address();
-    int id =
-        Deoptimizer::GetDeoptimizationId(isolate, addr, Deoptimizer::EAGER);
-    if (id == Deoptimizer::kNotDeoptimizationEntry) {
-      id = Deoptimizer::GetDeoptimizationId(isolate, addr, Deoptimizer::LAZY);
-      if (id == Deoptimizer::kNotDeoptimizationEntry) {
-        id = Deoptimizer::GetDeoptimizationId(isolate, addr, Deoptimizer::SOFT);
-        if (id == Deoptimizer::kNotDeoptimizationEntry) {
-          out->AddFormatted("    ;; %s", RelocInfo::RelocModeName(rmode));
-        } else {
-          out->AddFormatted("    ;; soft deoptimization bailout %d", id);
-        }
-      } else {
-        out->AddFormatted("    ;; lazy deoptimization bailout %d", id);
-      }
+    DeoptimizeKind type;
+    if (Deoptimizer::IsDeoptimizationEntry(isolate, addr, &type)) {
+      int id = relocinfo->GetDeoptimizationId(isolate, type);
+      out->AddFormatted("    ;; %s deoptimization bailout %d",
+                        Deoptimizer::MessageFor(type), id);
     } else {
-      out->AddFormatted("    ;; deoptimization bailout %d", id);
+      out->AddFormatted("    ;; %s", RelocInfo::RelocModeName(rmode));
     }
   } else {
     out->AddFormatted("    ;; %s", RelocInfo::RelocModeName(rmode));
   }
 }
 
-static int DecodeIt(Isolate* isolate, std::ostream* os,
-                    const V8NameConverter& converter, byte* begin, byte* end,
-                    void* current_pc) {
-  SealHandleScope shs(isolate);
-  DisallowHeapAllocation no_alloc;
-  ExternalReferenceEncoder ref_encoder(isolate);
-
+static int DecodeIt(Isolate* isolate, ExternalReferenceEncoder* ref_encoder,
+                    std::ostream* os, const V8NameConverter& converter,
+                    byte* begin, byte* end, Address current_pc) {
   v8::internal::EmbeddedVector<char, 128> decode_buffer;
   v8::internal::EmbeddedVector<char, kOutBufferSize> out_buffer;
   StringBuilder out(out_buffer.start(), out_buffer.length());
   byte* pc = begin;
   disasm::Disassembler d(converter);
   RelocIterator* it = nullptr;
-  if (converter.code() != nullptr) {
+  if (!converter.code().is_null()) {
     it = new RelocIterator(converter.code());
   } else {
     // No relocation information when printing code stubs.
@@ -203,7 +201,8 @@ static int DecodeIt(Isolate* isolate, std::ostream* os,
                  *reinterpret_cast<int32_t*>(pc), num_const);
         constants = num_const;
         pc += 4;
-      } else if (it != nullptr && !it->done() && it->rinfo()->pc() == pc &&
+      } else if (it != nullptr && !it->done() &&
+                 it->rinfo()->pc() == reinterpret_cast<Address>(pc) &&
                  it->rinfo()->rmode() == RelocInfo::INTERNAL_REFERENCE) {
         // raw pointer embedded in code stream, e.g., jump table
         byte* ptr = *reinterpret_cast<byte**>(pc);
@@ -219,11 +218,11 @@ static int DecodeIt(Isolate* isolate, std::ostream* os,
 
     // Collect RelocInfo for this instruction (prev_pc .. pc-1)
     std::vector<const char*> comments;
-    std::vector<byte*> pcs;
+    std::vector<Address> pcs;
     std::vector<RelocInfo::Mode> rmodes;
     std::vector<intptr_t> datas;
     if (it != nullptr) {
-      while (!it->done() && it->rinfo()->pc() < pc) {
+      while (!it->done() && it->rinfo()->pc() < reinterpret_cast<Address>(pc)) {
         if (RelocInfo::IsComment(it->rinfo()->rmode())) {
           // For comments just collect the text.
           comments.push_back(
@@ -245,7 +244,7 @@ static int DecodeIt(Isolate* isolate, std::ostream* os,
     }
 
     // Instruction address and instruction offset.
-    if (FLAG_log_colour && prev_pc == current_pc) {
+    if (FLAG_log_colour && reinterpret_cast<Address>(prev_pc) == current_pc) {
       // If this is the given "current" pc, make it yellow and bold.
       out.AddFormatted("\033[33;1m");
     }
@@ -258,9 +257,10 @@ static int DecodeIt(Isolate* isolate, std::ostream* os,
     // Print all the reloc info for this instruction which are not comments.
     for (size_t i = 0; i < pcs.size(); i++) {
       // Put together the reloc info
-      Code* host = converter.code();
-      RelocInfo relocinfo(pcs[i], rmodes[i], datas[i], host);
-      relocinfo.set_constant_pool(host ? host->constant_pool() : nullptr);
+      const CodeReference& host = converter.code();
+      Address constant_pool =
+          host.is_null() ? kNullAddress : host.constant_pool();
+      RelocInfo relocinfo(pcs[i], rmodes[i], datas[i], nullptr, constant_pool);
 
       bool first_reloc_info = (i == 0);
       PrintRelocInfo(&out, isolate, ref_encoder, os, &relocinfo,
@@ -270,10 +270,11 @@ static int DecodeIt(Isolate* isolate, std::ostream* os,
     // If this is a constant pool load and we haven't found any RelocInfo
     // already, check if we can find some RelocInfo for the target address in
     // the constant pool.
-    if (pcs.empty() && converter.code() != nullptr) {
-      RelocInfo dummy_rinfo(prev_pc, RelocInfo::NONE, 0, nullptr);
+    if (pcs.empty() && !converter.code().is_null()) {
+      RelocInfo dummy_rinfo(reinterpret_cast<Address>(prev_pc), RelocInfo::NONE,
+                            0, nullptr);
       if (dummy_rinfo.IsInConstantPool()) {
-        byte* constant_pool_entry_address =
+        Address constant_pool_entry_address =
             dummy_rinfo.constant_pool_entry_address();
         RelocIterator reloc_it(converter.code());
         while (!reloc_it.done()) {
@@ -288,7 +289,7 @@ static int DecodeIt(Isolate* isolate, std::ostream* os,
       }
     }
 
-    if (FLAG_log_colour && prev_pc == current_pc) {
+    if (FLAG_log_colour && reinterpret_cast<Address>(prev_pc) == current_pc) {
       out.AddFormatted("\033[m");
     }
 
@@ -311,15 +312,26 @@ static int DecodeIt(Isolate* isolate, std::ostream* os,
 }
 
 int Disassembler::Decode(Isolate* isolate, std::ostream* os, byte* begin,
-                         byte* end, Code* code, void* current_pc) {
-  V8NameConverter v8NameConverter(code);
-  return DecodeIt(isolate, os, v8NameConverter, begin, end, current_pc);
+                         byte* end, CodeReference code, Address current_pc) {
+  V8NameConverter v8NameConverter(isolate, code);
+  if (isolate) {
+    // We have an isolate, so support external reference names.
+    SealHandleScope shs(isolate);
+    DisallowHeapAllocation no_alloc;
+    ExternalReferenceEncoder ref_encoder(isolate);
+    return DecodeIt(isolate, &ref_encoder, os, v8NameConverter, begin, end,
+                    current_pc);
+  } else {
+    // No isolate => isolate-independent code. No external reference names.
+    return DecodeIt(nullptr, nullptr, os, v8NameConverter, begin, end,
+                    current_pc);
+  }
 }
 
 #else  // ENABLE_DISASSEMBLER
 
 int Disassembler::Decode(Isolate* isolate, std::ostream* os, byte* begin,
-                         byte* end, Code* code, void* current_pc) {
+                         byte* end, CodeReference code, Address current_pc) {
   return 0;
 }
 
diff --git a/deps/v8/src/disassembler.h b/deps/v8/src/disassembler.h
index 51ed0bf196cecc..deb98ca140927e 100644
--- a/deps/v8/src/disassembler.h
+++ b/deps/v8/src/disassembler.h
@@ -6,6 +6,7 @@
 #define V8_DISASSEMBLER_H_
 
 #include "src/allocation.h"
+#include "src/code-reference.h"
 
 namespace v8 {
 namespace internal {
@@ -16,8 +17,9 @@ class Disassembler : public AllStatic {
   // code into os. Returns the number of bytes disassembled or 1 if no
   // instruction could be decoded.
   // the code object is used for name resolution and may be null.
+  // TODO(titzer): accept a {WasmCodeManager*} if {isolate} is null
   static int Decode(Isolate* isolate, std::ostream* os, byte* begin, byte* end,
-                    Code* code = nullptr, void* current_pc = nullptr);
+                    CodeReference code = {}, Address current_pc = kNullAddress);
 };
 
 }  // namespace internal
diff --git a/deps/v8/src/eh-frame.cc b/deps/v8/src/eh-frame.cc
index f0e413cf33edba..7b1addb4f1f80b 100644
--- a/deps/v8/src/eh-frame.cc
+++ b/deps/v8/src/eh-frame.cc
@@ -577,7 +577,8 @@ void EhFrameDisassembler::DumpDwarfDirectives(std::ostream& stream,  // NOLINT
 
 void EhFrameDisassembler::DisassembleToStream(std::ostream& stream) {  // NOLINT
   // The encoded CIE size does not include the size field itself.
-  const int cie_size = ReadUnalignedUInt32(start_) + kInt32Size;
+  const int cie_size =
+      ReadUnalignedUInt32(reinterpret_cast<Address>(start_)) + kInt32Size;
   const int fde_offset = cie_size;
 
   const byte* cie_directives_start =
@@ -588,13 +589,15 @@ void EhFrameDisassembler::DisassembleToStream(std::ostream& stream) {  // NOLINT
   stream << reinterpret_cast<const void*>(start_) << "  .eh_frame: CIE\n";
   DumpDwarfDirectives(stream, cie_directives_start, cie_directives_end);
 
-  const byte* procedure_offset_address =
-      start_ + fde_offset + EhFrameConstants::kProcedureAddressOffsetInFde;
+  Address procedure_offset_address =
+      reinterpret_cast<Address>(start_) + fde_offset +
+      EhFrameConstants::kProcedureAddressOffsetInFde;
   int32_t procedure_offset =
       ReadUnalignedValue<int32_t>(procedure_offset_address);
 
-  const byte* procedure_size_address =
-      start_ + fde_offset + EhFrameConstants::kProcedureSizeOffsetInFde;
+  Address procedure_size_address = reinterpret_cast<Address>(start_) +
+                                   fde_offset +
+                                   EhFrameConstants::kProcedureSizeOffsetInFde;
   uint32_t procedure_size = ReadUnalignedUInt32(procedure_size_address);
 
   const byte* fde_start = start_ + fde_offset;
diff --git a/deps/v8/src/eh-frame.h b/deps/v8/src/eh-frame.h
index 68a8c031c093b8..5aa61520bb31f1 100644
--- a/deps/v8/src/eh-frame.h
+++ b/deps/v8/src/eh-frame.h
@@ -140,10 +140,14 @@ class V8_EXPORT_PRIVATE EhFrameWriter {
     WriteBytes(reinterpret_cast<const byte*>(&value), sizeof(value));
   }
   void PatchInt32(int base_offset, uint32_t value) {
-    DCHECK_EQ(ReadUnalignedUInt32(eh_frame_buffer_.data() + base_offset),
-              kInt32Placeholder);
+    DCHECK_EQ(
+        ReadUnalignedUInt32(reinterpret_cast<Address>(eh_frame_buffer_.data()) +
+                            base_offset),
+        kInt32Placeholder);
     DCHECK_LT(base_offset + kInt32Size, eh_frame_offset());
-    WriteUnalignedUInt32(eh_frame_buffer_.data() + base_offset, value);
+    WriteUnalignedUInt32(
+        reinterpret_cast<Address>(eh_frame_buffer_.data()) + base_offset,
+        value);
   }
 
   // Write the common information entry, which includes encoding specifiers,
@@ -209,7 +213,7 @@ class V8_EXPORT_PRIVATE EhFrameIterator {
 
   void SkipCie() {
     DCHECK_EQ(next_, start_);
-    next_ += ReadUnalignedUInt32(next_) + kInt32Size;
+    next_ += ReadUnalignedUInt32(reinterpret_cast<Address>(next_)) + kInt32Size;
   }
 
   void SkipToFdeDirectives() {
@@ -260,7 +264,7 @@ class V8_EXPORT_PRIVATE EhFrameIterator {
   T GetNextValue() {
     T result;
     DCHECK_LE(next_ + sizeof(result), end_);
-    result = ReadUnalignedValue<T>(next_);
+    result = ReadUnalignedValue<T>(reinterpret_cast<Address>(next_));
     next_ += sizeof(result);
     return result;
   }
diff --git a/deps/v8/src/elements-kind.cc b/deps/v8/src/elements-kind.cc
index 0905677c3c14be..95bfc2e93de47f 100644
--- a/deps/v8/src/elements-kind.cc
+++ b/deps/v8/src/elements-kind.cc
@@ -49,6 +49,9 @@ int ElementsKindToShiftSize(ElementsKind elements_kind) {
   UNREACHABLE();
 }
 
+int ElementsKindToByteSize(ElementsKind elements_kind) {
+  return 1 << ElementsKindToShiftSize(elements_kind);
+}
 
 int GetDefaultHeaderSizeForElementsKind(ElementsKind elements_kind) {
   STATIC_ASSERT(FixedArray::kHeaderSize == FixedDoubleArray::kHeaderSize);
diff --git a/deps/v8/src/elements-kind.h b/deps/v8/src/elements-kind.h
index b00966ef1091d6..88c5350b4d3baf 100644
--- a/deps/v8/src/elements-kind.h
+++ b/deps/v8/src/elements-kind.h
@@ -74,6 +74,7 @@ const int kFastElementsKindPackedToHoley =
     HOLEY_SMI_ELEMENTS - PACKED_SMI_ELEMENTS;
 
 int ElementsKindToShiftSize(ElementsKind elements_kind);
+int ElementsKindToByteSize(ElementsKind elements_kind);
 int GetDefaultHeaderSizeForElementsKind(ElementsKind elements_kind);
 const char* ElementsKindToString(ElementsKind kind);
 
@@ -264,6 +265,7 @@ inline bool IsTransitionableFastElementsKind(ElementsKind from_kind) {
          from_kind != TERMINAL_FAST_ELEMENTS_KIND;
 }
 
+inline bool ElementsKindEqual(ElementsKind a, ElementsKind b) { return a == b; }
 
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/src/elements.cc b/deps/v8/src/elements.cc
index 27abf624106b70..1e4983ca63be12 100644
--- a/deps/v8/src/elements.cc
+++ b/deps/v8/src/elements.cc
@@ -11,6 +11,8 @@
 #include "src/isolate-inl.h"
 #include "src/messages.h"
 #include "src/objects-inl.h"
+#include "src/objects/arguments-inl.h"
+#include "src/objects/hash-table-inl.h"
 #include "src/utils.h"
 
 // Each concrete ElementsAccessor can handle exactly one ElementsKind,
@@ -117,13 +119,18 @@ MaybeHandle<Object> ThrowArrayLengthRangeError(Isolate* isolate) {
                   Object);
 }
 
+WriteBarrierMode GetWriteBarrierMode(ElementsKind kind) {
+  if (IsSmiElementsKind(kind)) return SKIP_WRITE_BARRIER;
+  if (IsDoubleElementsKind(kind)) return SKIP_WRITE_BARRIER;
+  return UPDATE_WRITE_BARRIER;
+}
 
-void CopyObjectToObjectElements(FixedArrayBase* from_base,
+void CopyObjectToObjectElements(Isolate* isolate, FixedArrayBase* from_base,
                                 ElementsKind from_kind, uint32_t from_start,
                                 FixedArrayBase* to_base, ElementsKind to_kind,
                                 uint32_t to_start, int raw_copy_size) {
-  DCHECK(to_base->map() !=
-      from_base->GetIsolate()->heap()->fixed_cow_array_map());
+  ReadOnlyRoots roots(isolate);
+  DCHECK(to_base->map() != roots.fixed_cow_array_map());
   DisallowHeapAllocation no_allocation;
   int copy_size = raw_copy_size;
   if (raw_copy_size < 0) {
@@ -135,9 +142,8 @@ void CopyObjectToObjectElements(FixedArrayBase* from_base,
       int start = to_start + copy_size;
       int length = to_base->length() - start;
       if (length > 0) {
-        Heap* heap = from_base->GetHeap();
         MemsetPointer(FixedArray::cast(to_base)->data_start() + start,
-                      heap->the_hole_value(), length);
+                      roots.the_hole_value(), length);
       }
     }
   }
@@ -159,10 +165,10 @@ void CopyObjectToObjectElements(FixedArrayBase* from_base,
   }
 }
 
-
 static void CopyDictionaryToObjectElements(
-    FixedArrayBase* from_base, uint32_t from_start, FixedArrayBase* to_base,
-    ElementsKind to_kind, uint32_t to_start, int raw_copy_size) {
+    Isolate* isolate, FixedArrayBase* from_base, uint32_t from_start,
+    FixedArrayBase* to_base, ElementsKind to_kind, uint32_t to_start,
+    int raw_copy_size) {
   DisallowHeapAllocation no_allocation;
   NumberDictionary* from = NumberDictionary::cast(from_base);
   int copy_size = raw_copy_size;
@@ -174,9 +180,8 @@ static void CopyDictionaryToObjectElements(
       int start = to_start + copy_size;
       int length = to_base->length() - start;
       if (length > 0) {
-        Heap* heap = from->GetHeap();
         MemsetPointer(FixedArray::cast(to_base)->data_start() + start,
-                      heap->the_hole_value(), length);
+                      ReadOnlyRoots(isolate).the_hole_value(), length);
       }
     }
   }
@@ -188,9 +193,7 @@ static void CopyDictionaryToObjectElements(
   if (to_start + copy_size > to_length) {
     copy_size = to_length - to_start;
   }
-  WriteBarrierMode write_barrier_mode =
-      IsObjectElementsKind(to_kind) ? UPDATE_WRITE_BARRIER : SKIP_WRITE_BARRIER;
-  Isolate* isolate = from->GetIsolate();
+  WriteBarrierMode write_barrier_mode = GetWriteBarrierMode(to_kind);
   for (int i = 0; i < copy_size; i++) {
     int entry = from->FindEntry(isolate, i + from_start);
     if (entry != NumberDictionary::kNotFound) {
@@ -207,7 +210,8 @@ static void CopyDictionaryToObjectElements(
 // NOTE: this method violates the handlified function signature convention:
 // raw pointer parameters in the function that allocates.
 // See ElementsAccessorBase::CopyElements() for details.
-static void CopyDoubleToObjectElements(FixedArrayBase* from_base,
+static void CopyDoubleToObjectElements(Isolate* isolate,
+                                       FixedArrayBase* from_base,
                                        uint32_t from_start,
                                        FixedArrayBase* to_base,
                                        uint32_t to_start, int raw_copy_size) {
@@ -225,9 +229,8 @@ static void CopyDoubleToObjectElements(FixedArrayBase* from_base,
       int start = to_start;
       int length = to_base->length() - start;
       if (length > 0) {
-        Heap* heap = from_base->GetHeap();
         MemsetPointer(FixedArray::cast(to_base)->data_start() + start,
-                      heap->the_hole_value(), length);
+                      ReadOnlyRoots(isolate).the_hole_value(), length);
       }
     }
   }
@@ -238,7 +241,6 @@ static void CopyDoubleToObjectElements(FixedArrayBase* from_base,
 
   // From here on, the code below could actually allocate. Therefore the raw
   // values are wrapped into handles.
-  Isolate* isolate = from_base->GetIsolate();
   Handle<FixedDoubleArray> from(FixedDoubleArray::cast(from_base), isolate);
   Handle<FixedArray> to(FixedArray::cast(to_base), isolate);
 
@@ -312,7 +314,7 @@ static void CopySmiToDoubleElements(FixedArrayBase* from_base,
   if (copy_size == 0) return;
   FixedArray* from = FixedArray::cast(from_base);
   FixedDoubleArray* to = FixedDoubleArray::cast(to_base);
-  Object* the_hole = from->GetHeap()->the_hole_value();
+  Object* the_hole = from->GetReadOnlyRoots().the_hole_value();
   for (uint32_t from_end = from_start + static_cast<uint32_t>(copy_size);
        from_start < from_end; from_start++, to_start++) {
     Object* hole_or_smi = from->get(from_start);
@@ -358,7 +360,7 @@ static void CopyPackedSmiToDoubleElements(FixedArrayBase* from_base,
   for (uint32_t from_end = from_start + static_cast<uint32_t>(packed_size);
        from_start < from_end; from_start++, to_start++) {
     Object* smi = from->get(from_start);
-    DCHECK(!smi->IsTheHole(from->GetIsolate()));
+    DCHECK(!smi->IsTheHole());
     to->set(to_start, Smi::ToInt(smi));
   }
 }
@@ -385,7 +387,7 @@ static void CopyObjectToDoubleElements(FixedArrayBase* from_base,
   if (copy_size == 0) return;
   FixedArray* from = FixedArray::cast(from_base);
   FixedDoubleArray* to = FixedDoubleArray::cast(to_base);
-  Object* the_hole = from->GetHeap()->the_hole_value();
+  Object* the_hole = from->GetReadOnlyRoots().the_hole_value();
   for (uint32_t from_end = from_start + copy_size;
        from_start < from_end; from_start++, to_start++) {
     Object* hole_or_object = from->get(from_start);
@@ -397,12 +399,9 @@ static void CopyObjectToDoubleElements(FixedArrayBase* from_base,
   }
 }
 
-
-static void CopyDictionaryToDoubleElements(FixedArrayBase* from_base,
-                                           uint32_t from_start,
-                                           FixedArrayBase* to_base,
-                                           uint32_t to_start,
-                                           int raw_copy_size) {
+static void CopyDictionaryToDoubleElements(
+    Isolate* isolate, FixedArrayBase* from_base, uint32_t from_start,
+    FixedArrayBase* to_base, uint32_t to_start, int raw_copy_size) {
   DisallowHeapAllocation no_allocation;
   NumberDictionary* from = NumberDictionary::cast(from_base);
   int copy_size = raw_copy_size;
@@ -422,7 +421,6 @@ static void CopyDictionaryToDoubleElements(FixedArrayBase* from_base,
   if (to_start + copy_size > to_length) {
     copy_size = to_length - to_start;
   }
-  Isolate* isolate = from->GetIsolate();
   for (int i = 0; i < copy_size; i++) {
     int entry = from->FindEntry(isolate, i + from_start);
     if (entry != NumberDictionary::kNotFound) {
@@ -441,9 +439,10 @@ static void TraceTopFrame(Isolate* isolate) {
   }
   StackFrame* raw_frame = it.frame();
   if (raw_frame->is_internal()) {
-    Code* apply_builtin =
-        isolate->builtins()->builtin(Builtins::kFunctionPrototypeApply);
-    if (raw_frame->unchecked_code() == apply_builtin) {
+    Code* current_code_object =
+        isolate->heap()->GcSafeFindCodeForInnerPointer(raw_frame->pc());
+    if (current_code_object->builtin_index() ==
+        Builtins::kFunctionPrototypeApply) {
       PrintF("apply from ");
       it.Advance();
       raw_frame = it.frame();
@@ -453,31 +452,28 @@ static void TraceTopFrame(Isolate* isolate) {
 }
 
 static void SortIndices(
-    Handle<FixedArray> indices, uint32_t sort_size,
+    Isolate* isolate, Handle<FixedArray> indices, uint32_t sort_size,
     WriteBarrierMode write_barrier_mode = UPDATE_WRITE_BARRIER) {
-  struct {
-    bool operator()(const base::AtomicElement<Object*>& elementA,
-                    const base::AtomicElement<Object*>& elementB) {
-      const Object* a = elementA.value();
-      const Object* b = elementB.value();
-      if (a->IsSmi() || !a->IsUndefined(HeapObject::cast(a)->GetIsolate())) {
-        if (!b->IsSmi() && b->IsUndefined(HeapObject::cast(b)->GetIsolate())) {
-          return true;
-        }
-        return a->Number() < b->Number();
-      }
-      return !b->IsSmi() && b->IsUndefined(HeapObject::cast(b)->GetIsolate());
-    }
-  } cmp;
   // Use AtomicElement wrapper to ensure that std::sort uses atomic load and
   // store operations that are safe for concurrent marking.
   base::AtomicElement<Object*>* start =
       reinterpret_cast<base::AtomicElement<Object*>*>(
           indices->GetFirstElementAddress());
-  std::sort(start, start + sort_size, cmp);
+  std::sort(start, start + sort_size,
+            [isolate](const base::AtomicElement<Object*>& elementA,
+                      const base::AtomicElement<Object*>& elementB) {
+              const Object* a = elementA.value();
+              const Object* b = elementB.value();
+              if (a->IsSmi() || !a->IsUndefined(isolate)) {
+                if (!b->IsSmi() && b->IsUndefined(isolate)) {
+                  return true;
+                }
+                return a->Number() < b->Number();
+              }
+              return !b->IsSmi() && b->IsUndefined(isolate);
+            });
   if (write_barrier_mode != SKIP_WRITE_BARRIER) {
-    FIXED_ARRAY_ELEMENTS_WRITE_BARRIER(indices->GetIsolate()->heap(), *indices,
-                                       0, sort_size);
+    FIXED_ARRAY_ELEMENTS_WRITE_BARRIER(isolate->heap(), *indices, 0, sort_size);
   }
 }
 
@@ -593,7 +589,7 @@ class ElementsAccessorBase : public InternalElementsAccessor {
                            uint32_t start, uint32_t end) {
     DisallowHeapAllocation no_gc;
     if (IsFastPackedElementsKind(kind())) return true;
-    Isolate* isolate = backing_store->GetIsolate();
+    Isolate* isolate = holder->GetIsolate();
     for (uint32_t i = start; i < end; i++) {
       if (!Subclass::HasElementImpl(isolate, holder, i, backing_store,
                                     ALL_PROPERTIES)) {
@@ -605,7 +601,8 @@ class ElementsAccessorBase : public InternalElementsAccessor {
 
   static void TryTransitionResultArrayToPacked(Handle<JSArray> array) {
     if (!IsHoleyOrDictionaryElementsKind(kind())) return;
-    Handle<FixedArrayBase> backing_store(array->elements());
+    Handle<FixedArrayBase> backing_store(array->elements(),
+                                         array->GetIsolate());
     int length = Smi::ToInt(array->length());
     if (!Subclass::IsPackedImpl(*array, *backing_store, 0, length)) {
       return;
@@ -755,7 +752,7 @@ class ElementsAccessorBase : public InternalElementsAccessor {
 
   void SetLength(Handle<JSArray> array, uint32_t length) final {
     Subclass::SetLengthImpl(array->GetIsolate(), array, length,
-                            handle(array->elements()));
+                            handle(array->elements(), array->GetIsolate()));
   }
 
   static void SetLengthImpl(Isolate* isolate, Handle<JSArray> array,
@@ -868,7 +865,7 @@ class ElementsAccessorBase : public InternalElementsAccessor {
       packed_size = Smi::ToInt(JSArray::cast(*object)->length());
     }
 
-    Subclass::CopyElementsImpl(*old_elements, src_index, *new_elements,
+    Subclass::CopyElementsImpl(isolate, *old_elements, src_index, *new_elements,
                                from_kind, dst_index, packed_size, copy_size);
 
     return new_elements;
@@ -876,7 +873,7 @@ class ElementsAccessorBase : public InternalElementsAccessor {
 
   static void TransitionElementsKindImpl(Handle<JSObject> object,
                                          Handle<Map> to_map) {
-    Handle<Map> from_map = handle(object->map());
+    Handle<Map> from_map = handle(object->map(), object->GetIsolate());
     ElementsKind from_kind = from_map->elements_kind();
     ElementsKind to_kind = to_map->elements_kind();
     if (IsHoleyElementsKind(from_kind)) {
@@ -888,8 +885,10 @@ class ElementsAccessorBase : public InternalElementsAccessor {
       DCHECK(IsFastElementsKind(to_kind));
       DCHECK_NE(TERMINAL_FAST_ELEMENTS_KIND, from_kind);
 
-      Handle<FixedArrayBase> from_elements(object->elements());
-      if (object->elements() == object->GetHeap()->empty_fixed_array() ||
+      Handle<FixedArrayBase> from_elements(object->elements(),
+                                           object->GetIsolate());
+      if (object->elements() ==
+              object->GetReadOnlyRoots().empty_fixed_array() ||
           IsDoubleElementsKind(from_kind) == IsDoubleElementsKind(to_kind)) {
         // No change is needed to the elements() buffer, the transition
         // only requires a map change.
@@ -904,9 +903,9 @@ class ElementsAccessorBase : public InternalElementsAccessor {
         JSObject::SetMapAndElements(object, to_map, elements);
       }
       if (FLAG_trace_elements_transitions) {
-        JSObject::PrintElementsTransition(stdout, object, from_kind,
-                                          from_elements, to_kind,
-                                          handle(object->elements()));
+        JSObject::PrintElementsTransition(
+            stdout, object, from_kind, from_elements, to_kind,
+            handle(object->elements(), object->GetIsolate()));
       }
     }
   }
@@ -920,7 +919,8 @@ class ElementsAccessorBase : public InternalElementsAccessor {
       // prototype object, make sure all of these optimizations are invalidated.
       object->GetIsolate()->UpdateNoElementsProtectorOnSetLength(object);
     }
-    Handle<FixedArrayBase> old_elements(object->elements());
+    Handle<FixedArrayBase> old_elements(object->elements(),
+                                        object->GetIsolate());
     // This method should only be called if there's a reason to update the
     // elements.
     DCHECK(IsDoubleElementsKind(from_kind) != IsDoubleElementsKind(kind()) ||
@@ -966,7 +966,8 @@ class ElementsAccessorBase : public InternalElementsAccessor {
         object->WouldConvertToSlowElements(index)) {
       return false;
     }
-    Handle<FixedArrayBase> old_elements(object->elements());
+    Handle<FixedArrayBase> old_elements(object->elements(),
+                                        object->GetIsolate());
     uint32_t new_capacity = JSObject::NewElementsCapacity(index + 1);
     DCHECK(static_cast<uint32_t>(old_elements->length()) < new_capacity);
     Handle<FixedArrayBase> elements =
@@ -987,10 +988,10 @@ class ElementsAccessorBase : public InternalElementsAccessor {
     Subclass::DeleteImpl(obj, entry);
   }
 
-  static void CopyElementsImpl(FixedArrayBase* from, uint32_t from_start,
-                               FixedArrayBase* to, ElementsKind from_kind,
-                               uint32_t to_start, int packed_size,
-                               int copy_size) {
+  static void CopyElementsImpl(Isolate* isolate, FixedArrayBase* from,
+                               uint32_t from_start, FixedArrayBase* to,
+                               ElementsKind from_kind, uint32_t to_start,
+                               int packed_size, int copy_size) {
     UNREACHABLE();
   }
 
@@ -1016,14 +1017,15 @@ class ElementsAccessorBase : public InternalElementsAccessor {
     // copying from object with fast double elements to object with object
     // elements. In all the other cases there are no allocations performed and
     // handle creation causes noticeable performance degradation of the builtin.
-    Subclass::CopyElementsImpl(from, from_start, *to, from_kind, to_start,
-                               packed_size, copy_size);
+    Subclass::CopyElementsImpl(from_holder->GetIsolate(), from, from_start, *to,
+                               from_kind, to_start, packed_size, copy_size);
   }
 
-  void CopyElements(Handle<FixedArrayBase> source, ElementsKind source_kind,
+  void CopyElements(Isolate* isolate, Handle<FixedArrayBase> source,
+                    ElementsKind source_kind,
                     Handle<FixedArrayBase> destination, int size) {
-    Subclass::CopyElementsImpl(*source, 0, *destination, source_kind, 0,
-                               kPackedSizeNotKnown, size);
+    Subclass::CopyElementsImpl(isolate, *source, 0, *destination, source_kind,
+                               0, kPackedSizeNotKnown, size);
   }
 
   void CopyTypedArrayElementsSlice(JSTypedArray* source,
@@ -1051,7 +1053,8 @@ class ElementsAccessorBase : public InternalElementsAccessor {
   }
 
   Handle<NumberDictionary> Normalize(Handle<JSObject> object) final {
-    return Subclass::NormalizeImpl(object, handle(object->elements()));
+    return Subclass::NormalizeImpl(
+        object, handle(object->elements(), object->GetIsolate()));
   }
 
   static Handle<NumberDictionary> NormalizeImpl(
@@ -1237,7 +1240,7 @@ class ElementsAccessorBase : public InternalElementsAccessor {
         combined_keys, &nof_indices);
 
     if (needs_sorting) {
-      SortIndices(combined_keys, nof_indices);
+      SortIndices(isolate, combined_keys, nof_indices);
       // Indices from dictionary elements should only be converted after
       // sorting.
       if (convert == GetKeysConversion::kConvertToString) {
@@ -1250,8 +1253,9 @@ class ElementsAccessorBase : public InternalElementsAccessor {
     }
 
     // Copy over the passed-in property keys.
-    CopyObjectToObjectElements(*keys, PACKED_ELEMENTS, 0, *combined_keys,
-                               PACKED_ELEMENTS, nof_indices, nof_property_keys);
+    CopyObjectToObjectElements(isolate, *keys, PACKED_ELEMENTS, 0,
+                               *combined_keys, PACKED_ELEMENTS, nof_indices,
+                               nof_property_keys);
 
     // For holey elements and arguments we might have to shrink the collected
     // keys since the estimates might be off.
@@ -1260,7 +1264,7 @@ class ElementsAccessorBase : public InternalElementsAccessor {
       // Shrink combined_keys to the final size.
       int final_size = nof_indices + nof_property_keys;
       DCHECK_LE(final_size, combined_keys->length());
-      combined_keys->Shrink(final_size);
+      return FixedArray::ShrinkOrEmpty(combined_keys, final_size);
     }
 
     return combined_keys;
@@ -1461,8 +1465,10 @@ class DictionaryElementsAccessor
             }
           }
 
-          // Update the number of elements.
-          dict->ElementsRemoved(removed_entries);
+          if (removed_entries > 0) {
+            // Update the number of elements.
+            dict->ElementsRemoved(removed_entries);
+          }
         }
       }
     }
@@ -1471,10 +1477,10 @@ class DictionaryElementsAccessor
     array->set_length(*length_obj);
   }
 
-  static void CopyElementsImpl(FixedArrayBase* from, uint32_t from_start,
-                               FixedArrayBase* to, ElementsKind from_kind,
-                               uint32_t to_start, int packed_size,
-                               int copy_size) {
+  static void CopyElementsImpl(Isolate* isolate, FixedArrayBase* from,
+                               uint32_t from_start, FixedArrayBase* to,
+                               ElementsKind from_kind, uint32_t to_start,
+                               int packed_size, int copy_size) {
     UNREACHABLE();
   }
 
@@ -1489,7 +1495,7 @@ class DictionaryElementsAccessor
     JSObject::NormalizeElements(result_array);
     result_array->set_length(Smi::FromInt(result_length));
     Handle<NumberDictionary> source_dict(
-        NumberDictionary::cast(receiver->elements()));
+        NumberDictionary::cast(receiver->elements()), isolate);
     int entry_count = source_dict->Capacity();
     for (int i = 0; i < entry_count; i++) {
       Object* key = source_dict->KeyAt(i);
@@ -1497,7 +1503,7 @@ class DictionaryElementsAccessor
       uint64_t key_value = NumberToInt64(key);
       if (key_value >= start && key_value < end) {
         Handle<NumberDictionary> dest_dict(
-            NumberDictionary::cast(result_array->elements()));
+            NumberDictionary::cast(result_array->elements()), isolate);
         Handle<Object> value(source_dict->ValueAt(i), isolate);
         PropertyDetails details = source_dict->DetailsAt(i);
         PropertyAttributes attr = details.attributes();
@@ -1510,7 +1516,8 @@ class DictionaryElementsAccessor
   }
 
   static void DeleteImpl(Handle<JSObject> obj, uint32_t entry) {
-    Handle<NumberDictionary> dict(NumberDictionary::cast(obj->elements()));
+    Handle<NumberDictionary> dict(NumberDictionary::cast(obj->elements()),
+                                  obj->GetIsolate());
     dict = NumberDictionary::DeleteEntry(dict, entry);
     obj->set_elements(*dict);
   }
@@ -1521,7 +1528,7 @@ class DictionaryElementsAccessor
     NumberDictionary* dict = NumberDictionary::cast(backing_store);
     if (!dict->requires_slow_elements()) return false;
     int capacity = dict->Capacity();
-    Isolate* isolate = dict->GetIsolate();
+    Isolate* isolate = holder->GetIsolate();
     for (int i = 0; i < capacity; i++) {
       Object* key = dict->KeyAt(i);
       if (!dict->IsKey(isolate, key)) continue;
@@ -1572,7 +1579,8 @@ class DictionaryElementsAccessor
     Handle<NumberDictionary> dictionary =
         object->HasFastElements() || object->HasFastStringWrapperElements()
             ? JSObject::NormalizeElements(object)
-            : handle(NumberDictionary::cast(object->elements()));
+            : handle(NumberDictionary::cast(object->elements()),
+                     object->GetIsolate());
     Handle<NumberDictionary> new_dictionary =
         NumberDictionary::Add(dictionary, index, value, details);
     new_dictionary->UpdateMaxNumberKey(index, object);
@@ -1663,7 +1671,7 @@ class DictionaryElementsAccessor
       elements->set(insertion_index, raw_key);
       insertion_index++;
     }
-    SortIndices(elements, insertion_index);
+    SortIndices(isolate, elements, insertion_index);
     for (int i = 0; i < insertion_index; i++) {
       keys->AddKey(elements->get(i));
     }
@@ -1715,8 +1723,8 @@ class DictionaryElementsAccessor
     DisallowHeapAllocation no_gc;
     NumberDictionary* dictionary = NumberDictionary::cast(receiver->elements());
     int capacity = dictionary->Capacity();
-    Object* the_hole = isolate->heap()->the_hole_value();
-    Object* undefined = isolate->heap()->undefined_value();
+    Object* the_hole = ReadOnlyRoots(isolate).the_hole_value();
+    Object* undefined = ReadOnlyRoots(isolate).undefined_value();
 
     // Scan for accessor properties. If accessors are present, then elements
     // must be accessed in order via the slow path.
@@ -1930,7 +1938,7 @@ class FastElementsAccessor : public ElementsAccessorBase<Subclass, KindTraits> {
 
   static Handle<NumberDictionary> NormalizeImpl(Handle<JSObject> object,
                                                 Handle<FixedArrayBase> store) {
-    Isolate* isolate = store->GetIsolate();
+    Isolate* isolate = object->GetIsolate();
     ElementsKind kind = Subclass::kind();
 
     // Ensure that notifications fire if the array or object prototypes are
@@ -1972,7 +1980,7 @@ class FastElementsAccessor : public ElementsAccessorBase<Subclass, KindTraits> {
       if (!backing_store->is_the_hole(isolate, entry - 1)) break;
     }
     if (entry == 0) {
-      FixedArray* empty = isolate->heap()->empty_fixed_array();
+      FixedArray* empty = ReadOnlyRoots(isolate).empty_fixed_array();
       // Dynamically ask for the elements kind here since we manually redirect
       // the operations for argument backing stores.
       if (obj->GetElementsKind() == FAST_SLOPPY_ARGUMENTS_ELEMENTS) {
@@ -2006,7 +2014,7 @@ class FastElementsAccessor : public ElementsAccessorBase<Subclass, KindTraits> {
     // has too few used values, normalize it.
     const int kMinLengthForSparsenessCheck = 64;
     if (backing_store->length() < kMinLengthForSparsenessCheck) return;
-    if (backing_store->GetHeap()->InNewSpace(*backing_store)) return;
+    if (Heap::InNewSpace(*backing_store)) return;
     uint32_t length = 0;
     if (obj->IsJSArray()) {
       JSArray::cast(*obj)->length()->ToArrayLength(&length);
@@ -2098,7 +2106,7 @@ class FastElementsAccessor : public ElementsAccessorBase<Subclass, KindTraits> {
     if (IsSmiOrObjectElementsKind(KindTraits::Kind)) {
       JSObject::EnsureWritableFastElements(obj);
     }
-    DeleteCommon(obj, entry, handle(obj->elements()));
+    DeleteCommon(obj, entry, handle(obj->elements(), obj->GetIsolate()));
   }
 
   static bool HasEntryImpl(Isolate* isolate, FixedArrayBase* backing_store,
@@ -2139,10 +2147,10 @@ class FastElementsAccessor : public ElementsAccessorBase<Subclass, KindTraits> {
     FixedArrayBase* elements = holder->elements();
     Map* map = elements->map();
     if (IsSmiOrObjectElementsKind(KindTraits::Kind)) {
-      DCHECK_NE(map, heap->fixed_double_array_map());
+      DCHECK_NE(map, ReadOnlyRoots(heap).fixed_double_array_map());
     } else if (IsDoubleElementsKind(KindTraits::Kind)) {
-      DCHECK_NE(map, heap->fixed_cow_array_map());
-      if (map == heap->fixed_array_map()) DCHECK_EQ(0, length);
+      DCHECK_NE(map, ReadOnlyRoots(heap).fixed_cow_array_map());
+      if (map == ReadOnlyRoots(heap).fixed_array_map()) DCHECK_EQ(0, length);
     } else {
       UNREACHABLE();
     }
@@ -2179,14 +2187,16 @@ class FastElementsAccessor : public ElementsAccessorBase<Subclass, KindTraits> {
 
   static uint32_t PushImpl(Handle<JSArray> receiver,
                            Arguments* args, uint32_t push_size) {
-    Handle<FixedArrayBase> backing_store(receiver->elements());
+    Handle<FixedArrayBase> backing_store(receiver->elements(),
+                                         receiver->GetIsolate());
     return Subclass::AddArguments(receiver, backing_store, args, push_size,
                                   AT_END);
   }
 
   static uint32_t UnshiftImpl(Handle<JSArray> receiver,
                               Arguments* args, uint32_t unshift_size) {
-    Handle<FixedArrayBase> backing_store(receiver->elements());
+    Handle<FixedArrayBase> backing_store(receiver->elements(),
+                                         receiver->GetIsolate());
     return Subclass::AddArguments(receiver, backing_store, args, unshift_size,
                                   AT_START);
   }
@@ -2199,9 +2209,9 @@ class FastElementsAccessor : public ElementsAccessorBase<Subclass, KindTraits> {
     Handle<JSArray> result_array = isolate->factory()->NewJSArray(
         KindTraits::Kind, result_len, result_len);
     DisallowHeapAllocation no_gc;
-    Subclass::CopyElementsImpl(*backing_store, start, result_array->elements(),
-                               KindTraits::Kind, 0, kPackedSizeNotKnown,
-                               result_len);
+    Subclass::CopyElementsImpl(isolate, *backing_store, start,
+                               result_array->elements(), KindTraits::Kind, 0,
+                               kPackedSizeNotKnown, result_len);
     Subclass::TryTransitionResultArrayToPacked(result_array);
     return result_array;
   }
@@ -2224,7 +2234,7 @@ class FastElementsAccessor : public ElementsAccessorBase<Subclass, KindTraits> {
     Handle<FixedArrayBase> backing_store(receiver->elements(), isolate);
 
     if (new_length == 0) {
-      receiver->set_elements(heap->empty_fixed_array());
+      receiver->set_elements(ReadOnlyRoots(heap).empty_fixed_array());
       receiver->set_length(Smi::kZero);
       return isolate->factory()->NewJSArrayWithElements(
           backing_store, KindTraits::Kind, delete_count);
@@ -2235,7 +2245,7 @@ class FastElementsAccessor : public ElementsAccessorBase<Subclass, KindTraits> {
         KindTraits::Kind, delete_count, delete_count);
     if (delete_count > 0) {
       DisallowHeapAllocation no_gc;
-      Subclass::CopyElementsImpl(*backing_store, start,
+      Subclass::CopyElementsImpl(isolate, *backing_store, start,
                                  deleted_elements->elements(), KindTraits::Kind,
                                  0, kPackedSizeNotKnown, delete_count);
     }
@@ -2258,26 +2268,6 @@ class FastElementsAccessor : public ElementsAccessorBase<Subclass, KindTraits> {
     return deleted_elements;
   }
 
-  static Maybe<bool> CollectValuesOrEntriesImpl(
-      Isolate* isolate, Handle<JSObject> object,
-      Handle<FixedArray> values_or_entries, bool get_entries, int* nof_items,
-      PropertyFilter filter) {
-    Handle<BackingStore> elements(BackingStore::cast(object->elements()),
-                                  isolate);
-    int count = 0;
-    uint32_t length = elements->length();
-    for (uint32_t index = 0; index < length; ++index) {
-      if (!HasEntryImpl(isolate, *elements, index)) continue;
-      Handle<Object> value = Subclass::GetImpl(isolate, *elements, index);
-      if (get_entries) {
-        value = MakeEntryPair(isolate, index, value);
-      }
-      values_or_entries->set(count++, *value);
-    }
-    *nof_items = count;
-    return Just(true);
-  }
-
   static void MoveElements(Isolate* isolate, Handle<JSArray> receiver,
                            Handle<FixedArrayBase> backing_store, int dst_index,
                            int src_index, int len, int hole_start,
@@ -2286,6 +2276,9 @@ class FastElementsAccessor : public ElementsAccessorBase<Subclass, KindTraits> {
     Handle<BackingStore> dst_elms = Handle<BackingStore>::cast(backing_store);
     if (len > JSArray::kMaxCopyElements && dst_index == 0 &&
         heap->CanMoveObjectStart(*dst_elms)) {
+      // Remove all the pointers to the FixedArrayBase we're going to left trim
+      // from the heap.
+      receiver->set_elements(ReadOnlyRoots(heap).empty_fixed_array());
       // Update all the copies of this backing_store handle.
       *dst_elms.location() =
           BackingStore::cast(heap->LeftTrimFixedArray(*dst_elms, src_index));
@@ -2300,8 +2293,9 @@ class FastElementsAccessor : public ElementsAccessorBase<Subclass, KindTraits> {
                 dst_elms->data_start() + src_index, len * kDoubleSize);
       } else {
         DisallowHeapAllocation no_gc;
+        WriteBarrierMode mode = GetWriteBarrierMode(KindTraits::Kind);
         heap->MoveElements(FixedArray::cast(*dst_elms), dst_index, src_index,
-                           len);
+                           len, mode);
       }
     }
     if (hole_start != hole_end) {
@@ -2316,8 +2310,8 @@ class FastElementsAccessor : public ElementsAccessorBase<Subclass, KindTraits> {
     DCHECK(JSObject::PrototypeHasNoElements(isolate, *receiver));
     DisallowHeapAllocation no_gc;
     FixedArrayBase* elements_base = receiver->elements();
-    Object* the_hole = isolate->heap()->the_hole_value();
-    Object* undefined = isolate->heap()->undefined_value();
+    Object* the_hole = ReadOnlyRoots(isolate).the_hole_value();
+    Object* undefined = ReadOnlyRoots(isolate).undefined_value();
     Object* value = *search_value;
 
     // Elements beyond the capacity of the backing store treated as undefined.
@@ -2511,8 +2505,8 @@ class FastElementsAccessor : public ElementsAccessorBase<Subclass, KindTraits> {
     Handle<FixedArrayBase> new_elms = Subclass::ConvertElementsWithCapacity(
         receiver, backing_store, KindTraits::Kind, capacity, start);
     // Copy the trailing elements after start + delete_count
-    Subclass::CopyElementsImpl(*backing_store, start + delete_count, *new_elms,
-                               KindTraits::Kind, start + add_count,
+    Subclass::CopyElementsImpl(isolate, *backing_store, start + delete_count,
+                               *new_elms, KindTraits::Kind, start + add_count,
                                kPackedSizeNotKnown,
                                ElementsAccessor::kCopyToEndAndInitializeToHole);
     receiver->set_elements(*new_elms);
@@ -2592,7 +2586,7 @@ class FastElementsAccessor : public ElementsAccessorBase<Subclass, KindTraits> {
     WriteBarrierMode mode = raw_backing_store->GetWriteBarrierMode(no_gc);
     for (uint32_t i = 0; i < copy_size; i++) {
       Object* argument = (*args)[src_index + i];
-      DCHECK(!argument->IsTheHole(raw_backing_store->GetIsolate()));
+      DCHECK(!argument->IsTheHole());
       Subclass::SetImpl(raw_backing_store, dst_index + i, argument, mode);
     }
   }
@@ -2630,10 +2624,10 @@ class FastSmiOrObjectElementsAccessor
   // See ElementsAccessor::CopyElements() for details.
   // This method could actually allocate if copying from double elements to
   // object elements.
-  static void CopyElementsImpl(FixedArrayBase* from, uint32_t from_start,
-                               FixedArrayBase* to, ElementsKind from_kind,
-                               uint32_t to_start, int packed_size,
-                               int copy_size) {
+  static void CopyElementsImpl(Isolate* isolate, FixedArrayBase* from,
+                               uint32_t from_start, FixedArrayBase* to,
+                               ElementsKind from_kind, uint32_t to_start,
+                               int packed_size, int copy_size) {
     DisallowHeapAllocation no_gc;
     ElementsKind to_kind = KindTraits::Kind;
     switch (from_kind) {
@@ -2641,19 +2635,20 @@ class FastSmiOrObjectElementsAccessor
       case HOLEY_SMI_ELEMENTS:
       case PACKED_ELEMENTS:
       case HOLEY_ELEMENTS:
-        CopyObjectToObjectElements(from, from_kind, from_start, to, to_kind,
-                                   to_start, copy_size);
+        CopyObjectToObjectElements(isolate, from, from_kind, from_start, to,
+                                   to_kind, to_start, copy_size);
         break;
       case PACKED_DOUBLE_ELEMENTS:
       case HOLEY_DOUBLE_ELEMENTS: {
         AllowHeapAllocation allow_allocation;
         DCHECK(IsObjectElementsKind(to_kind));
-        CopyDoubleToObjectElements(from, from_start, to, to_start, copy_size);
+        CopyDoubleToObjectElements(isolate, from, from_start, to, to_start,
+                                   copy_size);
         break;
       }
       case DICTIONARY_ELEMENTS:
-        CopyDictionaryToObjectElements(from, from_start, to, to_kind, to_start,
-                                       copy_size);
+        CopyDictionaryToObjectElements(isolate, from, from_start, to, to_kind,
+                                       to_start, copy_size);
         break;
       case FAST_SLOPPY_ARGUMENTS_ELEMENTS:
       case SLOW_SLOPPY_ARGUMENTS_ELEMENTS:
@@ -2671,6 +2666,37 @@ class FastSmiOrObjectElementsAccessor
     }
   }
 
+  static Maybe<bool> CollectValuesOrEntriesImpl(
+      Isolate* isolate, Handle<JSObject> object,
+      Handle<FixedArray> values_or_entries, bool get_entries, int* nof_items,
+      PropertyFilter filter) {
+    int count = 0;
+    if (get_entries) {
+      // Collecting entries needs to allocate, so this code must be handlified.
+      Handle<FixedArray> elements(FixedArray::cast(object->elements()),
+                                  isolate);
+      uint32_t length = elements->length();
+      for (uint32_t index = 0; index < length; ++index) {
+        if (!Subclass::HasEntryImpl(isolate, *elements, index)) continue;
+        Handle<Object> value = Subclass::GetImpl(isolate, *elements, index);
+        value = MakeEntryPair(isolate, index, value);
+        values_or_entries->set(count++, *value);
+      }
+    } else {
+      // No allocations here, so we can avoid handlification overhead.
+      DisallowHeapAllocation no_gc;
+      FixedArray* elements = FixedArray::cast(object->elements());
+      uint32_t length = elements->length();
+      for (uint32_t index = 0; index < length; ++index) {
+        if (!Subclass::HasEntryImpl(isolate, elements, index)) continue;
+        Object* value = GetRaw(elements, index);
+        values_or_entries->set(count++, value);
+      }
+    }
+    *nof_items = count;
+    return Just(true);
+  }
+
   static Maybe<int64_t> IndexOfValueImpl(Isolate* isolate,
                                          Handle<JSObject> receiver,
                                          Handle<Object> search_value,
@@ -2770,10 +2796,10 @@ class FastDoubleElementsAccessor
     FixedDoubleArray::cast(backing_store)->set(entry, value->Number());
   }
 
-  static void CopyElementsImpl(FixedArrayBase* from, uint32_t from_start,
-                               FixedArrayBase* to, ElementsKind from_kind,
-                               uint32_t to_start, int packed_size,
-                               int copy_size) {
+  static void CopyElementsImpl(Isolate* isolate, FixedArrayBase* from,
+                               uint32_t from_start, FixedArrayBase* to,
+                               ElementsKind from_kind, uint32_t to_start,
+                               int packed_size, int copy_size) {
     DisallowHeapAllocation no_allocation;
     switch (from_kind) {
       case PACKED_SMI_ELEMENTS:
@@ -2792,7 +2818,7 @@ class FastDoubleElementsAccessor
         CopyObjectToDoubleElements(from, from_start, to, to_start, copy_size);
         break;
       case DICTIONARY_ELEMENTS:
-        CopyDictionaryToDoubleElements(from, from_start, to, to_start,
+        CopyDictionaryToDoubleElements(isolate, from, from_start, to, to_start,
                                        copy_size);
         break;
       case FAST_SLOPPY_ARGUMENTS_ELEMENTS:
@@ -2810,6 +2836,26 @@ class FastDoubleElementsAccessor
     }
   }
 
+  static Maybe<bool> CollectValuesOrEntriesImpl(
+      Isolate* isolate, Handle<JSObject> object,
+      Handle<FixedArray> values_or_entries, bool get_entries, int* nof_items,
+      PropertyFilter filter) {
+    Handle<FixedDoubleArray> elements(
+        FixedDoubleArray::cast(object->elements()), isolate);
+    int count = 0;
+    uint32_t length = elements->length();
+    for (uint32_t index = 0; index < length; ++index) {
+      if (!Subclass::HasEntryImpl(isolate, *elements, index)) continue;
+      Handle<Object> value = Subclass::GetImpl(isolate, *elements, index);
+      if (get_entries) {
+        value = MakeEntryPair(isolate, index, value);
+      }
+      values_or_entries->set(count++, *value);
+    }
+    *nof_items = count;
+    return Just(true);
+  }
+
   static Maybe<int64_t> IndexOfValueImpl(Isolate* isolate,
                                          Handle<JSObject> receiver,
                                          Handle<Object> search_value,
@@ -2964,7 +3010,7 @@ class TypedElementsAccessor
                                               KeyAccumulator* accumulator,
                                               AddKeyConversion convert) {
     Isolate* isolate = receiver->GetIsolate();
-    Handle<FixedArrayBase> elements(receiver->elements());
+    Handle<FixedArrayBase> elements(receiver->elements(), isolate);
     uint32_t length = AccessorClass::GetCapacityImpl(*receiver, *elements);
     for (uint32_t i = 0; i < length; i++) {
       Handle<Object> value = AccessorClass::GetImpl(isolate, *elements, i);
@@ -2978,7 +3024,7 @@ class TypedElementsAccessor
       PropertyFilter filter) {
     int count = 0;
     if ((filter & ONLY_CONFIGURABLE) == 0) {
-      Handle<FixedArrayBase> elements(object->elements());
+      Handle<FixedArrayBase> elements(object->elements(), isolate);
       uint32_t length = AccessorClass::GetCapacityImpl(*object, *elements);
       for (uint32_t index = 0; index < length; ++index) {
         Handle<Object> value =
@@ -3193,7 +3239,8 @@ class TypedElementsAccessor
     DCHECK(!WasNeutered(*object));
     DCHECK(object->IsJSTypedArray());
     Handle<FixedArray> result = isolate->factory()->NewFixedArray(length);
-    Handle<BackingStore> elements(BackingStore::cast(object->elements()));
+    Handle<BackingStore> elements(BackingStore::cast(object->elements()),
+                                  isolate);
     for (uint32_t i = 0; i < length; i++) {
       Handle<Object> value = AccessorClass::GetImpl(isolate, *elements, i);
       result->set(i, *value);
@@ -3367,6 +3414,16 @@ class TypedElementsAccessor
     DisallowHeapAllocation no_gc;
     DisallowJavascriptExecution no_js(isolate);
 
+    size_t current_length;
+    DCHECK(source->length()->IsNumber() &&
+           TryNumberToSize(source->length(), &current_length) &&
+           length <= current_length);
+    USE(current_length);
+
+    size_t dest_length = destination->length_value();
+    DCHECK(length + offset <= dest_length);
+    USE(dest_length);
+
     ElementsKind kind = source->GetElementsKind();
     BackingStore* dest = BackingStore::cast(destination->elements());
 
@@ -3377,7 +3434,7 @@ class TypedElementsAccessor
     // the hole into undefined.
     if (HoleyPrototypeLookupRequired(isolate, context, source)) return false;
 
-    Object* undefined = isolate->heap()->undefined_value();
+    Object* undefined = ReadOnlyRoots(isolate).undefined_value();
 
     // Fastpath for packed Smi kind.
     if (kind == PACKED_SMI_ELEMENTS) {
@@ -3437,7 +3494,7 @@ class TypedElementsAccessor
                                         size_t length, uint32_t offset) {
     Isolate* isolate = destination->GetIsolate();
     Handle<BackingStore> destination_elements(
-        BackingStore::cast(destination->elements()));
+        BackingStore::cast(destination->elements()), isolate);
     for (uint32_t i = 0; i < length; i++) {
       LookupIterator it(isolate, source, i);
       Handle<Object> elem;
@@ -3504,6 +3561,7 @@ class TypedElementsAccessor
       // If we have to copy more elements than we have in the source, we need to
       // do special handling and conversion; that happens in the slow case.
       if (length + offset <= source_ta->length_value()) {
+        DCHECK(length == 0 || !source_ta->WasNeutered());
         CopyElementsFromTypedArray(*source_ta, *destination_ta, length, offset);
         return *isolate->factory()->undefined_value();
       }
@@ -3511,10 +3569,17 @@ class TypedElementsAccessor
 
     // Fast cases for packed numbers kinds where we don't need to allocate.
     if (source->IsJSArray()) {
-      Handle<JSArray> source_array = Handle<JSArray>::cast(source);
-      if (TryCopyElementsFastNumber(isolate->context(), *source_array,
-                                    *destination_ta, length, offset)) {
-        return *isolate->factory()->undefined_value();
+      Handle<JSArray> source_js_array = Handle<JSArray>::cast(source);
+      size_t current_length;
+      if (source_js_array->length()->IsNumber() &&
+          TryNumberToSize(source_js_array->length(), &current_length)) {
+        if (length <= current_length) {
+          Handle<JSArray> source_array = Handle<JSArray>::cast(source);
+          if (TryCopyElementsFastNumber(isolate->context(), *source_array,
+                                        *destination_ta, length, offset)) {
+            return *isolate->factory()->undefined_value();
+          }
+        }
       }
     }
     // Final generic case that handles prototype chain lookups, getters, proxies
@@ -3590,10 +3655,10 @@ class SloppyArgumentsElementsAccessor
       // Store context mapped entry.
       DisallowHeapAllocation no_gc;
       Object* probe = elements->get_mapped_entry(entry);
-      DCHECK(!probe->IsTheHole(store->GetIsolate()));
+      DCHECK(!probe->IsTheHole());
       Context* context = elements->context();
       int context_entry = Smi::ToInt(probe);
-      DCHECK(!context->get(context_entry)->IsTheHole(store->GetIsolate()));
+      DCHECK(!context->get(context_entry)->IsTheHole());
       context->set(context_entry, value);
     } else {
       //  Entry is not context mapped defer to arguments.
@@ -3603,7 +3668,7 @@ class SloppyArgumentsElementsAccessor
         AliasedArgumentsEntry* alias = AliasedArgumentsEntry::cast(current);
         Context* context = elements->context();
         int context_entry = alias->aliased_context_slot();
-        DCHECK(!context->get(context_entry)->IsTheHole(store->GetIsolate()));
+        DCHECK(!context->get(context_entry)->IsTheHole());
         context->set(context_entry, value);
       } else {
         ArgumentsAccessor::SetImpl(arguments, entry - length, value);
@@ -3728,7 +3793,7 @@ class SloppyArgumentsElementsAccessor
 
   static void DeleteImpl(Handle<JSObject> obj, uint32_t entry) {
     Handle<SloppyArgumentsElements> elements(
-        SloppyArgumentsElements::cast(obj->elements()));
+        SloppyArgumentsElements::cast(obj->elements()), obj->GetIsolate());
     uint32_t length = elements->parameter_map_length();
     uint32_t delete_or_entry = entry;
     if (entry < length) {
@@ -3738,7 +3803,8 @@ class SloppyArgumentsElementsAccessor
     // SloppyDeleteImpl allocates a new dictionary elements store. For making
     // heap verification happy we postpone clearing out the mapped entry.
     if (entry < length) {
-      elements->set_mapped_entry(entry, obj->GetHeap()->the_hole_value());
+      elements->set_mapped_entry(entry,
+                                 obj->GetReadOnlyRoots().the_hole_value());
     }
   }
 
@@ -3759,7 +3825,7 @@ class SloppyArgumentsElementsAccessor
     DirectCollectElementIndicesImpl(isolate, object, backing_store,
                                     GetKeysConversion::kKeepNumbers,
                                     ENUMERABLE_STRINGS, indices, &nof_indices);
-    SortIndices(indices, nof_indices);
+    SortIndices(isolate, indices, nof_indices);
     for (uint32_t i = 0; i < nof_indices; i++) {
       keys->AddKey(indices->get(i));
     }
@@ -3961,7 +4027,7 @@ class SlowSloppyArgumentsElementsAccessor
                               Handle<FixedArrayBase> store, uint32_t entry,
                               Handle<Object> value,
                               PropertyAttributes attributes) {
-    Isolate* isolate = store->GetIsolate();
+    Isolate* isolate = object->GetIsolate();
     Handle<SloppyArgumentsElements> elements =
         Handle<SloppyArgumentsElements>::cast(store);
     uint32_t length = elements->parameter_map_length();
@@ -3974,7 +4040,8 @@ class SlowSloppyArgumentsElementsAccessor
       context->set(context_entry, *value);
 
       // Redefining attributes of an aliased element destroys fast aliasing.
-      elements->set_mapped_entry(entry, isolate->heap()->the_hole_value());
+      elements->set_mapped_entry(entry,
+                                 ReadOnlyRoots(isolate).the_hole_value());
       // For elements that are still writable we re-establish slow aliasing.
       if ((attributes & READ_ONLY) == 0) {
         value = isolate->factory()->NewAliasedArgumentsEntry(context_entry);
@@ -4025,7 +4092,7 @@ class FastSloppyArgumentsElementsAccessor
   static Handle<NumberDictionary> NormalizeImpl(
       Handle<JSObject> object, Handle<FixedArrayBase> elements) {
     Handle<FixedArray> arguments =
-        GetArguments(elements->GetIsolate(), *elements);
+        GetArguments(object->GetIsolate(), *elements);
     return FastHoleyObjectElementsAccessor::NormalizeImpl(object, arguments);
   }
 
@@ -4079,23 +4146,23 @@ class FastSloppyArgumentsElementsAccessor
                               PropertyAttributes attributes) {
     DCHECK_EQ(object->elements(), *store);
     Handle<SloppyArgumentsElements> elements(
-        SloppyArgumentsElements::cast(*store));
+        SloppyArgumentsElements::cast(*store), object->GetIsolate());
     NormalizeArgumentsElements(object, elements, &entry);
     SlowSloppyArgumentsElementsAccessor::ReconfigureImpl(object, store, entry,
                                                          value, attributes);
   }
 
-  static void CopyElementsImpl(FixedArrayBase* from, uint32_t from_start,
-                               FixedArrayBase* to, ElementsKind from_kind,
-                               uint32_t to_start, int packed_size,
-                               int copy_size) {
+  static void CopyElementsImpl(Isolate* isolate, FixedArrayBase* from,
+                               uint32_t from_start, FixedArrayBase* to,
+                               ElementsKind from_kind, uint32_t to_start,
+                               int packed_size, int copy_size) {
     DCHECK(!to->IsDictionary());
     if (from_kind == SLOW_SLOPPY_ARGUMENTS_ELEMENTS) {
-      CopyDictionaryToObjectElements(from, from_start, to, HOLEY_ELEMENTS,
-                                     to_start, copy_size);
+      CopyDictionaryToObjectElements(isolate, from, from_start, to,
+                                     HOLEY_ELEMENTS, to_start, copy_size);
     } else {
       DCHECK_EQ(FAST_SLOPPY_ARGUMENTS_ELEMENTS, from_kind);
-      CopyObjectToObjectElements(from, HOLEY_ELEMENTS, from_start, to,
+      CopyObjectToObjectElements(isolate, from, HOLEY_ELEMENTS, from_start, to,
                                  HOLEY_ELEMENTS, to_start, copy_size);
     }
   }
@@ -4142,7 +4209,7 @@ class StringWrapperElementsAccessor
     uint32_t length = static_cast<uint32_t>(string->length());
     if (entry < length) {
       return isolate->factory()->LookupSingleCharacterStringFromCode(
-          String::Flatten(string)->Get(entry));
+          String::Flatten(isolate, string)->Get(entry));
     }
     return BackingStoreAccessor::GetImpl(isolate, holder->elements(),
                                          entry - length);
@@ -4224,7 +4291,7 @@ class StringWrapperElementsAccessor
                                               AddKeyConversion convert) {
     Isolate* isolate = receiver->GetIsolate();
     Handle<String> string(GetString(*receiver), isolate);
-    string = String::Flatten(string);
+    string = String::Flatten(isolate, string);
     uint32_t length = static_cast<uint32_t>(string->length());
     for (uint32_t i = 0; i < length; i++) {
       accumulator->AddKey(
@@ -4250,7 +4317,8 @@ class StringWrapperElementsAccessor
 
   static void GrowCapacityAndConvertImpl(Handle<JSObject> object,
                                          uint32_t capacity) {
-    Handle<FixedArrayBase> old_elements(object->elements());
+    Handle<FixedArrayBase> old_elements(object->elements(),
+                                        object->GetIsolate());
     ElementsKind from_kind = object->GetElementsKind();
     if (from_kind == FAST_STRING_WRAPPER_ELEMENTS) {
       // The optimizing compiler relies on the prototype lookups of String
@@ -4268,17 +4336,17 @@ class StringWrapperElementsAccessor
                                               capacity);
   }
 
-  static void CopyElementsImpl(FixedArrayBase* from, uint32_t from_start,
-                               FixedArrayBase* to, ElementsKind from_kind,
-                               uint32_t to_start, int packed_size,
-                               int copy_size) {
+  static void CopyElementsImpl(Isolate* isolate, FixedArrayBase* from,
+                               uint32_t from_start, FixedArrayBase* to,
+                               ElementsKind from_kind, uint32_t to_start,
+                               int packed_size, int copy_size) {
     DCHECK(!to->IsDictionary());
     if (from_kind == SLOW_STRING_WRAPPER_ELEMENTS) {
-      CopyDictionaryToObjectElements(from, from_start, to, HOLEY_ELEMENTS,
-                                     to_start, copy_size);
+      CopyDictionaryToObjectElements(isolate, from, from_start, to,
+                                     HOLEY_ELEMENTS, to_start, copy_size);
     } else {
       DCHECK_EQ(FAST_STRING_WRAPPER_ELEMENTS, from_kind);
-      CopyObjectToObjectElements(from, HOLEY_ELEMENTS, from_start, to,
+      CopyObjectToObjectElements(isolate, from, HOLEY_ELEMENTS, from_start, to,
                                  HOLEY_ELEMENTS, to_start, copy_size);
     }
   }
diff --git a/deps/v8/src/elements.h b/deps/v8/src/elements.h
index 385ae85ad168de..a7dab7daa54f25 100644
--- a/deps/v8/src/elements.h
+++ b/deps/v8/src/elements.h
@@ -106,8 +106,9 @@ class ElementsAccessor {
   inline MaybeHandle<FixedArray> PrependElementIndices(
       Handle<JSObject> object, Handle<FixedArray> keys,
       GetKeysConversion convert, PropertyFilter filter = ALL_PROPERTIES) {
-    return PrependElementIndices(object, handle(object->elements()), keys,
-                                 convert, filter);
+    return PrependElementIndices(
+        object, handle(object->elements(), object->GetIsolate()), keys, convert,
+        filter);
   }
 
   virtual void AddElementsToKeyAccumulator(Handle<JSObject> receiver,
@@ -180,7 +181,7 @@ class ElementsAccessor {
 
   virtual void Reverse(JSObject* receiver) = 0;
 
-  virtual void CopyElements(Handle<FixedArrayBase> source,
+  virtual void CopyElements(Isolate* isolate, Handle<FixedArrayBase> source,
                             ElementsKind source_kind,
                             Handle<FixedArrayBase> destination, int size) = 0;
 
diff --git a/deps/v8/src/execution.cc b/deps/v8/src/execution.cc
index 50e05a0e6e9a89..dc8f4fbb2cfa90 100644
--- a/deps/v8/src/execution.cc
+++ b/deps/v8/src/execution.cc
@@ -157,7 +157,7 @@ V8_WARN_UNUSED_RESULT MaybeHandle<Object> Invoke(
 
 #ifdef VERIFY_HEAP
   if (FLAG_verify_heap) {
-    value->ObjectVerify();
+    value->ObjectVerify(isolate);
   }
 #endif
 
@@ -244,7 +244,7 @@ MaybeHandle<Object> Execution::TryCall(
     if (maybe_result.is_null()) {
       DCHECK(isolate->has_pending_exception());
       if (isolate->pending_exception() ==
-          isolate->heap()->termination_exception()) {
+          ReadOnlyRoots(isolate).termination_exception()) {
         is_termination = true;
       } else {
         if (exception_out != nullptr) {
@@ -315,29 +315,56 @@ void StackGuard::DisableInterrupts() {
   reset_limits(access);
 }
 
-
-void StackGuard::PushPostponeInterruptsScope(PostponeInterruptsScope* scope) {
+void StackGuard::PushInterruptsScope(InterruptsScope* scope) {
   ExecutionAccess access(isolate_);
-  // Intercept already requested interrupts.
-  int intercepted = thread_local_.interrupt_flags_ & scope->intercept_mask_;
-  scope->intercepted_flags_ = intercepted;
-  thread_local_.interrupt_flags_ &= ~intercepted;
+  DCHECK_NE(scope->mode_, InterruptsScope::kNoop);
+  if (scope->mode_ == InterruptsScope::kPostponeInterrupts) {
+    // Intercept already requested interrupts.
+    int intercepted = thread_local_.interrupt_flags_ & scope->intercept_mask_;
+    scope->intercepted_flags_ = intercepted;
+    thread_local_.interrupt_flags_ &= ~intercepted;
+  } else {
+    DCHECK_EQ(scope->mode_, InterruptsScope::kRunInterrupts);
+    // Restore postponed interrupts.
+    int restored_flags = 0;
+    for (InterruptsScope* current = thread_local_.interrupt_scopes_;
+         current != nullptr; current = current->prev_) {
+      restored_flags |= (current->intercepted_flags_ & scope->intercept_mask_);
+      current->intercepted_flags_ &= ~scope->intercept_mask_;
+    }
+    thread_local_.interrupt_flags_ |= restored_flags;
+  }
   if (!has_pending_interrupts(access)) reset_limits(access);
   // Add scope to the chain.
-  scope->prev_ = thread_local_.postpone_interrupts_;
-  thread_local_.postpone_interrupts_ = scope;
+  scope->prev_ = thread_local_.interrupt_scopes_;
+  thread_local_.interrupt_scopes_ = scope;
 }
 
-
-void StackGuard::PopPostponeInterruptsScope() {
+void StackGuard::PopInterruptsScope() {
   ExecutionAccess access(isolate_);
-  PostponeInterruptsScope* top = thread_local_.postpone_interrupts_;
-  // Make intercepted interrupts active.
-  DCHECK_EQ(thread_local_.interrupt_flags_ & top->intercept_mask_, 0);
-  thread_local_.interrupt_flags_ |= top->intercepted_flags_;
+  InterruptsScope* top = thread_local_.interrupt_scopes_;
+  DCHECK_NE(top->mode_, InterruptsScope::kNoop);
+  if (top->mode_ == InterruptsScope::kPostponeInterrupts) {
+    // Make intercepted interrupts active.
+    DCHECK_EQ(thread_local_.interrupt_flags_ & top->intercept_mask_, 0);
+    thread_local_.interrupt_flags_ |= top->intercepted_flags_;
+  } else {
+    DCHECK_EQ(top->mode_, InterruptsScope::kRunInterrupts);
+    // Postpone existing interupts if needed.
+    if (top->prev_) {
+      for (int interrupt = 1; interrupt < ALL_INTERRUPTS;
+           interrupt = interrupt << 1) {
+        InterruptFlag flag = static_cast<InterruptFlag>(interrupt);
+        if ((thread_local_.interrupt_flags_ & flag) &&
+            top->prev_->Intercept(flag)) {
+          thread_local_.interrupt_flags_ &= ~flag;
+        }
+      }
+    }
+  }
   if (has_pending_interrupts(access)) set_interrupt_limits(access);
   // Remove scope from chain.
-  thread_local_.postpone_interrupts_ = top->prev_;
+  thread_local_.interrupt_scopes_ = top->prev_;
 }
 
 
@@ -349,9 +376,9 @@ bool StackGuard::CheckInterrupt(InterruptFlag flag) {
 
 void StackGuard::RequestInterrupt(InterruptFlag flag) {
   ExecutionAccess access(isolate_);
-  // Check the chain of PostponeInterruptsScopes for interception.
-  if (thread_local_.postpone_interrupts_ &&
-      thread_local_.postpone_interrupts_->Intercept(flag)) {
+  // Check the chain of InterruptsScope for interception.
+  if (thread_local_.interrupt_scopes_ &&
+      thread_local_.interrupt_scopes_->Intercept(flag)) {
     return;
   }
 
@@ -366,8 +393,8 @@ void StackGuard::RequestInterrupt(InterruptFlag flag) {
 
 void StackGuard::ClearInterrupt(InterruptFlag flag) {
   ExecutionAccess access(isolate_);
-  // Clear the interrupt flag from the chain of PostponeInterruptsScopes.
-  for (PostponeInterruptsScope* current = thread_local_.postpone_interrupts_;
+  // Clear the interrupt flag from the chain of InterruptsScope.
+  for (InterruptsScope* current = thread_local_.interrupt_scopes_;
        current != nullptr; current = current->prev_) {
     current->intercepted_flags_ &= ~flag;
   }
@@ -424,7 +451,7 @@ void StackGuard::ThreadLocal::Clear() {
   set_jslimit(kIllegalLimit);
   real_climit_ = kIllegalLimit;
   set_climit(kIllegalLimit);
-  postpone_interrupts_ = nullptr;
+  interrupt_scopes_ = nullptr;
   interrupt_flags_ = 0;
 }
 
@@ -441,7 +468,7 @@ bool StackGuard::ThreadLocal::Initialize(Isolate* isolate) {
     set_climit(limit);
     should_set_stack_limits = true;
   }
-  postpone_interrupts_ = nullptr;
+  interrupt_scopes_ = nullptr;
   interrupt_flags_ = 0;
   return should_set_stack_limits;
 }
@@ -468,13 +495,6 @@ void StackGuard::InitThread(const ExecutionAccess& lock) {
 // --- C a l l s   t o   n a t i v e s ---
 
 
-void StackGuard::HandleGCInterrupt() {
-  if (CheckAndClearInterrupt(GC_REQUEST)) {
-    isolate_->heap()->HandleGCRequest();
-  }
-}
-
-
 Object* StackGuard::HandleInterrupts() {
   if (FLAG_verify_predictable) {
     // Advance synthetic time by making a time request.
@@ -494,15 +514,6 @@ Object* StackGuard::HandleInterrupts() {
     isolate_->heap()->HandleGCRequest();
   }
 
-  if (CheckDebugBreak()) {
-    if (FLAG_trace_interrupts) {
-      if (any_interrupt_handled) PrintF(", ");
-      PrintF("DEBUG_BREAK");
-      any_interrupt_handled = true;
-    }
-    isolate_->debug()->HandleDebugBreak(kIgnoreIfTopFrameBlackboxed);
-  }
-
   if (CheckAndClearInterrupt(TERMINATE_EXECUTION)) {
     if (FLAG_trace_interrupts) {
       if (any_interrupt_handled) PrintF(", ");
@@ -552,7 +563,7 @@ Object* StackGuard::HandleInterrupts() {
   isolate_->counters()->runtime_profiler_ticks()->Increment();
   isolate_->runtime_profiler()->MarkCandidatesForOptimization();
 
-  return isolate_->heap()->undefined_value();
+  return ReadOnlyRoots(isolate_).undefined_value();
 }
 
 }  // namespace internal
diff --git a/deps/v8/src/execution.h b/deps/v8/src/execution.h
index 95135031cf8023..44491c6e6739fa 100644
--- a/deps/v8/src/execution.h
+++ b/deps/v8/src/execution.h
@@ -60,8 +60,7 @@ class Execution final : public AllStatic {
 
 
 class ExecutionAccess;
-class PostponeInterruptsScope;
-
+class InterruptsScope;
 
 // StackGuard contains the handling of the limits that are used to limit the
 // number of nested invocations of JavaScript and the stack size used in each
@@ -90,12 +89,11 @@ class V8_EXPORT_PRIVATE StackGuard final {
   void ClearThread(const ExecutionAccess& lock);
 
 #define INTERRUPT_LIST(V)                       \
-  V(DEBUGBREAK, DebugBreak, 0)                  \
-  V(TERMINATE_EXECUTION, TerminateExecution, 1) \
-  V(GC_REQUEST, GC, 2)                          \
-  V(INSTALL_CODE, InstallCode, 3)               \
-  V(API_INTERRUPT, ApiInterrupt, 4)             \
-  V(DEOPT_MARKED_ALLOCATION_SITES, DeoptMarkedAllocationSites, 5)
+  V(TERMINATE_EXECUTION, TerminateExecution, 0) \
+  V(GC_REQUEST, GC, 1)                          \
+  V(INSTALL_CODE, InstallCode, 2)               \
+  V(API_INTERRUPT, ApiInterrupt, 3)             \
+  V(DEOPT_MARKED_ALLOCATION_SITES, DeoptMarkedAllocationSites, 4)
 
 #define V(NAME, Name, id)                                                    \
   inline bool Check##Name() { return CheckInterrupt(NAME); }                 \
@@ -136,7 +134,6 @@ class V8_EXPORT_PRIVATE StackGuard final {
   // If the stack guard is triggered, but it is not an actual
   // stack overflow, then handle the interruption accordingly.
   Object* HandleInterrupts();
-  void HandleGCInterrupt();
 
  private:
   StackGuard();
@@ -170,8 +167,8 @@ class V8_EXPORT_PRIVATE StackGuard final {
   static const uintptr_t kIllegalLimit = 0xfffffff8;
 #endif
 
-  void PushPostponeInterruptsScope(PostponeInterruptsScope* scope);
-  void PopPostponeInterruptsScope();
+  void PushInterruptsScope(InterruptsScope* scope);
+  void PopInterruptsScope();
 
   class ThreadLocal final {
    public:
@@ -215,7 +212,7 @@ class V8_EXPORT_PRIVATE StackGuard final {
                                  static_cast<base::AtomicWord>(limit));
     }
 
-    PostponeInterruptsScope* postpone_interrupts_;
+    InterruptsScope* interrupt_scopes_;
     int interrupt_flags_;
   };
 
@@ -226,7 +223,7 @@ class V8_EXPORT_PRIVATE StackGuard final {
 
   friend class Isolate;
   friend class StackLimitCheck;
-  friend class PostponeInterruptsScope;
+  friend class InterruptsScope;
 
   DISALLOW_COPY_AND_ASSIGN(StackGuard);
 };
diff --git a/deps/v8/src/extensions/externalize-string-extension.cc b/deps/v8/src/extensions/externalize-string-extension.cc
index 54c6259b8b3d08..363c0c593def25 100644
--- a/deps/v8/src/extensions/externalize-string-extension.cc
+++ b/deps/v8/src/extensions/externalize-string-extension.cc
@@ -98,10 +98,6 @@ void ExternalizeStringExtension::Externalize(
     SimpleOneByteStringResource* resource = new SimpleOneByteStringResource(
         reinterpret_cast<char*>(data), string->length());
     result = string->MakeExternal(resource);
-    if (result) {
-      i::Isolate* isolate = reinterpret_cast<i::Isolate*>(args.GetIsolate());
-      isolate->heap()->RegisterExternalString(*string);
-    }
     if (!result) delete resource;
   } else {
     uc16* data = new uc16[string->length()];
@@ -109,10 +105,6 @@ void ExternalizeStringExtension::Externalize(
     SimpleTwoByteStringResource* resource = new SimpleTwoByteStringResource(
         data, string->length());
     result = string->MakeExternal(resource);
-    if (result) {
-      i::Isolate* isolate = reinterpret_cast<i::Isolate*>(args.GetIsolate());
-      isolate->heap()->RegisterExternalString(*string);
-    }
     if (!result) delete resource;
   }
   if (!result) {
diff --git a/deps/v8/src/external-reference-table.cc b/deps/v8/src/external-reference-table.cc
index 3c3ff92c65449b..e9c4221f9afdd3 100644
--- a/deps/v8/src/external-reference-table.cc
+++ b/deps/v8/src/external-reference-table.cc
@@ -27,15 +27,16 @@ BUILTIN_LIST_C(FORWARD_DECLARE)
 void ExternalReferenceTable::Init(Isolate* isolate) {
   int index = 0;
 
-  // nullptr is preserved through serialization/deserialization.
-  Add(nullptr, "nullptr", &index);
+  // kNullAddress is preserved through serialization/deserialization.
+  Add(kNullAddress, "nullptr", &index);
   AddReferences(isolate, &index);
   AddBuiltins(isolate, &index);
   AddRuntimeFunctions(isolate, &index);
   AddIsolateAddresses(isolate, &index);
   AddAccessors(isolate, &index);
   AddStubCache(isolate, &index);
-  is_initialized_ = true;
+  is_initialized_ = static_cast<uint32_t>(true);
+  USE(unused_padding_);
 
   CHECK_EQ(kSize, index);
 }
@@ -62,10 +63,15 @@ void ExternalReferenceTable::AddReferences(Isolate* isolate, int* index) {
   CHECK_EQ(kSpecialReferenceCount, *index);
 
 #define ADD_EXTERNAL_REFERENCE(name, desc) \
-  Add(ExternalReference::name(isolate).address(), desc, index);
+  Add(ExternalReference::name().address(), desc, index);
   EXTERNAL_REFERENCE_LIST(ADD_EXTERNAL_REFERENCE)
 #undef ADD_EXTERNAL_REFERENCE
 
+#define ADD_EXTERNAL_REFERENCE(name, desc) \
+  Add(ExternalReference::name(isolate).address(), desc, index);
+  EXTERNAL_REFERENCE_LIST_WITH_ISOLATE(ADD_EXTERNAL_REFERENCE)
+#undef ADD_EXTERNAL_REFERENCE
+
   CHECK_EQ(kSpecialReferenceCount + kExternalReferenceCount, *index);
 }
 
@@ -82,7 +88,7 @@ void ExternalReferenceTable::AddBuiltins(Isolate* isolate, int* index) {
 #undef DEF_ENTRY
   };
   for (unsigned i = 0; i < arraysize(c_builtins); ++i) {
-    Add(ExternalReference(c_builtins[i].address, isolate).address(),
+    Add(ExternalReference::Create(c_builtins[i].address).address(),
         c_builtins[i].name, index);
   }
 
@@ -108,7 +114,7 @@ void ExternalReferenceTable::AddRuntimeFunctions(Isolate* isolate, int* index) {
   };
 
   for (unsigned i = 0; i < arraysize(runtime_functions); ++i) {
-    ExternalReference ref(runtime_functions[i].id, isolate);
+    ExternalReference ref = ExternalReference::Create(runtime_functions[i].id);
     Add(ref.address(), runtime_functions[i].name, index);
   }
 
diff --git a/deps/v8/src/external-reference-table.h b/deps/v8/src/external-reference-table.h
index a0b53da2e33823..c880aa8c40c8a3 100644
--- a/deps/v8/src/external-reference-table.h
+++ b/deps/v8/src/external-reference-table.h
@@ -8,7 +8,6 @@
 #include <vector>
 
 #include "src/accessors.h"
-#include "src/address-map.h"
 #include "src/builtins/builtins.h"
 #include "src/external-reference.h"
 
@@ -43,20 +42,26 @@ class ExternalReferenceTable {
       kIsolateAddressReferenceCount + kAccessorReferenceCount +
       kStubCacheReferenceCount;
 
-  uint32_t size() const { return static_cast<uint32_t>(kSize); }
+  static constexpr uint32_t size() { return static_cast<uint32_t>(kSize); }
   Address address(uint32_t i) { return refs_[i].address; }
   const char* name(uint32_t i) { return refs_[i].name; }
 
-  bool is_initialized() const { return is_initialized_; }
+  bool is_initialized() const { return is_initialized_ != 0; }
 
   static const char* ResolveSymbol(void* address);
 
-  static uint32_t OffsetOfEntry(uint32_t i) {
+  static constexpr uint32_t OffsetOfEntry(uint32_t i) {
     // Used in CodeAssembler::LookupExternalReference.
     STATIC_ASSERT(offsetof(ExternalReferenceEntry, address) == 0);
     return i * sizeof(ExternalReferenceEntry);
   }
 
+  static constexpr uint32_t SizeInBytes() {
+    STATIC_ASSERT(OffsetOfEntry(size()) + 2 * kUInt32Size ==
+                  sizeof(ExternalReferenceTable));
+    return OffsetOfEntry(size()) + 2 * kUInt32Size;
+  }
+
   ExternalReferenceTable() {}
   void Init(Isolate* isolate);
 
@@ -65,7 +70,7 @@ class ExternalReferenceTable {
     Address address;
     const char* name;
 
-    ExternalReferenceEntry() : address(nullptr), name(nullptr) {}
+    ExternalReferenceEntry() : address(kNullAddress), name(nullptr) {}
     ExternalReferenceEntry(Address address, const char* name)
         : address(address), name(name) {}
   };
@@ -80,7 +85,8 @@ class ExternalReferenceTable {
   void AddStubCache(Isolate* isolate, int* index);
 
   ExternalReferenceEntry refs_[kSize];
-  bool is_initialized_ = false;
+  uint32_t is_initialized_ = 0;  // Not bool to guarantee deterministic size.
+  uint32_t unused_padding_ = 0;  // For alignment.
 
   DISALLOW_COPY_AND_ASSIGN(ExternalReferenceTable);
 };
diff --git a/deps/v8/src/external-reference.cc b/deps/v8/src/external-reference.cc
index 49186ec159cf2e..dedf76b6d23644 100644
--- a/deps/v8/src/external-reference.cc
+++ b/deps/v8/src/external-reference.cc
@@ -18,6 +18,7 @@
 #include "src/isolate.h"
 #include "src/objects-inl.h"
 #include "src/regexp/regexp-stack.h"
+#include "src/simulator-base.h"
 #include "src/string-search.h"
 #include "src/wasm/wasm-external-refs.h"
 
@@ -54,38 +55,33 @@ namespace internal {
 // -----------------------------------------------------------------------------
 // Common double constants.
 
-struct DoubleConstant BASE_EMBEDDED {
-  double min_int;
-  double one_half;
-  double minus_one_half;
-  double negative_infinity;
-  uint64_t the_hole_nan;
-  double uint32_bias;
-};
+constexpr double double_min_int_constant = kMinInt;
+constexpr double double_one_half_constant = 0.5;
+constexpr uint64_t double_the_hole_nan_constant = kHoleNanInt64;
+constexpr double double_uint32_bias_constant =
+    static_cast<double>(kMaxUInt32) + 1;
 
-static DoubleConstant double_constants;
-
-static struct V8_ALIGNED(16) {
+constexpr struct V8_ALIGNED(16) {
   uint32_t a;
   uint32_t b;
   uint32_t c;
   uint32_t d;
 } float_absolute_constant = {0x7FFFFFFF, 0x7FFFFFFF, 0x7FFFFFFF, 0x7FFFFFFF};
 
-static struct V8_ALIGNED(16) {
+constexpr struct V8_ALIGNED(16) {
   uint32_t a;
   uint32_t b;
   uint32_t c;
   uint32_t d;
 } float_negate_constant = {0x80000000, 0x80000000, 0x80000000, 0x80000000};
 
-static struct V8_ALIGNED(16) {
+constexpr struct V8_ALIGNED(16) {
   uint64_t a;
   uint64_t b;
 } double_absolute_constant = {uint64_t{0x7FFFFFFFFFFFFFFF},
                               uint64_t{0x7FFFFFFFFFFFFFFF}};
 
-static struct V8_ALIGNED(16) {
+constexpr struct V8_ALIGNED(16) {
   uint64_t a;
   uint64_t b;
 } double_negate_constant = {uint64_t{0x8000000000000000},
@@ -103,38 +99,34 @@ static ExternalReference::Type BuiltinCallTypeForResultSize(int result_size) {
   UNREACHABLE();
 }
 
-void ExternalReference::SetUp() {
-  double_constants.min_int = kMinInt;
-  double_constants.one_half = 0.5;
-  double_constants.minus_one_half = -0.5;
-  double_constants.the_hole_nan = kHoleNanInt64;
-  double_constants.negative_infinity = -V8_INFINITY;
-  double_constants.uint32_bias =
-      static_cast<double>(static_cast<uint32_t>(0xFFFFFFFF)) + 1;
+// static
+ExternalReference ExternalReference::Create(
+    ApiFunction* fun, Type type = ExternalReference::BUILTIN_CALL) {
+  return ExternalReference(Redirect(fun->address(), type));
 }
 
-ExternalReference::ExternalReference(Address address, Isolate* isolate)
-    : address_(Redirect(isolate, address)) {}
-
-ExternalReference::ExternalReference(
-    ApiFunction* fun, Type type = ExternalReference::BUILTIN_CALL,
-    Isolate* isolate = nullptr)
-    : address_(Redirect(isolate, fun->address(), type)) {}
+// static
+ExternalReference ExternalReference::Create(Runtime::FunctionId id) {
+  return Create(Runtime::FunctionForId(id));
+}
 
-ExternalReference::ExternalReference(Runtime::FunctionId id, Isolate* isolate)
-    : ExternalReference(Runtime::FunctionForId(id), isolate) {}
+// static
+ExternalReference ExternalReference::Create(const Runtime::Function* f) {
+  return ExternalReference(
+      Redirect(f->entry, BuiltinCallTypeForResultSize(f->result_size)));
+}
 
-ExternalReference::ExternalReference(const Runtime::Function* f,
-                                     Isolate* isolate)
-    : address_(Redirect(isolate, f->entry,
-                        BuiltinCallTypeForResultSize(f->result_size))) {}
+// static
+ExternalReference ExternalReference::Create(Address address) {
+  return ExternalReference(Redirect(address));
+}
 
 ExternalReference ExternalReference::isolate_address(Isolate* isolate) {
   return ExternalReference(isolate);
 }
 
 ExternalReference ExternalReference::builtins_address(Isolate* isolate) {
-  return ExternalReference(isolate->builtins()->builtins_table_address());
+  return ExternalReference(isolate->heap()->builtin_address(0));
 }
 
 ExternalReference ExternalReference::handle_scope_implementer_address(
@@ -158,41 +150,46 @@ ExternalReference ExternalReference::interpreter_dispatch_counters(
       isolate->interpreter()->bytecode_dispatch_counters_table());
 }
 
-ExternalReference ExternalReference::bytecode_size_table_address(
-    Isolate* isolate) {
+ExternalReference ExternalReference::bytecode_size_table_address() {
   return ExternalReference(
       interpreter::Bytecodes::bytecode_size_table_address());
 }
 
-ExternalReference::ExternalReference(StatsCounter* counter)
-    : address_(reinterpret_cast<Address>(counter->GetInternalPointer())) {}
+// static
+ExternalReference ExternalReference::Create(StatsCounter* counter) {
+  return ExternalReference(
+      reinterpret_cast<Address>(counter->GetInternalPointer()));
+}
 
-ExternalReference::ExternalReference(IsolateAddressId id, Isolate* isolate)
-    : address_(isolate->get_address_from_id(id)) {}
+// static
+ExternalReference ExternalReference::Create(IsolateAddressId id,
+                                            Isolate* isolate) {
+  return ExternalReference(isolate->get_address_from_id(id));
+}
 
-ExternalReference::ExternalReference(const SCTableReference& table_ref)
-    : address_(table_ref.address()) {}
+// static
+ExternalReference ExternalReference::Create(const SCTableReference& table_ref) {
+  return ExternalReference(table_ref.address());
+}
 
-ExternalReference ExternalReference::incremental_marking_record_write_function(
-    Isolate* isolate) {
-  return ExternalReference(Redirect(
-      isolate, FUNCTION_ADDR(IncrementalMarking::RecordWriteFromCode)));
+ExternalReference
+ExternalReference::incremental_marking_record_write_function() {
+  return ExternalReference(
+      Redirect(FUNCTION_ADDR(IncrementalMarking::RecordWriteFromCode)));
 }
 
-ExternalReference ExternalReference::store_buffer_overflow_function(
-    Isolate* isolate) {
+ExternalReference ExternalReference::store_buffer_overflow_function() {
   return ExternalReference(
-      Redirect(isolate, FUNCTION_ADDR(StoreBuffer::StoreBufferOverflow)));
+      Redirect(FUNCTION_ADDR(StoreBuffer::StoreBufferOverflow)));
 }
 
-ExternalReference ExternalReference::delete_handle_scope_extensions(
-    Isolate* isolate) {
+ExternalReference ExternalReference::delete_handle_scope_extensions() {
   return ExternalReference(
-      Redirect(isolate, FUNCTION_ADDR(HandleScope::DeleteExtensions)));
+      Redirect(FUNCTION_ADDR(HandleScope::DeleteExtensions)));
 }
 
-ExternalReference ExternalReference::get_date_field_function(Isolate* isolate) {
-  return ExternalReference(Redirect(isolate, FUNCTION_ADDR(JSDate::GetField)));
+ExternalReference ExternalReference::get_date_field_function() {
+  return ExternalReference(Redirect(FUNCTION_ADDR(JSDate::GetField)));
 }
 
 ExternalReference ExternalReference::date_cache_stamp(Isolate* isolate) {
@@ -206,24 +203,13 @@ ExternalReference::runtime_function_table_address_for_unittests(
   return runtime_function_table_address(isolate);
 }
 
-void ExternalReference::set_redirector(
-    Isolate* isolate, ExternalReferenceRedirector* redirector) {
-  // We can't stack them.
-  DCHECK_NULL(isolate->external_reference_redirector());
-  isolate->set_external_reference_redirector(
-      reinterpret_cast<ExternalReferenceRedirectorPointer*>(redirector));
-}
-
 // static
-void* ExternalReference::Redirect(Isolate* isolate, Address address_arg,
-                                  Type type) {
-  ExternalReferenceRedirector* redirector =
-      reinterpret_cast<ExternalReferenceRedirector*>(
-          isolate->external_reference_redirector());
-  void* address = reinterpret_cast<void*>(address_arg);
-  void* answer =
-      (redirector == nullptr) ? address : (*redirector)(address, type);
-  return answer;
+Address ExternalReference::Redirect(Address address, Type type) {
+#ifdef USE_SIMULATOR
+  return SimulatorBase::RedirectExternalReference(address, type);
+#else
+  return address;
+#endif
 }
 
 ExternalReference ExternalReference::stress_deopt_count(Isolate* isolate) {
@@ -234,205 +220,181 @@ ExternalReference ExternalReference::force_slow_path(Isolate* isolate) {
   return ExternalReference(isolate->force_slow_path_address());
 }
 
-ExternalReference ExternalReference::new_deoptimizer_function(
-    Isolate* isolate) {
-  return ExternalReference(Redirect(isolate, FUNCTION_ADDR(Deoptimizer::New)));
+ExternalReference ExternalReference::new_deoptimizer_function() {
+  return ExternalReference(Redirect(FUNCTION_ADDR(Deoptimizer::New)));
 }
 
-ExternalReference ExternalReference::compute_output_frames_function(
-    Isolate* isolate) {
+ExternalReference ExternalReference::compute_output_frames_function() {
   return ExternalReference(
-      Redirect(isolate, FUNCTION_ADDR(Deoptimizer::ComputeOutputFrames)));
+      Redirect(FUNCTION_ADDR(Deoptimizer::ComputeOutputFrames)));
 }
 
-ExternalReference ExternalReference::wasm_f32_trunc(Isolate* isolate) {
-  return ExternalReference(
-      Redirect(isolate, FUNCTION_ADDR(wasm::f32_trunc_wrapper)));
+ExternalReference ExternalReference::wasm_f32_trunc() {
+  return ExternalReference(Redirect(FUNCTION_ADDR(wasm::f32_trunc_wrapper)));
 }
-ExternalReference ExternalReference::wasm_f32_floor(Isolate* isolate) {
-  return ExternalReference(
-      Redirect(isolate, FUNCTION_ADDR(wasm::f32_floor_wrapper)));
+ExternalReference ExternalReference::wasm_f32_floor() {
+  return ExternalReference(Redirect(FUNCTION_ADDR(wasm::f32_floor_wrapper)));
 }
-ExternalReference ExternalReference::wasm_f32_ceil(Isolate* isolate) {
-  return ExternalReference(
-      Redirect(isolate, FUNCTION_ADDR(wasm::f32_ceil_wrapper)));
+ExternalReference ExternalReference::wasm_f32_ceil() {
+  return ExternalReference(Redirect(FUNCTION_ADDR(wasm::f32_ceil_wrapper)));
 }
-ExternalReference ExternalReference::wasm_f32_nearest_int(Isolate* isolate) {
+ExternalReference ExternalReference::wasm_f32_nearest_int() {
   return ExternalReference(
-      Redirect(isolate, FUNCTION_ADDR(wasm::f32_nearest_int_wrapper)));
+      Redirect(FUNCTION_ADDR(wasm::f32_nearest_int_wrapper)));
 }
 
-ExternalReference ExternalReference::wasm_f64_trunc(Isolate* isolate) {
-  return ExternalReference(
-      Redirect(isolate, FUNCTION_ADDR(wasm::f64_trunc_wrapper)));
+ExternalReference ExternalReference::wasm_f64_trunc() {
+  return ExternalReference(Redirect(FUNCTION_ADDR(wasm::f64_trunc_wrapper)));
 }
 
-ExternalReference ExternalReference::wasm_f64_floor(Isolate* isolate) {
-  return ExternalReference(
-      Redirect(isolate, FUNCTION_ADDR(wasm::f64_floor_wrapper)));
+ExternalReference ExternalReference::wasm_f64_floor() {
+  return ExternalReference(Redirect(FUNCTION_ADDR(wasm::f64_floor_wrapper)));
 }
 
-ExternalReference ExternalReference::wasm_f64_ceil(Isolate* isolate) {
-  return ExternalReference(
-      Redirect(isolate, FUNCTION_ADDR(wasm::f64_ceil_wrapper)));
+ExternalReference ExternalReference::wasm_f64_ceil() {
+  return ExternalReference(Redirect(FUNCTION_ADDR(wasm::f64_ceil_wrapper)));
 }
 
-ExternalReference ExternalReference::wasm_f64_nearest_int(Isolate* isolate) {
+ExternalReference ExternalReference::wasm_f64_nearest_int() {
   return ExternalReference(
-      Redirect(isolate, FUNCTION_ADDR(wasm::f64_nearest_int_wrapper)));
+      Redirect(FUNCTION_ADDR(wasm::f64_nearest_int_wrapper)));
 }
 
-ExternalReference ExternalReference::wasm_int64_to_float32(Isolate* isolate) {
+ExternalReference ExternalReference::wasm_int64_to_float32() {
   return ExternalReference(
-      Redirect(isolate, FUNCTION_ADDR(wasm::int64_to_float32_wrapper)));
+      Redirect(FUNCTION_ADDR(wasm::int64_to_float32_wrapper)));
 }
 
-ExternalReference ExternalReference::wasm_uint64_to_float32(Isolate* isolate) {
+ExternalReference ExternalReference::wasm_uint64_to_float32() {
   return ExternalReference(
-      Redirect(isolate, FUNCTION_ADDR(wasm::uint64_to_float32_wrapper)));
+      Redirect(FUNCTION_ADDR(wasm::uint64_to_float32_wrapper)));
 }
 
-ExternalReference ExternalReference::wasm_int64_to_float64(Isolate* isolate) {
+ExternalReference ExternalReference::wasm_int64_to_float64() {
   return ExternalReference(
-      Redirect(isolate, FUNCTION_ADDR(wasm::int64_to_float64_wrapper)));
+      Redirect(FUNCTION_ADDR(wasm::int64_to_float64_wrapper)));
 }
 
-ExternalReference ExternalReference::wasm_uint64_to_float64(Isolate* isolate) {
+ExternalReference ExternalReference::wasm_uint64_to_float64() {
   return ExternalReference(
-      Redirect(isolate, FUNCTION_ADDR(wasm::uint64_to_float64_wrapper)));
+      Redirect(FUNCTION_ADDR(wasm::uint64_to_float64_wrapper)));
 }
 
-ExternalReference ExternalReference::wasm_float32_to_int64(Isolate* isolate) {
+ExternalReference ExternalReference::wasm_float32_to_int64() {
   return ExternalReference(
-      Redirect(isolate, FUNCTION_ADDR(wasm::float32_to_int64_wrapper)));
+      Redirect(FUNCTION_ADDR(wasm::float32_to_int64_wrapper)));
 }
 
-ExternalReference ExternalReference::wasm_float32_to_uint64(Isolate* isolate) {
+ExternalReference ExternalReference::wasm_float32_to_uint64() {
   return ExternalReference(
-      Redirect(isolate, FUNCTION_ADDR(wasm::float32_to_uint64_wrapper)));
+      Redirect(FUNCTION_ADDR(wasm::float32_to_uint64_wrapper)));
 }
 
-ExternalReference ExternalReference::wasm_float64_to_int64(Isolate* isolate) {
+ExternalReference ExternalReference::wasm_float64_to_int64() {
   return ExternalReference(
-      Redirect(isolate, FUNCTION_ADDR(wasm::float64_to_int64_wrapper)));
+      Redirect(FUNCTION_ADDR(wasm::float64_to_int64_wrapper)));
 }
 
-ExternalReference ExternalReference::wasm_float64_to_uint64(Isolate* isolate) {
+ExternalReference ExternalReference::wasm_float64_to_uint64() {
   return ExternalReference(
-      Redirect(isolate, FUNCTION_ADDR(wasm::float64_to_uint64_wrapper)));
+      Redirect(FUNCTION_ADDR(wasm::float64_to_uint64_wrapper)));
 }
 
-ExternalReference ExternalReference::wasm_int64_div(Isolate* isolate) {
-  return ExternalReference(
-      Redirect(isolate, FUNCTION_ADDR(wasm::int64_div_wrapper)));
+ExternalReference ExternalReference::wasm_int64_div() {
+  return ExternalReference(Redirect(FUNCTION_ADDR(wasm::int64_div_wrapper)));
 }
 
-ExternalReference ExternalReference::wasm_int64_mod(Isolate* isolate) {
-  return ExternalReference(
-      Redirect(isolate, FUNCTION_ADDR(wasm::int64_mod_wrapper)));
+ExternalReference ExternalReference::wasm_int64_mod() {
+  return ExternalReference(Redirect(FUNCTION_ADDR(wasm::int64_mod_wrapper)));
 }
 
-ExternalReference ExternalReference::wasm_uint64_div(Isolate* isolate) {
-  return ExternalReference(
-      Redirect(isolate, FUNCTION_ADDR(wasm::uint64_div_wrapper)));
+ExternalReference ExternalReference::wasm_uint64_div() {
+  return ExternalReference(Redirect(FUNCTION_ADDR(wasm::uint64_div_wrapper)));
 }
 
-ExternalReference ExternalReference::wasm_uint64_mod(Isolate* isolate) {
-  return ExternalReference(
-      Redirect(isolate, FUNCTION_ADDR(wasm::uint64_mod_wrapper)));
+ExternalReference ExternalReference::wasm_uint64_mod() {
+  return ExternalReference(Redirect(FUNCTION_ADDR(wasm::uint64_mod_wrapper)));
 }
 
-ExternalReference ExternalReference::wasm_word32_ctz(Isolate* isolate) {
-  return ExternalReference(
-      Redirect(isolate, FUNCTION_ADDR(wasm::word32_ctz_wrapper)));
+ExternalReference ExternalReference::wasm_word32_ctz() {
+  return ExternalReference(Redirect(FUNCTION_ADDR(wasm::word32_ctz_wrapper)));
 }
 
-ExternalReference ExternalReference::wasm_word64_ctz(Isolate* isolate) {
-  return ExternalReference(
-      Redirect(isolate, FUNCTION_ADDR(wasm::word64_ctz_wrapper)));
+ExternalReference ExternalReference::wasm_word64_ctz() {
+  return ExternalReference(Redirect(FUNCTION_ADDR(wasm::word64_ctz_wrapper)));
 }
 
-ExternalReference ExternalReference::wasm_word32_popcnt(Isolate* isolate) {
+ExternalReference ExternalReference::wasm_word32_popcnt() {
   return ExternalReference(
-      Redirect(isolate, FUNCTION_ADDR(wasm::word32_popcnt_wrapper)));
+      Redirect(FUNCTION_ADDR(wasm::word32_popcnt_wrapper)));
 }
 
-ExternalReference ExternalReference::wasm_word64_popcnt(Isolate* isolate) {
+ExternalReference ExternalReference::wasm_word64_popcnt() {
   return ExternalReference(
-      Redirect(isolate, FUNCTION_ADDR(wasm::word64_popcnt_wrapper)));
+      Redirect(FUNCTION_ADDR(wasm::word64_popcnt_wrapper)));
 }
 
-ExternalReference ExternalReference::wasm_word32_rol(Isolate* isolate) {
-  return ExternalReference(
-      Redirect(isolate, FUNCTION_ADDR(wasm::word32_rol_wrapper)));
+ExternalReference ExternalReference::wasm_word32_rol() {
+  return ExternalReference(Redirect(FUNCTION_ADDR(wasm::word32_rol_wrapper)));
 }
 
-ExternalReference ExternalReference::wasm_word32_ror(Isolate* isolate) {
-  return ExternalReference(
-      Redirect(isolate, FUNCTION_ADDR(wasm::word32_ror_wrapper)));
+ExternalReference ExternalReference::wasm_word32_ror() {
+  return ExternalReference(Redirect(FUNCTION_ADDR(wasm::word32_ror_wrapper)));
 }
 
-static void f64_acos_wrapper(double* param) {
-  WriteDoubleValue(param, base::ieee754::acos(ReadDoubleValue(param)));
+static void f64_acos_wrapper(Address data) {
+  double input = ReadUnalignedValue<double>(data);
+  WriteUnalignedValue(data, base::ieee754::acos(input));
 }
 
-ExternalReference ExternalReference::f64_acos_wrapper_function(
-    Isolate* isolate) {
-  return ExternalReference(Redirect(isolate, FUNCTION_ADDR(f64_acos_wrapper)));
+ExternalReference ExternalReference::f64_acos_wrapper_function() {
+  return ExternalReference(Redirect(FUNCTION_ADDR(f64_acos_wrapper)));
 }
 
-static void f64_asin_wrapper(double* param) {
-  WriteDoubleValue(param, base::ieee754::asin(ReadDoubleValue(param)));
+static void f64_asin_wrapper(Address data) {
+  double input = ReadUnalignedValue<double>(data);
+  WriteUnalignedValue<double>(data, base::ieee754::asin(input));
 }
 
-ExternalReference ExternalReference::f64_asin_wrapper_function(
-    Isolate* isolate) {
-  return ExternalReference(Redirect(isolate, FUNCTION_ADDR(f64_asin_wrapper)));
+ExternalReference ExternalReference::f64_asin_wrapper_function() {
+  return ExternalReference(Redirect(FUNCTION_ADDR(f64_asin_wrapper)));
 }
 
-ExternalReference ExternalReference::wasm_float64_pow(Isolate* isolate) {
-  return ExternalReference(
-      Redirect(isolate, FUNCTION_ADDR(wasm::float64_pow_wrapper)));
+ExternalReference ExternalReference::wasm_float64_pow() {
+  return ExternalReference(Redirect(FUNCTION_ADDR(wasm::float64_pow_wrapper)));
 }
 
-ExternalReference ExternalReference::wasm_set_thread_in_wasm_flag(
-    Isolate* isolate) {
+ExternalReference ExternalReference::wasm_set_thread_in_wasm_flag() {
   return ExternalReference(
-      Redirect(isolate, FUNCTION_ADDR(wasm::set_thread_in_wasm_flag)));
+      Redirect(FUNCTION_ADDR(wasm::set_thread_in_wasm_flag)));
 }
 
-ExternalReference ExternalReference::wasm_clear_thread_in_wasm_flag(
-    Isolate* isolate) {
+ExternalReference ExternalReference::wasm_clear_thread_in_wasm_flag() {
   return ExternalReference(
-      Redirect(isolate, FUNCTION_ADDR(wasm::clear_thread_in_wasm_flag)));
+      Redirect(FUNCTION_ADDR(wasm::clear_thread_in_wasm_flag)));
 }
 
-static void f64_mod_wrapper(double* param0, double* param1) {
-  WriteDoubleValue(param0,
-                   Modulo(ReadDoubleValue(param0), ReadDoubleValue(param1)));
+static void f64_mod_wrapper(Address data) {
+  double dividend = ReadUnalignedValue<double>(data);
+  double divisor = ReadUnalignedValue<double>(data + sizeof(dividend));
+  WriteUnalignedValue<double>(data, Modulo(dividend, divisor));
 }
 
-ExternalReference ExternalReference::f64_mod_wrapper_function(
-    Isolate* isolate) {
-  return ExternalReference(Redirect(isolate, FUNCTION_ADDR(f64_mod_wrapper)));
+ExternalReference ExternalReference::f64_mod_wrapper_function() {
+  return ExternalReference(Redirect(FUNCTION_ADDR(f64_mod_wrapper)));
 }
 
-ExternalReference ExternalReference::wasm_call_trap_callback_for_testing(
-    Isolate* isolate) {
+ExternalReference ExternalReference::wasm_call_trap_callback_for_testing() {
   return ExternalReference(
-      Redirect(isolate, FUNCTION_ADDR(wasm::call_trap_callback_for_testing)));
+      Redirect(FUNCTION_ADDR(wasm::call_trap_callback_for_testing)));
 }
 
-ExternalReference ExternalReference::log_enter_external_function(
-    Isolate* isolate) {
-  return ExternalReference(
-      Redirect(isolate, FUNCTION_ADDR(Logger::EnterExternal)));
+ExternalReference ExternalReference::log_enter_external_function() {
+  return ExternalReference(Redirect(FUNCTION_ADDR(Logger::EnterExternal)));
 }
 
-ExternalReference ExternalReference::log_leave_external_function(
-    Isolate* isolate) {
-  return ExternalReference(
-      Redirect(isolate, FUNCTION_ADDR(Logger::LeaveExternal)));
+ExternalReference ExternalReference::log_leave_external_function() {
+  return ExternalReference(Redirect(FUNCTION_ADDR(Logger::LeaveExternal)));
 }
 
 ExternalReference ExternalReference::roots_array_start(Isolate* isolate) {
@@ -507,74 +469,58 @@ ExternalReference ExternalReference::address_of_pending_message_obj(
   return ExternalReference(isolate->pending_message_obj_address());
 }
 
-ExternalReference ExternalReference::address_of_min_int(Isolate* isolate) {
-  return ExternalReference(reinterpret_cast<void*>(&double_constants.min_int));
+ExternalReference ExternalReference::address_of_min_int() {
+  return ExternalReference(reinterpret_cast<Address>(&double_min_int_constant));
 }
 
-ExternalReference ExternalReference::address_of_one_half(Isolate* isolate) {
-  return ExternalReference(reinterpret_cast<void*>(&double_constants.one_half));
-}
-
-ExternalReference ExternalReference::address_of_minus_one_half(
-    Isolate* isolate) {
+ExternalReference ExternalReference::address_of_one_half() {
   return ExternalReference(
-      reinterpret_cast<void*>(&double_constants.minus_one_half));
+      reinterpret_cast<Address>(&double_one_half_constant));
 }
 
-ExternalReference ExternalReference::address_of_negative_infinity(
-    Isolate* isolate) {
+ExternalReference ExternalReference::address_of_the_hole_nan() {
   return ExternalReference(
-      reinterpret_cast<void*>(&double_constants.negative_infinity));
+      reinterpret_cast<Address>(&double_the_hole_nan_constant));
 }
 
-ExternalReference ExternalReference::address_of_the_hole_nan(Isolate* isolate) {
+ExternalReference ExternalReference::address_of_uint32_bias() {
   return ExternalReference(
-      reinterpret_cast<void*>(&double_constants.the_hole_nan));
+      reinterpret_cast<Address>(&double_uint32_bias_constant));
 }
 
-ExternalReference ExternalReference::address_of_uint32_bias(Isolate* isolate) {
-  return ExternalReference(
-      reinterpret_cast<void*>(&double_constants.uint32_bias));
-}
-
-ExternalReference ExternalReference::address_of_float_abs_constant(
-    Isolate* isolate) {
-  return ExternalReference(reinterpret_cast<void*>(&float_absolute_constant));
+ExternalReference ExternalReference::address_of_float_abs_constant() {
+  return ExternalReference(reinterpret_cast<Address>(&float_absolute_constant));
 }
 
-ExternalReference ExternalReference::address_of_float_neg_constant(
-    Isolate* isolate) {
-  return ExternalReference(reinterpret_cast<void*>(&float_negate_constant));
+ExternalReference ExternalReference::address_of_float_neg_constant() {
+  return ExternalReference(reinterpret_cast<Address>(&float_negate_constant));
 }
 
-ExternalReference ExternalReference::address_of_double_abs_constant(
-    Isolate* isolate) {
-  return ExternalReference(reinterpret_cast<void*>(&double_absolute_constant));
+ExternalReference ExternalReference::address_of_double_abs_constant() {
+  return ExternalReference(
+      reinterpret_cast<Address>(&double_absolute_constant));
 }
 
-ExternalReference ExternalReference::address_of_double_neg_constant(
-    Isolate* isolate) {
-  return ExternalReference(reinterpret_cast<void*>(&double_negate_constant));
+ExternalReference ExternalReference::address_of_double_neg_constant() {
+  return ExternalReference(reinterpret_cast<Address>(&double_negate_constant));
 }
 
 ExternalReference ExternalReference::is_profiling_address(Isolate* isolate) {
   return ExternalReference(isolate->is_profiling_address());
 }
 
-ExternalReference ExternalReference::invoke_function_callback(
-    Isolate* isolate) {
+ExternalReference ExternalReference::invoke_function_callback() {
   Address thunk_address = FUNCTION_ADDR(&InvokeFunctionCallback);
   ExternalReference::Type thunk_type = ExternalReference::PROFILING_API_CALL;
   ApiFunction thunk_fun(thunk_address);
-  return ExternalReference(&thunk_fun, thunk_type, isolate);
+  return ExternalReference::Create(&thunk_fun, thunk_type);
 }
 
-ExternalReference ExternalReference::invoke_accessor_getter_callback(
-    Isolate* isolate) {
+ExternalReference ExternalReference::invoke_accessor_getter_callback() {
   Address thunk_address = FUNCTION_ADDR(&InvokeAccessorGetterCallback);
   ExternalReference::Type thunk_type = ExternalReference::PROFILING_GETTER_CALL;
   ApiFunction thunk_fun(thunk_address);
-  return ExternalReference(&thunk_fun, thunk_type, isolate);
+  return ExternalReference::Create(&thunk_fun, thunk_type);
 }
 
 #ifndef V8_INTERPRETED_REGEXP
@@ -601,18 +547,17 @@ ExternalReference ExternalReference::re_check_stack_guard_state(
 #else
   UNREACHABLE();
 #endif
-  return ExternalReference(Redirect(isolate, function));
+  return ExternalReference(Redirect(function));
 }
 
 ExternalReference ExternalReference::re_grow_stack(Isolate* isolate) {
   return ExternalReference(
-      Redirect(isolate, FUNCTION_ADDR(NativeRegExpMacroAssembler::GrowStack)));
+      Redirect(FUNCTION_ADDR(NativeRegExpMacroAssembler::GrowStack)));
 }
 
 ExternalReference ExternalReference::re_case_insensitive_compare_uc16(
     Isolate* isolate) {
   return ExternalReference(Redirect(
-      isolate,
       FUNCTION_ADDR(NativeRegExpMacroAssembler::CaseInsensitiveCompareUC16)));
 }
 
@@ -644,226 +589,215 @@ ExternalReference ExternalReference::address_of_regexp_stack_memory_size(
 
 #endif  // V8_INTERPRETED_REGEXP
 
-ExternalReference ExternalReference::ieee754_acos_function(Isolate* isolate) {
+ExternalReference ExternalReference::ieee754_acos_function() {
   return ExternalReference(
-      Redirect(isolate, FUNCTION_ADDR(base::ieee754::acos), BUILTIN_FP_CALL));
+      Redirect(FUNCTION_ADDR(base::ieee754::acos), BUILTIN_FP_CALL));
 }
 
-ExternalReference ExternalReference::ieee754_acosh_function(Isolate* isolate) {
-  return ExternalReference(Redirect(
-      isolate, FUNCTION_ADDR(base::ieee754::acosh), BUILTIN_FP_FP_CALL));
+ExternalReference ExternalReference::ieee754_acosh_function() {
+  return ExternalReference(
+      Redirect(FUNCTION_ADDR(base::ieee754::acosh), BUILTIN_FP_FP_CALL));
 }
 
-ExternalReference ExternalReference::ieee754_asin_function(Isolate* isolate) {
+ExternalReference ExternalReference::ieee754_asin_function() {
   return ExternalReference(
-      Redirect(isolate, FUNCTION_ADDR(base::ieee754::asin), BUILTIN_FP_CALL));
+      Redirect(FUNCTION_ADDR(base::ieee754::asin), BUILTIN_FP_CALL));
 }
 
-ExternalReference ExternalReference::ieee754_asinh_function(Isolate* isolate) {
-  return ExternalReference(Redirect(
-      isolate, FUNCTION_ADDR(base::ieee754::asinh), BUILTIN_FP_FP_CALL));
+ExternalReference ExternalReference::ieee754_asinh_function() {
+  return ExternalReference(
+      Redirect(FUNCTION_ADDR(base::ieee754::asinh), BUILTIN_FP_FP_CALL));
 }
 
-ExternalReference ExternalReference::ieee754_atan_function(Isolate* isolate) {
+ExternalReference ExternalReference::ieee754_atan_function() {
   return ExternalReference(
-      Redirect(isolate, FUNCTION_ADDR(base::ieee754::atan), BUILTIN_FP_CALL));
+      Redirect(FUNCTION_ADDR(base::ieee754::atan), BUILTIN_FP_CALL));
 }
 
-ExternalReference ExternalReference::ieee754_atanh_function(Isolate* isolate) {
-  return ExternalReference(Redirect(
-      isolate, FUNCTION_ADDR(base::ieee754::atanh), BUILTIN_FP_FP_CALL));
+ExternalReference ExternalReference::ieee754_atanh_function() {
+  return ExternalReference(
+      Redirect(FUNCTION_ADDR(base::ieee754::atanh), BUILTIN_FP_FP_CALL));
 }
 
-ExternalReference ExternalReference::ieee754_atan2_function(Isolate* isolate) {
-  return ExternalReference(Redirect(
-      isolate, FUNCTION_ADDR(base::ieee754::atan2), BUILTIN_FP_FP_CALL));
+ExternalReference ExternalReference::ieee754_atan2_function() {
+  return ExternalReference(
+      Redirect(FUNCTION_ADDR(base::ieee754::atan2), BUILTIN_FP_FP_CALL));
 }
 
-ExternalReference ExternalReference::ieee754_cbrt_function(Isolate* isolate) {
-  return ExternalReference(Redirect(isolate, FUNCTION_ADDR(base::ieee754::cbrt),
-                                    BUILTIN_FP_FP_CALL));
+ExternalReference ExternalReference::ieee754_cbrt_function() {
+  return ExternalReference(
+      Redirect(FUNCTION_ADDR(base::ieee754::cbrt), BUILTIN_FP_FP_CALL));
 }
 
-ExternalReference ExternalReference::ieee754_cos_function(Isolate* isolate) {
+ExternalReference ExternalReference::ieee754_cos_function() {
   return ExternalReference(
-      Redirect(isolate, FUNCTION_ADDR(base::ieee754::cos), BUILTIN_FP_CALL));
+      Redirect(FUNCTION_ADDR(base::ieee754::cos), BUILTIN_FP_CALL));
 }
 
-ExternalReference ExternalReference::ieee754_cosh_function(Isolate* isolate) {
+ExternalReference ExternalReference::ieee754_cosh_function() {
   return ExternalReference(
-      Redirect(isolate, FUNCTION_ADDR(base::ieee754::cosh), BUILTIN_FP_CALL));
+      Redirect(FUNCTION_ADDR(base::ieee754::cosh), BUILTIN_FP_CALL));
 }
 
-ExternalReference ExternalReference::ieee754_exp_function(Isolate* isolate) {
+ExternalReference ExternalReference::ieee754_exp_function() {
   return ExternalReference(
-      Redirect(isolate, FUNCTION_ADDR(base::ieee754::exp), BUILTIN_FP_CALL));
+      Redirect(FUNCTION_ADDR(base::ieee754::exp), BUILTIN_FP_CALL));
 }
 
-ExternalReference ExternalReference::ieee754_expm1_function(Isolate* isolate) {
-  return ExternalReference(Redirect(
-      isolate, FUNCTION_ADDR(base::ieee754::expm1), BUILTIN_FP_FP_CALL));
+ExternalReference ExternalReference::ieee754_expm1_function() {
+  return ExternalReference(
+      Redirect(FUNCTION_ADDR(base::ieee754::expm1), BUILTIN_FP_FP_CALL));
 }
 
-ExternalReference ExternalReference::ieee754_log_function(Isolate* isolate) {
+ExternalReference ExternalReference::ieee754_log_function() {
   return ExternalReference(
-      Redirect(isolate, FUNCTION_ADDR(base::ieee754::log), BUILTIN_FP_CALL));
+      Redirect(FUNCTION_ADDR(base::ieee754::log), BUILTIN_FP_CALL));
 }
 
-ExternalReference ExternalReference::ieee754_log1p_function(Isolate* isolate) {
+ExternalReference ExternalReference::ieee754_log1p_function() {
   return ExternalReference(
-      Redirect(isolate, FUNCTION_ADDR(base::ieee754::log1p), BUILTIN_FP_CALL));
+      Redirect(FUNCTION_ADDR(base::ieee754::log1p), BUILTIN_FP_CALL));
 }
 
-ExternalReference ExternalReference::ieee754_log10_function(Isolate* isolate) {
+ExternalReference ExternalReference::ieee754_log10_function() {
   return ExternalReference(
-      Redirect(isolate, FUNCTION_ADDR(base::ieee754::log10), BUILTIN_FP_CALL));
+      Redirect(FUNCTION_ADDR(base::ieee754::log10), BUILTIN_FP_CALL));
 }
 
-ExternalReference ExternalReference::ieee754_log2_function(Isolate* isolate) {
+ExternalReference ExternalReference::ieee754_log2_function() {
   return ExternalReference(
-      Redirect(isolate, FUNCTION_ADDR(base::ieee754::log2), BUILTIN_FP_CALL));
+      Redirect(FUNCTION_ADDR(base::ieee754::log2), BUILTIN_FP_CALL));
 }
 
-ExternalReference ExternalReference::ieee754_sin_function(Isolate* isolate) {
+ExternalReference ExternalReference::ieee754_sin_function() {
   return ExternalReference(
-      Redirect(isolate, FUNCTION_ADDR(base::ieee754::sin), BUILTIN_FP_CALL));
+      Redirect(FUNCTION_ADDR(base::ieee754::sin), BUILTIN_FP_CALL));
 }
 
-ExternalReference ExternalReference::ieee754_sinh_function(Isolate* isolate) {
+ExternalReference ExternalReference::ieee754_sinh_function() {
   return ExternalReference(
-      Redirect(isolate, FUNCTION_ADDR(base::ieee754::sinh), BUILTIN_FP_CALL));
+      Redirect(FUNCTION_ADDR(base::ieee754::sinh), BUILTIN_FP_CALL));
 }
 
-ExternalReference ExternalReference::ieee754_tan_function(Isolate* isolate) {
+ExternalReference ExternalReference::ieee754_tan_function() {
   return ExternalReference(
-      Redirect(isolate, FUNCTION_ADDR(base::ieee754::tan), BUILTIN_FP_CALL));
+      Redirect(FUNCTION_ADDR(base::ieee754::tan), BUILTIN_FP_CALL));
 }
 
-ExternalReference ExternalReference::ieee754_tanh_function(Isolate* isolate) {
+ExternalReference ExternalReference::ieee754_tanh_function() {
   return ExternalReference(
-      Redirect(isolate, FUNCTION_ADDR(base::ieee754::tanh), BUILTIN_FP_CALL));
+      Redirect(FUNCTION_ADDR(base::ieee754::tanh), BUILTIN_FP_CALL));
 }
 
 void* libc_memchr(void* string, int character, size_t search_length) {
   return memchr(string, character, search_length);
 }
 
-ExternalReference ExternalReference::libc_memchr_function(Isolate* isolate) {
-  return ExternalReference(Redirect(isolate, FUNCTION_ADDR(libc_memchr)));
+ExternalReference ExternalReference::libc_memchr_function() {
+  return ExternalReference(Redirect(FUNCTION_ADDR(libc_memchr)));
 }
 
 void* libc_memcpy(void* dest, const void* src, size_t n) {
   return memcpy(dest, src, n);
 }
 
-ExternalReference ExternalReference::libc_memcpy_function(Isolate* isolate) {
-  return ExternalReference(Redirect(isolate, FUNCTION_ADDR(libc_memcpy)));
+ExternalReference ExternalReference::libc_memcpy_function() {
+  return ExternalReference(Redirect(FUNCTION_ADDR(libc_memcpy)));
 }
 
 void* libc_memmove(void* dest, const void* src, size_t n) {
   return memmove(dest, src, n);
 }
 
-ExternalReference ExternalReference::libc_memmove_function(Isolate* isolate) {
-  return ExternalReference(Redirect(isolate, FUNCTION_ADDR(libc_memmove)));
+ExternalReference ExternalReference::libc_memmove_function() {
+  return ExternalReference(Redirect(FUNCTION_ADDR(libc_memmove)));
 }
 
-void* libc_memset(void* dest, int byte, size_t n) {
-  DCHECK_EQ(static_cast<char>(byte), byte);
-  return memset(dest, byte, n);
+void* libc_memset(void* dest, int value, size_t n) {
+  DCHECK_EQ(static_cast<byte>(value), value);
+  return memset(dest, value, n);
 }
 
-ExternalReference ExternalReference::libc_memset_function(Isolate* isolate) {
-  return ExternalReference(Redirect(isolate, FUNCTION_ADDR(libc_memset)));
+ExternalReference ExternalReference::libc_memset_function() {
+  return ExternalReference(Redirect(FUNCTION_ADDR(libc_memset)));
 }
 
-ExternalReference ExternalReference::printf_function(Isolate* isolate) {
-  return ExternalReference(Redirect(isolate, FUNCTION_ADDR(std::printf)));
+ExternalReference ExternalReference::printf_function() {
+  return ExternalReference(Redirect(FUNCTION_ADDR(std::printf)));
 }
 
 template <typename SubjectChar, typename PatternChar>
-ExternalReference ExternalReference::search_string_raw(Isolate* isolate) {
+ExternalReference ExternalReference::search_string_raw() {
   auto f = SearchStringRaw<SubjectChar, PatternChar>;
-  return ExternalReference(Redirect(isolate, FUNCTION_ADDR(f)));
+  return ExternalReference(Redirect(FUNCTION_ADDR(f)));
 }
 
-ExternalReference ExternalReference::search_string_raw_one_one(
-    Isolate* isolate) {
-  return search_string_raw<const uint8_t, const uint8_t>(isolate);
+ExternalReference ExternalReference::search_string_raw_one_one() {
+  return search_string_raw<const uint8_t, const uint8_t>();
 }
 
-ExternalReference ExternalReference::search_string_raw_one_two(
-    Isolate* isolate) {
-  return search_string_raw<const uint8_t, const uc16>(isolate);
+ExternalReference ExternalReference::search_string_raw_one_two() {
+  return search_string_raw<const uint8_t, const uc16>();
 }
 
-ExternalReference ExternalReference::search_string_raw_two_one(
-    Isolate* isolate) {
-  return search_string_raw<const uc16, const uint8_t>(isolate);
+ExternalReference ExternalReference::search_string_raw_two_one() {
+  return search_string_raw<const uc16, const uint8_t>();
 }
 
-ExternalReference ExternalReference::search_string_raw_two_two(
-    Isolate* isolate) {
-  return search_string_raw<const uc16, const uc16>(isolate);
+ExternalReference ExternalReference::search_string_raw_two_two() {
+  return search_string_raw<const uc16, const uc16>();
 }
 
-ExternalReference ExternalReference::orderedhashmap_gethash_raw(
-    Isolate* isolate) {
+ExternalReference ExternalReference::orderedhashmap_gethash_raw() {
   auto f = OrderedHashMap::GetHash;
-  return ExternalReference(Redirect(isolate, FUNCTION_ADDR(f)));
+  return ExternalReference(Redirect(FUNCTION_ADDR(f)));
 }
 
 ExternalReference ExternalReference::get_or_create_hash_raw(Isolate* isolate) {
   typedef Smi* (*GetOrCreateHash)(Isolate * isolate, Object * key);
   GetOrCreateHash f = Object::GetOrCreateHash;
-  return ExternalReference(Redirect(isolate, FUNCTION_ADDR(f)));
+  return ExternalReference(Redirect(FUNCTION_ADDR(f)));
 }
 
 ExternalReference ExternalReference::jsreceiver_create_identity_hash(
     Isolate* isolate) {
   typedef Smi* (*CreateIdentityHash)(Isolate * isolate, JSReceiver * key);
   CreateIdentityHash f = JSReceiver::CreateIdentityHash;
-  return ExternalReference(Redirect(isolate, FUNCTION_ADDR(f)));
+  return ExternalReference(Redirect(FUNCTION_ADDR(f)));
 }
 
 ExternalReference
-ExternalReference::copy_fast_number_jsarray_elements_to_typed_array(
-    Isolate* isolate) {
-  return ExternalReference(Redirect(
-      isolate, FUNCTION_ADDR(CopyFastNumberJSArrayElementsToTypedArray)));
+ExternalReference::copy_fast_number_jsarray_elements_to_typed_array() {
+  return ExternalReference(
+      Redirect(FUNCTION_ADDR(CopyFastNumberJSArrayElementsToTypedArray)));
 }
 
-ExternalReference ExternalReference::copy_typed_array_elements_to_typed_array(
-    Isolate* isolate) {
+ExternalReference
+ExternalReference::copy_typed_array_elements_to_typed_array() {
   return ExternalReference(
-      Redirect(isolate, FUNCTION_ADDR(CopyTypedArrayElementsToTypedArray)));
+      Redirect(FUNCTION_ADDR(CopyTypedArrayElementsToTypedArray)));
 }
 
-ExternalReference ExternalReference::copy_typed_array_elements_slice(
-    Isolate* isolate) {
+ExternalReference ExternalReference::copy_typed_array_elements_slice() {
   return ExternalReference(
-      Redirect(isolate, FUNCTION_ADDR(CopyTypedArrayElementsSlice)));
+      Redirect(FUNCTION_ADDR(CopyTypedArrayElementsSlice)));
 }
 
-ExternalReference ExternalReference::try_internalize_string_function(
-    Isolate* isolate) {
-  return ExternalReference(Redirect(
-      isolate, FUNCTION_ADDR(StringTable::LookupStringIfExists_NoAllocate)));
+ExternalReference ExternalReference::try_internalize_string_function() {
+  return ExternalReference(
+      Redirect(FUNCTION_ADDR(StringTable::LookupStringIfExists_NoAllocate)));
 }
 
-ExternalReference ExternalReference::check_object_type(Isolate* isolate) {
-  return ExternalReference(Redirect(isolate, FUNCTION_ADDR(CheckObjectType)));
+ExternalReference ExternalReference::check_object_type() {
+  return ExternalReference(Redirect(FUNCTION_ADDR(CheckObjectType)));
 }
 
 #ifdef V8_INTL_SUPPORT
-ExternalReference ExternalReference::intl_convert_one_byte_to_lower(
-    Isolate* isolate) {
-  return ExternalReference(
-      Redirect(isolate, FUNCTION_ADDR(ConvertOneByteToLower)));
+ExternalReference ExternalReference::intl_convert_one_byte_to_lower() {
+  return ExternalReference(Redirect(FUNCTION_ADDR(ConvertOneByteToLower)));
 }
 
-ExternalReference ExternalReference::intl_to_latin1_lower_table(
-    Isolate* isolate) {
+ExternalReference ExternalReference::intl_to_latin1_lower_table() {
   uint8_t* ptr = const_cast<uint8_t*>(ToLatin1LowerTable());
   return ExternalReference(reinterpret_cast<Address>(ptr));
 }
@@ -871,13 +805,13 @@ ExternalReference ExternalReference::intl_to_latin1_lower_table(
 
 // Explicit instantiations for all combinations of 1- and 2-byte strings.
 template ExternalReference
-ExternalReference::search_string_raw<const uint8_t, const uint8_t>(Isolate*);
+ExternalReference::search_string_raw<const uint8_t, const uint8_t>();
 template ExternalReference
-ExternalReference::search_string_raw<const uint8_t, const uc16>(Isolate*);
+ExternalReference::search_string_raw<const uint8_t, const uc16>();
 template ExternalReference
-ExternalReference::search_string_raw<const uc16, const uint8_t>(Isolate*);
+ExternalReference::search_string_raw<const uc16, const uint8_t>();
 template ExternalReference
-ExternalReference::search_string_raw<const uc16, const uc16>(Isolate*);
+ExternalReference::search_string_raw<const uc16, const uc16>();
 
 ExternalReference ExternalReference::page_flags(Page* page) {
   return ExternalReference(reinterpret_cast<Address>(page) +
@@ -888,14 +822,25 @@ ExternalReference ExternalReference::ForDeoptEntry(Address entry) {
   return ExternalReference(entry);
 }
 
-ExternalReference ExternalReference::cpu_features(Isolate* isolate) {
+ExternalReference ExternalReference::cpu_features() {
   DCHECK(CpuFeatures::initialized_);
   return ExternalReference(&CpuFeatures::supported_);
 }
 
-ExternalReference ExternalReference::promise_hook_or_debug_is_active_address(
+ExternalReference ExternalReference::promise_hook_address(Isolate* isolate) {
+  return ExternalReference(isolate->promise_hook_address());
+}
+
+ExternalReference ExternalReference::async_event_delegate_address(
     Isolate* isolate) {
-  return ExternalReference(isolate->promise_hook_or_debug_is_active_address());
+  return ExternalReference(isolate->async_event_delegate_address());
+}
+
+ExternalReference
+ExternalReference::promise_hook_or_async_event_delegate_address(
+    Isolate* isolate) {
+  return ExternalReference(
+      isolate->promise_hook_or_async_event_delegate_address());
 }
 
 ExternalReference ExternalReference::debug_is_active_address(Isolate* isolate) {
@@ -907,21 +852,15 @@ ExternalReference ExternalReference::debug_hook_on_function_call_address(
   return ExternalReference(isolate->debug()->hook_on_function_call_address());
 }
 
-ExternalReference ExternalReference::debug_execution_mode_address(
-    Isolate* isolate) {
-  return ExternalReference(isolate->debug_execution_mode_address());
-}
-
 ExternalReference ExternalReference::runtime_function_table_address(
     Isolate* isolate) {
   return ExternalReference(
       const_cast<Runtime::Function*>(Runtime::RuntimeFunctionTable(isolate)));
 }
 
-ExternalReference ExternalReference::invalidate_prototype_chains_function(
-    Isolate* isolate) {
+ExternalReference ExternalReference::invalidate_prototype_chains_function() {
   return ExternalReference(
-      Redirect(isolate, FUNCTION_ADDR(JSObject::InvalidatePrototypeChains)));
+      Redirect(FUNCTION_ADDR(JSObject::InvalidatePrototypeChains)));
 }
 
 double power_helper(Isolate* isolate, double x, double y) {
@@ -972,21 +911,14 @@ double power_double_double(double x, double y) {
 
 double modulo_double_double(double x, double y) { return Modulo(x, y); }
 
-ExternalReference ExternalReference::power_double_double_function(
-    Isolate* isolate) {
-  return ExternalReference(Redirect(isolate, FUNCTION_ADDR(power_double_double),
-                                    BUILTIN_FP_FP_CALL));
-}
-
-ExternalReference ExternalReference::mod_two_doubles_operation(
-    Isolate* isolate) {
-  return ExternalReference(Redirect(
-      isolate, FUNCTION_ADDR(modulo_double_double), BUILTIN_FP_FP_CALL));
+ExternalReference ExternalReference::power_double_double_function() {
+  return ExternalReference(
+      Redirect(FUNCTION_ADDR(power_double_double), BUILTIN_FP_FP_CALL));
 }
 
-ExternalReference ExternalReference::debug_last_step_action_address(
-    Isolate* isolate) {
-  return ExternalReference(isolate->debug()->last_step_action_address());
+ExternalReference ExternalReference::mod_two_doubles_operation() {
+  return ExternalReference(
+      Redirect(FUNCTION_ADDR(modulo_double_double), BUILTIN_FP_FP_CALL));
 }
 
 ExternalReference ExternalReference::debug_suspended_generator_address(
@@ -999,8 +931,7 @@ ExternalReference ExternalReference::debug_restart_fp_address(
   return ExternalReference(isolate->debug()->restart_fp_address());
 }
 
-ExternalReference ExternalReference::fixed_typed_array_base_data_offset(
-    Isolate* isolate) {
+ExternalReference ExternalReference::fixed_typed_array_base_data_offset() {
   return ExternalReference(reinterpret_cast<void*>(
       FixedTypedArrayBase::kDataOffset - kHeapObjectTag));
 }
@@ -1018,7 +949,7 @@ size_t hash_value(ExternalReference reference) {
 }
 
 std::ostream& operator<<(std::ostream& os, ExternalReference reference) {
-  os << static_cast<const void*>(reference.address());
+  os << reinterpret_cast<const void*>(reference.address());
   const Runtime::Function* fn = Runtime::FunctionForEntry(reference.address());
   if (fn) os << "<" << fn->name << ".entry>";
   return os;
diff --git a/deps/v8/src/external-reference.h b/deps/v8/src/external-reference.h
index 52abf34a636970..a22ca0157e89dc 100644
--- a/deps/v8/src/external-reference.h
+++ b/deps/v8/src/external-reference.h
@@ -22,150 +22,150 @@ class StatsCounter;
 //------------------------------------------------------------------------------
 // External references
 
-#define EXTERNAL_REFERENCE_LIST(V)                                             \
-  V(address_of_double_abs_constant, "double_absolute_constant")                \
-  V(address_of_double_neg_constant, "double_negate_constant")                  \
-  V(address_of_float_abs_constant, "float_absolute_constant")                  \
-  V(address_of_float_neg_constant, "float_negate_constant")                    \
-  V(address_of_min_int, "LDoubleConstant::min_int")                            \
-  V(address_of_minus_one_half, "double_constants.minus_one_half")              \
-  V(address_of_negative_infinity, "LDoubleConstant::negative_infinity")        \
-  V(address_of_one_half, "LDoubleConstant::one_half")                          \
-  V(address_of_pending_message_obj, "address_of_pending_message_obj")          \
-  V(address_of_real_stack_limit, "StackGuard::address_of_real_jslimit()")      \
-  V(address_of_stack_limit, "StackGuard::address_of_jslimit()")                \
-  V(address_of_the_hole_nan, "the_hole_nan")                                   \
-  V(address_of_uint32_bias, "uint32_bias")                                     \
-  V(allocation_sites_list_address, "Heap::allocation_sites_list_address()")    \
+#define EXTERNAL_REFERENCE_LIST_WITH_ISOLATE(V)                                \
+  V(isolate_address, "isolate")                                                \
   V(builtins_address, "builtins")                                              \
-  V(bytecode_size_table_address, "Bytecodes::bytecode_size_table_address")     \
-  V(check_object_type, "check_object_type")                                    \
-  V(compute_output_frames_function, "Deoptimizer::ComputeOutputFrames()")      \
-  V(copy_fast_number_jsarray_elements_to_typed_array,                          \
-    "copy_fast_number_jsarray_elements_to_typed_array")                        \
-  V(copy_typed_array_elements_slice, "copy_typed_array_elements_slice")        \
-  V(copy_typed_array_elements_to_typed_array,                                  \
-    "copy_typed_array_elements_to_typed_array")                                \
-  V(cpu_features, "cpu_features")                                              \
-  V(date_cache_stamp, "date_cache_stamp")                                      \
-  V(debug_execution_mode_address, "Isolate::debug_execution_mode()")           \
-  V(debug_hook_on_function_call_address,                                       \
-    "Debug::hook_on_function_call_address()")                                  \
-  V(debug_is_active_address, "Debug::is_active_address()")                     \
-  V(debug_last_step_action_address, "Debug::step_in_enabled_address()")        \
-  V(debug_restart_fp_address, "Debug::restart_fp_address()")                   \
-  V(debug_suspended_generator_address,                                         \
-    "Debug::step_suspended_generator_address()")                               \
-  V(delete_handle_scope_extensions, "HandleScope::DeleteExtensions")           \
-  V(f64_acos_wrapper_function, "f64_acos_wrapper")                             \
-  V(f64_asin_wrapper_function, "f64_asin_wrapper")                             \
-  V(f64_mod_wrapper_function, "f64_mod_wrapper")                               \
-  V(fixed_typed_array_base_data_offset, "fixed_typed_array_base_data_offset")  \
-  V(force_slow_path, "Isolate::force_slow_path_address()")                     \
-  V(get_date_field_function, "JSDate::GetField")                               \
-  V(get_or_create_hash_raw, "get_or_create_hash_raw")                          \
   V(handle_scope_implementer_address,                                          \
     "Isolate::handle_scope_implementer_address")                               \
-  V(handle_scope_level_address, "HandleScope::level")                          \
-  V(handle_scope_limit_address, "HandleScope::limit")                          \
-  V(handle_scope_next_address, "HandleScope::next")                            \
-  V(heap_is_marking_flag_address, "heap_is_marking_flag_address")              \
-  V(ieee754_acos_function, "base::ieee754::acos")                              \
-  V(ieee754_acosh_function, "base::ieee754::acosh")                            \
-  V(ieee754_asin_function, "base::ieee754::asin")                              \
-  V(ieee754_asinh_function, "base::ieee754::asinh")                            \
-  V(ieee754_atan2_function, "base::ieee754::atan2")                            \
-  V(ieee754_atan_function, "base::ieee754::atan")                              \
-  V(ieee754_atanh_function, "base::ieee754::atanh")                            \
-  V(ieee754_cbrt_function, "base::ieee754::cbrt")                              \
-  V(ieee754_cos_function, "base::ieee754::cos")                                \
-  V(ieee754_cosh_function, "base::ieee754::cosh")                              \
-  V(ieee754_exp_function, "base::ieee754::exp")                                \
-  V(ieee754_expm1_function, "base::ieee754::expm1")                            \
-  V(ieee754_log10_function, "base::ieee754::log10")                            \
-  V(ieee754_log1p_function, "base::ieee754::log1p")                            \
-  V(ieee754_log2_function, "base::ieee754::log2")                              \
-  V(ieee754_log_function, "base::ieee754::log")                                \
-  V(ieee754_sin_function, "base::ieee754::sin")                                \
-  V(ieee754_sinh_function, "base::ieee754::sinh")                              \
-  V(ieee754_tan_function, "base::ieee754::tan")                                \
-  V(ieee754_tanh_function, "base::ieee754::tanh")                              \
-  V(incremental_marking_record_write_function,                                 \
-    "IncrementalMarking::RecordWrite")                                         \
+  V(pending_microtask_count_address,                                           \
+    "Isolate::pending_microtask_count_address()")                              \
   V(interpreter_dispatch_counters, "Interpreter::dispatch_counters")           \
   V(interpreter_dispatch_table_address, "Interpreter::dispatch_table_address") \
-  V(invalidate_prototype_chains_function,                                      \
-    "JSObject::InvalidatePrototypeChains()")                                   \
-  V(invoke_accessor_getter_callback, "InvokeAccessorGetterCallback")           \
-  V(invoke_function_callback, "InvokeFunctionCallback")                        \
-  V(isolate_address, "isolate")                                                \
-  V(is_profiling_address, "Isolate::is_profiling")                             \
-  V(jsreceiver_create_identity_hash, "jsreceiver_create_identity_hash")        \
-  V(libc_memchr_function, "libc_memchr")                                       \
-  V(libc_memcpy_function, "libc_memcpy")                                       \
-  V(libc_memmove_function, "libc_memmove")                                     \
-  V(libc_memset_function, "libc_memset")                                       \
-  V(log_enter_external_function, "Logger::EnterExternal")                      \
-  V(log_leave_external_function, "Logger::LeaveExternal")                      \
-  V(mod_two_doubles_operation, "mod_two_doubles")                              \
-  V(new_deoptimizer_function, "Deoptimizer::New()")                            \
+  V(date_cache_stamp, "date_cache_stamp")                                      \
+  V(stress_deopt_count, "Isolate::stress_deopt_count_address()")               \
+  V(force_slow_path, "Isolate::force_slow_path_address()")                     \
+  V(roots_array_start, "Heap::roots_array_start()")                            \
+  V(allocation_sites_list_address, "Heap::allocation_sites_list_address()")    \
+  V(address_of_stack_limit, "StackGuard::address_of_jslimit()")                \
+  V(address_of_real_stack_limit, "StackGuard::address_of_real_jslimit()")      \
+  V(store_buffer_top, "store_buffer_top")                                      \
+  V(heap_is_marking_flag_address, "heap_is_marking_flag_address")              \
+  V(new_space_allocation_top_address, "Heap::NewSpaceAllocationTopAddress()")  \
   V(new_space_allocation_limit_address,                                        \
     "Heap::NewSpaceAllocationLimitAddress()")                                  \
-  V(new_space_allocation_top_address, "Heap::NewSpaceAllocationTopAddress()")  \
+  V(old_space_allocation_top_address, "Heap::OldSpaceAllocationTopAddress")    \
   V(old_space_allocation_limit_address,                                        \
     "Heap::OldSpaceAllocationLimitAddress")                                    \
-  V(old_space_allocation_top_address, "Heap::OldSpaceAllocationTopAddress")    \
-  V(orderedhashmap_gethash_raw, "orderedhashmap_gethash_raw")                  \
-  V(pending_microtask_count_address,                                           \
-    "Isolate::pending_microtask_count_address()")                              \
-  V(power_double_double_function, "power_double_double_function")              \
-  V(printf_function, "printf")                                                 \
-  V(promise_hook_or_debug_is_active_address,                                   \
-    "Isolate::promise_hook_or_debug_is_active_address()")                      \
-  V(roots_array_start, "Heap::roots_array_start()")                            \
+  V(handle_scope_level_address, "HandleScope::level")                          \
+  V(handle_scope_next_address, "HandleScope::next")                            \
+  V(handle_scope_limit_address, "HandleScope::limit")                          \
+  V(scheduled_exception_address, "Isolate::scheduled_exception")               \
+  V(address_of_pending_message_obj, "address_of_pending_message_obj")          \
+  V(get_or_create_hash_raw, "get_or_create_hash_raw")                          \
+  V(jsreceiver_create_identity_hash, "jsreceiver_create_identity_hash")        \
+  V(promise_hook_address, "Isolate::promise_hook_address()")                   \
+  V(async_event_delegate_address, "Isolate::async_event_delegate_address()")   \
+  V(promise_hook_or_async_event_delegate_address,                              \
+    "Isolate::promise_hook_or_async_event_delegate_address()")                 \
+  V(debug_is_active_address, "Debug::is_active_address()")                     \
+  V(debug_hook_on_function_call_address,                                       \
+    "Debug::hook_on_function_call_address()")                                  \
   V(runtime_function_table_address,                                            \
     "Runtime::runtime_function_table_address()")                               \
-  V(scheduled_exception_address, "Isolate::scheduled_exception")               \
-  V(search_string_raw_one_one, "search_string_raw_one_one")                    \
-  V(search_string_raw_one_two, "search_string_raw_one_two")                    \
-  V(search_string_raw_two_one, "search_string_raw_two_one")                    \
-  V(search_string_raw_two_two, "search_string_raw_two_two")                    \
-  V(store_buffer_overflow_function, "StoreBuffer::StoreBufferOverflow")        \
-  V(store_buffer_top, "store_buffer_top")                                      \
-  V(stress_deopt_count, "Isolate::stress_deopt_count_address()")               \
-  V(try_internalize_string_function, "try_internalize_string_function")        \
-  V(wasm_call_trap_callback_for_testing,                                       \
-    "wasm::call_trap_callback_for_testing")                                    \
-  V(wasm_clear_thread_in_wasm_flag, "wasm::clear_thread_in_wasm_flag")         \
-  V(wasm_f32_ceil, "wasm::f32_ceil_wrapper")                                   \
-  V(wasm_f32_floor, "wasm::f32_floor_wrapper")                                 \
-  V(wasm_f32_nearest_int, "wasm::f32_nearest_int_wrapper")                     \
-  V(wasm_f32_trunc, "wasm::f32_trunc_wrapper")                                 \
-  V(wasm_f64_ceil, "wasm::f64_ceil_wrapper")                                   \
-  V(wasm_f64_floor, "wasm::f64_floor_wrapper")                                 \
-  V(wasm_f64_nearest_int, "wasm::f64_nearest_int_wrapper")                     \
-  V(wasm_f64_trunc, "wasm::f64_trunc_wrapper")                                 \
-  V(wasm_float32_to_int64, "wasm::float32_to_int64_wrapper")                   \
-  V(wasm_float32_to_uint64, "wasm::float32_to_uint64_wrapper")                 \
-  V(wasm_float64_pow, "wasm::float64_pow")                                     \
-  V(wasm_float64_to_int64, "wasm::float64_to_int64_wrapper")                   \
-  V(wasm_float64_to_uint64, "wasm::float64_to_uint64_wrapper")                 \
-  V(wasm_int64_div, "wasm::int64_div")                                         \
-  V(wasm_int64_mod, "wasm::int64_mod")                                         \
-  V(wasm_int64_to_float32, "wasm::int64_to_float32_wrapper")                   \
-  V(wasm_int64_to_float64, "wasm::int64_to_float64_wrapper")                   \
-  V(wasm_set_thread_in_wasm_flag, "wasm::set_thread_in_wasm_flag")             \
-  V(wasm_uint64_div, "wasm::uint64_div")                                       \
-  V(wasm_uint64_mod, "wasm::uint64_mod")                                       \
-  V(wasm_uint64_to_float32, "wasm::uint64_to_float32_wrapper")                 \
-  V(wasm_uint64_to_float64, "wasm::uint64_to_float64_wrapper")                 \
-  V(wasm_word32_ctz, "wasm::word32_ctz")                                       \
-  V(wasm_word32_popcnt, "wasm::word32_popcnt")                                 \
-  V(wasm_word32_rol, "wasm::word32_rol")                                       \
-  V(wasm_word32_ror, "wasm::word32_ror")                                       \
-  V(wasm_word64_ctz, "wasm::word64_ctz")                                       \
-  V(wasm_word64_popcnt, "wasm::word64_popcnt")                                 \
-  EXTERNAL_REFERENCE_LIST_NON_INTERPRETED_REGEXP(V)                            \
+  V(is_profiling_address, "Isolate::is_profiling")                             \
+  V(debug_suspended_generator_address,                                         \
+    "Debug::step_suspended_generator_address()")                               \
+  V(debug_restart_fp_address, "Debug::restart_fp_address()")                   \
+  EXTERNAL_REFERENCE_LIST_NON_INTERPRETED_REGEXP(V)
+
+#define EXTERNAL_REFERENCE_LIST(V)                                            \
+  V(address_of_double_abs_constant, "double_absolute_constant")               \
+  V(address_of_double_neg_constant, "double_negate_constant")                 \
+  V(address_of_float_abs_constant, "float_absolute_constant")                 \
+  V(address_of_float_neg_constant, "float_negate_constant")                   \
+  V(address_of_min_int, "LDoubleConstant::min_int")                           \
+  V(address_of_one_half, "LDoubleConstant::one_half")                         \
+  V(address_of_the_hole_nan, "the_hole_nan")                                  \
+  V(address_of_uint32_bias, "uint32_bias")                                    \
+  V(bytecode_size_table_address, "Bytecodes::bytecode_size_table_address")    \
+  V(check_object_type, "check_object_type")                                   \
+  V(compute_output_frames_function, "Deoptimizer::ComputeOutputFrames()")     \
+  V(copy_fast_number_jsarray_elements_to_typed_array,                         \
+    "copy_fast_number_jsarray_elements_to_typed_array")                       \
+  V(copy_typed_array_elements_slice, "copy_typed_array_elements_slice")       \
+  V(copy_typed_array_elements_to_typed_array,                                 \
+    "copy_typed_array_elements_to_typed_array")                               \
+  V(cpu_features, "cpu_features")                                             \
+  V(delete_handle_scope_extensions, "HandleScope::DeleteExtensions")          \
+  V(f64_acos_wrapper_function, "f64_acos_wrapper")                            \
+  V(f64_asin_wrapper_function, "f64_asin_wrapper")                            \
+  V(f64_mod_wrapper_function, "f64_mod_wrapper")                              \
+  V(fixed_typed_array_base_data_offset, "fixed_typed_array_base_data_offset") \
+  V(get_date_field_function, "JSDate::GetField")                              \
+  V(ieee754_acos_function, "base::ieee754::acos")                             \
+  V(ieee754_acosh_function, "base::ieee754::acosh")                           \
+  V(ieee754_asin_function, "base::ieee754::asin")                             \
+  V(ieee754_asinh_function, "base::ieee754::asinh")                           \
+  V(ieee754_atan2_function, "base::ieee754::atan2")                           \
+  V(ieee754_atan_function, "base::ieee754::atan")                             \
+  V(ieee754_atanh_function, "base::ieee754::atanh")                           \
+  V(ieee754_cbrt_function, "base::ieee754::cbrt")                             \
+  V(ieee754_cos_function, "base::ieee754::cos")                               \
+  V(ieee754_cosh_function, "base::ieee754::cosh")                             \
+  V(ieee754_exp_function, "base::ieee754::exp")                               \
+  V(ieee754_expm1_function, "base::ieee754::expm1")                           \
+  V(ieee754_log10_function, "base::ieee754::log10")                           \
+  V(ieee754_log1p_function, "base::ieee754::log1p")                           \
+  V(ieee754_log2_function, "base::ieee754::log2")                             \
+  V(ieee754_log_function, "base::ieee754::log")                               \
+  V(ieee754_sin_function, "base::ieee754::sin")                               \
+  V(ieee754_sinh_function, "base::ieee754::sinh")                             \
+  V(ieee754_tan_function, "base::ieee754::tan")                               \
+  V(ieee754_tanh_function, "base::ieee754::tanh")                             \
+  V(incremental_marking_record_write_function,                                \
+    "IncrementalMarking::RecordWrite")                                        \
+  V(invalidate_prototype_chains_function,                                     \
+    "JSObject::InvalidatePrototypeChains()")                                  \
+  V(invoke_accessor_getter_callback, "InvokeAccessorGetterCallback")          \
+  V(invoke_function_callback, "InvokeFunctionCallback")                       \
+  V(libc_memchr_function, "libc_memchr")                                      \
+  V(libc_memcpy_function, "libc_memcpy")                                      \
+  V(libc_memmove_function, "libc_memmove")                                    \
+  V(libc_memset_function, "libc_memset")                                      \
+  V(log_enter_external_function, "Logger::EnterExternal")                     \
+  V(log_leave_external_function, "Logger::LeaveExternal")                     \
+  V(mod_two_doubles_operation, "mod_two_doubles")                             \
+  V(new_deoptimizer_function, "Deoptimizer::New()")                           \
+  V(orderedhashmap_gethash_raw, "orderedhashmap_gethash_raw")                 \
+  V(power_double_double_function, "power_double_double_function")             \
+  V(printf_function, "printf")                                                \
+  V(store_buffer_overflow_function, "StoreBuffer::StoreBufferOverflow")       \
+  V(search_string_raw_one_one, "search_string_raw_one_one")                   \
+  V(search_string_raw_one_two, "search_string_raw_one_two")                   \
+  V(search_string_raw_two_one, "search_string_raw_two_one")                   \
+  V(search_string_raw_two_two, "search_string_raw_two_two")                   \
+  V(try_internalize_string_function, "try_internalize_string_function")       \
+  V(wasm_call_trap_callback_for_testing,                                      \
+    "wasm::call_trap_callback_for_testing")                                   \
+  V(wasm_clear_thread_in_wasm_flag, "wasm::clear_thread_in_wasm_flag")        \
+  V(wasm_f32_ceil, "wasm::f32_ceil_wrapper")                                  \
+  V(wasm_f32_floor, "wasm::f32_floor_wrapper")                                \
+  V(wasm_f32_nearest_int, "wasm::f32_nearest_int_wrapper")                    \
+  V(wasm_f32_trunc, "wasm::f32_trunc_wrapper")                                \
+  V(wasm_f64_ceil, "wasm::f64_ceil_wrapper")                                  \
+  V(wasm_f64_floor, "wasm::f64_floor_wrapper")                                \
+  V(wasm_f64_nearest_int, "wasm::f64_nearest_int_wrapper")                    \
+  V(wasm_f64_trunc, "wasm::f64_trunc_wrapper")                                \
+  V(wasm_float32_to_int64, "wasm::float32_to_int64_wrapper")                  \
+  V(wasm_float32_to_uint64, "wasm::float32_to_uint64_wrapper")                \
+  V(wasm_float64_pow, "wasm::float64_pow")                                    \
+  V(wasm_float64_to_int64, "wasm::float64_to_int64_wrapper")                  \
+  V(wasm_float64_to_uint64, "wasm::float64_to_uint64_wrapper")                \
+  V(wasm_int64_div, "wasm::int64_div")                                        \
+  V(wasm_int64_mod, "wasm::int64_mod")                                        \
+  V(wasm_int64_to_float32, "wasm::int64_to_float32_wrapper")                  \
+  V(wasm_int64_to_float64, "wasm::int64_to_float64_wrapper")                  \
+  V(wasm_set_thread_in_wasm_flag, "wasm::set_thread_in_wasm_flag")            \
+  V(wasm_uint64_div, "wasm::uint64_div")                                      \
+  V(wasm_uint64_mod, "wasm::uint64_mod")                                      \
+  V(wasm_uint64_to_float32, "wasm::uint64_to_float32_wrapper")                \
+  V(wasm_uint64_to_float64, "wasm::uint64_to_float64_wrapper")                \
+  V(wasm_word32_ctz, "wasm::word32_ctz")                                      \
+  V(wasm_word32_popcnt, "wasm::word32_popcnt")                                \
+  V(wasm_word32_rol, "wasm::word32_rol")                                      \
+  V(wasm_word32_ror, "wasm::word32_ror")                                      \
+  V(wasm_word64_ctz, "wasm::word64_ctz")                                      \
+  V(wasm_word64_popcnt, "wasm::word64_popcnt")                                \
   EXTERNAL_REFERENCE_LIST_INTL(V)
 
 #ifndef V8_INTERPRETED_REGEXP
@@ -245,52 +245,54 @@ class ExternalReference BASE_EMBEDDED {
 
   static constexpr int kExternalReferenceCount =
 #define COUNT_EXTERNAL_REFERENCE(name, desc) +1
-      EXTERNAL_REFERENCE_LIST(COUNT_EXTERNAL_REFERENCE);
+      EXTERNAL_REFERENCE_LIST(COUNT_EXTERNAL_REFERENCE)
+          EXTERNAL_REFERENCE_LIST_WITH_ISOLATE(COUNT_EXTERNAL_REFERENCE);
 #undef COUNT_EXTERNAL_REFERENCE
 
-  static void SetUp();
+  typedef Address ExternalReferenceRedirector(Address original, Type type);
 
-  typedef void* ExternalReferenceRedirector(void* original, Type type);
-
-  ExternalReference() : address_(nullptr) {}
-  explicit ExternalReference(const SCTableReference& table_ref);
-  explicit ExternalReference(StatsCounter* counter);
-  ExternalReference(Address address, Isolate* isolate);
-  ExternalReference(ApiFunction* ptr, Type type, Isolate* isolate);
-  ExternalReference(const Runtime::Function* f, Isolate* isolate);
-  ExternalReference(IsolateAddressId id, Isolate* isolate);
-  ExternalReference(Runtime::FunctionId id, Isolate* isolate);
+  ExternalReference() : address_(kNullAddress) {}
+  static ExternalReference Create(const SCTableReference& table_ref);
+  static ExternalReference Create(StatsCounter* counter);
+  static ExternalReference Create(ApiFunction* ptr, Type type);
+  static ExternalReference Create(const Runtime::Function* f);
+  static ExternalReference Create(IsolateAddressId id, Isolate* isolate);
+  static ExternalReference Create(Runtime::FunctionId id);
+  static V8_EXPORT_PRIVATE ExternalReference Create(Address address);
 
   template <typename SubjectChar, typename PatternChar>
-  static ExternalReference search_string_raw(Isolate* isolate);
+  static ExternalReference search_string_raw();
 
   static ExternalReference page_flags(Page* page);
 
   static ExternalReference ForDeoptEntry(Address entry);
 
+#define DECL_EXTERNAL_REFERENCE(name, desc) static ExternalReference name();
+  EXTERNAL_REFERENCE_LIST(DECL_EXTERNAL_REFERENCE)
+#undef DECL_EXTERNAL_REFERENCE
+
 #define DECL_EXTERNAL_REFERENCE(name, desc) \
   static ExternalReference name(Isolate* isolate);
-  EXTERNAL_REFERENCE_LIST(DECL_EXTERNAL_REFERENCE)
+  EXTERNAL_REFERENCE_LIST_WITH_ISOLATE(DECL_EXTERNAL_REFERENCE)
 #undef DECL_EXTERNAL_REFERENCE
 
   V8_EXPORT_PRIVATE V8_NOINLINE static ExternalReference
   runtime_function_table_address_for_unittests(Isolate* isolate);
 
-  Address address() const { return reinterpret_cast<Address>(address_); }
-
-  // This lets you register a function that rewrites all external references.
-  // Used by the ARM simulator to catch calls to external references.
-  static void set_redirector(Isolate* isolate,
-                             ExternalReferenceRedirector* redirector);
+  Address address() const { return address_; }
 
  private:
-  explicit ExternalReference(void* address) : address_(address) {}
+  explicit ExternalReference(Address address) : address_(address) {}
+
+  explicit ExternalReference(void* address)
+      : address_(reinterpret_cast<Address>(address)) {}
 
-  static void* Redirect(Isolate* isolate, Address address_arg,
-                        Type type = ExternalReference::BUILTIN_CALL);
+  static Address Redirect(Address address_arg,
+                          Type type = ExternalReference::BUILTIN_CALL);
 
-  void* address_;
+  Address address_;
 };
+ASSERT_TRIVIALLY_COPYABLE(ExternalReference);
 
 V8_EXPORT_PRIVATE bool operator==(ExternalReference, ExternalReference);
 bool operator!=(ExternalReference, ExternalReference);
diff --git a/deps/v8/src/feedback-vector-inl.h b/deps/v8/src/feedback-vector-inl.h
index a2e27807ef2c49..c3c0c8c63d3ebc 100644
--- a/deps/v8/src/feedback-vector-inl.h
+++ b/deps/v8/src/feedback-vector-inl.h
@@ -22,7 +22,7 @@ INT32_ACCESSORS(FeedbackMetadata, slot_count, kSlotCountOffset)
 
 int32_t FeedbackMetadata::synchronized_slot_count() const {
   return base::Acquire_Load(reinterpret_cast<const base::Atomic32*>(
-          FIELD_ADDR_CONST(this, kSlotCountOffset)));
+      FIELD_ADDR(this, kSlotCountOffset)));
 }
 
 // static
@@ -145,32 +145,41 @@ FeedbackSlot FeedbackVector::ToSlot(int index) {
   return FeedbackSlot(index);
 }
 
-Object* FeedbackVector::Get(FeedbackSlot slot) const {
+MaybeObject* FeedbackVector::Get(FeedbackSlot slot) const {
   return get(GetIndex(slot));
 }
 
-Object* FeedbackVector::get(int index) const {
+MaybeObject* FeedbackVector::get(int index) const {
   DCHECK_GE(index, 0);
   DCHECK_LT(index, this->length());
   int offset = kFeedbackSlotsOffset + index * kPointerSize;
-  return RELAXED_READ_FIELD(this, offset);
+  return RELAXED_READ_WEAK_FIELD(this, offset);
 }
 
-void FeedbackVector::Set(FeedbackSlot slot, Object* value,
+void FeedbackVector::Set(FeedbackSlot slot, MaybeObject* value,
                          WriteBarrierMode mode) {
   set(GetIndex(slot), value, mode);
 }
 
-void FeedbackVector::set(int index, Object* value, WriteBarrierMode mode) {
+void FeedbackVector::set(int index, MaybeObject* value, WriteBarrierMode mode) {
   DCHECK_GE(index, 0);
   DCHECK_LT(index, this->length());
   int offset = kFeedbackSlotsOffset + index * kPointerSize;
   RELAXED_WRITE_FIELD(this, offset, value);
-  CONDITIONAL_WRITE_BARRIER(GetHeap(), this, offset, value, mode);
+  CONDITIONAL_WEAK_WRITE_BARRIER(GetHeap(), this, offset, value, mode);
+}
+
+void FeedbackVector::Set(FeedbackSlot slot, Object* value,
+                         WriteBarrierMode mode) {
+  set(GetIndex(slot), MaybeObject::FromObject(value), mode);
 }
 
-inline Object** FeedbackVector::slots_start() {
-  return HeapObject::RawField(this, kFeedbackSlotsOffset);
+void FeedbackVector::set(int index, Object* value, WriteBarrierMode mode) {
+  set(index, MaybeObject::FromObject(value), mode);
+}
+
+inline MaybeObject** FeedbackVector::slots_start() {
+  return HeapObject::RawMaybeWeakField(this, kFeedbackSlotsOffset);
 }
 
 // Helper function to transform the feedback to BinaryOperationHint.
@@ -240,8 +249,8 @@ ForInHint ForInHintFromFeedback(int type_feedback) {
 
 void FeedbackVector::ComputeCounts(int* with_type_info, int* generic,
                                    int* vector_ic_count) {
-  Object* megamorphic_sentinel =
-      *FeedbackVector::MegamorphicSentinel(GetIsolate());
+  MaybeObject* megamorphic_sentinel = MaybeObject::FromObject(
+      *FeedbackVector::MegamorphicSentinel(GetIsolate()));
   int with = 0;
   int gen = 0;
   int total = 0;
@@ -250,7 +259,8 @@ void FeedbackVector::ComputeCounts(int* with_type_info, int* generic,
     FeedbackSlot slot = iter.Next();
     FeedbackSlotKind kind = iter.kind();
 
-    Object* const obj = Get(slot);
+    MaybeObject* const obj = Get(slot);
+    AssertNoLegacyTypes(obj);
     switch (kind) {
       case FeedbackSlotKind::kCall:
       case FeedbackSlotKind::kLoadProperty:
@@ -267,7 +277,10 @@ void FeedbackVector::ComputeCounts(int* with_type_info, int* generic,
       case FeedbackSlotKind::kStoreInArrayLiteral:
       case FeedbackSlotKind::kStoreDataPropertyInLiteral:
       case FeedbackSlotKind::kTypeProfile: {
-        if (obj->IsWeakCell() || obj->IsFixedArray() || obj->IsString()) {
+        HeapObject* heap_object;
+        if (obj->IsWeakOrClearedHeapObject() ||
+            (obj->ToStrongHeapObject(&heap_object) &&
+             (heap_object->IsWeakFixedArray() || heap_object->IsString()))) {
           with++;
         } else if (obj == megamorphic_sentinel) {
           gen++;
@@ -277,7 +290,7 @@ void FeedbackVector::ComputeCounts(int* with_type_info, int* generic,
         break;
       }
       case FeedbackSlotKind::kBinaryOp: {
-        int const feedback = Smi::ToInt(obj);
+        int const feedback = Smi::ToInt(obj->ToSmi());
         BinaryOperationHint hint = BinaryOperationHintFromFeedback(feedback);
         if (hint == BinaryOperationHint::kAny) {
           gen++;
@@ -289,20 +302,19 @@ void FeedbackVector::ComputeCounts(int* with_type_info, int* generic,
         break;
       }
       case FeedbackSlotKind::kCompareOp: {
-          int const feedback = Smi::ToInt(obj);
-          CompareOperationHint hint =
-              CompareOperationHintFromFeedback(feedback);
-          if (hint == CompareOperationHint::kAny) {
-            gen++;
-          }
-          if (hint != CompareOperationHint::kNone) {
-            with++;
-          }
-          total++;
+        int const feedback = Smi::ToInt(obj->ToSmi());
+        CompareOperationHint hint = CompareOperationHintFromFeedback(feedback);
+        if (hint == CompareOperationHint::kAny) {
+          gen++;
+        }
+        if (hint != CompareOperationHint::kNone) {
+          with++;
+        }
+        total++;
         break;
       }
       case FeedbackSlotKind::kForIn: {
-        int const feedback = Smi::ToInt(obj);
+        int const feedback = Smi::ToInt(obj->ToSmi());
         ForInHint hint = ForInHintFromFeedback(feedback);
         if (hint == ForInHint::kAny) {
           gen++;
@@ -314,7 +326,7 @@ void FeedbackVector::ComputeCounts(int* with_type_info, int* generic,
         break;
       }
       case FeedbackSlotKind::kInstanceOf: {
-        if (obj->IsWeakCell()) {
+        if (obj->IsWeakOrClearedHeapObject()) {
           with++;
         } else if (obj == megamorphic_sentinel) {
           gen++;
@@ -355,7 +367,7 @@ Handle<Symbol> FeedbackVector::PremonomorphicSentinel(Isolate* isolate) {
 }
 
 Symbol* FeedbackVector::RawUninitializedSentinel(Isolate* isolate) {
-  return isolate->heap()->uninitialized_symbol();
+  return ReadOnlyRoots(isolate).uninitialized_symbol();
 }
 
 bool FeedbackMetadataIterator::HasNext() const {
@@ -374,9 +386,13 @@ int FeedbackMetadataIterator::entry_size() const {
   return FeedbackMetadata::GetSlotSize(kind());
 }
 
-Object* FeedbackNexus::GetFeedback() const { return vector()->Get(slot()); }
+MaybeObject* FeedbackNexus::GetFeedback() const {
+  MaybeObject* feedback = vector()->Get(slot());
+  FeedbackVector::AssertNoLegacyTypes(feedback);
+  return feedback;
+}
 
-Object* FeedbackNexus::GetFeedbackExtra() const {
+MaybeObject* FeedbackNexus::GetFeedbackExtra() const {
 #ifdef DEBUG
   FeedbackSlotKind kind = vector()->GetKind(slot());
   DCHECK_LT(1, FeedbackMetadata::GetSlotSize(kind));
@@ -386,6 +402,11 @@ Object* FeedbackNexus::GetFeedbackExtra() const {
 }
 
 void FeedbackNexus::SetFeedback(Object* feedback, WriteBarrierMode mode) {
+  SetFeedback(MaybeObject::FromObject(feedback));
+}
+
+void FeedbackNexus::SetFeedback(MaybeObject* feedback, WriteBarrierMode mode) {
+  FeedbackVector::AssertNoLegacyTypes(feedback);
   vector()->Set(slot(), feedback, mode);
 }
 
@@ -394,6 +415,16 @@ void FeedbackNexus::SetFeedbackExtra(Object* feedback_extra,
 #ifdef DEBUG
   FeedbackSlotKind kind = vector()->GetKind(slot());
   DCHECK_LT(1, FeedbackMetadata::GetSlotSize(kind));
+  FeedbackVector::AssertNoLegacyTypes(MaybeObject::FromObject(feedback_extra));
+#endif
+  int index = vector()->GetIndex(slot()) + 1;
+  vector()->set(index, MaybeObject::FromObject(feedback_extra), mode);
+}
+
+void FeedbackNexus::SetFeedbackExtra(MaybeObject* feedback_extra,
+                                     WriteBarrierMode mode) {
+#ifdef DEBUG
+  FeedbackVector::AssertNoLegacyTypes(feedback_extra);
 #endif
   int index = vector()->GetIndex(slot()) + 1;
   vector()->set(index, feedback_extra, mode);
diff --git a/deps/v8/src/feedback-vector.cc b/deps/v8/src/feedback-vector.cc
index 28ed6394c5d115..71ba61565e1a73 100644
--- a/deps/v8/src/feedback-vector.cc
+++ b/deps/v8/src/feedback-vector.cc
@@ -7,6 +7,7 @@
 #include "src/feedback-vector-inl.h"
 #include "src/ic/ic-inl.h"
 #include "src/objects.h"
+#include "src/objects/hash-table-inl.h"
 #include "src/objects/object-macros.h"
 
 namespace v8 {
@@ -38,14 +39,16 @@ bool FeedbackVectorSpec::HasTypeProfileSlot() const {
   return GetKind(slot) == FeedbackSlotKind::kTypeProfile;
 }
 
-static bool IsPropertyNameFeedback(Object* feedback) {
-  if (feedback->IsString()) return true;
-  if (!feedback->IsSymbol()) return false;
-  Symbol* symbol = Symbol::cast(feedback);
-  Heap* heap = symbol->GetHeap();
-  return symbol != heap->uninitialized_symbol() &&
-         symbol != heap->premonomorphic_symbol() &&
-         symbol != heap->megamorphic_symbol();
+static bool IsPropertyNameFeedback(MaybeObject* feedback) {
+  HeapObject* heap_object;
+  if (!feedback->ToStrongHeapObject(&heap_object)) return false;
+  if (heap_object->IsString()) return true;
+  if (!heap_object->IsSymbol()) return false;
+  Symbol* symbol = Symbol::cast(heap_object);
+  ReadOnlyRoots roots = symbol->GetReadOnlyRoots();
+  return symbol != roots.uninitialized_symbol() &&
+         symbol != roots.premonomorphic_symbol() &&
+         symbol != roots.megamorphic_symbol();
 }
 
 std::ostream& operator<<(std::ostream& os, FeedbackSlotKind kind) {
@@ -216,7 +219,8 @@ Handle<FeedbackVector> FeedbackVector::New(Isolate* isolate,
 
   // Ensure we can skip the write barrier
   Handle<Object> uninitialized_sentinel = UninitializedSentinel(isolate);
-  DCHECK_EQ(isolate->heap()->uninitialized_symbol(), *uninitialized_sentinel);
+  DCHECK_EQ(ReadOnlyRoots(isolate).uninitialized_symbol(),
+            *uninitialized_sentinel);
   Handle<Oddball> undefined_value = factory->undefined_value();
   for (int i = 0; i < slot_count;) {
     FeedbackSlot slot(i);
@@ -230,7 +234,7 @@ Handle<FeedbackVector> FeedbackVector::New(Isolate* isolate,
       case FeedbackSlotKind::kLoadGlobalNotInsideTypeof:
       case FeedbackSlotKind::kStoreGlobalSloppy:
       case FeedbackSlotKind::kStoreGlobalStrict:
-        vector->set(index, isolate->heap()->empty_weak_cell(),
+        vector->set(index, HeapObjectReference::ClearedValue(),
                     SKIP_WRITE_BARRIER);
         break;
       case FeedbackSlotKind::kForIn:
@@ -283,19 +287,6 @@ Handle<FeedbackVector> FeedbackVector::New(Isolate* isolate,
   return result;
 }
 
-// static
-Handle<FeedbackVector> FeedbackVector::Copy(Isolate* isolate,
-                                            Handle<FeedbackVector> vector) {
-  Handle<FeedbackVector> result;
-  result = Handle<FeedbackVector>::cast(
-      isolate->factory()->CopyFixedArray(Handle<FixedArray>::cast(vector)));
-  if (!isolate->is_best_effort_code_coverage() ||
-      isolate->is_collecting_type_profile()) {
-    AddToVectorsForProfilingTools(isolate, result);
-  }
-  return result;
-}
-
 // static
 void FeedbackVector::AddToVectorsForProfilingTools(
     Isolate* isolate, Handle<FeedbackVector> vector) {
@@ -358,15 +349,15 @@ void FeedbackVector::EvictOptimizedCodeMarkedForDeoptimization(
 }
 
 bool FeedbackVector::ClearSlots(Isolate* isolate) {
-  Object* uninitialized_sentinel =
-      FeedbackVector::RawUninitializedSentinel(isolate);
+  MaybeObject* uninitialized_sentinel = MaybeObject::FromObject(
+      FeedbackVector::RawUninitializedSentinel(isolate));
 
   bool feedback_updated = false;
   FeedbackMetadataIterator iter(metadata());
   while (iter.HasNext()) {
     FeedbackSlot slot = iter.Next();
 
-    Object* obj = Get(slot);
+    MaybeObject* obj = Get(slot);
     if (obj != uninitialized_sentinel) {
       FeedbackNexus nexus(this, slot);
       feedback_updated |= nexus.Clear();
@@ -375,28 +366,42 @@ bool FeedbackVector::ClearSlots(Isolate* isolate) {
   return feedback_updated;
 }
 
-Handle<FixedArray> FeedbackNexus::EnsureArrayOfSize(int length) {
+void FeedbackVector::AssertNoLegacyTypes(MaybeObject* object) {
+#ifdef DEBUG
+  HeapObject* heap_object;
+  if (object->ToStrongOrWeakHeapObject(&heap_object)) {
+    // Instead of FixedArray, the Feedback and the Extra should contain
+    // WeakFixedArrays. The only allowed FixedArray subtype is HashTable.
+    DCHECK_IMPLIES(heap_object->IsFixedArray(), heap_object->IsHashTable());
+    DCHECK(!heap_object->IsWeakCell());
+  }
+#endif
+}
+
+Handle<WeakFixedArray> FeedbackNexus::EnsureArrayOfSize(int length) {
   Isolate* isolate = GetIsolate();
-  Handle<Object> feedback = handle(GetFeedback(), isolate);
-  if (!feedback->IsFixedArray() ||
-      FixedArray::cast(*feedback)->length() != length) {
-    Handle<FixedArray> array = isolate->factory()->NewFixedArray(length);
-    SetFeedback(*array);
-    return array;
+  HeapObject* heap_object;
+  if (GetFeedback()->ToStrongHeapObject(&heap_object) &&
+      heap_object->IsWeakFixedArray() &&
+      WeakFixedArray::cast(heap_object)->length() == length) {
+    return handle(WeakFixedArray::cast(heap_object), isolate);
   }
-  return Handle<FixedArray>::cast(feedback);
+  Handle<WeakFixedArray> array = isolate->factory()->NewWeakFixedArray(length);
+  SetFeedback(*array);
+  return array;
 }
 
-Handle<FixedArray> FeedbackNexus::EnsureExtraArrayOfSize(int length) {
+Handle<WeakFixedArray> FeedbackNexus::EnsureExtraArrayOfSize(int length) {
   Isolate* isolate = GetIsolate();
-  Handle<Object> feedback_extra = handle(GetFeedbackExtra(), isolate);
-  if (!feedback_extra->IsFixedArray() ||
-      FixedArray::cast(*feedback_extra)->length() != length) {
-    Handle<FixedArray> array = isolate->factory()->NewFixedArray(length);
-    SetFeedbackExtra(*array);
-    return array;
+  HeapObject* heap_object;
+  if (GetFeedbackExtra()->ToStrongHeapObject(&heap_object) &&
+      heap_object->IsWeakFixedArray() &&
+      WeakFixedArray::cast(heap_object)->length() == length) {
+    return handle(WeakFixedArray::cast(heap_object), isolate);
   }
-  return Handle<FixedArray>::cast(feedback_extra);
+  Handle<WeakFixedArray> array = isolate->factory()->NewWeakFixedArray(length);
+  SetFeedbackExtra(*array);
+  return array;
 }
 
 void FeedbackNexus::ConfigureUninitialized() {
@@ -406,7 +411,7 @@ void FeedbackNexus::ConfigureUninitialized() {
     case FeedbackSlotKind::kStoreGlobalStrict:
     case FeedbackSlotKind::kLoadGlobalNotInsideTypeof:
     case FeedbackSlotKind::kLoadGlobalInsideTypeof: {
-      SetFeedback(isolate->heap()->empty_weak_cell(), SKIP_WRITE_BARRIER);
+      SetFeedback(HeapObjectReference::ClearedValue(), SKIP_WRITE_BARRIER);
       SetFeedbackExtra(*FeedbackVector::UninitializedSentinel(isolate),
                        SKIP_WRITE_BARRIER);
       break;
@@ -500,14 +505,15 @@ bool FeedbackNexus::ConfigureMegamorphic(IcCheckType property_type) {
   DisallowHeapAllocation no_gc;
   Isolate* isolate = GetIsolate();
   bool changed = false;
-  Symbol* sentinel = *FeedbackVector::MegamorphicSentinel(isolate);
+  MaybeObject* sentinel =
+      MaybeObject::FromObject(*FeedbackVector::MegamorphicSentinel(isolate));
   if (GetFeedback() != sentinel) {
     SetFeedback(sentinel, SKIP_WRITE_BARRIER);
     changed = true;
   }
 
   Smi* extra = Smi::FromInt(static_cast<int>(property_type));
-  if (changed || GetFeedbackExtra() != extra) {
+  if (changed || GetFeedbackExtra() != MaybeObject::FromSmi(extra)) {
     SetFeedbackExtra(extra, SKIP_WRITE_BARRIER);
     changed = true;
   }
@@ -516,7 +522,7 @@ bool FeedbackNexus::ConfigureMegamorphic(IcCheckType property_type) {
 
 InlineCacheState FeedbackNexus::StateFromFeedback() const {
   Isolate* isolate = GetIsolate();
-  Object* feedback = GetFeedback();
+  MaybeObject* feedback = GetFeedback();
 
   switch (kind()) {
     case FeedbackSlotKind::kCreateClosure:
@@ -531,9 +537,11 @@ InlineCacheState FeedbackNexus::StateFromFeedback() const {
     case FeedbackSlotKind::kLoadGlobalInsideTypeof: {
       if (feedback->IsSmi()) return MONOMORPHIC;
 
-      Object* extra = GetFeedbackExtra();
-      if (!WeakCell::cast(feedback)->cleared() ||
-          extra != *FeedbackVector::UninitializedSentinel(isolate)) {
+      DCHECK(feedback->IsWeakOrClearedHeapObject());
+      MaybeObject* extra = GetFeedbackExtra();
+      if (!feedback->IsClearedWeakHeapObject() ||
+          extra != MaybeObject::FromObject(
+                       *FeedbackVector::UninitializedSentinel(isolate))) {
         return MONOMORPHIC;
       }
       return UNINITIALIZED;
@@ -547,40 +555,51 @@ InlineCacheState FeedbackNexus::StateFromFeedback() const {
     case FeedbackSlotKind::kStoreOwnNamed:
     case FeedbackSlotKind::kLoadProperty:
     case FeedbackSlotKind::kLoadKeyed: {
-      if (feedback == *FeedbackVector::UninitializedSentinel(isolate)) {
+      if (feedback == MaybeObject::FromObject(
+                          *FeedbackVector::UninitializedSentinel(isolate))) {
         return UNINITIALIZED;
       }
-      if (feedback == *FeedbackVector::MegamorphicSentinel(isolate)) {
+      if (feedback == MaybeObject::FromObject(
+                          *FeedbackVector::MegamorphicSentinel(isolate))) {
         return MEGAMORPHIC;
       }
-      if (feedback == *FeedbackVector::PremonomorphicSentinel(isolate)) {
+      if (feedback == MaybeObject::FromObject(
+                          *FeedbackVector::PremonomorphicSentinel(isolate))) {
         return PREMONOMORPHIC;
       }
-      if (feedback->IsFixedArray()) {
-        // Determine state purely by our structure, don't check if the maps are
-        // cleared.
-        return POLYMORPHIC;
-      }
-      if (feedback->IsWeakCell()) {
+      if (feedback->IsWeakOrClearedHeapObject()) {
         // Don't check if the map is cleared.
         return MONOMORPHIC;
       }
-      if (feedback->IsName()) {
-        DCHECK(IsKeyedLoadICKind(kind()) || IsKeyedStoreICKind(kind()));
-        Object* extra = GetFeedbackExtra();
-        FixedArray* extra_array = FixedArray::cast(extra);
-        return extra_array->length() > 2 ? POLYMORPHIC : MONOMORPHIC;
+      HeapObject* heap_object;
+      if (feedback->ToStrongHeapObject(&heap_object)) {
+        if (heap_object->IsWeakFixedArray()) {
+          // Determine state purely by our structure, don't check if the maps
+          // are cleared.
+          return POLYMORPHIC;
+        }
+        if (heap_object->IsName()) {
+          DCHECK(IsKeyedLoadICKind(kind()) || IsKeyedStoreICKind(kind()));
+          Object* extra = GetFeedbackExtra()->ToStrongHeapObject();
+          WeakFixedArray* extra_array = WeakFixedArray::cast(extra);
+          return extra_array->length() > 2 ? POLYMORPHIC : MONOMORPHIC;
+        }
       }
       UNREACHABLE();
     }
     case FeedbackSlotKind::kCall: {
-      if (feedback == *FeedbackVector::MegamorphicSentinel(isolate)) {
+      HeapObject* heap_object;
+      if (feedback == MaybeObject::FromObject(
+                          *FeedbackVector::MegamorphicSentinel(isolate))) {
         return GENERIC;
-      } else if (feedback->IsAllocationSite() || feedback->IsWeakCell()) {
+      } else if (feedback->IsWeakOrClearedHeapObject() ||
+                 (feedback->ToStrongHeapObject(&heap_object) &&
+                  heap_object->IsAllocationSite())) {
         return MONOMORPHIC;
       }
 
-      CHECK(feedback == *FeedbackVector::UninitializedSentinel(isolate));
+      CHECK_EQ(feedback, MaybeObject::FromObject(
+                             *FeedbackVector::UninitializedSentinel(isolate)));
       return UNINITIALIZED;
     }
     case FeedbackSlotKind::kBinaryOp: {
@@ -613,17 +632,21 @@ InlineCacheState FeedbackNexus::StateFromFeedback() const {
       return MONOMORPHIC;
     }
     case FeedbackSlotKind::kInstanceOf: {
-      if (feedback == *FeedbackVector::UninitializedSentinel(isolate)) {
+      if (feedback == MaybeObject::FromObject(
+                          *FeedbackVector::UninitializedSentinel(isolate))) {
         return UNINITIALIZED;
-      } else if (feedback == *FeedbackVector::MegamorphicSentinel(isolate)) {
+      } else if (feedback ==
+                 MaybeObject::FromObject(
+                     *FeedbackVector::MegamorphicSentinel(isolate))) {
         return MEGAMORPHIC;
       }
       return MONOMORPHIC;
     }
     case FeedbackSlotKind::kStoreDataPropertyInLiteral: {
-      if (feedback == *FeedbackVector::UninitializedSentinel(isolate)) {
+      if (feedback == MaybeObject::FromObject(
+                          *FeedbackVector::UninitializedSentinel(isolate))) {
         return UNINITIALIZED;
-      } else if (feedback->IsWeakCell()) {
+      } else if (feedback->IsWeakOrClearedHeapObject()) {
         // Don't check if the map is cleared.
         return MONOMORPHIC;
       }
@@ -631,7 +654,8 @@ InlineCacheState FeedbackNexus::StateFromFeedback() const {
       return MEGAMORPHIC;
     }
     case FeedbackSlotKind::kTypeProfile: {
-      if (feedback == *FeedbackVector::UninitializedSentinel(isolate)) {
+      if (feedback == MaybeObject::FromObject(
+                          *FeedbackVector::UninitializedSentinel(isolate))) {
         return UNINITIALIZED;
       }
       return MONOMORPHIC;
@@ -648,7 +672,7 @@ InlineCacheState FeedbackNexus::StateFromFeedback() const {
 void FeedbackNexus::ConfigurePropertyCellMode(Handle<PropertyCell> cell) {
   DCHECK(IsGlobalICKind(kind()));
   Isolate* isolate = GetIsolate();
-  SetFeedback(*isolate->factory()->NewWeakCell(cell));
+  SetFeedback(HeapObjectReference::Weak(*cell));
   SetFeedbackExtra(*FeedbackVector::UninitializedSentinel(isolate),
                    SKIP_WRITE_BARRIER);
 }
@@ -672,16 +696,17 @@ bool FeedbackNexus::ConfigureLexicalVarMode(int script_context_index,
   return true;
 }
 
-void FeedbackNexus::ConfigureHandlerMode(Handle<Object> handler) {
+void FeedbackNexus::ConfigureHandlerMode(const MaybeObjectHandle& handler) {
   DCHECK(IsGlobalICKind(kind()));
-  SetFeedback(GetIsolate()->heap()->empty_weak_cell());
+  DCHECK(IC::IsHandler(*handler));
+  SetFeedback(HeapObjectReference::ClearedValue());
   SetFeedbackExtra(*handler);
 }
 
 int FeedbackNexus::GetCallCount() {
   DCHECK(IsCallICKind(kind()));
 
-  Object* call_count = GetFeedbackExtra();
+  Object* call_count = GetFeedbackExtra()->ToObject();
   CHECK(call_count->IsSmi());
   uint32_t value = static_cast<uint32_t>(Smi::ToInt(call_count));
   return CallCountField::decode(value);
@@ -690,7 +715,7 @@ int FeedbackNexus::GetCallCount() {
 void FeedbackNexus::SetSpeculationMode(SpeculationMode mode) {
   DCHECK(IsCallICKind(kind()));
 
-  Object* call_count = GetFeedbackExtra();
+  Object* call_count = GetFeedbackExtra()->ToObject();
   CHECK(call_count->IsSmi());
   uint32_t count = static_cast<uint32_t>(Smi::ToInt(call_count));
   uint32_t value = CallCountField::encode(CallCountField::decode(count));
@@ -701,7 +726,7 @@ void FeedbackNexus::SetSpeculationMode(SpeculationMode mode) {
 SpeculationMode FeedbackNexus::GetSpeculationMode() {
   DCHECK(IsCallICKind(kind()));
 
-  Object* call_count = GetFeedbackExtra();
+  Object* call_count = GetFeedbackExtra()->ToObject();
   CHECK(call_count->IsSmi());
   uint32_t value = static_cast<uint32_t>(Smi::ToInt(call_count));
   return SpeculationModeField::decode(value);
@@ -721,30 +746,31 @@ float FeedbackNexus::ComputeCallFrequency() {
 
 void FeedbackNexus::ConfigureMonomorphic(Handle<Name> name,
                                          Handle<Map> receiver_map,
-                                         Handle<Object> handler) {
-  Handle<WeakCell> cell = Map::WeakCellForMap(receiver_map);
+                                         const MaybeObjectHandle& handler) {
+  DCHECK(handler.is_null() || IC::IsHandler(*handler));
   if (kind() == FeedbackSlotKind::kStoreDataPropertyInLiteral) {
-    SetFeedback(*cell);
+    SetFeedback(HeapObjectReference::Weak(*receiver_map));
     SetFeedbackExtra(*name);
   } else {
     if (name.is_null()) {
-      SetFeedback(*cell);
+      SetFeedback(HeapObjectReference::Weak(*receiver_map));
       SetFeedbackExtra(*handler);
     } else {
-      Handle<FixedArray> array = EnsureExtraArrayOfSize(2);
+      Handle<WeakFixedArray> array = EnsureExtraArrayOfSize(2);
       SetFeedback(*name);
-      array->set(0, *cell);
-      array->set(1, *handler);
+      array->Set(0, HeapObjectReference::Weak(*receiver_map));
+      array->Set(1, *handler);
     }
   }
 }
 
 void FeedbackNexus::ConfigurePolymorphic(Handle<Name> name,
                                          MapHandles const& maps,
-                                         ObjectHandles* handlers) {
+                                         MaybeObjectHandles* handlers) {
+  DCHECK_EQ(handlers->size(), maps.size());
   int receiver_count = static_cast<int>(maps.size());
   DCHECK_GT(receiver_count, 1);
-  Handle<FixedArray> array;
+  Handle<WeakFixedArray> array;
   if (name.is_null()) {
     array = EnsureArrayOfSize(receiver_count * 2);
     SetFeedbackExtra(*FeedbackVector::UninitializedSentinel(GetIsolate()),
@@ -756,9 +782,9 @@ void FeedbackNexus::ConfigurePolymorphic(Handle<Name> name,
 
   for (int current = 0; current < receiver_count; ++current) {
     Handle<Map> map = maps[current];
-    Handle<WeakCell> cell = Map::WeakCellForMap(map);
-    array->set(current * 2, *cell);
-    array->set(current * 2 + 1, *handlers->at(current));
+    array->Set(current * 2, HeapObjectReference::Weak(*map));
+    DCHECK(IC::IsHandler(*handlers->at(current)));
+    array->Set(current * 2 + 1, *handlers->at(current));
   }
 }
 
@@ -769,111 +795,122 @@ int FeedbackNexus::ExtractMaps(MapHandles* maps) const {
          IsStoreInArrayLiteralICKind(kind()));
 
   Isolate* isolate = GetIsolate();
-  Object* feedback = GetFeedback();
+  MaybeObject* feedback = GetFeedback();
   bool is_named_feedback = IsPropertyNameFeedback(feedback);
-  if (feedback->IsFixedArray() || is_named_feedback) {
+  HeapObject* heap_object;
+  if ((feedback->ToStrongHeapObject(&heap_object) &&
+       heap_object->IsWeakFixedArray()) ||
+      is_named_feedback) {
     int found = 0;
+    WeakFixedArray* array;
     if (is_named_feedback) {
-      feedback = GetFeedbackExtra();
+      array = WeakFixedArray::cast(GetFeedbackExtra()->ToStrongHeapObject());
+    } else {
+      array = WeakFixedArray::cast(heap_object);
     }
-    FixedArray* array = FixedArray::cast(feedback);
     const int increment = 2;
+    HeapObject* heap_object;
     for (int i = 0; i < array->length(); i += increment) {
-      DCHECK(array->get(i)->IsWeakCell());
-      WeakCell* cell = WeakCell::cast(array->get(i));
-      if (!cell->cleared()) {
-        Map* map = Map::cast(cell->value());
+      DCHECK(array->Get(i)->IsWeakOrClearedHeapObject());
+      if (array->Get(i)->ToWeakHeapObject(&heap_object)) {
+        Map* map = Map::cast(heap_object);
         maps->push_back(handle(map, isolate));
         found++;
       }
     }
     return found;
-  } else if (feedback->IsWeakCell()) {
-    WeakCell* cell = WeakCell::cast(feedback);
-    if (!cell->cleared()) {
-      Map* map = Map::cast(cell->value());
-      maps->push_back(handle(map, isolate));
-      return 1;
-    }
+  } else if (feedback->ToWeakHeapObject(&heap_object)) {
+    Map* map = Map::cast(heap_object);
+    maps->push_back(handle(map, isolate));
+    return 1;
   }
 
   return 0;
 }
 
-MaybeHandle<Object> FeedbackNexus::FindHandlerForMap(Handle<Map> map) const {
+MaybeObjectHandle FeedbackNexus::FindHandlerForMap(Handle<Map> map) const {
   DCHECK(IsLoadICKind(kind()) || IsStoreICKind(kind()) ||
          IsKeyedLoadICKind(kind()) || IsKeyedStoreICKind(kind()) ||
          IsStoreOwnICKind(kind()) || IsStoreDataPropertyInLiteralKind(kind()));
 
-  Object* feedback = GetFeedback();
+  MaybeObject* feedback = GetFeedback();
   Isolate* isolate = GetIsolate();
   bool is_named_feedback = IsPropertyNameFeedback(feedback);
-  if (feedback->IsFixedArray() || is_named_feedback) {
+  HeapObject* heap_object;
+  if ((feedback->ToStrongHeapObject(&heap_object) &&
+       heap_object->IsWeakFixedArray()) ||
+      is_named_feedback) {
+    WeakFixedArray* array;
     if (is_named_feedback) {
-      feedback = GetFeedbackExtra();
+      array = WeakFixedArray::cast(GetFeedbackExtra()->ToStrongHeapObject());
+    } else {
+      array = WeakFixedArray::cast(heap_object);
     }
-    FixedArray* array = FixedArray::cast(feedback);
     const int increment = 2;
+    HeapObject* heap_object;
     for (int i = 0; i < array->length(); i += increment) {
-      DCHECK(array->get(i)->IsWeakCell());
-      WeakCell* cell = WeakCell::cast(array->get(i));
-      if (!cell->cleared()) {
-        Map* array_map = Map::cast(cell->value());
-        if (array_map == *map) {
-          Object* code = array->get(i + increment - 1);
-          DCHECK(IC::IsHandler(code));
-          return handle(code, isolate);
+      DCHECK(array->Get(i)->IsWeakOrClearedHeapObject());
+      if (array->Get(i)->ToWeakHeapObject(&heap_object)) {
+        Map* array_map = Map::cast(heap_object);
+        if (array_map == *map &&
+            !array->Get(i + increment - 1)->IsClearedWeakHeapObject()) {
+          MaybeObject* handler = array->Get(i + increment - 1);
+          DCHECK(IC::IsHandler(handler));
+          return handle(handler, isolate);
         }
       }
     }
-  } else if (feedback->IsWeakCell()) {
-    WeakCell* cell = WeakCell::cast(feedback);
-    if (!cell->cleared()) {
-      Map* cell_map = Map::cast(cell->value());
-      if (cell_map == *map) {
-        Object* code = GetFeedbackExtra();
-        DCHECK(IC::IsHandler(code));
-        return handle(code, isolate);
-      }
+  } else if (feedback->ToWeakHeapObject(&heap_object)) {
+    Map* cell_map = Map::cast(heap_object);
+    if (cell_map == *map && !GetFeedbackExtra()->IsClearedWeakHeapObject()) {
+      MaybeObject* handler = GetFeedbackExtra();
+      DCHECK(IC::IsHandler(handler));
+      return handle(handler, isolate);
     }
   }
 
-  return MaybeHandle<Code>();
+  return MaybeObjectHandle();
 }
 
-bool FeedbackNexus::FindHandlers(ObjectHandles* code_list, int length) const {
+bool FeedbackNexus::FindHandlers(MaybeObjectHandles* code_list,
+                                 int length) const {
   DCHECK(IsLoadICKind(kind()) || IsStoreICKind(kind()) ||
          IsKeyedLoadICKind(kind()) || IsKeyedStoreICKind(kind()) ||
          IsStoreOwnICKind(kind()) || IsStoreDataPropertyInLiteralKind(kind()) ||
          IsStoreInArrayLiteralICKind(kind()));
 
-  Object* feedback = GetFeedback();
+  MaybeObject* feedback = GetFeedback();
   Isolate* isolate = GetIsolate();
   int count = 0;
   bool is_named_feedback = IsPropertyNameFeedback(feedback);
-  if (feedback->IsFixedArray() || is_named_feedback) {
+  HeapObject* heap_object;
+  if ((feedback->ToStrongHeapObject(&heap_object) &&
+       heap_object->IsWeakFixedArray()) ||
+      is_named_feedback) {
+    WeakFixedArray* array;
     if (is_named_feedback) {
-      feedback = GetFeedbackExtra();
+      array = WeakFixedArray::cast(GetFeedbackExtra()->ToStrongHeapObject());
+    } else {
+      array = WeakFixedArray::cast(heap_object);
     }
-    FixedArray* array = FixedArray::cast(feedback);
     const int increment = 2;
+    HeapObject* heap_object;
     for (int i = 0; i < array->length(); i += increment) {
-      DCHECK(array->get(i)->IsWeakCell());
-      WeakCell* cell = WeakCell::cast(array->get(i));
       // Be sure to skip handlers whose maps have been cleared.
-      if (!cell->cleared()) {
-        Object* code = array->get(i + increment - 1);
-        DCHECK(IC::IsHandler(code));
-        code_list->push_back(handle(code, isolate));
+      DCHECK(array->Get(i)->IsWeakOrClearedHeapObject());
+      if (array->Get(i)->ToWeakHeapObject(&heap_object) &&
+          !array->Get(i + increment - 1)->IsClearedWeakHeapObject()) {
+        MaybeObject* handler = array->Get(i + increment - 1);
+        DCHECK(IC::IsHandler(handler));
+        code_list->push_back(handle(handler, isolate));
         count++;
       }
     }
-  } else if (feedback->IsWeakCell()) {
-    WeakCell* cell = WeakCell::cast(feedback);
-    if (!cell->cleared()) {
-      Object* code = GetFeedbackExtra();
-      DCHECK(IC::IsHandler(code));
-      code_list->push_back(handle(code, isolate));
+  } else if (feedback->ToWeakHeapObject(&heap_object)) {
+    MaybeObject* extra = GetFeedbackExtra();
+    if (!extra->IsClearedWeakHeapObject()) {
+      DCHECK(IC::IsHandler(extra));
+      code_list->push_back(handle(extra, isolate));
       count++;
     }
   }
@@ -882,9 +919,9 @@ bool FeedbackNexus::FindHandlers(ObjectHandles* code_list, int length) const {
 
 Name* FeedbackNexus::FindFirstName() const {
   if (IsKeyedStoreICKind(kind()) || IsKeyedLoadICKind(kind())) {
-    Object* feedback = GetFeedback();
+    MaybeObject* feedback = GetFeedback();
     if (IsPropertyNameFeedback(feedback)) {
-      return Name::cast(feedback);
+      return Name::cast(feedback->ToStrongHeapObject());
     }
   }
   return nullptr;
@@ -893,13 +930,13 @@ Name* FeedbackNexus::FindFirstName() const {
 KeyedAccessLoadMode FeedbackNexus::GetKeyedAccessLoadMode() const {
   DCHECK(IsKeyedLoadICKind(kind()));
   MapHandles maps;
-  ObjectHandles handlers;
+  MaybeObjectHandles handlers;
 
   if (GetKeyType() == PROPERTY) return STANDARD_LOAD;
 
   ExtractMaps(&maps);
   FindHandlers(&handlers, static_cast<int>(maps.size()));
-  for (Handle<Object> const& handler : handlers) {
+  for (MaybeObjectHandle const& handler : handlers) {
     KeyedAccessLoadMode mode = LoadHandler::GetKeyedAccessLoadMode(*handler);
     if (mode != STANDARD_LOAD) return mode;
   }
@@ -911,26 +948,28 @@ KeyedAccessStoreMode FeedbackNexus::GetKeyedAccessStoreMode() const {
   DCHECK(IsKeyedStoreICKind(kind()) || IsStoreInArrayLiteralICKind(kind()));
   KeyedAccessStoreMode mode = STANDARD_STORE;
   MapHandles maps;
-  ObjectHandles handlers;
+  MaybeObjectHandles handlers;
 
   if (GetKeyType() == PROPERTY) return mode;
 
   ExtractMaps(&maps);
   FindHandlers(&handlers, static_cast<int>(maps.size()));
-  for (const Handle<Object>& maybe_code_handler : handlers) {
+  for (const MaybeObjectHandle& maybe_code_handler : handlers) {
     // The first handler that isn't the slow handler will have the bits we need.
     Handle<Code> handler;
-    if (maybe_code_handler->IsStoreHandler()) {
+    if (maybe_code_handler.object()->IsStoreHandler()) {
       Handle<StoreHandler> data_handler =
-          Handle<StoreHandler>::cast(maybe_code_handler);
-      handler = handle(Code::cast(data_handler->smi_handler()));
-    } else if (maybe_code_handler->IsSmi()) {
+          Handle<StoreHandler>::cast(maybe_code_handler.object());
+      handler = handle(Code::cast(data_handler->smi_handler()),
+                       vector()->GetIsolate());
+    } else if (maybe_code_handler.object()->IsSmi()) {
       // Skip proxy handlers.
-      DCHECK_EQ(*maybe_code_handler, *StoreHandler::StoreProxy(GetIsolate()));
+      DCHECK_EQ(*(maybe_code_handler.object()),
+                *StoreHandler::StoreProxy(GetIsolate()));
       continue;
     } else {
       // Element store without prototype chain check.
-      handler = Handle<Code>::cast(maybe_code_handler);
+      handler = Handle<Code>::cast(maybe_code_handler.object());
       if (handler->is_builtin()) continue;
     }
     CodeStub::Major major_key = CodeStub::MajorKeyFromKey(handler->stub_key());
@@ -953,42 +992,45 @@ KeyedAccessStoreMode FeedbackNexus::GetKeyedAccessStoreMode() const {
 IcCheckType FeedbackNexus::GetKeyType() const {
   DCHECK(IsKeyedStoreICKind(kind()) || IsKeyedLoadICKind(kind()) ||
          IsStoreInArrayLiteralICKind(kind()));
-  Object* feedback = GetFeedback();
-  if (feedback == *FeedbackVector::MegamorphicSentinel(GetIsolate())) {
-    return static_cast<IcCheckType>(Smi::ToInt(GetFeedbackExtra()));
+  MaybeObject* feedback = GetFeedback();
+  if (feedback == MaybeObject::FromObject(
+                      *FeedbackVector::MegamorphicSentinel(GetIsolate()))) {
+    return static_cast<IcCheckType>(Smi::ToInt(GetFeedbackExtra()->ToObject()));
   }
   return IsPropertyNameFeedback(feedback) ? PROPERTY : ELEMENT;
 }
 
 BinaryOperationHint FeedbackNexus::GetBinaryOperationFeedback() const {
   DCHECK_EQ(kind(), FeedbackSlotKind::kBinaryOp);
-  int feedback = Smi::ToInt(GetFeedback());
+  int feedback = Smi::ToInt(GetFeedback()->ToSmi());
   return BinaryOperationHintFromFeedback(feedback);
 }
 
 CompareOperationHint FeedbackNexus::GetCompareOperationFeedback() const {
   DCHECK_EQ(kind(), FeedbackSlotKind::kCompareOp);
-  int feedback = Smi::ToInt(GetFeedback());
+  int feedback = Smi::ToInt(GetFeedback()->ToSmi());
   return CompareOperationHintFromFeedback(feedback);
 }
 
 ForInHint FeedbackNexus::GetForInFeedback() const {
   DCHECK_EQ(kind(), FeedbackSlotKind::kForIn);
-  int feedback = Smi::ToInt(GetFeedback());
+  int feedback = Smi::ToInt(GetFeedback()->ToSmi());
   return ForInHintFromFeedback(feedback);
 }
 
 Handle<FeedbackCell> FeedbackNexus::GetFeedbackCell() const {
   DCHECK_EQ(FeedbackSlotKind::kCreateClosure, kind());
-  return handle(FeedbackCell::cast(GetFeedback()));
+  return handle(FeedbackCell::cast(GetFeedback()->ToObject()),
+                vector()->GetIsolate());
 }
 
 MaybeHandle<JSObject> FeedbackNexus::GetConstructorFeedback() const {
   DCHECK_EQ(kind(), FeedbackSlotKind::kInstanceOf);
   Isolate* isolate = GetIsolate();
-  Object* feedback = GetFeedback();
-  if (feedback->IsWeakCell() && !WeakCell::cast(feedback)->cleared()) {
-    return handle(JSObject::cast(WeakCell::cast(feedback)->value()), isolate);
+  MaybeObject* feedback = GetFeedback();
+  HeapObject* heap_object;
+  if (feedback->ToWeakHeapObject(&heap_object)) {
+    return handle(JSObject::cast(heap_object), isolate);
   }
   return MaybeHandle<JSObject>();
 }
@@ -1011,15 +1053,17 @@ void FeedbackNexus::Collect(Handle<String> type, int position) {
   DCHECK_GE(position, 0);
   Isolate* isolate = GetIsolate();
 
-  Object* const feedback = GetFeedback();
+  MaybeObject* const feedback = GetFeedback();
 
   // Map source position to collection of types
   Handle<SimpleNumberDictionary> types;
 
-  if (feedback == *FeedbackVector::UninitializedSentinel(isolate)) {
+  if (feedback == MaybeObject::FromObject(
+                      *FeedbackVector::UninitializedSentinel(isolate))) {
     types = SimpleNumberDictionary::New(isolate, 1);
   } else {
-    types = handle(SimpleNumberDictionary::cast(feedback));
+    types = handle(SimpleNumberDictionary::cast(feedback->ToStrongHeapObject()),
+                   isolate);
   }
 
   Handle<ArrayList> position_specific_types;
@@ -1031,7 +1075,8 @@ void FeedbackNexus::Collect(Handle<String> type, int position) {
         types, position, ArrayList::Add(position_specific_types, type));
   } else {
     DCHECK(types->ValueAt(entry)->IsArrayList());
-    position_specific_types = handle(ArrayList::cast(types->ValueAt(entry)));
+    position_specific_types =
+        handle(ArrayList::cast(types->ValueAt(entry)), isolate);
     if (!InList(position_specific_types, type)) {  // Add type
       types = SimpleNumberDictionary::Set(
           types, position, ArrayList::Add(position_specific_types, type));
@@ -1045,14 +1090,15 @@ std::vector<int> FeedbackNexus::GetSourcePositions() const {
   std::vector<int> source_positions;
   Isolate* isolate = GetIsolate();
 
-  Object* const feedback = GetFeedback();
+  MaybeObject* const feedback = GetFeedback();
 
-  if (feedback == *FeedbackVector::UninitializedSentinel(isolate)) {
+  if (feedback == MaybeObject::FromObject(
+                      *FeedbackVector::UninitializedSentinel(isolate))) {
     return source_positions;
   }
 
-  Handle<SimpleNumberDictionary> types = Handle<SimpleNumberDictionary>(
-      SimpleNumberDictionary::cast(feedback), isolate);
+  Handle<SimpleNumberDictionary> types(
+      SimpleNumberDictionary::cast(feedback->ToStrongHeapObject()), isolate);
 
   for (int index = SimpleNumberDictionary::kElementsStartIndex;
        index < types->length(); index += SimpleNumberDictionary::kEntrySize) {
@@ -1071,14 +1117,15 @@ std::vector<Handle<String>> FeedbackNexus::GetTypesForSourcePositions(
   DCHECK(IsTypeProfileKind(kind()));
   Isolate* isolate = GetIsolate();
 
-  Object* const feedback = GetFeedback();
+  MaybeObject* const feedback = GetFeedback();
   std::vector<Handle<String>> types_for_position;
-  if (feedback == *FeedbackVector::UninitializedSentinel(isolate)) {
+  if (feedback == MaybeObject::FromObject(
+                      *FeedbackVector::UninitializedSentinel(isolate))) {
     return types_for_position;
   }
 
-  Handle<SimpleNumberDictionary> types = Handle<SimpleNumberDictionary>(
-      SimpleNumberDictionary::cast(feedback), isolate);
+  Handle<SimpleNumberDictionary> types(
+      SimpleNumberDictionary::cast(feedback->ToStrongHeapObject()), isolate);
 
   int entry = types->FindEntry(position);
   if (entry == SimpleNumberDictionary::kNotFound) {
@@ -1086,7 +1133,7 @@ std::vector<Handle<String>> FeedbackNexus::GetTypesForSourcePositions(
   }
   DCHECK(types->ValueAt(entry)->IsArrayList());
   Handle<ArrayList> position_specific_types =
-      Handle<ArrayList>(ArrayList::cast(types->ValueAt(entry)));
+      Handle<ArrayList>(ArrayList::cast(types->ValueAt(entry)), isolate);
   for (int i = 0; i < position_specific_types->Length(); i++) {
     Object* t = position_specific_types->Get(i);
     types_for_position.push_back(Handle<String>(String::cast(t), isolate));
@@ -1111,15 +1158,14 @@ Handle<JSObject> ConvertToJSObject(Isolate* isolate,
       int value_index = index + SimpleNumberDictionary::kEntryValueIndex;
 
       Handle<ArrayList> position_specific_types(
-          ArrayList::cast(feedback->get(value_index)));
+          ArrayList::cast(feedback->get(value_index)), isolate);
 
       int position = Smi::ToInt(key);
       JSObject::AddDataElement(
           type_profile, position,
           isolate->factory()->NewJSArrayWithElements(
               ArrayList::Elements(position_specific_types)),
-          PropertyAttributes::NONE)
-          .ToHandleChecked();
+          PropertyAttributes::NONE);
     }
   }
   return type_profile;
@@ -1130,14 +1176,17 @@ JSObject* FeedbackNexus::GetTypeProfile() const {
   DCHECK(IsTypeProfileKind(kind()));
   Isolate* isolate = GetIsolate();
 
-  Object* const feedback = GetFeedback();
+  MaybeObject* const feedback = GetFeedback();
 
-  if (feedback == *FeedbackVector::UninitializedSentinel(isolate)) {
+  if (feedback == MaybeObject::FromObject(
+                      *FeedbackVector::UninitializedSentinel(isolate))) {
     return *isolate->factory()->NewJSObject(isolate->object_function());
   }
 
-  return *ConvertToJSObject(isolate,
-                            handle(SimpleNumberDictionary::cast(feedback)));
+  return *ConvertToJSObject(
+      isolate,
+      handle(SimpleNumberDictionary::cast(feedback->ToStrongHeapObject()),
+             isolate));
 }
 
 void FeedbackNexus::ResetTypeProfile() {
diff --git a/deps/v8/src/feedback-vector.h b/deps/v8/src/feedback-vector.h
index 02acb797511d2e..880e4713d469d6 100644
--- a/deps/v8/src/feedback-vector.h
+++ b/deps/v8/src/feedback-vector.h
@@ -129,7 +129,7 @@ inline LanguageMode GetLanguageModeFromSlotKind(FeedbackSlotKind kind) {
 
 std::ostream& operator<<(std::ostream& os, FeedbackSlotKind kind);
 
-typedef std::vector<Handle<Object>> ObjectHandles;
+typedef std::vector<MaybeObjectHandle> MaybeObjectHandles;
 
 class FeedbackMetadata;
 
@@ -140,8 +140,13 @@ class FeedbackMetadata;
 //  - optimized code cell (weak cell or Smi marker)
 // followed by an array of feedback slots, of length determined by the feedback
 // metadata.
-class FeedbackVector : public HeapObject {
+class FeedbackVector : public HeapObject, public NeverReadOnlySpaceObject {
  public:
+  // Use the mixin methods over the HeapObject methods.
+  // TODO(v8:7786) Remove once the HeapObject methods are gone.
+  using NeverReadOnlySpaceObject::GetHeap;
+  using NeverReadOnlySpaceObject::GetIsolate;
+
   // Casting.
   static inline FeedbackVector* cast(Object* obj);
 
@@ -196,15 +201,19 @@ class FeedbackVector : public HeapObject {
 
   // Conversion from an integer index to the underlying array to a slot.
   static inline FeedbackSlot ToSlot(int index);
-  inline Object* Get(FeedbackSlot slot) const;
-  inline Object* get(int index) const;
+  inline MaybeObject* Get(FeedbackSlot slot) const;
+  inline MaybeObject* get(int index) const;
+  inline void Set(FeedbackSlot slot, MaybeObject* value,
+                  WriteBarrierMode mode = UPDATE_WRITE_BARRIER);
+  inline void set(int index, MaybeObject* value,
+                  WriteBarrierMode mode = UPDATE_WRITE_BARRIER);
   inline void Set(FeedbackSlot slot, Object* value,
                   WriteBarrierMode mode = UPDATE_WRITE_BARRIER);
   inline void set(int index, Object* value,
                   WriteBarrierMode mode = UPDATE_WRITE_BARRIER);
 
   // Gives access to raw memory which stores the array's data.
-  inline Object** slots_start();
+  inline MaybeObject** slots_start();
 
   // Returns slot kind for given slot.
   FeedbackSlotKind GetKind(FeedbackSlot slot) const;
@@ -214,9 +223,6 @@ class FeedbackVector : public HeapObject {
   V8_EXPORT_PRIVATE static Handle<FeedbackVector> New(
       Isolate* isolate, Handle<SharedFunctionInfo> shared);
 
-  static Handle<FeedbackVector> Copy(Isolate* isolate,
-                                     Handle<FeedbackVector> vector);
-
 #define DEFINE_SLOT_KIND_PREDICATE(Name) \
   bool Name(FeedbackSlot slot) const { return Name##Kind(GetKind(slot)); }
 
@@ -242,10 +248,7 @@ class FeedbackVector : public HeapObject {
     return GetLanguageModeFromSlotKind(GetKind(slot));
   }
 
-#ifdef OBJECT_PRINT
-  // For gdb debugging.
-  void Print();
-#endif  // OBJECT_PRINT
+  static void AssertNoLegacyTypes(MaybeObject* object);
 
   DECL_PRINTER(FeedbackVector)
   DECL_VERIFIER(FeedbackVector)
@@ -442,11 +445,6 @@ class FeedbackMetadata : public HeapObject {
   V8_EXPORT_PRIVATE static Handle<FeedbackMetadata> New(
       Isolate* isolate, const FeedbackVectorSpec* spec = nullptr);
 
-#ifdef OBJECT_PRINT
-  // For gdb debugging.
-  void Print();
-#endif  // OBJECT_PRINT
-
   DECL_PRINTER(FeedbackMetadata)
   DECL_VERIFIER(FeedbackMetadata)
 
@@ -592,8 +590,8 @@ class FeedbackNexus final {
 
   InlineCacheState StateFromFeedback() const;
   int ExtractMaps(MapHandles* maps) const;
-  MaybeHandle<Object> FindHandlerForMap(Handle<Map> map) const;
-  bool FindHandlers(ObjectHandles* code_list, int length = -1) const;
+  MaybeObjectHandle FindHandlerForMap(Handle<Map> map) const;
+  bool FindHandlers(MaybeObjectHandles* code_list, int length = -1) const;
 
   bool IsCleared() const {
     InlineCacheState state = StateFromFeedback();
@@ -606,16 +604,16 @@ class FeedbackNexus final {
   void ConfigurePremonomorphic();
   bool ConfigureMegamorphic(IcCheckType property_type);
 
-  inline Object* GetFeedback() const;
-  inline Object* GetFeedbackExtra() const;
+  inline MaybeObject* GetFeedback() const;
+  inline MaybeObject* GetFeedbackExtra() const;
 
   inline Isolate* GetIsolate() const;
 
   void ConfigureMonomorphic(Handle<Name> name, Handle<Map> receiver_map,
-                            Handle<Object> handler);
+                            const MaybeObjectHandle& handler);
 
   void ConfigurePolymorphic(Handle<Name> name, MapHandles const& maps,
-                            ObjectHandles* handlers);
+                            MaybeObjectHandles* handlers);
 
   BinaryOperationHint GetBinaryOperationFeedback() const;
   CompareOperationHint GetCompareOperationFeedback() const;
@@ -654,7 +652,7 @@ class FeedbackNexus final {
   // Returns false if given combination of indices is not allowed.
   bool ConfigureLexicalVarMode(int script_context_index,
                                int context_slot_index);
-  void ConfigureHandlerMode(Handle<Object> handler);
+  void ConfigureHandlerMode(const MaybeObjectHandle& handler);
 
 // Bit positions in a smi that encodes lexical environment variable access.
 #define LEXICAL_MODE_BIT_FIELDS(V, _)  \
@@ -681,11 +679,15 @@ class FeedbackNexus final {
  protected:
   inline void SetFeedback(Object* feedback,
                           WriteBarrierMode mode = UPDATE_WRITE_BARRIER);
+  inline void SetFeedback(MaybeObject* feedback,
+                          WriteBarrierMode mode = UPDATE_WRITE_BARRIER);
   inline void SetFeedbackExtra(Object* feedback_extra,
                                WriteBarrierMode mode = UPDATE_WRITE_BARRIER);
+  inline void SetFeedbackExtra(MaybeObject* feedback_extra,
+                               WriteBarrierMode mode = UPDATE_WRITE_BARRIER);
 
-  Handle<FixedArray> EnsureArrayOfSize(int length);
-  Handle<FixedArray> EnsureExtraArrayOfSize(int length);
+  Handle<WeakFixedArray> EnsureArrayOfSize(int length);
+  Handle<WeakFixedArray> EnsureExtraArrayOfSize(int length);
 
  private:
   // The reason for having a vector handle and a raw pointer is that we can and
diff --git a/deps/v8/src/flag-definitions.h b/deps/v8/src/flag-definitions.h
index 311620ebc5f3ea..3a7d52772988d8 100644
--- a/deps/v8/src/flag-definitions.h
+++ b/deps/v8/src/flag-definitions.h
@@ -208,46 +208,39 @@ DEFINE_IMPLICATION(harmony_class_fields, harmony_private_fields)
 // Update bootstrapper.cc whenever adding a new feature flag.
 
 // Features that are still work in progress (behind individual flags).
-#define HARMONY_INPROGRESS(V)                                         \
-  V(harmony_array_prototype_values, "harmony Array.prototype.values") \
+#define HARMONY_INPROGRESS_BASE(V)                                    \
   V(harmony_do_expressions, "harmony do-expressions")                 \
   V(harmony_class_fields, "harmony fields in class literals")         \
   V(harmony_static_fields, "harmony static fields in class literals") \
-  V(harmony_array_flatten, "harmony Array.prototype.flat{ten,Map}")   \
-  V(harmony_string_matchall, "harmony String.prototype.matchAll")
+  V(harmony_await_optimization, "harmony await taking 1 tick")
+
+#ifdef V8_INTL_SUPPORT
+#define HARMONY_INPROGRESS(V)      \
+  HARMONY_INPROGRESS_BASE(V)       \
+  V(harmony_locale, "Intl.Locale") \
+  V(harmony_intl_relative_time_format, "Intl.RelativeTimeFormat")
+#else
+#define HARMONY_INPROGRESS(V) HARMONY_INPROGRESS_BASE(V)
+#endif
 
 // Features that are complete (but still behind --harmony/es-staging flag).
-#define HARMONY_STAGED(V)                                               \
-  V(harmony_restrict_constructor_return,                                \
-    "harmony disallow non undefined primitive return value from class " \
-    "constructor")                                                      \
-  V(harmony_public_fields, "harmony public fields in class literals")   \
-  V(harmony_private_fields, "harmony private fields in class literals") \
-  V(harmony_numeric_separator, "harmony numeric separator between digits")
+#define HARMONY_STAGED(V)                                                  \
+  V(harmony_public_fields, "harmony public fields in class literals")      \
+  V(harmony_private_fields, "harmony private fields in class literals")    \
+  V(harmony_numeric_separator, "harmony numeric separator between digits") \
+  V(harmony_string_matchall, "harmony String.prototype.matchAll")          \
+  V(harmony_symbol_description, "harmony Symbol.prototype.description")
 
 // Features that are shipping (turned on by default, but internal flag remains).
-#define HARMONY_SHIPPING_BASE(V)                                              \
-  V(harmony_subsume_json, "harmony subsume JSON")                             \
+#define HARMONY_SHIPPING(V)                                                   \
   V(harmony_string_trimming, "harmony String.prototype.trim{Start,End}")      \
   V(harmony_sharedarraybuffer, "harmony sharedarraybuffer")                   \
-  V(harmony_regexp_named_captures, "harmony regexp named captures")           \
-  V(harmony_regexp_property, "harmony Unicode regexp property classes")       \
   V(harmony_function_tostring, "harmony Function.prototype.toString")         \
-  V(harmony_promise_finally, "harmony Promise.prototype.finally")             \
-  V(harmony_optional_catch_binding, "allow omitting binding in catch blocks") \
   V(harmony_import_meta, "harmony import.meta property")                      \
   V(harmony_bigint, "harmony arbitrary precision integers")                   \
-  V(harmony_dynamic_import, "harmony dynamic import")
-
-#ifdef V8_INTL_SUPPORT
-#define HARMONY_SHIPPING(V)                      \
-  HARMONY_SHIPPING_BASE(V)                       \
-  V(harmony_number_format_to_parts,              \
-    "Intl.NumberFormat.prototype.formatToParts") \
-  V(harmony_plural_rules, "Intl.PluralRules")
-#else
-#define HARMONY_SHIPPING(V) HARMONY_SHIPPING_BASE(V)
-#endif
+  V(harmony_dynamic_import, "harmony dynamic import")                         \
+  V(harmony_array_prototype_values, "harmony Array.prototype.values")         \
+  V(harmony_array_flat, "harmony Array.prototype.{flat,flatMap}")
 
 // Once a shipping feature has proved stable in the wild, it will be dropped
 // from HARMONY_SHIPPING, all occurrences of the FLAG_ variable are removed,
@@ -344,6 +337,9 @@ DEFINE_BOOL(ignition_elide_noneffectful_bytecodes, true,
 DEFINE_BOOL(ignition_reo, true, "use ignition register equivalence optimizer")
 DEFINE_BOOL(ignition_filter_expression_positions, true,
             "filter expression positions before the bytecode pipeline")
+DEFINE_BOOL(ignition_share_named_property_feedback, true,
+            "share feedback slots when loading the same named property from "
+            "the same object")
 DEFINE_BOOL(print_bytecode, false,
             "print bytecode generated by ignition interpreter")
 DEFINE_STRING(print_bytecode_filter, "*",
@@ -397,6 +393,10 @@ DEFINE_BOOL(turbo_preprocess_ranges, true,
             "run pre-register allocation heuristics")
 DEFINE_STRING(turbo_filter, "*", "optimization filter for TurboFan compiler")
 DEFINE_BOOL(trace_turbo, false, "trace generated TurboFan IR")
+DEFINE_STRING(trace_turbo_path, nullptr,
+              "directory to dump generated TurboFan IR to")
+DEFINE_STRING(trace_turbo_filter, "*",
+              "filter for tracing turbofan compilation")
 DEFINE_BOOL(trace_turbo_graph, false, "trace generated TurboFan graphs")
 DEFINE_BOOL(trace_turbo_scheduled, false, "trace TurboFan IR with schedule")
 DEFINE_IMPLICATION(trace_turbo_scheduled, trace_turbo_graph)
@@ -431,6 +431,8 @@ DEFINE_STRING(csa_trap_on_node, nullptr,
 DEFINE_BOOL(turbo_stats, false, "print TurboFan statistics")
 DEFINE_BOOL(turbo_stats_nvp, false,
             "print TurboFan statistics in machine-readable format")
+DEFINE_BOOL(turbo_stats_wasm, false,
+            "print TurboFan statistics of wasm compilations")
 DEFINE_BOOL(turbo_splitting, true, "split nodes during scheduling in TurboFan")
 DEFINE_BOOL(function_context_specialization, false,
             "enable function context specialization in TurboFan")
@@ -489,7 +491,7 @@ DEFINE_BOOL(turbo_store_elimination, true,
 DEFINE_BOOL(trace_store_elimination, false, "trace store elimination")
 DEFINE_BOOL(turbo_rewrite_far_jumps, true,
             "rewrite far to near jumps (ia32,x64)")
-DEFINE_BOOL(experimental_inline_promise_constructor, false,
+DEFINE_BOOL(experimental_inline_promise_constructor, true,
             "inline the Promise constructor in TurboFan")
 
 #ifdef DISABLE_UNTRUSTED_CODE_MITIGATIONS
@@ -501,10 +503,6 @@ DEFINE_BOOL(untrusted_code_mitigations, V8_DEFAULT_UNTRUSTED_CODE_MITIGATIONS,
             "Enable mitigations for executing untrusted code")
 #undef V8_DEFAULT_UNTRUSTED_CODE_MITIGATIONS
 
-DEFINE_BOOL(turbo_disable_switch_jump_table, false,
-            "do not emit jump-tables in Turbofan")
-DEFINE_IMPLICATION(untrusted_code_mitigations, turbo_disable_switch_jump_table)
-
 DEFINE_BOOL(branch_load_poisoning, false, "Mask loads with branch conditions.")
 DEFINE_IMPLICATION(future, branch_load_poisoning)
 
@@ -531,20 +529,24 @@ DEFINE_BOOL(wasm_trace_serialization, false,
             "trace serialization/deserialization")
 DEFINE_BOOL(wasm_async_compilation, true,
             "enable actual asynchronous compilation for WebAssembly.compile")
-DEFINE_BOOL(wasm_stream_compilation, true,
-            "enable streaming compilation for WebAssembly")
-DEFINE_IMPLICATION(wasm_stream_compilation, wasm_async_compilation)
 DEFINE_BOOL(wasm_test_streaming, false,
             "use streaming compilation instead of async compilation for tests")
-DEFINE_IMPLICATION(wasm_test_streaming, wasm_stream_compilation)
-// Parallel compilation confuses turbo_stats, force single threaded.
-DEFINE_VALUE_IMPLICATION(turbo_stats, wasm_num_compilation_tasks, 0)
 DEFINE_UINT(wasm_max_mem_pages, v8::internal::wasm::kV8MaxWasmMemoryPages,
             "maximum memory size of a wasm instance")
 DEFINE_UINT(wasm_max_table_size, v8::internal::wasm::kV8MaxWasmTableSize,
             "maximum table size of a wasm instance")
-DEFINE_BOOL(wasm_tier_up, false,
-            "enable basic tiering up to the optimizing compiler")
+// Enable Liftoff by default on ia32 and x64. More architectures will follow
+// once they are implemented and sufficiently tested.
+#if V8_TARGET_ARCH_IA32 || V8_TARGET_ARCH_X64
+DEFINE_BOOL(
+    wasm_tier_up, true,
+    "enable wasm baseline compilation and tier up to the optimizing compiler")
+#else
+DEFINE_BOOL(
+    wasm_tier_up, false,
+    "enable wasm baseline compilation and tier up to the optimizing compiler")
+DEFINE_IMPLICATION(future, wasm_tier_up)
+#endif
 DEFINE_IMPLICATION(wasm_tier_up, liftoff)
 DEFINE_DEBUG_BOOL(trace_wasm_decoder, false, "trace decoding of wasm code")
 DEFINE_DEBUG_BOOL(trace_wasm_decode_time, false,
@@ -558,10 +560,9 @@ DEFINE_INT(trace_wasm_ast_start, 0,
            "start function for wasm AST trace (inclusive)")
 DEFINE_INT(trace_wasm_ast_end, 0, "end function for wasm AST trace (exclusive)")
 DEFINE_BOOL(liftoff, false,
-            "enable liftoff, the experimental wasm baseline compiler")
+            "enable Liftoff, the baseline compiler for WebAssembly")
 DEFINE_DEBUG_BOOL(trace_liftoff, false,
-                  "trace liftoff, the wasm baseline compiler")
-DEFINE_UINT(skip_compiling_wasm_funcs, 0, "start compiling at function N")
+                  "trace Liftoff, the baseline compiler for WebAssembly")
 DEFINE_DEBUG_BOOL(wasm_break_on_decoder_error, false,
                   "debug break when wasm decoder encounters an error")
 DEFINE_BOOL(wasm_trace_memory, false,
@@ -590,11 +591,11 @@ DEFINE_BOOL(experimental_wasm_threads, false,
             "enable prototype threads for wasm")
 DEFINE_BOOL(experimental_wasm_sat_f2i_conversions, false,
             "enable non-trapping float-to-int conversions for wasm")
-DEFINE_BOOL(experimental_wasm_se, false,
+DEFINE_BOOL(experimental_wasm_se, true,
             "enable prototype sign extension opcodes for wasm")
 DEFINE_BOOL(experimental_wasm_anyref, false,
             "enable prototype anyref support for wasm")
-DEFINE_BOOL(experimental_wasm_mut_global, false,
+DEFINE_BOOL(experimental_wasm_mut_global, true,
             "enable prototype import/export mutable global support for wasm")
 
 DEFINE_BOOL(wasm_opt, false, "enable wasm optimization")
@@ -603,9 +604,11 @@ DEFINE_BOOL(wasm_no_bounds_checks, false,
 DEFINE_BOOL(wasm_no_stack_checks, false,
             "disable stack checks (performance testing only)")
 
-DEFINE_BOOL(wasm_trap_handler, false,
+DEFINE_BOOL(wasm_trap_handler, true,
             "use signal handlers to catch out of bounds memory access in wasm"
-            " (experimental, currently Linux x86_64 only)")
+            " (currently Linux x86_64 only)")
+DEFINE_BOOL(wasm_trap_handler_fallback, false,
+            "Use bounds checks if guarded memory is not available")
 DEFINE_BOOL(wasm_fuzzer_gen_test, false,
             "Generate a test case when running a wasm fuzzer")
 DEFINE_IMPLICATION(wasm_fuzzer_gen_test, single_threaded)
@@ -697,6 +700,9 @@ DEFINE_BOOL(concurrent_marking, V8_CONCURRENT_MARKING_BOOL,
             "use concurrent marking")
 DEFINE_BOOL(parallel_marking, true, "use parallel marking in atomic pause")
 DEFINE_IMPLICATION(parallel_marking, concurrent_marking)
+DEFINE_INT(ephemeron_fixpoint_iterations, 0,
+           "number of fixpoint iterations it takes to switch to linear "
+           "ephemeron algorithm")
 DEFINE_BOOL(trace_concurrent_marking, false, "trace concurrent marking")
 DEFINE_BOOL(black_allocation, true, "use black allocation")
 DEFINE_BOOL(concurrent_store_buffer, true,
@@ -782,6 +788,12 @@ DEFINE_BOOL(manual_evacuation_candidates_selection, false,
 DEFINE_BOOL(fast_promotion_new_space, false,
             "fast promote new space on high survival rates")
 
+DEFINE_BOOL(clear_free_memory, false, "initialize free memory with 0")
+
+DEFINE_BOOL(young_generation_large_objects, false,
+            "allocates large objects by default in the young generation large "
+            "object space")
+
 // assembler-ia32.cc / assembler-arm.cc / assembler-x64.cc
 DEFINE_BOOL(debug_code, DEBUG_BOOL,
             "generate extra code (assertions) for debugging")
@@ -845,6 +857,7 @@ DEFINE_BOOL(enable_experimental_builtins, false,
             "enable new csa-based experimental builtins")
 DEFINE_BOOL(disallow_code_generation_from_strings, false,
             "disallow eval and friends")
+DEFINE_BOOL(expose_async_hooks, false, "expose async_hooks object")
 
 // builtins.cc
 DEFINE_BOOL(allow_unsafe_function_constructor, false,
@@ -908,7 +921,6 @@ DEFINE_IMPLICATION(trace_array_abuse, trace_js_array_abuse)
 DEFINE_IMPLICATION(trace_array_abuse, trace_external_array_abuse)
 
 // debugger
-DEFINE_BOOL(enable_liveedit, true, "enable liveedit experimental feature")
 DEFINE_BOOL(
     trace_side_effect_free_debug_evaluate, false,
     "print debug messages for side-effect-free debug-evaluate for testing")
@@ -1045,6 +1057,13 @@ DEFINE_INT(runtime_stats, 0,
 DEFINE_VALUE_IMPLICATION(runtime_call_stats, runtime_stats, 1)
 
 // snapshot-common.cc
+#ifdef V8_EMBEDDED_BUILTINS
+#define V8_EMBEDDED_BUILTINS_BOOL true
+#else
+#define V8_EMBEDDED_BUILTINS_BOOL false
+#endif
+DEFINE_BOOL_READONLY(embedded_builtins, V8_EMBEDDED_BUILTINS_BOOL,
+                     "Embed builtin code into the binary.")
 DEFINE_BOOL(lazy_deserialization, true,
             "Deserialize code lazily from the snapshot.")
 DEFINE_BOOL(lazy_handler_deserialization, true,
@@ -1056,6 +1075,8 @@ DEFINE_BOOL(profile_deserialization, false,
             "Print the time it takes to deserialize the snapshot.")
 DEFINE_BOOL(serialization_statistics, false,
             "Collect statistics on serialized objects.")
+DEFINE_UINT(serialization_chunk_size, 4096,
+            "Custom size for serialization chunks")
 
 // Regexp
 DEFINE_BOOL(regexp_optimization, true, "generate optimized regexp code")
@@ -1139,7 +1160,7 @@ DEFINE_NEG_IMPLICATION(gdbjit, compact_code_space)
 
 // checks.cc
 #ifdef ENABLE_SLOW_DCHECKS
-DEFINE_BOOL(enable_slow_asserts, false,
+DEFINE_BOOL(enable_slow_asserts, true,
             "enable asserts that are slow to execute")
 #endif
 
@@ -1306,6 +1327,8 @@ DEFINE_BOOL(print_opt_code, false, "print optimized code")
 DEFINE_STRING(print_opt_code_filter, "*", "filter for printing optimized code")
 DEFINE_BOOL(print_code_verbose, false, "print more information for code")
 DEFINE_BOOL(print_builtin_code, false, "print generated code for builtins")
+DEFINE_STRING(print_builtin_code_filter, "*",
+              "filter for printing builtin code")
 DEFINE_BOOL(print_builtin_size, false, "print code size for builtins")
 
 #ifdef ENABLE_DISASSEMBLER
diff --git a/deps/v8/src/flags.cc b/deps/v8/src/flags.cc
index 2a05ad3da8d70c..50ffb3330e5fa0 100644
--- a/deps/v8/src/flags.cc
+++ b/deps/v8/src/flags.cc
@@ -312,18 +312,15 @@ inline char NormalizeChar(char ch) {
 }
 
 // Helper function to parse flags: Takes an argument arg and splits it into
-// a flag name and flag value (or nullptr if they are missing). is_bool is set
+// a flag name and flag value (or nullptr if they are missing). negated is set
 // if the arg started with "-no" or "--no". The buffer may be used to NUL-
 // terminate the name, it must be large enough to hold any possible name.
-static void SplitArgument(const char* arg,
-                          char* buffer,
-                          int buffer_size,
-                          const char** name,
-                          const char** value,
-                          bool* is_bool) {
+static void SplitArgument(const char* arg, char* buffer, int buffer_size,
+                          const char** name, const char** value,
+                          bool* negated) {
   *name = nullptr;
   *value = nullptr;
-  *is_bool = false;
+  *negated = false;
 
   if (arg != nullptr && *arg == '-') {
     // find the begin of the flag name
@@ -339,7 +336,7 @@ static void SplitArgument(const char* arg,
     if (arg[0] == 'n' && arg[1] == 'o') {
       arg += 2;  // remove "no"
       if (NormalizeChar(arg[0]) == '-') arg++;  // remove dash after "no".
-      *is_bool = true;
+      *negated = true;
     }
     *name = arg;
 
@@ -392,9 +389,7 @@ bool TryParseUnsigned(Flag* flag, const char* arg, const char* value,
   if (val < 0 || static_cast<uint64_t>(val) > max || errno != 0) {
     PrintF(stderr,
            "Error: Value for flag %s of type %s is out of bounds "
-           "[0-%" PRIu64
-           "]\n"
-           "Try --help for options\n",
+           "[0-%" PRIu64 "]\n",
            arg, Type2String(flag->type()), max);
     return false;
   }
@@ -416,8 +411,8 @@ int FlagList::SetFlagsFromCommandLine(int* argc,
     char buffer[1*KB];
     const char* name;
     const char* value;
-    bool is_bool;
-    SplitArgument(arg, buffer, sizeof buffer, &name, &value, &is_bool);
+    bool negated;
+    SplitArgument(arg, buffer, sizeof buffer, &name, &value, &negated);
 
     if (name != nullptr) {
       // lookup the flag
@@ -430,8 +425,7 @@ int FlagList::SetFlagsFromCommandLine(int* argc,
           // sense there.
           continue;
         } else {
-          PrintF(stderr, "Error: unrecognized flag %s\n"
-                 "Try --help for options\n", arg);
+          PrintF(stderr, "Error: unrecognized flag %s\n", arg);
           return_code = j;
           break;
         }
@@ -445,9 +439,8 @@ int FlagList::SetFlagsFromCommandLine(int* argc,
           value = argv[i++];
         }
         if (!value) {
-          PrintF(stderr, "Error: missing value for flag %s of type %s\n"
-                 "Try --help for options\n",
-                 arg, Type2String(flag->type()));
+          PrintF(stderr, "Error: missing value for flag %s of type %s\n", arg,
+                 Type2String(flag->type()));
           return_code = j;
           break;
         }
@@ -457,10 +450,10 @@ int FlagList::SetFlagsFromCommandLine(int* argc,
       char* endp = const_cast<char*>("");  // *endp is only read
       switch (flag->type()) {
         case Flag::TYPE_BOOL:
-          *flag->bool_variable() = !is_bool;
+          *flag->bool_variable() = !negated;
           break;
         case Flag::TYPE_MAYBE_BOOL:
-          *flag->maybe_bool_variable() = MaybeBoolFlag::Create(true, !is_bool);
+          *flag->maybe_bool_variable() = MaybeBoolFlag::Create(true, !negated);
           break;
         case Flag::TYPE_INT:
           *flag->int_variable() = static_cast<int>(strtol(value, &endp, 10));
@@ -502,11 +495,12 @@ int FlagList::SetFlagsFromCommandLine(int* argc,
       // handle errors
       bool is_bool_type = flag->type() == Flag::TYPE_BOOL ||
           flag->type() == Flag::TYPE_MAYBE_BOOL;
-      if ((is_bool_type && value != nullptr) || (!is_bool_type && is_bool) ||
+      if ((is_bool_type && value != nullptr) || (!is_bool_type && negated) ||
           *endp != '\0') {
-        PrintF(stderr, "Error: illegal value for flag %s of type %s\n"
-               "Try --help for options\n",
-               arg, Type2String(flag->type()));
+        // TODO(neis): TryParseUnsigned may return with {*endp == '\0'} even in
+        // an error case.
+        PrintF(stderr, "Error: illegal value for flag %s of type %s\n", arg,
+               Type2String(flag->type()));
         if (is_bool_type) {
           PrintF(stderr,
                  "To set or unset a boolean flag, use --flag or --no-flag.\n");
@@ -524,20 +518,29 @@ int FlagList::SetFlagsFromCommandLine(int* argc,
     }
   }
 
-  // shrink the argument list
+  if (FLAG_help) {
+    PrintHelp();
+    exit(0);
+  }
+
   if (remove_flags) {
+    // shrink the argument list
     int j = 1;
     for (int i = 1; i < *argc; i++) {
       if (argv[i] != nullptr) argv[j++] = argv[i];
     }
     *argc = j;
+  } else if (return_code != 0) {
+    if (return_code + 1 < *argc) {
+      PrintF(stderr, "The remaining arguments were ignored:");
+      for (int i = return_code + 1; i < *argc; ++i) {
+        PrintF(stderr, " %s", argv[i]);
+      }
+      PrintF(stderr, "\n");
+    }
   }
+  if (return_code != 0) PrintF(stderr, "Try --help for options\n");
 
-  if (FLAG_help) {
-    PrintHelp();
-    exit(0);
-  }
-  // parsed all flags successfully
   return return_code;
 }
 
@@ -583,10 +586,7 @@ int FlagList::SetFlagsFromString(const char* str, int len) {
     p = SkipWhiteSpace(p);
   }
 
-  // set the flags
-  int result = SetFlagsFromCommandLine(&argc, argv.start(), false);
-
-  return result;
+  return SetFlagsFromCommandLine(&argc, argv.start(), false);
 }
 
 
@@ -604,19 +604,13 @@ void FlagList::PrintHelp() {
   CpuFeatures::PrintTarget();
   CpuFeatures::PrintFeatures();
 
-  OFStream os(stdout);
-  os << "Usage:\n"
-        "  shell [options] -e string\n"
-        "    execute string in V8\n"
-        "  shell [options] file1 file2 ... filek\n"
-        "    run JavaScript scripts in file1, file2, ..., filek\n"
-        "  shell [options]\n"
-        "  shell [options] --shell [file1 file2 ... filek]\n"
-        "    run an interactive JavaScript shell\n"
-        "  d8 [options] file1 file2 ... filek\n"
-        "  d8 [options]\n"
-        "  d8 [options] --shell [file1 file2 ... filek]\n"
-        "    run the new debugging shell\n\n"
+  StdoutStream os;
+  os << "Synopsis:\n"
+        "  shell [options] [--shell] [<file>...]\n"
+        "  d8 [options] [-e <string>] [--shell] [[--module] <file>...]\n\n"
+        "  -e        execute a string in V8\n"
+        "  --shell   run an interactive JavaScript shell\n"
+        "  --module  execute a file as a JavaScript module\n\n"
         "Options:\n";
 
   for (const Flag& f : flags) {
@@ -639,6 +633,9 @@ void ComputeFlagListHash() {
 #ifdef DEBUG
   modified_args_as_string << "debug";
 #endif  // DEBUG
+  if (FLAG_embedded_builtins) {
+    modified_args_as_string << "embedded";
+  }
   for (size_t i = 0; i < num_flags; ++i) {
     Flag* current = &flags[i];
     if (!current->IsDefault()) {
diff --git a/deps/v8/src/flags.h b/deps/v8/src/flags.h
index 761375934377fa..deb050980a0d89 100644
--- a/deps/v8/src/flags.h
+++ b/deps/v8/src/flags.h
@@ -29,11 +29,12 @@ class V8_EXPORT_PRIVATE FlagList {
   static std::vector<const char*>* argv();
 
   // Set the flag values by parsing the command line. If remove_flags is
-  // set, the flags and associated values are removed from (argc,
-  // argv). Returns 0 if no error occurred. Otherwise, returns the argv
-  // index > 0 for the argument where an error occurred. In that case,
-  // (argc, argv) will remain unchanged independent of the remove_flags
-  // value, and no assumptions about flag settings should be made.
+  // set, the recognized flags and associated values are removed from (argc,
+  // argv) and only unknown arguments remain. Returns 0 if no error occurred.
+  // Otherwise, returns the argv index > 0 for the argument where an error
+  // occurred. In that case, (argc, argv) will remain unchanged independent of
+  // the remove_flags value, and no assumptions about flag settings should be
+  // made.
   //
   // The following syntax for flags is accepted (both '-' and '--' are ok):
   //
diff --git a/deps/v8/src/frame-constants.h b/deps/v8/src/frame-constants.h
index 46815273e9a7f7..1426c72bd78e28 100644
--- a/deps/v8/src/frame-constants.h
+++ b/deps/v8/src/frame-constants.h
@@ -234,13 +234,6 @@ class BuiltinFrameConstants : public TypedFrameConstants {
   DEFINE_TYPED_FRAME_SIZES(2);
 };
 
-class InternalFrameConstants : public TypedFrameConstants {
- public:
-  // FP-relative.
-  static constexpr int kCodeOffset = TYPED_FRAME_PUSHED_VALUE_OFFSET(0);
-  DEFINE_TYPED_FRAME_SIZES(1);
-};
-
 class ConstructFrameConstants : public TypedFrameConstants {
  public:
   // FP-relative.
@@ -253,6 +246,13 @@ class ConstructFrameConstants : public TypedFrameConstants {
   DEFINE_TYPED_FRAME_SIZES(5);
 };
 
+class WasmCompiledFrameConstants : public TypedFrameConstants {
+ public:
+  // FP-relative.
+  static constexpr int kWasmInstanceOffset = TYPED_FRAME_PUSHED_VALUE_OFFSET(0);
+  DEFINE_TYPED_FRAME_SIZES(1);
+};
+
 class BuiltinContinuationFrameConstants : public TypedFrameConstants {
  public:
   // FP-relative.
diff --git a/deps/v8/src/frames-inl.h b/deps/v8/src/frames-inl.h
index b3efd797807405..a64404c8ed44d3 100644
--- a/deps/v8/src/frames-inl.h
+++ b/deps/v8/src/frames-inl.h
@@ -209,6 +209,10 @@ inline JsToWasmFrame::JsToWasmFrame(StackFrameIteratorBase* iterator)
 inline CWasmEntryFrame::CWasmEntryFrame(StackFrameIteratorBase* iterator)
     : StubFrame(iterator) {}
 
+inline WasmCompileLazyFrame::WasmCompileLazyFrame(
+    StackFrameIteratorBase* iterator)
+    : StandardFrame(iterator) {}
+
 inline InternalFrame::InternalFrame(StackFrameIteratorBase* iterator)
     : StandardFrame(iterator) {
 }
diff --git a/deps/v8/src/frames.cc b/deps/v8/src/frames.cc
index 4bf0483daa3c0a..61d241a51e3c3a 100644
--- a/deps/v8/src/frames.cc
+++ b/deps/v8/src/frames.cc
@@ -208,16 +208,6 @@ DISABLE_ASAN Address ReadMemoryAt(Address address) {
   return Memory::Address_at(address);
 }
 
-WasmInstanceObject* LookupWasmInstanceObjectFromStandardFrame(
-    const StandardFrame* frame) {
-  // TODO(titzer): WASM instances cannot be found from the code in the future.
-  WasmInstanceObject* ret = WasmInstanceObject::GetOwningInstance(
-      frame->isolate()->wasm_engine()->code_manager()->LookupCode(frame->pc()));
-  // This is a live stack frame, there must be a live wasm instance available.
-  DCHECK_NOT_NULL(ret);
-  return ret;
-}
-
 }  // namespace
 
 SafeStackFrameIterator::SafeStackFrameIterator(
@@ -236,7 +226,7 @@ SafeStackFrameIterator::SafeStackFrameIterator(
     type = ExitFrame::GetStateForFramePointer(Isolate::c_entry_fp(top), &state);
     top_frame_type_ = type;
   } else if (IsValidStackAddress(fp)) {
-    DCHECK_NOT_NULL(fp);
+    DCHECK_NE(fp, kNullAddress);
     state.fp = fp;
     state.sp = sp;
     state.pc_address = StackFrame::ResolveReturnAddressLocation(
@@ -247,7 +237,7 @@ SafeStackFrameIterator::SafeStackFrameIterator(
     // case, set the PC properly and make sure we do not drop the frame.
     if (IsValidStackAddress(sp)) {
       MSAN_MEMORY_IS_INITIALIZED(sp, kPointerSize);
-      Address tos = ReadMemoryAt(reinterpret_cast<Address>(sp));
+      Address tos = ReadMemoryAt(sp);
       if (IsInterpreterFramePc(isolate, tos, &state)) {
         state.pc_address = reinterpret_cast<Address*>(sp);
         advance_frame = false;
@@ -293,7 +283,7 @@ bool SafeStackFrameIterator::IsValidTop(ThreadLocalTop* top) const {
   if (!IsValidExitFrame(c_entry_fp)) return false;
   // There should be at least one JS_ENTRY stack handler.
   Address handler = Isolate::handler(top);
-  if (handler == nullptr) return false;
+  if (handler == kNullAddress) return false;
   // Check that there are no js frames on top of the native frames.
   return c_entry_fp < handler;
 }
@@ -359,7 +349,7 @@ bool SafeStackFrameIterator::IsValidExitFrame(Address fp) const {
   StackFrame::State state;
   ExitFrame::FillState(fp, sp, &state);
   MSAN_MEMORY_IS_INITIALIZED(state.pc_address, sizeof(state.pc_address));
-  return *state.pc_address != nullptr;
+  return *state.pc_address != kNullAddress;
 }
 
 
@@ -435,7 +425,7 @@ void StackFrame::SetReturnAddressLocationResolver(
 
 StackFrame::Type StackFrame::ComputeType(const StackFrameIteratorBase* iterator,
                                          State* state) {
-  DCHECK_NOT_NULL(state->fp);
+  DCHECK_NE(state->fp, kNullAddress);
 
   MSAN_MEMORY_IS_INITIALIZED(
       state->fp + CommonFrameConstants::kContextOrFrameTypeOffset,
@@ -470,16 +460,16 @@ StackFrame::Type StackFrame::ComputeType(const StackFrameIteratorBase* iterator,
         iterator->isolate()->wasm_engine()->code_manager()->LookupCode(pc);
     if (wasm_code != nullptr) {
       switch (wasm_code->kind()) {
-        case wasm::WasmCode::kInterpreterStub:
-          return WASM_INTERPRETER_ENTRY;
         case wasm::WasmCode::kFunction:
-        case wasm::WasmCode::kCopiedStub:
           return WASM_COMPILED;
-        case wasm::WasmCode::kLazyStub:
-          if (StackFrame::IsTypeMarker(marker)) break;
-          return BUILTIN;
         case wasm::WasmCode::kWasmToJsWrapper:
           return WASM_TO_JS;
+        case wasm::WasmCode::kLazyStub:
+          return WASM_COMPILE_LAZY;
+        case wasm::WasmCode::kRuntimeStub:
+          return STUB;
+        case wasm::WasmCode::kInterpreterEntry:
+          return WASM_INTERPRETER_ENTRY;
         default:
           UNREACHABLE();
       }
@@ -640,7 +630,7 @@ StackFrame::Type ExitFrame::GetStateForFramePointer(Address fp, State* state) {
   if (fp == 0) return NONE;
   Address sp = ComputeStackPointer(fp);
   FillState(fp, sp, state);
-  DCHECK_NOT_NULL(*state->pc_address);
+  DCHECK_NE(*state->pc_address, kNullAddress);
 
   return ComputeFrameType(fp);
 }
@@ -734,7 +724,7 @@ void StackFrame::Print(StringStream* accumulator, PrintMode mode,
   DisallowHeapAllocation no_gc;
   PrintIndex(accumulator, mode, index);
   accumulator->Add(StringForStackFrameType(type()));
-  accumulator->Add(" [pc: %p]\n", pc());
+  accumulator->Add(" [pc: %p]\n", reinterpret_cast<void*>(pc()));
 }
 
 void BuiltinExitFrame::Print(StringStream* accumulator, PrintMode mode,
@@ -778,11 +768,11 @@ Script* StandardFrame::script() const {
 }
 
 Object* StandardFrame::receiver() const {
-  return isolate()->heap()->undefined_value();
+  return ReadOnlyRoots(isolate()).undefined_value();
 }
 
 Object* StandardFrame::context() const {
-  return isolate()->heap()->undefined_value();
+  return ReadOnlyRoots(isolate()).undefined_value();
 }
 
 int StandardFrame::position() const {
@@ -838,7 +828,7 @@ void StandardFrame::IterateCompiledFrame(RootVisitor* v) const {
   Code* code = nullptr;
   bool has_tagged_params = false;
   if (wasm_code != nullptr) {
-    SafepointTable table(wasm_code->instructions().start(),
+    SafepointTable table(wasm_code->instruction_start(),
                          wasm_code->safepoint_table_offset(),
                          wasm_code->stack_slots());
     safepoint_entry = table.FindEntry(inner_pointer);
@@ -881,11 +871,14 @@ void StandardFrame::IterateCompiledFrame(RootVisitor* v) const {
       case INTERNAL:
       case CONSTRUCT:
       case JS_TO_WASM:
+      case C_WASM_ENTRY:
+        frame_header_size = TypedFrameConstants::kFixedFrameSizeFromFp;
+        break;
       case WASM_TO_JS:
       case WASM_COMPILED:
       case WASM_INTERPRETER_ENTRY:
-      case C_WASM_ENTRY:
-        frame_header_size = TypedFrameConstants::kFixedFrameSizeFromFp;
+      case WASM_COMPILE_LAZY:
+        frame_header_size = WasmCompiledFrameConstants::kFixedFrameSizeFromFp;
         break;
       case OPTIMIZED:
       case INTERPRETED:
@@ -959,18 +952,17 @@ void StandardFrame::IterateCompiledFrame(RootVisitor* v) const {
     }
   }
 
-  // For wasm-to-js cases, we can skip this.
+  // For the off-heap code cases, we can skip this.
   if (code != nullptr) {
     // Visit the return address in the callee and incoming arguments.
     IteratePc(v, pc_address(), constant_pool_address(), code);
   }
 
-  if (!is_wasm() && !is_wasm_to_js()) {
-    // If this frame has JavaScript ABI, visit the context (in stub and JS
-    // frames) and the function (in JS frames).
-    v->VisitRootPointers(Root::kTop, nullptr, frame_header_base,
-                         frame_header_limit);
-  }
+  // If this frame has JavaScript ABI, visit the context (in stub and JS
+  // frames) and the function (in JS frames). If it has WebAssembly ABI, visit
+  // the instance object.
+  v->VisitRootPointers(Root::kTop, nullptr, frame_header_base,
+                       frame_header_limit);
 }
 
 void StubFrame::Iterate(RootVisitor* v) const { IterateCompiledFrame(v); }
@@ -1060,7 +1052,8 @@ void JavaScriptFrame::GetFunctions(
   std::vector<SharedFunctionInfo*> raw_functions;
   GetFunctions(&raw_functions);
   for (const auto& raw_function : raw_functions) {
-    functions->push_back(Handle<SharedFunctionInfo>(raw_function));
+    functions->push_back(
+        Handle<SharedFunctionInfo>(raw_function, function()->GetIsolate()));
   }
 }
 
@@ -1084,7 +1077,7 @@ Object* JavaScriptFrame::unchecked_function() const {
   // materialize some closures on the stack. The arguments marker object
   // marks this case.
   DCHECK(function_slot_object()->IsJSFunction() ||
-         isolate()->heap()->arguments_marker() == function_slot_object());
+         ReadOnlyRoots(isolate()).arguments_marker() == function_slot_object());
   return function_slot_object();
 }
 
@@ -1258,7 +1251,7 @@ void JavaScriptBuiltinContinuationWithCatchFrame::SetException(
       kPointerSize;  // Skip over return value slot.
 
   // Only allow setting exception if previous value was the hole.
-  CHECK_EQ(isolate()->heap()->the_hole_value(),
+  CHECK_EQ(ReadOnlyRoots(isolate()).the_hole_value(),
            Memory::Object_at(exception_argument_slot));
   Memory::Object_at(exception_argument_slot) = exception;
 }
@@ -1326,26 +1319,27 @@ WASM_SUMMARY_DISPATCH(int, byte_offset)
 #undef WASM_SUMMARY_DISPATCH
 
 int FrameSummary::WasmFrameSummary::SourcePosition() const {
-  Handle<WasmSharedModuleData> shared(
-      wasm_instance()->compiled_module()->shared(), isolate());
-  return WasmSharedModuleData::GetSourcePosition(
-      shared, function_index(), byte_offset(), at_to_number_conversion());
+  Handle<WasmModuleObject> module_object(wasm_instance()->module_object(),
+                                         isolate());
+  return WasmModuleObject::GetSourcePosition(module_object, function_index(),
+                                             byte_offset(),
+                                             at_to_number_conversion());
 }
 
 Handle<Script> FrameSummary::WasmFrameSummary::script() const {
-  return handle(wasm_instance()->compiled_module()->shared()->script());
+  return handle(wasm_instance()->module_object()->script(),
+                wasm_instance()->GetIsolate());
 }
 
 Handle<String> FrameSummary::WasmFrameSummary::FunctionName() const {
-  Handle<WasmSharedModuleData> shared(
-      wasm_instance()->compiled_module()->shared(), isolate());
-  return WasmSharedModuleData::GetFunctionName(isolate(), shared,
-                                               function_index());
+  Handle<WasmModuleObject> module_object(wasm_instance()->module_object(),
+                                         isolate());
+  return WasmModuleObject::GetFunctionName(isolate(), module_object,
+                                           function_index());
 }
 
 Handle<Context> FrameSummary::WasmFrameSummary::native_context() const {
-  return handle(wasm_instance()->compiled_module()->native_context(),
-                isolate());
+  return handle(wasm_instance()->native_context(), isolate());
 }
 
 FrameSummary::WasmCompiledFrameSummary::WasmCompiledFrameSummary(
@@ -1759,13 +1753,7 @@ Address InternalFrame::GetCallerStackPointer() const {
   return fp() + StandardFrameConstants::kCallerSPOffset;
 }
 
-Code* InternalFrame::unchecked_code() const {
-  const int offset = InternalFrameConstants::kCodeOffset;
-  Object* code = Memory::Object_at(fp() + offset);
-  DCHECK_NOT_NULL(code);
-  return reinterpret_cast<Code*>(code);
-}
-
+Code* InternalFrame::unchecked_code() const { UNREACHABLE(); }
 
 void WasmCompiledFrame::Print(StringStream* accumulator, PrintMode mode,
                               int index) const {
@@ -1777,17 +1765,16 @@ void WasmCompiledFrame::Print(StringStream* accumulator, PrintMode mode,
                                   ->wasm_engine()
                                   ->code_manager()
                                   ->LookupCode(pc())
-                                  ->instructions()
-                                  .start();
+                                  ->instruction_start();
   int pc = static_cast<int>(this->pc() - instruction_start);
   Vector<const uint8_t> raw_func_name =
-      shared()->GetRawFunctionName(this->function_index());
+      module_object()->GetRawFunctionName(this->function_index());
   const int kMaxPrintedFunctionName = 64;
   char func_name[kMaxPrintedFunctionName + 1];
   int func_name_len = std::min(kMaxPrintedFunctionName, raw_func_name.length());
   memcpy(func_name, raw_func_name.start(), func_name_len);
   func_name[func_name_len] = '\0';
-  accumulator->Add("], function #%u ('%s'), pc=%p, pos=%d\n",
+  accumulator->Add("], function #%u ('%s'), pc=+0x%x, pos=%d\n",
                    this->function_index(), func_name, pc, this->position());
   if (mode != OVERVIEW) accumulator->Add("\n");
 }
@@ -1809,24 +1796,20 @@ wasm::WasmCode* WasmCompiledFrame::wasm_code() const {
 }
 
 WasmInstanceObject* WasmCompiledFrame::wasm_instance() const {
-  return LookupWasmInstanceObjectFromStandardFrame(this);
-}
-
-WasmSharedModuleData* WasmCompiledFrame::shared() const {
-  return LookupWasmInstanceObjectFromStandardFrame(this)
-      ->compiled_module()
-      ->shared();
+  const int offset = WasmCompiledFrameConstants::kWasmInstanceOffset;
+  Object* instance = Memory::Object_at(fp() + offset);
+  return WasmInstanceObject::cast(instance);
 }
 
-WasmCompiledModule* WasmCompiledFrame::compiled_module() const {
-  return LookupWasmInstanceObjectFromStandardFrame(this)->compiled_module();
+WasmModuleObject* WasmCompiledFrame::module_object() const {
+  return wasm_instance()->module_object();
 }
 
 uint32_t WasmCompiledFrame::function_index() const {
   return FrameSummary::GetSingle(this).AsWasmCompiled().function_index();
 }
 
-Script* WasmCompiledFrame::script() const { return shared()->script(); }
+Script* WasmCompiledFrame::script() const { return module_object()->script(); }
 
 int WasmCompiledFrame::position() const {
   return FrameSummary::GetSingle(this).SourcePosition();
@@ -1835,9 +1818,8 @@ int WasmCompiledFrame::position() const {
 void WasmCompiledFrame::Summarize(std::vector<FrameSummary>* functions) const {
   DCHECK(functions->empty());
   wasm::WasmCode* code = wasm_code();
-  int offset = static_cast<int>(pc() - code->instructions().start());
-  Handle<WasmInstanceObject> instance(
-      LookupWasmInstanceObjectFromStandardFrame(this), isolate());
+  int offset = static_cast<int>(pc() - code->instruction_start());
+  Handle<WasmInstanceObject> instance(wasm_instance(), isolate());
   FrameSummary::WasmCompiledFrameSummary summary(
       isolate(), instance, code, offset, at_to_number_conversion());
   functions->push_back(summary);
@@ -1846,13 +1828,12 @@ void WasmCompiledFrame::Summarize(std::vector<FrameSummary>* functions) const {
 bool WasmCompiledFrame::at_to_number_conversion() const {
   // Check whether our callee is a WASM_TO_JS frame, and this frame is at the
   // ToNumber conversion call.
-  Address callee_pc = reinterpret_cast<Address>(this->callee_pc());
   wasm::WasmCode* code =
-      callee_pc
-          ? isolate()->wasm_engine()->code_manager()->LookupCode(callee_pc)
+      callee_pc() != kNullAddress
+          ? isolate()->wasm_engine()->code_manager()->LookupCode(callee_pc())
           : nullptr;
   if (!code || code->kind() != wasm::WasmCode::kWasmToJsWrapper) return false;
-  int offset = static_cast<int>(callee_pc - code->instructions().start());
+  int offset = static_cast<int>(callee_pc() - code->instruction_start());
   int pos = FrameSummary::WasmCompiledFrameSummary::GetWasmSourcePosition(
       code, offset);
   DCHECK(pos == 0 || pos == 1);
@@ -1865,9 +1846,8 @@ int WasmCompiledFrame::LookupExceptionHandlerInTable(int* stack_slots) {
   wasm::WasmCode* code =
       isolate()->wasm_engine()->code_manager()->LookupCode(pc());
   if (!code->IsAnonymous() && code->handler_table_offset() > 0) {
-    HandlerTable table(code->instructions().start(),
-                       code->handler_table_offset());
-    int pc_offset = static_cast<int>(pc() - code->instructions().start());
+    HandlerTable table(code->instruction_start(), code->handler_table_offset());
+    int pc_offset = static_cast<int>(pc() - code->instruction_start());
     *stack_slots = static_cast<int>(code->stack_slots());
     return table.LookupReturn(pc_offset);
   }
@@ -1890,8 +1870,7 @@ void WasmInterpreterEntryFrame::Print(StringStream* accumulator, PrintMode mode,
 
 void WasmInterpreterEntryFrame::Summarize(
     std::vector<FrameSummary>* functions) const {
-  Handle<WasmInstanceObject> instance(
-      LookupWasmInstanceObjectFromStandardFrame(this), isolate());
+  Handle<WasmInstanceObject> instance(wasm_instance(), isolate());
   std::vector<std::pair<uint32_t, int>> interpreted_stack =
       instance->debug_info()->GetInterpretedStack(fp());
 
@@ -1904,39 +1883,57 @@ void WasmInterpreterEntryFrame::Summarize(
 
 Code* WasmInterpreterEntryFrame::unchecked_code() const { UNREACHABLE(); }
 
-// TODO(titzer): deprecate this method.
 WasmInstanceObject* WasmInterpreterEntryFrame::wasm_instance() const {
-  return LookupWasmInstanceObjectFromStandardFrame(this);
+  const int offset = WasmCompiledFrameConstants::kWasmInstanceOffset;
+  Object* instance = Memory::Object_at(fp() + offset);
+  return WasmInstanceObject::cast(instance);
 }
 
 WasmDebugInfo* WasmInterpreterEntryFrame::debug_info() const {
-  return LookupWasmInstanceObjectFromStandardFrame(this)->debug_info();
+  return wasm_instance()->debug_info();
 }
 
-WasmSharedModuleData* WasmInterpreterEntryFrame::shared() const {
-  return LookupWasmInstanceObjectFromStandardFrame(this)
-      ->compiled_module()
-      ->shared();
+WasmModuleObject* WasmInterpreterEntryFrame::module_object() const {
+  return wasm_instance()->module_object();
 }
 
-WasmCompiledModule* WasmInterpreterEntryFrame::compiled_module() const {
-  return LookupWasmInstanceObjectFromStandardFrame(this)->compiled_module();
+Script* WasmInterpreterEntryFrame::script() const {
+  return module_object()->script();
 }
 
-Script* WasmInterpreterEntryFrame::script() const { return shared()->script(); }
-
 int WasmInterpreterEntryFrame::position() const {
   return FrameSummary::GetBottom(this).AsWasmInterpreted().SourcePosition();
 }
 
 Object* WasmInterpreterEntryFrame::context() const {
-  return compiled_module()->native_context();
+  return wasm_instance()->native_context();
 }
 
 Address WasmInterpreterEntryFrame::GetCallerStackPointer() const {
   return fp() + ExitFrameConstants::kCallerSPOffset;
 }
 
+WasmInstanceObject* WasmCompileLazyFrame::wasm_instance() const {
+  return WasmInstanceObject::cast(*wasm_instance_slot());
+}
+
+Object** WasmCompileLazyFrame::wasm_instance_slot() const {
+  const int offset = WasmCompileLazyFrameConstants::kWasmInstanceOffset;
+  return &Memory::Object_at(fp() + offset);
+}
+
+void WasmCompileLazyFrame::Iterate(RootVisitor* v) const {
+  const int header_size = WasmCompileLazyFrameConstants::kFixedFrameSizeFromFp;
+  Object** base = &Memory::Object_at(sp());
+  Object** limit = &Memory::Object_at(fp() - header_size);
+  v->VisitRootPointers(Root::kTop, nullptr, base, limit);
+  v->VisitRootPointer(Root::kTop, nullptr, wasm_instance_slot());
+}
+
+Address WasmCompileLazyFrame::GetCallerStackPointer() const {
+  return fp() + WasmCompileLazyFrameConstants::kCallerSPOffset;
+}
+
 namespace {
 
 
@@ -1982,7 +1979,6 @@ void JavaScriptFrame::Print(StringStream* accumulator,
     accumulator->Add(" [");
     accumulator->PrintName(script->name());
 
-    Address pc = this->pc();
     if (is_interpreted()) {
       const InterpretedFrame* iframe =
           reinterpret_cast<const InterpretedFrame*>(this);
@@ -1994,7 +1990,7 @@ void JavaScriptFrame::Print(StringStream* accumulator,
     } else {
       int function_start_pos = shared->StartPosition();
       int line = script->GetLineNumber(function_start_pos) + 1;
-      accumulator->Add(":~%d] [pc=%p]", line, pc);
+      accumulator->Add(":~%d] [pc=%p]", line, reinterpret_cast<void*>(pc()));
     }
   }
 
@@ -2004,13 +2000,6 @@ void JavaScriptFrame::Print(StringStream* accumulator,
   int parameters_count = ComputeParametersCount();
   for (int i = 0; i < parameters_count; i++) {
     accumulator->Add(",");
-    // If we have a name for the parameter we print it. Nameless
-    // parameters are either because we have more actual parameters
-    // than formal parameters or because we have no scope information.
-    if (i < scope_info->ParameterCount()) {
-      accumulator->PrintName(scope_info->ParameterName(i));
-      accumulator->Add("=");
-    }
     accumulator->Add("%o", GetParameter(i));
   }
 
@@ -2028,26 +2017,9 @@ void JavaScriptFrame::Print(StringStream* accumulator,
   accumulator->Add(" {\n");
 
   // Compute the number of locals and expression stack elements.
-  int stack_locals_count = scope_info->StackLocalCount();
   int heap_locals_count = scope_info->ContextLocalCount();
   int expressions_count = ComputeExpressionsCount();
 
-  // Print stack-allocated local variables.
-  if (stack_locals_count > 0) {
-    accumulator->Add("  // stack-allocated locals\n");
-  }
-  for (int i = 0; i < stack_locals_count; i++) {
-    accumulator->Add("  var ");
-    accumulator->PrintName(scope_info->StackLocalName(i));
-    accumulator->Add(" = ");
-    if (i < expressions_count) {
-      accumulator->Add("%o", GetExpression(i));
-    } else {
-      accumulator->Add("// no expression found - inconsistent frame?");
-    }
-    accumulator->Add("\n");
-  }
-
   // Try to get hold of the context of this frame.
   Context* context = nullptr;
   if (this->context() != nullptr && this->context()->IsContext()) {
@@ -2081,11 +2053,10 @@ void JavaScriptFrame::Print(StringStream* accumulator,
   }
 
   // Print the expression stack.
-  int expressions_start = stack_locals_count;
-  if (expressions_start < expressions_count) {
+  if (0 < expressions_count) {
     accumulator->Add("  // expression stack (top to bottom)\n");
   }
-  for (int i = expressions_count - 1; i >= expressions_start; i--) {
+  for (int i = expressions_count - 1; i >= 0; i--) {
     accumulator->Add("  [%02d] : %o\n", i, GetExpression(i));
   }
 
@@ -2141,21 +2112,15 @@ void JavaScriptFrame::Iterate(RootVisitor* v) const {
 }
 
 void InternalFrame::Iterate(RootVisitor* v) const {
-  wasm::WasmCode* wasm_code =
-      isolate()->wasm_engine()->code_manager()->LookupCode(pc());
-  if (wasm_code != nullptr) {
-    DCHECK(wasm_code->kind() == wasm::WasmCode::kLazyStub);
-  } else {
-    Code* code = LookupCode();
-    IteratePc(v, pc_address(), constant_pool_address(), code);
-    // Internal frames typically do not receive any arguments, hence their stack
-    // only contains tagged pointers.
-    // We are misusing the has_tagged_params flag here to tell us whether
-    // the full stack frame contains only tagged pointers or only raw values.
-    // This is used for the WasmCompileLazy builtin, where we actually pass
-    // untagged arguments and also store untagged values on the stack.
-    if (code->has_tagged_params()) IterateExpressions(v);
-  }
+  Code* code = LookupCode();
+  IteratePc(v, pc_address(), constant_pool_address(), code);
+  // Internal frames typically do not receive any arguments, hence their stack
+  // only contains tagged pointers.
+  // We are misusing the has_tagged_params flag here to tell us whether
+  // the full stack frame contains only tagged pointers or only raw values.
+  // This is used for the WasmCompileLazy builtin, where we actually pass
+  // untagged arguments and also store untagged values on the stack.
+  if (code->has_tagged_params()) IterateExpressions(v);
 }
 
 // -------------------------------------------------------------------------
@@ -2164,7 +2129,8 @@ InnerPointerToCodeCache::InnerPointerToCodeCacheEntry*
     InnerPointerToCodeCache::GetCacheEntry(Address inner_pointer) {
   isolate_->counters()->pc_to_code()->Increment();
   DCHECK(base::bits::IsPowerOfTwo(kInnerPointerToCodeCacheSize));
-  uint32_t hash = ComputeIntegerHash(ObjectAddressForHashing(inner_pointer));
+  uint32_t hash = ComputeIntegerHash(
+      ObjectAddressForHashing(reinterpret_cast<void*>(inner_pointer)));
   uint32_t index = hash & (kInnerPointerToCodeCacheSize - 1);
   InnerPointerToCodeCacheEntry* entry = cache(index);
   if (entry->inner_pointer == inner_pointer) {
@@ -2183,47 +2149,5 @@ InnerPointerToCodeCache::InnerPointerToCodeCacheEntry*
   }
   return entry;
 }
-
-
-// -------------------------------------------------------------------------
-
-
-#define DEFINE_WRAPPER(type, field)                              \
-class field##_Wrapper : public ZoneObject {                      \
- public:  /* NOLINT */                                           \
-  field##_Wrapper(const field& original) : frame_(original) {    \
-  }                                                              \
-  field frame_;                                                  \
-};
-STACK_FRAME_TYPE_LIST(DEFINE_WRAPPER)
-#undef DEFINE_WRAPPER
-
-static StackFrame* AllocateFrameCopy(StackFrame* frame, Zone* zone) {
-#define FRAME_TYPE_CASE(type, field) \
-  case StackFrame::type: { \
-    field##_Wrapper* wrapper = \
-        new(zone) field##_Wrapper(*(reinterpret_cast<field*>(frame))); \
-    return &wrapper->frame_; \
-  }
-
-  switch (frame->type()) {
-    STACK_FRAME_TYPE_LIST(FRAME_TYPE_CASE)
-    default: UNREACHABLE();
-  }
-#undef FRAME_TYPE_CASE
-  return nullptr;
-}
-
-
-Vector<StackFrame*> CreateStackMap(Isolate* isolate, Zone* zone) {
-  ZoneVector<StackFrame*> frames(zone);
-  for (StackFrameIterator it(isolate); !it.done(); it.Advance()) {
-    StackFrame* frame = AllocateFrameCopy(it.frame(), zone);
-    frames.push_back(frame);
-  }
-  return Vector<StackFrame*>(frames.data(), frames.size());
-}
-
-
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/src/frames.h b/deps/v8/src/frames.h
index d8438acfd7daa5..40fce95e7f9aec 100644
--- a/deps/v8/src/frames.h
+++ b/deps/v8/src/frames.h
@@ -26,10 +26,9 @@ class RootVisitor;
 class StackFrameIteratorBase;
 class StringStream;
 class ThreadLocalTop;
-class WasmCompiledModule;
 class WasmDebugInfo;
 class WasmInstanceObject;
-class WasmSharedModuleData;
+class WasmModuleObject;
 
 class InnerPointerToCodeCache {
  public:
@@ -96,6 +95,7 @@ class StackHandler BASE_EMBEDDED {
   V(JS_TO_WASM, JsToWasmFrame)                                            \
   V(WASM_INTERPRETER_ENTRY, WasmInterpreterEntryFrame)                    \
   V(C_WASM_ENTRY, CWasmEntryFrame)                                        \
+  V(WASM_COMPILE_LAZY, WasmCompileLazyFrame)                              \
   V(INTERPRETED, InterpretedFrame)                                        \
   V(STUB, StubFrame)                                                      \
   V(BUILTIN_CONTINUATION, BuiltinContinuationFrame)                       \
@@ -146,8 +146,8 @@ class StackFrame BASE_EMBEDDED {
                 kHeapObjectTag);
 
   struct State {
-    Address sp = nullptr;
-    Address fp = nullptr;
+    Address sp = kNullAddress;
+    Address fp = kNullAddress;
     Address* pc_address = nullptr;
     Address* callee_pc_address = nullptr;
     Address* constant_pool_address = nullptr;
@@ -201,6 +201,7 @@ class StackFrame BASE_EMBEDDED {
   bool is_optimized() const { return type() == OPTIMIZED; }
   bool is_interpreted() const { return type() == INTERPRETED; }
   bool is_wasm_compiled() const { return type() == WASM_COMPILED; }
+  bool is_wasm_compile_lazy() const { return type() == WASM_COMPILE_LAZY; }
   bool is_wasm_to_js() const { return type() == WASM_TO_JS; }
   bool is_js_to_wasm() const { return type() == JS_TO_WASM; }
   bool is_wasm_interpreter_entry() const {
@@ -237,7 +238,7 @@ class StackFrame BASE_EMBEDDED {
   Address sp() const { return state_.sp; }
   Address fp() const { return state_.fp; }
   Address callee_pc() const {
-    return state_.callee_pc_address ? *state_.callee_pc_address : nullptr;
+    return state_.callee_pc_address ? *state_.callee_pc_address : kNullAddress;
   }
   Address caller_sp() const { return GetCallerStackPointer(); }
 
@@ -786,10 +787,6 @@ class JavaScriptFrame : public StandardFrame {
 
   virtual int GetNumberOfIncomingArguments() const;
 
-  // Garbage collection support. Iterates over incoming arguments,
-  // receiver, and any callee-saved registers.
-  void IterateArguments(RootVisitor* v) const;
-
   virtual void PrintFrameKind(StringStream* accumulator) const {}
 
  private:
@@ -979,7 +976,7 @@ class WasmCompiledFrame final : public StandardFrame {
   Code* unchecked_code() const override;
 
   // Accessors.
-  WasmInstanceObject* wasm_instance() const;  // TODO(titzer): deprecate.
+  WasmInstanceObject* wasm_instance() const;
   wasm::WasmCode* wasm_code() const;
   uint32_t function_index() const;
   Script* script() const override;
@@ -1000,8 +997,7 @@ class WasmCompiledFrame final : public StandardFrame {
 
  private:
   friend class StackFrameIteratorBase;
-  WasmCompiledModule* compiled_module() const;
-  WasmSharedModuleData* shared() const;
+  WasmModuleObject* module_object() const;
 };
 
 class WasmInterpreterEntryFrame final : public StandardFrame {
@@ -1022,7 +1018,7 @@ class WasmInterpreterEntryFrame final : public StandardFrame {
 
   // Accessors.
   WasmDebugInfo* debug_info() const;
-  WasmInstanceObject* wasm_instance() const;  // TODO(titzer): deprecate.
+  WasmInstanceObject* wasm_instance() const;
 
   Script* script() const override;
   int position() const override;
@@ -1040,8 +1036,7 @@ class WasmInterpreterEntryFrame final : public StandardFrame {
 
  private:
   friend class StackFrameIteratorBase;
-  WasmCompiledModule* compiled_module() const;
-  WasmSharedModuleData* shared() const;
+  WasmModuleObject* module_object() const;
 };
 
 class WasmToJsFrame : public StubFrame {
@@ -1077,6 +1072,31 @@ class CWasmEntryFrame : public StubFrame {
   friend class StackFrameIteratorBase;
 };
 
+class WasmCompileLazyFrame : public StandardFrame {
+ public:
+  Type type() const override { return WASM_COMPILE_LAZY; }
+
+  Code* unchecked_code() const override { return nullptr; }
+  WasmInstanceObject* wasm_instance() const;
+  Object** wasm_instance_slot() const;
+
+  // Garbage collection support.
+  void Iterate(RootVisitor* v) const override;
+
+  static WasmCompileLazyFrame* cast(StackFrame* frame) {
+    DCHECK(frame->is_wasm_compile_lazy());
+    return static_cast<WasmCompileLazyFrame*>(frame);
+  }
+
+ protected:
+  inline explicit WasmCompileLazyFrame(StackFrameIteratorBase* iterator);
+
+  Address GetCallerStackPointer() const override;
+
+ private:
+  friend class StackFrameIteratorBase;
+};
+
 class InternalFrame: public StandardFrame {
  public:
   Type type() const override { return INTERNAL; }
@@ -1303,11 +1323,6 @@ class SafeStackFrameIterator: public StackFrameIteratorBase {
   StackFrame::Type top_frame_type_;
   ExternalCallbackScope* external_callback_scope_;
 };
-
-// Reads all frames on the current stack and copies them into the current
-// zone memory.
-Vector<StackFrame*> CreateStackMap(Isolate* isolate, Zone* zone);
-
 }  // namespace internal
 }  // namespace v8
 
diff --git a/deps/v8/src/futex-emulation.cc b/deps/v8/src/futex-emulation.cc
index 274e09b2eaa8f7..718673e6977bf9 100644
--- a/deps/v8/src/futex-emulation.cc
+++ b/deps/v8/src/futex-emulation.cc
@@ -16,6 +16,8 @@
 namespace v8 {
 namespace internal {
 
+using AtomicsWaitEvent = v8::Isolate::AtomicsWaitEvent;
+
 base::LazyMutex FutexEmulation::mutex_ = LAZY_MUTEX_INITIALIZER;
 base::LazyInstance<FutexWaitList>::type FutexEmulation::wait_list_ =
     LAZY_INSTANCE_INITIALIZER;
@@ -71,6 +73,17 @@ void FutexWaitList::RemoveNode(FutexWaitListNode* node) {
   node->prev_ = node->next_ = nullptr;
 }
 
+void AtomicsWaitWakeHandle::Wake() {
+  // Adding a separate `NotifyWake()` variant that doesn't acquire the lock
+  // itself would likely just add unnecessary complexity..
+  // The split lock by itself isn’t an issue, as long as the caller properly
+  // synchronizes this with the closing `AtomicsWaitCallback`.
+  {
+    base::LockGuard<base::Mutex> lock_guard(FutexEmulation::mutex_.Pointer());
+    stopped_ = true;
+  }
+  isolate_->futex_wait_list_node()->NotifyWake();
+}
 
 Object* FutexEmulation::Wait(Isolate* isolate,
                              Handle<JSArrayBuffer> array_buffer, size_t addr,
@@ -81,14 +94,7 @@ Object* FutexEmulation::Wait(Isolate* isolate,
   int32_t* p =
       reinterpret_cast<int32_t*>(static_cast<int8_t*>(backing_store) + addr);
 
-  base::LockGuard<base::Mutex> lock_guard(mutex_.Pointer());
-
-  if (*p != value) {
-    return isolate->heap()->not_equal();
-  }
-
   FutexWaitListNode* node = isolate->futex_wait_list_node();
-
   node->backing_store_ = backing_store;
   node->wait_addr_ = addr;
   node->waiting_ = true;
@@ -112,77 +118,119 @@ Object* FutexEmulation::Wait(Isolate* isolate,
     }
   }
 
-  base::TimeTicks start_time = base::TimeTicks::Now();
-  base::TimeTicks timeout_time = start_time + rel_timeout;
-  base::TimeTicks current_time = start_time;
+  AtomicsWaitWakeHandle stop_handle(isolate);
 
-  wait_list_.Pointer()->AddNode(node);
+  isolate->RunAtomicsWaitCallback(AtomicsWaitEvent::kStartWait, array_buffer,
+                                  addr, value, rel_timeout_ms, &stop_handle);
 
-  Object* result;
-
-  while (true) {
-    bool interrupted = node->interrupted_;
-    node->interrupted_ = false;
-
-    // Unlock the mutex here to prevent deadlock from lock ordering between
-    // mutex_ and mutexes locked by HandleInterrupts.
-    mutex_.Pointer()->Unlock();
-
-    // Because the mutex is unlocked, we have to be careful about not dropping
-    // an interrupt. The notification can happen in three different places:
-    // 1) Before Wait is called: the notification will be dropped, but
-    //    interrupted_ will be set to 1. This will be checked below.
-    // 2) After interrupted has been checked here, but before mutex_ is
-    //    acquired: interrupted is checked again below, with mutex_ locked.
-    //    Because the wakeup signal also acquires mutex_, we know it will not
-    //    be able to notify until mutex_ is released below, when waiting on the
-    //    condition variable.
-    // 3) After the mutex is released in the call to WaitFor(): this
-    // notification will wake up the condition variable. node->waiting() will
-    // be false, so we'll loop and then check interrupts.
-    if (interrupted) {
-      Object* interrupt_object = isolate->stack_guard()->HandleInterrupts();
-      if (interrupt_object->IsException(isolate)) {
-        result = interrupt_object;
-        mutex_.Pointer()->Lock();
-        break;
-      }
-    }
+  if (isolate->has_scheduled_exception()) {
+    node->waiting_ = false;
+    return isolate->PromoteScheduledException();
+  }
 
-    mutex_.Pointer()->Lock();
+  Object* result;
+  AtomicsWaitEvent callback_result = AtomicsWaitEvent::kWokenUp;
 
-    if (node->interrupted_) {
-      // An interrupt occurred while the mutex_ was unlocked. Don't wait yet.
-      continue;
-    }
+  do {  // Not really a loop, just makes it easier to break out early.
+    base::LockGuard<base::Mutex> lock_guard(mutex_.Pointer());
+    // Reset node->waiting_ = false when leaving this scope (but while
+    // still holding the lock).
+    ResetWaitingOnScopeExit reset_waiting(node);
 
-    if (!node->waiting_) {
-      result = isolate->heap()->ok();
+    if (*p != value) {
+      result = ReadOnlyRoots(isolate).not_equal();
+      callback_result = AtomicsWaitEvent::kNotEqual;
       break;
     }
 
-    // No interrupts, now wait.
+    base::TimeTicks timeout_time;
+    base::TimeTicks current_time;
+
     if (use_timeout) {
       current_time = base::TimeTicks::Now();
-      if (current_time >= timeout_time) {
-        result = isolate->heap()->timed_out();
+      timeout_time = current_time + rel_timeout;
+    }
+
+    wait_list_.Pointer()->AddNode(node);
+
+    while (true) {
+      bool interrupted = node->interrupted_;
+      node->interrupted_ = false;
+
+      // Unlock the mutex here to prevent deadlock from lock ordering between
+      // mutex_ and mutexes locked by HandleInterrupts.
+      mutex_.Pointer()->Unlock();
+
+      // Because the mutex is unlocked, we have to be careful about not dropping
+      // an interrupt. The notification can happen in three different places:
+      // 1) Before Wait is called: the notification will be dropped, but
+      //    interrupted_ will be set to 1. This will be checked below.
+      // 2) After interrupted has been checked here, but before mutex_ is
+      //    acquired: interrupted is checked again below, with mutex_ locked.
+      //    Because the wakeup signal also acquires mutex_, we know it will not
+      //    be able to notify until mutex_ is released below, when waiting on
+      //    the condition variable.
+      // 3) After the mutex is released in the call to WaitFor(): this
+      // notification will wake up the condition variable. node->waiting() will
+      // be false, so we'll loop and then check interrupts.
+      if (interrupted) {
+        Object* interrupt_object = isolate->stack_guard()->HandleInterrupts();
+        if (interrupt_object->IsException(isolate)) {
+          result = interrupt_object;
+          callback_result = AtomicsWaitEvent::kTerminatedExecution;
+          mutex_.Pointer()->Lock();
+          break;
+        }
+      }
+
+      mutex_.Pointer()->Lock();
+
+      if (node->interrupted_) {
+        // An interrupt occurred while the mutex_ was unlocked. Don't wait yet.
+        continue;
+      }
+
+      if (stop_handle.has_stopped()) {
+        node->waiting_ = false;
+        callback_result = AtomicsWaitEvent::kAPIStopped;
+      }
+
+      if (!node->waiting_) {
+        result = ReadOnlyRoots(isolate).ok();
         break;
       }
 
-      base::TimeDelta time_until_timeout = timeout_time - current_time;
-      DCHECK_GE(time_until_timeout.InMicroseconds(), 0);
-      bool wait_for_result =
-          node->cond_.WaitFor(mutex_.Pointer(), time_until_timeout);
-      USE(wait_for_result);
-    } else {
-      node->cond_.Wait(mutex_.Pointer());
+      // No interrupts, now wait.
+      if (use_timeout) {
+        current_time = base::TimeTicks::Now();
+        if (current_time >= timeout_time) {
+          result = ReadOnlyRoots(isolate).timed_out();
+          callback_result = AtomicsWaitEvent::kTimedOut;
+          break;
+        }
+
+        base::TimeDelta time_until_timeout = timeout_time - current_time;
+        DCHECK_GE(time_until_timeout.InMicroseconds(), 0);
+        bool wait_for_result =
+            node->cond_.WaitFor(mutex_.Pointer(), time_until_timeout);
+        USE(wait_for_result);
+      } else {
+        node->cond_.Wait(mutex_.Pointer());
+      }
+
+      // Spurious wakeup, interrupt or timeout.
     }
 
-    // Spurious wakeup, interrupt or timeout.
-  }
+    wait_list_.Pointer()->RemoveNode(node);
+  } while (0);
 
-  wait_list_.Pointer()->RemoveNode(node);
-  node->waiting_ = false;
+  isolate->RunAtomicsWaitCallback(callback_result, array_buffer, addr, value,
+                                  rel_timeout_ms, nullptr);
+
+  if (isolate->has_scheduled_exception()) {
+    CHECK_NE(callback_result, AtomicsWaitEvent::kTerminatedExecution);
+    result = isolate->PromoteScheduledException();
+  }
 
   return result;
 }
diff --git a/deps/v8/src/futex-emulation.h b/deps/v8/src/futex-emulation.h
index 801198fab8aa64..a1580099d6a79f 100644
--- a/deps/v8/src/futex-emulation.h
+++ b/deps/v8/src/futex-emulation.h
@@ -35,6 +35,18 @@ class Handle;
 class Isolate;
 class JSArrayBuffer;
 
+class AtomicsWaitWakeHandle {
+ public:
+  explicit AtomicsWaitWakeHandle(Isolate* isolate) : isolate_(isolate) {}
+
+  void Wake();
+  inline bool has_stopped() const { return stopped_; }
+
+ private:
+  Isolate* isolate_;
+  bool stopped_ = false;
+};
+
 class FutexWaitListNode {
  public:
   FutexWaitListNode()
@@ -50,12 +62,17 @@ class FutexWaitListNode {
  private:
   friend class FutexEmulation;
   friend class FutexWaitList;
+  friend class ResetWaitingOnScopeExit;
 
   base::ConditionVariable cond_;
+  // prev_ and next_ are protected by FutexEmulation::mutex_.
   FutexWaitListNode* prev_;
   FutexWaitListNode* next_;
   void* backing_store_;
   size_t wait_addr_;
+  // waiting_ and interrupted_ are protected by FutexEmulation::mutex_
+  // if this node is currently contained in FutexEmulation::wait_list_
+  // or an AtomicsWaitWakeHandle has access to it.
   bool waiting_;
   bool interrupted_;
 
@@ -79,6 +96,16 @@ class FutexWaitList {
   DISALLOW_COPY_AND_ASSIGN(FutexWaitList);
 };
 
+class ResetWaitingOnScopeExit {
+ public:
+  explicit ResetWaitingOnScopeExit(FutexWaitListNode* node) : node_(node) {}
+  ~ResetWaitingOnScopeExit() { node_->waiting_ = false; }
+
+ private:
+  FutexWaitListNode* node_;
+
+  DISALLOW_COPY_AND_ASSIGN(ResetWaitingOnScopeExit);
+};
 
 class FutexEmulation : public AllStatic {
  public:
@@ -109,7 +136,13 @@ class FutexEmulation : public AllStatic {
 
  private:
   friend class FutexWaitListNode;
+  friend class AtomicsWaitWakeHandle;
 
+  // `mutex_` protects the composition of `wait_list_` (i.e. no elements may be
+  // added or removed without holding this mutex), as well as the `waiting_`
+  // and `interrupted_` fields for each individual list node that is currently
+  // part of the list. It must be the mutex used together with the `cond_`
+  // condition variable of such nodes.
   static base::LazyMutex mutex_;
   static base::LazyInstance<FutexWaitList>::type wait_list_;
 };
diff --git a/deps/v8/src/gdb-jit.cc b/deps/v8/src/gdb-jit.cc
index 8fcd410643303c..355bcbd62f0e87 100644
--- a/deps/v8/src/gdb-jit.cc
+++ b/deps/v8/src/gdb-jit.cc
@@ -979,11 +979,11 @@ class CodeDescription BASE_EMBEDDED {
   }
 
   uintptr_t CodeStart() const {
-    return reinterpret_cast<uintptr_t>(code_->InstructionStart());
+    return static_cast<uintptr_t>(code_->InstructionStart());
   }
 
   uintptr_t CodeEnd() const {
-    return reinterpret_cast<uintptr_t>(code_->InstructionEnd());
+    return static_cast<uintptr_t>(code_->InstructionEnd());
   }
 
   uintptr_t CodeSize() const {
@@ -1171,17 +1171,19 @@ class DebugInfoSection : public DebugSection {
       fb_block_size.set(static_cast<uint32_t>(w->position() - fb_block_start));
 
       int params = scope->ParameterCount();
-      int slots = scope->StackLocalCount();
       int context_slots = scope->ContextLocalCount();
       // The real slot ID is internal_slots + context_slot_id.
       int internal_slots = Context::MIN_CONTEXT_SLOTS;
-      int locals = scope->StackLocalCount();
       int current_abbreviation = 4;
 
+      EmbeddedVector<char, 256> buffer;
+      StringBuilder builder(buffer.start(), buffer.length());
+
       for (int param = 0; param < params; ++param) {
         w->WriteULEB128(current_abbreviation++);
-        w->WriteString(
-            scope->ParameterName(param)->ToCString(DISALLOW_NULLS).get());
+        builder.Reset();
+        builder.AddFormatted("param%d", param);
+        w->WriteString(builder.Finalize());
         w->Write<uint32_t>(ty_offset);
         Writer::Slot<uint32_t> block_size = w->CreateSlotHere<uint32_t>();
         uintptr_t block_start = w->position();
@@ -1192,24 +1194,14 @@ class DebugInfoSection : public DebugSection {
         block_size.set(static_cast<uint32_t>(w->position() - block_start));
       }
 
-      EmbeddedVector<char, 256> buffer;
-      StringBuilder builder(buffer.start(), buffer.length());
-
-      for (int slot = 0; slot < slots; ++slot) {
-        w->WriteULEB128(current_abbreviation++);
-        builder.Reset();
-        builder.AddFormatted("slot%d", slot);
-        w->WriteString(builder.Finalize());
-      }
-
       // See contexts.h for more information.
       DCHECK_EQ(Context::MIN_CONTEXT_SLOTS, 4);
-      DCHECK_EQ(Context::CLOSURE_INDEX, 0);
+      DCHECK_EQ(Context::SCOPE_INFO_INDEX, 0);
       DCHECK_EQ(Context::PREVIOUS_INDEX, 1);
       DCHECK_EQ(Context::EXTENSION_INDEX, 2);
       DCHECK_EQ(Context::NATIVE_CONTEXT_INDEX, 3);
       w->WriteULEB128(current_abbreviation++);
-      w->WriteString(".closure");
+      w->WriteString(".scope_info");
       w->WriteULEB128(current_abbreviation++);
       w->WriteString(".previous");
       w->WriteULEB128(current_abbreviation++);
@@ -1226,20 +1218,6 @@ class DebugInfoSection : public DebugSection {
         w->WriteString(builder.Finalize());
       }
 
-      for (int local = 0; local < locals; ++local) {
-        w->WriteULEB128(current_abbreviation++);
-        w->WriteString(
-            scope->StackLocalName(local)->ToCString(DISALLOW_NULLS).get());
-        w->Write<uint32_t>(ty_offset);
-        Writer::Slot<uint32_t> block_size = w->CreateSlotHere<uint32_t>();
-        uintptr_t block_start = w->position();
-        w->Write<uint8_t>(DW_OP_fbreg);
-        w->WriteSLEB128(
-          JavaScriptFrameConstants::kLocal0Offset -
-              kPointerSize * local);
-        block_size.set(static_cast<uint32_t>(w->position() - block_start));
-      }
-
       {
         w->WriteULEB128(current_abbreviation++);
         w->WriteString("__function");
@@ -1370,13 +1348,11 @@ class DebugAbbrevSection : public DebugSection {
     if (extra_info) {
       ScopeInfo* scope = desc_->scope_info();
       int params = scope->ParameterCount();
-      int slots = scope->StackLocalCount();
       int context_slots = scope->ContextLocalCount();
       // The real slot ID is internal_slots + context_slot_id.
       int internal_slots = Context::MIN_CONTEXT_SLOTS;
-      int locals = scope->StackLocalCount();
-      // Total children is params + slots + context_slots + internal_slots +
-      // locals + 2 (__function and __context).
+      // Total children is params + context_slots + internal_slots + 2
+      // (__function and __context).
 
       // The extra duplication below seems to be necessary to keep
       // gdb from getting upset on OSX.
@@ -1408,10 +1384,6 @@ class DebugAbbrevSection : public DebugSection {
         WriteVariableAbbreviation(w, current_abbreviation++, true, true);
       }
 
-      for (int slot = 0; slot < slots; ++slot) {
-        WriteVariableAbbreviation(w, current_abbreviation++, false, false);
-      }
-
       for (int internal_slot = 0;
            internal_slot < internal_slots;
            ++internal_slot) {
@@ -1424,10 +1396,6 @@ class DebugAbbrevSection : public DebugSection {
         WriteVariableAbbreviation(w, current_abbreviation++, false, false);
       }
 
-      for (int local = 0; local < locals; ++local) {
-        WriteVariableAbbreviation(w, current_abbreviation++, true, false);
-      }
-
       // The function.
       WriteVariableAbbreviation(w, current_abbreviation++, true, false);
 
@@ -1885,8 +1853,8 @@ extern "C" {
 
 #ifdef OBJECT_PRINT
   void __gdb_print_v8_object(Object* object) {
-    OFStream os(stdout);
-    object->Print(os);
+    StdoutStream os;
+    object->Print(Isolate::Current(), os);
     os << std::flush;
   }
 #endif
@@ -1900,7 +1868,8 @@ static JITCodeEntry* CreateCodeEntry(Address symfile_addr,
 
   entry->symfile_addr_ = reinterpret_cast<Address>(entry + 1);
   entry->symfile_size_ = symfile_size;
-  MemCopy(entry->symfile_addr_, symfile_addr, symfile_size);
+  MemCopy(reinterpret_cast<void*>(entry->symfile_addr_),
+          reinterpret_cast<void*>(symfile_addr), symfile_size);
 
   entry->prev_ = entry->next_ = nullptr;
 
@@ -1976,7 +1945,7 @@ static JITCodeEntry* CreateELFObject(CodeDescription* desc, Isolate* isolate) {
   elf.Write(&w);
 #endif
 
-  return CreateCodeEntry(w.buffer(), w.position());
+  return CreateCodeEntry(reinterpret_cast<Address>(w.buffer()), w.position());
 }
 
 
@@ -2010,8 +1979,7 @@ static CodeMap* GetCodeMap() {
 
 static uint32_t HashCodeAddress(Address addr) {
   static const uintptr_t kGoldenRatio = 2654435761u;
-  uintptr_t offset = OffsetFrom(addr);
-  return static_cast<uint32_t>((offset >> kCodeAlignmentBits) * kGoldenRatio);
+  return static_cast<uint32_t>((addr >> kCodeAlignmentBits) * kGoldenRatio);
 }
 
 static base::HashMap* GetLineMap() {
@@ -2025,15 +1993,16 @@ static base::HashMap* GetLineMap() {
 
 static void PutLineInfo(Address addr, LineInfo* info) {
   base::HashMap* line_map = GetLineMap();
-  base::HashMap::Entry* e =
-      line_map->LookupOrInsert(addr, HashCodeAddress(addr));
+  base::HashMap::Entry* e = line_map->LookupOrInsert(
+      reinterpret_cast<void*>(addr), HashCodeAddress(addr));
   if (e->value != nullptr) delete static_cast<LineInfo*>(e->value);
   e->value = info;
 }
 
 
 static LineInfo* GetLineInfo(Address addr) {
-  void* value = GetLineMap()->Remove(addr, HashCodeAddress(addr));
+  void* value = GetLineMap()->Remove(reinterpret_cast<void*>(addr),
+                                     HashCodeAddress(addr));
   return static_cast<LineInfo*>(value);
 }
 
@@ -2121,7 +2090,7 @@ static void AddJITCodeEntry(CodeMap* map, const AddressRange& range,
 
     SNPrintF(Vector<char>(file_name, kMaxFileNameSize), "/tmp/elfdump%s%d.o",
              (name_hint != nullptr) ? name_hint : "", file_num++);
-    WriteBytes(file_name, entry->symfile_addr_,
+    WriteBytes(file_name, reinterpret_cast<byte*>(entry->symfile_addr_),
                static_cast<int>(entry->symfile_size_));
   }
 #endif
diff --git a/deps/v8/src/global-handles.cc b/deps/v8/src/global-handles.cc
index 0e9b678ceb7eb8..370270748204fe 100644
--- a/deps/v8/src/global-handles.cc
+++ b/deps/v8/src/global-handles.cc
@@ -509,30 +509,16 @@ class GlobalHandles::NodeIterator {
 class GlobalHandles::PendingPhantomCallbacksSecondPassTask
     : public v8::internal::CancelableTask {
  public:
-  // Takes ownership of the contents of pending_phantom_callbacks, leaving it in
-  // the same state it would be after a call to Clear().
-  PendingPhantomCallbacksSecondPassTask(
-      std::vector<PendingPhantomCallback>* pending_phantom_callbacks,
-      Isolate* isolate)
-      : CancelableTask(isolate), isolate_(isolate) {
-    pending_phantom_callbacks_.swap(*pending_phantom_callbacks);
-  }
+  PendingPhantomCallbacksSecondPassTask(GlobalHandles* global_handles,
+                                        Isolate* isolate)
+      : CancelableTask(isolate), global_handles_(global_handles) {}
 
   void RunInternal() override {
-    TRACE_EVENT0("v8", "V8.GCPhantomHandleProcessingCallback");
-    isolate()->heap()->CallGCPrologueCallbacks(
-        GCType::kGCTypeProcessWeakCallbacks, kNoGCCallbackFlags);
-    InvokeSecondPassPhantomCallbacks(&pending_phantom_callbacks_, isolate());
-    isolate()->heap()->CallGCEpilogueCallbacks(
-        GCType::kGCTypeProcessWeakCallbacks, kNoGCCallbackFlags);
+    global_handles_->InvokeSecondPassPhantomCallbacksFromTask();
   }
 
-  Isolate* isolate() { return isolate_; }
-
  private:
-  Isolate* isolate_;
-  std::vector<PendingPhantomCallback> pending_phantom_callbacks_;
-
+  GlobalHandles* global_handles_;
   DISALLOW_COPY_AND_ASSIGN(PendingPhantomCallbacksSecondPassTask);
 };
 
@@ -566,8 +552,7 @@ Handle<Object> GlobalHandles::Create(Object* value) {
   Node* result = first_free_;
   first_free_ = result->next_free();
   result->Acquire(value);
-  if (isolate_->heap()->InNewSpace(value) &&
-      !result->is_in_new_space_list()) {
+  if (Heap::InNewSpace(value) && !result->is_in_new_space_list()) {
     new_space_nodes_.push_back(result);
     result->set_in_new_space_list(true);
   }
@@ -641,10 +626,11 @@ void GlobalHandles::IterateWeakRootsForFinalizers(RootVisitor* v) {
 
 DISABLE_CFI_PERF
 void GlobalHandles::IterateWeakRootsForPhantomHandles(
-    WeakSlotCallback should_reset_handle) {
+    WeakSlotCallbackWithHeap should_reset_handle) {
   for (NodeIterator it(this); !it.done(); it.Advance()) {
     Node* node = it.node();
-    if (node->IsWeakRetainer() && should_reset_handle(node->location())) {
+    if (node->IsWeakRetainer() &&
+        should_reset_handle(isolate()->heap(), node->location())) {
       if (node->IsPhantomResetHandle()) {
         node->MarkPending();
         node->ResetPhantomHandle();
@@ -658,10 +644,12 @@ void GlobalHandles::IterateWeakRootsForPhantomHandles(
   }
 }
 
-void GlobalHandles::IdentifyWeakHandles(WeakSlotCallback should_reset_handle) {
+void GlobalHandles::IdentifyWeakHandles(
+    WeakSlotCallbackWithHeap should_reset_handle) {
   for (NodeIterator it(this); !it.done(); it.Advance()) {
     Node* node = it.node();
-    if (node->IsWeak() && should_reset_handle(node->location())) {
+    if (node->IsWeak() &&
+        should_reset_handle(isolate()->heap(), node->location())) {
       if (!node->IsPhantomCallback() && !node->IsPhantomResetHandle()) {
         node->MarkPending();
       }
@@ -762,18 +750,27 @@ void GlobalHandles::IterateNewSpaceWeakUnmodifiedRootsForPhantomHandles(
   }
 }
 
-void GlobalHandles::InvokeSecondPassPhantomCallbacks(
-    std::vector<PendingPhantomCallback>* callbacks, Isolate* isolate) {
-  while (!callbacks->empty()) {
-    auto callback = callbacks->back();
-    callbacks->pop_back();
+void GlobalHandles::InvokeSecondPassPhantomCallbacksFromTask() {
+  DCHECK(second_pass_callbacks_task_posted_);
+  second_pass_callbacks_task_posted_ = false;
+  TRACE_EVENT0("v8", "V8.GCPhantomHandleProcessingCallback");
+  isolate()->heap()->CallGCPrologueCallbacks(
+      GCType::kGCTypeProcessWeakCallbacks, kNoGCCallbackFlags);
+  InvokeSecondPassPhantomCallbacks();
+  isolate()->heap()->CallGCEpilogueCallbacks(
+      GCType::kGCTypeProcessWeakCallbacks, kNoGCCallbackFlags);
+}
+
+void GlobalHandles::InvokeSecondPassPhantomCallbacks() {
+  while (!second_pass_callbacks_.empty()) {
+    auto callback = second_pass_callbacks_.back();
+    second_pass_callbacks_.pop_back();
     DCHECK_NULL(callback.node());
     // Fire second pass callback
-    callback.Invoke(isolate);
+    callback.Invoke(isolate());
   }
 }
 
-
 int GlobalHandles::PostScavengeProcessing(
     const int initial_post_gc_processing_count) {
   int freed_nodes = 0;
@@ -840,7 +837,7 @@ void GlobalHandles::UpdateListOfNewSpaceNodes() {
   for (Node* node : new_space_nodes_) {
     DCHECK(node->is_in_new_space_list());
     if (node->IsRetainer()) {
-      if (isolate_->heap()->InNewSpace(node->object())) {
+      if (Heap::InNewSpace(node->object())) {
         new_space_nodes_[last++] = node;
         isolate_->heap()->IncrementNodesCopiedInNewSpace();
       } else {
@@ -861,28 +858,29 @@ void GlobalHandles::UpdateListOfNewSpaceNodes() {
 int GlobalHandles::DispatchPendingPhantomCallbacks(
     bool synchronous_second_pass) {
   int freed_nodes = 0;
-  std::vector<PendingPhantomCallback> second_pass_callbacks;
+  // Protect against callback modifying pending_phantom_callbacks_.
+  std::vector<PendingPhantomCallback> pending_phantom_callbacks;
+  pending_phantom_callbacks.swap(pending_phantom_callbacks_);
   {
     // The initial pass callbacks must simply clear the nodes.
-    for (auto callback : pending_phantom_callbacks_) {
+    for (auto callback : pending_phantom_callbacks) {
       // Skip callbacks that have already been processed once.
       if (callback.node() == nullptr) continue;
       callback.Invoke(isolate());
-      if (callback.callback()) second_pass_callbacks.push_back(callback);
+      if (callback.callback()) second_pass_callbacks_.push_back(callback);
       freed_nodes++;
     }
   }
-  pending_phantom_callbacks_.clear();
-  if (!second_pass_callbacks.empty()) {
+  if (!second_pass_callbacks_.empty()) {
     if (FLAG_optimize_for_size || FLAG_predictable || synchronous_second_pass) {
       isolate()->heap()->CallGCPrologueCallbacks(
           GCType::kGCTypeProcessWeakCallbacks, kNoGCCallbackFlags);
-      InvokeSecondPassPhantomCallbacks(&second_pass_callbacks, isolate());
+      InvokeSecondPassPhantomCallbacks();
       isolate()->heap()->CallGCEpilogueCallbacks(
           GCType::kGCTypeProcessWeakCallbacks, kNoGCCallbackFlags);
-    } else {
-      auto task = new PendingPhantomCallbacksSecondPassTask(
-          &second_pass_callbacks, isolate());
+    } else if (!second_pass_callbacks_task_posted_) {
+      second_pass_callbacks_task_posted_ = true;
+      auto task = new PendingPhantomCallbacksSecondPassTask(this, isolate());
       V8::GetCurrentPlatform()->CallOnForegroundThread(
           reinterpret_cast<v8::Isolate*>(isolate()), task);
     }
@@ -1129,11 +1127,10 @@ void EternalHandles::IterateNewSpaceRoots(RootVisitor* visitor) {
   }
 }
 
-
-void EternalHandles::PostGarbageCollectionProcessing(Heap* heap) {
+void EternalHandles::PostGarbageCollectionProcessing() {
   size_t last = 0;
   for (int index : new_space_indices_) {
-    if (heap->InNewSpace(*GetLocation(index))) {
+    if (Heap::InNewSpace(*GetLocation(index))) {
       new_space_indices_[last++] = index;
     }
   }
@@ -1145,19 +1142,19 @@ void EternalHandles::PostGarbageCollectionProcessing(Heap* heap) {
 void EternalHandles::Create(Isolate* isolate, Object* object, int* index) {
   DCHECK_EQ(kInvalidIndex, *index);
   if (object == nullptr) return;
-  DCHECK_NE(isolate->heap()->the_hole_value(), object);
+  Object* the_hole = ReadOnlyRoots(isolate).the_hole_value();
+  DCHECK_NE(the_hole, object);
   int block = size_ >> kShift;
   int offset = size_ & kMask;
   // need to resize
   if (offset == 0) {
     Object** next_block = new Object*[kSize];
-    Object* the_hole = isolate->heap()->the_hole_value();
     MemsetPointer(next_block, the_hole, kSize);
     blocks_.push_back(next_block);
   }
-  DCHECK_EQ(isolate->heap()->the_hole_value(), blocks_[block][offset]);
+  DCHECK_EQ(the_hole, blocks_[block][offset]);
   blocks_[block][offset] = object;
-  if (isolate->heap()->InNewSpace(object)) {
+  if (Heap::InNewSpace(object)) {
     new_space_indices_.push_back(size_);
   }
   *index = size_++;
diff --git a/deps/v8/src/global-handles.h b/deps/v8/src/global-handles.h
index 2c2fbbd3f95e97..a379a74d44b217 100644
--- a/deps/v8/src/global-handles.h
+++ b/deps/v8/src/global-handles.h
@@ -137,11 +137,12 @@ class GlobalHandles {
 
   // Iterates over weak roots on the heap.
   void IterateWeakRootsForFinalizers(RootVisitor* v);
-  void IterateWeakRootsForPhantomHandles(WeakSlotCallback should_reset_handle);
+  void IterateWeakRootsForPhantomHandles(
+      WeakSlotCallbackWithHeap should_reset_handle);
 
   // Marks all handles that should be finalized based on the predicate
   // |should_reset_handle| as pending.
-  void IdentifyWeakHandles(WeakSlotCallback should_reset_handle);
+  void IdentifyWeakHandles(WeakSlotCallbackWithHeap should_reset_handle);
 
   // NOTE: Five ...NewSpace... functions below are used during
   // scavenge collections and iterate over sets of handles that are
@@ -180,6 +181,8 @@ class GlobalHandles {
   void Print();
 #endif  // DEBUG
 
+  void InvokeSecondPassPhantomCallbacks();
+
  private:
   // Internal node structures.
   class Node;
@@ -190,9 +193,7 @@ class GlobalHandles {
 
   explicit GlobalHandles(Isolate* isolate);
 
-  // Helpers for PostGarbageCollectionProcessing.
-  static void InvokeSecondPassPhantomCallbacks(
-      std::vector<PendingPhantomCallback>* callbacks, Isolate* isolate);
+  void InvokeSecondPassPhantomCallbacksFromTask();
   int PostScavengeProcessing(int initial_post_gc_processing_count);
   int PostMarkSweepProcessing(int initial_post_gc_processing_count);
   int DispatchPendingPhantomCallbacks(bool synchronous_second_pass);
@@ -223,6 +224,8 @@ class GlobalHandles {
   size_t number_of_phantom_handle_resets_;
 
   std::vector<PendingPhantomCallback> pending_phantom_callbacks_;
+  std::vector<PendingPhantomCallback> second_pass_callbacks_;
+  bool second_pass_callbacks_task_posted_ = false;
 
   friend class Isolate;
 
@@ -300,7 +303,7 @@ class EternalHandles {
   // Iterates over all handles which might be in new space.
   void IterateNewSpaceRoots(RootVisitor* visitor);
   // Rebuilds new space list.
-  void PostGarbageCollectionProcessing(Heap* heap);
+  void PostGarbageCollectionProcessing();
 
  private:
   static const int kInvalidIndex = -1;
diff --git a/deps/v8/src/globals.h b/deps/v8/src/globals.h
index a41bd326c725ac..9eb6fd0e88ac9e 100644
--- a/deps/v8/src/globals.h
+++ b/deps/v8/src/globals.h
@@ -50,7 +50,6 @@ namespace v8 {
 namespace base {
 class Mutex;
 class RecursiveMutex;
-class VirtualMemory;
 }
 
 namespace internal {
@@ -127,7 +126,8 @@ class AllStatic {
 #define BASE_EMBEDDED
 
 typedef uint8_t byte;
-typedef byte* Address;
+typedef uintptr_t Address;
+static const Address kNullAddress = 0;
 
 // -----------------------------------------------------------------------------
 // Constants
@@ -163,6 +163,7 @@ constexpr int kDoubleSize = sizeof(double);
 constexpr int kIntptrSize = sizeof(intptr_t);
 constexpr int kUIntptrSize = sizeof(uintptr_t);
 constexpr int kPointerSize = sizeof(void*);
+constexpr int kPointerHexDigits = kPointerSize == 4 ? 8 : 12;
 #if V8_TARGET_ARCH_X64 && V8_TARGET_ARCH_32_BIT
 constexpr int kRegisterSize = kPointerSize + kPointerSize;
 #else
@@ -178,7 +179,12 @@ constexpr int kElidedFrameSlots = 0;
 #endif
 
 constexpr int kDoubleSizeLog2 = 3;
+#if V8_TARGET_ARCH_ARM64
+// ARM64 only supports direct calls within a 128 MB range.
+constexpr size_t kMaxWasmCodeMemory = 128 * MB;
+#else
 constexpr size_t kMaxWasmCodeMemory = 256 * MB;
+#endif
 
 #if V8_HOST_ARCH_64_BIT
 constexpr int kPointerSizeLog2 = 3;
@@ -195,8 +201,11 @@ constexpr size_t kCodeRangeAreaAlignment = 256 * MB;
 #elif V8_HOST_ARCH_PPC && V8_TARGET_ARCH_PPC && V8_OS_LINUX
 constexpr size_t kMaximalCodeRangeSize = 512 * MB;
 constexpr size_t kCodeRangeAreaAlignment = 64 * KB;  // OS page on PPC Linux
+#elif V8_TARGET_ARCH_ARM64
+constexpr size_t kMaximalCodeRangeSize = 128 * MB;
+constexpr size_t kCodeRangeAreaAlignment = 4 * KB;  // OS page.
 #else
-constexpr size_t kMaximalCodeRangeSize = 512 * MB;
+constexpr size_t kMaximalCodeRangeSize = 128 * MB;
 constexpr size_t kCodeRangeAreaAlignment = 4 * KB;  // OS page.
 #endif
 #if V8_OS_WIN
@@ -242,6 +251,10 @@ constexpr int kExternalAllocationSoftLimit = 64 * MB;
 // Current value: Page::kAllocatableMemory (on 32-bit arch) - 512 (slack).
 constexpr int kMaxRegularHeapObjectSize = 507136;
 
+// Objects smaller or equal kMaxNewSpaceHeapObjectSize are allocated in the
+// new large object space.
+constexpr int kMaxNewSpaceHeapObjectSize = 32 * KB;
+
 STATIC_ASSERT(kPointerSize == (1 << kPointerSizeLog2));
 
 constexpr int kBitsPerByte = 8;
@@ -275,15 +288,18 @@ constexpr int kUC16Size = sizeof(uc16);  // NOLINT
 constexpr int kSimd128Size = 16;
 
 // FUNCTION_ADDR(f) gets the address of a C function f.
-#define FUNCTION_ADDR(f)                                        \
-  (reinterpret_cast<v8::internal::Address>(reinterpret_cast<intptr_t>(f)))
-
+#define FUNCTION_ADDR(f) (reinterpret_cast<v8::internal::Address>(f))
 
 // FUNCTION_CAST<F>(addr) casts an address into a function
 // of type F. Used to invoke generated code from within C.
+template <typename F>
+F FUNCTION_CAST(byte* addr) {
+  return reinterpret_cast<F>(reinterpret_cast<Address>(addr));
+}
+
 template <typename F>
 F FUNCTION_CAST(Address addr) {
-  return reinterpret_cast<F>(reinterpret_cast<intptr_t>(addr));
+  return reinterpret_cast<F>(addr);
 }
 
 
@@ -351,14 +367,30 @@ inline LanguageMode stricter_language_mode(LanguageMode mode1,
 
 enum TypeofMode : int { INSIDE_TYPEOF, NOT_INSIDE_TYPEOF };
 
+// Enums used by CEntry.
+enum SaveFPRegsMode { kDontSaveFPRegs, kSaveFPRegs };
+enum ArgvMode { kArgvOnStack, kArgvInRegister };
+
 // This constant is used as an undefined value when passing source positions.
 constexpr int kNoSourcePosition = -1;
 
 // This constant is used to indicate missing deoptimization information.
 constexpr int kNoDeoptimizationId = -1;
 
-// Deoptimize bailout kind.
-enum class DeoptimizeKind : uint8_t { kEager, kSoft, kLazy };
+// Deoptimize bailout kind:
+// - Eager: a check failed in the optimized code and deoptimization happens
+//   immediately.
+// - Lazy: the code has been marked as dependent on some assumption which
+//   is checked elsewhere and can trigger deoptimization the next time the
+//   code is executed.
+// - Soft: similar to lazy deoptimization, but does not contribute to the
+//   total deopt count which can lead to disabling optimization for a function.
+enum class DeoptimizeKind : uint8_t {
+  kEager,
+  kSoft,
+  kLazy,
+  kLastDeoptimizeKind = kLazy
+};
 inline size_t hash_value(DeoptimizeKind kind) {
   return static_cast<size_t>(kind);
 }
@@ -389,8 +421,26 @@ inline std::ostream& operator<<(std::ostream& os,
   UNREACHABLE();
 }
 
+static_assert(kSmiValueSize <= 32, "Unsupported Smi tagging scheme");
+// Smi sign bit position must be 32-bit aligned so we can use sign extension
+// instructions on 64-bit architectures without additional shifts.
+static_assert((kSmiValueSize + kSmiShiftSize + kSmiTagSize) % 32 == 0,
+              "Unsupported Smi tagging scheme");
+
+constexpr bool kIsSmiValueInUpper32Bits =
+    (kSmiValueSize + kSmiShiftSize + kSmiTagSize) == 64;
+constexpr bool kIsSmiValueInLower32Bits =
+    (kSmiValueSize + kSmiShiftSize + kSmiTagSize) == 32;
+static_assert(!SmiValuesAre32Bits() == SmiValuesAre31Bits(),
+              "Unsupported Smi tagging scheme");
+static_assert(SmiValuesAre32Bits() == kIsSmiValueInUpper32Bits,
+              "Unsupported Smi tagging scheme");
+static_assert(SmiValuesAre31Bits() == kIsSmiValueInLower32Bits,
+              "Unsupported Smi tagging scheme");
+
 // Mask for the sign bit in a smi.
-constexpr intptr_t kSmiSignMask = kIntptrSignBit;
+constexpr intptr_t kSmiSignMask = static_cast<intptr_t>(
+    uintptr_t{1} << (kSmiValueSize + kSmiShiftSize + kSmiTagSize - 1));
 
 constexpr int kObjectAlignmentBits = kPointerSizeLog2;
 constexpr intptr_t kObjectAlignment = 1 << kObjectAlignmentBits;
@@ -454,6 +504,7 @@ class AccessorInfo;
 class Arguments;
 class Assembler;
 class Code;
+class CodeSpace;
 class CodeStub;
 class Context;
 class Debug;
@@ -489,6 +540,7 @@ class MapSpace;
 class MarkCompactCollector;
 class MaybeObject;
 class NewSpace;
+class NewLargeObjectSpace;
 class Object;
 class OldSpace;
 class ParameterCount;
@@ -523,18 +575,20 @@ typedef bool (*WeakSlotCallbackWithHeap)(Heap* heap, Object** pointer);
 enum AllocationSpace {
   // TODO(v8:7464): Actually map this space's memory as read-only.
   RO_SPACE,    // Immortal, immovable and immutable objects,
-  NEW_SPACE,   // Semispaces collected with copying collector.
-  OLD_SPACE,   // May contain pointers to new space.
-  CODE_SPACE,  // No pointers to new space, marked executable.
-  MAP_SPACE,   // Only and all map objects.
-  LO_SPACE,    // Promoted large objects.
+  NEW_SPACE,   // Young generation semispaces for regular objects collected with
+               // Scavenger.
+  OLD_SPACE,   // Old generation regular object space.
+  CODE_SPACE,  // Old generation code object space, marked executable.
+  MAP_SPACE,   // Old generation map object space, non-movable.
+  LO_SPACE,    // Old generation large object space.
+  NEW_LO_SPACE,  // Young generation large object space.
 
   FIRST_SPACE = RO_SPACE,
-  LAST_SPACE = LO_SPACE,
+  LAST_SPACE = NEW_LO_SPACE,
   FIRST_GROWABLE_PAGED_SPACE = OLD_SPACE,
   LAST_GROWABLE_PAGED_SPACE = MAP_SPACE
 };
-constexpr int kSpaceTagSize = 4;
+constexpr int kSpaceTagSize = 3;
 STATIC_ASSERT(FIRST_SPACE == 0);
 
 enum AllocationAlignment { kWordAligned, kDoubleAligned, kDoubleUnaligned };
@@ -568,10 +622,10 @@ inline std::ostream& operator<<(std::ostream& os, WriteBarrierKind kind) {
 }
 
 // A flag that indicates whether objects should be pretenured when
-// allocated (allocated directly into the old generation) or not
-// (allocated in the young generation if the object size and type
+// allocated (allocated directly into either the old generation or read-only
+// space), or not (allocated in the young generation if the object size and type
 // allows).
-enum PretenureFlag { NOT_TENURED, TENURED };
+enum PretenureFlag { NOT_TENURED, TENURED, TENURED_READ_ONLY };
 
 inline std::ostream& operator<<(std::ostream& os, const PretenureFlag& flag) {
   switch (flag) {
@@ -579,6 +633,8 @@ inline std::ostream& operator<<(std::ostream& os, const PretenureFlag& flag) {
       return os << "NotTenured";
     case TENURED:
       return os << "Tenured";
+    case TENURED_READ_ONLY:
+      return os << "TenuredReadOnly";
   }
   UNREACHABLE();
 }
@@ -916,26 +972,26 @@ constexpr uint64_t kHoleNanInt64 =
 constexpr double kMaxSafeInteger = 9007199254740991.0;  // 2^53-1
 
 // The order of this enum has to be kept in sync with the predicates below.
-enum VariableMode : uint8_t {
+enum class VariableMode : uint8_t {
   // User declared variables:
-  LET,  // declared via 'let' declarations (first lexical)
+  kLet,  // declared via 'let' declarations (first lexical)
 
-  CONST,  // declared via 'const' declarations (last lexical)
+  kConst,  // declared via 'const' declarations (last lexical)
 
-  VAR,  // declared via 'var', and 'function' declarations
+  kVar,  // declared via 'var', and 'function' declarations
 
   // Variables introduced by the compiler:
-  TEMPORARY,  // temporary variables (not user-visible), stack-allocated
-              // unless the scope as a whole has forced context allocation
+  kTemporary,  // temporary variables (not user-visible), stack-allocated
+               // unless the scope as a whole has forced context allocation
 
-  DYNAMIC,  // always require dynamic lookup (we don't know
-            // the declaration)
+  kDynamic,  // always require dynamic lookup (we don't know
+             // the declaration)
 
-  DYNAMIC_GLOBAL,  // requires dynamic lookup, but we know that the
+  kDynamicGlobal,  // requires dynamic lookup, but we know that the
                    // variable is global unless it has been shadowed
                    // by an eval-introduced variable
 
-  DYNAMIC_LOCAL  // requires dynamic lookup, but we know that the
+  kDynamicLocal  // requires dynamic lookup, but we know that the
                  // variable is local and where it is unless it
                  // has been shadowed by an eval-introduced
                  // variable
@@ -945,19 +1001,19 @@ enum VariableMode : uint8_t {
 #ifdef DEBUG
 inline const char* VariableMode2String(VariableMode mode) {
   switch (mode) {
-    case VAR:
+    case VariableMode::kVar:
       return "VAR";
-    case LET:
+    case VariableMode::kLet:
       return "LET";
-    case CONST:
+    case VariableMode::kConst:
       return "CONST";
-    case DYNAMIC:
+    case VariableMode::kDynamic:
       return "DYNAMIC";
-    case DYNAMIC_GLOBAL:
+    case VariableMode::kDynamicGlobal:
       return "DYNAMIC_GLOBAL";
-    case DYNAMIC_LOCAL:
+    case VariableMode::kDynamicLocal:
       return "DYNAMIC_LOCAL";
-    case TEMPORARY:
+    case VariableMode::kTemporary:
       return "TEMPORARY";
   }
   UNREACHABLE();
@@ -972,19 +1028,19 @@ enum VariableKind : uint8_t {
 };
 
 inline bool IsDynamicVariableMode(VariableMode mode) {
-  return mode >= DYNAMIC && mode <= DYNAMIC_LOCAL;
+  return mode >= VariableMode::kDynamic && mode <= VariableMode::kDynamicLocal;
 }
 
-
 inline bool IsDeclaredVariableMode(VariableMode mode) {
-  STATIC_ASSERT(LET == 0);  // Implies that mode >= LET.
-  return mode <= VAR;
+  STATIC_ASSERT(static_cast<uint8_t>(VariableMode::kLet) ==
+                0);  // Implies that mode >= VariableMode::kLet.
+  return mode <= VariableMode::kVar;
 }
 
-
 inline bool IsLexicalVariableMode(VariableMode mode) {
-  STATIC_ASSERT(LET == 0);  // Implies that mode >= LET.
-  return mode <= CONST;
+  STATIC_ASSERT(static_cast<uint8_t>(VariableMode::kLet) ==
+                0);  // Implies that mode >= VariableMode::kLet.
+  return mode <= VariableMode::kConst;
 }
 
 enum VariableLocation : uint8_t {
@@ -1225,8 +1281,7 @@ inline std::ostream& operator<<(std::ostream& os,
 inline uint32_t ObjectHash(Address address) {
   // All objects are at least pointer aligned, so we can remove the trailing
   // zeros.
-  return static_cast<uint32_t>(bit_cast<uintptr_t>(address) >>
-                               kPointerSizeLog2);
+  return static_cast<uint32_t>(address >> kPointerSizeLog2);
 }
 
 // Type feedback is encoded in such a way that, we can combine the feedback
@@ -1506,7 +1561,7 @@ V8_INLINE static HeapObject* RemoveWeakHeapObjectMask(
                                        ~kWeakHeapObjectMask);
 }
 
-V8_INLINE static HeapObjectReference* AddWeakHeapObjectMask(HeapObject* value) {
+V8_INLINE static HeapObjectReference* AddWeakHeapObjectMask(Object* value) {
   return reinterpret_cast<HeapObjectReference*>(
       reinterpret_cast<intptr_t>(value) | kWeakHeapObjectMask);
 }
@@ -1521,8 +1576,30 @@ enum class HeapObjectReferenceType {
   STRONG,
 };
 
-enum class PoisoningMitigationLevel { kOff, kOn };
-enum class LoadSensitivity { kSafe, kNeedsPoisoning };
+enum class PoisoningMitigationLevel {
+  kPoisonAll,
+  kDontPoison,
+  kPoisonCriticalOnly
+};
+
+enum class LoadSensitivity {
+  kCritical,  // Critical loads are poisoned whenever we can run untrusted
+              // code (i.e., when --untrusted-code-mitigations is on).
+  kUnsafe,    // Unsafe loads are poisoned when full poisoning is on
+              // (--branch-load-poisoning).
+  kSafe       // Safe loads are never poisoned.
+};
+
+// The reason for a WebAssembly trap.
+#define FOREACH_WASM_TRAPREASON(V) \
+  V(TrapUnreachable)               \
+  V(TrapMemOutOfBounds)            \
+  V(TrapDivByZero)                 \
+  V(TrapDivUnrepresentable)        \
+  V(TrapRemByZero)                 \
+  V(TrapFloatUnrepresentable)      \
+  V(TrapFuncInvalid)               \
+  V(TrapFuncSigMismatch)
 
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/src/handler-table.cc b/deps/v8/src/handler-table.cc
index 72e0e6caf8db2f..57cf4e26485770 100644
--- a/deps/v8/src/handler-table.cc
+++ b/deps/v8/src/handler-table.cc
@@ -25,7 +25,8 @@ HandlerTable::HandlerTable(ByteArray* byte_array)
 #ifdef DEBUG
       mode_(kRangeBasedEncoding),
 #endif
-      raw_encoded_data_(byte_array->GetDataStartAddress()) {
+      raw_encoded_data_(
+          reinterpret_cast<Address>(byte_array->GetDataStartAddress())) {
 }
 
 HandlerTable::HandlerTable(Address instruction_start,
diff --git a/deps/v8/src/handles-inl.h b/deps/v8/src/handles-inl.h
index df99f8652da701..536388476ba668 100644
--- a/deps/v8/src/handles-inl.h
+++ b/deps/v8/src/handles-inl.h
@@ -7,7 +7,9 @@
 
 #include "src/handles.h"
 #include "src/isolate.h"
+#include "src/msan.h"
 #include "src/objects-inl.h"
+#include "src/objects/maybe-object-inl.h"
 
 namespace v8 {
 namespace internal {
@@ -32,9 +34,6 @@ HandleScope::HandleScope(Isolate* isolate) {
   data->level++;
 }
 
-template <typename T>
-Handle<T>::Handle(T* object) : Handle(object, object->GetIsolate()) {}
-
 template <typename T>
 Handle<T>::Handle(T* object, Isolate* isolate) : HandleBase(object, isolate) {}
 
@@ -43,6 +42,65 @@ inline std::ostream& operator<<(std::ostream& os, Handle<T> handle) {
   return os << Brief(*handle);
 }
 
+MaybeObjectHandle::MaybeObjectHandle()
+    : reference_type_(HeapObjectReferenceType::STRONG),
+      handle_(Handle<Object>::null()) {}
+
+MaybeObjectHandle::MaybeObjectHandle(MaybeObject* object, Isolate* isolate) {
+  HeapObject* heap_object;
+  DCHECK(!object->IsClearedWeakHeapObject());
+  if (object->ToWeakHeapObject(&heap_object)) {
+    handle_ = handle(heap_object, isolate);
+    reference_type_ = HeapObjectReferenceType::WEAK;
+  } else {
+    handle_ = handle(object->ToObject(), isolate);
+    reference_type_ = HeapObjectReferenceType::STRONG;
+  }
+}
+
+MaybeObjectHandle::MaybeObjectHandle(Handle<Object> object)
+    : reference_type_(HeapObjectReferenceType::STRONG), handle_(object) {}
+
+MaybeObjectHandle::MaybeObjectHandle(Object* object, Isolate* isolate)
+    : reference_type_(HeapObjectReferenceType::STRONG),
+      handle_(object, isolate) {}
+
+MaybeObjectHandle::MaybeObjectHandle(Object* object,
+                                     HeapObjectReferenceType reference_type,
+                                     Isolate* isolate)
+    : reference_type_(reference_type), handle_(handle(object, isolate)) {}
+
+MaybeObjectHandle::MaybeObjectHandle(Handle<Object> object,
+                                     HeapObjectReferenceType reference_type)
+    : reference_type_(reference_type), handle_(object) {}
+
+MaybeObjectHandle MaybeObjectHandle::Weak(Handle<Object> object) {
+  return MaybeObjectHandle(object, HeapObjectReferenceType::WEAK);
+}
+
+MaybeObject* MaybeObjectHandle::operator*() const {
+  if (reference_type_ == HeapObjectReferenceType::WEAK) {
+    return HeapObjectReference::Weak(*handle_.ToHandleChecked());
+  } else {
+    return MaybeObject::FromObject(*handle_.ToHandleChecked());
+  }
+}
+
+MaybeObject* MaybeObjectHandle::operator->() const {
+  if (reference_type_ == HeapObjectReferenceType::WEAK) {
+    return HeapObjectReference::Weak(*handle_.ToHandleChecked());
+  } else {
+    return MaybeObject::FromObject(*handle_.ToHandleChecked());
+  }
+}
+
+Handle<Object> MaybeObjectHandle::object() const {
+  return handle_.ToHandleChecked();
+}
+
+inline MaybeObjectHandle handle(MaybeObject* object, Isolate* isolate) {
+  return MaybeObjectHandle(object, isolate);
+}
 
 HandleScope::~HandleScope() {
 #ifdef DEBUG
@@ -68,15 +126,17 @@ void HandleScope::CloseScope(Isolate* isolate,
 
   std::swap(current->next, prev_next);
   current->level--;
+  Object** limit = prev_next;
   if (current->limit != prev_limit) {
     current->limit = prev_limit;
+    limit = prev_limit;
     DeleteExtensions(isolate);
+  }
 #ifdef ENABLE_HANDLE_ZAPPING
-    ZapRange(current->next, prev_limit);
-  } else {
-    ZapRange(current->next, prev_next);
+  ZapRange(current->next, limit);
 #endif
-  }
+  MSAN_ALLOCATED_UNINITIALIZED_MEMORY(
+      current->next, static_cast<size_t>(limit - current->next));
 }
 
 
diff --git a/deps/v8/src/handles.cc b/deps/v8/src/handles.cc
index cfa65d11b818b7..cc79ee17ffce5b 100644
--- a/deps/v8/src/handles.cc
+++ b/deps/v8/src/handles.cc
@@ -107,7 +107,7 @@ void HandleScope::DeleteExtensions(Isolate* isolate) {
 void HandleScope::ZapRange(Object** start, Object** end) {
   DCHECK_LE(end - start, kHandleBlockSize);
   for (Object** p = start; p != end; p++) {
-    *reinterpret_cast<Address*>(p) = reinterpret_cast<Address>(kHandleZapValue);
+    *reinterpret_cast<Address*>(p) = static_cast<Address>(kHandleZapValue);
   }
 }
 #endif
@@ -176,7 +176,8 @@ DeferredHandleScope::DeferredHandleScope(Isolate* isolate)
   HandleScopeData* data = impl_->isolate()->handle_scope_data();
   Object** new_next = impl_->GetSpareOrNewBlock();
   Object** new_limit = &new_next[kHandleBlockSize];
-  // Check that at least one HandleScope exists, see the class description.
+  // Check that at least one HandleScope with at least one Handle in it exists,
+  // see the class description.
   DCHECK(!impl_->blocks()->empty());
   // Check that we are not in a SealedHandleScope.
   DCHECK(data->limit == &impl_->blocks()->back()[kHandleBlockSize]);
diff --git a/deps/v8/src/handles.h b/deps/v8/src/handles.h
index 1d7a79533bc754..714139869fc108 100644
--- a/deps/v8/src/handles.h
+++ b/deps/v8/src/handles.h
@@ -97,7 +97,6 @@ class Handle final : public HandleBase {
                   "static type violation");
   }
 
-  V8_INLINE explicit Handle(T* object);
   V8_INLINE Handle(T* object, Isolate* isolate);
 
   // Allocate a new handle for the object, do not canonicalize.
@@ -144,7 +143,7 @@ class Handle final : public HandleBase {
   // Provide function object for location hashing.
   struct hash : public std::unary_function<Handle<T>, size_t> {
     V8_INLINE size_t operator()(Handle<T> const& handle) const {
-      return base::hash<void*>()(handle.address());
+      return base::hash<Address>()(handle.address());
     }
   };
 
@@ -165,11 +164,6 @@ V8_INLINE Handle<T> handle(T* object, Isolate* isolate) {
   return Handle<T>(object, isolate);
 }
 
-template <typename T>
-V8_INLINE Handle<T> handle(T* object) {
-  return Handle<T>(object);
-}
-
 // ----------------------------------------------------------------------------
 // A Handle can be converted into a MaybeHandle. Converting a MaybeHandle
 // into a Handle requires checking that it does not point to nullptr.  This
@@ -235,6 +229,43 @@ class MaybeHandle final {
   friend class MaybeHandle;
 };
 
+// A handle which contains a potentially weak pointer. Keeps it alive (strongly)
+// while the MaybeObjectHandle is alive.
+class MaybeObjectHandle {
+ public:
+  inline MaybeObjectHandle();
+  inline MaybeObjectHandle(MaybeObject* object, Isolate* isolate);
+  inline MaybeObjectHandle(Object* object, Isolate* isolate);
+  inline explicit MaybeObjectHandle(Handle<Object> object);
+
+  static inline MaybeObjectHandle Weak(Object* object, Isolate* isolate);
+  static inline MaybeObjectHandle Weak(Handle<Object> object);
+
+  inline MaybeObject* operator*() const;
+  inline MaybeObject* operator->() const;
+  inline Handle<Object> object() const;
+
+  bool is_identical_to(const MaybeObjectHandle& other) const {
+    Handle<Object> this_handle;
+    Handle<Object> other_handle;
+    return reference_type_ == other.reference_type_ &&
+           handle_.ToHandle(&this_handle) ==
+               other.handle_.ToHandle(&other_handle) &&
+           this_handle.is_identical_to(other_handle);
+  }
+
+  bool is_null() const { return handle_.is_null(); }
+
+ private:
+  inline MaybeObjectHandle(Object* object,
+                           HeapObjectReferenceType reference_type,
+                           Isolate* isolate);
+  inline MaybeObjectHandle(Handle<Object> object,
+                           HeapObjectReferenceType reference_type);
+
+  HeapObjectReferenceType reference_type_;
+  MaybeHandle<Object> handle_;
+};
 
 // ----------------------------------------------------------------------------
 // A stack-allocated class that governs a number of local handles.
diff --git a/deps/v8/src/heap-symbols.h b/deps/v8/src/heap-symbols.h
index c15aa9ba1380db..32ff8e3fd833e3 100644
--- a/deps/v8/src/heap-symbols.h
+++ b/deps/v8/src/heap-symbols.h
@@ -7,6 +7,7 @@
 
 #define INTERNALIZED_STRING_LIST(V)                                \
   V(add_string, "add")                                             \
+  V(always_string, "always")                                       \
   V(anonymous_function_string, "(anonymous function)")             \
   V(anonymous_string, "anonymous")                                 \
   V(apply_string, "apply")                                         \
@@ -19,6 +20,7 @@
   V(ArrayIterator_string, "Array Iterator")                        \
   V(assign_string, "assign")                                       \
   V(async_string, "async")                                         \
+  V(auto_string, "auto")                                           \
   V(await_string, "await")                                         \
   V(BigInt_string, "BigInt")                                       \
   V(bigint_string, "bigint")                                       \
@@ -115,6 +117,8 @@
   V(line_string, "line")                                           \
   V(LinkError_string, "LinkError")                                 \
   V(literal_string, "literal")                                     \
+  V(locale_string, "locale")                                       \
+  V(long_string, "long")                                           \
   V(Map_string, "Map")                                             \
   V(MapIterator_string, "Map Iterator")                            \
   V(message_string, "message")                                     \
@@ -128,6 +132,7 @@
   V(name_string, "name")                                           \
   V(NaN_string, "NaN")                                             \
   V(nan_string, "nan")                                             \
+  V(narrow_string, "narrow")                                       \
   V(native_string, "native")                                       \
   V(new_target_string, ".new.target")                              \
   V(next_string, "next")                                           \
@@ -141,6 +146,7 @@
   V(Number_string, "Number")                                       \
   V(number_string, "number")                                       \
   V(number_to_string, "[object Number]")                           \
+  V(numeric_string, "numeric")                                     \
   V(Object_string, "Object")                                       \
   V(object_string, "object")                                       \
   V(object_to_string, "[object Object]")                           \
@@ -172,6 +178,8 @@
   V(RuntimeError_string, "RuntimeError")                           \
   V(Script_string, "Script")                                       \
   V(script_string, "script")                                       \
+  V(short_string, "short")                                         \
+  V(style_string, "style")                                         \
   V(second_string, "second")                                       \
   V(set_space_string, "set ")                                      \
   V(Set_string, "Set")                                             \
@@ -210,6 +218,7 @@
   V(undefined_string, "undefined")                                 \
   V(undefined_to_string, "[object Undefined]")                     \
   V(unicode_string, "unicode")                                     \
+  V(unit_string, "unit")                                           \
   V(URIError_string, "URIError")                                   \
   V(use_asm_string, "use asm")                                     \
   V(use_strict_string, "use strict")                               \
@@ -256,8 +265,6 @@
   V(sealed_symbol)                     \
   V(stack_trace_symbol)                \
   V(strict_function_transition_symbol) \
-  V(wasm_function_index_symbol)        \
-  V(wasm_instance_symbol)              \
   V(uninitialized_symbol)
 
 #define PUBLIC_SYMBOL_LIST(V)                    \
@@ -294,6 +301,15 @@
   F(MC_INCREMENTAL_EXTERNAL_EPILOGUE)                              \
   F(MC_INCREMENTAL_EXTERNAL_PROLOGUE)
 
+#define TOP_MC_SCOPES(F) \
+  F(MC_CLEAR)            \
+  F(MC_EPILOGUE)         \
+  F(MC_EVACUATE)         \
+  F(MC_FINISH)           \
+  F(MC_MARK)             \
+  F(MC_PROLOGUE)         \
+  F(MC_SWEEP)
+
 #define TRACER_SCOPES(F)                             \
   INCREMENTAL_SCOPES(F)                              \
   F(HEAP_EPILOGUE)                                   \
@@ -302,7 +318,7 @@
   F(HEAP_EXTERNAL_PROLOGUE)                          \
   F(HEAP_EXTERNAL_WEAK_GLOBAL_HANDLES)               \
   F(HEAP_PROLOGUE)                                   \
-  F(MC_CLEAR)                                        \
+  TOP_MC_SCOPES(F)                                   \
   F(MC_CLEAR_DEPENDENT_CODE)                         \
   F(MC_CLEAR_MAPS)                                   \
   F(MC_CLEAR_SLOTS_BUFFER)                           \
@@ -312,8 +328,6 @@
   F(MC_CLEAR_WEAK_COLLECTIONS)                       \
   F(MC_CLEAR_WEAK_LISTS)                             \
   F(MC_CLEAR_WEAK_REFERENCES)                        \
-  F(MC_EPILOGUE)                                     \
-  F(MC_EVACUATE)                                     \
   F(MC_EVACUATE_CANDIDATES)                          \
   F(MC_EVACUATE_CLEAN_UP)                            \
   F(MC_EVACUATE_COPY)                                \
@@ -325,21 +339,19 @@
   F(MC_EVACUATE_UPDATE_POINTERS_SLOTS_MAP_SPACE)     \
   F(MC_EVACUATE_UPDATE_POINTERS_TO_NEW_ROOTS)        \
   F(MC_EVACUATE_UPDATE_POINTERS_WEAK)                \
-  F(MC_FINISH)                                       \
-  F(MC_MARK)                                         \
   F(MC_MARK_FINISH_INCREMENTAL)                      \
   F(MC_MARK_MAIN)                                    \
   F(MC_MARK_ROOTS)                                   \
   F(MC_MARK_WEAK_CLOSURE)                            \
-  F(MC_MARK_WEAK_CLOSURE_EPHEMERAL)                  \
+  F(MC_MARK_WEAK_CLOSURE_EPHEMERON)                  \
+  F(MC_MARK_WEAK_CLOSURE_EPHEMERON_MARKING)          \
+  F(MC_MARK_WEAK_CLOSURE_EPHEMERON_LINEAR)           \
   F(MC_MARK_WEAK_CLOSURE_WEAK_HANDLES)               \
   F(MC_MARK_WEAK_CLOSURE_WEAK_ROOTS)                 \
   F(MC_MARK_WEAK_CLOSURE_HARMONY)                    \
   F(MC_MARK_WRAPPER_EPILOGUE)                        \
   F(MC_MARK_WRAPPER_PROLOGUE)                        \
   F(MC_MARK_WRAPPER_TRACING)                         \
-  F(MC_PROLOGUE)                                     \
-  F(MC_SWEEP)                                        \
   F(MC_SWEEP_CODE)                                   \
   F(MC_SWEEP_MAP)                                    \
   F(MC_SWEEP_OLD)                                    \
@@ -372,6 +384,7 @@
   F(SCAVENGER_SCAVENGE_WEAK_GLOBAL_HANDLES_PROCESS)  \
   F(SCAVENGER_SCAVENGE_PARALLEL)                     \
   F(SCAVENGER_SCAVENGE_ROOTS)                        \
+  F(SCAVENGER_SCAVENGE_UPDATE_REFS)                  \
   F(SCAVENGER_SCAVENGE_WEAK)
 
 #define TRACER_BACKGROUND_SCOPES(F)               \
diff --git a/deps/v8/src/heap/array-buffer-collector.cc b/deps/v8/src/heap/array-buffer-collector.cc
index 412e4ad05ae8fd..bce22c39baf681 100644
--- a/deps/v8/src/heap/array-buffer-collector.cc
+++ b/deps/v8/src/heap/array-buffer-collector.cc
@@ -12,18 +12,18 @@ namespace v8 {
 namespace internal {
 
 void ArrayBufferCollector::AddGarbageAllocations(
-    std::vector<JSArrayBuffer::Allocation>* allocations) {
+    std::vector<JSArrayBuffer::Allocation> allocations) {
   base::LockGuard<base::Mutex> guard(&allocations_mutex_);
-  allocations_.push_back(allocations);
+  allocations_.push_back(std::move(allocations));
 }
 
 void ArrayBufferCollector::FreeAllocations() {
   base::LockGuard<base::Mutex> guard(&allocations_mutex_);
-  for (std::vector<JSArrayBuffer::Allocation>* allocations : allocations_) {
-    for (auto alloc : *allocations) {
+  for (const std::vector<JSArrayBuffer::Allocation>& allocations :
+       allocations_) {
+    for (JSArrayBuffer::Allocation alloc : allocations) {
       JSArrayBuffer::FreeBackingStore(heap_->isolate(), alloc);
     }
-    delete allocations;
   }
   allocations_.clear();
 }
@@ -47,6 +47,7 @@ class ArrayBufferCollector::FreeingTask final : public CancelableTask {
 };
 
 void ArrayBufferCollector::FreeAllocationsOnBackgroundThread() {
+  // TODO(wez): Remove backing-store from external memory accounting.
   heap_->account_external_memory_concurrently_freed();
   if (!heap_->IsTearingDown() && FLAG_concurrent_array_buffer_freeing) {
     V8::GetCurrentPlatform()->CallOnWorkerThread(
diff --git a/deps/v8/src/heap/array-buffer-collector.h b/deps/v8/src/heap/array-buffer-collector.h
index 002eba9a430e8c..b44af2f2ad8e55 100644
--- a/deps/v8/src/heap/array-buffer-collector.h
+++ b/deps/v8/src/heap/array-buffer-collector.h
@@ -28,7 +28,7 @@ class ArrayBufferCollector {
   // These allocations will begin to be freed once FreeAllocations() is called,
   // or on TearDown.
   void AddGarbageAllocations(
-      std::vector<JSArrayBuffer::Allocation>* allocations);
+      std::vector<JSArrayBuffer::Allocation> allocations);
 
   // Calls FreeAllocations() on a background thread.
   void FreeAllocationsOnBackgroundThread();
@@ -42,7 +42,7 @@ class ArrayBufferCollector {
 
   Heap* heap_;
   base::Mutex allocations_mutex_;
-  std::vector<std::vector<JSArrayBuffer::Allocation>*> allocations_;
+  std::vector<std::vector<JSArrayBuffer::Allocation>> allocations_;
 };
 
 }  // namespace internal
diff --git a/deps/v8/src/heap/array-buffer-tracker-inl.h b/deps/v8/src/heap/array-buffer-tracker-inl.h
index 8ed4a66664bc12..7bfdca351f6ea0 100644
--- a/deps/v8/src/heap/array-buffer-tracker-inl.h
+++ b/deps/v8/src/heap/array-buffer-tracker-inl.h
@@ -8,6 +8,7 @@
 #include "src/conversions-inl.h"
 #include "src/heap/array-buffer-tracker.h"
 #include "src/heap/heap.h"
+#include "src/heap/spaces.h"
 #include "src/objects.h"
 
 namespace v8 {
@@ -28,6 +29,8 @@ void ArrayBufferTracker::RegisterNew(Heap* heap, JSArrayBuffer* buffer) {
     DCHECK_NOT_NULL(tracker);
     tracker->Add(buffer, length);
   }
+
+  // TODO(wez): Remove backing-store from external memory accounting.
   // We may go over the limit of externally allocated memory here. We call the
   // api function to trigger a GC in this case.
   reinterpret_cast<v8::Isolate*>(heap->isolate())
@@ -45,33 +48,40 @@ void ArrayBufferTracker::Unregister(Heap* heap, JSArrayBuffer* buffer) {
     DCHECK_NOT_NULL(tracker);
     tracker->Remove(buffer, length);
   }
+
+  // TODO(wez): Remove backing-store from external memory accounting.
   heap->update_external_memory(-static_cast<intptr_t>(length));
 }
 
+Space* LocalArrayBufferTracker::space() { return page_->owner(); }
+
 template <typename Callback>
 void LocalArrayBufferTracker::Free(Callback should_free) {
-  size_t new_retained_size = 0;
-  Isolate* isolate = heap_->isolate();
+  size_t freed_memory = 0;
+  Isolate* isolate = page_->heap()->isolate();
   for (TrackingData::iterator it = array_buffers_.begin();
        it != array_buffers_.end();) {
     JSArrayBuffer* buffer = reinterpret_cast<JSArrayBuffer*>(it->first);
-    const size_t length = it->second;
+    const size_t length = it->second.length;
+
     if (should_free(buffer)) {
       JSArrayBuffer::FreeBackingStore(
-          isolate, {buffer->backing_store(), length, buffer->backing_store(),
-                    buffer->allocation_mode(), buffer->is_wasm_memory()});
+          isolate, {it->second.backing_store, length, it->second.backing_store,
+                    buffer->is_wasm_memory()});
       it = array_buffers_.erase(it);
+      freed_memory += length;
     } else {
-      new_retained_size += length;
       ++it;
     }
   }
-  const size_t freed_memory = retained_size_ - new_retained_size;
   if (freed_memory > 0) {
-    heap_->update_external_memory_concurrently_freed(
+    page_->DecrementExternalBackingStoreBytes(
+        ExternalBackingStoreType::kArrayBuffer, freed_memory);
+
+    // TODO(wez): Remove backing-store from external memory accounting.
+    page_->heap()->update_external_memory_concurrently_freed(
         static_cast<intptr_t>(freed_memory));
   }
-  retained_size_ = new_retained_size;
 }
 
 template <typename MarkingState>
@@ -88,9 +98,10 @@ void ArrayBufferTracker::FreeDead(Page* page, MarkingState* marking_state) {
 }
 
 void LocalArrayBufferTracker::Add(JSArrayBuffer* buffer, size_t length) {
-  DCHECK_GE(retained_size_ + length, retained_size_);
-  retained_size_ += length;
-  auto ret = array_buffers_.insert({buffer, length});
+  page_->IncrementExternalBackingStoreBytes(
+      ExternalBackingStoreType::kArrayBuffer, length);
+
+  auto ret = array_buffers_.insert({buffer, {buffer->backing_store(), length}});
   USE(ret);
   // Check that we indeed inserted a new value and did not overwrite an existing
   // one (which would be a bug).
@@ -98,12 +109,13 @@ void LocalArrayBufferTracker::Add(JSArrayBuffer* buffer, size_t length) {
 }
 
 void LocalArrayBufferTracker::Remove(JSArrayBuffer* buffer, size_t length) {
-  DCHECK_GE(retained_size_, retained_size_ - length);
-  retained_size_ -= length;
+  page_->DecrementExternalBackingStoreBytes(
+      ExternalBackingStoreType::kArrayBuffer, length);
+
   TrackingData::iterator it = array_buffers_.find(buffer);
   // Check that we indeed find a key to remove.
   DCHECK(it != array_buffers_.end());
-  DCHECK_EQ(length, it->second);
+  DCHECK_EQ(length, it->second.length);
   array_buffers_.erase(it);
 }
 
diff --git a/deps/v8/src/heap/array-buffer-tracker.cc b/deps/v8/src/heap/array-buffer-tracker.cc
index 589756fdc37e3f..f2dc085b92d67b 100644
--- a/deps/v8/src/heap/array-buffer-tracker.cc
+++ b/deps/v8/src/heap/array-buffer-tracker.cc
@@ -20,20 +20,20 @@ LocalArrayBufferTracker::~LocalArrayBufferTracker() {
 
 template <typename Callback>
 void LocalArrayBufferTracker::Process(Callback callback) {
-  std::vector<JSArrayBuffer::Allocation>* backing_stores_to_free =
-      new std::vector<JSArrayBuffer::Allocation>();
+  std::vector<JSArrayBuffer::Allocation> backing_stores_to_free;
+  TrackingData kept_array_buffers;
 
   JSArrayBuffer* new_buffer = nullptr;
   JSArrayBuffer* old_buffer = nullptr;
-  size_t new_retained_size = 0;
-  size_t moved_size = 0;
+  size_t freed_memory = 0;
+  size_t moved_memory = 0;
   for (TrackingData::iterator it = array_buffers_.begin();
-       it != array_buffers_.end();) {
+       it != array_buffers_.end(); ++it) {
     old_buffer = reinterpret_cast<JSArrayBuffer*>(it->first);
+    Page* old_page = Page::FromAddress(old_buffer->address());
     const CallbackResult result = callback(old_buffer, &new_buffer);
     if (result == kKeepEntry) {
-      new_retained_size += NumberToSize(old_buffer->byte_length());
-      ++it;
+      kept_array_buffers.insert(*it);
     } else if (result == kUpdateEntry) {
       DCHECK_NOT_NULL(new_buffer);
       Page* target_page = Page::FromAddress(new_buffer->address());
@@ -46,56 +46,52 @@ void LocalArrayBufferTracker::Process(Callback callback) {
         }
         DCHECK_NOT_NULL(tracker);
         const size_t size = NumberToSize(new_buffer->byte_length());
-        moved_size += size;
+        // We should decrement before adding to avoid potential overflows in
+        // the external memory counters.
+        old_page->DecrementExternalBackingStoreBytes(
+            ExternalBackingStoreType::kArrayBuffer, it->second.length);
         tracker->Add(new_buffer, size);
       }
-      it = array_buffers_.erase(it);
+      moved_memory += it->second.length;
+
     } else if (result == kRemoveEntry) {
+      freed_memory += it->second.length;
       // We pass backing_store() and stored length to the collector for freeing
       // the backing store. Wasm allocations will go through their own tracker
       // based on the backing store.
-      backing_stores_to_free->emplace_back(
-          old_buffer->backing_store(), it->second, old_buffer->backing_store(),
-          old_buffer->allocation_mode(), old_buffer->is_wasm_memory());
-      it = array_buffers_.erase(it);
+      backing_stores_to_free.emplace_back(
+          it->second.backing_store, it->second.length, it->second.backing_store,
+          old_buffer->is_wasm_memory());
+      old_page->DecrementExternalBackingStoreBytes(
+          ExternalBackingStoreType::kArrayBuffer, it->second.length);
+
     } else {
       UNREACHABLE();
     }
   }
-  const size_t freed_memory = retained_size_ - new_retained_size - moved_size;
-  if (freed_memory > 0) {
-    heap_->update_external_memory_concurrently_freed(
+  if (moved_memory || freed_memory) {
+    // TODO(wez): Remove backing-store from external memory accounting.
+    page_->heap()->update_external_memory_concurrently_freed(
         static_cast<intptr_t>(freed_memory));
   }
-  retained_size_ = new_retained_size;
+
+  array_buffers_.swap(kept_array_buffers);
 
   // Pass the backing stores that need to be freed to the main thread for later
   // distribution.
-  // ArrayBufferCollector takes ownership of this pointer.
-  heap_->array_buffer_collector()->AddGarbageAllocations(
-      backing_stores_to_free);
+  page_->heap()->array_buffer_collector()->AddGarbageAllocations(
+      std::move(backing_stores_to_free));
 }
 
 void ArrayBufferTracker::PrepareToFreeDeadInNewSpace(Heap* heap) {
   DCHECK_EQ(heap->gc_state(), Heap::HeapState::SCAVENGE);
-  for (Page* page : PageRange(heap->new_space()->FromSpaceStart(),
-                              heap->new_space()->FromSpaceEnd())) {
+  for (Page* page :
+       PageRange(heap->new_space()->from_space().first_page(), nullptr)) {
     bool empty = ProcessBuffers(page, kUpdateForwardedRemoveOthers);
     CHECK(empty);
   }
 }
 
-size_t ArrayBufferTracker::RetainedInNewSpace(Heap* heap) {
-  size_t retained_size = 0;
-  for (Page* page : PageRange(heap->new_space()->ToSpaceStart(),
-                              heap->new_space()->ToSpaceEnd())) {
-    LocalArrayBufferTracker* tracker = page->local_tracker();
-    if (tracker == nullptr) continue;
-    retained_size += tracker->retained_size();
-  }
-  return retained_size;
-}
-
 void ArrayBufferTracker::FreeAll(Page* page) {
   LocalArrayBufferTracker* tracker = page->local_tracker();
   if (tracker == nullptr) return;
diff --git a/deps/v8/src/heap/array-buffer-tracker.h b/deps/v8/src/heap/array-buffer-tracker.h
index c9c1a5b645ee40..40de8d962b153d 100644
--- a/deps/v8/src/heap/array-buffer-tracker.h
+++ b/deps/v8/src/heap/array-buffer-tracker.h
@@ -14,10 +14,10 @@
 namespace v8 {
 namespace internal {
 
-class Heap;
 class JSArrayBuffer;
 class MarkingState;
 class Page;
+class Space;
 
 class ArrayBufferTracker : public AllStatic {
  public:
@@ -38,9 +38,6 @@ class ArrayBufferTracker : public AllStatic {
   // Does not take any locks and can only be called during Scavenge.
   static void PrepareToFreeDeadInNewSpace(Heap* heap);
 
-  // Number of array buffer bytes retained from new space.
-  static size_t RetainedInNewSpace(Heap* heap);
-
   // Frees all backing store pointers for dead JSArrayBuffer on a given page.
   // Requires marking information to be present. Requires the page lock to be
   // taken by the caller.
@@ -70,8 +67,7 @@ class LocalArrayBufferTracker {
   enum CallbackResult { kKeepEntry, kUpdateEntry, kRemoveEntry };
   enum FreeMode { kFreeDead, kFreeAll };
 
-  explicit LocalArrayBufferTracker(Heap* heap)
-      : heap_(heap), retained_size_(0) {}
+  explicit LocalArrayBufferTracker(Page* page) : page_(page) {}
   ~LocalArrayBufferTracker();
 
   inline void Add(JSArrayBuffer* buffer, size_t length);
@@ -101,8 +97,6 @@ class LocalArrayBufferTracker {
     return array_buffers_.find(buffer) != array_buffers_.end();
   }
 
-  size_t retained_size() const { return retained_size_; }
-
  private:
   class Hasher {
    public:
@@ -111,19 +105,25 @@ class LocalArrayBufferTracker {
     }
   };
 
+  struct BackingStoreAndLength {
+    void* backing_store;
+    size_t length;
+  };
+
   // Keep track of the backing store and the corresponding length at time of
   // registering. The length is accessed from JavaScript and can be a
   // HeapNumber. The reason for tracking the length is that in the case of
   // length being a HeapNumber, the buffer and its length may be stored on
   // different memory pages, making it impossible to guarantee order of freeing.
-  typedef std::unordered_map<JSArrayBuffer*, size_t, Hasher> TrackingData;
+  typedef std::unordered_map<JSArrayBuffer*, BackingStoreAndLength, Hasher>
+      TrackingData;
+
+  inline Space* space();
 
-  Heap* heap_;
+  Page* page_;
   // The set contains raw heap pointers which are removed by the GC upon
   // processing the tracker through its owning page.
   TrackingData array_buffers_;
-  // Retained size of array buffers for this tracker in bytes.
-  size_t retained_size_;
 };
 
 }  // namespace internal
diff --git a/deps/v8/src/heap/code-stats.cc b/deps/v8/src/heap/code-stats.cc
index f2c1985296cbcc..1753e29afd6e99 100644
--- a/deps/v8/src/heap/code-stats.cc
+++ b/deps/v8/src/heap/code-stats.cc
@@ -11,32 +11,41 @@ namespace internal {
 // Record code statisitcs.
 void CodeStatistics::RecordCodeAndMetadataStatistics(HeapObject* object,
                                                      Isolate* isolate) {
-  if (!object->IsAbstractCode()) {
-    return;
-  }
-
-  // Record code+metadata statisitcs.
-  AbstractCode* abstract_code = AbstractCode::cast(object);
-  int size = abstract_code->SizeIncludingMetadata();
-  if (abstract_code->IsCode()) {
-    size += isolate->code_and_metadata_size();
-    isolate->set_code_and_metadata_size(size);
-  } else {
-    size += isolate->bytecode_and_metadata_size();
-    isolate->set_bytecode_and_metadata_size(size);
-  }
+  if (object->IsScript()) {
+    Script* script = Script::cast(object);
+    // Log the size of external source code.
+    Object* source = script->source();
+    if (source->IsExternalString()) {
+      ExternalString* external_source_string = ExternalString::cast(source);
+      int size = isolate->external_script_source_size();
+      size += external_source_string->ExternalPayloadSize();
+      isolate->set_external_script_source_size(size);
+    }
+  } else if (object->IsAbstractCode()) {
+    // Record code+metadata statisitcs.
+    AbstractCode* abstract_code = AbstractCode::cast(object);
+    int size = abstract_code->SizeIncludingMetadata();
+    if (abstract_code->IsCode()) {
+      size += isolate->code_and_metadata_size();
+      isolate->set_code_and_metadata_size(size);
+    } else {
+      size += isolate->bytecode_and_metadata_size();
+      isolate->set_bytecode_and_metadata_size(size);
+    }
 
 #ifdef DEBUG
-  // Record code kind and code comment statistics.
-  isolate->code_kind_statistics()[abstract_code->kind()] +=
-      abstract_code->Size();
-  CodeStatistics::CollectCodeCommentStatistics(object, isolate);
+    // Record code kind and code comment statistics.
+    isolate->code_kind_statistics()[abstract_code->kind()] +=
+        abstract_code->Size();
+    CodeStatistics::CollectCodeCommentStatistics(object, isolate);
 #endif
+  }
 }
 
 void CodeStatistics::ResetCodeAndMetadataStatistics(Isolate* isolate) {
   isolate->set_code_and_metadata_size(0);
   isolate->set_bytecode_and_metadata_size(0);
+  isolate->set_external_script_source_size(0);
 #ifdef DEBUG
   ResetCodeStatistics(isolate);
 #endif
@@ -165,7 +174,7 @@ void CodeStatistics::CollectCommentStatistics(Isolate* isolate,
   // Search for end of nested comment or a new nested comment
   const char* const comment_txt =
       reinterpret_cast<const char*>(it->rinfo()->data());
-  const byte* prev_pc = it->rinfo()->pc();
+  Address prev_pc = it->rinfo()->pc();
   int flat_delta = 0;
   it->next();
   while (true) {
@@ -199,7 +208,7 @@ void CodeStatistics::CollectCodeCommentStatistics(HeapObject* obj,
   Code* code = Code::cast(obj);
   RelocIterator it(code);
   int delta = 0;
-  const byte* prev_pc = code->raw_instruction_start();
+  Address prev_pc = code->raw_instruction_start();
   while (!it.done()) {
     if (it.rinfo()->rmode() == RelocInfo::COMMENT) {
       delta += static_cast<int>(it.rinfo()->pc() - prev_pc);
diff --git a/deps/v8/src/heap/concurrent-marking.cc b/deps/v8/src/heap/concurrent-marking.cc
index ca2afb8cdfb29b..3a1f5456fa5fd8 100644
--- a/deps/v8/src/heap/concurrent-marking.cc
+++ b/deps/v8/src/heap/concurrent-marking.cc
@@ -19,6 +19,7 @@
 #include "src/heap/objects-visiting.h"
 #include "src/heap/worklist.h"
 #include "src/isolate.h"
+#include "src/objects/hash-table-inl.h"
 #include "src/utils-inl.h"
 #include "src/utils.h"
 #include "src/v8.h"
@@ -156,8 +157,9 @@ class ConcurrentMarkingVisitor final
       Object* object = snapshot.value(i);
       DCHECK(!HasWeakHeapObjectTag(object));
       if (!object->IsHeapObject()) continue;
-      MarkObject(HeapObject::cast(object));
-      MarkCompactCollector::RecordSlot(host, slot, object);
+      HeapObject* heap_object = HeapObject::cast(object);
+      MarkObject(heap_object);
+      MarkCompactCollector::RecordSlot(host, slot, heap_object);
     }
   }
 
@@ -352,9 +354,59 @@ class ConcurrentMarkingVisitor final
   }
 
   int VisitJSWeakCollection(Map* map, JSWeakCollection* object) {
-    // TODO(ulan): implement iteration of strong fields.
-    bailout_.Push(object);
-    return 0;
+    return VisitJSObjectSubclass(map, object);
+  }
+
+  int VisitEphemeronHashTable(Map* map, EphemeronHashTable* table) {
+    if (!ShouldVisit(table)) return 0;
+    weak_objects_->ephemeron_hash_tables.Push(task_id_, table);
+
+    for (int i = 0; i < table->Capacity(); i++) {
+      Object** key_slot =
+          table->RawFieldOfElementAt(EphemeronHashTable::EntryToIndex(i));
+      HeapObject* key = HeapObject::cast(table->KeyAt(i));
+      MarkCompactCollector::RecordSlot(table, key_slot, key);
+
+      Object** value_slot =
+          table->RawFieldOfElementAt(EphemeronHashTable::EntryToValueIndex(i));
+
+      if (marking_state_.IsBlackOrGrey(key)) {
+        VisitPointer(table, value_slot);
+
+      } else {
+        Object* value_obj = table->ValueAt(i);
+
+        if (value_obj->IsHeapObject()) {
+          HeapObject* value = HeapObject::cast(value_obj);
+          MarkCompactCollector::RecordSlot(table, value_slot, value);
+
+          // Revisit ephemerons with both key and value unreachable at end
+          // of concurrent marking cycle.
+          if (marking_state_.IsWhite(value)) {
+            weak_objects_->discovered_ephemerons.Push(task_id_,
+                                                      Ephemeron{key, value});
+          }
+        }
+      }
+    }
+
+    return table->SizeFromMap(map);
+  }
+
+  // Implements ephemeron semantics: Marks value if key is already reachable.
+  // Returns true if value was actually marked.
+  bool VisitEphemeron(HeapObject* key, HeapObject* value) {
+    if (marking_state_.IsBlackOrGrey(key)) {
+      if (marking_state_.WhiteToGrey(value)) {
+        shared_.Push(value);
+        return true;
+      }
+
+    } else if (marking_state_.IsWhite(value)) {
+      weak_objects_->next_ephemerons.Push(task_id_, Ephemeron{key, value});
+    }
+
+    return false;
   }
 
   void MarkObject(HeapObject* object) {
@@ -535,9 +587,21 @@ void ConcurrentMarking::Run(int task_id, TaskState* task_state) {
     heap_->isolate()->PrintWithTimestamp(
         "Starting concurrent marking task %d\n", task_id);
   }
+  bool ephemeron_marked = false;
+
   {
     TimedScope scope(&time_ms);
 
+    {
+      Ephemeron ephemeron;
+
+      while (weak_objects_->current_ephemerons.Pop(task_id, &ephemeron)) {
+        if (visitor.VisitEphemeron(ephemeron.key, ephemeron.value)) {
+          ephemeron_marked = true;
+        }
+      }
+    }
+
     bool done = false;
     while (!done) {
       size_t current_marked_bytes = 0;
@@ -569,15 +633,35 @@ void ConcurrentMarking::Run(int task_id, TaskState* task_state) {
         break;
       }
     }
+
+    if (done) {
+      Ephemeron ephemeron;
+
+      while (weak_objects_->discovered_ephemerons.Pop(task_id, &ephemeron)) {
+        if (visitor.VisitEphemeron(ephemeron.key, ephemeron.value)) {
+          ephemeron_marked = true;
+        }
+      }
+    }
+
     shared_->FlushToGlobal(task_id);
     bailout_->FlushToGlobal(task_id);
     on_hold_->FlushToGlobal(task_id);
 
     weak_objects_->weak_cells.FlushToGlobal(task_id);
     weak_objects_->transition_arrays.FlushToGlobal(task_id);
+    weak_objects_->ephemeron_hash_tables.FlushToGlobal(task_id);
+    weak_objects_->current_ephemerons.FlushToGlobal(task_id);
+    weak_objects_->next_ephemerons.FlushToGlobal(task_id);
+    weak_objects_->discovered_ephemerons.FlushToGlobal(task_id);
     weak_objects_->weak_references.FlushToGlobal(task_id);
     base::AsAtomicWord::Relaxed_Store<size_t>(&task_state->marked_bytes, 0);
-    total_marked_bytes_.Increment(marked_bytes);
+    total_marked_bytes_ += marked_bytes;
+
+    if (ephemeron_marked) {
+      set_ephemeron_marked(true);
+    }
+
     {
       base::LockGuard<base::Mutex> guard(&pending_lock_);
       is_pending_[task_id] = false;
@@ -637,7 +721,9 @@ void ConcurrentMarking::RescheduleTasksIfNeeded() {
     base::LockGuard<base::Mutex> guard(&pending_lock_);
     if (pending_task_count_ > 0) return;
   }
-  if (!shared_->IsGlobalPoolEmpty()) {
+  if (!shared_->IsGlobalPoolEmpty() ||
+      !weak_objects_->current_ephemerons.IsEmpty() ||
+      !weak_objects_->discovered_ephemerons.IsEmpty()) {
     ScheduleTasks();
   }
 }
@@ -672,6 +758,13 @@ bool ConcurrentMarking::Stop(StopRequest stop_request) {
   return true;
 }
 
+bool ConcurrentMarking::IsStopped() {
+  if (!FLAG_concurrent_marking) return true;
+
+  base::LockGuard<base::Mutex> guard(&pending_lock_);
+  return pending_task_count_ == 0;
+}
+
 void ConcurrentMarking::FlushLiveBytes(
     MajorNonAtomicMarkingState* marking_state) {
   DCHECK_EQ(pending_task_count_, 0);
@@ -687,7 +780,7 @@ void ConcurrentMarking::FlushLiveBytes(
     live_bytes.clear();
     task_state_[i].marked_bytes = 0;
   }
-  total_marked_bytes_.SetValue(0);
+  total_marked_bytes_ = 0;
 }
 
 void ConcurrentMarking::ClearLiveness(MemoryChunk* chunk) {
@@ -704,7 +797,7 @@ size_t ConcurrentMarking::TotalMarkedBytes() {
     result +=
         base::AsAtomicWord::Relaxed_Load<size_t>(&task_state_[i].marked_bytes);
   }
-  result += total_marked_bytes_.Value();
+  result += total_marked_bytes_;
   return result;
 }
 
diff --git a/deps/v8/src/heap/concurrent-marking.h b/deps/v8/src/heap/concurrent-marking.h
index c5af406e45c0e3..a99fb706cc3a22 100644
--- a/deps/v8/src/heap/concurrent-marking.h
+++ b/deps/v8/src/heap/concurrent-marking.h
@@ -81,8 +81,16 @@ class ConcurrentMarking {
 
   int TaskCount() { return task_count_; }
 
+  // Checks if all threads are stopped.
+  bool IsStopped();
+
   size_t TotalMarkedBytes();
 
+  void set_ephemeron_marked(bool ephemeron_marked) {
+    ephemeron_marked_.store(ephemeron_marked);
+  }
+  bool ephemeron_marked() { return ephemeron_marked_.load(); }
+
  private:
   struct TaskState {
     // The main thread sets this flag to true when it wants the concurrent
@@ -101,7 +109,8 @@ class ConcurrentMarking {
   MarkingWorklist* const on_hold_;
   WeakObjects* const weak_objects_;
   TaskState task_state_[kMaxTasks + 1];
-  base::AtomicNumber<size_t> total_marked_bytes_{0};
+  std::atomic<size_t> total_marked_bytes_{0};
+  std::atomic<bool> ephemeron_marked_{false};
   base::Mutex pending_lock_;
   base::ConditionVariable pending_condition_;
   int pending_task_count_ = 0;
diff --git a/deps/v8/src/heap/embedder-tracing.cc b/deps/v8/src/heap/embedder-tracing.cc
index 1d20918ef32f19..d8659ec889de57 100644
--- a/deps/v8/src/heap/embedder-tracing.cc
+++ b/deps/v8/src/heap/embedder-tracing.cc
@@ -45,11 +45,10 @@ bool LocalEmbedderHeapTracer::Trace(
   return remote_tracer_->AdvanceTracing(deadline, actions);
 }
 
-size_t LocalEmbedderHeapTracer::NumberOfWrappersToTrace() {
-  return (InUse())
-             ? cached_wrappers_to_trace_.size() +
-                   remote_tracer_->NumberOfWrappersToTrace()
-             : 0;
+bool LocalEmbedderHeapTracer::IsRemoteTracingDone() {
+  return (InUse()) ? cached_wrappers_to_trace_.empty() &&
+                         remote_tracer_->IsTracingDone()
+                   : true;
 }
 
 void LocalEmbedderHeapTracer::RegisterWrappersWithRemoteTracer() {
diff --git a/deps/v8/src/heap/embedder-tracing.h b/deps/v8/src/heap/embedder-tracing.h
index 8146a1281c3106..06450241a2e2b4 100644
--- a/deps/v8/src/heap/embedder-tracing.h
+++ b/deps/v8/src/heap/embedder-tracing.h
@@ -30,8 +30,8 @@ class V8_EXPORT_PRIVATE LocalEmbedderHeapTracer final {
   void EnterFinalPause();
   bool Trace(double deadline,
              EmbedderHeapTracer::AdvanceTracingActions actions);
+  bool IsRemoteTracingDone();
 
-  size_t NumberOfWrappersToTrace();
   size_t NumberOfCachedWrappersToTrace() {
     return cached_wrappers_to_trace_.size();
   }
@@ -51,7 +51,7 @@ class V8_EXPORT_PRIVATE LocalEmbedderHeapTracer final {
   bool ShouldFinalizeIncrementalMarking() {
     static const size_t kMaxIncrementalFixpointRounds = 3;
     return !FLAG_incremental_marking_wrappers || !InUse() ||
-           NumberOfWrappersToTrace() == 0 ||
+           IsRemoteTracingDone() ||
            num_v8_marking_worklist_was_empty_ > kMaxIncrementalFixpointRounds;
   }
 
diff --git a/deps/v8/src/heap/factory-inl.h b/deps/v8/src/heap/factory-inl.h
index 21ee6dc251f7cf..85f2679b3f6f76 100644
--- a/deps/v8/src/heap/factory-inl.h
+++ b/deps/v8/src/heap/factory-inl.h
@@ -30,6 +30,14 @@ ROOT_LIST(ROOT_ACCESSOR)
 STRUCT_LIST(STRUCT_MAP_ACCESSOR)
 #undef STRUCT_MAP_ACCESSOR
 
+#define ALLOCATION_SITE_MAP_ACCESSOR(NAME, Name, Size, name)             \
+  Handle<Map> Factory::name##_map() {                                    \
+    return Handle<Map>(bit_cast<Map**>(                                  \
+        &isolate()->heap()->roots_[Heap::k##Name##Size##MapRootIndex])); \
+  }
+ALLOCATION_SITE_LIST(ALLOCATION_SITE_MAP_ACCESSOR)
+#undef ALLOCATION_SITE_MAP_ACCESSOR
+
 #define DATA_HANDLER_MAP_ACCESSOR(NAME, Name, Size, name)                \
   Handle<Map> Factory::name##_map() {                                    \
     return Handle<Map>(bit_cast<Map**>(                                  \
@@ -109,23 +117,37 @@ Handle<Object> Factory::NewNumberFromInt64(int64_t value,
   return NewNumber(static_cast<double>(value), pretenure);
 }
 
-Handle<HeapNumber> Factory::NewHeapNumber(double value, MutableMode mode,
+Handle<HeapNumber> Factory::NewHeapNumber(double value,
                                           PretenureFlag pretenure) {
-  Handle<HeapNumber> heap_number = NewHeapNumber(mode, pretenure);
+  Handle<HeapNumber> heap_number = NewHeapNumber(pretenure);
   heap_number->set_value(value);
   return heap_number;
 }
 
+Handle<MutableHeapNumber> Factory::NewMutableHeapNumber(
+    double value, PretenureFlag pretenure) {
+  Handle<MutableHeapNumber> number = NewMutableHeapNumber(pretenure);
+  number->set_value(value);
+  return number;
+}
+
 Handle<HeapNumber> Factory::NewHeapNumberFromBits(uint64_t bits,
-                                                  MutableMode mode,
                                                   PretenureFlag pretenure) {
-  Handle<HeapNumber> heap_number = NewHeapNumber(mode, pretenure);
+  Handle<HeapNumber> heap_number = NewHeapNumber(pretenure);
   heap_number->set_value_as_bits(bits);
   return heap_number;
 }
 
-Handle<HeapNumber> Factory::NewMutableHeapNumber(PretenureFlag pretenure) {
-  return NewHeapNumberFromBits(kHoleNanInt64, MUTABLE, pretenure);
+Handle<MutableHeapNumber> Factory::NewMutableHeapNumberFromBits(
+    uint64_t bits, PretenureFlag pretenure) {
+  Handle<MutableHeapNumber> number = NewMutableHeapNumber(pretenure);
+  number->set_value_as_bits(bits);
+  return number;
+}
+
+Handle<MutableHeapNumber> Factory::NewMutableHeapNumberWithHoleNaN(
+    PretenureFlag pretenure) {
+  return NewMutableHeapNumberFromBits(kHoleNanInt64, pretenure);
 }
 
 Handle<JSArray> Factory::NewJSArrayWithElements(Handle<FixedArrayBase> elements,
@@ -143,7 +165,8 @@ Handle<Object> Factory::NewURIError() {
 Handle<String> Factory::Uint32ToString(uint32_t value) {
   Handle<String> result = NumberToString(NewNumberFromUint(value));
 
-  if (result->length() <= String::kMaxArrayIndexSize) {
+  if (result->length() <= String::kMaxArrayIndexSize &&
+      result->hash_field() == String::kEmptyHashField) {
     uint32_t field = StringHasher::MakeArrayIndexHash(value, result->length());
     result->set_hash_field(field);
   }
diff --git a/deps/v8/src/heap/factory.cc b/deps/v8/src/heap/factory.cc
index aecbc880e17bdb..3e72c1384f6146 100644
--- a/deps/v8/src/heap/factory.cc
+++ b/deps/v8/src/heap/factory.cc
@@ -10,16 +10,22 @@
 #include "src/ast/ast.h"
 #include "src/base/bits.h"
 #include "src/bootstrapper.h"
+#include "src/builtins/constants-table-builder.h"
 #include "src/compiler.h"
 #include "src/conversions.h"
 #include "src/interpreter/interpreter.h"
 #include "src/isolate-inl.h"
 #include "src/macro-assembler.h"
+#include "src/objects/api-callbacks.h"
+#include "src/objects/arguments-inl.h"
 #include "src/objects/bigint.h"
 #include "src/objects/debug-objects-inl.h"
 #include "src/objects/frame-array-inl.h"
+#include "src/objects/js-collection-inl.h"
+#include "src/objects/js-regexp-inl.h"
+#include "src/objects/literal-objects-inl.h"
 #include "src/objects/microtask-inl.h"
-#include "src/objects/module.h"
+#include "src/objects/module-inl.h"
 #include "src/objects/promise-inl.h"
 #include "src/objects/scope-info.h"
 #include "src/unicode-cache.h"
@@ -28,11 +34,86 @@
 namespace v8 {
 namespace internal {
 
+namespace {
+
+int ComputeCodeObjectSize(const CodeDesc& desc) {
+  bool has_unwinding_info = desc.unwinding_info != nullptr;
+  DCHECK((has_unwinding_info && desc.unwinding_info_size > 0) ||
+         (!has_unwinding_info && desc.unwinding_info_size == 0));
+  int body_size = desc.instr_size;
+  int unwinding_info_size_field_size = kInt64Size;
+  if (has_unwinding_info) {
+    body_size = RoundUp(body_size, kInt64Size) + desc.unwinding_info_size +
+                unwinding_info_size_field_size;
+  }
+  int object_size = Code::SizeFor(RoundUp(body_size, kObjectAlignment));
+  DCHECK(IsAligned(static_cast<intptr_t>(object_size), kCodeAlignment));
+  return object_size;
+}
+
+void InitializeCode(Heap* heap, Handle<Code> code, int object_size,
+                    const CodeDesc& desc, Code::Kind kind,
+                    Handle<Object> self_ref, int32_t builtin_index,
+                    Handle<ByteArray> source_position_table,
+                    Handle<DeoptimizationData> deopt_data,
+                    Handle<ByteArray> reloc_info,
+                    Handle<CodeDataContainer> data_container, uint32_t stub_key,
+                    bool is_turbofanned, int stack_slots,
+                    int safepoint_table_offset, int handler_table_offset) {
+  DCHECK(IsAligned(code->address(), kCodeAlignment));
+  DCHECK(!heap->memory_allocator()->code_range()->valid() ||
+         heap->memory_allocator()->code_range()->contains(code->address()) ||
+         object_size <= heap->code_space()->AreaSize());
+
+  bool has_unwinding_info = desc.unwinding_info != nullptr;
+
+  code->set_raw_instruction_size(desc.instr_size);
+  code->set_relocation_info(*reloc_info);
+  const bool is_off_heap_trampoline = false;
+  code->initialize_flags(kind, has_unwinding_info, is_turbofanned, stack_slots,
+                         is_off_heap_trampoline);
+  code->set_safepoint_table_offset(safepoint_table_offset);
+  code->set_handler_table_offset(handler_table_offset);
+  code->set_code_data_container(*data_container);
+  code->set_deoptimization_data(*deopt_data);
+  code->set_stub_key(stub_key);
+  code->set_source_position_table(*source_position_table);
+  code->set_constant_pool_offset(desc.instr_size - desc.constant_pool_size);
+  code->set_builtin_index(builtin_index);
+
+  // Allow self references to created code object by patching the handle to
+  // point to the newly allocated Code object.
+  if (!self_ref.is_null()) {
+    DCHECK(self_ref->IsOddball());
+    DCHECK(Oddball::cast(*self_ref)->kind() == Oddball::kSelfReferenceMarker);
+    if (FLAG_embedded_builtins) {
+      auto builder = heap->isolate()->builtins_constants_table_builder();
+      if (builder != nullptr) builder->PatchSelfReference(self_ref, code);
+    }
+    *(self_ref.location()) = *code;
+  }
+
+  // Migrate generated code.
+  // The generated code can contain Object** values (typically from handles)
+  // that are dereferenced during the copy to point directly to the actual heap
+  // objects. These pointers can include references to the code object itself,
+  // through the self_reference parameter.
+  code->CopyFromNoFlush(heap, desc);
+
+  code->clear_padding();
+
+#ifdef VERIFY_HEAP
+  if (FLAG_verify_heap) code->ObjectVerify(heap->isolate());
+#endif
+}
+
+}  // namespace
+
 HeapObject* Factory::AllocateRawWithImmortalMap(int size,
                                                 PretenureFlag pretenure,
                                                 Map* map,
                                                 AllocationAlignment alignment) {
-  HeapObject* result = isolate()->heap()->AllocateRawWithRetry(
+  HeapObject* result = isolate()->heap()->AllocateRawWithRetryOrFail(
       size, Heap::SelectSpace(pretenure), alignment);
   result->set_map_after_allocation(map, SKIP_WRITE_BARRIER);
   return result;
@@ -45,7 +126,8 @@ HeapObject* Factory::AllocateRawWithAllocationSite(
   int size = map->instance_size();
   if (!allocation_site.is_null()) size += AllocationMemento::kSize;
   AllocationSpace space = Heap::SelectSpace(pretenure);
-  HeapObject* result = isolate()->heap()->AllocateRawWithRetry(size, space);
+  HeapObject* result =
+      isolate()->heap()->AllocateRawWithRetryOrFail(size, space);
   WriteBarrierMode write_barrier_mode =
       space == NEW_SPACE ? SKIP_WRITE_BARRIER : UPDATE_WRITE_BARRIER;
   result->set_map_after_allocation(*map, write_barrier_mode);
@@ -61,7 +143,6 @@ void Factory::InitializeAllocationMemento(AllocationMemento* memento,
                                           AllocationSite* allocation_site) {
   memento->set_map_after_allocation(*allocation_memento_map(),
                                     SKIP_WRITE_BARRIER);
-  DCHECK(allocation_site->map() == *allocation_site_map());
   memento->set_allocation_site(allocation_site, SKIP_WRITE_BARRIER);
   if (FLAG_allocation_site_pretenuring) {
     allocation_site->IncrementMementoCreateCount();
@@ -70,7 +151,8 @@ void Factory::InitializeAllocationMemento(AllocationMemento* memento,
 
 HeapObject* Factory::AllocateRawArray(int size, PretenureFlag pretenure) {
   AllocationSpace space = Heap::SelectSpace(pretenure);
-  HeapObject* result = isolate()->heap()->AllocateRawWithRetry(size, space);
+  HeapObject* result =
+      isolate()->heap()->AllocateRawWithRetryOrFail(size, space);
   if (size > kMaxRegularHeapObjectSize && FLAG_use_marking_progress_bar) {
     MemoryChunk* chunk = MemoryChunk::FromAddress(result->address());
     chunk->SetFlag<AccessMode::ATOMIC>(MemoryChunk::HAS_PROGRESS_BAR);
@@ -86,11 +168,20 @@ HeapObject* Factory::AllocateRawFixedArray(int length,
   return AllocateRawArray(FixedArray::SizeFor(length), pretenure);
 }
 
+HeapObject* Factory::AllocateRawWeakArrayList(int capacity,
+                                              PretenureFlag pretenure) {
+  if (capacity < 0 || capacity > WeakArrayList::kMaxCapacity) {
+    isolate()->heap()->FatalProcessOutOfMemory("invalid array length");
+  }
+  return AllocateRawArray(WeakArrayList::SizeForCapacity(capacity), pretenure);
+}
+
 HeapObject* Factory::New(Handle<Map> map, PretenureFlag pretenure) {
   DCHECK(map->instance_type() != MAP_TYPE);
   int size = map->instance_size();
   AllocationSpace space = Heap::SelectSpace(pretenure);
-  HeapObject* result = isolate()->heap()->AllocateRawWithRetry(size, space);
+  HeapObject* result =
+      isolate()->heap()->AllocateRawWithRetryOrFail(size, space);
   // New space objects are allocated white.
   WriteBarrierMode write_barrier_mode =
       space == NEW_SPACE ? SKIP_WRITE_BARRIER : UPDATE_WRITE_BARRIER;
@@ -102,7 +193,7 @@ Handle<HeapObject> Factory::NewFillerObject(int size, bool double_align,
                                             AllocationSpace space) {
   AllocationAlignment alignment = double_align ? kDoubleAligned : kWordAligned;
   Heap* heap = isolate()->heap();
-  HeapObject* result = heap->AllocateRawWithRetry(size, space, alignment);
+  HeapObject* result = heap->AllocateRawWithRetryOrFail(size, space, alignment);
 #ifdef DEBUG
   MemoryChunk* chunk = MemoryChunk::FromAddress(result->address());
   DCHECK(chunk->owner()->identity() == space);
@@ -145,21 +236,13 @@ Handle<Tuple3> Factory::NewTuple3(Handle<Object> value1, Handle<Object> value2,
   return result;
 }
 
-Handle<ContextExtension> Factory::NewContextExtension(
-    Handle<ScopeInfo> scope_info, Handle<Object> extension) {
-  Handle<ContextExtension> result = Handle<ContextExtension>::cast(
-      NewStruct(CONTEXT_EXTENSION_TYPE, TENURED));
-  result->set_scope_info(*scope_info);
-  result->set_extension(*extension);
-  return result;
-}
-
-Handle<ConstantElementsPair> Factory::NewConstantElementsPair(
+Handle<ArrayBoilerplateDescription> Factory::NewArrayBoilerplateDescription(
     ElementsKind elements_kind, Handle<FixedArrayBase> constant_values) {
-  Handle<ConstantElementsPair> result =
-      Handle<ConstantElementsPair>::cast(NewStruct(TUPLE2_TYPE, TENURED));
+  Handle<ArrayBoilerplateDescription> result =
+      Handle<ArrayBoilerplateDescription>::cast(
+          NewStruct(ARRAY_BOILERPLATE_DESCRIPTION_TYPE, TENURED));
   result->set_elements_kind(elements_kind);
-  result->set_constant_values(*constant_values);
+  result->set_constant_elements(*constant_values);
   return result;
 }
 
@@ -176,12 +259,19 @@ Handle<TemplateObjectDescription> Factory::NewTemplateObjectDescription(
 
 Handle<Oddball> Factory::NewOddball(Handle<Map> map, const char* to_string,
                                     Handle<Object> to_number,
-                                    const char* type_of, byte kind) {
-  Handle<Oddball> oddball(Oddball::cast(New(map, TENURED)), isolate());
+                                    const char* type_of, byte kind,
+                                    PretenureFlag pretenure) {
+  Handle<Oddball> oddball(Oddball::cast(New(map, pretenure)), isolate());
   Oddball::Initialize(isolate(), oddball, to_string, to_number, type_of, kind);
   return oddball;
 }
 
+Handle<Oddball> Factory::NewSelfReferenceMarker(PretenureFlag pretenure) {
+  return NewOddball(self_reference_marker_map(), "self_reference_marker",
+                    handle(Smi::FromInt(-1), isolate()), "undefined",
+                    Oddball::kSelfReferenceMarker, pretenure);
+}
+
 Handle<PropertyArray> Factory::NewPropertyArray(int length,
                                                 PretenureFlag pretenure) {
   DCHECK_LE(0, length);
@@ -219,9 +309,36 @@ Handle<T> Factory::NewFixedArrayWithMap(Heap::RootListIndex map_root_index,
       map_root_index, length, *undefined_value(), pretenure));
 }
 
+template <typename T>
+Handle<T> Factory::NewWeakFixedArrayWithMap(Heap::RootListIndex map_root_index,
+                                            int length,
+                                            PretenureFlag pretenure) {
+  static_assert(std::is_base_of<WeakFixedArray, T>::value,
+                "T must be a descendant of WeakFixedArray");
+
+  // Zero-length case must be handled outside.
+  DCHECK_LT(0, length);
+
+  HeapObject* result =
+      AllocateRawArray(WeakFixedArray::SizeFor(length), pretenure);
+  Map* map = Map::cast(isolate()->heap()->root(map_root_index));
+  result->set_map_after_allocation(map, SKIP_WRITE_BARRIER);
+
+  Handle<WeakFixedArray> array(WeakFixedArray::cast(result), isolate());
+  array->set_length(length);
+  MemsetPointer(array->data_start(),
+                HeapObjectReference::Strong(*undefined_value()), length);
+
+  return Handle<T>::cast(array);
+}
+
 template Handle<FixedArray> Factory::NewFixedArrayWithMap<FixedArray>(
     Heap::RootListIndex, int, PretenureFlag);
 
+template Handle<DescriptorArray>
+Factory::NewWeakFixedArrayWithMap<DescriptorArray>(Heap::RootListIndex, int,
+                                                   PretenureFlag);
+
 Handle<FixedArray> Factory::NewFixedArray(int length, PretenureFlag pretenure) {
   DCHECK_LE(0, length);
   if (length == 0) return empty_fixed_array();
@@ -262,7 +379,8 @@ MaybeHandle<FixedArray> Factory::TryNewFixedArray(int length,
   result->set_map_after_allocation(*fixed_array_map(), SKIP_WRITE_BARRIER);
   Handle<FixedArray> array(FixedArray::cast(result), isolate());
   array->set_length(length);
-  MemsetPointer(array->data_start(), heap->undefined_value(), length);
+  MemsetPointer(array->data_start(), ReadOnlyRoots(heap).undefined_value(),
+                length);
   return array;
 }
 
@@ -304,11 +422,12 @@ Handle<FeedbackVector> Factory::NewFeedbackVector(
   vector->set_profiler_ticks(0);
   vector->set_deopt_count(0);
   // TODO(leszeks): Initialize based on the feedback metadata.
-  MemsetPointer(vector->slots_start(), *undefined_value(), length);
+  MemsetPointer(vector->slots_start(),
+                MaybeObject::FromObject(*undefined_value()), length);
   return vector;
 }
 
-Handle<BoilerplateDescription> Factory::NewBoilerplateDescription(
+Handle<ObjectBoilerplateDescription> Factory::NewObjectBoilerplateDescription(
     int boilerplate, int all_properties, int index_keys, bool has_seen_proto) {
   DCHECK_GE(boilerplate, 0);
   DCHECK_GE(all_properties, index_keys);
@@ -319,21 +438,18 @@ Handle<BoilerplateDescription> Factory::NewBoilerplateDescription(
   DCHECK_GE(backing_store_size, 0);
   bool has_different_size_backing_store = boilerplate != backing_store_size;
 
-  // Space for name and value for every boilerplate property.
-  int size = 2 * boilerplate;
+  // Space for name and value for every boilerplate property + LiteralType flag.
+  int size =
+      2 * boilerplate + ObjectBoilerplateDescription::kDescriptionStartIndex;
 
   if (has_different_size_backing_store) {
     // An extra entry for the backing store size.
     size++;
   }
 
-  if (size == 0) {
-    return isolate()->factory()->empty_boilerplate_description();
-  }
-
-  Handle<BoilerplateDescription> description =
-      Handle<BoilerplateDescription>::cast(NewFixedArrayWithMap(
-          Heap::kBoilerplateDescriptionMapRootIndex, size, TENURED));
+  Handle<ObjectBoilerplateDescription> description =
+      Handle<ObjectBoilerplateDescription>::cast(NewFixedArrayWithMap(
+          Heap::kObjectBoilerplateDescriptionMapRootIndex, size, TENURED));
 
   if (has_different_size_backing_store) {
     DCHECK_IMPLIES((boilerplate == (all_properties - index_keys)),
@@ -341,6 +457,8 @@ Handle<BoilerplateDescription> Factory::NewBoilerplateDescription(
     description->set_backing_store_size(isolate(), backing_store_size);
   }
 
+  description->set_flags(0);
+
   return description;
 }
 
@@ -370,18 +488,19 @@ Handle<FixedArrayBase> Factory::NewFixedDoubleArrayWithHoles(
   return array;
 }
 
-Handle<FeedbackMetadata> Factory::NewFeedbackMetadata(int slot_count) {
+Handle<FeedbackMetadata> Factory::NewFeedbackMetadata(int slot_count,
+                                                      PretenureFlag tenure) {
   DCHECK_LE(0, slot_count);
   int size = FeedbackMetadata::SizeFor(slot_count);
   HeapObject* result =
-      AllocateRawWithImmortalMap(size, TENURED, *feedback_metadata_map());
+      AllocateRawWithImmortalMap(size, tenure, *feedback_metadata_map());
   Handle<FeedbackMetadata> data(FeedbackMetadata::cast(result), isolate());
   data->set_slot_count(slot_count);
 
   // Initialize the data section to 0.
   int data_size = size - FeedbackMetadata::kHeaderSize;
-  byte* data_start = data->address() + FeedbackMetadata::kHeaderSize;
-  memset(data_start, 0, data_size);
+  Address data_start = data->address() + FeedbackMetadata::kHeaderSize;
+  memset(reinterpret_cast<byte*>(data_start), 0, data_size);
   // Fields have been zeroed out but not initialized, so this object will not
   // pass object verification at this point.
   return data;
@@ -390,8 +509,8 @@ Handle<FeedbackMetadata> Factory::NewFeedbackMetadata(int slot_count) {
 Handle<FrameArray> Factory::NewFrameArray(int number_of_frames,
                                           PretenureFlag pretenure) {
   DCHECK_LE(0, number_of_frames);
-  Handle<FixedArray> result =
-      NewFixedArrayWithHoles(FrameArray::LengthFor(number_of_frames));
+  Handle<FixedArray> result = NewFixedArrayWithHoles(
+      FrameArray::LengthFor(number_of_frames), pretenure);
   result->set(FrameArray::kFrameCountIndex, Smi::kZero);
   return Handle<FrameArray>::cast(result);
 }
@@ -402,7 +521,7 @@ Handle<SmallOrderedHashSet> Factory::NewSmallOrderedHashSet(
   CHECK_LE(capacity, SmallOrderedHashSet::kMaxCapacity);
   DCHECK_EQ(0, capacity % SmallOrderedHashSet::kLoadFactor);
 
-  int size = SmallOrderedHashSet::Size(capacity);
+  int size = SmallOrderedHashSet::SizeFor(capacity);
   Map* map = *small_ordered_hash_set_map();
   HeapObject* result = AllocateRawWithImmortalMap(size, pretenure, map);
   Handle<SmallOrderedHashSet> table(SmallOrderedHashSet::cast(result),
@@ -417,7 +536,7 @@ Handle<SmallOrderedHashMap> Factory::NewSmallOrderedHashMap(
   CHECK_LE(capacity, SmallOrderedHashMap::kMaxCapacity);
   DCHECK_EQ(0, capacity % SmallOrderedHashMap::kLoadFactor);
 
-  int size = SmallOrderedHashMap::Size(capacity);
+  int size = SmallOrderedHashMap::SizeFor(capacity);
   Map* map = *small_ordered_hash_map_map();
   HeapObject* result = AllocateRawWithImmortalMap(size, pretenure, map);
   Handle<SmallOrderedHashMap> table(SmallOrderedHashMap::cast(result),
@@ -607,7 +726,7 @@ bool inline IsOneByte(Vector<const char> str, int chars) {
   return chars == str.length();
 }
 
-bool inline IsOneByte(Handle<String> str, int chars) {
+bool inline IsOneByte(Handle<String> str) {
   return str->IsOneByteRepresentation();
 }
 
@@ -655,7 +774,11 @@ Handle<SeqOneByteString> Factory::AllocateRawOneByteInternalizedString(
 
   Map* map = *one_byte_internalized_string_map();
   int size = SeqOneByteString::SizeFor(length);
-  HeapObject* result = AllocateRawWithImmortalMap(size, TENURED, map);
+  HeapObject* result = AllocateRawWithImmortalMap(
+      size,
+      isolate()->heap()->CanAllocateInReadOnlySpace() ? TENURED_READ_ONLY
+                                                      : TENURED,
+      map);
   Handle<SeqOneByteString> answer(SeqOneByteString::cast(result), isolate());
   answer->set_length(length);
   answer->set_hash_field(hash_field);
@@ -671,14 +794,13 @@ Handle<String> Factory::AllocateTwoByteInternalizedString(
   Map* map = *internalized_string_map();
   int size = SeqTwoByteString::SizeFor(str.length());
   HeapObject* result = AllocateRawWithImmortalMap(size, TENURED, map);
-  Handle<String> answer(String::cast(result), isolate());
+  Handle<SeqTwoByteString> answer(SeqTwoByteString::cast(result), isolate());
   answer->set_length(str.length());
   answer->set_hash_field(hash_field);
   DCHECK_EQ(size, answer->Size());
 
   // Fill in the characters.
-  MemCopy(answer->address() + SeqTwoByteString::kHeaderSize, str.start(),
-          str.length() * kUC16Size);
+  MemCopy(answer->GetChars(), str.start(), str.length() * kUC16Size);
 
   return answer;
 }
@@ -700,7 +822,11 @@ Handle<String> Factory::AllocateInternalizedStringImpl(T t, int chars,
     size = SeqTwoByteString::SizeFor(chars);
   }
 
-  HeapObject* result = AllocateRawWithImmortalMap(size, TENURED, map);
+  HeapObject* result = AllocateRawWithImmortalMap(
+      size,
+      isolate()->heap()->CanAllocateInReadOnlySpace() ? TENURED_READ_ONLY
+                                                      : TENURED,
+      map);
   Handle<String> answer(String::cast(result), isolate());
   answer->set_length(chars);
   answer->set_hash_field(hash_field);
@@ -751,7 +877,7 @@ Handle<String> Factory::NewTwoByteInternalizedString(Vector<const uc16> str,
 Handle<String> Factory::NewInternalizedStringImpl(Handle<String> string,
                                                   int chars,
                                                   uint32_t hash_field) {
-  if (IsOneByte(string, chars)) {
+  if (IsOneByte(string)) {
     return AllocateInternalizedStringImpl<true>(string, chars, hash_field);
   }
   return AllocateInternalizedStringImpl<false>(string, chars, hash_field);
@@ -787,7 +913,7 @@ MaybeHandle<Map> GetInternalizedStringMap(Factory* f, Handle<String> string) {
 MaybeHandle<Map> Factory::InternalizedStringMapForString(
     Handle<String> string) {
   // If the string is in new space it cannot be used as internalized.
-  if (isolate()->heap()->InNewSpace(*string)) return MaybeHandle<Map>();
+  if (Heap::InNewSpace(*string)) return MaybeHandle<Map>();
 
   return GetInternalizedStringMap(this, string);
 }
@@ -1041,11 +1167,11 @@ Handle<String> Factory::NewSurrogatePairString(uint16_t lead, uint16_t trail) {
 Handle<String> Factory::NewProperSubString(Handle<String> str, int begin,
                                            int end) {
 #if VERIFY_HEAP
-  if (FLAG_verify_heap) str->StringVerify();
+  if (FLAG_verify_heap) str->StringVerify(isolate());
 #endif
   DCHECK(begin > 0 || end < str->length());
 
-  str = String::Flatten(str);
+  str = String::Flatten(isolate(), str);
 
   int length = end - begin;
   if (length <= 0) return empty_string();
@@ -1121,10 +1247,11 @@ MaybeHandle<String> Factory::NewExternalStringFromOneByte(
     map = external_one_byte_string_map();
   }
   Handle<ExternalOneByteString> external_string(
-      ExternalOneByteString::cast(New(map, NOT_TENURED)), isolate());
+      ExternalOneByteString::cast(New(map, TENURED)), isolate());
   external_string->set_length(static_cast<int>(length));
   external_string->set_hash_field(String::kEmptyHashField);
   external_string->set_resource(resource);
+  isolate()->heap()->RegisterExternalString(*external_string);
 
   return external_string;
 }
@@ -1153,10 +1280,11 @@ MaybeHandle<String> Factory::NewExternalStringFromTwoByte(
                       : external_string_map();
   }
   Handle<ExternalTwoByteString> external_string(
-      ExternalTwoByteString::cast(New(map, NOT_TENURED)), isolate());
+      ExternalTwoByteString::cast(New(map, TENURED)), isolate());
   external_string->set_length(static_cast<int>(length));
   external_string->set_hash_field(String::kEmptyHashField);
   external_string->set_resource(resource);
+  isolate()->heap()->RegisterExternalString(*external_string);
 
   return external_string;
 }
@@ -1172,6 +1300,7 @@ Handle<ExternalOneByteString> Factory::NewNativeSourceString(
   external_string->set_length(static_cast<int>(length));
   external_string->set_hash_field(String::kEmptyHashField);
   external_string->set_resource(resource);
+  isolate()->heap()->RegisterExternalString(*external_string);
 
   return external_string;
 }
@@ -1179,7 +1308,7 @@ Handle<ExternalOneByteString> Factory::NewNativeSourceString(
 Handle<JSStringIterator> Factory::NewJSStringIterator(Handle<String> string) {
   Handle<Map> map(isolate()->native_context()->string_iterator_map(),
                   isolate());
-  Handle<String> flat_string = String::Flatten(string);
+  Handle<String> flat_string = String::Flatten(isolate(), string);
   Handle<JSStringIterator> iterator =
       Handle<JSStringIterator>::cast(NewJSObjectFromMap(map));
   iterator->set_string(*flat_string);
@@ -1188,12 +1317,13 @@ Handle<JSStringIterator> Factory::NewJSStringIterator(Handle<String> string) {
   return iterator;
 }
 
-Handle<Symbol> Factory::NewSymbol() {
+Handle<Symbol> Factory::NewSymbol(PretenureFlag flag) {
+  DCHECK(flag != NOT_TENURED);
   // Statically ensure that it is safe to allocate symbols in paged spaces.
   STATIC_ASSERT(Symbol::kSize <= kMaxRegularHeapObjectSize);
 
   HeapObject* result =
-      AllocateRawWithImmortalMap(Symbol::kSize, TENURED, *symbol_map());
+      AllocateRawWithImmortalMap(Symbol::kSize, flag, *symbol_map());
 
   // Generate a random hash value.
   int hash = isolate()->GenerateIdentityHash(Name::kHashBitMask);
@@ -1207,8 +1337,9 @@ Handle<Symbol> Factory::NewSymbol() {
   return symbol;
 }
 
-Handle<Symbol> Factory::NewPrivateSymbol() {
-  Handle<Symbol> symbol = NewSymbol();
+Handle<Symbol> Factory::NewPrivateSymbol(PretenureFlag flag) {
+  DCHECK(flag != NOT_TENURED);
+  Handle<Symbol> symbol = NewSymbol(flag);
   symbol->set_is_private(true);
   return symbol;
 }
@@ -1232,15 +1363,16 @@ Handle<Context> Factory::NewNativeContext() {
   return context;
 }
 
-Handle<Context> Factory::NewScriptContext(Handle<JSFunction> function,
+Handle<Context> Factory::NewScriptContext(Handle<Context> outer,
                                           Handle<ScopeInfo> scope_info) {
   DCHECK_EQ(scope_info->scope_type(), SCRIPT_SCOPE);
+  DCHECK(outer->IsNativeContext());
   Handle<Context> context = NewFixedArrayWithMap<Context>(
       Heap::kScriptContextMapRootIndex, scope_info->ContextLength(), TENURED);
-  context->set_closure(*function);
-  context->set_previous(function->context());
-  context->set_extension(*scope_info);
-  context->set_native_context(function->native_context());
+  context->set_scope_info(*scope_info);
+  context->set_previous(*outer);
+  context->set_extension(*the_hole_value());
+  context->set_native_context(*outer);
   DCHECK(context->IsScriptContext());
   return context;
 }
@@ -1255,26 +1387,25 @@ Handle<ScriptContextTable> Factory::NewScriptContextTable() {
 }
 
 Handle<Context> Factory::NewModuleContext(Handle<Module> module,
-                                          Handle<JSFunction> function,
+                                          Handle<Context> outer,
                                           Handle<ScopeInfo> scope_info) {
   DCHECK_EQ(scope_info->scope_type(), MODULE_SCOPE);
   Handle<Context> context = NewFixedArrayWithMap<Context>(
       Heap::kModuleContextMapRootIndex, scope_info->ContextLength(), TENURED);
-  context->set_closure(*function);
-  context->set_previous(function->context());
+  context->set_scope_info(*scope_info);
+  context->set_previous(*outer);
   context->set_extension(*module);
-  context->set_native_context(function->native_context());
+  context->set_native_context(*outer);
   DCHECK(context->IsModuleContext());
   return context;
 }
 
-Handle<Context> Factory::NewFunctionContext(int length,
-                                            Handle<JSFunction> function,
-                                            ScopeType scope_type) {
-  DCHECK(function->shared()->scope_info()->scope_type() == scope_type);
-  DCHECK(length >= Context::MIN_CONTEXT_SLOTS);
+Handle<Context> Factory::NewFunctionContext(Handle<Context> outer,
+                                            Handle<ScopeInfo> scope_info) {
+  int length = scope_info->ContextLength();
+  DCHECK_LE(Context::MIN_CONTEXT_SLOTS, length);
   Heap::RootListIndex mapRootIndex;
-  switch (scope_type) {
+  switch (scope_info->scope_type()) {
     case EVAL_SCOPE:
       mapRootIndex = Heap::kEvalContextMapRootIndex;
       break;
@@ -1285,25 +1416,22 @@ Handle<Context> Factory::NewFunctionContext(int length,
       UNREACHABLE();
   }
   Handle<Context> context = NewFixedArrayWithMap<Context>(mapRootIndex, length);
-  context->set_closure(*function);
-  context->set_previous(function->context());
+  context->set_scope_info(*scope_info);
+  context->set_previous(*outer);
   context->set_extension(*the_hole_value());
-  context->set_native_context(function->native_context());
+  context->set_native_context(outer->native_context());
   return context;
 }
 
-Handle<Context> Factory::NewCatchContext(Handle<JSFunction> function,
-                                         Handle<Context> previous,
+Handle<Context> Factory::NewCatchContext(Handle<Context> previous,
                                          Handle<ScopeInfo> scope_info,
-                                         Handle<String> name,
                                          Handle<Object> thrown_object) {
   STATIC_ASSERT(Context::MIN_CONTEXT_SLOTS == Context::THROWN_OBJECT_INDEX);
-  Handle<ContextExtension> extension = NewContextExtension(scope_info, name);
   Handle<Context> context = NewFixedArrayWithMap<Context>(
       Heap::kCatchContextMapRootIndex, Context::MIN_CONTEXT_SLOTS + 1);
-  context->set_closure(*function);
+  context->set_scope_info(*scope_info);
   context->set_previous(*previous);
-  context->set_extension(*extension);
+  context->set_extension(*the_hole_value());
   context->set_native_context(previous->native_context());
   context->set(Context::THROWN_OBJECT_INDEX, *thrown_object);
   return context;
@@ -1316,48 +1444,55 @@ Handle<Context> Factory::NewDebugEvaluateContext(Handle<Context> previous,
                                                  Handle<StringSet> whitelist) {
   STATIC_ASSERT(Context::WHITE_LIST_INDEX == Context::MIN_CONTEXT_SLOTS + 1);
   DCHECK(scope_info->IsDebugEvaluateScope());
-  Handle<ContextExtension> context_extension = NewContextExtension(
-      scope_info, extension.is_null() ? Handle<Object>::cast(undefined_value())
-                                      : Handle<Object>::cast(extension));
+  Handle<HeapObject> ext = extension.is_null()
+                               ? Handle<HeapObject>::cast(the_hole_value())
+                               : Handle<HeapObject>::cast(extension);
   Handle<Context> c = NewFixedArrayWithMap<Context>(
       Heap::kDebugEvaluateContextMapRootIndex, Context::MIN_CONTEXT_SLOTS + 2);
-  c->set_closure(wrapped.is_null() ? previous->closure() : wrapped->closure());
+  c->set_scope_info(*scope_info);
   c->set_previous(*previous);
   c->set_native_context(previous->native_context());
-  c->set_extension(*context_extension);
+  c->set_extension(*ext);
   if (!wrapped.is_null()) c->set(Context::WRAPPED_CONTEXT_INDEX, *wrapped);
   if (!whitelist.is_null()) c->set(Context::WHITE_LIST_INDEX, *whitelist);
   return c;
 }
 
-Handle<Context> Factory::NewWithContext(Handle<JSFunction> function,
-                                        Handle<Context> previous,
+Handle<Context> Factory::NewWithContext(Handle<Context> previous,
                                         Handle<ScopeInfo> scope_info,
                                         Handle<JSReceiver> extension) {
-  Handle<ContextExtension> context_extension =
-      NewContextExtension(scope_info, extension);
   Handle<Context> context = NewFixedArrayWithMap<Context>(
       Heap::kWithContextMapRootIndex, Context::MIN_CONTEXT_SLOTS);
-  context->set_closure(*function);
+  context->set_scope_info(*scope_info);
   context->set_previous(*previous);
-  context->set_extension(*context_extension);
+  context->set_extension(*extension);
   context->set_native_context(previous->native_context());
   return context;
 }
 
-Handle<Context> Factory::NewBlockContext(Handle<JSFunction> function,
-                                         Handle<Context> previous,
+Handle<Context> Factory::NewBlockContext(Handle<Context> previous,
                                          Handle<ScopeInfo> scope_info) {
   DCHECK_EQ(scope_info->scope_type(), BLOCK_SCOPE);
   Handle<Context> context = NewFixedArrayWithMap<Context>(
       Heap::kBlockContextMapRootIndex, scope_info->ContextLength());
-  context->set_closure(*function);
+  context->set_scope_info(*scope_info);
   context->set_previous(*previous);
-  context->set_extension(*scope_info);
+  context->set_extension(*the_hole_value());
   context->set_native_context(previous->native_context());
   return context;
 }
 
+Handle<Context> Factory::NewBuiltinContext(Handle<Context> native_context,
+                                           int length) {
+  DCHECK_GE(length, Context::MIN_CONTEXT_SLOTS);
+  Handle<Context> context =
+      NewFixedArrayWithMap<Context>(Heap::kFunctionContextMapRootIndex, length);
+  context->set_scope_info(ReadOnlyRoots(isolate()).empty_scope_info());
+  context->set_extension(*the_hole_value());
+  context->set_native_context(*native_context);
+  return context;
+}
+
 Handle<Struct> Factory::NewStruct(InstanceType type, PretenureFlag pretenure) {
   Map* map;
   switch (type) {
@@ -1395,29 +1530,63 @@ Handle<AccessorInfo> Factory::NewAccessorInfo() {
   return info;
 }
 
-Handle<Script> Factory::NewScript(Handle<String> source) {
+Handle<Script> Factory::NewScript(Handle<String> source, PretenureFlag tenure) {
+  return NewScriptWithId(source, isolate()->heap()->NextScriptId(), tenure);
+}
+
+Handle<Script> Factory::NewScriptWithId(Handle<String> source, int script_id,
+                                        PretenureFlag tenure) {
+  DCHECK(tenure == TENURED || tenure == TENURED_READ_ONLY);
   // Create and initialize script object.
   Heap* heap = isolate()->heap();
-  Handle<Script> script = Handle<Script>::cast(NewStruct(SCRIPT_TYPE, TENURED));
+  ReadOnlyRoots roots(heap);
+  Handle<Script> script = Handle<Script>::cast(NewStruct(SCRIPT_TYPE, tenure));
   script->set_source(*source);
-  script->set_name(heap->undefined_value());
-  script->set_id(isolate()->heap()->NextScriptId());
+  script->set_name(roots.undefined_value());
+  script->set_id(script_id);
   script->set_line_offset(0);
   script->set_column_offset(0);
-  script->set_context_data(heap->undefined_value());
+  script->set_context_data(roots.undefined_value());
   script->set_type(Script::TYPE_NORMAL);
-  script->set_wrapper(heap->undefined_value());
-  script->set_line_ends(heap->undefined_value());
-  script->set_eval_from_shared_or_wrapped_arguments(heap->undefined_value());
+  script->set_line_ends(roots.undefined_value());
+  script->set_eval_from_shared_or_wrapped_arguments(roots.undefined_value());
   script->set_eval_from_position(0);
   script->set_shared_function_infos(*empty_weak_fixed_array(),
                                     SKIP_WRITE_BARRIER);
   script->set_flags(0);
   script->set_host_defined_options(*empty_fixed_array());
-  heap->set_script_list(*FixedArrayOfWeakCells::Add(script_list(), script));
+  heap->set_script_list(
+      *FixedArrayOfWeakCells::Add(isolate(), script_list(), script));
+  LOG(isolate(), ScriptEvent(Logger::ScriptEventType::kCreate, script_id));
   return script;
 }
 
+Handle<Script> Factory::CloneScript(Handle<Script> script) {
+  Heap* heap = isolate()->heap();
+  int script_id = isolate()->heap()->NextScriptId();
+  Handle<Script> new_script =
+      Handle<Script>::cast(NewStruct(SCRIPT_TYPE, TENURED));
+  new_script->set_source(script->source());
+  new_script->set_name(script->name());
+  new_script->set_id(script_id);
+  new_script->set_line_offset(script->line_offset());
+  new_script->set_column_offset(script->column_offset());
+  new_script->set_context_data(script->context_data());
+  new_script->set_type(script->type());
+  new_script->set_line_ends(ReadOnlyRoots(heap).undefined_value());
+  new_script->set_eval_from_shared_or_wrapped_arguments(
+      script->eval_from_shared_or_wrapped_arguments());
+  new_script->set_shared_function_infos(*empty_weak_fixed_array(),
+                                        SKIP_WRITE_BARRIER);
+  new_script->set_eval_from_position(script->eval_from_position());
+  new_script->set_flags(script->flags());
+  new_script->set_host_defined_options(script->host_defined_options());
+  heap->set_script_list(
+      *FixedArrayOfWeakCells::Add(isolate(), script_list(), new_script));
+  LOG(isolate(), ScriptEvent(Logger::ScriptEventType::kCreate, script_id));
+  return new_script;
+}
+
 Handle<CallableTask> Factory::NewCallableTask(Handle<JSReceiver> callable,
                                               Handle<Context> context) {
   DCHECK(callable->IsCallable());
@@ -1484,7 +1653,7 @@ Handle<BytecodeArray> Factory::NewBytecodeArray(
     isolate()->heap()->FatalProcessOutOfMemory("invalid array length");
   }
   // Bytecode array is pretenured, so constant pool array should be too.
-  DCHECK(!isolate()->heap()->InNewSpace(*constant_pool));
+  DCHECK(!Heap::InNewSpace(*constant_pool));
 
   int size = BytecodeArray::SizeFor(length);
   HeapObject* result =
@@ -1501,7 +1670,8 @@ Handle<BytecodeArray> Factory::NewBytecodeArray(
   instance->set_constant_pool(*constant_pool);
   instance->set_handler_table(*empty_byte_array());
   instance->set_source_position_table(*empty_byte_array());
-  CopyBytes(instance->GetFirstBytecodeAddress(), raw_bytecodes, length);
+  CopyBytes(reinterpret_cast<byte*>(instance->GetFirstBytecodeAddress()),
+            raw_bytecodes, length);
   instance->clear_padding();
 
   return instance;
@@ -1539,8 +1709,8 @@ Handle<FixedTypedArrayBase> Factory::NewFixedTypedArray(
                                        isolate());
   elements->set_base_pointer(*elements, SKIP_WRITE_BARRIER);
   elements->set_external_pointer(
-      ExternalReference::fixed_typed_array_base_data_offset(isolate())
-          .address(),
+      reinterpret_cast<void*>(
+          ExternalReference::fixed_typed_array_base_data_offset().address()),
       SKIP_WRITE_BARRIER);
   elements->set_length(static_cast<int>(length));
   if (initialize) memset(elements->DataPtr(), 0, elements->DataSize());
@@ -1584,11 +1754,12 @@ Handle<FeedbackCell> Factory::NewManyClosuresCell(Handle<HeapObject> value) {
   return cell;
 }
 
-Handle<PropertyCell> Factory::NewPropertyCell(Handle<Name> name) {
+Handle<PropertyCell> Factory::NewPropertyCell(Handle<Name> name,
+                                              PretenureFlag pretenure) {
   DCHECK(name->IsUniqueName());
   STATIC_ASSERT(PropertyCell::kSize <= kMaxRegularHeapObjectSize);
-  HeapObject* result = AllocateRawWithImmortalMap(PropertyCell::kSize, TENURED,
-                                                  *global_property_cell_map());
+  HeapObject* result = AllocateRawWithImmortalMap(
+      PropertyCell::kSize, pretenure, *global_property_cell_map());
   Handle<PropertyCell> cell(PropertyCell::cast(result), isolate());
   cell->set_dependent_code(DependentCode::cast(*empty_fixed_array()),
                            SKIP_WRITE_BARRIER);
@@ -1598,20 +1769,23 @@ Handle<PropertyCell> Factory::NewPropertyCell(Handle<Name> name) {
   return cell;
 }
 
-Handle<WeakCell> Factory::NewWeakCell(Handle<HeapObject> value) {
+Handle<WeakCell> Factory::NewWeakCell(Handle<HeapObject> value,
+                                      PretenureFlag pretenure) {
   // It is safe to dereference the value because we are embedding it
   // in cell and not inspecting its fields.
   AllowDeferredHandleDereference convert_to_cell;
   STATIC_ASSERT(WeakCell::kSize <= kMaxRegularHeapObjectSize);
   HeapObject* result =
-      AllocateRawWithImmortalMap(WeakCell::kSize, TENURED, *weak_cell_map());
+      AllocateRawWithImmortalMap(WeakCell::kSize, pretenure, *weak_cell_map());
   Handle<WeakCell> cell(WeakCell::cast(result), isolate());
   cell->initialize(*value);
   return cell;
 }
 
-Handle<TransitionArray> Factory::NewTransitionArray(int capacity) {
-  Handle<TransitionArray> array = NewFixedArrayWithMap<TransitionArray>(
+Handle<TransitionArray> Factory::NewTransitionArray(int number_of_transitions,
+                                                    int slack) {
+  int capacity = TransitionArray::LengthFor(number_of_transitions + slack);
+  Handle<TransitionArray> array = NewWeakFixedArrayWithMap<TransitionArray>(
       Heap::kTransitionArrayMapRootIndex, capacity, TENURED);
   // Transition arrays are tenured. When black allocation is on we have to
   // add the transition array to the list of encountered_transition_arrays.
@@ -1619,18 +1793,26 @@ Handle<TransitionArray> Factory::NewTransitionArray(int capacity) {
   if (heap->incremental_marking()->black_allocation()) {
     heap->mark_compact_collector()->AddTransitionArray(*array);
   }
+  array->WeakFixedArray::Set(TransitionArray::kPrototypeTransitionsIndex,
+                             MaybeObject::FromObject(Smi::kZero));
+  array->WeakFixedArray::Set(
+      TransitionArray::kTransitionLengthIndex,
+      MaybeObject::FromObject(Smi::FromInt(number_of_transitions)));
   return array;
 }
 
-Handle<AllocationSite> Factory::NewAllocationSite() {
-  Handle<Map> map = allocation_site_map();
+Handle<AllocationSite> Factory::NewAllocationSite(bool with_weak_next) {
+  Handle<Map> map = with_weak_next ? allocation_site_map()
+                                   : allocation_site_without_weaknext_map();
   Handle<AllocationSite> site(AllocationSite::cast(New(map, TENURED)),
                               isolate());
   site->Initialize();
 
-  // Link the site
-  site->set_weak_next(isolate()->heap()->allocation_sites_list());
-  isolate()->heap()->set_allocation_sites_list(*site);
+  if (with_weak_next) {
+    // Link the site
+    site->set_weak_next(isolate()->heap()->allocation_sites_list());
+    isolate()->heap()->set_allocation_sites_list(*site);
+  }
   return site;
 }
 
@@ -1638,12 +1820,12 @@ Handle<Map> Factory::NewMap(InstanceType type, int instance_size,
                             ElementsKind elements_kind,
                             int inobject_properties) {
   STATIC_ASSERT(LAST_JS_OBJECT_TYPE == LAST_TYPE);
-  DCHECK_IMPLIES(type >= FIRST_JS_OBJECT_TYPE &&
+  DCHECK_IMPLIES(Map::IsJSObject(type) &&
                      !Map::CanHaveFastTransitionableElementsKind(type),
                  IsDictionaryElementsKind(elements_kind) ||
                      IsTerminalElementsKind(elements_kind));
   HeapObject* result =
-      isolate()->heap()->AllocateRawWithRetry(Map::kSize, MAP_SPACE);
+      isolate()->heap()->AllocateRawWithRetryOrFail(Map::kSize, MAP_SPACE);
   result->set_map_after_allocation(*meta_map(), SKIP_WRITE_BARRIER);
   return handle(InitializeMap(Map::cast(result), type, instance_size,
                               elements_kind, inobject_properties),
@@ -1658,6 +1840,7 @@ Map* Factory::InitializeMap(Map* map, InstanceType type, int instance_size,
   map->set_constructor_or_backpointer(*null_value(), SKIP_WRITE_BARRIER);
   map->set_instance_size(instance_size);
   if (map->IsJSObjectMap()) {
+    DCHECK(!isolate()->heap()->InReadOnlySpace(map));
     map->SetInObjectPropertiesStartInWords(instance_size / kPointerSize -
                                            inobject_properties);
     DCHECK_EQ(map->GetInObjectProperties(), inobject_properties);
@@ -1719,10 +1902,10 @@ Handle<JSObject> Factory::CopyJSObjectWithAllocationSite(
   int object_size = map->instance_size();
   int adjusted_object_size =
       site.is_null() ? object_size : object_size + AllocationMemento::kSize;
-  HeapObject* raw_clone =
-      isolate()->heap()->AllocateRawWithRetry(adjusted_object_size, NEW_SPACE);
+  HeapObject* raw_clone = isolate()->heap()->AllocateRawWithRetryOrFail(
+      adjusted_object_size, NEW_SPACE);
 
-  SLOW_DCHECK(isolate()->heap()->InNewSpace(raw_clone));
+  SLOW_DCHECK(Heap::InNewSpace(raw_clone));
   // Since we know the clone is allocated in new space, we can copy
   // the contents without worrying about updating the write barrier.
   Heap::CopyBlock(raw_clone->address(), source->address(), object_size);
@@ -1836,6 +2019,53 @@ Handle<FixedArray> Factory::CopyFixedArrayAndGrow(Handle<FixedArray> array,
   return CopyArrayAndGrow(array, grow_by, pretenure);
 }
 
+Handle<WeakFixedArray> Factory::CopyWeakFixedArrayAndGrow(
+    Handle<WeakFixedArray> src, int grow_by, PretenureFlag pretenure) {
+  DCHECK(
+      !src->IsTransitionArray());  // Compacted by GC, this code doesn't work.
+  int old_len = src->length();
+  int new_len = old_len + grow_by;
+  DCHECK_GE(new_len, old_len);
+  HeapObject* obj = AllocateRawFixedArray(new_len, pretenure);
+  DCHECK_EQ(old_len, src->length());
+  obj->set_map_after_allocation(src->map(), SKIP_WRITE_BARRIER);
+
+  WeakFixedArray* result = WeakFixedArray::cast(obj);
+  result->set_length(new_len);
+
+  // Copy the content.
+  DisallowHeapAllocation no_gc;
+  WriteBarrierMode mode = obj->GetWriteBarrierMode(no_gc);
+  for (int i = 0; i < old_len; i++) result->Set(i, src->Get(i), mode);
+  HeapObjectReference* undefined_reference =
+      HeapObjectReference::Strong(ReadOnlyRoots(isolate()).undefined_value());
+  MemsetPointer(result->data_start() + old_len, undefined_reference, grow_by);
+  return Handle<WeakFixedArray>(result, isolate());
+}
+
+Handle<WeakArrayList> Factory::CopyWeakArrayListAndGrow(
+    Handle<WeakArrayList> src, int grow_by, PretenureFlag pretenure) {
+  int old_capacity = src->capacity();
+  int new_capacity = old_capacity + grow_by;
+  DCHECK_GE(new_capacity, old_capacity);
+  HeapObject* obj = AllocateRawWeakArrayList(new_capacity, pretenure);
+  obj->set_map_after_allocation(src->map(), SKIP_WRITE_BARRIER);
+
+  WeakArrayList* result = WeakArrayList::cast(obj);
+  result->set_length(src->length());
+  result->set_capacity(new_capacity);
+
+  // Copy the content.
+  DisallowHeapAllocation no_gc;
+  WriteBarrierMode mode = obj->GetWriteBarrierMode(no_gc);
+  for (int i = 0; i < old_capacity; i++) result->Set(i, src->Get(i), mode);
+  HeapObjectReference* undefined_reference =
+      HeapObjectReference::Strong(ReadOnlyRoots(isolate()).undefined_value());
+  MemsetPointer(result->data_start() + old_capacity, undefined_reference,
+                grow_by);
+  return Handle<WeakArrayList>(result, isolate());
+}
+
 Handle<PropertyArray> Factory::CopyPropertyArrayAndGrow(
     Handle<PropertyArray> array, int grow_by, PretenureFlag pretenure) {
   return CopyArrayAndGrow(array, grow_by, pretenure);
@@ -1867,7 +2097,7 @@ Handle<FixedArray> Factory::CopyFixedArray(Handle<FixedArray> array) {
 
 Handle<FixedArray> Factory::CopyAndTenureFixedCOWArray(
     Handle<FixedArray> array) {
-  DCHECK(isolate()->heap()->InNewSpace(*array));
+  DCHECK(Heap::InNewSpace(*array));
   Handle<FixedArray> result =
       CopyFixedArrayUpTo(array, array->length(), TENURED);
 
@@ -1924,16 +2154,14 @@ Handle<Object> Factory::NewNumber(double value, PretenureFlag pretenure) {
   if (DoubleToSmiInteger(value, &int_value)) {
     return handle(Smi::FromInt(int_value), isolate());
   }
-
-  // Materialize the value in the heap.
-  return NewHeapNumber(value, IMMUTABLE, pretenure);
+  return NewHeapNumber(value, pretenure);
 }
 
 Handle<Object> Factory::NewNumberFromInt(int32_t value,
                                          PretenureFlag pretenure) {
   if (Smi::IsValid(value)) return handle(Smi::FromInt(value), isolate());
   // Bypass NewNumber to avoid various redundant checks.
-  return NewHeapNumber(FastI2D(value), IMMUTABLE, pretenure);
+  return NewHeapNumber(FastI2D(value), pretenure);
 }
 
 Handle<Object> Factory::NewNumberFromUint(uint32_t value,
@@ -1942,18 +2170,26 @@ Handle<Object> Factory::NewNumberFromUint(uint32_t value,
   if (int32v >= 0 && Smi::IsValid(int32v)) {
     return handle(Smi::FromInt(int32v), isolate());
   }
-  return NewHeapNumber(FastUI2D(value), IMMUTABLE, pretenure);
+  return NewHeapNumber(FastUI2D(value), pretenure);
 }
 
-Handle<HeapNumber> Factory::NewHeapNumber(MutableMode mode,
-                                          PretenureFlag pretenure) {
+Handle<HeapNumber> Factory::NewHeapNumber(PretenureFlag pretenure) {
   STATIC_ASSERT(HeapNumber::kSize <= kMaxRegularHeapObjectSize);
-  Map* map = mode == MUTABLE ? *mutable_heap_number_map() : *heap_number_map();
+  Map* map = *heap_number_map();
   HeapObject* result = AllocateRawWithImmortalMap(HeapNumber::kSize, pretenure,
                                                   map, kDoubleUnaligned);
   return handle(HeapNumber::cast(result), isolate());
 }
 
+Handle<MutableHeapNumber> Factory::NewMutableHeapNumber(
+    PretenureFlag pretenure) {
+  STATIC_ASSERT(HeapNumber::kSize <= kMaxRegularHeapObjectSize);
+  Map* map = *mutable_heap_number_map();
+  HeapObject* result = AllocateRawWithImmortalMap(
+      MutableHeapNumber::kSize, pretenure, map, kDoubleUnaligned);
+  return handle(MutableHeapNumber::cast(result), isolate());
+}
+
 Handle<FreshlyAllocatedBigInt> Factory::NewBigInt(int length,
                                                   PretenureFlag pretenure) {
   if (length < 0 || length > BigInt::kMaxLength) {
@@ -2042,17 +2278,15 @@ DEFINE_ERROR(WasmRuntimeError, wasm_runtime_error)
 
 Handle<JSFunction> Factory::NewFunction(Handle<Map> map,
                                         Handle<SharedFunctionInfo> info,
-                                        Handle<Object> context_or_undefined,
+                                        Handle<Context> context,
                                         PretenureFlag pretenure) {
   Handle<JSFunction> function(JSFunction::cast(New(map, pretenure)), isolate());
-  DCHECK(context_or_undefined->IsContext() ||
-         context_or_undefined->IsUndefined(isolate()));
 
   function->initialize_properties();
   function->initialize_elements();
   function->set_shared(*info);
   function->set_code(info->GetCode());
-  function->set_context(*context_or_undefined);
+  function->set_context(*context);
   function->set_feedback_cell(*many_closures_cell());
   int header_size;
   if (map->has_prototype_slot()) {
@@ -2079,8 +2313,9 @@ Handle<JSFunction> Factory::NewFunction(const NewFunctionArgs& args) {
   // Create the SharedFunctionInfo.
   Handle<Context> context(isolate()->native_context());
   Handle<Map> map = args.GetMap(isolate());
-  Handle<SharedFunctionInfo> info = NewSharedFunctionInfo(
-      args.name_, args.maybe_code_, args.maybe_builtin_id_, kNormalFunction);
+  Handle<SharedFunctionInfo> info =
+      NewSharedFunctionInfo(args.name_, args.maybe_exported_function_data_,
+                            args.maybe_builtin_id_, kNormalFunction);
 
   // Proper language mode in shared function info will be set later.
   DCHECK(is_sloppy(info->language_mode()));
@@ -2157,27 +2392,32 @@ Handle<JSFunction> Factory::NewFunction(const NewFunctionArgs& args) {
 Handle<JSObject> Factory::NewFunctionPrototype(Handle<JSFunction> function) {
   // Make sure to use globals from the function's context, since the function
   // can be from a different context.
-  Handle<Context> native_context(function->context()->native_context());
+  Handle<Context> native_context(function->context()->native_context(),
+                                 isolate());
   Handle<Map> new_map;
   if (V8_UNLIKELY(IsAsyncGeneratorFunction(function->shared()->kind()))) {
-    new_map = handle(native_context->async_generator_object_prototype_map());
+    new_map = handle(native_context->async_generator_object_prototype_map(),
+                     isolate());
   } else if (IsResumableFunction(function->shared()->kind())) {
     // Generator and async function prototypes can share maps since they
     // don't have "constructor" properties.
-    new_map = handle(native_context->generator_object_prototype_map());
+    new_map =
+        handle(native_context->generator_object_prototype_map(), isolate());
   } else {
     // Each function prototype gets a fresh map to avoid unwanted sharing of
     // maps between prototypes of different constructors.
-    Handle<JSFunction> object_function(native_context->object_function());
+    Handle<JSFunction> object_function(native_context->object_function(),
+                                       isolate());
     DCHECK(object_function->has_initial_map());
-    new_map = handle(object_function->initial_map());
+    new_map = handle(object_function->initial_map(), isolate());
   }
 
   DCHECK(!new_map->is_prototype_map());
   Handle<JSObject> prototype = NewJSObjectFromMap(new_map);
 
   if (!IsResumableFunction(function->shared()->kind())) {
-    JSObject::AddProperty(prototype, constructor_string(), function, DONT_ENUM);
+    JSObject::AddProperty(isolate(), prototype, constructor_string(), function,
+                          DONT_ENUM);
   }
 
   return prototype;
@@ -2187,7 +2427,8 @@ Handle<JSFunction> Factory::NewFunctionFromSharedFunctionInfo(
     Handle<SharedFunctionInfo> info, Handle<Context> context,
     PretenureFlag pretenure) {
   Handle<Map> initial_map(
-      Map::cast(context->native_context()->get(info->function_map_index())));
+      Map::cast(context->native_context()->get(info->function_map_index())),
+      isolate());
   return NewFunctionFromSharedFunctionInfo(initial_map, info, context,
                                            pretenure);
 }
@@ -2196,33 +2437,32 @@ Handle<JSFunction> Factory::NewFunctionFromSharedFunctionInfo(
     Handle<SharedFunctionInfo> info, Handle<Context> context,
     Handle<FeedbackCell> feedback_cell, PretenureFlag pretenure) {
   Handle<Map> initial_map(
-      Map::cast(context->native_context()->get(info->function_map_index())));
+      Map::cast(context->native_context()->get(info->function_map_index())),
+      isolate());
   return NewFunctionFromSharedFunctionInfo(initial_map, info, context,
                                            feedback_cell, pretenure);
 }
 
 Handle<JSFunction> Factory::NewFunctionFromSharedFunctionInfo(
     Handle<Map> initial_map, Handle<SharedFunctionInfo> info,
-    Handle<Object> context_or_undefined, PretenureFlag pretenure) {
+    Handle<Context> context, PretenureFlag pretenure) {
   DCHECK_EQ(JS_FUNCTION_TYPE, initial_map->instance_type());
   Handle<JSFunction> result =
-      NewFunction(initial_map, info, context_or_undefined, pretenure);
+      NewFunction(initial_map, info, context, pretenure);
 
-  if (context_or_undefined->IsContext()) {
-    // Give compiler a chance to pre-initialize.
-    Compiler::PostInstantiation(result, pretenure);
-  }
+  // Give compiler a chance to pre-initialize.
+  Compiler::PostInstantiation(result, pretenure);
 
   return result;
 }
 
 Handle<JSFunction> Factory::NewFunctionFromSharedFunctionInfo(
     Handle<Map> initial_map, Handle<SharedFunctionInfo> info,
-    Handle<Object> context_or_undefined, Handle<FeedbackCell> feedback_cell,
+    Handle<Context> context, Handle<FeedbackCell> feedback_cell,
     PretenureFlag pretenure) {
   DCHECK_EQ(JS_FUNCTION_TYPE, initial_map->instance_type());
   Handle<JSFunction> result =
-      NewFunction(initial_map, info, context_or_undefined, pretenure);
+      NewFunction(initial_map, info, context, pretenure);
 
   // Bump the closure count that is encoded in the feedback cell's map.
   if (feedback_cell->map() == *no_closures_cell_map()) {
@@ -2242,10 +2482,8 @@ Handle<JSFunction> Factory::NewFunctionFromSharedFunctionInfo(
   }
   result->set_feedback_cell(*feedback_cell);
 
-  if (context_or_undefined->IsContext()) {
-    // Give compiler a chance to pre-initialize.
-    Compiler::PostInstantiation(result, pretenure);
-  }
+  // Give compiler a chance to pre-initialize.
+  Compiler::PostInstantiation(result, pretenure);
 
   return result;
 }
@@ -2268,8 +2506,34 @@ Handle<PreParsedScopeData> Factory::NewPreParsedScopeData() {
   return result;
 }
 
+Handle<UncompiledDataWithoutPreParsedScope>
+Factory::NewUncompiledDataWithoutPreParsedScope(int32_t start_position,
+                                                int32_t end_position) {
+  Handle<UncompiledDataWithoutPreParsedScope> result(
+      UncompiledDataWithoutPreParsedScope::cast(
+          New(uncompiled_data_without_pre_parsed_scope_map(), TENURED)),
+      isolate());
+  result->set_start_position(start_position);
+  result->set_end_position(end_position);
+  return result;
+}
+
+Handle<UncompiledDataWithPreParsedScope>
+Factory::NewUncompiledDataWithPreParsedScope(
+    int32_t start_position, int32_t end_position,
+    Handle<PreParsedScopeData> pre_parsed_scope_data) {
+  Handle<UncompiledDataWithPreParsedScope> result(
+      UncompiledDataWithPreParsedScope::cast(
+          New(uncompiled_data_with_pre_parsed_scope_map(), TENURED)),
+      isolate());
+  result->set_start_position(start_position);
+  result->set_end_position(end_position);
+  result->set_pre_parsed_scope_data(*pre_parsed_scope_data);
+  return result;
+}
+
 Handle<JSObject> Factory::NewExternal(void* value) {
-  Handle<Foreign> foreign = NewForeign(static_cast<Address>(value));
+  Handle<Foreign> foreign = NewForeign(reinterpret_cast<Address>(value));
   Handle<JSObject> external = NewJSObjectFromMap(external_map());
   external->SetEmbedderField(0, *foreign);
   return external;
@@ -2285,15 +2549,15 @@ Handle<CodeDataContainer> Factory::NewCodeDataContainer(int flags) {
   return data_container;
 }
 
-Handle<Code> Factory::NewCode(
+MaybeHandle<Code> Factory::TryNewCode(
     const CodeDesc& desc, Code::Kind kind, Handle<Object> self_ref,
     int32_t builtin_index, MaybeHandle<ByteArray> maybe_source_position_table,
     MaybeHandle<DeoptimizationData> maybe_deopt_data, Movability movability,
     uint32_t stub_key, bool is_turbofanned, int stack_slots,
     int safepoint_table_offset, int handler_table_offset) {
+  // Allocate objects needed for code initialization.
   Handle<ByteArray> reloc_info = NewByteArray(desc.reloc_size, TENURED);
   Handle<CodeDataContainer> data_container = NewCodeDataContainer(0);
-
   Handle<ByteArray> source_position_table =
       maybe_source_position_table.is_null()
           ? empty_byte_array()
@@ -2301,116 +2565,110 @@ Handle<Code> Factory::NewCode(
   Handle<DeoptimizationData> deopt_data =
       maybe_deopt_data.is_null() ? DeoptimizationData::Empty(isolate())
                                  : maybe_deopt_data.ToHandleChecked();
+  Handle<Code> code;
+  {
+    int object_size = ComputeCodeObjectSize(desc);
 
-  bool has_unwinding_info = desc.unwinding_info != nullptr;
-  DCHECK((has_unwinding_info && desc.unwinding_info_size > 0) ||
-         (!has_unwinding_info && desc.unwinding_info_size == 0));
+    Heap* heap = isolate()->heap();
+    CodePageCollectionMemoryModificationScope code_allocation(heap);
+    HeapObject* result =
+        heap->AllocateRawWithLightRetry(object_size, CODE_SPACE);
 
-  // Compute size.
-  int body_size = desc.instr_size;
-  int unwinding_info_size_field_size = kInt64Size;
-  if (has_unwinding_info) {
-    body_size = RoundUp(body_size, kInt64Size) + desc.unwinding_info_size +
-                unwinding_info_size_field_size;
-  }
-  int object_size = Code::SizeFor(RoundUp(body_size, kObjectAlignment));
-  DCHECK(IsAligned(static_cast<intptr_t>(object_size), kCodeAlignment));
+    // Return an empty handle if we cannot allocate the code object.
+    if (!result) return MaybeHandle<Code>();
 
-  Heap* heap = isolate()->heap();
-  CodePageCollectionMemoryModificationScope code_allocation(heap);
-  HeapObject* result = heap->AllocateRawWithRetry(object_size, CODE_SPACE);
-
-  if (movability == kImmovable) {
-    MemoryChunk* chunk = MemoryChunk::FromAddress(result->address());
-    // Code objects which should stay at a fixed address are allocated either
-    // in the first page of code space, in large object space, or (during
-    // snapshot creation) the containing page is marked as immovable.
-    if (!Heap::IsImmovable(result)) {
-      if (isolate()->serializer_enabled() ||
-          heap->code_space_->FirstPage()->Contains(result->address())) {
-        chunk->MarkNeverEvacuate();
-      } else {
-        // Discard the first code allocation, which was on a page where it could
-        // be moved.
-        heap->CreateFillerObjectAt(result->address(), object_size,
-                                   ClearRecordedSlots::kNo);
-        result = heap->AllocateRawCodeInLargeObjectSpace(object_size);
-        heap->UnprotectAndRegisterMemoryChunk(result);
-        heap->ZapCodeObject(result->address(), object_size);
-        heap->OnAllocationEvent(result, object_size);
-      }
+    if (movability == kImmovable) {
+      result = heap->EnsureImmovableCode(result, object_size);
     }
+
+    // The code object has not been fully initialized yet.  We rely on the
+    // fact that no allocation will happen from this point on.
+    DisallowHeapAllocation no_gc;
+
+    result->set_map_after_allocation(*code_map(), SKIP_WRITE_BARRIER);
+    code = handle(Code::cast(result), isolate());
+
+    InitializeCode(heap, code, object_size, desc, kind, self_ref, builtin_index,
+                   source_position_table, deopt_data, reloc_info,
+                   data_container, stub_key, is_turbofanned, stack_slots,
+                   safepoint_table_offset, handler_table_offset);
   }
+  // Flush the instruction cache after changing the permissions.
+  code->FlushICache();
 
-  result->set_map_after_allocation(*code_map(), SKIP_WRITE_BARRIER);
-  Handle<Code> code(Code::cast(result), isolate());
-  DCHECK(IsAligned(bit_cast<intptr_t>(code->address()), kCodeAlignment));
-  DCHECK(!heap->memory_allocator()->code_range()->valid() ||
-         heap->memory_allocator()->code_range()->contains(code->address()) ||
-         object_size <= heap->code_space()->AreaSize());
+  return code;
+}
 
-  // The code object has not been fully initialized yet.  We rely on the
-  // fact that no allocation will happen from this point on.
-  DisallowHeapAllocation no_gc;
-  code->set_raw_instruction_size(desc.instr_size);
-  code->set_relocation_info(*reloc_info);
-  code->initialize_flags(kind, has_unwinding_info, is_turbofanned, stack_slots);
-  code->set_safepoint_table_offset(safepoint_table_offset);
-  code->set_handler_table_offset(handler_table_offset);
-  code->set_code_data_container(*data_container);
-  code->set_deoptimization_data(*deopt_data);
-  code->set_stub_key(stub_key);
-  code->set_source_position_table(*source_position_table);
-  code->set_constant_pool_offset(desc.instr_size - desc.constant_pool_size);
-  code->set_builtin_index(builtin_index);
+Handle<Code> Factory::NewCode(
+    const CodeDesc& desc, Code::Kind kind, Handle<Object> self_ref,
+    int32_t builtin_index, MaybeHandle<ByteArray> maybe_source_position_table,
+    MaybeHandle<DeoptimizationData> maybe_deopt_data, Movability movability,
+    uint32_t stub_key, bool is_turbofanned, int stack_slots,
+    int safepoint_table_offset, int handler_table_offset) {
+  // Allocate objects needed for code initialization.
+  Handle<ByteArray> reloc_info = NewByteArray(desc.reloc_size, TENURED);
+  Handle<CodeDataContainer> data_container = NewCodeDataContainer(0);
+  Handle<ByteArray> source_position_table =
+      maybe_source_position_table.is_null()
+          ? empty_byte_array()
+          : maybe_source_position_table.ToHandleChecked();
+  Handle<DeoptimizationData> deopt_data =
+      maybe_deopt_data.is_null() ? DeoptimizationData::Empty(isolate())
+                                 : maybe_deopt_data.ToHandleChecked();
 
-  // Allow self references to created code object by patching the handle to
-  // point to the newly allocated Code object.
-  if (!self_ref.is_null()) *(self_ref.location()) = *code;
+  Handle<Code> code;
+  {
+    int object_size = ComputeCodeObjectSize(desc);
 
-  // Migrate generated code.
-  // The generated code can contain Object** values (typically from handles)
-  // that are dereferenced during the copy to point directly to the actual heap
-  // objects. These pointers can include references to the code object itself,
-  // through the self_reference parameter.
-  code->CopyFrom(desc);
+    Heap* heap = isolate()->heap();
+    CodePageCollectionMemoryModificationScope code_allocation(heap);
+    HeapObject* result =
+        heap->AllocateRawWithRetryOrFail(object_size, CODE_SPACE);
 
-  code->clear_padding();
+    if (movability == kImmovable) {
+      result = heap->EnsureImmovableCode(result, object_size);
+    }
+
+    // The code object has not been fully initialized yet.  We rely on the
+    // fact that no allocation will happen from this point on.
+    DisallowHeapAllocation no_gc;
+
+    result->set_map_after_allocation(*code_map(), SKIP_WRITE_BARRIER);
+    code = handle(Code::cast(result), isolate());
+
+    InitializeCode(heap, code, object_size, desc, kind, self_ref, builtin_index,
+                   source_position_table, deopt_data, reloc_info,
+                   data_container, stub_key, is_turbofanned, stack_slots,
+                   safepoint_table_offset, handler_table_offset);
+  }
+  // Flush the instruction cache after changing the permissions.
+  code->FlushICache();
 
-#ifdef VERIFY_HEAP
-  if (FLAG_verify_heap) code->ObjectVerify();
-#endif
-  DCHECK(IsAligned(bit_cast<intptr_t>(code->address()), kCodeAlignment));
-  DCHECK(!isolate()->heap()->memory_allocator()->code_range()->valid() ||
-         isolate()->heap()->memory_allocator()->code_range()->contains(
-             code->address()) ||
-         object_size <= isolate()->heap()->code_space()->AreaSize());
   return code;
 }
 
 Handle<Code> Factory::NewCodeForDeserialization(uint32_t size) {
   DCHECK(IsAligned(static_cast<intptr_t>(size), kCodeAlignment));
   Heap* heap = isolate()->heap();
-  HeapObject* result = heap->AllocateRawWithRetry(size, CODE_SPACE);
+  HeapObject* result = heap->AllocateRawWithRetryOrFail(size, CODE_SPACE);
   // Unprotect the memory chunk of the object if it was not unprotected
   // already.
   heap->UnprotectAndRegisterMemoryChunk(result);
   heap->ZapCodeObject(result->address(), size);
   result->set_map_after_allocation(*code_map(), SKIP_WRITE_BARRIER);
-  DCHECK(IsAligned(bit_cast<intptr_t>(result->address()), kCodeAlignment));
+  DCHECK(IsAligned(result->address(), kCodeAlignment));
   DCHECK(!heap->memory_allocator()->code_range()->valid() ||
          heap->memory_allocator()->code_range()->contains(result->address()) ||
          static_cast<int>(size) <= heap->code_space()->AreaSize());
   return handle(Code::cast(result), isolate());
 }
 
-#ifdef V8_EMBEDDED_BUILTINS
 Handle<Code> Factory::NewOffHeapTrampolineFor(Handle<Code> code,
                                               Address off_heap_entry) {
-  DCHECK(isolate()->serializer_enabled());
-  DCHECK_NOT_NULL(isolate()->embedded_blob());
-  DCHECK_NE(0, isolate()->embedded_blob_size());
-  DCHECK(Builtins::IsEmbeddedBuiltin(*code));
+  CHECK(isolate()->serializer_enabled());
+  CHECK_NOT_NULL(isolate()->embedded_blob());
+  CHECK_NE(0, isolate()->embedded_blob_size());
+  CHECK(Builtins::IsIsolateIndependentBuiltin(*code));
 
   Handle<Code> result =
       Builtins::GenerateOffHeapTrampolineFor(isolate(), off_heap_entry);
@@ -2418,9 +2676,11 @@ Handle<Code> Factory::NewOffHeapTrampolineFor(Handle<Code> code,
   // The trampoline code object must inherit specific flags from the original
   // builtin (e.g. the safepoint-table offset). We set them manually here.
 
+  const bool set_is_off_heap_trampoline = true;
   const int stack_slots = code->has_safepoint_info() ? code->stack_slots() : 0;
   result->initialize_flags(code->kind(), code->has_unwinding_info(),
-                           code->is_turbofanned(), stack_slots);
+                           code->is_turbofanned(), stack_slots,
+                           set_is_off_heap_trampoline);
   result->set_builtin_index(code->builtin_index());
   result->set_handler_table_offset(code->handler_table_offset());
   result->code_data_container()->set_kind_specific_flags(
@@ -2432,7 +2692,6 @@ Handle<Code> Factory::NewOffHeapTrampolineFor(Handle<Code> code,
 
   return result;
 }
-#endif
 
 Handle<Code> Factory::CopyCode(Handle<Code> code) {
   Handle<CodeDataContainer> data_container =
@@ -2440,7 +2699,7 @@ Handle<Code> Factory::CopyCode(Handle<Code> code) {
 
   Heap* heap = isolate()->heap();
   int obj_size = code->Size();
-  HeapObject* result = heap->AllocateRawWithRetry(obj_size, CODE_SPACE);
+  HeapObject* result = heap->AllocateRawWithRetryOrFail(obj_size, CODE_SPACE);
 
   // Copy code object.
   Address old_addr = code->address();
@@ -2459,9 +2718,9 @@ Handle<Code> Factory::CopyCode(Handle<Code> code) {
   heap->RecordWritesIntoCode(*new_code);
 
 #ifdef VERIFY_HEAP
-  if (FLAG_verify_heap) new_code->ObjectVerify();
+  if (FLAG_verify_heap) new_code->ObjectVerify(isolate());
 #endif
-  DCHECK(IsAligned(bit_cast<intptr_t>(new_code->address()), kCodeAlignment));
+  DCHECK(IsAligned(new_code->address(), kCodeAlignment));
   DCHECK(
       !heap->memory_allocator()->code_range()->valid() ||
       heap->memory_allocator()->code_range()->contains(new_code->address()) ||
@@ -2494,16 +2753,16 @@ Handle<BytecodeArray> Factory::CopyBytecodeArray(
 Handle<JSObject> Factory::NewJSObject(Handle<JSFunction> constructor,
                                       PretenureFlag pretenure) {
   JSFunction::EnsureHasInitialMap(constructor);
-  Handle<Map> map(constructor->initial_map());
+  Handle<Map> map(constructor->initial_map(), isolate());
   return NewJSObjectFromMap(map, pretenure);
 }
 
 Handle<JSObject> Factory::NewJSObjectWithNullProto(PretenureFlag pretenure) {
   Handle<JSObject> result =
       NewJSObject(isolate()->object_function(), pretenure);
-  Handle<Map> new_map =
-      Map::Copy(Handle<Map>(result->map()), "ObjectWithNullProto");
-  Map::SetPrototype(new_map, null_value());
+  Handle<Map> new_map = Map::Copy(
+      isolate(), Handle<Map>(result->map(), isolate()), "ObjectWithNullProto");
+  Map::SetPrototype(isolate(), new_map, null_value());
   JSObject::MigrateToMap(result, new_map);
   return result;
 }
@@ -2511,7 +2770,7 @@ Handle<JSObject> Factory::NewJSObjectWithNullProto(PretenureFlag pretenure) {
 Handle<JSGlobalObject> Factory::NewJSGlobalObject(
     Handle<JSFunction> constructor) {
   DCHECK(constructor->has_initial_map());
-  Handle<Map> map(constructor->initial_map());
+  Handle<Map> map(constructor->initial_map(), isolate());
   DCHECK(map->is_dictionary_map());
 
   // Make sure no field properties are described in the initial map.
@@ -2536,16 +2795,16 @@ Handle<JSGlobalObject> Factory::NewJSGlobalObject(
 
   // The global object might be created from an object template with accessors.
   // Fill these accessors into the dictionary.
-  Handle<DescriptorArray> descs(map->instance_descriptors());
+  Handle<DescriptorArray> descs(map->instance_descriptors(), isolate());
   for (int i = 0; i < map->NumberOfOwnDescriptors(); i++) {
     PropertyDetails details = descs->GetDetails(i);
     // Only accessors are expected.
     DCHECK_EQ(kAccessor, details.kind());
     PropertyDetails d(kAccessor, details.attributes(),
                       PropertyCellType::kMutable);
-    Handle<Name> name(descs->GetKey(i));
+    Handle<Name> name(descs->GetKey(i), isolate());
     Handle<PropertyCell> cell = NewPropertyCell(name);
-    cell->set_value(descs->GetValue(i));
+    cell->set_value(descs->GetStrongValue(i));
     // |dictionary| already contains enough space for all properties.
     USE(GlobalDictionary::Add(dictionary, name, cell, d));
   }
@@ -2556,7 +2815,7 @@ Handle<JSGlobalObject> Factory::NewJSGlobalObject(
   InitializeJSObjectFromMap(global, dictionary, map);
 
   // Create a new map for the global object.
-  Handle<Map> new_map = Map::CopyDropDescriptors(map);
+  Handle<Map> new_map = Map::CopyDropDescriptors(isolate(), map);
   new_map->set_may_have_interesting_symbols(true);
   new_map->set_is_dictionary_map(true);
 
@@ -2607,7 +2866,7 @@ void Factory::InitializeJSObjectBody(Handle<JSObject> obj, Handle<Map> map,
   }
   obj->InitializeBody(*map, start_offset, *undefined_value(), filler);
   if (in_progress) {
-    map->FindRootMap()->InobjectSlackTrackingStep();
+    map->FindRootMap(isolate())->InobjectSlackTrackingStep(isolate());
   }
 }
 
@@ -2652,7 +2911,8 @@ Handle<JSArray> Factory::NewJSArray(ElementsKind elements_kind,
     JSFunction* array_function = native_context->array_function();
     map = array_function->initial_map();
   }
-  return Handle<JSArray>::cast(NewJSObjectFromMap(handle(map), pretenure));
+  return Handle<JSArray>::cast(
+      NewJSObjectFromMap(handle(map, isolate()), pretenure));
 }
 
 Handle<JSArray> Factory::NewJSArray(ElementsKind elements_kind, int length,
@@ -2713,8 +2973,9 @@ void Factory::NewJSArrayStorage(Handle<JSArray> array, int length, int capacity,
 
 Handle<JSWeakMap> Factory::NewJSWeakMap() {
   Context* native_context = isolate()->raw_native_context();
-  Handle<Map> map(native_context->js_weak_map_fun()->initial_map());
-  Handle<JSWeakMap> weakmap(JSWeakMap::cast(*NewJSObjectFromMap(map)));
+  Handle<Map> map(native_context->js_weak_map_fun()->initial_map(), isolate());
+  Handle<JSWeakMap> weakmap(JSWeakMap::cast(*NewJSObjectFromMap(map)),
+                            isolate());
   {
     // Do not leak handles for the hash table, it would make entries strong.
     HandleScope scope(isolate());
@@ -2730,7 +2991,7 @@ Handle<JSModuleNamespace> Factory::NewJSModuleNamespace() {
   FieldIndex index = FieldIndex::ForDescriptor(
       *map, JSModuleNamespace::kToStringTagFieldIndex);
   module_namespace->FastPropertyAtPut(index,
-                                      isolate()->heap()->Module_string());
+                                      ReadOnlyRoots(isolate()).Module_string());
   return module_namespace;
 }
 
@@ -2738,7 +2999,7 @@ Handle<JSGeneratorObject> Factory::NewJSGeneratorObject(
     Handle<JSFunction> function) {
   DCHECK(IsResumableFunction(function->shared()->kind()));
   JSFunction::EnsureHasInitialMap(function);
-  Handle<Map> map(function->initial_map());
+  Handle<Map> map(function->initial_map(), isolate());
 
   DCHECK(map->instance_type() == JS_GENERATOR_OBJECT_TYPE ||
          map->instance_type() == JS_ASYNC_GENERATOR_OBJECT_TYPE);
@@ -2760,18 +3021,19 @@ Handle<Module> Factory::NewModule(Handle<SharedFunctionInfo> code) {
       requested_modules_length > 0 ? NewFixedArray(requested_modules_length)
                                    : empty_fixed_array();
 
+  ReadOnlyRoots roots(isolate());
   Handle<Module> module = Handle<Module>::cast(NewStruct(MODULE_TYPE, TENURED));
   module->set_code(*code);
   module->set_exports(*exports);
   module->set_regular_exports(*regular_exports);
   module->set_regular_imports(*regular_imports);
   module->set_hash(isolate()->GenerateIdentityHash(Smi::kMaxValue));
-  module->set_module_namespace(isolate()->heap()->undefined_value());
+  module->set_module_namespace(roots.undefined_value());
   module->set_requested_modules(*requested_modules);
   module->set_script(Script::cast(code->script()));
   module->set_status(Module::kUninstantiated);
-  module->set_exception(isolate()->heap()->the_hole_value());
-  module->set_import_meta(isolate()->heap()->the_hole_value());
+  module->set_exception(roots.the_hole_value());
+  module->set_import_meta(roots.the_hole_value());
   module->set_dfs_index(-1);
   module->set_dfs_ancestor_index(-1);
   return module;
@@ -2782,14 +3044,16 @@ Handle<JSArrayBuffer> Factory::NewJSArrayBuffer(SharedFlag shared,
   Handle<JSFunction> array_buffer_fun(
       shared == SharedFlag::kShared
           ? isolate()->native_context()->shared_array_buffer_fun()
-          : isolate()->native_context()->array_buffer_fun());
+          : isolate()->native_context()->array_buffer_fun(),
+      isolate());
   Handle<Map> map(array_buffer_fun->initial_map(), isolate());
   return Handle<JSArrayBuffer>::cast(NewJSObjectFromMap(map, pretenure));
 }
 
 Handle<JSIteratorResult> Factory::NewJSIteratorResult(Handle<Object> value,
                                                       bool done) {
-  Handle<Map> map(isolate()->native_context()->iterator_result_map());
+  Handle<Map> map(isolate()->native_context()->iterator_result_map(),
+                  isolate());
   Handle<JSIteratorResult> js_iter_result =
       Handle<JSIteratorResult>::cast(NewJSObjectFromMap(map));
   js_iter_result->set_value(*value);
@@ -2799,7 +3063,8 @@ Handle<JSIteratorResult> Factory::NewJSIteratorResult(Handle<Object> value,
 
 Handle<JSAsyncFromSyncIterator> Factory::NewJSAsyncFromSyncIterator(
     Handle<JSReceiver> sync_iterator, Handle<Object> next) {
-  Handle<Map> map(isolate()->native_context()->async_from_sync_iterator_map());
+  Handle<Map> map(isolate()->native_context()->async_from_sync_iterator_map(),
+                  isolate());
   Handle<JSAsyncFromSyncIterator> iterator =
       Handle<JSAsyncFromSyncIterator>::cast(NewJSObjectFromMap(map));
 
@@ -2809,14 +3074,14 @@ Handle<JSAsyncFromSyncIterator> Factory::NewJSAsyncFromSyncIterator(
 }
 
 Handle<JSMap> Factory::NewJSMap() {
-  Handle<Map> map(isolate()->native_context()->js_map_map());
+  Handle<Map> map(isolate()->native_context()->js_map_map(), isolate());
   Handle<JSMap> js_map = Handle<JSMap>::cast(NewJSObjectFromMap(map));
   JSMap::Initialize(js_map, isolate());
   return js_map;
 }
 
 Handle<JSSet> Factory::NewJSSet() {
-  Handle<Map> map(isolate()->native_context()->js_set_map());
+  Handle<Map> map(isolate()->native_context()->js_set_map(), isolate());
   Handle<JSSet> js_set = Handle<JSSet>::cast(NewJSObjectFromMap(map));
   JSSet::Initialize(js_set, isolate());
   return js_set;
@@ -2934,7 +3199,8 @@ void SetupArrayBufferView(i::Isolate* isolate,
 
 Handle<JSTypedArray> Factory::NewJSTypedArray(ExternalArrayType type,
                                               PretenureFlag pretenure) {
-  Handle<JSFunction> typed_array_fun(GetTypedArrayFun(type, isolate()));
+  Handle<JSFunction> typed_array_fun(GetTypedArrayFun(type, isolate()),
+                                     isolate());
   Handle<Map> map(typed_array_fun->initial_map(), isolate());
   return Handle<JSTypedArray>::cast(NewJSObjectFromMap(map, pretenure));
 }
@@ -3060,7 +3326,7 @@ MaybeHandle<JSBoundFunction> Factory::NewJSBoundFunction(
                         ? isolate()->bound_function_with_constructor_map()
                         : isolate()->bound_function_without_constructor_map();
   if (map->prototype() != *prototype) {
-    map = Map::TransitionToPrototype(map, prototype);
+    map = Map::TransitionToPrototype(isolate(), map, prototype);
   }
   DCHECK_EQ(target_function->IsConstructor(), map->is_constructor());
 
@@ -3116,7 +3382,7 @@ void Factory::ReinitializeJSGlobalProxy(Handle<JSGlobalProxy> object,
                                         isolate());
 
   if (old_map->is_prototype_map()) {
-    map = Map::Copy(map, "CopyAsPrototypeForJSGlobalProxy");
+    map = Map::Copy(isolate(), map, "CopyAsPrototypeForJSGlobalProxy");
     map->set_is_prototype_map(true);
   }
   JSObject::NotifyMapChange(old_map, map, isolate());
@@ -3150,7 +3416,7 @@ Handle<SharedFunctionInfo> Factory::NewSharedFunctionInfoForLiteral(
 
 Handle<JSMessageObject> Factory::NewJSMessageObject(
     MessageTemplate::Template message, Handle<Object> argument,
-    int start_position, int end_position, Handle<Object> script,
+    int start_position, int end_position, Handle<Script> script,
     Handle<Object> stack_frames) {
   Handle<Map> map = message_object_map();
   Handle<JSMessageObject> message_obj(
@@ -3192,7 +3458,7 @@ Handle<SharedFunctionInfo> Factory::NewSharedFunctionInfo(
   Handle<String> shared_name;
   bool has_shared_name = maybe_name.ToHandle(&shared_name);
   if (has_shared_name) {
-    shared_name = String::Flatten(shared_name, TENURED);
+    shared_name = String::Flatten(isolate(), shared_name, TENURED);
   }
 
   Handle<Map> map = shared_function_info_map();
@@ -3230,8 +3496,8 @@ Handle<SharedFunctionInfo> Factory::NewSharedFunctionInfo(
           *empty_feedback_metadata(), SKIP_WRITE_BARRIER);
     }
     share->set_script(*undefined_value(), SKIP_WRITE_BARRIER);
-    share->set_debug_info(Smi::kZero, SKIP_WRITE_BARRIER);
-    share->set_function_identifier(*undefined_value(), SKIP_WRITE_BARRIER);
+    share->set_function_identifier_or_debug_info(*undefined_value(),
+                                                 SKIP_WRITE_BARRIER);
     share->set_function_literal_id(FunctionLiteral::kIdTypeInvalid);
 #if V8_SFI_HAS_UNIQUE_ID
     share->set_unique_id(isolate()->GetNextUniqueSharedFunctionInfoId());
@@ -3241,9 +3507,7 @@ Handle<SharedFunctionInfo> Factory::NewSharedFunctionInfo(
     share->set_length(0);
     share->set_internal_formal_parameter_count(0);
     share->set_expected_nof_properties(0);
-    share->set_raw_start_position_and_type(0);
-    share->set_raw_end_position(0);
-    share->set_function_token_position(0);
+    share->set_raw_function_token_offset(0);
     // All flags default to false or 0.
     share->set_flags(0);
     share->CalculateConstructAsBuiltin();
@@ -3252,13 +3516,12 @@ Handle<SharedFunctionInfo> Factory::NewSharedFunctionInfo(
     share->clear_padding();
   }
   // Link into the list.
-  Handle<Object> new_noscript_list =
-      FixedArrayOfWeakCells::Add(noscript_shared_function_infos(), share);
+  Handle<Object> new_noscript_list = FixedArrayOfWeakCells::Add(
+      isolate(), noscript_shared_function_infos(), share);
   isolate()->heap()->set_noscript_shared_function_infos(*new_noscript_list);
 
-  DCHECK_EQ(SharedFunctionInfo::kNoDebuggingId, share->debugging_id());
 #ifdef VERIFY_HEAP
-  share->SharedFunctionInfoVerify();
+  share->SharedFunctionInfoVerify(isolate());
 #endif
   return share;
 }
@@ -3335,12 +3598,17 @@ Handle<DebugInfo> Factory::NewDebugInfo(Handle<SharedFunctionInfo> shared) {
       Handle<DebugInfo>::cast(NewStruct(DEBUG_INFO_TYPE, TENURED));
   debug_info->set_flags(DebugInfo::kNone);
   debug_info->set_shared(*shared);
-  debug_info->set_debugger_hints(shared->debugger_hints());
-  debug_info->set_debug_bytecode_array(heap->undefined_value());
-  debug_info->set_break_points(heap->empty_fixed_array());
+  debug_info->set_debugger_hints(0);
+  DCHECK_EQ(DebugInfo::kNoDebuggingId, debug_info->debugging_id());
+  DCHECK(!shared->HasDebugInfo());
+  debug_info->set_function_identifier(
+      shared->function_identifier_or_debug_info());
+  debug_info->set_original_bytecode_array(
+      ReadOnlyRoots(heap).undefined_value());
+  debug_info->set_break_points(ReadOnlyRoots(heap).empty_fixed_array());
 
   // Link debug info to function.
-  shared->set_debug_info(*debug_info);
+  shared->SetDebugInfo(*debug_info);
 
   return debug_info;
 }
@@ -3560,9 +3828,11 @@ Handle<RegExpMatchInfo> Factory::NewRegExpMatchInfo() {
 }
 
 Handle<Object> Factory::GlobalConstantFor(Handle<Name> name) {
-  if (Name::Equals(name, undefined_string())) return undefined_value();
-  if (Name::Equals(name, NaN_string())) return nan_value();
-  if (Name::Equals(name, Infinity_string())) return infinity_value();
+  if (Name::Equals(isolate(), name, undefined_string())) {
+    return undefined_value();
+  }
+  if (Name::Equals(isolate(), name, NaN_string())) return nan_value();
+  if (Name::Equals(isolate(), name, Infinity_string())) return infinity_value();
   return Handle<Object>::null();
 }
 
@@ -3599,13 +3869,13 @@ Handle<Map> Factory::CreateSloppyFunctionMap(
   map->set_is_callable(true);
   Handle<JSFunction> empty_function;
   if (maybe_empty_function.ToHandle(&empty_function)) {
-    Map::SetPrototype(map, empty_function);
+    Map::SetPrototype(isolate(), map, empty_function);
   }
 
   //
   // Setup descriptors array.
   //
-  Map::EnsureDescriptorSlack(map, descriptors_count);
+  Map::EnsureDescriptorSlack(isolate(), map, descriptors_count);
 
   PropertyAttributes ro_attribs =
       static_cast<PropertyAttributes>(DONT_ENUM | DONT_DELETE | READ_ONLY);
@@ -3676,12 +3946,12 @@ Handle<Map> Factory::CreateStrictFunctionMap(
   map->set_has_prototype_slot(has_prototype);
   map->set_is_constructor(has_prototype);
   map->set_is_callable(true);
-  Map::SetPrototype(map, empty_function);
+  Map::SetPrototype(isolate(), map, empty_function);
 
   //
   // Setup descriptors array.
   //
-  Map::EnsureDescriptorSlack(map, descriptors_count);
+  Map::EnsureDescriptorSlack(isolate(), map, descriptors_count);
 
   PropertyAttributes rw_attribs =
       static_cast<PropertyAttributes>(DONT_ENUM | DONT_DELETE);
@@ -3741,12 +4011,12 @@ Handle<Map> Factory::CreateClassFunctionMap(Handle<JSFunction> empty_function) {
   map->set_is_constructor(true);
   map->set_is_prototype_map(true);
   map->set_is_callable(true);
-  Map::SetPrototype(map, empty_function);
+  Map::SetPrototype(isolate(), map, empty_function);
 
   //
   // Setup descriptors array.
   //
-  Map::EnsureDescriptorSlack(map, 2);
+  Map::EnsureDescriptorSlack(isolate(), map, 2);
 
   PropertyAttributes ro_attribs =
       static_cast<PropertyAttributes>(DONT_ENUM | DONT_DELETE | READ_ONLY);
@@ -3792,7 +4062,7 @@ Handle<CallHandlerInfo> Factory::NewCallHandlerInfo(bool has_no_side_effect) {
                         : side_effect_call_handler_info_map();
   Handle<CallHandlerInfo> info(CallHandlerInfo::cast(New(map, TENURED)),
                                isolate());
-  Object* undefined_value = isolate()->heap()->undefined_value();
+  Object* undefined_value = ReadOnlyRoots(isolate()).undefined_value();
   info->set_callback(undefined_value);
   info->set_js_callback(undefined_value);
   info->set_data(undefined_value);
@@ -3800,12 +4070,13 @@ Handle<CallHandlerInfo> Factory::NewCallHandlerInfo(bool has_no_side_effect) {
 }
 
 // static
-NewFunctionArgs NewFunctionArgs::ForWasm(Handle<String> name, Handle<Code> code,
-                                         Handle<Map> map) {
+NewFunctionArgs NewFunctionArgs::ForWasm(
+    Handle<String> name,
+    Handle<WasmExportedFunctionData> exported_function_data, Handle<Map> map) {
   NewFunctionArgs args;
   args.name_ = name;
   args.maybe_map_ = map;
-  args.maybe_code_ = code;
+  args.maybe_exported_function_data_ = exported_function_data;
   args.language_mode_ = LanguageMode::kSloppy;
   args.prototype_mutability_ = MUTABLE;
 
diff --git a/deps/v8/src/heap/factory.h b/deps/v8/src/heap/factory.h
index ead1d0d24c5d4d..58374be3729996 100644
--- a/deps/v8/src/heap/factory.h
+++ b/deps/v8/src/heap/factory.h
@@ -15,6 +15,7 @@
 #include "src/objects/hash-table.h"
 #include "src/objects/js-array.h"
 #include "src/objects/js-regexp.h"
+#include "src/objects/ordered-hash-table.h"
 #include "src/objects/string.h"
 
 namespace v8 {
@@ -22,12 +23,14 @@ namespace internal {
 
 // Forward declarations.
 class AliasedArgumentsEntry;
-class BoilerplateDescription;
+class ObjectBoilerplateDescription;
 class BreakPoint;
 class BreakPointInfo;
 class CallableTask;
 class CallbackTask;
-class ConstantElementsPair;
+class CallHandlerInfo;
+class Expression;
+class ArrayBoilerplateDescription;
 class CoverageInfo;
 class DebugInfo;
 class EnumCache;
@@ -48,6 +51,9 @@ class RegExpMatchInfo;
 class ScriptContextTable;
 class StoreHandler;
 class TemplateObjectDescription;
+class UncompiledDataWithoutPreParsedScope;
+class UncompiledDataWithPreParsedScope;
+class WasmExportedFunctionData;
 struct SourceRange;
 template <typename T>
 class ZoneVector;
@@ -81,11 +87,15 @@ enum FunctionMode {
 };
 
 // Interface for handle based allocation.
-class V8_EXPORT_PRIVATE Factory final {
+class V8_EXPORT_PRIVATE Factory {
  public:
   Handle<Oddball> NewOddball(Handle<Map> map, const char* to_string,
                              Handle<Object> to_number, const char* type_of,
-                             byte kind);
+                             byte kind,
+                             PretenureFlag pretenure = TENURED_READ_ONLY);
+
+  // Marks self references within code generation.
+  Handle<Oddball> NewSelfReferenceMarker(PretenureFlag pretenure = TENURED);
 
   // Allocates a fixed array-like object with given map and initialized with
   // undefined values.
@@ -93,6 +103,13 @@ class V8_EXPORT_PRIVATE Factory final {
   Handle<T> NewFixedArrayWithMap(Heap::RootListIndex map_root_index, int length,
                                  PretenureFlag pretenure = NOT_TENURED);
 
+  // Allocates a weak fixed array-like object with given map and initialized
+  // with undefined values.
+  template <typename T = WeakFixedArray>
+  Handle<T> NewWeakFixedArrayWithMap(Heap::RootListIndex map_root_index,
+                                     int length,
+                                     PretenureFlag pretenure = NOT_TENURED);
+
   // Allocates a fixed array initialized with undefined values.
   Handle<FixedArray> NewFixedArray(int length,
                                    PretenureFlag pretenure = NOT_TENURED);
@@ -129,10 +146,8 @@ class V8_EXPORT_PRIVATE Factory final {
 
   // Allocates a fixed array for name-value pairs of boilerplate properties and
   // calculates the number of properties we need to store in the backing store.
-  Handle<BoilerplateDescription> NewBoilerplateDescription(int boilerplate,
-                                                           int all_properties,
-                                                           int index_keys,
-                                                           bool has_seen_proto);
+  Handle<ObjectBoilerplateDescription> NewObjectBoilerplateDescription(
+      int boilerplate, int all_properties, int index_keys, bool has_seen_proto);
 
   // Allocate a new uninitialized fixed double array.
   // The function returns a pre-allocated empty fixed array for length = 0,
@@ -145,7 +160,8 @@ class V8_EXPORT_PRIVATE Factory final {
       int size, PretenureFlag pretenure = NOT_TENURED);
 
   // Allocates a FeedbackMedata object and zeroes the data section.
-  Handle<FeedbackMetadata> NewFeedbackMetadata(int slot_count);
+  Handle<FeedbackMetadata> NewFeedbackMetadata(int slot_count,
+                                               PretenureFlag tenure = TENURED);
 
   Handle<FrameArray> NewFrameArray(int number_of_frames,
                                    PretenureFlag pretenure = NOT_TENURED);
@@ -175,12 +191,8 @@ class V8_EXPORT_PRIVATE Factory final {
   Handle<Tuple3> NewTuple3(Handle<Object> value1, Handle<Object> value2,
                            Handle<Object> value3, PretenureFlag pretenure);
 
-  // Create a new ContextExtension struct.
-  Handle<ContextExtension> NewContextExtension(Handle<ScopeInfo> scope_info,
-                                               Handle<Object> extension);
-
-  // Create a new ConstantElementsPair struct.
-  Handle<ConstantElementsPair> NewConstantElementsPair(
+  // Create a new ArrayBoilerplateDescription struct.
+  Handle<ArrayBoilerplateDescription> NewArrayBoilerplateDescription(
       ElementsKind elements_kind, Handle<FixedArrayBase> constant_values);
 
   // Create a new TemplateObjectDescription struct.
@@ -337,40 +349,36 @@ class V8_EXPORT_PRIVATE Factory final {
   Handle<ExternalOneByteString> NewNativeSourceString(
       const ExternalOneByteString::Resource* resource);
 
-  // Create a symbol in old space.
-  Handle<Symbol> NewSymbol();
-  Handle<Symbol> NewPrivateSymbol();
+  // Create a symbol in old or read-only space.
+  Handle<Symbol> NewSymbol(PretenureFlag pretenure = TENURED);
+  Handle<Symbol> NewPrivateSymbol(PretenureFlag pretenure = TENURED);
   Handle<Symbol> NewPrivateFieldSymbol();
 
   // Create a global (but otherwise uninitialized) context.
   Handle<Context> NewNativeContext();
 
   // Create a script context.
-  Handle<Context> NewScriptContext(Handle<JSFunction> function,
+  Handle<Context> NewScriptContext(Handle<Context> outer,
                                    Handle<ScopeInfo> scope_info);
 
   // Create an empty script context table.
   Handle<ScriptContextTable> NewScriptContextTable();
 
   // Create a module context.
-  Handle<Context> NewModuleContext(Handle<Module> module,
-                                   Handle<JSFunction> function,
+  Handle<Context> NewModuleContext(Handle<Module> module, Handle<Context> outer,
                                    Handle<ScopeInfo> scope_info);
 
   // Create a function or eval context.
-  Handle<Context> NewFunctionContext(int length, Handle<JSFunction> function,
-                                     ScopeType scope_type);
+  Handle<Context> NewFunctionContext(Handle<Context> outer,
+                                     Handle<ScopeInfo> scope_info);
 
   // Create a catch context.
-  Handle<Context> NewCatchContext(Handle<JSFunction> function,
-                                  Handle<Context> previous,
+  Handle<Context> NewCatchContext(Handle<Context> previous,
                                   Handle<ScopeInfo> scope_info,
-                                  Handle<String> name,
                                   Handle<Object> thrown_object);
 
   // Create a 'with' context.
-  Handle<Context> NewWithContext(Handle<JSFunction> function,
-                                 Handle<Context> previous,
+  Handle<Context> NewWithContext(Handle<Context> previous,
                                  Handle<ScopeInfo> scope_info,
                                  Handle<JSReceiver> extension);
 
@@ -381,10 +389,16 @@ class V8_EXPORT_PRIVATE Factory final {
                                           Handle<StringSet> whitelist);
 
   // Create a block context.
-  Handle<Context> NewBlockContext(Handle<JSFunction> function,
-                                  Handle<Context> previous,
+  Handle<Context> NewBlockContext(Handle<Context> previous,
                                   Handle<ScopeInfo> scope_info);
 
+  // Create a context that's used by builtin functions.
+  //
+  // These are similar to function context but don't have a previous
+  // context or any scope info. These are used to store spec defined
+  // context values.
+  Handle<Context> NewBuiltinContext(Handle<Context> native_context, int length);
+
   Handle<Struct> NewStruct(InstanceType type,
                            PretenureFlag pretenure = NOT_TENURED);
 
@@ -393,7 +407,11 @@ class V8_EXPORT_PRIVATE Factory final {
 
   Handle<AccessorInfo> NewAccessorInfo();
 
-  Handle<Script> NewScript(Handle<String> source);
+  Handle<Script> NewScript(Handle<String> source,
+                           PretenureFlag tenure = TENURED);
+  Handle<Script> NewScriptWithId(Handle<String> source, int script_id,
+                                 PretenureFlag tenure = TENURED);
+  Handle<Script> CloneScript(Handle<Script> script);
 
   Handle<BreakPointInfo> NewBreakPointInfo(int source_position);
   Handle<BreakPoint> NewBreakPoint(int id, Handle<String> condition);
@@ -433,18 +451,21 @@ class V8_EXPORT_PRIVATE Factory final {
 
   Handle<Cell> NewCell(Handle<Object> value);
 
-  Handle<PropertyCell> NewPropertyCell(Handle<Name> name);
+  Handle<PropertyCell> NewPropertyCell(Handle<Name> name,
+                                       PretenureFlag pretenure = TENURED);
 
-  Handle<WeakCell> NewWeakCell(Handle<HeapObject> value);
+  Handle<WeakCell> NewWeakCell(Handle<HeapObject> value,
+                               PretenureFlag pretenure = TENURED);
 
   Handle<FeedbackCell> NewNoClosuresCell(Handle<HeapObject> value);
   Handle<FeedbackCell> NewOneClosureCell(Handle<HeapObject> value);
   Handle<FeedbackCell> NewManyClosuresCell(Handle<HeapObject> value);
 
-  Handle<TransitionArray> NewTransitionArray(int capacity);
+  Handle<TransitionArray> NewTransitionArray(int number_of_transitions,
+                                             int slack = 0);
 
   // Allocate a tenured AllocationSite. Its payload is null.
-  Handle<AllocationSite> NewAllocationSite();
+  Handle<AllocationSite> NewAllocationSite(bool with_weak_next);
 
   // Allocates and initializes a new Map.
   Handle<Map> NewMap(InstanceType type, int instance_size,
@@ -477,6 +498,14 @@ class V8_EXPORT_PRIVATE Factory final {
       Handle<FixedArray> array, int grow_by,
       PretenureFlag pretenure = NOT_TENURED);
 
+  Handle<WeakFixedArray> CopyWeakFixedArrayAndGrow(
+      Handle<WeakFixedArray> array, int grow_by,
+      PretenureFlag pretenure = NOT_TENURED);
+
+  Handle<WeakArrayList> CopyWeakArrayListAndGrow(
+      Handle<WeakArrayList> array, int grow_by,
+      PretenureFlag pretenure = NOT_TENURED);
+
   Handle<PropertyArray> CopyPropertyArrayAndGrow(
       Handle<PropertyArray> array, int grow_by,
       PretenureFlag pretenure = NOT_TENURED);
@@ -507,18 +536,21 @@ class V8_EXPORT_PRIVATE Factory final {
   inline Handle<Object> NewNumberFromInt64(
       int64_t value, PretenureFlag pretenure = NOT_TENURED);
   inline Handle<HeapNumber> NewHeapNumber(
-      double value, MutableMode mode = IMMUTABLE,
-      PretenureFlag pretenure = NOT_TENURED);
+      double value, PretenureFlag pretenure = NOT_TENURED);
   inline Handle<HeapNumber> NewHeapNumberFromBits(
-      uint64_t bits, MutableMode mode = IMMUTABLE,
-      PretenureFlag pretenure = NOT_TENURED);
-  // Creates mutable heap number object with value field set to hole NaN.
-  inline Handle<HeapNumber> NewMutableHeapNumber(
-      PretenureFlag pretenure = NOT_TENURED);
+      uint64_t bits, PretenureFlag pretenure = NOT_TENURED);
 
   // Creates heap number object with not yet set value field.
-  Handle<HeapNumber> NewHeapNumber(MutableMode mode,
-                                   PretenureFlag pretenure = NOT_TENURED);
+  Handle<HeapNumber> NewHeapNumber(PretenureFlag pretenure = NOT_TENURED);
+
+  Handle<MutableHeapNumber> NewMutableHeapNumber(
+      PretenureFlag pretenure = NOT_TENURED);
+  inline Handle<MutableHeapNumber> NewMutableHeapNumber(
+      double value, PretenureFlag pretenure = NOT_TENURED);
+  inline Handle<MutableHeapNumber> NewMutableHeapNumberFromBits(
+      uint64_t bits, PretenureFlag pretenure = NOT_TENURED);
+  inline Handle<MutableHeapNumber> NewMutableHeapNumberWithHoleNaN(
+      PretenureFlag pretenure = NOT_TENURED);
 
   // Allocates a new BigInt with {length} digits. Only to be used by
   // MutableBigInt::New*.
@@ -665,7 +697,7 @@ class V8_EXPORT_PRIVATE Factory final {
 
   Handle<JSFunction> NewFunctionFromSharedFunctionInfo(
       Handle<Map> initial_map, Handle<SharedFunctionInfo> function_info,
-      Handle<Object> context_or_undefined, Handle<FeedbackCell> feedback_cell,
+      Handle<Context> context, Handle<FeedbackCell> feedback_cell,
       PretenureFlag pretenure = TENURED);
 
   Handle<JSFunction> NewFunctionFromSharedFunctionInfo(
@@ -674,7 +706,7 @@ class V8_EXPORT_PRIVATE Factory final {
 
   Handle<JSFunction> NewFunctionFromSharedFunctionInfo(
       Handle<Map> initial_map, Handle<SharedFunctionInfo> function_info,
-      Handle<Object> context_or_undefined, PretenureFlag pretenure = TENURED);
+      Handle<Context> context, PretenureFlag pretenure = TENURED);
 
   Handle<JSFunction> NewFunctionFromSharedFunctionInfo(
       Handle<SharedFunctionInfo> function_info, Handle<Context> context,
@@ -684,7 +716,7 @@ class V8_EXPORT_PRIVATE Factory final {
   // initialization. All other utility methods call into this.
   Handle<JSFunction> NewFunction(Handle<Map> map,
                                  Handle<SharedFunctionInfo> info,
-                                 Handle<Object> context_or_undefined,
+                                 Handle<Context> context,
                                  PretenureFlag pretenure = TENURED);
 
   // Create a serialized scope info.
@@ -694,6 +726,13 @@ class V8_EXPORT_PRIVATE Factory final {
 
   Handle<PreParsedScopeData> NewPreParsedScopeData();
 
+  Handle<UncompiledDataWithoutPreParsedScope>
+  NewUncompiledDataWithoutPreParsedScope(int32_t start_position,
+                                         int32_t end_position);
+
+  Handle<UncompiledDataWithPreParsedScope> NewUncompiledDataWithPreParsedScope(
+      int32_t start_position, int32_t end_position, Handle<PreParsedScopeData>);
+
   // Create an External object for V8's external API.
   Handle<JSObject> NewExternal(void* value);
 
@@ -717,18 +756,30 @@ class V8_EXPORT_PRIVATE Factory final {
                        int safepoint_table_offset = 0,
                        int handler_table_offset = 0);
 
+  // Like NewCode, this function allocates a new code object (fully
+  // initialized). It may return an empty handle if the allocation does not
+  // succeed.
+  V8_WARN_UNUSED_RESULT MaybeHandle<Code> TryNewCode(
+      const CodeDesc& desc, Code::Kind kind, Handle<Object> self_reference,
+      int32_t builtin_index = Builtins::kNoBuiltinId,
+      MaybeHandle<ByteArray> maybe_source_position_table =
+          MaybeHandle<ByteArray>(),
+      MaybeHandle<DeoptimizationData> maybe_deopt_data =
+          MaybeHandle<DeoptimizationData>(),
+      Movability movability = kMovable, uint32_t stub_key = 0,
+      bool is_turbofanned = false, int stack_slots = 0,
+      int safepoint_table_offset = 0, int handler_table_offset = 0);
+
   // Allocates a new, empty code object for use by builtin deserialization. The
   // given {size} argument specifies the size of the entire code object.
   // Can only be used when code space is unprotected and requires manual
   // initialization by the caller.
   Handle<Code> NewCodeForDeserialization(uint32_t size);
 
-#ifdef V8_EMBEDDED_BUILTINS
   // Allocates a new code object and initializes it as the trampoline to the
   // given off-heap entry point.
   Handle<Code> NewOffHeapTrampolineFor(Handle<Code> code,
                                        Address off_heap_entry);
-#endif
 
   Handle<Code> CopyCode(Handle<Code> code);
 
@@ -777,6 +828,11 @@ class V8_EXPORT_PRIVATE Factory final {
   STRUCT_LIST(STRUCT_MAP_ACCESSOR)
 #undef STRUCT_MAP_ACCESSOR
 
+#define ALLOCATION_SITE_MAP_ACCESSOR(NAME, Name, Size, name) \
+  inline Handle<Map> name##_map();
+  ALLOCATION_SITE_LIST(ALLOCATION_SITE_MAP_ACCESSOR)
+#undef ALLOCATION_SITE_MAP_ACCESSOR
+
 #define DATA_HANDLER_MAP_ACCESSOR(NAME, Name, Size, name) \
   inline Handle<Map> name##_map();
   DATA_HANDLER_LIST(DATA_HANDLER_MAP_ACCESSOR)
@@ -841,7 +897,7 @@ class V8_EXPORT_PRIVATE Factory final {
                                              Handle<Object> argument,
                                              int start_position,
                                              int end_position,
-                                             Handle<Object> script,
+                                             Handle<Script> script,
                                              Handle<Object> stack_frames);
 
   Handle<DebugInfo> NewDebugInfo(Handle<SharedFunctionInfo> shared);
@@ -890,7 +946,12 @@ class V8_EXPORT_PRIVATE Factory final {
   }
 
  private:
-  Isolate* isolate() { return reinterpret_cast<Isolate*>(this); }
+  Isolate* isolate() {
+    // Downcast to the privately inherited sub-class using c-style casts to
+    // avoid undefined behavior (as static_cast cannot cast across private
+    // bases).
+    return (Isolate*)this;  // NOLINT(readability/casting)
+  }
 
   HeapObject* AllocateRawWithImmortalMap(
       int size, PretenureFlag pretenure, Map* map,
@@ -902,6 +963,7 @@ class V8_EXPORT_PRIVATE Factory final {
   // Allocate memory for an uninitialized array (e.g., a FixedArray or similar).
   HeapObject* AllocateRawArray(int size, PretenureFlag pretenure);
   HeapObject* AllocateRawFixedArray(int length, PretenureFlag pretenure);
+  HeapObject* AllocateRawWeakArrayList(int length, PretenureFlag pretenure);
   Handle<FixedArray> NewFixedArrayWithFiller(Heap::RootListIndex map_root_index,
                                              int length, Object* filler,
                                              PretenureFlag pretenure);
@@ -961,8 +1023,9 @@ class V8_EXPORT_PRIVATE Factory final {
 // Utility class to simplify argument handling around JSFunction creation.
 class NewFunctionArgs final {
  public:
-  static NewFunctionArgs ForWasm(Handle<String> name, Handle<Code> code,
-                                 Handle<Map> map);
+  static NewFunctionArgs ForWasm(
+      Handle<String> name,
+      Handle<WasmExportedFunctionData> exported_function_data, Handle<Map> map);
   static NewFunctionArgs ForBuiltin(Handle<String> name, Handle<Map> map,
                                     int builtin_id);
   static NewFunctionArgs ForFunctionWithoutCode(Handle<String> name,
@@ -990,7 +1053,7 @@ class NewFunctionArgs final {
 
   Handle<String> name_;
   MaybeHandle<Map> maybe_map_;
-  MaybeHandle<Code> maybe_code_;
+  MaybeHandle<WasmExportedFunctionData> maybe_exported_function_data_;
 
   bool should_create_and_set_initial_map_ = false;
   InstanceType type_;
diff --git a/deps/v8/src/heap/gc-tracer.cc b/deps/v8/src/heap/gc-tracer.cc
index 9900b343fd6e04..5ddb2b023700bc 100644
--- a/deps/v8/src/heap/gc-tracer.cc
+++ b/deps/v8/src/heap/gc-tracer.cc
@@ -532,6 +532,7 @@ void GCTracer::PrintNVP() const {
           "scavenge.weak_global_handles.identify=%.2f "
           "scavenge.weak_global_handles.process=%.2f "
           "scavenge.parallel=%.2f "
+          "scavenge.update_refs=%.2f "
           "background.scavenge.parallel=%.2f "
           "background.array_buffer_free=%.2f "
           "background.store_buffer=%.2f "
@@ -580,6 +581,7 @@ void GCTracer::PrintNVP() const {
           current_
               .scopes[Scope::SCAVENGER_SCAVENGE_WEAK_GLOBAL_HANDLES_PROCESS],
           current_.scopes[Scope::SCAVENGER_SCAVENGE_PARALLEL],
+          current_.scopes[Scope::SCAVENGER_SCAVENGE_UPDATE_REFS],
           current_.scopes[Scope::SCAVENGER_BACKGROUND_SCAVENGE_PARALLEL],
           current_.scopes[Scope::BACKGROUND_ARRAY_BUFFER_FREE],
           current_.scopes[Scope::BACKGROUND_STORE_BUFFER],
@@ -697,7 +699,9 @@ void GCTracer::PrintNVP() const {
           "mark.roots=%.1f "
           "mark.main=%.1f "
           "mark.weak_closure=%.1f "
-          "mark.weak_closure.ephemeral=%.1f "
+          "mark.weak_closure.ephemeron=%.1f "
+          "mark.weak_closure.ephemeron.marking=%.1f "
+          "mark.weak_closure.ephemeron.linear=%.1f "
           "mark.weak_closure.weak_handles=%.1f "
           "mark.weak_closure.weak_roots=%.1f "
           "mark.weak_closure.harmony=%.1f "
@@ -791,7 +795,9 @@ void GCTracer::PrintNVP() const {
           current_.scopes[Scope::MC_MARK_ROOTS],
           current_.scopes[Scope::MC_MARK_MAIN],
           current_.scopes[Scope::MC_MARK_WEAK_CLOSURE],
-          current_.scopes[Scope::MC_MARK_WEAK_CLOSURE_EPHEMERAL],
+          current_.scopes[Scope::MC_MARK_WEAK_CLOSURE_EPHEMERON],
+          current_.scopes[Scope::MC_MARK_WEAK_CLOSURE_EPHEMERON_MARKING],
+          current_.scopes[Scope::MC_MARK_WEAK_CLOSURE_EPHEMERON_LINEAR],
           current_.scopes[Scope::MC_MARK_WEAK_CLOSURE_WEAK_HANDLES],
           current_.scopes[Scope::MC_MARK_WEAK_CLOSURE_WEAK_ROOTS],
           current_.scopes[Scope::MC_MARK_WEAK_CLOSURE_HARMONY],
@@ -1100,5 +1106,27 @@ void GCTracer::AddBackgroundScopeSample(
   }
 }
 
+void GCTracer::RecordMarkCompactHistograms(HistogramTimer* gc_timer) {
+  Counters* counters = heap_->isolate()->counters();
+  if (gc_timer == counters->gc_finalize()) {
+    DCHECK_EQ(Scope::FIRST_TOP_MC_SCOPE, Scope::MC_CLEAR);
+    counters->gc_finalize_clear()->AddSample(
+        static_cast<int>(current_.scopes[Scope::MC_CLEAR]));
+    counters->gc_finalize_epilogue()->AddSample(
+        static_cast<int>(current_.scopes[Scope::MC_EPILOGUE]));
+    counters->gc_finalize_evacuate()->AddSample(
+        static_cast<int>(current_.scopes[Scope::MC_EVACUATE]));
+    counters->gc_finalize_finish()->AddSample(
+        static_cast<int>(current_.scopes[Scope::MC_FINISH]));
+    counters->gc_finalize_mark()->AddSample(
+        static_cast<int>(current_.scopes[Scope::MC_MARK]));
+    counters->gc_finalize_prologue()->AddSample(
+        static_cast<int>(current_.scopes[Scope::MC_PROLOGUE]));
+    counters->gc_finalize_sweep()->AddSample(
+        static_cast<int>(current_.scopes[Scope::MC_SWEEP]));
+    DCHECK_EQ(Scope::LAST_TOP_MC_SCOPE, Scope::MC_SWEEP);
+  }
+}
+
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/src/heap/gc-tracer.h b/deps/v8/src/heap/gc-tracer.h
index f35fa50d453ff0..62e077be50a11d 100644
--- a/deps/v8/src/heap/gc-tracer.h
+++ b/deps/v8/src/heap/gc-tracer.h
@@ -79,6 +79,8 @@ class V8_EXPORT_PRIVATE GCTracer {
       LAST_GENERAL_BACKGROUND_SCOPE = BACKGROUND_UNMAPPER,
       FIRST_MC_BACKGROUND_SCOPE = MC_BACKGROUND_EVACUATE_COPY,
       LAST_MC_BACKGROUND_SCOPE = MC_BACKGROUND_SWEEPING,
+      FIRST_TOP_MC_SCOPE = MC_CLEAR,
+      LAST_TOP_MC_SCOPE = MC_SWEEP,
       FIRST_MINOR_GC_BACKGROUND_SCOPE = MINOR_MC_BACKGROUND_EVACUATE_COPY,
       LAST_MINOR_GC_BACKGROUND_SCOPE = SCAVENGER_BACKGROUND_SCAVENGE_PARALLEL
     };
@@ -319,6 +321,8 @@ class V8_EXPORT_PRIVATE GCTracer {
   void AddBackgroundScopeSample(BackgroundScope::ScopeId scope, double duration,
                                 RuntimeCallCounter* runtime_call_counter);
 
+  void RecordMarkCompactHistograms(HistogramTimer* gc_timer);
+
  private:
   FRIEND_TEST(GCTracer, AverageSpeed);
   FRIEND_TEST(GCTracerTest, AllocationThroughput);
@@ -334,6 +338,7 @@ class V8_EXPORT_PRIVATE GCTracer {
   FRIEND_TEST(GCTracerTest, IncrementalScope);
   FRIEND_TEST(GCTracerTest, IncrementalMarkingSpeed);
   FRIEND_TEST(GCTracerTest, MutatorUtilization);
+  FRIEND_TEST(GCTracerTest, RecordMarkCompactHistograms);
 
   struct BackgroundCounter {
     double total_duration_ms;
diff --git a/deps/v8/src/heap/heap-controller.cc b/deps/v8/src/heap/heap-controller.cc
new file mode 100644
index 00000000000000..41f1a6bb3a9e80
--- /dev/null
+++ b/deps/v8/src/heap/heap-controller.cc
@@ -0,0 +1,160 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "src/heap/heap-controller.h"
+#include "src/isolate-inl.h"
+
+namespace v8 {
+namespace internal {
+
+const double HeapController::kMinHeapGrowingFactor = 1.1;
+const double HeapController::kMaxHeapGrowingFactor = 4.0;
+const double HeapController::kConservativeHeapGrowingFactor = 1.3;
+const double HeapController::kTargetMutatorUtilization = 0.97;
+
+// Given GC speed in bytes per ms, the allocation throughput in bytes per ms
+// (mutator speed), this function returns the heap growing factor that will
+// achieve the kTargetMutatorUtilisation if the GC speed and the mutator speed
+// remain the same until the next GC.
+//
+// For a fixed time-frame T = TM + TG, the mutator utilization is the ratio
+// TM / (TM + TG), where TM is the time spent in the mutator and TG is the
+// time spent in the garbage collector.
+//
+// Let MU be kTargetMutatorUtilisation, the desired mutator utilization for the
+// time-frame from the end of the current GC to the end of the next GC. Based
+// on the MU we can compute the heap growing factor F as
+//
+// F = R * (1 - MU) / (R * (1 - MU) - MU), where R = gc_speed / mutator_speed.
+//
+// This formula can be derived as follows.
+//
+// F = Limit / Live by definition, where the Limit is the allocation limit,
+// and the Live is size of live objects.
+// Let’s assume that we already know the Limit. Then:
+//   TG = Limit / gc_speed
+//   TM = (TM + TG) * MU, by definition of MU.
+//   TM = TG * MU / (1 - MU)
+//   TM = Limit *  MU / (gc_speed * (1 - MU))
+// On the other hand, if the allocation throughput remains constant:
+//   Limit = Live + TM * allocation_throughput = Live + TM * mutator_speed
+// Solving it for TM, we get
+//   TM = (Limit - Live) / mutator_speed
+// Combining the two equation for TM:
+//   (Limit - Live) / mutator_speed = Limit * MU / (gc_speed * (1 - MU))
+//   (Limit - Live) = Limit * MU * mutator_speed / (gc_speed * (1 - MU))
+// substitute R = gc_speed / mutator_speed
+//   (Limit - Live) = Limit * MU  / (R * (1 - MU))
+// substitute F = Limit / Live
+//   F - 1 = F * MU  / (R * (1 - MU))
+//   F - F * MU / (R * (1 - MU)) = 1
+//   F * (1 - MU / (R * (1 - MU))) = 1
+//   F * (R * (1 - MU) - MU) / (R * (1 - MU)) = 1
+//   F = R * (1 - MU) / (R * (1 - MU) - MU)
+double HeapController::HeapGrowingFactor(double gc_speed, double mutator_speed,
+                                         double max_factor) {
+  DCHECK_LE(kMinHeapGrowingFactor, max_factor);
+  DCHECK_GE(kMaxHeapGrowingFactor, max_factor);
+  if (gc_speed == 0 || mutator_speed == 0) return max_factor;
+
+  const double speed_ratio = gc_speed / mutator_speed;
+  const double mu = kTargetMutatorUtilization;
+
+  const double a = speed_ratio * (1 - mu);
+  const double b = speed_ratio * (1 - mu) - mu;
+
+  // The factor is a / b, but we need to check for small b first.
+  double factor = (a < b * max_factor) ? a / b : max_factor;
+  factor = Min(factor, max_factor);
+  factor = Max(factor, kMinHeapGrowingFactor);
+  return factor;
+}
+
+double HeapController::MaxHeapGrowingFactor(size_t max_old_generation_size) {
+  const double min_small_factor = 1.3;
+  const double max_small_factor = 2.0;
+  const double high_factor = 4.0;
+
+  size_t max_old_generation_size_in_mb = max_old_generation_size / MB;
+  max_old_generation_size_in_mb =
+      Max(max_old_generation_size_in_mb,
+          static_cast<size_t>(kMinOldGenerationSize));
+
+  // If we are on a device with lots of memory, we allow a high heap
+  // growing factor.
+  if (max_old_generation_size_in_mb >= kMaxOldGenerationSize) {
+    return high_factor;
+  }
+
+  DCHECK_GE(max_old_generation_size_in_mb, kMinOldGenerationSize);
+  DCHECK_LT(max_old_generation_size_in_mb, kMaxOldGenerationSize);
+
+  // On smaller devices we linearly scale the factor: (X-A)/(B-A)*(D-C)+C
+  double factor = (max_old_generation_size_in_mb - kMinOldGenerationSize) *
+                      (max_small_factor - min_small_factor) /
+                      (kMaxOldGenerationSize - kMinOldGenerationSize) +
+                  min_small_factor;
+  return factor;
+}
+
+size_t HeapController::CalculateOldGenerationAllocationLimit(
+    size_t old_gen_size, size_t max_old_generation_size, double gc_speed,
+    double mutator_speed, size_t new_space_capacity,
+    Heap::HeapGrowingMode growing_mode) {
+  double max_factor = MaxHeapGrowingFactor(max_old_generation_size);
+  double factor = HeapGrowingFactor(gc_speed, mutator_speed, max_factor);
+
+  if (FLAG_trace_gc_verbose) {
+    heap_->isolate()->PrintWithTimestamp(
+        "Heap growing factor %.1f based on mu=%.3f, speed_ratio=%.f "
+        "(gc=%.f, mutator=%.f)\n",
+        factor, kTargetMutatorUtilization, gc_speed / mutator_speed, gc_speed,
+        mutator_speed);
+  }
+
+  if (growing_mode == Heap::HeapGrowingMode::kConservative ||
+      growing_mode == Heap::HeapGrowingMode::kSlow) {
+    factor = Min(factor, kConservativeHeapGrowingFactor);
+  }
+
+  if (growing_mode == Heap::HeapGrowingMode::kMinimal) {
+    factor = kMinHeapGrowingFactor;
+  }
+
+  if (FLAG_heap_growing_percent > 0) {
+    factor = 1.0 + FLAG_heap_growing_percent / 100.0;
+  }
+
+  CHECK_LT(1.0, factor);
+  CHECK_LT(0, old_gen_size);
+  uint64_t limit = static_cast<uint64_t>(old_gen_size * factor);
+  limit = Max(limit, static_cast<uint64_t>(old_gen_size) +
+                         MinimumAllocationLimitGrowingStep(growing_mode));
+  limit += new_space_capacity;
+  uint64_t halfway_to_the_max =
+      (static_cast<uint64_t>(old_gen_size) + max_old_generation_size) / 2;
+  size_t result = static_cast<size_t>(Min(limit, halfway_to_the_max));
+
+  if (FLAG_trace_gc_verbose) {
+    heap_->isolate()->PrintWithTimestamp(
+        "Heap Controller Limit: old size: %" PRIuS " KB, new limit: %" PRIuS
+        " KB (%.1f)\n",
+        old_gen_size / KB, result / KB, factor);
+  }
+
+  return result;
+}
+
+size_t HeapController::MinimumAllocationLimitGrowingStep(
+    Heap::HeapGrowingMode growing_mode) {
+  const size_t kRegularAllocationLimitGrowingStep = 8;
+  const size_t kLowMemoryAllocationLimitGrowingStep = 2;
+  size_t limit = (Page::kPageSize > MB ? Page::kPageSize : MB);
+  return limit * (growing_mode == Heap::HeapGrowingMode::kConservative
+                      ? kLowMemoryAllocationLimitGrowingStep
+                      : kRegularAllocationLimitGrowingStep);
+}
+
+}  // namespace internal
+}  // namespace v8
diff --git a/deps/v8/src/heap/heap-controller.h b/deps/v8/src/heap/heap-controller.h
new file mode 100644
index 00000000000000..717c97a5b8b4b5
--- /dev/null
+++ b/deps/v8/src/heap/heap-controller.h
@@ -0,0 +1,55 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef V8_HEAP_HEAP_CONTROLLER_H_
+#define V8_HEAP_HEAP_CONTROLLER_H_
+
+#include <cstddef>
+#include "src/allocation.h"
+#include "src/heap/heap.h"
+#include "testing/gtest/include/gtest/gtest_prod.h"  // nogncheck
+
+namespace v8 {
+namespace internal {
+
+class HeapController {
+ public:
+  explicit HeapController(Heap* heap) : heap_(heap) {}
+
+  // Computes the allocation limit to trigger the next full garbage collection.
+  V8_EXPORT_PRIVATE size_t CalculateOldGenerationAllocationLimit(
+      size_t old_gen_size, size_t max_old_generation_size, double gc_speed,
+      double mutator_speed, size_t new_space_capacity,
+      Heap::HeapGrowingMode growing_mode);
+
+  size_t MinimumAllocationLimitGrowingStep(Heap::HeapGrowingMode growing_mode);
+
+  // The old space size has to be a multiple of Page::kPageSize.
+  // Sizes are in MB.
+  static const size_t kMinOldGenerationSize = 128 * Heap::kPointerMultiplier;
+  static const size_t kMaxOldGenerationSize = 1024 * Heap::kPointerMultiplier;
+
+ private:
+  FRIEND_TEST(HeapController, HeapGrowingFactor);
+  FRIEND_TEST(HeapController, MaxHeapGrowingFactor);
+  FRIEND_TEST(HeapControllerTest, OldGenerationAllocationLimit);
+
+  V8_EXPORT_PRIVATE static const double kMinHeapGrowingFactor;
+  V8_EXPORT_PRIVATE static const double kMaxHeapGrowingFactor;
+  V8_EXPORT_PRIVATE static const double kConservativeHeapGrowingFactor;
+  V8_EXPORT_PRIVATE static double MaxHeapGrowingFactor(
+      size_t max_old_generation_size);
+  V8_EXPORT_PRIVATE static double HeapGrowingFactor(double gc_speed,
+                                                    double mutator_speed,
+                                                    double max_factor);
+
+  static const double kTargetMutatorUtilization;
+
+  Heap* heap_;
+};
+
+}  // namespace internal
+}  // namespace v8
+
+#endif  // V8_HEAP_HEAP_CONTROLLER_H_
diff --git a/deps/v8/src/heap/heap-inl.h b/deps/v8/src/heap/heap-inl.h
index 230452d4d0f08a..cc31a31e3a316d 100644
--- a/deps/v8/src/heap/heap-inl.h
+++ b/deps/v8/src/heap/heap-inl.h
@@ -23,6 +23,7 @@
 #include "src/log.h"
 #include "src/msan.h"
 #include "src/objects-inl.h"
+#include "src/objects/api-callbacks-inl.h"
 #include "src/objects/descriptor-array.h"
 #include "src/objects/literal-objects.h"
 #include "src/objects/scope-info.h"
@@ -46,14 +47,9 @@ HeapObject* AllocationResult::ToObjectChecked() {
 
 #define ROOT_ACCESSOR(type, name, camel_name) \
   type* Heap::name() { return type::cast(roots_[k##camel_name##RootIndex]); }
-ROOT_LIST(ROOT_ACCESSOR)
+MUTABLE_ROOT_LIST(ROOT_ACCESSOR)
 #undef ROOT_ACCESSOR
 
-#define STRUCT_MAP_ACCESSOR(NAME, Name, name) \
-  Map* Heap::name##_map() { return Map::cast(roots_[k##Name##MapRootIndex]); }
-STRUCT_LIST(STRUCT_MAP_ACCESSOR)
-#undef STRUCT_MAP_ACCESSOR
-
 #define DATA_HANDLER_MAP_ACCESSOR(NAME, Name, Size, name)  \
   Map* Heap::name##_map() {                                \
     return Map::cast(roots_[k##Name##Size##MapRootIndex]); \
@@ -61,22 +57,6 @@ STRUCT_LIST(STRUCT_MAP_ACCESSOR)
 DATA_HANDLER_LIST(DATA_HANDLER_MAP_ACCESSOR)
 #undef DATA_HANDLER_MAP_ACCESSOR
 
-#define STRING_ACCESSOR(name, str) \
-  String* Heap::name() { return String::cast(roots_[k##name##RootIndex]); }
-INTERNALIZED_STRING_LIST(STRING_ACCESSOR)
-#undef STRING_ACCESSOR
-
-#define SYMBOL_ACCESSOR(name) \
-  Symbol* Heap::name() { return Symbol::cast(roots_[k##name##RootIndex]); }
-PRIVATE_SYMBOL_LIST(SYMBOL_ACCESSOR)
-#undef SYMBOL_ACCESSOR
-
-#define SYMBOL_ACCESSOR(name, description) \
-  Symbol* Heap::name() { return Symbol::cast(roots_[k##name##RootIndex]); }
-PUBLIC_SYMBOL_LIST(SYMBOL_ACCESSOR)
-WELL_KNOWN_SYMBOL_LIST(SYMBOL_ACCESSOR)
-#undef SYMBOL_ACCESSOR
-
 #define ACCESSOR_INFO_ACCESSOR(accessor_name, AccessorName)                \
   AccessorInfo* Heap::accessor_name##_accessor() {                         \
     return AccessorInfo::cast(roots_[k##AccessorName##AccessorRootIndex]); \
@@ -146,13 +126,19 @@ AllocationResult Heap::AllocateRaw(int size_in_bytes, AllocationSpace space,
 #endif
 
   bool large_object = size_in_bytes > kMaxRegularHeapObjectSize;
+  bool new_large_object = FLAG_young_generation_large_objects &&
+                          size_in_bytes > kMaxNewSpaceHeapObjectSize;
   HeapObject* object = nullptr;
   AllocationResult allocation;
   if (NEW_SPACE == space) {
     if (large_object) {
       space = LO_SPACE;
     } else {
-      allocation = new_space_->AllocateRaw(size_in_bytes, alignment);
+      if (new_large_object) {
+        allocation = new_lo_space_->AllocateRaw(size_in_bytes);
+      } else {
+        allocation = new_space_->AllocateRaw(size_in_bytes, alignment);
+      }
       if (allocation.To(&object)) {
         OnAllocationEvent(object, size_in_bytes);
       }
@@ -183,6 +169,7 @@ AllocationResult Heap::AllocateRaw(int size_in_bytes, AllocationSpace space,
     DCHECK(isolate_->serializer_enabled());
 #endif
     DCHECK(!large_object);
+    DCHECK(CanAllocateInReadOnlySpace());
     allocation = read_only_space_->AllocateRaw(size_in_bytes, alignment);
   } else {
     // NEW_SPACE is not allowed here.
@@ -261,6 +248,12 @@ void Heap::OnMoveEvent(HeapObject* target, HeapObject* source,
   }
 }
 
+bool Heap::CanAllocateInReadOnlySpace() {
+  return !deserialization_complete_ &&
+         (isolate()->serializer_enabled() ||
+          !isolate()->initialized_from_snapshot());
+}
+
 void Heap::UpdateAllocationsHash(HeapObject* object) {
   Address object_address = object->address();
   MemoryChunk* memory_chunk = MemoryChunk::FromAddress(object_address);
@@ -306,60 +299,78 @@ void Heap::FinalizeExternalString(String* string) {
 
 Address Heap::NewSpaceTop() { return new_space_->top(); }
 
+// static
 bool Heap::InNewSpace(Object* object) {
   DCHECK(!HasWeakHeapObjectTag(object));
   return object->IsHeapObject() && InNewSpace(HeapObject::cast(object));
 }
 
+// static
 bool Heap::InNewSpace(MaybeObject* object) {
   HeapObject* heap_object;
   return object->ToStrongOrWeakHeapObject(&heap_object) &&
          InNewSpace(heap_object);
 }
 
+// static
 bool Heap::InNewSpace(HeapObject* heap_object) {
   // Inlined check from NewSpace::Contains.
-  bool result = Page::FromAddress(heap_object->address())->InNewSpace();
-  DCHECK(!result ||                 // Either not in new space
-         gc_state_ != NOT_IN_GC ||  // ... or in the middle of GC
-         InToSpace(heap_object));   // ... or in to-space (where we allocate).
+  bool result = MemoryChunk::FromHeapObject(heap_object)->InNewSpace();
+#ifdef DEBUG
+  // If in NEW_SPACE, then check we're either not in the middle of GC or the
+  // object is in to-space.
+  if (result) {
+    // If the object is in NEW_SPACE, then it's not in RO_SPACE so this is safe.
+    Heap* heap = Heap::FromWritableHeapObject(heap_object);
+    DCHECK(heap->gc_state_ != NOT_IN_GC || InToSpace(heap_object));
+  }
+#endif
   return result;
 }
 
+// static
 bool Heap::InFromSpace(Object* object) {
   DCHECK(!HasWeakHeapObjectTag(object));
   return object->IsHeapObject() && InFromSpace(HeapObject::cast(object));
 }
 
+// static
 bool Heap::InFromSpace(MaybeObject* object) {
   HeapObject* heap_object;
   return object->ToStrongOrWeakHeapObject(&heap_object) &&
          InFromSpace(heap_object);
 }
 
+// static
 bool Heap::InFromSpace(HeapObject* heap_object) {
-  return MemoryChunk::FromAddress(heap_object->address())
+  return MemoryChunk::FromHeapObject(heap_object)
       ->IsFlagSet(Page::IN_FROM_SPACE);
 }
 
+// static
 bool Heap::InToSpace(Object* object) {
   DCHECK(!HasWeakHeapObjectTag(object));
   return object->IsHeapObject() && InToSpace(HeapObject::cast(object));
 }
 
+// static
 bool Heap::InToSpace(MaybeObject* object) {
   HeapObject* heap_object;
   return object->ToStrongOrWeakHeapObject(&heap_object) &&
          InToSpace(heap_object);
 }
 
+// static
 bool Heap::InToSpace(HeapObject* heap_object) {
-  return MemoryChunk::FromAddress(heap_object->address())
-      ->IsFlagSet(Page::IN_TO_SPACE);
+  return MemoryChunk::FromHeapObject(heap_object)->IsFlagSet(Page::IN_TO_SPACE);
 }
 
 bool Heap::InOldSpace(Object* object) { return old_space_->Contains(object); }
 
+bool Heap::InReadOnlySpace(Object* object) {
+  return read_only_space_->Contains(object);
+}
+
 bool Heap::InNewSpaceSlow(Address address) {
   return new_space_->ContainsSlow(address);
 }
@@ -368,6 +379,19 @@ bool Heap::InOldSpaceSlow(Address address) {
   return old_space_->ContainsSlow(address);
 }
 
+// static
+Heap* Heap::FromWritableHeapObject(const HeapObject* obj) {
+  MemoryChunk* chunk = MemoryChunk::FromHeapObject(obj);
+  // RO_SPACE can be shared between heaps, so we can't use RO_SPACE objects to
+  // find a heap. The exception is when the ReadOnlySpace is writeable, during
+  // bootstrapping, so explicitly allow this case.
+  SLOW_DCHECK(chunk->owner()->identity() != RO_SPACE ||
+              static_cast<ReadOnlySpace*>(chunk->owner())->writable());
+  Heap* heap = chunk->heap();
+  SLOW_DCHECK(heap != nullptr);
+  return heap;
+}
+
 bool Heap::ShouldBePromoted(Address old_address) {
   Page* page = Page::FromAddress(old_address);
   Address age_mark = new_space_->age_mark();
@@ -378,9 +402,8 @@ bool Heap::ShouldBePromoted(Address old_address) {
 void Heap::RecordWrite(Object* object, Object** slot, Object* value) {
   DCHECK(!HasWeakHeapObjectTag(*slot));
   DCHECK(!HasWeakHeapObjectTag(value));
-  if (!InNewSpace(value) || !object->IsHeapObject() || InNewSpace(object)) {
-    return;
-  }
+  DCHECK(object->IsHeapObject());  // Can't write to slots of a Smi.
+  if (!InNewSpace(value) || InNewSpace(HeapObject::cast(object))) return;
   store_buffer()->InsertEntry(reinterpret_cast<Address>(slot));
 }
 
@@ -430,7 +453,7 @@ AllocationMemento* Heap::FindAllocationMemento(Map* map, HeapObject* object) {
   // below (memento_address == top) ensures that this is safe. Mark the word as
   // initialized to silence MemorySanitizer warnings.
   MSAN_MEMORY_IS_INITIALIZED(&candidate_map, sizeof(candidate_map));
-  if (candidate_map != allocation_memento_map()) {
+  if (candidate_map != ReadOnlyRoots(this).allocation_memento_map()) {
     return nullptr;
   }
 
@@ -479,13 +502,12 @@ AllocationMemento* Heap::FindAllocationMemento(Map* map, HeapObject* object) {
 void Heap::UpdateAllocationSite(Map* map, HeapObject* object,
                                 PretenuringFeedbackMap* pretenuring_feedback) {
   DCHECK_NE(pretenuring_feedback, &global_pretenuring_feedback_);
-  DCHECK(InFromSpace(object) ||
-         (InToSpace(object) &&
-          Page::FromAddress(object->address())
-              ->IsFlagSet(Page::PAGE_NEW_NEW_PROMOTION)) ||
-         (!InNewSpace(object) &&
-          Page::FromAddress(object->address())
-              ->IsFlagSet(Page::PAGE_NEW_OLD_PROMOTION)));
+  DCHECK(
+      InFromSpace(object) ||
+      (InToSpace(object) && Page::FromAddress(object->address())
+                                ->IsFlagSet(Page::PAGE_NEW_NEW_PROMOTION)) ||
+      (!InNewSpace(object) && Page::FromAddress(object->address())
+                                  ->IsFlagSet(Page::PAGE_NEW_OLD_PROMOTION)));
   if (!FLAG_allocation_site_pretenuring ||
       !AllocationSite::CanTrack(map->instance_type()))
     return;
@@ -508,7 +530,7 @@ Isolate* Heap::isolate() {
 
 void Heap::ExternalStringTable::AddString(String* string) {
   DCHECK(string->IsExternalString());
-  if (heap_->InNewSpace(string)) {
+  if (InNewSpace(string)) {
     new_space_strings_.push_back(string);
   } else {
     old_space_strings_.push_back(string);
@@ -516,7 +538,8 @@ void Heap::ExternalStringTable::AddString(String* string) {
 }
 
 Oddball* Heap::ToBoolean(bool condition) {
-  return condition ? true_value() : false_value();
+  ReadOnlyRoots roots(this);
+  return condition ? roots.true_value() : roots.false_value();
 }
 
 uint32_t Heap::HashSeed() {
@@ -536,8 +559,8 @@ int Heap::NextScriptId() {
 
 int Heap::NextDebuggingId() {
   int last_id = last_debugging_id()->value();
-  if (last_id == SharedFunctionInfo::DebuggingIdBits::kMax) {
-    last_id = SharedFunctionInfo::kNoDebuggingId;
+  if (last_id == DebugInfo::DebuggingIdBits::kMax) {
+    last_id = DebugInfo::kNoDebuggingId;
   }
   last_id++;
   set_last_debugging_id(Smi::FromInt(last_id));
@@ -552,11 +575,11 @@ int Heap::GetNextTemplateSerialNumber() {
 
 AlwaysAllocateScope::AlwaysAllocateScope(Isolate* isolate)
     : heap_(isolate->heap()) {
-  heap_->always_allocate_scope_count_.Increment(1);
+  heap_->always_allocate_scope_count_++;
 }
 
 AlwaysAllocateScope::~AlwaysAllocateScope() {
-  heap_->always_allocate_scope_count_.Decrement(1);
+  heap_->always_allocate_scope_count_--;
 }
 
 CodeSpaceMemoryModificationScope::CodeSpaceMemoryModificationScope(Heap* heap)
diff --git a/deps/v8/src/heap/heap.cc b/deps/v8/src/heap/heap.cc
index ab2399aad7f530..d6183326ccfd3e 100644
--- a/deps/v8/src/heap/heap.cc
+++ b/deps/v8/src/heap/heap.cc
@@ -30,6 +30,7 @@
 #include "src/heap/embedder-tracing.h"
 #include "src/heap/gc-idle-time-handler.h"
 #include "src/heap/gc-tracer.h"
+#include "src/heap/heap-controller.h"
 #include "src/heap/incremental-marking.h"
 #include "src/heap/item-parallel-job.h"
 #include "src/heap/mark-compact-inl.h"
@@ -48,6 +49,7 @@
 #include "src/instruction-stream.h"
 #include "src/interpreter/interpreter.h"
 #include "src/objects/data-handler.h"
+#include "src/objects/hash-table-inl.h"
 #include "src/objects/maybe-object.h"
 #include "src/objects/shared-function-info.h"
 #include "src/regexp/jsregexp.h"
@@ -75,18 +77,12 @@ void Heap::SetArgumentsAdaptorDeoptPCOffset(int pc_offset) {
 }
 
 void Heap::SetConstructStubCreateDeoptPCOffset(int pc_offset) {
-  // TODO(tebbi): Remove second half of DCHECK once
-  // FLAG_harmony_restrict_constructor_return is gone.
-  DCHECK(construct_stub_create_deopt_pc_offset() == Smi::kZero ||
-         construct_stub_create_deopt_pc_offset() == Smi::FromInt(pc_offset));
+  DCHECK(construct_stub_create_deopt_pc_offset() == Smi::kZero);
   set_construct_stub_create_deopt_pc_offset(Smi::FromInt(pc_offset));
 }
 
 void Heap::SetConstructStubInvokeDeoptPCOffset(int pc_offset) {
-  // TODO(tebbi): Remove second half of DCHECK once
-  // FLAG_harmony_restrict_constructor_return is gone.
-  DCHECK(construct_stub_invoke_deopt_pc_offset() == Smi::kZero ||
-         construct_stub_invoke_deopt_pc_offset() == Smi::FromInt(pc_offset));
+  DCHECK(construct_stub_invoke_deopt_pc_offset() == Smi::kZero);
   set_construct_stub_invoke_deopt_pc_offset(Smi::FromInt(pc_offset));
 }
 
@@ -141,6 +137,7 @@ Heap::Heap()
     : external_memory_(0),
       external_memory_limit_(kExternalAllocationSoftLimit),
       external_memory_at_last_mark_compact_(0),
+      external_memory_concurrently_freed_(0),
       isolate_(nullptr),
       code_range_size_(0),
       // semispace_size_ should be a power of 2 and old_generation_size_ should
@@ -168,6 +165,7 @@ Heap::Heap()
       code_space_(nullptr),
       map_space_(nullptr),
       lo_space_(nullptr),
+      new_lo_space_(nullptr),
       read_only_space_(nullptr),
       write_protect_code_memory_(false),
       code_space_memory_modification_scope_depth_(0),
@@ -244,10 +242,9 @@ Heap::Heap()
   memset(roots_, 0, sizeof(roots_[0]) * kRootListLength);
   set_native_contexts_list(nullptr);
   set_allocation_sites_list(Smi::kZero);
-  set_encountered_weak_collections(Smi::kZero);
   // Put a dummy entry in the remembered pages so we can find the list the
   // minidump even if there are no real unmapped pages.
-  RememberUnmappedPage(nullptr, false);
+  RememberUnmappedPage(kNullAddress, false);
 }
 
 size_t Heap::MaxReserved() {
@@ -256,6 +253,15 @@ size_t Heap::MaxReserved() {
       (2 * max_semi_space_size_ + max_old_generation_size_) * kFactor);
 }
 
+size_t Heap::ComputeMaxOldGenerationSize(uint64_t physical_memory) {
+  const size_t old_space_physical_memory_factor = 4;
+  size_t computed_size = static_cast<size_t>(physical_memory / i::MB /
+                                             old_space_physical_memory_factor *
+                                             kPointerMultiplier);
+  return Max(Min(computed_size, HeapController::kMaxOldGenerationSize),
+             HeapController::kMinOldGenerationSize);
+}
+
 size_t Heap::Capacity() {
   if (!HasBeenSetUp()) return 0;
 
@@ -264,15 +270,32 @@ size_t Heap::Capacity() {
 
 size_t Heap::OldGenerationCapacity() {
   if (!HasBeenSetUp()) return 0;
-  return old_space_->Capacity() + code_space_->Capacity() +
-         map_space_->Capacity() + lo_space_->SizeOfObjects();
+  PagedSpaces spaces(this, PagedSpaces::SpacesSpecifier::kAllPagedSpaces);
+  size_t total = 0;
+  for (PagedSpace* space = spaces.next(); space != nullptr;
+       space = spaces.next()) {
+    total += space->Capacity();
+  }
+  return total + lo_space_->SizeOfObjects();
 }
 
 size_t Heap::CommittedOldGenerationMemory() {
   if (!HasBeenSetUp()) return 0;
 
-  return old_space_->CommittedMemory() + code_space_->CommittedMemory() +
-         map_space_->CommittedMemory() + lo_space_->Size();
+  PagedSpaces spaces(this, PagedSpaces::SpacesSpecifier::kAllPagedSpaces);
+  size_t total = 0;
+  for (PagedSpace* space = spaces.next(); space != nullptr;
+       space = spaces.next()) {
+    total += space->CommittedMemory();
+  }
+  return total + lo_space_->Size();
+}
+
+size_t Heap::CommittedMemoryOfHeapAndUnmapper() {
+  if (!HasBeenSetUp()) return 0;
+
+  return CommittedMemory() +
+         memory_allocator()->unmapper()->CommittedBufferedMemory();
 }
 
 size_t Heap::CommittedMemory() {
@@ -285,11 +308,12 @@ size_t Heap::CommittedMemory() {
 size_t Heap::CommittedPhysicalMemory() {
   if (!HasBeenSetUp()) return 0;
 
-  return new_space_->CommittedPhysicalMemory() +
-         old_space_->CommittedPhysicalMemory() +
-         code_space_->CommittedPhysicalMemory() +
-         map_space_->CommittedPhysicalMemory() +
-         lo_space_->CommittedPhysicalMemory();
+  size_t total = 0;
+  for (SpaceIterator it(this); it.has_next();) {
+    total += it.next()->CommittedPhysicalMemory();
+  }
+
+  return total;
 }
 
 size_t Heap::CommittedMemoryExecutable() {
@@ -329,9 +353,8 @@ bool Heap::CanExpandOldGeneration(size_t size) {
 }
 
 bool Heap::HasBeenSetUp() {
-  return old_space_ != nullptr && code_space_ != nullptr &&
-         map_space_ != nullptr && lo_space_ != nullptr &&
-         read_only_space_ != nullptr;
+  // We will always have a new space when the heap is set up.
+  return new_space_ != nullptr;
 }
 
 
@@ -375,53 +398,82 @@ void Heap::SetGCState(HeapState state) {
 
 void Heap::PrintShortHeapStatistics() {
   if (!FLAG_trace_gc_verbose) return;
-  PrintIsolate(isolate_, "Memory allocator,   used: %6" PRIuS
-                         " KB,"
-                         " available: %6" PRIuS " KB\n",
+  PrintIsolate(isolate_,
+               "Memory allocator,       used: %6" PRIuS
+               " KB,"
+               " available: %6" PRIuS " KB\n",
                memory_allocator()->Size() / KB,
                memory_allocator()->Available() / KB);
-  PrintIsolate(isolate_, "New space,          used: %6" PRIuS
-                         " KB"
-                         ", available: %6" PRIuS
-                         " KB"
-                         ", committed: %6" PRIuS " KB\n",
+  PrintIsolate(isolate_,
+               "Read-only space,        used: %6" PRIuS
+               " KB"
+               ", available: %6" PRIuS
+               " KB"
+               ", committed: %6" PRIuS " KB\n",
+               read_only_space_->Size() / KB,
+               read_only_space_->Available() / KB,
+               read_only_space_->CommittedMemory() / KB);
+  PrintIsolate(isolate_,
+               "New space,              used: %6" PRIuS
+               " KB"
+               ", available: %6" PRIuS
+               " KB"
+               ", committed: %6" PRIuS " KB\n",
                new_space_->Size() / KB, new_space_->Available() / KB,
                new_space_->CommittedMemory() / KB);
-  PrintIsolate(isolate_, "Old space,          used: %6" PRIuS
-                         " KB"
-                         ", available: %6" PRIuS
-                         " KB"
-                         ", committed: %6" PRIuS " KB\n",
+  PrintIsolate(isolate_,
+               "New large object space, used: %6" PRIuS
+               " KB"
+               ", available: %6" PRIuS
+               " KB"
+               ", committed: %6" PRIuS " KB\n",
+               new_lo_space_->SizeOfObjects() / KB,
+               new_lo_space_->Available() / KB,
+               new_lo_space_->CommittedMemory() / KB);
+  PrintIsolate(isolate_,
+               "Old space,              used: %6" PRIuS
+               " KB"
+               ", available: %6" PRIuS
+               " KB"
+               ", committed: %6" PRIuS " KB\n",
                old_space_->SizeOfObjects() / KB, old_space_->Available() / KB,
                old_space_->CommittedMemory() / KB);
-  PrintIsolate(isolate_, "Code space,         used: %6" PRIuS
-                         " KB"
-                         ", available: %6" PRIuS
-                         " KB"
-                         ", committed: %6" PRIuS "KB\n",
+  PrintIsolate(isolate_,
+               "Code space,             used: %6" PRIuS
+               " KB"
+               ", available: %6" PRIuS
+               " KB"
+               ", committed: %6" PRIuS "KB\n",
                code_space_->SizeOfObjects() / KB, code_space_->Available() / KB,
                code_space_->CommittedMemory() / KB);
-  PrintIsolate(isolate_, "Map space,          used: %6" PRIuS
-                         " KB"
-                         ", available: %6" PRIuS
-                         " KB"
-                         ", committed: %6" PRIuS " KB\n",
+  PrintIsolate(isolate_,
+               "Map space,              used: %6" PRIuS
+               " KB"
+               ", available: %6" PRIuS
+               " KB"
+               ", committed: %6" PRIuS " KB\n",
                map_space_->SizeOfObjects() / KB, map_space_->Available() / KB,
                map_space_->CommittedMemory() / KB);
-  PrintIsolate(isolate_, "Large object space, used: %6" PRIuS
-                         " KB"
-                         ", available: %6" PRIuS
-                         " KB"
-                         ", committed: %6" PRIuS " KB\n",
+  PrintIsolate(isolate_,
+               "Large object space,     used: %6" PRIuS
+               " KB"
+               ", available: %6" PRIuS
+               " KB"
+               ", committed: %6" PRIuS " KB\n",
                lo_space_->SizeOfObjects() / KB, lo_space_->Available() / KB,
                lo_space_->CommittedMemory() / KB);
-  PrintIsolate(isolate_, "All spaces,         used: %6" PRIuS
-                         " KB"
-                         ", available: %6" PRIuS
-                         " KB"
-                         ", committed: %6" PRIuS "KB\n",
+  PrintIsolate(isolate_,
+               "All spaces,             used: %6" PRIuS
+               " KB"
+               ", available: %6" PRIuS
+               " KB"
+               ", committed: %6" PRIuS "KB\n",
                this->SizeOfObjects() / KB, this->Available() / KB,
                this->CommittedMemory() / KB);
+  PrintIsolate(isolate_,
+               "Unmapper buffering %d chunks of committed: %6" PRIuS " KB\n",
+               memory_allocator()->unmapper()->NumberOfChunks(),
+               CommittedMemoryOfHeapAndUnmapper() / KB);
   PrintIsolate(isolate_, "External memory reported: %6" PRId64 " KB\n",
                external_memory_ / KB);
   PrintIsolate(isolate_, "External memory global %zu KB\n",
@@ -463,7 +515,7 @@ void Heap::AddRetainingPathTarget(Handle<HeapObject> object,
   } else {
     int index = 0;
     Handle<FixedArrayOfWeakCells> array = FixedArrayOfWeakCells::Add(
-        handle(retaining_path_targets(), isolate()), object, &index);
+        isolate(), handle(retaining_path_targets(), isolate()), object, &index);
     set_retaining_path_targets(*array);
     retaining_path_target_option_[index] = option;
   }
@@ -492,16 +544,16 @@ void Heap::PrintRetainingPath(HeapObject* target, RetainingPathOption option) {
   HeapObject* object = target;
   std::vector<std::pair<HeapObject*, bool>> retaining_path;
   Root root = Root::kUnknown;
-  bool ephemeral = false;
+  bool ephemeron = false;
   while (true) {
-    retaining_path.push_back(std::make_pair(object, ephemeral));
-    if (option == RetainingPathOption::kTrackEphemeralPath &&
-        ephemeral_retainer_.count(object)) {
-      object = ephemeral_retainer_[object];
-      ephemeral = true;
+    retaining_path.push_back(std::make_pair(object, ephemeron));
+    if (option == RetainingPathOption::kTrackEphemeronPath &&
+        ephemeron_retainer_.count(object)) {
+      object = ephemeron_retainer_[object];
+      ephemeron = true;
     } else if (retainer_.count(object)) {
       object = retainer_[object];
-      ephemeral = false;
+      ephemeron = false;
     } else {
       if (retaining_root_.count(object)) {
         root = retaining_root_[object];
@@ -512,15 +564,15 @@ void Heap::PrintRetainingPath(HeapObject* target, RetainingPathOption option) {
   int distance = static_cast<int>(retaining_path.size());
   for (auto node : retaining_path) {
     HeapObject* object = node.first;
-    bool ephemeral = node.second;
+    bool ephemeron = node.second;
     PrintF("\n");
     PrintF("^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^\n");
     PrintF("Distance from root %d%s: ", distance,
-           ephemeral ? " (ephemeral)" : "");
+           ephemeron ? " (ephemeron)" : "");
     object->ShortPrint();
     PrintF("\n");
 #ifdef OBJECT_PRINT
-    object->Print();
+    object->Print(isolate());
     PrintF("\n");
 #endif
     --distance;
@@ -537,20 +589,20 @@ void Heap::AddRetainer(HeapObject* retainer, HeapObject* object) {
   RetainingPathOption option = RetainingPathOption::kDefault;
   if (IsRetainingPathTarget(object, &option)) {
     // Check if the retaining path was already printed in
-    // AddEphemeralRetainer().
-    if (ephemeral_retainer_.count(object) == 0 ||
+    // AddEphemeronRetainer().
+    if (ephemeron_retainer_.count(object) == 0 ||
         option == RetainingPathOption::kDefault) {
       PrintRetainingPath(object, option);
     }
   }
 }
 
-void Heap::AddEphemeralRetainer(HeapObject* retainer, HeapObject* object) {
-  if (ephemeral_retainer_.count(object)) return;
-  ephemeral_retainer_[object] = retainer;
+void Heap::AddEphemeronRetainer(HeapObject* retainer, HeapObject* object) {
+  if (ephemeron_retainer_.count(object)) return;
+  ephemeron_retainer_[object] = retainer;
   RetainingPathOption option = RetainingPathOption::kDefault;
   if (IsRetainingPathTarget(object, &option) &&
-      option == RetainingPathOption::kTrackEphemeralPath) {
+      option == RetainingPathOption::kTrackEphemeronPath) {
     // Check if the retaining path was already printed in AddRetainer().
     if (retainer_.count(object) == 0) {
       PrintRetainingPath(object, option);
@@ -611,7 +663,7 @@ void Heap::GarbageCollectionPrologue() {
   UpdateNewSpaceAllocationCounter();
   if (FLAG_track_retaining_path) {
     retainer_.clear();
-    ephemeral_retainer_.clear();
+    ephemeron_retainer_.clear();
     retaining_root_.clear();
   }
 }
@@ -638,6 +690,8 @@ const char* Heap::GetSpaceName(int idx) {
       return "code_space";
     case LO_SPACE:
       return "large_object_space";
+    case NEW_LO_SPACE:
+      return "new_large_object_space";
     case RO_SPACE:
       return "read_only_space";
     default:
@@ -835,17 +889,16 @@ void Heap::ProcessPretenuringFeedback() {
     // Step 2: Deopt maybe tenured allocation sites if necessary.
     bool deopt_maybe_tenured = DeoptMaybeTenuredAllocationSites();
     if (deopt_maybe_tenured) {
-      Object* list_element = allocation_sites_list();
-      while (list_element->IsAllocationSite()) {
-        site = AllocationSite::cast(list_element);
-        DCHECK(site->IsAllocationSite());
-        allocation_sites++;
-        if (site->IsMaybeTenure()) {
-          site->set_deopt_dependent_code(true);
-          trigger_deoptimization = true;
-        }
-        list_element = site->weak_next();
-      }
+      ForeachAllocationSite(
+          allocation_sites_list(),
+          [&allocation_sites, &trigger_deoptimization](AllocationSite* site) {
+            DCHECK(site->IsAllocationSite());
+            allocation_sites++;
+            if (site->IsMaybeTenure()) {
+              site->set_deopt_dependent_code(true);
+              trigger_deoptimization = true;
+            }
+          });
     }
 
     if (trigger_deoptimization) {
@@ -872,36 +925,34 @@ void Heap::ProcessPretenuringFeedback() {
 void Heap::InvalidateCodeEmbeddedObjects(Code* code) {
   MemoryChunk* chunk = MemoryChunk::FromAddress(code->address());
   CodePageMemoryModificationScope modification_scope(chunk);
-  code->InvalidateEmbeddedObjects();
+  code->InvalidateEmbeddedObjects(this);
 }
 
 void Heap::InvalidateCodeDeoptimizationData(Code* code) {
   MemoryChunk* chunk = MemoryChunk::FromAddress(code->address());
   CodePageMemoryModificationScope modification_scope(chunk);
-  code->set_deoptimization_data(empty_fixed_array());
+  code->set_deoptimization_data(ReadOnlyRoots(this).empty_fixed_array());
 }
 
 void Heap::DeoptMarkedAllocationSites() {
   // TODO(hpayer): If iterating over the allocation sites list becomes a
   // performance issue, use a cache data structure in heap instead.
-  Object* list_element = allocation_sites_list();
-  while (list_element->IsAllocationSite()) {
-    AllocationSite* site = AllocationSite::cast(list_element);
+
+  ForeachAllocationSite(allocation_sites_list(), [this](AllocationSite* site) {
     if (site->deopt_dependent_code()) {
       site->dependent_code()->MarkCodeForDeoptimization(
           isolate_, DependentCode::kAllocationSiteTenuringChangedGroup);
       site->set_deopt_dependent_code(false);
     }
-    list_element = site->weak_next();
-  }
+  });
+
   Deoptimizer::DeoptimizeMarkedCode(isolate_);
 }
 
 
 void Heap::GarbageCollectionEpilogue() {
   TRACE_GC(tracer(), GCTracer::Scope::HEAP_EPILOGUE);
-  // In release mode, we only zap the from space under heap verification.
-  if (Heap::ShouldZapGarbage()) {
+  if (Heap::ShouldZapGarbage() || FLAG_clear_free_memory) {
     ZapFromSpace();
   }
 
@@ -1159,7 +1210,8 @@ intptr_t CompareWords(int size, HeapObject* a, HeapObject* b) {
   return 0;
 }
 
-void ReportDuplicates(int size, std::vector<HeapObject*>& objects) {
+void ReportDuplicates(Isolate* isolate, int size,
+                      std::vector<HeapObject*>& objects) {
   if (objects.size() == 0) return;
 
   sort(objects.begin(), objects.end(), [size](HeapObject* a, HeapObject* b) {
@@ -1195,7 +1247,7 @@ void ReportDuplicates(int size, std::vector<HeapObject*>& objects) {
     PrintF("%d duplicates of size %d each (%dKB)\n", it->first, size,
            duplicate_bytes / KB);
     PrintF("Sample object: ");
-    it->second->Print();
+    it->second->Print(isolate);
     PrintF("============================\n");
   }
 }
@@ -1237,6 +1289,7 @@ void Heap::CollectAllAvailableGarbage(GarbageCollectionReason gc_reason) {
   set_current_gc_flags(kNoGCFlags);
   new_space_->Shrink();
   UncommitFromSpace();
+  memory_allocator()->unmapper()->EnsureUnmappingCompleted();
 
   if (FLAG_trace_duplicate_threshold_kb) {
     std::map<int, std::vector<HeapObject*>> objects_by_size;
@@ -1256,7 +1309,7 @@ void Heap::CollectAllAvailableGarbage(GarbageCollectionReason gc_reason) {
     }
     for (auto it = objects_by_size.rbegin(); it != objects_by_size.rend();
          ++it) {
-      ReportDuplicates(it->first, it->second);
+      ReportDuplicates(isolate(), it->first, it->second);
     }
   }
 }
@@ -1325,6 +1378,9 @@ bool Heap::CollectGarbage(AllocationSpace space,
     InvokeNearHeapLimitCallback();
   }
 
+  // Ensure that all pending phantom callbacks are invoked.
+  isolate()->global_handles()->InvokeSecondPassPhantomCallbacks();
+
   // The VM is in the GC state until exiting this function.
   VMState<GC> state(isolate());
 
@@ -1367,11 +1423,18 @@ bool Heap::CollectGarbage(AllocationSpace space,
       TRACE_EVENT0("v8", gc_type_timer->name());
 
       HistogramTimer* gc_type_priority_timer = GCTypePriorityTimer(collector);
-      HistogramTimerScope histogram_timer_priority_scope(
-          gc_type_priority_timer);
+      OptionalHistogramTimerScopeMode mode =
+          isolate_->IsMemorySavingsModeActive()
+              ? OptionalHistogramTimerScopeMode::DONT_TAKE_TIME
+              : OptionalHistogramTimerScopeMode::TAKE_TIME;
+      OptionalHistogramTimerScope histogram_timer_priority_scope(
+          gc_type_priority_timer, mode);
 
       next_gc_likely_to_collect_more =
           PerformGarbageCollection(collector, gc_callback_flags);
+      if (collector == MARK_COMPACTOR) {
+        tracer()->RecordMarkCompactHistograms(gc_type_timer);
+      }
     }
 
     GarbageCollectionEpilogue();
@@ -1381,7 +1444,7 @@ bool Heap::CollectGarbage(AllocationSpace space,
 
     if (collector == MARK_COMPACTOR) {
       size_t committed_memory_after = CommittedOldGenerationMemory();
-      size_t used_memory_after = PromotedSpaceSizeOfObjects();
+      size_t used_memory_after = OldGenerationSizeOfObjects();
       MemoryReducer::Event event;
       event.type = MemoryReducer::kMarkCompact;
       event.time_ms = MonotonicallyIncreasingTimeInMs();
@@ -1435,7 +1498,7 @@ int Heap::NotifyContextDisposed(bool dependant_context) {
   }
   isolate()->AbortConcurrentOptimization(BlockingBehavior::kDontBlock);
 
-  number_of_disposed_maps_ = retained_maps()->Length();
+  number_of_disposed_maps_ = retained_maps()->length();
   tracer()->AddContextDisposalTime(MonotonicallyIncreasingTimeInMs());
   return ++contexts_disposed_;
 }
@@ -1471,12 +1534,11 @@ void Heap::StartIdleIncrementalMarking(
                           gc_callback_flags);
 }
 
-
 void Heap::MoveElements(FixedArray* array, int dst_index, int src_index,
-                        int len) {
+                        int len, WriteBarrierMode mode) {
   if (len == 0) return;
 
-  DCHECK(array->map() != fixed_cow_array_map());
+  DCHECK(array->map() != ReadOnlyRoots(this).fixed_cow_array_map());
   Object** dst = array->data_start() + dst_index;
   Object** src = array->data_start() + src_index;
   if (FLAG_concurrent_marking && incremental_marking()->IsMarking()) {
@@ -1494,6 +1556,7 @@ void Heap::MoveElements(FixedArray* array, int dst_index, int src_index,
   } else {
     MemMove(dst, src, len * kPointerSize);
   }
+  if (mode == SKIP_WRITE_BARRIER) return;
   FIXED_ARRAY_ELEMENTS_WRITE_BARRIER(this, array, dst_index, len);
 }
 
@@ -1502,15 +1565,16 @@ void Heap::MoveElements(FixedArray* array, int dst_index, int src_index,
 // Helper class for verifying the string table.
 class StringTableVerifier : public ObjectVisitor {
  public:
+  explicit StringTableVerifier(Isolate* isolate) : isolate_(isolate) {}
+
   void VisitPointers(HeapObject* host, Object** start, Object** end) override {
     // Visit all HeapObject pointers in [start, end).
     for (Object** p = start; p < end; p++) {
       DCHECK(!HasWeakHeapObjectTag(*p));
       if ((*p)->IsHeapObject()) {
         HeapObject* object = HeapObject::cast(*p);
-        Isolate* isolate = object->GetIsolate();
         // Check that the string is actually internalized.
-        CHECK(object->IsTheHole(isolate) || object->IsUndefined(isolate) ||
+        CHECK(object->IsTheHole(isolate_) || object->IsUndefined(isolate_) ||
               object->IsInternalizedString());
       }
     }
@@ -1519,12 +1583,14 @@ class StringTableVerifier : public ObjectVisitor {
                      MaybeObject** end) override {
     UNREACHABLE();
   }
-};
 
+ private:
+  Isolate* isolate_;
+};
 
-static void VerifyStringTable(Heap* heap) {
-  StringTableVerifier verifier;
-  heap->string_table()->IterateElements(&verifier);
+static void VerifyStringTable(Isolate* isolate) {
+  StringTableVerifier verifier(isolate);
+  isolate->heap()->string_table()->IterateElements(&verifier);
 }
 #endif  // VERIFY_HEAP
 
@@ -1538,7 +1604,10 @@ bool Heap::ReserveSpace(Reservation* reservations, std::vector<Address>* maps) {
          space < SerializerDeserializer::kNumberOfSpaces; space++) {
       Reservation* reservation = &reservations[space];
       DCHECK_LE(1, reservation->size());
-      if (reservation->at(0).size == 0) continue;
+      if (reservation->at(0).size == 0) {
+        DCHECK_EQ(1, reservation->size());
+        continue;
+      }
       bool perform_gc = false;
       if (space == MAP_SPACE) {
         // We allocate each map individually to avoid fragmentation.
@@ -1673,7 +1742,7 @@ bool Heap::PerformGarbageCollection(
 
 #ifdef VERIFY_HEAP
   if (FLAG_verify_heap) {
-    VerifyStringTable(this);
+    VerifyStringTable(this->isolate());
   }
 #endif
 
@@ -1709,7 +1778,7 @@ bool Heap::PerformGarbageCollection(
         // GC.
         old_generation_allocation_counter_at_last_gc_ +=
             static_cast<size_t>(promoted_objects_size_);
-        old_generation_size_at_last_gc_ = PromotedSpaceSizeOfObjects();
+        old_generation_size_at_last_gc_ = OldGenerationSizeOfObjects();
         break;
       case MINOR_MARK_COMPACTOR:
         MinorMarkCompact();
@@ -1743,7 +1812,7 @@ bool Heap::PerformGarbageCollection(
   }
 
   if (!fast_promotion_mode_ || collector == MARK_COMPACTOR) {
-    ComputeFastPromotionMode(promotion_ratio_ + semi_space_copied_rate_);
+    ComputeFastPromotionMode();
   }
 
   isolate_->counters()->objs_since_last_young()->Set(0);
@@ -1758,7 +1827,7 @@ bool Heap::PerformGarbageCollection(
   }
   gc_post_processing_depth_--;
 
-  isolate_->eternal_handles()->PostGarbageCollectionProcessing(this);
+  isolate_->eternal_handles()->PostGarbageCollectionProcessing();
 
   // Update relocatables.
   Relocatable::PostGarbageCollectionProcessing(isolate_);
@@ -1766,17 +1835,27 @@ bool Heap::PerformGarbageCollection(
   double gc_speed = tracer()->CombinedMarkCompactSpeedInBytesPerMillisecond();
   double mutator_speed =
       tracer()->CurrentOldGenerationAllocationThroughputInBytesPerMillisecond();
-  size_t old_gen_size = PromotedSpaceSizeOfObjects();
+  size_t old_gen_size = OldGenerationSizeOfObjects();
   if (collector == MARK_COMPACTOR) {
     // Register the amount of external allocated memory.
     external_memory_at_last_mark_compact_ = external_memory_;
     external_memory_limit_ = external_memory_ + kExternalAllocationSoftLimit;
-    SetOldGenerationAllocationLimit(old_gen_size, gc_speed, mutator_speed);
+
+    size_t new_limit = heap_controller()->CalculateOldGenerationAllocationLimit(
+        old_gen_size, max_old_generation_size_, gc_speed, mutator_speed,
+        new_space()->Capacity(), CurrentHeapGrowingMode());
+    old_generation_allocation_limit_ = new_limit;
+
     CheckIneffectiveMarkCompact(
         old_gen_size, tracer()->AverageMarkCompactMutatorUtilization());
   } else if (HasLowYoungGenerationAllocationRate() &&
              old_generation_size_configured_) {
-    DampenOldGenerationAllocationLimit(old_gen_size, gc_speed, mutator_speed);
+    size_t new_limit = heap_controller()->CalculateOldGenerationAllocationLimit(
+        old_gen_size, max_old_generation_size_, gc_speed, mutator_speed,
+        new_space()->Capacity(), CurrentHeapGrowingMode());
+    if (new_limit < old_generation_allocation_limit_) {
+      old_generation_allocation_limit_ = new_limit;
+    }
   }
 
   {
@@ -1792,7 +1871,7 @@ bool Heap::PerformGarbageCollection(
 
 #ifdef VERIFY_HEAP
   if (FLAG_verify_heap) {
-    VerifyStringTable(this);
+    VerifyStringTable(this->isolate());
   }
 #endif
 
@@ -1863,7 +1942,6 @@ void Heap::MinorMarkCompact() {
   AlwaysAllocateScope always_allocate(isolate());
   IncrementalMarking::PauseBlackAllocationScope pause_black_allocation(
       incremental_marking());
-  CodeSpaceMemoryModificationScope code_modifcation(this);
   ConcurrentMarking::PauseScope pause_scope(concurrent_marking());
 
   minor_mark_compact_collector()->CollectGarbage();
@@ -1920,16 +1998,14 @@ void Heap::CheckNewSpaceExpansionCriteria() {
 }
 
 static bool IsUnscavengedHeapObject(Heap* heap, Object** p) {
-  return heap->InFromSpace(*p) &&
+  return Heap::InFromSpace(*p) &&
          !HeapObject::cast(*p)->map_word().IsForwardingAddress();
 }
 
 class ScavengeWeakObjectRetainer : public WeakObjectRetainer {
  public:
-  explicit ScavengeWeakObjectRetainer(Heap* heap) : heap_(heap) {}
-
   virtual Object* RetainAs(Object* object) {
-    if (!heap_->InFromSpace(object)) {
+    if (!Heap::InFromSpace(object)) {
       return object;
     }
 
@@ -1939,9 +2015,6 @@ class ScavengeWeakObjectRetainer : public WeakObjectRetainer {
     }
     return nullptr;
   }
-
- private:
-  Heap* heap_;
 };
 
 void Heap::EvacuateYoungGeneration() {
@@ -1959,10 +2032,10 @@ void Heap::EvacuateYoungGeneration() {
   LOG(isolate_, ResourceEvent("scavenge", "begin"));
 
   // Move pages from new->old generation.
-  PageRange range(new_space()->bottom(), new_space()->top());
+  PageRange range(new_space()->first_allocatable_address(), new_space()->top());
   for (auto it = range.begin(); it != range.end();) {
     Page* p = (*++it)->prev_page();
-    p->Unlink();
+    new_space()->from_space().RemovePage(p);
     Page::ConvertNewToOld(p);
     if (incremental_marking()->IsMarking())
       mark_compact_collector()->RecordLiveSlotsOnPage(p);
@@ -2121,7 +2194,7 @@ void Heap::Scavenge() {
           job.AddItem(new PageScavengingItem(chunk));
         });
 
-    RootScavengeVisitor root_scavenge_visitor(this, scavengers[kMainThreadId]);
+    RootScavengeVisitor root_scavenge_visitor(scavengers[kMainThreadId]);
 
     {
       // Identify weak unmodified handles. Requires an unmodified graph.
@@ -2136,17 +2209,12 @@ void Heap::Scavenge() {
       TRACE_GC(tracer(), GCTracer::Scope::SCAVENGER_SCAVENGE_ROOTS);
       IterateRoots(&root_scavenge_visitor, VISIT_ALL_IN_SCAVENGE);
     }
-    {
-      // Weak collections are held strongly by the Scavenger.
-      TRACE_GC(tracer(), GCTracer::Scope::SCAVENGER_SCAVENGE_WEAK);
-      IterateEncounteredWeakCollections(&root_scavenge_visitor);
-    }
     {
       // Parallel phase scavenging all copied and promoted objects.
       TRACE_GC(tracer(), GCTracer::Scope::SCAVENGER_SCAVENGE_PARALLEL);
       job.Run(isolate()->async_counters());
-      DCHECK(copied_list.IsGlobalEmpty());
-      DCHECK(promotion_list.IsGlobalEmpty());
+      DCHECK(copied_list.IsEmpty());
+      DCHECK(promotion_list.IsEmpty());
     }
     {
       // Scavenge weak global handles.
@@ -2160,8 +2228,8 @@ void Heap::Scavenge() {
               &root_scavenge_visitor);
       scavengers[kMainThreadId]->Process();
 
-      DCHECK(copied_list.IsGlobalEmpty());
-      DCHECK(promotion_list.IsGlobalEmpty());
+      DCHECK(copied_list.IsEmpty());
+      DCHECK(promotion_list.IsEmpty());
       isolate()
           ->global_handles()
           ->IterateNewSpaceWeakUnmodifiedRootsForPhantomHandles(
@@ -2174,21 +2242,24 @@ void Heap::Scavenge() {
     }
   }
 
-  UpdateNewSpaceReferencesInExternalStringTable(
-      &UpdateNewSpaceReferenceInExternalStringTableEntry);
+  {
+    // Update references into new space
+    TRACE_GC(tracer(), GCTracer::Scope::SCAVENGER_SCAVENGE_UPDATE_REFS);
+    UpdateNewSpaceReferencesInExternalStringTable(
+        &UpdateNewSpaceReferenceInExternalStringTableEntry);
 
-  incremental_marking()->UpdateMarkingWorklistAfterScavenge();
+    incremental_marking()->UpdateMarkingWorklistAfterScavenge();
+  }
 
   if (FLAG_concurrent_marking) {
     // Ensure that concurrent marker does not track pages that are
     // going to be unmapped.
-    for (Page* p : PageRange(new_space()->FromSpaceStart(),
-                             new_space()->FromSpaceEnd())) {
+    for (Page* p : PageRange(new_space()->from_space().first_page(), nullptr)) {
       concurrent_marking()->ClearLiveness(p);
     }
   }
 
-  ScavengeWeakObjectRetainer weak_object_retainer(this);
+  ScavengeWeakObjectRetainer weak_object_retainer;
   ProcessYoungWeakReferences(&weak_object_retainer);
 
   // Set age mark.
@@ -2220,14 +2291,14 @@ void Heap::Scavenge() {
   SetGCState(NOT_IN_GC);
 }
 
-void Heap::ComputeFastPromotionMode(double survival_rate) {
+void Heap::ComputeFastPromotionMode() {
   const size_t survived_in_new_space =
       survived_last_scavenge_ * 100 / new_space_->Capacity();
   fast_promotion_mode_ =
       !FLAG_optimize_for_size && FLAG_fast_promotion_new_space &&
       !ShouldReduceMemory() && new_space_->IsAtMaximumCapacity() &&
       survived_in_new_space >= kMinPromotedPercentForFastPromotionMode;
-  if (FLAG_trace_gc_verbose) {
+  if (FLAG_trace_gc_verbose && !FLAG_trace_gc_ignore_scavenger) {
     PrintIsolate(
         isolate(), "Fast promotion mode: %s survival rate: %" PRIuS "%%\n",
         fast_promotion_mode_ ? "true" : "false", survived_in_new_space);
@@ -2288,12 +2359,12 @@ void Heap::ExternalStringTable::Verify() {
 #ifdef DEBUG
   for (size_t i = 0; i < new_space_strings_.size(); ++i) {
     Object* obj = Object::cast(new_space_strings_[i]);
-    DCHECK(heap_->InNewSpace(obj));
+    DCHECK(InNewSpace(obj));
     DCHECK(!obj->IsTheHole(heap_->isolate()));
   }
   for (size_t i = 0; i < old_space_strings_.size(); ++i) {
     Object* obj = Object::cast(old_space_strings_[i]);
-    DCHECK(!heap_->InNewSpace(obj));
+    DCHECK(!InNewSpace(obj));
     DCHECK(!obj->IsTheHole(heap_->isolate()));
   }
 #endif
@@ -2314,7 +2385,7 @@ void Heap::ExternalStringTable::UpdateNewSpaceReferences(
 
     DCHECK(target->IsExternalString());
 
-    if (heap_->InNewSpace(target)) {
+    if (InNewSpace(target)) {
       // String is still in new space. Update the table entry.
       *last = target;
       ++last;
@@ -2409,20 +2480,37 @@ void Heap::ProcessWeakListRoots(WeakObjectRetainer* retainer) {
   set_allocation_sites_list(retainer->RetainAs(allocation_sites_list()));
 }
 
+void Heap::ForeachAllocationSite(Object* list,
+                                 std::function<void(AllocationSite*)> visitor) {
+  DisallowHeapAllocation disallow_heap_allocation;
+  Object* current = list;
+  while (current->IsAllocationSite()) {
+    AllocationSite* site = AllocationSite::cast(current);
+    visitor(site);
+    Object* current_nested = site->nested_site();
+    while (current_nested->IsAllocationSite()) {
+      AllocationSite* nested_site = AllocationSite::cast(current_nested);
+      visitor(nested_site);
+      current_nested = nested_site->nested_site();
+    }
+    current = site->weak_next();
+  }
+}
+
 void Heap::ResetAllAllocationSitesDependentCode(PretenureFlag flag) {
   DisallowHeapAllocation no_allocation_scope;
-  Object* cur = allocation_sites_list();
   bool marked = false;
-  while (cur->IsAllocationSite()) {
-    AllocationSite* casted = AllocationSite::cast(cur);
-    if (casted->GetPretenureMode() == flag) {
-      casted->ResetPretenureDecision();
-      casted->set_deopt_dependent_code(true);
-      marked = true;
-      RemoveAllocationSitePretenuringFeedback(casted);
-    }
-    cur = casted->weak_next();
-  }
+
+  ForeachAllocationSite(allocation_sites_list(),
+                        [&marked, flag, this](AllocationSite* site) {
+                          if (site->GetPretenureMode() == flag) {
+                            site->ResetPretenureDecision();
+                            site->set_deopt_dependent_code(true);
+                            marked = true;
+                            RemoveAllocationSitePretenuringFeedback(site);
+                            return;
+                          }
+                        });
   if (marked) isolate_->stack_guard()->RequestDeoptMarkedAllocationSites();
 }
 
@@ -2457,20 +2545,21 @@ void Heap::VisitExternalResources(v8::ExternalResourceVisitor* visitor) {
   class ExternalStringTableVisitorAdapter : public RootVisitor {
    public:
     explicit ExternalStringTableVisitorAdapter(
-        v8::ExternalResourceVisitor* visitor)
-        : visitor_(visitor) {}
+        Isolate* isolate, v8::ExternalResourceVisitor* visitor)
+        : isolate_(isolate), visitor_(visitor) {}
     virtual void VisitRootPointers(Root root, const char* description,
                                    Object** start, Object** end) {
       for (Object** p = start; p < end; p++) {
         DCHECK((*p)->IsExternalString());
         visitor_->VisitExternalString(
-            Utils::ToLocal(Handle<String>(String::cast(*p))));
+            Utils::ToLocal(Handle<String>(String::cast(*p), isolate_)));
       }
     }
 
    private:
+    Isolate* isolate_;
     v8::ExternalResourceVisitor* visitor_;
-  } external_string_table_visitor(visitor);
+  } external_string_table_visitor(isolate(), visitor);
 
   external_string_table_.IterateAll(&external_string_table_visitor);
 }
@@ -2543,7 +2632,8 @@ void Heap::UnregisterArrayBuffer(JSArrayBuffer* buffer) {
 void Heap::ConfigureInitialOldGenerationSize() {
   if (!old_generation_size_configured_ && tracer()->SurvivalEventsRecorded()) {
     old_generation_allocation_limit_ =
-        Max(MinimumAllocationLimitGrowingStep(),
+        Max(heap_controller()->MinimumAllocationLimitGrowingStep(
+                CurrentHeapGrowingMode()),
             static_cast<size_t>(
                 static_cast<double>(old_generation_allocation_limit_) *
                 (tracer()->AverageSurvivalRatio() / 100)));
@@ -2582,10 +2672,6 @@ void Heap::CreateFixedStubs() {
   // we cannot create stubs while we are creating stubs.
   CodeStub::GenerateStubsAheadOfTime(isolate());
 
-  // MacroAssembler::Abort calls (usually enabled with --debug-code) depend on
-  // CEntryStub, so we need to call GenerateStubsAheadOfTime before JSEntryStub
-  // is created.
-
   // gcc-4.4 has problem generating correct code of following snippet:
   // {  JSEntryStub stub;
   //    js_entry_code_ = *stub.GetCode();
@@ -2733,7 +2819,7 @@ HeapObject* Heap::CreateFillerObjectAt(Address addr, int size,
         SKIP_WRITE_BARRIER);
     if (clear_memory_mode == ClearFreedMemoryMode::kClearFreedMemory) {
       Memory::Address_at(addr + kPointerSize) =
-          reinterpret_cast<Address>(kClearedFreeMemoryValue);
+          static_cast<Address>(kClearedFreeMemoryValue);
     }
   } else {
     DCHECK_GT(size, 2 * kPointerSize);
@@ -2777,6 +2863,29 @@ bool Heap::IsImmovable(HeapObject* object) {
   return chunk->NeverEvacuate() || chunk->owner()->identity() == LO_SPACE;
 }
 
+#ifdef ENABLE_SLOW_DCHECKS
+namespace {
+
+class LeftTrimmerVerifierRootVisitor : public RootVisitor {
+ public:
+  explicit LeftTrimmerVerifierRootVisitor(FixedArrayBase* to_check)
+      : to_check_(to_check) {}
+
+  virtual void VisitRootPointers(Root root, const char* description,
+                                 Object** start, Object** end) {
+    for (Object** p = start; p < end; ++p) {
+      DCHECK_NE(*p, to_check_);
+    }
+  }
+
+ private:
+  FixedArrayBase* to_check_;
+
+  DISALLOW_COPY_AND_ASSIGN(LeftTrimmerVerifierRootVisitor);
+};
+}  // namespace
+#endif  // ENABLE_SLOW_DCHECKS
+
 FixedArrayBase* Heap::LeftTrimFixedArray(FixedArrayBase* object,
                                          int elements_to_trim) {
   CHECK_NOT_NULL(object);
@@ -2792,7 +2901,7 @@ FixedArrayBase* Heap::LeftTrimFixedArray(FixedArrayBase* object,
   // In large object space the object's start must coincide with chunk
   // and thus the trick is just not applicable.
   DCHECK(!lo_space()->Contains(object));
-  DCHECK(object->map() != fixed_cow_array_map());
+  DCHECK(object->map() != ReadOnlyRoots(this).fixed_cow_array_map());
 
   STATIC_ASSERT(FixedArrayBase::kMapOffset == 0);
   STATIC_ASSERT(FixedArrayBase::kLengthOffset == kPointerSize);
@@ -2832,6 +2941,16 @@ FixedArrayBase* Heap::LeftTrimFixedArray(FixedArrayBase* object,
 
   // Notify the heap profiler of change in object layout.
   OnMoveEvent(new_object, object, new_object->Size());
+
+#ifdef ENABLE_SLOW_DCHECKS
+  if (FLAG_enable_slow_asserts) {
+    // Make sure the stack or other roots (e.g., Handles) don't contain pointers
+    // to the original FixedArray (which is now the filler object).
+    LeftTrimmerVerifierRootVisitor root_visitor(object);
+    IterateRoots(&root_visitor, VISIT_ALL);
+  }
+#endif  // ENABLE_SLOW_DCHECKS
+
   return new_object;
 }
 
@@ -2847,20 +2966,39 @@ void Heap::RightTrimFixedArray(FixedArrayBase* object, int elements_to_trim) {
     bytes_to_trim = ByteArray::SizeFor(len) - new_size;
     DCHECK_GE(bytes_to_trim, 0);
   } else if (object->IsFixedArray()) {
+    CHECK_NE(elements_to_trim, len);
     bytes_to_trim = elements_to_trim * kPointerSize;
   } else {
     DCHECK(object->IsFixedDoubleArray());
+    CHECK_NE(elements_to_trim, len);
     bytes_to_trim = elements_to_trim * kDoubleSize;
   }
 
+  CreateFillerForArray<FixedArrayBase>(object, elements_to_trim, bytes_to_trim);
+}
+
+void Heap::RightTrimWeakFixedArray(WeakFixedArray* object,
+                                   int elements_to_trim) {
+  // This function is safe to use only at the end of the mark compact
+  // collection: When marking, we record the weak slots, and shrinking
+  // invalidates them.
+  DCHECK_EQ(gc_state(), MARK_COMPACT);
+  CreateFillerForArray<WeakFixedArray>(object, elements_to_trim,
+                                       elements_to_trim * kPointerSize);
+}
+
+template <typename T>
+void Heap::CreateFillerForArray(T* object, int elements_to_trim,
+                                int bytes_to_trim) {
+  DCHECK(object->IsFixedArrayBase() || object->IsByteArray() ||
+         object->IsWeakFixedArray());
 
   // For now this trick is only applied to objects in new and paged space.
-  DCHECK(object->map() != fixed_cow_array_map());
+  DCHECK(object->map() != ReadOnlyRoots(this).fixed_cow_array_map());
 
   if (bytes_to_trim == 0) {
-    // No need to create filler and update live bytes counters, just initialize
-    // header of the trimmed array.
-    object->synchronized_set_length(len - elements_to_trim);
+    DCHECK_EQ(elements_to_trim, 0);
+    // No need to create filler and update live bytes counters.
     return;
   }
 
@@ -2892,7 +3030,7 @@ void Heap::RightTrimFixedArray(FixedArrayBase* object, int elements_to_trim) {
   // Initialize header of the trimmed array. We are storing the new length
   // using release store after creating a filler for the left-over space to
   // avoid races with the sweeper thread.
-  object->synchronized_set_length(len - elements_to_trim);
+  object->synchronized_set_length(object->length() - elements_to_trim);
 
   // Notify the heap object allocation tracker of change in object layout. The
   // array may not be moved during GC, and size has to be adjusted nevertheless.
@@ -3001,7 +3139,7 @@ void Heap::CheckIneffectiveMarkCompact(size_t old_generation_size,
 }
 
 bool Heap::HasHighFragmentation() {
-  size_t used = PromotedSpaceSizeOfObjects();
+  size_t used = OldGenerationSizeOfObjects();
   size_t committed = CommittedOldGenerationMemory();
   return HasHighFragmentation(used, committed);
 }
@@ -3017,7 +3155,8 @@ bool Heap::HasHighFragmentation(size_t used, size_t committed) {
 bool Heap::ShouldOptimizeForMemoryUsage() {
   const size_t kOldGenerationSlack = max_old_generation_size_ / 8;
   return FLAG_optimize_for_size || isolate()->IsIsolateInBackground() ||
-         HighMemoryPressure() || !CanExpandOldGeneration(kOldGenerationSlack);
+         isolate()->IsMemorySavingsModeActive() || HighMemoryPressure() ||
+         !CanExpandOldGeneration(kOldGenerationSlack);
 }
 
 void Heap::ActivateMemoryReducerIfNeeded() {
@@ -3436,6 +3575,7 @@ void Heap::RemoveNearHeapLimitCallback(v8::NearHeapLimitCallback callback,
 
 bool Heap::InvokeNearHeapLimitCallback() {
   if (near_heap_limit_callbacks_.size() > 0) {
+    HandleScope scope(isolate());
     v8::NearHeapLimitCallback callback =
         near_heap_limit_callbacks_.back().first;
     void* data = near_heap_limit_callbacks_.back().second;
@@ -3450,6 +3590,7 @@ bool Heap::InvokeNearHeapLimitCallback() {
 }
 
 void Heap::CollectCodeStatistics() {
+  TRACE_EVENT0("v8", "Heap::CollectCodeStatistics");
   CodeStatistics::ResetCodeAndMetadataStatistics(isolate());
   // We do not look for code in new space, or map space.  If code
   // somehow ends up in those spaces, we would miss it here.
@@ -3567,6 +3708,8 @@ bool Heap::InSpace(HeapObject* value, AllocationSpace space) {
       return map_space_->Contains(value);
     case LO_SPACE:
       return lo_space_->Contains(value);
+    case NEW_LO_SPACE:
+      return new_lo_space_->Contains(value);
     case RO_SPACE:
       return read_only_space_->Contains(value);
   }
@@ -3590,13 +3733,14 @@ bool Heap::InSpaceSlow(Address addr, AllocationSpace space) {
       return map_space_->ContainsSlow(addr);
     case LO_SPACE:
       return lo_space_->ContainsSlow(addr);
+    case NEW_LO_SPACE:
+      return new_lo_space_->ContainsSlow(addr);
     case RO_SPACE:
       return read_only_space_->ContainsSlow(addr);
   }
   UNREACHABLE();
 }
 
-
 bool Heap::IsValidAllocationSpace(AllocationSpace space) {
   switch (space) {
     case NEW_SPACE:
@@ -3604,6 +3748,7 @@ bool Heap::IsValidAllocationSpace(AllocationSpace space) {
     case CODE_SPACE:
     case MAP_SPACE:
     case LO_SPACE:
+    case NEW_LO_SPACE:
     case RO_SPACE:
       return true;
     default:
@@ -3631,16 +3776,22 @@ bool Heap::RootIsImmortalImmovable(int root_index) {
 
 #ifdef VERIFY_HEAP
 class VerifyReadOnlyPointersVisitor : public VerifyPointersVisitor {
+ public:
+  explicit VerifyReadOnlyPointersVisitor(Heap* heap)
+      : VerifyPointersVisitor(heap) {}
+
  protected:
   void VerifyPointers(HeapObject* host, MaybeObject** start,
                       MaybeObject** end) override {
+    if (host != nullptr) {
+      CHECK(heap_->InReadOnlySpace(host->map()));
+    }
     VerifyPointersVisitor::VerifyPointers(host, start, end);
 
     for (MaybeObject** current = start; current < end; current++) {
       HeapObject* object;
       if ((*current)->ToStrongOrWeakHeapObject(&object)) {
-        CHECK(
-            object->GetIsolate()->heap()->read_only_space()->Contains(object));
+        CHECK(heap_->InReadOnlySpace(object));
       }
     }
   }
@@ -3653,24 +3804,24 @@ void Heap::Verify() {
   // We have to wait here for the sweeper threads to have an iterable heap.
   mark_compact_collector()->EnsureSweepingCompleted();
 
-  VerifyPointersVisitor visitor;
+  VerifyPointersVisitor visitor(this);
   IterateRoots(&visitor, VISIT_ONLY_STRONG);
 
   VerifySmisVisitor smis_visitor;
   IterateSmiRoots(&smis_visitor);
 
-  new_space_->Verify();
+  new_space_->Verify(isolate());
 
-  old_space_->Verify(&visitor);
-  map_space_->Verify(&visitor);
+  old_space_->Verify(isolate(), &visitor);
+  map_space_->Verify(isolate(), &visitor);
 
-  VerifyPointersVisitor no_dirty_regions_visitor;
-  code_space_->Verify(&no_dirty_regions_visitor);
+  VerifyPointersVisitor no_dirty_regions_visitor(this);
+  code_space_->Verify(isolate(), &no_dirty_regions_visitor);
 
-  lo_space_->Verify();
+  lo_space_->Verify(isolate());
 
-  VerifyReadOnlyPointersVisitor read_only_visitor;
-  read_only_space_->Verify(&read_only_visitor);
+  VerifyReadOnlyPointersVisitor read_only_visitor(this);
+  read_only_space_->Verify(isolate(), &read_only_visitor);
 }
 
 class SlotVerifyingVisitor : public ObjectVisitor {
@@ -3730,20 +3881,17 @@ class SlotVerifyingVisitor : public ObjectVisitor {
 
 class OldToNewSlotVerifyingVisitor : public SlotVerifyingVisitor {
  public:
-  OldToNewSlotVerifyingVisitor(Heap* heap, std::set<Address>* untyped,
-                               std::set<std::pair<SlotType, Address> >* typed)
-      : SlotVerifyingVisitor(untyped, typed), heap_(heap) {}
+  OldToNewSlotVerifyingVisitor(std::set<Address>* untyped,
+                               std::set<std::pair<SlotType, Address>>* typed)
+      : SlotVerifyingVisitor(untyped, typed) {}
 
   bool ShouldHaveBeenRecorded(HeapObject* host, MaybeObject* target) override {
     DCHECK_IMPLIES(
-        target->IsStrongOrWeakHeapObject() && heap_->InNewSpace(target),
-        heap_->InToSpace(target));
-    return target->IsStrongOrWeakHeapObject() && heap_->InNewSpace(target) &&
-           !heap_->InNewSpace(host);
+        target->IsStrongOrWeakHeapObject() && Heap::InNewSpace(target),
+        Heap::InToSpace(target));
+    return target->IsStrongOrWeakHeapObject() && Heap::InNewSpace(target) &&
+           !Heap::InNewSpace(host);
   }
-
- private:
-  Heap* heap_;
 };
 
 template <RememberedSetType direction>
@@ -3769,7 +3917,10 @@ void CollectSlots(MemoryChunk* chunk, Address start, Address end,
 
 void Heap::VerifyRememberedSetFor(HeapObject* object) {
   MemoryChunk* chunk = MemoryChunk::FromAddress(object->address());
-  base::LockGuard<base::Mutex> lock_guard(chunk->mutex());
+  DCHECK_IMPLIES(chunk->mutex() == nullptr, InReadOnlySpace(object));
+  // In RO_SPACE chunk->mutex() may be nullptr, so just ignore it.
+  base::LockGuard<base::Mutex, base::NullBehavior::kIgnoreIfNull> lock_guard(
+      chunk->mutex());
   Address start = object->address();
   Address end = start + object->Size();
   std::set<Address> old_to_new;
@@ -3777,7 +3928,7 @@ void Heap::VerifyRememberedSetFor(HeapObject* object) {
   if (!InNewSpace(object)) {
     store_buffer()->MoveAllEntriesToRememberedSet();
     CollectSlots<OLD_TO_NEW>(chunk, start, end, &old_to_new, &typed_old_to_new);
-    OldToNewSlotVerifyingVisitor visitor(this, &old_to_new, &typed_old_to_new);
+    OldToNewSlotVerifyingVisitor visitor(&old_to_new, &typed_old_to_new);
     object->IterateBody(&visitor);
   }
   // TODO(ulan): Add old to old slot set verification once all weak objects
@@ -3805,13 +3956,10 @@ void Heap::VerifyCountersBeforeConcurrentSweeping() {
 
 void Heap::ZapFromSpace() {
   if (!new_space_->IsFromSpaceCommitted()) return;
-  for (Page* page :
-       PageRange(new_space_->FromSpaceStart(), new_space_->FromSpaceEnd())) {
-    for (Address cursor = page->area_start(), limit = page->area_end();
-         cursor < limit; cursor += kPointerSize) {
-      Memory::Address_at(cursor) =
-          reinterpret_cast<Address>(kFromSpaceZapValue);
-    }
+  for (Page* page : PageRange(new_space_->from_space().first_page(), nullptr)) {
+    memory_allocator()->ZapBlock(page->area_start(),
+                                 page->HighWaterMark() - page->area_start(),
+                                 ZapValue());
   }
 }
 
@@ -3823,6 +3971,26 @@ void Heap::ZapCodeObject(Address start_address, int size_in_bytes) {
 #endif
 }
 
+Code* Heap::builtin(int index) {
+  DCHECK(Builtins::IsBuiltinId(index));
+  // Code::cast cannot be used here since we access builtins
+  // during the marking phase of mark sweep. See IC::Clear.
+  return reinterpret_cast<Code*>(builtins_[index]);
+}
+
+Address Heap::builtin_address(int index) {
+  DCHECK(Builtins::IsBuiltinId(index) || index == Builtins::builtin_count);
+  return reinterpret_cast<Address>(&builtins_[index]);
+}
+
+void Heap::set_builtin(int index, HeapObject* builtin) {
+  DCHECK(Builtins::IsBuiltinId(index));
+  DCHECK(Internals::HasHeapObjectTag(builtin));
+  // The given builtin may be completely uninitialized thus we cannot check its
+  // type here.
+  builtins_[index] = builtin;
+}
+
 void Heap::IterateRoots(RootVisitor* v, VisitMode mode) {
   IterateStrongRoots(v, mode);
   IterateWeakRoots(v, mode);
@@ -3854,11 +4022,6 @@ void Heap::IterateSmiRoots(RootVisitor* v) {
   v->Synchronize(VisitorSynchronization::kSmiRootList);
 }
 
-void Heap::IterateEncounteredWeakCollections(RootVisitor* visitor) {
-  visitor->VisitRootPointer(Root::kWeakCollections, nullptr,
-                            &encountered_weak_collections_);
-}
-
 // We cannot avoid stale handles to left-trimmed objects, but can only make
 // sure all handles still needed are updated. Filter out a stale pointer
 // and clear the slot to allow post processing of handles (needed because
@@ -3889,9 +4052,10 @@ class FixStaleLeftTrimmedHandlesVisitor : public RootVisitor {
       // We need to find a FixedArrayBase map after walking the fillers.
       while (current->IsFiller()) {
         Address next = reinterpret_cast<Address>(current);
-        if (current->map() == heap_->one_pointer_filler_map()) {
+        if (current->map() == ReadOnlyRoots(heap_).one_pointer_filler_map()) {
           next += kPointerSize;
-        } else if (current->map() == heap_->two_pointer_filler_map()) {
+        } else if (current->map() ==
+                   ReadOnlyRoots(heap_).two_pointer_filler_map()) {
           next += 2 * kPointerSize;
         } else {
           next += current->Size();
@@ -3938,7 +4102,7 @@ void Heap::IterateStrongRoots(RootVisitor* v, VisitMode mode) {
   // heap. Note that it is not necessary to iterate over code objects
   // on scavenge collections.
   if (!isMinorGC) {
-    isolate_->builtins()->IterateBuiltins(v);
+    IterateBuiltins(v);
     v->Synchronize(VisitorSynchronization::kBuiltins);
     isolate_->interpreter()->IterateDispatchTable(v);
     v->Synchronize(VisitorSynchronization::kDispatchTable);
@@ -4002,14 +4166,18 @@ void Heap::IterateWeakGlobalHandles(RootVisitor* v) {
   isolate_->global_handles()->IterateWeakRoots(v);
 }
 
+void Heap::IterateBuiltins(RootVisitor* v) {
+  for (int i = 0; i < Builtins::builtin_count; i++) {
+    v->VisitRootPointer(Root::kBuiltins, Builtins::name(i), &builtins_[i]);
+  }
+}
+
 // TODO(1236194): Since the heap size is configurable on the command line
 // and through the API, we should gracefully handle the case that the heap
 // size is not big enough to fit all the initial objects.
-bool Heap::ConfigureHeap(size_t max_semi_space_size_in_kb,
+void Heap::ConfigureHeap(size_t max_semi_space_size_in_kb,
                          size_t max_old_generation_size_in_mb,
                          size_t code_range_size_in_mb) {
-  if (HasBeenSetUp()) return false;
-
   // Overwrite default configuration.
   if (max_semi_space_size_in_kb != 0) {
     max_semi_space_size_ =
@@ -4097,7 +4265,6 @@ bool Heap::ConfigureHeap(size_t max_semi_space_size_in_kb,
   code_range_size_ = code_range_size_in_mb * MB;
 
   configured_ = true;
-  return true;
 }
 
 
@@ -4124,11 +4291,13 @@ void Heap::GetFromRingBuffer(char* buffer) {
   memcpy(buffer + copied, trace_ring_buffer_, ring_buffer_end_);
 }
 
-bool Heap::ConfigureHeapDefault() { return ConfigureHeap(0, 0, 0); }
+void Heap::ConfigureHeapDefault() { ConfigureHeap(0, 0, 0); }
 
 void Heap::RecordStats(HeapStats* stats, bool take_snapshot) {
   *stats->start_marker = HeapStats::kStartMarker;
   *stats->end_marker = HeapStats::kEndMarker;
+  *stats->ro_space_size = read_only_space_->Size();
+  *stats->ro_space_capacity = read_only_space_->Capacity();
   *stats->new_space_size = new_space_->Size();
   *stats->new_space_capacity = new_space_->Capacity();
   *stats->old_space_size = old_space_->SizeOfObjects();
@@ -4168,9 +4337,14 @@ void Heap::RecordStats(HeapStats* stats, bool take_snapshot) {
   }
 }
 
-size_t Heap::PromotedSpaceSizeOfObjects() {
-  return old_space_->SizeOfObjects() + code_space_->SizeOfObjects() +
-         map_space_->SizeOfObjects() + lo_space_->SizeOfObjects();
+size_t Heap::OldGenerationSizeOfObjects() {
+  PagedSpaces spaces(this, PagedSpaces::SpacesSpecifier::kAllPagedSpaces);
+  size_t total = 0;
+  for (PagedSpace* space = spaces.next(); space != nullptr;
+       space = spaces.next()) {
+    total += space->SizeOfObjects();
+  }
+  return total + lo_space_->SizeOfObjects();
 }
 
 uint64_t Heap::PromotedExternalMemorySize() {
@@ -4179,176 +4353,6 @@ uint64_t Heap::PromotedExternalMemorySize() {
                                external_memory_at_last_mark_compact_);
 }
 
-
-const double Heap::kMinHeapGrowingFactor = 1.1;
-const double Heap::kMaxHeapGrowingFactor = 4.0;
-const double Heap::kMaxHeapGrowingFactorMemoryConstrained = 2.0;
-const double Heap::kMaxHeapGrowingFactorIdle = 1.5;
-const double Heap::kConservativeHeapGrowingFactor = 1.3;
-const double Heap::kTargetMutatorUtilization = 0.97;
-
-// Given GC speed in bytes per ms, the allocation throughput in bytes per ms
-// (mutator speed), this function returns the heap growing factor that will
-// achieve the kTargetMutatorUtilisation if the GC speed and the mutator speed
-// remain the same until the next GC.
-//
-// For a fixed time-frame T = TM + TG, the mutator utilization is the ratio
-// TM / (TM + TG), where TM is the time spent in the mutator and TG is the
-// time spent in the garbage collector.
-//
-// Let MU be kTargetMutatorUtilisation, the desired mutator utilization for the
-// time-frame from the end of the current GC to the end of the next GC. Based
-// on the MU we can compute the heap growing factor F as
-//
-// F = R * (1 - MU) / (R * (1 - MU) - MU), where R = gc_speed / mutator_speed.
-//
-// This formula can be derived as follows.
-//
-// F = Limit / Live by definition, where the Limit is the allocation limit,
-// and the Live is size of live objects.
-// Let’s assume that we already know the Limit. Then:
-//   TG = Limit / gc_speed
-//   TM = (TM + TG) * MU, by definition of MU.
-//   TM = TG * MU / (1 - MU)
-//   TM = Limit *  MU / (gc_speed * (1 - MU))
-// On the other hand, if the allocation throughput remains constant:
-//   Limit = Live + TM * allocation_throughput = Live + TM * mutator_speed
-// Solving it for TM, we get
-//   TM = (Limit - Live) / mutator_speed
-// Combining the two equation for TM:
-//   (Limit - Live) / mutator_speed = Limit * MU / (gc_speed * (1 - MU))
-//   (Limit - Live) = Limit * MU * mutator_speed / (gc_speed * (1 - MU))
-// substitute R = gc_speed / mutator_speed
-//   (Limit - Live) = Limit * MU  / (R * (1 - MU))
-// substitute F = Limit / Live
-//   F - 1 = F * MU  / (R * (1 - MU))
-//   F - F * MU / (R * (1 - MU)) = 1
-//   F * (1 - MU / (R * (1 - MU))) = 1
-//   F * (R * (1 - MU) - MU) / (R * (1 - MU)) = 1
-//   F = R * (1 - MU) / (R * (1 - MU) - MU)
-double Heap::HeapGrowingFactor(double gc_speed, double mutator_speed,
-                               double max_factor) {
-  DCHECK_LE(kMinHeapGrowingFactor, max_factor);
-  DCHECK_GE(kMaxHeapGrowingFactor, max_factor);
-  if (gc_speed == 0 || mutator_speed == 0) return max_factor;
-
-  const double speed_ratio = gc_speed / mutator_speed;
-  const double mu = kTargetMutatorUtilization;
-
-  const double a = speed_ratio * (1 - mu);
-  const double b = speed_ratio * (1 - mu) - mu;
-
-  // The factor is a / b, but we need to check for small b first.
-  double factor = (a < b * max_factor) ? a / b : max_factor;
-  factor = Min(factor, max_factor);
-  factor = Max(factor, kMinHeapGrowingFactor);
-  return factor;
-}
-
-double Heap::MaxHeapGrowingFactor(size_t max_old_generation_size) {
-  const double min_small_factor = 1.3;
-  const double max_small_factor = 2.0;
-  const double high_factor = 4.0;
-
-  size_t max_old_generation_size_in_mb = max_old_generation_size / MB;
-  max_old_generation_size_in_mb =
-      Max(max_old_generation_size_in_mb,
-          static_cast<size_t>(kMinOldGenerationSize));
-
-  // If we are on a device with lots of memory, we allow a high heap
-  // growing factor.
-  if (max_old_generation_size_in_mb >= kMaxOldGenerationSize) {
-    return high_factor;
-  }
-
-  DCHECK_GE(max_old_generation_size_in_mb, kMinOldGenerationSize);
-  DCHECK_LT(max_old_generation_size_in_mb, kMaxOldGenerationSize);
-
-  // On smaller devices we linearly scale the factor: (X-A)/(B-A)*(D-C)+C
-  double factor = (max_old_generation_size_in_mb - kMinOldGenerationSize) *
-                      (max_small_factor - min_small_factor) /
-                      (kMaxOldGenerationSize - kMinOldGenerationSize) +
-                  min_small_factor;
-  return factor;
-}
-
-size_t Heap::CalculateOldGenerationAllocationLimit(double factor,
-                                                   size_t old_gen_size) {
-  CHECK_LT(1.0, factor);
-  CHECK_LT(0, old_gen_size);
-  uint64_t limit = static_cast<uint64_t>(old_gen_size * factor);
-  limit = Max(limit, static_cast<uint64_t>(old_gen_size) +
-                         MinimumAllocationLimitGrowingStep());
-  limit += new_space_->Capacity();
-  uint64_t halfway_to_the_max =
-      (static_cast<uint64_t>(old_gen_size) + max_old_generation_size_) / 2;
-  return static_cast<size_t>(Min(limit, halfway_to_the_max));
-}
-
-size_t Heap::MinimumAllocationLimitGrowingStep() {
-  const size_t kRegularAllocationLimitGrowingStep = 8;
-  const size_t kLowMemoryAllocationLimitGrowingStep = 2;
-  size_t limit = (Page::kPageSize > MB ? Page::kPageSize : MB);
-  return limit * (ShouldOptimizeForMemoryUsage()
-                      ? kLowMemoryAllocationLimitGrowingStep
-                      : kRegularAllocationLimitGrowingStep);
-}
-
-void Heap::SetOldGenerationAllocationLimit(size_t old_gen_size, double gc_speed,
-                                           double mutator_speed) {
-  double max_factor = MaxHeapGrowingFactor(max_old_generation_size_);
-  double factor = HeapGrowingFactor(gc_speed, mutator_speed, max_factor);
-
-  if (FLAG_trace_gc_verbose) {
-    isolate_->PrintWithTimestamp(
-        "Heap growing factor %.1f based on mu=%.3f, speed_ratio=%.f "
-        "(gc=%.f, mutator=%.f)\n",
-        factor, kTargetMutatorUtilization, gc_speed / mutator_speed, gc_speed,
-        mutator_speed);
-  }
-
-  if (memory_reducer_->ShouldGrowHeapSlowly() ||
-      ShouldOptimizeForMemoryUsage()) {
-    factor = Min(factor, kConservativeHeapGrowingFactor);
-  }
-
-  if (FLAG_stress_compaction || ShouldReduceMemory()) {
-    factor = kMinHeapGrowingFactor;
-  }
-
-  if (FLAG_heap_growing_percent > 0) {
-    factor = 1.0 + FLAG_heap_growing_percent / 100.0;
-  }
-
-  old_generation_allocation_limit_ =
-      CalculateOldGenerationAllocationLimit(factor, old_gen_size);
-
-  if (FLAG_trace_gc_verbose) {
-    isolate_->PrintWithTimestamp(
-        "Grow: old size: %" PRIuS " KB, new limit: %" PRIuS " KB (%.1f)\n",
-        old_gen_size / KB, old_generation_allocation_limit_ / KB, factor);
-  }
-}
-
-void Heap::DampenOldGenerationAllocationLimit(size_t old_gen_size,
-                                              double gc_speed,
-                                              double mutator_speed) {
-  double max_factor = MaxHeapGrowingFactor(max_old_generation_size_);
-  double factor = HeapGrowingFactor(gc_speed, mutator_speed, max_factor);
-  size_t limit = CalculateOldGenerationAllocationLimit(factor, old_gen_size);
-  if (limit < old_generation_allocation_limit_) {
-    if (FLAG_trace_gc_verbose) {
-      isolate_->PrintWithTimestamp(
-          "Dampen: old size: %" PRIuS " KB, old limit: %" PRIuS
-          " KB, "
-          "new limit: %" PRIuS " KB (%.1f)\n",
-          old_gen_size / KB, old_generation_allocation_limit_ / KB, limit / KB,
-          factor);
-    }
-    old_generation_allocation_limit_ = limit;
-  }
-}
-
 bool Heap::ShouldOptimizeForLoadTime() {
   return isolate()->rail_mode() == PERFORMANCE_LOAD &&
          !AllocationLimitOvershotByLargeMargin() &&
@@ -4381,6 +4385,22 @@ bool Heap::ShouldExpandOldGenerationOnSlowAllocation() {
   return true;
 }
 
+Heap::HeapGrowingMode Heap::CurrentHeapGrowingMode() {
+  if (ShouldReduceMemory() || FLAG_stress_compaction) {
+    return Heap::HeapGrowingMode::kMinimal;
+  }
+
+  if (ShouldOptimizeForMemoryUsage()) {
+    return Heap::HeapGrowingMode::kConservative;
+  }
+
+  if (memory_reducer()->ShouldGrowHeapSlowly()) {
+    return Heap::HeapGrowingMode::kSlow;
+  }
+
+  return Heap::HeapGrowingMode::kDefault;
+}
+
 // This function returns either kNoLimit, kSoftLimit, or kHardLimit.
 // The kNoLimit means that either incremental marking is disabled or it is too
 // early to start incremental marking.
@@ -4396,7 +4416,7 @@ Heap::IncrementalMarkingLimit Heap::IncrementalMarkingLimitReached() {
   if (FLAG_stress_incremental_marking) {
     return IncrementalMarkingLimit::kHardLimit;
   }
-  if (PromotedSpaceSizeOfObjects() <=
+  if (OldGenerationSizeOfObjects() <=
       IncrementalMarking::kActivationThreshold) {
     // Incremental marking is disabled or it is too early to start.
     return IncrementalMarkingLimit::kNoLimit;
@@ -4412,7 +4432,9 @@ Heap::IncrementalMarkingLimit Heap::IncrementalMarkingLimitReached() {
     double gained_since_last_gc =
         PromotedSinceLastGC() +
         (external_memory_ - external_memory_at_last_mark_compact_);
-    double size_before_gc = PromotedTotalSize() - gained_since_last_gc;
+    double size_before_gc =
+        OldGenerationObjectsAndPromotedExternalMemorySize() -
+        gained_since_last_gc;
     double bytes_to_limit = old_generation_allocation_limit_ - size_before_gc;
     if (bytes_to_limit > 0) {
       double current_percent = (gained_since_last_gc / bytes_to_limit) * 100.0;
@@ -4479,12 +4501,38 @@ void Heap::DisableInlineAllocation() {
   }
 }
 
-HeapObject* Heap::AllocateRawWithRetry(int size, AllocationSpace space,
-                                       AllocationAlignment alignment) {
-  AllocationResult alloc = AllocateRaw(size, space, alignment);
+HeapObject* Heap::EnsureImmovableCode(HeapObject* heap_object,
+                                      int object_size) {
+  // Code objects which should stay at a fixed address are allocated either
+  // in the first page of code space, in large object space, or (during
+  // snapshot creation) the containing page is marked as immovable.
+  DCHECK(heap_object);
+  DCHECK(code_space_->Contains(heap_object));
+  DCHECK_GE(object_size, 0);
+  if (!Heap::IsImmovable(heap_object)) {
+    if (isolate()->serializer_enabled() ||
+        code_space_->first_page()->Contains(heap_object->address())) {
+      MemoryChunk::FromAddress(heap_object->address())->MarkNeverEvacuate();
+    } else {
+      // Discard the first code allocation, which was on a page where it could
+      // be moved.
+      CreateFillerObjectAt(heap_object->address(), object_size,
+                           ClearRecordedSlots::kNo);
+      heap_object = AllocateRawCodeInLargeObjectSpace(object_size);
+      UnprotectAndRegisterMemoryChunk(heap_object);
+      ZapCodeObject(heap_object->address(), object_size);
+      OnAllocationEvent(heap_object, object_size);
+    }
+  }
+  return heap_object;
+}
+
+HeapObject* Heap::AllocateRawWithLightRetry(int size, AllocationSpace space,
+                                            AllocationAlignment alignment) {
   HeapObject* result;
+  AllocationResult alloc = AllocateRaw(size, space, alignment);
   if (alloc.To(&result)) {
-    DCHECK(result != exception());
+    DCHECK(result != ReadOnlyRoots(this).exception());
     return result;
   }
   // Two GCs before panicking. In newspace will almost always succeed.
@@ -4493,10 +4541,19 @@ HeapObject* Heap::AllocateRawWithRetry(int size, AllocationSpace space,
                    GarbageCollectionReason::kAllocationFailure);
     alloc = AllocateRaw(size, space, alignment);
     if (alloc.To(&result)) {
-      DCHECK(result != exception());
+      DCHECK(result != ReadOnlyRoots(this).exception());
       return result;
     }
   }
+  return nullptr;
+}
+
+HeapObject* Heap::AllocateRawWithRetryOrFail(int size, AllocationSpace space,
+                                             AllocationAlignment alignment) {
+  AllocationResult alloc;
+  HeapObject* result = AllocateRawWithLightRetry(size, space, alignment);
+  if (result) return result;
+
   isolate()->counters()->gc_last_resort_from_handles()->Increment();
   CollectAllAvailableGarbage(GarbageCollectionReason::kLastResort);
   {
@@ -4504,7 +4561,7 @@ HeapObject* Heap::AllocateRawWithRetry(int size, AllocationSpace space,
     alloc = AllocateRaw(size, space, alignment);
   }
   if (alloc.To(&result)) {
-    DCHECK(result != exception());
+    DCHECK(result != ReadOnlyRoots(this).exception());
     return result;
   }
   // TODO(1181417): Fix this.
@@ -4518,7 +4575,7 @@ HeapObject* Heap::AllocateRawCodeInLargeObjectSpace(int size) {
   AllocationResult alloc = lo_space()->AllocateRaw(size, EXECUTABLE);
   HeapObject* result;
   if (alloc.To(&result)) {
-    DCHECK(result != exception());
+    DCHECK(result != ReadOnlyRoots(this).exception());
     return result;
   }
   // Two GCs before panicking.
@@ -4527,7 +4584,7 @@ HeapObject* Heap::AllocateRawCodeInLargeObjectSpace(int size) {
                    GarbageCollectionReason::kAllocationFailure);
     alloc = lo_space()->AllocateRaw(size, EXECUTABLE);
     if (alloc.To(&result)) {
-      DCHECK(result != exception());
+      DCHECK(result != ReadOnlyRoots(this).exception());
       return result;
     }
   }
@@ -4538,7 +4595,7 @@ HeapObject* Heap::AllocateRawCodeInLargeObjectSpace(int size) {
     alloc = lo_space()->AllocateRaw(size, EXECUTABLE);
   }
   if (alloc.To(&result)) {
-    DCHECK(result != exception());
+    DCHECK(result != ReadOnlyRoots(this).exception());
     return result;
   }
   // TODO(1181417): Fix this.
@@ -4546,33 +4603,31 @@ HeapObject* Heap::AllocateRawCodeInLargeObjectSpace(int size) {
   return nullptr;
 }
 
-bool Heap::SetUp() {
+void Heap::SetUp() {
 #ifdef V8_ENABLE_ALLOCATION_TIMEOUT
   allocation_timeout_ = NextAllocationTimeout();
 #endif
 
-  // Initialize heap spaces and initial maps and objects. Whenever something
-  // goes wrong, just return false. The caller should check the results and
-  // call Heap::TearDown() to release allocated memory.
+  // Initialize heap spaces and initial maps and objects.
   //
   // If the heap is not yet configured (e.g. through the API), configure it.
   // Configuration is based on the flags new-space-size (really the semispace
   // size) and old-space-size if set or the initial values of semispace_size_
   // and old_generation_size_ otherwise.
-  if (!configured_) {
-    if (!ConfigureHeapDefault()) return false;
-  }
+  if (!configured_) ConfigureHeapDefault();
 
   mmap_region_base_ =
       reinterpret_cast<uintptr_t>(v8::internal::GetRandomMmapAddr()) &
       ~kMmapRegionMask;
 
   // Set up memory allocator.
-  memory_allocator_ = new MemoryAllocator(isolate_);
-  if (!memory_allocator_->SetUp(MaxReserved(), code_range_size_)) return false;
+  memory_allocator_ =
+      new MemoryAllocator(isolate_, MaxReserved(), code_range_size_);
 
   store_buffer_ = new StoreBuffer(this);
 
+  heap_controller_ = new HeapController(this);
+
   mark_compact_collector_ = new MarkCompactCollector(this);
   incremental_marking_ =
       new IncrementalMarking(this, mark_compact_collector_->marking_worklist(),
@@ -4589,34 +4644,18 @@ bool Heap::SetUp() {
         new ConcurrentMarking(this, nullptr, nullptr, nullptr, nullptr);
   }
 
-  for (int i = 0; i <= LAST_SPACE; i++) {
+  for (int i = FIRST_SPACE; i <= LAST_SPACE; i++) {
     space_[i] = nullptr;
   }
 
-  space_[NEW_SPACE] = new_space_ = new NewSpace(this);
-  if (!new_space_->SetUp(initial_semispace_size_, max_semi_space_size_)) {
-    return false;
-  }
-
-  space_[OLD_SPACE] = old_space_ =
-      new OldSpace(this, OLD_SPACE, NOT_EXECUTABLE);
-  if (!old_space_->SetUp()) return false;
-
-  space_[CODE_SPACE] = code_space_ = new OldSpace(this, CODE_SPACE, EXECUTABLE);
-  if (!code_space_->SetUp()) return false;
-
-  space_[MAP_SPACE] = map_space_ = new MapSpace(this, MAP_SPACE);
-  if (!map_space_->SetUp()) return false;
-
-  // The large object code space may contain code or data.  We set the memory
-  // to be non-executable here for safety, but this means we need to enable it
-  // explicitly when allocating large code objects.
-  space_[LO_SPACE] = lo_space_ = new LargeObjectSpace(this, LO_SPACE);
-  if (!lo_space_->SetUp()) return false;
-
-  space_[RO_SPACE] = read_only_space_ =
-      new ReadOnlySpace(this, RO_SPACE, NOT_EXECUTABLE);
-  if (!read_only_space_->SetUp()) return false;
+  space_[RO_SPACE] = read_only_space_ = new ReadOnlySpace(this);
+  space_[NEW_SPACE] = new_space_ =
+      new NewSpace(this, initial_semispace_size_, max_semi_space_size_);
+  space_[OLD_SPACE] = old_space_ = new OldSpace(this);
+  space_[CODE_SPACE] = code_space_ = new CodeSpace(this);
+  space_[MAP_SPACE] = map_space_ = new MapSpace(this);
+  space_[LO_SPACE] = lo_space_ = new LargeObjectSpace(this);
+  space_[NEW_LO_SPACE] = new_lo_space_ = new NewLargeObjectSpace(this);
 
   // Set up the seed that is used to randomize the string hash function.
   DCHECK_EQ(Smi::kZero, hash_seed());
@@ -4676,8 +4715,6 @@ bool Heap::SetUp() {
   write_protect_code_memory_ = FLAG_write_protect_code_memory;
 
   external_reference_table_.Init(isolate_);
-
-  return true;
 }
 
 void Heap::InitializeHashSeed() {
@@ -4752,6 +4789,7 @@ void Heap::NotifyDeserializationComplete() {
 #endif  // DEBUG
   }
 
+  read_only_space()->MarkAsReadOnly();
   deserialization_complete_ = true;
 }
 
@@ -4764,8 +4802,8 @@ void Heap::TracePossibleWrapper(JSObject* js_object) {
   DCHECK(js_object->WasConstructedFromApiFunction());
   if (js_object->GetEmbedderFieldCount() >= 2 &&
       js_object->GetEmbedderField(0) &&
-      js_object->GetEmbedderField(0) != undefined_value() &&
-      js_object->GetEmbedderField(1) != undefined_value()) {
+      js_object->GetEmbedderField(0) != ReadOnlyRoots(this).undefined_value() &&
+      js_object->GetEmbedderField(1) != ReadOnlyRoots(this).undefined_value()) {
     DCHECK_EQ(0,
               reinterpret_cast<intptr_t>(js_object->GetEmbedderField(0)) % 2);
     local_embedder_heap_tracer()->AddWrapperToTrace(std::pair<void*, void*>(
@@ -4829,6 +4867,11 @@ void Heap::TearDown() {
     stress_scavenge_observer_ = nullptr;
   }
 
+  if (heap_controller_ != nullptr) {
+    delete heap_controller_;
+    heap_controller_ = nullptr;
+  }
+
   if (mark_compact_collector_ != nullptr) {
     mark_compact_collector_->TearDown();
     delete mark_compact_collector_;
@@ -4891,34 +4934,9 @@ void Heap::TearDown() {
   delete tracer_;
   tracer_ = nullptr;
 
-  new_space_->TearDown();
-  delete new_space_;
-  new_space_ = nullptr;
-
-  if (old_space_ != nullptr) {
-    delete old_space_;
-    old_space_ = nullptr;
-  }
-
-  if (code_space_ != nullptr) {
-    delete code_space_;
-    code_space_ = nullptr;
-  }
-
-  if (map_space_ != nullptr) {
-    delete map_space_;
-    map_space_ = nullptr;
-  }
-
-  if (lo_space_ != nullptr) {
-    lo_space_->TearDown();
-    delete lo_space_;
-    lo_space_ = nullptr;
-  }
-
-  if (read_only_space_ != nullptr) {
-    delete read_only_space_;
-    read_only_space_ = nullptr;
+  for (int i = FIRST_SPACE; i <= LAST_SPACE; i++) {
+    delete space_[i];
+    space_[i] = nullptr;
   }
 
   store_buffer()->TearDown();
@@ -5016,33 +5034,38 @@ void Heap::AddRetainedMap(Handle<Map> map) {
   if (map->is_in_retained_map_list()) {
     return;
   }
-  Handle<WeakCell> cell = Map::WeakCellForMap(map);
-  Handle<ArrayList> array(retained_maps(), isolate());
+  Handle<WeakArrayList> array(retained_maps(), isolate());
   if (array->IsFull()) {
     CompactRetainedMaps(*array);
   }
-  array = ArrayList::Add(
-      array, cell, handle(Smi::FromInt(FLAG_retain_maps_for_n_gc), isolate()));
+  array = WeakArrayList::AddToEnd(array, MaybeObjectHandle::Weak(map));
+  array = WeakArrayList::AddToEnd(
+      array,
+      MaybeObjectHandle(Smi::FromInt(FLAG_retain_maps_for_n_gc), isolate()));
   if (*array != retained_maps()) {
     set_retained_maps(*array);
   }
   map->set_is_in_retained_map_list(true);
 }
 
-
-void Heap::CompactRetainedMaps(ArrayList* retained_maps) {
+void Heap::CompactRetainedMaps(WeakArrayList* retained_maps) {
   DCHECK_EQ(retained_maps, this->retained_maps());
-  int length = retained_maps->Length();
+  int length = retained_maps->length();
   int new_length = 0;
   int new_number_of_disposed_maps = 0;
   // This loop compacts the array by removing cleared weak cells.
   for (int i = 0; i < length; i += 2) {
-    DCHECK(retained_maps->Get(i)->IsWeakCell());
-    WeakCell* cell = WeakCell::cast(retained_maps->Get(i));
-    Object* age = retained_maps->Get(i + 1);
-    if (cell->cleared()) continue;
+    MaybeObject* maybe_object = retained_maps->Get(i);
+    if (maybe_object->IsClearedWeakHeapObject()) {
+      continue;
+    }
+
+    DCHECK(maybe_object->IsWeakHeapObject());
+
+    MaybeObject* age = retained_maps->Get(i + 1);
+    DCHECK(age->IsSmi());
     if (i != new_length) {
-      retained_maps->Set(new_length, cell);
+      retained_maps->Set(new_length, maybe_object);
       retained_maps->Set(new_length + 1, age);
     }
     if (i < number_of_disposed_maps_) {
@@ -5051,11 +5074,11 @@ void Heap::CompactRetainedMaps(ArrayList* retained_maps) {
     new_length += 2;
   }
   number_of_disposed_maps_ = new_number_of_disposed_maps;
-  Object* undefined = undefined_value();
+  HeapObject* undefined = ReadOnlyRoots(this).undefined_value();
   for (int i = new_length; i < length; i++) {
-    retained_maps->Clear(i, undefined);
+    retained_maps->Set(i, HeapObjectReference::Strong(undefined));
   }
-  if (new_length != length) retained_maps->SetLength(new_length);
+  if (new_length != length) retained_maps->set_length(new_length);
 }
 
 void Heap::FatalProcessOutOfMemory(const char* location) {
@@ -5142,7 +5165,7 @@ void Heap::RecordWriteIntoCodeSlow(Code* host, RelocInfo* rinfo,
   SlotType slot_type = SlotTypeForRelocInfoMode(rmode);
   if (rinfo->IsInConstantPool()) {
     addr = rinfo->constant_pool_entry_address();
-    if (RelocInfo::IsCodeTarget(rmode)) {
+    if (RelocInfo::IsCodeTargetMode(rmode)) {
       slot_type = CODE_ENTRY_SLOT;
     } else {
       DCHECK(RelocInfo::IsEmbeddedObject(rmode));
@@ -5375,12 +5398,11 @@ void Heap::ExternalStringTable::CleanUpNewSpaceStrings() {
     if (o->IsTheHole(isolate)) {
       continue;
     }
-    if (o->IsThinString()) {
-      o = ThinString::cast(o)->actual();
-      if (!o->IsExternalString()) continue;
-    }
+    // The real external string is already in one of these vectors and was or
+    // will be processed. Re-processing it will add a duplicate to the vector.
+    if (o->IsThinString()) continue;
     DCHECK(o->IsExternalString());
-    if (heap_->InNewSpace(o)) {
+    if (InNewSpace(o)) {
       new_space_strings_[last++] = o;
     } else {
       old_space_strings_.push_back(o);
@@ -5398,12 +5420,11 @@ void Heap::ExternalStringTable::CleanUpAll() {
     if (o->IsTheHole(isolate)) {
       continue;
     }
-    if (o->IsThinString()) {
-      o = ThinString::cast(o)->actual();
-      if (!o->IsExternalString()) continue;
-    }
+    // The real external string is already in one of these vectors and was or
+    // will be processed. Re-processing it will add a duplicate to the vector.
+    if (o->IsThinString()) continue;
     DCHECK(o->IsExternalString());
-    DCHECK(!heap_->InNewSpace(o));
+    DCHECK(!InNewSpace(o));
     old_space_strings_[last++] = o;
   }
   old_space_strings_.resize(last);
@@ -5437,15 +5458,13 @@ void Heap::ExternalStringTable::TearDown() {
 
 
 void Heap::RememberUnmappedPage(Address page, bool compacted) {
-  uintptr_t p = reinterpret_cast<uintptr_t>(page);
   // Tag the page pointer to make it findable in the dump file.
   if (compacted) {
-    p ^= 0xC1EAD & (Page::kPageSize - 1);  // Cleared.
+    page ^= 0xC1EAD & (Page::kPageSize - 1);  // Cleared.
   } else {
-    p ^= 0x1D1ED & (Page::kPageSize - 1);  // I died.
+    page ^= 0x1D1ED & (Page::kPageSize - 1);  // I died.
   }
-  remembered_unmapped_pages_[remembered_unmapped_pages_index_] =
-      reinterpret_cast<Address>(p);
+  remembered_unmapped_pages_[remembered_unmapped_pages_index_] = page;
   remembered_unmapped_pages_index_++;
   remembered_unmapped_pages_index_ %= kRememberedUnmappedPages;
 }
@@ -5571,6 +5590,8 @@ const char* AllocationSpaceName(AllocationSpace space) {
       return "MAP_SPACE";
     case LO_SPACE:
       return "LO_SPACE";
+    case NEW_LO_SPACE:
+      return "NEW_LO_SPACE";
     case RO_SPACE:
       return "RO_SPACE";
     default:
@@ -5603,7 +5624,7 @@ void VerifyPointersVisitor::VerifyPointers(HeapObject* host,
   for (MaybeObject** current = start; current < end; current++) {
     HeapObject* object;
     if ((*current)->ToStrongOrWeakHeapObject(&object)) {
-      CHECK(object->GetIsolate()->heap()->Contains(object));
+      CHECK(heap_->Contains(object));
       CHECK(object->map()->IsMap());
     } else {
       CHECK((*current)->IsSmi() || (*current)->IsClearedWeakHeapObject());
@@ -5631,7 +5652,7 @@ bool Heap::AllowedToBeMigrated(HeapObject* obj, AllocationSpace dst) {
   //
   // Since this function is used for debugging only, we do not place
   // asserts here, but check everything explicitly.
-  if (obj->map() == one_pointer_filler_map()) return false;
+  if (obj->map() == ReadOnlyRoots(this).one_pointer_filler_map()) return false;
   InstanceType type = obj->map()->instance_type();
   MemoryChunk* chunk = MemoryChunk::FromAddress(obj->address());
   AllocationSpace src = chunk->owner()->identity();
@@ -5644,6 +5665,7 @@ bool Heap::AllowedToBeMigrated(HeapObject* obj, AllocationSpace dst) {
       return dst == CODE_SPACE && type == CODE_TYPE;
     case MAP_SPACE:
     case LO_SPACE:
+    case NEW_LO_SPACE:
     case RO_SPACE:
       return false;
   }
@@ -5695,20 +5717,16 @@ Code* GcSafeCastToCode(Heap* heap, HeapObject* object, Address inner_pointer) {
 
 bool Heap::GcSafeCodeContains(HeapObject* code, Address addr) {
   Map* map = GcSafeMapOfCodeSpaceObject(code);
-  DCHECK(map == code->GetHeap()->code_map());
-#ifdef V8_EMBEDDED_BUILTINS
+  DCHECK(map == ReadOnlyRoots(this).code_map());
   if (InstructionStream::TryLookupCode(isolate(), addr) == code) return true;
-#endif
   Address start = code->address();
   Address end = code->address() + code->SizeFromMap(map);
   return start <= addr && addr < end;
 }
 
 Code* Heap::GcSafeFindCodeForInnerPointer(Address inner_pointer) {
-#ifdef V8_EMBEDDED_BUILTINS
   Code* code = InstructionStream::TryLookupCode(isolate(), inner_pointer);
   if (code != nullptr) return code;
-#endif
 
   // Check if the inner pointer points into a large object chunk.
   LargePage* large_page = lo_space()->FindPage(inner_pointer);
diff --git a/deps/v8/src/heap/heap.h b/deps/v8/src/heap/heap.h
index cdd44f7a15bddb..471fa95b7f1c38 100644
--- a/deps/v8/src/heap/heap.h
+++ b/deps/v8/src/heap/heap.h
@@ -22,9 +22,9 @@
 #include "src/globals.h"
 #include "src/heap-symbols.h"
 #include "src/objects.h"
-#include "src/objects/code.h"
-#include "src/objects/hash-table.h"
+#include "src/objects/fixed-array.h"
 #include "src/objects/string-table.h"
+#include "src/roots.h"
 #include "src/visitors.h"
 
 namespace v8 {
@@ -40,7 +40,7 @@ class HeapTester;
 class TestMemoryAllocatorScope;
 }  // namespace heap
 
-class BoilerplateDescription;
+class ObjectBoilerplateDescription;
 class BytecodeArray;
 class CodeDataContainer;
 class DeoptimizationData;
@@ -50,366 +50,119 @@ class JSArrayBuffer;
 
 using v8::MemoryPressureLevel;
 
-// Defines all the roots in Heap.
-#define STRONG_ROOT_LIST(V)                                                    \
-  /* Cluster the most popular ones in a few cache lines here at the top.    */ \
-  /* The first 32 entries are most often used in the startup snapshot and   */ \
-  /* can use a shorter representation in the serialization format.          */ \
-  V(Map, free_space_map, FreeSpaceMap)                                         \
-  V(Map, one_pointer_filler_map, OnePointerFillerMap)                          \
-  V(Map, two_pointer_filler_map, TwoPointerFillerMap)                          \
-  V(Oddball, uninitialized_value, UninitializedValue)                          \
-  V(Oddball, undefined_value, UndefinedValue)                                  \
-  V(Oddball, the_hole_value, TheHoleValue)                                     \
-  V(Oddball, null_value, NullValue)                                            \
-  V(Oddball, true_value, TrueValue)                                            \
-  V(Oddball, false_value, FalseValue)                                          \
-  V(String, empty_string, empty_string)                                        \
-  V(Map, meta_map, MetaMap)                                                    \
-  V(Map, byte_array_map, ByteArrayMap)                                         \
-  V(Map, fixed_array_map, FixedArrayMap)                                       \
-  V(Map, fixed_cow_array_map, FixedCOWArrayMap)                                \
-  V(Map, hash_table_map, HashTableMap)                                         \
-  V(Map, symbol_map, SymbolMap)                                                \
-  V(Map, one_byte_string_map, OneByteStringMap)                                \
-  V(Map, one_byte_internalized_string_map, OneByteInternalizedStringMap)       \
-  V(Map, scope_info_map, ScopeInfoMap)                                         \
-  V(Map, shared_function_info_map, SharedFunctionInfoMap)                      \
-  V(Map, code_map, CodeMap)                                                    \
-  V(Map, function_context_map, FunctionContextMap)                             \
-  V(Map, cell_map, CellMap)                                                    \
-  V(Map, weak_cell_map, WeakCellMap)                                           \
-  V(Map, global_property_cell_map, GlobalPropertyCellMap)                      \
-  V(Map, foreign_map, ForeignMap)                                              \
-  V(Map, heap_number_map, HeapNumberMap)                                       \
-  V(Map, transition_array_map, TransitionArrayMap)                             \
-  V(Map, feedback_vector_map, FeedbackVectorMap)                               \
-  V(ScopeInfo, empty_scope_info, EmptyScopeInfo)                               \
-  V(FixedArray, empty_fixed_array, EmptyFixedArray)                            \
-  V(DescriptorArray, empty_descriptor_array, EmptyDescriptorArray)             \
-  /* Entries beyond the first 32                                            */ \
-  /* The roots above this line should be boring from a GC point of view.    */ \
-  /* This means they are never in new space and never on a page that is     */ \
-  /* being compacted.*/                                                        \
-  /* Oddballs */                                                               \
-  V(Oddball, arguments_marker, ArgumentsMarker)                                \
-  V(Oddball, exception, Exception)                                             \
-  V(Oddball, termination_exception, TerminationException)                      \
-  V(Oddball, optimized_out, OptimizedOut)                                      \
-  V(Oddball, stale_register, StaleRegister)                                    \
-  /* Context maps */                                                           \
-  V(Map, native_context_map, NativeContextMap)                                 \
-  V(Map, module_context_map, ModuleContextMap)                                 \
-  V(Map, eval_context_map, EvalContextMap)                                     \
-  V(Map, script_context_map, ScriptContextMap)                                 \
-  V(Map, block_context_map, BlockContextMap)                                   \
-  V(Map, catch_context_map, CatchContextMap)                                   \
-  V(Map, with_context_map, WithContextMap)                                     \
-  V(Map, debug_evaluate_context_map, DebugEvaluateContextMap)                  \
-  V(Map, script_context_table_map, ScriptContextTableMap)                      \
-  /* Maps */                                                                   \
-  V(Map, feedback_metadata_map, FeedbackMetadataArrayMap)                      \
-  V(Map, array_list_map, ArrayListMap)                                         \
-  V(Map, bigint_map, BigIntMap)                                                \
-  V(Map, boilerplate_description_map, BoilerplateDescriptionMap)               \
-  V(Map, bytecode_array_map, BytecodeArrayMap)                                 \
-  V(Map, code_data_container_map, CodeDataContainerMap)                        \
-  V(Map, descriptor_array_map, DescriptorArrayMap)                             \
-  V(Map, external_map, ExternalMap)                                            \
-  V(Map, fixed_double_array_map, FixedDoubleArrayMap)                          \
-  V(Map, global_dictionary_map, GlobalDictionaryMap)                           \
-  V(Map, many_closures_cell_map, ManyClosuresCellMap)                          \
-  V(Map, message_object_map, JSMessageObjectMap)                               \
-  V(Map, module_info_map, ModuleInfoMap)                                       \
-  V(Map, mutable_heap_number_map, MutableHeapNumberMap)                        \
-  V(Map, name_dictionary_map, NameDictionaryMap)                               \
-  V(Map, no_closures_cell_map, NoClosuresCellMap)                              \
-  V(Map, number_dictionary_map, NumberDictionaryMap)                           \
-  V(Map, one_closure_cell_map, OneClosureCellMap)                              \
-  V(Map, ordered_hash_map_map, OrderedHashMapMap)                              \
-  V(Map, ordered_hash_set_map, OrderedHashSetMap)                              \
-  V(Map, property_array_map, PropertyArrayMap)                                 \
-  V(Map, side_effect_call_handler_info_map, SideEffectCallHandlerInfoMap)      \
-  V(Map, side_effect_free_call_handler_info_map,                               \
-    SideEffectFreeCallHandlerInfoMap)                                          \
-  V(Map, simple_number_dictionary_map, SimpleNumberDictionaryMap)              \
-  V(Map, sloppy_arguments_elements_map, SloppyArgumentsElementsMap)            \
-  V(Map, small_ordered_hash_map_map, SmallOrderedHashMapMap)                   \
-  V(Map, small_ordered_hash_set_map, SmallOrderedHashSetMap)                   \
-  V(Map, string_table_map, StringTableMap)                                     \
-  V(Map, weak_fixed_array_map, WeakFixedArrayMap)                              \
-  /* String maps */                                                            \
-  V(Map, native_source_string_map, NativeSourceStringMap)                      \
-  V(Map, string_map, StringMap)                                                \
-  V(Map, cons_one_byte_string_map, ConsOneByteStringMap)                       \
-  V(Map, cons_string_map, ConsStringMap)                                       \
-  V(Map, thin_one_byte_string_map, ThinOneByteStringMap)                       \
-  V(Map, thin_string_map, ThinStringMap)                                       \
-  V(Map, sliced_string_map, SlicedStringMap)                                   \
-  V(Map, sliced_one_byte_string_map, SlicedOneByteStringMap)                   \
-  V(Map, external_string_map, ExternalStringMap)                               \
-  V(Map, external_string_with_one_byte_data_map,                               \
-    ExternalStringWithOneByteDataMap)                                          \
-  V(Map, external_one_byte_string_map, ExternalOneByteStringMap)               \
-  V(Map, short_external_string_map, ShortExternalStringMap)                    \
-  V(Map, short_external_string_with_one_byte_data_map,                         \
-    ShortExternalStringWithOneByteDataMap)                                     \
-  V(Map, internalized_string_map, InternalizedStringMap)                       \
-  V(Map, external_internalized_string_map, ExternalInternalizedStringMap)      \
-  V(Map, external_internalized_string_with_one_byte_data_map,                  \
-    ExternalInternalizedStringWithOneByteDataMap)                              \
-  V(Map, external_one_byte_internalized_string_map,                            \
-    ExternalOneByteInternalizedStringMap)                                      \
-  V(Map, short_external_internalized_string_map,                               \
-    ShortExternalInternalizedStringMap)                                        \
-  V(Map, short_external_internalized_string_with_one_byte_data_map,            \
-    ShortExternalInternalizedStringWithOneByteDataMap)                         \
-  V(Map, short_external_one_byte_internalized_string_map,                      \
-    ShortExternalOneByteInternalizedStringMap)                                 \
-  V(Map, short_external_one_byte_string_map, ShortExternalOneByteStringMap)    \
-  /* Array element maps */                                                     \
-  V(Map, fixed_uint8_array_map, FixedUint8ArrayMap)                            \
-  V(Map, fixed_int8_array_map, FixedInt8ArrayMap)                              \
-  V(Map, fixed_uint16_array_map, FixedUint16ArrayMap)                          \
-  V(Map, fixed_int16_array_map, FixedInt16ArrayMap)                            \
-  V(Map, fixed_uint32_array_map, FixedUint32ArrayMap)                          \
-  V(Map, fixed_int32_array_map, FixedInt32ArrayMap)                            \
-  V(Map, fixed_float32_array_map, FixedFloat32ArrayMap)                        \
-  V(Map, fixed_float64_array_map, FixedFloat64ArrayMap)                        \
-  V(Map, fixed_uint8_clamped_array_map, FixedUint8ClampedArrayMap)             \
-  V(Map, fixed_biguint64_array_map, FixedBigUint64ArrayMap)                    \
-  V(Map, fixed_bigint64_array_map, FixedBigInt64ArrayMap)                      \
-  /* Oddball maps */                                                           \
-  V(Map, undefined_map, UndefinedMap)                                          \
-  V(Map, the_hole_map, TheHoleMap)                                             \
-  V(Map, null_map, NullMap)                                                    \
-  V(Map, boolean_map, BooleanMap)                                              \
-  V(Map, uninitialized_map, UninitializedMap)                                  \
-  V(Map, arguments_marker_map, ArgumentsMarkerMap)                             \
-  V(Map, exception_map, ExceptionMap)                                          \
-  V(Map, termination_exception_map, TerminationExceptionMap)                   \
-  V(Map, optimized_out_map, OptimizedOutMap)                                   \
-  V(Map, stale_register_map, StaleRegisterMap)                                 \
-  /* Canonical empty values */                                                 \
-  V(EnumCache, empty_enum_cache, EmptyEnumCache)                               \
-  V(PropertyArray, empty_property_array, EmptyPropertyArray)                   \
-  V(ByteArray, empty_byte_array, EmptyByteArray)                               \
-  V(BoilerplateDescription, empty_boilerplate_description,                     \
-    EmptyBoilerplateDescription)                                               \
-  V(FixedTypedArrayBase, empty_fixed_uint8_array, EmptyFixedUint8Array)        \
-  V(FixedTypedArrayBase, empty_fixed_int8_array, EmptyFixedInt8Array)          \
-  V(FixedTypedArrayBase, empty_fixed_uint16_array, EmptyFixedUint16Array)      \
-  V(FixedTypedArrayBase, empty_fixed_int16_array, EmptyFixedInt16Array)        \
-  V(FixedTypedArrayBase, empty_fixed_uint32_array, EmptyFixedUint32Array)      \
-  V(FixedTypedArrayBase, empty_fixed_int32_array, EmptyFixedInt32Array)        \
-  V(FixedTypedArrayBase, empty_fixed_float32_array, EmptyFixedFloat32Array)    \
-  V(FixedTypedArrayBase, empty_fixed_float64_array, EmptyFixedFloat64Array)    \
-  V(FixedTypedArrayBase, empty_fixed_uint8_clamped_array,                      \
-    EmptyFixedUint8ClampedArray)                                               \
-  V(FixedTypedArrayBase, empty_fixed_biguint64_array,                          \
-    EmptyFixedBigUint64Array)                                                  \
-  V(FixedTypedArrayBase, empty_fixed_bigint64_array, EmptyFixedBigInt64Array)  \
-  V(Script, empty_script, EmptyScript)                                         \
-  V(FeedbackCell, many_closures_cell, ManyClosuresCell)                        \
-  V(FixedArray, empty_sloppy_arguments_elements, EmptySloppyArgumentsElements) \
-  V(NumberDictionary, empty_slow_element_dictionary,                           \
-    EmptySlowElementDictionary)                                                \
-  V(FixedArray, empty_ordered_hash_map, EmptyOrderedHashMap)                   \
-  V(FixedArray, empty_ordered_hash_set, EmptyOrderedHashSet)                   \
-  V(FeedbackMetadata, empty_feedback_metadata, EmptyFeedbackMetadata)          \
-  V(PropertyCell, empty_property_cell, EmptyPropertyCell)                      \
-  V(WeakCell, empty_weak_cell, EmptyWeakCell)                                  \
-  V(Cell, invalid_prototype_validity_cell, InvalidPrototypeValidityCell)       \
-  V(InterceptorInfo, noop_interceptor_info, NoOpInterceptorInfo)               \
-  V(WeakFixedArray, empty_weak_fixed_array, EmptyWeakFixedArray)               \
-  /* Protectors */                                                             \
-  V(Cell, array_constructor_protector, ArrayConstructorProtector)              \
-  V(PropertyCell, no_elements_protector, NoElementsProtector)                  \
-  V(Cell, is_concat_spreadable_protector, IsConcatSpreadableProtector)         \
-  V(PropertyCell, array_species_protector, ArraySpeciesProtector)              \
-  V(PropertyCell, typed_array_species_protector, TypedArraySpeciesProtector)   \
-  V(PropertyCell, promise_species_protector, PromiseSpeciesProtector)          \
-  V(Cell, string_length_protector, StringLengthProtector)                      \
-  V(PropertyCell, array_iterator_protector, ArrayIteratorProtector)            \
-  V(PropertyCell, array_buffer_neutering_protector,                            \
-    ArrayBufferNeuteringProtector)                                             \
-  V(PropertyCell, promise_hook_protector, PromiseHookProtector)                \
-  V(Cell, promise_resolve_protector, PromiseResolveProtector)                  \
-  V(PropertyCell, promise_then_protector, PromiseThenProtector)                \
-  /* Special numbers */                                                        \
-  V(HeapNumber, nan_value, NanValue)                                           \
-  V(HeapNumber, hole_nan_value, HoleNanValue)                                  \
-  V(HeapNumber, infinity_value, InfinityValue)                                 \
-  V(HeapNumber, minus_zero_value, MinusZeroValue)                              \
-  V(HeapNumber, minus_infinity_value, MinusInfinityValue)                      \
-  /* Caches */                                                                 \
-  V(FixedArray, number_string_cache, NumberStringCache)                        \
-  V(FixedArray, single_character_string_cache, SingleCharacterStringCache)     \
-  V(FixedArray, string_split_cache, StringSplitCache)                          \
-  V(FixedArray, regexp_multiple_cache, RegExpMultipleCache)                    \
-  /* Lists and dictionaries */                                                 \
-  V(NameDictionary, empty_property_dictionary, EmptyPropertyDictionary)        \
-  V(NameDictionary, public_symbol_table, PublicSymbolTable)                    \
-  V(NameDictionary, api_symbol_table, ApiSymbolTable)                          \
-  V(NameDictionary, api_private_symbol_table, ApiPrivateSymbolTable)           \
-  V(Object, script_list, ScriptList)                                           \
-  V(SimpleNumberDictionary, code_stubs, CodeStubs)                             \
-  V(FixedArray, materialized_objects, MaterializedObjects)                     \
-  V(FixedArray, microtask_queue, MicrotaskQueue)                               \
-  V(FixedArray, detached_contexts, DetachedContexts)                           \
-  V(HeapObject, retaining_path_targets, RetainingPathTargets)                  \
-  V(ArrayList, retained_maps, RetainedMaps)                                    \
-  /* Indirection lists for isolate-independent builtins */                     \
-  V(FixedArray, builtins_constants_table, BuiltinsConstantsTable)              \
-  /* Feedback vectors that we need for code coverage or type profile */        \
-  V(Object, feedback_vectors_for_profiling_tools,                              \
-    FeedbackVectorsForProfilingTools)                                          \
-  V(Object, weak_stack_trace_list, WeakStackTraceList)                         \
-  V(Object, noscript_shared_function_infos, NoScriptSharedFunctionInfos)       \
-  V(FixedArray, serialized_objects, SerializedObjects)                         \
-  V(FixedArray, serialized_global_proxy_sizes, SerializedGlobalProxySizes)     \
-  V(TemplateList, message_listeners, MessageListeners)                         \
-  /* DeserializeLazy handlers for lazy bytecode deserialization */             \
-  V(Object, deserialize_lazy_handler, DeserializeLazyHandler)                  \
-  V(Object, deserialize_lazy_handler_wide, DeserializeLazyHandlerWide)         \
-  V(Object, deserialize_lazy_handler_extra_wide,                               \
-    DeserializeLazyHandlerExtraWide)                                           \
-  /* JS Entries */                                                             \
-  V(Code, js_entry_code, JsEntryCode)                                          \
-  V(Code, js_construct_entry_code, JsConstructEntryCode)                       \
-  V(Code, js_run_microtasks_entry_code, JsRunMicrotasksEntryCode)
-
-// Entries in this list are limited to Smis and are not visited during GC.
-#define SMI_ROOT_LIST(V)                                                       \
-  V(Smi, stack_limit, StackLimit)                                              \
-  V(Smi, real_stack_limit, RealStackLimit)                                     \
-  V(Smi, last_script_id, LastScriptId)                                         \
-  V(Smi, last_debugging_id, LastDebuggingId)                                   \
-  V(Smi, hash_seed, HashSeed)                                                  \
-  /* To distinguish the function templates, so that we can find them in the */ \
-  /* function cache of the native context. */                                  \
-  V(Smi, next_template_serial_number, NextTemplateSerialNumber)                \
-  V(Smi, arguments_adaptor_deopt_pc_offset, ArgumentsAdaptorDeoptPCOffset)     \
-  V(Smi, construct_stub_create_deopt_pc_offset,                                \
-    ConstructStubCreateDeoptPCOffset)                                          \
-  V(Smi, construct_stub_invoke_deopt_pc_offset,                                \
-    ConstructStubInvokeDeoptPCOffset)                                          \
-  V(Smi, interpreter_entry_return_pc_offset, InterpreterEntryReturnPCOffset)
-
-#define ROOT_LIST(V)  \
-  STRONG_ROOT_LIST(V) \
-  SMI_ROOT_LIST(V)    \
-  V(StringTable, string_table, StringTable)
-
-
 // Heap roots that are known to be immortal immovable, for which we can safely
 // skip write barriers. This list is not complete and has omissions.
-#define IMMORTAL_IMMOVABLE_ROOT_LIST(V) \
-  V(ArgumentsMarker)                    \
-  V(ArgumentsMarkerMap)                 \
-  V(ArrayBufferNeuteringProtector)      \
-  V(ArrayIteratorProtector)             \
-  V(BigIntMap)                          \
-  V(BlockContextMap)                    \
-  V(BoilerplateDescriptionMap)          \
-  V(BooleanMap)                         \
-  V(ByteArrayMap)                       \
-  V(BytecodeArrayMap)                   \
-  V(CatchContextMap)                    \
-  V(CellMap)                            \
-  V(CodeMap)                            \
-  V(DebugEvaluateContextMap)            \
-  V(DescriptorArrayMap)                 \
-  V(EmptyByteArray)                     \
-  V(EmptyDescriptorArray)               \
-  V(EmptyFixedArray)                    \
-  V(EmptyFixedFloat32Array)             \
-  V(EmptyFixedFloat64Array)             \
-  V(EmptyFixedInt16Array)               \
-  V(EmptyFixedInt32Array)               \
-  V(EmptyFixedInt8Array)                \
-  V(EmptyFixedUint16Array)              \
-  V(EmptyFixedUint32Array)              \
-  V(EmptyFixedUint8Array)               \
-  V(EmptyFixedUint8ClampedArray)        \
-  V(EmptyOrderedHashMap)                \
-  V(EmptyOrderedHashSet)                \
-  V(EmptyPropertyCell)                  \
-  V(EmptyScopeInfo)                     \
-  V(EmptyScript)                        \
-  V(EmptySloppyArgumentsElements)       \
-  V(EmptySlowElementDictionary)         \
-  V(EmptyWeakCell)                      \
-  V(EvalContextMap)                     \
-  V(Exception)                          \
-  V(FalseValue)                         \
-  V(FixedArrayMap)                      \
-  V(FixedCOWArrayMap)                   \
-  V(FixedDoubleArrayMap)                \
-  V(ForeignMap)                         \
-  V(FreeSpaceMap)                       \
-  V(FunctionContextMap)                 \
-  V(GlobalDictionaryMap)                \
-  V(GlobalPropertyCellMap)              \
-  V(HashTableMap)                       \
-  V(HeapNumberMap)                      \
-  V(HoleNanValue)                       \
-  V(InfinityValue)                      \
-  V(IsConcatSpreadableProtector)        \
-  V(JSMessageObjectMap)                 \
-  V(JsConstructEntryCode)               \
-  V(JsEntryCode)                        \
-  V(ManyClosuresCell)                   \
-  V(ManyClosuresCellMap)                \
-  V(MetaMap)                            \
-  V(MinusInfinityValue)                 \
-  V(MinusZeroValue)                     \
-  V(ModuleContextMap)                   \
-  V(ModuleInfoMap)                      \
-  V(MutableHeapNumberMap)               \
-  V(NameDictionaryMap)                  \
-  V(NanValue)                           \
-  V(NativeContextMap)                   \
-  V(NoClosuresCellMap)                  \
-  V(NoElementsProtector)                \
-  V(NullMap)                            \
-  V(NullValue)                          \
-  V(NumberDictionaryMap)                \
-  V(OneClosureCellMap)                  \
-  V(OnePointerFillerMap)                \
-  V(OptimizedOut)                       \
-  V(OrderedHashMapMap)                  \
-  V(OrderedHashSetMap)                  \
-  V(PropertyArrayMap)                   \
-  V(ScopeInfoMap)                       \
-  V(ScriptContextMap)                   \
-  V(ScriptContextTableMap)              \
-  V(SharedFunctionInfoMap)              \
-  V(SimpleNumberDictionaryMap)          \
-  V(SloppyArgumentsElementsMap)         \
-  V(SmallOrderedHashMapMap)             \
-  V(SmallOrderedHashSetMap)             \
-  V(ArraySpeciesProtector)              \
-  V(TypedArraySpeciesProtector)         \
-  V(PromiseSpeciesProtector)            \
-  V(StaleRegister)                      \
-  V(StringLengthProtector)              \
-  V(StringTableMap)                     \
-  V(SymbolMap)                          \
-  V(TerminationException)               \
-  V(TheHoleMap)                         \
-  V(TheHoleValue)                       \
-  V(TransitionArrayMap)                 \
-  V(TrueValue)                          \
-  V(TwoPointerFillerMap)                \
-  V(UndefinedMap)                       \
-  V(UndefinedValue)                     \
-  V(UninitializedMap)                   \
-  V(UninitializedValue)                 \
-  V(WeakCellMap)                        \
-  V(WeakFixedArrayMap)                  \
-  V(WithContextMap)                     \
-  V(empty_string)                       \
+#define IMMORTAL_IMMOVABLE_ROOT_LIST(V)     \
+  V(ArgumentsMarker)                        \
+  V(ArgumentsMarkerMap)                     \
+  V(ArrayBufferNeuteringProtector)          \
+  V(ArrayIteratorProtector)                 \
+  V(BigIntMap)                              \
+  V(BlockContextMap)                        \
+  V(ObjectBoilerplateDescriptionMap)        \
+  V(BooleanMap)                             \
+  V(ByteArrayMap)                           \
+  V(BytecodeArrayMap)                       \
+  V(CatchContextMap)                        \
+  V(CellMap)                                \
+  V(CodeMap)                                \
+  V(DebugEvaluateContextMap)                \
+  V(DescriptorArrayMap)                     \
+  V(EphemeronHashTableMap)                  \
+  V(EmptyByteArray)                         \
+  V(EmptyDescriptorArray)                   \
+  V(EmptyFixedArray)                        \
+  V(EmptyFixedFloat32Array)                 \
+  V(EmptyFixedFloat64Array)                 \
+  V(EmptyFixedInt16Array)                   \
+  V(EmptyFixedInt32Array)                   \
+  V(EmptyFixedInt8Array)                    \
+  V(EmptyFixedUint16Array)                  \
+  V(EmptyFixedUint32Array)                  \
+  V(EmptyFixedUint8Array)                   \
+  V(EmptyFixedUint8ClampedArray)            \
+  V(EmptyOrderedHashMap)                    \
+  V(EmptyOrderedHashSet)                    \
+  V(EmptyPropertyCell)                      \
+  V(EmptyScopeInfo)                         \
+  V(EmptyScript)                            \
+  V(EmptySloppyArgumentsElements)           \
+  V(EmptySlowElementDictionary)             \
+  V(EmptyWeakCell)                          \
+  V(EvalContextMap)                         \
+  V(Exception)                              \
+  V(FalseValue)                             \
+  V(FixedArrayMap)                          \
+  V(FixedCOWArrayMap)                       \
+  V(FixedDoubleArrayMap)                    \
+  V(ForeignMap)                             \
+  V(FreeSpaceMap)                           \
+  V(FunctionContextMap)                     \
+  V(GlobalDictionaryMap)                    \
+  V(GlobalPropertyCellMap)                  \
+  V(HashTableMap)                           \
+  V(HeapNumberMap)                          \
+  V(HoleNanValue)                           \
+  V(InfinityValue)                          \
+  V(IsConcatSpreadableProtector)            \
+  V(JSMessageObjectMap)                     \
+  V(JsConstructEntryCode)                   \
+  V(JsEntryCode)                            \
+  V(ManyClosuresCell)                       \
+  V(ManyClosuresCellMap)                    \
+  V(MetaMap)                                \
+  V(MinusInfinityValue)                     \
+  V(MinusZeroValue)                         \
+  V(ModuleContextMap)                       \
+  V(ModuleInfoMap)                          \
+  V(MutableHeapNumberMap)                   \
+  V(NameDictionaryMap)                      \
+  V(NanValue)                               \
+  V(NativeContextMap)                       \
+  V(NoClosuresCellMap)                      \
+  V(NoElementsProtector)                    \
+  V(NullMap)                                \
+  V(NullValue)                              \
+  V(NumberDictionaryMap)                    \
+  V(OneClosureCellMap)                      \
+  V(OnePointerFillerMap)                    \
+  V(OptimizedOut)                           \
+  V(OrderedHashMapMap)                      \
+  V(OrderedHashSetMap)                      \
+  V(PropertyArrayMap)                       \
+  V(ScopeInfoMap)                           \
+  V(ScriptContextMap)                       \
+  V(ScriptContextTableMap)                  \
+  V(SelfReferenceMarker)                    \
+  V(SharedFunctionInfoMap)                  \
+  V(SimpleNumberDictionaryMap)              \
+  V(SloppyArgumentsElementsMap)             \
+  V(SmallOrderedHashMapMap)                 \
+  V(SmallOrderedHashSetMap)                 \
+  V(ArraySpeciesProtector)                  \
+  V(TypedArraySpeciesProtector)             \
+  V(PromiseSpeciesProtector)                \
+  V(StaleRegister)                          \
+  V(StringLengthProtector)                  \
+  V(StringTableMap)                         \
+  V(SymbolMap)                              \
+  V(TerminationException)                   \
+  V(TheHoleMap)                             \
+  V(TheHoleValue)                           \
+  V(TransitionArrayMap)                     \
+  V(TrueValue)                              \
+  V(TwoPointerFillerMap)                    \
+  V(UndefinedMap)                           \
+  V(UndefinedValue)                         \
+  V(UninitializedMap)                       \
+  V(UninitializedValue)                     \
+  V(UncompiledDataWithoutPreParsedScopeMap) \
+  V(UncompiledDataWithPreParsedScopeMap)    \
+  V(WeakCellMap)                            \
+  V(WeakFixedArrayMap)                      \
+  V(WeakArrayListMap)                       \
+  V(WithContextMap)                         \
+  V(empty_string)                           \
   PRIVATE_SYMBOL_LIST(V)
 
 #define FIXED_ARRAY_ELEMENTS_WRITE_BARRIER(heap, array, start, length) \
@@ -426,6 +179,7 @@ class GCIdleTimeAction;
 class GCIdleTimeHandler;
 class GCIdleTimeHeapState;
 class GCTracer;
+class HeapController;
 class HeapObjectAllocationTracker;
 class HeapObjectsFilter;
 class HeapStats;
@@ -463,7 +217,7 @@ enum class FixedArrayVisitationMode { kRegular, kIncremental };
 
 enum class TraceRetainingPathMode { kEnabled, kDisabled };
 
-enum class RetainingPathOption { kDefault, kTrackEphemeralPath };
+enum class RetainingPathOption { kDefault, kTrackEphemeronPath };
 
 enum class GarbageCollectionReason {
   kUnknown = 0,
@@ -585,6 +339,10 @@ class Heap {
     STRUCT_LIST(DECL)
 #undef DECL
 
+#define DECL(NAME, Name, Size, name) k##Name##Size##MapRootIndex,
+   ALLOCATION_SITE_LIST(DECL)
+#undef DECL
+
 #define DECL(NAME, Name, Size, name) k##Name##Size##MapRootIndex,
     DATA_HANDLER_LIST(DECL)
 #undef DECL
@@ -642,21 +400,9 @@ class Heap {
   static const size_t kMaxSemiSpaceSizeInKB =
       16 * kPointerMultiplier * ((1 << kPageSizeBits) / KB);
 
-  // The old space size has to be a multiple of Page::kPageSize.
-  // Sizes are in MB.
-  static const size_t kMinOldGenerationSize = 128 * kPointerMultiplier;
-  static const size_t kMaxOldGenerationSize = 1024 * kPointerMultiplier;
-
   static const int kTraceRingBufferSize = 512;
   static const int kStacktraceBufferSize = 512;
 
-  V8_EXPORT_PRIVATE static const double kMinHeapGrowingFactor;
-  V8_EXPORT_PRIVATE static const double kMaxHeapGrowingFactor;
-  static const double kMaxHeapGrowingFactorMemoryConstrained;
-  static const double kMaxHeapGrowingFactorIdle;
-  static const double kConservativeHeapGrowingFactor;
-  static const double kTargetMutatorUtilization;
-
   static const int kNoGCFlags = 0;
   static const int kReduceMemoryFootprintMask = 1;
   static const int kAbortIncrementalMarkingMask = 2;
@@ -712,6 +458,10 @@ class Heap {
 #endif
   }
 
+  static uintptr_t ZapValue() {
+    return FLAG_clear_free_memory ? kClearedFreeMemoryValue : kZapValue;
+  }
+
   static inline bool IsYoungGenerationCollector(GarbageCollector collector) {
     return collector == SCAVENGER || collector == MINOR_MARK_COMPACTOR;
   }
@@ -736,12 +486,6 @@ class Heap {
     return "Unknown collector";
   }
 
-  V8_EXPORT_PRIVATE static double MaxHeapGrowingFactor(
-      size_t max_old_generation_size);
-  V8_EXPORT_PRIVATE static double HeapGrowingFactor(double gc_speed,
-                                                    double mutator_speed,
-                                                    double max_factor);
-
   // Copy block of memory from src to dst. Size of block should be aligned
   // by pointer size.
   static inline void CopyBlock(Address dst, Address src, int byte_size);
@@ -760,7 +504,8 @@ class Heap {
 
   // Move len elements within a given array from src_index index to dst_index
   // index.
-  void MoveElements(FixedArray* array, int dst_index, int src_index, int len);
+  void MoveElements(FixedArray* array, int dst_index, int src_index, int len,
+                    WriteBarrierMode mode = UPDATE_WRITE_BARRIER);
 
   // Initialize a filler object to keep the ability to iterate over the heap
   // when introducing gaps within pages. If slots could have been recorded in
@@ -773,6 +518,9 @@ class Heap {
       ClearFreedMemoryMode clear_memory_mode =
           ClearFreedMemoryMode::kDontClearFreedMemory);
 
+  template <typename T>
+  void CreateFillerForArray(T* object, int elements_to_trim, int bytes_to_trim);
+
   bool CanMoveObjectStart(HeapObject* object);
 
   static bool IsImmovable(HeapObject* object);
@@ -783,6 +531,7 @@ class Heap {
 
   // Trim the given array from the right.
   void RightTrimFixedArray(FixedArrayBase* obj, int elements_to_trim);
+  void RightTrimWeakFixedArray(WeakFixedArray* obj, int elements_to_trim);
 
   // Converts the given boolean condition to JavaScript boolean value.
   inline Oddball* ToBoolean(bool condition);
@@ -803,13 +552,10 @@ class Heap {
   // Used in CreateAllocationSiteStub and the (de)serializer.
   Object** allocation_sites_list_address() { return &allocation_sites_list_; }
 
-  void set_encountered_weak_collections(Object* weak_collection) {
-    encountered_weak_collections_ = weak_collection;
-  }
-  Object* encountered_weak_collections() const {
-    return encountered_weak_collections_;
-  }
-  void IterateEncounteredWeakCollections(RootVisitor* visitor);
+  // Traverse all the allocaions_sites [nested_site and weak_next] in the list
+  // and foreach call the visitor
+  void ForeachAllocationSite(Object* list,
+                             std::function<void(AllocationSite*)> visitor);
 
   // Number of mark-sweeps.
   int ms_count() const { return ms_count_; }
@@ -922,12 +668,12 @@ class Heap {
   void update_external_memory(int64_t delta) { external_memory_ += delta; }
 
   void update_external_memory_concurrently_freed(intptr_t freed) {
-    external_memory_concurrently_freed_.Increment(freed);
+    external_memory_concurrently_freed_ += freed;
   }
 
   void account_external_memory_concurrently_freed() {
-    external_memory_ -= external_memory_concurrently_freed_.Value();
-    external_memory_concurrently_freed_.SetValue(0);
+    external_memory_ -= external_memory_concurrently_freed_;
+    external_memory_concurrently_freed_ = 0;
   }
 
   void CompactFixedArraysOfWeakCells();
@@ -944,6 +690,7 @@ class Heap {
   inline void OnMoveEvent(HeapObject* target, HeapObject* source,
                           int size_in_bytes);
 
+  inline bool CanAllocateInReadOnlySpace();
   bool deserialization_complete() const { return deserialization_complete_; }
 
   bool HasLowAllocationRate();
@@ -973,15 +720,14 @@ class Heap {
   // max_semi_space_size_in_kb: maximum semi-space size in KB
   // max_old_generation_size_in_mb: maximum old generation size in MB
   // code_range_size_in_mb: code range size in MB
-  // Return false if the heap has been set up already.
-  bool ConfigureHeap(size_t max_semi_space_size_in_kb,
+  void ConfigureHeap(size_t max_semi_space_size_in_kb,
                      size_t max_old_generation_size_in_mb,
                      size_t code_range_size_in_mb);
-  bool ConfigureHeapDefault();
+  void ConfigureHeapDefault();
 
   // Prepares the heap, setting up memory areas that are needed in the isolate
   // without actually creating any objects.
-  bool SetUp();
+  void SetUp();
 
   // (Re-)Initialize hash seed from flag or RNG.
   void InitializeHashSeed();
@@ -1010,9 +756,10 @@ class Heap {
 
   NewSpace* new_space() { return new_space_; }
   OldSpace* old_space() { return old_space_; }
-  OldSpace* code_space() { return code_space_; }
+  CodeSpace* code_space() { return code_space_; }
   MapSpace* map_space() { return map_space_; }
   LargeObjectSpace* lo_space() { return lo_space_; }
+  NewLargeObjectSpace* new_lo_space() { return new_lo_space_; }
   ReadOnlySpace* read_only_space() { return read_only_space_; }
 
   inline PagedSpace* paged_space(int idx);
@@ -1046,35 +793,19 @@ class Heap {
   // ===========================================================================
   // Root set access. ==========================================================
   // ===========================================================================
+  friend class ReadOnlyRoots;
 
-  // Heap root getters.
+ public:
+// Heap root getters.
 #define ROOT_ACCESSOR(type, name, camel_name) inline type* name();
-  ROOT_LIST(ROOT_ACCESSOR)
+  MUTABLE_ROOT_LIST(ROOT_ACCESSOR)
 #undef ROOT_ACCESSOR
 
-  // Utility type maps.
-#define STRUCT_MAP_ACCESSOR(NAME, Name, name) inline Map* name##_map();
-  STRUCT_LIST(STRUCT_MAP_ACCESSOR)
-#undef STRUCT_MAP_ACCESSOR
-
 #define DATA_HANDLER_MAP_ACCESSOR(NAME, Name, Size, name) \
   inline Map* name##_map();
   DATA_HANDLER_LIST(DATA_HANDLER_MAP_ACCESSOR)
 #undef DATA_HANDLER_MAP_ACCESSOR
 
-#define STRING_ACCESSOR(name, str) inline String* name();
-  INTERNALIZED_STRING_LIST(STRING_ACCESSOR)
-#undef STRING_ACCESSOR
-
-#define SYMBOL_ACCESSOR(name) inline Symbol* name();
-  PRIVATE_SYMBOL_LIST(SYMBOL_ACCESSOR)
-#undef SYMBOL_ACCESSOR
-
-#define SYMBOL_ACCESSOR(name, description) inline Symbol* name();
-  PUBLIC_SYMBOL_LIST(SYMBOL_ACCESSOR)
-  WELL_KNOWN_SYMBOL_LIST(SYMBOL_ACCESSOR)
-#undef SYMBOL_ACCESSOR
-
 #define ACCESSOR_INFO_ACCESSOR(accessor_name, AccessorName) \
   inline AccessorInfo* accessor_name##_accessor();
   ACCESSOR_INFO_LIST(ACCESSOR_INFO_ACCESSOR)
@@ -1105,6 +836,15 @@ class Heap {
     return kRootsExternalReferenceTableOffset;
   }
 
+  static constexpr int roots_to_builtins_offset() {
+    return kRootsBuiltinsOffset;
+  }
+
+  Address root_register_addressable_end() {
+    return reinterpret_cast<Address>(roots_array_start()) +
+           kRootRegisterAddressableEndOffset;
+  }
+
   // Sets the stub_cache_ (only used when expanding the dictionary).
   void SetRootCodeStubs(SimpleNumberDictionary* value);
 
@@ -1201,6 +941,14 @@ class Heap {
   // Invoked when GC was requested via the stack guard.
   void HandleGCRequest();
 
+  // ===========================================================================
+  // Builtins. =================================================================
+  // ===========================================================================
+
+  Code* builtin(int index);
+  Address builtin_address(int index);
+  void set_builtin(int index, HeapObject* builtin);
+
   // ===========================================================================
   // Iterators. ================================================================
   // ===========================================================================
@@ -1214,6 +962,8 @@ class Heap {
   void IterateWeakRoots(RootVisitor* v, VisitMode mode);
   // Iterates over weak global handles.
   void IterateWeakGlobalHandles(RootVisitor* v);
+  // Iterates over builtins.
+  void IterateBuiltins(RootVisitor* v);
 
   // ===========================================================================
   // Store buffer API. =========================================================
@@ -1344,19 +1094,22 @@ class Heap {
   // ===========================================================================
 
   // Returns whether the object resides in new space.
-  inline bool InNewSpace(Object* object);
-  inline bool InNewSpace(MaybeObject* object);
-  inline bool InNewSpace(HeapObject* heap_object);
-  inline bool InFromSpace(Object* object);
-  inline bool InFromSpace(MaybeObject* object);
-  inline bool InFromSpace(HeapObject* heap_object);
-  inline bool InToSpace(Object* object);
-  inline bool InToSpace(MaybeObject* object);
-  inline bool InToSpace(HeapObject* heap_object);
+  static inline bool InNewSpace(Object* object);
+  static inline bool InNewSpace(MaybeObject* object);
+  static inline bool InNewSpace(HeapObject* heap_object);
+  static inline bool InFromSpace(Object* object);
+  static inline bool InFromSpace(MaybeObject* object);
+  static inline bool InFromSpace(HeapObject* heap_object);
+  static inline bool InToSpace(Object* object);
+  static inline bool InToSpace(MaybeObject* object);
+  static inline bool InToSpace(HeapObject* heap_object);
 
   // Returns whether the object resides in old space.
   inline bool InOldSpace(Object* object);
 
+  // Returns whether the object resides in read-only space.
+  inline bool InReadOnlySpace(Object* object);
+
   // Checks whether an address/object in the heap (including auxiliary
   // area and unused area).
   bool Contains(HeapObject* value);
@@ -1372,6 +1125,10 @@ class Heap {
   inline bool InNewSpaceSlow(Address address);
   inline bool InOldSpaceSlow(Address address);
 
+  // Find the heap which owns this HeapObject. Should never be called for
+  // objects in RO space.
+  static inline Heap* FromWritableHeapObject(const HeapObject* obj);
+
   // ===========================================================================
   // Object statistics tracking. ===============================================
   // ===========================================================================
@@ -1414,14 +1171,8 @@ class Heap {
   size_t InitialSemiSpaceSize() { return initial_semispace_size_; }
   size_t MaxOldGenerationSize() { return max_old_generation_size_; }
 
-  static size_t ComputeMaxOldGenerationSize(uint64_t physical_memory) {
-    const size_t old_space_physical_memory_factor = 4;
-    size_t computed_size = static_cast<size_t>(
-        physical_memory / i::MB / old_space_physical_memory_factor *
-        kPointerMultiplier);
-    return Max(Min(computed_size, kMaxOldGenerationSize),
-               kMinOldGenerationSize);
-  }
+  V8_EXPORT_PRIVATE static size_t ComputeMaxOldGenerationSize(
+      uint64_t physical_memory);
 
   static size_t ComputeMaxSemiSpaceSize(uint64_t physical_memory) {
     const uint64_t min_physical_memory = 512 * MB;
@@ -1445,6 +1196,10 @@ class Heap {
   // Returns the capacity of the old generation.
   size_t OldGenerationCapacity();
 
+  // Returns the amount of memory currently committed for the heap and memory
+  // held alive by the unmapper.
+  size_t CommittedMemoryOfHeapAndUnmapper();
+
   // Returns the amount of memory currently committed for the heap.
   size_t CommittedMemory();
 
@@ -1501,8 +1256,8 @@ class Heap {
     survived_since_last_expansion_ += survived;
   }
 
-  inline uint64_t PromotedTotalSize() {
-    return PromotedSpaceSizeOfObjects() + PromotedExternalMemorySize();
+  inline uint64_t OldGenerationObjectsAndPromotedExternalMemorySize() {
+    return OldGenerationSizeOfObjects() + PromotedExternalMemorySize();
   }
 
   inline void UpdateNewSpaceAllocationCounter();
@@ -1531,18 +1286,18 @@ class Heap {
   }
 
   size_t PromotedSinceLastGC() {
-    size_t old_generation_size = PromotedSpaceSizeOfObjects();
+    size_t old_generation_size = OldGenerationSizeOfObjects();
     DCHECK_GE(old_generation_size, old_generation_size_at_last_gc_);
     return old_generation_size - old_generation_size_at_last_gc_;
   }
 
   // This is called by the sweeper when it discovers more free space
-  // as expected at the end of the last GC.
+  // than expected at the end of the preceding GC.
   void NotifyRefinedOldGenerationSize(size_t decreased_bytes) {
     if (old_generation_size_at_last_gc_ != 0) {
-      // PromotedSpaceSizeOfObjects() is now smaller by |decreased_bytes|.
-      // Adjust old_generation_size_at_last_gc_ too so that PromotedSinceLastGC
-      // stay monotonically non-decreasing function.
+      // OldGenerationSizeOfObjects() is now smaller by |decreased_bytes|.
+      // Adjust old_generation_size_at_last_gc_ too, so that PromotedSinceLastGC
+      // continues to increase monotonically, rather than decreasing here.
       DCHECK_GE(old_generation_size_at_last_gc_, decreased_bytes);
       old_generation_size_at_last_gc_ -= decreased_bytes;
     }
@@ -1550,8 +1305,9 @@ class Heap {
 
   int gc_count() const { return gc_count_; }
 
-  // Returns the size of objects residing in non new spaces.
-  size_t PromotedSpaceSizeOfObjects();
+  // Returns the size of objects residing in non-new spaces.
+  // Excludes external memory held by those objects.
+  size_t OldGenerationSizeOfObjects();
 
   // ===========================================================================
   // Prologue/epilogue callback methods.========================================
@@ -1640,6 +1396,7 @@ class Heap {
     return !allocation_trackers_.empty();
   }
 
+  // ===========================================================================
   // Retaining path tracking. ==================================================
   // ===========================================================================
 
@@ -1811,7 +1568,16 @@ class Heap {
 
   // Selects the proper allocation space based on the pretenuring decision.
   static AllocationSpace SelectSpace(PretenureFlag pretenure) {
-    return (pretenure == TENURED) ? OLD_SPACE : NEW_SPACE;
+    switch (pretenure) {
+      case TENURED_READ_ONLY:
+        return RO_SPACE;
+      case TENURED:
+        return OLD_SPACE;
+      case NOT_TENURED:
+        return NEW_SPACE;
+      default:
+        UNREACHABLE();
+    }
   }
 
   static size_t DefaultGetExternallyAllocatedMemoryInBytesCallback() {
@@ -1875,9 +1641,9 @@ class Heap {
 
   // These five Create*EntryStub functions are here and forced to not be inlined
   // because of a gcc-4.4 bug that assigns wrong vtable entries.
-  NO_INLINE(void CreateJSEntryStub());
-  NO_INLINE(void CreateJSConstructEntryStub());
-  NO_INLINE(void CreateJSRunMicrotasksEntryStub());
+  V8_NOINLINE void CreateJSEntryStub();
+  V8_NOINLINE void CreateJSConstructEntryStub();
+  V8_NOINLINE void CreateJSRunMicrotasksEntryStub();
 
   void CreateFixedStubs();
 
@@ -1942,13 +1708,13 @@ class Heap {
   void AddToRingBuffer(const char* string);
   void GetFromRingBuffer(char* buffer);
 
-  void CompactRetainedMaps(ArrayList* retained_maps);
+  void CompactRetainedMaps(WeakArrayList* retained_maps);
 
   void CollectGarbageOnMemoryPressure();
 
   bool InvokeNearHeapLimitCallback();
 
-  void ComputeFastPromotionMode(double survival_rate);
+  void ComputeFastPromotionMode();
 
   // Attempt to over-approximate the weak closure by marking object groups and
   // implicit references from global handles, but don't atomically complete
@@ -2016,9 +1782,12 @@ class Heap {
   // ===========================================================================
 
   inline size_t OldGenerationSpaceAvailable() {
-    if (old_generation_allocation_limit_ <= PromotedTotalSize()) return 0;
+    if (old_generation_allocation_limit_ <=
+        OldGenerationObjectsAndPromotedExternalMemorySize())
+      return 0;
     return old_generation_allocation_limit_ -
-           static_cast<size_t>(PromotedTotalSize());
+           static_cast<size_t>(
+               OldGenerationObjectsAndPromotedExternalMemorySize());
   }
 
   // We allow incremental marking to overshoot the allocation limit for
@@ -2028,8 +1797,11 @@ class Heap {
     // This guards against too eager finalization in small heaps.
     // The number is chosen based on v8.browsing_mobile on Nexus 7v2.
     size_t kMarginForSmallHeaps = 32u * MB;
-    if (old_generation_allocation_limit_ >= PromotedTotalSize()) return false;
-    uint64_t overshoot = PromotedTotalSize() - old_generation_allocation_limit_;
+    if (old_generation_allocation_limit_ >=
+        OldGenerationObjectsAndPromotedExternalMemorySize())
+      return false;
+    uint64_t overshoot = OldGenerationObjectsAndPromotedExternalMemorySize() -
+                         old_generation_allocation_limit_;
     // Overshoot margin is 50% of allocation limit or half-way to the max heap
     // with special handling of small heaps.
     uint64_t margin =
@@ -2051,6 +1823,9 @@ class Heap {
   // Growing strategy. =========================================================
   // ===========================================================================
 
+  HeapController* heap_controller() { return heap_controller_; }
+  MemoryReducer* memory_reducer() { return memory_reducer_; }
+
   // For some webpages RAIL mode does not switch from PERFORMANCE_LOAD.
   // This constant limits the effect of load RAIL mode on GC.
   // The value is arbitrary and chosen as the largest load time observed in
@@ -2059,32 +1834,20 @@ class Heap {
 
   bool ShouldOptimizeForLoadTime();
 
-  // Decrease the allocation limit if the new limit based on the given
-  // parameters is lower than the current limit.
-  void DampenOldGenerationAllocationLimit(size_t old_gen_size, double gc_speed,
-                                          double mutator_speed);
-
-  // Calculates the allocation limit based on a given growing factor and a
-  // given old generation size.
-  size_t CalculateOldGenerationAllocationLimit(double factor,
-                                               size_t old_gen_size);
-
-  // Sets the allocation limit to trigger the next full garbage collection.
-  void SetOldGenerationAllocationLimit(size_t old_gen_size, double gc_speed,
-                                       double mutator_speed);
-
-  size_t MinimumAllocationLimitGrowingStep();
-
   size_t old_generation_allocation_limit() const {
     return old_generation_allocation_limit_;
   }
 
-  bool always_allocate() { return always_allocate_scope_count_.Value() != 0; }
+  bool always_allocate() { return always_allocate_scope_count_ != 0; }
 
   bool CanExpandOldGeneration(size_t size);
 
   bool ShouldExpandOldGenerationOnSlowAllocation();
 
+  enum class HeapGrowingMode { kSlow, kConservative, kMinimal, kDefault };
+
+  HeapGrowingMode CurrentHeapGrowingMode();
+
   enum class IncrementalMarkingLimit { kNoLimit, kSoftLimit, kHardLimit };
   IncrementalMarkingLimit IncrementalMarkingLimitReached();
 
@@ -2123,7 +1886,22 @@ class Heap {
       int size_in_bytes, AllocationSpace space,
       AllocationAlignment aligment = kWordAligned);
 
-  HeapObject* AllocateRawWithRetry(
+  // This method will try to perform an allocation of a given size in a given
+  // space. If the allocation fails, a regular full garbage collection is
+  // triggered and the allocation is retried. This is performed multiple times.
+  // If after that retry procedure the allocation still fails nullptr is
+  // returned.
+  HeapObject* AllocateRawWithLightRetry(
+      int size, AllocationSpace space,
+      AllocationAlignment alignment = kWordAligned);
+
+  // This method will try to perform an allocation of a given size in a given
+  // space. If the allocation fails, a regular full garbage collection is
+  // triggered and the allocation is retried. This is performed multiple times.
+  // If after that retry procedure the allocation still fails a "hammer"
+  // garbage collection is triggered which tries to significantly reduce memory.
+  // If the allocation still fails after that a fatal error is thrown.
+  HeapObject* AllocateRawWithRetryOrFail(
       int size, AllocationSpace space,
       AllocationAlignment alignment = kWordAligned);
   HeapObject* AllocateRawCodeInLargeObjectSpace(int size);
@@ -2132,10 +1910,17 @@ class Heap {
   V8_WARN_UNUSED_RESULT AllocationResult Allocate(Map* map,
                                                   AllocationSpace space);
 
+  // Takes a code object and checks if it is on memory which is not subject to
+  // compaction. This method will return a new code object on an immovable
+  // memory location if the original code object was movable.
+  HeapObject* EnsureImmovableCode(HeapObject* heap_object, int object_size);
+
   // Allocates a partial map for bootstrapping.
   V8_WARN_UNUSED_RESULT AllocationResult
   AllocatePartialMap(InstanceType instance_type, int instance_size);
 
+  void FinalizePartialMap(Map* map);
+
   // Allocate empty fixed typed array of given type.
   V8_WARN_UNUSED_RESULT AllocationResult
   AllocateEmptyFixedTypedArray(ExternalArrayType array_type);
@@ -2147,7 +1932,7 @@ class Heap {
   // ===========================================================================
 
   void AddRetainer(HeapObject* retainer, HeapObject* object);
-  void AddEphemeralRetainer(HeapObject* retainer, HeapObject* object);
+  void AddEphemeronRetainer(HeapObject* retainer, HeapObject* object);
   void AddRetainingRoot(Root root, HeapObject* object);
   // Returns true if the given object is a target of retaining path tracking.
   // Stores the option corresponding to the object in the provided *option.
@@ -2164,7 +1949,7 @@ class Heap {
   int64_t external_memory_at_last_mark_compact_;
 
   // The amount of memory that has been freed concurrently.
-  base::AtomicNumber<intptr_t> external_memory_concurrently_freed_;
+  std::atomic<intptr_t> external_memory_concurrently_freed_;
 
   // This can be calculated directly from a pointer to the heap; however, it is
   // more expedient to get at the isolate directly from within Heap methods.
@@ -2179,6 +1964,20 @@ class Heap {
       kRootListLength * kPointerSize;
   ExternalReferenceTable external_reference_table_;
 
+  // As external references above, builtins are accessed through an offset from
+  // the roots register. Its offset from roots_ must remain static. This is
+  // verified in Isolate::Init() using runtime checks.
+  static constexpr int kRootsBuiltinsOffset =
+      kRootsExternalReferenceTableOffset +
+      ExternalReferenceTable::SizeInBytes();
+  Object* builtins_[Builtins::builtin_count];
+
+  // kRootRegister may be used to address any location that starts at the
+  // Isolate and ends at this point. Fields past this point are not guaranteed
+  // to live at a static offset from kRootRegister.
+  static constexpr int kRootRegisterAddressableEndOffset =
+      kRootsBuiltinsOffset + Builtins::builtin_count * kPointerSize;
+
   size_t code_range_size_;
   size_t max_semi_space_size_;
   size_t initial_semispace_size_;
@@ -2197,7 +1996,7 @@ class Heap {
 
   // This is not the depth of nested AlwaysAllocateScope's but rather a single
   // count, as scopes can be acquired from multiple tasks (read: threads).
-  base::AtomicNumber<size_t> always_allocate_scope_count_;
+  std::atomic<size_t> always_allocate_scope_count_;
 
   // Stores the memory pressure level that set by MemoryPressureNotification
   // and reset by a mark-compact garbage collection.
@@ -2216,9 +2015,10 @@ class Heap {
 
   NewSpace* new_space_;
   OldSpace* old_space_;
-  OldSpace* code_space_;
+  CodeSpace* code_space_;
   MapSpace* map_space_;
   LargeObjectSpace* lo_space_;
+  NewLargeObjectSpace* new_lo_space_;
   ReadOnlySpace* read_only_space_;
   // Map from the space id to the space.
   Space* space_[LAST_SPACE + 1];
@@ -2291,11 +2091,6 @@ class Heap {
   Object* native_contexts_list_;
   Object* allocation_sites_list_;
 
-  // List of encountered weak collections (JSWeakMap and JSWeakSet) during
-  // marking. It is initialized during marking, destroyed after marking and
-  // contains Smi(0) while marking is not active.
-  Object* encountered_weak_collections_;
-
   std::vector<GCCallbackTuple> gc_epilogue_callbacks_;
   std::vector<GCCallbackTuple> gc_prologue_callbacks_;
 
@@ -2339,6 +2134,8 @@ class Heap {
 
   StoreBuffer* store_buffer_;
 
+  HeapController* heap_controller_;
+
   IncrementalMarking* incremental_marking_;
   ConcurrentMarking* concurrent_marking_;
 
@@ -2434,7 +2231,7 @@ class Heap {
   std::map<HeapObject*, Root> retaining_root_;
   // If an object is retained by an ephemeron, then the retaining key of the
   // ephemeron is stored in this map.
-  std::map<HeapObject*, HeapObject*> ephemeral_retainer_;
+  std::map<HeapObject*, HeapObject*> ephemeron_retainer_;
   // For each index inthe retaining_path_targets_ array this map
   // stores the option of the corresponding target.
   std::map<int, RetainingPathOption> retaining_path_target_option_;
@@ -2444,8 +2241,10 @@ class Heap {
   // Classes in "heap" can be friends.
   friend class AlwaysAllocateScope;
   friend class ConcurrentMarking;
+  friend class EphemeronHashTableMarkingTask;
   friend class GCCallbacksScope;
   friend class GCTracer;
+  friend class HeapController;
   friend class HeapIterator;
   friend class IdleScavengeObserver;
   friend class IncrementalMarking;
@@ -2475,6 +2274,8 @@ class Heap {
   // Used in cctest.
   friend class heap::HeapTester;
 
+  FRIEND_TEST(HeapControllerTest, OldGenerationAllocationLimit);
+
   DISALLOW_COPY_AND_ASSIGN(Heap);
 };
 
@@ -2485,30 +2286,32 @@ class HeapStats {
   static const int kEndMarker = 0xDECADE01;
 
   intptr_t* start_marker;                  //  0
-  size_t* new_space_size;                  //  1
-  size_t* new_space_capacity;              //  2
-  size_t* old_space_size;                  //  3
-  size_t* old_space_capacity;              //  4
-  size_t* code_space_size;                 //  5
-  size_t* code_space_capacity;             //  6
-  size_t* map_space_size;                  //  7
-  size_t* map_space_capacity;              //  8
-  size_t* lo_space_size;                   //  9
-  size_t* global_handle_count;             // 10
-  size_t* weak_global_handle_count;        // 11
-  size_t* pending_global_handle_count;     // 12
-  size_t* near_death_global_handle_count;  // 13
-  size_t* free_global_handle_count;        // 14
-  size_t* memory_allocator_size;           // 15
-  size_t* memory_allocator_capacity;       // 16
-  size_t* malloced_memory;                 // 17
-  size_t* malloced_peak_memory;            // 18
-  size_t* objects_per_type;                // 19
-  size_t* size_per_type;                   // 20
-  int* os_error;                           // 21
-  char* last_few_messages;                 // 22
-  char* js_stacktrace;                     // 23
-  intptr_t* end_marker;                    // 24
+  size_t* ro_space_size;                   //  1
+  size_t* ro_space_capacity;               //  2
+  size_t* new_space_size;                  //  3
+  size_t* new_space_capacity;              //  4
+  size_t* old_space_size;                  //  5
+  size_t* old_space_capacity;              //  6
+  size_t* code_space_size;                 //  7
+  size_t* code_space_capacity;             //  8
+  size_t* map_space_size;                  //  9
+  size_t* map_space_capacity;              // 10
+  size_t* lo_space_size;                   // 11
+  size_t* global_handle_count;             // 12
+  size_t* weak_global_handle_count;        // 13
+  size_t* pending_global_handle_count;     // 14
+  size_t* near_death_global_handle_count;  // 15
+  size_t* free_global_handle_count;        // 16
+  size_t* memory_allocator_size;           // 17
+  size_t* memory_allocator_capacity;       // 18
+  size_t* malloced_memory;                 // 19
+  size_t* malloced_peak_memory;            // 20
+  size_t* objects_per_type;                // 21
+  size_t* size_per_type;                   // 22
+  int* os_error;                           // 23
+  char* last_few_messages;                 // 24
+  char* js_stacktrace;                     // 25
+  intptr_t* end_marker;                    // 26
 };
 
 
@@ -2567,6 +2370,7 @@ class CodePageMemoryModificationScope {
 // objects in a heap space but above the allocation pointer.
 class VerifyPointersVisitor : public ObjectVisitor, public RootVisitor {
  public:
+  explicit VerifyPointersVisitor(Heap* heap) : heap_(heap) {}
   void VisitPointers(HeapObject* host, Object** start, Object** end) override;
   void VisitPointers(HeapObject* host, MaybeObject** start,
                      MaybeObject** end) override;
@@ -2576,6 +2380,8 @@ class VerifyPointersVisitor : public ObjectVisitor, public RootVisitor {
  protected:
   virtual void VerifyPointers(HeapObject* host, MaybeObject** start,
                               MaybeObject** end);
+
+  Heap* heap_;
 };
 
 
diff --git a/deps/v8/src/heap/incremental-marking-inl.h b/deps/v8/src/heap/incremental-marking-inl.h
index b64c203a8d74b8..d2736c67150605 100644
--- a/deps/v8/src/heap/incremental-marking-inl.h
+++ b/deps/v8/src/heap/incremental-marking-inl.h
@@ -17,8 +17,10 @@ void IncrementalMarking::RecordWrite(HeapObject* obj, Object** slot,
                                      Object* value) {
   DCHECK_IMPLIES(slot != nullptr, !HasWeakHeapObjectTag(*slot));
   DCHECK(!HasWeakHeapObjectTag(value));
-  RecordMaybeWeakWrite(obj, reinterpret_cast<MaybeObject**>(slot),
-                       reinterpret_cast<MaybeObject*>(value));
+  if (IsMarking() && value->IsHeapObject()) {
+    RecordWriteSlow(obj, reinterpret_cast<HeapObjectReference**>(slot),
+                    HeapObject::cast(value));
+  }
 }
 
 void IncrementalMarking::RecordMaybeWeakWrite(HeapObject* obj,
diff --git a/deps/v8/src/heap/incremental-marking.cc b/deps/v8/src/heap/incremental-marking.cc
index 2b693ed44eda3f..2b84a459993c72 100644
--- a/deps/v8/src/heap/incremental-marking.cc
+++ b/deps/v8/src/heap/incremental-marking.cc
@@ -16,6 +16,7 @@
 #include "src/heap/objects-visiting-inl.h"
 #include "src/heap/objects-visiting.h"
 #include "src/heap/sweeper.h"
+#include "src/objects/hash-table-inl.h"
 #include "src/tracing/trace-event.h"
 #include "src/v8.h"
 #include "src/visitors.h"
@@ -37,12 +38,12 @@ void IncrementalMarking::Observer::Step(int bytes_allocated, Address addr,
       heap->isolate(),
       RuntimeCallCounterId::kGC_Custom_IncrementalMarkingObserver);
   incremental_marking_.AdvanceIncrementalMarkingOnAllocation();
-  if (incremental_marking_.black_allocation() && addr != nullptr) {
+  if (incremental_marking_.black_allocation() && addr != kNullAddress) {
     // AdvanceIncrementalMarkingOnAllocation can start black allocation.
     // Ensure that the new object is marked black.
     HeapObject* object = HeapObject::FromAddress(addr);
     if (incremental_marking_.marking_state()->IsWhite(object) &&
-        !heap->InNewSpace(object)) {
+        !(Heap::InNewSpace(object) || heap->new_lo_space()->Contains(object))) {
       if (heap->lo_space()->Contains(object)) {
         incremental_marking_.marking_state()->WhiteToBlack(object);
       } else {
@@ -98,14 +99,16 @@ void IncrementalMarking::RecordWriteSlow(HeapObject* obj,
                                          Object* value) {
   if (BaseRecordWrite(obj, value) && slot != nullptr) {
     // Object is not going to be rescanned we need to record the slot.
-    heap_->mark_compact_collector()->RecordSlot(obj, slot, value);
+    heap_->mark_compact_collector()->RecordSlot(obj, slot,
+                                                HeapObject::cast(value));
   }
 }
 
-int IncrementalMarking::RecordWriteFromCode(HeapObject* obj, Object** slot,
+int IncrementalMarking::RecordWriteFromCode(HeapObject* obj, MaybeObject** slot,
                                             Isolate* isolate) {
   DCHECK(obj->IsHeapObject());
-  isolate->heap()->incremental_marking()->RecordWrite(obj, slot, *slot);
+  isolate->heap()->incremental_marking()->RecordMaybeWeakWrite(obj, slot,
+                                                               *slot);
   // Called by RecordWriteCodeStubAssembler, which doesnt accept void type
   return 0;
 }
@@ -226,34 +229,10 @@ class IncrementalMarkingRootMarkingVisitor : public RootVisitor {
   Heap* heap_;
 };
 
-void IncrementalMarking::SetOldSpacePageFlags(MemoryChunk* chunk,
-                                              bool is_marking,
-                                              bool is_compacting) {
-  if (is_marking) {
-    chunk->SetFlag(MemoryChunk::POINTERS_TO_HERE_ARE_INTERESTING);
-    chunk->SetFlag(MemoryChunk::POINTERS_FROM_HERE_ARE_INTERESTING);
-  } else {
-    chunk->ClearFlag(MemoryChunk::POINTERS_TO_HERE_ARE_INTERESTING);
-    chunk->SetFlag(MemoryChunk::POINTERS_FROM_HERE_ARE_INTERESTING);
-  }
-}
-
-
-void IncrementalMarking::SetNewSpacePageFlags(MemoryChunk* chunk,
-                                              bool is_marking) {
-  chunk->SetFlag(MemoryChunk::POINTERS_TO_HERE_ARE_INTERESTING);
-  if (is_marking) {
-    chunk->SetFlag(MemoryChunk::POINTERS_FROM_HERE_ARE_INTERESTING);
-  } else {
-    chunk->ClearFlag(MemoryChunk::POINTERS_FROM_HERE_ARE_INTERESTING);
-  }
-}
-
-
 void IncrementalMarking::DeactivateIncrementalWriteBarrierForSpace(
     PagedSpace* space) {
   for (Page* p : *space) {
-    SetOldSpacePageFlags(p, false, false);
+    p->SetOldGenerationPageFlags(false);
   }
 }
 
@@ -261,7 +240,7 @@ void IncrementalMarking::DeactivateIncrementalWriteBarrierForSpace(
 void IncrementalMarking::DeactivateIncrementalWriteBarrierForSpace(
     NewSpace* space) {
   for (Page* p : *space) {
-    SetNewSpacePageFlags(p, false);
+    p->SetYoungGenerationPageFlags(false);
   }
 }
 
@@ -272,22 +251,22 @@ void IncrementalMarking::DeactivateIncrementalWriteBarrier() {
   DeactivateIncrementalWriteBarrierForSpace(heap_->code_space());
   DeactivateIncrementalWriteBarrierForSpace(heap_->new_space());
 
-  for (LargePage* lop : *heap_->lo_space()) {
-    SetOldSpacePageFlags(lop, false, false);
+  for (LargePage* p : *heap_->lo_space()) {
+    p->SetOldGenerationPageFlags(false);
   }
 }
 
 
 void IncrementalMarking::ActivateIncrementalWriteBarrier(PagedSpace* space) {
   for (Page* p : *space) {
-    SetOldSpacePageFlags(p, true, is_compacting_);
+    p->SetOldGenerationPageFlags(true);
   }
 }
 
 
 void IncrementalMarking::ActivateIncrementalWriteBarrier(NewSpace* space) {
   for (Page* p : *space) {
-    SetNewSpacePageFlags(p, true);
+    p->SetYoungGenerationPageFlags(true);
   }
 }
 
@@ -298,8 +277,8 @@ void IncrementalMarking::ActivateIncrementalWriteBarrier() {
   ActivateIncrementalWriteBarrier(heap_->code_space());
   ActivateIncrementalWriteBarrier(heap_->new_space());
 
-  for (LargePage* lop : *heap_->lo_space()) {
-    SetOldSpacePageFlags(lop, true, is_compacting_);
+  for (LargePage* p : *heap_->lo_space()) {
+    p->SetOldGenerationPageFlags(true);
   }
 }
 
@@ -324,7 +303,7 @@ void IncrementalMarking::Deactivate() {
 void IncrementalMarking::Start(GarbageCollectionReason gc_reason) {
   if (FLAG_trace_incremental_marking) {
     int old_generation_size_mb =
-        static_cast<int>(heap()->PromotedSpaceSizeOfObjects() / MB);
+        static_cast<int>(heap()->OldGenerationSizeOfObjects() / MB);
     int old_generation_limit_mb =
         static_cast<int>(heap()->old_generation_allocation_limit() / MB);
     heap()->isolate()->PrintWithTimestamp(
@@ -350,7 +329,7 @@ void IncrementalMarking::Start(GarbageCollectionReason gc_reason) {
   heap_->tracer()->NotifyIncrementalMarkingStart();
 
   start_time_ms_ = heap()->MonotonicallyIncreasingTimeInMs();
-  initial_old_generation_size_ = heap_->PromotedSpaceSizeOfObjects();
+  initial_old_generation_size_ = heap_->OldGenerationSizeOfObjects();
   old_generation_allocation_counter_ = heap_->OldGenerationAllocationCounter();
   bytes_allocated_ = 0;
   bytes_marked_ahead_of_schedule_ = 0;
@@ -486,16 +465,14 @@ void IncrementalMarking::MarkRoots() {
   heap_->IterateStrongRoots(&visitor, VISIT_ONLY_STRONG);
 }
 
-bool ShouldRetainMap(Map* map, int age) {
+bool IncrementalMarking::ShouldRetainMap(Map* map, int age) {
   if (age == 0) {
     // The map has aged. Do not retain this map.
     return false;
   }
   Object* constructor = map->GetConstructor();
-  Heap* heap = map->GetHeap();
   if (!constructor->IsHeapObject() ||
-      heap->incremental_marking()->marking_state()->IsWhite(
-          HeapObject::cast(constructor))) {
+      marking_state()->IsWhite(HeapObject::cast(constructor))) {
     // The constructor is dead, no new objects with this map can
     // be created. Do not retain this map.
     return false;
@@ -511,19 +488,21 @@ void IncrementalMarking::RetainMaps() {
   bool map_retaining_is_disabled = heap()->ShouldReduceMemory() ||
                                    heap()->ShouldAbortIncrementalMarking() ||
                                    FLAG_retain_maps_for_n_gc == 0;
-  ArrayList* retained_maps = heap()->retained_maps();
-  int length = retained_maps->Length();
+  WeakArrayList* retained_maps = heap()->retained_maps();
+  int length = retained_maps->length();
   // The number_of_disposed_maps separates maps in the retained_maps
   // array that were created before and after context disposal.
   // We do not age and retain disposed maps to avoid memory leaks.
   int number_of_disposed_maps = heap()->number_of_disposed_maps_;
   for (int i = 0; i < length; i += 2) {
-    DCHECK(retained_maps->Get(i)->IsWeakCell());
-    WeakCell* cell = WeakCell::cast(retained_maps->Get(i));
-    if (cell->cleared()) continue;
-    int age = Smi::ToInt(retained_maps->Get(i + 1));
+    MaybeObject* value = retained_maps->Get(i);
+    HeapObject* map_heap_object;
+    if (!value->ToWeakHeapObject(&map_heap_object)) {
+      continue;
+    }
+    int age = Smi::ToInt(retained_maps->Get(i + 1)->ToSmi());
     int new_age;
-    Map* map = Map::cast(cell->value());
+    Map* map = Map::cast(map_heap_object);
     if (i >= number_of_disposed_maps && !map_retaining_is_disabled &&
         marking_state()->IsWhite(map)) {
       if (ShouldRetainMap(map, age)) {
@@ -544,7 +523,7 @@ void IncrementalMarking::RetainMaps() {
     }
     // Compact the array and update the age.
     if (new_age != age) {
-      retained_maps->Set(i + 1, Smi::FromInt(new_age));
+      retained_maps->Set(i + 1, MaybeObject::FromSmi(Smi::FromInt(new_age)));
     }
   }
 }
@@ -586,7 +565,7 @@ void IncrementalMarking::FinalizeIncrementally() {
 void IncrementalMarking::UpdateMarkingWorklistAfterScavenge() {
   if (!IsMarking()) return;
 
-  Map* filler_map = heap_->one_pointer_filler_map();
+  Map* filler_map = ReadOnlyRoots(heap_).one_pointer_filler_map();
 
 #ifdef ENABLE_MINOR_MC
   MinorMarkCompactCollector::MarkingState* minor_marking_state =
@@ -599,7 +578,7 @@ void IncrementalMarking::UpdateMarkingWorklistAfterScavenge() {
                                  HeapObject* obj, HeapObject** out) -> bool {
     DCHECK(obj->IsHeapObject());
     // Only pointers to from space have to be updated.
-    if (heap_->InFromSpace(obj)) {
+    if (Heap::InFromSpace(obj)) {
       MapWord map_word = obj->map_word();
       if (!map_word.IsForwardingAddress()) {
         // There may be objects on the marking deque that do not exist anymore,
@@ -613,7 +592,7 @@ void IncrementalMarking::UpdateMarkingWorklistAfterScavenge() {
       DCHECK_IMPLIES(marking_state()->IsWhite(obj), obj->IsFiller());
       *out = dest;
       return true;
-    } else if (heap_->InToSpace(obj)) {
+    } else if (Heap::InToSpace(obj)) {
       // The object may be on a page that was moved in new space.
       DCHECK(
           Page::FromAddress(obj->address())->IsFlagSet(Page::SWEEP_TO_ITERATE));
@@ -651,43 +630,84 @@ void IncrementalMarking::UpdateMarkingWorklistAfterScavenge() {
   UpdateWeakReferencesAfterScavenge();
 }
 
+namespace {
+template <typename T>
+T* ForwardingAddress(T* heap_obj) {
+  MapWord map_word = heap_obj->map_word();
+
+  if (map_word.IsForwardingAddress()) {
+    return T::cast(map_word.ToForwardingAddress());
+  } else if (Heap::InNewSpace(heap_obj)) {
+    return nullptr;
+  } else {
+    return heap_obj;
+  }
+}
+}  // namespace
+
 void IncrementalMarking::UpdateWeakReferencesAfterScavenge() {
   weak_objects_->weak_references.Update(
       [](std::pair<HeapObject*, HeapObjectReference**> slot_in,
          std::pair<HeapObject*, HeapObjectReference**>* slot_out) -> bool {
         HeapObject* heap_obj = slot_in.first;
-        MapWord map_word = heap_obj->map_word();
-        if (map_word.IsForwardingAddress()) {
+        HeapObject* forwarded = ForwardingAddress(heap_obj);
+
+        if (forwarded) {
           ptrdiff_t distance_to_slot =
               reinterpret_cast<Address>(slot_in.second) -
               reinterpret_cast<Address>(slot_in.first);
           Address new_slot =
-              reinterpret_cast<Address>(map_word.ToForwardingAddress()) +
-              distance_to_slot;
-          slot_out->first = map_word.ToForwardingAddress();
+              reinterpret_cast<Address>(forwarded) + distance_to_slot;
+          slot_out->first = forwarded;
           slot_out->second = reinterpret_cast<HeapObjectReference**>(new_slot);
           return true;
         }
-        if (heap_obj->GetHeap()->InNewSpace(heap_obj)) {
-          // The new space object containing the weak reference died.
-          return false;
-        }
-        *slot_out = slot_in;
-        return true;
+
+        return false;
       });
   weak_objects_->weak_objects_in_code.Update(
       [](std::pair<HeapObject*, Code*> slot_in,
          std::pair<HeapObject*, Code*>* slot_out) -> bool {
         HeapObject* heap_obj = slot_in.first;
-        MapWord map_word = heap_obj->map_word();
-        if (map_word.IsForwardingAddress()) {
-          slot_out->first = map_word.ToForwardingAddress();
+        HeapObject* forwarded = ForwardingAddress(heap_obj);
+
+        if (forwarded) {
+          slot_out->first = forwarded;
           slot_out->second = slot_in.second;
-        } else {
-          *slot_out = slot_in;
+          return true;
         }
-        return true;
+
+        return false;
+      });
+  weak_objects_->ephemeron_hash_tables.Update(
+      [](EphemeronHashTable* slot_in, EphemeronHashTable** slot_out) -> bool {
+        EphemeronHashTable* forwarded = ForwardingAddress(slot_in);
+
+        if (forwarded) {
+          *slot_out = forwarded;
+          return true;
+        }
+
+        return false;
       });
+
+  auto ephemeron_updater = [](Ephemeron slot_in, Ephemeron* slot_out) -> bool {
+    HeapObject* key = slot_in.key;
+    HeapObject* value = slot_in.value;
+    HeapObject* forwarded_key = ForwardingAddress(key);
+    HeapObject* forwarded_value = ForwardingAddress(value);
+
+    if (forwarded_key && forwarded_value) {
+      *slot_out = Ephemeron{forwarded_key, forwarded_value};
+      return true;
+    }
+
+    return false;
+  };
+
+  weak_objects_->current_ephemerons.Update(ephemeron_updater);
+  weak_objects_->next_ephemerons.Update(ephemeron_updater);
+  weak_objects_->discovered_ephemerons.Update(ephemeron_updater);
 }
 
 void IncrementalMarking::UpdateMarkedBytesAfterScavenge(
@@ -714,8 +734,7 @@ int IncrementalMarking::VisitObject(Map* map, HeapObject* obj) {
     //    unsafe layout change.
     // 4. The object is materizalized by the deoptimizer.
     DCHECK(obj->IsHashTable() || obj->IsPropertyArray() ||
-           obj->IsContextExtension() || obj->IsFixedArray() ||
-           obj->IsJSObject() || obj->IsString());
+           obj->IsFixedArray() || obj->IsJSObject() || obj->IsString());
   }
   DCHECK(marking_state()->IsBlack(obj));
   WhiteToGreyAndPush(map);
@@ -810,7 +829,7 @@ void IncrementalMarking::Stop() {
   if (IsStopped()) return;
   if (FLAG_trace_incremental_marking) {
     int old_generation_size_mb =
-        static_cast<int>(heap()->PromotedSpaceSizeOfObjects() / MB);
+        static_cast<int>(heap()->OldGenerationSizeOfObjects() / MB);
     int old_generation_limit_mb =
         static_cast<int>(heap()->old_generation_allocation_limit() / MB);
     heap()->isolate()->PrintWithTimestamp(
@@ -959,7 +978,7 @@ size_t IncrementalMarking::StepSizeToMakeProgress() {
   size_t oom_slack = heap()->new_space()->Capacity() + 64 * MB;
 
   if (!heap()->CanExpandOldGeneration(oom_slack)) {
-    return heap()->PromotedSpaceSizeOfObjects() / kTargetStepCountAtOOM;
+    return heap()->OldGenerationSizeOfObjects() / kTargetStepCountAtOOM;
   }
 
   size_t step_size = Max(initial_old_generation_size_ / kTargetStepCount,
diff --git a/deps/v8/src/heap/incremental-marking.h b/deps/v8/src/heap/incremental-marking.h
index b9f6a664440514..1a916693bae7ef 100644
--- a/deps/v8/src/heap/incremental-marking.h
+++ b/deps/v8/src/heap/incremental-marking.h
@@ -196,7 +196,7 @@ class V8_EXPORT_PRIVATE IncrementalMarking {
 
   inline void RestartIfNotMarking();
 
-  static int RecordWriteFromCode(HeapObject* obj, Object** slot,
+  static int RecordWriteFromCode(HeapObject* obj, MaybeObject** slot,
                                  Isolate* isolate);
 
   // Record a slot for compaction.  Returns false for objects that are
@@ -226,14 +226,6 @@ class V8_EXPORT_PRIVATE IncrementalMarking {
   // the concurrent marker.
   void MarkBlackAndPush(HeapObject* obj);
 
-  inline void SetOldSpacePageFlags(MemoryChunk* chunk) {
-    SetOldSpacePageFlags(chunk, IsMarking(), IsCompacting());
-  }
-
-  inline void SetNewSpacePageFlags(Page* chunk) {
-    SetNewSpacePageFlags(chunk, IsMarking());
-  }
-
   bool IsCompacting() { return IsMarking() && is_compacting_; }
 
   void ActivateGeneratedStub(Code* stub);
@@ -279,11 +271,6 @@ class V8_EXPORT_PRIVATE IncrementalMarking {
     IncrementalMarking& incremental_marking_;
   };
 
-  static void SetOldSpacePageFlags(MemoryChunk* chunk, bool is_marking,
-                                   bool is_compacting);
-
-  static void SetNewSpacePageFlags(MemoryChunk* chunk, bool is_marking);
-
   void StartMarking();
 
   void StartBlackAllocation();
@@ -291,6 +278,7 @@ class V8_EXPORT_PRIVATE IncrementalMarking {
   void FinishBlackAllocation();
 
   void MarkRoots();
+  bool ShouldRetainMap(Map* map, int age);
   // Retain dying maps for <FLAG_retain_maps_for_n_gc> garbage collections to
   // increase chances of reusing of map transition tree in future.
   void RetainMaps();
diff --git a/deps/v8/src/heap/local-allocator.h b/deps/v8/src/heap/local-allocator.h
index 0a23e774b3acc8..4646a3783dea8c 100644
--- a/deps/v8/src/heap/local-allocator.h
+++ b/deps/v8/src/heap/local-allocator.h
@@ -35,8 +35,8 @@ class LocalAllocator {
     // sits right next to new space allocation top.
     const LinearAllocationArea info = new_space_lab_.Close();
     const Address top = new_space_->top();
-    if (info.limit() != nullptr && info.limit() == top) {
-      DCHECK_NOT_NULL(info.top());
+    if (info.limit() != kNullAddress && info.limit() == top) {
+      DCHECK_NE(info.top(), kNullAddress);
       *new_space_->allocation_top_address() = info.top();
     }
   }
diff --git a/deps/v8/src/heap/mark-compact-inl.h b/deps/v8/src/heap/mark-compact-inl.h
index c21c7dda6e98c5..d2006719551962 100644
--- a/deps/v8/src/heap/mark-compact-inl.h
+++ b/deps/v8/src/heap/mark-compact-inl.h
@@ -9,6 +9,7 @@
 #include "src/heap/mark-compact.h"
 #include "src/heap/objects-visiting-inl.h"
 #include "src/heap/remembered-set.h"
+#include "src/objects/js-collection-inl.h"
 
 namespace v8 {
 namespace internal {
@@ -88,29 +89,38 @@ int MarkingVisitor<fixed_array_mode, retaining_path_mode,
 template <FixedArrayVisitationMode fixed_array_mode,
           TraceRetainingPathMode retaining_path_mode, typename MarkingState>
 int MarkingVisitor<fixed_array_mode, retaining_path_mode, MarkingState>::
-    VisitJSWeakCollection(Map* map, JSWeakCollection* weak_collection) {
-  // Enqueue weak collection in linked list of encountered weak collections.
-  if (weak_collection->next() == heap_->undefined_value()) {
-    weak_collection->set_next(heap_->encountered_weak_collections());
-    heap_->set_encountered_weak_collections(weak_collection);
+    VisitEphemeronHashTable(Map* map, EphemeronHashTable* table) {
+  collector_->AddEphemeronHashTable(table);
+
+  for (int i = 0; i < table->Capacity(); i++) {
+    Object** key_slot =
+        table->RawFieldOfElementAt(EphemeronHashTable::EntryToIndex(i));
+    HeapObject* key = HeapObject::cast(table->KeyAt(i));
+    collector_->RecordSlot(table, key_slot, key);
+
+    Object** value_slot =
+        table->RawFieldOfElementAt(EphemeronHashTable::EntryToValueIndex(i));
+
+    if (marking_state()->IsBlackOrGrey(key)) {
+      VisitPointer(table, value_slot);
+
+    } else {
+      Object* value_obj = *value_slot;
+
+      if (value_obj->IsHeapObject()) {
+        HeapObject* value = HeapObject::cast(value_obj);
+        collector_->RecordSlot(table, value_slot, value);
+
+        // Revisit ephemerons with both key and value unreachable at end
+        // of concurrent marking cycle.
+        if (marking_state()->IsWhite(value)) {
+          collector_->AddEphemeron(key, value);
+        }
+      }
+    }
   }
 
-  // Skip visiting the backing hash table containing the mappings and the
-  // pointer to the other enqueued weak collections, both are post-processed.
-  int size = JSWeakCollection::BodyDescriptorWeak::SizeOf(map, weak_collection);
-  JSWeakCollection::BodyDescriptorWeak::IterateBody(map, weak_collection, size,
-                                                    this);
-
-  // Partially initialized weak collection is enqueued, but table is ignored.
-  if (!weak_collection->table()->IsHashTable()) return size;
-
-  // Mark the backing hash table without pushing it on the marking stack.
-  Object** slot =
-      HeapObject::RawField(weak_collection, JSWeakCollection::kTableOffset);
-  HeapObject* obj = HeapObject::cast(*slot);
-  collector_->RecordSlot(weak_collection, slot, obj);
-  MarkObjectWithoutPush(weak_collection, obj);
-  return size;
+  return table->SizeFromMap(map);
 }
 
 template <FixedArrayVisitationMode fixed_array_mode,
@@ -162,7 +172,7 @@ int MarkingVisitor<fixed_array_mode, retaining_path_mode,
       // Weak cells with live values are directly processed here to reduce
       // the processing time of weak cells during the main GC pause.
       Object** slot = HeapObject::RawField(weak_cell, WeakCell::kValueOffset);
-      collector_->RecordSlot(weak_cell, slot, *slot);
+      collector_->RecordSlot(weak_cell, slot, HeapObject::cast(*slot));
     } else {
       // If we do not know about liveness of values of weak cells, we have to
       // process them when we know the liveness of the whole transitive
@@ -250,7 +260,7 @@ template <FixedArrayVisitationMode fixed_array_mode,
 void MarkingVisitor<fixed_array_mode, retaining_path_mode,
                     MarkingState>::VisitCodeTarget(Code* host,
                                                    RelocInfo* rinfo) {
-  DCHECK(RelocInfo::IsCodeTarget(rinfo->rmode()));
+  DCHECK(RelocInfo::IsCodeTargetMode(rinfo->rmode()));
   Code* target = Code::GetCodeFromTargetAddress(rinfo->target_address());
   collector_->RecordRelocSlot(host, rinfo, target);
   MarkObject(host, target);
@@ -380,6 +390,16 @@ void MarkCompactCollector::MarkRootObject(Root root, HeapObject* obj) {
   }
 }
 
+#ifdef ENABLE_MINOR_MC
+
+void MinorMarkCompactCollector::MarkRootObject(HeapObject* obj) {
+  if (Heap::InNewSpace(obj) && non_atomic_marking_state_.WhiteToGrey(obj)) {
+    worklist_->Push(kMainThread, obj);
+  }
+}
+
+#endif
+
 void MarkCompactCollector::MarkExternallyReferencedObject(HeapObject* obj) {
   if (marking_state()->WhiteToGrey(obj)) {
     marking_worklist()->Push(obj);
@@ -390,13 +410,13 @@ void MarkCompactCollector::MarkExternallyReferencedObject(HeapObject* obj) {
 }
 
 void MarkCompactCollector::RecordSlot(HeapObject* object, Object** slot,
-                                      Object* target) {
+                                      HeapObject* target) {
   RecordSlot(object, reinterpret_cast<HeapObjectReference**>(slot), target);
 }
 
 void MarkCompactCollector::RecordSlot(HeapObject* object,
                                       HeapObjectReference** slot,
-                                      Object* target) {
+                                      HeapObject* target) {
   Page* target_page = Page::FromAddress(reinterpret_cast<Address>(target));
   Page* source_page = Page::FromAddress(reinterpret_cast<Address>(object));
   if (target_page->IsEvacuationCandidate<AccessMode::ATOMIC>() &&
@@ -410,9 +430,11 @@ template <LiveObjectIterationMode mode>
 LiveObjectRange<mode>::iterator::iterator(MemoryChunk* chunk, Bitmap* bitmap,
                                           Address start)
     : chunk_(chunk),
-      one_word_filler_map_(chunk->heap()->one_pointer_filler_map()),
-      two_word_filler_map_(chunk->heap()->two_pointer_filler_map()),
-      free_space_map_(chunk->heap()->free_space_map()),
+      one_word_filler_map_(
+          ReadOnlyRoots(chunk->heap()).one_pointer_filler_map()),
+      two_word_filler_map_(
+          ReadOnlyRoots(chunk->heap()).two_pointer_filler_map()),
+      free_space_map_(ReadOnlyRoots(chunk->heap()).free_space_map()),
       it_(chunk, bitmap) {
   it_.Advance(Bitmap::IndexToCell(
       Bitmap::CellAlignIndex(chunk_->AddressToMarkbitIndex(start))));
diff --git a/deps/v8/src/heap/mark-compact.cc b/deps/v8/src/heap/mark-compact.cc
index 7784c3e3f67396..9f8c12fb78316a 100644
--- a/deps/v8/src/heap/mark-compact.cc
+++ b/deps/v8/src/heap/mark-compact.cc
@@ -28,6 +28,7 @@
 #include "src/heap/sweeper.h"
 #include "src/heap/worklist.h"
 #include "src/ic/stub-cache.h"
+#include "src/objects/hash-table-inl.h"
 #include "src/transitions-inl.h"
 #include "src/utils-inl.h"
 #include "src/v8.h"
@@ -102,7 +103,7 @@ void MarkingVerifier::VerifyMarkingOnPage(const Page* page, Address start,
     object = HeapObject::FromAddress(current);
     // One word fillers at the end of a black area can be grey.
     if (IsBlackOrGrey(object) &&
-        object->map() != heap_->one_pointer_filler_map()) {
+        object->map() != ReadOnlyRoots(heap_).one_pointer_filler_map()) {
       CHECK(IsMarked(object));
       CHECK(current >= next_object_must_be_here_or_later);
       object->Iterate(this);
@@ -127,9 +128,10 @@ void MarkingVerifier::VerifyMarking(NewSpace* space) {
   Address end = space->top();
   // The bottom position is at the start of its page. Allows us to use
   // page->area_start() as start of range on all pages.
-  CHECK_EQ(space->bottom(), Page::FromAddress(space->bottom())->area_start());
+  CHECK_EQ(space->first_allocatable_address(),
+           space->first_page()->area_start());
 
-  PageRange range(space->bottom(), end);
+  PageRange range(space->first_allocatable_address(), end);
   for (auto it = range.begin(); it != range.end();) {
     Page* page = *(it++);
     Address limit = it != range.end() ? page->area_end() : end;
@@ -257,7 +259,7 @@ void EvacuationVerifier::VerifyEvacuationOnPage(Address start, Address end) {
 }
 
 void EvacuationVerifier::VerifyEvacuation(NewSpace* space) {
-  PageRange range(space->bottom(), space->top());
+  PageRange range(space->first_allocatable_address(), space->top());
   for (auto it = range.begin(); it != range.end();) {
     Page* page = *(it++);
     Address current = page->area_start();
@@ -270,11 +272,12 @@ void EvacuationVerifier::VerifyEvacuation(NewSpace* space) {
 void EvacuationVerifier::VerifyEvacuation(PagedSpace* space) {
   for (Page* p : *space) {
     if (p->IsEvacuationCandidate()) continue;
-    if (p->Contains(space->top()))
+    if (p->Contains(space->top())) {
+      CodePageMemoryModificationScope memory_modification_scope(p);
       heap_->CreateFillerObjectAt(
           space->top(), static_cast<int>(space->limit() - space->top()),
           ClearRecordedSlots::kNo);
-
+    }
     VerifyEvacuationOnPage(p->area_start(), p->area_end());
   }
 }
@@ -296,8 +299,8 @@ class FullEvacuationVerifier : public EvacuationVerifier {
     for (Object** current = start; current < end; current++) {
       if ((*current)->IsHeapObject()) {
         HeapObject* object = HeapObject::cast(*current);
-        if (heap()->InNewSpace(object)) {
-          CHECK(heap()->InToSpace(object));
+        if (Heap::InNewSpace(object)) {
+          CHECK(Heap::InToSpace(object));
         }
         CHECK(!MarkCompactCollector::IsOnEvacuationCandidate(object));
       }
@@ -307,8 +310,8 @@ class FullEvacuationVerifier : public EvacuationVerifier {
     for (MaybeObject** current = start; current < end; current++) {
       HeapObject* object;
       if ((*current)->ToStrongHeapObject(&object)) {
-        if (heap()->InNewSpace(object)) {
-          CHECK(heap()->InToSpace(object));
+        if (Heap::InNewSpace(object)) {
+          CHECK(Heap::InToSpace(object));
         }
         CHECK(!MarkCompactCollector::IsOnEvacuationCandidate(object));
       }
@@ -330,53 +333,6 @@ using MarkCompactMarkingVisitor =
 
 namespace {
 
-// This root visitor walks all roots and creates items bundling objects that
-// are then processed later on. Slots have to be dereferenced as they could
-// live on the native (C++) stack, which requires filtering out the indirection.
-template <class BatchedItem>
-class RootMarkingVisitorSeedOnly : public RootVisitor {
- public:
-  explicit RootMarkingVisitorSeedOnly(ItemParallelJob* job) : job_(job) {
-    buffered_objects_.reserve(kBufferSize);
-  }
-
-  void VisitRootPointer(Root root, const char* description,
-                        Object** p) override {
-    if (!(*p)->IsHeapObject()) return;
-    AddObject(*p);
-  }
-
-  void VisitRootPointers(Root root, const char* description, Object** start,
-                         Object** end) override {
-    for (Object** p = start; p < end; p++) {
-      if (!(*p)->IsHeapObject()) continue;
-      AddObject(*p);
-    }
-  }
-
-  void FlushObjects() {
-    job_->AddItem(new BatchedItem(std::move(buffered_objects_)));
-    // Moving leaves the container in a valid but unspecified state. Reusing the
-    // container requires a call without precondition that resets the state.
-    buffered_objects_.clear();
-    buffered_objects_.reserve(kBufferSize);
-  }
-
- private:
-  // Bundling several objects together in items avoids issues with allocating
-  // and deallocating items; both are operations that are performed on the main
-  // thread.
-  static const int kBufferSize = 128;
-
-  void AddObject(Object* object) {
-    buffered_objects_.push_back(object);
-    if (buffered_objects_.size() == kBufferSize) FlushObjects();
-  }
-
-  ItemParallelJob* job_;
-  std::vector<Object*> buffered_objects_;
-};
-
 int NumberOfAvailableCores() {
   static int num_cores = V8::GetCurrentPlatform()->NumberOfWorkerThreads() + 1;
   // This number of cores should be greater than zero and never change.
@@ -467,8 +423,7 @@ static void TraceFragmentation(PagedSpace* space) {
   int number_of_pages = space->CountTotalPages();
   intptr_t reserved = (number_of_pages * space->AreaSize());
   intptr_t free = reserved - space->SizeOfObjects();
-  PrintF("[%s]: %d pages, %d (%.1f%%) free\n",
-         AllocationSpaceName(space->identity()), number_of_pages,
+  PrintF("[%s]: %d pages, %d (%.1f%%) free\n", space->name(), number_of_pages,
          static_cast<int>(free), static_cast<double>(free) * 100 / reserved);
 }
 
@@ -533,7 +488,7 @@ void MarkCompactCollector::VerifyMarkbitsAreClean(PagedSpace* space) {
 
 
 void MarkCompactCollector::VerifyMarkbitsAreClean(NewSpace* space) {
-  for (Page* p : PageRange(space->bottom(), space->top())) {
+  for (Page* p : PageRange(space->first_allocatable_address(), space->top())) {
     CHECK(non_atomic_marking_state()->bitmap(p)->IsClean());
     CHECK_EQ(0, non_atomic_marking_state()->live_bytes(p));
   }
@@ -756,9 +711,9 @@ void MarkCompactCollector::CollectEvacuationCandidates(PagedSpace* space) {
                      "fragmentation_limit_kb=%" PRIuS
                      " fragmentation_limit_percent=%d sum_compaction_kb=%zu "
                      "compaction_limit_kb=%zu\n",
-                     AllocationSpaceName(space->identity()), free_bytes / KB,
-                     free_bytes_threshold / KB, target_fragmentation_percent,
-                     total_live_bytes / KB, max_evacuated_bytes / KB);
+                     space->name(), free_bytes / KB, free_bytes_threshold / KB,
+                     target_fragmentation_percent, total_live_bytes / KB,
+                     max_evacuated_bytes / KB);
       }
     }
     // How many pages we will allocated for the evacuated objects
@@ -780,8 +735,8 @@ void MarkCompactCollector::CollectEvacuationCandidates(PagedSpace* space) {
     PrintIsolate(isolate(),
                  "compaction-selection: space=%s reduce_memory=%d pages=%d "
                  "total_live_bytes=%zu\n",
-                 AllocationSpaceName(space->identity()), reduce_memory,
-                 candidate_count, total_live_bytes / KB);
+                 space->name(), reduce_memory, candidate_count,
+                 total_live_bytes / KB);
   }
 }
 
@@ -816,9 +771,7 @@ void MarkCompactCollector::Prepare() {
     heap()->incremental_marking()->Stop();
   }
 
-  // If concurrent unmapping tasks are still running, we should wait for
-  // them here.
-  heap()->memory_allocator()->unmapper()->WaitUntilCompleted();
+  heap()->memory_allocator()->unmapper()->PrepareForMarkCompact();
 
   // Clear marking bits if incremental marking is aborted.
   if (was_marked_incrementally_ && heap_->ShouldAbortIncrementalMarking()) {
@@ -827,7 +780,6 @@ void MarkCompactCollector::Prepare() {
     FinishConcurrentMarking(ConcurrentMarking::StopRequest::PREEMPT_TASKS);
     heap()->incremental_marking()->Deactivate();
     ClearMarkbits();
-    AbortWeakCollections();
     AbortWeakObjects();
     AbortCompaction();
     heap_->local_embedder_heap_tracer()->AbortTracing();
@@ -878,9 +830,11 @@ void MarkCompactCollector::VerifyMarking() {
   }
 #endif
 #ifdef VERIFY_HEAP
-  heap()->old_space()->VerifyLiveBytes();
-  heap()->map_space()->VerifyLiveBytes();
-  heap()->code_space()->VerifyLiveBytes();
+  if (FLAG_verify_heap) {
+    heap()->old_space()->VerifyLiveBytes();
+    heap()->map_space()->VerifyLiveBytes();
+    heap()->code_space()->VerifyLiveBytes();
+  }
 #endif
 }
 
@@ -891,6 +845,10 @@ void MarkCompactCollector::Finish() {
   heap()->VerifyCountersBeforeConcurrentSweeping();
 #endif
 
+  CHECK(weak_objects_.current_ephemerons.IsEmpty());
+  CHECK(weak_objects_.discovered_ephemerons.IsEmpty());
+  weak_objects_.next_ephemerons.Clear();
+
   sweeper()->StartSweeperTasks();
   sweeper()->StartIterabilityTasks();
 
@@ -991,7 +949,7 @@ class InternalizedStringTableCleaner : public ObjectVisitor {
 
   void VisitPointers(HeapObject* host, Object** start, Object** end) override {
     // Visit all HeapObject pointers in [start, end).
-    Object* the_hole = heap_->the_hole_value();
+    Object* the_hole = ReadOnlyRoots(heap_).the_hole_value();
     MarkCompactCollector::NonAtomicMarkingState* marking_state =
         heap_->mark_compact_collector()->non_atomic_marking_state();
     for (Object** p = start; p < end; p++) {
@@ -1004,8 +962,8 @@ class InternalizedStringTableCleaner : public ObjectVisitor {
           *p = the_hole;
         } else {
           // StringTable contains only old space strings.
-          DCHECK(!heap_->InNewSpace(o));
-          MarkCompactCollector::RecordSlot(table_, p, o);
+          DCHECK(!Heap::InNewSpace(o));
+          MarkCompactCollector::RecordSlot(table_, p, heap_object);
         }
       }
     }
@@ -1035,7 +993,7 @@ class ExternalStringTableCleaner : public RootVisitor {
     // Visit all HeapObject pointers in [start, end).
     MarkCompactCollector::NonAtomicMarkingState* marking_state =
         heap_->mark_compact_collector()->non_atomic_marking_state();
-    Object* the_hole = heap_->the_hole_value();
+    Object* the_hole = ReadOnlyRoots(heap_).the_hole_value();
     for (Object** p = start; p < end; p++) {
       Object* o = *p;
       if (o->IsHeapObject()) {
@@ -1075,9 +1033,17 @@ class MarkCompactWeakObjectRetainer : public WeakObjectRetainer {
                !(AllocationSite::cast(object)->IsZombie())) {
       // "dead" AllocationSites need to live long enough for a traversal of new
       // space. These sites get a one-time reprieve.
-      AllocationSite* site = AllocationSite::cast(object);
-      site->MarkZombie();
-      marking_state_->WhiteToBlack(site);
+
+      Object* nested = object;
+      while (nested->IsAllocationSite()) {
+        AllocationSite* current_site = AllocationSite::cast(nested);
+        // MarkZombie will override the nested_site, read it first before
+        // marking
+        nested = current_site->nested_site();
+        current_site->MarkZombie();
+        marking_state_->WhiteToBlack(current_site);
+      }
+
       return object;
     } else {
       return nullptr;
@@ -1121,11 +1087,11 @@ class RecordMigratedSlotVisitor : public ObjectVisitor {
 
   inline void VisitCodeTarget(Code* host, RelocInfo* rinfo) override {
     DCHECK_EQ(host, rinfo->host());
-    DCHECK(RelocInfo::IsCodeTarget(rinfo->rmode()));
+    DCHECK(RelocInfo::IsCodeTargetMode(rinfo->rmode()));
     Code* target = Code::GetCodeFromTargetAddress(rinfo->target_address());
     // The target is always in old space, we don't have to record the slot in
     // the old-to-new remembered set.
-    DCHECK(!collector_->heap()->InNewSpace(target));
+    DCHECK(!Heap::InNewSpace(target));
     collector_->RecordRelocSlot(host, rinfo, target);
   }
 
@@ -1239,7 +1205,7 @@ class EvacuateVisitorBase : public HeapObjectVisitor {
         base->ExecuteMigrationObservers(dest, src, dst, size);
     }
     base::Relaxed_Store(reinterpret_cast<base::AtomicWord*>(src_addr),
-                        reinterpret_cast<base::AtomicWord>(dst_addr));
+                        static_cast<base::AtomicWord>(dst_addr));
   }
 
   EvacuateVisitorBase(Heap* heap, LocalAllocator* local_allocator,
@@ -1284,8 +1250,7 @@ class EvacuateVisitorBase : public HeapObjectVisitor {
     if (FLAG_stress_compaction) {
       const uintptr_t mask = static_cast<uintptr_t>(FLAG_random_seed) &
                              Page::kPageAlignmentMask & ~kPointerAlignmentMask;
-      if ((reinterpret_cast<uintptr_t>(object->address()) &
-           Page::kPageAlignmentMask) == mask) {
+      if ((object->address() & Page::kPageAlignmentMask) == mask) {
         Page* page = Page::FromAddress(object->address());
         if (page->IsFlagSet(Page::COMPACTION_WAS_ABORTED_FOR_TESTING)) {
           page->ClearFlag(Page::COMPACTION_WAS_ABORTED_FOR_TESTING);
@@ -1413,7 +1378,7 @@ class EvacuateNewSpacePageVisitor final : public HeapObjectVisitor {
         page->SetFlag(Page::PAGE_NEW_NEW_PROMOTION);
         break;
       case NEW_TO_OLD: {
-        page->Unlink();
+        page->heap()->new_space()->from_space().RemovePage(page);
         Page* new_page = Page::ConvertNewToOld(page);
         DCHECK(!new_page->InNewSpace());
         new_page->SetFlag(Page::PAGE_NEW_OLD_PROMOTION);
@@ -1474,14 +1439,12 @@ class EvacuateRecordOnlyVisitor final : public HeapObjectVisitor {
   Heap* heap_;
 };
 
-bool MarkCompactCollector::IsUnmarkedHeapObject(Object** p) {
+bool MarkCompactCollector::IsUnmarkedHeapObject(Heap* heap, Object** p) {
   Object* o = *p;
   if (!o->IsHeapObject()) return false;
   HeapObject* heap_object = HeapObject::cast(o);
-  return heap_object->GetHeap()
-      ->mark_compact_collector()
-      ->non_atomic_marking_state()
-      ->IsWhite(HeapObject::cast(o));
+  return heap->mark_compact_collector()->non_atomic_marking_state()->IsWhite(
+      heap_object);
 }
 
 void MarkCompactCollector::MarkStringTable(
@@ -1505,7 +1468,185 @@ void MarkCompactCollector::MarkRoots(RootVisitor* root_visitor,
   ProcessTopOptimizedFrame(custom_root_body_visitor);
 }
 
+void MarkCompactCollector::ProcessEphemeronsUntilFixpoint() {
+  bool work_to_do = true;
+  int iterations = 0;
+  int max_iterations = FLAG_ephemeron_fixpoint_iterations;
+
+  while (work_to_do) {
+    PerformWrapperTracing();
+
+    if (iterations >= max_iterations) {
+      // Give up fixpoint iteration and switch to linear algorithm.
+      ProcessEphemeronsLinear();
+      break;
+    }
+
+    // Move ephemerons from next_ephemerons into current_ephemerons to
+    // drain them in this iteration.
+    weak_objects_.current_ephemerons.Swap(weak_objects_.next_ephemerons);
+    heap()->concurrent_marking()->set_ephemeron_marked(false);
+
+    {
+      TRACE_GC(heap()->tracer(),
+               GCTracer::Scope::MC_MARK_WEAK_CLOSURE_EPHEMERON_MARKING);
+
+      if (FLAG_parallel_marking) {
+        DCHECK(FLAG_concurrent_marking);
+        heap_->concurrent_marking()->RescheduleTasksIfNeeded();
+      }
+
+      work_to_do = ProcessEphemerons();
+      FinishConcurrentMarking(
+          ConcurrentMarking::StopRequest::COMPLETE_ONGOING_TASKS);
+    }
+
+    CHECK(weak_objects_.current_ephemerons.IsEmpty());
+    CHECK(weak_objects_.discovered_ephemerons.IsEmpty());
+
+    work_to_do = work_to_do || !marking_worklist()->IsEmpty() ||
+                 heap()->concurrent_marking()->ephemeron_marked() ||
+                 !heap()->local_embedder_heap_tracer()->IsRemoteTracingDone();
+    ++iterations;
+  }
+
+  CHECK(marking_worklist()->IsEmpty());
+  CHECK(weak_objects_.current_ephemerons.IsEmpty());
+  CHECK(weak_objects_.discovered_ephemerons.IsEmpty());
+}
+
+bool MarkCompactCollector::ProcessEphemerons() {
+  Ephemeron ephemeron;
+  bool ephemeron_marked = false;
+
+  // Drain current_ephemerons and push ephemerons where key and value are still
+  // unreachable into next_ephemerons.
+  while (weak_objects_.current_ephemerons.Pop(kMainThread, &ephemeron)) {
+    if (VisitEphemeron(ephemeron.key, ephemeron.value)) {
+      ephemeron_marked = true;
+    }
+  }
+
+  // Drain marking worklist and push discovered ephemerons into
+  // discovered_ephemerons.
+  ProcessMarkingWorklist();
+
+  // Drain discovered_ephemerons (filled in the drain MarkingWorklist-phase
+  // before) and push ephemerons where key and value are still unreachable into
+  // next_ephemerons.
+  while (weak_objects_.discovered_ephemerons.Pop(kMainThread, &ephemeron)) {
+    if (VisitEphemeron(ephemeron.key, ephemeron.value)) {
+      ephemeron_marked = true;
+    }
+  }
+
+  // Flush local ephemerons for main task to global pool.
+  weak_objects_.ephemeron_hash_tables.FlushToGlobal(kMainThread);
+  weak_objects_.next_ephemerons.FlushToGlobal(kMainThread);
+
+  return ephemeron_marked;
+}
+
+void MarkCompactCollector::ProcessEphemeronsLinear() {
+  TRACE_GC(heap()->tracer(),
+           GCTracer::Scope::MC_MARK_WEAK_CLOSURE_EPHEMERON_LINEAR);
+  CHECK(heap()->concurrent_marking()->IsStopped());
+  std::unordered_multimap<HeapObject*, HeapObject*> key_to_values;
+  Ephemeron ephemeron;
+
+  DCHECK(weak_objects_.current_ephemerons.IsEmpty());
+  weak_objects_.current_ephemerons.Swap(weak_objects_.next_ephemerons);
+
+  while (weak_objects_.current_ephemerons.Pop(kMainThread, &ephemeron)) {
+    VisitEphemeron(ephemeron.key, ephemeron.value);
+
+    if (non_atomic_marking_state()->IsWhite(ephemeron.value)) {
+      key_to_values.insert(std::make_pair(ephemeron.key, ephemeron.value));
+    }
+  }
+
+  ephemeron_marking_.newly_discovered_limit = key_to_values.size();
+  bool work_to_do = true;
+
+  while (work_to_do) {
+    PerformWrapperTracing();
+
+    ResetNewlyDiscovered();
+    ephemeron_marking_.newly_discovered_limit = key_to_values.size();
+
+    {
+      TRACE_GC(heap()->tracer(),
+               GCTracer::Scope::MC_MARK_WEAK_CLOSURE_EPHEMERON_MARKING);
+      // Drain marking worklist and push all discovered objects into
+      // newly_discovered.
+      ProcessMarkingWorklistInternal<
+          MarkCompactCollector::MarkingWorklistProcessingMode::
+              kTrackNewlyDiscoveredObjects>();
+    }
+
+    while (weak_objects_.discovered_ephemerons.Pop(kMainThread, &ephemeron)) {
+      VisitEphemeron(ephemeron.key, ephemeron.value);
+
+      if (non_atomic_marking_state()->IsWhite(ephemeron.value)) {
+        key_to_values.insert(std::make_pair(ephemeron.key, ephemeron.value));
+      }
+    }
+
+    if (ephemeron_marking_.newly_discovered_overflowed) {
+      // If newly_discovered was overflowed just visit all ephemerons in
+      // next_ephemerons.
+      weak_objects_.next_ephemerons.Iterate([&](Ephemeron ephemeron) {
+        if (non_atomic_marking_state()->IsBlackOrGrey(ephemeron.key) &&
+            non_atomic_marking_state()->WhiteToGrey(ephemeron.value)) {
+          marking_worklist()->Push(ephemeron.value);
+        }
+      });
+
+    } else {
+      // This is the good case: newly_discovered stores all discovered
+      // objects. Now use key_to_values to see if discovered objects keep more
+      // objects alive due to ephemeron semantics.
+      for (HeapObject* object : ephemeron_marking_.newly_discovered) {
+        auto range = key_to_values.equal_range(object);
+        for (auto it = range.first; it != range.second; ++it) {
+          HeapObject* value = it->second;
+          MarkObject(object, value);
+        }
+      }
+    }
+
+    // Do NOT drain marking worklist here, otherwise the current checks
+    // for work_to_do are not sufficient for determining if another iteration
+    // is necessary.
+
+    work_to_do = !marking_worklist()->IsEmpty() ||
+                 !heap()->local_embedder_heap_tracer()->IsRemoteTracingDone();
+    CHECK(weak_objects_.discovered_ephemerons.IsEmpty());
+  }
+
+  ResetNewlyDiscovered();
+  ephemeron_marking_.newly_discovered.shrink_to_fit();
+
+  CHECK(marking_worklist()->IsEmpty());
+}
+
+void MarkCompactCollector::PerformWrapperTracing() {
+  if (heap_->local_embedder_heap_tracer()->InUse()) {
+    TRACE_GC(heap()->tracer(), GCTracer::Scope::MC_MARK_WRAPPER_TRACING);
+    heap_->local_embedder_heap_tracer()->RegisterWrappersWithRemoteTracer();
+    heap_->local_embedder_heap_tracer()->Trace(
+        0, EmbedderHeapTracer::AdvanceTracingActions(
+               EmbedderHeapTracer::ForceCompletionAction::FORCE_COMPLETION));
+  }
+}
+
 void MarkCompactCollector::ProcessMarkingWorklist() {
+  ProcessMarkingWorklistInternal<
+      MarkCompactCollector::MarkingWorklistProcessingMode::kDefault>();
+}
+
+template <MarkCompactCollector::MarkingWorklistProcessingMode mode>
+void MarkCompactCollector::ProcessMarkingWorklistInternal() {
   HeapObject* object;
   MarkCompactMarkingVisitor visitor(this, marking_state());
   while ((object = marking_worklist()->Pop()) != nullptr) {
@@ -1514,6 +1655,10 @@ void MarkCompactCollector::ProcessMarkingWorklist() {
     DCHECK(heap()->Contains(object));
     DCHECK(!(marking_state()->IsWhite(object)));
     marking_state()->GreyToBlack(object);
+    if (mode == MarkCompactCollector::MarkingWorklistProcessingMode::
+                    kTrackNewlyDiscoveredObjects) {
+      AddNewlyDiscovered(object);
+    }
     Map* map = object->map();
     MarkObject(object, map);
     visitor.Visit(map, object);
@@ -1521,23 +1666,31 @@ void MarkCompactCollector::ProcessMarkingWorklist() {
   DCHECK(marking_worklist()->IsBailoutEmpty());
 }
 
-void MarkCompactCollector::ProcessEphemeralMarking() {
-  DCHECK(marking_worklist()->IsEmpty());
-  bool work_to_do = true;
-  while (work_to_do) {
-    if (heap_->local_embedder_heap_tracer()->InUse()) {
-      TRACE_GC(heap()->tracer(), GCTracer::Scope::MC_MARK_WRAPPER_TRACING);
-      heap_->local_embedder_heap_tracer()->RegisterWrappersWithRemoteTracer();
-      heap_->local_embedder_heap_tracer()->Trace(
-          0, EmbedderHeapTracer::AdvanceTracingActions(
-                 EmbedderHeapTracer::ForceCompletionAction::FORCE_COMPLETION));
-    }
-    ProcessWeakCollections();
-    work_to_do = !marking_worklist()->IsEmpty();
-    ProcessMarkingWorklist();
+bool MarkCompactCollector::VisitEphemeron(HeapObject* key, HeapObject* value) {
+  if (marking_state()->IsBlackOrGrey(key)) {
+    if (marking_state()->WhiteToGrey(value)) {
+      marking_worklist()->Push(value);
+      return true;
+    }
+
+  } else if (marking_state()->IsWhite(value)) {
+    weak_objects_.next_ephemerons.Push(kMainThread, Ephemeron{key, value});
   }
+
+  return false;
+}
+
+void MarkCompactCollector::ProcessEphemeronMarking() {
+  DCHECK(marking_worklist()->IsEmpty());
+
+  // Incremental marking might leave ephemerons in main task's local
+  // buffer, flush it into global pool.
+  weak_objects_.next_ephemerons.FlushToGlobal(kMainThread);
+
+  ProcessEphemeronsUntilFixpoint();
+
   CHECK(marking_worklist()->IsEmpty());
-  CHECK_EQ(0, heap()->local_embedder_heap_tracer()->NumberOfWrappersToTrace());
+  CHECK(heap()->local_embedder_heap_tracer()->IsRemoteTracingDone());
 }
 
 void MarkCompactCollector::ProcessTopOptimizedFrame(ObjectVisitor* visitor) {
@@ -1636,8 +1789,8 @@ void MarkCompactCollector::MarkLiveObjects() {
     // harmony weak maps.
     {
       TRACE_GC(heap()->tracer(),
-               GCTracer::Scope::MC_MARK_WEAK_CLOSURE_EPHEMERAL);
-      ProcessEphemeralMarking();
+               GCTracer::Scope::MC_MARK_WEAK_CLOSURE_EPHEMERON);
+      ProcessEphemeronMarking();
       DCHECK(marking_worklist()->IsEmpty());
     }
 
@@ -1666,10 +1819,10 @@ void MarkCompactCollector::MarkLiveObjects() {
       ProcessMarkingWorklist();
     }
 
-    // Repeat ephemeral processing from the newly marked objects.
+    // Repeat ephemeron processing from the newly marked objects.
     {
       TRACE_GC(heap()->tracer(), GCTracer::Scope::MC_MARK_WEAK_CLOSURE_HARMONY);
-      ProcessEphemeralMarking();
+      ProcessEphemeronMarking();
       {
         TRACE_GC(heap()->tracer(), GCTracer::Scope::MC_MARK_WRAPPER_EPILOGUE);
         heap()->local_embedder_heap_tracer()->TraceEpilogue();
@@ -1717,7 +1870,8 @@ void MarkCompactCollector::ClearNonLiveReferences() {
 
   {
     TRACE_GC(heap()->tracer(), GCTracer::Scope::MC_CLEAR_MAPS);
-    // ClearFullMapTransitions must be called before WeakCells are cleared.
+    // ClearFullMapTransitions must be called before weak references are
+    // cleared.
     ClearFullMapTransitions();
   }
   ClearWeakCells();
@@ -1726,10 +1880,10 @@ void MarkCompactCollector::ClearNonLiveReferences() {
 
   ClearWeakCollections();
 
-  DCHECK(weak_objects_.weak_cells.IsGlobalEmpty());
-  DCHECK(weak_objects_.transition_arrays.IsGlobalEmpty());
-  DCHECK(weak_objects_.weak_references.IsGlobalEmpty());
-  DCHECK(weak_objects_.weak_objects_in_code.IsGlobalEmpty());
+  DCHECK(weak_objects_.weak_cells.IsEmpty());
+  DCHECK(weak_objects_.transition_arrays.IsEmpty());
+  DCHECK(weak_objects_.weak_references.IsEmpty());
+  DCHECK(weak_objects_.weak_objects_in_code.IsEmpty());
 }
 
 void MarkCompactCollector::MarkDependentCodeForDeoptimization() {
@@ -1741,7 +1895,7 @@ void MarkCompactCollector::MarkDependentCodeForDeoptimization() {
     if (!non_atomic_marking_state()->IsBlackOrGrey(object) &&
         !code->marked_for_deoptimization()) {
       code->SetMarkedForDeoptimization("weak objects");
-      code->InvalidateEmbeddedObjects();
+      code->InvalidateEmbeddedObjects(heap_);
       have_code_to_deoptimize_ = true;
     }
   }
@@ -1754,7 +1908,7 @@ void MarkCompactCollector::ClearPotentialSimpleMapTransition(Map* dead_target) {
     Map* parent = Map::cast(potential_parent);
     DisallowHeapAllocation no_gc_obviously;
     if (non_atomic_marking_state()->IsBlackOrGrey(parent) &&
-        TransitionsAccessor(parent, &no_gc_obviously)
+        TransitionsAccessor(isolate(), parent, &no_gc_obviously)
             .HasSimpleTransitionTo(dead_target)) {
       ClearPotentialSimpleMapTransition(parent, dead_target);
     }
@@ -1821,12 +1975,14 @@ bool MarkCompactCollector::CompactTransitionArray(
       if (i != transition_index) {
         Name* key = transitions->GetKey(i);
         transitions->SetKey(transition_index, key);
-        Object** key_slot = transitions->GetKeySlot(transition_index);
+        HeapObjectReference** key_slot =
+            transitions->GetKeySlot(transition_index);
         RecordSlot(transitions, key_slot, key);
-        Object* raw_target = transitions->GetRawTarget(i);
-        transitions->SetTarget(transition_index, raw_target);
-        Object** target_slot = transitions->GetTargetSlot(transition_index);
-        RecordSlot(transitions, target_slot, raw_target);
+        MaybeObject* raw_target = transitions->GetRawTarget(i);
+        transitions->SetRawTarget(transition_index, raw_target);
+        HeapObjectReference** target_slot =
+            transitions->GetTargetSlot(transition_index);
+        RecordSlot(transitions, target_slot, raw_target->GetHeapObject());
       }
       transition_index++;
     }
@@ -1842,7 +1998,8 @@ bool MarkCompactCollector::CompactTransitionArray(
   // array disappeared during GC.
   int trim = transitions->Capacity() - transition_index;
   if (trim > 0) {
-    heap_->RightTrimFixedArray(transitions, trim * TransitionArray::kEntrySize);
+    heap_->RightTrimWeakFixedArray(transitions,
+                                   trim * TransitionArray::kEntrySize);
     transitions->SetNumberOfTransitions(transition_index);
   }
   return descriptors_owner_died;
@@ -1852,15 +2009,15 @@ void MarkCompactCollector::TrimDescriptorArray(Map* map,
                                                DescriptorArray* descriptors) {
   int number_of_own_descriptors = map->NumberOfOwnDescriptors();
   if (number_of_own_descriptors == 0) {
-    DCHECK(descriptors == heap_->empty_descriptor_array());
+    DCHECK(descriptors == ReadOnlyRoots(heap_).empty_descriptor_array());
     return;
   }
 
   int number_of_descriptors = descriptors->number_of_descriptors_storage();
   int to_trim = number_of_descriptors - number_of_own_descriptors;
   if (to_trim > 0) {
-    heap_->RightTrimFixedArray(descriptors,
-                               to_trim * DescriptorArray::kEntrySize);
+    heap_->RightTrimWeakFixedArray(descriptors,
+                                   to_trim * DescriptorArray::kEntrySize);
     descriptors->SetNumberOfDescriptors(number_of_own_descriptors);
 
     TrimEnumCache(map, descriptors);
@@ -1897,67 +2054,27 @@ void MarkCompactCollector::TrimEnumCache(Map* map,
   heap_->RightTrimFixedArray(indices, to_trim);
 }
 
-void MarkCompactCollector::ProcessWeakCollections() {
-  MarkCompactMarkingVisitor visitor(this, marking_state());
-  Object* weak_collection_obj = heap()->encountered_weak_collections();
-  while (weak_collection_obj != Smi::kZero) {
-    JSWeakCollection* weak_collection =
-        reinterpret_cast<JSWeakCollection*>(weak_collection_obj);
-    DCHECK(non_atomic_marking_state()->IsBlackOrGrey(weak_collection));
-    if (weak_collection->table()->IsHashTable()) {
-      ObjectHashTable* table = ObjectHashTable::cast(weak_collection->table());
-      for (int i = 0; i < table->Capacity(); i++) {
-        HeapObject* heap_object = HeapObject::cast(table->KeyAt(i));
-        if (non_atomic_marking_state()->IsBlackOrGrey(heap_object)) {
-          Object** key_slot =
-              table->RawFieldOfElementAt(ObjectHashTable::EntryToIndex(i));
-          RecordSlot(table, key_slot, *key_slot);
-          Object** value_slot =
-              table->RawFieldOfElementAt(ObjectHashTable::EntryToValueIndex(i));
-          if (V8_UNLIKELY(FLAG_track_retaining_path) &&
-              (*value_slot)->IsHeapObject()) {
-            heap()->AddEphemeralRetainer(heap_object,
-                                         HeapObject::cast(*value_slot));
-          }
-          visitor.VisitPointer(table, value_slot);
-        }
-      }
-    }
-    weak_collection_obj = weak_collection->next();
-  }
-}
-
 void MarkCompactCollector::ClearWeakCollections() {
   TRACE_GC(heap()->tracer(), GCTracer::Scope::MC_CLEAR_WEAK_COLLECTIONS);
-  Object* weak_collection_obj = heap()->encountered_weak_collections();
-  while (weak_collection_obj != Smi::kZero) {
-    JSWeakCollection* weak_collection =
-        reinterpret_cast<JSWeakCollection*>(weak_collection_obj);
-    DCHECK(non_atomic_marking_state()->IsBlackOrGrey(weak_collection));
-    if (weak_collection->table()->IsHashTable()) {
-      ObjectHashTable* table = ObjectHashTable::cast(weak_collection->table());
-      for (int i = 0; i < table->Capacity(); i++) {
-        HeapObject* key = HeapObject::cast(table->KeyAt(i));
-        if (!non_atomic_marking_state()->IsBlackOrGrey(key)) {
-          table->RemoveEntry(i);
-        }
+  EphemeronHashTable* table;
+
+  while (weak_objects_.ephemeron_hash_tables.Pop(kMainThread, &table)) {
+    for (int i = 0; i < table->Capacity(); i++) {
+      HeapObject* key = HeapObject::cast(table->KeyAt(i));
+#ifdef VERIFY_HEAP
+      Object* value = table->ValueAt(i);
+
+      if (value->IsHeapObject()) {
+        CHECK_IMPLIES(
+            non_atomic_marking_state()->IsBlackOrGrey(key),
+            non_atomic_marking_state()->IsBlackOrGrey(HeapObject::cast(value)));
+      }
+#endif
+      if (!non_atomic_marking_state()->IsBlackOrGrey(key)) {
+        table->RemoveEntry(i);
       }
     }
-    weak_collection_obj = weak_collection->next();
-    weak_collection->set_next(heap()->undefined_value());
   }
-  heap()->set_encountered_weak_collections(Smi::kZero);
-}
-
-void MarkCompactCollector::AbortWeakCollections() {
-  Object* weak_collection_obj = heap()->encountered_weak_collections();
-  while (weak_collection_obj != Smi::kZero) {
-    JSWeakCollection* weak_collection =
-        reinterpret_cast<JSWeakCollection*>(weak_collection_obj);
-    weak_collection_obj = weak_collection->next();
-    weak_collection->set_next(heap()->undefined_value());
-  }
-  heap()->set_encountered_weak_collections(Smi::kZero);
 }
 
 void MarkCompactCollector::ClearWeakCells() {
@@ -1982,9 +2099,9 @@ void MarkCompactCollector::ClearWeakCells() {
           // Resurrect the cell.
           non_atomic_marking_state()->WhiteToBlack(value);
           Object** slot = HeapObject::RawField(value, Cell::kValueOffset);
-          RecordSlot(value, slot, *slot);
+          RecordSlot(value, slot, HeapObject::cast(*slot));
           slot = HeapObject::RawField(weak_cell, WeakCell::kValueOffset);
-          RecordSlot(weak_cell, slot, *slot);
+          RecordSlot(weak_cell, slot, HeapObject::cast(*slot));
         } else {
           weak_cell->clear();
         }
@@ -1995,7 +2112,7 @@ void MarkCompactCollector::ClearWeakCells() {
     } else {
       // The value of the weak cell is alive.
       Object** slot = HeapObject::RawField(weak_cell, WeakCell::kValueOffset);
-      RecordSlot(weak_cell, slot, *slot);
+      RecordSlot(weak_cell, slot, HeapObject::cast(*slot));
     }
   }
 }
@@ -2025,6 +2142,10 @@ void MarkCompactCollector::ClearWeakReferences() {
 void MarkCompactCollector::AbortWeakObjects() {
   weak_objects_.weak_cells.Clear();
   weak_objects_.transition_arrays.Clear();
+  weak_objects_.ephemeron_hash_tables.Clear();
+  weak_objects_.current_ephemerons.Clear();
+  weak_objects_.next_ephemerons.Clear();
+  weak_objects_.discovered_ephemerons.Clear();
   weak_objects_.weak_references.Clear();
   weak_objects_.weak_objects_in_code.Clear();
 }
@@ -2041,7 +2162,7 @@ void MarkCompactCollector::RecordRelocSlot(Code* host, RelocInfo* rinfo,
     SlotType slot_type = SlotTypeForRelocInfoMode(rmode);
     if (rinfo->IsInConstantPool()) {
       addr = rinfo->constant_pool_entry_address();
-      if (RelocInfo::IsCodeTarget(rmode)) {
+      if (RelocInfo::IsCodeTargetMode(rmode)) {
         slot_type = CODE_ENTRY_SLOT;
       } else {
         DCHECK(RelocInfo::IsEmbeddedObject(rmode));
@@ -2059,7 +2180,7 @@ static inline SlotCallbackResult UpdateSlot(
     HeapObjectReferenceType reference_type) {
   MapWord map_word = heap_obj->map_word();
   if (map_word.IsForwardingAddress()) {
-    DCHECK(heap_obj->GetHeap()->InFromSpace(heap_obj) ||
+    DCHECK(Heap::InFromSpace(heap_obj) ||
            MarkCompactCollector::IsOnEvacuationCandidate(heap_obj) ||
            Page::FromAddress(heap_obj->address())
                ->IsFlagSet(Page::COMPACTION_WAS_ABORTED));
@@ -2072,7 +2193,7 @@ static inline SlotCallbackResult UpdateSlot(
     } else {
       base::AsAtomicPointer::Release_CompareAndSwap(slot, old, target);
     }
-    DCHECK(!heap_obj->GetHeap()->InFromSpace(target));
+    DCHECK(!Heap::InFromSpace(target));
     DCHECK(!MarkCompactCollector::IsOnEvacuationCandidate(target));
   }
   // OLD_TO_OLD slots are always removed after updating.
@@ -2111,6 +2232,8 @@ static inline SlotCallbackResult UpdateStrongSlot(MaybeObject** maybe_slot) {
 // nevers visits code objects.
 class PointersUpdatingVisitor : public ObjectVisitor, public RootVisitor {
  public:
+  explicit PointersUpdatingVisitor(Heap* heap) : heap_(heap) {}
+
   void VisitPointer(HeapObject* host, Object** p) override {
     UpdateStrongSlotInternal(p);
   }
@@ -2144,7 +2267,7 @@ class PointersUpdatingVisitor : public ObjectVisitor, public RootVisitor {
 
   void VisitEmbeddedPointer(Code* host, RelocInfo* rinfo) override {
     UpdateTypedSlotHelper::UpdateEmbeddedPointer(
-        rinfo, UpdateStrongMaybeObjectSlotInternal);
+        heap_, rinfo, UpdateStrongMaybeObjectSlotInternal);
   }
 
   void VisitCodeTarget(Code* host, RelocInfo* rinfo) override {
@@ -2169,6 +2292,8 @@ class PointersUpdatingVisitor : public ObjectVisitor, public RootVisitor {
   static inline SlotCallbackResult UpdateSlotInternal(MaybeObject** slot) {
     return UpdateSlot<AccessMode::NON_ATOMIC>(slot);
   }
+
+  Heap* heap_;
 };
 
 static String* UpdateReferenceInExternalStringTableEntry(Heap* heap,
@@ -2186,7 +2311,8 @@ void MarkCompactCollector::EvacuatePrologue() {
   // New space.
   NewSpace* new_space = heap()->new_space();
   // Append the list of new space pages to be processed.
-  for (Page* p : PageRange(new_space->bottom(), new_space->top())) {
+  for (Page* p :
+       PageRange(new_space->first_allocatable_address(), new_space->top())) {
     new_space_evacuation_pages_.push_back(p);
   }
   new_space->Flip();
@@ -2765,7 +2891,7 @@ class ToSpaceUpdatingItem : public UpdatingItem {
   void ProcessVisitAll() {
     TRACE_EVENT0(TRACE_DISABLED_BY_DEFAULT("v8.gc"),
                  "ToSpaceUpdatingItem::ProcessVisitAll");
-    PointersUpdatingVisitor visitor;
+    PointersUpdatingVisitor visitor(chunk_->heap());
     for (Address cur = start_; cur < end_;) {
       HeapObject* object = HeapObject::FromAddress(cur);
       Map* map = object->map();
@@ -2780,7 +2906,7 @@ class ToSpaceUpdatingItem : public UpdatingItem {
                  "ToSpaceUpdatingItem::ProcessVisitLive");
     // For young generation evacuations we want to visit grey objects, for
     // full MC, we need to visit black objects.
-    PointersUpdatingVisitor visitor;
+    PointersUpdatingVisitor visitor(chunk_->heap());
     for (auto object_and_size : LiveObjectRange<kAllLiveObjects>(
              chunk_, marking_state_->bitmap(chunk_))) {
       object_and_size.first->IterateBodyFast(&visitor);
@@ -2809,6 +2935,7 @@ class RememberedSetUpdatingItem : public UpdatingItem {
     TRACE_EVENT0(TRACE_DISABLED_BY_DEFAULT("v8.gc"),
                  "RememberedSetUpdatingItem::Process");
     base::LockGuard<base::Mutex> guard(chunk_->mutex());
+    CodePageMemoryModificationScope memory_modification_scope(chunk_);
     UpdateUntypedPointers();
     UpdateTypedPointers();
   }
@@ -2820,7 +2947,7 @@ class RememberedSetUpdatingItem : public UpdatingItem {
     if (!(*slot)->ToStrongOrWeakHeapObject(&heap_object)) {
       return REMOVE_SLOT;
     }
-    if (heap_->InFromSpace(heap_object)) {
+    if (Heap::InFromSpace(heap_object)) {
       MapWord map_word = heap_object->map_word();
       if (map_word.IsForwardingAddress()) {
         HeapObjectReference::Update(
@@ -2834,10 +2961,10 @@ class RememberedSetUpdatingItem : public UpdatingItem {
       // callback in to space, the object is still live.
       // Unfortunately, we do not know about the slot. It could be in a
       // just freed free space object.
-      if (heap_->InToSpace(heap_object)) {
+      if (Heap::InToSpace(heap_object)) {
         return KEEP_SLOT;
       }
-    } else if (heap_->InToSpace(heap_object)) {
+    } else if (Heap::InToSpace(heap_object)) {
       // Slots can point to "to" space if the page has been moved, or if the
       // slot has been recorded multiple times in the remembered set, or
       // if the slot was already updated during old->old updating.
@@ -2856,7 +2983,7 @@ class RememberedSetUpdatingItem : public UpdatingItem {
       }
       return KEEP_SLOT;
     } else {
-      DCHECK(!heap_->InNewSpace(heap_object));
+      DCHECK(!Heap::InNewSpace(heap_object));
     }
     return REMOVE_SLOT;
   }
@@ -2896,15 +3023,13 @@ class RememberedSetUpdatingItem : public UpdatingItem {
   }
 
   void UpdateTypedPointers() {
-    Isolate* isolate = heap_->isolate();
     if (chunk_->typed_slot_set<OLD_TO_NEW, AccessMode::NON_ATOMIC>() !=
         nullptr) {
       CHECK_NE(chunk_->owner(), heap_->map_space());
       RememberedSet<OLD_TO_NEW>::IterateTyped(
-          chunk_,
-          [isolate, this](SlotType slot_type, Address host_addr, Address slot) {
+          chunk_, [this](SlotType slot_type, Address host_addr, Address slot) {
             return UpdateTypedSlotHelper::UpdateTypedSlot(
-                isolate, slot_type, slot, [this](MaybeObject** slot) {
+                heap_, slot_type, slot, [this](MaybeObject** slot) {
                   return CheckAndUpdateOldToNewSlot(
                       reinterpret_cast<Address>(slot));
                 });
@@ -2915,12 +3040,11 @@ class RememberedSetUpdatingItem : public UpdatingItem {
          nullptr)) {
       CHECK_NE(chunk_->owner(), heap_->map_space());
       RememberedSet<OLD_TO_OLD>::IterateTyped(
-          chunk_,
-          [isolate](SlotType slot_type, Address host_addr, Address slot) {
+          chunk_, [this](SlotType slot_type, Address host_addr, Address slot) {
             // Using UpdateStrongSlot is OK here, because there are no weak
             // typed slots.
             return UpdateTypedSlotHelper::UpdateTypedSlot(
-                isolate, slot_type, slot,
+                heap_, slot_type, slot,
                 UpdateStrongSlot<AccessMode::NON_ATOMIC>);
           });
     }
@@ -2946,19 +3070,23 @@ UpdatingItem* MarkCompactCollector::CreateRememberedSetUpdatingItem(
 
 class GlobalHandlesUpdatingItem : public UpdatingItem {
  public:
-  GlobalHandlesUpdatingItem(GlobalHandles* global_handles, size_t start,
-                            size_t end)
-      : global_handles_(global_handles), start_(start), end_(end) {}
+  GlobalHandlesUpdatingItem(Heap* heap, GlobalHandles* global_handles,
+                            size_t start, size_t end)
+      : heap_(heap),
+        global_handles_(global_handles),
+        start_(start),
+        end_(end) {}
   virtual ~GlobalHandlesUpdatingItem() {}
 
   void Process() override {
     TRACE_EVENT0(TRACE_DISABLED_BY_DEFAULT("v8.gc"),
                  "GlobalHandlesUpdatingItem::Process");
-    PointersUpdatingVisitor updating_visitor;
+    PointersUpdatingVisitor updating_visitor(heap_);
     global_handles_->IterateNewSpaceRoots(&updating_visitor, start_, end_);
   }
 
  private:
+  Heap* heap_;
   GlobalHandles* global_handles_;
   size_t start_;
   size_t end_;
@@ -3001,7 +3129,7 @@ class ArrayBufferTrackerUpdatingItem : public UpdatingItem {
 int MarkCompactCollectorBase::CollectToSpaceUpdatingItems(
     ItemParallelJob* job) {
   // Seed to space pages.
-  const Address space_start = heap()->new_space()->bottom();
+  const Address space_start = heap()->new_space()->first_allocatable_address();
   const Address space_end = heap()->new_space()->top();
   int pages = 0;
   for (Page* page : PageRange(space_start, space_end)) {
@@ -3083,7 +3211,7 @@ int MarkCompactCollector::CollectOldSpaceArrayBufferTrackerItems(
 void MarkCompactCollector::UpdatePointersAfterEvacuation() {
   TRACE_GC(heap()->tracer(), GCTracer::Scope::MC_EVACUATE_UPDATE_POINTERS);
 
-  PointersUpdatingVisitor updating_visitor;
+  PointersUpdatingVisitor updating_visitor(heap());
 
   {
     TRACE_GC(heap()->tracer(),
@@ -3207,7 +3335,7 @@ void MarkCompactCollector::PostProcessEvacuationCandidates() {
     } else {
       DCHECK(p->IsEvacuationCandidate());
       DCHECK(p->SweepingDone());
-      p->Unlink();
+      p->owner()->memory_chunk_list().Remove(p);
     }
   }
   DCHECK_EQ(aborted_pages_verified, aborted_pages);
@@ -3268,6 +3396,7 @@ void MarkCompactCollector::StartSweepSpace(PagedSpace* space) {
                        static_cast<void*>(p));
         }
         ArrayBufferTracker::FreeAll(p);
+        space->memory_chunk_list().Remove(p);
         space->ReleasePage(p);
         continue;
       }
@@ -3280,7 +3409,7 @@ void MarkCompactCollector::StartSweepSpace(PagedSpace* space) {
 
   if (FLAG_gc_verbose) {
     PrintIsolate(isolate(), "sweeping: space=%s initialized_for_sweeping=%d",
-                 AllocationSpaceName(space->identity()), will_be_swept);
+                 space->name(), will_be_swept);
   }
 }
 
@@ -3310,6 +3439,30 @@ void MarkCompactCollector::StartSweepSpaces() {
   }
 }
 
+void MarkCompactCollector::MarkingWorklist::PrintWorklist(
+    const char* worklist_name, ConcurrentMarkingWorklist* worklist) {
+  std::map<InstanceType, int> count;
+  int total_count = 0;
+  worklist->IterateGlobalPool([&count, &total_count](HeapObject* obj) {
+    ++total_count;
+    count[obj->map()->instance_type()]++;
+  });
+  std::vector<std::pair<int, InstanceType>> rank;
+  for (auto i : count) {
+    rank.push_back(std::make_pair(i.second, i.first));
+  }
+  std::map<InstanceType, std::string> instance_type_name;
+#define INSTANCE_TYPE_NAME(name) instance_type_name[name] = #name;
+  INSTANCE_TYPE_LIST(INSTANCE_TYPE_NAME)
+#undef INSTANCE_TYPE_NAME
+  std::sort(rank.begin(), rank.end(),
+            std::greater<std::pair<int, InstanceType>>());
+  PrintF("Worklist %s: %d\n", worklist_name, total_count);
+  for (auto i : rank) {
+    PrintF("  [%s]: %d\n", instance_type_name[i.second].c_str(), i.first);
+  }
+}
+
 #ifdef ENABLE_MINOR_MC
 
 namespace {
@@ -3345,7 +3498,7 @@ class YoungGenerationMarkingVerifier : public MarkingVerifier {
       DCHECK(!HasWeakHeapObjectTag(*current));
       if ((*current)->IsHeapObject()) {
         HeapObject* object = HeapObject::cast(*current);
-        if (!heap_->InNewSpace(object)) return;
+        if (!Heap::InNewSpace(object)) return;
         CHECK(IsMarked(object));
       }
     }
@@ -3356,7 +3509,7 @@ class YoungGenerationMarkingVerifier : public MarkingVerifier {
       HeapObject* object;
       // Minor MC treats weak references as strong.
       if ((*current)->ToStrongOrWeakHeapObject(&object)) {
-        if (!heap_->InNewSpace(object)) {
+        if (!Heap::InNewSpace(object)) {
           continue;
         }
         CHECK(IsMarked(object));
@@ -3386,7 +3539,7 @@ class YoungGenerationEvacuationVerifier : public EvacuationVerifier {
     for (Object** current = start; current < end; current++) {
       if ((*current)->IsHeapObject()) {
         HeapObject* object = HeapObject::cast(*current);
-        CHECK_IMPLIES(heap()->InNewSpace(object), heap()->InToSpace(object));
+        CHECK_IMPLIES(Heap::InNewSpace(object), Heap::InToSpace(object));
       }
     }
   }
@@ -3394,7 +3547,7 @@ class YoungGenerationEvacuationVerifier : public EvacuationVerifier {
     for (MaybeObject** current = start; current < end; current++) {
       HeapObject* object;
       if ((*current)->ToStrongOrWeakHeapObject(&object)) {
-        CHECK_IMPLIES(heap()->InNewSpace(object), heap()->InToSpace(object));
+        CHECK_IMPLIES(Heap::InNewSpace(object), Heap::InToSpace(object));
       }
     }
   }
@@ -3403,7 +3556,8 @@ class YoungGenerationEvacuationVerifier : public EvacuationVerifier {
 #endif  // VERIFY_HEAP
 
 template <class ParallelItem>
-void SeedGlobalHandles(GlobalHandles* global_handles, ItemParallelJob* job) {
+void SeedGlobalHandles(Heap* heap, GlobalHandles* global_handles,
+                       ItemParallelJob* job) {
   // Create batches of global handles.
   const size_t kGlobalHandlesBufferSize = 1000;
   const size_t new_space_nodes = global_handles->NumberOfNewSpaceNodes();
@@ -3411,13 +3565,13 @@ void SeedGlobalHandles(GlobalHandles* global_handles, ItemParallelJob* job) {
        start += kGlobalHandlesBufferSize) {
     size_t end = start + kGlobalHandlesBufferSize;
     if (end > new_space_nodes) end = new_space_nodes;
-    job->AddItem(new ParallelItem(global_handles, start, end));
+    job->AddItem(new ParallelItem(heap, global_handles, start, end));
   }
 }
 
 bool IsUnmarkedObjectForYoungGeneration(Heap* heap, Object** p) {
-  DCHECK_IMPLIES(heap->InNewSpace(*p), heap->InToSpace(*p));
-  return heap->InNewSpace(*p) && !heap->minor_mark_compact_collector()
+  DCHECK_IMPLIES(Heap::InNewSpace(*p), Heap::InToSpace(*p));
+  return Heap::InNewSpace(*p) && !heap->minor_mark_compact_collector()
                                       ->non_atomic_marking_state()
                                       ->IsGrey(HeapObject::cast(*p));
 }
@@ -3428,11 +3582,9 @@ class YoungGenerationMarkingVisitor final
     : public NewSpaceVisitor<YoungGenerationMarkingVisitor> {
  public:
   YoungGenerationMarkingVisitor(
-      Heap* heap, MinorMarkCompactCollector::MarkingState* marking_state,
+      MinorMarkCompactCollector::MarkingState* marking_state,
       MinorMarkCompactCollector::MarkingWorklist* global_worklist, int task_id)
-      : heap_(heap),
-        worklist_(global_worklist, task_id),
-        marking_state_(marking_state) {}
+      : worklist_(global_worklist, task_id), marking_state_(marking_state) {}
 
   V8_INLINE void VisitPointers(HeapObject* host, Object** start,
                                Object** end) final {
@@ -3451,7 +3603,7 @@ class YoungGenerationMarkingVisitor final
   V8_INLINE void VisitPointer(HeapObject* host, Object** slot) final {
     Object* target = *slot;
     DCHECK(!HasWeakHeapObjectTag(target));
-    if (heap_->InNewSpace(target)) {
+    if (Heap::InNewSpace(target)) {
       HeapObject* target_object = HeapObject::cast(target);
       MarkObjectViaMarkingWorklist(target_object);
     }
@@ -3459,7 +3611,7 @@ class YoungGenerationMarkingVisitor final
 
   V8_INLINE void VisitPointer(HeapObject* host, MaybeObject** slot) final {
     MaybeObject* target = *slot;
-    if (heap_->InNewSpace(target)) {
+    if (Heap::InNewSpace(target)) {
       HeapObject* target_object;
       // Treat weak references as strong. TODO(marja): Proper weakness handling
       // for minor-mcs.
@@ -3477,7 +3629,6 @@ class YoungGenerationMarkingVisitor final
     }
   }
 
-  Heap* heap_;
   MinorMarkCompactCollector::MarkingWorklist::View worklist_;
   MinorMarkCompactCollector::MarkingState* marking_state_;
 };
@@ -3490,7 +3641,7 @@ MinorMarkCompactCollector::MinorMarkCompactCollector(Heap* heap)
     : MarkCompactCollectorBase(heap),
       worklist_(new MinorMarkCompactCollector::MarkingWorklist()),
       main_marking_visitor_(new YoungGenerationMarkingVisitor(
-          heap, marking_state(), worklist_, kMainMarker)),
+          marking_state(), worklist_, kMainMarker)),
       page_parallel_job_semaphore_(0) {
   static_assert(
       kNumMarkers <= MinorMarkCompactCollector::MarkingWorklist::kMaxNumTasks,
@@ -3509,7 +3660,9 @@ int MinorMarkCompactCollector::NumberOfParallelMarkingTasks(int pages) {
   // amount of marking that is required.
   const int kPagesPerTask = 2;
   const int wanted_tasks = Max(1, pages / kPagesPerTask);
-  return Min(NumberOfAvailableCores(), Min(wanted_tasks, kNumMarkers));
+  return Min(NumberOfAvailableCores(),
+             Min(wanted_tasks,
+                 MinorMarkCompactCollector::MarkingWorklist::kMaxNumTasks));
 }
 
 void MinorMarkCompactCollector::CleanupSweepToIteratePages() {
@@ -3585,14 +3738,14 @@ void MinorMarkCompactCollector::UpdatePointersAfterEvacuation() {
   TRACE_GC(heap()->tracer(),
            GCTracer::Scope::MINOR_MC_EVACUATE_UPDATE_POINTERS);
 
-  PointersUpdatingVisitor updating_visitor;
+  PointersUpdatingVisitor updating_visitor(heap());
   ItemParallelJob updating_job(isolate()->cancelable_task_manager(),
                                &page_parallel_job_semaphore_);
 
   CollectNewSpaceArrayBufferTrackerItems(&updating_job);
   // Create batches of global handles.
-  SeedGlobalHandles<GlobalHandlesUpdatingItem>(isolate()->global_handles(),
-                                               &updating_job);
+  SeedGlobalHandles<GlobalHandlesUpdatingItem>(
+      heap(), isolate()->global_handles(), &updating_job);
   const int to_space_tasks = CollectToSpaceUpdatingItems(&updating_job);
   int remembered_set_pages = 0;
   remembered_set_pages += CollectRememberedSetUpdatingItems(
@@ -3640,42 +3793,31 @@ void MinorMarkCompactCollector::UpdatePointersAfterEvacuation() {
     // Update pointers from external string table.
     heap()->UpdateNewSpaceReferencesInExternalStringTable(
         &UpdateReferenceInExternalStringTableEntry);
-    heap()->IterateEncounteredWeakCollections(&updating_visitor);
   }
 }
 
 class MinorMarkCompactCollector::RootMarkingVisitor : public RootVisitor {
  public:
   explicit RootMarkingVisitor(MinorMarkCompactCollector* collector)
-      : collector_(collector),
-        marking_state_(collector_->non_atomic_marking_state()) {}
+      : collector_(collector) {}
 
-  void VisitRootPointer(Root root, const char* description,
-                        Object** p) override {
+  void VisitRootPointer(Root root, const char* description, Object** p) final {
     MarkObjectByPointer(p);
   }
 
   void VisitRootPointers(Root root, const char* description, Object** start,
-                         Object** end) override {
-    for (Object** p = start; p < end; p++) MarkObjectByPointer(p);
+                         Object** end) final {
+    for (Object** p = start; p < end; p++) {
+      MarkObjectByPointer(p);
+    }
   }
 
  private:
-  void MarkObjectByPointer(Object** p) {
+  V8_INLINE void MarkObjectByPointer(Object** p) {
     if (!(*p)->IsHeapObject()) return;
-
-    HeapObject* object = HeapObject::cast(*p);
-
-    if (!collector_->heap()->InNewSpace(object)) return;
-
-    if (marking_state_->WhiteToGrey(object)) {
-      collector_->main_marking_visitor()->Visit(object);
-      collector_->ProcessMarkingWorklist();
-    }
+    collector_->MarkRootObject(HeapObject::cast(*p));
   }
-
-  MinorMarkCompactCollector* collector_;
-  MinorMarkCompactCollector::NonAtomicMarkingState* marking_state_;
+  MinorMarkCompactCollector* const collector_;
 };
 
 void MinorMarkCompactCollector::CollectGarbage() {
@@ -3709,8 +3851,8 @@ void MinorMarkCompactCollector::CollectGarbage() {
 
   {
     TRACE_GC(heap()->tracer(), GCTracer::Scope::MINOR_MC_RESET_LIVENESS);
-    for (Page* p : PageRange(heap()->new_space()->FromSpaceStart(),
-                             heap()->new_space()->FromSpaceEnd())) {
+    for (Page* p :
+         PageRange(heap()->new_space()->from_space().first_page(), nullptr)) {
       DCHECK(!p->IsFlagSet(Page::SWEEP_TO_ITERATE));
       non_atomic_marking_state()->ClearLiveness(p);
       if (FLAG_concurrent_marking) {
@@ -3740,7 +3882,7 @@ void MinorMarkCompactCollector::MakeIterable(
   // remove here.
   MarkCompactCollector* full_collector = heap()->mark_compact_collector();
   Address free_start = p->area_start();
-  DCHECK_EQ(0, reinterpret_cast<intptr_t>(free_start) % (32 * kPointerSize));
+  DCHECK_EQ(0, free_start % (32 * kPointerSize));
 
   for (auto object_and_size :
        LiveObjectRange<kGreyObjects>(p, marking_state()->bitmap(p))) {
@@ -3754,7 +3896,7 @@ void MinorMarkCompactCollector::MakeIterable(
           p->AddressToMarkbitIndex(free_start),
           p->AddressToMarkbitIndex(free_end));
       if (free_space_mode == ZAP_FREE_SPACE) {
-        memset(free_start, 0xCC, size);
+        memset(reinterpret_cast<void*>(free_start), 0xCC, size);
       }
       p->heap()->CreateFillerObjectAt(free_start, static_cast<int>(size),
                                       ClearRecordedSlots::kNo);
@@ -3771,7 +3913,7 @@ void MinorMarkCompactCollector::MakeIterable(
         p->AddressToMarkbitIndex(free_start),
         p->AddressToMarkbitIndex(p->area_end()));
     if (free_space_mode == ZAP_FREE_SPACE) {
-      memset(free_start, 0xCC, size);
+      memset(reinterpret_cast<void*>(free_start), 0xCC, size);
     }
     p->heap()->CreateFillerObjectAt(free_start, static_cast<int>(size),
                                     ClearRecordedSlots::kNo);
@@ -3810,7 +3952,7 @@ class YoungGenerationExternalStringTableCleaner : public RootVisitor {
             DCHECK(o->IsThinString());
           }
           // Set the entry to the_hole_value (as deleted).
-          *p = heap_->the_hole_value();
+          *p = ReadOnlyRoots(heap_).the_hole_value();
         }
       }
     }
@@ -3827,12 +3969,11 @@ class MinorMarkCompactWeakObjectRetainer : public WeakObjectRetainer {
  public:
   explicit MinorMarkCompactWeakObjectRetainer(
       MinorMarkCompactCollector* collector)
-      : heap_(collector->heap()),
-        marking_state_(collector->non_atomic_marking_state()) {}
+      : marking_state_(collector->non_atomic_marking_state()) {}
 
   virtual Object* RetainAs(Object* object) {
     HeapObject* heap_object = HeapObject::cast(object);
-    if (!heap_->InNewSpace(heap_object)) return object;
+    if (!Heap::InNewSpace(heap_object)) return object;
 
     // Young generation marking only marks to grey instead of black.
     DCHECK(!marking_state_->IsBlack(heap_object));
@@ -3843,7 +3984,6 @@ class MinorMarkCompactWeakObjectRetainer : public WeakObjectRetainer {
   }
 
  private:
-  Heap* heap_;
   MinorMarkCompactCollector::NonAtomicMarkingState* marking_state_;
 };
 
@@ -3872,7 +4012,8 @@ void MinorMarkCompactCollector::ClearNonLiveReferences() {
 void MinorMarkCompactCollector::EvacuatePrologue() {
   NewSpace* new_space = heap()->new_space();
   // Append the list of new space pages to be processed.
-  for (Page* p : PageRange(new_space->bottom(), new_space->top())) {
+  for (Page* p :
+       PageRange(new_space->first_allocatable_address(), new_space->top())) {
     new_space_evacuation_pages_.push_back(p);
   }
   new_space->Flip();
@@ -3918,7 +4059,7 @@ class YoungGenerationMarkingTask : public ItemParallelJob::Task {
         collector_(collector),
         marking_worklist_(global_worklist, task_id),
         marking_state_(collector->marking_state()),
-        visitor_(isolate->heap(), marking_state_, global_worklist, task_id) {
+        visitor_(marking_state_, global_worklist, task_id) {
     local_live_bytes_.reserve(isolate->heap()->new_space()->Capacity() /
                               Page::kPageSize);
   }
@@ -3946,7 +4087,7 @@ class YoungGenerationMarkingTask : public ItemParallelJob::Task {
   };
 
   void MarkObject(Object* object) {
-    if (!collector_->heap()->InNewSpace(object)) return;
+    if (!Heap::InNewSpace(object)) return;
     HeapObject* heap_object = HeapObject::cast(object);
     if (marking_state_->WhiteToGrey(heap_object)) {
       const int size = visitor_.Visit(heap_object);
@@ -3989,30 +4130,11 @@ class YoungGenerationMarkingTask : public ItemParallelJob::Task {
   std::unordered_map<Page*, intptr_t, Page::Hasher> local_live_bytes_;
 };
 
-class BatchedRootMarkingItem : public MarkingItem {
- public:
-  explicit BatchedRootMarkingItem(std::vector<Object*>&& objects)
-      : objects_(objects) {}
-  virtual ~BatchedRootMarkingItem() {}
-
-  void Process(YoungGenerationMarkingTask* task) override {
-    TRACE_EVENT0(TRACE_DISABLED_BY_DEFAULT("v8.gc"),
-                 "BatchedRootMarkingItem::Process");
-    for (Object* object : objects_) {
-      task->MarkObject(object);
-    }
-  }
-
- private:
-  std::vector<Object*> objects_;
-};
-
 class PageMarkingItem : public MarkingItem {
  public:
-  explicit PageMarkingItem(MemoryChunk* chunk,
-                           base::AtomicNumber<intptr_t>* global_slots)
+  explicit PageMarkingItem(MemoryChunk* chunk, std::atomic<int>* global_slots)
       : chunk_(chunk), global_slots_(global_slots), slots_(0) {}
-  virtual ~PageMarkingItem() { global_slots_->Increment(slots_); }
+  virtual ~PageMarkingItem() { *global_slots_ = *global_slots_ + slots_; }
 
   void Process(YoungGenerationMarkingTask* task) override {
     TRACE_EVENT0(TRACE_DISABLED_BY_DEFAULT("v8.gc"),
@@ -4033,12 +4155,11 @@ class PageMarkingItem : public MarkingItem {
   }
 
   void MarkTypedPointers(YoungGenerationMarkingTask* task) {
-    Isolate* isolate = heap()->isolate();
     RememberedSet<OLD_TO_NEW>::IterateTyped(
-        chunk_, [this, isolate, task](SlotType slot_type, Address host_addr,
-                                      Address slot) {
+        chunk_,
+        [this, task](SlotType slot_type, Address host_addr, Address slot) {
           return UpdateTypedSlotHelper::UpdateTypedSlot(
-              isolate, slot_type, slot, [this, task](MaybeObject** slot) {
+              heap(), slot_type, slot, [this, task](MaybeObject** slot) {
                 return CheckAndMarkObject(task,
                                           reinterpret_cast<Address>(slot));
               });
@@ -4048,10 +4169,10 @@ class PageMarkingItem : public MarkingItem {
   SlotCallbackResult CheckAndMarkObject(YoungGenerationMarkingTask* task,
                                         Address slot_address) {
     MaybeObject* object = *reinterpret_cast<MaybeObject**>(slot_address);
-    if (heap()->InNewSpace(object)) {
+    if (Heap::InNewSpace(object)) {
       // Marking happens before flipping the young generation, so the object
       // has to be in ToSpace.
-      DCHECK(heap()->InToSpace(object));
+      DCHECK(Heap::InToSpace(object));
       HeapObject* heap_object;
       bool success = object->ToStrongOrWeakHeapObject(&heap_object);
       USE(success);
@@ -4064,14 +4185,14 @@ class PageMarkingItem : public MarkingItem {
   }
 
   MemoryChunk* chunk_;
-  base::AtomicNumber<intptr_t>* global_slots_;
-  intptr_t slots_;
+  std::atomic<int>* global_slots_;
+  int slots_;
 };
 
 class GlobalHandlesMarkingItem : public MarkingItem {
  public:
-  GlobalHandlesMarkingItem(GlobalHandles* global_handles, size_t start,
-                           size_t end)
+  GlobalHandlesMarkingItem(Heap* heap, GlobalHandles* global_handles,
+                           size_t start, size_t end)
       : global_handles_(global_handles), start_(start), end_(end) {}
   virtual ~GlobalHandlesMarkingItem() {}
 
@@ -4113,8 +4234,9 @@ class GlobalHandlesMarkingItem : public MarkingItem {
   size_t end_;
 };
 
-void MinorMarkCompactCollector::MarkRootSetInParallel() {
-  base::AtomicNumber<intptr_t> slots;
+void MinorMarkCompactCollector::MarkRootSetInParallel(
+    RootMarkingVisitor* root_visitor) {
+  std::atomic<int> slots;
   {
     ItemParallelJob job(isolate()->cancelable_task_manager(),
                         &page_parallel_job_semaphore_);
@@ -4122,20 +4244,15 @@ void MinorMarkCompactCollector::MarkRootSetInParallel() {
     // Seed the root set (roots + old->new set).
     {
       TRACE_GC(heap()->tracer(), GCTracer::Scope::MINOR_MC_MARK_SEED);
-      // Create batches of roots.
-      RootMarkingVisitorSeedOnly<BatchedRootMarkingItem> root_seed_visitor(
-          &job);
-      heap()->IterateRoots(&root_seed_visitor, VISIT_ALL_IN_MINOR_MC_MARK);
+      heap()->IterateRoots(root_visitor, VISIT_ALL_IN_MINOR_MC_MARK);
       // Create batches of global handles.
-      SeedGlobalHandles<GlobalHandlesMarkingItem>(isolate()->global_handles(),
-                                                  &job);
+      SeedGlobalHandles<GlobalHandlesMarkingItem>(
+          heap(), isolate()->global_handles(), &job);
       // Create items for each page.
       RememberedSet<OLD_TO_NEW>::IterateMemoryChunks(
           heap(), [&job, &slots](MemoryChunk* chunk) {
             job.AddItem(new PageMarkingItem(chunk, &slots));
           });
-      // Flush any remaining objects in the seeding visitor.
-      root_seed_visitor.FlushObjects();
     }
 
     // Add tasks and run in parallel.
@@ -4149,10 +4266,10 @@ void MinorMarkCompactCollector::MarkRootSetInParallel() {
             new YoungGenerationMarkingTask(isolate(), this, worklist(), i));
       }
       job.Run(isolate()->async_counters());
-      DCHECK(worklist()->IsGlobalEmpty());
+      DCHECK(worklist()->IsEmpty());
     }
   }
-  old_to_new_slots_ = static_cast<int>(slots.Value());
+  old_to_new_slots_ = slots;
 }
 
 void MinorMarkCompactCollector::MarkLiveObjects() {
@@ -4162,12 +4279,11 @@ void MinorMarkCompactCollector::MarkLiveObjects() {
 
   RootMarkingVisitor root_visitor(this);
 
-  MarkRootSetInParallel();
+  MarkRootSetInParallel(&root_visitor);
 
   // Mark rest on the main thread.
   {
     TRACE_GC(heap()->tracer(), GCTracer::Scope::MINOR_MC_MARK_WEAK);
-    heap()->IterateEncounteredWeakCollections(&root_visitor);
     ProcessMarkingWorklist();
   }
 
diff --git a/deps/v8/src/heap/mark-compact.h b/deps/v8/src/heap/mark-compact.h
index 944b139a59334e..169f2ae671c36b 100644
--- a/deps/v8/src/heap/mark-compact.h
+++ b/deps/v8/src/heap/mark-compact.h
@@ -5,7 +5,6 @@
 #ifndef V8_HEAP_MARK_COMPACT_H_
 #define V8_HEAP_MARK_COMPACT_H_
 
-#include <deque>
 #include <vector>
 
 #include "src/heap/concurrent-marking.h"
@@ -261,6 +260,7 @@ class MarkCompactCollectorBase {
   inline Isolate* isolate() { return heap()->isolate(); }
 
  protected:
+  static const int kMainThread = 0;
   explicit MarkCompactCollectorBase(Heap* heap)
       : heap_(heap), old_to_new_slots_(0) {}
 
@@ -315,21 +315,15 @@ class MinorMarkingState final
   }
 
   void IncrementLiveBytes(MemoryChunk* chunk, intptr_t by) {
-    reinterpret_cast<base::AtomicNumber<intptr_t>*>(
-        &chunk->young_generation_live_byte_count_)
-        ->Increment(by);
+    chunk->young_generation_live_byte_count_ += by;
   }
 
   intptr_t live_bytes(MemoryChunk* chunk) const {
-    return reinterpret_cast<base::AtomicNumber<intptr_t>*>(
-               &chunk->young_generation_live_byte_count_)
-        ->Value();
+    return chunk->young_generation_live_byte_count_;
   }
 
   void SetLiveBytes(MemoryChunk* chunk, intptr_t value) {
-    reinterpret_cast<base::AtomicNumber<intptr_t>*>(
-        &chunk->young_generation_live_byte_count_)
-        ->SetValue(value);
+    chunk->young_generation_live_byte_count_ = value;
   }
 };
 
@@ -384,19 +378,15 @@ class MajorAtomicMarkingState final
   }
 
   void IncrementLiveBytes(MemoryChunk* chunk, intptr_t by) {
-    reinterpret_cast<base::AtomicNumber<intptr_t>*>(&chunk->live_byte_count_)
-        ->Increment(by);
+    chunk->live_byte_count_ += by;
   }
 
   intptr_t live_bytes(MemoryChunk* chunk) const {
-    return reinterpret_cast<base::AtomicNumber<intptr_t>*>(
-               &chunk->live_byte_count_)
-        ->Value();
+    return chunk->live_byte_count_;
   }
 
   void SetLiveBytes(MemoryChunk* chunk, intptr_t value) {
-    reinterpret_cast<base::AtomicNumber<intptr_t>*>(&chunk->live_byte_count_)
-        ->SetValue(value);
+    chunk->live_byte_count_ = value;
   }
 };
 
@@ -421,16 +411,52 @@ class MajorNonAtomicMarkingState final
   }
 };
 
+struct Ephemeron {
+  HeapObject* key;
+  HeapObject* value;
+};
+
+typedef Worklist<Ephemeron, 64> EphemeronWorklist;
+
 // Weak objects encountered during marking.
 struct WeakObjects {
   Worklist<WeakCell*, 64> weak_cells;
   Worklist<TransitionArray*, 64> transition_arrays;
+
+  // Keep track of all EphemeronHashTables in the heap to process
+  // them in the atomic pause.
+  Worklist<EphemeronHashTable*, 64> ephemeron_hash_tables;
+
+  // Keep track of all ephemerons for concurrent marking tasks. Only store
+  // ephemerons in these Worklists if both key and value are unreachable at the
+  // moment.
+  //
+  // MarkCompactCollector::ProcessEphemeronsUntilFixpoint drains and fills these
+  // worklists.
+  //
+  // current_ephemerons is used as draining worklist in the current fixpoint
+  // iteration.
+  EphemeronWorklist current_ephemerons;
+
+  // Stores ephemerons to visit in the next fixpoint iteration.
+  EphemeronWorklist next_ephemerons;
+
+  // When draining the marking worklist new discovered ephemerons are pushed
+  // into this worklist.
+  EphemeronWorklist discovered_ephemerons;
+
   // TODO(marja): For old space, we only need the slot, not the host
   // object. Optimize this by adding a different storage for old space.
   Worklist<std::pair<HeapObject*, HeapObjectReference**>, 64> weak_references;
   Worklist<std::pair<HeapObject*, Code*>, 64> weak_objects_in_code;
 };
 
+struct EphemeronMarking {
+  std::vector<HeapObject*> newly_discovered;
+  bool newly_discovered_overflowed;
+  size_t newly_discovered_limit;
+};
+
 // Collector for young and old generation.
 class MarkCompactCollector final : public MarkCompactCollectorBase {
  public:
@@ -440,8 +466,6 @@ class MarkCompactCollector final : public MarkCompactCollectorBase {
   using MarkingState = MajorNonAtomicMarkingState;
 #endif  // V8_CONCURRENT_MARKING
   using NonAtomicMarkingState = MajorNonAtomicMarkingState;
-
-  static const int kMainThread = 0;
   // Wrapper for the shared and bailout worklists.
   class MarkingWorklist {
    public:
@@ -530,30 +554,20 @@ class MarkCompactCollector final : public MarkCompactCollectorBase {
    private:
     // Prints the stats about the global pool of the worklist.
     void PrintWorklist(const char* worklist_name,
-                       ConcurrentMarkingWorklist* worklist) {
-      std::map<InstanceType, int> count;
-      int total_count = 0;
-      worklist->IterateGlobalPool([&count, &total_count](HeapObject* obj) {
-        ++total_count;
-        count[obj->map()->instance_type()]++;
-      });
-      std::vector<std::pair<int, InstanceType>> rank;
-      for (auto i : count) {
-        rank.push_back(std::make_pair(i.second, i.first));
-      }
-      std::map<InstanceType, std::string> instance_type_name;
-#define INSTANCE_TYPE_NAME(name) instance_type_name[name] = #name;
-      INSTANCE_TYPE_LIST(INSTANCE_TYPE_NAME)
-#undef INSTANCE_TYPE_NAME
-      std::sort(rank.begin(), rank.end(),
-                std::greater<std::pair<int, InstanceType>>());
-      PrintF("Worklist %s: %d\n", worklist_name, total_count);
-      for (auto i : rank) {
-        PrintF("  [%s]: %d\n", instance_type_name[i.second].c_str(), i.first);
-      }
-    }
+                       ConcurrentMarkingWorklist* worklist);
+
+    // Worklist used for most objects.
     ConcurrentMarkingWorklist shared_;
+
+    // Concurrent marking uses this worklist to bail out of concurrently
+    // marking certain object types. These objects are handled later in a STW
+    // pause after concurrent marking has finished.
     ConcurrentMarkingWorklist bailout_;
+
+    // Concurrent marking uses this worklist to bail out of marking objects
+    // in new space's linear allocation area. Used to avoid black allocation
+    // for new space. This allow the compiler to remove write barriers
+    // for freshly allocatd objects.
     ConcurrentMarkingWorklist on_hold_;
   };
 
@@ -604,9 +618,10 @@ class MarkCompactCollector final : public MarkCompactCollectorBase {
 
   void RecordRelocSlot(Code* host, RelocInfo* rinfo, Object* target);
   V8_INLINE static void RecordSlot(HeapObject* object, Object** slot,
-                                   Object* target);
+                                   HeapObject* target);
   V8_INLINE static void RecordSlot(HeapObject* object,
-                                   HeapObjectReference** slot, Object* target);
+                                   HeapObjectReference** slot,
+                                   HeapObject* target);
   void RecordLiveSlotsOnPage(Page* page);
 
   void UpdateSlots(SlotsBuffer* buffer);
@@ -640,6 +655,15 @@ class MarkCompactCollector final : public MarkCompactCollectorBase {
     weak_objects_.transition_arrays.Push(kMainThread, array);
   }
 
+  void AddEphemeronHashTable(EphemeronHashTable* table) {
+    weak_objects_.ephemeron_hash_tables.Push(kMainThread, table);
+  }
+
+  void AddEphemeron(HeapObject* key, HeapObject* value) {
+    weak_objects_.discovered_ephemerons.Push(kMainThread,
+                                             Ephemeron{key, value});
+  }
+
   void AddWeakReference(HeapObject* host, HeapObjectReference** slot) {
     weak_objects_.weak_references.Push(kMainThread, std::make_pair(host, slot));
   }
@@ -649,6 +673,22 @@ class MarkCompactCollector final : public MarkCompactCollectorBase {
                                             std::make_pair(object, code));
   }
 
+  void AddNewlyDiscovered(HeapObject* object) {
+    if (ephemeron_marking_.newly_discovered_overflowed) return;
+
+    if (ephemeron_marking_.newly_discovered.size() <
+        ephemeron_marking_.newly_discovered_limit) {
+      ephemeron_marking_.newly_discovered.push_back(object);
+    } else {
+      ephemeron_marking_.newly_discovered_overflowed = true;
+    }
+  }
+
+  void ResetNewlyDiscovered() {
+    ephemeron_marking_.newly_discovered_overflowed = false;
+    ephemeron_marking_.newly_discovered.clear();
+  }
+
   Sweeper* sweeper() { return sweeper_; }
 
 #ifdef DEBUG
@@ -703,7 +743,7 @@ class MarkCompactCollector final : public MarkCompactCollectorBase {
   void MarkStringTable(ObjectVisitor* visitor);
 
   // Marks object reachable from harmony weak maps and wrapper tracing.
-  void ProcessEphemeralMarking();
+  void ProcessEphemeronMarking();
 
   // If the call-site of the top optimized code was not prepared for
   // deoptimization, then treat embedded pointers in the code as strong as
@@ -717,9 +757,36 @@ class MarkCompactCollector final : public MarkCompactCollectorBase {
   // if no concurrent threads are running.
   void ProcessMarkingWorklist() override;
 
+  enum class MarkingWorklistProcessingMode {
+    kDefault,
+    kTrackNewlyDiscoveredObjects
+  };
+
+  template <MarkingWorklistProcessingMode mode>
+  void ProcessMarkingWorklistInternal();
+
+  // Implements ephemeron semantics: Marks value if key is already reachable.
+  // Returns true if value was actually marked.
+  bool VisitEphemeron(HeapObject* key, HeapObject* value);
+
+  // Marks ephemerons and drains marking worklist iteratively
+  // until a fixpoint is reached.
+  void ProcessEphemeronsUntilFixpoint();
+
+  // Drains ephemeron and marking worklists. Single iteration of the
+  // fixpoint iteration.
+  bool ProcessEphemerons();
+
+  // Mark ephemerons and drain marking worklist with a linear algorithm.
+  // Only used if fixpoint iteration doesn't finish within a few iterations.
+  void ProcessEphemeronsLinear();
+
+  // Perform Wrapper Tracing if in use.
+  void PerformWrapperTracing();
+
   // Callback function for telling whether the object *p is an unmarked
   // heap object.
-  static bool IsUnmarkedHeapObject(Object** p);
+  static bool IsUnmarkedHeapObject(Heap* heap, Object** p);
 
   // Clear non-live references in weak cells, transition and descriptor arrays,
   // and deoptimize dependent code of non-live maps.
@@ -738,20 +805,11 @@ class MarkCompactCollector final : public MarkCompactCollectorBase {
   void TrimDescriptorArray(Map* map, DescriptorArray* descriptors);
   void TrimEnumCache(Map* map, DescriptorArray* descriptors);
 
-  // Mark all values associated with reachable keys in weak collections
-  // encountered so far.  This might push new object or even new weak maps onto
-  // the marking stack.
-  void ProcessWeakCollections();
-
   // After all reachable objects have been marked those weak map entries
   // with an unreachable key are removed from all encountered weak maps.
   // The linked list of all encountered weak maps is destroyed.
   void ClearWeakCollections();
 
-  // We have to remove all encountered weak maps from the list of weak
-  // collections when incremental marking is aborted.
-  void AbortWeakCollections();
-
   // Goes through the list of encountered weak cells and clears those with
   // dead values. If the value is a dead map and the parent map transitions to
   // the dead map via weak cell, then this function also clears the map
@@ -786,6 +844,10 @@ class MarkCompactCollector final : public MarkCompactCollectorBase {
   void ClearMarkbitsInPagedSpace(PagedSpace* space);
   void ClearMarkbitsInNewSpace(NewSpace* space);
 
+  static const int kEphemeronChunkSize = 8 * KB;
+
+  int NumberOfParallelEphemeronVisitingTasks(size_t elements);
+
   base::Mutex mutex_;
   base::Semaphore page_parallel_job_semaphore_;
 
@@ -818,6 +880,7 @@ class MarkCompactCollector final : public MarkCompactCollectorBase {
 
   MarkingWorklist marking_worklist_;
   WeakObjects weak_objects_;
+  EphemeronMarking ephemeron_marking_;
 
   // Candidates for pages that should be evacuated.
   std::vector<Page*> evacuation_candidates_;
@@ -831,6 +894,7 @@ class MarkCompactCollector final : public MarkCompactCollectorBase {
   MarkingState marking_state_;
   NonAtomicMarkingState non_atomic_marking_state_;
 
+  friend class EphemeronHashTableMarkingTask;
   friend class FullEvacuator;
   friend class Heap;
   friend class RecordMigratedSlotVisitor;
@@ -855,10 +919,10 @@ class MarkingVisitor final
   V8_INLINE int VisitAllocationSite(Map* map, AllocationSite* object);
   V8_INLINE int VisitBytecodeArray(Map* map, BytecodeArray* object);
   V8_INLINE int VisitCodeDataContainer(Map* map, CodeDataContainer* object);
+  V8_INLINE int VisitEphemeronHashTable(Map* map, EphemeronHashTable* object);
   V8_INLINE int VisitFixedArray(Map* map, FixedArray* object);
   V8_INLINE int VisitJSApiObject(Map* map, JSObject* object);
   V8_INLINE int VisitJSFunction(Map* map, JSFunction* object);
-  V8_INLINE int VisitJSWeakCollection(Map* map, JSWeakCollection* object);
   V8_INLINE int VisitMap(Map* map, Map* object);
   V8_INLINE int VisitNativeContext(Map* map, Context* object);
   V8_INLINE int VisitTransitionArray(Map* map, TransitionArray* object);
@@ -953,7 +1017,8 @@ class MinorMarkCompactCollector final : public MarkCompactCollectorBase {
   }
 
   void MarkLiveObjects() override;
-  void MarkRootSetInParallel();
+  void MarkRootSetInParallel(RootMarkingVisitor* root_visitor);
+  V8_INLINE void MarkRootObject(HeapObject* obj);
   void ProcessMarkingWorklist() override;
   void ClearNonLiveReferences() override;
 
diff --git a/deps/v8/src/heap/marking.h b/deps/v8/src/heap/marking.h
index bfa813091e552e..ccf25d654965c0 100644
--- a/deps/v8/src/heap/marking.h
+++ b/deps/v8/src/heap/marking.h
@@ -208,7 +208,7 @@ class Marking : public AllStatic {
   // Impossible markbits: 01
   static const char* kImpossibleBitPattern;
   template <AccessMode mode = AccessMode::NON_ATOMIC>
-  INLINE(static bool IsImpossible(MarkBit mark_bit)) {
+  V8_INLINE static bool IsImpossible(MarkBit mark_bit) {
     if (mode == AccessMode::NON_ATOMIC) {
       return !mark_bit.Get<mode>() && mark_bit.Next().Get<mode>();
     }
@@ -226,14 +226,14 @@ class Marking : public AllStatic {
   // Black markbits: 11
   static const char* kBlackBitPattern;
   template <AccessMode mode = AccessMode::NON_ATOMIC>
-  INLINE(static bool IsBlack(MarkBit mark_bit)) {
+  V8_INLINE static bool IsBlack(MarkBit mark_bit) {
     return mark_bit.Get<mode>() && mark_bit.Next().Get<mode>();
   }
 
   // White markbits: 00 - this is required by the mark bit clearer.
   static const char* kWhiteBitPattern;
   template <AccessMode mode = AccessMode::NON_ATOMIC>
-  INLINE(static bool IsWhite(MarkBit mark_bit)) {
+  V8_INLINE static bool IsWhite(MarkBit mark_bit) {
     DCHECK(!IsImpossible<mode>(mark_bit));
     return !mark_bit.Get<mode>();
   }
@@ -241,19 +241,19 @@ class Marking : public AllStatic {
   // Grey markbits: 10
   static const char* kGreyBitPattern;
   template <AccessMode mode = AccessMode::NON_ATOMIC>
-  INLINE(static bool IsGrey(MarkBit mark_bit)) {
+  V8_INLINE static bool IsGrey(MarkBit mark_bit) {
     return mark_bit.Get<mode>() && !mark_bit.Next().Get<mode>();
   }
 
   // IsBlackOrGrey assumes that the first bit is set for black or grey
   // objects.
   template <AccessMode mode = AccessMode::NON_ATOMIC>
-  INLINE(static bool IsBlackOrGrey(MarkBit mark_bit)) {
+  V8_INLINE static bool IsBlackOrGrey(MarkBit mark_bit) {
     return mark_bit.Get<mode>();
   }
 
   template <AccessMode mode = AccessMode::NON_ATOMIC>
-  INLINE(static void MarkWhite(MarkBit markbit)) {
+  V8_INLINE static void MarkWhite(MarkBit markbit) {
     STATIC_ASSERT(mode == AccessMode::NON_ATOMIC);
     markbit.Clear<mode>();
     markbit.Next().Clear<mode>();
@@ -263,23 +263,23 @@ class Marking : public AllStatic {
   // If you know that nobody else will change the bits on the given location
   // then you may use it.
   template <AccessMode mode = AccessMode::NON_ATOMIC>
-  INLINE(static void MarkBlack(MarkBit markbit)) {
+  V8_INLINE static void MarkBlack(MarkBit markbit) {
     markbit.Set<mode>();
     markbit.Next().Set<mode>();
   }
 
   template <AccessMode mode = AccessMode::NON_ATOMIC>
-  INLINE(static bool WhiteToGrey(MarkBit markbit)) {
+  V8_INLINE static bool WhiteToGrey(MarkBit markbit) {
     return markbit.Set<mode>();
   }
 
   template <AccessMode mode = AccessMode::NON_ATOMIC>
-  INLINE(static bool WhiteToBlack(MarkBit markbit)) {
+  V8_INLINE static bool WhiteToBlack(MarkBit markbit) {
     return markbit.Set<mode>() && markbit.Next().Set<mode>();
   }
 
   template <AccessMode mode = AccessMode::NON_ATOMIC>
-  INLINE(static bool GreyToBlack(MarkBit markbit)) {
+  V8_INLINE static bool GreyToBlack(MarkBit markbit) {
     return markbit.Get<mode>() && markbit.Next().Set<mode>();
   }
 
diff --git a/deps/v8/src/heap/memory-reducer.cc b/deps/v8/src/heap/memory-reducer.cc
index baa4d6c00b27f8..4af7df87fd70eb 100644
--- a/deps/v8/src/heap/memory-reducer.cc
+++ b/deps/v8/src/heap/memory-reducer.cc
@@ -20,6 +20,14 @@ const int MemoryReducer::kMaxNumberOfGCs = 3;
 const double MemoryReducer::kCommittedMemoryFactor = 1.1;
 const size_t MemoryReducer::kCommittedMemoryDelta = 10 * MB;
 
+MemoryReducer::MemoryReducer(Heap* heap)
+    : heap_(heap),
+      taskrunner_(V8::GetCurrentPlatform()->GetForegroundTaskRunner(
+          reinterpret_cast<v8::Isolate*>(heap->isolate()))),
+      state_(kDone, 0, 0.0, 0.0, 0),
+      js_calls_counter_(0),
+      js_calls_sample_time_ms_(0.0) {}
+
 MemoryReducer::TimerTask::TimerTask(MemoryReducer* memory_reducer)
     : CancelableTask(memory_reducer->heap()->isolate()),
       memory_reducer_(memory_reducer) {}
@@ -84,7 +92,7 @@ void MemoryReducer::NotifyTimer(const Event& event) {
           GarbageCollectionReason::kFinalizeMarkingViaTask);
     }
     // Re-schedule the timer.
-    ScheduleTimer(event.time_ms, state_.next_gc_start_ms - event.time_ms);
+    ScheduleTimer(state_.next_gc_start_ms - event.time_ms);
     if (FLAG_trace_gc_verbose) {
       heap()->isolate()->PrintWithTimestamp(
           "Memory reducer: waiting for %.f ms\n",
@@ -100,7 +108,7 @@ void MemoryReducer::NotifyMarkCompact(const Event& event) {
   state_ = Step(state_, event);
   if (old_action != kWait && state_.action == kWait) {
     // If we are transitioning to the WAIT state, start the timer.
-    ScheduleTimer(event.time_ms, state_.next_gc_start_ms - event.time_ms);
+    ScheduleTimer(state_.next_gc_start_ms - event.time_ms);
   }
   if (old_action == kRun) {
     if (FLAG_trace_gc_verbose) {
@@ -117,7 +125,7 @@ void MemoryReducer::NotifyPossibleGarbage(const Event& event) {
   state_ = Step(state_, event);
   if (old_action != kWait && state_.action == kWait) {
     // If we are transitioning to the WAIT state, start the timer.
-    ScheduleTimer(event.time_ms, state_.next_gc_start_ms - event.time_ms);
+    ScheduleTimer(state_.next_gc_start_ms - event.time_ms);
   }
 }
 
@@ -199,16 +207,14 @@ MemoryReducer::State MemoryReducer::Step(const State& state,
   UNREACHABLE();
 }
 
-
-void MemoryReducer::ScheduleTimer(double time_ms, double delay_ms) {
+void MemoryReducer::ScheduleTimer(double delay_ms) {
   DCHECK_LT(0, delay_ms);
   if (heap()->IsTearingDown()) return;
   // Leave some room for precision error in task scheduler.
   const double kSlackMs = 100;
-  v8::Isolate* isolate = reinterpret_cast<v8::Isolate*>(heap()->isolate());
-  auto timer_task = new MemoryReducer::TimerTask(this);
-  V8::GetCurrentPlatform()->CallDelayedOnForegroundThread(
-      isolate, timer_task, (delay_ms + kSlackMs) / 1000.0);
+  taskrunner_->PostDelayedTask(
+      base::make_unique<MemoryReducer::TimerTask>(this),
+      (delay_ms + kSlackMs) / 1000.0);
 }
 
 void MemoryReducer::TearDown() { state_ = State(kDone, 0, 0, 0.0, 0); }
diff --git a/deps/v8/src/heap/memory-reducer.h b/deps/v8/src/heap/memory-reducer.h
index ce6564596eb651..90a955150e415f 100644
--- a/deps/v8/src/heap/memory-reducer.h
+++ b/deps/v8/src/heap/memory-reducer.h
@@ -110,11 +110,7 @@ class V8_EXPORT_PRIVATE MemoryReducer {
     bool can_start_incremental_gc;
   };
 
-  explicit MemoryReducer(Heap* heap)
-      : heap_(heap),
-        state_(kDone, 0, 0.0, 0.0, 0),
-        js_calls_counter_(0),
-        js_calls_sample_time_ms_(0.0) {}
+  explicit MemoryReducer(Heap* heap);
   // Callbacks.
   void NotifyMarkCompact(const Event& event);
   void NotifyPossibleGarbage(const Event& event);
@@ -123,7 +119,7 @@ class V8_EXPORT_PRIVATE MemoryReducer {
   // the incoming event.
   static State Step(const State& state, const Event& event);
   // Posts a timer task that will call NotifyTimer after the given delay.
-  void ScheduleTimer(double time_ms, double delay_ms);
+  void ScheduleTimer(double delay_ms);
   void TearDown();
   static const int kLongDelayMs;
   static const int kShortDelayMs;
@@ -159,6 +155,7 @@ class V8_EXPORT_PRIVATE MemoryReducer {
   static bool WatchdogGC(const State& state, const Event& event);
 
   Heap* heap_;
+  std::shared_ptr<v8::TaskRunner> taskrunner_;
   State state_;
   unsigned int js_calls_counter_;
   double js_calls_sample_time_ms_;
diff --git a/deps/v8/src/heap/object-stats.cc b/deps/v8/src/heap/object-stats.cc
index 008ba7879de2e3..6c15fba55c7aa8 100644
--- a/deps/v8/src/heap/object-stats.cc
+++ b/deps/v8/src/heap/object-stats.cc
@@ -16,6 +16,9 @@
 #include "src/heap/mark-compact.h"
 #include "src/isolate.h"
 #include "src/objects/compilation-cache-inl.h"
+#include "src/objects/js-collection-inl.h"
+#include "src/objects/literal-objects-inl.h"
+#include "src/objects/templates.h"
 #include "src/utils.h"
 
 namespace v8 {
@@ -23,6 +26,101 @@ namespace internal {
 
 static base::LazyMutex object_stats_mutex = LAZY_MUTEX_INITIALIZER;
 
+class FieldStatsCollector : public ObjectVisitor {
+ public:
+  FieldStatsCollector(size_t* tagged_fields_count,
+                      size_t* embedder_fields_count,
+                      size_t* unboxed_double_fields_count,
+                      size_t* raw_fields_count)
+      : tagged_fields_count_(tagged_fields_count),
+        embedder_fields_count_(embedder_fields_count),
+        unboxed_double_fields_count_(unboxed_double_fields_count),
+        raw_fields_count_(raw_fields_count) {}
+
+  void RecordStats(HeapObject* host) {
+    size_t old_pointer_fields_count = *tagged_fields_count_;
+    host->Iterate(this);
+    size_t tagged_fields_count_in_object =
+        *tagged_fields_count_ - old_pointer_fields_count;
+
+    int object_size_in_words = host->Size() / kPointerSize;
+    DCHECK_LE(tagged_fields_count_in_object, object_size_in_words);
+    size_t raw_fields_count_in_object =
+        object_size_in_words - tagged_fields_count_in_object;
+
+    if (host->IsJSObject()) {
+      JSObjectFieldStats field_stats = GetInobjectFieldStats(host->map());
+      // Embedder fields are already included into pointer words.
+      DCHECK_LE(field_stats.embedded_fields_count_,
+                tagged_fields_count_in_object);
+      tagged_fields_count_in_object -= field_stats.embedded_fields_count_;
+      *tagged_fields_count_ -= field_stats.embedded_fields_count_;
+      *embedder_fields_count_ += field_stats.embedded_fields_count_;
+
+      // The rest are data words.
+      DCHECK_LE(field_stats.unboxed_double_fields_count_,
+                raw_fields_count_in_object);
+      raw_fields_count_in_object -= field_stats.unboxed_double_fields_count_;
+      *unboxed_double_fields_count_ += field_stats.unboxed_double_fields_count_;
+    }
+    *raw_fields_count_ += raw_fields_count_in_object;
+  }
+
+  void VisitPointers(HeapObject* host, Object** start, Object** end) override {
+    *tagged_fields_count_ += (end - start);
+  }
+  void VisitPointers(HeapObject* host, MaybeObject** start,
+                     MaybeObject** end) override {
+    *tagged_fields_count_ += (end - start);
+  }
+
+ private:
+  struct JSObjectFieldStats {
+    JSObjectFieldStats()
+        : embedded_fields_count_(0), unboxed_double_fields_count_(0) {}
+
+    unsigned embedded_fields_count_ : kDescriptorIndexBitCount;
+    unsigned unboxed_double_fields_count_ : kDescriptorIndexBitCount;
+  };
+  std::unordered_map<Map*, JSObjectFieldStats> field_stats_cache_;
+
+  JSObjectFieldStats GetInobjectFieldStats(Map* map);
+
+  size_t* const tagged_fields_count_;
+  size_t* const embedder_fields_count_;
+  size_t* const unboxed_double_fields_count_;
+  size_t* const raw_fields_count_;
+};
+
+FieldStatsCollector::JSObjectFieldStats
+FieldStatsCollector::GetInobjectFieldStats(Map* map) {
+  auto iter = field_stats_cache_.find(map);
+  if (iter != field_stats_cache_.end()) {
+    return iter->second;
+  }
+  // Iterate descriptor array and calculate stats.
+  JSObjectFieldStats stats;
+  stats.embedded_fields_count_ = JSObject::GetEmbedderFieldCount(map);
+  if (!map->is_dictionary_map()) {
+    int nof = map->NumberOfOwnDescriptors();
+    DescriptorArray* descriptors = map->instance_descriptors();
+    for (int descriptor = 0; descriptor < nof; descriptor++) {
+      PropertyDetails details = descriptors->GetDetails(descriptor);
+      if (details.location() == kField) {
+        FieldIndex index = FieldIndex::ForDescriptor(map, descriptor);
+        // Stop on first out-of-object field.
+        if (!index.is_inobject()) break;
+        if (details.representation().IsDouble() &&
+            map->IsUnboxedDoubleField(index)) {
+          ++stats.unboxed_double_fields_count_;
+        }
+      }
+    }
+  }
+  field_stats_cache_.insert(std::make_pair(map, stats));
+  return stats;
+}
+
 void ObjectStats::ClearObjectStats(bool clear_last_time_stats) {
   memset(object_counts_, 0, sizeof(object_counts_));
   memset(object_sizes_, 0, sizeof(object_sizes_));
@@ -33,6 +131,10 @@ void ObjectStats::ClearObjectStats(bool clear_last_time_stats) {
     memset(object_counts_last_time_, 0, sizeof(object_counts_last_time_));
     memset(object_sizes_last_time_, 0, sizeof(object_sizes_last_time_));
   }
+  tagged_fields_count_ = 0;
+  embedder_fields_count_ = 0;
+  unboxed_double_fields_count_ = 0;
+  raw_fields_count_ = 0;
 }
 
 // Tell the compiler to never inline this: occasionally, the optimizer will
@@ -49,12 +151,7 @@ V8_NOINLINE static void PrintJSONArray(size_t* array, const int len) {
 
 V8_NOINLINE static void DumpJSONArray(std::stringstream& stream, size_t* array,
                                       const int len) {
-  stream << "[";
-  for (int i = 0; i < len; i++) {
-    stream << array[i];
-    if (i != (len - 1)) stream << ",";
-  }
-  stream << "]";
+  stream << PrintCollection(Vector<size_t>(array, len));
 }
 
 void ObjectStats::PrintKeyAndId(const char* key, int gc_count) {
@@ -88,6 +185,16 @@ void ObjectStats::PrintJSON(const char* key) {
   PrintF("{ ");
   PrintKeyAndId(key, gc_count);
   PrintF("\"type\": \"gc_descriptor\", \"time\": %f }\n", time);
+  // field_data
+  PrintF("{ ");
+  PrintKeyAndId(key, gc_count);
+  PrintF("\"type\": \"field_data\"");
+  PrintF(", \"tagged_fields\": %zu", tagged_fields_count_ * kPointerSize);
+  PrintF(", \"embedder_fields\": %zu", embedder_fields_count_ * kPointerSize);
+  PrintF(", \"unboxed_double_fields\": %zu",
+         unboxed_double_fields_count_ * kDoubleSize);
+  PrintF(", \"other_raw_fields\": %zu", raw_fields_count_ * kPointerSize);
+  PrintF(" }\n");
   // bucket_sizes
   PrintF("{ ");
   PrintKeyAndId(key, gc_count);
@@ -133,6 +240,16 @@ void ObjectStats::Dump(std::stringstream& stream) {
   stream << "\"isolate\":\"" << reinterpret_cast<void*>(isolate()) << "\",";
   stream << "\"id\":" << gc_count << ",";
   stream << "\"time\":" << time << ",";
+
+  // field_data
+  stream << "\"field_data\":{";
+  stream << "\"tagged_fields\":" << (tagged_fields_count_ * kPointerSize);
+  stream << ",\"embedder_fields\":" << (embedder_fields_count_ * kPointerSize);
+  stream << ",\"unboxed_double_fields\": "
+         << (unboxed_double_fields_count_ * kDoubleSize);
+  stream << ",\"other_raw_fields\":" << (raw_fields_count_ * kPointerSize);
+  stream << "}, ";
+
   stream << "\"bucket_sizes\":[";
   for (int i = 0; i < kNumberOfBuckets; i++) {
     stream << (1 << (kFirstBucketShift + i));
@@ -207,7 +324,10 @@ class ObjectStatsCollectorImpl {
   ObjectStatsCollectorImpl(Heap* heap, ObjectStats* stats);
 
   void CollectGlobalStatistics();
-  void CollectStatistics(HeapObject* obj, Phase phase);
+
+  enum class CollectFieldStats { kNo, kYes };
+  void CollectStatistics(HeapObject* obj, Phase phase,
+                         CollectFieldStats collect_field_stats);
 
  private:
   enum CowMode {
@@ -241,7 +361,7 @@ class ObjectStatsCollectorImpl {
   void RecordObjectStats(HeapObject* obj, InstanceType type, size_t size);
 
   // Specific recursion into constant pool or embedded code objects. Records
-  // FixedArrays and Tuple2 that look like ConstantElementsPair.
+  // FixedArrays and Tuple2.
   void RecordVirtualObjectsForConstantPoolOrEmbeddedObjects(
       HeapObject* parent, HeapObject* object,
       ObjectStats::VirtualInstanceType type);
@@ -262,10 +382,13 @@ class ObjectStatsCollectorImpl {
   void RecordVirtualSharedFunctionInfoDetails(SharedFunctionInfo* info);
   void RecordVirtualJSFunctionDetails(JSFunction* function);
 
+  void RecordVirtualArrayBoilerplateDescription(
+      ArrayBoilerplateDescription* description);
   Heap* heap_;
   ObjectStats* stats_;
   MarkCompactCollector::NonAtomicMarkingState* marking_state_;
   std::unordered_set<HeapObject*> virtual_objects_;
+  FieldStatsCollector field_stats_collector_;
 };
 
 ObjectStatsCollectorImpl::ObjectStatsCollectorImpl(Heap* heap,
@@ -273,7 +396,10 @@ ObjectStatsCollectorImpl::ObjectStatsCollectorImpl(Heap* heap,
     : heap_(heap),
       stats_(stats),
       marking_state_(
-          heap->mark_compact_collector()->non_atomic_marking_state()) {}
+          heap->mark_compact_collector()->non_atomic_marking_state()),
+      field_stats_collector_(
+          &stats->tagged_fields_count_, &stats->embedder_fields_count_,
+          &stats->unboxed_double_fields_count_, &stats->raw_fields_count_) {}
 
 bool ObjectStatsCollectorImpl::ShouldRecordObject(HeapObject* obj,
                                                   CowMode check_cow_array) {
@@ -282,7 +408,7 @@ bool ObjectStatsCollectorImpl::ShouldRecordObject(HeapObject* obj,
     bool cow_check = check_cow_array == kIgnoreCow || !IsCowArray(fixed_array);
     return CanRecordFixedArray(fixed_array) && cow_check;
   }
-  if (obj == heap_->empty_property_array()) return false;
+  if (obj == ReadOnlyRoots(heap_).empty_property_array()) return false;
   return true;
 }
 
@@ -406,7 +532,10 @@ void ObjectStatsCollectorImpl::RecordVirtualJSObjectDetails(JSObject* object) {
 }
 
 static ObjectStats::VirtualInstanceType GetFeedbackSlotType(
-    Object* obj, FeedbackSlotKind kind, Isolate* isolate) {
+    MaybeObject* maybe_obj, FeedbackSlotKind kind, Isolate* isolate) {
+  if (maybe_obj->IsClearedWeakHeapObject())
+    return ObjectStats::FEEDBACK_VECTOR_SLOT_OTHER_TYPE;
+  Object* obj = maybe_obj->GetHeapObjectOrSmi();
   switch (kind) {
     case FeedbackSlotKind::kCall:
       if (obj == *isolate->factory()->uninitialized_symbol() ||
@@ -465,6 +594,8 @@ void ObjectStatsCollectorImpl::RecordVirtualFeedbackVectorDetails(
     calculated_size += header_size;
 
     // Iterate over the feedback slots and log each one.
+    if (!vector->shared_function_info()->HasFeedbackMetadata()) return;
+
     FeedbackMetadataIterator it(vector->metadata());
     while (it.HasNext()) {
       FeedbackSlot slot = it.Next();
@@ -477,10 +608,10 @@ void ObjectStatsCollectorImpl::RecordVirtualFeedbackVectorDetails(
 
       // Log the monomorphic/polymorphic helper objects that this slot owns.
       for (int i = 0; i < it.entry_size(); i++) {
-        Object* raw_object = vector->get(slot.ToInt() + i);
-        if (!raw_object->IsHeapObject()) continue;
-        HeapObject* object = HeapObject::cast(raw_object);
-        if (object->IsCell() || object->IsFixedArrayExact()) {
+        MaybeObject* raw_object = vector->get(slot.ToInt() + i);
+        if (!raw_object->IsStrongOrWeakHeapObject()) continue;
+        HeapObject* object = raw_object->GetHeapObject();
+        if (object->IsCell() || object->IsWeakFixedArray()) {
           RecordSimpleVirtualObjectStats(
               vector, object, ObjectStats::FEEDBACK_VECTOR_ENTRY_TYPE);
         }
@@ -500,7 +631,8 @@ void ObjectStatsCollectorImpl::RecordVirtualFixedArrayDetails(
   }
 }
 
-void ObjectStatsCollectorImpl::CollectStatistics(HeapObject* obj, Phase phase) {
+void ObjectStatsCollectorImpl::CollectStatistics(
+    HeapObject* obj, Phase phase, CollectFieldStats collect_field_stats) {
   Map* map = obj->map();
   switch (phase) {
     case kPhase1:
@@ -531,6 +663,9 @@ void ObjectStatsCollectorImpl::CollectStatistics(HeapObject* obj, Phase phase) {
         RecordVirtualContext(Context::cast(obj));
       } else if (obj->IsScript()) {
         RecordVirtualScriptDetails(Script::cast(obj));
+      } else if (obj->IsArrayBoilerplateDescription()) {
+        RecordVirtualArrayBoilerplateDescription(
+            ArrayBoilerplateDescription::cast(obj));
       } else if (obj->IsFixedArrayExact()) {
         // Has to go last as it triggers too eagerly.
         RecordVirtualFixedArrayDetails(FixedArray::cast(obj));
@@ -538,6 +673,9 @@ void ObjectStatsCollectorImpl::CollectStatistics(HeapObject* obj, Phase phase) {
       break;
     case kPhase2:
       RecordObjectStats(obj, map->instance_type(), obj->Size());
+      if (collect_field_stats == CollectFieldStats::kYes) {
+        field_stats_collector_.RecordStats(obj);
+      }
       break;
   }
 }
@@ -576,8 +714,6 @@ void ObjectStatsCollectorImpl::CollectGlobalStatistics() {
       ObjectStats::SCRIPT_LIST_TYPE);
 
   // HashTable.
-  RecordHashTableVirtualObjectStats(nullptr, heap_->string_table(),
-                                    ObjectStats::STRING_TABLE_TYPE);
   RecordHashTableVirtualObjectStats(nullptr, heap_->code_stubs(),
                                     ObjectStats::CODE_STUBS_TABLE_TYPE);
 }
@@ -591,14 +727,15 @@ void ObjectStatsCollectorImpl::RecordObjectStats(HeapObject* obj,
 }
 
 bool ObjectStatsCollectorImpl::CanRecordFixedArray(FixedArrayBase* array) {
-  return array != heap_->empty_fixed_array() &&
-         array != heap_->empty_sloppy_arguments_elements() &&
-         array != heap_->empty_slow_element_dictionary() &&
+  ReadOnlyRoots roots(heap_);
+  return array != roots.empty_fixed_array() &&
+         array != roots.empty_sloppy_arguments_elements() &&
+         array != roots.empty_slow_element_dictionary() &&
          array != heap_->empty_property_dictionary();
 }
 
 bool ObjectStatsCollectorImpl::IsCowArray(FixedArrayBase* array) {
-  return array->map() == heap_->fixed_cow_array_map();
+  return array->map() == ReadOnlyRoots(heap_).fixed_cow_array_map();
 }
 
 bool ObjectStatsCollectorImpl::SameLiveness(HeapObject* obj1,
@@ -611,7 +748,8 @@ void ObjectStatsCollectorImpl::RecordVirtualMapDetails(Map* map) {
   // TODO(mlippautz): map->dependent_code(): DEPENDENT_CODE_TYPE.
 
   DescriptorArray* array = map->instance_descriptors();
-  if (map->owns_descriptors() && array != heap_->empty_descriptor_array()) {
+  if (map->owns_descriptors() &&
+      array != ReadOnlyRoots(heap_).empty_descriptor_array()) {
     // DescriptorArray has its own instance type.
     EnumCache* enum_cache = array->GetEnumCache();
     RecordSimpleVirtualObjectStats(array, enum_cache->keys(),
@@ -643,10 +781,7 @@ void ObjectStatsCollectorImpl::RecordVirtualScriptDetails(Script* script) {
     // The contents of external strings aren't on the heap, so we have to record
     // them manually.
     ExternalString* external_source_string = ExternalString::cast(source);
-    size_t length_multiplier = external_source_string->IsTwoByteRepresentation()
-                                   ? kShortSize
-                                   : kCharSize;
-    size_t off_heap_size = external_source_string->length() * length_multiplier;
+    size_t off_heap_size = external_source_string->ExternalPayloadSize();
     size_t on_heap_size = external_source_string->Size();
     RecordVirtualObjectStats(script, external_source_string,
                              ObjectStats::SCRIPT_SOURCE_EXTERNAL_TYPE,
@@ -676,17 +811,13 @@ void ObjectStatsCollectorImpl::RecordVirtualJSFunctionDetails(
                                    ObjectStats::UNCOMPILED_JS_FUNCTION_TYPE);
   }
 }
-
-namespace {
-
-bool MatchesConstantElementsPair(Object* object) {
-  if (!object->IsTuple2()) return false;
-  Tuple2* tuple = Tuple2::cast(object);
-  return tuple->value1()->IsSmi() && tuple->value2()->IsFixedArrayExact();
+void ObjectStatsCollectorImpl::RecordVirtualArrayBoilerplateDescription(
+    ArrayBoilerplateDescription* description) {
+  RecordVirtualObjectsForConstantPoolOrEmbeddedObjects(
+      description, description->constant_elements(),
+      ObjectStats::ARRAY_BOILERPLATE_DESCRIPTION_ELEMENTS_TYPE);
 }
 
-}  // namespace
-
 void ObjectStatsCollectorImpl::
     RecordVirtualObjectsForConstantPoolOrEmbeddedObjects(
         HeapObject* parent, HeapObject* object,
@@ -700,10 +831,6 @@ void ObjectStatsCollectorImpl::
       RecordVirtualObjectsForConstantPoolOrEmbeddedObjects(
           array, HeapObject::cast(entry), type);
     }
-  } else if (MatchesConstantElementsPair(object)) {
-    Tuple2* tuple = Tuple2::cast(object);
-    RecordVirtualObjectsForConstantPoolOrEmbeddedObjects(
-        tuple, HeapObject::cast(tuple->value2()), type);
   }
 }
 
@@ -717,7 +844,7 @@ void ObjectStatsCollectorImpl::RecordVirtualBytecodeArrayDetails(
   FixedArray* constant_pool = FixedArray::cast(bytecode->constant_pool());
   for (int i = 0; i < constant_pool->length(); i++) {
     Object* entry = constant_pool->get(i);
-    if (entry->IsFixedArrayExact() || MatchesConstantElementsPair(entry)) {
+    if (entry->IsFixedArrayExact()) {
       RecordVirtualObjectsForConstantPoolOrEmbeddedObjects(
           constant_pool, HeapObject::cast(entry),
           ObjectStats::EMBEDDED_OBJECT_TYPE);
@@ -751,6 +878,20 @@ void ObjectStatsCollectorImpl::RecordVirtualCodeDetails(Code* code) {
                                  CodeKindToVirtualInstanceType(code->kind()));
   RecordSimpleVirtualObjectStats(code, code->deoptimization_data(),
                                  ObjectStats::DEOPTIMIZATION_DATA_TYPE);
+  RecordSimpleVirtualObjectStats(code, code->relocation_info(),
+                                 ObjectStats::RELOC_INFO_TYPE);
+  Object* source_position_table = code->source_position_table();
+  if (source_position_table->IsSourcePositionTableWithFrameCache()) {
+    RecordSimpleVirtualObjectStats(
+        code,
+        SourcePositionTableWithFrameCache::cast(source_position_table)
+            ->source_position_table(),
+        ObjectStats::SOURCE_POSITION_TABLE_TYPE);
+  } else if (source_position_table->IsHeapObject()) {
+    RecordSimpleVirtualObjectStats(code,
+                                   HeapObject::cast(source_position_table),
+                                   ObjectStats::SOURCE_POSITION_TABLE_TYPE);
+  }
   if (code->kind() == Code::Kind::OPTIMIZED_FUNCTION) {
     DeoptimizationData* input_data =
         DeoptimizationData::cast(code->deoptimization_data());
@@ -765,7 +906,7 @@ void ObjectStatsCollectorImpl::RecordVirtualCodeDetails(Code* code) {
     RelocInfo::Mode mode = it.rinfo()->rmode();
     if (mode == RelocInfo::EMBEDDED_OBJECT) {
       Object* target = it.rinfo()->target_object();
-      if (target->IsFixedArrayExact() || MatchesConstantElementsPair(target)) {
+      if (target->IsFixedArrayExact()) {
         RecordVirtualObjectsForConstantPoolOrEmbeddedObjects(
             code, HeapObject::cast(target), ObjectStats::EMBEDDED_OBJECT_TYPE);
       }
@@ -797,10 +938,12 @@ class ObjectStatsVisitor {
 
   bool Visit(HeapObject* obj, int size) {
     if (marking_state_->IsBlack(obj)) {
-      live_collector_->CollectStatistics(obj, phase_);
+      live_collector_->CollectStatistics(
+          obj, phase_, ObjectStatsCollectorImpl::CollectFieldStats::kYes);
     } else {
       DCHECK(!marking_state_->IsGrey(obj));
-      dead_collector_->CollectStatistics(obj, phase_);
+      dead_collector_->CollectStatistics(
+          obj, phase_, ObjectStatsCollectorImpl::CollectFieldStats::kNo);
     }
     return true;
   }
diff --git a/deps/v8/src/heap/object-stats.h b/deps/v8/src/heap/object-stats.h
index 3648b9985bc3fe..a21b7f749f31a4 100644
--- a/deps/v8/src/heap/object-stats.h
+++ b/deps/v8/src/heap/object-stats.h
@@ -14,56 +14,58 @@
 // tracing.
 //
 // Update LAST_VIRTUAL_TYPE below when changing this macro.
-#define VIRTUAL_INSTANCE_TYPE_LIST(V)       \
-  CODE_KIND_LIST(V)                         \
-  V(BOILERPLATE_ELEMENTS_TYPE)              \
-  V(BOILERPLATE_PROPERTY_ARRAY_TYPE)        \
-  V(BOILERPLATE_PROPERTY_DICTIONARY_TYPE)   \
-  V(BYTECODE_ARRAY_CONSTANT_POOL_TYPE)      \
-  V(BYTECODE_ARRAY_HANDLER_TABLE_TYPE)      \
-  V(CODE_STUBS_TABLE_TYPE)                  \
-  V(COW_ARRAY_TYPE)                         \
-  V(DEOPTIMIZATION_DATA_TYPE)               \
-  V(DEPENDENT_CODE_TYPE)                    \
-  V(ELEMENTS_TYPE)                          \
-  V(EMBEDDED_OBJECT_TYPE)                   \
-  V(ENUM_CACHE_TYPE)                        \
-  V(ENUM_INDICES_CACHE_TYPE)                \
-  V(FEEDBACK_VECTOR_ENTRY_TYPE)             \
-  V(FEEDBACK_VECTOR_HEADER_TYPE)            \
-  V(FEEDBACK_VECTOR_SLOT_CALL_TYPE)         \
-  V(FEEDBACK_VECTOR_SLOT_CALL_UNUSED_TYPE)  \
-  V(FEEDBACK_VECTOR_SLOT_ENUM_TYPE)         \
-  V(FEEDBACK_VECTOR_SLOT_LOAD_TYPE)         \
-  V(FEEDBACK_VECTOR_SLOT_LOAD_UNUSED_TYPE)  \
-  V(FEEDBACK_VECTOR_SLOT_OTHER_TYPE)        \
-  V(FEEDBACK_VECTOR_SLOT_STORE_TYPE)        \
-  V(FEEDBACK_VECTOR_SLOT_STORE_UNUSED_TYPE) \
-  V(FUNCTION_TEMPLATE_INFO_ENTRIES_TYPE)    \
-  V(GLOBAL_ELEMENTS_TYPE)                   \
-  V(GLOBAL_PROPERTIES_TYPE)                 \
-  V(JS_ARRAY_BOILERPLATE_TYPE)              \
-  V(JS_COLLETION_TABLE_TYPE)                \
-  V(JS_OBJECT_BOILERPLATE_TYPE)             \
-  V(NOSCRIPT_SHARED_FUNCTION_INFOS_TYPE)    \
-  V(NUMBER_STRING_CACHE_TYPE)               \
-  V(OBJECT_PROPERTY_DICTIONARY_TYPE)        \
-  V(OBJECT_TO_CODE_TYPE)                    \
-  V(OPTIMIZED_CODE_LITERALS_TYPE)           \
-  V(OTHER_CONTEXT_TYPE)                     \
-  V(PROTOTYPE_USERS_TYPE)                   \
-  V(REGEXP_MULTIPLE_CACHE_TYPE)             \
-  V(RETAINED_MAPS_TYPE)                     \
-  V(SCRIPT_LIST_TYPE)                       \
-  V(SCRIPT_SHARED_FUNCTION_INFOS_TYPE)      \
-  V(SCRIPT_SOURCE_EXTERNAL_TYPE)            \
-  V(SCRIPT_SOURCE_NON_EXTERNAL_TYPE)        \
-  V(SERIALIZED_OBJECTS_TYPE)                \
-  V(SINGLE_CHARACTER_STRING_CACHE_TYPE)     \
-  V(STRING_SPLIT_CACHE_TYPE)                \
-  V(STRING_TABLE_TYPE)                      \
-  V(UNCOMPILED_JS_FUNCTION_TYPE)            \
-  V(UNCOMPILED_SHARED_FUNCTION_INFO_TYPE)   \
+#define VIRTUAL_INSTANCE_TYPE_LIST(V)            \
+  CODE_KIND_LIST(V)                              \
+  V(ARRAY_BOILERPLATE_DESCRIPTION_ELEMENTS_TYPE) \
+  V(BOILERPLATE_ELEMENTS_TYPE)                   \
+  V(BOILERPLATE_PROPERTY_ARRAY_TYPE)             \
+  V(BOILERPLATE_PROPERTY_DICTIONARY_TYPE)        \
+  V(BYTECODE_ARRAY_CONSTANT_POOL_TYPE)           \
+  V(BYTECODE_ARRAY_HANDLER_TABLE_TYPE)           \
+  V(CODE_STUBS_TABLE_TYPE)                       \
+  V(COW_ARRAY_TYPE)                              \
+  V(DEOPTIMIZATION_DATA_TYPE)                    \
+  V(DEPENDENT_CODE_TYPE)                         \
+  V(ELEMENTS_TYPE)                               \
+  V(EMBEDDED_OBJECT_TYPE)                        \
+  V(ENUM_CACHE_TYPE)                             \
+  V(ENUM_INDICES_CACHE_TYPE)                     \
+  V(FEEDBACK_VECTOR_ENTRY_TYPE)                  \
+  V(FEEDBACK_VECTOR_HEADER_TYPE)                 \
+  V(FEEDBACK_VECTOR_SLOT_CALL_TYPE)              \
+  V(FEEDBACK_VECTOR_SLOT_CALL_UNUSED_TYPE)       \
+  V(FEEDBACK_VECTOR_SLOT_ENUM_TYPE)              \
+  V(FEEDBACK_VECTOR_SLOT_LOAD_TYPE)              \
+  V(FEEDBACK_VECTOR_SLOT_LOAD_UNUSED_TYPE)       \
+  V(FEEDBACK_VECTOR_SLOT_OTHER_TYPE)             \
+  V(FEEDBACK_VECTOR_SLOT_STORE_TYPE)             \
+  V(FEEDBACK_VECTOR_SLOT_STORE_UNUSED_TYPE)      \
+  V(FUNCTION_TEMPLATE_INFO_ENTRIES_TYPE)         \
+  V(GLOBAL_ELEMENTS_TYPE)                        \
+  V(GLOBAL_PROPERTIES_TYPE)                      \
+  V(JS_ARRAY_BOILERPLATE_TYPE)                   \
+  V(JS_COLLETION_TABLE_TYPE)                     \
+  V(JS_OBJECT_BOILERPLATE_TYPE)                  \
+  V(NOSCRIPT_SHARED_FUNCTION_INFOS_TYPE)         \
+  V(NUMBER_STRING_CACHE_TYPE)                    \
+  V(OBJECT_PROPERTY_DICTIONARY_TYPE)             \
+  V(OBJECT_TO_CODE_TYPE)                         \
+  V(OPTIMIZED_CODE_LITERALS_TYPE)                \
+  V(OTHER_CONTEXT_TYPE)                          \
+  V(PROTOTYPE_USERS_TYPE)                        \
+  V(REGEXP_MULTIPLE_CACHE_TYPE)                  \
+  V(RELOC_INFO_TYPE)                             \
+  V(RETAINED_MAPS_TYPE)                          \
+  V(SCRIPT_LIST_TYPE)                            \
+  V(SCRIPT_SHARED_FUNCTION_INFOS_TYPE)           \
+  V(SCRIPT_SOURCE_EXTERNAL_TYPE)                 \
+  V(SCRIPT_SOURCE_NON_EXTERNAL_TYPE)             \
+  V(SERIALIZED_OBJECTS_TYPE)                     \
+  V(SINGLE_CHARACTER_STRING_CACHE_TYPE)          \
+  V(STRING_SPLIT_CACHE_TYPE)                     \
+  V(SOURCE_POSITION_TABLE_TYPE)                  \
+  V(UNCOMPILED_JS_FUNCTION_TYPE)                 \
+  V(UNCOMPILED_SHARED_FUNCTION_INFO_TYPE)        \
   V(WEAK_NEW_SPACE_OBJECT_TO_CODE_TYPE)
 
 namespace v8 {
@@ -144,6 +146,13 @@ class ObjectStats {
   // Detailed histograms by InstanceType.
   size_t size_histogram_[OBJECT_STATS_COUNT][kNumberOfBuckets];
   size_t over_allocated_histogram_[OBJECT_STATS_COUNT][kNumberOfBuckets];
+
+  size_t tagged_fields_count_;
+  size_t embedder_fields_count_;
+  size_t unboxed_double_fields_count_;
+  size_t raw_fields_count_;
+
+  friend class ObjectStatsCollectorImpl;
 };
 
 class ObjectStatsCollector {
diff --git a/deps/v8/src/heap/objects-visiting-inl.h b/deps/v8/src/heap/objects-visiting-inl.h
index b47dba7830542f..54229416b703f4 100644
--- a/deps/v8/src/heap/objects-visiting-inl.h
+++ b/deps/v8/src/heap/objects-visiting-inl.h
@@ -56,6 +56,8 @@ ResultType HeapVisitor<ResultType, ConcreteVisitor>::Visit(Map* map,
       return visitor->VisitStruct(map, object);
     case kVisitFreeSpace:
       return visitor->VisitFreeSpace(map, FreeSpace::cast(object));
+    case kVisitWeakArray:
+      return visitor->VisitWeakArray(map, object);
     case kVisitorIdCount:
       UNREACHABLE();
   }
@@ -191,6 +193,18 @@ int NewSpaceVisitor<ConcreteVisitor>::VisitJSApiObject(Map* map,
   return visitor->VisitJSObject(map, object);
 }
 
+template <typename ResultType, typename ConcreteVisitor>
+ResultType HeapVisitor<ResultType, ConcreteVisitor>::VisitWeakArray(
+    Map* map, HeapObject* object) {
+  ConcreteVisitor* visitor = static_cast<ConcreteVisitor*>(this);
+  if (!visitor->ShouldVisit(object)) return ResultType();
+  int size = WeakArrayBodyDescriptor::SizeOf(map, object);
+  if (visitor->ShouldVisitMapPointer())
+    visitor->VisitMapPointer(object, object->map_slot());
+  WeakArrayBodyDescriptor::IterateBody(map, object, size, visitor);
+  return size;
+}
+
 }  // namespace internal
 }  // namespace v8
 
diff --git a/deps/v8/src/heap/objects-visiting.cc b/deps/v8/src/heap/objects-visiting.cc
index c7c384f52a1e57..594b837f698150 100644
--- a/deps/v8/src/heap/objects-visiting.cc
+++ b/deps/v8/src/heap/objects-visiting.cc
@@ -27,7 +27,7 @@ struct WeakListVisitor;
 
 template <class T>
 Object* VisitWeakList(Heap* heap, Object* list, WeakObjectRetainer* retainer) {
-  Object* undefined = heap->undefined_value();
+  Object* undefined = ReadOnlyRoots(heap).undefined_value();
   Object* head = undefined;
   T* tail = nullptr;
   bool record_slots = MustRecordSlots(heap);
@@ -53,7 +53,8 @@ Object* VisitWeakList(Heap* heap, Object* list, WeakObjectRetainer* retainer) {
           HeapObject* slot_holder = WeakListVisitor<T>::WeakNextHolder(tail);
           int slot_offset = WeakListVisitor<T>::WeakNextOffset();
           Object** slot = HeapObject::RawField(slot_holder, slot_offset);
-          MarkCompactCollector::RecordSlot(slot_holder, slot, retained);
+          MarkCompactCollector::RecordSlot(slot_holder, slot,
+                                           HeapObject::cast(retained));
         }
       }
       // Retained object is new tail.
@@ -77,7 +78,7 @@ Object* VisitWeakList(Heap* heap, Object* list, WeakObjectRetainer* retainer) {
 
 template <class T>
 static void ClearWeakList(Heap* heap, Object* list) {
-  Object* undefined = heap->undefined_value();
+  Object* undefined = ReadOnlyRoots(heap).undefined_value();
   while (list != undefined) {
     T* candidate = reinterpret_cast<T*>(list);
     list = WeakListVisitor<T>::WeakNext(candidate);
@@ -107,7 +108,7 @@ struct WeakListVisitor<Code> {
   static void VisitPhantomObject(Heap* heap, Code* code) {
     // Even though the code is dying, its code_data_container can still be
     // alive. Clear the next_code_link slot to avoid a dangling pointer.
-    SetWeakNext(code, heap->undefined_value());
+    SetWeakNext(code, ReadOnlyRoots(heap).undefined_value());
   }
 };
 
@@ -135,7 +136,8 @@ struct WeakListVisitor<Context> {
       for (int idx = Context::FIRST_WEAK_SLOT;
            idx < Context::NATIVE_CONTEXT_SLOTS; ++idx) {
         Object** slot = Context::cast(context)->RawFieldOfElementAt(idx);
-        MarkCompactCollector::RecordSlot(context, slot, *slot);
+        MarkCompactCollector::RecordSlot(context, slot,
+                                         HeapObject::cast(*slot));
       }
       // Code objects are always allocated in Code space, we do not have to
       // visit them during scavenges.
@@ -157,7 +159,8 @@ struct WeakListVisitor<Context> {
       // Record the updated slot if necessary.
       Object** head_slot =
           HeapObject::RawField(context, FixedArray::SizeFor(index));
-      heap->mark_compact_collector()->RecordSlot(context, head_slot, list_head);
+      heap->mark_compact_collector()->RecordSlot(context, head_slot,
+                                                 HeapObject::cast(list_head));
     }
   }
 
diff --git a/deps/v8/src/heap/objects-visiting.h b/deps/v8/src/heap/objects-visiting.h
index 88e38dcb0c8839..410dbeba9faa9e 100644
--- a/deps/v8/src/heap/objects-visiting.h
+++ b/deps/v8/src/heap/objects-visiting.h
@@ -10,6 +10,7 @@
 #include "src/objects-body-descriptors.h"
 #include "src/objects.h"
 #include "src/objects/hash-table.h"
+#include "src/objects/ordered-hash-table.h"
 #include "src/objects/string.h"
 #include "src/visitors.h"
 
@@ -18,45 +19,50 @@ namespace internal {
 
 class BigInt;
 class BytecodeArray;
+class DataHandler;
 class JSArrayBuffer;
 class JSRegExp;
 class JSWeakCollection;
-
-#define TYPED_VISITOR_ID_LIST(V) \
-  V(AllocationSite)              \
-  V(BigInt)                      \
-  V(ByteArray)                   \
-  V(BytecodeArray)               \
-  V(Cell)                        \
-  V(Code)                        \
-  V(CodeDataContainer)           \
-  V(ConsString)                  \
-  V(FeedbackCell)                \
-  V(FeedbackVector)              \
-  V(FixedArray)                  \
-  V(FixedDoubleArray)            \
-  V(FixedFloat64Array)           \
-  V(FixedTypedArrayBase)         \
-  V(JSArrayBuffer)               \
-  V(JSFunction)                  \
-  V(JSObject)                    \
-  V(JSWeakCollection)            \
-  V(Map)                         \
-  V(Oddball)                     \
-  V(PropertyArray)               \
-  V(PropertyCell)                \
-  V(SeqOneByteString)            \
-  V(SeqTwoByteString)            \
-  V(SharedFunctionInfo)          \
-  V(SlicedString)                \
-  V(SmallOrderedHashMap)         \
-  V(SmallOrderedHashSet)         \
-  V(Symbol)                      \
-  V(ThinString)                  \
-  V(TransitionArray)             \
-  V(WasmInstanceObject)          \
-  V(WeakCell)                    \
-  V(WeakFixedArray)
+class UncompiledDataWithPreParsedScope;
+
+#define TYPED_VISITOR_ID_LIST(V)      \
+  V(AllocationSite)                   \
+  V(BigInt)                           \
+  V(ByteArray)                        \
+  V(BytecodeArray)                    \
+  V(Cell)                             \
+  V(Code)                             \
+  V(CodeDataContainer)                \
+  V(ConsString)                       \
+  V(DataHandler)                      \
+  V(EphemeronHashTable)               \
+  V(FeedbackCell)                     \
+  V(FeedbackVector)                   \
+  V(FixedArray)                       \
+  V(FixedDoubleArray)                 \
+  V(FixedFloat64Array)                \
+  V(FixedTypedArrayBase)              \
+  V(JSArrayBuffer)                    \
+  V(JSFunction)                       \
+  V(JSObject)                         \
+  V(JSWeakCollection)                 \
+  V(Map)                              \
+  V(Oddball)                          \
+  V(PropertyArray)                    \
+  V(PropertyCell)                     \
+  V(PrototypeInfo)                    \
+  V(SeqOneByteString)                 \
+  V(SeqTwoByteString)                 \
+  V(SharedFunctionInfo)               \
+  V(SlicedString)                     \
+  V(SmallOrderedHashMap)              \
+  V(SmallOrderedHashSet)              \
+  V(Symbol)                           \
+  V(ThinString)                       \
+  V(TransitionArray)                  \
+  V(UncompiledDataWithPreParsedScope) \
+  V(WasmInstanceObject)               \
+  V(WeakCell)
 
 // The base class for visitors that need to dispatch on object type. The default
 // behavior of all visit functions is to iterate body of the given object using
@@ -98,6 +104,7 @@ class HeapVisitor : public ObjectVisitor {
   V8_INLINE ResultType VisitJSApiObject(Map* map, JSObject* object);
   V8_INLINE ResultType VisitStruct(Map* map, HeapObject* object);
   V8_INLINE ResultType VisitFreeSpace(Map* map, FreeSpace* object);
+  V8_INLINE ResultType VisitWeakArray(Map* map, HeapObject* object);
 
   template <typename T>
   static V8_INLINE T* Cast(HeapObject* object);
diff --git a/deps/v8/src/heap/remembered-set.h b/deps/v8/src/heap/remembered-set.h
index 45a6422204744e..95b7b5b9d51e72 100644
--- a/deps/v8/src/heap/remembered-set.h
+++ b/deps/v8/src/heap/remembered-set.h
@@ -196,7 +196,7 @@ class RememberedSet : public AllStatic {
     if (slot_set == nullptr) {
       slot_set = page->AllocateTypedSlotSet<type>();
     }
-    if (host_addr == nullptr) {
+    if (host_addr == kNullAddress) {
       host_addr = page->address();
     }
     uintptr_t offset = slot_addr - page->address();
@@ -295,7 +295,7 @@ class UpdateTypedSlotHelper {
   template <typename Callback>
   static SlotCallbackResult UpdateCodeTarget(RelocInfo* rinfo,
                                              Callback callback) {
-    DCHECK(RelocInfo::IsCodeTarget(rinfo->rmode()));
+    DCHECK(RelocInfo::IsCodeTargetMode(rinfo->rmode()));
     Code* old_target = Code::GetCodeFromTargetAddress(rinfo->target_address());
     Object* new_target = old_target;
     SlotCallbackResult result =
@@ -311,7 +311,7 @@ class UpdateTypedSlotHelper {
   // Updates an embedded pointer slot using an untyped slot callback.
   // The callback accepts Object** and returns SlotCallbackResult.
   template <typename Callback>
-  static SlotCallbackResult UpdateEmbeddedPointer(RelocInfo* rinfo,
+  static SlotCallbackResult UpdateEmbeddedPointer(Heap* heap, RelocInfo* rinfo,
                                                   Callback callback) {
     DCHECK(rinfo->rmode() == RelocInfo::EMBEDDED_OBJECT);
     HeapObject* old_target = rinfo->target_object();
@@ -320,7 +320,7 @@ class UpdateTypedSlotHelper {
         callback(reinterpret_cast<MaybeObject**>(&new_target));
     DCHECK(!HasWeakHeapObjectTag(new_target));
     if (new_target != old_target) {
-      rinfo->set_target_object(HeapObject::cast(new_target));
+      rinfo->set_target_object(heap, HeapObject::cast(new_target));
     }
     return result;
   }
@@ -328,9 +328,8 @@ class UpdateTypedSlotHelper {
   // Updates a typed slot using an untyped slot callback.
   // The callback accepts MaybeObject** and returns SlotCallbackResult.
   template <typename Callback>
-  static SlotCallbackResult UpdateTypedSlot(Isolate* isolate,
-                                            SlotType slot_type, Address addr,
-                                            Callback callback) {
+  static SlotCallbackResult UpdateTypedSlot(Heap* heap, SlotType slot_type,
+                                            Address addr, Callback callback) {
     switch (slot_type) {
       case CODE_TARGET_SLOT: {
         RelocInfo rinfo(addr, RelocInfo::CODE_TARGET, 0, nullptr);
@@ -341,7 +340,7 @@ class UpdateTypedSlotHelper {
       }
       case EMBEDDED_OBJECT_SLOT: {
         RelocInfo rinfo(addr, RelocInfo::EMBEDDED_OBJECT, 0, nullptr);
-        return UpdateEmbeddedPointer(&rinfo, callback);
+        return UpdateEmbeddedPointer(heap, &rinfo, callback);
       }
       case OBJECT_SLOT: {
         return callback(reinterpret_cast<MaybeObject**>(addr));
@@ -354,7 +353,7 @@ class UpdateTypedSlotHelper {
 };
 
 inline SlotType SlotTypeForRelocInfoMode(RelocInfo::Mode rmode) {
-  if (RelocInfo::IsCodeTarget(rmode)) {
+  if (RelocInfo::IsCodeTargetMode(rmode)) {
     return CODE_TARGET_SLOT;
   } else if (RelocInfo::IsEmbeddedObject(rmode)) {
     return EMBEDDED_OBJECT_SLOT;
diff --git a/deps/v8/src/heap/scavenger-inl.h b/deps/v8/src/heap/scavenger-inl.h
index 4b07f16d1192e3..e581ebe571db4d 100644
--- a/deps/v8/src/heap/scavenger-inl.h
+++ b/deps/v8/src/heap/scavenger-inl.h
@@ -150,7 +150,7 @@ void Scavenger::EvacuateThinString(Map* map, HeapObject** slot,
     *slot = actual;
     // ThinStrings always refer to internalized strings, which are
     // always in old space.
-    DCHECK(!heap()->InNewSpace(actual));
+    DCHECK(!Heap::InNewSpace(actual));
     base::AsAtomicPointer::Relaxed_Store(
         reinterpret_cast<Map**>(object->address()),
         MapWord::FromForwardingAddress(actual).ToMap());
@@ -165,12 +165,12 @@ void Scavenger::EvacuateShortcutCandidate(Map* map, HeapObject** slot,
                                           ConsString* object, int object_size) {
   DCHECK(IsShortcutCandidate(map->instance_type()));
   if (!is_incremental_marking_ &&
-      object->unchecked_second() == heap()->empty_string()) {
+      object->unchecked_second() == ReadOnlyRoots(heap()).empty_string()) {
     HeapObject* first = HeapObject::cast(object->unchecked_first());
 
     *slot = first;
 
-    if (!heap()->InNewSpace(first)) {
+    if (!Heap::InNewSpace(first)) {
       base::AsAtomicPointer::Relaxed_Store(
           reinterpret_cast<Map**>(object->address()),
           MapWord::FromForwardingAddress(first).ToMap());
@@ -202,7 +202,7 @@ void Scavenger::EvacuateShortcutCandidate(Map* map, HeapObject** slot,
 
 void Scavenger::EvacuateObject(HeapObjectReference** slot, Map* map,
                                HeapObject* source) {
-  SLOW_DCHECK(heap_->InFromSpace(source));
+  SLOW_DCHECK(Heap::InFromSpace(source));
   SLOW_DCHECK(!MapWord::FromMap(map).IsForwardingAddress());
   int size = source->SizeFromMap(map);
   // Cannot use ::cast() below because that would add checks in debug mode
@@ -227,7 +227,7 @@ void Scavenger::EvacuateObject(HeapObjectReference** slot, Map* map,
 }
 
 void Scavenger::ScavengeObject(HeapObjectReference** p, HeapObject* object) {
-  DCHECK(heap()->InFromSpace(object));
+  DCHECK(Heap::InFromSpace(object));
 
   // Synchronized load that consumes the publishing CAS of MigrateObject.
   MapWord first_word = object->synchronized_map_word();
@@ -236,7 +236,7 @@ void Scavenger::ScavengeObject(HeapObjectReference** p, HeapObject* object) {
   // copied.
   if (first_word.IsForwardingAddress()) {
     HeapObject* dest = first_word.ToForwardingAddress();
-    DCHECK(heap()->InFromSpace(*p));
+    DCHECK(Heap::InFromSpace(*p));
     if ((*p)->IsWeakHeapObject()) {
       *p = HeapObjectReference::Weak(dest);
     } else {
@@ -248,7 +248,7 @@ void Scavenger::ScavengeObject(HeapObjectReference** p, HeapObject* object) {
 
   Map* map = first_word.ToMap();
   // AllocationMementos are unrooted and shouldn't survive a scavenge
-  DCHECK_NE(heap()->allocation_memento_map(), map);
+  DCHECK_NE(ReadOnlyRoots(heap()).allocation_memento_map(), map);
   // Call the slow part of scavenge object.
   EvacuateObject(p, map, object);
 }
@@ -257,7 +257,7 @@ SlotCallbackResult Scavenger::CheckAndScavengeObject(Heap* heap,
                                                      Address slot_address) {
   MaybeObject** slot = reinterpret_cast<MaybeObject**>(slot_address);
   MaybeObject* object = *slot;
-  if (heap->InFromSpace(object)) {
+  if (Heap::InFromSpace(object)) {
     HeapObject* heap_object;
     bool success = object->ToStrongOrWeakHeapObject(&heap_object);
     USE(success);
@@ -272,10 +272,10 @@ SlotCallbackResult Scavenger::CheckAndScavengeObject(Heap* heap,
     // Unfortunately, we do not know about the slot. It could be in a
     // just freed free space object.
     PageMemoryFence(object);
-    if (heap->InToSpace(object)) {
+    if (Heap::InToSpace(object)) {
       return KEEP_SLOT;
     }
-  } else if (heap->InToSpace(object)) {
+  } else if (Heap::InToSpace(object)) {
     // Already updated slot. This can happen when processing of the work list
     // is interleaved with processing roots.
     return KEEP_SLOT;
@@ -289,7 +289,7 @@ void ScavengeVisitor::VisitPointers(HeapObject* host, Object** start,
                                     Object** end) {
   for (Object** p = start; p < end; p++) {
     Object* object = *p;
-    if (!heap_->InNewSpace(object)) continue;
+    if (!Heap::InNewSpace(object)) continue;
     scavenger_->ScavengeObject(reinterpret_cast<HeapObjectReference**>(p),
                                reinterpret_cast<HeapObject*>(object));
   }
@@ -299,7 +299,7 @@ void ScavengeVisitor::VisitPointers(HeapObject* host, MaybeObject** start,
                                     MaybeObject** end) {
   for (MaybeObject** p = start; p < end; p++) {
     MaybeObject* object = *p;
-    if (!heap_->InNewSpace(object)) continue;
+    if (!Heap::InNewSpace(object)) continue;
     // Treat the weak reference as strong.
     HeapObject* heap_object;
     if (object->ToStrongOrWeakHeapObject(&heap_object)) {
diff --git a/deps/v8/src/heap/scavenger.cc b/deps/v8/src/heap/scavenger.cc
index cd6c53470401d3..d9f920ef7e310d 100644
--- a/deps/v8/src/heap/scavenger.cc
+++ b/deps/v8/src/heap/scavenger.cc
@@ -52,16 +52,16 @@ class IterateAndScavengePromotedObjectsVisitor final : public ObjectVisitor {
         reinterpret_cast<HeapObjectReference**>(slot_address);
     scavenger_->PageMemoryFence(reinterpret_cast<MaybeObject*>(target));
 
-    if (heap_->InFromSpace(target)) {
+    if (Heap::InFromSpace(target)) {
       scavenger_->ScavengeObject(slot, target);
       bool success = (*slot)->ToStrongOrWeakHeapObject(&target);
       USE(success);
       DCHECK(success);
       scavenger_->PageMemoryFence(reinterpret_cast<MaybeObject*>(target));
 
-      if (heap_->InNewSpace(target)) {
+      if (Heap::InNewSpace(target)) {
         SLOW_DCHECK(target->IsHeapObject());
-        SLOW_DCHECK(heap_->InToSpace(target));
+        SLOW_DCHECK(Heap::InToSpace(target));
         RememberedSet<OLD_TO_NEW>::Insert(Page::FromAddress(slot_address),
                                           slot_address);
       }
@@ -125,7 +125,7 @@ void Scavenger::ScavengePage(MemoryChunk* page) {
   RememberedSet<OLD_TO_NEW>::IterateTyped(
       page, [this](SlotType type, Address host_addr, Address addr) {
         return UpdateTypedSlotHelper::UpdateTypedSlot(
-            heap_->isolate(), type, addr, [this](MaybeObject** addr) {
+            heap_, type, addr, [this](MaybeObject** addr) {
               return CheckAndScavengeObject(heap(),
                                             reinterpret_cast<Address>(addr));
             });
@@ -139,7 +139,7 @@ void Scavenger::Process(OneshotBarrier* barrier) {
   // Threshold when to switch processing the promotion list to avoid
   // allocating too much backing store in the worklist.
   const int kProcessPromotionListThreshold = kPromotionListSegmentSize / 2;
-  ScavengeVisitor scavenge_visitor(heap(), this);
+  ScavengeVisitor scavenge_visitor(this);
 
   const bool have_barrier = barrier != nullptr;
   bool done;
@@ -196,7 +196,7 @@ void RootScavengeVisitor::VisitRootPointers(Root root, const char* description,
 void RootScavengeVisitor::ScavengePointer(Object** p) {
   Object* object = *p;
   DCHECK(!HasWeakHeapObjectTag(object));
-  if (!heap_->InNewSpace(object)) return;
+  if (!Heap::InNewSpace(object)) return;
 
   scavenger_->ScavengeObject(reinterpret_cast<HeapObjectReference**>(p),
                              reinterpret_cast<HeapObject*>(object));
diff --git a/deps/v8/src/heap/scavenger.h b/deps/v8/src/heap/scavenger.h
index de2f49f0e201c0..847a5b07fcd4ec 100644
--- a/deps/v8/src/heap/scavenger.h
+++ b/deps/v8/src/heap/scavenger.h
@@ -114,8 +114,7 @@ class Scavenger {
 // filtering out non-HeapObjects and objects which do not reside in new space.
 class RootScavengeVisitor final : public RootVisitor {
  public:
-  RootScavengeVisitor(Heap* heap, Scavenger* scavenger)
-      : heap_(heap), scavenger_(scavenger) {}
+  explicit RootScavengeVisitor(Scavenger* scavenger) : scavenger_(scavenger) {}
 
   void VisitRootPointer(Root root, const char* description, Object** p) final;
   void VisitRootPointers(Root root, const char* description, Object** start,
@@ -124,14 +123,12 @@ class RootScavengeVisitor final : public RootVisitor {
  private:
   void ScavengePointer(Object** p);
 
-  Heap* const heap_;
   Scavenger* const scavenger_;
 };
 
 class ScavengeVisitor final : public NewSpaceVisitor<ScavengeVisitor> {
  public:
-  ScavengeVisitor(Heap* heap, Scavenger* scavenger)
-      : heap_(heap), scavenger_(scavenger) {}
+  explicit ScavengeVisitor(Scavenger* scavenger) : scavenger_(scavenger) {}
 
   V8_INLINE void VisitPointers(HeapObject* host, Object** start,
                                Object** end) final;
@@ -139,7 +136,6 @@ class ScavengeVisitor final : public NewSpaceVisitor<ScavengeVisitor> {
                                MaybeObject** end) final;
 
  private:
-  Heap* const heap_;
   Scavenger* const scavenger_;
 };
 
diff --git a/deps/v8/src/heap/setup-heap-internal.cc b/deps/v8/src/heap/setup-heap-internal.cc
index ca6ce64e2faf58..38eb0efcb822b5 100644
--- a/deps/v8/src/heap/setup-heap-internal.cc
+++ b/deps/v8/src/heap/setup-heap-internal.cc
@@ -22,7 +22,9 @@
 #include "src/objects/descriptor-array.h"
 #include "src/objects/dictionary.h"
 #include "src/objects/map.h"
+#include "src/objects/microtask.h"
 #include "src/objects/module.h"
+#include "src/objects/promise.h"
 #include "src/objects/script.h"
 #include "src/objects/shared-function-info.h"
 #include "src/objects/string.h"
@@ -46,8 +48,8 @@ bool Heap::CreateHeapObjects() {
   CreateInternalAccessorInfoObjects();
   CHECK_EQ(0u, gc_count_);
 
-  set_native_contexts_list(undefined_value());
-  set_allocation_sites_list(undefined_value());
+  set_native_contexts_list(ReadOnlyRoots(this).undefined_value());
+  set_allocation_sites_list(ReadOnlyRoots(this).undefined_value());
 
   return true;
 }
@@ -72,9 +74,14 @@ const Heap::StructTable Heap::struct_table[] = {
     STRUCT_LIST(STRUCT_TABLE_ELEMENT)
 #undef STRUCT_TABLE_ELEMENT
 
+#define ALLOCATION_SITE_ELEMENT(NAME, Name, Size, name) \
+  {NAME##_TYPE, Name::kSize##Size, k##Name##Size##MapRootIndex},
+        ALLOCATION_SITE_LIST(ALLOCATION_SITE_ELEMENT)
+#undef ALLOCATION_SITE_ELEMENT
+
 #define DATA_HANDLER_ELEMENT(NAME, Name, Size, name) \
   {NAME##_TYPE, Name::kSizeWithData##Size, k##Name##Size##MapRootIndex},
-        DATA_HANDLER_LIST(DATA_HANDLER_ELEMENT)
+            DATA_HANDLER_LIST(DATA_HANDLER_ELEMENT)
 #undef DATA_HANDLER_ELEMENT
 };
 
@@ -83,24 +90,40 @@ AllocationResult Heap::AllocateMap(InstanceType instance_type,
                                    ElementsKind elements_kind,
                                    int inobject_properties) {
   STATIC_ASSERT(LAST_JS_OBJECT_TYPE == LAST_TYPE);
-  DCHECK_IMPLIES(instance_type >= FIRST_JS_OBJECT_TYPE &&
+  bool is_js_object = Map::IsJSObject(instance_type);
+  DCHECK_IMPLIES(is_js_object &&
                      !Map::CanHaveFastTransitionableElementsKind(instance_type),
                  IsDictionaryElementsKind(elements_kind) ||
                      IsTerminalElementsKind(elements_kind));
   HeapObject* result = nullptr;
-  AllocationResult allocation = AllocateRaw(Map::kSize, MAP_SPACE);
+  // JSObjects have maps with a mutable prototype_validity_cell, so they cannot
+  // go in RO_SPACE.
+  AllocationResult allocation =
+      AllocateRaw(Map::kSize, is_js_object ? MAP_SPACE : RO_SPACE);
   if (!allocation.To(&result)) return allocation;
 
-  result->set_map_after_allocation(meta_map(), SKIP_WRITE_BARRIER);
-  return isolate()->factory()->InitializeMap(Map::cast(result), instance_type,
-                                             instance_size, elements_kind,
-                                             inobject_properties);
+  result->set_map_after_allocation(ReadOnlyRoots(this).meta_map(),
+                                   SKIP_WRITE_BARRIER);
+  Map* map = isolate()->factory()->InitializeMap(
+      Map::cast(result), instance_type, instance_size, elements_kind,
+      inobject_properties);
+
+  if (!is_js_object) {
+    // Eagerly initialize the WeakCell cache for the map as it will not be
+    // writable in RO_SPACE.
+    HandleScope handle_scope(isolate());
+    Handle<WeakCell> weak_cell = isolate()->factory()->NewWeakCell(
+        Handle<Map>(map, isolate()), TENURED_READ_ONLY);
+    map->set_weak_cell_cache(*weak_cell);
+  }
+
+  return map;
 }
 
 AllocationResult Heap::AllocatePartialMap(InstanceType instance_type,
                                           int instance_size) {
   Object* result = nullptr;
-  AllocationResult allocation = AllocateRaw(Map::kSize, MAP_SPACE);
+  AllocationResult allocation = AllocateRaw(Map::kSize, RO_SPACE);
   if (!allocation.To(&result)) return allocation;
   // Map::cast cannot be used due to uninitialized map field.
   Map* map = reinterpret_cast<Map*>(result);
@@ -130,21 +153,25 @@ AllocationResult Heap::AllocatePartialMap(InstanceType instance_type,
   return map;
 }
 
-namespace {
-
-void FinalizePartialMap(Heap* heap, Map* map) {
-  map->set_dependent_code(DependentCode::cast(heap->empty_fixed_array()));
+void Heap::FinalizePartialMap(Map* map) {
+  ReadOnlyRoots roots(this);
+  map->set_dependent_code(DependentCode::cast(roots.empty_fixed_array()));
   map->set_raw_transitions(MaybeObject::FromSmi(Smi::kZero));
-  map->set_instance_descriptors(heap->empty_descriptor_array());
+  map->set_instance_descriptors(roots.empty_descriptor_array());
   if (FLAG_unbox_double_fields) {
     map->set_layout_descriptor(LayoutDescriptor::FastPointerLayout());
   }
-  map->set_prototype(heap->null_value());
-  map->set_constructor_or_backpointer(heap->null_value());
+  map->set_prototype(roots.null_value());
+  map->set_constructor_or_backpointer(roots.null_value());
+
+  // Eagerly initialize the WeakCell cache for the map as it will not be
+  // writable in RO_SPACE.
+  HandleScope handle_scope(isolate());
+  Handle<WeakCell> weak_cell = isolate()->factory()->NewWeakCell(
+      Handle<Map>(map, isolate()), TENURED_READ_ONLY);
+  map->set_weak_cell_cache(*weak_cell);
 }
 
-}  // namespace
-
 AllocationResult Heap::Allocate(Map* map, AllocationSpace space) {
   DCHECK(map->instance_type() != MAP_TYPE);
   int size = map->instance_size();
@@ -164,7 +191,7 @@ AllocationResult Heap::AllocateEmptyFixedTypedArray(
 
   HeapObject* object = nullptr;
   AllocationResult allocation = AllocateRaw(
-      size, OLD_SPACE,
+      size, RO_SPACE,
       array_type == kExternalFloat64Array ? kDoubleAligned : kWordAligned);
   if (!allocation.To(&object)) return allocation;
 
@@ -173,8 +200,8 @@ AllocationResult Heap::AllocateEmptyFixedTypedArray(
   FixedTypedArrayBase* elements = FixedTypedArrayBase::cast(object);
   elements->set_base_pointer(elements, SKIP_WRITE_BARRIER);
   elements->set_external_pointer(
-      ExternalReference::fixed_typed_array_base_data_offset(isolate())
-          .address(),
+      reinterpret_cast<void*>(
+          ExternalReference::fixed_typed_array_base_data_offset().address()),
       SKIP_WRITE_BARRIER);
   elements->set_length(0);
   return elements;
@@ -191,20 +218,23 @@ bool Heap::CreateInitialMaps() {
   set_meta_map(new_meta_map);
   new_meta_map->set_map_after_allocation(new_meta_map);
 
+  ReadOnlyRoots roots(this);
   {  // Partial map allocation
 #define ALLOCATE_PARTIAL_MAP(instance_type, size, field_name)                \
-    {                                                                          \
-      Map* map;                                                                \
-      if (!AllocatePartialMap((instance_type), (size)).To(&map)) return false; \
-      set_##field_name##_map(map);                                             \
-    }
+  {                                                                          \
+    Map* map;                                                                \
+    if (!AllocatePartialMap((instance_type), (size)).To(&map)) return false; \
+    set_##field_name##_map(map);                                             \
+  }
 
     ALLOCATE_PARTIAL_MAP(FIXED_ARRAY_TYPE, kVariableSizeSentinel, fixed_array);
     ALLOCATE_PARTIAL_MAP(WEAK_FIXED_ARRAY_TYPE, kVariableSizeSentinel,
                          weak_fixed_array);
+    ALLOCATE_PARTIAL_MAP(WEAK_ARRAY_LIST_TYPE, kVariableSizeSentinel,
+                         weak_array_list);
     ALLOCATE_PARTIAL_MAP(FIXED_ARRAY_TYPE, kVariableSizeSentinel,
                          fixed_cow_array)
-    DCHECK_NE(fixed_array_map(), fixed_cow_array_map());
+    DCHECK_NE(roots.fixed_array_map(), roots.fixed_cow_array_map());
 
     ALLOCATE_PARTIAL_MAP(DESCRIPTOR_ARRAY_TYPE, kVariableSizeSentinel,
                          descriptor_array)
@@ -212,50 +242,63 @@ bool Heap::CreateInitialMaps() {
     ALLOCATE_PARTIAL_MAP(ODDBALL_TYPE, Oddball::kSize, undefined);
     ALLOCATE_PARTIAL_MAP(ODDBALL_TYPE, Oddball::kSize, null);
     ALLOCATE_PARTIAL_MAP(ODDBALL_TYPE, Oddball::kSize, the_hole);
+    ALLOCATE_PARTIAL_MAP(WEAK_CELL_TYPE, WeakCell::kSize, weak_cell);
 
 #undef ALLOCATE_PARTIAL_MAP
   }
 
   // Allocate the empty array.
   {
-    AllocationResult alloc = AllocateRaw(FixedArray::SizeFor(0), OLD_SPACE);
+    AllocationResult alloc = AllocateRaw(FixedArray::SizeFor(0), RO_SPACE);
     if (!alloc.To(&obj)) return false;
-    obj->set_map_after_allocation(fixed_array_map(), SKIP_WRITE_BARRIER);
+    obj->set_map_after_allocation(roots.fixed_array_map(), SKIP_WRITE_BARRIER);
     FixedArray::cast(obj)->set_length(0);
   }
   set_empty_fixed_array(FixedArray::cast(obj));
 
   {
-    AllocationResult alloc = AllocateRaw(WeakFixedArray::SizeFor(0), OLD_SPACE);
+    AllocationResult alloc = AllocateRaw(WeakFixedArray::SizeFor(0), RO_SPACE);
     if (!alloc.To(&obj)) return false;
-    obj->set_map_after_allocation(weak_fixed_array_map(), SKIP_WRITE_BARRIER);
+    obj->set_map_after_allocation(roots.weak_fixed_array_map(),
+                                  SKIP_WRITE_BARRIER);
     WeakFixedArray::cast(obj)->set_length(0);
   }
   set_empty_weak_fixed_array(WeakFixedArray::cast(obj));
 
   {
-    AllocationResult allocation = Allocate(null_map(), OLD_SPACE);
+    AllocationResult allocation =
+        AllocateRaw(WeakArrayList::SizeForCapacity(0), RO_SPACE);
+    if (!allocation.To(&obj)) return false;
+    obj->set_map_after_allocation(roots.weak_array_list_map(),
+                                  SKIP_WRITE_BARRIER);
+    WeakArrayList::cast(obj)->set_capacity(0);
+    WeakArrayList::cast(obj)->set_length(0);
+  }
+  set_empty_weak_array_list(WeakArrayList::cast(obj));
+
+  {
+    AllocationResult allocation = Allocate(roots.null_map(), RO_SPACE);
     if (!allocation.To(&obj)) return false;
   }
   set_null_value(Oddball::cast(obj));
   Oddball::cast(obj)->set_kind(Oddball::kNull);
 
   {
-    AllocationResult allocation = Allocate(undefined_map(), OLD_SPACE);
+    AllocationResult allocation = Allocate(roots.undefined_map(), RO_SPACE);
     if (!allocation.To(&obj)) return false;
   }
   set_undefined_value(Oddball::cast(obj));
   Oddball::cast(obj)->set_kind(Oddball::kUndefined);
-  DCHECK(!InNewSpace(undefined_value()));
+  DCHECK(!InNewSpace(roots.undefined_value()));
   {
-    AllocationResult allocation = Allocate(the_hole_map(), OLD_SPACE);
+    AllocationResult allocation = Allocate(roots.the_hole_map(), RO_SPACE);
     if (!allocation.To(&obj)) return false;
   }
   set_the_hole_value(Oddball::cast(obj));
   Oddball::cast(obj)->set_kind(Oddball::kTheHole);
 
   // Set preliminary exception sentinel value before actually initializing it.
-  set_exception(null_value());
+  set_exception(roots.null_value());
 
   // Setup the struct maps first (needed for the EnumCache).
   for (unsigned i = 0; i < arraysize(struct_table); i++) {
@@ -267,42 +310,45 @@ bool Heap::CreateInitialMaps() {
 
   // Allocate the empty enum cache.
   {
-    AllocationResult allocation = Allocate(tuple2_map(), OLD_SPACE);
+    AllocationResult allocation = Allocate(roots.tuple2_map(), RO_SPACE);
     if (!allocation.To(&obj)) return false;
   }
   set_empty_enum_cache(EnumCache::cast(obj));
-  EnumCache::cast(obj)->set_keys(empty_fixed_array());
-  EnumCache::cast(obj)->set_indices(empty_fixed_array());
+  EnumCache::cast(obj)->set_keys(roots.empty_fixed_array());
+  EnumCache::cast(obj)->set_indices(roots.empty_fixed_array());
 
   // Allocate the empty descriptor array.
   {
     STATIC_ASSERT(DescriptorArray::kFirstIndex != 0);
     int length = DescriptorArray::kFirstIndex;
-    int size = FixedArray::SizeFor(length);
-    if (!AllocateRaw(size, OLD_SPACE).To(&obj)) return false;
-    obj->set_map_after_allocation(descriptor_array_map(), SKIP_WRITE_BARRIER);
+    int size = WeakFixedArray::SizeFor(length);
+    if (!AllocateRaw(size, RO_SPACE).To(&obj)) return false;
+    obj->set_map_after_allocation(roots.descriptor_array_map(),
+                                  SKIP_WRITE_BARRIER);
     DescriptorArray::cast(obj)->set_length(length);
   }
   set_empty_descriptor_array(DescriptorArray::cast(obj));
-  DescriptorArray::cast(obj)->set(DescriptorArray::kDescriptorLengthIndex,
-                                  Smi::kZero);
-  DescriptorArray::cast(obj)->set(DescriptorArray::kEnumCacheIndex,
-                                  empty_enum_cache());
+  DescriptorArray::cast(obj)->SetNumberOfDescriptors(0);
+  WeakFixedArray::cast(obj)->Set(
+      DescriptorArray::kEnumCacheIndex,
+      MaybeObject::FromObject(roots.empty_enum_cache()));
 
   // Fix the instance_descriptors for the existing maps.
-  FinalizePartialMap(this, meta_map());
-  FinalizePartialMap(this, fixed_array_map());
-  FinalizePartialMap(this, weak_fixed_array_map());
-  FinalizePartialMap(this, fixed_cow_array_map());
-  FinalizePartialMap(this, descriptor_array_map());
-  FinalizePartialMap(this, undefined_map());
-  undefined_map()->set_is_undetectable(true);
-  FinalizePartialMap(this, null_map());
-  null_map()->set_is_undetectable(true);
-  FinalizePartialMap(this, the_hole_map());
+  FinalizePartialMap(roots.meta_map());
+  FinalizePartialMap(roots.weak_cell_map());
+  FinalizePartialMap(roots.fixed_array_map());
+  FinalizePartialMap(roots.weak_fixed_array_map());
+  FinalizePartialMap(roots.weak_array_list_map());
+  FinalizePartialMap(roots.fixed_cow_array_map());
+  FinalizePartialMap(roots.descriptor_array_map());
+  FinalizePartialMap(roots.undefined_map());
+  roots.undefined_map()->set_is_undetectable(true);
+  FinalizePartialMap(roots.null_map());
+  roots.null_map()->set_is_undetectable(true);
+  FinalizePartialMap(roots.the_hole_map());
   for (unsigned i = 0; i < arraysize(struct_table); ++i) {
     const StructTable& entry = struct_table[i];
-    FinalizePartialMap(this, Map::cast(roots_[entry.index]));
+    FinalizePartialMap(Map::cast(roots_[entry.index]));
   }
 
   {  // Map allocation
@@ -318,18 +364,18 @@ bool Heap::CreateInitialMaps() {
 
 #define ALLOCATE_PRIMITIVE_MAP(instance_type, size, field_name, \
                                constructor_function_index)      \
-    {                                                             \
-      ALLOCATE_MAP((instance_type), (size), field_name);          \
-      field_name##_map()->SetConstructorFunctionIndex(            \
-          (constructor_function_index));                          \
-    }
+  {                                                             \
+    ALLOCATE_MAP((instance_type), (size), field_name);          \
+    roots.field_name##_map()->SetConstructorFunctionIndex(      \
+        (constructor_function_index));                          \
+  }
 
     ALLOCATE_VARSIZE_MAP(SCOPE_INFO_TYPE, scope_info)
     ALLOCATE_VARSIZE_MAP(FIXED_ARRAY_TYPE, module_info)
     ALLOCATE_VARSIZE_MAP(FEEDBACK_VECTOR_TYPE, feedback_vector)
     ALLOCATE_PRIMITIVE_MAP(HEAP_NUMBER_TYPE, HeapNumber::kSize, heap_number,
                            Context::NUMBER_FUNCTION_INDEX)
-    ALLOCATE_MAP(MUTABLE_HEAP_NUMBER_TYPE, HeapNumber::kSize,
+    ALLOCATE_MAP(MUTABLE_HEAP_NUMBER_TYPE, MutableHeapNumber::kSize,
                  mutable_heap_number)
     ALLOCATE_PRIMITIVE_MAP(SYMBOL_TYPE, Symbol::kSize, symbol,
                            Context::SYMBOL_FUNCTION_INDEX)
@@ -343,6 +389,7 @@ bool Heap::CreateInitialMaps() {
     ALLOCATE_MAP(ODDBALL_TYPE, Oddball::kSize, termination_exception);
     ALLOCATE_MAP(ODDBALL_TYPE, Oddball::kSize, optimized_out);
     ALLOCATE_MAP(ODDBALL_TYPE, Oddball::kSize, stale_register);
+    ALLOCATE_MAP(ODDBALL_TYPE, Oddball::kSize, self_reference_marker);
     ALLOCATE_VARSIZE_MAP(BIGINT_TYPE, bigint);
 
     for (unsigned i = 0; i < arraysize(string_type_table); i++) {
@@ -370,7 +417,7 @@ bool Heap::CreateInitialMaps() {
     }
 
     ALLOCATE_VARSIZE_MAP(FIXED_DOUBLE_ARRAY_TYPE, fixed_double_array)
-    fixed_double_array_map()->set_elements_kind(HOLEY_DOUBLE_ELEMENTS);
+    roots.fixed_double_array_map()->set_elements_kind(HOLEY_DOUBLE_ELEMENTS);
     ALLOCATE_VARSIZE_MAP(FEEDBACK_METADATA_TYPE, feedback_metadata)
     ALLOCATE_VARSIZE_MAP(BYTE_ARRAY_TYPE, byte_array)
     ALLOCATE_VARSIZE_MAP(BYTECODE_ARRAY_TYPE, bytecode_array)
@@ -395,34 +442,36 @@ bool Heap::CreateInitialMaps() {
       Smi* value = Smi::FromInt(Map::kPrototypeChainInvalid);
       AllocationResult alloc = AllocateRaw(Cell::kSize, OLD_SPACE);
       if (!alloc.To(&obj)) return false;
-      obj->set_map_after_allocation(cell_map(), SKIP_WRITE_BARRIER);
+      obj->set_map_after_allocation(roots.cell_map(), SKIP_WRITE_BARRIER);
       Cell::cast(obj)->set_value(value);
       set_invalid_prototype_validity_cell(Cell::cast(obj));
     }
 
     ALLOCATE_MAP(PROPERTY_CELL_TYPE, PropertyCell::kSize, global_property_cell)
-    ALLOCATE_MAP(WEAK_CELL_TYPE, WeakCell::kSize, weak_cell)
     ALLOCATE_MAP(FILLER_TYPE, kPointerSize, one_pointer_filler)
     ALLOCATE_MAP(FILLER_TYPE, 2 * kPointerSize, two_pointer_filler)
 
     // The "no closures" and "one closure" FeedbackCell maps need
     // to be marked unstable because their objects can change maps.
     ALLOCATE_MAP(FEEDBACK_CELL_TYPE, FeedbackCell::kSize, no_closures_cell)
-    no_closures_cell_map()->mark_unstable();
+    roots.no_closures_cell_map()->mark_unstable();
     ALLOCATE_MAP(FEEDBACK_CELL_TYPE, FeedbackCell::kSize, one_closure_cell)
-    one_closure_cell_map()->mark_unstable();
+    roots.one_closure_cell_map()->mark_unstable();
     ALLOCATE_MAP(FEEDBACK_CELL_TYPE, FeedbackCell::kSize, many_closures_cell)
 
     ALLOCATE_VARSIZE_MAP(TRANSITION_ARRAY_TYPE, transition_array)
 
     ALLOCATE_VARSIZE_MAP(HASH_TABLE_TYPE, hash_table)
-    ALLOCATE_VARSIZE_MAP(HASH_TABLE_TYPE, ordered_hash_map)
-    ALLOCATE_VARSIZE_MAP(HASH_TABLE_TYPE, ordered_hash_set)
-    ALLOCATE_VARSIZE_MAP(HASH_TABLE_TYPE, name_dictionary)
-    ALLOCATE_VARSIZE_MAP(HASH_TABLE_TYPE, global_dictionary)
-    ALLOCATE_VARSIZE_MAP(HASH_TABLE_TYPE, number_dictionary)
-    ALLOCATE_VARSIZE_MAP(HASH_TABLE_TYPE, simple_number_dictionary)
-    ALLOCATE_VARSIZE_MAP(HASH_TABLE_TYPE, string_table)
+    ALLOCATE_VARSIZE_MAP(ORDERED_HASH_MAP_TYPE, ordered_hash_map)
+    ALLOCATE_VARSIZE_MAP(ORDERED_HASH_SET_TYPE, ordered_hash_set)
+    ALLOCATE_VARSIZE_MAP(NAME_DICTIONARY_TYPE, name_dictionary)
+    ALLOCATE_VARSIZE_MAP(GLOBAL_DICTIONARY_TYPE, global_dictionary)
+    ALLOCATE_VARSIZE_MAP(NUMBER_DICTIONARY_TYPE, number_dictionary)
+    ALLOCATE_VARSIZE_MAP(SIMPLE_NUMBER_DICTIONARY_TYPE,
+                         simple_number_dictionary)
+    ALLOCATE_VARSIZE_MAP(STRING_TABLE_TYPE, string_table)
+
+    ALLOCATE_VARSIZE_MAP(EPHEMERON_HASH_TABLE_TYPE, ephemeron_hash_table)
 
     ALLOCATE_VARSIZE_MAP(FIXED_ARRAY_TYPE, array_list)
 
@@ -434,18 +483,27 @@ bool Heap::CreateInitialMaps() {
     ALLOCATE_VARSIZE_MAP(MODULE_CONTEXT_TYPE, module_context)
     ALLOCATE_VARSIZE_MAP(EVAL_CONTEXT_TYPE, eval_context)
     ALLOCATE_VARSIZE_MAP(SCRIPT_CONTEXT_TYPE, script_context)
-    ALLOCATE_VARSIZE_MAP(FIXED_ARRAY_TYPE, script_context_table)
+    ALLOCATE_VARSIZE_MAP(SCRIPT_CONTEXT_TABLE_TYPE, script_context_table)
 
-    ALLOCATE_VARSIZE_MAP(BOILERPLATE_DESCRIPTION_TYPE, boilerplate_description)
+    ALLOCATE_VARSIZE_MAP(OBJECT_BOILERPLATE_DESCRIPTION_TYPE,
+                         object_boilerplate_description)
 
     ALLOCATE_VARSIZE_MAP(NATIVE_CONTEXT_TYPE, native_context)
-    native_context_map()->set_visitor_id(kVisitNativeContext);
+    roots.native_context_map()->set_visitor_id(kVisitNativeContext);
 
     ALLOCATE_MAP(CALL_HANDLER_INFO_TYPE, CallHandlerInfo::kSize,
                  side_effect_call_handler_info)
     ALLOCATE_MAP(CALL_HANDLER_INFO_TYPE, CallHandlerInfo::kSize,
                  side_effect_free_call_handler_info)
-
+    ALLOCATE_MAP(CALL_HANDLER_INFO_TYPE, CallHandlerInfo::kSize,
+                 next_call_side_effect_free_call_handler_info)
+
+    ALLOCATE_MAP(UNCOMPILED_DATA_WITHOUT_PRE_PARSED_SCOPE_TYPE,
+                 UncompiledDataWithoutPreParsedScope::kSize,
+                 uncompiled_data_without_pre_parsed_scope)
+    ALLOCATE_MAP(UNCOMPILED_DATA_WITH_PRE_PARSED_SCOPE_TYPE,
+                 UncompiledDataWithPreParsedScope::kSize,
+                 uncompiled_data_with_pre_parsed_scope)
     ALLOCATE_MAP(SHARED_FUNCTION_INFO_TYPE, SharedFunctionInfo::kAlignedSize,
                  shared_function_info)
 
@@ -461,31 +519,36 @@ bool Heap::CreateInitialMaps() {
   }
 
   {
-    AllocationResult alloc = AllocateRaw(FixedArray::SizeFor(0), OLD_SPACE);
+    AllocationResult alloc = AllocateRaw(FixedArray::SizeFor(0), RO_SPACE);
     if (!alloc.To(&obj)) return false;
-    obj->set_map_after_allocation(scope_info_map(), SKIP_WRITE_BARRIER);
+    obj->set_map_after_allocation(roots.scope_info_map(), SKIP_WRITE_BARRIER);
     FixedArray::cast(obj)->set_length(0);
   }
   set_empty_scope_info(ScopeInfo::cast(obj));
 
   {
-    AllocationResult alloc = AllocateRaw(FixedArray::SizeFor(0), OLD_SPACE);
+    // Empty boilerplate needs a field for literal_flags
+    AllocationResult alloc = AllocateRaw(FixedArray::SizeFor(1), RO_SPACE);
     if (!alloc.To(&obj)) return false;
-    obj->set_map_after_allocation(boilerplate_description_map(),
+    obj->set_map_after_allocation(roots.object_boilerplate_description_map(),
                                   SKIP_WRITE_BARRIER);
-    FixedArray::cast(obj)->set_length(0);
+
+    FixedArray::cast(obj)->set_length(1);
+    FixedArray::cast(obj)->set(ObjectBoilerplateDescription::kLiteralTypeOffset,
+                               Smi::kZero);
   }
-  set_empty_boilerplate_description(BoilerplateDescription::cast(obj));
+  set_empty_object_boilerplate_description(
+      ObjectBoilerplateDescription::cast(obj));
 
   {
-    AllocationResult allocation = Allocate(boolean_map(), OLD_SPACE);
+    AllocationResult allocation = Allocate(roots.boolean_map(), RO_SPACE);
     if (!allocation.To(&obj)) return false;
   }
   set_true_value(Oddball::cast(obj));
   Oddball::cast(obj)->set_kind(Oddball::kTrue);
 
   {
-    AllocationResult allocation = Allocate(boolean_map(), OLD_SPACE);
+    AllocationResult allocation = Allocate(roots.boolean_map(), RO_SPACE);
     if (!allocation.To(&obj)) return false;
   }
   set_false_value(Oddball::cast(obj));
@@ -493,17 +556,18 @@ bool Heap::CreateInitialMaps() {
 
   // Empty arrays.
   {
-    if (!AllocateRaw(ByteArray::SizeFor(0), OLD_SPACE).To(&obj)) return false;
-    obj->set_map_after_allocation(byte_array_map(), SKIP_WRITE_BARRIER);
+    if (!AllocateRaw(ByteArray::SizeFor(0), RO_SPACE).To(&obj)) return false;
+    obj->set_map_after_allocation(roots.byte_array_map(), SKIP_WRITE_BARRIER);
     ByteArray::cast(obj)->set_length(0);
     set_empty_byte_array(ByteArray::cast(obj));
   }
 
   {
-    if (!AllocateRaw(FixedArray::SizeFor(0), OLD_SPACE).To(&obj)) {
+    if (!AllocateRaw(FixedArray::SizeFor(0), RO_SPACE).To(&obj)) {
       return false;
     }
-    obj->set_map_after_allocation(property_array_map(), SKIP_WRITE_BARRIER);
+    obj->set_map_after_allocation(roots.property_array_map(),
+                                  SKIP_WRITE_BARRIER);
     PropertyArray::cast(obj)->initialize_length(0);
     set_empty_property_array(PropertyArray::cast(obj));
   }
@@ -519,7 +583,11 @@ bool Heap::CreateInitialMaps() {
   TYPED_ARRAYS(ALLOCATE_EMPTY_FIXED_TYPED_ARRAY)
 #undef ALLOCATE_EMPTY_FIXED_TYPED_ARRAY
 
-  DCHECK(!InNewSpace(empty_fixed_array()));
+  DCHECK(!InNewSpace(roots.empty_fixed_array()));
+
+  roots.bigint_map()->SetConstructorFunctionIndex(
+      Context::BIGINT_FUNCTION_INDEX);
+
   return true;
 }
 
@@ -530,7 +598,7 @@ void Heap::CreateApiObjects() {
   set_message_listeners(*TemplateList::New(isolate, 2));
 
   Handle<InterceptorInfo> info = Handle<InterceptorInfo>::cast(
-      isolate->factory()->NewStruct(INTERCEPTOR_INFO_TYPE, TENURED));
+      isolate->factory()->NewStruct(INTERCEPTOR_INFO_TYPE, TENURED_READ_ONLY));
   info->set_flags(0);
   set_noop_interceptor_info(*info);
 }
@@ -538,22 +606,33 @@ void Heap::CreateApiObjects() {
 void Heap::CreateInitialObjects() {
   HandleScope scope(isolate());
   Factory* factory = isolate()->factory();
+  ReadOnlyRoots roots(this);
 
   // The -0 value must be set before NewNumber works.
-  set_minus_zero_value(*factory->NewHeapNumber(-0.0, IMMUTABLE, TENURED));
-  DCHECK(std::signbit(minus_zero_value()->Number()));
+  set_minus_zero_value(*factory->NewHeapNumber(-0.0, TENURED_READ_ONLY));
+  DCHECK(std::signbit(roots.minus_zero_value()->Number()));
 
   set_nan_value(*factory->NewHeapNumber(
-      std::numeric_limits<double>::quiet_NaN(), IMMUTABLE, TENURED));
+      std::numeric_limits<double>::quiet_NaN(), TENURED_READ_ONLY));
   set_hole_nan_value(
-      *factory->NewHeapNumberFromBits(kHoleNanInt64, IMMUTABLE, TENURED));
-  set_infinity_value(*factory->NewHeapNumber(V8_INFINITY, IMMUTABLE, TENURED));
+      *factory->NewHeapNumberFromBits(kHoleNanInt64, TENURED_READ_ONLY));
+  set_infinity_value(*factory->NewHeapNumber(V8_INFINITY, TENURED_READ_ONLY));
   set_minus_infinity_value(
-      *factory->NewHeapNumber(-V8_INFINITY, IMMUTABLE, TENURED));
+      *factory->NewHeapNumber(-V8_INFINITY, TENURED_READ_ONLY));
+
+  // Allocate cache for single character one byte strings.
+  set_single_character_string_cache(
+      *factory->NewFixedArray(String::kMaxOneByteCharCode + 1, TENURED));
 
   // Allocate initial string table.
   set_string_table(*StringTable::New(isolate(), kInitialStringTableSize));
 
+  for (unsigned i = 0; i < arraysize(constant_string_table); i++) {
+    Handle<String> str =
+        factory->InternalizeUtf8String(constant_string_table[i].contents);
+    roots_[constant_string_table[i].index] = *str;
+  }
+
   // Allocate
 
   // Finish initializing oddballs after creating the string table.
@@ -607,11 +686,9 @@ void Heap::CreateInitialObjects() {
                            handle(Smi::FromInt(-7), isolate()), "undefined",
                            Oddball::kStaleRegister));
 
-  for (unsigned i = 0; i < arraysize(constant_string_table); i++) {
-    Handle<String> str =
-        factory->InternalizeUtf8String(constant_string_table[i].contents);
-    roots_[constant_string_table[i].index] = *str;
-  }
+  // Initialize the self-reference marker.
+  set_self_reference_marker(
+      *factory->NewSelfReferenceMarker(TENURED_READ_ONLY));
 
   // Create the code_stubs dictionary. The initial size is set to avoid
   // expanding the dictionary during bootstrapping.
@@ -619,10 +696,11 @@ void Heap::CreateInitialObjects() {
 
   {
     HandleScope scope(isolate());
-#define SYMBOL_INIT(name)                                              \
-  {                                                                    \
-    Handle<Symbol> symbol(isolate()->factory()->NewPrivateSymbol());   \
-    roots_[k##name##RootIndex] = *symbol;                              \
+#define SYMBOL_INIT(name)                                           \
+  {                                                                 \
+    Handle<Symbol> symbol(                                          \
+        isolate()->factory()->NewPrivateSymbol(TENURED_READ_ONLY)); \
+    roots_[k##name##RootIndex] = *symbol;                           \
   }
     PRIVATE_SYMBOL_LIST(SYMBOL_INIT)
 #undef SYMBOL_INIT
@@ -630,19 +708,21 @@ void Heap::CreateInitialObjects() {
 
   {
     HandleScope scope(isolate());
-#define SYMBOL_INIT(name, description)                                      \
-  Handle<Symbol> name = factory->NewSymbol();                               \
-  Handle<String> name##d = factory->NewStringFromStaticChars(#description); \
-  name->set_name(*name##d);                                                 \
+#define SYMBOL_INIT(name, description)                                    \
+  Handle<Symbol> name = factory->NewSymbol(TENURED_READ_ONLY);            \
+  Handle<String> name##d =                                                \
+      factory->NewStringFromStaticChars(#description, TENURED_READ_ONLY); \
+  name->set_name(*name##d);                                               \
   roots_[k##name##RootIndex] = *name;
     PUBLIC_SYMBOL_LIST(SYMBOL_INIT)
 #undef SYMBOL_INIT
 
-#define SYMBOL_INIT(name, description)                                      \
-  Handle<Symbol> name = factory->NewSymbol();                               \
-  Handle<String> name##d = factory->NewStringFromStaticChars(#description); \
-  name->set_is_well_known_symbol(true);                                     \
-  name->set_name(*name##d);                                                 \
+#define SYMBOL_INIT(name, description)                                    \
+  Handle<Symbol> name = factory->NewSymbol(TENURED_READ_ONLY);            \
+  Handle<String> name##d =                                                \
+      factory->NewStringFromStaticChars(#description, TENURED_READ_ONLY); \
+  name->set_is_well_known_symbol(true);                                   \
+  name->set_name(*name##d);                                               \
   roots_[k##name##RootIndex] = *name;
     WELL_KNOWN_SYMBOL_LIST(SYMBOL_INIT)
 #undef SYMBOL_INIT
@@ -663,10 +743,6 @@ void Heap::CreateInitialObjects() {
   set_number_string_cache(
       *factory->NewFixedArray(kInitialNumberStringCacheSize * 2, TENURED));
 
-  // Allocate cache for single character one byte strings.
-  set_single_character_string_cache(
-      *factory->NewFixedArray(String::kMaxOneByteCharCode + 1, TENURED));
-
   // Allocate cache for string split and regexp-multiple.
   set_string_split_cache(*factory->NewFixedArray(
       RegExpResultsCache::kRegExpResultsCacheSize, TENURED));
@@ -680,32 +756,33 @@ void Heap::CreateInitialObjects() {
 
   // Microtask queue uses the empty fixed array as a sentinel for "empty".
   // Number of queued microtasks stored in Isolate::pending_microtask_count().
-  set_microtask_queue(empty_fixed_array());
+  set_microtask_queue(roots.empty_fixed_array());
 
   {
     Handle<FixedArray> empty_sloppy_arguments_elements =
-        factory->NewFixedArray(2, TENURED);
+        factory->NewFixedArray(2, TENURED_READ_ONLY);
     empty_sloppy_arguments_elements->set_map_after_allocation(
-        sloppy_arguments_elements_map(), SKIP_WRITE_BARRIER);
+        roots.sloppy_arguments_elements_map(), SKIP_WRITE_BARRIER);
     set_empty_sloppy_arguments_elements(*empty_sloppy_arguments_elements);
   }
 
   {
-    Handle<WeakCell> cell = factory->NewWeakCell(factory->undefined_value());
+    Handle<WeakCell> cell =
+        factory->NewWeakCell(factory->undefined_value(), TENURED_READ_ONLY);
     set_empty_weak_cell(*cell);
     cell->clear();
   }
 
-  set_detached_contexts(empty_fixed_array());
-  set_retained_maps(ArrayList::cast(empty_fixed_array()));
-  set_retaining_path_targets(undefined_value());
+  set_detached_contexts(roots.empty_fixed_array());
+  set_retained_maps(roots.empty_weak_array_list());
+  set_retaining_path_targets(roots.undefined_value());
 
-  set_feedback_vectors_for_profiling_tools(undefined_value());
+  set_feedback_vectors_for_profiling_tools(roots.undefined_value());
 
   set_script_list(Smi::kZero);
 
-  Handle<NumberDictionary> slow_element_dictionary =
-      NumberDictionary::New(isolate(), 1, TENURED, USE_CUSTOM_MINIMUM_CAPACITY);
+  Handle<NumberDictionary> slow_element_dictionary = NumberDictionary::New(
+      isolate(), 1, TENURED_READ_ONLY, USE_CUSTOM_MINIMUM_CAPACITY);
   DCHECK(!slow_element_dictionary->HasSufficientCapacityToAdd(1));
   slow_element_dictionary->set_requires_slow_elements();
   set_empty_slow_element_dictionary(*slow_element_dictionary);
@@ -714,12 +791,12 @@ void Heap::CreateInitialObjects() {
 
   // Handling of script id generation is in Heap::NextScriptId().
   set_last_script_id(Smi::FromInt(v8::UnboundScript::kNoScriptId));
-  set_last_debugging_id(Smi::FromInt(SharedFunctionInfo::kNoDebuggingId));
+  set_last_debugging_id(Smi::FromInt(DebugInfo::kNoDebuggingId));
   set_next_template_serial_number(Smi::kZero);
 
   // Allocate the empty OrderedHashMap.
-  Handle<FixedArray> empty_ordered_hash_map =
-      factory->NewFixedArray(OrderedHashMap::kHashTableStartIndex, TENURED);
+  Handle<FixedArray> empty_ordered_hash_map = factory->NewFixedArray(
+      OrderedHashMap::kHashTableStartIndex, TENURED_READ_ONLY);
   empty_ordered_hash_map->set_map_no_write_barrier(
       *factory->ordered_hash_map_map());
   for (int i = 0; i < empty_ordered_hash_map->length(); ++i) {
@@ -728,8 +805,8 @@ void Heap::CreateInitialObjects() {
   set_empty_ordered_hash_map(*empty_ordered_hash_map);
 
   // Allocate the empty OrderedHashSet.
-  Handle<FixedArray> empty_ordered_hash_set =
-      factory->NewFixedArray(OrderedHashSet::kHashTableStartIndex, TENURED);
+  Handle<FixedArray> empty_ordered_hash_set = factory->NewFixedArray(
+      OrderedHashSet::kHashTableStartIndex, TENURED_READ_ONLY);
   empty_ordered_hash_set->set_map_no_write_barrier(
       *factory->ordered_hash_set_map());
   for (int i = 0; i < empty_ordered_hash_set->length(); ++i) {
@@ -739,7 +816,7 @@ void Heap::CreateInitialObjects() {
 
   // Allocate the empty FeedbackMetadata.
   Handle<FeedbackMetadata> empty_feedback_metadata =
-      factory->NewFeedbackMetadata(0);
+      factory->NewFeedbackMetadata(0, TENURED_READ_ONLY);
   set_empty_feedback_metadata(*empty_feedback_metadata);
 
   // Allocate the empty script.
@@ -755,8 +832,8 @@ void Heap::CreateInitialObjects() {
   cell->set_value(Smi::FromInt(Isolate::kProtectorValid));
   set_no_elements_protector(*cell);
 
-  cell = factory->NewPropertyCell(factory->empty_string());
-  cell->set_value(the_hole_value());
+  cell = factory->NewPropertyCell(factory->empty_string(), TENURED_READ_ONLY);
+  cell->set_value(roots.the_hole_value());
   set_empty_property_cell(*cell);
 
   cell = factory->NewPropertyCell(factory->empty_string());
@@ -799,8 +876,8 @@ void Heap::CreateInitialObjects() {
   cell->set_value(Smi::FromInt(Isolate::kProtectorValid));
   set_promise_then_protector(*cell);
 
-  set_serialized_objects(empty_fixed_array());
-  set_serialized_global_proxy_sizes(empty_fixed_array());
+  set_serialized_objects(roots.empty_fixed_array());
+  set_serialized_global_proxy_sizes(roots.empty_fixed_array());
 
   set_weak_stack_trace_list(Smi::kZero);
 
@@ -811,8 +888,12 @@ void Heap::CreateInitialObjects() {
   set_deserialize_lazy_handler_wide(Smi::kZero);
   set_deserialize_lazy_handler_extra_wide(Smi::kZero);
 
+  // Evaluate the hash values which will then be cached in the strings.
+  isolate()->factory()->zero_string()->Hash();
+  isolate()->factory()->one_string()->Hash();
+
   // Initialize builtins constants table.
-  set_builtins_constants_table(empty_fixed_array());
+  set_builtins_constants_table(roots.empty_fixed_array());
 
   // Initialize context slot cache.
   isolate_->context_slot_cache()->Clear();
diff --git a/deps/v8/src/heap/spaces-inl.h b/deps/v8/src/heap/spaces-inl.h
index c9cd68d5c62f43..2ddcf6cf368668 100644
--- a/deps/v8/src/heap/spaces-inl.h
+++ b/deps/v8/src/heap/spaces-inl.h
@@ -45,7 +45,7 @@ HeapObject* SemiSpaceIterator::Next() {
     if (Page::IsAlignedToPageSize(current_)) {
       Page* page = Page::FromAllocationAreaAddress(current_);
       page = page->next_page();
-      DCHECK(!page->is_anchor());
+      DCHECK(page);
       current_ = page->area_start();
       if (current_ == limit_) return nullptr;
     }
@@ -139,7 +139,7 @@ bool NewSpace::ToSpaceContains(Object* o) { return to_space_.Contains(o); }
 bool NewSpace::FromSpaceContains(Object* o) { return from_space_.Contains(o); }
 
 bool PagedSpace::Contains(Address addr) {
-  if (heap_->lo_space()->FindPage(addr)) return false;
+  if (heap()->lo_space()->FindPage(addr)) return false;
   return MemoryChunk::FromAnyPointerAddress(heap(), addr)->owner() == this;
 }
 
@@ -171,7 +171,7 @@ size_t PagedSpace::RelinkFreeListCategories(Page* page) {
 }
 
 bool PagedSpace::TryFreeLast(HeapObject* object, int object_size) {
-  if (allocation_info_.top() != nullptr) {
+  if (allocation_info_.top() != kNullAddress) {
     const Address object_address = object->address();
     if ((allocation_info_.top() - object_size) == object_address) {
       allocation_info_.set_top(object_address);
@@ -315,6 +315,7 @@ HeapObject* PagedSpace::TryAllocateLinearlyAligned(
 
 AllocationResult PagedSpace::AllocateRawUnaligned(
     int size_in_bytes, UpdateSkipList update_skip_list) {
+  DCHECK_IMPLIES(identity() == RO_SPACE, heap()->CanAllocateInReadOnlySpace());
   if (!EnsureLinearAllocationArea(size_in_bytes)) {
     return AllocationResult::Retry(identity());
   }
@@ -330,7 +331,8 @@ AllocationResult PagedSpace::AllocateRawUnaligned(
 
 AllocationResult PagedSpace::AllocateRawAligned(int size_in_bytes,
                                                 AllocationAlignment alignment) {
-  DCHECK(identity() == OLD_SPACE);
+  DCHECK(identity() == OLD_SPACE || identity() == RO_SPACE);
+  DCHECK_IMPLIES(identity() == RO_SPACE, heap()->CanAllocateInReadOnlySpace());
   int allocation_size = size_in_bytes;
   HeapObject* object = TryAllocateLinearlyAligned(&allocation_size, alignment);
   if (object == nullptr) {
@@ -356,7 +358,7 @@ AllocationResult PagedSpace::AllocateRaw(int size_in_bytes,
       SupportsInlineAllocation()) {
     // Generated code decreased the top() pointer to do folded allocations.
     // The top_on_previous_step_ can be one byte beyond the current page.
-    DCHECK_NOT_NULL(top());
+    DCHECK_NE(top(), kNullAddress);
     DCHECK_EQ(Page::FromAllocationAreaAddress(top()),
               Page::FromAllocationAreaAddress(top_on_previous_step_ - 1));
     top_on_previous_step_ = top();
@@ -396,7 +398,8 @@ AllocationResult NewSpace::AllocateRawAligned(int size_in_bytes,
   int filler_size = Heap::GetFillToAlign(top, alignment);
   int aligned_size_in_bytes = size_in_bytes + filler_size;
 
-  if (allocation_info_.limit() - top < aligned_size_in_bytes) {
+  if (allocation_info_.limit() - top <
+      static_cast<uintptr_t>(aligned_size_in_bytes)) {
     // See if we can create room.
     if (!EnsureAllocation(size_in_bytes, alignment)) {
       return AllocationResult::Retry();
@@ -465,13 +468,10 @@ V8_WARN_UNUSED_RESULT inline AllocationResult NewSpace::AllocateRawSynchronized(
   return AllocateRaw(size_in_bytes, alignment);
 }
 
-size_t LargeObjectSpace::Available() {
-  return ObjectSizeFor(heap()->memory_allocator()->Available());
-}
-
 
 LocalAllocationBuffer LocalAllocationBuffer::InvalidBuffer() {
-  return LocalAllocationBuffer(nullptr, LinearAllocationArea(nullptr, nullptr));
+  return LocalAllocationBuffer(
+      nullptr, LinearAllocationArea(kNullAddress, kNullAddress));
 }
 
 
@@ -491,7 +491,7 @@ LocalAllocationBuffer LocalAllocationBuffer::FromResult(Heap* heap,
 bool LocalAllocationBuffer::TryMerge(LocalAllocationBuffer* other) {
   if (allocation_info_.top() == other->allocation_info_.limit()) {
     allocation_info_.set_top(other->allocation_info_.top());
-    other->allocation_info_.Reset(nullptr, nullptr);
+    other->allocation_info_.Reset(kNullAddress, kNullAddress);
     return true;
   }
   return false;
diff --git a/deps/v8/src/heap/spaces.cc b/deps/v8/src/heap/spaces.cc
index 5a94e1c3b968fb..ad4ca490445443 100644
--- a/deps/v8/src/heap/spaces.cc
+++ b/deps/v8/src/heap/spaces.cc
@@ -14,6 +14,7 @@
 #include "src/heap/array-buffer-tracker.h"
 #include "src/heap/concurrent-marking.h"
 #include "src/heap/gc-tracer.h"
+#include "src/heap/heap-controller.h"
 #include "src/heap/incremental-marking.h"
 #include "src/heap/mark-compact.h"
 #include "src/heap/slot-set.h"
@@ -31,15 +32,15 @@ namespace internal {
 // HeapObjectIterator
 
 HeapObjectIterator::HeapObjectIterator(PagedSpace* space)
-    : cur_addr_(nullptr),
-      cur_end_(nullptr),
+    : cur_addr_(kNullAddress),
+      cur_end_(kNullAddress),
       space_(space),
-      page_range_(space->anchor()->next_page(), space->anchor()),
+      page_range_(space->first_page(), nullptr),
       current_page_(page_range_.begin()) {}
 
 HeapObjectIterator::HeapObjectIterator(Page* page)
-    : cur_addr_(nullptr),
-      cur_end_(nullptr),
+    : cur_addr_(kNullAddress),
+      cur_end_(kNullAddress),
       space_(reinterpret_cast<PagedSpace*>(page->owner())),
       page_range_(page),
       current_page_(page_range_.begin()) {
@@ -93,13 +94,11 @@ PauseAllocationObserversScope::~PauseAllocationObserversScope() {
 // -----------------------------------------------------------------------------
 // CodeRange
 
-CodeRange::CodeRange(Isolate* isolate)
+CodeRange::CodeRange(Isolate* isolate, size_t requested)
     : isolate_(isolate),
       free_list_(0),
       allocation_list_(0),
-      current_allocation_block_index_(0) {}
-
-bool CodeRange::SetUp(size_t requested) {
+      current_allocation_block_index_(0) {
   DCHECK(!virtual_memory_.IsReserved());
 
   if (requested == 0) {
@@ -109,7 +108,7 @@ bool CodeRange::SetUp(size_t requested) {
     if (kRequiresCodeRange) {
       requested = kMaximalCodeRangeSize;
     } else {
-      return true;
+      return;
     }
   }
 
@@ -128,19 +127,20 @@ bool CodeRange::SetUp(size_t requested) {
   if (!AlignedAllocVirtualMemory(
           requested, Max(kCodeRangeAreaAlignment, AllocatePageSize()),
           GetRandomMmapAddr(), &reservation)) {
-    return false;
+    V8::FatalProcessOutOfMemory(isolate,
+                                "CodeRange setup: allocate virtual memory");
   }
 
   // We are sure that we have mapped a block of requested addresses.
   DCHECK_GE(reservation.size(), requested);
-  Address base = reinterpret_cast<Address>(reservation.address());
+  Address base = reservation.address();
 
   // On some platforms, specifically Win64, we need to reserve some pages at
   // the beginning of an executable space.
   if (reserved_area > 0) {
     if (!reservation.SetPermissions(base, reserved_area,
                                     PageAllocator::kReadWrite))
-      return false;
+      V8::FatalProcessOutOfMemory(isolate, "CodeRange setup: set permissions");
 
     base += reserved_area;
   }
@@ -149,9 +149,10 @@ bool CodeRange::SetUp(size_t requested) {
   allocation_list_.emplace_back(aligned_base, size);
   current_allocation_block_index_ = 0;
 
-  LOG(isolate_, NewEvent("CodeRange", reservation.address(), requested));
+  LOG(isolate_,
+      NewEvent("CodeRange", reinterpret_cast<void*>(reservation.address()),
+               requested));
   virtual_memory_.TakeControl(&reservation);
-  return true;
 }
 
 bool CodeRange::CompareFreeBlockAddress(const FreeBlock& left,
@@ -212,7 +213,7 @@ Address CodeRange::AllocateRawMemory(const size_t requested_size,
   FreeBlock current;
   if (!ReserveBlock(requested_size, &current)) {
     *allocated = 0;
-    return nullptr;
+    return kNullAddress;
   }
   *allocated = current.size;
   DCHECK(IsAddressAligned(current.start, MemoryChunk::kAlignment));
@@ -220,24 +221,11 @@ Address CodeRange::AllocateRawMemory(const size_t requested_size,
           &virtual_memory_, current.start, commit_size, *allocated)) {
     *allocated = 0;
     ReleaseBlock(&current);
-    return nullptr;
+    return kNullAddress;
   }
   return current.start;
 }
 
-
-bool CodeRange::CommitRawMemory(Address start, size_t length) {
-  return isolate_->heap()->memory_allocator()->CommitMemory(start, length,
-                                                            EXECUTABLE);
-}
-
-
-bool CodeRange::UncommitRawMemory(Address start, size_t length) {
-  return virtual_memory_.SetPermissions(start, length,
-                                        PageAllocator::kNoAccess);
-}
-
-
 void CodeRange::FreeRawMemory(Address address, size_t length) {
   DCHECK(IsAddressAligned(address, MemoryChunk::kAlignment));
   base::LockGuard<base::Mutex> guard(&code_range_mutex_);
@@ -278,26 +266,17 @@ void CodeRange::ReleaseBlock(const FreeBlock* block) {
 // MemoryAllocator
 //
 
-MemoryAllocator::MemoryAllocator(Isolate* isolate)
+MemoryAllocator::MemoryAllocator(Isolate* isolate, size_t capacity,
+                                 size_t code_range_size)
     : isolate_(isolate),
       code_range_(nullptr),
-      capacity_(0),
+      capacity_(RoundUp(capacity, Page::kPageSize)),
       size_(0),
       size_executable_(0),
-      lowest_ever_allocated_(reinterpret_cast<void*>(-1)),
-      highest_ever_allocated_(reinterpret_cast<void*>(0)),
-      unmapper_(isolate->heap(), this) {}
-
-bool MemoryAllocator::SetUp(size_t capacity, size_t code_range_size) {
-  capacity_ = ::RoundUp(capacity, Page::kPageSize);
-
-  size_ = 0;
-  size_executable_ = 0;
-
-  code_range_ = new CodeRange(isolate_);
-  if (!code_range_->SetUp(code_range_size)) return false;
-
-  return true;
+      lowest_ever_allocated_(static_cast<Address>(-1ll)),
+      highest_ever_allocated_(kNullAddress),
+      unmapper_(isolate->heap(), this) {
+  code_range_ = new CodeRange(isolate_, code_range_size);
 }
 
 
@@ -305,7 +284,7 @@ void MemoryAllocator::TearDown() {
   unmapper()->TearDown();
 
   // Check that spaces were torn down before MemoryAllocator.
-  DCHECK_EQ(size_.Value(), 0u);
+  DCHECK_EQ(size_, 0u);
   // TODO(gc) this will be true again when we fix FreeMemory.
   // DCHECK_EQ(0, size_executable_);
   capacity_ = 0;
@@ -330,7 +309,7 @@ class MemoryAllocator::Unmapper::UnmapFreeMemoryTask : public CancelableTask {
     TRACE_BACKGROUND_GC(tracer_,
                         GCTracer::BackgroundScope::BACKGROUND_UNMAPPER);
     unmapper_->PerformFreeMemoryOnQueuedChunks<FreeMode::kUncommitPooled>();
-    unmapper_->active_unmapping_tasks_.Decrement(1);
+    unmapper_->active_unmapping_tasks_--;
     unmapper_->pending_unmapping_tasks_semaphore_.Signal();
     if (FLAG_trace_unmapper) {
       PrintIsolate(unmapper_->heap_->isolate(),
@@ -361,9 +340,9 @@ void MemoryAllocator::Unmapper::FreeQueuedChunks() {
                    task->id());
     }
     DCHECK_LT(pending_unmapping_tasks_, kMaxUnmapperTasks);
-    DCHECK_LE(active_unmapping_tasks_.Value(), pending_unmapping_tasks_);
-    DCHECK_GE(active_unmapping_tasks_.Value(), 0);
-    active_unmapping_tasks_.Increment(1);
+    DCHECK_LE(active_unmapping_tasks_, pending_unmapping_tasks_);
+    DCHECK_GE(active_unmapping_tasks_, 0);
+    active_unmapping_tasks_++;
     task_ids_[pending_unmapping_tasks_++] = task->id();
     V8::GetCurrentPlatform()->CallOnWorkerThread(std::move(task));
   } else {
@@ -371,7 +350,7 @@ void MemoryAllocator::Unmapper::FreeQueuedChunks() {
   }
 }
 
-void MemoryAllocator::Unmapper::WaitUntilCompleted() {
+void MemoryAllocator::Unmapper::CancelAndWaitForPendingTasks() {
   for (int i = 0; i < pending_unmapping_tasks_; i++) {
     if (heap_->isolate()->cancelable_task_manager()->TryAbort(task_ids_[i]) !=
         CancelableTaskManager::kTaskAborted) {
@@ -379,25 +358,44 @@ void MemoryAllocator::Unmapper::WaitUntilCompleted() {
     }
   }
   pending_unmapping_tasks_ = 0;
-  active_unmapping_tasks_.SetValue(0);
+  active_unmapping_tasks_ = 0;
 
   if (FLAG_trace_unmapper) {
-    PrintIsolate(heap_->isolate(),
-                 "Unmapper::WaitUntilCompleted: no tasks remaining\n");
+    PrintIsolate(
+        heap_->isolate(),
+        "Unmapper::CancelAndWaitForPendingTasks: no tasks remaining\n");
   }
 }
 
+void MemoryAllocator::Unmapper::PrepareForMarkCompact() {
+  CancelAndWaitForPendingTasks();
+  // Free non-regular chunks because they cannot be re-used.
+  PerformFreeMemoryOnQueuedNonRegularChunks();
+}
+
+void MemoryAllocator::Unmapper::EnsureUnmappingCompleted() {
+  CancelAndWaitForPendingTasks();
+  PerformFreeMemoryOnQueuedChunks<FreeMode::kReleasePooled>();
+}
+
 bool MemoryAllocator::Unmapper::MakeRoomForNewTasks() {
   DCHECK_LE(pending_unmapping_tasks_, kMaxUnmapperTasks);
 
-  if (active_unmapping_tasks_.Value() == 0 && pending_unmapping_tasks_ > 0) {
+  if (active_unmapping_tasks_ == 0 && pending_unmapping_tasks_ > 0) {
     // All previous unmapping tasks have been run to completion.
     // Finalize those tasks to make room for new ones.
-    WaitUntilCompleted();
+    CancelAndWaitForPendingTasks();
   }
   return pending_unmapping_tasks_ != kMaxUnmapperTasks;
 }
 
+void MemoryAllocator::Unmapper::PerformFreeMemoryOnQueuedNonRegularChunks() {
+  MemoryChunk* chunk = nullptr;
+  while ((chunk = GetMemoryChunkSafe<kNonRegular>()) != nullptr) {
+    allocator_->PerformFreeMemory(chunk);
+  }
+}
+
 template <MemoryAllocator::Unmapper::FreeMode mode>
 void MemoryAllocator::Unmapper::PerformFreeMemoryOnQueuedChunks() {
   MemoryChunk* chunk = nullptr;
@@ -421,10 +419,7 @@ void MemoryAllocator::Unmapper::PerformFreeMemoryOnQueuedChunks() {
       allocator_->Free<MemoryAllocator::kAlreadyPooled>(chunk);
     }
   }
-  // Non-regular chunks.
-  while ((chunk = GetMemoryChunkSafe<kNonRegular>()) != nullptr) {
-    allocator_->PerformFreeMemory(chunk);
-  }
+  PerformFreeMemoryOnQueuedNonRegularChunks();
 }
 
 void MemoryAllocator::Unmapper::TearDown() {
@@ -444,8 +439,22 @@ int MemoryAllocator::Unmapper::NumberOfChunks() {
   return static_cast<int>(result);
 }
 
-bool MemoryAllocator::CommitMemory(Address base, size_t size,
-                                   Executability executable) {
+size_t MemoryAllocator::Unmapper::CommittedBufferedMemory() {
+  base::LockGuard<base::Mutex> guard(&mutex_);
+
+  size_t sum = 0;
+  // kPooled chunks are already uncommited. We only have to account for
+  // kRegular and kNonRegular chunks.
+  for (auto& chunk : chunks_[kRegular]) {
+    sum += chunk->size();
+  }
+  for (auto& chunk : chunks_[kNonRegular]) {
+    sum += chunk->size();
+  }
+  return sum;
+}
+
+bool MemoryAllocator::CommitMemory(Address base, size_t size) {
   if (!SetPermissions(base, size, PageAllocator::kReadWrite)) {
     return false;
   }
@@ -458,7 +467,7 @@ void MemoryAllocator::FreeMemory(VirtualMemory* reservation,
   // TODO(gc) make code_range part of memory allocator?
   // Code which is part of the code-range does not have its own VirtualMemory.
   DCHECK(code_range() == nullptr ||
-         !code_range()->contains(static_cast<Address>(reservation->address())));
+         !code_range()->contains(reservation->address()));
   DCHECK(executable == NOT_EXECUTABLE || !code_range()->valid() ||
          reservation->size() <= Page::kPageSize);
 
@@ -469,13 +478,12 @@ void MemoryAllocator::FreeMemory(VirtualMemory* reservation,
 void MemoryAllocator::FreeMemory(Address base, size_t size,
                                  Executability executable) {
   // TODO(gc) make code_range part of memory allocator?
-  if (code_range() != nullptr &&
-      code_range()->contains(static_cast<Address>(base))) {
+  if (code_range() != nullptr && code_range()->contains(base)) {
     DCHECK(executable == EXECUTABLE);
     code_range()->FreeRawMemory(base, size);
   } else {
     DCHECK(executable == NOT_EXECUTABLE || !code_range()->valid());
-    CHECK(FreePages(base, size));
+    CHECK(FreePages(reinterpret_cast<void*>(base), size));
   }
 }
 
@@ -483,11 +491,12 @@ Address MemoryAllocator::ReserveAlignedMemory(size_t size, size_t alignment,
                                               void* hint,
                                               VirtualMemory* controller) {
   VirtualMemory reservation;
-  if (!AlignedAllocVirtualMemory(size, alignment, hint, &reservation))
-    return nullptr;
+  if (!AlignedAllocVirtualMemory(size, alignment, hint, &reservation)) {
+    return kNullAddress;
+  }
 
-  Address result = static_cast<Address>(reservation.address());
-  size_.Increment(reservation.size());
+  Address result = reservation.address();
+  size_ += reservation.size();
   controller->TakeControl(&reservation);
   return result;
 }
@@ -499,42 +508,34 @@ Address MemoryAllocator::AllocateAlignedMemory(
   VirtualMemory reservation;
   Address base =
       ReserveAlignedMemory(reserve_size, alignment, hint, &reservation);
-  if (base == nullptr) return nullptr;
+  if (base == kNullAddress) return kNullAddress;
 
   if (executable == EXECUTABLE) {
     if (!CommitExecutableMemory(&reservation, base, commit_size,
                                 reserve_size)) {
-      base = nullptr;
+      base = kNullAddress;
     }
   } else {
     if (reservation.SetPermissions(base, commit_size,
                                    PageAllocator::kReadWrite)) {
       UpdateAllocatedSpaceLimits(base, base + commit_size);
     } else {
-      base = nullptr;
+      base = kNullAddress;
     }
   }
 
-  if (base == nullptr) {
+  if (base == kNullAddress) {
     // Failed to commit the body. Free the mapping and any partially committed
     // regions inside it.
     reservation.Free();
-    size_.Decrement(reserve_size);
-    return nullptr;
+    size_ -= reserve_size;
+    return kNullAddress;
   }
 
   controller->TakeControl(&reservation);
   return base;
 }
 
-void Page::InitializeAsAnchor(Space* space) {
-  set_owner(space);
-  set_next_chunk(this);
-  set_prev_chunk(this);
-  SetFlags(0, static_cast<uintptr_t>(~0));
-  SetFlag(ANCHOR);
-}
-
 Heap* MemoryChunk::synchronized_heap() {
   return reinterpret_cast<Heap*>(
       base::Acquire_Load(reinterpret_cast<base::AtomicWord*>(&heap_)));
@@ -628,10 +629,13 @@ MemoryChunk* MemoryChunk::Initialize(Heap* heap, Address base, size_t size,
   chunk->allocated_bytes_ = chunk->area_size();
   chunk->wasted_memory_ = 0;
   chunk->young_generation_bitmap_ = nullptr;
-  chunk->set_next_chunk(nullptr);
-  chunk->set_prev_chunk(nullptr);
   chunk->local_tracker_ = nullptr;
 
+  chunk->external_backing_store_bytes_[ExternalBackingStoreType::kArrayBuffer] =
+      0;
+  chunk->external_backing_store_bytes_
+      [ExternalBackingStoreType::kExternalString] = 0;
+
   for (int i = kFirstCategory; i < kNumberOfCategories; i++) {
     chunk->categories_[i] = nullptr;
   }
@@ -674,9 +678,10 @@ Page* PagedSpace::InitializePage(MemoryChunk* chunk, Executability executable) {
   DCHECK_GE(Page::kAllocatableMemory, page->area_size());
   // Make sure that categories are initialized before freeing the area.
   page->ResetAllocatedBytes();
-  heap()->incremental_marking()->SetOldSpacePageFlags(page);
+  page->SetOldGenerationPageFlags(heap()->incremental_marking()->IsMarking());
   page->AllocateFreeListCategories();
   page->InitializeFreeListCategories();
+  page->list_node().Initialize();
   page->InitializationMemoryFence();
   return page;
 }
@@ -689,8 +694,9 @@ Page* SemiSpace::InitializePage(MemoryChunk* chunk, Executability executable) {
   DCHECK(!chunk->IsFlagSet(in_to_space ? MemoryChunk::IN_FROM_SPACE
                                        : MemoryChunk::IN_TO_SPACE));
   Page* page = static_cast<Page*>(chunk);
-  heap()->incremental_marking()->SetNewSpacePageFlags(page);
+  page->SetYoungGenerationPageFlags(heap()->incremental_marking()->IsMarking());
   page->AllocateLocalTracker();
+  page->list_node().Initialize();
 #ifdef ENABLE_MINOR_MC
   if (FLAG_minor_mc) {
     page->AllocateYoungGenerationBitmap();
@@ -705,24 +711,16 @@ Page* SemiSpace::InitializePage(MemoryChunk* chunk, Executability executable) {
 }
 
 LargePage* LargePage::Initialize(Heap* heap, MemoryChunk* chunk,
-                                 Executability executable, Space* owner) {
+                                 Executability executable) {
   if (executable && chunk->size() > LargePage::kMaxCodePageSize) {
     STATIC_ASSERT(LargePage::kMaxCodePageSize <= TypedSlotSet::kMaxOffset);
     FATAL("Code page is too large.");
   }
-  heap->incremental_marking()->SetOldSpacePageFlags(chunk);
 
   MSAN_ALLOCATED_UNINITIALIZED_MEMORY(chunk->area_start(), chunk->area_size());
 
-  // Initialize the owner field for each contained page (except the first, which
-  // is initialized by MemoryChunk::Initialize).
-  for (Address addr = chunk->address() + Page::kPageSize + Page::kOwnerOffset;
-       addr < chunk->area_end(); addr += Page::kPageSize) {
-    // Clear out kPageHeaderTag.
-    Memory::Address_at(addr) = 0;
-  }
   LargePage* page = static_cast<LargePage*>(chunk);
-  page->InitializationMemoryFence();
+  page->list_node().Initialize();
   return page;
 }
 
@@ -749,7 +747,7 @@ void Page::ReleaseFreeListCategories() {
 }
 
 Page* Page::ConvertNewToOld(Page* old_page) {
-  DCHECK(!old_page->is_anchor());
+  DCHECK(old_page);
   DCHECK(old_page->InNewSpace());
   OldSpace* old_space = old_page->heap()->old_space();
   old_page->set_owner(old_space);
@@ -769,25 +767,6 @@ bool MemoryChunk::IsPagedSpace() const {
   return owner()->identity() != LO_SPACE;
 }
 
-void MemoryChunk::InsertAfter(MemoryChunk* other) {
-  MemoryChunk* other_next = other->next_chunk();
-
-  set_next_chunk(other_next);
-  set_prev_chunk(other);
-  other_next->set_prev_chunk(this);
-  other->set_next_chunk(this);
-}
-
-
-void MemoryChunk::Unlink() {
-  MemoryChunk* next_element = next_chunk();
-  MemoryChunk* prev_element = prev_chunk();
-  next_element->set_prev_chunk(prev_element);
-  prev_element->set_next_chunk(next_element);
-  set_prev_chunk(nullptr);
-  set_next_chunk(nullptr);
-}
-
 MemoryChunk* MemoryAllocator::AllocateChunk(size_t reserve_area_size,
                                             size_t commit_area_size,
                                             Executability executable,
@@ -796,10 +775,10 @@ MemoryChunk* MemoryAllocator::AllocateChunk(size_t reserve_area_size,
 
   size_t chunk_size;
   Heap* heap = isolate_->heap();
-  Address base = nullptr;
+  Address base = kNullAddress;
   VirtualMemory reservation;
-  Address area_start = nullptr;
-  Address area_end = nullptr;
+  Address area_start = kNullAddress;
+  Address area_end = kNullAddress;
   void* address_hint =
       AlignedAddress(heap->GetRandomMmapAddr(), MemoryChunk::kAlignment);
 
@@ -851,24 +830,23 @@ MemoryChunk* MemoryAllocator::AllocateChunk(size_t reserve_area_size,
 #endif
       base =
           code_range()->AllocateRawMemory(chunk_size, commit_size, &chunk_size);
-      DCHECK(
-          IsAligned(reinterpret_cast<intptr_t>(base), MemoryChunk::kAlignment));
-      if (base == nullptr) return nullptr;
-      size_.Increment(chunk_size);
+      DCHECK(IsAligned(base, MemoryChunk::kAlignment));
+      if (base == kNullAddress) return nullptr;
+      size_ += chunk_size;
       // Update executable memory size.
-      size_executable_.Increment(chunk_size);
+      size_executable_ += chunk_size;
     } else {
       base = AllocateAlignedMemory(chunk_size, commit_size,
                                    MemoryChunk::kAlignment, executable,
                                    address_hint, &reservation);
-      if (base == nullptr) return nullptr;
+      if (base == kNullAddress) return nullptr;
       // Update executable memory size.
-      size_executable_.Increment(reservation.size());
+      size_executable_ += reservation.size();
     }
 
     if (Heap::ShouldZapGarbage()) {
-      ZapBlock(base, CodePageGuardStartOffset());
-      ZapBlock(base + CodePageAreaStartOffset(), commit_area_size);
+      ZapBlock(base, CodePageGuardStartOffset(), kZapValue);
+      ZapBlock(base + CodePageAreaStartOffset(), commit_area_size, kZapValue);
     }
 
     area_start = base + CodePageAreaStartOffset();
@@ -883,10 +861,10 @@ MemoryChunk* MemoryAllocator::AllocateChunk(size_t reserve_area_size,
         AllocateAlignedMemory(chunk_size, commit_size, MemoryChunk::kAlignment,
                               executable, address_hint, &reservation);
 
-    if (base == nullptr) return nullptr;
+    if (base == kNullAddress) return nullptr;
 
     if (Heap::ShouldZapGarbage()) {
-      ZapBlock(base, Page::kObjectStartOffset + commit_area_size);
+      ZapBlock(base, Page::kObjectStartOffset + commit_area_size, kZapValue);
     }
 
     area_start = base + Page::kObjectStartOffset;
@@ -898,19 +876,19 @@ MemoryChunk* MemoryAllocator::AllocateChunk(size_t reserve_area_size,
   isolate_->counters()->memory_allocated()->Increment(
       static_cast<int>(chunk_size));
 
-  LOG(isolate_, NewEvent("MemoryChunk", base, chunk_size));
+  LOG(isolate_,
+      NewEvent("MemoryChunk", reinterpret_cast<void*>(base), chunk_size));
 
   // We cannot use the last chunk in the address space because we would
   // overflow when comparing top and limit if this chunk is used for a
   // linear allocation area.
-  if ((reinterpret_cast<uintptr_t>(base) + chunk_size) == 0u) {
+  if ((base + chunk_size) == 0u) {
     CHECK(!last_chunk_.IsReserved());
     last_chunk_.TakeControl(&reservation);
-    UncommitBlock(reinterpret_cast<Address>(last_chunk_.address()),
-                  last_chunk_.size());
-    size_.Decrement(chunk_size);
+    UncommitBlock(last_chunk_.address(), last_chunk_.size());
+    size_ -= chunk_size;
     if (executable == EXECUTABLE) {
-      size_executable_.Decrement(chunk_size);
+      size_executable_ -= chunk_size;
     }
     CHECK(last_chunk_.IsReserved());
     return AllocateChunk(reserve_area_size, commit_area_size, executable,
@@ -925,8 +903,36 @@ MemoryChunk* MemoryAllocator::AllocateChunk(size_t reserve_area_size,
   return chunk;
 }
 
+void MemoryChunk::SetOldGenerationPageFlags(bool is_marking) {
+  if (is_marking) {
+    SetFlag(MemoryChunk::POINTERS_TO_HERE_ARE_INTERESTING);
+    SetFlag(MemoryChunk::POINTERS_FROM_HERE_ARE_INTERESTING);
+  } else {
+    ClearFlag(MemoryChunk::POINTERS_TO_HERE_ARE_INTERESTING);
+    SetFlag(MemoryChunk::POINTERS_FROM_HERE_ARE_INTERESTING);
+  }
+}
+
+void MemoryChunk::SetYoungGenerationPageFlags(bool is_marking) {
+  SetFlag(MemoryChunk::POINTERS_TO_HERE_ARE_INTERESTING);
+  if (is_marking) {
+    SetFlag(MemoryChunk::POINTERS_FROM_HERE_ARE_INTERESTING);
+  } else {
+    ClearFlag(MemoryChunk::POINTERS_FROM_HERE_ARE_INTERESTING);
+  }
+}
+
 void Page::ResetAllocatedBytes() { allocated_bytes_ = area_size(); }
 
+void Page::AllocateLocalTracker() {
+  DCHECK_NULL(local_tracker_);
+  local_tracker_ = new LocalArrayBufferTracker(this);
+}
+
+bool Page::contains_array_buffers() {
+  return local_tracker_ != nullptr && !local_tracker_->IsEmpty();
+}
+
 void Page::ResetFreeListStatistics() {
   wasted_memory_ = 0;
 }
@@ -1004,7 +1010,7 @@ void Page::CreateBlackArea(Address start, Address end) {
       heap()->incremental_marking()->marking_state();
   marking_state->bitmap(this)->SetRange(AddressToMarkbitIndex(start),
                                         AddressToMarkbitIndex(end));
-  marking_state->IncrementLiveBytes(this, static_cast<int>(end - start));
+  marking_state->IncrementLiveBytes(this, static_cast<intptr_t>(end - start));
 }
 
 void Page::DestroyBlackArea(Address start, Address end) {
@@ -1016,7 +1022,7 @@ void Page::DestroyBlackArea(Address start, Address end) {
       heap()->incremental_marking()->marking_state();
   marking_state->bitmap(this)->ClearRange(AddressToMarkbitIndex(start),
                                           AddressToMarkbitIndex(end));
-  marking_state->IncrementLiveBytes(this, -static_cast<int>(end - start));
+  marking_state->IncrementLiveBytes(this, -static_cast<intptr_t>(end - start));
 }
 
 void MemoryAllocator::PartialFreeMemory(MemoryChunk* chunk, Address start_free,
@@ -1029,8 +1035,7 @@ void MemoryAllocator::PartialFreeMemory(MemoryChunk* chunk, Address start_free,
   if (chunk->IsFlagSet(MemoryChunk::IS_EXECUTABLE)) {
     // Add guard page at the end.
     size_t page_size = GetCommitPageSize();
-    DCHECK_EQ(0, reinterpret_cast<uintptr_t>(chunk->area_end_) %
-                     static_cast<uintptr_t>(page_size));
+    DCHECK_EQ(0, chunk->area_end_ % static_cast<Address>(page_size));
     DCHECK_EQ(chunk->address() + chunk->size(),
               chunk->area_end() + CodePageGuardSize());
     reservation->SetPermissions(chunk->area_end_, page_size,
@@ -1040,8 +1045,8 @@ void MemoryAllocator::PartialFreeMemory(MemoryChunk* chunk, Address start_free,
   // partially starting at |start_free| will also release the potentially
   // unused part behind the current page.
   const size_t released_bytes = reservation->Release(start_free);
-  DCHECK_GE(size_.Value(), released_bytes);
-  size_.Decrement(released_bytes);
+  DCHECK_GE(size_, released_bytes);
+  size_ -= released_bytes;
   isolate_->counters()->memory_allocated()->Decrement(
       static_cast<int>(released_bytes));
 }
@@ -1056,12 +1061,12 @@ void MemoryAllocator::PreFreeMemory(MemoryChunk* chunk) {
   VirtualMemory* reservation = chunk->reserved_memory();
   const size_t size =
       reservation->IsReserved() ? reservation->size() : chunk->size();
-  DCHECK_GE(size_.Value(), static_cast<size_t>(size));
-  size_.Decrement(size);
+  DCHECK_GE(size_, static_cast<size_t>(size));
+  size_ -= size;
   isolate_->counters()->memory_allocated()->Decrement(static_cast<int>(size));
   if (chunk->executable() == EXECUTABLE) {
-    DCHECK_GE(size_executable_.Value(), size);
-    size_executable_.Decrement(size);
+    DCHECK_GE(size_executable_, size);
+    size_executable_ -= size;
   }
 
   chunk->SetFlag(MemoryChunk::PRE_FREED);
@@ -1153,7 +1158,7 @@ LargePage* MemoryAllocator::AllocateLargePage(size_t size,
                                               Executability executable) {
   MemoryChunk* chunk = AllocateChunk(size, size, executable, owner);
   if (chunk == nullptr) return nullptr;
-  return LargePage::Initialize(isolate_->heap(), chunk, executable, owner);
+  return LargePage::Initialize(isolate_->heap(), chunk, executable);
 }
 
 template <typename SpaceType>
@@ -1164,22 +1169,21 @@ MemoryChunk* MemoryAllocator::AllocatePagePooled(SpaceType* owner) {
   const Address start = reinterpret_cast<Address>(chunk);
   const Address area_start = start + MemoryChunk::kObjectStartOffset;
   const Address area_end = start + size;
-  if (!CommitBlock(reinterpret_cast<Address>(chunk), size, NOT_EXECUTABLE)) {
+  if (!CommitBlock(start, size)) {
     return nullptr;
   }
   VirtualMemory reservation(start, size);
   MemoryChunk::Initialize(isolate_->heap(), start, size, area_start, area_end,
                           NOT_EXECUTABLE, owner, &reservation);
-  size_.Increment(size);
+  size_ += size;
   return chunk;
 }
 
-bool MemoryAllocator::CommitBlock(Address start, size_t size,
-                                  Executability executable) {
-  if (!CommitMemory(start, size, executable)) return false;
+bool MemoryAllocator::CommitBlock(Address start, size_t size) {
+  if (!CommitMemory(start, size)) return false;
 
   if (Heap::ShouldZapGarbage()) {
-    ZapBlock(start, size);
+    ZapBlock(start, size, kZapValue);
   }
 
   isolate_->counters()->memory_allocated()->Increment(static_cast<int>(size));
@@ -1193,10 +1197,12 @@ bool MemoryAllocator::UncommitBlock(Address start, size_t size) {
   return true;
 }
 
-
-void MemoryAllocator::ZapBlock(Address start, size_t size) {
+void MemoryAllocator::ZapBlock(Address start, size_t size,
+                               uintptr_t zap_value) {
+  DCHECK_EQ(start % kPointerSize, 0);
+  DCHECK_EQ(size % kPointerSize, 0);
   for (size_t s = 0; s + kPointerSize <= size; s += kPointerSize) {
-    Memory::Address_at(start + s) = reinterpret_cast<Address>(kZapValue);
+    Memory::Address_at(start + s) = static_cast<Address>(zap_value);
   }
 }
 
@@ -1271,10 +1277,6 @@ bool MemoryAllocator::CommitExecutableMemory(VirtualMemory* vm, Address start,
 // -----------------------------------------------------------------------------
 // MemoryChunk implementation
 
-bool MemoryChunk::contains_array_buffers() {
-  return local_tracker() != nullptr && !local_tracker()->IsEmpty();
-}
-
 void MemoryChunk::ReleaseAllocatedMemory() {
   if (skip_list_ != nullptr) {
     delete skip_list_;
@@ -1392,11 +1394,6 @@ void MemoryChunk::RegisterObjectWithInvalidatedSlots(HeapObject* object,
   }
 }
 
-void MemoryChunk::AllocateLocalTracker() {
-  DCHECK_NULL(local_tracker_);
-  local_tracker_ = new LocalArrayBufferTracker(heap());
-}
-
 void MemoryChunk::ReleaseLocalTracker() {
   DCHECK_NOT_NULL(local_tracker_);
   delete local_tracker_;
@@ -1414,6 +1411,19 @@ void MemoryChunk::ReleaseYoungGenerationBitmap() {
   young_generation_bitmap_ = nullptr;
 }
 
+void MemoryChunk::IncrementExternalBackingStoreBytes(
+    ExternalBackingStoreType type, size_t amount) {
+  external_backing_store_bytes_[type] += amount;
+  owner()->IncrementExternalBackingStoreBytes(type, amount);
+}
+
+void MemoryChunk::DecrementExternalBackingStoreBytes(
+    ExternalBackingStoreType type, size_t amount) {
+  DCHECK_GE(external_backing_store_bytes_[type], amount);
+  external_backing_store_bytes_[type] -= amount;
+  owner()->DecrementExternalBackingStoreBytes(type, amount);
+}
+
 // -----------------------------------------------------------------------------
 // PagedSpace implementation
 
@@ -1463,25 +1473,17 @@ intptr_t Space::GetNextInlineAllocationStepSize() {
 
 PagedSpace::PagedSpace(Heap* heap, AllocationSpace space,
                        Executability executable)
-    : SpaceWithLinearArea(heap, space, executable), anchor_(this) {
+    : SpaceWithLinearArea(heap, space), executable_(executable) {
   area_size_ = MemoryAllocator::PageAreaSize(space);
   accounting_stats_.Clear();
 }
 
-
-bool PagedSpace::SetUp() { return true; }
-
-
-bool PagedSpace::HasBeenSetUp() { return true; }
-
-
 void PagedSpace::TearDown() {
-  for (auto it = begin(); it != end();) {
-    Page* page = *(it++);  // Will be erased.
-    heap()->memory_allocator()->Free<MemoryAllocator::kFull>(page);
+  while (!memory_chunk_list_.Empty()) {
+    MemoryChunk* chunk = memory_chunk_list_.front();
+    memory_chunk_list_.Remove(chunk);
+    heap()->memory_allocator()->Free<MemoryAllocator::kFull>(chunk);
   }
-  anchor_.set_next_page(&anchor_);
-  anchor_.set_prev_page(&anchor_);
   accounting_stats_.Clear();
 }
 
@@ -1525,13 +1527,11 @@ void PagedSpace::MergeCompactionSpace(CompactionSpace* other) {
   DCHECK(identity() == other->identity());
   // Unmerged fields:
   //   area_size_
-  //   anchor_
-
   other->FreeLinearAllocationArea();
 
   // The linear allocation area of {other} should be destroyed now.
-  DCHECK_NULL(other->top());
-  DCHECK_NULL(other->limit());
+  DCHECK_EQ(kNullAddress, other->top());
+  DCHECK_EQ(kNullAddress, other->limit());
 
   // Move over pages.
   for (auto it = other->begin(); it != other->end();) {
@@ -1609,20 +1609,28 @@ Page* PagedSpace::RemovePageSafe(int size_in_bytes) {
 size_t PagedSpace::AddPage(Page* page) {
   CHECK(page->SweepingDone());
   page->set_owner(this);
-  page->InsertAfter(anchor()->prev_page());
+  memory_chunk_list_.PushBack(page);
   AccountCommitted(page->size());
   IncreaseCapacity(page->area_size());
   IncreaseAllocatedBytes(page->allocated_bytes(), page);
+  for (size_t i = 0; i < ExternalBackingStoreType::kNumTypes; i++) {
+    ExternalBackingStoreType t = static_cast<ExternalBackingStoreType>(i);
+    IncrementExternalBackingStoreBytes(t, page->ExternalBackingStoreBytes(t));
+  }
   return RelinkFreeListCategories(page);
 }
 
 void PagedSpace::RemovePage(Page* page) {
   CHECK(page->SweepingDone());
-  page->Unlink();
+  memory_chunk_list_.Remove(page);
   UnlinkFreeListCategories(page);
   DecreaseAllocatedBytes(page->allocated_bytes(), page);
   DecreaseCapacity(page->area_size());
   AccountUncommitted(page->size());
+  for (size_t i = 0; i < ExternalBackingStoreType::kNumTypes; i++) {
+    ExternalBackingStoreType t = static_cast<ExternalBackingStoreType>(i);
+    DecrementExternalBackingStoreBytes(t, page->ExternalBackingStoreBytes(t));
+  }
 }
 
 size_t PagedSpace::ShrinkPageToHighWaterMark(Page* page) {
@@ -1667,7 +1675,6 @@ bool PagedSpace::Expand() {
   AddPage(page);
   Free(page->area_start(), page->area_size(),
        SpaceAccountingMode::kSpaceAccounted);
-  DCHECK(Capacity() <= heap()->MaxOldGenerationSize());
   return true;
 }
 
@@ -1690,7 +1697,7 @@ void PagedSpace::ResetFreeListStatistics() {
 
 void PagedSpace::SetLinearAllocationArea(Address top, Address limit) {
   SetTopAndLimit(top, limit);
-  if (top != nullptr && top != limit &&
+  if (top != kNullAddress && top != limit &&
       heap()->incremental_marking()->black_allocation()) {
     Page::FromAllocationAreaAddress(top)->CreateBlackArea(top, limit);
   }
@@ -1735,7 +1742,7 @@ Address SpaceWithLinearArea::ComputeLimit(Address start, Address end,
     } else {
       rounded_step = RoundSizeDownToObjectAlignment(static_cast<int>(step));
     }
-    return Min(start + min_size + rounded_step, end);
+    return Min(static_cast<Address>(start + min_size + rounded_step), end);
   } else {
     // The entire node can be used as the linear allocation area.
     return end;
@@ -1746,7 +1753,7 @@ void PagedSpace::MarkLinearAllocationAreaBlack() {
   DCHECK(heap()->incremental_marking()->black_allocation());
   Address current_top = top();
   Address current_limit = limit();
-  if (current_top != nullptr && current_top != current_limit) {
+  if (current_top != kNullAddress && current_top != current_limit) {
     Page::FromAllocationAreaAddress(current_top)
         ->CreateBlackArea(current_top, current_limit);
   }
@@ -1755,7 +1762,7 @@ void PagedSpace::MarkLinearAllocationAreaBlack() {
 void PagedSpace::UnmarkLinearAllocationArea() {
   Address current_top = top();
   Address current_limit = limit();
-  if (current_top != nullptr && current_top != current_limit) {
+  if (current_top != kNullAddress && current_top != current_limit) {
     Page::FromAllocationAreaAddress(current_top)
         ->DestroyBlackArea(current_top, current_limit);
   }
@@ -1766,8 +1773,8 @@ void PagedSpace::FreeLinearAllocationArea() {
   // skipped when scanning the heap.
   Address current_top = top();
   Address current_limit = limit();
-  if (current_top == nullptr) {
-    DCHECK_NULL(current_limit);
+  if (current_top == kNullAddress) {
+    DCHECK_EQ(kNullAddress, current_limit);
     return;
   }
 
@@ -1786,14 +1793,14 @@ void PagedSpace::FreeLinearAllocationArea() {
     }
   }
 
-  InlineAllocationStep(current_top, nullptr, nullptr, 0);
-  SetTopAndLimit(nullptr, nullptr);
+  InlineAllocationStep(current_top, kNullAddress, kNullAddress, 0);
+  SetTopAndLimit(kNullAddress, kNullAddress);
   DCHECK_GE(current_limit, current_top);
 
   // The code page of the linear allocation area needs to be unprotected
   // because we are going to write a filler into that memory area below.
   if (identity() == CODE_SPACE) {
-    heap_->UnprotectAndRegisterMemoryChunk(
+    heap()->UnprotectAndRegisterMemoryChunk(
         MemoryChunk::FromAddress(current_top));
   }
   Free(current_top, current_limit - current_top,
@@ -1811,14 +1818,9 @@ void PagedSpace::ReleasePage(Page* page) {
 
   if (Page::FromAllocationAreaAddress(allocation_info_.top()) == page) {
     DCHECK(!top_on_previous_step_);
-    allocation_info_.Reset(nullptr, nullptr);
+    allocation_info_.Reset(kNullAddress, kNullAddress);
   }
 
-  // If page is still in a list, unlink it from that list.
-  if (page->next_chunk() != nullptr) {
-    DCHECK_NOT_NULL(page->prev_chunk());
-    page->Unlink();
-  }
   AccountUncommitted(page->size());
   accounting_stats_.DecreaseCapacity(page->area_size());
   heap()->memory_allocator()->Free<MemoryAllocator::kPreFreeAndQueue>(page);
@@ -1827,7 +1829,7 @@ void PagedSpace::ReleasePage(Page* page) {
 void PagedSpace::SetReadAndExecutable() {
   DCHECK(identity() == CODE_SPACE);
   for (Page* page : *this) {
-    CHECK(heap_->memory_allocator()->IsMemoryChunkExecutable(page));
+    CHECK(heap()->memory_allocator()->IsMemoryChunkExecutable(page));
     page->SetReadAndExecutable();
   }
 }
@@ -1835,7 +1837,7 @@ void PagedSpace::SetReadAndExecutable() {
 void PagedSpace::SetReadAndWritable() {
   DCHECK(identity() == CODE_SPACE);
   for (Page* page : *this) {
-    CHECK(heap_->memory_allocator()->IsMemoryChunkExecutable(page));
+    CHECK(heap()->memory_allocator()->IsMemoryChunkExecutable(page));
     page->SetReadAndWritable();
   }
 }
@@ -1889,7 +1891,7 @@ bool PagedSpace::RefillLinearAllocationAreaFromFreeList(size_t size_in_bytes) {
   DCHECK_LE(size_in_bytes, limit - start);
   if (limit != end) {
     if (identity() == CODE_SPACE) {
-      heap_->UnprotectAndRegisterMemoryChunk(page);
+      heap()->UnprotectAndRegisterMemoryChunk(page);
     }
     Free(limit, end - limit, SpaceAccountingMode::kSpaceAccounted);
   }
@@ -1903,11 +1905,23 @@ void PagedSpace::Print() {}
 #endif
 
 #ifdef VERIFY_HEAP
-void PagedSpace::Verify(ObjectVisitor* visitor) {
+void PagedSpace::Verify(Isolate* isolate, ObjectVisitor* visitor) {
   bool allocation_pointer_found_in_space =
       (allocation_info_.top() == allocation_info_.limit());
+  size_t external_space_bytes[kNumTypes];
+  size_t external_page_bytes[kNumTypes];
+
+  for (int i = 0; i < kNumTypes; i++) {
+    external_space_bytes[static_cast<ExternalBackingStoreType>(i)] = 0;
+  }
+
   for (Page* page : *this) {
     CHECK(page->owner() == this);
+
+    for (int i = 0; i < kNumTypes; i++) {
+      external_page_bytes[static_cast<ExternalBackingStoreType>(i)] = 0;
+    }
+
     if (page == Page::FromAllocationAreaAddress(allocation_info_.top())) {
       allocation_pointer_found_in_space = true;
     }
@@ -1915,6 +1929,7 @@ void PagedSpace::Verify(ObjectVisitor* visitor) {
     HeapObjectIterator it(page);
     Address end_of_previous_object = page->area_start();
     Address top = page->area_end();
+
     for (HeapObject* object = it.Next(); object != nullptr;
          object = it.Next()) {
       CHECK(end_of_previous_object <= object->address());
@@ -1923,13 +1938,14 @@ void PagedSpace::Verify(ObjectVisitor* visitor) {
       // be in map space.
       Map* map = object->map();
       CHECK(map->IsMap());
-      CHECK(heap()->map_space()->Contains(map));
+      CHECK(heap()->map_space()->Contains(map) ||
+            heap()->read_only_space()->Contains(map));
 
       // Perform space-specific object verification.
       VerifyObject(object);
 
       // The object itself should look OK.
-      object->ObjectVerify();
+      object->ObjectVerify(isolate);
 
       if (!FLAG_verify_heap_skip_remembered_set) {
         heap()->VerifyRememberedSetFor(object);
@@ -1940,8 +1956,25 @@ void PagedSpace::Verify(ObjectVisitor* visitor) {
       object->IterateBody(map, size, visitor);
       CHECK(object->address() + size <= top);
       end_of_previous_object = object->address() + size;
+
+      if (object->IsJSArrayBuffer()) {
+        JSArrayBuffer* array_buffer = JSArrayBuffer::cast(object);
+        if (ArrayBufferTracker::IsTracked(array_buffer)) {
+          size_t size = NumberToSize(array_buffer->byte_length());
+          external_page_bytes[ExternalBackingStoreType::kArrayBuffer] += size;
+        }
+      }
+    }
+    for (int i = 0; i < kNumTypes; i++) {
+      ExternalBackingStoreType t = static_cast<ExternalBackingStoreType>(i);
+      CHECK_EQ(external_page_bytes[t], page->ExternalBackingStoreBytes(t));
+      external_space_bytes[t] += external_page_bytes[t];
     }
   }
+  for (int i = 0; i < kNumTypes; i++) {
+    ExternalBackingStoreType t = static_cast<ExternalBackingStoreType>(i);
+    CHECK_EQ(external_space_bytes[t], ExternalBackingStoreBytes(t));
+  }
   CHECK(allocation_pointer_found_in_space);
 #ifdef DEBUG
   VerifyCountersAfterSweeping();
@@ -2019,26 +2052,27 @@ void PagedSpace::VerifyCountersBeforeConcurrentSweeping() {
 // -----------------------------------------------------------------------------
 // NewSpace implementation
 
-bool NewSpace::SetUp(size_t initial_semispace_capacity,
-                     size_t maximum_semispace_capacity) {
-  DCHECK(initial_semispace_capacity <= maximum_semispace_capacity);
-  DCHECK(base::bits::IsPowerOfTwo(
-      static_cast<uint32_t>(maximum_semispace_capacity)));
-
-  to_space_.SetUp(initial_semispace_capacity, maximum_semispace_capacity);
-  from_space_.SetUp(initial_semispace_capacity, maximum_semispace_capacity);
+NewSpace::NewSpace(Heap* heap, size_t initial_semispace_capacity,
+                   size_t max_semispace_capacity)
+    : SpaceWithLinearArea(heap, NEW_SPACE),
+      to_space_(heap, kToSpace),
+      from_space_(heap, kFromSpace),
+      reservation_() {
+  DCHECK(initial_semispace_capacity <= max_semispace_capacity);
+  DCHECK(
+      base::bits::IsPowerOfTwo(static_cast<uint32_t>(max_semispace_capacity)));
+
+  to_space_.SetUp(initial_semispace_capacity, max_semispace_capacity);
+  from_space_.SetUp(initial_semispace_capacity, max_semispace_capacity);
   if (!to_space_.Commit()) {
-    return false;
+    V8::FatalProcessOutOfMemory(heap->isolate(), "New space setup");
   }
   DCHECK(!from_space_.is_committed());  // No need to use memory yet.
   ResetLinearAllocationArea();
-
-  return true;
 }
 
-
 void NewSpace::TearDown() {
-  allocation_info_.Reset(nullptr, nullptr);
+  allocation_info_.Reset(kNullAddress, kNullAddress);
 
   to_space_.TearDown();
   from_space_.TearDown();
@@ -2099,35 +2133,41 @@ bool SemiSpace::EnsureCurrentCapacity() {
   if (is_committed()) {
     const int expected_pages =
         static_cast<int>(current_capacity_ / Page::kPageSize);
+    MemoryChunk* current_page = first_page();
     int actual_pages = 0;
-    Page* current_page = anchor()->next_page();
-    while (current_page != anchor()) {
+
+    // First iterate through the pages list until expected pages if so many
+    // pages exist.
+    while (current_page != nullptr && actual_pages < expected_pages) {
       actual_pages++;
-      current_page = current_page->next_page();
-      if (actual_pages > expected_pages) {
-        Page* to_remove = current_page->prev_page();
-        // Make sure we don't overtake the actual top pointer.
-        CHECK_NE(to_remove, current_page_);
-        to_remove->Unlink();
-        // Clear new space flags to avoid this page being treated as a new
-        // space page that is potentially being swept.
-        to_remove->SetFlags(0, Page::kIsInNewSpaceMask);
-        heap()->memory_allocator()->Free<MemoryAllocator::kPooledAndQueue>(
-            to_remove);
-      }
+      current_page = current_page->list_node().next();
+    }
+
+    // Free all overallocated pages which are behind current_page.
+    while (current_page) {
+      MemoryChunk* next_current = current_page->list_node().next();
+      memory_chunk_list_.Remove(current_page);
+      // Clear new space flags to avoid this page being treated as a new
+      // space page that is potentially being swept.
+      current_page->SetFlags(0, Page::kIsInNewSpaceMask);
+      heap()->memory_allocator()->Free<MemoryAllocator::kPooledAndQueue>(
+          current_page);
+      current_page = next_current;
     }
+
+    // Add more pages if we have less than expected_pages.
     IncrementalMarking::NonAtomicMarkingState* marking_state =
         heap()->incremental_marking()->non_atomic_marking_state();
     while (actual_pages < expected_pages) {
       actual_pages++;
       current_page =
           heap()->memory_allocator()->AllocatePage<MemoryAllocator::kPooled>(
-              Page::kAllocatableMemory, this, executable());
+              Page::kAllocatableMemory, this, NOT_EXECUTABLE);
       if (current_page == nullptr) return false;
       DCHECK_NOT_NULL(current_page);
-      current_page->InsertAfter(anchor());
+      memory_chunk_list_.PushBack(current_page);
       marking_state->ClearLiveness(current_page);
-      current_page->SetFlags(anchor()->prev_page()->GetFlags(),
+      current_page->SetFlags(first_page()->GetFlags(),
                              static_cast<uintptr_t>(Page::kCopyAllFlags));
       heap()->CreateFillerObjectAt(current_page->area_start(),
                                    static_cast<int>(current_page->area_size()),
@@ -2144,10 +2184,10 @@ LinearAllocationArea LocalAllocationBuffer::Close() {
         static_cast<int>(allocation_info_.limit() - allocation_info_.top()),
         ClearRecordedSlots::kNo);
     const LinearAllocationArea old_info = allocation_info_;
-    allocation_info_ = LinearAllocationArea(nullptr, nullptr);
+    allocation_info_ = LinearAllocationArea(kNullAddress, kNullAddress);
     return old_info;
   }
-  return LinearAllocationArea(nullptr, nullptr);
+  return LinearAllocationArea(kNullAddress, kNullAddress);
 }
 
 LocalAllocationBuffer::LocalAllocationBuffer(
@@ -2177,8 +2217,8 @@ LocalAllocationBuffer& LocalAllocationBuffer::operator=(
   // This is needed since we (a) cannot yet use move-semantics, and (b) want
   // to make the use of the class easy by it as value and (c) implicitly call
   // {Close} upon copy.
-  const_cast<LocalAllocationBuffer&>(other)
-      .allocation_info_.Reset(nullptr, nullptr);
+  const_cast<LocalAllocationBuffer&>(other).allocation_info_.Reset(
+      kNullAddress, kNullAddress);
   return *this;
 }
 
@@ -2197,7 +2237,7 @@ void NewSpace::UpdateLinearAllocationArea() {
 
 void NewSpace::ResetLinearAllocationArea() {
   // Do a step to account for memory allocated so far before resetting.
-  InlineAllocationStep(top(), top(), nullptr, 0);
+  InlineAllocationStep(top(), top(), kNullAddress, 0);
   to_space_.Reset();
   UpdateLinearAllocationArea();
   // Clear all mark-bits in the to-space.
@@ -2227,7 +2267,7 @@ bool NewSpace::AddFreshPage() {
   DCHECK(!Page::IsAtObjectStart(top));
 
   // Do a step to account for memory allocated on previous page.
-  InlineAllocationStep(top, top, nullptr, 0);
+  InlineAllocationStep(top, top, kNullAddress, 0);
 
   if (!to_space_.AdvancePage()) {
     // No more pages left to advance.
@@ -2283,6 +2323,10 @@ bool NewSpace::EnsureAllocation(int size_in_bytes,
   return true;
 }
 
+size_t LargeObjectSpace::Available() {
+  return ObjectSizeFor(heap()->memory_allocator()->Available());
+}
+
 void SpaceWithLinearArea::StartNextInlineAllocationStep() {
   if (heap()->allocation_step_in_progress()) {
     // If we are mid-way through an existing step, don't start a new one.
@@ -2293,12 +2337,12 @@ void SpaceWithLinearArea::StartNextInlineAllocationStep() {
     top_on_previous_step_ = top();
     UpdateInlineAllocationLimit(0);
   } else {
-    DCHECK_NULL(top_on_previous_step_);
+    DCHECK_EQ(kNullAddress, top_on_previous_step_);
   }
 }
 
 void SpaceWithLinearArea::AddAllocationObserver(AllocationObserver* observer) {
-  InlineAllocationStep(top(), top(), nullptr, 0);
+  InlineAllocationStep(top(), top(), kNullAddress, 0);
   Space::AddAllocationObserver(observer);
   DCHECK_IMPLIES(top_on_previous_step_, AllocationObserversActive());
 }
@@ -2306,22 +2350,22 @@ void SpaceWithLinearArea::AddAllocationObserver(AllocationObserver* observer) {
 void SpaceWithLinearArea::RemoveAllocationObserver(
     AllocationObserver* observer) {
   Address top_for_next_step =
-      allocation_observers_.size() == 1 ? nullptr : top();
-  InlineAllocationStep(top(), top_for_next_step, nullptr, 0);
+      allocation_observers_.size() == 1 ? kNullAddress : top();
+  InlineAllocationStep(top(), top_for_next_step, kNullAddress, 0);
   Space::RemoveAllocationObserver(observer);
   DCHECK_IMPLIES(top_on_previous_step_, AllocationObserversActive());
 }
 
 void SpaceWithLinearArea::PauseAllocationObservers() {
   // Do a step to account for memory allocated so far.
-  InlineAllocationStep(top(), nullptr, nullptr, 0);
+  InlineAllocationStep(top(), kNullAddress, kNullAddress, 0);
   Space::PauseAllocationObservers();
-  DCHECK_NULL(top_on_previous_step_);
+  DCHECK_EQ(kNullAddress, top_on_previous_step_);
   UpdateInlineAllocationLimit(0);
 }
 
 void SpaceWithLinearArea::ResumeAllocationObservers() {
-  DCHECK_NULL(top_on_previous_step_);
+  DCHECK_EQ(kNullAddress, top_on_previous_step_);
   Space::ResumeAllocationObservers();
   StartNextInlineAllocationStep();
 }
@@ -2338,7 +2382,7 @@ void SpaceWithLinearArea::InlineAllocationStep(Address top,
   if (top_on_previous_step_) {
     if (top < top_on_previous_step_) {
       // Generated code decreased the top pointer to do folded allocations.
-      DCHECK_NOT_NULL(top);
+      DCHECK_NE(top, kNullAddress);
       DCHECK_EQ(Page::FromAllocationAreaAddress(top),
                 Page::FromAllocationAreaAddress(top_on_previous_step_));
       top_on_previous_step_ = top;
@@ -2356,7 +2400,7 @@ std::unique_ptr<ObjectIterator> NewSpace::GetObjectIterator() {
 #ifdef VERIFY_HEAP
 // We do not use the SemiSpaceIterator because verification doesn't assume
 // that it works (it depends on the invariants we are checking).
-void NewSpace::Verify() {
+void NewSpace::Verify(Isolate* isolate) {
   // The allocation pointer should be in the space or at the very end.
   DCHECK_SEMISPACE_ALLOCATION_INFO(allocation_info_, to_space_);
 
@@ -2365,6 +2409,11 @@ void NewSpace::Verify() {
   Address current = to_space_.first_page()->area_start();
   CHECK_EQ(current, to_space_.space_start());
 
+  size_t external_space_bytes[kNumTypes];
+  for (int i = 0; i < kNumTypes; i++) {
+    external_space_bytes[static_cast<ExternalBackingStoreType>(i)] = 0;
+  }
+
   while (current != top()) {
     if (!Page::IsAlignedToPageSize(current)) {
       // The allocation pointer should not be in the middle of an object.
@@ -2374,33 +2423,45 @@ void NewSpace::Verify() {
       HeapObject* object = HeapObject::FromAddress(current);
 
       // The first word should be a map, and we expect all map pointers to
-      // be in map space.
+      // be in map space or read-only space.
       Map* map = object->map();
       CHECK(map->IsMap());
-      CHECK(heap()->map_space()->Contains(map));
+      CHECK(heap()->map_space()->Contains(map) ||
+            heap()->read_only_space()->Contains(map));
 
       // The object should not be code or a map.
       CHECK(!object->IsMap());
       CHECK(!object->IsAbstractCode());
 
       // The object itself should look OK.
-      object->ObjectVerify();
+      object->ObjectVerify(isolate);
 
       // All the interior pointers should be contained in the heap.
-      VerifyPointersVisitor visitor;
+      VerifyPointersVisitor visitor(heap());
       int size = object->Size();
       object->IterateBody(map, size, &visitor);
 
+      if (object->IsJSArrayBuffer()) {
+        JSArrayBuffer* array_buffer = JSArrayBuffer::cast(object);
+        if (ArrayBufferTracker::IsTracked(array_buffer)) {
+          size_t size = NumberToSize(array_buffer->byte_length());
+          external_space_bytes[ExternalBackingStoreType::kArrayBuffer] += size;
+        }
+      }
+
       current += size;
     } else {
       // At end of page, switch to next page.
       Page* page = Page::FromAllocationAreaAddress(current)->next_page();
-      // Next page should be valid.
-      CHECK(!page->is_anchor());
       current = page->area_start();
     }
   }
 
+  for (int i = 0; i < kNumTypes; i++) {
+    ExternalBackingStoreType t = static_cast<ExternalBackingStoreType>(i);
+    CHECK_EQ(external_space_bytes[t], ExternalBackingStoreBytes(t));
+  }
+
   // Check semi-spaces.
   CHECK_EQ(from_space_.id(), kFromSpace);
   CHECK_EQ(to_space_.id(), kToSpace);
@@ -2432,22 +2493,20 @@ void SemiSpace::TearDown() {
 
 bool SemiSpace::Commit() {
   DCHECK(!is_committed());
-  Page* current = anchor();
   const int num_pages = static_cast<int>(current_capacity_ / Page::kPageSize);
   for (int pages_added = 0; pages_added < num_pages; pages_added++) {
     Page* new_page =
         heap()->memory_allocator()->AllocatePage<MemoryAllocator::kPooled>(
-            Page::kAllocatableMemory, this, executable());
+            Page::kAllocatableMemory, this, NOT_EXECUTABLE);
     if (new_page == nullptr) {
-      RewindPages(current, pages_added);
+      if (pages_added) RewindPages(pages_added);
       return false;
     }
-    new_page->InsertAfter(current);
-    current = new_page;
+    memory_chunk_list_.PushBack(new_page);
   }
   Reset();
   AccountCommitted(current_capacity_);
-  if (age_mark_ == nullptr) {
+  if (age_mark_ == kNullAddress) {
     age_mark_ = first_page()->area_start();
   }
   committed_ = true;
@@ -2457,12 +2516,12 @@ bool SemiSpace::Commit() {
 
 bool SemiSpace::Uncommit() {
   DCHECK(is_committed());
-  for (auto it = begin(); it != end();) {
-    Page* p = *(it++);
-    heap()->memory_allocator()->Free<MemoryAllocator::kPooledAndQueue>(p);
+  while (!memory_chunk_list_.Empty()) {
+    MemoryChunk* chunk = memory_chunk_list_.front();
+    memory_chunk_list_.Remove(chunk);
+    heap()->memory_allocator()->Free<MemoryAllocator::kPooledAndQueue>(chunk);
   }
-  anchor()->set_next_page(anchor());
-  anchor()->set_prev_page(anchor());
+  current_page_ = nullptr;
   AccountUncommitted(current_capacity_);
   committed_ = false;
   heap()->memory_allocator()->unmapper()->FreeQueuedChunks();
@@ -2489,38 +2548,34 @@ bool SemiSpace::GrowTo(size_t new_capacity) {
   const size_t delta = new_capacity - current_capacity_;
   DCHECK(IsAligned(delta, AllocatePageSize()));
   const int delta_pages = static_cast<int>(delta / Page::kPageSize);
-  Page* last_page = anchor()->prev_page();
-  DCHECK_NE(last_page, anchor());
+  DCHECK(last_page());
   IncrementalMarking::NonAtomicMarkingState* marking_state =
       heap()->incremental_marking()->non_atomic_marking_state();
   for (int pages_added = 0; pages_added < delta_pages; pages_added++) {
     Page* new_page =
         heap()->memory_allocator()->AllocatePage<MemoryAllocator::kPooled>(
-            Page::kAllocatableMemory, this, executable());
+            Page::kAllocatableMemory, this, NOT_EXECUTABLE);
     if (new_page == nullptr) {
-      RewindPages(last_page, pages_added);
+      if (pages_added) RewindPages(pages_added);
       return false;
     }
-    new_page->InsertAfter(last_page);
+    memory_chunk_list_.PushBack(new_page);
     marking_state->ClearLiveness(new_page);
     // Duplicate the flags that was set on the old page.
-    new_page->SetFlags(last_page->GetFlags(), Page::kCopyOnFlipFlagsMask);
-    last_page = new_page;
+    new_page->SetFlags(last_page()->GetFlags(), Page::kCopyOnFlipFlagsMask);
   }
   AccountCommitted(delta);
   current_capacity_ = new_capacity;
   return true;
 }
 
-void SemiSpace::RewindPages(Page* start, int num_pages) {
-  Page* new_last_page = nullptr;
-  Page* last_page = start;
+void SemiSpace::RewindPages(int num_pages) {
+  DCHECK_GT(num_pages, 0);
+  DCHECK(last_page());
   while (num_pages > 0) {
-    DCHECK_NE(last_page, anchor());
-    new_last_page = last_page->prev_page();
-    last_page->prev_page()->set_next_page(last_page->next_page());
-    last_page->next_page()->set_prev_page(last_page->prev_page());
-    last_page = new_last_page;
+    MemoryChunk* last = last_page();
+    memory_chunk_list_.Remove(last);
+    heap()->memory_allocator()->Free<MemoryAllocator::kPooledAndQueue>(last);
     num_pages--;
   }
 }
@@ -2531,19 +2586,9 @@ bool SemiSpace::ShrinkTo(size_t new_capacity) {
   DCHECK_LT(new_capacity, current_capacity_);
   if (is_committed()) {
     const size_t delta = current_capacity_ - new_capacity;
-    DCHECK(IsAligned(delta, AllocatePageSize()));
+    DCHECK(IsAligned(delta, Page::kPageSize));
     int delta_pages = static_cast<int>(delta / Page::kPageSize);
-    Page* new_last_page;
-    Page* last_page;
-    while (delta_pages > 0) {
-      last_page = anchor()->prev_page();
-      new_last_page = last_page->prev_page();
-      new_last_page->set_next_page(anchor());
-      anchor()->set_prev_page(new_last_page);
-      heap()->memory_allocator()->Free<MemoryAllocator::kPooledAndQueue>(
-          last_page);
-      delta_pages--;
-    }
+    RewindPages(delta_pages);
     AccountUncommitted(delta);
     heap()->memory_allocator()->unmapper()->FreeQueuedChunks();
   }
@@ -2552,10 +2597,6 @@ bool SemiSpace::ShrinkTo(size_t new_capacity) {
 }
 
 void SemiSpace::FixPagesFlags(intptr_t flags, intptr_t mask) {
-  anchor_.set_owner(this);
-  anchor_.prev_page()->set_next_page(&anchor_);
-  anchor_.next_page()->set_prev_page(&anchor_);
-
   for (Page* page : *this) {
     page->set_owner(this);
     page->SetFlags(flags, mask);
@@ -2576,30 +2617,41 @@ void SemiSpace::FixPagesFlags(intptr_t flags, intptr_t mask) {
 
 
 void SemiSpace::Reset() {
-  DCHECK_NE(anchor_.next_page(), &anchor_);
-  current_page_ = anchor_.next_page();
+  DCHECK(first_page());
+  DCHECK(last_page());
+  current_page_ = first_page();
   pages_used_ = 0;
 }
 
 void SemiSpace::RemovePage(Page* page) {
   if (current_page_ == page) {
-    current_page_ = page->prev_page();
+    if (page->prev_page()) {
+      current_page_ = page->prev_page();
+    }
+  }
+  memory_chunk_list_.Remove(page);
+  for (size_t i = 0; i < ExternalBackingStoreType::kNumTypes; i++) {
+    ExternalBackingStoreType t = static_cast<ExternalBackingStoreType>(i);
+    DecrementExternalBackingStoreBytes(t, page->ExternalBackingStoreBytes(t));
   }
-  page->Unlink();
 }
 
 void SemiSpace::PrependPage(Page* page) {
   page->SetFlags(current_page()->GetFlags(),
                  static_cast<uintptr_t>(Page::kCopyAllFlags));
   page->set_owner(this);
-  page->InsertAfter(anchor());
+  memory_chunk_list_.PushFront(page);
   pages_used_++;
+  for (size_t i = 0; i < ExternalBackingStoreType::kNumTypes; i++) {
+    ExternalBackingStoreType t = static_cast<ExternalBackingStoreType>(i);
+    IncrementExternalBackingStoreBytes(t, page->ExternalBackingStoreBytes(t));
+  }
 }
 
 void SemiSpace::Swap(SemiSpace* from, SemiSpace* to) {
   // We won't be swapping semispaces without data in them.
-  DCHECK_NE(from->anchor_.next_page(), &from->anchor_);
-  DCHECK_NE(to->anchor_.next_page(), &to->anchor_);
+  DCHECK(from->first_page());
+  DCHECK(to->first_page());
 
   intptr_t saved_to_space_flags = to->current_page()->GetFlags();
 
@@ -2609,8 +2661,10 @@ void SemiSpace::Swap(SemiSpace* from, SemiSpace* to) {
   std::swap(from->minimum_capacity_, to->minimum_capacity_);
   std::swap(from->age_mark_, to->age_mark_);
   std::swap(from->committed_, to->committed_);
-  std::swap(from->anchor_, to->anchor_);
+  std::swap(from->memory_chunk_list_, to->memory_chunk_list_);
   std::swap(from->current_page_, to->current_page_);
+  std::swap(from->external_backing_store_bytes_,
+            to->external_backing_store_bytes_);
 
   to->FixPagesFlags(saved_to_space_flags, Page::kCopyOnFlipFlagsMask);
   from->FixPagesFlags(0, 0);
@@ -2637,9 +2691,13 @@ void SemiSpace::Print() {}
 #ifdef VERIFY_HEAP
 void SemiSpace::Verify() {
   bool is_from_space = (id_ == kFromSpace);
-  Page* page = anchor_.next_page();
-  CHECK(anchor_.owner() == this);
-  while (page != &anchor_) {
+  size_t external_backing_store_bytes[kNumTypes];
+
+  for (int i = 0; i < kNumTypes; i++) {
+    external_backing_store_bytes[static_cast<ExternalBackingStoreType>(i)] = 0;
+  }
+
+  for (Page* page : *this) {
     CHECK_EQ(page->owner(), this);
     CHECK(page->InNewSpace());
     CHECK(page->IsFlagSet(is_from_space ? MemoryChunk::IN_FROM_SPACE
@@ -2657,8 +2715,17 @@ void SemiSpace::Verify() {
             !page->IsFlagSet(MemoryChunk::POINTERS_FROM_HERE_ARE_INTERESTING));
       }
     }
-    CHECK_EQ(page->prev_page()->next_page(), page);
-    page = page->next_page();
+    for (int i = 0; i < kNumTypes; i++) {
+      ExternalBackingStoreType t = static_cast<ExternalBackingStoreType>(i);
+      external_backing_store_bytes[t] += page->ExternalBackingStoreBytes(t);
+    }
+
+    CHECK_IMPLIES(page->list_node().prev(),
+                  page->list_node().prev()->list_node().next() == page);
+  }
+  for (int i = 0; i < kNumTypes; i++) {
+    ExternalBackingStoreType t = static_cast<ExternalBackingStoreType>(i);
+    CHECK_EQ(external_backing_store_bytes[t], ExternalBackingStoreBytes(t));
   }
 }
 #endif
@@ -2678,8 +2745,8 @@ void SemiSpace::AssertValidRange(Address start, Address end) {
   } else {
     while (page != end_page) {
       page = page->next_page();
-      DCHECK_NE(page, space->anchor());
     }
+    DCHECK(page);
   }
 }
 #endif
@@ -2689,7 +2756,7 @@ void SemiSpace::AssertValidRange(Address start, Address end) {
 // SemiSpaceIterator implementation.
 
 SemiSpaceIterator::SemiSpaceIterator(NewSpace* space) {
-  Initialize(space->bottom(), space->top());
+  Initialize(space->first_allocatable_address(), space->top());
 }
 
 
@@ -2783,9 +2850,9 @@ void FreeListCategory::RepairFreeList(Heap* heap) {
   while (n != nullptr) {
     Map** map_location = reinterpret_cast<Map**>(n->address());
     if (*map_location == nullptr) {
-      *map_location = heap->free_space_map();
+      *map_location = ReadOnlyRoots(heap).free_space_map();
     } else {
-      DCHECK(*map_location == heap->free_space_map());
+      DCHECK(*map_location == ReadOnlyRoots(heap).free_space_map());
     }
     n = n->next();
   }
@@ -2820,7 +2887,7 @@ size_t FreeList::Free(Address start, size_t size_in_bytes, FreeMode mode) {
   // Blocks have to be a minimum size to hold free list items.
   if (size_in_bytes < kMinBlockSize) {
     page->add_wasted_memory(size_in_bytes);
-    wasted_bytes_.Increment(size_in_bytes);
+    wasted_bytes_ += size_in_bytes;
     return size_in_bytes;
   }
 
@@ -2992,7 +3059,7 @@ size_t FreeListCategory::SumFreeList() {
   size_t sum = 0;
   FreeSpace* cur = top();
   while (cur != nullptr) {
-    DCHECK(cur->map() == cur->GetHeap()->root(Heap::kFreeSpaceMapRootIndex));
+    DCHECK(cur->map() == page()->heap()->root(Heap::kFreeSpaceMapRootIndex));
     sum += cur->relaxed_read_size();
     cur = cur->next();
   }
@@ -3181,6 +3248,64 @@ bool PagedSpace::RawSlowRefillLinearAllocationArea(int size_in_bytes) {
 void MapSpace::VerifyObject(HeapObject* object) { CHECK(object->IsMap()); }
 #endif
 
+ReadOnlySpace::ReadOnlySpace(Heap* heap)
+    : PagedSpace(heap, RO_SPACE, NOT_EXECUTABLE),
+      is_string_padding_cleared_(heap->isolate()->initialized_from_snapshot()) {
+}
+
+void ReadOnlyPage::MakeHeaderRelocatable() {
+  if (mutex_ != nullptr) {
+    // TODO(v8:7464): heap_ and owner_ need to be cleared as well.
+    delete mutex_;
+    mutex_ = nullptr;
+    local_tracker_ = nullptr;
+    reservation_.Reset();
+  }
+}
+
+void ReadOnlySpace::SetPermissionsForPages(PageAllocator::Permission access) {
+  const size_t page_size = MemoryAllocator::GetCommitPageSize();
+  const size_t area_start_offset = RoundUp(Page::kObjectStartOffset, page_size);
+  for (Page* p : *this) {
+    ReadOnlyPage* page = static_cast<ReadOnlyPage*>(p);
+    if (access == PageAllocator::kRead) {
+      page->MakeHeaderRelocatable();
+    }
+    CHECK(SetPermissions(page->address() + area_start_offset,
+                         page->size() - area_start_offset, access));
+  }
+}
+
+void ReadOnlySpace::ClearStringPaddingIfNeeded() {
+  if (is_string_padding_cleared_) return;
+
+  WritableScope writable_scope(this);
+  for (Page* page : *this) {
+    HeapObjectIterator iterator(page);
+    for (HeapObject* o = iterator.Next(); o != nullptr; o = iterator.Next()) {
+      if (o->IsSeqOneByteString()) {
+        SeqOneByteString::cast(o)->clear_padding();
+      } else if (o->IsSeqTwoByteString()) {
+        SeqTwoByteString::cast(o)->clear_padding();
+      }
+    }
+  }
+  is_string_padding_cleared_ = true;
+}
+
+void ReadOnlySpace::MarkAsReadOnly() {
+  DCHECK(!is_marked_read_only_);
+  FreeLinearAllocationArea();
+  is_marked_read_only_ = true;
+  SetPermissionsForPages(PageAllocator::kRead);
+}
+
+void ReadOnlySpace::MarkAsReadWrite() {
+  DCHECK(is_marked_read_only_);
+  SetPermissionsForPages(PageAllocator::kReadWrite);
+  is_marked_read_only_ = false;
+}
+
 Address LargePage::GetAddressToShrink(Address object_address,
                                       size_t object_size) {
   if (executable() == EXECUTABLE) {
@@ -3207,7 +3332,7 @@ void LargePage::ClearOutOfLiveRangeSlots(Address free_start) {
 // LargeObjectIterator
 
 LargeObjectIterator::LargeObjectIterator(LargeObjectSpace* space) {
-  current_ = space->first_page_;
+  current_ = space->first_page();
 }
 
 
@@ -3223,31 +3348,27 @@ HeapObject* LargeObjectIterator::Next() {
 // -----------------------------------------------------------------------------
 // LargeObjectSpace
 
+LargeObjectSpace::LargeObjectSpace(Heap* heap)
+    : LargeObjectSpace(heap, LO_SPACE) {}
+
 LargeObjectSpace::LargeObjectSpace(Heap* heap, AllocationSpace id)
-    : Space(heap, id, NOT_EXECUTABLE),  // Managed on a per-allocation basis
-      first_page_(nullptr),
+    : Space(heap, id),
       size_(0),
       page_count_(0),
       objects_size_(0),
       chunk_map_(1024) {}
 
-LargeObjectSpace::~LargeObjectSpace() {}
-
-bool LargeObjectSpace::SetUp() {
-  return true;
-}
-
 void LargeObjectSpace::TearDown() {
-  while (first_page_ != nullptr) {
-    LargePage* page = first_page_;
-    first_page_ = first_page_->next_page();
-    LOG(heap()->isolate(), DeleteEvent("LargeObjectChunk", page->address()));
+  while (!memory_chunk_list_.Empty()) {
+    LargePage* page = first_page();
+    LOG(heap()->isolate(),
+        DeleteEvent("LargeObjectChunk",
+                    reinterpret_cast<void*>(page->address())));
+    memory_chunk_list_.Remove(page);
     heap()->memory_allocator()->Free<MemoryAllocator::kFull>(page);
   }
-  SetUp();
 }
 
-
 AllocationResult LargeObjectSpace::AllocateRaw(int object_size,
                                                Executability executable) {
   // Check if we want to force a GC before growing the old space further.
@@ -3257,17 +3378,35 @@ AllocationResult LargeObjectSpace::AllocateRaw(int object_size,
     return AllocationResult::Retry(identity());
   }
 
+  LargePage* page = AllocateLargePage(object_size, executable);
+  if (page == nullptr) return AllocationResult::Retry(identity());
+  page->SetOldGenerationPageFlags(heap()->incremental_marking()->IsMarking());
+  HeapObject* object = page->GetObject();
+  heap()->StartIncrementalMarkingIfAllocationLimitIsReached(
+      heap()->GCFlagsForIncrementalMarking(),
+      kGCCallbackScheduleIdleGarbageCollection);
+  if (heap()->incremental_marking()->black_allocation()) {
+    heap()->incremental_marking()->marking_state()->WhiteToBlack(object);
+  }
+  DCHECK_IMPLIES(
+      heap()->incremental_marking()->black_allocation(),
+      heap()->incremental_marking()->marking_state()->IsBlack(object));
+  page->InitializationMemoryFence();
+  return object;
+}
+
+LargePage* LargeObjectSpace::AllocateLargePage(int object_size,
+                                               Executability executable) {
   LargePage* page = heap()->memory_allocator()->AllocateLargePage(
       object_size, this, executable);
-  if (page == nullptr) return AllocationResult::Retry(identity());
+  if (page == nullptr) return nullptr;
   DCHECK_GE(page->area_size(), static_cast<size_t>(object_size));
 
   size_ += static_cast<int>(page->size());
   AccountCommitted(page->size());
   objects_size_ += object_size;
   page_count_++;
-  page->set_next_page(first_page_);
-  first_page_ = page;
+  memory_chunk_list_.PushBack(page);
 
   InsertChunkMapEntries(page);
 
@@ -3277,23 +3416,13 @@ AllocationResult LargeObjectSpace::AllocateRaw(int object_size,
     // Make the object consistent so the heap can be verified in OldSpaceStep.
     // We only need to do this in debug builds or if verify_heap is on.
     reinterpret_cast<Object**>(object->address())[0] =
-        heap()->fixed_array_map();
+        ReadOnlyRoots(heap()).fixed_array_map();
     reinterpret_cast<Object**>(object->address())[1] = Smi::kZero;
   }
-
-  heap()->StartIncrementalMarkingIfAllocationLimitIsReached(
-      heap()->GCFlagsForIncrementalMarking(),
-      kGCCallbackScheduleIdleGarbageCollection);
   heap()->CreateFillerObjectAt(object->address(), object_size,
                                ClearRecordedSlots::kNo);
-  if (heap()->incremental_marking()->black_allocation()) {
-    heap()->incremental_marking()->marking_state()->WhiteToBlack(object);
-  }
   AllocationStep(object_size, object->address(), object_size);
-  DCHECK_IMPLIES(
-      heap()->incremental_marking()->black_allocation(),
-      heap()->incremental_marking()->marking_state()->IsBlack(object));
-  return object;
+  return page;
 }
 
 
@@ -3321,7 +3450,7 @@ LargePage* LargeObjectSpace::FindPageThreadSafe(Address a) {
 
 LargePage* LargeObjectSpace::FindPage(Address a) {
   const Address key = MemoryChunk::FromAddress(a)->address();
-  auto it = chunk_map_.find(reinterpret_cast<Address>(key));
+  auto it = chunk_map_.find(key);
   if (it != chunk_map_.end()) {
     LargePage* page = it->second;
     if (page->Contains(a)) {
@@ -3365,8 +3494,7 @@ void LargeObjectSpace::RemoveChunkMapEntries(LargePage* page) {
 
 void LargeObjectSpace::RemoveChunkMapEntries(LargePage* page,
                                              Address free_start) {
-  for (Address current = reinterpret_cast<Address>(::RoundUp(
-           reinterpret_cast<uintptr_t>(free_start), MemoryChunk::kPageSize));
+  for (Address current = ::RoundUp(free_start, MemoryChunk::kPageSize);
        current < reinterpret_cast<Address>(page) + page->size();
        current += MemoryChunk::kPageSize) {
     chunk_map_.erase(current);
@@ -3374,12 +3502,12 @@ void LargeObjectSpace::RemoveChunkMapEntries(LargePage* page,
 }
 
 void LargeObjectSpace::FreeUnmarkedObjects() {
-  LargePage* previous = nullptr;
-  LargePage* current = first_page_;
+  LargePage* current = first_page();
   IncrementalMarking::NonAtomicMarkingState* marking_state =
       heap()->incremental_marking()->non_atomic_marking_state();
   objects_size_ = 0;
-  while (current != nullptr) {
+  while (current) {
+    LargePage* next_current = current->next_page();
     HeapObject* object = current->GetObject();
     DCHECK(!marking_state->IsGrey(object));
     if (marking_state->IsBlack(object)) {
@@ -3399,26 +3527,19 @@ void LargeObjectSpace::FreeUnmarkedObjects() {
         size_ -= bytes_to_free;
         AccountUncommitted(bytes_to_free);
       }
-      previous = current;
-      current = current->next_page();
     } else {
-      LargePage* page = current;
-      // Cut the chunk out from the chunk list.
-      current = current->next_page();
-      if (previous == nullptr) {
-        first_page_ = current;
-      } else {
-        previous->set_next_page(current);
-      }
+      memory_chunk_list_.Remove(current);
 
       // Free the chunk.
-      size_ -= static_cast<int>(page->size());
-      AccountUncommitted(page->size());
+      size_ -= static_cast<int>(current->size());
+      AccountUncommitted(current->size());
       page_count_--;
 
-      RemoveChunkMapEntries(page);
-      heap()->memory_allocator()->Free<MemoryAllocator::kPreFreeAndQueue>(page);
+      RemoveChunkMapEntries(current);
+      heap()->memory_allocator()->Free<MemoryAllocator::kPreFreeAndQueue>(
+          current);
     }
+    current = next_current;
   }
 }
 
@@ -3441,8 +3562,14 @@ std::unique_ptr<ObjectIterator> LargeObjectSpace::GetObjectIterator() {
 #ifdef VERIFY_HEAP
 // We do not assume that the large object iterator works, because it depends
 // on the invariants we are checking during verification.
-void LargeObjectSpace::Verify() {
-  for (LargePage* chunk = first_page_; chunk != nullptr;
+void LargeObjectSpace::Verify(Isolate* isolate) {
+  size_t external_backing_store_bytes[kNumTypes];
+
+  for (int i = 0; i < kNumTypes; i++) {
+    external_backing_store_bytes[static_cast<ExternalBackingStoreType>(i)] = 0;
+  }
+
+  for (LargePage* chunk = first_page(); chunk != nullptr;
        chunk = chunk->next_page()) {
     // Each chunk contains an object that starts at the large object page's
     // object area start.
@@ -3451,25 +3578,23 @@ void LargeObjectSpace::Verify() {
     CHECK(object->address() == page->area_start());
 
     // The first word should be a map, and we expect all map pointers to be
-    // in map space.
+    // in map space or read-only space.
     Map* map = object->map();
     CHECK(map->IsMap());
-    CHECK(heap()->map_space()->Contains(map));
+    CHECK(heap()->map_space()->Contains(map) ||
+          heap()->read_only_space()->Contains(map));
 
-    // We have only code, sequential strings, external strings (sequential
-    // strings that have been morphed into external strings), thin strings
-    // (sequential strings that have been morphed into thin strings), fixed
-    // arrays, fixed double arrays, byte arrays, feedback vectors, bigints and
-    // free space (right after allocation) in the large object space.
+    // We have only the following types in the large object space:
     CHECK(object->IsAbstractCode() || object->IsSeqString() ||
           object->IsExternalString() || object->IsThinString() ||
           object->IsFixedArray() || object->IsFixedDoubleArray() ||
+          object->IsWeakFixedArray() || object->IsWeakArrayList() ||
           object->IsPropertyArray() || object->IsByteArray() ||
           object->IsFeedbackVector() || object->IsBigInt() ||
           object->IsFreeSpace());
 
     // The object itself should look OK.
-    object->ObjectVerify();
+    object->ObjectVerify(isolate);
 
     if (!FLAG_verify_heap_skip_remembered_set) {
       heap()->VerifyRememberedSetFor(object);
@@ -3477,7 +3602,7 @@ void LargeObjectSpace::Verify() {
 
     // Byte arrays and strings don't have interior pointers.
     if (object->IsAbstractCode()) {
-      VerifyPointersVisitor code_visitor;
+      VerifyPointersVisitor code_visitor(heap());
       object->IterateBody(map, object->Size(), &code_visitor);
     } else if (object->IsFixedArray()) {
       FixedArray* array = FixedArray::cast(object);
@@ -3500,23 +3625,32 @@ void LargeObjectSpace::Verify() {
         }
       }
     }
+    for (int i = 0; i < kNumTypes; i++) {
+      ExternalBackingStoreType t = static_cast<ExternalBackingStoreType>(i);
+      external_backing_store_bytes[t] += chunk->ExternalBackingStoreBytes(t);
+    }
+  }
+  for (int i = 0; i < kNumTypes; i++) {
+    ExternalBackingStoreType t = static_cast<ExternalBackingStoreType>(i);
+    CHECK_EQ(external_backing_store_bytes[t], ExternalBackingStoreBytes(t));
   }
 }
 #endif
 
 #ifdef DEBUG
 void LargeObjectSpace::Print() {
-  OFStream os(stdout);
+  StdoutStream os;
   LargeObjectIterator it(this);
+  Isolate* isolate = heap()->isolate();
   for (HeapObject* obj = it.Next(); obj != nullptr; obj = it.Next()) {
-    obj->Print(os);
+    obj->Print(isolate, os);
   }
 }
 
 void Page::Print() {
   // Make a best-effort to print the objects in the page.
-  PrintF("Page@%p in %s\n", static_cast<void*>(this->address()),
-         AllocationSpaceName(this->owner()->identity()));
+  PrintF("Page@%p in %s\n", reinterpret_cast<void*>(this->address()),
+         this->owner()->name());
   printf(" --------------------------------------\n");
   HeapObjectIterator objects(this);
   unsigned mark_size = 0;
@@ -3537,5 +3671,23 @@ void Page::Print() {
 }
 
 #endif  // DEBUG
+
+NewLargeObjectSpace::NewLargeObjectSpace(Heap* heap)
+    : LargeObjectSpace(heap, NEW_LO_SPACE) {}
+
+AllocationResult NewLargeObjectSpace::AllocateRaw(int object_size) {
+  // TODO(hpayer): Add heap growing strategy here.
+  LargePage* page = AllocateLargePage(object_size, NOT_EXECUTABLE);
+  if (page == nullptr) return AllocationResult::Retry(identity());
+  page->SetYoungGenerationPageFlags(heap()->incremental_marking()->IsMarking());
+  page->SetFlag(MemoryChunk::IN_TO_SPACE);
+  page->InitializationMemoryFence();
+  return page->GetObject();
+}
+
+size_t NewLargeObjectSpace::Available() {
+  // TODO(hpayer): Update as soon as we have a growing strategy.
+  return 0;
+}
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/src/heap/spaces.h b/deps/v8/src/heap/spaces.h
index e5377b0336413a..140cd200efe77a 100644
--- a/deps/v8/src/heap/spaces.h
+++ b/deps/v8/src/heap/spaces.h
@@ -15,6 +15,7 @@
 #include "src/allocation.h"
 #include "src/base/atomic-utils.h"
 #include "src/base/iterator.h"
+#include "src/base/list.h"
 #include "src/base/platform/mutex.h"
 #include "src/cancelable-task.h"
 #include "src/flags.h"
@@ -141,6 +142,12 @@ enum FreeMode { kLinkCategory, kDoNotLinkCategory };
 
 enum class SpaceAccountingMode { kSpaceAccounted, kSpaceUnaccounted };
 
+enum ExternalBackingStoreType {
+  kArrayBuffer,
+  kExternalString,
+  kNumTypes
+};
+
 enum RememberedSetType {
   OLD_TO_NEW,
   OLD_TO_OLD,
@@ -256,7 +263,7 @@ class MemoryChunk {
     IS_EXECUTABLE = 1u << 0,
     POINTERS_TO_HERE_ARE_INTERESTING = 1u << 1,
     POINTERS_FROM_HERE_ARE_INTERESTING = 1u << 2,
-    // A page in new space has one of the next to flags set.
+    // A page in new space has one of the next two flags set.
     IN_FROM_SPACE = 1u << 3,
     IN_TO_SPACE = 1u << 4,
     NEW_SPACE_BELOW_AGE_MARK = 1u << 5,
@@ -303,12 +310,9 @@ class MemoryChunk {
     // triggering on the same page.
     COMPACTION_WAS_ABORTED_FOR_TESTING = 1u << 16,
 
-    // |ANCHOR|: Flag is set if page is an anchor.
-    ANCHOR = 1u << 17,
-
     // |SWEEP_TO_ITERATE|: The page requires sweeping using external markbits
     // to iterate the page.
-    SWEEP_TO_ITERATE = 1u << 18
+    SWEEP_TO_ITERATE = 1u << 17
   };
 
   using Flags = uintptr_t;
@@ -359,7 +363,7 @@ class MemoryChunk {
       + kPointerSize      // Address owner_
       + kPointerSize      // Heap* heap_
       + kIntptrSize       // intptr_t progress_bar_
-      + kIntptrSize       // intptr_t live_byte_count_
+      + kIntptrSize       // std::atomic<intptr_t> live_byte_count_
       + kPointerSize * NUMBER_OF_REMEMBERED_SET_TYPES  // SlotSet* array
       + kPointerSize * NUMBER_OF_REMEMBERED_SET_TYPES  // TypedSlotSet* array
       + kPointerSize  // InvalidatedSlots* invalidated_slots_
@@ -369,14 +373,15 @@ class MemoryChunk {
       + kPointerSize  // base::AtomicWord concurrent_sweeping_
       + kPointerSize  // base::Mutex* page_protection_change_mutex_
       + kPointerSize  // unitptr_t write_unprotect_counter_
-      + kSizetSize    // size_t allocated_bytes_
-      + kSizetSize    // size_t wasted_memory_
-      + kPointerSize  // AtomicValue next_chunk_
-      + kPointerSize  // AtomicValue prev_chunk_
+      + kSizetSize * kNumTypes
+      // std::atomic<size_t> external_backing_store_bytes_
+      + kSizetSize        // size_t allocated_bytes_
+      + kSizetSize        // size_t wasted_memory_
+      + kPointerSize * 2  // base::ListNode
       + kPointerSize * kNumberOfCategories
       // FreeListCategory categories_[kNumberOfCategories]
-      + kPointerSize   // LocalArrayBufferTracker* local_tracker_
-      + kIntptrSize    // intptr_t young_generation_live_byte_count_
+      + kPointerSize  // LocalArrayBufferTracker* local_tracker_
+      + kIntptrSize   // std::atomic<intptr_t> young_generation_live_byte_count_
       + kPointerSize;  // Bitmap* young_generation_bitmap_
 
   // We add some more space to the computed header size to amount for missing
@@ -409,11 +414,19 @@ class MemoryChunk {
   static MemoryChunk* FromAddress(Address a) {
     return reinterpret_cast<MemoryChunk*>(OffsetFrom(a) & ~kAlignmentMask);
   }
+  // Only works if the object is in the first kPageSize of the MemoryChunk.
+  static MemoryChunk* FromHeapObject(const HeapObject* o) {
+    return reinterpret_cast<MemoryChunk*>(reinterpret_cast<Address>(o) &
+                                          ~kAlignmentMask);
+  }
+
+  void SetOldGenerationPageFlags(bool is_marking);
+  void SetYoungGenerationPageFlags(bool is_marking);
 
   static inline MemoryChunk* FromAnyPointerAddress(Heap* heap, Address addr);
 
   static inline void UpdateHighWaterMark(Address mark) {
-    if (mark == nullptr) return;
+    if (mark == kNullAddress) return;
     // Need to subtract one from the mark because when a chunk is full the
     // top points to the next address after the chunk, which effectively belongs
     // to another chunk. See the comment to Page::FromTopOrLimit.
@@ -497,10 +510,7 @@ class MemoryChunk {
   void RegisterObjectWithInvalidatedSlots(HeapObject* object, int size);
   InvalidatedSlots* invalidated_slots() { return invalidated_slots_; }
 
-  void AllocateLocalTracker();
   void ReleaseLocalTracker();
-  inline LocalArrayBufferTracker* local_tracker() { return local_tracker_; }
-  bool contains_array_buffers();
 
   void AllocateYoungGenerationBitmap();
   void ReleaseYoungGenerationBitmap();
@@ -530,6 +540,14 @@ class MemoryChunk {
     }
   }
 
+  void IncrementExternalBackingStoreBytes(ExternalBackingStoreType type,
+                                          size_t amount);
+  void DecrementExternalBackingStoreBytes(ExternalBackingStoreType type,
+                                          size_t amount);
+  size_t ExternalBackingStoreBytes(ExternalBackingStoreType type) {
+    return external_backing_store_bytes_[type];
+  }
+
   inline uint32_t AddressToMarkbitIndex(Address addr) const {
     return static_cast<uint32_t>(addr - this->address()) >> kPointerSizeLog2;
   }
@@ -601,23 +619,12 @@ class MemoryChunk {
 
   bool InFromSpace() { return IsFlagSet(IN_FROM_SPACE); }
 
-  MemoryChunk* next_chunk() { return next_chunk_.Value(); }
-
-  MemoryChunk* prev_chunk() { return prev_chunk_.Value(); }
-
-  void set_next_chunk(MemoryChunk* next) { next_chunk_.SetValue(next); }
-
-  void set_prev_chunk(MemoryChunk* prev) { prev_chunk_.SetValue(prev); }
-
   Space* owner() const { return owner_.Value(); }
 
   void set_owner(Space* space) { owner_.SetValue(space); }
 
   bool IsPagedSpace() const;
 
-  void InsertAfter(MemoryChunk* other);
-  void Unlink();
-
   // Emits a memory barrier. For TSAN builds the other thread needs to perform
   // MemoryChunk::synchronized_heap() to simulate the barrier.
   void InitializationMemoryFence();
@@ -625,6 +632,8 @@ class MemoryChunk {
   void SetReadAndExecutable();
   void SetReadAndWritable();
 
+  base::ListNode<MemoryChunk>& list_node() { return list_node_; }
+
  protected:
   static MemoryChunk* Initialize(Heap* heap, Address base, size_t size,
                                  Address area_start, Address area_end,
@@ -656,7 +665,7 @@ class MemoryChunk {
   intptr_t progress_bar_;
 
   // Count of bytes marked black on page.
-  intptr_t live_byte_count_;
+  std::atomic<intptr_t> live_byte_count_;
 
   // A single slot set for small pages (of size kPageSize) or an array of slot
   // set for large pages. In the latter case the number of entries in the array
@@ -694,19 +703,20 @@ class MemoryChunk {
   // Byte allocated on the page, which includes all objects on the page
   // and the linear allocation area.
   size_t allocated_bytes_;
+
+  // Tracks off-heap memory used by this memory chunk.
+  std::atomic<size_t> external_backing_store_bytes_[kNumTypes];
+
   // Freed memory that was not added to the free list.
   size_t wasted_memory_;
 
-  // next_chunk_ holds a pointer of type MemoryChunk
-  base::AtomicValue<MemoryChunk*> next_chunk_;
-  // prev_chunk_ holds a pointer of type MemoryChunk
-  base::AtomicValue<MemoryChunk*> prev_chunk_;
+  base::ListNode<MemoryChunk> list_node_;
 
   FreeListCategory* categories_[kNumberOfCategories];
 
   LocalArrayBufferTracker* local_tracker_;
 
-  intptr_t young_generation_live_byte_count_;
+  std::atomic<intptr_t> young_generation_live_byte_count_;
   Bitmap* young_generation_bitmap_;
 
  private:
@@ -769,24 +779,17 @@ class Page : public MemoryChunk {
   }
 
   static bool IsAtObjectStart(Address addr) {
-    return (reinterpret_cast<intptr_t>(addr) & kPageAlignmentMask) ==
-           kObjectStartOffset;
+    return (addr & kPageAlignmentMask) == kObjectStartOffset;
   }
 
   static Page* ConvertNewToOld(Page* old_page);
 
-  // Create a Page object that is only used as anchor for the doubly-linked
-  // list of real pages.
-  explicit Page(Space* owner) { InitializeAsAnchor(owner); }
-
   inline void MarkNeverAllocateForTesting();
   inline void MarkEvacuationCandidate();
   inline void ClearEvacuationCandidate();
 
-  Page* next_page() { return static_cast<Page*>(next_chunk()); }
-  Page* prev_page() { return static_cast<Page*>(prev_chunk()); }
-  void set_next_page(Page* page) { set_next_chunk(page); }
-  void set_prev_page(Page* page) { set_prev_chunk(page); }
+  Page* next_page() { return static_cast<Page*>(list_node_.next()); }
+  Page* prev_page() { return static_cast<Page*>(list_node_.prev()); }
 
   template <typename Callback>
   inline void ForAllFreeListCategories(Callback callback) {
@@ -813,6 +816,10 @@ class Page : public MemoryChunk {
     DCHECK(SweepingDone());
   }
 
+  void AllocateLocalTracker();
+  inline LocalArrayBufferTracker* local_tracker() { return local_tracker_; }
+  bool contains_array_buffers();
+
   void ResetFreeListStatistics();
 
   size_t AvailableInFreeList();
@@ -826,8 +833,6 @@ class Page : public MemoryChunk {
     return categories_[type];
   }
 
-  bool is_anchor() { return IsFlagSet(Page::ANCHOR); }
-
   size_t wasted_memory() { return wasted_memory_; }
   void add_wasted_memory(size_t waste) { wasted_memory_ += waste; }
   size_t allocated_bytes() { return allocated_bytes_; }
@@ -859,21 +864,24 @@ class Page : public MemoryChunk {
  private:
   enum InitializationMode { kFreeMemory, kDoNotFreeMemory };
 
-  void InitializeAsAnchor(Space* owner);
-
   friend class MemoryAllocator;
 };
 
+class ReadOnlyPage : public Page {
+ public:
+  // Clears any pointers in the header that point out of the page that would
+  // otherwise make the header non-relocatable.
+  void MakeHeaderRelocatable();
+};
+
 class LargePage : public MemoryChunk {
  public:
   HeapObject* GetObject() { return HeapObject::FromAddress(area_start()); }
 
   inline LargePage* next_page() {
-    return static_cast<LargePage*>(next_chunk());
+    return static_cast<LargePage*>(list_node_.next());
   }
 
-  inline void set_next_page(LargePage* page) { set_next_chunk(page); }
-
   // Uncommit memory that is not in use anymore by the object. If the object
   // cannot be shrunk 0 is returned.
   Address GetAddressToShrink(Address object_address, size_t object_size);
@@ -888,7 +896,7 @@ class LargePage : public MemoryChunk {
 
  private:
   static LargePage* Initialize(Heap* heap, MemoryChunk* chunk,
-                               Executability executable, Space* owner);
+                               Executability executable);
 
   friend class MemoryAllocator;
 };
@@ -898,24 +906,31 @@ class LargePage : public MemoryChunk {
 // Space is the abstract superclass for all allocation spaces.
 class Space : public Malloced {
  public:
-  Space(Heap* heap, AllocationSpace id, Executability executable)
+  Space(Heap* heap, AllocationSpace id)
       : allocation_observers_paused_(false),
         heap_(heap),
         id_(id),
-        executable_(executable),
         committed_(0),
-        max_committed_(0) {}
+        max_committed_(0) {
+    external_backing_store_bytes_ =
+        new std::atomic<size_t>[ExternalBackingStoreType::kNumTypes];
+    external_backing_store_bytes_[ExternalBackingStoreType::kArrayBuffer] = 0;
+    external_backing_store_bytes_[ExternalBackingStoreType::kExternalString] =
+        0;
+  }
 
-  virtual ~Space() {}
+  virtual ~Space() {
+    delete[] external_backing_store_bytes_;
+    external_backing_store_bytes_ = nullptr;
+  }
 
   Heap* heap() const { return heap_; }
 
-  // Does the space need executable memory?
-  Executability executable() { return executable_; }
-
   // Identity used in error reporting.
   AllocationSpace identity() { return id_; }
 
+  const char* name() { return AllocationSpaceName(id_); }
+
   V8_EXPORT_PRIVATE virtual void AddAllocationObserver(
       AllocationObserver* observer);
 
@@ -943,6 +958,12 @@ class Space : public Malloced {
   // (e.g. see LargeObjectSpace).
   virtual size_t SizeOfObjects() { return Size(); }
 
+  // Returns amount of off-heap memory in-use by objects in this Space.
+  virtual size_t ExternalBackingStoreBytes(
+      ExternalBackingStoreType type) const {
+    return external_backing_store_bytes_[type];
+  }
+
   // Approximate amount of physical memory committed for this space.
   virtual size_t CommittedPhysicalMemory() = 0;
 
@@ -972,8 +993,23 @@ class Space : public Malloced {
     committed_ -= bytes;
   }
 
+  void IncrementExternalBackingStoreBytes(ExternalBackingStoreType type,
+                                          size_t amount) {
+    external_backing_store_bytes_[type] += amount;
+  }
+  void DecrementExternalBackingStoreBytes(ExternalBackingStoreType type,
+                                          size_t amount) {
+    DCHECK_GE(external_backing_store_bytes_[type], amount);
+    external_backing_store_bytes_[type] -= amount;
+  }
+
   V8_EXPORT_PRIVATE void* GetRandomMmapAddr();
 
+  MemoryChunk* first_page() { return memory_chunk_list_.front(); }
+  MemoryChunk* last_page() { return memory_chunk_list_.back(); }
+
+  base::List<MemoryChunk>& memory_chunk_list() { return memory_chunk_list_; }
+
 #ifdef DEBUG
   virtual void Print() = 0;
 #endif
@@ -985,12 +1021,17 @@ class Space : public Malloced {
   }
 
   std::vector<AllocationObserver*> allocation_observers_;
-  bool allocation_observers_paused_;
 
- protected:
+  // The List manages the pages that belong to the given space.
+  base::List<MemoryChunk> memory_chunk_list_;
+
+  // Tracks off-heap memory used by this space.
+  std::atomic<size_t>* external_backing_store_bytes_;
+
+ private:
+  bool allocation_observers_paused_;
   Heap* heap_;
   AllocationSpace id_;
-  Executability executable_;
 
   // Keeps track of committed memory in a space.
   size_t committed_;
@@ -1020,20 +1061,15 @@ class MemoryChunkValidator {
 // manages a range of virtual memory.
 class CodeRange {
  public:
-  explicit CodeRange(Isolate* isolate);
+  CodeRange(Isolate* isolate, size_t requested_size);
   ~CodeRange() {
     if (virtual_memory_.IsReserved()) virtual_memory_.Free();
   }
 
-  // Reserves a range of virtual memory, but does not commit any of it.
-  // Can only be called once, at heap initialization time.
-  // Returns false on failure.
-  bool SetUp(size_t requested_size);
-
   bool valid() { return virtual_memory_.IsReserved(); }
   Address start() {
     DCHECK(valid());
-    return static_cast<Address>(virtual_memory_.address());
+    return virtual_memory_.address();
   }
   size_t size() {
     DCHECK(valid());
@@ -1041,7 +1077,7 @@ class CodeRange {
   }
   bool contains(Address address) {
     if (!valid()) return false;
-    Address start = static_cast<Address>(virtual_memory_.address());
+    Address start = virtual_memory_.address();
     return start <= address && address < start + virtual_memory_.size();
   }
 
@@ -1051,8 +1087,6 @@ class CodeRange {
   V8_WARN_UNUSED_RESULT Address AllocateRawMemory(const size_t requested_size,
                                                   const size_t commit_size,
                                                   size_t* allocated);
-  bool CommitRawMemory(Address start, size_t length);
-  bool UncommitRawMemory(Address start, size_t length);
   void FreeRawMemory(Address buf, size_t length);
 
  private:
@@ -1065,7 +1099,7 @@ class CodeRange {
       DCHECK(size >= static_cast<size_t>(Page::kPageSize));
     }
     FreeBlock(void* start_arg, size_t size_arg)
-        : start(static_cast<Address>(start_arg)), size(size_arg) {
+        : start(reinterpret_cast<Address>(start_arg)), size(size_arg) {
       DCHECK(IsAddressAligned(start, MemoryChunk::kAlignment));
       DCHECK(size >= static_cast<size_t>(Page::kPageSize));
     }
@@ -1114,7 +1148,7 @@ class SkipList {
 
   void Clear() {
     for (int idx = 0; idx < kSize; idx++) {
-      starts_[idx] = reinterpret_cast<Address>(-1);
+      starts_[idx] = static_cast<Address>(-1);
     }
   }
 
@@ -1209,9 +1243,12 @@ class V8_EXPORT_PRIVATE MemoryAllocator {
     }
 
     void FreeQueuedChunks();
-    void WaitUntilCompleted();
+    void CancelAndWaitForPendingTasks();
+    void PrepareForMarkCompact();
+    void EnsureUnmappingCompleted();
     void TearDown();
     int NumberOfChunks();
+    size_t CommittedBufferedMemory();
 
    private:
     static const int kReservedQueueingSlots = 64;
@@ -1250,6 +1287,8 @@ class V8_EXPORT_PRIVATE MemoryAllocator {
     template <FreeMode mode>
     void PerformFreeMemoryOnQueuedChunks();
 
+    void PerformFreeMemoryOnQueuedNonRegularChunks();
+
     Heap* const heap_;
     MemoryAllocator* const allocator_;
     base::Mutex mutex_;
@@ -1257,7 +1296,7 @@ class V8_EXPORT_PRIVATE MemoryAllocator {
     CancelableTaskManager::Id task_ids_[kMaxUnmapperTasks];
     base::Semaphore pending_unmapping_tasks_semaphore_;
     intptr_t pending_unmapping_tasks_;
-    base::AtomicNumber<intptr_t> active_unmapping_tasks_;
+    std::atomic<intptr_t> active_unmapping_tasks_;
 
     friend class MemoryAllocator;
   };
@@ -1294,11 +1333,8 @@ class V8_EXPORT_PRIVATE MemoryAllocator {
 
   static intptr_t GetCommitPageSize();
 
-  explicit MemoryAllocator(Isolate* isolate);
-
-  // Initializes its internal bookkeeping structures.
-  // Max capacity of the total space and executable memory limit.
-  bool SetUp(size_t max_capacity, size_t code_range_size);
+  MemoryAllocator(Isolate* isolate, size_t max_capacity,
+                  size_t code_range_size);
 
   void TearDown();
 
@@ -1316,10 +1352,10 @@ class V8_EXPORT_PRIVATE MemoryAllocator {
   void Free(MemoryChunk* chunk);
 
   // Returns allocated spaces in bytes.
-  size_t Size() { return size_.Value(); }
+  size_t Size() { return size_; }
 
   // Returns allocated executable spaces in bytes.
-  size_t SizeExecutable() { return size_executable_.Value(); }
+  size_t SizeExecutable() { return size_executable_; }
 
   // Returns the maximum available bytes of heaps.
   size_t Available() {
@@ -1334,7 +1370,7 @@ class V8_EXPORT_PRIVATE MemoryAllocator {
 
   // Returns an indication of whether a pointer is in a space that has
   // been allocated by this MemoryAllocator.
-  V8_INLINE bool IsOutsideAllocatedSpace(const void* address) {
+  V8_INLINE bool IsOutsideAllocatedSpace(Address address) {
     return address < lowest_ever_allocated_.Value() ||
            address >= highest_ever_allocated_.Value();
   }
@@ -1351,7 +1387,7 @@ class V8_EXPORT_PRIVATE MemoryAllocator {
                                 size_t alignment, Executability executable,
                                 void* hint, VirtualMemory* controller);
 
-  bool CommitMemory(Address addr, size_t size, Executability executable);
+  bool CommitMemory(Address addr, size_t size);
 
   void FreeMemory(VirtualMemory* reservation, Executability executable);
   void FreeMemory(Address addr, size_t size, Executability executable);
@@ -1364,10 +1400,10 @@ class V8_EXPORT_PRIVATE MemoryAllocator {
                          size_t bytes_to_free, Address new_area_end);
 
   // Commit a contiguous block of memory from the initial chunk.  Assumes that
-  // the address is not nullptr, the size is greater than zero, and that the
-  // block is contained in the initial chunk.  Returns true if it succeeded
+  // the address is not kNullAddress, the size is greater than zero, and that
+  // the block is contained in the initial chunk.  Returns true if it succeeded
   // and false otherwise.
-  bool CommitBlock(Address start, size_t size, Executability executable);
+  bool CommitBlock(Address start, size_t size);
 
   // Checks if an allocated MemoryChunk was intended to be used for executable
   // memory.
@@ -1376,14 +1412,14 @@ class V8_EXPORT_PRIVATE MemoryAllocator {
   }
 
   // Uncommit a contiguous block of memory [start..(start+size)[.
-  // start is not nullptr, the size is greater than zero, and the
+  // start is not kNullAddress, the size is greater than zero, and the
   // block is contained in the initial chunk.  Returns true if it succeeded
   // and false otherwise.
   bool UncommitBlock(Address start, size_t size);
 
-  // Zaps a contiguous block of memory [start..(start+size)[ thus
-  // filling it up with a recognizable non-nullptr bit pattern.
-  void ZapBlock(Address start, size_t size);
+  // Zaps a contiguous block of memory [start..(start+size)[ with
+  // a given zap value.
+  void ZapBlock(Address start, size_t size, uintptr_t zap_value);
 
   V8_WARN_UNUSED_RESULT bool CommitExecutableMemory(VirtualMemory* vm,
                                                     Address start,
@@ -1413,11 +1449,11 @@ class V8_EXPORT_PRIVATE MemoryAllocator {
   Page* InitializePagesInChunk(int chunk_id, int pages_in_chunk,
                                PagedSpace* owner);
 
-  void UpdateAllocatedSpaceLimits(void* low, void* high) {
+  void UpdateAllocatedSpaceLimits(Address low, Address high) {
     // The use of atomic primitives does not guarantee correctness (wrt.
     // desired semantics) by default. The loop here ensures that we update the
     // values only if they did not change in between.
-    void* ptr = nullptr;
+    Address ptr = kNullAddress;
     do {
       ptr = lowest_ever_allocated_.Value();
     } while ((low < ptr) && !lowest_ever_allocated_.TrySetValue(ptr, low));
@@ -1445,17 +1481,17 @@ class V8_EXPORT_PRIVATE MemoryAllocator {
   size_t capacity_;
 
   // Allocated space size in bytes.
-  base::AtomicNumber<size_t> size_;
+  std::atomic<size_t> size_;
   // Allocated executable space size in bytes.
-  base::AtomicNumber<size_t> size_executable_;
+  std::atomic<size_t> size_executable_;
 
   // We keep the lowest and highest addresses allocated as a quick way
   // of determining that pointers are outside the heap. The estimate is
   // conservative, i.e. not all addresses in 'allocated' space are allocated
   // to our heap. The range is [lowest, highest[, inclusive on the low end
   // and exclusive on the high end.
-  base::AtomicValue<void*> lowest_ever_allocated_;
-  base::AtomicValue<void*> highest_ever_allocated_;
+  base::AtomicValue<Address> lowest_ever_allocated_;
+  base::AtomicValue<Address> highest_ever_allocated_;
 
   VirtualMemory last_chunk_;
   Unmapper unmapper_;
@@ -1574,7 +1610,7 @@ class V8_EXPORT_PRIVATE HeapObjectIterator : public ObjectIterator {
 // space.
 class LinearAllocationArea {
  public:
-  LinearAllocationArea() : top_(nullptr), limit_(nullptr) {}
+  LinearAllocationArea() : top_(kNullAddress), limit_(kNullAddress) {}
   LinearAllocationArea(Address top, Address limit) : top_(top), limit_(limit) {}
 
   void Reset(Address top, Address limit) {
@@ -1582,27 +1618,21 @@ class LinearAllocationArea {
     set_limit(limit);
   }
 
-  INLINE(void set_top(Address top)) {
-    SLOW_DCHECK(top == nullptr ||
-                (reinterpret_cast<intptr_t>(top) & kHeapObjectTagMask) == 0);
+  V8_INLINE void set_top(Address top) {
+    SLOW_DCHECK(top == kNullAddress || (top & kHeapObjectTagMask) == 0);
     top_ = top;
   }
 
-  INLINE(Address top()) const {
-    SLOW_DCHECK(top_ == nullptr ||
-                (reinterpret_cast<intptr_t>(top_) & kHeapObjectTagMask) == 0);
+  V8_INLINE Address top() const {
+    SLOW_DCHECK(top_ == kNullAddress || (top_ & kHeapObjectTagMask) == 0);
     return top_;
   }
 
   Address* top_address() { return &top_; }
 
-  INLINE(void set_limit(Address limit)) {
-    limit_ = limit;
-  }
+  V8_INLINE void set_limit(Address limit) { limit_ = limit; }
 
-  INLINE(Address limit()) const {
-    return limit_;
-  }
+  V8_INLINE Address limit() const { return limit_; }
 
   Address* limit_address() { return &limit_; }
 
@@ -1647,7 +1677,7 @@ class AllocationStats BASE_EMBEDDED {
   }
 
   // Accessors for the allocation statistics.
-  size_t Capacity() { return capacity_.Value(); }
+  size_t Capacity() { return capacity_; }
   size_t MaxCapacity() { return max_capacity_; }
   size_t Size() { return size_; }
 #ifdef DEBUG
@@ -1672,19 +1702,16 @@ class AllocationStats BASE_EMBEDDED {
   }
 
   void DecreaseCapacity(size_t bytes) {
-    size_t capacity = capacity_.Value();
-    DCHECK_GE(capacity, bytes);
-    DCHECK_GE(capacity - bytes, size_);
-    USE(capacity);
-    capacity_.Decrement(bytes);
+    DCHECK_GE(capacity_, bytes);
+    DCHECK_GE(capacity_ - bytes, size_);
+    capacity_ -= bytes;
   }
 
   void IncreaseCapacity(size_t bytes) {
-    size_t capacity = capacity_.Value();
-    DCHECK_GE(capacity + bytes, capacity);
-    capacity_.Increment(bytes);
-    if (capacity > max_capacity_) {
-      max_capacity_ = capacity;
+    DCHECK_GE(capacity_ + bytes, capacity_);
+    capacity_ += bytes;
+    if (capacity_ > max_capacity_) {
+      max_capacity_ = capacity_;
     }
   }
 
@@ -1693,7 +1720,7 @@ class AllocationStats BASE_EMBEDDED {
   // bookkeeping structures) currently in the space.
   // During evacuation capacity of the main spaces is accessed from multiple
   // threads to check the old generation hard limit.
-  base::AtomicNumber<size_t> capacity_;
+  std::atomic<size_t> capacity_;
 
   // |max_capacity_|: The maximum capacity ever observed.
   size_t max_capacity_;
@@ -1784,7 +1811,7 @@ class V8_EXPORT_PRIVATE FreeList {
   void Reset();
 
   void ResetStats() {
-    wasted_bytes_.SetValue(0);
+    wasted_bytes_ = 0;
     ForAllFreeListCategories(
         [](FreeListCategory* category) { category->ResetStats(); });
   }
@@ -1812,7 +1839,7 @@ class V8_EXPORT_PRIVATE FreeList {
   size_t EvictFreeListItems(Page* page);
   bool ContainsPageFreeListItems(Page* page);
 
-  size_t wasted_bytes() { return wasted_bytes_.Value(); }
+  size_t wasted_bytes() { return wasted_bytes_; }
 
   template <typename Callback>
   void ForAllFreeListCategories(FreeListCategoryType type, Callback callback) {
@@ -1908,7 +1935,7 @@ class V8_EXPORT_PRIVATE FreeList {
     return categories_[type];
   }
 
-  base::AtomicNumber<size_t> wasted_bytes_;
+  std::atomic<size_t> wasted_bytes_;
   FreeListCategory* categories_[kNumberOfCategories];
 
   friend class FreeListCategory;
@@ -1952,7 +1979,7 @@ class LocalAllocationBuffer {
   V8_WARN_UNUSED_RESULT inline AllocationResult AllocateRawAligned(
       int size_in_bytes, AllocationAlignment alignment);
 
-  inline bool IsValid() { return allocation_info_.top() != nullptr; }
+  inline bool IsValid() { return allocation_info_.top() != kNullAddress; }
 
   // Try to merge LABs, which is only possible when they are adjacent in memory.
   // Returns true if the merge was successful, false otherwise.
@@ -1972,9 +1999,9 @@ class LocalAllocationBuffer {
 
 class SpaceWithLinearArea : public Space {
  public:
-  SpaceWithLinearArea(Heap* heap, AllocationSpace id, Executability executable)
-      : Space(heap, id, executable), top_on_previous_step_(0) {
-    allocation_info_.Reset(nullptr, nullptr);
+  SpaceWithLinearArea(Heap* heap, AllocationSpace id)
+      : Space(heap, id), top_on_previous_step_(0) {
+    allocation_info_.Reset(kNullAddress, kNullAddress);
   }
 
   virtual bool SupportsInlineAllocation() = 0;
@@ -2038,21 +2065,14 @@ class V8_EXPORT_PRIVATE PagedSpace
 
   ~PagedSpace() override { TearDown(); }
 
-  // Set up the space using the given address range of virtual memory (from
-  // the memory allocator's initial chunk) if possible.  If the block of
-  // addresses is not big enough to contain a single page-aligned page, a
-  // fresh chunk will be allocated.
-  bool SetUp();
-
-  // Returns true if the space has been successfully set up and not
-  // subsequently torn down.
-  bool HasBeenSetUp();
-
   // Checks whether an object/address is in this space.
   inline bool Contains(Address a);
   inline bool Contains(Object* o);
   bool ContainsSlow(Address addr);
 
+  // Does the space need executable memory?
+  Executability executable() { return executable_; }
+
   // During boot the free_space_map is created, and afterwards we may need
   // to write it into the free list nodes that were already created.
   void RepairFreeListsAfterDeserialization();
@@ -2119,8 +2139,8 @@ class V8_EXPORT_PRIVATE PagedSpace
 
   size_t Free(Address start, size_t size_in_bytes, SpaceAccountingMode mode) {
     if (size_in_bytes == 0) return 0;
-    heap_->CreateFillerObjectAt(start, static_cast<int>(size_in_bytes),
-                                ClearRecordedSlots::kNo);
+    heap()->CreateFillerObjectAt(start, static_cast<int>(size_in_bytes),
+                                 ClearRecordedSlots::kNo);
     if (mode == SpaceAccountingMode::kSpaceAccounted) {
       return AccountedFree(start, size_in_bytes);
     } else {
@@ -2171,11 +2191,10 @@ class V8_EXPORT_PRIVATE PagedSpace
 
   void RefineAllocatedBytesAfterSweeping(Page* page);
 
-  // The dummy page that anchors the linked list of pages.
-  Page* anchor() { return &anchor_; }
-
   Page* InitializePage(MemoryChunk* chunk, Executability executable);
+
   void ReleasePage(Page* page);
+
   // Adds the page to this space and returns the number of bytes added to the
   // free list of the space.
   size_t AddPage(Page* page);
@@ -2189,7 +2208,7 @@ class V8_EXPORT_PRIVATE PagedSpace
 
 #ifdef VERIFY_HEAP
   // Verify integrity of this space.
-  virtual void Verify(ObjectVisitor* visitor);
+  virtual void Verify(Isolate* isolate, ObjectVisitor* visitor);
 
   void VerifyLiveBytes();
 
@@ -2209,9 +2228,6 @@ class V8_EXPORT_PRIVATE PagedSpace
   static void ResetCodeStatistics(Isolate* isolate);
 #endif
 
-  Page* FirstPage() { return anchor_.next_page(); }
-  Page* LastPage() { return anchor_.prev_page(); }
-
   bool CanExpand(size_t size);
 
   // Returns the number of total pages in this space.
@@ -2237,8 +2253,10 @@ class V8_EXPORT_PRIVATE PagedSpace
   inline void UnlinkFreeListCategories(Page* page);
   inline size_t RelinkFreeListCategories(Page* page);
 
-  iterator begin() { return iterator(anchor_.next_page()); }
-  iterator end() { return iterator(&anchor_); }
+  Page* first_page() { return reinterpret_cast<Page*>(Space::first_page()); }
+
+  iterator begin() { return iterator(first_page()); }
+  iterator end() { return iterator(nullptr); }
 
   // Shrink immortal immovable pages of the space to be exactly the size needed
   // using the high water mark.
@@ -2269,7 +2287,7 @@ class V8_EXPORT_PRIVATE PagedSpace
   // smaller, initial pages.
   virtual bool snapshotable() { return true; }
 
-  bool HasPages() { return anchor_.next_page() != &anchor_; }
+  bool HasPages() { return first_page() != nullptr; }
 
   // Cleans up the space, frees all pages in this space except those belonging
   // to the initial chunk, uncommits addresses in the initial chunk.
@@ -2314,14 +2332,13 @@ class V8_EXPORT_PRIVATE PagedSpace
   V8_WARN_UNUSED_RESULT bool RawSlowRefillLinearAllocationArea(
       int size_in_bytes);
 
+  Executability executable_;
+
   size_t area_size_;
 
   // Accounting information for this space.
   AllocationStats accounting_stats_;
 
-  // The dummy page that anchors the double linked list of pages.
-  Page anchor_;
-
   // The space's free list.
   FreeList free_list_;
 
@@ -2350,14 +2367,13 @@ class SemiSpace : public Space {
   static void Swap(SemiSpace* from, SemiSpace* to);
 
   SemiSpace(Heap* heap, SemiSpaceId semispace)
-      : Space(heap, NEW_SPACE, NOT_EXECUTABLE),
+      : Space(heap, NEW_SPACE),
         current_capacity_(0),
         maximum_capacity_(0),
         minimum_capacity_(0),
-        age_mark_(nullptr),
+        age_mark_(kNullAddress),
         committed_(false),
         id_(semispace),
-        anchor_(this),
         current_page_(nullptr),
         pages_used_(0) {}
 
@@ -2367,7 +2383,6 @@ class SemiSpace : public Space {
 
   void SetUp(size_t initial_capacity, size_t maximum_capacity);
   void TearDown();
-  bool HasBeenSetUp() { return maximum_capacity_ != 0; }
 
   bool Commit();
   bool Uncommit();
@@ -2384,19 +2399,17 @@ class SemiSpace : public Space {
 
   bool EnsureCurrentCapacity();
 
+  Address space_end() { return memory_chunk_list_.back()->area_end(); }
+
   // Returns the start address of the first page of the space.
   Address space_start() {
-    DCHECK_NE(anchor_.next_page(), anchor());
-    return anchor_.next_page()->area_start();
+    DCHECK_NE(memory_chunk_list_.front(), nullptr);
+    return memory_chunk_list_.front()->area_start();
   }
 
-  Page* first_page() { return anchor_.next_page(); }
   Page* current_page() { return current_page_; }
   int pages_used() { return pages_used_; }
 
-  // Returns one past the end address of the space.
-  Address space_end() { return anchor_.prev_page()->area_end(); }
-
   // Returns the start address of the current page of the space.
   Address page_low() { return current_page_->area_start(); }
 
@@ -2409,7 +2422,7 @@ class SemiSpace : public Space {
     // that we need to account for the next page already for this check as we
     // could potentially fill the whole page after advancing.
     const bool reached_max_pages = (pages_used_ + 1) == max_pages();
-    if (next_page == anchor() || reached_max_pages) {
+    if (next_page == nullptr || reached_max_pages) {
       return false;
     }
     current_page_ = next_page;
@@ -2422,6 +2435,7 @@ class SemiSpace : public Space {
 
   void RemovePage(Page* page);
   void PrependPage(Page* page);
+
   Page* InitializePage(MemoryChunk* chunk, Executability executable);
 
   // Age mark accessors.
@@ -2455,8 +2469,11 @@ class SemiSpace : public Space {
     UNREACHABLE();
   }
 
-  iterator begin() { return iterator(anchor_.next_page()); }
-  iterator end() { return iterator(anchor()); }
+  Page* first_page() { return reinterpret_cast<Page*>(Space::first_page()); }
+  Page* last_page() { return reinterpret_cast<Page*>(Space::last_page()); }
+
+  iterator begin() { return iterator(first_page()); }
+  iterator end() { return iterator(nullptr); }
 
   std::unique_ptr<ObjectIterator> GetObjectIterator() override;
 
@@ -2476,9 +2493,8 @@ class SemiSpace : public Space {
 #endif
 
  private:
-  void RewindPages(Page* start, int num_pages);
+  void RewindPages(int num_pages);
 
-  inline Page* anchor() { return &anchor_; }
   inline int max_pages() {
     return static_cast<int>(current_capacity_ / Page::kPageSize);
   }
@@ -2502,8 +2518,8 @@ class SemiSpace : public Space {
   bool committed_;
   SemiSpaceId id_;
 
-  Page anchor_;
   Page* current_page_;
+
   int pages_used_;
 
   friend class NewSpace;
@@ -2542,27 +2558,19 @@ class NewSpace : public SpaceWithLinearArea {
  public:
   typedef PageIterator iterator;
 
-  explicit NewSpace(Heap* heap)
-      : SpaceWithLinearArea(heap, NEW_SPACE, NOT_EXECUTABLE),
-        to_space_(heap, kToSpace),
-        from_space_(heap, kFromSpace),
-        reservation_() {}
+  NewSpace(Heap* heap, size_t initial_semispace_capacity,
+           size_t max_semispace_capacity);
+
+  ~NewSpace() override { TearDown(); }
 
   inline bool Contains(HeapObject* o);
   inline bool ContainsSlow(Address a);
   inline bool Contains(Object* o);
 
-  bool SetUp(size_t initial_semispace_capacity, size_t max_semispace_capacity);
-
   // Tears down the space.  Heap memory was not allocated by the space, so it
   // is not deallocated here.
   void TearDown();
 
-  // True if the space has been set up but not torn down.
-  bool HasBeenSetUp() {
-    return to_space_.HasBeenSetUp() && from_space_.HasBeenSetUp();
-  }
-
   // Flip the pair of spaces.
   void Flip();
 
@@ -2616,10 +2624,16 @@ class NewSpace : public SpaceWithLinearArea {
     return Capacity() - Size();
   }
 
+  size_t ExternalBackingStoreBytes(
+      ExternalBackingStoreType type) const override {
+    DCHECK_EQ(0, from_space_.ExternalBackingStoreBytes(type));
+    return to_space_.ExternalBackingStoreBytes(type);
+  }
+
   size_t AllocatedSinceLastGC() {
     const Address age_mark = to_space_.age_mark();
-    DCHECK_NOT_NULL(age_mark);
-    DCHECK_NOT_NULL(top());
+    DCHECK_NE(age_mark, kNullAddress);
+    DCHECK_NE(top(), kNullAddress);
     Page* const age_mark_page = Page::FromAllocationAreaAddress(age_mark);
     Page* const last_page = Page::FromAllocationAreaAddress(top());
     Page* current_page = age_mark_page;
@@ -2675,22 +2689,23 @@ class NewSpace : public SpaceWithLinearArea {
   Address original_top() { return original_top_.Value(); }
   Address original_limit() { return original_limit_.Value(); }
 
-  // Return the address of the first object in the active semispace.
-  Address bottom() { return to_space_.space_start(); }
+  // Return the address of the first allocatable address in the active
+  // semispace. This may be the address where the first object resides.
+  Address first_allocatable_address() { return to_space_.space_start(); }
 
   // Get the age mark of the inactive semispace.
   Address age_mark() { return from_space_.age_mark(); }
   // Set the age mark in the active semispace.
   void set_age_mark(Address mark) { to_space_.set_age_mark(mark); }
 
-  V8_WARN_UNUSED_RESULT INLINE(AllocationResult AllocateRawAligned(
-      int size_in_bytes, AllocationAlignment alignment));
+  V8_WARN_UNUSED_RESULT V8_INLINE AllocationResult
+  AllocateRawAligned(int size_in_bytes, AllocationAlignment alignment);
 
-  V8_WARN_UNUSED_RESULT INLINE(
-      AllocationResult AllocateRawUnaligned(int size_in_bytes));
+  V8_WARN_UNUSED_RESULT V8_INLINE AllocationResult
+  AllocateRawUnaligned(int size_in_bytes);
 
-  V8_WARN_UNUSED_RESULT INLINE(AllocationResult AllocateRaw(
-      int size_in_bytes, AllocationAlignment alignment));
+  V8_WARN_UNUSED_RESULT V8_INLINE AllocationResult
+  AllocateRaw(int size_in_bytes, AllocationAlignment alignment);
 
   V8_WARN_UNUSED_RESULT inline AllocationResult AllocateRawSynchronized(
       int size_in_bytes, AllocationAlignment alignment);
@@ -2705,18 +2720,6 @@ class NewSpace : public SpaceWithLinearArea {
   // it in steps to guarantee that the observers are notified periodically.
   void UpdateInlineAllocationLimit(size_t size_in_bytes) override;
 
-  // Get the extent of the inactive semispace (for use as a marking stack,
-  // or to zap it). Notice: space-addresses are not necessarily on the
-  // same page, so FromSpaceStart() might be above FromSpaceEnd().
-  Address FromSpacePageLow() { return from_space_.page_low(); }
-  Address FromSpacePageHigh() { return from_space_.page_high(); }
-  Address FromSpaceStart() { return from_space_.space_start(); }
-  Address FromSpaceEnd() { return from_space_.space_end(); }
-
-  // Get the extent of the active semispace's pages' memory.
-  Address ToSpaceStart() { return to_space_.space_start(); }
-  Address ToSpaceEnd() { return to_space_.space_end(); }
-
   inline bool ToSpaceContainsSlow(Address a);
   inline bool FromSpaceContainsSlow(Address a);
   inline bool ToSpaceContains(Object* o);
@@ -2731,7 +2734,7 @@ class NewSpace : public SpaceWithLinearArea {
 
 #ifdef VERIFY_HEAP
   // Verify the active semispace.
-  virtual void Verify();
+  virtual void Verify(Isolate* isolate);
 #endif
 
 #ifdef DEBUG
@@ -2754,6 +2757,9 @@ class NewSpace : public SpaceWithLinearArea {
 
   SemiSpace* active_space() { return &to_space_; }
 
+  Page* first_page() { return to_space_.first_page(); }
+  Page* last_page() { return to_space_.last_page(); }
+
   iterator begin() { return to_space_.begin(); }
   iterator end() { return to_space_.end(); }
 
@@ -2840,16 +2846,24 @@ class CompactionSpaceCollection : public Malloced {
   CompactionSpace code_space_;
 };
 
-
 // -----------------------------------------------------------------------------
-// Old object space (includes the old space of objects and code space)
+// Old generation regular object space.
 
 class OldSpace : public PagedSpace {
  public:
   // Creates an old space object. The constructor does not allocate pages
   // from OS.
-  OldSpace(Heap* heap, AllocationSpace id, Executability executable)
-      : PagedSpace(heap, id, executable) {}
+  explicit OldSpace(Heap* heap) : PagedSpace(heap, OLD_SPACE, NOT_EXECUTABLE) {}
+};
+
+// -----------------------------------------------------------------------------
+// Old generation code object space.
+
+class CodeSpace : public PagedSpace {
+ public:
+  // Creates an old space object. The constructor does not allocate pages
+  // from OS.
+  explicit CodeSpace(Heap* heap) : PagedSpace(heap, CODE_SPACE, EXECUTABLE) {}
 };
 
 
@@ -2867,8 +2881,7 @@ class OldSpace : public PagedSpace {
 class MapSpace : public PagedSpace {
  public:
   // Creates a map space object.
-  MapSpace(Heap* heap, AllocationSpace id)
-      : PagedSpace(heap, id, NOT_EXECUTABLE) {}
+  explicit MapSpace(Heap* heap) : PagedSpace(heap, MAP_SPACE, NOT_EXECUTABLE) {}
 
   int RoundSizeDownToObjectAlignment(int size) override {
     if (base::bits::IsPowerOfTwo(Map::kSize)) {
@@ -2888,8 +2901,35 @@ class MapSpace : public PagedSpace {
 
 class ReadOnlySpace : public PagedSpace {
  public:
-  ReadOnlySpace(Heap* heap, AllocationSpace id, Executability executable)
-      : PagedSpace(heap, id, executable) {}
+  class WritableScope {
+   public:
+    explicit WritableScope(ReadOnlySpace* space) : space_(space) {
+      space_->MarkAsReadWrite();
+    }
+
+    ~WritableScope() { space_->MarkAsReadOnly(); }
+
+   private:
+    ReadOnlySpace* space_;
+  };
+
+  explicit ReadOnlySpace(Heap* heap);
+
+  bool writable() const { return !is_marked_read_only_; }
+
+  void ClearStringPaddingIfNeeded();
+  void MarkAsReadOnly();
+
+ private:
+  void MarkAsReadWrite();
+  void SetPermissionsForPages(PageAllocator::Permission access);
+
+  bool is_marked_read_only_ = false;
+  //
+  // String padding must be cleared just before serialization and therefore the
+  // string padding in the space will already have been cleared if the space was
+  // deserialized.
+  bool is_string_padding_cleared_;
 };
 
 // -----------------------------------------------------------------------------
@@ -2903,11 +2943,10 @@ class LargeObjectSpace : public Space {
  public:
   typedef LargePageIterator iterator;
 
+  explicit LargeObjectSpace(Heap* heap);
   LargeObjectSpace(Heap* heap, AllocationSpace id);
-  virtual ~LargeObjectSpace();
 
-  // Initializes internal data structures.
-  bool SetUp();
+  ~LargeObjectSpace() override { TearDown(); }
 
   // Releases internal resources, frees objects in this space.
   void TearDown();
@@ -2917,16 +2956,13 @@ class LargeObjectSpace : public Space {
     return chunk_size - Page::kPageSize - Page::kObjectStartOffset;
   }
 
-  // Shared implementation of AllocateRaw, AllocateRawCode and
-  // AllocateRawFixedArray.
   V8_WARN_UNUSED_RESULT AllocationResult AllocateRaw(int object_size,
                                                      Executability executable);
 
   // Available bytes for objects in this space.
-  inline size_t Available() override;
+  size_t Available() override;
 
   size_t Size() override { return size_; }
-
   size_t SizeOfObjects() override { return objects_size_; }
 
   // Approximate amount of physical memory committed for this space.
@@ -2962,14 +2998,16 @@ class LargeObjectSpace : public Space {
   bool ContainsSlow(Address addr) { return FindObject(addr)->IsHeapObject(); }
 
   // Checks whether the space is empty.
-  bool IsEmpty() { return first_page_ == nullptr; }
+  bool IsEmpty() { return first_page() == nullptr; }
 
-  LargePage* first_page() { return first_page_; }
+  LargePage* first_page() {
+    return reinterpret_cast<LargePage*>(Space::first_page());
+  }
 
   // Collect code statistics.
   void CollectCodeStatistics();
 
-  iterator begin() { return iterator(first_page_); }
+  iterator begin() { return iterator(first_page()); }
   iterator end() { return iterator(nullptr); }
 
   std::unique_ptr<ObjectIterator> GetObjectIterator() override;
@@ -2977,28 +3015,40 @@ class LargeObjectSpace : public Space {
   base::Mutex* chunk_map_mutex() { return &chunk_map_mutex_; }
 
 #ifdef VERIFY_HEAP
-  virtual void Verify();
+  virtual void Verify(Isolate* isolate);
 #endif
 
 #ifdef DEBUG
   void Print() override;
 #endif
 
+ protected:
+  LargePage* AllocateLargePage(int object_size, Executability executable);
+
  private:
-  // The head of the linked list of large object chunks.
-  LargePage* first_page_;
-  size_t size_;            // allocated bytes
-  int page_count_;         // number of chunks
-  size_t objects_size_;    // size of objects
+  size_t size_;          // allocated bytes
+  int page_count_;       // number of chunks
+  size_t objects_size_;  // size of objects
+
   // The chunk_map_mutex_ has to be used when the chunk map is accessed
   // concurrently.
   base::Mutex chunk_map_mutex_;
+
   // Page-aligned addresses to their corresponding LargePage.
   std::unordered_map<Address, LargePage*> chunk_map_;
 
   friend class LargeObjectIterator;
 };
 
+class NewLargeObjectSpace : public LargeObjectSpace {
+ public:
+  explicit NewLargeObjectSpace(Heap* heap);
+
+  V8_WARN_UNUSED_RESULT AllocationResult AllocateRaw(int object_size);
+
+  // Available bytes for objects in this space.
+  size_t Available() override;
+};
 
 class LargeObjectIterator : public ObjectIterator {
  public:
diff --git a/deps/v8/src/heap/store-buffer.cc b/deps/v8/src/heap/store-buffer.cc
index 3df5a5a53f2fd0..d73e3235c158df 100644
--- a/deps/v8/src/heap/store-buffer.cc
+++ b/deps/v8/src/heap/store-buffer.cc
@@ -38,15 +38,13 @@ void StoreBuffer::SetUp() {
                           &reservation)) {
     heap_->FatalProcessOutOfMemory("StoreBuffer::SetUp");
   }
-  uintptr_t start_as_int = reinterpret_cast<uintptr_t>(reservation.address());
-  start_[0] =
-      reinterpret_cast<Address*>(::RoundUp(start_as_int, kStoreBufferSize));
+  Address start = reservation.address();
+  start_[0] = reinterpret_cast<Address*>(::RoundUp(start, kStoreBufferSize));
   limit_[0] = start_[0] + (kStoreBufferSize / kPointerSize);
   start_[1] = limit_[0];
   limit_[1] = start_[1] + (kStoreBufferSize / kPointerSize);
 
-  Address* vm_limit = reinterpret_cast<Address*>(
-      reinterpret_cast<char*>(reservation.address()) + reservation.size());
+  Address* vm_limit = reinterpret_cast<Address*>(start + reservation.size());
 
   USE(vm_limit);
   for (int i = 0; i < kStoreBuffers; i++) {
@@ -54,7 +52,7 @@ void StoreBuffer::SetUp() {
     DCHECK(reinterpret_cast<Address>(limit_[i]) >= reservation.address());
     DCHECK(start_[i] <= vm_limit);
     DCHECK(limit_[i] <= vm_limit);
-    DCHECK_EQ(0, reinterpret_cast<uintptr_t>(limit_[i]) & kStoreBufferMask);
+    DCHECK_EQ(0, reinterpret_cast<Address>(limit_[i]) & kStoreBufferMask);
   }
 
   if (!reservation.SetPermissions(reinterpret_cast<Address>(start_[0]),
@@ -104,7 +102,7 @@ void StoreBuffer::MoveEntriesToRememberedSet(int index) {
   if (!lazy_top_[index]) return;
   DCHECK_GE(index, 0);
   DCHECK_LT(index, kStoreBuffers);
-  Address last_inserted_addr = nullptr;
+  Address last_inserted_addr = kNullAddress;
 
   // We are taking the chunk map mutex here because the page lookup of addr
   // below may require us to check if addr is part of a large page.
@@ -114,7 +112,7 @@ void StoreBuffer::MoveEntriesToRememberedSet(int index) {
     Address addr = *current;
     MemoryChunk* chunk = MemoryChunk::FromAnyPointerAddress(heap_, addr);
     if (IsDeletionAddress(addr)) {
-      last_inserted_addr = nullptr;
+      last_inserted_addr = kNullAddress;
       current++;
       Address end = *current;
       DCHECK(!IsDeletionAddress(end));
diff --git a/deps/v8/src/heap/store-buffer.h b/deps/v8/src/heap/store-buffer.h
index 58f47f483418c4..e447b2f74e0368 100644
--- a/deps/v8/src/heap/store-buffer.h
+++ b/deps/v8/src/heap/store-buffer.h
@@ -50,23 +50,21 @@ class StoreBuffer {
   void MoveAllEntriesToRememberedSet();
 
   inline bool IsDeletionAddress(Address address) const {
-    return reinterpret_cast<intptr_t>(address) & kDeletionTag;
+    return address & kDeletionTag;
   }
 
   inline Address MarkDeletionAddress(Address address) {
-    return reinterpret_cast<Address>(reinterpret_cast<intptr_t>(address) |
-                                     kDeletionTag);
+    return address | kDeletionTag;
   }
 
   inline Address UnmarkDeletionAddress(Address address) {
-    return reinterpret_cast<Address>(reinterpret_cast<intptr_t>(address) &
-                                     ~kDeletionTag);
+    return address & ~kDeletionTag;
   }
 
   // If we only want to delete a single slot, end should be set to null which
   // will be written into the second field. When processing the store buffer
   // the more efficient Remove method will be called in this case.
-  void DeleteEntry(Address start, Address end = nullptr) {
+  void DeleteEntry(Address start, Address end = kNullAddress) {
     // Deletions coming from the GC are directly deleted from the remembered
     // set. Deletions coming from the runtime are added to the store buffer
     // to allow concurrent processing.
diff --git a/deps/v8/src/heap/sweeper.cc b/deps/v8/src/heap/sweeper.cc
index f72f041c7808cc..efd5d304861770 100644
--- a/deps/v8/src/heap/sweeper.cc
+++ b/deps/v8/src/heap/sweeper.cc
@@ -67,7 +67,7 @@ class Sweeper::SweeperTask final : public CancelableTask {
  public:
   SweeperTask(Isolate* isolate, Sweeper* sweeper,
               base::Semaphore* pending_sweeper_tasks,
-              base::AtomicNumber<intptr_t>* num_sweeping_tasks,
+              std::atomic<intptr_t>* num_sweeping_tasks,
               AllocationSpace space_to_start)
       : CancelableTask(isolate),
         sweeper_(sweeper),
@@ -93,13 +93,13 @@ class Sweeper::SweeperTask final : public CancelableTask {
       DCHECK(IsValidSweepingSpace(space_id));
       sweeper_->SweepSpaceFromTask(space_id);
     }
-    num_sweeping_tasks_->Decrement(1);
+    (*num_sweeping_tasks_)--;
     pending_sweeper_tasks_->Signal();
   }
 
   Sweeper* const sweeper_;
   base::Semaphore* const pending_sweeper_tasks_;
-  base::AtomicNumber<intptr_t>* const num_sweeping_tasks_;
+  std::atomic<intptr_t>* const num_sweeping_tasks_;
   AllocationSpace space_to_start_;
   GCTracer* const tracer_;
 
@@ -151,12 +151,12 @@ void Sweeper::StartSweeping() {
 
 void Sweeper::StartSweeperTasks() {
   DCHECK_EQ(0, num_tasks_);
-  DCHECK_EQ(0, num_sweeping_tasks_.Value());
+  DCHECK_EQ(0, num_sweeping_tasks_);
   if (FLAG_concurrent_sweeping && sweeping_in_progress_ &&
       !heap_->delay_sweeper_tasks_for_testing_) {
     ForAllSweepingSpaces([this](AllocationSpace space) {
       DCHECK(IsValidSweepingSpace(space));
-      num_sweeping_tasks_.Increment(1);
+      num_sweeping_tasks_++;
       auto task = base::make_unique<SweeperTask>(
           heap_->isolate(), this, &pending_sweeper_tasks_semaphore_,
           &num_sweeping_tasks_, space);
@@ -200,11 +200,11 @@ void Sweeper::AbortAndWaitForTasks() {
       pending_sweeper_tasks_semaphore_.Wait();
     } else {
       // Aborted case.
-      num_sweeping_tasks_.Decrement(1);
+      num_sweeping_tasks_--;
     }
   }
   num_tasks_ = 0;
-  DCHECK_EQ(0, num_sweeping_tasks_.Value());
+  DCHECK_EQ(0, num_sweeping_tasks_);
 }
 
 void Sweeper::EnsureCompleted() {
@@ -225,9 +225,7 @@ void Sweeper::EnsureCompleted() {
   sweeping_in_progress_ = false;
 }
 
-bool Sweeper::AreSweeperTasksRunning() {
-  return num_sweeping_tasks_.Value() != 0;
-}
+bool Sweeper::AreSweeperTasksRunning() { return num_sweeping_tasks_ != 0; }
 
 int Sweeper::RawSweep(Page* p, FreeListRebuildingMode free_list_mode,
                       FreeSpaceTreatmentMode free_space_mode) {
@@ -251,7 +249,7 @@ int Sweeper::RawSweep(Page* p, FreeListRebuildingMode free_list_mode,
   ArrayBufferTracker::FreeDead(p, marking_state_);
 
   Address free_start = p->area_start();
-  DCHECK_EQ(0, reinterpret_cast<intptr_t>(free_start) % (32 * kPointerSize));
+  DCHECK_EQ(0, free_start % (32 * kPointerSize));
 
   // If we use the skip list for code space pages, we have to lock the skip
   // list because it could be accessed concurrently by the runtime or the
@@ -281,7 +279,7 @@ int Sweeper::RawSweep(Page* p, FreeListRebuildingMode free_list_mode,
       CHECK_GT(free_end, free_start);
       size_t size = static_cast<size_t>(free_end - free_start);
       if (free_space_mode == ZAP_FREE_SPACE) {
-        memset(free_start, 0xCC, size);
+        memset(reinterpret_cast<void*>(free_start), 0xCC, size);
       }
       if (free_list_mode == REBUILD_FREE_LIST) {
         freed_bytes = reinterpret_cast<PagedSpace*>(space)->Free(
@@ -321,7 +319,7 @@ int Sweeper::RawSweep(Page* p, FreeListRebuildingMode free_list_mode,
     CHECK_GT(p->area_end(), free_start);
     size_t size = static_cast<size_t>(p->area_end() - free_start);
     if (free_space_mode == ZAP_FREE_SPACE) {
-      memset(free_start, 0xCC, size);
+      memset(reinterpret_cast<void*>(free_start), 0xCC, size);
     }
     if (free_list_mode == REBUILD_FREE_LIST) {
       freed_bytes = reinterpret_cast<PagedSpace*>(space)->Free(
diff --git a/deps/v8/src/heap/sweeper.h b/deps/v8/src/heap/sweeper.h
index ecf1f8d4d290cf..af2e5629c68cf6 100644
--- a/deps/v8/src/heap/sweeper.h
+++ b/deps/v8/src/heap/sweeper.h
@@ -186,7 +186,7 @@ class Sweeper {
   bool sweeping_in_progress_;
   // Counter is actively maintained by the concurrent tasks to avoid querying
   // the semaphore for maintaining a task counter on the main thread.
-  base::AtomicNumber<intptr_t> num_sweeping_tasks_;
+  std::atomic<intptr_t> num_sweeping_tasks_;
   // Used by PauseOrCompleteScope to signal early bailout to tasks.
   base::AtomicValue<bool> stop_sweeper_tasks_;
 
diff --git a/deps/v8/src/heap/worklist.h b/deps/v8/src/heap/worklist.h
index bb3eae222845bd..db6e572df7dcbb 100644
--- a/deps/v8/src/heap/worklist.h
+++ b/deps/v8/src/heap/worklist.h
@@ -43,7 +43,7 @@ class Worklist {
 
     // Returns true if the worklist is empty. Can only be used from the main
     // thread without concurrent access.
-    bool IsGlobalEmpty() { return worklist_->IsGlobalEmpty(); }
+    bool IsEmpty() { return worklist_->IsEmpty(); }
 
     bool IsGlobalPoolEmpty() { return worklist_->IsGlobalPoolEmpty(); }
 
@@ -69,7 +69,7 @@ class Worklist {
   }
 
   ~Worklist() {
-    CHECK(IsGlobalEmpty());
+    CHECK(IsEmpty());
     for (int i = 0; i < num_tasks_; i++) {
       DCHECK_NOT_NULL(private_push_segment(i));
       DCHECK_NOT_NULL(private_pop_segment(i));
@@ -78,6 +78,15 @@ class Worklist {
     }
   }
 
+  // Swaps content with the given worklist. Local buffers need to
+  // be empty, not thread safe.
+  void Swap(Worklist<EntryType, SEGMENT_SIZE>& other) {
+    CHECK(AreLocalsEmpty());
+    CHECK(other.AreLocalsEmpty());
+
+    global_pool_.Swap(other.global_pool_);
+  }
+
   bool Push(int task_id, EntryType entry) {
     DCHECK_LT(task_id, num_tasks_);
     DCHECK_NOT_NULL(private_push_segment(task_id));
@@ -119,11 +128,16 @@ class Worklist {
 
   bool IsGlobalPoolEmpty() { return global_pool_.IsEmpty(); }
 
-  bool IsGlobalEmpty() {
+  bool IsEmpty() {
+    if (!AreLocalsEmpty()) return false;
+    return global_pool_.IsEmpty();
+  }
+
+  bool AreLocalsEmpty() {
     for (int i = 0; i < num_tasks_; i++) {
       if (!IsLocalEmpty(i)) return false;
     }
-    return global_pool_.IsEmpty();
+    return true;
   }
 
   size_t LocalSize(int task_id) {
@@ -159,6 +173,20 @@ class Worklist {
     global_pool_.Update(callback);
   }
 
+  // Calls the specified callback on each element of the deques.
+  // The signature of the callback is:
+  //   void Callback(EntryType entry).
+  //
+  // Assumes that no other tasks are running.
+  template <typename Callback>
+  void Iterate(Callback callback) {
+    for (int i = 0; i < num_tasks_; i++) {
+      private_pop_segment(i)->Iterate(callback);
+      private_push_segment(i)->Iterate(callback);
+    }
+    global_pool_.Iterate(callback);
+  }
+
   template <typename Callback>
   void IterateGlobalPool(Callback callback) {
     global_pool_.Iterate(callback);
@@ -246,6 +274,13 @@ class Worklist {
    public:
     GlobalPool() : top_(nullptr) {}
 
+    // Swaps contents, not thread safe.
+    void Swap(GlobalPool& other) {
+      Segment* temp = top_;
+      set_top(other.top_);
+      other.set_top(temp);
+    }
+
     V8_INLINE void Push(Segment* segment) {
       base::LockGuard<base::Mutex> guard(&lock_);
       segment->set_next(top_);
diff --git a/deps/v8/src/ia32/assembler-ia32-inl.h b/deps/v8/src/ia32/assembler-ia32-inl.h
index 14589b8577197c..429953c0e60548 100644
--- a/deps/v8/src/ia32/assembler-ia32-inl.h
+++ b/deps/v8/src/ia32/assembler-ia32-inl.h
@@ -72,9 +72,9 @@ Address RelocInfo::target_address() {
 
 Address RelocInfo::target_address_address() {
   DCHECK(IsCodeTarget(rmode_) || IsRuntimeEntry(rmode_) || IsWasmCall(rmode_) ||
-         IsEmbeddedObject(rmode_) || IsExternalReference(rmode_) ||
-         IsOffHeapTarget(rmode_));
-  return reinterpret_cast<Address>(pc_);
+         IsWasmStubCall(rmode_) || IsEmbeddedObject(rmode_) ||
+         IsExternalReference(rmode_) || IsOffHeapTarget(rmode_));
+  return pc_;
 }
 
 
@@ -97,7 +97,7 @@ Handle<HeapObject> RelocInfo::target_object_handle(Assembler* origin) {
   return Handle<HeapObject>::cast(Memory::Object_Handle_at(pc_));
 }
 
-void RelocInfo::set_target_object(HeapObject* target,
+void RelocInfo::set_target_object(Heap* heap, HeapObject* target,
                                   WriteBarrierMode write_barrier_mode,
                                   ICacheFlushMode icache_flush_mode) {
   DCHECK(IsCodeTarget(rmode_) || rmode_ == EMBEDDED_OBJECT);
@@ -106,9 +106,8 @@ void RelocInfo::set_target_object(HeapObject* target,
     Assembler::FlushICache(pc_, sizeof(Address));
   }
   if (write_barrier_mode == UPDATE_WRITE_BARRIER && host() != nullptr) {
-    host()->GetHeap()->RecordWriteIntoCode(host(), this, target);
-    host()->GetHeap()->incremental_marking()->RecordWriteIntoCode(host(), this,
-                                                                  target);
+    heap->RecordWriteIntoCode(host(), this, target);
+    heap->incremental_marking()->RecordWriteIntoCode(host(), this, target);
   }
 }
 
@@ -135,21 +134,12 @@ Address RelocInfo::target_internal_reference() {
 
 Address RelocInfo::target_internal_reference_address() {
   DCHECK(rmode_ == INTERNAL_REFERENCE);
-  return reinterpret_cast<Address>(pc_);
-}
-
-void RelocInfo::set_wasm_code_table_entry(Address target,
-                                          ICacheFlushMode icache_flush_mode) {
-  DCHECK(rmode_ == RelocInfo::WASM_CODE_TABLE_ENTRY);
-  Memory::Address_at(pc_) = target;
-  if (icache_flush_mode != SKIP_ICACHE_FLUSH) {
-    Assembler::FlushICache(pc_, sizeof(Address));
-  }
+  return pc_;
 }
 
 Address RelocInfo::target_runtime_entry(Assembler* origin) {
   DCHECK(IsRuntimeEntry(rmode_));
-  return reinterpret_cast<Address>(*reinterpret_cast<int32_t*>(pc_));
+  return static_cast<Address>(*reinterpret_cast<int32_t*>(pc_));
 }
 
 void RelocInfo::set_target_runtime_entry(Address target,
@@ -169,7 +159,7 @@ Address RelocInfo::target_off_heap_target() {
 void RelocInfo::WipeOut() {
   if (IsEmbeddedObject(rmode_) || IsExternalReference(rmode_) ||
       IsInternalReference(rmode_)) {
-    Memory::Address_at(pc_) = nullptr;
+    Memory::Address_at(pc_) = kNullAddress;
   } else if (IsCodeTarget(rmode_) || IsRuntimeEntry(rmode_)) {
     // Effectively write zero into the relocation.
     Assembler::set_target_address_at(pc_, constant_pool_,
@@ -185,7 +175,7 @@ void RelocInfo::Visit(ObjectVisitor* visitor) {
   if (mode == RelocInfo::EMBEDDED_OBJECT) {
     visitor->VisitEmbeddedPointer(host(), this);
     Assembler::FlushICache(pc_, sizeof(Address));
-  } else if (RelocInfo::IsCodeTarget(mode)) {
+  } else if (RelocInfo::IsCodeTargetMode(mode)) {
     visitor->VisitCodeTarget(host(), this);
   } else if (mode == RelocInfo::EXTERNAL_REFERENCE) {
     visitor->VisitExternalReference(host(), this);
@@ -210,8 +200,7 @@ void Assembler::emit_q(uint64_t x) {
 }
 
 void Assembler::emit(Handle<HeapObject> handle) {
-  emit(reinterpret_cast<intptr_t>(handle.address()),
-       RelocInfo::EMBEDDED_OBJECT);
+  emit(handle.address(), RelocInfo::EMBEDDED_OBJECT);
 }
 
 void Assembler::emit(uint32_t x, RelocInfo::Mode rmode) {
@@ -222,7 +211,7 @@ void Assembler::emit(uint32_t x, RelocInfo::Mode rmode) {
 }
 
 void Assembler::emit(Handle<Code> code, RelocInfo::Mode rmode) {
-  emit(reinterpret_cast<intptr_t>(code.address()), rmode);
+  emit(code.address(), rmode);
 }
 
 
@@ -273,10 +262,9 @@ Address Assembler::target_address_at(Address pc, Address constant_pool) {
 void Assembler::set_target_address_at(Address pc, Address constant_pool,
                                       Address target,
                                       ICacheFlushMode icache_flush_mode) {
-  int32_t* p = reinterpret_cast<int32_t*>(pc);
-  *p = target - (pc + sizeof(int32_t));
+  *reinterpret_cast<int32_t*>(pc) = target - (pc + sizeof(int32_t));
   if (icache_flush_mode != SKIP_ICACHE_FLUSH) {
-    Assembler::FlushICache(p, sizeof(int32_t));
+    Assembler::FlushICache(pc, sizeof(int32_t));
   }
 }
 
@@ -287,7 +275,12 @@ Address Assembler::target_address_from_return_address(Address pc) {
 void Assembler::deserialization_set_special_target_at(
     Address instruction_payload, Code* code, Address target) {
   set_target_address_at(instruction_payload,
-                        code ? code->constant_pool() : nullptr, target);
+                        code ? code->constant_pool() : kNullAddress, target);
+}
+
+int Assembler::deserialization_special_target_size(
+    Address instruction_payload) {
+  return kSpecialTargetSize;
 }
 
 Displacement Assembler::disp_at(Label* L) {
diff --git a/deps/v8/src/ia32/assembler-ia32.cc b/deps/v8/src/ia32/assembler-ia32.cc
index 8277b4bd4bde77..0c24125a3b93b0 100644
--- a/deps/v8/src/ia32/assembler-ia32.cc
+++ b/deps/v8/src/ia32/assembler-ia32.cc
@@ -52,6 +52,7 @@
 #include "src/base/cpu.h"
 #include "src/code-stubs.h"
 #include "src/conversions-inl.h"
+#include "src/deoptimizer.h"
 #include "src/disassembler.h"
 #include "src/macro-assembler.h"
 #include "src/v8.h"
@@ -187,8 +188,10 @@ void Displacement::init(Label* L, Type type) {
 // Implementation of RelocInfo
 
 const int RelocInfo::kApplyMask =
-    RelocInfo::kCodeTargetMask | 1 << RelocInfo::RUNTIME_ENTRY |
-    1 << RelocInfo::INTERNAL_REFERENCE | 1 << RelocInfo::JS_TO_WASM_CALL;
+    RelocInfo::ModeMask(RelocInfo::CODE_TARGET) |
+    RelocInfo::ModeMask(RelocInfo::RUNTIME_ENTRY) |
+    RelocInfo::ModeMask(RelocInfo::INTERNAL_REFERENCE) |
+    RelocInfo::ModeMask(RelocInfo::JS_TO_WASM_CALL);
 
 bool RelocInfo::IsCodedSpecially() {
   // The deserializer needs to know whether a pointer is specially coded.  Being
@@ -203,24 +206,9 @@ bool RelocInfo::IsInConstantPool() {
   return false;
 }
 
-Address RelocInfo::embedded_address() const { return Memory::Address_at(pc_); }
-
-uint32_t RelocInfo::embedded_size() const { return Memory::uint32_at(pc_); }
-
-void RelocInfo::set_embedded_address(Address address,
-                                     ICacheFlushMode icache_flush_mode) {
-  Memory::Address_at(pc_) = address;
-  if (icache_flush_mode != SKIP_ICACHE_FLUSH) {
-    Assembler::FlushICache(pc_, sizeof(Address));
-  }
-}
-
-void RelocInfo::set_embedded_size(uint32_t size,
-                                  ICacheFlushMode icache_flush_mode) {
-  Memory::uint32_at(pc_) = size;
-  if (icache_flush_mode != SKIP_ICACHE_FLUSH) {
-    Assembler::FlushICache(pc_, sizeof(uint32_t));
-  }
+int RelocInfo::GetDeoptimizationId(Isolate* isolate, DeoptimizeKind kind) {
+  DCHECK(IsRuntimeEntry(rmode_));
+  return Deoptimizer::GetDeoptimizationId(isolate, target_address(), kind);
 }
 
 void RelocInfo::set_js_to_wasm_address(Address address,
@@ -235,6 +223,11 @@ Address RelocInfo::js_to_wasm_address() const {
   return Assembler::target_address_at(pc_, constant_pool_);
 }
 
+uint32_t RelocInfo::wasm_call_tag() const {
+  DCHECK(rmode_ == WASM_CALL || rmode_ == WASM_STUB_CALL);
+  return Memory::uint32_at(pc_);
+}
+
 // -----------------------------------------------------------------------------
 // Implementation of Operand
 
@@ -310,15 +303,15 @@ void Assembler::AllocateAndInstallRequestedHeapObjects(Isolate* isolate) {
     Handle<HeapObject> object;
     switch (request.kind()) {
       case HeapObjectRequest::kHeapNumber:
-        object = isolate->factory()->NewHeapNumber(request.heap_number(),
-                                                   IMMUTABLE, TENURED);
+        object =
+            isolate->factory()->NewHeapNumber(request.heap_number(), TENURED);
         break;
       case HeapObjectRequest::kCodeStub:
         request.code_stub()->set_isolate(isolate);
         object = request.code_stub()->GetCode();
         break;
     }
-    Address pc = buffer_ + request.offset();
+    Address pc = reinterpret_cast<Address>(buffer_) + request.offset();
     Memory::Object_Handle_at(pc) = object;
   }
 }
@@ -330,8 +323,9 @@ void Assembler::AllocateAndInstallRequestedHeapObjects(Isolate* isolate) {
 #define EMIT(x)                                 \
   *pc_++ = (x)
 
-Assembler::Assembler(IsolateData isolate_data, void* buffer, int buffer_size)
-    : AssemblerBase(isolate_data, buffer, buffer_size) {
+Assembler::Assembler(const AssemblerOptions& options, void* buffer,
+                     int buffer_size)
+    : AssemblerBase(options, buffer, buffer_size) {
 // Clear the buffer in debug mode unless it was provided by the
 // caller in which case we can't be sure it's okay to overwrite
 // existing code in it.
@@ -395,7 +389,7 @@ void Assembler::Align(int m) {
 
 
 bool Assembler::IsNop(Address addr) {
-  Address a = addr;
+  byte* a = reinterpret_cast<byte*>(addr);
   while (*a == 0x66) a++;
   if (*a == 0x90) return true;
   if (a[0] == 0xF && a[1] == 0x1F) return true;
@@ -654,7 +648,7 @@ void Assembler::mov(Operand dst, Address src, RelocInfo::Mode rmode) {
   EnsureSpace ensure_space(this);
   EMIT(0xC7);
   emit_operand(eax, dst);
-  emit(reinterpret_cast<uint32_t>(src), rmode);
+  emit(src, rmode);
 }
 
 void Assembler::mov(Operand dst, Handle<HeapObject> handle) {
@@ -1595,22 +1589,21 @@ void Assembler::call(Label* L) {
   }
 }
 
-
-void Assembler::call(byte* entry, RelocInfo::Mode rmode) {
+void Assembler::call(Address entry, RelocInfo::Mode rmode) {
   EnsureSpace ensure_space(this);
   DCHECK(!RelocInfo::IsCodeTarget(rmode));
   EMIT(0xE8);
   if (RelocInfo::IsRuntimeEntry(rmode)) {
-    emit(reinterpret_cast<uint32_t>(entry), rmode);
+    emit(entry, rmode);
   } else {
-    emit(entry - (pc_ + sizeof(int32_t)), rmode);
+    emit(entry - (reinterpret_cast<Address>(pc_) + sizeof(int32_t)), rmode);
   }
 }
 
 void Assembler::wasm_call(Address entry, RelocInfo::Mode rmode) {
   EnsureSpace ensure_space(this);
   EMIT(0xE8);
-  emit(reinterpret_cast<intptr_t>(entry), rmode);
+  emit(entry, rmode);
 }
 
 int Assembler::CallSize(Operand adr) {
@@ -1642,23 +1635,31 @@ void Assembler::call(CodeStub* stub) {
   emit(Immediate::EmbeddedCode(stub));
 }
 
-void Assembler::jmp(Label* L, Label::Distance distance) {
+void Assembler::jmp_rel(int offset) {
   EnsureSpace ensure_space(this);
+  const int short_size = 2;
+  const int long_size = 5;
+  if (is_int8(offset - short_size)) {
+    // 1110 1011 #8-bit disp.
+    EMIT(0xEB);
+    EMIT((offset - short_size) & 0xFF);
+  } else {
+    // 1110 1001 #32-bit disp.
+    EMIT(0xE9);
+    emit(offset - long_size);
+  }
+}
+
+void Assembler::jmp(Label* L, Label::Distance distance) {
   if (L->is_bound()) {
-    const int short_size = 2;
-    const int long_size  = 5;
-    int offs = L->pos() - pc_offset();
-    DCHECK_LE(offs, 0);
-    if (is_int8(offs - short_size)) {
-      // 1110 1011 #8-bit disp.
-      EMIT(0xEB);
-      EMIT((offs - short_size) & 0xFF);
-    } else {
-      // 1110 1001 #32-bit disp.
-      EMIT(0xE9);
-      emit(offs - long_size);
-    }
-  } else if (distance == Label::kNear) {
+    int offset = L->pos() - pc_offset();
+    DCHECK_LE(offset, 0);  // backward jump.
+    jmp_rel(offset);
+    return;
+  }
+
+  EnsureSpace ensure_space(this);
+  if (distance == Label::kNear) {
     EMIT(0xEB);
     emit_near_disp(L);
   } else {
@@ -1680,14 +1681,14 @@ void Assembler::jmp(Label* L, Label::Distance distance) {
   }
 }
 
-void Assembler::jmp(byte* entry, RelocInfo::Mode rmode) {
+void Assembler::jmp(Address entry, RelocInfo::Mode rmode) {
   EnsureSpace ensure_space(this);
   DCHECK(!RelocInfo::IsCodeTarget(rmode));
   EMIT(0xE9);
   if (RelocInfo::IsRuntimeEntry(rmode)) {
-    emit(reinterpret_cast<uint32_t>(entry), rmode);
+    emit(entry, rmode);
   } else {
-    emit(entry - (pc_ + sizeof(int32_t)), rmode);
+    emit(entry - (reinterpret_cast<Address>(pc_) + sizeof(int32_t)), rmode);
   }
 }
 
@@ -2606,16 +2607,6 @@ void Assembler::extractps(Register dst, XMMRegister src, byte imm8) {
   EMIT(imm8);
 }
 
-void Assembler::ptest(XMMRegister dst, XMMRegister src) {
-  DCHECK(IsEnabled(SSE4_1));
-  EnsureSpace ensure_space(this);
-  EMIT(0x66);
-  EMIT(0x0F);
-  EMIT(0x38);
-  EMIT(0x17);
-  emit_sse_operand(dst, src);
-}
-
 void Assembler::psllw(XMMRegister reg, int8_t shift) {
   EnsureSpace ensure_space(this);
   EMIT(0x66);
@@ -2707,6 +2698,15 @@ void Assembler::psrlq(XMMRegister dst, XMMRegister src) {
   emit_sse_operand(dst, src);
 }
 
+void Assembler::pshufhw(XMMRegister dst, Operand src, uint8_t shuffle) {
+  EnsureSpace ensure_space(this);
+  EMIT(0xF3);
+  EMIT(0x0F);
+  EMIT(0x70);
+  emit_sse_operand(dst, src);
+  EMIT(shuffle);
+}
+
 void Assembler::pshuflw(XMMRegister dst, Operand src, uint8_t shuffle) {
   EnsureSpace ensure_space(this);
   EMIT(0xF2);
@@ -2736,6 +2736,17 @@ void Assembler::pblendw(XMMRegister dst, Operand src, uint8_t mask) {
   EMIT(mask);
 }
 
+void Assembler::palignr(XMMRegister dst, Operand src, uint8_t mask) {
+  DCHECK(IsEnabled(SSSE3));
+  EnsureSpace ensure_space(this);
+  EMIT(0x66);
+  EMIT(0x0F);
+  EMIT(0x3A);
+  EMIT(0x0F);
+  emit_sse_operand(dst, src);
+  EMIT(mask);
+}
+
 void Assembler::pextrb(Operand dst, XMMRegister src, int8_t offset) {
   DCHECK(IsEnabled(SSE4_1));
   EnsureSpace ensure_space(this);
@@ -2960,6 +2971,11 @@ void Assembler::vpsrad(XMMRegister dst, XMMRegister src, int8_t imm8) {
   EMIT(imm8);
 }
 
+void Assembler::vpshufhw(XMMRegister dst, Operand src, uint8_t shuffle) {
+  vinstr(0x70, dst, xmm0, src, kF3, k0F, kWIG);
+  EMIT(shuffle);
+}
+
 void Assembler::vpshuflw(XMMRegister dst, Operand src, uint8_t shuffle) {
   vinstr(0x70, dst, xmm0, src, kF2, k0F, kWIG);
   EMIT(shuffle);
@@ -2976,6 +2992,12 @@ void Assembler::vpblendw(XMMRegister dst, XMMRegister src1, Operand src2,
   EMIT(mask);
 }
 
+void Assembler::vpalignr(XMMRegister dst, XMMRegister src1, Operand src2,
+                         uint8_t mask) {
+  vinstr(0x0F, dst, src1, src2, k66, k0F3A, kWIG);
+  EMIT(mask);
+}
+
 void Assembler::vpextrb(Operand dst, XMMRegister src, int8_t offset) {
   vinstr(0x14, src, xmm0, dst, k66, k0F3A, kWIG);
   EMIT(offset);
@@ -3199,6 +3221,12 @@ void Assembler::GrowBuffer() {
     *p += pc_delta;
   }
 
+  // Relocate js-to-wasm calls (which are encoded pc-relative).
+  for (RelocIterator it(desc, RelocInfo::ModeMask(RelocInfo::JS_TO_WASM_CALL));
+       !it.done(); it.next()) {
+    it.rinfo()->apply(pc_delta);
+  }
+
   DCHECK(!buffer_overflow());
 }
 
@@ -3300,11 +3328,11 @@ void Assembler::dd(Label* label) {
 void Assembler::RecordRelocInfo(RelocInfo::Mode rmode, intptr_t data) {
   DCHECK(!RelocInfo::IsNone(rmode));
   // Don't record external references unless the heap will be serialized.
-  if (rmode == RelocInfo::EXTERNAL_REFERENCE &&
-      !serializer_enabled() && !emit_debug_code()) {
+  if (RelocInfo::IsOnlyForSerializer(rmode) &&
+      !options().record_reloc_info_for_serialization && !emit_debug_code()) {
     return;
   }
-  RelocInfo rinfo(pc_, rmode, data, nullptr);
+  RelocInfo rinfo(reinterpret_cast<Address>(pc_), rmode, data, nullptr);
   reloc_info_writer.Write(&rinfo);
 }
 
diff --git a/deps/v8/src/ia32/assembler-ia32.h b/deps/v8/src/ia32/assembler-ia32.h
index 76594f7bd49ee2..40a981f53f9cf4 100644
--- a/deps/v8/src/ia32/assembler-ia32.h
+++ b/deps/v8/src/ia32/assembler-ia32.h
@@ -40,6 +40,7 @@
 #include <deque>
 
 #include "src/assembler.h"
+#include "src/ia32/constants-ia32.h"
 #include "src/ia32/sse-instr.h"
 #include "src/isolate.h"
 #include "src/utils.h"
@@ -233,6 +234,7 @@ enum RoundingMode {
 
 class Immediate BASE_EMBEDDED {
  public:
+  // Calls where x is an Address (uintptr_t) resolve to this overload.
   inline explicit Immediate(int x, RelocInfo::Mode rmode = RelocInfo::NONE) {
     value_.immediate = x;
     rmode_ = rmode;
@@ -243,9 +245,6 @@ class Immediate BASE_EMBEDDED {
       : Immediate(handle.address(), RelocInfo::EMBEDDED_OBJECT) {}
   inline explicit Immediate(Smi* value)
       : Immediate(reinterpret_cast<intptr_t>(value)) {}
-  inline explicit Immediate(Address addr,
-                            RelocInfo::Mode rmode = RelocInfo::NONE)
-      : Immediate(reinterpret_cast<int32_t>(addr), rmode) {}
 
   static Immediate EmbeddedNumber(double number);  // Smi or HeapNumber.
   static Immediate EmbeddedCode(CodeStub* code);
@@ -325,22 +324,22 @@ enum ScaleFactor {
 class Operand {
  public:
   // reg
-  INLINE(explicit Operand(Register reg)) { set_modrm(3, reg); }
+  V8_INLINE explicit Operand(Register reg) { set_modrm(3, reg); }
 
   // XMM reg
-  INLINE(explicit Operand(XMMRegister xmm_reg)) {
+  V8_INLINE explicit Operand(XMMRegister xmm_reg) {
     Register reg = Register::from_code(xmm_reg.code());
     set_modrm(3, reg);
   }
 
   // [disp/r]
-  INLINE(explicit Operand(int32_t disp, RelocInfo::Mode rmode)) {
+  V8_INLINE explicit Operand(int32_t disp, RelocInfo::Mode rmode) {
     set_modrm(0, ebp);
     set_dispr(disp, rmode);
   }
 
   // [disp/r]
-  INLINE(explicit Operand(Immediate imm)) {
+  V8_INLINE explicit Operand(Immediate imm) {
     set_modrm(0, ebp);
     set_dispr(imm.immediate(), imm.rmode_);
   }
@@ -363,15 +362,13 @@ class Operand {
   }
 
   static Operand StaticVariable(const ExternalReference& ext) {
-    return Operand(reinterpret_cast<int32_t>(ext.address()),
-                   RelocInfo::EXTERNAL_REFERENCE);
+    return Operand(ext.address(), RelocInfo::EXTERNAL_REFERENCE);
   }
 
   static Operand StaticArray(Register index,
                              ScaleFactor scale,
                              const ExternalReference& arr) {
-    return Operand(index, scale, reinterpret_cast<int32_t>(arr.address()),
-                   RelocInfo::EXTERNAL_REFERENCE);
+    return Operand(index, scale, arr.address(), RelocInfo::EXTERNAL_REFERENCE);
   }
 
   static Operand ForRegisterPlusImmediate(Register base, Immediate imm) {
@@ -504,9 +501,7 @@ class Assembler : public AssemblerBase {
   // buffer for code generation and assumes its size to be buffer_size. If the
   // buffer is too small, a fatal error occurs. No deallocation of the buffer is
   // done upon destruction of the assembler.
-  Assembler(Isolate* isolate, void* buffer, int buffer_size)
-      : Assembler(IsolateData(isolate), buffer, buffer_size) {}
-  Assembler(IsolateData isolate_data, void* buffer, int buffer_size);
+  Assembler(const AssemblerOptions& options, void* buffer, int buffer_size);
   virtual ~Assembler() {}
 
   // GetCode emits any pending (non-emitted) code and fills the descriptor
@@ -530,6 +525,10 @@ class Assembler : public AssemblerBase {
   inline static void deserialization_set_special_target_at(
       Address instruction_payload, Code* code, Address target);
 
+  // Get the size of the special target encoded at 'instruction_payload'.
+  inline static int deserialization_special_target_size(
+      Address instruction_payload);
+
   // This sets the internal reference at the pc.
   inline static void deserialization_set_target_internal_reference_at(
       Address pc, Address target,
@@ -850,7 +849,7 @@ class Assembler : public AssemblerBase {
 
   // Calls
   void call(Label* L);
-  void call(byte* entry, RelocInfo::Mode rmode);
+  void call(Address entry, RelocInfo::Mode rmode);
   int CallSize(Operand adr);
   void call(Register reg) { call(Operand(reg)); }
   void call(Operand adr);
@@ -862,10 +861,13 @@ class Assembler : public AssemblerBase {
   // Jumps
   // unconditional jump to L
   void jmp(Label* L, Label::Distance distance = Label::kFar);
-  void jmp(byte* entry, RelocInfo::Mode rmode);
+  void jmp(Address entry, RelocInfo::Mode rmode);
   void jmp(Register reg) { jmp(Operand(reg)); }
   void jmp(Operand adr);
   void jmp(Handle<Code> code, RelocInfo::Mode rmode);
+  // unconditionoal jump relative to the current address. Low-level rountine,
+  // use with caution!
+  void jmp_rel(int offset);
 
   // Conditional jumps
   void j(Condition cc,
@@ -1111,8 +1113,6 @@ class Assembler : public AssemblerBase {
   void movss(XMMRegister dst, XMMRegister src) { movss(dst, Operand(src)); }
   void extractps(Register dst, XMMRegister src, byte imm8);
 
-  void ptest(XMMRegister dst, XMMRegister src);
-
   void psllw(XMMRegister reg, int8_t shift);
   void pslld(XMMRegister reg, int8_t shift);
   void psrlw(XMMRegister reg, int8_t shift);
@@ -1124,6 +1124,10 @@ class Assembler : public AssemblerBase {
   void psrlq(XMMRegister reg, int8_t shift);
   void psrlq(XMMRegister dst, XMMRegister src);
 
+  void pshufhw(XMMRegister dst, XMMRegister src, uint8_t shuffle) {
+    pshufhw(dst, Operand(src), shuffle);
+  }
+  void pshufhw(XMMRegister dst, Operand src, uint8_t shuffle);
   void pshuflw(XMMRegister dst, XMMRegister src, uint8_t shuffle) {
     pshuflw(dst, Operand(src), shuffle);
   }
@@ -1138,6 +1142,11 @@ class Assembler : public AssemblerBase {
   }
   void pblendw(XMMRegister dst, Operand src, uint8_t mask);
 
+  void palignr(XMMRegister dst, XMMRegister src, uint8_t mask) {
+    palignr(dst, Operand(src), mask);
+  }
+  void palignr(XMMRegister dst, Operand src, uint8_t mask);
+
   void pextrb(Register dst, XMMRegister src, int8_t offset) {
     pextrb(Operand(dst), src, offset);
   }
@@ -1437,6 +1446,10 @@ class Assembler : public AssemblerBase {
   void vpsraw(XMMRegister dst, XMMRegister src, int8_t imm8);
   void vpsrad(XMMRegister dst, XMMRegister src, int8_t imm8);
 
+  void vpshufhw(XMMRegister dst, XMMRegister src, uint8_t shuffle) {
+    vpshufhw(dst, Operand(src), shuffle);
+  }
+  void vpshufhw(XMMRegister dst, Operand src, uint8_t shuffle);
   void vpshuflw(XMMRegister dst, XMMRegister src, uint8_t shuffle) {
     vpshuflw(dst, Operand(src), shuffle);
   }
@@ -1452,6 +1465,12 @@ class Assembler : public AssemblerBase {
   }
   void vpblendw(XMMRegister dst, XMMRegister src1, Operand src2, uint8_t mask);
 
+  void vpalignr(XMMRegister dst, XMMRegister src1, XMMRegister src2,
+                uint8_t mask) {
+    vpalignr(dst, src1, Operand(src2), mask);
+  }
+  void vpalignr(XMMRegister dst, XMMRegister src1, Operand src2, uint8_t mask);
+
   void vpextrb(Register dst, XMMRegister src, int8_t offset) {
     vpextrb(Operand(dst), src, offset);
   }
@@ -1679,6 +1698,7 @@ class Assembler : public AssemblerBase {
   }
 
   SSE4_INSTRUCTION_LIST(DECLARE_SSE4_INSTRUCTION)
+  SSE4_RM_INSTRUCTION_LIST(DECLARE_SSE4_INSTRUCTION)
 #undef DECLARE_SSE4_INSTRUCTION
 
 #define DECLARE_SSE34_AVX_INSTRUCTION(instruction, prefix, escape1, escape2,  \
@@ -1694,6 +1714,18 @@ class Assembler : public AssemblerBase {
   SSE4_INSTRUCTION_LIST(DECLARE_SSE34_AVX_INSTRUCTION)
 #undef DECLARE_SSE34_AVX_INSTRUCTION
 
+#define DECLARE_SSE4_AVX_RM_INSTRUCTION(instruction, prefix, escape1, escape2, \
+                                        opcode)                                \
+  void v##instruction(XMMRegister dst, XMMRegister src) {                      \
+    v##instruction(dst, Operand(src));                                         \
+  }                                                                            \
+  void v##instruction(XMMRegister dst, Operand src) {                          \
+    vinstr(0x##opcode, dst, xmm0, src, k##prefix, k##escape1##escape2, kW0);   \
+  }
+
+  SSE4_RM_INSTRUCTION_LIST(DECLARE_SSE4_AVX_RM_INSTRUCTION)
+#undef DECLARE_SSE4_AVX_RM_INSTRUCTION
+
   // Prefetch src position into cache level.
   // Level 1, 2 or 3 specifies CPU cache level. Level 0 specifies a
   // non-temporal
@@ -1836,6 +1868,8 @@ class Assembler : public AssemblerBase {
 
   bool is_optimizable_farjmp(int idx);
 
+  void AllocateAndInstallRequestedHeapObjects(Isolate* isolate);
+
   friend class EnsureSpace;
 
   // Internal reference positions, required for (potential) patching in
@@ -1846,19 +1880,6 @@ class Assembler : public AssemblerBase {
   // code generation
   RelocInfoWriter reloc_info_writer;
 
-  // The following functions help with avoiding allocations of embedded heap
-  // objects during the code assembly phase. {RequestHeapObject} records the
-  // need for a future heap number allocation or code stub generation. After
-  // code assembly, {AllocateAndInstallRequestedHeapObjects} will allocate these
-  // objects and place them where they are expected (determined by the pc offset
-  // associated with each request). That is, for each request, it will patch the
-  // dummy heap object handle that we emitted during code assembly with the
-  // actual heap object handle.
-  void RequestHeapObject(HeapObjectRequest request);
-  void AllocateAndInstallRequestedHeapObjects(Isolate* isolate);
-
-  std::forward_list<HeapObjectRequest> heap_object_requests_;
-
   // Variables for this instance of assembler
   int farjmp_num_ = 0;
   std::deque<int> farjmp_positions_;
diff --git a/deps/v8/src/ia32/code-stubs-ia32.cc b/deps/v8/src/ia32/code-stubs-ia32.cc
index 48ce8ac29e55da..b7a704f359b011 100644
--- a/deps/v8/src/ia32/code-stubs-ia32.cc
+++ b/deps/v8/src/ia32/code-stubs-ia32.cc
@@ -15,6 +15,7 @@
 #include "src/ic/ic.h"
 #include "src/ic/stub-cache.h"
 #include "src/isolate.h"
+#include "src/objects/api-callbacks.h"
 #include "src/regexp/jsregexp.h"
 #include "src/regexp/regexp-macro-assembler.h"
 #include "src/runtime/runtime.h"
@@ -24,403 +25,6 @@ namespace internal {
 
 #define __ ACCESS_MASM(masm)
 
-void ArrayNArgumentsConstructorStub::Generate(MacroAssembler* masm) {
-  __ pop(ecx);
-  __ mov(MemOperand(esp, eax, times_4, 0), edi);
-  __ push(edi);
-  __ push(ebx);
-  __ push(ecx);
-  __ add(eax, Immediate(3));
-  __ TailCallRuntime(Runtime::kNewArray);
-}
-
-
-void DoubleToIStub::Generate(MacroAssembler* masm) {
-  Register final_result_reg = this->destination();
-
-  Label check_negative, process_64_bits, done;
-
-  // Account for return address and saved regs.
-  const int kArgumentOffset = 3 * kPointerSize;
-
-  MemOperand mantissa_operand(MemOperand(esp, kArgumentOffset));
-  MemOperand exponent_operand(
-      MemOperand(esp, kArgumentOffset + kDoubleSize / 2));
-
-  Register scratch1 = no_reg;
-  {
-    Register scratch_candidates[3] = { ebx, edx, edi };
-    for (int i = 0; i < 3; i++) {
-      scratch1 = scratch_candidates[i];
-      if (final_result_reg != scratch1) break;
-    }
-  }
-  // Since we must use ecx for shifts below, use some other register (eax)
-  // to calculate the result if ecx is the requested return register.
-  Register result_reg = final_result_reg == ecx ? eax : final_result_reg;
-  // Save ecx if it isn't the return register and therefore volatile, or if it
-  // is the return register, then save the temp register we use in its stead for
-  // the result.
-  Register save_reg = final_result_reg == ecx ? eax : ecx;
-  __ push(scratch1);
-  __ push(save_reg);
-
-  __ mov(scratch1, mantissa_operand);
-  if (CpuFeatures::IsSupported(SSE3)) {
-    CpuFeatureScope scope(masm, SSE3);
-    // Load x87 register with heap number.
-    __ fld_d(mantissa_operand);
-  }
-  __ mov(ecx, exponent_operand);
-
-  __ and_(ecx, HeapNumber::kExponentMask);
-  __ shr(ecx, HeapNumber::kExponentShift);
-  __ lea(result_reg, MemOperand(ecx, -HeapNumber::kExponentBias));
-  __ cmp(result_reg, Immediate(HeapNumber::kMantissaBits));
-  __ j(below, &process_64_bits);
-
-  // Result is entirely in lower 32-bits of mantissa
-  int delta = HeapNumber::kExponentBias + Double::kPhysicalSignificandSize;
-  if (CpuFeatures::IsSupported(SSE3)) {
-    __ fstp(0);
-  }
-  __ sub(ecx, Immediate(delta));
-  __ xor_(result_reg, result_reg);
-  __ cmp(ecx, Immediate(31));
-  __ j(above, &done);
-  __ shl_cl(scratch1);
-  __ jmp(&check_negative);
-
-  __ bind(&process_64_bits);
-  if (CpuFeatures::IsSupported(SSE3)) {
-    CpuFeatureScope scope(masm, SSE3);
-    // Reserve space for 64 bit answer.
-    __ sub(esp, Immediate(kDoubleSize));  // Nolint.
-    // Do conversion, which cannot fail because we checked the exponent.
-    __ fisttp_d(Operand(esp, 0));
-    __ mov(result_reg, Operand(esp, 0));  // Load low word of answer as result
-    __ add(esp, Immediate(kDoubleSize));
-    __ jmp(&done);
-  } else {
-    // Result must be extracted from shifted 32-bit mantissa
-    __ sub(ecx, Immediate(delta));
-    __ neg(ecx);
-    __ mov(result_reg, exponent_operand);
-    __ and_(result_reg,
-            Immediate(static_cast<uint32_t>(Double::kSignificandMask >> 32)));
-    __ add(result_reg,
-           Immediate(static_cast<uint32_t>(Double::kHiddenBit >> 32)));
-    __ shrd_cl(scratch1, result_reg);
-    __ shr_cl(result_reg);
-    __ test(ecx, Immediate(32));
-    __ cmov(not_equal, scratch1, result_reg);
-  }
-
-  // If the double was negative, negate the integer result.
-  __ bind(&check_negative);
-  __ mov(result_reg, scratch1);
-  __ neg(result_reg);
-  __ cmp(exponent_operand, Immediate(0));
-  __ cmov(greater, result_reg, scratch1);
-
-  // Restore registers
-  __ bind(&done);
-  if (final_result_reg != result_reg) {
-    DCHECK(final_result_reg == ecx);
-    __ mov(final_result_reg, result_reg);
-  }
-  __ pop(save_reg);
-  __ pop(scratch1);
-  __ ret(0);
-}
-
-
-void MathPowStub::Generate(MacroAssembler* masm) {
-  const Register exponent = MathPowTaggedDescriptor::exponent();
-  DCHECK(exponent == eax);
-  const Register scratch = ecx;
-  const XMMRegister double_result = xmm3;
-  const XMMRegister double_base = xmm2;
-  const XMMRegister double_exponent = xmm1;
-  const XMMRegister double_scratch = xmm4;
-
-  Label call_runtime, done, exponent_not_smi, int_exponent;
-
-  // Save 1 in double_result - we need this several times later on.
-  __ mov(scratch, Immediate(1));
-  __ Cvtsi2sd(double_result, scratch);
-
-  Label fast_power, try_arithmetic_simplification;
-  __ DoubleToI(exponent, double_exponent, double_scratch,
-               &try_arithmetic_simplification, &try_arithmetic_simplification);
-  __ jmp(&int_exponent);
-
-  __ bind(&try_arithmetic_simplification);
-  // Skip to runtime if possibly NaN (indicated by the indefinite integer).
-  __ cvttsd2si(exponent, Operand(double_exponent));
-  __ cmp(exponent, Immediate(0x1));
-  __ j(overflow, &call_runtime);
-
-  // Using FPU instructions to calculate power.
-  Label fast_power_failed;
-  __ bind(&fast_power);
-  __ fnclex();  // Clear flags to catch exceptions later.
-  // Transfer (B)ase and (E)xponent onto the FPU register stack.
-  __ sub(esp, Immediate(kDoubleSize));
-  __ movsd(Operand(esp, 0), double_exponent);
-  __ fld_d(Operand(esp, 0));  // E
-  __ movsd(Operand(esp, 0), double_base);
-  __ fld_d(Operand(esp, 0));  // B, E
-
-  // Exponent is in st(1) and base is in st(0)
-  // B ^ E = (2^(E * log2(B)) - 1) + 1 = (2^X - 1) + 1 for X = E * log2(B)
-  // FYL2X calculates st(1) * log2(st(0))
-  __ fyl2x();    // X
-  __ fld(0);     // X, X
-  __ frndint();  // rnd(X), X
-  __ fsub(1);    // rnd(X), X-rnd(X)
-  __ fxch(1);    // X - rnd(X), rnd(X)
-  // F2XM1 calculates 2^st(0) - 1 for -1 < st(0) < 1
-  __ f2xm1();   // 2^(X-rnd(X)) - 1, rnd(X)
-  __ fld1();    // 1, 2^(X-rnd(X)) - 1, rnd(X)
-  __ faddp(1);  // 2^(X-rnd(X)), rnd(X)
-  // FSCALE calculates st(0) * 2^st(1)
-  __ fscale();  // 2^X, rnd(X)
-  __ fstp(1);   // 2^X
-  // Bail out to runtime in case of exceptions in the status word.
-  __ fnstsw_ax();
-  __ test_b(eax, Immediate(0x5F));  // We check for all but precision exception.
-  __ j(not_zero, &fast_power_failed, Label::kNear);
-  __ fstp_d(Operand(esp, 0));
-  __ movsd(double_result, Operand(esp, 0));
-  __ add(esp, Immediate(kDoubleSize));
-  __ jmp(&done);
-
-  __ bind(&fast_power_failed);
-  __ fninit();
-  __ add(esp, Immediate(kDoubleSize));
-  __ jmp(&call_runtime);
-
-  // Calculate power with integer exponent.
-  __ bind(&int_exponent);
-  const XMMRegister double_scratch2 = double_exponent;
-  __ mov(scratch, exponent);  // Back up exponent.
-  __ movsd(double_scratch, double_base);  // Back up base.
-  __ movsd(double_scratch2, double_result);  // Load double_exponent with 1.
-
-  // Get absolute value of exponent.
-  Label no_neg, while_true, while_false;
-  __ test(scratch, scratch);
-  __ j(positive, &no_neg, Label::kNear);
-  __ neg(scratch);
-  __ bind(&no_neg);
-
-  __ j(zero, &while_false, Label::kNear);
-  __ shr(scratch, 1);
-  // Above condition means CF==0 && ZF==0.  This means that the
-  // bit that has been shifted out is 0 and the result is not 0.
-  __ j(above, &while_true, Label::kNear);
-  __ movsd(double_result, double_scratch);
-  __ j(zero, &while_false, Label::kNear);
-
-  __ bind(&while_true);
-  __ shr(scratch, 1);
-  __ mulsd(double_scratch, double_scratch);
-  __ j(above, &while_true, Label::kNear);
-  __ mulsd(double_result, double_scratch);
-  __ j(not_zero, &while_true);
-
-  __ bind(&while_false);
-  // scratch has the original value of the exponent - if the exponent is
-  // negative, return 1/result.
-  __ test(exponent, exponent);
-  __ j(positive, &done);
-  __ divsd(double_scratch2, double_result);
-  __ movsd(double_result, double_scratch2);
-  // Test whether result is zero.  Bail out to check for subnormal result.
-  // Due to subnormals, x^-y == (1/x)^y does not hold in all cases.
-  __ xorps(double_scratch2, double_scratch2);
-  __ ucomisd(double_scratch2, double_result);  // Result cannot be NaN.
-  // double_exponent aliased as double_scratch2 has already been overwritten
-  // and may not have contained the exponent value in the first place when the
-  // exponent is a smi.  We reset it with exponent value before bailing out.
-  __ j(not_equal, &done);
-  __ Cvtsi2sd(double_exponent, exponent);
-
-  // Returning or bailing out.
-  __ bind(&call_runtime);
-  {
-    AllowExternalCallThatCantCauseGC scope(masm);
-    __ PrepareCallCFunction(4, scratch);
-    __ movsd(Operand(esp, 0 * kDoubleSize), double_base);
-    __ movsd(Operand(esp, 1 * kDoubleSize), double_exponent);
-    __ CallCFunction(ExternalReference::power_double_double_function(isolate()),
-                     4);
-  }
-  // Return value is in st(0) on ia32.
-  // Store it into the (fixed) result register.
-  __ sub(esp, Immediate(kDoubleSize));
-  __ fstp_d(Operand(esp, 0));
-  __ movsd(double_result, Operand(esp, 0));
-  __ add(esp, Immediate(kDoubleSize));
-
-  __ bind(&done);
-  __ ret(0);
-}
-
-Movability CEntryStub::NeedsImmovableCode() { return kMovable; }
-
-void CodeStub::GenerateStubsAheadOfTime(Isolate* isolate) {
-  CEntryStub::GenerateAheadOfTime(isolate);
-  // It is important that the store buffer overflow stubs are generated first.
-  CommonArrayConstructorStub::GenerateStubsAheadOfTime(isolate);
-  StoreFastElementStub::GenerateAheadOfTime(isolate);
-}
-
-
-void CodeStub::GenerateFPStubs(Isolate* isolate) {
-  // Generate if not already in cache.
-  CEntryStub(isolate, 1, kSaveFPRegs).GetCode();
-}
-
-
-void CEntryStub::GenerateAheadOfTime(Isolate* isolate) {
-  CEntryStub stub(isolate, 1, kDontSaveFPRegs);
-  stub.GetCode();
-}
-
-
-void CEntryStub::Generate(MacroAssembler* masm) {
-  // eax: number of arguments including receiver
-  // ebx: pointer to C function  (C callee-saved)
-  // ebp: frame pointer  (restored after C call)
-  // esp: stack pointer  (restored after C call)
-  // esi: current context (C callee-saved)
-  // edi: JS function of the caller (C callee-saved)
-  //
-  // If argv_in_register():
-  // ecx: pointer to the first argument
-
-  ProfileEntryHookStub::MaybeCallEntryHook(masm);
-
-  // Reserve space on the stack for the three arguments passed to the call. If
-  // result size is greater than can be returned in registers, also reserve
-  // space for the hidden argument for the result location, and space for the
-  // result itself.
-  int arg_stack_space = 3;
-
-  // Enter the exit frame that transitions from JavaScript to C++.
-  if (argv_in_register()) {
-    DCHECK(!save_doubles());
-    DCHECK(!is_builtin_exit());
-    __ EnterApiExitFrame(arg_stack_space);
-
-    // Move argc and argv into the correct registers.
-    __ mov(esi, ecx);
-    __ mov(edi, eax);
-  } else {
-    __ EnterExitFrame(
-        arg_stack_space, save_doubles(),
-        is_builtin_exit() ? StackFrame::BUILTIN_EXIT : StackFrame::EXIT);
-  }
-
-  // ebx: pointer to C function  (C callee-saved)
-  // ebp: frame pointer  (restored after C call)
-  // esp: stack pointer  (restored after C call)
-  // edi: number of arguments including receiver  (C callee-saved)
-  // esi: pointer to the first argument (C callee-saved)
-
-  // Result returned in eax, or eax+edx if result size is 2.
-
-  // Check stack alignment.
-  if (FLAG_debug_code) {
-    __ CheckStackAlignment();
-  }
-  // Call C function.
-  __ mov(Operand(esp, 0 * kPointerSize), edi);  // argc.
-  __ mov(Operand(esp, 1 * kPointerSize), esi);  // argv.
-  __ mov(Operand(esp, 2 * kPointerSize),
-         Immediate(ExternalReference::isolate_address(isolate())));
-  __ call(ebx);
-
-  // Result is in eax or edx:eax - do not destroy these registers!
-
-  // Check result for exception sentinel.
-  Label exception_returned;
-  __ cmp(eax, isolate()->factory()->exception());
-  __ j(equal, &exception_returned);
-
-  // Check that there is no pending exception, otherwise we
-  // should have returned the exception sentinel.
-  if (FLAG_debug_code) {
-    __ push(edx);
-    __ mov(edx, Immediate(isolate()->factory()->the_hole_value()));
-    Label okay;
-    ExternalReference pending_exception_address(
-        IsolateAddressId::kPendingExceptionAddress, isolate());
-    __ cmp(edx, Operand::StaticVariable(pending_exception_address));
-    // Cannot use check here as it attempts to generate call into runtime.
-    __ j(equal, &okay, Label::kNear);
-    __ int3();
-    __ bind(&okay);
-    __ pop(edx);
-  }
-
-  // Exit the JavaScript to C++ exit frame.
-  __ LeaveExitFrame(save_doubles(), !argv_in_register());
-  __ ret(0);
-
-  // Handling of exception.
-  __ bind(&exception_returned);
-
-  ExternalReference pending_handler_context_address(
-      IsolateAddressId::kPendingHandlerContextAddress, isolate());
-  ExternalReference pending_handler_entrypoint_address(
-      IsolateAddressId::kPendingHandlerEntrypointAddress, isolate());
-  ExternalReference pending_handler_fp_address(
-      IsolateAddressId::kPendingHandlerFPAddress, isolate());
-  ExternalReference pending_handler_sp_address(
-      IsolateAddressId::kPendingHandlerSPAddress, isolate());
-
-  // Ask the runtime for help to determine the handler. This will set eax to
-  // contain the current pending exception, don't clobber it.
-  ExternalReference find_handler(Runtime::kUnwindAndFindExceptionHandler,
-                                 isolate());
-  {
-    FrameScope scope(masm, StackFrame::MANUAL);
-    __ PrepareCallCFunction(3, eax);
-    __ mov(Operand(esp, 0 * kPointerSize), Immediate(0));  // argc.
-    __ mov(Operand(esp, 1 * kPointerSize), Immediate(0));  // argv.
-    __ mov(Operand(esp, 2 * kPointerSize),
-           Immediate(ExternalReference::isolate_address(isolate())));
-    __ CallCFunction(find_handler, 3);
-  }
-
-  // Retrieve the handler context, SP and FP.
-  __ mov(esi, Operand::StaticVariable(pending_handler_context_address));
-  __ mov(esp, Operand::StaticVariable(pending_handler_sp_address));
-  __ mov(ebp, Operand::StaticVariable(pending_handler_fp_address));
-
-  // If the handler is a JS frame, restore the context to the frame. Note that
-  // the context will be set to (esi == 0) for non-JS frames.
-  Label skip;
-  __ test(esi, esi);
-  __ j(zero, &skip, Label::kNear);
-  __ mov(Operand(ebp, StandardFrameConstants::kContextOffset), esi);
-  __ bind(&skip);
-
-  // Reset the masking register. This is done independent of the underlying
-  // feature flag {FLAG_branch_load_poisoning} to make the snapshot work with
-  // both configurations. It is safe to always do this, because the underlying
-  // register is caller-saved and can be arbitrarily clobbered.
-  __ ResetSpeculationPoisonRegister();
-
-  // Compute the handler entry address and jump to it.
-  __ mov(edi, Operand::StaticVariable(pending_handler_entrypoint_address));
-  __ jmp(edi);
-}
-
-
 void JSEntryStub::Generate(MacroAssembler* masm) {
   Label invoke, handler_entry, exit;
   Label not_outermost_js, not_outermost_js_2;
@@ -434,8 +38,8 @@ void JSEntryStub::Generate(MacroAssembler* masm) {
   // Push marker in two places.
   StackFrame::Type marker = type();
   __ push(Immediate(StackFrame::TypeToMarker(marker)));  // marker
-  ExternalReference context_address(IsolateAddressId::kContextAddress,
-                                    isolate());
+  ExternalReference context_address =
+      ExternalReference::Create(IsolateAddressId::kContextAddress, isolate());
   __ push(Operand::StaticVariable(context_address));  // context
   // Save callee-saved registers (C calling conventions).
   __ push(edi);
@@ -443,11 +47,13 @@ void JSEntryStub::Generate(MacroAssembler* masm) {
   __ push(ebx);
 
   // Save copies of the top frame descriptor on the stack.
-  ExternalReference c_entry_fp(IsolateAddressId::kCEntryFPAddress, isolate());
+  ExternalReference c_entry_fp =
+      ExternalReference::Create(IsolateAddressId::kCEntryFPAddress, isolate());
   __ push(Operand::StaticVariable(c_entry_fp));
 
   // If this is the outermost JS call, set js_entry_sp value.
-  ExternalReference js_entry_sp(IsolateAddressId::kJSEntrySPAddress, isolate());
+  ExternalReference js_entry_sp =
+      ExternalReference::Create(IsolateAddressId::kJSEntrySPAddress, isolate());
   __ cmp(Operand::StaticVariable(js_entry_sp), Immediate(0));
   __ j(not_equal, &not_outermost_js, Label::kNear);
   __ mov(Operand::StaticVariable(js_entry_sp), ebp);
@@ -463,7 +69,7 @@ void JSEntryStub::Generate(MacroAssembler* masm) {
   handler_offset_ = handler_entry.pos();
   // Caught exception: Store result (exception) in the pending exception
   // field in the JSEnv and return a failure sentinel.
-  ExternalReference pending_exception(
+  ExternalReference pending_exception = ExternalReference::Create(
       IsolateAddressId::kPendingExceptionAddress, isolate());
   __ mov(Operand::StaticVariable(pending_exception), eax);
   __ mov(eax, Immediate(isolate()->factory()->exception()));
@@ -491,8 +97,8 @@ void JSEntryStub::Generate(MacroAssembler* masm) {
   __ bind(&not_outermost_js_2);
 
   // Restore the top frame descriptor from the stack.
-  __ pop(Operand::StaticVariable(
-      ExternalReference(IsolateAddressId::kCEntryFPAddress, isolate())));
+  __ pop(Operand::StaticVariable(ExternalReference::Create(
+      IsolateAddressId::kCEntryFPAddress, isolate())));
 
   // Restore callee-saved registers (C calling conventions).
   __ pop(ebx);
@@ -551,303 +157,6 @@ void ProfileEntryHookStub::Generate(MacroAssembler* masm) {
   __ ret(0);
 }
 
-
-template<class T>
-static void CreateArrayDispatch(MacroAssembler* masm,
-                                AllocationSiteOverrideMode mode) {
-  if (mode == DISABLE_ALLOCATION_SITES) {
-    T stub(masm->isolate(),
-           GetInitialFastElementsKind(),
-           mode);
-    __ TailCallStub(&stub);
-  } else if (mode == DONT_OVERRIDE) {
-    int last_index =
-        GetSequenceIndexFromFastElementsKind(TERMINAL_FAST_ELEMENTS_KIND);
-    for (int i = 0; i <= last_index; ++i) {
-      Label next;
-      ElementsKind kind = GetFastElementsKindFromSequenceIndex(i);
-      __ cmp(edx, kind);
-      __ j(not_equal, &next);
-      T stub(masm->isolate(), kind);
-      __ TailCallStub(&stub);
-      __ bind(&next);
-    }
-
-    // If we reached this point there is a problem.
-    __ Abort(AbortReason::kUnexpectedElementsKindInArrayConstructor);
-  } else {
-    UNREACHABLE();
-  }
-}
-
-
-static void CreateArrayDispatchOneArgument(MacroAssembler* masm,
-                                           AllocationSiteOverrideMode mode) {
-  // ebx - allocation site (if mode != DISABLE_ALLOCATION_SITES)
-  // edx - kind (if mode != DISABLE_ALLOCATION_SITES)
-  // eax - number of arguments
-  // edi - constructor?
-  // esp[0] - return address
-  // esp[4] - last argument
-  STATIC_ASSERT(PACKED_SMI_ELEMENTS == 0);
-  STATIC_ASSERT(HOLEY_SMI_ELEMENTS == 1);
-  STATIC_ASSERT(PACKED_ELEMENTS == 2);
-  STATIC_ASSERT(HOLEY_ELEMENTS == 3);
-  STATIC_ASSERT(PACKED_DOUBLE_ELEMENTS == 4);
-  STATIC_ASSERT(HOLEY_DOUBLE_ELEMENTS == 5);
-
-  if (mode == DISABLE_ALLOCATION_SITES) {
-    ElementsKind initial = GetInitialFastElementsKind();
-    ElementsKind holey_initial = GetHoleyElementsKind(initial);
-
-    ArraySingleArgumentConstructorStub stub_holey(masm->isolate(),
-                                                  holey_initial,
-                                                  DISABLE_ALLOCATION_SITES);
-    __ TailCallStub(&stub_holey);
-  } else if (mode == DONT_OVERRIDE) {
-    // is the low bit set? If so, we are holey and that is good.
-    Label normal_sequence;
-    __ test_b(edx, Immediate(1));
-    __ j(not_zero, &normal_sequence);
-
-    // We are going to create a holey array, but our kind is non-holey.
-    // Fix kind and retry.
-    __ inc(edx);
-
-    if (FLAG_debug_code) {
-      Handle<Map> allocation_site_map =
-          masm->isolate()->factory()->allocation_site_map();
-      __ cmp(FieldOperand(ebx, 0), Immediate(allocation_site_map));
-      __ Assert(equal, AbortReason::kExpectedAllocationSite);
-    }
-
-    // Save the resulting elements kind in type info. We can't just store r3
-    // in the AllocationSite::transition_info field because elements kind is
-    // restricted to a portion of the field...upper bits need to be left alone.
-    STATIC_ASSERT(AllocationSite::ElementsKindBits::kShift == 0);
-    __ add(
-        FieldOperand(ebx, AllocationSite::kTransitionInfoOrBoilerplateOffset),
-        Immediate(Smi::FromInt(kFastElementsKindPackedToHoley)));
-
-    __ bind(&normal_sequence);
-    int last_index =
-        GetSequenceIndexFromFastElementsKind(TERMINAL_FAST_ELEMENTS_KIND);
-    for (int i = 0; i <= last_index; ++i) {
-      Label next;
-      ElementsKind kind = GetFastElementsKindFromSequenceIndex(i);
-      __ cmp(edx, kind);
-      __ j(not_equal, &next);
-      ArraySingleArgumentConstructorStub stub(masm->isolate(), kind);
-      __ TailCallStub(&stub);
-      __ bind(&next);
-    }
-
-    // If we reached this point there is a problem.
-    __ Abort(AbortReason::kUnexpectedElementsKindInArrayConstructor);
-  } else {
-    UNREACHABLE();
-  }
-}
-
-
-template<class T>
-static void ArrayConstructorStubAheadOfTimeHelper(Isolate* isolate) {
-  int to_index =
-      GetSequenceIndexFromFastElementsKind(TERMINAL_FAST_ELEMENTS_KIND);
-  for (int i = 0; i <= to_index; ++i) {
-    ElementsKind kind = GetFastElementsKindFromSequenceIndex(i);
-    T stub(isolate, kind);
-    stub.GetCode();
-    if (AllocationSite::ShouldTrack(kind)) {
-      T stub1(isolate, kind, DISABLE_ALLOCATION_SITES);
-      stub1.GetCode();
-    }
-  }
-}
-
-void CommonArrayConstructorStub::GenerateStubsAheadOfTime(Isolate* isolate) {
-  ArrayConstructorStubAheadOfTimeHelper<ArrayNoArgumentConstructorStub>(
-      isolate);
-  ArrayConstructorStubAheadOfTimeHelper<ArraySingleArgumentConstructorStub>(
-      isolate);
-  ArrayNArgumentsConstructorStub stub(isolate);
-  stub.GetCode();
-
-  ElementsKind kinds[2] = {PACKED_ELEMENTS, HOLEY_ELEMENTS};
-  for (int i = 0; i < 2; i++) {
-    // For internal arrays we only need a few things
-    InternalArrayNoArgumentConstructorStub stubh1(isolate, kinds[i]);
-    stubh1.GetCode();
-    InternalArraySingleArgumentConstructorStub stubh2(isolate, kinds[i]);
-    stubh2.GetCode();
-  }
-}
-
-void ArrayConstructorStub::GenerateDispatchToArrayStub(
-    MacroAssembler* masm, AllocationSiteOverrideMode mode) {
-  Label not_zero_case, not_one_case;
-  __ test(eax, eax);
-  __ j(not_zero, &not_zero_case);
-  CreateArrayDispatch<ArrayNoArgumentConstructorStub>(masm, mode);
-
-  __ bind(&not_zero_case);
-  __ cmp(eax, 1);
-  __ j(greater, &not_one_case);
-  CreateArrayDispatchOneArgument(masm, mode);
-
-  __ bind(&not_one_case);
-  ArrayNArgumentsConstructorStub stub(masm->isolate());
-  __ TailCallStub(&stub);
-}
-
-void ArrayConstructorStub::Generate(MacroAssembler* masm) {
-  // ----------- S t a t e -------------
-  //  -- eax : argc (only if argument_count() is ANY or MORE_THAN_ONE)
-  //  -- ebx : AllocationSite or undefined
-  //  -- edi : constructor
-  //  -- edx : Original constructor
-  //  -- esp[0] : return address
-  //  -- esp[4] : last argument
-  // -----------------------------------
-  if (FLAG_debug_code) {
-    // The array construct code is only set for the global and natives
-    // builtin Array functions which always have maps.
-
-    // Initial map for the builtin Array function should be a map.
-    __ mov(ecx, FieldOperand(edi, JSFunction::kPrototypeOrInitialMapOffset));
-    // Will both indicate a nullptr and a Smi.
-    __ test(ecx, Immediate(kSmiTagMask));
-    __ Assert(not_zero, AbortReason::kUnexpectedInitialMapForArrayFunction);
-    __ CmpObjectType(ecx, MAP_TYPE, ecx);
-    __ Assert(equal, AbortReason::kUnexpectedInitialMapForArrayFunction);
-
-    // We should either have undefined in ebx or a valid AllocationSite
-    __ AssertUndefinedOrAllocationSite(ebx);
-  }
-
-  Label subclassing;
-
-  // Enter the context of the Array function.
-  __ mov(esi, FieldOperand(edi, JSFunction::kContextOffset));
-
-  __ cmp(edx, edi);
-  __ j(not_equal, &subclassing);
-
-  Label no_info;
-  // If the feedback vector is the undefined value call an array constructor
-  // that doesn't use AllocationSites.
-  __ cmp(ebx, isolate()->factory()->undefined_value());
-  __ j(equal, &no_info);
-
-  // Only look at the lower 16 bits of the transition info.
-  __ mov(edx,
-         FieldOperand(ebx, AllocationSite::kTransitionInfoOrBoilerplateOffset));
-  __ SmiUntag(edx);
-  STATIC_ASSERT(AllocationSite::ElementsKindBits::kShift == 0);
-  __ and_(edx, Immediate(AllocationSite::ElementsKindBits::kMask));
-  GenerateDispatchToArrayStub(masm, DONT_OVERRIDE);
-
-  __ bind(&no_info);
-  GenerateDispatchToArrayStub(masm, DISABLE_ALLOCATION_SITES);
-
-  // Subclassing.
-  __ bind(&subclassing);
-  __ mov(Operand(esp, eax, times_pointer_size, kPointerSize), edi);
-  __ add(eax, Immediate(3));
-  __ PopReturnAddressTo(ecx);
-  __ Push(edx);
-  __ Push(ebx);
-  __ PushReturnAddressFrom(ecx);
-  __ JumpToExternalReference(ExternalReference(Runtime::kNewArray, isolate()));
-}
-
-
-void InternalArrayConstructorStub::GenerateCase(
-    MacroAssembler* masm, ElementsKind kind) {
-  Label not_zero_case, not_one_case;
-  Label normal_sequence;
-
-  __ test(eax, eax);
-  __ j(not_zero, &not_zero_case);
-  InternalArrayNoArgumentConstructorStub stub0(isolate(), kind);
-  __ TailCallStub(&stub0);
-
-  __ bind(&not_zero_case);
-  __ cmp(eax, 1);
-  __ j(greater, &not_one_case);
-
-  if (IsFastPackedElementsKind(kind)) {
-    // We might need to create a holey array
-    // look at the first argument
-    __ mov(ecx, Operand(esp, kPointerSize));
-    __ test(ecx, ecx);
-    __ j(zero, &normal_sequence);
-
-    InternalArraySingleArgumentConstructorStub
-        stub1_holey(isolate(), GetHoleyElementsKind(kind));
-    __ TailCallStub(&stub1_holey);
-  }
-
-  __ bind(&normal_sequence);
-  InternalArraySingleArgumentConstructorStub stub1(isolate(), kind);
-  __ TailCallStub(&stub1);
-
-  __ bind(&not_one_case);
-  ArrayNArgumentsConstructorStub stubN(isolate());
-  __ TailCallStub(&stubN);
-}
-
-
-void InternalArrayConstructorStub::Generate(MacroAssembler* masm) {
-  // ----------- S t a t e -------------
-  //  -- eax : argc
-  //  -- edi : constructor
-  //  -- esp[0] : return address
-  //  -- esp[4] : last argument
-  // -----------------------------------
-
-  if (FLAG_debug_code) {
-    // The array construct code is only set for the global and natives
-    // builtin Array functions which always have maps.
-
-    // Initial map for the builtin Array function should be a map.
-    __ mov(ecx, FieldOperand(edi, JSFunction::kPrototypeOrInitialMapOffset));
-    // Will both indicate a nullptr and a Smi.
-    __ test(ecx, Immediate(kSmiTagMask));
-    __ Assert(not_zero, AbortReason::kUnexpectedInitialMapForArrayFunction);
-    __ CmpObjectType(ecx, MAP_TYPE, ecx);
-    __ Assert(equal, AbortReason::kUnexpectedInitialMapForArrayFunction);
-  }
-
-  // Figure out the right elements kind
-  __ mov(ecx, FieldOperand(edi, JSFunction::kPrototypeOrInitialMapOffset));
-
-  // Load the map's "bit field 2" into |result|. We only need the first byte,
-  // but the following masking takes care of that anyway.
-  __ mov(ecx, FieldOperand(ecx, Map::kBitField2Offset));
-  // Retrieve elements_kind from bit field 2.
-  __ DecodeField<Map::ElementsKindBits>(ecx);
-
-  if (FLAG_debug_code) {
-    Label done;
-    __ cmp(ecx, Immediate(PACKED_ELEMENTS));
-    __ j(equal, &done);
-    __ cmp(ecx, Immediate(HOLEY_ELEMENTS));
-    __ Assert(
-        equal,
-        AbortReason::kInvalidElementsKindForInternalArrayOrInternalPackedArray);
-    __ bind(&done);
-  }
-
-  Label fast_elements_case;
-  __ cmp(ecx, Immediate(PACKED_ELEMENTS));
-  __ j(equal, &fast_elements_case);
-  GenerateCase(masm, HOLEY_ELEMENTS);
-
-  __ bind(&fast_elements_case);
-  GenerateCase(masm, PACKED_ELEMENTS);
-}
-
 // Generates an Operand for saving parameters after PrepareCallApiFunction.
 static Operand ApiParameterOperand(int index) {
   return Operand(esp, index * kPointerSize);
@@ -898,8 +207,7 @@ static void CallApiFunctionAndReturn(MacroAssembler* masm,
     __ PrepareCallCFunction(1, eax);
     __ mov(Operand(esp, 0),
            Immediate(ExternalReference::isolate_address(isolate)));
-    __ CallCFunction(ExternalReference::log_enter_external_function(isolate),
-                     1);
+    __ CallCFunction(ExternalReference::log_enter_external_function(), 1);
     __ PopSafepointRegisters();
   }
 
@@ -928,8 +236,7 @@ static void CallApiFunctionAndReturn(MacroAssembler* masm,
     __ PrepareCallCFunction(1, eax);
     __ mov(Operand(esp, 0),
            Immediate(ExternalReference::isolate_address(isolate)));
-    __ CallCFunction(ExternalReference::log_leave_external_function(isolate),
-                     1);
+    __ CallCFunction(ExternalReference::log_leave_external_function(), 1);
     __ PopSafepointRegisters();
   }
 
@@ -1014,7 +321,7 @@ static void CallApiFunctionAndReturn(MacroAssembler* masm,
 
   // HandleScope limit has changed. Delete allocated extensions.
   ExternalReference delete_extensions =
-      ExternalReference::delete_handle_scope_extensions(isolate);
+      ExternalReference::delete_handle_scope_extensions();
   __ bind(&delete_allocated_handles);
   __ mov(Operand::StaticVariable(limit_address), edi);
   __ mov(edi, eax);
@@ -1103,8 +410,7 @@ void CallApiCallbackStub::Generate(MacroAssembler* masm) {
   __ lea(scratch, ApiParameterOperand(2));
   __ mov(ApiParameterOperand(0), scratch);
 
-  ExternalReference thunk_ref =
-      ExternalReference::invoke_function_callback(masm->isolate());
+  ExternalReference thunk_ref = ExternalReference::invoke_function_callback();
 
   // Stores return the first js argument
   int return_value_offset = 2 + FCA::kReturnValueOffset;
@@ -1174,7 +480,7 @@ void CallApiGetterStub::Generate(MacroAssembler* masm) {
   Operand thunk_last_arg = ApiParameterOperand(2);
 
   ExternalReference thunk_ref =
-      ExternalReference::invoke_accessor_getter_callback(isolate());
+      ExternalReference::invoke_accessor_getter_callback();
 
   __ mov(scratch, FieldOperand(callback, AccessorInfo::kJsGetterOffset));
   Register function_address = edx;
diff --git a/deps/v8/src/ia32/constants-ia32.h b/deps/v8/src/ia32/constants-ia32.h
new file mode 100644
index 00000000000000..38ad1280f121e2
--- /dev/null
+++ b/deps/v8/src/ia32/constants-ia32.h
@@ -0,0 +1,23 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef V8_IA32_CONSTANTS_IA32_H_
+#define V8_IA32_CONSTANTS_IA32_H_
+
+#include "src/globals.h"
+
+namespace v8 {
+namespace internal {
+// Actual value of root register is offset from the root array's start
+// to take advantage of negative displacement values.
+// For x86, this value is provided for uniformity with other platforms, although
+// currently no root register is present.
+constexpr int kRootRegisterBias = 0;
+
+// TODO(sigurds): Change this value once we use relative jumps.
+constexpr size_t kMaxPCRelativeCodeRangeInMB = 0;
+}  // namespace internal
+}  // namespace v8
+
+#endif  // V8_IA32_CONSTANTS_IA32_H_
diff --git a/deps/v8/src/ia32/deoptimizer-ia32.cc b/deps/v8/src/ia32/deoptimizer-ia32.cc
index b072784441590e..259ad6a508eb67 100644
--- a/deps/v8/src/ia32/deoptimizer-ia32.cc
+++ b/deps/v8/src/ia32/deoptimizer-ia32.cc
@@ -45,8 +45,8 @@ void Deoptimizer::TableEntryGenerator::Generate() {
 
   __ pushad();
 
-  ExternalReference c_entry_fp_address(IsolateAddressId::kCEntryFPAddress,
-                                       isolate());
+  ExternalReference c_entry_fp_address =
+      ExternalReference::Create(IsolateAddressId::kCEntryFPAddress, isolate());
   __ mov(Operand::StaticVariable(c_entry_fp_address), ebp);
 
   const int kSavedRegistersAreaSize =
@@ -72,7 +72,8 @@ void Deoptimizer::TableEntryGenerator::Generate() {
   __ mov(eax, Operand(ebp, JavaScriptFrameConstants::kFunctionOffset));
   __ bind(&context_check);
   __ mov(Operand(esp, 0 * kPointerSize), eax);  // Function.
-  __ mov(Operand(esp, 1 * kPointerSize), Immediate(type()));  // Bailout type.
+  __ mov(Operand(esp, 1 * kPointerSize),
+         Immediate(static_cast<int>(deopt_kind())));
   __ mov(Operand(esp, 2 * kPointerSize), ebx);  // Bailout id.
   __ mov(Operand(esp, 3 * kPointerSize), ecx);  // Code address or 0.
   __ mov(Operand(esp, 4 * kPointerSize), edx);  // Fp-to-sp delta.
@@ -80,7 +81,7 @@ void Deoptimizer::TableEntryGenerator::Generate() {
          Immediate(ExternalReference::isolate_address(isolate())));
   {
     AllowExternalCallThatCantCauseGC scope(masm());
-    __ CallCFunction(ExternalReference::new_deoptimizer_function(isolate()), 6);
+    __ CallCFunction(ExternalReference::new_deoptimizer_function(), 6);
   }
 
   // Preserve deoptimizer object in register eax and get the input
@@ -143,8 +144,7 @@ void Deoptimizer::TableEntryGenerator::Generate() {
   __ mov(Operand(esp, 0 * kPointerSize), eax);
   {
     AllowExternalCallThatCantCauseGC scope(masm());
-    __ CallCFunction(
-        ExternalReference::compute_output_frames_function(isolate()), 1);
+    __ CallCFunction(ExternalReference::compute_output_frames_function(), 1);
   }
   __ pop(eax);
 
diff --git a/deps/v8/src/ia32/disasm-ia32.cc b/deps/v8/src/ia32/disasm-ia32.cc
index 5f07f0803d1b11..42f699bf82adf8 100644
--- a/deps/v8/src/ia32/disasm-ia32.cc
+++ b/deps/v8/src/ia32/disasm-ia32.cc
@@ -812,6 +812,16 @@ int DisassemblerIA32::AVXInstruction(byte* data) {
         SSSE3_INSTRUCTION_LIST(DECLARE_SSE_AVX_DIS_CASE)
         SSE4_INSTRUCTION_LIST(DECLARE_SSE_AVX_DIS_CASE)
 #undef DECLARE_SSE_AVX_DIS_CASE
+#define DECLARE_SSE_AVX_RM_DIS_CASE(instruction, notUsed1, notUsed2, notUsed3, \
+                                    opcode)                                    \
+  case 0x##opcode: {                                                           \
+    AppendToBuffer("v" #instruction " %s,", NameOfXMMRegister(regop));         \
+    current += PrintRightXMMOperand(current);                                  \
+    break;                                                                     \
+  }
+
+        SSE4_RM_INSTRUCTION_LIST(DECLARE_SSE_AVX_RM_DIS_CASE)
+#undef DECLARE_SSE_AVX_RM_DIS_CASE
       default:
         UnimplementedInstruction();
     }
@@ -826,6 +836,13 @@ int DisassemblerIA32::AVXInstruction(byte* data) {
         AppendToBuffer(",%d", *reinterpret_cast<uint8_t*>(current));
         current++;
         break;
+      case 0x0F:
+        AppendToBuffer("vpalignr %s,%s,", NameOfXMMRegister(regop),
+                       NameOfXMMRegister(vvvv));
+        current += PrintRightXMMOperand(current);
+        AppendToBuffer(",%d", *reinterpret_cast<uint8_t*>(current));
+        current++;
+        break;
       case 0x14:
         AppendToBuffer("vpextrb ");
         current += PrintRightOperand(current);
@@ -971,6 +988,12 @@ int DisassemblerIA32::AVXInstruction(byte* data) {
         AppendToBuffer("vmovdqu %s,", NameOfXMMRegister(regop));
         current += PrintRightOperand(current);
         break;
+      case 0x70:
+        AppendToBuffer("vpshufhw %s,", NameOfXMMRegister(regop));
+        current += PrintRightXMMOperand(current);
+        AppendToBuffer(",%d", *reinterpret_cast<int8_t*>(current));
+        current++;
+        break;
       case 0x7f:
         AppendToBuffer("vmovdqu ");
         current += PrintRightOperand(current);
@@ -1930,11 +1953,6 @@ int DisassemblerIA32::InstructionDecode(v8::internal::Vector<char> out_buffer,
             int mod, regop, rm;
             get_modrm(*data, &mod, &regop, &rm);
             switch (op) {
-              case 0x17:
-                AppendToBuffer("ptest %s,%s", NameOfXMMRegister(regop),
-                               NameOfXMMRegister(rm));
-                data++;
-                break;
 #define SSE34_DIS_CASE(instruction, notUsed1, notUsed2, notUsed3, opcode) \
   case 0x##opcode: {                                                      \
     AppendToBuffer(#instruction " %s,", NameOfXMMRegister(regop));        \
@@ -1944,6 +1962,7 @@ int DisassemblerIA32::InstructionDecode(v8::internal::Vector<char> out_buffer,
 
                 SSSE3_INSTRUCTION_LIST(SSE34_DIS_CASE)
                 SSE4_INSTRUCTION_LIST(SSE34_DIS_CASE)
+                SSE4_RM_INSTRUCTION_LIST(SSE34_DIS_CASE)
 #undef SSE34_DIS_CASE
               default:
                 UnimplementedInstruction();
@@ -1976,6 +1995,14 @@ int DisassemblerIA32::InstructionDecode(v8::internal::Vector<char> out_buffer,
               data += PrintRightXMMOperand(data);
               AppendToBuffer(",%d", *reinterpret_cast<uint8_t*>(data));
               data++;
+            } else if (*data == 0x0F) {
+              data++;
+              int mod, regop, rm;
+              get_modrm(*data, &mod, &regop, &rm);
+              AppendToBuffer("palignr %s,", NameOfXMMRegister(regop));
+              data += PrintRightXMMOperand(data);
+              AppendToBuffer(",%d", *reinterpret_cast<uint8_t*>(data));
+              data++;
             } else if (*data == 0x14) {
               data++;
               int mod, regop, rm;
@@ -2394,6 +2421,14 @@ int DisassemblerIA32::InstructionDecode(v8::internal::Vector<char> out_buffer,
             get_modrm(*data, &mod, &regop, &rm);
             AppendToBuffer("movdqu %s,", NameOfXMMRegister(regop));
             data += PrintRightXMMOperand(data);
+          } else if (b2 == 0x70) {
+            data += 3;
+            int mod, regop, rm;
+            get_modrm(*data, &mod, &regop, &rm);
+            AppendToBuffer("pshufhw %s,", NameOfXMMRegister(regop));
+            data += PrintRightXMMOperand(data);
+            AppendToBuffer(",%d", *reinterpret_cast<int8_t*>(data));
+            data++;
           } else if (b2 == 0x7F) {
             AppendToBuffer("movdqu ");
             data += 3;
@@ -2484,6 +2519,9 @@ int DisassemblerIA32::InstructionDecode(v8::internal::Vector<char> out_buffer,
         } else if (*(data+1) == 0xAB) {
           data += 2;
           AppendToBuffer("rep_stos");
+        } else if (*(data + 1) == 0x90) {
+          data += 2;
+          AppendToBuffer("pause");
         } else {
           UnimplementedInstruction();
         }
diff --git a/deps/v8/src/ia32/frame-constants-ia32.h b/deps/v8/src/ia32/frame-constants-ia32.h
index f0c1dc835ffa63..5683fdd9e3361d 100644
--- a/deps/v8/src/ia32/frame-constants-ia32.h
+++ b/deps/v8/src/ia32/frame-constants-ia32.h
@@ -5,6 +5,9 @@
 #ifndef V8_IA32_FRAME_CONSTANTS_IA32_H_
 #define V8_IA32_FRAME_CONSTANTS_IA32_H_
 
+#include "src/base/macros.h"
+#include "src/frame-constants.h"
+
 namespace v8 {
 namespace internal {
 
@@ -35,6 +38,19 @@ class ExitFrameConstants : public TypedFrameConstants {
   static constexpr int kConstantPoolOffset = 0;  // Not used
 };
 
+class WasmCompileLazyFrameConstants : public TypedFrameConstants {
+ public:
+  static constexpr int kNumberOfSavedGpParamRegs = 5;
+  static constexpr int kNumberOfSavedFpParamRegs = 6;
+
+  // FP-relative.
+  static constexpr int kWasmInstanceOffset = TYPED_FRAME_PUSHED_VALUE_OFFSET(0);
+  static constexpr int kFixedFrameSizeFromFp =
+      TypedFrameConstants::kFixedFrameSizeFromFp +
+      kNumberOfSavedGpParamRegs * kPointerSize +
+      kNumberOfSavedFpParamRegs * kSimd128Size;
+};
+
 class JavaScriptFrameConstants : public AllStatic {
  public:
   // FP-relative.
diff --git a/deps/v8/src/ia32/interface-descriptors-ia32.cc b/deps/v8/src/ia32/interface-descriptors-ia32.cc
index a4c6894ae8a2c5..c2300876185110 100644
--- a/deps/v8/src/ia32/interface-descriptors-ia32.cc
+++ b/deps/v8/src/ia32/interface-descriptors-ia32.cc
@@ -33,7 +33,7 @@ void RecordWriteDescriptor::InitializePlatformSpecific(
   data->InitializePlatformSpecific(kParameterCount, default_stub_registers);
 }
 
-const Register FastNewFunctionContextDescriptor::FunctionRegister() {
+const Register FastNewFunctionContextDescriptor::ScopeInfoRegister() {
   return edi;
 }
 const Register FastNewFunctionContextDescriptor::SlotsRegister() { return eax; }
@@ -58,13 +58,6 @@ const Register StoreTransitionDescriptor::MapRegister() { return edi; }
 const Register ApiGetterDescriptor::HolderRegister() { return ecx; }
 const Register ApiGetterDescriptor::CallbackRegister() { return eax; }
 
-const Register MathPowTaggedDescriptor::exponent() { return eax; }
-
-const Register MathPowIntegerDescriptor::exponent() {
-  return MathPowTaggedDescriptor::exponent();
-}
-
-
 const Register GrowArrayElementsDescriptor::ObjectRegister() { return eax; }
 const Register GrowArrayElementsDescriptor::KeyRegister() { return ebx; }
 
@@ -75,13 +68,13 @@ const Register TypeConversionDescriptor::ArgumentRegister() { return eax; }
 void TypeofDescriptor::InitializePlatformSpecific(
     CallInterfaceDescriptorData* data) {
   Register registers[] = {ebx};
-  data->InitializePlatformSpecific(arraysize(registers), registers, nullptr);
+  data->InitializePlatformSpecific(arraysize(registers), registers);
 }
 
 void CallFunctionDescriptor::InitializePlatformSpecific(
     CallInterfaceDescriptorData* data) {
   Register registers[] = {edi};
-  data->InitializePlatformSpecific(arraysize(registers), registers, nullptr);
+  data->InitializePlatformSpecific(arraysize(registers), registers);
 }
 
 void CallTrampolineDescriptor::InitializePlatformSpecific(
@@ -178,24 +171,7 @@ void ConstructStubDescriptor::InitializePlatformSpecific(
   data->InitializePlatformSpecific(arraysize(registers), registers);
 }
 
-
-void ConstructTrampolineDescriptor::InitializePlatformSpecific(
-    CallInterfaceDescriptorData* data) {
-  // eax : number of arguments
-  // edx : the new target
-  // edi : the target to call
-  Register registers[] = {edi, edx, eax};
-  data->InitializePlatformSpecific(arraysize(registers), registers);
-}
-
-
-void TransitionElementsKindDescriptor::InitializePlatformSpecific(
-    CallInterfaceDescriptorData* data) {
-  Register registers[] = {eax, ebx};
-  data->InitializePlatformSpecific(arraysize(registers), registers, nullptr);
-}
-
-void AbortJSDescriptor::InitializePlatformSpecific(
+void AbortDescriptor::InitializePlatformSpecific(
     CallInterfaceDescriptorData* data) {
   Register registers[] = {edx};
   data->InitializePlatformSpecific(arraysize(registers), registers);
@@ -204,63 +180,19 @@ void AbortJSDescriptor::InitializePlatformSpecific(
 void AllocateHeapNumberDescriptor::InitializePlatformSpecific(
     CallInterfaceDescriptorData* data) {
   // register state
-  data->InitializePlatformSpecific(0, nullptr, nullptr);
-}
-
-void ArrayConstructorDescriptor::InitializePlatformSpecific(
-    CallInterfaceDescriptorData* data) {
-  // kTarget, kNewTarget, kActualArgumentsCount, kAllocationSite
-  Register registers[] = {edi, edx, eax, ebx};
-  data->InitializePlatformSpecific(arraysize(registers), registers, nullptr);
-}
-
-void ArrayNoArgumentConstructorDescriptor::InitializePlatformSpecific(
-    CallInterfaceDescriptorData* data) {
-  // register state
-  // eax -- number of arguments
-  // edi -- function
-  // ebx -- allocation site with elements kind
-  Register registers[] = {edi, ebx, eax};
-  data->InitializePlatformSpecific(arraysize(registers), registers, nullptr);
-}
-
-void ArraySingleArgumentConstructorDescriptor::InitializePlatformSpecific(
-    CallInterfaceDescriptorData* data) {
-  // register state
-  // eax -- number of arguments
-  // edi -- function
-  // ebx -- allocation site with elements kind
-  Register registers[] = {edi, ebx, eax};
-  data->InitializePlatformSpecific(arraysize(registers), registers, nullptr);
-}
-
-void ArrayNArgumentsConstructorDescriptor::InitializePlatformSpecific(
-    CallInterfaceDescriptorData* data) {
-  // register state
-  // eax -- number of arguments
-  // edi -- function
-  // ebx -- allocation site with elements kind
-  Register registers[] = {edi, ebx, eax};
-  data->InitializePlatformSpecific(arraysize(registers), registers, nullptr);
+  data->InitializePlatformSpecific(0, nullptr);
 }
 
 void CompareDescriptor::InitializePlatformSpecific(
     CallInterfaceDescriptorData* data) {
   Register registers[] = {edx, eax};
-  data->InitializePlatformSpecific(arraysize(registers), registers, nullptr);
+  data->InitializePlatformSpecific(arraysize(registers), registers);
 }
 
-
 void BinaryOpDescriptor::InitializePlatformSpecific(
     CallInterfaceDescriptorData* data) {
   Register registers[] = {edx, eax};
-  data->InitializePlatformSpecific(arraysize(registers), registers, nullptr);
-}
-
-void StringAddDescriptor::InitializePlatformSpecific(
-    CallInterfaceDescriptorData* data) {
-  Register registers[] = {edx, eax};
-  data->InitializePlatformSpecific(arraysize(registers), registers, nullptr);
+  data->InitializePlatformSpecific(arraysize(registers), registers);
 }
 
 void ArgumentAdaptorDescriptor::InitializePlatformSpecific(
@@ -315,7 +247,9 @@ void InterpreterPushArgsThenConstructDescriptor::InitializePlatformSpecific(
   data->InitializePlatformSpecific(arraysize(registers), registers);
 }
 
-void InterpreterCEntryDescriptor::InitializePlatformSpecific(
+namespace {
+
+void InterpreterCEntryDescriptor_InitializePlatformSpecific(
     CallInterfaceDescriptorData* data) {
   Register registers[] = {
       eax,  // argument count (argc)
@@ -325,6 +259,18 @@ void InterpreterCEntryDescriptor::InitializePlatformSpecific(
   data->InitializePlatformSpecific(arraysize(registers), registers);
 }
 
+}  // namespace
+
+void InterpreterCEntry1Descriptor::InitializePlatformSpecific(
+    CallInterfaceDescriptorData* data) {
+  InterpreterCEntryDescriptor_InitializePlatformSpecific(data);
+}
+
+void InterpreterCEntry2Descriptor::InitializePlatformSpecific(
+    CallInterfaceDescriptorData* data) {
+  InterpreterCEntryDescriptor_InitializePlatformSpecific(data);
+}
+
 void ResumeGeneratorDescriptor::InitializePlatformSpecific(
     CallInterfaceDescriptorData* data) {
   Register registers[] = {
diff --git a/deps/v8/src/ia32/macro-assembler-ia32.cc b/deps/v8/src/ia32/macro-assembler-ia32.cc
index e0f3f738043d04..72fc7789666054 100644
--- a/deps/v8/src/ia32/macro-assembler-ia32.cc
+++ b/deps/v8/src/ia32/macro-assembler-ia32.cc
@@ -9,6 +9,7 @@
 #include "src/base/utils/random-number-generator.h"
 #include "src/bootstrapper.h"
 #include "src/callable.h"
+#include "src/code-factory.h"
 #include "src/code-stubs.h"
 #include "src/debug/debug.h"
 #include "src/external-reference-table.h"
@@ -26,20 +27,22 @@ namespace internal {
 // -------------------------------------------------------------------------
 // MacroAssembler implementation.
 
-MacroAssembler::MacroAssembler(Isolate* isolate, void* buffer, int size,
-                               CodeObjectRequired create_code_object)
-    : TurboAssembler(isolate, buffer, size, create_code_object) {}
-
-TurboAssembler::TurboAssembler(Isolate* isolate, void* buffer, int buffer_size,
-                               CodeObjectRequired create_code_object)
-    : Assembler(isolate, buffer, buffer_size), isolate_(isolate) {
+MacroAssembler::MacroAssembler(Isolate* isolate,
+                               const AssemblerOptions& options, void* buffer,
+                               int size, CodeObjectRequired create_code_object)
+    : TurboAssembler(isolate, options, buffer, size, create_code_object) {
   if (create_code_object == CodeObjectRequired::kYes) {
-    code_object_ =
-        Handle<HeapObject>::New(isolate->heap()->undefined_value(), isolate);
+    // Unlike TurboAssembler, which can be used off the main thread and may not
+    // allocate, macro assembler creates its own copy of the self-reference
+    // marker in order to disambiguate between self-references during nested
+    // code generation (e.g.: codegen of the current object triggers stub
+    // compilation through CodeStub::GetCode()).
+    code_object_ = Handle<HeapObject>::New(
+        *isolate->factory()->NewSelfReferenceMarker(), isolate);
   }
 }
 
-void MacroAssembler::LoadRoot(Register destination, Heap::RootListIndex index) {
+void TurboAssembler::LoadRoot(Register destination, Heap::RootListIndex index) {
   if (isolate()->heap()->RootCanBeTreatedAsConstant(index)) {
     Handle<Object> object = isolate()->heap()->root_handle(index);
     if (object->IsHeapObject()) {
@@ -57,7 +60,6 @@ void MacroAssembler::LoadRoot(Register destination, Heap::RootListIndex index) {
                                         roots_array_start));
 }
 
-
 void MacroAssembler::CompareRoot(Register with,
                                  Register scratch,
                                  Heap::RootListIndex index) {
@@ -177,10 +179,6 @@ int TurboAssembler::PopCallerSaved(SaveFPRegsMode fp_mode, Register exclusion1,
   return bytes;
 }
 
-void TurboAssembler::SlowTruncateToIDelayed(Zone* zone, Register result_reg) {
-  CallStubDelayed(new (zone) DoubleToIStub(nullptr, result_reg));
-}
-
 void MacroAssembler::DoubleToI(Register result_reg, XMMRegister input_reg,
                                XMMRegister scratch, Label* lost_precision,
                                Label* is_nan, Label::Distance dst) {
@@ -192,17 +190,6 @@ void MacroAssembler::DoubleToI(Register result_reg, XMMRegister input_reg,
   j(parity_even, is_nan, dst);
 }
 
-void TurboAssembler::LoadUint32(XMMRegister dst, Operand src) {
-  Label done;
-  cmp(src, Immediate(0));
-  ExternalReference uint32_bias =
-      ExternalReference::address_of_uint32_bias(isolate());
-  Cvtsi2sd(dst, src);
-  j(not_sign, &done, Label::kNear);
-  addsd(dst, Operand::StaticVariable(uint32_bias));
-  bind(&done);
-}
-
 void MacroAssembler::RecordWriteField(Register object, int offset,
                                       Register value, Register dst,
                                       SaveFPRegsMode save_fp,
@@ -369,27 +356,64 @@ void MacroAssembler::MaybeDropFrames() {
     RelocInfo::CODE_TARGET);
 }
 
-void TurboAssembler::Cvtsi2sd(XMMRegister dst, Operand src) {
+void TurboAssembler::Cvtsi2ss(XMMRegister dst, Operand src) {
   xorps(dst, dst);
+  cvtsi2ss(dst, src);
+}
+
+void TurboAssembler::Cvtsi2sd(XMMRegister dst, Operand src) {
+  xorpd(dst, dst);
   cvtsi2sd(dst, src);
 }
 
-void TurboAssembler::Cvtui2ss(XMMRegister dst, Register src, Register tmp) {
-  Label msb_set_src;
-  Label jmp_return;
-  test(src, src);
-  j(sign, &msb_set_src, Label::kNear);
-  cvtsi2ss(dst, src);
-  jmp(&jmp_return, Label::kNear);
-  bind(&msb_set_src);
-  mov(tmp, src);
-  shr(src, 1);
-  // Recover the least significant bit to avoid rounding errors.
-  and_(tmp, Immediate(1));
-  or_(src, tmp);
-  cvtsi2ss(dst, src);
+void TurboAssembler::Cvtui2ss(XMMRegister dst, Operand src, Register tmp) {
+  Label done;
+  Register src_reg = src.is_reg_only() ? src.reg() : tmp;
+  if (src_reg == tmp) mov(tmp, src);
+  cvtsi2ss(dst, src_reg);
+  test(src_reg, src_reg);
+  j(positive, &done, Label::kNear);
+
+  // Compute {src/2 | (src&1)} (retain the LSB to avoid rounding errors).
+  if (src_reg != tmp) mov(tmp, src_reg);
+  shr(tmp, 1);
+  // The LSB is shifted into CF. If it is set, set the LSB in {tmp}.
+  Label msb_not_set;
+  j(not_carry, &msb_not_set, Label::kNear);
+  or_(tmp, Immediate(1));
+  bind(&msb_not_set);
+  cvtsi2ss(dst, tmp);
   addss(dst, dst);
-  bind(&jmp_return);
+  bind(&done);
+}
+
+void TurboAssembler::Cvttss2ui(Register dst, Operand src, XMMRegister tmp) {
+  Label done;
+  cvttss2si(dst, src);
+  test(dst, dst);
+  j(positive, &done);
+  Move(tmp, static_cast<float>(INT32_MIN));
+  addss(tmp, src);
+  cvttss2si(dst, tmp);
+  or_(dst, Immediate(0x80000000));
+  bind(&done);
+}
+
+void TurboAssembler::Cvtui2sd(XMMRegister dst, Operand src) {
+  Label done;
+  cmp(src, Immediate(0));
+  ExternalReference uint32_bias = ExternalReference::address_of_uint32_bias();
+  Cvtsi2sd(dst, src);
+  j(not_sign, &done, Label::kNear);
+  addsd(dst, Operand::StaticVariable(uint32_bias));
+  bind(&done);
+}
+
+void TurboAssembler::Cvttsd2ui(Register dst, Operand src, XMMRegister tmp) {
+  Move(tmp, -2147483648.0);
+  addsd(tmp, src);
+  cvttsd2si(dst, tmp);
+  add(dst, Immediate(0x80000000));
 }
 
 void TurboAssembler::ShlPair(Register high, Register low, uint8_t shift) {
@@ -477,17 +501,6 @@ void MacroAssembler::AssertSmi(Register object) {
   }
 }
 
-void MacroAssembler::AssertFixedArray(Register object) {
-  if (emit_debug_code()) {
-    test(object, Immediate(kSmiTagMask));
-    Check(not_equal, AbortReason::kOperandIsASmiAndNotAFixedArray);
-    Push(object);
-    CmpObjectType(object, FIXED_ARRAY_TYPE, object);
-    Pop(object);
-    Check(equal, AbortReason::kOperandIsNotAFixedArray);
-  }
-}
-
 void MacroAssembler::AssertConstructor(Register object) {
   if (emit_debug_code()) {
     test(object, Immediate(kSmiTagMask));
@@ -590,14 +603,6 @@ void TurboAssembler::EnterFrame(StackFrame::Type type) {
   push(ebp);
   mov(ebp, esp);
   push(Immediate(StackFrame::TypeToMarker(type)));
-  if (type == StackFrame::INTERNAL) {
-    push(Immediate(CodeObject()));
-    // Check at runtime that this code object was patched correctly.
-    if (emit_debug_code()) {
-      cmp(Operand(esp, 0), Immediate(isolate()->factory()->undefined_value()));
-      Check(not_equal, AbortReason::kCodeObjectNotProperlyPatched);
-    }
-  }
 }
 
 void TurboAssembler::LeaveFrame(StackFrame::Type type) {
@@ -609,6 +614,30 @@ void TurboAssembler::LeaveFrame(StackFrame::Type type) {
   leave();
 }
 
+#ifdef V8_OS_WIN
+void TurboAssembler::AllocateStackFrame(Register bytes_scratch) {
+  // In windows, we cannot increment the stack size by more than one page
+  // (minimum page size is 4KB) without accessing at least one byte on the
+  // page. Check this:
+  // https://msdn.microsoft.com/en-us/library/aa227153(v=vs.60).aspx.
+  constexpr int kPageSize = 4 * 1024;
+  Label check_offset;
+  Label touch_next_page;
+  jmp(&check_offset);
+  bind(&touch_next_page);
+  sub(esp, Immediate(kPageSize));
+  // Just to touch the page, before we increment further.
+  mov(Operand(esp, 0), Immediate(0));
+  sub(bytes_scratch, Immediate(kPageSize));
+
+  bind(&check_offset);
+  cmp(bytes_scratch, kPageSize);
+  j(greater, &touch_next_page);
+
+  sub(esp, bytes_scratch);
+}
+#endif
+
 void MacroAssembler::EnterBuiltinFrame(Register context, Register target,
                                        Register argc) {
   Push(ebp);
@@ -645,12 +674,12 @@ void MacroAssembler::EnterExitFramePrologue(StackFrame::Type frame_type) {
   push(Immediate(CodeObject()));  // Accessed from ExitFrame::code_slot.
 
   // Save the frame pointer and the context in top.
-  ExternalReference c_entry_fp_address(IsolateAddressId::kCEntryFPAddress,
-                                       isolate());
-  ExternalReference context_address(IsolateAddressId::kContextAddress,
-                                    isolate());
-  ExternalReference c_function_address(IsolateAddressId::kCFunctionAddress,
-                                       isolate());
+  ExternalReference c_entry_fp_address =
+      ExternalReference::Create(IsolateAddressId::kCEntryFPAddress, isolate());
+  ExternalReference context_address =
+      ExternalReference::Create(IsolateAddressId::kContextAddress, isolate());
+  ExternalReference c_function_address =
+      ExternalReference::Create(IsolateAddressId::kCFunctionAddress, isolate());
   mov(Operand::StaticVariable(c_entry_fp_address), ebp);
   mov(Operand::StaticVariable(context_address), esi);
   mov(Operand::StaticVariable(c_function_address), ebx);
@@ -732,8 +761,8 @@ void MacroAssembler::LeaveExitFrame(bool save_doubles, bool pop_arguments) {
 
 void MacroAssembler::LeaveExitFrameEpilogue() {
   // Restore current context from top and clear it in debug mode.
-  ExternalReference context_address(IsolateAddressId::kContextAddress,
-                                    isolate());
+  ExternalReference context_address =
+      ExternalReference::Create(IsolateAddressId::kContextAddress, isolate());
   mov(esi, Operand::StaticVariable(context_address));
 #ifdef DEBUG
   mov(Operand::StaticVariable(context_address),
@@ -741,8 +770,8 @@ void MacroAssembler::LeaveExitFrameEpilogue() {
 #endif
 
   // Clear the top frame.
-  ExternalReference c_entry_fp_address(IsolateAddressId::kCEntryFPAddress,
-                                       isolate());
+  ExternalReference c_entry_fp_address =
+      ExternalReference::Create(IsolateAddressId::kCEntryFPAddress, isolate());
   mov(Operand::StaticVariable(c_entry_fp_address), Immediate(0));
 }
 
@@ -762,8 +791,8 @@ void MacroAssembler::PushStackHandler() {
   push(Immediate(0));  // Padding.
 
   // Link the current handler as the next handler.
-  ExternalReference handler_address(IsolateAddressId::kHandlerAddress,
-                                    isolate());
+  ExternalReference handler_address =
+      ExternalReference::Create(IsolateAddressId::kHandlerAddress, isolate());
   push(Operand::StaticVariable(handler_address));
 
   // Set this new handler as the current one.
@@ -773,8 +802,8 @@ void MacroAssembler::PushStackHandler() {
 
 void MacroAssembler::PopStackHandler() {
   STATIC_ASSERT(StackHandlerConstants::kNextOffset == 0);
-  ExternalReference handler_address(IsolateAddressId::kHandlerAddress,
-                                    isolate());
+  ExternalReference handler_address =
+      ExternalReference::Create(IsolateAddressId::kHandlerAddress, isolate());
   pop(Operand::StaticVariable(handler_address));
   add(esp, Immediate(StackHandlerConstants::kSize - kPointerSize));
 }
@@ -811,21 +840,24 @@ void MacroAssembler::CallRuntime(const Runtime::Function* f,
   // should remove this need and make the runtime routine entry code
   // smarter.
   Move(eax, Immediate(num_arguments));
-  mov(ebx, Immediate(ExternalReference(f, isolate())));
-  CEntryStub ces(isolate(), 1, save_doubles);
-  CallStub(&ces);
+  mov(ebx, Immediate(ExternalReference::Create(f)));
+  Handle<Code> code =
+      CodeFactory::CEntry(isolate(), f->result_size, save_doubles);
+  Call(code, RelocInfo::CODE_TARGET);
 }
 
-void TurboAssembler::CallRuntimeDelayed(Zone* zone, Runtime::FunctionId fid,
-                                        SaveFPRegsMode save_doubles) {
+void TurboAssembler::CallRuntimeWithCEntry(Runtime::FunctionId fid,
+                                           Register centry) {
   const Runtime::Function* f = Runtime::FunctionForId(fid);
   // TODO(1236192): Most runtime routines don't need the number of
   // arguments passed in because it is constant. At some point we
   // should remove this need and make the runtime routine entry code
   // smarter.
   Move(eax, Immediate(f->nargs));
-  mov(ebx, Immediate(ExternalReference(f, isolate())));
-  CallStubDelayed(new (zone) CEntryStub(nullptr, 1, save_doubles));
+  mov(ebx, Immediate(ExternalReference::Create(f)));
+  DCHECK(!AreAliased(centry, eax, ebx));
+  add(centry, Immediate(Code::kHeaderSize - kHeapObjectTag));
+  Call(centry);
 }
 
 void MacroAssembler::TailCallRuntime(Runtime::FunctionId fid) {
@@ -848,16 +880,16 @@ void MacroAssembler::TailCallRuntime(Runtime::FunctionId fid) {
     // smarter.
     mov(eax, Immediate(function->nargs));
   }
-  JumpToExternalReference(ExternalReference(fid, isolate()));
+  JumpToExternalReference(ExternalReference::Create(fid));
 }
 
 void MacroAssembler::JumpToExternalReference(const ExternalReference& ext,
                                              bool builtin_exit_frame) {
   // Set the entry point and jump to the C entry runtime stub.
   mov(ebx, Immediate(ext));
-  CEntryStub ces(isolate(), 1, kDontSaveFPRegs, kArgvOnStack,
-                 builtin_exit_frame);
-  jmp(ces.GetCode(), RelocInfo::CODE_TARGET);
+  Handle<Code> code = CodeFactory::CEntry(isolate(), 1, kDontSaveFPRegs,
+                                          kArgvOnStack, builtin_exit_frame);
+  Jump(code, RelocInfo::CODE_TARGET);
 }
 
 void MacroAssembler::JumpToInstructionStream(Address entry) {
@@ -1021,12 +1053,19 @@ void MacroAssembler::CheckDebugHook(Register fun, Register new_target,
     if (actual.is_reg()) {
       SmiTag(actual.reg());
       Push(actual.reg());
+      SmiUntag(actual.reg());
     }
     if (new_target.is_valid()) {
       Push(new_target);
     }
     Push(fun);
     Push(fun);
+    Operand receiver_op =
+        actual.is_reg()
+            ? Operand(ebp, actual.reg(), times_pointer_size, kPointerSize * 2)
+            : Operand(ebp, actual.immediate() * times_pointer_size +
+                               kPointerSize * 2);
+    Push(receiver_op);
     CallRuntime(Runtime::kDebugOnFunctionCall);
     Pop(fun);
     if (new_target.is_valid()) {
@@ -1091,7 +1130,8 @@ void MacroAssembler::InvokeFunction(Register fun, Register new_target,
   DCHECK(fun == edi);
   mov(ebx, FieldOperand(edi, JSFunction::kSharedFunctionInfoOffset));
   mov(esi, FieldOperand(edi, JSFunction::kContextOffset));
-  mov(ebx, FieldOperand(ebx, SharedFunctionInfo::kFormalParameterCountOffset));
+  movzx_w(ebx,
+          FieldOperand(ebx, SharedFunctionInfo::kFormalParameterCountOffset));
 
   ParameterCount expected(ebx);
   InvokeFunctionCode(edi, new_target, expected, actual, flag);
@@ -1233,6 +1273,15 @@ void TurboAssembler::Move(XMMRegister dst, uint64_t src) {
   }
 }
 
+void TurboAssembler::Pshufhw(XMMRegister dst, Operand src, uint8_t shuffle) {
+  if (CpuFeatures::IsSupported(AVX)) {
+    CpuFeatureScope scope(this, AVX);
+    vpshufhw(dst, src, shuffle);
+  } else {
+    pshufhw(dst, src, shuffle);
+  }
+}
+
 void TurboAssembler::Pshuflw(XMMRegister dst, Operand src, uint8_t shuffle) {
   if (CpuFeatures::IsSupported(AVX)) {
     CpuFeatureScope scope(this, AVX);
@@ -1251,6 +1300,24 @@ void TurboAssembler::Pshufd(XMMRegister dst, Operand src, uint8_t shuffle) {
   }
 }
 
+void TurboAssembler::Psraw(XMMRegister dst, int8_t shift) {
+  if (CpuFeatures::IsSupported(AVX)) {
+    CpuFeatureScope scope(this, AVX);
+    vpsraw(dst, dst, shift);
+  } else {
+    psraw(dst, shift);
+  }
+}
+
+void TurboAssembler::Psrlw(XMMRegister dst, int8_t shift) {
+  if (CpuFeatures::IsSupported(AVX)) {
+    CpuFeatureScope scope(this, AVX);
+    vpsrlw(dst, dst, shift);
+  } else {
+    psrlw(dst, shift);
+  }
+}
+
 void TurboAssembler::Psignb(XMMRegister dst, Operand src) {
   if (CpuFeatures::IsSupported(AVX)) {
     CpuFeatureScope scope(this, AVX);
@@ -1307,6 +1374,34 @@ void TurboAssembler::Pshufb(XMMRegister dst, Operand src) {
   UNREACHABLE();
 }
 
+void TurboAssembler::Pblendw(XMMRegister dst, Operand src, uint8_t imm8) {
+  if (CpuFeatures::IsSupported(AVX)) {
+    CpuFeatureScope scope(this, AVX);
+    vpblendw(dst, dst, src, imm8);
+    return;
+  }
+  if (CpuFeatures::IsSupported(SSE4_1)) {
+    CpuFeatureScope sse_scope(this, SSE4_1);
+    pblendw(dst, src, imm8);
+    return;
+  }
+  UNREACHABLE();
+}
+
+void TurboAssembler::Palignr(XMMRegister dst, Operand src, uint8_t imm8) {
+  if (CpuFeatures::IsSupported(AVX)) {
+    CpuFeatureScope scope(this, AVX);
+    vpalignr(dst, dst, src, imm8);
+    return;
+  }
+  if (CpuFeatures::IsSupported(SSSE3)) {
+    CpuFeatureScope sse_scope(this, SSSE3);
+    palignr(dst, src, imm8);
+    return;
+  }
+  UNREACHABLE();
+}
+
 void TurboAssembler::Pextrb(Register dst, XMMRegister src, int8_t imm8) {
   if (CpuFeatures::IsSupported(AVX)) {
     CpuFeatureScope scope(this, AVX);
@@ -1429,7 +1524,8 @@ void MacroAssembler::LoadWeakValue(Register in_out, Label* target_if_cleared) {
 void MacroAssembler::IncrementCounter(StatsCounter* counter, int value) {
   DCHECK_GT(value, 0);
   if (FLAG_native_code_counters && counter->Enabled()) {
-    Operand operand = Operand::StaticVariable(ExternalReference(counter));
+    Operand operand =
+        Operand::StaticVariable(ExternalReference::Create(counter));
     if (value == 1) {
       inc(operand);
     } else {
@@ -1442,7 +1538,8 @@ void MacroAssembler::IncrementCounter(StatsCounter* counter, int value) {
 void MacroAssembler::DecrementCounter(StatsCounter* counter, int value) {
   DCHECK_GT(value, 0);
   if (FLAG_native_code_counters && counter->Enabled()) {
-    Operand operand = Operand::StaticVariable(ExternalReference(counter));
+    Operand operand =
+        Operand::StaticVariable(ExternalReference::Create(counter));
     if (value == 1) {
       dec(operand);
     } else {
@@ -1484,16 +1581,15 @@ void TurboAssembler::CheckStackAlignment() {
 void TurboAssembler::Abort(AbortReason reason) {
 #ifdef DEBUG
   const char* msg = GetAbortReason(reason);
-  if (msg != nullptr) {
-    RecordComment("Abort message: ");
-    RecordComment(msg);
-  }
+  RecordComment("Abort message: ");
+  RecordComment(msg);
+#endif
 
-  if (FLAG_trap_on_abort) {
+  // Avoid emitting call to builtin if requested.
+  if (trap_on_abort()) {
     int3();
     return;
   }
-#endif
 
   Move(edx, Smi::FromInt(static_cast<int>(reason)));
 
diff --git a/deps/v8/src/ia32/macro-assembler-ia32.h b/deps/v8/src/ia32/macro-assembler-ia32.h
index c51e6b9d2d1afe..5d2b9bb0af4cf6 100644
--- a/deps/v8/src/ia32/macro-assembler-ia32.h
+++ b/deps/v8/src/ia32/macro-assembler-ia32.h
@@ -9,6 +9,7 @@
 #include "src/bailout-reason.h"
 #include "src/globals.h"
 #include "src/ia32/assembler-ia32.h"
+#include "src/turbo-assembler.h"
 
 namespace v8 {
 namespace internal {
@@ -25,12 +26,17 @@ constexpr Register kInterpreterAccumulatorRegister = eax;
 constexpr Register kInterpreterBytecodeOffsetRegister = edx;
 constexpr Register kInterpreterBytecodeArrayRegister = edi;
 constexpr Register kInterpreterDispatchTableRegister = esi;
+
 constexpr Register kJavaScriptCallArgCountRegister = eax;
 constexpr Register kJavaScriptCallCodeStartRegister = ecx;
+constexpr Register kJavaScriptCallTargetRegister = kJSFunctionRegister;
 constexpr Register kJavaScriptCallNewTargetRegister = edx;
+constexpr Register kJavaScriptCallExtraArg1Register = ebx;
+
 constexpr Register kOffHeapTrampolineRegister = ecx;
 constexpr Register kRuntimeCallFunctionRegister = ebx;
 constexpr Register kRuntimeCallArgCountRegister = eax;
+constexpr Register kWasmInstanceRegister = esi;
 
 // Convenience for platform-independent signatures.  We do not normally
 // distinguish memory operands from other operands on ia32.
@@ -48,20 +54,13 @@ bool AreAliased(Register reg1, Register reg2, Register reg3 = no_reg,
                 Register reg8 = no_reg);
 #endif
 
-class TurboAssembler : public Assembler {
+class TurboAssembler : public TurboAssemblerBase {
  public:
-  TurboAssembler(Isolate* isolate, void* buffer, int buffer_size,
-                 CodeObjectRequired create_code_object);
-
-  void set_has_frame(bool value) { has_frame_ = value; }
-  bool has_frame() const { return has_frame_; }
-
-  Isolate* isolate() const { return isolate_; }
-
-  Handle<HeapObject> CodeObject() {
-    DCHECK(!code_object_.is_null());
-    return code_object_;
-  }
+  TurboAssembler(Isolate* isolate, const AssemblerOptions& options,
+                 void* buffer, int buffer_size,
+                 CodeObjectRequired create_code_object)
+      : TurboAssemblerBase(isolate, options, buffer, buffer_size,
+                           create_code_object) {}
 
   void CheckPageFlag(Register object, Register scratch, int mask, Condition cc,
                      Label* condition_met,
@@ -75,6 +74,19 @@ class TurboAssembler : public Assembler {
   }
   void LeaveFrame(StackFrame::Type type);
 
+// Allocate a stack frame of given size (i.e. decrement {esp} by the value
+// stored in the given register).
+#ifdef V8_OS_WIN
+  // On win32, take special care if the number of bytes is greater than 4096:
+  // Ensure that each page within the new stack frame is touched once in
+  // decreasing order. See
+  // https://msdn.microsoft.com/en-us/library/aa227153(v=vs.60).aspx.
+  // Use {bytes_scratch} as scratch register for this procedure.
+  void AllocateStackFrame(Register bytes_scratch);
+#else
+  void AllocateStackFrame(Register bytes) { sub(esp, bytes); }
+#endif
+
   // Print a message to stdout and abort execution.
   void Abort(AbortReason reason);
 
@@ -113,6 +125,7 @@ class TurboAssembler : public Assembler {
 
   void Move(Register dst, Handle<HeapObject> handle);
 
+  void Call(Register reg) { call(reg); }
   void Call(Handle<Code> target, RelocInfo::Mode rmode) { call(target, rmode); }
   void Call(Label* target) { call(target); }
 
@@ -121,15 +134,18 @@ class TurboAssembler : public Assembler {
 
   void RetpolineJump(Register reg);
 
-  void CallForDeoptimization(Address target, RelocInfo::Mode rmode) {
+  void CallForDeoptimization(Address target, int deopt_id,
+                             RelocInfo::Mode rmode) {
+    USE(deopt_id);
     call(target, rmode);
   }
 
   inline bool AllowThisStubCall(CodeStub* stub);
   void CallStubDelayed(CodeStub* stub);
 
-  void CallRuntimeDelayed(Zone* zone, Runtime::FunctionId fid,
-                          SaveFPRegsMode save_doubles = kDontSaveFPRegs);
+  // Call a runtime routine. This expects {centry} to contain a fitting CEntry
+  // builtin for the target runtime function and uses an indirect call.
+  void CallRuntimeWithCEntry(Runtime::FunctionId fid, Register centry);
 
   // Jump the register contains a smi.
   inline void JumpIfSmi(Register value, Label* smi_label,
@@ -144,6 +160,16 @@ class TurboAssembler : public Assembler {
     j(zero, smi_label, distance);
   }
 
+  void JumpIfEqual(Register a, int32_t b, Label* dest) {
+    cmp(a, Immediate(b));
+    j(equal, dest);
+  }
+
+  void JumpIfLessThan(Register a, int32_t b, Label* dest) {
+    cmp(a, Immediate(b));
+    j(less, dest);
+  }
+
   void SmiUntag(Register reg) { sar(reg, kSmiTagSize); }
 
   // Removes current frame and its arguments from the stack preserving the
@@ -198,10 +224,28 @@ class TurboAssembler : public Assembler {
 
   void Ret();
 
+  void LoadRoot(Register destination, Heap::RootListIndex index) override;
+
+  // TODO(jgruber,v8:6666): Implement embedded builtins.
+  void LoadFromConstantsTable(Register destination,
+                              int constant_index) override {
+    UNREACHABLE();
+  }
+  void LoadRootRegisterOffset(Register destination, intptr_t offset) override {
+    UNREACHABLE();
+  }
+  void LoadRootRelative(Register destination, int32_t offset) override {
+    UNREACHABLE();
+  }
+
   // Return and drop arguments from stack, where the number of arguments
   // may be bigger than 2^16 - 1.  Requires a scratch register.
   void Ret(int bytes_dropped, Register scratch);
 
+  void Pshufhw(XMMRegister dst, XMMRegister src, uint8_t shuffle) {
+    Pshufhw(dst, Operand(src), shuffle);
+  }
+  void Pshufhw(XMMRegister dst, Operand src, uint8_t shuffle);
   void Pshuflw(XMMRegister dst, XMMRegister src, uint8_t shuffle) {
     Pshuflw(dst, Operand(src), shuffle);
   }
@@ -210,6 +254,8 @@ class TurboAssembler : public Assembler {
     Pshufd(dst, Operand(src), shuffle);
   }
   void Pshufd(XMMRegister dst, Operand src, uint8_t shuffle);
+  void Psraw(XMMRegister dst, int8_t shift);
+  void Psrlw(XMMRegister dst, int8_t shift);
 
 // SSE/SSE2 instructions with AVX version.
 #define AVX_OP2_WITH_TYPE(macro_name, name, dst_type, src_type) \
@@ -249,10 +295,16 @@ class TurboAssembler : public Assembler {
   AVX_OP3_WITH_TYPE(macro_name, name, XMMRegister, XMMRegister) \
   AVX_OP3_WITH_TYPE(macro_name, name, XMMRegister, Operand)
 
+  AVX_OP3_XO(Packsswb, packsswb)
+  AVX_OP3_XO(Packuswb, packuswb)
+  AVX_OP3_XO(Pcmpeqb, pcmpeqb)
+  AVX_OP3_XO(Pcmpeqw, pcmpeqw)
   AVX_OP3_XO(Pcmpeqd, pcmpeqd)
   AVX_OP3_XO(Psubb, psubb)
   AVX_OP3_XO(Psubw, psubw)
   AVX_OP3_XO(Psubd, psubd)
+  AVX_OP3_XO(Punpcklbw, punpcklbw)
+  AVX_OP3_XO(Punpckhbw, punpckhbw)
   AVX_OP3_XO(Pxor, pxor)
   AVX_OP3_XO(Andps, andps)
   AVX_OP3_XO(Andpd, andpd)
@@ -264,9 +316,41 @@ class TurboAssembler : public Assembler {
 #undef AVX_OP3_XO
 #undef AVX_OP3_WITH_TYPE
 
-  // Non-SSE2 instructions.
+// Non-SSE2 instructions.
+#define AVX_OP2_WITH_TYPE_SCOPE(macro_name, name, dst_type, src_type, \
+                                sse_scope)                            \
+  void macro_name(dst_type dst, src_type src) {                       \
+    if (CpuFeatures::IsSupported(AVX)) {                              \
+      CpuFeatureScope scope(this, AVX);                               \
+      v##name(dst, src);                                              \
+      return;                                                         \
+    }                                                                 \
+    if (CpuFeatures::IsSupported(sse_scope)) {                        \
+      CpuFeatureScope scope(this, sse_scope);                         \
+      name(dst, src);                                                 \
+      return;                                                         \
+    }                                                                 \
+    UNREACHABLE();                                                    \
+  }
+#define AVX_OP2_XO_SSE4(macro_name, name)                                     \
+  AVX_OP2_WITH_TYPE_SCOPE(macro_name, name, XMMRegister, XMMRegister, SSE4_1) \
+  AVX_OP2_WITH_TYPE_SCOPE(macro_name, name, XMMRegister, Operand, SSE4_1)
+
+  AVX_OP2_XO_SSE4(Ptest, ptest)
+  AVX_OP2_XO_SSE4(Pmovsxbw, pmovsxbw)
+  AVX_OP2_XO_SSE4(Pmovsxwd, pmovsxwd)
+  AVX_OP2_XO_SSE4(Pmovzxbw, pmovzxbw)
+  AVX_OP2_XO_SSE4(Pmovzxwd, pmovzxwd)
+
+#undef AVX_OP2_WITH_TYPE_SCOPE
+#undef AVX_OP2_XO_SSE4
+
   void Pshufb(XMMRegister dst, XMMRegister src) { Pshufb(dst, Operand(src)); }
   void Pshufb(XMMRegister dst, Operand src);
+  void Pblendw(XMMRegister dst, XMMRegister src, uint8_t imm8) {
+    Pblendw(dst, Operand(src), imm8);
+  }
+  void Pblendw(XMMRegister dst, Operand src, uint8_t imm8);
 
   void Psignb(XMMRegister dst, XMMRegister src) { Psignb(dst, Operand(src)); }
   void Psignb(XMMRegister dst, Operand src);
@@ -275,6 +359,11 @@ class TurboAssembler : public Assembler {
   void Psignd(XMMRegister dst, XMMRegister src) { Psignd(dst, Operand(src)); }
   void Psignd(XMMRegister dst, Operand src);
 
+  void Palignr(XMMRegister dst, XMMRegister src, uint8_t imm8) {
+    Palignr(dst, Operand(src), imm8);
+  }
+  void Palignr(XMMRegister dst, Operand src, uint8_t imm8);
+
   void Pextrb(Register dst, XMMRegister src, int8_t imm8);
   void Pextrw(Register dst, XMMRegister src, int8_t imm8);
   void Pextrd(Register dst, XMMRegister src, int8_t imm8);
@@ -285,21 +374,29 @@ class TurboAssembler : public Assembler {
   void Pinsrd(XMMRegister dst, Operand src, int8_t imm8,
               bool is_64_bits = false);
 
-  void LoadUint32(XMMRegister dst, Register src) {
-    LoadUint32(dst, Operand(src));
-  }
-  void LoadUint32(XMMRegister dst, Operand src);
-
   // Expression support
   // cvtsi2sd instruction only writes to the low 64-bit of dst register, which
   // hinders register renaming and makes dependence chains longer. So we use
   // xorps to clear the dst register before cvtsi2sd to solve this issue.
+  void Cvtsi2ss(XMMRegister dst, Register src) { Cvtsi2ss(dst, Operand(src)); }
+  void Cvtsi2ss(XMMRegister dst, Operand src);
   void Cvtsi2sd(XMMRegister dst, Register src) { Cvtsi2sd(dst, Operand(src)); }
   void Cvtsi2sd(XMMRegister dst, Operand src);
 
-  void Cvtui2ss(XMMRegister dst, Register src, Register tmp);
-
-  void SlowTruncateToIDelayed(Zone* zone, Register result_reg);
+  void Cvtui2ss(XMMRegister dst, Register src, Register tmp) {
+    Cvtui2ss(dst, Operand(src), tmp);
+  }
+  void Cvtui2ss(XMMRegister dst, Operand src, Register tmp);
+  void Cvttss2ui(Register dst, XMMRegister src, XMMRegister tmp) {
+    Cvttss2ui(dst, Operand(src), tmp);
+  }
+  void Cvttss2ui(Register dst, Operand src, XMMRegister tmp);
+  void Cvtui2sd(XMMRegister dst, Register src) { Cvtui2sd(dst, Operand(src)); }
+  void Cvtui2sd(XMMRegister dst, Operand src);
+  void Cvttsd2ui(Register dst, XMMRegister src, XMMRegister tmp) {
+    Cvttsd2ui(dst, Operand(src), tmp);
+  }
+  void Cvttsd2ui(Register dst, Operand src, XMMRegister tmp);
 
   void Push(Register src) { push(src); }
   void Push(Operand src) { push(src); }
@@ -342,19 +439,17 @@ class TurboAssembler : public Assembler {
   void ComputeCodeStartAddress(Register dst);
 
   void ResetSpeculationPoisonRegister();
-
- private:
-  bool has_frame_ = false;
-  Isolate* const isolate_;
-  // This handle will be patched with the code object on installation.
-  Handle<HeapObject> code_object_;
 };
 
 // MacroAssembler implements a collection of frequently used macros.
 class MacroAssembler : public TurboAssembler {
  public:
   MacroAssembler(Isolate* isolate, void* buffer, int size,
-                 CodeObjectRequired create_code_object);
+                 CodeObjectRequired create_code_object)
+      : MacroAssembler(isolate, AssemblerOptions::Default(isolate), buffer,
+                       size, create_code_object) {}
+  MacroAssembler(Isolate* isolate, const AssemblerOptions& options,
+                 void* buffer, int size, CodeObjectRequired create_code_object);
 
   // Load a register with a long value as efficiently as possible.
   void Set(Register dst, int32_t x) {
@@ -367,7 +462,6 @@ class MacroAssembler : public TurboAssembler {
   void Set(Operand dst, int32_t x) { mov(dst, Immediate(x)); }
 
   // Operations on roots in the root-array.
-  void LoadRoot(Register destination, Heap::RootListIndex index);
   void CompareRoot(Register with, Register scratch, Heap::RootListIndex index);
   // These methods can only be used with constant roots (i.e. non-writable
   // and not in new space).
@@ -533,9 +627,6 @@ class MacroAssembler : public TurboAssembler {
   // Abort execution if argument is a smi, enabled via --debug-code.
   void AssertNotSmi(Register object);
 
-  // Abort execution if argument is not a FixedArray, enabled via --debug-code.
-  void AssertFixedArray(Register object);
-
   // Abort execution if argument is not a JSFunction, enabled via --debug-code.
   void AssertFunction(Register object);
 
diff --git a/deps/v8/src/ia32/sse-instr.h b/deps/v8/src/ia32/sse-instr.h
index cb4cba3ad001f2..f9d4c59e07b6a7 100644
--- a/deps/v8/src/ia32/sse-instr.h
+++ b/deps/v8/src/ia32/sse-instr.h
@@ -6,6 +6,9 @@
 #define V8_IA32_SSE_INSTR_H_
 
 #define SSE2_INSTRUCTION_LIST(V) \
+  V(packsswb, 66, 0F, 63)        \
+  V(packssdw, 66, 0F, 6B)        \
+  V(packuswb, 66, 0F, 67)        \
   V(paddb, 66, 0F, FC)           \
   V(paddw, 66, 0F, FD)           \
   V(paddd, 66, 0F, FE)           \
@@ -39,8 +42,14 @@
   V(psubsw, 66, 0F, E9)          \
   V(psubusb, 66, 0F, D8)         \
   V(psubusw, 66, 0F, D9)         \
-  V(punpckhdq, 66, 0F, 6A)       \
+  V(punpcklbw, 66, 0F, 60)       \
+  V(punpcklwd, 66, 0F, 61)       \
   V(punpckldq, 66, 0F, 62)       \
+  V(punpcklqdq, 66, 0F, 6C)      \
+  V(punpckhbw, 66, 0F, 68)       \
+  V(punpckhwd, 66, 0F, 69)       \
+  V(punpckhdq, 66, 0F, 6A)       \
+  V(punpckhqdq, 66, 0F, 6D)      \
   V(pxor, 66, 0F, EF)
 
 #define SSSE3_INSTRUCTION_LIST(V) \
@@ -52,6 +61,7 @@
   V(psignd, 66, 0F, 38, 0A)
 
 #define SSE4_INSTRUCTION_LIST(V) \
+  V(packusdw, 66, 0F, 38, 2B)    \
   V(pminsb, 66, 0F, 38, 38)      \
   V(pminsd, 66, 0F, 38, 39)      \
   V(pminuw, 66, 0F, 38, 3A)      \
@@ -62,4 +72,11 @@
   V(pmaxud, 66, 0F, 38, 3F)      \
   V(pmulld, 66, 0F, 38, 40)
 
+#define SSE4_RM_INSTRUCTION_LIST(V) \
+  V(pmovsxbw, 66, 0F, 38, 20)       \
+  V(pmovsxwd, 66, 0F, 38, 23)       \
+  V(pmovzxbw, 66, 0F, 38, 30)       \
+  V(pmovzxwd, 66, 0F, 38, 33)       \
+  V(ptest, 66, 0F, 38, 17)
+
 #endif  // V8_IA32_SSE_INSTR_H_
diff --git a/deps/v8/src/ic/accessor-assembler.cc b/deps/v8/src/ic/accessor-assembler.cc
index 7ffa26341017df..1600bcc9fed526 100644
--- a/deps/v8/src/ic/accessor-assembler.cc
+++ b/deps/v8/src/ic/accessor-assembler.cc
@@ -11,6 +11,7 @@
 #include "src/ic/ic.h"
 #include "src/ic/stub-cache.h"
 #include "src/objects-inl.h"
+#include "src/objects/module.h"
 
 namespace v8 {
 namespace internal {
@@ -25,7 +26,7 @@ using SloppyTNode = compiler::SloppyTNode<T>;
 //////////////////// Private helpers.
 
 // Loads dataX field from the DataHandler object.
-TNode<Object> AccessorAssembler::LoadHandlerDataField(
+TNode<MaybeObject> AccessorAssembler::LoadHandlerDataField(
     SloppyTNode<DataHandler> handler, int data_index) {
 #ifdef DEBUG
   TNode<Map> handler_map = LoadMap(handler);
@@ -57,14 +58,12 @@ TNode<Object> AccessorAssembler::LoadHandlerDataField(
   CSA_ASSERT(this, UintPtrGreaterThanOrEqual(
                        LoadMapInstanceSizeInWords(handler_map),
                        IntPtrConstant(minimum_size / kPointerSize)));
-  return LoadObjectField(handler, offset);
+  return LoadMaybeWeakObjectField(handler, offset);
 }
 
-Node* AccessorAssembler::TryMonomorphicCase(Node* slot, Node* vector,
-                                            Node* receiver_map,
-                                            Label* if_handler,
-                                            Variable* var_handler,
-                                            Label* if_miss) {
+TNode<MaybeObject> AccessorAssembler::TryMonomorphicCase(
+    Node* slot, Node* vector, Node* receiver_map, Label* if_handler,
+    TVariable<MaybeObject>* var_handler, Label* if_miss) {
   Comment("TryMonomorphicCase");
   DCHECK_EQ(MachineRepresentation::kTagged, var_handler->rep());
 
@@ -76,29 +75,27 @@ Node* AccessorAssembler::TryMonomorphicCase(Node* slot, Node* vector,
   // into ElementOffsetFromIndex() allows it to be folded into a single
   // [base, index, offset] indirect memory access on x64.
   Node* offset = ElementOffsetFromIndex(slot, HOLEY_ELEMENTS, SMI_PARAMETERS);
-  Node* feedback = Load(MachineType::AnyTagged(), vector,
-                        IntPtrAdd(offset, IntPtrConstant(header_size)));
+  TNode<MaybeObject> feedback = ReinterpretCast<MaybeObject>(
+      Load(MachineType::AnyTagged(), vector,
+           IntPtrAdd(offset, IntPtrConstant(header_size))));
 
   // Try to quickly handle the monomorphic case without knowing for sure
-  // if we have a weak cell in feedback. We do know it's safe to look
-  // at WeakCell::kValueOffset.
-  GotoIf(WordNotEqual(receiver_map, LoadWeakCellValueUnchecked(feedback)),
-         if_miss);
+  // if we have a weak reference in feedback.
+  GotoIf(IsNotWeakReferenceTo(feedback, CAST(receiver_map)), if_miss);
 
-  Node* handler =
+  TNode<MaybeObject> handler = UncheckedCast<MaybeObject>(
       Load(MachineType::AnyTagged(), vector,
-           IntPtrAdd(offset, IntPtrConstant(header_size + kPointerSize)));
+           IntPtrAdd(offset, IntPtrConstant(header_size + kPointerSize))));
 
-  var_handler->Bind(handler);
+  *var_handler = handler;
   Goto(if_handler);
   return feedback;
 }
 
-void AccessorAssembler::HandlePolymorphicCase(Node* receiver_map,
-                                              Node* feedback, Label* if_handler,
-                                              Variable* var_handler,
-                                              Label* if_miss,
-                                              int min_feedback_capacity) {
+void AccessorAssembler::HandlePolymorphicCase(
+    Node* receiver_map, TNode<WeakFixedArray> feedback, Label* if_handler,
+    TVariable<MaybeObject>* var_handler, Label* if_miss,
+    int min_feedback_capacity) {
   Comment("HandlePolymorphicCase");
   DCHECK_EQ(MachineRepresentation::kTagged, var_handler->rep());
 
@@ -113,7 +110,7 @@ void AccessorAssembler::HandlePolymorphicCase(Node* receiver_map,
   // the first {min_feedback_capacity} (map, handler) pairs.
   Node* length = nullptr;
   CSA_ASSERT(this, SmiGreaterThanOrEqual(
-                       LoadFixedArrayBaseLength(feedback),
+                       LoadWeakFixedArrayLength(feedback),
                        SmiConstant(min_feedback_capacity * kEntrySize)));
 
   const int kUnrolledIterations = IC::kMaxPolymorphicMapCount;
@@ -122,19 +119,22 @@ void AccessorAssembler::HandlePolymorphicCase(Node* receiver_map,
     int handler_index = i * kEntrySize + 1;
 
     if (i >= min_feedback_capacity) {
-      if (length == nullptr) length = LoadFixedArrayBaseLength(feedback);
-      GotoIf(SmiGreaterThanOrEqual(SmiConstant(handler_index), length),
+      if (length == nullptr) length = LoadWeakFixedArrayLength(feedback);
+      GotoIf(SmiGreaterThanOrEqual(SmiConstant(handler_index), CAST(length)),
              if_miss);
     }
 
     Label next_entry(this);
-    Node* cached_map =
-        LoadWeakCellValue(CAST(LoadFixedArrayElement(feedback, map_index)));
-    GotoIf(WordNotEqual(receiver_map, cached_map), &next_entry);
+    TNode<MaybeObject> maybe_cached_map =
+        LoadWeakFixedArrayElement(feedback, map_index);
+    CSA_ASSERT(this, IsWeakOrClearedHeapObject(maybe_cached_map));
+    GotoIf(IsNotWeakReferenceTo(maybe_cached_map, CAST(receiver_map)),
+           &next_entry);
 
     // Found, now call handler.
-    Node* handler = LoadFixedArrayElement(feedback, handler_index);
-    var_handler->Bind(handler);
+    TNode<MaybeObject> handler =
+        LoadWeakFixedArrayElement(feedback, handler_index);
+    *var_handler = handler;
     Goto(if_handler);
 
     BIND(&next_entry);
@@ -144,19 +144,21 @@ void AccessorAssembler::HandlePolymorphicCase(Node* receiver_map,
   // Loop from {kUnrolledIterations}*kEntrySize to {length}.
   BIND(&loop);
   Node* start_index = IntPtrConstant(kUnrolledIterations * kEntrySize);
-  Node* end_index = LoadAndUntagFixedArrayBaseLength(feedback);
+  Node* end_index = LoadAndUntagWeakFixedArrayLength(feedback);
   BuildFastLoop(
       start_index, end_index,
       [this, receiver_map, feedback, if_handler, var_handler](Node* index) {
-        Node* cached_map =
-            LoadWeakCellValue(CAST(LoadFixedArrayElement(feedback, index)));
-
         Label next_entry(this);
-        GotoIf(WordNotEqual(receiver_map, cached_map), &next_entry);
+        TNode<MaybeObject> maybe_cached_map =
+            LoadWeakFixedArrayElement(feedback, index);
+        CSA_ASSERT(this, IsWeakOrClearedHeapObject(maybe_cached_map));
+        GotoIf(IsNotWeakReferenceTo(maybe_cached_map, CAST(receiver_map)),
+               &next_entry);
 
         // Found, now call handler.
-        Node* handler = LoadFixedArrayElement(feedback, index, kPointerSize);
-        var_handler->Bind(handler);
+        TNode<MaybeObject> handler =
+            LoadWeakFixedArrayElement(feedback, index, kPointerSize);
+        *var_handler = handler;
         Goto(if_handler);
 
         BIND(&next_entry);
@@ -167,7 +169,7 @@ void AccessorAssembler::HandlePolymorphicCase(Node* receiver_map,
 }
 
 void AccessorAssembler::HandleLoadICHandlerCase(
-    const LoadICParameters* p, Node* handler, Label* miss,
+    const LoadICParameters* p, TNode<Object> handler, Label* miss,
     ExitPoint* exit_point, ICMode ic_mode, OnNonExistent on_nonexistent,
     ElementSupport support_elements) {
   Comment("have_handler");
@@ -193,15 +195,14 @@ void AccessorAssembler::HandleLoadICHandlerCase(
 
   BIND(&try_proto_handler);
   {
-    GotoIf(IsCodeMap(LoadMap(handler)), &call_handler);
+    GotoIf(IsCodeMap(LoadMap(CAST(handler))), &call_handler);
     HandleLoadICProtoHandler(p, handler, &var_holder, &var_smi_handler,
                              &if_smi_handler, miss, exit_point, ic_mode);
   }
 
   BIND(&call_handler);
   {
-    typedef LoadWithVectorDescriptor Descriptor;
-    exit_point->ReturnCallStub(Descriptor(isolate()), handler, p->context,
+    exit_point->ReturnCallStub(LoadWithVectorDescriptor{}, handler, p->context,
                                p->receiver, p->name, p->slot, p->vector);
   }
 }
@@ -249,16 +250,22 @@ void AccessorAssembler::HandleLoadField(Node* holder, Node* handler_word,
   }
 }
 
-Node* AccessorAssembler::LoadDescriptorValue(Node* map, Node* descriptor) {
-  Node* descriptors = LoadMapDescriptors(map);
+TNode<Object> AccessorAssembler::LoadDescriptorValue(Node* map,
+                                                     Node* descriptor) {
+  return CAST(LoadDescriptorValueOrFieldType(map, descriptor));
+}
+
+TNode<MaybeObject> AccessorAssembler::LoadDescriptorValueOrFieldType(
+    Node* map, Node* descriptor) {
+  TNode<DescriptorArray> descriptors = LoadMapDescriptors(map);
   Node* scaled_descriptor =
       IntPtrMul(descriptor, IntPtrConstant(DescriptorArray::kEntrySize));
   Node* value_index = IntPtrAdd(
       scaled_descriptor, IntPtrConstant(DescriptorArray::kFirstIndex +
                                         DescriptorArray::kEntryValueIndex));
-  CSA_ASSERT(this, UintPtrLessThan(descriptor, LoadAndUntagFixedArrayBaseLength(
+  CSA_ASSERT(this, UintPtrLessThan(descriptor, LoadAndUntagWeakFixedArrayLength(
                                                    descriptors)));
-  return LoadFixedArrayElement(descriptors, value_index);
+  return LoadWeakFixedArrayElement(descriptors, value_index);
 }
 
 void AccessorAssembler::HandleLoadICSmiHandlerCase(
@@ -423,10 +430,10 @@ void AccessorAssembler::HandleLoadICSmiHandlerCase(
   BIND(&normal);
   {
     Comment("load_normal");
-    Node* properties = LoadSlowProperties(holder);
-    VARIABLE(var_name_index, MachineType::PointerRepresentation());
+    TNode<NameDictionary> properties = CAST(LoadSlowProperties(holder));
+    TVARIABLE(IntPtrT, var_name_index);
     Label found(this, &var_name_index);
-    NameDictionaryLookup<NameDictionary>(properties, p->name, &found,
+    NameDictionaryLookup<NameDictionary>(properties, CAST(p->name), &found,
                                          &var_name_index, miss);
     BIND(&found);
     {
@@ -474,10 +481,10 @@ void AccessorAssembler::HandleLoadICSmiHandlerCase(
     // the access check is enabled for this handler or not.
     TNode<Object> context_cell = Select<Object>(
         IsSetWord<LoadHandler::DoAccessCheckOnReceiverBits>(handler_word),
-        [=] { return LoadHandlerDataField(handler, 3); },
-        [=] { return LoadHandlerDataField(handler, 2); });
+        [=] { return CAST(LoadHandlerDataField(handler, 3)); },
+        [=] { return CAST(LoadHandlerDataField(handler, 2)); });
 
-    Node* context = LoadWeakCellValueUnchecked(context_cell);
+    Node* context = LoadWeakCellValueUnchecked(CAST(context_cell));
     Node* foreign =
         LoadObjectField(call_handler_info, CallHandlerInfo::kJsCallbackOffset);
     Node* callback = LoadObjectField(foreign, Foreign::kForeignAddressOffset,
@@ -513,13 +520,16 @@ void AccessorAssembler::HandleLoadICSmiHandlerCase(
         to_name_failed(this, Label::kDeferred);
 
     if (support_elements == kSupportElements) {
+      DCHECK_NE(on_nonexistent, OnNonExistent::kThrowReferenceError);
+
       TryToName(p->name, &if_index, &var_index, &if_unique_name, &var_unique,
                 &to_name_failed);
 
       BIND(&if_unique_name);
       exit_point->ReturnCallStub(
           Builtins::CallableFor(isolate(), Builtins::kProxyGetProperty),
-          p->context, holder, var_unique.value(), p->receiver);
+          p->context, holder, var_unique.value(), p->receiver,
+          SmiConstant(on_nonexistent));
 
       BIND(&if_index);
       // TODO(mslekova): introduce TryToName that doesn't try to compute
@@ -528,12 +538,13 @@ void AccessorAssembler::HandleLoadICSmiHandlerCase(
 
       BIND(&to_name_failed);
       exit_point->ReturnCallRuntime(Runtime::kGetPropertyWithReceiver,
-                                    p->context, holder, p->name, p->receiver);
-
+                                    p->context, holder, p->name, p->receiver,
+                                    SmiConstant(on_nonexistent));
     } else {
       exit_point->ReturnCallStub(
           Builtins::CallableFor(isolate(), Builtins::kProxyGetProperty),
-          p->context, holder, p->name, p->receiver);
+          p->context, holder, p->name, p->receiver,
+          SmiConstant(on_nonexistent));
     }
   }
 
@@ -659,7 +670,7 @@ Node* AccessorAssembler::HandleProtoHandler(
 
       BIND(&if_do_access_check);
       {
-        Node* data2 = LoadHandlerDataField(handler, 2);
+        TNode<WeakCell> data2 = CAST(LoadHandlerDataField(handler, 2));
         Node* expected_native_context = LoadWeakCellValue(data2, miss);
         EmitAccessCheck(expected_native_context, p->context, p->receiver, &done,
                         miss);
@@ -674,10 +685,11 @@ Node* AccessorAssembler::HandleProtoHandler(
         CSA_ASSERT(this, Word32BinaryNot(HasInstanceType(
                              p->receiver, JS_GLOBAL_OBJECT_TYPE)));
 
-        Node* properties = LoadSlowProperties(p->receiver);
-        VARIABLE(var_name_index, MachineType::PointerRepresentation());
+        TNode<NameDictionary> properties =
+            CAST(LoadSlowProperties(p->receiver));
+        TVARIABLE(IntPtrT, var_name_index);
         Label found(this, &var_name_index);
-        NameDictionaryLookup<NameDictionary>(properties, p->name, &found,
+        NameDictionaryLookup<NameDictionary>(properties, CAST(p->name), &found,
                                              &var_name_index, &done);
         BIND(&found);
         {
@@ -719,7 +731,7 @@ void AccessorAssembler::HandleLoadICProtoHandler(
       },
       miss, ic_mode);
 
-  Node* maybe_holder_cell = LoadHandlerDataField(handler, 1);
+  TNode<Object> maybe_holder_cell = CAST(LoadHandlerDataField(handler, 1));
 
   Label load_from_cached_holder(this), done(this);
 
@@ -730,7 +742,7 @@ void AccessorAssembler::HandleLoadICProtoHandler(
     // For regular holders, having passed the receiver map check and the
     // validity cell check implies that |holder| is alive. However, for
     // global object receivers, the |maybe_holder_cell| may be cleared.
-    Node* holder = LoadWeakCellValue(maybe_holder_cell, miss);
+    Node* holder = LoadWeakCellValue(CAST(maybe_holder_cell), miss);
 
     var_holder->Bind(holder);
     Goto(&done);
@@ -784,8 +796,8 @@ void AccessorAssembler::HandleStoreICNativeDataProperty(
 }
 
 void AccessorAssembler::HandleStoreICHandlerCase(
-    const StoreICParameters* p, Node* handler, Label* miss, ICMode ic_mode,
-    ElementSupport support_elements) {
+    const StoreICParameters* p, TNode<MaybeObject> handler, Label* miss,
+    ICMode ic_mode, ElementSupport support_elements) {
   Label if_smi_handler(this), if_nonsmi_handler(this);
   Label if_proto_handler(this), if_element_handler(this), call_handler(this),
       store_transition_or_global(this);
@@ -797,7 +809,7 @@ void AccessorAssembler::HandleStoreICHandlerCase(
   BIND(&if_smi_handler);
   {
     Node* holder = p->receiver;
-    Node* handler_word = SmiUntag(handler);
+    Node* handler_word = SmiUntag(CAST(handler));
 
     Label if_fast_smi(this), if_proxy(this);
 
@@ -813,12 +825,12 @@ void AccessorAssembler::HandleStoreICHandlerCase(
            &if_proxy);
     CSA_ASSERT(this,
                WordEqual(handler_kind, IntPtrConstant(StoreHandler::kNormal)));
-    Node* properties = LoadSlowProperties(holder);
+    TNode<NameDictionary> properties = CAST(LoadSlowProperties(holder));
 
-    VARIABLE(var_name_index, MachineType::PointerRepresentation());
+    TVARIABLE(IntPtrT, var_name_index);
     Label dictionary_found(this, &var_name_index);
-    NameDictionaryLookup<NameDictionary>(properties, p->name, &dictionary_found,
-                                         &var_name_index, miss);
+    NameDictionaryLookup<NameDictionary>(
+        properties, CAST(p->name), &dictionary_found, &var_name_index, miss);
     BIND(&dictionary_found);
     {
       Node* details = LoadDetailsByKeyIndex<NameDictionary>(
@@ -862,44 +874,53 @@ void AccessorAssembler::HandleStoreICHandlerCase(
 
   BIND(&if_nonsmi_handler);
   {
-    Node* handler_map = LoadMap(handler);
-    GotoIf(IsWeakCellMap(handler_map), &store_transition_or_global);
+    GotoIf(IsWeakOrClearedHeapObject(handler), &store_transition_or_global);
+    TNode<HeapObject> strong_handler = CAST(handler);
+    TNode<Map> handler_map = LoadMap(strong_handler);
     Branch(IsCodeMap(handler_map), &call_handler, &if_proto_handler);
-  }
 
-  BIND(&if_proto_handler);
-  HandleStoreICProtoHandler(p, handler, miss, ic_mode, support_elements);
+    BIND(&if_proto_handler);
+    {
+      HandleStoreICProtoHandler(p, CAST(strong_handler), miss, ic_mode,
+                                support_elements);
+    }
 
-  // |handler| is a heap object. Must be code, call it.
-  BIND(&call_handler);
-  {
-    StoreWithVectorDescriptor descriptor(isolate());
-    TailCallStub(descriptor, handler, p->context, p->receiver, p->name,
-                 p->value, p->slot, p->vector);
+    // |handler| is a heap object. Must be code, call it.
+    BIND(&call_handler);
+    {
+      TailCallStub(StoreWithVectorDescriptor{}, CAST(strong_handler),
+                   CAST(p->context), p->receiver, p->name, p->value, p->slot,
+                   p->vector);
+    }
   }
 
   BIND(&store_transition_or_global);
   {
     // Load value or miss if the {handler} weak cell is cleared.
-    Node* map_or_property_cell = LoadWeakCellValue(handler, miss);
+    CSA_ASSERT(this, IsWeakOrClearedHeapObject(handler));
+    TNode<HeapObject> map_or_property_cell = ToWeakHeapObject(handler, miss);
 
     Label store_global(this), store_transition(this);
     Branch(IsMap(map_or_property_cell), &store_transition, &store_global);
 
     BIND(&store_global);
     {
+      TNode<PropertyCell> property_cell = CAST(map_or_property_cell);
       ExitPoint direct_exit(this);
-      StoreGlobalIC_PropertyCellCase(map_or_property_cell, p->value,
-                                     &direct_exit, miss);
+      StoreGlobalIC_PropertyCellCase(property_cell, p->value, &direct_exit,
+                                     miss);
     }
     BIND(&store_transition);
-    HandleStoreICTransitionMapHandlerCase(p, map_or_property_cell, miss, false);
-    Return(p->value);
+    {
+      TNode<Map> map = CAST(map_or_property_cell);
+      HandleStoreICTransitionMapHandlerCase(p, map, miss, false);
+      Return(p->value);
+    }
   }
 }
 
 void AccessorAssembler::HandleStoreICTransitionMapHandlerCase(
-    const StoreICParameters* p, Node* transition_map, Label* miss,
+    const StoreICParameters* p, TNode<Map> transition_map, Label* miss,
     bool validate_transition_handler) {
   Node* maybe_validity_cell =
       LoadObjectField(transition_map, Map::kPrototypeValidityCellOffset);
@@ -912,21 +933,21 @@ void AccessorAssembler::HandleStoreICTransitionMapHandlerCase(
   // Load last descriptor details.
   Node* nof = DecodeWordFromWord32<Map::NumberOfOwnDescriptorsBits>(bitfield3);
   CSA_ASSERT(this, WordNotEqual(nof, IntPtrConstant(0)));
-  Node* descriptors = LoadMapDescriptors(transition_map);
+  TNode<DescriptorArray> descriptors = LoadMapDescriptors(transition_map);
 
   Node* factor = IntPtrConstant(DescriptorArray::kEntrySize);
-  Node* last_key_index = IntPtrAdd(
-      IntPtrConstant(DescriptorArray::ToKeyIndex(-1)), IntPtrMul(nof, factor));
+  TNode<IntPtrT> last_key_index = UncheckedCast<IntPtrT>(IntPtrAdd(
+      IntPtrConstant(DescriptorArray::ToKeyIndex(-1)), IntPtrMul(nof, factor)));
   if (validate_transition_handler) {
-    Node* key = LoadFixedArrayElement(descriptors, last_key_index);
+    Node* key = LoadWeakFixedArrayElement(descriptors, last_key_index);
     GotoIf(WordNotEqual(key, p->name), miss);
   } else {
-    CSA_ASSERT(
-        this,
-        WordEqual(LoadFixedArrayElement(descriptors, last_key_index), p->name));
+    CSA_ASSERT(this,
+               WordEqual(BitcastMaybeObjectToWord(LoadWeakFixedArrayElement(
+                             descriptors, last_key_index)),
+                         p->name));
   }
-  Node* details =
-      LoadDetailsByKeyIndex<DescriptorArray>(descriptors, last_key_index);
+  Node* details = LoadDetailsByKeyIndex(descriptors, last_key_index);
   if (validate_transition_handler) {
     // Follow transitions only in the following cases:
     // 1) name is a non-private symbol and attributes equal to NONE,
@@ -952,9 +973,9 @@ void AccessorAssembler::HandleStoreICTransitionMapHandlerCase(
                                     true);
 }
 
-void AccessorAssembler::CheckFieldType(Node* descriptors, Node* name_index,
-                                       Node* representation, Node* value,
-                                       Label* bailout) {
+void AccessorAssembler::CheckFieldType(TNode<DescriptorArray> descriptors,
+                                       Node* name_index, Node* representation,
+                                       Node* value, Label* bailout) {
   Label r_smi(this), r_double(this), r_heapobject(this), all_fine(this);
   // Ignore FLAG_track_fields etc. and always emit code for all checks,
   // because this builtin is part of the snapshot and therefore should
@@ -990,20 +1011,25 @@ void AccessorAssembler::CheckFieldType(Node* descriptors, Node* name_index,
   BIND(&r_heapobject);
   {
     GotoIf(TaggedIsSmi(value), bailout);
-    Node* field_type =
-        LoadValueByKeyIndex<DescriptorArray>(descriptors, name_index);
+    TNode<MaybeObject> field_type = LoadFieldTypeByKeyIndex(
+        descriptors, UncheckedCast<IntPtrT>(name_index));
     intptr_t kNoneType = reinterpret_cast<intptr_t>(FieldType::None());
     intptr_t kAnyType = reinterpret_cast<intptr_t>(FieldType::Any());
+    DCHECK_NE(kNoneType, kClearedWeakHeapObject);
+    DCHECK_NE(kAnyType, kClearedWeakHeapObject);
     // FieldType::None can't hold any value.
-    GotoIf(WordEqual(field_type, IntPtrConstant(kNoneType)), bailout);
+    GotoIf(WordEqual(BitcastMaybeObjectToWord(field_type),
+                     IntPtrConstant(kNoneType)),
+           bailout);
     // FieldType::Any can hold any value.
-    GotoIf(WordEqual(field_type, IntPtrConstant(kAnyType)), &all_fine);
-    CSA_ASSERT(this, IsWeakCell(field_type));
-    // Cleared WeakCells count as FieldType::None, which can't hold any value.
-    field_type = LoadWeakCellValue(field_type, bailout);
+    GotoIf(WordEqual(BitcastMaybeObjectToWord(field_type),
+                     IntPtrConstant(kAnyType)),
+           &all_fine);
+    // Cleared weak references count as FieldType::None, which can't hold any
+    // value.
+    TNode<Map> field_type_map = CAST(ToWeakHeapObject(field_type, bailout));
     // FieldType::Class(...) performs a map check.
-    CSA_ASSERT(this, IsMap(field_type));
-    Branch(WordEqual(LoadMap(value), field_type), &all_fine, bailout);
+    Branch(WordEqual(LoadMap(value), field_type_map), &all_fine, bailout);
   }
 
   BIND(&all_fine);
@@ -1028,16 +1054,17 @@ void AccessorAssembler::OverwriteExistingFastDataProperty(
     if (FLAG_track_constant_fields && !do_transitioning_store) {
       // TODO(ishell): Taking the slow path is not necessary if new and old
       // values are identical.
-      GotoIf(Word32Equal(DecodeWord32<PropertyDetails::ConstnessField>(details),
-                         Int32Constant(kConst)),
+      GotoIf(Word32Equal(
+                 DecodeWord32<PropertyDetails::ConstnessField>(details),
+                 Int32Constant(static_cast<int32_t>(VariableMode::kConst))),
              slow);
     }
 
     Node* representation =
         DecodeWord32<PropertyDetails::RepresentationField>(details);
 
-    CheckFieldType(descriptors, descriptor_name_index, representation, value,
-                   slow);
+    CheckFieldType(CAST(descriptors), descriptor_name_index, representation,
+                   value, slow);
 
     Node* field_index =
         DecodeWordFromWord32<PropertyDetails::FieldIndexField>(details);
@@ -1068,7 +1095,7 @@ void AccessorAssembler::OverwriteExistingFastDataProperty(
         } else {
           if (do_transitioning_store) {
             Node* mutable_heap_number =
-                AllocateHeapNumberWithValue(double_value, MUTABLE);
+                AllocateMutableHeapNumberWithValue(double_value);
             StoreMap(object, object_map);
             StoreObjectField(object, field_offset, mutable_heap_number);
           } else {
@@ -1107,7 +1134,7 @@ void AccessorAssembler::OverwriteExistingFastDataProperty(
           {
             Node* double_value = ChangeNumberToFloat64(value);
             Node* mutable_heap_number =
-                AllocateHeapNumberWithValue(double_value, MUTABLE);
+                AllocateMutableHeapNumberWithValue(double_value);
             var_value.Bind(mutable_heap_number);
             Goto(&cont);
           }
@@ -1130,7 +1157,7 @@ void AccessorAssembler::OverwriteExistingFastDataProperty(
         BIND(&double_rep);
         {
           Node* mutable_heap_number =
-              LoadFixedArrayElement(properties, backing_store_index);
+              LoadPropertyArrayElement(properties, backing_store_index);
           Node* double_value = ChangeNumberToFloat64(value);
           StoreHeapNumberValue(mutable_heap_number, double_value);
           Goto(&done);
@@ -1147,8 +1174,8 @@ void AccessorAssembler::OverwriteExistingFastDataProperty(
   BIND(&if_descriptor);
   {
     // Check that constant matches value.
-    Node* constant = LoadValueByKeyIndex<DescriptorArray>(
-        descriptors, descriptor_name_index);
+    Node* constant = LoadValueByKeyIndex(
+        CAST(descriptors), UncheckedCast<IntPtrT>(descriptor_name_index));
     GotoIf(WordNotEqual(value, constant), slow);
 
     if (do_transitioning_store) {
@@ -1187,8 +1214,8 @@ void AccessorAssembler::HandleStoreAccessor(const StoreICParameters* p,
 }
 
 void AccessorAssembler::HandleStoreICProtoHandler(
-    const StoreICParameters* p, Node* handler, Label* miss, ICMode ic_mode,
-    ElementSupport support_elements) {
+    const StoreICParameters* p, TNode<StoreHandler> handler, Label* miss,
+    ICMode ic_mode, ElementSupport support_elements) {
   Comment("HandleStoreICProtoHandler");
 
   OnCodeHandler on_code_handler;
@@ -1201,22 +1228,22 @@ void AccessorAssembler::HandleStoreICProtoHandler(
              &if_transitioning_element_store);
       BIND(&if_element_store);
       {
-        StoreWithVectorDescriptor descriptor(isolate());
-        TailCallStub(descriptor, code_handler, p->context, p->receiver, p->name,
-                     p->value, p->slot, p->vector);
+        TailCallStub(StoreWithVectorDescriptor{}, code_handler, p->context,
+                     p->receiver, p->name, p->value, p->slot, p->vector);
       }
 
       BIND(&if_transitioning_element_store);
       {
-        Node* transition_map_cell = LoadHandlerDataField(handler, 1);
-        Node* transition_map = LoadWeakCellValue(transition_map_cell, miss);
-        CSA_ASSERT(this, IsMap(transition_map));
+        TNode<MaybeObject> maybe_transition_map =
+            LoadHandlerDataField(handler, 1);
+        TNode<Map> transition_map =
+            CAST(ToWeakHeapObject(maybe_transition_map, miss));
 
         GotoIf(IsDeprecatedMap(transition_map), miss);
 
-        StoreTransitionDescriptor descriptor(isolate());
-        TailCallStub(descriptor, code_handler, p->context, p->receiver, p->name,
-                     transition_map, p->value, p->slot, p->vector);
+        TailCallStub(StoreTransitionDescriptor{}, code_handler, p->context,
+                     p->receiver, p->name, transition_map, p->value, p->slot,
+                     p->vector);
       }
     };
   }
@@ -1250,7 +1277,7 @@ void AccessorAssembler::HandleStoreICProtoHandler(
     GotoIf(WordEqual(handler_kind, IntPtrConstant(StoreHandler::kNormal)),
            &if_add_normal);
 
-    Node* holder_cell = LoadHandlerDataField(handler, 1);
+    TNode<WeakCell> holder_cell = CAST(LoadHandlerDataField(handler, 1));
     Node* holder = LoadWeakCellValue(holder_cell, miss);
 
     GotoIf(WordEqual(handler_kind, IntPtrConstant(StoreHandler::kGlobalProxy)),
@@ -1281,11 +1308,11 @@ void AccessorAssembler::HandleStoreICProtoHandler(
       // case is covered above by LookupOnReceiver bit handling of the smi
       // handler.
       Label slow(this);
-      Node* receiver_map = LoadMap(p->receiver);
+      TNode<Map> receiver_map = LoadMap(p->receiver);
       InvalidateValidityCellIfPrototype(receiver_map);
 
-      Node* properties = LoadSlowProperties(p->receiver);
-      Add<NameDictionary>(properties, p->name, p->value, &slow);
+      TNode<NameDictionary> properties = CAST(LoadSlowProperties(p->receiver));
+      Add<NameDictionary>(properties, CAST(p->name), p->value, &slow);
       Return(p->value);
 
       BIND(&slow);
@@ -1309,10 +1336,10 @@ void AccessorAssembler::HandleStoreICProtoHandler(
       // the access check is enabled for this handler or not.
       TNode<Object> context_cell = Select<Object>(
           IsSetWord<LoadHandler::DoAccessCheckOnReceiverBits>(handler_word),
-          [=] { return LoadHandlerDataField(handler, 3); },
-          [=] { return LoadHandlerDataField(handler, 2); });
+          [=] { return CAST(LoadHandlerDataField(handler, 3)); },
+          [=] { return CAST(LoadHandlerDataField(handler, 2)); });
 
-      Node* context = LoadWeakCellValueUnchecked(context_cell);
+      Node* context = LoadWeakCellValueUnchecked(CAST(context_cell));
 
       Node* foreign = LoadObjectField(call_handler_info,
                                       CallHandlerInfo::kJsCallbackOffset);
@@ -1503,12 +1530,13 @@ Node* AccessorAssembler::PrepareValueForStore(Node* handler_word, Node* holder,
              &done);
     }
     Node* descriptor = DecodeWord<StoreHandler::DescriptorBits>(handler_word);
-    Node* maybe_field_type = LoadDescriptorValue(LoadMap(holder), descriptor);
+    TNode<MaybeObject> maybe_field_type =
+        LoadDescriptorValueOrFieldType(LoadMap(holder), descriptor);
 
     GotoIf(TaggedIsSmi(maybe_field_type), &done);
     // Check that value type matches the field type.
     {
-      Node* field_type = LoadWeakCellValue(maybe_field_type, bailout);
+      Node* field_type = ToWeakHeapObject(maybe_field_type, bailout);
       Branch(WordEqual(LoadMap(value), field_type), &done, bailout);
     }
     BIND(&done);
@@ -1693,10 +1721,11 @@ void AccessorAssembler::EmitFastElementsBoundsCheck(Node* object,
 }
 
 void AccessorAssembler::EmitElementLoad(
-    Node* object, Node* elements, Node* elements_kind, Node* intptr_index,
-    Node* is_jsarray_condition, Label* if_hole, Label* rebox_double,
-    Variable* var_double_value, Label* unimplemented_elements_kind,
-    Label* out_of_bounds, Label* miss, ExitPoint* exit_point) {
+    Node* object, Node* elements, Node* elements_kind,
+    SloppyTNode<IntPtrT> intptr_index, Node* is_jsarray_condition,
+    Label* if_hole, Label* rebox_double, Variable* var_double_value,
+    Label* unimplemented_elements_kind, Label* out_of_bounds, Label* miss,
+    ExitPoint* exit_point) {
   Label if_typed_array(this), if_fast_packed(this), if_fast_holey(this),
       if_fast_double(this), if_fast_holey_double(this), if_nonfast(this),
       if_dictionary(this);
@@ -1773,19 +1802,10 @@ void AccessorAssembler::EmitElementLoad(
   {
     Comment("dictionary elements");
     GotoIf(IntPtrLessThan(intptr_index, IntPtrConstant(0)), out_of_bounds);
-    VARIABLE(var_entry, MachineType::PointerRepresentation());
-    Label if_found(this);
-    NumberDictionaryLookup(elements, intptr_index, &if_found, &var_entry,
-                           if_hole);
-    BIND(&if_found);
-    // Check that the value is a data property.
-    Node* index = EntryToIndex<NumberDictionary>(var_entry.value());
-    Node* details = LoadDetailsByKeyIndex<NumberDictionary>(elements, index);
-    Node* kind = DecodeWord32<PropertyDetails::KindField>(details);
-    // TODO(jkummerow): Support accessors without missing?
-    GotoIfNot(Word32Equal(kind, Int32Constant(kData)), miss);
-    // Finally, load the value.
-    exit_point->Return(LoadValueByKeyIndex<NumberDictionary>(elements, index));
+
+    TNode<Object> value = BasicLoadNumberDictionaryElement(
+        CAST(elements), intptr_index, miss, if_hole);
+    exit_point->Return(value);
   }
 
   BIND(&if_typed_array);
@@ -1796,8 +1816,7 @@ void AccessorAssembler::EmitElementLoad(
     GotoIf(IsDetachedBuffer(buffer), miss);
 
     // Bounds check.
-    Node* length =
-        SmiUntag(CAST(LoadObjectField(object, JSTypedArray::kLengthOffset)));
+    Node* length = SmiUntag(LoadTypedArrayLength(CAST(object)));
     GotoIfNot(UintPtrLessThan(intptr_index, length), out_of_bounds);
 
     Node* backing_store = LoadFixedTypedArrayBackingStore(CAST(elements));
@@ -1894,12 +1913,13 @@ void AccessorAssembler::EmitElementLoad(
   }
 }
 
-void AccessorAssembler::NameDictionaryNegativeLookup(Node* object, Node* name,
+void AccessorAssembler::NameDictionaryNegativeLookup(Node* object,
+                                                     SloppyTNode<Name> name,
                                                      Label* miss) {
   CSA_ASSERT(this, IsDictionaryMap(LoadMap(object)));
-  Node* properties = LoadSlowProperties(object);
+  TNode<NameDictionary> properties = CAST(LoadSlowProperties(object));
   // Ensure the property does not exist in a dictionary-mode object.
-  VARIABLE(var_name_index, MachineType::PointerRepresentation());
+  TVARIABLE(IntPtrT, var_name_index);
   Label done(this);
   NameDictionaryLookup<NameDictionary>(properties, name, miss, &var_name_index,
                                        &done);
@@ -1961,7 +1981,7 @@ void AccessorAssembler::InvalidateValidityCellIfPrototype(Node* map,
     GotoIf(TaggedIsSmi(maybe_prototype_info), &cont);
 
     Node* function = ExternalConstant(
-        ExternalReference::invalidate_prototype_chains_function(isolate()));
+        ExternalReference::invalidate_prototype_chains_function());
     CallCFunction1(MachineType::AnyTagged(), MachineType::AnyTagged(), function,
                    map);
     Goto(&cont);
@@ -1970,8 +1990,8 @@ void AccessorAssembler::InvalidateValidityCellIfPrototype(Node* map,
 }
 
 void AccessorAssembler::GenericElementLoad(Node* receiver, Node* receiver_map,
-                                           Node* instance_type, Node* index,
-                                           Label* slow) {
+                                           SloppyTNode<Int32T> instance_type,
+                                           Node* index, Label* slow) {
   Comment("integer index");
 
   ExitPoint direct_exit(this);
@@ -1979,9 +1999,7 @@ void AccessorAssembler::GenericElementLoad(Node* receiver, Node* receiver_map,
   Label if_custom(this), if_element_hole(this), if_oob(this);
   // Receivers requiring non-standard element accesses (interceptors, access
   // checks, strings and string wrappers, proxies) are handled in the runtime.
-  GotoIf(Int32LessThanOrEqual(instance_type,
-                              Int32Constant(LAST_CUSTOM_ELEMENTS_RECEIVER)),
-         &if_custom);
+  GotoIf(IsCustomElementsReceiverInstanceType(instance_type), &if_custom);
   Node* elements = LoadElements(receiver);
   Node* elements_kind = LoadMapElementsKind(receiver_map);
   Node* is_jsarray_condition = InstanceTypeEqual(instance_type, JS_ARRAY_TYPE);
@@ -2034,7 +2052,7 @@ void AccessorAssembler::GenericElementLoad(Node* receiver, Node* receiver_map,
 }
 
 void AccessorAssembler::GenericPropertyLoad(Node* receiver, Node* receiver_map,
-                                            Node* instance_type,
+                                            SloppyTNode<Int32T> instance_type,
                                             const LoadICParameters* p,
                                             Label* slow,
                                             UseStubCache use_stub_cache) {
@@ -2057,7 +2075,7 @@ void AccessorAssembler::GenericPropertyLoad(Node* receiver, Node* receiver_map,
 
   // Try looking up the property on the receiver; if unsuccessful, look
   // for a handler in the stub cache.
-  Node* descriptors = LoadMapDescriptors(receiver_map);
+  TNode<DescriptorArray> descriptors = LoadMapDescriptors(receiver_map);
 
   Label if_descriptor_found(this), stub_cache(this);
   TVARIABLE(IntPtrT, var_name_index);
@@ -2077,13 +2095,13 @@ void AccessorAssembler::GenericPropertyLoad(Node* receiver, Node* receiver_map,
   if (use_stub_cache == kUseStubCache) {
     BIND(&stub_cache);
     Comment("stub cache probe for fast property load");
-    VARIABLE(var_handler, MachineRepresentation::kTagged);
+    TVARIABLE(MaybeObject, var_handler);
     Label found_handler(this, &var_handler), stub_cache_miss(this);
     TryProbeStubCache(isolate()->load_stub_cache(), receiver, p->name,
                       &found_handler, &var_handler, &stub_cache_miss);
     BIND(&found_handler);
     {
-      HandleLoadICHandlerCase(p, var_handler.value(), &stub_cache_miss,
+      HandleLoadICHandlerCase(p, CAST(var_handler.value()), &stub_cache_miss,
                               &direct_exit);
     }
 
@@ -2103,11 +2121,11 @@ void AccessorAssembler::GenericPropertyLoad(Node* receiver, Node* receiver_map,
     // We checked for LAST_CUSTOM_ELEMENTS_RECEIVER before, which rules out
     // seeing global objects here (which would need special handling).
 
-    VARIABLE(var_name_index, MachineType::PointerRepresentation());
+    TVARIABLE(IntPtrT, var_name_index);
     Label dictionary_found(this, &var_name_index);
-    Node* properties = LoadSlowProperties(receiver);
-    NameDictionaryLookup<NameDictionary>(properties, p->name, &dictionary_found,
-                                         &var_name_index,
+    TNode<NameDictionary> properties = CAST(LoadSlowProperties(receiver));
+    NameDictionaryLookup<NameDictionary>(properties, CAST(p->name),
+                                         &dictionary_found, &var_name_index,
                                          &lookup_prototype_chain);
     BIND(&dictionary_found);
     {
@@ -2182,7 +2200,7 @@ void AccessorAssembler::GenericPropertyLoad(Node* receiver, Node* receiver_map,
     direct_exit.ReturnCallStub(
         Builtins::CallableFor(isolate(), Builtins::kProxyGetProperty),
         p->context, receiver /*holder is the same as receiver*/, p->name,
-        receiver);
+        receiver, SmiConstant(OnNonExistent::kReturnUndefined));
   }
 }
 
@@ -2226,12 +2244,10 @@ Node* AccessorAssembler::StubCacheSecondaryOffset(Node* name, Node* seed) {
   return ChangeUint32ToWord(Word32And(hash, Int32Constant(mask)));
 }
 
-void AccessorAssembler::TryProbeStubCacheTable(StubCache* stub_cache,
-                                               StubCacheTable table_id,
-                                               Node* entry_offset, Node* name,
-                                               Node* map, Label* if_handler,
-                                               Variable* var_handler,
-                                               Label* if_miss) {
+void AccessorAssembler::TryProbeStubCacheTable(
+    StubCache* stub_cache, StubCacheTable table_id, Node* entry_offset,
+    Node* name, Node* map, Label* if_handler,
+    TVariable<MaybeObject>* var_handler, Label* if_miss) {
   StubCache::Table table = static_cast<StubCache::Table>(table_id);
 #ifdef DEBUG
   if (FLAG_test_secondary_stub_cache && table == StubCache::kPrimary) {
@@ -2248,8 +2264,8 @@ void AccessorAssembler::TryProbeStubCacheTable(StubCache* stub_cache,
   entry_offset = IntPtrMul(entry_offset, IntPtrConstant(kMultiplier));
 
   // Check that the key in the entry matches the name.
-  Node* key_base =
-      ExternalConstant(ExternalReference(stub_cache->key_reference(table)));
+  Node* key_base = ExternalConstant(
+      ExternalReference::Create(stub_cache->key_reference(table)));
   Node* entry_key = Load(MachineType::Pointer(), key_base, entry_offset);
   GotoIf(WordNotEqual(name, entry_key), if_miss);
 
@@ -2263,17 +2279,18 @@ void AccessorAssembler::TryProbeStubCacheTable(StubCache* stub_cache,
 
   DCHECK_EQ(kPointerSize, stub_cache->value_reference(table).address() -
                               stub_cache->key_reference(table).address());
-  Node* handler = Load(MachineType::TaggedPointer(), key_base,
-                       IntPtrAdd(entry_offset, IntPtrConstant(kPointerSize)));
+  TNode<MaybeObject> handler = ReinterpretCast<MaybeObject>(
+      Load(MachineType::TaggedPointer(), key_base,
+           IntPtrAdd(entry_offset, IntPtrConstant(kPointerSize))));
 
   // We found the handler.
-  var_handler->Bind(handler);
+  *var_handler = handler;
   Goto(if_handler);
 }
 
 void AccessorAssembler::TryProbeStubCache(StubCache* stub_cache, Node* receiver,
                                           Node* name, Label* if_handler,
-                                          Variable* var_handler,
+                                          TVariable<MaybeObject>* var_handler,
                                           Label* if_miss) {
   Label try_secondary(this), miss(this);
 
@@ -2327,22 +2344,22 @@ void AccessorAssembler::LoadIC_BytecodeHandler(const LoadICParameters* p,
     Node* recv_map = LoadReceiverMap(p->receiver);
     GotoIf(IsDeprecatedMap(recv_map), &miss);
 
-    VARIABLE(var_handler, MachineRepresentation::kTagged);
+    TVARIABLE(MaybeObject, var_handler);
     Label try_polymorphic(this), if_handler(this, &var_handler);
 
-    Node* feedback =
+    TNode<MaybeObject> feedback =
         TryMonomorphicCase(p->slot, p->vector, recv_map, &if_handler,
                            &var_handler, &try_polymorphic);
 
     BIND(&if_handler);
-    HandleLoadICHandlerCase(p, var_handler.value(), &miss, exit_point);
+    HandleLoadICHandlerCase(p, CAST(var_handler.value()), &miss, exit_point);
 
     BIND(&try_polymorphic);
     {
-      GotoIfNot(WordEqual(LoadMap(feedback), FixedArrayMapConstant()),
-                &stub_call);
-      HandlePolymorphicCase(recv_map, feedback, &if_handler, &var_handler,
-                            &miss, 2);
+      TNode<HeapObject> strong_feedback = ToStrongHeapObject(feedback, &miss);
+      GotoIfNot(IsWeakFixedArrayMap(LoadMap(strong_feedback)), &stub_call);
+      HandlePolymorphicCase(recv_map, CAST(strong_feedback), &if_handler,
+                            &var_handler, &miss, 2);
     }
   }
 
@@ -2372,7 +2389,7 @@ void AccessorAssembler::LoadIC(const LoadICParameters* p) {
 
   ExitPoint direct_exit(this);
 
-  VARIABLE(var_handler, MachineRepresentation::kTagged);
+  TVARIABLE(MaybeObject, var_handler);
   Label if_handler(this, &var_handler), non_inlined(this, Label::kDeferred),
       try_polymorphic(this), miss(this, Label::kDeferred);
 
@@ -2380,25 +2397,27 @@ void AccessorAssembler::LoadIC(const LoadICParameters* p) {
   GotoIf(IsDeprecatedMap(receiver_map), &miss);
 
   // Check monomorphic case.
-  Node* feedback =
+  TNode<MaybeObject> feedback =
       TryMonomorphicCase(p->slot, p->vector, receiver_map, &if_handler,
                          &var_handler, &try_polymorphic);
   BIND(&if_handler);
-  HandleLoadICHandlerCase(p, var_handler.value(), &miss, &direct_exit);
+  HandleLoadICHandlerCase(p, CAST(var_handler.value()), &miss, &direct_exit);
 
   BIND(&try_polymorphic);
+  TNode<HeapObject> strong_feedback = ToStrongHeapObject(feedback, &miss);
   {
     // Check polymorphic case.
     Comment("LoadIC_try_polymorphic");
-    GotoIfNot(WordEqual(LoadMap(feedback), FixedArrayMapConstant()),
-              &non_inlined);
-    HandlePolymorphicCase(receiver_map, feedback, &if_handler, &var_handler,
-                          &miss, 2);
+    GotoIfNot(IsWeakFixedArrayMap(LoadMap(strong_feedback)), &non_inlined);
+    HandlePolymorphicCase(receiver_map, CAST(strong_feedback), &if_handler,
+                          &var_handler, &miss, 2);
   }
 
   BIND(&non_inlined);
-  LoadIC_Noninlined(p, receiver_map, feedback, &var_handler, &if_handler, &miss,
-                    &direct_exit);
+  {
+    LoadIC_Noninlined(p, receiver_map, strong_feedback, &var_handler,
+                      &if_handler, &miss, &direct_exit);
+  }
 
   BIND(&miss);
   direct_exit.ReturnCallRuntime(Runtime::kLoadIC_Miss, p->context, p->receiver,
@@ -2406,8 +2425,9 @@ void AccessorAssembler::LoadIC(const LoadICParameters* p) {
 }
 
 void AccessorAssembler::LoadIC_Noninlined(const LoadICParameters* p,
-                                          Node* receiver_map, Node* feedback,
-                                          Variable* var_handler,
+                                          Node* receiver_map,
+                                          TNode<HeapObject> feedback,
+                                          TVariable<MaybeObject>* var_handler,
                                           Label* if_handler, Label* miss,
                                           ExitPoint* exit_point) {
   Label try_uninitialized(this, Label::kDeferred);
@@ -2415,9 +2435,8 @@ void AccessorAssembler::LoadIC_Noninlined(const LoadICParameters* p,
   // Neither deprecated map nor monomorphic. These cases are handled in the
   // bytecode handler.
   CSA_ASSERT(this, Word32BinaryNot(IsDeprecatedMap(receiver_map)));
-  CSA_ASSERT(this,
-             WordNotEqual(receiver_map, LoadWeakCellValueUnchecked(feedback)));
-  CSA_ASSERT(this, WordNotEqual(LoadMap(feedback), FixedArrayMapConstant()));
+  CSA_ASSERT(this, WordNotEqual(receiver_map, feedback));
+  CSA_ASSERT(this, Word32BinaryNot(IsWeakFixedArrayMap(LoadMap(feedback))));
   DCHECK_EQ(MachineRepresentation::kTagged, var_handler->rep());
 
   {
@@ -2520,17 +2539,16 @@ void AccessorAssembler::LoadGlobalIC_TryPropertyCellCase(
   Comment("LoadGlobalIC_TryPropertyCellCase");
 
   Label if_lexical_var(this), if_property_cell(this);
-  TNode<Object> maybe_weak_cell =
+  TNode<MaybeObject> maybe_weak_ref =
       LoadFeedbackVectorSlot(vector, slot, 0, slot_mode);
-  Branch(TaggedIsSmi(maybe_weak_cell), &if_lexical_var, &if_property_cell);
+  Branch(TaggedIsSmi(maybe_weak_ref), &if_lexical_var, &if_property_cell);
 
   BIND(&if_property_cell);
   {
-    TNode<WeakCell> weak_cell = CAST(maybe_weak_cell);
-
-    // Load value or try handler case if the {weak_cell} is cleared.
+    // Load value or try handler case if the weak reference is cleared.
+    CSA_ASSERT(this, IsWeakOrClearedHeapObject(maybe_weak_ref));
     TNode<PropertyCell> property_cell =
-        CAST(LoadWeakCellValue(weak_cell, try_handler));
+        CAST(ToWeakHeapObject(maybe_weak_ref, try_handler));
     TNode<Object> value =
         LoadObjectField(property_cell, PropertyCell::kValueOffset);
     GotoIf(WordEqual(value, TheHoleConstant()), miss);
@@ -2540,7 +2558,7 @@ void AccessorAssembler::LoadGlobalIC_TryPropertyCellCase(
   BIND(&if_lexical_var);
   {
     Comment("Load lexical variable");
-    TNode<IntPtrT> lexical_handler = SmiUntag(CAST(maybe_weak_cell));
+    TNode<IntPtrT> lexical_handler = SmiUntag(CAST(maybe_weak_ref));
     TNode<IntPtrT> context_index =
         Signed(DecodeWord<FeedbackNexus::ContextIndexBits>(lexical_handler));
     TNode<IntPtrT> slot_index =
@@ -2561,7 +2579,9 @@ void AccessorAssembler::LoadGlobalIC_TryHandlerCase(
 
   Label call_handler(this), non_smi(this);
 
-  Node* handler = LoadFeedbackVectorSlot(vector, slot, kPointerSize, slot_mode);
+  TNode<MaybeObject> feedback_element =
+      LoadFeedbackVectorSlot(vector, slot, kPointerSize, slot_mode);
+  TNode<Object> handler = CAST(feedback_element);
   GotoIf(WordEqual(handler, LoadRoot(Heap::kuninitialized_symbolRootIndex)),
          miss);
 
@@ -2585,7 +2605,7 @@ void AccessorAssembler::LoadGlobalIC_TryHandlerCase(
 void AccessorAssembler::KeyedLoadIC(const LoadICParameters* p) {
   ExitPoint direct_exit(this);
 
-  VARIABLE(var_handler, MachineRepresentation::kTagged);
+  TVARIABLE(MaybeObject, var_handler);
   Label if_handler(this, &var_handler), try_polymorphic(this, Label::kDeferred),
       try_megamorphic(this, Label::kDeferred),
       try_polymorphic_name(this, Label::kDeferred),
@@ -2595,31 +2615,32 @@ void AccessorAssembler::KeyedLoadIC(const LoadICParameters* p) {
   GotoIf(IsDeprecatedMap(receiver_map), &miss);
 
   // Check monomorphic case.
-  Node* feedback =
+  TNode<MaybeObject> feedback =
       TryMonomorphicCase(p->slot, p->vector, receiver_map, &if_handler,
                          &var_handler, &try_polymorphic);
   BIND(&if_handler);
   {
-    HandleLoadICHandlerCase(p, var_handler.value(), &miss, &direct_exit,
+    HandleLoadICHandlerCase(p, CAST(var_handler.value()), &miss, &direct_exit,
                             ICMode::kNonGlobalIC,
                             OnNonExistent::kReturnUndefined, kSupportElements);
   }
 
   BIND(&try_polymorphic);
+  TNode<HeapObject> strong_feedback = ToStrongHeapObject(feedback, &miss);
   {
     // Check polymorphic case.
     Comment("KeyedLoadIC_try_polymorphic");
-    GotoIfNot(WordEqual(LoadMap(feedback), FixedArrayMapConstant()),
-              &try_megamorphic);
-    HandlePolymorphicCase(receiver_map, feedback, &if_handler, &var_handler,
-                          &miss, 2);
+    GotoIfNot(IsWeakFixedArrayMap(LoadMap(strong_feedback)), &try_megamorphic);
+    HandlePolymorphicCase(receiver_map, CAST(strong_feedback), &if_handler,
+                          &var_handler, &miss, 2);
   }
 
   BIND(&try_megamorphic);
   {
     // Check megamorphic case.
     Comment("KeyedLoadIC_try_megamorphic");
-    GotoIfNot(WordEqual(feedback, LoadRoot(Heap::kmegamorphic_symbolRootIndex)),
+    GotoIfNot(WordEqual(strong_feedback,
+                        LoadRoot(Heap::kmegamorphic_symbolRootIndex)),
               &try_polymorphic_name);
     // TODO(jkummerow): Inline this? Or some of it?
     TailCallBuiltin(Builtins::kKeyedLoadIC_Megamorphic, p->context, p->receiver,
@@ -2627,7 +2648,8 @@ void AccessorAssembler::KeyedLoadIC(const LoadICParameters* p) {
   }
   BIND(&try_polymorphic_name);
   {
-    // We might have a name in feedback, and a fixed array in the next slot.
+    // We might have a name in feedback, and a weak fixed array in the next
+    // slot.
     Node* name = p->name;
     Comment("KeyedLoadIC_try_polymorphic_name");
     VARIABLE(var_name, MachineRepresentation::kTagged, name);
@@ -2636,7 +2658,7 @@ void AccessorAssembler::KeyedLoadIC(const LoadICParameters* p) {
         if_notinternalized(this, Label::kDeferred);
 
     // Fast-case: The recorded {feedback} matches the {name}.
-    GotoIf(WordEqual(feedback, name), &if_polymorphic_name);
+    GotoIf(WordEqual(strong_feedback, name), &if_polymorphic_name);
 
     // Try to internalize the {name} if it isn't already.
     TryToName(name, &miss, &var_index, &if_internalized, &var_name, &miss,
@@ -2645,7 +2667,7 @@ void AccessorAssembler::KeyedLoadIC(const LoadICParameters* p) {
     BIND(&if_internalized);
     {
       // The {var_name} now contains a unique name.
-      Branch(WordEqual(feedback, var_name.value()), &if_polymorphic_name,
+      Branch(WordEqual(strong_feedback, var_name.value()), &if_polymorphic_name,
              &miss);
     }
 
@@ -2653,7 +2675,7 @@ void AccessorAssembler::KeyedLoadIC(const LoadICParameters* p) {
     {
       // Try to internalize the {name}.
       Node* function = ExternalConstant(
-          ExternalReference::try_internalize_string_function(isolate()));
+          ExternalReference::try_internalize_string_function());
       var_name.Bind(CallCFunction1(MachineType::AnyTagged(),
                                    MachineType::AnyTagged(), function, name));
       Goto(&if_internalized);
@@ -2661,8 +2683,8 @@ void AccessorAssembler::KeyedLoadIC(const LoadICParameters* p) {
 
     BIND(&if_polymorphic_name);
     {
-      // If the name comparison succeeded, we know we have a fixed array with
-      // at least one map/handler pair.
+      // If the name comparison succeeded, we know we have a weak fixed array
+      // with at least one map/handler pair.
       Node* name = var_name.value();
       TailCallBuiltin(Builtins::kKeyedLoadIC_PolymorphicName, p->context,
                       p->receiver, name, p->slot, p->vector);
@@ -2743,7 +2765,7 @@ void AccessorAssembler::KeyedLoadICGeneric(const LoadICParameters* p) {
 }
 
 void AccessorAssembler::KeyedLoadICPolymorphicName(const LoadICParameters* p) {
-  VARIABLE(var_handler, MachineRepresentation::kTagged);
+  TVARIABLE(MaybeObject, var_handler);
   Label if_handler(this, &var_handler), miss(this, Label::kDeferred);
 
   Node* receiver = p->receiver;
@@ -2758,19 +2780,20 @@ void AccessorAssembler::KeyedLoadICPolymorphicName(const LoadICParameters* p) {
   // LoadIC handler logic below.
   CSA_ASSERT(this, IsName(name));
   CSA_ASSERT(this, Word32BinaryNot(IsDeprecatedMap(receiver_map)));
-  CSA_ASSERT(this, WordEqual(name, LoadFeedbackVectorSlot(vector, slot, 0,
-                                                          SMI_PARAMETERS)));
+  CSA_ASSERT(this, WordEqual(name, CAST(LoadFeedbackVectorSlot(
+                                       vector, slot, 0, SMI_PARAMETERS))));
 
   // Check if we have a matching handler for the {receiver_map}.
-  Node* array =
+  TNode<MaybeObject> feedback_element =
       LoadFeedbackVectorSlot(vector, slot, kPointerSize, SMI_PARAMETERS);
+  TNode<WeakFixedArray> array = CAST(feedback_element);
   HandlePolymorphicCase(receiver_map, array, &if_handler, &var_handler, &miss,
                         1);
 
   BIND(&if_handler);
   {
     ExitPoint direct_exit(this);
-    HandleLoadICHandlerCase(p, var_handler.value(), &miss, &direct_exit,
+    HandleLoadICHandlerCase(p, CAST(var_handler.value()), &miss, &direct_exit,
                             ICMode::kNonGlobalIC,
                             OnNonExistent::kReturnUndefined, kOnlyProperties);
   }
@@ -2784,8 +2807,12 @@ void AccessorAssembler::KeyedLoadICPolymorphicName(const LoadICParameters* p) {
 }
 
 void AccessorAssembler::StoreIC(const StoreICParameters* p) {
-  VARIABLE(var_handler, MachineRepresentation::kTagged);
-  Label if_handler(this, &var_handler), try_polymorphic(this, Label::kDeferred),
+  TVARIABLE(MaybeObject, var_handler,
+            ReinterpretCast<MaybeObject>(SmiConstant(0)));
+
+  Label if_handler(this, &var_handler),
+      if_handler_from_stub_cache(this, &var_handler, Label::kDeferred),
+      try_polymorphic(this, Label::kDeferred),
       try_megamorphic(this, Label::kDeferred),
       try_uninitialized(this, Label::kDeferred), miss(this, Label::kDeferred);
 
@@ -2793,7 +2820,7 @@ void AccessorAssembler::StoreIC(const StoreICParameters* p) {
   GotoIf(IsDeprecatedMap(receiver_map), &miss);
 
   // Check monomorphic case.
-  Node* feedback =
+  TNode<MaybeObject> feedback =
       TryMonomorphicCase(p->slot, p->vector, receiver_map, &if_handler,
                          &var_handler, &try_polymorphic);
   BIND(&if_handler);
@@ -2804,20 +2831,20 @@ void AccessorAssembler::StoreIC(const StoreICParameters* p) {
   }
 
   BIND(&try_polymorphic);
+  TNode<HeapObject> strong_feedback = ToStrongHeapObject(feedback, &miss);
   {
     // Check polymorphic case.
     Comment("StoreIC_try_polymorphic");
-    GotoIfNot(
-        WordEqual(LoadMap(feedback), LoadRoot(Heap::kFixedArrayMapRootIndex)),
-        &try_megamorphic);
-    HandlePolymorphicCase(receiver_map, feedback, &if_handler, &var_handler,
-                          &miss, 2);
+    GotoIfNot(IsWeakFixedArrayMap(LoadMap(strong_feedback)), &try_megamorphic);
+    HandlePolymorphicCase(receiver_map, CAST(strong_feedback), &if_handler,
+                          &var_handler, &miss, 2);
   }
 
   BIND(&try_megamorphic);
   {
     // Check megamorphic case.
-    GotoIfNot(WordEqual(feedback, LoadRoot(Heap::kmegamorphic_symbolRootIndex)),
+    GotoIfNot(WordEqual(strong_feedback,
+                        LoadRoot(Heap::kmegamorphic_symbolRootIndex)),
               &try_uninitialized);
 
     TryProbeStubCache(isolate()->store_stub_cache(), p->receiver, p->name,
@@ -2826,9 +2853,9 @@ void AccessorAssembler::StoreIC(const StoreICParameters* p) {
   BIND(&try_uninitialized);
   {
     // Check uninitialized case.
-    GotoIfNot(
-        WordEqual(feedback, LoadRoot(Heap::kuninitialized_symbolRootIndex)),
-        &miss);
+    GotoIfNot(WordEqual(strong_feedback,
+                        LoadRoot(Heap::kuninitialized_symbolRootIndex)),
+              &miss);
     TailCallBuiltin(Builtins::kStoreIC_Uninitialized, p->context, p->receiver,
                     p->name, p->value, p->slot, p->vector);
   }
@@ -2841,14 +2868,16 @@ void AccessorAssembler::StoreIC(const StoreICParameters* p) {
 
 void AccessorAssembler::StoreGlobalIC(const StoreICParameters* pp) {
   Label if_lexical_var(this), if_property_cell(this);
-  Node* maybe_weak_cell =
+  TNode<MaybeObject> maybe_weak_ref =
       LoadFeedbackVectorSlot(pp->vector, pp->slot, 0, SMI_PARAMETERS);
-  Branch(TaggedIsSmi(maybe_weak_cell), &if_lexical_var, &if_property_cell);
+  Branch(TaggedIsSmi(maybe_weak_ref), &if_lexical_var, &if_property_cell);
 
   BIND(&if_property_cell);
   {
     Label try_handler(this), miss(this, Label::kDeferred);
-    Node* property_cell = LoadWeakCellValue(maybe_weak_cell, &try_handler);
+    CSA_ASSERT(this, IsWeakOrClearedHeapObject(maybe_weak_ref));
+    TNode<PropertyCell> property_cell =
+        CAST(ToWeakHeapObject(maybe_weak_ref, &try_handler));
 
     ExitPoint direct_exit(this);
     StoreGlobalIC_PropertyCellCase(property_cell, pp->value, &direct_exit,
@@ -2857,8 +2886,8 @@ void AccessorAssembler::StoreGlobalIC(const StoreICParameters* pp) {
     BIND(&try_handler);
     {
       Comment("StoreGlobalIC_try_handler");
-      Node* handler = LoadFeedbackVectorSlot(pp->vector, pp->slot, kPointerSize,
-                                             SMI_PARAMETERS);
+      TNode<MaybeObject> handler = LoadFeedbackVectorSlot(
+          pp->vector, pp->slot, kPointerSize, SMI_PARAMETERS);
 
       GotoIf(WordEqual(handler, LoadRoot(Heap::kuninitialized_symbolRootIndex)),
              &miss);
@@ -2882,14 +2911,14 @@ void AccessorAssembler::StoreGlobalIC(const StoreICParameters* pp) {
   BIND(&if_lexical_var);
   {
     Comment("Store lexical variable");
-    TNode<IntPtrT> lexical_handler = SmiUntag(maybe_weak_cell);
+    TNode<IntPtrT> lexical_handler = SmiUntag(CAST(maybe_weak_ref));
     TNode<IntPtrT> context_index =
         Signed(DecodeWord<FeedbackNexus::ContextIndexBits>(lexical_handler));
     TNode<IntPtrT> slot_index =
         Signed(DecodeWord<FeedbackNexus::SlotIndexBits>(lexical_handler));
     TNode<Context> script_context =
         LoadScriptContext(CAST(pp->context), context_index);
-    StoreContextElement(script_context, slot_index, CAST(pp->value));
+    StoreContextElement(script_context, slot_index, pp->value);
     Return(pp->value);
   }
 }
@@ -2961,7 +2990,7 @@ void AccessorAssembler::StoreGlobalIC_PropertyCellCase(Node* property_cell,
 void AccessorAssembler::KeyedStoreIC(const StoreICParameters* p) {
   Label miss(this, Label::kDeferred);
   {
-    VARIABLE(var_handler, MachineRepresentation::kTagged);
+    TVARIABLE(MaybeObject, var_handler);
 
     Label if_handler(this, &var_handler),
         try_polymorphic(this, Label::kDeferred),
@@ -2972,7 +3001,7 @@ void AccessorAssembler::KeyedStoreIC(const StoreICParameters* p) {
     GotoIf(IsDeprecatedMap(receiver_map), &miss);
 
     // Check monomorphic case.
-    Node* feedback =
+    TNode<MaybeObject> feedback =
         TryMonomorphicCase(p->slot, p->vector, receiver_map, &if_handler,
                            &var_handler, &try_polymorphic);
     BIND(&if_handler);
@@ -2983,23 +3012,23 @@ void AccessorAssembler::KeyedStoreIC(const StoreICParameters* p) {
     }
 
     BIND(&try_polymorphic);
+    TNode<HeapObject> strong_feedback = ToStrongHeapObject(feedback, &miss);
     {
       // CheckPolymorphic case.
       Comment("KeyedStoreIC_try_polymorphic");
-      GotoIfNot(
-          WordEqual(LoadMap(feedback), LoadRoot(Heap::kFixedArrayMapRootIndex)),
-          &try_megamorphic);
-      HandlePolymorphicCase(receiver_map, feedback, &if_handler, &var_handler,
-                            &miss, 2);
+      GotoIfNot(IsWeakFixedArrayMap(LoadMap(strong_feedback)),
+                &try_megamorphic);
+      HandlePolymorphicCase(receiver_map, CAST(strong_feedback), &if_handler,
+                            &var_handler, &miss, 2);
     }
 
     BIND(&try_megamorphic);
     {
       // Check megamorphic case.
       Comment("KeyedStoreIC_try_megamorphic");
-      GotoIfNot(
-          WordEqual(feedback, LoadRoot(Heap::kmegamorphic_symbolRootIndex)),
-          &try_polymorphic_name);
+      GotoIfNot(WordEqual(strong_feedback,
+                          LoadRoot(Heap::kmegamorphic_symbolRootIndex)),
+                &try_polymorphic_name);
       TailCallBuiltin(Builtins::kKeyedStoreIC_Megamorphic, p->context,
                       p->receiver, p->name, p->value, p->slot, p->vector);
     }
@@ -3008,11 +3037,12 @@ void AccessorAssembler::KeyedStoreIC(const StoreICParameters* p) {
     {
       // We might have a name in feedback, and a fixed array in the next slot.
       Comment("KeyedStoreIC_try_polymorphic_name");
-      GotoIfNot(WordEqual(feedback, p->name), &miss);
+      GotoIfNot(WordEqual(strong_feedback, p->name), &miss);
       // If the name comparison succeeded, we know we have a feedback vector
       // with at least one map/handler pair.
-      Node* array = LoadFeedbackVectorSlot(p->vector, p->slot, kPointerSize,
-                                           SMI_PARAMETERS);
+      TNode<MaybeObject> feedback_element = LoadFeedbackVectorSlot(
+          p->vector, p->slot, kPointerSize, SMI_PARAMETERS);
+      TNode<WeakFixedArray> array = CAST(feedback_element);
       HandlePolymorphicCase(receiver_map, array, &if_handler, &var_handler,
                             &miss, 1);
     }
@@ -3028,7 +3058,7 @@ void AccessorAssembler::KeyedStoreIC(const StoreICParameters* p) {
 void AccessorAssembler::StoreInArrayLiteralIC(const StoreICParameters* p) {
   Label miss(this, Label::kDeferred);
   {
-    VARIABLE(var_handler, MachineRepresentation::kTagged);
+    TVARIABLE(MaybeObject, var_handler);
 
     Label if_handler(this, &var_handler),
         try_polymorphic(this, Label::kDeferred),
@@ -3036,7 +3066,7 @@ void AccessorAssembler::StoreInArrayLiteralIC(const StoreICParameters* p) {
 
     Node* array_map = LoadReceiverMap(p->receiver);
     GotoIf(IsDeprecatedMap(array_map), &miss);
-    Node* feedback =
+    TNode<MaybeObject> feedback =
         TryMonomorphicCase(p->slot, p->vector, array_map, &if_handler,
                            &var_handler, &try_polymorphic);
 
@@ -3045,35 +3075,34 @@ void AccessorAssembler::StoreInArrayLiteralIC(const StoreICParameters* p) {
       Comment("StoreInArrayLiteralIC_if_handler");
       // This is a stripped-down version of HandleStoreICHandlerCase.
 
-      Node* handler = var_handler.value();
+      TNode<HeapObject> handler = CAST(var_handler.value());
       Label if_transitioning_element_store(this);
       GotoIfNot(IsCode(handler), &if_transitioning_element_store);
-      StoreWithVectorDescriptor descriptor(isolate());
-      TailCallStub(descriptor, handler, p->context, p->receiver, p->name,
-                   p->value, p->slot, p->vector);
+      TailCallStub(StoreWithVectorDescriptor{}, CAST(handler), CAST(p->context),
+                   p->receiver, p->name, p->value, p->slot, p->vector);
 
       BIND(&if_transitioning_element_store);
       {
-        Node* transition_map_cell = LoadHandlerDataField(handler, 1);
-        Node* transition_map = LoadWeakCellValue(transition_map_cell, &miss);
-        CSA_ASSERT(this, IsMap(transition_map));
+        TNode<MaybeObject> maybe_transition_map =
+            LoadHandlerDataField(CAST(handler), 1);
+        TNode<Map> transition_map =
+            CAST(ToWeakHeapObject(maybe_transition_map, &miss));
         GotoIf(IsDeprecatedMap(transition_map), &miss);
         Node* code = LoadObjectField(handler, StoreHandler::kSmiHandlerOffset);
         CSA_ASSERT(this, IsCode(code));
-        StoreTransitionDescriptor descriptor(isolate());
-        TailCallStub(descriptor, code, p->context, p->receiver, p->name,
-                     transition_map, p->value, p->slot, p->vector);
+        TailCallStub(StoreTransitionDescriptor{}, code, p->context, p->receiver,
+                     p->name, transition_map, p->value, p->slot, p->vector);
       }
     }
 
     BIND(&try_polymorphic);
+    TNode<HeapObject> strong_feedback = ToStrongHeapObject(feedback, &miss);
     {
       Comment("StoreInArrayLiteralIC_try_polymorphic");
-      GotoIfNot(
-          WordEqual(LoadMap(feedback), LoadRoot(Heap::kFixedArrayMapRootIndex)),
-          &try_megamorphic);
-      HandlePolymorphicCase(array_map, feedback, &if_handler, &var_handler,
-                            &miss, 2);
+      GotoIfNot(IsWeakFixedArrayMap(LoadMap(strong_feedback)),
+                &try_megamorphic);
+      HandlePolymorphicCase(array_map, CAST(strong_feedback), &if_handler,
+                            &var_handler, &miss, 2);
     }
 
     BIND(&try_megamorphic);
@@ -3081,16 +3110,13 @@ void AccessorAssembler::StoreInArrayLiteralIC(const StoreICParameters* p) {
       Comment("StoreInArrayLiteralIC_try_megamorphic");
       CSA_ASSERT(
           this,
-          Word32Or(
-              Word32Or(
-                  IsWeakCellMap(LoadMap(feedback)),
-                  WordEqual(feedback,
-                            LoadRoot(Heap::kuninitialized_symbolRootIndex))),
-              WordEqual(feedback,
-                        LoadRoot(Heap::kmegamorphic_symbolRootIndex))));
-      GotoIfNot(
-          WordEqual(feedback, LoadRoot(Heap::kmegamorphic_symbolRootIndex)),
-          &miss);
+          Word32Or(WordEqual(strong_feedback,
+                             LoadRoot(Heap::kuninitialized_symbolRootIndex)),
+                   WordEqual(strong_feedback,
+                             LoadRoot(Heap::kmegamorphic_symbolRootIndex))));
+      GotoIfNot(WordEqual(strong_feedback,
+                          LoadRoot(Heap::kmegamorphic_symbolRootIndex)),
+                &miss);
       TailCallRuntime(Runtime::kStoreInArrayLiteralIC_Slow, p->context,
                       p->value, p->receiver, p->name);
     }
@@ -3130,18 +3156,20 @@ void AccessorAssembler::GenerateLoadIC_Noninlined() {
   Node* context = Parameter(Descriptor::kContext);
 
   ExitPoint direct_exit(this);
-  VARIABLE(var_handler, MachineRepresentation::kTagged);
+  TVARIABLE(MaybeObject, var_handler);
   Label if_handler(this, &var_handler), miss(this, Label::kDeferred);
 
   Node* receiver_map = LoadReceiverMap(receiver);
-  Node* feedback = LoadFeedbackVectorSlot(vector, slot, 0, SMI_PARAMETERS);
+  TNode<MaybeObject> feedback_element =
+      LoadFeedbackVectorSlot(vector, slot, 0, SMI_PARAMETERS);
+  TNode<HeapObject> feedback = CAST(feedback_element);
 
   LoadICParameters p(context, receiver, name, slot, vector);
   LoadIC_Noninlined(&p, receiver_map, feedback, &var_handler, &if_handler,
                     &miss, &direct_exit);
 
   BIND(&if_handler);
-  HandleLoadICHandlerCase(&p, var_handler.value(), &miss, &direct_exit);
+  HandleLoadICHandlerCase(&p, CAST(var_handler.value()), &miss, &direct_exit);
 
   BIND(&miss);
   direct_exit.ReturnCallRuntime(Runtime::kLoadIC_Miss, context, receiver, name,
@@ -3173,30 +3201,6 @@ void AccessorAssembler::GenerateLoadICTrampoline() {
   TailCallBuiltin(Builtins::kLoadIC, context, receiver, name, slot, vector);
 }
 
-void AccessorAssembler::GenerateLoadField() {
-  typedef LoadFieldDescriptor Descriptor;
-
-  Node* receiver = Parameter(Descriptor::kReceiver);
-  Node* name = nullptr;
-  Node* slot = nullptr;
-  Node* vector = nullptr;
-  Node* context = Parameter(Descriptor::kContext);
-  LoadICParameters p(context, receiver, name, slot, vector);
-
-  ExitPoint direct_exit(this);
-
-  VARIABLE(var_double_value, MachineRepresentation::kFloat64);
-  Label rebox_double(this, &var_double_value);
-
-  Node* smi_handler = Parameter(Descriptor::kSmiHandler);
-  Node* handler_word = SmiUntag(smi_handler);
-  HandleLoadField(receiver, handler_word, &var_double_value, &rebox_double,
-                  &direct_exit);
-
-  BIND(&rebox_double);
-  Return(AllocateHeapNumberWithValue(var_double_value.value()));
-}
-
 void AccessorAssembler::GenerateLoadGlobalIC(TypeofMode typeof_mode) {
   typedef LoadGlobalWithVectorDescriptor Descriptor;
 
diff --git a/deps/v8/src/ic/accessor-assembler.h b/deps/v8/src/ic/accessor-assembler.h
index 7428eeec4d4988..0aa9f0ab41c3a0 100644
--- a/deps/v8/src/ic/accessor-assembler.h
+++ b/deps/v8/src/ic/accessor-assembler.h
@@ -30,7 +30,6 @@ class AccessorAssembler : public CodeStubAssembler {
   void GenerateLoadIC();
   void GenerateLoadIC_Noninlined();
   void GenerateLoadIC_Uninitialized();
-  void GenerateLoadField();
   void GenerateLoadICTrampoline();
   void GenerateKeyedLoadIC();
   void GenerateKeyedLoadICTrampoline();
@@ -50,7 +49,7 @@ class AccessorAssembler : public CodeStubAssembler {
   void GenerateStoreInArrayLiteralIC();
 
   void TryProbeStubCache(StubCache* stub_cache, Node* receiver, Node* name,
-                         Label* if_handler, Variable* var_handler,
+                         Label* if_handler, TVariable<MaybeObject>* var_handler,
                          Label* if_miss);
 
   Node* StubCachePrimaryOffsetForTesting(Node* name, Node* map) {
@@ -89,25 +88,26 @@ class AccessorAssembler : public CodeStubAssembler {
   void LoadIC_BytecodeHandler(const LoadICParameters* p, ExitPoint* exit_point);
 
   // Loads dataX field from the DataHandler object.
-  TNode<Object> LoadHandlerDataField(SloppyTNode<DataHandler> handler,
-                                     int data_index);
+  TNode<MaybeObject> LoadHandlerDataField(SloppyTNode<DataHandler> handler,
+                                          int data_index);
 
  protected:
   struct StoreICParameters : public LoadICParameters {
-    StoreICParameters(Node* context, Node* receiver, Node* name, Node* value,
-                      Node* slot, Node* vector)
+    StoreICParameters(Node* context, Node* receiver, Node* name,
+                      SloppyTNode<Object> value, Node* slot, Node* vector)
         : LoadICParameters(context, receiver, name, slot, vector),
           value(value) {}
-    Node* value;
+    SloppyTNode<Object> value;
   };
 
   enum class ICMode { kNonGlobalIC, kGlobalIC };
   enum ElementSupport { kOnlyProperties, kSupportElements };
   void HandleStoreICHandlerCase(
-      const StoreICParameters* p, Node* handler, Label* miss, ICMode ic_mode,
-      ElementSupport support_elements = kOnlyProperties);
+      const StoreICParameters* p, TNode<MaybeObject> handler, Label* miss,
+      ICMode ic_mode, ElementSupport support_elements = kOnlyProperties);
   void HandleStoreICTransitionMapHandlerCase(const StoreICParameters* p,
-                                             Node* transition_map, Label* miss,
+                                             TNode<Map> transition_map,
+                                             Label* miss,
                                              bool validate_transition_handler);
 
   void JumpIfDataProperty(Node* details, Label* writable, Label* readonly);
@@ -123,8 +123,8 @@ class AccessorAssembler : public CodeStubAssembler {
                                          Label* slow,
                                          bool do_transitioning_store);
 
-  void CheckFieldType(Node* descriptors, Node* name_index, Node* representation,
-                      Node* value, Label* bailout);
+  void CheckFieldType(TNode<DescriptorArray> descriptors, Node* name_index,
+                      Node* representation, Node* value, Label* bailout);
 
  private:
   // Stub generation entry points.
@@ -133,10 +133,13 @@ class AccessorAssembler : public CodeStubAssembler {
   // logic not inlined into Ignition bytecode handlers.
   void LoadIC(const LoadICParameters* p);
   void LoadIC_Noninlined(const LoadICParameters* p, Node* receiver_map,
-                         Node* feedback, Variable* var_handler,
-                         Label* if_handler, Label* miss, ExitPoint* exit_point);
+                         TNode<HeapObject> feedback,
+                         TVariable<MaybeObject>* var_handler, Label* if_handler,
+                         Label* miss, ExitPoint* exit_point);
 
-  Node* LoadDescriptorValue(Node* map, Node* descriptor);
+  TNode<Object> LoadDescriptorValue(Node* map, Node* descriptor);
+  TNode<MaybeObject> LoadDescriptorValueOrFieldType(Node* map,
+                                                    Node* descriptor);
 
   void LoadIC_Uninitialized(const LoadICParameters* p);
 
@@ -153,17 +156,18 @@ class AccessorAssembler : public CodeStubAssembler {
   // IC dispatcher behavior.
 
   // Checks monomorphic case. Returns {feedback} entry of the vector.
-  Node* TryMonomorphicCase(Node* slot, Node* vector, Node* receiver_map,
-                           Label* if_handler, Variable* var_handler,
-                           Label* if_miss);
-  void HandlePolymorphicCase(Node* receiver_map, Node* feedback,
-                             Label* if_handler, Variable* var_handler,
+  TNode<MaybeObject> TryMonomorphicCase(Node* slot, Node* vector,
+                                        Node* receiver_map, Label* if_handler,
+                                        TVariable<MaybeObject>* var_handler,
+                                        Label* if_miss);
+  void HandlePolymorphicCase(Node* receiver_map, TNode<WeakFixedArray> feedback,
+                             Label* if_handler,
+                             TVariable<MaybeObject>* var_handler,
                              Label* if_miss, int min_feedback_capacity);
 
   // LoadIC implementation.
-  enum class OnNonExistent { kThrowReferenceError, kReturnUndefined };
   void HandleLoadICHandlerCase(
-      const LoadICParameters* p, Node* handler, Label* miss,
+      const LoadICParameters* p, TNode<Object> handler, Label* miss,
       ExitPoint* exit_point, ICMode ic_mode = ICMode::kNonGlobalIC,
       OnNonExistent on_nonexistent = OnNonExistent::kReturnUndefined,
       ElementSupport support_elements = kOnlyProperties);
@@ -203,8 +207,9 @@ class AccessorAssembler : public CodeStubAssembler {
 
   // StoreIC implementation.
 
-  void HandleStoreICProtoHandler(const StoreICParameters* p, Node* handler,
-                                 Label* miss, ICMode ic_mode,
+  void HandleStoreICProtoHandler(const StoreICParameters* p,
+                                 TNode<StoreHandler> handler, Label* miss,
+                                 ICMode ic_mode,
                                  ElementSupport support_elements);
   void HandleStoreICSmiHandlerCase(Node* handler_word, Node* holder,
                                    Node* value, Label* miss);
@@ -225,12 +230,13 @@ class AccessorAssembler : public CodeStubAssembler {
   // KeyedLoadIC_Generic implementation.
 
   void GenericElementLoad(Node* receiver, Node* receiver_map,
-                          Node* instance_type, Node* index, Label* slow);
+                          SloppyTNode<Int32T> instance_type, Node* index,
+                          Label* slow);
 
   enum UseStubCache { kUseStubCache, kDontUseStubCache };
   void GenericPropertyLoad(Node* receiver, Node* receiver_map,
-                           Node* instance_type, const LoadICParameters* p,
-                           Label* slow,
+                           SloppyTNode<Int32T> instance_type,
+                           const LoadICParameters* p, Label* slow,
                            UseStubCache use_stub_cache = kUseStubCache);
 
   // Low-level helpers.
@@ -263,11 +269,13 @@ class AccessorAssembler : public CodeStubAssembler {
                                    Node* intptr_index,
                                    Node* is_jsarray_condition, Label* miss);
   void EmitElementLoad(Node* object, Node* elements, Node* elements_kind,
-                       Node* key, Node* is_jsarray_condition, Label* if_hole,
-                       Label* rebox_double, Variable* var_double_value,
+                       SloppyTNode<IntPtrT> key, Node* is_jsarray_condition,
+                       Label* if_hole, Label* rebox_double,
+                       Variable* var_double_value,
                        Label* unimplemented_elements_kind, Label* out_of_bounds,
                        Label* miss, ExitPoint* exit_point);
-  void NameDictionaryNegativeLookup(Node* object, Node* name, Label* miss);
+  void NameDictionaryNegativeLookup(Node* object, SloppyTNode<Name> name,
+                                    Label* miss);
 
   // Stub cache access helpers.
 
@@ -280,7 +288,8 @@ class AccessorAssembler : public CodeStubAssembler {
 
   void TryProbeStubCacheTable(StubCache* stub_cache, StubCacheTable table_id,
                               Node* entry_offset, Node* name, Node* map,
-                              Label* if_handler, Variable* var_handler,
+                              Label* if_handler,
+                              TVariable<MaybeObject>* var_handler,
                               Label* if_miss);
 };
 
diff --git a/deps/v8/src/ic/binary-op-assembler.cc b/deps/v8/src/ic/binary-op-assembler.cc
index 717c38e3564a1e..9016e9ba18c8a2 100644
--- a/deps/v8/src/ic/binary-op-assembler.cc
+++ b/deps/v8/src/ic/binary-op-assembler.cc
@@ -58,20 +58,20 @@ Node* BinaryOpAssembler::Generate_AddWithFeedback(Node* context, Node* lhs,
 
     {
       Comment("perform smi operation");
-      // Try fast Smi addition first.
-      Node* pair = IntPtrAddWithOverflow(BitcastTaggedToWord(lhs),
-                                         BitcastTaggedToWord(rhs));
-      Node* overflow = Projection(1, pair);
-
-      // Check if the Smi additon overflowed.
       // If rhs is known to be an Smi we want to fast path Smi operation. This
       // is for AddSmi operation. For the normal Add operation, we want to fast
       // path both Smi and Number operations, so this path should not be marked
       // as Deferred.
       Label if_overflow(this,
-                        rhs_is_smi ? Label::kDeferred : Label::kNonDeferred),
-          if_notoverflow(this);
-      Branch(overflow, &if_overflow, &if_notoverflow);
+                        rhs_is_smi ? Label::kDeferred : Label::kNonDeferred);
+      TNode<Smi> smi_result = TrySmiAdd(CAST(lhs), CAST(rhs), &if_overflow);
+      // Not overflowed.
+      {
+        var_type_feedback.Bind(
+            SmiConstant(BinaryOperationFeedback::kSignedSmall));
+        var_result.Bind(smi_result);
+        Goto(&end);
+      }
 
       BIND(&if_overflow);
       {
@@ -79,14 +79,6 @@ Node* BinaryOpAssembler::Generate_AddWithFeedback(Node* context, Node* lhs,
         var_fadd_rhs.Bind(SmiToFloat64(rhs));
         Goto(&do_fadd);
       }
-
-      BIND(&if_notoverflow);
-      {
-        var_type_feedback.Bind(
-            SmiConstant(BinaryOperationFeedback::kSignedSmall));
-        var_result.Bind(BitcastWordToTaggedSigned(Projection(0, pair)));
-        Goto(&end);
-      }
     }
   }
 
@@ -416,34 +408,22 @@ Node* BinaryOpAssembler::Generate_SubtractWithFeedback(Node* context, Node* lhs,
                                                        Node* feedback_vector,
                                                        bool rhs_is_smi) {
   auto smiFunction = [=](Node* lhs, Node* rhs, Variable* var_type_feedback) {
-    VARIABLE(var_result, MachineRepresentation::kTagged);
-    // Try a fast Smi subtraction first.
-    Node* pair = IntPtrSubWithOverflow(BitcastTaggedToWord(lhs),
-                                       BitcastTaggedToWord(rhs));
-    Node* overflow = Projection(1, pair);
-
-    // Check if the Smi subtraction overflowed.
-    Label if_notoverflow(this), end(this);
+    Label end(this);
+    TVARIABLE(Number, var_result);
     // If rhs is known to be an Smi (for SubSmi) we want to fast path Smi
     // operation. For the normal Sub operation, we want to fast path both
     // Smi and Number operations, so this path should not be marked as Deferred.
     Label if_overflow(this,
                       rhs_is_smi ? Label::kDeferred : Label::kNonDeferred);
-    Branch(overflow, &if_overflow, &if_notoverflow);
-
-    BIND(&if_notoverflow);
-    {
-      var_type_feedback->Bind(
-          SmiConstant(BinaryOperationFeedback::kSignedSmall));
-      var_result.Bind(BitcastWordToTaggedSigned(Projection(0, pair)));
-      Goto(&end);
-    }
+    var_result = TrySmiSub(CAST(lhs), CAST(rhs), &if_overflow);
+    var_type_feedback->Bind(SmiConstant(BinaryOperationFeedback::kSignedSmall));
+    Goto(&end);
 
     BIND(&if_overflow);
     {
       var_type_feedback->Bind(SmiConstant(BinaryOperationFeedback::kNumber));
       Node* value = Float64Sub(SmiToFloat64(lhs), SmiToFloat64(rhs));
-      var_result.Bind(AllocateHeapNumberWithValue(value));
+      var_result = AllocateHeapNumberWithValue(value);
       Goto(&end);
     }
 
@@ -463,7 +443,7 @@ Node* BinaryOpAssembler::Generate_MultiplyWithFeedback(Node* context, Node* lhs,
                                                        Node* feedback_vector,
                                                        bool rhs_is_smi) {
   auto smiFunction = [=](Node* lhs, Node* rhs, Variable* var_type_feedback) {
-    Node* result = SmiMul(lhs, rhs);
+    TNode<Number> result = SmiMul(CAST(lhs), CAST(rhs));
     var_type_feedback->Bind(SelectSmiConstant(
         TaggedIsSmi(result), BinaryOperationFeedback::kSignedSmall,
         BinaryOperationFeedback::kNumber));
@@ -487,7 +467,7 @@ Node* BinaryOpAssembler::Generate_DivideWithFeedback(
     // Smi and Number operations, so this path should not be marked as Deferred.
     Label bailout(this, rhs_is_smi ? Label::kDeferred : Label::kNonDeferred),
         end(this);
-    var_result.Bind(TrySmiDiv(lhs, rhs, &bailout));
+    var_result.Bind(TrySmiDiv(CAST(lhs), CAST(rhs), &bailout));
     var_type_feedback->Bind(SmiConstant(BinaryOperationFeedback::kSignedSmall));
     Goto(&end);
 
@@ -515,7 +495,7 @@ Node* BinaryOpAssembler::Generate_ModulusWithFeedback(
     Node* context, Node* dividend, Node* divisor, Node* slot_id,
     Node* feedback_vector, bool rhs_is_smi) {
   auto smiFunction = [=](Node* lhs, Node* rhs, Variable* var_type_feedback) {
-    Node* result = SmiMod(lhs, rhs);
+    TNode<Number> result = SmiMod(CAST(lhs), CAST(rhs));
     var_type_feedback->Bind(SelectSmiConstant(
         TaggedIsSmi(result), BinaryOperationFeedback::kSignedSmall,
         BinaryOperationFeedback::kNumber));
diff --git a/deps/v8/src/ic/call-optimization.cc b/deps/v8/src/ic/call-optimization.cc
index c8705bc6c9a7b3..41928f1c08e536 100644
--- a/deps/v8/src/ic/call-optimization.cc
+++ b/deps/v8/src/ic/call-optimization.cc
@@ -8,15 +8,15 @@
 namespace v8 {
 namespace internal {
 
-CallOptimization::CallOptimization(Handle<Object> function) {
+CallOptimization::CallOptimization(Isolate* isolate, Handle<Object> function) {
   constant_function_ = Handle<JSFunction>::null();
   is_simple_api_call_ = false;
   expected_receiver_type_ = Handle<FunctionTemplateInfo>::null();
   api_call_info_ = Handle<CallHandlerInfo>::null();
   if (function->IsJSFunction()) {
-    Initialize(Handle<JSFunction>::cast(function));
+    Initialize(isolate, Handle<JSFunction>::cast(function));
   } else if (function->IsFunctionTemplateInfo()) {
-    Initialize(Handle<FunctionTemplateInfo>::cast(function));
+    Initialize(isolate, Handle<FunctionTemplateInfo>::cast(function));
   }
 }
 
@@ -48,8 +48,9 @@ Handle<JSObject> CallOptimization::LookupHolderOfExpectedType(
     return Handle<JSObject>::null();
   }
   if (object_map->has_hidden_prototype()) {
-    Handle<JSObject> prototype(JSObject::cast(object_map->prototype()));
-    object_map = handle(prototype->map());
+    JSObject* raw_prototype = JSObject::cast(object_map->prototype());
+    Handle<JSObject> prototype(raw_prototype, raw_prototype->GetIsolate());
+    object_map = handle(prototype->map(), prototype->GetIsolate());
     if (expected_receiver_type_->IsTemplateFor(*object_map)) {
       *holder_lookup = kHolderFound;
       return prototype;
@@ -64,7 +65,7 @@ bool CallOptimization::IsCompatibleReceiver(Handle<Object> receiver,
                                             Handle<JSObject> holder) const {
   DCHECK(is_simple_api_call());
   if (!receiver->IsHeapObject()) return false;
-  Handle<Map> map(HeapObject::cast(*receiver)->map());
+  Handle<Map> map(HeapObject::cast(*receiver)->map(), holder->GetIsolate());
   return IsCompatibleReceiverMap(map, holder);
 }
 
@@ -96,30 +97,30 @@ bool CallOptimization::IsCompatibleReceiverMap(Handle<Map> map,
 }
 
 void CallOptimization::Initialize(
-    Handle<FunctionTemplateInfo> function_template_info) {
-  Isolate* isolate = function_template_info->GetIsolate();
+    Isolate* isolate, Handle<FunctionTemplateInfo> function_template_info) {
   if (function_template_info->call_code()->IsUndefined(isolate)) return;
-  api_call_info_ =
-      handle(CallHandlerInfo::cast(function_template_info->call_code()));
+  api_call_info_ = handle(
+      CallHandlerInfo::cast(function_template_info->call_code()), isolate);
 
   if (!function_template_info->signature()->IsUndefined(isolate)) {
     expected_receiver_type_ =
-        handle(FunctionTemplateInfo::cast(function_template_info->signature()));
+        handle(FunctionTemplateInfo::cast(function_template_info->signature()),
+               isolate);
   }
   is_simple_api_call_ = true;
 }
 
-void CallOptimization::Initialize(Handle<JSFunction> function) {
+void CallOptimization::Initialize(Isolate* isolate,
+                                  Handle<JSFunction> function) {
   if (function.is_null() || !function->is_compiled()) return;
 
   constant_function_ = function;
-  AnalyzePossibleApiFunction(function);
+  AnalyzePossibleApiFunction(isolate, function);
 }
 
-
-void CallOptimization::AnalyzePossibleApiFunction(Handle<JSFunction> function) {
+void CallOptimization::AnalyzePossibleApiFunction(Isolate* isolate,
+                                                  Handle<JSFunction> function) {
   if (!function->shared()->IsApiFunction()) return;
-  Isolate* isolate = function->GetIsolate();
   Handle<FunctionTemplateInfo> info(function->shared()->get_api_func_data(),
                                     isolate);
 
diff --git a/deps/v8/src/ic/call-optimization.h b/deps/v8/src/ic/call-optimization.h
index ee421355e6502f..d87ec4fdb1a032 100644
--- a/deps/v8/src/ic/call-optimization.h
+++ b/deps/v8/src/ic/call-optimization.h
@@ -14,7 +14,7 @@ namespace internal {
 // Holds information about possible function call optimizations.
 class CallOptimization BASE_EMBEDDED {
  public:
-  explicit CallOptimization(Handle<Object> function);
+  CallOptimization(Isolate* isolate, Handle<Object> function);
 
   Context* GetAccessorContext(Map* holder_map) const;
   bool IsCrossContextLazyAccessorPair(Context* native_context,
@@ -52,12 +52,14 @@ class CallOptimization BASE_EMBEDDED {
                                Handle<JSObject> holder) const;
 
  private:
-  void Initialize(Handle<JSFunction> function);
-  void Initialize(Handle<FunctionTemplateInfo> function_template_info);
+  void Initialize(Isolate* isolate, Handle<JSFunction> function);
+  void Initialize(Isolate* isolate,
+                  Handle<FunctionTemplateInfo> function_template_info);
 
   // Determines whether the given function can be called using the
   // fast api call builtin.
-  void AnalyzePossibleApiFunction(Handle<JSFunction> function);
+  void AnalyzePossibleApiFunction(Isolate* isolate,
+                                  Handle<JSFunction> function);
 
   Handle<JSFunction> constant_function_;
   bool is_simple_api_call_;
diff --git a/deps/v8/src/ic/handler-configuration-inl.h b/deps/v8/src/ic/handler-configuration-inl.h
index 08054ef498446a..74ee29edaf337b 100644
--- a/deps/v8/src/ic/handler-configuration-inl.h
+++ b/deps/v8/src/ic/handler-configuration-inl.h
@@ -163,8 +163,9 @@ Handle<Smi> StoreHandler::StoreField(Isolate* isolate, int descriptor,
                                      FieldIndex field_index,
                                      PropertyConstness constness,
                                      Representation representation) {
-  DCHECK_IMPLIES(!FLAG_track_constant_fields, constness == kMutable);
-  Kind kind = constness == kMutable ? kField : kConstField;
+  DCHECK_IMPLIES(!FLAG_track_constant_fields,
+                 constness == PropertyConstness::kMutable);
+  Kind kind = constness == PropertyConstness::kMutable ? kField : kConstField;
   return StoreField(isolate, kind, descriptor, field_index, representation);
 }
 
@@ -187,14 +188,6 @@ Handle<Smi> StoreHandler::StoreApiSetter(Isolate* isolate,
   return handle(Smi::FromInt(config), isolate);
 }
 
-// static
-WeakCell* StoreHandler::GetTransitionCell(Object* handler) {
-  DCHECK(handler->IsStoreHandler());
-  WeakCell* cell = WeakCell::cast(StoreHandler::cast(handler)->data1());
-  DCHECK(!cell->cleared());
-  return cell;
-}
-
 }  // namespace internal
 }  // namespace v8
 
diff --git a/deps/v8/src/ic/handler-configuration.cc b/deps/v8/src/ic/handler-configuration.cc
index 7a5d6a46f78b10..c95e036e1c58b9 100644
--- a/deps/v8/src/ic/handler-configuration.cc
+++ b/deps/v8/src/ic/handler-configuration.cc
@@ -59,7 +59,7 @@ int InitPrototypeChecksImpl(Isolate* isolate, Handle<ICHandler> handler,
     }
   }
   if (fill_handler) {
-    handler->set_data1(*data1);
+    handler->set_data1(MaybeObject::FromObject(*data1));
   }
   Handle<Object> data2;
   if (maybe_data2.ToHandle(&data2)) {
@@ -162,10 +162,10 @@ Handle<Object> LoadHandler::LoadFullChain(Isolate* isolate,
 }
 
 // static
-KeyedAccessLoadMode LoadHandler::GetKeyedAccessLoadMode(Object* handler) {
+KeyedAccessLoadMode LoadHandler::GetKeyedAccessLoadMode(MaybeObject* handler) {
   DisallowHeapAllocation no_gc;
   if (handler->IsSmi()) {
-    int const raw_handler = Smi::cast(handler)->value();
+    int const raw_handler = Smi::cast(handler->ToSmi())->value();
     Kind const kind = KindBits::decode(raw_handler);
     if ((kind == kElement || kind == kIndexedString) &&
         AllowOutOfBoundsBits::decode(raw_handler)) {
@@ -187,21 +187,21 @@ Handle<Object> StoreHandler::StoreElementTransition(
                           .GetCode();
   Handle<Object> validity_cell =
       Map::GetOrCreatePrototypeChainValidityCell(receiver_map, isolate);
-  Handle<WeakCell> cell = Map::WeakCellForMap(transition);
   Handle<StoreHandler> handler = isolate->factory()->NewStoreHandler(1);
   handler->set_smi_handler(*stub);
   handler->set_validity_cell(*validity_cell);
-  handler->set_data1(*cell);
+  handler->set_data1(HeapObjectReference::Weak(*transition));
   return handler;
 }
 
-Handle<Object> StoreHandler::StoreTransition(Isolate* isolate,
-                                             Handle<Map> transition_map) {
+MaybeObjectHandle StoreHandler::StoreTransition(Isolate* isolate,
+                                                Handle<Map> transition_map) {
   bool is_dictionary_map = transition_map->is_dictionary_map();
 #ifdef DEBUG
   if (!is_dictionary_map) {
     int descriptor = transition_map->LastAdded();
-    Handle<DescriptorArray> descriptors(transition_map->instance_descriptors());
+    Handle<DescriptorArray> descriptors(transition_map->instance_descriptors(),
+                                        isolate);
     PropertyDetails details = descriptors->GetDetails(descriptor);
     if (descriptors->GetKey(descriptor)->IsPrivate()) {
       DCHECK_EQ(DONT_ENUM, details.attributes());
@@ -229,15 +229,14 @@ Handle<Object> StoreHandler::StoreTransition(Isolate* isolate,
     int config = KindBits::encode(kNormal) | LookupOnReceiverBits::encode(true);
     handler->set_smi_handler(Smi::FromInt(config));
     handler->set_validity_cell(*validity_cell);
-    return handler;
+    return MaybeObjectHandle(handler);
 
   } else {
     // Ensure the transition map contains a valid prototype validity cell.
     if (!validity_cell.is_null()) {
       transition_map->set_prototype_validity_cell(*validity_cell);
     }
-    Handle<WeakCell> cell = Map::WeakCellForMap(transition_map);
-    return cell;
+    return MaybeObjectHandle::Weak(transition_map);
   }
 }
 
@@ -270,9 +269,9 @@ Handle<Object> StoreHandler::StoreThroughPrototype(
 }
 
 // static
-Handle<Object> StoreHandler::StoreGlobal(Isolate* isolate,
-                                         Handle<PropertyCell> cell) {
-  return isolate->factory()->NewWeakCell(cell);
+MaybeObjectHandle StoreHandler::StoreGlobal(Isolate* isolate,
+                                            Handle<PropertyCell> cell) {
+  return MaybeObjectHandle::Weak(cell);
 }
 
 // static
@@ -287,35 +286,5 @@ Handle<Object> StoreHandler::StoreProxy(Isolate* isolate,
                                holder_cell);
 }
 
-Object* StoreHandler::ValidHandlerOrNull(Object* raw_handler, Name* name,
-                                         Handle<Map>* out_transition) {
-  Smi* valid = Smi::FromInt(Map::kPrototypeChainValid);
-
-  DCHECK(raw_handler->IsStoreHandler());
-
-  // Check validity cell.
-  StoreHandler* handler = StoreHandler::cast(raw_handler);
-
-  Object* raw_validity_cell = handler->validity_cell();
-  // |raw_valitity_cell| can be Smi::kZero if no validity cell is required
-  // (which counts as valid).
-  if (raw_validity_cell->IsCell() &&
-      Cell::cast(raw_validity_cell)->value() != valid) {
-    return nullptr;
-  }
-  // We use this ValidHandlerOrNull() function only for transitioning store
-  // handlers which are not applicable to receivers that require access checks.
-  DCHECK(handler->smi_handler()->IsSmi());
-  DCHECK(
-      !DoAccessCheckOnReceiverBits::decode(Smi::ToInt(handler->smi_handler())));
-
-  // Check if the transition target is deprecated.
-  WeakCell* target_cell = GetTransitionCell(raw_handler);
-  Map* transition = Map::cast(target_cell->value());
-  if (transition->is_deprecated()) return nullptr;
-  *out_transition = handle(transition);
-  return raw_handler;
-}
-
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/src/ic/handler-configuration.h b/deps/v8/src/ic/handler-configuration.h
index 67f7a1d08e0486..4807ad695dd951 100644
--- a/deps/v8/src/ic/handler-configuration.h
+++ b/deps/v8/src/ic/handler-configuration.h
@@ -175,7 +175,7 @@ class LoadHandler final : public DataHandler {
                                               KeyedAccessLoadMode load_mode);
 
   // Decodes the KeyedAccessLoadMode from a {handler}.
-  static KeyedAccessLoadMode GetKeyedAccessLoadMode(Object* handler);
+  static KeyedAccessLoadMode GetKeyedAccessLoadMode(MaybeObject* handler);
 };
 
 // A set of bit fields representing Smi handlers for stores and a HeapObject
@@ -243,18 +243,14 @@ class StoreHandler final : public DataHandler {
   // Make sure we don't overflow the smi.
   STATIC_ASSERT(FieldIndexBits::kNext <= kSmiValueSize);
 
-  static inline WeakCell* GetTransitionCell(Object* handler);
-  static Object* ValidHandlerOrNull(Object* handler, Name* name,
-                                    Handle<Map>* out_transition);
-
   // Creates a Smi-handler for storing a field to fast object.
   static inline Handle<Smi> StoreField(Isolate* isolate, int descriptor,
                                        FieldIndex field_index,
                                        PropertyConstness constness,
                                        Representation representation);
 
-  static Handle<Object> StoreTransition(Isolate* isolate,
-                                        Handle<Map> transition_map);
+  static MaybeObjectHandle StoreTransition(Isolate* isolate,
+                                           Handle<Map> transition_map);
 
   // Creates a Smi-handler for storing a native data property on a fast object.
   static inline Handle<Smi> StoreNativeDataProperty(Isolate* isolate,
@@ -284,8 +280,8 @@ class StoreHandler final : public DataHandler {
 
   // Creates a handler for storing a property to the property cell of a global
   // object.
-  static Handle<Object> StoreGlobal(Isolate* isolate,
-                                    Handle<PropertyCell> cell);
+  static MaybeObjectHandle StoreGlobal(Isolate* isolate,
+                                       Handle<PropertyCell> cell);
 
   // Creates a Smi-handler for storing a property to a global proxy object.
   static inline Handle<Smi> StoreGlobalProxy(Isolate* isolate);
diff --git a/deps/v8/src/ic/ic-inl.h b/deps/v8/src/ic/ic-inl.h
index 83ab9d86b85973..7c95f2fcf05c6e 100644
--- a/deps/v8/src/ic/ic-inl.h
+++ b/deps/v8/src/ic/ic-inl.h
@@ -26,7 +26,7 @@ Address IC::constant_pool() const {
   if (FLAG_enable_embedded_constant_pool) {
     return raw_constant_pool();
   } else {
-    return nullptr;
+    return kNullAddress;
   }
 }
 
@@ -35,14 +35,18 @@ Address IC::raw_constant_pool() const {
   if (FLAG_enable_embedded_constant_pool) {
     return *constant_pool_address_;
   } else {
-    return nullptr;
+    return kNullAddress;
   }
 }
 
-
-bool IC::IsHandler(Object* object) {
-  return (object->IsSmi() && (object != nullptr)) || object->IsDataHandler() ||
-         object->IsWeakCell() || object->IsCode();
+bool IC::IsHandler(MaybeObject* object) {
+  HeapObject* heap_object;
+  return (object->IsSmi() && (object != nullptr)) ||
+         (object->ToWeakHeapObject(&heap_object) &&
+          (heap_object->IsMap() || heap_object->IsPropertyCell())) ||
+         (object->ToStrongHeapObject(&heap_object) &&
+          (heap_object->IsDataHandler() ||
+           heap_object->IsCode()));
 }
 
 bool IC::AddressIsDeoptimizedCode() const {
diff --git a/deps/v8/src/ic/ic.cc b/deps/v8/src/ic/ic.cc
index 8924723951d656..bcedbb967961be 100644
--- a/deps/v8/src/ic/ic.cc
+++ b/deps/v8/src/ic/ic.cc
@@ -20,6 +20,9 @@
 #include "src/ic/stub-cache.h"
 #include "src/isolate-inl.h"
 #include "src/macro-assembler.h"
+#include "src/objects/api-callbacks.h"
+#include "src/objects/hash-table-inl.h"
+#include "src/objects/module-inl.h"
 #include "src/prototype.h"
 #include "src/runtime-profiler.h"
 #include "src/runtime/runtime-utils.h"
@@ -147,9 +150,7 @@ void IC::TraceIC(const char* type, Handle<Object> name, State old_state,
   ICStats::instance()->End();
 }
 
-
-IC::IC(FrameDepth depth, Isolate* isolate, Handle<FeedbackVector> vector,
-       FeedbackSlot slot)
+IC::IC(Isolate* isolate, Handle<FeedbackVector> vector, FeedbackSlot slot)
     : isolate_(isolate),
       vector_set_(false),
       kind_(FeedbackSlotKind::kInvalid),
@@ -168,21 +169,9 @@ IC::IC(FrameDepth depth, Isolate* isolate, Handle<FeedbackVector> vector,
   Address* pc_address =
       reinterpret_cast<Address*>(entry + ExitFrameConstants::kCallerPCOffset);
   Address fp = Memory::Address_at(entry + ExitFrameConstants::kCallerFPOffset);
-  // If there's another JavaScript frame on the stack we need to look one frame
-  // further down the stack to find the frame pointer and the return address
-  // stack slot.
-  if (depth == EXTRA_CALL_FRAME) {
-    if (FLAG_enable_embedded_constant_pool) {
-      constant_pool = reinterpret_cast<Address*>(
-          fp + StandardFrameConstants::kConstantPoolOffset);
-    }
-    const int kCallerPCOffset = StandardFrameConstants::kCallerPCOffset;
-    pc_address = reinterpret_cast<Address*>(fp + kCallerPCOffset);
-    fp = Memory::Address_at(fp + StandardFrameConstants::kCallerFPOffset);
-  }
 #ifdef DEBUG
   StackFrameIterator it(isolate);
-  for (int i = 0; i < depth + 1; i++) it.Advance();
+  for (int i = 0; i < 1; i++) it.Advance();
   StackFrame* frame = it.frame();
   DCHECK(fp == frame->fp() && pc_address == frame->pc_address());
 #endif
@@ -218,7 +207,7 @@ JSFunction* IC::GetHostFunction() const {
   return frame->function();
 }
 
-static void LookupForRead(LookupIterator* it) {
+static void LookupForRead(Isolate* isolate, LookupIterator* it) {
   for (; it->IsFound(); it->Next()) {
     switch (it->state()) {
       case LookupIterator::NOT_FOUND:
@@ -229,8 +218,7 @@ static void LookupForRead(LookupIterator* it) {
       case LookupIterator::INTERCEPTOR: {
         // If there is a getter, return; otherwise loop to perform the lookup.
         Handle<JSObject> holder = it->GetHolder<JSObject>();
-        if (!holder->GetNamedInterceptor()->getter()->IsUndefined(
-                it->isolate())) {
+        if (!holder->GetNamedInterceptor()->getter()->IsUndefined(isolate)) {
           return;
         }
         break;
@@ -267,7 +255,7 @@ bool IC::ShouldRecomputeHandler(Handle<String> name) {
     if (!receiver_map()->IsJSObjectMap()) return false;
     Map* first_map = FirstTargetMap();
     if (first_map == nullptr) return false;
-    Handle<Map> old_map(first_map);
+    Handle<Map> old_map(first_map, isolate());
     if (old_map->is_deprecated()) return true;
     return IsMoreGeneralElementsKindTransition(old_map->elements_kind(),
                                                receiver_map()->elements_kind());
@@ -345,7 +333,7 @@ void IC::OnFeedbackChanged(Isolate* isolate, FeedbackVector* vector,
   if (FLAG_trace_feedback_updates) {
     int slot_count = vector->metadata()->slot_count();
 
-    OFStream os(stdout);
+    StdoutStream os;
     if (slot.IsInvalid()) {
       os << "[Feedback slots in ";
     } else {
@@ -400,6 +388,11 @@ bool IC::ConfigureVectorState(IC::State new_state, Handle<Object> key) {
 
 void IC::ConfigureVectorState(Handle<Name> name, Handle<Map> map,
                               Handle<Object> handler) {
+  ConfigureVectorState(name, map, MaybeObjectHandle(handler));
+}
+
+void IC::ConfigureVectorState(Handle<Name> name, Handle<Map> map,
+                              const MaybeObjectHandle& handler) {
   if (IsGlobalIC()) {
     nexus()->ConfigureHandlerMode(handler);
   } else {
@@ -414,7 +407,7 @@ void IC::ConfigureVectorState(Handle<Name> name, Handle<Map> map,
 }
 
 void IC::ConfigureVectorState(Handle<Name> name, MapHandles const& maps,
-                              ObjectHandles* handlers) {
+                              MaybeObjectHandles* handlers) {
   DCHECK(!IsGlobalIC());
   // Non-keyed ICs don't track the name explicitly.
   if (!is_keyed()) name = Handle<Name>::null();
@@ -436,7 +429,7 @@ MaybeHandle<Object> LoadIC::Load(Handle<Object> object, Handle<Name> name) {
       TraceIC("LoadIC", name);
     }
 
-    if (*name == isolate()->heap()->iterator_symbol()) {
+    if (*name == ReadOnlyRoots(isolate()).iterator_symbol()) {
       return Runtime::ThrowIteratorError(isolate(), object);
     }
     return TypeError(MessageTemplate::kNonObjectPropertyLoad, object, name);
@@ -450,7 +443,7 @@ MaybeHandle<Object> LoadIC::Load(Handle<Object> object, Handle<Name> name) {
   }
   // Named lookup in the object.
   LookupIterator it(object, name);
-  LookupForRead(&it);
+  LookupForRead(isolate(), &it);
 
   if (name->IsPrivate()) {
     if (name->IsPrivateField() && !it.IsFound()) {
@@ -491,7 +484,7 @@ MaybeHandle<Object> LoadGlobalIC::Load(Handle<Name> name) {
     // Look up in script context table.
     Handle<String> str_name = Handle<String>::cast(name);
     Handle<ScriptContextTable> script_contexts(
-        global->native_context()->script_context_table());
+        global->native_context()->script_context_table(), isolate());
 
     ScriptContextTable::LookupResult lookup_result;
     if (ScriptContextTable::Lookup(script_contexts, str_name, &lookup_result)) {
@@ -534,14 +527,15 @@ static bool AddOneReceiverMapIfMissing(MapHandles* receiver_maps,
   return true;
 }
 
-bool IC::UpdatePolymorphicIC(Handle<Name> name, Handle<Object> handler) {
+bool IC::UpdatePolymorphicIC(Handle<Name> name,
+                             const MaybeObjectHandle& handler) {
   DCHECK(IsHandler(*handler));
   if (is_keyed() && state() != RECOMPUTE_HANDLER) {
     if (nexus()->FindFirstName() != *name) return false;
   }
   Handle<Map> map = receiver_map();
   MapHandles maps;
-  ObjectHandles handlers;
+  MaybeObjectHandles handlers;
 
   TargetMaps(&maps);
   int number_of_maps = static_cast<int>(maps.size());
@@ -603,7 +597,8 @@ bool IC::UpdatePolymorphicIC(Handle<Name> name, Handle<Object> handler) {
   return true;
 }
 
-void IC::UpdateMonomorphicIC(Handle<Object> handler, Handle<Name> name) {
+void IC::UpdateMonomorphicIC(const MaybeObjectHandle& handler,
+                             Handle<Name> name) {
   DCHECK(IsHandler(*handler));
   ConfigureVectorState(name, receiver_map(), handler);
 }
@@ -611,11 +606,11 @@ void IC::UpdateMonomorphicIC(Handle<Object> handler, Handle<Name> name) {
 
 void IC::CopyICToMegamorphicCache(Handle<Name> name) {
   MapHandles maps;
-  ObjectHandles handlers;
+  MaybeObjectHandles handlers;
   TargetMaps(&maps);
   if (!nexus()->FindHandlers(&handlers, static_cast<int>(maps.size()))) return;
   for (int i = 0; i < static_cast<int>(maps.size()); i++) {
-    UpdateMegamorphicCache(*maps.at(i), *name, *handlers.at(i));
+    UpdateMegamorphicCache(maps.at(i), name, handlers.at(i));
   }
 }
 
@@ -630,13 +625,18 @@ bool IC::IsTransitionOfMonomorphicTarget(Map* source_map, Map* target_map) {
   Map* transitioned_map = nullptr;
   if (more_general_transition) {
     MapHandles map_list;
-    map_list.push_back(handle(target_map));
-    transitioned_map = source_map->FindElementsKindTransitionedMap(map_list);
+    map_list.push_back(handle(target_map, isolate_));
+    transitioned_map =
+        source_map->FindElementsKindTransitionedMap(isolate(), map_list);
   }
   return transitioned_map == target_map;
 }
 
 void IC::PatchCache(Handle<Name> name, Handle<Object> handler) {
+  PatchCache(name, MaybeObjectHandle(handler));
+}
+
+void IC::PatchCache(Handle<Name> name, const MaybeObjectHandle& handler) {
   DCHECK(IsHandler(*handler));
   // Currently only load and store ICs support non-code handlers.
   DCHECK(IsAnyLoad() || IsAnyStore());
@@ -660,7 +660,7 @@ void IC::PatchCache(Handle<Name> name, Handle<Object> handler) {
       ConfigureVectorState(MEGAMORPHIC, name);
       V8_FALLTHROUGH;
     case MEGAMORPHIC:
-      UpdateMegamorphicCache(*receiver_map(), *name, *handler);
+      UpdateMegamorphicCache(receiver_map(), name, handler);
       // Indicate that we've handled this case.
       vector_set_ = true;
       break;
@@ -719,8 +719,9 @@ StubCache* IC::stub_cache() {
   }
 }
 
-void IC::UpdateMegamorphicCache(Map* map, Name* name, Object* handler) {
-  stub_cache()->Set(name, map, handler);
+void IC::UpdateMegamorphicCache(Handle<Map> map, Handle<Name> name,
+                                const MaybeObjectHandle& handler) {
+  stub_cache()->Set(*name, *map, *handler);
 }
 
 void IC::TraceHandlerCacheHitStats(LookupIterator* lookup) {
@@ -736,21 +737,19 @@ void IC::TraceHandlerCacheHitStats(LookupIterator* lookup) {
 
 Handle<Object> LoadIC::ComputeHandler(LookupIterator* lookup) {
   Handle<Object> receiver = lookup->GetReceiver();
-  if (receiver->IsString() &&
-      *lookup->name() == isolate()->heap()->length_string()) {
+  ReadOnlyRoots roots(isolate());
+  if (receiver->IsString() && *lookup->name() == roots.length_string()) {
     TRACE_HANDLER_STATS(isolate(), LoadIC_StringLength);
     return BUILTIN_CODE(isolate(), LoadIC_StringLength);
   }
 
-  if (receiver->IsStringWrapper() &&
-      *lookup->name() == isolate()->heap()->length_string()) {
+  if (receiver->IsStringWrapper() && *lookup->name() == roots.length_string()) {
     TRACE_HANDLER_STATS(isolate(), LoadIC_StringWrapperLength);
     return BUILTIN_CODE(isolate(), LoadIC_StringWrapperLength);
   }
 
   // Use specialized code for getting prototype of functions.
-  if (receiver->IsJSFunction() &&
-      *lookup->name() == isolate()->heap()->prototype_string() &&
+  if (receiver->IsJSFunction() && *lookup->name() == roots.prototype_string() &&
       JSFunction::cast(*receiver)->has_prototype_slot() &&
       !JSFunction::cast(*receiver)->map()->has_non_instance_prototype()) {
     Handle<Code> stub;
@@ -796,7 +795,8 @@ Handle<Object> LoadIC::ComputeHandler(LookupIterator* lookup) {
       // The method will only return true for absolute truths based on the
       // receiver maps.
       FieldIndex index;
-      if (Accessors::IsJSObjectFieldAccessor(map, lookup->name(), &index)) {
+      if (Accessors::IsJSObjectFieldAccessor(isolate(), map, lookup->name(),
+                                             &index)) {
         TRACE_HANDLER_STATS(isolate(), LoadIC_LoadFieldDH);
         return LoadHandler::LoadField(isolate(), index);
       }
@@ -835,7 +835,7 @@ Handle<Object> LoadIC::ComputeHandler(LookupIterator* lookup) {
 
         Handle<Smi> smi_handler;
 
-        CallOptimization call_optimization(getter);
+        CallOptimization call_optimization(isolate(), getter);
         if (call_optimization.is_simple_api_call()) {
           if (!call_optimization.IsCompatibleReceiverMap(map, holder) ||
               !holder->HasFastProperties()) {
@@ -850,7 +850,7 @@ Handle<Object> LoadIC::ComputeHandler(LookupIterator* lookup) {
               isolate(), holder_lookup == CallOptimization::kHolderIsReceiver);
 
           Handle<Context> context(
-              call_optimization.GetAccessorContext(holder->map()));
+              call_optimization.GetAccessorContext(holder->map()), isolate());
           Handle<WeakCell> context_cell =
               isolate()->factory()->NewWeakCell(context);
           Handle<WeakCell> data_cell = isolate()->factory()->NewWeakCell(
@@ -889,7 +889,7 @@ Handle<Object> LoadIC::ComputeHandler(LookupIterator* lookup) {
 
       Handle<AccessorInfo> info = Handle<AccessorInfo>::cast(accessors);
 
-      if (v8::ToCData<Address>(info->getter()) == nullptr ||
+      if (v8::ToCData<Address>(info->getter()) == kNullAddress ||
           !AccessorInfo::IsCompatibleReceiverMap(isolate(), info, map) ||
           !holder->HasFastProperties() ||
           (info->is_sloppy() && !receiver->IsJSReceiver())) {
@@ -974,9 +974,13 @@ static Handle<Object> TryConvertKey(Handle<Object> key, Isolate* isolate) {
     if (std::isnan(value)) {
       key = isolate->factory()->NaN_string();
     } else {
-      int int_value = FastD2I(value);
-      if (value == int_value && Smi::IsValid(int_value)) {
-        key = handle(Smi::FromInt(int_value), isolate);
+      // Check bounds first to avoid undefined behavior in the conversion
+      // to int.
+      if (value <= Smi::kMaxValue && value >= Smi::kMinValue) {
+        int int_value = FastD2I(value);
+        if (value == int_value) {
+          key = handle(Smi::FromInt(int_value), isolate);
+        }
       }
     }
   } else if (key->IsString()) {
@@ -986,9 +990,9 @@ static Handle<Object> TryConvertKey(Handle<Object> key, Isolate* isolate) {
 }
 
 bool KeyedLoadIC::CanChangeToAllowOutOfBounds(Handle<Map> receiver_map) {
-  Handle<Object> handler;
-  return nexus()->FindHandlerForMap(receiver_map).ToHandle(&handler) &&
-         LoadHandler::GetKeyedAccessLoadMode(*handler) == STANDARD_LOAD;
+  const MaybeObjectHandle& handler = nexus()->FindHandlerForMap(receiver_map);
+  if (handler.is_null()) return false;
+  return LoadHandler::GetKeyedAccessLoadMode(*handler) == STANDARD_LOAD;
 }
 
 void KeyedLoadIC::UpdateLoadElement(Handle<HeapObject> receiver,
@@ -1055,7 +1059,7 @@ void KeyedLoadIC::UpdateLoadElement(Handle<HeapObject> receiver,
     return;
   }
 
-  ObjectHandles handlers;
+  MaybeObjectHandles handlers;
   handlers.reserve(target_receiver_maps.size());
   LoadElementPolymorphicHandlers(&target_receiver_maps, &handlers, load_mode);
   DCHECK_LE(1, target_receiver_maps.size());
@@ -1113,7 +1117,7 @@ Handle<Object> KeyedLoadIC::LoadElementHandler(Handle<Map> receiver_map,
 }
 
 void KeyedLoadIC::LoadElementPolymorphicHandlers(
-    MapHandles* receiver_maps, ObjectHandles* handlers,
+    MapHandles* receiver_maps, MaybeObjectHandles* handlers,
     KeyedAccessLoadMode load_mode) {
   // Filter out deprecated maps to ensure their instances get migrated.
   receiver_maps->erase(
@@ -1127,17 +1131,43 @@ void KeyedLoadIC::LoadElementPolymorphicHandlers(
     // among receiver_maps as unstable because the optimizing compilers may
     // generate an elements kind transition for this kind of receivers.
     if (receiver_map->is_stable()) {
-      Map* tmap = receiver_map->FindElementsKindTransitionedMap(*receiver_maps);
+      Map* tmap = receiver_map->FindElementsKindTransitionedMap(isolate(),
+                                                                *receiver_maps);
       if (tmap != nullptr) {
         receiver_map->NotifyLeafMapLayoutChange();
       }
     }
-    handlers->push_back(LoadElementHandler(receiver_map, load_mode));
+    handlers->push_back(
+        MaybeObjectHandle(LoadElementHandler(receiver_map, load_mode)));
   }
 }
 
 namespace {
 
+bool ConvertKeyToIndex(Handle<Object> receiver, Handle<Object> key,
+                       uint32_t* index) {
+  if (!FLAG_use_ic) return false;
+  if (receiver->IsAccessCheckNeeded() || receiver->IsJSValue()) return false;
+
+  // For regular JSReceiver or String receivers, the {key} must be a positive
+  // array index.
+  if (receiver->IsJSReceiver() || receiver->IsString()) {
+    return key->ToArrayIndex(index);
+  }
+  // For JSTypedArray receivers, we can also support negative keys, which we
+  // just map into the [2**31, 2**32 - 1] range via a bit_cast. This is valid
+  // because JSTypedArray::length is always a Smi, so such keys will always
+  // be detected as OOB.
+  if (receiver->IsJSTypedArray()) {
+    int32_t signed_index;
+    if (key->ToInt32(&signed_index)) {
+      *index = bit_cast<uint32_t>(signed_index);
+      return true;
+    }
+  }
+  return false;
+}
+
 bool IsOutOfBoundsAccess(Handle<Object> receiver, uint32_t index) {
   uint32_t length = 0;
   if (receiver->IsJSArray()) {
@@ -1152,7 +1182,8 @@ bool IsOutOfBoundsAccess(Handle<Object> receiver, uint32_t index) {
   return index >= length;
 }
 
-KeyedAccessLoadMode GetLoadMode(Handle<Object> receiver, uint32_t index) {
+KeyedAccessLoadMode GetLoadMode(Isolate* isolate, Handle<Object> receiver,
+                                uint32_t index) {
   if (IsOutOfBoundsAccess(receiver, index)) {
     if (receiver->IsJSTypedArray()) {
       // For JSTypedArray we never lookup elements in the prototype chain.
@@ -1160,7 +1191,6 @@ KeyedAccessLoadMode GetLoadMode(Handle<Object> receiver, uint32_t index) {
     }
 
     // For other {receiver}s we need to check the "no elements" protector.
-    Isolate* isolate = Handle<HeapObject>::cast(receiver)->GetIsolate();
     if (isolate->IsNoElementsProtectorIntact()) {
       if (receiver->IsString()) {
         // ToObject(receiver) will have the initial String.prototype.
@@ -1210,21 +1240,11 @@ MaybeHandle<Object> KeyedLoadIC::Load(Handle<Object> object,
     ASSIGN_RETURN_ON_EXCEPTION(isolate(), load_handle,
                                LoadIC::Load(object, Handle<Name>::cast(key)),
                                Object);
-  } else if (FLAG_use_ic && !object->IsAccessCheckNeeded() &&
-             !object->IsJSValue()) {
-    // For regular JSReceiver or String {object}s the {key} must be a positive
-    // array index, for JSTypedArray {object}s we can also support negative
-    // {key}s which we just map into the [2*31,2*32-1] range (via a bit_cast).
-    // This is valid since JSTypedArray::length is always a Smi.
-    if (((object->IsJSReceiver() || object->IsString()) &&
-         key->ToArrayIndex(&index)) ||
-        (object->IsJSTypedArray() &&
-         key->ToInt32(bit_cast<int32_t*>(&index)))) {
-      KeyedAccessLoadMode load_mode = GetLoadMode(object, index);
-      UpdateLoadElement(Handle<HeapObject>::cast(object), load_mode);
-      if (is_vector_set()) {
-        TraceIC("LoadIC", key);
-      }
+  } else if (ConvertKeyToIndex(object, key, &index)) {
+    KeyedAccessLoadMode load_mode = GetLoadMode(isolate(), object, index);
+    UpdateLoadElement(Handle<HeapObject>::cast(object), load_mode);
+    if (is_vector_set()) {
+      TraceIC("LoadIC", key);
     }
   }
 
@@ -1265,9 +1285,9 @@ bool StoreIC::LookupForWrite(LookupIterator* it, Handle<Object> value,
           InterceptorInfo* info = holder->GetNamedInterceptor();
           if (it->HolderIsReceiverOrHiddenPrototype()) {
             return !info->non_masking() && receiver.is_identical_to(holder) &&
-                   !info->setter()->IsUndefined(it->isolate());
-          } else if (!info->getter()->IsUndefined(it->isolate()) ||
-                     !info->query()->IsUndefined(it->isolate())) {
+                   !info->setter()->IsUndefined(isolate());
+          } else if (!info->getter()->IsUndefined(isolate()) ||
+                     !info->query()->IsUndefined(isolate())) {
             return false;
           }
           break;
@@ -1292,7 +1312,7 @@ bool StoreIC::LookupForWrite(LookupIterator* it, Handle<Object> value,
 
           // Receiver != holder.
           if (receiver->IsJSGlobalProxy()) {
-            PrototypeIterator iter(it->isolate(), receiver);
+            PrototypeIterator iter(isolate(), receiver);
             return it->GetHolder<Object>().is_identical_to(
                 PrototypeIterator::GetCurrent(iter));
           }
@@ -1322,13 +1342,13 @@ MaybeHandle<Object> StoreGlobalIC::Store(Handle<Name> name,
   Handle<String> str_name = Handle<String>::cast(name);
   Handle<JSGlobalObject> global = isolate()->global_object();
   Handle<ScriptContextTable> script_contexts(
-      global->native_context()->script_context_table());
+      global->native_context()->script_context_table(), isolate());
 
   ScriptContextTable::LookupResult lookup_result;
   if (ScriptContextTable::Lookup(script_contexts, str_name, &lookup_result)) {
     Handle<Context> script_context = ScriptContextTable::GetContext(
         script_contexts, lookup_result.context_index);
-    if (lookup_result.mode == CONST) {
+    if (lookup_result.mode == VariableMode::kConst) {
       return TypeError(MessageTemplate::kConstAssign, global, name);
     }
 
@@ -1422,7 +1442,7 @@ void StoreIC::UpdateCaches(LookupIterator* lookup, Handle<Object> value,
     return;
   }
 
-  Handle<Object> handler;
+  MaybeObjectHandle handler;
   if (LookupForWrite(lookup, value, store_mode)) {
     if (IsStoreGlobalIC()) {
       if (lookup->state() == LookupIterator::DATA &&
@@ -1437,14 +1457,15 @@ void StoreIC::UpdateCaches(LookupIterator* lookup, Handle<Object> value,
     handler = ComputeHandler(lookup);
   } else {
     set_slow_stub_reason("LookupForWrite said 'false'");
-    handler = slow_stub();
+    // TODO(marja): change slow_stub to return MaybeObjectHandle.
+    handler = MaybeObjectHandle(slow_stub());
   }
 
   PatchCache(lookup->name(), handler);
   TraceIC("StoreIC", lookup->name());
 }
 
-Handle<Object> StoreIC::ComputeHandler(LookupIterator* lookup) {
+MaybeObjectHandle StoreIC::ComputeHandler(LookupIterator* lookup) {
   switch (lookup->state()) {
     case LookupIterator::TRANSITION: {
       Handle<JSObject> store_target = lookup->GetStoreTarget<JSObject>();
@@ -1467,7 +1488,7 @@ Handle<Object> StoreIC::ComputeHandler(LookupIterator* lookup) {
             isolate()->factory()->NewWeakCell(lookup->transition_cell());
         Handle<Object> handler = StoreHandler::StoreThroughPrototype(
             isolate(), receiver_map(), store_target, smi_handler, cell);
-        return handler;
+        return MaybeObjectHandle(handler);
       }
       // Dictionary-to-fast transitions are not expected and not supported.
       DCHECK_IMPLIES(!lookup->transition_map()->is_dictionary_map(),
@@ -1485,7 +1506,7 @@ Handle<Object> StoreIC::ComputeHandler(LookupIterator* lookup) {
       DCHECK(!holder->GetNamedInterceptor()->setter()->IsUndefined(isolate()));
       TRACE_HANDLER_STATS(isolate(), StoreIC_StoreInterceptorStub);
       StoreInterceptorStub stub(isolate());
-      return stub.GetCode();
+      return MaybeObjectHandle(stub.GetCode());
     }
 
     case LookupIterator::ACCESSOR: {
@@ -1497,37 +1518,39 @@ Handle<Object> StoreIC::ComputeHandler(LookupIterator* lookup) {
       if (!holder->HasFastProperties()) {
         set_slow_stub_reason("accessor on slow map");
         TRACE_HANDLER_STATS(isolate(), StoreIC_SlowStub);
-        return slow_stub();
+        return MaybeObjectHandle(slow_stub());
       }
       Handle<Object> accessors = lookup->GetAccessors();
       if (accessors->IsAccessorInfo()) {
         Handle<AccessorInfo> info = Handle<AccessorInfo>::cast(accessors);
-        if (v8::ToCData<Address>(info->setter()) == nullptr) {
-          set_slow_stub_reason("setter == nullptr");
+        if (v8::ToCData<Address>(info->setter()) == kNullAddress) {
+          set_slow_stub_reason("setter == kNullAddress");
           TRACE_HANDLER_STATS(isolate(), StoreIC_SlowStub);
-          return slow_stub();
+          return MaybeObjectHandle(slow_stub());
         }
         if (AccessorInfo::cast(*accessors)->is_special_data_property() &&
             !lookup->HolderIsReceiverOrHiddenPrototype()) {
           set_slow_stub_reason("special data property in prototype chain");
           TRACE_HANDLER_STATS(isolate(), StoreIC_SlowStub);
-          return slow_stub();
+          return MaybeObjectHandle(slow_stub());
         }
         if (!AccessorInfo::IsCompatibleReceiverMap(isolate(), info,
                                                    receiver_map())) {
           set_slow_stub_reason("incompatible receiver type");
           TRACE_HANDLER_STATS(isolate(), StoreIC_SlowStub);
-          return slow_stub();
+          return MaybeObjectHandle(slow_stub());
         }
 
         Handle<Smi> smi_handler = StoreHandler::StoreNativeDataProperty(
             isolate(), lookup->GetAccessorIndex());
         TRACE_HANDLER_STATS(isolate(), StoreIC_StoreNativeDataPropertyDH);
-        if (receiver.is_identical_to(holder)) return smi_handler;
+        if (receiver.is_identical_to(holder)) {
+          return MaybeObjectHandle(smi_handler);
+        }
         TRACE_HANDLER_STATS(isolate(),
                             StoreIC_StoreNativeDataPropertyOnPrototypeDH);
-        return StoreHandler::StoreThroughPrototype(isolate(), receiver_map(),
-                                                   holder, smi_handler);
+        return MaybeObjectHandle(StoreHandler::StoreThroughPrototype(
+            isolate(), receiver_map(), holder, smi_handler));
 
       } else if (accessors->IsAccessorPair()) {
         Handle<Object> setter(Handle<AccessorPair>::cast(accessors)->setter(),
@@ -1535,17 +1558,17 @@ Handle<Object> StoreIC::ComputeHandler(LookupIterator* lookup) {
         if (!setter->IsJSFunction() && !setter->IsFunctionTemplateInfo()) {
           set_slow_stub_reason("setter not a function");
           TRACE_HANDLER_STATS(isolate(), StoreIC_SlowStub);
-          return slow_stub();
+          return MaybeObjectHandle(slow_stub());
         }
 
         if (setter->IsFunctionTemplateInfo() &&
             FunctionTemplateInfo::cast(*setter)->BreakAtEntry()) {
           // Do not install an IC if the api function has a breakpoint.
           TRACE_HANDLER_STATS(isolate(), StoreIC_SlowStub);
-          return slow_stub();
+          return MaybeObjectHandle(slow_stub());
         }
 
-        CallOptimization call_optimization(setter);
+        CallOptimization call_optimization(isolate(), setter);
         if (call_optimization.is_simple_api_call()) {
           if (call_optimization.IsCompatibleReceiver(receiver, holder)) {
             CallOptimization::HolderLookup holder_lookup;
@@ -1557,37 +1580,39 @@ Handle<Object> StoreIC::ComputeHandler(LookupIterator* lookup) {
                 holder_lookup == CallOptimization::kHolderIsReceiver);
 
             Handle<Context> context(
-                call_optimization.GetAccessorContext(holder->map()));
+                call_optimization.GetAccessorContext(holder->map()), isolate());
             Handle<WeakCell> context_cell =
                 isolate()->factory()->NewWeakCell(context);
             Handle<WeakCell> data_cell = isolate()->factory()->NewWeakCell(
                 call_optimization.api_call_info());
             TRACE_HANDLER_STATS(isolate(), StoreIC_StoreApiSetterOnPrototypeDH);
-            return StoreHandler::StoreThroughPrototype(
+            return MaybeObjectHandle(StoreHandler::StoreThroughPrototype(
                 isolate(), receiver_map(), holder, smi_handler, data_cell,
-                context_cell);
+                context_cell));
           }
           set_slow_stub_reason("incompatible receiver");
           TRACE_HANDLER_STATS(isolate(), StoreIC_SlowStub);
-          return slow_stub();
+          return MaybeObjectHandle(slow_stub());
         } else if (setter->IsFunctionTemplateInfo()) {
           set_slow_stub_reason("setter non-simple template");
           TRACE_HANDLER_STATS(isolate(), StoreIC_SlowStub);
-          return slow_stub();
+          return MaybeObjectHandle(slow_stub());
         }
 
         Handle<Smi> smi_handler =
             StoreHandler::StoreAccessor(isolate(), lookup->GetAccessorIndex());
 
         TRACE_HANDLER_STATS(isolate(), StoreIC_StoreAccessorDH);
-        if (receiver.is_identical_to(holder)) return smi_handler;
+        if (receiver.is_identical_to(holder)) {
+          return MaybeObjectHandle(smi_handler);
+        }
         TRACE_HANDLER_STATS(isolate(), StoreIC_StoreAccessorOnPrototypeDH);
 
-        return StoreHandler::StoreThroughPrototype(isolate(), receiver_map(),
-                                                   holder, smi_handler);
+        return MaybeObjectHandle(StoreHandler::StoreThroughPrototype(
+            isolate(), receiver_map(), holder, smi_handler));
       }
       TRACE_HANDLER_STATS(isolate(), StoreIC_SlowStub);
-      return slow_stub();
+      return MaybeObjectHandle(slow_stub());
     }
 
     case LookupIterator::DATA: {
@@ -1601,12 +1626,12 @@ Handle<Object> StoreIC::ComputeHandler(LookupIterator* lookup) {
       if (lookup->is_dictionary_holder()) {
         if (holder->IsJSGlobalObject()) {
           TRACE_HANDLER_STATS(isolate(), StoreIC_StoreGlobalDH);
-          return StoreHandler::StoreGlobal(isolate(),
-                                           lookup->GetPropertyCell());
+          return MaybeObjectHandle(
+              StoreHandler::StoreGlobal(isolate(), lookup->GetPropertyCell()));
         }
         TRACE_HANDLER_STATS(isolate(), StoreIC_StoreNormalDH);
         DCHECK(holder.is_identical_to(receiver));
-        return StoreHandler::StoreNormal(isolate());
+        return MaybeObjectHandle(StoreHandler::StoreNormal(isolate()));
       }
 
       // -------------- Fields --------------
@@ -1615,27 +1640,29 @@ Handle<Object> StoreIC::ComputeHandler(LookupIterator* lookup) {
         int descriptor = lookup->GetFieldDescriptorIndex();
         FieldIndex index = lookup->GetFieldIndex();
         PropertyConstness constness = lookup->constness();
-        if (constness == kConst && IsStoreOwnICKind(nexus()->kind())) {
+        if (constness == PropertyConstness::kConst &&
+            IsStoreOwnICKind(nexus()->kind())) {
           // StoreOwnICs are used for initializing object literals therefore
-          // we must store the value unconditionally even to kConst fields.
-          constness = kMutable;
+          // we must store the value unconditionally even to
+          // VariableMode::kConst fields.
+          constness = PropertyConstness::kMutable;
         }
-        return StoreHandler::StoreField(isolate(), descriptor, index, constness,
-                                        lookup->representation());
+        return MaybeObjectHandle(StoreHandler::StoreField(
+            isolate(), descriptor, index, constness, lookup->representation()));
       }
 
       // -------------- Constant properties --------------
       DCHECK_EQ(kDescriptor, lookup->property_details().location());
       set_slow_stub_reason("constant property");
       TRACE_HANDLER_STATS(isolate(), StoreIC_SlowStub);
-      return slow_stub();
+      return MaybeObjectHandle(slow_stub());
     }
     case LookupIterator::JSPROXY: {
       Handle<JSReceiver> receiver =
           Handle<JSReceiver>::cast(lookup->GetReceiver());
       Handle<JSProxy> holder = lookup->GetHolder<JSProxy>();
-      return StoreHandler::StoreProxy(isolate(), receiver_map(), holder,
-                                      receiver);
+      return MaybeObjectHandle(StoreHandler::StoreProxy(
+          isolate(), receiver_map(), holder, receiver));
     }
 
     case LookupIterator::INTEGER_INDEXED_EXOTIC:
@@ -1643,7 +1670,7 @@ Handle<Object> StoreIC::ComputeHandler(LookupIterator* lookup) {
     case LookupIterator::NOT_FOUND:
       UNREACHABLE();
   }
-  return Handle<Code>::null();
+  return MaybeObjectHandle();
 }
 
 void KeyedStoreIC::UpdateStoreElement(Handle<Map> receiver_map,
@@ -1761,7 +1788,7 @@ void KeyedStoreIC::UpdateStoreElement(Handle<Map> receiver_map,
     }
   }
 
-  ObjectHandles handlers;
+  MaybeObjectHandles handlers;
   handlers.reserve(target_receiver_maps.size());
   StoreElementPolymorphicHandlers(&target_receiver_maps, &handlers, store_mode);
   if (target_receiver_maps.size() == 0) {
@@ -1782,14 +1809,14 @@ Handle<Map> KeyedStoreIC::ComputeTransitionedMap(
       ElementsKind kind = IsHoleyElementsKind(map->elements_kind())
                               ? HOLEY_ELEMENTS
                               : PACKED_ELEMENTS;
-      return Map::TransitionElementsTo(map, kind);
+      return Map::TransitionElementsTo(isolate(), map, kind);
     }
     case STORE_TRANSITION_TO_DOUBLE:
     case STORE_AND_GROW_TRANSITION_TO_DOUBLE: {
       ElementsKind kind = IsHoleyElementsKind(map->elements_kind())
                               ? HOLEY_DOUBLE_ELEMENTS
                               : PACKED_DOUBLE_ELEMENTS;
-      return Map::TransitionElementsTo(map, kind);
+      return Map::TransitionElementsTo(isolate(), map, kind);
     }
     case STORE_NO_TRANSITION_IGNORE_OUT_OF_BOUNDS:
       DCHECK(map->has_fixed_typed_array_elements());
@@ -1853,7 +1880,7 @@ Handle<Object> KeyedStoreIC::StoreElementHandler(
 }
 
 void KeyedStoreIC::StoreElementPolymorphicHandlers(
-    MapHandles* receiver_maps, ObjectHandles* handlers,
+    MapHandles* receiver_maps, MaybeObjectHandles* handlers,
     KeyedAccessStoreMode store_mode) {
   DCHECK(store_mode == STANDARD_STORE ||
          store_mode == STORE_AND_GROW_NO_TRANSITION_HANDLE_COW ||
@@ -1880,13 +1907,13 @@ void KeyedStoreIC::StoreElementPolymorphicHandlers(
 
     } else {
       {
-        Map* tmap =
-            receiver_map->FindElementsKindTransitionedMap(*receiver_maps);
+        Map* tmap = receiver_map->FindElementsKindTransitionedMap(
+            isolate(), *receiver_maps);
         if (tmap != nullptr) {
           if (receiver_map->is_stable()) {
             receiver_map->NotifyLeafMapLayoutChange();
           }
-          transition = handle(tmap);
+          transition = handle(tmap, isolate());
         }
       }
 
@@ -1905,7 +1932,7 @@ void KeyedStoreIC::StoreElementPolymorphicHandlers(
       }
     }
     DCHECK(!handler.is_null());
-    handlers->push_back(handler);
+    handlers->push_back(MaybeObjectHandle(handler));
   }
 }
 
@@ -2002,7 +2029,7 @@ MaybeHandle<Object> KeyedStoreIC::Store(Handle<Object> object,
     // expect to be able to trap element sets to objects with those maps in
     // the runtime to enable optimization of element hole access.
     Handle<HeapObject> heap_object = Handle<HeapObject>::cast(object);
-    if (heap_object->map()->IsMapInArrayPrototypeChain()) {
+    if (heap_object->map()->IsMapInArrayPrototypeChain(isolate())) {
       set_slow_stub_reason("map in array prototype");
       use_ic = false;
     }
@@ -2076,12 +2103,12 @@ MaybeHandle<Object> KeyedStoreIC::Store(Handle<Object> object,
 }
 
 namespace {
-void StoreOwnElement(Handle<JSArray> array, Handle<Object> index,
-                     Handle<Object> value) {
+void StoreOwnElement(Isolate* isolate, Handle<JSArray> array,
+                     Handle<Object> index, Handle<Object> value) {
   DCHECK(index->IsNumber());
   bool success = false;
   LookupIterator it = LookupIterator::PropertyOrElement(
-      array->GetIsolate(), array, index, &success, LookupIterator::OWN);
+      isolate, array, index, &success, LookupIterator::OWN);
   DCHECK(success);
 
   CHECK(JSObject::DefineOwnPropertyIgnoreAttributes(&it, value, NONE,
@@ -2092,11 +2119,11 @@ void StoreOwnElement(Handle<JSArray> array, Handle<Object> index,
 
 void StoreInArrayLiteralIC::Store(Handle<JSArray> array, Handle<Object> index,
                                   Handle<Object> value) {
-  DCHECK(!array->map()->IsMapInArrayPrototypeChain());
+  DCHECK(!array->map()->IsMapInArrayPrototypeChain(isolate()));
   DCHECK(index->IsNumber());
 
   if (!FLAG_use_ic || MigrateDeprecated(array)) {
-    StoreOwnElement(array, index, value);
+    StoreOwnElement(isolate(), array, index, value);
     TraceIC("StoreInArrayLiteralIC", index);
     return;
   }
@@ -2112,7 +2139,7 @@ void StoreInArrayLiteralIC::Store(Handle<JSArray> array, Handle<Object> index,
 
   Handle<Map> old_array_map(array->map(), isolate());
   bool array_was_cow = array->elements()->IsCowArray();
-  StoreOwnElement(array, index, value);
+  StoreOwnElement(isolate(), array, index, value);
 
   if (index->IsSmi()) {
     DCHECK(!old_array_map->is_abandoned_prototype_map());
@@ -2189,7 +2216,7 @@ RUNTIME_FUNCTION(Runtime_LoadGlobalIC_Slow) {
 
   Handle<Context> native_context = isolate->native_context();
   Handle<ScriptContextTable> script_contexts(
-      native_context->script_context_table());
+      native_context->script_context_table(), isolate);
 
   ScriptContextTable::LookupResult lookup_result;
   if (ScriptContextTable::Lookup(script_contexts, name, &lookup_result)) {
@@ -2197,7 +2224,7 @@ RUNTIME_FUNCTION(Runtime_LoadGlobalIC_Slow) {
         script_contexts, lookup_result.context_index);
     Handle<Object> result =
         FixedArray::get(*script_context, lookup_result.slot_index, isolate);
-    if (*result == isolate->heap()->the_hole_value()) {
+    if (*result == ReadOnlyRoots(isolate).the_hole_value()) {
       THROW_NEW_ERROR_RETURN_FAILURE(
           isolate, NewReferenceError(MessageTemplate::kNotDefined, name));
     }
@@ -2305,13 +2332,13 @@ RUNTIME_FUNCTION(Runtime_StoreGlobalIC_Slow) {
   Handle<JSGlobalObject> global = isolate->global_object();
   Handle<Context> native_context = isolate->native_context();
   Handle<ScriptContextTable> script_contexts(
-      native_context->script_context_table());
+      native_context->script_context_table(), isolate);
 
   ScriptContextTable::LookupResult lookup_result;
   if (ScriptContextTable::Lookup(script_contexts, name, &lookup_result)) {
     Handle<Context> script_context = ScriptContextTable::GetContext(
         script_contexts, lookup_result.context_index);
-    if (lookup_result.mode == CONST) {
+    if (lookup_result.mode == VariableMode::kConst) {
       THROW_NEW_ERROR_RETURN_FAILURE(
           isolate, NewTypeError(MessageTemplate::kConstAssign, global, name));
     }
@@ -2389,7 +2416,7 @@ RUNTIME_FUNCTION(Runtime_StoreInArrayLiteralIC_Slow) {
   Handle<Object> value = args.at(0);
   Handle<Object> array = args.at(1);
   Handle<Object> index = args.at(2);
-  StoreOwnElement(Handle<JSArray>::cast(array), index, value);
+  StoreOwnElement(isolate, Handle<JSArray>::cast(array), index, value);
   return *value;
 }
 
@@ -2412,7 +2439,7 @@ RUNTIME_FUNCTION(Runtime_ElementsTransitionAndStoreIC_Miss) {
   }
 
   if (IsStoreInArrayLiteralICKind(kind)) {
-    StoreOwnElement(Handle<JSArray>::cast(object), key, value);
+    StoreOwnElement(isolate, Handle<JSArray>::cast(object), key, value);
     return *value;
   } else {
     DCHECK(IsKeyedStoreICKind(kind) || IsStoreICKind(kind));
@@ -2442,7 +2469,8 @@ RUNTIME_FUNCTION(Runtime_StoreCallbackProperty) {
   Handle<AccessorInfo> info(
       callback_or_cell->IsWeakCell()
           ? AccessorInfo::cast(WeakCell::cast(*callback_or_cell)->value())
-          : AccessorInfo::cast(*callback_or_cell));
+          : AccessorInfo::cast(*callback_or_cell),
+      isolate);
 
   DCHECK(info->IsCompatibleReceiver(*receiver));
 
@@ -2501,7 +2529,7 @@ RUNTIME_FUNCTION(Runtime_LoadPropertyWithInterceptor) {
   // It could actually be any kind of load IC slot here but the predicate
   // handles all the cases properly.
   if (!LoadIC::ShouldThrowReferenceError(slot_kind)) {
-    return isolate->heap()->undefined_value();
+    return ReadOnlyRoots(isolate).undefined_value();
   }
 
   // Throw a reference error.
@@ -2555,7 +2583,7 @@ RUNTIME_FUNCTION(Runtime_StorePropertyWithInterceptor) {
 
   MAYBE_RETURN(Object::SetProperty(&it, value, language_mode,
                                    JSReceiver::CERTAINLY_NOT_STORE_FROM_KEYED),
-               isolate->heap()->exception());
+               ReadOnlyRoots(isolate).exception());
   return *value;
 }
 
diff --git a/deps/v8/src/ic/ic.h b/deps/v8/src/ic/ic.h
index 020b8dcd2640e8..feac4dc63bc48c 100644
--- a/deps/v8/src/ic/ic.h
+++ b/deps/v8/src/ic/ic.h
@@ -14,6 +14,7 @@
 #include "src/macro-assembler.h"
 #include "src/messages.h"
 #include "src/objects/map.h"
+#include "src/objects/maybe-object.h"
 
 namespace v8 {
 namespace internal {
@@ -26,10 +27,6 @@ class IC {
   // Alias the inline cache state type to make the IC code more readable.
   typedef InlineCacheState State;
 
-  // The IC code is either invoked with no extra frames on the stack
-  // or with a single extra frame for supporting calls.
-  enum FrameDepth { NO_EXTRA_FRAME = 0, EXTRA_CALL_FRAME = 1 };
-
   static constexpr int kMaxKeyedPolymorphism = 4;
 
   // A polymorphic IC can handle at most 4 distinct maps before transitioning
@@ -38,8 +35,7 @@ class IC {
 
   // Construct the IC structure with the given number of extra
   // JavaScript frames on the stack.
-  IC(FrameDepth depth, Isolate* isolate, Handle<FeedbackVector> vector,
-     FeedbackSlot slot);
+  IC(Isolate* isolate, Handle<FeedbackVector> vector, FeedbackSlot slot);
   virtual ~IC() {}
 
   State state() const { return state_; }
@@ -63,7 +59,7 @@ class IC {
            IsKeyedStoreIC() || IsStoreInArrayLiteralICKind(kind());
   }
 
-  static inline bool IsHandler(Object* object);
+  static inline bool IsHandler(MaybeObject* object);
 
   // Nofity the IC system that a feedback has changed.
   static void OnFeedbackChanged(Isolate* isolate, FeedbackVector* vector,
@@ -92,7 +88,7 @@ class IC {
   bool vector_needs_update() {
     return (!vector_set_ &&
             (state() != MEGAMORPHIC ||
-             Smi::ToInt(nexus()->GetFeedbackExtra()) != ELEMENT));
+             Smi::ToInt(nexus()->GetFeedbackExtra()->ToSmi()) != ELEMENT));
   }
 
   // Configure for most states.
@@ -100,9 +96,11 @@ class IC {
   // Configure the vector for MONOMORPHIC.
   void ConfigureVectorState(Handle<Name> name, Handle<Map> map,
                             Handle<Object> handler);
+  void ConfigureVectorState(Handle<Name> name, Handle<Map> map,
+                            const MaybeObjectHandle& handler);
   // Configure the vector for POLYMORPHIC.
   void ConfigureVectorState(Handle<Name> name, MapHandles const& maps,
-                            ObjectHandles* handlers);
+                            MaybeObjectHandles* handlers);
 
   char TransitionMarkFromState(IC::State state);
   void TraceIC(const char* type, Handle<Object> name);
@@ -115,15 +113,17 @@ class IC {
 
   void TraceHandlerCacheHitStats(LookupIterator* lookup);
 
-  void UpdateMonomorphicIC(Handle<Object> handler, Handle<Name> name);
-  bool UpdatePolymorphicIC(Handle<Name> name, Handle<Object> code);
-  void UpdateMegamorphicCache(Map* map, Name* name, Object* code);
+  void UpdateMonomorphicIC(const MaybeObjectHandle& handler, Handle<Name> name);
+  bool UpdatePolymorphicIC(Handle<Name> name, const MaybeObjectHandle& handler);
+  void UpdateMegamorphicCache(Handle<Map> map, Handle<Name> name,
+                              const MaybeObjectHandle& handler);
 
   StubCache* stub_cache();
 
   void CopyICToMegamorphicCache(Handle<Name> name);
   bool IsTransitionOfMonomorphicTarget(Map* source_map, Map* target_map);
-  void PatchCache(Handle<Name> name, Handle<Object> code);
+  void PatchCache(Handle<Name> name, Handle<Object> handler);
+  void PatchCache(Handle<Name> name, const MaybeObjectHandle& handler);
   FeedbackSlotKind kind() const { return kind_; }
   bool IsGlobalIC() const { return IsLoadGlobalIC() || IsStoreGlobalIC(); }
   bool IsLoadIC() const { return IsLoadICKind(kind_); }
@@ -144,7 +144,7 @@ class IC {
     if (receiver->IsSmi()) {
       receiver_map_ = isolate_->factory()->heap_number_map();
     } else {
-      receiver_map_ = handle(HeapObject::cast(*receiver)->map());
+      receiver_map_ = handle(HeapObject::cast(*receiver)->map(), isolate_);
     }
   }
 
@@ -197,7 +197,7 @@ class IC {
   State state_;
   FeedbackSlotKind kind_;
   Handle<Map> receiver_map_;
-  MaybeHandle<Object> maybe_handler_;
+  MaybeObjectHandle maybe_handler_;
 
   MapHandles target_maps_;
   bool target_maps_set_;
@@ -210,17 +210,10 @@ class IC {
 };
 
 
-class CallIC : public IC {
- public:
-  CallIC(Isolate* isolate, Handle<FeedbackVector> vector, FeedbackSlot slot)
-      : IC(EXTRA_CALL_FRAME, isolate, vector, slot) {}
-};
-
-
 class LoadIC : public IC {
  public:
   LoadIC(Isolate* isolate, Handle<FeedbackVector> vector, FeedbackSlot slot)
-      : IC(NO_EXTRA_FRAME, isolate, vector, slot) {
+      : IC(isolate, vector, slot) {
     DCHECK(IsAnyLoad());
   }
 
@@ -286,7 +279,7 @@ class KeyedLoadIC : public LoadIC {
                                     KeyedAccessLoadMode load_mode);
 
   void LoadElementPolymorphicHandlers(MapHandles* receiver_maps,
-                                      ObjectHandles* handlers,
+                                      MaybeObjectHandles* handlers,
                                       KeyedAccessLoadMode load_mode);
 
   // Returns true if the receiver_map has a kElement or kIndexedString
@@ -299,7 +292,7 @@ class KeyedLoadIC : public LoadIC {
 class StoreIC : public IC {
  public:
   StoreIC(Isolate* isolate, Handle<FeedbackVector> vector, FeedbackSlot slot)
-      : IC(NO_EXTRA_FRAME, isolate, vector, slot) {
+      : IC(isolate, vector, slot) {
     DCHECK(IsAnyStore());
   }
 
@@ -326,7 +319,7 @@ class StoreIC : public IC {
                     JSReceiver::StoreFromKeyed store_mode);
 
  private:
-  Handle<Object> ComputeHandler(LookupIterator* lookup);
+  MaybeObjectHandle ComputeHandler(LookupIterator* lookup);
 
   friend class IC;
 };
@@ -383,7 +376,7 @@ class KeyedStoreIC : public StoreIC {
                                      KeyedAccessStoreMode store_mode);
 
   void StoreElementPolymorphicHandlers(MapHandles* receiver_maps,
-                                       ObjectHandles* handlers,
+                                       MaybeObjectHandles* handlers,
                                        KeyedAccessStoreMode store_mode);
 
   friend class IC;
diff --git a/deps/v8/src/ic/keyed-store-generic.cc b/deps/v8/src/ic/keyed-store-generic.cc
index f2f161f3b695ae..4257f0591433c4 100644
--- a/deps/v8/src/ic/keyed-store-generic.cc
+++ b/deps/v8/src/ic/keyed-store-generic.cc
@@ -16,7 +16,9 @@
 namespace v8 {
 namespace internal {
 
-using compiler::Node;
+using Node = compiler::Node;
+template <class T>
+using TNode = compiler::TNode<T>;
 
 class KeyedStoreGenericAssembler : public AccessorAssembler {
  public:
@@ -27,6 +29,12 @@ class KeyedStoreGenericAssembler : public AccessorAssembler {
 
   void StoreIC_Uninitialized();
 
+  // Generates code for [[Set]] operation, the |unique_name| is supposed to be
+  // unique otherwise this code will always go to runtime.
+  void SetProperty(TNode<Context> context, TNode<JSReceiver> receiver,
+                   TNode<BoolT> is_simple_receiver, TNode<Name> unique_name,
+                   TNode<Object> value, LanguageMode language_mode);
+
  private:
   enum UpdateLength {
     kDontChangeLength,
@@ -40,15 +48,20 @@ class KeyedStoreGenericAssembler : public AccessorAssembler {
                                Node* instance_type, Node* intptr_index,
                                Node* value, Node* context, Label* slow);
 
-  void EmitGenericPropertyStore(Node* receiver, Node* receiver_map,
+  // If language mode is not provided it is deduced from the feedback slot's
+  // kind.
+  void EmitGenericPropertyStore(TNode<JSReceiver> receiver,
+                                TNode<Map> receiver_map,
                                 const StoreICParameters* p,
                                 ExitPoint* exit_point, Label* slow,
-                                bool assume_strict_language_mode = false);
+                                Maybe<LanguageMode> maybe_language_mode);
 
-  void EmitGenericPropertyStore(Node* receiver, Node* receiver_map,
+  void EmitGenericPropertyStore(SloppyTNode<JSReceiver> receiver,
+                                SloppyTNode<Map> receiver_map,
                                 const StoreICParameters* p, Label* slow) {
     ExitPoint direct_exit(this);
-    EmitGenericPropertyStore(receiver, receiver_map, p, &direct_exit, slow);
+    EmitGenericPropertyStore(receiver, receiver_map, p, &direct_exit, slow,
+                             Nothing<LanguageMode>());
   }
 
   void BranchIfPrototypesHaveNonFastElements(Node* receiver_map,
@@ -97,6 +110,15 @@ void StoreICUninitializedGenerator::Generate(
   assembler.StoreIC_Uninitialized();
 }
 
+void KeyedStoreGenericGenerator::SetProperty(
+    compiler::CodeAssemblerState* state, TNode<Context> context,
+    TNode<JSReceiver> receiver, TNode<BoolT> is_simple_receiver,
+    TNode<Name> name, TNode<Object> value, LanguageMode language_mode) {
+  KeyedStoreGenericAssembler assembler(state);
+  assembler.SetProperty(context, receiver, is_simple_receiver, name, value,
+                        language_mode);
+}
+
 void KeyedStoreGenericAssembler::BranchIfPrototypesHaveNonFastElements(
     Node* receiver_map, Label* non_fast_elements, Label* only_fast_elements) {
   VARIABLE(var_map, MachineRepresentation::kTagged);
@@ -111,14 +133,10 @@ void KeyedStoreGenericAssembler::BranchIfPrototypesHaveNonFastElements(
     GotoIf(IsNull(prototype), only_fast_elements);
     Node* prototype_map = LoadMap(prototype);
     var_map.Bind(prototype_map);
-    Node* instance_type = LoadMapInstanceType(prototype_map);
-    STATIC_ASSERT(JS_PROXY_TYPE < JS_OBJECT_TYPE);
-    STATIC_ASSERT(JS_VALUE_TYPE < JS_OBJECT_TYPE);
-    GotoIf(Int32LessThanOrEqual(instance_type,
-                                Int32Constant(LAST_CUSTOM_ELEMENTS_RECEIVER)),
+    TNode<Int32T> instance_type = LoadMapInstanceType(prototype_map);
+    GotoIf(IsCustomElementsReceiverInstanceType(instance_type),
            non_fast_elements);
     Node* elements_kind = LoadMapElementsKind(prototype_map);
-    STATIC_ASSERT(FIRST_ELEMENTS_KIND == FIRST_FAST_ELEMENTS_KIND);
     GotoIf(IsFastElementsKind(elements_kind), &loop_body);
     GotoIf(Word32Equal(elements_kind, Int32Constant(NO_ELEMENTS)), &loop_body);
     Goto(non_fast_elements);
@@ -244,8 +262,8 @@ void KeyedStoreGenericAssembler::StoreElementWithCapacity(
     // The length property is non-configurable, so it's guaranteed to always
     // be the first property.
     TNode<DescriptorArray> descriptors = LoadMapDescriptors(receiver_map);
-    TNode<Int32T> details = LoadAndUntagToWord32FixedArrayElement(
-        descriptors, DescriptorArray::ToDetailsIndex(0));
+    TNode<Uint32T> details = LoadDetailsByKeyIndex(
+        descriptors, IntPtrConstant(DescriptorArray::ToKeyIndex(0)));
     GotoIf(IsSetWord32(details, PropertyDetails::kAttributesReadOnlyMask),
            slow);
   }
@@ -555,10 +573,9 @@ void KeyedStoreGenericAssembler::LookupPropertyOnPrototypeChain(
                         &var_entry, &next_proto, bailout);
       BIND(&found_fast);
       {
-        Node* descriptors = var_meta_storage.value();
-        Node* name_index = var_entry.value();
-        Node* details =
-            LoadDetailsByKeyIndex<DescriptorArray>(descriptors, name_index);
+        TNode<DescriptorArray> descriptors = CAST(var_meta_storage.value());
+        TNode<IntPtrT> name_index = var_entry.value();
+        Node* details = LoadDetailsByKeyIndex(descriptors, name_index);
         JumpIfDataProperty(details, &ok_to_write, readonly);
 
         // Accessor case.
@@ -618,8 +635,10 @@ void KeyedStoreGenericAssembler::LookupPropertyOnPrototypeChain(
 }
 
 void KeyedStoreGenericAssembler::EmitGenericPropertyStore(
-    Node* receiver, Node* receiver_map, const StoreICParameters* p,
-    ExitPoint* exit_point, Label* slow, bool assume_strict_language_mode) {
+    TNode<JSReceiver> receiver, TNode<Map> receiver_map,
+    const StoreICParameters* p, ExitPoint* exit_point, Label* slow,
+    Maybe<LanguageMode> maybe_language_mode) {
+  CSA_ASSERT(this, IsSimpleObjectMap(receiver_map));
   VARIABLE(var_accessor_pair, MachineRepresentation::kTagged);
   VARIABLE(var_accessor_holder, MachineRepresentation::kTagged);
   Label stub_cache(this), fast_properties(this), dictionary_properties(this),
@@ -631,7 +650,7 @@ void KeyedStoreGenericAssembler::EmitGenericPropertyStore(
   BIND(&fast_properties);
   {
     Comment("fast property store");
-    Node* descriptors = LoadMapDescriptors(receiver_map);
+    TNode<DescriptorArray> descriptors = LoadMapDescriptors(receiver_map);
     Label descriptor_found(this), lookup_transition(this);
     TVARIABLE(IntPtrT, var_name_index);
     DescriptorLookup(p->name, descriptors, bitfield3, &descriptor_found,
@@ -639,9 +658,8 @@ void KeyedStoreGenericAssembler::EmitGenericPropertyStore(
 
     BIND(&descriptor_found);
     {
-      Node* name_index = var_name_index.value();
-      Node* details =
-          LoadDetailsByKeyIndex<DescriptorArray>(descriptors, name_index);
+      TNode<IntPtrT> name_index = var_name_index.value();
+      Node* details = LoadDetailsByKeyIndex(descriptors, name_index);
       Label data_property(this);
       JumpIfDataProperty(details, &data_property, &readonly);
 
@@ -668,14 +686,14 @@ void KeyedStoreGenericAssembler::EmitGenericPropertyStore(
       TVARIABLE(Map, var_transition_map);
       Label simple_transition(this), transition_array(this),
           found_handler_candidate(this);
-      TNode<Object> maybe_handler =
-          LoadObjectField(receiver_map, Map::kTransitionsOrPrototypeInfoOffset);
+      TNode<MaybeObject> maybe_handler = LoadMaybeWeakObjectField(
+          receiver_map, Map::kTransitionsOrPrototypeInfoOffset);
 
       // SMI -> slow
       // cleared weak reference -> slow
       // weak reference -> simple_transition
       // strong reference -> transition_array
-      VARIABLE(var_transition_map_or_array, MachineRepresentation::kTagged);
+      TVARIABLE(Object, var_transition_map_or_array);
       DispatchMaybeObject(maybe_handler, slow, slow, &simple_transition,
                           &transition_array, &var_transition_map_or_array);
 
@@ -716,10 +734,9 @@ void KeyedStoreGenericAssembler::EmitGenericPropertyStore(
           const int kKeyToTargetOffset = (TransitionArray::kEntryTargetIndex -
                                           TransitionArray::kEntryKeyIndex) *
                                          kPointerSize;
-          TNode<WeakCell> transition_map_weak_cell = CAST(LoadFixedArrayElement(
-              transitions, var_name_index.value(), kKeyToTargetOffset));
-          var_transition_map =
-              CAST(LoadWeakCellValue(transition_map_weak_cell, slow));
+          var_transition_map = CAST(ToWeakHeapObject(
+              LoadArrayElement(transitions, WeakFixedArray::kHeaderSize,
+                               var_name_index.value(), kKeyToTargetOffset)));
           Goto(&found_handler_candidate);
         }
       }
@@ -740,15 +757,16 @@ void KeyedStoreGenericAssembler::EmitGenericPropertyStore(
     // We checked for LAST_CUSTOM_ELEMENTS_RECEIVER before, which rules out
     // seeing global objects here (which would need special handling).
 
-    VARIABLE(var_name_index, MachineType::PointerRepresentation());
+    TVARIABLE(IntPtrT, var_name_index);
     Label dictionary_found(this, &var_name_index), not_found(this);
-    Node* properties = LoadSlowProperties(receiver);
-    NameDictionaryLookup<NameDictionary>(properties, p->name, &dictionary_found,
-                                         &var_name_index, &not_found);
+    TNode<NameDictionary> properties = CAST(LoadSlowProperties(CAST(receiver)));
+    NameDictionaryLookup<NameDictionary>(properties, CAST(p->name),
+                                         &dictionary_found, &var_name_index,
+                                         &not_found);
     BIND(&dictionary_found);
     {
       Label overwrite(this);
-      Node* details = LoadDetailsByKeyIndex<NameDictionary>(
+      TNode<Uint32T> details = LoadDetailsByKeyIndex<NameDictionary>(
           properties, var_name_index.value());
       JumpIfDataProperty(details, &overwrite, &readonly);
 
@@ -781,7 +799,7 @@ void KeyedStoreGenericAssembler::EmitGenericPropertyStore(
                                      &readonly, slow);
       Label add_dictionary_property_slow(this);
       InvalidateValidityCellIfPrototype(receiver_map, bitfield2);
-      Add<NameDictionary>(properties, p->name, p->value,
+      Add<NameDictionary>(properties, CAST(p->name), p->value,
                           &add_dictionary_property_slow);
       exit_point->Return(p->value);
 
@@ -809,36 +827,54 @@ void KeyedStoreGenericAssembler::EmitGenericPropertyStore(
 
     BIND(&not_callable);
     {
+      bool handle_strict = true;
       Label strict(this);
-      if (assume_strict_language_mode) {
-        Goto(&strict);
+      LanguageMode language_mode;
+      if (maybe_language_mode.To(&language_mode)) {
+        if (language_mode == LanguageMode::kStrict) {
+          Goto(&strict);
+        } else {
+          handle_strict = false;
+          exit_point->Return(p->value);
+        }
       } else {
         BranchIfStrictMode(p->vector, p->slot, &strict);
         exit_point->Return(p->value);
       }
 
-      BIND(&strict);
-      {
-        ThrowTypeError(p->context, MessageTemplate::kNoSetterInCallback,
-                       p->name, var_accessor_holder.value());
+      if (handle_strict) {
+        BIND(&strict);
+        {
+          ThrowTypeError(p->context, MessageTemplate::kNoSetterInCallback,
+                         p->name, var_accessor_holder.value());
+        }
       }
     }
   }
 
   BIND(&readonly);
   {
+    bool handle_strict = true;
     Label strict(this);
-    if (assume_strict_language_mode) {
-      Goto(&strict);
+    LanguageMode language_mode;
+    if (maybe_language_mode.To(&language_mode)) {
+      if (language_mode == LanguageMode::kStrict) {
+        Goto(&strict);
+      } else {
+        handle_strict = false;
+        exit_point->Return(p->value);
+      }
     } else {
       BranchIfStrictMode(p->vector, p->slot, &strict);
       exit_point->Return(p->value);
     }
-    BIND(&strict);
-    {
-      Node* type = Typeof(p->receiver);
-      ThrowTypeError(p->context, MessageTemplate::kStrictReadOnlyProperty,
-                     p->name, type, p->receiver);
+    if (handle_strict) {
+      BIND(&strict);
+      {
+        Node* type = Typeof(p->receiver);
+        ThrowTypeError(p->context, MessageTemplate::kStrictReadOnlyProperty,
+                       p->name, type, p->receiver);
+      }
     }
   }
 }
@@ -861,12 +897,10 @@ void KeyedStoreGenericAssembler::KeyedStoreGeneric() {
 
   GotoIf(TaggedIsSmi(receiver), &slow);
   Node* receiver_map = LoadMap(receiver);
-  Node* instance_type = LoadMapInstanceType(receiver_map);
+  TNode<Int32T> instance_type = LoadMapInstanceType(receiver_map);
   // Receivers requiring non-standard element accesses (interceptors, access
   // checks, strings and string wrappers, proxies) are handled in the runtime.
-  GotoIf(Int32LessThanOrEqual(instance_type,
-                              Int32Constant(LAST_CUSTOM_ELEMENTS_RECEIVER)),
-         &slow);
+  GotoIf(IsCustomElementsReceiverInstanceType(instance_type), &slow);
 
   TryToName(name, &if_index, &var_index, &if_unique_name, &var_unique, &slow,
             &not_internalized);
@@ -925,7 +959,7 @@ void KeyedStoreGenericAssembler::StoreIC_Uninitialized() {
 
   GotoIf(TaggedIsSmi(receiver), &miss);
   Node* receiver_map = LoadMap(receiver);
-  Node* instance_type = LoadMapInstanceType(receiver_map);
+  TNode<Int32T> instance_type = LoadMapInstanceType(receiver_map);
   // Receivers requiring non-standard element accesses (interceptors, access
   // checks, strings and string wrappers, proxies) are handled in the runtime.
   GotoIf(IsSpecialReceiverInstanceType(instance_type), &miss);
@@ -949,5 +983,33 @@ void KeyedStoreGenericAssembler::StoreIC_Uninitialized() {
   }
 }
 
+void KeyedStoreGenericAssembler::SetProperty(TNode<Context> context,
+                                             TNode<JSReceiver> receiver,
+                                             TNode<BoolT> is_simple_receiver,
+                                             TNode<Name> unique_name,
+                                             TNode<Object> value,
+                                             LanguageMode language_mode) {
+  StoreICParameters p(context, receiver, unique_name, value, nullptr, nullptr);
+
+  Label done(this), slow(this, Label::kDeferred);
+  ExitPoint exit_point(this, [&](Node* result) { Goto(&done); });
+
+  CSA_ASSERT(this, Word32Equal(is_simple_receiver,
+                               IsSimpleObjectMap(LoadMap(receiver))));
+  GotoIfNot(is_simple_receiver, &slow);
+
+  EmitGenericPropertyStore(receiver, LoadMap(receiver), &p, &exit_point, &slow,
+                           Just(language_mode));
+
+  BIND(&slow);
+  {
+    CallRuntime(Runtime::kSetProperty, context, receiver, unique_name, value,
+                SmiConstant(language_mode));
+    Goto(&done);
+  }
+
+  BIND(&done);
+}
+
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/src/ic/keyed-store-generic.h b/deps/v8/src/ic/keyed-store-generic.h
index 1a0de3b2b4ecd2..9cda8ef2e29b2d 100644
--- a/deps/v8/src/ic/keyed-store-generic.h
+++ b/deps/v8/src/ic/keyed-store-generic.h
@@ -5,18 +5,24 @@
 #ifndef V8_IC_KEYED_STORE_GENERIC_H_
 #define V8_IC_KEYED_STORE_GENERIC_H_
 
+#include "src/compiler/code-assembler.h"
 #include "src/globals.h"
 
 namespace v8 {
 namespace internal {
 
-namespace compiler {
-class CodeAssemblerState;
-}
-
 class KeyedStoreGenericGenerator {
  public:
+  template <class T>
+  using TNode = compiler::TNode<T>;
+
   static void Generate(compiler::CodeAssemblerState* state);
+
+  // Building block for fast path of Object.assign implementation.
+  static void SetProperty(compiler::CodeAssemblerState* state,
+                          TNode<Context> context, TNode<JSReceiver> receiver,
+                          TNode<BoolT> is_simple_receiver, TNode<Name> name,
+                          TNode<Object> value, LanguageMode language_mode);
 };
 
 class StoreICUninitializedGenerator {
diff --git a/deps/v8/src/ic/stub-cache.cc b/deps/v8/src/ic/stub-cache.cc
index 927c7c6f27f0fd..4958726a227060 100644
--- a/deps/v8/src/ic/stub-cache.cc
+++ b/deps/v8/src/ic/stub-cache.cc
@@ -58,11 +58,11 @@ int StubCache::SecondaryOffset(Name* name, int seed) {
 namespace {
 
 bool CommonStubCacheChecks(StubCache* stub_cache, Name* name, Map* map,
-                           Object* handler) {
+                           MaybeObject* handler) {
   // Validate that the name and handler do not move on scavenge, and that we
   // can use identity checks instead of structural equality checks.
-  DCHECK(!name->GetHeap()->InNewSpace(name));
-  DCHECK(!name->GetHeap()->InNewSpace(handler));
+  DCHECK(!Heap::InNewSpace(name));
+  DCHECK(!Heap::InNewSpace(handler));
   DCHECK(name->IsUniqueName());
   DCHECK(name->HasHashCode());
   if (handler) DCHECK(IC::IsHandler(handler));
@@ -72,17 +72,18 @@ bool CommonStubCacheChecks(StubCache* stub_cache, Name* name, Map* map,
 }  // namespace
 #endif
 
-Object* StubCache::Set(Name* name, Map* map, Object* handler) {
+MaybeObject* StubCache::Set(Name* name, Map* map, MaybeObject* handler) {
   DCHECK(CommonStubCacheChecks(this, name, map, handler));
 
   // Compute the primary entry.
   int primary_offset = PrimaryOffset(name, map);
   Entry* primary = entry(primary_, primary_offset);
-  Object* old_handler = primary->value;
+  MaybeObject* old_handler = primary->value;
 
   // If the primary entry has useful data in it, we retire it to the
   // secondary cache before overwriting it.
-  if (old_handler != isolate_->builtins()->builtin(Builtins::kIllegal)) {
+  if (old_handler != MaybeObject::FromObject(
+                         isolate_->builtins()->builtin(Builtins::kIllegal))) {
     Map* old_map = primary->map;
     int seed = PrimaryOffset(primary->key, old_map);
     int secondary_offset = SecondaryOffset(primary->key, seed);
@@ -98,7 +99,7 @@ Object* StubCache::Set(Name* name, Map* map, Object* handler) {
   return handler;
 }
 
-Object* StubCache::Get(Name* name, Map* map) {
+MaybeObject* StubCache::Get(Name* name, Map* map) {
   DCHECK(CommonStubCacheChecks(this, name, map, nullptr));
   int primary_offset = PrimaryOffset(name, map);
   Entry* primary = entry(primary_, primary_offset);
@@ -115,14 +116,16 @@ Object* StubCache::Get(Name* name, Map* map) {
 
 
 void StubCache::Clear() {
-  Code* empty = isolate_->builtins()->builtin(Builtins::kIllegal);
+  MaybeObject* empty = MaybeObject::FromObject(
+      isolate_->builtins()->builtin(Builtins::kIllegal));
+  Name* empty_string = ReadOnlyRoots(isolate()).empty_string();
   for (int i = 0; i < kPrimaryTableSize; i++) {
-    primary_[i].key = isolate()->heap()->empty_string();
+    primary_[i].key = empty_string;
     primary_[i].map = nullptr;
     primary_[i].value = empty;
   }
   for (int j = 0; j < kSecondaryTableSize; j++) {
-    secondary_[j].key = isolate()->heap()->empty_string();
+    secondary_[j].key = empty_string;
     secondary_[j].map = nullptr;
     secondary_[j].value = empty;
   }
diff --git a/deps/v8/src/ic/stub-cache.h b/deps/v8/src/ic/stub-cache.h
index 870266eefdca8a..5cff496b1506b5 100644
--- a/deps/v8/src/ic/stub-cache.h
+++ b/deps/v8/src/ic/stub-cache.h
@@ -34,14 +34,14 @@ class StubCache {
  public:
   struct Entry {
     Name* key;
-    Object* value;
+    MaybeObject* value;
     Map* map;
   };
 
   void Initialize();
   // Access cache for entry hash(name, map).
-  Object* Set(Name* name, Map* map, Object* handler);
-  Object* Get(Name* name, Map* map);
+  MaybeObject* Set(Name* name, Map* map, MaybeObject* handler);
+  MaybeObject* Get(Name* name, Map* map);
   // Clear the lookup table (@ mark compact collection).
   void Clear();
 
diff --git a/deps/v8/src/identity-map.cc b/deps/v8/src/identity-map.cc
index 6a3bd4ca616c95..c6d74d2bd8b848 100644
--- a/deps/v8/src/identity-map.cc
+++ b/deps/v8/src/identity-map.cc
@@ -45,7 +45,7 @@ void IdentityMapBase::DisableIteration() {
 
 int IdentityMapBase::ScanKeysFor(Object* address) const {
   int start = Hash(address) & mask_;
-  Object* not_mapped = heap_->not_mapped_symbol();
+  Object* not_mapped = ReadOnlyRoots(heap_).not_mapped_symbol();
   for (int index = start; index < capacity_; index++) {
     if (keys_[index] == address) return index;  // Found.
     if (keys_[index] == not_mapped) return -1;  // Not found.
@@ -58,7 +58,7 @@ int IdentityMapBase::ScanKeysFor(Object* address) const {
 }
 
 int IdentityMapBase::InsertKey(Object* address) {
-  Object* not_mapped = heap_->not_mapped_symbol();
+  Object* not_mapped = ReadOnlyRoots(heap_).not_mapped_symbol();
   while (true) {
     int start = Hash(address) & mask_;
     int limit = capacity_ / 2;
@@ -78,9 +78,9 @@ int IdentityMapBase::InsertKey(Object* address) {
   UNREACHABLE();
 }
 
-void* IdentityMapBase::DeleteIndex(int index) {
-  void* ret_value = values_[index];
-  Object* not_mapped = heap_->not_mapped_symbol();
+bool IdentityMapBase::DeleteIndex(int index, void** deleted_value) {
+  if (deleted_value != nullptr) *deleted_value = values_[index];
+  Object* not_mapped = ReadOnlyRoots(heap_).not_mapped_symbol();
   DCHECK_NE(keys_[index], not_mapped);
   keys_[index] = not_mapped;
   values_[index] = nullptr;
@@ -90,7 +90,7 @@ void* IdentityMapBase::DeleteIndex(int index) {
   if (capacity_ > kInitialIdentityMapSize &&
       size_ * kResizeFactor < capacity_ / kResizeFactor) {
     Resize(capacity_ / kResizeFactor);
-    return ret_value;  // No need to fix collisions as resize reinserts keys.
+    return true;  // No need to fix collisions as resize reinserts keys.
   }
 
   // Move any collisions to their new correct location.
@@ -115,7 +115,7 @@ void* IdentityMapBase::DeleteIndex(int index) {
     index = next_index;
   }
 
-  return ret_value;
+  return true;
 }
 
 int IdentityMapBase::Lookup(Object* key) const {
@@ -141,7 +141,7 @@ int IdentityMapBase::LookupOrInsert(Object* key) {
 }
 
 int IdentityMapBase::Hash(Object* address) const {
-  CHECK_NE(address, heap_->not_mapped_symbol());
+  CHECK_NE(address, ReadOnlyRoots(heap_).not_mapped_symbol());
   uintptr_t raw_address = reinterpret_cast<uintptr_t>(address);
   return static_cast<int>(hasher_(raw_address));
 }
@@ -159,7 +159,7 @@ IdentityMapBase::RawEntry IdentityMapBase::GetEntry(Object* key) {
     gc_counter_ = heap_->gc_count();
 
     keys_ = reinterpret_cast<Object**>(NewPointerArray(capacity_));
-    Object* not_mapped = heap_->not_mapped_symbol();
+    Object* not_mapped = ReadOnlyRoots(heap_).not_mapped_symbol();
     for (int i = 0; i < capacity_; i++) keys_[i] = not_mapped;
     values_ = NewPointerArray(capacity_);
     memset(values_, 0, sizeof(void*) * capacity_);
@@ -184,21 +184,20 @@ IdentityMapBase::RawEntry IdentityMapBase::FindEntry(Object* key) const {
 }
 
 // Deletes the given key from the map using the object's address as the
-// identity, returning:
-//    found => the value
-//    not found => {nullptr}
-void* IdentityMapBase::DeleteEntry(Object* key) {
+// identity, returning true iff the key was found (in which case, the value
+// argument will be set to the deleted entry's value).
+bool IdentityMapBase::DeleteEntry(Object* key, void** deleted_value) {
   CHECK(!is_iterable());  // Don't allow deletion by key while iterable.
-  if (size_ == 0) return nullptr;
+  if (size_ == 0) return false;
   int index = Lookup(key);
-  if (index < 0) return nullptr;  // No entry found.
-  return DeleteIndex(index);
+  if (index < 0) return false;  // No entry found.
+  return DeleteIndex(index, deleted_value);
 }
 
 Object* IdentityMapBase::KeyAtIndex(int index) const {
   DCHECK_LE(0, index);
   DCHECK_LT(index, capacity_);
-  DCHECK_NE(keys_[index], heap_->not_mapped_symbol());
+  DCHECK_NE(keys_[index], ReadOnlyRoots(heap_).not_mapped_symbol());
   CHECK(is_iterable());  // Must be iterable to access by index;
   return keys_[index];
 }
@@ -206,7 +205,7 @@ Object* IdentityMapBase::KeyAtIndex(int index) const {
 IdentityMapBase::RawEntry IdentityMapBase::EntryAtIndex(int index) const {
   DCHECK_LE(0, index);
   DCHECK_LT(index, capacity_);
-  DCHECK_NE(keys_[index], heap_->not_mapped_symbol());
+  DCHECK_NE(keys_[index], ReadOnlyRoots(heap_).not_mapped_symbol());
   CHECK(is_iterable());  // Must be iterable to access by index;
   return &values_[index];
 }
@@ -215,7 +214,7 @@ int IdentityMapBase::NextIndex(int index) const {
   DCHECK_LE(-1, index);
   DCHECK_LE(index, capacity_);
   CHECK(is_iterable());  // Must be iterable to access by index;
-  Object* not_mapped = heap_->not_mapped_symbol();
+  Object* not_mapped = ReadOnlyRoots(heap_).not_mapped_symbol();
   for (++index; index < capacity_; ++index) {
     if (keys_[index] != not_mapped) {
       return index;
@@ -233,7 +232,7 @@ void IdentityMapBase::Rehash() {
   // Search the table looking for keys that wouldn't be found with their
   // current hashcode and evacuate them.
   int last_empty = -1;
-  Object* not_mapped = heap_->not_mapped_symbol();
+  Object* not_mapped = ReadOnlyRoots(heap_).not_mapped_symbol();
   for (int i = 0; i < capacity_; i++) {
     if (keys_[i] == not_mapped) {
       last_empty = i;
@@ -271,7 +270,7 @@ void IdentityMapBase::Resize(int new_capacity) {
   size_ = 0;
 
   keys_ = reinterpret_cast<Object**>(NewPointerArray(capacity_));
-  Object* not_mapped = heap_->not_mapped_symbol();
+  Object* not_mapped = ReadOnlyRoots(heap_).not_mapped_symbol();
   for (int i = 0; i < capacity_; i++) keys_[i] = not_mapped;
   values_ = NewPointerArray(capacity_);
   memset(values_, 0, sizeof(void*) * capacity_);
diff --git a/deps/v8/src/identity-map.h b/deps/v8/src/identity-map.h
index 4e69d3198af30c..ec2b558dc29687 100644
--- a/deps/v8/src/identity-map.h
+++ b/deps/v8/src/identity-map.h
@@ -43,7 +43,7 @@ class IdentityMapBase {
 
   RawEntry GetEntry(Object* key);
   RawEntry FindEntry(Object* key) const;
-  void* DeleteEntry(Object* key);
+  bool DeleteEntry(Object* key, void** deleted_value);
   void Clear();
 
   Object* KeyAtIndex(int index) const;
@@ -63,7 +63,7 @@ class IdentityMapBase {
   int InsertKey(Object* address);
   int Lookup(Object* key) const;
   int LookupOrInsert(Object* key);
-  void* DeleteIndex(int index);
+  bool DeleteIndex(int index, void** deleted_value);
   void Rehash();
   void Resize(int new_capacity);
   int Hash(Object* address) const;
@@ -113,8 +113,17 @@ class IdentityMap : public IdentityMapBase {
   void Set(Handle<Object> key, V v) { Set(*key, v); }
   void Set(Object* key, V v) { *(reinterpret_cast<V*>(GetEntry(key))) = v; }
 
-  V Delete(Handle<Object> key) { return Delete(*key); }
-  V Delete(Object* key) { return reinterpret_cast<V>(DeleteEntry(key)); }
+  bool Delete(Handle<Object> key, V* deleted_value) {
+    return Delete(*key, deleted_value);
+  }
+  bool Delete(Object* key, V* deleted_value) {
+    void* v = nullptr;
+    bool deleted_something = DeleteEntry(key, &v);
+    if (deleted_value != nullptr && deleted_something) {
+      *deleted_value = (V) reinterpret_cast<intptr_t>(v);
+    }
+    return deleted_something;
+  }
 
   // Removes all elements from the map.
   void Clear() { IdentityMapBase::Clear(); }
diff --git a/deps/v8/src/inspector/DEPS b/deps/v8/src/inspector/DEPS
index f396d64b99b170..e3457ca0f9e3af 100644
--- a/deps/v8/src/inspector/DEPS
+++ b/deps/v8/src/inspector/DEPS
@@ -5,6 +5,7 @@ include_rules = [
   "+src/base/macros.h",
   "+src/base/logging.h",
   "+src/base/platform/platform.h",
+  "+src/base/platform/mutex.h",
   "+src/conversions.h",
   "+src/flags.h",
   "+src/utils.h",
diff --git a/deps/v8/src/inspector/PRESUBMIT.py b/deps/v8/src/inspector/PRESUBMIT.py
index 9760cb0a5ba2a0..8b7a5cb3204166 100644
--- a/deps/v8/src/inspector/PRESUBMIT.py
+++ b/deps/v8/src/inspector/PRESUBMIT.py
@@ -61,6 +61,7 @@ def PostUploadHook(cl, change, output_api):
   return output_api.EnsureCQIncludeTrybotsAreAdded(
     cl,
     [
-      'master.tryserver.blink:linux_trusty_blink_rel'
+      'master.tryserver.blink:linux_trusty_blink_rel',
+      'luci.chromium.try:linux_chromium_headless_rel',
     ],
     'Automatically added layout test trybots to run tests on CQ.')
diff --git a/deps/v8/src/inspector/injected-script.cc b/deps/v8/src/inspector/injected-script.cc
index 662a5678b0db99..5852b227e7d333 100644
--- a/deps/v8/src/inspector/injected-script.cc
+++ b/deps/v8/src/inspector/injected-script.cc
@@ -263,6 +263,7 @@ std::unique_ptr<InjectedScript> InjectedScript::create(
   v8::HandleScope handles(isolate);
   v8::TryCatch tryCatch(isolate);
   v8::Local<v8::Context> context = inspectedContext->context();
+  v8::debug::PostponeInterruptsScope postponeInterrupts(isolate);
   v8::Context::Scope scope(context);
   v8::MicrotasksScope microtasksScope(isolate,
                                       v8::MicrotasksScope::kDoNotRunMicrotasks);
diff --git a/deps/v8/src/inspector/inspected-context.cc b/deps/v8/src/inspector/inspected-context.cc
index 5e2cf23bd9344f..bb98c871581920 100644
--- a/deps/v8/src/inspector/inspected-context.cc
+++ b/deps/v8/src/inspector/inspected-context.cc
@@ -110,11 +110,11 @@ InjectedScript* InspectedContext::getInjectedScript(int sessionId) {
 }
 
 bool InspectedContext::createInjectedScript(int sessionId) {
-  DCHECK(m_injectedScripts.find(sessionId) == m_injectedScripts.end());
   std::unique_ptr<InjectedScript> injectedScript =
       InjectedScript::create(this, sessionId);
   // InjectedScript::create can destroy |this|.
   if (!injectedScript) return false;
+  CHECK(m_injectedScripts.find(sessionId) == m_injectedScripts.end());
   m_injectedScripts[sessionId] = std::move(injectedScript);
   return true;
 }
diff --git a/deps/v8/src/inspector/js_protocol.json b/deps/v8/src/inspector/js_protocol.json
index eb8785dfdef889..23f887506313de 100644
--- a/deps/v8/src/inspector/js_protocol.json
+++ b/deps/v8/src/inspector/js_protocol.json
@@ -391,6 +391,13 @@
                             "description": "Whether to throw an exception if side effect cannot be ruled out during evaluation.",
                             "optional": true,
                             "type": "boolean"
+                        },
+                        {
+                            "name": "timeout",
+                            "description": "Terminate execution after timing out (number of milliseconds).",
+                            "experimental": true,
+                            "optional": true,
+                            "$ref": "Runtime.TimeDelta"
                         }
                     ],
                     "returns": [
@@ -711,6 +718,31 @@
                         }
                     ]
                 },
+                {
+                    "name": "setBreakpointOnFunctionCall",
+                    "description": "Sets JavaScript breakpoint before each call to the given function.\nIf another function was created from the same source as a given one,\ncalling it will also trigger the breakpoint.",
+                    "experimental": true,
+                    "parameters": [
+                        {
+                            "name": "objectId",
+                            "description": "Function object id.",
+                            "$ref": "Runtime.RemoteObjectId"
+                        },
+                        {
+                            "name": "condition",
+                            "description": "Expression to use as a breakpoint condition. When specified, debugger will\nstop on the breakpoint if this expression evaluates to true.",
+                            "optional": true,
+                            "type": "string"
+                        }
+                    ],
+                    "returns": [
+                        {
+                            "name": "breakpointId",
+                            "description": "Id of the created breakpoint for further reference.",
+                            "$ref": "BreakpointId"
+                        }
+                    ]
+                },
                 {
                     "name": "setBreakpointsActive",
                     "description": "Activates / deactivates all breakpoints on the page.",
@@ -2251,6 +2283,11 @@
                     "description": "Number of milliseconds since epoch.",
                     "type": "number"
                 },
+                {
+                    "id": "TimeDelta",
+                    "description": "Number of milliseconds.",
+                    "type": "number"
+                },
                 {
                     "id": "CallFrame",
                     "description": "Stack entry for runtime errors and assertions.",
@@ -2577,6 +2614,13 @@
                             "experimental": true,
                             "optional": true,
                             "type": "boolean"
+                        },
+                        {
+                            "name": "timeout",
+                            "description": "Terminate execution after timing out (number of milliseconds).",
+                            "experimental": true,
+                            "optional": true,
+                            "$ref": "TimeDelta"
                         }
                     ],
                     "returns": [
@@ -2814,6 +2858,18 @@
                         }
                     ]
                 },
+                {
+                    "name": "setAsyncCallStackDepth",
+                    "description": "Enables or disables async call stacks tracking.",
+                    "redirect": "Debugger",
+                    "parameters": [
+                        {
+                            "name": "maxDepth",
+                            "description": "Maximum depth of async call stacks. Setting to `0` will effectively disable collecting async\ncall stacks (default).",
+                            "type": "integer"
+                        }
+                    ]
+                },
                 {
                     "name": "setCustomObjectFormatterEnabled",
                     "experimental": true,
@@ -2824,13 +2880,70 @@
                         }
                     ]
                 },
+                {
+                    "name": "setMaxCallStackSizeToCapture",
+                    "experimental": true,
+                    "parameters": [
+                        {
+                            "name": "size",
+                            "type": "integer"
+                        }
+                    ]
+                },
                 {
                     "name": "terminateExecution",
                     "description": "Terminate current or next JavaScript execution.\nWill cancel the termination when the outer-most script execution ends.",
                     "experimental": true
+                },
+                {
+                    "name": "addBinding",
+                    "description": "If executionContextId is empty, adds binding with the given name on the\nglobal objects of all inspected contexts, including those created later,\nbindings survive reloads.\nIf executionContextId is specified, adds binding only on global object of\ngiven execution context.\nBinding function takes exactly one argument, this argument should be string,\nin case of any other input, function throws an exception.\nEach binding function call produces Runtime.bindingCalled notification.",
+                    "experimental": true,
+                    "parameters": [
+                        {
+                            "name": "name",
+                            "type": "string"
+                        },
+                        {
+                            "name": "executionContextId",
+                            "optional": true,
+                            "$ref": "ExecutionContextId"
+                        }
+                    ]
+                },
+                {
+                    "name": "removeBinding",
+                    "description": "This method does not remove binding function from global object but\nunsubscribes current runtime agent from Runtime.bindingCalled notifications.",
+                    "experimental": true,
+                    "parameters": [
+                        {
+                            "name": "name",
+                            "type": "string"
+                        }
+                    ]
                 }
             ],
             "events": [
+                {
+                    "name": "bindingCalled",
+                    "description": "Notification is issued every time when binding is called.",
+                    "experimental": true,
+                    "parameters": [
+                        {
+                            "name": "name",
+                            "type": "string"
+                        },
+                        {
+                            "name": "payload",
+                            "type": "string"
+                        },
+                        {
+                            "name": "executionContextId",
+                            "description": "Identifier of the context where the call was made.",
+                            "$ref": "ExecutionContextId"
+                        }
+                    ]
+                },
                 {
                     "name": "consoleAPICalled",
                     "description": "Issued when console API was called.",
diff --git a/deps/v8/src/inspector/js_protocol.pdl b/deps/v8/src/inspector/js_protocol.pdl
index d6e239cfb53185..a7e368d2b8b9d6 100644
--- a/deps/v8/src/inspector/js_protocol.pdl
+++ b/deps/v8/src/inspector/js_protocol.pdl
@@ -191,6 +191,8 @@ domain Debugger
       experimental optional boolean generatePreview
       # Whether to throw an exception if side effect cannot be ruled out during evaluation.
       optional boolean throwOnSideEffect
+      # Terminate execution after timing out (number of milliseconds).
+      experimental optional Runtime.TimeDelta timeout
     returns
       # Object wrapper for the evaluation result.
       Runtime.RemoteObject result
@@ -343,6 +345,20 @@ domain Debugger
       # List of the locations this breakpoint resolved into upon addition.
       array of Location locations
 
+  # Sets JavaScript breakpoint before each call to the given function.
+  # If another function was created from the same source as a given one,
+  # calling it will also trigger the breakpoint.
+  experimental command setBreakpointOnFunctionCall
+    parameters
+      # Function object id.
+      Runtime.RemoteObjectId objectId
+      # Expression to use as a breakpoint condition. When specified, debugger will
+      # stop on the breakpoint if this expression evaluates to true.
+      optional string condition
+    returns
+      # Id of the created breakpoint for further reference.
+      BreakpointId breakpointId
+
   # Activates / deactivates all breakpoints on the page.
   command setBreakpointsActive
     parameters
@@ -1046,6 +1062,9 @@ domain Runtime
   # Number of milliseconds since epoch.
   type Timestamp extends number
 
+  # Number of milliseconds.
+  type TimeDelta extends number
+
   # Stack entry for runtime errors and assertions.
   type CallFrame extends object
     properties
@@ -1189,6 +1208,8 @@ domain Runtime
       optional boolean awaitPromise
       # Whether to throw an exception if side effect cannot be ruled out during evaluation.
       experimental optional boolean throwOnSideEffect
+      # Terminate execution after timing out (number of milliseconds).
+      experimental optional TimeDelta timeout
     returns
       # Evaluation result.
       RemoteObject result
@@ -1293,14 +1314,53 @@ domain Runtime
       # Exception details.
       optional ExceptionDetails exceptionDetails
 
+  # Enables or disables async call stacks tracking.
+  command setAsyncCallStackDepth
+    redirect Debugger
+    parameters
+      # Maximum depth of async call stacks. Setting to `0` will effectively disable collecting async
+      # call stacks (default).
+      integer maxDepth
+
   experimental command setCustomObjectFormatterEnabled
     parameters
       boolean enabled
 
+  experimental command setMaxCallStackSizeToCapture
+    parameters
+      integer size
+
   # Terminate current or next JavaScript execution.
   # Will cancel the termination when the outer-most script execution ends.
   experimental command terminateExecution
 
+  # If executionContextId is empty, adds binding with the given name on the
+  # global objects of all inspected contexts, including those created later,
+  # bindings survive reloads.
+  # If executionContextId is specified, adds binding only on global object of
+  # given execution context.
+  # Binding function takes exactly one argument, this argument should be string,
+  # in case of any other input, function throws an exception.
+  # Each binding function call produces Runtime.bindingCalled notification.
+  experimental command addBinding
+    parameters
+      string name
+      optional ExecutionContextId executionContextId
+
+  # This method does not remove binding function from global object but
+  # unsubscribes current runtime agent from Runtime.bindingCalled notifications.
+  experimental command removeBinding
+    parameters
+      string name
+
+  # Notification is issued every time when binding is called.
+  experimental event bindingCalled
+    parameters
+      string name
+      string payload
+      # Identifier of the context where the call was made.
+      ExecutionContextId executionContextId
+
   # Issued when console API was called.
   event consoleAPICalled
     parameters
diff --git a/deps/v8/src/inspector/v8-console-message.cc b/deps/v8/src/inspector/v8-console-message.cc
index 83aee258255db8..408f88bc1d09b2 100644
--- a/deps/v8/src/inspector/v8-console-message.cc
+++ b/deps/v8/src/inspector/v8-console-message.cc
@@ -532,6 +532,14 @@ void V8ConsoleMessageStorage::time(int contextId, const String16& id) {
   m_data[contextId].m_time[id] = m_inspector->client()->currentTimeMS();
 }
 
+bool V8ConsoleMessageStorage::countReset(int contextId, const String16& id) {
+  std::map<String16, int>& count_map = m_data[contextId].m_count;
+  if (count_map.find(id) == count_map.end()) return false;
+
+  count_map[id] = 0;
+  return true;
+}
+
 double V8ConsoleMessageStorage::timeEnd(int contextId, const String16& id) {
   std::map<String16, double>& time = m_data[contextId].m_time;
   auto it = time.find(id);
diff --git a/deps/v8/src/inspector/v8-console-message.h b/deps/v8/src/inspector/v8-console-message.h
index 103cb9002b60b4..d030778a5b04b0 100644
--- a/deps/v8/src/inspector/v8-console-message.h
+++ b/deps/v8/src/inspector/v8-console-message.h
@@ -118,6 +118,7 @@ class V8ConsoleMessageStorage {
 
   bool shouldReportDeprecationMessage(int contextId, const String16& method);
   int count(int contextId, const String16& id);
+  bool countReset(int contextId, const String16& id);
   void time(int contextId, const String16& id);
   double timeEnd(int contextId, const String16& id);
   bool hasTimer(int contextId, const String16& id);
@@ -130,7 +131,9 @@ class V8ConsoleMessageStorage {
 
   struct PerContextData {
     std::set<String16> m_reportedDeprecationMessages;
+    // Corresponds to https://console.spec.whatwg.org/#count-map
     std::map<String16, int> m_count;
+    // Corresponds to https://console.spec.whatwg.org/#timer-table
     std::map<String16, double> m_time;
   };
   std::map<int, PerContextData> m_data;
diff --git a/deps/v8/src/inspector/v8-console.cc b/deps/v8/src/inspector/v8-console.cc
index 6f3278ee9f7405..faba4a082b94af 100644
--- a/deps/v8/src/inspector/v8-console.cc
+++ b/deps/v8/src/inspector/v8-console.cc
@@ -162,16 +162,16 @@ void returnDataCallback(const v8::FunctionCallbackInfo<v8::Value>& info) {
   info.GetReturnValue().Set(info.Data());
 }
 
-void createBoundFunctionProperty(v8::Local<v8::Context> context,
-                                 v8::Local<v8::Object> console,
-                                 v8::Local<v8::Value> data, const char* name,
-                                 v8::FunctionCallback callback,
-                                 const char* description = nullptr) {
+void createBoundFunctionProperty(
+    v8::Local<v8::Context> context, v8::Local<v8::Object> console,
+    v8::Local<v8::Value> data, const char* name, v8::FunctionCallback callback,
+    const char* description = nullptr,
+    v8::SideEffectType side_effect_type = v8::SideEffectType::kHasSideEffect) {
   v8::Local<v8::String> funcName =
       toV8StringInternalized(context->GetIsolate(), name);
   v8::Local<v8::Function> func;
   if (!v8::Function::New(context, callback, data, 0,
-                         v8::ConstructorBehavior::kThrow)
+                         v8::ConstructorBehavior::kThrow, side_effect_type)
            .ToLocal(&func))
     return;
   func->SetName(funcName);
@@ -180,7 +180,8 @@ void createBoundFunctionProperty(v8::Local<v8::Context> context,
         toV8String(context->GetIsolate(), description);
     v8::Local<v8::Function> toStringFunction;
     if (v8::Function::New(context, returnDataCallback, returnValue, 0,
-                          v8::ConstructorBehavior::kThrow)
+                          v8::ConstructorBehavior::kThrow,
+                          v8::SideEffectType::kHasNoSideEffect)
             .ToLocal(&toStringFunction))
       createDataProperty(context, func, toV8StringInternalized(
                                             context->GetIsolate(), "toString"),
@@ -281,14 +282,14 @@ void V8Console::Clear(const v8::debug::ConsoleCallArguments& info,
                                        String16("console.clear"));
 }
 
-void V8Console::Count(const v8::debug::ConsoleCallArguments& info,
-                      const v8::debug::ConsoleContext& consoleContext) {
-  ConsoleHelper helper(info, consoleContext, m_inspector);
-  String16 title = helper.firstArgToString(String16("default"), false);
+static String16 identifierFromTitleOrStackTrace(
+    const String16& title, const ConsoleHelper& helper,
+    const v8::debug::ConsoleContext& consoleContext,
+    V8InspectorImpl* inspector) {
   String16 identifier;
   if (title.isEmpty()) {
     std::unique_ptr<V8StackTraceImpl> stackTrace =
-        V8StackTraceImpl::capture(m_inspector->debugger(), helper.groupId(), 1);
+        V8StackTraceImpl::capture(inspector->debugger(), helper.groupId(), 1);
     if (stackTrace && !stackTrace->isEmpty()) {
       identifier = toString16(stackTrace->topSourceURL()) + ":" +
                    String16::fromInteger(stackTrace->topLineNumber());
@@ -298,6 +299,16 @@ void V8Console::Count(const v8::debug::ConsoleCallArguments& info,
   }
   identifier = consoleContextToString(consoleContext) + "@" + identifier;
 
+  return identifier;
+}
+
+void V8Console::Count(const v8::debug::ConsoleCallArguments& info,
+                      const v8::debug::ConsoleContext& consoleContext) {
+  ConsoleHelper helper(info, consoleContext, m_inspector);
+  String16 title = helper.firstArgToString(String16("default"), false);
+  String16 identifier = identifierFromTitleOrStackTrace(
+      title, helper, consoleContext, m_inspector);
+
   int count =
       helper.consoleMessageStorage()->count(helper.contextId(), identifier);
   String16 countString = String16::fromInteger(count);
@@ -306,6 +317,20 @@ void V8Console::Count(const v8::debug::ConsoleCallArguments& info,
       title.isEmpty() ? countString : (title + ": " + countString));
 }
 
+void V8Console::CountReset(const v8::debug::ConsoleCallArguments& info,
+                           const v8::debug::ConsoleContext& consoleContext) {
+  ConsoleHelper helper(info, consoleContext, m_inspector);
+  String16 title = helper.firstArgToString(String16("default"), false);
+  String16 identifier = identifierFromTitleOrStackTrace(
+      title, helper, consoleContext, m_inspector);
+
+  if (!helper.consoleMessageStorage()->countReset(helper.contextId(),
+                                                  identifier)) {
+    helper.reportCallWithArgument(ConsoleAPIType::kWarning,
+                                  "Count for '" + title + "' does not exist");
+  }
+}
+
 void V8Console::Assert(const v8::debug::ConsoleCallArguments& info,
                        const v8::debug::ConsoleContext& consoleContext) {
   ConsoleHelper helper(info, consoleContext, m_inspector);
@@ -320,16 +345,6 @@ void V8Console::Assert(const v8::debug::ConsoleCallArguments& info,
   m_inspector->debugger()->breakProgramOnAssert(helper.groupId());
 }
 
-void V8Console::MarkTimeline(const v8::debug::ConsoleCallArguments& info,
-                             const v8::debug::ConsoleContext& consoleContext) {
-  ConsoleHelper(info, consoleContext, m_inspector)
-      .reportDeprecatedCall("V8Console#markTimelineDeprecated",
-                            "'console.markTimeline' is "
-                            "deprecated. Please use "
-                            "'console.timeStamp' instead.");
-  TimeStamp(info, consoleContext);
-}
-
 void V8Console::Profile(const v8::debug::ConsoleCallArguments& info,
                         const v8::debug::ConsoleContext& consoleContext) {
   ConsoleHelper helper(info, consoleContext, m_inspector);
@@ -389,25 +404,6 @@ static void timeEndFunction(const v8::debug::ConsoleCallArguments& info,
   helper.reportCallWithArgument(ConsoleAPIType::kTimeEnd, message);
 }
 
-void V8Console::Timeline(const v8::debug::ConsoleCallArguments& info,
-                         const v8::debug::ConsoleContext& consoleContext) {
-  ConsoleHelper(info, consoleContext, m_inspector)
-      .reportDeprecatedCall("V8Console#timeline",
-                            "'console.timeline' is deprecated. Please use "
-                            "'console.time' instead.");
-  timeFunction(info, consoleContext, true, m_inspector);
-}
-
-void V8Console::TimelineEnd(const v8::debug::ConsoleCallArguments& info,
-                            const v8::debug::ConsoleContext& consoleContext) {
-  ConsoleHelper(info, consoleContext, m_inspector)
-      .reportDeprecatedCall("V8Console#timelineEnd",
-                            "'console.timelineEnd' is "
-                            "deprecated. Please use "
-                            "'console.timeEnd' instead.");
-  timeEndFunction(info, consoleContext, true, m_inspector);
-}
-
 void V8Console::Time(const v8::debug::ConsoleCallArguments& info,
                      const v8::debug::ConsoleContext& consoleContext) {
   timeFunction(info, consoleContext, false, m_inspector);
@@ -651,9 +647,9 @@ void V8Console::installMemoryGetter(v8::Local<v8::Context> context,
   v8::Local<v8::External> data = v8::External::New(isolate, this);
   console->SetAccessorProperty(
       toV8StringInternalized(isolate, "memory"),
-      v8::Function::New(context,
-                        &V8Console::call<&V8Console::memoryGetterCallback>,
-                        data, 0, v8::ConstructorBehavior::kThrow)
+      v8::Function::New(
+          context, &V8Console::call<&V8Console::memoryGetterCallback>, data, 0,
+          v8::ConstructorBehavior::kThrow, v8::SideEffectType::kHasNoSideEffect)
           .ToLocalChecked(),
       v8::Function::New(context,
                         &V8Console::call<&V8Console::memorySetterCallback>,
@@ -701,10 +697,12 @@ v8::Local<v8::Object> V8Console::createCommandLineAPI(
 
   createBoundFunctionProperty(context, commandLineAPI, data, "keys",
                               &V8Console::call<&V8Console::keysCallback>,
-                              "function keys(object) { [Command Line API] }");
+                              "function keys(object) { [Command Line API] }",
+                              v8::SideEffectType::kHasNoSideEffect);
   createBoundFunctionProperty(context, commandLineAPI, data, "values",
                               &V8Console::call<&V8Console::valuesCallback>,
-                              "function values(object) { [Command Line API] }");
+                              "function values(object) { [Command Line API] }",
+                              v8::SideEffectType::kHasNoSideEffect);
   createBoundFunctionProperty(
       context, commandLineAPI, data, "debug",
       &V8Console::call<&V8Console::debugFunctionCallback>,
@@ -734,17 +732,23 @@ v8::Local<v8::Object> V8Console::createCommandLineAPI(
       "function queryObjects(constructor) { [Command Line API] }");
   createBoundFunctionProperty(
       context, commandLineAPI, data, "$_",
-      &V8Console::call<&V8Console::lastEvaluationResultCallback>);
+      &V8Console::call<&V8Console::lastEvaluationResultCallback>, nullptr,
+      v8::SideEffectType::kHasNoSideEffect);
   createBoundFunctionProperty(context, commandLineAPI, data, "$0",
-                              &V8Console::call<&V8Console::inspectedObject0>);
+                              &V8Console::call<&V8Console::inspectedObject0>,
+                              nullptr, v8::SideEffectType::kHasNoSideEffect);
   createBoundFunctionProperty(context, commandLineAPI, data, "$1",
-                              &V8Console::call<&V8Console::inspectedObject1>);
+                              &V8Console::call<&V8Console::inspectedObject1>,
+                              nullptr, v8::SideEffectType::kHasNoSideEffect);
   createBoundFunctionProperty(context, commandLineAPI, data, "$2",
-                              &V8Console::call<&V8Console::inspectedObject2>);
+                              &V8Console::call<&V8Console::inspectedObject2>,
+                              nullptr, v8::SideEffectType::kHasNoSideEffect);
   createBoundFunctionProperty(context, commandLineAPI, data, "$3",
-                              &V8Console::call<&V8Console::inspectedObject3>);
+                              &V8Console::call<&V8Console::inspectedObject3>,
+                              nullptr, v8::SideEffectType::kHasNoSideEffect);
   createBoundFunctionProperty(context, commandLineAPI, data, "$4",
-                              &V8Console::call<&V8Console::inspectedObject4>);
+                              &V8Console::call<&V8Console::inspectedObject4>,
+                              nullptr, v8::SideEffectType::kHasNoSideEffect);
 
   m_inspector->client()->installAdditionalCommandLineAPI(context,
                                                          commandLineAPI);
@@ -827,7 +831,8 @@ V8Console::CommandLineAPIScope::CommandLineAPIScope(
              ->SetAccessor(context, v8::Local<v8::Name>::Cast(name),
                            CommandLineAPIScope::accessorGetterCallback,
                            CommandLineAPIScope::accessorSetterCallback,
-                           externalThis, v8::DEFAULT, v8::DontEnum)
+                           externalThis, v8::DEFAULT, v8::DontEnum,
+                           v8::SideEffectType::kHasNoSideEffect)
              .FromMaybe(false)) {
       bool removed = m_installedMethods->Delete(context, name).FromMaybe(false);
       DCHECK(removed);
diff --git a/deps/v8/src/inspector/v8-console.h b/deps/v8/src/inspector/v8-console.h
index 311625efde5637..2e47012807471f 100644
--- a/deps/v8/src/inspector/v8-console.h
+++ b/deps/v8/src/inspector/v8-console.h
@@ -16,7 +16,7 @@ class InspectedContext;
 class V8InspectorImpl;
 
 // Console API
-// https://console.spec.whatwg.org/#console-interface
+// https://console.spec.whatwg.org/#console-namespace
 class V8Console : public v8::debug::ConsoleDelegate {
  public:
   v8::Local<v8::Object> createCommandLineAPI(v8::Local<v8::Context> context,
@@ -78,18 +78,14 @@ class V8Console : public v8::debug::ConsoleDelegate {
              const v8::debug::ConsoleContext& consoleContext) override;
   void Count(const v8::debug::ConsoleCallArguments&,
              const v8::debug::ConsoleContext& consoleContext) override;
+  void CountReset(const v8::debug::ConsoleCallArguments&,
+                  const v8::debug::ConsoleContext& consoleContext) override;
   void Assert(const v8::debug::ConsoleCallArguments&,
               const v8::debug::ConsoleContext& consoleContext) override;
-  void MarkTimeline(const v8::debug::ConsoleCallArguments&,
-                    const v8::debug::ConsoleContext& consoleContext) override;
   void Profile(const v8::debug::ConsoleCallArguments&,
                const v8::debug::ConsoleContext& consoleContext) override;
   void ProfileEnd(const v8::debug::ConsoleCallArguments&,
                   const v8::debug::ConsoleContext& consoleContext) override;
-  void Timeline(const v8::debug::ConsoleCallArguments&,
-                const v8::debug::ConsoleContext& consoleContext) override;
-  void TimelineEnd(const v8::debug::ConsoleCallArguments&,
-                   const v8::debug::ConsoleContext& consoleContext) override;
   void Time(const v8::debug::ConsoleCallArguments&,
             const v8::debug::ConsoleContext& consoleContext) override;
   void TimeEnd(const v8::debug::ConsoleCallArguments&,
diff --git a/deps/v8/src/inspector/v8-debugger-agent-impl.cc b/deps/v8/src/inspector/v8-debugger-agent-impl.cc
index ece808b58bcda0..e4e6492b67a0c5 100644
--- a/deps/v8/src/inspector/v8-debugger-agent-impl.cc
+++ b/deps/v8/src/inspector/v8-debugger-agent-impl.cc
@@ -80,7 +80,8 @@ enum class BreakpointType {
   kByScriptHash,
   kByScriptId,
   kDebugCommand,
-  kMonitorCommand
+  kMonitorCommand,
+  kBreakpointAtEntry
 };
 
 String16 generateBreakpointId(BreakpointType type,
@@ -114,12 +115,13 @@ bool parseBreakpointId(const String16& breakpointId, BreakpointType* type,
 
   int rawType = breakpointId.substring(0, typeLineSeparator).toInteger();
   if (rawType < static_cast<int>(BreakpointType::kByUrl) ||
-      rawType > static_cast<int>(BreakpointType::kMonitorCommand)) {
+      rawType > static_cast<int>(BreakpointType::kBreakpointAtEntry)) {
     return false;
   }
   if (type) *type = static_cast<BreakpointType>(rawType);
   if (rawType == static_cast<int>(BreakpointType::kDebugCommand) ||
-      rawType == static_cast<int>(BreakpointType::kMonitorCommand)) {
+      rawType == static_cast<int>(BreakpointType::kMonitorCommand) ||
+      rawType == static_cast<int>(BreakpointType::kBreakpointAtEntry)) {
     // The script and source position is not encoded in this case.
     return true;
   }
@@ -253,26 +255,33 @@ Response buildScopes(v8::debug::ScopeIterator* iterator,
                      std::unique_ptr<Array<Scope>>* scopes) {
   *scopes = Array<Scope>::create();
   if (!injectedScript) return Response::OK();
+  if (iterator->Done()) return Response::OK();
+
+  String16 scriptId = String16::fromInteger(iterator->GetScriptId());
+
   for (; !iterator->Done(); iterator->Advance()) {
     std::unique_ptr<RemoteObject> object;
     Response result = injectedScript->wrapObject(
         iterator->GetObject(), kBacktraceObjectGroup, false, false, &object);
     if (!result.isSuccess()) return result;
+
     auto scope = Scope::create()
                      .setType(scopeType(iterator->GetType()))
                      .setObject(std::move(object))
                      .build();
-    v8::Local<v8::Function> closure = iterator->GetFunction();
-    if (!closure.IsEmpty()) {
-      String16 name = toProtocolStringWithTypeCheck(closure->GetDebugName());
-      if (!name.isEmpty()) scope->setName(name);
-      String16 scriptId = String16::fromInteger(closure->ScriptId());
+
+    String16 name =
+        toProtocolStringWithTypeCheck(iterator->GetFunctionDebugName());
+    if (!name.isEmpty()) scope->setName(name);
+
+    if (iterator->HasLocationInfo()) {
       v8::debug::Location start = iterator->GetStartLocation();
       scope->setStartLocation(protocol::Debugger::Location::create()
                                   .setScriptId(scriptId)
                                   .setLineNumber(start.GetLineNumber())
                                   .setColumnNumber(start.GetColumnNumber())
                                   .build());
+
       v8::debug::Location end = iterator->GetEndLocation();
       scope->setEndLocation(protocol::Debugger::Location::create()
                                 .setScriptId(scriptId)
@@ -285,62 +294,6 @@ Response buildScopes(v8::debug::ScopeIterator* iterator,
   return Response::OK();
 }
 
-bool liveEditExceptionToDetails(
-    V8InspectorImpl* inspector, v8::Local<v8::Context> context,
-    v8::Local<v8::Value> exceptionValue,
-    Maybe<protocol::Runtime::ExceptionDetails>* exceptionDetails) {
-  if (!exceptionValue->IsObject()) return false;
-  v8::Isolate* isolate = context->GetIsolate();
-  v8::Local<v8::Object> exception = exceptionValue.As<v8::Object>();
-  v8::Local<v8::Value> detailsValue;
-  if (!exception->Get(context, toV8String(isolate, "details"))
-           .ToLocal(&detailsValue) ||
-      !detailsValue->IsObject()) {
-    return false;
-  }
-  v8::Local<v8::Object> details = detailsValue.As<v8::Object>();
-  v8::Local<v8::Value> message;
-  if (!details->Get(context, toV8String(isolate, "syntaxErrorMessage"))
-           .ToLocal(&message) ||
-      !message->IsString()) {
-    return false;
-  }
-  v8::Local<v8::Value> positionValue;
-  if (!details->Get(context, toV8String(isolate, "position"))
-           .ToLocal(&positionValue) ||
-      !positionValue->IsObject()) {
-    return false;
-  }
-  v8::Local<v8::Value> startPositionValue;
-  if (!positionValue.As<v8::Object>()
-           ->Get(context, toV8String(isolate, "start"))
-           .ToLocal(&startPositionValue) ||
-      !startPositionValue->IsObject()) {
-    return false;
-  }
-  v8::Local<v8::Object> startPosition = startPositionValue.As<v8::Object>();
-  v8::Local<v8::Value> lineValue;
-  if (!startPosition->Get(context, toV8String(isolate, "line"))
-           .ToLocal(&lineValue) ||
-      !lineValue->IsInt32()) {
-    return false;
-  }
-  v8::Local<v8::Value> columnValue;
-  if (!startPosition->Get(context, toV8String(isolate, "column"))
-           .ToLocal(&columnValue) ||
-      !columnValue->IsInt32()) {
-    return false;
-  }
-  *exceptionDetails =
-      protocol::Runtime::ExceptionDetails::create()
-          .setExceptionId(inspector->nextExceptionId())
-          .setText(toProtocolString(message.As<v8::String>()))
-          .setLineNumber(lineValue->Int32Value(context).FromJust() - 1)
-          .setColumnNumber(columnValue->Int32Value(context).FromJust() - 1)
-          .build();
-  return true;
-}
-
 protocol::DictionaryValue* getOrCreateObject(protocol::DictionaryValue* object,
                                              const String16& key) {
   protocol::DictionaryValue* value = object->getObject(key);
@@ -409,12 +362,10 @@ Response V8DebuggerAgentImpl::disable() {
                       v8::debug::NoBreakOnException);
   m_state->setInteger(DebuggerAgentState::asyncCallStackDepth, 0);
 
-  if (isPaused()) m_debugger->continueProgram(m_session->contextGroupId());
   if (m_breakpointsActive) {
     m_debugger->setBreakpointsActive(false);
     m_breakpointsActive = false;
   }
-  m_debugger->disable();
   m_blackboxedPositions.clear();
   m_blackboxPattern.reset();
   resetBlackboxedStateCache();
@@ -431,6 +382,7 @@ Response V8DebuggerAgentImpl::disable() {
   m_state->remove(DebuggerAgentState::blackboxPattern);
   m_enabled = false;
   m_state->setBoolean(DebuggerAgentState::debuggerEnabled, false);
+  m_debugger->disable();
   return Response::OK();
 }
 
@@ -469,7 +421,7 @@ Response V8DebuggerAgentImpl::setBreakpointsActive(bool active) {
   m_debugger->setBreakpointsActive(active);
   if (!active && !m_breakReason.empty()) {
     clearBreakDetails();
-    m_debugger->setPauseOnNextStatement(false, m_session->contextGroupId());
+    m_debugger->setPauseOnNextCall(false, m_session->contextGroupId());
   }
   return Response::OK();
 }
@@ -603,6 +555,30 @@ Response V8DebuggerAgentImpl::setBreakpoint(
   return Response::OK();
 }
 
+Response V8DebuggerAgentImpl::setBreakpointOnFunctionCall(
+    const String16& functionObjectId, Maybe<String16> optionalCondition,
+    String16* outBreakpointId) {
+  InjectedScript::ObjectScope scope(m_session, functionObjectId);
+  Response response = scope.initialize();
+  if (!response.isSuccess()) return response;
+  if (!scope.object()->IsFunction()) {
+    return Response::Error("Could not find function with given id");
+  }
+  v8::Local<v8::Function> function =
+      v8::Local<v8::Function>::Cast(scope.object());
+  String16 breakpointId =
+      generateBreakpointId(BreakpointType::kBreakpointAtEntry, function);
+  if (m_breakpointIdToDebuggerBreakpointIds.find(breakpointId) !=
+      m_breakpointIdToDebuggerBreakpointIds.end()) {
+    return Response::Error("Breakpoint at specified location already exists.");
+  }
+  v8::Local<v8::String> condition =
+      toV8String(m_isolate, optionalCondition.fromMaybe(String16()));
+  setBreakpointImpl(breakpointId, function, condition);
+  *outBreakpointId = breakpointId;
+  return Response::OK();
+}
+
 Response V8DebuggerAgentImpl::removeBreakpoint(const String16& breakpointId) {
   if (!enabled()) return Response::Error(kDebuggerNotEnabled);
   BreakpointType type;
@@ -685,9 +661,12 @@ Response V8DebuggerAgentImpl::getPossibleBreakpoints(
   std::vector<v8::debug::BreakLocation> v8Locations;
   {
     v8::HandleScope handleScope(m_isolate);
-    v8::Local<v8::Context> debuggerContext =
-        v8::debug::GetDebugContext(m_isolate);
-    v8::Context::Scope contextScope(debuggerContext);
+    int contextId = it->second->executionContextId();
+    InspectedContext* inspected = m_inspector->getContext(contextId);
+    if (!inspected) {
+      return Response::Error("Cannot retrive script context");
+    }
+    v8::Context::Scope contextScope(inspected->context());
     v8::MicrotasksScope microtasks(m_isolate,
                                    v8::MicrotasksScope::kDoNotRunMicrotasks);
     v8::TryCatch tryCatch(m_isolate);
@@ -892,23 +871,22 @@ Response V8DebuggerAgentImpl::setScriptSource(
   v8::HandleScope handleScope(m_isolate);
   v8::Local<v8::Context> context = inspected->context();
   v8::Context::Scope contextScope(context);
-  v8::TryCatch tryCatch(m_isolate);
-
-  bool stackChangedValue = false;
-  it->second->setSource(newContent, dryRun.fromMaybe(false),
-                        &stackChangedValue);
-  if (tryCatch.HasCaught()) {
-    if (liveEditExceptionToDetails(m_inspector, context, tryCatch.Exception(),
-                                   optOutCompileError)) {
-      return Response::OK();
-    }
-    v8::Local<v8::Message> message = tryCatch.Message();
-    if (!message.IsEmpty())
-      return Response::Error(toProtocolStringWithTypeCheck(message->Get()));
-    else
-      return Response::InternalError();
+
+  v8::debug::LiveEditResult result;
+  it->second->setSource(newContent, dryRun.fromMaybe(false), &result);
+  if (result.status != v8::debug::LiveEditResult::OK) {
+    *optOutCompileError =
+        protocol::Runtime::ExceptionDetails::create()
+            .setExceptionId(m_inspector->nextExceptionId())
+            .setText(toProtocolString(result.message))
+            .setLineNumber(result.line_number != -1 ? result.line_number - 1
+                                                    : 0)
+            .setColumnNumber(result.column_number != -1 ? result.column_number
+                                                        : 0)
+            .build();
+    return Response::OK();
   } else {
-    *stackChanged = stackChangedValue;
+    *stackChanged = result.stack_changed;
   }
   std::unique_ptr<Array<CallFrame>> callFrames;
   Response response = currentCallFrames(&callFrames);
@@ -974,7 +952,7 @@ void V8DebuggerAgentImpl::schedulePauseOnNextStatement(
     std::unique_ptr<protocol::DictionaryValue> data) {
   if (isPaused() || !acceptsPause(false) || !m_breakpointsActive) return;
   if (m_breakReason.empty()) {
-    m_debugger->setPauseOnNextStatement(true, m_session->contextGroupId());
+    m_debugger->setPauseOnNextCall(true, m_session->contextGroupId());
   }
   pushBreakDetails(breakReason, std::move(data));
 }
@@ -982,7 +960,7 @@ void V8DebuggerAgentImpl::schedulePauseOnNextStatement(
 void V8DebuggerAgentImpl::cancelPauseOnNextStatement() {
   if (isPaused() || !acceptsPause(false) || !m_breakpointsActive) return;
   if (m_breakReason.size() == 1) {
-    m_debugger->setPauseOnNextStatement(false, m_session->contextGroupId());
+    m_debugger->setPauseOnNextCall(false, m_session->contextGroupId());
   }
   popBreakDetails();
 }
@@ -990,10 +968,14 @@ void V8DebuggerAgentImpl::cancelPauseOnNextStatement() {
 Response V8DebuggerAgentImpl::pause() {
   if (!enabled()) return Response::Error(kDebuggerNotEnabled);
   if (isPaused()) return Response::OK();
-  if (m_breakReason.empty()) {
-    m_debugger->setPauseOnNextStatement(true, m_session->contextGroupId());
+  if (m_debugger->canBreakProgram()) {
+    m_debugger->interruptAndBreak(m_session->contextGroupId());
+  } else {
+    if (m_breakReason.empty()) {
+      m_debugger->setPauseOnNextCall(true, m_session->contextGroupId());
+    }
+    pushBreakDetails(protocol::Debugger::Paused::ReasonEnum::Other, nullptr);
   }
-  pushBreakDetails(protocol::Debugger::Paused::ReasonEnum::Other, nullptr);
   return Response::OK();
 }
 
@@ -1078,7 +1060,8 @@ Response V8DebuggerAgentImpl::evaluateOnCallFrame(
     const String16& callFrameId, const String16& expression,
     Maybe<String16> objectGroup, Maybe<bool> includeCommandLineAPI,
     Maybe<bool> silent, Maybe<bool> returnByValue, Maybe<bool> generatePreview,
-    Maybe<bool> throwOnSideEffect, std::unique_ptr<RemoteObject>* result,
+    Maybe<bool> throwOnSideEffect, Maybe<double> timeout,
+    std::unique_ptr<RemoteObject>* result,
     Maybe<protocol::Runtime::ExceptionDetails>* exceptionDetails) {
   if (!isPaused()) return Response::Error(kDebuggerNotPaused);
   InjectedScript::CallFrameScope scope(m_session, callFrameId);
@@ -1092,8 +1075,17 @@ Response V8DebuggerAgentImpl::evaluateOnCallFrame(
   if (it->Done()) {
     return Response::Error("Could not find call frame with given id");
   }
-  v8::MaybeLocal<v8::Value> maybeResultValue = it->Evaluate(
-      toV8String(m_isolate, expression), throwOnSideEffect.fromMaybe(false));
+
+  v8::MaybeLocal<v8::Value> maybeResultValue;
+  {
+    V8InspectorImpl::EvaluateScope evaluateScope(m_isolate);
+    if (timeout.isJust()) {
+      response = evaluateScope.setTimeout(timeout.fromJust() / 1000.0);
+      if (!response.isSuccess()) return response;
+    }
+    maybeResultValue = it->Evaluate(toV8String(m_isolate, expression),
+                                    throwOnSideEffect.fromMaybe(false));
+  }
   // Re-initialize after running client's code, as it could have destroyed
   // context or session.
   response = scope.initialize();
@@ -1164,7 +1156,9 @@ Response V8DebuggerAgentImpl::setReturnValue(
 }
 
 Response V8DebuggerAgentImpl::setAsyncCallStackDepth(int depth) {
-  if (!enabled()) return Response::Error(kDebuggerNotEnabled);
+  if (!enabled() && !m_session->runtimeAgent()->enabled()) {
+    return Response::Error(kDebuggerNotEnabled);
+  }
   m_state->setInteger(DebuggerAgentState::asyncCallStackDepth, depth);
   m_debugger->setAsyncCallStackDepth(this, depth);
   return Response::OK();
@@ -1309,7 +1303,7 @@ Response V8DebuggerAgentImpl::currentCallFrames(
     auto frame =
         CallFrame::create()
             .setCallFrameId(callFrameId)
-            .setFunctionName(toProtocolString(iterator->GetFunctionName()))
+            .setFunctionName(toProtocolString(iterator->GetFunctionDebugName()))
             .setLocation(std::move(location))
             .setUrl(url)
             .setScopeChain(std::move(scopes))
@@ -1626,7 +1620,7 @@ void V8DebuggerAgentImpl::breakProgram(
   popBreakDetails();
   m_breakReason.swap(currentScheduledReason);
   if (!m_breakReason.empty()) {
-    m_debugger->setPauseOnNextStatement(true, m_session->contextGroupId());
+    m_debugger->setPauseOnNextCall(true, m_session->contextGroupId());
   }
 }
 
diff --git a/deps/v8/src/inspector/v8-debugger-agent-impl.h b/deps/v8/src/inspector/v8-debugger-agent-impl.h
index c67e20142d1b0a..f5623a8dc55509 100644
--- a/deps/v8/src/inspector/v8-debugger-agent-impl.h
+++ b/deps/v8/src/inspector/v8-debugger-agent-impl.h
@@ -55,6 +55,9 @@ class V8DebuggerAgentImpl : public protocol::Debugger::Backend {
       std::unique_ptr<protocol::Debugger::Location>,
       Maybe<String16> optionalCondition, String16*,
       std::unique_ptr<protocol::Debugger::Location>* actualLocation) override;
+  Response setBreakpointOnFunctionCall(const String16& functionObjectId,
+                                       Maybe<String16> optionalCondition,
+                                       String16* outBreakpointId) override;
   Response removeBreakpoint(const String16& breakpointId) override;
   Response continueToLocation(std::unique_ptr<protocol::Debugger::Location>,
                               Maybe<String16> targetCallFrames) override;
@@ -102,6 +105,7 @@ class V8DebuggerAgentImpl : public protocol::Debugger::Backend {
       Maybe<String16> objectGroup, Maybe<bool> includeCommandLineAPI,
       Maybe<bool> silent, Maybe<bool> returnByValue,
       Maybe<bool> generatePreview, Maybe<bool> throwOnSideEffect,
+      Maybe<double> timeout,
       std::unique_ptr<protocol::Runtime::RemoteObject>* result,
       Maybe<protocol::Runtime::ExceptionDetails>*) override;
   Response setVariableValue(
diff --git a/deps/v8/src/inspector/v8-debugger-script.cc b/deps/v8/src/inspector/v8-debugger-script.cc
index dc5054a6658818..c40477ae2af74d 100644
--- a/deps/v8/src/inspector/v8-debugger-script.cc
+++ b/deps/v8/src/inspector/v8-debugger-script.cc
@@ -37,7 +37,8 @@ String16 calculateHash(const String16& str) {
   size_t sizeInBytes = sizeof(UChar) * str.length();
   data = reinterpret_cast<const uint32_t*>(str.characters16());
   for (size_t i = 0; i < sizeInBytes / 4; ++i) {
-    uint32_t d = v8::internal::ReadUnalignedUInt32(data + i);
+    uint32_t d = v8::internal::ReadUnalignedUInt32(
+        reinterpret_cast<v8::internal::Address>(data + i));
 #if V8_TARGET_LITTLE_ENDIAN
     uint32_t v = d;
 #else
@@ -113,37 +114,7 @@ class ActualScript : public V8DebuggerScript {
       : V8DebuggerScript(isolate, String16::fromInteger(script->Id()),
                          GetNameOrSourceUrl(script)),
         m_isLiveEdit(isLiveEdit) {
-    v8::Local<v8::String> tmp;
-    if (script->SourceURL().ToLocal(&tmp)) m_sourceURL = toProtocolString(tmp);
-    if (script->SourceMappingURL().ToLocal(&tmp))
-      m_sourceMappingURL = toProtocolString(tmp);
-    m_startLine = script->LineOffset();
-    m_startColumn = script->ColumnOffset();
-    std::vector<int> lineEnds = script->LineEnds();
-    CHECK(lineEnds.size());
-    int source_length = lineEnds[lineEnds.size() - 1];
-    if (lineEnds.size()) {
-      m_endLine = static_cast<int>(lineEnds.size()) + m_startLine - 1;
-      if (lineEnds.size() > 1) {
-        m_endColumn = source_length - lineEnds[lineEnds.size() - 2] - 1;
-      } else {
-        m_endColumn = source_length + m_startColumn;
-      }
-    } else {
-      m_endLine = m_startLine;
-      m_endColumn = m_startColumn;
-    }
-
-    USE(script->ContextId().To(&m_executionContextId));
-
-    if (script->Source().ToLocal(&tmp)) {
-      m_source = toProtocolString(tmp);
-    }
-
-    m_isModule = script->IsModule();
-
-    m_script.Reset(m_isolate, script);
-    m_script.AnnotateStrongRetainer(kGlobalDebuggerScriptHandleLabel);
+    Initialize(script);
   }
 
   bool isLiveEdit() const override { return m_isLiveEdit; }
@@ -165,17 +136,17 @@ class ActualScript : public V8DebuggerScript {
   }
 
   void setSource(const String16& newSource, bool preview,
-                 bool* stackChanged) override {
+                 v8::debug::LiveEditResult* result) override {
     DCHECK(!isModule());
-    v8::HandleScope scope(m_isolate);
+    v8::EscapableHandleScope scope(m_isolate);
     v8::Local<v8::String> v8Source = toV8String(m_isolate, newSource);
-    if (!m_script.Get(m_isolate)->SetScriptSource(v8Source, preview,
-                                                  stackChanged)) {
+    if (!m_script.Get(m_isolate)->SetScriptSource(v8Source, preview, result)) {
+      result->message = scope.Escape(result->message);
       return;
     }
     if (preview) return;
-    m_source = newSource;
     m_hash = String16();
+    Initialize(scope.Escape(result->script));
   }
 
   bool getPossibleBreakpoints(
@@ -258,6 +229,40 @@ class ActualScript : public V8DebuggerScript {
     return m_script.Get(m_isolate);
   }
 
+  void Initialize(v8::Local<v8::debug::Script> script) {
+    v8::Local<v8::String> tmp;
+    if (script->SourceURL().ToLocal(&tmp)) m_sourceURL = toProtocolString(tmp);
+    if (script->SourceMappingURL().ToLocal(&tmp))
+      m_sourceMappingURL = toProtocolString(tmp);
+    m_startLine = script->LineOffset();
+    m_startColumn = script->ColumnOffset();
+    std::vector<int> lineEnds = script->LineEnds();
+    CHECK(lineEnds.size());
+    int source_length = lineEnds[lineEnds.size() - 1];
+    if (lineEnds.size()) {
+      m_endLine = static_cast<int>(lineEnds.size()) + m_startLine - 1;
+      if (lineEnds.size() > 1) {
+        m_endColumn = source_length - lineEnds[lineEnds.size() - 2] - 1;
+      } else {
+        m_endColumn = source_length + m_startColumn;
+      }
+    } else {
+      m_endLine = m_startLine;
+      m_endColumn = m_startColumn;
+    }
+
+    USE(script->ContextId().To(&m_executionContextId));
+
+    if (script->Source().ToLocal(&tmp)) {
+      m_source = toProtocolString(tmp);
+    }
+
+    m_isModule = script->IsModule();
+
+    m_script.Reset(m_isolate, script);
+    m_script.AnnotateStrongRetainer(kGlobalDebuggerScriptHandleLabel);
+  }
+
   String16 m_sourceMappingURL;
   bool m_isLiveEdit = false;
   bool m_isModule = false;
@@ -289,7 +294,9 @@ class WasmVirtualScript : public V8DebuggerScript {
   bool isLiveEdit() const override { return false; }
   bool isModule() const override { return false; }
   void setSourceMappingURL(const String16&) override {}
-  void setSource(const String16&, bool, bool*) override { UNREACHABLE(); }
+  void setSource(const String16&, bool, v8::debug::LiveEditResult*) override {
+    UNREACHABLE();
+  }
   bool isSourceLoadedLazily() const override { return true; }
   const String16& source() const override {
     return m_wasmTranslation->GetSource(m_id, m_functionIndex);
diff --git a/deps/v8/src/inspector/v8-debugger-script.h b/deps/v8/src/inspector/v8-debugger-script.h
index 3e3885ed52e1fd..e0e7d93b202752 100644
--- a/deps/v8/src/inspector/v8-debugger-script.h
+++ b/deps/v8/src/inspector/v8-debugger-script.h
@@ -73,7 +73,7 @@ class V8DebuggerScript {
   void setSourceURL(const String16&);
   virtual void setSourceMappingURL(const String16&) = 0;
   virtual void setSource(const String16& source, bool preview,
-                         bool* stackChanged) = 0;
+                         v8::debug::LiveEditResult* result) = 0;
 
   virtual bool getPossibleBreakpoints(
       const v8::debug::Location& start, const v8::debug::Location& end,
diff --git a/deps/v8/src/inspector/v8-debugger.cc b/deps/v8/src/inspector/v8-debugger.cc
index 01e9acd9c9e6bd..1ceb4210f7f476 100644
--- a/deps/v8/src/inspector/v8-debugger.cc
+++ b/deps/v8/src/inspector/v8-debugger.cc
@@ -170,12 +170,10 @@ V8Debugger::V8Debugger(v8::Isolate* isolate, V8InspectorImpl* inspector)
       m_wasmTranslation(isolate) {}
 
 V8Debugger::~V8Debugger() {
-  if (m_terminateExecutionCallback) {
-    m_isolate->RemoveCallCompletedCallback(
-        &V8Debugger::terminateExecutionCompletedCallback);
-    m_isolate->RemoveMicrotasksCompletedCallback(
-        &V8Debugger::terminateExecutionCompletedCallback);
-  }
+  m_isolate->RemoveCallCompletedCallback(
+      &V8Debugger::terminateExecutionCompletedCallback);
+  m_isolate->RemoveMicrotasksCompletedCallback(
+      &V8Debugger::terminateExecutionCompletedCallback);
 }
 
 void V8Debugger::enable() {
@@ -188,9 +186,20 @@ void V8Debugger::enable() {
 }
 
 void V8Debugger::disable() {
+  if (isPaused()) {
+    bool scheduledOOMBreak = m_scheduledOOMBreak;
+    bool hasAgentAcceptsPause = false;
+    m_inspector->forEachSession(
+        m_pausedContextGroupId, [&scheduledOOMBreak, &hasAgentAcceptsPause](
+                                    V8InspectorSessionImpl* session) {
+          if (session->debuggerAgent()->acceptsPause(scheduledOOMBreak)) {
+            hasAgentAcceptsPause = true;
+          }
+        });
+    if (!hasAgentAcceptsPause) m_inspector->client()->quitMessageLoopOnPause();
+  }
   if (--m_enableCount) return;
   clearContinueToLocation();
-  allAsyncTasksCanceled();
   m_taskWithScheduledBreak = nullptr;
   m_taskWithScheduledBreakDebuggerId = String16();
   m_pauseOnAsyncCall = false;
@@ -249,7 +258,7 @@ void V8Debugger::setPauseOnExceptionsState(
   m_pauseOnExceptionsState = pauseOnExceptionsState;
 }
 
-void V8Debugger::setPauseOnNextStatement(bool pause, int targetContextGroupId) {
+void V8Debugger::setPauseOnNextCall(bool pause, int targetContextGroupId) {
   if (isPaused()) return;
   DCHECK(targetContextGroupId);
   if (!pause && m_targetContextGroupId &&
@@ -259,9 +268,9 @@ void V8Debugger::setPauseOnNextStatement(bool pause, int targetContextGroupId) {
   m_targetContextGroupId = targetContextGroupId;
   m_breakRequested = pause;
   if (pause)
-    v8::debug::DebugBreak(m_isolate);
+    v8::debug::SetBreakOnNextFunctionCall(m_isolate);
   else
-    v8::debug::CancelDebugBreak(m_isolate);
+    v8::debug::ClearBreakOnNextFunctionCall(m_isolate);
 }
 
 bool V8Debugger::canBreakProgram() {
@@ -277,6 +286,16 @@ void V8Debugger::breakProgram(int targetContextGroupId) {
   v8::debug::BreakRightNow(m_isolate);
 }
 
+void V8Debugger::interruptAndBreak(int targetContextGroupId) {
+  // Don't allow nested breaks.
+  if (isPaused()) return;
+  DCHECK(targetContextGroupId);
+  m_targetContextGroupId = targetContextGroupId;
+  m_isolate->RequestInterrupt(
+      [](v8::Isolate* isolate, void*) { v8::debug::BreakRightNow(isolate); },
+      nullptr);
+}
+
 void V8Debugger::continueProgram(int targetContextGroupId) {
   if (m_pausedContextGroupId != targetContextGroupId) return;
   if (isPaused()) m_inspector->client()->quitMessageLoopOnPause();
@@ -298,6 +317,7 @@ void V8Debugger::stepIntoStatement(int targetContextGroupId,
                                    bool breakOnAsyncCall) {
   DCHECK(isPaused());
   DCHECK(targetContextGroupId);
+  if (asyncStepOutOfFunction(targetContextGroupId, true)) return;
   m_targetContextGroupId = targetContextGroupId;
   m_pauseOnAsyncCall = breakOnAsyncCall;
   v8::debug::PrepareStep(m_isolate, v8::debug::StepIn);
@@ -307,6 +327,7 @@ void V8Debugger::stepIntoStatement(int targetContextGroupId,
 void V8Debugger::stepOverStatement(int targetContextGroupId) {
   DCHECK(isPaused());
   DCHECK(targetContextGroupId);
+  if (asyncStepOutOfFunction(targetContextGroupId, true)) return;
   m_targetContextGroupId = targetContextGroupId;
   v8::debug::PrepareStep(m_isolate, v8::debug::StepNext);
   continueProgram(targetContextGroupId);
@@ -315,11 +336,44 @@ void V8Debugger::stepOverStatement(int targetContextGroupId) {
 void V8Debugger::stepOutOfFunction(int targetContextGroupId) {
   DCHECK(isPaused());
   DCHECK(targetContextGroupId);
+  if (asyncStepOutOfFunction(targetContextGroupId, false)) return;
   m_targetContextGroupId = targetContextGroupId;
   v8::debug::PrepareStep(m_isolate, v8::debug::StepOut);
   continueProgram(targetContextGroupId);
 }
 
+bool V8Debugger::asyncStepOutOfFunction(int targetContextGroupId,
+                                        bool onlyAtReturn) {
+  auto iterator = v8::debug::StackTraceIterator::Create(m_isolate);
+  DCHECK(!iterator->Done());
+  bool atReturn = !iterator->GetReturnValue().IsEmpty();
+  iterator->Advance();
+  // Synchronous stack has more then one frame.
+  if (!iterator->Done()) return false;
+  // There is only one synchronous frame but we are not at return position and
+  // user requests stepOver or stepInto.
+  if (onlyAtReturn && !atReturn) return false;
+  // If we are inside async function, current async parent was captured when
+  // async function was suspended first time and we install that stack as
+  // current before resume async function. So it represents current async
+  // function.
+  auto current = currentAsyncParent();
+  if (!current) return false;
+  // Lookup for parent async function.
+  auto parent = current->parent();
+  if (parent.expired()) return false;
+  // Parent async stack will have suspended task id iff callee async function
+  // is awaiting current async function. We can make stepOut there only in this
+  // case.
+  void* parentTask =
+      std::shared_ptr<AsyncStackTrace>(parent)->suspendedTaskId();
+  if (!parentTask) return false;
+  pauseOnAsyncCall(targetContextGroupId,
+                   reinterpret_cast<uintptr_t>(parentTask), String16());
+  continueProgram(targetContextGroupId);
+  return true;
+}
+
 void V8Debugger::scheduleStepIntoAsync(
     std::unique_ptr<ScheduleStepIntoAsyncCallback> callback,
     int targetContextGroupId) {
@@ -345,8 +399,10 @@ void V8Debugger::pauseOnAsyncCall(int targetContextGroupId, uintptr_t task,
 void V8Debugger::terminateExecution(
     std::unique_ptr<TerminateExecutionCallback> callback) {
   if (m_terminateExecutionCallback) {
-    callback->sendFailure(
-        Response::Error("There is current termination request in progress"));
+    if (callback) {
+      callback->sendFailure(
+          Response::Error("There is current termination request in progress"));
+    }
     return;
   }
   m_terminateExecutionCallback = std::move(callback);
@@ -366,8 +422,10 @@ void V8Debugger::terminateExecutionCompletedCallback(v8::Isolate* isolate) {
       static_cast<V8InspectorImpl*>(v8::debug::GetInspector(isolate));
   V8Debugger* debugger = inspector->debugger();
   debugger->m_isolate->CancelTerminateExecution();
-  debugger->m_terminateExecutionCallback->sendSuccess();
-  debugger->m_terminateExecutionCallback.reset();
+  if (debugger->m_terminateExecutionCallback) {
+    debugger->m_terminateExecutionCallback->sendSuccess();
+    debugger->m_terminateExecutionCallback.reset();
+  }
 }
 
 Response V8Debugger::continueToLocation(
@@ -474,9 +532,6 @@ void V8Debugger::handleProgramBreak(
       });
   {
     v8::Context::Scope scope(pausedContext);
-    v8::Local<v8::Context> context = m_isolate->GetCurrentContext();
-    CHECK(!context.IsEmpty() &&
-          context != v8::debug::GetDebugContext(m_isolate));
     m_inspector->client()->runMessageLoopOnPause(contextGroupId);
     m_pausedContextGroupId = 0;
   }
@@ -507,9 +562,11 @@ size_t V8Debugger::nearHeapLimitCallback(void* data, size_t current_heap_limit,
   thisPtr->m_originalHeapLimit = current_heap_limit;
   thisPtr->m_scheduledOOMBreak = true;
   v8::Local<v8::Context> context = thisPtr->m_isolate->GetEnteredContext();
-  DCHECK(!context.IsEmpty());
-  thisPtr->setPauseOnNextStatement(
-      true, thisPtr->m_inspector->contextGroupId(context));
+  thisPtr->m_targetContextGroupId =
+      context.IsEmpty() ? 0 : thisPtr->m_inspector->contextGroupId(context);
+  thisPtr->m_isolate->RequestInterrupt(
+      [](v8::Isolate* isolate, void*) { v8::debug::BreakRightNow(isolate); },
+      nullptr);
   return HeapLimitForDebugging(initial_heap_limit);
 }
 
@@ -541,13 +598,12 @@ void V8Debugger::ScriptCompiled(v8::Local<v8::debug::Script> script,
 }
 
 void V8Debugger::BreakProgramRequested(
-    v8::Local<v8::Context> pausedContext, v8::Local<v8::Object>,
+    v8::Local<v8::Context> pausedContext,
     const std::vector<v8::debug::BreakpointId>& break_points_hit) {
   handleProgramBreak(pausedContext, v8::Local<v8::Value>(), break_points_hit);
 }
 
 void V8Debugger::ExceptionThrown(v8::Local<v8::Context> pausedContext,
-                                 v8::Local<v8::Object>,
                                  v8::Local<v8::Value> exception,
                                  v8::Local<v8::Value> promise,
                                  bool isUncaught) {
@@ -577,15 +633,12 @@ bool V8Debugger::IsFunctionBlackboxed(v8::Local<v8::debug::Script> script,
   return hasAgents && allBlackboxed;
 }
 
-void V8Debugger::PromiseEventOccurred(v8::debug::PromiseDebugActionType type,
-                                      int id, bool isBlackboxed) {
+void V8Debugger::AsyncEventOccurred(v8::debug::DebugAsyncActionType type,
+                                    int id, bool isBlackboxed) {
   // Async task events from Promises are given misaligned pointers to prevent
   // from overlapping with other Blink task identifiers.
   void* task = reinterpret_cast<void*>(id * 2 + 1);
   switch (type) {
-    case v8::debug::kDebugAsyncFunctionPromiseCreated:
-      asyncTaskScheduledForStack("async function", task, true);
-      break;
     case v8::debug::kDebugPromiseThen:
       asyncTaskScheduledForStack("Promise.then", task, false);
       if (!isBlackboxed) asyncTaskCandidateForStepping(task, true);
@@ -606,6 +659,20 @@ void V8Debugger::PromiseEventOccurred(v8::debug::PromiseDebugActionType type,
       asyncTaskFinishedForStack(task);
       asyncTaskFinishedForStepping(task);
       break;
+    case v8::debug::kAsyncFunctionSuspended: {
+      if (m_asyncTaskStacks.find(task) == m_asyncTaskStacks.end()) {
+        asyncTaskScheduledForStack("async function", task, true);
+      }
+      auto stackIt = m_asyncTaskStacks.find(task);
+      if (stackIt != m_asyncTaskStacks.end() && !stackIt->second.expired()) {
+        std::shared_ptr<AsyncStackTrace> stack(stackIt->second);
+        stack->setSuspendedTaskId(task);
+      }
+      break;
+    }
+    case v8::debug::kAsyncFunctionFinished:
+      asyncTaskCanceledForStack(task);
+      break;
   }
 }
 
@@ -650,9 +717,9 @@ v8::MaybeLocal<v8::Value> V8Debugger::getTargetScopes(
     }
     String16 type = v8_inspector::scopeType(iterator->GetType());
     String16 name;
-    v8::Local<v8::Function> closure = iterator->GetFunction();
-    if (!closure.IsEmpty()) {
-      name = toProtocolStringWithTypeCheck(closure->GetDebugName());
+    v8::Local<v8::Value> maybe_name = iterator->GetFunctionDebugName();
+    if (!maybe_name->IsUndefined()) {
+      name = toProtocolStringWithTypeCheck(maybe_name);
     }
     v8::Local<v8::Object> object = iterator->GetObject();
     createDataProperty(context, scope,
@@ -780,6 +847,8 @@ void V8Debugger::setAsyncCallStackDepth(V8DebuggerAgentImpl* agent, int depth) {
   m_inspector->client()->maxAsyncCallStackDepthChanged(
       m_maxAsyncCallStackDepth);
   if (!maxAsyncCallStackDepth) allAsyncTasksCanceled();
+  v8::debug::SetAsyncEventDelegate(m_isolate,
+                                   maxAsyncCallStackDepth ? this : nullptr);
 }
 
 std::shared_ptr<AsyncStackTrace> V8Debugger::stackTraceFor(
@@ -832,7 +901,7 @@ void V8Debugger::externalAsyncTaskStarted(const V8StackTraceId& parent) {
       reinterpret_cast<uintptr_t>(m_taskWithScheduledBreak) == parent.id &&
       m_taskWithScheduledBreakDebuggerId ==
           debuggerIdToString(parent.debugger_id)) {
-    v8::debug::DebugBreak(m_isolate);
+    v8::debug::SetBreakOnNextFunctionCall(m_isolate);
   }
 }
 
@@ -852,7 +921,7 @@ void V8Debugger::externalAsyncTaskFinished(const V8StackTraceId& parent) {
   m_taskWithScheduledBreak = nullptr;
   m_taskWithScheduledBreakDebuggerId = String16();
   if (m_breakRequested) return;
-  v8::debug::CancelDebugBreak(m_isolate);
+  v8::debug::ClearBreakOnNextFunctionCall(m_isolate);
 }
 
 void V8Debugger::asyncTaskScheduled(const StringView& taskName, void* task,
@@ -909,8 +978,10 @@ void V8Debugger::asyncTaskStartedForStack(void* task) {
   // - asyncTaskFinished
   m_currentTasks.push_back(task);
   AsyncTaskToStackTrace::iterator stackIt = m_asyncTaskStacks.find(task);
-  if (stackIt != m_asyncTaskStacks.end()) {
-    m_currentAsyncParent.push_back(stackIt->second.lock());
+  if (stackIt != m_asyncTaskStacks.end() && !stackIt->second.expired()) {
+    std::shared_ptr<AsyncStackTrace> stack(stackIt->second);
+    stack->setSuspendedTaskId(nullptr);
+    m_currentAsyncParent.push_back(stack);
   } else {
     m_currentAsyncParent.emplace_back();
   }
@@ -961,7 +1032,7 @@ void V8Debugger::asyncTaskStartedForStepping(void* task) {
   // blackboxing.
   if (m_taskWithScheduledBreakDebuggerId.isEmpty() &&
       task == m_taskWithScheduledBreak) {
-    v8::debug::DebugBreak(m_isolate);
+    v8::debug::SetBreakOnNextFunctionCall(m_isolate);
   }
 }
 
@@ -972,7 +1043,7 @@ void V8Debugger::asyncTaskFinishedForStepping(void* task) {
   }
   m_taskWithScheduledBreak = nullptr;
   if (m_breakRequested) return;
-  v8::debug::CancelDebugBreak(m_isolate);
+  v8::debug::ClearBreakOnNextFunctionCall(m_isolate);
 }
 
 void V8Debugger::asyncTaskCanceledForStepping(void* task) {
@@ -1057,7 +1128,9 @@ std::shared_ptr<StackFrame> V8Debugger::symbolize(
     frameId = v8::debug::GetStackFrameId(v8Frame);
     it = m_framesCache.find(frameId);
   }
-  if (it != m_framesCache.end() && it->second.lock()) return it->second.lock();
+  if (it != m_framesCache.end() && !it->second.expired()) {
+    return std::shared_ptr<StackFrame>(it->second);
+  }
   std::shared_ptr<StackFrame> frame(new StackFrame(v8Frame));
   // TODO(clemensh): Figure out a way to do this translation only right before
   // sending the stack trace over wire.
diff --git a/deps/v8/src/inspector/v8-debugger.h b/deps/v8/src/inspector/v8-debugger.h
index 351e5b66adbf8b..dc3bb609c8ad51 100644
--- a/deps/v8/src/inspector/v8-debugger.h
+++ b/deps/v8/src/inspector/v8-debugger.h
@@ -35,7 +35,8 @@ using ScheduleStepIntoAsyncCallback =
 using TerminateExecutionCallback =
     protocol::Runtime::Backend::TerminateExecutionCallback;
 
-class V8Debugger : public v8::debug::DebugDelegate {
+class V8Debugger : public v8::debug::DebugDelegate,
+                   public v8::debug::AsyncEventDelegate {
  public:
   V8Debugger(v8::Isolate*, V8InspectorImpl*);
   ~V8Debugger();
@@ -49,10 +50,11 @@ class V8Debugger : public v8::debug::DebugDelegate {
   void setPauseOnExceptionsState(v8::debug::ExceptionBreakState);
   bool canBreakProgram();
   void breakProgram(int targetContextGroupId);
+  void interruptAndBreak(int targetContextGroupId);
   void continueProgram(int targetContextGroupId);
   void breakProgramOnAssert(int targetContextGroupId);
 
-  void setPauseOnNextStatement(bool, int targetContextGroupId);
+  void setPauseOnNextCall(bool, int targetContextGroupId);
   void stepIntoStatement(int targetContextGroupId, bool breakOnAsyncCall);
   void stepOverStatement(int targetContextGroupId);
   void stepOutOfFunction(int targetContextGroupId);
@@ -169,21 +171,22 @@ class V8Debugger : public v8::debug::DebugDelegate {
   void asyncTaskCanceledForStepping(void* task);
 
   // v8::debug::DebugEventListener implementation.
-  void PromiseEventOccurred(v8::debug::PromiseDebugActionType type, int id,
-                            bool isBlackboxed) override;
+  void AsyncEventOccurred(v8::debug::DebugAsyncActionType type, int id,
+                          bool isBlackboxed) override;
   void ScriptCompiled(v8::Local<v8::debug::Script> script, bool is_live_edited,
                       bool has_compile_error) override;
   void BreakProgramRequested(
-      v8::Local<v8::Context> paused_context, v8::Local<v8::Object>,
+      v8::Local<v8::Context> paused_context,
       const std::vector<v8::debug::BreakpointId>& break_points_hit) override;
   void ExceptionThrown(v8::Local<v8::Context> paused_context,
-                       v8::Local<v8::Object>, v8::Local<v8::Value> exception,
+                       v8::Local<v8::Value> exception,
                        v8::Local<v8::Value> promise, bool is_uncaught) override;
   bool IsFunctionBlackboxed(v8::Local<v8::debug::Script> script,
                             const v8::debug::Location& start,
                             const v8::debug::Location& end) override;
 
   int currentContextGroupId();
+  bool asyncStepOutOfFunction(int targetContextGroupId, bool onlyAtReturn);
 
   v8::Isolate* m_isolate;
   V8InspectorImpl* m_inspector;
diff --git a/deps/v8/src/inspector/v8-inspector-impl.cc b/deps/v8/src/inspector/v8-inspector-impl.cc
index 14b792551457cb..6272e4b4b2f5ee 100644
--- a/deps/v8/src/inspector/v8-inspector-impl.cc
+++ b/deps/v8/src/inspector/v8-inspector-impl.cc
@@ -32,6 +32,7 @@
 
 #include <vector>
 
+#include "src/base/platform/mutex.h"
 #include "src/inspector/inspected-context.h"
 #include "src/inspector/string-util.h"
 #include "src/inspector/v8-console-agent-impl.h"
@@ -44,6 +45,8 @@
 #include "src/inspector/v8-runtime-agent-impl.h"
 #include "src/inspector/v8-stack-trace-impl.h"
 
+#include "include/v8-platform.h"
+
 namespace v8_inspector {
 
 std::unique_ptr<V8Inspector> V8Inspector::create(v8::Isolate* isolate,
@@ -87,6 +90,7 @@ v8::MaybeLocal<v8::Value> V8InspectorImpl::compileAndRunInternalScript(
   v8::MicrotasksScope microtasksScope(m_isolate,
                                       v8::MicrotasksScope::kDoNotRunMicrotasks);
   v8::Context::Scope contextScope(context);
+  v8::Isolate::SafeForTerminationScope allowTermination(m_isolate);
   return unboundScript->BindToCurrentContext()->Run(context);
 }
 
@@ -202,6 +206,7 @@ void V8InspectorImpl::contextCreated(const V8ContextInfo& info) {
   (*contextById)[contextId].reset(context);
   forEachSession(
       info.contextGroupId, [&context](V8InspectorSessionImpl* session) {
+        session->runtimeAgent()->addBindings(context);
         session->runtimeAgent()->reportExecutionContextCreated(context);
       });
 }
@@ -376,4 +381,48 @@ void V8InspectorImpl::forEachSession(
   }
 }
 
+V8InspectorImpl::EvaluateScope::EvaluateScope(v8::Isolate* isolate)
+    : m_isolate(isolate), m_safeForTerminationScope(isolate) {}
+
+struct V8InspectorImpl::EvaluateScope::CancelToken {
+  v8::base::Mutex m_mutex;
+  bool m_canceled = false;
+};
+
+V8InspectorImpl::EvaluateScope::~EvaluateScope() {
+  if (m_cancelToken) {
+    v8::base::LockGuard<v8::base::Mutex> lock(&m_cancelToken->m_mutex);
+    m_cancelToken->m_canceled = true;
+    m_isolate->CancelTerminateExecution();
+  }
+}
+
+class V8InspectorImpl::EvaluateScope::TerminateTask : public v8::Task {
+ public:
+  TerminateTask(v8::Isolate* isolate, std::shared_ptr<CancelToken> token)
+      : m_isolate(isolate), m_token(token) {}
+
+  void Run() {
+    // CancelToken contains m_canceled bool which may be changed from main
+    // thread, so lock mutex first.
+    v8::base::LockGuard<v8::base::Mutex> lock(&m_token->m_mutex);
+    if (m_token->m_canceled) return;
+    m_isolate->TerminateExecution();
+  }
+
+ private:
+  v8::Isolate* m_isolate;
+  std::shared_ptr<CancelToken> m_token;
+};
+
+protocol::Response V8InspectorImpl::EvaluateScope::setTimeout(double timeout) {
+  if (m_isolate->IsExecutionTerminating()) {
+    return protocol::Response::Error("Execution was terminated");
+  }
+  m_cancelToken.reset(new CancelToken());
+  v8::debug::GetCurrentPlatform()->CallDelayedOnWorkerThread(
+      v8::base::make_unique<TerminateTask>(m_isolate, m_cancelToken), timeout);
+  return protocol::Response::OK();
+}
+
 }  // namespace v8_inspector
diff --git a/deps/v8/src/inspector/v8-inspector-impl.h b/deps/v8/src/inspector/v8-inspector-impl.h
index d34eddfa68ae06..73a9253e9e8314 100644
--- a/deps/v8/src/inspector/v8-inspector-impl.h
+++ b/deps/v8/src/inspector/v8-inspector-impl.h
@@ -35,6 +35,7 @@
 #include <map>
 
 #include "src/base/macros.h"
+#include "src/base/platform/mutex.h"
 #include "src/inspector/protocol/Protocol.h"
 
 #include "include/v8-inspector.h"
@@ -120,6 +121,21 @@ class V8InspectorImpl : public V8Inspector {
   void forEachSession(int contextGroupId,
                       std::function<void(V8InspectorSessionImpl*)> callback);
 
+  class EvaluateScope {
+   public:
+    explicit EvaluateScope(v8::Isolate* isolate);
+    ~EvaluateScope();
+
+    protocol::Response setTimeout(double timeout);
+
+   private:
+    v8::Isolate* m_isolate;
+    class TerminateTask;
+    struct CancelToken;
+    std::shared_ptr<CancelToken> m_cancelToken;
+    v8::Isolate::SafeForTerminationScope m_safeForTerminationScope;
+  };
+
  private:
   v8::Isolate* m_isolate;
   V8InspectorClient* m_client;
diff --git a/deps/v8/src/inspector/v8-runtime-agent-impl.cc b/deps/v8/src/inspector/v8-runtime-agent-impl.cc
index bb3198e0bfd40f..31111add168f6c 100644
--- a/deps/v8/src/inspector/v8-runtime-agent-impl.cc
+++ b/deps/v8/src/inspector/v8-runtime-agent-impl.cc
@@ -54,6 +54,7 @@ namespace V8RuntimeAgentImplState {
 static const char customObjectFormatterEnabled[] =
     "customObjectFormatterEnabled";
 static const char runtimeEnabled[] = "runtimeEnabled";
+static const char bindings[] = "bindings";
 };
 
 using protocol::Runtime::RemoteObject;
@@ -233,7 +234,7 @@ void V8RuntimeAgentImpl::evaluate(
     Maybe<int> executionContextId, Maybe<bool> returnByValue,
     Maybe<bool> generatePreview, Maybe<bool> userGesture,
     Maybe<bool> awaitPromise, Maybe<bool> throwOnSideEffect,
-    std::unique_ptr<EvaluateCallback> callback) {
+    Maybe<double> timeout, std::unique_ptr<EvaluateCallback> callback) {
   TRACE_EVENT0(TRACE_DISABLED_BY_DEFAULT("devtools.timeline"),
                "EvaluateScript");
   int contextId = 0;
@@ -258,9 +259,16 @@ void V8RuntimeAgentImpl::evaluate(
 
   // Temporarily enable allow evals for inspector.
   scope.allowCodeGenerationFromStrings();
-
   v8::MaybeLocal<v8::Value> maybeResultValue;
   {
+    V8InspectorImpl::EvaluateScope evaluateScope(m_inspector->isolate());
+    if (timeout.isJust()) {
+      response = evaluateScope.setTimeout(timeout.fromJust() / 1000.0);
+      if (!response.isSuccess()) {
+        callback->sendFailure(response);
+        return;
+      }
+    }
     v8::MicrotasksScope microtasksScope(m_inspector->isolate(),
                                         v8::MicrotasksScope::kRunMicrotasks);
     maybeResultValue = v8::debug::EvaluateGlobal(
@@ -453,6 +461,14 @@ Response V8RuntimeAgentImpl::setCustomObjectFormatterEnabled(bool enabled) {
   return Response::OK();
 }
 
+Response V8RuntimeAgentImpl::setMaxCallStackSizeToCapture(int size) {
+  if (size < 0) {
+    return Response::Error("maxCallStackSizeToCapture should be non-negative");
+  }
+  V8StackTraceImpl::maxCallStackSizeToCapture = size;
+  return Response::OK();
+}
+
 Response V8RuntimeAgentImpl::discardConsoleEntries() {
   V8ConsoleMessageStorage* storage =
       m_inspector->ensureConsoleMessageStorage(m_session->contextGroupId());
@@ -632,6 +648,102 @@ void V8RuntimeAgentImpl::terminateExecution(
   m_inspector->debugger()->terminateExecution(std::move(callback));
 }
 
+Response V8RuntimeAgentImpl::addBinding(const String16& name,
+                                        Maybe<int> executionContextId) {
+  if (!m_state->getObject(V8RuntimeAgentImplState::bindings)) {
+    m_state->setObject(V8RuntimeAgentImplState::bindings,
+                       protocol::DictionaryValue::create());
+  }
+  protocol::DictionaryValue* bindings =
+      m_state->getObject(V8RuntimeAgentImplState::bindings);
+  if (bindings->booleanProperty(name, false)) return Response::OK();
+  if (executionContextId.isJust()) {
+    int contextId = executionContextId.fromJust();
+    InspectedContext* context =
+        m_inspector->getContext(m_session->contextGroupId(), contextId);
+    if (!context) {
+      return Response::Error(
+          "Cannot find execution context with given executionContextId");
+    }
+    addBinding(context, name);
+    // false means that we should not add this binding later.
+    bindings->setBoolean(name, false);
+    return Response::OK();
+  }
+  bindings->setBoolean(name, true);
+  m_inspector->forEachContext(
+      m_session->contextGroupId(),
+      [&name, this](InspectedContext* context) { addBinding(context, name); });
+  return Response::OK();
+}
+
+void V8RuntimeAgentImpl::bindingCallback(
+    const v8::FunctionCallbackInfo<v8::Value>& info) {
+  v8::Isolate* isolate = info.GetIsolate();
+  if (info.Length() != 1 || !info[0]->IsString()) {
+    info.GetIsolate()->ThrowException(toV8String(
+        isolate, "Invalid arguments: should be exactly one string."));
+    return;
+  }
+  V8InspectorImpl* inspector =
+      static_cast<V8InspectorImpl*>(v8::debug::GetInspector(isolate));
+  int contextId = InspectedContext::contextId(isolate->GetCurrentContext());
+  int contextGroupId = inspector->contextGroupId(contextId);
+
+  String16 name = toProtocolString(v8::Local<v8::String>::Cast(info.Data()));
+  String16 payload = toProtocolString(v8::Local<v8::String>::Cast(info[0]));
+
+  inspector->forEachSession(
+      contextGroupId,
+      [&name, &payload, &contextId](V8InspectorSessionImpl* session) {
+        session->runtimeAgent()->bindingCalled(name, payload, contextId);
+      });
+}
+
+void V8RuntimeAgentImpl::addBinding(InspectedContext* context,
+                                    const String16& name) {
+  v8::HandleScope handles(m_inspector->isolate());
+  v8::Local<v8::Context> localContext = context->context();
+  v8::Local<v8::Object> global = localContext->Global();
+  v8::Local<v8::String> v8Name = toV8String(m_inspector->isolate(), name);
+  v8::Local<v8::Value> functionValue;
+  v8::MicrotasksScope microtasks(m_inspector->isolate(),
+                                 v8::MicrotasksScope::kDoNotRunMicrotasks);
+  if (v8::Function::New(localContext, bindingCallback, v8Name)
+          .ToLocal(&functionValue)) {
+    v8::Maybe<bool> success = global->Set(localContext, v8Name, functionValue);
+    USE(success);
+  }
+}
+
+Response V8RuntimeAgentImpl::removeBinding(const String16& name) {
+  protocol::DictionaryValue* bindings =
+      m_state->getObject(V8RuntimeAgentImplState::bindings);
+  if (!bindings) return Response::OK();
+  bindings->remove(name);
+  return Response::OK();
+}
+
+void V8RuntimeAgentImpl::bindingCalled(const String16& name,
+                                       const String16& payload,
+                                       int executionContextId) {
+  protocol::DictionaryValue* bindings =
+      m_state->getObject(V8RuntimeAgentImplState::bindings);
+  if (!bindings || !bindings->get(name)) return;
+  m_frontend.bindingCalled(name, payload, executionContextId);
+}
+
+void V8RuntimeAgentImpl::addBindings(InspectedContext* context) {
+  if (!m_enabled) return;
+  protocol::DictionaryValue* bindings =
+      m_state->getObject(V8RuntimeAgentImplState::bindings);
+  if (!bindings) return;
+  for (size_t i = 0; i < bindings->size(); ++i) {
+    if (!bindings->at(i).second) continue;
+    addBinding(context, bindings->at(i).first);
+  }
+}
+
 void V8RuntimeAgentImpl::restore() {
   if (!m_state->booleanProperty(V8RuntimeAgentImplState::runtimeEnabled, false))
     return;
@@ -640,6 +752,10 @@ void V8RuntimeAgentImpl::restore() {
   if (m_state->booleanProperty(
           V8RuntimeAgentImplState::customObjectFormatterEnabled, false))
     m_session->setCustomObjectFormatterEnabled(true);
+
+  m_inspector->forEachContext(
+      m_session->contextGroupId(),
+      [this](InspectedContext* context) { addBindings(context); });
 }
 
 Response V8RuntimeAgentImpl::enable() {
@@ -662,11 +778,15 @@ Response V8RuntimeAgentImpl::disable() {
   if (!m_enabled) return Response::OK();
   m_enabled = false;
   m_state->setBoolean(V8RuntimeAgentImplState::runtimeEnabled, false);
+  m_state->remove(V8RuntimeAgentImplState::bindings);
   m_inspector->disableStackCapturingIfNeeded();
   m_session->setCustomObjectFormatterEnabled(false);
   reset();
   m_inspector->client()->endEnsureAllContextsInGroup(
       m_session->contextGroupId());
+  if (m_session->debuggerAgent() && !m_session->debuggerAgent()->enabled()) {
+    m_session->debuggerAgent()->setAsyncCallStackDepth(0);
+  }
   return Response::OK();
 }
 
@@ -723,5 +843,4 @@ bool V8RuntimeAgentImpl::reportMessage(V8ConsoleMessage* message,
   m_frontend.flush();
   return m_inspector->hasConsoleMessageStorage(m_session->contextGroupId());
 }
-
 }  // namespace v8_inspector
diff --git a/deps/v8/src/inspector/v8-runtime-agent-impl.h b/deps/v8/src/inspector/v8-runtime-agent-impl.h
index 3975e1b970b699..fb98236c268382 100644
--- a/deps/v8/src/inspector/v8-runtime-agent-impl.h
+++ b/deps/v8/src/inspector/v8-runtime-agent-impl.h
@@ -64,6 +64,7 @@ class V8RuntimeAgentImpl : public protocol::Runtime::Backend {
                 Maybe<int> executionContextId, Maybe<bool> returnByValue,
                 Maybe<bool> generatePreview, Maybe<bool> userGesture,
                 Maybe<bool> awaitPromise, Maybe<bool> throwOnSideEffect,
+                Maybe<double> timeout,
                 std::unique_ptr<EvaluateCallback>) override;
   void awaitPromise(const String16& promiseObjectId, Maybe<bool> returnByValue,
                     Maybe<bool> generatePreview,
@@ -88,6 +89,7 @@ class V8RuntimeAgentImpl : public protocol::Runtime::Backend {
   Response releaseObjectGroup(const String16& objectGroup) override;
   Response runIfWaitingForDebugger() override;
   Response setCustomObjectFormatterEnabled(bool) override;
+  Response setMaxCallStackSizeToCapture(int) override;
   Response discardConsoleEntries() override;
   Response compileScript(const String16& expression, const String16& sourceURL,
                          bool persistScript, Maybe<int> executionContextId,
@@ -109,6 +111,11 @@ class V8RuntimeAgentImpl : public protocol::Runtime::Backend {
   void terminateExecution(
       std::unique_ptr<TerminateExecutionCallback> callback) override;
 
+  Response addBinding(const String16& name,
+                      Maybe<int> executionContextId) override;
+  Response removeBinding(const String16& name) override;
+  void addBindings(InspectedContext* context);
+
   void reset();
   void reportExecutionContextCreated(InspectedContext*);
   void reportExecutionContextDestroyed(InspectedContext*);
@@ -120,6 +127,11 @@ class V8RuntimeAgentImpl : public protocol::Runtime::Backend {
  private:
   bool reportMessage(V8ConsoleMessage*, bool generatePreview);
 
+  static void bindingCallback(const v8::FunctionCallbackInfo<v8::Value>& args);
+  void bindingCalled(const String16& name, const String16& payload,
+                     int executionContextId);
+  void addBinding(InspectedContext* context, const String16& name);
+
   V8InspectorSessionImpl* m_session;
   protocol::DictionaryValue* m_state;
   protocol::Runtime::Frontend m_frontend;
diff --git a/deps/v8/src/inspector/v8-stack-trace-impl.cc b/deps/v8/src/inspector/v8-stack-trace-impl.cc
index 8c208aaf8a26c2..75293c59afee8e 100644
--- a/deps/v8/src/inspector/v8-stack-trace-impl.cc
+++ b/deps/v8/src/inspector/v8-stack-trace-impl.cc
@@ -11,6 +11,8 @@
 
 namespace v8_inspector {
 
+int V8StackTraceImpl::maxCallStackSizeToCapture = 200;
+
 namespace {
 
 static const v8::StackTrace::StackTraceOptions stackTraceOptions =
@@ -23,9 +25,9 @@ std::vector<std::shared_ptr<StackFrame>> toFramesVector(
     int maxStackSize) {
   DCHECK(debugger->isolate()->InContext());
   int frameCount = std::min(v8StackTrace->GetFrameCount(), maxStackSize);
-  std::vector<std::shared_ptr<StackFrame>> frames;
+  std::vector<std::shared_ptr<StackFrame>> frames(frameCount);
   for (int i = 0; i < frameCount; ++i) {
-    frames.push_back(debugger->symbolize(v8StackTrace->GetFrame(i)));
+    frames[i] = debugger->symbolize(v8StackTrace->GetFrame(i));
   }
   return frames;
 }
@@ -215,6 +217,17 @@ std::unique_ptr<V8StackTrace> V8StackTraceImpl::clone() {
       m_frames, 0, std::shared_ptr<AsyncStackTrace>(), V8StackTraceId()));
 }
 
+StringView V8StackTraceImpl::firstNonEmptySourceURL() const {
+  StackFrameIterator current(this);
+  while (!current.done()) {
+    if (current.frame()->sourceURL().length()) {
+      return toStringView(current.frame()->sourceURL());
+    }
+    current.next();
+  }
+  return StringView();
+}
+
 bool V8StackTraceImpl::isEmpty() const { return m_frames.empty(); }
 
 StringView V8StackTraceImpl::topSourceURL() const {
@@ -360,6 +373,7 @@ AsyncStackTrace::AsyncStackTrace(
     const V8StackTraceId& externalParent)
     : m_contextGroupId(contextGroupId),
       m_id(0),
+      m_suspendedTaskId(nullptr),
       m_description(description),
       m_frames(std::move(frames)),
       m_asyncParent(asyncParent),
@@ -377,6 +391,12 @@ AsyncStackTrace::buildInspectorObject(V8Debugger* debugger,
 
 int AsyncStackTrace::contextGroupId() const { return m_contextGroupId; }
 
+void AsyncStackTrace::setSuspendedTaskId(void* task) {
+  m_suspendedTaskId = task;
+}
+
+void* AsyncStackTrace::suspendedTaskId() const { return m_suspendedTaskId; }
+
 uintptr_t AsyncStackTrace::store(V8Debugger* debugger,
                                  std::shared_ptr<AsyncStackTrace> stack) {
   if (stack->m_id) return stack->m_id;
diff --git a/deps/v8/src/inspector/v8-stack-trace-impl.h b/deps/v8/src/inspector/v8-stack-trace-impl.h
index 87d2b0f0270823..a8f23c48b67231 100644
--- a/deps/v8/src/inspector/v8-stack-trace-impl.h
+++ b/deps/v8/src/inspector/v8-stack-trace-impl.h
@@ -48,7 +48,7 @@ class V8StackTraceImpl : public V8StackTrace {
  public:
   static void setCaptureStackTraceForUncaughtExceptions(v8::Isolate*,
                                                         bool capture);
-  static const int maxCallStackSizeToCapture = 200;
+  static int maxCallStackSizeToCapture;
   static std::unique_ptr<V8StackTraceImpl> create(V8Debugger*,
                                                   int contextGroupId,
                                                   v8::Local<v8::StackTrace>,
@@ -64,6 +64,7 @@ class V8StackTraceImpl : public V8StackTrace {
   // V8StackTrace implementation.
   // This method drops the async stack trace.
   std::unique_ptr<V8StackTrace> clone() override;
+  StringView firstNonEmptySourceURL() const override;
   bool isEmpty() const override;
   StringView topSourceURL() const override;
   int topLineNumber() const override;    // 1-based.
@@ -116,6 +117,16 @@ class AsyncStackTrace {
   std::unique_ptr<protocol::Runtime::StackTrace> buildInspectorObject(
       V8Debugger* debugger, int maxAsyncDepth) const;
 
+  // If async stack has suspended task id, it means that at moment when we
+  // capture current stack trace we suspended corresponded asynchronous
+  // execution flow and it is possible to request pause for a momemnt when
+  // that flow is resumed.
+  // E.g. every time when we suspend async function we mark corresponded async
+  // stack as suspended and every time when this function is resumed we remove
+  // suspendedTaskId.
+  void setSuspendedTaskId(void* task);
+  void* suspendedTaskId() const;
+
   int contextGroupId() const;
   const String16& description() const;
   std::weak_ptr<AsyncStackTrace> parent() const;
@@ -134,6 +145,7 @@ class AsyncStackTrace {
 
   int m_contextGroupId;
   uintptr_t m_id;
+  void* m_suspendedTaskId;
   String16 m_description;
 
   std::vector<std::shared_ptr<StackFrame>> m_frames;
diff --git a/deps/v8/src/instruction-stream.cc b/deps/v8/src/instruction-stream.cc
index 6a95534af8fcdc..4b2a9012d628a8 100644
--- a/deps/v8/src/instruction-stream.cc
+++ b/deps/v8/src/instruction-stream.cc
@@ -13,17 +13,16 @@ namespace internal {
 
 // static
 bool InstructionStream::PcIsOffHeap(Isolate* isolate, Address pc) {
-#ifdef V8_EMBEDDED_BUILTINS
-  const uint8_t* start = isolate->embedded_blob();
-  return start <= pc && pc < start + isolate->embedded_blob_size();
-#else
-  return false;
-#endif
+  if (FLAG_embedded_builtins) {
+    const Address start = reinterpret_cast<Address>(isolate->embedded_blob());
+    return start <= pc && pc < start + isolate->embedded_blob_size();
+  } else {
+    return false;
+  }
 }
 
 // static
 Code* InstructionStream::TryLookupCode(Isolate* isolate, Address address) {
-#ifdef V8_EMBEDDED_BUILTINS
   if (!PcIsOffHeap(isolate, address)) return nullptr;
 
   EmbeddedData d = EmbeddedData::FromBlob();
@@ -31,8 +30,8 @@ Code* InstructionStream::TryLookupCode(Isolate* isolate, Address address) {
   int l = 0, r = Builtins::builtin_count;
   while (l < r) {
     const int mid = (l + r) / 2;
-    const uint8_t* start = d.InstructionStartOfBuiltin(mid);
-    const uint8_t* end = start + d.InstructionSizeOfBuiltin(mid);
+    Address start = d.InstructionStartOfBuiltin(mid);
+    Address end = start + d.InstructionSizeOfBuiltin(mid);
 
     if (address < start) {
       r = mid;
@@ -44,12 +43,8 @@ Code* InstructionStream::TryLookupCode(Isolate* isolate, Address address) {
   }
 
   UNREACHABLE();
-#else
-  return nullptr;
-#endif
 }
 
-#ifdef V8_EMBEDDED_BUILTINS
 // static
 void InstructionStream::CreateOffHeapInstructionStream(Isolate* isolate,
                                                        uint8_t** data,
@@ -69,7 +64,7 @@ void InstructionStream::CreateOffHeapInstructionStream(Isolate* isolate,
                        PageAllocator::kReadExecute));
 
   *data = allocated_bytes;
-  *size = allocated_size;
+  *size = d.size();
 
   d.Dispose();
 }
@@ -77,9 +72,9 @@ void InstructionStream::CreateOffHeapInstructionStream(Isolate* isolate,
 // static
 void InstructionStream::FreeOffHeapInstructionStream(uint8_t* data,
                                                      uint32_t size) {
-  CHECK(FreePages(data, size));
+  const uint32_t page_size = static_cast<uint32_t>(AllocatePageSize());
+  CHECK(FreePages(data, RoundUp(size, page_size)));
 }
-#endif  // V8_EMBEDDED_BUILTINS
 
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/src/instruction-stream.h b/deps/v8/src/instruction-stream.h
index d659de4266a978..25129871dbb99e 100644
--- a/deps/v8/src/instruction-stream.h
+++ b/deps/v8/src/instruction-stream.h
@@ -24,7 +24,6 @@ class InstructionStream final : public AllStatic {
   // Returns the corresponding Code object if it exists, and nullptr otherwise.
   static Code* TryLookupCode(Isolate* isolate, Address address);
 
-#ifdef V8_EMBEDDED_BUILTINS
   // During snapshot creation, we first create an executable off-heap area
   // containing all off-heap code. The area is guaranteed to be contiguous.
   // Note that this only applies when building the snapshot, e.g. for
@@ -32,7 +31,6 @@ class InstructionStream final : public AllStatic {
   static void CreateOffHeapInstructionStream(Isolate* isolate, uint8_t** data,
                                              uint32_t* size);
   static void FreeOffHeapInstructionStream(uint8_t* data, uint32_t size);
-#endif
 };
 
 }  // namespace internal
diff --git a/deps/v8/src/interface-descriptors.cc b/deps/v8/src/interface-descriptors.cc
index 9771f0e00c2f75..85c2b56e21b0c3 100644
--- a/deps/v8/src/interface-descriptors.cc
+++ b/deps/v8/src/interface-descriptors.cc
@@ -7,29 +7,27 @@
 namespace v8 {
 namespace internal {
 
-
 void CallInterfaceDescriptorData::InitializePlatformSpecific(
-    int register_parameter_count, const Register* registers,
-    PlatformInterfaceDescriptor* platform_descriptor) {
-  platform_specific_descriptor_ = platform_descriptor;
+    int register_parameter_count, const Register* registers) {
   register_param_count_ = register_parameter_count;
 
   // InterfaceDescriptor owns a copy of the registers array.
-  register_params_.reset(NewArray<Register>(register_parameter_count, no_reg));
+  register_params_ = NewArray<Register>(register_parameter_count, no_reg);
   for (int i = 0; i < register_parameter_count; i++) {
     register_params_[i] = registers[i];
   }
 }
 
 void CallInterfaceDescriptorData::InitializePlatformIndependent(
-    int parameter_count, int extra_parameter_count,
-    const MachineType* machine_types) {
-  // InterfaceDescriptor owns a copy of the MachineType array.
-  // We only care about parameters, not receiver and result.
-  param_count_ = parameter_count + extra_parameter_count;
-  machine_types_.reset(NewArray<MachineType>(param_count_));
-  for (int i = 0; i < param_count_; i++) {
-    if (machine_types == nullptr || i >= parameter_count) {
+    Flags flags, int return_count, int parameter_count,
+    const MachineType* machine_types, int machine_types_length) {
+  flags_ = flags;
+  return_count_ = return_count;
+  param_count_ = parameter_count;
+  int types_length = return_count_ + param_count_;
+  machine_types_ = NewArray<MachineType>(types_length);
+  for (int i = 0; i < types_length; i++) {
+    if (machine_types == nullptr || i >= machine_types_length) {
       machine_types_[i] = MachineType::AnyTagged();
     } else {
       machine_types_[i] = machine_types[i];
@@ -37,15 +35,63 @@ void CallInterfaceDescriptorData::InitializePlatformIndependent(
   }
 }
 
-const char* CallInterfaceDescriptor::DebugName(Isolate* isolate) const {
-  CallInterfaceDescriptorData* start = isolate->call_descriptor_data(0);
-  size_t index = data_ - start;
-  DCHECK(index < CallDescriptors::NUMBER_OF_DESCRIPTORS);
-  CallDescriptors::Key key = static_cast<CallDescriptors::Key>(index);
+void CallInterfaceDescriptorData::Reset() {
+  delete[] machine_types_;
+  machine_types_ = nullptr;
+  delete[] register_params_;
+  register_params_ = nullptr;
+}
+
+// static
+CallInterfaceDescriptorData
+    CallDescriptors::call_descriptor_data_[NUMBER_OF_DESCRIPTORS];
+
+void CallDescriptors::InitializeOncePerProcess() {
+#define INTERFACE_DESCRIPTOR(name, ...) \
+  name##Descriptor().Initialize(&call_descriptor_data_[CallDescriptors::name]);
+  INTERFACE_DESCRIPTOR_LIST(INTERFACE_DESCRIPTOR)
+#undef INTERFACE_DESCRIPTOR
+
+  DCHECK(ContextOnlyDescriptor{}.HasContextParameter());
+  DCHECK(!NoContextDescriptor{}.HasContextParameter());
+  DCHECK(!AllocateDescriptor{}.HasContextParameter());
+  DCHECK(!AllocateHeapNumberDescriptor{}.HasContextParameter());
+  DCHECK(!AbortDescriptor{}.HasContextParameter());
+}
+
+void CallDescriptors::TearDown() {
+  for (CallInterfaceDescriptorData& data : call_descriptor_data_) {
+    data.Reset();
+  }
+}
+
+void CallInterfaceDescriptor::JSDefaultInitializePlatformSpecific(
+    CallInterfaceDescriptorData* data, int non_js_register_parameter_count) {
+  DCHECK_LE(static_cast<unsigned>(non_js_register_parameter_count), 1);
+
+  // 3 is for kTarget, kNewTarget and kActualArgumentsCount
+  int register_parameter_count = 3 + non_js_register_parameter_count;
+
+  DCHECK(!AreAliased(
+      kJavaScriptCallTargetRegister, kJavaScriptCallNewTargetRegister,
+      kJavaScriptCallArgCountRegister, kJavaScriptCallExtraArg1Register));
+
+  const Register default_js_stub_registers[] = {
+      kJavaScriptCallTargetRegister, kJavaScriptCallNewTargetRegister,
+      kJavaScriptCallArgCountRegister, kJavaScriptCallExtraArg1Register};
+
+  CHECK_LE(static_cast<size_t>(register_parameter_count),
+           arraysize(default_js_stub_registers));
+  data->InitializePlatformSpecific(register_parameter_count,
+                                   default_js_stub_registers);
+}
+
+const char* CallInterfaceDescriptor::DebugName() const {
+  CallDescriptors::Key key = CallDescriptors::GetKey(data_);
   switch (key) {
-#define DEF_CASE(NAME, ...)   \
-  case CallDescriptors::NAME: \
-    return #NAME " Descriptor";
+#define DEF_CASE(name, ...)   \
+  case CallDescriptors::name: \
+    return #name " Descriptor";
     INTERFACE_DESCRIPTOR_LIST(DEF_CASE)
 #undef DEF_CASE
     case CallDescriptors::NUMBER_OF_DESCRIPTORS:
@@ -60,17 +106,22 @@ void VoidDescriptor::InitializePlatformSpecific(
   data->InitializePlatformSpecific(0, nullptr);
 }
 
-void FastNewFunctionContextDescriptor::InitializePlatformIndependent(
+void AllocateDescriptor::InitializePlatformSpecific(
     CallInterfaceDescriptorData* data) {
-  MachineType machine_types[] = {MachineType::AnyTagged(),
-                                 MachineType::Int32()};
-  data->InitializePlatformIndependent(arraysize(machine_types), 0,
-                                      machine_types);
+  Register registers[] = {kAllocateSizeRegister};
+  data->InitializePlatformSpecific(arraysize(registers), registers);
+}
+
+void CEntry1ArgvOnStackDescriptor::InitializePlatformSpecific(
+    CallInterfaceDescriptorData* data) {
+  Register registers[] = {kRuntimeCallArgCountRegister,
+                          kRuntimeCallFunctionRegister};
+  data->InitializePlatformSpecific(arraysize(registers), registers);
 }
 
 void FastNewFunctionContextDescriptor::InitializePlatformSpecific(
     CallInterfaceDescriptorData* data) {
-  Register registers[] = {FunctionRegister(), SlotsRegister()};
+  Register registers[] = {ScopeInfoRegister(), SlotsRegister()};
   data->InitializePlatformSpecific(arraysize(registers), registers);
 }
 
@@ -88,35 +139,6 @@ const Register FastNewObjectDescriptor::NewTargetRegister() {
   return kJavaScriptCallNewTargetRegister;
 }
 
-void FastNewArgumentsDescriptor::InitializePlatformSpecific(
-    CallInterfaceDescriptorData* data) {
-  Register registers[] = {TargetRegister()};
-  data->InitializePlatformSpecific(arraysize(registers), registers);
-}
-
-const Register FastNewArgumentsDescriptor::TargetRegister() {
-  return kJSFunctionRegister;
-}
-
-void RecordWriteDescriptor::InitializePlatformIndependent(
-    CallInterfaceDescriptorData* data) {
-  MachineType machine_types[] = {MachineType::TaggedPointer(),
-                                 MachineType::Pointer(), MachineType::Pointer(),
-                                 MachineType::TaggedSigned(),
-                                 MachineType::TaggedSigned()};
-  data->InitializePlatformIndependent(arraysize(machine_types), 0,
-                                      machine_types);
-}
-
-void LoadDescriptor::InitializePlatformIndependent(
-    CallInterfaceDescriptorData* data) {
-  // kReceiver, kName, kSlot
-  MachineType machine_types[] = {MachineType::AnyTagged(),
-                                 MachineType::AnyTagged(),
-                                 MachineType::TaggedSigned()};
-  data->InitializePlatformIndependent(arraysize(machine_types), 0,
-                                      machine_types);
-}
 
 void LoadDescriptor::InitializePlatformSpecific(
     CallInterfaceDescriptorData* data) {
@@ -124,62 +146,18 @@ void LoadDescriptor::InitializePlatformSpecific(
   data->InitializePlatformSpecific(arraysize(registers), registers);
 }
 
-void LoadFieldDescriptor::InitializePlatformIndependent(
-    CallInterfaceDescriptorData* data) {
-  // kReceiver, kSmiHandler
-  MachineType machine_types[] = {MachineType::AnyTagged(),
-                                 MachineType::AnyTagged()};
-  data->InitializePlatformIndependent(arraysize(machine_types), 0,
-                                      machine_types);
-}
-
-void LoadFieldDescriptor::InitializePlatformSpecific(
-    CallInterfaceDescriptorData* data) {
-  Register registers[] = {ReceiverRegister(), SmiHandlerRegister()};
-  data->InitializePlatformSpecific(arraysize(registers), registers);
-}
-
-void LoadGlobalDescriptor::InitializePlatformIndependent(
-    CallInterfaceDescriptorData* data) {
-  // kName, kSlot
-  MachineType machine_types[] = {MachineType::AnyTagged(),
-                                 MachineType::TaggedSigned()};
-  data->InitializePlatformIndependent(arraysize(machine_types), 0,
-                                      machine_types);
-}
-
 void LoadGlobalDescriptor::InitializePlatformSpecific(
     CallInterfaceDescriptorData* data) {
   Register registers[] = {NameRegister(), SlotRegister()};
   data->InitializePlatformSpecific(arraysize(registers), registers);
 }
 
-void LoadGlobalWithVectorDescriptor::InitializePlatformIndependent(
-    CallInterfaceDescriptorData* data) {
-  // kName, kSlot, kVector
-  MachineType machine_types[] = {MachineType::AnyTagged(),
-                                 MachineType::TaggedSigned(),
-                                 MachineType::AnyTagged()};
-  data->InitializePlatformIndependent(arraysize(machine_types), 0,
-                                      machine_types);
-}
-
 void LoadGlobalWithVectorDescriptor::InitializePlatformSpecific(
     CallInterfaceDescriptorData* data) {
   Register registers[] = {NameRegister(), SlotRegister(), VectorRegister()};
   data->InitializePlatformSpecific(arraysize(registers), registers);
 }
 
-void StoreGlobalDescriptor::InitializePlatformIndependent(
-    CallInterfaceDescriptorData* data) {
-  // kName, kValue, kSlot
-  MachineType machine_types[] = {MachineType::AnyTagged(),
-                                 MachineType::AnyTagged(),
-                                 MachineType::TaggedSigned()};
-  data->InitializePlatformIndependent(arraysize(machine_types), 0,
-                                      machine_types);
-}
-
 void StoreGlobalDescriptor::InitializePlatformSpecific(
     CallInterfaceDescriptorData* data) {
   Register registers[] = {NameRegister(), ValueRegister(), SlotRegister()};
@@ -188,16 +166,6 @@ void StoreGlobalDescriptor::InitializePlatformSpecific(
   data->InitializePlatformSpecific(len, registers);
 }
 
-void StoreGlobalWithVectorDescriptor::InitializePlatformIndependent(
-    CallInterfaceDescriptorData* data) {
-  // kName, kValue, kSlot, kVector
-  MachineType machine_types[] = {
-      MachineType::AnyTagged(), MachineType::AnyTagged(),
-      MachineType::TaggedSigned(), MachineType::AnyTagged()};
-  data->InitializePlatformIndependent(arraysize(machine_types), 0,
-                                      machine_types);
-}
-
 void StoreGlobalWithVectorDescriptor::InitializePlatformSpecific(
     CallInterfaceDescriptorData* data) {
   Register registers[] = {NameRegister(), ValueRegister(), SlotRegister(),
@@ -206,16 +174,6 @@ void StoreGlobalWithVectorDescriptor::InitializePlatformSpecific(
   data->InitializePlatformSpecific(len, registers);
 }
 
-void StoreDescriptor::InitializePlatformIndependent(
-    CallInterfaceDescriptorData* data) {
-  // kReceiver, kName, kValue, kSlot
-  MachineType machine_types[] = {
-      MachineType::AnyTagged(), MachineType::AnyTagged(),
-      MachineType::AnyTagged(), MachineType::TaggedSigned()};
-  data->InitializePlatformIndependent(arraysize(machine_types), 0,
-                                      machine_types);
-}
-
 void StoreDescriptor::InitializePlatformSpecific(
     CallInterfaceDescriptorData* data) {
   Register registers[] = {ReceiverRegister(), NameRegister(), ValueRegister(),
@@ -235,65 +193,11 @@ void StoreTransitionDescriptor::InitializePlatformSpecific(
   data->InitializePlatformSpecific(len, registers);
 }
 
-void StoreTransitionDescriptor::InitializePlatformIndependent(
-    CallInterfaceDescriptorData* data) {
-  // kReceiver, kName, kMap, kValue, kSlot, kVector
-  MachineType machine_types[] = {
-      MachineType::AnyTagged(),    MachineType::AnyTagged(),
-      MachineType::AnyTagged(),    MachineType::AnyTagged(),
-      MachineType::TaggedSigned(), MachineType::AnyTagged()};
-  data->InitializePlatformIndependent(arraysize(machine_types), 0,
-                                      machine_types);
-}
-
-void StoreNamedTransitionDescriptor::InitializePlatformIndependent(
-    CallInterfaceDescriptorData* data) {
-  // kReceiver, kFieldOffset, kMap, kValue, kSlot, kVector, kName
-  MachineType machine_types[] = {
-      MachineType::AnyTagged(),    MachineType::TaggedSigned(),
-      MachineType::AnyTagged(),    MachineType::AnyTagged(),
-      MachineType::TaggedSigned(), MachineType::AnyTagged(),
-      MachineType::AnyTagged()};
-  data->InitializePlatformIndependent(arraysize(machine_types), 0,
-                                      machine_types);
-}
-
-void StoreNamedTransitionDescriptor::InitializePlatformSpecific(
-    CallInterfaceDescriptorData* data) {
-  Register registers[] = {
-      ReceiverRegister(), FieldOffsetRegister(), MapRegister(),
-      ValueRegister(),    SlotRegister(),        VectorRegister(),
-      NameRegister(),
-  };
-  int len = arraysize(registers) - kStackArgumentsCount;
-  data->InitializePlatformSpecific(len, registers);
-}
-
-void StringAtDescriptor::InitializePlatformIndependent(
-    CallInterfaceDescriptorData* data) {
-  // kReceiver, kPosition
-  // TODO(turbofan): Allow builtins to return untagged values.
-  MachineType machine_types[] = {MachineType::AnyTagged(),
-                                 MachineType::IntPtr()};
-  data->InitializePlatformIndependent(arraysize(machine_types), 0,
-                                      machine_types);
-}
-
 void StringAtDescriptor::InitializePlatformSpecific(
     CallInterfaceDescriptorData* data) {
   DefaultInitializePlatformSpecific(data, kParameterCount);
 }
 
-void StringSubstringDescriptor::InitializePlatformIndependent(
-    CallInterfaceDescriptorData* data) {
-  // kString, kFrom, kTo
-  // TODO(turbofan): Allow builtins to return untagged values.
-  MachineType machine_types[] = {MachineType::AnyTagged(),
-                                 MachineType::IntPtr(), MachineType::IntPtr()};
-  data->InitializePlatformIndependent(arraysize(machine_types), 0,
-                                      machine_types);
-}
-
 void StringSubstringDescriptor::InitializePlatformSpecific(
     CallInterfaceDescriptorData* data) {
   DefaultInitializePlatformSpecific(data, kParameterCount);
@@ -310,46 +214,6 @@ void TypeConversionStackParameterDescriptor::InitializePlatformSpecific(
   data->InitializePlatformSpecific(0, nullptr);
 }
 
-void TypeConversionStackParameterDescriptor::InitializePlatformIndependent(
-    CallInterfaceDescriptorData* data) {
-  data->InitializePlatformIndependent(data->register_param_count(), 1, nullptr);
-}
-
-void MathPowTaggedDescriptor::InitializePlatformSpecific(
-    CallInterfaceDescriptorData* data) {
-  Register registers[] = {exponent()};
-  data->InitializePlatformSpecific(arraysize(registers), registers);
-}
-
-void MathPowIntegerDescriptor::InitializePlatformSpecific(
-    CallInterfaceDescriptorData* data) {
-  Register registers[] = {exponent()};
-  data->InitializePlatformSpecific(arraysize(registers), registers);
-}
-
-const Register LoadFieldDescriptor::ReceiverRegister() {
-  // Reuse the register from the LoadDescriptor, since given the
-  // LoadFieldDescriptor's usage, it doesn't matter exactly which registers are
-  // used to pass parameters in.
-  return LoadDescriptor::ReceiverRegister();
-}
-const Register LoadFieldDescriptor::SmiHandlerRegister() {
-  // Reuse the register from the LoadDescriptor, since given the
-  // LoadFieldDescriptor's usage, it doesn't matter exactly which registers are
-  // used to pass parameters in.
-  return LoadDescriptor::NameRegister();
-}
-
-void LoadWithVectorDescriptor::InitializePlatformIndependent(
-    CallInterfaceDescriptorData* data) {
-  // kReceiver, kName, kSlot, kVector
-  MachineType machine_types[] = {
-      MachineType::AnyTagged(), MachineType::AnyTagged(),
-      MachineType::TaggedSigned(), MachineType::AnyTagged()};
-  data->InitializePlatformIndependent(arraysize(machine_types), 0,
-                                      machine_types);
-}
-
 void LoadWithVectorDescriptor::InitializePlatformSpecific(
     CallInterfaceDescriptorData* data) {
   Register registers[] = {ReceiverRegister(), NameRegister(), SlotRegister(),
@@ -357,17 +221,6 @@ void LoadWithVectorDescriptor::InitializePlatformSpecific(
   data->InitializePlatformSpecific(arraysize(registers), registers);
 }
 
-void StoreWithVectorDescriptor::InitializePlatformIndependent(
-    CallInterfaceDescriptorData* data) {
-  // kReceiver, kName, kValue, kSlot, kVector
-  MachineType machine_types[] = {
-      MachineType::AnyTagged(), MachineType::AnyTagged(),
-      MachineType::AnyTagged(), MachineType::TaggedSigned(),
-      MachineType::AnyTagged()};
-  data->InitializePlatformIndependent(arraysize(machine_types), 0,
-                                      machine_types);
-}
-
 void StoreWithVectorDescriptor::InitializePlatformSpecific(
     CallInterfaceDescriptorData* data) {
   Register registers[] = {ReceiverRegister(), NameRegister(), ValueRegister(),
@@ -392,20 +245,15 @@ void ContextOnlyDescriptor::InitializePlatformSpecific(
   data->InitializePlatformSpecific(0, nullptr);
 }
 
-void GrowArrayElementsDescriptor::InitializePlatformSpecific(
+void NoContextDescriptor::InitializePlatformSpecific(
     CallInterfaceDescriptorData* data) {
-  Register registers[] = {ObjectRegister(), KeyRegister()};
-  data->InitializePlatformSpecific(arraysize(registers), registers);
+  data->InitializePlatformSpecific(0, nullptr);
 }
 
-void NewArgumentsElementsDescriptor::InitializePlatformIndependent(
+void GrowArrayElementsDescriptor::InitializePlatformSpecific(
     CallInterfaceDescriptorData* data) {
-  // kFrame, kLength, kMappedCount
-  MachineType const kMachineTypes[] = {MachineType::Pointer(),
-                                       MachineType::TaggedSigned(),
-                                       MachineType::TaggedSigned()};
-  data->InitializePlatformIndependent(arraysize(kMachineTypes), 0,
-                                      kMachineTypes);
+  Register registers[] = {ObjectRegister(), KeyRegister()};
+  data->InitializePlatformSpecific(arraysize(registers), registers);
 }
 
 void NewArgumentsElementsDescriptor::InitializePlatformSpecific(
@@ -413,244 +261,34 @@ void NewArgumentsElementsDescriptor::InitializePlatformSpecific(
   DefaultInitializePlatformSpecific(data, 3);
 }
 
-void CallTrampolineDescriptor::InitializePlatformIndependent(
-    CallInterfaceDescriptorData* data) {
-  // kFunction, kActualArgumentsCount
-  MachineType machine_types[] = {MachineType::AnyTagged(),
-                                 MachineType::Int32()};
-  data->InitializePlatformIndependent(arraysize(machine_types), 0,
-                                      machine_types);
-}
-
-void CallVarargsDescriptor::InitializePlatformIndependent(
-    CallInterfaceDescriptorData* data) {
-  // kTarget, kActualArgumentsCount, kArgumentsList, kArgumentsLength
-  MachineType machine_types[] = {MachineType::AnyTagged(), MachineType::Int32(),
-                                 MachineType::AnyTagged(),
-                                 MachineType::Int32()};
-  data->InitializePlatformIndependent(arraysize(machine_types), 0,
-                                      machine_types);
-}
-
-void CallForwardVarargsDescriptor::InitializePlatformIndependent(
-    CallInterfaceDescriptorData* data) {
-  // kTarget, kActualArgumentsCount, kStartIndex
-  MachineType machine_types[] = {MachineType::AnyTagged(), MachineType::Int32(),
-                                 MachineType::Int32()};
-  data->InitializePlatformIndependent(arraysize(machine_types), 0,
-                                      machine_types);
-}
-
-void CallWithSpreadDescriptor::InitializePlatformIndependent(
-    CallInterfaceDescriptorData* data) {
-  // kTarget, kArgumentsCount, kArgumentsList
-  MachineType machine_types[] = {MachineType::AnyTagged(), MachineType::Int32(),
-                                 MachineType::AnyTagged()};
-  data->InitializePlatformIndependent(arraysize(machine_types), 0,
-                                      machine_types);
-}
-
-void CallWithArrayLikeDescriptor::InitializePlatformIndependent(
-    CallInterfaceDescriptorData* data) {
-  // kTarget, kArgumentsList
-  MachineType machine_types[] = {MachineType::AnyTagged(),
-                                 MachineType::AnyTagged()};
-  data->InitializePlatformIndependent(arraysize(machine_types), 0,
-                                      machine_types);
-}
-
-void ConstructVarargsDescriptor::InitializePlatformIndependent(
-    CallInterfaceDescriptorData* data) {
-  // kTarget, kNewTarget, kActualArgumentsCount, kArgumentsList,
-  // kArgumentsLength
-  MachineType machine_types[] = {
-      MachineType::AnyTagged(), MachineType::AnyTagged(), MachineType::Int32(),
-      MachineType::AnyTagged(), MachineType::Int32()};
-  data->InitializePlatformIndependent(arraysize(machine_types), 0,
-                                      machine_types);
-}
-
-void ConstructForwardVarargsDescriptor::InitializePlatformIndependent(
-    CallInterfaceDescriptorData* data) {
-  // kTarget, kNewTarget, kActualArgumentsCount, kStartIndex
-  MachineType machine_types[] = {MachineType::AnyTagged(),
-                                 MachineType::AnyTagged(), MachineType::Int32(),
-                                 MachineType::Int32()};
-  data->InitializePlatformIndependent(arraysize(machine_types), 0,
-                                      machine_types);
-}
-
-void ConstructWithSpreadDescriptor::InitializePlatformIndependent(
-    CallInterfaceDescriptorData* data) {
-  // kTarget, kNewTarget, kArgumentsCount, kSpread
-  MachineType machine_types[] = {MachineType::AnyTagged(),
-                                 MachineType::AnyTagged(), MachineType::Int32(),
-                                 MachineType::AnyTagged()};
-  data->InitializePlatformIndependent(arraysize(machine_types), 0,
-                                      machine_types);
-}
-
-void ConstructWithArrayLikeDescriptor::InitializePlatformIndependent(
-    CallInterfaceDescriptorData* data) {
-  // kTarget, kNewTarget, kArgumentsList
-  MachineType machine_types[] = {MachineType::AnyTagged(),
-                                 MachineType::AnyTagged(),
-                                 MachineType::AnyTagged()};
-  data->InitializePlatformIndependent(arraysize(machine_types), 0,
-                                      machine_types);
-}
-
-void ConstructStubDescriptor::InitializePlatformIndependent(
+void ArrayNoArgumentConstructorDescriptor::InitializePlatformSpecific(
     CallInterfaceDescriptorData* data) {
-  // kFunction, kNewTarget, kActualArgumentsCount, kAllocationSite
-  MachineType machine_types[] = {MachineType::AnyTagged(),
-                                 MachineType::AnyTagged(), MachineType::Int32(),
-                                 MachineType::AnyTagged()};
-  data->InitializePlatformIndependent(arraysize(machine_types), 0,
-                                      machine_types);
+  // This descriptor must use the same set of registers as the
+  // ArrayNArgumentsConstructorDescriptor.
+  ArrayNArgumentsConstructorDescriptor::InitializePlatformSpecific(data);
 }
 
-void ConstructTrampolineDescriptor::InitializePlatformIndependent(
+void ArraySingleArgumentConstructorDescriptor::InitializePlatformSpecific(
     CallInterfaceDescriptorData* data) {
-  // kFunction, kNewTarget, kActualArgumentsCount
-  MachineType machine_types[] = {
-      MachineType::AnyTagged(), MachineType::AnyTagged(), MachineType::Int32()};
-  data->InitializePlatformIndependent(arraysize(machine_types), 0,
-                                      machine_types);
+  // This descriptor must use the same set of registers as the
+  // ArrayNArgumentsConstructorDescriptor.
+  ArrayNArgumentsConstructorDescriptor::InitializePlatformSpecific(data);
 }
 
-void BuiltinDescriptor::InitializePlatformIndependent(
-    CallInterfaceDescriptorData* data) {
-  // kTarget, kNewTarget, kArgumentsCount
-  MachineType machine_types[] = {
-      MachineType::AnyTagged(), MachineType::AnyTagged(), MachineType::Int32()};
-  data->InitializePlatformIndependent(arraysize(machine_types), 0,
-                                      machine_types);
-}
-
-void BuiltinDescriptor::InitializePlatformSpecific(
-    CallInterfaceDescriptorData* data) {
-  Register registers[] = {TargetRegister(), NewTargetRegister(),
-                          ArgumentsCountRegister()};
-  data->InitializePlatformSpecific(arraysize(registers), registers);
-}
-
-const Register BuiltinDescriptor::ArgumentsCountRegister() {
-  return kJavaScriptCallArgCountRegister;
-}
-const Register BuiltinDescriptor::NewTargetRegister() {
-  return kJavaScriptCallNewTargetRegister;
-}
-
-const Register BuiltinDescriptor::TargetRegister() {
-  return kJSFunctionRegister;
-}
-
-void ArrayConstructorDescriptor::InitializePlatformIndependent(
-    CallInterfaceDescriptorData* data) {
-  // kTarget, kNewTarget, kActualArgumentsCount, kAllocationSite
-  MachineType machine_types[] = {MachineType::AnyTagged(),
-                                 MachineType::AnyTagged(), MachineType::Int32(),
-                                 MachineType::AnyTagged()};
-  data->InitializePlatformIndependent(arraysize(machine_types), 0,
-                                      machine_types);
-}
-
-void ArrayNoArgumentConstructorDescriptor::InitializePlatformIndependent(
-    CallInterfaceDescriptorData* data) {
-  // kFunction, kAllocationSite, kActualArgumentsCount, kFunctionParameter
-  MachineType machine_types[] = {MachineType::TaggedPointer(),
-                                 MachineType::AnyTagged(), MachineType::Int32(),
-                                 MachineType::AnyTagged()};
-  data->InitializePlatformIndependent(arraysize(machine_types), 0,
-                                      machine_types);
-}
-
-void ArraySingleArgumentConstructorDescriptor::InitializePlatformIndependent(
-    CallInterfaceDescriptorData* data) {
-  // kFunction, kAllocationSite, kActualArgumentsCount, kFunctionParameter,
-  // kArraySizeSmiParameter
-  MachineType machine_types[] = {
-      MachineType::TaggedPointer(), MachineType::AnyTagged(),
-      MachineType::Int32(), MachineType::AnyTagged(), MachineType::AnyTagged()};
-  data->InitializePlatformIndependent(arraysize(machine_types), 0,
-                                      machine_types);
-}
-
-void ArrayNArgumentsConstructorDescriptor::InitializePlatformIndependent(
+void ArrayNArgumentsConstructorDescriptor::InitializePlatformSpecific(
     CallInterfaceDescriptorData* data) {
+  // Keep the arguments on the same registers as they were in
+  // ArrayConstructorDescriptor to avoid unnecessary register moves.
   // kFunction, kAllocationSite, kActualArgumentsCount
-  MachineType machine_types[] = {
-      MachineType::AnyTagged(), MachineType::AnyTagged(), MachineType::Int32()};
-  data->InitializePlatformIndependent(arraysize(machine_types), 0,
-                                      machine_types);
-}
-
-void ArgumentAdaptorDescriptor::InitializePlatformIndependent(
-    CallInterfaceDescriptorData* data) {
-  // kFunction, kNewTarget, kActualArgumentsCount, kExpectedArgumentsCount
-  MachineType machine_types[] = {MachineType::TaggedPointer(),
-                                 MachineType::AnyTagged(), MachineType::Int32(),
-                                 MachineType::Int32()};
-  data->InitializePlatformIndependent(arraysize(machine_types), 0,
-                                      machine_types);
-}
-
-void ApiCallbackDescriptor::InitializePlatformIndependent(
-    CallInterfaceDescriptorData* data) {
-  // kTargetContext, kCallData, kHolder, kApiFunctionAddress
-  MachineType machine_types[] = {
-      MachineType::AnyTagged(), MachineType::AnyTagged(),
-      MachineType::AnyTagged(), MachineType::Pointer()};
-  data->InitializePlatformIndependent(arraysize(machine_types), 0,
-                                      machine_types);
-}
-
-void InterpreterDispatchDescriptor::InitializePlatformIndependent(
-    CallInterfaceDescriptorData* data) {
-  // kAccumulator, kBytecodeOffset, kBytecodeArray, kDispatchTable
-  MachineType machine_types[] = {
-      MachineType::AnyTagged(), MachineType::IntPtr(), MachineType::AnyTagged(),
-      MachineType::IntPtr()};
-  data->InitializePlatformIndependent(arraysize(machine_types), 0,
-                                      machine_types);
-}
-
-void InterpreterPushArgsThenCallDescriptor::InitializePlatformIndependent(
-    CallInterfaceDescriptorData* data) {
-  // kNumberOfArguments, kFirstArgument, kFunction
-  MachineType machine_types[] = {MachineType::Int32(), MachineType::Pointer(),
-                                 MachineType::AnyTagged()};
-  data->InitializePlatformIndependent(arraysize(machine_types), 0,
-                                      machine_types);
-}
-
-void InterpreterPushArgsThenConstructDescriptor::InitializePlatformIndependent(
-    CallInterfaceDescriptorData* data) {
-  // kNumberOfArguments, kNewTarget, kConstructor, kFeedbackElement,
-  // kFirstArgument
-  MachineType machine_types[] = {
-      MachineType::Int32(), MachineType::AnyTagged(), MachineType::AnyTagged(),
-      MachineType::AnyTagged(), MachineType::Pointer()};
-  data->InitializePlatformIndependent(arraysize(machine_types), 0,
-                                      machine_types);
-}
-
-void InterpreterCEntryDescriptor::InitializePlatformIndependent(
-    CallInterfaceDescriptorData* data) {
-  // kNumberOfArguments, kFirstArgument, kFunctionEntry
-  MachineType machine_types[] = {MachineType::Int32(), MachineType::Pointer(),
-                                 MachineType::Pointer()};
-  data->InitializePlatformIndependent(arraysize(machine_types), 0,
-                                      machine_types);
+  Register registers[] = {kJavaScriptCallTargetRegister,
+                          kJavaScriptCallExtraArg1Register,
+                          kJavaScriptCallArgCountRegister};
+  data->InitializePlatformSpecific(arraysize(registers), registers);
 }
 
-void FrameDropperTrampolineDescriptor::InitializePlatformIndependent(
+void WasmGrowMemoryDescriptor::InitializePlatformSpecific(
     CallInterfaceDescriptorData* data) {
-  // New FP value.
-  MachineType machine_types[] = {MachineType::Pointer()};
-  data->InitializePlatformIndependent(arraysize(machine_types), 0,
-                                      machine_types);
+  DefaultInitializePlatformSpecific(data, kParameterCount);
 }
 
 }  // namespace internal
diff --git a/deps/v8/src/interface-descriptors.h b/deps/v8/src/interface-descriptors.h
index 8375ea11971ac4..cf841383b29090 100644
--- a/deps/v8/src/interface-descriptors.h
+++ b/deps/v8/src/interface-descriptors.h
@@ -15,25 +15,24 @@
 namespace v8 {
 namespace internal {
 
-class PlatformInterfaceDescriptor;
-
 #define INTERFACE_DESCRIPTOR_LIST(V)  \
+  V(CppBuiltinAdaptor)                \
+  V(CEntry1ArgvOnStack)               \
+  V(Allocate)                         \
   V(Void)                             \
   V(ContextOnly)                      \
+  V(NoContext)                        \
   V(Load)                             \
   V(LoadWithVector)                   \
-  V(LoadField)                        \
   V(LoadGlobal)                       \
   V(LoadGlobalWithVector)             \
   V(Store)                            \
   V(StoreWithVector)                  \
-  V(StoreNamedTransition)             \
   V(StoreTransition)                  \
   V(StoreGlobal)                      \
   V(StoreGlobalWithVector)            \
   V(FastNewFunctionContext)           \
   V(FastNewObject)                    \
-  V(FastNewArguments)                 \
   V(RecordWrite)                      \
   V(TypeConversion)                   \
   V(TypeConversionStackParameter)     \
@@ -49,76 +48,83 @@ class PlatformInterfaceDescriptor;
   V(ConstructForwardVarargs)          \
   V(ConstructWithSpread)              \
   V(ConstructWithArrayLike)           \
-  V(ConstructTrampoline)              \
-  V(TransitionElementsKind)           \
-  V(AbortJS)                          \
+  V(JSTrampoline)                     \
+  V(Abort)                            \
   V(AllocateHeapNumber)               \
-  V(Builtin)                          \
   V(ArrayConstructor)                 \
-  V(IteratingArrayBuiltin)            \
   V(ArrayNoArgumentConstructor)       \
   V(ArraySingleArgumentConstructor)   \
   V(ArrayNArgumentsConstructor)       \
   V(Compare)                          \
   V(BinaryOp)                         \
-  V(StringAdd)                        \
   V(StringAt)                         \
   V(StringSubstring)                  \
-  V(ForInPrepare)                     \
   V(GetProperty)                      \
   V(ArgumentAdaptor)                  \
   V(ApiCallback)                      \
   V(ApiGetter)                        \
-  V(MathPowTagged)                    \
-  V(MathPowInteger)                   \
   V(GrowArrayElements)                \
   V(NewArgumentsElements)             \
   V(InterpreterDispatch)              \
   V(InterpreterPushArgsThenCall)      \
   V(InterpreterPushArgsThenConstruct) \
-  V(InterpreterCEntry)                \
+  V(InterpreterCEntry1)               \
+  V(InterpreterCEntry2)               \
   V(ResumeGenerator)                  \
   V(FrameDropperTrampoline)           \
-  V(WasmRuntimeCall)                  \
   V(RunMicrotasks)                    \
+  V(WasmGrowMemory)                   \
   BUILTIN_LIST_TFS(V)
 
 class V8_EXPORT_PRIVATE CallInterfaceDescriptorData {
  public:
-  CallInterfaceDescriptorData()
-      : register_param_count_(-1),
-        param_count_(-1),
-        allocatable_registers_(0) {}
+  enum Flag {
+    kNoFlags = 0u,
+    kNoContext = 1u << 0,
+  };
+  typedef base::Flags<Flag> Flags;
+
+  CallInterfaceDescriptorData() = default;
 
   // A copy of the passed in registers and param_representations is made
   // and owned by the CallInterfaceDescriptorData.
 
-  void InitializePlatformSpecific(
-      int register_parameter_count, const Register* registers,
-      PlatformInterfaceDescriptor* platform_descriptor = nullptr);
+  void InitializePlatformSpecific(int register_parameter_count,
+                                  const Register* registers);
 
   // if machine_types is null, then an array of size
-  // (parameter_count + extra_parameter_count) will be created with
+  // (return_count + parameter_count) will be created with
   // MachineType::AnyTagged() for each member.
   //
   // if machine_types is not null, then it should be of the size
-  // parameter_count. Those members of the parameter array will be initialized
-  // from {machine_types}, and the rest initialized to MachineType::AnyTagged().
-  void InitializePlatformIndependent(int parameter_count,
-                                     int extra_parameter_count,
-                                     const MachineType* machine_types);
+  // (return_count + parameter_count). Those members of the parameter array will
+  // be initialized from {machine_types}, and the rest initialized to
+  // MachineType::AnyTagged().
+  void InitializePlatformIndependent(Flags flags, int return_count,
+                                     int parameter_count,
+                                     const MachineType* machine_types,
+                                     int machine_types_length);
+
+  void Reset();
 
   bool IsInitialized() const {
-    return register_param_count_ >= 0 && param_count_ >= 0;
+    return register_param_count_ >= 0 && return_count_ >= 0 &&
+           param_count_ >= 0;
   }
 
+  Flags flags() const { return flags_; }
+  int return_count() const { return return_count_; }
   int param_count() const { return param_count_; }
   int register_param_count() const { return register_param_count_; }
   Register register_param(int index) const { return register_params_[index]; }
-  Register* register_params() const { return register_params_.get(); }
-  MachineType param_type(int index) const { return machine_types_[index]; }
-  PlatformInterfaceDescriptor* platform_specific_descriptor() const {
-    return platform_specific_descriptor_;
+  Register* register_params() const { return register_params_; }
+  MachineType return_type(int index) const {
+    DCHECK_LT(index, return_count_);
+    return machine_types_[index];
+  }
+  MachineType param_type(int index) const {
+    DCHECK_LT(index, param_count_);
+    return machine_types_[return_count_ + index];
   }
 
   void RestrictAllocatableRegisters(const Register* registers, int num) {
@@ -132,27 +138,28 @@ class V8_EXPORT_PRIVATE CallInterfaceDescriptorData {
   RegList allocatable_registers() const { return allocatable_registers_; }
 
  private:
-  int register_param_count_;
-  int param_count_;
+  int register_param_count_ = -1;
+  int return_count_ = -1;
+  int param_count_ = -1;
+  Flags flags_ = kNoFlags;
 
   // Specifying the set of registers that could be used by the register
   // allocator. Currently, it's only used by RecordWrite code stub.
-  RegList allocatable_registers_;
+  RegList allocatable_registers_ = 0;
 
-  // The Register params are allocated dynamically by the
-  // InterfaceDescriptor, and freed on destruction. This is because static
-  // arrays of Registers cause creation of runtime static initializers
-  // which we don't want.
-  std::unique_ptr<Register[]> register_params_;
-  std::unique_ptr<MachineType[]> machine_types_;
-
-  PlatformInterfaceDescriptor* platform_specific_descriptor_;
+  // |registers_params_| defines registers that are used for parameter passing.
+  // |machine_types_| defines machine types for resulting values and incomping
+  // parameters.
+  // Both arrays are allocated dynamically by the InterfaceDescriptor and
+  // freed on destruction. This is because static arrays cause creation of
+  // runtime static initializers which we don't want.
+  Register* register_params_ = nullptr;
+  MachineType* machine_types_ = nullptr;
 
   DISALLOW_COPY_AND_ASSIGN(CallInterfaceDescriptorData);
 };
 
-
-class CallDescriptors {
+class V8_EXPORT_PRIVATE CallDescriptors : public AllStatic {
  public:
   enum Key {
 #define DEF_ENUM(name, ...) name,
@@ -160,15 +167,49 @@ class CallDescriptors {
 #undef DEF_ENUM
         NUMBER_OF_DESCRIPTORS
   };
+
+  static void InitializeOncePerProcess();
+  static void TearDown();
+
+  static CallInterfaceDescriptorData* call_descriptor_data(
+      CallDescriptors::Key key) {
+    return &call_descriptor_data_[key];
+  }
+
+  static Key GetKey(const CallInterfaceDescriptorData* data) {
+    ptrdiff_t index = data - call_descriptor_data_;
+    DCHECK_LE(0, index);
+    DCHECK_LT(index, CallDescriptors::NUMBER_OF_DESCRIPTORS);
+    return static_cast<CallDescriptors::Key>(index);
+  }
+
+ private:
+  static CallInterfaceDescriptorData
+      call_descriptor_data_[NUMBER_OF_DESCRIPTORS];
 };
 
 class V8_EXPORT_PRIVATE CallInterfaceDescriptor {
  public:
+  typedef CallInterfaceDescriptorData::Flags Flags;
+
   CallInterfaceDescriptor() : data_(nullptr) {}
   virtual ~CallInterfaceDescriptor() {}
 
-  CallInterfaceDescriptor(Isolate* isolate, CallDescriptors::Key key)
-      : data_(isolate->call_descriptor_data(key)) {}
+  CallInterfaceDescriptor(CallDescriptors::Key key)
+      : data_(CallDescriptors::call_descriptor_data(key)) {}
+
+  Flags flags() const { return data()->flags(); }
+
+  bool HasContextParameter() const {
+    return (flags() & CallInterfaceDescriptorData::kNoContext) == 0;
+  }
+
+  int GetReturnCount() const { return data()->return_count(); }
+
+  MachineType GetReturnType(int index) const {
+    DCHECK_LT(index, data()->return_count());
+    return data()->return_type(index);
+  }
 
   int GetParameterCount() const { return data()->param_count(); }
 
@@ -185,22 +226,17 @@ class V8_EXPORT_PRIVATE CallInterfaceDescriptor {
   }
 
   MachineType GetParameterType(int index) const {
-    DCHECK(index < data()->param_count());
+    DCHECK_LT(index, data()->param_count());
     return data()->param_type(index);
   }
 
-  // Some platforms have extra information to associate with the descriptor.
-  PlatformInterfaceDescriptor* platform_specific_descriptor() const {
-    return data()->platform_specific_descriptor();
-  }
-
   RegList allocatable_registers() const {
     return data()->allocatable_registers();
   }
 
   static const Register ContextRegister();
 
-  const char* DebugName(Isolate* isolate) const;
+  const char* DebugName() const;
 
  protected:
   const CallInterfaceDescriptorData* data() const { return data_; }
@@ -211,19 +247,11 @@ class V8_EXPORT_PRIVATE CallInterfaceDescriptor {
 
   virtual void InitializePlatformIndependent(
       CallInterfaceDescriptorData* data) {
-    data->InitializePlatformIndependent(data->register_param_count(), 0,
-                                        nullptr);
-  }
-
-  void Initialize(Isolate* isolate, CallDescriptors::Key key) {
-    if (!data()->IsInitialized()) {
-      // We should only initialize descriptors on the isolate's main thread.
-      DCHECK(ThreadId::Current().Equals(isolate->thread_id()));
-      CallInterfaceDescriptorData* d = isolate->call_descriptor_data(key);
-      DCHECK(d == data());  // d should be a modifiable pointer to data().
-      InitializePlatformSpecific(d);
-      InitializePlatformIndependent(d);
-    }
+    // Default descriptor configuration: one result, all parameters are passed
+    // in registers and all parameters have MachineType::AnyTagged() type.
+    data->InitializePlatformIndependent(CallInterfaceDescriptorData::kNoFlags,
+                                        1, data->register_param_count(),
+                                        nullptr, 0);
   }
 
   // Initializes |data| using the platform dependent default set of registers.
@@ -232,156 +260,202 @@ class V8_EXPORT_PRIVATE CallInterfaceDescriptor {
   static void DefaultInitializePlatformSpecific(
       CallInterfaceDescriptorData* data, int register_parameter_count);
 
+  // Initializes |data| using the platform dependent default set of registers
+  // for JavaScript-compatible calling convention.
+  // It is intended to be used for TurboFan stubs being called with JavaScript
+  // linkage + additional parameters on registers and stack.
+  static void JSDefaultInitializePlatformSpecific(
+      CallInterfaceDescriptorData* data, int non_js_register_parameter_count);
+
  private:
+  // {CallDescriptors} is allowed to call the private {Initialize} method.
+  friend class CallDescriptors;
+
   const CallInterfaceDescriptorData* data_;
+
+  void Initialize(CallInterfaceDescriptorData* data) {
+    // The passed pointer should be a modifiable pointer to our own data.
+    DCHECK_EQ(data, data_);
+    DCHECK(!data->IsInitialized());
+    InitializePlatformSpecific(data);
+    InitializePlatformIndependent(data);
+    DCHECK(data->IsInitialized());
+  }
 };
 
-#define DECLARE_DESCRIPTOR_WITH_BASE(name, base)           \
- public:                                                   \
-  explicit name(Isolate* isolate) : base(isolate, key()) { \
-    Initialize(isolate, key());                            \
-  }                                                        \
+#define DECLARE_DESCRIPTOR_WITH_BASE(name, base) \
+ public:                                         \
+  explicit name() : base(key()) {}               \
   static inline CallDescriptors::Key key();
 
-static const int kMaxBuiltinRegisterParams = 5;
-
-#define DECLARE_DEFAULT_DESCRIPTOR(name, base, parameter_count)               \
-  DECLARE_DESCRIPTOR_WITH_BASE(name, base)                                    \
- protected:                                                                   \
-  static const int kRegisterParams =                                          \
-      parameter_count > kMaxBuiltinRegisterParams ? kMaxBuiltinRegisterParams \
-                                                  : parameter_count;          \
-  static const int kStackParams = parameter_count - kRegisterParams;          \
-  void InitializePlatformSpecific(CallInterfaceDescriptorData* data)          \
-      override {                                                              \
-    DefaultInitializePlatformSpecific(data, kRegisterParams);                 \
-  }                                                                           \
-  void InitializePlatformIndependent(CallInterfaceDescriptorData* data)       \
-      override {                                                              \
-    data->InitializePlatformIndependent(kRegisterParams, kStackParams,        \
-                                        nullptr);                             \
-  }                                                                           \
-  name(Isolate* isolate, CallDescriptors::Key key) : base(isolate, key) {}    \
-                                                                              \
- public:
+constexpr int kMaxBuiltinRegisterParams = 5;
 
-#define DECLARE_DESCRIPTOR(name, base)                                         \
+#define DECLARE_DEFAULT_DESCRIPTOR(name, base)                                 \
   DECLARE_DESCRIPTOR_WITH_BASE(name, base)                                     \
  protected:                                                                    \
-  void InitializePlatformSpecific(CallInterfaceDescriptorData* data) override; \
-  name(Isolate* isolate, CallDescriptors::Key key) : base(isolate, key) {}     \
+  static const int kRegisterParams =                                           \
+      kParameterCount > kMaxBuiltinRegisterParams ? kMaxBuiltinRegisterParams  \
+                                                  : kParameterCount;           \
+  static const int kStackParams = kParameterCount - kRegisterParams;           \
+  void InitializePlatformSpecific(CallInterfaceDescriptorData* data)           \
+      override {                                                               \
+    DefaultInitializePlatformSpecific(data, kRegisterParams);                  \
+  }                                                                            \
+  void InitializePlatformIndependent(CallInterfaceDescriptorData* data)        \
+      override {                                                               \
+    data->InitializePlatformIndependent(Flags(kDescriptorFlags), kReturnCount, \
+                                        kParameterCount, nullptr, 0);          \
+  }                                                                            \
+  name(CallDescriptors::Key key) : base(key) {}                                \
                                                                                \
  public:
 
-#define DECLARE_DESCRIPTOR_WITH_CUSTOM_FUNCTION_TYPE(name, base)        \
-  DECLARE_DESCRIPTOR(name, base)                                        \
- protected:                                                             \
-  void InitializePlatformIndependent(CallInterfaceDescriptorData* data) \
-      override;                                                         \
-                                                                        \
- public:
-
-#define DECLARE_DESCRIPTOR_WITH_STACK_ARGS(name, base)                  \
-  DECLARE_DESCRIPTOR_WITH_BASE(name, base)                              \
- protected:                                                             \
-  void InitializePlatformIndependent(CallInterfaceDescriptorData* data) \
-      override {                                                        \
-    data->InitializePlatformIndependent(0, kParameterCount, nullptr);   \
-  }                                                                     \
-  void InitializePlatformSpecific(CallInterfaceDescriptorData* data)    \
-      override {                                                        \
-    data->InitializePlatformSpecific(0, nullptr);                       \
-  }                                                                     \
-                                                                        \
- public:
+#define DECLARE_JS_COMPATIBLE_DESCRIPTOR(name, base,                        \
+                                         non_js_reg_parameters_count)       \
+  DECLARE_DESCRIPTOR_WITH_BASE(name, base)                                  \
+ protected:                                                                 \
+  void InitializePlatformSpecific(CallInterfaceDescriptorData* data)        \
+      override {                                                            \
+    JSDefaultInitializePlatformSpecific(data, non_js_reg_parameters_count); \
+  }                                                                         \
+  name(CallDescriptors::Key key) : base(key) {}                             \
+                                                                            \
+ public:
+
+#define DEFINE_RESULT_AND_PARAMETERS(return_count, ...)   \
+  static constexpr int kDescriptorFlags =                 \
+      CallInterfaceDescriptorData::kNoFlags;              \
+  static constexpr int kReturnCount = return_count;       \
+  enum ParameterIndices {                                 \
+    __dummy = -1, /* to be able to pass zero arguments */ \
+    ##__VA_ARGS__,                                        \
+                                                          \
+    kParameterCount,                                      \
+    kContext = kParameterCount /* implicit parameter */   \
+  };
 
-#define DEFINE_EMPTY_PARAMETERS()                       \
-  enum ParameterIndices {                               \
-    kParameterCount,                                    \
-    kContext = kParameterCount /* implicit parameter */ \
+#define DEFINE_RESULT_AND_PARAMETERS_NO_CONTEXT(return_count, ...) \
+  static constexpr int kDescriptorFlags =                          \
+      CallInterfaceDescriptorData::kNoContext;                     \
+  static constexpr int kReturnCount = return_count;                \
+  enum ParameterIndices {                                          \
+    __dummy = -1, /* to be able to pass zero arguments */          \
+    ##__VA_ARGS__,                                                 \
+                                                                   \
+    kParameterCount                                                \
   };
 
-#define DEFINE_PARAMETERS(...)                          \
+#define DEFINE_PARAMETERS(...) DEFINE_RESULT_AND_PARAMETERS(1, ##__VA_ARGS__)
+
+#define DEFINE_PARAMETERS_NO_CONTEXT(...) \
+  DEFINE_RESULT_AND_PARAMETERS_NO_CONTEXT(1, ##__VA_ARGS__)
+
+#define DEFINE_RESULT_AND_PARAMETER_TYPES(...)                                 \
+  void InitializePlatformIndependent(CallInterfaceDescriptorData* data)        \
+      override {                                                               \
+    MachineType machine_types[] = {__VA_ARGS__};                               \
+    static_assert(                                                             \
+        kReturnCount + kParameterCount == arraysize(machine_types),            \
+        "Parameter names definition is not consistent with parameter types");  \
+    data->InitializePlatformIndependent(Flags(kDescriptorFlags), kReturnCount, \
+                                        kParameterCount, machine_types,        \
+                                        arraysize(machine_types));             \
+  }
+
+#define DEFINE_PARAMETER_TYPES(...)                                        \
+  DEFINE_RESULT_AND_PARAMETER_TYPES(MachineType::AnyTagged() /* result */, \
+                                    ##__VA_ARGS__)
+
+#define DEFINE_JS_PARAMETERS(...)                       \
+  static constexpr int kDescriptorFlags =               \
+      CallInterfaceDescriptorData::kNoFlags;            \
+  static constexpr int kReturnCount = 1;                \
   enum ParameterIndices {                               \
-    __VA_ARGS__,                                        \
+    kTarget,                                            \
+    kNewTarget,                                         \
+    kActualArgumentsCount,                              \
+    ##__VA_ARGS__,                                      \
                                                         \
     kParameterCount,                                    \
     kContext = kParameterCount /* implicit parameter */ \
   };
 
-#define DECLARE_BUILTIN_DESCRIPTOR(name)                                      \
-  DECLARE_DESCRIPTOR_WITH_BASE(name, BuiltinDescriptor)                       \
- protected:                                                                   \
-  void InitializePlatformIndependent(CallInterfaceDescriptorData* data)       \
-      override {                                                              \
-    MachineType machine_types[] = {MachineType::AnyTagged(),                  \
-                                   MachineType::AnyTagged(),                  \
-                                   MachineType::Int32()};                     \
-    data->InitializePlatformIndependent(arraysize(machine_types),             \
-                                        kStackParameterCount, machine_types); \
-  }                                                                           \
-  void InitializePlatformSpecific(CallInterfaceDescriptorData* data)          \
-      override {                                                              \
-    Register registers[] = {TargetRegister(), NewTargetRegister(),            \
-                            ArgumentsCountRegister()};                        \
-    data->InitializePlatformSpecific(arraysize(registers), registers);        \
-  }                                                                           \
-                                                                              \
- public:
-
-#define DEFINE_BUILTIN_PARAMETERS(...)                                  \
-  enum ParameterIndices {                                               \
-    kReceiver,                                                          \
-    kBeforeFirstStackParameter = kReceiver,                             \
-    __VA_ARGS__,                                                        \
-    kAfterLastStackParameter,                                           \
-    kNewTarget = kAfterLastStackParameter,                              \
-    kArgumentsCount,                                                    \
-    kContext, /* implicit parameter */                                  \
-    kParameterCount = kContext,                                         \
-    kArity = kAfterLastStackParameter - kBeforeFirstStackParameter - 1, \
-    kStackParameterCount = kArity + 1                                   \
-  };
+#define DEFINE_JS_PARAMETER_TYPES(...)                                         \
+  DEFINE_PARAMETER_TYPES(MachineType::AnyTagged(), /* kTarget */               \
+                         MachineType::AnyTagged(), /* kNewTarget */            \
+                         MachineType::Int32(),     /* kActualArgumentsCount */ \
+                         ##__VA_ARGS__)
+
+#define DECLARE_DESCRIPTOR(name, base)                                         \
+  DECLARE_DESCRIPTOR_WITH_BASE(name, base)                                     \
+ protected:                                                                    \
+  void InitializePlatformSpecific(CallInterfaceDescriptorData* data) override; \
+  name(CallDescriptors::Key key) : base(key) {}                                \
+                                                                               \
+ public:
 
 class V8_EXPORT_PRIVATE VoidDescriptor : public CallInterfaceDescriptor {
  public:
+  DEFINE_PARAMETERS()
+  DEFINE_PARAMETER_TYPES()
   DECLARE_DESCRIPTOR(VoidDescriptor, CallInterfaceDescriptor)
 };
 
+class AllocateDescriptor : public CallInterfaceDescriptor {
+ public:
+  DEFINE_PARAMETERS_NO_CONTEXT(kRequestedSize)
+  DEFINE_RESULT_AND_PARAMETER_TYPES(MachineType::TaggedPointer(),  // result 1
+                                    MachineType::Int32())  // kRequestedSize
+  DECLARE_DESCRIPTOR(AllocateDescriptor, CallInterfaceDescriptor)
+};
+
+// This descriptor defines the JavaScript calling convention that can be used
+// by stubs: target, new.target, argc (not including the receiver) and context
+// are passed in registers while receiver and the rest of the JS arguments are
+// passed on the stack.
+class JSTrampolineDescriptor : public CallInterfaceDescriptor {
+ public:
+  DEFINE_JS_PARAMETERS()
+  DEFINE_JS_PARAMETER_TYPES()
+
+  DECLARE_JS_COMPATIBLE_DESCRIPTOR(JSTrampolineDescriptor,
+                                   CallInterfaceDescriptor, 0)
+};
+
 class ContextOnlyDescriptor : public CallInterfaceDescriptor {
  public:
+  DEFINE_PARAMETERS()
+  DEFINE_PARAMETER_TYPES()
   DECLARE_DESCRIPTOR(ContextOnlyDescriptor, CallInterfaceDescriptor)
 };
 
+class NoContextDescriptor : public CallInterfaceDescriptor {
+ public:
+  DEFINE_PARAMETERS_NO_CONTEXT()
+  DEFINE_PARAMETER_TYPES()
+  DECLARE_DESCRIPTOR(NoContextDescriptor, CallInterfaceDescriptor)
+};
+
 // LoadDescriptor is used by all stubs that implement Load/KeyedLoad ICs.
 class LoadDescriptor : public CallInterfaceDescriptor {
  public:
   DEFINE_PARAMETERS(kReceiver, kName, kSlot)
-  DECLARE_DESCRIPTOR_WITH_CUSTOM_FUNCTION_TYPE(LoadDescriptor,
-                                               CallInterfaceDescriptor)
+  DEFINE_PARAMETER_TYPES(MachineType::AnyTagged(),     // kReceiver
+                         MachineType::AnyTagged(),     // kName
+                         MachineType::TaggedSigned())  // kSlot
+  DECLARE_DESCRIPTOR(LoadDescriptor, CallInterfaceDescriptor)
 
   static const Register ReceiverRegister();
   static const Register NameRegister();
   static const Register SlotRegister();
 };
 
-// LoadFieldDescriptor is used by the shared handler that loads a field from an
-// object based on the smi-encoded field description.
-class LoadFieldDescriptor : public CallInterfaceDescriptor {
- public:
-  DEFINE_PARAMETERS(kReceiver, kSmiHandler)
-  DECLARE_DESCRIPTOR_WITH_CUSTOM_FUNCTION_TYPE(LoadFieldDescriptor,
-                                               CallInterfaceDescriptor)
-
-  static const Register ReceiverRegister();
-  static const Register SmiHandlerRegister();
-};
-
 class LoadGlobalDescriptor : public CallInterfaceDescriptor {
  public:
   DEFINE_PARAMETERS(kName, kSlot)
-  DECLARE_DESCRIPTOR_WITH_CUSTOM_FUNCTION_TYPE(LoadGlobalDescriptor,
-                                               CallInterfaceDescriptor)
+  DEFINE_PARAMETER_TYPES(MachineType::AnyTagged(),     // kName
+                         MachineType::TaggedSigned())  // kSlot
+  DECLARE_DESCRIPTOR(LoadGlobalDescriptor, CallInterfaceDescriptor)
 
   static const Register NameRegister() {
     return LoadDescriptor::NameRegister();
@@ -395,8 +469,11 @@ class LoadGlobalDescriptor : public CallInterfaceDescriptor {
 class StoreDescriptor : public CallInterfaceDescriptor {
  public:
   DEFINE_PARAMETERS(kReceiver, kName, kValue, kSlot)
-  DECLARE_DESCRIPTOR_WITH_CUSTOM_FUNCTION_TYPE(StoreDescriptor,
-                                               CallInterfaceDescriptor)
+  DEFINE_PARAMETER_TYPES(MachineType::AnyTagged(),     // kReceiver
+                         MachineType::AnyTagged(),     // kName
+                         MachineType::AnyTagged(),     // kValue
+                         MachineType::TaggedSigned())  // kSlot
+  DECLARE_DESCRIPTOR(StoreDescriptor, CallInterfaceDescriptor)
 
   static const Register ReceiverRegister();
   static const Register NameRegister();
@@ -416,8 +493,13 @@ class StoreDescriptor : public CallInterfaceDescriptor {
 class StoreTransitionDescriptor : public StoreDescriptor {
  public:
   DEFINE_PARAMETERS(kReceiver, kName, kMap, kValue, kSlot, kVector)
-  DECLARE_DESCRIPTOR_WITH_CUSTOM_FUNCTION_TYPE(StoreTransitionDescriptor,
-                                               StoreDescriptor)
+  DEFINE_PARAMETER_TYPES(MachineType::AnyTagged(),     // kReceiver
+                         MachineType::AnyTagged(),     // kName
+                         MachineType::AnyTagged(),     // kMap
+                         MachineType::AnyTagged(),     // kValue
+                         MachineType::TaggedSigned(),  // kSlot
+                         MachineType::AnyTagged())     // kVector
+  DECLARE_DESCRIPTOR(StoreTransitionDescriptor, StoreDescriptor)
 
   static const Register MapRegister();
   static const Register SlotRegister();
@@ -427,29 +509,15 @@ class StoreTransitionDescriptor : public StoreDescriptor {
   static const int kStackArgumentsCount = kPassLastArgsOnStack ? 3 : 0;
 };
 
-class StoreNamedTransitionDescriptor : public StoreTransitionDescriptor {
- public:
-  DEFINE_PARAMETERS(kReceiver, kFieldOffset, kMap, kValue, kSlot, kVector,
-                    kName)
-  DECLARE_DESCRIPTOR_WITH_CUSTOM_FUNCTION_TYPE(StoreNamedTransitionDescriptor,
-                                               StoreTransitionDescriptor)
-
-  // Always pass name on the stack.
-  static const bool kPassLastArgsOnStack = true;
-  static const int kStackArgumentsCount =
-      StoreTransitionDescriptor::kStackArgumentsCount + 1;
-
-  static const Register NameRegister() { return no_reg; }
-  static const Register FieldOffsetRegister() {
-    return StoreTransitionDescriptor::NameRegister();
-  }
-};
-
 class StoreWithVectorDescriptor : public StoreDescriptor {
  public:
   DEFINE_PARAMETERS(kReceiver, kName, kValue, kSlot, kVector)
-  DECLARE_DESCRIPTOR_WITH_CUSTOM_FUNCTION_TYPE(StoreWithVectorDescriptor,
-                                               StoreDescriptor)
+  DEFINE_PARAMETER_TYPES(MachineType::AnyTagged(),     // kReceiver
+                         MachineType::AnyTagged(),     // kName
+                         MachineType::AnyTagged(),     // kValue
+                         MachineType::TaggedSigned(),  // kSlot
+                         MachineType::AnyTagged())     // kVector
+  DECLARE_DESCRIPTOR(StoreWithVectorDescriptor, StoreDescriptor)
 
   static const Register VectorRegister();
 
@@ -460,8 +528,10 @@ class StoreWithVectorDescriptor : public StoreDescriptor {
 class StoreGlobalDescriptor : public CallInterfaceDescriptor {
  public:
   DEFINE_PARAMETERS(kName, kValue, kSlot)
-  DECLARE_DESCRIPTOR_WITH_CUSTOM_FUNCTION_TYPE(StoreGlobalDescriptor,
-                                               CallInterfaceDescriptor)
+  DEFINE_PARAMETER_TYPES(MachineType::AnyTagged(),     // kName
+                         MachineType::AnyTagged(),     // kValue
+                         MachineType::TaggedSigned())  // kSlot
+  DECLARE_DESCRIPTOR(StoreGlobalDescriptor, CallInterfaceDescriptor)
 
   static const bool kPassLastArgsOnStack =
       StoreDescriptor::kPassLastArgsOnStack;
@@ -484,8 +554,11 @@ class StoreGlobalDescriptor : public CallInterfaceDescriptor {
 class StoreGlobalWithVectorDescriptor : public StoreGlobalDescriptor {
  public:
   DEFINE_PARAMETERS(kName, kValue, kSlot, kVector)
-  DECLARE_DESCRIPTOR_WITH_CUSTOM_FUNCTION_TYPE(StoreGlobalWithVectorDescriptor,
-                                               StoreGlobalDescriptor)
+  DEFINE_PARAMETER_TYPES(MachineType::AnyTagged(),     // kName
+                         MachineType::AnyTagged(),     // kValue
+                         MachineType::TaggedSigned(),  // kSlot
+                         MachineType::AnyTagged())     // kVector
+  DECLARE_DESCRIPTOR(StoreGlobalWithVectorDescriptor, StoreGlobalDescriptor)
 
   static const Register VectorRegister() {
     return StoreWithVectorDescriptor::VectorRegister();
@@ -498,8 +571,11 @@ class StoreGlobalWithVectorDescriptor : public StoreGlobalDescriptor {
 class LoadWithVectorDescriptor : public LoadDescriptor {
  public:
   DEFINE_PARAMETERS(kReceiver, kName, kSlot, kVector)
-  DECLARE_DESCRIPTOR_WITH_CUSTOM_FUNCTION_TYPE(LoadWithVectorDescriptor,
-                                               LoadDescriptor)
+  DEFINE_PARAMETER_TYPES(MachineType::AnyTagged(),     // kReceiver
+                         MachineType::AnyTagged(),     // kName
+                         MachineType::TaggedSigned(),  // kSlot
+                         MachineType::AnyTagged())     // kVector
+  DECLARE_DESCRIPTOR(LoadWithVectorDescriptor, LoadDescriptor)
 
   static const Register VectorRegister();
 };
@@ -507,8 +583,10 @@ class LoadWithVectorDescriptor : public LoadDescriptor {
 class LoadGlobalWithVectorDescriptor : public LoadGlobalDescriptor {
  public:
   DEFINE_PARAMETERS(kName, kSlot, kVector)
-  DECLARE_DESCRIPTOR_WITH_CUSTOM_FUNCTION_TYPE(LoadGlobalWithVectorDescriptor,
-                                               LoadGlobalDescriptor)
+  DEFINE_PARAMETER_TYPES(MachineType::AnyTagged(),     // kName
+                         MachineType::TaggedSigned(),  // kSlot
+                         MachineType::AnyTagged())     // kVector
+  DECLARE_DESCRIPTOR(LoadGlobalWithVectorDescriptor, LoadGlobalDescriptor)
 
   static const Register VectorRegister() {
     return LoadWithVectorDescriptor::VectorRegister();
@@ -517,39 +595,41 @@ class LoadGlobalWithVectorDescriptor : public LoadGlobalDescriptor {
 
 class FastNewFunctionContextDescriptor : public CallInterfaceDescriptor {
  public:
-  DEFINE_PARAMETERS(kFunction, kSlots)
-  DECLARE_DESCRIPTOR_WITH_CUSTOM_FUNCTION_TYPE(FastNewFunctionContextDescriptor,
-                                               CallInterfaceDescriptor)
+  DEFINE_PARAMETERS(kScopeInfo, kSlots)
+  DEFINE_PARAMETER_TYPES(MachineType::AnyTagged(),  // kScopeInfo
+                         MachineType::Int32())      // kSlots
+  DECLARE_DESCRIPTOR(FastNewFunctionContextDescriptor, CallInterfaceDescriptor)
 
-  static const Register FunctionRegister();
+  static const Register ScopeInfoRegister();
   static const Register SlotsRegister();
 };
 
 class FastNewObjectDescriptor : public CallInterfaceDescriptor {
  public:
   DEFINE_PARAMETERS(kTarget, kNewTarget)
+  DEFINE_PARAMETER_TYPES(MachineType::AnyTagged(),  // kTarget
+                         MachineType::AnyTagged())  // kNewTarget
   DECLARE_DESCRIPTOR(FastNewObjectDescriptor, CallInterfaceDescriptor)
   static const Register TargetRegister();
   static const Register NewTargetRegister();
 };
 
-class FastNewArgumentsDescriptor : public CallInterfaceDescriptor {
- public:
-  DEFINE_PARAMETERS(kFunction)
-  DECLARE_DESCRIPTOR(FastNewArgumentsDescriptor, CallInterfaceDescriptor)
-  static const Register TargetRegister();
-};
-
 class RecordWriteDescriptor final : public CallInterfaceDescriptor {
  public:
   DEFINE_PARAMETERS(kObject, kSlot, kIsolate, kRememberedSet, kFPMode)
-  DECLARE_DESCRIPTOR_WITH_CUSTOM_FUNCTION_TYPE(RecordWriteDescriptor,
-                                               CallInterfaceDescriptor)
+  DEFINE_PARAMETER_TYPES(MachineType::TaggedPointer(),  // kObject
+                         MachineType::Pointer(),        // kSlot
+                         MachineType::Pointer(),        // kIsolate
+                         MachineType::TaggedSigned(),   // kRememberedSet
+                         MachineType::TaggedSigned())   // kFPMode
+
+  DECLARE_DESCRIPTOR(RecordWriteDescriptor, CallInterfaceDescriptor)
 };
 
 class TypeConversionDescriptor final : public CallInterfaceDescriptor {
  public:
   DEFINE_PARAMETERS(kArgument)
+  DEFINE_PARAMETER_TYPES(MachineType::AnyTagged())
   DECLARE_DESCRIPTOR(TypeConversionDescriptor, CallInterfaceDescriptor)
 
   static const Register ArgumentRegister();
@@ -559,183 +639,185 @@ class TypeConversionStackParameterDescriptor final
     : public CallInterfaceDescriptor {
  public:
   DEFINE_PARAMETERS(kArgument)
-  DECLARE_DESCRIPTOR_WITH_CUSTOM_FUNCTION_TYPE(
-      TypeConversionStackParameterDescriptor, CallInterfaceDescriptor)
-};
-
-class ForInPrepareDescriptor final : public CallInterfaceDescriptor {
- public:
-  DEFINE_PARAMETERS(kObject)
-  DECLARE_DEFAULT_DESCRIPTOR(ForInPrepareDescriptor, CallInterfaceDescriptor,
-                             kParameterCount)
+  DEFINE_PARAMETER_TYPES(MachineType::AnyTagged())
+  DECLARE_DESCRIPTOR(TypeConversionStackParameterDescriptor,
+                     CallInterfaceDescriptor)
 };
 
 class GetPropertyDescriptor final : public CallInterfaceDescriptor {
  public:
   DEFINE_PARAMETERS(kObject, kKey)
-  DECLARE_DEFAULT_DESCRIPTOR(GetPropertyDescriptor, CallInterfaceDescriptor,
-                             kParameterCount)
+  DECLARE_DEFAULT_DESCRIPTOR(GetPropertyDescriptor, CallInterfaceDescriptor)
 };
 
 class TypeofDescriptor : public CallInterfaceDescriptor {
  public:
   DEFINE_PARAMETERS(kObject)
+  DEFINE_PARAMETER_TYPES(MachineType::AnyTagged())
   DECLARE_DESCRIPTOR(TypeofDescriptor, CallInterfaceDescriptor)
 };
 
 class CallTrampolineDescriptor : public CallInterfaceDescriptor {
  public:
   DEFINE_PARAMETERS(kFunction, kActualArgumentsCount)
-  DECLARE_DESCRIPTOR_WITH_CUSTOM_FUNCTION_TYPE(CallTrampolineDescriptor,
-                                               CallInterfaceDescriptor)
+  DEFINE_PARAMETER_TYPES(MachineType::AnyTagged(),  // kFunction
+                         MachineType::Int32())      // kActualArgumentsCount
+  DECLARE_DESCRIPTOR(CallTrampolineDescriptor, CallInterfaceDescriptor)
 };
 
 class CallVarargsDescriptor : public CallInterfaceDescriptor {
  public:
   DEFINE_PARAMETERS(kTarget, kActualArgumentsCount, kArgumentsList,
                     kArgumentsLength)
-  DECLARE_DESCRIPTOR_WITH_CUSTOM_FUNCTION_TYPE(CallVarargsDescriptor,
-                                               CallInterfaceDescriptor)
+  DEFINE_PARAMETER_TYPES(MachineType::AnyTagged(),  // kTarget
+                         MachineType::Int32(),      // kActualArgumentsCount
+                         MachineType::AnyTagged(),  // kArgumentsList
+                         MachineType::Int32())      // kArgumentsLength
+  DECLARE_DESCRIPTOR(CallVarargsDescriptor, CallInterfaceDescriptor)
 };
 
 class CallForwardVarargsDescriptor : public CallInterfaceDescriptor {
  public:
   DEFINE_PARAMETERS(kTarget, kActualArgumentsCount, kStartIndex)
-  DECLARE_DESCRIPTOR_WITH_CUSTOM_FUNCTION_TYPE(CallForwardVarargsDescriptor,
-                                               CallInterfaceDescriptor)
+  DEFINE_PARAMETER_TYPES(MachineType::AnyTagged(),  // kTarget
+                         MachineType::Int32(),      // kActualArgumentsCount
+                         MachineType::Int32())      // kStartIndex
+  DECLARE_DESCRIPTOR(CallForwardVarargsDescriptor, CallInterfaceDescriptor)
 };
 
 class CallWithSpreadDescriptor : public CallInterfaceDescriptor {
  public:
   DEFINE_PARAMETERS(kTarget, kArgumentsCount, kSpread)
-  DECLARE_DESCRIPTOR_WITH_CUSTOM_FUNCTION_TYPE(CallWithSpreadDescriptor,
-                                               CallInterfaceDescriptor)
+  DEFINE_PARAMETER_TYPES(MachineType::AnyTagged(),  // kTarget
+                         MachineType::Int32(),      // kArgumentsCount
+                         MachineType::AnyTagged())  // kSpread
+  DECLARE_DESCRIPTOR(CallWithSpreadDescriptor, CallInterfaceDescriptor)
 };
 
 class CallWithArrayLikeDescriptor : public CallInterfaceDescriptor {
  public:
   DEFINE_PARAMETERS(kTarget, kArgumentsList)
-  DECLARE_DESCRIPTOR_WITH_CUSTOM_FUNCTION_TYPE(CallWithArrayLikeDescriptor,
-                                               CallInterfaceDescriptor)
+  DEFINE_PARAMETER_TYPES(MachineType::AnyTagged(),  // kTarget
+                         MachineType::AnyTagged())  // kArgumentsList
+  DECLARE_DESCRIPTOR(CallWithArrayLikeDescriptor, CallInterfaceDescriptor)
 };
 
 class ConstructVarargsDescriptor : public CallInterfaceDescriptor {
  public:
-  DEFINE_PARAMETERS(kTarget, kNewTarget, kActualArgumentsCount, kArgumentsList,
-                    kArgumentsLength)
-  DECLARE_DESCRIPTOR_WITH_CUSTOM_FUNCTION_TYPE(ConstructVarargsDescriptor,
-                                               CallInterfaceDescriptor)
+  DEFINE_JS_PARAMETERS(kArgumentsList, kArgumentsLength)
+  DEFINE_JS_PARAMETER_TYPES(MachineType::AnyTagged(),  // kArgumentsList
+                            MachineType::Int32())      // kArgumentsLength
+  DECLARE_DESCRIPTOR(ConstructVarargsDescriptor, CallInterfaceDescriptor)
 };
 
 class ConstructForwardVarargsDescriptor : public CallInterfaceDescriptor {
  public:
-  DEFINE_PARAMETERS(kTarget, kNewTarget, kActualArgumentsCount, kStartIndex)
-  DECLARE_DESCRIPTOR_WITH_CUSTOM_FUNCTION_TYPE(
-      ConstructForwardVarargsDescriptor, CallInterfaceDescriptor)
+  DEFINE_JS_PARAMETERS(kStartIndex)
+  DEFINE_JS_PARAMETER_TYPES(MachineType::Int32())
+  DECLARE_DESCRIPTOR(ConstructForwardVarargsDescriptor, CallInterfaceDescriptor)
 };
 
 class ConstructWithSpreadDescriptor : public CallInterfaceDescriptor {
  public:
-  DEFINE_PARAMETERS(kTarget, kNewTarget, kArgumentsCount, kSpread)
-  DECLARE_DESCRIPTOR_WITH_CUSTOM_FUNCTION_TYPE(ConstructWithSpreadDescriptor,
-                                               CallInterfaceDescriptor)
+  DEFINE_JS_PARAMETERS(kSpread)
+  DEFINE_JS_PARAMETER_TYPES(MachineType::AnyTagged())
+  DECLARE_DESCRIPTOR(ConstructWithSpreadDescriptor, CallInterfaceDescriptor)
 };
 
 class ConstructWithArrayLikeDescriptor : public CallInterfaceDescriptor {
  public:
   DEFINE_PARAMETERS(kTarget, kNewTarget, kArgumentsList)
-  DECLARE_DESCRIPTOR_WITH_CUSTOM_FUNCTION_TYPE(ConstructWithArrayLikeDescriptor,
-                                               CallInterfaceDescriptor)
+  DEFINE_PARAMETER_TYPES(MachineType::AnyTagged(),  // kTarget
+                         MachineType::AnyTagged(),  // kNewTarget
+                         MachineType::AnyTagged())  // kArgumentsList
+  DECLARE_DESCRIPTOR(ConstructWithArrayLikeDescriptor, CallInterfaceDescriptor)
 };
 
+// TODO(ishell): consider merging this with ArrayConstructorDescriptor
 class ConstructStubDescriptor : public CallInterfaceDescriptor {
  public:
-  DEFINE_PARAMETERS(kFunction, kNewTarget, kActualArgumentsCount,
-                    kAllocationSite)
-  DECLARE_DESCRIPTOR_WITH_CUSTOM_FUNCTION_TYPE(ConstructStubDescriptor,
-                                               CallInterfaceDescriptor)
-};
+  DEFINE_JS_PARAMETERS(kAllocationSite)
+  DEFINE_JS_PARAMETER_TYPES(MachineType::AnyTagged());
 
-// This descriptor is also used by DebugBreakTrampoline because it handles both
-// regular function calls and construct calls, and we need to pass new.target
-// for the latter.
-class ConstructTrampolineDescriptor : public CallInterfaceDescriptor {
- public:
-  DEFINE_PARAMETERS(kFunction, kNewTarget, kActualArgumentsCount)
-  DECLARE_DESCRIPTOR_WITH_CUSTOM_FUNCTION_TYPE(ConstructTrampolineDescriptor,
-                                               CallInterfaceDescriptor)
+  // TODO(ishell): Use DECLARE_JS_COMPATIBLE_DESCRIPTOR if registers match
+  DECLARE_DESCRIPTOR(ConstructStubDescriptor, CallInterfaceDescriptor)
 };
 
-
 class CallFunctionDescriptor : public CallInterfaceDescriptor {
  public:
+  DEFINE_PARAMETERS(kTarget)
+  DEFINE_PARAMETER_TYPES(MachineType::AnyTagged())
   DECLARE_DESCRIPTOR(CallFunctionDescriptor, CallInterfaceDescriptor)
 };
 
-class TransitionElementsKindDescriptor : public CallInterfaceDescriptor {
- public:
-  DEFINE_PARAMETERS(kObject, kMap)
-  DECLARE_DESCRIPTOR(TransitionElementsKindDescriptor, CallInterfaceDescriptor)
-};
-
-class AbortJSDescriptor : public CallInterfaceDescriptor {
+class AbortDescriptor : public CallInterfaceDescriptor {
  public:
-  DEFINE_PARAMETERS(kObject)
-  DECLARE_DESCRIPTOR(AbortJSDescriptor, CallInterfaceDescriptor)
+  DEFINE_PARAMETERS_NO_CONTEXT(kMessageOrMessageId)
+  DEFINE_PARAMETER_TYPES(MachineType::AnyTagged())
+  DECLARE_DESCRIPTOR(AbortDescriptor, CallInterfaceDescriptor)
 };
 
 class AllocateHeapNumberDescriptor : public CallInterfaceDescriptor {
  public:
-  DEFINE_EMPTY_PARAMETERS()
+  DEFINE_PARAMETERS_NO_CONTEXT()
+  DEFINE_PARAMETER_TYPES()
   DECLARE_DESCRIPTOR(AllocateHeapNumberDescriptor, CallInterfaceDescriptor)
 };
 
-class BuiltinDescriptor : public CallInterfaceDescriptor {
+class ArrayConstructorDescriptor : public CallInterfaceDescriptor {
  public:
-  // TODO(ishell): Where is kFunction??
-  DEFINE_PARAMETERS(kNewTarget, kArgumentsCount)
-  DECLARE_DESCRIPTOR_WITH_CUSTOM_FUNCTION_TYPE(BuiltinDescriptor,
-                                               CallInterfaceDescriptor)
-  static const Register ArgumentsCountRegister();
-  static const Register NewTargetRegister();
-  static const Register TargetRegister();
-};
+  DEFINE_JS_PARAMETERS(kAllocationSite)
+  DEFINE_JS_PARAMETER_TYPES(MachineType::AnyTagged());
 
-class IteratingArrayBuiltinDescriptor : public BuiltinDescriptor {
- public:
-  DEFINE_BUILTIN_PARAMETERS(kCallback, kThisArg)
-  DECLARE_BUILTIN_DESCRIPTOR(IteratingArrayBuiltinDescriptor)
+  DECLARE_JS_COMPATIBLE_DESCRIPTOR(ArrayConstructorDescriptor,
+                                   CallInterfaceDescriptor, 1)
 };
 
-class ArrayConstructorDescriptor : public CallInterfaceDescriptor {
+class ArrayNArgumentsConstructorDescriptor : public CallInterfaceDescriptor {
  public:
-  DEFINE_PARAMETERS(kTarget, kNewTarget, kActualArgumentsCount, kAllocationSite)
-  DECLARE_DESCRIPTOR_WITH_CUSTOM_FUNCTION_TYPE(ArrayConstructorDescriptor,
-                                               CallInterfaceDescriptor)
+  // This descriptor declares only register arguments while respective number
+  // of JS arguments stay on the expression stack.
+  // The ArrayNArgumentsConstructor builtin does not access stack arguments
+  // directly it just forwards them to the runtime function.
+  DEFINE_PARAMETERS(kFunction, kAllocationSite, kActualArgumentsCount)
+  DEFINE_PARAMETER_TYPES(MachineType::AnyTagged(),  // kFunction,
+                         MachineType::AnyTagged(),  // kAllocationSite
+                         MachineType::Int32())      // kActualArgumentsCount
+  DECLARE_DESCRIPTOR(ArrayNArgumentsConstructorDescriptor,
+                     CallInterfaceDescriptor)
 };
 
-class ArrayNoArgumentConstructorDescriptor : public CallInterfaceDescriptor {
+class ArrayNoArgumentConstructorDescriptor
+    : public ArrayNArgumentsConstructorDescriptor {
  public:
+  // This descriptor declares same register arguments as the parent
+  // ArrayNArgumentsConstructorDescriptor and it declares indices for
+  // JS arguments passed on the expression stack.
   DEFINE_PARAMETERS(kFunction, kAllocationSite, kActualArgumentsCount,
                     kFunctionParameter)
-  DECLARE_DESCRIPTOR_WITH_CUSTOM_FUNCTION_TYPE(
-      ArrayNoArgumentConstructorDescriptor, CallInterfaceDescriptor)
+  DEFINE_PARAMETER_TYPES(MachineType::AnyTagged(),  // kFunction
+                         MachineType::AnyTagged(),  // kAllocationSite
+                         MachineType::Int32(),      // kActualArgumentsCount
+                         MachineType::AnyTagged())  // kFunctionParameter
+  DECLARE_DESCRIPTOR(ArrayNoArgumentConstructorDescriptor,
+                     ArrayNArgumentsConstructorDescriptor)
 };
 
 class ArraySingleArgumentConstructorDescriptor
-    : public CallInterfaceDescriptor {
+    : public ArrayNArgumentsConstructorDescriptor {
  public:
+  // This descriptor declares same register arguments as the parent
+  // ArrayNArgumentsConstructorDescriptor and it declares indices for
+  // JS arguments passed on the expression stack.
   DEFINE_PARAMETERS(kFunction, kAllocationSite, kActualArgumentsCount,
                     kFunctionParameter, kArraySizeSmiParameter)
-  DECLARE_DESCRIPTOR_WITH_CUSTOM_FUNCTION_TYPE(
-      ArraySingleArgumentConstructorDescriptor, CallInterfaceDescriptor)
-};
-
-class ArrayNArgumentsConstructorDescriptor : public CallInterfaceDescriptor {
- public:
-  DEFINE_PARAMETERS(kFunction, kAllocationSite, kActualArgumentsCount)
-  DECLARE_DESCRIPTOR_WITH_CUSTOM_FUNCTION_TYPE(
-      ArrayNArgumentsConstructorDescriptor, CallInterfaceDescriptor)
+  DEFINE_PARAMETER_TYPES(MachineType::AnyTagged(),  // kFunction
+                         MachineType::AnyTagged(),  // kAllocationSite
+                         MachineType::Int32(),      // kActualArgumentsCount
+                         MachineType::AnyTagged(),  // kFunctionParameter
+                         MachineType::AnyTagged())  // kArraySizeSmiParameter
+  DECLARE_DESCRIPTOR(ArraySingleArgumentConstructorDescriptor,
+                     ArrayNArgumentsConstructorDescriptor)
 };
 
 class CompareDescriptor : public CallInterfaceDescriptor {
@@ -751,47 +833,78 @@ class BinaryOpDescriptor : public CallInterfaceDescriptor {
   DECLARE_DESCRIPTOR(BinaryOpDescriptor, CallInterfaceDescriptor)
 };
 
-
-class StringAddDescriptor : public CallInterfaceDescriptor {
- public:
-  DEFINE_PARAMETERS(kLeft, kRight)
-  DECLARE_DESCRIPTOR(StringAddDescriptor, CallInterfaceDescriptor)
-};
-
 // This desciptor is shared among String.p.charAt/charCodeAt/codePointAt
 // as they all have the same interface.
 class StringAtDescriptor final : public CallInterfaceDescriptor {
  public:
   DEFINE_PARAMETERS(kReceiver, kPosition)
-  DECLARE_DESCRIPTOR_WITH_CUSTOM_FUNCTION_TYPE(StringAtDescriptor,
-                                               CallInterfaceDescriptor)
+  // TODO(turbofan): Return untagged value here.
+  DEFINE_RESULT_AND_PARAMETER_TYPES(MachineType::TaggedSigned(),  // result 1
+                                    MachineType::AnyTagged(),     // kReceiver
+                                    MachineType::IntPtr())        // kPosition
+  DECLARE_DESCRIPTOR(StringAtDescriptor, CallInterfaceDescriptor)
 };
 
 class StringSubstringDescriptor final : public CallInterfaceDescriptor {
  public:
   DEFINE_PARAMETERS(kString, kFrom, kTo)
-  DECLARE_DESCRIPTOR_WITH_CUSTOM_FUNCTION_TYPE(StringSubstringDescriptor,
-                                               CallInterfaceDescriptor)
+  DEFINE_PARAMETER_TYPES(MachineType::AnyTagged(),  // kString
+                         MachineType::IntPtr(),     // kFrom
+                         MachineType::IntPtr())     // kTo
+
+  // TODO(turbofan): Allow builtins to return untagged values.
+  DECLARE_DESCRIPTOR(StringSubstringDescriptor, CallInterfaceDescriptor)
 };
 
 class ArgumentAdaptorDescriptor : public CallInterfaceDescriptor {
  public:
-  DEFINE_PARAMETERS(kFunction, kNewTarget, kActualArgumentsCount,
-                    kExpectedArgumentsCount)
-  DECLARE_DESCRIPTOR_WITH_CUSTOM_FUNCTION_TYPE(ArgumentAdaptorDescriptor,
-                                               CallInterfaceDescriptor)
+  DEFINE_JS_PARAMETERS(kExpectedArgumentsCount)
+  DEFINE_JS_PARAMETER_TYPES(MachineType::Int32())
+  DECLARE_DESCRIPTOR(ArgumentAdaptorDescriptor, CallInterfaceDescriptor)
+};
+
+class CppBuiltinAdaptorDescriptor : public CallInterfaceDescriptor {
+ public:
+  DEFINE_JS_PARAMETERS(kCFunction)
+  DEFINE_JS_PARAMETER_TYPES(MachineType::Pointer())
+  DECLARE_JS_COMPATIBLE_DESCRIPTOR(CppBuiltinAdaptorDescriptor,
+                                   CallInterfaceDescriptor, 1)
+};
+
+class CEntry1ArgvOnStackDescriptor : public CallInterfaceDescriptor {
+ public:
+  DEFINE_PARAMETERS(kArity,          // register argument
+                    kCFunction,      // register argument
+                    kPadding,        // stack argument 1 (just padding)
+                    kArgcSmi,        // stack argument 2
+                    kTargetCopy,     // stack argument 3
+                    kNewTargetCopy)  // stack argument 4
+  DEFINE_PARAMETER_TYPES(MachineType::Int32(),      // kArity
+                         MachineType::Pointer(),    // kCFunction
+                         MachineType::AnyTagged(),  // kPadding
+                         MachineType::AnyTagged(),  // kArgcSmi
+                         MachineType::AnyTagged(),  // kTargetCopy
+                         MachineType::AnyTagged())  // kNewTargetCopy
+  DECLARE_DESCRIPTOR(CEntry1ArgvOnStackDescriptor, CallInterfaceDescriptor)
 };
 
 class ApiCallbackDescriptor : public CallInterfaceDescriptor {
  public:
-  DEFINE_PARAMETERS(kTargetContext, kCallData, kHolder, kApiFunctionAddress)
-  DECLARE_DESCRIPTOR_WITH_CUSTOM_FUNCTION_TYPE(ApiCallbackDescriptor,
-                                               CallInterfaceDescriptor)
+  DEFINE_PARAMETERS_NO_CONTEXT(kTargetContext, kCallData, kHolder,
+                               kApiFunctionAddress)
+  DEFINE_PARAMETER_TYPES(MachineType::AnyTagged(),  // kTargetContext
+                         MachineType::AnyTagged(),  // kCallData
+                         MachineType::AnyTagged(),  // kHolder
+                         MachineType::Pointer())    // kApiFunctionAddress
+  DECLARE_DESCRIPTOR(ApiCallbackDescriptor, CallInterfaceDescriptor)
 };
 
 class ApiGetterDescriptor : public CallInterfaceDescriptor {
  public:
   DEFINE_PARAMETERS(kReceiver, kHolder, kCallback)
+  DEFINE_PARAMETER_TYPES(MachineType::AnyTagged(),  // kReceiver
+                         MachineType::AnyTagged(),  // kHolder
+                         MachineType::AnyTagged())  // kCallback
   DECLARE_DESCRIPTOR(ApiGetterDescriptor, CallInterfaceDescriptor)
 
   static const Register ReceiverRegister();
@@ -799,26 +912,12 @@ class ApiGetterDescriptor : public CallInterfaceDescriptor {
   static const Register CallbackRegister();
 };
 
-class MathPowTaggedDescriptor : public CallInterfaceDescriptor {
- public:
-  DEFINE_PARAMETERS(kExponent)
-  DECLARE_DESCRIPTOR(MathPowTaggedDescriptor, CallInterfaceDescriptor)
-
-  static const Register exponent();
-};
-
-class MathPowIntegerDescriptor : public CallInterfaceDescriptor {
- public:
-  DEFINE_PARAMETERS(kExponent)
-  DECLARE_DESCRIPTOR(MathPowIntegerDescriptor, CallInterfaceDescriptor)
-
-  static const Register exponent();
-};
-
 // TODO(turbofan): We should probably rename this to GrowFastElementsDescriptor.
 class GrowArrayElementsDescriptor : public CallInterfaceDescriptor {
  public:
   DEFINE_PARAMETERS(kObject, kKey)
+  DEFINE_PARAMETER_TYPES(MachineType::AnyTagged(),  // kObject
+                         MachineType::AnyTagged())  // kKey
   DECLARE_DESCRIPTOR(GrowArrayElementsDescriptor, CallInterfaceDescriptor)
 
   static const Register ObjectRegister();
@@ -828,8 +927,10 @@ class GrowArrayElementsDescriptor : public CallInterfaceDescriptor {
 class NewArgumentsElementsDescriptor final : public CallInterfaceDescriptor {
  public:
   DEFINE_PARAMETERS(kFrame, kLength, kMappedCount)
-  DECLARE_DESCRIPTOR_WITH_CUSTOM_FUNCTION_TYPE(NewArgumentsElementsDescriptor,
-                                               CallInterfaceDescriptor)
+  DEFINE_PARAMETER_TYPES(MachineType::Pointer(),       // kFrame
+                         MachineType::TaggedSigned(),  // kLength
+                         MachineType::TaggedSigned())  // kMappedCount
+  DECLARE_DESCRIPTOR(NewArgumentsElementsDescriptor, CallInterfaceDescriptor)
 };
 
 class V8_EXPORT_PRIVATE InterpreterDispatchDescriptor
@@ -837,15 +938,21 @@ class V8_EXPORT_PRIVATE InterpreterDispatchDescriptor
  public:
   DEFINE_PARAMETERS(kAccumulator, kBytecodeOffset, kBytecodeArray,
                     kDispatchTable)
-  DECLARE_DESCRIPTOR_WITH_CUSTOM_FUNCTION_TYPE(InterpreterDispatchDescriptor,
-                                               CallInterfaceDescriptor)
+  DEFINE_PARAMETER_TYPES(MachineType::AnyTagged(),  // kAccumulator
+                         MachineType::IntPtr(),     // kBytecodeOffset
+                         MachineType::AnyTagged(),  // kBytecodeArray
+                         MachineType::IntPtr())     // kDispatchTable
+  DECLARE_DESCRIPTOR(InterpreterDispatchDescriptor, CallInterfaceDescriptor)
 };
 
 class InterpreterPushArgsThenCallDescriptor : public CallInterfaceDescriptor {
  public:
   DEFINE_PARAMETERS(kNumberOfArguments, kFirstArgument, kFunction)
-  DECLARE_DESCRIPTOR_WITH_CUSTOM_FUNCTION_TYPE(
-      InterpreterPushArgsThenCallDescriptor, CallInterfaceDescriptor)
+  DEFINE_PARAMETER_TYPES(MachineType::Int32(),      // kNumberOfArguments
+                         MachineType::Pointer(),    // kFirstArgument
+                         MachineType::AnyTagged())  // kFunction
+  DECLARE_DESCRIPTOR(InterpreterPushArgsThenCallDescriptor,
+                     CallInterfaceDescriptor)
 };
 
 class InterpreterPushArgsThenConstructDescriptor
@@ -853,47 +960,72 @@ class InterpreterPushArgsThenConstructDescriptor
  public:
   DEFINE_PARAMETERS(kNumberOfArguments, kNewTarget, kConstructor,
                     kFeedbackElement, kFirstArgument)
-  DECLARE_DESCRIPTOR_WITH_CUSTOM_FUNCTION_TYPE(
-      InterpreterPushArgsThenConstructDescriptor, CallInterfaceDescriptor)
+  DEFINE_PARAMETER_TYPES(MachineType::Int32(),      // kNumberOfArguments
+                         MachineType::AnyTagged(),  // kNewTarget
+                         MachineType::AnyTagged(),  // kConstructor
+                         MachineType::AnyTagged(),  // kFeedbackElement
+                         MachineType::Pointer())    // kFirstArgument
+  DECLARE_DESCRIPTOR(InterpreterPushArgsThenConstructDescriptor,
+                     CallInterfaceDescriptor)
+};
+
+class InterpreterCEntry1Descriptor : public CallInterfaceDescriptor {
+ public:
+  DEFINE_RESULT_AND_PARAMETERS(1, kNumberOfArguments, kFirstArgument,
+                               kFunctionEntry)
+  DEFINE_RESULT_AND_PARAMETER_TYPES(MachineType::AnyTagged(),  // result 1
+                                    MachineType::Int32(),  // kNumberOfArguments
+                                    MachineType::Pointer(),  // kFirstArgument
+                                    MachineType::Pointer())  // kFunctionEntry
+  DECLARE_DESCRIPTOR(InterpreterCEntry1Descriptor, CallInterfaceDescriptor)
 };
 
-class InterpreterCEntryDescriptor : public CallInterfaceDescriptor {
+class InterpreterCEntry2Descriptor : public CallInterfaceDescriptor {
  public:
-  DEFINE_PARAMETERS(kNumberOfArguments, kFirstArgument, kFunctionEntry)
-  DECLARE_DESCRIPTOR_WITH_CUSTOM_FUNCTION_TYPE(InterpreterCEntryDescriptor,
-                                               CallInterfaceDescriptor)
+  DEFINE_RESULT_AND_PARAMETERS(2, kNumberOfArguments, kFirstArgument,
+                               kFunctionEntry)
+  DEFINE_RESULT_AND_PARAMETER_TYPES(MachineType::AnyTagged(),  // result 1
+                                    MachineType::AnyTagged(),  // result 2
+                                    MachineType::Int32(),  // kNumberOfArguments
+                                    MachineType::Pointer(),  // kFirstArgument
+                                    MachineType::Pointer())  // kFunctionEntry
+  DECLARE_DESCRIPTOR(InterpreterCEntry2Descriptor, CallInterfaceDescriptor)
 };
 
 class ResumeGeneratorDescriptor final : public CallInterfaceDescriptor {
  public:
+  DEFINE_PARAMETERS(kValue, kGenerator)
+  DEFINE_PARAMETER_TYPES(MachineType::AnyTagged(),  // kValue
+                         MachineType::AnyTagged())  // kGenerator
   DECLARE_DESCRIPTOR(ResumeGeneratorDescriptor, CallInterfaceDescriptor)
 };
 
 class FrameDropperTrampolineDescriptor final : public CallInterfaceDescriptor {
-  DECLARE_DESCRIPTOR_WITH_CUSTOM_FUNCTION_TYPE(FrameDropperTrampolineDescriptor,
-                                               CallInterfaceDescriptor)
+ public:
+  DEFINE_PARAMETERS(kRestartFp)
+  DEFINE_PARAMETER_TYPES(MachineType::Pointer())
+  DECLARE_DESCRIPTOR(FrameDropperTrampolineDescriptor, CallInterfaceDescriptor)
 };
 
-class WasmRuntimeCallDescriptor final : public CallInterfaceDescriptor {
+class RunMicrotasksDescriptor final : public CallInterfaceDescriptor {
  public:
-  DEFINE_EMPTY_PARAMETERS()
-  DECLARE_DEFAULT_DESCRIPTOR(WasmRuntimeCallDescriptor, CallInterfaceDescriptor,
-                             0)
+  DEFINE_PARAMETERS()
+  DECLARE_DEFAULT_DESCRIPTOR(RunMicrotasksDescriptor, CallInterfaceDescriptor)
 };
 
-class RunMicrotasksDescriptor final : public CallInterfaceDescriptor {
+class WasmGrowMemoryDescriptor final : public CallInterfaceDescriptor {
  public:
-  DEFINE_EMPTY_PARAMETERS()
-  DECLARE_DEFAULT_DESCRIPTOR(RunMicrotasksDescriptor, CallInterfaceDescriptor,
-                             0)
+  DEFINE_PARAMETERS_NO_CONTEXT(kNumPages)
+  DEFINE_RESULT_AND_PARAMETER_TYPES(MachineType::Int32(),  // result 1
+                                    MachineType::Int32())  // kNumPages
+  DECLARE_DESCRIPTOR(WasmGrowMemoryDescriptor, CallInterfaceDescriptor)
 };
 
 #define DEFINE_TFS_BUILTIN_DESCRIPTOR(Name, ...)                          \
   class Name##Descriptor : public CallInterfaceDescriptor {               \
    public:                                                                \
     DEFINE_PARAMETERS(__VA_ARGS__)                                        \
-    DECLARE_DEFAULT_DESCRIPTOR(Name##Descriptor, CallInterfaceDescriptor, \
-                               kParameterCount)                           \
+    DECLARE_DEFAULT_DESCRIPTOR(Name##Descriptor, CallInterfaceDescriptor) \
   };
 BUILTIN_LIST_TFS(DEFINE_TFS_BUILTIN_DESCRIPTOR)
 #undef DEFINE_TFS_BUILTIN_DESCRIPTOR
@@ -901,9 +1033,15 @@ BUILTIN_LIST_TFS(DEFINE_TFS_BUILTIN_DESCRIPTOR)
 #undef DECLARE_DEFAULT_DESCRIPTOR
 #undef DECLARE_DESCRIPTOR_WITH_BASE
 #undef DECLARE_DESCRIPTOR
-#undef DECLARE_DESCRIPTOR_WITH_CUSTOM_FUNCTION_TYPE
-#undef DECLARE_DESCRIPTOR_WITH_BASE_AND_FUNCTION_TYPE_ARG
+#undef DECLARE_JS_COMPATIBLE_DESCRIPTOR
+#undef DEFINE_RESULT_AND_PARAMETERS
+#undef DEFINE_RESULT_AND_PARAMETERS_NO_CONTEXT
 #undef DEFINE_PARAMETERS
+#undef DEFINE_PARAMETERS_NO_CONTEXT
+#undef DEFINE_RESULT_AND_PARAMETER_TYPES
+#undef DEFINE_PARAMETER_TYPES
+#undef DEFINE_JS_PARAMETERS
+#undef DEFINE_JS_PARAMETER_TYPES
 
 // We define the association between CallDescriptors::Key and the specialized
 // descriptor here to reduce boilerplate and mistakes.
@@ -914,11 +1052,4 @@ INTERFACE_DESCRIPTOR_LIST(DEF_KEY)
 }  // namespace internal
 }  // namespace v8
 
-
-#if V8_TARGET_ARCH_ARM64
-#include "src/arm64/interface-descriptors-arm64.h"
-#elif V8_TARGET_ARCH_ARM
-#include "src/arm/interface-descriptors-arm.h"
-#endif
-
 #endif  // V8_INTERFACE_DESCRIPTORS_H_
diff --git a/deps/v8/src/interpreter/bytecode-array-accessor.cc b/deps/v8/src/interpreter/bytecode-array-accessor.cc
index 2a5923b2a48574..ef6bdd30a171f0 100644
--- a/deps/v8/src/interpreter/bytecode-array-accessor.cc
+++ b/deps/v8/src/interpreter/bytecode-array-accessor.cc
@@ -68,7 +68,7 @@ uint32_t BytecodeArrayAccessor::GetUnsignedOperand(
   DCHECK_EQ(operand_type,
             Bytecodes::GetOperandType(current_bytecode(), operand_index));
   DCHECK(Bytecodes::IsUnsignedOperandType(operand_type));
-  const uint8_t* operand_start =
+  Address operand_start =
       bytecode_array()->GetFirstBytecodeAddress() + bytecode_offset_ +
       current_prefix_offset() +
       Bytecodes::GetOperandOffset(current_bytecode(), operand_index,
@@ -84,7 +84,7 @@ int32_t BytecodeArrayAccessor::GetSignedOperand(
   DCHECK_EQ(operand_type,
             Bytecodes::GetOperandType(current_bytecode(), operand_index));
   DCHECK(!Bytecodes::IsUnsignedOperandType(operand_type));
-  const uint8_t* operand_start =
+  Address operand_start =
       bytecode_array()->GetFirstBytecodeAddress() + bytecode_offset_ +
       current_prefix_offset() +
       Bytecodes::GetOperandOffset(current_bytecode(), operand_index,
@@ -134,7 +134,7 @@ FeedbackSlot BytecodeArrayAccessor::GetSlotOperand(int operand_index) const {
 Register BytecodeArrayAccessor::GetRegisterOperand(int operand_index) const {
   OperandType operand_type =
       Bytecodes::GetOperandType(current_bytecode(), operand_index);
-  const uint8_t* operand_start =
+  Address operand_start =
       bytecode_array()->GetFirstBytecodeAddress() + bytecode_offset_ +
       current_prefix_offset() +
       Bytecodes::GetOperandOffset(current_bytecode(), operand_index,
@@ -184,12 +184,11 @@ Runtime::FunctionId BytecodeArrayAccessor::GetIntrinsicIdOperand(
       static_cast<IntrinsicsHelper::IntrinsicId>(raw_id));
 }
 
-Handle<Object> BytecodeArrayAccessor::GetConstantAtIndex(int index) const {
-  return FixedArray::get(bytecode_array()->constant_pool(), index,
-                         bytecode_array()->GetIsolate());
+Object* BytecodeArrayAccessor::GetConstantAtIndex(int index) const {
+  return bytecode_array()->constant_pool()->get(index);
 }
 
-Handle<Object> BytecodeArrayAccessor::GetConstantForIndexOperand(
+Object* BytecodeArrayAccessor::GetConstantForIndexOperand(
     int operand_index) const {
   return GetConstantAtIndex(GetIndexOperand(operand_index));
 }
@@ -203,7 +202,7 @@ int BytecodeArrayAccessor::GetJumpTargetOffset() const {
     }
     return GetAbsoluteOffset(relative_offset);
   } else if (interpreter::Bytecodes::IsJumpConstant(bytecode)) {
-    Smi* smi = Smi::cast(*GetConstantForIndexOperand(0));
+    Smi* smi = Smi::cast(GetConstantForIndexOperand(0));
     return GetAbsoluteOffset(smi->value());
   } else {
     UNREACHABLE();
@@ -237,9 +236,10 @@ bool BytecodeArrayAccessor::OffsetWithinBytecode(int offset) const {
 }
 
 std::ostream& BytecodeArrayAccessor::PrintTo(std::ostream& os) const {
-  return BytecodeDecoder::Decode(
-      os, bytecode_array()->GetFirstBytecodeAddress() + bytecode_offset_,
-      bytecode_array()->parameter_count());
+  const uint8_t* bytecode_addr = reinterpret_cast<const uint8_t*>(
+      bytecode_array()->GetFirstBytecodeAddress() + bytecode_offset_);
+  return BytecodeDecoder::Decode(os, bytecode_addr,
+                                 bytecode_array()->parameter_count());
 }
 
 JumpTableTargetOffsets::JumpTableTargetOffsets(
@@ -272,6 +272,7 @@ JumpTableTargetOffsets::iterator::iterator(
     int case_value, int table_offset, int table_end,
     const BytecodeArrayAccessor* accessor)
     : accessor_(accessor),
+      current_(Smi::kZero),
       index_(case_value),
       table_offset_(table_offset),
       table_end_(table_end) {
@@ -280,8 +281,7 @@ JumpTableTargetOffsets::iterator::iterator(
 
 JumpTableTargetOffset JumpTableTargetOffsets::iterator::operator*() {
   DCHECK_LT(table_offset_, table_end_);
-  DCHECK(current_->IsSmi());
-  return {index_, accessor_->GetAbsoluteOffset(Smi::ToInt(*current_))};
+  return {index_, accessor_->GetAbsoluteOffset(Smi::ToInt(current_))};
 }
 
 JumpTableTargetOffsets::iterator& JumpTableTargetOffsets::iterator::
@@ -304,13 +304,17 @@ bool JumpTableTargetOffsets::iterator::operator!=(
 void JumpTableTargetOffsets::iterator::UpdateAndAdvanceToValid() {
   if (table_offset_ >= table_end_) return;
 
-  current_ = accessor_->GetConstantAtIndex(table_offset_);
-  Isolate* isolate = accessor_->bytecode_array()->GetIsolate();
-  while (current_->IsTheHole(isolate)) {
+  Object* current = accessor_->GetConstantAtIndex(table_offset_);
+  while (!current->IsSmi()) {
+    DCHECK(current->IsTheHole());
     ++table_offset_;
     ++index_;
     if (table_offset_ >= table_end_) break;
-    current_ = accessor_->GetConstantAtIndex(table_offset_);
+    current = accessor_->GetConstantAtIndex(table_offset_);
+  }
+  // Make sure we haven't reached the end of the table with a hole in current.
+  if (current->IsSmi()) {
+    current_ = Smi::cast(current);
   }
 }
 
diff --git a/deps/v8/src/interpreter/bytecode-array-accessor.h b/deps/v8/src/interpreter/bytecode-array-accessor.h
index f31d2d0e7f26bd..443929aefe075a 100644
--- a/deps/v8/src/interpreter/bytecode-array-accessor.h
+++ b/deps/v8/src/interpreter/bytecode-array-accessor.h
@@ -42,7 +42,7 @@ class V8_EXPORT_PRIVATE JumpTableTargetOffsets final {
     void UpdateAndAdvanceToValid();
 
     const BytecodeArrayAccessor* accessor_;
-    Handle<Object> current_;
+    Smi* current_;
     int index_;
     int table_offset_;
     int table_end_;
@@ -90,8 +90,8 @@ class V8_EXPORT_PRIVATE BytecodeArrayAccessor {
   Runtime::FunctionId GetRuntimeIdOperand(int operand_index) const;
   Runtime::FunctionId GetIntrinsicIdOperand(int operand_index) const;
   uint32_t GetNativeContextIndexOperand(int operand_index) const;
-  Handle<Object> GetConstantAtIndex(int offset) const;
-  Handle<Object> GetConstantForIndexOperand(int operand_index) const;
+  Object* GetConstantAtIndex(int offset) const;
+  Object* GetConstantForIndexOperand(int operand_index) const;
 
   // Returns the absolute offset of the branch target at the current bytecode.
   // It is an error to call this method if the bytecode is not for a jump or
diff --git a/deps/v8/src/interpreter/bytecode-array-builder.cc b/deps/v8/src/interpreter/bytecode-array-builder.cc
index 0558f45acf23a5..b0162c77ad4646 100644
--- a/deps/v8/src/interpreter/bytecode-array-builder.cc
+++ b/deps/v8/src/interpreter/bytecode-array-builder.cc
@@ -176,12 +176,13 @@ namespace {
 template <OperandTypeInfo type_info>
 class UnsignedOperandHelper {
  public:
-  INLINE(static uint32_t Convert(BytecodeArrayBuilder* builder, size_t value)) {
+  V8_INLINE static uint32_t Convert(BytecodeArrayBuilder* builder,
+                                    size_t value) {
     DCHECK(IsValid(value));
     return static_cast<uint32_t>(value);
   }
 
-  INLINE(static uint32_t Convert(BytecodeArrayBuilder* builder, int value)) {
+  V8_INLINE static uint32_t Convert(BytecodeArrayBuilder* builder, int value) {
     DCHECK_GE(value, 0);
     return Convert(builder, static_cast<size_t>(value));
   }
@@ -215,7 +216,7 @@ UNSIGNED_SCALABLE_SCALAR_OPERAND_TYPE_LIST(DEFINE_UNSIGNED_OPERAND_HELPER)
 template <>
 class OperandHelper<OperandType::kImm> {
  public:
-  INLINE(static uint32_t Convert(BytecodeArrayBuilder* builder, int value)) {
+  V8_INLINE static uint32_t Convert(BytecodeArrayBuilder* builder, int value) {
     return static_cast<uint32_t>(value);
   }
 };
@@ -223,7 +224,8 @@ class OperandHelper<OperandType::kImm> {
 template <>
 class OperandHelper<OperandType::kReg> {
  public:
-  INLINE(static uint32_t Convert(BytecodeArrayBuilder* builder, Register reg)) {
+  V8_INLINE static uint32_t Convert(BytecodeArrayBuilder* builder,
+                                    Register reg) {
     return builder->GetInputRegisterOperand(reg);
   }
 };
@@ -231,8 +233,8 @@ class OperandHelper<OperandType::kReg> {
 template <>
 class OperandHelper<OperandType::kRegList> {
  public:
-  INLINE(static uint32_t Convert(BytecodeArrayBuilder* builder,
-                                 RegisterList reg_list)) {
+  V8_INLINE static uint32_t Convert(BytecodeArrayBuilder* builder,
+                                    RegisterList reg_list) {
     return builder->GetInputRegisterListOperand(reg_list);
   }
 };
@@ -240,8 +242,8 @@ class OperandHelper<OperandType::kRegList> {
 template <>
 class OperandHelper<OperandType::kRegPair> {
  public:
-  INLINE(static uint32_t Convert(BytecodeArrayBuilder* builder,
-                                 RegisterList reg_list)) {
+  V8_INLINE static uint32_t Convert(BytecodeArrayBuilder* builder,
+                                    RegisterList reg_list) {
     DCHECK_EQ(reg_list.register_count(), 2);
     return builder->GetInputRegisterListOperand(reg_list);
   }
@@ -250,7 +252,8 @@ class OperandHelper<OperandType::kRegPair> {
 template <>
 class OperandHelper<OperandType::kRegOut> {
  public:
-  INLINE(static uint32_t Convert(BytecodeArrayBuilder* builder, Register reg)) {
+  V8_INLINE static uint32_t Convert(BytecodeArrayBuilder* builder,
+                                    Register reg) {
     return builder->GetOutputRegisterOperand(reg);
   }
 };
@@ -258,8 +261,8 @@ class OperandHelper<OperandType::kRegOut> {
 template <>
 class OperandHelper<OperandType::kRegOutList> {
  public:
-  INLINE(static uint32_t Convert(BytecodeArrayBuilder* builder,
-                                 RegisterList reg_list)) {
+  V8_INLINE static uint32_t Convert(BytecodeArrayBuilder* builder,
+                                    RegisterList reg_list) {
     return builder->GetOutputRegisterListOperand(reg_list);
   }
 };
@@ -267,8 +270,8 @@ class OperandHelper<OperandType::kRegOutList> {
 template <>
 class OperandHelper<OperandType::kRegOutPair> {
  public:
-  INLINE(static uint32_t Convert(BytecodeArrayBuilder* builder,
-                                 RegisterList reg_list)) {
+  V8_INLINE static uint32_t Convert(BytecodeArrayBuilder* builder,
+                                    RegisterList reg_list) {
     DCHECK_EQ(2, reg_list.register_count());
     return builder->GetOutputRegisterListOperand(reg_list);
   }
@@ -277,8 +280,8 @@ class OperandHelper<OperandType::kRegOutPair> {
 template <>
 class OperandHelper<OperandType::kRegOutTriple> {
  public:
-  INLINE(static uint32_t Convert(BytecodeArrayBuilder* builder,
-                                 RegisterList reg_list)) {
+  V8_INLINE static uint32_t Convert(BytecodeArrayBuilder* builder,
+                                    RegisterList reg_list) {
     DCHECK_EQ(3, reg_list.register_count());
     return builder->GetOutputRegisterListOperand(reg_list);
   }
@@ -291,8 +294,8 @@ template <Bytecode bytecode, AccumulatorUse accumulator_use,
 class BytecodeNodeBuilder {
  public:
   template <typename... Operands>
-  INLINE(static BytecodeNode Make(BytecodeArrayBuilder* builder,
-                                  Operands... operands)) {
+  V8_INLINE static BytecodeNode Make(BytecodeArrayBuilder* builder,
+                                     Operands... operands) {
     static_assert(sizeof...(Operands) <= Bytecodes::kMaxOperands,
                   "too many operands for bytecode");
     builder->PrepareToOutputBytecode<bytecode, accumulator_use>();
@@ -511,9 +514,6 @@ BytecodeArrayBuilder& BytecodeArrayBuilder::CompareOperation(
 BytecodeArrayBuilder& BytecodeArrayBuilder::CompareOperation(Token::Value op,
                                                              Register reg) {
   switch (op) {
-    case Token::Value::EQ_STRICT:
-      OutputTestEqualStrictNoFeedback(reg);
-      break;
     case Token::Value::IN:
       OutputTestIn(reg);
       break;
@@ -523,6 +523,11 @@ BytecodeArrayBuilder& BytecodeArrayBuilder::CompareOperation(Token::Value op,
   return *this;
 }
 
+BytecodeArrayBuilder& BytecodeArrayBuilder::CompareReference(Register reg) {
+  OutputTestReferenceEqual(reg);
+  return *this;
+}
+
 BytecodeArrayBuilder& BytecodeArrayBuilder::CompareUndetectable() {
   OutputTestUndetectable();
   return *this;
@@ -904,20 +909,23 @@ BytecodeArrayBuilder& BytecodeArrayBuilder::CreateBlockContext(
 }
 
 BytecodeArrayBuilder& BytecodeArrayBuilder::CreateCatchContext(
-    Register exception, const AstRawString* name, const Scope* scope) {
-  size_t name_index = GetConstantPoolEntry(name);
+    Register exception, const Scope* scope) {
   size_t scope_index = GetConstantPoolEntry(scope);
-  OutputCreateCatchContext(exception, name_index, scope_index);
+  OutputCreateCatchContext(exception, scope_index);
   return *this;
 }
 
-BytecodeArrayBuilder& BytecodeArrayBuilder::CreateFunctionContext(int slots) {
-  OutputCreateFunctionContext(slots);
+BytecodeArrayBuilder& BytecodeArrayBuilder::CreateFunctionContext(
+    const Scope* scope, int slots) {
+  size_t scope_index = GetConstantPoolEntry(scope);
+  OutputCreateFunctionContext(scope_index, slots);
   return *this;
 }
 
-BytecodeArrayBuilder& BytecodeArrayBuilder::CreateEvalContext(int slots) {
-  OutputCreateEvalContext(slots);
+BytecodeArrayBuilder& BytecodeArrayBuilder::CreateEvalContext(
+    const Scope* scope, int slots) {
+  size_t scope_index = GetConstantPoolEntry(scope);
+  OutputCreateEvalContext(scope_index, slots);
   return *this;
 }
 
diff --git a/deps/v8/src/interpreter/bytecode-array-builder.h b/deps/v8/src/interpreter/bytecode-array-builder.h
index a22462d1fac823..f34f6f3a7d8537 100644
--- a/deps/v8/src/interpreter/bytecode-array-builder.h
+++ b/deps/v8/src/interpreter/bytecode-array-builder.h
@@ -208,24 +208,21 @@ class V8_EXPORT_PRIVATE BytecodeArrayBuilder final {
   BytecodeArrayBuilder& CreateClosure(size_t shared_function_info_entry,
                                       int slot, int flags);
 
-  // Create a new local context for a |scope| and a closure which should be
-  // in the accumulator.
+  // Create a new local context for a |scope|.
   BytecodeArrayBuilder& CreateBlockContext(const Scope* scope);
 
-  // Create a new context for a catch block with |exception|, |name|,
-  // |scope|, and the closure in the accumulator.
+  // Create a new context for a catch block with |exception| and |scope|.
   BytecodeArrayBuilder& CreateCatchContext(Register exception,
-                                           const AstRawString* name,
                                            const Scope* scope);
 
-  // Create a new context with size |slots|.
-  BytecodeArrayBuilder& CreateFunctionContext(int slots);
+  // Create a new context with the given |scope| and size |slots|.
+  BytecodeArrayBuilder& CreateFunctionContext(const Scope* scope, int slots);
 
-  // Create a new eval context with size |slots|.
-  BytecodeArrayBuilder& CreateEvalContext(int slots);
+  // Create a new eval context with the given |scope| and size |slots|.
+  BytecodeArrayBuilder& CreateEvalContext(const Scope* scope, int slots);
 
   // Creates a new context with the given |scope| for a with-statement
-  // with the |object| in a register and the closure in the accumulator.
+  // with the |object| in a register.
   BytecodeArrayBuilder& CreateWithContext(Register object, const Scope* scope);
 
   // Create a new arguments object in the accumulator.
@@ -366,6 +363,7 @@ class V8_EXPORT_PRIVATE BytecodeArrayBuilder final {
   BytecodeArrayBuilder& CompareOperation(Token::Value op, Register reg,
                                          int feedback_slot);
   BytecodeArrayBuilder& CompareOperation(Token::Value op, Register reg);
+  BytecodeArrayBuilder& CompareReference(Register reg);
   BytecodeArrayBuilder& CompareUndetectable();
   BytecodeArrayBuilder& CompareUndefined();
   BytecodeArrayBuilder& CompareNull();
@@ -539,19 +537,19 @@ class V8_EXPORT_PRIVATE BytecodeArrayBuilder final {
   }
 
   // Returns the current source position for the given |bytecode|.
-  INLINE(BytecodeSourceInfo CurrentSourcePosition(Bytecode bytecode));
-
-#define DECLARE_BYTECODE_OUTPUT(Name, ...)                       \
-  template <typename... Operands>                                \
-  INLINE(BytecodeNode Create##Name##Node(Operands... operands)); \
-  template <typename... Operands>                                \
-  INLINE(void Output##Name(Operands... operands));               \
-  template <typename... Operands>                                \
-  INLINE(void Output##Name(BytecodeLabel* label, Operands... operands));
+  V8_INLINE BytecodeSourceInfo CurrentSourcePosition(Bytecode bytecode);
+
+#define DECLARE_BYTECODE_OUTPUT(Name, ...)                         \
+  template <typename... Operands>                                  \
+  V8_INLINE BytecodeNode Create##Name##Node(Operands... operands); \
+  template <typename... Operands>                                  \
+  V8_INLINE void Output##Name(Operands... operands);               \
+  template <typename... Operands>                                  \
+  V8_INLINE void Output##Name(BytecodeLabel* label, Operands... operands);
   BYTECODE_LIST(DECLARE_BYTECODE_OUTPUT)
 #undef DECLARE_OPERAND_TYPE_INFO
 
-  INLINE(void OutputSwitchOnSmiNoFeedback(BytecodeJumpTable* jump_table));
+  V8_INLINE void OutputSwitchOnSmiNoFeedback(BytecodeJumpTable* jump_table);
 
   bool RegisterIsValid(Register reg) const;
   bool RegisterListIsValid(RegisterList reg_list) const;
diff --git a/deps/v8/src/interpreter/bytecode-array-writer.cc b/deps/v8/src/interpreter/bytecode-array-writer.cc
index 81f49baeeac7b4..b44f726e929df1 100644
--- a/deps/v8/src/interpreter/bytecode-array-writer.cc
+++ b/deps/v8/src/interpreter/bytecode-array-writer.cc
@@ -304,7 +304,8 @@ void BytecodeArrayWriter::PatchJumpWith16BitOperand(size_t jump_location,
     // The jump fits within the range of an Imm16 operand, so cancel
     // the reservation and jump directly.
     constant_array_builder()->DiscardReservedEntry(OperandSize::kShort);
-    WriteUnalignedUInt16(operand_bytes, static_cast<uint16_t>(delta));
+    WriteUnalignedUInt16(reinterpret_cast<Address>(operand_bytes),
+                         static_cast<uint16_t>(delta));
   } else {
     // The jump does not fit within the range of an Imm16 operand, so
     // commit reservation putting the offset into the constant pool,
@@ -313,7 +314,8 @@ void BytecodeArrayWriter::PatchJumpWith16BitOperand(size_t jump_location,
         OperandSize::kShort, Smi::FromInt(delta));
     jump_bytecode = GetJumpWithConstantOperand(jump_bytecode);
     bytecodes()->at(jump_location) = Bytecodes::ToByte(jump_bytecode);
-    WriteUnalignedUInt16(operand_bytes, static_cast<uint16_t>(entry));
+    WriteUnalignedUInt16(reinterpret_cast<Address>(operand_bytes),
+                         static_cast<uint16_t>(entry));
   }
   DCHECK(bytecodes()->at(operand_location) == k8BitJumpPlaceholder &&
          bytecodes()->at(operand_location + 1) == k8BitJumpPlaceholder);
@@ -327,7 +329,8 @@ void BytecodeArrayWriter::PatchJumpWith32BitOperand(size_t jump_location,
       Bytecodes::FromByte(bytecodes()->at(jump_location))));
   constant_array_builder()->DiscardReservedEntry(OperandSize::kQuad);
   uint8_t operand_bytes[4];
-  WriteUnalignedUInt32(operand_bytes, static_cast<uint32_t>(delta));
+  WriteUnalignedUInt32(reinterpret_cast<Address>(operand_bytes),
+                       static_cast<uint32_t>(delta));
   size_t operand_location = jump_location + 1;
   DCHECK(bytecodes()->at(operand_location) == k8BitJumpPlaceholder &&
          bytecodes()->at(operand_location + 1) == k8BitJumpPlaceholder &&
diff --git a/deps/v8/src/interpreter/bytecode-decoder.cc b/deps/v8/src/interpreter/bytecode-decoder.cc
index fb2ae376eab185..e684eb410b6d54 100644
--- a/deps/v8/src/interpreter/bytecode-decoder.cc
+++ b/deps/v8/src/interpreter/bytecode-decoder.cc
@@ -15,7 +15,7 @@ namespace internal {
 namespace interpreter {
 
 // static
-Register BytecodeDecoder::DecodeRegisterOperand(const uint8_t* operand_start,
+Register BytecodeDecoder::DecodeRegisterOperand(Address operand_start,
                                                 OperandType operand_type,
                                                 OperandScale operand_scale) {
   DCHECK(Bytecodes::IsRegisterOperandType(operand_type));
@@ -26,7 +26,7 @@ Register BytecodeDecoder::DecodeRegisterOperand(const uint8_t* operand_start,
 
 // static
 RegisterList BytecodeDecoder::DecodeRegisterListOperand(
-    const uint8_t* operand_start, uint32_t count, OperandType operand_type,
+    Address operand_start, uint32_t count, OperandType operand_type,
     OperandScale operand_scale) {
   Register first_reg =
       DecodeRegisterOperand(operand_start, operand_type, operand_scale);
@@ -34,13 +34,13 @@ RegisterList BytecodeDecoder::DecodeRegisterListOperand(
 }
 
 // static
-int32_t BytecodeDecoder::DecodeSignedOperand(const uint8_t* operand_start,
+int32_t BytecodeDecoder::DecodeSignedOperand(Address operand_start,
                                              OperandType operand_type,
                                              OperandScale operand_scale) {
   DCHECK(!Bytecodes::IsUnsignedOperandType(operand_type));
   switch (Bytecodes::SizeOfOperand(operand_type, operand_scale)) {
     case OperandSize::kByte:
-      return static_cast<int8_t>(*operand_start);
+      return *reinterpret_cast<const int8_t*>(operand_start);
     case OperandSize::kShort:
       return static_cast<int16_t>(ReadUnalignedUInt16(operand_start));
     case OperandSize::kQuad:
@@ -52,13 +52,13 @@ int32_t BytecodeDecoder::DecodeSignedOperand(const uint8_t* operand_start,
 }
 
 // static
-uint32_t BytecodeDecoder::DecodeUnsignedOperand(const uint8_t* operand_start,
+uint32_t BytecodeDecoder::DecodeUnsignedOperand(Address operand_start,
                                                 OperandType operand_type,
                                                 OperandScale operand_scale) {
   DCHECK(Bytecodes::IsUnsignedOperandType(operand_type));
   switch (Bytecodes::SizeOfOperand(operand_type, operand_scale)) {
     case OperandSize::kByte:
-      return *operand_start;
+      return *reinterpret_cast<const uint8_t*>(operand_start);
     case OperandSize::kShort:
       return ReadUnalignedUInt16(operand_start);
     case OperandSize::kQuad:
@@ -139,8 +139,8 @@ std::ostream& BytecodeDecoder::Decode(std::ostream& os,
     OperandType op_type = Bytecodes::GetOperandType(bytecode, i);
     int operand_offset =
         Bytecodes::GetOperandOffset(bytecode, i, operand_scale);
-    const uint8_t* operand_start =
-        &bytecode_start[prefix_offset + operand_offset];
+    Address operand_start = reinterpret_cast<Address>(
+        &bytecode_start[prefix_offset + operand_offset]);
     switch (op_type) {
       case interpreter::OperandType::kIdx:
       case interpreter::OperandType::kUImm:
@@ -201,8 +201,8 @@ std::ostream& BytecodeDecoder::Decode(std::ostream& os,
                   OperandType::kRegCount);
         int reg_count_offset =
             Bytecodes::GetOperandOffset(bytecode, i + 1, operand_scale);
-        const uint8_t* reg_count_operand =
-            &bytecode_start[prefix_offset + reg_count_offset];
+        Address reg_count_operand = reinterpret_cast<Address>(
+            &bytecode_start[prefix_offset + reg_count_offset]);
         uint32_t count = DecodeUnsignedOperand(
             reg_count_operand, OperandType::kRegCount, operand_scale);
         RegisterList reg_list = DecodeRegisterListOperand(
diff --git a/deps/v8/src/interpreter/bytecode-decoder.h b/deps/v8/src/interpreter/bytecode-decoder.h
index 51d0e41ff7f429..49ede542d2b6a3 100644
--- a/deps/v8/src/interpreter/bytecode-decoder.h
+++ b/deps/v8/src/interpreter/bytecode-decoder.h
@@ -18,23 +18,23 @@ namespace interpreter {
 class V8_EXPORT_PRIVATE BytecodeDecoder final {
  public:
   // Decodes a register operand in a byte array.
-  static Register DecodeRegisterOperand(const uint8_t* operand_start,
+  static Register DecodeRegisterOperand(Address operand_start,
                                         OperandType operand_type,
                                         OperandScale operand_scale);
 
   // Decodes a register list operand in a byte array.
-  static RegisterList DecodeRegisterListOperand(const uint8_t* operand_start,
+  static RegisterList DecodeRegisterListOperand(Address operand_start,
                                                 uint32_t count,
                                                 OperandType operand_type,
                                                 OperandScale operand_scale);
 
   // Decodes a signed operand in a byte array.
-  static int32_t DecodeSignedOperand(const uint8_t* operand_start,
+  static int32_t DecodeSignedOperand(Address operand_start,
                                      OperandType operand_type,
                                      OperandScale operand_scale);
 
   // Decodes an unsigned operand in a byte array.
-  static uint32_t DecodeUnsignedOperand(const uint8_t* operand_start,
+  static uint32_t DecodeUnsignedOperand(Address operand_start,
                                         OperandType operand_type,
                                         OperandScale operand_scale);
 
diff --git a/deps/v8/src/interpreter/bytecode-generator.cc b/deps/v8/src/interpreter/bytecode-generator.cc
index 744c6614f7a2ec..79792a3d56180a 100644
--- a/deps/v8/src/interpreter/bytecode-generator.cc
+++ b/deps/v8/src/interpreter/bytecode-generator.cc
@@ -6,7 +6,6 @@
 
 #include "src/api.h"
 #include "src/ast/ast-source-ranges.h"
-#include "src/ast/compile-time-value.h"
 #include "src/ast/scopes.h"
 #include "src/builtins/builtins-constructor.h"
 #include "src/code-stubs.h"
@@ -235,7 +234,7 @@ class BytecodeGenerator::ControlScope::DeferredCommands final {
 
       builder()
           ->LoadLiteral(Smi::FromInt(entry.token))
-          .CompareOperation(Token::EQ_STRICT, token_register_)
+          .CompareReference(token_register_)
           .JumpIfFalse(ToBooleanMode::kAlreadyBoolean, &fall_through);
 
       if (CommandUsesAccumulator(entry.command)) {
@@ -734,7 +733,7 @@ class BytecodeGenerator::GlobalDeclarationsBuilder final : public ZoneObject {
       data->set(array_index++, Smi::FromInt(declaration.slot.ToInt()));
       Object* undefined_or_literal_slot;
       if (declaration.literal_slot.IsInvalid()) {
-        undefined_or_literal_slot = isolate->heap()->undefined_value();
+        undefined_or_literal_slot = ReadOnlyRoots(isolate).undefined_value();
       } else {
         undefined_or_literal_slot =
             Smi::FromInt(declaration.literal_slot.ToInt());
@@ -807,30 +806,40 @@ class BytecodeGenerator::FeedbackSlotCache : public ZoneObject {
   explicit FeedbackSlotCache(Zone* zone) : map_(zone) {}
 
   void Put(FeedbackSlotKind slot_kind, Variable* variable, FeedbackSlot slot) {
-    PutImpl(slot_kind, variable, slot);
+    PutImpl(slot_kind, 0, variable, slot);
   }
   void Put(FeedbackSlotKind slot_kind, AstNode* node, FeedbackSlot slot) {
-    PutImpl(slot_kind, node, slot);
+    PutImpl(slot_kind, 0, node, slot);
+  }
+  void Put(FeedbackSlotKind slot_kind, int variable_index,
+           const AstRawString* name, FeedbackSlot slot) {
+    PutImpl(slot_kind, variable_index, name, slot);
   }
 
   FeedbackSlot Get(FeedbackSlotKind slot_kind, Variable* variable) const {
-    return GetImpl(slot_kind, variable);
+    return GetImpl(slot_kind, 0, variable);
   }
   FeedbackSlot Get(FeedbackSlotKind slot_kind, AstNode* node) const {
-    return GetImpl(slot_kind, node);
+    return GetImpl(slot_kind, 0, node);
+  }
+  FeedbackSlot Get(FeedbackSlotKind slot_kind, int variable_index,
+                   const AstRawString* name) const {
+    return GetImpl(slot_kind, variable_index, name);
   }
 
  private:
-  typedef std::pair<FeedbackSlotKind, void*> Key;
+  typedef std::tuple<FeedbackSlotKind, int, const void*> Key;
 
-  void PutImpl(FeedbackSlotKind slot_kind, void* node, FeedbackSlot slot) {
-    Key key = std::make_pair(slot_kind, node);
+  void PutImpl(FeedbackSlotKind slot_kind, int index, const void* node,
+               FeedbackSlot slot) {
+    Key key = std::make_tuple(slot_kind, index, node);
     auto entry = std::make_pair(key, slot);
     map_.insert(entry);
   }
 
-  FeedbackSlot GetImpl(FeedbackSlotKind slot_kind, void* node) const {
-    Key key = std::make_pair(slot_kind, node);
+  FeedbackSlot GetImpl(FeedbackSlotKind slot_kind, int index,
+                       const void* node) const {
+    Key key = std::make_tuple(slot_kind, index, node);
     auto iter = map_.find(key);
     if (iter != map_.end()) {
       return iter->second;
@@ -899,6 +908,7 @@ BytecodeGenerator::BytecodeGenerator(
       execution_context_(nullptr),
       execution_result_(nullptr),
       incoming_new_target_or_generator_(),
+      dummy_feedback_slot_(),
       generator_jump_table_(nullptr),
       suspend_count_(0),
       loop_depth_(0),
@@ -980,8 +990,8 @@ void BytecodeGenerator::AllocateDeferredConstants(Isolate* isolate,
     if (object_literal->properties_count() > 0) {
       // If constant properties is an empty fixed array, we've already added it
       // to the constant pool when visiting the object literal.
-      Handle<BoilerplateDescription> constant_properties =
-          object_literal->GetOrBuildConstantProperties(isolate);
+      Handle<ObjectBoilerplateDescription> constant_properties =
+          object_literal->GetOrBuildBoilerplateDescription(isolate);
 
       builder()->SetDeferredConstantPoolEntry(literal.second,
                                               constant_properties);
@@ -991,8 +1001,8 @@ void BytecodeGenerator::AllocateDeferredConstants(Isolate* isolate,
   // Build array literal constant elements
   for (std::pair<ArrayLiteral*, size_t> literal : array_literals_) {
     ArrayLiteral* array_literal = literal.first;
-    Handle<ConstantElementsPair> constant_elements =
-        array_literal->GetOrBuildConstantElements(isolate);
+    Handle<ArrayBoilerplateDescription> constant_elements =
+        array_literal->GetOrBuildBoilerplateDescription(isolate);
     builder()->SetDeferredConstantPoolEntry(literal.second, constant_elements);
   }
 
@@ -1201,7 +1211,7 @@ void BytecodeGenerator::VisitVariableDeclaration(VariableDeclaration* decl) {
       }
       break;
     case VariableLocation::LOOKUP: {
-      DCHECK_EQ(VAR, variable->mode());
+      DCHECK_EQ(VariableMode::kVar, variable->mode());
       DCHECK(!variable->binding_needs_init());
 
       Register name = register_allocator()->NewRegister();
@@ -1224,7 +1234,8 @@ void BytecodeGenerator::VisitVariableDeclaration(VariableDeclaration* decl) {
 
 void BytecodeGenerator::VisitFunctionDeclaration(FunctionDeclaration* decl) {
   Variable* variable = decl->proxy()->var();
-  DCHECK(variable->mode() == LET || variable->mode() == VAR);
+  DCHECK(variable->mode() == VariableMode::kLet ||
+         variable->mode() == VariableMode::kVar);
   switch (variable->location()) {
     case VariableLocation::UNALLOCATED: {
       FeedbackSlot slot =
@@ -1259,7 +1270,7 @@ void BytecodeGenerator::VisitFunctionDeclaration(FunctionDeclaration* decl) {
       break;
     }
     case VariableLocation::MODULE:
-      DCHECK_EQ(variable->mode(), LET);
+      DCHECK_EQ(variable->mode(), VariableMode::kLet);
       DCHECK(variable->IsExport());
       VisitForAccumulatorValue(decl->fun());
       BuildVariableAssignment(variable, Token::INIT, HoleCheckMode::kElided);
@@ -1316,7 +1327,7 @@ void BytecodeGenerator::VisitDeclarations(Declaration::List* declarations) {
   globals_builder_ = new (zone()) GlobalDeclarationsBuilder(zone());
 }
 
-void BytecodeGenerator::VisitStatements(ZoneList<Statement*>* statements) {
+void BytecodeGenerator::VisitStatements(ZonePtrList<Statement>* statements) {
   for (int i = 0; i < statements->length(); i++) {
     // Allocate an outer register allocations scope for the statement.
     RegisterAllocationScope allocation_scope(this);
@@ -1405,7 +1416,7 @@ void BytecodeGenerator::VisitWithStatement(WithStatement* stmt) {
 void BytecodeGenerator::VisitSwitchStatement(SwitchStatement* stmt) {
   // We need this scope because we visit for register values. We have to
   // maintain a execution result scope where registers can be allocated.
-  ZoneList<CaseClause*>* clauses = stmt->cases();
+  ZonePtrList<CaseClause>* clauses = stmt->cases();
   SwitchBuilder switch_builder(builder(), block_coverage_builder_, stmt,
                                clauses->length());
   ControlScopeForBreakable scope(this, stmt, &switch_builder);
@@ -1552,7 +1563,7 @@ void BytecodeGenerator::VisitForInAssignment(Expression* expr) {
       const AstRawString* name =
           property->key()->AsLiteral()->AsRawPropertyName();
       builder()->LoadAccumulatorWithRegister(value);
-      FeedbackSlot slot = feedback_spec()->AddStoreICSlot(language_mode());
+      FeedbackSlot slot = GetCachedStoreICSlot(property->obj(), name);
       builder()->StoreNamedProperty(object, name, feedback_index(slot),
                                     language_mode());
       builder()->LoadAccumulatorWithRegister(value);
@@ -1846,10 +1857,13 @@ void BytecodeGenerator::BuildClassLiteral(ClassLiteral* expr) {
           // computed property name case in the parser. Since this is the only
           // case where we need to check for an own read only property we
           // special case this so we do not need to do this for every property.
+
+          FeedbackSlot slot = GetDummyCompareICSlot();
           BytecodeLabel done;
           builder()
               ->LoadLiteral(ast_string_constants()->prototype_string())
-              .CompareOperation(Token::Value::EQ_STRICT, key)
+              .CompareOperation(Token::Value::EQ_STRICT, key,
+                                feedback_index(slot))
               .JumpIfFalse(ToBooleanMode::kAlreadyBoolean, &done)
               .CallRuntime(Runtime::kThrowStaticPrototypeError)
               .Bind(&done);
@@ -2104,7 +2118,7 @@ void BytecodeGenerator::VisitObjectLiteral(ObjectLiteral* expr) {
   // If constant properties is an empty fixed array, use a cached empty fixed
   // array to ensure it's only added to the constant pool once.
   if (expr->properties_count() == 0) {
-    entry = builder()->EmptyBoilerplateDescriptionConstantPoolEntry();
+    entry = builder()->EmptyObjectBoilerplateDescriptionConstantPoolEntry();
   } else {
     entry = builder()->AllocateDeferredConstantPoolEntry();
     object_literals_.push_back(std::make_pair(expr, entry));
@@ -2129,7 +2143,7 @@ void BytecodeGenerator::VisitObjectLiteral(ObjectLiteral* expr) {
       case ObjectLiteral::Property::CONSTANT:
         UNREACHABLE();
       case ObjectLiteral::Property::MATERIALIZED_LITERAL:
-        DCHECK(!CompileTimeValue::IsCompileTimeValue(property->value()));
+        DCHECK(!property->value()->IsCompileTimeValue());
         V8_FALLTHROUGH;
       case ObjectLiteral::Property::COMPUTED: {
         // It is safe to use [[Put]] here because the boilerplate already
@@ -2300,52 +2314,36 @@ void BytecodeGenerator::VisitObjectLiteral(ObjectLiteral* expr) {
   builder()->LoadAccumulatorWithRegister(literal);
 }
 
-void BytecodeGenerator::VisitArrayLiteral(ArrayLiteral* expr) {
-  expr->InitDepthAndFlags();
-
-  // Deep-copy the literal boilerplate.
-  int literal_index = feedback_index(feedback_spec()->AddLiteralSlot());
-  if (expr->is_empty()) {
-    // Empty array literal fast-path.
-    DCHECK(expr->IsFastCloningSupported());
-    builder()->CreateEmptyArrayLiteral(literal_index);
-    return;
-  }
-
-  uint8_t flags = CreateArrayLiteralFlags::Encode(
-      expr->IsFastCloningSupported(), expr->ComputeFlags());
-  size_t entry = builder()->AllocateDeferredConstantPoolEntry();
-  builder()->CreateArrayLiteral(entry, literal_index, flags);
-  array_literals_.push_back(std::make_pair(expr, entry));
-
-  Register literal = register_allocator()->NewRegister();
-  builder()->StoreAccumulatorInRegister(literal);
-
-  // We'll reuse the same literal slot for all of the non-constant
-  // subexpressions that use a keyed store IC.
+void BytecodeGenerator::BuildArrayLiteralElementsInsertion(
+    Register array, int first_spread_index, ZonePtrList<Expression>* elements,
+    bool skip_constants) {
+  DCHECK_LT(first_spread_index, elements->length());
 
   Register index = register_allocator()->NewRegister();
   int array_index = 0;
 
-  // Evaluate all the non-constant subexpressions and store them into the
-  // newly cloned array.
-  FeedbackSlot slot;
-  ZoneList<Expression*>::iterator iter = expr->BeginValue();
-  for (; iter != expr->FirstSpreadOrEndValue(); ++iter, array_index++) {
+  ZonePtrList<Expression>::iterator iter = elements->begin();
+  ZonePtrList<Expression>::iterator first_spread_or_end =
+      first_spread_index >= 0 ? elements->begin() + first_spread_index
+                              : elements->end();
+
+  // Evaluate subexpressions and store them into the array.
+  FeedbackSlot keyed_store_slot;
+  for (; iter != first_spread_or_end; ++iter, array_index++) {
     Expression* subexpr = *iter;
     DCHECK(!subexpr->IsSpread());
-    if (CompileTimeValue::IsCompileTimeValue(subexpr)) continue;
-    if (slot.IsInvalid()) {
-      slot = feedback_spec()->AddKeyedStoreICSlot(language_mode());
+    if (skip_constants && subexpr->IsCompileTimeValue()) continue;
+    if (keyed_store_slot.IsInvalid()) {
+      keyed_store_slot = feedback_spec()->AddKeyedStoreICSlot(language_mode());
     }
     builder()
         ->LoadLiteral(Smi::FromInt(array_index))
         .StoreAccumulatorInRegister(index);
     VisitForAccumulatorValue(subexpr);
-    builder()->StoreKeyedProperty(literal, index, feedback_index(slot),
-                                  language_mode());
+    builder()->StoreKeyedProperty(
+        array, index, feedback_index(keyed_store_slot), language_mode());
   }
-  if (iter != expr->EndValue()) {
+  if (iter != elements->end()) {
     builder()->LoadLiteral(array_index).StoreAccumulatorInRegister(index);
 
     // Handle the first spread element and everything that follows.
@@ -2354,16 +2352,16 @@ void BytecodeGenerator::VisitArrayLiteral(ArrayLiteral* expr) {
     // TODO(neis): Only create length_slot when there are holes.
     FeedbackSlot length_slot =
         feedback_spec()->AddStoreICSlot(LanguageMode::kStrict);
-    for (; iter != expr->EndValue(); ++iter) {
+    for (; iter != elements->end(); ++iter) {
       Expression* subexpr = *iter;
       if (subexpr->IsSpread()) {
-        BuildArrayLiteralSpread(subexpr->AsSpread(), literal, index, index_slot,
+        BuildArrayLiteralSpread(subexpr->AsSpread(), array, index, index_slot,
                                 element_slot);
       } else if (!subexpr->IsTheHoleLiteral()) {
         // literal[index++] = subexpr
         VisitForAccumulatorValue(subexpr);
         builder()
-            ->StoreInArrayLiteral(literal, index, feedback_index(element_slot))
+            ->StoreInArrayLiteral(array, index, feedback_index(element_slot))
             .LoadAccumulatorWithRegister(index)
             .UnaryOperation(Token::INC, feedback_index(index_slot))
             .StoreAccumulatorInRegister(index);
@@ -2374,14 +2372,37 @@ void BytecodeGenerator::VisitArrayLiteral(ArrayLiteral* expr) {
             ->LoadAccumulatorWithRegister(index)
             .UnaryOperation(Token::INC, feedback_index(index_slot))
             .StoreAccumulatorInRegister(index)
-            .StoreNamedProperty(literal, length, feedback_index(length_slot),
+            .StoreNamedProperty(array, length, feedback_index(length_slot),
                                 LanguageMode::kStrict);
       }
     }
   }
+  builder()->LoadAccumulatorWithRegister(array);
+}
 
-  // Restore literal array into accumulator.
-  builder()->LoadAccumulatorWithRegister(literal);
+void BytecodeGenerator::VisitArrayLiteral(ArrayLiteral* expr) {
+  expr->InitDepthAndFlags();
+
+  // Deep-copy the literal boilerplate.
+  int literal_index = feedback_index(feedback_spec()->AddLiteralSlot());
+  if (expr->is_empty()) {
+    // Empty array literal fast-path.
+    DCHECK(expr->IsFastCloningSupported());
+    builder()->CreateEmptyArrayLiteral(literal_index);
+    return;
+  }
+
+  uint8_t flags = CreateArrayLiteralFlags::Encode(
+      expr->IsFastCloningSupported(), expr->ComputeFlags());
+  size_t entry = builder()->AllocateDeferredConstantPoolEntry();
+  builder()->CreateArrayLiteral(entry, literal_index, flags);
+  array_literals_.push_back(std::make_pair(expr, entry));
+
+  Register literal = register_allocator()->NewRegister();
+  builder()->StoreAccumulatorInRegister(literal);
+  // Insert all elements except the constant ones, since they are already there.
+  BuildArrayLiteralElementsInsertion(literal, expr->first_spread_index(),
+                                     expr->values(), true);
 }
 
 void BytecodeGenerator::BuildArrayLiteralSpread(Spread* spread, Register array,
@@ -2510,7 +2531,7 @@ void BytecodeGenerator::BuildVariableLoad(Variable* variable,
     }
     case VariableLocation::LOOKUP: {
       switch (variable->mode()) {
-        case DYNAMIC_LOCAL: {
+        case VariableMode::kDynamicLocal: {
           Variable* local_variable = variable->local_if_not_shadowed();
           int depth =
               execution_context()->ContextChainDepth(local_variable->scope());
@@ -2521,7 +2542,7 @@ void BytecodeGenerator::BuildVariableLoad(Variable* variable,
           }
           break;
         }
-        case DYNAMIC_GLOBAL: {
+        case VariableMode::kDynamicGlobal: {
           int depth =
               current_scope()->ContextChainLengthUntilOutermostSloppyEval();
           FeedbackSlot slot = GetCachedLoadGlobalICSlot(typeof_mode, variable);
@@ -2600,7 +2621,7 @@ void BytecodeGenerator::BuildReThrow() { builder()->ReThrow(); }
 
 void BytecodeGenerator::BuildThrowIfHole(Variable* variable) {
   if (variable->is_this()) {
-    DCHECK(variable->mode() == CONST);
+    DCHECK(variable->mode() == VariableMode::kConst);
     builder()->ThrowSuperNotCalledIfHole();
   } else {
     builder()->ThrowReferenceErrorIfHole(variable->raw_name());
@@ -2609,7 +2630,8 @@ void BytecodeGenerator::BuildThrowIfHole(Variable* variable) {
 
 void BytecodeGenerator::BuildHoleCheckForVariableAssignment(Variable* variable,
                                                             Token::Value op) {
-  if (variable->is_this() && variable->mode() == CONST && op == Token::INIT) {
+  if (variable->is_this() && variable->mode() == VariableMode::kConst &&
+      op == Token::INIT) {
     // Perform an initialization check for 'this'. 'this' variable is the
     // only variable able to trigger bind operations outside the TDZ
     // via 'super' calls.
@@ -2653,7 +2675,7 @@ void BytecodeGenerator::BuildVariableAssignment(
         builder()->LoadAccumulatorWithRegister(value_temp);
       }
 
-      if (mode != CONST || op == Token::INIT) {
+      if (mode != VariableMode::kConst || op == Token::INIT) {
         builder()->StoreAccumulatorInRegister(destination);
       } else if (variable->throw_on_const_assignment(language_mode())) {
         builder()->CallRuntime(Runtime::kThrowConstAssignError);
@@ -2689,7 +2711,7 @@ void BytecodeGenerator::BuildVariableAssignment(
         builder()->LoadAccumulatorWithRegister(value_temp);
       }
 
-      if (mode != CONST || op == Token::INIT) {
+      if (mode != VariableMode::kConst || op == Token::INIT) {
         builder()->StoreContextSlot(context_reg, variable->index(), depth);
       } else if (variable->throw_on_const_assignment(language_mode())) {
         builder()->CallRuntime(Runtime::kThrowConstAssignError);
@@ -2704,7 +2726,7 @@ void BytecodeGenerator::BuildVariableAssignment(
     case VariableLocation::MODULE: {
       DCHECK(IsDeclaredVariableMode(mode));
 
-      if (mode == CONST && op != Token::INIT) {
+      if (mode == VariableMode::kConst && op != Token::INIT) {
         builder()->CallRuntime(Runtime::kThrowConstAssignError);
         break;
       }
@@ -2790,7 +2812,7 @@ void BytecodeGenerator::VisitAssignment(Assignment* expr) {
         break;
       }
       case NAMED_PROPERTY: {
-        FeedbackSlot slot = feedback_spec()->AddLoadICSlot();
+        FeedbackSlot slot = GetCachedLoadICSlot(property->obj(), name);
         builder()->LoadNamedProperty(object, name, feedback_index(slot));
         break;
       }
@@ -2841,7 +2863,7 @@ void BytecodeGenerator::VisitAssignment(Assignment* expr) {
       break;
     }
     case NAMED_PROPERTY: {
-      FeedbackSlot slot = feedback_spec()->AddStoreICSlot(language_mode());
+      FeedbackSlot slot = GetCachedStoreICSlot(property->obj(), name);
       Register value;
       if (!execution_result()->IsEffect()) {
         value = register_allocator()->NewRegister();
@@ -3211,7 +3233,7 @@ void BytecodeGenerator::VisitYieldStar(YieldStar* expr) {
                           feedback_index(feedback_spec()->AddLoadICSlot()))
       .StoreAccumulatorInRegister(output_value)
       .LoadLiteral(Smi::FromInt(JSGeneratorObject::kReturn))
-      .CompareOperation(Token::EQ_STRICT, resume_mode)
+      .CompareReference(resume_mode)
       .JumpIfFalse(ToBooleanMode::kAlreadyBoolean, &completion_is_output_value)
       .LoadAccumulatorWithRegister(output_value);
   if (iterator_type == IteratorType::kAsync) {
@@ -3282,7 +3304,7 @@ void BytecodeGenerator::BuildAwait(Expression* await_expr) {
       .CallRuntime(Runtime::kInlineGeneratorGetResumeMode, generator_object())
       .StoreAccumulatorInRegister(resume_mode)
       .LoadLiteral(Smi::FromInt(JSGeneratorObject::kNext))
-      .CompareOperation(Token::EQ_STRICT, resume_mode)
+      .CompareReference(resume_mode)
       .JumpIfTrue(ToBooleanMode::kAlreadyBoolean, &resume_next);
 
   // Resume with "throw" completion (rethrow the received value).
@@ -3319,7 +3341,9 @@ void BytecodeGenerator::VisitPropertyLoad(Register obj, Property* property) {
       builder()->SetExpressionPosition(property);
       builder()->LoadNamedProperty(
           obj, property->key()->AsLiteral()->AsRawPropertyName(),
-          feedback_index(feedback_spec()->AddLoadICSlot()));
+          feedback_index(GetCachedLoadICSlot(
+              property->obj(),
+              property->key()->AsLiteral()->AsRawPropertyName())));
       break;
     }
     case KEYED_PROPERTY: {
@@ -3400,7 +3424,7 @@ void BytecodeGenerator::VisitResolvedProperty(ResolvedProperty* expr) {
   UNREACHABLE();
 }
 
-void BytecodeGenerator::VisitArguments(ZoneList<Expression*>* args,
+void BytecodeGenerator::VisitArguments(ZonePtrList<Expression>* args,
                                        RegisterList* arg_regs) {
   // Visit arguments.
   for (int i = 0; i < static_cast<int>(args->length()); i++) {
@@ -3571,6 +3595,12 @@ void BytecodeGenerator::VisitCall(Call* expr) {
 void BytecodeGenerator::VisitCallSuper(Call* expr) {
   RegisterAllocationScope register_scope(this);
   SuperCallReference* super = expr->expression()->AsSuperCallReference();
+  ZonePtrList<Expression>* args = expr->arguments();
+
+  int first_spread_index = 0;
+  for (; first_spread_index < args->length(); first_spread_index++) {
+    if (args->at(first_spread_index)->IsSpread()) break;
+  }
 
   // Prepare the constructor to the super call.
   Register this_function = VisitForRegisterValue(super->this_function_var());
@@ -3579,29 +3609,62 @@ void BytecodeGenerator::VisitCallSuper(Call* expr) {
       ->LoadAccumulatorWithRegister(this_function)
       .GetSuperConstructor(constructor);
 
-  ZoneList<Expression*>* args = expr->arguments();
-  RegisterList args_regs = register_allocator()->NewGrowableRegisterList();
-  VisitArguments(args, &args_regs);
-  // The new target is loaded into the accumulator from the
-  // {new.target} variable.
-  VisitForAccumulatorValue(super->new_target_var());
-  builder()->SetExpressionPosition(expr);
+  if (first_spread_index < expr->arguments()->length() - 1) {
+    // We rewrite something like
+    //    super(1, ...x, 2)
+    // to
+    //    %reflect_construct(constructor, [1, ...x, 2], new_target)
+    // That is, we implement (non-last-arg) spreads in super calls via our
+    // mechanism for spreads in array literals.
+
+    // First generate the array containing all arguments.
+    Register array = register_allocator()->NewRegister();
+    int literal_index = feedback_index(feedback_spec()->AddLiteralSlot());
+    builder()
+        ->CreateEmptyArrayLiteral(literal_index)
+        .StoreAccumulatorInRegister(array);
+    BuildArrayLiteralElementsInsertion(array, first_spread_index, args, false);
+
+    // Now pass that array to %reflect_construct.
+    RegisterList construct_args = register_allocator()->NewRegisterList(3);
+    builder()->MoveRegister(constructor, construct_args[0]);
+    builder()->MoveRegister(array, construct_args[1]);
+    VisitForRegisterValue(super->new_target_var(), construct_args[2]);
+    builder()->CallJSRuntime(Context::REFLECT_CONSTRUCT_INDEX, construct_args);
+  } else {
+    RegisterList args_regs = register_allocator()->NewGrowableRegisterList();
+    VisitArguments(args, &args_regs);
+    // The new target is loaded into the accumulator from the
+    // {new.target} variable.
+    VisitForAccumulatorValue(super->new_target_var());
+    builder()->SetExpressionPosition(expr);
 
-  int feedback_slot_index = feedback_index(feedback_spec()->AddCallICSlot());
+    int feedback_slot_index = feedback_index(feedback_spec()->AddCallICSlot());
 
-  // When a super call contains a spread, a CallSuper AST node is only created
-  // if there is exactly one spread, and it is the last argument.
-  if (expr->only_last_arg_is_spread()) {
-    builder()->ConstructWithSpread(constructor, args_regs, feedback_slot_index);
-  } else {
-    // Call construct.
-    // TODO(turbofan): For now we do gather feedback on super constructor
-    // calls, utilizing the existing machinery to inline the actual call
-    // target and the JSCreate for the implicit receiver allocation. This
-    // is not an ideal solution for super constructor calls, but it gets
-    // the job done for now. In the long run we might want to revisit this
-    // and come up with a better way.
-    builder()->Construct(constructor, args_regs, feedback_slot_index);
+    if (first_spread_index == expr->arguments()->length() - 1) {
+      builder()->ConstructWithSpread(constructor, args_regs,
+                                     feedback_slot_index);
+    } else {
+      DCHECK_EQ(first_spread_index, expr->arguments()->length());
+      // Call construct.
+      // TODO(turbofan): For now we do gather feedback on super constructor
+      // calls, utilizing the existing machinery to inline the actual call
+      // target and the JSCreate for the implicit receiver allocation. This
+      // is not an ideal solution for super constructor calls, but it gets
+      // the job done for now. In the long run we might want to revisit this
+      // and come up with a better way.
+      builder()->Construct(constructor, args_regs, feedback_slot_index);
+    }
+  }
+
+  // Explicit calls to the super constructor using super() perform an
+  // implicit binding assignment to the 'this' variable.
+  //
+  // Default constructors don't need have to do the assignment because
+  // 'this' isn't accessed in default constructors.
+  if (!IsDefaultConstructor(info()->literal()->kind())) {
+    BuildVariableAssignment(super->this_var()->var(), Token::INIT,
+                            HoleCheckMode::kRequired);
   }
 
   // The derived constructor has the correct bit set always, so we
@@ -3800,7 +3863,8 @@ void BytecodeGenerator::VisitCountOperation(CountOperation* expr) {
       object = VisitForRegisterValue(property->obj());
       name = property->key()->AsLiteral()->AsRawPropertyName();
       builder()->LoadNamedProperty(
-          object, name, feedback_index(feedback_spec()->AddLoadICSlot()));
+          object, name,
+          feedback_index(GetCachedLoadICSlot(property->obj(), name)));
       break;
     }
     case KEYED_PROPERTY: {
@@ -3864,7 +3928,7 @@ void BytecodeGenerator::VisitCountOperation(CountOperation* expr) {
       break;
     }
     case NAMED_PROPERTY: {
-      FeedbackSlot slot = feedback_spec()->AddStoreICSlot(language_mode());
+      FeedbackSlot slot = GetCachedStoreICSlot(property->obj(), name);
       Register value;
       if (!execution_result()->IsEffect()) {
         value = register_allocator()->NewRegister();
@@ -4245,8 +4309,8 @@ void BytecodeGenerator::VisitGetTemplateObject(GetTemplateObject* expr) {
 }
 
 void BytecodeGenerator::VisitTemplateLiteral(TemplateLiteral* expr) {
-  const TemplateLiteral::StringList& parts = *expr->string_parts();
-  const TemplateLiteral::ExpressionList& substitutions = *expr->substitutions();
+  const ZonePtrList<const AstRawString>& parts = *expr->string_parts();
+  const ZonePtrList<Expression>& substitutions = *expr->substitutions();
   // Template strings with no substitutions are turned into StringLiterals.
   DCHECK_GT(substitutions.length(), 0);
   DCHECK_EQ(parts.length(), substitutions.length() + 1);
@@ -4540,29 +4604,26 @@ void BytecodeGenerator::VisitRewritableExpression(RewritableExpression* expr) {
 void BytecodeGenerator::BuildNewLocalActivationContext() {
   ValueResultScope value_execution_result(this);
   Scope* scope = closure_scope();
+  DCHECK_EQ(current_scope(), closure_scope());
 
   // Create the appropriate context.
   if (scope->is_script_scope()) {
-    RegisterList args = register_allocator()->NewRegisterList(2);
+    Register scope_reg = register_allocator()->NewRegister();
     builder()
-        ->LoadAccumulatorWithRegister(Register::function_closure())
-        .StoreAccumulatorInRegister(args[0])
-        .LoadLiteral(scope)
-        .StoreAccumulatorInRegister(args[1])
-        .CallRuntime(Runtime::kNewScriptContext, args);
+        ->LoadLiteral(scope)
+        .StoreAccumulatorInRegister(scope_reg)
+        .CallRuntime(Runtime::kNewScriptContext, scope_reg);
   } else if (scope->is_module_scope()) {
     // We don't need to do anything for the outer script scope.
     DCHECK(scope->outer_scope()->is_script_scope());
 
     // A JSFunction representing a module is called with the module object as
-    // its sole argument, which we pass on to PushModuleContext.
-    RegisterList args = register_allocator()->NewRegisterList(3);
+    // its sole argument.
+    RegisterList args = register_allocator()->NewRegisterList(2);
     builder()
         ->MoveRegister(builder()->Parameter(0), args[0])
-        .LoadAccumulatorWithRegister(Register::function_closure())
-        .StoreAccumulatorInRegister(args[1])
         .LoadLiteral(scope)
-        .StoreAccumulatorInRegister(args[2])
+        .StoreAccumulatorInRegister(args[1])
         .CallRuntime(Runtime::kPushModuleContext, args);
   } else {
     DCHECK(scope->is_function_scope() || scope->is_eval_scope());
@@ -4570,21 +4631,18 @@ void BytecodeGenerator::BuildNewLocalActivationContext() {
     if (slot_count <= ConstructorBuiltins::MaximumFunctionContextSlots()) {
       switch (scope->scope_type()) {
         case EVAL_SCOPE:
-          builder()->CreateEvalContext(slot_count);
+          builder()->CreateEvalContext(scope, slot_count);
           break;
         case FUNCTION_SCOPE:
-          builder()->CreateFunctionContext(slot_count);
+          builder()->CreateFunctionContext(scope, slot_count);
           break;
         default:
           UNREACHABLE();
       }
     } else {
-      RegisterList args = register_allocator()->NewRegisterList(2);
-      builder()
-          ->MoveRegister(Register::function_closure(), args[0])
-          .LoadLiteral(Smi::FromInt(scope->scope_type()))
-          .StoreAccumulatorInRegister(args[1])
-          .CallRuntime(Runtime::kNewFunctionContext, args);
+      Register arg = register_allocator()->NewRegister();
+      builder()->LoadLiteral(scope).StoreAccumulatorInRegister(arg).CallRuntime(
+          Runtime::kNewFunctionContext, arg);
     }
   }
 }
@@ -4619,7 +4677,6 @@ void BytecodeGenerator::BuildNewLocalBlockContext(Scope* scope) {
   ValueResultScope value_execution_result(this);
   DCHECK(scope->is_block_scope());
 
-  VisitFunctionClosureForContext();
   builder()->CreateBlockContext(scope);
 }
 
@@ -4629,7 +4686,6 @@ void BytecodeGenerator::BuildNewLocalWithContext(Scope* scope) {
   Register extension_object = register_allocator()->NewRegister();
 
   builder()->ToObject(extension_object);
-  VisitFunctionClosureForContext();
   builder()->CreateWithContext(extension_object, scope);
 }
 
@@ -4639,9 +4695,7 @@ void BytecodeGenerator::BuildNewLocalCatchContext(Scope* scope) {
 
   Register exception = register_allocator()->NewRegister();
   builder()->StoreAccumulatorInRegister(exception);
-  VisitFunctionClosureForContext();
-  builder()->CreateCatchContext(exception, scope->catch_variable()->raw_name(),
-                                scope);
+  builder()->CreateCatchContext(exception, scope);
 }
 
 void BytecodeGenerator::VisitObjectLiteralAccessor(
@@ -4742,33 +4796,6 @@ void BytecodeGenerator::BuildGeneratorObjectVariableInitialization() {
   }
 }
 
-void BytecodeGenerator::VisitFunctionClosureForContext() {
-  ValueResultScope value_execution_result(this);
-  if (closure_scope()->is_script_scope()) {
-    // Contexts nested in the native context have a canonical empty function as
-    // their closure, not the anonymous closure containing the global code.
-    Register native_context = register_allocator()->NewRegister();
-    builder()
-        ->LoadContextSlot(execution_context()->reg(),
-                          Context::NATIVE_CONTEXT_INDEX, 0,
-                          BytecodeArrayBuilder::kImmutableSlot)
-        .StoreAccumulatorInRegister(native_context)
-        .LoadContextSlot(native_context, Context::CLOSURE_INDEX, 0,
-                         BytecodeArrayBuilder::kImmutableSlot);
-  } else if (closure_scope()->is_eval_scope()) {
-    // Contexts created by a call to eval have the same closure as the
-    // context calling eval, not the anonymous closure containing the eval
-    // code. Fetch it from the context.
-    builder()->LoadContextSlot(execution_context()->reg(),
-                               Context::CLOSURE_INDEX, 0,
-                               BytecodeArrayBuilder::kImmutableSlot);
-  } else {
-    DCHECK(closure_scope()->is_function_scope() ||
-           closure_scope()->is_module_scope());
-    builder()->LoadAccumulatorWithRegister(Register::function_closure());
-  }
-}
-
 void BytecodeGenerator::BuildPushUndefinedIntoRegisterList(
     RegisterList* reg_list) {
   Register reg = register_allocator()->GrowRegisterList(reg_list);
@@ -4993,6 +5020,48 @@ FeedbackSlot BytecodeGenerator::GetCachedStoreGlobalICSlot(
   return slot;
 }
 
+FeedbackSlot BytecodeGenerator::GetCachedLoadICSlot(const Expression* expr,
+                                                    const AstRawString* name) {
+  if (!FLAG_ignition_share_named_property_feedback) {
+    return feedback_spec()->AddLoadICSlot();
+  }
+  FeedbackSlotKind slot_kind = FeedbackSlotKind::kLoadProperty;
+  if (!expr->IsVariableProxy()) {
+    return feedback_spec()->AddLoadICSlot();
+  }
+  const VariableProxy* proxy = expr->AsVariableProxy();
+  FeedbackSlot slot =
+      feedback_slot_cache()->Get(slot_kind, proxy->var()->index(), name);
+  if (!slot.IsInvalid()) {
+    return slot;
+  }
+  slot = feedback_spec()->AddLoadICSlot();
+  feedback_slot_cache()->Put(slot_kind, proxy->var()->index(), name, slot);
+  return slot;
+}
+
+FeedbackSlot BytecodeGenerator::GetCachedStoreICSlot(const Expression* expr,
+                                                     const AstRawString* name) {
+  if (!FLAG_ignition_share_named_property_feedback) {
+    return feedback_spec()->AddStoreICSlot(language_mode());
+  }
+  FeedbackSlotKind slot_kind = is_strict(language_mode())
+                                   ? FeedbackSlotKind::kStoreNamedStrict
+                                   : FeedbackSlotKind::kStoreNamedSloppy;
+  if (!expr->IsVariableProxy()) {
+    return feedback_spec()->AddStoreICSlot(language_mode());
+  }
+  const VariableProxy* proxy = expr->AsVariableProxy();
+  FeedbackSlot slot =
+      feedback_slot_cache()->Get(slot_kind, proxy->var()->index(), name);
+  if (!slot.IsInvalid()) {
+    return slot;
+  }
+  slot = feedback_spec()->AddStoreICSlot(language_mode());
+  feedback_slot_cache()->Put(slot_kind, proxy->var()->index(), name, slot);
+  return slot;
+}
+
 FeedbackSlot BytecodeGenerator::GetCachedCreateClosureSlot(
     FunctionLiteral* literal) {
   FeedbackSlotKind slot_kind = FeedbackSlotKind::kCreateClosure;
@@ -5005,6 +5074,14 @@ FeedbackSlot BytecodeGenerator::GetCachedCreateClosureSlot(
   return slot;
 }
 
+FeedbackSlot BytecodeGenerator::GetDummyCompareICSlot() {
+  if (!dummy_feedback_slot_.IsInvalid()) {
+    return dummy_feedback_slot_;
+  }
+  dummy_feedback_slot_ = feedback_spec()->AddCompareICSlot();
+  return dummy_feedback_slot_;
+}
+
 Runtime::FunctionId BytecodeGenerator::StoreToSuperRuntimeId() {
   return is_strict(language_mode()) ? Runtime::kStoreToSuper_Strict
                                     : Runtime::kStoreToSuper_Sloppy;
diff --git a/deps/v8/src/interpreter/bytecode-generator.h b/deps/v8/src/interpreter/bytecode-generator.h
index e6e63f3c8ef03b..c9cee39bb9c2f9 100644
--- a/deps/v8/src/interpreter/bytecode-generator.h
+++ b/deps/v8/src/interpreter/bytecode-generator.h
@@ -43,7 +43,7 @@ class BytecodeGenerator final : public AstVisitor<BytecodeGenerator> {
 
   // Visiting function for declarations list and statements are overridden.
   void VisitDeclarations(Declaration::List* declarations);
-  void VisitStatements(ZoneList<Statement*>* statments);
+  void VisitStatements(ZonePtrList<Statement>* statments);
 
  private:
   class ContextScope;
@@ -100,7 +100,7 @@ class BytecodeGenerator final : public AstVisitor<BytecodeGenerator> {
 
   // Visit the arguments expressions in |args| and store them in |args_regs|,
   // growing |args_regs| for each argument visited.
-  void VisitArguments(ZoneList<Expression*>* args, RegisterList* arg_regs);
+  void VisitArguments(ZonePtrList<Expression>* args, RegisterList* arg_regs);
 
   // Visit a keyed super property load. The optional
   // |opt_receiver_out| register will have the receiver stored to it
@@ -177,6 +177,10 @@ class BytecodeGenerator final : public AstVisitor<BytecodeGenerator> {
   void BuildArrayLiteralSpread(Spread* spread, Register array, Register index,
                                FeedbackSlot index_slot,
                                FeedbackSlot element_slot);
+  void BuildArrayLiteralElementsInsertion(Register array,
+                                          int first_spread_index,
+                                          ZonePtrList<Expression>* elements,
+                                          bool skip_constants);
 
   void AllocateTopLevelRegisters();
   void VisitArgumentsObject(Variable* variable);
@@ -189,7 +193,6 @@ class BytecodeGenerator final : public AstVisitor<BytecodeGenerator> {
                                         Register instance);
   void BuildGeneratorObjectVariableInitialization();
   void VisitBlockDeclarationsAndStatements(Block* stmt);
-  void VisitFunctionClosureForContext();
   void VisitSetHomeObject(Register value, Register home_object,
                           LiteralProperty* property);
   void VisitObjectLiteralAccessor(Register home_object,
@@ -244,7 +247,7 @@ class BytecodeGenerator final : public AstVisitor<BytecodeGenerator> {
   TypeHint VisitForAccumulatorValue(Expression* expr);
   void VisitForAccumulatorValueOrTheHole(Expression* expr);
   V8_WARN_UNUSED_RESULT Register VisitForRegisterValue(Expression* expr);
-  INLINE(void VisitForRegisterValue(Expression* expr, Register destination));
+  V8_INLINE void VisitForRegisterValue(Expression* expr, Register destination);
   void VisitAndPushIntoRegisterList(Expression* expr, RegisterList* reg_list);
   void VisitForEffect(Expression* expr);
   void VisitForTest(Expression* expr, BytecodeLabels* then_labels,
@@ -266,6 +269,11 @@ class BytecodeGenerator final : public AstVisitor<BytecodeGenerator> {
   FeedbackSlot GetCachedStoreGlobalICSlot(LanguageMode language_mode,
                                           Variable* variable);
   FeedbackSlot GetCachedCreateClosureSlot(FunctionLiteral* literal);
+  FeedbackSlot GetCachedLoadICSlot(const Expression* expr,
+                                   const AstRawString* name);
+  FeedbackSlot GetCachedStoreICSlot(const Expression* expr,
+                                    const AstRawString* name);
+  FeedbackSlot GetDummyCompareICSlot();
 
   void AddToEagerLiteralsIfEager(FunctionLiteral* literal);
 
@@ -352,6 +360,10 @@ class BytecodeGenerator final : public AstVisitor<BytecodeGenerator> {
 
   Register incoming_new_target_or_generator_;
 
+  // Dummy feedback slot for compare operations, where we don't care about
+  // feedback
+  FeedbackSlot dummy_feedback_slot_;
+
   BytecodeJumpTable* generator_jump_table_;
   int suspend_count_;
   int loop_depth_;
diff --git a/deps/v8/src/interpreter/bytecode-node.h b/deps/v8/src/interpreter/bytecode-node.h
index 98e1577f4546ee..48d89616327957 100644
--- a/deps/v8/src/interpreter/bytecode-node.h
+++ b/deps/v8/src/interpreter/bytecode-node.h
@@ -18,8 +18,8 @@ namespace interpreter {
 // A container for a generated bytecode, it's operands, and source information.
 class V8_EXPORT_PRIVATE BytecodeNode final {
  public:
-  INLINE(BytecodeNode(Bytecode bytecode,
-                      BytecodeSourceInfo source_info = BytecodeSourceInfo()))
+  V8_INLINE BytecodeNode(Bytecode bytecode,
+                         BytecodeSourceInfo source_info = BytecodeSourceInfo())
       : bytecode_(bytecode),
         operand_count_(0),
         operand_scale_(OperandScale::kSingle),
@@ -27,8 +27,8 @@ class V8_EXPORT_PRIVATE BytecodeNode final {
     DCHECK_EQ(Bytecodes::NumberOfOperands(bytecode), operand_count());
   }
 
-  INLINE(BytecodeNode(Bytecode bytecode, uint32_t operand0,
-                      BytecodeSourceInfo source_info = BytecodeSourceInfo()))
+  V8_INLINE BytecodeNode(Bytecode bytecode, uint32_t operand0,
+                         BytecodeSourceInfo source_info = BytecodeSourceInfo())
       : bytecode_(bytecode),
         operand_count_(1),
         operand_scale_(OperandScale::kSingle),
@@ -37,8 +37,9 @@ class V8_EXPORT_PRIVATE BytecodeNode final {
     SetOperand(0, operand0);
   }
 
-  INLINE(BytecodeNode(Bytecode bytecode, uint32_t operand0, uint32_t operand1,
-                      BytecodeSourceInfo source_info = BytecodeSourceInfo()))
+  V8_INLINE BytecodeNode(Bytecode bytecode, uint32_t operand0,
+                         uint32_t operand1,
+                         BytecodeSourceInfo source_info = BytecodeSourceInfo())
       : bytecode_(bytecode),
         operand_count_(2),
         operand_scale_(OperandScale::kSingle),
@@ -48,9 +49,9 @@ class V8_EXPORT_PRIVATE BytecodeNode final {
     SetOperand(1, operand1);
   }
 
-  INLINE(BytecodeNode(Bytecode bytecode, uint32_t operand0, uint32_t operand1,
-                      uint32_t operand2,
-                      BytecodeSourceInfo source_info = BytecodeSourceInfo()))
+  V8_INLINE BytecodeNode(Bytecode bytecode, uint32_t operand0,
+                         uint32_t operand1, uint32_t operand2,
+                         BytecodeSourceInfo source_info = BytecodeSourceInfo())
       : bytecode_(bytecode),
         operand_count_(3),
         operand_scale_(OperandScale::kSingle),
@@ -61,9 +62,10 @@ class V8_EXPORT_PRIVATE BytecodeNode final {
     SetOperand(2, operand2);
   }
 
-  INLINE(BytecodeNode(Bytecode bytecode, uint32_t operand0, uint32_t operand1,
-                      uint32_t operand2, uint32_t operand3,
-                      BytecodeSourceInfo source_info = BytecodeSourceInfo()))
+  V8_INLINE BytecodeNode(Bytecode bytecode, uint32_t operand0,
+                         uint32_t operand1, uint32_t operand2,
+                         uint32_t operand3,
+                         BytecodeSourceInfo source_info = BytecodeSourceInfo())
       : bytecode_(bytecode),
         operand_count_(4),
         operand_scale_(OperandScale::kSingle),
@@ -75,9 +77,10 @@ class V8_EXPORT_PRIVATE BytecodeNode final {
     SetOperand(3, operand3);
   }
 
-  INLINE(BytecodeNode(Bytecode bytecode, uint32_t operand0, uint32_t operand1,
-                      uint32_t operand2, uint32_t operand3, uint32_t operand4,
-                      BytecodeSourceInfo source_info = BytecodeSourceInfo()))
+  V8_INLINE BytecodeNode(Bytecode bytecode, uint32_t operand0,
+                         uint32_t operand1, uint32_t operand2,
+                         uint32_t operand3, uint32_t operand4,
+                         BytecodeSourceInfo source_info = BytecodeSourceInfo())
       : bytecode_(bytecode),
         operand_count_(5),
         operand_scale_(OperandScale::kSingle),
@@ -92,8 +95,8 @@ class V8_EXPORT_PRIVATE BytecodeNode final {
 
 #define DEFINE_BYTECODE_NODE_CREATOR(Name, ...)                              \
   template <typename... Operands>                                            \
-  INLINE(static BytecodeNode Name(BytecodeSourceInfo source_info,            \
-                                  Operands... operands)) {                   \
+  V8_INLINE static BytecodeNode Name(BytecodeSourceInfo source_info,         \
+                                     Operands... operands) {                 \
     return Create<Bytecode::k##Name, __VA_ARGS__>(source_info, operands...); \
   }
   BYTECODE_LIST(DEFINE_BYTECODE_NODE_CREATOR)
@@ -128,11 +131,11 @@ class V8_EXPORT_PRIVATE BytecodeNode final {
             OperandType... operand_types>
   friend class BytecodeNodeBuilder;
 
-  INLINE(BytecodeNode(Bytecode bytecode, int operand_count,
-                      OperandScale operand_scale,
-                      BytecodeSourceInfo source_info, uint32_t operand0 = 0,
-                      uint32_t operand1 = 0, uint32_t operand2 = 0,
-                      uint32_t operand3 = 0, uint32_t operand4 = 0))
+  V8_INLINE BytecodeNode(Bytecode bytecode, int operand_count,
+                         OperandScale operand_scale,
+                         BytecodeSourceInfo source_info, uint32_t operand0 = 0,
+                         uint32_t operand1 = 0, uint32_t operand2 = 0,
+                         uint32_t operand3 = 0, uint32_t operand4 = 0)
       : bytecode_(bytecode),
         operand_count_(operand_count),
         operand_scale_(operand_scale),
@@ -146,14 +149,14 @@ class V8_EXPORT_PRIVATE BytecodeNode final {
   }
 
   template <Bytecode bytecode, AccumulatorUse accum_use>
-  INLINE(static BytecodeNode Create(BytecodeSourceInfo source_info)) {
+  V8_INLINE static BytecodeNode Create(BytecodeSourceInfo source_info) {
     return BytecodeNode(bytecode, 0, OperandScale::kSingle, source_info);
   }
 
   template <Bytecode bytecode, AccumulatorUse accum_use,
             OperandType operand0_type>
-  INLINE(static BytecodeNode Create(BytecodeSourceInfo source_info,
-                                    uint32_t operand0)) {
+  V8_INLINE static BytecodeNode Create(BytecodeSourceInfo source_info,
+                                       uint32_t operand0) {
     DCHECK_EQ(Bytecodes::GetOperandType(bytecode, 0), operand0_type);
     OperandScale scale = OperandScale::kSingle;
     scale = std::max(scale, ScaleForOperand<operand0_type>(operand0));
@@ -162,8 +165,8 @@ class V8_EXPORT_PRIVATE BytecodeNode final {
 
   template <Bytecode bytecode, AccumulatorUse accum_use,
             OperandType operand0_type, OperandType operand1_type>
-  INLINE(static BytecodeNode Create(BytecodeSourceInfo source_info,
-                                    uint32_t operand0, uint32_t operand1)) {
+  V8_INLINE static BytecodeNode Create(BytecodeSourceInfo source_info,
+                                       uint32_t operand0, uint32_t operand1) {
     DCHECK_EQ(Bytecodes::GetOperandType(bytecode, 0), operand0_type);
     DCHECK_EQ(Bytecodes::GetOperandType(bytecode, 1), operand1_type);
     OperandScale scale = OperandScale::kSingle;
@@ -175,9 +178,9 @@ class V8_EXPORT_PRIVATE BytecodeNode final {
   template <Bytecode bytecode, AccumulatorUse accum_use,
             OperandType operand0_type, OperandType operand1_type,
             OperandType operand2_type>
-  INLINE(static BytecodeNode Create(BytecodeSourceInfo source_info,
-                                    uint32_t operand0, uint32_t operand1,
-                                    uint32_t operand2)) {
+  V8_INLINE static BytecodeNode Create(BytecodeSourceInfo source_info,
+                                       uint32_t operand0, uint32_t operand1,
+                                       uint32_t operand2) {
     DCHECK_EQ(Bytecodes::GetOperandType(bytecode, 0), operand0_type);
     DCHECK_EQ(Bytecodes::GetOperandType(bytecode, 1), operand1_type);
     DCHECK_EQ(Bytecodes::GetOperandType(bytecode, 2), operand2_type);
@@ -192,9 +195,9 @@ class V8_EXPORT_PRIVATE BytecodeNode final {
   template <Bytecode bytecode, AccumulatorUse accum_use,
             OperandType operand0_type, OperandType operand1_type,
             OperandType operand2_type, OperandType operand3_type>
-  INLINE(static BytecodeNode Create(BytecodeSourceInfo source_info,
-                                    uint32_t operand0, uint32_t operand1,
-                                    uint32_t operand2, uint32_t operand3)) {
+  V8_INLINE static BytecodeNode Create(BytecodeSourceInfo source_info,
+                                       uint32_t operand0, uint32_t operand1,
+                                       uint32_t operand2, uint32_t operand3) {
     DCHECK_EQ(Bytecodes::GetOperandType(bytecode, 0), operand0_type);
     DCHECK_EQ(Bytecodes::GetOperandType(bytecode, 1), operand1_type);
     DCHECK_EQ(Bytecodes::GetOperandType(bytecode, 2), operand2_type);
@@ -212,10 +215,10 @@ class V8_EXPORT_PRIVATE BytecodeNode final {
             OperandType operand0_type, OperandType operand1_type,
             OperandType operand2_type, OperandType operand3_type,
             OperandType operand4_type>
-  INLINE(static BytecodeNode Create(BytecodeSourceInfo source_info,
-                                    uint32_t operand0, uint32_t operand1,
-                                    uint32_t operand2, uint32_t operand3,
-                                    uint32_t operand4)) {
+  V8_INLINE static BytecodeNode Create(BytecodeSourceInfo source_info,
+                                       uint32_t operand0, uint32_t operand1,
+                                       uint32_t operand2, uint32_t operand3,
+                                       uint32_t operand4) {
     DCHECK_EQ(Bytecodes::GetOperandType(bytecode, 0), operand0_type);
     DCHECK_EQ(Bytecodes::GetOperandType(bytecode, 1), operand1_type);
     DCHECK_EQ(Bytecodes::GetOperandType(bytecode, 2), operand2_type);
@@ -232,7 +235,7 @@ class V8_EXPORT_PRIVATE BytecodeNode final {
   }
 
   template <OperandType operand_type>
-  INLINE(static OperandScale ScaleForOperand(uint32_t operand)) {
+  V8_INLINE static OperandScale ScaleForOperand(uint32_t operand) {
     if (BytecodeOperands::IsScalableUnsignedByte(operand_type)) {
       return Bytecodes::ScaleForUnsignedOperand(operand);
     } else if (BytecodeOperands::IsScalableSignedByte(operand_type)) {
@@ -242,7 +245,7 @@ class V8_EXPORT_PRIVATE BytecodeNode final {
     }
   }
 
-  INLINE(void UpdateScaleForOperand(int operand_index, uint32_t operand)) {
+  V8_INLINE void UpdateScaleForOperand(int operand_index, uint32_t operand) {
     if (Bytecodes::OperandIsScalableSignedByte(bytecode(), operand_index)) {
       operand_scale_ =
           std::max(operand_scale_, Bytecodes::ScaleForSignedOperand(operand));
@@ -253,7 +256,7 @@ class V8_EXPORT_PRIVATE BytecodeNode final {
     }
   }
 
-  INLINE(void SetOperand(int operand_index, uint32_t operand)) {
+  V8_INLINE void SetOperand(int operand_index, uint32_t operand) {
     operands_[operand_index] = operand;
     UpdateScaleForOperand(operand_index, operand);
   }
diff --git a/deps/v8/src/interpreter/bytecode-register-optimizer.h b/deps/v8/src/interpreter/bytecode-register-optimizer.h
index 92673d9cac9701..11794274b9c1fd 100644
--- a/deps/v8/src/interpreter/bytecode-register-optimizer.h
+++ b/deps/v8/src/interpreter/bytecode-register-optimizer.h
@@ -63,7 +63,7 @@ class V8_EXPORT_PRIVATE BytecodeRegisterOptimizer final
 
   // Prepares for |bytecode|.
   template <Bytecode bytecode, AccumulatorUse accumulator_use>
-  INLINE(void PrepareForBytecode()) {
+  V8_INLINE void PrepareForBytecode() {
     if (Bytecodes::IsJump(bytecode) || Bytecodes::IsSwitch(bytecode) ||
         bytecode == Bytecode::kDebugger ||
         bytecode == Bytecode::kSuspendGenerator ||
diff --git a/deps/v8/src/interpreter/bytecodes.h b/deps/v8/src/interpreter/bytecodes.h
index 5533287061eed4..b1ae88c1baf8fb 100644
--- a/deps/v8/src/interpreter/bytecodes.h
+++ b/deps/v8/src/interpreter/bytecodes.h
@@ -226,7 +226,7 @@ namespace interpreter {
     OperandType::kIdx)                                                         \
   V(TestGreaterThanOrEqual, AccumulatorUse::kReadWrite, OperandType::kReg,     \
     OperandType::kIdx)                                                         \
-  V(TestEqualStrictNoFeedback, AccumulatorUse::kReadWrite, OperandType::kReg)  \
+  V(TestReferenceEqual, AccumulatorUse::kReadWrite, OperandType::kReg)         \
   V(TestInstanceOf, AccumulatorUse::kReadWrite, OperandType::kReg,             \
     OperandType::kIdx)                                                         \
   V(TestIn, AccumulatorUse::kReadWrite, OperandType::kReg)                     \
@@ -261,12 +261,14 @@ namespace interpreter {
     OperandType::kIdx, OperandType::kFlag8)                                    \
                                                                                \
   /* Context allocation */                                                     \
-  V(CreateBlockContext, AccumulatorUse::kReadWrite, OperandType::kIdx)         \
-  V(CreateCatchContext, AccumulatorUse::kReadWrite, OperandType::kReg,         \
-    OperandType::kIdx, OperandType::kIdx)                                      \
-  V(CreateFunctionContext, AccumulatorUse::kWrite, OperandType::kUImm)         \
-  V(CreateEvalContext, AccumulatorUse::kWrite, OperandType::kUImm)             \
-  V(CreateWithContext, AccumulatorUse::kReadWrite, OperandType::kReg,          \
+  V(CreateBlockContext, AccumulatorUse::kWrite, OperandType::kIdx)             \
+  V(CreateCatchContext, AccumulatorUse::kWrite, OperandType::kReg,             \
+    OperandType::kIdx)                                                         \
+  V(CreateFunctionContext, AccumulatorUse::kWrite, OperandType::kIdx,          \
+    OperandType::kUImm)                                                        \
+  V(CreateEvalContext, AccumulatorUse::kWrite, OperandType::kIdx,              \
+    OperandType::kUImm)                                                        \
+  V(CreateWithContext, AccumulatorUse::kWrite, OperandType::kReg,              \
     OperandType::kIdx)                                                         \
                                                                                \
   /* Arguments allocation */                                                   \
@@ -693,11 +695,6 @@ class V8_EXPORT_PRIVATE Bytecodes final : public AllStatic {
 #undef OR_BYTECODE
   }
 
-  // Returns the number of values which |bytecode| returns.
-  static constexpr size_t ReturnCount(Bytecode bytecode) {
-    return Returns(bytecode) ? 1 : 0;
-  }
-
   // Returns the number of operands expected by |bytecode|.
   static int NumberOfOperands(Bytecode bytecode) {
     DCHECK_LE(bytecode, Bytecode::kLast);
diff --git a/deps/v8/src/interpreter/constant-array-builder.h b/deps/v8/src/interpreter/constant-array-builder.h
index e66946f2c5b293..8f558c4a90552d 100644
--- a/deps/v8/src/interpreter/constant-array-builder.h
+++ b/deps/v8/src/interpreter/constant-array-builder.h
@@ -21,14 +21,14 @@ class AstValue;
 namespace interpreter {
 
 // Constant array entries that represent singletons.
-#define SINGLETON_CONSTANT_ENTRY_TYPES(V)                       \
-  V(AsyncIteratorSymbol, async_iterator_symbol)                 \
-  V(ClassFieldsSymbol, class_fields_symbol)                     \
-  V(EmptyBoilerplateDescription, empty_boilerplate_description) \
-  V(EmptyFixedArray, empty_fixed_array)                         \
-  V(HomeObjectSymbol, home_object_symbol)                       \
-  V(IteratorSymbol, iterator_symbol)                            \
-  V(InterpreterTrampolineSymbol, interpreter_trampoline_symbol) \
+#define SINGLETON_CONSTANT_ENTRY_TYPES(V)                                    \
+  V(AsyncIteratorSymbol, async_iterator_symbol)                              \
+  V(ClassFieldsSymbol, class_fields_symbol)                                  \
+  V(EmptyObjectBoilerplateDescription, empty_object_boilerplate_description) \
+  V(EmptyFixedArray, empty_fixed_array)                                      \
+  V(HomeObjectSymbol, home_object_symbol)                                    \
+  V(IteratorSymbol, iterator_symbol)                                         \
+  V(InterpreterTrampolineSymbol, interpreter_trampoline_symbol)              \
   V(NaN, nan_value)
 
 // A helper class for constructing constant arrays for the
diff --git a/deps/v8/src/interpreter/interpreter-assembler.cc b/deps/v8/src/interpreter/interpreter-assembler.cc
index 0ebc3039231f2e..6ea4ba628c3b09 100644
--- a/deps/v8/src/interpreter/interpreter-assembler.cc
+++ b/deps/v8/src/interpreter/interpreter-assembler.cc
@@ -23,6 +23,8 @@ namespace interpreter {
 
 using compiler::CodeAssemblerState;
 using compiler::Node;
+template <class T>
+using TNode = compiler::TNode<T>;
 
 InterpreterAssembler::InterpreterAssembler(CodeAssemblerState* state,
                                            Bytecode bytecode,
@@ -139,7 +141,7 @@ Node* InterpreterAssembler::GetAccumulatorUnchecked() {
 Node* InterpreterAssembler::GetAccumulator() {
   DCHECK(Bytecodes::ReadsAccumulator(bytecode_));
   accumulator_use_ = accumulator_use_ | AccumulatorUse::kRead;
-  return PoisonOnSpeculationTagged(GetAccumulatorUnchecked());
+  return TaggedPoisonOnSpeculation(GetAccumulatorUnchecked());
 }
 
 void InterpreterAssembler::SetAccumulator(Node* value) {
@@ -222,7 +224,7 @@ void InterpreterAssembler::GotoIfHasContextExtensionUpToDepth(Node* context,
 }
 
 Node* InterpreterAssembler::RegisterLocation(Node* reg_index) {
-  return PoisonOnSpeculationWord(
+  return WordPoisonOnSpeculation(
       IntPtrAdd(GetInterpretedFramePointer(), RegisterFrameOffset(reg_index)));
 }
 
@@ -236,7 +238,7 @@ Node* InterpreterAssembler::RegisterFrameOffset(Node* index) {
 
 Node* InterpreterAssembler::LoadRegister(Node* reg_index) {
   return Load(MachineType::AnyTagged(), GetInterpretedFramePointer(),
-              RegisterFrameOffset(reg_index), LoadSensitivity::kNeedsPoisoning);
+              RegisterFrameOffset(reg_index), LoadSensitivity::kCritical);
 }
 
 Node* InterpreterAssembler::LoadRegister(Register reg) {
@@ -648,7 +650,7 @@ Node* InterpreterAssembler::LoadConstantPoolEntry(Node* index) {
   Node* constant_pool = LoadObjectField(BytecodeArrayTaggedPointer(),
                                         BytecodeArray::kConstantPoolOffset);
   return LoadFixedArrayElement(constant_pool, UncheckedCast<IntPtrT>(index),
-                               LoadSensitivity::kNeedsPoisoning);
+                               LoadSensitivity::kCritical);
 }
 
 Node* InterpreterAssembler::LoadAndUntagConstantPoolEntry(Node* index) {
@@ -667,8 +669,8 @@ Node* InterpreterAssembler::LoadAndUntagConstantPoolEntryAtOperandIndex(
   return SmiUntag(LoadConstantPoolEntryAtOperandIndex(operand_index));
 }
 
-Node* InterpreterAssembler::LoadFeedbackVector() {
-  Node* function = LoadRegister(Register::function_closure());
+TNode<FeedbackVector> InterpreterAssembler::LoadFeedbackVector() {
+  TNode<JSFunction> function = CAST(LoadRegister(Register::function_closure()));
   return CodeStubAssembler::LoadFeedbackVector(function);
 }
 
@@ -703,8 +705,8 @@ void InterpreterAssembler::CallEpilogue() {
 void InterpreterAssembler::IncrementCallCount(Node* feedback_vector,
                                               Node* slot_id) {
   Comment("increment call count");
-  Node* call_count =
-      LoadFeedbackVectorSlot(feedback_vector, slot_id, kPointerSize);
+  TNode<Smi> call_count =
+      CAST(LoadFeedbackVectorSlot(feedback_vector, slot_id, kPointerSize));
   // The lowest {FeedbackNexus::CallCountField::kShift} bits of the call
   // count are used as flags. To increment the call count by 1 we hence
   // have to increment by 1 << {FeedbackNexus::CallCountField::kShift}.
@@ -721,34 +723,33 @@ void InterpreterAssembler::CollectCallableFeedback(Node* target, Node* context,
   Label extra_checks(this, Label::kDeferred), done(this);
 
   // Check if we have monomorphic {target} feedback already.
-  Node* feedback_element = LoadFeedbackVectorSlot(feedback_vector, slot_id);
-  Node* feedback_value = LoadWeakCellValueUnchecked(feedback_element);
+  TNode<MaybeObject> feedback =
+      LoadFeedbackVectorSlot(feedback_vector, slot_id);
   Comment("check if monomorphic");
-  Node* is_monomorphic = WordEqual(target, feedback_value);
+  TNode<BoolT> is_monomorphic = IsWeakReferenceTo(feedback, CAST(target));
   GotoIf(is_monomorphic, &done);
 
   // Check if it is a megamorphic {target}.
   Comment("check if megamorphic");
-  Node* is_megamorphic =
-      WordEqual(feedback_element,
-                HeapConstant(FeedbackVector::MegamorphicSentinel(isolate())));
+  Node* is_megamorphic = WordEqual(
+      feedback, HeapConstant(FeedbackVector::MegamorphicSentinel(isolate())));
   Branch(is_megamorphic, &done, &extra_checks);
 
   BIND(&extra_checks);
   {
     Label initialize(this), mark_megamorphic(this);
 
-    Comment("check if weak cell");
+    Comment("check if weak reference");
     Node* is_uninitialized = WordEqual(
-        feedback_element,
+        feedback,
         HeapConstant(FeedbackVector::UninitializedSentinel(isolate())));
     GotoIf(is_uninitialized, &initialize);
-    CSA_ASSERT(this, IsWeakCell(feedback_element));
+    CSA_ASSERT(this, IsWeakOrClearedHeapObject(feedback));
 
-    // If the weak cell is cleared, we have a new chance to become monomorphic.
-    Comment("check if weak cell is cleared");
-    Node* is_smi = TaggedIsSmi(feedback_value);
-    Branch(is_smi, &initialize, &mark_megamorphic);
+    // If the weak reference is cleared, we have a new chance to become
+    // monomorphic.
+    Comment("check if weak reference is cleared");
+    Branch(IsClearedWeakHeapObject(feedback), &initialize, &mark_megamorphic);
 
     BIND(&initialize);
     {
@@ -791,7 +792,8 @@ void InterpreterAssembler::CollectCallableFeedback(Node* target, Node* context,
         }
       }
       BIND(&done_loop);
-      CreateWeakCellInFeedbackVector(feedback_vector, slot_id, target);
+      StoreWeakReferenceInFeedbackVector(feedback_vector, slot_id,
+                                         CAST(target));
       ReportFeedbackUpdate(feedback_vector, slot_id, "Call:Initialize");
       Goto(&done);
     }
@@ -929,9 +931,10 @@ Node* InterpreterAssembler::Construct(Node* target, Node* context,
   IncrementCallCount(feedback_vector, slot_id);
 
   // Check if we have monomorphic {new_target} feedback already.
-  Node* feedback_element = LoadFeedbackVectorSlot(feedback_vector, slot_id);
-  Node* feedback_value = LoadWeakCellValueUnchecked(feedback_element);
-  Branch(WordEqual(new_target, feedback_value), &construct, &extra_checks);
+  TNode<MaybeObject> feedback =
+      LoadFeedbackVectorSlot(feedback_vector, slot_id);
+  Branch(IsWeakReferenceTo(feedback, CAST(new_target)), &construct,
+         &extra_checks);
 
   BIND(&extra_checks);
   {
@@ -940,32 +943,31 @@ Node* InterpreterAssembler::Construct(Node* target, Node* context,
 
     // Check if it is a megamorphic {new_target}..
     Comment("check if megamorphic");
-    Node* is_megamorphic =
-        WordEqual(feedback_element,
-                  HeapConstant(FeedbackVector::MegamorphicSentinel(isolate())));
+    Node* is_megamorphic = WordEqual(
+        feedback, HeapConstant(FeedbackVector::MegamorphicSentinel(isolate())));
     GotoIf(is_megamorphic, &construct);
 
-    Comment("check if weak cell");
-    Node* feedback_element_map = LoadMap(feedback_element);
-    GotoIfNot(IsWeakCellMap(feedback_element_map), &check_allocation_site);
+    Comment("check if weak reference");
+    GotoIfNot(IsWeakOrClearedHeapObject(feedback), &check_allocation_site);
 
-    // If the weak cell is cleared, we have a new chance to become monomorphic.
-    Comment("check if weak cell is cleared");
-    Node* is_smi = TaggedIsSmi(feedback_value);
-    Branch(is_smi, &initialize, &mark_megamorphic);
+    // If the weak reference is cleared, we have a new chance to become
+    // monomorphic.
+    Comment("check if weak reference is cleared");
+    Branch(IsClearedWeakHeapObject(feedback), &initialize, &mark_megamorphic);
 
     BIND(&check_allocation_site);
     {
       // Check if it is an AllocationSite.
       Comment("check if allocation site");
-      GotoIfNot(IsAllocationSiteMap(feedback_element_map), &check_initialized);
+      TNode<HeapObject> strong_feedback = CAST(feedback);
+      GotoIfNot(IsAllocationSite(strong_feedback), &check_initialized);
 
       // Make sure that {target} and {new_target} are the Array constructor.
       Node* array_function = LoadContextElement(LoadNativeContext(context),
                                                 Context::ARRAY_FUNCTION_INDEX);
       GotoIfNot(WordEqual(target, array_function), &mark_megamorphic);
       GotoIfNot(WordEqual(new_target, array_function), &mark_megamorphic);
-      var_site.Bind(feedback_element);
+      var_site.Bind(strong_feedback);
       Goto(&construct_array);
     }
 
@@ -973,8 +975,8 @@ Node* InterpreterAssembler::Construct(Node* target, Node* context,
     {
       // Check if it is uninitialized.
       Comment("check if uninitialized");
-      Node* is_uninitialized = WordEqual(
-          feedback_element, LoadRoot(Heap::kuninitialized_symbolRootIndex));
+      Node* is_uninitialized =
+          WordEqual(feedback, LoadRoot(Heap::kuninitialized_symbolRootIndex));
       Branch(is_uninitialized, &initialize, &mark_megamorphic);
     }
 
@@ -1021,12 +1023,12 @@ Node* InterpreterAssembler::Construct(Node* target, Node* context,
 
       // Create an AllocationSite if {target} and {new_target} refer
       // to the current native context's Array constructor.
-      Label create_allocation_site(this), create_weak_cell(this);
-      GotoIfNot(WordEqual(target, new_target), &create_weak_cell);
+      Label create_allocation_site(this), store_weak_reference(this);
+      GotoIfNot(WordEqual(target, new_target), &store_weak_reference);
       Node* array_function = LoadContextElement(LoadNativeContext(context),
                                                 Context::ARRAY_FUNCTION_INDEX);
       Branch(WordEqual(target, array_function), &create_allocation_site,
-             &create_weak_cell);
+             &store_weak_reference);
 
       BIND(&create_allocation_site);
       {
@@ -1037,11 +1039,12 @@ Node* InterpreterAssembler::Construct(Node* target, Node* context,
         Goto(&construct_array);
       }
 
-      BIND(&create_weak_cell);
+      BIND(&store_weak_reference);
       {
-        CreateWeakCellInFeedbackVector(feedback_vector, slot_id, new_target);
+        StoreWeakReferenceInFeedbackVector(feedback_vector, slot_id,
+                                           CAST(new_target));
         ReportFeedbackUpdate(feedback_vector, slot_id,
-                             "Construct:CreateWeakCell");
+                             "Construct:StoreWeakReference");
         Goto(&construct);
       }
     }
@@ -1108,9 +1111,10 @@ Node* InterpreterAssembler::ConstructWithSpread(Node* target, Node* context,
   IncrementCallCount(feedback_vector, slot_id);
 
   // Check if we have monomorphic {new_target} feedback already.
-  Node* feedback_element = LoadFeedbackVectorSlot(feedback_vector, slot_id);
-  Node* feedback_value = LoadWeakCellValueUnchecked(feedback_element);
-  Branch(WordEqual(new_target, feedback_value), &construct, &extra_checks);
+  TNode<MaybeObject> feedback =
+      LoadFeedbackVectorSlot(feedback_vector, slot_id);
+  Branch(IsWeakReferenceTo(feedback, CAST(new_target)), &construct,
+         &extra_checks);
 
   BIND(&extra_checks);
   {
@@ -1118,27 +1122,24 @@ Node* InterpreterAssembler::ConstructWithSpread(Node* target, Node* context,
 
     // Check if it is a megamorphic {new_target}.
     Comment("check if megamorphic");
-    Node* is_megamorphic =
-        WordEqual(feedback_element,
-                  HeapConstant(FeedbackVector::MegamorphicSentinel(isolate())));
+    Node* is_megamorphic = WordEqual(
+        feedback, HeapConstant(FeedbackVector::MegamorphicSentinel(isolate())));
     GotoIf(is_megamorphic, &construct);
 
-    Comment("check if weak cell");
-    Node* is_weak_cell = WordEqual(LoadMap(feedback_element),
-                                   LoadRoot(Heap::kWeakCellMapRootIndex));
-    GotoIfNot(is_weak_cell, &check_initialized);
+    Comment("check if weak reference");
+    GotoIfNot(IsWeakOrClearedHeapObject(feedback), &check_initialized);
 
-    // If the weak cell is cleared, we have a new chance to become monomorphic.
-    Comment("check if weak cell is cleared");
-    Node* is_smi = TaggedIsSmi(feedback_value);
-    Branch(is_smi, &initialize, &mark_megamorphic);
+    // If the weak reference is cleared, we have a new chance to become
+    // monomorphic.
+    Comment("check if weak reference is cleared");
+    Branch(IsClearedWeakHeapObject(feedback), &initialize, &mark_megamorphic);
 
     BIND(&check_initialized);
     {
       // Check if it is uninitialized.
       Comment("check if uninitialized");
-      Node* is_uninitialized = WordEqual(
-          feedback_element, LoadRoot(Heap::kuninitialized_symbolRootIndex));
+      Node* is_uninitialized =
+          WordEqual(feedback, LoadRoot(Heap::kuninitialized_symbolRootIndex));
       Branch(is_uninitialized, &initialize, &mark_megamorphic);
     }
 
@@ -1182,7 +1183,8 @@ Node* InterpreterAssembler::ConstructWithSpread(Node* target, Node* context,
         }
       }
       BIND(&done_loop);
-      CreateWeakCellInFeedbackVector(feedback_vector, slot_id, new_target);
+      StoreWeakReferenceInFeedbackVector(feedback_vector, slot_id,
+                                         CAST(new_target));
       ReportFeedbackUpdate(feedback_vector, slot_id,
                            "ConstructWithSpread:Initialize");
       Goto(&construct);
@@ -1420,12 +1422,12 @@ Node* InterpreterAssembler::DispatchToBytecodeHandler(Node* handler,
 
 Node* InterpreterAssembler::DispatchToBytecodeHandlerEntry(
     Node* handler_entry, Node* bytecode_offset, Node* target_bytecode) {
-  InterpreterDispatchDescriptor descriptor(isolate());
   // Propagate speculation poisoning.
-  Node* poisoned_handler_entry = PoisonOnSpeculationWord(handler_entry);
+  Node* poisoned_handler_entry = WordPoisonOnSpeculation(handler_entry);
   return TailCallBytecodeDispatch(
-      descriptor, poisoned_handler_entry, GetAccumulatorUnchecked(),
-      bytecode_offset, BytecodeArrayTaggedPointer(), DispatchTableRawPointer());
+      InterpreterDispatchDescriptor{}, poisoned_handler_entry,
+      GetAccumulatorUnchecked(), bytecode_offset, BytecodeArrayTaggedPointer(),
+      DispatchTableRawPointer());
 }
 
 void InterpreterAssembler::DispatchWide(OperandScale operand_scale) {
@@ -1579,62 +1581,103 @@ bool InterpreterAssembler::TargetSupportsUnalignedAccess() {
 #endif
 }
 
-void InterpreterAssembler::AbortIfRegisterCountInvalid(Node* register_file,
-                                                       Node* register_count) {
-  Node* array_size = LoadAndUntagFixedArrayBaseLength(register_file);
+void InterpreterAssembler::AbortIfRegisterCountInvalid(
+    Node* parameters_and_registers, Node* formal_parameter_count,
+    Node* register_count) {
+  Node* array_size = LoadAndUntagFixedArrayBaseLength(parameters_and_registers);
 
   Label ok(this), abort(this, Label::kDeferred);
-  Branch(UintPtrLessThanOrEqual(register_count, array_size), &ok, &abort);
+  Branch(UintPtrLessThanOrEqual(
+             IntPtrAdd(formal_parameter_count, register_count), array_size),
+         &ok, &abort);
 
   BIND(&abort);
-  Abort(AbortReason::kInvalidRegisterFileInGenerator);
+  Abort(AbortReason::kInvalidParametersAndRegistersInGenerator);
   Goto(&ok);
 
   BIND(&ok);
 }
 
-Node* InterpreterAssembler::ExportRegisterFile(
-    Node* array, const RegListNodePair& registers) {
+Node* InterpreterAssembler::ExportParametersAndRegisterFile(
+    Node* array, const RegListNodePair& registers,
+    Node* formal_parameter_count) {
+  // Store the formal parameters (without receiver) followed by the
+  // registers into the generator's internal parameters_and_registers field.
+  formal_parameter_count = ChangeInt32ToIntPtr(formal_parameter_count);
   Node* register_count = ChangeUint32ToWord(registers.reg_count());
   if (FLAG_debug_code) {
     CSA_ASSERT(this, IntPtrEqual(registers.base_reg_location(),
                                  RegisterLocation(Register(0))));
-    AbortIfRegisterCountInvalid(array, register_count);
+    AbortIfRegisterCountInvalid(array, formal_parameter_count, register_count);
   }
 
-  Variable var_index(this, MachineType::PointerRepresentation());
-  var_index.Bind(IntPtrConstant(0));
-
-  // Iterate over register file and write values into array.
-  // The mapping of register to array index must match that used in
-  // BytecodeGraphBuilder::VisitResumeGenerator.
-  Label loop(this, &var_index), done_loop(this);
-  Goto(&loop);
-  BIND(&loop);
   {
-    Node* index = var_index.value();
-    GotoIfNot(UintPtrLessThan(index, register_count), &done_loop);
+    Variable var_index(this, MachineType::PointerRepresentation());
+    var_index.Bind(IntPtrConstant(0));
 
-    Node* reg_index = IntPtrSub(IntPtrConstant(Register(0).ToOperand()), index);
-    Node* value = LoadRegister(reg_index);
+    // Iterate over parameters and write them into the array.
+    Label loop(this, &var_index), done_loop(this);
 
-    StoreFixedArrayElement(array, index, value);
+    Node* reg_base = IntPtrAdd(
+        IntPtrConstant(Register::FromParameterIndex(0, 1).ToOperand() - 1),
+        formal_parameter_count);
 
-    var_index.Bind(IntPtrAdd(index, IntPtrConstant(1)));
     Goto(&loop);
+    BIND(&loop);
+    {
+      Node* index = var_index.value();
+      GotoIfNot(UintPtrLessThan(index, formal_parameter_count), &done_loop);
+
+      Node* reg_index = IntPtrSub(reg_base, index);
+      Node* value = LoadRegister(reg_index);
+
+      StoreFixedArrayElement(array, index, value);
+
+      var_index.Bind(IntPtrAdd(index, IntPtrConstant(1)));
+      Goto(&loop);
+    }
+    BIND(&done_loop);
+  }
+
+  {
+    // Iterate over register file and write values into array.
+    // The mapping of register to array index must match that used in
+    // BytecodeGraphBuilder::VisitResumeGenerator.
+    Variable var_index(this, MachineType::PointerRepresentation());
+    var_index.Bind(IntPtrConstant(0));
+
+    Label loop(this, &var_index), done_loop(this);
+    Goto(&loop);
+    BIND(&loop);
+    {
+      Node* index = var_index.value();
+      GotoIfNot(UintPtrLessThan(index, register_count), &done_loop);
+
+      Node* reg_index =
+          IntPtrSub(IntPtrConstant(Register(0).ToOperand()), index);
+      Node* value = LoadRegister(reg_index);
+
+      Node* array_index = IntPtrAdd(formal_parameter_count, index);
+      StoreFixedArrayElement(array, array_index, value);
+
+      var_index.Bind(IntPtrAdd(index, IntPtrConstant(1)));
+      Goto(&loop);
+    }
+    BIND(&done_loop);
   }
-  BIND(&done_loop);
 
   return array;
 }
 
-Node* InterpreterAssembler::ImportRegisterFile(
-    Node* array, const RegListNodePair& registers) {
+Node* InterpreterAssembler::ImportRegisterFile(Node* array,
+                                               const RegListNodePair& registers,
+                                               Node* formal_parameter_count) {
+  formal_parameter_count = ChangeInt32ToIntPtr(formal_parameter_count);
   Node* register_count = ChangeUint32ToWord(registers.reg_count());
   if (FLAG_debug_code) {
     CSA_ASSERT(this, IntPtrEqual(registers.base_reg_location(),
                                  RegisterLocation(Register(0))));
-    AbortIfRegisterCountInvalid(array, register_count);
+    AbortIfRegisterCountInvalid(array, formal_parameter_count, register_count);
   }
 
   Variable var_index(this, MachineType::PointerRepresentation());
@@ -1649,12 +1692,14 @@ Node* InterpreterAssembler::ImportRegisterFile(
     Node* index = var_index.value();
     GotoIfNot(UintPtrLessThan(index, register_count), &done_loop);
 
-    Node* value = LoadFixedArrayElement(array, index);
+    Node* array_index = IntPtrAdd(formal_parameter_count, index);
+    Node* value = LoadFixedArrayElement(array, array_index);
 
     Node* reg_index = IntPtrSub(IntPtrConstant(Register(0).ToOperand()), index);
     StoreRegister(value, reg_index);
 
-    StoreFixedArrayElement(array, index, StaleRegisterConstant());
+    StoreFixedArrayElement(array, array_index,
+                           LoadRoot(Heap::kStaleRegisterRootIndex));
 
     var_index.Bind(IntPtrAdd(index, IntPtrConstant(1)));
     Goto(&loop);
diff --git a/deps/v8/src/interpreter/interpreter-assembler.h b/deps/v8/src/interpreter/interpreter-assembler.h
index 6f8ee3d323129a..641d553fd2bad2 100644
--- a/deps/v8/src/interpreter/interpreter-assembler.h
+++ b/deps/v8/src/interpreter/interpreter-assembler.h
@@ -98,10 +98,16 @@ class V8_EXPORT_PRIVATE InterpreterAssembler : public CodeStubAssembler {
   };
 
   // Backup/restore register file to/from a fixed array of the correct length.
-  compiler::Node* ExportRegisterFile(compiler::Node* array,
-                                     const RegListNodePair& registers);
+  // There is an asymmetry between suspend/export and resume/import.
+  // - Suspend copies arguments and registers to the generator.
+  // - Resume copies only the registers from the generator, the arguments
+  //   are copied by the ResumeGenerator trampoline.
+  compiler::Node* ExportParametersAndRegisterFile(
+      compiler::Node* array, const RegListNodePair& registers,
+      compiler::Node* formal_parameter_count);
   compiler::Node* ImportRegisterFile(compiler::Node* array,
-                                     const RegListNodePair& registers);
+                                     const RegListNodePair& registers,
+                                     compiler::Node* formal_parameter_count);
 
   // Loads from and stores to the interpreter register file.
   compiler::Node* LoadRegister(Register reg);
@@ -139,7 +145,7 @@ class V8_EXPORT_PRIVATE InterpreterAssembler : public CodeStubAssembler {
   compiler::Node* LoadAndUntagConstantPoolEntry(compiler::Node* index);
 
   // Load the FeedbackVector for the current function.
-  compiler::Node* LoadFeedbackVector();
+  compiler::TNode<FeedbackVector> LoadFeedbackVector();
 
   // Increment the call count for a CALL_IC or construct call.
   // The call count is located at feedback_vector[slot_id + 1].
@@ -248,7 +254,8 @@ class V8_EXPORT_PRIVATE InterpreterAssembler : public CodeStubAssembler {
   void AbortIfWordNotEqual(compiler::Node* lhs, compiler::Node* rhs,
                            AbortReason abort_reason);
   // Abort if |register_count| is invalid for given register file array.
-  void AbortIfRegisterCountInvalid(compiler::Node* register_file,
+  void AbortIfRegisterCountInvalid(compiler::Node* parameters_and_registers,
+                                   compiler::Node* formal_parameter_count,
                                    compiler::Node* register_count);
 
   // Dispatch to frame dropper trampoline if necessary.
@@ -318,49 +325,49 @@ class V8_EXPORT_PRIVATE InterpreterAssembler : public CodeStubAssembler {
   // do not support unaligned memory accesses.
   compiler::Node* BytecodeOperandReadUnaligned(
       int relative_offset, MachineType result_type,
-      LoadSensitivity needs_poisoning = LoadSensitivity::kNeedsPoisoning);
+      LoadSensitivity needs_poisoning = LoadSensitivity::kCritical);
 
   // Returns zero- or sign-extended to word32 value of the operand.
   compiler::Node* BytecodeOperandUnsignedByte(
       int operand_index,
-      LoadSensitivity needs_poisoning = LoadSensitivity::kNeedsPoisoning);
+      LoadSensitivity needs_poisoning = LoadSensitivity::kCritical);
   compiler::Node* BytecodeOperandSignedByte(
       int operand_index,
-      LoadSensitivity needs_poisoning = LoadSensitivity::kNeedsPoisoning);
+      LoadSensitivity needs_poisoning = LoadSensitivity::kCritical);
   compiler::Node* BytecodeOperandUnsignedShort(
       int operand_index,
-      LoadSensitivity needs_poisoning = LoadSensitivity::kNeedsPoisoning);
+      LoadSensitivity needs_poisoning = LoadSensitivity::kCritical);
   compiler::Node* BytecodeOperandSignedShort(
       int operand_index,
-      LoadSensitivity needs_poisoning = LoadSensitivity::kNeedsPoisoning);
+      LoadSensitivity needs_poisoning = LoadSensitivity::kCritical);
   compiler::Node* BytecodeOperandUnsignedQuad(
       int operand_index,
-      LoadSensitivity needs_poisoning = LoadSensitivity::kNeedsPoisoning);
+      LoadSensitivity needs_poisoning = LoadSensitivity::kCritical);
   compiler::Node* BytecodeOperandSignedQuad(
       int operand_index,
-      LoadSensitivity needs_poisoning = LoadSensitivity::kNeedsPoisoning);
+      LoadSensitivity needs_poisoning = LoadSensitivity::kCritical);
 
   // Returns zero- or sign-extended to word32 value of the operand of
   // given size.
   compiler::Node* BytecodeSignedOperand(
       int operand_index, OperandSize operand_size,
-      LoadSensitivity needs_poisoning = LoadSensitivity::kNeedsPoisoning);
+      LoadSensitivity needs_poisoning = LoadSensitivity::kCritical);
   compiler::Node* BytecodeUnsignedOperand(
       int operand_index, OperandSize operand_size,
-      LoadSensitivity needs_poisoning = LoadSensitivity::kNeedsPoisoning);
+      LoadSensitivity needs_poisoning = LoadSensitivity::kCritical);
 
   // Returns the word-size sign-extended register index for bytecode operand
   // |operand_index| in the current bytecode. Value is not poisoned on
   // speculation since the value loaded from the register is poisoned instead.
   compiler::Node* BytecodeOperandReg(
       int operand_index,
-      LoadSensitivity needs_poisoning = LoadSensitivity::kNeedsPoisoning);
+      LoadSensitivity needs_poisoning = LoadSensitivity::kCritical);
 
   // Returns the word zero-extended index immediate for bytecode operand
   // |operand_index| in the current bytecode for use when loading a .
   compiler::Node* BytecodeOperandConstantPoolIdx(
       int operand_index,
-      LoadSensitivity needs_poisoning = LoadSensitivity::kNeedsPoisoning);
+      LoadSensitivity needs_poisoning = LoadSensitivity::kCritical);
 
   // Jump relative to the current bytecode by the |jump_offset|. If |backward|,
   // then jump backward (subtract the offset), otherwise jump forward (add the
diff --git a/deps/v8/src/interpreter/interpreter-generator.cc b/deps/v8/src/interpreter/interpreter-generator.cc
index 961597ee26edb4..74ebaabcc7e262 100644
--- a/deps/v8/src/interpreter/interpreter-generator.cc
+++ b/deps/v8/src/interpreter/interpreter-generator.cc
@@ -19,6 +19,7 @@
 #include "src/interpreter/interpreter-assembler.h"
 #include "src/interpreter/interpreter-intrinsics-generator.h"
 #include "src/objects-inl.h"
+#include "src/objects/module.h"
 
 namespace v8 {
 namespace internal {
@@ -153,7 +154,7 @@ class InterpreterLoadGlobalAssembler : public InterpreterAssembler {
 
   void LdaGlobal(int slot_operand_index, int name_operand_index,
                  TypeofMode typeof_mode) {
-    TNode<FeedbackVector> feedback_vector = CAST(LoadFeedbackVector());
+    TNode<FeedbackVector> feedback_vector = LoadFeedbackVector();
     Node* feedback_slot = BytecodeOperandIdx(slot_operand_index);
 
     AccessorAssembler accessor_asm(state());
@@ -902,8 +903,8 @@ class InterpreterBitwiseBinaryOpAssembler : public InterpreterAssembler {
     Node* slot_index = BytecodeOperandIdx(1);
     Node* feedback_vector = LoadFeedbackVector();
 
-    VARIABLE(var_left_feedback, MachineRepresentation::kTaggedSigned);
-    VARIABLE(var_right_feedback, MachineRepresentation::kTaggedSigned);
+    TVARIABLE(Smi, var_left_feedback);
+    TVARIABLE(Smi, var_right_feedback);
     VARIABLE(var_left_word32, MachineRepresentation::kWord32);
     VARIABLE(var_right_word32, MachineRepresentation::kWord32);
     VARIABLE(var_left_bigint, MachineRepresentation::kTagged, left);
@@ -919,12 +920,12 @@ class InterpreterBitwiseBinaryOpAssembler : public InterpreterAssembler {
                                        &var_right_word32, &do_bigint_op,
                                        &var_right_bigint, &var_right_feedback);
     BIND(&do_number_op);
-    Node* result = BitwiseOp(var_left_word32.value(), var_right_word32.value(),
-                             bitwise_op);
-    Node* result_type = SelectSmiConstant(TaggedIsSmi(result),
-                                          BinaryOperationFeedback::kSignedSmall,
-                                          BinaryOperationFeedback::kNumber);
-    Node* input_feedback =
+    TNode<Number> result = BitwiseOp(var_left_word32.value(),
+                                     var_right_word32.value(), bitwise_op);
+    TNode<Smi> result_type = SelectSmiConstant(
+        TaggedIsSmi(result), BinaryOperationFeedback::kSignedSmall,
+        BinaryOperationFeedback::kNumber);
+    TNode<Smi> input_feedback =
         SmiOr(var_left_feedback.value(), var_right_feedback.value());
     UpdateFeedback(SmiOr(result_type, input_feedback), feedback_vector,
                    slot_index);
@@ -952,7 +953,7 @@ class InterpreterBitwiseBinaryOpAssembler : public InterpreterAssembler {
     Node* feedback_vector = LoadFeedbackVector();
     Node* context = GetContext();
 
-    VARIABLE(var_left_feedback, MachineRepresentation::kTaggedSigned);
+    TVARIABLE(Smi, var_left_feedback);
     VARIABLE(var_left_word32, MachineRepresentation::kWord32);
     VARIABLE(var_left_bigint, MachineRepresentation::kTagged);
     Label do_smi_op(this), if_bigint_mix(this);
@@ -961,11 +962,11 @@ class InterpreterBitwiseBinaryOpAssembler : public InterpreterAssembler {
                                        &var_left_word32, &if_bigint_mix,
                                        &var_left_bigint, &var_left_feedback);
     BIND(&do_smi_op);
-    Node* result =
+    TNode<Number> result =
         BitwiseOp(var_left_word32.value(), SmiToInt32(right), bitwise_op);
-    Node* result_type = SelectSmiConstant(TaggedIsSmi(result),
-                                          BinaryOperationFeedback::kSignedSmall,
-                                          BinaryOperationFeedback::kNumber);
+    TNode<Smi> result_type = SelectSmiConstant(
+        TaggedIsSmi(result), BinaryOperationFeedback::kSignedSmall,
+        BinaryOperationFeedback::kNumber);
     UpdateFeedback(SmiOr(result_type, var_left_feedback.value()),
                    feedback_vector, slot_index);
     SetAccumulator(result);
@@ -1059,7 +1060,7 @@ IGNITION_HANDLER(BitwiseNot, InterpreterAssembler) {
   Node* context = GetContext();
 
   VARIABLE(var_word32, MachineRepresentation::kWord32);
-  VARIABLE(var_feedback, MachineRepresentation::kTaggedSigned);
+  TVARIABLE(Smi, var_feedback);
   VARIABLE(var_bigint, MachineRepresentation::kTagged);
   Label if_number(this), if_bigint(this);
   TaggedToWord32OrBigIntWithFeedback(context, operand, &if_number, &var_word32,
@@ -1067,10 +1068,11 @@ IGNITION_HANDLER(BitwiseNot, InterpreterAssembler) {
 
   // Number case.
   BIND(&if_number);
-  Node* result = ChangeInt32ToTagged(Signed(Word32Not(var_word32.value())));
-  Node* result_type = SelectSmiConstant(TaggedIsSmi(result),
-                                        BinaryOperationFeedback::kSignedSmall,
-                                        BinaryOperationFeedback::kNumber);
+  TNode<Number> result =
+      ChangeInt32ToTagged(Signed(Word32Not(var_word32.value())));
+  TNode<Smi> result_type = SelectSmiConstant(
+      TaggedIsSmi(result), BinaryOperationFeedback::kSignedSmall,
+      BinaryOperationFeedback::kNumber);
   UpdateFeedback(SmiOr(result_type, var_feedback.value()), feedback_vector,
                  slot_index);
   SetAccumulator(result);
@@ -1122,8 +1124,8 @@ class UnaryNumericOpAssembler : public InterpreterAssembler {
   virtual ~UnaryNumericOpAssembler() {}
 
   // Must return a tagged value.
-  virtual Node* SmiOp(Node* smi_value, Variable* var_feedback,
-                      Label* do_float_op, Variable* var_float) = 0;
+  virtual TNode<Number> SmiOp(TNode<Smi> smi_value, Variable* var_feedback,
+                              Label* do_float_op, Variable* var_float) = 0;
   // Must return a Float64 value.
   virtual Node* FloatOp(Node* float_value) = 0;
   // Must return a tagged value.
@@ -1136,8 +1138,7 @@ class UnaryNumericOpAssembler : public InterpreterAssembler {
 
     VARIABLE(var_result, MachineRepresentation::kTagged);
     VARIABLE(var_float_value, MachineRepresentation::kFloat64);
-    VARIABLE(var_feedback, MachineRepresentation::kTaggedSigned,
-             SmiConstant(BinaryOperationFeedback::kNone));
+    TVARIABLE(Smi, var_feedback, SmiConstant(BinaryOperationFeedback::kNone));
     Variable* loop_vars[] = {&var_value, &var_feedback};
     Label start(this, arraysize(loop_vars), loop_vars), end(this);
     Label do_float_op(this, &var_float_value);
@@ -1159,7 +1160,7 @@ class UnaryNumericOpAssembler : public InterpreterAssembler {
       BIND(&if_smi);
       {
         var_result.Bind(
-            SmiOp(value, &var_feedback, &do_float_op, &var_float_value));
+            SmiOp(CAST(value), &var_feedback, &do_float_op, &var_float_value));
         Goto(&end);
       }
 
@@ -1224,9 +1225,9 @@ class NegateAssemblerImpl : public UnaryNumericOpAssembler {
                                OperandScale operand_scale)
       : UnaryNumericOpAssembler(state, bytecode, operand_scale) {}
 
-  Node* SmiOp(Node* smi_value, Variable* var_feedback, Label* do_float_op,
-              Variable* var_float) override {
-    VARIABLE(var_result, MachineRepresentation::kTagged);
+  TNode<Number> SmiOp(TNode<Smi> smi_value, Variable* var_feedback,
+                      Label* do_float_op, Variable* var_float) override {
+    TVARIABLE(Number, var_result);
     Label if_zero(this), if_min_smi(this), end(this);
     // Return -0 if operand is 0.
     GotoIf(SmiEqual(smi_value, SmiConstant(0)), &if_zero);
@@ -1236,12 +1237,12 @@ class NegateAssemblerImpl : public UnaryNumericOpAssembler {
 
     // Else simply subtract operand from 0.
     CombineFeedback(var_feedback, BinaryOperationFeedback::kSignedSmall);
-    var_result.Bind(SmiSub(SmiConstant(0), smi_value));
+    var_result = SmiSub(SmiConstant(0), smi_value);
     Goto(&end);
 
     BIND(&if_zero);
     CombineFeedback(var_feedback, BinaryOperationFeedback::kNumber);
-    var_result.Bind(MinusZeroConstant());
+    var_result = MinusZeroConstant();
     Goto(&end);
 
     BIND(&if_min_smi);
@@ -1320,29 +1321,24 @@ class IncDecAssembler : public UnaryNumericOpAssembler {
     return op_;
   }
 
-  Node* SmiOp(Node* smi_value, Variable* var_feedback, Label* do_float_op,
-              Variable* var_float) override {
-    // Try fast Smi operation first.
-    Node* value = BitcastTaggedToWord(smi_value);
-    Node* one = BitcastTaggedToWord(SmiConstant(1));
-    Node* pair = op() == Operation::kIncrement
-                     ? IntPtrAddWithOverflow(value, one)
-                     : IntPtrSubWithOverflow(value, one);
-    Node* overflow = Projection(1, pair);
-
-    // Check if the Smi operation overflowed.
+  TNode<Number> SmiOp(TNode<Smi> value, Variable* var_feedback,
+                      Label* do_float_op, Variable* var_float) override {
+    TNode<Smi> one = SmiConstant(1);
     Label if_overflow(this), if_notoverflow(this);
-    Branch(overflow, &if_overflow, &if_notoverflow);
+    TNode<Smi> result = op() == Operation::kIncrement
+                            ? TrySmiAdd(value, one, &if_overflow)
+                            : TrySmiSub(value, one, &if_overflow);
+    Goto(&if_notoverflow);
 
     BIND(&if_overflow);
     {
-      var_float->Bind(SmiToFloat64(smi_value));
+      var_float->Bind(SmiToFloat64(value));
       Goto(do_float_op);
     }
 
     BIND(&if_notoverflow);
     CombineFeedback(var_feedback, BinaryOperationFeedback::kSignedSmall);
-    return BitcastWordToTaggedSigned(Projection(0, pair));
+    return result;
   }
 
   Node* FloatOp(Node* float_value) override {
@@ -1797,18 +1793,14 @@ IGNITION_HANDLER(TestGreaterThanOrEqual, InterpreterCompareOpAssembler) {
   CompareOpWithFeedback(Operation::kGreaterThanOrEqual);
 }
 
-// TestEqualStrictNoFeedback <src>
+// TestReferenceEqual <src>
 //
-// Test if the value in the <src> register is strictly equal to the accumulator.
-// Type feedback is not collected.
-IGNITION_HANDLER(TestEqualStrictNoFeedback, InterpreterAssembler) {
+// Test if the value in the <src> register is equal to the accumulator
+// by means of simple comparison. For SMIs and simple reference comparisons.
+IGNITION_HANDLER(TestReferenceEqual, InterpreterAssembler) {
   Node* lhs = LoadRegisterAtOperandIndex(0);
   Node* rhs = GetAccumulator();
-  // TODO(5310): This is called only when lhs and rhs are Smis (for ex:
-  // try-finally or generators) or strings (only when visiting
-  // ClassLiteralProperties). We should be able to optimize this and not perform
-  // the full strict equality.
-  Node* result = StrictEqual(lhs, rhs);
+  Node* result = SelectBooleanConstant(WordEqual(lhs, rhs));
   SetAccumulator(result);
   Dispatch();
 }
@@ -2416,7 +2408,8 @@ IGNITION_HANDLER(CreateObjectLiteral, InterpreterAssembler) {
   BIND(&if_not_fast_clone);
   {
     // If we can't do a fast clone, call into the runtime.
-    Node* boilerplate_description = LoadConstantPoolEntryAtOperandIndex(0);
+    Node* object_boilerplate_description =
+        LoadConstantPoolEntryAtOperandIndex(0);
     Node* context = GetContext();
 
     Node* flags_raw = DecodeWordFromWord32<CreateObjectLiteralFlags::FlagsBits>(
@@ -2425,7 +2418,7 @@ IGNITION_HANDLER(CreateObjectLiteral, InterpreterAssembler) {
 
     Node* result =
         CallRuntime(Runtime::kCreateObjectLiteral, context, feedback_vector,
-                    SmiTag(slot_id), boilerplate_description, flags);
+                    SmiTag(slot_id), object_boilerplate_description, flags);
     StoreRegisterAtOperandIndex(result, 3);
     // TODO(klaasb) build a single dispatch once the call is inlined
     Dispatch();
@@ -2451,8 +2444,8 @@ IGNITION_HANDLER(CreateEmptyObjectLiteral, InterpreterAssembler) {
 IGNITION_HANDLER(GetTemplateObject, InterpreterAssembler) {
   Node* feedback_vector = LoadFeedbackVector();
   Node* slot = BytecodeOperandIdx(1);
-  Node* cached_value =
-      LoadFeedbackVectorSlot(feedback_vector, slot, 0, INTPTR_PARAMETERS);
+  TNode<Object> cached_value =
+      CAST(LoadFeedbackVectorSlot(feedback_vector, slot, 0, INTPTR_PARAMETERS));
 
   Label call_runtime(this, Label::kDeferred);
   GotoIf(WordEqual(cached_value, SmiConstant(0)), &call_runtime);
@@ -2466,8 +2459,7 @@ IGNITION_HANDLER(GetTemplateObject, InterpreterAssembler) {
     Node* context = GetContext();
     Node* result =
         CallRuntime(Runtime::kCreateTemplateObject, context, description);
-    StoreFeedbackVectorSlot(feedback_vector, slot, result, UPDATE_WRITE_BARRIER,
-                            0, INTPTR_PARAMETERS);
+    StoreFeedbackVectorSlot(feedback_vector, slot, result);
     SetAccumulator(result);
     Dispatch();
   }
@@ -2483,7 +2475,8 @@ IGNITION_HANDLER(CreateClosure, InterpreterAssembler) {
   Node* context = GetContext();
   Node* slot = BytecodeOperandIdx(1);
   Node* feedback_vector = LoadFeedbackVector();
-  Node* feedback_cell = LoadFeedbackVectorSlot(feedback_vector, slot);
+  TNode<Object> feedback_cell =
+      CAST(LoadFeedbackVectorSlot(feedback_vector, slot));
 
   Label if_fast(this), if_slow(this, Label::kDeferred);
   Branch(IsSetWord32<CreateClosureFlags::FastNewClosureBit>(flags), &if_fast,
@@ -2523,71 +2516,65 @@ IGNITION_HANDLER(CreateClosure, InterpreterAssembler) {
 
 // CreateBlockContext <index>
 //
-// Creates a new block context with the scope info constant at |index| and the
-// closure in the accumulator.
+// Creates a new block context with the scope info constant at |index|.
 IGNITION_HANDLER(CreateBlockContext, InterpreterAssembler) {
   Node* scope_info = LoadConstantPoolEntryAtOperandIndex(0);
-  Node* closure = GetAccumulator();
   Node* context = GetContext();
-  SetAccumulator(
-      CallRuntime(Runtime::kPushBlockContext, context, scope_info, closure));
+  SetAccumulator(CallRuntime(Runtime::kPushBlockContext, context, scope_info));
   Dispatch();
 }
 
-// CreateCatchContext <exception> <name_idx> <scope_info_idx>
+// CreateCatchContext <exception> <scope_info_idx>
 //
-// Creates a new context for a catch block with the |exception| in a register,
-// the variable name at |name_idx|, the ScopeInfo at |scope_info_idx|, and the
-// closure in the accumulator.
+// Creates a new context for a catch block with the |exception| in a register
+// and the ScopeInfo at |scope_info_idx|.
 IGNITION_HANDLER(CreateCatchContext, InterpreterAssembler) {
   Node* exception = LoadRegisterAtOperandIndex(0);
-  Node* name = LoadConstantPoolEntryAtOperandIndex(1);
-  Node* scope_info = LoadConstantPoolEntryAtOperandIndex(2);
-  Node* closure = GetAccumulator();
+  Node* scope_info = LoadConstantPoolEntryAtOperandIndex(1);
   Node* context = GetContext();
-  SetAccumulator(CallRuntime(Runtime::kPushCatchContext, context, name,
-                             exception, scope_info, closure));
+  SetAccumulator(
+      CallRuntime(Runtime::kPushCatchContext, context, exception, scope_info));
   Dispatch();
 }
 
-// CreateFunctionContext <slots>
+// CreateFunctionContext <scope_info_idx> <slots>
 //
 // Creates a new context with number of |slots| for the function closure.
 IGNITION_HANDLER(CreateFunctionContext, InterpreterAssembler) {
-  Node* closure = LoadRegister(Register::function_closure());
-  Node* slots = BytecodeOperandUImm(0);
+  Node* scope_info_idx = BytecodeOperandIdx(0);
+  Node* scope_info = LoadConstantPoolEntry(scope_info_idx);
+  Node* slots = BytecodeOperandUImm(1);
   Node* context = GetContext();
   ConstructorBuiltinsAssembler constructor_assembler(state());
   SetAccumulator(constructor_assembler.EmitFastNewFunctionContext(
-      closure, slots, context, FUNCTION_SCOPE));
+      scope_info, slots, context, FUNCTION_SCOPE));
   Dispatch();
 }
 
-// CreateEvalContext <slots>
+// CreateEvalContext <scope_info_idx> <slots>
 //
 // Creates a new context with number of |slots| for an eval closure.
 IGNITION_HANDLER(CreateEvalContext, InterpreterAssembler) {
-  Node* closure = LoadRegister(Register::function_closure());
-  Node* slots = BytecodeOperandUImm(0);
+  Node* scope_info_idx = BytecodeOperandIdx(0);
+  Node* scope_info = LoadConstantPoolEntry(scope_info_idx);
+  Node* slots = BytecodeOperandUImm(1);
   Node* context = GetContext();
   ConstructorBuiltinsAssembler constructor_assembler(state());
   SetAccumulator(constructor_assembler.EmitFastNewFunctionContext(
-      closure, slots, context, EVAL_SCOPE));
+      scope_info, slots, context, EVAL_SCOPE));
   Dispatch();
 }
 
 // CreateWithContext <register> <scope_info_idx>
 //
 // Creates a new context with the ScopeInfo at |scope_info_idx| for a
-// with-statement with the object in |register| and the closure in the
-// accumulator.
+// with-statement with the object in |register|.
 IGNITION_HANDLER(CreateWithContext, InterpreterAssembler) {
   Node* object = LoadRegisterAtOperandIndex(0);
   Node* scope_info = LoadConstantPoolEntryAtOperandIndex(1);
-  Node* closure = GetAccumulator();
   Node* context = GetContext();
-  SetAccumulator(CallRuntime(Runtime::kPushWithContext, context, object,
-                             scope_info, closure));
+  SetAccumulator(
+      CallRuntime(Runtime::kPushWithContext, context, object, scope_info));
   Dispatch();
 }
 
@@ -2660,7 +2647,7 @@ IGNITION_HANDLER(CreateRestParameter, InterpreterAssembler) {
 //
 // Performs a stack guard check.
 IGNITION_HANDLER(StackCheck, InterpreterAssembler) {
-  Node* context = GetContext();
+  TNode<Context> context = CAST(GetContext());
   PerformStackCheck(context);
   Dispatch();
 }
@@ -2980,9 +2967,9 @@ IGNITION_HANDLER(ForInContinue, InterpreterAssembler) {
 // Increments the loop counter in register |index| and stores the result
 // in the accumulator.
 IGNITION_HANDLER(ForInStep, InterpreterAssembler) {
-  Node* index = LoadRegisterAtOperandIndex(0);
-  Node* one = SmiConstant(1);
-  Node* result = SmiAdd(index, one);
+  TNode<Smi> index = CAST(LoadRegisterAtOperandIndex(0));
+  TNode<Smi> one = SmiConstant(1);
+  TNode<Smi> result = SmiAdd(index, one);
   SetAccumulator(result);
   Dispatch();
 }
@@ -3011,18 +2998,26 @@ IGNITION_HANDLER(Illegal, InterpreterAssembler) {
 // SuspendGenerator <generator> <first input register> <register count>
 // <suspend_id>
 //
-// Exports the register file and stores it into the generator.  Also stores the
-// current context, |suspend_id|, and the current bytecode offset (for debugging
-// purposes) into the generator. Then, returns the value in the accumulator.
+// Stores the parameters and the register file in the generator. Also stores
+// the current context, |suspend_id|, and the current bytecode offset
+// (for debugging purposes) into the generator. Then, returns the value
+// in the accumulator.
 IGNITION_HANDLER(SuspendGenerator, InterpreterAssembler) {
   Node* generator = LoadRegisterAtOperandIndex(0);
-  Node* array =
-      LoadObjectField(generator, JSGeneratorObject::kRegisterFileOffset);
+  Node* array = LoadObjectField(
+      generator, JSGeneratorObject::kParametersAndRegistersOffset);
+  Node* closure = LoadRegister(Register::function_closure());
   Node* context = GetContext();
   RegListNodePair registers = GetRegisterListAtOperandIndex(1);
   Node* suspend_id = BytecodeOperandUImmSmi(3);
 
-  ExportRegisterFile(array, registers);
+  Node* shared =
+      LoadObjectField(closure, JSFunction::kSharedFunctionInfoOffset);
+  Node* formal_parameter_count =
+      LoadObjectField(shared, SharedFunctionInfo::kFormalParameterCountOffset,
+                      MachineType::Uint16());
+
+  ExportParametersAndRegisterFile(array, registers, formal_parameter_count);
   StoreObjectField(generator, JSGeneratorObject::kContextOffset, context);
   StoreObjectField(generator, JSGeneratorObject::kContinuationOffset,
                    suspend_id);
@@ -3087,11 +3082,19 @@ IGNITION_HANDLER(SwitchOnGeneratorState, InterpreterAssembler) {
 // state as executing.
 IGNITION_HANDLER(ResumeGenerator, InterpreterAssembler) {
   Node* generator = LoadRegisterAtOperandIndex(0);
+  Node* closure = LoadRegister(Register::function_closure());
   RegListNodePair registers = GetRegisterListAtOperandIndex(1);
 
+  Node* shared =
+      LoadObjectField(closure, JSFunction::kSharedFunctionInfoOffset);
+  Node* formal_parameter_count =
+      LoadObjectField(shared, SharedFunctionInfo::kFormalParameterCountOffset,
+                      MachineType::Uint16());
+
   ImportRegisterFile(
-      LoadObjectField(generator, JSGeneratorObject::kRegisterFileOffset),
-      registers);
+      LoadObjectField(generator,
+                      JSGeneratorObject::kParametersAndRegistersOffset),
+      registers, formal_parameter_count);
 
   // Return the generator's input_or_debug_pos in the accumulator.
   SetAccumulator(
@@ -3105,13 +3108,12 @@ IGNITION_HANDLER(ResumeGenerator, InterpreterAssembler) {
 Handle<Code> GenerateBytecodeHandler(Isolate* isolate, Bytecode bytecode,
                                      OperandScale operand_scale) {
   Zone zone(isolate->allocator(), ZONE_NAME);
-  InterpreterDispatchDescriptor descriptor(isolate);
   compiler::CodeAssemblerState state(
-      isolate, &zone, descriptor, Code::BYTECODE_HANDLER,
+      isolate, &zone, InterpreterDispatchDescriptor{}, Code::BYTECODE_HANDLER,
       Bytecodes::ToString(bytecode),
-      FLAG_untrusted_code_mitigations ? PoisoningMitigationLevel::kOn
-                                      : PoisoningMitigationLevel::kOff,
-      Bytecodes::ReturnCount(bytecode));
+      FLAG_untrusted_code_mitigations
+          ? PoisoningMitigationLevel::kPoisonCriticalOnly
+          : PoisoningMitigationLevel::kDontPoison);
 
   switch (bytecode) {
 #define CALL_GENERATOR(Name, ...)                     \
@@ -3122,14 +3124,15 @@ Handle<Code> GenerateBytecodeHandler(Isolate* isolate, Bytecode bytecode,
 #undef CALL_GENERATOR
   }
 
-  Handle<Code> code = compiler::CodeAssembler::GenerateCode(&state);
+  Handle<Code> code = compiler::CodeAssembler::GenerateCode(
+      &state, AssemblerOptions::Default(isolate));
   PROFILE(isolate, CodeCreateEvent(
                        CodeEventListener::BYTECODE_HANDLER_TAG,
                        AbstractCode::cast(*code),
                        Bytecodes::ToString(bytecode, operand_scale).c_str()));
 #ifdef ENABLE_DISASSEMBLER
   if (FLAG_trace_ignition_codegen) {
-    OFStream os(stdout);
+    StdoutStream os;
     code->Disassemble(Bytecodes::ToString(bytecode), os);
     os << std::flush;
   }
@@ -3171,7 +3174,6 @@ class DeserializeLazyAssembler : public InterpreterAssembler {
 Handle<Code> GenerateDeserializeLazyHandler(Isolate* isolate,
                                             OperandScale operand_scale) {
   Zone zone(isolate->allocator(), ZONE_NAME);
-  const size_t return_count = 0;
 
   std::string debug_name = std::string("DeserializeLazy");
   if (operand_scale > OperandScale::kSingle) {
@@ -3180,22 +3182,23 @@ Handle<Code> GenerateDeserializeLazyHandler(Isolate* isolate,
     debug_name = debug_name.append(Bytecodes::ToString(prefix_bytecode));
   }
 
-  InterpreterDispatchDescriptor descriptor(isolate);
   compiler::CodeAssemblerState state(
-      isolate, &zone, descriptor, Code::BYTECODE_HANDLER, debug_name.c_str(),
-      FLAG_untrusted_code_mitigations ? PoisoningMitigationLevel::kOn
-                                      : PoisoningMitigationLevel::kOff,
-      return_count);
+      isolate, &zone, InterpreterDispatchDescriptor{}, Code::BYTECODE_HANDLER,
+      debug_name.c_str(),
+      FLAG_untrusted_code_mitigations
+          ? PoisoningMitigationLevel::kPoisonCriticalOnly
+          : PoisoningMitigationLevel::kDontPoison);
 
   DeserializeLazyAssembler::Generate(&state, operand_scale);
-  Handle<Code> code = compiler::CodeAssembler::GenerateCode(&state);
+  Handle<Code> code = compiler::CodeAssembler::GenerateCode(
+      &state, AssemblerOptions::Default(isolate));
   PROFILE(isolate,
           CodeCreateEvent(CodeEventListener::BYTECODE_HANDLER_TAG,
                           AbstractCode::cast(*code), debug_name.c_str()));
 
 #ifdef ENABLE_DISASSEMBLER
   if (FLAG_trace_ignition_codegen) {
-    OFStream os(stdout);
+    StdoutStream os;
     code->Disassemble(debug_name.c_str(), os);
     os << std::flush;
   }
diff --git a/deps/v8/src/interpreter/interpreter-intrinsics-generator.cc b/deps/v8/src/interpreter/interpreter-intrinsics-generator.cc
index 0480dec6cc6516..62785d7904ed3a 100644
--- a/deps/v8/src/interpreter/interpreter-intrinsics-generator.cc
+++ b/deps/v8/src/interpreter/interpreter-intrinsics-generator.cc
@@ -170,18 +170,6 @@ Node* IntrinsicsGenerator::IsTypedArray(
   return IsInstanceType(input, JS_TYPED_ARRAY_TYPE);
 }
 
-Node* IntrinsicsGenerator::IsJSMap(
-    const InterpreterAssembler::RegListNodePair& args, Node* context) {
-  Node* input = __ LoadRegisterFromRegisterList(args, 0);
-  return IsInstanceType(input, JS_MAP_TYPE);
-}
-
-Node* IntrinsicsGenerator::IsJSSet(
-    const InterpreterAssembler::RegListNodePair& args, Node* context) {
-  Node* input = __ LoadRegisterFromRegisterList(args, 0);
-  return IsInstanceType(input, JS_SET_TYPE);
-}
-
 Node* IntrinsicsGenerator::IsJSWeakMap(
     const InterpreterAssembler::RegListNodePair& args, Node* context) {
   Node* input = __ LoadRegisterFromRegisterList(args, 0);
diff --git a/deps/v8/src/interpreter/interpreter-intrinsics.h b/deps/v8/src/interpreter/interpreter-intrinsics.h
index 3016183c0b96d7..570caca072197e 100644
--- a/deps/v8/src/interpreter/interpreter-intrinsics.h
+++ b/deps/v8/src/interpreter/interpreter-intrinsics.h
@@ -27,10 +27,8 @@ namespace interpreter {
   V(CreateAsyncFromSyncIterator, create_async_from_sync_iterator, 1)  \
   V(HasProperty, has_property, 2)                                     \
   V(IsArray, is_array, 1)                                             \
-  V(IsJSMap, is_js_map, 1)                                            \
   V(IsJSProxy, is_js_proxy, 1)                                        \
   V(IsJSReceiver, is_js_receiver, 1)                                  \
-  V(IsJSSet, is_js_set, 1)                                            \
   V(IsJSWeakMap, is_js_weak_map, 1)                                   \
   V(IsJSWeakSet, is_js_weak_set, 1)                                   \
   V(IsSmi, is_smi, 1)                                                 \
diff --git a/deps/v8/src/interpreter/interpreter.cc b/deps/v8/src/interpreter/interpreter.cc
index 925adac90fa294..cac8f45f4132e9 100644
--- a/deps/v8/src/interpreter/interpreter.cc
+++ b/deps/v8/src/interpreter/interpreter.cc
@@ -115,7 +115,7 @@ size_t Interpreter::GetDispatchTableIndex(Bytecode bytecode,
 void Interpreter::IterateDispatchTable(RootVisitor* v) {
   for (int i = 0; i < kDispatchTableSize; i++) {
     Address code_entry = dispatch_table_[i];
-    Object* code = code_entry == nullptr
+    Object* code = code_entry == kNullAddress
                        ? nullptr
                        : Code::GetCodeFromTargetAddress(code_entry);
     Object* old_code = code;
@@ -136,7 +136,7 @@ void MaybePrintAst(ParseInfo* parse_info,
                    UnoptimizedCompilationInfo* compilation_info) {
   if (!FLAG_print_ast) return;
 
-  OFStream os(stdout);
+  StdoutStream os;
   std::unique_ptr<char[]> name = compilation_info->literal()->GetDebugName();
   os << "[generating bytecode for function: " << name.get() << "]" << std::endl;
 #ifdef DEBUG
@@ -208,12 +208,12 @@ InterpreterCompilationJob::Status InterpreterCompilationJob::FinalizeJobImpl(
   }
 
   if (ShouldPrintBytecode(shared_info)) {
-    OFStream os(stdout);
+    StdoutStream os;
     std::unique_ptr<char[]> name =
         compilation_info()->literal()->GetDebugName();
     os << "[generated bytecode for function: " << name.get() << "]"
        << std::endl;
-    bytecodes->Disassemble(os);
+    bytecodes->Disassemble(isolate, os);
     os << std::flush;
   }
 
@@ -230,10 +230,10 @@ UnoptimizedCompilationJob* Interpreter::NewCompilationJob(
 }
 
 bool Interpreter::IsDispatchTableInitialized() const {
-  return dispatch_table_[0] != nullptr;
+  return dispatch_table_[0] != kNullAddress;
 }
 
-const char* Interpreter::LookupNameOfBytecodeHandler(Code* code) {
+const char* Interpreter::LookupNameOfBytecodeHandler(const Code* code) {
 #ifdef ENABLE_DISASSEMBLER
 #define RETURN_NAME(Name, ...)                                 \
   if (dispatch_table_[Bytecodes::ToByte(Bytecode::k##Name)] == \
diff --git a/deps/v8/src/interpreter/interpreter.h b/deps/v8/src/interpreter/interpreter.h
index 711aea80294c35..5ded89379876be 100644
--- a/deps/v8/src/interpreter/interpreter.h
+++ b/deps/v8/src/interpreter/interpreter.h
@@ -65,7 +65,7 @@ class Interpreter {
   void IterateDispatchTable(RootVisitor* v);
 
   // Disassembler support (only useful with ENABLE_DISASSEMBLER defined).
-  const char* LookupNameOfBytecodeHandler(Code* code);
+  const char* LookupNameOfBytecodeHandler(const Code* code);
 
   V8_EXPORT_PRIVATE Local<v8::Object> GetDispatchCountersObject();
 
diff --git a/deps/v8/src/interpreter/setup-interpreter-internal.cc b/deps/v8/src/interpreter/setup-interpreter-internal.cc
index a4b8b2a33ffc39..2e0a7d8ca528e4 100644
--- a/deps/v8/src/interpreter/setup-interpreter-internal.cc
+++ b/deps/v8/src/interpreter/setup-interpreter-internal.cc
@@ -51,7 +51,7 @@ void SetupInterpreter::InstallBytecodeHandlers(Interpreter* interpreter) {
   size_t illegal_index = Interpreter::GetDispatchTableIndex(
       Bytecode::kIllegal, OperandScale::kSingle);
   for (size_t index = 0; index < Interpreter::kDispatchTableSize; ++index) {
-    if (dispatch_table[index] == nullptr) {
+    if (dispatch_table[index] == kNullAddress) {
       dispatch_table[index] = dispatch_table[illegal_index];
     }
   }
@@ -84,6 +84,13 @@ void SetupInterpreter::InstallBytecodeHandler(Isolate* isolate,
   dispatch_table[index] = code->entry();
 
   if (FLAG_print_builtin_size) PrintBuiltinSize(bytecode, operand_scale, code);
+
+#ifdef ENABLE_DISASSEMBLER
+  if (FLAG_print_builtin_code) {
+    std::string name = Bytecodes::ToString(bytecode, operand_scale);
+    code->PrintBuiltinCode(isolate, name.c_str());
+  }
+#endif  // ENABLE_DISASSEMBLER
 }
 
 }  // namespace interpreter
diff --git a/deps/v8/src/intl.cc b/deps/v8/src/intl.cc
index 139bb4daf549ea..a4d3262d74dc1b 100644
--- a/deps/v8/src/intl.cc
+++ b/deps/v8/src/intl.cc
@@ -166,7 +166,7 @@ V8_WARN_UNUSED_RESULT Object* LocaleConvertCase(Handle<String> s,
   Handle<SeqTwoByteString> result;
   std::unique_ptr<uc16[]> sap;
 
-  if (dest_length == 0) return isolate->heap()->empty_string();
+  if (dest_length == 0) return ReadOnlyRoots(isolate).empty_string();
 
   // This is not a real loop. It'll be executed only once (no overflow) or
   // twice (overflow).
diff --git a/deps/v8/src/intl.h b/deps/v8/src/intl.h
index 627cb4980de76e..e5d3441164ba48 100644
--- a/deps/v8/src/intl.h
+++ b/deps/v8/src/intl.h
@@ -23,6 +23,14 @@ class TimeZone;
 namespace v8 {
 namespace internal {
 
+enum class IcuService {
+  kBreakIterator,
+  kCollator,
+  kDateFormat,
+  kNumberFormat,
+  kPluralRules
+};
+
 const UChar* GetUCharBufferFromFlat(const String::FlatContent& flat,
                                     std::unique_ptr<uc16[]>* dest,
                                     int32_t length);
diff --git a/deps/v8/src/isolate-inl.h b/deps/v8/src/isolate-inl.h
index 2d982f009f82b7..7a43f1367fc421 100644
--- a/deps/v8/src/isolate-inl.h
+++ b/deps/v8/src/isolate-inl.h
@@ -38,7 +38,7 @@ void Isolate::set_pending_exception(Object* exception_obj) {
 
 void Isolate::clear_pending_exception() {
   DCHECK(!thread_local_top_.pending_exception_->IsException(this));
-  thread_local_top_.pending_exception_ = heap_.the_hole_value();
+  thread_local_top_.pending_exception_ = ReadOnlyRoots(this).the_hole_value();
 }
 
 
@@ -60,7 +60,7 @@ void Isolate::clear_wasm_caught_exception() {
 }
 
 void Isolate::clear_pending_message() {
-  thread_local_top_.pending_message_obj_ = heap_.the_hole_value();
+  thread_local_top_.pending_message_obj_ = ReadOnlyRoots(this).the_hole_value();
 }
 
 
@@ -73,17 +73,18 @@ Object* Isolate::scheduled_exception() {
 
 bool Isolate::has_scheduled_exception() {
   DCHECK(!thread_local_top_.scheduled_exception_->IsException(this));
-  return thread_local_top_.scheduled_exception_ != heap_.the_hole_value();
+  return thread_local_top_.scheduled_exception_ !=
+         ReadOnlyRoots(this).the_hole_value();
 }
 
 
 void Isolate::clear_scheduled_exception() {
   DCHECK(!thread_local_top_.scheduled_exception_->IsException(this));
-  thread_local_top_.scheduled_exception_ = heap_.the_hole_value();
+  thread_local_top_.scheduled_exception_ = ReadOnlyRoots(this).the_hole_value();
 }
 
 bool Isolate::is_catchable_by_javascript(Object* exception) {
-  return exception != heap()->termination_exception();
+  return exception != ReadOnlyRoots(heap()).termination_exception();
 }
 
 void Isolate::FireBeforeCallEnteredCallback() {
diff --git a/deps/v8/src/isolate.cc b/deps/v8/src/isolate.cc
index 7ef0214f4a6462..2291310188175a 100644
--- a/deps/v8/src/isolate.cc
+++ b/deps/v8/src/isolate.cc
@@ -41,8 +41,10 @@
 #include "src/log.h"
 #include "src/messages.h"
 #include "src/objects/frame-array-inl.h"
+#include "src/objects/hash-table-inl.h"
+#include "src/objects/module-inl.h"
 #include "src/objects/promise-inl.h"
-#include "src/profiler/cpu-profiler.h"
+#include "src/profiler/tracing-cpu-profiler.h"
 #include "src/prototype.h"
 #include "src/regexp/regexp-stack.h"
 #include "src/runtime-profiler.h"
@@ -56,18 +58,31 @@
 #include "src/version.h"
 #include "src/visitors.h"
 #include "src/vm-state-inl.h"
-#include "src/wasm/compilation-manager.h"
 #include "src/wasm/wasm-code-manager.h"
 #include "src/wasm/wasm-engine.h"
 #include "src/wasm/wasm-objects.h"
 #include "src/zone/accounting-allocator.h"
+#ifdef V8_INTL_SUPPORT
+#include "unicode/regex.h"
+#endif  // V8_INTL_SUPPORT
 
 namespace v8 {
 namespace internal {
 
+#ifdef DEBUG
+#define TRACE_ISOLATE(tag)                                                  \
+  do {                                                                      \
+    if (FLAG_trace_isolates) {                                              \
+      PrintF("Isolate %p (id %d)" #tag "\n", reinterpret_cast<void*>(this), \
+             id());                                                         \
+    }                                                                       \
+  } while (false)
+#else
+#define TRACE_ISOLATE(tag)
+#endif
+
 base::Atomic32 ThreadId::highest_thread_id_ = 0;
 
-#ifdef V8_EMBEDDED_BUILTINS
 extern const uint8_t* DefaultEmbeddedBlob();
 extern uint32_t DefaultEmbeddedBlobSize();
 
@@ -94,6 +109,15 @@ void Isolate::SetEmbeddedBlob(const uint8_t* blob, uint32_t blob_size) {
   embedded_blob_size_ = blob_size;
   current_embedded_blob_.store(blob, std::memory_order_relaxed);
   current_embedded_blob_size_.store(blob_size, std::memory_order_relaxed);
+
+#ifdef DEBUG
+  if (blob != nullptr) {
+    // Verify that the contents of the embedded blob are unchanged from
+    // serialization-time, just to ensure the compiler isn't messing with us.
+    EmbeddedData d = EmbeddedData::FromBlob();
+    CHECK_EQ(d.Hash(), d.CreateHash());
+  }
+#endif  // DEBUG
 }
 
 const uint8_t* Isolate::embedded_blob() const { return embedded_blob_; }
@@ -109,7 +133,6 @@ uint32_t Isolate::CurrentEmbeddedBlobSize() {
   return current_embedded_blob_size_.load(
       std::memory_order::memory_order_relaxed);
 }
-#endif  // V8_EMBEDDED_BUILTINS
 
 int ThreadId::AllocateThreadId() {
   int new_id = base::Relaxed_AtomicIncrement(&highest_thread_id_, 1);
@@ -139,7 +162,7 @@ void ThreadLocalTop::InitializeInternal() {
 #ifdef USE_SIMULATOR
   simulator_ = nullptr;
 #endif
-  js_entry_sp_ = nullptr;
+  js_entry_sp_ = kNullAddress;
   external_callback_scope_ = nullptr;
   current_vm_state_ = EXTERNAL;
   try_catch_handler_ = nullptr;
@@ -390,6 +413,7 @@ StackTraceFailureMessage::StackTraceFailureMessage(Isolate* isolate, void* ptr1,
   size_t i = 0;
   StackFrameIterator it(isolate);
   for (; !it.done() && i < code_objects_length; it.Advance()) {
+    if (it.frame()->type() == StackFrame::INTERNAL) continue;
     code_objects_[i++] = it.frame()->unchecked_code();
   }
 }
@@ -461,7 +485,7 @@ class FrameArrayBuilder {
         }
         Handle<WasmInstanceObject> instance = summary.wasm_instance();
         int flags = 0;
-        if (instance->compiled_module()->shared()->is_asm_js()) {
+        if (instance->module_object()->is_asm_js()) {
           flags |= FrameArray::kIsAsmJsWasmFrame;
           if (WasmCompiledFrame::cast(frame)->at_to_number_conversion()) {
             flags |= FrameArray::kAsmJsAtNumberConversion;
@@ -480,7 +504,7 @@ class FrameArrayBuilder {
         const auto& summary = summ.AsWasmInterpreted();
         Handle<WasmInstanceObject> instance = summary.wasm_instance();
         int flags = FrameArray::kIsWasmInterpretedFrame;
-        DCHECK(!instance->compiled_module()->shared()->is_asm_js());
+        DCHECK(!instance->module_object()->is_asm_js());
         elements_ = FrameArray::AppendWasmFrame(elements_, instance,
                                                 summary.function_index(), {},
                                                 summary.byte_offset(), flags);
@@ -698,7 +722,7 @@ Address Isolate::GetAbstractPC(int* line, int* column) {
   if (it.done()) {
     *line = -1;
     *column = -1;
-    return nullptr;
+    return kNullAddress;
   }
   JavaScriptFrame* frame = it.frame();
   DCHECK(!frame->is_builtin());
@@ -756,12 +780,8 @@ class CaptureStackTraceHelper {
       int entry = cache->FindEntry(code_offset);
       if (entry != NumberDictionary::kNotFound) {
         Handle<StackFrameInfo> frame(
-            StackFrameInfo::cast(cache->ValueAt(entry)));
-        DCHECK(frame->function_name()->IsString());
-        Handle<String> function_name = summ.FunctionName();
-        if (function_name->Equals(String::cast(frame->function_name()))) {
-          return frame;
-        }
+            StackFrameInfo::cast(cache->ValueAt(entry)), isolate_);
+        return frame;
       }
     }
 
@@ -797,10 +817,10 @@ class CaptureStackTraceHelper {
       const FrameSummary::WasmFrameSummary& summ) {
     Handle<StackFrameInfo> info = factory()->NewStackFrameInfo();
 
-    Handle<WasmSharedModuleData> shared(
-        summ.wasm_instance()->compiled_module()->shared(), isolate_);
-    Handle<String> name = WasmSharedModuleData::GetFunctionName(
-        isolate_, shared, summ.function_index());
+    Handle<WasmModuleObject> module_object(
+        summ.wasm_instance()->module_object(), isolate_);
+    Handle<String> name = WasmModuleObject::GetFunctionName(
+        isolate_, module_object, summ.function_index());
     info->set_function_name(*name);
     // Encode the function index as line number (1-based).
     info->set_line_number(summ.function_index() + 1);
@@ -856,8 +876,7 @@ Handle<FixedArray> Isolate::CaptureCurrentStackTrace(
       frames_seen++;
     }
   }
-  stack_trace_elems->Shrink(frames_seen);
-  return stack_trace_elems;
+  return FixedArray::ShrinkOrEmpty(stack_trace_elems, frames_seen);
 }
 
 
@@ -1027,12 +1046,12 @@ Object* Isolate::StackOverflow() {
   }
 #endif  // VERIFY_HEAP
 
-  return heap()->exception();
+  return ReadOnlyRoots(heap()).exception();
 }
 
 
 Object* Isolate::TerminateExecution() {
-  return Throw(heap_.termination_exception(), nullptr);
+  return Throw(ReadOnlyRoots(this).termination_exception(), nullptr);
 }
 
 
@@ -1041,12 +1060,12 @@ void Isolate::CancelTerminateExecution() {
     try_catch_handler()->has_terminated_ = false;
   }
   if (has_pending_exception() &&
-      pending_exception() == heap_.termination_exception()) {
+      pending_exception() == ReadOnlyRoots(this).termination_exception()) {
     thread_local_top()->external_caught_exception_ = false;
     clear_pending_exception();
   }
   if (has_scheduled_exception() &&
-      scheduled_exception() == heap_.termination_exception()) {
+      scheduled_exception() == ReadOnlyRoots(this).termination_exception()) {
     thread_local_top()->external_caught_exception_ = false;
     clear_scheduled_exception();
   }
@@ -1111,7 +1130,8 @@ void ReportBootstrappingException(Handle<Object> exception,
   // Since comments and empty lines have been stripped from the source of
   // builtins, print the actual source here so that line numbers match.
   if (location->script()->source()->IsString()) {
-    Handle<String> src(String::cast(location->script()->source()));
+    Handle<String> src(String::cast(location->script()->source()),
+                       location->script()->GetIsolate());
     PrintF("Failing script:");
     int len = src->length();
     if (len == 0) {
@@ -1144,11 +1164,11 @@ bool Isolate::is_catchable_by_wasm(Object* exception) {
       .IsJust();
 }
 
-Object* Isolate::Throw(Object* exception, MessageLocation* location) {
+Object* Isolate::Throw(Object* raw_exception, MessageLocation* location) {
   DCHECK(!has_pending_exception());
 
   HandleScope scope(this);
-  Handle<Object> exception_handle(exception, this);
+  Handle<Object> exception(raw_exception, this);
 
   if (FLAG_print_all_exceptions) {
     printf("=========================================================\n");
@@ -1173,11 +1193,13 @@ Object* Isolate::Throw(Object* exception, MessageLocation* location) {
                Script::GetColumnNumber(script, location->start_pos()),
                Script::GetLineNumber(script, location->end_pos()) + 1,
                Script::GetColumnNumber(script, location->end_pos()));
+        // Make sure to update the raw exception pointer in case it moved.
+        raw_exception = *exception;
       } else {
         printf(", line %d\n", script->GetLineNumber(location->start_pos()) + 1);
       }
     }
-    exception->Print();
+    raw_exception->Print(this);
     printf("Stack Trace:\n");
     PrintStack(stdout);
     printf("=========================================================\n");
@@ -1199,8 +1221,8 @@ Object* Isolate::Throw(Object* exception, MessageLocation* location) {
   thread_local_top()->rethrowing_message_ = false;
 
   // Notify debugger of exception.
-  if (is_catchable_by_javascript(exception)) {
-    debug()->OnThrow(exception_handle);
+  if (is_catchable_by_javascript(raw_exception)) {
+    debug()->OnThrow(exception);
   }
 
   // Generate the message if required.
@@ -1215,9 +1237,9 @@ Object* Isolate::Throw(Object* exception, MessageLocation* location) {
       // It's not safe to try to make message objects or collect stack traces
       // while the bootstrapper is active since the infrastructure may not have
       // been properly initialized.
-      ReportBootstrappingException(exception_handle, location);
+      ReportBootstrappingException(exception, location);
     } else {
-      Handle<Object> message_obj = CreateMessage(exception_handle, location);
+      Handle<Object> message_obj = CreateMessage(exception, location);
       thread_local_top()->pending_message_obj_ = *message_obj;
 
       // For any exception not caught by JavaScript, even when an external
@@ -1246,8 +1268,8 @@ Object* Isolate::Throw(Object* exception, MessageLocation* location) {
   }
 
   // Set the exception being thrown.
-  set_pending_exception(*exception_handle);
-  return heap()->exception();
+  set_pending_exception(*exception);
+  return ReadOnlyRoots(heap()).exception();
 }
 
 
@@ -1256,7 +1278,7 @@ Object* Isolate::ReThrow(Object* exception) {
 
   // Set the exception being re-thrown.
   set_pending_exception(exception);
-  return heap()->exception();
+  return ReadOnlyRoots(heap()).exception();
 }
 
 
@@ -1267,7 +1289,7 @@ Object* Isolate::UnwindAndFindHandler() {
                           intptr_t handler_offset,
                           Address constant_pool_address, Address handler_sp,
                           Address handler_fp) {
-    // Store information to be consumed by the CEntryStub.
+    // Store information to be consumed by the CEntry.
     thread_local_top()->pending_handler_context_ = context;
     thread_local_top()->pending_handler_entrypoint_ =
         instruction_start + handler_offset;
@@ -1335,7 +1357,7 @@ Object* Isolate::UnwindAndFindHandler() {
         set_wasm_caught_exception(exception);
         wasm::WasmCode* wasm_code =
             wasm_engine()->code_manager()->LookupCode(frame->pc());
-        return FoundHandler(nullptr, wasm_code->instructions().start(), offset,
+        return FoundHandler(nullptr, wasm_code->instruction_start(), offset,
                             wasm_code->constant_pool(), return_sp, frame->fp());
       }
 
@@ -1546,8 +1568,10 @@ Isolate::CatchType Isolate::PredictExceptionCatcher() {
         Address entry_handler = frame->top_handler()->next()->address();
         // The exception has been externally caught if and only if there is an
         // external handler which is on top of the top-most JS_ENTRY handler.
-        if (external_handler != nullptr && !try_catch_handler()->is_verbose_) {
-          if (entry_handler == nullptr || entry_handler > external_handler) {
+        if (external_handler != kNullAddress &&
+            !try_catch_handler()->is_verbose_) {
+          if (entry_handler == kNullAddress ||
+              entry_handler > external_handler) {
             return CAUGHT_BY_EXTERNAL;
           }
         }
@@ -1564,7 +1588,7 @@ Isolate::CatchType Isolate::PredictExceptionCatcher() {
       } break;
 
       case StackFrame::STUB: {
-        Handle<Code> code(frame->LookupCode());
+        Handle<Code> code(frame->LookupCode(), this);
         if (!code->IsCode() || code->kind() != Code::BUILTIN ||
             !code->handler_table_offset() || !code->is_turbofanned()) {
           break;
@@ -1575,7 +1599,7 @@ Isolate::CatchType Isolate::PredictExceptionCatcher() {
       } break;
 
       case StackFrame::JAVA_SCRIPT_BUILTIN_CONTINUATION_WITH_CATCH: {
-        Handle<Code> code(frame->LookupCode());
+        Handle<Code> code(frame->LookupCode(), this);
         CatchType prediction = ToCatchType(code->GetBuiltinCatchPrediction());
         if (prediction != NOT_CAUGHT) return prediction;
       } break;
@@ -1592,7 +1616,7 @@ Isolate::CatchType Isolate::PredictExceptionCatcher() {
 
 Object* Isolate::ThrowIllegalOperation() {
   if (FLAG_stack_trace_on_illegal) PrintStack(stdout);
-  return Throw(heap()->illegal_access_string());
+  return Throw(ReadOnlyRoots(heap()).illegal_access_string());
 }
 
 
@@ -1623,7 +1647,8 @@ void Isolate::RestorePendingMessageFromTryCatch(v8::TryCatch* handler) {
 void Isolate::CancelScheduledExceptionFromTryCatch(v8::TryCatch* handler) {
   DCHECK(has_scheduled_exception());
   if (scheduled_exception() == handler->exception_) {
-    DCHECK(scheduled_exception() != heap()->termination_exception());
+    DCHECK(scheduled_exception() !=
+           ReadOnlyRoots(heap()).termination_exception());
     clear_scheduled_exception();
   }
   if (thread_local_top_.pending_message_obj_ == handler->message_obj_) {
@@ -1649,8 +1674,17 @@ void Isolate::PrintCurrentStackTrace(FILE* out) {
 
     Handle<Object> receiver(frame->receiver(), this);
     Handle<JSFunction> function(frame->function(), this);
-    Handle<AbstractCode> code(AbstractCode::cast(frame->LookupCode()), this);
-    const int offset = static_cast<int>(frame->pc() - code->InstructionStart());
+    Handle<AbstractCode> code;
+    int offset;
+    if (frame->is_interpreted()) {
+      InterpretedFrame* interpreted_frame = InterpretedFrame::cast(frame);
+      code = handle(AbstractCode::cast(interpreted_frame->GetBytecodeArray()),
+                    this);
+      offset = interpreted_frame->GetBytecodeOffset();
+    } else {
+      code = handle(AbstractCode::cast(frame->LookupCode()), this);
+      offset = static_cast<int>(frame->pc() - code->InstructionStart());
+    }
 
     JSStackFrame site(this, receiver, function, code, offset);
     Handle<String> line = site.ToString().ToHandleChecked();
@@ -1680,7 +1714,7 @@ bool Isolate::ComputeLocation(MessageLocation* target) {
   }
 
   if (summary.IsJavaScript()) {
-    shared = handle(summary.AsJavaScript().function()->shared());
+    shared = handle(summary.AsJavaScript().function()->shared(), this);
   }
   *target = MessageLocation(Handle<Script>::cast(script), pos, pos + 1, shared);
   return true;
@@ -1707,7 +1741,7 @@ bool Isolate::ComputeLocationFromException(MessageLocation* target,
       Handle<JSObject>::cast(exception), script_symbol);
   if (!script->IsScript()) return false;
 
-  Handle<Script> cast_script(Script::cast(*script));
+  Handle<Script> cast_script(Script::cast(*script), this);
   *target = MessageLocation(cast_script, start_pos_value, end_pos_value);
   return true;
 }
@@ -1722,13 +1756,13 @@ bool Isolate::ComputeLocationFromStackTrace(MessageLocation* target,
   if (!property->IsJSArray()) return false;
   Handle<JSArray> simple_stack_trace = Handle<JSArray>::cast(property);
 
-  Handle<FrameArray> elements(FrameArray::cast(simple_stack_trace->elements()));
+  Handle<FrameArray> elements(FrameArray::cast(simple_stack_trace->elements()),
+                              this);
 
   const int frame_count = elements->FrameCount();
   for (int i = 0; i < frame_count; i++) {
     if (elements->IsWasmFrame(i) || elements->IsAsmJsWasmFrame(i)) {
-      Handle<WasmCompiledModule> compiled_module(
-          elements->WasmInstance(i)->compiled_module());
+      Handle<WasmInstanceObject> instance(elements->WasmInstance(i), this);
       uint32_t func_index =
           static_cast<uint32_t>(elements->WasmFunctionIndex(i)->value());
       int code_offset = elements->Offset(i)->value();
@@ -1737,16 +1771,16 @@ bool Isolate::ComputeLocationFromStackTrace(MessageLocation* target,
       // a second lookup here could lead to inconsistency.
       int byte_offset =
           FrameSummary::WasmCompiledFrameSummary::GetWasmSourcePosition(
-              compiled_module->GetNativeModule()->GetCode(func_index),
+              instance->module_object()->native_module()->code(func_index),
               code_offset);
 
       bool is_at_number_conversion =
           elements->IsAsmJsWasmFrame(i) &&
           elements->Flags(i)->value() & FrameArray::kAsmJsAtNumberConversion;
-      int pos = WasmSharedModuleData::GetSourcePosition(
-          handle(compiled_module->shared(), this), func_index, byte_offset,
+      int pos = WasmModuleObject::GetSourcePosition(
+          handle(instance->module_object(), this), func_index, byte_offset,
           is_at_number_conversion);
-      Handle<Script> script(compiled_module->shared()->script());
+      Handle<Script> script(instance->module_object()->script(), this);
 
       *target = MessageLocation(script, pos, pos + 1);
       return true;
@@ -1762,7 +1796,7 @@ bool Isolate::ComputeLocationFromStackTrace(MessageLocation* target,
       const int code_offset = elements->Offset(i)->value();
       const int pos = abstract_code->SourcePosition(code_offset);
 
-      Handle<Script> casted_script(Script::cast(script));
+      Handle<Script> casted_script(Script::cast(script), this);
       *target = MessageLocation(casted_script, pos, pos + 1);
       return true;
     }
@@ -1805,19 +1839,19 @@ Handle<JSMessageObject> Isolate::CreateMessage(Handle<Object> exception,
 
 
 bool Isolate::IsJavaScriptHandlerOnTop(Object* exception) {
-  DCHECK_NE(heap()->the_hole_value(), exception);
+  DCHECK_NE(ReadOnlyRoots(heap()).the_hole_value(), exception);
 
   // For uncatchable exceptions, the JavaScript handler cannot be on top.
   if (!is_catchable_by_javascript(exception)) return false;
 
   // Get the top-most JS_ENTRY handler, cannot be on top if it doesn't exist.
   Address entry_handler = Isolate::handler(thread_local_top());
-  if (entry_handler == nullptr) return false;
+  if (entry_handler == kNullAddress) return false;
 
   // Get the address of the external handler so we can compare the address to
   // determine which one is closer to the top of the stack.
   Address external_handler = thread_local_top()->try_catch_handler_address();
-  if (external_handler == nullptr) return true;
+  if (external_handler == kNullAddress) return true;
 
   // The exception has been externally caught if and only if there is an
   // external handler which is on top of the top-most JS_ENTRY handler.
@@ -1830,19 +1864,19 @@ bool Isolate::IsJavaScriptHandlerOnTop(Object* exception) {
 
 
 bool Isolate::IsExternalHandlerOnTop(Object* exception) {
-  DCHECK_NE(heap()->the_hole_value(), exception);
+  DCHECK_NE(ReadOnlyRoots(heap()).the_hole_value(), exception);
 
   // Get the address of the external handler so we can compare the address to
   // determine which one is closer to the top of the stack.
   Address external_handler = thread_local_top()->try_catch_handler_address();
-  if (external_handler == nullptr) return false;
+  if (external_handler == kNullAddress) return false;
 
   // For uncatchable exceptions, the external handler is always on top.
   if (!is_catchable_by_javascript(exception)) return true;
 
   // Get the top-most JS_ENTRY handler, cannot be on top if it doesn't exist.
   Address entry_handler = Isolate::handler(thread_local_top());
-  if (entry_handler == nullptr) return true;
+  if (entry_handler == kNullAddress) return true;
 
   // The exception has been externally caught if and only if there is an
   // external handler which is on top of the top-most JS_ENTRY handler.
@@ -1880,8 +1914,7 @@ void Isolate::ReportPendingMessagesImpl(bool report_externally) {
   if (!message_obj->IsTheHole(this) && should_report_exception) {
     HandleScope scope(this);
     Handle<JSMessageObject> message(JSMessageObject::cast(message_obj), this);
-    Handle<JSValue> script_wrapper(JSValue::cast(message->script()), this);
-    Handle<Script> script(Script::cast(script_wrapper->value()), this);
+    Handle<Script> script(message->script(), this);
     int start_pos = message->start_position();
     int end_pos = message->end_position();
     MessageLocation location(script, start_pos, end_pos);
@@ -1914,25 +1947,25 @@ void Isolate::ReportPendingMessagesFromJavaScript() {
 
     // Get the top-most JS_ENTRY handler, cannot be on top if it doesn't exist.
     Address entry_handler = Isolate::handler(thread_local_top());
-    DCHECK_NOT_NULL(entry_handler);
+    DCHECK_NE(entry_handler, kNullAddress);
     entry_handler =
         reinterpret_cast<StackHandler*>(entry_handler)->next()->address();
 
     // Get the address of the external handler so we can compare the address to
     // determine which one is closer to the top of the stack.
     Address external_handler = thread_local_top()->try_catch_handler_address();
-    if (external_handler == nullptr) return true;
+    if (external_handler == kNullAddress) return true;
 
     return (entry_handler < external_handler);
   };
 
   auto IsHandledExternally = [=]() {
     Address external_handler = thread_local_top()->try_catch_handler_address();
-    if (external_handler == nullptr) return false;
+    if (external_handler == kNullAddress) return false;
 
     // Get the top-most JS_ENTRY handler, cannot be on top if it doesn't exist.
     Address entry_handler = Isolate::handler(thread_local_top());
-    DCHECK_NOT_NULL(entry_handler);
+    DCHECK_NE(entry_handler, kNullAddress);
     entry_handler =
         reinterpret_cast<StackHandler*>(entry_handler)->next()->address();
     return (entry_handler > external_handler);
@@ -1972,12 +2005,12 @@ void Isolate::ReportPendingMessagesFromJavaScript() {
 MessageLocation Isolate::GetMessageLocation() {
   DCHECK(has_pending_exception());
 
-  if (thread_local_top_.pending_exception_ != heap()->termination_exception() &&
+  if (thread_local_top_.pending_exception_ !=
+          ReadOnlyRoots(heap()).termination_exception() &&
       !thread_local_top_.pending_message_obj_->IsTheHole(this)) {
     Handle<JSMessageObject> message_obj(
         JSMessageObject::cast(thread_local_top_.pending_message_obj_), this);
-    Handle<JSValue> script_wrapper(JSValue::cast(message_obj->script()), this);
-    Handle<Script> script(Script::cast(script_wrapper->value()), this);
+    Handle<Script> script(message_obj->script(), this);
     int start_pos = message_obj->start_position();
     int end_pos = message_obj->end_position();
     return MessageLocation(script, start_pos, end_pos);
@@ -1992,7 +2025,7 @@ bool Isolate::OptionalRescheduleException(bool is_bottom_call) {
   PropagatePendingExceptionToExternalTryCatch();
 
   bool is_termination_exception =
-      pending_exception() == heap_.termination_exception();
+      pending_exception() == ReadOnlyRoots(this).termination_exception();
 
   // Do not reschedule the exception if this is the bottom call.
   bool clear_exception = is_bottom_call;
@@ -2007,7 +2040,7 @@ bool Isolate::OptionalRescheduleException(bool is_bottom_call) {
     // If the exception is externally caught, clear it if there are no
     // JavaScript frames on the way to the C++ frame that has the
     // external handler.
-    DCHECK_NOT_NULL(thread_local_top()->try_catch_handler_address());
+    DCHECK_NE(thread_local_top()->try_catch_handler_address(), kNullAddress);
     Address external_handler_address =
         thread_local_top()->try_catch_handler_address();
     JavaScriptFrameIterator it(this);
@@ -2213,24 +2246,8 @@ void Isolate::SetAbortOnUncaughtExceptionCallback(
   abort_on_uncaught_exception_callback_ = callback;
 }
 
-namespace {
-void AdvanceWhileDebugContext(JavaScriptFrameIterator& it, Debug* debug) {
-  if (!debug->in_debug_scope()) return;
-
-  while (!it.done()) {
-    Context* context = Context::cast(it.frame()->context());
-    if (context->native_context() == *debug->debug_context()) {
-      it.Advance();
-    } else {
-      break;
-    }
-  }
-}
-}  // namespace
-
 Handle<Context> Isolate::GetCallingNativeContext() {
   JavaScriptFrameIterator it(this);
-  AdvanceWhileDebugContext(it, debug_);
   if (it.done()) return Handle<Context>::null();
   JavaScriptFrame* frame = it.frame();
   Context* context = Context::cast(frame->context());
@@ -2239,7 +2256,6 @@ Handle<Context> Isolate::GetCallingNativeContext() {
 
 Handle<Context> Isolate::GetIncumbentContext() {
   JavaScriptFrameIterator it(this);
-  AdvanceWhileDebugContext(it, debug_);
 
   // 1st candidate: most-recently-entered author function's context
   // if it's newer than the last Context::BackupIncumbentScope entry.
@@ -2292,43 +2308,39 @@ Isolate::ThreadDataTable::ThreadDataTable() : table_() {}
 
 Isolate::ThreadDataTable::~ThreadDataTable() {}
 
-void Isolate::ReleaseManagedObjects() {
-  Isolate::ManagedObjectFinalizer* current =
-      managed_object_finalizers_list_.next_;
-  managed_object_finalizers_list_.next_ = nullptr;
-  while (current != nullptr) {
-    Isolate::ManagedObjectFinalizer* next = current->next_;
-    current->Dispose();
-    current = next;
+void Isolate::ReleaseSharedPtrs() {
+  while (managed_ptr_destructors_head_) {
+    ManagedPtrDestructor* l = managed_ptr_destructors_head_;
+    ManagedPtrDestructor* n = nullptr;
+    managed_ptr_destructors_head_ = nullptr;
+    for (; l != nullptr; l = n) {
+      l->destructor_(l->shared_ptr_ptr_);
+      n = l->next_;
+      delete l;
+    }
   }
-  // No new managed objects should pop up during finalization.
-  DCHECK_NULL(managed_object_finalizers_list_.next_);
 }
 
-void Isolate::RegisterForReleaseAtTeardown(
-    Isolate::ManagedObjectFinalizer* finalizer) {
-  DCHECK_NOT_NULL(finalizer->value_);
-  DCHECK_NOT_NULL(finalizer->deleter_);
-  DCHECK_NULL(finalizer->prev_);
-  DCHECK_NULL(finalizer->next_);
-
-  // Insert at head. We keep the head alive for the lifetime of the Isolate
-  // because otherwise we can't reset the head, should we delete it before
-  // the isolate expires
-  Isolate::ManagedObjectFinalizer* next = managed_object_finalizers_list_.next_;
-  managed_object_finalizers_list_.next_ = finalizer;
-  finalizer->prev_ = &managed_object_finalizers_list_;
-  finalizer->next_ = next;
-  if (next != nullptr) next->prev_ = finalizer;
+void Isolate::RegisterManagedPtrDestructor(ManagedPtrDestructor* destructor) {
+  DCHECK_NULL(destructor->prev_);
+  DCHECK_NULL(destructor->next_);
+  if (managed_ptr_destructors_head_) {
+    managed_ptr_destructors_head_->prev_ = destructor;
+  }
+  destructor->next_ = managed_ptr_destructors_head_;
+  managed_ptr_destructors_head_ = destructor;
 }
 
-void Isolate::UnregisterFromReleaseAtTeardown(
-    Isolate::ManagedObjectFinalizer* finalizer) {
-  DCHECK_NOT_NULL(finalizer);
-  DCHECK_NOT_NULL(finalizer->prev_);
-
-  finalizer->prev_->next_ = finalizer->next_;
-  if (finalizer->next_ != nullptr) finalizer->next_->prev_ = finalizer->prev_;
+void Isolate::UnregisterManagedPtrDestructor(ManagedPtrDestructor* destructor) {
+  if (destructor->prev_) {
+    destructor->prev_->next_ = destructor->next_;
+  } else {
+    DCHECK_EQ(destructor, managed_ptr_destructors_head_);
+    managed_ptr_destructors_head_ = destructor->next_;
+  }
+  if (destructor->next_) destructor->next_->prev_ = destructor->prev_;
+  destructor->prev_ = nullptr;
+  destructor->next_ = nullptr;
 }
 
 Isolate::PerIsolateThreadData::~PerIsolateThreadData() {
@@ -2363,19 +2375,6 @@ void Isolate::ThreadDataTable::RemoveAllThreads() {
   table_.clear();
 }
 
-
-#ifdef DEBUG
-#define TRACE_ISOLATE(tag)                                              \
-  do {                                                                  \
-    if (FLAG_trace_isolates) {                                          \
-      PrintF("Isolate %p (id %d)" #tag "\n",                            \
-             reinterpret_cast<void*>(this), id());                      \
-    }                                                                   \
-  } while (false)
-#else
-#define TRACE_ISOLATE(tag)
-#endif
-
 class VerboseAccountingAllocator : public AccountingAllocator {
  public:
   VerboseAccountingAllocator(Heap* heap, size_t allocation_sample_bytes,
@@ -2393,12 +2392,11 @@ class VerboseAccountingAllocator : public AccountingAllocator {
       size_t malloced_current = GetCurrentMemoryUsage();
       size_t pooled_current = GetCurrentPoolSize();
 
-      if (last_memory_usage_.Value() + allocation_sample_bytes_ <
-              malloced_current ||
-          last_pool_size_.Value() + pool_sample_bytes_ < pooled_current) {
+      if (last_memory_usage_ + allocation_sample_bytes_ < malloced_current ||
+          last_pool_size_ + pool_sample_bytes_ < pooled_current) {
         PrintMemoryJSON(malloced_current, pooled_current);
-        last_memory_usage_.SetValue(malloced_current);
-        last_pool_size_.SetValue(pooled_current);
+        last_memory_usage_ = malloced_current;
+        last_pool_size_ = pooled_current;
       }
     }
     return memory;
@@ -2409,22 +2407,21 @@ class VerboseAccountingAllocator : public AccountingAllocator {
     size_t malloced_current = GetCurrentMemoryUsage();
     size_t pooled_current = GetCurrentPoolSize();
 
-    if (malloced_current + allocation_sample_bytes_ <
-            last_memory_usage_.Value() ||
-        pooled_current + pool_sample_bytes_ < last_pool_size_.Value()) {
+    if (malloced_current + allocation_sample_bytes_ < last_memory_usage_ ||
+        pooled_current + pool_sample_bytes_ < last_pool_size_) {
       PrintMemoryJSON(malloced_current, pooled_current);
-      last_memory_usage_.SetValue(malloced_current);
-      last_pool_size_.SetValue(pooled_current);
+      last_memory_usage_ = malloced_current;
+      last_pool_size_ = pooled_current;
     }
   }
 
   void ZoneCreation(const Zone* zone) override {
     PrintZoneModificationSample(zone, "zonecreation");
-    nesting_deepth_.Increment(1);
+    nesting_deepth_++;
   }
 
   void ZoneDestruction(const Zone* zone) override {
-    nesting_deepth_.Decrement(1);
+    nesting_deepth_--;
     PrintZoneModificationSample(zone, "zonedestruction");
   }
 
@@ -2443,7 +2440,7 @@ class VerboseAccountingAllocator : public AccountingAllocator {
         type, reinterpret_cast<void*>(heap_->isolate()),
         heap_->isolate()->time_millis_since_init(),
         reinterpret_cast<const void*>(zone), zone->name(),
-        zone->allocation_size(), nesting_deepth_.Value());
+        zone->allocation_size(), nesting_deepth_.load());
   }
 
   void PrintMemoryJSON(size_t malloced, size_t pooled) {
@@ -2462,17 +2459,17 @@ class VerboseAccountingAllocator : public AccountingAllocator {
   }
 
   Heap* heap_;
-  base::AtomicNumber<size_t> last_memory_usage_;
-  base::AtomicNumber<size_t> last_pool_size_;
-  base::AtomicNumber<size_t> nesting_deepth_;
+  std::atomic<size_t> last_memory_usage_;
+  std::atomic<size_t> last_pool_size_;
+  std::atomic<size_t> nesting_deepth_;
   size_t allocation_sample_bytes_, pool_sample_bytes_;
 };
 
 #ifdef DEBUG
-base::AtomicNumber<size_t> Isolate::non_disposed_isolates_;
+std::atomic<size_t> Isolate::non_disposed_isolates_;
 #endif  // DEBUG
 
-Isolate::Isolate(bool enable_serializer)
+Isolate::Isolate()
     : embedder_data_(),
       entry_stack_(nullptr),
       stack_trace_nesting_level_(0),
@@ -2500,24 +2497,32 @@ Isolate::Isolate(bool enable_serializer)
       global_handles_(nullptr),
       eternal_handles_(nullptr),
       thread_manager_(nullptr),
+      builtins_(this),
       setup_delegate_(nullptr),
       regexp_stack_(nullptr),
       date_cache_(nullptr),
-      call_descriptor_data_(nullptr),
       // TODO(bmeurer) Initialized lazily because it depends on flags; can
       // be fixed once the default isolate cleanup is done.
       random_number_generator_(nullptr),
       fuzzer_rng_(nullptr),
       rail_mode_(PERFORMANCE_ANIMATION),
-      promise_hook_or_debug_is_active_(false),
+      atomics_wait_callback_(nullptr),
+      atomics_wait_callback_data_(nullptr),
       promise_hook_(nullptr),
+      host_import_module_dynamically_callback_(nullptr),
+      host_initialize_import_meta_object_callback_(nullptr),
       load_start_time_ms_(0),
-      serializer_enabled_(enable_serializer),
+#ifdef V8_INTL_SUPPORT
+      language_singleton_regexp_matcher_(nullptr),
+      language_tag_regexp_matcher_(nullptr),
+      language_variant_regexp_matcher_(nullptr),
+#endif  // V8_INTL_SUPPORT
+      serializer_enabled_(false),
       has_fatal_error_(false),
       initialized_from_snapshot_(false),
       is_tail_call_elimination_enabled_(true),
       is_isolate_in_background_(false),
-      cpu_profiler_(nullptr),
+      memory_savings_mode_active_(false),
       heap_profiler_(nullptr),
       code_event_dispatcher_(new CodeEventDispatcher()),
       function_entry_hook_(nullptr),
@@ -2550,7 +2555,7 @@ Isolate::Isolate(bool enable_serializer)
   thread_manager_->isolate_ = this;
 
 #ifdef DEBUG
-  non_disposed_isolates_.Increment(1);
+  non_disposed_isolates_++;
 #endif  // DEBUG
 
   handle_scope_data_.Initialize();
@@ -2568,13 +2573,28 @@ Isolate::Isolate(bool enable_serializer)
   InitializeLoggingAndCounters();
   debug_ = new Debug(this);
 
+  tracing_cpu_profiler_.reset(new TracingCpuProfilerImpl(this));
+
   init_memcopy_functions(this);
+
+  if (FLAG_embedded_builtins) {
+#ifdef V8_MULTI_SNAPSHOTS
+  if (FLAG_untrusted_code_mitigations) {
+    SetEmbeddedBlob(DefaultEmbeddedBlob(), DefaultEmbeddedBlobSize());
+  } else {
+    SetEmbeddedBlob(TrustedEmbeddedBlob(), TrustedEmbeddedBlobSize());
+  }
+#else
+  SetEmbeddedBlob(DefaultEmbeddedBlob(), DefaultEmbeddedBlobSize());
+#endif
+  }
 }
 
 
 void Isolate::TearDown() {
   TRACE_ISOLATE(tear_down);
 
+  tracing_cpu_profiler_.reset();
   if (FLAG_stress_sampling_allocation_profiler > 0) {
     heap_profiler()->StopSamplingHeapProfiler();
   }
@@ -2597,7 +2617,7 @@ void Isolate::TearDown() {
   }
 
 #ifdef DEBUG
-  non_disposed_isolates_.Decrement(1);
+  non_disposed_isolates_--;
 #endif  // DEBUG
 
   delete this;
@@ -2627,7 +2647,7 @@ void Isolate::Deinit() {
   wasm_engine()->TearDown();
 
   heap_.mark_compact_collector()->EnsureSweepingCompleted();
-  heap_.memory_allocator()->unmapper()->WaitUntilCompleted();
+  heap_.memory_allocator()->unmapper()->EnsureUnmappingCompleted();
 
   DumpAndResetStats();
 
@@ -2635,10 +2655,6 @@ void Isolate::Deinit() {
     PrintF(stdout, "=== Stress deopt counter: %u\n", stress_deopt_count_);
   }
 
-  if (cpu_profiler_) {
-    cpu_profiler_->DeleteAllProfiles();
-  }
-
   // We must stop the logger before we tear down other components.
   sampler::Sampler* sampler = logger_->sampler();
   if (sampler && sampler->IsActive()) sampler->Stop();
@@ -2648,9 +2664,8 @@ void Isolate::Deinit() {
   // We start with the heap tear down so that releasing managed objects does
   // not cause a GC.
   heap_.StartTearDown();
-  // Release managed objects before shutting down the heap. The finalizer might
-  // need to access heap objects.
-  ReleaseManagedObjects();
+
+  ReleaseSharedPtrs();
 
   delete deoptimizer_data_;
   deoptimizer_data_ = nullptr;
@@ -2672,18 +2687,20 @@ void Isolate::Deinit() {
   delete compiler_dispatcher_;
   compiler_dispatcher_ = nullptr;
 
+  // This stops cancelable tasks (i.e. concurrent masking tasks)
   cancelable_task_manager()->CancelAndWait();
 
   heap_.TearDown();
   logger_->TearDown();
 
-#ifdef V8_EMBEDDED_BUILTINS
-  if (DefaultEmbeddedBlob() == nullptr && embedded_blob() != nullptr) {
-    // We own the embedded blob. Free it.
-    uint8_t* data = const_cast<uint8_t*>(embedded_blob_);
-    InstructionStream::FreeOffHeapInstructionStream(data, embedded_blob_size_);
+  if (FLAG_embedded_builtins) {
+    if (DefaultEmbeddedBlob() == nullptr && embedded_blob() != nullptr) {
+      // We own the embedded blob. Free it.
+      uint8_t* data = const_cast<uint8_t*>(embedded_blob_);
+      InstructionStream::FreeOffHeapInstructionStream(data,
+                                                      embedded_blob_size_);
+    }
   }
-#endif
 
   delete interpreter_;
   interpreter_ = nullptr;
@@ -2691,9 +2708,6 @@ void Isolate::Deinit() {
   delete ast_string_constants_;
   ast_string_constants_ = nullptr;
 
-  delete cpu_profiler_;
-  cpu_profiler_ = nullptr;
-
   code_event_dispatcher_.reset();
 
   delete root_index_map_;
@@ -2725,8 +2739,16 @@ Isolate::~Isolate() {
   delete date_cache_;
   date_cache_ = nullptr;
 
-  delete[] call_descriptor_data_;
-  call_descriptor_data_ = nullptr;
+#ifdef V8_INTL_SUPPORT
+  delete language_singleton_regexp_matcher_;
+  language_singleton_regexp_matcher_ = nullptr;
+
+  delete language_tag_regexp_matcher_;
+  language_tag_regexp_matcher_ = nullptr;
+
+  delete language_variant_regexp_matcher_;
+  language_variant_regexp_matcher_ = nullptr;
+#endif  // V8_INTL_SUPPORT
 
   delete regexp_stack_;
   regexp_stack_ = nullptr;
@@ -2797,7 +2819,7 @@ void Isolate::SetTerminationOnExternalTryCatch() {
   if (try_catch_handler() == nullptr) return;
   try_catch_handler()->can_continue_ = false;
   try_catch_handler()->has_terminated_ = true;
-  try_catch_handler()->exception_ = heap()->null_value();
+  try_catch_handler()->exception_ = ReadOnlyRoots(heap()).null_value();
 }
 
 bool Isolate::PropagatePendingExceptionToExternalTryCatch() {
@@ -2855,7 +2877,6 @@ void PrintBuiltinSizes(Isolate* isolate) {
   }
 }
 
-#ifdef V8_EMBEDDED_BUILTINS
 void CreateOffHeapTrampolines(Isolate* isolate) {
   DCHECK(isolate->serializer_enabled());
   DCHECK_NOT_NULL(isolate->embedded_blob());
@@ -2870,9 +2891,9 @@ void CreateOffHeapTrampolines(Isolate* isolate) {
   for (int i = 0; i < Builtins::builtin_count; i++) {
     if (!Builtins::IsIsolateIndependent(i)) continue;
 
-    const uint8_t* instruction_start = d.InstructionStartOfBuiltin(i);
+    Address instruction_start = d.InstructionStartOfBuiltin(i);
     Handle<Code> trampoline = isolate->factory()->NewOffHeapTrampolineFor(
-        builtins->builtin_handle(i), const_cast<Address>(instruction_start));
+        builtins->builtin_handle(i), instruction_start);
 
     // Note that references to the old, on-heap code objects may still exist on
     // the heap. This is fine for the sake of serialization, as serialization
@@ -2889,10 +2910,8 @@ void CreateOffHeapTrampolines(Isolate* isolate) {
     }
   }
 }
-#endif  // V8_EMBEDDED_BUILTINS
 }  // namespace
 
-#ifdef V8_EMBEDDED_BUILTINS
 void Isolate::PrepareEmbeddedBlobForSerialization() {
   // When preparing the embedded blob, ensure it doesn't exist yet.
   DCHECK_NULL(embedded_blob());
@@ -2909,7 +2928,6 @@ void Isolate::PrepareEmbeddedBlobForSerialization() {
   SetEmbeddedBlob(const_cast<const uint8_t*>(data), size);
   CreateOffHeapTrampolines(this);
 }
-#endif  // V8_EMBEDDED_BUILTINS
 
 bool Isolate::Init(StartupDeserializer* des) {
   TRACE_ISOLATE(init);
@@ -2959,34 +2977,14 @@ bool Isolate::Init(StartupDeserializer* des) {
   regexp_stack_ = new RegExpStack();
   regexp_stack_->isolate_ = this;
   date_cache_ = new DateCache();
-  call_descriptor_data_ =
-      new CallInterfaceDescriptorData[CallDescriptors::NUMBER_OF_DESCRIPTORS];
-  cpu_profiler_ = new CpuProfiler(this);
   heap_profiler_ = new HeapProfiler(heap());
   interpreter_ = new interpreter::Interpreter(this);
   compiler_dispatcher_ =
       new CompilerDispatcher(this, V8::GetCurrentPlatform(), FLAG_stack_size);
 
-#ifdef V8_EMBEDDED_BUILTINS
-#ifdef V8_MULTI_SNAPSHOTS
-  if (FLAG_untrusted_code_mitigations) {
-    SetEmbeddedBlob(DefaultEmbeddedBlob(), DefaultEmbeddedBlobSize());
-  } else {
-    SetEmbeddedBlob(TrustedEmbeddedBlob(), TrustedEmbeddedBlobSize());
-  }
-#else
-  SetEmbeddedBlob(DefaultEmbeddedBlob(), DefaultEmbeddedBlobSize());
-#endif
-#endif
-
   // Enable logging before setting up the heap
   logger_->SetUp(this);
 
-  // Initialize other runtime facilities
-#if defined(USE_SIMULATOR)
-  Simulator::Initialize(this);
-#endif
-
   { // NOLINT
     // Ensure that the thread has a valid stack guard.  The v8::Locker object
     // will ensure this too, but we don't have to use lockers if we are only
@@ -2997,26 +2995,20 @@ bool Isolate::Init(StartupDeserializer* des) {
 
   // SetUp the object heap.
   DCHECK(!heap_.HasBeenSetUp());
-  if (!heap_.SetUp()) {
-    V8::FatalProcessOutOfMemory(this, "heap setup");
-    return false;
-  }
-
-  // Setup the wasm engine. Currently, there's one per Isolate.
-  const size_t max_code_size =
-      kRequiresCodeRange
-          ? std::min(kMaxWasmCodeMemory,
-                     heap_.memory_allocator()->code_range()->size())
-          : kMaxWasmCodeMemory;
-  wasm_engine_.reset(new wasm::WasmEngine(
-      std::unique_ptr<wasm::WasmCodeManager>(new wasm::WasmCodeManager(
-          reinterpret_cast<v8::Isolate*>(this), max_code_size))));
+  heap_.SetUp();
 
-// Initialize the interface descriptors ahead of time.
-#define INTERFACE_DESCRIPTOR(Name, ...) \
-  { Name##Descriptor(this); }
-  INTERFACE_DESCRIPTOR_LIST(INTERFACE_DESCRIPTOR)
-#undef INTERFACE_DESCRIPTOR
+  // Setup the wasm engine. Currently, there's one per Isolate by default.
+  if (wasm_engine_ == nullptr) {
+    wasm_engine_.reset(
+        new wasm::WasmEngine(std::unique_ptr<wasm::WasmCodeManager>(
+            new wasm::WasmCodeManager(kMaxWasmCodeMemory))));
+    wasm_engine_->memory_tracker()->SetAllocationResultHistogram(
+        counters()->wasm_memory_allocation_result());
+    wasm_engine_->memory_tracker()->SetAddressSpaceUsageHistogram(
+        counters()->wasm_address_space_usage_mb());
+    wasm_engine_->code_manager()->SetModuleCodeSizeHistogram(
+        counters()->wasm_module_code_size_mb());
+  }
 
   deoptimizer_data_ = new DeoptimizerData(heap());
 
@@ -3032,19 +3024,28 @@ bool Isolate::Init(StartupDeserializer* des) {
 
   if (create_heap_objects) {
     // Terminate the partial snapshot cache so we can iterate.
-    partial_snapshot_cache_.push_back(heap_.undefined_value());
-#ifdef V8_EMBEDDED_BUILTINS
-    if (serializer_enabled()) {
-      builtins_constants_table_builder_ =
-          new BuiltinsConstantsTableBuilder(this);
-    }
-#endif
+    partial_snapshot_cache_.push_back(ReadOnlyRoots(this).undefined_value());
   }
 
   InitializeThreadLocal();
 
   bootstrapper_->Initialize(create_heap_objects);
+
+  if (FLAG_embedded_builtins) {
+    if (create_heap_objects && serializer_enabled()) {
+      builtins_constants_table_builder_ =
+          new BuiltinsConstantsTableBuilder(this);
+    }
+  }
   setup_delegate_->SetupBuiltins(this);
+  if (FLAG_embedded_builtins) {
+    if (create_heap_objects && serializer_enabled()) {
+      builtins_constants_table_builder_->Finalize();
+      delete builtins_constants_table_builder_;
+      builtins_constants_table_builder_ = nullptr;
+    }
+  }
+
   if (create_heap_objects) heap_.CreateFixedStubs();
 
   if (FLAG_log_internal_timer_events) {
@@ -3071,14 +3072,6 @@ bool Isolate::Init(StartupDeserializer* des) {
     store_stub_cache_->Initialize();
     setup_delegate_->SetupInterpreter(interpreter_);
 
-#ifdef V8_EMBEDDED_BUILTINS
-    if (create_heap_objects && serializer_enabled()) {
-      builtins_constants_table_builder_->Finalize();
-      delete builtins_constants_table_builder_;
-      builtins_constants_table_builder_ = nullptr;
-    }
-#endif  // V8_EMBEDDED_BUILTINS
-
     heap_.NotifyDeserializationComplete();
   }
   delete setup_delegate_;
@@ -3096,7 +3089,8 @@ bool Isolate::Init(StartupDeserializer* des) {
   heap_.SetStackLimits();
 
   // Quiet the heap NaN if needed on target platform.
-  if (!create_heap_objects) Assembler::QuietNaN(heap_.nan_value());
+  if (!create_heap_objects)
+    Assembler::QuietNaN(ReadOnlyRoots(this).nan_value());
 
   if (FLAG_trace_turbo) {
     // Create an empty file.
@@ -3118,19 +3112,14 @@ bool Isolate::Init(StartupDeserializer* des) {
       static_cast<int>(OFFSET_OF(Isolate, heap_.external_reference_table_)),
       Internals::kIsolateRootsOffset +
           Heap::kRootsExternalReferenceTableOffset);
+  CHECK_EQ(static_cast<int>(OFFSET_OF(Isolate, heap_.builtins_)),
+           Internals::kIsolateRootsOffset + Heap::kRootsBuiltinsOffset);
 
   {
     HandleScope scope(this);
     ast_string_constants_ = new AstStringConstants(this, heap()->HashSeed());
   }
 
-  if (!serializer_enabled()) {
-    // Ensure that all stubs which need to be generated ahead of time, but
-    // cannot be serialized into the snapshot have been generated.
-    HandleScope scope(this);
-    CodeStub::GenerateFPStubs(this);
-  }
-
   initialized_from_snapshot_ = (des != nullptr);
 
   if (!FLAG_inline_new) heap_.DisableInlineAllocation();
@@ -3244,8 +3233,7 @@ void Isolate::UnlinkDeferredHandles(DeferredHandles* deferred) {
 void Isolate::DumpAndResetStats() {
   if (turbo_statistics() != nullptr) {
     DCHECK(FLAG_turbo_stats || FLAG_turbo_stats_nvp);
-
-    OFStream os(stdout);
+    StdoutStream os;
     if (FLAG_turbo_stats) {
       AsPrintableStatistics ps = {*turbo_statistics(), false};
       os << ps << std::endl;
@@ -3254,9 +3242,14 @@ void Isolate::DumpAndResetStats() {
       AsPrintableStatistics ps = {*turbo_statistics(), true};
       os << ps << std::endl;
     }
+    delete turbo_statistics_;
+    turbo_statistics_ = nullptr;
+  }
+  // TODO(7424): There is no public API for the {WasmEngine} yet. So for now we
+  // just dump and reset the engines statistics together with the Isolate.
+  if (FLAG_turbo_stats_wasm) {
+    wasm_engine()->DumpAndResetTurboStatistics();
   }
-  delete turbo_statistics_;
-  turbo_statistics_ = nullptr;
   if (V8_UNLIKELY(FLAG_runtime_stats ==
                   v8::tracing::TracingCategoryObserver::ENABLED_BY_NATIVE)) {
     counters()->runtime_call_stats()->Print();
@@ -3390,16 +3383,17 @@ bool Isolate::IsNoElementsProtectorIntact(Context* context) {
   }
 
   FixedArrayBase* elements = initial_array_proto->elements();
-  if (elements != heap()->empty_fixed_array() &&
-      elements != heap()->empty_slow_element_dictionary()) {
+  ReadOnlyRoots roots(heap());
+  if (elements != roots.empty_fixed_array() &&
+      elements != roots.empty_slow_element_dictionary()) {
     DCHECK_EQ(false, cell_reports_intact);
     return cell_reports_intact;
   }
 
   // Check that the Object.prototype hasn't been altered WRT empty elements.
   elements = initial_object_proto->elements();
-  if (elements != heap()->empty_fixed_array() &&
-      elements != heap()->empty_slow_element_dictionary()) {
+  if (elements != roots.empty_fixed_array() &&
+      elements != roots.empty_slow_element_dictionary()) {
     DCHECK_EQ(false, cell_reports_intact);
     return cell_reports_intact;
   }
@@ -3422,8 +3416,8 @@ bool Isolate::IsNoElementsProtectorIntact(Context* context) {
 
   // Check that the String.prototype hasn't been altered WRT empty elements.
   elements = initial_string_proto->elements();
-  if (elements != heap()->empty_fixed_array() &&
-      elements != heap()->empty_slow_element_dictionary()) {
+  if (elements != roots.empty_fixed_array() &&
+      elements != roots.empty_slow_element_dictionary()) {
     DCHECK_EQ(false, cell_reports_intact);
     return cell_reports_intact;
   }
@@ -3480,7 +3474,7 @@ bool Isolate::IsPromiseHookProtectorIntact() {
   bool is_promise_hook_protector_intact =
       Smi::ToInt(promise_hook_cell->value()) == kProtectorValid;
   DCHECK_IMPLIES(is_promise_hook_protector_intact,
-                 !promise_hook_or_debug_is_active_);
+                 !promise_hook_or_async_event_delegate_);
   return is_promise_hook_protector_intact;
 }
 
@@ -3514,7 +3508,7 @@ void Isolate::UpdateNoElementsProtectorOnSetElement(Handle<JSObject> object) {
   if (!IsNoElementsProtectorIntact()) return;
   if (!IsArrayOrObjectOrStringPrototype(*object)) return;
   PropertyCell::SetValueWithInvalidation(
-      factory()->no_elements_protector(),
+      this, factory()->no_elements_protector(),
       handle(Smi::FromInt(kProtectorInvalid), this));
 }
 
@@ -3537,24 +3531,27 @@ void Isolate::InvalidateArrayConstructorProtector() {
 void Isolate::InvalidateArraySpeciesProtector() {
   DCHECK(factory()->array_species_protector()->value()->IsSmi());
   DCHECK(IsArraySpeciesLookupChainIntact());
-  factory()->array_species_protector()->set_value(
-      Smi::FromInt(kProtectorInvalid));
+  PropertyCell::SetValueWithInvalidation(
+      this, factory()->array_species_protector(),
+      handle(Smi::FromInt(kProtectorInvalid), this));
   DCHECK(!IsArraySpeciesLookupChainIntact());
 }
 
 void Isolate::InvalidateTypedArraySpeciesProtector() {
   DCHECK(factory()->typed_array_species_protector()->value()->IsSmi());
   DCHECK(IsTypedArraySpeciesLookupChainIntact());
-  factory()->typed_array_species_protector()->set_value(
-      Smi::FromInt(kProtectorInvalid));
+  PropertyCell::SetValueWithInvalidation(
+      this, factory()->typed_array_species_protector(),
+      handle(Smi::FromInt(kProtectorInvalid), this));
   DCHECK(!IsTypedArraySpeciesLookupChainIntact());
 }
 
 void Isolate::InvalidatePromiseSpeciesProtector() {
   DCHECK(factory()->promise_species_protector()->value()->IsSmi());
   DCHECK(IsPromiseSpeciesLookupChainIntact());
-  factory()->promise_species_protector()->set_value(
-      Smi::FromInt(kProtectorInvalid));
+  PropertyCell::SetValueWithInvalidation(
+      this, factory()->promise_species_protector(),
+      handle(Smi::FromInt(kProtectorInvalid), this));
   DCHECK(!IsPromiseSpeciesLookupChainIntact());
 }
 
@@ -3570,7 +3567,7 @@ void Isolate::InvalidateArrayIteratorProtector() {
   DCHECK(factory()->array_iterator_protector()->value()->IsSmi());
   DCHECK(IsArrayIteratorLookupChainIntact());
   PropertyCell::SetValueWithInvalidation(
-      factory()->array_iterator_protector(),
+      this, factory()->array_iterator_protector(),
       handle(Smi::FromInt(kProtectorInvalid), this));
   DCHECK(!IsArrayIteratorLookupChainIntact());
 }
@@ -3579,7 +3576,7 @@ void Isolate::InvalidateArrayBufferNeuteringProtector() {
   DCHECK(factory()->array_buffer_neutering_protector()->value()->IsSmi());
   DCHECK(IsArrayBufferNeuteringIntact());
   PropertyCell::SetValueWithInvalidation(
-      factory()->array_buffer_neutering_protector(),
+      this, factory()->array_buffer_neutering_protector(),
       handle(Smi::FromInt(kProtectorInvalid), this));
   DCHECK(!IsArrayBufferNeuteringIntact());
 }
@@ -3588,7 +3585,7 @@ void Isolate::InvalidatePromiseHookProtector() {
   DCHECK(factory()->promise_hook_protector()->value()->IsSmi());
   DCHECK(IsPromiseHookProtectorIntact());
   PropertyCell::SetValueWithInvalidation(
-      factory()->promise_hook_protector(),
+      this, factory()->promise_hook_protector(),
       handle(Smi::FromInt(kProtectorInvalid), this));
   DCHECK(!IsPromiseHookProtectorIntact());
 }
@@ -3605,7 +3602,7 @@ void Isolate::InvalidatePromiseThenProtector() {
   DCHECK(factory()->promise_then_protector()->value()->IsSmi());
   DCHECK(IsPromiseThenLookupChainIntact());
   PropertyCell::SetValueWithInvalidation(
-      factory()->promise_then_protector(),
+      this, factory()->promise_then_protector(),
       handle(Smi::FromInt(kProtectorInvalid), this));
   DCHECK(!IsPromiseThenLookupChainIntact());
 }
@@ -3615,12 +3612,6 @@ bool Isolate::IsAnyInitialArrayPrototype(Handle<JSArray> array) {
   return IsInAnyContext(*array, Context::INITIAL_ARRAY_PROTOTYPE_INDEX);
 }
 
-
-CallInterfaceDescriptorData* Isolate::call_descriptor_data(int index) {
-  DCHECK(0 <= index && index < CallDescriptors::NUMBER_OF_DESCRIPTORS);
-  return &call_descriptor_data_[index];
-}
-
 static base::RandomNumberGenerator* ensure_rng_exists(
     base::RandomNumberGenerator** rng, int seed) {
   if (*rng == nullptr) {
@@ -3700,7 +3691,7 @@ Handle<Symbol> Isolate::SymbolFor(Heap::RootListIndex dictionary_index,
         UNREACHABLE();
     }
   } else {
-    symbol = Handle<Symbol>(Symbol::cast(dictionary->ValueAt(entry)));
+    symbol = Handle<Symbol>(Symbol::cast(dictionary->ValueAt(entry)), this);
   }
   return symbol;
 }
@@ -3771,12 +3762,13 @@ void Isolate::FireCallCompletedCallback() {
   }
 }
 
-void Isolate::DebugStateUpdated() {
-  bool promise_hook_or_debug_is_active = promise_hook_ || debug()->is_active();
-  if (promise_hook_or_debug_is_active && IsPromiseHookProtectorIntact()) {
+void Isolate::PromiseHookStateUpdated() {
+  bool is_active = promise_hook_ || async_event_delegate_;
+  if (is_active && IsPromiseHookProtectorIntact()) {
+    HandleScope scope(this);
     InvalidatePromiseHookProtector();
   }
-  promise_hook_or_debug_is_active_ = promise_hook_or_debug_is_active;
+  promise_hook_or_async_event_delegate_ = is_active;
 }
 
 namespace {
@@ -3855,19 +3847,104 @@ void Isolate::SetHostInitializeImportMetaObjectCallback(
   host_initialize_import_meta_object_callback_ = callback;
 }
 
+void Isolate::SetAtomicsWaitCallback(v8::Isolate::AtomicsWaitCallback callback,
+                                     void* data) {
+  atomics_wait_callback_ = callback;
+  atomics_wait_callback_data_ = data;
+}
+
+void Isolate::RunAtomicsWaitCallback(v8::Isolate::AtomicsWaitEvent event,
+                                     Handle<JSArrayBuffer> array_buffer,
+                                     size_t offset_in_bytes, int32_t value,
+                                     double timeout_in_ms,
+                                     AtomicsWaitWakeHandle* stop_handle) {
+  DCHECK(array_buffer->is_shared());
+  if (atomics_wait_callback_ == nullptr) return;
+  HandleScope handle_scope(this);
+  atomics_wait_callback_(
+      event, v8::Utils::ToLocalShared(array_buffer), offset_in_bytes, value,
+      timeout_in_ms,
+      reinterpret_cast<v8::Isolate::AtomicsWaitWakeHandle*>(stop_handle),
+      atomics_wait_callback_data_);
+}
+
 void Isolate::SetPromiseHook(PromiseHook hook) {
   promise_hook_ = hook;
-  DebugStateUpdated();
+  PromiseHookStateUpdated();
 }
 
 void Isolate::RunPromiseHook(PromiseHookType type, Handle<JSPromise> promise,
                              Handle<Object> parent) {
-  if (debug()->is_active()) debug()->RunPromiseHook(type, promise, parent);
+  RunPromiseHookForAsyncEventDelegate(type, promise);
   if (promise_hook_ == nullptr) return;
   promise_hook_(type, v8::Utils::PromiseToLocal(promise),
                 v8::Utils::ToLocal(parent));
 }
 
+void Isolate::RunPromiseHookForAsyncEventDelegate(PromiseHookType type,
+                                                  Handle<JSPromise> promise) {
+  if (!async_event_delegate_) return;
+  if (type == PromiseHookType::kResolve) return;
+
+  if (type == PromiseHookType::kBefore) {
+    if (!promise->async_task_id()) return;
+    async_event_delegate_->AsyncEventOccurred(debug::kDebugWillHandle,
+                                              promise->async_task_id(), false);
+  } else if (type == PromiseHookType::kAfter) {
+    if (!promise->async_task_id()) return;
+    async_event_delegate_->AsyncEventOccurred(debug::kDebugDidHandle,
+                                              promise->async_task_id(), false);
+  } else {
+    DCHECK(type == PromiseHookType::kInit);
+    debug::DebugAsyncActionType type = debug::kDebugPromiseThen;
+    bool last_frame_was_promise_builtin = false;
+    JavaScriptFrameIterator it(this);
+    while (!it.done()) {
+      std::vector<Handle<SharedFunctionInfo>> infos;
+      it.frame()->GetFunctions(&infos);
+      for (size_t i = 1; i <= infos.size(); ++i) {
+        Handle<SharedFunctionInfo> info = infos[infos.size() - i];
+        if (info->IsUserJavaScript()) {
+          // We should not report PromiseThen and PromiseCatch which is called
+          // indirectly, e.g. Promise.all calls Promise.then internally.
+          if (last_frame_was_promise_builtin) {
+            if (!promise->async_task_id()) {
+              promise->set_async_task_id(++async_task_count_);
+            }
+            async_event_delegate_->AsyncEventOccurred(
+                type, promise->async_task_id(), debug()->IsBlackboxed(info));
+          }
+          return;
+        }
+        last_frame_was_promise_builtin = false;
+        if (info->HasBuiltinId()) {
+          if (info->builtin_id() == Builtins::kPromisePrototypeThen) {
+            type = debug::kDebugPromiseThen;
+            last_frame_was_promise_builtin = true;
+          } else if (info->builtin_id() == Builtins::kPromisePrototypeCatch) {
+            type = debug::kDebugPromiseCatch;
+            last_frame_was_promise_builtin = true;
+          } else if (info->builtin_id() == Builtins::kPromisePrototypeFinally) {
+            type = debug::kDebugPromiseFinally;
+            last_frame_was_promise_builtin = true;
+          }
+        }
+      }
+      it.Advance();
+    }
+  }
+}
+
+void Isolate::OnAsyncFunctionStateChanged(Handle<JSPromise> promise,
+                                          debug::DebugAsyncActionType event) {
+  if (!async_event_delegate_) return;
+  if (!promise->async_task_id()) {
+    promise->set_async_task_id(++async_task_count_);
+  }
+  async_event_delegate_->AsyncEventOccurred(event, promise->async_task_id(),
+                                            false);
+}
+
 void Isolate::SetPromiseRejectCallback(PromiseRejectCallback callback) {
   promise_reject_callback_ = callback;
 }
@@ -3875,10 +3952,9 @@ void Isolate::SetPromiseRejectCallback(PromiseRejectCallback callback) {
 void Isolate::ReportPromiseReject(Handle<JSPromise> promise,
                                   Handle<Object> value,
                                   v8::PromiseRejectEvent event) {
-  DCHECK_EQ(v8::Promise::kRejected, promise->status());
   if (promise_reject_callback_ == nullptr) return;
   Handle<FixedArray> stack_trace;
-  if (event == v8::kPromiseRejectWithNoHandler && value->IsJSObject()) {
+  if (event != v8::kPromiseHandlerAddedAfterReject && value->IsJSObject()) {
     stack_trace = GetDetailedStackTrace(Handle<JSObject>::cast(value));
   }
   promise_reject_callback_(v8::PromiseRejectMessage(
@@ -3918,7 +3994,7 @@ void Isolate::RunMicrotasks() {
     // If execution is terminating, bail out, clean up, and propagate to
     // TryCatch scope.
     if (maybe_result.is_null() && maybe_exception.is_null()) {
-      heap()->set_microtask_queue(heap()->empty_fixed_array());
+      heap()->set_microtask_queue(ReadOnlyRoots(heap()).empty_fixed_array());
       set_pending_microtask_count(0);
       handle_scope_implementer()->LeaveMicrotaskContext();
       SetTerminationOnExternalTryCatch();
@@ -4013,7 +4089,7 @@ void Isolate::CheckDetachedContextsAfterGC() {
     }
   }
   if (new_length == 0) {
-    heap()->set_detached_contexts(heap()->empty_fixed_array());
+    heap()->set_detached_contexts(ReadOnlyRoots(heap()).empty_fixed_array());
   } else if (new_length < length) {
     heap()->RightTrimFixedArray(*detached_contexts, length - new_length);
   }
@@ -4062,7 +4138,7 @@ void Isolate::SetIdle(bool is_idle) {
   if (!is_profiling()) return;
   StateTag state = current_vm_state();
   DCHECK(state == EXTERNAL || state == IDLE);
-  if (js_entry_sp() != nullptr) return;
+  if (js_entry_sp() != kNullAddress) return;
   if (is_idle) {
     set_current_vm_state(IDLE);
   } else if (state == IDLE) {
@@ -4075,7 +4151,7 @@ bool StackLimitCheck::JsHasOverflowed(uintptr_t gap) const {
 #ifdef USE_SIMULATOR
   // The simulator uses a separate JS stack.
   Address jssp_address = Simulator::current(isolate_)->get_sp();
-  uintptr_t jssp = reinterpret_cast<uintptr_t>(jssp_address);
+  uintptr_t jssp = static_cast<uintptr_t>(jssp_address);
   if (jssp - gap < stack_guard->real_jslimit()) return true;
 #endif  // USE_SIMULATOR
   return GetCurrentStackPosition() - gap < stack_guard->real_climit();
@@ -4084,7 +4160,7 @@ bool StackLimitCheck::JsHasOverflowed(uintptr_t gap) const {
 SaveContext::SaveContext(Isolate* isolate)
     : isolate_(isolate), prev_(isolate->save_context()) {
   if (isolate->context() != nullptr) {
-    context_ = Handle<Context>(isolate->context());
+    context_ = Handle<Context>(isolate->context(), isolate);
   }
   isolate->set_save_context(this);
 
@@ -4105,17 +4181,27 @@ AssertNoContextChange::AssertNoContextChange(Isolate* isolate)
     : isolate_(isolate), context_(isolate->context(), isolate) {}
 #endif  // DEBUG
 
-
-bool PostponeInterruptsScope::Intercept(StackGuard::InterruptFlag flag) {
-  // First check whether the previous scope intercepts.
-  if (prev_ && prev_->Intercept(flag)) return true;
-  // Then check whether this scope intercepts.
-  if ((flag & intercept_mask_)) {
-    intercepted_flags_ |= flag;
-    return true;
+bool InterruptsScope::Intercept(StackGuard::InterruptFlag flag) {
+  InterruptsScope* last_postpone_scope = nullptr;
+  for (InterruptsScope* current = this; current; current = current->prev_) {
+    // We only consider scopes related to passed flag.
+    if (!(current->intercept_mask_ & flag)) continue;
+    if (current->mode_ == kRunInterrupts) {
+      // If innermost scope is kRunInterrupts scope, prevent interrupt from
+      // being intercepted.
+      break;
+    } else {
+      DCHECK_EQ(current->mode_, kPostponeInterrupts);
+      last_postpone_scope = current;
+    }
   }
-  return false;
+  // If there is no postpone scope for passed flag then we should not intercept.
+  if (!last_postpone_scope) return false;
+  last_postpone_scope->intercepted_flags_ |= flag;
+  return true;
 }
 
+#undef TRACE_ISOLATE
+
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/src/isolate.h b/deps/v8/src/isolate.h
index 99d8f530f0b148..00522a66d2e058 100644
--- a/deps/v8/src/isolate.h
+++ b/deps/v8/src/isolate.h
@@ -24,6 +24,7 @@
 #include "src/futex-emulation.h"
 #include "src/globals.h"
 #include "src/handles.h"
+#include "src/heap/factory.h"
 #include "src/heap/heap.h"
 #include "src/messages.h"
 #include "src/objects/code.h"
@@ -31,6 +32,16 @@
 #include "src/runtime/runtime.h"
 #include "src/unicode.h"
 
+#ifdef V8_INTL_SUPPORT
+#include "unicode/uversion.h"  // Define U_ICU_NAMESPACE.
+// 'icu' does not work. Use U_ICU_NAMESPACE.
+namespace U_ICU_NAMESPACE {
+
+class RegexMatcher;
+
+}  // namespace U_ICU_NAMESPACE
+#endif  // V8_INTL_SUPPORT
+
 namespace v8 {
 
 namespace base {
@@ -53,7 +64,6 @@ class AstStringConstants;
 class BasicBlockProfiler;
 class Bootstrapper;
 class BuiltinsConstantsTableBuilder;
-class CallInterfaceDescriptorData;
 class CancelableTaskManager;
 class CodeEventDispatcher;
 class ExternalCodeEventListener;
@@ -67,14 +77,12 @@ class CompilerDispatcher;
 class ContextSlotCache;
 class Counters;
 class CpuFeatures;
-class CpuProfiler;
 class Debug;
 class DeoptimizerData;
 class DescriptorLookupCache;
 class EmptyStatement;
 class EternalHandles;
 class ExternalCallbackScope;
-class Factory;
 class HandleScopeImplementer;
 class HeapObjectToIndexHashMap;
 class HeapProfiler;
@@ -102,15 +110,12 @@ class SweeperThread;
 class ThreadManager;
 class ThreadState;
 class ThreadVisitor;  // Defined in v8threads.h
+class TracingCpuProfilerImpl;
 class UnicodeCache;
+struct ManagedPtrDestructor;
 
 template <StateTag Tag> class VMState;
 
-// 'void function pointer', used to roundtrip the
-// ExternalReference::ExternalReferenceRedirector since we can not include
-// assembler.h, where it is defined, here.
-typedef void* ExternalReferenceRedirectorPointer();
-
 namespace interpreter {
 class Interpreter;
 }
@@ -163,16 +168,16 @@ class WasmEngine;
     }                                                             \
   } while (false)
 
-#define RETURN_RESULT_OR_FAILURE(isolate, call)     \
-  do {                                              \
-    Handle<Object> __result__;                      \
-    Isolate* __isolate__ = (isolate);               \
-    if (!(call).ToHandle(&__result__)) {            \
-      DCHECK(__isolate__->has_pending_exception()); \
-      return __isolate__->heap()->exception();      \
-    }                                               \
-    DCHECK(!__isolate__->has_pending_exception());  \
-    return *__result__;                             \
+#define RETURN_RESULT_OR_FAILURE(isolate, call)      \
+  do {                                               \
+    Handle<Object> __result__;                       \
+    Isolate* __isolate__ = (isolate);                \
+    if (!(call).ToHandle(&__result__)) {             \
+      DCHECK(__isolate__->has_pending_exception());  \
+      return ReadOnlyRoots(__isolate__).exception(); \
+    }                                                \
+    DCHECK(!__isolate__->has_pending_exception());   \
+    return *__result__;                              \
   } while (false)
 
 #define ASSIGN_RETURN_ON_EXCEPTION_VALUE(isolate, dst, call, value)  \
@@ -183,11 +188,11 @@ class WasmEngine;
     }                                                                \
   } while (false)
 
-#define ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, dst, call)          \
-  do {                                                                  \
-    Isolate* __isolate__ = (isolate);                                   \
-    ASSIGN_RETURN_ON_EXCEPTION_VALUE(__isolate__, dst, call,            \
-                                     __isolate__->heap()->exception()); \
+#define ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, dst, call)                \
+  do {                                                                        \
+    Isolate* __isolate__ = (isolate);                                         \
+    ASSIGN_RETURN_ON_EXCEPTION_VALUE(__isolate__, dst, call,                  \
+                                     ReadOnlyRoots(__isolate__).exception()); \
   } while (false)
 
 #define ASSIGN_RETURN_ON_EXCEPTION(isolate, dst, call, T)  \
@@ -205,6 +210,13 @@ class WasmEngine;
     return __isolate__->Throw(*__isolate__->factory()->call); \
   } while (false)
 
+#define THROW_NEW_ERROR_RETURN_VALUE(isolate, call, value) \
+  do {                                                     \
+    Isolate* __isolate__ = (isolate);                      \
+    __isolate__->Throw(*__isolate__->factory()->call);     \
+    return value;                                          \
+  } while (false)
+
 #define RETURN_ON_EXCEPTION_VALUE(isolate, call, value)            \
   do {                                                             \
     if ((call).is_null()) {                                        \
@@ -213,11 +225,11 @@ class WasmEngine;
     }                                                              \
   } while (false)
 
-#define RETURN_FAILURE_ON_EXCEPTION(isolate, call)               \
-  do {                                                           \
-    Isolate* __isolate__ = (isolate);                            \
-    RETURN_ON_EXCEPTION_VALUE(__isolate__, call,                 \
-                              __isolate__->heap()->exception()); \
+#define RETURN_FAILURE_ON_EXCEPTION(isolate, call)                     \
+  do {                                                                 \
+    Isolate* __isolate__ = (isolate);                                  \
+    RETURN_ON_EXCEPTION_VALUE(__isolate__, call,                       \
+                              ReadOnlyRoots(__isolate__).exception()); \
   } while (false);
 
 #define RETURN_ON_EXCEPTION(isolate, call, T)  \
@@ -259,12 +271,12 @@ class ThreadId {
   static ThreadId Invalid() { return ThreadId(kInvalidId); }
 
   // Compares ThreadIds for equality.
-  INLINE(bool Equals(const ThreadId& other) const) {
+  V8_INLINE bool Equals(const ThreadId& other) const {
     return base::Relaxed_Load(&id_) == base::Relaxed_Load(&other.id_);
   }
 
   // Checks whether this ThreadId refers to any thread.
-  INLINE(bool IsValid() const) {
+  V8_INLINE bool IsValid() const {
     return base::Relaxed_Load(&id_) != kInvalidId;
   }
 
@@ -340,7 +352,7 @@ class ThreadLocalTop BASE_EMBEDDED {
   // just innermost catching try block).
   Object* wasm_caught_exception_ = nullptr;
 
-  // Communication channel between Isolate::FindHandler and the CEntryStub.
+  // Communication channel between Isolate::FindHandler and the CEntry.
   Context* pending_handler_context_;
   Address pending_handler_entrypoint_;
   Address pending_handler_constant_pool_;
@@ -419,8 +431,6 @@ typedef std::vector<HeapObject*> DebugObjectCache;
   V(ExtensionCallback, wasm_module_callback, &NoExtension)                    \
   V(ExtensionCallback, wasm_instance_callback, &NoExtension)                  \
   V(ApiImplementationCallback, wasm_compile_streaming_callback, nullptr)      \
-  V(ExternalReferenceRedirectorPointer*, external_reference_redirector,       \
-    nullptr)                                                                  \
   /* State for Relocatable. */                                                \
   V(Relocatable*, relocatable_top, nullptr)                                   \
   V(DebugObjectCache*, string_stream_debug_object_cache, nullptr)             \
@@ -436,6 +446,7 @@ typedef std::vector<HeapObject*> DebugObjectCache;
   V(const v8::StartupData*, snapshot_blob, nullptr)                           \
   V(int, code_and_metadata_size, 0)                                           \
   V(int, bytecode_and_metadata_size, 0)                                       \
+  V(int, external_script_source_size, 0)                                      \
   /* true if being profiled. Causes collection of extra compile info. */      \
   V(bool, is_profiling, false)                                                \
   /* true if a trace is being formatted through Error.prepareStackTrace. */   \
@@ -447,7 +458,9 @@ typedef std::vector<HeapObject*> DebugObjectCache;
   V(debug::TypeProfile::Mode, type_profile_mode, debug::TypeProfile::kNone)   \
   V(int, last_stack_frame_info_id, 0)                                         \
   V(int, last_console_context_id, 0)                                          \
-  V(v8_inspector::V8Inspector*, inspector, nullptr)
+  V(v8_inspector::V8Inspector*, inspector, nullptr)                           \
+  V(bool, next_v8_call_is_safe_for_termination, false)                        \
+  V(bool, only_terminate_in_safe_scope, false)
 
 #define THREAD_LOCAL_TOP_ACCESSOR(type, name)                        \
   inline void set_##name(type v) { thread_local_top_.name##_ = v; }  \
@@ -456,8 +469,11 @@ typedef std::vector<HeapObject*> DebugObjectCache;
 #define THREAD_LOCAL_TOP_ADDRESS(type, name) \
   type* name##_address() { return &thread_local_top_.name##_; }
 
+// HiddenFactory exists so Isolate can privately inherit from it without making
+// Factory's members available to Isolate directly.
+class V8_EXPORT_PRIVATE HiddenFactory : private Factory {};
 
-class Isolate {
+class Isolate : private HiddenFactory {
   // These forward declarations are required to make the friend declarations in
   // PerIsolateThreadData work on some older versions of gcc.
   class ThreadDataTable;
@@ -526,7 +542,7 @@ class Isolate {
   }
 
   // Returns the isolate inside which the current thread is running.
-  INLINE(static Isolate* Current()) {
+  V8_INLINE static Isolate* Current() {
     DCHECK_EQ(base::Relaxed_Load(&isolate_key_created_), 1);
     Isolate* isolate = reinterpret_cast<Isolate*>(
         base::Thread::GetExistingThreadLocal(isolate_key_));
@@ -552,7 +568,7 @@ class Isolate {
   // for legacy API reasons.
   void TearDown();
 
-  void ReleaseManagedObjects();
+  void ReleaseSharedPtrs();
 
   void ClearSerializerData();
 
@@ -722,10 +738,10 @@ class Isolate {
   Handle<String> StackTraceString();
   // Stores a stack trace in a stack-allocated temporary buffer which will
   // end up in the minidump for debugging purposes.
-  NO_INLINE(void PushStackTraceAndDie(void* ptr1 = nullptr,
-                                      void* ptr2 = nullptr,
-                                      void* ptr3 = nullptr,
-                                      void* ptr4 = nullptr));
+  V8_NOINLINE void PushStackTraceAndDie(void* ptr1 = nullptr,
+                                        void* ptr2 = nullptr,
+                                        void* ptr3 = nullptr,
+                                        void* ptr4 = nullptr);
   Handle<FixedArray> CaptureCurrentStackTrace(
       int frame_limit, StackTrace::StackTraceOptions options);
   Handle<Object> CaptureSimpleStackTrace(Handle<JSReceiver> error_object,
@@ -765,6 +781,13 @@ class Isolate {
   }
   debug::ConsoleDelegate* console_delegate() { return console_delegate_; }
 
+  void set_async_event_delegate(debug::AsyncEventDelegate* delegate) {
+    async_event_delegate_ = delegate;
+    PromiseHookStateUpdated();
+  }
+  void OnAsyncFunctionStateChanged(Handle<JSPromise> promise,
+                                   debug::DebugAsyncActionType);
+
   // Re-throw an exception.  This involves no error reporting since error
   // reporting was handled when the exception was thrown originally.
   Object* ReThrow(Object* exception);
@@ -896,7 +919,6 @@ class Isolate {
   }
   StackGuard* stack_guard() { return &stack_guard_; }
   Heap* heap() { return &heap_; }
-  wasm::WasmEngine* wasm_engine() const { return wasm_engine_.get(); }
   StubCache* load_stub_cache() { return load_stub_cache_; }
   StubCache* store_stub_cache() { return store_stub_cache_; }
   DeoptimizerData* deoptimizer_data() { return deoptimizer_data_; }
@@ -978,12 +1000,14 @@ class Isolate {
   HeapProfiler* heap_profiler() const { return heap_profiler_; }
 
 #ifdef DEBUG
-  static size_t non_disposed_isolates() {
-    return non_disposed_isolates_.Value();
-  }
+  static size_t non_disposed_isolates() { return non_disposed_isolates_; }
 #endif
 
-  Factory* factory() { return reinterpret_cast<Factory*>(this); }
+  v8::internal::Factory* factory() {
+    // Upcast to the privately inherited base-class using c-style casts to avoid
+    // undefined behavior (as static_cast cannot cast across private bases).
+    return (v8::internal::Factory*)this;  // NOLINT(readability/casting)
+  }
 
   static const int kJSRegexpStaticOffsetsVectorSize = 128;
 
@@ -1001,6 +1025,9 @@ class Isolate {
   }
 
   bool serializer_enabled() const { return serializer_enabled_; }
+
+  void enable_serializer() { serializer_enabled_ = true; }
+
   bool snapshot_available() const {
     return snapshot_blob_ != nullptr && snapshot_blob_->raw_size != 0;
   }
@@ -1066,6 +1093,32 @@ class Isolate {
     date_cache_ = date_cache;
   }
 
+#ifdef V8_INTL_SUPPORT
+  icu::RegexMatcher* language_singleton_regexp_matcher() {
+    return language_singleton_regexp_matcher_;
+  }
+
+  icu::RegexMatcher* language_tag_regexp_matcher() {
+    return language_tag_regexp_matcher_;
+  }
+
+  icu::RegexMatcher* language_variant_regexp_matcher() {
+    return language_variant_regexp_matcher_;
+  }
+
+  void set_language_tag_regexp_matchers(
+      icu::RegexMatcher* language_singleton_regexp_matcher,
+      icu::RegexMatcher* language_tag_regexp_matcher,
+      icu::RegexMatcher* language_variant_regexp_matcher) {
+    DCHECK_NULL(language_singleton_regexp_matcher_);
+    DCHECK_NULL(language_tag_regexp_matcher_);
+    DCHECK_NULL(language_variant_regexp_matcher_);
+    language_singleton_regexp_matcher_ = language_singleton_regexp_matcher;
+    language_tag_regexp_matcher_ = language_tag_regexp_matcher;
+    language_variant_regexp_matcher_ = language_variant_regexp_matcher;
+  }
+#endif  // V8_INTL_SUPPORT
+
   static const int kProtectorValid = 1;
   static const int kProtectorInvalid = 0;
 
@@ -1097,7 +1150,10 @@ class Isolate {
   bool IsPromiseResolveLookupChainIntact();
 
   // Make sure a lookup of "then" on any JSPromise whose [[Prototype]] is the
-  // initial %PromisePrototype% yields the initial method.
+  // initial %PromisePrototype% yields the initial method. In addition this
+  // protector also guards the negative lookup of "then" on the intrinsic
+  // %ObjectPrototype%, meaning that such lookups are guaranteed to yield
+  // undefined without triggering any side-effects.
   bool IsPromiseThenLookupChainIntact();
   bool IsPromiseThenLookupChainIntact(Handle<JSReceiver> receiver);
 
@@ -1130,9 +1186,6 @@ class Isolate {
   // Returns true if array is the initial array prototype in any native context.
   bool IsAnyInitialArrayPrototype(Handle<JSArray> array);
 
-  V8_EXPORT_PRIVATE CallInterfaceDescriptorData* call_descriptor_data(
-      int index);
-
   void IterateDeferredHandles(RootVisitor* visitor);
   void LinkDeferredHandles(DeferredHandles* deferred_handles);
   void UnlinkDeferredHandles(DeferredHandles* deferred_handles);
@@ -1230,8 +1283,16 @@ class Isolate {
   int GetNextUniqueSharedFunctionInfoId() { return next_unique_sfi_id_++; }
 #endif
 
-  Address promise_hook_or_debug_is_active_address() {
-    return reinterpret_cast<Address>(&promise_hook_or_debug_is_active_);
+  Address promise_hook_address() {
+    return reinterpret_cast<Address>(&promise_hook_);
+  }
+
+  Address async_event_delegate_address() {
+    return reinterpret_cast<Address>(&async_event_delegate_);
+  }
+
+  Address promise_hook_or_async_event_delegate_address() {
+    return reinterpret_cast<Address>(&promise_hook_or_async_event_delegate_);
   }
 
   Address pending_microtask_count_address() {
@@ -1242,11 +1303,13 @@ class Isolate {
     return reinterpret_cast<Address>(&handle_scope_implementer_);
   }
 
-  Address debug_execution_mode_address() {
-    return reinterpret_cast<Address>(&debug_execution_mode_);
-  }
-
-  void DebugStateUpdated();
+  void SetAtomicsWaitCallback(v8::Isolate::AtomicsWaitCallback callback,
+                              void* data);
+  void RunAtomicsWaitCallback(v8::Isolate::AtomicsWaitEvent event,
+                              Handle<JSArrayBuffer> array_buffer,
+                              size_t offset_in_bytes, int32_t value,
+                              double timeout_in_ms,
+                              AtomicsWaitWakeHandle* stop_handle);
 
   void SetPromiseHook(PromiseHook hook);
   void RunPromiseHook(PromiseHookType type, Handle<JSPromise> promise,
@@ -1259,7 +1322,17 @@ class Isolate {
     return &partial_snapshot_cache_;
   }
 
-#ifdef V8_EMBEDDED_BUILTINS
+  // Off-heap builtins cannot embed constants within the code object itself,
+  // and thus need to load them from the root list.
+  bool ShouldLoadConstantsFromRootList() const {
+    if (FLAG_embedded_builtins) {
+      return (serializer_enabled() &&
+              builtins_constants_table_builder() != nullptr);
+    } else {
+      return false;
+    }
+  }
+
   // Called only prior to serialization.
   // This function copies off-heap-safe builtins off the heap, creates off-heap
   // trampolines, and sets up this isolate's embedded blob.
@@ -1272,10 +1345,10 @@ class Isolate {
   static const uint8_t* CurrentEmbeddedBlob();
   static uint32_t CurrentEmbeddedBlobSize();
 
-  // TODO(jgruber): Remove these in favor of the static methods above.
+  // These always return the same result as static methods above, but don't
+  // access the global atomic variable (and thus *might be* slightly faster).
   const uint8_t* embedded_blob() const;
   uint32_t embedded_blob_size() const;
-#endif
 
   void set_array_buffer_allocator(v8::ArrayBuffer::Allocator* allocator) {
     array_buffer_allocator_ = allocator;
@@ -1326,52 +1399,34 @@ class Isolate {
 
   bool IsIsolateInBackground() { return is_isolate_in_background_; }
 
-  PRINTF_FORMAT(2, 3) void PrintWithTimestamp(const char* format, ...);
-
-  void set_allow_atomics_wait(bool set) { allow_atomics_wait_ = set; }
-  bool allow_atomics_wait() { return allow_atomics_wait_; }
-
-  // List of native heap values allocated by the runtime as part of its
-  // implementation that must be freed at isolate deinit.
-  class ManagedObjectFinalizer {
-   public:
-    using Deleter = void (*)(ManagedObjectFinalizer*);
-
-    ManagedObjectFinalizer(void* value, Deleter deleter)
-        : value_(value), deleter_(deleter) {}
+  void EnableMemorySavingsMode() { memory_savings_mode_active_ = true; }
 
-    void Dispose() { deleter_(this); }
+  void DisableMemorySavingsMode() { memory_savings_mode_active_ = false; }
 
-    void* value() const { return value_; }
+  bool IsMemorySavingsModeActive() { return memory_savings_mode_active_; }
 
-   private:
-    friend class Isolate;
-
-    ManagedObjectFinalizer() = default;
-
-    void* value_ = nullptr;
-    Deleter deleter_ = nullptr;
-    ManagedObjectFinalizer* prev_ = nullptr;
-    ManagedObjectFinalizer* next_ = nullptr;
-  };
+  PRINTF_FORMAT(2, 3) void PrintWithTimestamp(const char* format, ...);
 
-  static_assert(offsetof(ManagedObjectFinalizer, value_) == 0,
-                "value_ must be the first member");
+  void set_allow_atomics_wait(bool set) { allow_atomics_wait_ = set; }
+  bool allow_atomics_wait() { return allow_atomics_wait_; }
 
   // Register a finalizer to be called at isolate teardown.
-  void RegisterForReleaseAtTeardown(ManagedObjectFinalizer*);
+  void RegisterManagedPtrDestructor(ManagedPtrDestructor* finalizer);
 
-  // Unregister a previously registered value from release at
-  // isolate teardown.
-  // This transfers the responsibility of the previously managed value's
-  // deletion to the caller.
-  void UnregisterFromReleaseAtTeardown(ManagedObjectFinalizer*);
+  // Removes a previously-registered shared object finalizer.
+  void UnregisterManagedPtrDestructor(ManagedPtrDestructor* finalizer);
 
   size_t elements_deletion_counter() { return elements_deletion_counter_; }
   void set_elements_deletion_counter(size_t value) {
     elements_deletion_counter_ = value;
   }
 
+  wasm::WasmEngine* wasm_engine() const { return wasm_engine_.get(); }
+  void set_wasm_engine(std::shared_ptr<wasm::WasmEngine> engine) {
+    DCHECK_NULL(wasm_engine_);  // Only call once before {Init}.
+    wasm_engine_ = std::move(engine);
+  }
+
   const v8::Context::BackupIncumbentScope* top_backup_incumbent_scope() const {
     return top_backup_incumbent_scope_;
   }
@@ -1383,7 +1438,7 @@ class Isolate {
   void SetIdle(bool is_idle);
 
  protected:
-  explicit Isolate(bool enable_serializer);
+  Isolate();
   bool IsArrayOrObjectOrStringPrototype(Object* object);
 
  private:
@@ -1441,15 +1496,9 @@ class Isolate {
     DISALLOW_COPY_AND_ASSIGN(EntryStackItem);
   };
 
-  // TODO(kenton@cloudflare.com): This mutex can be removed if
-  // thread_data_table_ is always accessed under the isolate lock. I do not
-  // know if this is the case, so I'm preserving it for now.
-  base::Mutex thread_data_table_mutex_;
-
   static base::Thread::LocalStorageKey per_isolate_thread_data_key_;
   static base::Thread::LocalStorageKey isolate_key_;
   static base::Thread::LocalStorageKey thread_id_key_;
-  ThreadDataTable thread_data_table_;
 
   // A global counter for all generated Isolates, might overflow.
   static base::Atomic32 isolate_counter_;
@@ -1494,6 +1543,10 @@ class Isolate {
 
   void SetTerminationOnExternalTryCatch();
 
+  void PromiseHookStateUpdated();
+  void RunPromiseHookForAsyncEventDelegate(PromiseHookType type,
+                                           Handle<JSPromise> promise);
+
   const char* RAILModeName(RAILMode rail_mode) const {
     switch (rail_mode) {
       case PERFORMANCE_RESPONSE:
@@ -1508,10 +1561,6 @@ class Isolate {
     return "";
   }
 
-  // TODO(alph): Remove along with the deprecated GetCpuProfiler().
-  friend v8::CpuProfiler* v8::Isolate::GetCpuProfiler();
-  CpuProfiler* cpu_profiler() const { return cpu_profiler_; }
-
   base::Atomic32 id_;
   EntryStackItem* entry_stack_;
   int stack_trace_nesting_level_;
@@ -1553,11 +1602,11 @@ class Isolate {
   RegExpStack* regexp_stack_;
   std::vector<int> regexp_indices_;
   DateCache* date_cache_;
-  CallInterfaceDescriptorData* call_descriptor_data_;
   base::RandomNumberGenerator* random_number_generator_;
   base::RandomNumberGenerator* fuzzer_rng_;
   base::AtomicValue<RAILMode> rail_mode_;
-  bool promise_hook_or_debug_is_active_;
+  v8::Isolate::AtomicsWaitCallback atomics_wait_callback_;
+  void* atomics_wait_callback_data_;
   PromiseHook promise_hook_;
   HostImportModuleDynamicallyCallback host_import_module_dynamically_callback_;
   HostInitializeImportMetaObjectCallback
@@ -1565,6 +1614,12 @@ class Isolate {
   base::Mutex rail_mutex_;
   double load_start_time_ms_;
 
+#ifdef V8_INTL_SUPPORT
+  icu::RegexMatcher* language_singleton_regexp_matcher_;
+  icu::RegexMatcher* language_tag_regexp_matcher_;
+  icu::RegexMatcher* language_variant_regexp_matcher_;
+#endif  // V8_INTL_SUPPORT
+
   // Whether the isolate has been created for snapshotting.
   bool serializer_enabled_;
 
@@ -1581,17 +1636,20 @@ class Isolate {
   // to prioritize between memory usage and latency.
   bool is_isolate_in_background_;
 
+  // True if the isolate is in memory savings mode. This flag is used to
+  // favor memory over runtime performance.
+  bool memory_savings_mode_active_;
+
   // Time stamp at initialization.
   double time_millis_at_init_;
 
 #ifdef DEBUG
-  static base::AtomicNumber<size_t> non_disposed_isolates_;
+  static std::atomic<size_t> non_disposed_isolates_;
 
   JSObject::SpillInformation js_spill_information_;
 #endif
 
   Debug* debug_;
-  CpuProfiler* cpu_profiler_;
   HeapProfiler* heap_profiler_;
   std::unique_ptr<CodeEventDispatcher> code_event_dispatcher_;
   FunctionEntryHook function_entry_hook_;
@@ -1655,7 +1713,6 @@ class Isolate {
 
   std::vector<Object*> partial_snapshot_cache_;
 
-#ifdef V8_EMBEDDED_BUILTINS
   // Used during builtins compilation to build the builtins constants table,
   // which is stored on the root list prior to serialization.
   BuiltinsConstantsTableBuilder* builtins_constants_table_builder_ = nullptr;
@@ -1664,7 +1721,6 @@ class Isolate {
 
   const uint8_t* embedded_blob_ = nullptr;
   uint32_t embedded_blob_size_ = 0;
-#endif
 
   v8::ArrayBuffer::Allocator* array_buffer_allocator_;
 
@@ -1674,23 +1730,35 @@ class Isolate {
 
   debug::ConsoleDelegate* console_delegate_ = nullptr;
 
+  debug::AsyncEventDelegate* async_event_delegate_ = nullptr;
+  bool promise_hook_or_async_event_delegate_ = false;
+  int async_task_count_ = 0;
+
   v8::Isolate::AbortOnUncaughtExceptionCallback
       abort_on_uncaught_exception_callback_;
 
   bool allow_atomics_wait_;
 
-  ManagedObjectFinalizer managed_object_finalizers_list_;
+  ManagedPtrDestructor* managed_ptr_destructors_head_ = nullptr;
 
   size_t total_regexp_code_generated_;
 
   size_t elements_deletion_counter_ = 0;
 
-  std::unique_ptr<wasm::WasmEngine> wasm_engine_;
+  std::shared_ptr<wasm::WasmEngine> wasm_engine_;
+
+  std::unique_ptr<TracingCpuProfilerImpl> tracing_cpu_profiler_;
 
   // The top entry of the v8::Context::BackupIncumbentScope stack.
   const v8::Context::BackupIncumbentScope* top_backup_incumbent_scope_ =
       nullptr;
 
+  // TODO(kenton@cloudflare.com): This mutex can be removed if
+  // thread_data_table_ is always accessed under the isolate lock. I do not
+  // know if this is the case, so I'm preserving it for now.
+  base::Mutex thread_data_table_mutex_;
+  ThreadDataTable thread_data_table_;
+
   friend class ExecutionAccess;
   friend class HandleScopeImplementer;
   friend class heap::HeapTester;
@@ -1822,37 +1890,63 @@ class StackLimitCheck BASE_EMBEDDED {
     }                                      \
   } while (false)
 
-// Support for temporarily postponing interrupts. When the outermost
-// postpone scope is left the interrupts will be re-enabled and any
-// interrupts that occurred while in the scope will be taken into
-// account.
-class PostponeInterruptsScope BASE_EMBEDDED {
+// Scope intercepts only interrupt which is part of its interrupt_mask and does
+// not affect other interrupts.
+class InterruptsScope {
  public:
-  PostponeInterruptsScope(Isolate* isolate,
-                          int intercept_mask = StackGuard::ALL_INTERRUPTS)
-      : stack_guard_(isolate->stack_guard()),
-        intercept_mask_(intercept_mask),
-        intercepted_flags_(0) {
-    stack_guard_->PushPostponeInterruptsScope(this);
-  }
+  enum Mode { kPostponeInterrupts, kRunInterrupts, kNoop };
 
-  ~PostponeInterruptsScope() {
-    stack_guard_->PopPostponeInterruptsScope();
+  virtual ~InterruptsScope() {
+    if (mode_ != kNoop) stack_guard_->PopInterruptsScope();
   }
 
-  // Find the bottom-most scope that intercepts this interrupt.
+  // Find the scope that intercepts this interrupt.
+  // It may be outermost PostponeInterruptsScope or innermost
+  // SafeForInterruptsScope if any.
   // Return whether the interrupt has been intercepted.
   bool Intercept(StackGuard::InterruptFlag flag);
 
+  InterruptsScope(Isolate* isolate, int intercept_mask, Mode mode)
+      : stack_guard_(isolate->stack_guard()),
+        intercept_mask_(intercept_mask),
+        intercepted_flags_(0),
+        mode_(mode) {
+    if (mode_ != kNoop) stack_guard_->PushInterruptsScope(this);
+  }
+
  private:
   StackGuard* stack_guard_;
   int intercept_mask_;
   int intercepted_flags_;
-  PostponeInterruptsScope* prev_;
+  Mode mode_;
+  InterruptsScope* prev_;
 
   friend class StackGuard;
 };
 
+// Support for temporarily postponing interrupts. When the outermost
+// postpone scope is left the interrupts will be re-enabled and any
+// interrupts that occurred while in the scope will be taken into
+// account.
+class PostponeInterruptsScope : public InterruptsScope {
+ public:
+  PostponeInterruptsScope(Isolate* isolate,
+                          int intercept_mask = StackGuard::ALL_INTERRUPTS)
+      : InterruptsScope(isolate, intercept_mask,
+                        InterruptsScope::kPostponeInterrupts) {}
+  virtual ~PostponeInterruptsScope() = default;
+};
+
+// Support for overriding PostponeInterruptsScope. Interrupt is not ignored if
+// innermost scope is SafeForInterruptsScope ignoring any outer
+// PostponeInterruptsScopes.
+class SafeForInterruptsScope : public InterruptsScope {
+ public:
+  SafeForInterruptsScope(Isolate* isolate, int intercept_mask)
+      : InterruptsScope(isolate, intercept_mask,
+                        InterruptsScope::kRunInterrupts) {}
+  virtual ~SafeForInterruptsScope() = default;
+};
 
 class CodeTracer final : public Malloced {
  public:
diff --git a/deps/v8/src/js/array.js b/deps/v8/src/js/array.js
index 5b393263dac4b4..fa819be8393a38 100644
--- a/deps/v8/src/js/array.js
+++ b/deps/v8/src/js/array.js
@@ -391,46 +391,6 @@ DEFINE_METHOD(
 );
 
 
-// Removes the last element from the array and returns it. See
-// ECMA-262, section 15.4.4.6.
-function ArrayPopFallback() {
-  var array = TO_OBJECT(this);
-  var n = TO_LENGTH(array.length);
-  if (n == 0) {
-    array.length = n;
-    return;
-  }
-
-  n--;
-  var value = array[n];
-  delete array[n];
-  array.length = n;
-  return value;
-}
-
-
-// Appends the arguments to the end of the array and returns the new
-// length of the array. See ECMA-262, section 15.4.4.7.
-function ArrayPushFallback() {
-  var array = TO_OBJECT(this);
-  var n = TO_LENGTH(array.length);
-  var m = arguments.length;
-
-  // Subtract n from kMaxSafeInteger rather than testing m + n >
-  // kMaxSafeInteger. n may already be kMaxSafeInteger. In that case adding
-  // e.g., 1 would not be safe.
-  if (m > kMaxSafeInteger - n) throw %make_type_error(kPushPastSafeLength, m, n);
-
-  for (var i = 0; i < m; i++) {
-    array[i+n] = arguments[i];
-  }
-
-  var new_length = n + m;
-  array.length = new_length;
-  return new_length;
-}
-
-
 // For implementing reverse() on large, sparse arrays.
 function SparseReverse(array, len) {
   var keys = GetSortedArrayKeys(array, %GetArrayKeys(array, len));
@@ -540,8 +500,6 @@ function ArrayShiftFallback() {
     return;
   }
 
-  if (%object_is_sealed(array)) throw %make_type_error(kArrayFunctionsOnSealed);
-
   var first = array[0];
 
   if (UseSparseVariant(array, len, IS_ARRAY(array), len)) {
@@ -561,20 +519,24 @@ function ArrayUnshiftFallback(arg1) {  // length == 1
   var len = TO_LENGTH(array.length);
   var num_arguments = arguments.length;
 
-  if (len > 0 && UseSparseVariant(array, len, IS_ARRAY(array), len) &&
-      !%object_is_sealed(array)) {
-    SparseMove(array, 0, 0, len, num_arguments);
-  } else {
-    SimpleMove(array, 0, 0, len, num_arguments);
-  }
+  const new_len = len + num_arguments;
+  if (num_arguments > 0) {
+    if (new_len >= 2**53) throw %make_type_error(kInvalidArrayLength);
+
+    if (len > 0 && UseSparseVariant(array, len, IS_ARRAY(array), len) &&
+        !%object_is_sealed(array)) {
+      SparseMove(array, 0, 0, len, num_arguments);
+    } else {
+      SimpleMove(array, 0, 0, len, num_arguments);
+    }
 
-  for (var i = 0; i < num_arguments; i++) {
-    array[i] = arguments[i];
+    for (var i = 0; i < num_arguments; i++) {
+      array[i] = arguments[i];
+    }
   }
 
-  var new_length = len + num_arguments;
-  array.length = new_length;
-  return new_length;
+  array.length = new_len;
+  return new_len;
 }
 
 
@@ -624,15 +586,13 @@ function ArraySpliceFallback(start, delete_count) {
   var start_i = ComputeSpliceStartIndex(TO_INTEGER(start), len);
   var del_count = ComputeSpliceDeleteCount(delete_count, num_arguments, len,
                                            start_i);
-  var deleted_elements = ArraySpeciesCreate(array, del_count);
-  deleted_elements.length = del_count;
   var num_elements_to_add = num_arguments > 2 ? num_arguments - 2 : 0;
 
-  if (del_count != num_elements_to_add && %object_is_sealed(array)) {
-    throw %make_type_error(kArrayFunctionsOnSealed);
-  } else if (del_count > 0 && %object_is_frozen(array)) {
-    throw %make_type_error(kArrayFunctionsOnFrozen);
-  }
+  const new_len = len - del_count + num_elements_to_add;
+  if (new_len >= 2**53) throw %make_type_error(kInvalidArrayLength);
+
+  var deleted_elements = ArraySpeciesCreate(array, del_count);
+  deleted_elements.length = del_count;
 
   var changed_elements = del_count;
   if (num_elements_to_add != del_count) {
@@ -658,7 +618,7 @@ function ArraySpliceFallback(start, delete_count) {
   while (arguments_index < arguments_length) {
     array[i++] = arguments[arguments_index++];
   }
-  array.length = len - del_count + num_elements_to_add;
+  array.length = new_len;
 
   // Return the deleted elements.
   return deleted_elements;
@@ -801,157 +761,27 @@ function InnerArraySort(array, length, comparefn) {
     }
   };
 
-  // Copy elements in the range 0..length from obj's prototype chain
-  // to obj itself, if obj has holes. Return one more than the maximal index
-  // of a prototype property.
-  function CopyFromPrototype(obj, length) {
-    var max = 0;
-    for (var proto = %object_get_prototype_of(obj); proto;
-         proto = %object_get_prototype_of(proto)) {
-      var indices = IS_PROXY(proto) ? length : %GetArrayKeys(proto, length);
-      if (IS_NUMBER(indices)) {
-        // It's an interval.
-        var proto_length = indices;
-        for (var i = 0; i < proto_length; i++) {
-          if (!HAS_OWN_PROPERTY(obj, i) && HAS_OWN_PROPERTY(proto, i)) {
-            obj[i] = proto[i];
-            if (i >= max) { max = i + 1; }
-          }
-        }
-      } else {
-        for (var i = 0; i < indices.length; i++) {
-          var index = indices[i];
-          if (!HAS_OWN_PROPERTY(obj, index) && HAS_OWN_PROPERTY(proto, index)) {
-            obj[index] = proto[index];
-            if (index >= max) { max = index + 1; }
-          }
-        }
-      }
-    }
-    return max;
-  };
-
-  // Set a value of "undefined" on all indices in the range from..to
-  // where a prototype of obj has an element. I.e., shadow all prototype
-  // elements in that range.
-  function ShadowPrototypeElements(obj, from, to) {
-    for (var proto = %object_get_prototype_of(obj); proto;
-         proto = %object_get_prototype_of(proto)) {
-      var indices = IS_PROXY(proto) ? to : %GetArrayKeys(proto, to);
-      if (IS_NUMBER(indices)) {
-        // It's an interval.
-        var proto_length = indices;
-        for (var i = from; i < proto_length; i++) {
-          if (HAS_OWN_PROPERTY(proto, i)) {
-            obj[i] = UNDEFINED;
-          }
-        }
-      } else {
-        for (var i = 0; i < indices.length; i++) {
-          var index = indices[i];
-          if (from <= index && HAS_OWN_PROPERTY(proto, index)) {
-            obj[index] = UNDEFINED;
-          }
-        }
-      }
-    }
-  };
-
-  function SafeRemoveArrayHoles(obj) {
-    // Copy defined elements from the end to fill in all holes and undefineds
-    // in the beginning of the array.  Write undefineds and holes at the end
-    // after loop is finished.
-    var first_undefined = 0;
-    var last_defined = length - 1;
-    var num_holes = 0;
-    while (first_undefined < last_defined) {
-      // Find first undefined element.
-      while (first_undefined < last_defined &&
-             !IS_UNDEFINED(obj[first_undefined])) {
-        first_undefined++;
-      }
-      // Maintain the invariant num_holes = the number of holes in the original
-      // array with indices <= first_undefined or > last_defined.
-      if (!HAS_OWN_PROPERTY(obj, first_undefined)) {
-        num_holes++;
-      }
-
-      // Find last defined element.
-      while (first_undefined < last_defined &&
-             IS_UNDEFINED(obj[last_defined])) {
-        if (!HAS_OWN_PROPERTY(obj, last_defined)) {
-          num_holes++;
-        }
-        last_defined--;
-      }
-      if (first_undefined < last_defined) {
-        // Fill in hole or undefined.
-        obj[first_undefined] = obj[last_defined];
-        obj[last_defined] = UNDEFINED;
-      }
-    }
-    // If there were any undefineds in the entire array, first_undefined
-    // points to one past the last defined element.  Make this true if
-    // there were no undefineds, as well, so that first_undefined == number
-    // of defined elements.
-    if (!IS_UNDEFINED(obj[first_undefined])) first_undefined++;
-    // Fill in the undefineds and the holes.  There may be a hole where
-    // an undefined should be and vice versa.
-    var i;
-    for (i = first_undefined; i < length - num_holes; i++) {
-      obj[i] = UNDEFINED;
-    }
-    for (i = length - num_holes; i < length; i++) {
-      // For compatibility with Webkit, do not expose elements in the prototype.
-      if (i in %object_get_prototype_of(obj)) {
-        obj[i] = UNDEFINED;
-      } else {
-        delete obj[i];
-      }
-    }
-
-    // Return the number of defined elements.
-    return first_undefined;
-  };
-
   if (length < 2) return array;
 
-  var is_array = IS_ARRAY(array);
-  var max_prototype_element;
-  if (!is_array) {
-    // For compatibility with JSC, we also sort elements inherited from
-    // the prototype chain on non-Array objects.
-    // We do this by copying them to this object and sorting only
-    // own elements. This is not very efficient, but sorting with
-    // inherited elements happens very, very rarely, if at all.
-    // The specification allows "implementation dependent" behavior
-    // if an element on the prototype chain has an element that
-    // might interact with sorting.
-    max_prototype_element = CopyFromPrototype(array, length);
-  }
-
-  // %RemoveArrayHoles returns -1 if fast removal is not supported.
-  var num_non_undefined = %RemoveArrayHoles(array, length);
-
-  if (num_non_undefined == -1) {
-    // There were indexed accessors in the array.
-    // Move array holes and undefineds to the end using a Javascript function
-    // that is safe in the presence of accessors.
-    num_non_undefined = SafeRemoveArrayHoles(array);
-  }
+  // For compatibility with JSC, we also sort elements inherited from
+  // the prototype chain on non-Array objects.
+  // We do this by copying them to this object and sorting only
+  // own elements. This is not very efficient, but sorting with
+  // inherited elements happens very, very rarely, if at all.
+  // The specification allows "implementation dependent" behavior
+  // if an element on the prototype chain has an element that
+  // might interact with sorting.
+  //
+  // We also move all non-undefined elements to the front of the
+  // array and move the undefineds after that. Holes are removed.
+  // This happens for Array as well as non-Array objects.
+  var num_non_undefined = %PrepareElementsForSort(array, length);
 
   QuickSort(array, 0, num_non_undefined);
 
-  if (!is_array && (num_non_undefined + 1 < max_prototype_element)) {
-    // For compatibility with JSC, we shadow any elements in the prototype
-    // chain that has become exposed by sort moving a hole to its position.
-    ShadowPrototypeElements(array, num_non_undefined, max_prototype_element);
-  }
-
   return array;
 }
 
-
 DEFINE_METHOD(
   GlobalArray.prototype,
   sort(comparefn) {
@@ -965,6 +795,7 @@ DEFINE_METHOD(
   }
 );
 
+
 DEFINE_METHOD_LEN(
   GlobalArray.prototype,
   lastIndexOf(element, index) {
@@ -1103,10 +934,6 @@ DEFINE_METHOD_LEN(
       if (end > length) end = length;
     }
 
-    if ((end - i) > 0 && %object_is_frozen(array)) {
-      throw %make_type_error(kArrayFunctionsOnFrozen);
-    }
-
     for (; i < end; i++)
       array[i] = value;
     return array;
@@ -1183,7 +1010,6 @@ utils.Export(function(to) {
   to.ArrayToString = ArrayToString;
   to.ArrayValues = ArrayValues;
   to.InnerArrayJoin = InnerArrayJoin;
-  to.InnerArraySort = InnerArraySort;
   to.InnerArrayToLocaleString = InnerArrayToLocaleString;
 });
 
@@ -1193,8 +1019,6 @@ utils.Export(function(to) {
   "array_keys_iterator", ArrayKeys,
   "array_values_iterator", ArrayValues,
   // Fallback implementations of Array builtins.
-  "array_pop", ArrayPopFallback,
-  "array_push", ArrayPushFallback,
   "array_shift", ArrayShiftFallback,
   "array_splice", ArraySpliceFallback,
   "array_unshift", ArrayUnshiftFallback,
diff --git a/deps/v8/src/js/intl.js b/deps/v8/src/js/intl.js
index 3c7112716c30cc..694c0afa74d55e 100644
--- a/deps/v8/src/js/intl.js
+++ b/deps/v8/src/js/intl.js
@@ -24,7 +24,7 @@ var GlobalIntl = global.Intl;
 var GlobalIntlDateTimeFormat = GlobalIntl.DateTimeFormat;
 var GlobalIntlNumberFormat = GlobalIntl.NumberFormat;
 var GlobalIntlCollator = GlobalIntl.Collator;
-var GlobalIntlPluralRules = utils.ImportNow("PluralRules");
+var GlobalIntlPluralRules = GlobalIntl.PluralRules;
 var GlobalIntlv8BreakIterator = GlobalIntl.v8BreakIterator;
 var GlobalNumber = global.Number;
 var GlobalRegExp = global.RegExp;
@@ -67,7 +67,7 @@ endmacro
 /**
  * Adds bound method to the prototype of the given object.
  */
-function AddBoundMethod(obj, methodName, implementation, length, typename,
+function AddBoundMethod(obj, methodName, implementation, length, type,
                         compat) {
   %CheckIsBootstrapping();
   var internalName = %CreatePrivateSymbol(methodName);
@@ -75,7 +75,10 @@ function AddBoundMethod(obj, methodName, implementation, length, typename,
   DEFINE_METHOD(
     obj.prototype,
     get [methodName]() {
-      var receiver = Unwrap(this, typename, obj, methodName, compat);
+      if(!IS_RECEIVER(this)) {
+        throw %make_type_error(kIncompatibleMethodReceiver, methodName, this);
+      }
+      var receiver = %IntlUnwrapReceiver(this, type, obj, methodName, compat);
       if (IS_UNDEFINED(receiver[internalName])) {
         var boundMethod;
         if (IS_UNDEFINED(length) || length === 2) {
@@ -120,31 +123,19 @@ function IntlConstruct(receiver, constructor, create, newTarget, args,
 
 
 
-function Unwrap(receiver, typename, constructor, method, compat) {
-  if (!%IsInitializedIntlObjectOfType(receiver, typename)) {
-    if (compat && receiver instanceof constructor) {
-      let fallback = receiver[IntlFallbackSymbol];
-      if (%IsInitializedIntlObjectOfType(fallback, typename)) {
-        return fallback;
-      }
-    }
-    throw %make_type_error(kIncompatibleMethodReceiver, method, receiver);
-  }
-  return receiver;
-}
-
-
 // -------------------------------------------------------------------
 
 /**
  * Caches available locales for each service.
  */
 var AVAILABLE_LOCALES = {
+   __proto__ : null,
   'collator': UNDEFINED,
   'numberformat': UNDEFINED,
   'dateformat': UNDEFINED,
   'breakiterator': UNDEFINED,
   'pluralrules': UNDEFINED,
+  'relativetimeformat': UNDEFINED,
 };
 
 /**
@@ -426,6 +417,9 @@ function resolveLocale(service, requestedLocales, options) {
   return resolved;
 }
 
+%InstallToContext([
+  "resolve_locale", resolveLocale
+]);
 
 /**
  * Look up the longest non-empty prefix of |locale| that is an element of
@@ -463,7 +457,7 @@ function attemptSingleLookup(availableLocales, requestedLocale) {
     var extensionMatch = %regexp_internal_match(
         GetUnicodeExtensionRE(), requestedLocale);
     var extension = IS_NULL(extensionMatch) ? '' : extensionMatch[0];
-    return {locale: availableLocale, extension: extension};
+    return {__proto__: null, locale: availableLocale, extension: extension};
   }
   return UNDEFINED;
 }
@@ -498,6 +492,7 @@ function lookupMatcher(service, requestedLocales) {
 
   // Didn't find a match, return default.
   return {
+    __proto__: null,
     locale: 'und',
     extension: ''
   };
@@ -782,15 +777,19 @@ function canonicalizeLanguageTag(localeID) {
     throw %make_type_error(kLanguageID);
   }
 
-  // Optimize for the most common case; a language code alone in
-  // the canonical form/lowercase (e.g. "en", "fil").
-  if (IS_STRING(localeID) &&
-      !IS_NULL(%regexp_internal_match(/^[a-z]{2,3}$/, localeID))) {
-    return localeID;
-  }
-
   var localeString = TO_STRING(localeID);
 
+  // Optimize for the most common case; a 2-letter language code in the
+  // canonical form/lowercase that is not one of deprecated codes
+  // (in, iw, ji, jw). Don't check for ~70 of 3-letter deprecated language
+  // codes. Instead, let them be handled by ICU in the slow path. Besides,
+  // fast-track 'fil' (3-letter canonical code).
+  if ((!IS_NULL(%regexp_internal_match(/^[a-z]{2}$/, localeString)) &&
+      IS_NULL(%regexp_internal_match(/^(in|iw|ji|jw)$/, localeString))) ||
+      localeString === "fil") {
+    return localeString;
+  }
+
   if (isStructuallyValidLanguageTag(localeString) === false) {
     throw %make_range_error(kInvalidLanguageTag, localeString);
   }
@@ -998,8 +997,9 @@ function CreateCollator(locales, options) {
    * for a collator.
    */
   var COLLATOR_KEY_MAP = {
-    'kn': {'property': 'numeric', 'type': 'boolean'},
-    'kf': {'property': 'caseFirst', 'type': 'string',
+    __proto__: null,
+    'kn': { __proto__: null, 'property': 'numeric', 'type': 'boolean'},
+    'kf': { __proto__: null, 'property': 'caseFirst', 'type': 'string',
            'values': ['false', 'lower', 'upper']}
   };
 
@@ -1049,7 +1049,7 @@ function CreateCollator(locales, options) {
 
   var collator = %CreateCollator(requestedLocale, internalOptions, resolved);
 
-  %MarkAsInitializedIntlObjectOfType(collator, 'collator');
+  %MarkAsInitializedIntlObjectOfType(collator, COLLATOR_TYPE);
   collator[resolvedSymbol] = resolved;
 
   return collator;
@@ -1075,8 +1075,12 @@ function CollatorConstructor() {
 DEFINE_METHOD(
   GlobalIntlCollator.prototype,
   resolvedOptions() {
-    var coll = Unwrap(this, 'collator', GlobalIntlCollator, 'resolvedOptions',
-                      false);
+    var methodName = 'resolvedOptions';
+    if(!IS_RECEIVER(this)) {
+      throw %make_type_error(kIncompatibleMethodReceiver, methodName, this);
+    }
+    var coll = %IntlUnwrapReceiver(this, COLLATOR_TYPE, GlobalIntlCollator,
+                                   methodName, false);
     return {
       locale: coll[resolvedSymbol].locale,
       usage: coll[resolvedSymbol].usage,
@@ -1119,7 +1123,7 @@ function compare(collator, x, y) {
 };
 
 
-AddBoundMethod(GlobalIntlCollator, 'compare', compare, 2, 'collator', false);
+AddBoundMethod(GlobalIntlCollator, 'compare', compare, 2, COLLATOR_TYPE, false);
 
 function PluralRulesConstructor() {
   if (IS_UNDEFINED(new.target)) {
@@ -1162,7 +1166,7 @@ function PluralRulesConstructor() {
   var pluralRules = %CreatePluralRules(requestedLocale, internalOptions,
                                        resolved);
 
-  %MarkAsInitializedIntlObjectOfType(pluralRules, 'pluralrules');
+  %MarkAsInitializedIntlObjectOfType(pluralRules, PLURAL_RULES_TYPE);
   pluralRules[resolvedSymbol] = resolved;
 
   return pluralRules;
@@ -1172,7 +1176,7 @@ function PluralRulesConstructor() {
 DEFINE_METHOD(
   GlobalIntlPluralRules.prototype,
   resolvedOptions() {
-    if (!%IsInitializedIntlObjectOfType(this, 'pluralrules')) {
+    if (!%IsInitializedIntlObjectOfType(this, PLURAL_RULES_TYPE)) {
       throw %make_type_error(kIncompatibleMethodReceiver,
                              'Intl.PluralRules.prototype.resolvedOptions',
                              this);
@@ -1213,7 +1217,7 @@ DEFINE_METHOD(
 DEFINE_METHOD(
   GlobalIntlPluralRules.prototype,
   select(value) {
-    if (!%IsInitializedIntlObjectOfType(this, 'pluralrules')) {
+    if (!%IsInitializedIntlObjectOfType(this, PLURAL_RULES_TYPE)) {
       throw %make_type_error(kIncompatibleMethodReceiver,
                             'Intl.PluralRules.prototype.select',
                             this);
@@ -1341,7 +1345,8 @@ function CreateNumberFormat(locales, options) {
    * for a number format.
    */
   var NUMBER_FORMAT_KEY_MAP = {
-    'nu': {'property': UNDEFINED, 'type': 'string'}
+    __proto__: null,
+    'nu': {__proto__: null, 'property': UNDEFINED, 'type': 'string'}
   };
 
   var extension = setOptions(options, extensionMap, NUMBER_FORMAT_KEY_MAP,
@@ -1374,7 +1379,7 @@ function CreateNumberFormat(locales, options) {
         {value: currencyDisplay, writable: true});
   }
 
-  %MarkAsInitializedIntlObjectOfType(numberFormat, 'numberformat');
+  %MarkAsInitializedIntlObjectOfType(numberFormat, NUMBER_FORMAT_TYPE);
   numberFormat[resolvedSymbol] = resolved;
 
   return numberFormat;
@@ -1400,8 +1405,13 @@ function NumberFormatConstructor() {
 DEFINE_METHOD(
   GlobalIntlNumberFormat.prototype,
   resolvedOptions() {
-    var format = Unwrap(this, 'numberformat', GlobalIntlNumberFormat,
-                        'resolvedOptions', true);
+    var methodName = 'resolvedOptions';
+    if(!IS_RECEIVER(this)) {
+      throw %make_type_error(kIncompatibleMethodReceiver, methodName, this);
+    }
+    var format = %IntlUnwrapReceiver(this, NUMBER_FORMAT_TYPE,
+                                     GlobalIntlNumberFormat,
+                                     methodName, true);
     var result = {
       locale: format[resolvedSymbol].locale,
       numberingSystem: format[resolvedSymbol].numberingSystem,
@@ -1459,10 +1469,6 @@ function formatNumber(formatter, value) {
   return %InternalNumberFormat(formatter, number);
 }
 
-
-AddBoundMethod(GlobalIntlNumberFormat, 'format', formatNumber, 1,
-               'numberformat', true);
-
 /**
  * Returns a string that matches LDML representation of the options object.
  */
@@ -1701,8 +1707,9 @@ function CreateDateTimeFormat(locales, options) {
    * for a date/time format.
    */
   var DATETIME_FORMAT_KEY_MAP = {
-    'ca': {'property': UNDEFINED, 'type': 'string'},
-    'nu': {'property': UNDEFINED, 'type': 'string'}
+    __proto__: null,
+    'ca': {__proto__: null, 'property': UNDEFINED, 'type': 'string'},
+    'nu': {__proto__: null, 'property': UNDEFINED, 'type': 'string'}
   };
 
   var extension = setOptions(options, extensionMap, DATETIME_FORMAT_KEY_MAP,
@@ -1730,13 +1737,14 @@ function CreateDateTimeFormat(locales, options) {
   });
 
   var dateFormat = %CreateDateTimeFormat(
-    requestedLocale, {skeleton: ldmlString, timeZone: tz}, resolved);
+    requestedLocale,
+    {__proto__: null, skeleton: ldmlString, timeZone: tz}, resolved);
 
   if (resolved.timeZone === "Etc/Unknown") {
     throw %make_range_error(kUnsupportedTimeZone, tz);
   }
 
-  %MarkAsInitializedIntlObjectOfType(dateFormat, 'dateformat');
+  %MarkAsInitializedIntlObjectOfType(dateFormat, DATE_TIME_FORMAT_TYPE);
   dateFormat[resolvedSymbol] = resolved;
 
   return dateFormat;
@@ -1762,8 +1770,13 @@ function DateTimeFormatConstructor() {
 DEFINE_METHOD(
   GlobalIntlDateTimeFormat.prototype,
   resolvedOptions() {
-    var format = Unwrap(this, 'dateformat', GlobalIntlDateTimeFormat,
-                        'resolvedOptions', true);
+    var methodName = 'resolvedOptions';
+    if(!IS_RECEIVER(this)) {
+      throw %make_type_error(kIncompatibleMethodReceiver, methodName, this);
+    }
+    var format = %IntlUnwrapReceiver(this, DATE_TIME_FORMAT_TYPE,
+                                     GlobalIntlDateTimeFormat,
+                                     methodName, true);
 
     /**
      * Maps ICU calendar names to LDML/BCP47 types for key 'ca'.
@@ -1772,6 +1785,7 @@ DEFINE_METHOD(
      * http://www.unicode.org/repos/cldr/tags/latest/common/bcp47/calendar.xml
      */
     var ICU_CALENDAR_MAP = {
+      __proto__: null,
       'gregorian': 'gregory',
       'ethiopic-amete-alem': 'ethioaa'
     };
@@ -1836,32 +1850,8 @@ function formatDate(formatter, dateValue) {
   return %InternalDateFormat(formatter, dateMs);
 }
 
-DEFINE_METHOD(
-  GlobalIntlDateTimeFormat.prototype,
-  formatToParts(dateValue) {
-    REQUIRE_OBJECT_COERCIBLE(this, "Intl.DateTimeFormat.prototype.formatToParts");
-    if (!IS_OBJECT(this)) {
-      throw %make_type_error(kCalledOnNonObject, this);
-    }
-    if (!%IsInitializedIntlObjectOfType(this, 'dateformat')) {
-      throw %make_type_error(kIncompatibleMethodReceiver,
-                            'Intl.DateTimeFormat.prototype.formatToParts',
-                            this);
-    }
-    var dateMs;
-    if (IS_UNDEFINED(dateValue)) {
-      dateMs = %DateCurrentTime();
-    } else {
-      dateMs = TO_NUMBER(dateValue);
-    }
-
-    return %InternalDateFormatToParts(this, dateMs);
-  }
-);
-
-
 // Length is 1 as specified in ECMA 402 v2+
-AddBoundMethod(GlobalIntlDateTimeFormat, 'format', formatDate, 1, 'dateformat',
+AddBoundMethod(GlobalIntlDateTimeFormat, 'format', formatDate, 1, DATE_TIME_FORMAT_TYPE,
                true);
 
 
@@ -1931,7 +1921,7 @@ function CreateBreakIterator(locales, options) {
 
   var iterator = %CreateBreakIterator(locale.locale, internalOptions, resolved);
 
-  %MarkAsInitializedIntlObjectOfType(iterator, 'breakiterator');
+  %MarkAsInitializedIntlObjectOfType(iterator, BREAK_ITERATOR_TYPE);
   iterator[resolvedSymbol] = resolved;
 
   return iterator;
@@ -1961,8 +1951,13 @@ DEFINE_METHOD(
       throw %make_type_error(kOrdinaryFunctionCalledAsConstructor);
     }
 
-    var segmenter = Unwrap(this, 'breakiterator', GlobalIntlv8BreakIterator,
-                           'resolvedOptions', false);
+    var methodName = 'resolvedOptions';
+    if(!IS_RECEIVER(this)) {
+      throw %make_type_error(kIncompatibleMethodReceiver, methodName, this);
+    }
+    var segmenter = %IntlUnwrapReceiver(this, BREAK_ITERATOR_TYPE,
+                                        GlobalIntlv8BreakIterator, methodName,
+                                        false);
 
     return {
       locale: segmenter[resolvedSymbol].locale,
@@ -2032,16 +2027,19 @@ function breakType(iterator) {
 
 
 AddBoundMethod(GlobalIntlv8BreakIterator, 'adoptText', adoptText, 1,
-               'breakiterator');
-AddBoundMethod(GlobalIntlv8BreakIterator, 'first', first, 0, 'breakiterator');
-AddBoundMethod(GlobalIntlv8BreakIterator, 'next', next, 0, 'breakiterator');
+               BREAK_ITERATOR_TYPE, false);
+AddBoundMethod(GlobalIntlv8BreakIterator, 'first', first, 0,
+               BREAK_ITERATOR_TYPE, false);
+AddBoundMethod(GlobalIntlv8BreakIterator, 'next', next, 0,
+               BREAK_ITERATOR_TYPE, false);
 AddBoundMethod(GlobalIntlv8BreakIterator, 'current', current, 0,
-               'breakiterator');
+               BREAK_ITERATOR_TYPE, false);
 AddBoundMethod(GlobalIntlv8BreakIterator, 'breakType', breakType, 0,
-               'breakiterator');
+               BREAK_ITERATOR_TYPE, false);
 
 // Save references to Intl objects and methods we use, for added security.
 var savedObjects = {
+  __proto__: null,
   'collator': GlobalIntlCollator,
   'numberformat': GlobalIntlNumberFormat,
   'dateformatall': GlobalIntlDateTimeFormat,
@@ -2053,6 +2051,7 @@ var savedObjects = {
 // Default (created with undefined locales and options parameters) collator,
 // number and date format instances. They'll be created as needed.
 var defaultObjects = {
+  __proto__: null,
   'collator': UNDEFINED,
   'numberformat': UNDEFINED,
   'dateformatall': UNDEFINED,
diff --git a/deps/v8/src/js/macros.py b/deps/v8/src/js/macros.py
index 75f01e38c97d25..9e5c6d72d6a6a2 100644
--- a/deps/v8/src/js/macros.py
+++ b/deps/v8/src/js/macros.py
@@ -83,3 +83,11 @@
 # Constants.  The compiler constant folds them.
 define INFINITY = (1/0);
 define UNDEFINED = (void 0);
+
+# This should be kept consistent with Intl::Type.
+define NUMBER_FORMAT_TYPE = 0;
+define COLLATOR_TYPE = 1;
+define DATE_TIME_FORMAT_TYPE = 2;
+define PLURAL_RULES_TYPE = 3;
+define BREAK_ITERATOR_TYPE = 4;
+define LOCALE_TYPE = 5;
diff --git a/deps/v8/src/js/typedarray.js b/deps/v8/src/js/typedarray.js
index c3987664312c7a..3d42498b035126 100644
--- a/deps/v8/src/js/typedarray.js
+++ b/deps/v8/src/js/typedarray.js
@@ -14,7 +14,6 @@
 // array.js has to come before typedarray.js for this to work
 var ArrayToString = utils.ImportNow("ArrayToString");
 var InnerArrayJoin;
-var InnerArraySort;
 var InnerArrayToLocaleString;
 
 macro TYPED_ARRAYS(FUNCTION)
@@ -45,7 +44,6 @@ var GlobalTypedArray = %object_get_prototype_of(GlobalUint8Array);
 
 utils.Import(function(from) {
   InnerArrayJoin = from.InnerArrayJoin;
-  InnerArraySort = from.InnerArraySort;
   InnerArrayToLocaleString = from.InnerArrayToLocaleString;
 });
 
@@ -59,26 +57,6 @@ function ValidateTypedArray(array, methodName) {
     throw %make_type_error(kDetachedOperation, methodName);
 }
 
-// ES6 draft 05-18-15, section 22.2.3.25
-DEFINE_METHOD(
-  GlobalTypedArray.prototype,
-  sort(comparefn) {
-    ValidateTypedArray(this, "%TypedArray%.prototype.sort");
-
-    if (!IS_UNDEFINED(comparefn) && !IS_CALLABLE(comparefn)) {
-      throw %make_type_error(kBadSortComparisonFunction, comparefn);
-    }
-
-    var length = %_TypedArrayGetLength(this);
-
-    if (IS_UNDEFINED(comparefn)) {
-      return %TypedArraySortFast(this);
-    }
-
-    return InnerArraySort(this, length, comparefn);
-  }
-);
-
 
 // ES6 section 22.2.3.27
 DEFINE_METHOD(
diff --git a/deps/v8/src/json-parser.cc b/deps/v8/src/json-parser.cc
index fa40731f45d6c3..d7205891cbd34d 100644
--- a/deps/v8/src/json-parser.cc
+++ b/deps/v8/src/json-parser.cc
@@ -10,6 +10,7 @@
 #include "src/field-type.h"
 #include "src/messages.h"
 #include "src/objects-inl.h"
+#include "src/objects/hash-table-inl.h"
 #include "src/property-descriptor.h"
 #include "src/string-hasher.h"
 #include "src/transitions.h"
@@ -59,7 +60,7 @@ MaybeHandle<Object> JsonParseInternalizer::Internalize(Isolate* isolate,
   Handle<JSObject> holder =
       isolate->factory()->NewJSObject(isolate->object_function());
   Handle<String> name = isolate->factory()->empty_string();
-  JSObject::AddProperty(holder, name, object, NONE);
+  JSObject::AddProperty(isolate, holder, name, object, NONE);
   return internalizer.InternalizeJsonProperty(holder, name);
 }
 
@@ -142,7 +143,7 @@ JsonParser<seq_one_byte>::JsonParser(Isolate* isolate, Handle<String> source)
                           isolate_),
       position_(-1),
       properties_(&zone_) {
-  source_ = String::Flatten(source_);
+  source_ = String::Flatten(isolate, source_);
   pretenure_ = (source_length_ >= kPretenureTreshold) ? TENURED : NOT_TENURED;
 
   // Optimized fast case where we only have Latin1 characters.
@@ -364,7 +365,7 @@ Handle<Object> JsonParser<seq_one_byte>::ParseJsonObject() {
   HandleScope scope(isolate());
   Handle<JSObject> json_object =
       factory()->NewJSObject(object_constructor(), pretenure_);
-  Handle<Map> map(json_object->map());
+  Handle<Map> map(json_object->map(), isolate());
   int descriptor = 0;
   VectorSegment<ZoneVector<Handle<Object>>> properties(&properties_);
   DCHECK_EQ(c0_, '{');
@@ -403,7 +404,7 @@ Handle<Object> JsonParser<seq_one_byte>::ParseJsonObject() {
       Handle<Map> target;
       if (seq_one_byte) {
         DisallowHeapAllocation no_gc;
-        TransitionsAccessor transitions(*map, &no_gc);
+        TransitionsAccessor transitions(isolate(), *map, &no_gc);
         key = transitions.ExpectedTransitionKey();
         follow_expected = !key.is_null() && ParseJsonString(key);
         // If the expected transition hits, follow it.
@@ -418,9 +419,9 @@ Handle<Object> JsonParser<seq_one_byte>::ParseJsonObject() {
         if (key.is_null()) return ReportUnexpectedCharacter();
 
         // If a transition was found, follow it and continue.
-        transitioning =
-            TransitionsAccessor(map).FindTransitionToField(key).ToHandle(
-                &target);
+        transitioning = TransitionsAccessor(isolate(), map)
+                            .FindTransitionToField(key)
+                            .ToHandle(&target);
       }
       if (c0_ != ':') return ReportUnexpectedCharacter();
 
@@ -440,8 +441,9 @@ Handle<Object> JsonParser<seq_one_byte>::ParseJsonObject() {
                    ->NowContains(value)) {
             Handle<FieldType> value_type(
                 value->OptimalType(isolate(), expected_representation));
-            Map::GeneralizeField(target, descriptor, details.constness(),
-                                 expected_representation, value_type);
+            Map::GeneralizeField(isolate(), target, descriptor,
+                                 details.constness(), expected_representation,
+                                 value_type);
           }
           DCHECK(target->instance_descriptors()
                      ->GetFieldType(descriptor)
diff --git a/deps/v8/src/json-parser.h b/deps/v8/src/json-parser.h
index fc60e29ec93c59..ac1442b4143059 100644
--- a/deps/v8/src/json-parser.h
+++ b/deps/v8/src/json-parser.h
@@ -40,7 +40,6 @@ class JsonParser BASE_EMBEDDED {
  public:
   V8_WARN_UNUSED_RESULT static MaybeHandle<Object> Parse(
       Isolate* isolate, Handle<String> source, Handle<Object> reviver) {
-    PostponeInterruptsScope no_debug_breaks(isolate, StackGuard::DEBUGBREAK);
     Handle<Object> result;
     ASSIGN_RETURN_ON_EXCEPTION(isolate, result,
                                JsonParser(isolate, source).ParseJson(), Object);
@@ -58,19 +57,19 @@ class JsonParser BASE_EMBEDDED {
   // Parse a string containing a single JSON value.
   MaybeHandle<Object> ParseJson();
 
-  INLINE(void Advance());
+  V8_INLINE void Advance();
 
   // The JSON lexical grammar is specified in the ECMAScript 5 standard,
   // section 15.12.1.1. The only allowed whitespace characters between tokens
   // are tab, carriage-return, newline and space.
 
-  INLINE(void AdvanceSkipWhitespace());
-  INLINE(void SkipWhitespace());
-  INLINE(uc32 AdvanceGetChar());
+  V8_INLINE void AdvanceSkipWhitespace();
+  V8_INLINE void SkipWhitespace();
+  V8_INLINE uc32 AdvanceGetChar();
 
   // Checks that current charater is c.
   // If so, then consume c and skip whitespace.
-  INLINE(bool MatchSkipWhiteSpace(uc32 c));
+  V8_INLINE bool MatchSkipWhiteSpace(uc32 c);
 
   // A JSON string (production JSONString) is subset of valid JavaScript string
   // literals. The string must only be double-quoted (not single-quoted), and
diff --git a/deps/v8/src/json-stringifier.cc b/deps/v8/src/json-stringifier.cc
index d77a761b130f0a..a0f74899ecb020 100644
--- a/deps/v8/src/json-stringifier.cc
+++ b/deps/v8/src/json-stringifier.cc
@@ -94,7 +94,6 @@ MaybeHandle<Object> JsonStringifier::Stringify(Handle<Object> object,
   if (!gap->IsUndefined(isolate_) && !InitializeGap(gap)) {
     return MaybeHandle<Object>();
   }
-  PostponeInterruptsScope no_debug_breaks(isolate_, StackGuard::DEBUGBREAK);
   Result result = SerializeObject(object);
   if (result == UNCHANGED) return factory()->undefined_value();
   if (result == SUCCESS) return builder_.Finish();
@@ -134,10 +133,10 @@ bool JsonStringifier::InitializeReplacer(Handle<Object> replacer) {
       if (key.is_null()) continue;
       // Object keys are internalized, so do it here.
       key = factory()->InternalizeString(key);
-      set = OrderedHashSet::Add(set, key);
+      set = OrderedHashSet::Add(isolate_, set, key);
     }
     property_list_ = OrderedHashSet::ConvertToKeysArray(
-        set, GetKeysConversion::kKeepNumbers);
+        isolate_, set, GetKeysConversion::kKeepNumbers);
     property_list_ = handle_scope.CloseAndEscape(property_list_);
   } else if (replacer->IsCallable()) {
     replacer_function_ = Handle<JSReceiver>::cast(replacer);
@@ -232,8 +231,8 @@ Handle<JSReceiver> JsonStringifier::CurrentHolder(
   if (length == 0) {
     Handle<JSObject> holder =
         factory()->NewJSObject(isolate_->object_function());
-    JSObject::AddProperty(holder, factory()->empty_string(), initial_holder,
-                          NONE);
+    JSObject::AddProperty(isolate_, holder, factory()->empty_string(),
+                          initial_holder, NONE);
     return holder;
   } else {
     FixedArray* elements = FixedArray::cast(stack_->elements());
@@ -521,7 +520,7 @@ JsonStringifier::Result JsonStringifier::SerializeJSObject(
   if (stack_push != SUCCESS) return stack_push;
 
   if (property_list_.is_null() &&
-      object->map()->instance_type() > LAST_CUSTOM_ELEMENTS_RECEIVER &&
+      !object->map()->IsCustomElementsReceiverMap() &&
       object->HasFastProperties() &&
       Handle<JSObject>::cast(object)->elements()->length() == 0) {
     DCHECK(object->IsJSObject());
@@ -529,7 +528,7 @@ JsonStringifier::Result JsonStringifier::SerializeJSObject(
     Handle<JSObject> js_obj = Handle<JSObject>::cast(object);
     DCHECK(!js_obj->HasIndexedInterceptor());
     DCHECK(!js_obj->HasNamedInterceptor());
-    Handle<Map> map(js_obj->map());
+    Handle<Map> map(js_obj->map(), isolate_);
     builder_.AppendCharacter('{');
     Indent();
     bool comma = false;
@@ -705,7 +704,7 @@ void JsonStringifier::SerializeDeferredKey(bool deferred_comma,
 }
 
 void JsonStringifier::SerializeString(Handle<String> object) {
-  object = String::Flatten(object);
+  object = String::Flatten(isolate_, object);
   if (builder_.CurrentEncoding() == String::ONE_BYTE_ENCODING) {
     if (object->IsOneByteRepresentationUnderneath()) {
       SerializeString_<uint8_t, uint8_t>(object);
diff --git a/deps/v8/src/json-stringifier.h b/deps/v8/src/json-stringifier.h
index 67cc8ea8439b1e..e9b97c7d1f6749 100644
--- a/deps/v8/src/json-stringifier.h
+++ b/deps/v8/src/json-stringifier.h
@@ -33,15 +33,14 @@ class JsonStringifier BASE_EMBEDDED {
       Handle<Object> value, Handle<Object> key, Handle<Object> initial_holder);
 
   // Entry point to serialize the object.
-  INLINE(Result SerializeObject(Handle<Object> obj)) {
+  V8_INLINE Result SerializeObject(Handle<Object> obj) {
     return Serialize_<false>(obj, false, factory()->empty_string());
   }
 
   // Serialize an array element.
   // The index may serve as argument for the toJSON function.
-  INLINE(Result SerializeElement(Isolate* isolate,
-                                 Handle<Object> object,
-                                 int i)) {
+  V8_INLINE Result SerializeElement(Isolate* isolate, Handle<Object> object,
+                                    int i) {
     return Serialize_<false>(object,
                              false,
                              Handle<Object>(Smi::FromInt(i), isolate));
@@ -50,9 +49,8 @@ class JsonStringifier BASE_EMBEDDED {
   // Serialize a object property.
   // The key may or may not be serialized depending on the property.
   // The key may also serve as argument for the toJSON function.
-  INLINE(Result SerializeProperty(Handle<Object> object,
-                                  bool deferred_comma,
-                                  Handle<String> deferred_key)) {
+  V8_INLINE Result SerializeProperty(Handle<Object> object, bool deferred_comma,
+                                     Handle<String> deferred_key) {
     DCHECK(!deferred_key.is_null());
     return Serialize_<true>(object, deferred_comma, deferred_key);
   }
@@ -60,20 +58,20 @@ class JsonStringifier BASE_EMBEDDED {
   template <bool deferred_string_key>
   Result Serialize_(Handle<Object> object, bool comma, Handle<Object> key);
 
-  INLINE(void SerializeDeferredKey(bool deferred_comma,
-                                   Handle<Object> deferred_key));
+  V8_INLINE void SerializeDeferredKey(bool deferred_comma,
+                                      Handle<Object> deferred_key);
 
   Result SerializeSmi(Smi* object);
 
   Result SerializeDouble(double number);
-  INLINE(Result SerializeHeapNumber(Handle<HeapNumber> object)) {
+  V8_INLINE Result SerializeHeapNumber(Handle<HeapNumber> object) {
     return SerializeDouble(object->value());
   }
 
   Result SerializeJSValue(Handle<JSValue> object);
 
-  INLINE(Result SerializeJSArray(Handle<JSArray> object));
-  INLINE(Result SerializeJSObject(Handle<JSObject> object));
+  V8_INLINE Result SerializeJSArray(Handle<JSArray> object);
+  V8_INLINE Result SerializeJSObject(Handle<JSObject> object);
 
   Result SerializeJSProxy(Handle<JSProxy> object);
   Result SerializeJSReceiverSlow(Handle<JSReceiver> object);
@@ -83,20 +81,20 @@ class JsonStringifier BASE_EMBEDDED {
   void SerializeString(Handle<String> object);
 
   template <typename SrcChar, typename DestChar>
-  INLINE(static void SerializeStringUnchecked_(
+  V8_INLINE static void SerializeStringUnchecked_(
       Vector<const SrcChar> src,
-      IncrementalStringBuilder::NoExtend<DestChar>* dest));
+      IncrementalStringBuilder::NoExtend<DestChar>* dest);
 
   template <typename SrcChar, typename DestChar>
-  INLINE(void SerializeString_(Handle<String> string));
+  V8_INLINE void SerializeString_(Handle<String> string);
 
   template <typename Char>
-  INLINE(static bool DoNotEscape(Char c));
+  V8_INLINE static bool DoNotEscape(Char c);
 
-  INLINE(void NewLine());
-  INLINE(void Indent() { indent_++; });
-  INLINE(void Unindent() { indent_--; });
-  INLINE(void Separator(bool first));
+  V8_INLINE void NewLine();
+  V8_INLINE void Indent() { indent_++; }
+  V8_INLINE void Unindent() { indent_--; }
+  V8_INLINE void Separator(bool first);
 
   Handle<JSReceiver> CurrentHolder(Handle<Object> value,
                                    Handle<Object> inital_holder);
diff --git a/deps/v8/src/keys.cc b/deps/v8/src/keys.cc
index 7af093744e2e27..12bc791ba48026 100644
--- a/deps/v8/src/keys.cc
+++ b/deps/v8/src/keys.cc
@@ -10,6 +10,9 @@
 #include "src/identity-map.h"
 #include "src/isolate-inl.h"
 #include "src/objects-inl.h"
+#include "src/objects/api-callbacks.h"
+#include "src/objects/hash-table-inl.h"
+#include "src/objects/module-inl.h"
 #include "src/property-descriptor.h"
 #include "src/prototype.h"
 
@@ -47,12 +50,12 @@ Handle<FixedArray> KeyAccumulator::GetKeys(GetKeysConversion convert) {
     return isolate_->factory()->empty_fixed_array();
   }
   if (mode_ == KeyCollectionMode::kOwnOnly &&
-      keys_->map() == isolate_->heap()->fixed_array_map()) {
+      keys_->map() == ReadOnlyRoots(isolate_).fixed_array_map()) {
     return Handle<FixedArray>::cast(keys_);
   }
   USE(ContainsOnlyValidKeys);
   Handle<FixedArray> result =
-      OrderedHashSet::ConvertToKeysArray(keys(), convert);
+      OrderedHashSet::ConvertToKeysArray(isolate(), keys(), convert);
   DCHECK(ContainsOnlyValidKeys(result));
   return result;
 }
@@ -77,7 +80,7 @@ void KeyAccumulator::AddKey(Handle<Object> key, AddKeyConversion convert) {
       Handle<String>::cast(key)->AsArrayIndex(&index)) {
     key = isolate_->factory()->NewNumberFromUint(index);
   }
-  Handle<OrderedHashSet> new_set = OrderedHashSet::Add(keys(), key);
+  Handle<OrderedHashSet> new_set = OrderedHashSet::Add(isolate(), keys(), key);
   if (*new_set != *keys_) {
     // The keys_ Set is converted directly to a FixedArray in GetKeys which can
     // be left-trimmer. Hence the previous Set should not keep a pointer to the
@@ -133,9 +136,7 @@ MaybeHandle<FixedArray> FilterProxyKeys(KeyAccumulator* accumulator,
     }
     store_position++;
   }
-  if (store_position == 0) return isolate->factory()->empty_fixed_array();
-  keys->Shrink(store_position);
-  return keys;
+  return FixedArray::ShrinkOrEmpty(keys, store_position);
 }
 
 // Returns "nothing" in case of exception, "true" on success.
@@ -373,10 +374,6 @@ MaybeHandle<FixedArray> GetOwnKeysWithElements(Isolate* isolate,
   return result;
 }
 
-bool OnlyHasSimpleProperties(Map* map) {
-  return map->instance_type() > LAST_CUSTOM_ELEMENTS_RECEIVER;
-}
-
 }  // namespace
 
 MaybeHandle<FixedArray> FastKeyAccumulator::GetKeys(
@@ -396,7 +393,7 @@ MaybeHandle<FixedArray> FastKeyAccumulator::GetKeysFast(
     GetKeysConversion keys_conversion) {
   bool own_only = has_empty_prototype_ || mode_ == KeyCollectionMode::kOwnOnly;
   Map* map = receiver_->map();
-  if (!own_only || !OnlyHasSimpleProperties(map)) {
+  if (!own_only || map->IsCustomElementsReceiverMap()) {
     return MaybeHandle<FixedArray>();
   }
 
@@ -594,7 +591,7 @@ int CollectOwnPropertyNamesInternal(Handle<JSObject> object,
 
     if (filter & ONLY_ALL_CAN_READ) {
       if (details.kind() != kAccessor) continue;
-      Object* accessors = descs->GetValue(i);
+      Object* accessors = descs->GetStrongValue(i);
       if (!accessors->IsAccessorInfo()) continue;
       if (!AccessorInfo::cast(accessors)->all_can_read()) continue;
     }
@@ -627,7 +624,7 @@ Handle<FixedArray> GetOwnEnumPropertyDictionaryKeys(Isolate* isolate,
     return isolate->factory()->empty_fixed_array();
   }
   Handle<FixedArray> storage = isolate->factory()->NewFixedArray(length);
-  T::CopyEnumKeysTo(dictionary, storage, mode, accumulator);
+  T::CopyEnumKeysTo(isolate, dictionary, storage, mode, accumulator);
   return storage;
 }
 }  // namespace
@@ -665,7 +662,9 @@ Maybe<bool> KeyAccumulator::CollectOwnPropertyNames(Handle<JSReceiver> receiver,
       // throws for uninitialized exports.
       for (int i = 0, n = enum_keys->length(); i < n; ++i) {
         Handle<String> key(String::cast(enum_keys->get(i)), isolate_);
-        if (Handle<JSModuleNamespace>::cast(object)->GetExport(key).is_null()) {
+        if (Handle<JSModuleNamespace>::cast(object)
+                ->GetExport(isolate(), key)
+                .is_null()) {
           return Nothing<bool>();
         }
       }
@@ -723,7 +722,7 @@ Maybe<bool> KeyAccumulator::CollectOwnKeys(Handle<JSReceiver> receiver,
                                            Handle<JSObject> object) {
   // Check access rights if required.
   if (object->IsAccessCheckNeeded() &&
-      !isolate_->MayAccess(handle(isolate_->context()), object)) {
+      !isolate_->MayAccess(handle(isolate_->context(), isolate_), object)) {
     // The cross-origin spec says that [[Enumerate]] shall return an empty
     // iterator when it doesn't have access...
     if (mode_ == KeyCollectionMode::kIncludePrototypes) {
@@ -770,11 +769,17 @@ Handle<FixedArray> KeyAccumulator::GetOwnEnumPropertyKeys(
 
 namespace {
 
-struct NameComparator {
+class NameComparator {
+ public:
+  explicit NameComparator(Isolate* isolate) : isolate_(isolate) {}
+
   bool operator()(uint32_t hash1, uint32_t hash2, const Handle<Name>& key1,
                   const Handle<Name>& key2) const {
-    return Name::Equals(key1, key2);
+    return Name::Equals(isolate_, key1, key2);
   }
+
+ private:
+  Isolate* isolate_;
 };
 
 }  // namespace
@@ -873,7 +878,7 @@ Maybe<bool> KeyAccumulator::CollectOwnJSProxyKeys(Handle<JSReceiver> receiver,
   base::TemplateHashMapImpl<Handle<Name>, int, NameComparator,
                             ZoneAllocationPolicy>
       unchecked_result_keys(ZoneHashMap::kDefaultHashMapCapacity,
-                            NameComparator(), alloc);
+                            NameComparator(isolate_), alloc);
   int unchecked_result_keys_size = 0;
   for (int i = 0; i < trap_result->length(); ++i) {
     Handle<Name> key(Name::cast(trap_result->get(i)), isolate_);
@@ -937,7 +942,8 @@ Maybe<bool> KeyAccumulator::CollectOwnJSProxyTargetKeys(
   Handle<FixedArray> keys;
   ASSIGN_RETURN_ON_EXCEPTION_VALUE(
       isolate_, keys,
-      KeyAccumulator::GetKeys(target, KeyCollectionMode::kOwnOnly, filter_,
+      KeyAccumulator::GetKeys(target, KeyCollectionMode::kOwnOnly,
+                              ALL_PROPERTIES,
                               GetKeysConversion::kConvertToString, is_for_in_),
       Nothing<bool>());
   Maybe<bool> result = AddKeysFromJSProxy(proxy, keys);
diff --git a/deps/v8/src/keys.h b/deps/v8/src/keys.h
index bd4f048c697a65..649d6a95999fc7 100644
--- a/deps/v8/src/keys.h
+++ b/deps/v8/src/keys.h
@@ -7,6 +7,7 @@
 
 #include "src/objects.h"
 #include "src/objects/hash-table.h"
+#include "src/objects/ordered-hash-table.h"
 
 namespace v8 {
 namespace internal {
diff --git a/deps/v8/src/label.h b/deps/v8/src/label.h
index eb93397518b327..cf81e6c30318ea 100644
--- a/deps/v8/src/label.h
+++ b/deps/v8/src/label.h
@@ -46,18 +46,18 @@ class Label {
 #endif
 #endif
 
-  INLINE(~Label()) {
+  V8_INLINE ~Label() {
     DCHECK(!is_linked());
     DCHECK(!is_near_linked());
   }
 
-  INLINE(void Unuse()) { pos_ = 0; }
-  INLINE(void UnuseNear()) { near_link_pos_ = 0; }
+  V8_INLINE void Unuse() { pos_ = 0; }
+  V8_INLINE void UnuseNear() { near_link_pos_ = 0; }
 
-  INLINE(bool is_bound() const) { return pos_ < 0; }
-  INLINE(bool is_unused() const) { return pos_ == 0 && near_link_pos_ == 0; }
-  INLINE(bool is_linked() const) { return pos_ > 0; }
-  INLINE(bool is_near_linked() const) { return near_link_pos_ > 0; }
+  V8_INLINE bool is_bound() const { return pos_ < 0; }
+  V8_INLINE bool is_unused() const { return pos_ == 0 && near_link_pos_ == 0; }
+  V8_INLINE bool is_linked() const { return pos_ > 0; }
+  V8_INLINE bool is_near_linked() const { return near_link_pos_ > 0; }
 
   // Returns the position of bound or linked labels. Cannot be used
   // for unused labels.
diff --git a/deps/v8/src/layout-descriptor-inl.h b/deps/v8/src/layout-descriptor-inl.h
index 93818ef71075e1..e37b4a2edff3fb 100644
--- a/deps/v8/src/layout-descriptor-inl.h
+++ b/deps/v8/src/layout-descriptor-inl.h
@@ -6,6 +6,8 @@
 #define V8_LAYOUT_DESCRIPTOR_INL_H_
 
 #include "src/layout-descriptor.h"
+#include "src/objects-inl.h"
+#include "src/objects/descriptor-array.h"
 
 namespace v8 {
 namespace internal {
@@ -16,14 +18,15 @@ LayoutDescriptor* LayoutDescriptor::FromSmi(Smi* smi) {
 
 
 Handle<LayoutDescriptor> LayoutDescriptor::New(Isolate* isolate, int length) {
-  if (length <= kSmiValueSize) {
+  if (length <= kBitsInSmiLayout) {
     // The whole bit vector fits into a smi.
     return handle(LayoutDescriptor::FromSmi(Smi::kZero), isolate);
   }
   int backing_store_length = GetSlowModeBackingStoreLength(length);
   Handle<LayoutDescriptor> result = Handle<LayoutDescriptor>::cast(
       isolate->factory()->NewByteArray(backing_store_length, TENURED));
-  memset(result->GetDataStartAddress(), 0, result->DataSize());
+  memset(reinterpret_cast<void*>(result->GetDataStartAddress()), 0,
+         result->DataSize());
   return result;
 }
 
@@ -127,7 +130,7 @@ bool LayoutDescriptor::IsSlowLayout() { return !IsSmi(); }
 
 
 int LayoutDescriptor::capacity() {
-  return IsSlowLayout() ? (length() * kBitsPerByte) : kSmiValueSize;
+  return IsSlowLayout() ? (length() * kBitsPerByte) : kBitsInSmiLayout;
 }
 
 
@@ -158,10 +161,10 @@ int LayoutDescriptor::CalculateCapacity(Map* map, DescriptorArray* descriptors,
   int layout_descriptor_length;
   const int kMaxWordsPerField = kDoubleSize / kPointerSize;
 
-  if (num_descriptors <= kSmiValueSize / kMaxWordsPerField) {
+  if (num_descriptors <= kBitsInSmiLayout / kMaxWordsPerField) {
     // Even in the "worst" case (all fields are doubles) it would fit into
     // a Smi, so no need to calculate length.
-    layout_descriptor_length = kSmiValueSize;
+    layout_descriptor_length = kBitsInSmiLayout;
 
   } else {
     layout_descriptor_length = 0;
diff --git a/deps/v8/src/layout-descriptor.cc b/deps/v8/src/layout-descriptor.cc
index 41882cedaae2c8..190237edafda15 100644
--- a/deps/v8/src/layout-descriptor.cc
+++ b/deps/v8/src/layout-descriptor.cc
@@ -142,13 +142,13 @@ bool LayoutDescriptor::IsTagged(int field_index, int max_sequence_length,
   bool is_tagged = (value & layout_mask) == 0;
   if (!is_tagged) value = ~value;  // Count set bits instead of cleared bits.
   value = value & ~(layout_mask - 1);  // Clear bits we are not interested in.
-  int sequence_length =
-      base::bits::CountTrailingZeros(value) - layout_bit_index;
+  int sequence_length;
+  if (IsSlowLayout()) {
+    sequence_length = base::bits::CountTrailingZeros(value) - layout_bit_index;
 
-  if (layout_bit_index + sequence_length == kBitsPerLayoutWord) {
-    // This is a contiguous sequence till the end of current word, proceed
-    // counting in the subsequent words.
-    if (IsSlowLayout()) {
+    if (layout_bit_index + sequence_length == kBitsPerLayoutWord) {
+      // This is a contiguous sequence till the end of current word, proceed
+      // counting in the subsequent words.
       ++layout_word_index;
       int num_words = number_of_layout_words();
       for (; layout_word_index < num_words; layout_word_index++) {
@@ -161,7 +161,17 @@ bool LayoutDescriptor::IsTagged(int field_index, int max_sequence_length,
         if (sequence_length >= max_sequence_length) break;
         if (cur_sequence_length != kBitsPerLayoutWord) break;
       }
+      if (is_tagged && (field_index + sequence_length == capacity())) {
+        // The contiguous sequence of tagged fields lasts till the end of the
+        // layout descriptor which means that all the fields starting from
+        // field_index are tagged.
+        sequence_length = std::numeric_limits<int>::max();
+      }
     }
+  } else {  // Fast layout.
+    sequence_length = Min(base::bits::CountTrailingZeros(value),
+                          static_cast<unsigned>(kBitsInSmiLayout)) -
+                      layout_bit_index;
     if (is_tagged && (field_index + sequence_length == capacity())) {
       // The contiguous sequence of tagged fields lasts till the end of the
       // layout descriptor which means that all the fields starting from
diff --git a/deps/v8/src/layout-descriptor.h b/deps/v8/src/layout-descriptor.h
index 1332a5efaa3c16..176109bdaac98d 100644
--- a/deps/v8/src/layout-descriptor.h
+++ b/deps/v8/src/layout-descriptor.h
@@ -83,7 +83,7 @@ class LayoutDescriptor : public ByteArray {
 
 #ifdef OBJECT_PRINT
   // For our gdb macros, we should perhaps change these in the future.
-  void Print();
+  void Print(Isolate* isolate);
 
   void ShortPrint(std::ostream& os);
   void Print(std::ostream& os);  // NOLINT
@@ -96,6 +96,10 @@ class LayoutDescriptor : public ByteArray {
   LayoutDescriptor* SetTaggedForTesting(int field_index, bool tagged);
 
  private:
+  // Exclude sign-bit to simplify encoding.
+  static constexpr int kBitsInSmiLayout =
+      SmiValuesAre32Bits() ? 32 : kSmiValueSize - 1;
+
   static const int kBitsPerLayoutWord = 32;
   int number_of_layout_words() { return length() / kUInt32Size; }
   uint32_t get_layout_word(int index) const { return get_uint32(index); }
diff --git a/deps/v8/src/libplatform/default-platform.cc b/deps/v8/src/libplatform/default-platform.cc
index 74975e71fa9323..ce204807aaaab3 100644
--- a/deps/v8/src/libplatform/default-platform.cc
+++ b/deps/v8/src/libplatform/default-platform.cc
@@ -193,21 +193,22 @@ std::shared_ptr<TaskRunner> DefaultPlatform::GetForegroundTaskRunner(
   return foreground_task_runner_map_[isolate];
 }
 
-std::shared_ptr<TaskRunner> DefaultPlatform::GetWorkerThreadsTaskRunner(
-    v8::Isolate*) {
+void DefaultPlatform::CallOnWorkerThread(std::unique_ptr<Task> task) {
   EnsureBackgroundTaskRunnerInitialized();
-  return worker_threads_task_runner_;
+  worker_threads_task_runner_->PostTask(std::move(task));
 }
 
-void DefaultPlatform::CallOnWorkerThread(std::unique_ptr<Task> task) {
-  GetWorkerThreadsTaskRunner(nullptr)->PostTask(std::move(task));
+void DefaultPlatform::CallDelayedOnWorkerThread(std::unique_ptr<Task> task,
+                                                double delay_in_seconds) {
+  EnsureBackgroundTaskRunnerInitialized();
+  worker_threads_task_runner_->PostDelayedTask(std::move(task),
+                                               delay_in_seconds);
 }
 
 void DefaultPlatform::CallOnForegroundThread(v8::Isolate* isolate, Task* task) {
   GetForegroundTaskRunner(isolate)->PostTask(std::unique_ptr<Task>(task));
 }
 
-
 void DefaultPlatform::CallDelayedOnForegroundThread(Isolate* isolate,
                                                     Task* task,
                                                     double delay_in_seconds) {
diff --git a/deps/v8/src/libplatform/default-platform.h b/deps/v8/src/libplatform/default-platform.h
index 77a7a865869013..1c844f0f0943cf 100644
--- a/deps/v8/src/libplatform/default-platform.h
+++ b/deps/v8/src/libplatform/default-platform.h
@@ -58,9 +58,9 @@ class V8_PLATFORM_EXPORT DefaultPlatform : public NON_EXPORTED_BASE(Platform) {
   int NumberOfWorkerThreads() override;
   std::shared_ptr<TaskRunner> GetForegroundTaskRunner(
       v8::Isolate* isolate) override;
-  std::shared_ptr<TaskRunner> GetWorkerThreadsTaskRunner(
-      v8::Isolate* isolate) override;
   void CallOnWorkerThread(std::unique_ptr<Task> task) override;
+  void CallDelayedOnWorkerThread(std::unique_ptr<Task> task,
+                                 double delay_in_seconds) override;
   void CallOnForegroundThread(v8::Isolate* isolate, Task* task) override;
   void CallDelayedOnForegroundThread(Isolate* isolate, Task* task,
                                      double delay_in_seconds) override;
diff --git a/deps/v8/src/libplatform/default-worker-threads-task-runner.cc b/deps/v8/src/libplatform/default-worker-threads-task-runner.cc
index bc2ebbd0154202..4251d8076e657a 100644
--- a/deps/v8/src/libplatform/default-worker-threads-task-runner.cc
+++ b/deps/v8/src/libplatform/default-worker-threads-task-runner.cc
@@ -40,8 +40,12 @@ void DefaultWorkerThreadsTaskRunner::PostDelayedTask(std::unique_ptr<Task> task,
                                                      double delay_in_seconds) {
   base::LockGuard<base::Mutex> guard(&lock_);
   if (terminated_) return;
-  // There is no use case for this function on a worker thread at the
-  // moment, but it is still part of the interface.
+  if (delay_in_seconds == 0) {
+    queue_.Append(std::move(task));
+    return;
+  }
+  // There is no use case for this function with non zero delay_in_second on a
+  // worker thread at the moment, but it is still part of the interface.
   UNIMPLEMENTED();
 }
 
diff --git a/deps/v8/src/log-utils.cc b/deps/v8/src/log-utils.cc
index 938a84bffd09f9..c5551fcac16d01 100644
--- a/deps/v8/src/log-utils.cc
+++ b/deps/v8/src/log-utils.cc
@@ -109,7 +109,7 @@ void Log::MessageBuilder::AppendSymbolName(Symbol* symbol) {
   DCHECK(symbol);
   OFStream& os = log_->os_;
   os << "symbol(";
-  if (!symbol->name()->IsUndefined(symbol->GetIsolate())) {
+  if (!symbol->name()->IsUndefined()) {
     os << "\"";
     AppendDetailed(String::cast(symbol->name()), false);
     os << "\" ";
diff --git a/deps/v8/src/log.cc b/deps/v8/src/log.cc
index 99fe64723dfddd..cf0cc014fbb50e 100644
--- a/deps/v8/src/log.cc
+++ b/deps/v8/src/log.cc
@@ -22,8 +22,8 @@
 #include "src/libsampler/sampler.h"
 #include "src/log-inl.h"
 #include "src/macro-assembler.h"
+#include "src/objects/api-callbacks.h"
 #include "src/perf-jit.h"
-#include "src/profiler/profiler-listener.h"
 #include "src/profiler/tick-sample.h"
 #include "src/runtime-profiler.h"
 #include "src/source-position-table.h"
@@ -87,7 +87,7 @@ static const char* ComputeMarker(const wasm::WasmCode* code) {
   switch (code->kind()) {
     case wasm::WasmCode::kFunction:
       return code->is_liftoff() ? "" : "*";
-    case wasm::WasmCode::kInterpreterStub:
+    case wasm::WasmCode::kInterpreterEntry:
       return "~";
     default:
       return "";
@@ -114,7 +114,7 @@ class CodeEventLogger::NameBuffer {
     } else {
       Symbol* symbol = Symbol::cast(name);
       AppendBytes("symbol(");
-      if (!symbol->name()->IsUndefined(symbol->GetIsolate())) {
+      if (!symbol->name()->IsUndefined()) {
         AppendBytes("\"");
         AppendString(String::cast(symbol->name()));
         AppendBytes("\" ");
@@ -336,15 +336,14 @@ void PerfBasicLogger::LogRecordedBuffer(AbstractCode* code, SharedFunctionInfo*,
     return;
   }
 
-  WriteLogRecordedBuffer(reinterpret_cast<uintptr_t>(code->InstructionStart()),
+  WriteLogRecordedBuffer(static_cast<uintptr_t>(code->InstructionStart()),
                          code->InstructionSize(), name, length);
 }
 
 void PerfBasicLogger::LogRecordedBuffer(const wasm::WasmCode* code,
                                         const char* name, int length) {
-  WriteLogRecordedBuffer(
-      reinterpret_cast<uintptr_t>(code->instructions().start()),
-      code->instructions().length(), name, length);
+  WriteLogRecordedBuffer(static_cast<uintptr_t>(code->instruction_start()),
+                         code->instructions().length(), name, length);
 }
 
 // External CodeEventListener
@@ -391,7 +390,7 @@ void ExternalCodeEventListener::CodeCreateEvent(
     const char* comment) {
   CodeEvent code_event;
   code_event.code_start_address =
-      reinterpret_cast<uintptr_t>(code->InstructionStart());
+      static_cast<uintptr_t>(code->InstructionStart());
   code_event.code_size = static_cast<size_t>(code->InstructionSize());
   code_event.function_name = isolate_->factory()->empty_string();
   code_event.script_name = isolate_->factory()->empty_string();
@@ -410,7 +409,7 @@ void ExternalCodeEventListener::CodeCreateEvent(
 
   CodeEvent code_event;
   code_event.code_start_address =
-      reinterpret_cast<uintptr_t>(code->InstructionStart());
+      static_cast<uintptr_t>(code->InstructionStart());
   code_event.code_size = static_cast<size_t>(code->InstructionSize());
   code_event.function_name = name_string;
   code_event.script_name = isolate_->factory()->empty_string();
@@ -430,7 +429,7 @@ void ExternalCodeEventListener::CodeCreateEvent(
 
   CodeEvent code_event;
   code_event.code_start_address =
-      reinterpret_cast<uintptr_t>(code->InstructionStart());
+      static_cast<uintptr_t>(code->InstructionStart());
   code_event.code_size = static_cast<size_t>(code->InstructionSize());
   code_event.function_name = name_string;
   code_event.script_name = isolate_->factory()->empty_string();
@@ -453,7 +452,7 @@ void ExternalCodeEventListener::CodeCreateEvent(
 
   CodeEvent code_event;
   code_event.code_start_address =
-      reinterpret_cast<uintptr_t>(code->InstructionStart());
+      static_cast<uintptr_t>(code->InstructionStart());
   code_event.code_size = static_cast<size_t>(code->InstructionSize());
   code_event.function_name = name_string;
   code_event.script_name = source_string;
@@ -475,7 +474,7 @@ void ExternalCodeEventListener::RegExpCodeCreateEvent(AbstractCode* code,
                                                       String* source) {
   CodeEvent code_event;
   code_event.code_start_address =
-      reinterpret_cast<uintptr_t>(code->InstructionStart());
+      static_cast<uintptr_t>(code->InstructionStart());
   code_event.code_size = static_cast<size_t>(code->InstructionSize());
   code_event.function_name = Handle<String>(source, isolate_);
   code_event.script_name = isolate_->factory()->empty_string();
@@ -603,11 +602,11 @@ void LowLevelLogger::LogRecordedBuffer(const wasm::WasmCode* code,
                                        const char* name, int length) {
   CodeCreateStruct event;
   event.name_size = length;
-  event.code_address = code->instructions().start();
+  event.code_address = code->instruction_start();
   event.code_size = code->instructions().length();
   LogWriteStruct(event);
   LogWriteBytes(name, length);
-  LogWriteBytes(reinterpret_cast<const char*>(code->instructions().start()),
+  LogWriteBytes(reinterpret_cast<const char*>(code->instruction_start()),
                 code->instructions().length());
 }
 
@@ -668,13 +667,14 @@ void JitLogger::LogRecordedBuffer(AbstractCode* code,
   JitCodeEvent event;
   memset(&event, 0, sizeof(event));
   event.type = JitCodeEvent::CODE_ADDED;
-  event.code_start = code->InstructionStart();
+  event.code_start = reinterpret_cast<void*>(code->InstructionStart());
   event.code_type =
       code->IsCode() ? JitCodeEvent::JIT_CODE : JitCodeEvent::BYTE_CODE;
   event.code_len = code->InstructionSize();
   Handle<SharedFunctionInfo> shared_function_handle;
   if (shared && shared->script()->IsScript()) {
-    shared_function_handle = Handle<SharedFunctionInfo>(shared);
+    shared_function_handle =
+        Handle<SharedFunctionInfo>(shared, shared->GetIsolate());
   }
   event.script = ToApiHandle<v8::UnboundScript>(shared_function_handle);
   event.name.str = name;
@@ -702,14 +702,14 @@ void JitLogger::CodeMoveEvent(AbstractCode* from, Address to) {
   event.type = JitCodeEvent::CODE_MOVED;
   event.code_type =
       from->IsCode() ? JitCodeEvent::JIT_CODE : JitCodeEvent::BYTE_CODE;
-  event.code_start = from->InstructionStart();
+  event.code_start = reinterpret_cast<void*>(from->InstructionStart());
   event.code_len = from->InstructionSize();
 
   // Calculate the header size.
   const size_t header_size = from->InstructionStart() - from->address();
 
   // Calculate the new start address of the instructions.
-  event.new_code_start = to + header_size;
+  event.new_code_start = reinterpret_cast<void*>(to + header_size);
 
   code_event_handler_(&event);
 }
@@ -745,7 +745,7 @@ void JitLogger::EndCodePosInfoEvent(Address start_address,
   JitCodeEvent event;
   memset(&event, 0, sizeof(event));
   event.type = JitCodeEvent::CODE_END_LINE_INFO_RECORDING;
-  event.code_start = start_address;
+  event.code_start = reinterpret_cast<void*>(start_address);
   event.user_data = jit_handler_data;
 
   code_event_handler_(&event);
@@ -981,13 +981,12 @@ Logger::~Logger() {
   delete log_;
 }
 
-void Logger::addCodeEventListener(CodeEventListener* listener) {
+void Logger::AddCodeEventListener(CodeEventListener* listener) {
   bool result = isolate_->code_event_dispatcher()->AddListener(listener);
-  USE(result);
-  DCHECK(result);
+  CHECK(result);
 }
 
-void Logger::removeCodeEventListener(CodeEventListener* listener) {
+void Logger::RemoveCodeEventListener(CodeEventListener* listener) {
   isolate_->code_event_dispatcher()->RemoveListener(listener);
 }
 
@@ -1052,7 +1051,7 @@ void Logger::SharedLibraryEvent(const std::string& library_path,
   msg.WriteToLogFile();
 }
 
-void Logger::CodeDeoptEvent(Code* code, DeoptKind kind, Address pc,
+void Logger::CodeDeoptEvent(Code* code, DeoptimizeKind kind, Address pc,
                             int fp_to_sp_delta) {
   if (!log_->IsEnabled()) return;
   Deoptimizer::DeoptInfo info = Deoptimizer::GetDeoptInfo(code, pc);
@@ -1073,17 +1072,7 @@ void Logger::CodeDeoptEvent(Code* code, DeoptKind kind, Address pc,
     deopt_location << "<unknown>";
   }
   msg << kNext << inlining_id << kNext << script_offset << kNext;
-  switch (kind) {
-    case kLazy:
-      msg << "lazy" << kNext;
-      break;
-    case kSoft:
-      msg << "soft" << kNext;
-      break;
-    case kEager:
-      msg << "eager" << kNext;
-      break;
-  }
+  msg << Deoptimizer::MessageFor(kind) << kNext;
   msg << deopt_location.str().c_str() << kNext
       << DeoptimizeReasonToString(info.deopt_reason);
   msg.WriteToLogFile();
@@ -1236,7 +1225,8 @@ void AppendCodeCreateHeader(Log::MessageBuilder& msg,
 void AppendCodeCreateHeader(Log::MessageBuilder& msg,
                             CodeEventListener::LogEventsAndTags tag,
                             AbstractCode* code, base::ElapsedTimer* timer) {
-  AppendCodeCreateHeader(msg, tag, code->kind(), code->InstructionStart(),
+  AppendCodeCreateHeader(msg, tag, code->kind(),
+                         reinterpret_cast<uint8_t*>(code->InstructionStart()),
                          code->InstructionSize(), timer);
 }
 
@@ -1311,40 +1301,20 @@ void Logger::CodeCreateEvent(CodeEventListener::LogEventsAndTags tag,
                              Name* source, int line, int column) {
   if (!is_listening_to_code_events()) return;
   if (!FLAG_log_code || !log_->IsEnabled()) return;
-
-  Log::MessageBuilder msg(log_);
-  AppendCodeCreateHeader(msg, tag, code, &timer_);
-  msg << shared->DebugName() << " " << source << ":" << line << ":" << column
-      << kNext << reinterpret_cast<void*>(shared->address()) << kNext
-      << ComputeMarker(shared, code);
-  msg.WriteToLogFile();
+  {
+    Log::MessageBuilder msg(log_);
+    AppendCodeCreateHeader(msg, tag, code, &timer_);
+    msg << shared->DebugName() << " " << source << ":" << line << ":" << column
+        << kNext << reinterpret_cast<void*>(shared->address()) << kNext
+        << ComputeMarker(shared, code);
+    msg.WriteToLogFile();
+  }
 
   if (!FLAG_log_source_code) return;
   Object* script_object = shared->script();
   if (!script_object->IsScript()) return;
-  // Make sure the script is written to the log file.
   Script* script = Script::cast(script_object);
-  int script_id = script->id();
-  if (logged_source_code_.find(script_id) == logged_source_code_.end()) {
-    // This script has not been logged yet.
-    logged_source_code_.insert(script_id);
-    Object* source_object = script->source();
-    if (source_object->IsString()) {
-      String* source_code = String::cast(source_object);
-      msg << "script" << kNext << script_id << kNext;
-
-      // Log the script name.
-      if (script->name()->IsString()) {
-        msg << String::cast(script->name()) << kNext;
-      } else {
-        msg << "<unknown>" << kNext;
-      }
-
-      // Log the source code.
-      msg << source_code;
-      msg.WriteToLogFile();
-    }
-  }
+  if (!EnsureLogScriptSource(script)) return;
 
   // We log source code information in the form:
   //
@@ -1367,10 +1337,11 @@ void Logger::CodeCreateEvent(CodeEventListener::LogEventsAndTags tag,
   //         <function-id> is an index into the <fns> function table
   //   <fns> is the function table encoded as a sequence of strings
   //      S<shared-function-info-address>
+  Log::MessageBuilder msg(log_);
   msg << "code-source-info" << kNext
-      << static_cast<void*>(code->InstructionStart()) << kNext << script_id
-      << kNext << shared->StartPosition() << kNext << shared->EndPosition()
-      << kNext;
+      << reinterpret_cast<void*>(code->InstructionStart()) << kNext
+      << script->id() << kNext << shared->StartPosition() << kNext
+      << shared->EndPosition() << kNext;
 
   SourcePositionTableIterator iterator(code->source_position_table());
   bool is_first = true;
@@ -1416,7 +1387,8 @@ void Logger::CodeCreateEvent(CodeEventListener::LogEventsAndTags tag,
     msg << std::hex;
     for (int i = 0; i <= maxInlinedId; i++) {
       msg << "S"
-          << static_cast<void*>(deopt_data->GetInlinedFunction(i)->address());
+          << reinterpret_cast<void*>(
+                 deopt_data->GetInlinedFunction(i)->address());
     }
     msg << std::dec;
   }
@@ -1532,57 +1504,135 @@ void Logger::SuspectReadEvent(Name* name, Object* obj) {
   if (!log_->IsEnabled() || !FLAG_log_suspect) return;
   Log::MessageBuilder msg(log_);
   String* class_name = obj->IsJSObject()
-                       ? JSObject::cast(obj)->class_name()
-                       : isolate_->heap()->empty_string();
+                           ? JSObject::cast(obj)->class_name()
+                           : ReadOnlyRoots(isolate_).empty_string();
   msg << "suspect-read" << kNext << class_name << kNext << name;
   msg.WriteToLogFile();
 }
 
 namespace {
 void AppendFunctionMessage(Log::MessageBuilder& msg, const char* reason,
-                           Script* script, int script_id, double time_delta,
-                           int start_position, int end_position,
-                           base::ElapsedTimer* timer) {
-  msg << "function" << Logger::kNext << reason << Logger::kNext;
-  if (script) {
-    if (script->name()->IsString()) {
-      msg << String::cast(script->name());
-    }
-    msg << Logger::kNext << script->id();
-  } else {
-    msg << Logger::kNext << script_id;
-  }
-  msg << Logger::kNext << start_position << Logger::kNext << end_position
+                           int script_id, double time_delta, int start_position,
+                           int end_position, base::ElapsedTimer* timer) {
+  msg << "function" << Logger::kNext << reason << Logger::kNext << script_id
+      << Logger::kNext << start_position << Logger::kNext << end_position
       << Logger::kNext << time_delta << Logger::kNext
       << timer->Elapsed().InMicroseconds() << Logger::kNext;
 }
 }  // namespace
 
-void Logger::FunctionEvent(const char* reason, Script* script, int script_id,
-                           double time_delta, int start_position,
-                           int end_position, String* function_name) {
+void Logger::FunctionEvent(const char* reason, int script_id, double time_delta,
+                           int start_position, int end_position,
+                           String* function_name) {
   if (!log_->IsEnabled() || !FLAG_log_function_events) return;
   Log::MessageBuilder msg(log_);
-  AppendFunctionMessage(msg, reason, script, script_id, time_delta,
-                        start_position, end_position, &timer_);
+  AppendFunctionMessage(msg, reason, script_id, time_delta, start_position,
+                        end_position, &timer_);
   if (function_name) msg << function_name;
   msg.WriteToLogFile();
 }
 
-void Logger::FunctionEvent(const char* reason, Script* script, int script_id,
-                           double time_delta, int start_position,
-                           int end_position, const char* function_name,
+void Logger::FunctionEvent(const char* reason, int script_id, double time_delta,
+                           int start_position, int end_position,
+                           const char* function_name,
                            size_t function_name_length) {
   if (!log_->IsEnabled() || !FLAG_log_function_events) return;
   Log::MessageBuilder msg(log_);
-  AppendFunctionMessage(msg, reason, script, script_id, time_delta,
-                        start_position, end_position, &timer_);
+  AppendFunctionMessage(msg, reason, script_id, time_delta, start_position,
+                        end_position, &timer_);
   if (function_name_length > 0) {
     msg.AppendStringPart(function_name, function_name_length);
   }
   msg.WriteToLogFile();
 }
 
+namespace {
+void AppendCompilationCacheMessage(Log::MessageBuilder& msg,
+                                   SharedFunctionInfo* sfi) {
+  int script_id = -1;
+  if (sfi->script()->IsScript()) {
+    script_id = Script::cast(sfi->script())->id();
+  }
+  msg << script_id << Logger::kNext << sfi->StartPosition() << Logger::kNext
+      << sfi->EndPosition();
+}
+}  // namespace
+
+void Logger::CompilationCacheEvent(const char* action, const char* cache_type,
+                                   SharedFunctionInfo* sfi) {
+  if (!log_->IsEnabled() || !FLAG_log_function_events) return;
+  Log::MessageBuilder msg(log_);
+  msg << "compilation-cache" << Logger::kNext << action << Logger::kNext
+      << cache_type << Logger::kNext;
+  AppendCompilationCacheMessage(msg, sfi);
+  msg.WriteToLogFile();
+}
+
+void Logger::ScriptEvent(ScriptEventType type, int script_id) {
+  if (!log_->IsEnabled() || !FLAG_log_function_events) return;
+  Log::MessageBuilder msg(log_);
+  msg << "script" << Logger::kNext;
+  switch (type) {
+    case ScriptEventType::kReserveId:
+      msg << "reserve-id";
+      break;
+    case ScriptEventType::kCreate:
+      msg << "create";
+      break;
+    case ScriptEventType::kDeserialize:
+      msg << "deserialize";
+      break;
+    case ScriptEventType::kBackgroundCompile:
+      msg << "background-compile";
+      break;
+  }
+  msg << Logger::kNext << script_id;
+  msg.WriteToLogFile();
+}
+
+void Logger::ScriptDetails(Script* script) {
+  if (!log_->IsEnabled() || !FLAG_log_function_events) return;
+  Log::MessageBuilder msg(log_);
+  msg << "script-details" << Logger::kNext << script->id() << Logger::kNext;
+  if (script->name()->IsString()) {
+    msg << String::cast(script->name());
+  }
+  msg << Logger::kNext << script->line_offset() << Logger::kNext
+      << script->column_offset() << Logger::kNext;
+  if (script->source_mapping_url()->IsString()) {
+    msg << String::cast(script->source_mapping_url());
+  }
+  msg.WriteToLogFile();
+}
+
+bool Logger::EnsureLogScriptSource(Script* script) {
+  if (!log_->IsEnabled()) return false;
+  Log::MessageBuilder msg(log_);
+  // Make sure the script is written to the log file.
+  int script_id = script->id();
+  if (logged_source_code_.find(script_id) != logged_source_code_.end()) {
+    return false;
+  }
+  // This script has not been logged yet.
+  logged_source_code_.insert(script_id);
+  Object* source_object = script->source();
+  if (!source_object->IsString()) return false;
+  String* source_code = String::cast(source_object);
+  msg << "script-source" << kNext << script_id << kNext;
+
+  // Log the script name.
+  if (script->name()->IsString()) {
+    msg << String::cast(script->name()) << kNext;
+  } else {
+    msg << "<unknown>" << kNext;
+  }
+
+  // Log the source code.
+  msg << source_code;
+  msg.WriteToLogFile();
+  return true;
+}
+
 void Logger::RuntimeCallTimerEvent() {
   RuntimeCallStats* stats = isolate_->counters()->runtime_call_stats();
   RuntimeCallCounter* counter = stats->current_counter();
@@ -1694,7 +1744,7 @@ void Logger::MapDetails(Map* map) {
       << reinterpret_cast<void*>(map) << kNext;
   if (FLAG_trace_maps_details) {
     std::ostringstream buffer;
-    map->PrintMapDetails(buffer);
+    map->PrintMapDetails(isolate_, buffer);
     msg << buffer.str().c_str();
   }
   msg.WriteToLogFile();
@@ -1705,7 +1755,7 @@ void Logger::StopProfiler() {
   if (profiler_ != nullptr) {
     profiler_->Pause();
     is_logging_ = false;
-    removeCodeEventListener(this);
+    RemoveCodeEventListener(this);
   }
 }
 
@@ -1720,10 +1770,10 @@ static void AddFunctionAndCode(SharedFunctionInfo* sfi,
                                Handle<SharedFunctionInfo>* sfis,
                                Handle<AbstractCode>* code_objects, int offset) {
   if (sfis != nullptr) {
-    sfis[offset] = Handle<SharedFunctionInfo>(sfi);
+    sfis[offset] = Handle<SharedFunctionInfo>(sfi, sfi->GetIsolate());
   }
   if (code_objects != nullptr) {
-    code_objects[offset] = Handle<AbstractCode>(code_object);
+    code_objects[offset] = Handle<AbstractCode>(code_object, sfi->GetIsolate());
   }
 }
 
@@ -1770,23 +1820,23 @@ static int EnumerateCompiledFunctions(Heap* heap,
   return compiled_funcs_count;
 }
 
-static int EnumerateWasmModules(Heap* heap,
-                                Handle<WasmCompiledModule>* modules) {
+static int EnumerateWasmModuleObjects(
+    Heap* heap, Handle<WasmModuleObject>* module_objects) {
   HeapIterator iterator(heap);
   DisallowHeapAllocation no_gc;
-  int wasm_modules_count = 0;
+  int module_objects_count = 0;
 
   for (HeapObject* obj = iterator.next(); obj != nullptr;
        obj = iterator.next()) {
-    if (obj->IsWasmCompiledModule()) {
-      WasmCompiledModule* module = WasmCompiledModule::cast(obj);
-      if (modules != nullptr) {
-        modules[wasm_modules_count] = Handle<WasmCompiledModule>(module);
+    if (obj->IsWasmModuleObject()) {
+      WasmModuleObject* module = WasmModuleObject::cast(obj);
+      if (module_objects != nullptr) {
+        module_objects[module_objects_count] = handle(module, heap->isolate());
       }
-      wasm_modules_count++;
+      module_objects_count++;
     }
   }
-  return wasm_modules_count;
+  return module_objects_count;
 }
 
 void Logger::LogCodeObject(Object* object) {
@@ -1915,17 +1965,17 @@ bool Logger::SetUp(Isolate* isolate) {
 
   if (FLAG_perf_basic_prof) {
     perf_basic_logger_ = new PerfBasicLogger();
-    addCodeEventListener(perf_basic_logger_);
+    AddCodeEventListener(perf_basic_logger_);
   }
 
   if (FLAG_perf_prof) {
     perf_jit_logger_ = new PerfJitLogger();
-    addCodeEventListener(perf_jit_logger_);
+    AddCodeEventListener(perf_jit_logger_);
   }
 
   if (FLAG_ll_prof) {
     ll_logger_ = new LowLevelLogger(log_file_name.str().c_str());
-    addCodeEventListener(ll_logger_);
+    AddCodeEventListener(ll_logger_);
   }
 
   ticker_ = new Ticker(isolate, FLAG_prof_sampling_interval);
@@ -1942,10 +1992,8 @@ bool Logger::SetUp(Isolate* isolate) {
     profiler_->Engage();
   }
 
-  profiler_listener_.reset();
-
   if (is_logging_) {
-    addCodeEventListener(this);
+    AddCodeEventListener(this);
   }
 
   return true;
@@ -1955,14 +2003,14 @@ bool Logger::SetUp(Isolate* isolate) {
 void Logger::SetCodeEventHandler(uint32_t options,
                                  JitCodeEventHandler event_handler) {
   if (jit_logger_) {
-      removeCodeEventListener(jit_logger_);
-      delete jit_logger_;
-      jit_logger_ = nullptr;
+    RemoveCodeEventListener(jit_logger_);
+    delete jit_logger_;
+    jit_logger_ = nullptr;
   }
 
   if (event_handler) {
     jit_logger_ = new JitLogger(event_handler);
-    addCodeEventListener(jit_logger_);
+    AddCodeEventListener(jit_logger_);
     if (options & kJitCodeEventEnumExisting) {
       HandleScope scope(isolate_);
       LogCodeObjects();
@@ -1971,19 +2019,6 @@ void Logger::SetCodeEventHandler(uint32_t options,
   }
 }
 
-void Logger::SetUpProfilerListener() {
-  if (!is_initialized_) return;
-  if (profiler_listener_.get() == nullptr) {
-    profiler_listener_.reset(new ProfilerListener(isolate_));
-  }
-  addCodeEventListener(profiler_listener_.get());
-}
-
-void Logger::TearDownProfilerListener() {
-  if (profiler_listener_->HasObservers()) return;
-  removeCodeEventListener(profiler_listener_.get());
-}
-
 sampler::Sampler* Logger::sampler() {
   return ticker_;
 }
@@ -2004,33 +2039,29 @@ FILE* Logger::TearDown() {
   ticker_ = nullptr;
 
   if (perf_basic_logger_) {
-    removeCodeEventListener(perf_basic_logger_);
+    RemoveCodeEventListener(perf_basic_logger_);
     delete perf_basic_logger_;
     perf_basic_logger_ = nullptr;
   }
 
   if (perf_jit_logger_) {
-    removeCodeEventListener(perf_jit_logger_);
+    RemoveCodeEventListener(perf_jit_logger_);
     delete perf_jit_logger_;
     perf_jit_logger_ = nullptr;
   }
 
   if (ll_logger_) {
-    removeCodeEventListener(ll_logger_);
+    RemoveCodeEventListener(ll_logger_);
     delete ll_logger_;
     ll_logger_ = nullptr;
   }
 
   if (jit_logger_) {
-    removeCodeEventListener(jit_logger_);
+    RemoveCodeEventListener(jit_logger_);
     delete jit_logger_;
     jit_logger_ = nullptr;
   }
 
-  if (profiler_listener_.get() != nullptr) {
-    removeCodeEventListener(profiler_listener_.get());
-  }
-
   return log_->Close();
 }
 
@@ -2114,21 +2145,24 @@ void ExistingCodeLogger::LogCompiledFunctions() {
   // GetScriptLineNumber call.
   for (int i = 0; i < compiled_funcs_count; ++i) {
     if (sfis[i]->function_data()->IsInterpreterData()) {
-      LogExistingFunction(sfis[i],
-                          Handle<AbstractCode>(AbstractCode::cast(
-                              sfis[i]->InterpreterTrampoline())),
-                          CodeEventListener::INTERPRETED_FUNCTION_TAG);
+      LogExistingFunction(
+          sfis[i],
+          Handle<AbstractCode>(
+              AbstractCode::cast(sfis[i]->InterpreterTrampoline()), isolate_),
+          CodeEventListener::INTERPRETED_FUNCTION_TAG);
     }
     if (code_objects[i].is_identical_to(BUILTIN_CODE(isolate_, CompileLazy)))
       continue;
     LogExistingFunction(sfis[i], code_objects[i]);
   }
 
-  const int compiled_wasm_modules_count = EnumerateWasmModules(heap, nullptr);
-  ScopedVector<Handle<WasmCompiledModule>> modules(compiled_wasm_modules_count);
-  EnumerateWasmModules(heap, modules.start());
-  for (int i = 0; i < compiled_wasm_modules_count; ++i) {
-    modules[i]->LogWasmCodes(isolate_);
+  const int wasm_module_objects_count =
+      EnumerateWasmModuleObjects(heap, nullptr);
+  std::unique_ptr<Handle<WasmModuleObject>[]> module_objects(
+      new Handle<WasmModuleObject>[wasm_module_objects_count]);
+  EnumerateWasmModuleObjects(heap, module_objects.get());
+  for (int i = 0; i < wasm_module_objects_count; ++i) {
+    module_objects[i]->native_module()->LogWasmCodes(isolate_);
   }
 }
 
@@ -2167,12 +2201,12 @@ void ExistingCodeLogger::LogExistingFunction(
     Handle<SharedFunctionInfo> shared, Handle<AbstractCode> code,
     CodeEventListener::LogEventsAndTags tag) {
   if (shared->script()->IsScript()) {
-    Handle<Script> script(Script::cast(shared->script()));
+    Handle<Script> script(Script::cast(shared->script()), isolate_);
     int line_num = Script::GetLineNumber(script, shared->StartPosition()) + 1;
     int column_num =
         Script::GetColumnNumber(script, shared->StartPosition()) + 1;
     if (script->name()->IsString()) {
-      Handle<String> script_name(String::cast(script->name()));
+      Handle<String> script_name(String::cast(script->name()), isolate_);
       if (line_num > 0) {
         CALL_CODE_EVENT_HANDLER(
             CodeCreateEvent(Logger::ToNativeByScript(tag, *script), *code,
@@ -2186,7 +2220,7 @@ void ExistingCodeLogger::LogExistingFunction(
     } else {
       CALL_CODE_EVENT_HANDLER(CodeCreateEvent(
           Logger::ToNativeByScript(tag, *script), *code, *shared,
-          isolate_->heap()->empty_string(), line_num, column_num))
+          ReadOnlyRoots(isolate_).empty_string(), line_num, column_num))
     }
   } else if (shared->IsApiFunction()) {
     // API function.
@@ -2202,8 +2236,8 @@ void ExistingCodeLogger::LogExistingFunction(
       CALL_CODE_EVENT_HANDLER(CallbackEvent(shared->DebugName(), entry_point))
     }
   } else {
-    CALL_CODE_EVENT_HANDLER(
-        CodeCreateEvent(tag, *code, *shared, isolate_->heap()->empty_string()))
+    CALL_CODE_EVENT_HANDLER(CodeCreateEvent(
+        tag, *code, *shared, ReadOnlyRoots(isolate_).empty_string()))
   }
 }
 
diff --git a/deps/v8/src/log.h b/deps/v8/src/log.h
index 566715bbaff2b8..97865dc0f5575b 100644
--- a/deps/v8/src/log.h
+++ b/deps/v8/src/log.h
@@ -72,10 +72,13 @@ class LowLevelLogger;
 class PerfBasicLogger;
 class PerfJitLogger;
 class Profiler;
-class ProfilerListener;
 class RuntimeCallTimer;
 class Ticker;
-class WasmCompiledModule;
+
+namespace interpreter {
+enum class Bytecode : uint8_t;
+enum class OperandScale : uint8_t;
+}  // namespace interpreter
 
 namespace wasm {
 class WasmCode;
@@ -121,6 +124,13 @@ class Logger : public CodeEventListener {
  public:
   enum StartEnd { START = 0, END = 1, STAMP = 2 };
 
+  enum class ScriptEventType {
+    kReserveId,
+    kCreate,
+    kDeserialize,
+    kBackgroundCompile
+  };
+
   // The separator is used to write an unescaped "," into the log.
   static const LogSeparator kNext = LogSeparator::kSeparator;
 
@@ -131,16 +141,8 @@ class Logger : public CodeEventListener {
   void SetCodeEventHandler(uint32_t options,
                            JitCodeEventHandler event_handler);
 
-  // Sets up ProfilerListener.
-  void SetUpProfilerListener();
-
-  // Tear down ProfilerListener if it has no observers.
-  void TearDownProfilerListener();
-
   sampler::Sampler* sampler();
 
-  ProfilerListener* profiler_listener() { return profiler_listener_.get(); }
-
   // Frees resources acquired in SetUp.
   // When a temporary file is used for the log, returns its stream descriptor,
   // leaving the file open.
@@ -169,14 +171,20 @@ class Logger : public CodeEventListener {
   // object.
   void SuspectReadEvent(Name* name, Object* obj);
 
-  void FunctionEvent(const char* reason, Script* script, int script_id,
-                     double time_delta_ms, int start_position = -1,
-                     int end_position = -1, String* function_name = nullptr);
-  void FunctionEvent(const char* reason, Script* script, int script_id,
-                     double time_delta_ms, int start_position, int end_position,
+  // ==== Events logged by --log-function-events ====
+  void FunctionEvent(const char* reason, int script_id, double time_delta_ms,
+                     int start_position = -1, int end_position = -1,
+                     String* function_name = nullptr);
+  void FunctionEvent(const char* reason, int script_id, double time_delta_ms,
+                     int start_position, int end_position,
                      const char* function_name = nullptr,
                      size_t function_name_length = 0);
 
+  void CompilationCacheEvent(const char* action, const char* cache_type,
+                             SharedFunctionInfo* sfi);
+  void ScriptEvent(ScriptEventType type, int script_id);
+  void ScriptDetails(Script* script);
+
   // ==== Events logged by --log-api. ====
   void ApiSecurityCheck();
   void ApiNamedPropertyAccess(const char* tag, JSObject* holder, Object* name);
@@ -187,8 +195,8 @@ class Logger : public CodeEventListener {
   void ApiEntryCall(const char* name);
 
   // ==== Events logged by --log-code. ====
-  void addCodeEventListener(CodeEventListener* listener);
-  void removeCodeEventListener(CodeEventListener* listener);
+  void AddCodeEventListener(CodeEventListener* listener);
+  void RemoveCodeEventListener(CodeEventListener* listener);
 
   // Emits a code event for a callback function.
   void CallbackEvent(Name* name, Address entry_point);
@@ -224,7 +232,7 @@ class Logger : public CodeEventListener {
 
   void CodeNameEvent(Address addr, int pos, const char* code_name);
 
-  void CodeDeoptEvent(Code* code, DeoptKind kind, Address pc,
+  void CodeDeoptEvent(Code* code, DeoptimizeKind kind, Address pc,
                       int fp_to_sp_delta);
 
   void ICEvent(const char* type, bool keyed, Map* map, Object* key,
@@ -250,8 +258,8 @@ class Logger : public CodeEventListener {
 
   static void DefaultEventLoggerSentinel(const char* name, int event) {}
 
-  INLINE(static void CallEventLogger(Isolate* isolate, const char* name,
-                                     StartEnd se, bool expose_to_api));
+  V8_INLINE static void CallEventLogger(Isolate* isolate, const char* name,
+                                        StartEnd se, bool expose_to_api);
 
   bool is_logging() {
     return is_logging_;
@@ -267,7 +275,6 @@ class Logger : public CodeEventListener {
 
   void LogExistingFunction(Handle<SharedFunctionInfo> shared,
                            Handle<AbstractCode> code);
-  void LogCompiledModule(Handle<WasmCompiledModule> module);
   // Logs all compiled functions found in the heap.
   void LogCompiledFunctions();
   // Logs all accessor callbacks found in the heap.
@@ -282,8 +289,8 @@ class Logger : public CodeEventListener {
   void LogMaps();
 
   // Converts tag to a corresponding NATIVE_... if the script is native.
-  INLINE(static CodeEventListener::LogEventsAndTags ToNativeByScript(
-      CodeEventListener::LogEventsAndTags, Script*));
+  V8_INLINE static CodeEventListener::LogEventsAndTags ToNativeByScript(
+      CodeEventListener::LogEventsAndTags, Script*);
 
   // Callback from Log, stops profiling in case of insufficient resources.
   void LogFailure();
@@ -320,6 +327,10 @@ class Logger : public CodeEventListener {
   // Logs an IntPtrTEvent regardless of whether FLAG_log is true.
   void UncheckedIntPtrTEvent(const char* name, intptr_t value);
 
+  // Logs a scripts sources. Keeps track of all logged scripts to ensure that
+  // each script is logged only once.
+  bool EnsureLogScriptSource(Script* script);
+
   Isolate* isolate_;
 
   // The sampler used by the profiler and the sliding state window.
@@ -348,7 +359,6 @@ class Logger : public CodeEventListener {
   PerfJitLogger* perf_jit_logger_;
   LowLevelLogger* ll_logger_;
   JitLogger* jit_logger_;
-  std::unique_ptr<ProfilerListener> profiler_listener_;
   std::set<int> logged_source_code_;
   uint32_t next_source_info_id_ = 0;
 
@@ -424,7 +434,7 @@ class CodeEventLogger : public CodeEventListener {
   void SetterCallbackEvent(Name* name, Address entry_point) override {}
   void SharedFunctionInfoMoveEvent(Address from, Address to) override {}
   void CodeMovingGCEvent() override {}
-  void CodeDeoptEvent(Code* code, DeoptKind kind, Address pc,
+  void CodeDeoptEvent(Code* code, DeoptimizeKind kind, Address pc,
                       int fp_to_sp_delta) override {}
 
  private:
@@ -475,7 +485,7 @@ class ExternalCodeEventListener : public CodeEventListener {
   void CodeDisableOptEvent(AbstractCode* code,
                            SharedFunctionInfo* shared) override {}
   void CodeMovingGCEvent() override {}
-  void CodeDeoptEvent(Code* code, DeoptKind kind, Address pc,
+  void CodeDeoptEvent(Code* code, DeoptimizeKind kind, Address pc,
                       int fp_to_sp_delta) override {}
 
   void StartListening(CodeEventHandler* code_event_handler);
diff --git a/deps/v8/src/lookup.cc b/deps/v8/src/lookup.cc
index a4cca33d6c3e8a..6d108f6edcfca2 100644
--- a/deps/v8/src/lookup.cc
+++ b/deps/v8/src/lookup.cc
@@ -9,6 +9,7 @@
 #include "src/elements.h"
 #include "src/field-type.h"
 #include "src/isolate-inl.h"
+#include "src/objects/hash-table-inl.h"
 
 namespace v8 {
 namespace internal {
@@ -107,8 +108,9 @@ LookupIterator LookupIterator::ForTransitionHandler(
 
   if (!transition_map->is_dictionary_map()) {
     int descriptor_number = transition_map->LastAdded();
-    Handle<Map> new_map = Map::PrepareForDataProperty(
-        transition_map, descriptor_number, kConst, value);
+    Handle<Map> new_map =
+        Map::PrepareForDataProperty(isolate, transition_map, descriptor_number,
+                                    PropertyConstness::kConst, value);
     // Reload information; this is no-op if nothing changed.
     it.property_details_ =
         new_map->instance_descriptors()->GetDetails(descriptor_number);
@@ -236,7 +238,7 @@ Handle<Map> LookupIterator::GetReceiverMap() const {
 
 bool LookupIterator::HasAccess() const {
   DCHECK_EQ(ACCESS_CHECK, state_);
-  return isolate_->MayAccess(handle(isolate_->context()),
+  return isolate_->MayAccess(handle(isolate_->context(), isolate_),
                              GetHolder<JSObject>());
 }
 
@@ -271,7 +273,8 @@ bool IsTypedArrayFunctionInAnyContext(Isolate* isolate, JSReceiver* holder) {
 void LookupIterator::InternalUpdateProtector() {
   if (isolate_->bootstrapper()->IsActive()) return;
 
-  if (*name_ == heap()->constructor_string()) {
+  ReadOnlyRoots roots(heap());
+  if (*name_ == roots.constructor_string()) {
     if (!isolate_->IsArraySpeciesLookupChainIntact() &&
         !isolate_->IsTypedArraySpeciesLookupChainIntact() &&
         !isolate_->IsPromiseSpeciesLookupChainIntact())
@@ -317,7 +320,7 @@ void LookupIterator::InternalUpdateProtector() {
         isolate_->InvalidateTypedArraySpeciesProtector();
       }
     }
-  } else if (*name_ == heap()->next_string()) {
+  } else if (*name_ == roots.next_string()) {
     if (!isolate_->IsArrayIteratorLookupChainIntact()) return;
     // Setting the next property of %ArrayIteratorPrototype% also needs to
     // invalidate the array iterator protector.
@@ -325,7 +328,7 @@ void LookupIterator::InternalUpdateProtector() {
             *holder_, Context::INITIAL_ARRAY_ITERATOR_PROTOTYPE_INDEX)) {
       isolate_->InvalidateArrayIteratorProtector();
     }
-  } else if (*name_ == heap()->species_symbol()) {
+  } else if (*name_ == roots.species_symbol()) {
     if (!isolate_->IsArraySpeciesLookupChainIntact() &&
         !isolate_->IsTypedArraySpeciesLookupChainIntact() &&
         !isolate_->IsPromiseSpeciesLookupChainIntact())
@@ -345,26 +348,33 @@ void LookupIterator::InternalUpdateProtector() {
       if (!isolate_->IsTypedArraySpeciesLookupChainIntact()) return;
       isolate_->InvalidateTypedArraySpeciesProtector();
     }
-  } else if (*name_ == heap()->is_concat_spreadable_symbol()) {
+  } else if (*name_ == roots.is_concat_spreadable_symbol()) {
     if (!isolate_->IsIsConcatSpreadableLookupChainIntact()) return;
     isolate_->InvalidateIsConcatSpreadableProtector();
-  } else if (*name_ == heap()->iterator_symbol()) {
+  } else if (*name_ == roots.iterator_symbol()) {
     if (!isolate_->IsArrayIteratorLookupChainIntact()) return;
     if (holder_->IsJSArray()) {
       isolate_->InvalidateArrayIteratorProtector();
     }
-  } else if (*name_ == heap()->resolve_string()) {
+  } else if (*name_ == roots.resolve_string()) {
     if (!isolate_->IsPromiseResolveLookupChainIntact()) return;
     // Setting the "resolve" property on any %Promise% intrinsic object
     // invalidates the Promise.resolve protector.
     if (isolate_->IsInAnyContext(*holder_, Context::PROMISE_FUNCTION_INDEX)) {
       isolate_->InvalidatePromiseResolveProtector();
     }
-  } else if (*name_ == heap()->then_string()) {
+  } else if (*name_ == roots.then_string()) {
     if (!isolate_->IsPromiseThenLookupChainIntact()) return;
     // Setting the "then" property on any JSPromise instance or on the
     // initial %PromisePrototype% invalidates the Promise#then protector.
+    // Also setting the "then" property on the initial %ObjectPrototype%
+    // invalidates the Promise#then protector, since we use this protector
+    // to guard the fast-path in AsyncGeneratorResolve, where we can skip
+    // the ResolvePromise step and go directly to FulfillPromise if we
+    // know that the Object.prototype doesn't contain a "then" method.
     if (holder_->IsJSPromise() ||
+        isolate_->IsInAnyContext(*holder_,
+                                 Context::INITIAL_OBJECT_PROTOTYPE_INDEX) ||
         isolate_->IsInAnyContext(*holder_, Context::PROMISE_PROTOTYPE_INDEX)) {
       isolate_->InvalidatePromiseThenProtector();
     }
@@ -402,30 +412,32 @@ void LookupIterator::PrepareForDataProperty(Handle<Object> value) {
 
   if (holder_obj->IsJSGlobalObject()) {
     Handle<GlobalDictionary> dictionary(
-        JSGlobalObject::cast(*holder_obj)->global_dictionary());
-    Handle<PropertyCell> cell(dictionary->CellAt(dictionary_entry()));
+        JSGlobalObject::cast(*holder_obj)->global_dictionary(), isolate());
+    Handle<PropertyCell> cell(dictionary->CellAt(dictionary_entry()),
+                              isolate());
     property_details_ = cell->property_details();
-    PropertyCell::PrepareForValue(dictionary, dictionary_entry(), value,
-                                  property_details_);
+    PropertyCell::PrepareForValue(isolate(), dictionary, dictionary_entry(),
+                                  value, property_details_);
     return;
   }
   if (!holder_obj->HasFastProperties()) return;
 
-  PropertyConstness new_constness = kConst;
+  PropertyConstness new_constness = PropertyConstness::kConst;
   if (FLAG_track_constant_fields) {
-    if (constness() == kConst) {
+    if (constness() == PropertyConstness::kConst) {
       DCHECK_EQ(kData, property_details_.kind());
       // Check that current value matches new value otherwise we should make
       // the property mutable.
-      if (!IsConstFieldValueEqualTo(*value)) new_constness = kMutable;
+      if (!IsConstFieldValueEqualTo(*value))
+        new_constness = PropertyConstness::kMutable;
     }
   } else {
-    new_constness = kMutable;
+    new_constness = PropertyConstness::kMutable;
   }
 
   Handle<Map> old_map(holder_obj->map(), isolate_);
   Handle<Map> new_map = Map::PrepareForDataProperty(
-      old_map, descriptor_number(), new_constness, value);
+      isolate(), old_map, descriptor_number(), new_constness, value);
 
   if (old_map.is_identical_to(new_map)) {
     // Update the property details if the representation was None.
@@ -458,18 +470,19 @@ void LookupIterator::ReconfigureDataProperty(Handle<Object> value,
   if (IsElement()) {
     DCHECK(!holder_obj->HasFixedTypedArrayElements());
     DCHECK(attributes != NONE || !holder_obj->HasFastElements());
-    Handle<FixedArrayBase> elements(holder_obj->elements());
+    Handle<FixedArrayBase> elements(holder_obj->elements(), isolate());
     holder_obj->GetElementsAccessor()->Reconfigure(holder_obj, elements,
                                                    number_, value, attributes);
     ReloadPropertyInformation<true>();
   } else if (holder_obj->HasFastProperties()) {
     Handle<Map> old_map(holder_obj->map(), isolate_);
     Handle<Map> new_map = Map::ReconfigureExistingProperty(
-        old_map, descriptor_number(), i::kData, attributes);
+        isolate_, old_map, descriptor_number(), i::kData, attributes);
     // Force mutable to avoid changing constant value by reconfiguring
     // kData -> kAccessor -> kData.
-    new_map = Map::PrepareForDataProperty(new_map, descriptor_number(),
-                                          kMutable, value);
+    new_map =
+        Map::PrepareForDataProperty(isolate(), new_map, descriptor_number(),
+                                    PropertyConstness::kMutable, value);
     JSObject::MigrateToMap(holder_obj, new_map);
     ReloadPropertyInformation<false>();
   }
@@ -486,14 +499,15 @@ void LookupIterator::ReconfigureDataProperty(Handle<Object> value,
     }
     if (holder_obj->IsJSGlobalObject()) {
       Handle<GlobalDictionary> dictionary(
-          JSGlobalObject::cast(*holder_obj)->global_dictionary());
+          JSGlobalObject::cast(*holder_obj)->global_dictionary(), isolate());
 
       Handle<PropertyCell> cell = PropertyCell::PrepareForValue(
-          dictionary, dictionary_entry(), value, details);
+          isolate(), dictionary, dictionary_entry(), value, details);
       cell->set_value(*value);
       property_details_ = cell->property_details();
     } else {
-      Handle<NameDictionary> dictionary(holder_obj->property_dictionary());
+      Handle<NameDictionary> dictionary(holder_obj->property_dictionary(),
+                                        isolate());
       PropertyDetails original_details =
           dictionary->DetailsAt(dictionary_entry());
       int enumeration_index = original_details.dictionary_index();
@@ -509,7 +523,7 @@ void LookupIterator::ReconfigureDataProperty(Handle<Object> value,
 
 #if VERIFY_HEAP
   if (FLAG_verify_heap) {
-    holder->HeapObjectVerify();
+    holder->HeapObjectVerify(isolate());
   }
 #endif
 }
@@ -556,7 +570,7 @@ void LookupIterator::PrepareTransitionToDataProperty(
       property_details_ = PropertyDetails(
           kData, attributes, PropertyCellType::kUninitialized, index);
       PropertyCellType new_type =
-          PropertyCell::UpdatedType(cell, value, property_details_);
+          PropertyCell::UpdatedType(isolate(), cell, value, property_details_);
       property_details_ = property_details_.set_cell_type(new_type);
       cell->set_property_details(property_details_);
       number_ = entry;
@@ -570,8 +584,9 @@ void LookupIterator::PrepareTransitionToDataProperty(
     return;
   }
 
-  Handle<Map> transition = Map::TransitionToDataProperty(
-      map, name_, value, attributes, kDefaultFieldConstness, store_mode);
+  Handle<Map> transition =
+      Map::TransitionToDataProperty(isolate_, map, name_, value, attributes,
+                                    kDefaultFieldConstness, store_mode);
   state_ = TRANSITION;
   transition_ = transition;
 
@@ -733,7 +748,7 @@ void LookupIterator::TransitionToAccessorProperty(
 
 #if VERIFY_HEAP
   if (FLAG_verify_heap) {
-    receiver->JSObjectVerify();
+    receiver->JSObjectVerify(isolate());
   }
 #endif
 }
@@ -759,7 +774,7 @@ void LookupIterator::TransitionToAccessorPair(Handle<Object> pair,
       FixedArray* parameter_map = FixedArray::cast(receiver->elements());
       uint32_t length = parameter_map->length() - 2;
       if (number_ < length) {
-        parameter_map->set(number_ + 2, heap()->the_hole_value());
+        parameter_map->set(number_ + 2, ReadOnlyRoots(heap()).the_hole_value());
       }
       FixedArray::cast(receiver->elements())->set(1, *dictionary);
     } else {
@@ -832,7 +847,7 @@ Handle<Object> LookupIterator::FetchValue() const {
     return JSObject::FastPropertyAt(holder, property_details_.representation(),
                                     field_index);
   } else {
-    result = holder_->map()->instance_descriptors()->GetValue(number_);
+    result = holder_->map()->instance_descriptors()->GetStrongValue(number_);
   }
   return handle(result, isolate_);
 }
@@ -841,7 +856,7 @@ bool LookupIterator::IsConstFieldValueEqualTo(Object* value) const {
   DCHECK(!IsElement());
   DCHECK(holder_->HasFastProperties());
   DCHECK_EQ(kField, property_details_.location());
-  DCHECK_EQ(kConst, property_details_.constness());
+  DCHECK_EQ(PropertyConstness::kConst, property_details_.constness());
   Handle<JSObject> holder = GetHolder<JSObject>();
   FieldIndex field_index = FieldIndex::ForDescriptor(holder->map(), number_);
   if (property_details_.representation().IsDouble()) {
@@ -852,7 +867,7 @@ bool LookupIterator::IsConstFieldValueEqualTo(Object* value) const {
     } else {
       Object* current_value = holder->RawFastPropertyAt(field_index);
       DCHECK(current_value->IsMutableHeapNumber());
-      bits = HeapNumber::cast(current_value)->value_as_bits();
+      bits = MutableHeapNumber::cast(current_value)->value_as_bits();
     }
     // Use bit representation of double to to check for hole double, since
     // manipulating the signaling NaN used for the hole in C++, e.g. with
@@ -903,7 +918,8 @@ Handle<Map> LookupIterator::GetFieldOwnerMap() const {
   DCHECK_EQ(kField, property_details_.location());
   DCHECK(!IsElement());
   Map* holder_map = holder_->map();
-  return handle(holder_map->FindFieldOwner(descriptor_number()), isolate_);
+  return handle(holder_map->FindFieldOwner(isolate(), descriptor_number()),
+                isolate_);
 }
 
 FieldIndex LookupIterator::GetFieldIndex() const {
@@ -954,16 +970,16 @@ void LookupIterator::WriteDataValue(Handle<Object> value,
     accessor->Set(object, number_, *value);
   } else if (holder->HasFastProperties()) {
     if (property_details_.location() == kField) {
-      // Check that in case of kConst field the existing value is equal to
-      // |value|.
-      DCHECK_IMPLIES(
-          !initializing_store && property_details_.constness() == kConst,
-          IsConstFieldValueEqualTo(*value));
+      // Check that in case of VariableMode::kConst field the existing value is
+      // equal to |value|.
+      DCHECK_IMPLIES(!initializing_store && property_details_.constness() ==
+                                                PropertyConstness::kConst,
+                     IsConstFieldValueEqualTo(*value));
       JSObject::cast(*holder)->WriteToField(descriptor_number(),
                                             property_details_, *value);
     } else {
       DCHECK_EQ(kDescriptor, property_details_.location());
-      DCHECK_EQ(kConst, property_details_.constness());
+      DCHECK_EQ(PropertyConstness::kConst, property_details_.constness());
     }
   } else if (holder->IsJSGlobalObject()) {
     GlobalDictionary* dictionary =
@@ -998,7 +1014,7 @@ bool LookupIterator::SkipInterceptor(JSObject* holder) {
 
 JSReceiver* LookupIterator::NextHolder(Map* map) {
   DisallowHeapAllocation no_gc;
-  if (map->prototype() == heap()->null_value()) return nullptr;
+  if (map->prototype() == ReadOnlyRoots(heap()).null_value()) return nullptr;
   if (!check_prototype_chain() && !map->has_hidden_prototype()) return nullptr;
   return JSReceiver::cast(map->prototype());
 }
diff --git a/deps/v8/src/lookup.h b/deps/v8/src/lookup.h
index 5a4135d8e018a9..d2d4a8ed05f3d3 100644
--- a/deps/v8/src/lookup.h
+++ b/deps/v8/src/lookup.h
@@ -56,7 +56,7 @@ class V8_EXPORT_PRIVATE LookupIterator final BASE_EMBEDDED {
   LookupIterator(Handle<Object> receiver, Handle<Name> name,
                  Handle<JSReceiver> holder,
                  Configuration configuration = DEFAULT)
-      : LookupIterator(name->GetIsolate(), receiver, name, holder,
+      : LookupIterator(holder->GetIsolate(), receiver, name, holder,
                        configuration) {}
 
   LookupIterator(Isolate* isolate, Handle<Object> receiver, Handle<Name> name,
@@ -273,11 +273,11 @@ class V8_EXPORT_PRIVATE LookupIterator final BASE_EMBEDDED {
     if (IsElement()) return;
     // This list must be kept in sync with
     // CodeStubAssembler::CheckForAssociatedProtector!
-    if (*name_ == heap()->is_concat_spreadable_symbol() ||
-        *name_ == heap()->constructor_string() ||
-        *name_ == heap()->next_string() || *name_ == heap()->species_symbol() ||
-        *name_ == heap()->iterator_symbol() ||
-        *name_ == heap()->resolve_string() || *name_ == heap()->then_string()) {
+    ReadOnlyRoots roots(heap());
+    if (*name_ == roots.is_concat_spreadable_symbol() ||
+        *name_ == roots.constructor_string() || *name_ == roots.next_string() ||
+        *name_ == roots.species_symbol() || *name_ == roots.iterator_symbol() ||
+        *name_ == roots.resolve_string() || *name_ == roots.then_string()) {
       InternalUpdateProtector();
     }
   }
diff --git a/deps/v8/src/lsan.h b/deps/v8/src/lsan.h
new file mode 100644
index 00000000000000..6e087e3a8faf5a
--- /dev/null
+++ b/deps/v8/src/lsan.h
@@ -0,0 +1,31 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// LeakSanitizer support.
+
+#ifndef V8_LSAN_H_
+#define V8_LSAN_H_
+
+#include "src/base/macros.h"
+#include "src/globals.h"
+
+// There is no compile time flag for LSan, to enable this whenever ASan is
+// enabled. Note that LSan can be used as part of ASan with 'detect_leaks=1'.
+// On windows, LSan is not implemented yet, so disable it there.
+#if defined(V8_USE_ADDRESS_SANITIZER) && !defined(V8_OS_WIN)
+
+#include <sanitizer/lsan_interface.h>
+
+#define LSAN_IGNORE_OBJECT(ptr) __lsan_ignore_object(ptr)
+
+#else  // defined(V8_USE_ADDRESS_SANITIZER) && !defined(V8_OS_WIN)
+
+#define LSAN_IGNORE_OBJECT(ptr)                                                \
+  static_assert(std::is_pointer<decltype(ptr)>::value ||                       \
+                    std::is_same<v8::internal::Address, decltype(ptr)>::value, \
+                "static type violation")
+
+#endif  // defined(V8_USE_ADDRESS_SANITIZER) && !defined(V8_OS_WIN)
+
+#endif  // V8_LSAN_H_
diff --git a/deps/v8/src/machine-type.h b/deps/v8/src/machine-type.h
index 63e3c7a462f358..68db01a4efa2fa 100644
--- a/deps/v8/src/machine-type.h
+++ b/deps/v8/src/machine-type.h
@@ -9,8 +9,6 @@
 
 #include "src/base/bits.h"
 #include "src/globals.h"
-#include "src/signature.h"
-#include "src/zone/zone.h"
 
 namespace v8 {
 namespace internal {
@@ -54,6 +52,8 @@ enum class MachineSemantic : uint8_t {
 
 V8_EXPORT_PRIVATE inline int ElementSizeLog2Of(MachineRepresentation rep);
 
+V8_EXPORT_PRIVATE inline int ElementSizeInBytes(MachineRepresentation rep);
+
 class MachineType {
  public:
   constexpr MachineType()
@@ -294,7 +294,9 @@ V8_EXPORT_PRIVATE inline int ElementSizeLog2Of(MachineRepresentation rep) {
   UNREACHABLE();
 }
 
-typedef Signature<MachineType> MachineSignature;
+V8_EXPORT_PRIVATE inline int ElementSizeInBytes(MachineRepresentation rep) {
+  return 1 << ElementSizeLog2Of(rep);
+}
 
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/src/macro-assembler.h b/deps/v8/src/macro-assembler.h
index a78476a82a5c0a..af5c60536b2966 100644
--- a/deps/v8/src/macro-assembler.h
+++ b/deps/v8/src/macro-assembler.h
@@ -189,6 +189,22 @@ class NoCurrentFrameScope {
   bool saved_;
 };
 
+// Prevent the use of the RootArray during the lifetime of this
+// scope object.
+class NoRootArrayScope {
+ public:
+  explicit NoRootArrayScope(MacroAssembler* masm)
+      : masm_(masm), old_value_(masm->root_array_available()) {
+    masm->set_root_array_available(false);
+  }
+
+  ~NoRootArrayScope() { masm_->set_root_array_available(old_value_); }
+
+ private:
+  MacroAssembler* masm_;
+  bool old_value_;
+};
+
 // Wrapper class for passing expected and actual parameter counts as
 // either registers or immediate values. Used to make sure that the
 // caller provides exactly the expected number of parameters to the
@@ -196,7 +212,7 @@ class NoCurrentFrameScope {
 class ParameterCount BASE_EMBEDDED {
  public:
   explicit ParameterCount(Register reg) : reg_(reg), immediate_(0) {}
-  explicit ParameterCount(int imm) : reg_(no_reg), immediate_(imm) {}
+  explicit ParameterCount(uint16_t imm) : reg_(no_reg), immediate_(imm) {}
 
   bool is_reg() const { return reg_.is_valid(); }
   bool is_immediate() const { return !is_reg(); }
@@ -205,14 +221,14 @@ class ParameterCount BASE_EMBEDDED {
     DCHECK(is_reg());
     return reg_;
   }
-  int immediate() const {
+  uint16_t immediate() const {
     DCHECK(is_immediate());
     return immediate_;
   }
 
  private:
   const Register reg_;
-  const int immediate_;
+  const uint16_t immediate_;
 
   DISALLOW_IMPLICIT_CONSTRUCTORS(ParameterCount);
 };
diff --git a/deps/v8/src/managed.h b/deps/v8/src/managed.h
deleted file mode 100644
index f98a86bec1956c..00000000000000
--- a/deps/v8/src/managed.h
+++ /dev/null
@@ -1,104 +0,0 @@
-// Copyright 2016 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef V8_MANAGED_H_
-#define V8_MANAGED_H_
-
-#include "src/global-handles.h"
-#include "src/handles.h"
-#include "src/heap/factory.h"
-#include "src/isolate.h"
-
-namespace v8 {
-namespace internal {
-// An object that wraps a pointer to a C++ object and manages its lifetime.
-// The C++ object will be deleted when the managed wrapper object is
-// garbage collected, or, last resort, if the isolate is torn down before GC,
-// as part of Isolate::Dispose().
-// Managed<CppType> may be used polymorphically as Foreign, where the held
-// address is typed as CppType**. The double indirection is due to the
-// use, by Managed, of Isolate::ManagedObjectFinalizer, which has a CppType*
-// first field.
-// Calling Foreign::set_foreign_address is not allowed on a Managed object.
-template <class CppType>
-class Managed : public Foreign {
-  class FinalizerWithHandle : public Isolate::ManagedObjectFinalizer {
-   public:
-    FinalizerWithHandle(void* value,
-                        Isolate::ManagedObjectFinalizer::Deleter deleter)
-        : Isolate::ManagedObjectFinalizer(value, deleter) {}
-
-    Object** global_handle_location;
-  };
-
- public:
-  V8_INLINE CppType* get() {
-    return reinterpret_cast<CppType*>(GetFinalizer()->value());
-  }
-
-  static Managed<CppType>* cast(Object* obj) {
-    SLOW_DCHECK(obj->IsForeign());
-    return reinterpret_cast<Managed<CppType>*>(obj);
-  }
-
-  // Allocate a new CppType and wrap it in a Managed.
-  template <typename... Args>
-  static Handle<Managed<CppType>> Allocate(Isolate* isolate, Args&&... args) {
-    CppType* ptr = new CppType(std::forward<Args>(args)...);
-    return From(isolate, ptr);
-  }
-
-  // Create a Managed from an existing CppType*. Takes ownership of the passed
-  // object.
-  static Handle<Managed<CppType>> From(Isolate* isolate, CppType* ptr) {
-    FinalizerWithHandle* finalizer =
-        new FinalizerWithHandle(ptr, &NativeDelete);
-    isolate->RegisterForReleaseAtTeardown(finalizer);
-    Handle<Managed<CppType>> handle = Handle<Managed<CppType>>::cast(
-        isolate->factory()->NewForeign(reinterpret_cast<Address>(finalizer)));
-    Handle<Object> global_handle = isolate->global_handles()->Create(*handle);
-    finalizer->global_handle_location = global_handle.location();
-    GlobalHandles::MakeWeak(
-        finalizer->global_handle_location, handle->GetFinalizer(),
-        &ResetWeakAndScheduleGCDelete, v8::WeakCallbackType::kParameter);
-
-    return handle;
-  }
-
- private:
-  static void ResetWeakAndScheduleGCDelete(
-      const v8::WeakCallbackInfo<void>& data) {
-    FinalizerWithHandle* finalizer =
-        reinterpret_cast<FinalizerWithHandle*>(data.GetParameter());
-    GlobalHandles::Destroy(finalizer->global_handle_location);
-    Isolate* isolate = reinterpret_cast<Isolate*>(data.GetIsolate());
-    isolate->UnregisterFromReleaseAtTeardown(finalizer);
-    // We need to call GCDelete as a second pass callback because
-    // it can trigger garbage collection. The first pass callbacks
-    // are not allowed to invoke V8 API.
-    data.SetSecondPassCallback(&GCDelete);
-  }
-
-  static void GCDelete(const v8::WeakCallbackInfo<void>& data) {
-    FinalizerWithHandle* finalizer =
-        reinterpret_cast<FinalizerWithHandle*>(data.GetParameter());
-    NativeDelete(finalizer);
-  }
-
-  static void NativeDelete(Isolate::ManagedObjectFinalizer* finalizer) {
-    CppType* typed_value = reinterpret_cast<CppType*>(finalizer->value());
-    delete typed_value;
-    FinalizerWithHandle* finalizer_with_handle =
-        static_cast<FinalizerWithHandle*>(finalizer);
-    delete finalizer_with_handle;
-  }
-
-  FinalizerWithHandle* GetFinalizer() {
-    return reinterpret_cast<FinalizerWithHandle*>(foreign_address());
-  }
-};
-}  // namespace internal
-}  // namespace v8
-
-#endif  // V8_MANAGED_H_
diff --git a/deps/v8/src/map-updater.cc b/deps/v8/src/map-updater.cc
index 1b8bdfdf12754d..29a4eccb714bcc 100644
--- a/deps/v8/src/map-updater.cc
+++ b/deps/v8/src/map-updater.cc
@@ -44,7 +44,7 @@ Object* MapUpdater::GetValue(int descriptor) const {
     return *new_value_;
   }
   DCHECK_EQ(kDescriptor, GetDetails(descriptor).location());
-  return old_descriptors_->GetValue(descriptor);
+  return old_descriptors_->GetStrongValue(descriptor);
 }
 
 FieldType* MapUpdater::GetFieldType(int descriptor) const {
@@ -78,7 +78,7 @@ Handle<FieldType> MapUpdater::GetOrComputeFieldType(
   if (location == kField) {
     return handle(descriptors->GetFieldType(descriptor), isolate_);
   } else {
-    return descriptors->GetValue(descriptor)
+    return descriptors->GetStrongValue(descriptor)
         ->OptimalType(isolate_, representation);
   }
 }
@@ -118,7 +118,7 @@ Handle<Map> MapUpdater::ReconfigureToDataField(int descriptor,
     // We don't know if this is a first property kind reconfiguration
     // and we don't know which value was in this property previously
     // therefore we can't treat such a property as constant.
-    new_constness_ = kMutable;
+    new_constness_ = PropertyConstness::kMutable;
     new_representation_ = representation;
     new_field_type_ = field_type;
   }
@@ -163,16 +163,16 @@ void MapUpdater::GeneralizeField(Handle<Map> map, int modify_index,
                                  PropertyConstness new_constness,
                                  Representation new_representation,
                                  Handle<FieldType> new_field_type) {
-  Map::GeneralizeField(map, modify_index, new_constness, new_representation,
-                       new_field_type);
+  Map::GeneralizeField(isolate_, map, modify_index, new_constness,
+                       new_representation, new_field_type);
 
   DCHECK_EQ(*old_descriptors_, old_map_->instance_descriptors());
 }
 
 MapUpdater::State MapUpdater::CopyGeneralizeAllFields(const char* reason) {
-  result_map_ = Map::CopyGeneralizeAllFields(old_map_, new_elements_kind_,
-                                             modified_descriptor_, new_kind_,
-                                             new_attributes_, reason);
+  result_map_ = Map::CopyGeneralizeAllFields(
+      isolate_, old_map_, new_elements_kind_, modified_descriptor_, new_kind_,
+      new_attributes_, reason);
   state_ = kEnd;
   return state_;  // Done.
 }
@@ -199,13 +199,13 @@ MapUpdater::State MapUpdater::TryRecofigureToDataFieldInplace() {
   DCHECK_EQ(kField, old_details.location());
   if (FLAG_trace_generalization) {
     old_map_->PrintGeneralization(
-        stdout, "uninitialized field", modified_descriptor_, old_nof_, old_nof_,
-        false, old_representation, new_representation_,
+        isolate_, stdout, "uninitialized field", modified_descriptor_, old_nof_,
+        old_nof_, false, old_representation, new_representation_,
         handle(old_descriptors_->GetFieldType(modified_descriptor_), isolate_),
         MaybeHandle<Object>(), new_field_type_, MaybeHandle<Object>());
   }
-  Handle<Map> field_owner(old_map_->FindFieldOwner(modified_descriptor_),
-                          isolate_);
+  Handle<Map> field_owner(
+      old_map_->FindFieldOwner(isolate_, modified_descriptor_), isolate_);
 
   GeneralizeField(field_owner, modified_descriptor_, new_constness_,
                   new_representation_, new_field_type_);
@@ -224,7 +224,7 @@ MapUpdater::State MapUpdater::TryRecofigureToDataFieldInplace() {
 MapUpdater::State MapUpdater::FindRootMap() {
   DCHECK_EQ(kInitialized, state_);
   // Check the state of the root map.
-  root_map_ = handle(old_map_->FindRootMap(), isolate_);
+  root_map_ = handle(old_map_->FindRootMap(isolate_), isolate_);
   ElementsKind from_kind = root_map_->elements_kind();
   ElementsKind to_kind = new_elements_kind_;
   if (root_map_->is_deprecated()) {
@@ -232,7 +232,7 @@ MapUpdater::State MapUpdater::FindRootMap() {
     result_map_ = handle(
         JSFunction::cast(root_map_->GetConstructor())->initial_map(), isolate_);
     if (from_kind != to_kind) {
-      result_map_ = Map::AsElementsKind(result_map_, to_kind);
+      result_map_ = Map::AsElementsKind(isolate_, result_map_, to_kind);
     }
     DCHECK(result_map_->is_dictionary_map());
     return state_;
@@ -294,7 +294,7 @@ MapUpdater::State MapUpdater::FindRootMap() {
 
   // From here on, use the map with correct elements kind as root map.
   if (from_kind != to_kind) {
-    root_map_ = Map::AsElementsKind(root_map_, to_kind);
+    root_map_ = Map::AsElementsKind(isolate_, root_map_, to_kind);
   }
   state_ = kAtRootMap;
   return state_;  // Not done yet.
@@ -307,7 +307,7 @@ MapUpdater::State MapUpdater::FindTargetMap() {
   int root_nof = root_map_->NumberOfOwnDescriptors();
   for (int i = root_nof; i < old_nof_; ++i) {
     PropertyDetails old_details = GetDetails(i);
-    Map* transition = TransitionsAccessor(target_map_)
+    Map* transition = TransitionsAccessor(isolate_, target_map_)
                           .SearchTransition(GetKey(i), old_details.kind(),
                                             old_details.attributes());
     if (transition == nullptr) break;
@@ -321,7 +321,8 @@ MapUpdater::State MapUpdater::FindTargetMap() {
     DCHECK_EQ(old_details.kind(), tmp_details.kind());
     DCHECK_EQ(old_details.attributes(), tmp_details.attributes());
     if (old_details.kind() == kAccessor &&
-        !EqualImmutableValues(GetValue(i), tmp_descriptors->GetValue(i))) {
+        !EqualImmutableValues(GetValue(i),
+                              tmp_descriptors->GetStrongValue(i))) {
       // TODO(ishell): mutable accessors are not implemented yet.
       return CopyGeneralizeAllFields("GenAll_Incompatible");
     }
@@ -347,7 +348,8 @@ MapUpdater::State MapUpdater::FindTargetMap() {
                       old_field_type);
     } else {
       // kDescriptor: Check that the value matches.
-      if (!EqualImmutableValues(GetValue(i), tmp_descriptors->GetValue(i))) {
+      if (!EqualImmutableValues(GetValue(i),
+                                tmp_descriptors->GetStrongValue(i))) {
         break;
       }
     }
@@ -374,8 +376,9 @@ MapUpdater::State MapUpdater::FindTargetMap() {
             target_descriptors->GetFieldType(modified_descriptor_)));
       } else {
         DCHECK(details.location() == kField ||
-               EqualImmutableValues(*new_value_, target_descriptors->GetValue(
-                                                     modified_descriptor_)));
+               EqualImmutableValues(
+                   *new_value_,
+                   target_descriptors->GetStrongValue(modified_descriptor_)));
       }
     }
 #endif
@@ -390,7 +393,7 @@ MapUpdater::State MapUpdater::FindTargetMap() {
   // Find the last compatible target map in the transition tree.
   for (int i = target_nof; i < old_nof_; ++i) {
     PropertyDetails old_details = GetDetails(i);
-    Map* transition = TransitionsAccessor(target_map_)
+    Map* transition = TransitionsAccessor(isolate_, target_map_)
                           .SearchTransition(GetKey(i), old_details.kind(),
                                             old_details.attributes());
     if (transition == nullptr) break;
@@ -404,7 +407,8 @@ MapUpdater::State MapUpdater::FindTargetMap() {
     DCHECK_EQ(old_details.attributes(), tmp_details.attributes());
 #endif
     if (old_details.kind() == kAccessor &&
-        !EqualImmutableValues(GetValue(i), tmp_descriptors->GetValue(i))) {
+        !EqualImmutableValues(GetValue(i),
+                              tmp_descriptors->GetStrongValue(i))) {
       return CopyGeneralizeAllFields("GenAll_Incompatible");
     }
     DCHECK(!tmp_map->is_deprecated());
@@ -447,7 +451,8 @@ Handle<DescriptorArray> MapUpdater::BuildDescriptorArray() {
       current_offset += old_details.field_width_in_words();
     }
     Descriptor d(handle(GetKey(i), isolate_),
-                 handle(old_descriptors_->GetValue(i), isolate_), old_details);
+                 MaybeObjectHandle(old_descriptors_->GetValue(i), isolate_),
+                 old_details);
     new_descriptors->Set(i, &d);
   }
 
@@ -471,16 +476,17 @@ Handle<DescriptorArray> MapUpdater::BuildDescriptorArray() {
     PropertyLocation next_location =
         old_details.location() == kField ||
                 target_details.location() == kField ||
-                !EqualImmutableValues(target_descriptors->GetValue(i),
+                !EqualImmutableValues(target_descriptors->GetStrongValue(i),
                                       GetValue(i))
             ? kField
             : kDescriptor;
 
     if (!FLAG_track_constant_fields && next_location == kField) {
-      next_constness = kMutable;
+      next_constness = PropertyConstness::kMutable;
     }
     // Ensure that mutable values are stored in fields.
-    DCHECK_IMPLIES(next_constness == kMutable, next_location == kField);
+    DCHECK_IMPLIES(next_constness == PropertyConstness::kMutable,
+                   next_location == kField);
 
     Representation next_representation =
         old_details.representation().generalize(
@@ -502,7 +508,7 @@ Handle<DescriptorArray> MapUpdater::BuildDescriptorArray() {
           isolate_, instance_type, &next_constness, &next_representation,
           &next_field_type);
 
-      Handle<Object> wrapped_type(Map::WrapFieldType(next_field_type));
+      MaybeObjectHandle wrapped_type(Map::WrapFieldType(next_field_type));
       Descriptor d;
       if (next_kind == kData) {
         d = Descriptor::DataField(key, current_offset, next_attributes,
@@ -516,7 +522,7 @@ Handle<DescriptorArray> MapUpdater::BuildDescriptorArray() {
       new_descriptors->Set(i, &d);
     } else {
       DCHECK_EQ(kDescriptor, next_location);
-      DCHECK_EQ(kConst, next_constness);
+      DCHECK_EQ(PropertyConstness::kConst, next_constness);
 
       Handle<Object> value(GetValue(i), isolate_);
       Descriptor d;
@@ -555,10 +561,11 @@ Handle<DescriptorArray> MapUpdater::BuildDescriptorArray() {
                     !Map::IsInplaceGeneralizableField(
                         next_constness, next_representation, *next_field_type));
 
-      Handle<Object> wrapped_type(Map::WrapFieldType(next_field_type));
+      MaybeObjectHandle wrapped_type(Map::WrapFieldType(next_field_type));
       Descriptor d;
       if (next_kind == kData) {
-        DCHECK_IMPLIES(!FLAG_track_constant_fields, next_constness == kMutable);
+        DCHECK_IMPLIES(!FLAG_track_constant_fields,
+                       next_constness == PropertyConstness::kMutable);
         d = Descriptor::DataField(key, current_offset, next_attributes,
                                   next_constness, next_representation,
                                   wrapped_type);
@@ -570,7 +577,7 @@ Handle<DescriptorArray> MapUpdater::BuildDescriptorArray() {
       new_descriptors->Set(i, &d);
     } else {
       DCHECK_EQ(kDescriptor, next_location);
-      DCHECK_EQ(kConst, next_constness);
+      DCHECK_EQ(PropertyConstness::kConst, next_constness);
 
       Handle<Object> value(GetValue(i), isolate_);
       if (next_kind == kData) {
@@ -596,7 +603,7 @@ Handle<Map> MapUpdater::FindSplitMap(Handle<DescriptorArray> descriptors) {
     Name* name = descriptors->GetKey(i);
     PropertyDetails details = descriptors->GetDetails(i);
     Map* next =
-        TransitionsAccessor(current, &no_allocation)
+        TransitionsAccessor(isolate_, current, &no_allocation)
             .SearchTransition(name, details.kind(), details.attributes());
     if (next == nullptr) break;
     DescriptorArray* next_descriptors = next->instance_descriptors();
@@ -614,8 +621,8 @@ Handle<Map> MapUpdater::FindSplitMap(Handle<DescriptorArray> descriptors) {
         break;
       }
     } else {
-      if (!EqualImmutableValues(descriptors->GetValue(i),
-                                next_descriptors->GetValue(i))) {
+      if (!EqualImmutableValues(descriptors->GetStrongValue(i),
+                                next_descriptors->GetStrongValue(i))) {
         break;
       }
     }
@@ -632,13 +639,13 @@ MapUpdater::State MapUpdater::ConstructNewMap() {
   DCHECK_NE(old_nof_, split_nof);
 
   PropertyDetails split_details = GetDetails(split_nof);
-  TransitionsAccessor transitions(split_map);
+  TransitionsAccessor transitions(isolate_, split_map);
 
   // Invalidate a transition target at |key|.
   Map* maybe_transition = transitions.SearchTransition(
       GetKey(split_nof), split_details.kind(), split_details.attributes());
   if (maybe_transition != nullptr) {
-    maybe_transition->DeprecateTransitionTree();
+    maybe_transition->DeprecateTransitionTree(isolate_);
   }
 
   // If |maybe_transition| is not nullptr then the transition array already
@@ -663,19 +670,19 @@ MapUpdater::State MapUpdater::ConstructNewMap() {
       old_field_type = handle(
           old_descriptors_->GetFieldType(modified_descriptor_), isolate_);
     } else {
-      old_value =
-          handle(old_descriptors_->GetValue(modified_descriptor_), isolate_);
+      old_value = handle(old_descriptors_->GetStrongValue(modified_descriptor_),
+                         isolate_);
     }
     if (new_details.location() == kField) {
       new_field_type =
           handle(new_descriptors->GetFieldType(modified_descriptor_), isolate_);
     } else {
-      new_value =
-          handle(new_descriptors->GetValue(modified_descriptor_), isolate_);
+      new_value = handle(new_descriptors->GetStrongValue(modified_descriptor_),
+                         isolate_);
     }
 
     old_map_->PrintGeneralization(
-        stdout, "", modified_descriptor_, split_nof, old_nof_,
+        isolate_, stdout, "", modified_descriptor_, split_nof, old_nof_,
         old_details.location() == kDescriptor && new_location_ == kField,
         old_details.representation(), new_details.representation(),
         old_field_type, old_value, new_field_type, new_value);
@@ -684,13 +691,14 @@ MapUpdater::State MapUpdater::ConstructNewMap() {
   Handle<LayoutDescriptor> new_layout_descriptor =
       LayoutDescriptor::New(split_map, new_descriptors, old_nof_);
 
-  Handle<Map> new_map = Map::AddMissingTransitions(split_map, new_descriptors,
-                                                   new_layout_descriptor);
+  Handle<Map> new_map = Map::AddMissingTransitions(
+      isolate_, split_map, new_descriptors, new_layout_descriptor);
 
   // Deprecated part of the transition tree is no longer reachable, so replace
   // current instance descriptors in the "survived" part of the tree with
   // the new descriptors to maintain descriptors sharing invariant.
-  split_map->ReplaceDescriptors(*new_descriptors, *new_layout_descriptor);
+  split_map->ReplaceDescriptors(isolate_, *new_descriptors,
+                                *new_layout_descriptor);
 
   result_map_ = new_map;
   state_ = kEnd;
diff --git a/deps/v8/src/map-updater.h b/deps/v8/src/map-updater.h
index 7c5e92f2bf28bd..5dcb0183734dc3 100644
--- a/deps/v8/src/map-updater.h
+++ b/deps/v8/src/map-updater.h
@@ -53,7 +53,9 @@ class MapUpdater {
         is_transitionable_fast_elements_kind_(
             IsTransitionableFastElementsKind(new_elements_kind_)) {
     // We shouldn't try to update remote objects.
-    DCHECK(!old_map->FindRootMap()->GetConstructor()->IsFunctionTemplateInfo());
+    DCHECK(!old_map->FindRootMap(isolate)
+                ->GetConstructor()
+                ->IsFunctionTemplateInfo());
   }
 
   // Prepares for reconfiguring of a property at |descriptor| to data field
@@ -170,7 +172,7 @@ class MapUpdater {
   int modified_descriptor_ = -1;
   PropertyKind new_kind_ = kData;
   PropertyAttributes new_attributes_ = NONE;
-  PropertyConstness new_constness_ = kMutable;
+  PropertyConstness new_constness_ = PropertyConstness::kMutable;
   PropertyLocation new_location_ = kField;
   Representation new_representation_ = Representation::None();
 
diff --git a/deps/v8/src/messages.cc b/deps/v8/src/messages.cc
index fe1c246e954969..4fd27f98072adc 100644
--- a/deps/v8/src/messages.cc
+++ b/deps/v8/src/messages.cc
@@ -56,13 +56,11 @@ Handle<JSMessageObject> MessageHandler::MakeMessageObject(
 
   int start = -1;
   int end = -1;
-  Handle<Object> script_handle = factory->undefined_value();
+  Handle<Script> script_handle = isolate->factory()->empty_script();
   if (location != nullptr) {
     start = location->start_pos();
     end = location->end_pos();
-    script_handle = Script::GetWrapper(location->script());
-  } else {
-    script_handle = Script::GetWrapper(isolate->factory()->empty_script());
+    script_handle = location->script();
   }
 
   Handle<Object> stack_frames_handle = stack_frames.is_null()
@@ -85,7 +83,7 @@ void MessageHandler::ReportMessage(Isolate* isolate, const MessageLocation* loc,
     // and ignore scheduled exceptions callbacks can throw.
 
     // We pass the exception object into the message handler callback though.
-    Object* exception_object = isolate->heap()->undefined_value();
+    Object* exception_object = ReadOnlyRoots(isolate).undefined_value();
     if (isolate->has_pending_exception()) {
       exception_object = isolate->pending_exception();
     }
@@ -190,11 +188,11 @@ namespace {
 
 Object* EvalFromFunctionName(Isolate* isolate, Handle<Script> script) {
   if (!script->has_eval_from_shared())
-    return isolate->heap()->undefined_value();
+    return ReadOnlyRoots(isolate).undefined_value();
 
-  Handle<SharedFunctionInfo> shared(script->eval_from_shared());
+  Handle<SharedFunctionInfo> shared(script->eval_from_shared(), isolate);
   // Find the name of the function calling eval.
-  if (shared->Name()->BooleanValue()) {
+  if (shared->Name()->BooleanValue(isolate)) {
     return shared->Name();
   }
 
@@ -203,12 +201,13 @@ Object* EvalFromFunctionName(Isolate* isolate, Handle<Script> script) {
 
 Object* EvalFromScript(Isolate* isolate, Handle<Script> script) {
   if (!script->has_eval_from_shared())
-    return isolate->heap()->undefined_value();
+    return ReadOnlyRoots(isolate).undefined_value();
 
-  Handle<SharedFunctionInfo> eval_from_shared(script->eval_from_shared());
+  Handle<SharedFunctionInfo> eval_from_shared(script->eval_from_shared(),
+                                              isolate);
   return eval_from_shared->script()->IsScript()
              ? eval_from_shared->script()
-             : isolate->heap()->undefined_value();
+             : ReadOnlyRoots(isolate).undefined_value();
 }
 
 MaybeHandle<String> FormatEvalOrigin(Isolate* isolate, Handle<Script> script) {
@@ -223,7 +222,7 @@ MaybeHandle<String> FormatEvalOrigin(Isolate* isolate, Handle<Script> script) {
 
   Handle<Object> eval_from_function_name =
       handle(EvalFromFunctionName(isolate, script), isolate);
-  if (eval_from_function_name->BooleanValue()) {
+  if (eval_from_function_name->BooleanValue(isolate)) {
     Handle<String> str;
     ASSIGN_RETURN_ON_EXCEPTION(
         isolate, str, Object::ToString(isolate, eval_from_function_name),
@@ -525,10 +524,10 @@ int StringIndexOf(Isolate* isolate, Handle<String> subject,
 // 2. subject == pattern.
 bool StringEndsWithMethodName(Isolate* isolate, Handle<String> subject,
                               Handle<String> pattern) {
-  if (String::Equals(subject, pattern)) return true;
+  if (String::Equals(isolate, subject, pattern)) return true;
 
-  FlatStringReader subject_reader(isolate, String::Flatten(subject));
-  FlatStringReader pattern_reader(isolate, String::Flatten(pattern));
+  FlatStringReader subject_reader(isolate, String::Flatten(isolate, subject));
+  FlatStringReader pattern_reader(isolate, String::Flatten(isolate, pattern));
 
   int pattern_index = pattern_reader.length() - 1;
   int subject_index = subject_reader.length() - 1;
@@ -650,7 +649,7 @@ void WasmStackFrame::FromFrameArray(Isolate* isolate, Handle<FrameArray> array,
   if (array->IsWasmInterpretedFrame(frame_ix)) {
     code_ = nullptr;
   } else {
-    code_ = wasm_instance_->compiled_module()->GetNativeModule()->GetCode(
+    code_ = wasm_instance_->module_object()->native_module()->code(
         wasm_func_index_);
   }
   offset_ = array->Offset(frame_ix)->value();
@@ -664,10 +663,10 @@ Handle<Object> WasmStackFrame::GetFunction() const {
 
 Handle<Object> WasmStackFrame::GetFunctionName() {
   Handle<Object> name;
-  Handle<WasmSharedModuleData> shared(
-      wasm_instance_->compiled_module()->shared(), isolate_);
-  if (!WasmSharedModuleData::GetFunctionNameOrNull(isolate_, shared,
-                                                   wasm_func_index_)
+  Handle<WasmModuleObject> module_object(wasm_instance_->module_object(),
+                                         isolate_);
+  if (!WasmModuleObject::GetFunctionNameOrNull(isolate_, module_object,
+                                               wasm_func_index_)
            .ToHandle(&name)) {
     name = isolate_->factory()->null_value();
   }
@@ -677,13 +676,12 @@ Handle<Object> WasmStackFrame::GetFunctionName() {
 MaybeHandle<String> WasmStackFrame::ToString() {
   IncrementalStringBuilder builder(isolate_);
 
-  Handle<WasmSharedModuleData> shared(
-      wasm_instance_->compiled_module()->shared(), isolate_);
+  Handle<WasmModuleObject> module_object(wasm_instance_->module_object(),
+                                         isolate_);
   MaybeHandle<String> module_name =
-      WasmSharedModuleData::GetModuleNameOrNull(isolate_, shared);
-  MaybeHandle<String> function_name =
-      WasmSharedModuleData::GetFunctionNameOrNull(isolate_, shared,
-                                                  wasm_func_index_);
+      WasmModuleObject::GetModuleNameOrNull(isolate_, module_object);
+  MaybeHandle<String> function_name = WasmModuleObject::GetFunctionNameOrNull(
+      isolate_, module_object, wasm_func_index_);
   bool has_name = !module_name.is_null() || !function_name.is_null();
   if (has_name) {
     if (module_name.is_null()) {
@@ -726,8 +724,7 @@ Handle<Object> WasmStackFrame::Null() const {
 bool WasmStackFrame::HasScript() const { return true; }
 
 Handle<Script> WasmStackFrame::GetScript() const {
-  return handle(wasm_instance_->compiled_module()->shared()->script(),
-                isolate_);
+  return handle(wasm_instance_->module_object()->script(), isolate_);
 }
 
 AsmJsWasmStackFrame::AsmJsWasmStackFrame() {}
@@ -751,15 +748,13 @@ Handle<Object> AsmJsWasmStackFrame::GetFunction() const {
 }
 
 Handle<Object> AsmJsWasmStackFrame::GetFileName() {
-  Handle<Script> script(wasm_instance_->compiled_module()->shared()->script(),
-                        isolate_);
+  Handle<Script> script(wasm_instance_->module_object()->script(), isolate_);
   DCHECK(script->IsUserJavaScript());
   return handle(script->name(), isolate_);
 }
 
 Handle<Object> AsmJsWasmStackFrame::GetScriptNameOrSourceUrl() {
-  Handle<Script> script(wasm_instance_->compiled_module()->shared()->script(),
-                        isolate_);
+  Handle<Script> script(wasm_instance_->module_object()->script(), isolate_);
   DCHECK_EQ(Script::TYPE_NORMAL, script->type());
   return ScriptNameOrSourceUrl(script, isolate_);
 }
@@ -769,26 +764,24 @@ int AsmJsWasmStackFrame::GetPosition() const {
   int byte_offset =
       FrameSummary::WasmCompiledFrameSummary::GetWasmSourcePosition(code_,
                                                                     offset_);
-  Handle<WasmSharedModuleData> shared(
-      wasm_instance_->compiled_module()->shared(), isolate_);
+  Handle<WasmModuleObject> module_object(wasm_instance_->module_object(),
+                                         isolate_);
   DCHECK_LE(0, byte_offset);
-  return WasmSharedModuleData::GetSourcePosition(
-      shared, wasm_func_index_, static_cast<uint32_t>(byte_offset),
-      is_at_number_conversion_);
+  return WasmModuleObject::GetSourcePosition(module_object, wasm_func_index_,
+                                             static_cast<uint32_t>(byte_offset),
+                                             is_at_number_conversion_);
 }
 
 int AsmJsWasmStackFrame::GetLineNumber() {
   DCHECK_LE(0, GetPosition());
-  Handle<Script> script(wasm_instance_->compiled_module()->shared()->script(),
-                        isolate_);
+  Handle<Script> script(wasm_instance_->module_object()->script(), isolate_);
   DCHECK(script->IsUserJavaScript());
   return Script::GetLineNumber(script, GetPosition()) + 1;
 }
 
 int AsmJsWasmStackFrame::GetColumnNumber() {
   DCHECK_LE(0, GetPosition());
-  Handle<Script> script(wasm_instance_->compiled_module()->shared()->script(),
-                        isolate_);
+  Handle<Script> script(wasm_instance_->module_object()->script(), isolate_);
   DCHECK(script->IsUserJavaScript());
   return Script::GetColumnNumber(script, GetPosition()) + 1;
 }
@@ -950,7 +943,8 @@ MaybeHandle<Object> ErrorUtils::FormatStackTrace(Isolate* isolate,
   Handle<JSArray> raw_stack_array = Handle<JSArray>::cast(raw_stack);
 
   DCHECK(raw_stack_array->elements()->IsFixedArray());
-  Handle<FrameArray> elems(FrameArray::cast(raw_stack_array->elements()));
+  Handle<FrameArray> elems(FrameArray::cast(raw_stack_array->elements()),
+                           isolate);
 
   // If there's a user-specified "prepareStackFrames" function, call it on the
   // frames and use its result.
@@ -1047,7 +1041,7 @@ Handle<String> MessageTemplate::FormatMessage(Isolate* isolate,
   // here to improve the efficiency of converting it to a C string and
   // other operations that are likely to take place (see GetLocalizedMessage
   // for example).
-  return String::Flatten(result_string);
+  return String::Flatten(isolate, result_string);
 }
 
 
@@ -1154,8 +1148,8 @@ MaybeHandle<String> GetStringPropertyOrDefault(Isolate* isolate,
                                                Handle<String> key,
                                                Handle<String> default_str) {
   Handle<Object> obj;
-  ASSIGN_RETURN_ON_EXCEPTION(isolate, obj, JSObject::GetProperty(recv, key),
-                             String);
+  ASSIGN_RETURN_ON_EXCEPTION(isolate, obj,
+                             JSObject::GetProperty(isolate, recv, key), String);
 
   Handle<String> str;
   if (obj->IsUndefined(isolate)) {
diff --git a/deps/v8/src/messages.h b/deps/v8/src/messages.h
index 187bd4d308a010..1d1a07d7b696f3 100644
--- a/deps/v8/src/messages.h
+++ b/deps/v8/src/messages.h
@@ -273,15 +273,13 @@ class ErrorUtils : public AllStatic {
     "Derived ArrayBuffer constructor created a buffer which was too small")    \
   T(ArrayBufferSpeciesThis,                                                    \
     "ArrayBuffer subclass returned this from species constructor")             \
-  T(ArrayFunctionsOnFrozen, "Cannot modify frozen array elements")             \
-  T(ArrayFunctionsOnSealed, "Cannot add/remove sealed array elements")         \
   T(AwaitNotInAsyncFunction, "await is only valid in async function")          \
   T(AtomicsWaitNotAllowed, "Atomics.wait cannot be called in this context")    \
   T(BadSortComparisonFunction,                                                 \
     "The comparison function must be either a function or undefined")          \
   T(BigIntFromNumber,                                                          \
-    "The number % is not a safe integer and thus cannot be converted to a "    \
-    "BigInt")                                                                  \
+    "The number % cannot be converted to a BigInt because it is not an "       \
+    "integer")                                                                 \
   T(BigIntFromObject, "Cannot convert % to a BigInt")                          \
   T(BigIntMixedTypes,                                                          \
     "Cannot mix BigInt and other types, use explicit conversions")             \
@@ -339,10 +337,14 @@ class ErrorUtils : public AllStatic {
   T(InvalidInOperatorUse, "Cannot use 'in' operator to search for '%' in %")   \
   T(InvalidRegExpExecResult,                                                   \
     "RegExp exec method returned something other than an Object or null")      \
+  T(InvalidUnit, "Invalid unit argument for %() '%'")                          \
   T(IteratorResultNotAnObject, "Iterator result % is not an object")           \
   T(IteratorSymbolNonCallable, "Found non-callable @@iterator")                \
   T(IteratorValueNotAnObject, "Iterator value % is not an entry object")       \
   T(LanguageID, "Language ID should be string or object.")                     \
+  T(LocaleNotEmpty,                                                            \
+    "First argument to Intl.Locale constructor can't be empty or missing")     \
+  T(LocaleBadParameters, "Incorrect locale information provided")              \
   T(MapperFunctionNonCallable, "flatMap mapper function is not callable")      \
   T(MethodCalledOnWrongObject,                                                 \
     "Method % called on a non-object or on a wrong type of object.")           \
@@ -488,6 +490,8 @@ class ErrorUtils : public AllStatic {
     "Cannot supply flags when constructing one RegExp from another")           \
   T(RegExpNonObject, "% getter called on non-object %")                        \
   T(RegExpNonRegExp, "% getter called on non-RegExp object")                   \
+  T(RelativeDateTimeFormatterBadParameters,                                    \
+    "Incorrect RelativeDateTimeFormatter provided")                            \
   T(ResolverNotAFunction, "Promise resolver % is not a function")              \
   T(ReturnMethodNotCallable, "The iterator's 'return' method is not callable") \
   T(SharedArrayBufferTooShort,                                                 \
@@ -581,8 +585,6 @@ class ErrorUtils : public AllStatic {
   T(ConstructorIsAccessor, "Class constructor may not be an accessor")         \
   T(ConstructorIsGenerator, "Class constructor may not be a generator")        \
   T(ConstructorIsAsync, "Class constructor may not be an async method")        \
-  T(ClassConstructorReturnedNonObject,                                         \
-    "Class constructors may only return object or undefined")                  \
   T(DerivedConstructorReturnedNonObject,                                       \
     "Derived constructors may only return object or undefined")                \
   T(DuplicateConstructor, "A class may only have one constructor")             \
diff --git a/deps/v8/src/mips/assembler-mips-inl.h b/deps/v8/src/mips/assembler-mips-inl.h
index bc4d95b4fade42..26860d961e2a3b 100644
--- a/deps/v8/src/mips/assembler-mips-inl.h
+++ b/deps/v8/src/mips/assembler-mips-inl.h
@@ -69,8 +69,7 @@ int32_t Operand::immediate() const {
 void RelocInfo::apply(intptr_t delta) {
   if (IsInternalReference(rmode_) || IsInternalReferenceEncoded(rmode_)) {
     // Absolute code pointer inside code object moves with the code object.
-    byte* p = reinterpret_cast<byte*>(pc_);
-    Assembler::RelocateInternalReference(rmode_, p, delta);
+    Assembler::RelocateInternalReference(rmode_, pc_, delta);
   }
 }
 
@@ -102,12 +101,11 @@ Address RelocInfo::target_address_address() {
     // On R6 we don't move to the end of the instructions to be patched, but one
     // instruction before, because if these instructions are at the end of the
     // code object it can cause errors in the deserializer.
-    return reinterpret_cast<Address>(
-        pc_ +
-        (Assembler::kInstructionsFor32BitConstant - 1) * Assembler::kInstrSize);
+    return pc_ + (Assembler::kInstructionsFor32BitConstant - 1) *
+                     Assembler::kInstrSize;
   } else {
-    return reinterpret_cast<Address>(
-        pc_ + Assembler::kInstructionsFor32BitConstant * Assembler::kInstrSize);
+    return pc_ +
+           Assembler::kInstructionsFor32BitConstant * Assembler::kInstrSize;
   }
 }
 
@@ -131,14 +129,19 @@ void Assembler::deserialization_set_special_target_at(
     // On R6 the address location is shifted by one instruction
     set_target_address_at(
         instruction_payload - (kInstructionsFor32BitConstant - 1) * kInstrSize,
-        code ? code->constant_pool() : nullptr, target);
+        code ? code->constant_pool() : kNullAddress, target);
   } else {
     set_target_address_at(
         instruction_payload - kInstructionsFor32BitConstant * kInstrSize,
-        code ? code->constant_pool() : nullptr, target);
+        code ? code->constant_pool() : kNullAddress, target);
   }
 }
 
+int Assembler::deserialization_special_target_size(
+    Address instruction_payload) {
+  return kSpecialTargetSize;
+}
+
 void Assembler::set_target_internal_reference_encoded_at(Address pc,
                                                          Address target) {
   Instr instr1 = Assembler::instr_at(pc + 0 * Assembler::kInstrSize);
@@ -147,7 +150,7 @@ void Assembler::set_target_internal_reference_encoded_at(Address pc,
   DCHECK(Assembler::IsOri(instr2) || Assembler::IsJicOrJialc(instr2));
   instr1 &= ~kImm16Mask;
   instr2 &= ~kImm16Mask;
-  int32_t imm = reinterpret_cast<int32_t>(target);
+  int32_t imm = static_cast<int32_t>(target);
   DCHECK_EQ(imm & 3, 0);
   if (Assembler::IsJicOrJialc(instr2)) {
     // Encoded internal references are lui/jic load of 32-bit absolute address.
@@ -193,7 +196,7 @@ Handle<HeapObject> RelocInfo::target_object_handle(Assembler* origin) {
       Assembler::target_address_at(pc_, constant_pool_)));
 }
 
-void RelocInfo::set_target_object(HeapObject* target,
+void RelocInfo::set_target_object(Heap* heap, HeapObject* target,
                                   WriteBarrierMode write_barrier_mode,
                                   ICacheFlushMode icache_flush_mode) {
   DCHECK(IsCodeTarget(rmode_) || rmode_ == EMBEDDED_OBJECT);
@@ -201,9 +204,9 @@ void RelocInfo::set_target_object(HeapObject* target,
                                    reinterpret_cast<Address>(target),
                                    icache_flush_mode);
   if (write_barrier_mode == UPDATE_WRITE_BARRIER && host() != nullptr) {
-    host()->GetHeap()->incremental_marking()->RecordWriteIntoCode(
-        host(), this, HeapObject::cast(target));
-    host()->GetHeap()->RecordWriteIntoCode(host(), this, target);
+    heap->incremental_marking()->RecordWriteIntoCode(host(), this,
+                                                     HeapObject::cast(target));
+    heap->RecordWriteIntoCode(host(), this, target);
   }
 }
 
@@ -232,26 +235,19 @@ Address RelocInfo::target_internal_reference() {
     DCHECK(Assembler::IsLui(instr1));
     DCHECK(Assembler::IsOri(instr2) || Assembler::IsJicOrJialc(instr2));
     if (Assembler::IsJicOrJialc(instr2)) {
-      return reinterpret_cast<Address>(
+      return static_cast<Address>(
           Assembler::CreateTargetAddress(instr1, instr2));
     }
     int32_t imm = (instr1 & static_cast<int32_t>(kImm16Mask)) << kLuiShift;
     imm |= (instr2 & static_cast<int32_t>(kImm16Mask));
-    return reinterpret_cast<Address>(imm);
+    return static_cast<Address>(imm);
   }
 }
 
 
 Address RelocInfo::target_internal_reference_address() {
   DCHECK(rmode_ == INTERNAL_REFERENCE || rmode_ == INTERNAL_REFERENCE_ENCODED);
-  return reinterpret_cast<Address>(pc_);
-}
-
-void RelocInfo::set_wasm_code_table_entry(Address target,
-                                          ICacheFlushMode icache_flush_mode) {
-  DCHECK(rmode_ == RelocInfo::WASM_CODE_TABLE_ENTRY);
-  Assembler::set_target_address_at(pc_, constant_pool_, target,
-                                   icache_flush_mode);
+  return pc_;
 }
 
 Address RelocInfo::target_runtime_entry(Assembler* origin) {
@@ -277,11 +273,11 @@ void RelocInfo::WipeOut() {
          IsRuntimeEntry(rmode_) || IsExternalReference(rmode_) ||
          IsInternalReference(rmode_) || IsInternalReferenceEncoded(rmode_));
   if (IsInternalReference(rmode_)) {
-    Memory::Address_at(pc_) = nullptr;
+    Memory::Address_at(pc_) = kNullAddress;
   } else if (IsInternalReferenceEncoded(rmode_)) {
-    Assembler::set_target_internal_reference_encoded_at(pc_, nullptr);
+    Assembler::set_target_internal_reference_encoded_at(pc_, kNullAddress);
   } else {
-    Assembler::set_target_address_at(pc_, constant_pool_, nullptr);
+    Assembler::set_target_address_at(pc_, constant_pool_, kNullAddress);
   }
 }
 
@@ -290,7 +286,7 @@ void RelocInfo::Visit(ObjectVisitor* visitor) {
   RelocInfo::Mode mode = rmode();
   if (mode == RelocInfo::EMBEDDED_OBJECT) {
     visitor->VisitEmbeddedPointer(host(), this);
-  } else if (RelocInfo::IsCodeTarget(mode)) {
+  } else if (RelocInfo::IsCodeTargetMode(mode)) {
     visitor->VisitCodeTarget(host(), this);
   } else if (mode == RelocInfo::EXTERNAL_REFERENCE) {
     visitor->VisitExternalReference(host(), this);
diff --git a/deps/v8/src/mips/assembler-mips.cc b/deps/v8/src/mips/assembler-mips.cc
index 6365290f4cb8c8..7b4fcb12edc229 100644
--- a/deps/v8/src/mips/assembler-mips.cc
+++ b/deps/v8/src/mips/assembler-mips.cc
@@ -39,6 +39,7 @@
 #include "src/base/bits.h"
 #include "src/base/cpu.h"
 #include "src/code-stubs.h"
+#include "src/deoptimizer.h"
 #include "src/mips/assembler-mips-inl.h"
 
 namespace v8 {
@@ -183,8 +184,9 @@ Register ToRegister(int num) {
 // -----------------------------------------------------------------------------
 // Implementation of RelocInfo.
 
-const int RelocInfo::kApplyMask = 1 << RelocInfo::INTERNAL_REFERENCE |
-                                  1 << RelocInfo::INTERNAL_REFERENCE_ENCODED;
+const int RelocInfo::kApplyMask =
+    RelocInfo::ModeMask(RelocInfo::INTERNAL_REFERENCE) |
+    RelocInfo::ModeMask(RelocInfo::INTERNAL_REFERENCE_ENCODED);
 
 bool RelocInfo::IsCodedSpecially() {
   // The deserializer needs to know whether a pointer is specially coded.  Being
@@ -198,34 +200,27 @@ bool RelocInfo::IsInConstantPool() {
   return false;
 }
 
-Address RelocInfo::embedded_address() const {
-  return Assembler::target_address_at(pc_, constant_pool_);
-}
-
-uint32_t RelocInfo::embedded_size() const {
-  return reinterpret_cast<uint32_t>(
-      Assembler::target_address_at(pc_, constant_pool_));
-}
-
-void RelocInfo::set_embedded_address(Address address,
-                                     ICacheFlushMode flush_mode) {
-  Assembler::set_target_address_at(pc_, constant_pool_, address, flush_mode);
-}
-
-void RelocInfo::set_embedded_size(uint32_t size, ICacheFlushMode flush_mode) {
-  Assembler::set_target_address_at(pc_, constant_pool_,
-                                   reinterpret_cast<Address>(size), flush_mode);
+int RelocInfo::GetDeoptimizationId(Isolate* isolate, DeoptimizeKind kind) {
+  DCHECK(IsRuntimeEntry(rmode_));
+  return Deoptimizer::GetDeoptimizationId(isolate, target_address(), kind);
 }
 
 void RelocInfo::set_js_to_wasm_address(Address address,
                                        ICacheFlushMode icache_flush_mode) {
   DCHECK_EQ(rmode_, JS_TO_WASM_CALL);
-  set_embedded_address(address, icache_flush_mode);
+  Assembler::set_target_address_at(pc_, constant_pool_, address,
+                                   icache_flush_mode);
 }
 
 Address RelocInfo::js_to_wasm_address() const {
   DCHECK_EQ(rmode_, JS_TO_WASM_CALL);
-  return embedded_address();
+  return Assembler::target_address_at(pc_, constant_pool_);
+}
+
+uint32_t RelocInfo::wasm_call_tag() const {
+  DCHECK(rmode_ == WASM_CALL || rmode_ == WASM_STUB_CALL);
+  return static_cast<uint32_t>(
+      Assembler::target_address_at(pc_, constant_pool_));
 }
 
 // -----------------------------------------------------------------------------
@@ -234,7 +229,7 @@ Address RelocInfo::js_to_wasm_address() const {
 
 Operand::Operand(Handle<HeapObject> handle)
     : rm_(no_reg), rmode_(RelocInfo::EMBEDDED_OBJECT) {
-  value_.immediate = reinterpret_cast<intptr_t>(handle.address());
+  value_.immediate = static_cast<intptr_t>(handle.address());
 }
 
 Operand Operand::EmbeddedNumber(double value) {
@@ -268,15 +263,15 @@ void Assembler::AllocateAndInstallRequestedHeapObjects(Isolate* isolate) {
     Handle<HeapObject> object;
     switch (request.kind()) {
       case HeapObjectRequest::kHeapNumber:
-        object = isolate->factory()->NewHeapNumber(request.heap_number(),
-                                                   IMMUTABLE, TENURED);
+        object =
+            isolate->factory()->NewHeapNumber(request.heap_number(), TENURED);
         break;
       case HeapObjectRequest::kCodeStub:
         request.code_stub()->set_isolate(isolate);
         object = request.code_stub()->GetCode();
         break;
     }
-    Address pc = buffer_ + request.offset();
+    Address pc = reinterpret_cast<Address>(buffer_) + request.offset();
     set_target_value_at(pc, reinterpret_cast<uint32_t>(object.location()));
   }
 }
@@ -318,8 +313,9 @@ const Instr kLwSwInstrTypeMask = 0xFFE00000;
 const Instr kLwSwInstrArgumentMask  = ~kLwSwInstrTypeMask;
 const Instr kLwSwOffsetMask = kImm16Mask;
 
-Assembler::Assembler(IsolateData isolate_data, void* buffer, int buffer_size)
-    : AssemblerBase(isolate_data, buffer, buffer_size),
+Assembler::Assembler(const AssemblerOptions& options, void* buffer,
+                     int buffer_size)
+    : AssemblerBase(options, buffer, buffer_size),
       scratch_register_list_(at.bit()) {
   reloc_info_writer.Reposition(buffer_ + buffer_size_, pc_);
 
@@ -3035,15 +3031,19 @@ void Assembler::cmp_d(FPUCondition cond, FPURegister fd, FPURegister fs,
 
 void Assembler::bc1eqz(int16_t offset, FPURegister ft) {
   DCHECK(IsMipsArchVariant(kMips32r6));
+  BlockTrampolinePoolScope block_trampoline_pool(this);
   Instr instr = COP1 | BC1EQZ | ft.code() << kFtShift | (offset & kImm16Mask);
-  emit(instr, CompactBranchType::COMPACT_BRANCH);
+  emit(instr);
+  BlockTrampolinePoolFor(1);  // For associated delay slot.
 }
 
 
 void Assembler::bc1nez(int16_t offset, FPURegister ft) {
   DCHECK(IsMipsArchVariant(kMips32r6));
+  BlockTrampolinePoolScope block_trampoline_pool(this);
   Instr instr = COP1 | BC1NEZ | ft.code() << kFtShift | (offset & kImm16Mask);
-  emit(instr, CompactBranchType::COMPACT_BRANCH);
+  emit(instr);
+  BlockTrampolinePoolFor(1);  // For associated delay slot.
 }
 
 
@@ -3602,7 +3602,7 @@ MSA_BIT_LIST(MSA_BIT)
 #undef MSA_BIT_FORMAT
 #undef MSA_BIT_LIST
 
-int Assembler::RelocateInternalReference(RelocInfo::Mode rmode, byte* pc,
+int Assembler::RelocateInternalReference(RelocInfo::Mode rmode, Address pc,
                                          intptr_t pc_delta) {
   Instr instr = instr_at(pc);
 
@@ -3698,8 +3698,7 @@ void Assembler::GrowBuffer() {
     RelocInfo::Mode rmode = it.rinfo()->rmode();
     if (rmode == RelocInfo::INTERNAL_REFERENCE_ENCODED ||
         rmode == RelocInfo::INTERNAL_REFERENCE) {
-      byte* p = reinterpret_cast<byte*>(it.rinfo()->pc());
-      RelocateInternalReference(rmode, p, pc_delta);
+      RelocateInternalReference(rmode, it.rinfo()->pc(), pc_delta);
     }
   }
   DCHECK(!overflow());
@@ -3741,11 +3740,10 @@ void Assembler::dd(Label* label) {
 
 void Assembler::RecordRelocInfo(RelocInfo::Mode rmode, intptr_t data) {
   // We do not try to reuse pool constants.
-  RelocInfo rinfo(pc_, rmode, data, nullptr);
+  RelocInfo rinfo(reinterpret_cast<Address>(pc_), rmode, data, nullptr);
   if (!RelocInfo::IsNone(rinfo.rmode())) {
-    // Don't record external references unless the heap will be serialized.
-    if (rmode == RelocInfo::EXTERNAL_REFERENCE &&
-        !serializer_enabled() && !emit_debug_code()) {
+    if (RelocInfo::IsOnlyForSerializer(rmode) &&
+        !options().record_reloc_info_for_serialization && !emit_debug_code()) {
       return;
     }
     DCHECK_GE(buffer_space(), kMaxRelocSize);  // Too late to grow buffer here.
@@ -3753,7 +3751,6 @@ void Assembler::RecordRelocInfo(RelocInfo::Mode rmode, intptr_t data) {
   }
 }
 
-
 void Assembler::BlockTrampolinePoolFor(int instructions) {
   CheckTrampolinePoolQuick(instructions);
   BlockTrampolinePoolBefore(pc_offset() + instructions * kInstrSize);
@@ -3857,11 +3854,11 @@ Address Assembler::target_address_at(Address pc) {
   if (IsLui(instr1)) {
     if (IsOri(instr2)) {
       // Assemble the 32 bit value.
-      return reinterpret_cast<Address>((GetImmediate16(instr1) << kLuiShift) |
-                                       GetImmediate16(instr2));
+      return static_cast<Address>((GetImmediate16(instr1) << kLuiShift) |
+                                  GetImmediate16(instr2));
     } else if (IsJicOrJialc(instr2)) {
       // Assemble the 32 bit value.
-      return reinterpret_cast<Address>(CreateTargetAddress(instr1, instr2));
+      return static_cast<Address>(CreateTargetAddress(instr1, instr2));
     }
   }
 
diff --git a/deps/v8/src/mips/assembler-mips.h b/deps/v8/src/mips/assembler-mips.h
index dbb803bad26409..8a46b811f1b142 100644
--- a/deps/v8/src/mips/assembler-mips.h
+++ b/deps/v8/src/mips/assembler-mips.h
@@ -387,20 +387,21 @@ constexpr MSAControlRegister MSACSR = {kMSACSRRegister};
 class Operand BASE_EMBEDDED {
  public:
   // Immediate.
-  INLINE(explicit Operand(int32_t immediate,
-                          RelocInfo::Mode rmode = RelocInfo::NONE))
+  V8_INLINE explicit Operand(int32_t immediate,
+                             RelocInfo::Mode rmode = RelocInfo::NONE)
       : rm_(no_reg), rmode_(rmode) {
     value_.immediate = immediate;
   }
-  INLINE(explicit Operand(const ExternalReference& f))
+  V8_INLINE explicit Operand(const ExternalReference& f)
       : rm_(no_reg), rmode_(RelocInfo::EXTERNAL_REFERENCE) {
-    value_.immediate = reinterpret_cast<int32_t>(f.address());
+    value_.immediate = static_cast<int32_t>(f.address());
   }
-  INLINE(explicit Operand(const char* s));
-  INLINE(explicit Operand(Object** opp));
-  INLINE(explicit Operand(Context** cpp));
+  V8_INLINE explicit Operand(const char* s);
+  V8_INLINE explicit Operand(Object** opp);
+  V8_INLINE explicit Operand(Context** cpp);
   explicit Operand(Handle<HeapObject> handle);
-  INLINE(explicit Operand(Smi* value)) : rm_(no_reg), rmode_(RelocInfo::NONE) {
+  V8_INLINE explicit Operand(Smi* value)
+      : rm_(no_reg), rmode_(RelocInfo::NONE) {
     value_.immediate = reinterpret_cast<intptr_t>(value);
   }
 
@@ -408,10 +409,10 @@ class Operand BASE_EMBEDDED {
   static Operand EmbeddedCode(CodeStub* stub);
 
   // Register.
-  INLINE(explicit Operand(Register rm)) : rm_(rm) {}
+  V8_INLINE explicit Operand(Register rm) : rm_(rm) {}
 
   // Return true if this is a register operand.
-  INLINE(bool is_reg() const);
+  V8_INLINE bool is_reg() const;
 
   inline int32_t immediate() const;
 
@@ -491,9 +492,7 @@ class Assembler : public AssemblerBase {
   // buffer for code generation and assumes its size to be buffer_size. If the
   // buffer is too small, a fatal error occurs. No deallocation of the buffer is
   // done upon destruction of the assembler.
-  Assembler(Isolate* isolate, void* buffer, int buffer_size)
-      : Assembler(IsolateData(isolate), buffer, buffer_size) {}
-  Assembler(IsolateData isolate_data, void* buffer, int buffer_size);
+  Assembler(const AssemblerOptions& options, void* buffer, int buffer_size);
   virtual ~Assembler() { }
 
   // GetCode emits any pending (non-emitted) code and fills the descriptor
@@ -566,19 +565,19 @@ class Assembler : public AssemblerBase {
   // Read/Modify the code target address in the branch/call instruction at pc.
   // The isolate argument is unused (and may be nullptr) when skipping flushing.
   static Address target_address_at(Address pc);
-  INLINE(static void set_target_address_at)
-  (Address pc, Address target,
-   ICacheFlushMode icache_flush_mode = FLUSH_ICACHE_IF_NEEDED) {
-    set_target_value_at(pc, reinterpret_cast<uint32_t>(target),
-                        icache_flush_mode);
+  V8_INLINE static void set_target_address_at(
+      Address pc, Address target,
+      ICacheFlushMode icache_flush_mode = FLUSH_ICACHE_IF_NEEDED) {
+    set_target_value_at(pc, static_cast<uint32_t>(target), icache_flush_mode);
   }
   // On MIPS there is no Constant Pool so we skip that parameter.
-  INLINE(static Address target_address_at(Address pc, Address constant_pool)) {
+  V8_INLINE static Address target_address_at(Address pc,
+                                             Address constant_pool) {
     return target_address_at(pc);
   }
-  INLINE(static void set_target_address_at(
+  V8_INLINE static void set_target_address_at(
       Address pc, Address constant_pool, Address target,
-      ICacheFlushMode icache_flush_mode = FLUSH_ICACHE_IF_NEEDED)) {
+      ICacheFlushMode icache_flush_mode = FLUSH_ICACHE_IF_NEEDED) {
     set_target_address_at(pc, target, icache_flush_mode);
   }
 
@@ -598,6 +597,10 @@ class Assembler : public AssemblerBase {
   inline static void deserialization_set_special_target_at(
       Address instruction_payload, Code* code, Address target);
 
+  // Get the size of the special target encoded at 'instruction_payload'.
+  inline static int deserialization_special_target_size(
+      Address instruction_payload);
+
   // This sets the internal reference at the pc.
   inline static void deserialization_set_target_internal_reference_at(
       Address pc, Address target,
@@ -1717,7 +1720,7 @@ class Assembler : public AssemblerBase {
   void RecordDeoptReason(DeoptimizeReason reason, SourcePosition position,
                          int id);
 
-  static int RelocateInternalReference(RelocInfo::Mode rmode, byte* pc,
+  static int RelocateInternalReference(RelocInfo::Mode rmode, Address pc,
                                        intptr_t pc_delta);
 
   // Writes a single byte or word of data in the code stream.  Used for
@@ -1741,8 +1744,8 @@ class Assembler : public AssemblerBase {
   inline int available_space() const { return reloc_info_writer.pos() - pc_; }
 
   // Read/patch instructions.
-  static Instr instr_at(byte* pc) { return *reinterpret_cast<Instr*>(pc); }
-  static void instr_at_put(byte* pc, Instr instr) {
+  static Instr instr_at(Address pc) { return *reinterpret_cast<Instr*>(pc); }
+  static void instr_at_put(Address pc, Instr instr) {
     *reinterpret_cast<Instr*>(pc) = instr;
   }
   Instr instr_at(int pos) { return *reinterpret_cast<Instr*>(buffer_ + pos); }
@@ -2183,23 +2186,9 @@ class Assembler : public AssemblerBase {
   Trampoline trampoline_;
   bool internal_trampoline_exception_;
 
-  // The following functions help with avoiding allocations of embedded heap
-  // objects during the code assembly phase. {RequestHeapObject} records the
-  // need for a future heap number allocation or code stub generation. After
-  // code assembly, {AllocateAndInstallRequestedHeapObjects} will allocate these
-  // objects and place them where they are expected (determined by the pc offset
-  // associated with each request). That is, for each request, it will patch the
-  // dummy heap object handle that we emitted during code assembly with the
-  // actual heap object handle.
- protected:
-  // TODO(neis): Make private if its use can be moved out of TurboAssembler.
-  void RequestHeapObject(HeapObjectRequest request);
-
  private:
   void AllocateAndInstallRequestedHeapObjects(Isolate* isolate);
 
-  std::forward_list<HeapObjectRequest> heap_object_requests_;
-
   friend class RegExpMacroAssemblerMIPS;
   friend class RelocInfo;
   friend class BlockTrampolinePoolScope;
diff --git a/deps/v8/src/mips/code-stubs-mips.cc b/deps/v8/src/mips/code-stubs-mips.cc
index eb39e5895945ba..8fc1c35cc72583 100644
--- a/deps/v8/src/mips/code-stubs-mips.cc
+++ b/deps/v8/src/mips/code-stubs-mips.cc
@@ -14,6 +14,7 @@
 #include "src/ic/ic.h"
 #include "src/ic/stub-cache.h"
 #include "src/isolate.h"
+#include "src/objects/api-callbacks.h"
 #include "src/regexp/jsregexp.h"
 #include "src/regexp/regexp-macro-assembler.h"
 #include "src/runtime/runtime.h"
@@ -25,472 +26,40 @@ namespace internal {
 
 #define __ ACCESS_MASM(masm)
 
-void ArrayNArgumentsConstructorStub::Generate(MacroAssembler* masm) {
-  __ sll(t9, a0, kPointerSizeLog2);
-  __ Addu(t9, sp, t9);
-  __ sw(a1, MemOperand(t9, 0));
-  __ Push(a1);
-  __ Push(a2);
-  __ Addu(a0, a0, Operand(3));
-  __ TailCallRuntime(Runtime::kNewArray);
-}
-
-
-void DoubleToIStub::Generate(MacroAssembler* masm) {
-  Label out_of_range, only_low, negate, done;
-  Register result_reg = destination();
-
-  Register scratch = GetRegisterThatIsNotOneOf(result_reg);
-  Register scratch2 = GetRegisterThatIsNotOneOf(result_reg, scratch);
-  Register scratch3 = GetRegisterThatIsNotOneOf(result_reg, scratch, scratch2);
-  DoubleRegister double_scratch = kScratchDoubleReg;
-
-  // Account for saved regs.
-  const int kArgumentOffset = 3 * kPointerSize;
-
-  __ Push(scratch, scratch2, scratch3);
-
-  // Load double input.
-  __ Ldc1(double_scratch, MemOperand(sp, kArgumentOffset));
-
-  // Clear cumulative exception flags and save the FCSR.
-  __ cfc1(scratch2, FCSR);
-  __ ctc1(zero_reg, FCSR);
-
-  // Try a conversion to a signed integer.
-  __ Trunc_w_d(double_scratch, double_scratch);
-  // Move the converted value into the result register.
-  __ mfc1(scratch3, double_scratch);
-
-  // Retrieve and restore the FCSR.
-  __ cfc1(scratch, FCSR);
-  __ ctc1(scratch2, FCSR);
-
-  // Check for overflow and NaNs.
-  __ And(
-      scratch, scratch,
-      kFCSROverflowFlagMask | kFCSRUnderflowFlagMask | kFCSRInvalidOpFlagMask);
-  // If we had no exceptions then set result_reg and we are done.
-  Label error;
-  __ Branch(&error, ne, scratch, Operand(zero_reg));
-  __ Move(result_reg, scratch3);
-  __ Branch(&done);
-  __ bind(&error);
-
-  // Load the double value and perform a manual truncation.
-  Register input_high = scratch2;
-  Register input_low = scratch3;
-
-  __ lw(input_low, MemOperand(sp, kArgumentOffset + Register::kMantissaOffset));
-  __ lw(input_high,
-        MemOperand(sp, kArgumentOffset + Register::kExponentOffset));
-
-  Label normal_exponent, restore_sign;
-  // Extract the biased exponent in result.
-  __ Ext(result_reg,
-         input_high,
-         HeapNumber::kExponentShift,
-         HeapNumber::kExponentBits);
-
-  // Check for Infinity and NaNs, which should return 0.
-  __ Subu(scratch, result_reg, HeapNumber::kExponentMask);
-  __ Movz(result_reg, zero_reg, scratch);
-  __ Branch(&done, eq, scratch, Operand(zero_reg));
-
-  // Express exponent as delta to (number of mantissa bits + 31).
-  __ Subu(result_reg,
-          result_reg,
-          Operand(HeapNumber::kExponentBias + HeapNumber::kMantissaBits + 31));
-
-  // If the delta is strictly positive, all bits would be shifted away,
-  // which means that we can return 0.
-  __ Branch(&normal_exponent, le, result_reg, Operand(zero_reg));
-  __ mov(result_reg, zero_reg);
-  __ Branch(&done);
-
-  __ bind(&normal_exponent);
-  const int kShiftBase = HeapNumber::kNonMantissaBitsInTopWord - 1;
-  // Calculate shift.
-  __ Addu(scratch, result_reg, Operand(kShiftBase + HeapNumber::kMantissaBits));
-
-  // Save the sign.
-  Register sign = result_reg;
-  result_reg = no_reg;
-  __ And(sign, input_high, Operand(HeapNumber::kSignMask));
-
-  // On ARM shifts > 31 bits are valid and will result in zero. On MIPS we need
-  // to check for this specific case.
-  Label high_shift_needed, high_shift_done;
-  __ Branch(&high_shift_needed, lt, scratch, Operand(32));
-  __ mov(input_high, zero_reg);
-  __ Branch(&high_shift_done);
-  __ bind(&high_shift_needed);
-
-  // Set the implicit 1 before the mantissa part in input_high.
-  __ Or(input_high,
-        input_high,
-        Operand(1 << HeapNumber::kMantissaBitsInTopWord));
-  // Shift the mantissa bits to the correct position.
-  // We don't need to clear non-mantissa bits as they will be shifted away.
-  // If they weren't, it would mean that the answer is in the 32bit range.
-  __ sllv(input_high, input_high, scratch);
-
-  __ bind(&high_shift_done);
-
-  // Replace the shifted bits with bits from the lower mantissa word.
-  Label pos_shift, shift_done;
-  __ li(at, 32);
-  __ subu(scratch, at, scratch);
-  __ Branch(&pos_shift, ge, scratch, Operand(zero_reg));
-
-  // Negate scratch.
-  __ Subu(scratch, zero_reg, scratch);
-  __ sllv(input_low, input_low, scratch);
-  __ Branch(&shift_done);
-
-  __ bind(&pos_shift);
-  __ srlv(input_low, input_low, scratch);
-
-  __ bind(&shift_done);
-  __ Or(input_high, input_high, Operand(input_low));
-  // Restore sign if necessary.
-  __ mov(scratch, sign);
-  result_reg = sign;
-  sign = no_reg;
-  __ Subu(result_reg, zero_reg, input_high);
-  __ Movz(result_reg, input_high, scratch);
-
-  __ bind(&done);
-
-  __ Pop(scratch, scratch2, scratch3);
-  __ Ret();
-}
-
-
-void MathPowStub::Generate(MacroAssembler* masm) {
-  const Register exponent = MathPowTaggedDescriptor::exponent();
-  DCHECK(exponent == a2);
-  const DoubleRegister double_base = f2;
-  const DoubleRegister double_exponent = f4;
-  const DoubleRegister double_result = f0;
-  const DoubleRegister double_scratch = f6;
-  const FPURegister single_scratch = f8;
-  const Register scratch = t5;
-  const Register scratch2 = t3;
-
-  Label call_runtime, done, int_exponent;
-
-  Label int_exponent_convert;
-  // Detect integer exponents stored as double.
-  __ EmitFPUTruncate(kRoundToMinusInf, scratch, double_exponent, at,
-                     double_scratch, scratch2, kCheckForInexactConversion);
-  // scratch2 == 0 means there was no conversion error.
-  __ Branch(&int_exponent_convert, eq, scratch2, Operand(zero_reg));
-
-  __ push(ra);
-  {
-    AllowExternalCallThatCantCauseGC scope(masm);
-    __ PrepareCallCFunction(0, 2, scratch2);
-    __ MovToFloatParameters(double_base, double_exponent);
-    __ CallCFunction(ExternalReference::power_double_double_function(isolate()),
-                     0, 2);
-  }
-  __ pop(ra);
-  __ MovFromFloatResult(double_result);
-  __ jmp(&done);
-
-  __ bind(&int_exponent_convert);
-
-  // Calculate power with integer exponent.
-  __ bind(&int_exponent);
-
-  // Get two copies of exponent in the registers scratch and exponent.
-  // Exponent has previously been stored into scratch as untagged integer.
-  __ mov(exponent, scratch);
-
-  __ mov_d(double_scratch, double_base);  // Back up base.
-  __ Move(double_result, 1.0);
-
-  // Get absolute value of exponent.
-  Label positive_exponent, bail_out;
-  __ Branch(&positive_exponent, ge, scratch, Operand(zero_reg));
-  __ Subu(scratch, zero_reg, scratch);
-  // Check when Subu overflows and we get negative result
-  // (happens only when input is MIN_INT).
-  __ Branch(&bail_out, gt, zero_reg, Operand(scratch));
-  __ bind(&positive_exponent);
-  __ Assert(ge, AbortReason::kUnexpectedNegativeValue, scratch,
-            Operand(zero_reg));
-
-  Label while_true, no_carry, loop_end;
-  __ bind(&while_true);
-
-  __ And(scratch2, scratch, 1);
-
-  __ Branch(&no_carry, eq, scratch2, Operand(zero_reg));
-  __ mul_d(double_result, double_result, double_scratch);
-  __ bind(&no_carry);
-
-  __ sra(scratch, scratch, 1);
-
-  __ Branch(&loop_end, eq, scratch, Operand(zero_reg));
-  __ mul_d(double_scratch, double_scratch, double_scratch);
-
-  __ Branch(&while_true);
-
-  __ bind(&loop_end);
-
-  __ Branch(&done, ge, exponent, Operand(zero_reg));
-  __ Move(double_scratch, 1.0);
-  __ div_d(double_result, double_scratch, double_result);
-  // Test whether result is zero.  Bail out to check for subnormal result.
-  // Due to subnormals, x^-y == (1/x)^y does not hold in all cases.
-  __ CompareF64(EQ, double_result, kDoubleRegZero);
-  __ BranchFalseShortF(&done);
-
-  // double_exponent may not contain the exponent value if the input was a
-  // smi.  We set it with exponent value before bailing out.
-  __ bind(&bail_out);
-  __ mtc1(exponent, single_scratch);
-  __ cvt_d_w(double_exponent, single_scratch);
-
-  // Returning or bailing out.
-  __ push(ra);
-  {
-    AllowExternalCallThatCantCauseGC scope(masm);
-    __ PrepareCallCFunction(0, 2, scratch);
-    __ MovToFloatParameters(double_base, double_exponent);
-    __ CallCFunction(ExternalReference::power_double_double_function(isolate()),
-                     0, 2);
-  }
-  __ pop(ra);
-  __ MovFromFloatResult(double_result);
-
-  __ bind(&done);
-  __ Ret();
-}
-
-Movability CEntryStub::NeedsImmovableCode() { return kImmovable; }
-
-void CodeStub::GenerateStubsAheadOfTime(Isolate* isolate) {
-  CEntryStub::GenerateAheadOfTime(isolate);
-  CommonArrayConstructorStub::GenerateStubsAheadOfTime(isolate);
-  StoreFastElementStub::GenerateAheadOfTime(isolate);
-}
-
-
-void CodeStub::GenerateFPStubs(Isolate* isolate) {
-  // Generate if not already in cache.
-  SaveFPRegsMode mode = kSaveFPRegs;
-  CEntryStub(isolate, 1, mode).GetCode();
-}
-
-
-void CEntryStub::GenerateAheadOfTime(Isolate* isolate) {
-  CEntryStub stub(isolate, 1, kDontSaveFPRegs);
-  stub.GetCode();
-  CEntryStub save_doubles(isolate, 1, kSaveFPRegs);
-  save_doubles.GetCode();
-}
-
-
-void CEntryStub::Generate(MacroAssembler* masm) {
-  // Called from JavaScript; parameters are on stack as if calling JS function
-  // a0: number of arguments including receiver
-  // a1: pointer to builtin function
-  // fp: frame pointer    (restored after C call)
-  // sp: stack pointer    (restored as callee's sp after C call)
-  // cp: current context  (C callee-saved)
-  //
-  // If argv_in_register():
-  // a2: pointer to the first argument
-
-  ProfileEntryHookStub::MaybeCallEntryHook(masm);
-
-  if (argv_in_register()) {
-    // Move argv into the correct register.
-    __ mov(s1, a2);
-  } else {
-    // Compute the argv pointer in a callee-saved register.
-    __ Lsa(s1, sp, a0, kPointerSizeLog2);
-    __ Subu(s1, s1, kPointerSize);
-  }
-
-  // Enter the exit frame that transitions from JavaScript to C++.
-  FrameScope scope(masm, StackFrame::MANUAL);
-  __ EnterExitFrame(save_doubles(), 0, is_builtin_exit()
-                                           ? StackFrame::BUILTIN_EXIT
-                                           : StackFrame::EXIT);
-
-  // s0: number of arguments  including receiver (C callee-saved)
-  // s1: pointer to first argument (C callee-saved)
-  // s2: pointer to builtin function (C callee-saved)
-
-  // Prepare arguments for C routine.
-  // a0 = argc
-  __ mov(s0, a0);
-  __ mov(s2, a1);
-
-  // We are calling compiled C/C++ code. a0 and a1 hold our two arguments. We
-  // also need to reserve the 4 argument slots on the stack.
-
-  __ AssertStackIsAligned();
-
-  // a0 = argc, a1 = argv, a2 = isolate
-  __ li(a2, Operand(ExternalReference::isolate_address(isolate())));
-  __ mov(a1, s1);
-
-  // To let the GC traverse the return address of the exit frames, we need to
-  // know where the return address is. The CEntryStub is unmovable, so
-  // we can store the address on the stack to be able to find it again and
-  // we never have to restore it, because it will not change.
-  { Assembler::BlockTrampolinePoolScope block_trampoline_pool(masm);
-    int kNumInstructionsToJump = 4;
-    Label find_ra;
-    // Adjust the value in ra to point to the correct return location, 2nd
-    // instruction past the real call into C code (the jalr(t9)), and push it.
-    // This is the return address of the exit frame.
-    if (kArchVariant >= kMips32r6) {
-      __ addiupc(ra, kNumInstructionsToJump + 1);
-    } else {
-      // This branch-and-link sequence is needed to find the current PC on mips
-      // before r6, saved to the ra register.
-      __ bal(&find_ra);  // bal exposes branch delay slot.
-      __ Addu(ra, ra, kNumInstructionsToJump * Instruction::kInstrSize);
-    }
-    __ bind(&find_ra);
-
-    // This spot was reserved in EnterExitFrame.
-    __ sw(ra, MemOperand(sp));
-    // Stack space reservation moved to the branch delay slot below.
-    // Stack is still aligned.
-
-    // Call the C routine.
-    __ mov(t9, s2);  // Function pointer to t9 to conform to ABI for PIC.
-    __ jalr(t9);
-    // Set up sp in the delay slot.
-    __ addiu(sp, sp, -kCArgsSlotsSize);
-    // Make sure the stored 'ra' points to this position.
-    DCHECK_EQ(kNumInstructionsToJump,
-              masm->InstructionsGeneratedSince(&find_ra));
-  }
-
-  // Result returned in v0 or v1:v0 - do not destroy these registers!
-
-  // Check result for exception sentinel.
-  Label exception_returned;
-  __ LoadRoot(t0, Heap::kExceptionRootIndex);
-  __ Branch(&exception_returned, eq, t0, Operand(v0));
-
-  // Check that there is no pending exception, otherwise we
-  // should have returned the exception sentinel.
-  if (FLAG_debug_code) {
-    Label okay;
-    ExternalReference pending_exception_address(
-        IsolateAddressId::kPendingExceptionAddress, isolate());
-    __ li(a2, Operand(pending_exception_address));
-    __ lw(a2, MemOperand(a2));
-    __ LoadRoot(t0, Heap::kTheHoleValueRootIndex);
-    // Cannot use check here as it attempts to generate call into runtime.
-    __ Branch(&okay, eq, t0, Operand(a2));
-    __ stop("Unexpected pending exception");
-    __ bind(&okay);
-  }
-
-  // Exit C frame and return.
-  // v0:v1: result
-  // sp: stack pointer
-  // fp: frame pointer
-  Register argc = argv_in_register()
-                      // We don't want to pop arguments so set argc to no_reg.
-                      ? no_reg
-                      // s0: still holds argc (callee-saved).
-                      : s0;
-  __ LeaveExitFrame(save_doubles(), argc, EMIT_RETURN);
-
-  // Handling of exception.
-  __ bind(&exception_returned);
-
-  ExternalReference pending_handler_context_address(
-      IsolateAddressId::kPendingHandlerContextAddress, isolate());
-  ExternalReference pending_handler_entrypoint_address(
-      IsolateAddressId::kPendingHandlerEntrypointAddress, isolate());
-  ExternalReference pending_handler_fp_address(
-      IsolateAddressId::kPendingHandlerFPAddress, isolate());
-  ExternalReference pending_handler_sp_address(
-      IsolateAddressId::kPendingHandlerSPAddress, isolate());
-
-  // Ask the runtime for help to determine the handler. This will set v0 to
-  // contain the current pending exception, don't clobber it.
-  ExternalReference find_handler(Runtime::kUnwindAndFindExceptionHandler,
-                                 isolate());
-  {
-    FrameScope scope(masm, StackFrame::MANUAL);
-    __ PrepareCallCFunction(3, 0, a0);
-    __ mov(a0, zero_reg);
-    __ mov(a1, zero_reg);
-    __ li(a2, Operand(ExternalReference::isolate_address(isolate())));
-    __ CallCFunction(find_handler, 3);
-  }
-
-  // Retrieve the handler context, SP and FP.
-  __ li(cp, Operand(pending_handler_context_address));
-  __ lw(cp, MemOperand(cp));
-  __ li(sp, Operand(pending_handler_sp_address));
-  __ lw(sp, MemOperand(sp));
-  __ li(fp, Operand(pending_handler_fp_address));
-  __ lw(fp, MemOperand(fp));
-
-  // If the handler is a JS frame, restore the context to the frame. Note that
-  // the context will be set to (cp == 0) for non-JS frames.
-  Label zero;
-  __ Branch(&zero, eq, cp, Operand(zero_reg));
-  __ sw(cp, MemOperand(fp, StandardFrameConstants::kContextOffset));
-  __ bind(&zero);
-
-  // Reset the masking register. This is done independent of the underlying
-  // feature flag {FLAG_branch_load_poisoning} to make the snapshot work with
-  // both configurations. It is safe to always do this, because the underlying
-  // register is caller-saved and can be arbitrarily clobbered.
-  __ ResetSpeculationPoisonRegister();
-
-  // Compute the handler entry address and jump to it.
-  __ li(t9, Operand(pending_handler_entrypoint_address));
-  __ lw(t9, MemOperand(t9));
-  __ Jump(t9);
-}
-
-
 void JSEntryStub::Generate(MacroAssembler* masm) {
   Label invoke, handler_entry, exit;
   Isolate* isolate = masm->isolate();
 
-  // Registers:
-  // a0: entry address
-  // a1: function
-  // a2: receiver
-  // a3: argc
-  //
-  // Stack:
-  // 4 args slots
-  // args
+  {
+    NoRootArrayScope no_root_array(masm);
 
-  ProfileEntryHookStub::MaybeCallEntryHook(masm);
+    // Registers:
+    // a0: entry address
+    // a1: function
+    // a2: receiver
+    // a3: argc
+    //
+    // Stack:
+    // 4 args slots
+    // args
 
-  // Save callee saved registers on the stack.
-  __ MultiPush(kCalleeSaved | ra.bit());
+    ProfileEntryHookStub::MaybeCallEntryHook(masm);
 
-  // Save callee-saved FPU registers.
-  __ MultiPushFPU(kCalleeSavedFPU);
-  // Set up the reserved register for 0.0.
-  __ Move(kDoubleRegZero, 0.0);
+    // Save callee saved registers on the stack.
+    __ MultiPush(kCalleeSaved | ra.bit());
 
+    // Save callee-saved FPU registers.
+    __ MultiPushFPU(kCalleeSavedFPU);
+    // Set up the reserved register for 0.0.
+    __ Move(kDoubleRegZero, 0.0);
+
+    __ InitializeRootRegister();
+  }
 
   // Load argv in s0 register.
   int offset_to_argv = (kNumCalleeSaved + 1) * kPointerSize;
   offset_to_argv += kNumCalleeSavedFPU * kDoubleSize;
 
-  __ InitializeRootRegister();
   __ lw(s0, MemOperand(sp, offset_to_argv + kCArgsSlotsSize));
 
   // We build an EntryFrame.
@@ -498,8 +67,8 @@ void JSEntryStub::Generate(MacroAssembler* masm) {
   StackFrame::Type marker = type();
   __ li(t2, Operand(StackFrame::TypeToMarker(marker)));
   __ li(t1, Operand(StackFrame::TypeToMarker(marker)));
-  __ li(t0, Operand(ExternalReference(IsolateAddressId::kCEntryFPAddress,
-                                      isolate)));
+  __ li(t0,
+        ExternalReference::Create(IsolateAddressId::kCEntryFPAddress, isolate));
   __ lw(t0, MemOperand(t0));
   __ Push(t3, t2, t1, t0);
   // Set up frame pointer for the frame to be pushed.
@@ -523,8 +92,9 @@ void JSEntryStub::Generate(MacroAssembler* masm) {
 
   // If this is the outermost JS call, set js_entry_sp value.
   Label non_outermost_js;
-  ExternalReference js_entry_sp(IsolateAddressId::kJSEntrySPAddress, isolate);
-  __ li(t1, Operand(ExternalReference(js_entry_sp)));
+  ExternalReference js_entry_sp =
+      ExternalReference::Create(IsolateAddressId::kJSEntrySPAddress, isolate);
+  __ li(t1, js_entry_sp);
   __ lw(t2, MemOperand(t1));
   __ Branch(&non_outermost_js, ne, t2, Operand(zero_reg));
   __ sw(fp, MemOperand(t1));
@@ -546,8 +116,8 @@ void JSEntryStub::Generate(MacroAssembler* masm) {
   // field in the JSEnv and return a failure sentinel.  Coming in here the
   // fp will be invalid because the PushStackHandler below sets it to 0 to
   // signal the existence of the JSEntry frame.
-  __ li(t0, Operand(ExternalReference(
-                IsolateAddressId::kPendingExceptionAddress, isolate)));
+  __ li(t0, ExternalReference::Create(
+                IsolateAddressId::kPendingExceptionAddress, isolate));
   __ sw(v0, MemOperand(t0));  // We come back from 'invoke'. result is in v0.
   __ LoadRoot(v0, Heap::kExceptionRootIndex);
   __ b(&exit);  // b exposes branch delay slot.
@@ -589,14 +159,14 @@ void JSEntryStub::Generate(MacroAssembler* masm) {
   __ pop(t1);
   __ Branch(&non_outermost_js_2, ne, t1,
             Operand(StackFrame::OUTERMOST_JSENTRY_FRAME));
-  __ li(t1, Operand(ExternalReference(js_entry_sp)));
+  __ li(t1, ExternalReference(js_entry_sp));
   __ sw(zero_reg, MemOperand(t1));
   __ bind(&non_outermost_js_2);
 
   // Restore the top frame descriptors from the stack.
   __ pop(t1);
-  __ li(t0, Operand(ExternalReference(IsolateAddressId::kCEntryFPAddress,
-                                      isolate)));
+  __ li(t0,
+        ExternalReference::Create(IsolateAddressId::kCEntryFPAddress, isolate));
   __ sw(t1, MemOperand(t0));
 
   // Reset the stack to the callee saved registers.
@@ -638,11 +208,22 @@ void DirectCEntryStub::Generate(MacroAssembler* masm) {
 
 void DirectCEntryStub::GenerateCall(MacroAssembler* masm,
                                     Register target) {
+  if (FLAG_embedded_builtins) {
+    if (masm->root_array_available() &&
+        isolate()->ShouldLoadConstantsFromRootList()) {
+      // This is basically an inlined version of Call(Handle<Code>) that loads
+      // the code object into kScratchReg instead of t9.
+      __ Move(t9, target);
+      __ IndirectLoadConstant(kScratchReg, GetCode());
+      __ Call(kScratchReg, Code::kHeaderSize - kHeapObjectTag);
+      return;
+    }
+  }
   intptr_t loc =
       reinterpret_cast<intptr_t>(GetCode().location());
   __ Move(t9, target);
-  __ li(at, Operand(loc, RelocInfo::CODE_TARGET), CONSTANT_SIZE);
-  __ Call(at);
+  __ li(kScratchReg, Operand(loc, RelocInfo::CODE_TARGET), CONSTANT_SIZE);
+  __ Call(kScratchReg);
 }
 
 
@@ -705,12 +286,11 @@ void ProfileEntryHookStub::Generate(MacroAssembler* masm) {
   // Under the simulator we need to indirect the entry hook through a
   // trampoline function at a known address.
   // It additionally takes an isolate as a third parameter.
-  __ li(a2, Operand(ExternalReference::isolate_address(isolate())));
+  __ li(a2, ExternalReference::isolate_address(isolate()));
 
   ApiFunction dispatcher(FUNCTION_ADDR(EntryHookTrampoline));
-  __ li(t9, Operand(ExternalReference(&dispatcher,
-                                      ExternalReference::BUILTIN_CALL,
-                                      isolate())));
+  __ li(t9, ExternalReference::Create(&dispatcher,
+                                      ExternalReference::BUILTIN_CALL));
 #endif
   // Call C function through t9 to conform ABI for PIC.
   __ Call(t9);
@@ -727,279 +307,6 @@ void ProfileEntryHookStub::Generate(MacroAssembler* masm) {
   __ Ret();
 }
 
-
-template<class T>
-static void CreateArrayDispatch(MacroAssembler* masm,
-                                AllocationSiteOverrideMode mode) {
-  if (mode == DISABLE_ALLOCATION_SITES) {
-    T stub(masm->isolate(), GetInitialFastElementsKind(), mode);
-    __ TailCallStub(&stub);
-  } else if (mode == DONT_OVERRIDE) {
-    int last_index =
-        GetSequenceIndexFromFastElementsKind(TERMINAL_FAST_ELEMENTS_KIND);
-    for (int i = 0; i <= last_index; ++i) {
-      ElementsKind kind = GetFastElementsKindFromSequenceIndex(i);
-      T stub(masm->isolate(), kind);
-      __ TailCallStub(&stub, eq, a3, Operand(kind));
-    }
-
-    // If we reached this point there is a problem.
-    __ Abort(AbortReason::kUnexpectedElementsKindInArrayConstructor);
-  } else {
-    UNREACHABLE();
-  }
-}
-
-
-static void CreateArrayDispatchOneArgument(MacroAssembler* masm,
-                                           AllocationSiteOverrideMode mode) {
-  // a2 - allocation site (if mode != DISABLE_ALLOCATION_SITES)
-  // a3 - kind (if mode != DISABLE_ALLOCATION_SITES)
-  // a0 - number of arguments
-  // a1 - constructor?
-  // sp[0] - last argument
-    STATIC_ASSERT(PACKED_SMI_ELEMENTS == 0);
-    STATIC_ASSERT(HOLEY_SMI_ELEMENTS == 1);
-    STATIC_ASSERT(PACKED_ELEMENTS == 2);
-    STATIC_ASSERT(HOLEY_ELEMENTS == 3);
-    STATIC_ASSERT(PACKED_DOUBLE_ELEMENTS == 4);
-    STATIC_ASSERT(HOLEY_DOUBLE_ELEMENTS == 5);
-
-  if (mode == DISABLE_ALLOCATION_SITES) {
-    ElementsKind initial = GetInitialFastElementsKind();
-    ElementsKind holey_initial = GetHoleyElementsKind(initial);
-
-    ArraySingleArgumentConstructorStub stub_holey(masm->isolate(),
-                                                  holey_initial,
-                                                  DISABLE_ALLOCATION_SITES);
-    __ TailCallStub(&stub_holey);
-  } else if (mode == DONT_OVERRIDE) {
-    // is the low bit set? If so, we are holey and that is good.
-    Label normal_sequence;
-    __ And(at, a3, Operand(1));
-    __ Branch(&normal_sequence, ne, at, Operand(zero_reg));
-
-    // We are going to create a holey array, but our kind is non-holey.
-    // Fix kind and retry (only if we have an allocation site in the slot).
-    __ Addu(a3, a3, Operand(1));
-
-    if (FLAG_debug_code) {
-      __ lw(t1, FieldMemOperand(a2, 0));
-      __ LoadRoot(at, Heap::kAllocationSiteMapRootIndex);
-      __ Assert(eq, AbortReason::kExpectedAllocationSite, t1, Operand(at));
-    }
-
-    // Save the resulting elements kind in type info. We can't just store a3
-    // in the AllocationSite::transition_info field because elements kind is
-    // restricted to a portion of the field...upper bits need to be left alone.
-    STATIC_ASSERT(AllocationSite::ElementsKindBits::kShift == 0);
-    __ lw(t0, FieldMemOperand(
-                  a2, AllocationSite::kTransitionInfoOrBoilerplateOffset));
-    __ Addu(t0, t0, Operand(Smi::FromInt(kFastElementsKindPackedToHoley)));
-    __ sw(t0, FieldMemOperand(
-                  a2, AllocationSite::kTransitionInfoOrBoilerplateOffset));
-
-    __ bind(&normal_sequence);
-    int last_index =
-        GetSequenceIndexFromFastElementsKind(TERMINAL_FAST_ELEMENTS_KIND);
-    for (int i = 0; i <= last_index; ++i) {
-      ElementsKind kind = GetFastElementsKindFromSequenceIndex(i);
-      ArraySingleArgumentConstructorStub stub(masm->isolate(), kind);
-      __ TailCallStub(&stub, eq, a3, Operand(kind));
-    }
-
-    // If we reached this point there is a problem.
-    __ Abort(AbortReason::kUnexpectedElementsKindInArrayConstructor);
-  } else {
-    UNREACHABLE();
-  }
-}
-
-
-template<class T>
-static void ArrayConstructorStubAheadOfTimeHelper(Isolate* isolate) {
-  int to_index =
-      GetSequenceIndexFromFastElementsKind(TERMINAL_FAST_ELEMENTS_KIND);
-  for (int i = 0; i <= to_index; ++i) {
-    ElementsKind kind = GetFastElementsKindFromSequenceIndex(i);
-    T stub(isolate, kind);
-    stub.GetCode();
-    if (AllocationSite::ShouldTrack(kind)) {
-      T stub1(isolate, kind, DISABLE_ALLOCATION_SITES);
-      stub1.GetCode();
-    }
-  }
-}
-
-void CommonArrayConstructorStub::GenerateStubsAheadOfTime(Isolate* isolate) {
-  ArrayConstructorStubAheadOfTimeHelper<ArrayNoArgumentConstructorStub>(
-      isolate);
-  ArrayConstructorStubAheadOfTimeHelper<ArraySingleArgumentConstructorStub>(
-      isolate);
-  ArrayNArgumentsConstructorStub stub(isolate);
-  stub.GetCode();
-  ElementsKind kinds[2] = {PACKED_ELEMENTS, HOLEY_ELEMENTS};
-  for (int i = 0; i < 2; i++) {
-    // For internal arrays we only need a few things.
-    InternalArrayNoArgumentConstructorStub stubh1(isolate, kinds[i]);
-    stubh1.GetCode();
-    InternalArraySingleArgumentConstructorStub stubh2(isolate, kinds[i]);
-    stubh2.GetCode();
-  }
-}
-
-
-void ArrayConstructorStub::GenerateDispatchToArrayStub(
-    MacroAssembler* masm,
-    AllocationSiteOverrideMode mode) {
-  Label not_zero_case, not_one_case;
-  __ And(at, a0, a0);
-  __ Branch(&not_zero_case, ne, at, Operand(zero_reg));
-  CreateArrayDispatch<ArrayNoArgumentConstructorStub>(masm, mode);
-
-  __ bind(&not_zero_case);
-  __ Branch(&not_one_case, gt, a0, Operand(1));
-  CreateArrayDispatchOneArgument(masm, mode);
-
-  __ bind(&not_one_case);
-  ArrayNArgumentsConstructorStub stub(masm->isolate());
-  __ TailCallStub(&stub);
-}
-
-
-void ArrayConstructorStub::Generate(MacroAssembler* masm) {
-  // ----------- S t a t e -------------
-  //  -- a0 : argc (only if argument_count() is ANY or MORE_THAN_ONE)
-  //  -- a1 : constructor
-  //  -- a2 : AllocationSite or undefined
-  //  -- a3 : Original constructor
-  //  -- sp[0] : last argument
-  // -----------------------------------
-
-  if (FLAG_debug_code) {
-    // The array construct code is only set for the global and natives
-    // builtin Array functions which always have maps.
-
-    // Initial map for the builtin Array function should be a map.
-    __ lw(t0, FieldMemOperand(a1, JSFunction::kPrototypeOrInitialMapOffset));
-    // Will both indicate a nullptr and a Smi.
-    __ SmiTst(t0, at);
-    __ Assert(ne, AbortReason::kUnexpectedInitialMapForArrayFunction, at,
-              Operand(zero_reg));
-    __ GetObjectType(t0, t0, t1);
-    __ Assert(eq, AbortReason::kUnexpectedInitialMapForArrayFunction, t1,
-              Operand(MAP_TYPE));
-
-    // We should either have undefined in a2 or a valid AllocationSite
-    __ AssertUndefinedOrAllocationSite(a2, t0);
-  }
-
-  // Enter the context of the Array function.
-  __ lw(cp, FieldMemOperand(a1, JSFunction::kContextOffset));
-
-  Label subclassing;
-  __ Branch(&subclassing, ne, a1, Operand(a3));
-
-  Label no_info;
-  // Get the elements kind and case on that.
-  __ LoadRoot(at, Heap::kUndefinedValueRootIndex);
-  __ Branch(&no_info, eq, a2, Operand(at));
-
-  __ lw(a3, FieldMemOperand(
-                a2, AllocationSite::kTransitionInfoOrBoilerplateOffset));
-  __ SmiUntag(a3);
-  STATIC_ASSERT(AllocationSite::ElementsKindBits::kShift == 0);
-  __ And(a3, a3, Operand(AllocationSite::ElementsKindBits::kMask));
-  GenerateDispatchToArrayStub(masm, DONT_OVERRIDE);
-
-  __ bind(&no_info);
-  GenerateDispatchToArrayStub(masm, DISABLE_ALLOCATION_SITES);
-
-  // Subclassing.
-  __ bind(&subclassing);
-  __ Lsa(at, sp, a0, kPointerSizeLog2);
-  __ sw(a1, MemOperand(at));
-  __ li(at, Operand(3));
-  __ addu(a0, a0, at);
-  __ Push(a3, a2);
-  __ JumpToExternalReference(ExternalReference(Runtime::kNewArray, isolate()));
-}
-
-
-void InternalArrayConstructorStub::GenerateCase(
-    MacroAssembler* masm, ElementsKind kind) {
-
-  InternalArrayNoArgumentConstructorStub stub0(isolate(), kind);
-  __ TailCallStub(&stub0, lo, a0, Operand(1));
-
-  ArrayNArgumentsConstructorStub stubN(isolate());
-  __ TailCallStub(&stubN, hi, a0, Operand(1));
-
-  if (IsFastPackedElementsKind(kind)) {
-    // We might need to create a holey array
-    // look at the first argument.
-    __ lw(at, MemOperand(sp, 0));
-
-    InternalArraySingleArgumentConstructorStub
-        stub1_holey(isolate(), GetHoleyElementsKind(kind));
-    __ TailCallStub(&stub1_holey, ne, at, Operand(zero_reg));
-  }
-
-  InternalArraySingleArgumentConstructorStub stub1(isolate(), kind);
-  __ TailCallStub(&stub1);
-}
-
-
-void InternalArrayConstructorStub::Generate(MacroAssembler* masm) {
-  // ----------- S t a t e -------------
-  //  -- a0 : argc
-  //  -- a1 : constructor
-  //  -- sp[0] : return address
-  //  -- sp[4] : last argument
-  // -----------------------------------
-
-  if (FLAG_debug_code) {
-    // The array construct code is only set for the global and natives
-    // builtin Array functions which always have maps.
-
-    // Initial map for the builtin Array function should be a map.
-    __ lw(a3, FieldMemOperand(a1, JSFunction::kPrototypeOrInitialMapOffset));
-    // Will both indicate a nullptr and a Smi.
-    __ SmiTst(a3, at);
-    __ Assert(ne, AbortReason::kUnexpectedInitialMapForArrayFunction, at,
-              Operand(zero_reg));
-    __ GetObjectType(a3, a3, t0);
-    __ Assert(eq, AbortReason::kUnexpectedInitialMapForArrayFunction, t0,
-              Operand(MAP_TYPE));
-  }
-
-  // Figure out the right elements kind.
-  __ lw(a3, FieldMemOperand(a1, JSFunction::kPrototypeOrInitialMapOffset));
-
-  // Load the map's "bit field 2" into a3. We only need the first byte,
-  // but the following bit field extraction takes care of that anyway.
-  __ lbu(a3, FieldMemOperand(a3, Map::kBitField2Offset));
-  // Retrieve elements_kind from bit field 2.
-  __ DecodeField<Map::ElementsKindBits>(a3);
-
-  if (FLAG_debug_code) {
-    Label done;
-    __ Branch(&done, eq, a3, Operand(PACKED_ELEMENTS));
-    __ Assert(
-        eq,
-        AbortReason::kInvalidElementsKindForInternalArrayOrInternalPackedArray,
-        a3, Operand(HOLEY_ELEMENTS));
-    __ bind(&done);
-  }
-
-  Label fast_elements_case;
-  __ Branch(&fast_elements_case, eq, a3, Operand(PACKED_ELEMENTS));
-  GenerateCase(masm, HOLEY_ELEMENTS);
-
-  __ bind(&fast_elements_case);
-  GenerateCase(masm, PACKED_ELEMENTS);
-}
-
 static int AddressOffset(ExternalReference ref0, ExternalReference ref1) {
   return ref0.address() - ref1.address();
 }
@@ -1028,12 +335,12 @@ static void CallApiFunctionAndReturn(MacroAssembler* masm,
 
   Label profiler_disabled;
   Label end_profiler_check;
-  __ li(t9, Operand(ExternalReference::is_profiling_address(isolate)));
+  __ li(t9, ExternalReference::is_profiling_address(isolate));
   __ lb(t9, MemOperand(t9, 0));
   __ Branch(&profiler_disabled, eq, t9, Operand(zero_reg));
 
   // Additional parameter is the address of the actual callback.
-  __ li(t9, Operand(thunk_ref));
+  __ li(t9, thunk_ref);
   __ jmp(&end_profiler_check);
 
   __ bind(&profiler_disabled);
@@ -1041,20 +348,19 @@ static void CallApiFunctionAndReturn(MacroAssembler* masm,
   __ bind(&end_profiler_check);
 
   // Allocate HandleScope in callee-save registers.
-  __ li(s3, Operand(next_address));
-  __ lw(s0, MemOperand(s3, kNextOffset));
-  __ lw(s1, MemOperand(s3, kLimitOffset));
-  __ lw(s2, MemOperand(s3, kLevelOffset));
+  __ li(s5, next_address);
+  __ lw(s0, MemOperand(s5, kNextOffset));
+  __ lw(s1, MemOperand(s5, kLimitOffset));
+  __ lw(s2, MemOperand(s5, kLevelOffset));
   __ Addu(s2, s2, Operand(1));
-  __ sw(s2, MemOperand(s3, kLevelOffset));
+  __ sw(s2, MemOperand(s5, kLevelOffset));
 
   if (FLAG_log_timer_events) {
     FrameScope frame(masm, StackFrame::MANUAL);
     __ PushSafepointRegisters();
     __ PrepareCallCFunction(1, a0);
-    __ li(a0, Operand(ExternalReference::isolate_address(isolate)));
-    __ CallCFunction(ExternalReference::log_enter_external_function(isolate),
-                     1);
+    __ li(a0, ExternalReference::isolate_address(isolate));
+    __ CallCFunction(ExternalReference::log_enter_external_function(), 1);
     __ PopSafepointRegisters();
   }
 
@@ -1068,9 +374,8 @@ static void CallApiFunctionAndReturn(MacroAssembler* masm,
     FrameScope frame(masm, StackFrame::MANUAL);
     __ PushSafepointRegisters();
     __ PrepareCallCFunction(1, a0);
-    __ li(a0, Operand(ExternalReference::isolate_address(isolate)));
-    __ CallCFunction(ExternalReference::log_leave_external_function(isolate),
-                     1);
+    __ li(a0, ExternalReference::isolate_address(isolate));
+    __ CallCFunction(ExternalReference::log_leave_external_function(), 1);
     __ PopSafepointRegisters();
   }
 
@@ -1085,16 +390,16 @@ static void CallApiFunctionAndReturn(MacroAssembler* masm,
 
   // No more valid handles (the result handle was the last one). Restore
   // previous handle scope.
-  __ sw(s0, MemOperand(s3, kNextOffset));
+  __ sw(s0, MemOperand(s5, kNextOffset));
   if (__ emit_debug_code()) {
-    __ lw(a1, MemOperand(s3, kLevelOffset));
+    __ lw(a1, MemOperand(s5, kLevelOffset));
     __ Check(eq, AbortReason::kUnexpectedLevelAfterReturnFromApiCall, a1,
              Operand(s2));
   }
   __ Subu(s2, s2, Operand(1));
-  __ sw(s2, MemOperand(s3, kLevelOffset));
-  __ lw(at, MemOperand(s3, kLimitOffset));
-  __ Branch(&delete_allocated_handles, ne, s1, Operand(at));
+  __ sw(s2, MemOperand(s5, kLevelOffset));
+  __ lw(kScratchReg, MemOperand(s5, kLimitOffset));
+  __ Branch(&delete_allocated_handles, ne, s1, Operand(kScratchReg));
 
   // Leave the API exit frame.
   __ bind(&leave_exit_frame);
@@ -1111,8 +416,8 @@ static void CallApiFunctionAndReturn(MacroAssembler* masm,
 
   // Check if the function scheduled an exception.
   __ LoadRoot(t0, Heap::kTheHoleValueRootIndex);
-  __ li(at, Operand(ExternalReference::scheduled_exception_address(isolate)));
-  __ lw(t1, MemOperand(at));
+  __ li(kScratchReg, ExternalReference::scheduled_exception_address(isolate));
+  __ lw(t1, MemOperand(kScratchReg));
   __ Branch(&promote_scheduled_exception, ne, t0, Operand(t1));
 
   __ Ret();
@@ -1123,13 +428,12 @@ static void CallApiFunctionAndReturn(MacroAssembler* masm,
 
   // HandleScope limit has changed. Delete allocated extensions.
   __ bind(&delete_allocated_handles);
-  __ sw(s1, MemOperand(s3, kLimitOffset));
+  __ sw(s1, MemOperand(s5, kLimitOffset));
   __ mov(s0, v0);
   __ mov(a0, v0);
   __ PrepareCallCFunction(1, s1);
-  __ li(a0, Operand(ExternalReference::isolate_address(isolate)));
-  __ CallCFunction(ExternalReference::delete_handle_scope_extensions(isolate),
-                   1);
+  __ li(a0, ExternalReference::isolate_address(isolate));
+  __ CallCFunction(ExternalReference::delete_handle_scope_extensions(), 1);
   __ mov(v0, s0);
   __ jmp(&leave_exit_frame);
 }
@@ -1171,7 +475,7 @@ void CallApiCallbackStub::Generate(MacroAssembler* masm) {
   __ LoadRoot(scratch, Heap::kUndefinedValueRootIndex);
   // Push return value and default return value.
   __ Push(scratch, scratch);
-  __ li(scratch, Operand(ExternalReference::isolate_address(masm->isolate())));
+  __ li(scratch, ExternalReference::isolate_address(masm->isolate()));
   // Push isolate and holder.
   __ Push(scratch, holder);
 
@@ -1192,14 +496,14 @@ void CallApiCallbackStub::Generate(MacroAssembler* masm) {
   // FunctionCallbackInfo::implicit_args_
   __ sw(scratch, MemOperand(a0, 0 * kPointerSize));
   // FunctionCallbackInfo::values_
-  __ Addu(at, scratch, Operand((FCA::kArgsLength - 1 + argc()) * kPointerSize));
-  __ sw(at, MemOperand(a0, 1 * kPointerSize));
+  __ Addu(kScratchReg, scratch,
+          Operand((FCA::kArgsLength - 1 + argc()) * kPointerSize));
+  __ sw(kScratchReg, MemOperand(a0, 1 * kPointerSize));
   // FunctionCallbackInfo::length_ = argc
-  __ li(at, Operand(argc()));
-  __ sw(at, MemOperand(a0, 2 * kPointerSize));
+  __ li(kScratchReg, Operand(argc()));
+  __ sw(kScratchReg, MemOperand(a0, 2 * kPointerSize));
 
-  ExternalReference thunk_ref =
-      ExternalReference::invoke_function_callback(masm->isolate());
+  ExternalReference thunk_ref = ExternalReference::invoke_function_callback();
 
   AllowExternalCallThatCantCauseGC scope(masm);
   // Stores return the first js argument.
@@ -1243,7 +547,7 @@ void CallApiGetterStub::Generate(MacroAssembler* masm) {
   __ sw(scratch, MemOperand(sp, (PCA::kReturnValueOffset + 1) * kPointerSize));
   __ sw(scratch, MemOperand(sp, (PCA::kReturnValueDefaultValueIndex + 1) *
                                     kPointerSize));
-  __ li(scratch, Operand(ExternalReference::isolate_address(isolate())));
+  __ li(scratch, ExternalReference::isolate_address(isolate()));
   __ sw(scratch, MemOperand(sp, (PCA::kIsolateIndex + 1) * kPointerSize));
   __ sw(holder, MemOperand(sp, (PCA::kHolderIndex + 1) * kPointerSize));
   // should_throw_on_error -> false
@@ -1270,7 +574,7 @@ void CallApiGetterStub::Generate(MacroAssembler* masm) {
   __ Addu(a1, sp, Operand(1 * kPointerSize));  // a1 = v8::PropertyCallbackInfo&
 
   ExternalReference thunk_ref =
-      ExternalReference::invoke_accessor_getter_callback(isolate());
+      ExternalReference::invoke_accessor_getter_callback();
 
   __ lw(scratch, FieldMemOperand(callback, AccessorInfo::kJsGetterOffset));
   __ lw(api_function_address,
diff --git a/deps/v8/src/mips/constants-mips.h b/deps/v8/src/mips/constants-mips.h
index 496c715e818197..6478b4e7c452b9 100644
--- a/deps/v8/src/mips/constants-mips.h
+++ b/deps/v8/src/mips/constants-mips.h
@@ -122,6 +122,14 @@ const uint32_t kMipsSwlOffset = 0;
 #error Unknown endianness
 #endif
 
+#if defined(V8_TARGET_LITTLE_ENDIAN)
+const uint32_t kLeastSignificantByteInInt32Offset = 0;
+#elif defined(V8_TARGET_BIG_ENDIAN)
+const uint32_t kLeastSignificantByteInInt32Offset = 3;
+#else
+#error Unknown endianness
+#endif
+
 #ifndef __STDC_FORMAT_MACROS
 #define __STDC_FORMAT_MACROS
 #endif
@@ -137,6 +145,9 @@ const uint32_t kMipsSwlOffset = 0;
 namespace v8 {
 namespace internal {
 
+// TODO(sigurds): Change this value once we use relative jumps.
+constexpr size_t kMaxPCRelativeCodeRangeInMB = 0;
+
 // -----------------------------------------------------------------------------
 // Registers and FPURegisters.
 
@@ -170,8 +181,8 @@ const int kMSALanesDword = kMSARegSize / 64;
 // FPU (coprocessor 1) control registers. Currently only FCSR is implemented.
 const int kFCSRRegister = 31;
 const int kInvalidFPUControlRegister = -1;
-const uint32_t kFPUInvalidResult = static_cast<uint32_t>(1 << 31) - 1;
-const int32_t kFPUInvalidResultNegative = static_cast<int32_t>(1 << 31);
+const uint32_t kFPUInvalidResult = static_cast<uint32_t>(1u << 31) - 1;
+const int32_t kFPUInvalidResultNegative = static_cast<int32_t>(1u << 31);
 const uint64_t kFPU64InvalidResult =
     static_cast<uint64_t>(static_cast<uint64_t>(1) << 63) - 1;
 const int64_t kFPU64InvalidResultNegative =
@@ -211,6 +222,11 @@ const int32_t kPrefHintStoreRetained = 7;
 const int32_t kPrefHintWritebackInvalidate = 25;
 const int32_t kPrefHintPrepareForStore = 30;
 
+// Actual value of root register is offset from the root array's start
+// to take advantage of negative displacement values.
+// TODO(sigurds): Choose best value.
+constexpr int kRootRegisterBias = 256;
+
 // Helper functions for converting between register numbers and names.
 class Registers {
  public:
diff --git a/deps/v8/src/mips/deoptimizer-mips.cc b/deps/v8/src/mips/deoptimizer-mips.cc
index 078440431b41cf..f64953de121cb5 100644
--- a/deps/v8/src/mips/deoptimizer-mips.cc
+++ b/deps/v8/src/mips/deoptimizer-mips.cc
@@ -56,8 +56,8 @@ void Deoptimizer::TableEntryGenerator::Generate() {
     }
   }
 
-  __ li(a2, Operand(ExternalReference(IsolateAddressId::kCEntryFPAddress,
-                                      isolate())));
+  __ li(a2, Operand(ExternalReference::Create(
+                IsolateAddressId::kCEntryFPAddress, isolate())));
   __ sw(fp, MemOperand(a2));
 
   const int kSavedRegistersAreaSize =
@@ -84,7 +84,7 @@ void Deoptimizer::TableEntryGenerator::Generate() {
   __ JumpIfSmi(a1, &context_check);
   __ lw(a0, MemOperand(fp, JavaScriptFrameConstants::kFunctionOffset));
   __ bind(&context_check);
-  __ li(a1, Operand(type()));  // Bailout type.
+  __ li(a1, Operand(static_cast<int>(deopt_kind())));
   // a2: bailout id already loaded.
   // a3: code address or 0 already loaded.
   __ sw(t0, CFunctionArgumentOperand(5));  // Fp-to-sp delta.
@@ -93,7 +93,7 @@ void Deoptimizer::TableEntryGenerator::Generate() {
   // Call Deoptimizer::New().
   {
     AllowExternalCallThatCantCauseGC scope(masm());
-    __ CallCFunction(ExternalReference::new_deoptimizer_function(isolate()), 6);
+    __ CallCFunction(ExternalReference::new_deoptimizer_function(), 6);
   }
 
   // Preserve "deoptimizer" object in register v0 and get the input
@@ -167,8 +167,7 @@ void Deoptimizer::TableEntryGenerator::Generate() {
   // Call Deoptimizer::ComputeOutputFrames().
   {
     AllowExternalCallThatCantCauseGC scope(masm());
-    __ CallCFunction(
-        ExternalReference::compute_output_frames_function(isolate()), 1);
+    __ CallCFunction(ExternalReference::compute_output_frames_function(), 1);
   }
   __ pop(a0);  // Restore deoptimizer object (class Deoptimizer).
 
@@ -266,11 +265,11 @@ void Deoptimizer::TableEntryGenerator::GeneratePrologue() {
       __ bind(&start);
       DCHECK(is_int16(i));
       if (IsMipsArchVariant(kMips32r6)) {
-        __ li(at, i);
+        __ li(kScratchReg, i);
         __ BranchShort(PROTECT, &done);
       } else {
         __ BranchShort(USE_DELAY_SLOT, &done);  // Expose delay slot.
-        __ li(at, i);                           // In the delay slot.
+        __ li(kScratchReg, i);                  // In the delay slot.
         __ nop();
       }
       DCHECK_EQ(table_entry_size_, masm()->SizeOfCodeGeneratedSince(&start));
@@ -279,7 +278,7 @@ void Deoptimizer::TableEntryGenerator::GeneratePrologue() {
     DCHECK_EQ(masm()->SizeOfCodeGeneratedSince(&table_start),
         count() * table_entry_size_);
     __ bind(&done);
-    __ Push(at);
+    __ Push(kScratchReg);
   } else {
     DCHECK(!IsMipsArchVariant(kMips32r6));
     // Uncommon case, the branch cannot reach.
@@ -290,14 +289,14 @@ void Deoptimizer::TableEntryGenerator::GeneratePrologue() {
       DCHECK(is_int16(i));
       if (j >= kMaxEntriesBranchReach) {
         j = 0;
-        __ li(at, i);
+        __ li(kScratchReg, i);
         __ bind(&trampoline_jump);
         trampoline_jump = Label();
         __ BranchShort(USE_DELAY_SLOT, &trampoline_jump);
         __ nop();
       } else {
         __ BranchShort(USE_DELAY_SLOT, &trampoline_jump);  // Expose delay slot.
-        __ li(at, i);                                      // In the delay slot.
+        __ li(kScratchReg, i);                             // In the delay slot.
         __ nop();
       }
       DCHECK_EQ(table_entry_size_, masm()->SizeOfCodeGeneratedSince(&start));
@@ -306,7 +305,7 @@ void Deoptimizer::TableEntryGenerator::GeneratePrologue() {
     DCHECK_EQ(masm()->SizeOfCodeGeneratedSince(&table_start),
         count() * table_entry_size_);
     __ bind(&trampoline_jump);
-    __ Push(at);
+    __ Push(kScratchReg);
   }
 }
 
diff --git a/deps/v8/src/mips/frame-constants-mips.h b/deps/v8/src/mips/frame-constants-mips.h
index e90c7d957f24c3..243ad6cdc21846 100644
--- a/deps/v8/src/mips/frame-constants-mips.h
+++ b/deps/v8/src/mips/frame-constants-mips.h
@@ -5,6 +5,9 @@
 #ifndef V8_MIPS_FRAME_CONSTANTS_MIPS_H_
 #define V8_MIPS_FRAME_CONSTANTS_MIPS_H_
 
+#include "src/base/macros.h"
+#include "src/frame-constants.h"
+
 namespace v8 {
 namespace internal {
 
@@ -34,6 +37,19 @@ class ExitFrameConstants : public TypedFrameConstants {
   static constexpr int kConstantPoolOffset = 0;  // Not used.
 };
 
+class WasmCompileLazyFrameConstants : public TypedFrameConstants {
+ public:
+  static constexpr int kNumberOfSavedGpParamRegs = 4;
+  static constexpr int kNumberOfSavedFpParamRegs = 7;
+
+  // FP-relative.
+  static constexpr int kWasmInstanceOffset = TYPED_FRAME_PUSHED_VALUE_OFFSET(3);
+  static constexpr int kFixedFrameSizeFromFp =
+      TypedFrameConstants::kFixedFrameSizeFromFp +
+      kNumberOfSavedGpParamRegs * kPointerSize +
+      kNumberOfSavedFpParamRegs * kDoubleSize;
+};
+
 class JavaScriptFrameConstants : public AllStatic {
  public:
   // FP-relative.
diff --git a/deps/v8/src/mips/interface-descriptors-mips.cc b/deps/v8/src/mips/interface-descriptors-mips.cc
index a23f8f0fd43325..e0d122fc497eb8 100644
--- a/deps/v8/src/mips/interface-descriptors-mips.cc
+++ b/deps/v8/src/mips/interface-descriptors-mips.cc
@@ -32,7 +32,7 @@ void RecordWriteDescriptor::InitializePlatformSpecific(
   data->InitializePlatformSpecific(kParameterCount, default_stub_registers);
 }
 
-const Register FastNewFunctionContextDescriptor::FunctionRegister() {
+const Register FastNewFunctionContextDescriptor::ScopeInfoRegister() {
   return a1;
 }
 const Register FastNewFunctionContextDescriptor::SlotsRegister() { return a0; }
@@ -57,13 +57,6 @@ const Register StoreTransitionDescriptor::MapRegister() { return t1; }
 const Register ApiGetterDescriptor::HolderRegister() { return a0; }
 const Register ApiGetterDescriptor::CallbackRegister() { return a3; }
 
-const Register MathPowTaggedDescriptor::exponent() { return a2; }
-
-const Register MathPowIntegerDescriptor::exponent() {
-  return MathPowTaggedDescriptor::exponent();
-}
-
-
 const Register GrowArrayElementsDescriptor::ObjectRegister() { return a0; }
 const Register GrowArrayElementsDescriptor::KeyRegister() { return a3; }
 
@@ -74,13 +67,13 @@ const Register TypeConversionDescriptor::ArgumentRegister() { return a0; }
 void TypeofDescriptor::InitializePlatformSpecific(
     CallInterfaceDescriptorData* data) {
   Register registers[] = {a3};
-  data->InitializePlatformSpecific(arraysize(registers), registers, nullptr);
+  data->InitializePlatformSpecific(arraysize(registers), registers);
 }
 
 void CallFunctionDescriptor::InitializePlatformSpecific(
     CallInterfaceDescriptorData* data) {
   Register registers[] = {a1};
-  data->InitializePlatformSpecific(arraysize(registers), registers, nullptr);
+  data->InitializePlatformSpecific(arraysize(registers), registers);
 }
 
 void CallTrampolineDescriptor::InitializePlatformSpecific(
@@ -177,24 +170,7 @@ void ConstructStubDescriptor::InitializePlatformSpecific(
   data->InitializePlatformSpecific(arraysize(registers), registers);
 }
 
-
-void ConstructTrampolineDescriptor::InitializePlatformSpecific(
-    CallInterfaceDescriptorData* data) {
-  // a1: target
-  // a3: new target
-  // a0: number of arguments
-  Register registers[] = {a1, a3, a0};
-  data->InitializePlatformSpecific(arraysize(registers), registers);
-}
-
-
-void TransitionElementsKindDescriptor::InitializePlatformSpecific(
-    CallInterfaceDescriptorData* data) {
-  Register registers[] = {a0, a1};
-  data->InitializePlatformSpecific(arraysize(registers), registers, nullptr);
-}
-
-void AbortJSDescriptor::InitializePlatformSpecific(
+void AbortDescriptor::InitializePlatformSpecific(
     CallInterfaceDescriptorData* data) {
   Register registers[] = {a0};
   data->InitializePlatformSpecific(arraysize(registers), registers);
@@ -203,60 +179,19 @@ void AbortJSDescriptor::InitializePlatformSpecific(
 void AllocateHeapNumberDescriptor::InitializePlatformSpecific(
     CallInterfaceDescriptorData* data) {
   // register state
-  data->InitializePlatformSpecific(0, nullptr, nullptr);
-}
-
-void ArrayConstructorDescriptor::InitializePlatformSpecific(
-    CallInterfaceDescriptorData* data) {
-  // kTarget, kNewTarget, kActualArgumentsCount, kAllocationSite
-  Register registers[] = {a1, a3, a0, a2};
-  data->InitializePlatformSpecific(arraysize(registers), registers, nullptr);
-}
-
-void ArrayNoArgumentConstructorDescriptor::InitializePlatformSpecific(
-    CallInterfaceDescriptorData* data) {
-  // register state
-  // a0 -- number of arguments
-  // a1 -- function
-  // a2 -- allocation site with elements kind
-  Register registers[] = {a1, a2, a0};
-  data->InitializePlatformSpecific(arraysize(registers), registers, nullptr);
-}
-
-void ArraySingleArgumentConstructorDescriptor::InitializePlatformSpecific(
-    CallInterfaceDescriptorData* data) {
-  // register state
-  // a0 -- number of arguments
-  // a1 -- function
-  // a2 -- allocation site with elements kind
-  Register registers[] = {a1, a2, a0};
-  data->InitializePlatformSpecific(arraysize(registers), registers, nullptr);
-}
-
-void ArrayNArgumentsConstructorDescriptor::InitializePlatformSpecific(
-    CallInterfaceDescriptorData* data) {
-  // stack param count needs (constructor pointer, and single argument)
-  Register registers[] = {a1, a2, a0};
-  data->InitializePlatformSpecific(arraysize(registers), registers);
+  data->InitializePlatformSpecific(0, nullptr);
 }
 
 void CompareDescriptor::InitializePlatformSpecific(
     CallInterfaceDescriptorData* data) {
   Register registers[] = {a1, a0};
-  data->InitializePlatformSpecific(arraysize(registers), registers, nullptr);
+  data->InitializePlatformSpecific(arraysize(registers), registers);
 }
 
-
 void BinaryOpDescriptor::InitializePlatformSpecific(
     CallInterfaceDescriptorData* data) {
   Register registers[] = {a1, a0};
-  data->InitializePlatformSpecific(arraysize(registers), registers, nullptr);
-}
-
-void StringAddDescriptor::InitializePlatformSpecific(
-    CallInterfaceDescriptorData* data) {
-  Register registers[] = {a1, a0};
-  data->InitializePlatformSpecific(arraysize(registers), registers, nullptr);
+  data->InitializePlatformSpecific(arraysize(registers), registers);
 }
 
 void ArgumentAdaptorDescriptor::InitializePlatformSpecific(
@@ -311,7 +246,9 @@ void InterpreterPushArgsThenConstructDescriptor::InitializePlatformSpecific(
   data->InitializePlatformSpecific(arraysize(registers), registers);
 }
 
-void InterpreterCEntryDescriptor::InitializePlatformSpecific(
+namespace {
+
+void InterpreterCEntryDescriptor_InitializePlatformSpecific(
     CallInterfaceDescriptorData* data) {
   Register registers[] = {
       a0,  // argument count (argc)
@@ -321,6 +258,18 @@ void InterpreterCEntryDescriptor::InitializePlatformSpecific(
   data->InitializePlatformSpecific(arraysize(registers), registers);
 }
 
+}  // namespace
+
+void InterpreterCEntry1Descriptor::InitializePlatformSpecific(
+    CallInterfaceDescriptorData* data) {
+  InterpreterCEntryDescriptor_InitializePlatformSpecific(data);
+}
+
+void InterpreterCEntry2Descriptor::InitializePlatformSpecific(
+    CallInterfaceDescriptorData* data) {
+  InterpreterCEntryDescriptor_InitializePlatformSpecific(data);
+}
+
 void ResumeGeneratorDescriptor::InitializePlatformSpecific(
     CallInterfaceDescriptorData* data) {
   Register registers[] = {
diff --git a/deps/v8/src/mips/macro-assembler-mips.cc b/deps/v8/src/mips/macro-assembler-mips.cc
index 35953e509a15e1..9ed119c28d3b88 100644
--- a/deps/v8/src/mips/macro-assembler-mips.cc
+++ b/deps/v8/src/mips/macro-assembler-mips.cc
@@ -10,6 +10,7 @@
 #include "src/base/division-by-constant.h"
 #include "src/bootstrapper.h"
 #include "src/callable.h"
+#include "src/code-factory.h"
 #include "src/code-stubs.h"
 #include "src/debug/debug.h"
 #include "src/external-reference-table.h"
@@ -19,22 +20,23 @@
 #include "src/mips/macro-assembler-mips.h"
 #include "src/register-configuration.h"
 #include "src/runtime/runtime.h"
+#include "src/snapshot/snapshot.h"
 
 namespace v8 {
 namespace internal {
 
-MacroAssembler::MacroAssembler(Isolate* isolate, void* buffer, int size,
-                               CodeObjectRequired create_code_object)
-    : TurboAssembler(isolate, buffer, size, create_code_object) {}
-
-TurboAssembler::TurboAssembler(Isolate* isolate, void* buffer, int buffer_size,
-                               CodeObjectRequired create_code_object)
-    : Assembler(isolate, buffer, buffer_size),
-      isolate_(isolate),
-      has_double_zero_reg_set_(false) {
+MacroAssembler::MacroAssembler(Isolate* isolate,
+                               const AssemblerOptions& options, void* buffer,
+                               int size, CodeObjectRequired create_code_object)
+    : TurboAssembler(isolate, options, buffer, size, create_code_object) {
   if (create_code_object == CodeObjectRequired::kYes) {
-    code_object_ =
-        Handle<HeapObject>::New(isolate->heap()->undefined_value(), isolate);
+    // Unlike TurboAssembler, which can be used off the main thread and may not
+    // allocate, macro assembler creates its own copy of the self-reference
+    // marker in order to disambiguate between self-references during nested
+    // code generation (e.g.: codegen of the current object triggers stub
+    // compilation through CodeStub::GetCode()).
+    code_object_ = Handle<HeapObject>::New(
+        *isolate->factory()->NewSelfReferenceMarker(), isolate);
   }
 }
 
@@ -125,14 +127,14 @@ int TurboAssembler::PopCallerSaved(SaveFPRegsMode fp_mode, Register exclusion1,
 }
 
 void TurboAssembler::LoadRoot(Register destination, Heap::RootListIndex index) {
-  lw(destination, MemOperand(s6, index << kPointerSizeLog2));
+  lw(destination, MemOperand(kRootRegister, RootRegisterOffset(index)));
 }
 
 void TurboAssembler::LoadRoot(Register destination, Heap::RootListIndex index,
                               Condition cond, Register src1,
                               const Operand& src2) {
   Branch(2, NegateCondition(cond), src1, src2);
-  lw(destination, MemOperand(s6, index << kPointerSizeLog2));
+  lw(destination, MemOperand(kRootRegister, RootRegisterOffset(index)));
 }
 
 
@@ -282,7 +284,7 @@ void TurboAssembler::CallRecordWriteStub(
   Pop(slot_parameter);
   Pop(object_parameter);
 
-  li(isolate_parameter, Operand(ExternalReference::isolate_address(isolate())));
+  li(isolate_parameter, ExternalReference::isolate_address(isolate()));
   Move(remembered_set_parameter, Smi::FromEnum(remembered_set_action));
   Move(fp_mode_parameter, Smi::FromEnum(fp_mode));
   Call(callable.code(), RelocInfo::CODE_TARGET);
@@ -971,71 +973,66 @@ void TurboAssembler::Bnvc(Register rs, Register rt, Label* L) {
 // Word Swap Byte
 void TurboAssembler::ByteSwapSigned(Register dest, Register src,
                                     int operand_size) {
-  DCHECK(operand_size == 1 || operand_size == 2 || operand_size == 4);
-
-  Register input = src;
-  if (operand_size == 2) {
-    input = dest;
-    Seh(dest, src);
-  } else if (operand_size == 1) {
-    input = dest;
-    Seb(dest, src);
-  }
-  // No need to do any preparation if operand_size is 4
+  DCHECK(operand_size == 2 || operand_size == 4);
 
   if (IsMipsArchVariant(kMips32r2) || IsMipsArchVariant(kMips32r6)) {
-    wsbh(dest, input);
-    rotr(dest, dest, 16);
+    if (operand_size == 2) {
+      wsbh(dest, src);
+      seh(dest, dest);
+    } else {
+      wsbh(dest, src);
+      rotr(dest, dest, 16);
+    }
   } else if (IsMipsArchVariant(kMips32r1) || IsMipsArchVariant(kLoongson)) {
-    Register tmp = at;
-    Register tmp2 = t8;
-    DCHECK(dest != tmp && dest != tmp2);
-    DCHECK(src != tmp && src != tmp2);
+    if (operand_size == 2) {
+      DCHECK(src != at && dest != at);
+      srl(at, src, 8);
+      andi(at, at, 0xFF);
+      sll(dest, src, 8);
+      or_(dest, dest, at);
+
+      // Sign-extension
+      sll(dest, dest, 16);
+      sra(dest, dest, 16);
+    } else {
+      Register tmp = at;
+      Register tmp2 = t8;
+      DCHECK(dest != tmp && dest != tmp2);
+      DCHECK(src != tmp && src != tmp2);
 
-    andi(tmp2, input, 0xFF);
-    sll(tmp, tmp2, 24);
+      andi(tmp2, src, 0xFF);
+      sll(tmp, tmp2, 24);
 
-    andi(tmp2, input, 0xFF00);
-    sll(tmp2, tmp2, 8);
-    or_(tmp, tmp, tmp2);
+      andi(tmp2, src, 0xFF00);
+      sll(tmp2, tmp2, 8);
+      or_(tmp, tmp, tmp2);
 
-    srl(tmp2, input, 8);
-    andi(tmp2, tmp2, 0xFF00);
-    or_(tmp, tmp, tmp2);
+      srl(tmp2, src, 8);
+      andi(tmp2, tmp2, 0xFF00);
+      or_(tmp, tmp, tmp2);
 
-    srl(tmp2, input, 24);
-    or_(dest, tmp, tmp2);
+      srl(tmp2, src, 24);
+      or_(dest, tmp, tmp2);
+    }
   }
 }
 
 void TurboAssembler::ByteSwapUnsigned(Register dest, Register src,
                                       int operand_size) {
-  DCHECK(operand_size == 1 || operand_size == 2);
+  DCHECK_EQ(operand_size, 2);
 
   if (IsMipsArchVariant(kMips32r2) || IsMipsArchVariant(kMips32r6)) {
-    Register input = src;
-    if (operand_size == 1) {
-      input = dest;
-      andi(dest, src, 0xFF);
-    } else {
-      input = dest;
-      andi(dest, src, 0xFFFF);
-    }
-    // No need to do any preparation if operand_size is 4
-
-    wsbh(dest, input);
-    rotr(dest, dest, 16);
+    wsbh(dest, src);
+    andi(dest, dest, 0xFFFF);
   } else if (IsMipsArchVariant(kMips32r1) || IsMipsArchVariant(kLoongson)) {
-    if (operand_size == 1) {
-      sll(dest, src, 24);
-    } else {
-      Register tmp = at;
+    DCHECK(src != at && dest != at);
+    srl(at, src, 8);
+    andi(at, at, 0xFF);
+    sll(dest, src, 8);
+    or_(dest, dest, at);
 
-      andi(tmp, src, 0xFF00);
-      sll(dest, src, 24);
-      sll(tmp, tmp, 8);
-      or_(dest, tmp, dest);
-    }
+    // Zero-extension
+    andi(dest, dest, 0xFFFF);
   }
 }
 
@@ -1320,6 +1317,22 @@ void TurboAssembler::Sc(Register rd, const MemOperand& rs) {
 }
 
 void TurboAssembler::li(Register dst, Handle<HeapObject> value, LiFlags mode) {
+  if (FLAG_embedded_builtins) {
+    if (root_array_available_ && options().isolate_independent_code) {
+      IndirectLoadConstant(dst, value);
+      return;
+    }
+  }
+  li(dst, Operand(value), mode);
+}
+
+void TurboAssembler::li(Register dst, ExternalReference value, LiFlags mode) {
+  if (FLAG_embedded_builtins) {
+    if (root_array_available_ && options().isolate_independent_code) {
+      IndirectLoadExternalReference(dst, value);
+      return;
+    }
+  }
   li(dst, Operand(value), mode);
 }
 
@@ -1411,34 +1424,44 @@ void TurboAssembler::MultiPopFPU(RegList regs) {
   addiu(sp, sp, stack_offset);
 }
 
-
 void TurboAssembler::AddPair(Register dst_low, Register dst_high,
                              Register left_low, Register left_high,
-                             Register right_low, Register right_high) {
-  Register kScratchReg = s3;
-  if (left_low == right_low) {
-    // Special case for left = right and the sum potentially overwriting both
-    // left and right.
-    Slt(kScratchReg, left_low, zero_reg);
-    Addu(dst_low, left_low, right_low);
-  } else {
-    Addu(dst_low, left_low, right_low);
-    // If the sum overwrites right, left remains unchanged, otherwise right
-    // remains unchanged.
-    Sltu(kScratchReg, dst_low, (dst_low == right_low) ? left_low : right_low);
-  }
-  Addu(dst_high, left_high, right_high);
-  Addu(dst_high, dst_high, kScratchReg);
+                             Register right_low, Register right_high,
+                             Register scratch1, Register scratch2) {
+  BlockTrampolinePoolScope block_trampoline_pool(this);
+  Register scratch3 = t8;
+  Addu(scratch1, left_low, right_low);
+  Sltu(scratch3, scratch1, left_low);
+  Addu(scratch2, left_high, right_high);
+  Addu(dst_high, scratch2, scratch3);
+  Move(dst_low, scratch1);
 }
 
 void TurboAssembler::SubPair(Register dst_low, Register dst_high,
                              Register left_low, Register left_high,
-                             Register right_low, Register right_high) {
-  Register kScratchReg = s3;
-  Sltu(kScratchReg, left_low, right_low);
-  Subu(dst_low, left_low, right_low);
-  Subu(dst_high, left_high, right_high);
-  Subu(dst_high, dst_high, kScratchReg);
+                             Register right_low, Register right_high,
+                             Register scratch1, Register scratch2) {
+  BlockTrampolinePoolScope block_trampoline_pool(this);
+  Register scratch3 = t8;
+  Sltu(scratch3, left_low, right_low);
+  Subu(scratch1, left_low, right_low);
+  Subu(scratch2, left_high, right_high);
+  Subu(dst_high, scratch2, scratch3);
+  Move(dst_low, scratch1);
+}
+
+void TurboAssembler::MulPair(Register dst_low, Register dst_high,
+                             Register left_low, Register left_high,
+                             Register right_low, Register right_high,
+                             Register scratch1, Register scratch2) {
+  BlockTrampolinePoolScope block_trampoline_pool(this);
+  Register scratch3 = t8;
+  Mulu(scratch2, scratch1, left_low, right_low);
+  Mul(scratch3, left_low, right_high);
+  Addu(scratch2, scratch2, scratch3);
+  Mul(scratch3, left_high, right_low);
+  Addu(dst_high, scratch2, scratch3);
+  Move(dst_low, scratch1);
 }
 
 void TurboAssembler::ShlPair(Register dst_low, Register dst_high,
@@ -1700,6 +1723,7 @@ void TurboAssembler::Neg_s(FPURegister fd, FPURegister fs) {
   } else {
     DCHECK(IsMipsArchVariant(kMips32r2) || IsMipsArchVariant(kMips32r1) ||
            IsMipsArchVariant(kLoongson));
+    BlockTrampolinePoolScope block_trampoline_pool(this);
     Label is_nan, done;
     Register scratch1 = t8;
     Register scratch2 = t9;
@@ -1725,6 +1749,7 @@ void TurboAssembler::Neg_d(FPURegister fd, FPURegister fs) {
   } else {
     DCHECK(IsMipsArchVariant(kMips32r2) || IsMipsArchVariant(kMips32r1) ||
            IsMipsArchVariant(kLoongson));
+    BlockTrampolinePoolScope block_trampoline_pool(this);
     Label is_nan, done;
     Register scratch1 = t8;
     Register scratch2 = t9;
@@ -1735,7 +1760,8 @@ void TurboAssembler::Neg_d(FPURegister fd, FPURegister fs) {
     // while the sign has to be changed separately.
     neg_d(fd, fs);  // In delay slot.
     bind(&is_nan);
-    Mfhc1(scratch1, fs);
+    Move(fd, fs);
+    Mfhc1(scratch1, fd);
     li(scratch2, HeapNumber::kSignMask);
     Xor(scratch1, scratch1, scratch2);
     Mthc1(scratch1, fd);
@@ -1784,13 +1810,15 @@ void TurboAssembler::Cvt_d_uw(FPURegister fd, Register rs,
 
 void TurboAssembler::Trunc_uw_d(FPURegister fd, FPURegister fs,
                                 FPURegister scratch) {
-  Trunc_uw_d(fs, t8, scratch);
+  BlockTrampolinePoolScope block_trampoline_pool(this);
+  Trunc_uw_d(t8, fs, scratch);
   mtc1(t8, fd);
 }
 
 void TurboAssembler::Trunc_uw_s(FPURegister fd, FPURegister fs,
                                 FPURegister scratch) {
-  Trunc_uw_s(fs, t8, scratch);
+  BlockTrampolinePoolScope block_trampoline_pool(this);
+  Trunc_uw_s(t8, fs, scratch);
   mtc1(t8, fd);
 }
 
@@ -1834,10 +1862,10 @@ void TurboAssembler::Ceil_w_d(FPURegister fd, FPURegister fs) {
   }
 }
 
-void TurboAssembler::Trunc_uw_d(FPURegister fd, Register rs,
+void TurboAssembler::Trunc_uw_d(Register rd, FPURegister fs,
                                 FPURegister scratch) {
-  DCHECK(fd != scratch);
-  DCHECK(rs != at);
+  DCHECK(fs != scratch);
+  DCHECK(rd != at);
 
   {
     // Load 2^31 into scratch as its float representation.
@@ -1847,33 +1875,33 @@ void TurboAssembler::Trunc_uw_d(FPURegister fd, Register rs,
     mtc1(zero_reg, scratch);
     Mthc1(scratch1, scratch);
   }
-  // Test if scratch > fd.
-  // If fd < 2^31 we can convert it normally.
+  // Test if scratch > fs.
+  // If fs < 2^31 we can convert it normally.
   Label simple_convert;
-  CompareF64(OLT, fd, scratch);
+  CompareF64(OLT, fs, scratch);
   BranchTrueShortF(&simple_convert);
 
-  // First we subtract 2^31 from fd, then trunc it to rs
-  // and add 2^31 to rs.
-  sub_d(scratch, fd, scratch);
+  // First we subtract 2^31 from fs, then trunc it to rd
+  // and add 2^31 to rd.
+  sub_d(scratch, fs, scratch);
   trunc_w_d(scratch, scratch);
-  mfc1(rs, scratch);
-  Or(rs, rs, 1 << 31);
+  mfc1(rd, scratch);
+  Or(rd, rd, 1 << 31);
 
   Label done;
   Branch(&done);
   // Simple conversion.
   bind(&simple_convert);
-  trunc_w_d(scratch, fd);
-  mfc1(rs, scratch);
+  trunc_w_d(scratch, fs);
+  mfc1(rd, scratch);
 
   bind(&done);
 }
 
-void TurboAssembler::Trunc_uw_s(FPURegister fd, Register rs,
+void TurboAssembler::Trunc_uw_s(Register rd, FPURegister fs,
                                 FPURegister scratch) {
-  DCHECK(fd != scratch);
-  DCHECK(rs != at);
+  DCHECK(fs != scratch);
+  DCHECK(rd != at);
 
   {
     // Load 2^31 into scratch as its float representation.
@@ -1882,25 +1910,25 @@ void TurboAssembler::Trunc_uw_s(FPURegister fd, Register rs,
     li(scratch1, 0x4F000000);
     mtc1(scratch1, scratch);
   }
-  // Test if scratch > fd.
-  // If fd < 2^31 we can convert it normally.
+  // Test if scratch > fs.
+  // If fs < 2^31 we can convert it normally.
   Label simple_convert;
-  CompareF32(OLT, fd, scratch);
+  CompareF32(OLT, fs, scratch);
   BranchTrueShortF(&simple_convert);
 
-  // First we subtract 2^31 from fd, then trunc it to rs
-  // and add 2^31 to rs.
-  sub_s(scratch, fd, scratch);
+  // First we subtract 2^31 from fs, then trunc it to rd
+  // and add 2^31 to rd.
+  sub_s(scratch, fs, scratch);
   trunc_w_s(scratch, scratch);
-  mfc1(rs, scratch);
-  Or(rs, rs, 1 << 31);
+  mfc1(rd, scratch);
+  Or(rd, rd, 1 << 31);
 
   Label done;
   Branch(&done);
   // Simple conversion.
   bind(&simple_convert);
-  trunc_w_s(scratch, fd);
-  mfc1(rs, scratch);
+  trunc_w_s(scratch, fs);
+  mfc1(rd, scratch);
 
   bind(&done);
 }
@@ -2104,49 +2132,51 @@ void TurboAssembler::CompareIsNanF(SecondaryField sizeField, FPURegister cmp1,
   CompareF(sizeField, UN, cmp1, cmp2);
 }
 
-void TurboAssembler::BranchTrueShortF(Label* target) {
+void TurboAssembler::BranchTrueShortF(Label* target, BranchDelaySlot bd) {
   if (IsMipsArchVariant(kMips32r6)) {
     bc1nez(target, kDoubleCompareReg);
-    nop();
   } else {
     bc1t(target);
+  }
+  if (bd == PROTECT) {
     nop();
   }
 }
 
-void TurboAssembler::BranchFalseShortF(Label* target) {
+void TurboAssembler::BranchFalseShortF(Label* target, BranchDelaySlot bd) {
   if (IsMipsArchVariant(kMips32r6)) {
     bc1eqz(target, kDoubleCompareReg);
-    nop();
   } else {
     bc1f(target);
+  }
+  if (bd == PROTECT) {
     nop();
   }
 }
 
-void TurboAssembler::BranchTrueF(Label* target) {
+void TurboAssembler::BranchTrueF(Label* target, BranchDelaySlot bd) {
   bool long_branch =
       target->is_bound() ? !is_near(target) : is_trampoline_emitted();
   if (long_branch) {
     Label skip;
     BranchFalseShortF(&skip);
-    BranchLong(target, PROTECT);
+    BranchLong(target, bd);
     bind(&skip);
   } else {
-    BranchTrueShortF(target);
+    BranchTrueShortF(target, bd);
   }
 }
 
-void TurboAssembler::BranchFalseF(Label* target) {
+void TurboAssembler::BranchFalseF(Label* target, BranchDelaySlot bd) {
   bool long_branch =
       target->is_bound() ? !is_near(target) : is_trampoline_emitted();
   if (long_branch) {
     Label skip;
     BranchTrueShortF(&skip);
-    BranchLong(target, PROTECT);
+    BranchLong(target, bd);
     bind(&skip);
   } else {
-    BranchFalseShortF(target);
+    BranchFalseShortF(target, bd);
   }
 }
 
@@ -2391,6 +2421,24 @@ void TurboAssembler::LoadZeroIfConditionZero(Register dest,
   }
 }
 
+void TurboAssembler::LoadZeroIfFPUCondition(Register dest) {
+  if (IsMipsArchVariant(kMips32r6)) {
+    mfc1(kScratchReg, kDoubleCompareReg);
+    LoadZeroIfConditionNotZero(dest, kScratchReg);
+  } else {
+    Movt(dest, zero_reg);
+  }
+}
+
+void TurboAssembler::LoadZeroIfNotFPUCondition(Register dest) {
+  if (IsMipsArchVariant(kMips32r6)) {
+    mfc1(kScratchReg, kDoubleCompareReg);
+    LoadZeroIfConditionZero(dest, kScratchReg);
+  } else {
+    Movf(dest, zero_reg);
+  }
+}
+
 void TurboAssembler::Movz(Register rd, Register rs, Register rt) {
   if (IsMipsArchVariant(kLoongson) || IsMipsArchVariant(kMips32r6)) {
     Label done;
@@ -2651,8 +2699,10 @@ void TurboAssembler::TryInlineTruncateDoubleToI(Register result,
   Branch(done, eq, scratch, Operand(zero_reg));
 }
 
-void TurboAssembler::TruncateDoubleToIDelayed(Zone* zone, Register result,
-                                              DoubleRegister double_input) {
+void TurboAssembler::TruncateDoubleToI(Isolate* isolate, Zone* zone,
+                                       Register result,
+                                       DoubleRegister double_input,
+                                       StubCallMode stub_mode) {
   Label done;
 
   TryInlineTruncateDoubleToI(result, double_input, &done);
@@ -2662,7 +2712,12 @@ void TurboAssembler::TruncateDoubleToIDelayed(Zone* zone, Register result,
   Subu(sp, sp, Operand(kDoubleSize));  // Put input on stack.
   Sdc1(double_input, MemOperand(sp, 0));
 
-  CallStubDelayed(new (zone) DoubleToIStub(nullptr, result));
+  if (stub_mode == StubCallMode::kCallWasmRuntimeStub) {
+    Call(wasm::WasmCode::kDoubleToI, RelocInfo::WASM_STUB_CALL);
+  } else {
+    Call(BUILTIN_CODE(isolate, DoubleToI), RelocInfo::CODE_TARGET);
+  }
+  lw(result, MemOperand(sp, 0));
 
   Addu(sp, sp, Operand(kDoubleSize));
   pop(ra);
@@ -3543,6 +3598,29 @@ bool TurboAssembler::BranchAndLinkShortCheck(int32_t offset, Label* L,
   return false;
 }
 
+void TurboAssembler::LoadFromConstantsTable(Register destination,
+                                            int constant_index) {
+  DCHECK(isolate()->heap()->RootCanBeTreatedAsConstant(
+      Heap::kBuiltinsConstantsTableRootIndex));
+  LoadRoot(destination, Heap::kBuiltinsConstantsTableRootIndex);
+  lw(destination,
+     FieldMemOperand(destination,
+                     FixedArray::kHeaderSize + constant_index * kPointerSize));
+}
+
+void TurboAssembler::LoadRootRelative(Register destination, int32_t offset) {
+  lw(destination, MemOperand(kRootRegister, offset));
+}
+
+void TurboAssembler::LoadRootRegisterOffset(Register destination,
+                                            intptr_t offset) {
+  if (offset == 0) {
+    Move(destination, kRootRegister);
+  } else {
+    Addu(destination, kRootRegister, offset);
+  }
+}
+
 void TurboAssembler::Jump(Register target, int16_t offset, Condition cond,
                           Register rs, const Operand& rt, BranchDelaySlot bd) {
   BlockTrampolinePoolScope block_trampoline_pool(this);
@@ -3649,8 +3727,9 @@ void TurboAssembler::Jump(intptr_t target, RelocInfo::Mode rmode,
   if (IsMipsArchVariant(kMips32r6) && bd == PROTECT) {
     uint32_t lui_offset, jic_offset;
     UnpackTargetAddressUnsigned(target, lui_offset, jic_offset);
-    DCHECK(MustUseReg(rmode));
-    RecordRelocInfo(rmode, target);
+    if (MustUseReg(rmode)) {
+      RecordRelocInfo(rmode, target);
+    }
     lui(t9, lui_offset);
     Jump(t9, jic_offset, al, zero_reg, Operand(zero_reg), bd);
   } else {
@@ -3663,14 +3742,33 @@ void TurboAssembler::Jump(intptr_t target, RelocInfo::Mode rmode,
 void TurboAssembler::Jump(Address target, RelocInfo::Mode rmode, Condition cond,
                           Register rs, const Operand& rt, BranchDelaySlot bd) {
   DCHECK(!RelocInfo::IsCodeTarget(rmode));
-  Jump(reinterpret_cast<intptr_t>(target), rmode, cond, rs, rt, bd);
+  Jump(static_cast<intptr_t>(target), rmode, cond, rs, rt, bd);
 }
 
 void TurboAssembler::Jump(Handle<Code> code, RelocInfo::Mode rmode,
                           Condition cond, Register rs, const Operand& rt,
                           BranchDelaySlot bd) {
   DCHECK(RelocInfo::IsCodeTarget(rmode));
-  Jump(reinterpret_cast<intptr_t>(code.address()), rmode, cond, rs, rt, bd);
+  if (FLAG_embedded_builtins) {
+    if (root_array_available_ && options().isolate_independent_code) {
+      IndirectLoadConstant(t9, code);
+      Jump(t9, Code::kHeaderSize - kHeapObjectTag, cond, rs, rt, bd);
+      return;
+    } else if (options().inline_offheap_trampolines) {
+      int builtin_index = Builtins::kNoBuiltinId;
+      if (isolate()->builtins()->IsBuiltinHandle(code, &builtin_index) &&
+          Builtins::IsIsolateIndependent(builtin_index)) {
+        // Inline the trampoline.
+        CHECK_NE(builtin_index, Builtins::kNoBuiltinId);
+        EmbeddedData d = EmbeddedData::FromBlob();
+        Address entry = d.InstructionStartOfBuiltin(builtin_index);
+        li(t9, Operand(entry, RelocInfo::OFF_HEAP_TARGET));
+        Jump(t9, 0, cond, rs, rt, bd);
+        return;
+      }
+    }
+  }
+  Jump(static_cast<intptr_t>(code.address()), rmode, cond, rs, rt, bd);
 }
 
 int TurboAssembler::CallSize(Register target, int16_t offset, Condition cond,
@@ -3793,7 +3891,7 @@ void TurboAssembler::Call(Address target, RelocInfo::Mode rmode, Condition cond,
   BlockTrampolinePoolScope block_trampoline_pool(this);
   Label start;
   bind(&start);
-  int32_t target_int = reinterpret_cast<int32_t>(target);
+  int32_t target_int = static_cast<int32_t>(target);
   if (IsMipsArchVariant(kMips32r6) && bd == PROTECT && cond == cc_always) {
     uint32_t lui_offset, jialc_offset;
     UnpackTargetAddressUnsigned(target_int, lui_offset, jialc_offset);
@@ -3821,6 +3919,25 @@ void TurboAssembler::Call(Handle<Code> code, RelocInfo::Mode rmode,
                           Condition cond, Register rs, const Operand& rt,
                           BranchDelaySlot bd) {
   BlockTrampolinePoolScope block_trampoline_pool(this);
+  if (FLAG_embedded_builtins) {
+    if (root_array_available_ && options().isolate_independent_code) {
+      IndirectLoadConstant(t9, code);
+      Call(t9, Code::kHeaderSize - kHeapObjectTag, cond, rs, rt, bd);
+      return;
+    } else if (options().inline_offheap_trampolines) {
+      int builtin_index = Builtins::kNoBuiltinId;
+      if (isolate()->builtins()->IsBuiltinHandle(code, &builtin_index) &&
+          Builtins::IsIsolateIndependent(builtin_index)) {
+        // Inline the trampoline.
+        CHECK_NE(builtin_index, Builtins::kNoBuiltinId);
+        EmbeddedData d = EmbeddedData::FromBlob();
+        Address entry = d.InstructionStartOfBuiltin(builtin_index);
+        li(t9, Operand(entry, RelocInfo::OFF_HEAP_TARGET));
+        Call(t9, 0, cond, rs, rt, bd);
+        return;
+      }
+    }
+  }
   Label start;
   bind(&start);
   DCHECK(RelocInfo::IsCodeTarget(rmode));
@@ -3996,9 +4113,7 @@ void TurboAssembler::Push(Smi* smi) {
 
 void MacroAssembler::MaybeDropFrames() {
   // Check whether we need to drop frames to restart a function on the stack.
-  ExternalReference restart_fp =
-      ExternalReference::debug_restart_fp_address(isolate());
-  li(a1, Operand(restart_fp));
+  li(a1, ExternalReference::debug_restart_fp_address(isolate()));
   lw(a1, MemOperand(a1));
   Jump(BUILTIN_CODE(isolate(), FrameDropperTrampoline), RelocInfo::CODE_TARGET,
        ne, a1, Operand(zero_reg));
@@ -4016,7 +4131,7 @@ void MacroAssembler::PushStackHandler() {
 
   // Link the current handler as the next handler.
   li(t2,
-     Operand(ExternalReference(IsolateAddressId::kHandlerAddress, isolate())));
+     ExternalReference::Create(IsolateAddressId::kHandlerAddress, isolate()));
   lw(t1, MemOperand(t2));
   push(t1);
 
@@ -4032,7 +4147,7 @@ void MacroAssembler::PopStackHandler() {
   UseScratchRegisterScope temps(this);
   Register scratch = temps.Acquire();
   li(scratch,
-     Operand(ExternalReference(IsolateAddressId::kHandlerAddress, isolate())));
+     ExternalReference::Create(IsolateAddressId::kHandlerAddress, isolate()));
   sw(a1, MemOperand(scratch));
 }
 
@@ -4238,13 +4353,19 @@ void MacroAssembler::CheckDebugHook(Register fun, Register new_target,
                                     const ParameterCount& expected,
                                     const ParameterCount& actual) {
   Label skip_hook;
-  ExternalReference debug_hook_active =
-      ExternalReference::debug_hook_on_function_call_address(isolate());
-  li(t0, Operand(debug_hook_active));
+  li(t0, ExternalReference::debug_hook_on_function_call_address(isolate()));
   lb(t0, MemOperand(t0));
   Branch(&skip_hook, eq, t0, Operand(zero_reg));
 
   {
+    // Load receiver to pass it later to DebugOnFunctionCall hook.
+    if (actual.is_reg()) {
+      mov(t0, actual.reg());
+    } else {
+      li(t0, actual.immediate());
+    }
+    Lsa(at, sp, t0, kPointerSizeLog2);
+    lw(t0, MemOperand(at));
     FrameScope frame(this,
                      has_frame() ? StackFrame::NONE : StackFrame::INTERNAL);
     if (expected.is_reg()) {
@@ -4260,6 +4381,7 @@ void MacroAssembler::CheckDebugHook(Register fun, Register new_target,
     }
     Push(fun);
     Push(fun);
+    Push(t0);
     CallRuntime(Runtime::kDebugOnFunctionCall);
     Pop(fun);
     if (new_target.is_valid()) {
@@ -4330,9 +4452,9 @@ void MacroAssembler::InvokeFunction(Register function, Register new_target,
 
   lw(temp_reg, FieldMemOperand(a1, JSFunction::kSharedFunctionInfoOffset));
   lw(cp, FieldMemOperand(a1, JSFunction::kContextOffset));
-  lw(expected_reg,
-     FieldMemOperand(temp_reg,
-                     SharedFunctionInfo::kFormalParameterCountOffset));
+  lhu(expected_reg,
+      FieldMemOperand(temp_reg,
+                      SharedFunctionInfo::kFormalParameterCountOffset));
 
   ParameterCount expected(expected_reg);
   InvokeFunctionCode(function, new_target, expected, actual, flag);
@@ -4488,22 +4610,21 @@ void TurboAssembler::MulOverflow(Register dst, Register left,
   }
 }
 
-void TurboAssembler::CallRuntimeDelayed(Zone* zone, Runtime::FunctionId fid,
-                                        SaveFPRegsMode save_doubles,
-                                        BranchDelaySlot bd) {
+void TurboAssembler::CallRuntimeWithCEntry(Runtime::FunctionId fid,
+                                           Register centry) {
   const Runtime::Function* f = Runtime::FunctionForId(fid);
   // TODO(1236192): Most runtime routines don't need the number of
   // arguments passed in because it is constant. At some point we
   // should remove this need and make the runtime routine entry code
   // smarter.
   PrepareCEntryArgs(f->nargs);
-  PrepareCEntryFunction(ExternalReference(f, isolate()));
-  CallStubDelayed(new (zone) CEntryStub(nullptr, 1, save_doubles));
+  PrepareCEntryFunction(ExternalReference::Create(f));
+  DCHECK(!AreAliased(centry, a0, a1));
+  Call(centry, Code::kHeaderSize - kHeapObjectTag);
 }
 
 void MacroAssembler::CallRuntime(const Runtime::Function* f, int num_arguments,
-                                 SaveFPRegsMode save_doubles,
-                                 BranchDelaySlot bd) {
+                                 SaveFPRegsMode save_doubles) {
   // All parameters are on the stack. v0 has the return value after call.
 
   // If the expected number of arguments of the runtime function is
@@ -4516,9 +4637,10 @@ void MacroAssembler::CallRuntime(const Runtime::Function* f, int num_arguments,
   // should remove this need and make the runtime routine entry code
   // smarter.
   PrepareCEntryArgs(num_arguments);
-  PrepareCEntryFunction(ExternalReference(f, isolate()));
-  CEntryStub stub(isolate(), 1, save_doubles);
-  CallStub(&stub, al, zero_reg, Operand(zero_reg), bd);
+  PrepareCEntryFunction(ExternalReference::Create(f));
+  Handle<Code> code =
+      CodeFactory::CEntry(isolate(), f->result_size, save_doubles);
+  Call(code, RelocInfo::CODE_TARGET);
 }
 
 void MacroAssembler::TailCallRuntime(Runtime::FunctionId fid) {
@@ -4527,26 +4649,20 @@ void MacroAssembler::TailCallRuntime(Runtime::FunctionId fid) {
   if (function->nargs >= 0) {
     PrepareCEntryArgs(function->nargs);
   }
-  JumpToExternalReference(ExternalReference(fid, isolate()));
+  JumpToExternalReference(ExternalReference::Create(fid));
 }
 
 void MacroAssembler::JumpToExternalReference(const ExternalReference& builtin,
                                              BranchDelaySlot bd,
                                              bool builtin_exit_frame) {
   PrepareCEntryFunction(builtin);
-  CEntryStub stub(isolate(), 1, kDontSaveFPRegs, kArgvOnStack,
-                  builtin_exit_frame);
-  Jump(stub.GetCode(),
-       RelocInfo::CODE_TARGET,
-       al,
-       zero_reg,
-       Operand(zero_reg),
-       bd);
+  Handle<Code> code = CodeFactory::CEntry(isolate(), 1, kDontSaveFPRegs,
+                                          kArgvOnStack, builtin_exit_frame);
+  Jump(code, RelocInfo::CODE_TARGET, al, zero_reg, Operand(zero_reg), bd);
 }
 
 void MacroAssembler::JumpToInstructionStream(Address entry) {
-  li(kOffHeapTrampolineRegister,
-     Operand(reinterpret_cast<int32_t>(entry), RelocInfo::OFF_HEAP_TARGET));
+  li(kOffHeapTrampolineRegister, Operand(entry, RelocInfo::OFF_HEAP_TARGET));
   Jump(kOffHeapTrampolineRegister);
 }
 
@@ -4561,7 +4677,7 @@ void MacroAssembler::IncrementCounter(StatsCounter* counter, int value,
                                       Register scratch1, Register scratch2) {
   DCHECK_GT(value, 0);
   if (FLAG_native_code_counters && counter->Enabled()) {
-    li(scratch2, Operand(ExternalReference(counter)));
+    li(scratch2, ExternalReference::Create(counter));
     lw(scratch1, MemOperand(scratch2));
     Addu(scratch1, scratch1, Operand(value));
     sw(scratch1, MemOperand(scratch2));
@@ -4573,7 +4689,7 @@ void MacroAssembler::DecrementCounter(StatsCounter* counter, int value,
                                       Register scratch1, Register scratch2) {
   DCHECK_GT(value, 0);
   if (FLAG_native_code_counters && counter->Enabled()) {
-    li(scratch2, Operand(ExternalReference(counter)));
+    li(scratch2, ExternalReference::Create(counter));
     lw(scratch1, MemOperand(scratch2));
     Subu(scratch1, scratch1, Operand(value));
     sw(scratch1, MemOperand(scratch2));
@@ -4602,18 +4718,17 @@ void TurboAssembler::Check(Condition cc, AbortReason reason, Register rs,
 void TurboAssembler::Abort(AbortReason reason) {
   Label abort_start;
   bind(&abort_start);
-#ifdef DEBUG
   const char* msg = GetAbortReason(reason);
-  if (msg != nullptr) {
-    RecordComment("Abort message: ");
-    RecordComment(msg);
-  }
+#ifdef DEBUG
+  RecordComment("Abort message: ");
+  RecordComment(msg);
+#endif
 
-  if (FLAG_trap_on_abort) {
+  // Avoid emitting call to builtin if requested.
+  if (trap_on_abort()) {
     stop(msg);
     return;
   }
-#endif
 
   Move(a0, Smi::FromInt(static_cast<int>(reason)));
 
@@ -4657,14 +4772,8 @@ void TurboAssembler::StubPrologue(StackFrame::Type type) {
 void TurboAssembler::Prologue() { PushStandardFrame(a1); }
 
 void TurboAssembler::EnterFrame(StackFrame::Type type) {
-  int stack_offset, fp_offset;
-  if (type == StackFrame::INTERNAL) {
-    stack_offset = -4 * kPointerSize;
-    fp_offset = 2 * kPointerSize;
-  } else {
-    stack_offset = -3 * kPointerSize;
-    fp_offset = 1 * kPointerSize;
-  }
+  int stack_offset = -3 * kPointerSize;
+  const int fp_offset = 1 * kPointerSize;
   addiu(sp, sp, stack_offset);
   stack_offset = -stack_offset - kPointerSize;
   sw(ra, MemOperand(sp, stack_offset));
@@ -4673,14 +4782,8 @@ void TurboAssembler::EnterFrame(StackFrame::Type type) {
   stack_offset -= kPointerSize;
   li(t9, Operand(StackFrame::TypeToMarker(type)));
   sw(t9, MemOperand(sp, stack_offset));
-  if (type == StackFrame::INTERNAL) {
-    DCHECK_EQ(stack_offset, kPointerSize);
-    li(t9, Operand(CodeObject()));
-    sw(t9, MemOperand(sp, 0));
-  } else {
-    DCHECK_EQ(stack_offset, 0);
-  }
   // Adjust FP to point to saved FP.
+  DCHECK_EQ(stack_offset, 0);
   Addu(fp, sp, Operand(fp_offset));
 }
 
@@ -4741,15 +4844,15 @@ void MacroAssembler::EnterExitFrame(bool save_doubles, int stack_space,
   }
 
   // Accessed from ExitFrame::code_slot.
-  li(t8, Operand(CodeObject()), CONSTANT_SIZE);
+  li(t8, CodeObject(), CONSTANT_SIZE);
   sw(t8, MemOperand(fp, ExitFrameConstants::kCodeOffset));
 
   // Save the frame pointer and the context in top.
   li(t8,
-     Operand(ExternalReference(IsolateAddressId::kCEntryFPAddress, isolate())));
+     ExternalReference::Create(IsolateAddressId::kCEntryFPAddress, isolate()));
   sw(fp, MemOperand(t8));
   li(t8,
-     Operand(ExternalReference(IsolateAddressId::kContextAddress, isolate())));
+     ExternalReference::Create(IsolateAddressId::kContextAddress, isolate()));
   sw(cp, MemOperand(t8));
 
   const int frame_alignment = MacroAssembler::ActivationFrameAlignment();
@@ -4802,17 +4905,17 @@ void MacroAssembler::LeaveExitFrame(bool save_doubles, Register argument_count,
 
   // Clear top frame.
   li(t8,
-     Operand(ExternalReference(IsolateAddressId::kCEntryFPAddress, isolate())));
+     ExternalReference::Create(IsolateAddressId::kCEntryFPAddress, isolate()));
   sw(zero_reg, MemOperand(t8));
 
   // Restore current context from top and clear it in debug mode.
   li(t8,
-     Operand(ExternalReference(IsolateAddressId::kContextAddress, isolate())));
+     ExternalReference::Create(IsolateAddressId::kContextAddress, isolate()));
   lw(cp, MemOperand(t8));
 
 #ifdef DEBUG
   li(t8,
-     Operand(ExternalReference(IsolateAddressId::kContextAddress, isolate())));
+     ExternalReference::Create(IsolateAddressId::kContextAddress, isolate()));
   sw(a3, MemOperand(t8));
 #endif
 
@@ -4931,18 +5034,6 @@ void MacroAssembler::AssertSmi(Register object) {
   }
 }
 
-void MacroAssembler::AssertFixedArray(Register object) {
-  if (emit_debug_code()) {
-    STATIC_ASSERT(kSmiTag == 0);
-    SmiTst(object, t8);
-    Check(ne, AbortReason::kOperandIsASmiAndNotAFixedArray, t8,
-          Operand(zero_reg));
-    GetObjectType(object, t8, t8);
-    Check(eq, AbortReason::kOperandIsNotAFixedArray, t8,
-          Operand(FIXED_ARRAY_TYPE));
-  }
-}
-
 void MacroAssembler::AssertConstructor(Register object) {
   if (emit_debug_code()) {
     STATIC_ASSERT(kSmiTag == 0);
@@ -5011,9 +5102,9 @@ void MacroAssembler::AssertUndefinedOrAllocationSite(Register object,
     AssertNotSmi(object);
     LoadRoot(scratch, Heap::kUndefinedValueRootIndex);
     Branch(&done_checking, eq, object, Operand(scratch));
-    lw(t8, FieldMemOperand(object, HeapObject::kMapOffset));
-    LoadRoot(scratch, Heap::kAllocationSiteMapRootIndex);
-    Assert(eq, AbortReason::kExpectedUndefinedOrCell, t8, Operand(scratch));
+    GetObjectType(object, scratch, scratch);
+    Assert(eq, AbortReason::kExpectedUndefinedOrCell, scratch,
+           Operand(ALLOCATION_SITE_TYPE));
     bind(&done_checking);
   }
 }
@@ -5256,7 +5347,7 @@ void TurboAssembler::CallCFunction(ExternalReference function,
   // Linux/MIPS convention demands that register t9 contains
   // the address of the function being call in case of
   // Position independent code
-  li(t9, Operand(function));
+  li(t9, function);
   CallCFunctionHelper(t9, 0, num_reg_arguments, num_double_arguments);
 }
 
diff --git a/deps/v8/src/mips/macro-assembler-mips.h b/deps/v8/src/mips/macro-assembler-mips.h
index 3278932e1944de..248dd4f9056bfd 100644
--- a/deps/v8/src/mips/macro-assembler-mips.h
+++ b/deps/v8/src/mips/macro-assembler-mips.h
@@ -8,6 +8,7 @@
 #include "src/assembler.h"
 #include "src/globals.h"
 #include "src/mips/assembler-mips.h"
+#include "src/turbo-assembler.h"
 
 namespace v8 {
 namespace internal {
@@ -24,14 +25,20 @@ constexpr Register kInterpreterAccumulatorRegister = v0;
 constexpr Register kInterpreterBytecodeOffsetRegister = t4;
 constexpr Register kInterpreterBytecodeArrayRegister = t5;
 constexpr Register kInterpreterDispatchTableRegister = t6;
+
 constexpr Register kJavaScriptCallArgCountRegister = a0;
 constexpr Register kJavaScriptCallCodeStartRegister = a2;
+constexpr Register kJavaScriptCallTargetRegister = kJSFunctionRegister;
 constexpr Register kJavaScriptCallNewTargetRegister = a3;
+constexpr Register kJavaScriptCallExtraArg1Register = a2;
+
 constexpr Register kOffHeapTrampolineRegister = at;
 constexpr Register kRuntimeCallFunctionRegister = a1;
 constexpr Register kRuntimeCallArgCountRegister = a0;
+constexpr Register kWasmInstanceRegister = a0;
 
-// Forward declaration.
+// Forward declarations
+enum class AbortReason;
 class JumpTarget;
 
 // Reserved Register Usage Summary.
@@ -124,20 +131,13 @@ inline MemOperand CFunctionArgumentOperand(int index) {
   return MemOperand(sp, offset);
 }
 
-class TurboAssembler : public Assembler {
+class TurboAssembler : public TurboAssemblerBase {
  public:
-  TurboAssembler(Isolate* isolate, void* buffer, int buffer_size,
-                 CodeObjectRequired create_code_object);
-
-  void set_has_frame(bool value) { has_frame_ = value; }
-  bool has_frame() const { return has_frame_; }
-
-  Isolate* isolate() const { return isolate_; }
-
-  Handle<HeapObject> CodeObject() {
-    DCHECK(!code_object_.is_null());
-    return code_object_;
-  }
+  TurboAssembler(Isolate* isolate, const AssemblerOptions& options,
+                 void* buffer, int buffer_size,
+                 CodeObjectRequired create_code_object)
+      : TurboAssemblerBase(isolate, options, buffer, buffer_size,
+                           create_code_object) {}
 
   // Activation support.
   void EnterFrame(StackFrame::Type type);
@@ -155,6 +155,7 @@ class TurboAssembler : public Assembler {
     ExternalReference roots_array_start =
         ExternalReference::roots_array_start(isolate());
     li(kRootRegister, Operand(roots_array_start));
+    Addu(kRootRegister, kRootRegister, kRootRegisterBias);
   }
 
   // Jump unconditionally to given label.
@@ -227,11 +228,11 @@ class TurboAssembler : public Assembler {
     CompareIsNanF(D, cmp1, cmp2);
   }
 
-  void BranchTrueShortF(Label* target);
-  void BranchFalseShortF(Label* target);
+  void BranchTrueShortF(Label* target, BranchDelaySlot bd = PROTECT);
+  void BranchFalseShortF(Label* target, BranchDelaySlot bd = PROTECT);
 
-  void BranchTrueF(Label* target);
-  void BranchFalseF(Label* target);
+  void BranchTrueF(Label* target, BranchDelaySlot bd = PROTECT);
+  void BranchFalseF(Label* target, BranchDelaySlot bd = PROTECT);
 
   // MSA Branches
   void BranchMSA(Label* target, MSABranchDF df, MSABranchCondition cond,
@@ -246,8 +247,14 @@ class TurboAssembler : public Assembler {
     li(rd, Operand(j), mode);
   }
   void li(Register dst, Handle<HeapObject> value, LiFlags mode = OPTIMIZE_SIZE);
+  void li(Register dst, ExternalReference value, LiFlags mode = OPTIMIZE_SIZE);
+
+  void LoadFromConstantsTable(Register destination,
+                              int constant_index) override;
+  void LoadRootRegisterOffset(Register destination, intptr_t offset) override;
+  void LoadRootRelative(Register destination, int32_t offset) override;
 
-  // Jump, Call, and Ret pseudo instructions implementing inter-working.
+// Jump, Call, and Ret pseudo instructions implementing inter-working.
 #define COND_ARGS Condition cond = al, Register rs = zero_reg, \
   const Operand& rt = Operand(zero_reg), BranchDelaySlot bd = PROTECT
 
@@ -270,7 +277,9 @@ class TurboAssembler : public Assembler {
             COND_ARGS);
   void Call(Label* target);
 
-  void CallForDeoptimization(Address target, RelocInfo::Mode rmode) {
+  void CallForDeoptimization(Address target, int deopt_id,
+                             RelocInfo::Mode rmode) {
+    USE(deopt_id);
     Call(target, rmode);
   }
 
@@ -530,10 +539,10 @@ class TurboAssembler : public Assembler {
   void MovToFloatParameters(DoubleRegister src1, DoubleRegister src2);
   void MovToFloatResult(DoubleRegister src);
 
-  // See comments at the beginning of CEntryStub::Generate.
+  // See comments at the beginning of Builtins::Generate_CEntry.
   inline void PrepareCEntryArgs(int num_args) { li(a0, num_args); }
   inline void PrepareCEntryFunction(const ExternalReference& ref) {
-    li(a1, Operand(ref));
+    li(a1, ref);
   }
 
   void CheckPageFlag(Register object, Register scratch, int mask, Condition cc,
@@ -542,9 +551,9 @@ class TurboAssembler : public Assembler {
   void CallStubDelayed(CodeStub* stub, COND_ARGS);
 #undef COND_ARGS
 
-  void CallRuntimeDelayed(Zone* zone, Runtime::FunctionId fid,
-                          SaveFPRegsMode save_doubles = kDontSaveFPRegs,
-                          BranchDelaySlot bd = PROTECT);
+  // Call a runtime routine. This expects {centry} to contain a fitting CEntry
+  // builtin for the target runtime function and uses an indirect call.
+  void CallRuntimeWithCEntry(Runtime::FunctionId fid, Register centry);
 
   // Performs a truncating conversion of a floating point number as used by
   // the JS bitwise operations. See ECMA-262 9.5: ToInt32. Goes to 'done' if it
@@ -558,8 +567,8 @@ class TurboAssembler : public Assembler {
   // Performs a truncating conversion of a floating point number as used by
   // the JS bitwise operations. See ECMA-262 9.5: ToInt32.
   // Exits with 'result' holding the answer.
-  void TruncateDoubleToIDelayed(Zone* zone, Register result,
-                                DoubleRegister double_input);
+  void TruncateDoubleToI(Isolate* isolate, Zone* zone, Register result,
+                         DoubleRegister double_input, StubCallMode stub_mode);
 
   // Conditional move.
   void Movz(Register rd, Register rs, Register rt);
@@ -567,6 +576,9 @@ class TurboAssembler : public Assembler {
   void Movt(Register rd, Register rs, uint16_t cc = 0);
   void Movf(Register rd, Register rs, uint16_t cc = 0);
 
+  void LoadZeroIfFPUCondition(Register dest);
+  void LoadZeroIfNotFPUCondition(Register dest);
+
   void LoadZeroIfConditionNotZero(Register dest, Register condition);
   void LoadZeroIfConditionZero(Register dest, Register condition);
   void LoadZeroOnCondition(Register rd, Register rs, const Operand& rt,
@@ -578,10 +590,16 @@ class TurboAssembler : public Assembler {
 
   // Int64Lowering instructions
   void AddPair(Register dst_low, Register dst_high, Register left_low,
-               Register left_high, Register right_low, Register right_high);
+               Register left_high, Register right_low, Register right_high,
+               Register scratch1, Register scratch2);
 
   void SubPair(Register dst_low, Register dst_high, Register left_low,
-               Register left_high, Register right_low, Register right_high);
+               Register left_high, Register right_low, Register right_high,
+               Register scratch1, Register scratch2);
+
+  void MulPair(Register dst_low, Register dst_high, Register left_low,
+               Register left_high, Register right_low, Register right_high,
+               Register scratch1, Register scratch2);
 
   void ShlPair(Register dst_low, Register dst_high, Register src_low,
                Register src_high, Register shift, Register scratch1,
@@ -622,7 +640,7 @@ class TurboAssembler : public Assembler {
 
   // Convert single to unsigned word.
   void Trunc_uw_s(FPURegister fd, FPURegister fs, FPURegister scratch);
-  void Trunc_uw_s(FPURegister fd, Register rs, FPURegister scratch);
+  void Trunc_uw_s(Register rd, FPURegister fs, FPURegister scratch);
 
   void Trunc_w_d(FPURegister fd, FPURegister fs);
   void Round_w_d(FPURegister fd, FPURegister fs);
@@ -795,7 +813,7 @@ class TurboAssembler : public Assembler {
                            Func GetLabelFunction);
 
   // Load an object from the root table.
-  void LoadRoot(Register destination, Heap::RootListIndex index);
+  void LoadRoot(Register destination, Heap::RootListIndex index) override;
   void LoadRoot(Register destination, Heap::RootListIndex index, Condition cond,
                 Register src1, const Operand& src2);
 
@@ -810,12 +828,22 @@ class TurboAssembler : public Assembler {
 
   // Convert double to unsigned word.
   void Trunc_uw_d(FPURegister fd, FPURegister fs, FPURegister scratch);
-  void Trunc_uw_d(FPURegister fd, Register rs, FPURegister scratch);
+  void Trunc_uw_d(Register rd, FPURegister fs, FPURegister scratch);
 
   // Jump the register contains a smi.
   void JumpIfSmi(Register value, Label* smi_label, Register scratch = at,
                  BranchDelaySlot bd = PROTECT);
 
+  void JumpIfEqual(Register a, int32_t b, Label* dest) {
+    li(kScratchReg, Operand(b));
+    Branch(dest, eq, a, Operand(kScratchReg));
+  }
+
+  void JumpIfLessThan(Register a, int32_t b, Label* dest) {
+    li(kScratchReg, Operand(b));
+    Branch(dest, lt, a, Operand(kScratchReg));
+  }
+
   // Push a standard frame, consisting of ra, fp, context and JS function.
   void PushStandardFrame(Register function_reg);
 
@@ -836,11 +864,7 @@ class TurboAssembler : public Assembler {
   inline int32_t GetOffset(int32_t offset, Label* L, OffsetSize bits);
 
  private:
-  bool has_frame_ = false;
-  Isolate* const isolate_;
-  // This handle will be patched with the code object on installation.
-  Handle<HeapObject> code_object_;
-  bool has_double_zero_reg_set_;
+  bool has_double_zero_reg_set_ = false;
 
   void CallCFunctionHelper(Register function_base, int16_t function_offset,
                            int num_reg_arguments, int num_double_arguments);
@@ -898,7 +922,11 @@ class TurboAssembler : public Assembler {
 class MacroAssembler : public TurboAssembler {
  public:
   MacroAssembler(Isolate* isolate, void* buffer, int size,
-                 CodeObjectRequired create_code_object);
+                 CodeObjectRequired create_code_object)
+      : MacroAssembler(isolate, AssemblerOptions::Default(isolate), buffer,
+                       size, create_code_object) {}
+  MacroAssembler(Isolate* isolate, const AssemblerOptions& options,
+                 void* buffer, int size, CodeObjectRequired create_code_object);
 
   // Swap two registers.  If the scratch register is omitted then a slightly
   // less efficient form using xor instead of mov is emitted.
@@ -1048,22 +1076,19 @@ const Operand& rt = Operand(zero_reg), BranchDelaySlot bd = PROTECT
 
   // Call a runtime routine.
   void CallRuntime(const Runtime::Function* f, int num_arguments,
-                   SaveFPRegsMode save_doubles = kDontSaveFPRegs,
-                   BranchDelaySlot bd = PROTECT);
+                   SaveFPRegsMode save_doubles = kDontSaveFPRegs);
 
   // Convenience function: Same as above, but takes the fid instead.
   void CallRuntime(Runtime::FunctionId fid,
-                   SaveFPRegsMode save_doubles = kDontSaveFPRegs,
-                   BranchDelaySlot bd = PROTECT) {
+                   SaveFPRegsMode save_doubles = kDontSaveFPRegs) {
     const Runtime::Function* function = Runtime::FunctionForId(fid);
-    CallRuntime(function, function->nargs, save_doubles, bd);
+    CallRuntime(function, function->nargs, save_doubles);
   }
 
   // Convenience function: Same as above, but takes the fid instead.
   void CallRuntime(Runtime::FunctionId id, int num_arguments,
-                   SaveFPRegsMode save_doubles = kDontSaveFPRegs,
-                   BranchDelaySlot bd = PROTECT) {
-    CallRuntime(Runtime::FunctionForId(id), num_arguments, save_doubles, bd);
+                   SaveFPRegsMode save_doubles = kDontSaveFPRegs) {
+    CallRuntime(Runtime::FunctionForId(id), num_arguments, save_doubles);
   }
 
   // Convenience function: tail call a runtime routine (jump).
@@ -1120,9 +1145,6 @@ const Operand& rt = Operand(zero_reg), BranchDelaySlot bd = PROTECT
   void AssertNotSmi(Register object);
   void AssertSmi(Register object);
 
-  // Abort execution if argument is not a FixedArray, enabled via --debug-code.
-  void AssertFixedArray(Register object);
-
   // Abort execution if argument is not a Constructor, enabled via --debug-code.
   void AssertConstructor(Register object);
 
diff --git a/deps/v8/src/mips/simulator-mips.cc b/deps/v8/src/mips/simulator-mips.cc
index a8b887fec8cf09..078ce821010f48 100644
--- a/deps/v8/src/mips/simulator-mips.cc
+++ b/deps/v8/src/mips/simulator-mips.cc
@@ -473,12 +473,12 @@ void MipsDebugger::Debug() {
                  || (strcmp(cmd, "printobject") == 0)) {
         if (argc == 2) {
           int32_t value;
-          OFStream os(stdout);
+          StdoutStream os;
           if (GetValue(arg1, &value)) {
             Object* obj = reinterpret_cast<Object*>(value);
             os << arg1 << ": \n";
 #ifdef DEBUG
-            obj->Print(os);
+            obj->Print(sim_->isolate_, os);
             os << "\n";
 #else
             os << Brief(obj) << "\n";
@@ -751,7 +751,7 @@ void MipsDebugger::Debug() {
         PrintF("    Stops are debug instructions inserted by\n");
         PrintF("    the Assembler::stop() function.\n");
         PrintF("    When hitting a stop, the Simulator will\n");
-        PrintF("    stop and and give control to the Debugger.\n");
+        PrintF("    stop and give control to the Debugger.\n");
         PrintF("    All stop codes are watched:\n");
         PrintF("    - They can be enabled / disabled: the Simulator\n");
         PrintF("       will / won't stop when hitting them.\n");
@@ -928,7 +928,6 @@ Simulator* Simulator::current(Isolate* isolate) {
   v8::internal::Isolate::PerIsolateThreadData* isolate_data =
        isolate->FindOrAllocatePerThreadDataForThisThread();
   DCHECK_NOT_NULL(isolate_data);
-  DCHECK_NOT_NULL(isolate_data);
 
   Simulator* sim = isolate_data->simulator();
   if (sim == nullptr) {
@@ -2301,17 +2300,18 @@ void Simulator::SoftwareInterrupt() {
           case ExternalReference::BUILTIN_FP_FP_CALL:
           case ExternalReference::BUILTIN_COMPARE_CALL:
             PrintF("Call to host function at %p with args %f, %f",
-                   static_cast<void*>(FUNCTION_ADDR(generic_target)), dval0,
-                   dval1);
+                   reinterpret_cast<void*>(FUNCTION_ADDR(generic_target)),
+                   dval0, dval1);
             break;
           case ExternalReference::BUILTIN_FP_CALL:
             PrintF("Call to host function at %p with arg %f",
-                   static_cast<void*>(FUNCTION_ADDR(generic_target)), dval0);
+                   reinterpret_cast<void*>(FUNCTION_ADDR(generic_target)),
+                   dval0);
             break;
           case ExternalReference::BUILTIN_FP_INT_CALL:
             PrintF("Call to host function at %p with args %f, %d",
-                   static_cast<void*>(FUNCTION_ADDR(generic_target)), dval0,
-                   ival);
+                   reinterpret_cast<void*>(FUNCTION_ADDR(generic_target)),
+                   dval0, ival);
             break;
           default:
             UNREACHABLE();
@@ -2411,8 +2411,8 @@ void Simulator::SoftwareInterrupt() {
         PrintF(
             "Call to host function at %p "
             "args %08x, %08x, %08x, %08x, %08x, %08x, %08x, %08x, %08x\n",
-            static_cast<void*>(FUNCTION_ADDR(target)), arg0, arg1, arg2, arg3,
-            arg4, arg5, arg6, arg7, arg8);
+            reinterpret_cast<void*>(FUNCTION_ADDR(target)), arg0, arg1, arg2,
+            arg3, arg4, arg5, arg6, arg7, arg8);
       }
       int64_t result =
           target(arg0, arg1, arg2, arg3, arg4, arg5, arg6, arg7, arg8);
@@ -6386,10 +6386,10 @@ void Simulator::DecodeTypeImmediate() {
           break;
         }
         case BC1EQZ:
-          BranchCompactHelper(!(get_fpu_register(ft_reg) & 0x1), 16);
+          BranchHelper(!(get_fpu_register(ft_reg) & 0x1));
           break;
         case BC1NEZ:
-          BranchCompactHelper(get_fpu_register(ft_reg) & 0x1, 16);
+          BranchHelper(get_fpu_register(ft_reg) & 0x1);
           break;
         case BZ_V: {
           msa_reg_t wt;
@@ -6974,13 +6974,12 @@ void Simulator::Execute() {
   }
 }
 
-
-void Simulator::CallInternal(byte* entry) {
+void Simulator::CallInternal(Address entry) {
   // Adjust JS-based stack limit to C-based stack limit.
   isolate_->stack_guard()->AdjustStackLimitForSimulator();
 
   // Prepare to execute the code at entry.
-  set_register(pc, reinterpret_cast<int32_t>(entry));
+  set_register(pc, static_cast<int32_t>(entry));
   // Put down marker for end of simulation. The simulator will stop simulation
   // when the PC reaches this value. By saving the "end simulation" value into
   // the LR the simulation stops when returning to this call point.
@@ -7044,7 +7043,7 @@ void Simulator::CallInternal(byte* entry) {
   set_register(fp, fp_val);
 }
 
-intptr_t Simulator::CallImpl(byte* entry, int argument_count,
+intptr_t Simulator::CallImpl(Address entry, int argument_count,
                              const intptr_t* arguments) {
   // Set up arguments.
 
@@ -7078,8 +7077,7 @@ intptr_t Simulator::CallImpl(byte* entry, int argument_count,
   return get_register(v0);
 }
 
-
-double Simulator::CallFP(byte* entry, double d0, double d1) {
+double Simulator::CallFP(Address entry, double d0, double d1) {
   if (!IsMipsSoftFloatABI) {
     set_fpu_register_double(f12, d0);
     set_fpu_register_double(f14, d1);
diff --git a/deps/v8/src/mips/simulator-mips.h b/deps/v8/src/mips/simulator-mips.h
index ffd2c467406f94..d505f92c9cb182 100644
--- a/deps/v8/src/mips/simulator-mips.h
+++ b/deps/v8/src/mips/simulator-mips.h
@@ -226,9 +226,7 @@ class Simulator : public SimulatorBase {
   void set_pc(int32_t value);
   int32_t get_pc() const;
 
-  Address get_sp() const {
-    return reinterpret_cast<Address>(static_cast<intptr_t>(get_register(sp)));
-  }
+  Address get_sp() const { return static_cast<Address>(get_register(sp)); }
 
   // Accessor to the internal simulator stack area.
   uintptr_t StackLimit(uintptr_t c_limit) const;
@@ -237,12 +235,12 @@ class Simulator : public SimulatorBase {
   void Execute();
 
   template <typename Return, typename... Args>
-  Return Call(byte* entry, Args... args) {
+  Return Call(Address entry, Args... args) {
     return VariadicCall<Return>(this, &Simulator::CallImpl, entry, args...);
   }
 
   // Alternative: call a 2-argument double function.
-  double CallFP(byte* entry, double d0, double d1);
+  double CallFP(Address entry, double d0, double d1);
 
   // Push an address onto the JS stack.
   uintptr_t PushAddress(uintptr_t address);
@@ -280,7 +278,7 @@ class Simulator : public SimulatorBase {
     Unpredictable = 0xbadbeaf
   };
 
-  V8_EXPORT_PRIVATE intptr_t CallImpl(byte* entry, int argument_count,
+  V8_EXPORT_PRIVATE intptr_t CallImpl(Address entry, int argument_count,
                                       const intptr_t* arguments);
 
   // Unsupported instructions use Format to print an error and stop execution.
@@ -511,7 +509,7 @@ class Simulator : public SimulatorBase {
   void GetFpArgs(double* x, double* y, int32_t* z);
   void SetFpResult(const double& result);
 
-  void CallInternal(byte* entry);
+  void CallInternal(Address entry);
 
   // Architecture state.
   // Registers.
diff --git a/deps/v8/src/mips64/assembler-mips64-inl.h b/deps/v8/src/mips64/assembler-mips64-inl.h
index 4ba2d1e7db4deb..2e5d0d144dce4c 100644
--- a/deps/v8/src/mips64/assembler-mips64-inl.h
+++ b/deps/v8/src/mips64/assembler-mips64-inl.h
@@ -68,8 +68,7 @@ int64_t Operand::immediate() const {
 void RelocInfo::apply(intptr_t delta) {
   if (IsInternalReference(rmode_) || IsInternalReferenceEncoded(rmode_)) {
     // Absolute code pointer inside code object moves with the code object.
-    byte* p = reinterpret_cast<byte*>(pc_);
-    Assembler::RelocateInternalReference(rmode_, p, delta);
+    Assembler::RelocateInternalReference(rmode_, pc_, delta);
   }
 }
 
@@ -97,10 +96,7 @@ Address RelocInfo::target_address_address() {
   // place, ready to be patched with the target. After jump optimization,
   // that is the address of the instruction that follows J/JAL/JR/JALR
   // instruction.
-  // return reinterpret_cast<Address>(
-  //  pc_ + Assembler::kInstructionsFor32BitConstant * Assembler::kInstrSize);
-  return reinterpret_cast<Address>(
-    pc_ + Assembler::kInstructionsFor64BitConstant * Assembler::kInstrSize);
+  return pc_ + Assembler::kInstructionsFor64BitConstant * Assembler::kInstrSize;
 }
 
 
@@ -121,7 +117,12 @@ void Assembler::deserialization_set_special_target_at(
     Address instruction_payload, Code* code, Address target) {
   set_target_address_at(
       instruction_payload - kInstructionsFor64BitConstant * kInstrSize,
-      code ? code->constant_pool() : nullptr, target);
+      code ? code->constant_pool() : kNullAddress, target);
+}
+
+int Assembler::deserialization_special_target_size(
+    Address instruction_payload) {
+  return kSpecialTargetSize;
 }
 
 void Assembler::set_target_internal_reference_encoded_at(Address pc,
@@ -129,8 +130,7 @@ void Assembler::set_target_internal_reference_encoded_at(Address pc,
   // Encoded internal references are j/jal instructions.
   Instr instr = Assembler::instr_at(pc + 0 * Assembler::kInstrSize);
 
-  uint64_t imm28 =
-      (reinterpret_cast<uint64_t>(target) & static_cast<uint64_t>(kImm28Mask));
+  uint64_t imm28 = target & static_cast<uint64_t>(kImm28Mask);
 
   instr &= ~kImm26Mask;
   uint64_t imm26 = imm28 >> 2;
@@ -164,7 +164,7 @@ Handle<HeapObject> RelocInfo::target_object_handle(Assembler* origin) {
       Assembler::target_address_at(pc_, constant_pool_)));
 }
 
-void RelocInfo::set_target_object(HeapObject* target,
+void RelocInfo::set_target_object(Heap* heap, HeapObject* target,
                                   WriteBarrierMode write_barrier_mode,
                                   ICacheFlushMode icache_flush_mode) {
   DCHECK(IsCodeTarget(rmode_) || rmode_ == EMBEDDED_OBJECT);
@@ -173,9 +173,9 @@ void RelocInfo::set_target_object(HeapObject* target,
                                    icache_flush_mode);
   if (write_barrier_mode == UPDATE_WRITE_BARRIER && host() != nullptr &&
       target->IsHeapObject()) {
-    host()->GetHeap()->incremental_marking()->RecordWriteIntoCode(
-        host(), this, HeapObject::cast(target));
-    host()->GetHeap()->RecordWriteIntoCode(host(), this, target);
+    heap->incremental_marking()->RecordWriteIntoCode(host(), this,
+                                                     HeapObject::cast(target));
+    heap->RecordWriteIntoCode(host(), this, target);
   }
 }
 
@@ -201,23 +201,15 @@ Address RelocInfo::target_internal_reference() {
     Instr instr = Assembler::instr_at(pc_ + 0 * Assembler::kInstrSize);
     instr &= kImm26Mask;
     uint64_t imm28 = instr << 2;
-    uint64_t segment =
-        (reinterpret_cast<uint64_t>(pc_) & ~static_cast<uint64_t>(kImm28Mask));
-    return reinterpret_cast<Address>(segment | imm28);
+    uint64_t segment = pc_ & ~static_cast<uint64_t>(kImm28Mask);
+    return static_cast<Address>(segment | imm28);
   }
 }
 
 
 Address RelocInfo::target_internal_reference_address() {
   DCHECK(rmode_ == INTERNAL_REFERENCE || rmode_ == INTERNAL_REFERENCE_ENCODED);
-  return reinterpret_cast<Address>(pc_);
-}
-
-void RelocInfo::set_wasm_code_table_entry(Address target,
-                                          ICacheFlushMode icache_flush_mode) {
-  DCHECK(rmode_ == RelocInfo::WASM_CODE_TABLE_ENTRY);
-  Assembler::set_target_address_at(pc_, constant_pool_, target,
-                                   icache_flush_mode);
+  return pc_;
 }
 
 Address RelocInfo::target_runtime_entry(Assembler* origin) {
@@ -243,11 +235,11 @@ void RelocInfo::WipeOut() {
          IsRuntimeEntry(rmode_) || IsExternalReference(rmode_) ||
          IsInternalReference(rmode_) || IsInternalReferenceEncoded(rmode_));
   if (IsInternalReference(rmode_)) {
-    Memory::Address_at(pc_) = nullptr;
+    Memory::Address_at(pc_) = kNullAddress;
   } else if (IsInternalReferenceEncoded(rmode_)) {
-    Assembler::set_target_internal_reference_encoded_at(pc_, nullptr);
+    Assembler::set_target_internal_reference_encoded_at(pc_, kNullAddress);
   } else {
-    Assembler::set_target_address_at(pc_, constant_pool_, nullptr);
+    Assembler::set_target_address_at(pc_, constant_pool_, kNullAddress);
   }
 }
 
@@ -256,7 +248,7 @@ void RelocInfo::Visit(ObjectVisitor* visitor) {
   RelocInfo::Mode mode = rmode();
   if (mode == RelocInfo::EMBEDDED_OBJECT) {
     visitor->VisitEmbeddedPointer(host(), this);
-  } else if (RelocInfo::IsCodeTarget(mode)) {
+  } else if (RelocInfo::IsCodeTargetMode(mode)) {
     visitor->VisitCodeTarget(host(), this);
   } else if (mode == RelocInfo::EXTERNAL_REFERENCE) {
     visitor->VisitExternalReference(host(), this);
diff --git a/deps/v8/src/mips64/assembler-mips64.cc b/deps/v8/src/mips64/assembler-mips64.cc
index 8f6f28678b69d6..d1939ea1c7c265 100644
--- a/deps/v8/src/mips64/assembler-mips64.cc
+++ b/deps/v8/src/mips64/assembler-mips64.cc
@@ -38,6 +38,7 @@
 
 #include "src/base/cpu.h"
 #include "src/code-stubs.h"
+#include "src/deoptimizer.h"
 #include "src/mips64/assembler-mips64-inl.h"
 
 namespace v8 {
@@ -161,8 +162,9 @@ Register ToRegister(int num) {
 // -----------------------------------------------------------------------------
 // Implementation of RelocInfo.
 
-const int RelocInfo::kApplyMask = 1 << RelocInfo::INTERNAL_REFERENCE |
-                                  1 << RelocInfo::INTERNAL_REFERENCE_ENCODED;
+const int RelocInfo::kApplyMask =
+    RelocInfo::ModeMask(RelocInfo::INTERNAL_REFERENCE) |
+    RelocInfo::ModeMask(RelocInfo::INTERNAL_REFERENCE_ENCODED);
 
 bool RelocInfo::IsCodedSpecially() {
   // The deserializer needs to know whether a pointer is specially coded.  Being
@@ -176,34 +178,27 @@ bool RelocInfo::IsInConstantPool() {
   return false;
 }
 
-Address RelocInfo::embedded_address() const {
-  return Assembler::target_address_at(pc_, constant_pool_);
-}
-
-uint32_t RelocInfo::embedded_size() const {
-  return static_cast<uint32_t>(reinterpret_cast<intptr_t>(
-      (Assembler::target_address_at(pc_, constant_pool_))));
-}
-
-void RelocInfo::set_embedded_address(Address address,
-                                     ICacheFlushMode flush_mode) {
-  Assembler::set_target_address_at(pc_, constant_pool_, address, flush_mode);
-}
-
-void RelocInfo::set_embedded_size(uint32_t size, ICacheFlushMode flush_mode) {
-  Assembler::set_target_address_at(pc_, constant_pool_,
-                                   reinterpret_cast<Address>(size), flush_mode);
+int RelocInfo::GetDeoptimizationId(Isolate* isolate, DeoptimizeKind kind) {
+  DCHECK(IsRuntimeEntry(rmode_));
+  return Deoptimizer::GetDeoptimizationId(isolate, target_address(), kind);
 }
 
 void RelocInfo::set_js_to_wasm_address(Address address,
                                        ICacheFlushMode icache_flush_mode) {
   DCHECK_EQ(rmode_, JS_TO_WASM_CALL);
-  set_embedded_address(address, icache_flush_mode);
+  Assembler::set_target_address_at(pc_, constant_pool_, address,
+                                   icache_flush_mode);
 }
 
 Address RelocInfo::js_to_wasm_address() const {
   DCHECK_EQ(rmode_, JS_TO_WASM_CALL);
-  return embedded_address();
+  return Assembler::target_address_at(pc_, constant_pool_);
+}
+
+uint32_t RelocInfo::wasm_call_tag() const {
+  DCHECK(rmode_ == WASM_CALL || rmode_ == WASM_STUB_CALL);
+  return static_cast<uint32_t>(
+      Assembler::target_address_at(pc_, constant_pool_));
 }
 
 // -----------------------------------------------------------------------------
@@ -212,7 +207,7 @@ Address RelocInfo::js_to_wasm_address() const {
 
 Operand::Operand(Handle<HeapObject> handle)
     : rm_(no_reg), rmode_(RelocInfo::EMBEDDED_OBJECT) {
-  value_.immediate = reinterpret_cast<intptr_t>(handle.address());
+  value_.immediate = static_cast<intptr_t>(handle.address());
 }
 
 Operand Operand::EmbeddedNumber(double value) {
@@ -247,15 +242,15 @@ void Assembler::AllocateAndInstallRequestedHeapObjects(Isolate* isolate) {
     Handle<HeapObject> object;
     switch (request.kind()) {
       case HeapObjectRequest::kHeapNumber:
-        object = isolate->factory()->NewHeapNumber(request.heap_number(),
-                                                   IMMUTABLE, TENURED);
+        object =
+            isolate->factory()->NewHeapNumber(request.heap_number(), TENURED);
         break;
       case HeapObjectRequest::kCodeStub:
         request.code_stub()->set_isolate(isolate);
         object = request.code_stub()->GetCode();
         break;
     }
-    Address pc = buffer_ + request.offset();
+    Address pc = reinterpret_cast<Address>(buffer_) + request.offset();
     set_target_value_at(pc, reinterpret_cast<uint64_t>(object.location()));
   }
 }
@@ -296,8 +291,9 @@ const Instr kLwSwInstrTypeMask = 0xFFE00000;
 const Instr kLwSwInstrArgumentMask  = ~kLwSwInstrTypeMask;
 const Instr kLwSwOffsetMask = kImm16Mask;
 
-Assembler::Assembler(IsolateData isolate_data, void* buffer, int buffer_size)
-    : AssemblerBase(isolate_data, buffer, buffer_size),
+Assembler::Assembler(const AssemblerOptions& options, void* buffer,
+                     int buffer_size)
+    : AssemblerBase(options, buffer, buffer_size),
       scratch_register_list_(at.bit()) {
   reloc_info_writer.Reposition(buffer_ + buffer_size_, pc_);
 
@@ -3355,15 +3351,19 @@ void Assembler::cmp_d(FPUCondition cond, FPURegister fd, FPURegister fs,
 
 void Assembler::bc1eqz(int16_t offset, FPURegister ft) {
   DCHECK_EQ(kArchVariant, kMips64r6);
+  BlockTrampolinePoolScope block_trampoline_pool(this);
   Instr instr = COP1 | BC1EQZ | ft.code() << kFtShift | (offset & kImm16Mask);
-  emit(instr, CompactBranchType::COMPACT_BRANCH);
+  emit(instr);
+  BlockTrampolinePoolFor(1);  // For associated delay slot.
 }
 
 
 void Assembler::bc1nez(int16_t offset, FPURegister ft) {
   DCHECK_EQ(kArchVariant, kMips64r6);
+  BlockTrampolinePoolScope block_trampoline_pool(this);
   Instr instr = COP1 | BC1NEZ | ft.code() << kFtShift | (offset & kImm16Mask);
-  emit(instr, CompactBranchType::COMPACT_BRANCH);
+  emit(instr);
+  BlockTrampolinePoolFor(1);  // For associated delay slot.
 }
 
 
@@ -3932,7 +3932,7 @@ MSA_BIT_LIST(MSA_BIT)
 #undef MSA_BIT_FORMAT
 #undef MSA_BIT_LIST
 
-int Assembler::RelocateInternalReference(RelocInfo::Mode rmode, byte* pc,
+int Assembler::RelocateInternalReference(RelocInfo::Mode rmode, Address pc,
                                          intptr_t pc_delta) {
   if (RelocInfo::IsInternalReference(rmode)) {
     int64_t* p = reinterpret_cast<int64_t*>(pc);
@@ -4049,8 +4049,7 @@ void Assembler::GrowBuffer() {
   for (RelocIterator it(desc); !it.done(); it.next()) {
     RelocInfo::Mode rmode = it.rinfo()->rmode();
     if (rmode == RelocInfo::INTERNAL_REFERENCE) {
-      byte* p = reinterpret_cast<byte*>(it.rinfo()->pc());
-      RelocateInternalReference(rmode, p, pc_delta);
+      RelocateInternalReference(rmode, it.rinfo()->pc(), pc_delta);
     }
   }
   DCHECK(!overflow());
@@ -4092,11 +4091,11 @@ void Assembler::dd(Label* label) {
 
 void Assembler::RecordRelocInfo(RelocInfo::Mode rmode, intptr_t data) {
   // We do not try to reuse pool constants.
-  RelocInfo rinfo(pc_, rmode, data, nullptr);
+  RelocInfo rinfo(reinterpret_cast<Address>(pc_), rmode, data, nullptr);
   if (!RelocInfo::IsNone(rinfo.rmode())) {
     // Don't record external references unless the heap will be serialized.
-    if (rmode == RelocInfo::EXTERNAL_REFERENCE &&
-        !serializer_enabled() && !emit_debug_code()) {
+    if (RelocInfo::IsOnlyForSerializer(rmode) &&
+        !options().record_reloc_info_for_serialization && !emit_debug_code()) {
       return;
     }
     DCHECK_GE(buffer_space(), kMaxRelocSize);  // Too late to grow buffer here.
@@ -4188,7 +4187,7 @@ Address Assembler::target_address_at(Address pc) {
 
     // Sign extend to get canonical address.
     addr = (addr << 16) >> 16;
-    return reinterpret_cast<Address>(addr);
+    return static_cast<Address>(addr);
   }
   // We should never get here, force a bad address if we do.
   UNREACHABLE();
diff --git a/deps/v8/src/mips64/assembler-mips64.h b/deps/v8/src/mips64/assembler-mips64.h
index 0971c43b00ec2e..0e25969b432dee 100644
--- a/deps/v8/src/mips64/assembler-mips64.h
+++ b/deps/v8/src/mips64/assembler-mips64.h
@@ -394,20 +394,21 @@ constexpr uint64_t kSmiShiftMask = (1UL << kSmiShift) - 1;
 class Operand BASE_EMBEDDED {
  public:
   // Immediate.
-  INLINE(explicit Operand(int64_t immediate,
-                          RelocInfo::Mode rmode = RelocInfo::NONE))
+  V8_INLINE explicit Operand(int64_t immediate,
+                             RelocInfo::Mode rmode = RelocInfo::NONE)
       : rm_(no_reg), rmode_(rmode) {
     value_.immediate = immediate;
   }
-  INLINE(explicit Operand(const ExternalReference& f))
+  V8_INLINE explicit Operand(const ExternalReference& f)
       : rm_(no_reg), rmode_(RelocInfo::EXTERNAL_REFERENCE) {
-    value_.immediate = reinterpret_cast<int64_t>(f.address());
+    value_.immediate = static_cast<int64_t>(f.address());
   }
-  INLINE(explicit Operand(const char* s));
-  INLINE(explicit Operand(Object** opp));
-  INLINE(explicit Operand(Context** cpp));
+  V8_INLINE explicit Operand(const char* s);
+  V8_INLINE explicit Operand(Object** opp);
+  V8_INLINE explicit Operand(Context** cpp);
   explicit Operand(Handle<HeapObject> handle);
-  INLINE(explicit Operand(Smi* value)) : rm_(no_reg), rmode_(RelocInfo::NONE) {
+  V8_INLINE explicit Operand(Smi* value)
+      : rm_(no_reg), rmode_(RelocInfo::NONE) {
     value_.immediate = reinterpret_cast<intptr_t>(value);
   }
 
@@ -415,10 +416,10 @@ class Operand BASE_EMBEDDED {
   static Operand EmbeddedCode(CodeStub* stub);
 
   // Register.
-  INLINE(explicit Operand(Register rm)) : rm_(rm) {}
+  V8_INLINE explicit Operand(Register rm) : rm_(rm) {}
 
   // Return true if this is a register operand.
-  INLINE(bool is_reg() const);
+  V8_INLINE bool is_reg() const;
 
   inline int64_t immediate() const;
 
@@ -498,9 +499,7 @@ class Assembler : public AssemblerBase {
   // buffer for code generation and assumes its size to be buffer_size. If the
   // buffer is too small, a fatal error occurs. No deallocation of the buffer is
   // done upon destruction of the assembler.
-  Assembler(Isolate* isolate, void* buffer, int buffer_size)
-      : Assembler(IsolateData(isolate), buffer, buffer_size) {}
-  Assembler(IsolateData isolate_data, void* buffer, int buffer_size);
+  Assembler(const AssemblerOptions& options, void* buffer, int buffer_size);
   virtual ~Assembler() { }
 
   // GetCode emits any pending (non-emitted) code and fills the descriptor
@@ -574,19 +573,19 @@ class Assembler : public AssemblerBase {
   // Read/Modify the code target address in the branch/call instruction at pc.
   // The isolate argument is unused (and may be nullptr) when skipping flushing.
   static Address target_address_at(Address pc);
-  INLINE(static void set_target_address_at(
+  V8_INLINE static void set_target_address_at(
       Address pc, Address target,
-      ICacheFlushMode icache_flush_mode = FLUSH_ICACHE_IF_NEEDED)) {
-    set_target_value_at(pc, reinterpret_cast<uint64_t>(target),
-                        icache_flush_mode);
+      ICacheFlushMode icache_flush_mode = FLUSH_ICACHE_IF_NEEDED) {
+    set_target_value_at(pc, target, icache_flush_mode);
   }
   // On MIPS there is no Constant Pool so we skip that parameter.
-  INLINE(static Address target_address_at(Address pc, Address constant_pool)) {
+  V8_INLINE static Address target_address_at(Address pc,
+                                             Address constant_pool) {
     return target_address_at(pc);
   }
-  INLINE(static void set_target_address_at(
+  V8_INLINE static void set_target_address_at(
       Address pc, Address constant_pool, Address target,
-      ICacheFlushMode icache_flush_mode = FLUSH_ICACHE_IF_NEEDED)) {
+      ICacheFlushMode icache_flush_mode = FLUSH_ICACHE_IF_NEEDED) {
     set_target_address_at(pc, target, icache_flush_mode);
   }
 
@@ -608,6 +607,10 @@ class Assembler : public AssemblerBase {
   inline static void deserialization_set_special_target_at(
       Address instruction_payload, Code* code, Address target);
 
+  // Get the size of the special target encoded at 'instruction_payload'.
+  inline static int deserialization_special_target_size(
+      Address instruction_payload);
+
   // This sets the internal reference at the pc.
   inline static void deserialization_set_target_internal_reference_at(
       Address pc, Address target,
@@ -1789,7 +1792,7 @@ class Assembler : public AssemblerBase {
   void RecordDeoptReason(DeoptimizeReason reason, SourcePosition position,
                          int id);
 
-  static int RelocateInternalReference(RelocInfo::Mode rmode, byte* pc,
+  static int RelocateInternalReference(RelocInfo::Mode rmode, Address pc,
                                        intptr_t pc_delta);
 
   // Writes a single byte or word of data in the code stream.  Used for
@@ -1815,8 +1818,8 @@ class Assembler : public AssemblerBase {
   }
 
   // Read/patch instructions.
-  static Instr instr_at(byte* pc) { return *reinterpret_cast<Instr*>(pc); }
-  static void instr_at_put(byte* pc, Instr instr) {
+  static Instr instr_at(Address pc) { return *reinterpret_cast<Instr*>(pc); }
+  static void instr_at_put(Address pc, Instr instr) {
     *reinterpret_cast<Instr*>(pc) = instr;
   }
   Instr instr_at(int pos) { return *reinterpret_cast<Instr*>(buffer_ + pos); }
@@ -2247,23 +2250,9 @@ class Assembler : public AssemblerBase {
 
   RegList scratch_register_list_;
 
-  // The following functions help with avoiding allocations of embedded heap
-  // objects during the code assembly phase. {RequestHeapObject} records the
-  // need for a future heap number allocation or code stub generation. After
-  // code assembly, {AllocateAndInstallRequestedHeapObjects} will allocate these
-  // objects and place them where they are expected (determined by the pc offset
-  // associated with each request). That is, for each request, it will patch the
-  // dummy heap object handle that we emitted during code assembly with the
-  // actual heap object handle.
- protected:
-  // TODO(neis): Make private if its use can be moved out of TurboAssembler.
-  void RequestHeapObject(HeapObjectRequest request);
-
  private:
   void AllocateAndInstallRequestedHeapObjects(Isolate* isolate);
 
-  std::forward_list<HeapObjectRequest> heap_object_requests_;
-
   friend class RegExpMacroAssemblerMIPS;
   friend class RelocInfo;
   friend class BlockTrampolinePoolScope;
diff --git a/deps/v8/src/mips64/code-stubs-mips64.cc b/deps/v8/src/mips64/code-stubs-mips64.cc
index 5d0639f1a9a551..5ed97cc0047efb 100644
--- a/deps/v8/src/mips64/code-stubs-mips64.cc
+++ b/deps/v8/src/mips64/code-stubs-mips64.cc
@@ -13,6 +13,7 @@
 #include "src/ic/ic.h"
 #include "src/ic/stub-cache.h"
 #include "src/isolate.h"
+#include "src/objects/api-callbacks.h"
 #include "src/regexp/jsregexp.h"
 #include "src/regexp/regexp-macro-assembler.h"
 #include "src/runtime/runtime.h"
@@ -24,479 +25,48 @@ namespace internal {
 
 #define __ ACCESS_MASM(masm)
 
-void ArrayNArgumentsConstructorStub::Generate(MacroAssembler* masm) {
-  __ dsll(t9, a0, kPointerSizeLog2);
-  __ Daddu(t9, sp, t9);
-  __ Sd(a1, MemOperand(t9, 0));
-  __ Push(a1);
-  __ Push(a2);
-  __ Daddu(a0, a0, 3);
-  __ TailCallRuntime(Runtime::kNewArray);
-}
-
-
-void DoubleToIStub::Generate(MacroAssembler* masm) {
-  Label out_of_range, only_low, negate, done;
-  Register result_reg = destination();
-
-  Register scratch = GetRegisterThatIsNotOneOf(result_reg);
-  Register scratch2 = GetRegisterThatIsNotOneOf(result_reg, scratch);
-  Register scratch3 = GetRegisterThatIsNotOneOf(result_reg, scratch, scratch2);
-  DoubleRegister double_scratch = kScratchDoubleReg;
-
-  // Account for saved regs.
-  const int kArgumentOffset = 3 * kPointerSize;
-
-  __ Push(scratch, scratch2, scratch3);
-
-  // Load double input.
-  __ Ldc1(double_scratch, MemOperand(sp, kArgumentOffset));
-
-  // Clear cumulative exception flags and save the FCSR.
-  __ cfc1(scratch2, FCSR);
-  __ ctc1(zero_reg, FCSR);
-
-  // Try a conversion to a signed integer.
-  __ Trunc_w_d(double_scratch, double_scratch);
-  // Move the converted value into the result register.
-  __ mfc1(scratch3, double_scratch);
-
-  // Retrieve and restore the FCSR.
-  __ cfc1(scratch, FCSR);
-  __ ctc1(scratch2, FCSR);
-
-  // Check for overflow and NaNs.
-  __ And(
-      scratch, scratch,
-      kFCSROverflowFlagMask | kFCSRUnderflowFlagMask | kFCSRInvalidOpFlagMask);
-  // If we had no exceptions then set result_reg and we are done.
-  Label error;
-  __ Branch(&error, ne, scratch, Operand(zero_reg));
-  __ Move(result_reg, scratch3);
-  __ Branch(&done);
-  __ bind(&error);
-
-  // Load the double value and perform a manual truncation.
-  Register input_high = scratch2;
-  Register input_low = scratch3;
-
-  __ Lw(input_low, MemOperand(sp, kArgumentOffset + Register::kMantissaOffset));
-  __ Lw(input_high,
-        MemOperand(sp, kArgumentOffset + Register::kExponentOffset));
-
-  Label normal_exponent, restore_sign;
-  // Extract the biased exponent in result.
-  __ Ext(result_reg,
-         input_high,
-         HeapNumber::kExponentShift,
-         HeapNumber::kExponentBits);
-
-  // Check for Infinity and NaNs, which should return 0.
-  __ Subu(scratch, result_reg, HeapNumber::kExponentMask);
-  __ Movz(result_reg, zero_reg, scratch);
-  __ Branch(&done, eq, scratch, Operand(zero_reg));
-
-  // Express exponent as delta to (number of mantissa bits + 31).
-  __ Subu(result_reg,
-          result_reg,
-          Operand(HeapNumber::kExponentBias + HeapNumber::kMantissaBits + 31));
-
-  // If the delta is strictly positive, all bits would be shifted away,
-  // which means that we can return 0.
-  __ Branch(&normal_exponent, le, result_reg, Operand(zero_reg));
-  __ mov(result_reg, zero_reg);
-  __ Branch(&done);
-
-  __ bind(&normal_exponent);
-  const int kShiftBase = HeapNumber::kNonMantissaBitsInTopWord - 1;
-  // Calculate shift.
-  __ Addu(scratch, result_reg, Operand(kShiftBase + HeapNumber::kMantissaBits));
-
-  // Save the sign.
-  Register sign = result_reg;
-  result_reg = no_reg;
-  __ And(sign, input_high, Operand(HeapNumber::kSignMask));
-
-  // On ARM shifts > 31 bits are valid and will result in zero. On MIPS we need
-  // to check for this specific case.
-  Label high_shift_needed, high_shift_done;
-  __ Branch(&high_shift_needed, lt, scratch, Operand(32));
-  __ mov(input_high, zero_reg);
-  __ Branch(&high_shift_done);
-  __ bind(&high_shift_needed);
-
-  // Set the implicit 1 before the mantissa part in input_high.
-  __ Or(input_high,
-        input_high,
-        Operand(1 << HeapNumber::kMantissaBitsInTopWord));
-  // Shift the mantissa bits to the correct position.
-  // We don't need to clear non-mantissa bits as they will be shifted away.
-  // If they weren't, it would mean that the answer is in the 32bit range.
-  __ sllv(input_high, input_high, scratch);
-
-  __ bind(&high_shift_done);
-
-  // Replace the shifted bits with bits from the lower mantissa word.
-  Label pos_shift, shift_done;
-  __ li(at, 32);
-  __ subu(scratch, at, scratch);
-  __ Branch(&pos_shift, ge, scratch, Operand(zero_reg));
-
-  // Negate scratch.
-  __ Subu(scratch, zero_reg, scratch);
-  __ sllv(input_low, input_low, scratch);
-  __ Branch(&shift_done);
-
-  __ bind(&pos_shift);
-  __ srlv(input_low, input_low, scratch);
-
-  __ bind(&shift_done);
-  __ Or(input_high, input_high, Operand(input_low));
-  // Restore sign if necessary.
-  __ mov(scratch, sign);
-  result_reg = sign;
-  sign = no_reg;
-  __ Subu(result_reg, zero_reg, input_high);
-  __ Movz(result_reg, input_high, scratch);
-
-  __ bind(&done);
-
-  __ Pop(scratch, scratch2, scratch3);
-  __ Ret();
-}
-
-
-void MathPowStub::Generate(MacroAssembler* masm) {
-  const Register exponent = MathPowTaggedDescriptor::exponent();
-  DCHECK(exponent == a2);
-  const DoubleRegister double_base = f2;
-  const DoubleRegister double_exponent = f4;
-  const DoubleRegister double_result = f0;
-  const DoubleRegister double_scratch = f6;
-  const FPURegister single_scratch = f8;
-  const Register scratch = t1;
-  const Register scratch2 = a7;
-
-  Label call_runtime, done, int_exponent;
-
-  Label int_exponent_convert;
-  // Detect integer exponents stored as double.
-  __ EmitFPUTruncate(kRoundToMinusInf, scratch, double_exponent, at,
-                     double_scratch, scratch2, kCheckForInexactConversion);
-  // scratch2 == 0 means there was no conversion error.
-  __ Branch(&int_exponent_convert, eq, scratch2, Operand(zero_reg));
-
-  __ push(ra);
-  {
-    AllowExternalCallThatCantCauseGC scope(masm);
-    __ PrepareCallCFunction(0, 2, scratch2);
-    __ MovToFloatParameters(double_base, double_exponent);
-    __ CallCFunction(ExternalReference::power_double_double_function(isolate()),
-                     0, 2);
-  }
-  __ pop(ra);
-  __ MovFromFloatResult(double_result);
-  __ jmp(&done);
-
-  __ bind(&int_exponent_convert);
-
-  // Calculate power with integer exponent.
-  __ bind(&int_exponent);
-
-  // Get two copies of exponent in the registers scratch and exponent.
-  // Exponent has previously been stored into scratch as untagged integer.
-  __ mov(exponent, scratch);
-
-  __ mov_d(double_scratch, double_base);  // Back up base.
-  __ Move(double_result, 1.0);
-
-  // Get absolute value of exponent.
-  Label positive_exponent, bail_out;
-  __ Branch(&positive_exponent, ge, scratch, Operand(zero_reg));
-  __ Dsubu(scratch, zero_reg, scratch);
-  // Check when Dsubu overflows and we get negative result
-  // (happens only when input is MIN_INT).
-  __ Branch(&bail_out, gt, zero_reg, Operand(scratch));
-  __ bind(&positive_exponent);
-  __ Assert(ge, AbortReason::kUnexpectedNegativeValue, scratch,
-            Operand(zero_reg));
-
-  Label while_true, no_carry, loop_end;
-  __ bind(&while_true);
-
-  __ And(scratch2, scratch, 1);
-
-  __ Branch(&no_carry, eq, scratch2, Operand(zero_reg));
-  __ mul_d(double_result, double_result, double_scratch);
-  __ bind(&no_carry);
-
-  __ dsra(scratch, scratch, 1);
-
-  __ Branch(&loop_end, eq, scratch, Operand(zero_reg));
-  __ mul_d(double_scratch, double_scratch, double_scratch);
-
-  __ Branch(&while_true);
-
-  __ bind(&loop_end);
-
-  __ Branch(&done, ge, exponent, Operand(zero_reg));
-  __ Move(double_scratch, 1.0);
-  __ div_d(double_result, double_scratch, double_result);
-  // Test whether result is zero.  Bail out to check for subnormal result.
-  // Due to subnormals, x^-y == (1/x)^y does not hold in all cases.
-  __ CompareF64(EQ, double_result, kDoubleRegZero);
-  __ BranchFalseShortF(&done);
-
-  // double_exponent may not contain the exponent value if the input was a
-  // smi.  We set it with exponent value before bailing out.
-  __ bind(&bail_out);
-  __ mtc1(exponent, single_scratch);
-  __ cvt_d_w(double_exponent, single_scratch);
-
-  // Returning or bailing out.
-  __ push(ra);
-  {
-    AllowExternalCallThatCantCauseGC scope(masm);
-    __ PrepareCallCFunction(0, 2, scratch);
-    __ MovToFloatParameters(double_base, double_exponent);
-    __ CallCFunction(ExternalReference::power_double_double_function(isolate()),
-                     0, 2);
-  }
-  __ pop(ra);
-  __ MovFromFloatResult(double_result);
-
-  __ bind(&done);
-  __ Ret();
-}
-
-Movability CEntryStub::NeedsImmovableCode() { return kImmovable; }
-
-void CodeStub::GenerateStubsAheadOfTime(Isolate* isolate) {
-  CEntryStub::GenerateAheadOfTime(isolate);
-  CommonArrayConstructorStub::GenerateStubsAheadOfTime(isolate);
-  StoreFastElementStub::GenerateAheadOfTime(isolate);
-}
-
-
-void CodeStub::GenerateFPStubs(Isolate* isolate) {
-  // Generate if not already in cache.
-  SaveFPRegsMode mode = kSaveFPRegs;
-  CEntryStub(isolate, 1, mode).GetCode();
-}
-
-
-void CEntryStub::GenerateAheadOfTime(Isolate* isolate) {
-  CEntryStub stub(isolate, 1, kDontSaveFPRegs);
-  stub.GetCode();
-  CEntryStub save_doubles(isolate, 1, kSaveFPRegs);
-  save_doubles.GetCode();
-}
-
-
-void CEntryStub::Generate(MacroAssembler* masm) {
-  // Called from JavaScript; parameters are on stack as if calling JS function
-  // a0: number of arguments including receiver
-  // a1: pointer to builtin function
-  // fp: frame pointer    (restored after C call)
-  // sp: stack pointer    (restored as callee's sp after C call)
-  // cp: current context  (C callee-saved)
-  //
-  // If argv_in_register():
-  // a2: pointer to the first argument
-
-  ProfileEntryHookStub::MaybeCallEntryHook(masm);
-
-  if (argv_in_register()) {
-    // Move argv into the correct register.
-    __ mov(s1, a2);
-  } else {
-    // Compute the argv pointer in a callee-saved register.
-    __ Dlsa(s1, sp, a0, kPointerSizeLog2);
-    __ Dsubu(s1, s1, kPointerSize);
-  }
-
-  // Enter the exit frame that transitions from JavaScript to C++.
-  FrameScope scope(masm, StackFrame::MANUAL);
-  __ EnterExitFrame(save_doubles(), 0, is_builtin_exit()
-                                           ? StackFrame::BUILTIN_EXIT
-                                           : StackFrame::EXIT);
-
-  // s0: number of arguments  including receiver (C callee-saved)
-  // s1: pointer to first argument (C callee-saved)
-  // s2: pointer to builtin function (C callee-saved)
-
-  // Prepare arguments for C routine.
-  // a0 = argc
-  __ mov(s0, a0);
-  __ mov(s2, a1);
-
-  // We are calling compiled C/C++ code. a0 and a1 hold our two arguments. We
-  // also need to reserve the 4 argument slots on the stack.
-
-  __ AssertStackIsAligned();
-
-  // a0 = argc, a1 = argv, a2 = isolate
-  __ li(a2, Operand(ExternalReference::isolate_address(isolate())));
-  __ mov(a1, s1);
-
-  // To let the GC traverse the return address of the exit frames, we need to
-  // know where the return address is. The CEntryStub is unmovable, so
-  // we can store the address on the stack to be able to find it again and
-  // we never have to restore it, because it will not change.
-  { Assembler::BlockTrampolinePoolScope block_trampoline_pool(masm);
-    int kNumInstructionsToJump = 4;
-    Label find_ra;
-    // Adjust the value in ra to point to the correct return location, 2nd
-    // instruction past the real call into C code (the jalr(t9)), and push it.
-    // This is the return address of the exit frame.
-    if (kArchVariant >= kMips64r6) {
-      __ addiupc(ra, kNumInstructionsToJump + 1);
-    } else {
-      // This branch-and-link sequence is needed to find the current PC on mips
-      // before r6, saved to the ra register.
-      __ bal(&find_ra);  // bal exposes branch delay slot.
-      __ Daddu(ra, ra, kNumInstructionsToJump * Instruction::kInstrSize);
-    }
-    __ bind(&find_ra);
-
-    // This spot was reserved in EnterExitFrame.
-    __ Sd(ra, MemOperand(sp));
-    // Stack space reservation moved to the branch delay slot below.
-    // Stack is still aligned.
-
-    // Call the C routine.
-    __ mov(t9, s2);  // Function pointer to t9 to conform to ABI for PIC.
-    __ jalr(t9);
-    // Set up sp in the delay slot.
-    __ daddiu(sp, sp, -kCArgsSlotsSize);
-    // Make sure the stored 'ra' points to this position.
-    DCHECK_EQ(kNumInstructionsToJump,
-              masm->InstructionsGeneratedSince(&find_ra));
-  }
-
-  // Result returned in v0 or v1:v0 - do not destroy these registers!
-
-  // Check result for exception sentinel.
-  Label exception_returned;
-  __ LoadRoot(a4, Heap::kExceptionRootIndex);
-  __ Branch(&exception_returned, eq, a4, Operand(v0));
-
-  // Check that there is no pending exception, otherwise we
-  // should have returned the exception sentinel.
-  if (FLAG_debug_code) {
-    Label okay;
-    ExternalReference pending_exception_address(
-        IsolateAddressId::kPendingExceptionAddress, isolate());
-    __ li(a2, Operand(pending_exception_address));
-    __ Ld(a2, MemOperand(a2));
-    __ LoadRoot(a4, Heap::kTheHoleValueRootIndex);
-    // Cannot use check here as it attempts to generate call into runtime.
-    __ Branch(&okay, eq, a4, Operand(a2));
-    __ stop("Unexpected pending exception");
-    __ bind(&okay);
-  }
-
-  // Exit C frame and return.
-  // v0:v1: result
-  // sp: stack pointer
-  // fp: frame pointer
-  Register argc = argv_in_register()
-                      // We don't want to pop arguments so set argc to no_reg.
-                      ? no_reg
-                      // s0: still holds argc (callee-saved).
-                      : s0;
-  __ LeaveExitFrame(save_doubles(), argc, EMIT_RETURN);
-
-  // Handling of exception.
-  __ bind(&exception_returned);
-
-  ExternalReference pending_handler_context_address(
-      IsolateAddressId::kPendingHandlerContextAddress, isolate());
-  ExternalReference pending_handler_entrypoint_address(
-      IsolateAddressId::kPendingHandlerEntrypointAddress, isolate());
-  ExternalReference pending_handler_fp_address(
-      IsolateAddressId::kPendingHandlerFPAddress, isolate());
-  ExternalReference pending_handler_sp_address(
-      IsolateAddressId::kPendingHandlerSPAddress, isolate());
-
-  // Ask the runtime for help to determine the handler. This will set v0 to
-  // contain the current pending exception, don't clobber it.
-  ExternalReference find_handler(Runtime::kUnwindAndFindExceptionHandler,
-                                 isolate());
-  {
-    FrameScope scope(masm, StackFrame::MANUAL);
-    __ PrepareCallCFunction(3, 0, a0);
-    __ mov(a0, zero_reg);
-    __ mov(a1, zero_reg);
-    __ li(a2, Operand(ExternalReference::isolate_address(isolate())));
-    __ CallCFunction(find_handler, 3);
-  }
-
-  // Retrieve the handler context, SP and FP.
-  __ li(cp, Operand(pending_handler_context_address));
-  __ Ld(cp, MemOperand(cp));
-  __ li(sp, Operand(pending_handler_sp_address));
-  __ Ld(sp, MemOperand(sp));
-  __ li(fp, Operand(pending_handler_fp_address));
-  __ Ld(fp, MemOperand(fp));
-
-  // If the handler is a JS frame, restore the context to the frame. Note that
-  // the context will be set to (cp == 0) for non-JS frames.
-  Label zero;
-  __ Branch(&zero, eq, cp, Operand(zero_reg));
-  __ Sd(cp, MemOperand(fp, StandardFrameConstants::kContextOffset));
-  __ bind(&zero);
-
-  // Reset the masking register. This is done independent of the underlying
-  // feature flag {FLAG_branch_load_poisoning} to make the snapshot work with
-  // both configurations. It is safe to always do this, because the underlying
-  // register is caller-saved and can be arbitrarily clobbered.
-  __ ResetSpeculationPoisonRegister();
-
-  // Compute the handler entry address and jump to it.
-  __ li(t9, Operand(pending_handler_entrypoint_address));
-  __ Ld(t9, MemOperand(t9));
-  __ Jump(t9);
-}
-
-
 void JSEntryStub::Generate(MacroAssembler* masm) {
   Label invoke, handler_entry, exit;
   Isolate* isolate = masm->isolate();
 
-  // TODO(plind): unify the ABI description here.
-  // Registers:
-  // a0: entry address
-  // a1: function
-  // a2: receiver
-  // a3: argc
-  // a4 (a4): on mips64
+  {
+    NoRootArrayScope no_root_array(masm);
 
-  // Stack:
-  // 0 arg slots on mips64 (4 args slots on mips)
-  // args -- in a4/a4 on mips64, on stack on mips
+    // TODO(plind): unify the ABI description here.
+    // Registers:
+    // a0: entry address
+    // a1: function
+    // a2: receiver
+    // a3: argc
+    // a4 (a4): on mips64
 
-  ProfileEntryHookStub::MaybeCallEntryHook(masm);
+    // Stack:
+    // 0 arg slots on mips64 (4 args slots on mips)
+    // args -- in a4/a4 on mips64, on stack on mips
 
-  // Save callee saved registers on the stack.
-  __ MultiPush(kCalleeSaved | ra.bit());
+    ProfileEntryHookStub::MaybeCallEntryHook(masm);
 
-  // Save callee-saved FPU registers.
-  __ MultiPushFPU(kCalleeSavedFPU);
-  // Set up the reserved register for 0.0.
-  __ Move(kDoubleRegZero, 0.0);
+    // Save callee saved registers on the stack.
+    __ MultiPush(kCalleeSaved | ra.bit());
 
-  // Load argv in s0 register.
-  __ mov(s0, a4);  // 5th parameter in mips64 a4 (a4) register.
+    // Save callee-saved FPU registers.
+    __ MultiPushFPU(kCalleeSavedFPU);
+    // Set up the reserved register for 0.0.
+    __ Move(kDoubleRegZero, 0.0);
 
-  __ InitializeRootRegister();
+    // Load argv in s0 register.
+    __ mov(s0, a4);  // 5th parameter in mips64 a4 (a4) register.
+
+    __ InitializeRootRegister();
+  }
 
   // We build an EntryFrame.
   __ li(a7, Operand(-1));  // Push a bad frame pointer to fail if it is used.
   StackFrame::Type marker = type();
   __ li(a6, Operand(StackFrame::TypeToMarker(marker)));
   __ li(a5, Operand(StackFrame::TypeToMarker(marker)));
-  ExternalReference c_entry_fp(IsolateAddressId::kCEntryFPAddress, isolate);
+  ExternalReference c_entry_fp =
+      ExternalReference::Create(IsolateAddressId::kCEntryFPAddress, isolate);
   __ li(a4, Operand(c_entry_fp));
   __ Ld(a4, MemOperand(a4));
   __ Push(a7, a6, a5, a4);
@@ -521,8 +91,9 @@ void JSEntryStub::Generate(MacroAssembler* masm) {
 
   // If this is the outermost JS call, set js_entry_sp value.
   Label non_outermost_js;
-  ExternalReference js_entry_sp(IsolateAddressId::kJSEntrySPAddress, isolate);
-  __ li(a5, Operand(ExternalReference(js_entry_sp)));
+  ExternalReference js_entry_sp =
+      ExternalReference::Create(IsolateAddressId::kJSEntrySPAddress, isolate);
+  __ li(a5, js_entry_sp);
   __ Ld(a6, MemOperand(a5));
   __ Branch(&non_outermost_js, ne, a6, Operand(zero_reg));
   __ Sd(fp, MemOperand(a5));
@@ -544,8 +115,8 @@ void JSEntryStub::Generate(MacroAssembler* masm) {
   // field in the JSEnv and return a failure sentinel.  Coming in here the
   // fp will be invalid because the PushStackHandler below sets it to 0 to
   // signal the existence of the JSEntry frame.
-  __ li(a4, Operand(ExternalReference(
-                IsolateAddressId::kPendingExceptionAddress, isolate)));
+  __ li(a4, ExternalReference::Create(
+                IsolateAddressId::kPendingExceptionAddress, isolate));
   __ Sd(v0, MemOperand(a4));  // We come back from 'invoke'. result is in v0.
   __ LoadRoot(v0, Heap::kExceptionRootIndex);
   __ b(&exit);  // b exposes branch delay slot.
@@ -587,14 +158,14 @@ void JSEntryStub::Generate(MacroAssembler* masm) {
   __ pop(a5);
   __ Branch(&non_outermost_js_2, ne, a5,
             Operand(StackFrame::OUTERMOST_JSENTRY_FRAME));
-  __ li(a5, Operand(ExternalReference(js_entry_sp)));
+  __ li(a5, ExternalReference(js_entry_sp));
   __ Sd(zero_reg, MemOperand(a5));
   __ bind(&non_outermost_js_2);
 
   // Restore the top frame descriptors from the stack.
   __ pop(a5);
-  __ li(a4, Operand(ExternalReference(IsolateAddressId::kCEntryFPAddress,
-                                      isolate)));
+  __ li(a4,
+        ExternalReference::Create(IsolateAddressId::kCEntryFPAddress, isolate));
   __ Sd(a5, MemOperand(a4));
 
   // Reset the stack to the callee saved registers.
@@ -636,11 +207,24 @@ void DirectCEntryStub::Generate(MacroAssembler* masm) {
 
 void DirectCEntryStub::GenerateCall(MacroAssembler* masm,
                                     Register target) {
+  if (FLAG_embedded_builtins) {
+    if (masm->root_array_available() &&
+        isolate()->ShouldLoadConstantsFromRootList()) {
+      // This is basically an inlined version of Call(Handle<Code>) that loads
+      // the code object into kScratchReg instead of t9.
+      __ Move(t9, target);
+      __ IndirectLoadConstant(kScratchReg, GetCode());
+      __ Daddu(kScratchReg, kScratchReg,
+               Operand(Code::kHeaderSize - kHeapObjectTag));
+      __ Call(kScratchReg);
+      return;
+    }
+  }
   intptr_t loc =
       reinterpret_cast<intptr_t>(GetCode().location());
   __ Move(t9, target);
-  __ li(at, Operand(loc, RelocInfo::CODE_TARGET), CONSTANT_SIZE);
-  __ Call(at);
+  __ li(kScratchReg, Operand(loc, RelocInfo::CODE_TARGET), CONSTANT_SIZE);
+  __ Call(kScratchReg);
 }
 
 
@@ -704,12 +288,11 @@ void ProfileEntryHookStub::Generate(MacroAssembler* masm) {
   // Under the simulator we need to indirect the entry hook through a
   // trampoline function at a known address.
   // It additionally takes an isolate as a third parameter.
-  __ li(a2, Operand(ExternalReference::isolate_address(isolate())));
+  __ li(a2, ExternalReference::isolate_address(isolate()));
 
   ApiFunction dispatcher(FUNCTION_ADDR(EntryHookTrampoline));
-  __ li(t9, Operand(ExternalReference(&dispatcher,
-                                      ExternalReference::BUILTIN_CALL,
-                                      isolate())));
+  __ li(t9, ExternalReference::Create(&dispatcher,
+                                      ExternalReference::BUILTIN_CALL));
 #endif
   // Call C function through t9 to conform ABI for PIC.
   __ Call(t9);
@@ -726,279 +309,6 @@ void ProfileEntryHookStub::Generate(MacroAssembler* masm) {
   __ Ret();
 }
 
-
-template<class T>
-static void CreateArrayDispatch(MacroAssembler* masm,
-                                AllocationSiteOverrideMode mode) {
-  if (mode == DISABLE_ALLOCATION_SITES) {
-    T stub(masm->isolate(), GetInitialFastElementsKind(), mode);
-    __ TailCallStub(&stub);
-  } else if (mode == DONT_OVERRIDE) {
-    int last_index =
-        GetSequenceIndexFromFastElementsKind(TERMINAL_FAST_ELEMENTS_KIND);
-    for (int i = 0; i <= last_index; ++i) {
-      ElementsKind kind = GetFastElementsKindFromSequenceIndex(i);
-      T stub(masm->isolate(), kind);
-      __ TailCallStub(&stub, eq, a3, Operand(kind));
-    }
-
-    // If we reached this point there is a problem.
-    __ Abort(AbortReason::kUnexpectedElementsKindInArrayConstructor);
-  } else {
-    UNREACHABLE();
-  }
-}
-
-
-static void CreateArrayDispatchOneArgument(MacroAssembler* masm,
-                                           AllocationSiteOverrideMode mode) {
-  // a2 - allocation site (if mode != DISABLE_ALLOCATION_SITES)
-  // a3 - kind (if mode != DISABLE_ALLOCATION_SITES)
-  // a0 - number of arguments
-  // a1 - constructor?
-  // sp[0] - last argument
-    STATIC_ASSERT(PACKED_SMI_ELEMENTS == 0);
-    STATIC_ASSERT(HOLEY_SMI_ELEMENTS == 1);
-    STATIC_ASSERT(PACKED_ELEMENTS == 2);
-    STATIC_ASSERT(HOLEY_ELEMENTS == 3);
-    STATIC_ASSERT(PACKED_DOUBLE_ELEMENTS == 4);
-    STATIC_ASSERT(HOLEY_DOUBLE_ELEMENTS == 5);
-
-  if (mode == DISABLE_ALLOCATION_SITES) {
-    ElementsKind initial = GetInitialFastElementsKind();
-    ElementsKind holey_initial = GetHoleyElementsKind(initial);
-
-    ArraySingleArgumentConstructorStub stub_holey(masm->isolate(),
-                                                  holey_initial,
-                                                  DISABLE_ALLOCATION_SITES);
-    __ TailCallStub(&stub_holey);
-  } else if (mode == DONT_OVERRIDE) {
-    // is the low bit set? If so, we are holey and that is good.
-    Label normal_sequence;
-    __ And(at, a3, Operand(1));
-    __ Branch(&normal_sequence, ne, at, Operand(zero_reg));
-
-    // We are going to create a holey array, but our kind is non-holey.
-    // Fix kind and retry (only if we have an allocation site in the slot).
-    __ Daddu(a3, a3, Operand(1));
-
-    if (FLAG_debug_code) {
-      __ Ld(a5, FieldMemOperand(a2, 0));
-      __ LoadRoot(at, Heap::kAllocationSiteMapRootIndex);
-      __ Assert(eq, AbortReason::kExpectedAllocationSite, a5, Operand(at));
-    }
-
-    // Save the resulting elements kind in type info. We can't just store a3
-    // in the AllocationSite::transition_info field because elements kind is
-    // restricted to a portion of the field...upper bits need to be left alone.
-    STATIC_ASSERT(AllocationSite::ElementsKindBits::kShift == 0);
-    __ Ld(a4, FieldMemOperand(
-                  a2, AllocationSite::kTransitionInfoOrBoilerplateOffset));
-    __ Daddu(a4, a4, Operand(Smi::FromInt(kFastElementsKindPackedToHoley)));
-    __ Sd(a4, FieldMemOperand(
-                  a2, AllocationSite::kTransitionInfoOrBoilerplateOffset));
-
-    __ bind(&normal_sequence);
-    int last_index =
-        GetSequenceIndexFromFastElementsKind(TERMINAL_FAST_ELEMENTS_KIND);
-    for (int i = 0; i <= last_index; ++i) {
-      ElementsKind kind = GetFastElementsKindFromSequenceIndex(i);
-      ArraySingleArgumentConstructorStub stub(masm->isolate(), kind);
-      __ TailCallStub(&stub, eq, a3, Operand(kind));
-    }
-
-    // If we reached this point there is a problem.
-    __ Abort(AbortReason::kUnexpectedElementsKindInArrayConstructor);
-  } else {
-    UNREACHABLE();
-  }
-}
-
-
-template<class T>
-static void ArrayConstructorStubAheadOfTimeHelper(Isolate* isolate) {
-  int to_index =
-      GetSequenceIndexFromFastElementsKind(TERMINAL_FAST_ELEMENTS_KIND);
-  for (int i = 0; i <= to_index; ++i) {
-    ElementsKind kind = GetFastElementsKindFromSequenceIndex(i);
-    T stub(isolate, kind);
-    stub.GetCode();
-    if (AllocationSite::ShouldTrack(kind)) {
-      T stub1(isolate, kind, DISABLE_ALLOCATION_SITES);
-      stub1.GetCode();
-    }
-  }
-}
-
-void CommonArrayConstructorStub::GenerateStubsAheadOfTime(Isolate* isolate) {
-  ArrayConstructorStubAheadOfTimeHelper<ArrayNoArgumentConstructorStub>(
-      isolate);
-  ArrayConstructorStubAheadOfTimeHelper<ArraySingleArgumentConstructorStub>(
-      isolate);
-  ArrayNArgumentsConstructorStub stub(isolate);
-  stub.GetCode();
-  ElementsKind kinds[2] = {PACKED_ELEMENTS, HOLEY_ELEMENTS};
-  for (int i = 0; i < 2; i++) {
-    // For internal arrays we only need a few things.
-    InternalArrayNoArgumentConstructorStub stubh1(isolate, kinds[i]);
-    stubh1.GetCode();
-    InternalArraySingleArgumentConstructorStub stubh2(isolate, kinds[i]);
-    stubh2.GetCode();
-  }
-}
-
-
-void ArrayConstructorStub::GenerateDispatchToArrayStub(
-    MacroAssembler* masm,
-    AllocationSiteOverrideMode mode) {
-  Label not_zero_case, not_one_case;
-  __ And(at, a0, a0);
-  __ Branch(&not_zero_case, ne, at, Operand(zero_reg));
-  CreateArrayDispatch<ArrayNoArgumentConstructorStub>(masm, mode);
-
-  __ bind(&not_zero_case);
-  __ Branch(&not_one_case, gt, a0, Operand(1));
-  CreateArrayDispatchOneArgument(masm, mode);
-
-  __ bind(&not_one_case);
-  ArrayNArgumentsConstructorStub stub(masm->isolate());
-  __ TailCallStub(&stub);
-}
-
-
-void ArrayConstructorStub::Generate(MacroAssembler* masm) {
-  // ----------- S t a t e -------------
-  //  -- a0 : argc (only if argument_count() == ANY)
-  //  -- a1 : constructor
-  //  -- a2 : AllocationSite or undefined
-  //  -- a3 : new target
-  //  -- sp[0] : last argument
-  // -----------------------------------
-
-  if (FLAG_debug_code) {
-    // The array construct code is only set for the global and natives
-    // builtin Array functions which always have maps.
-
-    // Initial map for the builtin Array function should be a map.
-    __ Ld(a4, FieldMemOperand(a1, JSFunction::kPrototypeOrInitialMapOffset));
-    // Will both indicate a nullptr and a Smi.
-    __ SmiTst(a4, at);
-    __ Assert(ne, AbortReason::kUnexpectedInitialMapForArrayFunction, at,
-              Operand(zero_reg));
-    __ GetObjectType(a4, a4, a5);
-    __ Assert(eq, AbortReason::kUnexpectedInitialMapForArrayFunction, a5,
-              Operand(MAP_TYPE));
-
-    // We should either have undefined in a2 or a valid AllocationSite
-    __ AssertUndefinedOrAllocationSite(a2, a4);
-  }
-
-  // Enter the context of the Array function.
-  __ Ld(cp, FieldMemOperand(a1, JSFunction::kContextOffset));
-
-  Label subclassing;
-  __ Branch(&subclassing, ne, a1, Operand(a3));
-
-  Label no_info;
-  // Get the elements kind and case on that.
-  __ LoadRoot(at, Heap::kUndefinedValueRootIndex);
-  __ Branch(&no_info, eq, a2, Operand(at));
-
-  __ Ld(a3, FieldMemOperand(
-                a2, AllocationSite::kTransitionInfoOrBoilerplateOffset));
-  __ SmiUntag(a3);
-  STATIC_ASSERT(AllocationSite::ElementsKindBits::kShift == 0);
-  __ And(a3, a3, Operand(AllocationSite::ElementsKindBits::kMask));
-  GenerateDispatchToArrayStub(masm, DONT_OVERRIDE);
-
-  __ bind(&no_info);
-  GenerateDispatchToArrayStub(masm, DISABLE_ALLOCATION_SITES);
-
-  // Subclassing.
-  __ bind(&subclassing);
-  __ Dlsa(at, sp, a0, kPointerSizeLog2);
-  __ Sd(a1, MemOperand(at));
-  __ li(at, Operand(3));
-  __ Daddu(a0, a0, at);
-  __ Push(a3, a2);
-  __ JumpToExternalReference(ExternalReference(Runtime::kNewArray, isolate()));
-}
-
-
-void InternalArrayConstructorStub::GenerateCase(
-    MacroAssembler* masm, ElementsKind kind) {
-
-  InternalArrayNoArgumentConstructorStub stub0(isolate(), kind);
-  __ TailCallStub(&stub0, lo, a0, Operand(1));
-
-  ArrayNArgumentsConstructorStub stubN(isolate());
-  __ TailCallStub(&stubN, hi, a0, Operand(1));
-
-  if (IsFastPackedElementsKind(kind)) {
-    // We might need to create a holey array
-    // look at the first argument.
-    __ Ld(at, MemOperand(sp, 0));
-
-    InternalArraySingleArgumentConstructorStub
-        stub1_holey(isolate(), GetHoleyElementsKind(kind));
-    __ TailCallStub(&stub1_holey, ne, at, Operand(zero_reg));
-  }
-
-  InternalArraySingleArgumentConstructorStub stub1(isolate(), kind);
-  __ TailCallStub(&stub1);
-}
-
-
-void InternalArrayConstructorStub::Generate(MacroAssembler* masm) {
-  // ----------- S t a t e -------------
-  //  -- a0 : argc
-  //  -- a1 : constructor
-  //  -- sp[0] : return address
-  //  -- sp[4] : last argument
-  // -----------------------------------
-
-  if (FLAG_debug_code) {
-    // The array construct code is only set for the global and natives
-    // builtin Array functions which always have maps.
-
-    // Initial map for the builtin Array function should be a map.
-    __ Ld(a3, FieldMemOperand(a1, JSFunction::kPrototypeOrInitialMapOffset));
-    // Will both indicate a nullptr and a Smi.
-    __ SmiTst(a3, at);
-    __ Assert(ne, AbortReason::kUnexpectedInitialMapForArrayFunction, at,
-              Operand(zero_reg));
-    __ GetObjectType(a3, a3, a4);
-    __ Assert(eq, AbortReason::kUnexpectedInitialMapForArrayFunction, a4,
-              Operand(MAP_TYPE));
-  }
-
-  // Figure out the right elements kind.
-  __ Ld(a3, FieldMemOperand(a1, JSFunction::kPrototypeOrInitialMapOffset));
-
-  // Load the map's "bit field 2" into a3. We only need the first byte,
-  // but the following bit field extraction takes care of that anyway.
-  __ Lbu(a3, FieldMemOperand(a3, Map::kBitField2Offset));
-  // Retrieve elements_kind from bit field 2.
-  __ DecodeField<Map::ElementsKindBits>(a3);
-
-  if (FLAG_debug_code) {
-    Label done;
-    __ Branch(&done, eq, a3, Operand(PACKED_ELEMENTS));
-    __ Assert(
-        eq,
-        AbortReason::kInvalidElementsKindForInternalArrayOrInternalPackedArray,
-        a3, Operand(HOLEY_ELEMENTS));
-    __ bind(&done);
-  }
-
-  Label fast_elements_case;
-  __ Branch(&fast_elements_case, eq, a3, Operand(PACKED_ELEMENTS));
-  GenerateCase(masm, HOLEY_ELEMENTS);
-
-  __ bind(&fast_elements_case);
-  GenerateCase(masm, PACKED_ELEMENTS);
-}
-
 static int AddressOffset(ExternalReference ref0, ExternalReference ref1) {
   int64_t offset = (ref0.address() - ref1.address());
   DCHECK(static_cast<int>(offset) == offset);
@@ -1029,12 +339,12 @@ static void CallApiFunctionAndReturn(MacroAssembler* masm,
 
   Label profiler_disabled;
   Label end_profiler_check;
-  __ li(t9, Operand(ExternalReference::is_profiling_address(isolate)));
+  __ li(t9, ExternalReference::is_profiling_address(isolate));
   __ Lb(t9, MemOperand(t9, 0));
   __ Branch(&profiler_disabled, eq, t9, Operand(zero_reg));
 
   // Additional parameter is the address of the actual callback.
-  __ li(t9, Operand(thunk_ref));
+  __ li(t9, thunk_ref);
   __ jmp(&end_profiler_check);
 
   __ bind(&profiler_disabled);
@@ -1042,20 +352,19 @@ static void CallApiFunctionAndReturn(MacroAssembler* masm,
   __ bind(&end_profiler_check);
 
   // Allocate HandleScope in callee-save registers.
-  __ li(s3, Operand(next_address));
-  __ Ld(s0, MemOperand(s3, kNextOffset));
-  __ Ld(s1, MemOperand(s3, kLimitOffset));
-  __ Lw(s2, MemOperand(s3, kLevelOffset));
+  __ li(s5, next_address);
+  __ Ld(s0, MemOperand(s5, kNextOffset));
+  __ Ld(s1, MemOperand(s5, kLimitOffset));
+  __ Lw(s2, MemOperand(s5, kLevelOffset));
   __ Addu(s2, s2, Operand(1));
-  __ Sw(s2, MemOperand(s3, kLevelOffset));
+  __ Sw(s2, MemOperand(s5, kLevelOffset));
 
   if (FLAG_log_timer_events) {
     FrameScope frame(masm, StackFrame::MANUAL);
     __ PushSafepointRegisters();
     __ PrepareCallCFunction(1, a0);
-    __ li(a0, Operand(ExternalReference::isolate_address(isolate)));
-    __ CallCFunction(ExternalReference::log_enter_external_function(isolate),
-                     1);
+    __ li(a0, ExternalReference::isolate_address(isolate));
+    __ CallCFunction(ExternalReference::log_enter_external_function(), 1);
     __ PopSafepointRegisters();
   }
 
@@ -1069,9 +378,8 @@ static void CallApiFunctionAndReturn(MacroAssembler* masm,
     FrameScope frame(masm, StackFrame::MANUAL);
     __ PushSafepointRegisters();
     __ PrepareCallCFunction(1, a0);
-    __ li(a0, Operand(ExternalReference::isolate_address(isolate)));
-    __ CallCFunction(ExternalReference::log_leave_external_function(isolate),
-                     1);
+    __ li(a0, ExternalReference::isolate_address(isolate));
+    __ CallCFunction(ExternalReference::log_leave_external_function(), 1);
     __ PopSafepointRegisters();
   }
 
@@ -1086,16 +394,16 @@ static void CallApiFunctionAndReturn(MacroAssembler* masm,
 
   // No more valid handles (the result handle was the last one). Restore
   // previous handle scope.
-  __ Sd(s0, MemOperand(s3, kNextOffset));
+  __ Sd(s0, MemOperand(s5, kNextOffset));
   if (__ emit_debug_code()) {
-    __ Lw(a1, MemOperand(s3, kLevelOffset));
+    __ Lw(a1, MemOperand(s5, kLevelOffset));
     __ Check(eq, AbortReason::kUnexpectedLevelAfterReturnFromApiCall, a1,
              Operand(s2));
   }
   __ Subu(s2, s2, Operand(1));
-  __ Sw(s2, MemOperand(s3, kLevelOffset));
-  __ Ld(at, MemOperand(s3, kLimitOffset));
-  __ Branch(&delete_allocated_handles, ne, s1, Operand(at));
+  __ Sw(s2, MemOperand(s5, kLevelOffset));
+  __ Ld(kScratchReg, MemOperand(s5, kLimitOffset));
+  __ Branch(&delete_allocated_handles, ne, s1, Operand(kScratchReg));
 
   // Leave the API exit frame.
   __ bind(&leave_exit_frame);
@@ -1111,8 +419,8 @@ static void CallApiFunctionAndReturn(MacroAssembler* masm,
 
   // Check if the function scheduled an exception.
   __ LoadRoot(a4, Heap::kTheHoleValueRootIndex);
-  __ li(at, Operand(ExternalReference::scheduled_exception_address(isolate)));
-  __ Ld(a5, MemOperand(at));
+  __ li(kScratchReg, ExternalReference::scheduled_exception_address(isolate));
+  __ Ld(a5, MemOperand(kScratchReg));
   __ Branch(&promote_scheduled_exception, ne, a4, Operand(a5));
 
   __ Ret();
@@ -1123,13 +431,12 @@ static void CallApiFunctionAndReturn(MacroAssembler* masm,
 
   // HandleScope limit has changed. Delete allocated extensions.
   __ bind(&delete_allocated_handles);
-  __ Sd(s1, MemOperand(s3, kLimitOffset));
+  __ Sd(s1, MemOperand(s5, kLimitOffset));
   __ mov(s0, v0);
   __ mov(a0, v0);
   __ PrepareCallCFunction(1, s1);
-  __ li(a0, Operand(ExternalReference::isolate_address(isolate)));
-  __ CallCFunction(ExternalReference::delete_handle_scope_extensions(isolate),
-                   1);
+  __ li(a0, ExternalReference::isolate_address(isolate));
+  __ CallCFunction(ExternalReference::delete_handle_scope_extensions(), 1);
   __ mov(v0, s0);
   __ jmp(&leave_exit_frame);
 }
@@ -1171,7 +478,7 @@ void CallApiCallbackStub::Generate(MacroAssembler* masm) {
   __ LoadRoot(scratch, Heap::kUndefinedValueRootIndex);
   // Push return value and default return value.
   __ Push(scratch, scratch);
-  __ li(scratch, Operand(ExternalReference::isolate_address(masm->isolate())));
+  __ li(scratch, ExternalReference::isolate_address(masm->isolate()));
   // Push isolate and holder.
   __ Push(scratch, holder);
 
@@ -1192,17 +499,16 @@ void CallApiCallbackStub::Generate(MacroAssembler* masm) {
   // FunctionCallbackInfo::implicit_args_
   __ Sd(scratch, MemOperand(a0, 0 * kPointerSize));
   // FunctionCallbackInfo::values_
-  __ Daddu(at, scratch,
+  __ Daddu(kScratchReg, scratch,
            Operand((FCA::kArgsLength - 1 + argc()) * kPointerSize));
-  __ Sd(at, MemOperand(a0, 1 * kPointerSize));
+  __ Sd(kScratchReg, MemOperand(a0, 1 * kPointerSize));
   // FunctionCallbackInfo::length_ = argc
   // Stored as int field, 32-bit integers within struct on stack always left
   // justified by n64 ABI.
-  __ li(at, Operand(argc()));
-  __ Sw(at, MemOperand(a0, 2 * kPointerSize));
+  __ li(kScratchReg, Operand(argc()));
+  __ Sw(kScratchReg, MemOperand(a0, 2 * kPointerSize));
 
-  ExternalReference thunk_ref =
-      ExternalReference::invoke_function_callback(masm->isolate());
+  ExternalReference thunk_ref = ExternalReference::invoke_function_callback();
 
   AllowExternalCallThatCantCauseGC scope(masm);
   // Stores return the first js argument.
@@ -1246,7 +552,7 @@ void CallApiGetterStub::Generate(MacroAssembler* masm) {
   __ Sd(scratch, MemOperand(sp, (PCA::kReturnValueOffset + 1) * kPointerSize));
   __ Sd(scratch, MemOperand(sp, (PCA::kReturnValueDefaultValueIndex + 1) *
                                     kPointerSize));
-  __ li(scratch, Operand(ExternalReference::isolate_address(isolate())));
+  __ li(scratch, ExternalReference::isolate_address(isolate()));
   __ Sd(scratch, MemOperand(sp, (PCA::kIsolateIndex + 1) * kPointerSize));
   __ Sd(holder, MemOperand(sp, (PCA::kHolderIndex + 1) * kPointerSize));
   // should_throw_on_error -> false
@@ -1274,7 +580,7 @@ void CallApiGetterStub::Generate(MacroAssembler* masm) {
   // a1 = v8::PropertyCallbackInfo&
 
   ExternalReference thunk_ref =
-      ExternalReference::invoke_accessor_getter_callback(isolate());
+      ExternalReference::invoke_accessor_getter_callback();
 
   __ Ld(scratch, FieldMemOperand(callback, AccessorInfo::kJsGetterOffset));
   __ Ld(api_function_address,
diff --git a/deps/v8/src/mips64/constants-mips64.h b/deps/v8/src/mips64/constants-mips64.h
index e89c4a5df3dc65..9f3869dff2f4cc 100644
--- a/deps/v8/src/mips64/constants-mips64.h
+++ b/deps/v8/src/mips64/constants-mips64.h
@@ -82,12 +82,21 @@ const uint32_t kMipsSdlOffset = 0;
 #error Unknown endianness
 #endif
 
+#if defined(V8_TARGET_LITTLE_ENDIAN)
+const uint32_t kLeastSignificantByteInInt32Offset = 0;
+const uint32_t kLessSignificantWordInDoublewordOffset = 0;
+#elif defined(V8_TARGET_BIG_ENDIAN)
+const uint32_t kLeastSignificantByteInInt32Offset = 3;
+const uint32_t kLessSignificantWordInDoublewordOffset = 4;
+#else
+#error Unknown endianness
+#endif
+
 #ifndef __STDC_FORMAT_MACROS
 #define __STDC_FORMAT_MACROS
 #endif
 #include <inttypes.h>
 
-
 // Defines constants and accessor classes to assemble, disassemble and
 // simulate MIPS32 instructions.
 //
@@ -98,6 +107,9 @@ const uint32_t kMipsSdlOffset = 0;
 namespace v8 {
 namespace internal {
 
+// TODO(sigurds): Change this value once we use relative jumps.
+constexpr size_t kMaxPCRelativeCodeRangeInMB = 0;
+
 // -----------------------------------------------------------------------------
 // Registers and FPURegisters.
 
@@ -131,8 +143,8 @@ const int kMSALanesDword = kMSARegSize / 64;
 // FPU (coprocessor 1) control registers. Currently only FCSR is implemented.
 const int kFCSRRegister = 31;
 const int kInvalidFPUControlRegister = -1;
-const uint32_t kFPUInvalidResult = static_cast<uint32_t>(1 << 31) - 1;
-const int32_t kFPUInvalidResultNegative = static_cast<int32_t>(1 << 31);
+const uint32_t kFPUInvalidResult = static_cast<uint32_t>(1u << 31) - 1;
+const int32_t kFPUInvalidResultNegative = static_cast<int32_t>(1u << 31);
 const uint64_t kFPU64InvalidResult =
     static_cast<uint64_t>(static_cast<uint64_t>(1) << 63) - 1;
 const int64_t kFPU64InvalidResultNegative =
@@ -172,6 +184,11 @@ const int32_t kPrefHintStoreRetained = 7;
 const int32_t kPrefHintWritebackInvalidate = 25;
 const int32_t kPrefHintPrepareForStore = 30;
 
+// Actual value of root register is offset from the root array's start
+// to take advantage of negative displacement values.
+// TODO(sigurds): Choose best value.
+constexpr int kRootRegisterBias = 256;
+
 // Helper functions for converting between register numbers and names.
 class Registers {
  public:
diff --git a/deps/v8/src/mips64/deoptimizer-mips64.cc b/deps/v8/src/mips64/deoptimizer-mips64.cc
index 506143fe739d1a..1d3e88372ea61f 100644
--- a/deps/v8/src/mips64/deoptimizer-mips64.cc
+++ b/deps/v8/src/mips64/deoptimizer-mips64.cc
@@ -56,8 +56,8 @@ void Deoptimizer::TableEntryGenerator::Generate() {
     }
   }
 
-  __ li(a2, Operand(ExternalReference(IsolateAddressId::kCEntryFPAddress,
-                                      isolate())));
+  __ li(a2, Operand(ExternalReference::Create(
+                IsolateAddressId::kCEntryFPAddress, isolate())));
   __ Sd(fp, MemOperand(a2));
 
   const int kSavedRegistersAreaSize =
@@ -84,7 +84,7 @@ void Deoptimizer::TableEntryGenerator::Generate() {
   __ JumpIfSmi(a1, &context_check);
   __ Ld(a0, MemOperand(fp, JavaScriptFrameConstants::kFunctionOffset));
   __ bind(&context_check);
-  __ li(a1, Operand(type()));  // Bailout type.
+  __ li(a1, Operand(static_cast<int>(deopt_kind())));
   // a2: bailout id already loaded.
   // a3: code address or 0 already loaded.
   // a4: already has fp-to-sp delta.
@@ -93,7 +93,7 @@ void Deoptimizer::TableEntryGenerator::Generate() {
   // Call Deoptimizer::New().
   {
     AllowExternalCallThatCantCauseGC scope(masm());
-    __ CallCFunction(ExternalReference::new_deoptimizer_function(isolate()), 6);
+    __ CallCFunction(ExternalReference::new_deoptimizer_function(), 6);
   }
 
   // Preserve "deoptimizer" object in register v0 and get the input
@@ -166,8 +166,7 @@ void Deoptimizer::TableEntryGenerator::Generate() {
   // Call Deoptimizer::ComputeOutputFrames().
   {
     AllowExternalCallThatCantCauseGC scope(masm());
-    __ CallCFunction(
-        ExternalReference::compute_output_frames_function(isolate()), 1);
+    __ CallCFunction(ExternalReference::compute_output_frames_function(), 1);
   }
   __ pop(a0);  // Restore deoptimizer object (class Deoptimizer).
 
@@ -263,11 +262,11 @@ void Deoptimizer::TableEntryGenerator::GeneratePrologue() {
       __ bind(&start);
       DCHECK(is_int16(i));
       if (kArchVariant == kMips64r6) {
-        __ li(at, i);
+        __ li(kScratchReg, i);
         __ BranchShort(PROTECT, &done);
       } else {
         __ BranchShort(USE_DELAY_SLOT, &done);  // Expose delay slot.
-        __ li(at, i);                           // In the delay slot.
+        __ li(kScratchReg, i);                  // In the delay slot.
         __ nop();
       }
 
@@ -277,7 +276,7 @@ void Deoptimizer::TableEntryGenerator::GeneratePrologue() {
     DCHECK_EQ(masm()->SizeOfCodeGeneratedSince(&table_start),
               count() * table_entry_size_);
     __ bind(&done);
-    __ Push(at);
+    __ Push(kScratchReg);
   } else {
     DCHECK_NE(kArchVariant, kMips64r6);
     // Uncommon case, the branch cannot reach.
@@ -288,14 +287,14 @@ void Deoptimizer::TableEntryGenerator::GeneratePrologue() {
       DCHECK(is_int16(i));
       if (j >= kMaxEntriesBranchReach) {
         j = 0;
-        __ li(at, i);
+        __ li(kScratchReg, i);
         __ bind(&trampoline_jump);
         trampoline_jump = Label();
         __ BranchShort(USE_DELAY_SLOT, &trampoline_jump);
         __ nop();
       } else {
         __ BranchShort(USE_DELAY_SLOT, &trampoline_jump);  // Expose delay slot.
-        __ li(at, i);                                      // In the delay slot.
+        __ li(kScratchReg, i);                             // In the delay slot.
         __ nop();
       }
       DCHECK_EQ(table_entry_size_, masm()->SizeOfCodeGeneratedSince(&start));
@@ -304,7 +303,7 @@ void Deoptimizer::TableEntryGenerator::GeneratePrologue() {
     DCHECK_EQ(masm()->SizeOfCodeGeneratedSince(&table_start),
               count() * table_entry_size_);
     __ bind(&trampoline_jump);
-    __ Push(at);
+    __ Push(kScratchReg);
   }
 }
 
diff --git a/deps/v8/src/mips64/frame-constants-mips64.h b/deps/v8/src/mips64/frame-constants-mips64.h
index 22f01002c786fa..e91ccf9480bcb7 100644
--- a/deps/v8/src/mips64/frame-constants-mips64.h
+++ b/deps/v8/src/mips64/frame-constants-mips64.h
@@ -5,6 +5,9 @@
 #ifndef V8_MIPS64_FRAME_CONSTANTS_MIPS64_H_
 #define V8_MIPS64_FRAME_CONSTANTS_MIPS64_H_
 
+#include "src/base/macros.h"
+#include "src/frame-constants.h"
+
 namespace v8 {
 namespace internal {
 
@@ -34,6 +37,19 @@ class ExitFrameConstants : public TypedFrameConstants {
   static constexpr int kConstantPoolOffset = 0;  // Not used.
 };
 
+class WasmCompileLazyFrameConstants : public TypedFrameConstants {
+ public:
+  static constexpr int kNumberOfSavedGpParamRegs = 8;
+  static constexpr int kNumberOfSavedFpParamRegs = 7;
+
+  // FP-relative.
+  static constexpr int kWasmInstanceOffset = TYPED_FRAME_PUSHED_VALUE_OFFSET(7);
+  static constexpr int kFixedFrameSizeFromFp =
+      TypedFrameConstants::kFixedFrameSizeFromFp +
+      kNumberOfSavedGpParamRegs * kPointerSize +
+      kNumberOfSavedFpParamRegs * kDoubleSize;
+};
+
 class JavaScriptFrameConstants : public AllStatic {
  public:
   // FP-relative.
diff --git a/deps/v8/src/mips64/interface-descriptors-mips64.cc b/deps/v8/src/mips64/interface-descriptors-mips64.cc
index 6aba359b78ae76..94058aa7213a58 100644
--- a/deps/v8/src/mips64/interface-descriptors-mips64.cc
+++ b/deps/v8/src/mips64/interface-descriptors-mips64.cc
@@ -32,7 +32,7 @@ void RecordWriteDescriptor::InitializePlatformSpecific(
   data->InitializePlatformSpecific(kParameterCount, default_stub_registers);
 }
 
-const Register FastNewFunctionContextDescriptor::FunctionRegister() {
+const Register FastNewFunctionContextDescriptor::ScopeInfoRegister() {
   return a1;
 }
 const Register FastNewFunctionContextDescriptor::SlotsRegister() { return a0; }
@@ -57,13 +57,6 @@ const Register StoreTransitionDescriptor::MapRegister() { return a5; }
 const Register ApiGetterDescriptor::HolderRegister() { return a0; }
 const Register ApiGetterDescriptor::CallbackRegister() { return a3; }
 
-const Register MathPowTaggedDescriptor::exponent() { return a2; }
-
-const Register MathPowIntegerDescriptor::exponent() {
-  return MathPowTaggedDescriptor::exponent();
-}
-
-
 const Register GrowArrayElementsDescriptor::ObjectRegister() { return a0; }
 const Register GrowArrayElementsDescriptor::KeyRegister() { return a3; }
 
@@ -74,13 +67,13 @@ const Register TypeConversionDescriptor::ArgumentRegister() { return a0; }
 void TypeofDescriptor::InitializePlatformSpecific(
     CallInterfaceDescriptorData* data) {
   Register registers[] = {a3};
-  data->InitializePlatformSpecific(arraysize(registers), registers, nullptr);
+  data->InitializePlatformSpecific(arraysize(registers), registers);
 }
 
 void CallFunctionDescriptor::InitializePlatformSpecific(
     CallInterfaceDescriptorData* data) {
   Register registers[] = {a1};
-  data->InitializePlatformSpecific(arraysize(registers), registers, nullptr);
+  data->InitializePlatformSpecific(arraysize(registers), registers);
 }
 
 void CallTrampolineDescriptor::InitializePlatformSpecific(
@@ -177,24 +170,7 @@ void ConstructStubDescriptor::InitializePlatformSpecific(
   data->InitializePlatformSpecific(arraysize(registers), registers);
 }
 
-
-void ConstructTrampolineDescriptor::InitializePlatformSpecific(
-    CallInterfaceDescriptorData* data) {
-  // a1: target
-  // a3: new target
-  // a0: number of arguments
-  Register registers[] = {a1, a3, a0};
-  data->InitializePlatformSpecific(arraysize(registers), registers);
-}
-
-
-void TransitionElementsKindDescriptor::InitializePlatformSpecific(
-    CallInterfaceDescriptorData* data) {
-  Register registers[] = {a0, a1};
-  data->InitializePlatformSpecific(arraysize(registers), registers, nullptr);
-}
-
-void AbortJSDescriptor::InitializePlatformSpecific(
+void AbortDescriptor::InitializePlatformSpecific(
     CallInterfaceDescriptorData* data) {
   Register registers[] = {a0};
   data->InitializePlatformSpecific(arraysize(registers), registers);
@@ -203,60 +179,19 @@ void AbortJSDescriptor::InitializePlatformSpecific(
 void AllocateHeapNumberDescriptor::InitializePlatformSpecific(
     CallInterfaceDescriptorData* data) {
   // register state
-  data->InitializePlatformSpecific(0, nullptr, nullptr);
-}
-
-void ArrayConstructorDescriptor::InitializePlatformSpecific(
-    CallInterfaceDescriptorData* data) {
-  // kTarget, kNewTarget, kActualArgumentsCount, kAllocationSite
-  Register registers[] = {a1, a3, a0, a2};
-  data->InitializePlatformSpecific(arraysize(registers), registers, nullptr);
-}
-
-void ArrayNoArgumentConstructorDescriptor::InitializePlatformSpecific(
-    CallInterfaceDescriptorData* data) {
-  // register state
-  // a0 -- number of arguments
-  // a1 -- function
-  // a2 -- allocation site with elements kind
-  Register registers[] = {a1, a2, a0};
-  data->InitializePlatformSpecific(arraysize(registers), registers, nullptr);
-}
-
-void ArraySingleArgumentConstructorDescriptor::InitializePlatformSpecific(
-    CallInterfaceDescriptorData* data) {
-  // register state
-  // a0 -- number of arguments
-  // a1 -- function
-  // a2 -- allocation site with elements kind
-  Register registers[] = {a1, a2, a0};
-  data->InitializePlatformSpecific(arraysize(registers), registers, nullptr);
-}
-
-void ArrayNArgumentsConstructorDescriptor::InitializePlatformSpecific(
-    CallInterfaceDescriptorData* data) {
-  // stack param count needs (constructor pointer, and single argument)
-  Register registers[] = {a1, a2, a0};
-  data->InitializePlatformSpecific(arraysize(registers), registers);
+  data->InitializePlatformSpecific(0, nullptr);
 }
 
 void CompareDescriptor::InitializePlatformSpecific(
     CallInterfaceDescriptorData* data) {
   Register registers[] = {a1, a0};
-  data->InitializePlatformSpecific(arraysize(registers), registers, nullptr);
+  data->InitializePlatformSpecific(arraysize(registers), registers);
 }
 
-
 void BinaryOpDescriptor::InitializePlatformSpecific(
     CallInterfaceDescriptorData* data) {
   Register registers[] = {a1, a0};
-  data->InitializePlatformSpecific(arraysize(registers), registers, nullptr);
-}
-
-void StringAddDescriptor::InitializePlatformSpecific(
-    CallInterfaceDescriptorData* data) {
-  Register registers[] = {a1, a0};
-  data->InitializePlatformSpecific(arraysize(registers), registers, nullptr);
+  data->InitializePlatformSpecific(arraysize(registers), registers);
 }
 
 void ArgumentAdaptorDescriptor::InitializePlatformSpecific(
@@ -311,7 +246,9 @@ void InterpreterPushArgsThenConstructDescriptor::InitializePlatformSpecific(
   data->InitializePlatformSpecific(arraysize(registers), registers);
 }
 
-void InterpreterCEntryDescriptor::InitializePlatformSpecific(
+namespace {
+
+void InterpreterCEntryDescriptor_InitializePlatformSpecific(
     CallInterfaceDescriptorData* data) {
   Register registers[] = {
       a0,  // argument count (argc)
@@ -321,6 +258,18 @@ void InterpreterCEntryDescriptor::InitializePlatformSpecific(
   data->InitializePlatformSpecific(arraysize(registers), registers);
 }
 
+}  // namespace
+
+void InterpreterCEntry1Descriptor::InitializePlatformSpecific(
+    CallInterfaceDescriptorData* data) {
+  InterpreterCEntryDescriptor_InitializePlatformSpecific(data);
+}
+
+void InterpreterCEntry2Descriptor::InitializePlatformSpecific(
+    CallInterfaceDescriptorData* data) {
+  InterpreterCEntryDescriptor_InitializePlatformSpecific(data);
+}
+
 void ResumeGeneratorDescriptor::InitializePlatformSpecific(
     CallInterfaceDescriptorData* data) {
   Register registers[] = {
diff --git a/deps/v8/src/mips64/macro-assembler-mips64.cc b/deps/v8/src/mips64/macro-assembler-mips64.cc
index 69e9b06e543650..f5d671cb714ab6 100644
--- a/deps/v8/src/mips64/macro-assembler-mips64.cc
+++ b/deps/v8/src/mips64/macro-assembler-mips64.cc
@@ -10,6 +10,7 @@
 #include "src/base/division-by-constant.h"
 #include "src/bootstrapper.h"
 #include "src/callable.h"
+#include "src/code-factory.h"
 #include "src/code-stubs.h"
 #include "src/debug/debug.h"
 #include "src/external-reference-table.h"
@@ -19,22 +20,23 @@
 #include "src/mips64/macro-assembler-mips64.h"
 #include "src/register-configuration.h"
 #include "src/runtime/runtime.h"
+#include "src/snapshot/snapshot.h"
 
 namespace v8 {
 namespace internal {
 
-MacroAssembler::MacroAssembler(Isolate* isolate, void* buffer, int size,
-                               CodeObjectRequired create_code_object)
-    : TurboAssembler(isolate, buffer, size, create_code_object) {}
-
-TurboAssembler::TurboAssembler(Isolate* isolate, void* buffer, int buffer_size,
-                               CodeObjectRequired create_code_object)
-    : Assembler(isolate, buffer, buffer_size),
-      isolate_(isolate),
-      has_double_zero_reg_set_(false) {
+MacroAssembler::MacroAssembler(Isolate* isolate,
+                               const AssemblerOptions& options, void* buffer,
+                               int size, CodeObjectRequired create_code_object)
+    : TurboAssembler(isolate, options, buffer, size, create_code_object) {
   if (create_code_object == CodeObjectRequired::kYes) {
-    code_object_ =
-        Handle<HeapObject>::New(isolate->heap()->undefined_value(), isolate);
+    // Unlike TurboAssembler, which can be used off the main thread and may not
+    // allocate, macro assembler creates its own copy of the self-reference
+    // marker in order to disambiguate between self-references during nested
+    // code generation (e.g.: codegen of the current object triggers stub
+    // compilation through CodeStub::GetCode()).
+    code_object_ = Handle<HeapObject>::New(
+        *isolate->factory()->NewSelfReferenceMarker(), isolate);
   }
 }
 
@@ -125,14 +127,14 @@ int TurboAssembler::PopCallerSaved(SaveFPRegsMode fp_mode, Register exclusion1,
 }
 
 void TurboAssembler::LoadRoot(Register destination, Heap::RootListIndex index) {
-  Ld(destination, MemOperand(s6, index << kPointerSizeLog2));
+  Ld(destination, MemOperand(s6, RootRegisterOffset(index)));
 }
 
 void TurboAssembler::LoadRoot(Register destination, Heap::RootListIndex index,
                               Condition cond, Register src1,
                               const Operand& src2) {
   Branch(2, NegateCondition(cond), src1, src2);
-  Ld(destination, MemOperand(s6, index << kPointerSizeLog2));
+  Ld(destination, MemOperand(s6, RootRegisterOffset(index)));
 }
 
 
@@ -282,7 +284,7 @@ void TurboAssembler::CallRecordWriteStub(
   Pop(slot_parameter);
   Pop(object_parameter);
 
-  li(isolate_parameter, Operand(ExternalReference::isolate_address(isolate())));
+  li(isolate_parameter, ExternalReference::isolate_address(isolate()));
   Move(remembered_set_parameter, Smi::FromEnum(remembered_set_action));
   Move(fp_mode_parameter, Smi::FromEnum(fp_mode));
   Call(callable.code(), RelocInfo::CODE_TARGET);
@@ -1115,23 +1117,14 @@ void TurboAssembler::Bnvc(Register rs, Register rt, Label* L) {
 // Change endianness
 void TurboAssembler::ByteSwapSigned(Register dest, Register src,
                                     int operand_size) {
-  DCHECK(operand_size == 1 || operand_size == 2 || operand_size == 4 ||
-         operand_size == 8);
+  DCHECK(operand_size == 2 || operand_size == 4 || operand_size == 8);
   DCHECK(kArchVariant == kMips64r6 || kArchVariant == kMips64r2);
-  if (operand_size == 1) {
-    seb(src, src);
-    sll(src, src, 0);
-    dsbh(dest, src);
-    dshd(dest, dest);
-  } else if (operand_size == 2) {
-    seh(src, src);
-    sll(src, src, 0);
-    dsbh(dest, src);
-    dshd(dest, dest);
+  if (operand_size == 2) {
+    wsbh(dest, src);
+    seh(dest, dest);
   } else if (operand_size == 4) {
-    sll(src, src, 0);
-    dsbh(dest, src);
-    dshd(dest, dest);
+    wsbh(dest, src);
+    rotr(dest, dest, 16);
   } else {
     dsbh(dest, src);
     dshd(dest, dest);
@@ -1140,20 +1133,14 @@ void TurboAssembler::ByteSwapSigned(Register dest, Register src,
 
 void TurboAssembler::ByteSwapUnsigned(Register dest, Register src,
                                       int operand_size) {
-  DCHECK(operand_size == 1 || operand_size == 2 || operand_size == 4);
-  if (operand_size == 1) {
-    andi(src, src, 0xFF);
-    dsbh(dest, src);
-    dshd(dest, dest);
-  } else if (operand_size == 2) {
-    andi(src, src, 0xFFFF);
-    dsbh(dest, src);
-    dshd(dest, dest);
+  DCHECK(operand_size == 2 || operand_size == 4);
+  if (operand_size == 2) {
+    wsbh(dest, src);
+    andi(dest, dest, 0xFFFF);
   } else {
-    dsll32(src, src, 0);
-    dsrl32(src, src, 0);
-    dsbh(dest, src);
-    dshd(dest, dest);
+    wsbh(dest, src);
+    rotr(dest, dest, 16);
+    dinsu_(dest, zero_reg, 32, 32);
   }
 }
 
@@ -1559,6 +1546,22 @@ void TurboAssembler::Scd(Register rd, const MemOperand& rs) {
 }
 
 void TurboAssembler::li(Register dst, Handle<HeapObject> value, LiFlags mode) {
+  if (FLAG_embedded_builtins) {
+    if (root_array_available_ && options().isolate_independent_code) {
+      IndirectLoadConstant(dst, value);
+      return;
+    }
+  }
+  li(dst, Operand(value), mode);
+}
+
+void TurboAssembler::li(Register dst, ExternalReference value, LiFlags mode) {
+  if (FLAG_embedded_builtins) {
+    if (root_array_available_ && options().isolate_independent_code) {
+      IndirectLoadExternalReference(dst, value);
+      return;
+    }
+  }
   li(dst, Operand(value), mode);
 }
 
@@ -2066,6 +2069,7 @@ void TurboAssembler::Neg_s(FPURegister fd, FPURegister fs) {
     neg_s(fd, fs);
   } else {
     DCHECK_EQ(kArchVariant, kMips64r2);
+    BlockTrampolinePoolScope block_trampoline_pool(this);
     Label is_nan, done;
     Register scratch1 = t8;
     Register scratch2 = t9;
@@ -2090,6 +2094,7 @@ void TurboAssembler::Neg_d(FPURegister fd, FPURegister fs) {
     neg_d(fd, fs);
   } else {
     DCHECK_EQ(kArchVariant, kMips64r2);
+    BlockTrampolinePoolScope block_trampoline_pool(this);
     Label is_nan, done;
     Register scratch1 = t8;
     Register scratch2 = t9;
@@ -2247,25 +2252,29 @@ void MacroAssembler::Trunc_l_ud(FPURegister fd,
 
 void TurboAssembler::Trunc_uw_d(FPURegister fd, FPURegister fs,
                                 FPURegister scratch) {
-  Trunc_uw_d(fs, t8, scratch);
+  BlockTrampolinePoolScope block_trampoline_pool(this);
+  Trunc_uw_d(t8, fs, scratch);
   mtc1(t8, fd);
 }
 
 void TurboAssembler::Trunc_uw_s(FPURegister fd, FPURegister fs,
                                 FPURegister scratch) {
-  Trunc_uw_s(fs, t8, scratch);
+  BlockTrampolinePoolScope block_trampoline_pool(this);
+  Trunc_uw_s(t8, fs, scratch);
   mtc1(t8, fd);
 }
 
 void TurboAssembler::Trunc_ul_d(FPURegister fd, FPURegister fs,
                                 FPURegister scratch, Register result) {
-  Trunc_ul_d(fs, t8, scratch, result);
+  BlockTrampolinePoolScope block_trampoline_pool(this);
+  Trunc_ul_d(t8, fs, scratch, result);
   dmtc1(t8, fd);
 }
 
 void TurboAssembler::Trunc_ul_s(FPURegister fd, FPURegister fs,
                                 FPURegister scratch, Register result) {
-  Trunc_ul_s(fs, t8, scratch, result);
+  BlockTrampolinePoolScope block_trampoline_pool(this);
+  Trunc_ul_s(t8, fs, scratch, result);
   dmtc1(t8, fd);
 }
 
@@ -2289,10 +2298,10 @@ void MacroAssembler::Ceil_w_d(FPURegister fd, FPURegister fs) {
   ceil_w_d(fd, fs);
 }
 
-void TurboAssembler::Trunc_uw_d(FPURegister fd, Register rs,
+void TurboAssembler::Trunc_uw_d(Register rd, FPURegister fs,
                                 FPURegister scratch) {
-  DCHECK(fd != scratch);
-  DCHECK(rs != at);
+  DCHECK(fs != scratch);
+  DCHECK(rd != at);
 
   {
     // Load 2^31 into scratch as its float representation.
@@ -2305,30 +2314,30 @@ void TurboAssembler::Trunc_uw_d(FPURegister fd, Register rs,
   // Test if scratch > fd.
   // If fd < 2^31 we can convert it normally.
   Label simple_convert;
-  CompareF64(OLT, fd, scratch);
+  CompareF64(OLT, fs, scratch);
   BranchTrueShortF(&simple_convert);
 
   // First we subtract 2^31 from fd, then trunc it to rs
   // and add 2^31 to rs.
-  sub_d(scratch, fd, scratch);
+  sub_d(scratch, fs, scratch);
   trunc_w_d(scratch, scratch);
-  mfc1(rs, scratch);
-  Or(rs, rs, 1 << 31);
+  mfc1(rd, scratch);
+  Or(rd, rd, 1 << 31);
 
   Label done;
   Branch(&done);
   // Simple conversion.
   bind(&simple_convert);
-  trunc_w_d(scratch, fd);
-  mfc1(rs, scratch);
+  trunc_w_d(scratch, fs);
+  mfc1(rd, scratch);
 
   bind(&done);
 }
 
-void TurboAssembler::Trunc_uw_s(FPURegister fd, Register rs,
+void TurboAssembler::Trunc_uw_s(Register rd, FPURegister fs,
                                 FPURegister scratch) {
-  DCHECK(fd != scratch);
-  DCHECK(rs != at);
+  DCHECK(fs != scratch);
+  DCHECK(rd != at);
 
   {
     // Load 2^31 into scratch as its float representation.
@@ -2337,42 +2346,42 @@ void TurboAssembler::Trunc_uw_s(FPURegister fd, Register rs,
     li(scratch1, 0x4F000000);
     mtc1(scratch1, scratch);
   }
-  // Test if scratch > fd.
-  // If fd < 2^31 we can convert it normally.
+  // Test if scratch > fs.
+  // If fs < 2^31 we can convert it normally.
   Label simple_convert;
-  CompareF32(OLT, fd, scratch);
+  CompareF32(OLT, fs, scratch);
   BranchTrueShortF(&simple_convert);
 
-  // First we subtract 2^31 from fd, then trunc it to rs
-  // and add 2^31 to rs.
-  sub_s(scratch, fd, scratch);
+  // First we subtract 2^31 from fs, then trunc it to rd
+  // and add 2^31 to rd.
+  sub_s(scratch, fs, scratch);
   trunc_w_s(scratch, scratch);
-  mfc1(rs, scratch);
-  Or(rs, rs, 1 << 31);
+  mfc1(rd, scratch);
+  Or(rd, rd, 1 << 31);
 
   Label done;
   Branch(&done);
   // Simple conversion.
   bind(&simple_convert);
-  trunc_w_s(scratch, fd);
-  mfc1(rs, scratch);
+  trunc_w_s(scratch, fs);
+  mfc1(rd, scratch);
 
   bind(&done);
 }
 
-void TurboAssembler::Trunc_ul_d(FPURegister fd, Register rs,
+void TurboAssembler::Trunc_ul_d(Register rd, FPURegister fs,
                                 FPURegister scratch, Register result) {
-  DCHECK(fd != scratch);
-  DCHECK(!AreAliased(rs, result, at));
+  DCHECK(fs != scratch);
+  DCHECK(!AreAliased(rd, result, at));
 
   Label simple_convert, done, fail;
   if (result.is_valid()) {
     mov(result, zero_reg);
     Move(scratch, -1.0);
     // If fd =< -1 or unordered, then the conversion fails.
-    CompareF64(OLE, fd, scratch);
+    CompareF64(OLE, fs, scratch);
     BranchTrueShortF(&fail);
-    CompareIsNanF64(fd, scratch);
+    CompareIsNanF64(fs, scratch);
     BranchTrueShortF(&fail);
   }
 
@@ -2380,23 +2389,23 @@ void TurboAssembler::Trunc_ul_d(FPURegister fd, Register rs,
   li(at, 0x43E0000000000000);
   dmtc1(at, scratch);
 
-  // Test if scratch > fd.
-  // If fd < 2^63 we can convert it normally.
-  CompareF64(OLT, fd, scratch);
+  // Test if scratch > fs.
+  // If fs < 2^63 we can convert it normally.
+  CompareF64(OLT, fs, scratch);
   BranchTrueShortF(&simple_convert);
 
-  // First we subtract 2^63 from fd, then trunc it to rs
-  // and add 2^63 to rs.
-  sub_d(scratch, fd, scratch);
+  // First we subtract 2^63 from fs, then trunc it to rd
+  // and add 2^63 to rd.
+  sub_d(scratch, fs, scratch);
   trunc_l_d(scratch, scratch);
-  dmfc1(rs, scratch);
-  Or(rs, rs, Operand(1UL << 63));
+  dmfc1(rd, scratch);
+  Or(rd, rd, Operand(1UL << 63));
   Branch(&done);
 
   // Simple conversion.
   bind(&simple_convert);
-  trunc_l_d(scratch, fd);
-  dmfc1(rs, scratch);
+  trunc_l_d(scratch, fs);
+  dmfc1(rd, scratch);
 
   bind(&done);
   if (result.is_valid()) {
@@ -2415,19 +2424,19 @@ void TurboAssembler::Trunc_ul_d(FPURegister fd, Register rs,
   bind(&fail);
 }
 
-void TurboAssembler::Trunc_ul_s(FPURegister fd, Register rs,
+void TurboAssembler::Trunc_ul_s(Register rd, FPURegister fs,
                                 FPURegister scratch, Register result) {
-  DCHECK(fd != scratch);
-  DCHECK(!AreAliased(rs, result, at));
+  DCHECK(fs != scratch);
+  DCHECK(!AreAliased(rd, result, at));
 
   Label simple_convert, done, fail;
   if (result.is_valid()) {
     mov(result, zero_reg);
     Move(scratch, -1.0f);
     // If fd =< -1 or unordered, then the conversion fails.
-    CompareF32(OLE, fd, scratch);
+    CompareF32(OLE, fs, scratch);
     BranchTrueShortF(&fail);
-    CompareIsNanF32(fd, scratch);
+    CompareIsNanF32(fs, scratch);
     BranchTrueShortF(&fail);
   }
 
@@ -2439,23 +2448,23 @@ void TurboAssembler::Trunc_ul_s(FPURegister fd, Register rs,
     mtc1(scratch1, scratch);
   }
 
-  // Test if scratch > fd.
-  // If fd < 2^63 we can convert it normally.
-  CompareF32(OLT, fd, scratch);
+  // Test if scratch > fs.
+  // If fs < 2^63 we can convert it normally.
+  CompareF32(OLT, fs, scratch);
   BranchTrueShortF(&simple_convert);
 
-  // First we subtract 2^63 from fd, then trunc it to rs
-  // and add 2^63 to rs.
-  sub_s(scratch, fd, scratch);
+  // First we subtract 2^63 from fs, then trunc it to rd
+  // and add 2^63 to rd.
+  sub_s(scratch, fs, scratch);
   trunc_l_s(scratch, scratch);
-  dmfc1(rs, scratch);
-  Or(rs, rs, Operand(1UL << 63));
+  dmfc1(rd, scratch);
+  Or(rd, rd, Operand(1UL << 63));
   Branch(&done);
 
   // Simple conversion.
   bind(&simple_convert);
-  trunc_l_s(scratch, fd);
-  dmfc1(rs, scratch);
+  trunc_l_s(scratch, fs);
+  dmfc1(rd, scratch);
 
   bind(&done);
   if (result.is_valid()) {
@@ -2635,49 +2644,51 @@ void TurboAssembler::CompareIsNanF(SecondaryField sizeField, FPURegister cmp1,
   CompareF(sizeField, UN, cmp1, cmp2);
 }
 
-void TurboAssembler::BranchTrueShortF(Label* target) {
+void TurboAssembler::BranchTrueShortF(Label* target, BranchDelaySlot bd) {
   if (kArchVariant == kMips64r6) {
     bc1nez(target, kDoubleCompareReg);
-    nop();
   } else {
     bc1t(target);
+  }
+  if (bd == PROTECT) {
     nop();
   }
 }
 
-void TurboAssembler::BranchFalseShortF(Label* target) {
+void TurboAssembler::BranchFalseShortF(Label* target, BranchDelaySlot bd) {
   if (kArchVariant == kMips64r6) {
     bc1eqz(target, kDoubleCompareReg);
-    nop();
   } else {
     bc1f(target);
+  }
+  if (bd == PROTECT) {
     nop();
   }
 }
 
-void TurboAssembler::BranchTrueF(Label* target) {
+void TurboAssembler::BranchTrueF(Label* target, BranchDelaySlot bd) {
   bool long_branch =
       target->is_bound() ? !is_near(target) : is_trampoline_emitted();
   if (long_branch) {
     Label skip;
     BranchFalseShortF(&skip);
-    BranchLong(target, PROTECT);
+    BranchLong(target, bd);
     bind(&skip);
   } else {
-    BranchTrueShortF(target);
+    BranchTrueShortF(target, bd);
   }
 }
 
-void TurboAssembler::BranchFalseF(Label* target) {
+void TurboAssembler::BranchFalseF(Label* target, BranchDelaySlot bd) {
   bool long_branch =
       target->is_bound() ? !is_near(target) : is_trampoline_emitted();
   if (long_branch) {
     Label skip;
     BranchTrueShortF(&skip);
-    BranchLong(target, PROTECT);
+    BranchLong(target, bd);
     bind(&skip);
   } else {
-    BranchFalseShortF(target);
+    BranchFalseShortF(target, bd);
   }
 }
 
@@ -2938,6 +2949,24 @@ void TurboAssembler::LoadZeroIfConditionZero(Register dest,
   }
 }
 
+void TurboAssembler::LoadZeroIfFPUCondition(Register dest) {
+  if (kArchVariant == kMips64r6) {
+    dmfc1(kScratchReg, kDoubleCompareReg);
+    LoadZeroIfConditionNotZero(dest, kScratchReg);
+  } else {
+    Movt(dest, zero_reg);
+  }
+}
+
+void TurboAssembler::LoadZeroIfNotFPUCondition(Register dest) {
+  if (kArchVariant == kMips64r6) {
+    dmfc1(kScratchReg, kDoubleCompareReg);
+    LoadZeroIfConditionZero(dest, kScratchReg);
+  } else {
+    Movf(dest, zero_reg);
+  }
+}
+
 void TurboAssembler::Movt(Register rd, Register rs, uint16_t cc) {
   movt(rd, rs, cc);
 }
@@ -3167,8 +3196,10 @@ void TurboAssembler::TryInlineTruncateDoubleToI(Register result,
   Branch(done, eq, scratch, Operand(zero_reg));
 }
 
-void TurboAssembler::TruncateDoubleToIDelayed(Zone* zone, Register result,
-                                              DoubleRegister double_input) {
+void TurboAssembler::TruncateDoubleToI(Isolate* isolate, Zone* zone,
+                                       Register result,
+                                       DoubleRegister double_input,
+                                       StubCallMode stub_mode) {
   Label done;
 
   TryInlineTruncateDoubleToI(result, double_input, &done);
@@ -3178,7 +3209,12 @@ void TurboAssembler::TruncateDoubleToIDelayed(Zone* zone, Register result,
   Dsubu(sp, sp, Operand(kDoubleSize));  // Put input on stack.
   Sdc1(double_input, MemOperand(sp, 0));
 
-  CallStubDelayed(new (zone) DoubleToIStub(nullptr, result));
+  if (stub_mode == StubCallMode::kCallWasmRuntimeStub) {
+    Call(wasm::WasmCode::kDoubleToI, RelocInfo::WASM_STUB_CALL);
+  } else {
+    Call(BUILTIN_CODE(isolate, DoubleToI), RelocInfo::CODE_TARGET);
+  }
+  Ld(result, MemOperand(sp, 0));
 
   Daddu(sp, sp, Operand(kDoubleSize));
   pop(ra);
@@ -4061,6 +4097,29 @@ bool TurboAssembler::BranchAndLinkShortCheck(int32_t offset, Label* L,
   return false;
 }
 
+void TurboAssembler::LoadFromConstantsTable(Register destination,
+                                            int constant_index) {
+  DCHECK(isolate()->heap()->RootCanBeTreatedAsConstant(
+      Heap::kBuiltinsConstantsTableRootIndex));
+  LoadRoot(destination, Heap::kBuiltinsConstantsTableRootIndex);
+  Ld(destination,
+     FieldMemOperand(destination,
+                     FixedArray::kHeaderSize + constant_index * kPointerSize));
+}
+
+void TurboAssembler::LoadRootRelative(Register destination, int32_t offset) {
+  Ld(destination, MemOperand(kRootRegister, offset));
+}
+
+void TurboAssembler::LoadRootRegisterOffset(Register destination,
+                                            intptr_t offset) {
+  if (offset == 0) {
+    Move(destination, kRootRegister);
+  } else {
+    Daddu(destination, kRootRegister, Operand(offset));
+  }
+}
+
 void TurboAssembler::Jump(Register target, Condition cond, Register rs,
                           const Operand& rt, BranchDelaySlot bd) {
   BlockTrampolinePoolScope block_trampoline_pool(this);
@@ -4102,14 +4161,34 @@ void TurboAssembler::Jump(intptr_t target, RelocInfo::Mode rmode,
 void TurboAssembler::Jump(Address target, RelocInfo::Mode rmode, Condition cond,
                           Register rs, const Operand& rt, BranchDelaySlot bd) {
   DCHECK(!RelocInfo::IsCodeTarget(rmode));
-  Jump(reinterpret_cast<intptr_t>(target), rmode, cond, rs, rt, bd);
+  Jump(static_cast<intptr_t>(target), rmode, cond, rs, rt, bd);
 }
 
 void TurboAssembler::Jump(Handle<Code> code, RelocInfo::Mode rmode,
                           Condition cond, Register rs, const Operand& rt,
                           BranchDelaySlot bd) {
   DCHECK(RelocInfo::IsCodeTarget(rmode));
-  Jump(reinterpret_cast<intptr_t>(code.address()), rmode, cond, rs, rt, bd);
+  if (FLAG_embedded_builtins) {
+    if (root_array_available_ && options().isolate_independent_code) {
+      IndirectLoadConstant(t9, code);
+      Daddu(t9, t9, Operand(Code::kHeaderSize - kHeapObjectTag));
+      Jump(t9, cond, rs, rt, bd);
+      return;
+    } else if (options().inline_offheap_trampolines) {
+      int builtin_index = Builtins::kNoBuiltinId;
+      if (isolate()->builtins()->IsBuiltinHandle(code, &builtin_index) &&
+          Builtins::IsIsolateIndependent(builtin_index)) {
+        // Inline the trampoline.
+        CHECK_NE(builtin_index, Builtins::kNoBuiltinId);
+        EmbeddedData d = EmbeddedData::FromBlob();
+        Address entry = d.InstructionStartOfBuiltin(builtin_index);
+        li(t9, Operand(entry, RelocInfo::OFF_HEAP_TARGET));
+        Jump(t9, cond, rs, rt, bd);
+        return;
+      }
+    }
+  }
+  Jump(static_cast<intptr_t>(code.address()), rmode, cond, rs, rt, bd);
 }
 
 int TurboAssembler::CallSize(Register target, Condition cond, Register rs,
@@ -4176,8 +4255,7 @@ void TurboAssembler::Call(Address target, RelocInfo::Mode rmode, Condition cond,
   BlockTrampolinePoolScope block_trampoline_pool(this);
   Label start;
   bind(&start);
-  int64_t target_int = reinterpret_cast<int64_t>(target);
-  li(t9, Operand(target_int, rmode), ADDRESS_LOAD);
+  li(t9, Operand(static_cast<int64_t>(target), rmode), ADDRESS_LOAD);
   Call(t9, cond, rs, rt, bd);
   DCHECK_EQ(CallSize(target, rmode, cond, rs, rt, bd),
             SizeOfCodeGeneratedSince(&start));
@@ -4193,6 +4271,26 @@ void TurboAssembler::Call(Handle<Code> code, RelocInfo::Mode rmode,
                           Condition cond, Register rs, const Operand& rt,
                           BranchDelaySlot bd) {
   BlockTrampolinePoolScope block_trampoline_pool(this);
+  if (FLAG_embedded_builtins) {
+    if (root_array_available_ && options().isolate_independent_code) {
+      IndirectLoadConstant(t9, code);
+      Daddu(t9, t9, Operand(Code::kHeaderSize - kHeapObjectTag));
+      Call(t9, cond, rs, rt, bd);
+      return;
+    } else if (options().inline_offheap_trampolines) {
+      int builtin_index = Builtins::kNoBuiltinId;
+      if (isolate()->builtins()->IsBuiltinHandle(code, &builtin_index) &&
+          Builtins::IsIsolateIndependent(builtin_index)) {
+        // Inline the trampoline.
+        CHECK_NE(builtin_index, Builtins::kNoBuiltinId);
+        EmbeddedData d = EmbeddedData::FromBlob();
+        Address entry = d.InstructionStartOfBuiltin(builtin_index);
+        li(t9, Operand(entry, RelocInfo::OFF_HEAP_TARGET));
+        Call(t9, cond, rs, rt, bd);
+        return;
+      }
+    }
+  }
   Label start;
   bind(&start);
   DCHECK(RelocInfo::IsCodeTarget(rmode));
@@ -4319,9 +4417,7 @@ void TurboAssembler::Push(Handle<HeapObject> handle) {
 
 void MacroAssembler::MaybeDropFrames() {
   // Check whether we need to drop frames to restart a function on the stack.
-  ExternalReference restart_fp =
-      ExternalReference::debug_restart_fp_address(isolate());
-  li(a1, Operand(restart_fp));
+  li(a1, ExternalReference::debug_restart_fp_address(isolate()));
   Ld(a1, MemOperand(a1));
   Jump(BUILTIN_CODE(isolate(), FrameDropperTrampoline), RelocInfo::CODE_TARGET,
        ne, a1, Operand(zero_reg));
@@ -4339,7 +4435,7 @@ void MacroAssembler::PushStackHandler() {
 
   // Link the current handler as the next handler.
   li(a6,
-     Operand(ExternalReference(IsolateAddressId::kHandlerAddress, isolate())));
+     ExternalReference::Create(IsolateAddressId::kHandlerAddress, isolate()));
   Ld(a5, MemOperand(a6));
   push(a5);
 
@@ -4356,7 +4452,7 @@ void MacroAssembler::PopStackHandler() {
   UseScratchRegisterScope temps(this);
   Register scratch = temps.Acquire();
   li(scratch,
-     Operand(ExternalReference(IsolateAddressId::kHandlerAddress, isolate())));
+     ExternalReference::Create(IsolateAddressId::kHandlerAddress, isolate()));
   Sd(a1, MemOperand(scratch));
 }
 
@@ -4564,13 +4660,19 @@ void MacroAssembler::CheckDebugHook(Register fun, Register new_target,
                                     const ParameterCount& actual) {
   Label skip_hook;
 
-  ExternalReference debug_hook_active =
-      ExternalReference::debug_hook_on_function_call_address(isolate());
-  li(t0, Operand(debug_hook_active));
+  li(t0, ExternalReference::debug_hook_on_function_call_address(isolate()));
   Lb(t0, MemOperand(t0));
   Branch(&skip_hook, eq, t0, Operand(zero_reg));
 
   {
+    // Load receiver to pass it later to DebugOnFunctionCall hook.
+    if (actual.is_reg()) {
+      mov(t0, actual.reg());
+    } else {
+      li(t0, actual.immediate());
+    }
+    Dlsa(t0, sp, t0, kPointerSizeLog2);
+    Ld(t0, MemOperand(t0));
     FrameScope frame(this,
                      has_frame() ? StackFrame::NONE : StackFrame::INTERNAL);
     if (expected.is_reg()) {
@@ -4586,6 +4688,7 @@ void MacroAssembler::CheckDebugHook(Register fun, Register new_target,
     }
     Push(fun);
     Push(fun);
+    Push(t0);
     CallRuntime(Runtime::kDebugOnFunctionCall);
     Pop(fun);
     if (new_target.is_valid()) {
@@ -4655,11 +4758,10 @@ void MacroAssembler::InvokeFunction(Register function, Register new_target,
   Register temp_reg = t0;
   Ld(temp_reg, FieldMemOperand(a1, JSFunction::kSharedFunctionInfoOffset));
   Ld(cp, FieldMemOperand(a1, JSFunction::kContextOffset));
-  // The argument count is stored as int32_t on 64-bit platforms.
-  // TODO(plind): Smi on 32-bit platforms.
-  Lw(expected_reg,
-     FieldMemOperand(temp_reg,
-                     SharedFunctionInfo::kFormalParameterCountOffset));
+  // The argument count is stored as uint16_t
+  Lhu(expected_reg,
+      FieldMemOperand(temp_reg,
+                      SharedFunctionInfo::kFormalParameterCountOffset));
   ParameterCount expected(expected_reg);
   InvokeFunctionCode(a1, new_target, expected, actual, flag);
 }
@@ -4815,22 +4917,22 @@ void TurboAssembler::MulOverflow(Register dst, Register left,
   xor_(overflow, overflow, scratch);
 }
 
-void TurboAssembler::CallRuntimeDelayed(Zone* zone, Runtime::FunctionId fid,
-                                        SaveFPRegsMode save_doubles,
-                                        BranchDelaySlot bd) {
+void TurboAssembler::CallRuntimeWithCEntry(Runtime::FunctionId fid,
+                                           Register centry) {
   const Runtime::Function* f = Runtime::FunctionForId(fid);
   // TODO(1236192): Most runtime routines don't need the number of
   // arguments passed in because it is constant. At some point we
   // should remove this need and make the runtime routine entry code
   // smarter.
   PrepareCEntryArgs(f->nargs);
-  PrepareCEntryFunction(ExternalReference(f, isolate()));
-  CallStubDelayed(new (zone) CEntryStub(nullptr, 1, save_doubles));
+  PrepareCEntryFunction(ExternalReference::Create(f));
+  DCHECK(!AreAliased(centry, a0, a1));
+  Daddu(centry, centry, Operand(Code::kHeaderSize - kHeapObjectTag));
+  Call(centry);
 }
 
 void MacroAssembler::CallRuntime(const Runtime::Function* f, int num_arguments,
-                                 SaveFPRegsMode save_doubles,
-                                 BranchDelaySlot bd) {
+                                 SaveFPRegsMode save_doubles) {
   // All parameters are on the stack. v0 has the return value after call.
 
   // If the expected number of arguments of the runtime function is
@@ -4843,9 +4945,10 @@ void MacroAssembler::CallRuntime(const Runtime::Function* f, int num_arguments,
   // should remove this need and make the runtime routine entry code
   // smarter.
   PrepareCEntryArgs(num_arguments);
-  PrepareCEntryFunction(ExternalReference(f, isolate()));
-  CEntryStub stub(isolate(), 1, save_doubles);
-  CallStub(&stub, al, zero_reg, Operand(zero_reg), bd);
+  PrepareCEntryFunction(ExternalReference::Create(f));
+  Handle<Code> code =
+      CodeFactory::CEntry(isolate(), f->result_size, save_doubles);
+  Call(code, RelocInfo::CODE_TARGET);
 }
 
 void MacroAssembler::TailCallRuntime(Runtime::FunctionId fid) {
@@ -4854,26 +4957,20 @@ void MacroAssembler::TailCallRuntime(Runtime::FunctionId fid) {
   if (function->nargs >= 0) {
     PrepareCEntryArgs(function->nargs);
   }
-  JumpToExternalReference(ExternalReference(fid, isolate()));
+  JumpToExternalReference(ExternalReference::Create(fid));
 }
 
 void MacroAssembler::JumpToExternalReference(const ExternalReference& builtin,
                                              BranchDelaySlot bd,
                                              bool builtin_exit_frame) {
   PrepareCEntryFunction(builtin);
-  CEntryStub stub(isolate(), 1, kDontSaveFPRegs, kArgvOnStack,
-                  builtin_exit_frame);
-  Jump(stub.GetCode(),
-       RelocInfo::CODE_TARGET,
-       al,
-       zero_reg,
-       Operand(zero_reg),
-       bd);
+  Handle<Code> code = CodeFactory::CEntry(isolate(), 1, kDontSaveFPRegs,
+                                          kArgvOnStack, builtin_exit_frame);
+  Jump(code, RelocInfo::CODE_TARGET, al, zero_reg, Operand(zero_reg), bd);
 }
 
 void MacroAssembler::JumpToInstructionStream(Address entry) {
-  li(kOffHeapTrampolineRegister,
-     Operand(reinterpret_cast<uint64_t>(entry), RelocInfo::OFF_HEAP_TARGET));
+  li(kOffHeapTrampolineRegister, Operand(entry, RelocInfo::OFF_HEAP_TARGET));
   Jump(kOffHeapTrampolineRegister);
 }
 
@@ -4888,7 +4985,7 @@ void MacroAssembler::IncrementCounter(StatsCounter* counter, int value,
                                       Register scratch1, Register scratch2) {
   DCHECK_GT(value, 0);
   if (FLAG_native_code_counters && counter->Enabled()) {
-    li(scratch2, Operand(ExternalReference(counter)));
+    li(scratch2, ExternalReference::Create(counter));
     Lw(scratch1, MemOperand(scratch2));
     Addu(scratch1, scratch1, Operand(value));
     Sw(scratch1, MemOperand(scratch2));
@@ -4900,7 +4997,7 @@ void MacroAssembler::DecrementCounter(StatsCounter* counter, int value,
                                       Register scratch1, Register scratch2) {
   DCHECK_GT(value, 0);
   if (FLAG_native_code_counters && counter->Enabled()) {
-    li(scratch2, Operand(ExternalReference(counter)));
+    li(scratch2, ExternalReference::Create(counter));
     Lw(scratch1, MemOperand(scratch2));
     Subu(scratch1, scratch1, Operand(value));
     Sw(scratch1, MemOperand(scratch2));
@@ -4929,18 +5026,17 @@ void TurboAssembler::Check(Condition cc, AbortReason reason, Register rs,
 void TurboAssembler::Abort(AbortReason reason) {
   Label abort_start;
   bind(&abort_start);
-#ifdef DEBUG
   const char* msg = GetAbortReason(reason);
-  if (msg != nullptr) {
-    RecordComment("Abort message: ");
-    RecordComment(msg);
-  }
+#ifdef DEBUG
+  RecordComment("Abort message: ");
+  RecordComment(msg);
+#endif
 
-  if (FLAG_trap_on_abort) {
+  // Avoid emitting call to builtin if requested.
+  if (trap_on_abort()) {
     stop(msg);
     return;
   }
-#endif
 
   Move(a0, Smi::FromInt(static_cast<int>(reason)));
 
@@ -4985,14 +5081,8 @@ void TurboAssembler::StubPrologue(StackFrame::Type type) {
 void TurboAssembler::Prologue() { PushStandardFrame(a1); }
 
 void TurboAssembler::EnterFrame(StackFrame::Type type) {
-  int stack_offset, fp_offset;
-  if (type == StackFrame::INTERNAL) {
-    stack_offset = -4 * kPointerSize;
-    fp_offset = 2 * kPointerSize;
-  } else {
-    stack_offset = -3 * kPointerSize;
-    fp_offset = 1 * kPointerSize;
-  }
+  int stack_offset = -3 * kPointerSize;
+  const int fp_offset = 1 * kPointerSize;
   daddiu(sp, sp, stack_offset);
   stack_offset = -stack_offset - kPointerSize;
   Sd(ra, MemOperand(sp, stack_offset));
@@ -5001,14 +5091,8 @@ void TurboAssembler::EnterFrame(StackFrame::Type type) {
   stack_offset -= kPointerSize;
   li(t9, Operand(StackFrame::TypeToMarker(type)));
   Sd(t9, MemOperand(sp, stack_offset));
-  if (type == StackFrame::INTERNAL) {
-    DCHECK_EQ(stack_offset, kPointerSize);
-    li(t9, Operand(CodeObject()));
-    Sd(t9, MemOperand(sp, 0));
-  } else {
-    DCHECK_EQ(stack_offset, 0);
-  }
   // Adjust FP to point to saved FP.
+  DCHECK_EQ(stack_offset, 0);
   Daddu(fp, sp, Operand(fp_offset));
 }
 
@@ -5069,15 +5153,15 @@ void MacroAssembler::EnterExitFrame(bool save_doubles, int stack_space,
   }
 
   // Accessed from ExitFrame::code_slot.
-  li(t8, Operand(CodeObject()), CONSTANT_SIZE);
+  li(t8, CodeObject(), CONSTANT_SIZE);
   Sd(t8, MemOperand(fp, ExitFrameConstants::kCodeOffset));
 
   // Save the frame pointer and the context in top.
   li(t8,
-     Operand(ExternalReference(IsolateAddressId::kCEntryFPAddress, isolate())));
+     ExternalReference::Create(IsolateAddressId::kCEntryFPAddress, isolate()));
   Sd(fp, MemOperand(t8));
   li(t8,
-     Operand(ExternalReference(IsolateAddressId::kContextAddress, isolate())));
+     ExternalReference::Create(IsolateAddressId::kContextAddress, isolate()));
   Sd(cp, MemOperand(t8));
 
   const int frame_alignment = MacroAssembler::ActivationFrameAlignment();
@@ -5128,17 +5212,17 @@ void MacroAssembler::LeaveExitFrame(bool save_doubles, Register argument_count,
 
   // Clear top frame.
   li(t8,
-     Operand(ExternalReference(IsolateAddressId::kCEntryFPAddress, isolate())));
+     ExternalReference::Create(IsolateAddressId::kCEntryFPAddress, isolate()));
   Sd(zero_reg, MemOperand(t8));
 
   // Restore current context from top and clear it in debug mode.
   li(t8,
-     Operand(ExternalReference(IsolateAddressId::kContextAddress, isolate())));
+     ExternalReference::Create(IsolateAddressId::kContextAddress, isolate()));
   Ld(cp, MemOperand(t8));
 
 #ifdef DEBUG
   li(t8,
-     Operand(ExternalReference(IsolateAddressId::kContextAddress, isolate())));
+     ExternalReference::Create(IsolateAddressId::kContextAddress, isolate()));
   Sd(a3, MemOperand(t8));
 #endif
 
@@ -5200,10 +5284,11 @@ void MacroAssembler::AssertStackIsAligned() {
     }
 }
 
-void MacroAssembler::SmiLoadUntag(Register dst, MemOperand src) {
+void TurboAssembler::SmiUntag(Register dst, const MemOperand& src) {
   if (SmiValuesAre32Bits()) {
-    Lw(dst, UntagSmiMemOperand(src.rm(), src.offset()));
+    Lw(dst, MemOperand(src.rm(), SmiWordOffset(src.offset())));
   } else {
+    DCHECK(SmiValuesAre31Bits());
     Lw(dst, src);
     SmiUntag(dst);
   }
@@ -5274,18 +5359,6 @@ void MacroAssembler::AssertSmi(Register object) {
   }
 }
 
-void MacroAssembler::AssertFixedArray(Register object) {
-  if (emit_debug_code()) {
-    STATIC_ASSERT(kSmiTag == 0);
-    SmiTst(object, t8);
-    Check(ne, AbortReason::kOperandIsASmiAndNotAFixedArray, t8,
-          Operand(zero_reg));
-    GetObjectType(object, t8, t8);
-    Check(eq, AbortReason::kOperandIsNotAFixedArray, t8,
-          Operand(FIXED_ARRAY_TYPE));
-  }
-}
-
 void MacroAssembler::AssertConstructor(Register object) {
   if (emit_debug_code()) {
     STATIC_ASSERT(kSmiTag == 0);
@@ -5354,9 +5427,9 @@ void MacroAssembler::AssertUndefinedOrAllocationSite(Register object,
     AssertNotSmi(object);
     LoadRoot(scratch, Heap::kUndefinedValueRootIndex);
     Branch(&done_checking, eq, object, Operand(scratch));
-    Ld(t8, FieldMemOperand(object, HeapObject::kMapOffset));
-    LoadRoot(scratch, Heap::kAllocationSiteMapRootIndex);
-    Assert(eq, AbortReason::kExpectedUndefinedOrCell, t8, Operand(scratch));
+    GetObjectType(object, scratch, scratch);
+    Assert(eq, AbortReason::kExpectedUndefinedOrCell, scratch,
+           Operand(ALLOCATION_SITE_TYPE));
     bind(&done_checking);
   }
 }
@@ -5599,7 +5672,7 @@ void TurboAssembler::PrepareCallCFunction(int num_reg_arguments,
 void TurboAssembler::CallCFunction(ExternalReference function,
                                    int num_reg_arguments,
                                    int num_double_arguments) {
-  li(t9, Operand(function));
+  li(t9, function);
   CallCFunctionHelper(t9, num_reg_arguments, num_double_arguments);
 }
 
diff --git a/deps/v8/src/mips64/macro-assembler-mips64.h b/deps/v8/src/mips64/macro-assembler-mips64.h
index 23ce8d2a96b0cf..36365681367b4e 100644
--- a/deps/v8/src/mips64/macro-assembler-mips64.h
+++ b/deps/v8/src/mips64/macro-assembler-mips64.h
@@ -8,6 +8,7 @@
 #include "src/assembler.h"
 #include "src/globals.h"
 #include "src/mips64/assembler-mips64.h"
+#include "src/turbo-assembler.h"
 
 namespace v8 {
 namespace internal {
@@ -24,14 +25,20 @@ constexpr Register kInterpreterAccumulatorRegister = v0;
 constexpr Register kInterpreterBytecodeOffsetRegister = t0;
 constexpr Register kInterpreterBytecodeArrayRegister = t1;
 constexpr Register kInterpreterDispatchTableRegister = t2;
+
 constexpr Register kJavaScriptCallArgCountRegister = a0;
 constexpr Register kJavaScriptCallCodeStartRegister = a2;
+constexpr Register kJavaScriptCallTargetRegister = kJSFunctionRegister;
 constexpr Register kJavaScriptCallNewTargetRegister = a3;
+constexpr Register kJavaScriptCallExtraArg1Register = a2;
+
 constexpr Register kOffHeapTrampolineRegister = at;
 constexpr Register kRuntimeCallFunctionRegister = a1;
 constexpr Register kRuntimeCallArgCountRegister = a0;
+constexpr Register kWasmInstanceRegister = a0;
 
-// Forward declaration.
+// Forward declarations.
+enum class AbortReason;
 class JumpTarget;
 
 // Reserved Register Usage Summary.
@@ -129,18 +136,6 @@ inline MemOperand FieldMemOperand(Register object, int offset) {
 }
 
 
-inline MemOperand UntagSmiMemOperand(Register rm, int offset) {
-  // Assumes that Smis are shifted by 32 bits.
-  STATIC_ASSERT(kSmiShift == 32);
-  return MemOperand(rm, SmiWordOffset(offset));
-}
-
-
-inline MemOperand UntagSmiFieldMemOperand(Register rm, int offset) {
-  return UntagSmiMemOperand(rm, offset - kHeapObjectTag);
-}
-
-
 // Generate a MemOperand for storing arguments 5..N on the stack
 // when calling CallCFunction().
 // TODO(plind): Currently ONLY used for O32. Should be fixed for
@@ -153,20 +148,13 @@ inline MemOperand CFunctionArgumentOperand(int index) {
   return MemOperand(sp, offset);
 }
 
-class TurboAssembler : public Assembler {
+class TurboAssembler : public TurboAssemblerBase {
  public:
-  TurboAssembler(Isolate* isolate, void* buffer, int buffer_size,
-                 CodeObjectRequired create_code_object);
-
-  void set_has_frame(bool value) { has_frame_ = value; }
-  bool has_frame() const { return has_frame_; }
-
-  Isolate* isolate() const { return isolate_; }
-
-  Handle<HeapObject> CodeObject() {
-    DCHECK(!code_object_.is_null());
-    return code_object_;
-  }
+  TurboAssembler(Isolate* isolate, const AssemblerOptions& options,
+                 void* buffer, int buffer_size,
+                 CodeObjectRequired create_code_object)
+      : TurboAssemblerBase(isolate, options, buffer, buffer_size,
+                           create_code_object) {}
 
   // Activation support.
   void EnterFrame(StackFrame::Type type);
@@ -184,6 +172,7 @@ class TurboAssembler : public Assembler {
     ExternalReference roots_array_start =
         ExternalReference::roots_array_start(isolate());
     li(kRootRegister, Operand(roots_array_start));
+    daddiu(kRootRegister, kRootRegister, kRootRegisterBias);
   }
 
   // Jump unconditionally to given label.
@@ -256,11 +245,11 @@ class TurboAssembler : public Assembler {
     CompareIsNanF(D, cmp1, cmp2);
   }
 
-  void BranchTrueShortF(Label* target);
-  void BranchFalseShortF(Label* target);
+  void BranchTrueShortF(Label* target, BranchDelaySlot bd = PROTECT);
+  void BranchFalseShortF(Label* target, BranchDelaySlot bd = PROTECT);
 
-  void BranchTrueF(Label* target);
-  void BranchFalseF(Label* target);
+  void BranchTrueF(Label* target, BranchDelaySlot bd = PROTECT);
+  void BranchFalseF(Label* target, BranchDelaySlot bd = PROTECT);
 
   // MSA branches
   void BranchMSA(Label* target, MSABranchDF df, MSABranchCondition cond,
@@ -278,8 +267,14 @@ class TurboAssembler : public Assembler {
     li(rd, Operand(j), mode);
   }
   void li(Register dst, Handle<HeapObject> value, LiFlags mode = OPTIMIZE_SIZE);
+  void li(Register dst, ExternalReference value, LiFlags mode = OPTIMIZE_SIZE);
+
+  void LoadFromConstantsTable(Register destination,
+                              int constant_index) override;
+  void LoadRootRegisterOffset(Register destination, intptr_t offset) override;
+  void LoadRootRelative(Register destination, int32_t offset) override;
 
-  // Jump, Call, and Ret pseudo instructions implementing inter-working.
+// Jump, Call, and Ret pseudo instructions implementing inter-working.
 #define COND_ARGS Condition cond = al, Register rs = zero_reg, \
   const Operand& rt = Operand(zero_reg), BranchDelaySlot bd = PROTECT
 
@@ -299,7 +294,9 @@ class TurboAssembler : public Assembler {
             COND_ARGS);
   void Call(Label* target);
 
-  void CallForDeoptimization(Address target, RelocInfo::Mode rmode) {
+  void CallForDeoptimization(Address target, int deopt_id,
+                             RelocInfo::Mode rmode) {
+    USE(deopt_id);
     Call(target, rmode);
   }
 
@@ -499,12 +496,13 @@ class TurboAssembler : public Assembler {
 #undef DEFINE_INSTRUCTION2
 #undef DEFINE_INSTRUCTION3
 
+  void SmiUntag(Register dst, const MemOperand& src);
   void SmiUntag(Register dst, Register src) {
     if (SmiValuesAre32Bits()) {
-      STATIC_ASSERT(kSmiShift == 32);
-      dsra32(dst, src, 0);
+      dsra32(dst, src, kSmiShift - 32);
     } else {
-      sra(dst, src, kSmiTagSize);
+      DCHECK(SmiValuesAre31Bits());
+      sra(dst, src, kSmiShift);
     }
   }
 
@@ -561,10 +559,10 @@ class TurboAssembler : public Assembler {
   void MovToFloatParameters(DoubleRegister src1, DoubleRegister src2);
   void MovToFloatResult(DoubleRegister src);
 
-  // See comments at the beginning of CEntryStub::Generate.
+  // See comments at the beginning of Builtins::Generate_CEntry.
   inline void PrepareCEntryArgs(int num_args) { li(a0, num_args); }
   inline void PrepareCEntryFunction(const ExternalReference& ref) {
-    li(a1, Operand(ref));
+    li(a1, ref);
   }
 
   void CheckPageFlag(Register object, Register scratch, int mask, Condition cc,
@@ -573,9 +571,9 @@ class TurboAssembler : public Assembler {
   void CallStubDelayed(CodeStub* stub, COND_ARGS);
 #undef COND_ARGS
 
-  void CallRuntimeDelayed(Zone* zone, Runtime::FunctionId fid,
-                          SaveFPRegsMode save_doubles = kDontSaveFPRegs,
-                          BranchDelaySlot bd = PROTECT);
+  // Call a runtime routine. This expects {centry} to contain a fitting CEntry
+  // builtin for the target runtime function and uses an indirect call.
+  void CallRuntimeWithCEntry(Runtime::FunctionId fid, Register centry);
 
   // Performs a truncating conversion of a floating point number as used by
   // the JS bitwise operations. See ECMA-262 9.5: ToInt32. Goes to 'done' if it
@@ -589,8 +587,8 @@ class TurboAssembler : public Assembler {
   // Performs a truncating conversion of a floating point number as used by
   // the JS bitwise operations. See ECMA-262 9.5: ToInt32.
   // Exits with 'result' holding the answer.
-  void TruncateDoubleToIDelayed(Zone* zone, Register result,
-                                DoubleRegister double_input);
+  void TruncateDoubleToI(Isolate* isolate, Zone* zone, Register result,
+                         DoubleRegister double_input, StubCallMode stub_mode);
 
   // Conditional move.
   void Movz(Register rd, Register rs, Register rt);
@@ -598,6 +596,9 @@ class TurboAssembler : public Assembler {
   void Movt(Register rd, Register rs, uint16_t cc = 0);
   void Movf(Register rd, Register rs, uint16_t cc = 0);
 
+  void LoadZeroIfFPUCondition(Register dest);
+  void LoadZeroIfNotFPUCondition(Register dest);
+
   void LoadZeroIfConditionNotZero(Register dest, Register condition);
   void LoadZeroIfConditionZero(Register dest, Register condition);
   void LoadZeroOnCondition(Register rd, Register rs, const Operand& rt,
@@ -626,7 +627,7 @@ class TurboAssembler : public Assembler {
 
   // Convert single to unsigned word.
   void Trunc_uw_s(FPURegister fd, FPURegister fs, FPURegister scratch);
-  void Trunc_uw_s(FPURegister fd, Register rs, FPURegister scratch);
+  void Trunc_uw_s(Register rd, FPURegister fs, FPURegister scratch);
 
   // Change endianness
   void ByteSwapSigned(Register dest, Register src, int operand_size);
@@ -782,7 +783,7 @@ class TurboAssembler : public Assembler {
                            Func GetLabelFunction);
 
   // Load an object from the root table.
-  void LoadRoot(Register destination, Heap::RootListIndex index);
+  void LoadRoot(Register destination, Heap::RootListIndex index) override;
   void LoadRoot(Register destination, Heap::RootListIndex index, Condition cond,
                 Register src1, const Operand& src2);
 
@@ -810,18 +811,18 @@ class TurboAssembler : public Assembler {
 
   // Convert double to unsigned word.
   void Trunc_uw_d(FPURegister fd, FPURegister fs, FPURegister scratch);
-  void Trunc_uw_d(FPURegister fd, Register rs, FPURegister scratch);
+  void Trunc_uw_d(Register rd, FPURegister fs, FPURegister scratch);
 
   // Convert double to unsigned long.
   void Trunc_ul_d(FPURegister fd, FPURegister fs, FPURegister scratch,
                   Register result = no_reg);
-  void Trunc_ul_d(FPURegister fd, Register rs, FPURegister scratch,
+  void Trunc_ul_d(Register rd, FPURegister fs, FPURegister scratch,
                   Register result = no_reg);
 
   // Convert single to unsigned long.
   void Trunc_ul_s(FPURegister fd, FPURegister fs, FPURegister scratch,
                   Register result = no_reg);
-  void Trunc_ul_s(FPURegister fd, Register rs, FPURegister scratch,
+  void Trunc_ul_s(Register rd, FPURegister fs, FPURegister scratch,
                   Register result = no_reg);
 
   // Round double functions
@@ -840,6 +841,16 @@ class TurboAssembler : public Assembler {
   void JumpIfSmi(Register value, Label* smi_label, Register scratch = at,
                  BranchDelaySlot bd = PROTECT);
 
+  void JumpIfEqual(Register a, int32_t b, Label* dest) {
+    li(kScratchReg, Operand(b));
+    Branch(dest, eq, a, Operand(kScratchReg));
+  }
+
+  void JumpIfLessThan(Register a, int32_t b, Label* dest) {
+    li(kScratchReg, Operand(b));
+    Branch(dest, lt, a, Operand(kScratchReg));
+  }
+
   // Push a standard frame, consisting of ra, fp, context and JS function.
   void PushStandardFrame(Register function_reg);
 
@@ -865,11 +876,7 @@ class TurboAssembler : public Assembler {
   inline int32_t GetOffset(int32_t offset, Label* L, OffsetSize bits);
 
  private:
-  bool has_frame_ = false;
-  Isolate* const isolate_;
-  // This handle will be patched with the code object on installation.
-  Handle<HeapObject> code_object_;
-  bool has_double_zero_reg_set_;
+  bool has_double_zero_reg_set_ = false;
 
   void CompareF(SecondaryField sizeField, FPUCondition cc, FPURegister cmp1,
                 FPURegister cmp2);
@@ -928,7 +935,11 @@ class TurboAssembler : public Assembler {
 class MacroAssembler : public TurboAssembler {
  public:
   MacroAssembler(Isolate* isolate, void* buffer, int size,
-                 CodeObjectRequired create_code_object);
+                 CodeObjectRequired create_code_object)
+      : MacroAssembler(isolate, AssemblerOptions::Default(isolate), buffer,
+                       size, create_code_object) {}
+  MacroAssembler(Isolate* isolate, const AssemblerOptions& options,
+                 void* buffer, int size, CodeObjectRequired create_code_object);
 
   bool IsNear(Label* L, Condition cond, int rs_reg);
 
@@ -1116,22 +1127,19 @@ const Operand& rt = Operand(zero_reg), BranchDelaySlot bd = PROTECT
 
   // Call a runtime routine.
   void CallRuntime(const Runtime::Function* f, int num_arguments,
-                   SaveFPRegsMode save_doubles = kDontSaveFPRegs,
-                   BranchDelaySlot bd = PROTECT);
+                   SaveFPRegsMode save_doubles = kDontSaveFPRegs);
 
   // Convenience function: Same as above, but takes the fid instead.
   void CallRuntime(Runtime::FunctionId fid,
-                   SaveFPRegsMode save_doubles = kDontSaveFPRegs,
-                   BranchDelaySlot bd = PROTECT) {
+                   SaveFPRegsMode save_doubles = kDontSaveFPRegs) {
     const Runtime::Function* function = Runtime::FunctionForId(fid);
-    CallRuntime(function, function->nargs, save_doubles, bd);
+    CallRuntime(function, function->nargs, save_doubles);
   }
 
   // Convenience function: Same as above, but takes the fid instead.
   void CallRuntime(Runtime::FunctionId fid, int num_arguments,
-                   SaveFPRegsMode save_doubles = kDontSaveFPRegs,
-                   BranchDelaySlot bd = PROTECT) {
-    CallRuntime(Runtime::FunctionForId(fid), num_arguments, save_doubles, bd);
+                   SaveFPRegsMode save_doubles = kDontSaveFPRegs) {
+    CallRuntime(Runtime::FunctionForId(fid), num_arguments, save_doubles);
   }
 
   // Convenience function: tail call a runtime routine (jump).
@@ -1163,9 +1171,9 @@ const Operand& rt = Operand(zero_reg), BranchDelaySlot bd = PROTECT
   void SmiTag(Register dst, Register src) {
     STATIC_ASSERT(kSmiTag == 0);
     if (SmiValuesAre32Bits()) {
-      STATIC_ASSERT(kSmiShift == 32);
       dsll32(dst, src, 0);
     } else {
+      DCHECK(SmiValuesAre31Bits());
       Addu(dst, src, src);
     }
   }
@@ -1180,14 +1188,12 @@ const Operand& rt = Operand(zero_reg), BranchDelaySlot bd = PROTECT
       // The int portion is upper 32-bits of 64-bit word.
       dsra(dst, src, kSmiShift - scale);
     } else {
+      DCHECK(SmiValuesAre31Bits());
       DCHECK_GE(scale, kSmiTagSize);
       sll(dst, src, scale - kSmiTagSize);
     }
   }
 
-  // Combine load with untagging or scaling.
-  void SmiLoadUntag(Register dst, MemOperand src);
-
   // Test if the register contains a smi.
   inline void SmiTst(Register value, Register scratch) {
     And(scratch, value, Operand(kSmiTagMask));
@@ -1209,9 +1215,6 @@ const Operand& rt = Operand(zero_reg), BranchDelaySlot bd = PROTECT
   void AssertNotSmi(Register object);
   void AssertSmi(Register object);
 
-  // Abort execution if argument is not a FixedArray, enabled via --debug-code.
-  void AssertFixedArray(Register object);
-
   // Abort execution if argument is not a Constructor, enabled via --debug-code.
   void AssertConstructor(Register object);
 
diff --git a/deps/v8/src/mips64/simulator-mips64.cc b/deps/v8/src/mips64/simulator-mips64.cc
index 53dacdc3307d9d..5bfb9e9d550a5c 100644
--- a/deps/v8/src/mips64/simulator-mips64.cc
+++ b/deps/v8/src/mips64/simulator-mips64.cc
@@ -418,12 +418,12 @@ void MipsDebugger::Debug() {
                  || (strcmp(cmd, "printobject") == 0)) {
         if (argc == 2) {
           int64_t value;
-          OFStream os(stdout);
+          StdoutStream os;
           if (GetValue(arg1, &value)) {
             Object* obj = reinterpret_cast<Object*>(value);
             os << arg1 << ": \n";
 #ifdef DEBUG
-            obj->Print(os);
+            obj->Print(sim_->isolate_, os);
             os << "\n";
 #else
             os << Brief(obj) << "\n";
@@ -683,7 +683,7 @@ void MipsDebugger::Debug() {
         PrintF("    Stops are debug instructions inserted by\n");
         PrintF("    the Assembler::stop() function.\n");
         PrintF("    When hitting a stop, the Simulator will\n");
-        PrintF("    stop and and give control to the Debugger.\n");
+        PrintF("    stop and give control to the Debugger.\n");
         PrintF("    All stop codes are watched:\n");
         PrintF("    - They can be enabled / disabled: the Simulator\n");
         PrintF("       will / won't stop when hitting them.\n");
@@ -861,7 +861,6 @@ Simulator* Simulator::current(Isolate* isolate) {
   v8::internal::Isolate::PerIsolateThreadData* isolate_data =
        isolate->FindOrAllocatePerThreadDataForThisThread();
   DCHECK_NOT_NULL(isolate_data);
-  DCHECK_NOT_NULL(isolate_data);
 
   Simulator* sim = isolate_data->simulator();
   if (sim == nullptr) {
@@ -2238,17 +2237,18 @@ void Simulator::SoftwareInterrupt() {
           case ExternalReference::BUILTIN_FP_FP_CALL:
           case ExternalReference::BUILTIN_COMPARE_CALL:
             PrintF("Call to host function at %p with args %f, %f",
-                   static_cast<void*>(FUNCTION_ADDR(generic_target)), dval0,
-                   dval1);
+                   reinterpret_cast<void*>(FUNCTION_ADDR(generic_target)),
+                   dval0, dval1);
             break;
           case ExternalReference::BUILTIN_FP_CALL:
             PrintF("Call to host function at %p with arg %f",
-                   static_cast<void*>(FUNCTION_ADDR(generic_target)), dval0);
+                   reinterpret_cast<void*>(FUNCTION_ADDR(generic_target)),
+                   dval0);
             break;
           case ExternalReference::BUILTIN_FP_INT_CALL:
             PrintF("Call to host function at %p with args %f, %d",
-                   static_cast<void*>(FUNCTION_ADDR(generic_target)), dval0,
-                   ival);
+                   reinterpret_cast<void*>(FUNCTION_ADDR(generic_target)),
+                   dval0, ival);
             break;
           default:
             UNREACHABLE();
@@ -2353,8 +2353,8 @@ void Simulator::SoftwareInterrupt() {
             "args %08" PRIx64 " , %08" PRIx64 " , %08" PRIx64 " , %08" PRIx64
             " , %08" PRIx64 " , %08" PRIx64 " , %08" PRIx64 " , %08" PRIx64
             " , %08" PRIx64 " \n",
-            static_cast<void*>(FUNCTION_ADDR(target)), arg0, arg1, arg2, arg3,
-            arg4, arg5, arg6, arg7, arg8);
+            reinterpret_cast<void*>(FUNCTION_ADDR(target)), arg0, arg1, arg2,
+            arg3, arg4, arg5, arg6, arg7, arg8);
       }
       ObjectPair result =
           target(arg0, arg1, arg2, arg3, arg4, arg5, arg6, arg7, arg8);
@@ -6625,10 +6625,10 @@ void Simulator::DecodeTypeImmediate() {
           break;
         }
         case BC1EQZ:
-          BranchCompactHelper(!(get_fpu_register(ft_reg) & 0x1), 16);
+          BranchHelper(!(get_fpu_register(ft_reg) & 0x1));
           break;
         case BC1NEZ:
-          BranchCompactHelper((get_fpu_register(ft_reg) & 0x1), 16);
+          BranchHelper(get_fpu_register(ft_reg) & 0x1);
           break;
         case BZ_V: {
           msa_reg_t wt;
@@ -7327,13 +7327,12 @@ void Simulator::Execute() {
   }
 }
 
-
-void Simulator::CallInternal(byte* entry) {
+void Simulator::CallInternal(Address entry) {
   // Adjust JS-based stack limit to C-based stack limit.
   isolate_->stack_guard()->AdjustStackLimitForSimulator();
 
   // Prepare to execute the code at entry.
-  set_register(pc, reinterpret_cast<int64_t>(entry));
+  set_register(pc, static_cast<int64_t>(entry));
   // Put down marker for end of simulation. The simulator will stop simulation
   // when the PC reaches this value. By saving the "end simulation" value into
   // the LR the simulation stops when returning to this call point.
@@ -7397,7 +7396,7 @@ void Simulator::CallInternal(byte* entry) {
   set_register(fp, fp_val);
 }
 
-intptr_t Simulator::CallImpl(byte* entry, int argument_count,
+intptr_t Simulator::CallImpl(Address entry, int argument_count,
                              const intptr_t* arguments) {
   constexpr int kRegisterPassedArguments = 8;
   // Set up arguments.
@@ -7441,8 +7440,7 @@ intptr_t Simulator::CallImpl(byte* entry, int argument_count,
   return get_register(v0);
 }
 
-
-double Simulator::CallFP(byte* entry, double d0, double d1) {
+double Simulator::CallFP(Address entry, double d0, double d1) {
   if (!IsMipsSoftFloatABI) {
     const FPURegister fparg2 = f13;
     set_fpu_register_double(f12, d0);
diff --git a/deps/v8/src/mips64/simulator-mips64.h b/deps/v8/src/mips64/simulator-mips64.h
index 115dde2103ae47..30db7b95d61d3c 100644
--- a/deps/v8/src/mips64/simulator-mips64.h
+++ b/deps/v8/src/mips64/simulator-mips64.h
@@ -228,9 +228,7 @@ class Simulator : public SimulatorBase {
   void set_pc(int64_t value);
   int64_t get_pc() const;
 
-  Address get_sp() const {
-    return reinterpret_cast<Address>(static_cast<intptr_t>(get_register(sp)));
-  }
+  Address get_sp() const { return static_cast<Address>(get_register(sp)); }
 
   // Accessor to the internal simulator stack area.
   uintptr_t StackLimit(uintptr_t c_limit) const;
@@ -239,12 +237,12 @@ class Simulator : public SimulatorBase {
   void Execute();
 
   template <typename Return, typename... Args>
-  Return Call(byte* entry, Args... args) {
+  Return Call(Address entry, Args... args) {
     return VariadicCall<Return>(this, &Simulator::CallImpl, entry, args...);
   }
 
   // Alternative: call a 2-argument double function.
-  double CallFP(byte* entry, double d0, double d1);
+  double CallFP(Address entry, double d0, double d1);
 
   // Push an address onto the JS stack.
   uintptr_t PushAddress(uintptr_t address);
@@ -282,7 +280,7 @@ class Simulator : public SimulatorBase {
     Unpredictable = 0xbadbeaf
   };
 
-  V8_EXPORT_PRIVATE intptr_t CallImpl(byte* entry, int argument_count,
+  V8_EXPORT_PRIVATE intptr_t CallImpl(Address entry, int argument_count,
                                       const intptr_t* arguments);
 
   // Unsupported instructions use Format to print an error and stop execution.
@@ -533,7 +531,7 @@ class Simulator : public SimulatorBase {
   void GetFpArgs(double* x, double* y, int32_t* z);
   void SetFpResult(const double& result);
 
-  void CallInternal(byte* entry);
+  void CallInternal(Address entry);
 
   // Architecture state.
   // Registers.
diff --git a/deps/v8/src/msan.h b/deps/v8/src/msan.h
index f099595e54f997..d3e79160cb7eec 100644
--- a/deps/v8/src/msan.h
+++ b/deps/v8/src/msan.h
@@ -7,27 +7,30 @@
 #ifndef V8_MSAN_H_
 #define V8_MSAN_H_
 
+#include "src/base/macros.h"
 #include "src/globals.h"
 
-#ifndef __has_feature
-# define __has_feature(x) 0
-#endif
+#ifdef V8_USE_MEMORY_SANITIZER
 
-#if __has_feature(memory_sanitizer) && !defined(MEMORY_SANITIZER)
-# define MEMORY_SANITIZER
-#endif
-
-#if defined(MEMORY_SANITIZER)
-# include <sanitizer/msan_interface.h>  // NOLINT
+#include <sanitizer/msan_interface.h>
 
 // Marks a memory range as uninitialized, as if it was allocated here.
-# define MSAN_ALLOCATED_UNINITIALIZED_MEMORY(p, s) \
-    __msan_allocated_memory((p), (s))
+#define MSAN_ALLOCATED_UNINITIALIZED_MEMORY(p, s) \
+  __msan_allocated_memory(reinterpret_cast<const void*>(p), (s))
 // Marks a memory range as initialized.
-#define MSAN_MEMORY_IS_INITIALIZED(p, s) __msan_unpoison((p), (s))
-#else
-# define MSAN_ALLOCATED_UNINITIALIZED_MEMORY(p, s)
-#define MSAN_MEMORY_IS_INITIALIZED(p, s)
-#endif
+#define MSAN_MEMORY_IS_INITIALIZED(p, s) \
+  __msan_unpoison(reinterpret_cast<const void*>(p), (s))
+
+#else  // !V8_USE_MEMORY_SANITIZER
+
+#define MSAN_ALLOCATED_UNINITIALIZED_MEMORY(p, s)                            \
+  static_assert((std::is_pointer<decltype(p)>::value ||                      \
+                 std::is_same<v8::internal::Address, decltype(p)>::value) && \
+                    std::is_convertible<decltype(s), size_t>::value,         \
+                "static type violation")
+#define MSAN_MEMORY_IS_INITIALIZED(p, s) \
+  MSAN_ALLOCATED_UNINITIALIZED_MEMORY(p, s)
+
+#endif  // V8_USE_MEMORY_SANITIZER
 
 #endif  // V8_MSAN_H_
diff --git a/deps/v8/src/objects-body-descriptors-inl.h b/deps/v8/src/objects-body-descriptors-inl.h
index b2f36430913900..e882335dc06f3a 100644
--- a/deps/v8/src/objects-body-descriptors-inl.h
+++ b/deps/v8/src/objects-body-descriptors-inl.h
@@ -9,6 +9,7 @@
 #include "src/feedback-vector.h"
 #include "src/objects-body-descriptors.h"
 #include "src/objects/hash-table.h"
+#include "src/objects/js-collection.h"
 #include "src/transitions.h"
 #include "src/wasm/wasm-objects-inl.h"
 
@@ -148,6 +149,49 @@ class JSFunction::BodyDescriptor final : public BodyDescriptorBase {
   }
 };
 
+template <bool includeWeakNext>
+class AllocationSite::BodyDescriptorImpl final : public BodyDescriptorBase {
+ public:
+  STATIC_ASSERT(AllocationSite::kCommonPointerFieldEndOffset ==
+                AllocationSite::kPretenureDataOffset);
+  STATIC_ASSERT(AllocationSite::kPretenureDataOffset + kInt32Size ==
+                AllocationSite::kPretenureCreateCountOffset);
+  STATIC_ASSERT(AllocationSite::kPretenureCreateCountOffset + kInt32Size ==
+                AllocationSite::kWeakNextOffset);
+
+  static bool IsValidSlot(Map* map, HeapObject* obj, int offset) {
+    if (offset >= AllocationSite::kStartOffset &&
+        offset < AllocationSite::kCommonPointerFieldEndOffset) {
+      return true;
+    }
+    // check for weak_next offset
+    if (includeWeakNext &&
+        map->instance_size() == AllocationSite::kSizeWithWeakNext &&
+        offset == AllocationSite::kWeakNextOffset) {
+      return true;
+    }
+    return false;
+  }
+
+  template <typename ObjectVisitor>
+  static inline void IterateBody(Map* map, HeapObject* obj, int object_size,
+                                 ObjectVisitor* v) {
+    // Iterate over all the common pointer fields
+    IteratePointers(obj, AllocationSite::kStartOffset,
+                    AllocationSite::kCommonPointerFieldEndOffset, v);
+    // Skip PretenureDataOffset and PretenureCreateCount which are Int32 fields
+    // Visit weak_next only for full body descriptor and if it has weak_next
+    // field
+    if (includeWeakNext && object_size == AllocationSite::kSizeWithWeakNext)
+      IteratePointers(obj, AllocationSite::kWeakNextOffset,
+                      AllocationSite::kSizeWithWeakNext, v);
+  }
+
+  static inline int SizeOf(Map* map, HeapObject* object) {
+    return map->instance_size();
+  }
+};
+
 class JSArrayBuffer::BodyDescriptor final : public BodyDescriptorBase {
  public:
   STATIC_ASSERT(kByteLengthOffset + kPointerSize == kBackingStoreOffset);
@@ -181,7 +225,8 @@ class SmallOrderedHashTable<Derived>::BodyDescriptor final
  public:
   static bool IsValidSlot(Map* map, HeapObject* obj, int offset) {
     Derived* table = reinterpret_cast<Derived*>(obj);
-    if (offset < table->GetDataTableStartOffset()) return false;
+    if (offset < kDataTableStartOffset) return false;
+    if (offset >= table->GetBucketsStartOffset()) return false;
     return IsValidSlotImpl(map, obj, offset);
   }
 
@@ -189,15 +234,20 @@ class SmallOrderedHashTable<Derived>::BodyDescriptor final
   static inline void IterateBody(Map* map, HeapObject* obj, int object_size,
                                  ObjectVisitor* v) {
     Derived* table = reinterpret_cast<Derived*>(obj);
-    int start = table->GetDataTableStartOffset();
+
+    int offset = kDataTableStartOffset;
+    int entry = 0;
     for (int i = 0; i < table->Capacity(); i++) {
-      IteratePointer(obj, start + (i * kPointerSize), v);
+      for (int j = 0; j < Derived::kEntrySize; j++) {
+        IteratePointer(obj, offset + (entry * kPointerSize), v);
+        entry++;
+      }
     }
   }
 
   static inline int SizeOf(Map* map, HeapObject* obj) {
     Derived* table = reinterpret_cast<Derived*>(obj);
-    return table->Size();
+    return table->SizeFor(table->Capacity());
   }
 };
 
@@ -285,16 +335,16 @@ class FixedTypedArrayBase::BodyDescriptor final : public BodyDescriptorBase {
   }
 };
 
-class WeakFixedArray::BodyDescriptor final : public BodyDescriptorBase {
+class WeakArrayBodyDescriptor final : public BodyDescriptorBase {
  public:
   static bool IsValidSlot(Map* map, HeapObject* obj, int offset) {
-    return offset >= kHeaderSize;
+    return true;
   }
 
   template <typename ObjectVisitor>
   static inline void IterateBody(Map* map, HeapObject* obj, int object_size,
                                  ObjectVisitor* v) {
-    IterateMaybeWeakPointers(obj, kHeaderSize, object_size, v);
+    IterateMaybeWeakPointers(obj, HeapObject::kHeaderSize, object_size, v);
   }
 
   static inline int SizeOf(Map* map, HeapObject* object) {
@@ -330,7 +380,7 @@ class FeedbackVector::BodyDescriptor final : public BodyDescriptorBase {
                                  ObjectVisitor* v) {
     IteratePointer(obj, kSharedFunctionInfoOffset, v);
     IterateMaybeWeakPointer(obj, kOptimizedCodeOffset, v);
-    IteratePointers(obj, kFeedbackSlotsOffset, object_size, v);
+    IterateMaybeWeakPointers(obj, kFeedbackSlotsOffset, object_size, v);
   }
 
   static inline int SizeOf(Map* map, HeapObject* obj) {
@@ -338,11 +388,28 @@ class FeedbackVector::BodyDescriptor final : public BodyDescriptorBase {
   }
 };
 
-template <JSWeakCollection::BodyVisitingPolicy body_visiting_policy>
+class PrototypeInfo::BodyDescriptor final : public BodyDescriptorBase {
+ public:
+  static bool IsValidSlot(Map* map, HeapObject* obj, int offset) {
+    return offset >= HeapObject::kHeaderSize;
+  }
+
+  template <typename ObjectVisitor>
+  static inline void IterateBody(Map* map, HeapObject* obj, int object_size,
+                                 ObjectVisitor* v) {
+    IteratePointers(obj, HeapObject::kHeaderSize, kObjectCreateMapOffset, v);
+    IterateMaybeWeakPointer(obj, kObjectCreateMapOffset, v);
+    IteratePointers(obj, kObjectCreateMapOffset + kPointerSize, object_size, v);
+  }
+
+  static inline int SizeOf(Map* map, HeapObject* obj) {
+    return obj->SizeFromMap(map);
+  }
+};
+
 class JSWeakCollection::BodyDescriptorImpl final : public BodyDescriptorBase {
  public:
-  STATIC_ASSERT(kTableOffset + kPointerSize == kNextOffset);
-  STATIC_ASSERT(kNextOffset + kPointerSize == kSize);
+  STATIC_ASSERT(kTableOffset + kPointerSize == kSize);
 
   static bool IsValidSlot(Map* map, HeapObject* obj, int offset) {
     return IsValidSlotImpl(map, obj, offset);
@@ -351,12 +418,7 @@ class JSWeakCollection::BodyDescriptorImpl final : public BodyDescriptorBase {
   template <typename ObjectVisitor>
   static inline void IterateBody(Map* map, HeapObject* obj, int object_size,
                                  ObjectVisitor* v) {
-    if (body_visiting_policy == kIgnoreWeakness) {
-      IterateBodyImpl(map, obj, kPropertiesOrHashOffset, object_size, v);
-    } else {
-      IteratePointers(obj, kPropertiesOrHashOffset, kTableOffset, v);
-      IterateBodyImpl(map, obj, kSize, object_size, v);
-    }
+    IterateBodyImpl(map, obj, kPropertiesOrHashOffset, object_size, v);
   }
 
   static inline int SizeOf(Map* map, HeapObject* object) {
@@ -424,7 +486,7 @@ class Code::BodyDescriptor final : public BodyDescriptorBase {
 
   template <typename ObjectVisitor>
   static inline void IterateBody(Map* map, HeapObject* obj, ObjectVisitor* v) {
-    int mode_mask = RelocInfo::kCodeTargetMask |
+    int mode_mask = RelocInfo::ModeMask(RelocInfo::CODE_TARGET) |
                     RelocInfo::ModeMask(RelocInfo::EMBEDDED_OBJECT) |
                     RelocInfo::ModeMask(RelocInfo::EXTERNAL_REFERENCE) |
                     RelocInfo::ModeMask(RelocInfo::INTERNAL_REFERENCE) |
@@ -436,9 +498,7 @@ class Code::BodyDescriptor final : public BodyDescriptorBase {
     IteratePointers(obj, kRelocationInfoOffset, kDataStart, v);
 
     RelocIterator it(Code::cast(obj), mode_mask);
-    for (; !it.done(); it.next()) {
-      it.rinfo()->Visit(v);
-    }
+    v->VisitRelocInfo(&it);
   }
 
   template <typename ObjectVisitor>
@@ -488,7 +548,7 @@ class WasmInstanceObject::BodyDescriptor final : public BodyDescriptorBase {
  public:
   static bool IsValidSlot(Map* map, HeapObject* obj, int offset) {
     if (offset < kMemoryStartOffset) return true;
-    if (offset < kCompiledModuleOffset) return false;
+    if (offset < kModuleObjectOffset) return false;
     return IsValidSlotImpl(map, obj, offset);
   }
 
@@ -524,6 +584,31 @@ class Map::BodyDescriptor final : public BodyDescriptorBase {
   static inline int SizeOf(Map* map, HeapObject* obj) { return Map::kSize; }
 };
 
+class DataHandler::BodyDescriptor final : public BodyDescriptorBase {
+ public:
+  static bool IsValidSlot(Map* map, HeapObject* obj, int offset) {
+    return offset >= HeapObject::kHeaderSize;
+  }
+
+  template <typename ObjectVisitor>
+  static inline void IterateBody(Map* map, HeapObject* obj, int object_size,
+                                 ObjectVisitor* v) {
+    static_assert(kSmiHandlerOffset < kData1Offset,
+                  "Field order must be in sync with this iteration code");
+    static_assert(kData1Offset < kSizeWithData1,
+                  "Field order must be in sync with this iteration code");
+    IteratePointers(obj, kSmiHandlerOffset, kData1Offset, v);
+    if (object_size >= kSizeWithData1) {
+      IterateMaybeWeakPointer(obj, kData1Offset, v);
+      IteratePointers(obj, kData1Offset + kPointerSize, object_size, v);
+    }
+  }
+
+  static inline int SizeOf(Map* map, HeapObject* object) {
+    return object->SizeFromMap(map);
+  }
+};
+
 template <typename Op, typename ReturnType, typename T1, typename T2,
           typename T3, typename T4>
 ReturnType BodyDescriptorApply(InstanceType type, T1 p1, T2 p2, T3 p3, T4 p4) {
@@ -551,9 +636,18 @@ ReturnType BodyDescriptorApply(InstanceType type, T1 p1, T2 p2, T3 p3, T4 p4) {
 
   switch (type) {
     case FIXED_ARRAY_TYPE:
-    case BOILERPLATE_DESCRIPTION_TYPE:
+    case OBJECT_BOILERPLATE_DESCRIPTION_TYPE:
     case HASH_TABLE_TYPE:
+    case ORDERED_HASH_MAP_TYPE:
+    case ORDERED_HASH_SET_TYPE:
+    case NAME_DICTIONARY_TYPE:
+    case GLOBAL_DICTIONARY_TYPE:
+    case NUMBER_DICTIONARY_TYPE:
+    case SIMPLE_NUMBER_DICTIONARY_TYPE:
+    case STRING_TABLE_TYPE:
+    case EPHEMERON_HASH_TABLE_TYPE:
     case SCOPE_INFO_TYPE:
+    case SCRIPT_CONTEXT_TABLE_TYPE:
     case BLOCK_CONTEXT_TYPE:
     case CATCH_CONTEXT_TYPE:
     case DEBUG_EVALUATE_CONTEXT_TYPE:
@@ -566,6 +660,8 @@ ReturnType BodyDescriptorApply(InstanceType type, T1 p1, T2 p2, T3 p3, T4 p4) {
       return Op::template apply<FixedArray::BodyDescriptor>(p1, p2, p3, p4);
     case WEAK_FIXED_ARRAY_TYPE:
       return Op::template apply<WeakFixedArray::BodyDescriptor>(p1, p2, p3, p4);
+    case WEAK_ARRAY_LIST_TYPE:
+      return Op::template apply<WeakArrayList::BodyDescriptor>(p1, p2, p3, p4);
     case FIXED_DOUBLE_ARRAY_TYPE:
       return ReturnType();
     case FEEDBACK_METADATA_TYPE:
@@ -614,6 +710,10 @@ ReturnType BodyDescriptorApply(InstanceType type, T1 p1, T2 p2, T3 p3, T4 p4) {
     case JS_SPECIAL_API_OBJECT_TYPE:
     case JS_MESSAGE_OBJECT_TYPE:
     case JS_BOUND_FUNCTION_TYPE:
+#ifdef V8_INTL_SUPPORT
+    case JS_INTL_LOCALE_TYPE:
+    case JS_INTL_RELATIVE_TIME_FORMAT_TYPE:
+#endif  // V8_INTL_SUPPORT
     case WASM_GLOBAL_TYPE:
     case WASM_MEMORY_TYPE:
     case WASM_MODULE_TYPE:
@@ -661,12 +761,16 @@ ReturnType BodyDescriptorApply(InstanceType type, T1 p1, T2 p2, T3 p3, T4 p4) {
     case CODE_DATA_CONTAINER_TYPE:
       return Op::template apply<CodeDataContainer::BodyDescriptor>(p1, p2, p3,
                                                                    p4);
+    case UNCOMPILED_DATA_WITH_PRE_PARSED_SCOPE_TYPE:
+      return Op::template apply<
+          UncompiledDataWithPreParsedScope::BodyDescriptor>(p1, p2, p3, p4);
     case HEAP_NUMBER_TYPE:
     case MUTABLE_HEAP_NUMBER_TYPE:
     case FILLER_TYPE:
     case BYTE_ARRAY_TYPE:
     case FREE_SPACE_TYPE:
     case BIGINT_TYPE:
+    case UNCOMPILED_DATA_WITHOUT_PRE_PARSED_SCOPE_TYPE:
       return ReturnType();
 
 #define TYPED_ARRAY_CASE(Type, type, TYPE, ctype, size)                        \
@@ -680,20 +784,23 @@ ReturnType BodyDescriptorApply(InstanceType type, T1 p1, T2 p2, T3 p3, T4 p4) {
       return Op::template apply<SharedFunctionInfo::BodyDescriptor>(p1, p2, p3,
                                                                     p4);
     }
+    case ALLOCATION_SITE_TYPE:
+      return Op::template apply<AllocationSite::BodyDescriptor>(p1, p2, p3, p4);
 
 #define MAKE_STRUCT_CASE(NAME, Name, name) case NAME##_TYPE:
       STRUCT_LIST(MAKE_STRUCT_CASE)
 #undef MAKE_STRUCT_CASE
-      if (type == ALLOCATION_SITE_TYPE) {
-        return Op::template apply<AllocationSite::BodyDescriptor>(p1, p2, p3,
-                                                                  p4);
+      if (type == PROTOTYPE_INFO_TYPE) {
+        return Op::template apply<PrototypeInfo::BodyDescriptor>(p1, p2, p3,
+                                                                 p4);
       } else {
         return Op::template apply<StructBodyDescriptor>(p1, p2, p3, p4);
       }
     case CALL_HANDLER_INFO_TYPE:
+      return Op::template apply<StructBodyDescriptor>(p1, p2, p3, p4);
     case LOAD_HANDLER_TYPE:
     case STORE_HANDLER_TYPE:
-      return Op::template apply<StructBodyDescriptor>(p1, p2, p3, p4);
+      return Op::template apply<DataHandler::BodyDescriptor>(p1, p2, p3, p4);
     default:
       PrintF("Unknown type: %d\n", type);
       UNREACHABLE();
diff --git a/deps/v8/src/objects-debug.cc b/deps/v8/src/objects-debug.cc
index 086078bb251dc4..dca45ba0bbed83 100644
--- a/deps/v8/src/objects-debug.cc
+++ b/deps/v8/src/objects-debug.cc
@@ -13,13 +13,24 @@
 #include "src/layout-descriptor.h"
 #include "src/macro-assembler.h"
 #include "src/objects-inl.h"
+#include "src/objects/arguments-inl.h"
 #include "src/objects/bigint.h"
 #include "src/objects/data-handler-inl.h"
 #include "src/objects/debug-objects-inl.h"
-#include "src/objects/literal-objects.h"
+#include "src/objects/hash-table-inl.h"
+#include "src/objects/js-collection-inl.h"
+#include "src/objects/literal-objects-inl.h"
+#ifdef V8_INTL_SUPPORT
+#include "src/objects/js-locale-inl.h"
+#endif  // V8_INTL_SUPPORT
+#include "src/objects/js-regexp-inl.h"
+#include "src/objects/js-regexp-string-iterator-inl.h"
+#ifdef V8_INTL_SUPPORT
+#include "src/objects/js-relative-time-format-inl.h"
+#endif  // V8_INTL_SUPPORT
 #include "src/objects/maybe-object.h"
 #include "src/objects/microtask-inl.h"
-#include "src/objects/module.h"
+#include "src/objects/module-inl.h"
 #include "src/objects/promise-inl.h"
 #include "src/ostreams.h"
 #include "src/regexp/jsregexp.h"
@@ -53,11 +64,17 @@ namespace internal {
 
 #ifdef VERIFY_HEAP
 
+// TODO(v8:7786): Remove this overload.
 void Object::ObjectVerify() {
+  // Passing a nullptr into here for non-heap-objects should be safe.
+  ObjectVerify(IsHeapObject() ? HeapObject::cast(this)->GetIsolate() : nullptr);
+}
+
+void Object::ObjectVerify(Isolate* isolate) {
   if (IsSmi()) {
-    Smi::cast(this)->SmiVerify();
+    Smi::cast(this)->SmiVerify(isolate);
   } else {
-    HeapObject::cast(this)->HeapObjectVerify();
+    HeapObject::cast(this)->HeapObjectVerify(isolate);
   }
   CHECK(!IsConstructor() || IsCallable());
 }
@@ -81,52 +98,63 @@ void MaybeObject::VerifyMaybeObjectPointer(MaybeObject* p) {
 }
 
 namespace {
-void VerifyForeignPointer(HeapObject* host, Object* foreign) {
+void VerifyForeignPointer(Isolate* isolate, HeapObject* host, Object* foreign) {
   host->VerifyPointer(foreign);
-  CHECK(foreign->IsUndefined(host->GetIsolate()) ||
-        Foreign::IsNormalized(foreign));
+  CHECK(foreign->IsUndefined(isolate) || Foreign::IsNormalized(foreign));
 }
 }  // namespace
 
-void Smi::SmiVerify() {
+void Smi::SmiVerify(Isolate* isolate) {
   CHECK(IsSmi());
   CHECK(!IsCallable());
   CHECK(!IsConstructor());
 }
 
-
-void HeapObject::HeapObjectVerify() {
+void HeapObject::HeapObjectVerify(Isolate* isolate) {
   VerifyHeapPointer(map());
   CHECK(map()->IsMap());
-  InstanceType instance_type = map()->instance_type();
 
-
-  switch (instance_type) {
+  switch (map()->instance_type()) {
 #define STRING_TYPE_CASE(TYPE, size, name, camel_name) case TYPE:
     STRING_TYPE_LIST(STRING_TYPE_CASE)
 #undef STRING_TYPE_CASE
-    String::cast(this)->StringVerify();
+    String::cast(this)->StringVerify(isolate);
     break;
     case SYMBOL_TYPE:
-      Symbol::cast(this)->SymbolVerify();
+      Symbol::cast(this)->SymbolVerify(isolate);
       break;
     case MAP_TYPE:
-      Map::cast(this)->MapVerify();
+      Map::cast(this)->MapVerify(isolate);
       break;
     case HEAP_NUMBER_TYPE:
+      CHECK(IsHeapNumber());
+      break;
     case MUTABLE_HEAP_NUMBER_TYPE:
-      HeapNumber::cast(this)->HeapNumberVerify();
+      CHECK(IsMutableHeapNumber());
       break;
     case BIGINT_TYPE:
-      BigInt::cast(this)->BigIntVerify();
+      BigInt::cast(this)->BigIntVerify(isolate);
       break;
     case CALL_HANDLER_INFO_TYPE:
-      CallHandlerInfo::cast(this)->CallHandlerInfoVerify();
+      CallHandlerInfo::cast(this)->CallHandlerInfoVerify(isolate);
       break;
+    case OBJECT_BOILERPLATE_DESCRIPTION_TYPE:
+      ObjectBoilerplateDescription::cast(this)
+          ->ObjectBoilerplateDescriptionVerify(isolate);
+      break;
+    // FixedArray types
     case HASH_TABLE_TYPE:
-    case BOILERPLATE_DESCRIPTION_TYPE:
+    case ORDERED_HASH_MAP_TYPE:
+    case ORDERED_HASH_SET_TYPE:
+    case NAME_DICTIONARY_TYPE:
+    case GLOBAL_DICTIONARY_TYPE:
+    case NUMBER_DICTIONARY_TYPE:
+    case SIMPLE_NUMBER_DICTIONARY_TYPE:
+    case STRING_TABLE_TYPE:
+    case EPHEMERON_HASH_TABLE_TYPE:
     case FIXED_ARRAY_TYPE:
     case SCOPE_INFO_TYPE:
+    case SCRIPT_CONTEXT_TABLE_TYPE:
     case BLOCK_CONTEXT_TYPE:
     case CATCH_CONTEXT_TYPE:
     case DEBUG_EVALUATE_CONTEXT_TYPE:
@@ -136,55 +164,58 @@ void HeapObject::HeapObjectVerify() {
     case NATIVE_CONTEXT_TYPE:
     case SCRIPT_CONTEXT_TYPE:
     case WITH_CONTEXT_TYPE:
-      FixedArray::cast(this)->FixedArrayVerify();
+      FixedArray::cast(this)->FixedArrayVerify(isolate);
       break;
     case WEAK_FIXED_ARRAY_TYPE:
-      WeakFixedArray::cast(this)->WeakFixedArrayVerify();
+      WeakFixedArray::cast(this)->WeakFixedArrayVerify(isolate);
+      break;
+    case WEAK_ARRAY_LIST_TYPE:
+      WeakArrayList::cast(this)->WeakArrayListVerify(isolate);
       break;
     case FIXED_DOUBLE_ARRAY_TYPE:
-      FixedDoubleArray::cast(this)->FixedDoubleArrayVerify();
+      FixedDoubleArray::cast(this)->FixedDoubleArrayVerify(isolate);
       break;
     case FEEDBACK_METADATA_TYPE:
-      FeedbackMetadata::cast(this)->FeedbackMetadataVerify();
+      FeedbackMetadata::cast(this)->FeedbackMetadataVerify(isolate);
       break;
     case BYTE_ARRAY_TYPE:
-      ByteArray::cast(this)->ByteArrayVerify();
+      ByteArray::cast(this)->ByteArrayVerify(isolate);
       break;
     case BYTECODE_ARRAY_TYPE:
-      BytecodeArray::cast(this)->BytecodeArrayVerify();
+      BytecodeArray::cast(this)->BytecodeArrayVerify(isolate);
       break;
     case DESCRIPTOR_ARRAY_TYPE:
-      DescriptorArray::cast(this)->DescriptorArrayVerify();
+      DescriptorArray::cast(this)->DescriptorArrayVerify(isolate);
       break;
     case TRANSITION_ARRAY_TYPE:
-      TransitionArray::cast(this)->TransitionArrayVerify();
+      TransitionArray::cast(this)->TransitionArrayVerify(isolate);
       break;
     case PROPERTY_ARRAY_TYPE:
-      PropertyArray::cast(this)->PropertyArrayVerify();
+      PropertyArray::cast(this)->PropertyArrayVerify(isolate);
       break;
     case FREE_SPACE_TYPE:
-      FreeSpace::cast(this)->FreeSpaceVerify();
+      FreeSpace::cast(this)->FreeSpaceVerify(isolate);
       break;
     case FEEDBACK_CELL_TYPE:
-      FeedbackCell::cast(this)->FeedbackCellVerify();
+      FeedbackCell::cast(this)->FeedbackCellVerify(isolate);
       break;
     case FEEDBACK_VECTOR_TYPE:
-      FeedbackVector::cast(this)->FeedbackVectorVerify();
+      FeedbackVector::cast(this)->FeedbackVectorVerify(isolate);
       break;
 
-#define VERIFY_TYPED_ARRAY(Type, type, TYPE, ctype, size)                      \
-    case FIXED_##TYPE##_ARRAY_TYPE:                                            \
-      Fixed##Type##Array::cast(this)->FixedTypedArrayVerify();                 \
-      break;
+#define VERIFY_TYPED_ARRAY(Type, type, TYPE, ctype, size)           \
+  case FIXED_##TYPE##_ARRAY_TYPE:                                   \
+    Fixed##Type##Array::cast(this)->FixedTypedArrayVerify(isolate); \
+    break;
 
-    TYPED_ARRAYS(VERIFY_TYPED_ARRAY)
+      TYPED_ARRAYS(VERIFY_TYPED_ARRAY)
 #undef VERIFY_TYPED_ARRAY
 
     case CODE_TYPE:
-      Code::cast(this)->CodeVerify();
+      Code::cast(this)->CodeVerify(isolate);
       break;
     case ODDBALL_TYPE:
-      Oddball::cast(this)->OddballVerify();
+      Oddball::cast(this)->OddballVerify(isolate);
       break;
     case JS_OBJECT_TYPE:
     case JS_ERROR_TYPE:
@@ -192,139 +223,162 @@ void HeapObject::HeapObjectVerify() {
     case JS_SPECIAL_API_OBJECT_TYPE:
     case JS_CONTEXT_EXTENSION_OBJECT_TYPE:
     case WASM_GLOBAL_TYPE:
-    case WASM_INSTANCE_TYPE:
     case WASM_MEMORY_TYPE:
     case WASM_MODULE_TYPE:
     case WASM_TABLE_TYPE:
-      JSObject::cast(this)->JSObjectVerify();
+      JSObject::cast(this)->JSObjectVerify(isolate);
+      break;
+    case WASM_INSTANCE_TYPE:
+      WasmInstanceObject::cast(this)->WasmInstanceObjectVerify(isolate);
       break;
     case JS_ARGUMENTS_TYPE:
-      JSArgumentsObject::cast(this)->JSArgumentsObjectVerify();
+      JSArgumentsObject::cast(this)->JSArgumentsObjectVerify(isolate);
       break;
     case JS_GENERATOR_OBJECT_TYPE:
-      JSGeneratorObject::cast(this)->JSGeneratorObjectVerify();
+      JSGeneratorObject::cast(this)->JSGeneratorObjectVerify(isolate);
       break;
     case JS_ASYNC_GENERATOR_OBJECT_TYPE:
-      JSAsyncGeneratorObject::cast(this)->JSAsyncGeneratorObjectVerify();
+      JSAsyncGeneratorObject::cast(this)->JSAsyncGeneratorObjectVerify(isolate);
       break;
     case JS_VALUE_TYPE:
-      JSValue::cast(this)->JSValueVerify();
+      JSValue::cast(this)->JSValueVerify(isolate);
       break;
     case JS_DATE_TYPE:
-      JSDate::cast(this)->JSDateVerify();
+      JSDate::cast(this)->JSDateVerify(isolate);
       break;
     case JS_BOUND_FUNCTION_TYPE:
-      JSBoundFunction::cast(this)->JSBoundFunctionVerify();
+      JSBoundFunction::cast(this)->JSBoundFunctionVerify(isolate);
       break;
     case JS_FUNCTION_TYPE:
-      JSFunction::cast(this)->JSFunctionVerify();
+      JSFunction::cast(this)->JSFunctionVerify(isolate);
       break;
     case JS_GLOBAL_PROXY_TYPE:
-      JSGlobalProxy::cast(this)->JSGlobalProxyVerify();
+      JSGlobalProxy::cast(this)->JSGlobalProxyVerify(isolate);
       break;
     case JS_GLOBAL_OBJECT_TYPE:
-      JSGlobalObject::cast(this)->JSGlobalObjectVerify();
+      JSGlobalObject::cast(this)->JSGlobalObjectVerify(isolate);
       break;
     case CELL_TYPE:
-      Cell::cast(this)->CellVerify();
+      Cell::cast(this)->CellVerify(isolate);
       break;
     case PROPERTY_CELL_TYPE:
-      PropertyCell::cast(this)->PropertyCellVerify();
+      PropertyCell::cast(this)->PropertyCellVerify(isolate);
       break;
     case WEAK_CELL_TYPE:
-      WeakCell::cast(this)->WeakCellVerify();
+      WeakCell::cast(this)->WeakCellVerify(isolate);
       break;
     case JS_ARRAY_TYPE:
-      JSArray::cast(this)->JSArrayVerify();
+      JSArray::cast(this)->JSArrayVerify(isolate);
       break;
     case JS_MODULE_NAMESPACE_TYPE:
-      JSModuleNamespace::cast(this)->JSModuleNamespaceVerify();
+      JSModuleNamespace::cast(this)->JSModuleNamespaceVerify(isolate);
       break;
     case JS_SET_TYPE:
-      JSSet::cast(this)->JSSetVerify();
+      JSSet::cast(this)->JSSetVerify(isolate);
       break;
     case JS_MAP_TYPE:
-      JSMap::cast(this)->JSMapVerify();
+      JSMap::cast(this)->JSMapVerify(isolate);
       break;
     case JS_SET_KEY_VALUE_ITERATOR_TYPE:
     case JS_SET_VALUE_ITERATOR_TYPE:
-      JSSetIterator::cast(this)->JSSetIteratorVerify();
+      JSSetIterator::cast(this)->JSSetIteratorVerify(isolate);
       break;
     case JS_MAP_KEY_ITERATOR_TYPE:
     case JS_MAP_KEY_VALUE_ITERATOR_TYPE:
     case JS_MAP_VALUE_ITERATOR_TYPE:
-      JSMapIterator::cast(this)->JSMapIteratorVerify();
+      JSMapIterator::cast(this)->JSMapIteratorVerify(isolate);
       break;
     case JS_ARRAY_ITERATOR_TYPE:
-      JSArrayIterator::cast(this)->JSArrayIteratorVerify();
+      JSArrayIterator::cast(this)->JSArrayIteratorVerify(isolate);
       break;
     case JS_STRING_ITERATOR_TYPE:
-      JSStringIterator::cast(this)->JSStringIteratorVerify();
+      JSStringIterator::cast(this)->JSStringIteratorVerify(isolate);
       break;
     case JS_ASYNC_FROM_SYNC_ITERATOR_TYPE:
-      JSAsyncFromSyncIterator::cast(this)->JSAsyncFromSyncIteratorVerify();
+      JSAsyncFromSyncIterator::cast(this)->JSAsyncFromSyncIteratorVerify(
+          isolate);
       break;
     case JS_WEAK_MAP_TYPE:
-      JSWeakMap::cast(this)->JSWeakMapVerify();
+      JSWeakMap::cast(this)->JSWeakMapVerify(isolate);
       break;
     case JS_WEAK_SET_TYPE:
-      JSWeakSet::cast(this)->JSWeakSetVerify();
+      JSWeakSet::cast(this)->JSWeakSetVerify(isolate);
       break;
     case JS_PROMISE_TYPE:
-      JSPromise::cast(this)->JSPromiseVerify();
+      JSPromise::cast(this)->JSPromiseVerify(isolate);
       break;
     case JS_REGEXP_TYPE:
-      JSRegExp::cast(this)->JSRegExpVerify();
+      JSRegExp::cast(this)->JSRegExpVerify(isolate);
       break;
     case JS_REGEXP_STRING_ITERATOR_TYPE:
-      JSRegExpStringIterator::cast(this)->JSRegExpStringIteratorVerify();
+      JSRegExpStringIterator::cast(this)->JSRegExpStringIteratorVerify(isolate);
       break;
     case FILLER_TYPE:
       break;
     case JS_PROXY_TYPE:
-      JSProxy::cast(this)->JSProxyVerify();
+      JSProxy::cast(this)->JSProxyVerify(isolate);
       break;
     case FOREIGN_TYPE:
-      Foreign::cast(this)->ForeignVerify();
+      Foreign::cast(this)->ForeignVerify(isolate);
+      break;
+    case UNCOMPILED_DATA_WITHOUT_PRE_PARSED_SCOPE_TYPE:
+      UncompiledDataWithoutPreParsedScope::cast(this)
+          ->UncompiledDataWithoutPreParsedScopeVerify(isolate);
+      break;
+    case UNCOMPILED_DATA_WITH_PRE_PARSED_SCOPE_TYPE:
+      UncompiledDataWithPreParsedScope::cast(this)
+          ->UncompiledDataWithPreParsedScopeVerify(isolate);
       break;
     case SHARED_FUNCTION_INFO_TYPE:
-      SharedFunctionInfo::cast(this)->SharedFunctionInfoVerify();
+      SharedFunctionInfo::cast(this)->SharedFunctionInfoVerify(isolate);
       break;
     case JS_MESSAGE_OBJECT_TYPE:
-      JSMessageObject::cast(this)->JSMessageObjectVerify();
+      JSMessageObject::cast(this)->JSMessageObjectVerify(isolate);
       break;
     case JS_ARRAY_BUFFER_TYPE:
-      JSArrayBuffer::cast(this)->JSArrayBufferVerify();
+      JSArrayBuffer::cast(this)->JSArrayBufferVerify(isolate);
       break;
     case JS_TYPED_ARRAY_TYPE:
-      JSTypedArray::cast(this)->JSTypedArrayVerify();
+      JSTypedArray::cast(this)->JSTypedArrayVerify(isolate);
       break;
     case JS_DATA_VIEW_TYPE:
-      JSDataView::cast(this)->JSDataViewVerify();
+      JSDataView::cast(this)->JSDataViewVerify(isolate);
       break;
     case SMALL_ORDERED_HASH_SET_TYPE:
-      SmallOrderedHashSet::cast(this)->SmallOrderedHashTableVerify();
+      SmallOrderedHashSet::cast(this)->SmallOrderedHashTableVerify(isolate);
       break;
     case SMALL_ORDERED_HASH_MAP_TYPE:
-      SmallOrderedHashMap::cast(this)->SmallOrderedHashTableVerify();
+      SmallOrderedHashMap::cast(this)->SmallOrderedHashTableVerify(isolate);
       break;
     case CODE_DATA_CONTAINER_TYPE:
-      CodeDataContainer::cast(this)->CodeDataContainerVerify();
+      CodeDataContainer::cast(this)->CodeDataContainerVerify(isolate);
+      break;
+#ifdef V8_INTL_SUPPORT
+    case JS_INTL_LOCALE_TYPE:
+      JSLocale::cast(this)->JSLocaleVerify(isolate);
       break;
+    case JS_INTL_RELATIVE_TIME_FORMAT_TYPE:
+      JSRelativeTimeFormat::cast(this)->JSRelativeTimeFormatVerify(isolate);
+      break;
+#endif  // V8_INTL_SUPPORT
 
-#define MAKE_STRUCT_CASE(NAME, Name, name) \
-  case NAME##_TYPE:                        \
-    Name::cast(this)->Name##Verify();      \
+#define MAKE_STRUCT_CASE(NAME, Name, name)   \
+  case NAME##_TYPE:                          \
+    Name::cast(this)->Name##Verify(isolate); \
     break;
-    STRUCT_LIST(MAKE_STRUCT_CASE)
+      STRUCT_LIST(MAKE_STRUCT_CASE)
 #undef MAKE_STRUCT_CASE
 
+    case ALLOCATION_SITE_TYPE:
+      AllocationSite::cast(this)->AllocationSiteVerify(isolate);
+      break;
+
     case LOAD_HANDLER_TYPE:
-      LoadHandler::cast(this)->LoadHandlerVerify();
+      LoadHandler::cast(this)->LoadHandlerVerify(isolate);
       break;
 
     case STORE_HANDLER_TYPE:
-      StoreHandler::cast(this)->StoreHandlerVerify();
+      StoreHandler::cast(this)->StoreHandlerVerify(isolate);
       break;
   }
 }
@@ -336,26 +390,17 @@ void HeapObject::VerifyHeapPointer(Object* p) {
   CHECK(ho->GetHeap()->Contains(ho));
 }
 
-
-void Symbol::SymbolVerify() {
+void Symbol::SymbolVerify(Isolate* isolate) {
   CHECK(IsSymbol());
   CHECK(HasHashCode());
   CHECK_GT(Hash(), 0);
-  CHECK(name()->IsUndefined(GetIsolate()) || name()->IsString());
+  CHECK(name()->IsUndefined(isolate) || name()->IsString());
   CHECK_IMPLIES(IsPrivateField(), IsPrivate());
 }
 
+void ByteArray::ByteArrayVerify(Isolate* isolate) { CHECK(IsByteArray()); }
 
-void HeapNumber::HeapNumberVerify() {
-  CHECK(IsHeapNumber() || IsMutableHeapNumber());
-}
-
-void ByteArray::ByteArrayVerify() {
-  CHECK(IsByteArray());
-}
-
-
-void BytecodeArray::BytecodeArrayVerify() {
+void BytecodeArray::BytecodeArrayVerify(Isolate* isolate) {
   // TODO(oth): Walk bytecodes and immediate values to validate sanity.
   // - All bytecodes are known and well formed.
   // - Jumps must go to new instructions starts.
@@ -366,19 +411,16 @@ void BytecodeArray::BytecodeArrayVerify() {
   VerifyHeapPointer(constant_pool());
 }
 
+void FreeSpace::FreeSpaceVerify(Isolate* isolate) { CHECK(IsFreeSpace()); }
 
-void FreeSpace::FreeSpaceVerify() {
-  CHECK(IsFreeSpace());
-}
-
-void FeedbackCell::FeedbackCellVerify() {
+void FeedbackCell::FeedbackCellVerify(Isolate* isolate) {
   CHECK(IsFeedbackCell());
-  Isolate* const isolate = GetIsolate();
+
   VerifyHeapPointer(value());
   CHECK(value()->IsUndefined(isolate) || value()->IsFeedbackVector());
 }
 
-void FeedbackVector::FeedbackVectorVerify() {
+void FeedbackVector::FeedbackVectorVerify(Isolate* isolate) {
   CHECK(IsFeedbackVector());
   MaybeObject* code = optimized_code_weak_or_smi();
   MaybeObject::VerifyMaybeObjectPointer(code);
@@ -387,14 +429,13 @@ void FeedbackVector::FeedbackVectorVerify() {
 }
 
 template <class Traits>
-void FixedTypedArray<Traits>::FixedTypedArrayVerify() {
+void FixedTypedArray<Traits>::FixedTypedArrayVerify(Isolate* isolate) {
   CHECK(IsHeapObject() &&
         HeapObject::cast(this)->map()->instance_type() ==
             Traits::kInstanceType);
   if (base_pointer() == this) {
-    CHECK(external_pointer() ==
-          ExternalReference::fixed_typed_array_base_data_offset(GetIsolate())
-              .address());
+    CHECK(reinterpret_cast<Address>(external_pointer()) ==
+          ExternalReference::fixed_typed_array_base_data_offset().address());
   } else {
     CHECK_NULL(base_pointer());
   }
@@ -405,11 +446,47 @@ bool JSObject::ElementsAreSafeToExamine() {
   // If a GC was caused while constructing this object, the elements
   // pointer may point to a one pointer filler map.
   return reinterpret_cast<Map*>(elements()) !=
-      GetHeap()->one_pointer_filler_map();
+         GetReadOnlyRoots().one_pointer_filler_map();
 }
 
+namespace {
+void VerifyJSObjectElements(Isolate* isolate, JSObject* object) {
+  // Only TypedArrays can have these specialized elements.
+  if (object->IsJSTypedArray()) {
+    // TODO(cbruni): Fix CreateTypedArray to either not instantiate the object
+    // or propertly initialize it on errors during construction.
+    /* CHECK(object->HasFixedTypedArrayElements()); */
+    /* CHECK(object->elements()->IsFixedTypedArrayBase()); */
+    return;
+  }
+  CHECK(!object->HasFixedTypedArrayElements());
+  CHECK(!object->elements()->IsFixedTypedArrayBase());
 
-void JSObject::JSObjectVerify() {
+  if (object->HasDoubleElements()) {
+    if (object->elements()->length() > 0) {
+      CHECK(object->elements()->IsFixedDoubleArray());
+    }
+    return;
+  }
+
+  FixedArray* elements = FixedArray::cast(object->elements());
+  if (object->HasSmiElements()) {
+    // We might have a partially initialized backing store, in which case we
+    // allow the hole + smi values.
+    for (int i = 0; i < elements->length(); i++) {
+      Object* value = elements->get(i);
+      CHECK(value->IsSmi() || value->IsTheHole(isolate));
+    }
+  } else if (object->HasObjectElements()) {
+    for (int i = 0; i < elements->length(); i++) {
+      Object* element = elements->get(i);
+      CHECK_IMPLIES(!element->IsSmi(), !HasWeakHeapObjectTag(element));
+    }
+  }
+}
+}  // namespace
+
+void JSObject::JSObjectVerify(Isolate* isolate) {
   VerifyPointer(raw_properties_or_hash());
   VerifyHeapPointer(elements());
 
@@ -430,7 +507,6 @@ void JSObject::JSObjectVerify() {
       CHECK_EQ(0, delta % JSObject::kFieldsAdded);
     }
     DescriptorArray* descriptors = map()->instance_descriptors();
-    Isolate* isolate = GetIsolate();
     bool is_transitionable_fast_elements_kind =
         IsTransitionableFastElementsKind(map()->elements_kind());
 
@@ -468,7 +544,7 @@ void JSObject::JSObjectVerify() {
       FixedArray* keys = enum_cache->keys();
       FixedArray* indices = enum_cache->indices();
       CHECK_LE(map()->EnumLength(), keys->length());
-      CHECK_IMPLIES(indices != isolate->heap()->empty_fixed_array(),
+      CHECK_IMPLIES(indices != ReadOnlyRoots(isolate).empty_fixed_array(),
                     keys->length() == indices->length());
     }
   }
@@ -477,18 +553,18 @@ void JSObject::JSObjectVerify() {
   // pointer may point to a one pointer filler map.
   if (ElementsAreSafeToExamine()) {
     CHECK_EQ((map()->has_fast_smi_or_object_elements() ||
-              (elements() == GetHeap()->empty_fixed_array()) ||
+              (elements() == GetReadOnlyRoots().empty_fixed_array()) ||
               HasFastStringWrapperElements()),
-             (elements()->map() == GetHeap()->fixed_array_map() ||
-              elements()->map() == GetHeap()->fixed_cow_array_map()));
-    CHECK(map()->has_fast_object_elements() == HasObjectElements());
+             (elements()->map() == GetReadOnlyRoots().fixed_array_map() ||
+              elements()->map() == GetReadOnlyRoots().fixed_cow_array_map()));
+    CHECK_EQ(map()->has_fast_object_elements(), HasObjectElements());
+    VerifyJSObjectElements(isolate, this);
   }
 }
 
-
-void Map::MapVerify() {
-  Heap* heap = GetHeap();
-  CHECK(!heap->InNewSpace(this));
+void Map::MapVerify(Isolate* isolate) {
+  Heap* heap = isolate->heap();
+  CHECK(!Heap::InNewSpace(this));
   CHECK(FIRST_TYPE <= instance_type() && instance_type() <= LAST_TYPE);
   CHECK(instance_size() == kVariableSizeSentinel ||
         (kPointerSize <= instance_size() &&
@@ -497,10 +573,12 @@ void Map::MapVerify() {
         !Map::cast(GetBackPointer())->is_stable());
   VerifyHeapPointer(prototype());
   VerifyHeapPointer(instance_descriptors());
-  SLOW_DCHECK(instance_descriptors()->IsSortedNoDuplicates());
+  SLOW_DCHECK(instance_descriptors()->IsSortedNoDuplicates(isolate));
   DisallowHeapAllocation no_gc;
-  SLOW_DCHECK(TransitionsAccessor(this, &no_gc).IsSortedNoDuplicates());
-  SLOW_DCHECK(TransitionsAccessor(this, &no_gc).IsConsistentWithBackPointers());
+  SLOW_DCHECK(
+      TransitionsAccessor(isolate, this, &no_gc).IsSortedNoDuplicates(isolate));
+  SLOW_DCHECK(TransitionsAccessor(isolate, this, &no_gc)
+                  .IsConsistentWithBackPointers());
   SLOW_DCHECK(!FLAG_unbox_double_fields ||
               layout_descriptor()->IsConsistentWithMap(this));
   if (!may_have_interesting_symbols()) {
@@ -526,37 +604,42 @@ void Map::MapVerify() {
         prototype_validity_cell()->IsCell());
 }
 
-
-void Map::DictionaryMapVerify() {
-  MapVerify();
+void Map::DictionaryMapVerify(Isolate* isolate) {
+  MapVerify(isolate);
   CHECK(is_dictionary_map());
   CHECK_EQ(kInvalidEnumCacheSentinel, EnumLength());
-  CHECK_EQ(GetHeap()->empty_descriptor_array(), instance_descriptors());
+  CHECK_EQ(ReadOnlyRoots(isolate).empty_descriptor_array(),
+           instance_descriptors());
   CHECK_EQ(0, UnusedPropertyFields());
   CHECK_EQ(Map::GetVisitorId(this), visitor_id());
 }
 
-void AliasedArgumentsEntry::AliasedArgumentsEntryVerify() {
+void AliasedArgumentsEntry::AliasedArgumentsEntryVerify(Isolate* isolate) {
   VerifySmiField(kAliasedContextSlot);
 }
 
-
-void FixedArray::FixedArrayVerify() {
+void FixedArray::FixedArrayVerify(Isolate* isolate) {
   for (int i = 0; i < length(); i++) {
     Object* e = get(i);
     VerifyPointer(e);
   }
 }
 
-void WeakFixedArray::WeakFixedArrayVerify() {
+void WeakFixedArray::WeakFixedArrayVerify(Isolate* isolate) {
+  for (int i = 0; i < length(); i++) {
+    MaybeObject::VerifyMaybeObjectPointer(Get(i));
+  }
+}
+
+void WeakArrayList::WeakArrayListVerify(Isolate* isolate) {
   for (int i = 0; i < length(); i++) {
     MaybeObject::VerifyMaybeObjectPointer(Get(i));
   }
 }
 
-void PropertyArray::PropertyArrayVerify() {
+void PropertyArray::PropertyArrayVerify(Isolate* isolate) {
   if (length() == 0) {
-    CHECK_EQ(this, this->GetHeap()->empty_property_array());
+    CHECK_EQ(this, ReadOnlyRoots(isolate).empty_property_array());
     return;
   }
   // There are no empty PropertyArrays.
@@ -567,7 +650,7 @@ void PropertyArray::PropertyArrayVerify() {
   }
 }
 
-void FixedDoubleArray::FixedDoubleArrayVerify() {
+void FixedDoubleArray::FixedDoubleArrayVerify(Isolate* isolate) {
   for (int i = 0; i < length(); i++) {
     if (!is_the_hole(i)) {
       uint64_t value = get_representation(i);
@@ -582,9 +665,9 @@ void FixedDoubleArray::FixedDoubleArrayVerify() {
   }
 }
 
-void FeedbackMetadata::FeedbackMetadataVerify() {
+void FeedbackMetadata::FeedbackMetadataVerify(Isolate* isolate) {
   if (slot_count() == 0) {
-    CHECK_EQ(GetHeap()->empty_feedback_metadata(), this);
+    CHECK_EQ(ReadOnlyRoots(isolate).empty_feedback_metadata(), this);
   } else {
     FeedbackMetadataIterator iter(this);
     while (iter.HasNext()) {
@@ -596,45 +679,54 @@ void FeedbackMetadata::FeedbackMetadataVerify() {
   }
 }
 
-void DescriptorArray::DescriptorArrayVerify() {
-  FixedArrayVerify();
+void DescriptorArray::DescriptorArrayVerify(Isolate* isolate) {
+  WeakFixedArrayVerify(isolate);
   int nof_descriptors = number_of_descriptors();
   if (number_of_descriptors_storage() == 0) {
-    Heap* heap = GetHeap();
-    CHECK_EQ(heap->empty_descriptor_array(), this);
+    Heap* heap = isolate->heap();
+    CHECK_EQ(ReadOnlyRoots(heap).empty_descriptor_array(), this);
     CHECK_EQ(2, length());
     CHECK_EQ(0, nof_descriptors);
-    CHECK_EQ(heap->empty_enum_cache(), GetEnumCache());
+    CHECK_EQ(ReadOnlyRoots(heap).empty_enum_cache(), GetEnumCache());
   } else {
     CHECK_LT(2, length());
     CHECK_LE(LengthFor(nof_descriptors), length());
 
-    Isolate* isolate = GetIsolate();
     // Check that properties with private symbols names are non-enumerable.
     for (int descriptor = 0; descriptor < nof_descriptors; descriptor++) {
-      Object* key = get(ToKeyIndex(descriptor));
+      Object* key = get(ToKeyIndex(descriptor))->ToObject();
       // number_of_descriptors() may be out of sync with the actual descriptors
       // written during descriptor array construction.
       if (key->IsUndefined(isolate)) continue;
+      PropertyDetails details = GetDetails(descriptor);
       if (Name::cast(key)->IsPrivate()) {
-        PropertyDetails details = GetDetails(descriptor);
         CHECK_NE(details.attributes() & DONT_ENUM, 0);
       }
+      MaybeObject* value = get(ToValueIndex(descriptor));
+      HeapObject* heap_object;
+      if (details.location() == kField) {
+        CHECK(value == MaybeObject::FromObject(FieldType::None()) ||
+              value == MaybeObject::FromObject(FieldType::Any()) ||
+              value->IsClearedWeakHeapObject() ||
+              (value->ToWeakHeapObject(&heap_object) && heap_object->IsMap()));
+      } else {
+        CHECK(!value->IsWeakOrClearedHeapObject());
+        CHECK(!value->ToObject()->IsMap());
+      }
     }
   }
 }
 
-void TransitionArray::TransitionArrayVerify() {
-  FixedArrayVerify();
+void TransitionArray::TransitionArrayVerify(Isolate* isolate) {
+  WeakFixedArrayVerify(isolate);
   CHECK_LE(LengthFor(number_of_transitions()), length());
 }
 
-void JSArgumentsObject::JSArgumentsObjectVerify() {
+void JSArgumentsObject::JSArgumentsObjectVerify(Isolate* isolate) {
   if (IsSloppyArgumentsElementsKind(GetElementsKind())) {
     SloppyArgumentsElements::cast(elements())
-        ->SloppyArgumentsElementsVerify(this);
+        ->SloppyArgumentsElementsVerify(isolate, this);
   }
-  Isolate* isolate = GetIsolate();
   if (isolate->IsInAnyContext(map(), Context::SLOPPY_ARGUMENTS_MAP_INDEX) ||
       isolate->IsInAnyContext(map(),
                               Context::SLOW_ALIASED_ARGUMENTS_MAP_INDEX) ||
@@ -646,12 +738,12 @@ void JSArgumentsObject::JSArgumentsObjectVerify() {
                                      Context::STRICT_ARGUMENTS_MAP_INDEX)) {
     VerifyObjectField(JSStrictArgumentsObject::kLengthOffset);
   }
-  JSObjectVerify();
+  JSObjectVerify(isolate);
 }
 
-void SloppyArgumentsElements::SloppyArgumentsElementsVerify(JSObject* holder) {
-  Isolate* isolate = GetIsolate();
-  FixedArrayVerify();
+void SloppyArgumentsElements::SloppyArgumentsElementsVerify(Isolate* isolate,
+                                                            JSObject* holder) {
+  FixedArrayVerify(isolate);
   // Abort verification if only partially initialized (can't use arguments()
   // getter because it does FixedArray::cast()).
   if (get(kArgumentsIndex)->IsUndefined(isolate)) return;
@@ -660,11 +752,11 @@ void SloppyArgumentsElements::SloppyArgumentsElementsVerify(JSObject* holder) {
   bool is_fast = kind == FAST_SLOPPY_ARGUMENTS_ELEMENTS;
   CHECK(IsFixedArray());
   CHECK_GE(length(), 2);
-  CHECK_EQ(map(), isolate->heap()->sloppy_arguments_elements_map());
+  CHECK_EQ(map(), ReadOnlyRoots(isolate).sloppy_arguments_elements_map());
   Context* context_object = Context::cast(context());
   FixedArray* arg_elements = FixedArray::cast(arguments());
   if (arg_elements->length() == 0) {
-    CHECK(arg_elements == isolate->heap()->empty_fixed_array());
+    CHECK(arg_elements == ReadOnlyRoots(isolate).empty_fixed_array());
     return;
   }
   ElementsAccessor* accessor;
@@ -703,37 +795,35 @@ void SloppyArgumentsElements::SloppyArgumentsElementsVerify(JSObject* holder) {
   CHECK_LE(maxMappedIndex, arg_elements->length());
 }
 
-void JSGeneratorObject::JSGeneratorObjectVerify() {
+void JSGeneratorObject::JSGeneratorObjectVerify(Isolate* isolate) {
   // In an expression like "new g()", there can be a point where a generator
   // object is allocated but its fields are all undefined, as it hasn't yet been
   // initialized by the generator.  Hence these weak checks.
   VerifyObjectField(kFunctionOffset);
   VerifyObjectField(kContextOffset);
   VerifyObjectField(kReceiverOffset);
-  VerifyObjectField(kRegisterFileOffset);
+  VerifyObjectField(kParametersAndRegistersOffset);
   VerifyObjectField(kContinuationOffset);
 }
 
-void JSAsyncGeneratorObject::JSAsyncGeneratorObjectVerify() {
+void JSAsyncGeneratorObject::JSAsyncGeneratorObjectVerify(Isolate* isolate) {
   // Check inherited fields
-  JSGeneratorObjectVerify();
+  JSGeneratorObjectVerify(isolate);
   VerifyObjectField(kQueueOffset);
-  queue()->HeapObjectVerify();
+  queue()->HeapObjectVerify(isolate);
 }
 
-void JSValue::JSValueVerify() {
+void JSValue::JSValueVerify(Isolate* isolate) {
   Object* v = value();
   if (v->IsHeapObject()) {
     VerifyHeapPointer(v);
   }
 }
 
-
-void JSDate::JSDateVerify() {
+void JSDate::JSDateVerify(Isolate* isolate) {
   if (value()->IsHeapObject()) {
     VerifyHeapPointer(value());
   }
-  Isolate* isolate = GetIsolate();
   CHECK(value()->IsUndefined(isolate) || value()->IsSmi() ||
         value()->IsHeapNumber());
   CHECK(year()->IsUndefined(isolate) || year()->IsSmi() || year()->IsNaN());
@@ -777,8 +867,7 @@ void JSDate::JSDateVerify() {
   }
 }
 
-
-void JSMessageObject::JSMessageObjectVerify() {
+void JSMessageObject::JSMessageObjectVerify(Isolate* isolate) {
   CHECK(IsJSMessageObject());
   VerifyObjectField(kStartPositionOffset);
   VerifyObjectField(kEndPositionOffset);
@@ -787,27 +876,25 @@ void JSMessageObject::JSMessageObjectVerify() {
   VerifyObjectField(kStackFramesOffset);
 }
 
-
-void String::StringVerify() {
+void String::StringVerify(Isolate* isolate) {
   CHECK(IsString());
   CHECK(length() >= 0 && length() <= Smi::kMaxValue);
-  CHECK_IMPLIES(length() == 0, this == GetHeap()->empty_string());
+  CHECK_IMPLIES(length() == 0, this == ReadOnlyRoots(isolate).empty_string());
   if (IsInternalizedString()) {
-    CHECK(!GetHeap()->InNewSpace(this));
+    CHECK(!Heap::InNewSpace(this));
   }
   if (IsConsString()) {
-    ConsString::cast(this)->ConsStringVerify();
+    ConsString::cast(this)->ConsStringVerify(isolate);
   } else if (IsSlicedString()) {
-    SlicedString::cast(this)->SlicedStringVerify();
+    SlicedString::cast(this)->SlicedStringVerify(isolate);
   } else if (IsThinString()) {
-    ThinString::cast(this)->ThinStringVerify();
+    ThinString::cast(this)->ThinStringVerify(isolate);
   }
 }
 
-
-void ConsString::ConsStringVerify() {
+void ConsString::ConsStringVerify(Isolate* isolate) {
   CHECK(this->first()->IsString());
-  CHECK(this->second() == GetHeap()->empty_string() ||
+  CHECK(this->second() == ReadOnlyRoots(isolate).empty_string() ||
         this->second()->IsString());
   CHECK_GE(this->length(), ConsString::kMinLength);
   CHECK(this->length() == this->first()->length() + this->second()->length());
@@ -819,36 +906,34 @@ void ConsString::ConsStringVerify() {
   }
 }
 
-void ThinString::ThinStringVerify() {
+void ThinString::ThinStringVerify(Isolate* isolate) {
   CHECK(this->actual()->IsInternalizedString());
   CHECK(this->actual()->IsSeqString() || this->actual()->IsExternalString());
 }
 
-void SlicedString::SlicedStringVerify() {
+void SlicedString::SlicedStringVerify(Isolate* isolate) {
   CHECK(!this->parent()->IsConsString());
   CHECK(!this->parent()->IsSlicedString());
   CHECK_GE(this->length(), SlicedString::kMinLength);
 }
 
-
-void JSBoundFunction::JSBoundFunctionVerify() {
+void JSBoundFunction::JSBoundFunctionVerify(Isolate* isolate) {
   CHECK(IsJSBoundFunction());
-  JSObjectVerify();
+  JSObjectVerify(isolate);
   VerifyObjectField(kBoundThisOffset);
   VerifyObjectField(kBoundTargetFunctionOffset);
   VerifyObjectField(kBoundArgumentsOffset);
   CHECK(IsCallable());
 
-  Isolate* const isolate = GetIsolate();
   if (!raw_bound_target_function()->IsUndefined(isolate)) {
     CHECK(bound_target_function()->IsCallable());
     CHECK_EQ(IsConstructor(), bound_target_function()->IsConstructor());
   }
 }
 
-void JSFunction::JSFunctionVerify() {
+void JSFunction::JSFunctionVerify(Isolate* isolate) {
   CHECK(IsJSFunction());
-  JSObjectVerify();
+  JSObjectVerify(isolate);
   VerifyHeapPointer(feedback_cell());
   CHECK(feedback_cell()->IsFeedbackCell());
   CHECK(code()->IsCode());
@@ -858,14 +943,12 @@ void JSFunction::JSFunctionVerify() {
   }
 }
 
-
-void SharedFunctionInfo::SharedFunctionInfoVerify() {
+void SharedFunctionInfo::SharedFunctionInfoVerify(Isolate* isolate) {
   CHECK(IsSharedFunctionInfo());
 
   VerifyObjectField(kFunctionDataOffset);
-  VerifyObjectField(kDebugInfoOffset);
   VerifyObjectField(kOuterScopeInfoOrFeedbackMetadataOffset);
-  VerifyObjectField(kFunctionIdentifierOffset);
+  VerifyObjectField(kFunctionIdentifierOrDebugInfoOffset);
   VerifyObjectField(kNameOrScopeInfoOffset);
   VerifyObjectField(kScriptOffset);
 
@@ -874,15 +957,16 @@ void SharedFunctionInfo::SharedFunctionInfoVerify() {
         value->IsScopeInfo());
   if (value->IsScopeInfo()) {
     CHECK_LT(0, ScopeInfo::cast(value)->length());
-    CHECK_NE(value, GetHeap()->empty_scope_info());
+    CHECK_NE(value, ReadOnlyRoots(isolate).empty_scope_info());
   }
 
-  Isolate* isolate = GetIsolate();
-  CHECK(HasCodeObject() || IsApiFunction() || HasBytecodeArray() ||
-        HasAsmWasmData() || HasBuiltinId() || HasPreParsedScopeData());
+  CHECK(HasWasmExportedFunctionData() || IsApiFunction() ||
+        HasBytecodeArray() || HasAsmWasmData() || HasBuiltinId() ||
+        HasUncompiledDataWithPreParsedScope() ||
+        HasUncompiledDataWithoutPreParsedScope());
 
-  CHECK(function_identifier()->IsUndefined(isolate) || HasBuiltinFunctionId() ||
-        HasInferredName());
+  CHECK(function_identifier_or_debug_info()->IsUndefined(isolate) ||
+        HasBuiltinFunctionId() || HasInferredName() || HasDebugInfo());
 
   if (!is_compiled()) {
     CHECK(!HasFeedbackMetadata());
@@ -901,8 +985,6 @@ void SharedFunctionInfo::SharedFunctionInfoVerify() {
     ScopeInfo* info = scope_info();
     CHECK(kind() == info->function_kind());
     CHECK_EQ(kind() == kModule, info->scope_type() == MODULE_SCOPE);
-    CHECK_EQ(raw_start_position(), info->StartPosition());
-    CHECK_EQ(raw_end_position(), info->EndPosition());
   }
 
   if (IsApiFunction()) {
@@ -919,35 +1001,32 @@ void SharedFunctionInfo::SharedFunctionInfoVerify() {
   }
 }
 
-
-void JSGlobalProxy::JSGlobalProxyVerify() {
+void JSGlobalProxy::JSGlobalProxyVerify(Isolate* isolate) {
   CHECK(IsJSGlobalProxy());
-  JSObjectVerify();
+  JSObjectVerify(isolate);
   VerifyObjectField(JSGlobalProxy::kNativeContextOffset);
   // Make sure that this object has no properties, elements.
   CHECK_EQ(0, FixedArray::cast(elements())->length());
 }
 
-
-void JSGlobalObject::JSGlobalObjectVerify() {
+void JSGlobalObject::JSGlobalObjectVerify(Isolate* isolate) {
   CHECK(IsJSGlobalObject());
   // Do not check the dummy global object for the builtins.
   if (global_dictionary()->NumberOfElements() == 0 &&
       elements()->length() == 0) {
     return;
   }
-  JSObjectVerify();
+  JSObjectVerify(isolate);
 }
 
-
-void Oddball::OddballVerify() {
+void Oddball::OddballVerify(Isolate* isolate) {
   CHECK(IsOddball());
-  Heap* heap = GetHeap();
+  Heap* heap = isolate->heap();
   VerifyHeapPointer(to_string());
   Object* number = to_number();
   if (number->IsHeapObject()) {
-    CHECK(number == heap->nan_value() ||
-          number == heap->hole_nan_value());
+    CHECK(number == ReadOnlyRoots(heap).nan_value() ||
+          number == ReadOnlyRoots(heap).hole_nan_value());
   } else {
     CHECK(number->IsSmi());
     int value = Smi::ToInt(number);
@@ -956,64 +1035,63 @@ void Oddball::OddballVerify() {
     CHECK_LE(value, 1);
     CHECK_GE(value, kLeastHiddenOddballNumber);
   }
-  if (map() == heap->undefined_map()) {
-    CHECK(this == heap->undefined_value());
-  } else if (map() == heap->the_hole_map()) {
-    CHECK(this == heap->the_hole_value());
-  } else if (map() == heap->null_map()) {
-    CHECK(this == heap->null_value());
-  } else if (map() == heap->boolean_map()) {
-    CHECK(this == heap->true_value() ||
-          this == heap->false_value());
-  } else if (map() == heap->uninitialized_map()) {
-    CHECK(this == heap->uninitialized_value());
-  } else if (map() == heap->arguments_marker_map()) {
-    CHECK(this == heap->arguments_marker());
-  } else if (map() == heap->termination_exception_map()) {
-    CHECK(this == heap->termination_exception());
-  } else if (map() == heap->exception_map()) {
-    CHECK(this == heap->exception());
-  } else if (map() == heap->optimized_out_map()) {
-    CHECK(this == heap->optimized_out());
-  } else if (map() == heap->stale_register_map()) {
-    CHECK(this == heap->stale_register());
+
+  ReadOnlyRoots roots(heap);
+  if (map() == roots.undefined_map()) {
+    CHECK(this == roots.undefined_value());
+  } else if (map() == roots.the_hole_map()) {
+    CHECK(this == roots.the_hole_value());
+  } else if (map() == roots.null_map()) {
+    CHECK(this == roots.null_value());
+  } else if (map() == roots.boolean_map()) {
+    CHECK(this == roots.true_value() || this == roots.false_value());
+  } else if (map() == roots.uninitialized_map()) {
+    CHECK(this == roots.uninitialized_value());
+  } else if (map() == roots.arguments_marker_map()) {
+    CHECK(this == roots.arguments_marker());
+  } else if (map() == roots.termination_exception_map()) {
+    CHECK(this == roots.termination_exception());
+  } else if (map() == roots.exception_map()) {
+    CHECK(this == roots.exception());
+  } else if (map() == roots.optimized_out_map()) {
+    CHECK(this == roots.optimized_out());
+  } else if (map() == roots.stale_register_map()) {
+    CHECK(this == roots.stale_register());
+  } else if (map() == roots.self_reference_marker_map()) {
+    // Multiple instances of this oddball may exist at once.
+    CHECK_EQ(kind(), Oddball::kSelfReferenceMarker);
   } else {
     UNREACHABLE();
   }
 }
 
-
-void Cell::CellVerify() {
+void Cell::CellVerify(Isolate* isolate) {
   CHECK(IsCell());
   VerifyObjectField(kValueOffset);
 }
 
-
-void PropertyCell::PropertyCellVerify() {
+void PropertyCell::PropertyCellVerify(Isolate* isolate) {
   CHECK(IsPropertyCell());
   VerifyObjectField(kValueOffset);
 }
 
-
-void WeakCell::WeakCellVerify() {
+void WeakCell::WeakCellVerify(Isolate* isolate) {
   CHECK(IsWeakCell());
   VerifyObjectField(kValueOffset);
 }
 
-void CodeDataContainer::CodeDataContainerVerify() {
+void CodeDataContainer::CodeDataContainerVerify(Isolate* isolate) {
   CHECK(IsCodeDataContainer());
   VerifyObjectField(kNextCodeLinkOffset);
-  CHECK(next_code_link()->IsCode() ||
-        next_code_link()->IsUndefined(GetIsolate()));
+  CHECK(next_code_link()->IsCode() || next_code_link()->IsUndefined(isolate));
 }
 
-void Code::CodeVerify() {
+void Code::CodeVerify(Isolate* isolate) {
   CHECK_LE(constant_pool_offset(), InstructionSize());
-  CHECK(IsAligned(reinterpret_cast<intptr_t>(InstructionStart()),
-                  kCodeAlignment));
-  relocation_info()->ObjectVerify();
-  Address last_gc_pc = nullptr;
-  Isolate* isolate = GetIsolate();
+  CHECK(IsAligned(InstructionStart(), kCodeAlignment));
+  relocation_info()->ObjectVerify(isolate);
+  Address last_gc_pc = kNullAddress;
+
   for (RelocIterator it(this); !it.done(); it.next()) {
     it.rinfo()->Verify(isolate);
     // Ensure that GC will not iterate twice over the same pointer.
@@ -1024,24 +1102,28 @@ void Code::CodeVerify() {
   }
 }
 
-
-void JSArray::JSArrayVerify() {
-  JSObjectVerify();
-  Isolate* isolate = GetIsolate();
+void JSArray::JSArrayVerify(Isolate* isolate) {
+  JSObjectVerify(isolate);
   CHECK(length()->IsNumber() || length()->IsUndefined(isolate));
   // If a GC was caused while constructing this array, the elements
   // pointer may point to a one pointer filler map.
   if (!ElementsAreSafeToExamine()) return;
   if (elements()->IsUndefined(isolate)) return;
   CHECK(elements()->IsFixedArray() || elements()->IsFixedDoubleArray());
+  if (elements()->length() == 0) {
+    CHECK_EQ(elements(), ReadOnlyRoots(isolate).empty_fixed_array());
+  }
   if (!length()->IsNumber()) return;
   // Verify that the length and the elements backing store are in sync.
   if (length()->IsSmi() && HasFastElements()) {
+    if (elements()->length() > 0) {
+      CHECK_IMPLIES(HasDoubleElements(), elements()->IsFixedDoubleArray());
+    }
     int size = Smi::ToInt(length());
     // Holey / Packed backing stores might have slack or might have not been
     // properly initialized yet.
     CHECK(size <= elements()->length() ||
-          elements() == isolate->heap()->empty_fixed_array());
+          elements() == ReadOnlyRoots(isolate).empty_fixed_array());
   } else {
     CHECK(HasDictionaryElements());
     uint32_t array_length;
@@ -1061,55 +1143,50 @@ void JSArray::JSArrayVerify() {
   }
 }
 
-
-void JSSet::JSSetVerify() {
+void JSSet::JSSetVerify(Isolate* isolate) {
   CHECK(IsJSSet());
-  JSObjectVerify();
+  JSObjectVerify(isolate);
   VerifyHeapPointer(table());
-  CHECK(table()->IsOrderedHashSet() || table()->IsUndefined(GetIsolate()));
+  CHECK(table()->IsOrderedHashSet() || table()->IsUndefined(isolate));
   // TODO(arv): Verify OrderedHashTable too.
 }
 
-
-void JSMap::JSMapVerify() {
+void JSMap::JSMapVerify(Isolate* isolate) {
   CHECK(IsJSMap());
-  JSObjectVerify();
+  JSObjectVerify(isolate);
   VerifyHeapPointer(table());
-  CHECK(table()->IsOrderedHashMap() || table()->IsUndefined(GetIsolate()));
+  CHECK(table()->IsOrderedHashMap() || table()->IsUndefined(isolate));
   // TODO(arv): Verify OrderedHashTable too.
 }
 
-
-void JSSetIterator::JSSetIteratorVerify() {
+void JSSetIterator::JSSetIteratorVerify(Isolate* isolate) {
   CHECK(IsJSSetIterator());
-  JSObjectVerify();
+  JSObjectVerify(isolate);
   VerifyHeapPointer(table());
   CHECK(table()->IsOrderedHashSet());
   CHECK(index()->IsSmi());
 }
 
-
-void JSMapIterator::JSMapIteratorVerify() {
+void JSMapIterator::JSMapIteratorVerify(Isolate* isolate) {
   CHECK(IsJSMapIterator());
-  JSObjectVerify();
+  JSObjectVerify(isolate);
   VerifyHeapPointer(table());
   CHECK(table()->IsOrderedHashMap());
   CHECK(index()->IsSmi());
 }
 
-
-void JSWeakMap::JSWeakMapVerify() {
+void JSWeakMap::JSWeakMapVerify(Isolate* isolate) {
   CHECK(IsJSWeakMap());
-  JSObjectVerify();
+  JSObjectVerify(isolate);
   VerifyHeapPointer(table());
-  CHECK(table()->IsHashTable() || table()->IsUndefined(GetIsolate()));
+  CHECK(table()->IsEphemeronHashTable() || table()->IsUndefined(isolate));
 }
 
-void JSArrayIterator::JSArrayIteratorVerify() {
+void JSArrayIterator::JSArrayIteratorVerify(Isolate* isolate) {
   CHECK(IsJSArrayIterator());
-  JSObjectVerify();
+  JSObjectVerify(isolate);
   CHECK(iterated_object()->IsJSReceiver() ||
-        iterated_object()->IsUndefined(GetIsolate()));
+        iterated_object()->IsUndefined(isolate));
 
   CHECK_GE(next_index()->Number(), 0);
   CHECK_LE(next_index()->Number(), kMaxSafeInteger);
@@ -1124,50 +1201,49 @@ void JSArrayIterator::JSArrayIteratorVerify() {
   }
 }
 
-void JSStringIterator::JSStringIteratorVerify() {
+void JSStringIterator::JSStringIteratorVerify(Isolate* isolate) {
   CHECK(IsJSStringIterator());
-  JSObjectVerify();
+  JSObjectVerify(isolate);
   CHECK(string()->IsString());
 
   CHECK_GE(index(), 0);
   CHECK_LE(index(), String::kMaxLength);
 }
 
-void JSAsyncFromSyncIterator::JSAsyncFromSyncIteratorVerify() {
+void JSAsyncFromSyncIterator::JSAsyncFromSyncIteratorVerify(Isolate* isolate) {
   CHECK(IsJSAsyncFromSyncIterator());
-  JSObjectVerify();
+  JSObjectVerify(isolate);
   VerifyHeapPointer(sync_iterator());
 }
 
-void JSWeakSet::JSWeakSetVerify() {
+void JSWeakSet::JSWeakSetVerify(Isolate* isolate) {
   CHECK(IsJSWeakSet());
-  JSObjectVerify();
+  JSObjectVerify(isolate);
   VerifyHeapPointer(table());
-  CHECK(table()->IsHashTable() || table()->IsUndefined(GetIsolate()));
+  CHECK(table()->IsEphemeronHashTable() || table()->IsUndefined(isolate));
 }
 
-void Microtask::MicrotaskVerify() { CHECK(IsMicrotask()); }
+void Microtask::MicrotaskVerify(Isolate* isolate) { CHECK(IsMicrotask()); }
 
-void CallableTask::CallableTaskVerify() {
+void CallableTask::CallableTaskVerify(Isolate* isolate) {
   CHECK(IsCallableTask());
-  MicrotaskVerify();
+  MicrotaskVerify(isolate);
   VerifyHeapPointer(callable());
   CHECK(callable()->IsCallable());
   VerifyHeapPointer(context());
   CHECK(context()->IsContext());
 }
 
-void CallbackTask::CallbackTaskVerify() {
+void CallbackTask::CallbackTaskVerify(Isolate* isolate) {
   CHECK(IsCallbackTask());
-  MicrotaskVerify();
+  MicrotaskVerify(isolate);
   VerifyHeapPointer(callback());
   VerifyHeapPointer(data());
 }
 
-void PromiseReactionJobTask::PromiseReactionJobTaskVerify() {
+void PromiseReactionJobTask::PromiseReactionJobTaskVerify(Isolate* isolate) {
   CHECK(IsPromiseReactionJobTask());
-  MicrotaskVerify();
-  Isolate* isolate = GetIsolate();
+  MicrotaskVerify(isolate);
   VerifyPointer(argument());
   VerifyHeapPointer(context());
   CHECK(context()->IsContext());
@@ -1178,19 +1254,22 @@ void PromiseReactionJobTask::PromiseReactionJobTaskVerify() {
         promise_or_capability()->IsPromiseCapability());
 }
 
-void PromiseFulfillReactionJobTask::PromiseFulfillReactionJobTaskVerify() {
+void PromiseFulfillReactionJobTask::PromiseFulfillReactionJobTaskVerify(
+    Isolate* isolate) {
   CHECK(IsPromiseFulfillReactionJobTask());
-  PromiseReactionJobTaskVerify();
+  PromiseReactionJobTaskVerify(isolate);
 }
 
-void PromiseRejectReactionJobTask::PromiseRejectReactionJobTaskVerify() {
+void PromiseRejectReactionJobTask::PromiseRejectReactionJobTaskVerify(
+    Isolate* isolate) {
   CHECK(IsPromiseRejectReactionJobTask());
-  PromiseReactionJobTaskVerify();
+  PromiseReactionJobTaskVerify(isolate);
 }
 
-void PromiseResolveThenableJobTask::PromiseResolveThenableJobTaskVerify() {
+void PromiseResolveThenableJobTask::PromiseResolveThenableJobTaskVerify(
+    Isolate* isolate) {
   CHECK(IsPromiseResolveThenableJobTask());
-  MicrotaskVerify();
+  MicrotaskVerify(isolate);
   VerifyHeapPointer(context());
   CHECK(context()->IsContext());
   VerifyHeapPointer(promise_to_resolve());
@@ -1202,18 +1281,18 @@ void PromiseResolveThenableJobTask::PromiseResolveThenableJobTaskVerify() {
   CHECK(thenable()->IsJSReceiver());
 }
 
-void PromiseCapability::PromiseCapabilityVerify() {
+void PromiseCapability::PromiseCapabilityVerify(Isolate* isolate) {
   CHECK(IsPromiseCapability());
-  Isolate* isolate = GetIsolate();
+
   VerifyHeapPointer(promise());
   CHECK(promise()->IsJSReceiver() || promise()->IsUndefined(isolate));
   VerifyPointer(resolve());
   VerifyPointer(reject());
 }
 
-void PromiseReaction::PromiseReactionVerify() {
+void PromiseReaction::PromiseReactionVerify(Isolate* isolate) {
   CHECK(IsPromiseReaction());
-  Isolate* isolate = GetIsolate();
+
   VerifyPointer(next());
   CHECK(next()->IsSmi() || next()->IsPromiseReaction());
   VerifyHeapPointer(reject_handler());
@@ -1227,9 +1306,9 @@ void PromiseReaction::PromiseReactionVerify() {
         promise_or_capability()->IsPromiseCapability());
 }
 
-void JSPromise::JSPromiseVerify() {
+void JSPromise::JSPromiseVerify(Isolate* isolate) {
   CHECK(IsJSPromise());
-  JSObjectVerify();
+  JSObjectVerify(isolate);
   VerifyPointer(reactions_or_result());
   VerifySmiField(kFlagsOffset);
   if (status() == Promise::kPending) {
@@ -1238,38 +1317,45 @@ void JSPromise::JSPromiseVerify() {
 }
 
 template <typename Derived>
-void SmallOrderedHashTable<Derived>::SmallOrderedHashTableVerify() {
+void SmallOrderedHashTable<Derived>::SmallOrderedHashTableVerify(
+    Isolate* isolate) {
   CHECK(IsSmallOrderedHashTable());
-  Isolate* isolate = GetIsolate();
+
+  int capacity = Capacity();
+  CHECK_GE(capacity, kMinCapacity);
+  CHECK_LE(capacity, kMaxCapacity);
 
   for (int entry = 0; entry < NumberOfBuckets(); entry++) {
     int bucket = GetFirstEntry(entry);
     if (bucket == kNotFound) continue;
-
-    for (int offset = 0; offset < Derived::kEntrySize; offset++) {
-      Object* val = GetDataEntry(bucket, offset);
-      CHECK(!val->IsTheHole(isolate));
-    }
+    CHECK_GE(bucket, 0);
+    CHECK_LE(bucket, capacity);
   }
 
   for (int entry = 0; entry < NumberOfElements(); entry++) {
     int chain = GetNextEntry(entry);
     if (chain == kNotFound) continue;
+    CHECK_GE(chain, 0);
+    CHECK_LE(chain, capacity);
+  }
 
+  for (int entry = 0; entry < NumberOfElements(); entry++) {
     for (int offset = 0; offset < Derived::kEntrySize; offset++) {
-      Object* val = GetDataEntry(chain, offset);
-      CHECK(!val->IsTheHole(isolate));
+      Object* val = GetDataEntry(entry, offset);
+      VerifyPointer(val);
     }
   }
 
-  for (int entry = 0; entry < NumberOfElements(); entry++) {
+  for (int entry = NumberOfElements(); entry < NumberOfDeletedElements();
+       entry++) {
     for (int offset = 0; offset < Derived::kEntrySize; offset++) {
       Object* val = GetDataEntry(entry, offset);
-      VerifyPointer(val);
+      CHECK(val->IsTheHole(isolate));
     }
   }
 
-  for (int entry = NumberOfElements(); entry < Capacity(); entry++) {
+  for (int entry = NumberOfElements() + NumberOfDeletedElements();
+       entry < Capacity(); entry++) {
     for (int offset = 0; offset < Derived::kEntrySize; offset++) {
       Object* val = GetDataEntry(entry, offset);
       CHECK(val->IsTheHole(isolate));
@@ -1277,14 +1363,13 @@ void SmallOrderedHashTable<Derived>::SmallOrderedHashTableVerify() {
   }
 }
 
-template void
-SmallOrderedHashTable<SmallOrderedHashMap>::SmallOrderedHashTableVerify();
-template void
-SmallOrderedHashTable<SmallOrderedHashSet>::SmallOrderedHashTableVerify();
+template void SmallOrderedHashTable<
+    SmallOrderedHashMap>::SmallOrderedHashTableVerify(Isolate* isolate);
+template void SmallOrderedHashTable<
+    SmallOrderedHashSet>::SmallOrderedHashTableVerify(Isolate* isolate);
 
-void JSRegExp::JSRegExpVerify() {
-  JSObjectVerify();
-  Isolate* isolate = GetIsolate();
+void JSRegExp::JSRegExpVerify(Isolate* isolate) {
+  JSObjectVerify(isolate);
   CHECK(data()->IsUndefined(isolate) || data()->IsFixedArray());
   switch (TypeTag()) {
     case JSRegExp::ATOM: {
@@ -1319,19 +1404,18 @@ void JSRegExp::JSRegExpVerify() {
   }
 }
 
-void JSRegExpStringIterator::JSRegExpStringIteratorVerify() {
+void JSRegExpStringIterator::JSRegExpStringIteratorVerify(Isolate* isolate) {
   CHECK(IsJSRegExpStringIterator());
-  JSObjectVerify();
+  JSObjectVerify(isolate);
   CHECK(iterating_string()->IsString());
   CHECK(iterating_regexp()->IsObject());
   VerifySmiField(kFlagsOffset);
 }
 
-void JSProxy::JSProxyVerify() {
+void JSProxy::JSProxyVerify(Isolate* isolate) {
   CHECK(IsJSProxy());
   VerifyPointer(target());
   VerifyPointer(handler());
-  Isolate* isolate = GetIsolate();
   if (!IsRevoked()) {
     CHECK_EQ(target()->IsCallable(), map()->is_callable());
     CHECK_EQ(target()->IsConstructor(), map()->is_constructor());
@@ -1341,21 +1425,18 @@ void JSProxy::JSProxyVerify() {
   CHECK_EQ(0, map()->NumberOfOwnDescriptors());
 }
 
-
-void JSArrayBuffer::JSArrayBufferVerify() {
+void JSArrayBuffer::JSArrayBufferVerify(Isolate* isolate) {
   CHECK(IsJSArrayBuffer());
-  JSObjectVerify();
+  JSObjectVerify(isolate);
   VerifyPointer(byte_length());
   CHECK(byte_length()->IsSmi() || byte_length()->IsHeapNumber() ||
-        byte_length()->IsUndefined(GetIsolate()));
+        byte_length()->IsUndefined(isolate));
 }
 
-
-void JSArrayBufferView::JSArrayBufferViewVerify() {
+void JSArrayBufferView::JSArrayBufferViewVerify(Isolate* isolate) {
   CHECK(IsJSArrayBufferView());
-  JSObjectVerify();
+  JSObjectVerify(isolate);
   VerifyPointer(buffer());
-  Isolate* isolate = GetIsolate();
   CHECK(buffer()->IsJSArrayBuffer() || buffer()->IsUndefined(isolate) ||
         buffer() == Smi::kZero);
 
@@ -1368,28 +1449,22 @@ void JSArrayBufferView::JSArrayBufferViewVerify() {
         raw_byte_length()->IsUndefined(isolate));
 }
 
-
-void JSTypedArray::JSTypedArrayVerify() {
+void JSTypedArray::JSTypedArrayVerify(Isolate* isolate) {
   CHECK(IsJSTypedArray());
-  JSArrayBufferViewVerify();
+  JSArrayBufferViewVerify(isolate);
   VerifyPointer(raw_length());
-  CHECK(raw_length()->IsSmi() || raw_length()->IsUndefined(GetIsolate()));
+  CHECK(raw_length()->IsSmi() || raw_length()->IsUndefined(isolate));
   VerifyPointer(elements());
 }
 
-
-void JSDataView::JSDataViewVerify() {
+void JSDataView::JSDataViewVerify(Isolate* isolate) {
   CHECK(IsJSDataView());
-  JSArrayBufferViewVerify();
-}
-
-
-void Foreign::ForeignVerify() {
-  CHECK(IsForeign());
+  JSArrayBufferViewVerify(isolate);
 }
 
+void Foreign::ForeignVerify(Isolate* isolate) { CHECK(IsForeign()); }
 
-void AsyncGeneratorRequest::AsyncGeneratorRequestVerify() {
+void AsyncGeneratorRequest::AsyncGeneratorRequestVerify(Isolate* isolate) {
   CHECK(IsAsyncGeneratorRequest());
   VerifySmiField(kResumeModeOffset);
   CHECK_GE(resume_mode(), JSGeneratorObject::kNext);
@@ -1397,22 +1472,21 @@ void AsyncGeneratorRequest::AsyncGeneratorRequestVerify() {
   CHECK(promise()->IsJSPromise());
   VerifyPointer(value());
   VerifyPointer(next());
-  next()->ObjectVerify();
+  next()->ObjectVerify(isolate);
 }
 
-void BigInt::BigIntVerify() {
+void BigInt::BigIntVerify(Isolate* isolate) {
   CHECK(IsBigInt());
   CHECK_GE(length(), 0);
   CHECK_IMPLIES(is_zero(), !sign());  // There is no -0n.
 }
 
-void JSModuleNamespace::JSModuleNamespaceVerify() {
+void JSModuleNamespace::JSModuleNamespaceVerify(Isolate* isolate) {
   CHECK(IsJSModuleNamespace());
   VerifyPointer(module());
 }
 
-void ModuleInfoEntry::ModuleInfoEntryVerify() {
-  Isolate* isolate = GetIsolate();
+void ModuleInfoEntry::ModuleInfoEntryVerify(Isolate* isolate) {
   CHECK(IsModuleInfoEntry());
 
   CHECK(export_name()->IsUndefined(isolate) || export_name()->IsString());
@@ -1429,7 +1503,7 @@ void ModuleInfoEntry::ModuleInfoEntryVerify() {
                 local_name()->IsUndefined(isolate));
 }
 
-void Module::ModuleVerify() {
+void Module::ModuleVerify(Isolate* isolate) {
   CHECK(IsModule());
 
   VerifyPointer(code());
@@ -1447,9 +1521,9 @@ void Module::ModuleVerify() {
         (status() == kInstantiating && code()->IsJSFunction()) ||
         (code()->IsSharedFunctionInfo()));
 
-  CHECK_EQ(status() == kErrored, !exception()->IsTheHole(GetIsolate()));
+  CHECK_EQ(status() == kErrored, !exception()->IsTheHole(isolate));
 
-  CHECK(module_namespace()->IsUndefined(GetIsolate()) ||
+  CHECK(module_namespace()->IsUndefined(isolate) ||
         module_namespace()->IsJSModuleNamespace());
   if (module_namespace()->IsJSModuleNamespace()) {
     CHECK_LE(kInstantiating, status());
@@ -1458,60 +1532,63 @@ void Module::ModuleVerify() {
 
   CHECK_EQ(requested_modules()->length(), info()->module_requests()->length());
 
-  CHECK(import_meta()->IsTheHole(GetIsolate()) || import_meta()->IsJSObject());
+  CHECK(import_meta()->IsTheHole(isolate) || import_meta()->IsJSObject());
 
   CHECK_NE(hash(), 0);
 }
 
-void PrototypeInfo::PrototypeInfoVerify() {
+void PrototypeInfo::PrototypeInfoVerify(Isolate* isolate) {
   CHECK(IsPrototypeInfo());
-  CHECK(weak_cell()->IsWeakCell() || weak_cell()->IsUndefined(GetIsolate()));
+  CHECK(weak_cell()->IsWeakCell() || weak_cell()->IsUndefined(isolate));
   if (prototype_users()->IsFixedArrayOfWeakCells()) {
-    FixedArrayOfWeakCells::cast(prototype_users())->FixedArrayVerify();
+    FixedArrayOfWeakCells::cast(prototype_users())->FixedArrayVerify(isolate);
   } else {
     CHECK(prototype_users()->IsSmi());
   }
 }
 
-void Tuple2::Tuple2Verify() {
+void Tuple2::Tuple2Verify(Isolate* isolate) {
   CHECK(IsTuple2());
-  Heap* heap = GetHeap();
-  if (this == heap->empty_enum_cache()) {
-    CHECK_EQ(heap->empty_fixed_array(), EnumCache::cast(this)->keys());
-    CHECK_EQ(heap->empty_fixed_array(), EnumCache::cast(this)->indices());
+  Heap* heap = isolate->heap();
+  if (this == ReadOnlyRoots(heap).empty_enum_cache()) {
+    CHECK_EQ(ReadOnlyRoots(heap).empty_fixed_array(),
+             EnumCache::cast(this)->keys());
+    CHECK_EQ(ReadOnlyRoots(heap).empty_fixed_array(),
+             EnumCache::cast(this)->indices());
   } else {
     VerifyObjectField(kValue1Offset);
     VerifyObjectField(kValue2Offset);
   }
 }
 
-void Tuple3::Tuple3Verify() {
+void Tuple3::Tuple3Verify(Isolate* isolate) {
   CHECK(IsTuple3());
   VerifyObjectField(kValue1Offset);
   VerifyObjectField(kValue2Offset);
   VerifyObjectField(kValue3Offset);
 }
 
-void WasmCompiledModule::WasmCompiledModuleVerify() {
-  CHECK(IsWasmCompiledModule());
-  VerifyObjectField(kSharedOffset);
-  VerifyObjectField(kNativeContextOffset);
-  VerifyObjectField(kExportWrappersOffset);
-  VerifyObjectField(kNextInstanceOffset);
-  VerifyObjectField(kPrevInstanceOffset);
-  VerifyObjectField(kOwningInstanceOffset);
-  VerifyObjectField(kWasmModuleOffset);
-  VerifyObjectField(kNativeModuleOffset);
-  VerifyObjectField(kLazyCompileDataOffset);
-  VerifyObjectField(kUseTrapHandlerOffset);
+void ObjectBoilerplateDescription::ObjectBoilerplateDescriptionVerify(
+    Isolate* isolate) {
+  CHECK(IsObjectBoilerplateDescription());
+  CHECK_GE(this->length(),
+           ObjectBoilerplateDescription::kDescriptionStartIndex);
+  this->FixedArrayVerify(isolate);
+}
+
+void ArrayBoilerplateDescription::ArrayBoilerplateDescriptionVerify(
+    Isolate* isolate) {
+  CHECK(IsArrayBoilerplateDescription());
+  CHECK(constant_elements()->IsFixedArrayBase());
+  VerifyObjectField(kConstantElementsOffset);
 }
 
-void WasmDebugInfo::WasmDebugInfoVerify() {
+void WasmDebugInfo::WasmDebugInfoVerify(Isolate* isolate) {
   CHECK(IsWasmDebugInfo());
   VerifyObjectField(kInstanceOffset);
   CHECK(wasm_instance()->IsWasmInstanceObject());
   VerifyObjectField(kInterpreterHandleOffset);
-  CHECK(interpreter_handle()->IsUndefined(GetIsolate()) ||
+  CHECK(interpreter_handle()->IsUndefined(isolate) ||
         interpreter_handle()->IsForeign());
   VerifyObjectField(kInterpretedFunctionsOffset);
   VerifyObjectField(kLocalsNamesOffset);
@@ -1519,24 +1596,46 @@ void WasmDebugInfo::WasmDebugInfoVerify() {
   VerifyObjectField(kCWasmEntryMapOffset);
 }
 
-void WasmSharedModuleData::WasmSharedModuleDataVerify() {
-  CHECK(IsWasmSharedModuleData());
-  VerifyObjectField(kModuleWrapperOffset);
-  CHECK(module_wrapper()->IsForeign());
-  VerifyObjectField(kModuleBytesOffset);
+void WasmInstanceObject::WasmInstanceObjectVerify(Isolate* isolate) {
+  JSObjectVerify(isolate);
+  CHECK(IsWasmInstanceObject());
+
+  // Just generically check all tagged fields. Don't check the untagged fields,
+  // as some of them might still contain the "undefined" value if the
+  // WasmInstanceObject is not fully set up yet.
+  for (int offset = kHeaderSize; offset < kFirstUntaggedOffset;
+       offset += kPointerSize) {
+    VerifyObjectField(offset);
+  }
+}
+
+void WasmExportedFunctionData::WasmExportedFunctionDataVerify(
+    Isolate* isolate) {
+  CHECK(IsWasmExportedFunctionData());
+  VerifyObjectField(kWrapperCodeOffset);
+  CHECK(wrapper_code()->kind() == Code::JS_TO_WASM_FUNCTION ||
+        wrapper_code()->kind() == Code::C_WASM_ENTRY);
+  VerifyObjectField(kInstanceOffset);
+  VerifySmiField(kFunctionIndexOffset);
+}
+
+void WasmModuleObject::WasmModuleObjectVerify(Isolate* isolate) {
+  CHECK(IsWasmModuleObject());
+  VerifyObjectField(kNativeModuleOffset);
+  VerifyObjectField(kExportWrappersOffset);
   VerifyObjectField(kScriptOffset);
   VerifyObjectField(kAsmJsOffsetTableOffset);
   VerifyObjectField(kBreakPointInfosOffset);
 }
 
-void DataHandler::DataHandlerVerify() {
+void DataHandler::DataHandlerVerify(Isolate* isolate) {
   CHECK(IsDataHandler());
   CHECK_IMPLIES(!smi_handler()->IsSmi(),
                 smi_handler()->IsCode() && IsStoreHandler());
   CHECK(validity_cell()->IsSmi() || validity_cell()->IsCell());
   int data_count = data_field_count();
   if (data_count >= 1) {
-    VerifyObjectField(kData1Offset);
+    VerifyMaybeObjectField(kData1Offset);
   }
   if (data_count >= 2) {
     VerifyObjectField(kData2Offset);
@@ -1546,41 +1645,33 @@ void DataHandler::DataHandlerVerify() {
   }
 }
 
-void LoadHandler::LoadHandlerVerify() {
-  DataHandler::DataHandlerVerify();
+void LoadHandler::LoadHandlerVerify(Isolate* isolate) {
+  DataHandler::DataHandlerVerify(isolate);
   // TODO(ishell): check handler integrity
 }
 
-void StoreHandler::StoreHandlerVerify() {
-  DataHandler::DataHandlerVerify();
+void StoreHandler::StoreHandlerVerify(Isolate* isolate) {
+  DataHandler::DataHandlerVerify(isolate);
   // TODO(ishell): check handler integrity
 }
 
-void ContextExtension::ContextExtensionVerify() {
-  CHECK(IsContextExtension());
-  VerifyObjectField(kScopeInfoOffset);
-  VerifyObjectField(kExtensionOffset);
-}
-
-void AccessorInfo::AccessorInfoVerify() {
+void AccessorInfo::AccessorInfoVerify(Isolate* isolate) {
   CHECK(IsAccessorInfo());
   VerifyPointer(name());
   VerifyPointer(expected_receiver_type());
-  VerifyForeignPointer(this, getter());
-  VerifyForeignPointer(this, setter());
-  VerifyForeignPointer(this, js_getter());
+  VerifyForeignPointer(isolate, this, getter());
+  VerifyForeignPointer(isolate, this, setter());
+  VerifyForeignPointer(isolate, this, js_getter());
   VerifyPointer(data());
 }
 
-
-void AccessorPair::AccessorPairVerify() {
+void AccessorPair::AccessorPairVerify(Isolate* isolate) {
   CHECK(IsAccessorPair());
   VerifyPointer(getter());
   VerifyPointer(setter());
 }
 
-
-void AccessCheckInfo::AccessCheckInfoVerify() {
+void AccessCheckInfo::AccessCheckInfoVerify(Isolate* isolate) {
   CHECK(IsAccessCheckInfo());
   VerifyPointer(callback());
   VerifyPointer(named_interceptor());
@@ -1588,37 +1679,38 @@ void AccessCheckInfo::AccessCheckInfoVerify() {
   VerifyPointer(data());
 }
 
-void CallHandlerInfo::CallHandlerInfoVerify() {
+void CallHandlerInfo::CallHandlerInfoVerify(Isolate* isolate) {
   CHECK(IsCallHandlerInfo());
-  CHECK(map() == GetHeap()->side_effect_call_handler_info_map() ||
-        map() == GetHeap()->side_effect_free_call_handler_info_map());
+  CHECK(map() == ReadOnlyRoots(isolate).side_effect_call_handler_info_map() ||
+        map() ==
+            ReadOnlyRoots(isolate).side_effect_free_call_handler_info_map() ||
+        map() == ReadOnlyRoots(isolate)
+                     .next_call_side_effect_free_call_handler_info_map());
   VerifyPointer(callback());
   VerifyPointer(js_callback());
   VerifyPointer(data());
 }
 
-void InterceptorInfo::InterceptorInfoVerify() {
+void InterceptorInfo::InterceptorInfoVerify(Isolate* isolate) {
   CHECK(IsInterceptorInfo());
-  VerifyForeignPointer(this, getter());
-  VerifyForeignPointer(this, setter());
-  VerifyForeignPointer(this, query());
-  VerifyForeignPointer(this, deleter());
-  VerifyForeignPointer(this, enumerator());
+  VerifyForeignPointer(isolate, this, getter());
+  VerifyForeignPointer(isolate, this, setter());
+  VerifyForeignPointer(isolate, this, query());
+  VerifyForeignPointer(isolate, this, deleter());
+  VerifyForeignPointer(isolate, this, enumerator());
   VerifyPointer(data());
   VerifySmiField(kFlagsOffset);
 }
 
-
-void TemplateInfo::TemplateInfoVerify() {
+void TemplateInfo::TemplateInfoVerify(Isolate* isolate) {
   VerifyPointer(tag());
   VerifyPointer(property_list());
   VerifyPointer(property_accessors());
 }
 
-
-void FunctionTemplateInfo::FunctionTemplateInfoVerify() {
+void FunctionTemplateInfo::FunctionTemplateInfoVerify(Isolate* isolate) {
   CHECK(IsFunctionTemplateInfo());
-  TemplateInfoVerify();
+  TemplateInfoVerify(isolate);
   VerifyPointer(serial_number());
   VerifyPointer(call_code());
   VerifyPointer(prototype_template());
@@ -1631,32 +1723,27 @@ void FunctionTemplateInfo::FunctionTemplateInfoVerify() {
   VerifyPointer(cached_property_name());
 }
 
-
-void ObjectTemplateInfo::ObjectTemplateInfoVerify() {
+void ObjectTemplateInfo::ObjectTemplateInfoVerify(Isolate* isolate) {
   CHECK(IsObjectTemplateInfo());
-  TemplateInfoVerify();
+  TemplateInfoVerify(isolate);
   VerifyPointer(constructor());
   VerifyPointer(data());
 }
 
-
-void AllocationSite::AllocationSiteVerify() {
+void AllocationSite::AllocationSiteVerify(Isolate* isolate) {
   CHECK(IsAllocationSite());
 }
 
-
-void AllocationMemento::AllocationMementoVerify() {
+void AllocationMemento::AllocationMementoVerify(Isolate* isolate) {
   CHECK(IsAllocationMemento());
   VerifyHeapPointer(allocation_site());
   CHECK(!IsValid() || GetAllocationSite()->IsAllocationSite());
 }
 
-
-void Script::ScriptVerify() {
+void Script::ScriptVerify(Isolate* isolate) {
   CHECK(IsScript());
   VerifyPointer(source());
   VerifyPointer(name());
-  VerifyPointer(wrapper());
   VerifyPointer(line_ends());
   for (int i = 0; i < shared_function_infos()->length(); ++i) {
     MaybeObject* maybe_object = shared_function_infos()->Get(i);
@@ -1664,20 +1751,18 @@ void Script::ScriptVerify() {
     CHECK(maybe_object->IsWeakHeapObject() ||
           maybe_object->IsClearedWeakHeapObject() ||
           (maybe_object->ToStrongHeapObject(&heap_object) &&
-           heap_object->IsUndefined(GetIsolate())));
+           heap_object->IsUndefined(isolate)));
   }
 }
 
-
-void NormalizedMapCache::NormalizedMapCacheVerify() {
-  FixedArray::cast(this)->FixedArrayVerify();
+void NormalizedMapCache::NormalizedMapCacheVerify(Isolate* isolate) {
+  FixedArray::cast(this)->FixedArrayVerify(isolate);
   if (FLAG_enable_slow_asserts) {
-    Isolate* isolate = GetIsolate();
     for (int i = 0; i < length(); i++) {
       Object* e = FixedArray::get(i);
       if (e->IsWeakCell()) {
         if (!WeakCell::cast(e)->cleared()) {
-          Map::cast(WeakCell::cast(e)->value())->DictionaryMapVerify();
+          Map::cast(WeakCell::cast(e)->value())->DictionaryMapVerify(isolate);
         }
       } else {
         CHECK(e->IsUndefined(isolate));
@@ -1686,39 +1771,74 @@ void NormalizedMapCache::NormalizedMapCacheVerify() {
   }
 }
 
-
-void DebugInfo::DebugInfoVerify() {
+void DebugInfo::DebugInfoVerify(Isolate* isolate) {
   CHECK(IsDebugInfo());
   VerifyPointer(shared());
-  VerifyPointer(debug_bytecode_array());
+  VerifyPointer(function_identifier());
+  VerifyPointer(original_bytecode_array());
   VerifyPointer(break_points());
 }
 
-
-void StackFrameInfo::StackFrameInfoVerify() {
+void StackFrameInfo::StackFrameInfoVerify(Isolate* isolate) {
   CHECK(IsStackFrameInfo());
   VerifyPointer(script_name());
   VerifyPointer(script_name_or_source_url());
   VerifyPointer(function_name());
 }
 
-void PreParsedScopeData::PreParsedScopeDataVerify() {
+void PreParsedScopeData::PreParsedScopeDataVerify(Isolate* isolate) {
   CHECK(IsPreParsedScopeData());
   CHECK(scope_data()->IsByteArray());
   CHECK(child_data()->IsFixedArray());
 }
 
-void InterpreterData::InterpreterDataVerify() {
+void UncompiledDataWithPreParsedScope::UncompiledDataWithPreParsedScopeVerify(
+    Isolate* isolate) {
+  CHECK(IsUncompiledDataWithPreParsedScope());
+  VerifyPointer(pre_parsed_scope_data());
+}
+
+void UncompiledDataWithoutPreParsedScope::
+    UncompiledDataWithoutPreParsedScopeVerify(Isolate* isolate) {
+  CHECK(IsUncompiledDataWithoutPreParsedScope());
+}
+
+void InterpreterData::InterpreterDataVerify(Isolate* isolate) {
   CHECK(IsInterpreterData());
   CHECK(bytecode_array()->IsBytecodeArray());
   CHECK(interpreter_trampoline()->IsCode());
 }
 
+#ifdef V8_INTL_SUPPORT
+void JSLocale::JSLocaleVerify(Isolate* isolate) {
+  VerifyObjectField(kLanguageOffset);
+  VerifyObjectField(kScriptOffset);
+  VerifyObjectField(kRegionOffset);
+  VerifyObjectField(kBaseNameOffset);
+  VerifyObjectField(kLocaleOffset);
+  // Unicode extension fields.
+  VerifyObjectField(kCalendarOffset);
+  VerifyObjectField(kCaseFirstOffset);
+  VerifyObjectField(kCollationOffset);
+  VerifyObjectField(kHourCycleOffset);
+  VerifyObjectField(kNumericOffset);
+  VerifyObjectField(kNumberingSystemOffset);
+}
+
+void JSRelativeTimeFormat::JSRelativeTimeFormatVerify(Isolate* isolate) {
+  VerifyObjectField(kLocaleOffset);
+  VerifyObjectField(kStyleOffset);
+  VerifyObjectField(kNumericOffset);
+  VerifyObjectField(kFormatterOffset);
+}
+#endif  // V8_INTL_SUPPORT
+
 #endif  // VERIFY_HEAP
 
 #ifdef DEBUG
 
-void JSObject::IncrementSpillStatistics(SpillInformation* info) {
+void JSObject::IncrementSpillStatistics(Isolate* isolate,
+                                        SpillInformation* info) {
   info->number_of_objects_++;
   // Named properties
   if (HasFastProperties()) {
@@ -1749,7 +1869,6 @@ void JSObject::IncrementSpillStatistics(SpillInformation* info) {
       int holes = 0;
       FixedArray* e = FixedArray::cast(elements());
       int len = e->length();
-      Isolate* isolate = GetIsolate();
       for (int i = 0; i < len; i++) {
         if (e->get(i)->IsTheHole(isolate)) holes++;
       }
@@ -1821,21 +1940,21 @@ void JSObject::SpillInformation::Print() {
   PrintF("\n");
 }
 
-
-bool DescriptorArray::IsSortedNoDuplicates(int valid_entries) {
+bool DescriptorArray::IsSortedNoDuplicates(Isolate* isolate,
+                                           int valid_entries) {
   if (valid_entries == -1) valid_entries = number_of_descriptors();
   Name* current_key = nullptr;
   uint32_t current = 0;
   for (int i = 0; i < number_of_descriptors(); i++) {
     Name* key = GetSortedKey(i);
     if (key == current_key) {
-      Print();
+      Print(isolate);
       return false;
     }
     current_key = key;
     uint32_t hash = GetSortedKey(i)->Hash();
     if (hash < current) {
-      Print();
+      Print(isolate);
       return false;
     }
     current = hash;
@@ -1843,22 +1962,23 @@ bool DescriptorArray::IsSortedNoDuplicates(int valid_entries) {
   return true;
 }
 
-
-bool TransitionArray::IsSortedNoDuplicates(int valid_entries) {
+bool TransitionArray::IsSortedNoDuplicates(Isolate* isolate,
+                                           int valid_entries) {
   DCHECK_EQ(valid_entries, -1);
   Name* prev_key = nullptr;
   PropertyKind prev_kind = kData;
   PropertyAttributes prev_attributes = NONE;
   uint32_t prev_hash = 0;
+
   for (int i = 0; i < number_of_transitions(); i++) {
     Name* key = GetSortedKey(i);
     uint32_t hash = key->Hash();
     PropertyKind kind = kData;
     PropertyAttributes attributes = NONE;
-    if (!TransitionsAccessor::IsSpecialTransition(key)) {
+    if (!TransitionsAccessor::IsSpecialTransition(isolate, key)) {
       Map* target = GetTarget(i);
       PropertyDetails details =
-          TransitionsAccessor::GetTargetDetails(key, target);
+          TransitionsAccessor::GetTargetDetails(isolate, key, target);
       kind = details.kind();
       attributes = details.attributes();
     } else {
@@ -1869,7 +1989,7 @@ bool TransitionArray::IsSortedNoDuplicates(int valid_entries) {
     int cmp = CompareKeys(prev_key, prev_hash, prev_kind, prev_attributes, key,
                           hash, kind, attributes);
     if (cmp >= 0) {
-      Print();
+      Print(isolate);
       return false;
     }
     prev_key = key;
@@ -1880,10 +2000,10 @@ bool TransitionArray::IsSortedNoDuplicates(int valid_entries) {
   return true;
 }
 
-bool TransitionsAccessor::IsSortedNoDuplicates() {
+bool TransitionsAccessor::IsSortedNoDuplicates(Isolate* isolate) {
   // Simple and non-existent transitions are always sorted.
   if (encoding() != kFullTransitionArray) return true;
-  return transitions()->IsSortedNoDuplicates();
+  return transitions()->IsSortedNoDuplicates(isolate);
 }
 
 
@@ -1927,10 +2047,9 @@ bool CanLeak(Object* obj, Heap* heap, bool skip_weak_cell) {
   return CanLeak(HeapObject::cast(obj)->map(), heap, skip_weak_cell);
 }
 
-
-void Code::VerifyEmbeddedObjects(VerifyMode mode) {
+void Code::VerifyEmbeddedObjects(Isolate* isolate, VerifyMode mode) {
   if (kind() == OPTIMIZED_FUNCTION) return;
-  Heap* heap = GetIsolate()->heap();
+  Heap* heap = isolate->heap();
   int mask = RelocInfo::ModeMask(RelocInfo::EMBEDDED_OBJECT);
   bool skip_weak_cell = (mode == kNoContextSpecificPointers) ? false : true;
   for (RelocIterator it(this, mask); !it.done(); it.next()) {
diff --git a/deps/v8/src/objects-definitions.h b/deps/v8/src/objects-definitions.h
new file mode 100644
index 00000000000000..a16158f65794f2
--- /dev/null
+++ b/deps/v8/src/objects-definitions.h
@@ -0,0 +1,343 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef V8_OBJECTS_DEFINITIONS_H_
+#define V8_OBJECTS_DEFINITIONS_H_
+
+#include "src/heap-symbols.h"
+
+namespace v8 {
+
+namespace internal {
+
+// All Maps have a field instance_type containing a InstanceType.
+// It describes the type of the instances.
+//
+// As an example, a JavaScript object is a heap object and its map
+// instance_type is JS_OBJECT_TYPE.
+//
+// The names of the string instance types are intended to systematically
+// mirror their encoding in the instance_type field of the map.  The default
+// encoding is considered TWO_BYTE.  It is not mentioned in the name.  ONE_BYTE
+// encoding is mentioned explicitly in the name.  Likewise, the default
+// representation is considered sequential.  It is not mentioned in the
+// name.  The other representations (e.g. CONS, EXTERNAL) are explicitly
+// mentioned.  Finally, the string is either a STRING_TYPE (if it is a normal
+// string) or a INTERNALIZED_STRING_TYPE (if it is a internalized string).
+//
+// NOTE: The following things are some that depend on the string types having
+// instance_types that are less than those of all other types:
+// HeapObject::Size, HeapObject::IterateBody, the typeof operator, and
+// Object::IsString.
+//
+// NOTE: Everything following JS_VALUE_TYPE is considered a
+// JSObject for GC purposes. The first four entries here have typeof
+// 'object', whereas JS_FUNCTION_TYPE has typeof 'function'.
+//
+// NOTE: List had to be split into two, because of conditional item(s) from
+// INTL namespace. They can't just be appended to the end, because of the
+// checks we do in tests (expecting JS_FUNCTION_TYPE to be last).
+#define INSTANCE_TYPE_LIST_BEFORE_INTL(V)                       \
+  V(INTERNALIZED_STRING_TYPE)                                   \
+  V(EXTERNAL_INTERNALIZED_STRING_TYPE)                          \
+  V(ONE_BYTE_INTERNALIZED_STRING_TYPE)                          \
+  V(EXTERNAL_ONE_BYTE_INTERNALIZED_STRING_TYPE)                 \
+  V(EXTERNAL_INTERNALIZED_STRING_WITH_ONE_BYTE_DATA_TYPE)       \
+  V(SHORT_EXTERNAL_INTERNALIZED_STRING_TYPE)                    \
+  V(SHORT_EXTERNAL_ONE_BYTE_INTERNALIZED_STRING_TYPE)           \
+  V(SHORT_EXTERNAL_INTERNALIZED_STRING_WITH_ONE_BYTE_DATA_TYPE) \
+  V(STRING_TYPE)                                                \
+  V(CONS_STRING_TYPE)                                           \
+  V(EXTERNAL_STRING_TYPE)                                       \
+  V(SLICED_STRING_TYPE)                                         \
+  V(THIN_STRING_TYPE)                                           \
+  V(ONE_BYTE_STRING_TYPE)                                       \
+  V(CONS_ONE_BYTE_STRING_TYPE)                                  \
+  V(EXTERNAL_ONE_BYTE_STRING_TYPE)                              \
+  V(SLICED_ONE_BYTE_STRING_TYPE)                                \
+  V(THIN_ONE_BYTE_STRING_TYPE)                                  \
+  V(EXTERNAL_STRING_WITH_ONE_BYTE_DATA_TYPE)                    \
+  V(SHORT_EXTERNAL_STRING_TYPE)                                 \
+  V(SHORT_EXTERNAL_ONE_BYTE_STRING_TYPE)                        \
+  V(SHORT_EXTERNAL_STRING_WITH_ONE_BYTE_DATA_TYPE)              \
+                                                                \
+  V(SYMBOL_TYPE)                                                \
+  V(HEAP_NUMBER_TYPE)                                           \
+  V(BIGINT_TYPE)                                                \
+  V(ODDBALL_TYPE)                                               \
+                                                                \
+  V(MAP_TYPE)                                                   \
+  V(CODE_TYPE)                                                  \
+  V(MUTABLE_HEAP_NUMBER_TYPE)                                   \
+  V(FOREIGN_TYPE)                                               \
+  V(BYTE_ARRAY_TYPE)                                            \
+  V(BYTECODE_ARRAY_TYPE)                                        \
+  V(FREE_SPACE_TYPE)                                            \
+                                                                \
+  V(FIXED_INT8_ARRAY_TYPE)                                      \
+  V(FIXED_UINT8_ARRAY_TYPE)                                     \
+  V(FIXED_INT16_ARRAY_TYPE)                                     \
+  V(FIXED_UINT16_ARRAY_TYPE)                                    \
+  V(FIXED_INT32_ARRAY_TYPE)                                     \
+  V(FIXED_UINT32_ARRAY_TYPE)                                    \
+  V(FIXED_FLOAT32_ARRAY_TYPE)                                   \
+  V(FIXED_FLOAT64_ARRAY_TYPE)                                   \
+  V(FIXED_UINT8_CLAMPED_ARRAY_TYPE)                             \
+  V(FIXED_BIGINT64_ARRAY_TYPE)                                  \
+  V(FIXED_BIGUINT64_ARRAY_TYPE)                                 \
+                                                                \
+  V(FIXED_DOUBLE_ARRAY_TYPE)                                    \
+  V(FEEDBACK_METADATA_TYPE)                                     \
+  V(FILLER_TYPE)                                                \
+                                                                \
+  V(ACCESS_CHECK_INFO_TYPE)                                     \
+  V(ACCESSOR_INFO_TYPE)                                         \
+  V(ACCESSOR_PAIR_TYPE)                                         \
+  V(ALIASED_ARGUMENTS_ENTRY_TYPE)                               \
+  V(ALLOCATION_MEMENTO_TYPE)                                    \
+  V(ASYNC_GENERATOR_REQUEST_TYPE)                               \
+  V(DEBUG_INFO_TYPE)                                            \
+  V(FUNCTION_TEMPLATE_INFO_TYPE)                                \
+  V(INTERCEPTOR_INFO_TYPE)                                      \
+  V(INTERPRETER_DATA_TYPE)                                      \
+  V(MODULE_INFO_ENTRY_TYPE)                                     \
+  V(MODULE_TYPE)                                                \
+  V(OBJECT_TEMPLATE_INFO_TYPE)                                  \
+  V(PROMISE_CAPABILITY_TYPE)                                    \
+  V(PROMISE_REACTION_TYPE)                                      \
+  V(PROTOTYPE_INFO_TYPE)                                        \
+  V(SCRIPT_TYPE)                                                \
+  V(STACK_FRAME_INFO_TYPE)                                      \
+  V(TUPLE2_TYPE)                                                \
+  V(TUPLE3_TYPE)                                                \
+  V(ARRAY_BOILERPLATE_DESCRIPTION_TYPE)                         \
+  V(WASM_DEBUG_INFO_TYPE)                                       \
+  V(WASM_EXPORTED_FUNCTION_DATA_TYPE)                           \
+                                                                \
+  V(CALLABLE_TASK_TYPE)                                         \
+  V(CALLBACK_TASK_TYPE)                                         \
+  V(PROMISE_FULFILL_REACTION_JOB_TASK_TYPE)                     \
+  V(PROMISE_REJECT_REACTION_JOB_TASK_TYPE)                      \
+  V(PROMISE_RESOLVE_THENABLE_JOB_TASK_TYPE)                     \
+                                                                \
+  V(ALLOCATION_SITE_TYPE)                                       \
+                                                                \
+  V(FIXED_ARRAY_TYPE)                                           \
+  V(OBJECT_BOILERPLATE_DESCRIPTION_TYPE)                        \
+  V(HASH_TABLE_TYPE)                                            \
+  V(ORDERED_HASH_MAP_TYPE)                                      \
+  V(ORDERED_HASH_SET_TYPE)                                      \
+  V(NAME_DICTIONARY_TYPE)                                       \
+  V(GLOBAL_DICTIONARY_TYPE)                                     \
+  V(NUMBER_DICTIONARY_TYPE)                                     \
+  V(SIMPLE_NUMBER_DICTIONARY_TYPE)                              \
+  V(STRING_TABLE_TYPE)                                          \
+  V(EPHEMERON_HASH_TABLE_TYPE)                                  \
+  V(SCOPE_INFO_TYPE)                                            \
+  V(SCRIPT_CONTEXT_TABLE_TYPE)                                  \
+                                                                \
+  V(BLOCK_CONTEXT_TYPE)                                         \
+  V(CATCH_CONTEXT_TYPE)                                         \
+  V(DEBUG_EVALUATE_CONTEXT_TYPE)                                \
+  V(EVAL_CONTEXT_TYPE)                                          \
+  V(FUNCTION_CONTEXT_TYPE)                                      \
+  V(MODULE_CONTEXT_TYPE)                                        \
+  V(NATIVE_CONTEXT_TYPE)                                        \
+  V(SCRIPT_CONTEXT_TYPE)                                        \
+  V(WITH_CONTEXT_TYPE)                                          \
+                                                                \
+  V(WEAK_FIXED_ARRAY_TYPE)                                      \
+  V(DESCRIPTOR_ARRAY_TYPE)                                      \
+  V(TRANSITION_ARRAY_TYPE)                                      \
+                                                                \
+  V(CALL_HANDLER_INFO_TYPE)                                     \
+  V(CELL_TYPE)                                                  \
+  V(CODE_DATA_CONTAINER_TYPE)                                   \
+  V(FEEDBACK_CELL_TYPE)                                         \
+  V(FEEDBACK_VECTOR_TYPE)                                       \
+  V(LOAD_HANDLER_TYPE)                                          \
+  V(PROPERTY_ARRAY_TYPE)                                        \
+  V(PROPERTY_CELL_TYPE)                                         \
+  V(SHARED_FUNCTION_INFO_TYPE)                                  \
+  V(SMALL_ORDERED_HASH_MAP_TYPE)                                \
+  V(SMALL_ORDERED_HASH_SET_TYPE)                                \
+  V(STORE_HANDLER_TYPE)                                         \
+  V(UNCOMPILED_DATA_WITHOUT_PRE_PARSED_SCOPE_TYPE)              \
+  V(UNCOMPILED_DATA_WITH_PRE_PARSED_SCOPE_TYPE)                 \
+  V(WEAK_CELL_TYPE)                                             \
+  V(WEAK_ARRAY_LIST_TYPE)                                       \
+                                                                \
+  V(JS_PROXY_TYPE)                                              \
+  V(JS_GLOBAL_OBJECT_TYPE)                                      \
+  V(JS_GLOBAL_PROXY_TYPE)                                       \
+  V(JS_MODULE_NAMESPACE_TYPE)                                   \
+  V(JS_SPECIAL_API_OBJECT_TYPE)                                 \
+  V(JS_VALUE_TYPE)                                              \
+  V(JS_API_OBJECT_TYPE)                                         \
+  V(JS_OBJECT_TYPE)                                             \
+                                                                \
+  V(JS_ARGUMENTS_TYPE)                                          \
+  V(JS_ARRAY_BUFFER_TYPE)                                       \
+  V(JS_ARRAY_ITERATOR_TYPE)                                     \
+  V(JS_ARRAY_TYPE)                                              \
+  V(JS_ASYNC_FROM_SYNC_ITERATOR_TYPE)                           \
+  V(JS_ASYNC_GENERATOR_OBJECT_TYPE)                             \
+  V(JS_CONTEXT_EXTENSION_OBJECT_TYPE)                           \
+  V(JS_DATE_TYPE)                                               \
+  V(JS_ERROR_TYPE)                                              \
+  V(JS_GENERATOR_OBJECT_TYPE)                                   \
+  V(JS_MAP_TYPE)                                                \
+  V(JS_MAP_KEY_ITERATOR_TYPE)                                   \
+  V(JS_MAP_KEY_VALUE_ITERATOR_TYPE)                             \
+  V(JS_MAP_VALUE_ITERATOR_TYPE)                                 \
+  V(JS_MESSAGE_OBJECT_TYPE)                                     \
+  V(JS_PROMISE_TYPE)                                            \
+  V(JS_REGEXP_TYPE)                                             \
+  V(JS_REGEXP_STRING_ITERATOR_TYPE)                             \
+  V(JS_SET_TYPE)                                                \
+  V(JS_SET_KEY_VALUE_ITERATOR_TYPE)                             \
+  V(JS_SET_VALUE_ITERATOR_TYPE)                                 \
+  V(JS_STRING_ITERATOR_TYPE)                                    \
+  V(JS_WEAK_MAP_TYPE)                                           \
+  V(JS_WEAK_SET_TYPE)                                           \
+  V(JS_TYPED_ARRAY_TYPE)                                        \
+  V(JS_DATA_VIEW_TYPE)
+
+#define INSTANCE_TYPE_LIST_AFTER_INTL(V) \
+  V(WASM_GLOBAL_TYPE)                    \
+  V(WASM_INSTANCE_TYPE)                  \
+  V(WASM_MEMORY_TYPE)                    \
+  V(WASM_MODULE_TYPE)                    \
+  V(WASM_TABLE_TYPE)                     \
+  V(JS_BOUND_FUNCTION_TYPE)              \
+  V(JS_FUNCTION_TYPE)
+
+#ifdef V8_INTL_SUPPORT
+#define INSTANCE_TYPE_LIST(V)          \
+  INSTANCE_TYPE_LIST_BEFORE_INTL(V)    \
+  V(JS_INTL_LOCALE_TYPE)               \
+  V(JS_INTL_RELATIVE_TIME_FORMAT_TYPE) \
+  INSTANCE_TYPE_LIST_AFTER_INTL(V)
+#else
+#define INSTANCE_TYPE_LIST(V)       \
+  INSTANCE_TYPE_LIST_BEFORE_INTL(V) \
+  INSTANCE_TYPE_LIST_AFTER_INTL(V)
+#endif  // V8_INTL_SUPPORT
+
+// Since string types are not consecutive, this macro is used to
+// iterate over them.
+#define STRING_TYPE_LIST(V)                                                   \
+  V(STRING_TYPE, kVariableSizeSentinel, string, String)                       \
+  V(ONE_BYTE_STRING_TYPE, kVariableSizeSentinel, one_byte_string,             \
+    OneByteString)                                                            \
+  V(CONS_STRING_TYPE, ConsString::kSize, cons_string, ConsString)             \
+  V(CONS_ONE_BYTE_STRING_TYPE, ConsString::kSize, cons_one_byte_string,       \
+    ConsOneByteString)                                                        \
+  V(SLICED_STRING_TYPE, SlicedString::kSize, sliced_string, SlicedString)     \
+  V(SLICED_ONE_BYTE_STRING_TYPE, SlicedString::kSize, sliced_one_byte_string, \
+    SlicedOneByteString)                                                      \
+  V(EXTERNAL_STRING_TYPE, ExternalTwoByteString::kSize, external_string,      \
+    ExternalString)                                                           \
+  V(EXTERNAL_ONE_BYTE_STRING_TYPE, ExternalOneByteString::kSize,              \
+    external_one_byte_string, ExternalOneByteString)                          \
+  V(EXTERNAL_STRING_WITH_ONE_BYTE_DATA_TYPE, ExternalTwoByteString::kSize,    \
+    external_string_with_one_byte_data, ExternalStringWithOneByteData)        \
+  V(SHORT_EXTERNAL_STRING_TYPE, ExternalTwoByteString::kShortSize,            \
+    short_external_string, ShortExternalString)                               \
+  V(SHORT_EXTERNAL_ONE_BYTE_STRING_TYPE, ExternalOneByteString::kShortSize,   \
+    short_external_one_byte_string, ShortExternalOneByteString)               \
+  V(SHORT_EXTERNAL_STRING_WITH_ONE_BYTE_DATA_TYPE,                            \
+    ExternalTwoByteString::kShortSize,                                        \
+    short_external_string_with_one_byte_data,                                 \
+    ShortExternalStringWithOneByteData)                                       \
+                                                                              \
+  V(INTERNALIZED_STRING_TYPE, kVariableSizeSentinel, internalized_string,     \
+    InternalizedString)                                                       \
+  V(ONE_BYTE_INTERNALIZED_STRING_TYPE, kVariableSizeSentinel,                 \
+    one_byte_internalized_string, OneByteInternalizedString)                  \
+  V(EXTERNAL_INTERNALIZED_STRING_TYPE, ExternalTwoByteString::kSize,          \
+    external_internalized_string, ExternalInternalizedString)                 \
+  V(EXTERNAL_ONE_BYTE_INTERNALIZED_STRING_TYPE, ExternalOneByteString::kSize, \
+    external_one_byte_internalized_string, ExternalOneByteInternalizedString) \
+  V(EXTERNAL_INTERNALIZED_STRING_WITH_ONE_BYTE_DATA_TYPE,                     \
+    ExternalTwoByteString::kSize,                                             \
+    external_internalized_string_with_one_byte_data,                          \
+    ExternalInternalizedStringWithOneByteData)                                \
+  V(SHORT_EXTERNAL_INTERNALIZED_STRING_TYPE,                                  \
+    ExternalTwoByteString::kShortSize, short_external_internalized_string,    \
+    ShortExternalInternalizedString)                                          \
+  V(SHORT_EXTERNAL_ONE_BYTE_INTERNALIZED_STRING_TYPE,                         \
+    ExternalOneByteString::kShortSize,                                        \
+    short_external_one_byte_internalized_string,                              \
+    ShortExternalOneByteInternalizedString)                                   \
+  V(SHORT_EXTERNAL_INTERNALIZED_STRING_WITH_ONE_BYTE_DATA_TYPE,               \
+    ExternalTwoByteString::kShortSize,                                        \
+    short_external_internalized_string_with_one_byte_data,                    \
+    ShortExternalInternalizedStringWithOneByteData)                           \
+  V(THIN_STRING_TYPE, ThinString::kSize, thin_string, ThinString)             \
+  V(THIN_ONE_BYTE_STRING_TYPE, ThinString::kSize, thin_one_byte_string,       \
+    ThinOneByteString)
+
+// A struct is a simple object a set of object-valued fields.  Including an
+// object type in this causes the compiler to generate most of the boilerplate
+// code for the class including allocation and garbage collection routines,
+// casts and predicates.  All you need to define is the class, methods and
+// object verification routines.  Easy, no?
+//
+// Note that for subtle reasons related to the ordering or numerical values of
+// type tags, elements in this list have to be added to the INSTANCE_TYPE_LIST
+// manually.
+#define STRUCT_LIST(V)                                                       \
+  V(ACCESS_CHECK_INFO, AccessCheckInfo, access_check_info)                   \
+  V(ACCESSOR_INFO, AccessorInfo, accessor_info)                              \
+  V(ACCESSOR_PAIR, AccessorPair, accessor_pair)                              \
+  V(ALIASED_ARGUMENTS_ENTRY, AliasedArgumentsEntry, aliased_arguments_entry) \
+  V(ALLOCATION_MEMENTO, AllocationMemento, allocation_memento)               \
+  V(ASYNC_GENERATOR_REQUEST, AsyncGeneratorRequest, async_generator_request) \
+  V(DEBUG_INFO, DebugInfo, debug_info)                                       \
+  V(FUNCTION_TEMPLATE_INFO, FunctionTemplateInfo, function_template_info)    \
+  V(INTERCEPTOR_INFO, InterceptorInfo, interceptor_info)                     \
+  V(INTERPRETER_DATA, InterpreterData, interpreter_data)                     \
+  V(MODULE_INFO_ENTRY, ModuleInfoEntry, module_info_entry)                   \
+  V(MODULE, Module, module)                                                  \
+  V(OBJECT_TEMPLATE_INFO, ObjectTemplateInfo, object_template_info)          \
+  V(PROMISE_CAPABILITY, PromiseCapability, promise_capability)               \
+  V(PROMISE_REACTION, PromiseReaction, promise_reaction)                     \
+  V(PROTOTYPE_INFO, PrototypeInfo, prototype_info)                           \
+  V(SCRIPT, Script, script)                                                  \
+  V(STACK_FRAME_INFO, StackFrameInfo, stack_frame_info)                      \
+  V(TUPLE2, Tuple2, tuple2)                                                  \
+  V(TUPLE3, Tuple3, tuple3)                                                  \
+  V(ARRAY_BOILERPLATE_DESCRIPTION, ArrayBoilerplateDescription,              \
+    array_boilerplate_description)                                           \
+  V(WASM_DEBUG_INFO, WasmDebugInfo, wasm_debug_info)                         \
+  V(WASM_EXPORTED_FUNCTION_DATA, WasmExportedFunctionData,                   \
+    wasm_exported_function_data)                                             \
+  V(CALLABLE_TASK, CallableTask, callable_task)                              \
+  V(CALLBACK_TASK, CallbackTask, callback_task)                              \
+  V(PROMISE_FULFILL_REACTION_JOB_TASK, PromiseFulfillReactionJobTask,        \
+    promise_fulfill_reaction_job_task)                                       \
+  V(PROMISE_REJECT_REACTION_JOB_TASK, PromiseRejectReactionJobTask,          \
+    promise_reject_reaction_job_task)                                        \
+  V(PROMISE_RESOLVE_THENABLE_JOB_TASK, PromiseResolveThenableJobTask,        \
+    promise_resolve_thenable_job_task)
+
+#define ALLOCATION_SITE_LIST(V)                                     \
+  V(ALLOCATION_SITE, AllocationSite, WithWeakNext, allocation_site) \
+  V(ALLOCATION_SITE, AllocationSite, WithoutWeakNext,               \
+    allocation_site_without_weaknext)
+
+#define DATA_HANDLER_LIST(V)                        \
+  V(LOAD_HANDLER, LoadHandler, 1, load_handler1)    \
+  V(LOAD_HANDLER, LoadHandler, 2, load_handler2)    \
+  V(LOAD_HANDLER, LoadHandler, 3, load_handler3)    \
+  V(STORE_HANDLER, StoreHandler, 0, store_handler0) \
+  V(STORE_HANDLER, StoreHandler, 1, store_handler1) \
+  V(STORE_HANDLER, StoreHandler, 2, store_handler2) \
+  V(STORE_HANDLER, StoreHandler, 3, store_handler3)
+
+}  // namespace internal
+}  // namespace v8
+
+#endif  // V8_OBJECTS_DEFINITIONS_H_
diff --git a/deps/v8/src/objects-inl.h b/deps/v8/src/objects-inl.h
index 297e9fc836d490..7013ec9dc42977 100644
--- a/deps/v8/src/objects-inl.h
+++ b/deps/v8/src/objects-inl.h
@@ -12,6 +12,8 @@
 #ifndef V8_OBJECTS_INL_H_
 #define V8_OBJECTS_INL_H_
 
+#include "src/objects.h"
+
 #include "src/base/atomicops.h"
 #include "src/base/bits.h"
 #include "src/base/tsan.h"
@@ -20,7 +22,6 @@
 #include "src/conversions-inl.h"
 #include "src/feedback-vector-inl.h"
 #include "src/field-index-inl.h"
-#include "src/field-type.h"
 #include "src/handles-inl.h"
 #include "src/heap/factory.h"
 #include "src/heap/heap-inl.h"
@@ -29,24 +30,18 @@
 #include "src/layout-descriptor-inl.h"
 #include "src/lookup-cache-inl.h"
 #include "src/lookup.h"
-#include "src/objects.h"
-#include "src/objects/arguments-inl.h"
 #include "src/objects/bigint.h"
-#include "src/objects/data-handler-inl.h"
-#include "src/objects/fixed-array-inl.h"
-#include "src/objects/hash-table-inl.h"
-#include "src/objects/js-array-inl.h"
-#include "src/objects/js-collection-inl.h"
-#include "src/objects/js-promise-inl.h"
-#include "src/objects/js-regexp-inl.h"
-#include "src/objects/js-regexp-string-iterator-inl.h"
+#include "src/objects/descriptor-array.h"
 #include "src/objects/literal-objects.h"
-#include "src/objects/module-inl.h"
+#include "src/objects/maybe-object-inl.h"
 #include "src/objects/regexp-match-info.h"
 #include "src/objects/scope-info.h"
 #include "src/objects/template-objects.h"
+#include "src/objects/templates.h"
+#include "src/property-details.h"
 #include "src/property.h"
 #include "src/prototype.h"
+#include "src/roots-inl.h"
 #include "src/transitions-inl.h"
 #include "src/v8memory.h"
 
@@ -76,22 +71,36 @@ int PropertyDetails::field_width_in_words() const {
   return representation().IsDouble() ? kDoubleSize / kPointerSize : 1;
 }
 
+// TODO(v8:7786): For instance types that have a single map instance on the
+// roots, and when that map is a embedded in the binary, compare against the map
+// pointer rather than looking up the instance type.
+TYPE_CHECKER(AllocationSite, ALLOCATION_SITE_TYPE)
 TYPE_CHECKER(BigInt, BIGINT_TYPE)
-TYPE_CHECKER(BoilerplateDescription, BOILERPLATE_DESCRIPTION_TYPE)
+TYPE_CHECKER(ObjectBoilerplateDescription, OBJECT_BOILERPLATE_DESCRIPTION_TYPE)
 TYPE_CHECKER(BreakPoint, TUPLE2_TYPE)
 TYPE_CHECKER(BreakPointInfo, TUPLE2_TYPE)
+TYPE_CHECKER(ByteArray, BYTE_ARRAY_TYPE)
+TYPE_CHECKER(BytecodeArray, BYTECODE_ARRAY_TYPE)
 TYPE_CHECKER(CallHandlerInfo, CALL_HANDLER_INFO_TYPE)
 TYPE_CHECKER(Cell, CELL_TYPE)
-TYPE_CHECKER(ConstantElementsPair, TUPLE2_TYPE)
+TYPE_CHECKER(Code, CODE_TYPE)
+TYPE_CHECKER(CodeDataContainer, CODE_DATA_CONTAINER_TYPE)
 TYPE_CHECKER(CoverageInfo, FIXED_ARRAY_TYPE)
 TYPE_CHECKER(DescriptorArray, DESCRIPTOR_ARRAY_TYPE)
+TYPE_CHECKER(EphemeronHashTable, EPHEMERON_HASH_TABLE_TYPE)
 TYPE_CHECKER(FeedbackCell, FEEDBACK_CELL_TYPE)
 TYPE_CHECKER(FeedbackMetadata, FEEDBACK_METADATA_TYPE)
 TYPE_CHECKER(FeedbackVector, FEEDBACK_VECTOR_TYPE)
+TYPE_CHECKER(FixedArrayExact, FIXED_ARRAY_TYPE)
+TYPE_CHECKER(FixedArrayOfWeakCells, FIXED_ARRAY_TYPE)
+TYPE_CHECKER(FixedDoubleArray, FIXED_DOUBLE_ARRAY_TYPE)
 TYPE_CHECKER(Foreign, FOREIGN_TYPE)
 TYPE_CHECKER(FreeSpace, FREE_SPACE_TYPE)
-TYPE_CHECKER(HashTable, HASH_TABLE_TYPE)
+TYPE_CHECKER(GlobalDictionary, GLOBAL_DICTIONARY_TYPE)
 TYPE_CHECKER(HeapNumber, HEAP_NUMBER_TYPE)
+TYPE_CHECKER(JSArgumentsObject, JS_ARGUMENTS_TYPE)
+TYPE_CHECKER(JSArray, JS_ARRAY_TYPE)
+TYPE_CHECKER(JSArrayBuffer, JS_ARRAY_BUFFER_TYPE)
 TYPE_CHECKER(JSArrayIterator, JS_ARRAY_ITERATOR_TYPE)
 TYPE_CHECKER(JSAsyncFromSyncIterator, JS_ASYNC_FROM_SYNC_ITERATOR_TYPE)
 TYPE_CHECKER(JSAsyncGeneratorObject, JS_ASYNC_GENERATOR_OBJECT_TYPE)
@@ -102,33 +111,67 @@ TYPE_CHECKER(JSDate, JS_DATE_TYPE)
 TYPE_CHECKER(JSError, JS_ERROR_TYPE)
 TYPE_CHECKER(JSFunction, JS_FUNCTION_TYPE)
 TYPE_CHECKER(JSGlobalObject, JS_GLOBAL_OBJECT_TYPE)
+TYPE_CHECKER(JSMap, JS_MAP_TYPE)
 TYPE_CHECKER(JSMessageObject, JS_MESSAGE_OBJECT_TYPE)
+TYPE_CHECKER(JSModuleNamespace, JS_MODULE_NAMESPACE_TYPE)
+TYPE_CHECKER(JSPromise, JS_PROMISE_TYPE)
+TYPE_CHECKER(JSRegExp, JS_REGEXP_TYPE)
+TYPE_CHECKER(JSRegExpStringIterator, JS_REGEXP_STRING_ITERATOR_TYPE)
+TYPE_CHECKER(JSSet, JS_SET_TYPE)
 TYPE_CHECKER(JSStringIterator, JS_STRING_ITERATOR_TYPE)
+TYPE_CHECKER(JSTypedArray, JS_TYPED_ARRAY_TYPE)
 TYPE_CHECKER(JSValue, JS_VALUE_TYPE)
+TYPE_CHECKER(JSWeakMap, JS_WEAK_MAP_TYPE)
+TYPE_CHECKER(JSWeakSet, JS_WEAK_SET_TYPE)
+TYPE_CHECKER(Map, MAP_TYPE)
 TYPE_CHECKER(MutableHeapNumber, MUTABLE_HEAP_NUMBER_TYPE)
+TYPE_CHECKER(NameDictionary, NAME_DICTIONARY_TYPE)
+TYPE_CHECKER(NativeContext, NATIVE_CONTEXT_TYPE)
+TYPE_CHECKER(NumberDictionary, NUMBER_DICTIONARY_TYPE)
 TYPE_CHECKER(Oddball, ODDBALL_TYPE)
+TYPE_CHECKER(OrderedHashMap, ORDERED_HASH_MAP_TYPE)
+TYPE_CHECKER(OrderedHashSet, ORDERED_HASH_SET_TYPE)
 TYPE_CHECKER(PreParsedScopeData, TUPLE2_TYPE)
 TYPE_CHECKER(PropertyArray, PROPERTY_ARRAY_TYPE)
 TYPE_CHECKER(PropertyCell, PROPERTY_CELL_TYPE)
 TYPE_CHECKER(PropertyDescriptorObject, FIXED_ARRAY_TYPE)
 TYPE_CHECKER(ScopeInfo, SCOPE_INFO_TYPE)
+TYPE_CHECKER(ScriptContextTable, SCRIPT_CONTEXT_TABLE_TYPE)
+TYPE_CHECKER(SharedFunctionInfo, SHARED_FUNCTION_INFO_TYPE)
+TYPE_CHECKER(SimpleNumberDictionary, SIMPLE_NUMBER_DICTIONARY_TYPE)
 TYPE_CHECKER(SmallOrderedHashMap, SMALL_ORDERED_HASH_MAP_TYPE)
 TYPE_CHECKER(SmallOrderedHashSet, SMALL_ORDERED_HASH_SET_TYPE)
 TYPE_CHECKER(SourcePositionTableWithFrameCache, TUPLE2_TYPE)
+TYPE_CHECKER(StringTable, STRING_TABLE_TYPE)
+TYPE_CHECKER(Symbol, SYMBOL_TYPE)
 TYPE_CHECKER(TemplateObjectDescription, TUPLE2_TYPE)
 TYPE_CHECKER(TransitionArray, TRANSITION_ARRAY_TYPE)
+TYPE_CHECKER(UncompiledDataWithoutPreParsedScope,
+             UNCOMPILED_DATA_WITHOUT_PRE_PARSED_SCOPE_TYPE)
+TYPE_CHECKER(UncompiledDataWithPreParsedScope,
+             UNCOMPILED_DATA_WITH_PRE_PARSED_SCOPE_TYPE)
 TYPE_CHECKER(WasmGlobalObject, WASM_GLOBAL_TYPE)
 TYPE_CHECKER(WasmInstanceObject, WASM_INSTANCE_TYPE)
 TYPE_CHECKER(WasmMemoryObject, WASM_MEMORY_TYPE)
 TYPE_CHECKER(WasmModuleObject, WASM_MODULE_TYPE)
 TYPE_CHECKER(WasmTableObject, WASM_TABLE_TYPE)
+TYPE_CHECKER(WeakArrayList, WEAK_ARRAY_LIST_TYPE)
 TYPE_CHECKER(WeakCell, WEAK_CELL_TYPE)
 
+#ifdef V8_INTL_SUPPORT
+TYPE_CHECKER(JSLocale, JS_INTL_LOCALE_TYPE)
+TYPE_CHECKER(JSRelativeTimeFormat, JS_INTL_RELATIVE_TIME_FORMAT_TYPE)
+#endif  // V8_INTL_SUPPORT
+
 #define TYPED_ARRAY_TYPE_CHECKER(Type, type, TYPE, ctype, size) \
   TYPE_CHECKER(Fixed##Type##Array, FIXED_##TYPE##_ARRAY_TYPE)
 TYPED_ARRAYS(TYPED_ARRAY_TYPE_CHECKER)
 #undef TYPED_ARRAY_TYPE_CHECKER
 
+bool HeapObject::IsUncompiledData() const {
+  return IsUncompiledDataWithoutPreParsedScope() ||
+         IsUncompiledDataWithPreParsedScope();
+}
 
 bool HeapObject::IsFixedArrayBase() const {
   return IsFixedArray() || IsFixedDoubleArray() || IsFixedTypedArrayBase();
@@ -140,6 +183,12 @@ bool HeapObject::IsFixedArray() const {
          instance_type <= LAST_FIXED_ARRAY_TYPE;
 }
 
+bool HeapObject::IsWeakFixedArray() const {
+  InstanceType instance_type = map()->instance_type();
+  return instance_type >= FIRST_WEAK_FIXED_ARRAY_TYPE &&
+         instance_type <= LAST_WEAK_FIXED_ARRAY_TYPE;
+}
+
 bool HeapObject::IsSloppyArgumentsElements() const {
   return IsFixedArrayExact();
 }
@@ -155,8 +204,8 @@ bool HeapObject::IsJSGeneratorObject() const {
 
 bool HeapObject::IsClassBoilerplate() const { return IsFixedArrayExact(); }
 
-bool HeapObject::IsExternal() const {
-  return map()->FindRootMap() == GetHeap()->external_map();
+bool HeapObject::IsExternal(Isolate* isolate) const {
+  return map()->FindRootMap(isolate) == isolate->heap()->external_map();
 }
 
 #define IS_TYPE_FUNCTION_DEF(type_)                               \
@@ -166,24 +215,48 @@ bool HeapObject::IsExternal() const {
 HEAP_OBJECT_TYPE_LIST(IS_TYPE_FUNCTION_DEF)
 #undef IS_TYPE_FUNCTION_DEF
 
-#define IS_TYPE_FUNCTION_DEF(Type, Value)             \
-  bool Object::Is##Type(Isolate* isolate) const {     \
-    return this == isolate->heap()->Value();          \
-  }                                                   \
-  bool HeapObject::Is##Type(Isolate* isolate) const { \
-    return this == isolate->heap()->Value();          \
-  }
+#define IS_TYPE_FUNCTION_DEF(Type, Value)                        \
+  bool Object::Is##Type(Isolate* isolate) const {                \
+    return Is##Type(ReadOnlyRoots(isolate->heap()));             \
+  }                                                              \
+  bool Object::Is##Type(ReadOnlyRoots roots) const {             \
+    return this == roots.Value();                                \
+  }                                                              \
+  bool Object::Is##Type() const {                                \
+    return IsHeapObject() && HeapObject::cast(this)->Is##Type(); \
+  }                                                              \
+  bool HeapObject::Is##Type(Isolate* isolate) const {            \
+    return Object::Is##Type(isolate);                            \
+  }                                                              \
+  bool HeapObject::Is##Type(ReadOnlyRoots roots) const {         \
+    return Object::Is##Type(roots);                              \
+  }                                                              \
+  bool HeapObject::Is##Type() const { return Is##Type(GetReadOnlyRoots()); }
 ODDBALL_LIST(IS_TYPE_FUNCTION_DEF)
 #undef IS_TYPE_FUNCTION_DEF
 
 bool Object::IsNullOrUndefined(Isolate* isolate) const {
-  Heap* heap = isolate->heap();
-  return this == heap->null_value() || this == heap->undefined_value();
+  return IsNullOrUndefined(ReadOnlyRoots(isolate));
+}
+
+bool Object::IsNullOrUndefined(ReadOnlyRoots roots) const {
+  return IsNull(roots) || IsUndefined(roots);
+}
+
+bool Object::IsNullOrUndefined() const {
+  return IsHeapObject() && HeapObject::cast(this)->IsNullOrUndefined();
 }
 
 bool HeapObject::IsNullOrUndefined(Isolate* isolate) const {
-  Heap* heap = isolate->heap();
-  return this == heap->null_value() || this == heap->undefined_value();
+  return Object::IsNullOrUndefined(isolate);
+}
+
+bool HeapObject::IsNullOrUndefined(ReadOnlyRoots roots) const {
+  return Object::IsNullOrUndefined(roots);
+}
+
+bool HeapObject::IsNullOrUndefined() const {
+  return IsNullOrUndefined(GetReadOnlyRoots());
 }
 
 bool HeapObject::IsString() const {
@@ -207,6 +280,10 @@ bool HeapObject::IsCallable() const { return map()->is_callable(); }
 
 bool HeapObject::IsConstructor() const { return map()->is_constructor(); }
 
+bool HeapObject::IsModuleInfo() const {
+  return map() == GetReadOnlyRoots().module_info_map();
+}
+
 bool HeapObject::IsTemplateInfo() const {
   return IsObjectTemplateInfo() || IsFunctionTemplateInfo();
 }
@@ -330,8 +407,8 @@ bool HeapObject::IsEnumCache() const { return IsTuple2(); }
 bool HeapObject::IsFrameArray() const { return IsFixedArrayExact(); }
 
 bool HeapObject::IsArrayList() const {
-  return map() == GetHeap()->array_list_map() ||
-         this == GetHeap()->empty_fixed_array();
+  return map() == GetReadOnlyRoots().array_list_map() ||
+         this == GetReadOnlyRoots().empty_fixed_array();
 }
 
 bool HeapObject::IsRegExpMatchInfo() const { return IsFixedArrayExact(); }
@@ -376,22 +453,9 @@ bool HeapObject::IsDependentCode() const {
 }
 
 bool HeapObject::IsContext() const {
-  Map* map = this->map();
-  Heap* heap = GetHeap();
-  return (
-      map == heap->function_context_map() || map == heap->catch_context_map() ||
-      map == heap->with_context_map() || map == heap->native_context_map() ||
-      map == heap->block_context_map() || map == heap->module_context_map() ||
-      map == heap->eval_context_map() || map == heap->script_context_map() ||
-      map == heap->debug_evaluate_context_map());
-}
-
-bool HeapObject::IsNativeContext() const {
-  return map() == GetHeap()->native_context_map();
-}
-
-bool HeapObject::IsScriptContextTable() const {
-  return map() == GetHeap()->script_context_table_map();
+  int instance_type = map()->instance_type();
+  return instance_type >= FIRST_CONTEXT_TYPE &&
+         instance_type <= LAST_CONTEXT_TYPE;
 }
 
 template <>
@@ -436,28 +500,16 @@ bool HeapObject::IsJSArrayBufferView() const {
   return IsJSDataView() || IsJSTypedArray();
 }
 
-bool HeapObject::IsDictionary() const {
-  return IsHashTable() && this != GetHeap()->string_table();
-}
-
-bool HeapObject::IsGlobalDictionary() const {
-  return map() == GetHeap()->global_dictionary_map();
-}
-
-bool HeapObject::IsNameDictionary() const {
-  return map() == GetHeap()->name_dictionary_map();
-}
-
-bool HeapObject::IsNumberDictionary() const {
-  return map() == GetHeap()->number_dictionary_map();
-}
-
-bool HeapObject::IsSimpleNumberDictionary() const {
-  return map() == GetHeap()->simple_number_dictionary_map();
+bool HeapObject::IsHashTable() const {
+  int instance_type = map()->instance_type();
+  return instance_type >= FIRST_HASH_TABLE_TYPE &&
+         instance_type <= LAST_HASH_TABLE_TYPE;
 }
 
-bool HeapObject::IsStringTable() const {
-  return map() == GetHeap()->string_table_map();
+bool HeapObject::IsDictionary() const {
+  int instance_type = map()->instance_type();
+  return instance_type >= FIRST_DICTIONARY_TYPE &&
+         instance_type <= LAST_DICTIONARY_TYPE;
 }
 
 bool HeapObject::IsStringSet() const { return IsHashTable(); }
@@ -465,7 +517,7 @@ bool HeapObject::IsStringSet() const { return IsHashTable(); }
 bool HeapObject::IsObjectHashSet() const { return IsHashTable(); }
 
 bool HeapObject::IsNormalizedMapCache() const {
-  return NormalizedMapCache::IsNormalizedMapCache(this);
+  return NormalizedMapCache::IsNormalizedMapCache(GetIsolate(), this);
 }
 
 bool HeapObject::IsCompilationCacheTable() const { return IsHashTable(); }
@@ -474,14 +526,6 @@ bool HeapObject::IsMapCache() const { return IsHashTable(); }
 
 bool HeapObject::IsObjectHashTable() const { return IsHashTable(); }
 
-bool HeapObject::IsOrderedHashSet() const {
-  return map() == GetHeap()->ordered_hash_set_map();
-}
-
-bool HeapObject::IsOrderedHashMap() const {
-  return map() == GetHeap()->ordered_hash_map_map();
-}
-
 bool Object::IsSmallOrderedHashTable() const {
   return IsSmallOrderedHashSet() || IsSmallOrderedHashMap();
 }
@@ -557,26 +601,21 @@ bool Object::IsMinusZero() const {
 // ------------------------------------
 // Cast operations
 
-CAST_ACCESSOR(AccessCheckInfo)
-CAST_ACCESSOR(AccessorInfo)
 CAST_ACCESSOR(AccessorPair)
 CAST_ACCESSOR(AllocationMemento)
 CAST_ACCESSOR(AllocationSite)
 CAST_ACCESSOR(AsyncGeneratorRequest)
 CAST_ACCESSOR(BigInt)
-CAST_ACCESSOR(BoilerplateDescription)
-CAST_ACCESSOR(CallHandlerInfo)
+CAST_ACCESSOR(ObjectBoilerplateDescription)
 CAST_ACCESSOR(Cell)
-CAST_ACCESSOR(ConstantElementsPair)
-CAST_ACCESSOR(ContextExtension)
+CAST_ACCESSOR(ArrayBoilerplateDescription)
 CAST_ACCESSOR(DescriptorArray)
+CAST_ACCESSOR(EphemeronHashTable)
 CAST_ACCESSOR(EnumCache)
 CAST_ACCESSOR(FeedbackCell)
 CAST_ACCESSOR(Foreign)
-CAST_ACCESSOR(FunctionTemplateInfo)
 CAST_ACCESSOR(GlobalDictionary)
 CAST_ACCESSOR(HeapObject)
-CAST_ACCESSOR(InterceptorInfo)
 CAST_ACCESSOR(JSAsyncFromSyncIterator)
 CAST_ACCESSOR(JSAsyncGeneratorObject)
 CAST_ACCESSOR(JSBoundFunction)
@@ -592,14 +631,15 @@ CAST_ACCESSOR(JSProxy)
 CAST_ACCESSOR(JSReceiver)
 CAST_ACCESSOR(JSStringIterator)
 CAST_ACCESSOR(JSValue)
+CAST_ACCESSOR(HeapNumber)
 CAST_ACCESSOR(LayoutDescriptor)
+CAST_ACCESSOR(MutableHeapNumber)
 CAST_ACCESSOR(NameDictionary)
 CAST_ACCESSOR(NormalizedMapCache)
 CAST_ACCESSOR(NumberDictionary)
 CAST_ACCESSOR(Object)
 CAST_ACCESSOR(ObjectHashSet)
 CAST_ACCESSOR(ObjectHashTable)
-CAST_ACCESSOR(ObjectTemplateInfo)
 CAST_ACCESSOR(Oddball)
 CAST_ACCESSOR(OrderedHashMap)
 CAST_ACCESSOR(OrderedHashSet)
@@ -617,7 +657,6 @@ CAST_ACCESSOR(StackFrameInfo)
 CAST_ACCESSOR(StringSet)
 CAST_ACCESSOR(StringTable)
 CAST_ACCESSOR(Struct)
-CAST_ACCESSOR(TemplateInfo)
 CAST_ACCESSOR(TemplateObjectDescription)
 CAST_ACCESSOR(Tuple2)
 CAST_ACCESSOR(Tuple3)
@@ -659,12 +698,13 @@ bool Object::FilterKey(PropertyFilter filter) {
 Handle<Object> Object::NewStorageFor(Isolate* isolate, Handle<Object> object,
                                      Representation representation) {
   if (!representation.IsDouble()) return object;
-  Handle<HeapNumber> result = isolate->factory()->NewHeapNumber(MUTABLE);
+  auto result = isolate->factory()->NewMutableHeapNumberWithHoleNaN();
   if (object->IsUninitialized(isolate)) {
     result->set_value_as_bits(kHoleNanInt64);
   } else if (object->IsMutableHeapNumber()) {
     // Ensure that all bits of the double value are preserved.
-    result->set_value_as_bits(HeapNumber::cast(*object)->value_as_bits());
+    result->set_value_as_bits(
+        MutableHeapNumber::cast(*object)->value_as_bits());
   } else {
     result->set_value(object->Number());
   }
@@ -678,7 +718,8 @@ Handle<Object> Object::WrapForRead(Isolate* isolate, Handle<Object> object,
     DCHECK(object->FitsRepresentation(representation));
     return object;
   }
-  return isolate->factory()->NewHeapNumber(HeapNumber::cast(*object)->value());
+  return isolate->factory()->NewHeapNumber(
+      MutableHeapNumber::cast(*object)->value());
 }
 
 Representation Object::OptimalRepresentation() {
@@ -687,8 +728,7 @@ Representation Object::OptimalRepresentation() {
     return Representation::Smi();
   } else if (FLAG_track_double_fields && IsHeapNumber()) {
     return Representation::Double();
-  } else if (FLAG_track_computed_fields &&
-             IsUninitialized(HeapObject::cast(this)->GetIsolate())) {
+  } else if (FLAG_track_computed_fields && IsUninitialized()) {
     return Representation::None();
   } else if (FLAG_track_heap_object_fields) {
     DCHECK(IsHeapObject());
@@ -823,9 +863,10 @@ MaybeHandle<Object> Object::GetProperty(Handle<Object> object,
   return GetProperty(&it);
 }
 
-MaybeHandle<Object> JSReceiver::GetProperty(Handle<JSReceiver> receiver,
+MaybeHandle<Object> JSReceiver::GetProperty(Isolate* isolate,
+                                            Handle<JSReceiver> receiver,
                                             Handle<Name> name) {
-  LookupIterator it(receiver, name, receiver);
+  LookupIterator it(isolate, receiver, name, receiver);
   if (!it.IsFound()) return it.factory()->undefined_value();
   return Object::GetProperty(&it);
 }
@@ -878,7 +919,7 @@ MaybeHandle<Object> JSReceiver::GetProperty(Isolate* isolate,
                                             Handle<JSReceiver> receiver,
                                             const char* name) {
   Handle<String> str = isolate->factory()->InternalizeUtf8String(name);
-  return GetProperty(receiver, str);
+  return GetProperty(isolate, receiver, str);
 }
 
 // static
@@ -892,13 +933,14 @@ V8_WARN_UNUSED_RESULT MaybeHandle<FixedArray> JSReceiver::OwnPropertyKeys(
 bool JSObject::PrototypeHasNoElements(Isolate* isolate, JSObject* object) {
   DisallowHeapAllocation no_gc;
   HeapObject* prototype = HeapObject::cast(object->map()->prototype());
-  HeapObject* null = isolate->heap()->null_value();
-  HeapObject* empty_fixed_array = isolate->heap()->empty_fixed_array();
+  ReadOnlyRoots roots(isolate);
+  HeapObject* null = roots.null_value();
+  HeapObject* empty_fixed_array = roots.empty_fixed_array();
   HeapObject* empty_slow_element_dictionary =
-      isolate->heap()->empty_slow_element_dictionary();
+      roots.empty_slow_element_dictionary();
   while (prototype != null) {
     Map* map = prototype->map();
-    if (map->instance_type() <= LAST_CUSTOM_ELEMENTS_RECEIVER) return false;
+    if (map->IsCustomElementsReceiverMap()) return false;
     HeapObject* elements = JSObject::cast(prototype)->elements();
     if (elements != empty_fixed_array &&
         elements != empty_slow_element_dictionary) {
@@ -909,7 +951,7 @@ bool JSObject::PrototypeHasNoElements(Isolate* isolate, JSObject* object) {
   return true;
 }
 
-Object** HeapObject::RawField(HeapObject* obj, int byte_offset) {
+Object** HeapObject::RawField(const HeapObject* obj, int byte_offset) {
   return reinterpret_cast<Object**>(FIELD_ADDR(obj, byte_offset));
 }
 
@@ -932,13 +974,13 @@ bool MapWord::IsForwardingAddress() const {
 
 MapWord MapWord::FromForwardingAddress(HeapObject* object) {
   Address raw = reinterpret_cast<Address>(object) - kHeapObjectTag;
-  return MapWord(reinterpret_cast<uintptr_t>(raw));
+  return MapWord(static_cast<uintptr_t>(raw));
 }
 
 
 HeapObject* MapWord::ToForwardingAddress() {
   DCHECK(IsForwardingAddress());
-  return HeapObject::FromAddress(reinterpret_cast<Address>(value_));
+  return HeapObject::FromAddress(static_cast<Address>(value_));
 }
 
 
@@ -947,11 +989,20 @@ void HeapObject::VerifyObjectField(int offset) {
   VerifyPointer(READ_FIELD(this, offset));
 }
 
+void HeapObject::VerifyMaybeObjectField(int offset) {
+  MaybeObject::VerifyMaybeObjectPointer(READ_WEAK_FIELD(this, offset));
+}
+
 void HeapObject::VerifySmiField(int offset) {
   CHECK(READ_FIELD(this, offset)->IsSmi());
 }
 #endif
 
+ReadOnlyRoots HeapObject::GetReadOnlyRoots() const {
+  // TODO(v8:7464): When RO_SPACE is embedded, this will access a global
+  // variable instead.
+  return ReadOnlyRoots(MemoryChunk::FromHeapObject(this)->heap());
+}
 
 Heap* HeapObject::GetHeap() const {
   Heap* heap = MemoryChunk::FromAddress(
@@ -966,6 +1017,20 @@ Isolate* HeapObject::GetIsolate() const {
   return GetHeap()->isolate();
 }
 
+Heap* NeverReadOnlySpaceObject::GetHeap() const {
+  MemoryChunk* chunk =
+      MemoryChunk::FromAddress(reinterpret_cast<Address>(this));
+  // Make sure we are not accessing an object in RO space.
+  SLOW_DCHECK(chunk->owner()->identity() != RO_SPACE);
+  Heap* heap = chunk->heap();
+  SLOW_DCHECK(heap != nullptr);
+  return heap;
+}
+
+Isolate* NeverReadOnlySpaceObject::GetIsolate() const {
+  return GetHeap()->isolate();
+}
+
 Map* HeapObject::map() const {
   return map_word().ToMap();
 }
@@ -974,14 +1039,15 @@ Map* HeapObject::map() const {
 void HeapObject::set_map(Map* value) {
   if (value != nullptr) {
 #ifdef VERIFY_HEAP
-    value->GetHeap()->VerifyObjectLayoutChange(this, value);
+    Heap::FromWritableHeapObject(this)->VerifyObjectLayoutChange(this, value);
 #endif
   }
   set_map_word(MapWord::FromMap(value));
   if (value != nullptr) {
     // TODO(1600) We are passing nullptr as a slot because maps can never be on
     // evacuation candidate.
-    value->GetHeap()->incremental_marking()->RecordWrite(this, nullptr, value);
+    Heap::FromWritableHeapObject(this)->incremental_marking()->RecordWrite(
+        this, nullptr, value);
   }
 }
 
@@ -993,14 +1059,15 @@ Map* HeapObject::synchronized_map() const {
 void HeapObject::synchronized_set_map(Map* value) {
   if (value != nullptr) {
 #ifdef VERIFY_HEAP
-    value->GetHeap()->VerifyObjectLayoutChange(this, value);
+    Heap::FromWritableHeapObject(this)->VerifyObjectLayoutChange(this, value);
 #endif
   }
   synchronized_set_map_word(MapWord::FromMap(value));
   if (value != nullptr) {
     // TODO(1600) We are passing nullptr as a slot because maps can never be on
     // evacuation candidate.
-    value->GetHeap()->incremental_marking()->RecordWrite(this, nullptr, value);
+    Heap::FromWritableHeapObject(this)->incremental_marking()->RecordWrite(
+        this, nullptr, value);
   }
 }
 
@@ -1009,7 +1076,7 @@ void HeapObject::synchronized_set_map(Map* value) {
 void HeapObject::set_map_no_write_barrier(Map* value) {
   if (value != nullptr) {
 #ifdef VERIFY_HEAP
-    value->GetHeap()->VerifyObjectLayoutChange(this, value);
+    Heap::FromWritableHeapObject(this)->VerifyObjectLayoutChange(this, value);
 #endif
   }
   set_map_word(MapWord::FromMap(value));
@@ -1021,7 +1088,8 @@ void HeapObject::set_map_after_allocation(Map* value, WriteBarrierMode mode) {
     DCHECK_NOT_NULL(value);
     // TODO(1600) We are passing nullptr as a slot because maps can never be on
     // evacuation candidate.
-    value->GetHeap()->incremental_marking()->RecordWrite(this, nullptr, value);
+    Heap::FromWritableHeapObject(this)->incremental_marking()->RecordWrite(
+        this, nullptr, value);
   }
 }
 
@@ -1054,30 +1122,28 @@ void HeapObject::synchronized_set_map_word(MapWord map_word) {
 
 int HeapObject::Size() const { return SizeFromMap(map()); }
 
-double HeapNumber::value() const {
+double HeapNumberBase::value() const {
   return READ_DOUBLE_FIELD(this, kValueOffset);
 }
 
-
-void HeapNumber::set_value(double value) {
+void HeapNumberBase::set_value(double value) {
   WRITE_DOUBLE_FIELD(this, kValueOffset, value);
 }
 
-uint64_t HeapNumber::value_as_bits() const {
+uint64_t HeapNumberBase::value_as_bits() const {
   return READ_UINT64_FIELD(this, kValueOffset);
 }
 
-void HeapNumber::set_value_as_bits(uint64_t bits) {
+void HeapNumberBase::set_value_as_bits(uint64_t bits) {
   WRITE_UINT64_FIELD(this, kValueOffset, bits);
 }
 
-int HeapNumber::get_exponent() {
+int HeapNumberBase::get_exponent() {
   return ((READ_INT_FIELD(this, kExponentOffset) & kExponentMask) >>
           kExponentShift) - kExponentBias;
 }
 
-
-int HeapNumber::get_sign() {
+int HeapNumberBase::get_sign() {
   return READ_INT_FIELD(this, kExponentOffset) & kSignMask;
 }
 
@@ -1088,14 +1154,19 @@ FixedArrayBase* JSObject::elements() const {
   return static_cast<FixedArrayBase*>(array);
 }
 
+bool AllocationSite::HasWeakNext() const {
+  return map() == GetReadOnlyRoots().allocation_site_map();
+}
+
 void AllocationSite::Initialize() {
   set_transition_info_or_boilerplate(Smi::kZero);
   SetElementsKind(GetInitialFastElementsKind());
   set_nested_site(Smi::kZero);
   set_pretenure_data(0);
   set_pretenure_create_count(0);
-  set_dependent_code(DependentCode::cast(GetHeap()->empty_fixed_array()),
-                     SKIP_WRITE_BARRIER);
+  set_dependent_code(
+      DependentCode::cast(GetReadOnlyRoots().empty_fixed_array()),
+      SKIP_WRITE_BARRIER);
 }
 
 bool AllocationSite::IsZombie() const {
@@ -1163,7 +1234,7 @@ AllocationSite::PretenureDecision AllocationSite::pretenure_decision() const {
 }
 
 void AllocationSite::set_pretenure_decision(PretenureDecision decision) {
-  int value = pretenure_data();
+  int32_t value = pretenure_data();
   set_pretenure_data(PretenureDecisionBits::update(value, decision));
 }
 
@@ -1172,7 +1243,7 @@ bool AllocationSite::deopt_dependent_code() const {
 }
 
 void AllocationSite::set_deopt_dependent_code(bool deopt) {
-  int value = pretenure_data();
+  int32_t value = pretenure_data();
   set_pretenure_data(DeoptDependentCodeBit::update(value, deopt));
 }
 
@@ -1181,7 +1252,7 @@ int AllocationSite::memento_found_count() const {
 }
 
 inline void AllocationSite::set_memento_found_count(int count) {
-  int value = pretenure_data();
+  int32_t value = pretenure_data();
   // Verify that we can count more mementos than we can possibly find in one
   // new space collection.
   DCHECK((GetHeap()->MaxSemiSpaceSize() /
@@ -1252,7 +1323,7 @@ void JSObject::EnsureCanContainElements(Handle<JSObject> object,
     DCHECK(mode != ALLOW_COPIED_DOUBLE_ELEMENTS);
     bool is_holey = IsHoleyElementsKind(current_kind);
     if (current_kind == HOLEY_ELEMENTS) return;
-    Object* the_hole = object->GetHeap()->the_hole_value();
+    Object* the_hole = object->GetReadOnlyRoots().the_hole_value();
     for (uint32_t i = 0; i < count; ++i) {
       Object* current = *objects++;
       if (current == the_hole) {
@@ -1286,10 +1357,10 @@ void JSObject::EnsureCanContainElements(Handle<JSObject> object,
                                         Handle<FixedArrayBase> elements,
                                         uint32_t length,
                                         EnsureElementsMode mode) {
-  Heap* heap = object->GetHeap();
-  if (elements->map() != heap->fixed_double_array_map()) {
-    DCHECK(elements->map() == heap->fixed_array_map() ||
-           elements->map() == heap->fixed_cow_array_map());
+  ReadOnlyRoots roots = object->GetReadOnlyRoots();
+  if (elements->map() != roots.fixed_double_array_map()) {
+    DCHECK(elements->map() == roots.fixed_array_map() ||
+           elements->map() == roots.fixed_cow_array_map());
     if (mode == ALLOW_COPIED_DOUBLE_ELEMENTS) {
       mode = DONT_ALLOW_DOUBLE_ELEMENTS;
     }
@@ -1321,11 +1392,11 @@ void JSObject::SetMapAndElements(Handle<JSObject> object,
                                  Handle<FixedArrayBase> value) {
   JSObject::MigrateToMap(object, new_map);
   DCHECK((object->map()->has_fast_smi_or_object_elements() ||
-          (*value == object->GetHeap()->empty_fixed_array()) ||
+          (*value == object->GetReadOnlyRoots().empty_fixed_array()) ||
           object->map()->has_fast_string_wrapper_elements()) ==
-         (value->map() == object->GetHeap()->fixed_array_map() ||
-          value->map() == object->GetHeap()->fixed_cow_array_map()));
-  DCHECK((*value == object->GetHeap()->empty_fixed_array()) ||
+         (value->map() == object->GetReadOnlyRoots().fixed_array_map() ||
+          value->map() == object->GetReadOnlyRoots().fixed_cow_array_map()));
+  DCHECK((*value == object->GetReadOnlyRoots().empty_fixed_array()) ||
          (object->map()->has_fast_double_elements() ==
           value->IsFixedDoubleArray()));
   object->set_elements(*value);
@@ -1404,8 +1475,8 @@ Object* WeakCell::value() const { return READ_FIELD(this, kValueOffset); }
 void WeakCell::clear() {
   // Either the garbage collector is clearing the cell or we are simply
   // initializing the root empty weak cell.
-  DCHECK(GetHeap()->gc_state() == Heap::MARK_COMPACT ||
-         this == GetHeap()->empty_weak_cell());
+  DCHECK(Heap::FromWritableHeapObject(this)->gc_state() == Heap::MARK_COMPACT ||
+         this == GetReadOnlyRoots().empty_weak_cell());
   WRITE_FIELD(this, kValueOffset, Smi::kZero);
 }
 
@@ -1415,7 +1486,7 @@ void WeakCell::initialize(HeapObject* val) {
   // We just have to execute the generational barrier here because we never
   // mark through a weak cell and collect evacuation candidates when we process
   // all weak cells.
-  Heap* heap = val->GetHeap();
+  Heap* heap = Heap::FromWritableHeapObject(this);
   WriteBarrierMode mode =
       heap->incremental_marking()->marking_state()->IsBlack(this)
           ? UPDATE_WRITE_BARRIER
@@ -1450,6 +1521,16 @@ bool Map::IsSpecialReceiverMap() const {
   return result;
 }
 
+inline bool IsCustomElementsReceiverInstanceType(InstanceType instance_type) {
+  return instance_type <= LAST_CUSTOM_ELEMENTS_RECEIVER;
+}
+
+// This should be in objects/map-inl.h, but can't, because of a cyclic
+// dependency.
+bool Map::IsCustomElementsReceiverMap() const {
+  return IsCustomElementsReceiverInstanceType(instance_type());
+}
+
 // static
 int JSObject::GetEmbedderFieldCount(const Map* map) {
   int instance_size = map->instance_size();
@@ -1546,8 +1627,8 @@ void JSObject::FastPropertyAtPut(FieldIndex index, Object* value) {
   if (IsUnboxedDoubleField(index)) {
     DCHECK(value->IsMutableHeapNumber());
     // Ensure that all bits of the double value are preserved.
-    RawFastDoublePropertyAsBitsAtPut(index,
-                                     HeapNumber::cast(value)->value_as_bits());
+    RawFastDoublePropertyAsBitsAtPut(
+        index, MutableHeapNumber::cast(value)->value_as_bits());
   } else {
     RawFastPropertyAtPut(index, value);
   }
@@ -1561,7 +1642,7 @@ void JSObject::WriteToField(int descriptor, PropertyDetails details,
   FieldIndex index = FieldIndex::ForDescriptor(map(), descriptor);
   if (details.representation().IsDouble()) {
     // Nothing more to be done.
-    if (value->IsUninitialized(this->GetIsolate())) {
+    if (value->IsUninitialized()) {
       return;
     }
     // Manipulating the signaling NaN used for the hole and uninitialized
@@ -1578,8 +1659,7 @@ void JSObject::WriteToField(int descriptor, PropertyDetails details,
     if (IsUnboxedDoubleField(index)) {
       RawFastDoublePropertyAsBitsAtPut(index, bits);
     } else {
-      HeapNumber* box = HeapNumber::cast(RawFastPropertyAt(index));
-      DCHECK(box->IsMutableHeapNumber());
+      auto box = MutableHeapNumber::cast(RawFastPropertyAt(index));
       box->set_value_as_bits(bits);
     }
   } else {
@@ -1612,10 +1692,9 @@ Object* JSObject::InObjectPropertyAtPut(int index,
 void JSObject::InitializeBody(Map* map, int start_offset,
                               Object* pre_allocated_value,
                               Object* filler_value) {
-  DCHECK(!filler_value->IsHeapObject() ||
-         !GetHeap()->InNewSpace(filler_value));
+  DCHECK(!filler_value->IsHeapObject() || !Heap::InNewSpace(filler_value));
   DCHECK(!pre_allocated_value->IsHeapObject() ||
-         !GetHeap()->InNewSpace(pre_allocated_value));
+         !Heap::InNewSpace(pre_allocated_value));
   int size = map->instance_size();
   int offset = start_offset;
   if (filler_value != pre_allocated_value) {
@@ -1634,7 +1713,7 @@ void JSObject::InitializeBody(Map* map, int start_offset,
 }
 
 void Struct::InitializeBody(int object_size) {
-  Object* value = GetHeap()->undefined_value();
+  Object* value = GetReadOnlyRoots().undefined_value();
   for (int offset = kHeaderSize; offset < object_size; offset += kPointerSize) {
     WRITE_FIELD(this, offset, value);
   }
@@ -1653,10 +1732,8 @@ void Object::VerifyApiCallResultType() {
 #if DEBUG
   if (IsSmi()) return;
   DCHECK(IsHeapObject());
-  Isolate* isolate = HeapObject::cast(this)->GetIsolate();
   if (!(IsString() || IsSymbol() || IsJSReceiver() || IsHeapNumber() ||
-        IsBigInt() || IsUndefined(isolate) || IsTrue(isolate) ||
-        IsFalse(isolate) || IsNull(isolate))) {
+        IsBigInt() || IsUndefined() || IsTrue() || IsFalse() || IsNull())) {
     FATAL("API call returned invalid object");
   }
 #endif  // DEBUG
@@ -1674,7 +1751,7 @@ void PropertyArray::set(int index, Object* value) {
   DCHECK_LT(index, this->length());
   int offset = kHeaderSize + index * kPointerSize;
   RELAXED_WRITE_FIELD(this, offset, value);
-  WRITE_BARRIER(GetHeap(), this, offset, value);
+  WRITE_BARRIER(Heap::FromWritableHeapObject(this), this, offset, value);
 }
 
 int RegExpMatchInfo::NumberOfCaptureRegisters() {
@@ -1722,9 +1799,9 @@ void RegExpMatchInfo::SetCapture(int i, int value) {
 
 WriteBarrierMode HeapObject::GetWriteBarrierMode(
     const DisallowHeapAllocation& promise) {
-  Heap* heap = GetHeap();
+  Heap* heap = Heap::FromWritableHeapObject(this);
   if (heap->incremental_marking()->IsMarking()) return UPDATE_WRITE_BARRIER;
-  if (heap->InNewSpace(this)) return SKIP_WRITE_BARRIER;
+  if (Heap::InNewSpace(this)) return SKIP_WRITE_BARRIER;
   return UPDATE_WRITE_BARRIER;
 }
 
@@ -1746,13 +1823,16 @@ bool HeapObject::NeedsRehashing() const {
       return DescriptorArray::cast(this)->number_of_descriptors() > 1;
     case TRANSITION_ARRAY_TYPE:
       return TransitionArray::cast(this)->number_of_entries() > 1;
+    case ORDERED_HASH_MAP_TYPE:
+      return OrderedHashMap::cast(this)->NumberOfElements() > 0;
+    case ORDERED_HASH_SET_TYPE:
+      return OrderedHashSet::cast(this)->NumberOfElements() > 0;
+    case NAME_DICTIONARY_TYPE:
+    case GLOBAL_DICTIONARY_TYPE:
+    case NUMBER_DICTIONARY_TYPE:
+    case SIMPLE_NUMBER_DICTIONARY_TYPE:
+    case STRING_TABLE_TYPE:
     case HASH_TABLE_TYPE:
-      if (IsOrderedHashMap()) {
-        return OrderedHashMap::cast(this)->NumberOfElements() > 0;
-      } else if (IsOrderedHashSet()) {
-        return OrderedHashSet::cast(this)->NumberOfElements() > 0;
-      }
-      return true;
     case SMALL_ORDERED_HASH_MAP_TYPE:
     case SMALL_ORDERED_HASH_SET_TYPE:
       return true;
@@ -1766,7 +1846,8 @@ void PropertyArray::set(int index, Object* value, WriteBarrierMode mode) {
   DCHECK_LT(index, this->length());
   int offset = kHeaderSize + index * kPointerSize;
   RELAXED_WRITE_FIELD(this, offset, value);
-  CONDITIONAL_WRITE_BARRIER(GetHeap(), this, offset, value, mode);
+  CONDITIONAL_WRITE_BARRIER(Heap::FromWritableHeapObject(this), this, offset,
+                            value, mode);
 }
 
 Object** PropertyArray::data_start() {
@@ -1777,7 +1858,7 @@ ACCESSORS(EnumCache, keys, FixedArray, kKeysOffset)
 ACCESSORS(EnumCache, indices, FixedArray, kIndicesOffset)
 
 int DescriptorArray::number_of_descriptors() const {
-  return Smi::ToInt(get(kDescriptorLengthIndex));
+  return Smi::ToInt(get(kDescriptorLengthIndex)->ToSmi());
 }
 
 int DescriptorArray::number_of_descriptors_storage() const {
@@ -1790,7 +1871,8 @@ int DescriptorArray::NumberOfSlackDescriptors() const {
 
 
 void DescriptorArray::SetNumberOfDescriptors(int number_of_descriptors) {
-  set(kDescriptorLengthIndex, Smi::FromInt(number_of_descriptors));
+  set(kDescriptorLengthIndex,
+      MaybeObject::FromObject(Smi::FromInt(number_of_descriptors)));
 }
 
 inline int DescriptorArray::number_of_entries() const {
@@ -1802,7 +1884,7 @@ void DescriptorArray::CopyEnumCacheFrom(DescriptorArray* array) {
 }
 
 EnumCache* DescriptorArray::GetEnumCache() {
-  return EnumCache::cast(get(kEnumCacheIndex));
+  return EnumCache::cast(get(kEnumCacheIndex)->ToStrongHeapObject());
 }
 
 // Perform a binary search in a fixed array.
@@ -1884,10 +1966,10 @@ int LinearSearch(T* array, Name* name, int valid_entries,
   }
 }
 
-
 template <SearchMode search_mode, typename T>
-int Search(T* array, Name* name, int valid_entries, int* out_insertion_index) {
-  SLOW_DCHECK(array->IsSortedNoDuplicates());
+int Search(Isolate* isolate, T* array, Name* name, int valid_entries,
+           int* out_insertion_index) {
+  SLOW_DCHECK(array->IsSortedNoDuplicates(isolate));
 
   if (valid_entries == 0) {
     if (search_mode == ALL_ENTRIES && out_insertion_index != nullptr) {
@@ -1911,8 +1993,15 @@ int Search(T* array, Name* name, int valid_entries, int* out_insertion_index) {
 
 int DescriptorArray::Search(Name* name, int valid_descriptors) {
   DCHECK(name->IsUniqueName());
-  return internal::Search<VALID_ENTRIES>(this, name, valid_descriptors,
-                                         nullptr);
+  return internal::Search<VALID_ENTRIES>(GetIsolate(), this, name,
+                                         valid_descriptors, nullptr);
+}
+
+int DescriptorArray::Search(Name* name, Map* map) {
+  DCHECK(name->IsUniqueName());
+  int number_of_own_descriptors = map->NumberOfOwnDescriptors();
+  if (number_of_own_descriptors == 0) return kNotFound;
+  return Search(name, number_of_own_descriptors);
 }
 
 int DescriptorArray::SearchWithCache(Isolate* isolate, Name* name, Map* map) {
@@ -1934,23 +2023,23 @@ int DescriptorArray::SearchWithCache(Isolate* isolate, Name* name, Map* map) {
 
 Object** DescriptorArray::GetKeySlot(int descriptor_number) {
   DCHECK(descriptor_number < number_of_descriptors());
-  return RawFieldOfElementAt(ToKeyIndex(descriptor_number));
+  DCHECK((*RawFieldOfElementAt(ToKeyIndex(descriptor_number)))->IsObject());
+  return reinterpret_cast<Object**>(
+      RawFieldOfElementAt(ToKeyIndex(descriptor_number)));
 }
 
-
-Object** DescriptorArray::GetDescriptorStartSlot(int descriptor_number) {
-  return GetKeySlot(descriptor_number);
+MaybeObject** DescriptorArray::GetDescriptorStartSlot(int descriptor_number) {
+  return reinterpret_cast<MaybeObject**>(GetKeySlot(descriptor_number));
 }
 
-
-Object** DescriptorArray::GetDescriptorEndSlot(int descriptor_number) {
+MaybeObject** DescriptorArray::GetDescriptorEndSlot(int descriptor_number) {
   return GetValueSlot(descriptor_number - 1) + 1;
 }
 
 
 Name* DescriptorArray::GetKey(int descriptor_number) {
   DCHECK(descriptor_number < number_of_descriptors());
-  return Name::cast(get(ToKeyIndex(descriptor_number)));
+  return Name::cast(get(ToKeyIndex(descriptor_number))->ToStrongHeapObject());
 }
 
 
@@ -1966,11 +2055,11 @@ Name* DescriptorArray::GetSortedKey(int descriptor_number) {
 
 void DescriptorArray::SetSortedKey(int descriptor_index, int pointer) {
   PropertyDetails details = GetDetails(descriptor_index);
-  set(ToDetailsIndex(descriptor_index), details.set_pointer(pointer).AsSmi());
+  set(ToDetailsIndex(descriptor_index),
+      MaybeObject::FromObject(details.set_pointer(pointer).AsSmi()));
 }
 
-
-Object** DescriptorArray::GetValueSlot(int descriptor_number) {
+MaybeObject** DescriptorArray::GetValueSlot(int descriptor_number) {
   DCHECK(descriptor_number < number_of_descriptors());
   return RawFieldOfElementAt(ToValueIndex(descriptor_number));
 }
@@ -1980,22 +2069,25 @@ int DescriptorArray::GetValueOffset(int descriptor_number) {
   return OffsetOfElementAt(ToValueIndex(descriptor_number));
 }
 
-
-Object* DescriptorArray::GetValue(int descriptor_number) {
+Object* DescriptorArray::GetStrongValue(int descriptor_number) {
   DCHECK(descriptor_number < number_of_descriptors());
-  return get(ToValueIndex(descriptor_number));
+  return get(ToValueIndex(descriptor_number))->ToObject();
 }
 
 
 void DescriptorArray::SetValue(int descriptor_index, Object* value) {
-  set(ToValueIndex(descriptor_index), value);
+  set(ToValueIndex(descriptor_index), MaybeObject::FromObject(value));
 }
 
+MaybeObject* DescriptorArray::GetValue(int descriptor_number) {
+  DCHECK_LT(descriptor_number, number_of_descriptors());
+  return get(ToValueIndex(descriptor_number));
+}
 
 PropertyDetails DescriptorArray::GetDetails(int descriptor_number) {
   DCHECK(descriptor_number < number_of_descriptors());
-  Object* details = get(ToDetailsIndex(descriptor_number));
-  return PropertyDetails(Smi::cast(details));
+  MaybeObject* details = get(ToDetailsIndex(descriptor_number));
+  return PropertyDetails(details->ToSmi());
 }
 
 int DescriptorArray::GetFieldIndex(int descriptor_number) {
@@ -2005,28 +2097,29 @@ int DescriptorArray::GetFieldIndex(int descriptor_number) {
 
 FieldType* DescriptorArray::GetFieldType(int descriptor_number) {
   DCHECK_EQ(GetDetails(descriptor_number).location(), kField);
-  Object* wrapped_type = GetValue(descriptor_number);
+  MaybeObject* wrapped_type = GetValue(descriptor_number);
   return Map::UnwrapFieldType(wrapped_type);
 }
 
 void DescriptorArray::Get(int descriptor_number, Descriptor* desc) {
   desc->Init(handle(GetKey(descriptor_number), GetIsolate()),
-             handle(GetValue(descriptor_number), GetIsolate()),
+             MaybeObjectHandle(GetStrongValue(descriptor_number), GetIsolate()),
              GetDetails(descriptor_number));
 }
 
-void DescriptorArray::Set(int descriptor_number, Name* key, Object* value,
+void DescriptorArray::Set(int descriptor_number, Name* key, MaybeObject* value,
                           PropertyDetails details) {
   // Range check.
   DCHECK(descriptor_number < number_of_descriptors());
-  set(ToKeyIndex(descriptor_number), key);
+  set(ToKeyIndex(descriptor_number), MaybeObject::FromObject(key));
   set(ToValueIndex(descriptor_number), value);
-  set(ToDetailsIndex(descriptor_number), details.AsSmi());
+  set(ToDetailsIndex(descriptor_number),
+      MaybeObject::FromObject(details.AsSmi()));
 }
 
 void DescriptorArray::Set(int descriptor_number, Descriptor* desc) {
   Name* key = *desc->GetKey();
-  Object* value = *desc->GetValue();
+  MaybeObject* value = *desc->GetValue();
   Set(descriptor_number, key, value, desc->GetDetails());
 }
 
@@ -2057,6 +2150,14 @@ void DescriptorArray::SwapSortedKeys(int first, int second) {
   SetSortedKey(second, first_key);
 }
 
+MaybeObject* DescriptorArray::get(int index) const {
+  return WeakFixedArray::Get(index);
+}
+
+void DescriptorArray::set(int index, MaybeObject* value) {
+  WeakFixedArray::Set(index, value);
+}
+
 bool StringSetShape::IsMatch(String* key, Object* value) {
   DCHECK(value->IsString());
   return key->Equals(String::cast(value));
@@ -2161,8 +2262,10 @@ int FreeSpace::Size() { return size(); }
 
 
 FreeSpace* FreeSpace::next() {
-  DCHECK(map() == GetHeap()->root(Heap::kFreeSpaceMapRootIndex) ||
-         (!GetHeap()->deserialization_complete() && map() == nullptr));
+  DCHECK(map() == Heap::FromWritableHeapObject(this)->root(
+                      Heap::kFreeSpaceMapRootIndex) ||
+         (!Heap::FromWritableHeapObject(this)->deserialization_complete() &&
+          map() == nullptr));
   DCHECK_LE(kNextOffset + kPointerSize, relaxed_read_size());
   return reinterpret_cast<FreeSpace*>(
       Memory::Address_at(address() + kNextOffset));
@@ -2170,8 +2273,10 @@ FreeSpace* FreeSpace::next() {
 
 
 void FreeSpace::set_next(FreeSpace* next) {
-  DCHECK(map() == GetHeap()->root(Heap::kFreeSpaceMapRootIndex) ||
-         (!GetHeap()->deserialization_complete() && map() == nullptr));
+  DCHECK(map() == Heap::FromWritableHeapObject(this)->root(
+                      Heap::kFreeSpaceMapRootIndex) ||
+         (!Heap::FromWritableHeapObject(this)->deserialization_complete() &&
+          map() == nullptr));
   DCHECK_LE(kNextOffset + kPointerSize, relaxed_read_size());
   base::Relaxed_Store(
       reinterpret_cast<base::AtomicWord*>(address() + kNextOffset),
@@ -2180,7 +2285,8 @@ void FreeSpace::set_next(FreeSpace* next) {
 
 
 FreeSpace* FreeSpace::cast(HeapObject* o) {
-  SLOW_DCHECK(!o->GetHeap()->deserialization_complete() || o->IsFreeSpace());
+  SLOW_DCHECK(!Heap::FromWritableHeapObject(o)->deserialization_complete() ||
+              o->IsFreeSpace());
   return reinterpret_cast<FreeSpace*>(o);
 }
 
@@ -2228,24 +2334,31 @@ int HeapObject::SizeFromMap(Map* map) const {
         reinterpret_cast<const FeedbackMetadata*>(this)
             ->synchronized_slot_count());
   }
-  if (instance_type == WEAK_FIXED_ARRAY_TYPE) {
+  if (instance_type >= FIRST_WEAK_FIXED_ARRAY_TYPE &&
+      instance_type <= LAST_WEAK_FIXED_ARRAY_TYPE) {
     return WeakFixedArray::SizeFor(
         reinterpret_cast<const WeakFixedArray*>(this)->synchronized_length());
   }
+  if (instance_type == WEAK_ARRAY_LIST_TYPE) {
+    return WeakArrayList::SizeForCapacity(
+        reinterpret_cast<const WeakArrayList*>(this)->synchronized_capacity());
+  }
   if (instance_type >= FIRST_FIXED_TYPED_ARRAY_TYPE &&
       instance_type <= LAST_FIXED_TYPED_ARRAY_TYPE) {
     return reinterpret_cast<const FixedTypedArrayBase*>(this)->TypedArraySize(
         instance_type);
   }
   if (instance_type == SMALL_ORDERED_HASH_SET_TYPE) {
-    return reinterpret_cast<const SmallOrderedHashSet*>(this)->Size();
+    return SmallOrderedHashSet::SizeFor(
+        reinterpret_cast<const SmallOrderedHashSet*>(this)->Capacity());
   }
   if (instance_type == PROPERTY_ARRAY_TYPE) {
     return PropertyArray::SizeFor(
         reinterpret_cast<const PropertyArray*>(this)->synchronized_length());
   }
   if (instance_type == SMALL_ORDERED_HASH_MAP_TYPE) {
-    return reinterpret_cast<const SmallOrderedHashMap*>(this)->Size();
+    return SmallOrderedHashMap::SizeFor(
+        reinterpret_cast<const SmallOrderedHashMap*>(this)->Capacity());
   }
   if (instance_type == FEEDBACK_VECTOR_TYPE) {
     return FeedbackVector::SizeFor(
@@ -2275,90 +2388,29 @@ ACCESSORS(JSGlobalObject, global_proxy, JSObject, kGlobalProxyOffset)
 
 ACCESSORS(JSGlobalProxy, native_context, Object, kNativeContextOffset)
 
-ACCESSORS(AccessorInfo, name, Name, kNameOffset)
-SMI_ACCESSORS(AccessorInfo, flags, kFlagsOffset)
-ACCESSORS(AccessorInfo, expected_receiver_type, Object,
-           kExpectedReceiverTypeOffset)
-
-ACCESSORS_CHECKED2(AccessorInfo, getter, Object, kGetterOffset, true,
-                   Foreign::IsNormalized(value))
-ACCESSORS_CHECKED2(AccessorInfo, setter, Object, kSetterOffset, true,
-                   Foreign::IsNormalized(value));
-ACCESSORS(AccessorInfo, js_getter, Object, kJsGetterOffset)
-ACCESSORS(AccessorInfo, data, Object, kDataOffset)
-
-bool AccessorInfo::has_getter() {
-  bool result = getter() != Smi::kZero;
-  DCHECK_EQ(result, getter() != Smi::kZero &&
-                        Foreign::cast(getter())->foreign_address() != nullptr);
-  return result;
-}
-
-bool AccessorInfo::has_setter() {
-  bool result = setter() != Smi::kZero;
-  DCHECK_EQ(result, setter() != Smi::kZero &&
-                        Foreign::cast(setter())->foreign_address() != nullptr);
-  return result;
-}
-
 ACCESSORS(AsyncGeneratorRequest, next, Object, kNextOffset)
 SMI_ACCESSORS(AsyncGeneratorRequest, resume_mode, kResumeModeOffset)
 ACCESSORS(AsyncGeneratorRequest, value, Object, kValueOffset)
 ACCESSORS(AsyncGeneratorRequest, promise, Object, kPromiseOffset)
 
 Map* PrototypeInfo::ObjectCreateMap() {
-  return Map::cast(WeakCell::cast(object_create_map())->value());
+  return Map::cast(object_create_map()->ToWeakHeapObject());
 }
 
 // static
 void PrototypeInfo::SetObjectCreateMap(Handle<PrototypeInfo> info,
                                        Handle<Map> map) {
-  Handle<WeakCell> cell = Map::WeakCellForMap(map);
-  info->set_object_create_map(*cell);
+  info->set_object_create_map(HeapObjectReference::Weak(*map));
 }
 
 bool PrototypeInfo::HasObjectCreateMap() {
-  Object* cache = object_create_map();
-  return cache->IsWeakCell() && !WeakCell::cast(cache)->cleared();
-}
-
-bool FunctionTemplateInfo::instantiated() {
-  return shared_function_info()->IsSharedFunctionInfo();
-}
-
-bool FunctionTemplateInfo::BreakAtEntry() {
-  Object* maybe_shared = shared_function_info();
-  if (maybe_shared->IsSharedFunctionInfo()) {
-    SharedFunctionInfo* shared = SharedFunctionInfo::cast(maybe_shared);
-    return shared->BreakAtEntry();
-  }
-  return false;
-}
-
-FunctionTemplateInfo* FunctionTemplateInfo::GetParent(Isolate* isolate) {
-  Object* parent = parent_template();
-  return parent->IsUndefined(isolate) ? nullptr
-                                      : FunctionTemplateInfo::cast(parent);
-}
-
-ObjectTemplateInfo* ObjectTemplateInfo::GetParent(Isolate* isolate) {
-  Object* maybe_ctor = constructor();
-  if (maybe_ctor->IsUndefined(isolate)) return nullptr;
-  FunctionTemplateInfo* constructor = FunctionTemplateInfo::cast(maybe_ctor);
-  while (true) {
-    constructor = constructor->GetParent(isolate);
-    if (constructor == nullptr) return nullptr;
-    Object* maybe_obj = constructor->instance_template();
-    if (!maybe_obj->IsUndefined(isolate)) {
-      return ObjectTemplateInfo::cast(maybe_obj);
-    }
-  }
-  return nullptr;
+  MaybeObject* cache = object_create_map();
+  return cache->IsWeakHeapObject();
 }
 
 ACCESSORS(PrototypeInfo, weak_cell, Object, kWeakCellOffset)
 ACCESSORS(PrototypeInfo, prototype_users, Object, kPrototypeUsersOffset)
-ACCESSORS(PrototypeInfo, object_create_map, Object, kObjectCreateMap)
+WEAK_ACCESSORS(PrototypeInfo, object_create_map, kObjectCreateMapOffset)
 SMI_ACCESSORS(PrototypeInfo, registry_slot, kRegistrySlotOffset)
 SMI_ACCESSORS(PrototypeInfo, bit_field, kBitFieldOffset)
 BOOL_ACCESSORS(PrototypeInfo, bit_field, should_be_fast_map, kShouldBeFastBit)
@@ -2367,16 +2419,6 @@ ACCESSORS(Tuple2, value1, Object, kValue1Offset)
 ACCESSORS(Tuple2, value2, Object, kValue2Offset)
 ACCESSORS(Tuple3, value3, Object, kValue3Offset)
 
-ACCESSORS(ContextExtension, scope_info, ScopeInfo, kScopeInfoOffset)
-ACCESSORS(ContextExtension, extension, Object, kExtensionOffset)
-
-SMI_ACCESSORS(ConstantElementsPair, elements_kind, kElementsKindOffset)
-ACCESSORS(ConstantElementsPair, constant_values, FixedArrayBase,
-          kConstantValuesOffset)
-bool ConstantElementsPair::is_empty() const {
-  return constant_values()->length() == 0;
-}
-
 ACCESSORS(TemplateObjectDescription, raw_strings, FixedArray, kRawStringsOffset)
 ACCESSORS(TemplateObjectDescription, cooked_strings, FixedArray,
           kCookedStringsOffset)
@@ -2384,96 +2426,6 @@ ACCESSORS(TemplateObjectDescription, cooked_strings, FixedArray,
 ACCESSORS(AccessorPair, getter, Object, kGetterOffset)
 ACCESSORS(AccessorPair, setter, Object, kSetterOffset)
 
-ACCESSORS(AccessCheckInfo, callback, Object, kCallbackOffset)
-ACCESSORS(AccessCheckInfo, named_interceptor, Object, kNamedInterceptorOffset)
-ACCESSORS(AccessCheckInfo, indexed_interceptor, Object,
-          kIndexedInterceptorOffset)
-ACCESSORS(AccessCheckInfo, data, Object, kDataOffset)
-
-ACCESSORS(InterceptorInfo, getter, Object, kGetterOffset)
-ACCESSORS(InterceptorInfo, setter, Object, kSetterOffset)
-ACCESSORS(InterceptorInfo, query, Object, kQueryOffset)
-ACCESSORS(InterceptorInfo, descriptor, Object, kDescriptorOffset)
-ACCESSORS(InterceptorInfo, deleter, Object, kDeleterOffset)
-ACCESSORS(InterceptorInfo, enumerator, Object, kEnumeratorOffset)
-ACCESSORS(InterceptorInfo, definer, Object, kDefinerOffset)
-ACCESSORS(InterceptorInfo, data, Object, kDataOffset)
-SMI_ACCESSORS(InterceptorInfo, flags, kFlagsOffset)
-BOOL_ACCESSORS(InterceptorInfo, flags, can_intercept_symbols,
-               kCanInterceptSymbolsBit)
-BOOL_ACCESSORS(InterceptorInfo, flags, all_can_read, kAllCanReadBit)
-BOOL_ACCESSORS(InterceptorInfo, flags, non_masking, kNonMasking)
-BOOL_ACCESSORS(InterceptorInfo, flags, is_named, kNamed)
-BOOL_ACCESSORS(InterceptorInfo, flags, has_no_side_effect, kHasNoSideEffect)
-
-ACCESSORS(CallHandlerInfo, callback, Object, kCallbackOffset)
-ACCESSORS(CallHandlerInfo, js_callback, Object, kJsCallbackOffset)
-ACCESSORS(CallHandlerInfo, data, Object, kDataOffset)
-
-bool CallHandlerInfo::IsSideEffectFreeCallHandlerInfo() const {
-  DCHECK(map() == GetHeap()->side_effect_call_handler_info_map() ||
-         map() == GetHeap()->side_effect_free_call_handler_info_map());
-  return map() == GetHeap()->side_effect_free_call_handler_info_map();
-}
-
-ACCESSORS(TemplateInfo, tag, Object, kTagOffset)
-ACCESSORS(TemplateInfo, serial_number, Object, kSerialNumberOffset)
-SMI_ACCESSORS(TemplateInfo, number_of_properties, kNumberOfProperties)
-ACCESSORS(TemplateInfo, property_list, Object, kPropertyListOffset)
-ACCESSORS(TemplateInfo, property_accessors, Object, kPropertyAccessorsOffset)
-
-ACCESSORS(FunctionTemplateInfo, call_code, Object, kCallCodeOffset)
-ACCESSORS(FunctionTemplateInfo, prototype_template, Object,
-          kPrototypeTemplateOffset)
-ACCESSORS(FunctionTemplateInfo, prototype_provider_template, Object,
-          kPrototypeProviderTemplateOffset)
-
-ACCESSORS(FunctionTemplateInfo, parent_template, Object, kParentTemplateOffset)
-ACCESSORS(FunctionTemplateInfo, named_property_handler, Object,
-          kNamedPropertyHandlerOffset)
-ACCESSORS(FunctionTemplateInfo, indexed_property_handler, Object,
-          kIndexedPropertyHandlerOffset)
-ACCESSORS(FunctionTemplateInfo, instance_template, Object,
-          kInstanceTemplateOffset)
-ACCESSORS(FunctionTemplateInfo, class_name, Object, kClassNameOffset)
-ACCESSORS(FunctionTemplateInfo, signature, Object, kSignatureOffset)
-ACCESSORS(FunctionTemplateInfo, instance_call_handler, Object,
-          kInstanceCallHandlerOffset)
-ACCESSORS(FunctionTemplateInfo, access_check_info, Object,
-          kAccessCheckInfoOffset)
-ACCESSORS(FunctionTemplateInfo, shared_function_info, Object,
-          kSharedFunctionInfoOffset)
-ACCESSORS(FunctionTemplateInfo, cached_property_name, Object,
-          kCachedPropertyNameOffset)
-
-SMI_ACCESSORS(FunctionTemplateInfo, flag, kFlagOffset)
-
-ACCESSORS(ObjectTemplateInfo, constructor, Object, kConstructorOffset)
-ACCESSORS(ObjectTemplateInfo, data, Object, kDataOffset)
-
-int ObjectTemplateInfo::embedder_field_count() const {
-  Object* value = data();
-  DCHECK(value->IsSmi());
-  return EmbedderFieldCount::decode(Smi::ToInt(value));
-}
-
-void ObjectTemplateInfo::set_embedder_field_count(int count) {
-  DCHECK_LE(count, JSObject::kMaxEmbedderFields);
-  return set_data(
-      Smi::FromInt(EmbedderFieldCount::update(Smi::ToInt(data()), count)));
-}
-
-bool ObjectTemplateInfo::immutable_proto() const {
-  Object* value = data();
-  DCHECK(value->IsSmi());
-  return IsImmutablePrototype::decode(Smi::ToInt(value));
-}
-
-void ObjectTemplateInfo::set_immutable_proto(bool immutable) {
-  return set_data(Smi::FromInt(
-      IsImmutablePrototype::update(Smi::ToInt(data()), immutable)));
-}
-
 ACCESSORS(AllocationSite, transition_info_or_boilerplate, Object,
           kTransitionInfoOrBoilerplateOffset)
 
@@ -2497,12 +2449,13 @@ void AllocationSite::set_transition_info(int value) {
 }
 
 ACCESSORS(AllocationSite, nested_site, Object, kNestedSiteOffset)
-SMI_ACCESSORS(AllocationSite, pretenure_data, kPretenureDataOffset)
-SMI_ACCESSORS(AllocationSite, pretenure_create_count,
-              kPretenureCreateCountOffset)
+INT32_ACCESSORS(AllocationSite, pretenure_data, kPretenureDataOffset)
+INT32_ACCESSORS(AllocationSite, pretenure_create_count,
+                kPretenureCreateCountOffset)
 ACCESSORS(AllocationSite, dependent_code, DependentCode,
           kDependentCodeOffset)
-ACCESSORS(AllocationSite, weak_next, Object, kWeakNextOffset)
+ACCESSORS_CHECKED(AllocationSite, weak_next, Object, kWeakNextOffset,
+                  HasWeakNext())
 ACCESSORS(AllocationMemento, allocation_site, Object, kAllocationSiteOffset)
 
 SMI_ACCESSORS(StackFrameInfo, line_number, kLineNumberIndex)
@@ -2523,20 +2476,6 @@ ACCESSORS(SourcePositionTableWithFrameCache, source_position_table, ByteArray,
 ACCESSORS(SourcePositionTableWithFrameCache, stack_frame_cache,
           SimpleNumberDictionary, kStackFrameCacheIndex)
 
-SMI_ACCESSORS(FunctionTemplateInfo, length, kLengthOffset)
-BOOL_ACCESSORS(FunctionTemplateInfo, flag, hidden_prototype,
-               kHiddenPrototypeBit)
-BOOL_ACCESSORS(FunctionTemplateInfo, flag, undetectable, kUndetectableBit)
-BOOL_ACCESSORS(FunctionTemplateInfo, flag, needs_access_check,
-               kNeedsAccessCheckBit)
-BOOL_ACCESSORS(FunctionTemplateInfo, flag, read_only_prototype,
-               kReadOnlyPrototypeBit)
-BOOL_ACCESSORS(FunctionTemplateInfo, flag, remove_prototype,
-               kRemovePrototypeBit)
-BOOL_ACCESSORS(FunctionTemplateInfo, flag, do_not_cache,
-               kDoNotCacheBit)
-BOOL_ACCESSORS(FunctionTemplateInfo, flag, accept_any_receiver,
-               kAcceptAnyReceiver)
 
 FeedbackVector* JSFunction::feedback_vector() const {
   DCHECK(has_feedback_vector());
@@ -2603,7 +2542,7 @@ bool JSFunction::IsInOptimizationQueue() {
 void JSFunction::CompleteInobjectSlackTrackingIfActive() {
   if (!has_prototype_slot()) return;
   if (has_initial_map() && initial_map()->IsInobjectSlackTrackingInProgress()) {
-    initial_map()->CompleteInobjectSlackTracking();
+    initial_map()->CompleteInobjectSlackTracking(GetIsolate());
   }
 }
 
@@ -2618,7 +2557,7 @@ AbstractCode* JSFunction::abstract_code() {
 Code* JSFunction::code() { return Code::cast(READ_FIELD(this, kCodeOffset)); }
 
 void JSFunction::set_code(Code* value) {
-  DCHECK(!GetHeap()->InNewSpace(value));
+  DCHECK(!Heap::InNewSpace(value));
   WRITE_FIELD(this, kCodeOffset, value);
   GetHeap()->incremental_marking()->RecordWrite(
       this, HeapObject::RawField(this, kCodeOffset), value);
@@ -2626,7 +2565,7 @@ void JSFunction::set_code(Code* value) {
 
 
 void JSFunction::set_code_no_write_barrier(Code* value) {
-  DCHECK(!GetHeap()->InNewSpace(value));
+  DCHECK(!Heap::InNewSpace(value));
   WRITE_FIELD(this, kCodeOffset, value);
 }
 
@@ -2651,7 +2590,7 @@ void JSFunction::SetOptimizationMarker(OptimizationMarker marker) {
 }
 
 bool JSFunction::has_feedback_vector() const {
-  return !feedback_cell()->value()->IsUndefined(GetIsolate());
+  return !feedback_cell()->value()->IsUndefined();
 }
 
 Context* JSFunction::context() {
@@ -2671,7 +2610,7 @@ Context* JSFunction::native_context() { return context()->native_context(); }
 
 
 void JSFunction::set_context(Object* value) {
-  DCHECK(value->IsUndefined(GetIsolate()) || value->IsContext());
+  DCHECK(value->IsUndefined() || value->IsContext());
   WRITE_FIELD(this, kContextOffset, value);
   WRITE_BARRIER(GetHeap(), this, kContextOffset, value);
 }
@@ -2696,11 +2635,9 @@ bool JSFunction::has_initial_map() {
 
 bool JSFunction::has_instance_prototype() {
   DCHECK(has_prototype_slot());
-  return has_initial_map() ||
-         !prototype_or_initial_map()->IsTheHole(GetIsolate());
+  return has_initial_map() || !prototype_or_initial_map()->IsTheHole();
 }
 
-
 bool JSFunction::has_prototype() {
   DCHECK(has_prototype_slot());
   return map()->has_non_instance_prototype() || has_instance_prototype();
@@ -2732,8 +2669,7 @@ Object* JSFunction::prototype() {
 
 
 bool JSFunction::is_compiled() {
-  Builtins* builtins = GetIsolate()->builtins();
-  return code() != builtins->builtin(Builtins::kCompileLazy);
+  return code()->builtin_index() != Builtins::kCompileLazy;
 }
 
 ACCESSORS(JSProxy, target, Object, kTargetOffset)
@@ -2744,7 +2680,7 @@ bool JSProxy::IsRevoked() const { return !handler()->IsJSReceiver(); }
 // static
 bool Foreign::IsNormalized(Object* value) {
   if (value == Smi::kZero) return true;
-  return Foreign::cast(value)->foreign_address() != nullptr;
+  return Foreign::cast(value)->foreign_address() != kNullAddress;
 }
 
 Address Foreign::foreign_address() {
@@ -2758,9 +2694,10 @@ void Foreign::set_foreign_address(Address value) {
 template <class Derived>
 void SmallOrderedHashTable<Derived>::SetDataEntry(int entry, int relative_index,
                                                   Object* value) {
-  int entry_offset = GetDataEntryOffset(entry, relative_index);
+  Address entry_offset = GetDataEntryOffset(entry, relative_index);
   RELAXED_WRITE_FIELD(this, entry_offset, value);
-  WRITE_BARRIER(GetHeap(), this, entry_offset, value);
+  WRITE_BARRIER(Heap::FromWritableHeapObject(this), this,
+                static_cast<int>(entry_offset), value);
 }
 
 ACCESSORS(JSGeneratorObject, function, JSFunction, kFunctionOffset)
@@ -2769,7 +2706,8 @@ ACCESSORS(JSGeneratorObject, receiver, Object, kReceiverOffset)
 ACCESSORS(JSGeneratorObject, input_or_debug_pos, Object, kInputOrDebugPosOffset)
 SMI_ACCESSORS(JSGeneratorObject, resume_mode, kResumeModeOffset)
 SMI_ACCESSORS(JSGeneratorObject, continuation, kContinuationOffset)
-ACCESSORS(JSGeneratorObject, register_file, FixedArray, kRegisterFileOffset)
+ACCESSORS(JSGeneratorObject, parameters_and_registers, FixedArray,
+          kParametersAndRegistersOffset)
 
 bool JSGeneratorObject::is_suspended() const {
   DCHECK_LT(kGeneratorExecuting, 0);
@@ -2791,18 +2729,6 @@ SMI_ACCESSORS(JSAsyncGeneratorObject, is_awaiting, kIsAwaitingOffset)
 ACCESSORS(JSValue, value, Object, kValueOffset)
 
 
-HeapNumber* HeapNumber::cast(Object* object) {
-  SLOW_DCHECK(object->IsHeapNumber() || object->IsMutableHeapNumber());
-  return reinterpret_cast<HeapNumber*>(object);
-}
-
-
-const HeapNumber* HeapNumber::cast(const Object* object) {
-  SLOW_DCHECK(object->IsHeapNumber() || object->IsMutableHeapNumber());
-  return reinterpret_cast<const HeapNumber*>(object);
-}
-
-
 ACCESSORS(JSDate, value, Object, kValueOffset)
 ACCESSORS(JSDate, cache_stamp, Object, kCacheStampOffset)
 ACCESSORS(JSDate, year, Object, kYearOffset)
@@ -2816,7 +2742,7 @@ ACCESSORS(JSDate, sec, Object, kSecOffset)
 
 SMI_ACCESSORS(JSMessageObject, type, kTypeOffset)
 ACCESSORS(JSMessageObject, argument, Object, kArgumentsOffset)
-ACCESSORS(JSMessageObject, script, Object, kScriptOffset)
+ACCESSORS(JSMessageObject, script, Script, kScriptOffset)
 ACCESSORS(JSMessageObject, stack_frames, Object, kStackFramesOffset)
 SMI_ACCESSORS(JSMessageObject, start_position, kStartPositionOffset)
 SMI_ACCESSORS(JSMessageObject, end_position, kEndPositionOffset)
@@ -2833,11 +2759,11 @@ ElementsKind JSObject::GetElementsKind() {
   if (ElementsAreSafeToExamine()) {
     Map* map = fixed_array->map();
     if (IsSmiOrObjectElementsKind(kind)) {
-      DCHECK(map == GetHeap()->fixed_array_map() ||
-             map == GetHeap()->fixed_cow_array_map());
+      DCHECK(map == GetReadOnlyRoots().fixed_array_map() ||
+             map == GetReadOnlyRoots().fixed_cow_array_map());
     } else if (IsDoubleElementsKind(kind)) {
       DCHECK(fixed_array->IsFixedDoubleArray() ||
-             fixed_array == GetHeap()->empty_fixed_array());
+             fixed_array == GetReadOnlyRoots().empty_fixed_array());
     } else if (kind == DICTIONARY_ELEMENTS) {
       DCHECK(fixed_array->IsFixedArray());
       DCHECK(fixed_array->IsDictionary());
@@ -2874,6 +2800,9 @@ bool JSObject::HasFastElements() {
   return IsFastElementsKind(GetElementsKind());
 }
 
+bool JSObject::HasFastPackedElements() {
+  return IsFastPackedElementsKind(GetElementsKind());
+}
 
 bool JSObject::HasDictionaryElements() {
   return GetElementsKind() == DICTIONARY_ELEMENTS;
@@ -2950,8 +2879,9 @@ NumberDictionary* JSObject::element_dictionary() {
 }
 
 // static
-Maybe<bool> Object::GreaterThan(Handle<Object> x, Handle<Object> y) {
-  Maybe<ComparisonResult> result = Compare(x, y);
+Maybe<bool> Object::GreaterThan(Isolate* isolate, Handle<Object> x,
+                                Handle<Object> y) {
+  Maybe<ComparisonResult> result = Compare(isolate, x, y);
   if (result.IsJust()) {
     switch (result.FromJust()) {
       case ComparisonResult::kGreaterThan:
@@ -2967,8 +2897,9 @@ Maybe<bool> Object::GreaterThan(Handle<Object> x, Handle<Object> y) {
 
 
 // static
-Maybe<bool> Object::GreaterThanOrEqual(Handle<Object> x, Handle<Object> y) {
-  Maybe<ComparisonResult> result = Compare(x, y);
+Maybe<bool> Object::GreaterThanOrEqual(Isolate* isolate, Handle<Object> x,
+                                       Handle<Object> y) {
+  Maybe<ComparisonResult> result = Compare(isolate, x, y);
   if (result.IsJust()) {
     switch (result.FromJust()) {
       case ComparisonResult::kEqual:
@@ -2984,8 +2915,9 @@ Maybe<bool> Object::GreaterThanOrEqual(Handle<Object> x, Handle<Object> y) {
 
 
 // static
-Maybe<bool> Object::LessThan(Handle<Object> x, Handle<Object> y) {
-  Maybe<ComparisonResult> result = Compare(x, y);
+Maybe<bool> Object::LessThan(Isolate* isolate, Handle<Object> x,
+                             Handle<Object> y) {
+  Maybe<ComparisonResult> result = Compare(isolate, x, y);
   if (result.IsJust()) {
     switch (result.FromJust()) {
       case ComparisonResult::kLessThan:
@@ -3001,8 +2933,9 @@ Maybe<bool> Object::LessThan(Handle<Object> x, Handle<Object> y) {
 
 
 // static
-Maybe<bool> Object::LessThanOrEqual(Handle<Object> x, Handle<Object> y) {
-  Maybe<ComparisonResult> result = Compare(x, y);
+Maybe<bool> Object::LessThanOrEqual(Isolate* isolate, Handle<Object> x,
+                                    Handle<Object> y) {
+  Maybe<ComparisonResult> result = Compare(isolate, x, y);
   if (result.IsJust()) {
     switch (result.FromJust()) {
       case ComparisonResult::kEqual:
@@ -3037,20 +2970,22 @@ MaybeHandle<Object> Object::SetPropertyOrElement(Handle<Object> object,
 MaybeHandle<Object> Object::GetPropertyOrElement(Handle<Object> receiver,
                                                  Handle<Name> name,
                                                  Handle<JSReceiver> holder) {
-  LookupIterator it = LookupIterator::PropertyOrElement(
-      name->GetIsolate(), receiver, name, holder);
+  LookupIterator it = LookupIterator::PropertyOrElement(holder->GetIsolate(),
+                                                        receiver, name, holder);
   return GetProperty(&it);
 }
 
 
 void JSReceiver::initialize_properties() {
-  DCHECK(!GetHeap()->InNewSpace(GetHeap()->empty_fixed_array()));
-  DCHECK(!GetHeap()->InNewSpace(GetHeap()->empty_property_dictionary()));
+  Heap* heap = GetHeap();
+  ReadOnlyRoots roots(heap);
+  DCHECK(!Heap::InNewSpace(roots.empty_fixed_array()));
+  DCHECK(!Heap::InNewSpace(heap->empty_property_dictionary()));
   if (map()->is_dictionary_map()) {
     WRITE_FIELD(this, kPropertiesOrHashOffset,
-                GetHeap()->empty_property_dictionary());
+                heap->empty_property_dictionary());
   } else {
-    WRITE_FIELD(this, kPropertiesOrHashOffset, GetHeap()->empty_fixed_array());
+    WRITE_FIELD(this, kPropertiesOrHashOffset, roots.empty_fixed_array());
   }
 }
 
@@ -3079,8 +3014,8 @@ PropertyArray* JSReceiver::property_array() const {
   DCHECK(HasFastProperties());
 
   Object* prop = raw_properties_or_hash();
-  if (prop->IsSmi() || prop == GetHeap()->empty_fixed_array()) {
-    return GetHeap()->empty_property_array();
+  if (prop->IsSmi() || prop == GetReadOnlyRoots().empty_fixed_array()) {
+    return GetReadOnlyRoots().empty_property_array();
   }
 
   return PropertyArray::cast(prop);
@@ -3112,7 +3047,7 @@ Maybe<bool> JSReceiver::HasOwnProperty(Handle<JSReceiver> object,
 
 Maybe<PropertyAttributes> JSReceiver::GetPropertyAttributes(
     Handle<JSReceiver> object, Handle<Name> name) {
-  LookupIterator it = LookupIterator::PropertyOrElement(name->GetIsolate(),
+  LookupIterator it = LookupIterator::PropertyOrElement(object->GetIsolate(),
                                                         object, name, object);
   return GetPropertyAttributes(&it);
 }
@@ -3121,7 +3056,7 @@ Maybe<PropertyAttributes> JSReceiver::GetPropertyAttributes(
 Maybe<PropertyAttributes> JSReceiver::GetOwnPropertyAttributes(
     Handle<JSReceiver> object, Handle<Name> name) {
   LookupIterator it = LookupIterator::PropertyOrElement(
-      name->GetIsolate(), object, name, object, LookupIterator::OWN);
+      object->GetIsolate(), object, name, object, LookupIterator::OWN);
   return GetPropertyAttributes(&it);
 }
 
@@ -3170,37 +3105,6 @@ inline int JSGlobalProxy::SizeWithEmbedderFields(int embedder_field_count) {
   return kSize + embedder_field_count * kPointerSize;
 }
 
-BIT_FIELD_ACCESSORS(AccessorInfo, flags, all_can_read,
-                    AccessorInfo::AllCanReadBit)
-BIT_FIELD_ACCESSORS(AccessorInfo, flags, all_can_write,
-                    AccessorInfo::AllCanWriteBit)
-BIT_FIELD_ACCESSORS(AccessorInfo, flags, is_special_data_property,
-                    AccessorInfo::IsSpecialDataPropertyBit)
-BIT_FIELD_ACCESSORS(AccessorInfo, flags, replace_on_access,
-                    AccessorInfo::ReplaceOnAccessBit)
-BIT_FIELD_ACCESSORS(AccessorInfo, flags, is_sloppy, AccessorInfo::IsSloppyBit)
-BIT_FIELD_ACCESSORS(AccessorInfo, flags, has_no_side_effect,
-                    AccessorInfo::HasNoSideEffectBit)
-BIT_FIELD_ACCESSORS(AccessorInfo, flags, initial_property_attributes,
-                    AccessorInfo::InitialAttributesBits)
-
-bool FunctionTemplateInfo::IsTemplateFor(JSObject* object) {
-  return IsTemplateFor(object->map());
-}
-
-bool AccessorInfo::IsCompatibleReceiver(Object* receiver) {
-  if (!HasExpectedReceiverType()) return true;
-  if (!receiver->IsJSObject()) return false;
-  return FunctionTemplateInfo::cast(expected_receiver_type())
-      ->IsTemplateFor(JSObject::cast(receiver)->map());
-}
-
-
-bool AccessorInfo::HasExpectedReceiverType() {
-  return expected_receiver_type()->IsFunctionTemplateInfo();
-}
-
-
 Object* AccessorPair::get(AccessorComponent component) {
   return component == ACCESSOR_GETTER ? getter() : setter();
 }
@@ -3216,12 +3120,10 @@ void AccessorPair::set(AccessorComponent component, Object* value) {
 
 
 void AccessorPair::SetComponents(Object* getter, Object* setter) {
-  Isolate* isolate = GetIsolate();
-  if (!getter->IsNull(isolate)) set_getter(getter);
-  if (!setter->IsNull(isolate)) set_setter(setter);
+  if (!getter->IsNull()) set_getter(getter);
+  if (!setter->IsNull()) set_setter(setter);
 }
 
-
 bool AccessorPair::Equals(AccessorPair* pair) {
   return (this == pair) || pair->Equals(getter(), setter());
 }
@@ -3238,12 +3140,12 @@ bool AccessorPair::ContainsAccessor() {
 
 
 bool AccessorPair::IsJSAccessor(Object* obj) {
-  return obj->IsCallable() || obj->IsUndefined(GetIsolate());
+  return obj->IsCallable() || obj->IsUndefined();
 }
 
 template <typename Derived, typename Shape>
 void Dictionary<Derived, Shape>::ClearEntry(int entry) {
-  Object* the_hole = this->GetHeap()->the_hole_value();
+  Object* the_hole = this->GetReadOnlyRoots().the_hole_value();
   PropertyDetails details = PropertyDetails::Empty();
   Derived::cast(this)->SetEntry(entry, the_hole, the_hole, details);
 }
@@ -3281,9 +3183,9 @@ PropertyCell* GlobalDictionary::CellAt(int entry) {
 }
 
 bool GlobalDictionaryShape::IsLive(Isolate* isolate, Object* k) {
-  Heap* heap = isolate->heap();
-  DCHECK_NE(heap->the_hole_value(), k);
-  return k != heap->undefined_value();
+  ReadOnlyRoots roots(isolate);
+  DCHECK_NE(roots.the_hole_value(), k);
+  return k != roots.undefined_value();
 }
 
 bool GlobalDictionaryShape::IsKey(Isolate* isolate, Object* k) {
@@ -3335,8 +3237,7 @@ int SimpleNumberDictionaryShape::GetMapRootIndex() {
 }
 
 bool NameDictionaryShape::IsMatch(Handle<Name> key, Object* other) {
-  DCHECK(other->IsTheHole(key->GetIsolate()) ||
-         Name::cast(other)->IsUniqueName());
+  DCHECK(other->IsTheHole() || Name::cast(other)->IsUniqueName());
   DCHECK(key->IsUniqueName());
   return *key == other;
 }
@@ -3396,16 +3297,59 @@ uint32_t ObjectHashTableShape::HashForObject(Isolate* isolate, Object* other) {
   return Smi::ToInt(other->GetHash());
 }
 
+// static
+Object* Object::GetSimpleHash(Object* object) {
+  DisallowHeapAllocation no_gc;
+  if (object->IsSmi()) {
+    uint32_t hash = ComputeIntegerHash(Smi::ToInt(object));
+    return Smi::FromInt(hash & Smi::kMaxValue);
+  }
+  if (object->IsHeapNumber()) {
+    double num = HeapNumber::cast(object)->value();
+    if (std::isnan(num)) return Smi::FromInt(Smi::kMaxValue);
+    // Use ComputeIntegerHash for all values in Signed32 range, including -0,
+    // which is considered equal to 0 because collections use SameValueZero.
+    uint32_t hash;
+    // Check range before conversion to avoid undefined behavior.
+    if (num >= kMinInt && num <= kMaxInt && FastI2D(FastD2I(num)) == num) {
+      hash = ComputeIntegerHash(FastD2I(num));
+    } else {
+      hash = ComputeLongHash(double_to_uint64(num));
+    }
+    return Smi::FromInt(hash & Smi::kMaxValue);
+  }
+  if (object->IsName()) {
+    uint32_t hash = Name::cast(object)->Hash();
+    return Smi::FromInt(hash);
+  }
+  if (object->IsOddball()) {
+    uint32_t hash = Oddball::cast(object)->to_string()->Hash();
+    return Smi::FromInt(hash);
+  }
+  if (object->IsBigInt()) {
+    uint32_t hash = BigInt::cast(object)->Hash();
+    return Smi::FromInt(hash & Smi::kMaxValue);
+  }
+  DCHECK(object->IsJSReceiver());
+  return object;
+}
+
+Object* Object::GetHash() {
+  DisallowHeapAllocation no_gc;
+  Object* hash = GetSimpleHash(this);
+  if (hash->IsSmi()) return hash;
+
+  DCHECK(IsJSReceiver());
+  JSReceiver* receiver = JSReceiver::cast(this);
+  Isolate* isolate = receiver->GetIsolate();
+  return receiver->GetIdentityHash(isolate);
+}
 
 Handle<Object> ObjectHashTableShape::AsHandle(Isolate* isolate,
                                               Handle<Object> key) {
   return key;
 }
 
-Handle<ObjectHashTable> ObjectHashTable::Shrink(Handle<ObjectHashTable> table) {
-  return DerivedHashTable::Shrink(table);
-}
-
 Relocatable::Relocatable(Isolate* isolate) {
   isolate_ = isolate;
   prev_ = isolate->relocatable_top();
@@ -3424,7 +3368,7 @@ Object* OrderedHashTableIterator<Derived, TableType>::CurrentKey() {
   TableType* table(TableType::cast(this->table()));
   int index = Smi::ToInt(this->index());
   Object* key = table->KeyAt(index);
-  DCHECK(!key->IsTheHole(table->GetIsolate()));
+  DCHECK(!key->IsTheHole());
   return key;
 }
 
diff --git a/deps/v8/src/objects-printer.cc b/deps/v8/src/objects-printer.cc
index 8d20279b2f1f20..9b0a1ec7d7a61c 100644
--- a/deps/v8/src/objects-printer.cc
+++ b/deps/v8/src/objects-printer.cc
@@ -10,10 +10,24 @@
 #include "src/bootstrapper.h"
 #include "src/disasm.h"
 #include "src/disassembler.h"
+#include "src/instruction-stream.h"
 #include "src/interpreter/bytecodes.h"
 #include "src/objects-inl.h"
+#include "src/objects/arguments-inl.h"
 #include "src/objects/debug-objects-inl.h"
+#include "src/objects/hash-table-inl.h"
+#include "src/objects/js-collection-inl.h"
+#ifdef V8_INTL_SUPPORT
+#include "src/objects/js-locale-inl.h"
+#endif  // V8_INTL_SUPPORT
+#include "src/objects/js-regexp-inl.h"
+#include "src/objects/js-regexp-string-iterator-inl.h"
+#ifdef V8_INTL_SUPPORT
+#include "src/objects/js-relative-time-format-inl.h"
+#endif  // V8_INTL_SUPPORT
+#include "src/objects/literal-objects-inl.h"
 #include "src/objects/microtask-inl.h"
+#include "src/objects/module-inl.h"
 #include "src/objects/promise-inl.h"
 #include "src/ostreams.h"
 #include "src/regexp/jsregexp.h"
@@ -27,19 +41,18 @@ namespace internal {
 
 #ifdef OBJECT_PRINT
 
-void Object::Print() {
-  OFStream os(stdout);
-  this->Print(os);
+void Object::Print(Isolate* isolate) {
+  StdoutStream os;
+  this->Print(isolate, os);
   os << std::flush;
 }
 
-
-void Object::Print(std::ostream& os) {  // NOLINT
+void Object::Print(Isolate* isolate, std::ostream& os) {  // NOLINT
   if (IsSmi()) {
     os << "Smi: " << std::hex << "0x" << Smi::ToInt(this);
     os << std::dec << " (" << Smi::ToInt(this) << ")\n";
   } else {
-    HeapObject::cast(this)->HeapObjectPrint(os);
+    HeapObject::cast(this)->HeapObjectPrint(isolate, os);
   }
 }
 
@@ -51,15 +64,17 @@ void HeapObject::PrintHeader(std::ostream& os, const char* id) {  // NOLINT
     os << map()->instance_type();
   }
   os << "]";
-  if (GetHeap()->InOldSpace(this)) os << " in OldSpace";
+  MemoryChunk* chunk = MemoryChunk::FromAddress(
+      reinterpret_cast<Address>(const_cast<HeapObject*>(this)));
+  if (chunk->owner()->identity() == OLD_SPACE) os << " in OldSpace";
   if (!IsMap()) os << "\n - map: " << Brief(map());
 }
 
-
-void HeapObject::HeapObjectPrint(std::ostream& os) {  // NOLINT
+void HeapObject::HeapObjectPrint(Isolate* isolate,
+                                 std::ostream& os) {  // NOLINT
   InstanceType instance_type = map()->instance_type();
 
-  HandleScope scope(GetIsolate());
+  HandleScope scope(isolate);
   if (instance_type < FIRST_NONSTRING_TYPE) {
     String::cast(this)->StringPrint(os);
     os << "\n";
@@ -68,10 +83,10 @@ void HeapObject::HeapObjectPrint(std::ostream& os) {  // NOLINT
 
   switch (instance_type) {
     case SYMBOL_TYPE:
-      Symbol::cast(this)->SymbolPrint(os);
+      Symbol::cast(this)->SymbolPrint(isolate, os);
       break;
     case MAP_TYPE:
-      Map::cast(this)->MapPrint(os);
+      Map::cast(this)->MapPrint(isolate, os);
       break;
     case HEAP_NUMBER_TYPE:
       HeapNumber::cast(this)->HeapNumberPrint(os);
@@ -79,7 +94,7 @@ void HeapObject::HeapObjectPrint(std::ostream& os) {  // NOLINT
       break;
     case MUTABLE_HEAP_NUMBER_TYPE:
       os << "<mutable ";
-      HeapNumber::cast(this)->HeapNumberPrint(os);
+      MutableHeapNumber::cast(this)->MutableHeapNumberPrint(os);
       os << ">\n";
       break;
     case BIGINT_TYPE:
@@ -89,7 +104,6 @@ void HeapObject::HeapObjectPrint(std::ostream& os) {  // NOLINT
     case FIXED_DOUBLE_ARRAY_TYPE:
       FixedDoubleArray::cast(this)->FixedDoubleArrayPrint(os);
       break;
-    case HASH_TABLE_TYPE:
     case FIXED_ARRAY_TYPE:
     case BLOCK_CONTEXT_TYPE:
     case CATCH_CONTEXT_TYPE:
@@ -100,10 +114,27 @@ void HeapObject::HeapObjectPrint(std::ostream& os) {  // NOLINT
     case NATIVE_CONTEXT_TYPE:
     case SCRIPT_CONTEXT_TYPE:
     case WITH_CONTEXT_TYPE:
+    case SCRIPT_CONTEXT_TABLE_TYPE:
       FixedArray::cast(this)->FixedArrayPrint(os);
       break;
-    case BOILERPLATE_DESCRIPTION_TYPE:
-      BoilerplateDescription::cast(this)->BoilerplateDescriptionPrint(os);
+    case HASH_TABLE_TYPE:
+    case ORDERED_HASH_MAP_TYPE:
+    case ORDERED_HASH_SET_TYPE:
+    case NAME_DICTIONARY_TYPE:
+    case GLOBAL_DICTIONARY_TYPE:
+    case SIMPLE_NUMBER_DICTIONARY_TYPE:
+    case STRING_TABLE_TYPE:
+      ObjectHashTable::cast(this)->ObjectHashTablePrint(os);
+      break;
+    case NUMBER_DICTIONARY_TYPE:
+      NumberDictionary::cast(this)->NumberDictionaryPrint(os);
+      break;
+    case EPHEMERON_HASH_TABLE_TYPE:
+      EphemeronHashTable::cast(this)->EphemeronHashTablePrint(os);
+      break;
+    case OBJECT_BOILERPLATE_DESCRIPTION_TYPE:
+      ObjectBoilerplateDescription::cast(this)
+          ->ObjectBoilerplateDescriptionPrint(os);
       break;
     case PROPERTY_ARRAY_TYPE:
       PropertyArray::cast(this)->PropertyArrayPrint(os);
@@ -112,16 +143,16 @@ void HeapObject::HeapObjectPrint(std::ostream& os) {  // NOLINT
       ByteArray::cast(this)->ByteArrayPrint(os);
       break;
     case BYTECODE_ARRAY_TYPE:
-      BytecodeArray::cast(this)->BytecodeArrayPrint(os);
+      BytecodeArray::cast(this)->BytecodeArrayPrint(isolate, os);
       break;
     case DESCRIPTOR_ARRAY_TYPE:
-      DescriptorArray::cast(this)->PrintDescriptors(os);
+      DescriptorArray::cast(this)->DescriptorArrayPrint(os);
       break;
     case TRANSITION_ARRAY_TYPE:
-      TransitionArray::cast(this)->TransitionArrayPrint(os);
+      TransitionArray::cast(this)->TransitionArrayPrint(isolate, os);
       break;
     case FEEDBACK_CELL_TYPE:
-      FeedbackCell::cast(this)->FeedbackCellPrint(os);
+      FeedbackCell::cast(this)->FeedbackCellPrint(isolate, os);
       break;
     case FEEDBACK_VECTOR_TYPE:
       FeedbackVector::cast(this)->FeedbackVectorPrint(os);
@@ -145,49 +176,55 @@ void HeapObject::HeapObjectPrint(std::ostream& os) {  // NOLINT
     case JS_API_OBJECT_TYPE:
     case JS_SPECIAL_API_OBJECT_TYPE:
     case JS_CONTEXT_EXTENSION_OBJECT_TYPE:
-    case JS_GENERATOR_OBJECT_TYPE:
     case JS_ASYNC_GENERATOR_OBJECT_TYPE:
     case JS_ARGUMENTS_TYPE:
     case JS_ERROR_TYPE:
+    // TODO(titzer): debug printing for more wasm objects
     case WASM_GLOBAL_TYPE:
-    case WASM_INSTANCE_TYPE:  // TODO(titzer): debug printing for wasm objects
     case WASM_MEMORY_TYPE:
     case WASM_MODULE_TYPE:
     case WASM_TABLE_TYPE:
-      JSObject::cast(this)->JSObjectPrint(os);
+      JSObject::cast(this)->JSObjectPrint(isolate, os);
+      break;
+    case WASM_INSTANCE_TYPE:
+      WasmInstanceObject::cast(this)->WasmInstanceObjectPrint(os);
+      break;
+    case JS_GENERATOR_OBJECT_TYPE:
+      JSGeneratorObject::cast(this)->JSGeneratorObjectPrint(isolate, os);
       break;
     case JS_PROMISE_TYPE:
-      JSPromise::cast(this)->JSPromisePrint(os);
+      JSPromise::cast(this)->JSPromisePrint(isolate, os);
       break;
     case JS_ARRAY_TYPE:
-      JSArray::cast(this)->JSArrayPrint(os);
+      JSArray::cast(this)->JSArrayPrint(isolate, os);
       break;
     case JS_REGEXP_TYPE:
-      JSRegExp::cast(this)->JSRegExpPrint(os);
+      JSRegExp::cast(this)->JSRegExpPrint(isolate, os);
       break;
     case JS_REGEXP_STRING_ITERATOR_TYPE:
-      JSRegExpStringIterator::cast(this)->JSRegExpStringIteratorPrint(os);
+      JSRegExpStringIterator::cast(this)->JSRegExpStringIteratorPrint(isolate,
+                                                                      os);
       break;
     case ODDBALL_TYPE:
-      Oddball::cast(this)->to_string()->Print(os);
+      Oddball::cast(this)->to_string()->Print(isolate, os);
       break;
     case JS_BOUND_FUNCTION_TYPE:
-      JSBoundFunction::cast(this)->JSBoundFunctionPrint(os);
+      JSBoundFunction::cast(this)->JSBoundFunctionPrint(isolate, os);
       break;
     case JS_FUNCTION_TYPE:
-      JSFunction::cast(this)->JSFunctionPrint(os);
+      JSFunction::cast(this)->JSFunctionPrint(isolate, os);
       break;
     case JS_GLOBAL_PROXY_TYPE:
-      JSGlobalProxy::cast(this)->JSGlobalProxyPrint(os);
+      JSGlobalProxy::cast(this)->JSGlobalProxyPrint(isolate, os);
       break;
     case JS_GLOBAL_OBJECT_TYPE:
-      JSGlobalObject::cast(this)->JSGlobalObjectPrint(os);
+      JSGlobalObject::cast(this)->JSGlobalObjectPrint(isolate, os);
       break;
     case JS_VALUE_TYPE:
-      JSValue::cast(this)->JSValuePrint(os);
+      JSValue::cast(this)->JSValuePrint(isolate, os);
       break;
     case JS_DATE_TYPE:
-      JSDate::cast(this)->JSDatePrint(os);
+      JSDate::cast(this)->JSDatePrint(isolate, os);
       break;
     case CODE_TYPE:
       Code::cast(this)->CodePrint(os);
@@ -199,28 +236,28 @@ void HeapObject::HeapObjectPrint(std::ostream& os) {  // NOLINT
       JSProxy::cast(this)->JSProxyPrint(os);
       break;
     case JS_SET_TYPE:
-      JSSet::cast(this)->JSSetPrint(os);
+      JSSet::cast(this)->JSSetPrint(isolate, os);
       break;
     case JS_MAP_TYPE:
-      JSMap::cast(this)->JSMapPrint(os);
+      JSMap::cast(this)->JSMapPrint(isolate, os);
       break;
     case JS_SET_KEY_VALUE_ITERATOR_TYPE:
     case JS_SET_VALUE_ITERATOR_TYPE:
-      JSSetIterator::cast(this)->JSSetIteratorPrint(os);
+      JSSetIterator::cast(this)->JSSetIteratorPrint(isolate, os);
       break;
     case JS_MAP_KEY_ITERATOR_TYPE:
     case JS_MAP_KEY_VALUE_ITERATOR_TYPE:
     case JS_MAP_VALUE_ITERATOR_TYPE:
-      JSMapIterator::cast(this)->JSMapIteratorPrint(os);
+      JSMapIterator::cast(this)->JSMapIteratorPrint(isolate, os);
       break;
     case JS_WEAK_MAP_TYPE:
-      JSWeakMap::cast(this)->JSWeakMapPrint(os);
+      JSWeakMap::cast(this)->JSWeakMapPrint(isolate, os);
       break;
     case JS_WEAK_SET_TYPE:
-      JSWeakSet::cast(this)->JSWeakSetPrint(os);
+      JSWeakSet::cast(this)->JSWeakSetPrint(isolate, os);
       break;
     case JS_MODULE_NAMESPACE_TYPE:
-      JSModuleNamespace::cast(this)->JSModuleNamespacePrint(os);
+      JSModuleNamespace::cast(this)->JSModuleNamespacePrint(isolate, os);
       break;
     case FOREIGN_TYPE:
       Foreign::cast(this)->ForeignPrint(os);
@@ -228,11 +265,19 @@ void HeapObject::HeapObjectPrint(std::ostream& os) {  // NOLINT
     case CALL_HANDLER_INFO_TYPE:
       CallHandlerInfo::cast(this)->CallHandlerInfoPrint(os);
       break;
+    case UNCOMPILED_DATA_WITHOUT_PRE_PARSED_SCOPE_TYPE:
+      UncompiledDataWithoutPreParsedScope::cast(this)
+          ->UncompiledDataWithoutPreParsedScopePrint(os);
+      break;
+    case UNCOMPILED_DATA_WITH_PRE_PARSED_SCOPE_TYPE:
+      UncompiledDataWithPreParsedScope::cast(this)
+          ->UncompiledDataWithPreParsedScopePrint(os);
+      break;
     case SHARED_FUNCTION_INFO_TYPE:
       SharedFunctionInfo::cast(this)->SharedFunctionInfoPrint(os);
       break;
     case JS_MESSAGE_OBJECT_TYPE:
-      JSMessageObject::cast(this)->JSMessageObjectPrint(os);
+      JSMessageObject::cast(this)->JSMessageObjectPrint(isolate, os);
       break;
     case CELL_TYPE:
       Cell::cast(this)->CellPrint(os);
@@ -244,17 +289,25 @@ void HeapObject::HeapObjectPrint(std::ostream& os) {  // NOLINT
       WeakCell::cast(this)->WeakCellPrint(os);
       break;
     case JS_ARRAY_BUFFER_TYPE:
-      JSArrayBuffer::cast(this)->JSArrayBufferPrint(os);
+      JSArrayBuffer::cast(this)->JSArrayBufferPrint(isolate, os);
       break;
     case JS_ARRAY_ITERATOR_TYPE:
-      JSArrayIterator::cast(this)->JSArrayIteratorPrint(os);
+      JSArrayIterator::cast(this)->JSArrayIteratorPrint(isolate, os);
       break;
     case JS_TYPED_ARRAY_TYPE:
-      JSTypedArray::cast(this)->JSTypedArrayPrint(os);
+      JSTypedArray::cast(this)->JSTypedArrayPrint(isolate, os);
       break;
     case JS_DATA_VIEW_TYPE:
-      JSDataView::cast(this)->JSDataViewPrint(os);
+      JSDataView::cast(this)->JSDataViewPrint(isolate, os);
       break;
+#ifdef V8_INTL_SUPPORT
+    case JS_INTL_LOCALE_TYPE:
+      JSLocale::cast(this)->JSLocalePrint(os);
+      break;
+    case JS_INTL_RELATIVE_TIME_FORMAT_TYPE:
+      JSRelativeTimeFormat::cast(this)->JSRelativeTimeFormatPrint(isolate, os);
+      break;
+#endif  // V8_INTL_SUPPORT
 #define MAKE_STRUCT_CASE(NAME, Name, name) \
   case NAME##_TYPE:                        \
     Name::cast(this)->Name##Print(os);     \
@@ -262,6 +315,9 @@ void HeapObject::HeapObjectPrint(std::ostream& os) {  // NOLINT
   STRUCT_LIST(MAKE_STRUCT_CASE)
 #undef MAKE_STRUCT_CASE
 
+    case ALLOCATION_SITE_TYPE:
+      AllocationSite::cast(this)->AllocationSitePrint(os);
+      break;
     case LOAD_HANDLER_TYPE:
       LoadHandler::cast(this)->LoadHandlerPrint(os);
       break;
@@ -277,6 +333,9 @@ void HeapObject::HeapObjectPrint(std::ostream& os) {  // NOLINT
     case WEAK_FIXED_ARRAY_TYPE:
       WeakFixedArray::cast(this)->WeakFixedArrayPrint(os);
       break;
+    case WEAK_ARRAY_LIST_TYPE:
+      WeakArrayList::cast(this)->WeakArrayListPrint(os);
+      break;
     case INTERNALIZED_STRING_TYPE:
     case EXTERNAL_INTERNALIZED_STRING_TYPE:
     case ONE_BYTE_INTERNALIZED_STRING_TYPE:
@@ -314,10 +373,10 @@ void ByteArray::ByteArrayPrint(std::ostream& os) {  // NOLINT
   os << "byte array, data starts at " << GetDataStartAddress();
 }
 
-
-void BytecodeArray::BytecodeArrayPrint(std::ostream& os) {  // NOLINT
+void BytecodeArray::BytecodeArrayPrint(Isolate* isolate,
+                                       std::ostream& os) {  // NOLINT
   HeapObject::PrintHeader(os, "BytecodeArray");
-  Disassemble(os);
+  Disassemble(isolate, os);
 }
 
 
@@ -353,7 +412,7 @@ bool JSObject::PrintProperties(std::ostream& os) {  // NOLINT
           break;
         }
         case kDescriptor:
-          os << Brief(descs->GetValue(i));
+          os << Brief(descs->GetStrongValue(i));
           break;
       }
       os << " ";
@@ -464,7 +523,6 @@ void PrintDictionaryElements(std::ostream& os, FixedArrayBase* elements) {
 
 void PrintSloppyArgumentElements(std::ostream& os, ElementsKind kind,
                                  SloppyArgumentsElements* elements) {
-  Isolate* isolate = elements->GetIsolate();
   FixedArray* arguments_store = elements->arguments();
   os << "\n    0: context: " << Brief(elements->context())
      << "\n    1: arguments_store: " << Brief(arguments_store)
@@ -474,7 +532,7 @@ void PrintSloppyArgumentElements(std::ostream& os, ElementsKind kind,
     Object* mapped_entry = elements->get_mapped_entry(i);
     os << "\n    " << raw_index << ": param(" << i
        << "): " << Brief(mapped_entry);
-    if (mapped_entry->IsTheHole(isolate)) {
+    if (mapped_entry->IsTheHole()) {
       os << " in the arguments_store[" << i << "]";
     } else {
       os << " in the context";
@@ -540,8 +598,8 @@ void JSObject::PrintElements(std::ostream& os) {  // NOLINT
   os << "\n }\n";
 }
 
-
-static void JSObjectPrintHeader(std::ostream& os, JSObject* obj,
+static void JSObjectPrintHeader(Isolate* isolate, std::ostream& os,
+                                JSObject* obj,
                                 const char* id) {  // NOLINT
   obj->PrintHeader(os, id);
   // Don't call GetElementsKind, its validation code can cause the printer to
@@ -552,7 +610,7 @@ static void JSObjectPrintHeader(std::ostream& os, JSObject* obj,
   } else {
     os << "DictionaryProperties";
   }
-  PrototypeIterator iter(obj->GetIsolate(), obj);
+  PrototypeIterator iter(isolate, obj);
   os << "]\n - prototype: " << Brief(iter.GetCurrent());
   os << "\n - elements: " << Brief(obj->elements()) << " ["
      << ElementsKindToString(obj->map()->elements_kind());
@@ -567,8 +625,8 @@ static void JSObjectPrintHeader(std::ostream& os, JSObject* obj,
   }
 }
 
-
-static void JSObjectPrintBody(std::ostream& os, JSObject* obj,  // NOLINT
+static void JSObjectPrintBody(std::ostream& os,
+                              JSObject* obj,  // NOLINT
                               bool print_elements = true) {
   os << "\n - properties: ";
   Object* properties_or_hash = obj->raw_properties_or_hash();
@@ -591,20 +649,70 @@ static void JSObjectPrintBody(std::ostream& os, JSObject* obj,  // NOLINT
   }
 }
 
-
-void JSObject::JSObjectPrint(std::ostream& os) {  // NOLINT
-  JSObjectPrintHeader(os, this, nullptr);
+void JSObject::JSObjectPrint(Isolate* isolate, std::ostream& os) {  // NOLINT
+  JSObjectPrintHeader(isolate, os, this, nullptr);
   JSObjectPrintBody(os, this);
 }
 
-void JSArray::JSArrayPrint(std::ostream& os) {  // NOLINT
-  JSObjectPrintHeader(os, this, "JSArray");
+void JSGeneratorObject::JSGeneratorObjectPrint(Isolate* isolate,
+                                               std::ostream& os) {  // NOLINT
+  JSObjectPrintHeader(isolate, os, this, "JSGeneratorObject");
+  os << "\n - function: " << Brief(function());
+  os << "\n - context: " << Brief(context());
+  os << "\n - receiver: " << Brief(receiver());
+  if (is_executing() || is_closed()) {
+    os << "\n - input: " << Brief(input_or_debug_pos());
+  } else {
+    DCHECK(is_suspended());
+    os << "\n - debug pos: " << Brief(input_or_debug_pos());
+  }
+  const char* mode = "(invalid)";
+  switch (resume_mode()) {
+    case kNext:
+      mode = ".next()";
+      break;
+    case kReturn:
+      mode = ".return()";
+      break;
+    case kThrow:
+      mode = ".throw()";
+      break;
+  }
+  os << "\n - resume mode: " << mode;
+  os << "\n - continuation: " << continuation();
+  if (is_closed()) os << " (closed)";
+  if (is_executing()) os << " (executing)";
+  if (is_suspended()) os << " (suspended)";
+  if (is_suspended()) {
+    DisallowHeapAllocation no_gc;
+    SharedFunctionInfo* fun_info = function()->shared();
+    if (fun_info->HasSourceCode()) {
+      Script* script = Script::cast(fun_info->script());
+      int lin = script->GetLineNumber(source_position()) + 1;
+      int col = script->GetColumnNumber(source_position()) + 1;
+      String* script_name = script->name()->IsString()
+                                ? String::cast(script->name())
+                                : ReadOnlyRoots(isolate).empty_string();
+      os << "\n - source position: " << source_position();
+      os << " (";
+      script_name->PrintUC16(os);
+      os << ", lin " << lin;
+      os << ", col " << col;
+      os << ")";
+    }
+  }
+  os << "\n - register file: " << Brief(parameters_and_registers());
+  os << "\n";
+}
+
+void JSArray::JSArrayPrint(Isolate* isolate, std::ostream& os) {  // NOLINT
+  JSObjectPrintHeader(isolate, os, this, "JSArray");
   os << "\n - length: " << Brief(this->length());
   JSObjectPrintBody(os, this);
 }
 
-void JSPromise::JSPromisePrint(std::ostream& os) {  // NOLINT
-  JSObjectPrintHeader(os, this, "JSPromise");
+void JSPromise::JSPromisePrint(Isolate* isolate, std::ostream& os) {  // NOLINT
+  JSObjectPrintHeader(isolate, os, this, "JSPromise");
   os << "\n - status: " << JSPromise::Status(status());
   if (status() == Promise::kPending) {
     os << "\n - reactions: " << Brief(reactions());
@@ -615,16 +723,17 @@ void JSPromise::JSPromisePrint(std::ostream& os) {  // NOLINT
   os << "\n ";
 }
 
-void JSRegExp::JSRegExpPrint(std::ostream& os) {  // NOLINT
-  JSObjectPrintHeader(os, this, "JSRegExp");
+void JSRegExp::JSRegExpPrint(Isolate* isolate, std::ostream& os) {  // NOLINT
+  JSObjectPrintHeader(isolate, os, this, "JSRegExp");
   os << "\n - data: " << Brief(data());
   os << "\n - source: " << Brief(source());
   JSObjectPrintBody(os, this);
 }
 
 void JSRegExpStringIterator::JSRegExpStringIteratorPrint(
+    Isolate* isolate,
     std::ostream& os) {  // NOLINT
-  JSObjectPrintHeader(os, this, "JSRegExpStringIterator");
+  JSObjectPrintHeader(isolate, os, this, "JSRegExpStringIterator");
   os << "\n - regex: " << Brief(iterating_regexp());
   os << "\n - string: " << Brief(iterating_string());
   os << "\n - done: " << done();
@@ -633,19 +742,18 @@ void JSRegExpStringIterator::JSRegExpStringIteratorPrint(
   JSObjectPrintBody(os, this);
 }
 
-void Symbol::SymbolPrint(std::ostream& os) {  // NOLINT
+void Symbol::SymbolPrint(Isolate* isolate, std::ostream& os) {  // NOLINT
   HeapObject::PrintHeader(os, "Symbol");
   os << "\n - hash: " << Hash();
   os << "\n - name: " << Brief(name());
-  if (name()->IsUndefined(GetIsolate())) {
-    os << " (" << PrivateSymbolToName() << ")";
+  if (name()->IsUndefined(isolate)) {
+    os << " (" << PrivateSymbolToName(isolate) << ")";
   }
   os << "\n - private: " << is_private();
   os << "\n";
 }
 
-
-void Map::MapPrint(std::ostream& os) {  // NOLINT
+void Map::MapPrint(Isolate* isolate, std::ostream& os) {  // NOLINT
   HeapObject::PrintHeader(os, "Map");
   os << "\n - type: " << instance_type();
   os << "\n - instance size: ";
@@ -698,7 +806,7 @@ void Map::MapPrint(std::ostream& os) {  // NOLINT
   }
   {
     DisallowHeapAllocation no_gc;
-    TransitionsAccessor transitions(this, &no_gc);
+    TransitionsAccessor transitions(isolate, this, &no_gc);
     int nof_transitions = transitions.NumberOfTransitions();
     if (nof_transitions > 0) {
       os << "\n - transitions #" << nof_transitions << ": ";
@@ -719,6 +827,21 @@ void Map::MapPrint(std::ostream& os) {  // NOLINT
   os << "\n";
 }
 
+void DescriptorArray::DescriptorArrayPrint(std::ostream& os) {
+  HeapObject::PrintHeader(os, "DescriptorArray");
+  os << "\n - capacity: " << length();
+  EnumCache* enum_cache = GetEnumCache();
+  os << "\n - enum_cache: ";
+  if (enum_cache->keys()->length() == 0) {
+    os << "empty";
+  } else {
+    os << enum_cache->keys()->length();
+    os << "\n   - keys: " << Brief(enum_cache->keys());
+    os << "\n   - indices: " << Brief(enum_cache->indices());
+  }
+  os << "\n - nof descriptors: " << number_of_descriptors();
+  PrintDescriptors(os);
+}
 
 void AliasedArgumentsEntry::AliasedArgumentsEntryPrint(
     std::ostream& os) {  // NOLINT
@@ -735,7 +858,25 @@ void PrintFixedArrayWithHeader(std::ostream& os, FixedArray* array,
   os << "\n";
 }
 
-void PrintWeakFixedArrayElements(std::ostream& os, WeakFixedArray* array) {
+template <typename T>
+void PrintHashTableWithHeader(std::ostream& os, T* table, const char* type) {
+  table->PrintHeader(os, type);
+  os << "\n - length: " << table->length();
+  os << "\n - elements: " << table->NumberOfElements();
+  os << "\n - deleted: " << table->NumberOfDeletedElements();
+  os << "\n - capacity: " << table->Capacity();
+
+  os << "\n - elements: {";
+  for (int i = 0; i < table->Capacity(); i++) {
+    os << '\n'
+       << std::setw(12) << i << ": " << Brief(table->KeyAt(i)) << " -> "
+       << Brief(table->ValueAt(i));
+  }
+  os << "\n }\n";
+}
+
+template <typename T>
+void PrintWeakArrayElements(std::ostream& os, T* array) {
   // Print in array notation for non-sparse arrays.
   MaybeObject* previous_value = array->length() > 0 ? array->Get(0) : nullptr;
   MaybeObject* value = nullptr;
@@ -758,22 +899,27 @@ void PrintWeakFixedArrayElements(std::ostream& os, WeakFixedArray* array) {
   }
 }
 
-void PrintWeakFixedArrayWithHeader(std::ostream& os, WeakFixedArray* array) {
-  array->PrintHeader(os, "WeakFixedArray");
-  os << "\n - length: " << array->length() << "\n";
-  PrintWeakFixedArrayElements(os, array);
-  os << "\n";
-}
-
 }  // namespace
 
 void FixedArray::FixedArrayPrint(std::ostream& os) {  // NOLINT
-  PrintFixedArrayWithHeader(os, this,
-                            IsHashTable() ? "HashTable" : "FixedArray");
+  PrintFixedArrayWithHeader(os, this, "FixedArray");
+}
+
+void ObjectHashTable::ObjectHashTablePrint(std::ostream& os) {
+  PrintHashTableWithHeader(os, this, "ObjectHashTable");
+}
+
+void NumberDictionary::NumberDictionaryPrint(std::ostream& os) {
+  PrintHashTableWithHeader(os, this, "NumberDictionary");
 }
 
-void BoilerplateDescription::BoilerplateDescriptionPrint(std::ostream& os) {
-  PrintFixedArrayWithHeader(os, this, "BoilerplateDescription");
+void EphemeronHashTable::EphemeronHashTablePrint(std::ostream& os) {
+  PrintHashTableWithHeader(os, this, "EphemeronHashTable");
+}
+
+void ObjectBoilerplateDescription::ObjectBoilerplateDescriptionPrint(
+    std::ostream& os) {
+  PrintFixedArrayWithHeader(os, this, "ObjectBoilerplateDescription");
 }
 
 void PropertyArray::PropertyArrayPrint(std::ostream& os) {  // NOLINT
@@ -792,27 +938,35 @@ void FixedDoubleArray::FixedDoubleArrayPrint(std::ostream& os) {  // NOLINT
 }
 
 void WeakFixedArray::WeakFixedArrayPrint(std::ostream& os) {
-  PrintWeakFixedArrayWithHeader(os, this);
+  PrintHeader(os, "WeakFixedArray");
+  os << "\n - length: " << length() << "\n";
+  PrintWeakArrayElements(os, this);
+  os << "\n";
 }
 
-void TransitionArray::TransitionArrayPrint(std::ostream& os) {  // NOLINT
-  HeapObject::PrintHeader(os, "TransitionArray");
-  os << "\n - capacity: " << length();
-  for (int i = 0; i < length(); i++) {
-    os << "\n  [" << i << "]: " << Brief(get(i));
-    if (i == kPrototypeTransitionsIndex) os << " (prototype transitions)";
-    if (i == kTransitionLengthIndex) os << " (number of transitions)";
-  }
+void WeakArrayList::WeakArrayListPrint(std::ostream& os) {
+  PrintHeader(os, "WeakArrayList");
+  os << "\n - capacity: " << capacity();
+  os << "\n - length: " << length() << "\n";
+  PrintWeakArrayElements(os, this);
   os << "\n";
 }
 
-void FeedbackCell::FeedbackCellPrint(std::ostream& os) {  // NOLINT
+void TransitionArray::TransitionArrayPrint(Isolate* isolate,
+                                           std::ostream& os) {  // NOLINT
+  HeapObject::PrintHeader(os, "TransitionArray");
+  PrintInternal(isolate, os);
+}
+
+void FeedbackCell::FeedbackCellPrint(Isolate* isolate,
+                                     std::ostream& os) {  // NOLINT
   HeapObject::PrintHeader(os, "FeedbackCell");
-  if (map() == GetHeap()->no_closures_cell_map()) {
+  Heap* heap = isolate->heap();
+  if (map() == ReadOnlyRoots(heap).no_closures_cell_map()) {
     os << "\n - no closures";
-  } else if (map() == GetHeap()->one_closure_cell_map()) {
+  } else if (map() == ReadOnlyRoots(heap).one_closure_cell_map()) {
     os << "\n - one closure";
-  } else if (map() == GetHeap()->many_closures_cell_map()) {
+  } else if (map() == ReadOnlyRoots(heap).many_closures_cell_map()) {
     os << "\n - many closures";
   } else {
     os << "\n - Invalid FeedbackCell map";
@@ -822,7 +976,7 @@ void FeedbackCell::FeedbackCellPrint(std::ostream& os) {  // NOLINT
 }
 
 void FeedbackVectorSpec::Print() {
-  OFStream os(stdout);
+  StdoutStream os;
 
   FeedbackVectorSpecPrint(os);
 
@@ -847,12 +1001,6 @@ void FeedbackVectorSpec::FeedbackVectorSpecPrint(std::ostream& os) {  // NOLINT
   os << "\n";
 }
 
-void FeedbackMetadata::Print() {
-  OFStream os(stdout);
-  FeedbackMetadataPrint(os);
-  os << std::flush;
-}
-
 void FeedbackMetadata::FeedbackMetadataPrint(std::ostream& os) {
   HeapObject::PrintHeader(os, "FeedbackMetadata");
   os << "\n - slot_count: " << slot_count();
@@ -866,12 +1014,6 @@ void FeedbackMetadata::FeedbackMetadataPrint(std::ostream& os) {
   os << "\n";
 }
 
-void FeedbackVector::Print() {
-  OFStream os(stdout);
-  FeedbackVectorPrint(os);
-  os << std::flush;
-}
-
 void FeedbackVector::FeedbackVectorPrint(std::ostream& os) {  // NOLINT
   HeapObject::PrintHeader(os, "FeedbackVector");
   os << "\n - length: " << length();
@@ -902,7 +1044,7 @@ void FeedbackVector::FeedbackVectorPrint(std::ostream& os) {  // NOLINT
     if (entry_size > 0) os << " {";
     for (int i = 0; i < entry_size; i++) {
       int index = GetIndex(slot) + i;
-      os << "\n     [" << index << "]: " << Brief(get(index));
+      os << "\n     [" << index << "]: " << MaybeObjectBrief(get(index));
     }
     if (entry_size > 0) os << "\n  }";
   }
@@ -981,15 +1123,15 @@ void FeedbackNexus::Print(std::ostream& os) {  // NOLINT
   }
 }
 
-void JSValue::JSValuePrint(std::ostream& os) {  // NOLINT
-  JSObjectPrintHeader(os, this, "JSValue");
+void JSValue::JSValuePrint(Isolate* isolate, std::ostream& os) {  // NOLINT
+  JSObjectPrintHeader(isolate, os, this, "JSValue");
   os << "\n - value: " << Brief(value());
   JSObjectPrintBody(os, this);
 }
 
-
-void JSMessageObject::JSMessageObjectPrint(std::ostream& os) {  // NOLINT
-  JSObjectPrintHeader(os, this, "JSMessageObject");
+void JSMessageObject::JSMessageObjectPrint(Isolate* isolate,
+                                           std::ostream& os) {  // NOLINT
+  JSObjectPrintHeader(isolate, os, this, "JSMessageObject");
   os << "\n - type: " << type();
   os << "\n - arguments: " << Brief(argument());
   os << "\n - start_position: " << start_position();
@@ -1045,9 +1187,8 @@ static const char* const weekdays[] = {
   "???", "Sun", "Mon", "Tue", "Wed", "Thu", "Fri", "Sat"
 };
 
-
-void JSDate::JSDatePrint(std::ostream& os) {  // NOLINT
-  JSObjectPrintHeader(os, this, "JSDate");
+void JSDate::JSDatePrint(Isolate* isolate, std::ostream& os) {  // NOLINT
+  JSObjectPrintHeader(isolate, os, this, "JSDate");
   os << "\n - value: " << Brief(value());
   if (!year()->IsSmi()) {
     os << "\n - time = NaN\n";
@@ -1077,16 +1218,14 @@ void JSProxy::JSProxyPrint(std::ostream& os) {  // NOLINT
   os << "\n";
 }
 
-
-void JSSet::JSSetPrint(std::ostream& os) {  // NOLINT
-  JSObjectPrintHeader(os, this, "JSSet");
+void JSSet::JSSetPrint(Isolate* isolate, std::ostream& os) {  // NOLINT
+  JSObjectPrintHeader(isolate, os, this, "JSSet");
   os << " - table: " << Brief(table());
   JSObjectPrintBody(os, this);
 }
 
-
-void JSMap::JSMapPrint(std::ostream& os) {  // NOLINT
-  JSObjectPrintHeader(os, this, "JSMap");
+void JSMap::JSMapPrint(Isolate* isolate, std::ostream& os) {  // NOLINT
+  JSObjectPrintHeader(isolate, os, this, "JSMap");
   os << " - table: " << Brief(table());
   JSObjectPrintBody(os, this);
 }
@@ -1098,34 +1237,33 @@ void JSCollectionIterator::JSCollectionIteratorPrint(
   os << "\n";
 }
 
-void JSSetIterator::JSSetIteratorPrint(std::ostream& os) {  // NOLINT
-  JSObjectPrintHeader(os, this, "JSSetIterator");
+void JSSetIterator::JSSetIteratorPrint(Isolate* isolate,
+                                       std::ostream& os) {  // NOLINT
+  JSObjectPrintHeader(isolate, os, this, "JSSetIterator");
   JSCollectionIteratorPrint(os);
 }
 
-
-void JSMapIterator::JSMapIteratorPrint(std::ostream& os) {  // NOLINT
-  JSObjectPrintHeader(os, this, "JSMapIterator");
+void JSMapIterator::JSMapIteratorPrint(Isolate* isolate,
+                                       std::ostream& os) {  // NOLINT
+  JSObjectPrintHeader(isolate, os, this, "JSMapIterator");
   JSCollectionIteratorPrint(os);
 }
 
-
-void JSWeakMap::JSWeakMapPrint(std::ostream& os) {  // NOLINT
-  JSObjectPrintHeader(os, this, "JSWeakMap");
+void JSWeakMap::JSWeakMapPrint(Isolate* isolate, std::ostream& os) {  // NOLINT
+  JSObjectPrintHeader(isolate, os, this, "JSWeakMap");
   os << "\n - table: " << Brief(table());
   JSObjectPrintBody(os, this);
 }
 
-
-void JSWeakSet::JSWeakSetPrint(std::ostream& os) {  // NOLINT
-  JSObjectPrintHeader(os, this, "JSWeakSet");
+void JSWeakSet::JSWeakSetPrint(Isolate* isolate, std::ostream& os) {  // NOLINT
+  JSObjectPrintHeader(isolate, os, this, "JSWeakSet");
   os << "\n - table: " << Brief(table());
   JSObjectPrintBody(os, this);
 }
 
-
-void JSArrayBuffer::JSArrayBufferPrint(std::ostream& os) {  // NOLINT
-  JSObjectPrintHeader(os, this, "JSArrayBuffer");
+void JSArrayBuffer::JSArrayBufferPrint(Isolate* isolate,
+                                       std::ostream& os) {  // NOLINT
+  JSObjectPrintHeader(isolate, os, this, "JSArrayBuffer");
   os << "\n - backing_store: " << backing_store();
   os << "\n - byte_length: " << Brief(byte_length());
   if (is_external()) os << "\n - external";
@@ -1137,9 +1275,9 @@ void JSArrayBuffer::JSArrayBufferPrint(std::ostream& os) {  // NOLINT
   JSObjectPrintBody(os, this, !was_neutered());
 }
 
-
-void JSTypedArray::JSTypedArrayPrint(std::ostream& os) {  // NOLINT
-  JSObjectPrintHeader(os, this, "JSTypedArray");
+void JSTypedArray::JSTypedArrayPrint(Isolate* isolate,
+                                     std::ostream& os) {  // NOLINT
+  JSObjectPrintHeader(isolate, os, this, "JSTypedArray");
   os << "\n - buffer: " << Brief(buffer());
   os << "\n - byte_offset: " << Brief(byte_offset());
   os << "\n - byte_length: " << Brief(byte_length());
@@ -1148,16 +1286,18 @@ void JSTypedArray::JSTypedArrayPrint(std::ostream& os) {  // NOLINT
   JSObjectPrintBody(os, this, !WasNeutered());
 }
 
-void JSArrayIterator::JSArrayIteratorPrint(std::ostream& os) {  // NOLING
-  JSObjectPrintHeader(os, this, "JSArrayIterator");
+void JSArrayIterator::JSArrayIteratorPrint(Isolate* isolate,
+                                           std::ostream& os) {  // NOLING
+  JSObjectPrintHeader(isolate, os, this, "JSArrayIterator");
   os << "\n - iterated_object: " << Brief(iterated_object());
   os << "\n - next_index: " << Brief(next_index());
   os << "\n - kind: " << kind();
   JSObjectPrintBody(os, this);
 }
 
-void JSDataView::JSDataViewPrint(std::ostream& os) {  // NOLINT
-  JSObjectPrintHeader(os, this, "JSDataView");
+void JSDataView::JSDataViewPrint(Isolate* isolate,
+                                 std::ostream& os) {  // NOLINT
+  JSObjectPrintHeader(isolate, os, this, "JSDataView");
   os << "\n - buffer =" << Brief(buffer());
   os << "\n - byte_offset: " << Brief(byte_offset());
   os << "\n - byte_length: " << Brief(byte_length());
@@ -1165,17 +1305,18 @@ void JSDataView::JSDataViewPrint(std::ostream& os) {  // NOLINT
   JSObjectPrintBody(os, this, !WasNeutered());
 }
 
-
-void JSBoundFunction::JSBoundFunctionPrint(std::ostream& os) {  // NOLINT
-  JSObjectPrintHeader(os, this, "JSBoundFunction");
+void JSBoundFunction::JSBoundFunctionPrint(Isolate* isolate,
+                                           std::ostream& os) {  // NOLINT
+  JSObjectPrintHeader(isolate, os, this, "JSBoundFunction");
   os << "\n - bound_target_function: " << Brief(bound_target_function());
   os << "\n - bound_this: " << Brief(bound_this());
   os << "\n - bound_arguments: " << Brief(bound_arguments());
   JSObjectPrintBody(os, this);
 }
 
-void JSFunction::JSFunctionPrint(std::ostream& os) {  // NOLINT
-  JSObjectPrintHeader(os, this, "Function");
+void JSFunction::JSFunctionPrint(Isolate* isolate,
+                                 std::ostream& os) {  // NOLINT
+  JSObjectPrintHeader(isolate, os, this, "Function");
   os << "\n - function prototype: ";
   if (has_prototype_slot()) {
     if (has_prototype()) {
@@ -1198,11 +1339,11 @@ void JSFunction::JSFunctionPrint(std::ostream& os) {  // NOLINT
     if (builtin_index == Builtins::kDeserializeLazy) {
       if (shared()->HasBuiltinId()) {
         builtin_index = shared()->builtin_id();
-        os << "\n - builtin: " << GetIsolate()->builtins()->name(builtin_index)
+        os << "\n - builtin: " << isolate->builtins()->name(builtin_index)
            << "(lazy)";
       }
     } else {
-      os << "\n - builtin: " << GetIsolate()->builtins()->name(builtin_index);
+      os << "\n - builtin: " << isolate->builtins()->name(builtin_index);
     }
   }
 
@@ -1226,7 +1367,9 @@ void JSFunction::JSFunctionPrint(std::ostream& os) {  // NOLINT
   shared()->PrintSourceCode(os);
   JSObjectPrintBody(os, this);
   os << "\n - feedback vector: ";
-  if (has_feedback_vector()) {
+  if (!shared()->HasFeedbackMetadata()) {
+    os << "feedback metadata is not available in SFI\n";
+  } else if (has_feedback_vector()) {
     feedback_vector()->FeedbackVectorPrint(os);
   } else {
     os << "not available\n";
@@ -1281,7 +1424,7 @@ void SharedFunctionInfo::SharedFunctionInfoPrint(std::ostream& os) {  // NOLINT
   os << "\n - start position: " << StartPosition();
   os << "\n - end position: " << EndPosition();
   if (HasDebugInfo()) {
-    os << "\n - debug info: " << Brief(debug_info());
+    os << "\n - debug info: " << Brief(GetDebugInfo());
   } else {
     os << "\n - no debug info";
   }
@@ -1299,33 +1442,31 @@ void SharedFunctionInfo::SharedFunctionInfoPrint(std::ostream& os) {  // NOLINT
   os << "\n";
 }
 
-
-void JSGlobalProxy::JSGlobalProxyPrint(std::ostream& os) {  // NOLINT
-  JSObjectPrintHeader(os, this, "JSGlobalProxy");
-  if (!GetIsolate()->bootstrapper()->IsActive()) {
+void JSGlobalProxy::JSGlobalProxyPrint(Isolate* isolate,
+                                       std::ostream& os) {  // NOLINT
+  JSObjectPrintHeader(isolate, os, this, "JSGlobalProxy");
+  if (!isolate->bootstrapper()->IsActive()) {
     os << "\n - native context: " << Brief(native_context());
   }
   JSObjectPrintBody(os, this);
 }
 
-
-void JSGlobalObject::JSGlobalObjectPrint(std::ostream& os) {  // NOLINT
-  JSObjectPrintHeader(os, this, "JSGlobalObject");
-  if (!GetIsolate()->bootstrapper()->IsActive()) {
+void JSGlobalObject::JSGlobalObjectPrint(Isolate* isolate,
+                                         std::ostream& os) {  // NOLINT
+  JSObjectPrintHeader(isolate, os, this, "JSGlobalObject");
+  if (!isolate->bootstrapper()->IsActive()) {
     os << "\n - native context: " << Brief(native_context());
   }
   os << "\n - global proxy: " << Brief(global_proxy());
   JSObjectPrintBody(os, this);
 }
 
-
 void Cell::CellPrint(std::ostream& os) {  // NOLINT
   HeapObject::PrintHeader(os, "Cell");
   os << "\n - value: " << Brief(value());
   os << "\n";
 }
 
-
 void PropertyCell::PropertyCellPrint(std::ostream& os) {  // NOLINT
   HeapObject::PrintHeader(os, "PropertyCell");
   os << "\n - name: ";
@@ -1335,7 +1476,7 @@ void PropertyCell::PropertyCellPrint(std::ostream& os) {  // NOLINT
   property_details().PrintAsSlowTo(os);
   PropertyCellType cell_type = property_details().cell_type();
   os << "\n - cell_type: ";
-  if (value()->IsTheHole(GetIsolate())) {
+  if (value()->IsTheHole()) {
     switch (cell_type) {
       case PropertyCellType::kUninitialized:
         os << "Uninitialized";
@@ -1528,8 +1669,9 @@ void Module::ModulePrint(std::ostream& os) {  // NOLINT
   os << "\n";
 }
 
-void JSModuleNamespace::JSModuleNamespacePrint(std::ostream& os) {  // NOLINT
-  JSObjectPrintHeader(os, this, "JSModuleNamespace");
+void JSModuleNamespace::JSModuleNamespacePrint(Isolate* isolate,
+                                               std::ostream& os) {  // NOLINT
+  JSObjectPrintHeader(isolate, os, this, "JSModuleNamespace");
   os << "\n - module: " << Brief(module());
   JSObjectPrintBody(os, this);
 }
@@ -1539,7 +1681,7 @@ void PrototypeInfo::PrototypeInfoPrint(std::ostream& os) {  // NOLINT
   os << "\n - weak cell: " << Brief(weak_cell());
   os << "\n - prototype users: " << Brief(prototype_users());
   os << "\n - registry slot: " << registry_slot();
-  os << "\n - object create map: " << Brief(object_create_map());
+  os << "\n - object create map: " << MaybeObjectBrief(object_create_map());
   os << "\n - should_be_fast_map: " << should_be_fast_map();
   os << "\n";
 }
@@ -1559,9 +1701,11 @@ void Tuple3::Tuple3Print(std::ostream& os) {  // NOLINT
   os << "\n";
 }
 
-void WasmCompiledModule::WasmCompiledModulePrint(std::ostream& os) {  // NOLINT
-  HeapObject::PrintHeader(os, "WasmCompiledModule");
-  os << "\n - shared: " << Brief(shared());
+void ArrayBoilerplateDescription::ArrayBoilerplateDescriptionPrint(
+    std::ostream& os) {  // NOLINT
+  HeapObject::PrintHeader(os, "ArrayBoilerplateDescription");
+  os << "\n - elements kind: " << elements_kind();
+  os << "\n - constant elements: " << Brief(constant_elements());
   os << "\n";
 }
 
@@ -1571,10 +1715,74 @@ void WasmDebugInfo::WasmDebugInfoPrint(std::ostream& os) {  // NOLINT
   os << "\n";
 }
 
-void WasmSharedModuleData::WasmSharedModuleDataPrint(
+void WasmInstanceObject::WasmInstanceObjectPrint(std::ostream& os) {  // NOLINT
+  HeapObject::PrintHeader(os, "WasmInstanceObject");
+  os << "\n - module_object: " << Brief(module_object());
+  os << "\n - exports_object: " << Brief(exports_object());
+  os << "\n - native_context: " << Brief(native_context());
+  if (has_memory_object()) {
+    os << "\n - memory_object: " << Brief(memory_object());
+  }
+  if (has_globals_buffer()) {
+    os << "\n - globals_buffer: " << Brief(globals_buffer());
+  }
+  if (has_imported_mutable_globals_buffers()) {
+    os << "\n - imported_mutable_globals_buffers: "
+       << Brief(imported_mutable_globals_buffers());
+  }
+  if (has_debug_info()) {
+    os << "\n - debug_info: " << Brief(debug_info());
+  }
+  if (has_table_object()) {
+    os << "\n - table_object: " << Brief(table_object());
+  }
+  os << "\n - imported_function_instances: "
+     << Brief(imported_function_instances());
+  os << "\n - imported_function_callables: "
+     << Brief(imported_function_callables());
+  if (has_indirect_function_table_instances()) {
+    os << "\n - indirect_function_table_instances: "
+       << Brief(indirect_function_table_instances());
+  }
+  if (has_managed_native_allocations()) {
+    os << "\n - managed_native_allocations: "
+       << Brief(managed_native_allocations());
+  }
+  os << "\n - memory_start: " << static_cast<void*>(memory_start());
+  os << "\n - memory_size: " << memory_size();
+  os << "\n - memory_mask: " << AsHex(memory_mask());
+  os << "\n - imported_function_targets: "
+     << static_cast<void*>(imported_function_targets());
+  os << "\n - globals_start: " << static_cast<void*>(globals_start());
+  os << "\n - imported_mutable_globals: "
+     << static_cast<void*>(imported_mutable_globals());
+  os << "\n - indirect_function_table_size: " << indirect_function_table_size();
+  os << "\n - indirect_function_table_sig_ids: "
+     << static_cast<void*>(indirect_function_table_sig_ids());
+  os << "\n - indirect_function_table_targets: "
+     << static_cast<void*>(indirect_function_table_targets());
+  os << "\n";
+}
+
+void WasmExportedFunctionData::WasmExportedFunctionDataPrint(
     std::ostream& os) {  // NOLINT
-  HeapObject::PrintHeader(os, "WasmSharedModuleData");
+  HeapObject::PrintHeader(os, "WasmExportedFunctionData");
+  os << "\n - wrapper_code: " << Brief(wrapper_code());
+  os << "\n - instance: " << Brief(instance());
+  os << "\n - function_index: " << function_index();
+  os << "\n";
+}
+
+void WasmModuleObject::WasmModuleObjectPrint(Isolate* isolate,
+                                             std::ostream& os) {  // NOLINT
+  JSObjectPrintHeader(isolate, os, this, "WasmModuleObject");
+  JSObjectPrintBody(os, this);
   os << "\n - module: " << module();
+  os << "\n - native module: " << native_module();
+  os << "\n - export wrappers: " << Brief(export_wrappers());
+  os << "\n - script: " << Brief(script());
+  os << "\n - asm_js_offset_table: " << Brief(asm_js_offset_table());
+  os << "\n - breakpoint_infos: " << Brief(breakpoint_infos());
   os << "\n";
 }
 
@@ -1585,7 +1793,7 @@ void LoadHandler::LoadHandlerPrint(std::ostream& os) {  // NOLINT
   os << "\n - validity_cell: " << Brief(validity_cell());
   int data_count = data_field_count();
   if (data_count >= 1) {
-    os << "\n - data1: " << Brief(data1());
+    os << "\n - data1: " << MaybeObjectBrief(data1());
   }
   if (data_count >= 2) {
     os << "\n - data2: " << Brief(data2());
@@ -1603,7 +1811,7 @@ void StoreHandler::StoreHandlerPrint(std::ostream& os) {  // NOLINT
   os << "\n - validity_cell: " << Brief(validity_cell());
   int data_count = data_field_count();
   if (data_count >= 1) {
-    os << "\n - data1: " << Brief(data1());
+    os << "\n - data1: " << MaybeObjectBrief(data1());
   }
   if (data_count >= 2) {
     os << "\n - data2: " << Brief(data2());
@@ -1614,13 +1822,6 @@ void StoreHandler::StoreHandlerPrint(std::ostream& os) {  // NOLINT
   os << "\n";
 }
 
-void ContextExtension::ContextExtensionPrint(std::ostream& os) {  // NOLINT
-  HeapObject::PrintHeader(os, "ContextExtension");
-  os << "\n - scope_info: " << Brief(scope_info());
-  os << "\n - extension: " << Brief(extension());
-  os << "\n";
-}
-
 void AccessorPair::AccessorPairPrint(std::ostream& os) {  // NOLINT
   HeapObject::PrintHeader(os, "AccessorPair");
   os << "\n - getter: " << Brief(getter());
@@ -1700,7 +1901,7 @@ void ObjectTemplateInfo::ObjectTemplateInfoPrint(std::ostream& os) {  // NOLINT
 
 void AllocationSite::AllocationSitePrint(std::ostream& os) {  // NOLINT
   HeapObject::PrintHeader(os, "AllocationSite");
-  os << "\n - weak_next: " << Brief(weak_next());
+  if (this->HasWeakNext()) os << "\n - weak_next: " << Brief(weak_next());
   os << "\n - dependent code: " << Brief(dependent_code());
   os << "\n - nested site: " << Brief(nested_site());
   os << "\n - memento found count: "
@@ -1726,7 +1927,7 @@ void AllocationMemento::AllocationMementoPrint(std::ostream& os) {  // NOLINT
   HeapObject::PrintHeader(os, "AllocationMemento");
   os << "\n - allocation site: ";
   if (IsValid()) {
-    GetAllocationSite()->Print(os);
+    GetAllocationSite()->AllocationSitePrint(os);
   } else {
     os << "<invalid>\n";
   }
@@ -1742,7 +1943,6 @@ void Script::ScriptPrint(std::ostream& os) {  // NOLINT
   os << "\n - type: " << type();
   os << "\n - id: " << id();
   os << "\n - context data: " << Brief(context_data());
-  os << "\n - wrapper: " << Brief(wrapper());
   os << "\n - compilation type: " << compilation_type();
   os << "\n - line ends: " << Brief(line_ends());
   if (has_eval_from_shared()) {
@@ -1756,6 +1956,35 @@ void Script::ScriptPrint(std::ostream& os) {  // NOLINT
   os << "\n";
 }
 
+#ifdef V8_INTL_SUPPORT
+void JSLocale::JSLocalePrint(std::ostream& os) {  // NOLINT
+  HeapObject::PrintHeader(os, "JSLocale");
+  os << "\n - language: " << Brief(language());
+  os << "\n - script: " << Brief(script());
+  os << "\n - region: " << Brief(region());
+  os << "\n - baseName: " << Brief(base_name());
+  os << "\n - locale: " << Brief(locale());
+  os << "\n - calendar: " << Brief(calendar());
+  os << "\n - caseFirst: " << Brief(case_first());
+  os << "\n - collation: " << Brief(collation());
+  os << "\n - hourCycle: " << Brief(hour_cycle());
+  os << "\n - numeric: " << Brief(numeric());
+  os << "\n - numberingSystem: " << Brief(numbering_system());
+  os << "\n";
+}
+
+void JSRelativeTimeFormat::JSRelativeTimeFormatPrint(
+    Isolate* isolate,
+    std::ostream& os) {  // NOLINT
+  JSObjectPrintHeader(isolate, os, this, "JSRelativeTimeFormat");
+  os << "\n - locale: " << Brief(locale());
+  os << "\n - style: " << StyleAsString(isolate);
+  os << "\n - numeric: " << NumericAsString(isolate);
+  os << "\n - formatter: " << Brief(formatter());
+  os << "\n";
+}
+#endif  // V8_INTL_SUPPORT
+
 namespace {
 void PrintScopeInfoList(ScopeInfo* scope_info, std::ostream& os,
                         const char* list_name, int nof_internal_slots,
@@ -1782,13 +2011,27 @@ void ScopeInfo::ScopeInfoPrint(std::ostream& os) {  // NOLINT
     os << "\n - length = 0\n";
     return;
   }
+  int flags = Flags();
+
+  os << "\n - parameters: " << ParameterCount();
+  os << "\n - context locals : " << ContextLocalCount();
 
   os << "\n - scope type: " << scope_type();
+  if (CallsSloppyEval()) os << "\n - sloppy eval";
   os << "\n - language mode: " << language_mode();
-  os << "\n - local count: " << LocalCount();
-  os << "\n - stack slot count: " << StackSlotCount();
-  if (HasReceiver()) os << "\n - has receiver";
+  if (is_declaration_scope()) os << "\n - declaration scope";
+  if (HasReceiver()) {
+    os << "\n - receiver: " << ReceiverVariableField::decode(flags);
+  }
   if (HasNewTarget()) os << "\n - needs new target";
+  if (HasFunctionName()) {
+    os << "\n - function name(" << FunctionVariableField::decode(flags)
+       << "): ";
+    FunctionName()->ShortPrint(os);
+  }
+  if (IsAsmModule()) os << "\n - asm module";
+  if (HasSimpleParameters()) os << "\n - simple parameters";
+  os << "\n - function kind: " << function_kind();
   if (HasOuterScopeInfo()) {
     os << "\n - outer scope info: " << Brief(OuterScopeInfo());
   }
@@ -1805,10 +2048,6 @@ void ScopeInfo::ScopeInfoPrint(std::ostream& os) {  // NOLINT
   }
   os << "\n - length: " << length();
   if (length() > 0) {
-    PrintScopeInfoList(this, os, "parameters", 0, ParameterNamesIndex(),
-                       ParameterCount());
-    PrintScopeInfoList(this, os, "stack slots", 0, StackLocalNamesIndex(),
-                       StackLocalCount());
     PrintScopeInfoList(this, os, "context slots", Context::MIN_CONTEXT_SLOTS,
                        ContextLocalNamesIndex(), ContextLocalCount());
     // TODO(neis): Print module stuff if present.
@@ -1821,9 +2060,10 @@ void DebugInfo::DebugInfoPrint(std::ostream& os) {  // NOLINT
   os << "\n - flags: " << flags();
   os << "\n - debugger_hints: " << debugger_hints();
   os << "\n - shared: " << Brief(shared());
-  os << "\n - debug bytecode array: " << Brief(debug_bytecode_array());
+  os << "\n - function_identifier: " << Brief(function_identifier());
+  os << "\n - original bytecode array: " << Brief(original_bytecode_array());
   os << "\n - break_points: ";
-  break_points()->Print(os);
+  break_points()->FixedArrayPrint(os);
   os << "\n - coverage_info: " << Brief(coverage_info());
 }
 
@@ -1850,9 +2090,8 @@ static void PrintBitMask(std::ostream& os, uint32_t value) {  // NOLINT
   }
 }
 
-
-void LayoutDescriptor::Print() {
-  OFStream os(stdout);
+void LayoutDescriptor::Print(Isolate* isolate) {
+  StdoutStream os;
   this->Print(os);
   os << std::flush;
 }
@@ -1872,8 +2111,7 @@ void LayoutDescriptor::Print(std::ostream& os) {  // NOLINT
   } else if (IsSmi()) {
     os << "fast";
     PrintBitMask(os, static_cast<uint32_t>(Smi::ToInt(this)));
-  } else if (IsOddball() &&
-             IsUninitialized(HeapObject::cast(this)->GetIsolate())) {
+  } else if (IsOddball() && IsUninitialized()) {
     os << "<uninitialized>";
   } else {
     os << "slow";
@@ -1893,6 +2131,23 @@ void PreParsedScopeData::PreParsedScopeDataPrint(std::ostream& os) {  // NOLINT
   os << "\n";
 }
 
+void UncompiledDataWithoutPreParsedScope::
+    UncompiledDataWithoutPreParsedScopePrint(std::ostream& os) {  // NOLINT
+  HeapObject::PrintHeader(os, "UncompiledDataWithoutPreParsedScope");
+  os << "\n - start position: " << start_position();
+  os << "\n - end position: " << end_position();
+  os << "\n";
+}
+
+void UncompiledDataWithPreParsedScope::UncompiledDataWithPreParsedScopePrint(
+    std::ostream& os) {  // NOLINT
+  HeapObject::PrintHeader(os, "UncompiledDataWithPreParsedScope");
+  os << "\n - start position: " << start_position();
+  os << "\n - end position: " << end_position();
+  os << "\n - pre_parsed_scope_data: " << Brief(pre_parsed_scope_data());
+  os << "\n";
+}
+
 void InterpreterData::InterpreterDataPrint(std::ostream& os) {  // NOLINT
   HeapObject::PrintHeader(os, "InterpreterData");
   os << "\n - bytecode_array: " << Brief(bytecode_array());
@@ -1900,17 +2155,46 @@ void InterpreterData::InterpreterDataPrint(std::ostream& os) {  // NOLINT
   os << "\n";
 }
 
+void MaybeObject::Print(Isolate* isolate) {
+  StdoutStream os;
+  this->Print(isolate, os);
+  os << std::flush;
+}
+
+void MaybeObject::Print(Isolate* isolate, std::ostream& os) {
+  Smi* smi;
+  HeapObject* heap_object;
+  if (ToSmi(&smi)) {
+    smi->SmiPrint(os);
+  } else if (IsClearedWeakHeapObject()) {
+    os << "[cleared]";
+  } else if (ToWeakHeapObject(&heap_object)) {
+    os << "[weak] ";
+    heap_object->HeapObjectPrint(isolate, os);
+  } else if (ToStrongHeapObject(&heap_object)) {
+    heap_object->HeapObjectPrint(isolate, os);
+  } else {
+    UNREACHABLE();
+  }
+}
+
 #endif  // OBJECT_PRINT
 
+void HeapNumber::HeapNumberPrint(std::ostream& os) { os << value(); }
+
+void MutableHeapNumber::MutableHeapNumberPrint(std::ostream& os) {
+  os << value();
+}
+
 // TODO(cbruni): remove once the new maptracer is in place.
-void Name::NameShortPrint() {
+void Name::NameShortPrint(Isolate* isolate) {
   if (this->IsString()) {
     PrintF("%s", String::cast(this)->ToCString().get());
   } else {
     DCHECK(this->IsSymbol());
     Symbol* s = Symbol::cast(this);
-    if (s->name()->IsUndefined(GetIsolate())) {
-      PrintF("#<%s>", s->PrivateSymbolToName());
+    if (s->name()->IsUndefined(isolate)) {
+      PrintF("#<%s>", s->PrivateSymbolToName(isolate));
     } else {
       PrintF("<%s>", String::cast(s->name())->ToCString().get());
     }
@@ -1918,37 +2202,32 @@ void Name::NameShortPrint() {
 }
 
 // TODO(cbruni): remove once the new maptracer is in place.
-int Name::NameShortPrint(Vector<char> str) {
+int Name::NameShortPrint(Isolate* isolate, Vector<char> str) {
   if (this->IsString()) {
     return SNPrintF(str, "%s", String::cast(this)->ToCString().get());
   } else {
     DCHECK(this->IsSymbol());
     Symbol* s = Symbol::cast(this);
-    if (s->name()->IsUndefined(GetIsolate())) {
-      return SNPrintF(str, "#<%s>", s->PrivateSymbolToName());
+    if (s->name()->IsUndefined(isolate)) {
+      return SNPrintF(str, "#<%s>", s->PrivateSymbolToName(isolate));
     } else {
       return SNPrintF(str, "<%s>", String::cast(s->name())->ToCString().get());
     }
   }
 }
 
-void Map::PrintMapDetails(std::ostream& os, JSObject* holder) {
+void Map::PrintMapDetails(Isolate* isolate, std::ostream& os) {
   DisallowHeapAllocation no_gc;
 #ifdef OBJECT_PRINT
-  this->MapPrint(os);
+  this->MapPrint(isolate, os);
 #else
   os << "Map=" << reinterpret_cast<void*>(this);
 #endif
   os << "\n";
   instance_descriptors()->PrintDescriptors(os);
-  if (is_dictionary_map() && holder != nullptr) {
-    os << holder->property_dictionary() << "\n";
-  }
 }
 
-void DescriptorArray::PrintDescriptors(std::ostream& os) {  // NOLINT
-  HandleScope scope(GetIsolate());
-  os << "Descriptor array #" << number_of_descriptors() << ":";
+void DescriptorArray::PrintDescriptors(std::ostream& os) {
   for (int i = 0; i < number_of_descriptors(); i++) {
     Name* key = GetKey(i);
     os << "\n  [" << i << "]: ";
@@ -1968,14 +2247,14 @@ void DescriptorArray::PrintDescriptorDetails(std::ostream& os, int descriptor,
   PropertyDetails details = GetDetails(descriptor);
   details.PrintAsFastTo(os, mode);
   os << " @ ";
-  Object* value = GetValue(descriptor);
   switch (details.location()) {
     case kField: {
-      FieldType* field_type = Map::UnwrapFieldType(value);
+      FieldType* field_type = GetFieldType(descriptor);
       field_type->PrintTo(os);
       break;
     }
     case kDescriptor:
+      Object* value = GetStrongValue(descriptor);
       os << Brief(value);
       if (value->IsAccessorPair()) {
         AccessorPair* pair = AccessorPair::cast(value);
@@ -2001,14 +2280,9 @@ char* String::ToAsciiArray() {
   return buffer;
 }
 
-void DescriptorArray::Print() {
-  OFStream os(stdout);
-  this->PrintDescriptors(os);
-  os << std::flush;
-}
 // static
-void TransitionsAccessor::PrintOneTransition(std::ostream& os, Name* key,
-                                             Map* target, Object* raw_target) {
+void TransitionsAccessor::PrintOneTransition(Isolate* isolate, std::ostream& os,
+                                             Name* key, Map* target) {
   os << "\n     ";
 #ifdef OBJECT_PRINT
   key->NamePrint(os);
@@ -2016,20 +2290,20 @@ void TransitionsAccessor::PrintOneTransition(std::ostream& os, Name* key,
   key->ShortPrint(os);
 #endif
   os << ": ";
-  Heap* heap = key->GetHeap();
-  if (key == heap->nonextensible_symbol()) {
+  Heap* heap = isolate->heap();
+  if (key == ReadOnlyRoots(heap).nonextensible_symbol()) {
     os << "(transition to non-extensible)";
-  } else if (key == heap->sealed_symbol()) {
+  } else if (key == ReadOnlyRoots(heap).sealed_symbol()) {
     os << "(transition to sealed)";
-  } else if (key == heap->frozen_symbol()) {
+  } else if (key == ReadOnlyRoots(heap).frozen_symbol()) {
     os << "(transition to frozen)";
-  } else if (key == heap->elements_transition_symbol()) {
+  } else if (key == ReadOnlyRoots(heap).elements_transition_symbol()) {
     os << "(transition to " << ElementsKindToString(target->elements_kind())
        << ")";
-  } else if (key == heap->strict_function_transition_symbol()) {
+  } else if (key == ReadOnlyRoots(heap).strict_function_transition_symbol()) {
     os << " (transition to strict function)";
   } else {
-    DCHECK(!IsSpecialTransition(key));
+    DCHECK(!IsSpecialTransition(heap->isolate(), key));
     os << "(transition to ";
     int descriptor = target->LastAdded();
     DescriptorArray* descriptors = target->instance_descriptors();
@@ -2038,53 +2312,37 @@ void TransitionsAccessor::PrintOneTransition(std::ostream& os, Name* key,
     os << ")";
   }
   os << " -> " << Brief(target);
-  if (!raw_target->IsMap() && !raw_target->IsWeakCell()) {
-    os << " (handler: " << Brief(raw_target) << ")";
-  }
-}
-
-void TransitionArray::Print() {
-  OFStream os(stdout);
-  Print(os);
 }
 
-// TODO(ishell): unify with TransitionArrayPrint().
-void TransitionArray::Print(std::ostream& os) {
+void TransitionArray::PrintInternal(Isolate* isolate, std::ostream& os) {
   int num_transitions = number_of_transitions();
   os << "Transition array #" << num_transitions << ":";
   for (int i = 0; i < num_transitions; i++) {
     Name* key = GetKey(i);
     Map* target = GetTarget(i);
-    Object* raw_target = GetRawTarget(i);
-    TransitionsAccessor::PrintOneTransition(os, key, target, raw_target);
+    TransitionsAccessor::PrintOneTransition(isolate, os, key, target);
   }
   os << "\n" << std::flush;
 }
 
 void TransitionsAccessor::PrintTransitions(std::ostream& os) {  // NOLINT
-  Map* target;
   switch (encoding()) {
     case kPrototypeInfo:
     case kUninitialized:
       return;
-    case kWeakRef:
-      target = Map::cast(raw_transitions_->ToWeakHeapObject());
-      break;
-    case kHandler: {
-      WeakCell* cell = GetTargetCell();
-      DCHECK(!cell->cleared());
-      target = Map::cast(cell->value());
+    case kWeakRef: {
+      Map* target = Map::cast(raw_transitions_->ToWeakHeapObject());
+      Name* key = GetSimpleTransitionKey(target);
+      PrintOneTransition(isolate_, os, key, target);
       break;
     }
     case kFullTransitionArray:
-      return transitions()->Print(os);
+      return transitions()->PrintInternal(isolate_, os);
   }
-  Name* key = GetSimpleTransitionKey(target);
-  PrintOneTransition(os, key, target, raw_transitions_->GetHeapObject());
 }
 
 void TransitionsAccessor::PrintTransitionTree() {
-  OFStream os(stdout);
+  StdoutStream os;
   os << "map= " << Brief(map_);
   DisallowHeapAllocation no_gc;
   PrintTransitionTree(os, 0, &no_gc);
@@ -2104,16 +2362,16 @@ void TransitionsAccessor::PrintTransitionTree(std::ostream& os, int level,
     ss << Brief(target);
     os << std::left << std::setw(50) << ss.str() << ": ";
 
-    Heap* heap = key->GetHeap();
-    if (key == heap->nonextensible_symbol()) {
+    Heap* heap = isolate_->heap();
+    if (key == ReadOnlyRoots(heap).nonextensible_symbol()) {
       os << "to non-extensible";
-    } else if (key == heap->sealed_symbol()) {
+    } else if (key == ReadOnlyRoots(heap).sealed_symbol()) {
       os << "to sealed ";
-    } else if (key == heap->frozen_symbol()) {
+    } else if (key == ReadOnlyRoots(heap).frozen_symbol()) {
       os << "to frozen";
-    } else if (key == heap->elements_transition_symbol()) {
+    } else if (key == ReadOnlyRoots(heap).elements_transition_symbol()) {
       os << "to " << ElementsKindToString(target->elements_kind());
-    } else if (key == heap->strict_function_transition_symbol()) {
+    } else if (key == ReadOnlyRoots(heap).strict_function_transition_symbol()) {
       os << "to strict function";
     } else {
 #ifdef OBJECT_PRINT
@@ -2122,25 +2380,26 @@ void TransitionsAccessor::PrintTransitionTree(std::ostream& os, int level,
       key->ShortPrint(os);
 #endif
       os << " ";
-      DCHECK(!IsSpecialTransition(key));
+      DCHECK(!IsSpecialTransition(isolate_, key));
       os << "to ";
       int descriptor = target->LastAdded();
       DescriptorArray* descriptors = target->instance_descriptors();
       descriptors->PrintDescriptorDetails(os, descriptor,
                                           PropertyDetails::kForTransitions);
     }
-    TransitionsAccessor transitions(target, no_gc);
+    TransitionsAccessor transitions(isolate_, target, no_gc);
     transitions.PrintTransitionTree(os, level + 1, no_gc);
   }
 }
 
 void JSObject::PrintTransitions(std::ostream& os) {  // NOLINT
   DisallowHeapAllocation no_gc;
-  TransitionsAccessor ta(map(), &no_gc);
+  TransitionsAccessor ta(GetIsolate(), map(), &no_gc);
   if (ta.NumberOfTransitions() == 0) return;
   os << "\n - transitions";
   ta.PrintTransitions(os);
 }
+
 #endif  // defined(DEBUG) || defined(OBJECT_PRINT)
 }  // namespace internal
 }  // namespace v8
@@ -2149,7 +2408,7 @@ void JSObject::PrintTransitions(std::ostream& os) {  // NOLINT
 // The following functions are used by our gdb macros.
 //
 extern void _v8_internal_Print_Object(void* object) {
-  reinterpret_cast<i::Object*>(object)->Print();
+  reinterpret_cast<i::Object*>(object)->Print(i::Isolate::Current());
 }
 
 extern void _v8_internal_Print_Code(void* object) {
@@ -2159,70 +2418,41 @@ extern void _v8_internal_Print_Code(void* object) {
   i::wasm::WasmCode* wasm_code =
       isolate->wasm_engine()->code_manager()->LookupCode(address);
   if (wasm_code) {
-    wasm_code->Print(isolate);
+    i::StdoutStream os;
+    wasm_code->Disassemble(nullptr, os, address);
     return;
   }
 
   if (!isolate->heap()->InSpaceSlow(address, i::CODE_SPACE) &&
-      !isolate->heap()->InSpaceSlow(address, i::LO_SPACE)) {
+      !isolate->heap()->InSpaceSlow(address, i::LO_SPACE) &&
+      !i::InstructionStream::PcIsOffHeap(isolate, address)) {
     i::PrintF(
-        "%p is not within the current isolate's large object or code spaces\n",
-        static_cast<void*>(address));
+        "%p is not within the current isolate's large object, code or embedded "
+        "spaces\n",
+        object);
     return;
   }
 
   i::Code* code = isolate->FindCodeObject(address);
   if (!code->IsCode()) {
-    i::PrintF("No code object found containing %p\n",
-              static_cast<void*>(address));
+    i::PrintF("No code object found containing %p\n", object);
     return;
   }
 #ifdef ENABLE_DISASSEMBLER
-  i::OFStream os(stdout);
+  i::StdoutStream os;
   code->Disassemble(nullptr, os, address);
 #else   // ENABLE_DISASSEMBLER
-  code->Print();
+  code->Print(i::Isolate::Current());
 #endif  // ENABLE_DISASSEMBLER
 }
 
-extern void _v8_internal_Print_FeedbackMetadata(void* object) {
-  if (reinterpret_cast<i::Object*>(object)->IsSmi()) {
-    printf("Please provide a feedback metadata object\n");
-  } else {
-    reinterpret_cast<i::FeedbackMetadata*>(object)->Print();
-  }
-}
-
-extern void _v8_internal_Print_FeedbackVector(void* object) {
-  if (reinterpret_cast<i::Object*>(object)->IsSmi()) {
-    printf("Please provide a feedback vector\n");
-  } else {
-    reinterpret_cast<i::FeedbackVector*>(object)->Print();
-  }
-}
-
-extern void _v8_internal_Print_DescriptorArray(void* object) {
-  if (reinterpret_cast<i::Object*>(object)->IsSmi()) {
-    printf("Please provide a descriptor array\n");
-  } else {
-    reinterpret_cast<i::DescriptorArray*>(object)->Print();
-  }
-}
-
 extern void _v8_internal_Print_LayoutDescriptor(void* object) {
   i::Object* o = reinterpret_cast<i::Object*>(object);
   if (!o->IsLayoutDescriptor()) {
     printf("Please provide a layout descriptor\n");
   } else {
-    reinterpret_cast<i::LayoutDescriptor*>(object)->Print();
-  }
-}
-
-extern void _v8_internal_Print_TransitionArray(void* object) {
-  if (reinterpret_cast<i::Object*>(object)->IsSmi()) {
-    printf("Please provide a transition array\n");
-  } else {
-    reinterpret_cast<i::TransitionArray*>(object)->Print();
+    reinterpret_cast<i::LayoutDescriptor*>(object)->Print(
+        i::Isolate::Current());
   }
 }
 
@@ -2238,8 +2468,8 @@ extern void _v8_internal_Print_TransitionTree(void* object) {
   } else {
 #if defined(DEBUG) || defined(OBJECT_PRINT)
     i::DisallowHeapAllocation no_gc;
-    i::TransitionsAccessor transitions(reinterpret_cast<i::Map*>(object),
-                                       &no_gc);
+    i::Map* map = reinterpret_cast<i::Map*>(object);
+    i::TransitionsAccessor transitions(map->GetIsolate(), map, &no_gc);
     transitions.PrintTransitionTree();
 #endif
   }
diff --git a/deps/v8/src/objects.cc b/deps/v8/src/objects.cc
index 6565910fd3faea..e3f58d1fae7cd0 100644
--- a/deps/v8/src/objects.cc
+++ b/deps/v8/src/objects.cc
@@ -25,12 +25,10 @@
 #include "src/bootstrapper.h"
 #include "src/builtins/builtins.h"
 #include "src/code-stubs.h"
-#include "src/compilation-dependencies.h"
 #include "src/compiler.h"
 #include "src/counters-inl.h"
 #include "src/counters.h"
 #include "src/date.h"
-#include "src/debug/debug-evaluate.h"
 #include "src/debug/debug.h"
 #include "src/deoptimizer.h"
 #include "src/elements.h"
@@ -53,15 +51,27 @@
 #include "src/map-updater.h"
 #include "src/messages.h"
 #include "src/objects-body-descriptors-inl.h"
+#include "src/objects/api-callbacks.h"
+#include "src/objects/arguments-inl.h"
 #include "src/objects/bigint.h"
 #include "src/objects/code-inl.h"
 #include "src/objects/compilation-cache-inl.h"
 #include "src/objects/debug-objects-inl.h"
 #include "src/objects/frame-array-inl.h"
-#include "src/objects/hash-table.h"
+#include "src/objects/hash-table-inl.h"
+#include "src/objects/js-collection-inl.h"
+#ifdef V8_INTL_SUPPORT
+#include "src/objects/js-locale.h"
+#endif  // V8_INTL_SUPPORT
+#include "src/objects/js-regexp-inl.h"
 #include "src/objects/js-regexp-string-iterator.h"
+#ifdef V8_INTL_SUPPORT
+#include "src/objects/js-relative-time-format.h"
+#endif  // V8_INTL_SUPPORT
+#include "src/objects/literal-objects-inl.h"
 #include "src/objects/map.h"
 #include "src/objects/microtask-inl.h"
+#include "src/objects/module-inl.h"
 #include "src/objects/promise-inl.h"
 #include "src/parsing/preparsed-scope-data.h"
 #include "src/property-descriptor.h"
@@ -172,8 +182,7 @@ MaybeHandle<JSReceiver> Object::ToObject(Isolate* isolate,
 MaybeHandle<JSReceiver> Object::ConvertReceiver(Isolate* isolate,
                                                 Handle<Object> object) {
   if (object->IsJSReceiver()) return Handle<JSReceiver>::cast(object);
-  if (*object == isolate->heap()->null_value() ||
-      object->IsUndefined(isolate)) {
+  if (object->IsNullOrUndefined(isolate)) {
     return isolate->global_proxy();
   }
   return Object::ToObject(isolate, object);
@@ -188,7 +197,7 @@ MaybeHandle<Object> Object::ConvertToNumberOrNumeric(Isolate* isolate,
       return input;
     }
     if (input->IsString()) {
-      return String::ToNumber(Handle<String>::cast(input));
+      return String::ToNumber(isolate, Handle<String>::cast(input));
     }
     if (input->IsOddball()) {
       return Oddball::ToNumber(Handle<Oddball>::cast(input));
@@ -290,7 +299,7 @@ MaybeHandle<String> Object::ConvertToString(Isolate* isolate,
                       String);
     }
     if (input->IsBigInt()) {
-      return BigInt::ToString(Handle<BigInt>::cast(input));
+      return BigInt::ToString(isolate, Handle<BigInt>::cast(input));
     }
     ASSIGN_RETURN_ON_EXCEPTION(
         isolate, input, JSReceiver::ToPrimitive(Handle<JSReceiver>::cast(input),
@@ -485,10 +494,9 @@ MaybeHandle<Object> Object::ConvertToIndex(
   return js_len;
 }
 
-bool Object::BooleanValue() {
+bool Object::BooleanValue(Isolate* isolate) {
   if (IsSmi()) return Smi::ToInt(this) != 0;
   DCHECK(IsHeapObject());
-  Isolate* isolate = HeapObject::cast(this)->GetIsolate();
   if (IsBoolean()) return IsTrue(isolate);
   if (IsNullOrUndefined(isolate)) return false;
   if (IsUndetectable()) return false;  // Undetectable object is false.
@@ -543,7 +551,8 @@ ComparisonResult Reverse(ComparisonResult result) {
 }  // anonymous namespace
 
 // static
-Maybe<ComparisonResult> Object::Compare(Handle<Object> x, Handle<Object> y) {
+Maybe<ComparisonResult> Object::Compare(Isolate* isolate, Handle<Object> x,
+                                        Handle<Object> y) {
   // ES6 section 7.2.11 Abstract Relational Comparison step 3 and 4.
   if (!Object::ToPrimitive(x, ToPrimitiveHint::kNumber).ToHandle(&x) ||
       !Object::ToPrimitive(y, ToPrimitiveHint::kNumber).ToHandle(&y)) {
@@ -551,8 +560,16 @@ Maybe<ComparisonResult> Object::Compare(Handle<Object> x, Handle<Object> y) {
   }
   if (x->IsString() && y->IsString()) {
     // ES6 section 7.2.11 Abstract Relational Comparison step 5.
-    return Just(
-        String::Compare(Handle<String>::cast(x), Handle<String>::cast(y)));
+    return Just(String::Compare(isolate, Handle<String>::cast(x),
+                                Handle<String>::cast(y)));
+  }
+  if (x->IsBigInt() && y->IsString()) {
+    return Just(BigInt::CompareToString(isolate, Handle<BigInt>::cast(x),
+                                        Handle<String>::cast(y)));
+  }
+  if (x->IsString() && y->IsBigInt()) {
+    return Just(Reverse(BigInt::CompareToString(
+        isolate, Handle<BigInt>::cast(y), Handle<String>::cast(x))));
   }
   // ES6 section 7.2.11 Abstract Relational Comparison step 6.
   if (!Object::ToNumeric(x).ToHandle(&x) ||
@@ -576,7 +593,8 @@ Maybe<ComparisonResult> Object::Compare(Handle<Object> x, Handle<Object> y) {
 
 
 // static
-Maybe<bool> Object::Equals(Handle<Object> x, Handle<Object> y) {
+Maybe<bool> Object::Equals(Isolate* isolate, Handle<Object> x,
+                           Handle<Object> y) {
   // This is the generic version of Abstract Equality Comparison. Must be in
   // sync with CodeStubAssembler::Equal.
   while (true) {
@@ -586,7 +604,8 @@ Maybe<bool> Object::Equals(Handle<Object> x, Handle<Object> y) {
       } else if (y->IsBoolean()) {
         return Just(NumberEquals(*x, Handle<Oddball>::cast(y)->to_number()));
       } else if (y->IsString()) {
-        return Just(NumberEquals(x, String::ToNumber(Handle<String>::cast(y))));
+        return Just(NumberEquals(
+            x, String::ToNumber(isolate, Handle<String>::cast(y))));
       } else if (y->IsBigInt()) {
         return Just(BigInt::EqualToNumber(Handle<BigInt>::cast(y), x));
       } else if (y->IsJSReceiver()) {
@@ -599,16 +618,16 @@ Maybe<bool> Object::Equals(Handle<Object> x, Handle<Object> y) {
       }
     } else if (x->IsString()) {
       if (y->IsString()) {
-        return Just(
-            String::Equals(Handle<String>::cast(x), Handle<String>::cast(y)));
+        return Just(String::Equals(isolate, Handle<String>::cast(x),
+                                   Handle<String>::cast(y)));
       } else if (y->IsNumber()) {
-        x = String::ToNumber(Handle<String>::cast(x));
+        x = String::ToNumber(isolate, Handle<String>::cast(x));
         return Just(NumberEquals(x, y));
       } else if (y->IsBoolean()) {
-        x = String::ToNumber(Handle<String>::cast(x));
+        x = String::ToNumber(isolate, Handle<String>::cast(x));
         return Just(NumberEquals(*x, Handle<Oddball>::cast(y)->to_number()));
       } else if (y->IsBigInt()) {
-        return Just(BigInt::EqualToString(Handle<BigInt>::cast(y),
+        return Just(BigInt::EqualToString(isolate, Handle<BigInt>::cast(y),
                                           Handle<String>::cast(x)));
       } else if (y->IsJSReceiver()) {
         if (!JSReceiver::ToPrimitive(Handle<JSReceiver>::cast(y))
@@ -624,7 +643,7 @@ Maybe<bool> Object::Equals(Handle<Object> x, Handle<Object> y) {
       } else if (y->IsNumber()) {
         return Just(NumberEquals(Handle<Oddball>::cast(x)->to_number(), *y));
       } else if (y->IsString()) {
-        y = String::ToNumber(Handle<String>::cast(y));
+        y = String::ToNumber(isolate, Handle<String>::cast(y));
         return Just(NumberEquals(Handle<Oddball>::cast(x)->to_number(), *y));
       } else if (y->IsBigInt()) {
         x = Oddball::ToNumber(Handle<Oddball>::cast(x));
@@ -653,7 +672,7 @@ Maybe<bool> Object::Equals(Handle<Object> x, Handle<Object> y) {
       if (y->IsBigInt()) {
         return Just(BigInt::EqualToBigInt(BigInt::cast(*x), BigInt::cast(*y)));
       }
-      return Equals(y, x);
+      return Equals(isolate, y, x);
     } else if (x->IsJSReceiver()) {
       if (y->IsJSReceiver()) {
         return Just(x.is_identical_to(y));
@@ -690,7 +709,8 @@ bool Object::StrictEquals(Object* that) {
 // static
 Handle<String> Object::TypeOf(Isolate* isolate, Handle<Object> object) {
   if (object->IsNumber()) return isolate->factory()->number_string();
-  if (object->IsOddball()) return handle(Oddball::cast(*object)->type_of());
+  if (object->IsOddball())
+    return handle(Oddball::cast(*object)->type_of(), isolate);
   if (object->IsUndetectable()) {
     return isolate->factory()->undefined_string();
   }
@@ -790,7 +810,7 @@ MaybeHandle<Object> Object::InstanceOf(Isolate* isolate, Handle<Object> object,
         isolate, result,
         Execution::Call(isolate, inst_of_handler, callable, 1, &object),
         Object);
-    return isolate->factory()->ToBoolean(result->BooleanValue());
+    return isolate->factory()->ToBoolean(result->BooleanValue(isolate));
   }
 
   // The {callable} must have a [[Call]] internal method.
@@ -813,8 +833,8 @@ MaybeHandle<Object> Object::GetMethod(Handle<JSReceiver> receiver,
                                       Handle<Name> name) {
   Handle<Object> func;
   Isolate* isolate = receiver->GetIsolate();
-  ASSIGN_RETURN_ON_EXCEPTION(isolate, func,
-                             JSReceiver::GetProperty(receiver, name), Object);
+  ASSIGN_RETURN_ON_EXCEPTION(
+      isolate, func, JSReceiver::GetProperty(isolate, receiver, name), Object);
   if (func->IsNullOrUndefined(isolate)) {
     return isolate->factory()->undefined_value();
   }
@@ -992,7 +1012,8 @@ Maybe<bool> JSReceiver::HasOwnProperty(Handle<JSReceiver> object,
 }
 
 // static
-MaybeHandle<Object> Object::GetProperty(LookupIterator* it) {
+MaybeHandle<Object> Object::GetProperty(LookupIterator* it,
+                                        OnNonExistent on_non_existent) {
   for (; it->IsFound(); it->Next()) {
     switch (it->state()) {
       case LookupIterator::NOT_FOUND:
@@ -1026,6 +1047,12 @@ MaybeHandle<Object> Object::GetProperty(LookupIterator* it) {
         return it->GetDataValue();
     }
   }
+
+  if (on_non_existent == OnNonExistent::kThrowReferenceError) {
+    THROW_NEW_ERROR(it->isolate(),
+                    NewReferenceError(MessageTemplate::kNotDefined, it->name()),
+                    Object);
+  }
   return it->isolate()->factory()->undefined_value();
 }
 
@@ -1186,7 +1213,8 @@ bool Object::ToInt32(int32_t* value) {
   }
   if (IsHeapNumber()) {
     double num = HeapNumber::cast(this)->value();
-    if (FastI2D(FastD2I(num)) == num) {
+    // Check range before conversion to avoid undefined behavior.
+    if (num >= kMinInt && num <= kMaxInt && FastI2D(FastD2I(num)) == num) {
       *value = FastD2I(num);
       return true;
     }
@@ -1206,7 +1234,7 @@ Handle<SharedFunctionInfo> FunctionTemplateInfo::GetOrCreateSharedFunctionInfo(
   if (maybe_name.ToHandle(&name) && name->IsString()) {
     name_string = Handle<String>::cast(name);
   } else if (info->class_name()->IsString()) {
-    name_string = handle(String::cast(info->class_name()));
+    name_string = handle(String::cast(info->class_name()), isolate);
   } else {
     name_string = isolate->factory()->empty_string();
   }
@@ -1309,7 +1337,7 @@ void JSObject::EnsureWritableFastElements(Handle<JSObject> object) {
          object->HasFastStringWrapperElements());
   FixedArray* raw_elems = FixedArray::cast(object->elements());
   Heap* heap = object->GetHeap();
-  if (raw_elems->map() != heap->fixed_cow_array_map()) return;
+  if (raw_elems->map() != ReadOnlyRoots(heap).fixed_cow_array_map()) return;
   Isolate* isolate = heap->isolate();
   Handle<FixedArray> elems(raw_elems, isolate);
   Handle<FixedArray> writable_elems = isolate->factory()->CopyFixedArrayWithMap(
@@ -1384,6 +1412,12 @@ int JSObject::GetHeaderSize(InstanceType type,
       return JSStringIterator::kSize;
     case JS_MODULE_NAMESPACE_TYPE:
       return JSModuleNamespace::kHeaderSize;
+#ifdef V8_INTL_SUPPORT
+    case JS_INTL_LOCALE_TYPE:
+      return JSLocale::kSize;
+    case JS_INTL_RELATIVE_TIME_FORMAT_TYPE:
+      return JSRelativeTimeFormat::kSize;
+#endif  // V8_INTL_SUPPORT
     case WASM_GLOBAL_TYPE:
       return WasmGlobalObject::kSize;
     case WASM_INSTANCE_TYPE:
@@ -1500,10 +1534,10 @@ MaybeHandle<Object> Object::GetPropertyWithAccessor(LookupIterator* it) {
     if (result.is_null()) return isolate->factory()->undefined_value();
     Handle<Object> reboxed_result = handle(*result, isolate);
     if (info->replace_on_access() && receiver->IsJSReceiver()) {
-      args.CallAccessorSetter(
-          isolate->factory()->reconfigure_to_data_property_accessor(), name,
-          result);
-      RETURN_EXCEPTION_IF_SCHEDULED_EXCEPTION(isolate, Object);
+      RETURN_ON_EXCEPTION(isolate,
+                          Accessors::ReplaceAccessorWithDataProperty(
+                              isolate, receiver, holder, name, result),
+                          Object);
     }
     return reboxed_result;
   }
@@ -1536,12 +1570,12 @@ Address AccessorInfo::redirect(Isolate* isolate, Address address,
   ApiFunction fun(address);
   DCHECK_EQ(ACCESSOR_GETTER, component);
   ExternalReference::Type type = ExternalReference::DIRECT_GETTER_CALL;
-  return ExternalReference(&fun, type, isolate).address();
+  return ExternalReference::Create(&fun, type).address();
 }
 
 Address AccessorInfo::redirected_getter() const {
   Address accessor = v8::ToCData<Address>(getter());
-  if (accessor == nullptr) return nullptr;
+  if (accessor == kNullAddress) return kNullAddress;
   return redirect(GetIsolate(), accessor, ACCESSOR_GETTER);
 }
 
@@ -1549,7 +1583,7 @@ Address CallHandlerInfo::redirected_callback() const {
   Address address = v8::ToCData<Address>(callback());
   ApiFunction fun(address);
   ExternalReference::Type type = ExternalReference::DIRECT_API_CALL;
-  return ExternalReference(&fun, type, GetIsolate()).address();
+  return ExternalReference::Create(&fun, type).address();
 }
 
 bool AccessorInfo::IsCompatibleReceiverMap(Isolate* isolate,
@@ -1616,8 +1650,8 @@ Maybe<bool> Object::SetPropertyWithAccessor(LookupIterator* it,
     // (signalling an exception) or a boolean Oddball.
     RETURN_VALUE_IF_SCHEDULED_EXCEPTION(isolate, Nothing<bool>());
     if (result.is_null()) return Just(true);
-    DCHECK(result->BooleanValue() || should_throw == kDontThrow);
-    return Just(result->BooleanValue());
+    DCHECK(result->BooleanValue(isolate) || should_throw == kDontThrow);
+    return Just(result->BooleanValue(isolate));
   }
 
   // Regular accessor.
@@ -1993,7 +2027,8 @@ void JSObject::SetNormalizedProperty(Handle<JSObject> object,
 
   if (object->IsJSGlobalObject()) {
     Handle<JSGlobalObject> global_obj = Handle<JSGlobalObject>::cast(object);
-    Handle<GlobalDictionary> dictionary(global_obj->global_dictionary());
+    Handle<GlobalDictionary> dictionary(global_obj->global_dictionary(),
+                                        isolate);
     int entry = dictionary->FindEntry(isolate, name, hash);
 
     if (entry == GlobalDictionary::kNotFound) {
@@ -2009,12 +2044,12 @@ void JSObject::SetNormalizedProperty(Handle<JSObject> object,
       dictionary = GlobalDictionary::Add(dictionary, name, value, details);
       global_obj->set_global_dictionary(*dictionary);
     } else {
-      Handle<PropertyCell> cell =
-          PropertyCell::PrepareForValue(dictionary, entry, value, details);
+      Handle<PropertyCell> cell = PropertyCell::PrepareForValue(
+          isolate, dictionary, entry, value, details);
       cell->set_value(*value);
     }
   } else {
-    Handle<NameDictionary> dictionary(object->property_dictionary());
+    Handle<NameDictionary> dictionary(object->property_dictionary(), isolate);
 
     int entry = dictionary->FindEntry(name);
     if (entry == NameDictionary::kNotFound) {
@@ -2085,7 +2120,7 @@ V8_WARN_UNUSED_RESULT Maybe<bool> FastAssign(
   if (!map->OnlyHasSimpleProperties()) return Just(false);
 
   Handle<JSObject> from = Handle<JSObject>::cast(source);
-  if (from->elements() != isolate->heap()->empty_fixed_array()) {
+  if (from->elements() != ReadOnlyRoots(isolate).empty_fixed_array()) {
     return Just(false);
   }
 
@@ -2103,7 +2138,7 @@ V8_WARN_UNUSED_RESULT Maybe<bool> FastAssign(
       if (!details.IsEnumerable()) continue;
       if (details.kind() == kData) {
         if (details.location() == kDescriptor) {
-          prop_value = handle(descriptors->GetValue(i), isolate);
+          prop_value = handle(descriptors->GetStrongValue(i), isolate);
         } else {
           Representation representation = details.representation();
           FieldIndex index = FieldIndex::ForDescriptor(*map, i);
@@ -2111,8 +2146,8 @@ V8_WARN_UNUSED_RESULT Maybe<bool> FastAssign(
         }
       } else {
         ASSIGN_RETURN_ON_EXCEPTION_VALUE(
-            isolate, prop_value, JSReceiver::GetProperty(from, next_key),
-            Nothing<bool>());
+            isolate, prop_value,
+            JSReceiver::GetProperty(isolate, from, next_key), Nothing<bool>());
         stable = from->map() == *map;
       }
     } else {
@@ -2240,58 +2275,7 @@ Map* Map::GetPrototypeChainRootMap(Isolate* isolate) const {
         JSFunction::cast(native_context->get(constructor_function_index));
     return constructor_function->initial_map();
   }
-  return isolate->heap()->null_value()->map();
-}
-
-namespace {
-
-// Returns a non-SMI for JSReceivers, but returns the hash code for simple
-// objects.  This avoids a double lookup in the cases where we know we will
-// add the hash to the JSReceiver if it does not already exist.
-Object* GetSimpleHash(Object* object) {
-  DisallowHeapAllocation no_gc;
-  if (object->IsSmi()) {
-    uint32_t hash = ComputeIntegerHash(Smi::ToInt(object));
-    return Smi::FromInt(hash & Smi::kMaxValue);
-  }
-  if (object->IsHeapNumber()) {
-    double num = HeapNumber::cast(object)->value();
-    if (std::isnan(num)) return Smi::FromInt(Smi::kMaxValue);
-    // Use ComputeIntegerHash for all values in Signed32 range, including -0,
-    // which is considered equal to 0 because collections use SameValueZero.
-    int32_t inum = FastD2I(num);
-    uint32_t hash = (FastI2D(inum) == num)
-                        ? ComputeIntegerHash(inum)
-                        : ComputeLongHash(double_to_uint64(num));
-    return Smi::FromInt(hash & Smi::kMaxValue);
-  }
-  if (object->IsName()) {
-    uint32_t hash = Name::cast(object)->Hash();
-    return Smi::FromInt(hash);
-  }
-  if (object->IsOddball()) {
-    uint32_t hash = Oddball::cast(object)->to_string()->Hash();
-    return Smi::FromInt(hash);
-  }
-  if (object->IsBigInt()) {
-    uint32_t hash = BigInt::cast(object)->Hash();
-    return Smi::FromInt(hash & Smi::kMaxValue);
-  }
-  DCHECK(object->IsJSReceiver());
-  return object;
-}
-
-}  // namespace
-
-Object* Object::GetHash() {
-  DisallowHeapAllocation no_gc;
-  Object* hash = GetSimpleHash(this);
-  if (hash->IsSmi()) return hash;
-
-  DCHECK(IsJSReceiver());
-  JSReceiver* receiver = JSReceiver::cast(this);
-  Isolate* isolate = receiver->GetIsolate();
-  return receiver->GetIdentityHash(isolate);
+  return ReadOnlyRoots(isolate).null_value()->map();
 }
 
 // static
@@ -2302,7 +2286,7 @@ Smi* Object::GetOrCreateHash(Isolate* isolate, Object* key) {
 
 Smi* Object::GetOrCreateHash(Isolate* isolate) {
   DisallowHeapAllocation no_gc;
-  Object* hash = GetSimpleHash(this);
+  Object* hash = Object::GetSimpleHash(this);
   if (hash->IsSmi()) return Smi::cast(hash);
 
   DCHECK(IsJSReceiver());
@@ -2384,7 +2368,8 @@ MaybeHandle<Object> Object::ArraySpeciesConstructor(
     if (constructor->IsJSReceiver()) {
       ASSIGN_RETURN_ON_EXCEPTION(
           isolate, constructor,
-          JSReceiver::GetProperty(Handle<JSReceiver>::cast(constructor),
+          JSReceiver::GetProperty(isolate,
+                                  Handle<JSReceiver>::cast(constructor),
                                   isolate->factory()->species_symbol()),
           Object);
       if (constructor->IsNull(isolate)) {
@@ -2411,7 +2396,8 @@ V8_WARN_UNUSED_RESULT MaybeHandle<Object> Object::SpeciesConstructor(
   Handle<Object> ctor_obj;
   ASSIGN_RETURN_ON_EXCEPTION(
       isolate, ctor_obj,
-      JSObject::GetProperty(recv, isolate->factory()->constructor_string()),
+      JSObject::GetProperty(isolate, recv,
+                            isolate->factory()->constructor_string()),
       Object);
 
   if (ctor_obj->IsUndefined(isolate)) return default_ctor;
@@ -2427,7 +2413,8 @@ V8_WARN_UNUSED_RESULT MaybeHandle<Object> Object::SpeciesConstructor(
   Handle<Object> species;
   ASSIGN_RETURN_ON_EXCEPTION(
       isolate, species,
-      JSObject::GetProperty(ctor, isolate->factory()->species_symbol()),
+      JSObject::GetProperty(isolate, ctor,
+                            isolate->factory()->species_symbol()),
       Object);
 
   if (species->IsNullOrUndefined(isolate)) {
@@ -2489,6 +2476,18 @@ void Object::ShortPrint(StringStream* accumulator) {
 
 void Object::ShortPrint(std::ostream& os) { os << Brief(this); }
 
+void MaybeObject::ShortPrint(FILE* out) {
+  OFStream os(out);
+  os << MaybeObjectBrief(this);
+}
+
+void MaybeObject::ShortPrint(StringStream* accumulator) {
+  std::ostringstream os;
+  os << MaybeObjectBrief(this);
+  accumulator->Add(os.str().c_str());
+}
+
+void MaybeObject::ShortPrint(std::ostream& os) { os << MaybeObjectBrief(this); }
 
 std::ostream& operator<<(std::ostream& os, const Brief& v) {
   if (v.value->IsSmi()) {
@@ -2525,7 +2524,7 @@ void Smi::SmiPrint(std::ostream& os) const {  // NOLINT
   os << value();
 }
 
-Handle<String> String::SlowFlatten(Handle<ConsString> cons,
+Handle<String> String::SlowFlatten(Isolate* isolate, Handle<ConsString> cons,
                                    PretenureFlag pretenure) {
   DCHECK_NE(cons->second()->length(), 0);
 
@@ -2535,17 +2534,15 @@ Handle<String> String::SlowFlatten(Handle<ConsString> cons,
     // String::Flatten only in those cases where String::SlowFlatten is not
     // called again.
     if (cons->second()->IsConsString() && !cons->second()->IsFlat()) {
-      cons = handle(ConsString::cast(cons->second()));
+      cons = handle(ConsString::cast(cons->second()), isolate);
     } else {
-      return String::Flatten(handle(cons->second()));
+      return String::Flatten(isolate, handle(cons->second(), isolate));
     }
   }
 
   DCHECK(AllowHeapAllocation::IsAllowed());
-  Isolate* isolate = cons->GetIsolate();
   int length = cons->length();
-  PretenureFlag tenure = isolate->heap()->InNewSpace(*cons) ? pretenure
-                                                            : TENURED;
+  PretenureFlag tenure = Heap::InNewSpace(*cons) ? pretenure : TENURED;
   Handle<SeqString> result;
   if (cons->IsOneByteRepresentation()) {
     Handle<SeqOneByteString> flat = isolate->factory()->NewRawOneByteString(
@@ -2561,7 +2558,7 @@ Handle<String> String::SlowFlatten(Handle<ConsString> cons,
     result = flat;
   }
   cons->set_first(*result);
-  cons->set_second(isolate->heap()->empty_string());
+  cons->set_second(ReadOnlyRoots(isolate).empty_string());
   DCHECK(result->IsFlat());
   return result;
 }
@@ -2587,7 +2584,11 @@ bool String::MakeExternal(v8::String::ExternalStringResource* resource) {
   int size = this->Size();  // Byte size of the original string.
   // Abort if size does not allow in-place conversion.
   if (size < ExternalString::kShortSize) return false;
-  Heap* heap = GetHeap();
+  MemoryChunk* chunk = MemoryChunk::FromHeapObject(this);
+  // Read-only strings cannot be made external, since that would mutate the
+  // string.
+  if (chunk->owner()->identity() == RO_SPACE) return false;
+  Heap* heap = chunk->heap();
   bool is_one_byte = this->IsOneByteRepresentation();
   bool is_internalized = this->IsInternalizedString();
   bool has_pointers = StringShape(this).IsIndirect();
@@ -2601,20 +2602,27 @@ bool String::MakeExternal(v8::String::ExternalStringResource* resource) {
   // the field caching the address of the backing store.  When we encounter
   // short external strings in generated code, we need to bailout to runtime.
   Map* new_map;
+  ReadOnlyRoots roots(heap);
   if (size < ExternalString::kSize) {
-    new_map = is_internalized
-        ? (is_one_byte
-           ? heap->short_external_internalized_string_with_one_byte_data_map()
-           : heap->short_external_internalized_string_map())
-        : (is_one_byte ? heap->short_external_string_with_one_byte_data_map()
-                       : heap->short_external_string_map());
+    if (is_internalized) {
+      new_map =
+          is_one_byte
+              ? roots
+                    .short_external_internalized_string_with_one_byte_data_map()
+              : roots.short_external_internalized_string_map();
+    } else {
+      new_map = is_one_byte
+                    ? roots.short_external_string_with_one_byte_data_map()
+                    : roots.short_external_string_map();
+    }
   } else {
-    new_map = is_internalized
-        ? (is_one_byte
-           ? heap->external_internalized_string_with_one_byte_data_map()
-           : heap->external_internalized_string_map())
-        : (is_one_byte ? heap->external_string_with_one_byte_data_map()
-                       : heap->external_string_map());
+    new_map =
+        is_internalized
+            ? (is_one_byte
+                   ? roots.external_internalized_string_with_one_byte_data_map()
+                   : roots.external_internalized_string_map())
+            : (is_one_byte ? roots.external_string_with_one_byte_data_map()
+                           : roots.external_string_map());
   }
 
   // Byte size of the external String object.
@@ -2631,6 +2639,7 @@ bool String::MakeExternal(v8::String::ExternalStringResource* resource) {
 
   ExternalTwoByteString* self = ExternalTwoByteString::cast(this);
   self->set_resource(resource);
+  heap->RegisterExternalString(this);
   if (is_internalized) self->Hash();  // Force regeneration of the hash value.
   return true;
 }
@@ -2660,7 +2669,11 @@ bool String::MakeExternal(v8::String::ExternalOneByteStringResource* resource) {
   int size = this->Size();  // Byte size of the original string.
   // Abort if size does not allow in-place conversion.
   if (size < ExternalString::kShortSize) return false;
-  Heap* heap = GetHeap();
+  MemoryChunk* chunk = MemoryChunk::FromHeapObject(this);
+  // Read-only strings cannot be made external, since that would mutate the
+  // string.
+  if (chunk->owner()->identity() == RO_SPACE) return false;
+  Heap* heap = chunk->heap();
   bool is_internalized = this->IsInternalizedString();
   bool has_pointers = StringShape(this).IsIndirect();
 
@@ -2675,14 +2688,15 @@ bool String::MakeExternal(v8::String::ExternalOneByteStringResource* resource) {
   // the field caching the address of the backing store.  When we encounter
   // short external strings in generated code, we need to bailout to runtime.
   Map* new_map;
+  ReadOnlyRoots roots(heap);
   if (size < ExternalString::kSize) {
     new_map = is_internalized
-                  ? heap->short_external_one_byte_internalized_string_map()
-                  : heap->short_external_one_byte_string_map();
+                  ? roots.short_external_one_byte_internalized_string_map()
+                  : roots.short_external_one_byte_string_map();
   } else {
     new_map = is_internalized
-                  ? heap->external_one_byte_internalized_string_map()
-                  : heap->external_one_byte_string_map();
+                  ? roots.external_one_byte_internalized_string_map()
+                  : roots.external_one_byte_string_map();
   }
 
   // Byte size of the external String object.
@@ -2699,6 +2713,7 @@ bool String::MakeExternal(v8::String::ExternalOneByteStringResource* resource) {
 
   ExternalOneByteString* self = ExternalOneByteString::cast(this);
   self->set_resource(resource);
+  heap->RegisterExternalString(this);
   if (is_internalized) self->Hash();  // Force regeneration of the hash value.
   return true;
 }
@@ -2778,7 +2793,7 @@ void String::PrintUC16(std::ostream& os, int start, int end) {  // NOLINT
 void JSObject::JSObjectShortPrint(StringStream* accumulator) {
   switch (map()->instance_type()) {
     case JS_ARRAY_TYPE: {
-      double length = JSArray::cast(this)->length()->IsUndefined(GetIsolate())
+      double length = JSArray::cast(this)->length()->IsUndefined()
                           ? 0
                           : JSArray::cast(this)->length()->Number();
       accumulator->Add("<JSArray[%u]>", static_cast<uint32_t>(length));
@@ -2926,14 +2941,15 @@ MaybeHandle<JSFunction> Map::GetConstructorFunction(
     int const constructor_function_index = map->GetConstructorFunctionIndex();
     if (constructor_function_index != kNoConstructorFunctionIndex) {
       return handle(
-          JSFunction::cast(native_context->get(constructor_function_index)));
+          JSFunction::cast(native_context->get(constructor_function_index)),
+          native_context->GetIsolate());
     }
   }
   return MaybeHandle<JSFunction>();
 }
 
-
-void Map::PrintReconfiguration(FILE* file, int modify_index, PropertyKind kind,
+void Map::PrintReconfiguration(Isolate* isolate, FILE* file, int modify_index,
+                               PropertyKind kind,
                                PropertyAttributes attributes) {
   OFStream os(file);
   os << "[reconfiguring]";
@@ -2945,7 +2961,7 @@ void Map::PrintReconfiguration(FILE* file, int modify_index, PropertyKind kind,
   }
   os << ": " << (kind == kData ? "kData" : "ACCESSORS") << ", attrs: ";
   os << attributes << " [";
-  JavaScriptFrame::PrintTop(GetIsolate(), file, false, true);
+  JavaScriptFrame::PrintTop(isolate, file, false, true);
   os << "]\n";
 }
 
@@ -2994,10 +3010,17 @@ VisitorId Map::GetVisitorId(Map* map) {
       return kVisitFreeSpace;
 
     case FIXED_ARRAY_TYPE:
-    case BOILERPLATE_DESCRIPTION_TYPE:
+    case OBJECT_BOILERPLATE_DESCRIPTION_TYPE:
     case HASH_TABLE_TYPE:
-    case DESCRIPTOR_ARRAY_TYPE:
+    case ORDERED_HASH_MAP_TYPE:
+    case ORDERED_HASH_SET_TYPE:
+    case NAME_DICTIONARY_TYPE:
+    case GLOBAL_DICTIONARY_TYPE:
+    case NUMBER_DICTIONARY_TYPE:
+    case SIMPLE_NUMBER_DICTIONARY_TYPE:
+    case STRING_TABLE_TYPE:
     case SCOPE_INFO_TYPE:
+    case SCRIPT_CONTEXT_TABLE_TYPE:
     case BLOCK_CONTEXT_TYPE:
     case CATCH_CONTEXT_TYPE:
     case DEBUG_EVALUATE_CONTEXT_TYPE:
@@ -3009,8 +3032,13 @@ VisitorId Map::GetVisitorId(Map* map) {
     case WITH_CONTEXT_TYPE:
       return kVisitFixedArray;
 
+    case EPHEMERON_HASH_TABLE_TYPE:
+      return kVisitEphemeronHashTable;
+
     case WEAK_FIXED_ARRAY_TYPE:
-      return kVisitWeakFixedArray;
+    case WEAK_ARRAY_LIST_TYPE:
+    case DESCRIPTOR_ARRAY_TYPE:
+      return kVisitWeakArray;
 
     case FIXED_DOUBLE_ARRAY_TYPE:
       return kVisitFixedDoubleArray;
@@ -3076,6 +3104,9 @@ VisitorId Map::GetVisitorId(Map* map) {
     case WASM_INSTANCE_TYPE:
       return kVisitWasmInstanceObject;
 
+    case UNCOMPILED_DATA_WITH_PRE_PARSED_SCOPE_TYPE:
+      return kVisitUncompiledDataWithPreParsedScope;
+
     case JS_OBJECT_TYPE:
     case JS_ERROR_TYPE:
     case JS_ARGUMENTS_TYPE:
@@ -3104,6 +3135,10 @@ VisitorId Map::GetVisitorId(Map* map) {
     case JS_PROMISE_TYPE:
     case JS_REGEXP_TYPE:
     case JS_REGEXP_STRING_ITERATOR_TYPE:
+#ifdef V8_INTL_SUPPORT
+    case JS_INTL_LOCALE_TYPE:
+    case JS_INTL_RELATIVE_TIME_FORMAT_TYPE:
+#endif  // V8_INTL_SUPPORT
     case WASM_GLOBAL_TYPE:
     case WASM_MEMORY_TYPE:
     case WASM_MODULE_TYPE:
@@ -3122,6 +3157,7 @@ VisitorId Map::GetVisitorId(Map* map) {
     case HEAP_NUMBER_TYPE:
     case MUTABLE_HEAP_NUMBER_TYPE:
     case FEEDBACK_METADATA_TYPE:
+    case UNCOMPILED_DATA_WITHOUT_PRE_PARSED_SCOPE_TYPE:
       return kVisitDataObject;
 
     case BIGINT_TYPE:
@@ -3142,17 +3178,20 @@ VisitorId Map::GetVisitorId(Map* map) {
     case FIXED_FLOAT64_ARRAY_TYPE:
       return kVisitFixedFloat64Array;
 
+    case ALLOCATION_SITE_TYPE:
+      return kVisitAllocationSite;
+
 #define MAKE_STRUCT_CASE(NAME, Name, name) case NAME##_TYPE:
       STRUCT_LIST(MAKE_STRUCT_CASE)
 #undef MAKE_STRUCT_CASE
-      if (instance_type == ALLOCATION_SITE_TYPE) {
-        return kVisitAllocationSite;
+      if (instance_type == PROTOTYPE_INFO_TYPE) {
+        return kVisitPrototypeInfo;
       }
       return kVisitStruct;
 
     case LOAD_HANDLER_TYPE:
     case STORE_HANDLER_TYPE:
-      return kVisitStruct;
+      return kVisitDataHandler;
 
     default:
       UNREACHABLE();
@@ -3160,8 +3199,8 @@ VisitorId Map::GetVisitorId(Map* map) {
 }
 
 void Map::PrintGeneralization(
-    FILE* file, const char* reason, int modify_index, int split,
-    int descriptors, bool descriptor_to_field,
+    Isolate* isolate, FILE* file, const char* reason, int modify_index,
+    int split, int descriptors, bool descriptor_to_field,
     Representation old_representation, Representation new_representation,
     MaybeHandle<FieldType> old_field_type, MaybeHandle<Object> old_value,
     MaybeHandle<FieldType> new_field_type, MaybeHandle<Object> new_value) {
@@ -3198,7 +3237,7 @@ void Map::PrintGeneralization(
     os << "+" << (descriptors - split) << " maps";
   }
   os << ") [";
-  JavaScriptFrame::PrintTop(GetIsolate(), file, false, true);
+  JavaScriptFrame::PrintTop(isolate, file, false, true);
   os << "]\n";
 }
 
@@ -3253,18 +3292,7 @@ bool JSObject::IsUnmodifiedApiObject(Object** o) {
 }
 
 void HeapObject::HeapObjectShortPrint(std::ostream& os) {  // NOLINT
-  Heap* heap = GetHeap();
-  Isolate* isolate = heap->isolate();
-  if (!heap->Contains(this)) {
-    os << "!!!INVALID POINTER!!!";
-    return;
-  }
-  if (!heap->Contains(map())) {
-    os << "!!!INVALID MAP!!!";
-    return;
-  }
-
-  os << this << " ";
+  os << AsHex(reinterpret_cast<Address>(this), kPointerHexDigits, true) << " ";
 
   if (IsString()) {
     HeapStringAllocator allocator;
@@ -3319,14 +3347,39 @@ void HeapObject::HeapObjectShortPrint(std::ostream& os) {  // NOLINT
     case WITH_CONTEXT_TYPE:
       os << "<WithContext[" << FixedArray::cast(this)->length() << "]>";
       break;
+    case SCRIPT_CONTEXT_TABLE_TYPE:
+      os << "<ScriptContextTable[" << FixedArray::cast(this)->length() << "]>";
+      break;
     case HASH_TABLE_TYPE:
       os << "<HashTable[" << FixedArray::cast(this)->length() << "]>";
       break;
+    case ORDERED_HASH_MAP_TYPE:
+      os << "<OrderedHashMap[" << FixedArray::cast(this)->length() << "]>";
+      break;
+    case ORDERED_HASH_SET_TYPE:
+      os << "<OrderedHashSet[" << FixedArray::cast(this)->length() << "]>";
+      break;
+    case NAME_DICTIONARY_TYPE:
+      os << "<NameDictionary[" << FixedArray::cast(this)->length() << "]>";
+      break;
+    case GLOBAL_DICTIONARY_TYPE:
+      os << "<GlobalDictionary[" << FixedArray::cast(this)->length() << "]>";
+      break;
+    case NUMBER_DICTIONARY_TYPE:
+      os << "<NumberDictionary[" << FixedArray::cast(this)->length() << "]>";
+      break;
+    case SIMPLE_NUMBER_DICTIONARY_TYPE:
+      os << "<SimpleNumberDictionary[" << FixedArray::cast(this)->length()
+         << "]>";
+      break;
+    case STRING_TABLE_TYPE:
+      os << "<StringTable[" << FixedArray::cast(this)->length() << "]>";
+      break;
     case FIXED_ARRAY_TYPE:
       os << "<FixedArray[" << FixedArray::cast(this)->length() << "]>";
       break;
-    case BOILERPLATE_DESCRIPTION_TYPE:
-      os << "<BoilerplateDescription[" << FixedArray::cast(this)->length()
+    case OBJECT_BOILERPLATE_DESCRIPTION_TYPE:
+      os << "<ObjectBoilerplateDescription[" << FixedArray::cast(this)->length()
          << "]>";
       break;
     case FIXED_DOUBLE_ARRAY_TYPE:
@@ -3351,17 +3404,20 @@ void HeapObject::HeapObjectShortPrint(std::ostream& os) {  // NOLINT
       os << "<PropertyArray[" << PropertyArray::cast(this)->length() << "]>";
       break;
     case FEEDBACK_CELL_TYPE: {
-      os << "<FeedbackCell[";
-      if (map() == heap->no_closures_cell_map()) {
-        os << "no closures";
-      } else if (map() == heap->one_closure_cell_map()) {
-        os << "one closure";
-      } else if (map() == heap->many_closures_cell_map()) {
-        os << "many closures";
-      } else {
-        os << "!!!INVALID MAP!!!";
+      {
+        ReadOnlyRoots roots = GetReadOnlyRoots();
+        os << "<FeedbackCell[";
+        if (map() == roots.no_closures_cell_map()) {
+          os << "no closures";
+        } else if (map() == roots.one_closure_cell_map()) {
+          os << "one closure";
+        } else if (map() == roots.many_closures_cell_map()) {
+          os << "many closures";
+        } else {
+          os << "!!!INVALID MAP!!!";
+        }
+        os << "]>";
       }
-      os << "]>";
       break;
     }
     case FEEDBACK_VECTOR_TYPE:
@@ -3379,6 +3435,23 @@ void HeapObject::HeapObjectShortPrint(std::ostream& os) {  // NOLINT
     TYPED_ARRAYS(TYPED_ARRAY_SHORT_PRINT)
 #undef TYPED_ARRAY_SHORT_PRINT
 
+    case UNCOMPILED_DATA_WITHOUT_PRE_PARSED_SCOPE_TYPE: {
+      UncompiledDataWithoutPreParsedScope* data =
+          UncompiledDataWithoutPreParsedScope::cast(this);
+      os << "<UncompiledDataWithoutPreParsedScope (" << data->start_position()
+         << ", " << data->end_position() << ")]>";
+      break;
+    }
+
+    case UNCOMPILED_DATA_WITH_PRE_PARSED_SCOPE_TYPE: {
+      UncompiledDataWithPreParsedScope* data =
+          UncompiledDataWithPreParsedScope::cast(this);
+      os << "<UncompiledDataWithPreParsedScope (" << data->start_position()
+         << ", " << data->end_position()
+         << ") preparsed=" << Brief(data->pre_parsed_scope_data()) << ">";
+      break;
+    }
+
     case SHARED_FUNCTION_INFO_TYPE: {
       SharedFunctionInfo* shared = SharedFunctionInfo::cast(this);
       std::unique_ptr<char[]> debug_name = shared->DebugName()->ToCString();
@@ -3400,6 +3473,12 @@ void HeapObject::HeapObjectShortPrint(std::ostream& os) {  // NOLINT
     break;
       STRUCT_LIST(MAKE_STRUCT_CASE)
 #undef MAKE_STRUCT_CASE
+    case ALLOCATION_SITE_TYPE: {
+      os << "<AllocationSite";
+      AllocationSite::cast(this)->BriefPrintDetails(os);
+      os << ">";
+      break;
+    }
     case SCOPE_INFO_TYPE: {
       ScopeInfo* scope = ScopeInfo::cast(this);
       os << "<ScopeInfo";
@@ -3419,15 +3498,15 @@ void HeapObject::HeapObjectShortPrint(std::ostream& os) {  // NOLINT
       break;
     }
     case ODDBALL_TYPE: {
-      if (IsUndefined(isolate)) {
+      if (IsUndefined()) {
         os << "<undefined>";
-      } else if (IsTheHole(isolate)) {
+      } else if (IsTheHole()) {
         os << "<the_hole>";
-      } else if (IsNull(isolate)) {
+      } else if (IsNull()) {
         os << "<null>";
-      } else if (IsTrue(isolate)) {
+      } else if (IsTrue()) {
         os << "<true>";
-      } else if (IsFalse(isolate)) {
+      } else if (IsFalse()) {
         os << "<false>";
       } else {
         os << "<Odd Oddball: ";
@@ -3442,14 +3521,14 @@ void HeapObject::HeapObjectShortPrint(std::ostream& os) {  // NOLINT
       break;
     }
     case HEAP_NUMBER_TYPE: {
-      os << "<Number ";
+      os << "<HeapNumber ";
       HeapNumber::cast(this)->HeapNumberPrint(os);
       os << ">";
       break;
     }
     case MUTABLE_HEAP_NUMBER_TYPE: {
-      os << "<MutableNumber ";
-      HeapNumber::cast(this)->HeapNumberPrint(os);
+      os << "<MutableHeapNumber ";
+      MutableHeapNumber::cast(this)->MutableHeapNumberPrint(os);
       os << '>';
       break;
     }
@@ -3525,6 +3604,10 @@ void Tuple3::BriefPrintDetails(std::ostream& os) {
      << Brief(value3());
 }
 
+void ArrayBoilerplateDescription::BriefPrintDetails(std::ostream& os) {
+  os << " " << elements_kind() << ", " << Brief(constant_elements());
+}
+
 void CallableTask::BriefPrintDetails(std::ostream& os) {
   os << " callable=" << Brief(callable());
 }
@@ -3555,69 +3638,51 @@ bool HeapObject::IsValidSlot(Map* map, int offset) {
                                                     this, offset, 0);
 }
 
-void HeapNumber::HeapNumberPrint(std::ostream& os) {  // NOLINT
-  os << value();
-}
-
-#define FIELD_ADDR(p, offset) \
-  (reinterpret_cast<byte*>(p) + offset - kHeapObjectTag)
-
-#define FIELD_ADDR_CONST(p, offset) \
-  (reinterpret_cast<const byte*>(p) + offset - kHeapObjectTag)
-
-#define READ_INT32_FIELD(p, offset) \
-  (*reinterpret_cast<const int32_t*>(FIELD_ADDR_CONST(p, offset)))
-
-#define READ_INT64_FIELD(p, offset) \
-  (*reinterpret_cast<const int64_t*>(FIELD_ADDR_CONST(p, offset)))
-
-#define READ_BYTE_FIELD(p, offset) \
-  (*reinterpret_cast<const byte*>(FIELD_ADDR_CONST(p, offset)))
-
 String* JSReceiver::class_name() {
-  if (IsFunction()) return GetHeap()->Function_string();
-  if (IsJSArgumentsObject()) return GetHeap()->Arguments_string();
-  if (IsJSArray()) return GetHeap()->Array_string();
+  ReadOnlyRoots roots = GetReadOnlyRoots();
+  if (IsFunction()) return roots.Function_string();
+  if (IsJSArgumentsObject()) return roots.Arguments_string();
+  if (IsJSArray()) return roots.Array_string();
   if (IsJSArrayBuffer()) {
     if (JSArrayBuffer::cast(this)->is_shared()) {
-      return GetHeap()->SharedArrayBuffer_string();
+      return roots.SharedArrayBuffer_string();
     }
-    return GetHeap()->ArrayBuffer_string();
+    return roots.ArrayBuffer_string();
   }
-  if (IsJSArrayIterator()) return GetHeap()->ArrayIterator_string();
-  if (IsJSDate()) return GetHeap()->Date_string();
-  if (IsJSError()) return GetHeap()->Error_string();
-  if (IsJSGeneratorObject()) return GetHeap()->Generator_string();
-  if (IsJSMap()) return GetHeap()->Map_string();
-  if (IsJSMapIterator()) return GetHeap()->MapIterator_string();
+  if (IsJSArrayIterator()) return roots.ArrayIterator_string();
+  if (IsJSDate()) return roots.Date_string();
+  if (IsJSError()) return roots.Error_string();
+  if (IsJSGeneratorObject()) return roots.Generator_string();
+  if (IsJSMap()) return roots.Map_string();
+  if (IsJSMapIterator()) return roots.MapIterator_string();
   if (IsJSProxy()) {
-    return map()->is_callable() ? GetHeap()->Function_string()
-                                : GetHeap()->Object_string();
+    return map()->is_callable() ? roots.Function_string()
+                                : roots.Object_string();
   }
-  if (IsJSRegExp()) return GetHeap()->RegExp_string();
-  if (IsJSSet()) return GetHeap()->Set_string();
-  if (IsJSSetIterator()) return GetHeap()->SetIterator_string();
+  if (IsJSRegExp()) return roots.RegExp_string();
+  if (IsJSSet()) return roots.Set_string();
+  if (IsJSSetIterator()) return roots.SetIterator_string();
   if (IsJSTypedArray()) {
 #define SWITCH_KIND(Type, type, TYPE, ctype, size) \
   if (map()->elements_kind() == TYPE##_ELEMENTS) { \
-    return GetHeap()->Type##Array_string();        \
+    return roots.Type##Array_string();             \
   }
     TYPED_ARRAYS(SWITCH_KIND)
 #undef SWITCH_KIND
   }
   if (IsJSValue()) {
     Object* value = JSValue::cast(this)->value();
-    if (value->IsBoolean()) return GetHeap()->Boolean_string();
-    if (value->IsString()) return GetHeap()->String_string();
-    if (value->IsNumber()) return GetHeap()->Number_string();
-    if (value->IsBigInt()) return GetHeap()->BigInt_string();
-    if (value->IsSymbol()) return GetHeap()->Symbol_string();
-    if (value->IsScript()) return GetHeap()->Script_string();
+    if (value->IsBoolean()) return roots.Boolean_string();
+    if (value->IsString()) return roots.String_string();
+    if (value->IsNumber()) return roots.Number_string();
+    if (value->IsBigInt()) return roots.BigInt_string();
+    if (value->IsSymbol()) return roots.Symbol_string();
+    if (value->IsScript()) return roots.Script_string();
     UNREACHABLE();
   }
-  if (IsJSWeakMap()) return GetHeap()->WeakMap_string();
-  if (IsJSWeakSet()) return GetHeap()->WeakSet_string();
-  if (IsJSGlobalProxy()) return GetHeap()->global_string();
+  if (IsJSWeakMap()) return roots.WeakMap_string();
+  if (IsJSWeakSet()) return roots.WeakSet_string();
+  if (IsJSGlobalProxy()) return roots.global_string();
 
   Object* maybe_constructor = map()->GetConstructor();
   if (maybe_constructor->IsJSFunction()) {
@@ -3632,17 +3697,22 @@ String* JSReceiver::class_name() {
     if (info->class_name()->IsString()) return String::cast(info->class_name());
   }
 
-  return GetHeap()->Object_string();
+  return roots.Object_string();
 }
 
 bool HeapObject::CanBeRehashed() const {
   DCHECK(NeedsRehashing());
   switch (map()->instance_type()) {
-    case HASH_TABLE_TYPE:
+    case ORDERED_HASH_MAP_TYPE:
+    case ORDERED_HASH_SET_TYPE:
       // TODO(yangguo): actually support rehashing OrderedHash{Map,Set}.
-      return IsNameDictionary() || IsGlobalDictionary() ||
-             IsNumberDictionary() || IsSimpleNumberDictionary() ||
-             IsStringTable();
+      return false;
+    case NAME_DICTIONARY_TYPE:
+    case GLOBAL_DICTIONARY_TYPE:
+    case NUMBER_DICTIONARY_TYPE:
+    case SIMPLE_NUMBER_DICTIONARY_TYPE:
+    case STRING_TABLE_TYPE:
+      return true;
     case DESCRIPTOR_ARRAY_TYPE:
       return true;
     case TRANSITION_ARRAY_TYPE:
@@ -3660,26 +3730,29 @@ bool HeapObject::CanBeRehashed() const {
 void HeapObject::RehashBasedOnMap() {
   switch (map()->instance_type()) {
     case HASH_TABLE_TYPE:
-      if (IsNameDictionary()) {
-        NameDictionary::cast(this)->Rehash();
-      } else if (IsNumberDictionary()) {
-        NumberDictionary::cast(this)->Rehash();
-      } else if (IsSimpleNumberDictionary()) {
-        SimpleNumberDictionary::cast(this)->Rehash();
-      } else if (IsGlobalDictionary()) {
-        GlobalDictionary::cast(this)->Rehash();
-      } else if (IsStringTable()) {
-        StringTable::cast(this)->Rehash();
-      } else {
-        UNREACHABLE();
-      }
+      UNREACHABLE();
+      break;
+    case NAME_DICTIONARY_TYPE:
+      NameDictionary::cast(this)->Rehash();
+      break;
+    case GLOBAL_DICTIONARY_TYPE:
+      GlobalDictionary::cast(this)->Rehash();
+      break;
+    case NUMBER_DICTIONARY_TYPE:
+      NumberDictionary::cast(this)->Rehash();
+      break;
+    case SIMPLE_NUMBER_DICTIONARY_TYPE:
+      SimpleNumberDictionary::cast(this)->Rehash();
+      break;
+    case STRING_TABLE_TYPE:
+      StringTable::cast(this)->Rehash();
       break;
     case DESCRIPTOR_ARRAY_TYPE:
       DCHECK_LE(1, DescriptorArray::cast(this)->number_of_descriptors());
       DescriptorArray::cast(this)->Sort();
       break;
     case TRANSITION_ARRAY_TYPE:
-      TransitionArray::cast(this)->Sort();
+      TransitionArray::cast(this)->Sort(GetIsolate());
       break;
     case SMALL_ORDERED_HASH_MAP_TYPE:
       DCHECK_EQ(0, SmallOrderedHashMap::cast(this)->NumberOfElements());
@@ -3707,7 +3780,7 @@ Handle<String> JSReceiver::GetConstructorName(Handle<JSReceiver> receiver) {
       JSFunction* constructor = JSFunction::cast(maybe_constructor);
       String* name = constructor->shared()->DebugName();
       if (name->length() != 0 &&
-          !name->Equals(isolate->heap()->Object_string())) {
+          !name->Equals(ReadOnlyRoots(isolate).Object_string())) {
         return handle(name, isolate);
       }
     } else if (maybe_constructor->IsFunctionTemplateInfo()) {
@@ -3724,7 +3797,7 @@ Handle<String> JSReceiver::GetConstructorName(Handle<JSReceiver> receiver) {
   if (maybe_tag->IsString()) return Handle<String>::cast(maybe_tag);
 
   PrototypeIterator iter(isolate, receiver);
-  if (iter.IsAtEnd()) return handle(receiver->class_name());
+  if (iter.IsAtEnd()) return handle(receiver->class_name(), isolate);
   Handle<JSReceiver> start = PrototypeIterator::GetCurrent<JSReceiver>(iter);
   LookupIterator it(receiver, isolate->factory()->constructor_string(), start,
                     LookupIterator::PROTOTYPE_CHAIN_SKIP_INTERCEPTOR);
@@ -3737,14 +3810,14 @@ Handle<String> JSReceiver::GetConstructorName(Handle<JSReceiver> receiver) {
   }
 
   return result.is_identical_to(isolate->factory()->Object_string())
-             ? handle(receiver->class_name())
+             ? handle(receiver->class_name(), isolate)
              : result;
 }
 
 Handle<Context> JSReceiver::GetCreationContext() {
   JSReceiver* receiver = this;
   // Externals are JSObjects with null as a constructor.
-  DCHECK(!receiver->IsExternal());
+  DCHECK(!receiver->IsExternal(GetIsolate()));
   Object* constructor = receiver->map()->GetConstructor();
   JSFunction* function;
   if (constructor->IsJSFunction()) {
@@ -3760,28 +3833,33 @@ Handle<Context> JSReceiver::GetCreationContext() {
   }
 
   return function->has_context()
-             ? Handle<Context>(function->context()->native_context())
+             ? Handle<Context>(function->context()->native_context(),
+                               receiver->GetIsolate())
              : Handle<Context>::null();
 }
 
 // static
-Handle<Object> Map::WrapFieldType(Handle<FieldType> type) {
-  if (type->IsClass()) return Map::WeakCellForMap(type->AsClass());
-  return type;
+MaybeObjectHandle Map::WrapFieldType(Handle<FieldType> type) {
+  if (type->IsClass()) {
+    return MaybeObjectHandle::Weak(type->AsClass());
+  }
+  return MaybeObjectHandle(type);
 }
 
 // static
-FieldType* Map::UnwrapFieldType(Object* wrapped_type) {
-  Object* value = wrapped_type;
-  if (value->IsWeakCell()) {
-    if (WeakCell::cast(value)->cleared()) return FieldType::None();
-    value = WeakCell::cast(value)->value();
+FieldType* Map::UnwrapFieldType(MaybeObject* wrapped_type) {
+  if (wrapped_type->IsClearedWeakHeapObject()) {
+    return FieldType::None();
+  }
+  HeapObject* heap_object;
+  if (wrapped_type->ToWeakHeapObject(&heap_object)) {
+    return FieldType::cast(heap_object);
   }
-  return FieldType::cast(value);
+  return FieldType::cast(wrapped_type->ToObject());
 }
 
-MaybeHandle<Map> Map::CopyWithField(Handle<Map> map, Handle<Name> name,
-                                    Handle<FieldType> type,
+MaybeHandle<Map> Map::CopyWithField(Isolate* isolate, Handle<Map> map,
+                                    Handle<Name> name, Handle<FieldType> type,
                                     PropertyAttributes attributes,
                                     PropertyConstness constness,
                                     Representation representation,
@@ -3795,13 +3873,11 @@ MaybeHandle<Map> Map::CopyWithField(Handle<Map> map, Handle<Name> name,
     return MaybeHandle<Map>();
   }
 
-  Isolate* isolate = map->GetIsolate();
-
   // Compute the new index for new field.
   int index = map->NextFreePropertyIndex();
 
   if (map->instance_type() == JS_CONTEXT_EXTENSION_OBJECT_TYPE) {
-    constness = kMutable;
+    constness = PropertyConstness::kMutable;
     representation = Representation::Tagged();
     type = FieldType::Any(isolate);
   } else {
@@ -3809,18 +3885,18 @@ MaybeHandle<Map> Map::CopyWithField(Handle<Map> map, Handle<Name> name,
         isolate, map->instance_type(), &constness, &representation, &type);
   }
 
-  Handle<Object> wrapped_type(WrapFieldType(type));
+  MaybeObjectHandle wrapped_type = WrapFieldType(type);
 
-  DCHECK_IMPLIES(!FLAG_track_constant_fields, constness == kMutable);
+  DCHECK_IMPLIES(!FLAG_track_constant_fields,
+                 constness == PropertyConstness::kMutable);
   Descriptor d = Descriptor::DataField(name, index, attributes, constness,
                                        representation, wrapped_type);
-  Handle<Map> new_map = Map::CopyAddDescriptor(map, &d, flag);
+  Handle<Map> new_map = Map::CopyAddDescriptor(isolate, map, &d, flag);
   new_map->AccountAddedPropertyField();
   return new_map;
 }
 
-
-MaybeHandle<Map> Map::CopyWithConstant(Handle<Map> map,
+MaybeHandle<Map> Map::CopyWithConstant(Isolate* isolate, Handle<Map> map,
                                        Handle<Name> name,
                                        Handle<Object> constant,
                                        PropertyAttributes attributes,
@@ -3831,15 +3907,14 @@ MaybeHandle<Map> Map::CopyWithConstant(Handle<Map> map,
   }
 
   if (FLAG_track_constant_fields) {
-    Isolate* isolate = map->GetIsolate();
     Representation representation = constant->OptimalRepresentation();
     Handle<FieldType> type = constant->OptimalType(isolate, representation);
-    return CopyWithField(map, name, type, attributes, kConst, representation,
-                         flag);
+    return CopyWithField(isolate, map, name, type, attributes,
+                         PropertyConstness::kConst, representation, flag);
   } else {
     // Allocate new instance descriptors with (name, constant) added.
     Descriptor d = Descriptor::DataConstant(name, 0, constant, attributes);
-    Handle<Map> new_map = Map::CopyAddDescriptor(map, &d, flag);
+    Handle<Map> new_map = Map::CopyAddDescriptor(isolate, map, &d, flag);
     return new_map;
   }
 }
@@ -3976,7 +4051,7 @@ namespace {
 //     store.
 void MigrateFastToFast(Handle<JSObject> object, Handle<Map> new_map) {
   Isolate* isolate = object->GetIsolate();
-  Handle<Map> old_map(object->map());
+  Handle<Map> old_map(object->map(), isolate);
   // In case of a regular transition.
   if (new_map->GetBackPointer() == *old_map) {
     // If the map does not add named properties, simply set the map.
@@ -4009,7 +4084,7 @@ void MigrateFastToFast(Handle<JSObject> object, Handle<Map> new_map) {
           FieldIndex::ForDescriptor(*new_map, new_map->LastAdded());
       DCHECK(details.representation().IsDouble());
       DCHECK(!new_map->IsUnboxedDoubleField(index));
-      Handle<Object> value = isolate->factory()->NewMutableHeapNumber();
+      auto value = isolate->factory()->NewMutableHeapNumberWithHoleNaN();
       object->RawFastPropertyAtPut(index, *value);
       object->synchronized_set_map(*new_map);
       return;
@@ -4018,14 +4093,14 @@ void MigrateFastToFast(Handle<JSObject> object, Handle<Map> new_map) {
     // This migration is a transition from a map that has run out of property
     // space. Extend the backing store.
     int grow_by = new_map->UnusedPropertyFields() + 1;
-    Handle<PropertyArray> old_storage(object->property_array());
+    Handle<PropertyArray> old_storage(object->property_array(), isolate);
     Handle<PropertyArray> new_storage =
         isolate->factory()->CopyPropertyArrayAndGrow(old_storage, grow_by);
 
     // Properly initialize newly added property.
     Handle<Object> value;
     if (details.representation().IsDouble()) {
-      value = isolate->factory()->NewMutableHeapNumber();
+      value = isolate->factory()->NewMutableHeapNumberWithHoleNaN();
     } else {
       value = isolate->factory()->uninitialized_value();
     }
@@ -4064,8 +4139,10 @@ void MigrateFastToFast(Handle<JSObject> object, Handle<Map> new_map) {
   Handle<FixedArray> inobject_props =
       isolate->factory()->NewFixedArray(inobject);
 
-  Handle<DescriptorArray> old_descriptors(old_map->instance_descriptors());
-  Handle<DescriptorArray> new_descriptors(new_map->instance_descriptors());
+  Handle<DescriptorArray> old_descriptors(old_map->instance_descriptors(),
+                                          isolate);
+  Handle<DescriptorArray> new_descriptors(new_map->instance_descriptors(),
+                                          isolate);
   int old_nof = old_map->NumberOfOwnDescriptors();
   int new_nof = new_map->NumberOfOwnDescriptors();
 
@@ -4087,13 +4164,13 @@ void MigrateFastToFast(Handle<JSObject> object, Handle<Map> new_map) {
         // must already be prepared for data of certain type.
         DCHECK(!details.representation().IsNone());
         if (details.representation().IsDouble()) {
-          value = isolate->factory()->NewMutableHeapNumber();
+          value = isolate->factory()->NewMutableHeapNumberWithHoleNaN();
         } else {
           value = isolate->factory()->uninitialized_value();
         }
       } else {
         DCHECK_EQ(kData, old_details.kind());
-        value = handle(old_descriptors->GetValue(i), isolate);
+        value = handle(old_descriptors->GetStrongValue(i), isolate);
         DCHECK(!old_representation.IsDouble() && !representation.IsDouble());
       }
     } else {
@@ -4101,9 +4178,11 @@ void MigrateFastToFast(Handle<JSObject> object, Handle<Map> new_map) {
       FieldIndex index = FieldIndex::ForDescriptor(*old_map, i);
       if (object->IsUnboxedDoubleField(index)) {
         uint64_t old_bits = object->RawFastDoublePropertyAsBitsAt(index);
-        value = isolate->factory()->NewHeapNumberFromBits(
-            old_bits, representation.IsDouble() ? MUTABLE : IMMUTABLE);
-
+        if (representation.IsDouble()) {
+          value = isolate->factory()->NewMutableHeapNumberFromBits(old_bits);
+        } else {
+          value = isolate->factory()->NewHeapNumberFromBits(old_bits);
+        }
       } else {
         value = handle(object->RawFastPropertyAt(index), isolate);
         if (!old_representation.IsDouble() && representation.IsDouble()) {
@@ -4131,7 +4210,7 @@ void MigrateFastToFast(Handle<JSObject> object, Handle<Map> new_map) {
     DCHECK_EQ(kData, details.kind());
     Handle<Object> value;
     if (details.representation().IsDouble()) {
-      value = isolate->factory()->NewMutableHeapNumber();
+      value = isolate->factory()->NewMutableHeapNumberWithHoleNaN();
     } else {
       value = isolate->factory()->uninitialized_value();
     }
@@ -4164,7 +4243,7 @@ void MigrateFastToFast(Handle<JSObject> object, Handle<Map> new_map) {
       DCHECK(value->IsMutableHeapNumber());
       // Ensure that all bits of the double value are preserved.
       object->RawFastDoublePropertyAsBitsAtPut(
-          index, HeapNumber::cast(value)->value_as_bits());
+          index, MutableHeapNumber::cast(value)->value_as_bits());
       if (i < old_number_of_fields && !old_map->IsUnboxedDoubleField(index)) {
         // Transition from tagged to untagged slot.
         heap->ClearRecordedSlot(*object,
@@ -4208,7 +4287,7 @@ void MigrateFastToSlow(Handle<JSObject> object, Handle<Map> new_map,
 
   Isolate* isolate = object->GetIsolate();
   HandleScope scope(isolate);
-  Handle<Map> map(object->map());
+  Handle<Map> map(object->map(), isolate);
 
   // Allocate new content.
   int real_size = map->NumberOfOwnDescriptors();
@@ -4222,10 +4301,10 @@ void MigrateFastToSlow(Handle<JSObject> object, Handle<Map> new_map,
   Handle<NameDictionary> dictionary =
       NameDictionary::New(isolate, property_count);
 
-  Handle<DescriptorArray> descs(map->instance_descriptors());
+  Handle<DescriptorArray> descs(map->instance_descriptors(), isolate);
   for (int i = 0; i < real_size; i++) {
     PropertyDetails details = descs->GetDetails(i);
-    Handle<Name> key(descs->GetKey(i));
+    Handle<Name> key(descs->GetKey(i), isolate);
     Handle<Object> value;
     if (details.location() == kField) {
       FieldIndex index = FieldIndex::ForDescriptor(*map, i);
@@ -4237,8 +4316,8 @@ void MigrateFastToSlow(Handle<JSObject> object, Handle<Map> new_map,
           value = handle(object->RawFastPropertyAt(index), isolate);
           if (details.representation().IsDouble()) {
             DCHECK(value->IsMutableHeapNumber());
-            Handle<HeapNumber> old = Handle<HeapNumber>::cast(value);
-            value = isolate->factory()->NewHeapNumber(old->value());
+            double old_value = Handle<MutableHeapNumber>::cast(value)->value();
+            value = isolate->factory()->NewHeapNumber(old_value);
           }
         }
       } else {
@@ -4248,7 +4327,7 @@ void MigrateFastToSlow(Handle<JSObject> object, Handle<Map> new_map,
 
     } else {
       DCHECK_EQ(kDescriptor, details.location());
-      value = handle(descs->GetValue(i), isolate);
+      value = handle(descs->GetStrongValue(i), isolate);
     }
     DCHECK(!value.is_null());
     PropertyDetails d(details.kind(), details.attributes(),
@@ -4301,9 +4380,9 @@ void MigrateFastToSlow(Handle<JSObject> object, Handle<Map> new_map,
 
 #ifdef DEBUG
   if (FLAG_trace_normalization) {
-    OFStream os(stdout);
+    StdoutStream os;
     os << "Object properties have been normalized:\n";
-    object->Print(os);
+    object->Print(isolate, os);
   }
 #endif
 }
@@ -4328,8 +4407,8 @@ void JSObject::NotifyMapChange(Handle<Map> old_map, Handle<Map> new_map,
 void JSObject::MigrateToMap(Handle<JSObject> object, Handle<Map> new_map,
                             int expected_additional_properties) {
   if (object->map() == *new_map) return;
-  Handle<Map> old_map(object->map());
-  NotifyMapChange(old_map, new_map, new_map->GetIsolate());
+  Handle<Map> old_map(object->map(), object->GetIsolate());
+  NotifyMapChange(old_map, new_map, object->GetIsolate());
 
   if (old_map->is_dictionary_map()) {
     // For slow-to-fast migrations JSObject::MigrateSlowToFast()
@@ -4351,8 +4430,9 @@ void JSObject::MigrateToMap(Handle<JSObject> object, Handle<Map> new_map,
       old_map->set_owns_descriptors(false);
       DCHECK(old_map->is_abandoned_prototype_map());
       // Ensure that no transition was inserted for prototype migrations.
-      DCHECK_EQ(0, TransitionsAccessor(old_map).NumberOfTransitions());
-      DCHECK(new_map->GetBackPointer()->IsUndefined(new_map->GetIsolate()));
+      DCHECK_EQ(0, TransitionsAccessor(object->GetIsolate(), old_map)
+                       .NumberOfTransitions());
+      DCHECK(new_map->GetBackPointer()->IsUndefined());
       DCHECK(object->map() != *old_map);
     }
   } else {
@@ -4370,9 +4450,10 @@ void JSObject::MigrateToMap(Handle<JSObject> object, Handle<Map> new_map,
 void JSObject::ForceSetPrototype(Handle<JSObject> object,
                                  Handle<Object> proto) {
   // object.__proto__ = proto;
-  Handle<Map> old_map = Handle<Map>(object->map());
-  Handle<Map> new_map = Map::Copy(old_map, "ForceSetPrototype");
-  Map::SetPrototype(new_map, proto);
+  Handle<Map> old_map = Handle<Map>(object->map(), object->GetIsolate());
+  Handle<Map> new_map =
+      Map::Copy(object->GetIsolate(), old_map, "ForceSetPrototype");
+  Map::SetPrototype(object->GetIsolate(), new_map, proto);
   JSObject::MigrateToMap(object, new_map);
 }
 
@@ -4396,36 +4477,35 @@ void DescriptorArray::GeneralizeAllFields() {
     details = details.CopyWithRepresentation(Representation::Tagged());
     if (details.location() == kField) {
       DCHECK_EQ(kData, details.kind());
-      details = details.CopyWithConstness(kMutable);
+      details = details.CopyWithConstness(PropertyConstness::kMutable);
       SetValue(i, FieldType::Any());
     }
-    set(ToDetailsIndex(i), details.AsSmi());
+    set(ToDetailsIndex(i), MaybeObject::FromObject(details.AsSmi()));
   }
 }
 
-Handle<Map> Map::CopyGeneralizeAllFields(Handle<Map> map,
+Handle<Map> Map::CopyGeneralizeAllFields(Isolate* isolate, Handle<Map> map,
                                          ElementsKind elements_kind,
                                          int modify_index, PropertyKind kind,
                                          PropertyAttributes attributes,
                                          const char* reason) {
-  Isolate* isolate = map->GetIsolate();
   Handle<DescriptorArray> old_descriptors(map->instance_descriptors(), isolate);
   int number_of_own_descriptors = map->NumberOfOwnDescriptors();
-  Handle<DescriptorArray> descriptors =
-      DescriptorArray::CopyUpTo(old_descriptors, number_of_own_descriptors);
+  Handle<DescriptorArray> descriptors = DescriptorArray::CopyUpTo(
+      isolate, old_descriptors, number_of_own_descriptors);
   descriptors->GeneralizeAllFields();
 
   Handle<LayoutDescriptor> new_layout_descriptor(
       LayoutDescriptor::FastPointerLayout(), isolate);
   Handle<Map> new_map = CopyReplaceDescriptors(
-      map, descriptors, new_layout_descriptor, OMIT_TRANSITION,
+      isolate, map, descriptors, new_layout_descriptor, OMIT_TRANSITION,
       MaybeHandle<Name>(), reason, SPECIAL_TRANSITION);
 
   // Unless the instance is being migrated, ensure that modify_index is a field.
   if (modify_index >= 0) {
     PropertyDetails details = descriptors->GetDetails(modify_index);
-    if (details.constness() != kMutable || details.location() != kField ||
-        details.attributes() != attributes) {
+    if (details.constness() != PropertyConstness::kMutable ||
+        details.location() != kField || details.attributes() != attributes) {
       int field_index = details.location() == kField
                             ? details.field_index()
                             : new_map->NumberOfFields();
@@ -4447,41 +4527,40 @@ Handle<Map> Map::CopyGeneralizeAllFields(Handle<Map> map,
             map->instance_descriptors()->GetFieldType(modify_index), isolate);
       }
       map->PrintGeneralization(
-          stdout, reason, modify_index, new_map->NumberOfOwnDescriptors(),
-          new_map->NumberOfOwnDescriptors(), details.location() == kDescriptor,
-          details.representation(), Representation::Tagged(), field_type,
-          MaybeHandle<Object>(), FieldType::Any(isolate),
-          MaybeHandle<Object>());
+          isolate, stdout, reason, modify_index,
+          new_map->NumberOfOwnDescriptors(), new_map->NumberOfOwnDescriptors(),
+          details.location() == kDescriptor, details.representation(),
+          Representation::Tagged(), field_type, MaybeHandle<Object>(),
+          FieldType::Any(isolate), MaybeHandle<Object>());
     }
   }
   new_map->set_elements_kind(elements_kind);
   return new_map;
 }
 
-void Map::DeprecateTransitionTree() {
+void Map::DeprecateTransitionTree(Isolate* isolate) {
   if (is_deprecated()) return;
   DisallowHeapAllocation no_gc;
-  TransitionsAccessor transitions(this, &no_gc);
+  TransitionsAccessor transitions(isolate, this, &no_gc);
   int num_transitions = transitions.NumberOfTransitions();
   for (int i = 0; i < num_transitions; ++i) {
-    transitions.GetTarget(i)->DeprecateTransitionTree();
+    transitions.GetTarget(i)->DeprecateTransitionTree(isolate);
   }
   DCHECK(!constructor_or_backpointer()->IsFunctionTemplateInfo());
   set_is_deprecated(true);
   if (FLAG_trace_maps) {
-    LOG(GetIsolate(), MapEvent("Deprecate", this, nullptr));
+    LOG(isolate, MapEvent("Deprecate", this, nullptr));
   }
   dependent_code()->DeoptimizeDependentCodeGroup(
-      GetIsolate(), DependentCode::kTransitionGroup);
+      isolate, DependentCode::kTransitionGroup);
   NotifyLeafMapLayoutChange();
 }
 
 
 // Installs |new_descriptors| over the current instance_descriptors to ensure
 // proper sharing of descriptor arrays.
-void Map::ReplaceDescriptors(DescriptorArray* new_descriptors,
+void Map::ReplaceDescriptors(Isolate* isolate, DescriptorArray* new_descriptors,
                              LayoutDescriptor* new_layout_descriptor) {
-  Isolate* isolate = GetIsolate();
   // Don't overwrite the empty descriptor array or initial map's descriptors.
   if (NumberOfOwnDescriptors() == 0 || GetBackPointer()->IsUndefined(isolate)) {
     return;
@@ -4503,9 +4582,8 @@ void Map::ReplaceDescriptors(DescriptorArray* new_descriptors,
   set_owns_descriptors(false);
 }
 
-Map* Map::FindRootMap() const {
+Map* Map::FindRootMap(Isolate* isolate) const {
   const Map* result = this;
-  Isolate* isolate = GetIsolate();
   while (true) {
     Object* back = result->GetBackPointer();
     if (back->IsUndefined(isolate)) {
@@ -4520,11 +4598,10 @@ Map* Map::FindRootMap() const {
   }
 }
 
-Map* Map::FindFieldOwner(int descriptor) const {
+Map* Map::FindFieldOwner(Isolate* isolate, int descriptor) const {
   DisallowHeapAllocation no_allocation;
   DCHECK_EQ(kField, instance_descriptors()->GetDetails(descriptor).location());
   const Map* result = this;
-  Isolate* isolate = GetIsolate();
   while (true) {
     Object* back = result->GetBackPointer();
     if (back->IsUndefined(isolate)) break;
@@ -4535,18 +4612,18 @@ Map* Map::FindFieldOwner(int descriptor) const {
   return const_cast<Map*>(result);
 }
 
-void Map::UpdateFieldType(int descriptor, Handle<Name> name,
+void Map::UpdateFieldType(Isolate* isolate, int descriptor, Handle<Name> name,
                           PropertyConstness new_constness,
                           Representation new_representation,
-                          Handle<Object> new_wrapped_type) {
-  DCHECK(new_wrapped_type->IsSmi() || new_wrapped_type->IsWeakCell());
+                          MaybeObjectHandle new_wrapped_type) {
+  DCHECK(new_wrapped_type->IsSmi() || new_wrapped_type->IsWeakHeapObject());
   // We store raw pointers in the queue, so no allocations are allowed.
   DisallowHeapAllocation no_allocation;
   PropertyDetails details = instance_descriptors()->GetDetails(descriptor);
   if (details.location() != kField) return;
   DCHECK_EQ(kData, details.kind());
 
-  Zone zone(GetIsolate()->allocator(), ZONE_NAME);
+  Zone zone(isolate->allocator(), ZONE_NAME);
   ZoneQueue<Map*> backlog(&zone);
   backlog.push(this);
 
@@ -4554,7 +4631,7 @@ void Map::UpdateFieldType(int descriptor, Handle<Name> name,
     Map* current = backlog.front();
     backlog.pop();
 
-    TransitionsAccessor transitions(current, &no_allocation);
+    TransitionsAccessor transitions(isolate, current, &no_allocation);
     int num_transitions = transitions.NumberOfTransitions();
     for (int i = 0; i < num_transitions; ++i) {
       Map* target = transitions.GetTarget(i);
@@ -4573,8 +4650,9 @@ void Map::UpdateFieldType(int descriptor, Handle<Name> name,
 
     // Skip if already updated the shared descriptor.
     if ((FLAG_modify_map_inplace && new_constness != details.constness()) ||
-        descriptors->GetValue(descriptor) != *new_wrapped_type) {
-      DCHECK_IMPLIES(!FLAG_track_constant_fields, new_constness == kMutable);
+        descriptors->GetFieldType(descriptor) != *new_wrapped_type.object()) {
+      DCHECK_IMPLIES(!FLAG_track_constant_fields,
+                     new_constness == PropertyConstness::kMutable);
       Descriptor d = Descriptor::DataField(
           name, descriptors->GetFieldIndex(descriptor), details.attributes(),
           new_constness, new_representation, new_wrapped_type);
@@ -4606,12 +4684,10 @@ Handle<FieldType> Map::GeneralizeFieldType(Representation rep1,
 }
 
 // static
-void Map::GeneralizeField(Handle<Map> map, int modify_index,
+void Map::GeneralizeField(Isolate* isolate, Handle<Map> map, int modify_index,
                           PropertyConstness new_constness,
                           Representation new_representation,
                           Handle<FieldType> new_field_type) {
-  Isolate* isolate = map->GetIsolate();
-
   // Check if we actually need to generalize the field type at all.
   Handle<DescriptorArray> old_descriptors(map->instance_descriptors(), isolate);
   PropertyDetails old_details = old_descriptors->GetDetails(modify_index);
@@ -4620,7 +4696,7 @@ void Map::GeneralizeField(Handle<Map> map, int modify_index,
   Handle<FieldType> old_field_type(old_descriptors->GetFieldType(modify_index),
                                    isolate);
 
-  // Return if the current map is general enough to hold requested contness and
+  // Return if the current map is general enough to hold requested constness and
   // representation/field type.
   if (((FLAG_modify_map_inplace &&
         IsGeneralizableTo(new_constness, old_constness)) ||
@@ -4637,7 +4713,7 @@ void Map::GeneralizeField(Handle<Map> map, int modify_index,
   }
 
   // Determine the field owner.
-  Handle<Map> field_owner(map->FindFieldOwner(modify_index), isolate);
+  Handle<Map> field_owner(map->FindFieldOwner(isolate, modify_index), isolate);
   Handle<DescriptorArray> descriptors(field_owner->instance_descriptors(),
                                       isolate);
   DCHECK_EQ(*old_field_type, descriptors->GetFieldType(modify_index));
@@ -4650,17 +4726,17 @@ void Map::GeneralizeField(Handle<Map> map, int modify_index,
   }
 
   PropertyDetails details = descriptors->GetDetails(modify_index);
-  Handle<Name> name(descriptors->GetKey(modify_index));
+  Handle<Name> name(descriptors->GetKey(modify_index), isolate);
 
-  Handle<Object> wrapped_type(WrapFieldType(new_field_type));
-  field_owner->UpdateFieldType(modify_index, name, new_constness,
+  MaybeObjectHandle wrapped_type(WrapFieldType(new_field_type));
+  field_owner->UpdateFieldType(isolate, modify_index, name, new_constness,
                                new_representation, wrapped_type);
   field_owner->dependent_code()->DeoptimizeDependentCodeGroup(
       isolate, DependentCode::kFieldOwnerGroup);
 
   if (FLAG_trace_generalization) {
     map->PrintGeneralization(
-        stdout, "field type generalization", modify_index,
+        isolate, stdout, "field type generalization", modify_index,
         map->NumberOfOwnDescriptors(), map->NumberOfOwnDescriptors(), false,
         details.representation(), details.representation(), old_field_type,
         MaybeHandle<Object>(), new_field_type, MaybeHandle<Object>());
@@ -4669,37 +4745,38 @@ void Map::GeneralizeField(Handle<Map> map, int modify_index,
 
 // TODO(ishell): remove.
 // static
-Handle<Map> Map::ReconfigureProperty(Handle<Map> map, int modify_index,
-                                     PropertyKind new_kind,
+Handle<Map> Map::ReconfigureProperty(Isolate* isolate, Handle<Map> map,
+                                     int modify_index, PropertyKind new_kind,
                                      PropertyAttributes new_attributes,
                                      Representation new_representation,
                                      Handle<FieldType> new_field_type) {
   DCHECK_EQ(kData, new_kind);  // Only kData case is supported.
-  MapUpdater mu(map->GetIsolate(), map);
-  return mu.ReconfigureToDataField(modify_index, new_attributes, kConst,
+  MapUpdater mu(isolate, map);
+  return mu.ReconfigureToDataField(modify_index, new_attributes,
+                                   PropertyConstness::kConst,
                                    new_representation, new_field_type);
 }
 
 // TODO(ishell): remove.
 // static
-Handle<Map> Map::ReconfigureElementsKind(Handle<Map> map,
+Handle<Map> Map::ReconfigureElementsKind(Isolate* isolate, Handle<Map> map,
                                          ElementsKind new_elements_kind) {
-  MapUpdater mu(map->GetIsolate(), map);
+  MapUpdater mu(isolate, map);
   return mu.ReconfigureElementsKind(new_elements_kind);
 }
 
 // Generalize all fields and update the transition tree.
-Handle<Map> Map::GeneralizeAllFields(Handle<Map> map) {
-  Isolate* isolate = map->GetIsolate();
+Handle<Map> Map::GeneralizeAllFields(Isolate* isolate, Handle<Map> map) {
   Handle<FieldType> any_type = FieldType::Any(isolate);
 
-  Handle<DescriptorArray> descriptors(map->instance_descriptors());
+  Handle<DescriptorArray> descriptors(map->instance_descriptors(), isolate);
   for (int i = 0; i < map->NumberOfOwnDescriptors(); ++i) {
     PropertyDetails details = descriptors->GetDetails(i);
     if (details.location() == kField) {
       DCHECK_EQ(kData, details.kind());
       MapUpdater mu(isolate, map);
-      map = mu.ReconfigureToDataField(i, details.attributes(), kMutable,
+      map = mu.ReconfigureToDataField(i, details.attributes(),
+                                      PropertyConstness::kMutable,
                                       Representation::Tagged(), any_type);
     }
   }
@@ -4708,14 +4785,14 @@ Handle<Map> Map::GeneralizeAllFields(Handle<Map> map) {
 
 
 // static
-MaybeHandle<Map> Map::TryUpdate(Handle<Map> old_map) {
+MaybeHandle<Map> Map::TryUpdate(Isolate* isolate, Handle<Map> old_map) {
   DisallowHeapAllocation no_allocation;
-  DisallowDeoptimization no_deoptimization(old_map->GetIsolate());
+  DisallowDeoptimization no_deoptimization(isolate);
 
   if (!old_map->is_deprecated()) return old_map;
 
   // Check the state of the root map.
-  Map* root_map = old_map->FindRootMap();
+  Map* root_map = old_map->FindRootMap(isolate);
   if (root_map->is_deprecated()) {
     JSFunction* constructor = JSFunction::cast(root_map->GetConstructor());
     DCHECK(constructor->has_initial_map());
@@ -4724,7 +4801,7 @@ MaybeHandle<Map> Map::TryUpdate(Handle<Map> old_map) {
         old_map->elements_kind()) {
       return MaybeHandle<Map>();
     }
-    return handle(constructor->initial_map());
+    return handle(constructor->initial_map(), constructor->GetIsolate());
   }
   if (!old_map->EquivalentToForTransition(root_map)) return MaybeHandle<Map>();
 
@@ -4732,18 +4809,18 @@ MaybeHandle<Map> Map::TryUpdate(Handle<Map> old_map) {
   ElementsKind to_kind = old_map->elements_kind();
   if (from_kind != to_kind) {
     // Try to follow existing elements kind transitions.
-    root_map = root_map->LookupElementsTransitionMap(to_kind);
+    root_map = root_map->LookupElementsTransitionMap(isolate, to_kind);
     if (root_map == nullptr) return MaybeHandle<Map>();
     // From here on, use the map with correct elements kind as root map.
   }
-  Map* new_map = root_map->TryReplayPropertyTransitions(*old_map);
+  Map* new_map = root_map->TryReplayPropertyTransitions(isolate, *old_map);
   if (new_map == nullptr) return MaybeHandle<Map>();
-  return handle(new_map);
+  return handle(new_map, isolate);
 }
 
-Map* Map::TryReplayPropertyTransitions(Map* old_map) {
+Map* Map::TryReplayPropertyTransitions(Isolate* isolate, Map* old_map) {
   DisallowHeapAllocation no_allocation;
-  DisallowDeoptimization no_deoptimization(GetIsolate());
+  DisallowDeoptimization no_deoptimization(isolate);
 
   int root_nof = NumberOfOwnDescriptors();
 
@@ -4754,7 +4831,7 @@ Map* Map::TryReplayPropertyTransitions(Map* old_map) {
   for (int i = root_nof; i < old_nof; ++i) {
     PropertyDetails old_details = old_descriptors->GetDetails(i);
     Map* transition =
-        TransitionsAccessor(new_map, &no_allocation)
+        TransitionsAccessor(isolate, new_map, &no_allocation)
             .SearchTransition(old_descriptors->GetKey(i), old_details.kind(),
                               old_details.attributes());
     if (transition == nullptr) return nullptr;
@@ -4789,7 +4866,7 @@ Map* Map::TryReplayPropertyTransitions(Map* old_map) {
         } else {
           DCHECK_EQ(kDescriptor, old_details.location());
           DCHECK(!FLAG_track_constant_fields);
-          Object* old_value = old_descriptors->GetValue(i);
+          Object* old_value = old_descriptors->GetStrongValue(i);
           if (!new_type->NowContains(old_value)) {
             return nullptr;
           }
@@ -4805,9 +4882,9 @@ Map* Map::TryReplayPropertyTransitions(Map* old_map) {
       }
     } else {
       DCHECK_EQ(kDescriptor, new_details.location());
-      Object* old_value = old_descriptors->GetValue(i);
-      Object* new_value = new_descriptors->GetValue(i);
-      if (old_details.location() == kField || old_value != new_value) {
+      if (old_details.location() == kField ||
+          old_descriptors->GetStrongValue(i) !=
+              new_descriptors->GetStrongValue(i)) {
         return nullptr;
       }
     }
@@ -4818,9 +4895,9 @@ Map* Map::TryReplayPropertyTransitions(Map* old_map) {
 
 
 // static
-Handle<Map> Map::Update(Handle<Map> map) {
+Handle<Map> Map::Update(Isolate* isolate, Handle<Map> map) {
   if (!map->is_deprecated()) return map;
-  MapUpdater mu(map->GetIsolate(), map);
+  MapUpdater mu(isolate, map);
   return mu.Update();
 }
 
@@ -4904,9 +4981,33 @@ Maybe<bool> Object::SetPropertyInternal(LookupIterator* it,
         }
         return SetPropertyWithAccessor(it, value, should_throw);
       }
-      case LookupIterator::INTEGER_INDEXED_EXOTIC:
-        // TODO(verwaest): We should throw an exception if holder is receiver.
+      case LookupIterator::INTEGER_INDEXED_EXOTIC: {
+        // IntegerIndexedElementSet converts value to a Number/BigInt prior to
+        // the bounds check. The bounds check has already happened here, but
+        // perform the possibly effectful ToNumber (or ToBigInt) operation
+        // anyways.
+        auto holder = it->GetHolder<JSTypedArray>();
+        Handle<Object> throwaway_value;
+        if (holder->type() == kExternalBigInt64Array ||
+            holder->type() == kExternalBigUint64Array) {
+          ASSIGN_RETURN_ON_EXCEPTION_VALUE(
+              it->isolate(), throwaway_value,
+              BigInt::FromObject(it->isolate(), value), Nothing<bool>());
+        } else {
+          ASSIGN_RETURN_ON_EXCEPTION_VALUE(it->isolate(), throwaway_value,
+                                           Object::ToNumber(value),
+                                           Nothing<bool>());
+        }
+
+        // FIXME: Throw a TypeError if the holder is neutered here
+        // (IntegerIndexedElementSpec step 5).
+
+        // TODO(verwaest): Per spec, we should return false here (steps 6-9
+        // in IntegerIndexedElementSpec), resulting in an exception being thrown
+        // on OOB accesses in strict code. Historically, v8 has not done made
+        // this change due to uncertainty about web compat. (v8:4901)
         return Just(true);
+      }
 
       case LookupIterator::DATA:
         if (it->IsReadOnly()) {
@@ -5130,7 +5231,7 @@ Maybe<bool> Object::SetDataProperty(LookupIterator* it, Handle<Object> value) {
 
 #if VERIFY_HEAP
   if (FLAG_verify_heap) {
-    receiver->HeapObjectVerify();
+    receiver->HeapObjectVerify(it->isolate());
   }
 #endif
   return Just(true);
@@ -5177,7 +5278,7 @@ Maybe<bool> Object::AddDataProperty(LookupIterator* it, Handle<Object> value,
     if (receiver->IsJSArray()) {
       Handle<JSArray> array = Handle<JSArray>::cast(receiver);
       if (JSArray::WouldChangeReadOnlyLength(array, it->index())) {
-        RETURN_FAILURE(array->GetIsolate(), should_throw,
+        RETURN_FAILURE(isolate, should_throw,
                        NewTypeError(MessageTemplate::kStrictReadOnlyProperty,
                                     isolate->factory()->length_string(),
                                     Object::TypeOf(isolate, array), array));
@@ -5194,10 +5295,9 @@ Maybe<bool> Object::AddDataProperty(LookupIterator* it, Handle<Object> value,
     }
 
     Handle<JSObject> receiver_obj = Handle<JSObject>::cast(receiver);
-    Maybe<bool> result = JSObject::AddDataElement(
-        receiver_obj, it->index(), value, attributes, should_throw);
+    JSObject::AddDataElement(receiver_obj, it->index(), value, attributes);
     JSObject::ValidateElements(*receiver_obj);
-    return result;
+    return Just(true);
   } else {
     it->UpdateProtector();
     // Migrate to the most up-to-date map that will be able to store |value|
@@ -5212,7 +5312,7 @@ Maybe<bool> Object::AddDataProperty(LookupIterator* it, Handle<Object> value,
 
 #if VERIFY_HEAP
     if (FLAG_verify_heap) {
-      receiver->HeapObjectVerify();
+      receiver->HeapObjectVerify(isolate);
     }
 #endif
   }
@@ -5220,17 +5320,16 @@ Maybe<bool> Object::AddDataProperty(LookupIterator* it, Handle<Object> value,
   return Just(true);
 }
 
-
-void Map::EnsureDescriptorSlack(Handle<Map> map, int slack) {
+void Map::EnsureDescriptorSlack(Isolate* isolate, Handle<Map> map, int slack) {
   // Only supports adding slack to owned descriptors.
   DCHECK(map->owns_descriptors());
 
-  Handle<DescriptorArray> descriptors(map->instance_descriptors());
+  Handle<DescriptorArray> descriptors(map->instance_descriptors(), isolate);
   int old_size = map->NumberOfOwnDescriptors();
   if (slack <= descriptors->NumberOfSlackDescriptors()) return;
 
-  Handle<DescriptorArray> new_descriptors = DescriptorArray::CopyUpTo(
-      descriptors, old_size, slack);
+  Handle<DescriptorArray> new_descriptors =
+      DescriptorArray::CopyUpTo(isolate, descriptors, old_size, slack);
 
   DisallowHeapAllocation no_allocation;
   // The descriptors are still the same, so keep the layout descriptor.
@@ -5248,7 +5347,6 @@ void Map::EnsureDescriptorSlack(Handle<Map> map, int slack) {
   // will be lazily replaced by the extended cache when needed.
   new_descriptors->CopyEnumCacheFrom(*descriptors);
 
-  Isolate* isolate = map->GetIsolate();
   // Replace descriptors by new_descriptors in all maps that share it. The old
   // descriptors will not be trimmed in the mark-compactor, we need to mark
   // all its elements.
@@ -5265,8 +5363,8 @@ void Map::EnsureDescriptorSlack(Handle<Map> map, int slack) {
 }
 
 // static
-Handle<Map> Map::GetObjectCreateMap(Handle<HeapObject> prototype) {
-  Isolate* isolate = prototype->GetIsolate();
+Handle<Map> Map::GetObjectCreateMap(Isolate* isolate,
+                                    Handle<HeapObject> prototype) {
   Handle<Map> map(isolate->native_context()->object_function()->initial_map(),
                   isolate);
   if (map->prototype() == *prototype) return map;
@@ -5284,19 +5382,19 @@ Handle<Map> Map::GetObjectCreateMap(Handle<HeapObject> prototype) {
     if (info->HasObjectCreateMap()) {
       map = handle(info->ObjectCreateMap(), isolate);
     } else {
-      map = Map::CopyInitialMap(map);
-      Map::SetPrototype(map, prototype);
+      map = Map::CopyInitialMap(isolate, map);
+      Map::SetPrototype(isolate, map, prototype);
       PrototypeInfo::SetObjectCreateMap(info, map);
     }
     return map;
   }
 
-  return Map::TransitionToPrototype(map, prototype);
+  return Map::TransitionToPrototype(isolate, map, prototype);
 }
 
 // static
-MaybeHandle<Map> Map::TryGetObjectCreateMap(Handle<HeapObject> prototype) {
-  Isolate* isolate = prototype->GetIsolate();
+MaybeHandle<Map> Map::TryGetObjectCreateMap(Isolate* isolate,
+                                            Handle<HeapObject> prototype) {
   Handle<Map> map(isolate->native_context()->object_function()->initial_map(),
                   isolate);
   if (map->prototype() == *prototype) return map;
@@ -5321,9 +5419,10 @@ static int AppendUniqueCallbacks(Handle<TemplateList> callbacks,
   // Fill in new callback descriptors.  Process the callbacks from
   // back to front so that the last callback with a given name takes
   // precedence over previously added callbacks with that name.
+  Isolate* isolate = callbacks->GetIsolate();
   for (int i = nof_callbacks - 1; i >= 0; i--) {
-    Handle<AccessorInfo> entry(AccessorInfo::cast(callbacks->get(i)));
-    Handle<Name> key(Name::cast(entry->name()));
+    Handle<AccessorInfo> entry(AccessorInfo::cast(callbacks->get(i)), isolate);
+    Handle<Name> key(Name::cast(entry->name()), isolate);
     DCHECK(key->IsUniqueName());
     // Check if a descriptor with this name already exists before writing.
     if (!T::Contains(key, entry, valid_descriptors, array)) {
@@ -5373,9 +5472,10 @@ static bool ContainsMap(MapHandles const& maps, Map* map) {
   return false;
 }
 
-Map* Map::FindElementsKindTransitionedMap(MapHandles const& candidates) {
+Map* Map::FindElementsKindTransitionedMap(Isolate* isolate,
+                                          MapHandles const& candidates) {
   DisallowHeapAllocation no_allocation;
-  DisallowDeoptimization no_deoptimization(GetIsolate());
+  DisallowDeoptimization no_deoptimization(isolate);
 
   if (is_prototype_map()) return nullptr;
 
@@ -5385,9 +5485,9 @@ Map* Map::FindElementsKindTransitionedMap(MapHandles const& candidates) {
   Map* transition = nullptr;
   if (IsTransitionableFastElementsKind(kind)) {
     // Check the state of the root map.
-    Map* root_map = FindRootMap();
+    Map* root_map = FindRootMap(isolate);
     if (!EquivalentToForElementsKindTransition(root_map)) return nullptr;
-    root_map = root_map->LookupElementsTransitionMap(kind);
+    root_map = root_map->LookupElementsTransitionMap(isolate, kind);
     DCHECK_NOT_NULL(root_map);
     // Starting from the next existing elements kind transition try to
     // replay the property transitions that does not involve instance rewriting
@@ -5395,7 +5495,7 @@ Map* Map::FindElementsKindTransitionedMap(MapHandles const& candidates) {
     for (root_map = root_map->ElementsTransitionMap();
          root_map != nullptr && root_map->has_fast_elements();
          root_map = root_map->ElementsTransitionMap()) {
-      Map* current = root_map->TryReplayPropertyTransitions(this);
+      Map* current = root_map->TryReplayPropertyTransitions(isolate, this);
       if (current == nullptr) continue;
       if (InstancesNeedRewriting(current)) continue;
 
@@ -5409,10 +5509,10 @@ Map* Map::FindElementsKindTransitionedMap(MapHandles const& candidates) {
   return transition;
 }
 
-
-static Map* FindClosestElementsTransition(Map* map, ElementsKind to_kind) {
+static Map* FindClosestElementsTransition(Isolate* isolate, Map* map,
+                                          ElementsKind to_kind) {
   // Ensure we are requested to search elements kind transition "near the root".
-  DCHECK_EQ(map->FindRootMap()->NumberOfOwnDescriptors(),
+  DCHECK_EQ(map->FindRootMap(isolate)->NumberOfOwnDescriptors(),
             map->NumberOfOwnDescriptors());
   Map* current_map = map;
 
@@ -5428,15 +5528,13 @@ static Map* FindClosestElementsTransition(Map* map, ElementsKind to_kind) {
   return current_map;
 }
 
-
-Map* Map::LookupElementsTransitionMap(ElementsKind to_kind) {
-  Map* to_map = FindClosestElementsTransition(this, to_kind);
+Map* Map::LookupElementsTransitionMap(Isolate* isolate, ElementsKind to_kind) {
+  Map* to_map = FindClosestElementsTransition(isolate, this, to_kind);
   if (to_map->elements_kind() == to_kind) return to_map;
   return nullptr;
 }
 
-bool Map::IsMapInArrayPrototypeChain() const {
-  Isolate* isolate = GetIsolate();
+bool Map::IsMapInArrayPrototypeChain(Isolate* isolate) const {
   if (isolate->initial_array_prototype()->map() == this) {
     return true;
   }
@@ -5448,19 +5546,17 @@ bool Map::IsMapInArrayPrototypeChain() const {
   return false;
 }
 
-
-Handle<WeakCell> Map::WeakCellForMap(Handle<Map> map) {
-  Isolate* isolate = map->GetIsolate();
+Handle<WeakCell> Map::WeakCellForMap(Isolate* isolate, Handle<Map> map) {
   if (map->weak_cell_cache()->IsWeakCell()) {
-    return Handle<WeakCell>(WeakCell::cast(map->weak_cell_cache()));
+    return Handle<WeakCell>(WeakCell::cast(map->weak_cell_cache()), isolate);
   }
   Handle<WeakCell> weak_cell = isolate->factory()->NewWeakCell(map);
   map->set_weak_cell_cache(*weak_cell);
   return weak_cell;
 }
 
-
-static Handle<Map> AddMissingElementsTransitions(Handle<Map> map,
+static Handle<Map> AddMissingElementsTransitions(Isolate* isolate,
+                                                 Handle<Map> map,
                                                  ElementsKind to_kind) {
   DCHECK(IsTransitionElementsKind(map->elements_kind()));
 
@@ -5475,7 +5571,7 @@ static Handle<Map> AddMissingElementsTransitions(Handle<Map> map,
     if (IsFastElementsKind(kind)) {
       while (kind != to_kind && !IsTerminalElementsKind(kind)) {
         kind = GetNextTransitionElementsKind(kind);
-        current_map = Map::CopyAsElementsKind(current_map, kind, flag);
+        current_map = Map::CopyAsElementsKind(isolate, current_map, kind, flag);
       }
     }
   }
@@ -5483,30 +5579,28 @@ static Handle<Map> AddMissingElementsTransitions(Handle<Map> map,
   // In case we are exiting the fast elements kind system, just add the map in
   // the end.
   if (kind != to_kind) {
-    current_map = Map::CopyAsElementsKind(current_map, to_kind, flag);
+    current_map = Map::CopyAsElementsKind(isolate, current_map, to_kind, flag);
   }
 
   DCHECK(current_map->elements_kind() == to_kind);
   return current_map;
 }
 
-
-Handle<Map> Map::TransitionElementsTo(Handle<Map> map,
+Handle<Map> Map::TransitionElementsTo(Isolate* isolate, Handle<Map> map,
                                       ElementsKind to_kind) {
   ElementsKind from_kind = map->elements_kind();
   if (from_kind == to_kind) return map;
 
-  Isolate* isolate = map->GetIsolate();
   Context* native_context = isolate->context()->native_context();
   if (from_kind == FAST_SLOPPY_ARGUMENTS_ELEMENTS) {
     if (*map == native_context->fast_aliased_arguments_map()) {
       DCHECK_EQ(SLOW_SLOPPY_ARGUMENTS_ELEMENTS, to_kind);
-      return handle(native_context->slow_aliased_arguments_map());
+      return handle(native_context->slow_aliased_arguments_map(), isolate);
     }
   } else if (from_kind == SLOW_SLOPPY_ARGUMENTS_ELEMENTS) {
     if (*map == native_context->slow_aliased_arguments_map()) {
       DCHECK_EQ(FAST_SLOPPY_ARGUMENTS_ELEMENTS, to_kind);
-      return handle(native_context->fast_aliased_arguments_map());
+      return handle(native_context->fast_aliased_arguments_map(), isolate);
     }
   } else if (IsFastElementsKind(from_kind) && IsFastElementsKind(to_kind)) {
     // Reuse map transitions for JSArrays.
@@ -5526,7 +5620,7 @@ Handle<Map> Map::TransitionElementsTo(Handle<Map> map,
       to_kind == GetPackedElementsKind(from_kind) &&
       map->GetBackPointer()->IsMap() &&
       Map::cast(map->GetBackPointer())->elements_kind() == to_kind) {
-    return handle(Map::cast(map->GetBackPointer()));
+    return handle(Map::cast(map->GetBackPointer()), isolate);
   }
 
   bool allow_store_transition = IsTransitionElementsKind(from_kind);
@@ -5538,29 +5632,31 @@ Handle<Map> Map::TransitionElementsTo(Handle<Map> map,
   }
 
   if (!allow_store_transition) {
-    return Map::CopyAsElementsKind(map, to_kind, OMIT_TRANSITION);
+    return Map::CopyAsElementsKind(isolate, map, to_kind, OMIT_TRANSITION);
   }
 
-  return Map::ReconfigureElementsKind(map, to_kind);
+  return Map::ReconfigureElementsKind(isolate, map, to_kind);
 }
 
 
 // static
-Handle<Map> Map::AsElementsKind(Handle<Map> map, ElementsKind kind) {
-  Handle<Map> closest_map(FindClosestElementsTransition(*map, kind));
+Handle<Map> Map::AsElementsKind(Isolate* isolate, Handle<Map> map,
+                                ElementsKind kind) {
+  Handle<Map> closest_map(FindClosestElementsTransition(isolate, *map, kind),
+                          isolate);
 
   if (closest_map->elements_kind() == kind) {
     return closest_map;
   }
 
-  return AddMissingElementsTransitions(closest_map, kind);
+  return AddMissingElementsTransitions(isolate, closest_map, kind);
 }
 
 
 Handle<Map> JSObject::GetElementsTransitionMap(Handle<JSObject> object,
                                                ElementsKind to_kind) {
-  Handle<Map> map(object->map());
-  return Map::TransitionElementsTo(map, to_kind);
+  Handle<Map> map(object->map(), object->GetIsolate());
+  return Map::TransitionElementsTo(object->GetIsolate(), map, to_kind);
 }
 
 
@@ -5569,9 +5665,9 @@ void JSProxy::Revoke(Handle<JSProxy> proxy) {
   // ES#sec-proxy-revocation-functions
   if (!proxy->IsRevoked()) {
     // 5. Set p.[[ProxyTarget]] to null.
-    proxy->set_target(isolate->heap()->null_value());
+    proxy->set_target(ReadOnlyRoots(isolate).null_value());
     // 6. Set p.[[ProxyHandler]] to null.
-    proxy->set_handler(isolate->heap()->null_value());
+    proxy->set_handler(ReadOnlyRoots(isolate).null_value());
   }
   DCHECK(proxy->IsRevoked());
 }
@@ -5632,7 +5728,7 @@ Maybe<bool> JSProxy::HasProperty(Isolate* isolate, Handle<JSProxy> proxy,
       isolate, trap_result_obj,
       Execution::Call(isolate, trap, handler, arraysize(args), args),
       Nothing<bool>());
-  bool boolean_trap_result = trap_result_obj->BooleanValue();
+  bool boolean_trap_result = trap_result_obj->BooleanValue(isolate);
   // 9. If booleanTrapResult is false, then:
   if (!boolean_trap_result) {
     MAYBE_RETURN(JSProxy::CheckHasTrap(isolate, name, target), Nothing<bool>());
@@ -5705,7 +5801,7 @@ Maybe<bool> JSProxy::SetProperty(Handle<JSProxy> proxy, Handle<Name> name,
       isolate, trap_result,
       Execution::Call(isolate, trap, handler, arraysize(args), args),
       Nothing<bool>());
-  if (!trap_result->BooleanValue()) {
+  if (!trap_result->BooleanValue(isolate)) {
     RETURN_FAILURE(isolate, should_throw,
                    NewTypeError(MessageTemplate::kProxyTrapReturnedFalsishFor,
                                 trap_name, name));
@@ -5753,7 +5849,7 @@ Maybe<bool> JSProxy::DeletePropertyOrElement(Handle<JSProxy> proxy,
       isolate, trap_result,
       Execution::Call(isolate, trap, handler, arraysize(args), args),
       Nothing<bool>());
-  if (!trap_result->BooleanValue()) {
+  if (!trap_result->BooleanValue(isolate)) {
     RETURN_FAILURE(isolate, should_throw,
                    NewTypeError(MessageTemplate::kProxyTrapReturnedFalsishFor,
                                 trap_name, name));
@@ -5806,7 +5902,8 @@ MaybeHandle<Context> JSProxy::GetFunctionRealm(Handle<JSProxy> proxy) {
     THROW_NEW_ERROR(proxy->GetIsolate(),
                     NewTypeError(MessageTemplate::kProxyRevoked), Context);
   }
-  Handle<JSReceiver> target(JSReceiver::cast(proxy->target()));
+  Handle<JSReceiver> target(JSReceiver::cast(proxy->target()),
+                            proxy->GetIsolate());
   return JSReceiver::GetFunctionRealm(target);
 }
 
@@ -5816,7 +5913,7 @@ MaybeHandle<Context> JSBoundFunction::GetFunctionRealm(
     Handle<JSBoundFunction> function) {
   DCHECK(function->map()->is_constructor());
   return JSReceiver::GetFunctionRealm(
-      handle(function->bound_target_function()));
+      handle(function->bound_target_function(), function->GetIsolate()));
 }
 
 // static
@@ -5902,7 +5999,7 @@ Maybe<int> JSFunction::GetLength(Isolate* isolate,
 // static
 Handle<Context> JSFunction::GetFunctionRealm(Handle<JSFunction> function) {
   DCHECK(function->map()->is_constructor());
-  return handle(function->context()->native_context());
+  return handle(function->context()->native_context(), function->GetIsolate());
 }
 
 
@@ -5958,7 +6055,7 @@ void JSObject::AllocateStorageForMap(Handle<JSObject> object, Handle<Map> map) {
     } else {
       TransitionElementsKind(object, to_kind);
     }
-    map = Map::ReconfigureElementsKind(map, to_kind);
+    map = Map::ReconfigureElementsKind(object->GetIsolate(), map, to_kind);
   }
   int number_of_fields = map->NumberOfFields();
   int inobject = map->GetInObjectProperties();
@@ -5971,7 +6068,7 @@ void JSObject::AllocateStorageForMap(Handle<JSObject> object, Handle<Map> map) {
   if (!FLAG_unbox_double_fields || external > 0) {
     Isolate* isolate = object->GetIsolate();
 
-    Handle<DescriptorArray> descriptors(map->instance_descriptors());
+    Handle<DescriptorArray> descriptors(map->instance_descriptors(), isolate);
     Handle<FixedArray> storage;
     if (!FLAG_unbox_double_fields) {
       storage = isolate->factory()->NewFixedArray(inobject);
@@ -5986,7 +6083,7 @@ void JSObject::AllocateStorageForMap(Handle<JSObject> object, Handle<Map> map) {
       if (!representation.IsDouble()) continue;
       FieldIndex index = FieldIndex::ForDescriptor(*map, i);
       if (map->IsUnboxedDoubleField(index)) continue;
-      Handle<HeapNumber> box = isolate->factory()->NewMutableHeapNumber();
+      auto box = isolate->factory()->NewMutableHeapNumberWithHoleNaN();
       if (index.is_inobject()) {
         storage->set(index.property_index(), *box);
       } else {
@@ -6009,8 +6106,8 @@ void JSObject::AllocateStorageForMap(Handle<JSObject> object, Handle<Map> map) {
 
 
 void JSObject::MigrateInstance(Handle<JSObject> object) {
-  Handle<Map> original_map(object->map());
-  Handle<Map> map = Map::Update(original_map);
+  Handle<Map> original_map(object->map(), object->GetIsolate());
+  Handle<Map> map = Map::Update(object->GetIsolate(), original_map);
   map->set_is_migration_target(true);
   MigrateToMap(object, map);
   if (FLAG_trace_migration) {
@@ -6018,7 +6115,7 @@ void JSObject::MigrateInstance(Handle<JSObject> object) {
   }
 #if VERIFY_HEAP
   if (FLAG_verify_heap) {
-    object->JSObjectVerify();
+    object->JSObjectVerify(object->GetIsolate());
   }
 #endif
 }
@@ -6030,7 +6127,7 @@ bool JSObject::TryMigrateInstance(Handle<JSObject> object) {
   DisallowDeoptimization no_deoptimization(isolate);
   Handle<Map> original_map(object->map(), isolate);
   Handle<Map> new_map;
-  if (!Map::TryUpdate(original_map).ToHandle(&new_map)) {
+  if (!Map::TryUpdate(isolate, original_map).ToHandle(&new_map)) {
     return false;
   }
   JSObject::MigrateToMap(object, new_map);
@@ -6039,17 +6136,17 @@ bool JSObject::TryMigrateInstance(Handle<JSObject> object) {
   }
 #if VERIFY_HEAP
   if (FLAG_verify_heap) {
-    object->JSObjectVerify();
+    object->JSObjectVerify(isolate);
   }
 #endif
   return true;
 }
 
-
-void JSObject::AddProperty(Handle<JSObject> object, Handle<Name> name,
-                           Handle<Object> value,
+void JSObject::AddProperty(Isolate* isolate, Handle<JSObject> object,
+                           Handle<Name> name, Handle<Object> value,
                            PropertyAttributes attributes) {
-  LookupIterator it(object, name, object, LookupIterator::OWN_SKIP_INTERCEPTOR);
+  LookupIterator it(isolate, object, name, object,
+                    LookupIterator::OWN_SKIP_INTERCEPTOR);
   CHECK_NE(LookupIterator::ACCESS_CHECK, it.state());
 #ifdef DEBUG
   uint32_t index;
@@ -6170,7 +6267,7 @@ Maybe<bool> JSObject::DefineOwnPropertyIgnoreAttributes(
 MaybeHandle<Object> JSObject::SetOwnPropertyIgnoreAttributes(
     Handle<JSObject> object, Handle<Name> name, Handle<Object> value,
     PropertyAttributes attributes) {
-  DCHECK(!value->IsTheHole(object->GetIsolate()));
+  DCHECK(!value->IsTheHole());
   LookupIterator it(object, name, object, LookupIterator::OWN);
   return DefineOwnPropertyIgnoreAttributes(&it, value, attributes);
 }
@@ -6251,7 +6348,7 @@ MaybeHandle<Map> NormalizedMapCache::Get(Handle<Map> fast_map,
   if (!normalized_map->EquivalentToForNormalization(*fast_map, mode)) {
     return MaybeHandle<Map>();
   }
-  return handle(normalized_map);
+  return handle(normalized_map, normalized_map->GetIsolate());
 }
 
 void NormalizedMapCache::Set(Handle<Map> fast_map, Handle<Map> normalized_map,
@@ -6277,8 +6374,8 @@ void JSObject::NormalizeProperties(Handle<JSObject> object,
                                    const char* reason) {
   if (!object->HasFastProperties()) return;
 
-  Handle<Map> map(object->map());
-  Handle<Map> new_map = Map::Normalize(map, mode, reason);
+  Handle<Map> map(object->map(), object->GetIsolate());
+  Handle<Map> new_map = Map::Normalize(object->GetIsolate(), map, mode, reason);
 
   MigrateToMap(object, new_map, expected_additional_properties);
 }
@@ -6291,7 +6388,7 @@ void JSObject::MigrateSlowToFast(Handle<JSObject> object,
   DCHECK(!object->IsJSGlobalObject());
   Isolate* isolate = object->GetIsolate();
   Factory* factory = isolate->factory();
-  Handle<NameDictionary> dictionary(object->property_dictionary());
+  Handle<NameDictionary> dictionary(object->property_dictionary(), isolate);
 
   // Make sure we preserve dictionary representation if there are too many
   // descriptors.
@@ -6327,9 +6424,12 @@ void JSObject::MigrateSlowToFast(Handle<JSObject> object,
   int inobject_props = old_map->GetInObjectProperties();
 
   // Allocate new map.
-  Handle<Map> new_map = Map::CopyDropDescriptors(old_map);
-  new_map->set_may_have_interesting_symbols(new_map->has_named_interceptor() ||
-                                            new_map->is_access_check_needed());
+  Handle<Map> new_map = Map::CopyDropDescriptors(isolate, old_map);
+  if (new_map->has_named_interceptor() || new_map->is_access_check_needed()) {
+    // Force certain slow paths when API interceptors are used, or if an access
+    // check is required.
+    new_map->set_may_have_interesting_symbols(true);
+  }
   new_map->set_is_dictionary_map(false);
 
   NotifyMapChange(old_map, new_map, isolate);
@@ -6344,7 +6444,7 @@ void JSObject::MigrateSlowToFast(Handle<JSObject> object,
     // Transform the object.
     new_map->SetInObjectUnusedPropertyFields(inobject_props);
     object->synchronized_set_map(*new_map);
-    object->SetProperties(isolate->heap()->empty_fixed_array());
+    object->SetProperties(ReadOnlyRoots(isolate).empty_fixed_array());
     // Check that it really works.
     DCHECK(object->HasFastProperties());
     return;
@@ -6388,7 +6488,7 @@ void JSObject::MigrateSlowToFast(Handle<JSObject> object,
 
     PropertyDetails details = dictionary->DetailsAt(index);
     DCHECK_EQ(kField, details.location());
-    DCHECK_EQ(kMutable, details.constness());
+    DCHECK_EQ(PropertyConstness::kMutable, details.constness());
 
     Descriptor d;
     if (details.kind() == kData) {
@@ -6400,12 +6500,13 @@ void JSObject::MigrateSlowToFast(Handle<JSObject> object,
         // transitionable.
         PropertyConstness constness =
             FLAG_track_constant_fields && !is_transitionable_elements_kind
-                ? kConst
-                : kMutable;
+                ? PropertyConstness::kConst
+                : PropertyConstness::kMutable;
         d = Descriptor::DataField(
             key, current_offset, details.attributes(), constness,
             // TODO(verwaest): value->OptimalRepresentation();
-            Representation::Tagged(), FieldType::Any(isolate));
+            Representation::Tagged(),
+            MaybeObjectHandle(FieldType::Any(isolate)));
       }
     } else {
       DCHECK_EQ(kAccessor, details.kind());
@@ -6472,7 +6573,7 @@ Handle<NumberDictionary> JSObject::NormalizeElements(Handle<JSObject> object) {
       elements = SloppyArgumentsElements::cast(elements)->arguments();
     }
 
-    if (elements->IsDictionary()) {
+    if (elements->IsNumberDictionary()) {
       return handle(NumberDictionary::cast(elements), isolate);
     }
   }
@@ -6505,9 +6606,9 @@ Handle<NumberDictionary> JSObject::NormalizeElements(Handle<JSObject> object) {
 
 #ifdef DEBUG
   if (FLAG_trace_normalization) {
-    OFStream os(stdout);
+    StdoutStream os;
     os << "Object elements have been normalized:\n";
-    object->Print(os);
+    object->Print(isolate, os);
   }
 #endif
 
@@ -6524,8 +6625,9 @@ Object* SetHashAndUpdateProperties(HeapObject* properties, int hash) {
   DCHECK(PropertyArray::HashField::is_valid(hash));
 
   Heap* heap = properties->GetHeap();
-  if (properties == heap->empty_fixed_array() ||
-      properties == heap->empty_property_array() ||
+  ReadOnlyRoots roots(heap);
+  if (properties == roots.empty_fixed_array() ||
+      properties == roots.empty_property_array() ||
       properties == heap->empty_property_dictionary()) {
     return Smi::FromInt(hash);
   }
@@ -6536,7 +6638,7 @@ Object* SetHashAndUpdateProperties(HeapObject* properties, int hash) {
     return properties;
   }
 
-  DCHECK(properties->IsDictionary());
+  DCHECK(properties->IsNameDictionary());
   NameDictionary::cast(properties)->SetHash(hash);
   return properties;
 }
@@ -6561,7 +6663,7 @@ int GetIdentityHashHelper(Isolate* isolate, JSReceiver* object) {
   }
 
 #ifdef DEBUG
-  FixedArray* empty_fixed_array = isolate->heap()->empty_fixed_array();
+  FixedArray* empty_fixed_array = ReadOnlyRoots(isolate).empty_fixed_array();
   FixedArray* empty_property_dictionary =
       isolate->heap()->empty_property_dictionary();
   DCHECK(properties == empty_fixed_array ||
@@ -6586,9 +6688,9 @@ void JSReceiver::SetIdentityHash(int hash) {
 void JSReceiver::SetProperties(HeapObject* properties) {
   DCHECK_IMPLIES(properties->IsPropertyArray() &&
                      PropertyArray::cast(properties)->length() == 0,
-                 properties == properties->GetHeap()->empty_property_array());
+                 properties == GetReadOnlyRoots().empty_property_array());
   DisallowHeapAllocation no_gc;
-  Isolate* isolate = properties->GetIsolate();
+  Isolate* isolate = GetIsolate();
   int hash = GetIdentityHashHelper(isolate, this);
   Object* new_properties = properties;
 
@@ -6606,7 +6708,7 @@ Object* JSReceiver::GetIdentityHash(Isolate* isolate) {
 
   int hash = GetIdentityHashHelper(isolate, this);
   if (hash == PropertyArray::kNoHashSentinel) {
-    return isolate->heap()->undefined_value();
+    return ReadOnlyRoots(isolate).undefined_value();
   }
 
   return Smi::FromInt(hash);
@@ -6677,15 +6779,15 @@ void JSReceiver::DeleteNormalizedProperty(Handle<JSReceiver> object,
   if (object->IsJSGlobalObject()) {
     // If we have a global object, invalidate the cell and swap in a new one.
     Handle<GlobalDictionary> dictionary(
-        JSGlobalObject::cast(*object)->global_dictionary());
+        JSGlobalObject::cast(*object)->global_dictionary(), isolate);
     DCHECK_NE(GlobalDictionary::kNotFound, entry);
 
-    auto cell = PropertyCell::InvalidateEntry(dictionary, entry);
-    cell->set_value(isolate->heap()->the_hole_value());
+    auto cell = PropertyCell::InvalidateEntry(isolate, dictionary, entry);
+    cell->set_value(ReadOnlyRoots(isolate).the_hole_value());
     cell->set_property_details(
         PropertyDetails::Empty(PropertyCellType::kUninitialized));
   } else {
-    Handle<NameDictionary> dictionary(object->property_dictionary());
+    Handle<NameDictionary> dictionary(object->property_dictionary(), isolate);
     DCHECK_NE(NameDictionary::kNotFound, entry);
 
     dictionary = NameDictionary::DeleteEntry(dictionary, entry);
@@ -6790,7 +6892,7 @@ Maybe<bool> JSReceiver::DeletePropertyOrElement(Handle<JSReceiver> object,
                                                 Handle<Name> name,
                                                 LanguageMode language_mode) {
   LookupIterator it = LookupIterator::PropertyOrElement(
-      name->GetIsolate(), object, name, object, LookupIterator::OWN);
+      object->GetIsolate(), object, name, object, LookupIterator::OWN);
   return DeleteProperty(&it, language_mode);
 }
 
@@ -6813,13 +6915,13 @@ Object* JSReceiver::DefineProperty(Isolate* isolate, Handle<Object> object,
   // 5. ReturnIfAbrupt(desc).
   PropertyDescriptor desc;
   if (!PropertyDescriptor::ToPropertyDescriptor(isolate, attributes, &desc)) {
-    return isolate->heap()->exception();
+    return ReadOnlyRoots(isolate).exception();
   }
   // 6. Let success be DefinePropertyOrThrow(O,key, desc).
   Maybe<bool> success = DefineOwnProperty(
       isolate, Handle<JSReceiver>::cast(object), key, &desc, kThrowOnError);
   // 7. ReturnIfAbrupt(success).
-  MAYBE_RETURN(success, isolate->heap()->exception());
+  MAYBE_RETURN(success, ReadOnlyRoots(isolate).exception());
   CHECK(success.FromJust());
   // 8. Return O.
   return *object;
@@ -6921,7 +7023,6 @@ Maybe<bool> JSReceiver::DefineOwnProperty(Isolate* isolate,
     return JSTypedArray::DefineOwnProperty(
         isolate, Handle<JSTypedArray>::cast(object), key, desc, should_throw);
   }
-  // TODO(neis): Special case for JSModuleNamespace?
 
   // OrdinaryDefineOwnProperty, by virtue of calling
   // DefineOwnPropertyIgnoreAttributes, can handle arguments
@@ -7346,7 +7447,7 @@ Maybe<bool> JSArray::DefineOwnProperty(Isolate* isolate, Handle<JSArray> o,
   // 1. Assert: IsPropertyKey(P) is true. ("P" is |name|.)
   // 2. If P is "length", then:
   // TODO(jkummerow): Check if we need slow string comparison.
-  if (*name == isolate->heap()->length_string()) {
+  if (*name == ReadOnlyRoots(isolate).length_string()) {
     // 2a. Return ArraySetLength(A, Desc).
     return ArraySetLength(isolate, o, desc, should_throw);
   }
@@ -7581,7 +7682,7 @@ Maybe<bool> JSProxy::DefineOwnProperty(Isolate* isolate, Handle<JSProxy> proxy,
       Execution::Call(isolate, trap, handler, arraysize(args), args),
       Nothing<bool>());
   // 10. If booleanTrapResult is false, return false.
-  if (!trap_result_obj->BooleanValue()) {
+  if (!trap_result_obj->BooleanValue(isolate)) {
     RETURN_FAILURE(isolate, should_throw,
                    NewTypeError(MessageTemplate::kProxyTrapReturnedFalsishFor,
                                 trap_name, property_name));
@@ -7666,7 +7767,7 @@ Maybe<bool> JSProxy::SetPrivateSymbol(Isolate* isolate, Handle<JSProxy> proxy,
     return Just(true);
   }
 
-  Handle<NameDictionary> dict(proxy->property_dictionary());
+  Handle<NameDictionary> dict(proxy->property_dictionary(), isolate);
   PropertyDetails details(kData, DONT_ENUM, PropertyCellType::kNoCell);
   Handle<NameDictionary> result =
       NameDictionary::Add(dict, private_name, value, details);
@@ -7921,7 +8022,7 @@ Maybe<bool> JSProxy::GetOwnPropertyDescriptor(Isolate* isolate,
 bool JSObject::ReferencesObjectFromElements(FixedArray* elements,
                                             ElementsKind kind,
                                             Object* object) {
-  Isolate* isolate = elements->GetIsolate();
+  Isolate* isolate = GetIsolate();
   if (IsObjectElementsKind(kind) || kind == FAST_STRING_WRAPPER_ELEMENTS) {
     int length = IsJSArray() ? Smi::ToInt(JSArray::cast(this)->length())
                              : elements->length();
@@ -7998,7 +8099,8 @@ bool JSObject::ReferencesObject(Object* obj) {
       }
       // Check the arguments.
       FixedArray* arguments = elements->arguments();
-      kind = arguments->IsDictionary() ? DICTIONARY_ELEMENTS : HOLEY_ELEMENTS;
+      kind = arguments->IsNumberDictionary() ? DICTIONARY_ELEMENTS
+                                             : HOLEY_ELEMENTS;
       if (ReferencesObjectFromElements(arguments, kind, obj)) return true;
       break;
     }
@@ -8148,7 +8250,7 @@ bool TestDictionaryPropertiesIntegrityLevel(Dictionary* dict, Isolate* isolate,
 
 bool TestFastPropertiesIntegrityLevel(Map* map, PropertyAttributes level) {
   DCHECK(level == SEALED || level == FROZEN);
-  DCHECK_LT(LAST_CUSTOM_ELEMENTS_RECEIVER, map->instance_type());
+  DCHECK(!map->IsCustomElementsReceiverMap());
   DCHECK(!map->is_dictionary_map());
 
   DescriptorArray* descriptors = map->instance_descriptors();
@@ -8165,7 +8267,7 @@ bool TestFastPropertiesIntegrityLevel(Map* map, PropertyAttributes level) {
 }
 
 bool TestPropertiesIntegrityLevel(JSObject* object, PropertyAttributes level) {
-  DCHECK_LT(LAST_CUSTOM_ELEMENTS_RECEIVER, object->map()->instance_type());
+  DCHECK(!object->map()->IsCustomElementsReceiverMap());
 
   if (object->HasFastProperties()) {
     return TestFastPropertiesIntegrityLevel(object->map(), level);
@@ -8193,7 +8295,7 @@ bool TestElementsIntegrityLevel(JSObject* object, PropertyAttributes level) {
 }
 
 bool FastTestIntegrityLevel(JSObject* object, PropertyAttributes level) {
-  DCHECK_LT(LAST_CUSTOM_ELEMENTS_RECEIVER, object->map()->instance_type());
+  DCHECK(!object->map()->IsCustomElementsReceiverMap());
 
   return !object->map()->is_extensible() &&
          TestElementsIntegrityLevel(object, level) &&
@@ -8236,7 +8338,7 @@ Maybe<bool> GenericTestIntegrityLevel(Handle<JSReceiver> receiver,
 
 Maybe<bool> JSReceiver::TestIntegrityLevel(Handle<JSReceiver> receiver,
                                            IntegrityLevel level) {
-  if (receiver->map()->instance_type() > LAST_CUSTOM_ELEMENTS_RECEIVER) {
+  if (!receiver->map()->IsCustomElementsReceiverMap()) {
     return JSObject::TestIntegrityLevel(Handle<JSObject>::cast(receiver),
                                         level);
   }
@@ -8245,7 +8347,7 @@ Maybe<bool> JSReceiver::TestIntegrityLevel(Handle<JSReceiver> receiver,
 
 Maybe<bool> JSObject::TestIntegrityLevel(Handle<JSObject> object,
                                          IntegrityLevel level) {
-  if (object->map()->instance_type() > LAST_CUSTOM_ELEMENTS_RECEIVER &&
+  if (!object->map()->IsCustomElementsReceiverMap() &&
       !object->HasSloppyArgumentsElements()) {
     return Just(FastTestIntegrityLevel(*object, level));
   }
@@ -8292,7 +8394,7 @@ Maybe<bool> JSProxy::PreventExtensions(Handle<JSProxy> proxy,
       isolate, trap_result,
       Execution::Call(isolate, trap, handler, arraysize(args), args),
       Nothing<bool>());
-  if (!trap_result->BooleanValue()) {
+  if (!trap_result->BooleanValue(isolate)) {
     RETURN_FAILURE(
         isolate, should_throw,
         NewTypeError(MessageTemplate::kProxyTrapReturnedFalsish, trap_name));
@@ -8319,7 +8421,7 @@ Maybe<bool> JSObject::PreventExtensions(Handle<JSObject> object,
   }
 
   if (object->IsAccessCheckNeeded() &&
-      !isolate->MayAccess(handle(isolate->context()), object)) {
+      !isolate->MayAccess(handle(isolate->context(), isolate), object)) {
     isolate->ReportFailedAccessCheck(object);
     RETURN_VALUE_IF_SCHEDULED_EXCEPTION(isolate, Nothing<bool>());
     RETURN_FAILURE(isolate, should_throw,
@@ -8355,7 +8457,8 @@ Maybe<bool> JSObject::PreventExtensions(Handle<JSObject> object,
   // Do a map transition, other objects with this map may still
   // be extensible.
   // TODO(adamk): Extend the NormalizedMapCache to handle non-extensible maps.
-  Handle<Map> new_map = Map::Copy(handle(object->map()), "PreventExtensions");
+  Handle<Map> new_map =
+      Map::Copy(isolate, handle(object->map(), isolate), "PreventExtensions");
 
   new_map->set_is_extensible(false);
   JSObject::MigrateToMap(object, new_map);
@@ -8404,7 +8507,7 @@ Maybe<bool> JSProxy::IsExtensible(Handle<JSProxy> proxy) {
   // Enforce the invariant.
   Maybe<bool> target_result = JSReceiver::IsExtensible(target);
   MAYBE_RETURN(target_result, Nothing<bool>());
-  if (target_result.FromJust() != trap_result->BooleanValue()) {
+  if (target_result.FromJust() != trap_result->BooleanValue(isolate)) {
     isolate->Throw(
         *factory->NewTypeError(MessageTemplate::kProxyIsExtensibleInconsistent,
                                factory->ToBoolean(target_result.FromJust())));
@@ -8417,7 +8520,7 @@ Maybe<bool> JSProxy::IsExtensible(Handle<JSProxy> proxy) {
 bool JSObject::IsExtensible(Handle<JSObject> object) {
   Isolate* isolate = object->GetIsolate();
   if (object->IsAccessCheckNeeded() &&
-      !isolate->MayAccess(handle(isolate->context()), object)) {
+      !isolate->MayAccess(handle(isolate->context(), isolate), object)) {
     return true;
   }
   if (object->IsJSGlobalProxy()) {
@@ -8466,7 +8569,7 @@ Maybe<bool> JSObject::PreventExtensionsWithTransition(
 
   Isolate* isolate = object->GetIsolate();
   if (object->IsAccessCheckNeeded() &&
-      !isolate->MayAccess(handle(isolate->context()), object)) {
+      !isolate->MayAccess(handle(isolate->context(), isolate), object)) {
     isolate->ReportFailedAccessCheck(object);
     RETURN_VALUE_IF_SCHEDULED_EXCEPTION(isolate, Nothing<bool>());
     RETURN_FAILURE(isolate, should_throw,
@@ -8525,7 +8628,7 @@ Maybe<bool> JSObject::PreventExtensionsWithTransition(
   }
 
   Handle<Map> old_map(object->map(), isolate);
-  TransitionsAccessor transitions(old_map);
+  TransitionsAccessor transitions(isolate, old_map);
   Map* transition = transitions.SearchSpecial(*transition_marker);
   if (transition != nullptr) {
     Handle<Map> transition_map(transition, isolate);
@@ -8537,7 +8640,7 @@ Maybe<bool> JSObject::PreventExtensionsWithTransition(
   } else if (transitions.CanHaveMoreTransitions()) {
     // Create a new descriptor array with the appropriate property attributes
     Handle<Map> new_map = Map::CopyForPreventExtensions(
-        old_map, attrs, transition_marker, "CopyForPreventExtensions");
+        isolate, old_map, attrs, transition_marker, "CopyForPreventExtensions");
     JSObject::MigrateToMap(object, new_map);
   } else {
     DCHECK(old_map->is_dictionary_map() || !old_map->is_prototype_map());
@@ -8547,8 +8650,8 @@ Maybe<bool> JSObject::PreventExtensionsWithTransition(
 
     // Create a new map, since other objects with this map may be extensible.
     // TODO(adamk): Extend the NormalizedMapCache to handle non-extensible maps.
-    Handle<Map> new_map =
-        Map::Copy(handle(object->map()), "SlowCopyForPreventExtensions");
+    Handle<Map> new_map = Map::Copy(isolate, handle(object->map(), isolate),
+                                    "SlowCopyForPreventExtensions");
     new_map->set_is_extensible(false);
     if (!new_element_dictionary.is_null()) {
       ElementsKind new_kind =
@@ -8590,7 +8693,8 @@ Maybe<bool> JSObject::PreventExtensionsWithTransition(
     object->set_elements(*new_element_dictionary);
   }
 
-  if (object->elements() != isolate->heap()->empty_slow_element_dictionary()) {
+  if (object->elements() !=
+      ReadOnlyRoots(isolate).empty_slow_element_dictionary()) {
     Handle<NumberDictionary> dictionary(object->element_dictionary(), isolate);
     // Make sure we never go back to the fast case
     object->RequireSlowElements(*dictionary);
@@ -8660,7 +8764,8 @@ MaybeHandle<Object> JSReceiver::OrdinaryToPrimitive(
   for (Handle<String> name : method_names) {
     Handle<Object> method;
     ASSIGN_RETURN_ON_EXCEPTION(isolate, method,
-                               JSReceiver::GetProperty(receiver, name), Object);
+                               JSReceiver::GetProperty(isolate, receiver, name),
+                               Object);
     if (method->IsCallable()) {
       Handle<Object> result;
       ASSIGN_RETURN_ON_EXCEPTION(
@@ -8785,7 +8890,7 @@ V8_WARN_UNUSED_RESULT Maybe<bool> FastGetOwnValuesOrEntries(
   if (!map->IsJSObjectMap()) return Just(false);
   if (!map->OnlyHasSimpleProperties()) return Just(false);
 
-  Handle<JSObject> object(JSObject::cast(*receiver));
+  Handle<JSObject> object(JSObject::cast(*receiver), isolate);
 
   Handle<DescriptorArray> descriptors(map->instance_descriptors(), isolate);
   int number_of_own_descriptors = map->NumberOfOwnDescriptors();
@@ -8795,7 +8900,7 @@ V8_WARN_UNUSED_RESULT Maybe<bool> FastGetOwnValuesOrEntries(
       number_of_own_descriptors + number_of_own_elements);
   int count = 0;
 
-  if (object->elements() != isolate->heap()->empty_fixed_array()) {
+  if (object->elements() != ReadOnlyRoots(isolate).empty_fixed_array()) {
     MAYBE_RETURN(object->GetElementsAccessor()->CollectValuesOrEntries(
                      isolate, object, values_or_entries, get_entries, &count,
                      ENUMERABLE_STRINGS),
@@ -8815,7 +8920,7 @@ V8_WARN_UNUSED_RESULT Maybe<bool> FastGetOwnValuesOrEntries(
       if (!details.IsEnumerable()) continue;
       if (details.kind() == kData) {
         if (details.location() == kDescriptor) {
-          prop_value = handle(descriptors->GetValue(index), isolate);
+          prop_value = handle(descriptors->GetStrongValue(index), isolate);
         } else {
           Representation representation = details.representation();
           FieldIndex field_index = FieldIndex::ForDescriptor(*map, index);
@@ -8824,7 +8929,8 @@ V8_WARN_UNUSED_RESULT Maybe<bool> FastGetOwnValuesOrEntries(
         }
       } else {
         ASSIGN_RETURN_ON_EXCEPTION_VALUE(
-            isolate, prop_value, JSReceiver::GetProperty(object, next_key),
+            isolate, prop_value,
+            JSReceiver::GetProperty(isolate, object, next_key),
             Nothing<bool>());
         stable = object->map() == *map;
       }
@@ -8848,8 +8954,8 @@ V8_WARN_UNUSED_RESULT Maybe<bool> FastGetOwnValuesOrEntries(
     count++;
   }
 
-  if (count < values_or_entries->length()) values_or_entries->Shrink(count);
-  *result = values_or_entries;
+  DCHECK_LE(count, values_or_entries->length());
+  *result = FixedArray::ShrinkOrEmpty(values_or_entries, count);
   return Just(true);
 }
 
@@ -8907,8 +9013,8 @@ MaybeHandle<FixedArray> GetOwnValuesOrEntries(Isolate* isolate,
     values_or_entries->set(length, *value);
     length++;
   }
-  if (length < values_or_entries->length()) values_or_entries->Shrink(length);
-  return values_or_entries;
+  DCHECK_LE(length, values_or_entries->length());
+  return FixedArray::ShrinkOrEmpty(values_or_entries, length);
 }
 
 MaybeHandle<FixedArray> JSReceiver::GetOwnValues(Handle<JSReceiver> object,
@@ -8925,6 +9031,18 @@ MaybeHandle<FixedArray> JSReceiver::GetOwnEntries(Handle<JSReceiver> object,
                                try_fast_path, true);
 }
 
+Handle<FixedArray> JSReceiver::GetOwnElementIndices(Isolate* isolate,
+                                                    Handle<JSReceiver> receiver,
+                                                    Handle<JSObject> object) {
+  KeyAccumulator accumulator(isolate, KeyCollectionMode::kOwnOnly,
+                             ALL_PROPERTIES);
+  accumulator.CollectOwnElementIndices(receiver, object);
+  Handle<FixedArray> keys =
+      accumulator.GetKeys(GetKeysConversion::kKeepNumbers);
+  DCHECK(keys->ContainsSortedNumbers());
+  return keys;
+}
+
 bool Map::DictionaryElementsInPrototypeChainOnly() {
   if (IsDictionaryElementsKind(elements_kind())) {
     return false;
@@ -9072,13 +9190,13 @@ Object* JSObject::SlowReverseLookup(Object* value) {
       } else {
         DCHECK_EQ(kDescriptor, details.location());
         if (details.kind() == kData) {
-          if (descs->GetValue(i) == value) {
+          if (descs->GetStrongValue(i) == value) {
             return descs->GetKey(i);
           }
         }
       }
     }
-    return GetHeap()->undefined_value();
+    return GetReadOnlyRoots().undefined_value();
   } else if (IsJSGlobalObject()) {
     return JSGlobalObject::cast(this)->global_dictionary()->SlowReverseLookup(
         value);
@@ -9087,14 +9205,13 @@ Object* JSObject::SlowReverseLookup(Object* value) {
   }
 }
 
-Handle<Map> Map::RawCopy(Handle<Map> map, int instance_size,
+Handle<Map> Map::RawCopy(Isolate* isolate, Handle<Map> map, int instance_size,
                          int inobject_properties) {
-  Isolate* isolate = map->GetIsolate();
   Handle<Map> result = isolate->factory()->NewMap(
       map->instance_type(), instance_size, TERMINAL_FAST_ELEMENTS_KIND,
       inobject_properties);
   Handle<Object> prototype(map->prototype(), isolate);
-  Map::SetPrototype(result, prototype);
+  Map::SetPrototype(isolate, result, prototype);
   result->set_constructor_or_backpointer(map->GetConstructor());
   result->set_bit_field(map->bit_field());
   result->set_bit_field2(map->bit_field2());
@@ -9111,12 +9228,10 @@ Handle<Map> Map::RawCopy(Handle<Map> map, int instance_size,
   return result;
 }
 
-
-Handle<Map> Map::Normalize(Handle<Map> fast_map, PropertyNormalizationMode mode,
-                           const char* reason) {
+Handle<Map> Map::Normalize(Isolate* isolate, Handle<Map> fast_map,
+                           PropertyNormalizationMode mode, const char* reason) {
   DCHECK(!fast_map->is_dictionary_map());
 
-  Isolate* isolate = fast_map->GetIsolate();
   Handle<Object> maybe_cache(isolate->native_context()->normalized_map_cache(),
                              isolate);
   bool use_cache =
@@ -9127,18 +9242,19 @@ Handle<Map> Map::Normalize(Handle<Map> fast_map, PropertyNormalizationMode mode,
   Handle<Map> new_map;
   if (use_cache && cache->Get(fast_map, mode).ToHandle(&new_map)) {
 #ifdef VERIFY_HEAP
-    if (FLAG_verify_heap) new_map->DictionaryMapVerify();
+    if (FLAG_verify_heap) new_map->DictionaryMapVerify(isolate);
 #endif
 #ifdef ENABLE_SLOW_DCHECKS
     if (FLAG_enable_slow_asserts) {
       // The cached map should match newly created normalized map bit-by-bit,
       // except for the code cache, which can contain some ICs which can be
       // applied to the shared map, dependent code and weak cell cache.
-      Handle<Map> fresh = Map::CopyNormalized(fast_map, mode);
+      Handle<Map> fresh = Map::CopyNormalized(isolate, fast_map, mode);
 
       if (new_map->is_prototype_map()) {
         // For prototype maps, the PrototypeInfo is not copied.
-        DCHECK_EQ(0, memcmp(fresh->address(), new_map->address(),
+        DCHECK_EQ(0, memcmp(reinterpret_cast<void*>(fresh->address()),
+                            reinterpret_cast<void*>(new_map->address()),
                             kTransitionsOrPrototypeInfoOffset));
         DCHECK_EQ(fresh->raw_transitions(),
                   MaybeObject::FromObject(Smi::kZero));
@@ -9148,7 +9264,8 @@ Handle<Map> Map::Normalize(Handle<Map> fast_map, PropertyNormalizationMode mode,
                             HeapObject::RawField(*new_map, kDescriptorsOffset),
                             kDependentCodeOffset - kDescriptorsOffset));
       } else {
-        DCHECK_EQ(0, memcmp(fresh->address(), new_map->address(),
+        DCHECK_EQ(0, memcmp(reinterpret_cast<void*>(fresh->address()),
+                            reinterpret_cast<void*>(new_map->address()),
                             Map::kDependentCodeOffset));
       }
       STATIC_ASSERT(Map::kWeakCellCacheOffset ==
@@ -9156,14 +9273,15 @@ Handle<Map> Map::Normalize(Handle<Map> fast_map, PropertyNormalizationMode mode,
       STATIC_ASSERT(Map::kPrototypeValidityCellOffset ==
                     Map::kWeakCellCacheOffset + kPointerSize);
       int offset = Map::kPrototypeValidityCellOffset + kPointerSize;
-      DCHECK_EQ(0, memcmp(fresh->address() + offset,
-                          new_map->address() + offset, Map::kSize - offset));
+      DCHECK_EQ(0, memcmp(reinterpret_cast<void*>(fresh->address() + offset),
+                          reinterpret_cast<void*>(new_map->address() + offset),
+                          Map::kSize - offset));
     }
 #endif
   } else {
-    new_map = Map::CopyNormalized(fast_map, mode);
+    new_map = Map::CopyNormalized(isolate, fast_map, mode);
     if (use_cache) {
-      Handle<WeakCell> cell = Map::WeakCellForMap(new_map);
+      Handle<WeakCell> cell = Map::WeakCellForMap(isolate, new_map);
       cache->Set(fast_map, new_map, cell);
       isolate->counters()->maps_normalized()->Increment();
     }
@@ -9175,8 +9293,7 @@ Handle<Map> Map::Normalize(Handle<Map> fast_map, PropertyNormalizationMode mode,
   return new_map;
 }
 
-
-Handle<Map> Map::CopyNormalized(Handle<Map> map,
+Handle<Map> Map::CopyNormalized(Isolate* isolate, Handle<Map> map,
                                 PropertyNormalizationMode mode) {
   int new_instance_size = map->instance_size();
   if (mode == CLEAR_INOBJECT_PROPERTIES) {
@@ -9184,7 +9301,7 @@ Handle<Map> Map::CopyNormalized(Handle<Map> map,
   }
 
   Handle<Map> result = RawCopy(
-      map, new_instance_size,
+      isolate, map, new_instance_size,
       mode == CLEAR_INOBJECT_PROPERTIES ? 0 : map->GetInObjectProperties());
   // Clear the unused_property_fields explicitly as this field should not
   // be accessed for normalized maps.
@@ -9195,7 +9312,7 @@ Handle<Map> Map::CopyNormalized(Handle<Map> map,
   result->set_construction_counter(kNoSlackTracking);
 
 #ifdef VERIFY_HEAP
-  if (FLAG_verify_heap) result->DictionaryMapVerify();
+  if (FLAG_verify_heap) result->DictionaryMapVerify(isolate);
 #endif
 
   return result;
@@ -9207,8 +9324,8 @@ Handle<Map> Map::CopyNormalized(Handle<Map> map,
 // memory on the map transition tree.
 
 // static
-Handle<Map> Map::TransitionToImmutableProto(Handle<Map> map) {
-  Handle<Map> new_map = Map::Copy(map, "ImmutablePrototype");
+Handle<Map> Map::TransitionToImmutableProto(Isolate* isolate, Handle<Map> map) {
+  Handle<Map> new_map = Map::Copy(isolate, map, "ImmutablePrototype");
   new_map->set_is_immutable_proto(true);
   return new_map;
 }
@@ -9243,18 +9360,19 @@ void EnsureInitialMap(Handle<Map> map) {
 }  // namespace
 
 // static
-Handle<Map> Map::CopyInitialMapNormalized(Handle<Map> map,
+Handle<Map> Map::CopyInitialMapNormalized(Isolate* isolate, Handle<Map> map,
                                           PropertyNormalizationMode mode) {
   EnsureInitialMap(map);
-  return CopyNormalized(map, mode);
+  return CopyNormalized(isolate, map, mode);
 }
 
 // static
-Handle<Map> Map::CopyInitialMap(Handle<Map> map, int instance_size,
-                                int inobject_properties,
+Handle<Map> Map::CopyInitialMap(Isolate* isolate, Handle<Map> map,
+                                int instance_size, int inobject_properties,
                                 int unused_property_fields) {
   EnsureInitialMap(map);
-  Handle<Map> result = RawCopy(map, instance_size, inobject_properties);
+  Handle<Map> result =
+      RawCopy(isolate, map, instance_size, inobject_properties);
 
   // Please note instance_type and instance_size are set when allocated.
   result->SetInObjectUnusedPropertyFields(unused_property_fields);
@@ -9273,10 +9391,9 @@ Handle<Map> Map::CopyInitialMap(Handle<Map> map, int instance_size,
   return result;
 }
 
-
-Handle<Map> Map::CopyDropDescriptors(Handle<Map> map) {
+Handle<Map> Map::CopyDropDescriptors(Isolate* isolate, Handle<Map> map) {
   Handle<Map> result =
-      RawCopy(map, map->instance_size(),
+      RawCopy(isolate, map, map->instance_size(),
               map->IsJSObjectMap() ? map->GetInObjectProperties() : 0);
 
   // Please note instance_type and instance_size are set when allocated.
@@ -9287,8 +9404,7 @@ Handle<Map> Map::CopyDropDescriptors(Handle<Map> map) {
   return result;
 }
 
-
-Handle<Map> Map::ShareDescriptor(Handle<Map> map,
+Handle<Map> Map::ShareDescriptor(Isolate* isolate, Handle<Map> map,
                                  Handle<DescriptorArray> descriptors,
                                  Descriptor* descriptor) {
   // Sanity check. This path is only to be taken if the map owns its descriptor
@@ -9297,7 +9413,7 @@ Handle<Map> Map::ShareDescriptor(Handle<Map> map,
   DCHECK_EQ(map->NumberOfOwnDescriptors(),
             map->instance_descriptors()->number_of_descriptors());
 
-  Handle<Map> result = CopyDropDescriptors(map);
+  Handle<Map> result = CopyDropDescriptors(isolate, map);
   Handle<Name> name = descriptor->GetKey();
 
   // Properly mark the {result} if the {name} is an "interesting symbol".
@@ -9309,18 +9425,18 @@ Handle<Map> Map::ShareDescriptor(Handle<Map> map,
   if (descriptors->NumberOfSlackDescriptors() == 0) {
     int old_size = descriptors->number_of_descriptors();
     if (old_size == 0) {
-      descriptors = DescriptorArray::Allocate(map->GetIsolate(), 0, 1);
+      descriptors = DescriptorArray::Allocate(isolate, 0, 1);
     } else {
       int slack = SlackForArraySize(old_size, kMaxNumberOfDescriptors);
-      EnsureDescriptorSlack(map, slack);
-      descriptors = handle(map->instance_descriptors());
+      EnsureDescriptorSlack(isolate, map, slack);
+      descriptors = handle(map->instance_descriptors(), isolate);
     }
   }
 
   Handle<LayoutDescriptor> layout_descriptor =
       FLAG_unbox_double_fields
           ? LayoutDescriptor::ShareAppend(map, descriptor->GetDetails())
-          : handle(LayoutDescriptor::FastPointerLayout(), map->GetIsolate());
+          : handle(LayoutDescriptor::FastPointerLayout(), isolate);
 
   {
     DisallowHeapAllocation no_gc;
@@ -9329,14 +9445,14 @@ Handle<Map> Map::ShareDescriptor(Handle<Map> map,
   }
 
   DCHECK(result->NumberOfOwnDescriptors() == map->NumberOfOwnDescriptors() + 1);
-  ConnectTransition(map, result, name, SIMPLE_PROPERTY_TRANSITION);
+  ConnectTransition(isolate, map, result, name, SIMPLE_PROPERTY_TRANSITION);
 
   return result;
 }
 
-void Map::ConnectTransition(Handle<Map> parent, Handle<Map> child,
-                            Handle<Name> name, SimpleTransitionFlag flag) {
-  Isolate* isolate = parent->GetIsolate();
+void Map::ConnectTransition(Isolate* isolate, Handle<Map> parent,
+                            Handle<Map> child, Handle<Name> name,
+                            SimpleTransitionFlag flag) {
   DCHECK_IMPLIES(name->IsInterestingSymbol(),
                  child->may_have_interesting_symbols());
   DCHECK_IMPLIES(parent->may_have_interesting_symbols(),
@@ -9366,22 +9482,21 @@ void Map::ConnectTransition(Handle<Map> parent, Handle<Map> child,
       LOG(isolate, MapEvent("Transition", *parent, *child, "prototype", *name));
     }
   } else {
-    TransitionsAccessor(parent).Insert(name, child, flag);
+    TransitionsAccessor(isolate, parent).Insert(name, child, flag);
     if (FLAG_trace_maps) {
       LOG(isolate, MapEvent("Transition", *parent, *child, "", *name));
     }
   }
 }
 
-
 Handle<Map> Map::CopyReplaceDescriptors(
-    Handle<Map> map, Handle<DescriptorArray> descriptors,
+    Isolate* isolate, Handle<Map> map, Handle<DescriptorArray> descriptors,
     Handle<LayoutDescriptor> layout_descriptor, TransitionFlag flag,
     MaybeHandle<Name> maybe_name, const char* reason,
     SimpleTransitionFlag simple_flag) {
-  DCHECK(descriptors->IsSortedNoDuplicates());
+  DCHECK(descriptors->IsSortedNoDuplicates(isolate));
 
-  Handle<Map> result = CopyDropDescriptors(map);
+  Handle<Map> result = CopyDropDescriptors(isolate, map);
 
   // Properly mark the {result} if the {name} is an "interesting symbol".
   Handle<Name> name;
@@ -9391,11 +9506,11 @@ Handle<Map> Map::CopyReplaceDescriptors(
 
   if (!map->is_prototype_map()) {
     if (flag == INSERT_TRANSITION &&
-        TransitionsAccessor(map).CanHaveMoreTransitions()) {
+        TransitionsAccessor(isolate, map).CanHaveMoreTransitions()) {
       result->InitializeDescriptors(*descriptors, *layout_descriptor);
 
       DCHECK(!maybe_name.is_null());
-      ConnectTransition(map, result, name, simple_flag);
+      ConnectTransition(isolate, map, result, name, simple_flag);
     } else {
       descriptors->GeneralizeAllFields();
       result->InitializeDescriptors(*descriptors,
@@ -9408,9 +9523,9 @@ Handle<Map> Map::CopyReplaceDescriptors(
       // Mirror conditions above that did not call ConnectTransition().
       (map->is_prototype_map() ||
        !(flag == INSERT_TRANSITION &&
-         TransitionsAccessor(map).CanHaveMoreTransitions()))) {
-    LOG(map->GetIsolate(), MapEvent("ReplaceDescriptors", *map, *result, reason,
-                                    maybe_name.is_null() ? nullptr : *name));
+         TransitionsAccessor(isolate, map).CanHaveMoreTransitions()))) {
+    LOG(isolate, MapEvent("ReplaceDescriptors", *map, *result, reason,
+                          maybe_name.is_null() ? nullptr : *name));
   }
   return result;
 }
@@ -9421,9 +9536,10 @@ Handle<Map> Map::CopyReplaceDescriptors(
 // The way how it is done is tricky because of GC and special descriptors
 // marking logic.
 Handle<Map> Map::AddMissingTransitions(
-    Handle<Map> split_map, Handle<DescriptorArray> descriptors,
+    Isolate* isolate, Handle<Map> split_map,
+    Handle<DescriptorArray> descriptors,
     Handle<LayoutDescriptor> full_layout_descriptor) {
-  DCHECK(descriptors->IsSortedNoDuplicates());
+  DCHECK(descriptors->IsSortedNoDuplicates(isolate));
   int split_nof = split_map->NumberOfOwnDescriptors();
   int nof_descriptors = descriptors->number_of_descriptors();
   DCHECK_LT(split_nof, nof_descriptors);
@@ -9437,7 +9553,7 @@ Handle<Map> Map::AddMissingTransitions(
   // Also the last map might have interesting symbols, we temporarily set
   // the flag and clear it right before the descriptors are installed. This
   // makes heap verification happy and ensures the flag ends up accurate.
-  Handle<Map> last_map = CopyDropDescriptors(split_map);
+  Handle<Map> last_map = CopyDropDescriptors(isolate, split_map);
   last_map->InitializeDescriptors(*descriptors, *full_layout_descriptor);
   last_map->SetInObjectUnusedPropertyFields(0);
   last_map->set_may_have_interesting_symbols(true);
@@ -9449,13 +9565,14 @@ Handle<Map> Map::AddMissingTransitions(
   // case for all the intermediate maps we create here.
   Handle<Map> map = split_map;
   for (int i = split_nof; i < nof_descriptors - 1; ++i) {
-    Handle<Map> new_map = CopyDropDescriptors(map);
-    InstallDescriptors(map, new_map, i, descriptors, full_layout_descriptor);
+    Handle<Map> new_map = CopyDropDescriptors(isolate, map);
+    InstallDescriptors(isolate, map, new_map, i, descriptors,
+                       full_layout_descriptor);
     map = new_map;
   }
   map->NotifyLeafMapLayoutChange();
   last_map->set_may_have_interesting_symbols(false);
-  InstallDescriptors(map, last_map, nof_descriptors - 1, descriptors,
+  InstallDescriptors(isolate, map, last_map, nof_descriptors - 1, descriptors,
                      full_layout_descriptor);
   return last_map;
 }
@@ -9463,11 +9580,11 @@ Handle<Map> Map::AddMissingTransitions(
 
 // Since this method is used to rewrite an existing transition tree, it can
 // always insert transitions without checking.
-void Map::InstallDescriptors(Handle<Map> parent, Handle<Map> child,
-                             int new_descriptor,
+void Map::InstallDescriptors(Isolate* isolate, Handle<Map> parent,
+                             Handle<Map> child, int new_descriptor,
                              Handle<DescriptorArray> descriptors,
                              Handle<LayoutDescriptor> full_layout_descriptor) {
-  DCHECK(descriptors->IsSortedNoDuplicates());
+  DCHECK(descriptors->IsSortedNoDuplicates(isolate));
 
   child->set_instance_descriptors(*descriptors);
   child->SetNumberOfOwnDescriptors(new_descriptor + 1);
@@ -9493,16 +9610,15 @@ void Map::InstallDescriptors(Handle<Map> parent, Handle<Map> child,
     child->set_visitor_id(Map::GetVisitorId(*child));
   }
 
-  Handle<Name> name = handle(descriptors->GetKey(new_descriptor));
+  Handle<Name> name = handle(descriptors->GetKey(new_descriptor), isolate);
   if (parent->may_have_interesting_symbols() || name->IsInterestingSymbol()) {
     child->set_may_have_interesting_symbols(true);
   }
-  ConnectTransition(parent, child, name, SIMPLE_PROPERTY_TRANSITION);
+  ConnectTransition(isolate, parent, child, name, SIMPLE_PROPERTY_TRANSITION);
 }
 
-
-Handle<Map> Map::CopyAsElementsKind(Handle<Map> map, ElementsKind kind,
-                                    TransitionFlag flag) {
+Handle<Map> Map::CopyAsElementsKind(Isolate* isolate, Handle<Map> map,
+                                    ElementsKind kind, TransitionFlag flag) {
   // Only certain objects are allowed to have non-terminal fast transitional
   // elements kinds.
   DCHECK(map->IsJSObjectMap());
@@ -9513,7 +9629,7 @@ Handle<Map> Map::CopyAsElementsKind(Handle<Map> map, ElementsKind kind,
   Map* maybe_elements_transition_map = nullptr;
   if (flag == INSERT_TRANSITION) {
     // Ensure we are requested to add elements kind transition "near the root".
-    DCHECK_EQ(map->FindRootMap()->NumberOfOwnDescriptors(),
+    DCHECK_EQ(map->FindRootMap(isolate)->NumberOfOwnDescriptors(),
               map->NumberOfOwnDescriptors());
 
     maybe_elements_transition_map = map->ElementsTransitionMap();
@@ -9526,44 +9642,44 @@ Handle<Map> Map::CopyAsElementsKind(Handle<Map> map, ElementsKind kind,
     DCHECK(kind != map->elements_kind());
   }
 
-  bool insert_transition = flag == INSERT_TRANSITION &&
-                           TransitionsAccessor(map).CanHaveMoreTransitions() &&
-                           maybe_elements_transition_map == nullptr;
+  bool insert_transition =
+      flag == INSERT_TRANSITION &&
+      TransitionsAccessor(isolate, map).CanHaveMoreTransitions() &&
+      maybe_elements_transition_map == nullptr;
 
   if (insert_transition) {
-    Handle<Map> new_map = CopyForTransition(map, "CopyAsElementsKind");
+    Handle<Map> new_map = CopyForTransition(isolate, map, "CopyAsElementsKind");
     new_map->set_elements_kind(kind);
 
-    Isolate* isolate = map->GetIsolate();
     Handle<Name> name = isolate->factory()->elements_transition_symbol();
-    ConnectTransition(map, new_map, name, SPECIAL_TRANSITION);
+    ConnectTransition(isolate, map, new_map, name, SPECIAL_TRANSITION);
     return new_map;
   }
 
   // Create a new free-floating map only if we are not allowed to store it.
-  Handle<Map> new_map = Copy(map, "CopyAsElementsKind");
+  Handle<Map> new_map = Copy(isolate, map, "CopyAsElementsKind");
   new_map->set_elements_kind(kind);
   return new_map;
 }
 
-Handle<Map> Map::AsLanguageMode(Handle<Map> initial_map,
+Handle<Map> Map::AsLanguageMode(Isolate* isolate, Handle<Map> initial_map,
                                 Handle<SharedFunctionInfo> shared_info) {
   DCHECK_EQ(JS_FUNCTION_TYPE, initial_map->instance_type());
   // Initial map for sloppy mode function is stored in the function
   // constructor. Initial maps for strict mode are cached as special transitions
   // using |strict_function_transition_symbol| as a key.
   if (is_sloppy(shared_info->language_mode())) return initial_map;
-  Isolate* isolate = initial_map->GetIsolate();
 
-  Handle<Map> function_map(Map::cast(
-      isolate->native_context()->get(shared_info->function_map_index())));
+  Handle<Map> function_map(Map::cast(isolate->native_context()->get(
+                               shared_info->function_map_index())),
+                           isolate);
 
   STATIC_ASSERT(LanguageModeSize == 2);
   DCHECK_EQ(LanguageMode::kStrict, shared_info->language_mode());
   Handle<Symbol> transition_symbol =
       isolate->factory()->strict_function_transition_symbol();
-  Map* maybe_transition =
-      TransitionsAccessor(initial_map).SearchSpecial(*transition_symbol);
+  Map* maybe_transition = TransitionsAccessor(isolate, initial_map)
+                              .SearchSpecial(*transition_symbol);
   if (maybe_transition != nullptr) {
     return handle(maybe_transition, isolate);
   }
@@ -9572,24 +9688,24 @@ Handle<Map> Map::AsLanguageMode(Handle<Map> initial_map,
   // Create new map taking descriptors from the |function_map| and all
   // the other details from the |initial_map|.
   Handle<Map> map =
-      Map::CopyInitialMap(function_map, initial_map->instance_size(),
+      Map::CopyInitialMap(isolate, function_map, initial_map->instance_size(),
                           initial_map->GetInObjectProperties(),
                           initial_map->UnusedPropertyFields());
   map->SetConstructor(initial_map->GetConstructor());
   map->set_prototype(initial_map->prototype());
   map->set_construction_counter(initial_map->construction_counter());
 
-  if (TransitionsAccessor(initial_map).CanHaveMoreTransitions()) {
-    Map::ConnectTransition(initial_map, map, transition_symbol,
+  if (TransitionsAccessor(isolate, initial_map).CanHaveMoreTransitions()) {
+    Map::ConnectTransition(isolate, initial_map, map, transition_symbol,
                            SPECIAL_TRANSITION);
   }
   return map;
 }
 
-
-Handle<Map> Map::CopyForTransition(Handle<Map> map, const char* reason) {
+Handle<Map> Map::CopyForTransition(Isolate* isolate, Handle<Map> map,
+                                   const char* reason) {
   DCHECK(!map->is_prototype_map());
-  Handle<Map> new_map = CopyDropDescriptors(map);
+  Handle<Map> new_map = CopyDropDescriptors(isolate, map);
 
   if (map->owns_descriptors()) {
     // In case the map owned its own descriptors, share the descriptors and
@@ -9600,39 +9716,38 @@ Handle<Map> Map::CopyForTransition(Handle<Map> map, const char* reason) {
   } else {
     // In case the map did not own its own descriptors, a split is forced by
     // copying the map; creating a new descriptor array cell.
-    Handle<DescriptorArray> descriptors(map->instance_descriptors());
+    Handle<DescriptorArray> descriptors(map->instance_descriptors(), isolate);
     int number_of_own_descriptors = map->NumberOfOwnDescriptors();
-    Handle<DescriptorArray> new_descriptors =
-        DescriptorArray::CopyUpTo(descriptors, number_of_own_descriptors);
+    Handle<DescriptorArray> new_descriptors = DescriptorArray::CopyUpTo(
+        isolate, descriptors, number_of_own_descriptors);
     Handle<LayoutDescriptor> new_layout_descriptor(map->GetLayoutDescriptor(),
-                                                   map->GetIsolate());
+                                                   isolate);
     new_map->InitializeDescriptors(*new_descriptors, *new_layout_descriptor);
   }
 
   if (FLAG_trace_maps) {
-    LOG(map->GetIsolate(),
-        MapEvent("CopyForTransition", *map, *new_map, reason));
+    LOG(isolate, MapEvent("CopyForTransition", *map, *new_map, reason));
   }
   return new_map;
 }
 
-
-Handle<Map> Map::Copy(Handle<Map> map, const char* reason) {
-  Handle<DescriptorArray> descriptors(map->instance_descriptors());
+Handle<Map> Map::Copy(Isolate* isolate, Handle<Map> map, const char* reason) {
+  Handle<DescriptorArray> descriptors(map->instance_descriptors(), isolate);
   int number_of_own_descriptors = map->NumberOfOwnDescriptors();
-  Handle<DescriptorArray> new_descriptors =
-      DescriptorArray::CopyUpTo(descriptors, number_of_own_descriptors);
+  Handle<DescriptorArray> new_descriptors = DescriptorArray::CopyUpTo(
+      isolate, descriptors, number_of_own_descriptors);
   Handle<LayoutDescriptor> new_layout_descriptor(map->GetLayoutDescriptor(),
-                                                 map->GetIsolate());
-  return CopyReplaceDescriptors(map, new_descriptors, new_layout_descriptor,
-                                OMIT_TRANSITION, MaybeHandle<Name>(), reason,
-                                SPECIAL_TRANSITION);
+                                                 isolate);
+  return CopyReplaceDescriptors(
+      isolate, map, new_descriptors, new_layout_descriptor, OMIT_TRANSITION,
+      MaybeHandle<Name>(), reason, SPECIAL_TRANSITION);
 }
 
 
 Handle<Map> Map::Create(Isolate* isolate, int inobject_properties) {
   Handle<Map> copy =
-      Copy(handle(isolate->object_function()->initial_map()), "MapCreate");
+      Copy(isolate, handle(isolate->object_function()->initial_map(), isolate),
+           "MapCreate");
 
   // Check that we do not overflow the instance size when adding the extra
   // inobject properties. If the instance size overflows, we allocate as many
@@ -9653,20 +9768,18 @@ Handle<Map> Map::Create(Isolate* isolate, int inobject_properties) {
   return copy;
 }
 
-
-Handle<Map> Map::CopyForPreventExtensions(Handle<Map> map,
+Handle<Map> Map::CopyForPreventExtensions(Isolate* isolate, Handle<Map> map,
                                           PropertyAttributes attrs_to_add,
                                           Handle<Symbol> transition_marker,
                                           const char* reason) {
   int num_descriptors = map->NumberOfOwnDescriptors();
-  Isolate* isolate = map->GetIsolate();
   Handle<DescriptorArray> new_desc = DescriptorArray::CopyUpToAddAttributes(
-      handle(map->instance_descriptors(), isolate), num_descriptors,
+      isolate, handle(map->instance_descriptors(), isolate), num_descriptors,
       attrs_to_add);
   Handle<LayoutDescriptor> new_layout_descriptor(map->GetLayoutDescriptor(),
                                                  isolate);
   Handle<Map> new_map = CopyReplaceDescriptors(
-      map, new_desc, new_layout_descriptor, INSERT_TRANSITION,
+      isolate, map, new_desc, new_layout_descriptor, INSERT_TRANSITION,
       transition_marker, reason, SPECIAL_TRANSITION);
   new_map->set_is_extensible(false);
   if (!IsFixedTypedArrayElementsKind(map->elements_kind())) {
@@ -9695,12 +9808,12 @@ bool CanHoldValue(DescriptorArray* descriptors, int descriptor,
 
   } else {
     DCHECK_EQ(kDescriptor, details.location());
-    DCHECK_EQ(kConst, details.constness());
+    DCHECK_EQ(PropertyConstness::kConst, details.constness());
     if (details.kind() == kData) {
       DCHECK(!FLAG_track_constant_fields);
-      DCHECK(descriptors->GetValue(descriptor) != value ||
+      DCHECK(descriptors->GetStrongValue(descriptor) != value ||
              value->FitsRepresentation(details.representation()));
-      return descriptors->GetValue(descriptor) == value;
+      return descriptors->GetStrongValue(descriptor) == value;
     } else {
       DCHECK_EQ(kAccessor, details.kind());
       return false;
@@ -9731,16 +9844,19 @@ Handle<Map> UpdateDescriptorForValue(Handle<Map> map, int descriptor,
 }  // namespace
 
 // static
-Handle<Map> Map::PrepareForDataProperty(Handle<Map> map, int descriptor,
+Handle<Map> Map::PrepareForDataProperty(Isolate* isolate, Handle<Map> map,
+                                        int descriptor,
                                         PropertyConstness constness,
                                         Handle<Object> value) {
   // Dictionaries can store any property value.
   DCHECK(!map->is_dictionary_map());
   // Update to the newest map before storing the property.
-  return UpdateDescriptorForValue(Update(map), descriptor, constness, value);
+  return UpdateDescriptorForValue(Update(isolate, map), descriptor, constness,
+                                  value);
 }
 
-Handle<Map> Map::TransitionToDataProperty(Handle<Map> map, Handle<Name> name,
+Handle<Map> Map::TransitionToDataProperty(Isolate* isolate, Handle<Map> map,
+                                          Handle<Name> name,
                                           Handle<Object> value,
                                           PropertyAttributes attributes,
                                           PropertyConstness constness,
@@ -9754,12 +9870,12 @@ Handle<Map> Map::TransitionToDataProperty(Handle<Map> map, Handle<Name> name,
   DCHECK(!map->is_dictionary_map());
 
   // Migrate to the newest map before storing the property.
-  map = Update(map);
+  map = Update(isolate, map);
 
-  Map* maybe_transition =
-      TransitionsAccessor(map).SearchTransition(*name, kData, attributes);
+  Map* maybe_transition = TransitionsAccessor(isolate, map)
+                              .SearchTransition(*name, kData, attributes);
   if (maybe_transition != nullptr) {
-    Handle<Map> transition(maybe_transition);
+    Handle<Map> transition(maybe_transition, isolate);
     int descriptor = transition->LastAdded();
 
     DCHECK_EQ(attributes, transition->instance_descriptors()
@@ -9771,25 +9887,26 @@ Handle<Map> Map::TransitionToDataProperty(Handle<Map> map, Handle<Name> name,
 
   TransitionFlag flag = INSERT_TRANSITION;
   MaybeHandle<Map> maybe_map;
-  if (!FLAG_track_constant_fields && value->IsJSFunction()) {
-    maybe_map = Map::CopyWithConstant(map, name, value, attributes, flag);
-  } else if (!map->TooManyFastProperties(store_mode)) {
-    Isolate* isolate = name->GetIsolate();
-    Representation representation = value->OptimalRepresentation();
-    Handle<FieldType> type = value->OptimalType(isolate, representation);
-    maybe_map = Map::CopyWithField(map, name, type, attributes, constness,
-                                   representation, flag);
+  if (!map->TooManyFastProperties(store_mode)) {
+    if (!FLAG_track_constant_fields && value->IsJSFunction()) {
+      maybe_map =
+          Map::CopyWithConstant(isolate, map, name, value, attributes, flag);
+    } else {
+      Representation representation = value->OptimalRepresentation();
+      Handle<FieldType> type = value->OptimalType(isolate, representation);
+      maybe_map = Map::CopyWithField(isolate, map, name, type, attributes,
+                                     constness, representation, flag);
+    }
   }
 
   Handle<Map> result;
   if (!maybe_map.ToHandle(&result)) {
-    Isolate* isolate = name->GetIsolate();
     const char* reason = "TooManyFastProperties";
 #if V8_TRACE_MAPS
     std::unique_ptr<ScopedVector<char>> buffer;
     if (FLAG_trace_maps) {
       ScopedVector<char> name_buffer(100);
-      name->NameShortPrint(name_buffer);
+      name->NameShortPrint(isolate, name_buffer);
       buffer.reset(new ScopedVector<char>(128));
       SNPrintF(*buffer, "TooManyFastProperties %s", name_buffer.start());
       reason = buffer->start();
@@ -9804,8 +9921,9 @@ Handle<Map> Map::TransitionToDataProperty(Handle<Map> map, Handle<Name> name,
       DCHECK_NE(*constructor,
                 constructor->context()->native_context()->object_function());
       Handle<Map> initial_map(constructor->initial_map(), isolate);
-      result = Map::Normalize(initial_map, CLEAR_INOBJECT_PROPERTIES, reason);
-      initial_map->DeprecateTransitionTree();
+      result = Map::Normalize(isolate, initial_map, CLEAR_INOBJECT_PROPERTIES,
+                              reason);
+      initial_map->DeprecateTransitionTree(isolate);
       Handle<Object> prototype(result->prototype(), isolate);
       JSFunction::SetInitialMap(constructor, result, prototype);
 
@@ -9814,19 +9932,19 @@ Handle<Map> Map::TransitionToDataProperty(Handle<Map> map, Handle<Name> name,
           isolate, DependentCode::kInitialMapChangedGroup);
       if (!result->EquivalentToForNormalization(*map,
                                                 CLEAR_INOBJECT_PROPERTIES)) {
-        result = Map::Normalize(map, CLEAR_INOBJECT_PROPERTIES, reason);
+        result =
+            Map::Normalize(isolate, map, CLEAR_INOBJECT_PROPERTIES, reason);
       }
     } else {
-      result = Map::Normalize(map, CLEAR_INOBJECT_PROPERTIES, reason);
+      result = Map::Normalize(isolate, map, CLEAR_INOBJECT_PROPERTIES, reason);
     }
   }
 
   return result;
 }
 
-
-Handle<Map> Map::ReconfigureExistingProperty(Handle<Map> map, int descriptor,
-                                             PropertyKind kind,
+Handle<Map> Map::ReconfigureExistingProperty(Isolate* isolate, Handle<Map> map,
+                                             int descriptor, PropertyKind kind,
                                              PropertyAttributes attributes) {
   // Dictionaries have to be reconfigured in-place.
   DCHECK(!map->is_dictionary_map());
@@ -9834,17 +9952,15 @@ Handle<Map> Map::ReconfigureExistingProperty(Handle<Map> map, int descriptor,
   if (!map->GetBackPointer()->IsMap()) {
     // There is no benefit from reconstructing transition tree for maps without
     // back pointers.
-    return CopyGeneralizeAllFields(map, map->elements_kind(), descriptor, kind,
-                                   attributes,
+    return CopyGeneralizeAllFields(isolate, map, map->elements_kind(),
+                                   descriptor, kind, attributes,
                                    "GenAll_AttributesMismatchProtoMap");
   }
 
   if (FLAG_trace_generalization) {
-    map->PrintReconfiguration(stdout, descriptor, kind, attributes);
+    map->PrintReconfiguration(isolate, stdout, descriptor, kind, attributes);
   }
 
-  Isolate* isolate = map->GetIsolate();
-
   MapUpdater mu(isolate, map);
   DCHECK_EQ(kData, kind);  // Only kData case is supported so far.
   Handle<Map> new_map = mu.ReconfigureToDataField(
@@ -9872,14 +9988,14 @@ Handle<Map> Map::TransitionToAccessorProperty(Isolate* isolate, Handle<Map> map,
   if (map->is_dictionary_map()) return map;
 
   // Migrate to the newest map before transitioning to the new property.
-  map = Update(map);
+  map = Update(isolate, map);
 
   PropertyNormalizationMode mode = map->is_prototype_map()
                                        ? KEEP_INOBJECT_PROPERTIES
                                        : CLEAR_INOBJECT_PROPERTIES;
 
-  Map* maybe_transition =
-      TransitionsAccessor(map).SearchTransition(*name, kAccessor, attributes);
+  Map* maybe_transition = TransitionsAccessor(isolate, map)
+                              .SearchTransition(*name, kAccessor, attributes);
   if (maybe_transition != nullptr) {
     Handle<Map> transition(maybe_transition, isolate);
     DescriptorArray* descriptors = transition->instance_descriptors();
@@ -9889,14 +10005,16 @@ Handle<Map> Map::TransitionToAccessorProperty(Isolate* isolate, Handle<Map> map,
     DCHECK_EQ(kAccessor, descriptors->GetDetails(descriptor).kind());
     DCHECK_EQ(attributes, descriptors->GetDetails(descriptor).attributes());
 
-    Handle<Object> maybe_pair(descriptors->GetValue(descriptor), isolate);
+    Handle<Object> maybe_pair(descriptors->GetStrongValue(descriptor), isolate);
     if (!maybe_pair->IsAccessorPair()) {
-      return Map::Normalize(map, mode, "TransitionToAccessorFromNonPair");
+      return Map::Normalize(isolate, map, mode,
+                            "TransitionToAccessorFromNonPair");
     }
 
     Handle<AccessorPair> pair = Handle<AccessorPair>::cast(maybe_pair);
     if (!pair->Equals(*getter, *setter)) {
-      return Map::Normalize(map, mode, "TransitionToDifferentAccessor");
+      return Map::Normalize(isolate, map, mode,
+                            "TransitionToDifferentAccessor");
     }
 
     return transition;
@@ -9906,20 +10024,22 @@ Handle<Map> Map::TransitionToAccessorProperty(Isolate* isolate, Handle<Map> map,
   DescriptorArray* old_descriptors = map->instance_descriptors();
   if (descriptor != DescriptorArray::kNotFound) {
     if (descriptor != map->LastAdded()) {
-      return Map::Normalize(map, mode, "AccessorsOverwritingNonLast");
+      return Map::Normalize(isolate, map, mode, "AccessorsOverwritingNonLast");
     }
     PropertyDetails old_details = old_descriptors->GetDetails(descriptor);
     if (old_details.kind() != kAccessor) {
-      return Map::Normalize(map, mode, "AccessorsOverwritingNonAccessors");
+      return Map::Normalize(isolate, map, mode,
+                            "AccessorsOverwritingNonAccessors");
     }
 
     if (old_details.attributes() != attributes) {
-      return Map::Normalize(map, mode, "AccessorsWithAttributes");
+      return Map::Normalize(isolate, map, mode, "AccessorsWithAttributes");
     }
 
-    Handle<Object> maybe_pair(old_descriptors->GetValue(descriptor), isolate);
+    Handle<Object> maybe_pair(old_descriptors->GetStrongValue(descriptor),
+                              isolate);
     if (!maybe_pair->IsAccessorPair()) {
-      return Map::Normalize(map, mode, "AccessorsOverwritingNonPair");
+      return Map::Normalize(isolate, map, mode, "AccessorsOverwritingNonPair");
     }
 
     Handle<AccessorPair> current_pair = Handle<AccessorPair>::cast(maybe_pair);
@@ -9937,13 +10057,15 @@ Handle<Map> Map::TransitionToAccessorProperty(Isolate* isolate, Handle<Map> map,
       overwriting_accessor = true;
     }
     if (overwriting_accessor) {
-      return Map::Normalize(map, mode, "AccessorsOverwritingAccessors");
+      return Map::Normalize(isolate, map, mode,
+                            "AccessorsOverwritingAccessors");
     }
 
     pair = AccessorPair::Copy(Handle<AccessorPair>::cast(maybe_pair));
   } else if (map->NumberOfOwnDescriptors() >= kMaxNumberOfDescriptors ||
              map->TooManyFastProperties(CERTAINLY_NOT_STORE_FROM_KEYED)) {
-    return Map::Normalize(map, CLEAR_INOBJECT_PROPERTIES, "TooManyAccessors");
+    return Map::Normalize(isolate, map, CLEAR_INOBJECT_PROPERTIES,
+                          "TooManyAccessors");
   } else {
     pair = isolate->factory()->NewAccessorPair();
   }
@@ -9952,92 +10074,90 @@ Handle<Map> Map::TransitionToAccessorProperty(Isolate* isolate, Handle<Map> map,
 
   TransitionFlag flag = INSERT_TRANSITION;
   Descriptor d = Descriptor::AccessorConstant(name, pair, attributes);
-  return Map::CopyInsertDescriptor(map, &d, flag);
+  return Map::CopyInsertDescriptor(isolate, map, &d, flag);
 }
 
-
-Handle<Map> Map::CopyAddDescriptor(Handle<Map> map,
+Handle<Map> Map::CopyAddDescriptor(Isolate* isolate, Handle<Map> map,
                                    Descriptor* descriptor,
                                    TransitionFlag flag) {
-  Handle<DescriptorArray> descriptors(map->instance_descriptors());
+  Handle<DescriptorArray> descriptors(map->instance_descriptors(), isolate);
 
   // Share descriptors only if map owns descriptors and it not an initial map.
   if (flag == INSERT_TRANSITION && map->owns_descriptors() &&
-      !map->GetBackPointer()->IsUndefined(map->GetIsolate()) &&
-      TransitionsAccessor(map).CanHaveMoreTransitions()) {
-    return ShareDescriptor(map, descriptors, descriptor);
+      !map->GetBackPointer()->IsUndefined(isolate) &&
+      TransitionsAccessor(isolate, map).CanHaveMoreTransitions()) {
+    return ShareDescriptor(isolate, map, descriptors, descriptor);
   }
 
   int nof = map->NumberOfOwnDescriptors();
   Handle<DescriptorArray> new_descriptors =
-      DescriptorArray::CopyUpTo(descriptors, nof, 1);
+      DescriptorArray::CopyUpTo(isolate, descriptors, nof, 1);
   new_descriptors->Append(descriptor);
 
   Handle<LayoutDescriptor> new_layout_descriptor =
       FLAG_unbox_double_fields
           ? LayoutDescriptor::New(map, new_descriptors, nof + 1)
-          : handle(LayoutDescriptor::FastPointerLayout(), map->GetIsolate());
+          : handle(LayoutDescriptor::FastPointerLayout(), isolate);
 
-  return CopyReplaceDescriptors(map, new_descriptors, new_layout_descriptor,
-                                flag, descriptor->GetKey(), "CopyAddDescriptor",
-                                SIMPLE_PROPERTY_TRANSITION);
+  return CopyReplaceDescriptors(
+      isolate, map, new_descriptors, new_layout_descriptor, flag,
+      descriptor->GetKey(), "CopyAddDescriptor", SIMPLE_PROPERTY_TRANSITION);
 }
 
-
-Handle<Map> Map::CopyInsertDescriptor(Handle<Map> map,
+Handle<Map> Map::CopyInsertDescriptor(Isolate* isolate, Handle<Map> map,
                                       Descriptor* descriptor,
                                       TransitionFlag flag) {
-  Handle<DescriptorArray> old_descriptors(map->instance_descriptors());
+  Handle<DescriptorArray> old_descriptors(map->instance_descriptors(), isolate);
 
   // We replace the key if it is already present.
-  int index = old_descriptors->SearchWithCache(map->GetIsolate(),
-                                               *descriptor->GetKey(), *map);
+  int index =
+      old_descriptors->SearchWithCache(isolate, *descriptor->GetKey(), *map);
   if (index != DescriptorArray::kNotFound) {
-    return CopyReplaceDescriptor(map, old_descriptors, descriptor, index, flag);
+    return CopyReplaceDescriptor(isolate, map, old_descriptors, descriptor,
+                                 index, flag);
   }
-  return CopyAddDescriptor(map, descriptor, flag);
+  return CopyAddDescriptor(isolate, map, descriptor, flag);
 }
 
-
-Handle<DescriptorArray> DescriptorArray::CopyUpTo(
-    Handle<DescriptorArray> desc,
-    int enumeration_index,
-    int slack) {
-  return DescriptorArray::CopyUpToAddAttributes(
-      desc, enumeration_index, NONE, slack);
+Handle<DescriptorArray> DescriptorArray::CopyUpTo(Isolate* isolate,
+                                                  Handle<DescriptorArray> desc,
+                                                  int enumeration_index,
+                                                  int slack) {
+  return DescriptorArray::CopyUpToAddAttributes(isolate, desc,
+                                                enumeration_index, NONE, slack);
 }
 
-
 Handle<DescriptorArray> DescriptorArray::CopyUpToAddAttributes(
-    Handle<DescriptorArray> desc,
-    int enumeration_index,
-    PropertyAttributes attributes,
-    int slack) {
+    Isolate* isolate, Handle<DescriptorArray> desc, int enumeration_index,
+    PropertyAttributes attributes, int slack) {
   if (enumeration_index + slack == 0) {
-    return desc->GetIsolate()->factory()->empty_descriptor_array();
+    return isolate->factory()->empty_descriptor_array();
   }
 
   int size = enumeration_index;
 
   Handle<DescriptorArray> descriptors =
-      DescriptorArray::Allocate(desc->GetIsolate(), size, slack);
+      DescriptorArray::Allocate(isolate, size, slack);
 
   if (attributes != NONE) {
     for (int i = 0; i < size; ++i) {
-      Object* value = desc->GetValue(i);
+      MaybeObject* value_or_field_type = desc->GetValue(i);
       Name* key = desc->GetKey(i);
       PropertyDetails details = desc->GetDetails(i);
       // Bulk attribute changes never affect private properties.
       if (!key->IsPrivate()) {
         int mask = DONT_DELETE | DONT_ENUM;
         // READ_ONLY is an invalid attribute for JS setters/getters.
-        if (details.kind() != kAccessor || !value->IsAccessorPair()) {
+        HeapObject* heap_object;
+        if (details.kind() != kAccessor ||
+            !(value_or_field_type->ToStrongHeapObject(&heap_object) &&
+              heap_object->IsAccessorPair())) {
           mask |= READ_ONLY;
         }
         details = details.CopyAddAttributes(
             static_cast<PropertyAttributes>(attributes & mask));
       }
-      descriptors->Set(i, key, value, details);
+      descriptors->Set(i, key, value_or_field_type, details);
     }
   } else {
     for (int i = 0; i < size; ++i) {
@@ -10067,8 +10187,7 @@ bool DescriptorArray::IsEqualUpTo(DescriptorArray* desc, int nof_descriptors) {
   return true;
 }
 
-
-Handle<Map> Map::CopyReplaceDescriptor(Handle<Map> map,
+Handle<Map> Map::CopyReplaceDescriptor(Isolate* isolate, Handle<Map> map,
                                        Handle<DescriptorArray> descriptors,
                                        Descriptor* descriptor,
                                        int insertion_index,
@@ -10081,7 +10200,7 @@ Handle<Map> Map::CopyReplaceDescriptor(Handle<Map> map,
   DCHECK_NE(kField, descriptors->GetDetails(insertion_index).location());
 
   Handle<DescriptorArray> new_descriptors = DescriptorArray::CopyUpTo(
-      descriptors, map->NumberOfOwnDescriptors());
+      isolate, descriptors, map->NumberOfOwnDescriptors());
 
   new_descriptors->Replace(insertion_index, descriptor);
   Handle<LayoutDescriptor> new_layout_descriptor = LayoutDescriptor::New(
@@ -10091,9 +10210,9 @@ Handle<Map> Map::CopyReplaceDescriptor(Handle<Map> map,
       (insertion_index == descriptors->number_of_descriptors() - 1)
           ? SIMPLE_PROPERTY_TRANSITION
           : PROPERTY_TRANSITION;
-  return CopyReplaceDescriptors(map, new_descriptors, new_layout_descriptor,
-                                flag, key, "CopyReplaceDescriptor",
-                                simple_flag);
+  return CopyReplaceDescriptors(isolate, map, new_descriptors,
+                                new_layout_descriptor, flag, key,
+                                "CopyReplaceDescriptor", simple_flag);
 }
 
 Handle<FixedArray> FixedArray::SetAndGrow(Handle<FixedArray> array, int index,
@@ -10116,8 +10235,32 @@ Handle<FixedArray> FixedArray::SetAndGrow(Handle<FixedArray> array, int index,
   return new_array;
 }
 
+bool FixedArray::ContainsSortedNumbers() {
+  for (int i = 1; i < length(); ++i) {
+    Object* a_obj = get(i - 1);
+    Object* b_obj = get(i);
+    if (!a_obj->IsNumber() || !b_obj->IsNumber()) return false;
+
+    uint32_t a = NumberToUint32(a_obj);
+    uint32_t b = NumberToUint32(b_obj);
+
+    if (a > b) return false;
+  }
+  return true;
+}
+
+Handle<FixedArray> FixedArray::ShrinkOrEmpty(Handle<FixedArray> array,
+                                             int new_length) {
+  if (new_length == 0) {
+    return array->GetReadOnlyRoots().empty_fixed_array_handle();
+  } else {
+    array->Shrink(new_length);
+    return array;
+  }
+}
+
 void FixedArray::Shrink(int new_length) {
-  DCHECK(0 <= new_length && new_length <= length());
+  DCHECK(0 < new_length && new_length <= length());
   if (new_length < length()) {
     GetHeap()->RightTrimFixedArray(this, length() - new_length);
   }
@@ -10126,6 +10269,9 @@ void FixedArray::Shrink(int new_length) {
 void FixedArray::CopyTo(int pos, FixedArray* dest, int dest_pos,
                         int len) const {
   DisallowHeapAllocation no_gc;
+  // Return early if len == 0 so that we don't try to read the write barrier off
+  // a canonical read-only empty fixed array.
+  if (len == 0) return;
   WriteBarrierMode mode = dest->GetWriteBarrierMode(no_gc);
   for (int index = 0; index < len; index++) {
     dest->set(dest_pos+index, get(pos+index), mode);
@@ -10142,14 +10288,14 @@ bool FixedArray::IsEqualTo(FixedArray* other) {
 }
 #endif
 
-
 // static
-void FixedArrayOfWeakCells::Set(Handle<FixedArrayOfWeakCells> array, int index,
+void FixedArrayOfWeakCells::Set(Isolate* isolate,
+                                Handle<FixedArrayOfWeakCells> array, int index,
                                 Handle<HeapObject> value) {
   DCHECK(array->IsEmptySlot(index));  // Don't overwrite anything.
   Handle<WeakCell> cell =
-      value->IsMap() ? Map::WeakCellForMap(Handle<Map>::cast(value))
-                     : array->GetIsolate()->factory()->NewWeakCell(value);
+      value->IsMap() ? Map::WeakCellForMap(isolate, Handle<Map>::cast(value))
+                     : isolate->factory()->NewWeakCell(value);
   Handle<FixedArray>::cast(array)->set(index + kFirstIndex, *cell);
   array->set_last_used_index(index);
 }
@@ -10157,11 +10303,11 @@ void FixedArrayOfWeakCells::Set(Handle<FixedArrayOfWeakCells> array, int index,
 
 // static
 Handle<FixedArrayOfWeakCells> FixedArrayOfWeakCells::Add(
-    Handle<Object> maybe_array, Handle<HeapObject> value, int* assigned_index) {
+    Isolate* isolate, Handle<Object> maybe_array, Handle<HeapObject> value,
+    int* assigned_index) {
   Handle<FixedArrayOfWeakCells> array =
       (maybe_array.is_null() || !maybe_array->IsFixedArrayOfWeakCells())
-          ? Allocate(value->GetIsolate(), 1,
-                     Handle<FixedArrayOfWeakCells>::null())
+          ? Allocate(isolate, 1, Handle<FixedArrayOfWeakCells>::null())
           : Handle<FixedArrayOfWeakCells>::cast(maybe_array);
   // Try to store the new entry if there's room. Optimize for consecutive
   // accesses.
@@ -10170,7 +10316,7 @@ Handle<FixedArrayOfWeakCells> FixedArrayOfWeakCells::Add(
   if (length > 0) {
     for (int i = first_index;;) {
       if (array->IsEmptySlot((i))) {
-        FixedArrayOfWeakCells::Set(array, i, value);
+        FixedArrayOfWeakCells::Set(isolate, array, i, value);
         if (assigned_index != nullptr) *assigned_index = i;
         return array;
       }
@@ -10182,8 +10328,8 @@ Handle<FixedArrayOfWeakCells> FixedArrayOfWeakCells::Add(
   // No usable slot found, grow the array.
   int new_length = length == 0 ? 1 : length + (length >> 1) + 4;
   Handle<FixedArrayOfWeakCells> new_array =
-      Allocate(array->GetIsolate(), new_length, array);
-  FixedArrayOfWeakCells::Set(new_array, length, value);
+      Allocate(isolate, new_length, array);
+  FixedArrayOfWeakCells::Set(isolate, new_array, length, value);
   if (assigned_index != nullptr) *assigned_index = length;
   return new_array;
 }
@@ -10302,7 +10448,8 @@ Handle<ArrayList> ArrayList::Add(Handle<ArrayList> array, Handle<Object> obj1,
 Handle<ArrayList> ArrayList::New(Isolate* isolate, int size) {
   Handle<FixedArray> fixed_array =
       isolate->factory()->NewFixedArray(size + kFirstIndex);
-  fixed_array->set_map_no_write_barrier(isolate->heap()->array_list_map());
+  fixed_array->set_map_no_write_barrier(
+      ReadOnlyRoots(isolate).array_list_map());
   Handle<ArrayList> result = Handle<ArrayList>::cast(fixed_array);
   result->SetLength(0);
   return result;
@@ -10344,13 +10491,41 @@ Handle<ArrayList> ArrayList::EnsureSpace(Handle<ArrayList> array, int length) {
   const bool empty = (array->length() == 0);
   auto ret = EnsureSpaceInFixedArray(array, kFirstIndex + length);
   if (empty) {
-    ret->set_map_no_write_barrier(array->GetHeap()->array_list_map());
+    ret->set_map_no_write_barrier(array->GetReadOnlyRoots().array_list_map());
 
     Handle<ArrayList>::cast(ret)->SetLength(0);
   }
   return Handle<ArrayList>::cast(ret);
 }
 
+// static
+Handle<WeakArrayList> WeakArrayList::AddToEnd(Handle<WeakArrayList> array,
+                                              MaybeObjectHandle value) {
+  int length = array->length();
+  array = EnsureSpace(array, length + 1);
+  // Check that GC didn't remove elements from the array.
+  DCHECK_EQ(array->length(), length);
+  array->Set(length, *value);
+  array->set_length(length + 1);
+  return array;
+}
+
+bool WeakArrayList::IsFull() { return length() == capacity(); }
+
+// static
+Handle<WeakArrayList> WeakArrayList::EnsureSpace(Handle<WeakArrayList> array,
+                                                 int length) {
+  int capacity = array->capacity();
+  if (capacity < length) {
+    Isolate* isolate = array->GetIsolate();
+    int new_capacity = length;
+    new_capacity = new_capacity + Max(new_capacity / 2, 2);
+    int grow_by = new_capacity - capacity;
+    array = isolate->factory()->CopyWeakArrayListAndGrow(array, grow_by);
+  }
+  return array;
+}
+
 Handle<RegExpMatchInfo> RegExpMatchInfo::ReserveCaptures(
     Handle<RegExpMatchInfo> match_info, int capture_count) {
   DCHECK_GE(match_info->length(), kLastMatchOverhead);
@@ -10413,15 +10588,19 @@ Handle<DescriptorArray> DescriptorArray::Allocate(Isolate* isolate,
   int size = number_of_descriptors + slack;
   if (size == 0) return factory->empty_descriptor_array();
   // Allocate the array of keys.
-  Handle<FixedArray> result = factory->NewFixedArrayWithMap(
-      Heap::kDescriptorArrayMapRootIndex, LengthFor(size), pretenure);
-  result->set(kDescriptorLengthIndex, Smi::FromInt(number_of_descriptors));
-  result->set(kEnumCacheIndex, isolate->heap()->empty_enum_cache());
+  Handle<WeakFixedArray> result =
+      factory->NewWeakFixedArrayWithMap<DescriptorArray>(
+          Heap::kDescriptorArrayMapRootIndex, LengthFor(size), pretenure);
+  result->Set(kDescriptorLengthIndex,
+              MaybeObject::FromObject(Smi::FromInt(number_of_descriptors)));
+  result->Set(kEnumCacheIndex, MaybeObject::FromObject(
+                                   ReadOnlyRoots(isolate).empty_enum_cache()));
   return Handle<DescriptorArray>::cast(result);
 }
 
 void DescriptorArray::ClearEnumCache() {
-  set(kEnumCacheIndex, GetHeap()->empty_enum_cache());
+  set(kEnumCacheIndex,
+      MaybeObject::FromObject(GetReadOnlyRoots().empty_enum_cache()));
 }
 
 void DescriptorArray::Replace(int index, Descriptor* descriptor) {
@@ -10434,9 +10613,9 @@ void DescriptorArray::SetEnumCache(Handle<DescriptorArray> descriptors,
                                    Isolate* isolate, Handle<FixedArray> keys,
                                    Handle<FixedArray> indices) {
   EnumCache* enum_cache = descriptors->GetEnumCache();
-  if (enum_cache == isolate->heap()->empty_enum_cache()) {
+  if (enum_cache == ReadOnlyRoots(isolate).empty_enum_cache()) {
     enum_cache = *isolate->factory()->NewEnumCache(keys, indices);
-    descriptors->set(kEnumCacheIndex, enum_cache);
+    descriptors->set(kEnumCacheIndex, MaybeObject::FromObject(enum_cache));
   } else {
     enum_cache->set_keys(*keys);
     enum_cache->set_indices(*indices);
@@ -10499,7 +10678,7 @@ void DescriptorArray::Sort() {
       parent_index = child_index;
     }
   }
-  DCHECK(IsSortedNoDuplicates());
+  DCHECK(IsSortedNoDuplicates(GetIsolate()));
 }
 
 
@@ -10512,13 +10691,13 @@ Handle<AccessorPair> AccessorPair::Copy(Handle<AccessorPair> pair) {
 
 Handle<Object> AccessorPair::GetComponent(Handle<AccessorPair> accessor_pair,
                                           AccessorComponent component) {
+  Isolate* isolate = accessor_pair->GetIsolate();
   Object* accessor = accessor_pair->get(component);
   if (accessor->IsFunctionTemplateInfo()) {
     return ApiNatives::InstantiateFunction(
-               handle(FunctionTemplateInfo::cast(accessor)))
+               handle(FunctionTemplateInfo::cast(accessor), isolate))
         .ToHandleChecked();
   }
-  Isolate* isolate = accessor_pair->GetIsolate();
   if (accessor->IsNull(isolate)) {
     return isolate->factory()->undefined_value();
   }
@@ -10556,9 +10735,9 @@ bool DescriptorArray::IsEqualTo(DescriptorArray* other) {
 #endif
 
 // static
-Handle<String> String::Trim(Handle<String> string, TrimMode mode) {
-  Isolate* const isolate = string->GetIsolate();
-  string = String::Flatten(string);
+Handle<String> String::Trim(Isolate* isolate, Handle<String> string,
+                            TrimMode mode) {
+  string = String::Flatten(isolate, string);
   int const length = string->length();
 
   // Perform left trimming if requested.
@@ -10584,7 +10763,15 @@ Handle<String> String::Trim(Handle<String> string, TrimMode mode) {
   return isolate->factory()->NewSubString(string, left, right);
 }
 
-bool String::LooksValid() { return GetIsolate()->heap()->Contains(this); }
+bool String::LooksValid() {
+  // TODO(leszeks): Maybe remove this check entirely, Heap::Contains uses
+  // basically the same logic as the way we access the heap in the first place.
+  MemoryChunk* chunk = MemoryChunk::FromHeapObject(this);
+  // RO_SPACE objects should always be valid.
+  if (chunk->owner()->identity() == RO_SPACE) return true;
+  if (chunk->heap() == nullptr) return false;
+  return chunk->heap()->Contains(this);
+}
 
 // static
 MaybeHandle<String> Name::ToFunctionName(Handle<Name> name) {
@@ -10642,11 +10829,9 @@ int ParseDecimalInteger(const uint8_t* s, int from, int to) {
 }  // namespace
 
 // static
-Handle<Object> String::ToNumber(Handle<String> subject) {
-  Isolate* const isolate = subject->GetIsolate();
-
+Handle<Object> String::ToNumber(Isolate* isolate, Handle<String> subject) {
   // Flatten {subject} string first.
-  subject = String::Flatten(subject);
+  subject = String::Flatten(isolate, subject);
 
   // Fast array index case.
   uint32_t index;
@@ -10700,7 +10885,7 @@ Handle<Object> String::ToNumber(Handle<String> subject) {
   // Slower case.
   int flags = ALLOW_HEX | ALLOW_OCTAL | ALLOW_BINARY;
   return isolate->factory()->NewNumber(
-      StringToDouble(isolate->unicode_cache(), subject, flags));
+      StringToDouble(isolate, isolate->unicode_cache(), subject, flags));
 }
 
 
@@ -11201,16 +11386,15 @@ static void CalculateLineEndsImpl(Isolate* isolate, std::vector<int>* line_ends,
   }
 }
 
-
-Handle<FixedArray> String::CalculateLineEnds(Handle<String> src,
+Handle<FixedArray> String::CalculateLineEnds(Isolate* isolate,
+                                             Handle<String> src,
                                              bool include_ending_line) {
-  src = Flatten(src);
+  src = Flatten(isolate, src);
   // Rough estimate of line count based on a roughly estimated average
   // length of (unpacked) code.
   int line_count_estimate = src->length() >> 4;
   std::vector<int> line_ends;
   line_ends.reserve(line_count_estimate);
-  Isolate* isolate = src->GetIsolate();
   { DisallowHeapAllocation no_allocation;  // ensure vectors stay valid.
     // Dispatch on type of strings.
     String::FlatContent content = src->GetFlatContent();
@@ -11439,8 +11623,8 @@ bool String::SlowEquals(String* other) {
   return comparator.Equals(this, other);
 }
 
-
-bool String::SlowEquals(Handle<String> one, Handle<String> two) {
+bool String::SlowEquals(Isolate* isolate, Handle<String> one,
+                        Handle<String> two) {
   // Fast check: negative check with lengths.
   int one_length = one->length();
   if (one_length != two->length()) return false;
@@ -11449,9 +11633,11 @@ bool String::SlowEquals(Handle<String> one, Handle<String> two) {
   // Fast check: if at least one ThinString is involved, dereference it/them
   // and restart.
   if (one->IsThinString() || two->IsThinString()) {
-    if (one->IsThinString()) one = handle(ThinString::cast(*one)->actual());
-    if (two->IsThinString()) two = handle(ThinString::cast(*two)->actual());
-    return String::Equals(one, two);
+    if (one->IsThinString())
+      one = handle(ThinString::cast(*one)->actual(), isolate);
+    if (two->IsThinString())
+      two = handle(ThinString::cast(*two)->actual(), isolate);
+    return String::Equals(isolate, one, two);
   }
 
   // Fast check: if hash code is computed for both strings
@@ -11478,8 +11664,8 @@ bool String::SlowEquals(Handle<String> one, Handle<String> two) {
   // before we try to flatten the strings.
   if (one->Get(0) != two->Get(0)) return false;
 
-  one = String::Flatten(one);
-  two = String::Flatten(two);
+  one = String::Flatten(isolate, one);
+  two = String::Flatten(isolate, two);
 
   DisallowHeapAllocation no_gc;
   String::FlatContent flat1 = one->GetFlatContent();
@@ -11499,7 +11685,8 @@ bool String::SlowEquals(Handle<String> one, Handle<String> two) {
 
 
 // static
-ComparisonResult String::Compare(Handle<String> x, Handle<String> y) {
+ComparisonResult String::Compare(Isolate* isolate, Handle<String> x,
+                                 Handle<String> y) {
   // A few fast case tests before we flatten.
   if (x.is_identical_to(y)) {
     return ComparisonResult::kEqual;
@@ -11518,8 +11705,8 @@ ComparisonResult String::Compare(Handle<String> x, Handle<String> y) {
   }
 
   // Slow case.
-  x = String::Flatten(x);
-  y = String::Flatten(y);
+  x = String::Flatten(isolate, x);
+  y = String::Flatten(isolate, y);
 
   DisallowHeapAllocation no_gc;
   ComparisonResult result = ComparisonResult::kEqual;
@@ -11610,8 +11797,8 @@ int String::IndexOf(Isolate* isolate, Handle<String> receiver,
   uint32_t receiver_length = receiver->length();
   if (start_index + search_length > receiver_length) return -1;
 
-  receiver = String::Flatten(receiver);
-  search = String::Flatten(search);
+  receiver = String::Flatten(isolate, receiver);
+  search = String::Flatten(isolate, search);
 
   DisallowHeapAllocation no_gc;  // ensure vectors stay valid
   // Extract flattened substrings of cons strings before getting encoding.
@@ -11632,7 +11819,6 @@ int String::IndexOf(Isolate* isolate, Handle<String> receiver,
 MaybeHandle<String> String::GetSubstitution(Isolate* isolate, Match* match,
                                             Handle<String> replacement,
                                             int start_index) {
-  DCHECK_IMPLIES(match->HasNamedCaptures(), FLAG_harmony_regexp_named_captures);
   DCHECK_GE(start_index, 0);
 
   Factory* factory = isolate->factory();
@@ -11640,7 +11826,7 @@ MaybeHandle<String> String::GetSubstitution(Isolate* isolate, Match* match,
   const int replacement_length = replacement->length();
   const int captures_length = match->CaptureCount();
 
-  replacement = String::Flatten(replacement);
+  replacement = String::Flatten(isolate, replacement);
 
   Handle<String> dollar_string =
       factory->LookupSingleCharacterStringFromCode('$');
@@ -11872,8 +12058,8 @@ Object* String::LastIndexOf(Isolate* isolate, Handle<Object> receiver,
     return Smi::FromInt(start_index);
   }
 
-  receiver_string = String::Flatten(receiver_string);
-  search_string = String::Flatten(search_string);
+  receiver_string = String::Flatten(isolate, receiver_string);
+  search_string = String::Flatten(isolate, search_string);
 
   int last_index = -1;
   DisallowHeapAllocation no_gc;  // ensure vectors stay valid
@@ -12038,12 +12224,19 @@ Handle<String> SeqString::Truncate(Handle<SeqString> string, int new_length) {
 
 void SeqOneByteString::clear_padding() {
   int data_size = SeqString::kHeaderSize + length() * kOneByteSize;
-  memset(address() + data_size, 0, SizeFor(length()) - data_size);
+  memset(reinterpret_cast<void*>(address() + data_size), 0,
+         SizeFor(length()) - data_size);
 }
 
 void SeqTwoByteString::clear_padding() {
   int data_size = SeqString::kHeaderSize + length() * kUC16Size;
-  memset(address() + data_size, 0, SizeFor(length()) - data_size);
+  memset(reinterpret_cast<void*>(address() + data_size), 0,
+         SizeFor(length()) - data_size);
+}
+
+int ExternalString::ExternalPayloadSize() const {
+  int length_multiplier = IsTwoByteRepresentation() ? i::kShortSize : kCharSize;
+  return length() * length_multiplier;
 }
 
 uint32_t StringHasher::MakeArrayIndexHash(uint32_t value, int length) {
@@ -12311,13 +12504,13 @@ static void StopSlackTracking(Map* map, void* data) {
   map->set_construction_counter(Map::kNoSlackTracking);
 }
 
-void Map::CompleteInobjectSlackTracking() {
+void Map::CompleteInobjectSlackTracking(Isolate* isolate) {
   DisallowHeapAllocation no_gc;
   // Has to be an initial map.
-  DCHECK(GetBackPointer()->IsUndefined(GetIsolate()));
+  DCHECK(GetBackPointer()->IsUndefined(isolate));
 
   int slack = UnusedPropertyFields();
-  TransitionsAccessor transitions(this, &no_gc);
+  TransitionsAccessor transitions(isolate, this, &no_gc);
   transitions.TraverseTransitionTree(&GetMinInobjectSlack, &slack);
   if (slack != 0) {
     // Resize the initial map and all maps in its transition tree.
@@ -12353,7 +12546,7 @@ void JSObject::MakePrototypesFast(Handle<Object> receiver,
       // If the map is already marked as should be fast, we're done. Its
       // prototypes will have been marked already as well.
       if (current_map->should_be_fast_prototype_map()) return;
-      Handle<Map> map(current_map);
+      Handle<Map> map(current_map, isolate);
       Map::SetShouldBeFastPrototypeMap(map, true, isolate);
       JSObject::OptimizeAsPrototype(current_obj);
     }
@@ -12375,7 +12568,9 @@ void JSObject::OptimizeAsPrototype(Handle<JSObject> object,
       JSObject::MigrateSlowToFast(object, 0, "OptimizeAsPrototype");
     }
   } else {
-    Handle<Map> new_map = Map::Copy(handle(object->map()), "CopyAsPrototype");
+    Handle<Map> new_map = Map::Copy(object->GetIsolate(),
+                                    handle(object->map(), object->GetIsolate()),
+                                    "CopyAsPrototype");
     JSObject::MigrateToMap(object, new_map);
     object->map()->set_is_prototype_map(true);
 
@@ -12426,8 +12621,8 @@ void JSObject::LazyRegisterPrototypeUser(Handle<Map> user, Isolate* isolate) {
         Map::GetOrCreatePrototypeInfo(proto, isolate);
     Handle<Object> maybe_registry(proto_info->prototype_users(), isolate);
     int slot = 0;
-    Handle<FixedArrayOfWeakCells> new_array =
-        FixedArrayOfWeakCells::Add(maybe_registry, current_user, &slot);
+    Handle<FixedArrayOfWeakCells> new_array = FixedArrayOfWeakCells::Add(
+        isolate, maybe_registry, current_user, &slot);
     current_user_info->set_registry_slot(slot);
     if (!maybe_registry.is_identical_to(new_array)) {
       proto_info->set_prototype_users(*new_array);
@@ -12645,7 +12840,8 @@ Handle<WeakCell> Map::GetOrCreatePrototypeWeakCell(Handle<JSReceiver> prototype,
 }
 
 // static
-void Map::SetPrototype(Handle<Map> map, Handle<Object> prototype,
+void Map::SetPrototype(Isolate* isolate, Handle<Map> map,
+                       Handle<Object> prototype,
                        bool enable_prototype_setup_mode) {
   RuntimeCallTimerScope stats_scope(*map,
                                     RuntimeCallCounterId::kMap_SetPrototype);
@@ -12670,9 +12866,8 @@ void Map::SetPrototype(Handle<Map> map, Handle<Object> prototype,
   }
   map->set_has_hidden_prototype(is_hidden);
 
-  WriteBarrierMode wb_mode = prototype->IsNull(map->GetIsolate())
-                                 ? SKIP_WRITE_BARRIER
-                                 : UPDATE_WRITE_BARRIER;
+  WriteBarrierMode wb_mode =
+      prototype->IsNull(isolate) ? SKIP_WRITE_BARRIER : UPDATE_WRITE_BARRIER;
   map->set_prototype(*prototype, wb_mode);
 }
 
@@ -12690,10 +12885,11 @@ Handle<Object> CacheInitialJSArrayMaps(
     Handle<Map> new_map;
     ElementsKind next_kind = GetFastElementsKindFromSequenceIndex(i);
     if (Map* maybe_elements_transition = current_map->ElementsTransitionMap()) {
-      new_map = handle(maybe_elements_transition);
+      new_map = handle(maybe_elements_transition, native_context->GetIsolate());
     } else {
-      new_map = Map::CopyAsElementsKind(
-          current_map, next_kind, INSERT_TRANSITION);
+      new_map =
+          Map::CopyAsElementsKind(native_context->GetIsolate(), current_map,
+                                  next_kind, INSERT_TRANSITION);
     }
     DCHECK_EQ(next_kind, new_map->elements_kind());
     native_context->set(Context::ArrayMapIndex(next_kind), *new_map);
@@ -12717,14 +12913,15 @@ void SetInstancePrototype(Isolate* isolate, Handle<JSFunction> function,
 
     Handle<Map> initial_map(function->initial_map(), isolate);
 
-    if (!initial_map->GetIsolate()->bootstrapper()->IsActive() &&
+    if (!isolate->bootstrapper()->IsActive() &&
         initial_map->instance_type() == JS_OBJECT_TYPE) {
       // Put the value in the initial map field until an initial map is needed.
       // At that point, a new initial map is created and the prototype is put
       // into the initial map where it belongs.
       function->set_prototype_or_initial_map(*value);
     } else {
-      Handle<Map> new_map = Map::Copy(initial_map, "SetInstancePrototype");
+      Handle<Map> new_map =
+          Map::Copy(isolate, initial_map, "SetInstancePrototype");
       JSFunction::SetInitialMap(function, new_map, value);
 
       // If the function is used as the global Array function, cache the
@@ -12771,14 +12968,16 @@ void JSFunction::SetPrototype(Handle<JSFunction> function,
     // Copy the map so this does not affect unrelated functions.
     // Remove map transitions because they point to maps with a
     // different prototype.
-    Handle<Map> new_map = Map::Copy(handle(function->map()), "SetPrototype");
+    Handle<Map> new_map =
+        Map::Copy(isolate, handle(function->map(), isolate), "SetPrototype");
 
     JSObject::MigrateToMap(function, new_map);
     new_map->SetConstructor(*value);
     new_map->set_has_non_instance_prototype(true);
 
     FunctionKind kind = function->shared()->kind();
-    Handle<Context> native_context(function->context()->native_context());
+    Handle<Context> native_context(function->context()->native_context(),
+                                   isolate);
 
     construct_prototype = Handle<JSReceiver>(
         IsGeneratorFunction(kind)
@@ -12798,12 +12997,13 @@ void JSFunction::SetPrototype(Handle<JSFunction> function,
 
 void JSFunction::SetInitialMap(Handle<JSFunction> function, Handle<Map> map,
                                Handle<Object> prototype) {
-  if (map->prototype() != *prototype) Map::SetPrototype(map, prototype);
+  if (map->prototype() != *prototype)
+    Map::SetPrototype(function->GetIsolate(), map, prototype);
   function->set_prototype_or_initial_map(*map);
   map->SetConstructor(*function);
   if (FLAG_trace_maps) {
-    LOG(map->GetIsolate(), MapEvent("InitialMap", nullptr, *map, "",
-                                    function->shared()->DebugName()));
+    LOG(function->GetIsolate(), MapEvent("InitialMap", nullptr, *map, "",
+                                         function->shared()->DebugName()));
   }
 }
 
@@ -12844,18 +13044,26 @@ bool CanSubclassHaveInobjectProperties(InstanceType instance_type) {
       return true;
 
     case BIGINT_TYPE:
-    case BOILERPLATE_DESCRIPTION_TYPE:
+    case OBJECT_BOILERPLATE_DESCRIPTION_TYPE:
     case BYTECODE_ARRAY_TYPE:
     case BYTE_ARRAY_TYPE:
     case CELL_TYPE:
     case CODE_TYPE:
     case FILLER_TYPE:
     case FIXED_ARRAY_TYPE:
+    case SCRIPT_CONTEXT_TABLE_TYPE:
     case FIXED_DOUBLE_ARRAY_TYPE:
     case FEEDBACK_METADATA_TYPE:
     case FOREIGN_TYPE:
     case FREE_SPACE_TYPE:
     case HASH_TABLE_TYPE:
+    case ORDERED_HASH_MAP_TYPE:
+    case ORDERED_HASH_SET_TYPE:
+    case NAME_DICTIONARY_TYPE:
+    case GLOBAL_DICTIONARY_TYPE:
+    case NUMBER_DICTIONARY_TYPE:
+    case SIMPLE_NUMBER_DICTIONARY_TYPE:
+    case STRING_TABLE_TYPE:
     case HEAP_NUMBER_TYPE:
     case JS_BOUND_FUNCTION_TYPE:
     case JS_GLOBAL_OBJECT_TYPE:
@@ -12868,6 +13076,7 @@ bool CanSubclassHaveInobjectProperties(InstanceType instance_type) {
     case SHARED_FUNCTION_INFO_TYPE:
     case SYMBOL_TYPE:
     case WEAK_CELL_TYPE:
+    case ALLOCATION_SITE_TYPE:
 
 #define TYPED_ARRAY_CASE(Type, type, TYPE, ctype, size) \
   case FIXED_##TYPE##_ARRAY_TYPE:
@@ -12973,10 +13182,10 @@ bool FastInitializeDerivedMap(Isolate* isolate, Handle<JSFunction> new_target,
                         constructor_initial_map->UnusedPropertyFields();
     CHECK_LE(constructor_initial_map->UsedInstanceSize(), instance_size);
     int unused_property_fields = in_object_properties - pre_allocated;
-    map = Map::CopyInitialMap(constructor_initial_map, instance_size,
+    map = Map::CopyInitialMap(isolate, constructor_initial_map, instance_size,
                               in_object_properties, unused_property_fields);
   } else {
-    map = Map::CopyInitialMap(constructor_initial_map);
+    map = Map::CopyInitialMap(isolate, constructor_initial_map);
   }
   map->set_new_target_is_base(false);
   Handle<Object> prototype(new_target->instance_prototype(), isolate);
@@ -13024,7 +13233,7 @@ MaybeHandle<Map> JSFunction::GetDerivedMap(Isolate* isolate,
     Handle<String> prototype_string = isolate->factory()->prototype_string();
     ASSIGN_RETURN_ON_EXCEPTION(
         isolate, prototype,
-        JSReceiver::GetProperty(new_target, prototype_string), Map);
+        JSReceiver::GetProperty(isolate, new_target, prototype_string), Map);
     // The above prototype lookup might change the constructor and its
     // prototype, hence we have to reload the initial map.
     EnsureHasInitialMap(constructor);
@@ -13044,14 +13253,16 @@ MaybeHandle<Map> JSFunction::GetDerivedMap(Isolate* isolate,
         constructor, isolate->factory()->native_context_index_symbol());
     int index = maybe_index->IsSmi() ? Smi::ToInt(*maybe_index)
                                      : Context::OBJECT_FUNCTION_INDEX;
-    Handle<JSFunction> realm_constructor(JSFunction::cast(context->get(index)));
+    Handle<JSFunction> realm_constructor(JSFunction::cast(context->get(index)),
+                                         isolate);
     prototype = handle(realm_constructor->prototype(), isolate);
   }
 
-  Handle<Map> map = Map::CopyInitialMap(constructor_initial_map);
+  Handle<Map> map = Map::CopyInitialMap(isolate, constructor_initial_map);
   map->set_new_target_is_base(false);
   CHECK(prototype->IsJSReceiver());
-  if (map->prototype() != *prototype) Map::SetPrototype(map, prototype);
+  if (map->prototype() != *prototype)
+    Map::SetPrototype(isolate, map, prototype);
   map->SetConstructor(*constructor);
   return map;
 }
@@ -13154,6 +13365,14 @@ Handle<String> JSFunction::ToString(Handle<JSFunction> function) {
   }
 
   if (FLAG_harmony_function_tostring) {
+    if (shared_info->function_token_position() == kNoSourcePosition) {
+      // If the function token position isn't valid, return [native code] to
+      // ensure calling eval on the returned source code throws rather than
+      // giving inconsistent call behaviour.
+      isolate->CountUsage(v8::Isolate::UseCounterFeature::
+                              kFunctionTokenOffsetTooLongForToString);
+      return NativeCodeFunctionSourceString(shared_info);
+    }
     return Handle<String>::cast(
         SharedFunctionInfo::GetSourceCodeHarmony(shared_info));
   }
@@ -13189,11 +13408,11 @@ Handle<String> JSFunction::ToString(Handle<JSFunction> function) {
   if (shared_info->is_wrapped()) {
     builder.AppendCharacter('(');
     Handle<FixedArray> args(
-        Script::cast(shared_info->script())->wrapped_arguments());
+        Script::cast(shared_info->script())->wrapped_arguments(), isolate);
     int argc = args->length();
     for (int i = 0; i < argc; i++) {
       if (i > 0) builder.AppendCString(", ");
-      builder.AppendString(Handle<String>(String::cast(args->get(i))));
+      builder.AppendString(Handle<String>(String::cast(args->get(i)), isolate));
     }
     builder.AppendCString(") {\n");
   }
@@ -13252,11 +13471,11 @@ void Script::InitLineEnds(Handle<Script> script) {
   Object* src_obj = script->source();
   if (!src_obj->IsString()) {
     DCHECK(src_obj->IsUndefined(isolate));
-    script->set_line_ends(isolate->heap()->empty_fixed_array());
+    script->set_line_ends(ReadOnlyRoots(isolate).empty_fixed_array());
   } else {
     DCHECK(src_obj->IsString());
     Handle<String> src(String::cast(src_obj), isolate);
-    Handle<FixedArray> array = String::CalculateLineEnds(src, true);
+    Handle<FixedArray> array = String::CalculateLineEnds(isolate, src, true);
     script->set_line_ends(*array);
   }
 
@@ -13275,7 +13494,7 @@ bool Script::IsUserJavaScript() { return type() == Script::TYPE_NORMAL; }
 
 bool Script::ContainsAsmModule() {
   DisallowHeapAllocation no_gc;
-  SharedFunctionInfo::ScriptIterator iter(Handle<Script>(this));
+  SharedFunctionInfo::ScriptIterator iter(this->GetIsolate(), this);
   while (SharedFunctionInfo* info = iter.Next()) {
     if (info->HasAsmWasmData()) return true;
   }
@@ -13317,14 +13536,12 @@ bool Script::GetPositionInfo(int position, PositionInfo* info,
   // For wasm, we do not rely on the line_ends array, but do the translation
   // directly.
   if (type() == Script::TYPE_WASM) {
-    Handle<WasmCompiledModule> compiled_module(
-        WasmCompiledModule::cast(wasm_compiled_module()));
     DCHECK_LE(0, position);
-    return compiled_module->shared()->GetPositionInfo(
-        static_cast<uint32_t>(position), info);
+    return WasmModuleObject::cast(wasm_module_object())
+        ->GetPositionInfo(static_cast<uint32_t>(position), info);
   }
 
-  if (line_ends()->IsUndefined(GetIsolate())) {
+  if (line_ends()->IsUndefined()) {
     // Slow mode: we do not have line_ends. We have to iterate through source.
     if (!GetPositionInfoSlow(this, position, info)) return false;
   } else {
@@ -13424,32 +13641,6 @@ Object* Script::GetNameOrSourceURL() {
   return name();
 }
 
-
-Handle<JSObject> Script::GetWrapper(Handle<Script> script) {
-  Isolate* isolate = script->GetIsolate();
-  if (!script->wrapper()->IsUndefined(isolate)) {
-    DCHECK(script->wrapper()->IsWeakCell());
-    Handle<WeakCell> cell(WeakCell::cast(script->wrapper()));
-    if (!cell->cleared()) {
-      // Return a handle for the existing script wrapper from the cache.
-      return handle(JSObject::cast(cell->value()));
-    }
-    // If we found an empty WeakCell, that means the script wrapper was
-    // GCed.  We are not notified directly of that, so we decrement here
-    // so that we at least don't count double for any given script.
-    isolate->counters()->script_wrappers()->Decrement();
-  }
-  // Construct a new script wrapper.
-  isolate->counters()->script_wrappers()->Increment();
-  Handle<JSFunction> constructor = isolate->script_function();
-  Handle<JSValue> result =
-      Handle<JSValue>::cast(isolate->factory()->NewJSObject(constructor));
-  result->set_value(*script);
-  Handle<WeakCell> cell = isolate->factory()->NewWeakCell(result);
-  script->set_wrapper(*cell);
-  return result;
-}
-
 MaybeHandle<SharedFunctionInfo> Script::FindSharedFunctionInfo(
     Isolate* isolate, const FunctionLiteral* fun) {
   CHECK_NE(fun->function_literal_id(), FunctionLiteral::kIdTypeInvalid);
@@ -13465,7 +13656,7 @@ MaybeHandle<SharedFunctionInfo> Script::FindSharedFunctionInfo(
       heap_object->IsUndefined(isolate)) {
     return MaybeHandle<SharedFunctionInfo>();
   }
-  return handle(SharedFunctionInfo::cast(heap_object));
+  return handle(SharedFunctionInfo::cast(heap_object), isolate);
 }
 
 Script::Iterator::Iterator(Isolate* isolate)
@@ -13474,10 +13665,10 @@ Script::Iterator::Iterator(Isolate* isolate)
 
 Script* Script::Iterator::Next() { return iterator_.Next<Script>(); }
 
-
-SharedFunctionInfo::ScriptIterator::ScriptIterator(Handle<Script> script)
-    : ScriptIterator(script->GetIsolate(),
-                     handle(script->shared_function_infos())) {}
+SharedFunctionInfo::ScriptIterator::ScriptIterator(Isolate* isolate,
+                                                   Script* script)
+    : ScriptIterator(isolate,
+                     handle(script->shared_function_infos(), isolate)) {}
 
 SharedFunctionInfo::ScriptIterator::ScriptIterator(
     Isolate* isolate, Handle<WeakFixedArray> shared_function_infos)
@@ -13498,15 +13689,15 @@ SharedFunctionInfo* SharedFunctionInfo::ScriptIterator::Next() {
   return nullptr;
 }
 
-void SharedFunctionInfo::ScriptIterator::Reset(Handle<Script> script) {
-  shared_function_infos_ = handle(script->shared_function_infos());
+void SharedFunctionInfo::ScriptIterator::Reset(Script* script) {
+  shared_function_infos_ = handle(script->shared_function_infos(), isolate_);
   index_ = 0;
 }
 
 SharedFunctionInfo::GlobalIterator::GlobalIterator(Isolate* isolate)
     : script_iterator_(isolate),
       noscript_sfi_iterator_(isolate->heap()->noscript_shared_function_infos()),
-      sfi_iterator_(handle(script_iterator_.Next(), isolate)) {}
+      sfi_iterator_(isolate, script_iterator_.Next()) {}
 
 SharedFunctionInfo* SharedFunctionInfo::GlobalIterator::Next() {
   SharedFunctionInfo* next = noscript_sfi_iterator_.Next<SharedFunctionInfo>();
@@ -13516,7 +13707,7 @@ SharedFunctionInfo* SharedFunctionInfo::GlobalIterator::Next() {
     if (next != nullptr) return next;
     Script* next_script = script_iterator_.Next();
     if (next_script == nullptr) return nullptr;
-    sfi_iterator_.Reset(handle(next_script));
+    sfi_iterator_.Reset(next_script);
   }
 }
 
@@ -13527,7 +13718,8 @@ void SharedFunctionInfo::SetScript(Handle<SharedFunctionInfo> shared,
   if (shared->script() == *script_object) return;
   Isolate* isolate = shared->GetIsolate();
 
-  if (reset_preparsed_scope_data && shared->HasPreParsedScopeData()) {
+  if (reset_preparsed_scope_data &&
+      shared->HasUncompiledDataWithPreParsedScope()) {
     shared->ClearPreParsedScopeData();
   }
 
@@ -13562,7 +13754,7 @@ void SharedFunctionInfo::SetScript(Handle<SharedFunctionInfo> shared,
     }
 #endif  // DEBUG
 
-    list = FixedArrayOfWeakCells::Add(list, shared);
+    list = FixedArrayOfWeakCells::Add(isolate, list, shared);
 
     isolate->heap()->SetRootNoScriptSharedFunctionInfos(*list);
   }
@@ -13581,7 +13773,8 @@ void SharedFunctionInfo::SetScript(Handle<SharedFunctionInfo> shared,
       if (raw->ToWeakHeapObject(&heap_object) && heap_object == *shared) {
         old_script->shared_function_infos()->Set(
             shared->function_literal_id(),
-            HeapObjectReference::Strong(isolate->heap()->undefined_value()));
+            HeapObjectReference::Strong(
+                ReadOnlyRoots(isolate).undefined_value()));
       }
     }
   } else {
@@ -13596,21 +13789,21 @@ void SharedFunctionInfo::SetScript(Handle<SharedFunctionInfo> shared,
 
 bool SharedFunctionInfo::HasBreakInfo() const {
   if (!HasDebugInfo()) return false;
-  DebugInfo* info = DebugInfo::cast(debug_info());
+  DebugInfo* info = DebugInfo::cast(GetDebugInfo());
   bool has_break_info = info->HasBreakInfo();
   return has_break_info;
 }
 
 bool SharedFunctionInfo::BreakAtEntry() const {
   if (!HasDebugInfo()) return false;
-  DebugInfo* info = DebugInfo::cast(debug_info());
+  DebugInfo* info = DebugInfo::cast(GetDebugInfo());
   bool break_at_entry = info->BreakAtEntry();
   return break_at_entry;
 }
 
 bool SharedFunctionInfo::HasCoverageInfo() const {
   if (!HasDebugInfo()) return false;
-  DebugInfo* info = DebugInfo::cast(debug_info());
+  DebugInfo* info = DebugInfo::cast(GetDebugInfo());
   bool has_coverage_info = info->HasCoverageInfo();
   return has_coverage_info;
 }
@@ -13620,83 +13813,23 @@ CoverageInfo* SharedFunctionInfo::GetCoverageInfo() const {
   return CoverageInfo::cast(GetDebugInfo()->coverage_info());
 }
 
-DebugInfo* SharedFunctionInfo::GetDebugInfo() const {
-  DCHECK(HasDebugInfo());
-  return DebugInfo::cast(debug_info());
-}
-
-int SharedFunctionInfo::debugger_hints() const {
-  if (HasDebugInfo()) return GetDebugInfo()->debugger_hints();
-  return Smi::ToInt(debug_info());
+String* SharedFunctionInfo::DebugName() {
+  DisallowHeapAllocation no_gc;
+  String* function_name = Name();
+  if (function_name->length() > 0) return function_name;
+  return inferred_name();
 }
 
-void SharedFunctionInfo::set_debugger_hints(int value) {
-  if (HasDebugInfo()) {
-    GetDebugInfo()->set_debugger_hints(value);
-  } else {
-    set_debug_info(Smi::FromInt(value));
-  }
+bool SharedFunctionInfo::PassesFilter(const char* raw_filter) {
+  Vector<const char> filter = CStrVector(raw_filter);
+  std::unique_ptr<char[]> cstrname(DebugName()->ToCString());
+  return v8::internal::PassesFilter(CStrVector(cstrname.get()), filter);
 }
 
-String* SharedFunctionInfo::DebugName() {
-  if (Name()->length() == 0) return inferred_name();
-  return Name();
-}
-
-// static
-bool SharedFunctionInfo::HasNoSideEffect(Handle<SharedFunctionInfo> info) {
-  if (!info->computed_has_no_side_effect()) {
-    DebugEvaluate::SideEffectState has_no_side_effect =
-        DebugEvaluate::FunctionGetSideEffectState(info);
-    info->set_has_no_side_effect(has_no_side_effect !=
-                                 DebugEvaluate::kHasSideEffects);
-    info->set_requires_runtime_side_effect_checks(
-        has_no_side_effect == DebugEvaluate::kRequiresRuntimeChecks);
-    info->set_computed_has_no_side_effect(true);
-  }
-  return info->has_no_side_effect();
-}
-
-// The filter is a pattern that matches function names in this way:
-//   "*"      all; the default
-//   "-"      all but the top-level function
-//   "-name"  all but the function "name"
-//   ""       only the top-level function
-//   "name"   only the function "name"
-//   "name*"  only functions starting with "name"
-//   "~"      none; the tilde is not an identifier
-bool SharedFunctionInfo::PassesFilter(const char* raw_filter) {
-  if (*raw_filter == '*') return true;
-  String* name = DebugName();
-  Vector<const char> filter = CStrVector(raw_filter);
-  if (filter.length() == 0) return name->length() == 0;
-  if (filter[0] == '-') {
-    // Negative filter.
-    if (filter.length() == 1) {
-      return (name->length() != 0);
-    } else if (name->IsUtf8EqualTo(filter.SubVector(1, filter.length()))) {
-      return false;
-    }
-    if (filter[filter.length() - 1] == '*' &&
-        name->IsUtf8EqualTo(filter.SubVector(1, filter.length() - 1), true)) {
-      return false;
-    }
-    return true;
-
-  } else if (name->IsUtf8EqualTo(filter)) {
-    return true;
-  }
-  if (filter[filter.length() - 1] == '*' &&
-      name->IsUtf8EqualTo(filter.SubVector(0, filter.length() - 1), true)) {
-    return true;
-  }
-  return false;
-}
-
-bool SharedFunctionInfo::HasSourceCode() const {
-  Isolate* isolate = GetIsolate();
-  return !script()->IsUndefined(isolate) &&
-         !reinterpret_cast<Script*>(script())->source()->IsUndefined(isolate);
+bool SharedFunctionInfo::HasSourceCode() const {
+  Isolate* isolate = GetIsolate();
+  return !script()->IsUndefined(isolate) &&
+         !reinterpret_cast<Script*>(script())->source()->IsUndefined(isolate);
 }
 
 // static
@@ -13704,7 +13837,8 @@ Handle<Object> SharedFunctionInfo::GetSourceCode(
     Handle<SharedFunctionInfo> shared) {
   Isolate* isolate = shared->GetIsolate();
   if (!shared->HasSourceCode()) return isolate->factory()->undefined_value();
-  Handle<String> source(String::cast(Script::cast(shared->script())->source()));
+  Handle<String> source(String::cast(Script::cast(shared->script())->source()),
+                        isolate);
   return isolate->factory()->NewSubString(source, shared->StartPosition(),
                                           shared->EndPosition());
 }
@@ -13715,9 +13849,9 @@ Handle<Object> SharedFunctionInfo::GetSourceCodeHarmony(
   Isolate* isolate = shared->GetIsolate();
   if (!shared->HasSourceCode()) return isolate->factory()->undefined_value();
   Handle<String> script_source(
-      String::cast(Script::cast(shared->script())->source()));
+      String::cast(Script::cast(shared->script())->source()), isolate);
   int start_pos = shared->function_token_position();
-  if (start_pos == kNoSourcePosition) start_pos = shared->StartPosition();
+  DCHECK_NE(start_pos, kNoSourcePosition);
   Handle<String> source = isolate->factory()->NewSubString(
       script_source, start_pos, shared->EndPosition());
   if (!shared->is_wrapped()) return source;
@@ -13727,11 +13861,12 @@ Handle<Object> SharedFunctionInfo::GetSourceCodeHarmony(
   builder.AppendCString("function ");
   builder.AppendString(Handle<String>(shared->Name(), isolate));
   builder.AppendCString("(");
-  Handle<FixedArray> args(Script::cast(shared->script())->wrapped_arguments());
+  Handle<FixedArray> args(Script::cast(shared->script())->wrapped_arguments(),
+                          isolate);
   int argc = args->length();
   for (int i = 0; i < argc; i++) {
     if (i > 0) builder.AppendCString(", ");
-    builder.AppendString(Handle<String>(String::cast(args->get(i))));
+    builder.AppendString(Handle<String>(String::cast(args->get(i)), isolate));
   }
   builder.AppendCString(") {\n");
   builder.AppendString(source);
@@ -13793,7 +13928,7 @@ bool JSFunction::CalculateInstanceSizeForDerivedClass(
     Handle<JSFunction> func(Handle<JSFunction>::cast(current));
     // The super constructor should be compiled for the number of expected
     // properties to be available.
-    Handle<SharedFunctionInfo> shared(func->shared());
+    Handle<SharedFunctionInfo> shared(func->shared(), isolate);
     if (shared->is_compiled() ||
         Compiler::Compile(func, Compiler::CLEAR_EXCEPTION)) {
       DCHECK(shared->is_compiled());
@@ -13870,15 +14005,18 @@ void SharedFunctionInfo::DisableOptimization(BailoutReason reason) {
 void SharedFunctionInfo::InitFromFunctionLiteral(
     Handle<SharedFunctionInfo> shared_info, FunctionLiteral* lit,
     bool is_toplevel) {
+  Isolate* isolate = shared_info->GetIsolate();
+  bool needs_position_info = true;
+
   // When adding fields here, make sure DeclarationScope::AnalyzePartially is
   // updated accordingly.
   shared_info->set_internal_formal_parameter_count(lit->parameter_count());
-  shared_info->set_function_token_position(lit->function_token_position());
-  shared_info->set_raw_start_position(lit->start_position());
-  shared_info->set_raw_end_position(lit->end_position());
+  shared_info->SetFunctionTokenPosition(lit->function_token_position(),
+                                        lit->start_position());
   if (shared_info->scope_info()->HasPositionInfo()) {
     shared_info->scope_info()->SetPositionInfo(lit->start_position(),
                                                lit->end_position());
+    needs_position_info = false;
   }
   shared_info->set_is_declaration(lit->is_declaration());
   shared_info->set_is_named_expression(lit->is_named_expression());
@@ -13898,7 +14036,7 @@ void SharedFunctionInfo::InitFromFunctionLiteral(
       lit->requires_instance_fields_initializer());
 
   shared_info->set_is_toplevel(is_toplevel);
-  DCHECK(shared_info->outer_scope_info()->IsTheHole(shared_info->GetIsolate()));
+  DCHECK(shared_info->outer_scope_info()->IsTheHole());
   if (!is_toplevel) {
     Scope* outer_scope = lit->scope()->GetOuterScopeWithContext();
     if (outer_scope) {
@@ -13915,6 +14053,14 @@ void SharedFunctionInfo::InitFromFunctionLiteral(
     shared_info->set_has_duplicate_parameters(lit->has_duplicate_parameters());
     shared_info->SetExpectedNofPropertiesFromEstimate(lit);
     DCHECK_NULL(lit->produced_preparsed_scope_data());
+    if (lit->ShouldEagerCompile()) {
+      // If we're about to eager compile, we'll have the function literal
+      // available, so there's no need to wastefully allocate an uncompiled
+      // data.
+      // TODO(leszeks): This should be explicitly passed as a parameter, rather
+      // than relying on a property of the literal.
+      needs_position_info = false;
+    }
   } else {
     // Set an invalid length for lazy functions. This way we can set the correct
     // value after compiling, but avoid overwriting values set manually by the
@@ -13924,15 +14070,25 @@ void SharedFunctionInfo::InitFromFunctionLiteral(
       ProducedPreParsedScopeData* scope_data =
           lit->produced_preparsed_scope_data();
       if (scope_data != nullptr) {
-        MaybeHandle<PreParsedScopeData> maybe_data =
-            scope_data->Serialize(shared_info->GetIsolate());
-        if (!maybe_data.is_null()) {
-          Handle<PreParsedScopeData> data = maybe_data.ToHandleChecked();
-          shared_info->set_preparsed_scope_data(*data);
+        Handle<PreParsedScopeData> pre_parsed_scope_data;
+        if (scope_data->Serialize(shared_info->GetIsolate())
+                .ToHandle(&pre_parsed_scope_data)) {
+          Handle<UncompiledData> data =
+              isolate->factory()->NewUncompiledDataWithPreParsedScope(
+                  lit->start_position(), lit->end_position(),
+                  pre_parsed_scope_data);
+          shared_info->set_uncompiled_data(*data);
+          needs_position_info = false;
         }
       }
     }
   }
+  if (needs_position_info) {
+    Handle<UncompiledData> data =
+        isolate->factory()->NewUncompiledDataWithoutPreParsedScope(
+            lit->start_position(), lit->end_position());
+    shared_info->set_uncompiled_data(*data);
+  }
 }
 
 void SharedFunctionInfo::SetExpectedNofPropertiesFromEstimate(
@@ -13947,9 +14103,28 @@ void SharedFunctionInfo::SetExpectedNofPropertiesFromEstimate(
   // so we can afford to adjust the estimate generously.
   estimate += 8;
 
+  // Limit actual estimate to fit in a 16 bit field, we will never allocate
+  // more than this in any case.
+  estimate = std::min(estimate, kMaxUInt16);
+
   set_expected_nof_properties(estimate);
 }
 
+void SharedFunctionInfo::SetFunctionTokenPosition(int function_token_position,
+                                                  int start_position) {
+  int offset;
+  if (function_token_position == kNoSourcePosition) {
+    offset = 0;
+  } else {
+    offset = start_position - function_token_position;
+  }
+
+  if (offset > kMaximumFunctionTokenOffset) {
+    offset = kFunctionTokenOutOfRange;
+  }
+  set_raw_function_token_offset(offset);
+}
+
 void Map::StartInobjectSlackTracking() {
   DCHECK(!IsInobjectSlackTrackingInProgress());
   if (UnusedPropertyFields() == 0) return;
@@ -13957,7 +14132,7 @@ void Map::StartInobjectSlackTracking() {
 }
 
 void ObjectVisitor::VisitCodeTarget(Code* host, RelocInfo* rinfo) {
-  DCHECK(RelocInfo::IsCodeTarget(rinfo->rmode()));
+  DCHECK(RelocInfo::IsCodeTargetMode(rinfo->rmode()));
   Object* old_pointer = Code::GetCodeFromTargetAddress(rinfo->target_address());
   Object* new_pointer = old_pointer;
   VisitPointer(host, &new_pointer);
@@ -13972,14 +14147,19 @@ void ObjectVisitor::VisitEmbeddedPointer(Code* host, RelocInfo* rinfo) {
   DCHECK_EQ(old_pointer, new_pointer);
 }
 
+void ObjectVisitor::VisitRelocInfo(RelocIterator* it) {
+  for (; !it->done(); it->next()) {
+    it->rinfo()->Visit(this);
+  }
+}
 
-void Code::InvalidateEmbeddedObjects() {
-  HeapObject* undefined = GetHeap()->undefined_value();
+void Code::InvalidateEmbeddedObjects(Heap* heap) {
+  HeapObject* undefined = ReadOnlyRoots(heap).undefined_value();
   int mode_mask = RelocInfo::ModeMask(RelocInfo::EMBEDDED_OBJECT);
   for (RelocIterator it(this, mode_mask); !it.done(); it.next()) {
     RelocInfo::Mode mode = it.rinfo()->rmode();
     if (mode == RelocInfo::EMBEDDED_OBJECT) {
-      it.rinfo()->set_target_object(undefined, SKIP_WRITE_BARRIER);
+      it.rinfo()->set_target_object(heap, undefined, SKIP_WRITE_BARRIER);
     }
   }
 }
@@ -13992,17 +14172,26 @@ void Code::Relocate(intptr_t delta) {
   Assembler::FlushICache(raw_instruction_start(), raw_instruction_size());
 }
 
+void Code::FlushICache() const {
+  Assembler::FlushICache(raw_instruction_start(), raw_instruction_size());
+}
+
+void Code::CopyFrom(Heap* heap, const CodeDesc& desc) {
+  CopyFromNoFlush(heap, desc);
+  FlushICache();
+}
 
-void Code::CopyFrom(const CodeDesc& desc) {
+void Code::CopyFromNoFlush(Heap* heap, const CodeDesc& desc) {
   // copy code
-  CopyBytes(raw_instruction_start(), desc.buffer,
+  CopyBytes(reinterpret_cast<byte*>(raw_instruction_start()), desc.buffer,
             static_cast<size_t>(desc.instr_size));
 
   // copy unwinding info, if any
   if (desc.unwinding_info) {
     DCHECK_GT(desc.unwinding_info_size, 0);
     set_unwinding_info_size(desc.unwinding_info_size);
-    CopyBytes(unwinding_info_start(), desc.unwinding_info,
+    CopyBytes(reinterpret_cast<byte*>(unwinding_info_start()),
+              desc.unwinding_info,
               static_cast<size_t>(desc.unwinding_info_size));
   }
 
@@ -14012,9 +14201,10 @@ void Code::CopyFrom(const CodeDesc& desc) {
             static_cast<size_t>(desc.reloc_size));
 
   // unbox handles and relocate
-  int mode_mask = RelocInfo::kCodeTargetMask |
+  int mode_mask = RelocInfo::ModeMask(RelocInfo::CODE_TARGET) |
                   RelocInfo::ModeMask(RelocInfo::EMBEDDED_OBJECT) |
                   RelocInfo::ModeMask(RelocInfo::RUNTIME_ENTRY) |
+                  RelocInfo::ModeMask(RelocInfo::RELATIVE_CODE_TARGET) |
                   RelocInfo::kApplyMask;
   // Needed to find target_object and runtime_entry on X64
   Assembler* origin = desc.origin;
@@ -14023,9 +14213,9 @@ void Code::CopyFrom(const CodeDesc& desc) {
     RelocInfo::Mode mode = it.rinfo()->rmode();
     if (mode == RelocInfo::EMBEDDED_OBJECT) {
       Handle<HeapObject> p = it.rinfo()->target_object_handle(origin);
-      it.rinfo()->set_target_object(*p, UPDATE_WRITE_BARRIER,
+      it.rinfo()->set_target_object(heap, *p, UPDATE_WRITE_BARRIER,
                                     SKIP_ICACHE_FLUSH);
-    } else if (RelocInfo::IsCodeTarget(mode)) {
+    } else if (RelocInfo::IsCodeTargetMode(mode)) {
       // rewrite code handles to direct pointers to the first instruction in the
       // code object
       Handle<Object> p = it.rinfo()->target_object_handle(origin);
@@ -14037,11 +14227,11 @@ void Code::CopyFrom(const CodeDesc& desc) {
       it.rinfo()->set_target_runtime_entry(p, UPDATE_WRITE_BARRIER,
                                            SKIP_ICACHE_FLUSH);
     } else {
-      intptr_t delta = raw_instruction_start() - desc.buffer;
+      intptr_t delta =
+          raw_instruction_start() - reinterpret_cast<Address>(desc.buffer);
       it.rinfo()->apply(delta);
     }
   }
-  Assembler::FlushICache(raw_instruction_start(), raw_instruction_size());
 }
 
 
@@ -14050,31 +14240,27 @@ SafepointEntry Code::GetSafepointEntry(Address pc) {
   return table.FindEntry(pc);
 }
 
-#ifdef V8_EMBEDDED_BUILTINS
 int Code::OffHeapInstructionSize() const {
-  DCHECK(Builtins::IsEmbeddedBuiltin(this));
+  DCHECK(is_off_heap_trampoline());
   if (Isolate::CurrentEmbeddedBlob() == nullptr) return raw_instruction_size();
   EmbeddedData d = EmbeddedData::FromBlob();
   return d.InstructionSizeOfBuiltin(builtin_index());
 }
 
 Address Code::OffHeapInstructionStart() const {
-  DCHECK(Builtins::IsEmbeddedBuiltin(this));
+  DCHECK(is_off_heap_trampoline());
   if (Isolate::CurrentEmbeddedBlob() == nullptr) return raw_instruction_start();
   EmbeddedData d = EmbeddedData::FromBlob();
-  return reinterpret_cast<Address>(
-      const_cast<uint8_t*>(d.InstructionStartOfBuiltin(builtin_index())));
+  return d.InstructionStartOfBuiltin(builtin_index());
 }
 
 Address Code::OffHeapInstructionEnd() const {
-  DCHECK(Builtins::IsEmbeddedBuiltin(this));
+  DCHECK(is_off_heap_trampoline());
   if (Isolate::CurrentEmbeddedBlob() == nullptr) return raw_instruction_end();
   EmbeddedData d = EmbeddedData::FromBlob();
-  return reinterpret_cast<Address>(
-      const_cast<uint8_t*>(d.InstructionStartOfBuiltin(builtin_index()) +
-                           d.InstructionSizeOfBuiltin(builtin_index())));
+  return d.InstructionStartOfBuiltin(builtin_index()) +
+         d.InstructionSizeOfBuiltin(builtin_index());
 }
-#endif
 
 namespace {
 template <typename Code>
@@ -14099,9 +14285,12 @@ void SetStackFrameCacheCommon(Handle<Code> code,
 void AbstractCode::SetStackFrameCache(Handle<AbstractCode> abstract_code,
                                       Handle<SimpleNumberDictionary> cache) {
   if (abstract_code->IsCode()) {
-    SetStackFrameCacheCommon(handle(abstract_code->GetCode()), cache);
+    SetStackFrameCacheCommon(
+        handle(abstract_code->GetCode(), abstract_code->GetIsolate()), cache);
   } else {
-    SetStackFrameCacheCommon(handle(abstract_code->GetBytecodeArray()), cache);
+    SetStackFrameCacheCommon(
+        handle(abstract_code->GetBytecodeArray(), abstract_code->GetIsolate()),
+        cache);
   }
 }
 
@@ -14211,39 +14400,53 @@ const char* AbstractCode::Kind2String(Kind kind) {
   UNREACHABLE();
 }
 
-#ifdef V8_EMBEDDED_BUILTINS
-bool Code::IsProcessIndependent() {
+bool Code::IsIsolateIndependent(Isolate* isolate) {
   constexpr int all_real_modes_mask =
       (1 << (RelocInfo::LAST_REAL_RELOC_MODE + 1)) - 1;
-  constexpr int mode_mask =
-      all_real_modes_mask & ~RelocInfo::ModeMask(RelocInfo::COMMENT) &
-      ~RelocInfo::ModeMask(RelocInfo::INTERNAL_REFERENCE) &
-      ~RelocInfo::ModeMask(RelocInfo::INTERNAL_REFERENCE_ENCODED) &
-      ~RelocInfo::ModeMask(RelocInfo::OFF_HEAP_TARGET) &
-      ~RelocInfo::ModeMask(RelocInfo::CONST_POOL) &
-      ~RelocInfo::ModeMask(RelocInfo::VENEER_POOL);
+  constexpr int mode_mask = all_real_modes_mask &
+                            ~RelocInfo::ModeMask(RelocInfo::COMMENT) &
+                            ~RelocInfo::ModeMask(RelocInfo::CONST_POOL) &
+                            ~RelocInfo::ModeMask(RelocInfo::OFF_HEAP_TARGET) &
+                            ~RelocInfo::ModeMask(RelocInfo::VENEER_POOL);
   STATIC_ASSERT(RelocInfo::LAST_REAL_RELOC_MODE == RelocInfo::VENEER_POOL);
   STATIC_ASSERT(RelocInfo::ModeMask(RelocInfo::COMMENT) ==
                 (1 << RelocInfo::COMMENT));
-  STATIC_ASSERT(
-      mode_mask ==
-      (RelocInfo::ModeMask(RelocInfo::CODE_TARGET) |
-       RelocInfo::ModeMask(RelocInfo::EMBEDDED_OBJECT) |
-       RelocInfo::ModeMask(RelocInfo::WASM_GLOBAL_HANDLE) |
-       RelocInfo::ModeMask(RelocInfo::WASM_CALL) |
-       RelocInfo::ModeMask(RelocInfo::JS_TO_WASM_CALL) |
-       RelocInfo::ModeMask(RelocInfo::RUNTIME_ENTRY) |
-       RelocInfo::ModeMask(RelocInfo::EXTERNAL_REFERENCE)));
-
-  RelocIterator it(this, mode_mask);
-  return it.done();
+  STATIC_ASSERT(mode_mask ==
+                (RelocInfo::ModeMask(RelocInfo::CODE_TARGET) |
+                 RelocInfo::ModeMask(RelocInfo::RELATIVE_CODE_TARGET) |
+                 RelocInfo::ModeMask(RelocInfo::EMBEDDED_OBJECT) |
+                 RelocInfo::ModeMask(RelocInfo::EXTERNAL_REFERENCE) |
+                 RelocInfo::ModeMask(RelocInfo::INTERNAL_REFERENCE) |
+                 RelocInfo::ModeMask(RelocInfo::INTERNAL_REFERENCE_ENCODED) |
+                 RelocInfo::ModeMask(RelocInfo::JS_TO_WASM_CALL) |
+                 RelocInfo::ModeMask(RelocInfo::RUNTIME_ENTRY) |
+                 RelocInfo::ModeMask(RelocInfo::WASM_CALL) |
+                 RelocInfo::ModeMask(RelocInfo::WASM_STUB_CALL)));
+
+  bool is_process_independent = true;
+  for (RelocIterator it(this, mode_mask); !it.done(); it.next()) {
+    if (RelocInfo::IsCodeTargetMode(it.rinfo()->rmode())) {
+      // Off-heap code targets are later rewritten as pc-relative jumps to the
+      // off-heap instruction stream and are thus process-independent.
+      Address target_address = it.rinfo()->target_address();
+      if (InstructionStream::PcIsOffHeap(isolate, target_address)) continue;
+
+      Code* target = Code::GetCodeFromTargetAddress(target_address);
+      CHECK(target->IsCode());
+      if (Builtins::IsIsolateIndependentBuiltin(target)) continue;
+    }
+    is_process_independent = false;
+  }
+
+  return is_process_independent;
 }
-#endif
 
 Handle<WeakCell> Code::WeakCellFor(Handle<Code> code) {
   DCHECK(code->kind() == OPTIMIZED_FUNCTION);
   WeakCell* raw_cell = code->CachedWeakCell();
-  if (raw_cell != nullptr) return Handle<WeakCell>(raw_cell);
+  if (raw_cell != nullptr) {
+    return Handle<WeakCell>(raw_cell, code->GetIsolate());
+  }
   Handle<WeakCell> cell = code->GetIsolate()->factory()->NewWeakCell(code);
   DeoptimizationData::cast(code->deoptimization_data())
       ->SetWeakCellCache(*cell);
@@ -14536,28 +14739,46 @@ void DeoptimizationData::DeoptimizationDataPrint(std::ostream& os) {  // NOLINT
   }
 }
 
+const char* Code::GetName(Isolate* isolate) const {
+  if (is_stub()) {
+    return CodeStub::MajorName(CodeStub::GetMajorKey(this));
+  } else if (kind() == BYTECODE_HANDLER) {
+    return isolate->interpreter()->LookupNameOfBytecodeHandler(this);
+  } else {
+    // There are some handlers and ICs that we can also find names for with
+    // Builtins::Lookup.
+    return isolate->builtins()->Lookup(raw_instruction_start());
+  }
+}
+
+void Code::PrintBuiltinCode(Isolate* isolate, const char* name) {
+  DCHECK(FLAG_print_builtin_code);
+  if (name == nullptr) {
+    name = GetName(isolate);
+  }
+  if (name != nullptr &&
+      PassesFilter(CStrVector(name),
+                   CStrVector(FLAG_print_builtin_code_filter))) {
+    CodeTracer::Scope trace_scope(isolate->GetCodeTracer());
+    OFStream os(trace_scope.file());
+    Disassemble(name, os);
+    os << "\n";
+  }
+}
 
-void Code::Disassemble(const char* name, std::ostream& os, void* current_pc) {
+void Code::Disassemble(const char* name, std::ostream& os, Address current_pc) {
+  Isolate* isolate = GetIsolate();
   os << "kind = " << Kind2String(kind()) << "\n";
   if (is_stub()) {
     const char* n = CodeStub::MajorName(CodeStub::GetMajorKey(this));
     os << "major_key = " << (n == nullptr ? "null" : n) << "\n";
     os << "minor_key = " << CodeStub::MinorKeyFromKey(this->stub_key()) << "\n";
   }
+  if (name == nullptr) {
+    name = GetName(isolate);
+  }
   if ((name != nullptr) && (name[0] != '\0')) {
     os << "name = " << name << "\n";
-  } else if (kind() == BYTECODE_HANDLER) {
-    name = GetIsolate()->interpreter()->LookupNameOfBytecodeHandler(this);
-    if (name != nullptr) {
-      os << "name = " << name << "\n";
-    }
-  } else {
-    // There are some handlers and ICs that we can also find names for with
-    // Builtins::Lookup.
-    name = GetIsolate()->builtins()->Lookup(raw_instruction_start());
-    if (name != nullptr) {
-      os << "name = " << name << "\n";
-    }
   }
   if (kind() == OPTIMIZED_FUNCTION) {
     os << "stack_slots = " << stack_slots() << "\n";
@@ -14567,7 +14788,6 @@ void Code::Disassemble(const char* name, std::ostream& os, void* current_pc) {
 
   os << "Body (size = " << InstructionSize() << ")\n";
   {
-    Isolate* isolate = GetIsolate();
     int size = InstructionSize();
     int safepoint_offset =
         has_safepoint_info() ? safepoint_table_offset() : size;
@@ -14578,9 +14798,18 @@ void Code::Disassemble(const char* name, std::ostream& os, void* current_pc) {
     int code_size =
         Min(handler_offset, Min(safepoint_offset, constant_pool_offset));
     os << "Instructions (size = " << code_size << ")\n";
-    byte* begin = InstructionStart();
-    byte* end = begin + code_size;
-    Disassembler::Decode(isolate, &os, begin, end, this, current_pc);
+    Address begin = InstructionStart();
+    Address end = begin + code_size;
+    {
+      // TODO(mstarzinger): Refactor CodeReference to avoid the
+      // unhandlified->handlified transition.
+      AllowHandleAllocation allow_handles;
+      DisallowHeapAllocation no_gc;
+      HandleScope handle_scope(isolate);
+      Disassembler::Decode(isolate, &os, reinterpret_cast<byte*>(begin),
+                           reinterpret_cast<byte*>(end),
+                           CodeReference(handle(this, isolate)), current_pc);
+    }
 
     if (constant_pool_offset < size) {
       int constant_pool_size = safepoint_offset - constant_pool_offset;
@@ -14619,7 +14848,8 @@ void Code::Disassemble(const char* name, std::ostream& os, void* current_pc) {
     os << "Safepoints (size = " << table.size() << ")\n";
     for (unsigned i = 0; i < table.length(); i++) {
       unsigned pc_offset = table.GetPcOffset(i);
-      os << static_cast<const void*>(InstructionStart() + pc_offset) << "  ";
+      os << reinterpret_cast<const void*>(InstructionStart() + pc_offset)
+         << "  ";
       os << std::setw(6) << std::hex << pc_offset << "  " << std::setw(4);
       int trampoline_pc = table.GetTrampolinePcOffset(i);
       print_pc(os, trampoline_pc);
@@ -14651,29 +14881,29 @@ void Code::Disassemble(const char* name, std::ostream& os, void* current_pc) {
 
   os << "RelocInfo (size = " << relocation_size() << ")\n";
   for (RelocIterator it(this); !it.done(); it.next()) {
-    it.rinfo()->Print(GetIsolate(), os);
+    it.rinfo()->Print(isolate, os);
   }
   os << "\n";
 
   if (has_unwinding_info()) {
     os << "UnwindingInfo (size = " << unwinding_info_size() << ")\n";
-    EhFrameDisassembler eh_frame_disassembler(unwinding_info_start(),
-                                              unwinding_info_end());
+    EhFrameDisassembler eh_frame_disassembler(
+        reinterpret_cast<byte*>(unwinding_info_start()),
+        reinterpret_cast<byte*>(unwinding_info_end()));
     eh_frame_disassembler.DisassembleToStream(os);
     os << "\n";
   }
 }
 #endif  // ENABLE_DISASSEMBLER
 
-
-void BytecodeArray::Disassemble(std::ostream& os) {
+void BytecodeArray::Disassemble(Isolate* isolate, std::ostream& os) {
   os << "Parameter count " << parameter_count() << "\n";
   os << "Frame size " << frame_size() << "\n";
 
-  const uint8_t* base_address = GetFirstBytecodeAddress();
+  Address base_address = GetFirstBytecodeAddress();
   SourcePositionTableIterator source_positions(SourcePositionTable());
 
-  interpreter::BytecodeArrayIterator iterator(handle(this));
+  interpreter::BytecodeArrayIterator iterator(handle(this, isolate));
   while (!iterator.done()) {
     if (!source_positions.done() &&
         iterator.current_offset() == source_positions.code_offset()) {
@@ -14683,15 +14913,15 @@ void BytecodeArray::Disassemble(std::ostream& os) {
     } else {
       os << "         ";
     }
-    const uint8_t* current_address = base_address + iterator.current_offset();
+    Address current_address = base_address + iterator.current_offset();
     os << reinterpret_cast<const void*>(current_address) << " @ "
        << std::setw(4) << iterator.current_offset() << " : ";
-    interpreter::BytecodeDecoder::Decode(os, current_address,
-                                         parameter_count());
+    interpreter::BytecodeDecoder::Decode(
+        os, reinterpret_cast<byte*>(current_address), parameter_count());
     if (interpreter::Bytecodes::IsJump(iterator.current_bytecode())) {
-      const void* jump_target = base_address + iterator.GetJumpTargetOffset();
-      os << " (" << jump_target << " @ " << iterator.GetJumpTargetOffset()
-         << ")";
+      Address jump_target = base_address + iterator.GetJumpTargetOffset();
+      os << " (" << reinterpret_cast<void*>(jump_target) << " @ "
+         << iterator.GetJumpTargetOffset() << ")";
     }
     if (interpreter::Bytecodes::IsSwitch(iterator.current_bytecode())) {
       os << " {";
@@ -14713,7 +14943,7 @@ void BytecodeArray::Disassemble(std::ostream& os) {
   os << "Constant pool (size = " << constant_pool()->length() << ")\n";
 #ifdef OBJECT_PRINT
   if (constant_pool()->length() > 0) {
-    constant_pool()->Print();
+    constant_pool()->Print(isolate);
   }
 #endif
 
@@ -14729,7 +14959,8 @@ void BytecodeArray::Disassemble(std::ostream& os) {
 void BytecodeArray::CopyBytecodesTo(BytecodeArray* to) {
   BytecodeArray* from = this;
   DCHECK_EQ(from->length(), to->length());
-  CopyBytes(to->GetFirstBytecodeAddress(), from->GetFirstBytecodeAddress(),
+  CopyBytes(reinterpret_cast<byte*>(to->GetFirstBytecodeAddress()),
+            reinterpret_cast<byte*>(from->GetFirstBytecodeAddress()),
             from->length());
 }
 
@@ -14737,12 +14968,12 @@ void BytecodeArray::MakeOlder() {
   // BytecodeArray is aged in concurrent marker.
   // The word must be completely within the byte code array.
   Address age_addr = address() + kBytecodeAgeOffset;
-  DCHECK_LE((reinterpret_cast<uintptr_t>(age_addr) & ~kPointerAlignmentMask) +
-                kPointerSize,
-            reinterpret_cast<uintptr_t>(address() + Size()));
+  DCHECK_LE((age_addr & ~kPointerAlignmentMask) + kPointerSize,
+            address() + Size());
   Age age = bytecode_age();
   if (age < kLastBytecodeAge) {
-    base::AsAtomic8::Release_CompareAndSwap(age_addr, age, age + 1);
+    base::AsAtomic8::Release_CompareAndSwap(reinterpret_cast<byte*>(age_addr),
+                                            age, age + 1);
   }
 
   DCHECK_GE(bytecode_age(), kFirstBytecodeAge);
@@ -14769,43 +15000,49 @@ void JSArray::SetLength(Handle<JSArray> array, uint32_t new_length) {
   array->GetElementsAccessor()->SetLength(array, new_length);
 }
 
-
-// static
-void Map::AddDependentCode(Handle<Map> map,
-                           DependentCode::DependencyGroup group,
-                           Handle<Code> code) {
-  Handle<WeakCell> cell = Code::WeakCellFor(code);
-  Handle<DependentCode> codes = DependentCode::InsertWeakCode(
-      Handle<DependentCode>(map->dependent_code()), group, cell);
-  if (*codes != map->dependent_code()) map->set_dependent_code(*codes);
+DependentCode* DependentCode::Get(Handle<HeapObject> object) {
+  if (object->IsMap()) {
+    return Handle<Map>::cast(object)->dependent_code();
+  } else if (object->IsPropertyCell()) {
+    return Handle<PropertyCell>::cast(object)->dependent_code();
+  } else if (object->IsAllocationSite()) {
+    return Handle<AllocationSite>::cast(object)->dependent_code();
+  }
+  UNREACHABLE();
 }
 
-
-Handle<DependentCode> DependentCode::InsertCompilationDependencies(
-    Handle<DependentCode> entries, DependencyGroup group,
-    Handle<Foreign> info) {
-  return Insert(entries, group, info);
+void DependentCode::Set(Handle<HeapObject> object, Handle<DependentCode> dep) {
+  if (object->IsMap()) {
+    Handle<Map>::cast(object)->set_dependent_code(*dep);
+  } else if (object->IsPropertyCell()) {
+    Handle<PropertyCell>::cast(object)->set_dependent_code(*dep);
+  } else if (object->IsAllocationSite()) {
+    Handle<AllocationSite>::cast(object)->set_dependent_code(*dep);
+  } else {
+    UNREACHABLE();
+  }
 }
 
+void DependentCode::InstallDependency(Isolate* isolate, Handle<WeakCell> cell,
+                                      Handle<HeapObject> object,
+                                      DependencyGroup group) {
+  Handle<DependentCode> old_deps(DependentCode::Get(object), isolate);
+  Handle<DependentCode> new_deps = InsertWeakCode(old_deps, group, cell);
+  // Update the list head if necessary.
+  if (!new_deps.is_identical_to(old_deps)) DependentCode::Set(object, new_deps);
+}
 
 Handle<DependentCode> DependentCode::InsertWeakCode(
     Handle<DependentCode> entries, DependencyGroup group,
     Handle<WeakCell> code_cell) {
-  return Insert(entries, group, code_cell);
-}
-
-
-Handle<DependentCode> DependentCode::Insert(Handle<DependentCode> entries,
-                                            DependencyGroup group,
-                                            Handle<Object> object) {
   if (entries->length() == 0 || entries->group() > group) {
     // There is no such group.
-    return DependentCode::New(group, object, entries);
+    return DependentCode::New(group, code_cell, entries);
   }
   if (entries->group() < group) {
     // The group comes later in the list.
-    Handle<DependentCode> old_next(entries->next_link());
-    Handle<DependentCode> new_next = Insert(old_next, group, object);
+    Handle<DependentCode> old_next(entries->next_link(), entries->GetIsolate());
+    Handle<DependentCode> new_next = InsertWeakCode(old_next, group, code_cell);
     if (!old_next.is_identical_to(new_next)) {
       entries->set_next_link(*new_next);
     }
@@ -14815,14 +15052,14 @@ Handle<DependentCode> DependentCode::Insert(Handle<DependentCode> entries,
   int count = entries->count();
   // Check for existing entry to avoid duplicates.
   for (int i = 0; i < count; i++) {
-    if (entries->object_at(i) == *object) return entries;
+    if (entries->object_at(i) == *code_cell) return entries;
   }
   if (entries->length() < kCodesStartIndex + count + 1) {
     entries = EnsureSpace(entries);
     // Count could have changed, reload it.
     count = entries->count();
   }
-  entries->set_object_at(count, *object);
+  entries->set_object_at(count, *code_cell);
   entries->set_count(count + 1);
   return entries;
 }
@@ -14872,34 +15109,6 @@ bool DependentCode::Compact() {
 }
 
 
-void DependentCode::UpdateToFinishedCode(DependencyGroup group, Foreign* info,
-                                         WeakCell* code_cell) {
-  if (this->length() == 0 || this->group() > group) {
-    // There is no such group.
-    return;
-  }
-  if (this->group() < group) {
-    // The group comes later in the list.
-    next_link()->UpdateToFinishedCode(group, info, code_cell);
-    return;
-  }
-  DCHECK_EQ(group, this->group());
-  DisallowHeapAllocation no_gc;
-  int count = this->count();
-  for (int i = 0; i < count; i++) {
-    if (object_at(i) == info) {
-      set_object_at(i, code_cell);
-      break;
-    }
-  }
-#ifdef DEBUG
-  for (int i = 0; i < count; i++) {
-    DCHECK(object_at(i) != info);
-  }
-#endif
-}
-
-
 void DependentCode::RemoveCompilationDependencies(
     DependentCode::DependencyGroup group, Foreign* info) {
   if (this->length() == 0 || this->group() > group) {
@@ -14988,20 +15197,12 @@ bool DependentCode::MarkCodeForDeoptimization(
   int count = this->count();
   for (int i = 0; i < count; i++) {
     Object* obj = object_at(i);
-    if (obj->IsWeakCell()) {
-      WeakCell* cell = WeakCell::cast(obj);
-      if (cell->cleared()) continue;
-      Code* code = Code::cast(cell->value());
-      if (!code->marked_for_deoptimization()) {
-        code->SetMarkedForDeoptimization(DependencyGroupName(group));
-        marked = true;
-      }
-    } else {
-      DCHECK(obj->IsForeign());
-      CompilationDependencies* info =
-          reinterpret_cast<CompilationDependencies*>(
-              Foreign::cast(obj)->foreign_address());
-      info->Abort();
+    WeakCell* cell = WeakCell::cast(obj);
+    if (cell->cleared()) continue;
+    Code* code = Code::cast(cell->value());
+    if (!code->marked_for_deoptimization()) {
+      code->SetMarkedForDeoptimization(DependencyGroupName(group));
+      marked = true;
     }
   }
   for (int i = 0; i < count; i++) {
@@ -15026,12 +15227,12 @@ void DependentCode::DeoptimizeDependentCodeGroup(
 void Code::SetMarkedForDeoptimization(const char* reason) {
   set_marked_for_deoptimization(true);
   if (FLAG_trace_deopt &&
-      (deoptimization_data() != GetHeap()->empty_fixed_array())) {
+      (deoptimization_data() != GetReadOnlyRoots().empty_fixed_array())) {
     DeoptimizationData* deopt_data =
         DeoptimizationData::cast(deoptimization_data());
     CodeTracer::Scope scope(GetHeap()->isolate()->GetCodeTracer());
     PrintF(scope.file(),
-           "[marking dependent code 0x%08" V8PRIxPTR
+           "[marking dependent code " V8PRIxPTR_FMT
            " (opt #%d) for deoptimization, reason: %s]\n",
            reinterpret_cast<intptr_t>(this),
            deopt_data->OptimizationId()->value(), reason);
@@ -15059,14 +15260,15 @@ const char* DependentCode::DependencyGroupName(DependencyGroup group) {
   UNREACHABLE();
 }
 
-Handle<Map> Map::TransitionToPrototype(Handle<Map> map,
+Handle<Map> Map::TransitionToPrototype(Isolate* isolate, Handle<Map> map,
                                        Handle<Object> prototype) {
   Handle<Map> new_map =
-      TransitionsAccessor(map).GetPrototypeTransition(prototype);
+      TransitionsAccessor(isolate, map).GetPrototypeTransition(prototype);
   if (new_map.is_null()) {
-    new_map = Copy(map, "TransitionToPrototype");
-    TransitionsAccessor(map).PutPrototypeTransition(prototype, new_map);
-    Map::SetPrototype(new_map, prototype);
+    new_map = Copy(isolate, map, "TransitionToPrototype");
+    TransitionsAccessor(isolate, map)
+        .PutPrototypeTransition(prototype, new_map);
+    Map::SetPrototype(isolate, new_map, prototype);
   }
   return new_map;
 }
@@ -15123,7 +15325,7 @@ Maybe<bool> JSProxy::SetPrototype(Handle<JSProxy> proxy, Handle<Object> value,
       isolate, trap_result,
       Execution::Call(isolate, trap, handler, arraysize(argv), argv),
       Nothing<bool>());
-  bool bool_trap_result = trap_result->BooleanValue();
+  bool bool_trap_result = trap_result->BooleanValue(isolate);
   // 9. If booleanTrapResult is false, return false.
   if (!bool_trap_result) {
     RETURN_FAILURE(
@@ -15167,7 +15369,7 @@ Maybe<bool> JSObject::SetPrototype(Handle<JSObject> object,
 
   if (from_javascript) {
     if (object->IsAccessCheckNeeded() &&
-        !isolate->MayAccess(handle(isolate->context()), object)) {
+        !isolate->MayAccess(handle(isolate->context(), isolate), object)) {
       isolate->ReportFailedAccessCheck(object);
       RETURN_VALUE_IF_SCHEDULED_EXCEPTION(isolate, Nothing<bool>());
       RETURN_FAILURE(isolate, should_throw,
@@ -15196,7 +15398,7 @@ Maybe<bool> JSObject::SetPrototype(Handle<JSObject> object,
       all_extensible = all_extensible && real_receiver->map()->is_extensible();
     }
   }
-  Handle<Map> map(real_receiver->map());
+  Handle<Map> map(real_receiver->map(), isolate);
 
   // Nothing to do if prototype is already set.
   if (map->prototype() == *value) return Just(true);
@@ -15240,7 +15442,7 @@ Maybe<bool> JSObject::SetPrototype(Handle<JSObject> object,
 
   isolate->UpdateNoElementsProtectorOnSetPrototype(real_receiver);
 
-  Handle<Map> new_map = Map::TransitionToPrototype(map, value);
+  Handle<Map> new_map = Map::TransitionToPrototype(isolate, map, value);
   DCHECK(new_map->prototype() == *value);
   JSObject::MigrateToMap(real_receiver, new_map);
 
@@ -15251,12 +15453,13 @@ Maybe<bool> JSObject::SetPrototype(Handle<JSObject> object,
 // static
 void JSObject::SetImmutableProto(Handle<JSObject> object) {
   DCHECK(!object->IsAccessCheckNeeded());  // Never called from JS
-  Handle<Map> map(object->map());
+  Handle<Map> map(object->map(), object->GetIsolate());
 
   // Nothing to do if prototype is already set.
   if (map->is_immutable_proto()) return;
 
-  Handle<Map> new_map = Map::TransitionToImmutableProto(map);
+  Handle<Map> new_map =
+      Map::TransitionToImmutableProto(object->GetIsolate(), map);
   object->synchronized_set_map(*new_map);
 }
 
@@ -15300,7 +15503,7 @@ static bool ShouldConvertToSlowElements(JSObject* object, uint32_t capacity,
   DCHECK_LT(index, *new_capacity);
   if (*new_capacity <= JSObject::kMaxUncheckedOldFastElementsLength ||
       (*new_capacity <= JSObject::kMaxUncheckedFastElementsLength &&
-       object->GetHeap()->InNewSpace(object))) {
+       Heap::InNewSpace(object))) {
     return false;
   }
   // If the fast-case backing storage takes up much more memory than a
@@ -15377,23 +15580,10 @@ static bool ShouldConvertToFastElements(JSObject* object,
   return 2 * dictionary_size >= *new_capacity;
 }
 
-
-// static
-MaybeHandle<Object> JSObject::AddDataElement(Handle<JSObject> object,
-                                             uint32_t index,
-                                             Handle<Object> value,
-                                             PropertyAttributes attributes) {
-  MAYBE_RETURN_NULL(
-      AddDataElement(object, index, value, attributes, kThrowOnError));
-  return value;
-}
-
-
 // static
-Maybe<bool> JSObject::AddDataElement(Handle<JSObject> object, uint32_t index,
-                                     Handle<Object> value,
-                                     PropertyAttributes attributes,
-                                     ShouldThrow should_throw) {
+void JSObject::AddDataElement(Handle<JSObject> object, uint32_t index,
+                              Handle<Object> value,
+                              PropertyAttributes attributes) {
   DCHECK(object->map()->is_extensible());
 
   Isolate* isolate = object->GetIsolate();
@@ -15443,8 +15633,6 @@ Maybe<bool> JSObject::AddDataElement(Handle<JSObject> object, uint32_t index,
         isolate->factory()->NewNumberFromUint(index + 1);
     JSArray::cast(*object)->set_length(*new_length);
   }
-
-  return Just(true);
 }
 
 
@@ -15475,7 +15663,7 @@ PretenureFlag AllocationSite::GetPretenureMode() const {
 
 bool AllocationSite::IsNested() {
   DCHECK(FLAG_trace_track_allocation_sites);
-  Object* current = GetHeap()->allocation_sites_list();
+  Object* current = boilerplate()->GetHeap()->allocation_sites_list();
   while (current->IsAllocationSite()) {
     AllocationSite* current_site = AllocationSite::cast(current);
     if (current_site->nested_site() == this) {
@@ -15566,19 +15754,19 @@ bool JSObject::UpdateAllocationSite(Handle<JSObject> object,
                                     ElementsKind to_kind) {
   if (!object->IsJSArray()) return false;
 
-  Heap* heap = object->GetHeap();
-  if (!heap->InNewSpace(*object)) return false;
+  if (!Heap::InNewSpace(*object)) return false;
 
   Handle<AllocationSite> site;
   {
     DisallowHeapAllocation no_allocation;
 
+    Heap* heap = object->GetHeap();
     AllocationMemento* memento =
         heap->FindAllocationMemento<Heap::kForRuntime>(object->map(), *object);
     if (memento == nullptr) return false;
 
     // Walk through to the Allocation Site
-    site = handle(memento->GetAllocationSite());
+    site = handle(memento->GetAllocationSite(), heap->isolate());
   }
   return AllocationSite::DigestTransitionFeedback<update_or_check>(site,
                                                                    to_kind);
@@ -15607,14 +15795,14 @@ void JSObject::TransitionElementsKind(Handle<JSObject> object,
   DCHECK_NE(TERMINAL_FAST_ELEMENTS_KIND, from_kind);
 
   UpdateAllocationSite(object, to_kind);
-  if (object->elements() == object->GetHeap()->empty_fixed_array() ||
+  if (object->elements() == object->GetReadOnlyRoots().empty_fixed_array() ||
       IsDoubleElementsKind(from_kind) == IsDoubleElementsKind(to_kind)) {
     // No change is needed to the elements() buffer, the transition
     // only requires a map change.
     Handle<Map> new_map = GetElementsTransitionMap(object, to_kind);
     MigrateToMap(object, new_map);
     if (FLAG_trace_elements_transitions) {
-      Handle<FixedArrayBase> elms(object->elements());
+      Handle<FixedArrayBase> elms(object->elements(), object->GetIsolate());
       PrintElementsTransition(stdout, object, from_kind, elms, to_kind, elms);
     }
   } else {
@@ -15645,7 +15833,7 @@ bool JSArray::HasReadOnlyLength(Handle<JSArray> array) {
   // configurable, it's guaranteed to be the first in the descriptor array.
   if (!map->is_dictionary_map()) {
     DCHECK(map->instance_descriptors()->GetKey(0) ==
-           array->GetHeap()->length_string());
+           array->GetReadOnlyRoots().length_string());
     return map->instance_descriptors()->GetDetails(0).IsReadOnly();
   }
 
@@ -15667,7 +15855,7 @@ bool JSArray::WouldChangeReadOnlyLength(Handle<JSArray> array,
 
 template <typename BackingStore>
 static int HoleyElementsUsage(JSObject* object, BackingStore* store) {
-  Isolate* isolate = store->GetIsolate();
+  Isolate* isolate = object->GetIsolate();
   int limit = object->IsJSArray() ? Smi::ToInt(JSArray::cast(object)->length())
                                   : store->length();
   int used = 0;
@@ -15738,7 +15926,7 @@ void Dictionary<Derived, Shape>::Print(std::ostream& os) {
 }
 template <typename Derived, typename Shape>
 void Dictionary<Derived, Shape>::Print() {
-  OFStream os(stdout);
+  StdoutStream os;
   Print(os);
   os << std::endl;
 }
@@ -15754,7 +15942,7 @@ MaybeHandle<Object> JSObject::GetPropertyWithInterceptor(LookupIterator* it,
 Maybe<bool> JSObject::HasRealNamedProperty(Handle<JSObject> object,
                                            Handle<Name> name) {
   LookupIterator it = LookupIterator::PropertyOrElement(
-      name->GetIsolate(), object, name, LookupIterator::OWN_SKIP_INTERCEPTOR);
+      object->GetIsolate(), object, name, LookupIterator::OWN_SKIP_INTERCEPTOR);
   return HasProperty(&it);
 }
 
@@ -15771,7 +15959,7 @@ Maybe<bool> JSObject::HasRealElementProperty(Handle<JSObject> object,
 Maybe<bool> JSObject::HasRealNamedCallbackProperty(Handle<JSObject> object,
                                                    Handle<Name> name) {
   LookupIterator it = LookupIterator::PropertyOrElement(
-      name->GetIsolate(), object, name, LookupIterator::OWN_SKIP_INTERCEPTOR);
+      object->GetIsolate(), object, name, LookupIterator::OWN_SKIP_INTERCEPTOR);
   Maybe<PropertyAttributes> maybe_result = GetPropertyAttributes(&it);
   return maybe_result.IsJust() ? Just(it.state() == LookupIterator::ACCESSOR)
                                : Nothing<bool>();
@@ -15783,7 +15971,7 @@ int FixedArrayBase::GetMaxLengthForNewSpaceAllocation(ElementsKind kind) {
 }
 
 bool FixedArrayBase::IsCowArray() const {
-  return map() == GetHeap()->fixed_cow_array_map();
+  return map() == GetReadOnlyRoots().fixed_cow_array_map();
 }
 
 bool JSObject::WasConstructedFromApiFunction() {
@@ -15816,10 +16004,10 @@ bool JSObject::WasConstructedFromApiFunction() {
   return is_api_object;
 }
 
-const char* Symbol::PrivateSymbolToName() const {
-  Heap* heap = GetIsolate()->heap();
+const char* Symbol::PrivateSymbolToName(Isolate* isolate) const {
+  ReadOnlyRoots roots(isolate);
 #define SYMBOL_CHECK_AND_PRINT(name) \
-  if (this == heap->name()) return #name;
+  if (this == roots.name()) return #name;
   PRIVATE_SYMBOL_LIST(SYMBOL_CHECK_AND_PRINT)
 #undef SYMBOL_CHECK_AND_PRINT
   return "UNKNOWN";
@@ -15827,15 +16015,16 @@ const char* Symbol::PrivateSymbolToName() const {
 
 
 void Symbol::SymbolShortPrint(std::ostream& os) {
+  Isolate* isolate = GetIsolate();
   os << "<Symbol:";
-  if (!name()->IsUndefined(GetIsolate())) {
+  if (!name()->IsUndefined(isolate)) {
     os << " ";
     HeapStringAllocator allocator;
     StringStream accumulator(&allocator);
     String::cast(name())->StringShortPrint(&accumulator, false);
     os << accumulator.ToCString().get();
   } else {
-    os << " (" << PrivateSymbolToName() << ")";
+    os << " (" << PrivateSymbolToName(isolate) << ")";
   }
   os << ">";
 }
@@ -15889,7 +16078,7 @@ class StringSharedKey : public HashTableKey {
     array->set(1, *source_);
     array->set(2, Smi::FromEnum(language_mode_));
     array->set(3, Smi::FromInt(position_));
-    array->set_map(isolate->heap()->fixed_cow_array_map());
+    array->set_map(ReadOnlyRoots(isolate).fixed_cow_array_map());
     return array;
   }
 
@@ -15924,6 +16113,14 @@ const char* JSPromise::Status(v8::Promise::PromiseState status) {
   UNREACHABLE();
 }
 
+int JSPromise::async_task_id() const {
+  return AsyncTaskIdField::decode(flags());
+}
+
+void JSPromise::set_async_task_id(int id) {
+  set_flags(AsyncTaskIdField::update(flags(), id));
+}
+
 // static
 Handle<Object> JSPromise::Fulfill(Handle<JSPromise> promise,
                                   Handle<Object> value) {
@@ -16015,8 +16212,9 @@ MaybeHandle<Object> JSPromise::Resolve(Handle<JSPromise> promise,
     // on JSPromise instances which have the (initial) %PromisePrototype%.
     then = isolate->promise_then();
   } else {
-    then = JSReceiver::GetProperty(Handle<JSReceiver>::cast(resolution),
-                                   isolate->factory()->then_string());
+    then =
+        JSReceiver::GetProperty(isolate, Handle<JSReceiver>::cast(resolution),
+                                isolate->factory()->then_string());
   }
 
   // 9. If then is an abrupt completion, then
@@ -16086,7 +16284,7 @@ Handle<Object> JSPromise::TriggerPromiseReactions(Isolate* isolate,
     STATIC_ASSERT(PromiseReaction::kSize == PromiseReactionJobTask::kSize);
     if (type == PromiseReaction::kFulfill) {
       task->synchronized_set_map(
-          isolate->heap()->promise_fulfill_reaction_job_task_map());
+          ReadOnlyRoots(isolate).promise_fulfill_reaction_job_task_map());
       Handle<PromiseFulfillReactionJobTask>::cast(task)->set_argument(
           *argument);
       Handle<PromiseFulfillReactionJobTask>::cast(task)->set_context(
@@ -16099,7 +16297,7 @@ Handle<Object> JSPromise::TriggerPromiseReactions(Isolate* isolate,
       DisallowHeapAllocation no_gc;
       HeapObject* handler = reaction->reject_handler();
       task->synchronized_set_map(
-          isolate->heap()->promise_reject_reaction_job_task_map());
+          ReadOnlyRoots(isolate).promise_reject_reaction_job_task_map());
       Handle<PromiseRejectReactionJobTask>::cast(task)->set_argument(*argument);
       Handle<PromiseRejectReactionJobTask>::cast(task)->set_context(
           *isolate->native_context());
@@ -16245,7 +16443,7 @@ MaybeHandle<String> EscapeRegExpSource(Isolate* isolate,
 MaybeHandle<JSRegExp> JSRegExp::Initialize(Handle<JSRegExp> regexp,
                                            Handle<String> source,
                                            Handle<String> flags_string) {
-  Isolate* isolate = source->GetIsolate();
+  Isolate* isolate = regexp->GetIsolate();
   bool success = false;
   Flags flags = RegExpFlagsFromString(flags_string, &success);
   if (!success) {
@@ -16267,14 +16465,14 @@ MaybeHandle<JSRegExp> JSRegExp::Initialize(Handle<JSRegExp> regexp,
   // suggested by ECMA-262, 5th, section 15.10.4.1.
   if (source->length() == 0) source = factory->query_colon_string();
 
-  source = String::Flatten(source);
+  source = String::Flatten(isolate, source);
 
   Handle<String> escaped_source;
   ASSIGN_RETURN_ON_EXCEPTION(isolate, escaped_source,
                              EscapeRegExpSource(isolate, source), JSRegExp);
 
-  RETURN_ON_EXCEPTION(isolate, RegExpImpl::Compile(regexp, source, flags),
-                      JSRegExp);
+  RETURN_ON_EXCEPTION(
+      isolate, RegExpImpl::Compile(isolate, regexp, source, flags), JSRegExp);
 
   regexp->set_source(*escaped_source);
   regexp->set_flags(Smi::FromInt(flags));
@@ -16525,8 +16723,8 @@ void HashTable<Derived, Shape>::Rehash() {
     }
   }
   // Wipe deleted entries.
-  Object* the_hole = isolate->heap()->the_hole_value();
-  Object* undefined = isolate->heap()->undefined_value();
+  Object* the_hole = ReadOnlyRoots(isolate).the_hole_value();
+  Object* undefined = ReadOnlyRoots(isolate).undefined_value();
   for (uint32_t current = 0; current < capacity; current++) {
     if (KeyAt(current) == the_hole) {
       set(EntryToIndex(current) + kEntryKeyIndex, undefined);
@@ -16545,9 +16743,9 @@ Handle<Derived> HashTable<Derived, Shape>::EnsureCapacity(
   int new_nof = table->NumberOfElements() + n;
 
   const int kMinCapacityForPretenure = 256;
-  bool should_pretenure = pretenure == TENURED ||
-      ((capacity > kMinCapacityForPretenure) &&
-          !isolate->heap()->InNewSpace(*table));
+  bool should_pretenure =
+      pretenure == TENURED ||
+      ((capacity > kMinCapacityForPretenure) && !Heap::InNewSpace(*table));
   Handle<Derived> new_table = HashTable::New(
       isolate, new_nof, should_pretenure ? TENURED : NOT_TENURED);
 
@@ -16588,18 +16786,17 @@ Handle<Derived> HashTable<Derived, Shape>::Shrink(Handle<Derived> table,
   // there is extra room in the dictionary for additions. Don't go lower than
   // room for {kMinShrinkCapacity} elements.
   int at_least_room_for = nof + additionalCapacity;
-  DCHECK_LE(at_least_room_for, capacity);
-  if (at_least_room_for < Derived::kMinShrinkCapacity) return table;
+  int new_capacity = ComputeCapacity(at_least_room_for);
+  if (new_capacity < Derived::kMinShrinkCapacity) return table;
+  if (new_capacity == capacity) return table;
 
   Isolate* isolate = table->GetIsolate();
   const int kMinCapacityForPretenure = 256;
-  bool pretenure =
-      (at_least_room_for > kMinCapacityForPretenure) &&
-      !isolate->heap()->InNewSpace(*table);
-  Handle<Derived> new_table = HashTable::New(
-      isolate,
-      at_least_room_for,
-      pretenure ? TENURED : NOT_TENURED);
+  bool pretenure = (at_least_room_for > kMinCapacityForPretenure) &&
+                   !Heap::InNewSpace(*table);
+  Handle<Derived> new_table =
+      HashTable::New(isolate, new_capacity, pretenure ? TENURED : NOT_TENURED,
+                     USE_CUSTOM_MINIMUM_CAPACITY);
 
   table->Rehash(*new_table);
   return new_table;
@@ -16619,139 +16816,6 @@ uint32_t HashTable<Derived, Shape>::FindInsertionEntry(uint32_t hash) {
   return entry;
 }
 
-
-// Force instantiation of template instances class.
-// Please note this list is compiler dependent.
-
-template class HashTable<StringTable, StringTableShape>;
-
-template class HashTable<CompilationCacheTable, CompilationCacheShape>;
-
-template class HashTable<ObjectHashTable, ObjectHashTableShape>;
-
-template class Dictionary<NameDictionary, NameDictionaryShape>;
-
-template class Dictionary<GlobalDictionary, GlobalDictionaryShape>;
-
-template class EXPORT_TEMPLATE_DEFINE(
-    V8_EXPORT_PRIVATE) HashTable<NumberDictionary, NumberDictionaryShape>;
-
-template class EXPORT_TEMPLATE_DEFINE(V8_EXPORT_PRIVATE)
-    Dictionary<NumberDictionary, NumberDictionaryShape>;
-
-template class EXPORT_TEMPLATE_DEFINE(V8_EXPORT_PRIVATE)
-    HashTable<SimpleNumberDictionary, SimpleNumberDictionaryShape>;
-
-template class EXPORT_TEMPLATE_DEFINE(V8_EXPORT_PRIVATE)
-    Dictionary<SimpleNumberDictionary, SimpleNumberDictionaryShape>;
-
-template Handle<NameDictionary>
-BaseNameDictionary<NameDictionary, NameDictionaryShape>::New(
-    Isolate*, int n, PretenureFlag pretenure, MinimumCapacity capacity_option);
-
-template Handle<GlobalDictionary>
-BaseNameDictionary<GlobalDictionary, GlobalDictionaryShape>::New(
-    Isolate*, int n, PretenureFlag pretenure, MinimumCapacity capacity_option);
-
-template Handle<NumberDictionary>
-    Dictionary<NumberDictionary, NumberDictionaryShape>::AtPut(
-        Handle<NumberDictionary>, uint32_t, Handle<Object>, PropertyDetails);
-
-template Handle<SimpleNumberDictionary>
-    Dictionary<SimpleNumberDictionary, SimpleNumberDictionaryShape>::AtPut(
-        Handle<SimpleNumberDictionary>, uint32_t, Handle<Object>,
-        PropertyDetails);
-
-template Object* Dictionary<
-    NumberDictionary, NumberDictionaryShape>::SlowReverseLookup(Object* value);
-
-template Object* Dictionary<
-    NameDictionary, NameDictionaryShape>::SlowReverseLookup(Object* value);
-
-template Handle<NameDictionary>
-Dictionary<NameDictionary, NameDictionaryShape>::DeleteEntry(
-    Handle<NameDictionary>, int);
-
-template Handle<NumberDictionary>
-Dictionary<NumberDictionary, NumberDictionaryShape>::DeleteEntry(
-    Handle<NumberDictionary>, int);
-
-template Handle<SimpleNumberDictionary>
-Dictionary<SimpleNumberDictionary, SimpleNumberDictionaryShape>::DeleteEntry(
-    Handle<SimpleNumberDictionary>, int);
-
-template Handle<NameDictionary>
-HashTable<NameDictionary, NameDictionaryShape>::New(Isolate*, int,
-                                                    PretenureFlag,
-                                                    MinimumCapacity);
-
-template Handle<ObjectHashSet>
-HashTable<ObjectHashSet, ObjectHashSetShape>::New(Isolate*, int n,
-                                                  PretenureFlag,
-                                                  MinimumCapacity);
-
-template Handle<NameDictionary>
-HashTable<NameDictionary, NameDictionaryShape>::Shrink(Handle<NameDictionary>,
-                                                       int additionalCapacity);
-
-template Handle<NameDictionary>
-BaseNameDictionary<NameDictionary, NameDictionaryShape>::Add(
-    Handle<NameDictionary>, Handle<Name>, Handle<Object>, PropertyDetails,
-    int*);
-
-template Handle<GlobalDictionary>
-BaseNameDictionary<GlobalDictionary, GlobalDictionaryShape>::Add(
-    Handle<GlobalDictionary>, Handle<Name>, Handle<Object>, PropertyDetails,
-    int*);
-
-template void HashTable<GlobalDictionary, GlobalDictionaryShape>::Rehash();
-
-template Handle<NumberDictionary>
-Dictionary<NumberDictionary, NumberDictionaryShape>::Add(
-    Handle<NumberDictionary>, uint32_t, Handle<Object>, PropertyDetails, int*);
-
-template Handle<NameDictionary>
-BaseNameDictionary<NameDictionary, NameDictionaryShape>::EnsureCapacity(
-    Handle<NameDictionary>, int);
-
-template Handle<SimpleNumberDictionary>
-Dictionary<SimpleNumberDictionary, SimpleNumberDictionaryShape>::Add(
-    Handle<SimpleNumberDictionary>, uint32_t, Handle<Object>, PropertyDetails,
-    int*);
-
-template int Dictionary<GlobalDictionary,
-                        GlobalDictionaryShape>::NumberOfEnumerableProperties();
-
-template int
-Dictionary<NameDictionary, NameDictionaryShape>::NumberOfEnumerableProperties();
-
-template void
-BaseNameDictionary<GlobalDictionary, GlobalDictionaryShape>::CopyEnumKeysTo(
-    Handle<GlobalDictionary> dictionary, Handle<FixedArray> storage,
-    KeyCollectionMode mode, KeyAccumulator* accumulator);
-
-template void
-BaseNameDictionary<NameDictionary, NameDictionaryShape>::CopyEnumKeysTo(
-    Handle<NameDictionary> dictionary, Handle<FixedArray> storage,
-    KeyCollectionMode mode, KeyAccumulator* accumulator);
-
-template Handle<FixedArray>
-BaseNameDictionary<GlobalDictionary, GlobalDictionaryShape>::IterationIndices(
-    Handle<GlobalDictionary> dictionary);
-template void
-BaseNameDictionary<GlobalDictionary, GlobalDictionaryShape>::CollectKeysTo(
-    Handle<GlobalDictionary> dictionary, KeyAccumulator* keys);
-
-template Handle<FixedArray>
-BaseNameDictionary<NameDictionary, NameDictionaryShape>::IterationIndices(
-    Handle<NameDictionary> dictionary);
-template void
-BaseNameDictionary<NameDictionary, NameDictionaryShape>::CollectKeysTo(
-    Handle<NameDictionary> dictionary, KeyAccumulator* keys);
-
-template int Dictionary<NumberDictionary,
-                        NumberDictionaryShape>::NumberOfEnumerableProperties();
-
 namespace {
 
 bool CanonicalNumericIndexString(Isolate* isolate, Handle<Object> s,
@@ -16762,7 +16826,7 @@ bool CanonicalNumericIndexString(Isolate* isolate, Handle<Object> s,
   if (s->IsSmi()) {
     result = s;
   } else {
-    result = String::ToNumber(Handle<String>::cast(s));
+    result = String::ToNumber(isolate, Handle<String>::cast(s));
     if (!result->IsMinusZero()) {
       Handle<String> str = Object::ToString(isolate, result).ToHandleChecked();
       // Avoid treating strings like "2E1" and "20" as the same key.
@@ -16881,10 +16945,10 @@ void JSGlobalObject::InvalidatePropertyCell(Handle<JSGlobalObject> global,
   JSObject::InvalidatePrototypeValidityCell(*global);
 
   DCHECK(!global->HasFastProperties());
-  auto dictionary = handle(global->global_dictionary());
+  auto dictionary = handle(global->global_dictionary(), global->GetIsolate());
   int entry = dictionary->FindEntry(name);
   if (entry == GlobalDictionary::kNotFound) return;
-  PropertyCell::InvalidateEntry(dictionary, entry);
+  PropertyCell::InvalidateEntry(global->GetIsolate(), dictionary, entry);
 }
 
 Handle<PropertyCell> JSGlobalObject::EnsureEmptyPropertyCell(
@@ -16897,13 +16961,13 @@ Handle<PropertyCell> JSGlobalObject::EnsureEmptyPropertyCell(
   Handle<PropertyCell> cell;
   if (entry != GlobalDictionary::kNotFound) {
     if (entry_out) *entry_out = entry;
-    cell = handle(dictionary->CellAt(entry));
+    cell = handle(dictionary->CellAt(entry), isolate);
     PropertyCellType original_cell_type = cell->property_details().cell_type();
     DCHECK(original_cell_type == PropertyCellType::kInvalidated ||
            original_cell_type == PropertyCellType::kUninitialized);
     DCHECK(cell->value()->IsTheHole(isolate));
     if (original_cell_type == PropertyCellType::kInvalidated) {
-      cell = PropertyCell::InvalidateEntry(dictionary, entry);
+      cell = PropertyCell::InvalidateEntry(isolate, dictionary, entry);
     }
     PropertyDetails details(kData, NONE, cell_type);
     cell->set_property_details(details);
@@ -17056,9 +17120,10 @@ void MakeStringThin(String* string, String* internalized, Isolate* isolate) {
 
 }  // namespace
 
+// static
 Handle<String> StringTable::LookupString(Isolate* isolate,
                                          Handle<String> string) {
-  string = String::Flatten(string);
+  string = String::Flatten(isolate, string);
   if (string->IsInternalizedString()) return string;
 
   InternalizedStringKey key(string);
@@ -17072,7 +17137,7 @@ Handle<String> StringTable::LookupString(Isolate* isolate,
     if (string->IsConsString()) {
       Handle<ConsString> cons = Handle<ConsString>::cast(string);
       cons->set_first(*result);
-      cons->set_second(isolate->heap()->empty_string());
+      cons->set_second(ReadOnlyRoots(isolate).empty_string());
     } else if (string->IsSlicedString()) {
       STATIC_ASSERT(ConsString::kSize == SlicedString::kSize);
       DisallowHeapAllocation no_gc;
@@ -17083,12 +17148,13 @@ Handle<String> StringTable::LookupString(Isolate* isolate,
       string->set_map(*map);
       Handle<ConsString> cons = Handle<ConsString>::cast(string);
       cons->set_first(*result);
-      cons->set_second(isolate->heap()->empty_string());
+      cons->set_second(ReadOnlyRoots(isolate).empty_string());
     }
   }
   return result;
 }
 
+// static
 Handle<String> StringTable::LookupKey(Isolate* isolate, StringTableKey* key) {
   Handle<StringTable> table = isolate->factory()->string_table();
   int entry = table->FindEntry(key);
@@ -17132,10 +17198,9 @@ Handle<StringTable> StringTable::CautiousShrink(Handle<StringTable> table) {
   int nof = table->NumberOfElements();
   if (capacity <= StringTable::kMinCapacity) return table;
   if (nof > (capacity / kMaxEmptyFactor)) return table;
-  // Make sure that after shrinking the table is half empty (aka. has capacity
-  // for another {nof} elements).
-  DCHECK_LE(nof * 2, capacity);
-  return Shrink(table, nof);
+  // Keep capacity for at least half of the current nof elements.
+  int slack_capacity = nof >> 2;
+  return Shrink(table, slack_capacity);
 }
 
 namespace {
@@ -17327,11 +17392,11 @@ Handle<StringSet> StringSet::New(Isolate* isolate) {
   return HashTable::New(isolate, 0);
 }
 
-Handle<StringSet> StringSet::Add(Handle<StringSet> stringset,
+Handle<StringSet> StringSet::Add(Isolate* isolate, Handle<StringSet> stringset,
                                  Handle<String> name) {
   if (!stringset->Has(name)) {
     stringset = EnsureCapacity(stringset, 1);
-    uint32_t hash = ShapeT::Hash(name->GetIsolate(), *name);
+    uint32_t hash = ShapeT::Hash(isolate, *name);
     int entry = stringset->FindInsertionEntry(hash);
     stringset->set(EntryToIndex(entry), *name);
     stringset->ElementAdded();
@@ -17357,10 +17422,9 @@ Handle<ObjectHashSet> ObjectHashSet::Add(Handle<ObjectHashSet> set,
 }
 
 Handle<Object> CompilationCacheTable::Lookup(Handle<String> src,
-                                             Handle<Context> context,
+                                             Handle<SharedFunctionInfo> shared,
                                              LanguageMode language_mode) {
   Isolate* isolate = GetIsolate();
-  Handle<SharedFunctionInfo> shared(context->closure()->shared());
   StringSharedKey key(src, shared, language_mode, kNoSourcePosition);
   int entry = FindEntry(&key);
   if (entry == kNotFound) return isolate->factory()->undefined_value();
@@ -17483,8 +17547,10 @@ FeedbackCell* SearchLiteralsMap(CompilationCacheTable* cache, int cache_entry,
 }  // namespace
 
 MaybeHandle<SharedFunctionInfo> CompilationCacheTable::LookupScript(
-    Handle<String> src, Handle<Context> context, LanguageMode language_mode) {
-  Handle<SharedFunctionInfo> shared(context->closure()->shared());
+    Handle<String> src, Handle<Context> native_context,
+    LanguageMode language_mode) {
+  Handle<SharedFunctionInfo> shared(native_context->empty_function()->shared(),
+                                    native_context->GetIsolate());
   StringSharedKey key(src, shared, language_mode, kNoSourcePosition);
   int entry = FindEntry(&key);
   if (entry == kNotFound) return MaybeHandle<SharedFunctionInfo>();
@@ -17492,7 +17558,7 @@ MaybeHandle<SharedFunctionInfo> CompilationCacheTable::LookupScript(
   if (!get(index)->IsFixedArray()) return MaybeHandle<SharedFunctionInfo>();
   Object* obj = get(index + 1);
   if (obj->IsSharedFunctionInfo()) {
-    return handle(SharedFunctionInfo::cast(obj));
+    return handle(SharedFunctionInfo::cast(obj), native_context->GetIsolate());
   }
   return MaybeHandle<SharedFunctionInfo>();
 }
@@ -17525,12 +17591,11 @@ Handle<Object> CompilationCacheTable::LookupRegExp(Handle<String> src,
   return Handle<Object>(get(EntryToIndex(entry) + 1), isolate);
 }
 
-
 Handle<CompilationCacheTable> CompilationCacheTable::Put(
     Handle<CompilationCacheTable> cache, Handle<String> src,
-    Handle<Context> context, LanguageMode language_mode, Handle<Object> value) {
+    Handle<SharedFunctionInfo> shared, LanguageMode language_mode,
+    Handle<Object> value) {
   Isolate* isolate = cache->GetIsolate();
-  Handle<SharedFunctionInfo> shared(context->closure()->shared());
   StringSharedKey key(src, shared, language_mode, kNoSourcePosition);
   Handle<Object> k = key.AsHandle(isolate);
   cache = EnsureCapacity(cache, 1);
@@ -17543,11 +17608,11 @@ Handle<CompilationCacheTable> CompilationCacheTable::Put(
 
 Handle<CompilationCacheTable> CompilationCacheTable::PutScript(
     Handle<CompilationCacheTable> cache, Handle<String> src,
-    Handle<Context> context, LanguageMode language_mode,
+    Handle<Context> native_context, LanguageMode language_mode,
     Handle<SharedFunctionInfo> value) {
-  Isolate* isolate = cache->GetIsolate();
-  Handle<SharedFunctionInfo> shared(context->closure()->shared());
-  Handle<Context> native_context(context->native_context());
+  Isolate* isolate = native_context->GetIsolate();
+  Handle<SharedFunctionInfo> shared(native_context->empty_function()->shared(),
+                                    isolate);
   StringSharedKey key(src, shared, language_mode, kNoSourcePosition);
   Handle<Object> k = key.AsHandle(isolate);
   cache = EnsureCapacity(cache, 1);
@@ -17563,7 +17628,7 @@ Handle<CompilationCacheTable> CompilationCacheTable::PutEval(
     Handle<SharedFunctionInfo> outer_info, Handle<SharedFunctionInfo> value,
     Handle<Context> native_context, Handle<FeedbackCell> feedback_cell,
     int position) {
-  Isolate* isolate = cache->GetIsolate();
+  Isolate* isolate = native_context->GetIsolate();
   StringSharedKey key(src, outer_info, value->language_mode(), position);
   {
     Handle<Object> k = key.AsHandle(isolate);
@@ -17608,7 +17673,7 @@ Handle<CompilationCacheTable> CompilationCacheTable::PutRegExp(
 
 void CompilationCacheTable::Age() {
   DisallowHeapAllocation no_allocation;
-  Object* the_hole_value = GetHeap()->the_hole_value();
+  Object* the_hole_value = GetReadOnlyRoots().the_hole_value();
   for (int entry = 0, size = Capacity(); entry < size; entry++) {
     int entry_index = EntryToIndex(entry);
     int value_index = entry_index + 1;
@@ -17638,7 +17703,7 @@ void CompilationCacheTable::Age() {
 
 void CompilationCacheTable::Remove(Object* value) {
   DisallowHeapAllocation no_allocation;
-  Object* the_hole_value = GetHeap()->the_hole_value();
+  Object* the_hole_value = GetReadOnlyRoots().the_hole_value();
   for (int entry = 0, size = Capacity(); entry < size; entry++) {
     int entry_index = EntryToIndex(entry);
     int value_index = entry_index + 1;
@@ -17877,10 +17942,9 @@ struct EnumIndexComparator {
 
 template <typename Derived, typename Shape>
 void BaseNameDictionary<Derived, Shape>::CopyEnumKeysTo(
-    Handle<Derived> dictionary, Handle<FixedArray> storage,
+    Isolate* isolate, Handle<Derived> dictionary, Handle<FixedArray> storage,
     KeyCollectionMode mode, KeyAccumulator* accumulator) {
   DCHECK_IMPLIES(mode != KeyCollectionMode::kOwnOnly, accumulator != nullptr);
-  Isolate* isolate = dictionary->GetIsolate();
   int length = storage->length();
   int capacity = dictionary->Capacity();
   int properties = 0;
@@ -17951,8 +18015,7 @@ Handle<FixedArray> BaseNameDictionary<Derived, Shape>::IterationIndices(
             array->GetFirstElementAddress());
     std::sort(start, start + array_size, cmp);
   }
-  array->Shrink(array_size);
-  return array;
+  return FixedArray::ShrinkOrEmpty(array, array_size);
 }
 
 template <typename Derived, typename Shape>
@@ -18026,47 +18089,60 @@ Object* Dictionary<Derived, Shape>::SlowReverseLookup(Object* value) {
     Object* e = dictionary->ValueAt(i);
     if (e == value) return k;
   }
-  return isolate->heap()->undefined_value();
+  return ReadOnlyRoots(isolate).undefined_value();
 }
 
+template <typename Derived, typename Shape>
+void ObjectHashTableBase<Derived, Shape>::FillEntriesWithHoles(
+    Handle<Derived> table) {
+  int length = table->length();
+  for (int i = Derived::EntryToIndex(0); i < length; i++) {
+    table->set_the_hole(i);
+  }
+}
 
-Object* ObjectHashTable::Lookup(Isolate* isolate, Handle<Object> key,
-                                int32_t hash) {
+template <typename Derived, typename Shape>
+Object* ObjectHashTableBase<Derived, Shape>::Lookup(Isolate* isolate,
+                                                    Handle<Object> key,
+                                                    int32_t hash) {
   DisallowHeapAllocation no_gc;
-  DCHECK(IsKey(isolate, *key));
+  DCHECK(this->IsKey(isolate, *key));
 
-  int entry = FindEntry(isolate, key, hash);
-  if (entry == kNotFound) return isolate->heap()->the_hole_value();
-  return get(EntryToIndex(entry) + 1);
+  int entry = this->FindEntry(isolate, key, hash);
+  if (entry == kNotFound) return ReadOnlyRoots(isolate).the_hole_value();
+  return this->get(Derived::EntryToIndex(entry) + 1);
 }
 
-
-Object* ObjectHashTable::Lookup(Handle<Object> key) {
+template <typename Derived, typename Shape>
+Object* ObjectHashTableBase<Derived, Shape>::Lookup(Handle<Object> key) {
   DisallowHeapAllocation no_gc;
 
-  Isolate* isolate = GetIsolate();
-  DCHECK(IsKey(isolate, *key));
+  Isolate* isolate = this->GetIsolate();
+  DCHECK(this->IsKey(isolate, *key));
 
   // If the object does not have an identity hash, it was never used as a key.
   Object* hash = key->GetHash();
   if (hash->IsUndefined(isolate)) {
-    return isolate->heap()->the_hole_value();
+    return ReadOnlyRoots(isolate).the_hole_value();
   }
   return Lookup(isolate, key, Smi::ToInt(hash));
 }
 
-Object* ObjectHashTable::ValueAt(int entry) {
-  return get(EntryToValueIndex(entry));
+template <typename Derived, typename Shape>
+Object* ObjectHashTableBase<Derived, Shape>::Lookup(Handle<Object> key,
+                                                    int32_t hash) {
+  return Lookup(this->GetIsolate(), key, hash);
 }
 
-Object* ObjectHashTable::Lookup(Handle<Object> key, int32_t hash) {
-  return Lookup(GetIsolate(), key, hash);
+template <typename Derived, typename Shape>
+Object* ObjectHashTableBase<Derived, Shape>::ValueAt(int entry) {
+  return this->get(EntryToValueIndex(entry));
 }
 
-
-Handle<ObjectHashTable> ObjectHashTable::Put(Handle<ObjectHashTable> table,
-                                             Handle<Object> key,
-                                             Handle<Object> value) {
+template <typename Derived, typename Shape>
+Handle<Derived> ObjectHashTableBase<Derived, Shape>::Put(Handle<Derived> table,
+                                                         Handle<Object> key,
+                                                         Handle<Object> value) {
   Isolate* isolate = table->GetIsolate();
   DCHECK(table->IsKey(isolate, *key));
   DCHECK(!value->IsTheHole(isolate));
@@ -18074,14 +18150,14 @@ Handle<ObjectHashTable> ObjectHashTable::Put(Handle<ObjectHashTable> table,
   // Make sure the key object has an identity hash code.
   int32_t hash = key->GetOrCreateHash(isolate)->value();
 
-  return Put(table, key, value, hash);
+  return ObjectHashTableBase<Derived, Shape>::Put(table, key, value, hash);
 }
 
-
-Handle<ObjectHashTable> ObjectHashTable::Put(Handle<ObjectHashTable> table,
-                                             Handle<Object> key,
-                                             Handle<Object> value,
-                                             int32_t hash) {
+template <typename Derived, typename Shape>
+Handle<Derived> ObjectHashTableBase<Derived, Shape>::Put(Handle<Derived> table,
+                                                         Handle<Object> key,
+                                                         Handle<Object> value,
+                                                         int32_t hash) {
   Isolate* isolate = table->GetIsolate();
   DCHECK(table->IsKey(isolate, *key));
   DCHECK(!value->IsTheHole(isolate));
@@ -18090,7 +18166,7 @@ Handle<ObjectHashTable> ObjectHashTable::Put(Handle<ObjectHashTable> table,
 
   // Key is already in table, just overwrite value.
   if (entry != kNotFound) {
-    table->set(EntryToIndex(entry) + 1, *value);
+    table->set(Derived::EntryToIndex(entry) + 1, *value);
     return table;
   }
 
@@ -18115,19 +18191,18 @@ Handle<ObjectHashTable> ObjectHashTable::Put(Handle<ObjectHashTable> table,
   }
 
   // Check whether the hash table should be extended.
-  table = EnsureCapacity(table, 1);
+  table = Derived::EnsureCapacity(table, 1);
   table->AddEntry(table->FindInsertionEntry(hash), *key, *value);
   return table;
 }
 
-
-Handle<ObjectHashTable> ObjectHashTable::Remove(Handle<ObjectHashTable> table,
-                                                Handle<Object> key,
-                                                bool* was_present) {
+template <typename Derived, typename Shape>
+Handle<Derived> ObjectHashTableBase<Derived, Shape>::Remove(
+    Handle<Derived> table, Handle<Object> key, bool* was_present) {
   DCHECK(table->IsKey(table->GetIsolate(), *key));
 
   Object* hash = key->GetHash();
-  if (hash->IsUndefined(table->GetIsolate())) {
+  if (hash->IsUndefined()) {
     *was_present = false;
     return table;
   }
@@ -18135,11 +18210,10 @@ Handle<ObjectHashTable> ObjectHashTable::Remove(Handle<ObjectHashTable> table,
   return Remove(table, key, was_present, Smi::ToInt(hash));
 }
 
-
-Handle<ObjectHashTable> ObjectHashTable::Remove(Handle<ObjectHashTable> table,
-                                                Handle<Object> key,
-                                                bool* was_present,
-                                                int32_t hash) {
+template <typename Derived, typename Shape>
+Handle<Derived> ObjectHashTableBase<Derived, Shape>::Remove(
+    Handle<Derived> table, Handle<Object> key, bool* was_present,
+    int32_t hash) {
   Isolate* isolate = table->GetIsolate();
   DCHECK(table->IsKey(isolate, *key));
 
@@ -18151,620 +18225,33 @@ Handle<ObjectHashTable> ObjectHashTable::Remove(Handle<ObjectHashTable> table,
 
   *was_present = true;
   table->RemoveEntry(entry);
-  return Shrink(table);
-}
-
-
-void ObjectHashTable::AddEntry(int entry, Object* key, Object* value) {
-  set(EntryToIndex(entry), key);
-  set(EntryToIndex(entry) + 1, value);
-  ElementAdded();
-}
-
-
-void ObjectHashTable::RemoveEntry(int entry) {
-  set_the_hole(EntryToIndex(entry));
-  set_the_hole(EntryToIndex(entry) + 1);
-  ElementRemoved();
-}
-
-template <class Derived, int entrysize>
-Handle<Derived> OrderedHashTable<Derived, entrysize>::Allocate(
-    Isolate* isolate, int capacity, PretenureFlag pretenure) {
-  // Capacity must be a power of two, since we depend on being able
-  // to divide and multiple by 2 (kLoadFactor) to derive capacity
-  // from number of buckets. If we decide to change kLoadFactor
-  // to something other than 2, capacity should be stored as another
-  // field of this object.
-  capacity = base::bits::RoundUpToPowerOfTwo32(Max(kMinCapacity, capacity));
-  if (capacity > kMaxCapacity) {
-    isolate->heap()->FatalProcessOutOfMemory("invalid table size");
-  }
-  int num_buckets = capacity / kLoadFactor;
-  Handle<FixedArray> backing_store = isolate->factory()->NewFixedArrayWithMap(
-      static_cast<Heap::RootListIndex>(Derived::GetMapRootIndex()),
-      kHashTableStartIndex + num_buckets + (capacity * kEntrySize), pretenure);
-  Handle<Derived> table = Handle<Derived>::cast(backing_store);
-  for (int i = 0; i < num_buckets; ++i) {
-    table->set(kHashTableStartIndex + i, Smi::FromInt(kNotFound));
-  }
-  table->SetNumberOfBuckets(num_buckets);
-  table->SetNumberOfElements(0);
-  table->SetNumberOfDeletedElements(0);
-  return table;
-}
-
-template <class Derived, int entrysize>
-Handle<Derived> OrderedHashTable<Derived, entrysize>::EnsureGrowable(
-    Handle<Derived> table) {
-  DCHECK(!table->IsObsolete());
-
-  int nof = table->NumberOfElements();
-  int nod = table->NumberOfDeletedElements();
-  int capacity = table->Capacity();
-  if ((nof + nod) < capacity) return table;
-  // Don't need to grow if we can simply clear out deleted entries instead.
-  // Note that we can't compact in place, though, so we always allocate
-  // a new table.
-  return Rehash(table, (nod < (capacity >> 1)) ? capacity << 1 : capacity);
-}
-
-template <class Derived, int entrysize>
-Handle<Derived> OrderedHashTable<Derived, entrysize>::Shrink(
-    Handle<Derived> table) {
-  DCHECK(!table->IsObsolete());
-
-  int nof = table->NumberOfElements();
-  int capacity = table->Capacity();
-  if (nof >= (capacity >> 2)) return table;
-  return Rehash(table, capacity / 2);
-}
-
-template <class Derived, int entrysize>
-Handle<Derived> OrderedHashTable<Derived, entrysize>::Clear(
-    Handle<Derived> table) {
-  DCHECK(!table->IsObsolete());
-
-  Handle<Derived> new_table =
-      Allocate(table->GetIsolate(),
-               kMinCapacity,
-               table->GetHeap()->InNewSpace(*table) ? NOT_TENURED : TENURED);
-
-  table->SetNextTable(*new_table);
-  table->SetNumberOfDeletedElements(kClearedTableSentinel);
-
-  return new_table;
+  return Derived::Shrink(table);
 }
 
-template <class Derived, int entrysize>
-bool OrderedHashTable<Derived, entrysize>::HasKey(Isolate* isolate,
-                                                  Derived* table, Object* key) {
-  DCHECK((entrysize == 1 && table->IsOrderedHashSet()) ||
-         (entrysize == 2 && table->IsOrderedHashMap()));
-  DisallowHeapAllocation no_gc;
-  int entry = table->FindEntry(isolate, key);
-  return entry != kNotFound;
-}
-
-Handle<OrderedHashSet> OrderedHashSet::Add(Handle<OrderedHashSet> table,
-                                           Handle<Object> key) {
-  int hash = key->GetOrCreateHash(table->GetIsolate())->value();
-  int entry = table->HashToEntry(hash);
-  // Walk the chain of the bucket and try finding the key.
-  while (entry != kNotFound) {
-    Object* candidate_key = table->KeyAt(entry);
-    // Do not add if we have the key already
-    if (candidate_key->SameValueZero(*key)) return table;
-    entry = table->NextChainEntry(entry);
-  }
-
-  table = OrderedHashSet::EnsureGrowable(table);
-  // Read the existing bucket values.
-  int bucket = table->HashToBucket(hash);
-  int previous_entry = table->HashToEntry(hash);
-  int nof = table->NumberOfElements();
-  // Insert a new entry at the end,
-  int new_entry = nof + table->NumberOfDeletedElements();
-  int new_index = table->EntryToIndex(new_entry);
-  table->set(new_index, *key);
-  table->set(new_index + kChainOffset, Smi::FromInt(previous_entry));
-  // and point the bucket to the new entry.
-  table->set(kHashTableStartIndex + bucket, Smi::FromInt(new_entry));
-  table->SetNumberOfElements(nof + 1);
-  return table;
-}
-
-Handle<FixedArray> OrderedHashSet::ConvertToKeysArray(
-    Handle<OrderedHashSet> table, GetKeysConversion convert) {
-  Isolate* isolate = table->GetIsolate();
-  int length = table->NumberOfElements();
-  int nof_buckets = table->NumberOfBuckets();
-  // Convert the dictionary to a linear list.
-  Handle<FixedArray> result = Handle<FixedArray>::cast(table);
-  // From this point on table is no longer a valid OrderedHashSet.
-  result->set_map(isolate->heap()->fixed_array_map());
-  for (int i = 0; i < length; i++) {
-    int index = kHashTableStartIndex + nof_buckets + (i * kEntrySize);
-    Object* key = table->get(index);
-    if (convert == GetKeysConversion::kConvertToString) {
-      uint32_t index_value;
-      if (key->ToArrayIndex(&index_value)) {
-        key = *isolate->factory()->Uint32ToString(index_value);
-      } else {
-        CHECK(key->IsName());
-      }
-    }
-    result->set(i, key);
-  }
-  result->Shrink(length);
-  return result;
-}
-
-HeapObject* OrderedHashSet::GetEmpty(Isolate* isolate) {
-  return isolate->heap()->empty_ordered_hash_set();
-}
-
-HeapObject* OrderedHashMap::GetEmpty(Isolate* isolate) {
-  return isolate->heap()->empty_ordered_hash_map();
-}
-
-template <class Derived, int entrysize>
-Handle<Derived> OrderedHashTable<Derived, entrysize>::Rehash(
-    Handle<Derived> table, int new_capacity) {
-  Isolate* isolate = table->GetIsolate();
-  DCHECK(!table->IsObsolete());
-
-  Handle<Derived> new_table =
-      Allocate(isolate, new_capacity,
-               isolate->heap()->InNewSpace(*table) ? NOT_TENURED : TENURED);
-  int nof = table->NumberOfElements();
-  int nod = table->NumberOfDeletedElements();
-  int new_buckets = new_table->NumberOfBuckets();
-  int new_entry = 0;
-  int removed_holes_index = 0;
-
-  DisallowHeapAllocation no_gc;
-  for (int old_entry = 0; old_entry < (nof + nod); ++old_entry) {
-    Object* key = table->KeyAt(old_entry);
-    if (key->IsTheHole(isolate)) {
-      table->SetRemovedIndexAt(removed_holes_index++, old_entry);
-      continue;
-    }
-
-    Object* hash = key->GetHash();
-    int bucket = Smi::ToInt(hash) & (new_buckets - 1);
-    Object* chain_entry = new_table->get(kHashTableStartIndex + bucket);
-    new_table->set(kHashTableStartIndex + bucket, Smi::FromInt(new_entry));
-    int new_index = new_table->EntryToIndex(new_entry);
-    int old_index = table->EntryToIndex(old_entry);
-    for (int i = 0; i < entrysize; ++i) {
-      Object* value = table->get(old_index + i);
-      new_table->set(new_index + i, value);
-    }
-    new_table->set(new_index + kChainOffset, chain_entry);
-    ++new_entry;
-  }
-
-  DCHECK_EQ(nod, removed_holes_index);
-
-  new_table->SetNumberOfElements(nof);
-  table->SetNextTable(*new_table);
-
-  return new_table;
-}
-
-template <class Derived, int entrysize>
-bool OrderedHashTable<Derived, entrysize>::Delete(Isolate* isolate,
-                                                  Derived* table, Object* key) {
-  DisallowHeapAllocation no_gc;
-  int entry = table->FindEntry(isolate, key);
-  if (entry == kNotFound) return false;
-
-  int nof = table->NumberOfElements();
-  int nod = table->NumberOfDeletedElements();
-  int index = table->EntryToIndex(entry);
-
-  Object* hole = isolate->heap()->the_hole_value();
-  for (int i = 0; i < entrysize; ++i) {
-    table->set(index + i, hole);
-  }
-
-  table->SetNumberOfElements(nof - 1);
-  table->SetNumberOfDeletedElements(nod + 1);
-
-  return true;
-}
-
-Object* OrderedHashMap::GetHash(Isolate* isolate, Object* key) {
-  DisallowHeapAllocation no_gc;
-
-  Object* hash = key->GetHash();
-  // If the object does not have an identity hash, it was never used as a key
-  if (hash->IsUndefined(isolate)) return Smi::FromInt(-1);
-  DCHECK(hash->IsSmi());
-  DCHECK_GE(Smi::cast(hash)->value(), 0);
-  return hash;
-}
-
-Handle<OrderedHashMap> OrderedHashMap::Add(Handle<OrderedHashMap> table,
-                                           Handle<Object> key,
-                                           Handle<Object> value) {
-  int hash = key->GetOrCreateHash(table->GetIsolate())->value();
-  int entry = table->HashToEntry(hash);
-  // Walk the chain of the bucket and try finding the key.
-  {
-    DisallowHeapAllocation no_gc;
-    Object* raw_key = *key;
-    while (entry != kNotFound) {
-      Object* candidate_key = table->KeyAt(entry);
-      // Do not add if we have the key already
-      if (candidate_key->SameValueZero(raw_key)) return table;
-      entry = table->NextChainEntry(entry);
-    }
-  }
-
-  table = OrderedHashMap::EnsureGrowable(table);
-  // Read the existing bucket values.
-  int bucket = table->HashToBucket(hash);
-  int previous_entry = table->HashToEntry(hash);
-  int nof = table->NumberOfElements();
-  // Insert a new entry at the end,
-  int new_entry = nof + table->NumberOfDeletedElements();
-  int new_index = table->EntryToIndex(new_entry);
-  table->set(new_index, *key);
-  table->set(new_index + kValueOffset, *value);
-  table->set(new_index + kChainOffset, Smi::FromInt(previous_entry));
-  // and point the bucket to the new entry.
-  table->set(kHashTableStartIndex + bucket, Smi::FromInt(new_entry));
-  table->SetNumberOfElements(nof + 1);
-  return table;
-}
-
-template Handle<OrderedHashSet> OrderedHashTable<OrderedHashSet, 1>::Allocate(
-    Isolate* isolate, int capacity, PretenureFlag pretenure);
-
-template Handle<OrderedHashSet> OrderedHashTable<
-    OrderedHashSet, 1>::EnsureGrowable(Handle<OrderedHashSet> table);
-
-template Handle<OrderedHashSet> OrderedHashTable<OrderedHashSet, 1>::Shrink(
-    Handle<OrderedHashSet> table);
-
-template Handle<OrderedHashSet> OrderedHashTable<OrderedHashSet, 1>::Clear(
-    Handle<OrderedHashSet> table);
-
-template bool OrderedHashTable<OrderedHashSet, 1>::HasKey(Isolate* isolate,
-                                                          OrderedHashSet* table,
-                                                          Object* key);
-
-template bool OrderedHashTable<OrderedHashSet, 1>::Delete(Isolate* isolate,
-                                                          OrderedHashSet* table,
-                                                          Object* key);
-
-template Handle<OrderedHashMap> OrderedHashTable<OrderedHashMap, 2>::Allocate(
-    Isolate* isolate, int capacity, PretenureFlag pretenure);
-
-template Handle<OrderedHashMap> OrderedHashTable<
-    OrderedHashMap, 2>::EnsureGrowable(Handle<OrderedHashMap> table);
-
-template Handle<OrderedHashMap> OrderedHashTable<OrderedHashMap, 2>::Shrink(
-    Handle<OrderedHashMap> table);
-
-template Handle<OrderedHashMap> OrderedHashTable<OrderedHashMap, 2>::Clear(
-    Handle<OrderedHashMap> table);
-
-template bool OrderedHashTable<OrderedHashMap, 2>::HasKey(Isolate* isolate,
-                                                          OrderedHashMap* table,
-                                                          Object* key);
-
-template bool OrderedHashTable<OrderedHashMap, 2>::Delete(Isolate* isolate,
-                                                          OrderedHashMap* table,
-                                                          Object* key);
-
-template <>
-Handle<SmallOrderedHashSet>
-SmallOrderedHashTable<SmallOrderedHashSet>::Allocate(Isolate* isolate,
-                                                     int capacity,
-                                                     PretenureFlag pretenure) {
-  return isolate->factory()->NewSmallOrderedHashSet(capacity, pretenure);
-}
-
-template <>
-Handle<SmallOrderedHashMap>
-SmallOrderedHashTable<SmallOrderedHashMap>::Allocate(Isolate* isolate,
-                                                     int capacity,
-                                                     PretenureFlag pretenure) {
-  return isolate->factory()->NewSmallOrderedHashMap(capacity, pretenure);
-}
-
-template <class Derived>
-void SmallOrderedHashTable<Derived>::Initialize(Isolate* isolate,
-                                                int capacity) {
-  int num_buckets = capacity / kLoadFactor;
-  int num_chains = capacity;
-
-  SetNumberOfBuckets(num_buckets);
-  SetNumberOfElements(0);
-  SetNumberOfDeletedElements(0);
-
-  byte* hashtable_start =
-      FIELD_ADDR(this, kHeaderSize + (kBucketsStartOffset * kOneByteSize));
-  memset(hashtable_start, kNotFound, num_buckets + num_chains);
-
-  if (isolate->heap()->InNewSpace(this)) {
-    MemsetPointer(RawField(this, GetDataTableStartOffset()),
-                  isolate->heap()->the_hole_value(),
-                  capacity * Derived::kEntrySize);
-  } else {
-    for (int i = 0; i < capacity; i++) {
-      for (int j = 0; j < Derived::kEntrySize; j++) {
-        SetDataEntry(i, j, isolate->heap()->the_hole_value());
-      }
-    }
-  }
-
-#ifdef DEBUG
-  for (int i = 0; i < num_buckets; ++i) {
-    DCHECK_EQ(kNotFound, GetFirstEntry(i));
-  }
-
-  for (int i = 0; i < num_chains; ++i) {
-    DCHECK_EQ(kNotFound, GetNextEntry(i));
-  }
-#endif  // DEBUG
-}
-
-Handle<SmallOrderedHashSet> SmallOrderedHashSet::Add(
-    Handle<SmallOrderedHashSet> table, Handle<Object> key) {
-  Isolate* isolate = table->GetIsolate();
-  if (table->HasKey(isolate, key)) return table;
-
-  if (table->UsedCapacity() >= table->Capacity()) {
-    table = SmallOrderedHashSet::Grow(table);
-  }
-
-  int hash = key->GetOrCreateHash(table->GetIsolate())->value();
-  int nof = table->NumberOfElements();
-
-  // Read the existing bucket values.
-  int bucket = table->HashToBucket(hash);
-  int previous_entry = table->HashToFirstEntry(hash);
-
-  // Insert a new entry at the end,
-  int new_entry = nof + table->NumberOfDeletedElements();
-
-  table->SetDataEntry(new_entry, SmallOrderedHashSet::kKeyIndex, *key);
-  table->SetFirstEntry(bucket, new_entry);
-  table->SetNextEntry(new_entry, previous_entry);
-
-  // and update book keeping.
-  table->SetNumberOfElements(nof + 1);
-
-  return table;
-}
-
-Handle<SmallOrderedHashMap> SmallOrderedHashMap::Add(
-    Handle<SmallOrderedHashMap> table, Handle<Object> key,
-    Handle<Object> value) {
-  Isolate* isolate = table->GetIsolate();
-  if (table->HasKey(isolate, key)) return table;
-
-  if (table->UsedCapacity() >= table->Capacity()) {
-    table = SmallOrderedHashMap::Grow(table);
-  }
-
-  int hash = key->GetOrCreateHash(table->GetIsolate())->value();
-  int nof = table->NumberOfElements();
-
-  // Read the existing bucket values.
-  int bucket = table->HashToBucket(hash);
-  int previous_entry = table->HashToFirstEntry(hash);
-
-  // Insert a new entry at the end,
-  int new_entry = nof + table->NumberOfDeletedElements();
-
-  table->SetDataEntry(new_entry, SmallOrderedHashMap::kValueIndex, *value);
-  table->SetDataEntry(new_entry, SmallOrderedHashMap::kKeyIndex, *key);
-  table->SetFirstEntry(bucket, new_entry);
-  table->SetNextEntry(new_entry, previous_entry);
-
-  // and update book keeping.
-  table->SetNumberOfElements(nof + 1);
-
-  return table;
-}
-
-template <class Derived>
-bool SmallOrderedHashTable<Derived>::HasKey(Isolate* isolate,
-                                            Handle<Object> key) {
-  DisallowHeapAllocation no_gc;
-  Object* raw_key = *key;
-  Object* hash = key->GetHash();
-
-  if (hash->IsUndefined(isolate)) return false;
-  int entry = HashToFirstEntry(Smi::ToInt(hash));
-
-  // Walk the chain in the bucket to find the key.
-  while (entry != kNotFound) {
-    Object* candidate_key = KeyAt(entry);
-    if (candidate_key->SameValueZero(raw_key)) return true;
-    entry = GetNextEntry(entry);
-  }
-  return false;
-}
-
-template <class Derived>
-Handle<Derived> SmallOrderedHashTable<Derived>::Rehash(Handle<Derived> table,
-                                                       int new_capacity) {
-  DCHECK_GE(kMaxCapacity, new_capacity);
-  Isolate* isolate = table->GetIsolate();
-
-  Handle<Derived> new_table = SmallOrderedHashTable<Derived>::Allocate(
-      isolate, new_capacity,
-      isolate->heap()->InNewSpace(*table) ? NOT_TENURED : TENURED);
-  int nof = table->NumberOfElements();
-  int nod = table->NumberOfDeletedElements();
-  int new_entry = 0;
-
-  {
-    DisallowHeapAllocation no_gc;
-    for (int old_entry = 0; old_entry < (nof + nod); ++old_entry) {
-      Object* key = table->KeyAt(old_entry);
-      if (key->IsTheHole(isolate)) continue;
-
-      int hash = Smi::ToInt(key->GetHash());
-      int bucket = new_table->HashToBucket(hash);
-      int chain = new_table->GetFirstEntry(bucket);
-
-      new_table->SetFirstEntry(bucket, new_entry);
-      new_table->SetNextEntry(new_entry, chain);
-
-      for (int i = 0; i < Derived::kEntrySize; ++i) {
-        Object* value = table->GetDataEntry(old_entry, i);
-        new_table->SetDataEntry(new_entry, i, value);
-      }
-
-      ++new_entry;
-    }
-
-    new_table->SetNumberOfElements(nof);
-  }
-  return new_table;
-}
-
-template <class Derived>
-Handle<Derived> SmallOrderedHashTable<Derived>::Grow(Handle<Derived> table) {
-  int capacity = table->Capacity();
-  int new_capacity = capacity;
-
-  // Don't need to grow if we can simply clear out deleted entries instead.
-  // TODO(gsathya): Compact in place, instead of allocating a new table.
-  if (table->NumberOfDeletedElements() < (capacity >> 1)) {
-    new_capacity = capacity << 1;
-
-    // The max capacity of our table is 254. We special case for 256 to
-    // account for our growth strategy, otherwise we would only fill up
-    // to 128 entries in our table.
-    if (new_capacity == kGrowthHack) {
-      new_capacity = kMaxCapacity;
-    }
-
-    // TODO(gsathya): Transition to OrderedHashTable for size > kMaxCapacity.
-  }
-
-  return Rehash(table, new_capacity);
-}
-
-template bool SmallOrderedHashTable<SmallOrderedHashSet>::HasKey(
-    Isolate* isolate, Handle<Object> key);
-template Handle<SmallOrderedHashSet>
-SmallOrderedHashTable<SmallOrderedHashSet>::Rehash(
-    Handle<SmallOrderedHashSet> table, int new_capacity);
-template Handle<SmallOrderedHashSet> SmallOrderedHashTable<
-    SmallOrderedHashSet>::Grow(Handle<SmallOrderedHashSet> table);
-template void SmallOrderedHashTable<SmallOrderedHashSet>::Initialize(
-    Isolate* isolate, int capacity);
-
-template bool SmallOrderedHashTable<SmallOrderedHashMap>::HasKey(
-    Isolate* isolate, Handle<Object> key);
-template Handle<SmallOrderedHashMap>
-SmallOrderedHashTable<SmallOrderedHashMap>::Rehash(
-    Handle<SmallOrderedHashMap> table, int new_capacity);
-template Handle<SmallOrderedHashMap> SmallOrderedHashTable<
-    SmallOrderedHashMap>::Grow(Handle<SmallOrderedHashMap> table);
-template void SmallOrderedHashTable<SmallOrderedHashMap>::Initialize(
-    Isolate* isolate, int capacity);
-
-template<class Derived, class TableType>
-void OrderedHashTableIterator<Derived, TableType>::Transition() {
-  DisallowHeapAllocation no_allocation;
-  TableType* table = TableType::cast(this->table());
-  if (!table->IsObsolete()) return;
-
-  int index = Smi::ToInt(this->index());
-  while (table->IsObsolete()) {
-    TableType* next_table = table->NextTable();
-
-    if (index > 0) {
-      int nod = table->NumberOfDeletedElements();
-
-      if (nod == TableType::kClearedTableSentinel) {
-        index = 0;
-      } else {
-        int old_index = index;
-        for (int i = 0; i < nod; ++i) {
-          int removed_index = table->RemovedIndexAt(i);
-          if (removed_index >= old_index) break;
-          --index;
-        }
-      }
-    }
-
-    table = next_table;
-  }
-
-  set_table(table);
-  set_index(Smi::FromInt(index));
+template <typename Derived, typename Shape>
+void ObjectHashTableBase<Derived, Shape>::AddEntry(int entry, Object* key,
+                                                   Object* value) {
+  this->set(Derived::EntryToIndex(entry), key);
+  this->set(Derived::EntryToIndex(entry) + 1, value);
+  this->ElementAdded();
 }
 
-
-template<class Derived, class TableType>
-bool OrderedHashTableIterator<Derived, TableType>::HasMore() {
-  DisallowHeapAllocation no_allocation;
-  Isolate* isolate = this->GetIsolate();
-
-  Transition();
-
-  TableType* table = TableType::cast(this->table());
-  int index = Smi::ToInt(this->index());
-  int used_capacity = table->UsedCapacity();
-
-  while (index < used_capacity && table->KeyAt(index)->IsTheHole(isolate)) {
-    index++;
-  }
-
-  set_index(Smi::FromInt(index));
-
-  if (index < used_capacity) return true;
-
-  set_table(TableType::GetEmpty(isolate));
-  return false;
+template <typename Derived, typename Shape>
+void ObjectHashTableBase<Derived, Shape>::RemoveEntry(int entry) {
+  this->set_the_hole(Derived::EntryToIndex(entry));
+  this->set_the_hole(Derived::EntryToIndex(entry) + 1);
+  this->ElementRemoved();
 }
 
-template bool
-OrderedHashTableIterator<JSSetIterator, OrderedHashSet>::HasMore();
-
-template void
-OrderedHashTableIterator<JSSetIterator, OrderedHashSet>::MoveNext();
-
-template Object*
-OrderedHashTableIterator<JSSetIterator, OrderedHashSet>::CurrentKey();
-
-template void
-OrderedHashTableIterator<JSSetIterator, OrderedHashSet>::Transition();
-
-
-template bool
-OrderedHashTableIterator<JSMapIterator, OrderedHashMap>::HasMore();
-
-template void
-OrderedHashTableIterator<JSMapIterator, OrderedHashMap>::MoveNext();
-
-template Object*
-OrderedHashTableIterator<JSMapIterator, OrderedHashMap>::CurrentKey();
-
-template void
-OrderedHashTableIterator<JSMapIterator, OrderedHashMap>::Transition();
-
 
 void JSSet::Initialize(Handle<JSSet> set, Isolate* isolate) {
   Handle<OrderedHashSet> table = isolate->factory()->NewOrderedHashSet();
   set->set_table(*table);
 }
 
-
-void JSSet::Clear(Handle<JSSet> set) {
-  Handle<OrderedHashSet> table(OrderedHashSet::cast(set->table()));
-  table = OrderedHashSet::Clear(table);
+void JSSet::Clear(Isolate* isolate, Handle<JSSet> set) {
+  Handle<OrderedHashSet> table(OrderedHashSet::cast(set->table()), isolate);
+  table = OrderedHashSet::Clear(isolate, table);
   set->set_table(*table);
 }
 
@@ -18774,17 +18261,16 @@ void JSMap::Initialize(Handle<JSMap> map, Isolate* isolate) {
   map->set_table(*table);
 }
 
-
-void JSMap::Clear(Handle<JSMap> map) {
-  Handle<OrderedHashMap> table(OrderedHashMap::cast(map->table()));
-  table = OrderedHashMap::Clear(table);
+void JSMap::Clear(Isolate* isolate, Handle<JSMap> map) {
+  Handle<OrderedHashMap> table(OrderedHashMap::cast(map->table()), isolate);
+  table = OrderedHashMap::Clear(isolate, table);
   map->set_table(*table);
 }
 
 
 void JSWeakCollection::Initialize(Handle<JSWeakCollection> weak_collection,
                                   Isolate* isolate) {
-  Handle<ObjectHashTable> table = ObjectHashTable::New(isolate, 0);
+  Handle<EphemeronHashTable> table = EphemeronHashTable::New(isolate, 0);
   weak_collection->set_table(*table);
 }
 
@@ -18793,15 +18279,16 @@ void JSWeakCollection::Set(Handle<JSWeakCollection> weak_collection,
                            Handle<Object> key, Handle<Object> value,
                            int32_t hash) {
   DCHECK(key->IsJSReceiver() || key->IsSymbol());
-  Handle<ObjectHashTable> table(
-      ObjectHashTable::cast(weak_collection->table()));
-  DCHECK(table->IsKey(table->GetIsolate(), *key));
-  Handle<ObjectHashTable> new_table =
-      ObjectHashTable::Put(table, key, value, hash);
+  Handle<EphemeronHashTable> table(
+      EphemeronHashTable::cast(weak_collection->table()),
+      weak_collection->GetIsolate());
+  DCHECK(table->IsKey(weak_collection->GetIsolate(), *key));
+  Handle<EphemeronHashTable> new_table =
+      EphemeronHashTable::Put(table, key, value, hash);
   weak_collection->set_table(*new_table);
   if (*table != *new_table) {
     // Zap the old table since we didn't record slots for its elements.
-    table->FillWithHoles(0, table->length());
+    EphemeronHashTable::FillEntriesWithHoles(table);
   }
 }
 
@@ -18809,16 +18296,17 @@ void JSWeakCollection::Set(Handle<JSWeakCollection> weak_collection,
 bool JSWeakCollection::Delete(Handle<JSWeakCollection> weak_collection,
                               Handle<Object> key, int32_t hash) {
   DCHECK(key->IsJSReceiver() || key->IsSymbol());
-  Handle<ObjectHashTable> table(
-      ObjectHashTable::cast(weak_collection->table()));
-  DCHECK(table->IsKey(table->GetIsolate(), *key));
+  Handle<EphemeronHashTable> table(
+      EphemeronHashTable::cast(weak_collection->table()),
+      weak_collection->GetIsolate());
+  DCHECK(table->IsKey(weak_collection->GetIsolate(), *key));
   bool was_present = false;
-  Handle<ObjectHashTable> new_table =
-      ObjectHashTable::Remove(table, key, &was_present, hash);
+  Handle<EphemeronHashTable> new_table =
+      EphemeronHashTable::Remove(table, key, &was_present, hash);
   weak_collection->set_table(*new_table);
   if (*table != *new_table) {
     // Zap the old table since we didn't record slots for its elements.
-    table->FillWithHoles(0, table->length());
+    EphemeronHashTable::FillEntriesWithHoles(table);
   }
   return was_present;
 }
@@ -18826,7 +18314,8 @@ bool JSWeakCollection::Delete(Handle<JSWeakCollection> weak_collection,
 Handle<JSArray> JSWeakCollection::GetEntries(Handle<JSWeakCollection> holder,
                                              int max_entries) {
   Isolate* isolate = holder->GetIsolate();
-  Handle<ObjectHashTable> table(ObjectHashTable::cast(holder->table()));
+  Handle<EphemeronHashTable> table(EphemeronHashTable::cast(holder->table()),
+                                   isolate);
   if (max_entries == 0 || max_entries > table->NumberOfElements()) {
     max_entries = table->NumberOfElements();
   }
@@ -18924,7 +18413,7 @@ Object* JSDate::DoGetField(FieldIndex index) {
   }
 
   double time = value()->Number();
-  if (std::isnan(time)) return GetIsolate()->heap()->nan_value();
+  if (std::isnan(time)) return GetReadOnlyRoots().nan_value();
 
   int64_t local_time_ms = date_cache->ToLocal(static_cast<int64_t>(time));
   int days = DateCache::DaysFromTime(local_time_ms);
@@ -18943,7 +18432,7 @@ Object* JSDate::GetUTCField(FieldIndex index,
                             DateCache* date_cache) {
   DCHECK_GE(index, kFirstUTCField);
 
-  if (std::isnan(value)) return GetIsolate()->heap()->nan_value();
+  if (std::isnan(value)) return GetReadOnlyRoots().nan_value();
 
   int64_t time_ms = static_cast<int64_t>(value);
 
@@ -18992,7 +18481,7 @@ Handle<Object> JSDate::SetValue(Handle<JSDate> date, double v) {
 void JSDate::SetValue(Object* value, bool is_value_nan) {
   set_value(value);
   if (is_value_nan) {
-    HeapNumber* nan = GetIsolate()->heap()->nan_value();
+    HeapNumber* nan = GetReadOnlyRoots().nan_value();
     set_cache_stamp(nan, SKIP_WRITE_BARRIER);
     set_year(nan, SKIP_WRITE_BARRIER);
     set_month(nan, SKIP_WRITE_BARRIER);
@@ -19026,21 +18515,10 @@ void JSDate::SetCachedFields(int64_t local_time_ms, DateCache* date_cache) {
   set_sec(Smi::FromInt(sec), SKIP_WRITE_BARRIER);
 }
 
-namespace {
-
-Script* ScriptFromJSValue(Object* in) {
-  DCHECK(in->IsJSValue());
-  JSValue* jsvalue = JSValue::cast(in);
-  DCHECK(jsvalue->value()->IsScript());
-  return Script::cast(jsvalue->value());
-}
-
-}  // namespace
-
 int JSMessageObject::GetLineNumber() const {
   if (start_position() == -1) return Message::kNoLineNumberInfo;
 
-  Handle<Script> the_script = handle(ScriptFromJSValue(script()));
+  Handle<Script> the_script(script(), GetIsolate());
 
   Script::PositionInfo info;
   const Script::OffsetFlag offset_flag = Script::WITH_OFFSET;
@@ -19055,7 +18533,7 @@ int JSMessageObject::GetLineNumber() const {
 int JSMessageObject::GetColumnNumber() const {
   if (start_position() == -1) return -1;
 
-  Handle<Script> the_script = handle(ScriptFromJSValue(script()));
+  Handle<Script> the_script(script(), GetIsolate());
 
   Script::PositionInfo info;
   const Script::OffsetFlag offset_flag = Script::WITH_OFFSET;
@@ -19068,9 +18546,9 @@ int JSMessageObject::GetColumnNumber() const {
 }
 
 Handle<String> JSMessageObject::GetSourceLine() const {
-  Handle<Script> the_script = handle(ScriptFromJSValue(script()));
+  Isolate* isolate = GetIsolate();
+  Handle<Script> the_script(script(), isolate);
 
-  Isolate* isolate = the_script->GetIsolate();
   if (the_script->type() == Script::TYPE_WASM) {
     return isolate->factory()->empty_string();
   }
@@ -19101,13 +18579,18 @@ void JSArrayBuffer::Neuter() {
   }
 }
 
+void JSArrayBuffer::StopTrackingWasmMemory(Isolate* isolate) {
+  DCHECK(is_wasm_memory());
+  isolate->wasm_engine()->memory_tracker()->ReleaseAllocation(backing_store());
+  set_is_wasm_memory(false);
+}
+
 void JSArrayBuffer::FreeBackingStoreFromMainThread() {
   if (allocation_base() == nullptr) {
     return;
   }
-  FreeBackingStore(GetIsolate(),
-                   {allocation_base(), allocation_length(), backing_store(),
-                    allocation_mode(), is_wasm_memory()});
+  FreeBackingStore(GetIsolate(), {allocation_base(), allocation_length(),
+                                  backing_store(), is_wasm_memory()});
   // Zero out the backing store and allocation base to avoid dangling
   // pointers.
   set_backing_store(nullptr);
@@ -19115,16 +18598,10 @@ void JSArrayBuffer::FreeBackingStoreFromMainThread() {
 
 // static
 void JSArrayBuffer::FreeBackingStore(Isolate* isolate, Allocation allocation) {
-  if (allocation.mode == ArrayBuffer::Allocator::AllocationMode::kReservation) {
-    bool needs_free = true;
-    if (allocation.is_wasm_memory) {
-      wasm::WasmMemoryTracker* memory_tracker =
-          isolate->wasm_engine()->memory_tracker();
-      if (memory_tracker->FreeMemoryIfIsWasmMemory(allocation.backing_store)) {
-        needs_free = false;
-      }
-    }
-    if (needs_free) {
+  if (allocation.is_wasm_memory) {
+    wasm::WasmMemoryTracker* memory_tracker =
+        isolate->wasm_engine()->memory_tracker();
+    if (!memory_tracker->FreeMemoryIfIsWasmMemory(allocation.backing_store)) {
       CHECK(FreePages(allocation.allocation_base, allocation.length));
     }
   } else {
@@ -19217,7 +18694,7 @@ Handle<JSArrayBuffer> JSTypedArray::MaterializeArrayBuffer(
   DCHECK(IsFixedTypedArrayElementsKind(typed_array->GetElementsKind()));
 
   Handle<FixedTypedArrayBase> fixed_typed_array(
-      FixedTypedArrayBase::cast(typed_array->elements()));
+      FixedTypedArrayBase::cast(typed_array->elements()), isolate);
 
   Handle<JSArrayBuffer> buffer(JSArrayBuffer::cast(typed_array->buffer()),
                                isolate);
@@ -19227,6 +18704,10 @@ Handle<JSArrayBuffer> JSTypedArray::MaterializeArrayBuffer(
   void* backing_store =
       isolate->array_buffer_allocator()->AllocateUninitialized(
           fixed_typed_array->DataSize());
+  if (backing_store == nullptr) {
+    isolate->heap()->FatalProcessOutOfMemory(
+        "JSTypedArray::MaterializeArrayBuffer");
+  }
   buffer->set_is_external(false);
   DCHECK(buffer->byte_length()->IsSmi() ||
          buffer->byte_length()->IsHeapNumber());
@@ -19254,18 +18735,18 @@ Handle<JSArrayBuffer> JSTypedArray::MaterializeArrayBuffer(
 
 Handle<JSArrayBuffer> JSTypedArray::GetBuffer() {
   if (!is_on_heap()) {
-    Handle<JSArrayBuffer> array_buffer(JSArrayBuffer::cast(buffer()));
+    Handle<JSArrayBuffer> array_buffer(JSArrayBuffer::cast(buffer()),
+                                       GetIsolate());
     return array_buffer;
   }
-  Handle<JSTypedArray> self(this);
+  Handle<JSTypedArray> self(this, GetIsolate());
   return MaterializeArrayBuffer(self);
 }
 
 Handle<PropertyCell> PropertyCell::InvalidateEntry(
-    Handle<GlobalDictionary> dictionary, int entry) {
-  Isolate* isolate = dictionary->GetIsolate();
+    Isolate* isolate, Handle<GlobalDictionary> dictionary, int entry) {
   // Swap with a copy.
-  Handle<PropertyCell> cell(dictionary->CellAt(entry));
+  Handle<PropertyCell> cell(dictionary->CellAt(entry), isolate);
   Handle<Name> name(cell->name(), isolate);
   Handle<PropertyCell> new_cell = isolate->factory()->NewPropertyCell(name);
   new_cell->set_value(cell->value());
@@ -19278,9 +18759,9 @@ Handle<PropertyCell> PropertyCell::InvalidateEntry(
   new_cell->set_property_details(details);
   // Old cell is ready for invalidation.
   if (is_the_hole) {
-    cell->set_value(isolate->heap()->undefined_value());
+    cell->set_value(ReadOnlyRoots(isolate).undefined_value());
   } else {
-    cell->set_value(isolate->heap()->the_hole_value());
+    cell->set_value(ReadOnlyRoots(isolate).the_hole_value());
   }
   details = details.set_cell_type(PropertyCellType::kInvalidated);
   cell->set_property_details(details);
@@ -19309,12 +18790,11 @@ static bool RemainsConstantType(Handle<PropertyCell> cell,
   return false;
 }
 
-
-PropertyCellType PropertyCell::UpdatedType(Handle<PropertyCell> cell,
+PropertyCellType PropertyCell::UpdatedType(Isolate* isolate,
+                                           Handle<PropertyCell> cell,
                                            Handle<Object> value,
                                            PropertyDetails details) {
   PropertyCellType type = details.cell_type();
-  Isolate* isolate = cell->GetIsolate();
   DCHECK(!value->IsTheHole(isolate));
   if (cell->value()->IsTheHole(isolate)) {
     switch (type) {
@@ -19346,11 +18826,10 @@ PropertyCellType PropertyCell::UpdatedType(Handle<PropertyCell> cell,
 }
 
 Handle<PropertyCell> PropertyCell::PrepareForValue(
-    Handle<GlobalDictionary> dictionary, int entry, Handle<Object> value,
-    PropertyDetails details) {
-  Isolate* isolate = dictionary->GetIsolate();
+    Isolate* isolate, Handle<GlobalDictionary> dictionary, int entry,
+    Handle<Object> value, PropertyDetails details) {
   DCHECK(!value->IsTheHole(isolate));
-  Handle<PropertyCell> cell(dictionary->CellAt(entry));
+  Handle<PropertyCell> cell(dictionary->CellAt(entry), isolate);
   const PropertyDetails original_details = cell->property_details();
   // Data accesses could be cached in ics or optimized code.
   bool invalidate =
@@ -19369,8 +18848,11 @@ Handle<PropertyCell> PropertyCell::PrepareForValue(
   DCHECK_LT(0, index);
   details = details.set_index(index);
 
-  PropertyCellType new_type = UpdatedType(cell, value, original_details);
-  if (invalidate) cell = PropertyCell::InvalidateEntry(dictionary, entry);
+  PropertyCellType new_type =
+      UpdatedType(isolate, cell, value, original_details);
+  if (invalidate) {
+    cell = PropertyCell::InvalidateEntry(isolate, dictionary, entry);
+  }
 
   // Install new property details.
   details = details.set_cell_type(new_type);
@@ -19395,11 +18877,11 @@ Handle<PropertyCell> PropertyCell::PrepareForValue(
 
 
 // static
-void PropertyCell::SetValueWithInvalidation(Handle<PropertyCell> cell,
+void PropertyCell::SetValueWithInvalidation(Isolate* isolate,
+                                            Handle<PropertyCell> cell,
                                             Handle<Object> new_value) {
   if (cell->value() != *new_value) {
     cell->set_value(*new_value);
-    Isolate* isolate = cell->GetIsolate();
     cell->dependent_code()->DeoptimizeDependentCodeGroup(
         isolate, DependentCode::kPropertyCellChangedGroup);
   }
@@ -19470,17 +18952,107 @@ MaybeHandle<Name> FunctionTemplateInfo::TryGetCachedPropertyName(
         Handle<FunctionTemplateInfo>::cast(getter);
     // Check if the accessor uses a cached property.
     if (!fti->cached_property_name()->IsTheHole(isolate)) {
-      return handle(Name::cast(fti->cached_property_name()));
+      return handle(Name::cast(fti->cached_property_name()), isolate);
     }
   }
   return MaybeHandle<Name>();
 }
 
-#undef FIELD_ADDR
-#undef FIELD_ADDR_CONST
-#undef READ_INT32_FIELD
-#undef READ_INT64_FIELD
-#undef READ_BYTE_FIELD
+// Force instantiation of template instances class.
+// Please note this list is compiler dependent.
+// Keep this at the end of this file
+
+template class HashTable<StringTable, StringTableShape>;
+
+template class HashTable<CompilationCacheTable, CompilationCacheShape>;
+
+template class HashTable<ObjectHashTable, ObjectHashTableShape>;
+
+template class HashTable<EphemeronHashTable, EphemeronHashTableShape>;
+
+template class ObjectHashTableBase<ObjectHashTable, ObjectHashTableShape>;
+
+template class ObjectHashTableBase<EphemeronHashTable, EphemeronHashTableShape>;
+
+template class Dictionary<NameDictionary, NameDictionaryShape>;
+
+template class Dictionary<GlobalDictionary, GlobalDictionaryShape>;
+
+template class EXPORT_TEMPLATE_DEFINE(
+    V8_EXPORT_PRIVATE) HashTable<NumberDictionary, NumberDictionaryShape>;
+
+template class EXPORT_TEMPLATE_DEFINE(V8_EXPORT_PRIVATE)
+    Dictionary<NumberDictionary, NumberDictionaryShape>;
+
+template class EXPORT_TEMPLATE_DEFINE(V8_EXPORT_PRIVATE)
+    HashTable<SimpleNumberDictionary, SimpleNumberDictionaryShape>;
+
+template class EXPORT_TEMPLATE_DEFINE(V8_EXPORT_PRIVATE)
+    Dictionary<SimpleNumberDictionary, SimpleNumberDictionaryShape>;
+
+template Handle<NameDictionary>
+BaseNameDictionary<NameDictionary, NameDictionaryShape>::New(
+    Isolate*, int n, PretenureFlag pretenure, MinimumCapacity capacity_option);
+
+template Handle<GlobalDictionary>
+BaseNameDictionary<GlobalDictionary, GlobalDictionaryShape>::New(
+    Isolate*, int n, PretenureFlag pretenure, MinimumCapacity capacity_option);
+
+template Handle<NameDictionary>
+HashTable<NameDictionary, NameDictionaryShape>::New(Isolate*, int,
+                                                    PretenureFlag,
+                                                    MinimumCapacity);
+
+template Handle<ObjectHashSet>
+HashTable<ObjectHashSet, ObjectHashSetShape>::New(Isolate*, int n,
+                                                  PretenureFlag,
+                                                  MinimumCapacity);
+
+template Handle<NameDictionary>
+HashTable<NameDictionary, NameDictionaryShape>::Shrink(Handle<NameDictionary>,
+                                                       int additionalCapacity);
+
+template Handle<NameDictionary>
+BaseNameDictionary<NameDictionary, NameDictionaryShape>::Add(
+    Handle<NameDictionary>, Handle<Name>, Handle<Object>, PropertyDetails,
+    int*);
+
+template Handle<GlobalDictionary>
+BaseNameDictionary<GlobalDictionary, GlobalDictionaryShape>::Add(
+    Handle<GlobalDictionary>, Handle<Name>, Handle<Object>, PropertyDetails,
+    int*);
+
+template void HashTable<GlobalDictionary, GlobalDictionaryShape>::Rehash();
+
+template Handle<NameDictionary>
+BaseNameDictionary<NameDictionary, NameDictionaryShape>::EnsureCapacity(
+    Handle<NameDictionary>, int);
+
+template void
+BaseNameDictionary<GlobalDictionary, GlobalDictionaryShape>::CopyEnumKeysTo(
+    Isolate* isolate, Handle<GlobalDictionary> dictionary,
+    Handle<FixedArray> storage, KeyCollectionMode mode,
+    KeyAccumulator* accumulator);
+
+template void
+BaseNameDictionary<NameDictionary, NameDictionaryShape>::CopyEnumKeysTo(
+    Isolate* isolate, Handle<NameDictionary> dictionary,
+    Handle<FixedArray> storage, KeyCollectionMode mode,
+    KeyAccumulator* accumulator);
+
+template Handle<FixedArray>
+BaseNameDictionary<GlobalDictionary, GlobalDictionaryShape>::IterationIndices(
+    Handle<GlobalDictionary> dictionary);
+template void
+BaseNameDictionary<GlobalDictionary, GlobalDictionaryShape>::CollectKeysTo(
+    Handle<GlobalDictionary> dictionary, KeyAccumulator* keys);
+
+template Handle<FixedArray>
+BaseNameDictionary<NameDictionary, NameDictionaryShape>::IterationIndices(
+    Handle<NameDictionary> dictionary);
+template void
+BaseNameDictionary<NameDictionary, NameDictionaryShape>::CollectKeysTo(
+    Handle<NameDictionary> dictionary, KeyAccumulator* keys);
 
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/src/objects.h b/deps/v8/src/objects.h
index 72c31a35de2a54..6e0279db34a287 100644
--- a/deps/v8/src/objects.h
+++ b/deps/v8/src/objects.h
@@ -8,19 +8,22 @@
 #include <iosfwd>
 #include <memory>
 
+#include "include/v8.h"
+#include "include/v8config.h"
 #include "src/assert-scope.h"
-#include "src/bailout-reason.h"
 #include "src/base/bits.h"
+#include "src/base/build_config.h"
 #include "src/base/flags.h"
+#include "src/base/logging.h"
 #include "src/checks.h"
 #include "src/elements-kind.h"
 #include "src/field-index.h"
 #include "src/flags.h"
-#include "src/interpreter/bytecode-register.h"
 #include "src/messages.h"
+#include "src/objects-definitions.h"
 #include "src/property-details.h"
-#include "src/unicode-decoder.h"
-#include "src/unicode.h"
+#include "src/roots.h"
+#include "src/utils.h"
 
 #if V8_TARGET_ARCH_ARM
 #include "src/arm/constants-arm.h"  // NOLINT
@@ -72,6 +75,8 @@
 //           - JSDate
 //         - JSMessageObject
 //         - JSModuleNamespace
+//         - JSLocale  // If V8_INTL_SUPPORT enabled.
+//         - JSRelativeTimeFormat  // If V8_INTL_SUPPORT enabled.
 //         - WasmGlobalObject
 //         - WasmInstanceObject
 //         - WasmMemoryObject
@@ -101,8 +106,6 @@
 //         - ModuleInfo
 //         - ScriptContextTable
 //         - FixedArrayOfWeakCells
-//         - WasmSharedModuleData
-//         - WasmCompiledModule
 //       - FixedDoubleArray
 //     - Name
 //       - String
@@ -171,6 +174,9 @@
 //     - WeakCell
 //     - FeedbackCell
 //     - FeedbackVector
+//     - UncompiledData
+//       - UncompiledDataWithoutPreParsedScope
+//       - UncompiledDataWithPreParsedScope
 //
 // Formats of Object*:
 //  Smi:        [31 bit signed int] 0
@@ -299,298 +305,6 @@ const int kVariableSizeSentinel = 0;
 const int kStubMajorKeyBits = 8;
 const int kStubMinorKeyBits = kSmiValueSize - kStubMajorKeyBits - 1;
 
-// All Maps have a field instance_type containing a InstanceType.
-// It describes the type of the instances.
-//
-// As an example, a JavaScript object is a heap object and its map
-// instance_type is JS_OBJECT_TYPE.
-//
-// The names of the string instance types are intended to systematically
-// mirror their encoding in the instance_type field of the map.  The default
-// encoding is considered TWO_BYTE.  It is not mentioned in the name.  ONE_BYTE
-// encoding is mentioned explicitly in the name.  Likewise, the default
-// representation is considered sequential.  It is not mentioned in the
-// name.  The other representations (e.g. CONS, EXTERNAL) are explicitly
-// mentioned.  Finally, the string is either a STRING_TYPE (if it is a normal
-// string) or a INTERNALIZED_STRING_TYPE (if it is a internalized string).
-//
-// NOTE: The following things are some that depend on the string types having
-// instance_types that are less than those of all other types:
-// HeapObject::Size, HeapObject::IterateBody, the typeof operator, and
-// Object::IsString.
-//
-// NOTE: Everything following JS_VALUE_TYPE is considered a
-// JSObject for GC purposes. The first four entries here have typeof
-// 'object', whereas JS_FUNCTION_TYPE has typeof 'function'.
-#define INSTANCE_TYPE_LIST(V)                                   \
-  V(INTERNALIZED_STRING_TYPE)                                   \
-  V(EXTERNAL_INTERNALIZED_STRING_TYPE)                          \
-  V(ONE_BYTE_INTERNALIZED_STRING_TYPE)                          \
-  V(EXTERNAL_ONE_BYTE_INTERNALIZED_STRING_TYPE)                 \
-  V(EXTERNAL_INTERNALIZED_STRING_WITH_ONE_BYTE_DATA_TYPE)       \
-  V(SHORT_EXTERNAL_INTERNALIZED_STRING_TYPE)                    \
-  V(SHORT_EXTERNAL_ONE_BYTE_INTERNALIZED_STRING_TYPE)           \
-  V(SHORT_EXTERNAL_INTERNALIZED_STRING_WITH_ONE_BYTE_DATA_TYPE) \
-  V(STRING_TYPE)                                                \
-  V(CONS_STRING_TYPE)                                           \
-  V(EXTERNAL_STRING_TYPE)                                       \
-  V(SLICED_STRING_TYPE)                                         \
-  V(THIN_STRING_TYPE)                                           \
-  V(ONE_BYTE_STRING_TYPE)                                       \
-  V(CONS_ONE_BYTE_STRING_TYPE)                                  \
-  V(EXTERNAL_ONE_BYTE_STRING_TYPE)                              \
-  V(SLICED_ONE_BYTE_STRING_TYPE)                                \
-  V(THIN_ONE_BYTE_STRING_TYPE)                                  \
-  V(EXTERNAL_STRING_WITH_ONE_BYTE_DATA_TYPE)                    \
-  V(SHORT_EXTERNAL_STRING_TYPE)                                 \
-  V(SHORT_EXTERNAL_ONE_BYTE_STRING_TYPE)                        \
-  V(SHORT_EXTERNAL_STRING_WITH_ONE_BYTE_DATA_TYPE)              \
-                                                                \
-  V(SYMBOL_TYPE)                                                \
-  V(HEAP_NUMBER_TYPE)                                           \
-  V(BIGINT_TYPE)                                                \
-  V(ODDBALL_TYPE)                                               \
-                                                                \
-  V(MAP_TYPE)                                                   \
-  V(CODE_TYPE)                                                  \
-  V(MUTABLE_HEAP_NUMBER_TYPE)                                   \
-  V(FOREIGN_TYPE)                                               \
-  V(BYTE_ARRAY_TYPE)                                            \
-  V(BYTECODE_ARRAY_TYPE)                                        \
-  V(FREE_SPACE_TYPE)                                            \
-                                                                \
-  V(FIXED_INT8_ARRAY_TYPE)                                      \
-  V(FIXED_UINT8_ARRAY_TYPE)                                     \
-  V(FIXED_INT16_ARRAY_TYPE)                                     \
-  V(FIXED_UINT16_ARRAY_TYPE)                                    \
-  V(FIXED_INT32_ARRAY_TYPE)                                     \
-  V(FIXED_UINT32_ARRAY_TYPE)                                    \
-  V(FIXED_FLOAT32_ARRAY_TYPE)                                   \
-  V(FIXED_FLOAT64_ARRAY_TYPE)                                   \
-  V(FIXED_UINT8_CLAMPED_ARRAY_TYPE)                             \
-  V(FIXED_BIGINT64_ARRAY_TYPE)                                  \
-  V(FIXED_BIGUINT64_ARRAY_TYPE)                                 \
-                                                                \
-  V(FIXED_DOUBLE_ARRAY_TYPE)                                    \
-  V(FEEDBACK_METADATA_TYPE)                                     \
-  V(FILLER_TYPE)                                                \
-                                                                \
-  V(ACCESS_CHECK_INFO_TYPE)                                     \
-  V(ACCESSOR_INFO_TYPE)                                         \
-  V(ACCESSOR_PAIR_TYPE)                                         \
-  V(ALIASED_ARGUMENTS_ENTRY_TYPE)                               \
-  V(ALLOCATION_MEMENTO_TYPE)                                    \
-  V(ALLOCATION_SITE_TYPE)                                       \
-  V(ASYNC_GENERATOR_REQUEST_TYPE)                               \
-  V(CONTEXT_EXTENSION_TYPE)                                     \
-  V(DEBUG_INFO_TYPE)                                            \
-  V(FUNCTION_TEMPLATE_INFO_TYPE)                                \
-  V(INTERCEPTOR_INFO_TYPE)                                      \
-  V(INTERPRETER_DATA_TYPE)                                      \
-  V(MODULE_INFO_ENTRY_TYPE)                                     \
-  V(MODULE_TYPE)                                                \
-  V(OBJECT_TEMPLATE_INFO_TYPE)                                  \
-  V(PROMISE_CAPABILITY_TYPE)                                    \
-  V(PROMISE_REACTION_TYPE)                                      \
-  V(PROTOTYPE_INFO_TYPE)                                        \
-  V(SCRIPT_TYPE)                                                \
-  V(STACK_FRAME_INFO_TYPE)                                      \
-  V(TUPLE2_TYPE)                                                \
-  V(TUPLE3_TYPE)                                                \
-  V(WASM_COMPILED_MODULE_TYPE)                                  \
-  V(WASM_DEBUG_INFO_TYPE)                                       \
-  V(WASM_SHARED_MODULE_DATA_TYPE)                               \
-                                                                \
-  V(CALLABLE_TASK_TYPE)                                         \
-  V(CALLBACK_TASK_TYPE)                                         \
-  V(PROMISE_FULFILL_REACTION_JOB_TASK_TYPE)                     \
-  V(PROMISE_REJECT_REACTION_JOB_TASK_TYPE)                      \
-  V(PROMISE_RESOLVE_THENABLE_JOB_TASK_TYPE)                     \
-                                                                \
-  V(FIXED_ARRAY_TYPE)                                           \
-  V(BOILERPLATE_DESCRIPTION_TYPE)                               \
-  V(DESCRIPTOR_ARRAY_TYPE)                                      \
-  V(HASH_TABLE_TYPE)                                            \
-  V(SCOPE_INFO_TYPE)                                            \
-  V(TRANSITION_ARRAY_TYPE)                                      \
-                                                                \
-  V(BLOCK_CONTEXT_TYPE)                                         \
-  V(CATCH_CONTEXT_TYPE)                                         \
-  V(DEBUG_EVALUATE_CONTEXT_TYPE)                                \
-  V(EVAL_CONTEXT_TYPE)                                          \
-  V(FUNCTION_CONTEXT_TYPE)                                      \
-  V(MODULE_CONTEXT_TYPE)                                        \
-  V(NATIVE_CONTEXT_TYPE)                                        \
-  V(SCRIPT_CONTEXT_TYPE)                                        \
-  V(WITH_CONTEXT_TYPE)                                          \
-                                                                \
-  V(CALL_HANDLER_INFO_TYPE)                                     \
-  V(CELL_TYPE)                                                  \
-  V(CODE_DATA_CONTAINER_TYPE)                                   \
-  V(FEEDBACK_CELL_TYPE)                                         \
-  V(FEEDBACK_VECTOR_TYPE)                                       \
-  V(LOAD_HANDLER_TYPE)                                          \
-  V(PROPERTY_ARRAY_TYPE)                                        \
-  V(PROPERTY_CELL_TYPE)                                         \
-  V(SHARED_FUNCTION_INFO_TYPE)                                  \
-  V(SMALL_ORDERED_HASH_MAP_TYPE)                                \
-  V(SMALL_ORDERED_HASH_SET_TYPE)                                \
-  V(STORE_HANDLER_TYPE)                                         \
-  V(WEAK_CELL_TYPE)                                             \
-  V(WEAK_FIXED_ARRAY_TYPE)                                      \
-                                                                \
-  V(JS_PROXY_TYPE)                                              \
-  V(JS_GLOBAL_OBJECT_TYPE)                                      \
-  V(JS_GLOBAL_PROXY_TYPE)                                       \
-  V(JS_MODULE_NAMESPACE_TYPE)                                   \
-  V(JS_SPECIAL_API_OBJECT_TYPE)                                 \
-  V(JS_VALUE_TYPE)                                              \
-  V(JS_API_OBJECT_TYPE)                                         \
-  V(JS_OBJECT_TYPE)                                             \
-                                                                \
-  V(JS_ARGUMENTS_TYPE)                                          \
-  V(JS_ARRAY_BUFFER_TYPE)                                       \
-  V(JS_ARRAY_ITERATOR_TYPE)                                     \
-  V(JS_ARRAY_TYPE)                                              \
-  V(JS_ASYNC_FROM_SYNC_ITERATOR_TYPE)                           \
-  V(JS_ASYNC_GENERATOR_OBJECT_TYPE)                             \
-  V(JS_CONTEXT_EXTENSION_OBJECT_TYPE)                           \
-  V(JS_DATE_TYPE)                                               \
-  V(JS_ERROR_TYPE)                                              \
-  V(JS_GENERATOR_OBJECT_TYPE)                                   \
-  V(JS_MAP_TYPE)                                                \
-  V(JS_MAP_KEY_ITERATOR_TYPE)                                   \
-  V(JS_MAP_KEY_VALUE_ITERATOR_TYPE)                             \
-  V(JS_MAP_VALUE_ITERATOR_TYPE)                                 \
-  V(JS_MESSAGE_OBJECT_TYPE)                                     \
-  V(JS_PROMISE_TYPE)                                            \
-  V(JS_REGEXP_TYPE)                                             \
-  V(JS_REGEXP_STRING_ITERATOR_TYPE)                             \
-  V(JS_SET_TYPE)                                                \
-  V(JS_SET_KEY_VALUE_ITERATOR_TYPE)                             \
-  V(JS_SET_VALUE_ITERATOR_TYPE)                                 \
-  V(JS_STRING_ITERATOR_TYPE)                                    \
-  V(JS_WEAK_MAP_TYPE)                                           \
-  V(JS_WEAK_SET_TYPE)                                           \
-                                                                \
-  V(JS_TYPED_ARRAY_TYPE)                                        \
-  V(JS_DATA_VIEW_TYPE)                                          \
-                                                                \
-  V(WASM_GLOBAL_TYPE)                                           \
-  V(WASM_INSTANCE_TYPE)                                         \
-  V(WASM_MEMORY_TYPE)                                           \
-  V(WASM_MODULE_TYPE)                                           \
-  V(WASM_TABLE_TYPE)                                            \
-  V(JS_BOUND_FUNCTION_TYPE)                                     \
-  V(JS_FUNCTION_TYPE)
-
-// Since string types are not consecutive, this macro is used to
-// iterate over them.
-#define STRING_TYPE_LIST(V)                                                   \
-  V(STRING_TYPE, kVariableSizeSentinel, string, String)                       \
-  V(ONE_BYTE_STRING_TYPE, kVariableSizeSentinel, one_byte_string,             \
-    OneByteString)                                                            \
-  V(CONS_STRING_TYPE, ConsString::kSize, cons_string, ConsString)             \
-  V(CONS_ONE_BYTE_STRING_TYPE, ConsString::kSize, cons_one_byte_string,       \
-    ConsOneByteString)                                                        \
-  V(SLICED_STRING_TYPE, SlicedString::kSize, sliced_string, SlicedString)     \
-  V(SLICED_ONE_BYTE_STRING_TYPE, SlicedString::kSize, sliced_one_byte_string, \
-    SlicedOneByteString)                                                      \
-  V(EXTERNAL_STRING_TYPE, ExternalTwoByteString::kSize, external_string,      \
-    ExternalString)                                                           \
-  V(EXTERNAL_ONE_BYTE_STRING_TYPE, ExternalOneByteString::kSize,              \
-    external_one_byte_string, ExternalOneByteString)                          \
-  V(EXTERNAL_STRING_WITH_ONE_BYTE_DATA_TYPE, ExternalTwoByteString::kSize,    \
-    external_string_with_one_byte_data, ExternalStringWithOneByteData)        \
-  V(SHORT_EXTERNAL_STRING_TYPE, ExternalTwoByteString::kShortSize,            \
-    short_external_string, ShortExternalString)                               \
-  V(SHORT_EXTERNAL_ONE_BYTE_STRING_TYPE, ExternalOneByteString::kShortSize,   \
-    short_external_one_byte_string, ShortExternalOneByteString)               \
-  V(SHORT_EXTERNAL_STRING_WITH_ONE_BYTE_DATA_TYPE,                            \
-    ExternalTwoByteString::kShortSize,                                        \
-    short_external_string_with_one_byte_data,                                 \
-    ShortExternalStringWithOneByteData)                                       \
-                                                                              \
-  V(INTERNALIZED_STRING_TYPE, kVariableSizeSentinel, internalized_string,     \
-    InternalizedString)                                                       \
-  V(ONE_BYTE_INTERNALIZED_STRING_TYPE, kVariableSizeSentinel,                 \
-    one_byte_internalized_string, OneByteInternalizedString)                  \
-  V(EXTERNAL_INTERNALIZED_STRING_TYPE, ExternalTwoByteString::kSize,          \
-    external_internalized_string, ExternalInternalizedString)                 \
-  V(EXTERNAL_ONE_BYTE_INTERNALIZED_STRING_TYPE, ExternalOneByteString::kSize, \
-    external_one_byte_internalized_string, ExternalOneByteInternalizedString) \
-  V(EXTERNAL_INTERNALIZED_STRING_WITH_ONE_BYTE_DATA_TYPE,                     \
-    ExternalTwoByteString::kSize,                                             \
-    external_internalized_string_with_one_byte_data,                          \
-    ExternalInternalizedStringWithOneByteData)                                \
-  V(SHORT_EXTERNAL_INTERNALIZED_STRING_TYPE,                                  \
-    ExternalTwoByteString::kShortSize, short_external_internalized_string,    \
-    ShortExternalInternalizedString)                                          \
-  V(SHORT_EXTERNAL_ONE_BYTE_INTERNALIZED_STRING_TYPE,                         \
-    ExternalOneByteString::kShortSize,                                        \
-    short_external_one_byte_internalized_string,                              \
-    ShortExternalOneByteInternalizedString)                                   \
-  V(SHORT_EXTERNAL_INTERNALIZED_STRING_WITH_ONE_BYTE_DATA_TYPE,               \
-    ExternalTwoByteString::kShortSize,                                        \
-    short_external_internalized_string_with_one_byte_data,                    \
-    ShortExternalInternalizedStringWithOneByteData)                           \
-  V(THIN_STRING_TYPE, ThinString::kSize, thin_string, ThinString)             \
-  V(THIN_ONE_BYTE_STRING_TYPE, ThinString::kSize, thin_one_byte_string,       \
-    ThinOneByteString)
-
-// A struct is a simple object a set of object-valued fields.  Including an
-// object type in this causes the compiler to generate most of the boilerplate
-// code for the class including allocation and garbage collection routines,
-// casts and predicates.  All you need to define is the class, methods and
-// object verification routines.  Easy, no?
-//
-// Note that for subtle reasons related to the ordering or numerical values of
-// type tags, elements in this list have to be added to the INSTANCE_TYPE_LIST
-// manually.
-#define STRUCT_LIST(V)                                                       \
-  V(ACCESS_CHECK_INFO, AccessCheckInfo, access_check_info)                   \
-  V(ACCESSOR_INFO, AccessorInfo, accessor_info)                              \
-  V(ACCESSOR_PAIR, AccessorPair, accessor_pair)                              \
-  V(ALIASED_ARGUMENTS_ENTRY, AliasedArgumentsEntry, aliased_arguments_entry) \
-  V(ALLOCATION_MEMENTO, AllocationMemento, allocation_memento)               \
-  V(ALLOCATION_SITE, AllocationSite, allocation_site)                        \
-  V(ASYNC_GENERATOR_REQUEST, AsyncGeneratorRequest, async_generator_request) \
-  V(CONTEXT_EXTENSION, ContextExtension, context_extension)                  \
-  V(DEBUG_INFO, DebugInfo, debug_info)                                       \
-  V(FUNCTION_TEMPLATE_INFO, FunctionTemplateInfo, function_template_info)    \
-  V(INTERCEPTOR_INFO, InterceptorInfo, interceptor_info)                     \
-  V(INTERPRETER_DATA, InterpreterData, interpreter_data)                     \
-  V(MODULE_INFO_ENTRY, ModuleInfoEntry, module_info_entry)                   \
-  V(MODULE, Module, module)                                                  \
-  V(OBJECT_TEMPLATE_INFO, ObjectTemplateInfo, object_template_info)          \
-  V(PROMISE_CAPABILITY, PromiseCapability, promise_capability)               \
-  V(PROMISE_REACTION, PromiseReaction, promise_reaction)                     \
-  V(PROTOTYPE_INFO, PrototypeInfo, prototype_info)                           \
-  V(SCRIPT, Script, script)                                                  \
-  V(STACK_FRAME_INFO, StackFrameInfo, stack_frame_info)                      \
-  V(TUPLE2, Tuple2, tuple2)                                                  \
-  V(TUPLE3, Tuple3, tuple3)                                                  \
-  V(WASM_COMPILED_MODULE, WasmCompiledModule, wasm_compiled_module)          \
-  V(WASM_DEBUG_INFO, WasmDebugInfo, wasm_debug_info)                         \
-  V(WASM_SHARED_MODULE_DATA, WasmSharedModuleData, wasm_shared_module_data)  \
-  V(CALLABLE_TASK, CallableTask, callable_task)                              \
-  V(CALLBACK_TASK, CallbackTask, callback_task)                              \
-  V(PROMISE_FULFILL_REACTION_JOB_TASK, PromiseFulfillReactionJobTask,        \
-    promise_fulfill_reaction_job_task)                                       \
-  V(PROMISE_REJECT_REACTION_JOB_TASK, PromiseRejectReactionJobTask,          \
-    promise_reject_reaction_job_task)                                        \
-  V(PROMISE_RESOLVE_THENABLE_JOB_TASK, PromiseResolveThenableJobTask,        \
-    promise_resolve_thenable_job_task)
-
-#define DATA_HANDLER_LIST(V)                        \
-  V(LOAD_HANDLER, LoadHandler, 1, load_handler1)    \
-  V(LOAD_HANDLER, LoadHandler, 2, load_handler2)    \
-  V(LOAD_HANDLER, LoadHandler, 3, load_handler3)    \
-  V(STORE_HANDLER, StoreHandler, 0, store_handler0) \
-  V(STORE_HANDLER, StoreHandler, 1, store_handler1) \
-  V(STORE_HANDLER, StoreHandler, 2, store_handler2) \
-  V(STORE_HANDLER, StoreHandler, 3, store_handler3)
-
 // We use the full 16 bits of the instance_type field to encode heap object
 // instance types. All the high-order bits (bit 7-15) are cleared if the object
 // is a string, and contain set bits if it is not a string.
@@ -748,9 +462,7 @@ enum InstanceType : uint16_t {
   ACCESSOR_PAIR_TYPE,
   ALIASED_ARGUMENTS_ENTRY_TYPE,
   ALLOCATION_MEMENTO_TYPE,
-  ALLOCATION_SITE_TYPE,
   ASYNC_GENERATOR_REQUEST_TYPE,
-  CONTEXT_EXTENSION_TYPE,
   DEBUG_INFO_TYPE,
   FUNCTION_TEMPLATE_INFO_TYPE,
   INTERCEPTOR_INFO_TYPE,
@@ -765,9 +477,9 @@ enum InstanceType : uint16_t {
   STACK_FRAME_INFO_TYPE,
   TUPLE2_TYPE,
   TUPLE3_TYPE,
-  WASM_COMPILED_MODULE_TYPE,
+  ARRAY_BOILERPLATE_DESCRIPTION_TYPE,
   WASM_DEBUG_INFO_TYPE,
-  WASM_SHARED_MODULE_DATA_TYPE,
+  WASM_EXPORTED_FUNCTION_DATA_TYPE,
 
   CALLABLE_TASK_TYPE,  // FIRST_MICROTASK_TYPE
   CALLBACK_TASK_TYPE,
@@ -775,13 +487,21 @@ enum InstanceType : uint16_t {
   PROMISE_REJECT_REACTION_JOB_TASK_TYPE,
   PROMISE_RESOLVE_THENABLE_JOB_TASK_TYPE,  // LAST_MICROTASK_TYPE
 
+  ALLOCATION_SITE_TYPE,
   // FixedArrays.
   FIXED_ARRAY_TYPE,  // FIRST_FIXED_ARRAY_TYPE
-  BOILERPLATE_DESCRIPTION_TYPE,
-  DESCRIPTOR_ARRAY_TYPE,
-  HASH_TABLE_TYPE,
+  OBJECT_BOILERPLATE_DESCRIPTION_TYPE,
+  HASH_TABLE_TYPE,        // FIRST_HASH_TABLE_TYPE
+  ORDERED_HASH_MAP_TYPE,  // FIRST_DICTIONARY_TYPE
+  ORDERED_HASH_SET_TYPE,
+  NAME_DICTIONARY_TYPE,
+  GLOBAL_DICTIONARY_TYPE,
+  NUMBER_DICTIONARY_TYPE,
+  SIMPLE_NUMBER_DICTIONARY_TYPE,  // LAST_DICTIONARY_TYPE
+  STRING_TABLE_TYPE,              // LAST_HASH_TABLE_TYPE
+  EPHEMERON_HASH_TABLE_TYPE,
   SCOPE_INFO_TYPE,
-  TRANSITION_ARRAY_TYPE,
+  SCRIPT_CONTEXT_TABLE_TYPE,
   BLOCK_CONTEXT_TYPE,  // FIRST_CONTEXT_TYPE
   CATCH_CONTEXT_TYPE,
   DEBUG_EVALUATE_CONTEXT_TYPE,
@@ -792,6 +512,10 @@ enum InstanceType : uint16_t {
   SCRIPT_CONTEXT_TYPE,
   WITH_CONTEXT_TYPE,  // LAST_FIXED_ARRAY_TYPE, LAST_CONTEXT_TYPE
 
+  WEAK_FIXED_ARRAY_TYPE,  // FIRST_WEAK_FIXED_ARRAY_TYPE
+  DESCRIPTOR_ARRAY_TYPE,
+  TRANSITION_ARRAY_TYPE,  // LAST_WEAK_FIXED_ARRAY_TYPE
+
   // Misc.
   CALL_HANDLER_INFO_TYPE,
   CELL_TYPE,
@@ -805,8 +529,10 @@ enum InstanceType : uint16_t {
   SMALL_ORDERED_HASH_MAP_TYPE,
   SMALL_ORDERED_HASH_SET_TYPE,
   STORE_HANDLER_TYPE,
+  UNCOMPILED_DATA_WITHOUT_PRE_PARSED_SCOPE_TYPE,
+  UNCOMPILED_DATA_WITH_PRE_PARSED_SCOPE_TYPE,
   WEAK_CELL_TYPE,
-  WEAK_FIXED_ARRAY_TYPE,
+  WEAK_ARRAY_LIST_TYPE,
 
   // All the following types are subtypes of JSReceiver, which corresponds to
   // objects in the JS sense. The first and the last type in this range are
@@ -854,6 +580,11 @@ enum InstanceType : uint16_t {
   JS_TYPED_ARRAY_TYPE,
   JS_DATA_VIEW_TYPE,
 
+#ifdef V8_INTL_SUPPORT
+  JS_INTL_LOCALE_TYPE,
+  JS_INTL_RELATIVE_TIME_FORMAT_TYPE,
+#endif  // V8_INTL_SUPPORT
+
   WASM_GLOBAL_TYPE,
   WASM_INSTANCE_TYPE,
   WASM_MEMORY_TYPE,
@@ -877,6 +608,15 @@ enum InstanceType : uint16_t {
   // Boundaries for testing if given HeapObject is a subclass of FixedArray.
   FIRST_FIXED_ARRAY_TYPE = FIXED_ARRAY_TYPE,
   LAST_FIXED_ARRAY_TYPE = WITH_CONTEXT_TYPE,
+  // Boundaries for testing if given HeapObject is a subclass of HashTable
+  FIRST_HASH_TABLE_TYPE = HASH_TABLE_TYPE,
+  LAST_HASH_TABLE_TYPE = STRING_TABLE_TYPE,
+  // Boundaries for testing if given HeapObject is a subclass of Dictionary
+  FIRST_DICTIONARY_TYPE = ORDERED_HASH_MAP_TYPE,
+  LAST_DICTIONARY_TYPE = SIMPLE_NUMBER_DICTIONARY_TYPE,
+  // Boundaries for testing if given HeapObject is a subclass of WeakFixedArray.
+  FIRST_WEAK_FIXED_ARRAY_TYPE = WEAK_FIXED_ARRAY_TYPE,
+  LAST_WEAK_FIXED_ARRAY_TYPE = TRANSITION_ARRAY_TYPE,
   // Boundaries for testing if given HeapObject is a Context
   FIRST_CONTEXT_TYPE = BLOCK_CONTEXT_TYPE,
   LAST_CONTEXT_TYPE = WITH_CONTEXT_TYPE,
@@ -935,8 +675,11 @@ enum class ComparisonResult {
 // (Returns false whenever {result} is kUndefined.)
 bool ComparisonResultToBool(Operation op, ComparisonResult result);
 
+enum class OnNonExistent { kThrowReferenceError, kReturnUndefined };
+
 class AbstractCode;
 class AccessorPair;
+class AccessCheckInfo;
 class AllocationSite;
 class ByteArray;
 class Cell;
@@ -947,7 +690,12 @@ class EnumCache;
 class FixedArrayBase;
 class PropertyArray;
 class FunctionLiteral;
+class FunctionTemplateInfo;
 class JSGlobalObject;
+#ifdef V8_INTL_SUPPORT
+class JSLocale;
+class JSRelativeTimeFormat;
+#endif  // V8_INTL_SUPPORT
 class JSPromise;
 class KeyAccumulator;
 class LayoutDescriptor;
@@ -956,6 +704,7 @@ class FieldType;
 class Module;
 class ModuleInfoEntry;
 class ObjectHashTable;
+class ObjectTemplateInfo;
 class ObjectVisitor;
 class PropertyCell;
 class PropertyDescriptor;
@@ -966,7 +715,9 @@ class StringStream;
 class FeedbackCell;
 class FeedbackMetadata;
 class FeedbackVector;
+class UncompiledData;
 class WeakCell;
+class TemplateInfo;
 class TransitionArray;
 class TemplateList;
 template <typename T>
@@ -977,8 +728,11 @@ template <class C> inline bool Is(Object* obj);
 
 #ifdef OBJECT_PRINT
 #define DECL_PRINTER(Name) void Name##Print(std::ostream& os);  // NOLINT
+#define DECL_PRINTER_WITH_ISOLATE(Name) \
+  void Name##Print(Isolate* isolate, std::ostream& os);  // NOLINT
 #else
 #define DECL_PRINTER(Name)
+#define DECL_PRINTER_WITH_ISOLATE(Name)
 #endif
 
 #define OBJECT_TYPE_LIST(V) \
@@ -989,163 +743,176 @@ template <class C> inline bool Is(Object* obj);
   V(Number)                 \
   V(Numeric)
 
+#define HEAP_OBJECT_ORDINARY_TYPE_LIST_BASE(V) \
+  V(AbstractCode)                              \
+  V(AccessCheckNeeded)                         \
+  V(AllocationSite)                            \
+  V(ArrayList)                                 \
+  V(BigInt)                                    \
+  V(BigIntWrapper)                             \
+  V(ObjectBoilerplateDescription)              \
+  V(Boolean)                                   \
+  V(BooleanWrapper)                            \
+  V(BreakPoint)                                \
+  V(BreakPointInfo)                            \
+  V(ByteArray)                                 \
+  V(BytecodeArray)                             \
+  V(CallHandlerInfo)                           \
+  V(Callable)                                  \
+  V(Cell)                                      \
+  V(ClassBoilerplate)                          \
+  V(Code)                                      \
+  V(CodeDataContainer)                         \
+  V(CompilationCacheTable)                     \
+  V(ConsString)                                \
+  V(Constructor)                               \
+  V(Context)                                   \
+  V(CoverageInfo)                              \
+  V(DataHandler)                               \
+  V(DeoptimizationData)                        \
+  V(DependentCode)                             \
+  V(DescriptorArray)                           \
+  V(EphemeronHashTable)                        \
+  V(EnumCache)                                 \
+  V(ExternalOneByteString)                     \
+  V(ExternalString)                            \
+  V(ExternalTwoByteString)                     \
+  V(FeedbackCell)                              \
+  V(FeedbackMetadata)                          \
+  V(FeedbackVector)                            \
+  V(Filler)                                    \
+  V(FixedArray)                                \
+  V(FixedArrayBase)                            \
+  V(FixedArrayExact)                           \
+  V(FixedArrayOfWeakCells)                     \
+  V(FixedBigInt64Array)                        \
+  V(FixedBigUint64Array)                       \
+  V(FixedDoubleArray)                          \
+  V(FixedFloat32Array)                         \
+  V(FixedFloat64Array)                         \
+  V(FixedInt16Array)                           \
+  V(FixedInt32Array)                           \
+  V(FixedInt8Array)                            \
+  V(FixedTypedArrayBase)                       \
+  V(FixedUint16Array)                          \
+  V(FixedUint32Array)                          \
+  V(FixedUint8Array)                           \
+  V(FixedUint8ClampedArray)                    \
+  V(Foreign)                                   \
+  V(FrameArray)                                \
+  V(FreeSpace)                                 \
+  V(Function)                                  \
+  V(GlobalDictionary)                          \
+  V(HandlerTable)                              \
+  V(HeapNumber)                                \
+  V(InternalizedString)                        \
+  V(JSArgumentsObject)                         \
+  V(JSArray)                                   \
+  V(JSArrayBuffer)                             \
+  V(JSArrayBufferView)                         \
+  V(JSArrayIterator)                           \
+  V(JSAsyncFromSyncIterator)                   \
+  V(JSAsyncGeneratorObject)                    \
+  V(JSBoundFunction)                           \
+  V(JSCollection)                              \
+  V(JSContextExtensionObject)                  \
+  V(JSDataView)                                \
+  V(JSDate)                                    \
+  V(JSError)                                   \
+  V(JSFunction)                                \
+  V(JSGeneratorObject)                         \
+  V(JSGlobalObject)                            \
+  V(JSGlobalProxy)                             \
+  V(JSMap)                                     \
+  V(JSMapIterator)                             \
+  V(JSMessageObject)                           \
+  V(JSModuleNamespace)                         \
+  V(JSObject)                                  \
+  V(JSPromise)                                 \
+  V(JSProxy)                                   \
+  V(JSReceiver)                                \
+  V(JSRegExp)                                  \
+  V(JSRegExpStringIterator)                    \
+  V(JSSet)                                     \
+  V(JSSetIterator)                             \
+  V(JSSloppyArgumentsObject)                   \
+  V(JSStringIterator)                          \
+  V(JSTypedArray)                              \
+  V(JSValue)                                   \
+  V(JSWeakCollection)                          \
+  V(JSWeakMap)                                 \
+  V(JSWeakSet)                                 \
+  V(LoadHandler)                               \
+  V(Map)                                       \
+  V(MapCache)                                  \
+  V(Microtask)                                 \
+  V(ModuleInfo)                                \
+  V(MutableHeapNumber)                         \
+  V(Name)                                      \
+  V(NameDictionary)                            \
+  V(NativeContext)                             \
+  V(NormalizedMapCache)                        \
+  V(NumberDictionary)                          \
+  V(NumberWrapper)                             \
+  V(ObjectHashSet)                             \
+  V(ObjectHashTable)                           \
+  V(Oddball)                                   \
+  V(OrderedHashMap)                            \
+  V(OrderedHashSet)                            \
+  V(PreParsedScopeData)                        \
+  V(PromiseReactionJobTask)                    \
+  V(PropertyArray)                             \
+  V(PropertyCell)                              \
+  V(PropertyDescriptorObject)                  \
+  V(RegExpMatchInfo)                           \
+  V(ScopeInfo)                                 \
+  V(ScriptContextTable)                        \
+  V(ScriptWrapper)                             \
+  V(SeqOneByteString)                          \
+  V(SeqString)                                 \
+  V(SeqTwoByteString)                          \
+  V(SharedFunctionInfo)                        \
+  V(SimpleNumberDictionary)                    \
+  V(SlicedString)                              \
+  V(SloppyArgumentsElements)                   \
+  V(SmallOrderedHashMap)                       \
+  V(SmallOrderedHashSet)                       \
+  V(SourcePositionTableWithFrameCache)         \
+  V(StoreHandler)                              \
+  V(String)                                    \
+  V(StringSet)                                 \
+  V(StringTable)                               \
+  V(StringWrapper)                             \
+  V(Struct)                                    \
+  V(Symbol)                                    \
+  V(SymbolWrapper)                             \
+  V(TemplateInfo)                              \
+  V(TemplateList)                              \
+  V(TemplateObjectDescription)                 \
+  V(ThinString)                                \
+  V(TransitionArray)                           \
+  V(UncompiledData)                            \
+  V(UncompiledDataWithPreParsedScope)          \
+  V(UncompiledDataWithoutPreParsedScope)       \
+  V(Undetectable)                              \
+  V(UniqueName)                                \
+  V(WasmGlobalObject)                          \
+  V(WasmInstanceObject)                        \
+  V(WasmMemoryObject)                          \
+  V(WasmModuleObject)                          \
+  V(WasmTableObject)                           \
+  V(WeakCell)                                  \
+  V(WeakFixedArray)                            \
+  V(WeakArrayList)
+
+#ifdef V8_INTL_SUPPORT
 #define HEAP_OBJECT_ORDINARY_TYPE_LIST(V) \
-  V(AbstractCode)                         \
-  V(AccessCheckNeeded)                    \
-  V(ArrayList)                            \
-  V(BigInt)                               \
-  V(BigIntWrapper)                        \
-  V(BoilerplateDescription)               \
-  V(Boolean)                              \
-  V(BooleanWrapper)                       \
-  V(BreakPoint)                           \
-  V(BreakPointInfo)                       \
-  V(ByteArray)                            \
-  V(BytecodeArray)                        \
-  V(CallHandlerInfo)                      \
-  V(Callable)                             \
-  V(Cell)                                 \
-  V(ClassBoilerplate)                     \
-  V(Code)                                 \
-  V(CodeDataContainer)                    \
-  V(CompilationCacheTable)                \
-  V(ConsString)                           \
-  V(ConstantElementsPair)                 \
-  V(Constructor)                          \
-  V(Context)                              \
-  V(CoverageInfo)                         \
-  V(DataHandler)                          \
-  V(DeoptimizationData)                   \
-  V(DependentCode)                        \
-  V(DescriptorArray)                      \
-  V(EnumCache)                            \
-  V(External)                             \
-  V(ExternalOneByteString)                \
-  V(ExternalString)                       \
-  V(ExternalTwoByteString)                \
-  V(FeedbackCell)                         \
-  V(FeedbackMetadata)                     \
-  V(FeedbackVector)                       \
-  V(Filler)                               \
-  V(FixedArray)                           \
-  V(FixedArrayBase)                       \
-  V(FixedArrayExact)                      \
-  V(FixedArrayOfWeakCells)                \
-  V(FixedBigInt64Array)                   \
-  V(FixedBigUint64Array)                  \
-  V(FixedDoubleArray)                     \
-  V(FixedFloat32Array)                    \
-  V(FixedFloat64Array)                    \
-  V(FixedInt16Array)                      \
-  V(FixedInt32Array)                      \
-  V(FixedInt8Array)                       \
-  V(FixedTypedArrayBase)                  \
-  V(FixedUint16Array)                     \
-  V(FixedUint32Array)                     \
-  V(FixedUint8Array)                      \
-  V(FixedUint8ClampedArray)               \
-  V(Foreign)                              \
-  V(FrameArray)                           \
-  V(FreeSpace)                            \
-  V(Function)                             \
-  V(GlobalDictionary)                     \
-  V(HandlerTable)                         \
-  V(HeapNumber)                           \
-  V(InternalizedString)                   \
-  V(JSArgumentsObject)                    \
-  V(JSArray)                              \
-  V(JSArrayBuffer)                        \
-  V(JSArrayBufferView)                    \
-  V(JSArrayIterator)                      \
-  V(JSAsyncFromSyncIterator)              \
-  V(JSAsyncGeneratorObject)               \
-  V(JSBoundFunction)                      \
-  V(JSCollection)                         \
-  V(JSContextExtensionObject)             \
-  V(JSDataView)                           \
-  V(JSDate)                               \
-  V(JSError)                              \
-  V(JSFunction)                           \
-  V(JSGeneratorObject)                    \
-  V(JSGlobalObject)                       \
-  V(JSGlobalProxy)                        \
-  V(JSMap)                                \
-  V(JSMapIterator)                        \
-  V(JSMessageObject)                      \
-  V(JSModuleNamespace)                    \
-  V(JSObject)                             \
-  V(JSPromise)                            \
-  V(JSProxy)                              \
-  V(JSReceiver)                           \
-  V(JSRegExp)                             \
-  V(JSRegExpStringIterator)               \
-  V(JSSet)                                \
-  V(JSSetIterator)                        \
-  V(JSSloppyArgumentsObject)              \
-  V(JSStringIterator)                     \
-  V(JSTypedArray)                         \
-  V(JSValue)                              \
-  V(JSWeakCollection)                     \
-  V(JSWeakMap)                            \
-  V(JSWeakSet)                            \
-  V(LoadHandler)                          \
-  V(Map)                                  \
-  V(MapCache)                             \
-  V(Microtask)                            \
-  V(ModuleInfo)                           \
-  V(MutableHeapNumber)                    \
-  V(Name)                                 \
-  V(NameDictionary)                       \
-  V(NativeContext)                        \
-  V(NormalizedMapCache)                   \
-  V(NumberDictionary)                     \
-  V(NumberWrapper)                        \
-  V(ObjectHashSet)                        \
-  V(ObjectHashTable)                      \
-  V(Oddball)                              \
-  V(OrderedHashMap)                       \
-  V(OrderedHashSet)                       \
-  V(PreParsedScopeData)                   \
-  V(PromiseReactionJobTask)               \
-  V(PropertyArray)                        \
-  V(PropertyCell)                         \
-  V(PropertyDescriptorObject)             \
-  V(RegExpMatchInfo)                      \
-  V(ScopeInfo)                            \
-  V(ScriptContextTable)                   \
-  V(ScriptWrapper)                        \
-  V(SeqOneByteString)                     \
-  V(SeqString)                            \
-  V(SeqTwoByteString)                     \
-  V(SharedFunctionInfo)                   \
-  V(SimpleNumberDictionary)               \
-  V(SlicedString)                         \
-  V(SloppyArgumentsElements)              \
-  V(SmallOrderedHashMap)                  \
-  V(SmallOrderedHashSet)                  \
-  V(SourcePositionTableWithFrameCache)    \
-  V(StoreHandler)                         \
-  V(String)                               \
-  V(StringSet)                            \
-  V(StringTable)                          \
-  V(StringWrapper)                        \
-  V(Struct)                               \
-  V(Symbol)                               \
-  V(SymbolWrapper)                        \
-  V(TemplateInfo)                         \
-  V(TemplateList)                         \
-  V(TemplateObjectDescription)            \
-  V(ThinString)                           \
-  V(TransitionArray)                      \
-  V(Undetectable)                         \
-  V(UniqueName)                           \
-  V(WasmGlobalObject)                     \
-  V(WasmInstanceObject)                   \
-  V(WasmMemoryObject)                     \
-  V(WasmModuleObject)                     \
-  V(WasmTableObject)                      \
-  V(WeakCell)                             \
-  V(WeakFixedArray)
+  HEAP_OBJECT_ORDINARY_TYPE_LIST_BASE(V)  \
+  V(JSLocale)                             \
+  V(JSRelativeTimeFormat)
+#else
+#define HEAP_OBJECT_ORDINARY_TYPE_LIST(V) HEAP_OBJECT_ORDINARY_TYPE_LIST_BASE(V)
+#endif  // V8_INTL_SUPPORT
 
 #define HEAP_OBJECT_TEMPLATE_TYPE_LIST(V) \
   V(Dictionary)                           \
@@ -1181,17 +948,25 @@ class Object {
   // Type testing.
   bool IsObject() const { return true; }
 
-#define IS_TYPE_FUNCTION_DECL(Type) INLINE(bool Is##Type() const);
+#define IS_TYPE_FUNCTION_DECL(Type) V8_INLINE bool Is##Type() const;
   OBJECT_TYPE_LIST(IS_TYPE_FUNCTION_DECL)
   HEAP_OBJECT_TYPE_LIST(IS_TYPE_FUNCTION_DECL)
 #undef IS_TYPE_FUNCTION_DECL
 
-#define IS_TYPE_FUNCTION_DECL(Type, Value) \
-  INLINE(bool Is##Type(Isolate* isolate) const);
+  V8_INLINE bool IsExternal(Isolate* isolate) const;
+
+// Oddball checks are faster when they are raw pointer comparisons, so the
+// isolate/read-only roots overloads should be preferred where possible.
+#define IS_TYPE_FUNCTION_DECL(Type, Value)            \
+  V8_INLINE bool Is##Type(Isolate* isolate) const;    \
+  V8_INLINE bool Is##Type(ReadOnlyRoots roots) const; \
+  V8_INLINE bool Is##Type() const;
   ODDBALL_LIST(IS_TYPE_FUNCTION_DECL)
 #undef IS_TYPE_FUNCTION_DECL
 
-  INLINE(bool IsNullOrUndefined(Isolate* isolate) const);
+  V8_INLINE bool IsNullOrUndefined(Isolate* isolate) const;
+  V8_INLINE bool IsNullOrUndefined(ReadOnlyRoots roots) const;
+  V8_INLINE bool IsNullOrUndefined() const;
 
   // A non-keyed store is of the form a.x = foo or a["x"] = foo whereas
   // a keyed store is of the form a[expression] = foo.
@@ -1219,20 +994,20 @@ class Object {
 
 #define MAYBE_RETURN_NULL(call) MAYBE_RETURN(call, MaybeHandle<Object>())
 
-#define DECL_STRUCT_PREDICATE(NAME, Name, name) INLINE(bool Is##Name() const);
+#define DECL_STRUCT_PREDICATE(NAME, Name, name) V8_INLINE bool Is##Name() const;
   STRUCT_LIST(DECL_STRUCT_PREDICATE)
 #undef DECL_STRUCT_PREDICATE
 
   // ES6, #sec-isarray.  NOT to be confused with %_IsArray.
-  INLINE(
-      V8_WARN_UNUSED_RESULT static Maybe<bool> IsArray(Handle<Object> object));
+  V8_INLINE
+  V8_WARN_UNUSED_RESULT static Maybe<bool> IsArray(Handle<Object> object);
 
-  INLINE(bool IsSmallOrderedHashTable() const);
+  V8_INLINE bool IsSmallOrderedHashTable() const;
 
   // Extract the number.
   inline double Number() const;
-  INLINE(bool IsNaN() const);
-  INLINE(bool IsMinusZero() const);
+  V8_INLINE bool IsNaN() const;
+  V8_INLINE bool IsMinusZero() const;
   V8_EXPORT_PRIVATE bool ToInt32(int32_t* value);
   inline bool ToUint32(uint32_t* value) const;
 
@@ -1264,14 +1039,16 @@ class Object {
   // implementation of a JSObject's elements.
   inline bool HasValidElements();
 
-  bool BooleanValue();                                      // ECMA-262 9.2.
+  // ECMA-262 9.2.
+  bool BooleanValue(Isolate* isolate);
 
   // ES6 section 7.2.11 Abstract Relational Comparison
   V8_WARN_UNUSED_RESULT static Maybe<ComparisonResult> Compare(
-      Handle<Object> x, Handle<Object> y);
+      Isolate* isolate, Handle<Object> x, Handle<Object> y);
 
   // ES6 section 7.2.12 Abstract Equality Comparison
-  V8_WARN_UNUSED_RESULT static Maybe<bool> Equals(Handle<Object> x,
+  V8_WARN_UNUSED_RESULT static Maybe<bool> Equals(Isolate* isolate,
+                                                  Handle<Object> x,
                                                   Handle<Object> y);
 
   // ES6 section 7.2.13 Strict Equality Comparison
@@ -1363,14 +1140,16 @@ class Object {
                                                        Handle<Object> rhs);
 
   // ES6 section 12.9 Relational Operators
-  V8_WARN_UNUSED_RESULT static inline Maybe<bool> GreaterThan(Handle<Object> x,
+  V8_WARN_UNUSED_RESULT static inline Maybe<bool> GreaterThan(Isolate* isolate,
+                                                              Handle<Object> x,
                                                               Handle<Object> y);
   V8_WARN_UNUSED_RESULT static inline Maybe<bool> GreaterThanOrEqual(
-      Handle<Object> x, Handle<Object> y);
-  V8_WARN_UNUSED_RESULT static inline Maybe<bool> LessThan(Handle<Object> x,
+      Isolate* isolate, Handle<Object> x, Handle<Object> y);
+  V8_WARN_UNUSED_RESULT static inline Maybe<bool> LessThan(Isolate* isolate,
+                                                           Handle<Object> x,
                                                            Handle<Object> y);
   V8_WARN_UNUSED_RESULT static inline Maybe<bool> LessThanOrEqual(
-      Handle<Object> x, Handle<Object> y);
+      Isolate* isolate, Handle<Object> x, Handle<Object> y);
 
   // ES6 section 7.3.19 OrdinaryHasInstance (C, O).
   V8_WARN_UNUSED_RESULT static MaybeHandle<Object> OrdinaryHasInstance(
@@ -1381,7 +1160,8 @@ class Object {
       Isolate* isolate, Handle<Object> object, Handle<Object> callable);
 
   V8_EXPORT_PRIVATE V8_WARN_UNUSED_RESULT static MaybeHandle<Object>
-  GetProperty(LookupIterator* it);
+  GetProperty(LookupIterator* it,
+              OnNonExistent on_non_existent = OnNonExistent::kReturnUndefined);
 
   // ES6 [[Set]] (when passed kDontThrow)
   // Invariants for this and related functions (unless stated otherwise):
@@ -1449,7 +1229,7 @@ class Object {
 
   // Returns the permanent hash code associated with this object. May return
   // undefined if not yet created.
-  Object* GetHash();
+  inline Object* GetHash();
 
   // Returns the permanent hash code associated with this object depending on
   // the actual object type. May create and store a hash code if needed and none
@@ -1495,6 +1275,9 @@ class Object {
 #ifdef VERIFY_HEAP
   // Verify a pointer is a valid object pointer.
   static void VerifyPointer(Object* p);
+  // Special non-isolate overload for cases where we don't have an isolate.
+  // TODO(v8:7786): Remove this overload.
+  void ObjectVerify();
 #endif
 
   inline void VerifyApiCallResultType();
@@ -1514,13 +1297,13 @@ class Object {
 
 #ifdef OBJECT_PRINT
   // For our gdb macros, we should perhaps change these in the future.
-  void Print();
+  void Print(Isolate* isolate);
 
   // Prints this object with details.
-  void Print(std::ostream& os);  // NOLINT
+  void Print(Isolate* isolate, std::ostream& os);  // NOLINT
 #else
-  void Print() { ShortPrint(); }
-  void Print(std::ostream& os) { ShortPrint(os); }  // NOLINT
+  void Print(Isolate* isolate) { ShortPrint(); }
+  void Print(Isolate* isolate, std::ostream& os) { ShortPrint(os); }  // NOLINT
 #endif
 
  private:
@@ -1530,6 +1313,15 @@ class Object {
   // Return the map of the root of object's prototype chain.
   Map* GetPrototypeChainRootMap(Isolate* isolate) const;
 
+  // Returns a non-SMI for JSReceivers, but returns the hash code for
+  // simple objects.  This avoids a double lookup in the cases where
+  // we know we will add the hash to the JSReceiver if it does not
+  // already exist.
+  //
+  // Despite its size, this needs to be inlined for performance
+  // reasons.
+  static inline Object* GetSimpleHash(Object* object);
+
   // Helper for SetProperty and SetSuperProperty.
   // Return value is only meaningful if [found] is set to true on return.
   V8_WARN_UNUSED_RESULT static Maybe<bool> SetPropertyInternal(
@@ -1632,9 +1424,8 @@ class Smi: public Object {
   DECL_VERIFIER(Smi)
 
   static constexpr Smi* const kZero = nullptr;
-  static const int kMinValue =
-      (static_cast<unsigned int>(-1)) << (kSmiValueSize - 1);
-  static const int kMaxValue = -(kMinValue + 1);
+  static const int kMinValue = kSmiMinValue;
+  static const int kMaxValue = kSmiMaxValue;
 
  private:
   DISALLOW_IMPLICIT_CONSTRUCTORS(Smi);
@@ -1721,24 +1512,47 @@ class HeapObject: public Object {
   inline MapWord map_word() const;
   inline void set_map_word(MapWord map_word);
 
+  // TODO(v8:7464): Once RO_SPACE is shared between isolates, this method can be
+  // removed as ReadOnlyRoots will be accessible from a global variable. For now
+  // this method exists to help remove GetIsolate/GetHeap from HeapObject, in a
+  // way that doesn't require passing Isolate/Heap down huge call chains or to
+  // places where it might not be safe to access it.
+  inline ReadOnlyRoots GetReadOnlyRoots() const;
+
   // The Heap the object was allocated in. Used also to access Isolate.
-  inline Heap* GetHeap() const;
+#ifdef DEPRECATE_GET_ISOLATE
+  [[deprecated("Pass Heap explicitly or use a NeverReadOnlyHeapObject")]]
+#endif
+      inline Heap*
+      GetHeap() const;
 
-  // Convenience method to get current isolate.
-  inline Isolate* GetIsolate() const;
+// Convenience method to get current isolate.
+#ifdef DEPRECATE_GET_ISOLATE
+  [[deprecated("Pass Isolate explicitly or use a NeverReadOnlyHeapObject")]]
+#endif
+      inline Isolate*
+      GetIsolate() const;
 
-#define IS_TYPE_FUNCTION_DECL(Type) INLINE(bool Is##Type() const);
+#define IS_TYPE_FUNCTION_DECL(Type) V8_INLINE bool Is##Type() const;
   HEAP_OBJECT_TYPE_LIST(IS_TYPE_FUNCTION_DECL)
 #undef IS_TYPE_FUNCTION_DECL
 
-#define IS_TYPE_FUNCTION_DECL(Type, Value) \
-  INLINE(bool Is##Type(Isolate* isolate) const);
+  V8_INLINE bool IsExternal(Isolate* isolate) const;
+
+// Oddball checks are faster when they are raw pointer comparisons, so the
+// isolate/read-only roots overloads should be preferred where possible.
+#define IS_TYPE_FUNCTION_DECL(Type, Value)            \
+  V8_INLINE bool Is##Type(Isolate* isolate) const;    \
+  V8_INLINE bool Is##Type(ReadOnlyRoots roots) const; \
+  V8_INLINE bool Is##Type() const;
   ODDBALL_LIST(IS_TYPE_FUNCTION_DECL)
 #undef IS_TYPE_FUNCTION_DECL
 
-  INLINE(bool IsNullOrUndefined(Isolate* isolate) const);
+  V8_INLINE bool IsNullOrUndefined(Isolate* isolate) const;
+  V8_INLINE bool IsNullOrUndefined(ReadOnlyRoots roots) const;
+  V8_INLINE bool IsNullOrUndefined() const;
 
-#define DECL_STRUCT_PREDICATE(NAME, Name, name) INLINE(bool Is##Name() const);
+#define DECL_STRUCT_PREDICATE(NAME, Name, name) V8_INLINE bool Is##Name() const;
   STRUCT_LIST(DECL_STRUCT_PREDICATE)
 #undef DECL_STRUCT_PREDICATE
 
@@ -1750,8 +1564,7 @@ class HeapObject: public Object {
 
   // Returns the address of this HeapObject.
   inline Address address() const {
-    return reinterpret_cast<Address>(const_cast<HeapObject*>(this)) -
-           kHeapObjectTag;
+    return reinterpret_cast<Address>(this) - kHeapObjectTag;
   }
 
   // Iterates over pointers contained in the object (including the Map).
@@ -1794,7 +1607,7 @@ class HeapObject: public Object {
   // Does no checking, and is safe to use during GC, while maps are invalid.
   // Does not invoke write barrier, so should only be assigned to
   // during marking GC.
-  static inline Object** RawField(HeapObject* obj, int offset);
+  static inline Object** RawField(const HeapObject* obj, int offset);
   static inline MaybeObject** RawMaybeWeakField(HeapObject* obj, int offset);
 
   DECL_CAST(HeapObject)
@@ -1812,11 +1625,12 @@ class HeapObject: public Object {
 #ifdef OBJECT_PRINT
   void PrintHeader(std::ostream& os, const char* id);  // NOLINT
 #endif
-  DECL_PRINTER(HeapObject)
+  DECL_PRINTER_WITH_ISOLATE(HeapObject)
   DECL_VERIFIER(HeapObject)
 #ifdef VERIFY_HEAP
   inline void VerifyObjectField(int offset);
   inline void VerifySmiField(int offset);
+  inline void VerifyMaybeObjectField(int offset);
 
   // Verify a pointer is a valid HeapObject pointer that points to object
   // areas in the heap.
@@ -1849,6 +1663,17 @@ class HeapObject: public Object {
   DISALLOW_IMPLICIT_CONSTRUCTORS(HeapObject);
 };
 
+// Mixin class for objects that can never be in RO space.
+// TODO(leszeks): Add checks in the factory that we never allocate these objects
+// in RO space.
+class NeverReadOnlySpaceObject {
+ public:
+  // The Heap the object was allocated in. Used also to access Isolate.
+  inline Heap* GetHeap() const;
+
+  // Convenience method to get current isolate.
+  inline Isolate* GetIsolate() const;
+};
 
 template <int start_offset, int end_offset, int size>
 class FixedBodyDescriptor;
@@ -1857,10 +1682,11 @@ class FixedBodyDescriptor;
 template <int start_offset>
 class FlexibleBodyDescriptor;
 
-
 // The HeapNumber class describes heap allocated numbers that cannot be
-// represented in a Smi (small integer)
-class HeapNumber: public HeapObject {
+// represented in a Smi (small integer). MutableHeapNumber is the same, but its
+// number value can change over time (it is used only as property storage).
+// HeapNumberBase merely exists to avoid code duplication.
+class HeapNumberBase : public HeapObject {
  public:
   // [value]: number value.
   inline double value() const;
@@ -1869,11 +1695,6 @@ class HeapNumber: public HeapObject {
   inline uint64_t value_as_bits() const;
   inline void set_value_as_bits(uint64_t bits);
 
-  DECL_CAST(HeapNumber)
-
-  V8_EXPORT_PRIVATE void HeapNumberPrint(std::ostream& os);  // NOLINT
-  DECL_VERIFIER(HeapNumber)
-
   inline int get_exponent();
   inline int get_sign();
 
@@ -1907,7 +1728,25 @@ class HeapNumber: public HeapObject {
   static const int kNonMantissaBitsInTopWord = 12;
 
  private:
-  DISALLOW_IMPLICIT_CONSTRUCTORS(HeapNumber);
+  DISALLOW_IMPLICIT_CONSTRUCTORS(HeapNumberBase)
+};
+
+class HeapNumber : public HeapNumberBase {
+ public:
+  DECL_CAST(HeapNumber)
+  V8_EXPORT_PRIVATE void HeapNumberPrint(std::ostream& os);
+
+ private:
+  DISALLOW_IMPLICIT_CONSTRUCTORS(HeapNumber)
+};
+
+class MutableHeapNumber : public HeapNumberBase {
+ public:
+  DECL_CAST(MutableHeapNumber)
+  V8_EXPORT_PRIVATE void MutableHeapNumberPrint(std::ostream& os);
+
+ private:
+  DISALLOW_IMPLICIT_CONSTRUCTORS(MutableHeapNumber)
 };
 
 enum EnsureElementsMode {
@@ -1992,8 +1831,13 @@ class PropertyArray : public HeapObject {
 
 // JSReceiver includes types on which properties can be defined, i.e.,
 // JSObject and JSProxy.
-class JSReceiver: public HeapObject {
+class JSReceiver : public HeapObject, public NeverReadOnlySpaceObject {
  public:
+  // Use the mixin methods over the HeapObject methods.
+  // TODO(v8:7786) Remove once the HeapObject methods are gone.
+  using NeverReadOnlySpaceObject::GetHeap;
+  using NeverReadOnlySpaceObject::GetIsolate;
+
   // Returns true if there is no slow (ie, dictionary) backing store.
   inline bool HasFastProperties() const;
 
@@ -2079,7 +1923,7 @@ class JSReceiver: public HeapObject {
   V8_WARN_UNUSED_RESULT static inline MaybeHandle<Object> GetProperty(
       Isolate* isolate, Handle<JSReceiver> receiver, const char* key);
   V8_WARN_UNUSED_RESULT static inline MaybeHandle<Object> GetProperty(
-      Handle<JSReceiver> receiver, Handle<Name> name);
+      Isolate* isolate, Handle<JSReceiver> receiver, Handle<Name> name);
   V8_WARN_UNUSED_RESULT static inline MaybeHandle<Object> GetElement(
       Isolate* isolate, Handle<JSReceiver> receiver, uint32_t index);
 
@@ -2214,6 +2058,9 @@ class JSReceiver: public HeapObject {
       Handle<JSReceiver> object, PropertyFilter filter,
       bool try_fast_path = true);
 
+  V8_WARN_UNUSED_RESULT static Handle<FixedArray> GetOwnElementIndices(
+      Isolate* isolate, Handle<JSReceiver> receiver, Handle<JSObject> object);
+
   static const int kHashMask = PropertyArray::HashField::kMask;
 
   // Layout description.
@@ -2278,6 +2125,8 @@ class JSObject: public JSReceiver {
   inline bool HasSmiOrObjectElements();
   // Returns true if an object has any of the "fast" elements kinds.
   inline bool HasFastElements();
+  // Returns true if an object has any of the PACKED elements kinds.
+  inline bool HasFastPackedElements();
   // Returns true if an object has elements of PACKED_DOUBLE_ELEMENTS or
   // HOLEY_DOUBLE_ELEMENTS ElementsKind.
   inline bool HasDoubleElements();
@@ -2356,15 +2205,13 @@ class JSObject: public JSReceiver {
       LookupIterator* it, Handle<Object> value,
       ShouldThrow should_throw = kDontThrow);
 
-  static void AddProperty(Handle<JSObject> object, Handle<Name> name,
-                          Handle<Object> value, PropertyAttributes attributes);
+  static void AddProperty(Isolate* isolate, Handle<JSObject> object,
+                          Handle<Name> name, Handle<Object> value,
+                          PropertyAttributes attributes);
 
-  V8_WARN_UNUSED_RESULT static Maybe<bool> AddDataElement(
-      Handle<JSObject> receiver, uint32_t index, Handle<Object> value,
-      PropertyAttributes attributes, ShouldThrow should_throw);
-  V8_WARN_UNUSED_RESULT static MaybeHandle<Object> AddDataElement(
-      Handle<JSObject> receiver, uint32_t index, Handle<Object> value,
-      PropertyAttributes attributes);
+  static void AddDataElement(Handle<JSObject> receiver, uint32_t index,
+                             Handle<Object> value,
+                             PropertyAttributes attributes);
 
   // Extend the receiver with a single fast property appeared first in the
   // passed map. This also extends the property backing store if necessary.
@@ -2614,7 +2461,7 @@ class JSObject: public JSReceiver {
 
   // Dispatched behavior.
   void JSObjectShortPrint(StringStream* accumulator);
-  DECL_PRINTER(JSObject)
+  DECL_PRINTER_WITH_ISOLATE(JSObject)
   DECL_VERIFIER(JSObject)
 #ifdef OBJECT_PRINT
   bool PrintProperties(std::ostream& os);  // NOLINT
@@ -2650,7 +2497,7 @@ class JSObject: public JSReceiver {
     int number_of_slow_unused_elements_;
   };
 
-  void IncrementSpillStatistics(SpillInformation* info);
+  void IncrementSpillStatistics(Isolate* isolate, SpillInformation* info);
 #endif
 
 #ifdef VERIFY_HEAP
@@ -2964,45 +2811,21 @@ class PrototypeInfo : public Struct {
   static const int kPrototypeUsersOffset = kWeakCellOffset + kPointerSize;
   static const int kRegistrySlotOffset = kPrototypeUsersOffset + kPointerSize;
   static const int kValidityCellOffset = kRegistrySlotOffset + kPointerSize;
-  static const int kObjectCreateMap = kValidityCellOffset + kPointerSize;
-  static const int kBitFieldOffset = kObjectCreateMap + kPointerSize;
+  static const int kObjectCreateMapOffset = kValidityCellOffset + kPointerSize;
+  static const int kBitFieldOffset = kObjectCreateMapOffset + kPointerSize;
   static const int kSize = kBitFieldOffset + kPointerSize;
 
   // Bit field usage.
   static const int kShouldBeFastBit = 0;
 
+  class BodyDescriptor;
+
  private:
-  DECL_ACCESSORS(object_create_map, Object)
+  DECL_ACCESSORS(object_create_map, MaybeObject)
 
   DISALLOW_IMPLICIT_CONSTRUCTORS(PrototypeInfo);
 };
 
-// Pair used to store both a ScopeInfo and an extension object in the extension
-// slot of a block, catch, or with context. Needed in the rare case where a
-// declaration block scope (a "varblock" as used to desugar parameter
-// destructuring) also contains a sloppy direct eval, or for with and catch
-// scopes. (In no other case both are needed at the same time.)
-class ContextExtension : public Struct {
- public:
-  // [scope_info]: Scope info.
-  DECL_ACCESSORS(scope_info, ScopeInfo)
-  // [extension]: Extension object.
-  DECL_ACCESSORS(extension, Object)
-
-  DECL_CAST(ContextExtension)
-
-  // Dispatched behavior.
-  DECL_PRINTER(ContextExtension)
-  DECL_VERIFIER(ContextExtension)
-
-  static const int kScopeInfoOffset = HeapObject::kHeaderSize;
-  static const int kExtensionOffset = kScopeInfoOffset + kPointerSize;
-  static const int kSize = kExtensionOffset + kPointerSize;
-
- private:
-  DISALLOW_IMPLICIT_CONSTRUCTORS(ContextExtension);
-};
-
 // List of builtin functions we want to identify to improve code
 // generation.
 //
@@ -3161,9 +2984,6 @@ enum BuiltinFunctionId {
   FUNCTIONS_WITH_ID_LIST(DECL_FUNCTION_ID)
       ATOMIC_FUNCTIONS_WITH_ID_LIST(DECL_FUNCTION_ID)
 #undef DECL_FUNCTION_ID
-  // Fake id for a special case of Math.pow. Note, it continues the
-  // list of math functions.
-  kMathPowHalf,
   // These are manually assigned to special getters during bootstrapping.
   kArrayBufferByteLength,
   kArrayBufferIsView,
@@ -3242,12 +3062,13 @@ class JSGeneratorObject: public JSObject {
   // is suspended.
   int source_position() const;
 
-  // [register_file]: Saved interpreter register file.
-  DECL_ACCESSORS(register_file, FixedArray)
+  // [parameters_and_registers]: Saved interpreter register file.
+  DECL_ACCESSORS(parameters_and_registers, FixedArray)
 
   DECL_CAST(JSGeneratorObject)
 
   // Dispatched behavior.
+  DECL_PRINTER_WITH_ISOLATE(JSGeneratorObject)
   DECL_VERIFIER(JSGeneratorObject)
 
   // Magic sentinel values for the continuation.
@@ -3261,8 +3082,9 @@ class JSGeneratorObject: public JSObject {
   static const int kInputOrDebugPosOffset = kReceiverOffset + kPointerSize;
   static const int kResumeModeOffset = kInputOrDebugPosOffset + kPointerSize;
   static const int kContinuationOffset = kResumeModeOffset + kPointerSize;
-  static const int kRegisterFileOffset = kContinuationOffset + kPointerSize;
-  static const int kSize = kRegisterFileOffset + kPointerSize;
+  static const int kParametersAndRegistersOffset =
+      kContinuationOffset + kPointerSize;
+  static const int kSize = kParametersAndRegistersOffset + kPointerSize;
 
  private:
   DISALLOW_IMPLICIT_CONSTRUCTORS(JSGeneratorObject);
@@ -3318,7 +3140,7 @@ class JSBoundFunction : public JSObject {
   DECL_CAST(JSBoundFunction)
 
   // Dispatched behavior.
-  DECL_PRINTER(JSBoundFunction)
+  DECL_PRINTER_WITH_ISOLATE(JSBoundFunction)
   DECL_VERIFIER(JSBoundFunction)
 
   // The bound function's string representation implemented according
@@ -3489,7 +3311,7 @@ class JSFunction: public JSObject {
   class BodyDescriptor;
 
   // Dispatched behavior.
-  DECL_PRINTER(JSFunction)
+  DECL_PRINTER_WITH_ISOLATE(JSFunction)
   DECL_VERIFIER(JSFunction)
 
   // The function's name if it is configured, otherwise shared function info
@@ -3528,6 +3350,7 @@ class JSFunction: public JSObject {
   V(kSizeWithPrototype, 0)
 
   DEFINE_FIELD_OFFSET_CONSTANTS(JSObject::kHeaderSize, JS_FUNCTION_FIELDS)
+#undef JS_FUNCTION_FIELDS
 
  private:
   DISALLOW_IMPLICIT_CONSTRUCTORS(JSFunction);
@@ -3555,7 +3378,7 @@ class JSGlobalProxy : public JSObject {
   static int SizeWithEmbedderFields(int embedder_field_count);
 
   // Dispatched behavior.
-  DECL_PRINTER(JSGlobalProxy)
+  DECL_PRINTER_WITH_ISOLATE(JSGlobalProxy)
   DECL_VERIFIER(JSGlobalProxy)
 
   // Layout description.
@@ -3592,7 +3415,7 @@ class JSGlobalObject : public JSObject {
   inline bool IsDetached();
 
   // Dispatched behavior.
-  DECL_PRINTER(JSGlobalObject)
+  DECL_PRINTER_WITH_ISOLATE(JSGlobalObject)
   DECL_VERIFIER(JSGlobalObject)
 
   // Layout description.
@@ -3615,7 +3438,7 @@ class JSValue: public JSObject {
   DECL_CAST(JSValue)
 
   // Dispatched behavior.
-  DECL_PRINTER(JSValue)
+  DECL_PRINTER_WITH_ISOLATE(JSValue)
   DECL_VERIFIER(JSValue)
 
   // Layout description.
@@ -3670,7 +3493,7 @@ class JSDate: public JSObject {
   void SetValue(Object* value, bool is_value_nan);
 
   // Dispatched behavior.
-  DECL_PRINTER(JSDate)
+  DECL_PRINTER_WITH_ISOLATE(JSDate)
   DECL_VERIFIER(JSDate)
 
   // The order is important. It must be kept in sync with date macros
@@ -3743,7 +3566,7 @@ class JSMessageObject: public JSObject {
   DECL_ACCESSORS(argument, Object)
 
   // [script]: the script from which the error message originated.
-  DECL_ACCESSORS(script, Object)
+  DECL_ACCESSORS(script, Script)
 
   // [stack_frames]: an array of stack frames for this error object.
   DECL_ACCESSORS(stack_frames, Object)
@@ -3773,7 +3596,7 @@ class JSMessageObject: public JSObject {
   DECL_CAST(JSMessageObject)
 
   // Dispatched behavior.
-  DECL_PRINTER(JSMessageObject)
+  DECL_PRINTER_WITH_ISOLATE(JSMessageObject)
   DECL_VERIFIER(JSMessageObject)
 
   // Layout description.
@@ -3793,7 +3616,7 @@ class JSMessageObject: public JSObject {
   typedef BodyDescriptor BodyDescriptorWeak;
 };
 
-class AllocationSite: public Struct {
+class AllocationSite : public Struct, public NeverReadOnlySpaceObject {
  public:
   static const uint32_t kMaximumArrayBytesToPretransition = 8 * 1024;
   static const double kPretenureRatio;
@@ -3809,6 +3632,11 @@ class AllocationSite: public Struct {
     kLastPretenureDecisionValue = kZombie
   };
 
+  // Use the mixin methods over the HeapObject methods.
+  // TODO(v8:7786) Remove once the HeapObject methods are gone.
+  using NeverReadOnlySpaceObject::GetHeap;
+  using NeverReadOnlySpaceObject::GetIsolate;
+
   const char* PretenureDecisionName(PretenureDecision decision);
 
   // Contains either a Smi-encoded bitfield or a boilerplate. If it's a Smi the
@@ -3823,9 +3651,9 @@ class AllocationSite: public Struct {
   DECL_ACCESSORS(nested_site, Object)
 
   // Bitfield containing pretenuring information.
-  DECL_INT_ACCESSORS(pretenure_data)
+  DECL_INT32_ACCESSORS(pretenure_data)
 
-  DECL_INT_ACCESSORS(pretenure_create_count)
+  DECL_INT32_ACCESSORS(pretenure_create_count)
   DECL_ACCESSORS(dependent_code, DependentCode)
 
   // heap->allocation_site_list() points to the last AllocationSite which form
@@ -3835,6 +3663,9 @@ class AllocationSite: public Struct {
 
   inline void Initialize();
 
+  // Checks if the allocation site contain weak_next field;
+  inline bool HasWeakNext() const;
+
   // This method is expensive, it should only be called for reporting.
   bool IsNested();
 
@@ -3908,31 +3739,36 @@ class AllocationSite: public Struct {
   static bool ShouldTrack(ElementsKind from, ElementsKind to);
   static inline bool CanTrack(InstanceType type);
 
-  static const int kTransitionInfoOrBoilerplateOffset = HeapObject::kHeaderSize;
-  static const int kNestedSiteOffset =
-      kTransitionInfoOrBoilerplateOffset + kPointerSize;
-  static const int kPretenureDataOffset = kNestedSiteOffset + kPointerSize;
-  static const int kPretenureCreateCountOffset =
-      kPretenureDataOffset + kPointerSize;
-  static const int kDependentCodeOffset =
-      kPretenureCreateCountOffset + kPointerSize;
-  static const int kWeakNextOffset = kDependentCodeOffset + kPointerSize;
-  static const int kSize = kWeakNextOffset + kPointerSize;
-
-  // During mark compact we need to take special care for the dependent code
-  // field.
-  static const int kPointerFieldsBeginOffset =
-      kTransitionInfoOrBoilerplateOffset;
-  static const int kPointerFieldsEndOffset = kWeakNextOffset;
-
-  // Ignores weakness.
-  typedef FixedBodyDescriptor<HeapObject::kHeaderSize, kSize, kSize>
-      BodyDescriptor;
-
-  // Respects weakness.
-  typedef FixedBodyDescriptor<kPointerFieldsBeginOffset,
-                              kPointerFieldsEndOffset, kSize>
-      BodyDescriptorWeak;
+// Layout description.
+// AllocationSite has to start with TransitionInfoOrboilerPlateOffset
+// and end with WeakNext field.
+#define ALLOCATION_SITE_FIELDS(V)                     \
+  V(kTransitionInfoOrBoilerplateOffset, kPointerSize) \
+  V(kNestedSiteOffset, kPointerSize)                  \
+  V(kDependentCodeOffset, kPointerSize)               \
+  V(kCommonPointerFieldEndOffset, 0)                  \
+  V(kPretenureDataOffset, kInt32Size)                 \
+  V(kPretenureCreateCountOffset, kInt32Size)          \
+  /* Size of AllocationSite without WeakNext field */ \
+  V(kSizeWithoutWeakNext, 0)                          \
+  V(kWeakNextOffset, kPointerSize)                    \
+  /* Size of AllocationSite with WeakNext field */    \
+  V(kSizeWithWeakNext, 0)
+
+  DEFINE_FIELD_OFFSET_CONSTANTS(HeapObject::kHeaderSize, ALLOCATION_SITE_FIELDS)
+
+  static const int kStartOffset = HeapObject::kHeaderSize;
+
+  template <bool includeWeakNext>
+  class BodyDescriptorImpl;
+
+  // BodyDescriptor is used to traverse all the pointer fields including
+  // weak_next
+  typedef BodyDescriptorImpl<true> BodyDescriptor;
+
+  // BodyDescriptorWeak is used to traverse all the pointer fields
+  // except for weak_next
+  typedef BodyDescriptorImpl<false> BodyDescriptorWeak;
 
  private:
   inline bool PretenuringDecisionMade() const;
@@ -4040,6 +3876,7 @@ class Oddball: public HeapObject {
   static const byte kException = 8;
   static const byte kOptimizedOut = 9;
   static const byte kStaleRegister = 10;
+  static const byte kSelfReferenceMarker = 10;
 
   typedef FixedBodyDescriptor<kToStringOffset, kTypeOfOffset + kPointerSize,
                               kSize> BodyDescriptor;
@@ -4103,7 +3940,7 @@ class FeedbackCell : public Struct {
   DECL_CAST(FeedbackCell)
 
   // Dispatched behavior.
-  DECL_PRINTER(FeedbackCell)
+  DECL_PRINTER_WITH_ISOLATE(FeedbackCell)
   DECL_VERIFIER(FeedbackCell)
 
   static const int kValueOffset = HeapObject::kHeaderSize;
@@ -4137,20 +3974,22 @@ class PropertyCell : public HeapObject {
 
   // Computes the new type of the cell's contents for the given value, but
   // without actually modifying the details.
-  static PropertyCellType UpdatedType(Handle<PropertyCell> cell,
+  static PropertyCellType UpdatedType(Isolate* isolate,
+                                      Handle<PropertyCell> cell,
                                       Handle<Object> value,
                                       PropertyDetails details);
   // Prepares property cell at given entry for receiving given value.
   // As a result the old cell could be invalidated and/or dependent code could
   // be deoptimized. Returns the prepared property cell.
   static Handle<PropertyCell> PrepareForValue(
-      Handle<GlobalDictionary> dictionary, int entry, Handle<Object> value,
-      PropertyDetails details);
+      Isolate* isolate, Handle<GlobalDictionary> dictionary, int entry,
+      Handle<Object> value, PropertyDetails details);
 
   static Handle<PropertyCell> InvalidateEntry(
-      Handle<GlobalDictionary> dictionary, int entry);
+      Isolate* isolate, Handle<GlobalDictionary> dictionary, int entry);
 
-  static void SetValueWithInvalidation(Handle<PropertyCell> cell,
+  static void SetValueWithInvalidation(Isolate* isolate,
+                                       Handle<PropertyCell> cell,
                                        Handle<Object> new_value);
 
   DECL_CAST(PropertyCell)
@@ -4219,7 +4058,7 @@ class JSProxy: public JSReceiver {
 
   DECL_CAST(JSProxy)
 
-  INLINE(bool IsRevoked() const);
+  V8_INLINE bool IsRevoked() const;
   static void Revoke(Handle<JSProxy> proxy);
 
   // ES6 9.5.1
@@ -4426,100 +4265,6 @@ class Foreign: public HeapObject {
   DISALLOW_IMPLICIT_CONSTRUCTORS(Foreign);
 };
 
-// An accessor must have a getter, but can have no setter.
-//
-// When setting a property, V8 searches accessors in prototypes.
-// If an accessor was found and it does not have a setter,
-// the request is ignored.
-//
-// If the accessor in the prototype has the READ_ONLY property attribute, then
-// a new value is added to the derived object when the property is set.
-// This shadows the accessor in the prototype.
-class AccessorInfo: public Struct {
- public:
-  DECL_ACCESSORS(name, Name)
-  DECL_INT_ACCESSORS(flags)
-  DECL_ACCESSORS(expected_receiver_type, Object)
-  // This directly points at a foreign C function to be used from the runtime.
-  DECL_ACCESSORS(getter, Object)
-  inline bool has_getter();
-  DECL_ACCESSORS(setter, Object)
-  inline bool has_setter();
-  // This either points at the same as above, or a trampoline in case we are
-  // running with the simulator. Use these entries from generated code.
-  DECL_ACCESSORS(js_getter, Object)
-  DECL_ACCESSORS(data, Object)
-
-  static Address redirect(Isolate* isolate, Address address,
-                          AccessorComponent component);
-  Address redirected_getter() const;
-
-  // Dispatched behavior.
-  DECL_PRINTER(AccessorInfo)
-
-  DECL_BOOLEAN_ACCESSORS(all_can_read)
-  DECL_BOOLEAN_ACCESSORS(all_can_write)
-  DECL_BOOLEAN_ACCESSORS(is_special_data_property)
-  DECL_BOOLEAN_ACCESSORS(replace_on_access)
-  DECL_BOOLEAN_ACCESSORS(is_sloppy)
-  DECL_BOOLEAN_ACCESSORS(has_no_side_effect)
-
-  // The property attributes used when an API object template is instantiated
-  // for the first time. Changing of this value afterwards does not affect
-  // the actual attributes of a property.
-  inline PropertyAttributes initial_property_attributes() const;
-  inline void set_initial_property_attributes(PropertyAttributes attributes);
-
-  // Checks whether the given receiver is compatible with this accessor.
-  static bool IsCompatibleReceiverMap(Isolate* isolate,
-                                      Handle<AccessorInfo> info,
-                                      Handle<Map> map);
-  inline bool IsCompatibleReceiver(Object* receiver);
-
-  DECL_CAST(AccessorInfo)
-
-  // Dispatched behavior.
-  DECL_VERIFIER(AccessorInfo)
-
-  // Append all descriptors to the array that are not already there.
-  // Return number added.
-  static int AppendUnique(Handle<Object> descriptors,
-                          Handle<FixedArray> array,
-                          int valid_descriptors);
-
-// Layout description.
-#define ACCESSOR_INFO_FIELDS(V)                \
-  V(kNameOffset, kPointerSize)                 \
-  V(kFlagsOffset, kPointerSize)                \
-  V(kExpectedReceiverTypeOffset, kPointerSize) \
-  V(kSetterOffset, kPointerSize)               \
-  V(kGetterOffset, kPointerSize)               \
-  V(kJsGetterOffset, kPointerSize)             \
-  V(kDataOffset, kPointerSize)                 \
-  V(kSize, 0)
-
-  DEFINE_FIELD_OFFSET_CONSTANTS(HeapObject::kHeaderSize, ACCESSOR_INFO_FIELDS)
-#undef ACCESSOR_INFO_FIELDS
-
- private:
-  inline bool HasExpectedReceiverType();
-
-// Bit positions in |flags|.
-#define ACCESSOR_INFO_FLAGS_BIT_FIELDS(V, _) \
-  V(AllCanReadBit, bool, 1, _)               \
-  V(AllCanWriteBit, bool, 1, _)              \
-  V(IsSpecialDataPropertyBit, bool, 1, _)    \
-  V(IsSloppyBit, bool, 1, _)                 \
-  V(ReplaceOnAccessBit, bool, 1, _)          \
-  V(HasNoSideEffectBit, bool, 1, _)          \
-  V(InitialAttributesBits, PropertyAttributes, 3, _)
-
-  DEFINE_BIT_FIELDS(ACCESSOR_INFO_FLAGS_BIT_FIELDS)
-#undef ACCESSOR_INFO_FLAGS_BIT_FIELDS
-
-  DISALLOW_IMPLICIT_CONSTRUCTORS(AccessorInfo);
-};
-
 // Support for JavaScript accessors: A pair of a getter and a setter. Each
 // accessor can either be
 //   * a JavaScript function or proxy: a real accessor
@@ -4569,309 +4314,6 @@ class AccessorPair: public Struct {
   DISALLOW_IMPLICIT_CONSTRUCTORS(AccessorPair);
 };
 
-
-class AccessCheckInfo: public Struct {
- public:
-  DECL_ACCESSORS(callback, Object)
-  DECL_ACCESSORS(named_interceptor, Object)
-  DECL_ACCESSORS(indexed_interceptor, Object)
-  DECL_ACCESSORS(data, Object)
-
-  DECL_CAST(AccessCheckInfo)
-
-  // Dispatched behavior.
-  DECL_PRINTER(AccessCheckInfo)
-  DECL_VERIFIER(AccessCheckInfo)
-
-  static AccessCheckInfo* Get(Isolate* isolate, Handle<JSObject> receiver);
-
-  static const int kCallbackOffset = HeapObject::kHeaderSize;
-  static const int kNamedInterceptorOffset = kCallbackOffset + kPointerSize;
-  static const int kIndexedInterceptorOffset =
-      kNamedInterceptorOffset + kPointerSize;
-  static const int kDataOffset = kIndexedInterceptorOffset + kPointerSize;
-  static const int kSize = kDataOffset + kPointerSize;
-
- private:
-  DISALLOW_IMPLICIT_CONSTRUCTORS(AccessCheckInfo);
-};
-
-
-class InterceptorInfo: public Struct {
- public:
-  DECL_ACCESSORS(getter, Object)
-  DECL_ACCESSORS(setter, Object)
-  DECL_ACCESSORS(query, Object)
-  DECL_ACCESSORS(descriptor, Object)
-  DECL_ACCESSORS(deleter, Object)
-  DECL_ACCESSORS(enumerator, Object)
-  DECL_ACCESSORS(definer, Object)
-  DECL_ACCESSORS(data, Object)
-  DECL_BOOLEAN_ACCESSORS(can_intercept_symbols)
-  DECL_BOOLEAN_ACCESSORS(all_can_read)
-  DECL_BOOLEAN_ACCESSORS(non_masking)
-  DECL_BOOLEAN_ACCESSORS(is_named)
-  DECL_BOOLEAN_ACCESSORS(has_no_side_effect)
-
-  inline int flags() const;
-  inline void set_flags(int flags);
-
-  DECL_CAST(InterceptorInfo)
-
-  // Dispatched behavior.
-  DECL_PRINTER(InterceptorInfo)
-  DECL_VERIFIER(InterceptorInfo)
-
-  static const int kGetterOffset = HeapObject::kHeaderSize;
-  static const int kSetterOffset = kGetterOffset + kPointerSize;
-  static const int kQueryOffset = kSetterOffset + kPointerSize;
-  static const int kDescriptorOffset = kQueryOffset + kPointerSize;
-  static const int kDeleterOffset = kDescriptorOffset + kPointerSize;
-  static const int kEnumeratorOffset = kDeleterOffset + kPointerSize;
-  static const int kDefinerOffset = kEnumeratorOffset + kPointerSize;
-  static const int kDataOffset = kDefinerOffset + kPointerSize;
-  static const int kFlagsOffset = kDataOffset + kPointerSize;
-  static const int kSize = kFlagsOffset + kPointerSize;
-
-  static const int kCanInterceptSymbolsBit = 0;
-  static const int kAllCanReadBit = 1;
-  static const int kNonMasking = 2;
-  static const int kNamed = 3;
-  static const int kHasNoSideEffect = 4;
-
- private:
-  DISALLOW_IMPLICIT_CONSTRUCTORS(InterceptorInfo);
-};
-
-class CallHandlerInfo : public Tuple3 {
- public:
-  DECL_ACCESSORS(callback, Object)
-  DECL_ACCESSORS(js_callback, Object)
-  DECL_ACCESSORS(data, Object)
-
-  DECL_CAST(CallHandlerInfo)
-
-  inline bool IsSideEffectFreeCallHandlerInfo() const;
-
-  // Dispatched behavior.
-  DECL_PRINTER(CallHandlerInfo)
-  DECL_VERIFIER(CallHandlerInfo)
-
-  Address redirected_callback() const;
-
-  static const int kCallbackOffset = kValue1Offset;
-  static const int kJsCallbackOffset = kValue2Offset;
-  static const int kDataOffset = kValue3Offset;
-
- private:
-  DISALLOW_IMPLICIT_CONSTRUCTORS(CallHandlerInfo);
-};
-
-
-class TemplateInfo: public Struct {
- public:
-  DECL_ACCESSORS(tag, Object)
-  DECL_ACCESSORS(serial_number, Object)
-  DECL_INT_ACCESSORS(number_of_properties)
-  DECL_ACCESSORS(property_list, Object)
-  DECL_ACCESSORS(property_accessors, Object)
-
-  DECL_VERIFIER(TemplateInfo)
-
-  DECL_CAST(TemplateInfo)
-
-  static const int kTagOffset = HeapObject::kHeaderSize;
-  static const int kSerialNumberOffset = kTagOffset + kPointerSize;
-  static const int kNumberOfProperties = kSerialNumberOffset + kPointerSize;
-  static const int kPropertyListOffset = kNumberOfProperties + kPointerSize;
-  static const int kPropertyAccessorsOffset =
-      kPropertyListOffset + kPointerSize;
-  static const int kHeaderSize = kPropertyAccessorsOffset + kPointerSize;
-
-  static const int kFastTemplateInstantiationsCacheSize = 1 * KB;
-
-  // While we could grow the slow cache until we run out of memory, we put
-  // a limit on it anyway to not crash for embedders that re-create templates
-  // instead of caching them.
-  static const int kSlowTemplateInstantiationsCacheSize = 1 * MB;
-
- private:
-  DISALLOW_IMPLICIT_CONSTRUCTORS(TemplateInfo);
-};
-
-// See the api-exposed FunctionTemplate for more information.
-class FunctionTemplateInfo: public TemplateInfo {
- public:
-  // Handler invoked when calling an instance of this FunctionTemplateInfo.
-  // Either CallInfoHandler or Undefined.
-  DECL_ACCESSORS(call_code, Object)
-
-  // ObjectTemplateInfo or Undefined, used for the prototype property of the
-  // resulting JSFunction instance of this FunctionTemplate.
-  DECL_ACCESSORS(prototype_template, Object)
-
-  // In the case the prototype_template is Undefined we use the
-  // protoype_provider_template to retrieve the instance prototype. Either
-  // contains an ObjectTemplateInfo or Undefined.
-  DECL_ACCESSORS(prototype_provider_template, Object)
-
-  // Used to create protoype chains. The parent_template's prototype is set as
-  // __proto__ of this FunctionTemplate's instance prototype. Is either a
-  // FunctionTemplateInfo or Undefined.
-  DECL_ACCESSORS(parent_template, Object)
-
-  // Returns an InterceptorInfo or Undefined for named properties.
-  DECL_ACCESSORS(named_property_handler, Object)
-  // Returns an InterceptorInfo or Undefined for indexed properties/elements.
-  DECL_ACCESSORS(indexed_property_handler, Object)
-
-  // An ObjectTemplateInfo that is used when instantiating the JSFunction
-  // associated with this FunctionTemplateInfo. Contains either an
-  // ObjectTemplateInfo or Undefined. A default instance_template is assigned
-  // upon first instantiation if it's Undefined.
-  DECL_ACCESSORS(instance_template, Object)
-
-  DECL_ACCESSORS(class_name, Object)
-
-  // If the signature is a FunctionTemplateInfo it is used to check whether the
-  // receiver calling the associated JSFunction is a compatible receiver, i.e.
-  // it is an instance of the signare FunctionTemplateInfo or any of the
-  // receiver's prototypes are.
-  DECL_ACCESSORS(signature, Object)
-
-  // Either a CallHandlerInfo or Undefined. If an instance_call_handler is
-  // provided the instances created from the associated JSFunction are marked as
-  // callable.
-  DECL_ACCESSORS(instance_call_handler, Object)
-
-  DECL_ACCESSORS(access_check_info, Object)
-  DECL_ACCESSORS(shared_function_info, Object)
-
-  // Internal field to store a flag bitfield.
-  DECL_INT_ACCESSORS(flag)
-
-  // "length" property of the final JSFunction.
-  DECL_INT_ACCESSORS(length)
-
-  // Either the_hole or a private symbol. Used to cache the result on
-  // the receiver under the the cached_property_name when this
-  // FunctionTemplateInfo is used as a getter.
-  DECL_ACCESSORS(cached_property_name, Object)
-
-  // Begin flag bits ---------------------
-  DECL_BOOLEAN_ACCESSORS(hidden_prototype)
-  DECL_BOOLEAN_ACCESSORS(undetectable)
-
-  // If set, object instances created by this function
-  // requires access check.
-  DECL_BOOLEAN_ACCESSORS(needs_access_check)
-
-  DECL_BOOLEAN_ACCESSORS(read_only_prototype)
-
-  // If set, do not create a prototype property for the associated
-  // JSFunction. This bit implies that neither the prototype_template nor the
-  // prototype_provoider_template are instantiated.
-  DECL_BOOLEAN_ACCESSORS(remove_prototype)
-
-  // If set, do not attach a serial number to this FunctionTemplate and thus do
-  // not keep an instance boilerplate around.
-  DECL_BOOLEAN_ACCESSORS(do_not_cache)
-
-  // If not set an access may be performed on calling the associated JSFunction.
-  DECL_BOOLEAN_ACCESSORS(accept_any_receiver)
-  // End flag bits ---------------------
-
-  DECL_CAST(FunctionTemplateInfo)
-
-  // Dispatched behavior.
-  DECL_PRINTER(FunctionTemplateInfo)
-  DECL_VERIFIER(FunctionTemplateInfo)
-
-  static const int kInvalidSerialNumber = 0;
-
-  static const int kCallCodeOffset = TemplateInfo::kHeaderSize;
-  static const int kPrototypeTemplateOffset =
-      kCallCodeOffset + kPointerSize;
-  static const int kPrototypeProviderTemplateOffset =
-      kPrototypeTemplateOffset + kPointerSize;
-  static const int kParentTemplateOffset =
-      kPrototypeProviderTemplateOffset + kPointerSize;
-  static const int kNamedPropertyHandlerOffset =
-      kParentTemplateOffset + kPointerSize;
-  static const int kIndexedPropertyHandlerOffset =
-      kNamedPropertyHandlerOffset + kPointerSize;
-  static const int kInstanceTemplateOffset =
-      kIndexedPropertyHandlerOffset + kPointerSize;
-  static const int kClassNameOffset = kInstanceTemplateOffset + kPointerSize;
-  static const int kSignatureOffset = kClassNameOffset + kPointerSize;
-  static const int kInstanceCallHandlerOffset = kSignatureOffset + kPointerSize;
-  static const int kAccessCheckInfoOffset =
-      kInstanceCallHandlerOffset + kPointerSize;
-  static const int kSharedFunctionInfoOffset =
-      kAccessCheckInfoOffset + kPointerSize;
-  static const int kFlagOffset = kSharedFunctionInfoOffset + kPointerSize;
-  static const int kLengthOffset = kFlagOffset + kPointerSize;
-  static const int kCachedPropertyNameOffset = kLengthOffset + kPointerSize;
-  static const int kSize = kCachedPropertyNameOffset + kPointerSize;
-
-  static Handle<SharedFunctionInfo> GetOrCreateSharedFunctionInfo(
-      Isolate* isolate, Handle<FunctionTemplateInfo> info,
-      MaybeHandle<Name> maybe_name);
-  // Returns parent function template or null.
-  inline FunctionTemplateInfo* GetParent(Isolate* isolate);
-  // Returns true if |object| is an instance of this function template.
-  inline bool IsTemplateFor(JSObject* object);
-  bool IsTemplateFor(Map* map);
-  inline bool instantiated();
-
-  inline bool BreakAtEntry();
-
-  // Helper function for cached accessors.
-  static MaybeHandle<Name> TryGetCachedPropertyName(Isolate* isolate,
-                                                    Handle<Object> getter);
-
- private:
-  // Bit position in the flag, from least significant bit position.
-  static const int kHiddenPrototypeBit   = 0;
-  static const int kUndetectableBit      = 1;
-  static const int kNeedsAccessCheckBit  = 2;
-  static const int kReadOnlyPrototypeBit = 3;
-  static const int kRemovePrototypeBit   = 4;
-  static const int kDoNotCacheBit        = 5;
-  static const int kAcceptAnyReceiver = 6;
-
-  DISALLOW_IMPLICIT_CONSTRUCTORS(FunctionTemplateInfo);
-};
-
-
-class ObjectTemplateInfo: public TemplateInfo {
- public:
-  DECL_ACCESSORS(constructor, Object)
-  DECL_ACCESSORS(data, Object)
-  DECL_INT_ACCESSORS(embedder_field_count)
-  DECL_BOOLEAN_ACCESSORS(immutable_proto)
-
-  DECL_CAST(ObjectTemplateInfo)
-
-  // Dispatched behavior.
-  DECL_PRINTER(ObjectTemplateInfo)
-  DECL_VERIFIER(ObjectTemplateInfo)
-
-  static const int kConstructorOffset = TemplateInfo::kHeaderSize;
-  // LSB is for immutable_proto, higher bits for embedder_field_count
-  static const int kDataOffset = kConstructorOffset + kPointerSize;
-  static const int kSize = kDataOffset + kPointerSize;
-
-  // Starting from given object template's constructor walk up the inheritance
-  // chain till a function template that has an instance template is found.
-  inline ObjectTemplateInfo* GetParent(Isolate* isolate);
-
- private:
-  class IsImmutablePrototype : public BitField<bool, 0, 1> {};
-  class EmbedderFieldCount
-      : public BitField<int, IsImmutablePrototype::kNext, 29> {};
-};
-
 class StackFrameInfo : public Struct {
  public:
   DECL_INT_ACCESSORS(line_number)
diff --git a/deps/v8/src/objects/api-callbacks-inl.h b/deps/v8/src/objects/api-callbacks-inl.h
new file mode 100644
index 00000000000000..4f7680d8edb71d
--- /dev/null
+++ b/deps/v8/src/objects/api-callbacks-inl.h
@@ -0,0 +1,139 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef V8_OBJECTS_API_CALLBACKS_INL_H_
+#define V8_OBJECTS_API_CALLBACKS_INL_H_
+
+#include "src/objects/api-callbacks.h"
+
+#include "src/heap/heap-inl.h"
+#include "src/objects/name.h"
+#include "src/objects/templates.h"
+
+// Has to be the last include (doesn't have include guards):
+#include "src/objects/object-macros.h"
+
+namespace v8 {
+namespace internal {
+
+CAST_ACCESSOR(AccessorInfo)
+CAST_ACCESSOR(AccessCheckInfo)
+CAST_ACCESSOR(InterceptorInfo)
+CAST_ACCESSOR(CallHandlerInfo)
+
+ACCESSORS(AccessorInfo, name, Name, kNameOffset)
+SMI_ACCESSORS(AccessorInfo, flags, kFlagsOffset)
+ACCESSORS(AccessorInfo, expected_receiver_type, Object,
+          kExpectedReceiverTypeOffset)
+
+ACCESSORS_CHECKED2(AccessorInfo, getter, Object, kGetterOffset, true,
+                   Foreign::IsNormalized(value))
+ACCESSORS_CHECKED2(AccessorInfo, setter, Object, kSetterOffset, true,
+                   Foreign::IsNormalized(value));
+ACCESSORS(AccessorInfo, js_getter, Object, kJsGetterOffset)
+ACCESSORS(AccessorInfo, data, Object, kDataOffset)
+
+bool AccessorInfo::has_getter() {
+  bool result = getter() != Smi::kZero;
+  DCHECK_EQ(result,
+            getter() != Smi::kZero &&
+                Foreign::cast(getter())->foreign_address() != kNullAddress);
+  return result;
+}
+
+bool AccessorInfo::has_setter() {
+  bool result = setter() != Smi::kZero;
+  DCHECK_EQ(result,
+            setter() != Smi::kZero &&
+                Foreign::cast(setter())->foreign_address() != kNullAddress);
+  return result;
+}
+
+BIT_FIELD_ACCESSORS(AccessorInfo, flags, all_can_read,
+                    AccessorInfo::AllCanReadBit)
+BIT_FIELD_ACCESSORS(AccessorInfo, flags, all_can_write,
+                    AccessorInfo::AllCanWriteBit)
+BIT_FIELD_ACCESSORS(AccessorInfo, flags, is_special_data_property,
+                    AccessorInfo::IsSpecialDataPropertyBit)
+BIT_FIELD_ACCESSORS(AccessorInfo, flags, replace_on_access,
+                    AccessorInfo::ReplaceOnAccessBit)
+BIT_FIELD_ACCESSORS(AccessorInfo, flags, is_sloppy, AccessorInfo::IsSloppyBit)
+BIT_FIELD_ACCESSORS(AccessorInfo, flags, has_no_side_effect,
+                    AccessorInfo::HasNoSideEffectBit)
+BIT_FIELD_ACCESSORS(AccessorInfo, flags, initial_property_attributes,
+                    AccessorInfo::InitialAttributesBits)
+
+bool AccessorInfo::IsCompatibleReceiver(Object* receiver) {
+  if (!HasExpectedReceiverType()) return true;
+  if (!receiver->IsJSObject()) return false;
+  return FunctionTemplateInfo::cast(expected_receiver_type())
+      ->IsTemplateFor(JSObject::cast(receiver)->map());
+}
+
+bool AccessorInfo::HasExpectedReceiverType() {
+  return expected_receiver_type()->IsFunctionTemplateInfo();
+}
+
+ACCESSORS(AccessCheckInfo, callback, Object, kCallbackOffset)
+ACCESSORS(AccessCheckInfo, named_interceptor, Object, kNamedInterceptorOffset)
+ACCESSORS(AccessCheckInfo, indexed_interceptor, Object,
+          kIndexedInterceptorOffset)
+ACCESSORS(AccessCheckInfo, data, Object, kDataOffset)
+
+ACCESSORS(InterceptorInfo, getter, Object, kGetterOffset)
+ACCESSORS(InterceptorInfo, setter, Object, kSetterOffset)
+ACCESSORS(InterceptorInfo, query, Object, kQueryOffset)
+ACCESSORS(InterceptorInfo, descriptor, Object, kDescriptorOffset)
+ACCESSORS(InterceptorInfo, deleter, Object, kDeleterOffset)
+ACCESSORS(InterceptorInfo, enumerator, Object, kEnumeratorOffset)
+ACCESSORS(InterceptorInfo, definer, Object, kDefinerOffset)
+ACCESSORS(InterceptorInfo, data, Object, kDataOffset)
+SMI_ACCESSORS(InterceptorInfo, flags, kFlagsOffset)
+BOOL_ACCESSORS(InterceptorInfo, flags, can_intercept_symbols,
+               kCanInterceptSymbolsBit)
+BOOL_ACCESSORS(InterceptorInfo, flags, all_can_read, kAllCanReadBit)
+BOOL_ACCESSORS(InterceptorInfo, flags, non_masking, kNonMasking)
+BOOL_ACCESSORS(InterceptorInfo, flags, is_named, kNamed)
+BOOL_ACCESSORS(InterceptorInfo, flags, has_no_side_effect, kHasNoSideEffect)
+
+ACCESSORS(CallHandlerInfo, callback, Object, kCallbackOffset)
+ACCESSORS(CallHandlerInfo, js_callback, Object, kJsCallbackOffset)
+ACCESSORS(CallHandlerInfo, data, Object, kDataOffset)
+
+bool CallHandlerInfo::IsSideEffectFreeCallHandlerInfo() const {
+  ReadOnlyRoots roots = GetReadOnlyRoots();
+  DCHECK(map() == roots.side_effect_call_handler_info_map() ||
+         map() == roots.side_effect_free_call_handler_info_map() ||
+         map() == roots.next_call_side_effect_free_call_handler_info_map());
+  return map() == roots.side_effect_free_call_handler_info_map();
+}
+
+bool CallHandlerInfo::IsSideEffectCallHandlerInfo() const {
+  ReadOnlyRoots roots = GetReadOnlyRoots();
+  DCHECK(map() == roots.side_effect_call_handler_info_map() ||
+         map() == roots.side_effect_free_call_handler_info_map() ||
+         map() == roots.next_call_side_effect_free_call_handler_info_map());
+  return map() == roots.side_effect_call_handler_info_map();
+}
+
+void CallHandlerInfo::SetNextCallHasNoSideEffect() {
+  set_map(
+      GetReadOnlyRoots().next_call_side_effect_free_call_handler_info_map());
+}
+
+bool CallHandlerInfo::NextCallHasNoSideEffect() {
+  ReadOnlyRoots roots = GetReadOnlyRoots();
+  if (map() == roots.next_call_side_effect_free_call_handler_info_map()) {
+    set_map(roots.side_effect_call_handler_info_map());
+    return true;
+  }
+  return false;
+}
+
+}  // namespace internal
+}  // namespace v8
+
+#include "src/objects/object-macros-undef.h"
+
+#endif  // V8_OBJECTS_API_CALLBACKS_INL_H_
diff --git a/deps/v8/src/objects/api-callbacks.h b/deps/v8/src/objects/api-callbacks.h
new file mode 100644
index 00000000000000..46247e9b98f73c
--- /dev/null
+++ b/deps/v8/src/objects/api-callbacks.h
@@ -0,0 +1,215 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef V8_OBJECTS_API_CALLBACKS_H_
+#define V8_OBJECTS_API_CALLBACKS_H_
+
+#include "src/objects.h"
+
+// Has to be the last include (doesn't have include guards):
+#include "src/objects/object-macros.h"
+
+namespace v8 {
+namespace internal {
+
+// An accessor must have a getter, but can have no setter.
+//
+// When setting a property, V8 searches accessors in prototypes.
+// If an accessor was found and it does not have a setter,
+// the request is ignored.
+//
+// If the accessor in the prototype has the READ_ONLY property attribute, then
+// a new value is added to the derived object when the property is set.
+// This shadows the accessor in the prototype.
+class AccessorInfo : public Struct {
+ public:
+  DECL_ACCESSORS(name, Name)
+  DECL_INT_ACCESSORS(flags)
+  DECL_ACCESSORS(expected_receiver_type, Object)
+  // This directly points at a foreign C function to be used from the runtime.
+  DECL_ACCESSORS(getter, Object)
+  inline bool has_getter();
+  DECL_ACCESSORS(setter, Object)
+  inline bool has_setter();
+  // This either points at the same as above, or a trampoline in case we are
+  // running with the simulator. Use these entries from generated code.
+  DECL_ACCESSORS(js_getter, Object)
+  DECL_ACCESSORS(data, Object)
+
+  static Address redirect(Isolate* isolate, Address address,
+                          AccessorComponent component);
+  Address redirected_getter() const;
+
+  // Dispatched behavior.
+  DECL_PRINTER(AccessorInfo)
+
+  DECL_BOOLEAN_ACCESSORS(all_can_read)
+  DECL_BOOLEAN_ACCESSORS(all_can_write)
+  DECL_BOOLEAN_ACCESSORS(is_special_data_property)
+  DECL_BOOLEAN_ACCESSORS(replace_on_access)
+  DECL_BOOLEAN_ACCESSORS(is_sloppy)
+  DECL_BOOLEAN_ACCESSORS(has_no_side_effect)
+
+  // The property attributes used when an API object template is instantiated
+  // for the first time. Changing of this value afterwards does not affect
+  // the actual attributes of a property.
+  inline PropertyAttributes initial_property_attributes() const;
+  inline void set_initial_property_attributes(PropertyAttributes attributes);
+
+  // Checks whether the given receiver is compatible with this accessor.
+  static bool IsCompatibleReceiverMap(Isolate* isolate,
+                                      Handle<AccessorInfo> info,
+                                      Handle<Map> map);
+  inline bool IsCompatibleReceiver(Object* receiver);
+
+  DECL_CAST(AccessorInfo)
+
+  // Dispatched behavior.
+  DECL_VERIFIER(AccessorInfo)
+
+  // Append all descriptors to the array that are not already there.
+  // Return number added.
+  static int AppendUnique(Handle<Object> descriptors, Handle<FixedArray> array,
+                          int valid_descriptors);
+
+// Layout description.
+#define ACCESSOR_INFO_FIELDS(V)                \
+  V(kNameOffset, kPointerSize)                 \
+  V(kFlagsOffset, kPointerSize)                \
+  V(kExpectedReceiverTypeOffset, kPointerSize) \
+  V(kSetterOffset, kPointerSize)               \
+  V(kGetterOffset, kPointerSize)               \
+  V(kJsGetterOffset, kPointerSize)             \
+  V(kDataOffset, kPointerSize)                 \
+  V(kSize, 0)
+
+  DEFINE_FIELD_OFFSET_CONSTANTS(HeapObject::kHeaderSize, ACCESSOR_INFO_FIELDS)
+#undef ACCESSOR_INFO_FIELDS
+
+ private:
+  inline bool HasExpectedReceiverType();
+
+// Bit positions in |flags|.
+#define ACCESSOR_INFO_FLAGS_BIT_FIELDS(V, _) \
+  V(AllCanReadBit, bool, 1, _)               \
+  V(AllCanWriteBit, bool, 1, _)              \
+  V(IsSpecialDataPropertyBit, bool, 1, _)    \
+  V(IsSloppyBit, bool, 1, _)                 \
+  V(ReplaceOnAccessBit, bool, 1, _)          \
+  V(HasNoSideEffectBit, bool, 1, _)          \
+  V(InitialAttributesBits, PropertyAttributes, 3, _)
+
+  DEFINE_BIT_FIELDS(ACCESSOR_INFO_FLAGS_BIT_FIELDS)
+#undef ACCESSOR_INFO_FLAGS_BIT_FIELDS
+
+  DISALLOW_IMPLICIT_CONSTRUCTORS(AccessorInfo);
+};
+
+class AccessCheckInfo : public Struct {
+ public:
+  DECL_ACCESSORS(callback, Object)
+  DECL_ACCESSORS(named_interceptor, Object)
+  DECL_ACCESSORS(indexed_interceptor, Object)
+  DECL_ACCESSORS(data, Object)
+
+  DECL_CAST(AccessCheckInfo)
+
+  // Dispatched behavior.
+  DECL_PRINTER(AccessCheckInfo)
+  DECL_VERIFIER(AccessCheckInfo)
+
+  static AccessCheckInfo* Get(Isolate* isolate, Handle<JSObject> receiver);
+
+  static const int kCallbackOffset = HeapObject::kHeaderSize;
+  static const int kNamedInterceptorOffset = kCallbackOffset + kPointerSize;
+  static const int kIndexedInterceptorOffset =
+      kNamedInterceptorOffset + kPointerSize;
+  static const int kDataOffset = kIndexedInterceptorOffset + kPointerSize;
+  static const int kSize = kDataOffset + kPointerSize;
+
+ private:
+  DISALLOW_IMPLICIT_CONSTRUCTORS(AccessCheckInfo);
+};
+
+class InterceptorInfo : public Struct {
+ public:
+  DECL_ACCESSORS(getter, Object)
+  DECL_ACCESSORS(setter, Object)
+  DECL_ACCESSORS(query, Object)
+  DECL_ACCESSORS(descriptor, Object)
+  DECL_ACCESSORS(deleter, Object)
+  DECL_ACCESSORS(enumerator, Object)
+  DECL_ACCESSORS(definer, Object)
+  DECL_ACCESSORS(data, Object)
+  DECL_BOOLEAN_ACCESSORS(can_intercept_symbols)
+  DECL_BOOLEAN_ACCESSORS(all_can_read)
+  DECL_BOOLEAN_ACCESSORS(non_masking)
+  DECL_BOOLEAN_ACCESSORS(is_named)
+  DECL_BOOLEAN_ACCESSORS(has_no_side_effect)
+
+  inline int flags() const;
+  inline void set_flags(int flags);
+
+  DECL_CAST(InterceptorInfo)
+
+  // Dispatched behavior.
+  DECL_PRINTER(InterceptorInfo)
+  DECL_VERIFIER(InterceptorInfo)
+
+  static const int kGetterOffset = HeapObject::kHeaderSize;
+  static const int kSetterOffset = kGetterOffset + kPointerSize;
+  static const int kQueryOffset = kSetterOffset + kPointerSize;
+  static const int kDescriptorOffset = kQueryOffset + kPointerSize;
+  static const int kDeleterOffset = kDescriptorOffset + kPointerSize;
+  static const int kEnumeratorOffset = kDeleterOffset + kPointerSize;
+  static const int kDefinerOffset = kEnumeratorOffset + kPointerSize;
+  static const int kDataOffset = kDefinerOffset + kPointerSize;
+  static const int kFlagsOffset = kDataOffset + kPointerSize;
+  static const int kSize = kFlagsOffset + kPointerSize;
+
+  static const int kCanInterceptSymbolsBit = 0;
+  static const int kAllCanReadBit = 1;
+  static const int kNonMasking = 2;
+  static const int kNamed = 3;
+  static const int kHasNoSideEffect = 4;
+
+ private:
+  DISALLOW_IMPLICIT_CONSTRUCTORS(InterceptorInfo);
+};
+
+class CallHandlerInfo : public Tuple3 {
+ public:
+  DECL_ACCESSORS(callback, Object)
+  DECL_ACCESSORS(js_callback, Object)
+  DECL_ACCESSORS(data, Object)
+
+  DECL_CAST(CallHandlerInfo)
+
+  inline bool IsSideEffectFreeCallHandlerInfo() const;
+  inline bool IsSideEffectCallHandlerInfo() const;
+  inline void SetNextCallHasNoSideEffect();
+  // Returns whether or not the next call can be side effect free.
+  // Calling this will change the state back to having a side effect.
+  inline bool NextCallHasNoSideEffect();
+
+  // Dispatched behavior.
+  DECL_PRINTER(CallHandlerInfo)
+  DECL_VERIFIER(CallHandlerInfo)
+
+  Address redirected_callback() const;
+
+  static const int kCallbackOffset = kValue1Offset;
+  static const int kJsCallbackOffset = kValue2Offset;
+  static const int kDataOffset = kValue3Offset;
+
+ private:
+  DISALLOW_IMPLICIT_CONSTRUCTORS(CallHandlerInfo);
+};
+
+}  // namespace internal
+}  // namespace v8
+
+#include "src/objects/object-macros-undef.h"
+
+#endif  // V8_OBJECTS_API_CALLBACKS_H_
diff --git a/deps/v8/src/objects/arguments-inl.h b/deps/v8/src/objects/arguments-inl.h
index d759c7dab26a6b..22f9837478f75d 100644
--- a/deps/v8/src/objects/arguments-inl.h
+++ b/deps/v8/src/objects/arguments-inl.h
@@ -19,8 +19,6 @@ CAST_ACCESSOR(SloppyArgumentsElements)
 
 SMI_ACCESSORS(AliasedArgumentsEntry, aliased_context_slot, kAliasedContextSlot)
 
-TYPE_CHECKER(JSArgumentsObject, JS_ARGUMENTS_TYPE)
-
 Context* SloppyArgumentsElements::context() {
   return Context::cast(get(kContextIndex));
 }
diff --git a/deps/v8/src/objects/arguments.h b/deps/v8/src/objects/arguments.h
index 83476d78be8f5d..9e23fa8b61dbfc 100644
--- a/deps/v8/src/objects/arguments.h
+++ b/deps/v8/src/objects/arguments.h
@@ -98,7 +98,7 @@ class SloppyArgumentsElements : public FixedArray {
 
   DECL_CAST(SloppyArgumentsElements)
 #ifdef VERIFY_HEAP
-  void SloppyArgumentsElementsVerify(JSObject* holder);
+  void SloppyArgumentsElementsVerify(Isolate* isolate, JSObject* holder);
 #endif
 
  private:
diff --git a/deps/v8/src/objects/bigint.cc b/deps/v8/src/objects/bigint.cc
index 66962033ffe8b0..4bb83a93b67cc0 100644
--- a/deps/v8/src/objects/bigint.cc
+++ b/deps/v8/src/objects/bigint.cc
@@ -43,9 +43,10 @@ class MutableBigInt : public FreshlyAllocatedBigInt {
   static MaybeHandle<MutableBigInt> New(Isolate* isolate, int length,
                                         PretenureFlag pretenure = NOT_TENURED);
   static Handle<BigInt> NewFromInt(Isolate* isolate, int value);
-  static Handle<BigInt> NewFromSafeInteger(Isolate* isolate, double value);
+  static Handle<BigInt> NewFromDouble(Isolate* isolate, double value);
   void InitializeDigits(int length, byte value = 0);
-  static Handle<MutableBigInt> Copy(Handle<BigIntBase> source);
+  static Handle<MutableBigInt> Copy(Isolate* isolate,
+                                    Handle<BigIntBase> source);
   static Handle<BigInt> Zero(Isolate* isolate) {
     // TODO(jkummerow): Consider caching a canonical zero-BigInt.
     return MakeImmutable(New(isolate, 0)).ToHandleChecked();
@@ -57,44 +58,52 @@ class MutableBigInt : public FreshlyAllocatedBigInt {
   }
 
   // Internal helpers.
-  static MaybeHandle<MutableBigInt> BitwiseAnd(Handle<BigInt> x,
+  static MaybeHandle<MutableBigInt> BitwiseAnd(Isolate* isolate,
+                                               Handle<BigInt> x,
                                                Handle<BigInt> y);
-  static MaybeHandle<MutableBigInt> BitwiseXor(Handle<BigInt> x,
+  static MaybeHandle<MutableBigInt> BitwiseXor(Isolate* isolate,
+                                               Handle<BigInt> x,
                                                Handle<BigInt> y);
-  static MaybeHandle<MutableBigInt> BitwiseOr(Handle<BigInt> x,
+  static MaybeHandle<MutableBigInt> BitwiseOr(Isolate* isolate,
+                                              Handle<BigInt> x,
                                               Handle<BigInt> y);
 
-  static Handle<BigInt> TruncateToNBits(int n, Handle<BigInt> x);
-  static Handle<BigInt> TruncateAndSubFromPowerOfTwo(int n, Handle<BigInt> x,
+  static Handle<BigInt> TruncateToNBits(Isolate* isolate, int n,
+                                        Handle<BigInt> x);
+  static Handle<BigInt> TruncateAndSubFromPowerOfTwo(Isolate* isolate, int n,
+                                                     Handle<BigInt> x,
                                                      bool result_sign);
 
-  static MaybeHandle<BigInt> AbsoluteAdd(Handle<BigInt> x, Handle<BigInt> y,
-                                         bool result_sign);
-  static Handle<BigInt> AbsoluteSub(Handle<BigInt> x, Handle<BigInt> y,
-                                    bool result_sign);
+  static MaybeHandle<BigInt> AbsoluteAdd(Isolate* isolate, Handle<BigInt> x,
+                                         Handle<BigInt> y, bool result_sign);
+  static Handle<BigInt> AbsoluteSub(Isolate* isolate, Handle<BigInt> x,
+                                    Handle<BigInt> y, bool result_sign);
   static MaybeHandle<MutableBigInt> AbsoluteAddOne(
-      Handle<BigIntBase> x, bool sign, MutableBigInt* result_storage = nullptr);
-  static Handle<MutableBigInt> AbsoluteSubOne(Handle<BigIntBase> x);
-  static MaybeHandle<MutableBigInt> AbsoluteSubOne(Handle<BigIntBase> x,
+      Isolate* isolate, Handle<BigIntBase> x, bool sign,
+      MutableBigInt* result_storage = nullptr);
+  static Handle<MutableBigInt> AbsoluteSubOne(Isolate* isolate,
+                                              Handle<BigIntBase> x);
+  static MaybeHandle<MutableBigInt> AbsoluteSubOne(Isolate* isolate,
+                                                   Handle<BigIntBase> x,
                                                    int result_length);
 
   enum ExtraDigitsHandling { kCopy, kSkip };
   enum SymmetricOp { kSymmetric, kNotSymmetric };
   static inline Handle<MutableBigInt> AbsoluteBitwiseOp(
-      Handle<BigIntBase> x, Handle<BigIntBase> y, MutableBigInt* result_storage,
-      ExtraDigitsHandling extra_digits, SymmetricOp symmetric,
-      std::function<digit_t(digit_t, digit_t)> op);
+      Isolate* isolate, Handle<BigIntBase> x, Handle<BigIntBase> y,
+      MutableBigInt* result_storage, ExtraDigitsHandling extra_digits,
+      SymmetricOp symmetric, std::function<digit_t(digit_t, digit_t)> op);
   static Handle<MutableBigInt> AbsoluteAnd(
-      Handle<BigIntBase> x, Handle<BigIntBase> y,
+      Isolate* isolate, Handle<BigIntBase> x, Handle<BigIntBase> y,
       MutableBigInt* result_storage = nullptr);
   static Handle<MutableBigInt> AbsoluteAndNot(
-      Handle<BigIntBase> x, Handle<BigIntBase> y,
+      Isolate* isolate, Handle<BigIntBase> x, Handle<BigIntBase> y,
       MutableBigInt* result_storage = nullptr);
   static Handle<MutableBigInt> AbsoluteOr(
-      Handle<BigIntBase> x, Handle<BigIntBase> y,
+      Isolate* isolate, Handle<BigIntBase> x, Handle<BigIntBase> y,
       MutableBigInt* result_storage = nullptr);
   static Handle<MutableBigInt> AbsoluteXor(
-      Handle<BigIntBase> x, Handle<BigIntBase> y,
+      Isolate* isolate, Handle<BigIntBase> x, Handle<BigIntBase> y,
       MutableBigInt* result_storage = nullptr);
 
   static int AbsoluteCompare(Handle<BigIntBase> x, Handle<BigIntBase> y);
@@ -109,10 +118,10 @@ class MutableBigInt : public FreshlyAllocatedBigInt {
   void InplaceMultiplyAdd(uintptr_t factor, uintptr_t summand);
 
   // Specialized helpers for Divide/Remainder.
-  static void AbsoluteDivSmall(Handle<BigIntBase> x, digit_t divisor,
-                               Handle<MutableBigInt>* quotient,
+  static void AbsoluteDivSmall(Isolate* isolate, Handle<BigIntBase> x,
+                               digit_t divisor, Handle<MutableBigInt>* quotient,
                                digit_t* remainder);
-  static bool AbsoluteDivLarge(Handle<BigIntBase> dividend,
+  static bool AbsoluteDivLarge(Isolate* isolate, Handle<BigIntBase> dividend,
                                Handle<BigIntBase> divisor,
                                Handle<MutableBigInt>* quotient,
                                Handle<MutableBigInt>* remainder);
@@ -125,19 +134,23 @@ class MutableBigInt : public FreshlyAllocatedBigInt {
     kSameSizeResult,
     kAlwaysAddOneDigit,
   };
-  static MaybeHandle<MutableBigInt> SpecialLeftShift(Handle<BigIntBase> x,
+  static MaybeHandle<MutableBigInt> SpecialLeftShift(Isolate* isolate,
+                                                     Handle<BigIntBase> x,
                                                      int shift,
                                                      SpecialLeftShiftMode mode);
 
   // Specialized helpers for shift operations.
-  static MaybeHandle<BigInt> LeftShiftByAbsolute(Handle<BigIntBase> x,
+  static MaybeHandle<BigInt> LeftShiftByAbsolute(Isolate* isolate,
+                                                 Handle<BigIntBase> x,
                                                  Handle<BigIntBase> y);
-  static Handle<BigInt> RightShiftByAbsolute(Handle<BigIntBase> x,
+  static Handle<BigInt> RightShiftByAbsolute(Isolate* isolate,
+                                             Handle<BigIntBase> x,
                                              Handle<BigIntBase> y);
   static Handle<BigInt> RightShiftByMaximum(Isolate* isolate, bool sign);
   static Maybe<digit_t> ToShiftAmount(Handle<BigIntBase> x);
 
-  static MaybeHandle<String> ToStringBasePowerOfTwo(Handle<BigIntBase> x,
+  static MaybeHandle<String> ToStringBasePowerOfTwo(Isolate* isolate,
+                                                    Handle<BigIntBase> x,
                                                     int radix);
   static MaybeHandle<String> ToStringGeneric(Handle<BigIntBase> x, int radix);
 
@@ -179,8 +192,8 @@ class MutableBigInt : public FreshlyAllocatedBigInt {
   }
   inline void set_digit(int n, digit_t value) {
     SLOW_DCHECK(0 <= n && n < length());
-    byte* address = FIELD_ADDR(this, kDigitsOffset + n * kDigitSize);
-    (*reinterpret_cast<digit_t*>(reinterpret_cast<intptr_t>(address))) = value;
+    Address address = FIELD_ADDR(this, kDigitsOffset + n * kDigitSize);
+    (*reinterpret_cast<digit_t*>(address)) = value;
   }
 #include "src/objects/object-macros-undef.h"
 
@@ -220,26 +233,80 @@ Handle<BigInt> MutableBigInt::NewFromInt(Isolate* isolate, int value) {
   return MakeImmutable(result);
 }
 
-Handle<BigInt> MutableBigInt::NewFromSafeInteger(Isolate* isolate,
-                                                 double value) {
+Handle<BigInt> MutableBigInt::NewFromDouble(Isolate* isolate, double value) {
+  DCHECK_EQ(value, std::floor(value));
   if (value == 0) return Zero(isolate);
 
-  uint64_t absolute = std::abs(value);
-  int length = 64 / kDigitBits;
-  Handle<MutableBigInt> result = Cast(isolate->factory()->NewBigInt(length));
-  bool sign = value < 0;  // Treats -0 like 0.
-  result->initialize_bitfield(sign, length);
-  result->set_64_bits(absolute);
+  bool sign = value < 0;  // -0 was already handled above.
+  uint64_t double_bits = bit_cast<uint64_t>(value);
+  int raw_exponent =
+      static_cast<int>(double_bits >> Double::kPhysicalSignificandSize) & 0x7FF;
+  DCHECK_NE(raw_exponent, 0x7FF);
+  DCHECK_GE(raw_exponent, 0x3FF);
+  int exponent = raw_exponent - 0x3FF;
+  int digits = exponent / kDigitBits + 1;
+  Handle<MutableBigInt> result = Cast(isolate->factory()->NewBigInt(digits));
+  result->initialize_bitfield(sign, digits);
+
+  // We construct a BigInt from the double {value} by shifting its mantissa
+  // according to its exponent and mapping the bit pattern onto digits.
+  //
+  //               <----------- bitlength = exponent + 1 ----------->
+  //                <----- 52 ------> <------ trailing zeroes ------>
+  // mantissa:     1yyyyyyyyyyyyyyyyy 0000000000000000000000000000000
+  // digits:    0001xxxx xxxxxxxx xxxxxxxx xxxxxxxx xxxxxxxx xxxxxxxx
+  //                <-->          <------>
+  //          msd_topbit         kDigitBits
+  //
+  uint64_t mantissa =
+      (double_bits & Double::kSignificandMask) | Double::kHiddenBit;
+  const int kMantissaTopBit = Double::kSignificandSize - 1;  // 0-indexed.
+  // 0-indexed position of most significant bit in the most significant digit.
+  int msd_topbit = exponent % kDigitBits;
+  // Number of unused bits in {mantissa}. We'll keep them shifted to the
+  // left (i.e. most significant part) of the underlying uint64_t.
+  int remaining_mantissa_bits = 0;
+  // Next digit under construction.
+  digit_t digit;
+
+  // First, build the MSD by shifting the mantissa appropriately.
+  if (msd_topbit < kMantissaTopBit) {
+    remaining_mantissa_bits = kMantissaTopBit - msd_topbit;
+    digit = mantissa >> remaining_mantissa_bits;
+    mantissa = mantissa << (64 - remaining_mantissa_bits);
+  } else {
+    DCHECK_GE(msd_topbit, kMantissaTopBit);
+    digit = mantissa << (msd_topbit - kMantissaTopBit);
+    mantissa = 0;
+  }
+  result->set_digit(digits - 1, digit);
+  // Then fill in the rest of the digits.
+  for (int digit_index = digits - 2; digit_index >= 0; digit_index--) {
+    if (remaining_mantissa_bits > 0) {
+      remaining_mantissa_bits -= kDigitBits;
+      if (sizeof(digit) == 4) {
+        digit = mantissa >> 32;
+        mantissa = mantissa << 32;
+      } else {
+        DCHECK_EQ(sizeof(digit), 8);
+        digit = mantissa;
+        mantissa = 0;
+      }
+    } else {
+      digit = 0;
+    }
+    result->set_digit(digit_index, digit);
+  }
   return MakeImmutable(result);
 }
 
-Handle<MutableBigInt> MutableBigInt::Copy(Handle<BigIntBase> source) {
+Handle<MutableBigInt> MutableBigInt::Copy(Isolate* isolate,
+                                          Handle<BigIntBase> source) {
   int length = source->length();
   // Allocating a BigInt of the same length as an existing BigInt cannot throw.
-  Handle<MutableBigInt> result =
-      New(source->GetIsolate(), length).ToHandleChecked();
-  memcpy(result->address() + BigIntBase::kHeaderSize,
-         source->address() + BigIntBase::kHeaderSize,
+  Handle<MutableBigInt> result = New(isolate, length).ToHandleChecked();
+  memcpy(reinterpret_cast<void*>(result->address() + BigIntBase::kHeaderSize),
+         reinterpret_cast<void*>(source->address() + BigIntBase::kHeaderSize),
          BigInt::SizeFor(length) - BigIntBase::kHeaderSize);
   return result;
 }
@@ -285,31 +352,30 @@ Handle<BigInt> BigInt::Zero(Isolate* isolate) {
   return MutableBigInt::Zero(isolate);
 }
 
-Handle<BigInt> BigInt::UnaryMinus(Handle<BigInt> x) {
+Handle<BigInt> BigInt::UnaryMinus(Isolate* isolate, Handle<BigInt> x) {
   // Special case: There is no -0n.
   if (x->is_zero()) {
     return x;
   }
-  Handle<MutableBigInt> result = MutableBigInt::Copy(x);
+  Handle<MutableBigInt> result = MutableBigInt::Copy(isolate, x);
   result->set_sign(!x->sign());
   return MutableBigInt::MakeImmutable(result);
 }
 
-MaybeHandle<BigInt> BigInt::BitwiseNot(Handle<BigInt> x) {
+MaybeHandle<BigInt> BigInt::BitwiseNot(Isolate* isolate, Handle<BigInt> x) {
   MaybeHandle<MutableBigInt> result;
   if (x->sign()) {
     // ~(-x) == ~(~(x-1)) == x-1
-    result = MutableBigInt::AbsoluteSubOne(x, x->length());
+    result = MutableBigInt::AbsoluteSubOne(isolate, x, x->length());
   } else {
     // ~x == -x-1 == -(x+1)
-    result = MutableBigInt::AbsoluteAddOne(x, true);
+    result = MutableBigInt::AbsoluteAddOne(isolate, x, true);
   }
   return MutableBigInt::MakeImmutable(result);
 }
 
-MaybeHandle<BigInt> BigInt::Exponentiate(Handle<BigInt> base,
+MaybeHandle<BigInt> BigInt::Exponentiate(Isolate* isolate, Handle<BigInt> base,
                                          Handle<BigInt> exponent) {
-  Isolate* isolate = base->GetIsolate();
   // 1. If exponent is < 0, throw a RangeError exception.
   if (exponent->sign()) {
     THROW_NEW_ERROR(isolate,
@@ -326,7 +392,7 @@ MaybeHandle<BigInt> BigInt::Exponentiate(Handle<BigInt> base,
   if (base->length() == 1 && base->digit(0) == 1) {
     // (-1) ** even_number == 1.
     if (base->sign() && (exponent->digit(0) & 1) == 0) {
-      return UnaryMinus(base);
+      return UnaryMinus(isolate, base);
     }
     // (-1) ** odd_number == -1; 1 ** anything == 1.
     return base;
@@ -367,13 +433,14 @@ MaybeHandle<BigInt> BigInt::Exponentiate(Handle<BigInt> base,
   if (n & 1) result = base;
   n >>= 1;
   for (; n != 0; n >>= 1) {
-    MaybeHandle<BigInt> maybe_result = Multiply(running_square, running_square);
+    MaybeHandle<BigInt> maybe_result =
+        Multiply(isolate, running_square, running_square);
     if (!maybe_result.ToHandle(&running_square)) return maybe_result;
     if (n & 1) {
       if (result.is_null()) {
         result = running_square;
       } else {
-        maybe_result = Multiply(result, running_square);
+        maybe_result = Multiply(isolate, result, running_square);
         if (!maybe_result.ToHandle(&result)) return maybe_result;
       }
     }
@@ -381,12 +448,13 @@ MaybeHandle<BigInt> BigInt::Exponentiate(Handle<BigInt> base,
   return result;
 }
 
-MaybeHandle<BigInt> BigInt::Multiply(Handle<BigInt> x, Handle<BigInt> y) {
+MaybeHandle<BigInt> BigInt::Multiply(Isolate* isolate, Handle<BigInt> x,
+                                     Handle<BigInt> y) {
   if (x->is_zero()) return x;
   if (y->is_zero()) return y;
   int result_length = x->length() + y->length();
   Handle<MutableBigInt> result;
-  if (!MutableBigInt::New(x->GetIsolate(), result_length).ToHandle(&result)) {
+  if (!MutableBigInt::New(isolate, result_length).ToHandle(&result)) {
     return MaybeHandle<BigInt>();
   }
   result->InitializeDigits(result_length);
@@ -397,29 +465,30 @@ MaybeHandle<BigInt> BigInt::Multiply(Handle<BigInt> x, Handle<BigInt> y) {
   return MutableBigInt::MakeImmutable(result);
 }
 
-MaybeHandle<BigInt> BigInt::Divide(Handle<BigInt> x, Handle<BigInt> y) {
+MaybeHandle<BigInt> BigInt::Divide(Isolate* isolate, Handle<BigInt> x,
+                                   Handle<BigInt> y) {
   // 1. If y is 0n, throw a RangeError exception.
   if (y->is_zero()) {
-    THROW_NEW_ERROR(y->GetIsolate(),
-                    NewRangeError(MessageTemplate::kBigIntDivZero), BigInt);
+    THROW_NEW_ERROR(isolate, NewRangeError(MessageTemplate::kBigIntDivZero),
+                    BigInt);
   }
   // 2. Let quotient be the mathematical value of x divided by y.
   // 3. Return a BigInt representing quotient rounded towards 0 to the next
   //    integral value.
   if (MutableBigInt::AbsoluteCompare(x, y) < 0) {
-    return Zero(x->GetIsolate());
+    return Zero(isolate);
   }
   Handle<MutableBigInt> quotient;
   bool result_sign = x->sign() != y->sign();
   if (y->length() == 1) {
     digit_t divisor = y->digit(0);
     if (divisor == 1) {
-      return result_sign == x->sign() ? x : UnaryMinus(x);
+      return result_sign == x->sign() ? x : UnaryMinus(isolate, x);
     }
     digit_t remainder;
-    MutableBigInt::AbsoluteDivSmall(x, divisor, &quotient, &remainder);
+    MutableBigInt::AbsoluteDivSmall(isolate, x, divisor, &quotient, &remainder);
   } else {
-    if (!MutableBigInt::AbsoluteDivLarge(x, y, &quotient, nullptr)) {
+    if (!MutableBigInt::AbsoluteDivLarge(isolate, x, y, &quotient, nullptr)) {
       return MaybeHandle<BigInt>();
     }
   }
@@ -427,8 +496,8 @@ MaybeHandle<BigInt> BigInt::Divide(Handle<BigInt> x, Handle<BigInt> y) {
   return MutableBigInt::MakeImmutable(quotient);
 }
 
-MaybeHandle<BigInt> BigInt::Remainder(Handle<BigInt> x, Handle<BigInt> y) {
-  Isolate* isolate = x->GetIsolate();
+MaybeHandle<BigInt> BigInt::Remainder(Isolate* isolate, Handle<BigInt> x,
+                                      Handle<BigInt> y) {
   // 1. If y is 0n, throw a RangeError exception.
   if (y->is_zero()) {
     THROW_NEW_ERROR(isolate, NewRangeError(MessageTemplate::kBigIntDivZero),
@@ -442,14 +511,15 @@ MaybeHandle<BigInt> BigInt::Remainder(Handle<BigInt> x, Handle<BigInt> y) {
     digit_t divisor = y->digit(0);
     if (divisor == 1) return Zero(isolate);
     digit_t remainder_digit;
-    MutableBigInt::AbsoluteDivSmall(x, divisor, nullptr, &remainder_digit);
+    MutableBigInt::AbsoluteDivSmall(isolate, x, divisor, nullptr,
+                                    &remainder_digit);
     if (remainder_digit == 0) {
       return Zero(isolate);
     }
     remainder = MutableBigInt::New(isolate, 1).ToHandleChecked();
     remainder->set_digit(0, remainder_digit);
   } else {
-    if (!MutableBigInt::AbsoluteDivLarge(x, y, nullptr, &remainder)) {
+    if (!MutableBigInt::AbsoluteDivLarge(isolate, x, y, nullptr, &remainder)) {
       return MaybeHandle<BigInt>();
     }
   }
@@ -457,53 +527,56 @@ MaybeHandle<BigInt> BigInt::Remainder(Handle<BigInt> x, Handle<BigInt> y) {
   return MutableBigInt::MakeImmutable(remainder);
 }
 
-MaybeHandle<BigInt> BigInt::Add(Handle<BigInt> x, Handle<BigInt> y) {
+MaybeHandle<BigInt> BigInt::Add(Isolate* isolate, Handle<BigInt> x,
+                                Handle<BigInt> y) {
   bool xsign = x->sign();
   if (xsign == y->sign()) {
     // x + y == x + y
     // -x + -y == -(x + y)
-    return MutableBigInt::AbsoluteAdd(x, y, xsign);
+    return MutableBigInt::AbsoluteAdd(isolate, x, y, xsign);
   }
   // x + -y == x - y == -(y - x)
   // -x + y == y - x == -(x - y)
   if (MutableBigInt::AbsoluteCompare(x, y) >= 0) {
-    return MutableBigInt::AbsoluteSub(x, y, xsign);
+    return MutableBigInt::AbsoluteSub(isolate, x, y, xsign);
   }
-  return MutableBigInt::AbsoluteSub(y, x, !xsign);
+  return MutableBigInt::AbsoluteSub(isolate, y, x, !xsign);
 }
 
-MaybeHandle<BigInt> BigInt::Subtract(Handle<BigInt> x, Handle<BigInt> y) {
+MaybeHandle<BigInt> BigInt::Subtract(Isolate* isolate, Handle<BigInt> x,
+                                     Handle<BigInt> y) {
   bool xsign = x->sign();
   if (xsign != y->sign()) {
     // x - (-y) == x + y
     // (-x) - y == -(x + y)
-    return MutableBigInt::AbsoluteAdd(x, y, xsign);
+    return MutableBigInt::AbsoluteAdd(isolate, x, y, xsign);
   }
   // x - y == -(y - x)
   // (-x) - (-y) == y - x == -(x - y)
   if (MutableBigInt::AbsoluteCompare(x, y) >= 0) {
-    return MutableBigInt::AbsoluteSub(x, y, xsign);
+    return MutableBigInt::AbsoluteSub(isolate, x, y, xsign);
   }
-  return MutableBigInt::AbsoluteSub(y, x, !xsign);
+  return MutableBigInt::AbsoluteSub(isolate, y, x, !xsign);
 }
 
-MaybeHandle<BigInt> BigInt::LeftShift(Handle<BigInt> x, Handle<BigInt> y) {
+MaybeHandle<BigInt> BigInt::LeftShift(Isolate* isolate, Handle<BigInt> x,
+                                      Handle<BigInt> y) {
   if (y->is_zero() || x->is_zero()) return x;
-  if (y->sign()) return MutableBigInt::RightShiftByAbsolute(x, y);
-  return MutableBigInt::LeftShiftByAbsolute(x, y);
+  if (y->sign()) return MutableBigInt::RightShiftByAbsolute(isolate, x, y);
+  return MutableBigInt::LeftShiftByAbsolute(isolate, x, y);
 }
 
-MaybeHandle<BigInt> BigInt::SignedRightShift(Handle<BigInt> x,
+MaybeHandle<BigInt> BigInt::SignedRightShift(Isolate* isolate, Handle<BigInt> x,
                                              Handle<BigInt> y) {
   if (y->is_zero() || x->is_zero()) return x;
-  if (y->sign()) return MutableBigInt::LeftShiftByAbsolute(x, y);
-  return MutableBigInt::RightShiftByAbsolute(x, y);
+  if (y->sign()) return MutableBigInt::LeftShiftByAbsolute(isolate, x, y);
+  return MutableBigInt::RightShiftByAbsolute(isolate, x, y);
 }
 
-MaybeHandle<BigInt> BigInt::UnsignedRightShift(Handle<BigInt> x,
+MaybeHandle<BigInt> BigInt::UnsignedRightShift(Isolate* isolate,
+                                               Handle<BigInt> x,
                                                Handle<BigInt> y) {
-  THROW_NEW_ERROR(x->GetIsolate(), NewTypeError(MessageTemplate::kBigIntShr),
-                  BigInt);
+  THROW_NEW_ERROR(isolate, NewTypeError(MessageTemplate::kBigIntShr), BigInt);
 }
 
 namespace {
@@ -548,49 +621,53 @@ bool BigInt::EqualToBigInt(BigInt* x, BigInt* y) {
   return true;
 }
 
-MaybeHandle<BigInt> BigInt::BitwiseAnd(Handle<BigInt> x, Handle<BigInt> y) {
-  return MutableBigInt::MakeImmutable(MutableBigInt::BitwiseAnd(x, y));
+MaybeHandle<BigInt> BigInt::BitwiseAnd(Isolate* isolate, Handle<BigInt> x,
+                                       Handle<BigInt> y) {
+  return MutableBigInt::MakeImmutable(MutableBigInt::BitwiseAnd(isolate, x, y));
 }
 
-MaybeHandle<MutableBigInt> MutableBigInt::BitwiseAnd(Handle<BigInt> x,
+MaybeHandle<MutableBigInt> MutableBigInt::BitwiseAnd(Isolate* isolate,
+                                                     Handle<BigInt> x,
                                                      Handle<BigInt> y) {
   if (!x->sign() && !y->sign()) {
-    return AbsoluteAnd(x, y);
+    return AbsoluteAnd(isolate, x, y);
   } else if (x->sign() && y->sign()) {
     int result_length = Max(x->length(), y->length()) + 1;
     // (-x) & (-y) == ~(x-1) & ~(y-1) == ~((x-1) | (y-1))
     // == -(((x-1) | (y-1)) + 1)
     Handle<MutableBigInt> result;
-    if (!AbsoluteSubOne(x, result_length).ToHandle(&result)) {
+    if (!AbsoluteSubOne(isolate, x, result_length).ToHandle(&result)) {
       return MaybeHandle<MutableBigInt>();
     }
-    Handle<MutableBigInt> y_1 = AbsoluteSubOne(y);
-    result = AbsoluteOr(result, y_1, *result);
-    return AbsoluteAddOne(result, true, *result);
+    Handle<MutableBigInt> y_1 = AbsoluteSubOne(isolate, y);
+    result = AbsoluteOr(isolate, result, y_1, *result);
+    return AbsoluteAddOne(isolate, result, true, *result);
   } else {
     DCHECK(x->sign() != y->sign());
     // Assume that x is the positive BigInt.
     if (x->sign()) std::swap(x, y);
     // x & (-y) == x & ~(y-1) == x &~ (y-1)
-    return AbsoluteAndNot(x, AbsoluteSubOne(y));
+    return AbsoluteAndNot(isolate, x, AbsoluteSubOne(isolate, y));
   }
 }
 
-MaybeHandle<BigInt> BigInt::BitwiseXor(Handle<BigInt> x, Handle<BigInt> y) {
-  return MutableBigInt::MakeImmutable(MutableBigInt::BitwiseXor(x, y));
+MaybeHandle<BigInt> BigInt::BitwiseXor(Isolate* isolate, Handle<BigInt> x,
+                                       Handle<BigInt> y) {
+  return MutableBigInt::MakeImmutable(MutableBigInt::BitwiseXor(isolate, x, y));
 }
 
-MaybeHandle<MutableBigInt> MutableBigInt::BitwiseXor(Handle<BigInt> x,
+MaybeHandle<MutableBigInt> MutableBigInt::BitwiseXor(Isolate* isolate,
+                                                     Handle<BigInt> x,
                                                      Handle<BigInt> y) {
   if (!x->sign() && !y->sign()) {
-    return AbsoluteXor(x, y);
+    return AbsoluteXor(isolate, x, y);
   } else if (x->sign() && y->sign()) {
     int result_length = Max(x->length(), y->length());
     // (-x) ^ (-y) == ~(x-1) ^ ~(y-1) == (x-1) ^ (y-1)
     Handle<MutableBigInt> result =
-        AbsoluteSubOne(x, result_length).ToHandleChecked();
-    Handle<MutableBigInt> y_1 = AbsoluteSubOne(y);
-    return AbsoluteXor(result, y_1, *result);
+        AbsoluteSubOne(isolate, x, result_length).ToHandleChecked();
+    Handle<MutableBigInt> y_1 = AbsoluteSubOne(isolate, y);
+    return AbsoluteXor(isolate, result, y_1, *result);
   } else {
     DCHECK(x->sign() != y->sign());
     int result_length = Max(x->length(), y->length()) + 1;
@@ -598,69 +675,85 @@ MaybeHandle<MutableBigInt> MutableBigInt::BitwiseXor(Handle<BigInt> x,
     if (x->sign()) std::swap(x, y);
     // x ^ (-y) == x ^ ~(y-1) == ~(x ^ (y-1)) == -((x ^ (y-1)) + 1)
     Handle<MutableBigInt> result;
-    if (!AbsoluteSubOne(y, result_length).ToHandle(&result)) {
+    if (!AbsoluteSubOne(isolate, y, result_length).ToHandle(&result)) {
       return MaybeHandle<MutableBigInt>();
     }
-    result = AbsoluteXor(result, x, *result);
-    return AbsoluteAddOne(result, true, *result);
+    result = AbsoluteXor(isolate, result, x, *result);
+    return AbsoluteAddOne(isolate, result, true, *result);
   }
 }
 
-MaybeHandle<BigInt> BigInt::BitwiseOr(Handle<BigInt> x, Handle<BigInt> y) {
-  return MutableBigInt::MakeImmutable(MutableBigInt::BitwiseOr(x, y));
+MaybeHandle<BigInt> BigInt::BitwiseOr(Isolate* isolate, Handle<BigInt> x,
+                                      Handle<BigInt> y) {
+  return MutableBigInt::MakeImmutable(MutableBigInt::BitwiseOr(isolate, x, y));
 }
 
-MaybeHandle<MutableBigInt> MutableBigInt::BitwiseOr(Handle<BigInt> x,
+MaybeHandle<MutableBigInt> MutableBigInt::BitwiseOr(Isolate* isolate,
+                                                    Handle<BigInt> x,
                                                     Handle<BigInt> y) {
   int result_length = Max(x->length(), y->length());
   if (!x->sign() && !y->sign()) {
-    return AbsoluteOr(x, y);
+    return AbsoluteOr(isolate, x, y);
   } else if (x->sign() && y->sign()) {
     // (-x) | (-y) == ~(x-1) | ~(y-1) == ~((x-1) & (y-1))
     // == -(((x-1) & (y-1)) + 1)
     Handle<MutableBigInt> result =
-        AbsoluteSubOne(x, result_length).ToHandleChecked();
-    Handle<MutableBigInt> y_1 = AbsoluteSubOne(y);
-    result = AbsoluteAnd(result, y_1, *result);
-    return AbsoluteAddOne(result, true, *result);
+        AbsoluteSubOne(isolate, x, result_length).ToHandleChecked();
+    Handle<MutableBigInt> y_1 = AbsoluteSubOne(isolate, y);
+    result = AbsoluteAnd(isolate, result, y_1, *result);
+    return AbsoluteAddOne(isolate, result, true, *result);
   } else {
     DCHECK(x->sign() != y->sign());
     // Assume that x is the positive BigInt.
     if (x->sign()) std::swap(x, y);
     // x | (-y) == x | ~(y-1) == ~((y-1) &~ x) == -(((y-1) &~ x) + 1)
     Handle<MutableBigInt> result =
-        AbsoluteSubOne(y, result_length).ToHandleChecked();
-    result = AbsoluteAndNot(result, x, *result);
-    return AbsoluteAddOne(result, true, *result);
+        AbsoluteSubOne(isolate, y, result_length).ToHandleChecked();
+    result = AbsoluteAndNot(isolate, result, x, *result);
+    return AbsoluteAddOne(isolate, result, true, *result);
   }
 }
 
-MaybeHandle<BigInt> BigInt::Increment(Handle<BigInt> x) {
+MaybeHandle<BigInt> BigInt::Increment(Isolate* isolate, Handle<BigInt> x) {
   if (x->sign()) {
-    Handle<MutableBigInt> result = MutableBigInt::AbsoluteSubOne(x);
+    Handle<MutableBigInt> result = MutableBigInt::AbsoluteSubOne(isolate, x);
     result->set_sign(true);
     return MutableBigInt::MakeImmutable(result);
   } else {
     return MutableBigInt::MakeImmutable(
-        MutableBigInt::AbsoluteAddOne(x, false));
+        MutableBigInt::AbsoluteAddOne(isolate, x, false));
   }
 }
 
-MaybeHandle<BigInt> BigInt::Decrement(Handle<BigInt> x) {
+MaybeHandle<BigInt> BigInt::Decrement(Isolate* isolate, Handle<BigInt> x) {
   MaybeHandle<MutableBigInt> result;
   if (x->sign()) {
-    result = MutableBigInt::AbsoluteAddOne(x, true);
+    result = MutableBigInt::AbsoluteAddOne(isolate, x, true);
   } else if (x->is_zero()) {
     // TODO(jkummerow): Consider caching a canonical -1n BigInt.
-    return MutableBigInt::NewFromInt(x->GetIsolate(), -1);
+    return MutableBigInt::NewFromInt(isolate, -1);
   } else {
-    result = MutableBigInt::AbsoluteSubOne(x);
+    result = MutableBigInt::AbsoluteSubOne(isolate, x);
   }
   return MutableBigInt::MakeImmutable(result);
 }
 
-bool BigInt::EqualToString(Handle<BigInt> x, Handle<String> y) {
-  Isolate* isolate = x->GetIsolate();
+ComparisonResult BigInt::CompareToString(Isolate* isolate, Handle<BigInt> x,
+                                         Handle<String> y) {
+  // a. Let ny be StringToBigInt(y);
+  MaybeHandle<BigInt> maybe_ny = StringToBigInt(isolate, y);
+  // b. If ny is NaN, return undefined.
+  Handle<BigInt> ny;
+  if (!maybe_ny.ToHandle(&ny)) {
+    DCHECK(!isolate->has_pending_exception());
+    return ComparisonResult::kUndefined;
+  }
+  // c. Return BigInt::lessThan(x, ny).
+  return CompareToBigInt(x, ny);
+}
+
+bool BigInt::EqualToString(Isolate* isolate, Handle<BigInt> x,
+                           Handle<String> y) {
   // a. Let n be StringToBigInt(y).
   MaybeHandle<BigInt> maybe_n = StringToBigInt(isolate, y);
   // b. If n is NaN, return false.
@@ -825,44 +918,30 @@ ComparisonResult BigInt::CompareToDouble(Handle<BigInt> x, double y) {
   return ComparisonResult::kEqual;
 }
 
-MaybeHandle<String> BigInt::ToString(Handle<BigInt> bigint, int radix) {
-  Isolate* isolate = bigint->GetIsolate();
+MaybeHandle<String> BigInt::ToString(Isolate* isolate, Handle<BigInt> bigint,
+                                     int radix) {
   if (bigint->is_zero()) {
     return isolate->factory()->NewStringFromStaticChars("0");
   }
   if (base::bits::IsPowerOfTwo(radix)) {
-    return MutableBigInt::ToStringBasePowerOfTwo(bigint, radix);
+    return MutableBigInt::ToStringBasePowerOfTwo(isolate, bigint, radix);
   }
   return MutableBigInt::ToStringGeneric(bigint, radix);
 }
 
-namespace {
-
-bool IsSafeInteger(double value) {
-  if (std::isnan(value) || std::isinf(value)) return false;
-
-  // Let integer be ! ToInteger(value).
-  // If ! SameValueZero(integer, value) is false, return false.
-  if (DoubleToInteger(value) != value) return false;
-
-  return std::abs(value) <= kMaxSafeInteger;
-}
-
-}  // anonymous namespace
-
 MaybeHandle<BigInt> BigInt::FromNumber(Isolate* isolate,
                                        Handle<Object> number) {
   DCHECK(number->IsNumber());
   if (number->IsSmi()) {
     return MutableBigInt::NewFromInt(isolate, Smi::ToInt(*number));
   }
-  if (!IsSafeInteger(Handle<HeapNumber>::cast(number)->value())) {
+  double value = HeapNumber::cast(*number)->value();
+  if (!std::isfinite(value) || (DoubleToInteger(value) != value)) {
     THROW_NEW_ERROR(isolate,
                     NewRangeError(MessageTemplate::kBigIntFromNumber, number),
                     BigInt);
   }
-  return MutableBigInt::NewFromSafeInteger(
-      isolate, Handle<HeapNumber>::cast(number)->value());
+  return MutableBigInt::NewFromDouble(isolate, value);
 }
 
 MaybeHandle<BigInt> BigInt::FromObject(Isolate* isolate, Handle<Object> obj) {
@@ -875,7 +954,7 @@ MaybeHandle<BigInt> BigInt::FromObject(Isolate* isolate, Handle<Object> obj) {
   }
 
   if (obj->IsBoolean()) {
-    return MutableBigInt::NewFromInt(isolate, obj->BooleanValue());
+    return MutableBigInt::NewFromInt(isolate, obj->BooleanValue(isolate));
   }
   if (obj->IsBigInt()) {
     return Handle<BigInt>::cast(obj);
@@ -894,8 +973,7 @@ MaybeHandle<BigInt> BigInt::FromObject(Isolate* isolate, Handle<Object> obj) {
       isolate, NewTypeError(MessageTemplate::kBigIntFromObject, obj), BigInt);
 }
 
-Handle<Object> BigInt::ToNumber(Handle<BigInt> x) {
-  Isolate* isolate = x->GetIsolate();
+Handle<Object> BigInt::ToNumber(Isolate* isolate, Handle<BigInt> x) {
   if (x->is_zero()) return Handle<Smi>(Smi::kZero, isolate);
   if (x->length() == 1 && x->digit(0) < Smi::kMaxValue) {
     int value = static_cast<int>(x->digit(0));
@@ -1008,19 +1086,20 @@ void BigInt::BigIntShortPrint(std::ostream& os) {
 
 // Internal helpers.
 
-MaybeHandle<BigInt> MutableBigInt::AbsoluteAdd(Handle<BigInt> x,
+MaybeHandle<BigInt> MutableBigInt::AbsoluteAdd(Isolate* isolate,
+                                               Handle<BigInt> x,
                                                Handle<BigInt> y,
                                                bool result_sign) {
-  if (x->length() < y->length()) return AbsoluteAdd(y, x, result_sign);
+  if (x->length() < y->length()) return AbsoluteAdd(isolate, y, x, result_sign);
   if (x->is_zero()) {
     DCHECK(y->is_zero());
     return x;
   }
   if (y->is_zero()) {
-    return result_sign == x->sign() ? x : BigInt::UnaryMinus(x);
+    return result_sign == x->sign() ? x : BigInt::UnaryMinus(isolate, x);
   }
   Handle<MutableBigInt> result;
-  if (!New(x->GetIsolate(), x->length() + 1).ToHandle(&result)) {
+  if (!New(isolate, x->length() + 1).ToHandle(&result)) {
     return MaybeHandle<BigInt>();
   }
   digit_t carry = 0;
@@ -1043,8 +1122,8 @@ MaybeHandle<BigInt> MutableBigInt::AbsoluteAdd(Handle<BigInt> x,
   return MakeImmutable(result);
 }
 
-Handle<BigInt> MutableBigInt::AbsoluteSub(Handle<BigInt> x, Handle<BigInt> y,
-                                          bool result_sign) {
+Handle<BigInt> MutableBigInt::AbsoluteSub(Isolate* isolate, Handle<BigInt> x,
+                                          Handle<BigInt> y, bool result_sign) {
   DCHECK(x->length() >= y->length());
   SLOW_DCHECK(AbsoluteCompare(x, y) >= 0);
   if (x->is_zero()) {
@@ -1052,10 +1131,9 @@ Handle<BigInt> MutableBigInt::AbsoluteSub(Handle<BigInt> x, Handle<BigInt> y,
     return x;
   }
   if (y->is_zero()) {
-    return result_sign == x->sign() ? x : BigInt::UnaryMinus(x);
+    return result_sign == x->sign() ? x : BigInt::UnaryMinus(isolate, x);
   }
-  Handle<MutableBigInt> result =
-      New(x->GetIsolate(), x->length()).ToHandleChecked();
+  Handle<MutableBigInt> result = New(isolate, x->length()).ToHandleChecked();
   digit_t borrow = 0;
   int i = 0;
   for (; i < y->length(); i++) {
@@ -1082,7 +1160,8 @@ Handle<BigInt> MutableBigInt::AbsoluteSub(Handle<BigInt> x, Handle<BigInt> y,
 // {result_storage} and {x} may refer to the same BigInt for in-place
 // modification.
 MaybeHandle<MutableBigInt> MutableBigInt::AbsoluteAddOne(
-    Handle<BigIntBase> x, bool sign, MutableBigInt* result_storage) {
+    Isolate* isolate, Handle<BigIntBase> x, bool sign,
+    MutableBigInt* result_storage) {
   int input_length = x->length();
   // The addition will overflow into a new digit if all existing digits are
   // at maximum.
@@ -1094,7 +1173,6 @@ MaybeHandle<MutableBigInt> MutableBigInt::AbsoluteAddOne(
     }
   }
   int result_length = input_length + will_overflow;
-  Isolate* isolate = x->GetIsolate();
   Handle<MutableBigInt> result(result_storage, isolate);
   if (result_storage == nullptr) {
     if (!New(isolate, result_length).ToHandle(&result)) {
@@ -1119,21 +1197,23 @@ MaybeHandle<MutableBigInt> MutableBigInt::AbsoluteAddOne(
 }
 
 // Subtracts 1 from the absolute value of {x}. {x} must not be zero.
-Handle<MutableBigInt> MutableBigInt::AbsoluteSubOne(Handle<BigIntBase> x) {
+Handle<MutableBigInt> MutableBigInt::AbsoluteSubOne(Isolate* isolate,
+                                                    Handle<BigIntBase> x) {
   DCHECK(!x->is_zero());
   // Requesting a result length identical to an existing BigInt's length
   // cannot overflow the limit.
-  return AbsoluteSubOne(x, x->length()).ToHandleChecked();
+  return AbsoluteSubOne(isolate, x, x->length()).ToHandleChecked();
 }
 
 // Like the above, but you can specify that the allocated result should have
 // length {result_length}, which must be at least as large as {x->length()}.
-MaybeHandle<MutableBigInt> MutableBigInt::AbsoluteSubOne(Handle<BigIntBase> x,
+MaybeHandle<MutableBigInt> MutableBigInt::AbsoluteSubOne(Isolate* isolate,
+                                                         Handle<BigIntBase> x,
                                                          int result_length) {
   DCHECK(!x->is_zero());
   DCHECK(result_length >= x->length());
   Handle<MutableBigInt> result;
-  if (!New(x->GetIsolate(), result_length).ToHandle(&result)) {
+  if (!New(isolate, result_length).ToHandle(&result)) {
     return MaybeHandle<MutableBigInt>();
   }
   int length = x->length();
@@ -1168,9 +1248,9 @@ MaybeHandle<MutableBigInt> MutableBigInt::AbsoluteSubOne(Handle<BigIntBase> x,
 //                          v     v     v     v
 // result_storage: [  0 ][ x3 ][ r2 ][ r1 ][ r0 ]
 inline Handle<MutableBigInt> MutableBigInt::AbsoluteBitwiseOp(
-    Handle<BigIntBase> x, Handle<BigIntBase> y, MutableBigInt* result_storage,
-    ExtraDigitsHandling extra_digits, SymmetricOp symmetric,
-    std::function<digit_t(digit_t, digit_t)> op) {
+    Isolate* isolate, Handle<BigIntBase> x, Handle<BigIntBase> y,
+    MutableBigInt* result_storage, ExtraDigitsHandling extra_digits,
+    SymmetricOp symmetric, std::function<digit_t(digit_t, digit_t)> op) {
   int x_length = x->length();
   int y_length = y->length();
   int num_pairs = y_length;
@@ -1182,7 +1262,6 @@ inline Handle<MutableBigInt> MutableBigInt::AbsoluteBitwiseOp(
     }
   }
   DCHECK(num_pairs == Min(x_length, y_length));
-  Isolate* isolate = x->GetIsolate();
   Handle<MutableBigInt> result(result_storage, isolate);
   int result_length = extra_digits == kCopy ? x_length : num_pairs;
   if (result_storage == nullptr) {
@@ -1210,8 +1289,9 @@ inline Handle<MutableBigInt> MutableBigInt::AbsoluteBitwiseOp(
 // otherwise a new BigInt of appropriate length will be allocated.
 // {result_storage} may alias {x} or {y} for in-place modification.
 Handle<MutableBigInt> MutableBigInt::AbsoluteAnd(
-    Handle<BigIntBase> x, Handle<BigIntBase> y, MutableBigInt* result_storage) {
-  return AbsoluteBitwiseOp(x, y, result_storage, kSkip, kSymmetric,
+    Isolate* isolate, Handle<BigIntBase> x, Handle<BigIntBase> y,
+    MutableBigInt* result_storage) {
+  return AbsoluteBitwiseOp(isolate, x, y, result_storage, kSkip, kSymmetric,
                            [](digit_t a, digit_t b) { return a & b; });
 }
 
@@ -1219,18 +1299,20 @@ Handle<MutableBigInt> MutableBigInt::AbsoluteAnd(
 // otherwise a new BigInt of appropriate length will be allocated.
 // {result_storage} may alias {x} or {y} for in-place modification.
 Handle<MutableBigInt> MutableBigInt::AbsoluteAndNot(
-    Handle<BigIntBase> x, Handle<BigIntBase> y, MutableBigInt* result_storage) {
-  return AbsoluteBitwiseOp(x, y, result_storage, kCopy, kNotSymmetric,
+    Isolate* isolate, Handle<BigIntBase> x, Handle<BigIntBase> y,
+    MutableBigInt* result_storage) {
+  return AbsoluteBitwiseOp(isolate, x, y, result_storage, kCopy, kNotSymmetric,
                            [](digit_t a, digit_t b) { return a & ~b; });
 }
 
 // If {result_storage} is non-nullptr, it will be used for the result,
 // otherwise a new BigInt of appropriate length will be allocated.
 // {result_storage} may alias {x} or {y} for in-place modification.
-Handle<MutableBigInt> MutableBigInt::AbsoluteOr(Handle<BigIntBase> x,
+Handle<MutableBigInt> MutableBigInt::AbsoluteOr(Isolate* isolate,
+                                                Handle<BigIntBase> x,
                                                 Handle<BigIntBase> y,
                                                 MutableBigInt* result_storage) {
-  return AbsoluteBitwiseOp(x, y, result_storage, kCopy, kSymmetric,
+  return AbsoluteBitwiseOp(isolate, x, y, result_storage, kCopy, kSymmetric,
                            [](digit_t a, digit_t b) { return a | b; });
 }
 
@@ -1238,8 +1320,9 @@ Handle<MutableBigInt> MutableBigInt::AbsoluteOr(Handle<BigIntBase> x,
 // otherwise a new BigInt of appropriate length will be allocated.
 // {result_storage} may alias {x} or {y} for in-place modification.
 Handle<MutableBigInt> MutableBigInt::AbsoluteXor(
-    Handle<BigIntBase> x, Handle<BigIntBase> y, MutableBigInt* result_storage) {
-  return AbsoluteBitwiseOp(x, y, result_storage, kCopy, kSymmetric,
+    Isolate* isolate, Handle<BigIntBase> x, Handle<BigIntBase> y,
+    MutableBigInt* result_storage) {
+  return AbsoluteBitwiseOp(isolate, x, y, result_storage, kCopy, kSymmetric,
                            [](digit_t a, digit_t b) { return a ^ b; });
 }
 
@@ -1345,7 +1428,8 @@ void BigInt::InplaceMultiplyAdd(Handle<FreshlyAllocatedBigInt> x,
 // allocated for it; otherwise the caller must ensure that it is big enough.
 // {quotient} can be the same as {x} for an in-place division. {quotient} can
 // also be nullptr if the caller is only interested in the remainder.
-void MutableBigInt::AbsoluteDivSmall(Handle<BigIntBase> x, digit_t divisor,
+void MutableBigInt::AbsoluteDivSmall(Isolate* isolate, Handle<BigIntBase> x,
+                                     digit_t divisor,
                                      Handle<MutableBigInt>* quotient,
                                      digit_t* remainder) {
   DCHECK_NE(divisor, 0);
@@ -1354,7 +1438,7 @@ void MutableBigInt::AbsoluteDivSmall(Handle<BigIntBase> x, digit_t divisor,
   int length = x->length();
   if (quotient != nullptr) {
     if ((*quotient).is_null()) {
-      *quotient = New(x->GetIsolate(), length).ToHandleChecked();
+      *quotient = New(isolate, length).ToHandleChecked();
     }
     for (int i = length - 1; i >= 0; i--) {
       digit_t q = digit_div(*remainder, x->digit(i), divisor, remainder);
@@ -1373,13 +1457,13 @@ void MutableBigInt::AbsoluteDivSmall(Handle<BigIntBase> x, digit_t divisor,
 // Both {quotient} and {remainder} are optional, for callers that are only
 // interested in one of them.
 // See Knuth, Volume 2, section 4.3.1, Algorithm D.
-bool MutableBigInt::AbsoluteDivLarge(Handle<BigIntBase> dividend,
+bool MutableBigInt::AbsoluteDivLarge(Isolate* isolate,
+                                     Handle<BigIntBase> dividend,
                                      Handle<BigIntBase> divisor,
                                      Handle<MutableBigInt>* quotient,
                                      Handle<MutableBigInt>* remainder) {
   DCHECK_GE(divisor->length(), 2);
   DCHECK(dividend->length() >= divisor->length());
-  Isolate* isolate = dividend->GetIsolate();
   // The unusual variable names inside this function are consistent with
   // Knuth's book, as well as with Go's implementation of this algorithm.
   // Maintaining this consistency is probably more useful than trying to
@@ -1402,13 +1486,14 @@ bool MutableBigInt::AbsoluteDivLarge(Handle<BigIntBase> dividend,
   // result).
   int shift = base::bits::CountLeadingZeros(divisor->digit(n - 1));
   if (shift > 0) {
-    divisor =
-        SpecialLeftShift(divisor, shift, kSameSizeResult).ToHandleChecked();
+    divisor = SpecialLeftShift(isolate, divisor, shift, kSameSizeResult)
+                  .ToHandleChecked();
   }
   // Holds the (continuously updated) remaining part of the dividend, which
   // eventually becomes the remainder.
   Handle<MutableBigInt> u;
-  if (!SpecialLeftShift(dividend, shift, kAlwaysAddOneDigit).ToHandle(&u)) {
+  if (!SpecialLeftShift(isolate, dividend, shift, kAlwaysAddOneDigit)
+           .ToHandle(&u)) {
     return false;
   }
 
@@ -1533,14 +1618,15 @@ void MutableBigInt::InplaceRightShift(int shift) {
 // Always copies the input, even when {shift} == 0.
 // {shift} must be less than kDigitBits, {x} must be non-zero.
 MaybeHandle<MutableBigInt> MutableBigInt::SpecialLeftShift(
-    Handle<BigIntBase> x, int shift, SpecialLeftShiftMode mode) {
+    Isolate* isolate, Handle<BigIntBase> x, int shift,
+    SpecialLeftShiftMode mode) {
   DCHECK_GE(shift, 0);
   DCHECK_LT(shift, kDigitBits);
   DCHECK_GT(x->length(), 0);
   int n = x->length();
   int result_length = mode == kAlwaysAddOneDigit ? n + 1 : n;
   Handle<MutableBigInt> result;
-  if (!New(x->GetIsolate(), result_length).ToHandle(&result)) {
+  if (!New(isolate, result_length).ToHandle(&result)) {
     return MaybeHandle<MutableBigInt>();
   }
   if (shift == 0) {
@@ -1564,9 +1650,9 @@ MaybeHandle<MutableBigInt> MutableBigInt::SpecialLeftShift(
   return result;
 }
 
-MaybeHandle<BigInt> MutableBigInt::LeftShiftByAbsolute(Handle<BigIntBase> x,
+MaybeHandle<BigInt> MutableBigInt::LeftShiftByAbsolute(Isolate* isolate,
+                                                       Handle<BigIntBase> x,
                                                        Handle<BigIntBase> y) {
-  Isolate* isolate = x->GetIsolate();
   Maybe<digit_t> maybe_shift = ToShiftAmount(y);
   if (maybe_shift.IsNothing()) {
     THROW_NEW_ERROR(isolate, NewRangeError(MessageTemplate::kBigIntTooBig),
@@ -1611,9 +1697,9 @@ MaybeHandle<BigInt> MutableBigInt::LeftShiftByAbsolute(Handle<BigIntBase> x,
   return MakeImmutable(result);
 }
 
-Handle<BigInt> MutableBigInt::RightShiftByAbsolute(Handle<BigIntBase> x,
+Handle<BigInt> MutableBigInt::RightShiftByAbsolute(Isolate* isolate,
+                                                   Handle<BigIntBase> x,
                                                    Handle<BigIntBase> y) {
-  Isolate* isolate = x->GetIsolate();
   int length = x->length();
   bool sign = x->sign();
   Maybe<digit_t> maybe_shift = ToShiftAmount(y);
@@ -1675,7 +1761,7 @@ Handle<BigInt> MutableBigInt::RightShiftByAbsolute(Handle<BigIntBase> x,
     if (must_round_down) {
       // Since the result is negative, rounding down means adding one to
       // its absolute value. This cannot overflow.
-      result = AbsoluteAddOne(result, true, *result).ToHandleChecked();
+      result = AbsoluteAddOne(isolate, result, true, *result).ToHandleChecked();
     }
   }
   return MakeImmutable(result);
@@ -1833,13 +1919,13 @@ MaybeHandle<BigInt> BigInt::FromSerializedDigits(
 
 static const char kConversionChars[] = "0123456789abcdefghijklmnopqrstuvwxyz";
 
-MaybeHandle<String> MutableBigInt::ToStringBasePowerOfTwo(Handle<BigIntBase> x,
+MaybeHandle<String> MutableBigInt::ToStringBasePowerOfTwo(Isolate* isolate,
+                                                          Handle<BigIntBase> x,
                                                           int radix) {
   STATIC_ASSERT(base::bits::IsPowerOfTwo(kDigitBits));
   DCHECK(base::bits::IsPowerOfTwo(radix));
   DCHECK(radix >= 2 && radix <= 32);
   DCHECK(!x->is_zero());
-  Isolate* isolate = x->GetIsolate();
 
   const int length = x->length();
   const bool sign = x->sign();
@@ -1963,7 +2049,7 @@ MaybeHandle<String> MutableBigInt::ToStringGeneric(Handle<BigIntBase> x,
     Handle<BigIntBase>* dividend = &x;
     do {
       digit_t chunk;
-      AbsoluteDivSmall(*dividend, chunk_divisor, &rest, &chunk);
+      AbsoluteDivSmall(isolate, *dividend, chunk_divisor, &rest, &chunk);
       DCHECK(!rest.is_null());
       dividend = reinterpret_cast<Handle<BigIntBase>*>(&rest);
       DisallowHeapAllocation no_gc;
@@ -2017,9 +2103,9 @@ MaybeHandle<String> MutableBigInt::ToStringGeneric(Handle<BigIntBase> x,
   return result;
 }
 
-Handle<BigInt> BigInt::AsIntN(uint64_t n, Handle<BigInt> x) {
+Handle<BigInt> BigInt::AsIntN(Isolate* isolate, uint64_t n, Handle<BigInt> x) {
   if (x->is_zero()) return x;
-  if (n == 0) return MutableBigInt::Zero(x->GetIsolate());
+  if (n == 0) return MutableBigInt::Zero(isolate);
   uint64_t needed_length = (n + kDigitBits - 1) / kDigitBits;
   uint64_t x_length = static_cast<uint64_t>(x->length());
   // If {x} has less than {n} bits, return it directly.
@@ -2039,35 +2125,37 @@ Handle<BigInt> BigInt::AsIntN(uint64_t n, Handle<BigInt> x) {
   DCHECK_LE(n, kMaxInt);
   int N = static_cast<int>(n);
   if (!has_bit) {
-    return MutableBigInt::TruncateToNBits(N, x);
+    return MutableBigInt::TruncateToNBits(isolate, N, x);
   }
   if (!x->sign()) {
-    return MutableBigInt::TruncateAndSubFromPowerOfTwo(N, x, true);
+    return MutableBigInt::TruncateAndSubFromPowerOfTwo(isolate, N, x, true);
   }
   // Negative numbers must subtract from 2^n, except for the special case
   // described above.
   if ((top_digit & (compare_digit - 1)) == 0) {
     for (int i = static_cast<int>(needed_length) - 2; i >= 0; i--) {
       if (x->digit(i) != 0) {
-        return MutableBigInt::TruncateAndSubFromPowerOfTwo(N, x, false);
+        return MutableBigInt::TruncateAndSubFromPowerOfTwo(isolate, N, x,
+                                                           false);
       }
     }
-    return MutableBigInt::TruncateToNBits(N, x);
+    return MutableBigInt::TruncateToNBits(isolate, N, x);
   }
-  return MutableBigInt::TruncateAndSubFromPowerOfTwo(N, x, false);
+  return MutableBigInt::TruncateAndSubFromPowerOfTwo(isolate, N, x, false);
 }
 
-MaybeHandle<BigInt> BigInt::AsUintN(uint64_t n, Handle<BigInt> x) {
+MaybeHandle<BigInt> BigInt::AsUintN(Isolate* isolate, uint64_t n,
+                                    Handle<BigInt> x) {
   if (x->is_zero()) return x;
-  if (n == 0) return MutableBigInt::Zero(x->GetIsolate());
+  if (n == 0) return MutableBigInt::Zero(isolate);
   // If {x} is negative, simulate two's complement representation.
   if (x->sign()) {
     if (n > kMaxLengthBits) {
-      THROW_NEW_ERROR(x->GetIsolate(),
-                      NewRangeError(MessageTemplate::kBigIntTooBig), BigInt);
+      THROW_NEW_ERROR(isolate, NewRangeError(MessageTemplate::kBigIntTooBig),
+                      BigInt);
     }
-    return MutableBigInt::TruncateAndSubFromPowerOfTwo(static_cast<int>(n), x,
-                                                       false);
+    return MutableBigInt::TruncateAndSubFromPowerOfTwo(
+        isolate, static_cast<int>(n), x, false);
   }
   // If {x} is positive and has up to {n} bits, return it directly.
   if (n >= kMaxLengthBits) return x;
@@ -2083,14 +2171,14 @@ MaybeHandle<BigInt> BigInt::AsUintN(uint64_t n, Handle<BigInt> x) {
   }
   // Otherwise, truncate.
   DCHECK_LE(n, kMaxInt);
-  return MutableBigInt::TruncateToNBits(static_cast<int>(n), x);
+  return MutableBigInt::TruncateToNBits(isolate, static_cast<int>(n), x);
 }
 
-Handle<BigInt> MutableBigInt::TruncateToNBits(int n, Handle<BigInt> x) {
+Handle<BigInt> MutableBigInt::TruncateToNBits(Isolate* isolate, int n,
+                                              Handle<BigInt> x) {
   // Only call this when there's something to do.
   DCHECK_NE(n, 0);
   DCHECK_GT(x->length(), n / kDigitBits);
-  Isolate* isolate = x->GetIsolate();
 
   int needed_digits = (n + (kDigitBits - 1)) / kDigitBits;
   DCHECK_LE(needed_digits, x->length());
@@ -2114,12 +2202,12 @@ Handle<BigInt> MutableBigInt::TruncateToNBits(int n, Handle<BigInt> x) {
 }
 
 // Subtracts the least significant n bits of abs(x) from 2^n.
-Handle<BigInt> MutableBigInt::TruncateAndSubFromPowerOfTwo(int n,
+Handle<BigInt> MutableBigInt::TruncateAndSubFromPowerOfTwo(Isolate* isolate,
+                                                           int n,
                                                            Handle<BigInt> x,
                                                            bool result_sign) {
   DCHECK_NE(n, 0);
   DCHECK_LE(n, kMaxLengthBits);
-  Isolate* isolate = x->GetIsolate();
 
   int needed_digits = (n + (kDigitBits - 1)) / kDigitBits;
   DCHECK_LE(needed_digits, kMaxLength);  // Follows from n <= kMaxLengthBits.
@@ -2405,16 +2493,20 @@ BigInt::digit_t MutableBigInt::digit_div(digit_t high, digit_t low,
   static const digit_t kHalfDigitBase = 1ull << kHalfDigitBits;
   // Adapted from Warren, Hacker's Delight, p. 152.
   int s = base::bits::CountLeadingZeros(divisor);
+  DCHECK_NE(s, kDigitBits);  // {divisor} is not 0.
   divisor <<= s;
 
   digit_t vn1 = divisor >> kHalfDigitBits;
   digit_t vn0 = divisor & kHalfDigitMask;
-  // {s} can be 0. "low >> kDigitBits == low" on x86, so we "&" it with
+  // {s} can be 0. {low >> kDigitBits} would be undefined behavior, so
+  // we mask the shift amount with {kShiftMask}, and the result with
   // {s_zero_mask} which is 0 if s == 0 and all 1-bits otherwise.
   STATIC_ASSERT(sizeof(intptr_t) == sizeof(digit_t));
+  const int kShiftMask = kDigitBits - 1;
   digit_t s_zero_mask =
       static_cast<digit_t>(static_cast<intptr_t>(-s) >> (kDigitBits - 1));
-  digit_t un32 = (high << s) | ((low >> (kDigitBits - s)) & s_zero_mask);
+  digit_t un32 =
+      (high << s) | ((low >> ((kDigitBits - s) & kShiftMask)) & s_zero_mask);
   digit_t un10 = low << s;
   digit_t un1 = un10 >> kHalfDigitBits;
   digit_t un0 = un10 & kHalfDigitMask;
diff --git a/deps/v8/src/objects/bigint.h b/deps/v8/src/objects/bigint.h
index 65ce808394452d..43660990eea13b 100644
--- a/deps/v8/src/objects/bigint.h
+++ b/deps/v8/src/objects/bigint.h
@@ -63,9 +63,8 @@ class BigIntBase : public HeapObject {
 
   inline digit_t digit(int n) const {
     SLOW_DCHECK(0 <= n && n < length());
-    const byte* address =
-        FIELD_ADDR_CONST(this, kDigitsOffset + n * kDigitSize);
-    return *reinterpret_cast<digit_t*>(reinterpret_cast<intptr_t>(address));
+    Address address = FIELD_ADDR(this, kDigitsOffset + n * kDigitSize);
+    return *reinterpret_cast<digit_t*>(address);
   }
 
   bool is_zero() const { return length() == 0; }
@@ -102,30 +101,41 @@ class V8_EXPORT_PRIVATE BigInt : public BigIntBase {
   // Implementation of the Spec methods, see:
   // https://tc39.github.io/proposal-bigint/#sec-numeric-types
   // Sections 1.1.1 through 1.1.19.
-  static Handle<BigInt> UnaryMinus(Handle<BigInt> x);
-  static MaybeHandle<BigInt> BitwiseNot(Handle<BigInt> x);
-  static MaybeHandle<BigInt> Exponentiate(Handle<BigInt> base,
+  static Handle<BigInt> UnaryMinus(Isolate* isolate, Handle<BigInt> x);
+  static MaybeHandle<BigInt> BitwiseNot(Isolate* isolate, Handle<BigInt> x);
+  static MaybeHandle<BigInt> Exponentiate(Isolate* isolate, Handle<BigInt> base,
                                           Handle<BigInt> exponent);
-  static MaybeHandle<BigInt> Multiply(Handle<BigInt> x, Handle<BigInt> y);
-  static MaybeHandle<BigInt> Divide(Handle<BigInt> x, Handle<BigInt> y);
-  static MaybeHandle<BigInt> Remainder(Handle<BigInt> x, Handle<BigInt> y);
-  static MaybeHandle<BigInt> Add(Handle<BigInt> x, Handle<BigInt> y);
-  static MaybeHandle<BigInt> Subtract(Handle<BigInt> x, Handle<BigInt> y);
-  static MaybeHandle<BigInt> LeftShift(Handle<BigInt> x, Handle<BigInt> y);
-  static MaybeHandle<BigInt> SignedRightShift(Handle<BigInt> x,
+  static MaybeHandle<BigInt> Multiply(Isolate* isolate, Handle<BigInt> x,
+                                      Handle<BigInt> y);
+  static MaybeHandle<BigInt> Divide(Isolate* isolate, Handle<BigInt> x,
+                                    Handle<BigInt> y);
+  static MaybeHandle<BigInt> Remainder(Isolate* isolate, Handle<BigInt> x,
+                                       Handle<BigInt> y);
+  static MaybeHandle<BigInt> Add(Isolate* isolate, Handle<BigInt> x,
+                                 Handle<BigInt> y);
+  static MaybeHandle<BigInt> Subtract(Isolate* isolate, Handle<BigInt> x,
+                                      Handle<BigInt> y);
+  static MaybeHandle<BigInt> LeftShift(Isolate* isolate, Handle<BigInt> x,
+                                       Handle<BigInt> y);
+  static MaybeHandle<BigInt> SignedRightShift(Isolate* isolate,
+                                              Handle<BigInt> x,
                                               Handle<BigInt> y);
-  static MaybeHandle<BigInt> UnsignedRightShift(Handle<BigInt> x,
+  static MaybeHandle<BigInt> UnsignedRightShift(Isolate* isolate,
+                                                Handle<BigInt> x,
                                                 Handle<BigInt> y);
   // More convenient version of "bool LessThan(x, y)".
   static ComparisonResult CompareToBigInt(Handle<BigInt> x, Handle<BigInt> y);
   static bool EqualToBigInt(BigInt* x, BigInt* y);
-  static MaybeHandle<BigInt> BitwiseAnd(Handle<BigInt> x, Handle<BigInt> y);
-  static MaybeHandle<BigInt> BitwiseXor(Handle<BigInt> x, Handle<BigInt> y);
-  static MaybeHandle<BigInt> BitwiseOr(Handle<BigInt> x, Handle<BigInt> y);
+  static MaybeHandle<BigInt> BitwiseAnd(Isolate* isolate, Handle<BigInt> x,
+                                        Handle<BigInt> y);
+  static MaybeHandle<BigInt> BitwiseXor(Isolate* isolate, Handle<BigInt> x,
+                                        Handle<BigInt> y);
+  static MaybeHandle<BigInt> BitwiseOr(Isolate* isolate, Handle<BigInt> x,
+                                       Handle<BigInt> y);
 
   // Other parts of the public interface.
-  static MaybeHandle<BigInt> Increment(Handle<BigInt> x);
-  static MaybeHandle<BigInt> Decrement(Handle<BigInt> x);
+  static MaybeHandle<BigInt> Increment(Isolate* isolate, Handle<BigInt> x);
+  static MaybeHandle<BigInt> Decrement(Isolate* isolate, Handle<BigInt> x);
 
   bool ToBoolean() { return !is_zero(); }
   uint32_t Hash() {
@@ -133,14 +143,18 @@ class V8_EXPORT_PRIVATE BigInt : public BigIntBase {
     return is_zero() ? 0 : ComputeIntegerHash(static_cast<uint32_t>(digit(0)));
   }
 
-  static bool EqualToString(Handle<BigInt> x, Handle<String> y);
+  static bool EqualToString(Isolate* isolate, Handle<BigInt> x,
+                            Handle<String> y);
   static bool EqualToNumber(Handle<BigInt> x, Handle<Object> y);
+  static ComparisonResult CompareToString(Isolate* isolate, Handle<BigInt> x,
+                                          Handle<String> y);
   static ComparisonResult CompareToNumber(Handle<BigInt> x, Handle<Object> y);
   // Exposed for tests, do not call directly. Use CompareToNumber() instead.
   static ComparisonResult CompareToDouble(Handle<BigInt> x, double y);
 
-  static Handle<BigInt> AsIntN(uint64_t n, Handle<BigInt> x);
-  static MaybeHandle<BigInt> AsUintN(uint64_t n, Handle<BigInt> x);
+  static Handle<BigInt> AsIntN(Isolate* isolate, uint64_t n, Handle<BigInt> x);
+  static MaybeHandle<BigInt> AsUintN(Isolate* isolate, uint64_t n,
+                                     Handle<BigInt> x);
 
   static Handle<BigInt> FromInt64(Isolate* isolate, int64_t n);
   static Handle<BigInt> FromUint64(Isolate* isolate, uint64_t n);
@@ -161,11 +175,12 @@ class V8_EXPORT_PRIVATE BigInt : public BigIntBase {
     return kHeaderSize + length * kDigitSize;
   }
 
-  static MaybeHandle<String> ToString(Handle<BigInt> bigint, int radix = 10);
+  static MaybeHandle<String> ToString(Isolate* isolate, Handle<BigInt> bigint,
+                                      int radix = 10);
   // "The Number value for x", see:
   // https://tc39.github.io/ecma262/#sec-ecmascript-language-types-number-type
   // Returns a Smi or HeapNumber.
-  static Handle<Object> ToNumber(Handle<BigInt> x);
+  static Handle<Object> ToNumber(Isolate* isolate, Handle<BigInt> x);
 
   // ECMAScript's NumberToBigInt
   static MaybeHandle<BigInt> FromNumber(Isolate* isolate,
diff --git a/deps/v8/src/objects/code-inl.h b/deps/v8/src/objects/code-inl.h
index 5ac8d766a44819..57e5f2a565c0f8 100644
--- a/deps/v8/src/objects/code-inl.h
+++ b/deps/v8/src/objects/code-inl.h
@@ -7,8 +7,10 @@
 
 #include "src/objects/code.h"
 
+#include "src/interpreter/bytecode-register.h"
 #include "src/isolate.h"
 #include "src/objects/dictionary.h"
+#include "src/objects/map-inl.h"
 #include "src/v8memory.h"
 
 // Has to be the last include (doesn't have include guards):
@@ -17,10 +19,6 @@
 namespace v8 {
 namespace internal {
 
-TYPE_CHECKER(BytecodeArray, BYTECODE_ARRAY_TYPE)
-TYPE_CHECKER(Code, CODE_TYPE)
-TYPE_CHECKER(CodeDataContainer, CODE_DATA_CONTAINER_TYPE)
-
 CAST_ACCESSOR(AbstractCode)
 CAST_ACCESSOR(BytecodeArray)
 CAST_ACCESSOR(Code)
@@ -115,7 +113,7 @@ Address AbstractCode::InstructionEnd() {
   }
 }
 
-bool AbstractCode::contains(byte* inner_pointer) {
+bool AbstractCode::contains(Address inner_pointer) {
   return (address() <= inner_pointer) && (inner_pointer <= address() + Size());
 }
 
@@ -157,10 +155,6 @@ DependentCode::DependencyGroup DependentCode::group() {
   return static_cast<DependencyGroup>(GroupField::decode(flags()));
 }
 
-void DependentCode::set_group(DependentCode::DependencyGroup group) {
-  set_flags(GroupField::update(flags(), static_cast<int>(group)));
-}
-
 void DependentCode::set_object_at(int i, Object* object) {
   set(kCodesStartIndex + i, object);
 }
@@ -175,9 +169,8 @@ void DependentCode::copy(int from, int to) {
 
 INT_ACCESSORS(Code, raw_instruction_size, kInstructionSizeOffset)
 INT_ACCESSORS(Code, handler_table_offset, kHandlerTableOffsetOffset)
-#define CODE_ACCESSORS(name, type, offset)           \
-  ACCESSORS_CHECKED2(Code, name, type, offset, true, \
-                     !GetHeap()->InNewSpace(value))
+#define CODE_ACCESSORS(name, type, offset) \
+  ACCESSORS_CHECKED2(Code, name, type, offset, true, !Heap::InNewSpace(value))
 CODE_ACCESSORS(relocation_info, ByteArray, kRelocationInfoOffset)
 CODE_ACCESSORS(deoptimization_data, FixedArray, kDeoptimizationDataOffset)
 CODE_ACCESSORS(source_position_table, Object, kSourcePositionTableOffset)
@@ -192,10 +185,12 @@ void Code::WipeOutHeader() {
 }
 
 void Code::clear_padding() {
-  memset(address() + kHeaderPaddingStart, 0, kHeaderSize - kHeaderPaddingStart);
+  memset(reinterpret_cast<void*>(address() + kHeaderPaddingStart), 0,
+         kHeaderSize - kHeaderPaddingStart);
   Address data_end =
       has_unwinding_info() ? unwinding_info_end() : raw_instruction_end();
-  memset(data_end, 0, CodeSize() - (data_end - address()));
+  memset(reinterpret_cast<void*>(data_end), 0,
+         CodeSize() - (data_end - address()));
 }
 
 ByteArray* Code::SourcePositionTable() const {
@@ -225,31 +220,34 @@ void Code::set_next_code_link(Object* value) {
 }
 
 int Code::InstructionSize() const {
-#ifdef V8_EMBEDDED_BUILTINS
-  if (Builtins::IsEmbeddedBuiltin(this)) return OffHeapInstructionSize();
-#endif
+  if (is_off_heap_trampoline()) {
+    DCHECK(FLAG_embedded_builtins);
+    return OffHeapInstructionSize();
+  }
   return raw_instruction_size();
 }
 
-byte* Code::raw_instruction_start() const {
-  return const_cast<byte*>(FIELD_ADDR_CONST(this, kHeaderSize));
+Address Code::raw_instruction_start() const {
+  return FIELD_ADDR(this, kHeaderSize);
 }
 
 Address Code::InstructionStart() const {
-#ifdef V8_EMBEDDED_BUILTINS
-  if (Builtins::IsEmbeddedBuiltin(this)) return OffHeapInstructionStart();
-#endif
+  if (is_off_heap_trampoline()) {
+    DCHECK(FLAG_embedded_builtins);
+    return OffHeapInstructionStart();
+  }
   return raw_instruction_start();
 }
 
-byte* Code::raw_instruction_end() const {
+Address Code::raw_instruction_end() const {
   return raw_instruction_start() + raw_instruction_size();
 }
 
 Address Code::InstructionEnd() const {
-#ifdef V8_EMBEDDED_BUILTINS
-  if (Builtins::IsEmbeddedBuiltin(this)) return OffHeapInstructionEnd();
-#endif
+  if (is_off_heap_trampoline()) {
+    DCHECK(FLAG_embedded_builtins);
+    return OffHeapInstructionEnd();
+  }
   return raw_instruction_end();
 }
 
@@ -269,14 +267,12 @@ void Code::set_unwinding_info_size(int value) {
   WRITE_UINT64_FIELD(this, GetUnwindingInfoSizeOffset(), value);
 }
 
-byte* Code::unwinding_info_start() const {
+Address Code::unwinding_info_start() const {
   DCHECK(has_unwinding_info());
-  return const_cast<byte*>(
-             FIELD_ADDR_CONST(this, GetUnwindingInfoSizeOffset())) +
-         kInt64Size;
+  return FIELD_ADDR(this, GetUnwindingInfoSizeOffset()) + kInt64Size;
 }
 
-byte* Code::unwinding_info_end() const {
+Address Code::unwinding_info_end() const {
   DCHECK(has_unwinding_info());
   return unwinding_info_start() + unwinding_info_size();
 }
@@ -304,14 +300,24 @@ byte* Code::relocation_start() const {
   return unchecked_relocation_info()->GetDataStartAddress();
 }
 
+byte* Code::relocation_end() const {
+  return unchecked_relocation_info()->GetDataStartAddress() +
+         unchecked_relocation_info()->length();
+}
+
 int Code::relocation_size() const {
   return unchecked_relocation_info()->length();
 }
 
-byte* Code::entry() const { return raw_instruction_start(); }
+Address Code::entry() const { return raw_instruction_start(); }
 
-bool Code::contains(byte* inner_pointer) {
-  return (address() <= inner_pointer) && (inner_pointer <= address() + Size());
+bool Code::contains(Address inner_pointer) {
+  if (is_off_heap_trampoline()) {
+    DCHECK(FLAG_embedded_builtins);
+    return (OffHeapInstructionStart() <= inner_pointer) &&
+           (inner_pointer < OffHeapInstructionEnd());
+  }
+  return (address() <= inner_pointer) && (inner_pointer < address() + Size());
 }
 
 int Code::ExecutableSize() const {
@@ -328,13 +334,15 @@ Code::Kind Code::kind() const {
 }
 
 void Code::initialize_flags(Kind kind, bool has_unwinding_info,
-                            bool is_turbofanned, int stack_slots) {
+                            bool is_turbofanned, int stack_slots,
+                            bool is_off_heap_trampoline) {
   CHECK(0 <= stack_slots && stack_slots < StackSlotsField::kMax);
   static_assert(Code::NUMBER_OF_KINDS <= KindField::kMax + 1, "field overflow");
   uint32_t flags = HasUnwindingInfoField::encode(has_unwinding_info) |
                    KindField::encode(kind) |
                    IsTurbofannedField::encode(is_turbofanned) |
-                   StackSlotsField::encode(stack_slots);
+                   StackSlotsField::encode(stack_slots) |
+                   IsOffHeapTrampoline::encode(is_off_heap_trampoline);
   WRITE_UINT32_FIELD(this, kFlagsOffset, flags);
   DCHECK_IMPLIES(stack_slots != 0, has_safepoint_info());
 }
@@ -428,6 +436,10 @@ inline void Code::set_is_exception_caught(bool value) {
   code_data_container()->set_kind_specific_flags(updated);
 }
 
+inline bool Code::is_off_heap_trampoline() const {
+  return IsOffHeapTrampoline::decode(READ_UINT32_FIELD(this, kFlagsOffset));
+}
+
 inline HandlerTable::CatchPrediction Code::GetBuiltinCatchPrediction() {
   if (is_promise_rejection()) return HandlerTable::PROMISE;
   if (is_exception_caught()) return HandlerTable::CAUGHT;
@@ -517,10 +529,18 @@ Address Code::constant_pool() const {
       return InstructionStart() + offset;
     }
   }
-  return nullptr;
+  return kNullAddress;
 }
 
 Code* Code::GetCodeFromTargetAddress(Address address) {
+  {
+    // TODO(jgruber,v8:6666): Support embedded builtins here. We'd need to pass
+    // in the current isolate.
+    Address start = reinterpret_cast<Address>(Isolate::CurrentEmbeddedBlob());
+    Address end = start + Isolate::CurrentEmbeddedBlobSize();
+    CHECK(address < start || address >= end);
+  }
+
   HeapObject* code = HeapObject::FromAddress(address - Code::kHeaderSize);
   // GetCodeFromTargetAddress might be called when marking objects during mark
   // sweep. reinterpret_cast is therefore used instead of the more appropriate
@@ -565,7 +585,8 @@ INT_ACCESSORS(CodeDataContainer, kind_specific_flags, kKindSpecificFlagsOffset)
 ACCESSORS(CodeDataContainer, next_code_link, Object, kNextCodeLinkOffset)
 
 void CodeDataContainer::clear_padding() {
-  memset(address() + kUnalignedSize, 0, kSize - kUnalignedSize);
+  memset(reinterpret_cast<void*>(address() + kUnalignedSize), 0,
+         kSize - kUnalignedSize);
 }
 
 byte BytecodeArray::get(int index) {
@@ -669,7 +690,8 @@ ACCESSORS(BytecodeArray, source_position_table, Object,
 
 void BytecodeArray::clear_padding() {
   int data_size = kHeaderSize + length();
-  memset(address() + data_size, 0, SizeFor(length()) - data_size);
+  memset(reinterpret_cast<void*>(address() + data_size), 0,
+         SizeFor(length()) - data_size);
 }
 
 Address BytecodeArray::GetFirstBytecodeAddress() {
diff --git a/deps/v8/src/objects/code.h b/deps/v8/src/objects/code.h
index a33a08d731cbb5..fb39d53983c862 100644
--- a/deps/v8/src/objects/code.h
+++ b/deps/v8/src/objects/code.h
@@ -19,6 +19,10 @@ class ByteArray;
 class BytecodeArray;
 class CodeDataContainer;
 
+namespace interpreter {
+class Register;
+}
+
 // Code describes objects with on-the-fly generated machine code.
 class Code : public HeapObject {
  public:
@@ -48,8 +52,10 @@ class Code : public HeapObject {
   static const char* Kind2String(Kind kind);
 
 #ifdef ENABLE_DISASSEMBLER
+  const char* GetName(Isolate* isolate) const;
+  void PrintBuiltinCode(Isolate* isolate, const char* name);
   void Disassemble(const char* name, std::ostream& os,
-                   void* current_pc = nullptr);  // NOLINT
+                   Address current_pc = kNullAddress);
 #endif
 
   // [instruction_size]: Size of the native instructions, including embedded
@@ -63,13 +69,11 @@ class Code : public HeapObject {
   // off-heap instruction stream rather than the on-heap trampoline located
   // at instruction_start.
   inline int InstructionSize() const;
-#ifdef V8_EMBEDDED_BUILTINS
   int OffHeapInstructionSize() const;
-#endif
 
   // [relocation_info]: Code relocation information
   DECL_ACCESSORS(relocation_info, ByteArray)
-  void InvalidateEmbeddedObjects();
+  void InvalidateEmbeddedObjects(Heap* heap);
 
   // [deoptimization_data]: Array containing data for deopt.
   DECL_ACCESSORS(deoptimization_data, FixedArray)
@@ -178,6 +182,10 @@ class Code : public HeapObject {
   // Use GetBuiltinCatchPrediction to access this.
   inline void set_is_exception_caught(bool flag);
 
+  // [is_off_heap_trampoline]: For kind BUILTIN tells whether
+  // this is a trampoline to an off-heap builtin.
+  inline bool is_off_heap_trampoline() const;
+
   // [constant_pool]: The constant pool for this function.
   inline Address constant_pool() const;
 
@@ -199,7 +207,8 @@ class Code : public HeapObject {
   // Initialize the flags field. Similar to clear_padding above this ensure that
   // the snapshot content is deterministic.
   inline void initialize_flags(Kind kind, bool has_unwinding_info,
-                               bool is_turbofanned, int stack_slots);
+                               bool is_turbofanned, int stack_slots,
+                               bool is_off_heap_trampoline);
 
   // Convert a target address into a code object.
   static inline Code* GetCodeFromTargetAddress(Address address);
@@ -211,26 +220,22 @@ class Code : public HeapObject {
   static inline Object* GetObjectFromCodeEntry(Address code_entry);
 
   // Returns the address of the first instruction.
-  inline byte* raw_instruction_start() const;
+  inline Address raw_instruction_start() const;
 
   // Returns the address of the first instruction. For off-heap code objects
   // this differs from instruction_start (which would point to the off-heap
   // trampoline instead).
   inline Address InstructionStart() const;
-#ifdef V8_EMBEDDED_BUILTINS
   Address OffHeapInstructionStart() const;
-#endif
 
   // Returns the address right after the last instruction.
-  inline byte* raw_instruction_end() const;
+  inline Address raw_instruction_end() const;
 
   // Returns the address right after the last instruction. For off-heap code
   // objects this differs from instruction_end (which would point to the
   // off-heap trampoline instead).
   inline Address InstructionEnd() const;
-#ifdef V8_EMBEDDED_BUILTINS
   Address OffHeapInstructionEnd() const;
-#endif
 
   // Returns the size of the instructions, padding, relocation and unwinding
   // information.
@@ -243,6 +248,9 @@ class Code : public HeapObject {
   // Returns the address of the first relocation info (read backwards!).
   inline byte* relocation_start() const;
 
+  // Returns the address right after the relocation info (read backwards!).
+  inline byte* relocation_end() const;
+
   // [has_unwinding_info]: Whether this code object has unwinding information.
   // If it doesn't, unwinding_information_start() will point to invalid data.
   //
@@ -281,23 +289,30 @@ class Code : public HeapObject {
   inline void set_unwinding_info_size(int value);
 
   // Returns the address of the unwinding information, if any.
-  inline byte* unwinding_info_start() const;
+  inline Address unwinding_info_start() const;
 
   // Returns the address right after the end of the unwinding information.
-  inline byte* unwinding_info_end() const;
+  inline Address unwinding_info_end() const;
 
   // Code entry point.
-  inline byte* entry() const;
+  inline Address entry() const;
 
   // Returns true if pc is inside this object's instructions.
-  inline bool contains(byte* pc);
+  inline bool contains(Address pc);
 
   // Relocate the code by delta bytes. Called to signal that this code
   // object has been moved by delta bytes.
   void Relocate(intptr_t delta);
 
   // Migrate code described by desc.
-  void CopyFrom(const CodeDesc& desc);
+  void CopyFrom(Heap* heap, const CodeDesc& desc);
+
+  // Migrate code from desc without flushing the instruction cache.
+  void CopyFromNoFlush(Heap* heap, const CodeDesc& desc);
+
+  // Flushes the instruction cache for the executable instructions of this code
+  // object.
+  void FlushICache() const;
 
   // Returns the object size for a given body (used for allocation).
   static int SizeFor(int body_size) {
@@ -326,12 +341,11 @@ class Code : public HeapObject {
 
 #ifdef DEBUG
   enum VerifyMode { kNoContextSpecificPointers, kNoContextRetainingPointers };
-  void VerifyEmbeddedObjects(VerifyMode mode = kNoContextRetainingPointers);
+  void VerifyEmbeddedObjects(Isolate* isolate,
+                             VerifyMode mode = kNoContextRetainingPointers);
 #endif  // DEBUG
 
-#ifdef V8_EMBEDDED_BUILTINS
-  bool IsProcessIndependent();
-#endif
+  bool IsIsolateIndependent(Isolate* isolate);
 
   inline bool CanContainWeakObjects();
 
@@ -401,11 +415,13 @@ class Code : public HeapObject {
   V(HasUnwindingInfoField, bool, 1, _) \
   V(KindField, Kind, 5, _)             \
   V(IsTurbofannedField, bool, 1, _)    \
-  V(StackSlotsField, int, 24, _)
+  V(StackSlotsField, int, 24, _)       \
+  V(IsOffHeapTrampoline, bool, 1, _)
   DEFINE_BIT_FIELDS(CODE_FLAGS_BIT_FIELDS)
 #undef CODE_FLAGS_BIT_FIELDS
   static_assert(NUMBER_OF_KINDS <= KindField::kMax, "Code::KindField size");
-  static_assert(StackSlotsField::kNext <= 32, "Code::flags field exhausted");
+  static_assert(IsOffHeapTrampoline::kNext <= 32,
+                "Code::flags field exhausted");
 
   // KindSpecificFlags layout (STUB, BUILTIN and OPTIMIZED_FUNCTION)
 #define CODE_KIND_SPECIFIC_FLAGS_BIT_FIELDS(V, _) \
@@ -424,7 +440,8 @@ class Code : public HeapObject {
       MarkedForDeoptimizationField::kShift;
 
   static const int kArgumentsBits = 16;
-  static const int kMaxArguments = (1 << kArgumentsBits) - 1;
+  // Reserve one argument count value as the "don't adapt arguments" sentinel.
+  static const int kMaxArguments = (1 << kArgumentsBits) - 2;
 
  private:
   friend class RelocIterator;
@@ -533,7 +550,7 @@ class AbstractCode : public HeapObject {
   inline int SizeIncludingMetadata();
 
   // Returns true if pc is inside this object's instructions.
-  inline bool contains(byte* pc);
+  inline bool contains(Address pc);
 
   // Returns the AbstractCode::Kind of the code.
   inline Kind kind();
@@ -572,6 +589,8 @@ class AbstractCode : public HeapObject {
 
 class DependentCode : public FixedArray {
  public:
+  DECL_CAST(DependentCode)
+
   enum DependencyGroup {
     // Group of code that embed a transition to this map, and depend on being
     // deoptimized when the transition is replaced by a new version.
@@ -598,64 +617,60 @@ class DependentCode : public FixedArray {
     kAllocationSiteTransitionChangedGroup
   };
 
-  static const int kGroupCount = kAllocationSiteTransitionChangedGroup + 1;
-  static const int kNextLinkIndex = 0;
-  static const int kFlagsIndex = 1;
-  static const int kCodesStartIndex = 2;
+  // Register a code dependency of {cell} on {object}.
+  static void InstallDependency(Isolate* isolate, Handle<WeakCell> cell,
+                                Handle<HeapObject> object,
+                                DependencyGroup group);
 
   bool Contains(DependencyGroup group, WeakCell* code_cell);
   bool IsEmpty(DependencyGroup group);
 
-  static Handle<DependentCode> InsertCompilationDependencies(
-      Handle<DependentCode> entries, DependencyGroup group,
-      Handle<Foreign> info);
-
-  static Handle<DependentCode> InsertWeakCode(Handle<DependentCode> entries,
-                                              DependencyGroup group,
-                                              Handle<WeakCell> code_cell);
-
-  void UpdateToFinishedCode(DependencyGroup group, Foreign* info,
-                            WeakCell* code_cell);
+  void RemoveCompilationDependencies(DependencyGroup group, Foreign* info);
 
-  void RemoveCompilationDependencies(DependentCode::DependencyGroup group,
-                                     Foreign* info);
+  void DeoptimizeDependentCodeGroup(Isolate* isolate, DependencyGroup group);
 
-  void DeoptimizeDependentCodeGroup(Isolate* isolate,
-                                    DependentCode::DependencyGroup group);
+  bool MarkCodeForDeoptimization(Isolate* isolate, DependencyGroup group);
 
-  bool MarkCodeForDeoptimization(Isolate* isolate,
-                                 DependentCode::DependencyGroup group);
-
-  // The following low-level accessors should only be used by this class
-  // and the mark compact collector.
-  inline DependentCode* next_link();
-  inline void set_next_link(DependentCode* next);
-  inline int count();
-  inline void set_count(int value);
+  // The following low-level accessors are exposed only for tests.
   inline DependencyGroup group();
-  inline void set_group(DependencyGroup group);
   inline Object* object_at(int i);
-  inline void set_object_at(int i, Object* object);
-  inline void clear_at(int i);
-  inline void copy(int from, int to);
-  DECL_CAST(DependentCode)
+  inline int count();
+  inline DependentCode* next_link();
 
+ private:
   static const char* DependencyGroupName(DependencyGroup group);
 
- private:
-  static Handle<DependentCode> Insert(Handle<DependentCode> entries,
-                                      DependencyGroup group,
-                                      Handle<Object> object);
+  // Get/Set {object}'s {DependentCode}.
+  static DependentCode* Get(Handle<HeapObject> object);
+  static void Set(Handle<HeapObject> object, Handle<DependentCode> dep);
+
   static Handle<DependentCode> New(DependencyGroup group, Handle<Object> object,
                                    Handle<DependentCode> next);
   static Handle<DependentCode> EnsureSpace(Handle<DependentCode> entries);
+  static Handle<DependentCode> InsertWeakCode(Handle<DependentCode> entries,
+                                              DependencyGroup group,
+                                              Handle<WeakCell> code_cell);
+
   // Compact by removing cleared weak cells and return true if there was
   // any cleared weak cell.
   bool Compact();
+
   static int Grow(int number_of_entries) {
     if (number_of_entries < 5) return number_of_entries + 1;
     return number_of_entries * 5 / 4;
   }
+
+  static const int kGroupCount = kAllocationSiteTransitionChangedGroup + 1;
+  static const int kNextLinkIndex = 0;
+  static const int kFlagsIndex = 1;
+  static const int kCodesStartIndex = 2;
+
+  inline void set_next_link(DependentCode* next);
+  inline void set_count(int value);
+  inline void set_object_at(int i, Object* object);
+  inline void clear_at(int i);
+  inline void copy(int from, int to);
+
   inline int flags();
   inline void set_flags(int flags);
   class GroupField : public BitField<int, 0, 3> {};
@@ -748,10 +763,10 @@ class BytecodeArray : public FixedArrayBase {
   int SourcePosition(int offset);
   int SourceStatementPosition(int offset);
 
-  DECL_PRINTER(BytecodeArray)
+  DECL_PRINTER_WITH_ISOLATE(BytecodeArray)
   DECL_VERIFIER(BytecodeArray)
 
-  void Disassemble(std::ostream& os);
+  void Disassemble(Isolate* isolate, std::ostream& os);
 
   void CopyBytecodesTo(BytecodeArray* to);
 
diff --git a/deps/v8/src/objects/compilation-cache-inl.h b/deps/v8/src/objects/compilation-cache-inl.h
index 99edc50c968205..cf80ec7076fdb2 100644
--- a/deps/v8/src/objects/compilation-cache-inl.h
+++ b/deps/v8/src/objects/compilation-cache-inl.h
@@ -44,7 +44,7 @@ uint32_t CompilationCacheShape::HashForObject(Isolate* isolate,
   if (object->IsNumber()) return static_cast<uint32_t>(object->Number());
 
   FixedArray* val = FixedArray::cast(object);
-  if (val->map() == val->GetHeap()->fixed_cow_array_map()) {
+  if (val->map() == val->GetReadOnlyRoots().fixed_cow_array_map()) {
     DCHECK_EQ(4, val->length());
     SharedFunctionInfo* shared = SharedFunctionInfo::cast(val->get(0));
     String* source = String::cast(val->get(1));
diff --git a/deps/v8/src/objects/compilation-cache.h b/deps/v8/src/objects/compilation-cache.h
index 5836b010910c8a..e65dc22fb4a080 100644
--- a/deps/v8/src/objects/compilation-cache.h
+++ b/deps/v8/src/objects/compilation-cache.h
@@ -69,10 +69,10 @@ class CompilationCacheTable
     : public HashTable<CompilationCacheTable, CompilationCacheShape> {
  public:
   // Find cached value for a string key, otherwise return null.
-  Handle<Object> Lookup(Handle<String> src, Handle<Context> context,
+  Handle<Object> Lookup(Handle<String> src, Handle<SharedFunctionInfo> shared,
                         LanguageMode language_mode);
   MaybeHandle<SharedFunctionInfo> LookupScript(Handle<String> src,
-                                               Handle<Context> context,
+                                               Handle<Context> native_context,
                                                LanguageMode language_mode);
   InfoCellPair LookupEval(Handle<String> src, Handle<SharedFunctionInfo> shared,
                           Handle<Context> native_context,
@@ -80,12 +80,12 @@ class CompilationCacheTable
   Handle<Object> LookupRegExp(Handle<String> source, JSRegExp::Flags flags);
   static Handle<CompilationCacheTable> Put(Handle<CompilationCacheTable> cache,
                                            Handle<String> src,
-                                           Handle<Context> context,
+                                           Handle<SharedFunctionInfo> shared,
                                            LanguageMode language_mode,
                                            Handle<Object> value);
   static Handle<CompilationCacheTable> PutScript(
       Handle<CompilationCacheTable> cache, Handle<String> src,
-      Handle<Context> context, LanguageMode language_mode,
+      Handle<Context> native_context, LanguageMode language_mode,
       Handle<SharedFunctionInfo> value);
   static Handle<CompilationCacheTable> PutEval(
       Handle<CompilationCacheTable> cache, Handle<String> src,
diff --git a/deps/v8/src/objects/data-handler-inl.h b/deps/v8/src/objects/data-handler-inl.h
index f0650479f7ae5b..ce9b5682c76b7e 100644
--- a/deps/v8/src/objects/data-handler-inl.h
+++ b/deps/v8/src/objects/data-handler-inl.h
@@ -26,8 +26,8 @@ int DataHandler::data_field_count() const {
   return (map()->instance_size() - kSizeWithData0) / kPointerSize;
 }
 
-ACCESSORS_CHECKED(DataHandler, data1, Object, kData1Offset,
-                  map()->instance_size() >= kSizeWithData1)
+WEAK_ACCESSORS_CHECKED(DataHandler, data1, kData1Offset,
+                       map()->instance_size() >= kSizeWithData1)
 ACCESSORS_CHECKED(DataHandler, data2, Object, kData2Offset,
                   map()->instance_size() >= kSizeWithData2)
 ACCESSORS_CHECKED(DataHandler, data3, Object, kData3Offset,
diff --git a/deps/v8/src/objects/data-handler.h b/deps/v8/src/objects/data-handler.h
index 8b3298207fadf3..96fab2e6bc3292 100644
--- a/deps/v8/src/objects/data-handler.h
+++ b/deps/v8/src/objects/data-handler.h
@@ -31,7 +31,7 @@ class DataHandler : public Struct {
 
   // [data1-3]: These are optional general-purpose fields whose content and
   // presence depends on the handler kind.
-  DECL_ACCESSORS(data1, Object)
+  DECL_ACCESSORS(data1, MaybeObject)
   DECL_ACCESSORS(data2, Object)
   DECL_ACCESSORS(data3, Object)
 
@@ -53,6 +53,8 @@ class DataHandler : public Struct {
   DECL_CAST(DataHandler)
 
   DECL_VERIFIER(DataHandler)
+
+  class BodyDescriptor;
 };
 
 }  // namespace internal
diff --git a/deps/v8/src/objects/debug-objects-inl.h b/deps/v8/src/objects/debug-objects-inl.h
index db651d9f4e6e6d..548fb15705923c 100644
--- a/deps/v8/src/objects/debug-objects-inl.h
+++ b/deps/v8/src/objects/debug-objects-inl.h
@@ -6,6 +6,7 @@
 #define V8_OBJECTS_DEBUG_OBJECTS_INL_H_
 
 #include "src/objects/debug-objects.h"
+#include "src/objects/shared-function-info.h"
 
 #include "src/heap/heap-inl.h"
 
@@ -23,28 +24,39 @@ CAST_ACCESSOR(BreakPoint)
 SMI_ACCESSORS(DebugInfo, flags, kFlagsOffset)
 ACCESSORS(DebugInfo, shared, SharedFunctionInfo, kSharedFunctionInfoOffset)
 SMI_ACCESSORS(DebugInfo, debugger_hints, kDebuggerHintsOffset)
-ACCESSORS(DebugInfo, debug_bytecode_array, Object, kDebugBytecodeArrayOffset)
+ACCESSORS(DebugInfo, function_identifier, Object, kFunctionIdentifierOffset)
+ACCESSORS(DebugInfo, original_bytecode_array, Object,
+          kOriginalBytecodeArrayOffset)
 ACCESSORS(DebugInfo, break_points, FixedArray, kBreakPointsStateOffset)
 ACCESSORS(DebugInfo, coverage_info, Object, kCoverageInfoOffset)
 
+BIT_FIELD_ACCESSORS(DebugInfo, debugger_hints, side_effect_state,
+                    DebugInfo::SideEffectStateBits)
+BIT_FIELD_ACCESSORS(DebugInfo, debugger_hints, debug_is_blackboxed,
+                    DebugInfo::DebugIsBlackboxedBit)
+BIT_FIELD_ACCESSORS(DebugInfo, debugger_hints, computed_debug_is_blackboxed,
+                    DebugInfo::ComputedDebugIsBlackboxedBit)
+BIT_FIELD_ACCESSORS(DebugInfo, debugger_hints, debugging_id,
+                    DebugInfo::DebuggingIdBits)
+
 SMI_ACCESSORS(BreakPointInfo, source_position, kSourcePositionOffset)
 ACCESSORS(BreakPointInfo, break_points, Object, kBreakPointsOffset)
 
 SMI_ACCESSORS(BreakPoint, id, kIdOffset)
 ACCESSORS(BreakPoint, condition, String, kConditionOffset)
 
-bool DebugInfo::HasDebugBytecodeArray() {
-  return debug_bytecode_array()->IsBytecodeArray();
+bool DebugInfo::HasInstrumentedBytecodeArray() {
+  return original_bytecode_array()->IsBytecodeArray();
 }
 
 BytecodeArray* DebugInfo::OriginalBytecodeArray() {
-  DCHECK(HasDebugBytecodeArray());
-  return shared()->GetBytecodeArray();
+  DCHECK(HasInstrumentedBytecodeArray());
+  return BytecodeArray::cast(original_bytecode_array());
 }
 
 BytecodeArray* DebugInfo::DebugBytecodeArray() {
-  DCHECK(HasDebugBytecodeArray());
-  return BytecodeArray::cast(debug_bytecode_array());
+  DCHECK(HasInstrumentedBytecodeArray());
+  return shared()->GetDebugBytecodeArray();
 }
 
 }  // namespace internal
diff --git a/deps/v8/src/objects/debug-objects.cc b/deps/v8/src/objects/debug-objects.cc
index f79aa5cea5bbdd..b77b6e136e53d5 100644
--- a/deps/v8/src/objects/debug-objects.cc
+++ b/deps/v8/src/objects/debug-objects.cc
@@ -3,12 +3,15 @@
 // found in the LICENSE file.
 
 #include "src/objects/debug-objects.h"
+#include "src/debug/debug-evaluate.h"
 #include "src/objects/debug-objects-inl.h"
 
 namespace v8 {
 namespace internal {
 
-bool DebugInfo::IsEmpty() const { return flags() == kNone; }
+bool DebugInfo::IsEmpty() const {
+  return flags() == kNone && debugger_hints() == 0;
+}
 
 bool DebugInfo::HasBreakInfo() const { return (flags() & kHasBreakInfo) != 0; }
 
@@ -21,19 +24,20 @@ void DebugInfo::SetDebugExecutionMode(ExecutionMode value) {
                                   : (flags() & ~kDebugExecutionMode));
 }
 
-bool DebugInfo::ClearBreakInfo() {
-  Isolate* isolate = GetIsolate();
-
-  set_debug_bytecode_array(isolate->heap()->undefined_value());
-  set_break_points(isolate->heap()->empty_fixed_array());
+void DebugInfo::ClearBreakInfo(Isolate* isolate) {
+  if (HasInstrumentedBytecodeArray()) {
+    // Reset function's bytecode array field to point to the original bytecode
+    // array.
+    shared()->SetDebugBytecodeArray(OriginalBytecodeArray());
+    set_original_bytecode_array(ReadOnlyRoots(isolate).undefined_value());
+  }
+  set_break_points(ReadOnlyRoots(isolate).empty_fixed_array());
 
   int new_flags = flags();
   new_flags &= ~kHasBreakInfo & ~kPreparedForDebugExecution;
   new_flags &= ~kBreakAtEntry & ~kCanBreakAtEntry;
   new_flags &= ~kDebugExecutionMode;
   set_flags(new_flags);
-
-  return new_flags == kNone;
 }
 
 void DebugInfo::SetBreakAtEntry() {
@@ -53,21 +57,21 @@ bool DebugInfo::CanBreakAtEntry() const {
 }
 
 // Check if there is a break point at this source position.
-bool DebugInfo::HasBreakPoint(int source_position) {
+bool DebugInfo::HasBreakPoint(Isolate* isolate, int source_position) {
   DCHECK(HasBreakInfo());
   // Get the break point info object for this code offset.
-  Object* break_point_info = GetBreakPointInfo(source_position);
+  Object* break_point_info = GetBreakPointInfo(isolate, source_position);
 
   // If there is no break point info object or no break points in the break
   // point info object there is no break point at this code offset.
-  if (break_point_info->IsUndefined(GetIsolate())) return false;
-  return BreakPointInfo::cast(break_point_info)->GetBreakPointCount() > 0;
+  if (break_point_info->IsUndefined(isolate)) return false;
+  return BreakPointInfo::cast(break_point_info)->GetBreakPointCount(isolate) >
+         0;
 }
 
 // Get the break point info object for this source position.
-Object* DebugInfo::GetBreakPointInfo(int source_position) {
+Object* DebugInfo::GetBreakPointInfo(Isolate* isolate, int source_position) {
   DCHECK(HasBreakInfo());
-  Isolate* isolate = GetIsolate();
   for (int i = 0; i < break_points()->length(); i++) {
     if (!break_points()->get(i)->IsUndefined(isolate)) {
       BreakPointInfo* break_point_info =
@@ -77,35 +81,33 @@ Object* DebugInfo::GetBreakPointInfo(int source_position) {
       }
     }
   }
-  return isolate->heap()->undefined_value();
+  return ReadOnlyRoots(isolate).undefined_value();
 }
 
-bool DebugInfo::ClearBreakPoint(Handle<DebugInfo> debug_info,
+bool DebugInfo::ClearBreakPoint(Isolate* isolate, Handle<DebugInfo> debug_info,
                                 Handle<BreakPoint> break_point) {
   DCHECK(debug_info->HasBreakInfo());
-  Isolate* isolate = debug_info->GetIsolate();
-
   for (int i = 0; i < debug_info->break_points()->length(); i++) {
     if (debug_info->break_points()->get(i)->IsUndefined(isolate)) continue;
     Handle<BreakPointInfo> break_point_info = Handle<BreakPointInfo>(
         BreakPointInfo::cast(debug_info->break_points()->get(i)), isolate);
-    if (BreakPointInfo::HasBreakPoint(break_point_info, break_point)) {
-      BreakPointInfo::ClearBreakPoint(break_point_info, break_point);
+    if (BreakPointInfo::HasBreakPoint(isolate, break_point_info, break_point)) {
+      BreakPointInfo::ClearBreakPoint(isolate, break_point_info, break_point);
       return true;
     }
   }
   return false;
 }
 
-void DebugInfo::SetBreakPoint(Handle<DebugInfo> debug_info, int source_position,
+void DebugInfo::SetBreakPoint(Isolate* isolate, Handle<DebugInfo> debug_info,
+                              int source_position,
                               Handle<BreakPoint> break_point) {
   DCHECK(debug_info->HasBreakInfo());
-  Isolate* isolate = debug_info->GetIsolate();
   Handle<Object> break_point_info(
-      debug_info->GetBreakPointInfo(source_position), isolate);
+      debug_info->GetBreakPointInfo(isolate, source_position), isolate);
   if (!break_point_info->IsUndefined(isolate)) {
     BreakPointInfo::SetBreakPoint(
-        Handle<BreakPointInfo>::cast(break_point_info), break_point);
+        isolate, Handle<BreakPointInfo>::cast(break_point_info), break_point);
     return;
   }
 
@@ -138,15 +140,15 @@ void DebugInfo::SetBreakPoint(Handle<DebugInfo> debug_info, int source_position,
   // Allocate new BreakPointInfo object and set the break point.
   Handle<BreakPointInfo> new_break_point_info =
       isolate->factory()->NewBreakPointInfo(source_position);
-  BreakPointInfo::SetBreakPoint(new_break_point_info, break_point);
+  BreakPointInfo::SetBreakPoint(isolate, new_break_point_info, break_point);
   debug_info->break_points()->set(index, *new_break_point_info);
 }
 
 // Get the break point objects for a source position.
-Handle<Object> DebugInfo::GetBreakPoints(int source_position) {
+Handle<Object> DebugInfo::GetBreakPoints(Isolate* isolate,
+                                         int source_position) {
   DCHECK(HasBreakInfo());
-  Object* break_point_info = GetBreakPointInfo(source_position);
-  Isolate* isolate = GetIsolate();
+  Object* break_point_info = GetBreakPointInfo(isolate, source_position);
   if (break_point_info->IsUndefined(isolate)) {
     return isolate->factory()->undefined_value();
   }
@@ -155,29 +157,29 @@ Handle<Object> DebugInfo::GetBreakPoints(int source_position) {
 }
 
 // Get the total number of break points.
-int DebugInfo::GetBreakPointCount() {
+int DebugInfo::GetBreakPointCount(Isolate* isolate) {
   DCHECK(HasBreakInfo());
-  Isolate* isolate = GetIsolate();
   int count = 0;
   for (int i = 0; i < break_points()->length(); i++) {
     if (!break_points()->get(i)->IsUndefined(isolate)) {
       BreakPointInfo* break_point_info =
           BreakPointInfo::cast(break_points()->get(i));
-      count += break_point_info->GetBreakPointCount();
+      count += break_point_info->GetBreakPointCount(isolate);
     }
   }
   return count;
 }
 
-Handle<Object> DebugInfo::FindBreakPointInfo(Handle<DebugInfo> debug_info,
+Handle<Object> DebugInfo::FindBreakPointInfo(Isolate* isolate,
+                                             Handle<DebugInfo> debug_info,
                                              Handle<BreakPoint> break_point) {
   DCHECK(debug_info->HasBreakInfo());
-  Isolate* isolate = debug_info->GetIsolate();
   for (int i = 0; i < debug_info->break_points()->length(); i++) {
     if (!debug_info->break_points()->get(i)->IsUndefined(isolate)) {
       Handle<BreakPointInfo> break_point_info = Handle<BreakPointInfo>(
           BreakPointInfo::cast(debug_info->break_points()->get(i)), isolate);
-      if (BreakPointInfo::HasBreakPoint(break_point_info, break_point)) {
+      if (BreakPointInfo::HasBreakPoint(isolate, break_point_info,
+                                        break_point)) {
         return break_point_info;
       }
     }
@@ -189,16 +191,23 @@ bool DebugInfo::HasCoverageInfo() const {
   return (flags() & kHasCoverageInfo) != 0;
 }
 
-bool DebugInfo::ClearCoverageInfo() {
+void DebugInfo::ClearCoverageInfo(Isolate* isolate) {
   if (HasCoverageInfo()) {
-    Isolate* isolate = GetIsolate();
-
-    set_coverage_info(isolate->heap()->undefined_value());
+    set_coverage_info(ReadOnlyRoots(isolate).undefined_value());
 
     int new_flags = flags() & ~kHasCoverageInfo;
     set_flags(new_flags);
   }
-  return flags() == kNone;
+}
+
+DebugInfo::SideEffectState DebugInfo::GetSideEffectState(Isolate* isolate) {
+  if (side_effect_state() == kNotComputed) {
+    SideEffectState has_no_side_effect =
+        DebugEvaluate::FunctionGetSideEffectState(isolate,
+                                                  handle(shared(), isolate));
+    set_side_effect_state(has_no_side_effect);
+  }
+  return static_cast<SideEffectState>(side_effect_state());
 }
 
 namespace {
@@ -208,23 +217,24 @@ bool IsEqual(BreakPoint* break_point1, BreakPoint* break_point2) {
 }  // namespace
 
 // Remove the specified break point object.
-void BreakPointInfo::ClearBreakPoint(Handle<BreakPointInfo> break_point_info,
+void BreakPointInfo::ClearBreakPoint(Isolate* isolate,
+                                     Handle<BreakPointInfo> break_point_info,
                                      Handle<BreakPoint> break_point) {
-  Isolate* isolate = break_point_info->GetIsolate();
   // If there are no break points just ignore.
   if (break_point_info->break_points()->IsUndefined(isolate)) return;
   // If there is a single break point clear it if it is the same.
   if (!break_point_info->break_points()->IsFixedArray()) {
     if (IsEqual(BreakPoint::cast(break_point_info->break_points()),
                 *break_point)) {
-      break_point_info->set_break_points(isolate->heap()->undefined_value());
+      break_point_info->set_break_points(
+          ReadOnlyRoots(isolate).undefined_value());
     }
     return;
   }
   // If there are multiple break points shrink the array
   DCHECK(break_point_info->break_points()->IsFixedArray());
-  Handle<FixedArray> old_array =
-      Handle<FixedArray>(FixedArray::cast(break_point_info->break_points()));
+  Handle<FixedArray> old_array = Handle<FixedArray>(
+      FixedArray::cast(break_point_info->break_points()), isolate);
   Handle<FixedArray> new_array =
       isolate->factory()->NewFixedArray(old_array->length() - 1);
   int found_count = 0;
@@ -241,10 +251,9 @@ void BreakPointInfo::ClearBreakPoint(Handle<BreakPointInfo> break_point_info,
 }
 
 // Add the specified break point object.
-void BreakPointInfo::SetBreakPoint(Handle<BreakPointInfo> break_point_info,
+void BreakPointInfo::SetBreakPoint(Isolate* isolate,
+                                   Handle<BreakPointInfo> break_point_info,
                                    Handle<BreakPoint> break_point) {
-  Isolate* isolate = break_point_info->GetIsolate();
-
   // If there was no break point objects before just set it.
   if (break_point_info->break_points()->IsUndefined(isolate)) {
     break_point_info->set_break_points(*break_point);
@@ -261,8 +270,8 @@ void BreakPointInfo::SetBreakPoint(Handle<BreakPointInfo> break_point_info,
     return;
   }
   // If there was more than one break point before extend array.
-  Handle<FixedArray> old_array =
-      Handle<FixedArray>(FixedArray::cast(break_point_info->break_points()));
+  Handle<FixedArray> old_array = Handle<FixedArray>(
+      FixedArray::cast(break_point_info->break_points()), isolate);
   Handle<FixedArray> new_array =
       isolate->factory()->NewFixedArray(old_array->length() + 1);
   for (int i = 0; i < old_array->length(); i++) {
@@ -275,10 +284,10 @@ void BreakPointInfo::SetBreakPoint(Handle<BreakPointInfo> break_point_info,
   break_point_info->set_break_points(*new_array);
 }
 
-bool BreakPointInfo::HasBreakPoint(Handle<BreakPointInfo> break_point_info,
+bool BreakPointInfo::HasBreakPoint(Isolate* isolate,
+                                   Handle<BreakPointInfo> break_point_info,
                                    Handle<BreakPoint> break_point) {
   // No break point.
-  Isolate* isolate = break_point_info->GetIsolate();
   if (break_point_info->break_points()->IsUndefined(isolate)) {
     return false;
   }
@@ -298,9 +307,9 @@ bool BreakPointInfo::HasBreakPoint(Handle<BreakPointInfo> break_point_info,
 }
 
 // Get the number of break points.
-int BreakPointInfo::GetBreakPointCount() {
+int BreakPointInfo::GetBreakPointCount(Isolate* isolate) {
   // No break point.
-  if (break_points()->IsUndefined(GetIsolate())) return 0;
+  if (break_points()->IsUndefined(isolate)) return 0;
   // Single break point.
   if (!break_points()->IsFixedArray()) return 1;
   // Multiple break points.
@@ -355,7 +364,7 @@ void CoverageInfo::Print(std::unique_ptr<char[]> function_name) {
   DCHECK(FLAG_trace_block_coverage);
   DisallowHeapAllocation no_gc;
 
-  OFStream os(stdout);
+  StdoutStream os;
   os << "Coverage info (";
   if (strlen(function_name.get()) > 0) {
     os << function_name.get();
diff --git a/deps/v8/src/objects/debug-objects.h b/deps/v8/src/objects/debug-objects.h
index f3e0256ae39f6f..45d26d882f3e60 100644
--- a/deps/v8/src/objects/debug-objects.h
+++ b/deps/v8/src/objects/debug-objects.h
@@ -42,6 +42,9 @@ class DebugInfo : public Struct {
   // Bit field containing various information collected for debugging.
   DECL_INT_ACCESSORS(debugger_hints)
 
+  // Function identifier field from shared function info.
+  DECL_ACCESSORS(function_identifier, Object)
+
   // DebugInfo can be detached from the SharedFunctionInfo iff it is empty.
   bool IsEmpty() const;
 
@@ -56,7 +59,10 @@ class DebugInfo : public Struct {
   ExecutionMode DebugExecutionMode() const;
   void SetDebugExecutionMode(ExecutionMode value);
 
-  inline bool HasDebugBytecodeArray();
+  // Specifies whether the associated function has an instrumented bytecode
+  // array. If so, OriginalBytecodeArray returns the non-instrumented bytecode,
+  // and DebugBytecodeArray returns the instrumented bytecode.
+  inline bool HasInstrumentedBytecodeArray();
 
   inline BytecodeArray* OriginalBytecodeArray();
   inline BytecodeArray* DebugBytecodeArray();
@@ -66,9 +72,8 @@ class DebugInfo : public Struct {
 
   bool HasBreakInfo() const;
 
-  // Clears all fields related to break points. Returns true iff the
-  // DebugInfo is now empty.
-  bool ClearBreakInfo();
+  // Clears all fields related to break points.
+  void ClearBreakInfo(Isolate* isolate);
 
   // Accessors to flag whether to break before entering the function.
   // This is used to break for functions with no source, e.g. builtins.
@@ -76,40 +81,79 @@ class DebugInfo : public Struct {
   void ClearBreakAtEntry();
   bool BreakAtEntry() const;
 
-  // The instrumented bytecode array for functions with break points.
-  DECL_ACCESSORS(debug_bytecode_array, Object)
+  // The original uninstrumented bytecode array for functions with break
+  // points - the instrumented bytecode is held in the shared function info.
+  DECL_ACCESSORS(original_bytecode_array, Object)
 
   // Fixed array holding status information for each active break point.
   DECL_ACCESSORS(break_points, FixedArray)
 
   // Check if there is a break point at a source position.
-  bool HasBreakPoint(int source_position);
+  bool HasBreakPoint(Isolate* isolate, int source_position);
   // Attempt to clear a break point. Return true if successful.
-  static bool ClearBreakPoint(Handle<DebugInfo> debug_info,
+  static bool ClearBreakPoint(Isolate* isolate, Handle<DebugInfo> debug_info,
                               Handle<BreakPoint> break_point);
   // Set a break point.
-  static void SetBreakPoint(Handle<DebugInfo> debug_info, int source_position,
+  static void SetBreakPoint(Isolate* isolate, Handle<DebugInfo> debug_info,
+                            int source_position,
                             Handle<BreakPoint> break_point);
   // Get the break point objects for a source position.
-  Handle<Object> GetBreakPoints(int source_position);
+  Handle<Object> GetBreakPoints(Isolate* isolate, int source_position);
   // Find the break point info holding this break point object.
-  static Handle<Object> FindBreakPointInfo(Handle<DebugInfo> debug_info,
+  static Handle<Object> FindBreakPointInfo(Isolate* isolate,
+                                           Handle<DebugInfo> debug_info,
                                            Handle<BreakPoint> break_point);
   // Get the number of break points for this function.
-  int GetBreakPointCount();
+  int GetBreakPointCount(Isolate* isolate);
 
   // Returns whether we should be able to break before entering the function.
   // This is true for functions with no source, e.g. builtins.
   bool CanBreakAtEntry() const;
 
+  // --- Debugger hint flags ---
+  // ---------------------------
+
+  // Indicates that the function should be skipped during stepping.
+  DECL_BOOLEAN_ACCESSORS(debug_is_blackboxed)
+
+  // Indicates that |debug_is_blackboxed| has been computed and set.
+  DECL_BOOLEAN_ACCESSORS(computed_debug_is_blackboxed)
+
+  // Indicates the side effect state.
+  DECL_INT_ACCESSORS(side_effect_state)
+
+  enum SideEffectState {
+    kNotComputed = 0,
+    kHasSideEffects = 1,
+    kRequiresRuntimeChecks = 2,
+    kHasNoSideEffect = 3,
+  };
+
+  SideEffectState GetSideEffectState(Isolate* isolate);
+
+  // Id assigned to the function for debugging.
+  // This could also be implemented as a weak hash table.
+  DECL_INT_ACCESSORS(debugging_id);
+
+// Bit positions in |debugger_hints|.
+#define DEBUGGER_HINTS_BIT_FIELDS(V, _)       \
+  V(SideEffectStateBits, int, 2, _)           \
+  V(DebugIsBlackboxedBit, bool, 1, _)         \
+  V(ComputedDebugIsBlackboxedBit, bool, 1, _) \
+  V(DebuggingIdBits, int, 20, _)
+
+  DEFINE_BIT_FIELDS(DEBUGGER_HINTS_BIT_FIELDS)
+#undef DEBUGGER_HINTS_BIT_FIELDS
+
+  static const int kNoDebuggingId = 0;
+
   // --- Block Coverage ---
   // ----------------------
 
   bool HasCoverageInfo() const;
 
-  // Clears all fields related to block coverage. Returns true iff the
-  // DebugInfo is now empty.
-  bool ClearCoverageInfo();
+  // Clears all fields related to block coverage.
+  void ClearCoverageInfo(Isolate* isolate);
   DECL_ACCESSORS(coverage_info, Object)
 
   DECL_CAST(DebugInfo)
@@ -121,10 +165,12 @@ class DebugInfo : public Struct {
   static const int kSharedFunctionInfoOffset = Struct::kHeaderSize;
   static const int kDebuggerHintsOffset =
       kSharedFunctionInfoOffset + kPointerSize;
-  static const int kDebugBytecodeArrayOffset =
+  static const int kFunctionIdentifierOffset =
       kDebuggerHintsOffset + kPointerSize;
+  static const int kOriginalBytecodeArrayOffset =
+      kFunctionIdentifierOffset + kPointerSize;
   static const int kBreakPointsStateOffset =
-      kDebugBytecodeArrayOffset + kPointerSize;
+      kOriginalBytecodeArrayOffset + kPointerSize;
   static const int kFlagsOffset = kBreakPointsStateOffset + kPointerSize;
   static const int kCoverageInfoOffset = kFlagsOffset + kPointerSize;
   static const int kSize = kCoverageInfoOffset + kPointerSize;
@@ -133,7 +179,7 @@ class DebugInfo : public Struct {
 
  private:
   // Get the break point info object for a source position.
-  Object* GetBreakPointInfo(int source_position);
+  Object* GetBreakPointInfo(Isolate* isolate, int source_position);
 
   DISALLOW_IMPLICIT_CONSTRUCTORS(DebugInfo);
 };
@@ -149,16 +195,16 @@ class BreakPointInfo : public Tuple2 {
   DECL_ACCESSORS(break_points, Object)
 
   // Removes a break point.
-  static void ClearBreakPoint(Handle<BreakPointInfo> info,
+  static void ClearBreakPoint(Isolate* isolate, Handle<BreakPointInfo> info,
                               Handle<BreakPoint> break_point);
   // Set a break point.
-  static void SetBreakPoint(Handle<BreakPointInfo> info,
+  static void SetBreakPoint(Isolate* isolate, Handle<BreakPointInfo> info,
                             Handle<BreakPoint> break_point);
   // Check if break point info has this break point.
-  static bool HasBreakPoint(Handle<BreakPointInfo> info,
+  static bool HasBreakPoint(Isolate* isolate, Handle<BreakPointInfo> info,
                             Handle<BreakPoint> break_point);
   // Get the number of break points for this code offset.
-  int GetBreakPointCount();
+  int GetBreakPointCount(Isolate* isolate);
 
   int GetStatementPosition(Handle<DebugInfo> debug_info);
 
diff --git a/deps/v8/src/objects/descriptor-array.h b/deps/v8/src/objects/descriptor-array.h
index f520cfb2e0f7e0..9e2b7783a50040 100644
--- a/deps/v8/src/objects/descriptor-array.h
+++ b/deps/v8/src/objects/descriptor-array.h
@@ -44,7 +44,10 @@ class EnumCache : public Tuple2 {
 //   [4]: first value for constants | Smi(1) when not used
 //
 //   [2 + number of descriptors * 3]: start of slack
-class DescriptorArray : public FixedArray {
+// The "value" fields store either values or field types. A field type is either
+// FieldType::None(), FieldType::Any() or a weak reference to a Map. All other
+// references are strong.
+class DescriptorArray : public WeakFixedArray {
  public:
   // Returns the number of descriptors in the array.
   inline int number_of_descriptors() const;
@@ -66,12 +69,13 @@ class DescriptorArray : public FixedArray {
   // Accessors for fetching instance descriptor at descriptor number.
   inline Name* GetKey(int descriptor_number);
   inline Object** GetKeySlot(int descriptor_number);
-  inline Object* GetValue(int descriptor_number);
+  inline Object* GetStrongValue(int descriptor_number);
   inline void SetValue(int descriptor_number, Object* value);
-  inline Object** GetValueSlot(int descriptor_number);
+  inline MaybeObject* GetValue(int descriptor_number);
+  inline MaybeObject** GetValueSlot(int descriptor_number);
   static inline int GetValueOffset(int descriptor_number);
-  inline Object** GetDescriptorStartSlot(int descriptor_number);
-  inline Object** GetDescriptorEndSlot(int descriptor_number);
+  inline MaybeObject** GetDescriptorStartSlot(int descriptor_number);
+  inline MaybeObject** GetDescriptorEndSlot(int descriptor_number);
   inline PropertyDetails GetDetails(int descriptor_number);
   inline int GetFieldIndex(int descriptor_number);
   inline FieldType* GetFieldType(int descriptor_number);
@@ -83,7 +87,7 @@ class DescriptorArray : public FixedArray {
   // Accessor for complete descriptor.
   inline void Get(int descriptor_number, Descriptor* desc);
   inline void Set(int descriptor_number, Descriptor* desc);
-  inline void Set(int descriptor_number, Name* key, Object* value,
+  inline void Set(int descriptor_number, Name* key, MaybeObject* value,
                   PropertyDetails details);
   void Replace(int descriptor_number, Descriptor* descriptor);
 
@@ -96,22 +100,24 @@ class DescriptorArray : public FixedArray {
   // array.
   inline void Append(Descriptor* desc);
 
-  static Handle<DescriptorArray> CopyUpTo(Handle<DescriptorArray> desc,
+  static Handle<DescriptorArray> CopyUpTo(Isolate* isolate,
+                                          Handle<DescriptorArray> desc,
                                           int enumeration_index, int slack = 0);
 
   static Handle<DescriptorArray> CopyUpToAddAttributes(
-      Handle<DescriptorArray> desc, int enumeration_index,
+      Isolate* isolate, Handle<DescriptorArray> desc, int enumeration_index,
       PropertyAttributes attributes, int slack = 0);
 
   // Sort the instance descriptors by the hash codes of their keys.
   void Sort();
 
   // Search the instance descriptors for given name.
-  INLINE(int Search(Name* name, int number_of_own_descriptors));
+  V8_INLINE int Search(Name* name, int number_of_own_descriptors);
+  V8_INLINE int Search(Name* name, Map* map);
 
   // As the above, but uses DescriptorLookupCache and updates it when
   // necessary.
-  INLINE(int SearchWithCache(Isolate* isolate, Name* name, Map* map));
+  V8_INLINE int SearchWithCache(Isolate* isolate, Name* name, Map* map);
 
   bool IsEqualUpTo(DescriptorArray* desc, int nof_descriptors);
 
@@ -143,20 +149,16 @@ class DescriptorArray : public FixedArray {
   static const int kEntrySize = 3;
 
   // Print all the descriptors.
-  void PrintDescriptors(std::ostream& os);  // NOLINT
+  void PrintDescriptors(std::ostream& os);
   void PrintDescriptorDetails(std::ostream& os, int descriptor,
                               PropertyDetails::PrintMode mode);
 
-#if defined(DEBUG) || defined(OBJECT_PRINT)
-  // For our gdb macros, we should perhaps change these in the future.
-  void Print();
-#endif
-
+  DECL_PRINTER(DescriptorArray)
   DECL_VERIFIER(DescriptorArray)
 
 #ifdef DEBUG
   // Is the descriptor array sorted and without duplicates?
-  bool IsSortedNoDuplicates(int valid_descriptors = -1);
+  bool IsSortedNoDuplicates(Isolate* isolate, int valid_descriptors = -1);
 
   // Are two DescriptorArrays equal?
   bool IsEqualTo(DescriptorArray* other);
@@ -182,6 +184,9 @@ class DescriptorArray : public FixedArray {
   }
 
  private:
+  inline MaybeObject* get(int index) const;
+  inline void set(int index, MaybeObject* value);
+
   // Transfer a complete descriptor from the src descriptor array to this
   // descriptor array.
   void CopyFrom(int index, DescriptorArray* src);
diff --git a/deps/v8/src/objects/dictionary.h b/deps/v8/src/objects/dictionary.h
index 4aca71d5639fc2..aeb094d6755c73 100644
--- a/deps/v8/src/objects/dictionary.h
+++ b/deps/v8/src/objects/dictionary.h
@@ -169,7 +169,7 @@ class BaseNameDictionary : public Dictionary<Derived, Shape> {
   // Copies enumerable keys to preallocated fixed array.
   // Does not throw for uninitialized exports in module namespace objects, so
   // this has to be checked separately.
-  static void CopyEnumKeysTo(Handle<Derived> dictionary,
+  static void CopyEnumKeysTo(Isolate* isolate, Handle<Derived> dictionary,
                              Handle<FixedArray> storage, KeyCollectionMode mode,
                              KeyAccumulator* accumulator);
 
@@ -301,6 +301,7 @@ class NumberDictionary
     : public Dictionary<NumberDictionary, NumberDictionaryShape> {
  public:
   DECL_CAST(NumberDictionary)
+  DECL_PRINTER(NumberDictionary)
 
   // Type specific at put (default NONE attributes is used when adding).
   V8_WARN_UNUSED_RESULT static Handle<NumberDictionary> Set(
diff --git a/deps/v8/src/objects/fixed-array-inl.h b/deps/v8/src/objects/fixed-array-inl.h
index 8c708f48cfadca..45107ce7fe00d6 100644
--- a/deps/v8/src/objects/fixed-array-inl.h
+++ b/deps/v8/src/objects/fixed-array-inl.h
@@ -5,7 +5,9 @@
 #ifndef V8_OBJECTS_FIXED_ARRAY_INL_H_
 #define V8_OBJECTS_FIXED_ARRAY_INL_H_
 
-#include "src/objects.h"
+#include "src/objects/fixed-array.h"
+
+#include "src/objects/bigint.h"
 
 // Has to be the last include (doesn't have include guards):
 #include "src/objects/object-macros.h"
@@ -13,12 +15,6 @@
 namespace v8 {
 namespace internal {
 
-TYPE_CHECKER(ByteArray, BYTE_ARRAY_TYPE)
-TYPE_CHECKER(FixedArrayExact, FIXED_ARRAY_TYPE)
-TYPE_CHECKER(FixedDoubleArray, FIXED_DOUBLE_ARRAY_TYPE)
-TYPE_CHECKER(FixedArrayOfWeakCells, FIXED_ARRAY_TYPE)
-TYPE_CHECKER(WeakFixedArray, WEAK_FIXED_ARRAY_TYPE)
-
 CAST_ACCESSOR(ArrayList)
 CAST_ACCESSOR(ByteArray)
 CAST_ACCESSOR(FixedArray)
@@ -28,12 +24,17 @@ CAST_ACCESSOR(FixedTypedArrayBase)
 CAST_ACCESSOR(TemplateList)
 CAST_ACCESSOR(FixedArrayOfWeakCells)
 CAST_ACCESSOR(WeakFixedArray)
+CAST_ACCESSOR(WeakArrayList)
 
 SMI_ACCESSORS(FixedArrayBase, length, kLengthOffset)
 SYNCHRONIZED_SMI_ACCESSORS(FixedArrayBase, length, kLengthOffset)
 SMI_ACCESSORS(WeakFixedArray, length, kLengthOffset)
 SYNCHRONIZED_SMI_ACCESSORS(WeakFixedArray, length, kLengthOffset)
 
+SMI_ACCESSORS(WeakArrayList, capacity, kCapacityOffset)
+SYNCHRONIZED_SMI_ACCESSORS(WeakArrayList, capacity, kCapacityOffset)
+SMI_ACCESSORS(WeakArrayList, length, kLengthOffset)
+
 Object* FixedArrayBase::unchecked_synchronized_length() const {
   return ACQUIRE_READ_FIELD(this, kLengthOffset);
 }
@@ -45,7 +46,7 @@ Object** FixedArray::GetFirstElementAddress() {
 }
 
 bool FixedArray::ContainsOnlySmisOrHoles() {
-  Object* the_hole = GetHeap()->the_hole_value();
+  Object* the_hole = GetReadOnlyRoots().the_hole_value();
   Object** current = GetFirstElementAddress();
   for (int i = 0; i < length(); ++i) {
     Object* candidate = *current++;
@@ -55,7 +56,7 @@ bool FixedArray::ContainsOnlySmisOrHoles() {
 }
 
 Object* FixedArray::get(int index) const {
-  SLOW_DCHECK(index >= 0 && index < this->length());
+  DCHECK(index >= 0 && index < this->length());
   return RELAXED_READ_FIELD(this, kHeaderSize + index * kPointerSize);
 }
 
@@ -82,7 +83,7 @@ bool FixedArray::is_the_hole(Isolate* isolate, int index) {
 }
 
 void FixedArray::set(int index, Smi* value) {
-  DCHECK_NE(map(), GetHeap()->fixed_cow_array_map());
+  DCHECK_NE(map(), GetReadOnlyRoots().fixed_cow_array_map());
   DCHECK_LT(index, this->length());
   DCHECK(reinterpret_cast<Object*>(value)->IsSmi());
   int offset = kHeaderSize + index * kPointerSize;
@@ -90,58 +91,71 @@ void FixedArray::set(int index, Smi* value) {
 }
 
 void FixedArray::set(int index, Object* value) {
-  DCHECK_NE(GetHeap()->fixed_cow_array_map(), map());
+  DCHECK_NE(GetReadOnlyRoots().fixed_cow_array_map(), map());
   DCHECK(IsFixedArray());
   DCHECK_GE(index, 0);
   DCHECK_LT(index, this->length());
   int offset = kHeaderSize + index * kPointerSize;
   RELAXED_WRITE_FIELD(this, offset, value);
-  WRITE_BARRIER(GetHeap(), this, offset, value);
+  WRITE_BARRIER(Heap::FromWritableHeapObject(this), this, offset, value);
 }
 
 void FixedArray::set(int index, Object* value, WriteBarrierMode mode) {
-  DCHECK_NE(map(), GetHeap()->fixed_cow_array_map());
+  DCHECK_NE(map(), GetReadOnlyRoots().fixed_cow_array_map());
   DCHECK_GE(index, 0);
   DCHECK_LT(index, this->length());
   int offset = kHeaderSize + index * kPointerSize;
   RELAXED_WRITE_FIELD(this, offset, value);
-  CONDITIONAL_WRITE_BARRIER(GetHeap(), this, offset, value, mode);
+  CONDITIONAL_WRITE_BARRIER(Heap::FromWritableHeapObject(this), this, offset,
+                            value, mode);
 }
 
 void FixedArray::NoWriteBarrierSet(FixedArray* array, int index,
                                    Object* value) {
-  DCHECK_NE(array->map(), array->GetHeap()->fixed_cow_array_map());
+  DCHECK_NE(array->map(), array->GetReadOnlyRoots().fixed_cow_array_map());
   DCHECK_GE(index, 0);
   DCHECK_LT(index, array->length());
-  DCHECK(!array->GetHeap()->InNewSpace(value));
+  DCHECK(!Heap::InNewSpace(value));
   RELAXED_WRITE_FIELD(array, kHeaderSize + index * kPointerSize, value);
 }
 
 void FixedArray::set_undefined(int index) {
-  set_undefined(GetIsolate(), index);
+  set_undefined(GetReadOnlyRoots(), index);
 }
 
 void FixedArray::set_undefined(Isolate* isolate, int index) {
-  FixedArray::NoWriteBarrierSet(this, index,
-                                isolate->heap()->undefined_value());
+  set_undefined(ReadOnlyRoots(isolate), index);
 }
 
-void FixedArray::set_null(int index) { set_null(GetIsolate(), index); }
+void FixedArray::set_undefined(ReadOnlyRoots ro_roots, int index) {
+  FixedArray::NoWriteBarrierSet(this, index, ro_roots.undefined_value());
+}
+
+void FixedArray::set_null(int index) { set_null(GetReadOnlyRoots(), index); }
 
 void FixedArray::set_null(Isolate* isolate, int index) {
-  FixedArray::NoWriteBarrierSet(this, index, isolate->heap()->null_value());
+  set_null(ReadOnlyRoots(isolate), index);
+}
+
+void FixedArray::set_null(ReadOnlyRoots ro_roots, int index) {
+  FixedArray::NoWriteBarrierSet(this, index, ro_roots.null_value());
 }
 
-void FixedArray::set_the_hole(int index) { set_the_hole(GetIsolate(), index); }
+void FixedArray::set_the_hole(int index) {
+  set_the_hole(GetReadOnlyRoots(), index);
+}
 
 void FixedArray::set_the_hole(Isolate* isolate, int index) {
-  FixedArray::NoWriteBarrierSet(this, index, isolate->heap()->the_hole_value());
+  set_the_hole(ReadOnlyRoots(isolate), index);
+}
+
+void FixedArray::set_the_hole(ReadOnlyRoots ro_roots, int index) {
+  FixedArray::NoWriteBarrierSet(this, index, ro_roots.the_hole_value());
 }
 
 void FixedArray::FillWithHoles(int from, int to) {
-  Isolate* isolate = GetIsolate();
   for (int i = from; i < to; i++) {
-    set_the_hole(isolate, i);
+    set_the_hole(i);
   }
 }
 
@@ -154,16 +168,16 @@ Object** FixedArray::RawFieldOfElementAt(int index) {
 }
 
 double FixedDoubleArray::get_scalar(int index) {
-  DCHECK(map() != GetHeap()->fixed_cow_array_map() &&
-         map() != GetHeap()->fixed_array_map());
+  DCHECK(map() != GetReadOnlyRoots().fixed_cow_array_map() &&
+         map() != GetReadOnlyRoots().fixed_array_map());
   DCHECK(index >= 0 && index < this->length());
   DCHECK(!is_the_hole(index));
   return READ_DOUBLE_FIELD(this, kHeaderSize + index * kDoubleSize);
 }
 
 uint64_t FixedDoubleArray::get_representation(int index) {
-  DCHECK(map() != GetHeap()->fixed_cow_array_map() &&
-         map() != GetHeap()->fixed_array_map());
+  DCHECK(map() != GetReadOnlyRoots().fixed_cow_array_map() &&
+         map() != GetReadOnlyRoots().fixed_array_map());
   DCHECK(index >= 0 && index < this->length());
   int offset = kHeaderSize + index * kDoubleSize;
   return READ_UINT64_FIELD(this, offset);
@@ -179,8 +193,8 @@ Handle<Object> FixedDoubleArray::get(FixedDoubleArray* array, int index,
 }
 
 void FixedDoubleArray::set(int index, double value) {
-  DCHECK(map() != GetHeap()->fixed_cow_array_map() &&
-         map() != GetHeap()->fixed_array_map());
+  DCHECK(map() != GetReadOnlyRoots().fixed_cow_array_map() &&
+         map() != GetReadOnlyRoots().fixed_array_map());
   int offset = kHeaderSize + index * kDoubleSize;
   if (std::isnan(value)) {
     WRITE_DOUBLE_FIELD(this, offset, std::numeric_limits<double>::quiet_NaN());
@@ -195,8 +209,8 @@ void FixedDoubleArray::set_the_hole(Isolate* isolate, int index) {
 }
 
 void FixedDoubleArray::set_the_hole(int index) {
-  DCHECK(map() != GetHeap()->fixed_cow_array_map() &&
-         map() != GetHeap()->fixed_array_map());
+  DCHECK(map() != GetReadOnlyRoots().fixed_cow_array_map() &&
+         map() != GetReadOnlyRoots().fixed_array_map());
   int offset = kHeaderSize + index * kDoubleSize;
   WRITE_UINT64_FIELD(this, offset, kHoleNanInt64);
 }
@@ -220,7 +234,7 @@ void FixedDoubleArray::FillWithHoles(int from, int to) {
 }
 
 MaybeObject* WeakFixedArray::Get(int index) const {
-  SLOW_DCHECK(index >= 0 && index < this->length());
+  DCHECK(index >= 0 && index < this->length());
   return RELAXED_READ_WEAK_FIELD(this, OffsetOfElementAt(index));
 }
 
@@ -229,13 +243,49 @@ void WeakFixedArray::Set(int index, MaybeObject* value) {
   DCHECK_LT(index, length());
   int offset = OffsetOfElementAt(index);
   RELAXED_WRITE_FIELD(this, offset, value);
-  WEAK_WRITE_BARRIER(GetHeap(), this, offset, value);
+  WEAK_WRITE_BARRIER(Heap::FromWritableHeapObject(this), this, offset, value);
+}
+
+void WeakFixedArray::Set(int index, MaybeObject* value, WriteBarrierMode mode) {
+  DCHECK_GE(index, 0);
+  DCHECK_LT(index, length());
+  int offset = OffsetOfElementAt(index);
+  RELAXED_WRITE_FIELD(this, offset, value);
+  CONDITIONAL_WEAK_WRITE_BARRIER(Heap::FromWritableHeapObject(this), this,
+                                 offset, value, mode);
 }
 
 MaybeObject** WeakFixedArray::data_start() {
   return HeapObject::RawMaybeWeakField(this, kHeaderSize);
 }
 
+MaybeObject** WeakFixedArray::RawFieldOfElementAt(int index) {
+  return HeapObject::RawMaybeWeakField(this, OffsetOfElementAt(index));
+}
+
+MaybeObject** WeakFixedArray::GetFirstElementAddress() {
+  return reinterpret_cast<MaybeObject**>(
+      FIELD_ADDR(this, OffsetOfElementAt(0)));
+}
+
+MaybeObject* WeakArrayList::Get(int index) const {
+  DCHECK(index >= 0 && index < this->capacity());
+  return RELAXED_READ_WEAK_FIELD(this, OffsetOfElementAt(index));
+}
+
+void WeakArrayList::Set(int index, MaybeObject* value, WriteBarrierMode mode) {
+  DCHECK_GE(index, 0);
+  DCHECK_LT(index, this->capacity());
+  int offset = OffsetOfElementAt(index);
+  RELAXED_WRITE_FIELD(this, offset, value);
+  CONDITIONAL_WEAK_WRITE_BARRIER(Heap::FromWritableHeapObject(this), this,
+                                 offset, value, mode);
+}
+
+MaybeObject** WeakArrayList::data_start() {
+  return HeapObject::RawMaybeWeakField(this, kHeaderSize);
+}
+
 Object* FixedArrayOfWeakCells::Get(int index) const {
   Object* raw = FixedArray::cast(this)->get(index + kFirstIndex);
   if (raw->IsSmi()) return raw;
@@ -300,7 +350,7 @@ void ArrayList::Set(int index, Object* obj, WriteBarrierMode mode) {
 }
 
 void ArrayList::Clear(int index, Object* undefined) {
-  DCHECK(undefined->IsUndefined(GetIsolate()));
+  DCHECK(undefined->IsUndefined());
   FixedArray::cast(this)->set(kFirstIndex + index, undefined,
                               SKIP_WRITE_BARRIER);
 }
@@ -320,15 +370,15 @@ void ByteArray::set(int index, byte value) {
 void ByteArray::copy_in(int index, const byte* buffer, int length) {
   DCHECK(index >= 0 && length >= 0 && length <= kMaxInt - index &&
          index + length <= this->length());
-  byte* dst_addr = FIELD_ADDR(this, kHeaderSize + index * kCharSize);
-  memcpy(dst_addr, buffer, length);
+  Address dst_addr = FIELD_ADDR(this, kHeaderSize + index * kCharSize);
+  memcpy(reinterpret_cast<void*>(dst_addr), buffer, length);
 }
 
 void ByteArray::copy_out(int index, byte* buffer, int length) {
   DCHECK(index >= 0 && length >= 0 && length <= kMaxInt - index &&
          index + length <= this->length());
-  const byte* src_addr = FIELD_ADDR(this, kHeaderSize + index * kCharSize);
-  memcpy(buffer, src_addr, length);
+  Address src_addr = FIELD_ADDR(this, kHeaderSize + index * kCharSize);
+  memcpy(buffer, reinterpret_cast<void*>(src_addr), length);
 }
 
 int ByteArray::get_int(int index) const {
@@ -353,7 +403,7 @@ void ByteArray::set_uint32(int index, uint32_t value) {
 
 void ByteArray::clear_padding() {
   int data_size = length() + kHeaderSize;
-  memset(address() + data_size, 0, Size() - data_size);
+  memset(reinterpret_cast<void*>(address() + data_size), 0, Size() - data_size);
 }
 
 ByteArray* ByteArray::FromDataStartAddress(Address address) {
@@ -365,18 +415,18 @@ int ByteArray::DataSize() const { return RoundUp(length(), kPointerSize); }
 
 int ByteArray::ByteArraySize() { return SizeFor(this->length()); }
 
-Address ByteArray::GetDataStartAddress() {
-  return reinterpret_cast<Address>(this) - kHeapObjectTag + kHeaderSize;
+byte* ByteArray::GetDataStartAddress() {
+  return reinterpret_cast<byte*>(address() + kHeaderSize);
 }
 
 template <class T>
 PodArray<T>* PodArray<T>::cast(Object* object) {
-  SLOW_DCHECK(object->IsByteArray());
+  DCHECK(object->IsByteArray());
   return reinterpret_cast<PodArray<T>*>(object);
 }
 template <class T>
 const PodArray<T>* PodArray<T>::cast(const Object* object) {
-  SLOW_DCHECK(object->IsByteArray());
+  DCHECK(object->IsByteArray());
   return reinterpret_cast<const PodArray<T>*>(object);
 }
 
@@ -655,7 +705,7 @@ void FixedTypedArray<Traits>::SetValue(uint32_t index, Object* value) {
   } else {
     // Clamp undefined to the default value. All other types have been
     // converted to a number type further up in the call chain.
-    DCHECK(value->IsUndefined(GetIsolate()));
+    DCHECK(value->IsUndefined());
   }
   set(index, cast_value);
 }
@@ -727,18 +777,18 @@ STATIC_CONST_MEMBER_DEFINITION const InstanceType
 
 template <class Traits>
 FixedTypedArray<Traits>* FixedTypedArray<Traits>::cast(Object* object) {
-  SLOW_DCHECK(object->IsHeapObject() &&
-              HeapObject::cast(object)->map()->instance_type() ==
-                  Traits::kInstanceType);
+  DCHECK(object->IsHeapObject() &&
+         HeapObject::cast(object)->map()->instance_type() ==
+             Traits::kInstanceType);
   return reinterpret_cast<FixedTypedArray<Traits>*>(object);
 }
 
 template <class Traits>
 const FixedTypedArray<Traits>* FixedTypedArray<Traits>::cast(
     const Object* object) {
-  SLOW_DCHECK(object->IsHeapObject() &&
-              HeapObject::cast(object)->map()->instance_type() ==
-                  Traits::kInstanceType);
+  DCHECK(object->IsHeapObject() &&
+         HeapObject::cast(object)->map()->instance_type() ==
+             Traits::kInstanceType);
   return reinterpret_cast<FixedTypedArray<Traits>*>(object);
 }
 
diff --git a/deps/v8/src/objects/fixed-array.h b/deps/v8/src/objects/fixed-array.h
index 022821244f0214..5082f0fa010b07 100644
--- a/deps/v8/src/objects/fixed-array.h
+++ b/deps/v8/src/objects/fixed-array.h
@@ -13,6 +13,8 @@
 namespace v8 {
 namespace internal {
 
+class WeakArrayBodyDescriptor;
+
 #define FIXED_ARRAY_SUB_INSTANCE_TYPE_LIST(V)    \
   V(BYTECODE_ARRAY_CONSTANT_POOL_SUB_TYPE)       \
   V(BYTECODE_ARRAY_HANDLER_TABLE_SUB_TYPE)       \
@@ -125,14 +127,20 @@ class FixedArray : public FixedArrayBase {
 
   inline Object** GetFirstElementAddress();
   inline bool ContainsOnlySmisOrHoles();
+  // Returns true iff the elements are Numbers and sorted ascending.
+  bool ContainsSortedNumbers();
 
   // Gives access to raw memory which stores the array's data.
   inline Object** data_start();
 
   inline void FillWithHoles(int from, int to);
 
-  // Shrink length and insert filler objects.
-  void Shrink(int length);
+  // Shrink the array and insert filler objects. {new_length} must be > 0.
+  void Shrink(int new_length);
+  // If {new_length} is 0, return the canonical empty FixedArray. Otherwise
+  // like above.
+  static Handle<FixedArray> ShrinkOrEmpty(Handle<FixedArray> array,
+                                          int new_length);
 
   // Copy a sub array from the receiver to dest.
   void CopyTo(int pos, FixedArray* dest, int dest_pos, int len) const;
@@ -182,6 +190,10 @@ class FixedArray : public FixedArrayBase {
  private:
   STATIC_ASSERT(kHeaderSize == Internals::kFixedArrayHeaderSize);
 
+  inline void set_undefined(ReadOnlyRoots ro_roots, int index);
+  inline void set_null(ReadOnlyRoots ro_roots, int index);
+  inline void set_the_hole(ReadOnlyRoots ro_roots, int index);
+
   DISALLOW_IMPLICIT_CONSTRUCTORS(FixedArray);
 };
 
@@ -254,6 +266,9 @@ class WeakFixedArray : public HeapObject {
   // Setter that uses write barrier.
   inline void Set(int index, MaybeObject* value);
 
+  // Setter with explicit barrier mode.
+  inline void Set(int index, MaybeObject* value, WriteBarrierMode mode);
+
   static constexpr int SizeFor(int length) {
     return kHeaderSize + length * kPointerSize;
   }
@@ -267,10 +282,14 @@ class WeakFixedArray : public HeapObject {
   // Gives access to raw memory which stores the array's data.
   inline MaybeObject** data_start();
 
+  inline MaybeObject** RawFieldOfElementAt(int index);
+
+  inline MaybeObject** GetFirstElementAddress();
+
   DECL_PRINTER(WeakFixedArray)
   DECL_VERIFIER(WeakFixedArray)
 
-  class BodyDescriptor;
+  typedef WeakArrayBodyDescriptor BodyDescriptor;
   typedef BodyDescriptor BodyDescriptorWeak;
 
   static const int kLengthOffset = HeapObject::kHeaderSize;
@@ -279,11 +298,12 @@ class WeakFixedArray : public HeapObject {
   static const int kMaxLength =
       (FixedArray::kMaxSize - kHeaderSize) / kPointerSize;
 
- private:
+ protected:
   static int OffsetOfElementAt(int index) {
     return kHeaderSize + index * kPointerSize;
   }
 
+ private:
   friend class Heap;
 
   static const int kFirstIndex = 1;
@@ -291,13 +311,73 @@ class WeakFixedArray : public HeapObject {
   DISALLOW_IMPLICIT_CONSTRUCTORS(WeakFixedArray);
 };
 
+// WeakArrayList is like a WeakFixedArray with static convenience methods for
+// adding more elements. length() returns the number of elements in the list and
+// capacity() returns the allocated size. The number of elements is stored at
+// kLengthOffset and is updated with every insertion. The array grows
+// dynamically with O(1) amortized insertion.
+class WeakArrayList : public HeapObject {
+ public:
+  DECL_CAST(WeakArrayList)
+  DECL_VERIFIER(WeakArrayList)
+  DECL_PRINTER(WeakArrayList)
+
+  static Handle<WeakArrayList> AddToEnd(Handle<WeakArrayList> array,
+                                        MaybeObjectHandle value);
+
+  inline MaybeObject* Get(int index) const;
+
+  // Set the element at index to obj. The underlying array must be large enough.
+  // If you need to grow the WeakArrayList, use the static AddToEnd() method
+  // instead.
+  inline void Set(int index, MaybeObject* value,
+                  WriteBarrierMode mode = UPDATE_WRITE_BARRIER);
+
+  static constexpr int SizeForCapacity(int capacity) {
+    return kHeaderSize + capacity * kPointerSize;
+  }
+
+  // Gives access to raw memory which stores the array's data.
+  inline MaybeObject** data_start();
+
+  bool IsFull();
+
+  DECL_INT_ACCESSORS(capacity)
+  DECL_INT_ACCESSORS(length)
+
+  // Get and set the capacity using acquire loads and release stores.
+  inline int synchronized_capacity() const;
+  inline void synchronized_set_capacity(int value);
+
+  typedef WeakArrayBodyDescriptor BodyDescriptor;
+  typedef BodyDescriptor BodyDescriptorWeak;
+
+  static const int kCapacityOffset = HeapObject::kHeaderSize;
+  static const int kLengthOffset = kCapacityOffset + kPointerSize;
+  static const int kHeaderSize = kLengthOffset + kPointerSize;
+
+  static const int kMaxCapacity =
+      (FixedArray::kMaxSize - kHeaderSize) / kPointerSize;
+
+ private:
+  static int OffsetOfElementAt(int index) {
+    return kHeaderSize + index * kPointerSize;
+  }
+
+  static Handle<WeakArrayList> EnsureSpace(Handle<WeakArrayList> array,
+                                           int length);
+
+  DISALLOW_IMPLICIT_CONSTRUCTORS(WeakArrayList);
+};
+
 // Deprecated. Use WeakFixedArray instead.
 class FixedArrayOfWeakCells : public FixedArray {
  public:
   // If |maybe_array| is not a FixedArrayOfWeakCells, a fresh one will be
   // allocated. This function does not check if the value exists already,
   // callers must ensure this themselves if necessary.
-  static Handle<FixedArrayOfWeakCells> Add(Handle<Object> maybe_array,
+  static Handle<FixedArrayOfWeakCells> Add(Isolate* isolate,
+                                           Handle<Object> maybe_array,
                                            Handle<HeapObject> value,
                                            int* assigned_index = nullptr);
 
@@ -349,8 +429,8 @@ class FixedArrayOfWeakCells : public FixedArray {
       Isolate* isolate, int size,
       Handle<FixedArrayOfWeakCells> initialize_from);
 
-  static void Set(Handle<FixedArrayOfWeakCells> array, int index,
-                  Handle<HeapObject> value);
+  static void Set(Isolate* isolate, Handle<FixedArrayOfWeakCells> array,
+                  int index, Handle<HeapObject> value);
   inline void clear(int index);
 
   inline int last_used_index() const;
@@ -411,7 +491,7 @@ class ArrayList : public FixedArray {
 enum SearchMode { ALL_ENTRIES, VALID_ENTRIES };
 
 template <SearchMode search_mode, typename T>
-inline int Search(T* array, Name* name, int valid_entries = 0,
+inline int Search(Isolate* isolate, T* array, Name* name, int valid_entries = 0,
                   int* out_insertion_index = nullptr);
 
 // ByteArray represents fixed sized byte arrays.  Used for the relocation info
@@ -453,7 +533,7 @@ class ByteArray : public FixedArrayBase {
   }
 
   // Returns data start address.
-  inline Address GetDataStartAddress();
+  inline byte* GetDataStartAddress();
 
   inline int DataSize() const;
 
diff --git a/deps/v8/src/objects/hash-table-inl.h b/deps/v8/src/objects/hash-table-inl.h
index a764684a000962..1995806913c63e 100644
--- a/deps/v8/src/objects/hash-table-inl.h
+++ b/deps/v8/src/objects/hash-table-inl.h
@@ -58,6 +58,10 @@ int BaseShape<Key>::GetMapRootIndex() {
   return Heap::kHashTableMapRootIndex;
 }
 
+int EphemeronHashTableShape::GetMapRootIndex() {
+  return Heap::kEphemeronHashTableMapRootIndex;
+}
+
 template <typename Derived, typename Shape>
 int HashTable<Derived, Shape>::FindEntry(Key key) {
   return FindEntry(GetIsolate(), key);
@@ -76,8 +80,9 @@ int HashTable<Derived, Shape>::FindEntry(Isolate* isolate, Key key,
   uint32_t entry = FirstProbe(hash, capacity);
   uint32_t count = 1;
   // EnsureCapacity will guarantee the hash table is never full.
-  Object* undefined = isolate->heap()->undefined_value();
-  Object* the_hole = isolate->heap()->the_hole_value();
+  ReadOnlyRoots roots(isolate);
+  Object* undefined = roots.undefined_value();
+  Object* the_hole = roots.the_hole_value();
   USE(the_hole);
   while (true) {
     Object* element = KeyAt(entry);
@@ -92,10 +97,29 @@ int HashTable<Derived, Shape>::FindEntry(Isolate* isolate, Key key,
   return kNotFound;
 }
 
+template <typename Derived, typename Shape>
+bool HashTable<Derived, Shape>::IsKey(Isolate* isolate, Object* k) {
+  return Shape::IsKey(isolate, k);
+}
+
+template <typename Derived, typename Shape>
+bool HashTable<Derived, Shape>::ToKey(Isolate* isolate, int entry,
+                                      Object** out_k) {
+  Object* k = KeyAt(entry);
+  if (!IsKey(isolate, k)) return false;
+  *out_k = Shape::Unwrap(k);
+  return true;
+}
+
+template <typename KeyT>
+bool BaseShape<KeyT>::IsKey(Isolate* isolate, Object* key) {
+  return IsLive(isolate, key);
+}
+
 template <typename KeyT>
 bool BaseShape<KeyT>::IsLive(Isolate* isolate, Object* k) {
-  Heap* heap = isolate->heap();
-  return k != heap->the_hole_value() && k != heap->undefined_value();
+  ReadOnlyRoots roots(isolate);
+  return k != roots.the_hole_value() && k != roots.undefined_value();
 }
 
 template <typename Derived, typename Shape>
@@ -121,19 +145,6 @@ bool ObjectHashSet::Has(Isolate* isolate, Handle<Object> key) {
   return FindEntry(isolate, key, Smi::ToInt(hash)) != kNotFound;
 }
 
-int OrderedHashSet::GetMapRootIndex() {
-  return Heap::kOrderedHashSetMapRootIndex;
-}
-
-int OrderedHashMap::GetMapRootIndex() {
-  return Heap::kOrderedHashMapMapRootIndex;
-}
-
-inline Object* OrderedHashMap::ValueAt(int entry) {
-  DCHECK_LT(entry, this->UsedCapacity());
-  return get(EntryToIndex(entry) + kValueOffset);
-}
-
 }  // namespace internal
 }  // namespace v8
 
diff --git a/deps/v8/src/objects/hash-table.h b/deps/v8/src/objects/hash-table.h
index a9ce37991b401c..e0740b7380c408 100644
--- a/deps/v8/src/objects/hash-table.h
+++ b/deps/v8/src/objects/hash-table.h
@@ -58,9 +58,7 @@ class BaseShape {
   static inline int GetMapRootIndex();
   static const bool kNeedsHoleCheck = true;
   static Object* Unwrap(Object* key) { return key; }
-  static bool IsKey(Isolate* isolate, Object* key) {
-    return IsLive(isolate, key);
-  }
+  static inline bool IsKey(Isolate* isolate, Object* key);
   static inline bool IsLive(Isolate* isolate, Object* key);
 };
 
@@ -89,7 +87,7 @@ class V8_EXPORT_PRIVATE HashTableBase : public NON_EXPORTED_BASE(FixedArray) {
   static inline int ComputeCapacity(int at_least_space_for);
 
   // Compute the probe offset (quadratic probing).
-  INLINE(static uint32_t GetProbeOffset(uint32_t n)) {
+  V8_INLINE static uint32_t GetProbeOffset(uint32_t n) {
     return (n + n * n) >> 1;
   }
 
@@ -155,16 +153,9 @@ class HashTable : public HashTableBase {
 
   // Tells whether k is a real key.  The hole and undefined are not allowed
   // as keys and can be used to indicate missing or deleted elements.
-  static bool IsKey(Isolate* isolate, Object* k) {
-    return Shape::IsKey(isolate, k);
-  }
+  static bool IsKey(Isolate* isolate, Object* k);
 
-  inline bool ToKey(Isolate* isolate, int entry, Object** out_k) {
-    Object* k = KeyAt(entry);
-    if (!IsKey(isolate, k)) return false;
-    *out_k = Shape::Unwrap(k);
-    return true;
-  }
+  inline bool ToKey(Isolate* isolate, int entry, Object** out_k);
 
   // Returns the key at entry.
   Object* KeyAt(int entry) { return get(EntryToIndex(entry) + kEntryKeyIndex); }
@@ -278,19 +269,9 @@ class ObjectHashTableShape : public BaseShape<Handle<Object>> {
   static const bool kNeedsHoleCheck = false;
 };
 
-// ObjectHashTable maps keys that are arbitrary objects to object values by
-// using the identity hash of the key for hashing purposes.
-class ObjectHashTable
-    : public HashTable<ObjectHashTable, ObjectHashTableShape> {
-  typedef HashTable<ObjectHashTable, ObjectHashTableShape> DerivedHashTable;
-
+template <typename Derived, typename Shape>
+class ObjectHashTableBase : public HashTable<Derived, Shape> {
  public:
-  DECL_CAST(ObjectHashTable)
-
-  // Attempt to shrink hash table after removal of key.
-  V8_WARN_UNUSED_RESULT static inline Handle<ObjectHashTable> Shrink(
-      Handle<ObjectHashTable> table);
-
   // Looks up the value associated with the given key. The hole value is
   // returned in case the key is not present.
   Object* Lookup(Handle<Object> key);
@@ -300,562 +281,77 @@ class ObjectHashTable
   // Returns the value at entry.
   Object* ValueAt(int entry);
 
+  // Overwrite all keys and values with the hole value.
+  static void FillEntriesWithHoles(Handle<Derived>);
+
   // Adds (or overwrites) the value associated with the given key.
-  static Handle<ObjectHashTable> Put(Handle<ObjectHashTable> table,
-                                     Handle<Object> key, Handle<Object> value);
-  static Handle<ObjectHashTable> Put(Handle<ObjectHashTable> table,
-                                     Handle<Object> key, Handle<Object> value,
-                                     int32_t hash);
+  static Handle<Derived> Put(Handle<Derived> table, Handle<Object> key,
+                             Handle<Object> value);
+  static Handle<Derived> Put(Handle<Derived> table, Handle<Object> key,
+                             Handle<Object> value, int32_t hash);
 
   // Returns an ObjectHashTable (possibly |table|) where |key| has been removed.
-  static Handle<ObjectHashTable> Remove(Handle<ObjectHashTable> table,
-                                        Handle<Object> key, bool* was_present);
-  static Handle<ObjectHashTable> Remove(Handle<ObjectHashTable> table,
-                                        Handle<Object> key, bool* was_present,
-                                        int32_t hash);
+  static Handle<Derived> Remove(Handle<Derived> table, Handle<Object> key,
+                                bool* was_present);
+  static Handle<Derived> Remove(Handle<Derived> table, Handle<Object> key,
+                                bool* was_present, int32_t hash);
 
   // Returns the index to the value of an entry.
   static inline int EntryToValueIndex(int entry) {
-    return EntryToIndex(entry) + ObjectHashTableShape::kEntryValueIndex;
+    return HashTable<Derived, Shape>::EntryToIndex(entry) +
+           Shape::kEntryValueIndex;
   }
 
  protected:
-  friend class MarkCompactCollector;
-
   void AddEntry(int entry, Object* key, Object* value);
   void RemoveEntry(int entry);
 };
 
-class ObjectHashSetShape : public ObjectHashTableShape {
- public:
-  static const int kPrefixSize = 0;
-  static const int kEntrySize = 1;
-};
-
-class ObjectHashSet : public HashTable<ObjectHashSet, ObjectHashSetShape> {
- public:
-  static Handle<ObjectHashSet> Add(Handle<ObjectHashSet> set,
-                                   Handle<Object> key);
-
-  inline bool Has(Isolate* isolate, Handle<Object> key, int32_t hash);
-  inline bool Has(Isolate* isolate, Handle<Object> key);
-
-  DECL_CAST(ObjectHashSet)
-};
-
-// Non-templatized base class for {OrderedHashTable}s.
-// TODO(hash): Unify this with the HashTableBase above.
-class OrderedHashTableBase : public FixedArray {
- public:
-  static const int kNotFound = -1;
-  static const int kMinCapacity = 4;
-
-  static const int kNumberOfElementsIndex = 0;
-  // The next table is stored at the same index as the nof elements.
-  static const int kNextTableIndex = kNumberOfElementsIndex;
-  static const int kNumberOfDeletedElementsIndex = kNumberOfElementsIndex + 1;
-  static const int kNumberOfBucketsIndex = kNumberOfDeletedElementsIndex + 1;
-  static const int kHashTableStartIndex = kNumberOfBucketsIndex + 1;
-  static const int kRemovedHolesIndex = kHashTableStartIndex;
-
-  static constexpr const int kNumberOfElementsOffset =
-      FixedArray::OffsetOfElementAt(kNumberOfElementsIndex);
-  static constexpr const int kNextTableOffset =
-      FixedArray::OffsetOfElementAt(kNextTableIndex);
-  static constexpr const int kNumberOfDeletedElementsOffset =
-      FixedArray::OffsetOfElementAt(kNumberOfDeletedElementsIndex);
-  static constexpr const int kNumberOfBucketsOffset =
-      FixedArray::OffsetOfElementAt(kNumberOfBucketsIndex);
-  static constexpr const int kHashTableStartOffset =
-      FixedArray::OffsetOfElementAt(kHashTableStartIndex);
-
-  static const int kLoadFactor = 2;
-
-  // NumberOfDeletedElements is set to kClearedTableSentinel when
-  // the table is cleared, which allows iterator transitions to
-  // optimize that case.
-  static const int kClearedTableSentinel = -1;
-};
-
-// OrderedHashTable is a HashTable with Object keys that preserves
-// insertion order. There are Map and Set interfaces (OrderedHashMap
-// and OrderedHashTable, below). It is meant to be used by JSMap/JSSet.
-//
-// Only Object* keys are supported, with Object::SameValueZero() used as the
-// equality operator and Object::GetHash() for the hash function.
-//
-// Based on the "Deterministic Hash Table" as described by Jason Orendorff at
-// https://wiki.mozilla.org/User:Jorend/Deterministic_hash_tables
-// Originally attributed to Tyler Close.
-//
-// Memory layout:
-//   [0]: element count
-//   [1]: deleted element count
-//   [2]: bucket count
-//   [3..(3 + NumberOfBuckets() - 1)]: "hash table", where each item is an
-//                            offset into the data table (see below) where the
-//                            first item in this bucket is stored.
-//   [3 + NumberOfBuckets()..length]: "data table", an array of length
-//                            Capacity() * kEntrySize, where the first entrysize
-//                            items are handled by the derived class and the
-//                            item at kChainOffset is another entry into the
-//                            data table indicating the next entry in this hash
-//                            bucket.
-//
-// When we transition the table to a new version we obsolete it and reuse parts
-// of the memory to store information how to transition an iterator to the new
-// table:
-//
-// Memory layout for obsolete table:
-//   [0]: bucket count
-//   [1]: Next newer table
-//   [2]: Number of removed holes or -1 when the table was cleared.
-//   [3..(3 + NumberOfRemovedHoles() - 1)]: The indexes of the removed holes.
-//   [3 + NumberOfRemovedHoles()..length]: Not used
-//
-template <class Derived, int entrysize>
-class OrderedHashTable : public OrderedHashTableBase {
+// ObjectHashTable maps keys that are arbitrary objects to object values by
+// using the identity hash of the key for hashing purposes.
+class ObjectHashTable
+    : public ObjectHashTableBase<ObjectHashTable, ObjectHashTableShape> {
  public:
-  // Returns an OrderedHashTable with a capacity of at least |capacity|.
-  static Handle<Derived> Allocate(Isolate* isolate, int capacity,
-                                  PretenureFlag pretenure = NOT_TENURED);
-
-  // Returns an OrderedHashTable (possibly |table|) with enough space
-  // to add at least one new element.
-  static Handle<Derived> EnsureGrowable(Handle<Derived> table);
-
-  // Returns an OrderedHashTable (possibly |table|) that's shrunken
-  // if possible.
-  static Handle<Derived> Shrink(Handle<Derived> table);
-
-  // Returns a new empty OrderedHashTable and records the clearing so that
-  // existing iterators can be updated.
-  static Handle<Derived> Clear(Handle<Derived> table);
-
-  // Returns true if the OrderedHashTable contains the key
-  static bool HasKey(Isolate* isolate, Derived* table, Object* key);
-
-  // Returns a true value if the OrderedHashTable contains the key and
-  // the key has been deleted. This does not shrink the table.
-  static bool Delete(Isolate* isolate, Derived* table, Object* key);
-
-  int NumberOfElements() const {
-    return Smi::ToInt(get(kNumberOfElementsIndex));
-  }
-
-  int NumberOfDeletedElements() const {
-    return Smi::ToInt(get(kNumberOfDeletedElementsIndex));
-  }
-
-  // Returns the number of contiguous entries in the data table, starting at 0,
-  // that either are real entries or have been deleted.
-  int UsedCapacity() const {
-    return NumberOfElements() + NumberOfDeletedElements();
-  }
-
-  int NumberOfBuckets() const { return Smi::ToInt(get(kNumberOfBucketsIndex)); }
-
-  // Returns an index into |this| for the given entry.
-  int EntryToIndex(int entry) {
-    return kHashTableStartIndex + NumberOfBuckets() + (entry * kEntrySize);
-  }
-
-  int HashToBucket(int hash) { return hash & (NumberOfBuckets() - 1); }
-
-  int HashToEntry(int hash) {
-    int bucket = HashToBucket(hash);
-    Object* entry = this->get(kHashTableStartIndex + bucket);
-    return Smi::ToInt(entry);
-  }
-
-  int KeyToFirstEntry(Isolate* isolate, Object* key) {
-    // This special cases for Smi, so that we avoid the HandleScope
-    // creation below.
-    if (key->IsSmi()) {
-      uint32_t hash = ComputeIntegerHash(Smi::ToInt(key));
-      return HashToEntry(hash & Smi::kMaxValue);
-    }
-    HandleScope scope(isolate);
-    Object* hash = key->GetHash();
-    // If the object does not have an identity hash, it was never used as a key
-    if (hash->IsUndefined(isolate)) return kNotFound;
-    return HashToEntry(Smi::ToInt(hash));
-  }
-
-  int FindEntry(Isolate* isolate, Object* key) {
-    int entry = KeyToFirstEntry(isolate, key);
-    // Walk the chain in the bucket to find the key.
-    while (entry != kNotFound) {
-      Object* candidate_key = KeyAt(entry);
-      if (candidate_key->SameValueZero(key)) break;
-      entry = NextChainEntry(entry);
-    }
-
-    return entry;
-  }
-
-  int NextChainEntry(int entry) {
-    Object* next_entry = get(EntryToIndex(entry) + kChainOffset);
-    return Smi::ToInt(next_entry);
-  }
-
-  // use KeyAt(i)->IsTheHole(isolate) to determine if this is a deleted entry.
-  Object* KeyAt(int entry) {
-    DCHECK_LT(entry, this->UsedCapacity());
-    return get(EntryToIndex(entry));
-  }
-
-  bool IsObsolete() { return !get(kNextTableIndex)->IsSmi(); }
-
-  // The next newer table. This is only valid if the table is obsolete.
-  Derived* NextTable() { return Derived::cast(get(kNextTableIndex)); }
-
-  // When the table is obsolete we store the indexes of the removed holes.
-  int RemovedIndexAt(int index) {
-    return Smi::ToInt(get(kRemovedHolesIndex + index));
-  }
-
-  static const int kEntrySize = entrysize + 1;
-  static const int kChainOffset = entrysize;
-
-  static const int kMaxCapacity =
-      (FixedArray::kMaxLength - kHashTableStartIndex) /
-      (1 + (kEntrySize * kLoadFactor));
-
- protected:
-  static Handle<Derived> Rehash(Handle<Derived> table, int new_capacity);
-
-  void SetNumberOfBuckets(int num) {
-    set(kNumberOfBucketsIndex, Smi::FromInt(num));
-  }
-
-  void SetNumberOfElements(int num) {
-    set(kNumberOfElementsIndex, Smi::FromInt(num));
-  }
-
-  void SetNumberOfDeletedElements(int num) {
-    set(kNumberOfDeletedElementsIndex, Smi::FromInt(num));
-  }
-
-  // Returns the number elements that can fit into the allocated buffer.
-  int Capacity() { return NumberOfBuckets() * kLoadFactor; }
-
-  void SetNextTable(Derived* next_table) { set(kNextTableIndex, next_table); }
-
-  void SetRemovedIndexAt(int index, int removed_index) {
-    return set(kRemovedHolesIndex + index, Smi::FromInt(removed_index));
-  }
+  DECL_CAST(ObjectHashTable)
+  DECL_PRINTER(ObjectHashTable)
 };
 
-class OrderedHashSet : public OrderedHashTable<OrderedHashSet, 1> {
+class EphemeronHashTableShape : public ObjectHashTableShape {
  public:
-  DECL_CAST(OrderedHashSet)
-
-  static Handle<OrderedHashSet> Add(Handle<OrderedHashSet> table,
-                                    Handle<Object> value);
-  static Handle<FixedArray> ConvertToKeysArray(Handle<OrderedHashSet> table,
-                                               GetKeysConversion convert);
-  static HeapObject* GetEmpty(Isolate* isolate);
   static inline int GetMapRootIndex();
 };
 
-class OrderedHashMap : public OrderedHashTable<OrderedHashMap, 2> {
+// EphemeronHashTable is similar to ObjectHashTable but gets special treatment
+// by the GC. The GC treats its entries as ephemerons: both key and value are
+// weak references, however if the key is strongly reachable its corresponding
+// value is also kept alive.
+class EphemeronHashTable
+    : public ObjectHashTableBase<EphemeronHashTable, EphemeronHashTableShape> {
  public:
-  DECL_CAST(OrderedHashMap)
-
-  // Returns a value if the OrderedHashMap contains the key, otherwise
-  // returns undefined.
-  static Handle<OrderedHashMap> Add(Handle<OrderedHashMap> table,
-                                    Handle<Object> key, Handle<Object> value);
-  Object* ValueAt(int entry);
-
-  static Object* GetHash(Isolate* isolate, Object* key);
-
-  static HeapObject* GetEmpty(Isolate* isolate);
-  static inline int GetMapRootIndex();
-
-  static const int kValueOffset = 1;
-};
-
-// This is similar to the OrderedHashTable, except for the memory
-// layout where we use byte instead of Smi. The max capacity of this
-// is only 254, we transition to an OrderedHashTable beyond that
-// limit.
-//
-// Each bucket and chain value is a byte long. The padding exists so
-// that the DataTable entries start aligned. A bucket or chain value
-// of 255 is used to denote an unknown entry.
-//
-// Memory layout: [ Header ] [ HashTable ] [ Chains ] [ Padding ] [ DataTable ]
-//
-// On a 64 bit machine with capacity = 4 and 2 entries,
-//
-// [ Header ]  :
-//    [0  .. 7]  : Number of elements
-//    [8  .. 15] : Number of deleted elements
-//    [16 .. 23] : Number of buckets
-//
-// [ HashTable ] :
-//    [24 .. 31] : First chain-link for bucket 1
-//    [32 .. 40] : First chain-link for bucket 2
-//
-// [ Chains ] :
-//    [40 .. 47] : Next chain link for entry 1
-//    [48 .. 55] : Next chain link for entry 2
-//    [56 .. 63] : Next chain link for entry 3
-//    [64 .. 71] : Next chain link for entry 4
-//
-// [ Padding ] :
-//    [72 .. 127] : Padding
-//
-// [ DataTable ] :
-//    [128 .. 128 + kEntrySize - 1] : Entry 1
-//    [128 + kEntrySize .. 128 + kEntrySize + kEntrySize - 1] : Entry 2
-//
-template <class Derived>
-class SmallOrderedHashTable : public HeapObject {
- public:
-  void Initialize(Isolate* isolate, int capacity);
-
-  static Handle<Derived> Allocate(Isolate* isolate, int capacity,
-                                  PretenureFlag pretenure = NOT_TENURED);
-
-  // Returns a true if the OrderedHashTable contains the key
-  bool HasKey(Isolate* isolate, Handle<Object> key);
-
-  // Iterates only fields in the DataTable.
-  class BodyDescriptor;
-
-  // No weak fields.
-  typedef BodyDescriptor BodyDescriptorWeak;
-
-  // Returns an SmallOrderedHashTable (possibly |table|) with enough
-  // space to add at least one new element.
-  static Handle<Derived> Grow(Handle<Derived> table);
-
-  static Handle<Derived> Rehash(Handle<Derived> table, int new_capacity);
-
-  void SetDataEntry(int entry, int relative_index, Object* value);
-
-  static int GetDataTableStartOffset(int capacity) {
-    int nof_buckets = capacity / kLoadFactor;
-    int nof_chain_entries = capacity;
-
-    int padding_index = kBucketsStartOffset + nof_buckets + nof_chain_entries;
-    int padding_offset = padding_index * kBitsPerByte;
-
-    return ((padding_offset + kPointerSize - 1) / kPointerSize) * kPointerSize;
-  }
-
-  int GetDataTableStartOffset() const {
-    return GetDataTableStartOffset(Capacity());
-  }
-
-  static int Size(int capacity) {
-    int data_table_start = GetDataTableStartOffset(capacity);
-    int data_table_size = capacity * Derived::kEntrySize * kBitsPerPointer;
-    return data_table_start + data_table_size;
-  }
-
-  int Size() const { return Size(Capacity()); }
-
-  void SetFirstEntry(int bucket, byte value) {
-    set(kBucketsStartOffset + bucket, value);
-  }
-
-  int GetFirstEntry(int bucket) const {
-    return get(kBucketsStartOffset + bucket);
-  }
-
-  void SetNextEntry(int entry, int next_entry) {
-    set(GetChainTableOffset() + entry, next_entry);
-  }
-
-  int GetNextEntry(int entry) const {
-    return get(GetChainTableOffset() + entry);
-  }
-
-  Object* GetDataEntry(int entry, int relative_index) {
-    int entry_offset = GetDataEntryOffset(entry, relative_index);
-    return READ_FIELD(this, entry_offset);
-  }
-
-  Object* KeyAt(int entry) const {
-    int entry_offset = GetDataEntryOffset(entry, Derived::kKeyIndex);
-    return READ_FIELD(this, entry_offset);
-  }
-
-  int HashToBucket(int hash) const { return hash & (NumberOfBuckets() - 1); }
-
-  int HashToFirstEntry(int hash) const {
-    int bucket = HashToBucket(hash);
-    int entry = GetFirstEntry(bucket);
-    return entry;
-  }
-
-  int GetChainTableOffset() const {
-    return kBucketsStartOffset + NumberOfBuckets();
-  }
-
-  void SetNumberOfBuckets(int num) { set(kNumberOfBucketsOffset, num); }
-
-  void SetNumberOfElements(int num) { set(kNumberOfElementsOffset, num); }
-
-  void SetNumberOfDeletedElements(int num) {
-    set(kNumberOfDeletedElementsOffset, num);
-  }
-
-  int NumberOfElements() const { return get(kNumberOfElementsOffset); }
-
-  int NumberOfDeletedElements() const {
-    return get(kNumberOfDeletedElementsOffset);
-  }
-
-  int NumberOfBuckets() const { return get(kNumberOfBucketsOffset); }
-
-  static const byte kNotFound = 0xFF;
-  static const int kMinCapacity = 4;
-
-  // We use the value 255 to indicate kNotFound for chain and bucket
-  // values, which means that this value can't be used a valid
-  // index.
-  static const int kMaxCapacity = 254;
-  STATIC_ASSERT(kMaxCapacity < kNotFound);
-
-  static const int kNumberOfElementsOffset = 0;
-  static const int kNumberOfDeletedElementsOffset = 1;
-  static const int kNumberOfBucketsOffset = 2;
-  static const int kBucketsStartOffset = 3;
-
-  // The load factor is used to derive the number of buckets from
-  // capacity during Allocation. We also depend on this to calaculate
-  // the capacity from number of buckets after allocation. If we
-  // decide to change kLoadFactor to something other than 2, capacity
-  // should be stored as another field of this object.
-  static const int kLoadFactor = 2;
-  static const int kBitsPerPointer = kPointerSize * kBitsPerByte;
-
-  // Our growth strategy involves doubling the capacity until we reach
-  // kMaxCapacity, but since the kMaxCapacity is always less than 256,
-  // we will never fully utilize this table. We special case for 256,
-  // by changing the new capacity to be kMaxCapacity in
-  // SmallOrderedHashTable::Grow.
-  static const int kGrowthHack = 256;
-
-  DECL_VERIFIER(SmallOrderedHashTable)
+  DECL_CAST(EphemeronHashTable)
+  DECL_PRINTER(EphemeronHashTable)
 
  protected:
-  // This is used for accessing the non |DataTable| part of the
-  // structure.
-  byte get(int index) const {
-    return READ_BYTE_FIELD(this, kHeaderSize + (index * kOneByteSize));
-  }
-
-  void set(int index, byte value) {
-    WRITE_BYTE_FIELD(this, kHeaderSize + (index * kOneByteSize), value);
-  }
-
-  int GetDataEntryOffset(int entry, int relative_index) const {
-    int datatable_start = GetDataTableStartOffset();
-    int offset_in_datatable = entry * Derived::kEntrySize * kPointerSize;
-    int offset_in_entry = relative_index * kPointerSize;
-    return datatable_start + offset_in_datatable + offset_in_entry;
-  }
-
-  // Returns the number elements that can fit into the allocated buffer.
-  int Capacity() const { return NumberOfBuckets() * kLoadFactor; }
-
-  int UsedCapacity() const {
-    return NumberOfElements() + NumberOfDeletedElements();
-  }
+  friend class MarkCompactCollector;
 };
 
-class SmallOrderedHashSet : public SmallOrderedHashTable<SmallOrderedHashSet> {
+class ObjectHashSetShape : public ObjectHashTableShape {
  public:
-  DECL_CAST(SmallOrderedHashSet)
-
-  DECL_PRINTER(SmallOrderedHashSet)
-
-  static const int kKeyIndex = 0;
+  static const int kPrefixSize = 0;
   static const int kEntrySize = 1;
-
-  // Adds |value| to |table|, if the capacity isn't enough, a new
-  // table is created. The original |table| is returned if there is
-  // capacity to store |value| otherwise the new table is returned.
-  static Handle<SmallOrderedHashSet> Add(Handle<SmallOrderedHashSet> table,
-                                         Handle<Object> key);
 };
 
-class SmallOrderedHashMap : public SmallOrderedHashTable<SmallOrderedHashMap> {
- public:
-  DECL_CAST(SmallOrderedHashMap)
-
-  DECL_PRINTER(SmallOrderedHashMap)
-
-  static const int kKeyIndex = 0;
-  static const int kValueIndex = 1;
-  static const int kEntrySize = 2;
-
-  // Adds |value| to |table|, if the capacity isn't enough, a new
-  // table is created. The original |table| is returned if there is
-  // capacity to store |value| otherwise the new table is returned.
-  static Handle<SmallOrderedHashMap> Add(Handle<SmallOrderedHashMap> table,
-                                         Handle<Object> key,
-                                         Handle<Object> value);
-};
-
-class JSCollectionIterator : public JSObject {
+class ObjectHashSet : public HashTable<ObjectHashSet, ObjectHashSetShape> {
  public:
-  // [table]: the backing hash table mapping keys to values.
-  DECL_ACCESSORS(table, Object)
-
-  // [index]: The index into the data table.
-  DECL_ACCESSORS(index, Object)
-
-  // Dispatched behavior.
-  DECL_PRINTER(JSCollectionIterator)
+  static Handle<ObjectHashSet> Add(Handle<ObjectHashSet> set,
+                                   Handle<Object> key);
 
-  static const int kTableOffset = JSObject::kHeaderSize;
-  static const int kIndexOffset = kTableOffset + kPointerSize;
-  static const int kSize = kIndexOffset + kPointerSize;
+  inline bool Has(Isolate* isolate, Handle<Object> key, int32_t hash);
+  inline bool Has(Isolate* isolate, Handle<Object> key);
 
- private:
-  DISALLOW_IMPLICIT_CONSTRUCTORS(JSCollectionIterator);
+  DECL_CAST(ObjectHashSet)
 };
 
-// OrderedHashTableIterator is an iterator that iterates over the keys and
-// values of an OrderedHashTable.
-//
-// The iterator has a reference to the underlying OrderedHashTable data,
-// [table], as well as the current [index] the iterator is at.
-//
-// When the OrderedHashTable is rehashed it adds a reference from the old table
-// to the new table as well as storing enough data about the changes so that the
-// iterator [index] can be adjusted accordingly.
-//
-// When the [Next] result from the iterator is requested, the iterator checks if
-// there is a newer table that it needs to transition to.
-template <class Derived, class TableType>
-class OrderedHashTableIterator : public JSCollectionIterator {
- public:
-  // Whether the iterator has more elements. This needs to be called before
-  // calling |CurrentKey| and/or |CurrentValue|.
-  bool HasMore();
-
-  // Move the index forward one.
-  void MoveNext() { set_index(Smi::FromInt(Smi::ToInt(index()) + 1)); }
-
-  // Returns the current key of the iterator. This should only be called when
-  // |HasMore| returns true.
-  inline Object* CurrentKey();
-
- private:
-  // Transitions the iterator to the non obsolete backing store. This is a NOP
-  // if the [table] is not obsolete.
-  void Transition();
-
-  DISALLOW_IMPLICIT_CONSTRUCTORS(OrderedHashTableIterator);
-};
 }  // namespace internal
 }  // namespace v8
 
diff --git a/deps/v8/src/objects/intl-objects-inl.h b/deps/v8/src/objects/intl-objects-inl.h
new file mode 100644
index 00000000000000..1fa2d66f94da20
--- /dev/null
+++ b/deps/v8/src/objects/intl-objects-inl.h
@@ -0,0 +1,27 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef V8_OBJECTS_INTL_OBJECTS_INL_H_
+#define V8_OBJECTS_INTL_OBJECTS_INL_H_
+
+#include "src/objects/intl-objects.h"
+
+namespace v8 {
+namespace internal {
+
+inline Intl::Type Intl::TypeFromInt(int type_int) {
+  STATIC_ASSERT(Intl::Type::kNumberFormat == 0);
+  DCHECK_LE(Intl::Type::kNumberFormat, type_int);
+  DCHECK_GT(Intl::Type::kTypeCount, type_int);
+  return static_cast<Intl::Type>(type_int);
+}
+
+inline Intl::Type Intl::TypeFromSmi(Smi* type) {
+  return TypeFromInt(Smi::ToInt(type));
+}
+
+}  // namespace internal
+}  // namespace v8
+
+#endif  // V8_OBJECTS_INTL_OBJECTS_INL_H_
diff --git a/deps/v8/src/objects/intl-objects.cc b/deps/v8/src/objects/intl-objects.cc
index 304764211112f2..57187d0f45a501 100644
--- a/deps/v8/src/objects/intl-objects.cc
+++ b/deps/v8/src/objects/intl-objects.cc
@@ -7,15 +7,17 @@
 #endif  // V8_INTL_SUPPORT
 
 #include "src/objects/intl-objects.h"
+#include "src/objects/intl-objects-inl.h"
 
 #include <memory>
 
 #include "src/api.h"
 #include "src/global-handles.h"
 #include "src/heap/factory.h"
+#include "src/intl.h"
 #include "src/isolate.h"
-#include "src/managed.h"
 #include "src/objects-inl.h"
+#include "src/objects/managed.h"
 #include "src/property-descriptor.h"
 #include "unicode/brkiter.h"
 #include "unicode/bytestream.h"
@@ -32,6 +34,7 @@
 #include "unicode/numsys.h"
 #include "unicode/plurrule.h"
 #include "unicode/rbbi.h"
+#include "unicode/regex.h"
 #include "unicode/smpdtfmt.h"
 #include "unicode/timezone.h"
 #include "unicode/uchar.h"
@@ -56,7 +59,7 @@ bool ExtractStringSetting(Isolate* isolate, Handle<JSObject> options,
   v8::Isolate* v8_isolate = reinterpret_cast<v8::Isolate*>(isolate);
   Handle<String> str = isolate->factory()->NewStringFromAsciiChecked(key);
   Handle<Object> object =
-      JSReceiver::GetProperty(options, str).ToHandleChecked();
+      JSReceiver::GetProperty(isolate, options, str).ToHandleChecked();
   if (object->IsString()) {
     v8::String::Utf8Value utf8_string(
         v8_isolate, v8::Utils::ToLocal(Handle<String>::cast(object)));
@@ -70,10 +73,9 @@ bool ExtractIntegerSetting(Isolate* isolate, Handle<JSObject> options,
                            const char* key, int32_t* value) {
   Handle<String> str = isolate->factory()->NewStringFromAsciiChecked(key);
   Handle<Object> object =
-      JSReceiver::GetProperty(options, str).ToHandleChecked();
+      JSReceiver::GetProperty(isolate, options, str).ToHandleChecked();
   if (object->IsNumber()) {
-    object->ToInt32(value);
-    return true;
+    return object->ToInt32(value);
   }
   return false;
 }
@@ -82,9 +84,9 @@ bool ExtractBooleanSetting(Isolate* isolate, Handle<JSObject> options,
                            const char* key, bool* value) {
   Handle<String> str = isolate->factory()->NewStringFromAsciiChecked(key);
   Handle<Object> object =
-      JSReceiver::GetProperty(options, str).ToHandleChecked();
+      JSReceiver::GetProperty(isolate, options, str).ToHandleChecked();
   if (object->IsBoolean()) {
-    *value = object->BooleanValue();
+    *value = object->BooleanValue(isolate);
     return true;
   }
   return false;
@@ -727,7 +729,8 @@ bool SetResolvedPluralRulesSettings(Isolate* isolate,
 
   Handle<JSObject> pluralCategories = Handle<JSObject>::cast(
       JSObject::GetProperty(
-          resolved, factory->NewStringFromStaticChars("pluralCategories"))
+          isolate, resolved,
+          factory->NewStringFromStaticChars("pluralCategories"))
           .ToHandleChecked());
 
   UErrorCode status = U_ZERO_ERROR;
@@ -906,7 +909,8 @@ icu::DecimalFormat* NumberFormat::InitializeNumberFormat(
 
 icu::DecimalFormat* NumberFormat::UnpackNumberFormat(Isolate* isolate,
                                                      Handle<JSObject> obj) {
-  return reinterpret_cast<icu::DecimalFormat*>(obj->GetEmbedderField(0));
+  return reinterpret_cast<icu::DecimalFormat*>(
+      obj->GetEmbedderField(NumberFormat::kDecimalFormatIndex));
 }
 
 void NumberFormat::DeleteNumberFormat(const v8::WeakCallbackInfo<void>& data) {
@@ -953,7 +957,7 @@ bool Collator::InitializeCollator(Isolate* isolate,
   }
 
   Handle<Managed<icu::Collator>> managed =
-      Managed<icu::Collator>::From(isolate, collator);
+      Managed<icu::Collator>::FromRawPtr(isolate, 0, collator);
   collator_holder->SetEmbedderField(0, *managed);
 
   return true;
@@ -961,7 +965,7 @@ bool Collator::InitializeCollator(Isolate* isolate,
 
 icu::Collator* Collator::UnpackCollator(Isolate* isolate,
                                         Handle<JSObject> obj) {
-  return Managed<icu::Collator>::cast(obj->GetEmbedderField(0))->get();
+  return Managed<icu::Collator>::cast(obj->GetEmbedderField(0))->raw();
 }
 
 bool PluralRules::InitializePluralRules(Isolate* isolate, Handle<String> locale,
@@ -1078,5 +1082,375 @@ void V8BreakIterator::DeleteBreakIterator(
   GlobalHandles::Destroy(reinterpret_cast<Object**>(data.GetParameter()));
 }
 
+// Build the shortened locale; eg, convert xx_Yyyy_ZZ  to xx_ZZ.
+bool Intl::RemoveLocaleScriptTag(const std::string& icu_locale,
+                                 std::string* locale_less_script) {
+  icu::Locale new_locale = icu::Locale::createCanonical(icu_locale.c_str());
+  const char* icu_script = new_locale.getScript();
+  if (icu_script == NULL || strlen(icu_script) == 0) {
+    *locale_less_script = std::string();
+    return false;
+  }
+
+  const char* icu_language = new_locale.getLanguage();
+  const char* icu_country = new_locale.getCountry();
+  icu::Locale short_locale = icu::Locale(icu_language, icu_country);
+  const char* icu_name = short_locale.getName();
+  *locale_less_script = std::string(icu_name);
+  return true;
+}
+
+std::set<std::string> Intl::GetAvailableLocales(const IcuService& service) {
+  const icu::Locale* icu_available_locales = nullptr;
+  int32_t count = 0;
+
+  switch (service) {
+    case IcuService::kBreakIterator:
+      icu_available_locales = icu::BreakIterator::getAvailableLocales(count);
+      break;
+    case IcuService::kCollator:
+      icu_available_locales = icu::Collator::getAvailableLocales(count);
+      break;
+    case IcuService::kDateFormat:
+      icu_available_locales = icu::DateFormat::getAvailableLocales(count);
+      break;
+    case IcuService::kNumberFormat:
+      icu_available_locales = icu::NumberFormat::getAvailableLocales(count);
+      break;
+    case IcuService::kPluralRules:
+      // TODO(littledan): For PluralRules, filter out locales that
+      // don't support PluralRules.
+      // PluralRules is missing an appropriate getAvailableLocales method,
+      // so we should filter from all locales, but it's not clear how; see
+      // https://ssl.icu-project.org/trac/ticket/12756
+      icu_available_locales = icu::Locale::getAvailableLocales(count);
+      break;
+  }
+
+  UErrorCode error = U_ZERO_ERROR;
+  char result[ULOC_FULLNAME_CAPACITY];
+
+  std::set<std::string> locales;
+  for (int32_t i = 0; i < count; ++i) {
+    const char* icu_name = icu_available_locales[i].getName();
+
+    error = U_ZERO_ERROR;
+    // No need to force strict BCP47 rules.
+    uloc_toLanguageTag(icu_name, result, ULOC_FULLNAME_CAPACITY, FALSE, &error);
+    if (U_FAILURE(error) || error == U_STRING_NOT_TERMINATED_WARNING) {
+      // This shouldn't happen, but lets not break the user.
+      continue;
+    }
+    std::string locale(result);
+    locales.insert(locale);
+
+    std::string shortened_locale;
+    if (Intl::RemoveLocaleScriptTag(icu_name, &shortened_locale)) {
+      std::replace(shortened_locale.begin(), shortened_locale.end(), '_', '-');
+      locales.insert(shortened_locale);
+    }
+  }
+
+  return locales;
+}
+
+bool Intl::IsObjectOfType(Isolate* isolate, Handle<Object> input,
+                          Intl::Type expected_type) {
+  if (!input->IsJSObject()) return false;
+  Handle<JSObject> obj = Handle<JSObject>::cast(input);
+
+  Handle<Symbol> marker = isolate->factory()->intl_initialized_marker_symbol();
+  Handle<Object> tag = JSReceiver::GetDataProperty(obj, marker);
+
+  if (!tag->IsSmi()) return false;
+
+  Intl::Type type = Intl::TypeFromSmi(Smi::cast(*tag));
+  return type == expected_type;
+}
+
+namespace {
+
+// In ECMA 402 v1, Intl constructors supported a mode of operation
+// where calling them with an existing object as a receiver would
+// transform the receiver into the relevant Intl instance with all
+// internal slots. In ECMA 402 v2, this capability was removed, to
+// avoid adding internal slots on existing objects. In ECMA 402 v3,
+// the capability was re-added as "normative optional" in a mode
+// which chains the underlying Intl instance on any object, when the
+// constructor is called
+//
+// See ecma402/#legacy-constructor.
+MaybeHandle<Object> LegacyUnwrapReceiver(Isolate* isolate,
+                                         Handle<JSReceiver> receiver,
+                                         Handle<JSFunction> constructor,
+                                         Intl::Type type) {
+  bool has_initialized_slot = Intl::IsObjectOfType(isolate, receiver, type);
+
+  Handle<Object> obj_is_instance_of;
+  ASSIGN_RETURN_ON_EXCEPTION(isolate, obj_is_instance_of,
+                             Object::InstanceOf(isolate, receiver, constructor),
+                             Object);
+  bool is_instance_of = obj_is_instance_of->BooleanValue(isolate);
+
+  // 2. If receiver does not have an [[Initialized...]] internal slot
+  //    and ? InstanceofOperator(receiver, constructor) is true, then
+  if (!has_initialized_slot && is_instance_of) {
+    // 2. a. Let new_receiver be ? Get(receiver, %Intl%.[[FallbackSymbol]]).
+    Handle<Object> new_receiver;
+    ASSIGN_RETURN_ON_EXCEPTION(
+        isolate, new_receiver,
+        JSReceiver::GetProperty(isolate, receiver,
+                                isolate->factory()->intl_fallback_symbol()),
+        Object);
+    return new_receiver;
+  }
+
+  return receiver;
+}
+
+}  // namespace
+
+MaybeHandle<JSObject> Intl::UnwrapReceiver(Isolate* isolate,
+                                           Handle<JSReceiver> receiver,
+                                           Handle<JSFunction> constructor,
+                                           Intl::Type type,
+                                           Handle<String> method_name,
+                                           bool check_legacy_constructor) {
+  Handle<Object> new_receiver = receiver;
+  if (check_legacy_constructor) {
+    ASSIGN_RETURN_ON_EXCEPTION(
+        isolate, new_receiver,
+        LegacyUnwrapReceiver(isolate, receiver, constructor, type), JSObject);
+  }
+
+  // 3. If Type(new_receiver) is not Object or nf does not have an
+  //    [[Initialized...]]  internal slot, then
+  if (!Intl::IsObjectOfType(isolate, new_receiver, type)) {
+    // 3. a. Throw a TypeError exception.
+    THROW_NEW_ERROR(isolate,
+                    NewTypeError(MessageTemplate::kIncompatibleMethodReceiver,
+                                 method_name, receiver),
+                    JSObject);
+  }
+
+  // The above IsObjectOfType returns true only for JSObjects, which
+  // makes this cast safe.
+  return Handle<JSObject>::cast(new_receiver);
+}
+
+MaybeHandle<JSObject> NumberFormat::Unwrap(Isolate* isolate,
+                                           Handle<JSReceiver> receiver,
+                                           const char* method_name) {
+  Handle<Context> native_context =
+      Handle<Context>(isolate->context()->native_context(), isolate);
+  Handle<JSFunction> constructor = Handle<JSFunction>(
+      JSFunction::cast(native_context->intl_number_format_function()), isolate);
+  Handle<String> method_name_str =
+      isolate->factory()->NewStringFromAsciiChecked(method_name);
+
+  return Intl::UnwrapReceiver(isolate, receiver, constructor,
+                              Intl::Type::kNumberFormat, method_name_str, true);
+}
+
+MaybeHandle<Object> NumberFormat::FormatNumber(
+    Isolate* isolate, Handle<JSObject> number_format_holder, double value) {
+  icu::DecimalFormat* number_format =
+      NumberFormat::UnpackNumberFormat(isolate, number_format_holder);
+  CHECK_NOT_NULL(number_format);
+
+  icu::UnicodeString result;
+  number_format->format(value, result);
+
+  return isolate->factory()->NewStringFromTwoByte(Vector<const uint16_t>(
+      reinterpret_cast<const uint16_t*>(result.getBuffer()), result.length()));
+}
+
+// TODO(bstell): enable this anonymous namespace once these routines are called:
+//  * GetLanguageSingletonRegexMatcher,
+//  * GetLanguageTagRegexMatcher
+//  * GetLanguageVariantRegexMatcher
+// namespace {
+
+// TODO(bstell): Make all these a constexpr on the Intl class.
+void BuildLanguageTagRegexes(Isolate* isolate) {
+  std::string alpha = "[a-zA-Z]";
+  std::string digit = "[0-9]";
+  std::string alphanum = "(" + alpha + "|" + digit + ")";
+  std::string regular =
+      "(art-lojban|cel-gaulish|no-bok|no-nyn|zh-guoyu|zh-hakka|"
+      "zh-min|zh-min-nan|zh-xiang)";
+  std::string irregular =
+      "(en-GB-oed|i-ami|i-bnn|i-default|i-enochian|i-hak|"
+      "i-klingon|i-lux|i-mingo|i-navajo|i-pwn|i-tao|i-tay|"
+      "i-tsu|sgn-BE-FR|sgn-BE-NL|sgn-CH-DE)";
+  std::string grandfathered = "(" + irregular + "|" + regular + ")";
+  std::string private_use = "(x(-" + alphanum + "{1,8})+)";
+
+  std::string singleton = "(" + digit + "|[A-WY-Za-wy-z])";
+  std::string language_singleton_regexp = "^" + singleton + "$";
+
+  std::string extension = "(" + singleton + "(-" + alphanum + "{2,8})+)";
+
+  std::string variant = "(" + alphanum + "{5,8}|(" + digit + alphanum + "{3}))";
+  std::string language_variant_regexp = "^" + variant + "$";
+
+  std::string region = "(" + alpha + "{2}|" + digit + "{3})";
+  std::string script = "(" + alpha + "{4})";
+  std::string ext_lang = "(" + alpha + "{3}(-" + alpha + "{3}){0,2})";
+  std::string language = "(" + alpha + "{2,3}(-" + ext_lang + ")?|" + alpha +
+                         "{4}|" + alpha + "{5,8})";
+  std::string lang_tag = language + "(-" + script + ")?(-" + region + ")?(-" +
+                         variant + ")*(-" + extension + ")*(-" + private_use +
+                         ")?";
+
+  std::string language_tag =
+      "^(" + lang_tag + "|" + private_use + "|" + grandfathered + ")$";
+  std::string language_tag_regexp = std::string(language_tag);
+
+  UErrorCode status = U_ZERO_ERROR;
+  icu::RegexMatcher* language_singleton_regexp_matcher = new icu::RegexMatcher(
+      icu::UnicodeString::fromUTF8(language_singleton_regexp), 0, status);
+  icu::RegexMatcher* language_tag_regexp_matcher = new icu::RegexMatcher(
+      icu::UnicodeString::fromUTF8(language_tag_regexp), 0, status);
+  icu::RegexMatcher* language_variant_regexp_matcher = new icu::RegexMatcher(
+      icu::UnicodeString::fromUTF8(language_variant_regexp), 0, status);
+  if (!U_SUCCESS(status)) {
+    return;
+  }
+
+  isolate->set_language_tag_regexp_matchers(language_singleton_regexp_matcher,
+                                            language_tag_regexp_matcher,
+                                            language_variant_regexp_matcher);
+}
+
+icu::RegexMatcher* GetLanguageSingletonRegexMatcher(Isolate* isolate) {
+  icu::RegexMatcher* language_singleton_regexp_matcher =
+      isolate->language_singleton_regexp_matcher();
+  if (language_singleton_regexp_matcher == nullptr) {
+    BuildLanguageTagRegexes(isolate);
+    language_singleton_regexp_matcher =
+        isolate->language_singleton_regexp_matcher();
+  }
+  return language_singleton_regexp_matcher;
+}
+
+icu::RegexMatcher* GetLanguageTagRegexMatcher(Isolate* isolate) {
+  icu::RegexMatcher* language_tag_regexp_matcher =
+      isolate->language_tag_regexp_matcher();
+  if (language_tag_regexp_matcher == nullptr) {
+    BuildLanguageTagRegexes(isolate);
+    language_tag_regexp_matcher = isolate->language_tag_regexp_matcher();
+  }
+  return language_tag_regexp_matcher;
+}
+
+icu::RegexMatcher* GetLanguageVariantRegexMatcher(Isolate* isolate) {
+  icu::RegexMatcher* language_variant_regexp_matcher =
+      isolate->language_variant_regexp_matcher();
+  if (language_variant_regexp_matcher == nullptr) {
+    BuildLanguageTagRegexes(isolate);
+    language_variant_regexp_matcher =
+        isolate->language_variant_regexp_matcher();
+  }
+  return language_variant_regexp_matcher;
+}
+
+// }  // anonymous namespace
+
+MaybeHandle<JSObject> Intl::ResolveLocale(Isolate* isolate, const char* service,
+                                          Handle<Object> requestedLocales,
+                                          Handle<Object> options) {
+  Handle<String> service_str =
+      isolate->factory()->NewStringFromAsciiChecked(service);
+
+  Handle<JSFunction> resolve_locale_function = isolate->resolve_locale();
+
+  Handle<Object> result;
+  Handle<Object> undefined_value(ReadOnlyRoots(isolate).undefined_value(),
+                                 isolate);
+  Handle<Object> args[] = {service_str, requestedLocales, options};
+  ASSIGN_RETURN_ON_EXCEPTION(
+      isolate, result,
+      Execution::Call(isolate, resolve_locale_function, undefined_value,
+                      arraysize(args), args),
+      JSObject);
+
+  return Handle<JSObject>::cast(result);
+}
+
+Maybe<bool> Intl::GetStringOption(Isolate* isolate, Handle<JSReceiver> options,
+                                  const char* property,
+                                  std::vector<const char*> values,
+                                  const char* service,
+                                  std::unique_ptr<char[]>* result) {
+  Handle<String> property_str =
+      isolate->factory()->NewStringFromAsciiChecked(property);
+
+  // 1. Let value be ? Get(options, property).
+  Handle<Object> value;
+  ASSIGN_RETURN_ON_EXCEPTION_VALUE(
+      isolate, value, Object::GetPropertyOrElement(options, property_str),
+      Nothing<bool>());
+
+  if (value->IsUndefined(isolate)) {
+    return Just(false);
+  }
+
+  // 2. c. Let value be ? ToString(value).
+  Handle<String> value_str;
+  ASSIGN_RETURN_ON_EXCEPTION_VALUE(
+      isolate, value_str, Object::ToString(isolate, value), Nothing<bool>());
+  std::unique_ptr<char[]> value_cstr = value_str->ToCString();
+
+  // 2. d. if values is not undefined, then
+  if (values.size() > 0) {
+    // 2. d. i. If values does not contain an element equal to value,
+    // throw a RangeError exception.
+    for (size_t i = 0; i < values.size(); i++) {
+      if (strcmp(values.at(i), value_cstr.get()) == 0) {
+        // 2. e. return value
+        *result = std::move(value_cstr);
+        return Just(true);
+      }
+    }
+
+    Handle<String> service_str =
+        isolate->factory()->NewStringFromAsciiChecked(service);
+    THROW_NEW_ERROR_RETURN_VALUE(
+        isolate,
+        NewRangeError(MessageTemplate::kValueOutOfRange, value, service_str,
+                      property_str),
+        Nothing<bool>());
+  }
+
+  // 2. e. return value
+  *result = std::move(value_cstr);
+  return Just(true);
+}
+
+V8_WARN_UNUSED_RESULT Maybe<bool> Intl::GetBoolOption(
+    Isolate* isolate, Handle<JSReceiver> options, const char* property,
+    const char* service, bool* result) {
+  Handle<String> property_str =
+      isolate->factory()->NewStringFromAsciiChecked(property);
+
+  // 1. Let value be ? Get(options, property).
+  Handle<Object> value;
+  ASSIGN_RETURN_ON_EXCEPTION_VALUE(
+      isolate, value, Object::GetPropertyOrElement(options, property_str),
+      Nothing<bool>());
+
+  // 2. If value is not undefined, then
+  if (!value->IsUndefined(isolate)) {
+    // 2. b. i. Let value be ToBoolean(value).
+    *result = value->BooleanValue(isolate);
+
+    // 2. e. return value
+    return Just(true);
+  }
+
+  return Just(false);
+}
+
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/src/objects/intl-objects.h b/deps/v8/src/objects/intl-objects.h
index 84cf85c6da3720..d9cfd679653a9b 100644
--- a/deps/v8/src/objects/intl-objects.h
+++ b/deps/v8/src/objects/intl-objects.h
@@ -9,6 +9,11 @@
 #ifndef V8_OBJECTS_INTL_OBJECTS_H_
 #define V8_OBJECTS_INTL_OBJECTS_H_
 
+#include <set>
+#include <string>
+
+#include "src/contexts.h"
+#include "src/intl.h"
 #include "src/objects.h"
 #include "unicode/uversion.h"
 
@@ -67,9 +72,47 @@ class NumberFormat {
   // holds the pointer gets garbage collected.
   static void DeleteNumberFormat(const v8::WeakCallbackInfo<void>& data);
 
+  // The UnwrapNumberFormat abstract operation gets the underlying
+  // NumberFormat operation for various methods which implement
+  // ECMA-402 v1 semantics for supporting initializing existing Intl
+  // objects.
+  //
+  // ecma402/#sec-unwrapnumberformat
+  static MaybeHandle<JSObject> Unwrap(Isolate* isolate,
+                                      Handle<JSReceiver> receiver,
+                                      const char* method_name);
+
+  // ecm402/#sec-formatnumber
+  static MaybeHandle<Object> FormatNumber(Isolate* isolate,
+                                          Handle<JSObject> number_format_holder,
+                                          double value);
+
   // Layout description.
-  static const int kDecimalFormat = JSObject::kHeaderSize;
-  static const int kSize = kDecimalFormat + kPointerSize;
+#define NUMBER_FORMAT_FIELDS(V)   \
+  /* Pointer fields. */           \
+  V(kDecimalFormat, kPointerSize) \
+  V(kBoundFormat, kPointerSize)   \
+  V(kSize, 0)
+
+  DEFINE_FIELD_OFFSET_CONSTANTS(JSObject::kHeaderSize, NUMBER_FORMAT_FIELDS)
+#undef NUMBER_FORMAT_FIELDS
+
+  // ContextSlot defines the context structure for the bound
+  // NumberFormat.prototype.format function.
+  enum ContextSlot {
+    // The number format instance that the function holding this
+    // context is bound to.
+    kNumberFormat = Context::MIN_CONTEXT_SLOTS,
+
+    kLength
+  };
+
+  // TODO(gsathya): Remove this and use regular accessors once
+  // NumberFormat is a sub class of JSObject.
+  //
+  // This needs to be consistent with the above LayoutDescription.
+  static const int kDecimalFormatIndex = 0;
+  static const int kBoundFormatIndex = 1;
 
  private:
   NumberFormat();
@@ -159,6 +202,105 @@ class V8BreakIterator {
   V8BreakIterator();
 };
 
+class Intl {
+ public:
+  enum Type {
+    kNumberFormat = 0,
+    kCollator,
+    kDateTimeFormat,
+    kPluralRules,
+    kBreakIterator,
+    kLocale,
+
+    kTypeCount
+  };
+
+  inline static Intl::Type TypeFromInt(int type);
+  inline static Intl::Type TypeFromSmi(Smi* type);
+
+  // Checks if the given object has the expected_type based by looking
+  // up a private symbol on the object.
+  //
+  // TODO(gsathya): This should just be an instance type check once we
+  // move all the Intl objects to C++.
+  static bool IsObjectOfType(Isolate* isolate, Handle<Object> object,
+                             Intl::Type expected_type);
+
+  // Gets the ICU locales for a given service. If there is a locale with a
+  // script tag then the locales also include a locale without the script; eg,
+  // pa_Guru_IN (language=Panjabi, script=Gurmukhi, country-India) would include
+  // pa_IN.
+  static std::set<std::string> GetAvailableLocales(const IcuService& service);
+
+  // If locale has a script tag then return true and the locale without the
+  // script else return false and an empty string
+  static bool RemoveLocaleScriptTag(const std::string& icu_locale,
+                                    std::string* locale_less_script);
+
+  // Returns the underlying Intl receiver for various methods which
+  // implement ECMA-402 v1 semantics for supporting initializing
+  // existing Intl objects.
+  V8_WARN_UNUSED_RESULT static MaybeHandle<JSObject> UnwrapReceiver(
+      Isolate* isolate, Handle<JSReceiver> receiver,
+      Handle<JSFunction> constructor, Intl::Type type,
+      Handle<String> method_name /* TODO(gsathya): Make this char const* */,
+      bool check_legacy_constructor = false);
+
+  // The ResolveLocale abstract operation compares a BCP 47 language
+  // priority list requestedLocales against the locales in
+  // availableLocales and determines the best available language to
+  // meet the request. availableLocales, requestedLocales, and
+  // relevantExtensionKeys must be provided as List values, options
+  // and localeData as Records.
+  //
+  // #ecma402/sec-partitiondatetimepattern
+  //
+  // Returns a JSObject with two properties:
+  //   (1) locale
+  //   (2) extension
+  //
+  // To access either, use JSObject::GetDataProperty.
+  V8_WARN_UNUSED_RESULT static MaybeHandle<JSObject> ResolveLocale(
+      Isolate* isolate, const char* service, Handle<Object> requestedLocales,
+      Handle<Object> options);
+
+  // ECMA402 9.2.10. GetOption( options, property, type, values, fallback)
+  // ecma402/#sec-getoption
+  //
+  // This is specialized for the case when type is string.
+  //
+  // Instead of passing undefined for the values argument as the spec
+  // defines, pass in an empty vector.
+  //
+  // Returns true if options object has the property and stores the
+  // result in value. Returns false if the value is not found. The
+  // caller is required to use fallback value appropriately in this
+  // case.
+  //
+  // service is a string denoting the type of Intl object; used when
+  // printing the error message.
+  V8_WARN_UNUSED_RESULT static Maybe<bool> GetStringOption(
+      Isolate* isolate, Handle<JSReceiver> options, const char* property,
+      std::vector<const char*> values, const char* service,
+      std::unique_ptr<char[]>* result);
+
+  // ECMA402 9.2.10. GetOption( options, property, type, values, fallback)
+  // ecma402/#sec-getoption
+  //
+  // This is specialized for the case when type is boolean.
+  //
+  // Returns true if options object has the property and stores the
+  // result in value. Returns false if the value is not found. The
+  // caller is required to use fallback value appropriately in this
+  // case.
+  //
+  // service is a string denoting the type of Intl object; used when
+  // printing the error message.
+  V8_WARN_UNUSED_RESULT static Maybe<bool> GetBoolOption(
+      Isolate* isolate, Handle<JSReceiver> options, const char* property,
+      const char* service, bool* result);
+};
+
 }  // namespace internal
 }  // namespace v8
 
diff --git a/deps/v8/src/objects/js-array-inl.h b/deps/v8/src/objects/js-array-inl.h
index 2500acfe9840c3..04e484c803d218 100644
--- a/deps/v8/src/objects/js-array-inl.h
+++ b/deps/v8/src/objects/js-array-inl.h
@@ -14,10 +14,6 @@
 namespace v8 {
 namespace internal {
 
-TYPE_CHECKER(JSArray, JS_ARRAY_TYPE)
-TYPE_CHECKER(JSArrayBuffer, JS_ARRAY_BUFFER_TYPE)
-TYPE_CHECKER(JSTypedArray, JS_TYPED_ARRAY_TYPE)
-
 CAST_ACCESSOR(JSArray)
 CAST_ACCESSOR(JSArrayBuffer)
 CAST_ACCESSOR(JSArrayBufferView)
@@ -51,12 +47,13 @@ void JSArray::SetContent(Handle<JSArray> array,
   EnsureCanContainElements(array, storage, storage->length(),
                            ALLOW_COPIED_DOUBLE_ELEMENTS);
 
-  DCHECK((storage->map() == array->GetHeap()->fixed_double_array_map() &&
-          IsDoubleElementsKind(array->GetElementsKind())) ||
-         ((storage->map() != array->GetHeap()->fixed_double_array_map()) &&
-          (IsObjectElementsKind(array->GetElementsKind()) ||
-           (IsSmiElementsKind(array->GetElementsKind()) &&
-            Handle<FixedArray>::cast(storage)->ContainsOnlySmisOrHoles()))));
+  DCHECK(
+      (storage->map() == array->GetReadOnlyRoots().fixed_double_array_map() &&
+       IsDoubleElementsKind(array->GetElementsKind())) ||
+      ((storage->map() != array->GetReadOnlyRoots().fixed_double_array_map()) &&
+       (IsObjectElementsKind(array->GetElementsKind()) ||
+        (IsSmiElementsKind(array->GetElementsKind()) &&
+         Handle<FixedArray>::cast(storage)->ContainsOnlySmisOrHoles()))));
   array->set_elements(*storage);
   array->set_length(Smi::FromInt(storage->length()));
 }
@@ -107,12 +104,6 @@ void* JSArrayBuffer::allocation_base() const {
   return backing_store();
 }
 
-ArrayBuffer::Allocator::AllocationMode JSArrayBuffer::allocation_mode() const {
-  using AllocationMode = ArrayBuffer::Allocator::AllocationMode;
-  return is_wasm_memory() ? AllocationMode::kReservation
-                          : AllocationMode::kNormal;
-}
-
 bool JSArrayBuffer::is_wasm_memory() const {
   bool const is_wasm_memory = IsWasmMemory::decode(bit_field());
   DCHECK_EQ(is_wasm_memory,
diff --git a/deps/v8/src/objects/js-array.h b/deps/v8/src/objects/js-array.h
index 6df0af17cb86dd..652d4df108cc7c 100644
--- a/deps/v8/src/objects/js-array.h
+++ b/deps/v8/src/objects/js-array.h
@@ -71,7 +71,7 @@ class JSArray : public JSObject {
   DECL_CAST(JSArray)
 
   // Dispatched behavior.
-  DECL_PRINTER(JSArray)
+  DECL_PRINTER_WITH_ISOLATE(JSArray)
   DECL_VERIFIER(JSArray)
 
   // Number of element slots to pre-allocate for an empty array.
@@ -94,6 +94,9 @@ class JSArray : public JSObject {
        AllocationMemento::kSize) >>
       kDoubleSizeLog2;
 
+  // Valid array indices range from +0 <= i < 2^32 - 1 (kMaxUInt32).
+  static const uint32_t kMaxArrayIndex = kMaxUInt32 - 1;
+
  private:
   DISALLOW_IMPLICIT_CONSTRUCTORS(JSArray);
 };
@@ -105,7 +108,7 @@ Handle<Object> CacheInitialJSArrayMaps(Handle<Context> native_context,
 // defined in ES section #sec-array-iterator-objects.
 class JSArrayIterator : public JSObject {
  public:
-  DECL_PRINTER(JSArrayIterator)
+  DECL_PRINTER_WITH_ISOLATE(JSArrayIterator)
   DECL_VERIFIER(JSArrayIterator)
 
   DECL_CAST(JSArrayIterator)
@@ -170,23 +173,19 @@ class JSArrayBuffer : public JSObject {
 
   void Neuter();
 
-  inline ArrayBuffer::Allocator::AllocationMode allocation_mode() const;
-
   struct Allocation {
     using AllocationMode = ArrayBuffer::Allocator::AllocationMode;
 
     Allocation(void* allocation_base, size_t length, void* backing_store,
-               AllocationMode mode, bool is_wasm_memory)
+               bool is_wasm_memory)
         : allocation_base(allocation_base),
           length(length),
           backing_store(backing_store),
-          mode(mode),
           is_wasm_memory(is_wasm_memory) {}
 
     void* allocation_base;
     size_t length;
     void* backing_store;
-    AllocationMode mode;
     bool is_wasm_memory;
   };
 
@@ -196,6 +195,10 @@ class JSArrayBuffer : public JSObject {
   // Sets whether the buffer is tracked by the WasmMemoryTracker.
   void set_is_wasm_memory(bool is_wasm_memory);
 
+  // Removes the backing store from the WasmMemoryTracker and sets
+  // |is_wasm_memory| to false.
+  void StopTrackingWasmMemory(Isolate* isolate);
+
   void FreeBackingStoreFromMainThread();
   static void FreeBackingStore(Isolate* isolate, Allocation allocation);
 
@@ -212,7 +215,7 @@ class JSArrayBuffer : public JSObject {
       SharedFlag shared = SharedFlag::kNotShared) V8_WARN_UNUSED_RESULT;
 
   // Dispatched behavior.
-  DECL_PRINTER(JSArrayBuffer)
+  DECL_PRINTER_WITH_ISOLATE(JSArrayBuffer)
   DECL_VERIFIER(JSArrayBuffer)
 
   static const int kByteLengthOffset = JSObject::kHeaderSize;
@@ -304,7 +307,7 @@ class JSTypedArray : public JSArrayBufferView {
                                                    const char* method_name);
 
   // Dispatched behavior.
-  DECL_PRINTER(JSTypedArray)
+  DECL_PRINTER_WITH_ISOLATE(JSTypedArray)
   DECL_VERIFIER(JSTypedArray)
 
   static const int kLengthOffset = kViewSize;
@@ -328,7 +331,7 @@ class JSDataView : public JSArrayBufferView {
   DECL_CAST(JSDataView)
 
   // Dispatched behavior.
-  DECL_PRINTER(JSDataView)
+  DECL_PRINTER_WITH_ISOLATE(JSDataView)
   DECL_VERIFIER(JSDataView)
 
   static const int kSize = kViewSize;
diff --git a/deps/v8/src/objects/js-collection-inl.h b/deps/v8/src/objects/js-collection-inl.h
index 7ad24bcf12977e..12bba94eaabbeb 100644
--- a/deps/v8/src/objects/js-collection-inl.h
+++ b/deps/v8/src/objects/js-collection-inl.h
@@ -18,12 +18,6 @@ ACCESSORS(JSCollectionIterator, table, Object, kTableOffset)
 ACCESSORS(JSCollectionIterator, index, Object, kIndexOffset)
 
 ACCESSORS(JSWeakCollection, table, Object, kTableOffset)
-ACCESSORS(JSWeakCollection, next, Object, kNextOffset)
-
-TYPE_CHECKER(JSMap, JS_MAP_TYPE)
-TYPE_CHECKER(JSSet, JS_SET_TYPE)
-TYPE_CHECKER(JSWeakMap, JS_WEAK_MAP_TYPE)
-TYPE_CHECKER(JSWeakSet, JS_WEAK_SET_TYPE)
 
 CAST_ACCESSOR(JSSet)
 CAST_ACCESSOR(JSSetIterator)
@@ -37,7 +31,7 @@ Object* JSMapIterator::CurrentValue() {
   OrderedHashMap* table(OrderedHashMap::cast(this->table()));
   int index = Smi::ToInt(this->index());
   Object* value = table->ValueAt(index);
-  DCHECK(!value->IsTheHole(table->GetIsolate()));
+  DCHECK(!value->IsTheHole());
   return value;
 }
 
diff --git a/deps/v8/src/objects/js-collection.h b/deps/v8/src/objects/js-collection.h
index 0777ccf1bd92fb..af54ea8731373b 100644
--- a/deps/v8/src/objects/js-collection.h
+++ b/deps/v8/src/objects/js-collection.h
@@ -31,10 +31,10 @@ class JSSet : public JSCollection {
   DECL_CAST(JSSet)
 
   static void Initialize(Handle<JSSet> set, Isolate* isolate);
-  static void Clear(Handle<JSSet> set);
+  static void Clear(Isolate* isolate, Handle<JSSet> set);
 
   // Dispatched behavior.
-  DECL_PRINTER(JSSet)
+  DECL_PRINTER_WITH_ISOLATE(JSSet)
   DECL_VERIFIER(JSSet)
 
  private:
@@ -45,7 +45,7 @@ class JSSetIterator
     : public OrderedHashTableIterator<JSSetIterator, OrderedHashSet> {
  public:
   // Dispatched behavior.
-  DECL_PRINTER(JSSetIterator)
+  DECL_PRINTER_WITH_ISOLATE(JSSetIterator)
   DECL_VERIFIER(JSSetIterator)
 
   DECL_CAST(JSSetIterator)
@@ -60,10 +60,10 @@ class JSMap : public JSCollection {
   DECL_CAST(JSMap)
 
   static void Initialize(Handle<JSMap> map, Isolate* isolate);
-  static void Clear(Handle<JSMap> map);
+  static void Clear(Isolate* isolate, Handle<JSMap> map);
 
   // Dispatched behavior.
-  DECL_PRINTER(JSMap)
+  DECL_PRINTER_WITH_ISOLATE(JSMap)
   DECL_VERIFIER(JSMap)
 
  private:
@@ -74,7 +74,7 @@ class JSMapIterator
     : public OrderedHashTableIterator<JSMapIterator, OrderedHashMap> {
  public:
   // Dispatched behavior.
-  DECL_PRINTER(JSMapIterator)
+  DECL_PRINTER_WITH_ISOLATE(JSMapIterator)
   DECL_VERIFIER(JSMapIterator)
 
   DECL_CAST(JSMapIterator)
@@ -95,9 +95,6 @@ class JSWeakCollection : public JSObject {
   // [table]: the backing hash table mapping keys to values.
   DECL_ACCESSORS(table, Object)
 
-  // [next]: linked list of encountered weak maps during GC.
-  DECL_ACCESSORS(next, Object)
-
   static void Initialize(Handle<JSWeakCollection> collection, Isolate* isolate);
   static void Set(Handle<JSWeakCollection> collection, Handle<Object> key,
                   Handle<Object> value, int32_t hash);
@@ -107,22 +104,16 @@ class JSWeakCollection : public JSObject {
                                     int max_entries);
 
   static const int kTableOffset = JSObject::kHeaderSize;
-  static const int kNextOffset = kTableOffset + kPointerSize;
-  static const int kSize = kNextOffset + kPointerSize;
-
-  // Visiting policy defines whether the table and next collection fields
-  // should be visited or not.
-  enum BodyVisitingPolicy { kIgnoreWeakness, kRespectWeakness };
+  static const int kSize = kTableOffset + kPointerSize;
 
   // Iterates the function object according to the visiting policy.
-  template <BodyVisitingPolicy>
   class BodyDescriptorImpl;
 
   // Visit the whole object.
-  typedef BodyDescriptorImpl<kIgnoreWeakness> BodyDescriptor;
+  typedef BodyDescriptorImpl BodyDescriptor;
 
-  // Don't visit table and next collection fields.
-  typedef BodyDescriptorImpl<kRespectWeakness> BodyDescriptorWeak;
+  // No weak fields.
+  typedef BodyDescriptor BodyDescriptorWeak;
 
  private:
   DISALLOW_IMPLICIT_CONSTRUCTORS(JSWeakCollection);
@@ -134,7 +125,7 @@ class JSWeakMap : public JSWeakCollection {
   DECL_CAST(JSWeakMap)
 
   // Dispatched behavior.
-  DECL_PRINTER(JSWeakMap)
+  DECL_PRINTER_WITH_ISOLATE(JSWeakMap)
   DECL_VERIFIER(JSWeakMap)
 
  private:
@@ -147,7 +138,7 @@ class JSWeakSet : public JSWeakCollection {
   DECL_CAST(JSWeakSet)
 
   // Dispatched behavior.
-  DECL_PRINTER(JSWeakSet)
+  DECL_PRINTER_WITH_ISOLATE(JSWeakSet)
   DECL_VERIFIER(JSWeakSet)
 
  private:
diff --git a/deps/v8/src/objects/js-locale-inl.h b/deps/v8/src/objects/js-locale-inl.h
new file mode 100644
index 00000000000000..65f537ea5203e6
--- /dev/null
+++ b/deps/v8/src/objects/js-locale-inl.h
@@ -0,0 +1,41 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef V8_INTL_SUPPORT
+#error Internationalization is expected to be enabled.
+#endif  // V8_INTL_SUPPORT
+
+#ifndef V8_OBJECTS_JS_LOCALE_INL_H_
+#define V8_OBJECTS_JS_LOCALE_INL_H_
+
+#include "src/objects-inl.h"
+#include "src/objects/js-locale.h"
+
+// Has to be the last include (doesn't have include guards):
+#include "src/objects/object-macros.h"
+
+namespace v8 {
+namespace internal {
+
+// Base locale accessors.
+ACCESSORS(JSLocale, language, Object, kLanguageOffset);
+ACCESSORS(JSLocale, script, Object, kScriptOffset);
+ACCESSORS(JSLocale, region, Object, kRegionOffset);
+ACCESSORS(JSLocale, base_name, Object, kBaseNameOffset);
+ACCESSORS(JSLocale, locale, String, kLocaleOffset);
+
+// Unicode extension accessors.
+ACCESSORS(JSLocale, calendar, Object, kCalendarOffset);
+ACCESSORS(JSLocale, case_first, Object, kCaseFirstOffset);
+ACCESSORS(JSLocale, collation, Object, kCollationOffset);
+ACCESSORS(JSLocale, hour_cycle, Object, kHourCycleOffset);
+ACCESSORS(JSLocale, numeric, Object, kNumericOffset);
+ACCESSORS(JSLocale, numbering_system, Object, kNumberingSystemOffset);
+
+CAST_ACCESSOR(JSLocale);
+
+}  // namespace internal
+}  // namespace v8
+
+#endif  // V8_OBJECTS_JS_LOCALE_INL_H_
diff --git a/deps/v8/src/objects/js-locale.cc b/deps/v8/src/objects/js-locale.cc
new file mode 100644
index 00000000000000..4dc93aa67cbef1
--- /dev/null
+++ b/deps/v8/src/objects/js-locale.cc
@@ -0,0 +1,287 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef V8_INTL_SUPPORT
+#error Internationalization is expected to be enabled.
+#endif  // V8_INTL_SUPPORT
+
+#include "src/objects/js-locale.h"
+
+#include <map>
+#include <memory>
+#include <string>
+
+#include "src/api.h"
+#include "src/global-handles.h"
+#include "src/heap/factory.h"
+#include "src/isolate.h"
+#include "src/objects-inl.h"
+#include "src/objects/intl-objects.h"
+#include "src/objects/js-locale-inl.h"
+#include "unicode/locid.h"
+#include "unicode/unistr.h"
+#include "unicode/uvernum.h"
+#include "unicode/uversion.h"
+
+#if U_ICU_VERSION_MAJOR_NUM >= 59
+#include "unicode/char16ptr.h"
+#endif
+
+namespace v8 {
+namespace internal {
+
+namespace {
+// Inserts tags from options into locale string.
+Maybe<bool> InsertOptionsIntoLocale(Isolate* isolate,
+                                    Handle<JSReceiver> options,
+                                    char* icu_locale) {
+  CHECK(isolate);
+  CHECK(icu_locale);
+
+  static const std::array<std::pair<const char*, const char*>, 6>
+      kOptionToUnicodeTagMap = {{{"calendar", "ca"},
+                                 {"collation", "co"},
+                                 {"hourCycle", "hc"},
+                                 {"caseFirst", "kf"},
+                                 {"numeric", "kn"},
+                                 {"numberingSystem", "nu"}}};
+
+  // TODO(cira): Pass in values as per the spec to make this to be
+  // spec compliant.
+  std::vector<const char*> values = {};
+
+  for (const auto& option_to_bcp47 : kOptionToUnicodeTagMap) {
+    std::unique_ptr<char[]> value_str = nullptr;
+    Maybe<bool> maybe_found = Intl::GetStringOption(
+        isolate, options, option_to_bcp47.first, values, "locale", &value_str);
+    if (maybe_found.IsNothing()) return maybe_found;
+
+    // TODO(cira): Use fallback value if value is not found to make
+    // this spec compliant.
+    if (!maybe_found.FromJust()) continue;
+    DCHECK_NOT_NULL(value_str.get());
+
+    // Convert bcp47 key and value into legacy ICU format so we can use
+    // uloc_setKeywordValue.
+    const char* key = uloc_toLegacyKey(option_to_bcp47.second);
+    DCHECK_NOT_NULL(key);
+
+    // Overwrite existing, or insert new key-value to the locale string.
+    const char* value = uloc_toLegacyType(key, value_str.get());
+    UErrorCode status = U_ZERO_ERROR;
+    if (value) {
+      // TODO(cira): ICU puts artificial limit on locale length, while BCP47
+      // doesn't. Switch to C++ API when it's ready.
+      // Related ICU bug - https://ssl.icu-project.org/trac/ticket/13417.
+      uloc_setKeywordValue(key, value, icu_locale, ULOC_FULLNAME_CAPACITY,
+                           &status);
+      if (U_FAILURE(status) || status == U_STRING_NOT_TERMINATED_WARNING) {
+        return Just(false);
+      }
+    } else {
+      return Just(false);
+    }
+  }
+
+  return Just(true);
+}
+
+// Fills in the JSLocale object slots with Unicode tag/values.
+bool PopulateLocaleWithUnicodeTags(Isolate* isolate, const char* icu_locale,
+                                   Handle<JSLocale> locale_holder) {
+  CHECK(isolate);
+  CHECK(icu_locale);
+
+  Factory* factory = isolate->factory();
+
+  UErrorCode status = U_ZERO_ERROR;
+  UEnumeration* keywords = uloc_openKeywords(icu_locale, &status);
+  if (!keywords) return true;
+
+  char value[ULOC_FULLNAME_CAPACITY];
+  while (const char* keyword = uenum_next(keywords, nullptr, &status)) {
+    uloc_getKeywordValue(icu_locale, keyword, value, ULOC_FULLNAME_CAPACITY,
+                         &status);
+    if (U_FAILURE(status)) {
+      status = U_ZERO_ERROR;
+      continue;
+    }
+
+    // Ignore those we don't recognize - spec allows that.
+    const char* bcp47_key = uloc_toUnicodeLocaleKey(keyword);
+    if (bcp47_key) {
+      const char* bcp47_value = uloc_toUnicodeLocaleType(bcp47_key, value);
+      if (bcp47_value) {
+          // It's either Boolean value.
+          if (strncmp(bcp47_key, "kn", 2) == 0) {
+            bool numeric = strcmp(bcp47_value, "true") == 0 ? true : false;
+            Handle<Object> numeric_handle = factory->ToBoolean(numeric);
+            locale_holder->set_numeric(*numeric_handle);
+            continue;
+          }
+          // Or a string.
+          Handle<String> bcp47_handle =
+              factory->NewStringFromAsciiChecked(bcp47_value);
+          if (strncmp(bcp47_key, "ca", 2) == 0) {
+            locale_holder->set_calendar(*bcp47_handle);
+          } else if (strncmp(bcp47_key, "kf", 2) == 0) {
+            locale_holder->set_case_first(*bcp47_handle);
+          } else if (strncmp(bcp47_key, "co", 2) == 0) {
+            locale_holder->set_collation(*bcp47_handle);
+          } else if (strncmp(bcp47_key, "hc", 2) == 0) {
+            locale_holder->set_hour_cycle(*bcp47_handle);
+          } else if (strncmp(bcp47_key, "nu", 2) == 0) {
+            locale_holder->set_numbering_system(*bcp47_handle);
+          }
+      }
+    }
+  }
+
+  uenum_close(keywords);
+
+  return true;
+}
+}  // namespace
+
+MaybeHandle<JSLocale> JSLocale::InitializeLocale(Isolate* isolate,
+                                                 Handle<JSLocale> locale_holder,
+                                                 Handle<String> locale,
+                                                 Handle<JSReceiver> options) {
+  static const char* const kMethod = "Intl.Locale";
+  v8::Isolate* v8_isolate = reinterpret_cast<v8::Isolate*>(isolate);
+  UErrorCode status = U_ZERO_ERROR;
+
+  // Get ICU locale format, and canonicalize it.
+  char icu_result[ULOC_FULLNAME_CAPACITY];
+  char icu_canonical[ULOC_FULLNAME_CAPACITY];
+
+  v8::String::Utf8Value bcp47_locale(v8_isolate, v8::Utils::ToLocal(locale));
+  if (bcp47_locale.length() == 0) return MaybeHandle<JSLocale>();
+
+  int icu_length = uloc_forLanguageTag(
+      *bcp47_locale, icu_result, ULOC_FULLNAME_CAPACITY, nullptr, &status);
+
+  if (U_FAILURE(status) || status == U_STRING_NOT_TERMINATED_WARNING ||
+      icu_length == 0) {
+    THROW_NEW_ERROR(
+        isolate,
+        NewRangeError(MessageTemplate::kLocaleBadParameters,
+                      isolate->factory()->NewStringFromAsciiChecked(kMethod),
+                      locale_holder),
+        JSLocale);
+    return MaybeHandle<JSLocale>();
+  }
+
+  Maybe<bool> error = InsertOptionsIntoLocale(isolate, options, icu_result);
+  MAYBE_RETURN(error, MaybeHandle<JSLocale>());
+  if (!error.FromJust()) {
+    THROW_NEW_ERROR(
+        isolate,
+        NewRangeError(MessageTemplate::kLocaleBadParameters,
+                      isolate->factory()->NewStringFromAsciiChecked(kMethod),
+                      locale_holder),
+        JSLocale);
+    return MaybeHandle<JSLocale>();
+  }
+  DCHECK(error.FromJust());
+
+  uloc_canonicalize(icu_result, icu_canonical, ULOC_FULLNAME_CAPACITY, &status);
+  if (U_FAILURE(status) || status == U_STRING_NOT_TERMINATED_WARNING) {
+    THROW_NEW_ERROR(
+        isolate,
+        NewRangeError(MessageTemplate::kLocaleBadParameters,
+                      isolate->factory()->NewStringFromAsciiChecked(kMethod),
+                      locale_holder),
+        JSLocale);
+    return MaybeHandle<JSLocale>();
+  }
+
+  if (!PopulateLocaleWithUnicodeTags(isolate, icu_canonical, locale_holder)) {
+    THROW_NEW_ERROR(
+        isolate,
+        NewRangeError(MessageTemplate::kLocaleBadParameters,
+                      isolate->factory()->NewStringFromAsciiChecked(kMethod),
+                      locale_holder),
+        JSLocale);
+    return MaybeHandle<JSLocale>();
+  }
+
+  // Extract language, script and region parts.
+  char icu_language[ULOC_LANG_CAPACITY];
+  uloc_getLanguage(icu_canonical, icu_language, ULOC_LANG_CAPACITY, &status);
+
+  char icu_script[ULOC_SCRIPT_CAPACITY];
+  uloc_getScript(icu_canonical, icu_script, ULOC_SCRIPT_CAPACITY, &status);
+
+  char icu_region[ULOC_COUNTRY_CAPACITY];
+  uloc_getCountry(icu_canonical, icu_region, ULOC_COUNTRY_CAPACITY, &status);
+
+  if (U_FAILURE(status) || status == U_STRING_NOT_TERMINATED_WARNING) {
+    THROW_NEW_ERROR(
+        isolate,
+        NewRangeError(MessageTemplate::kLocaleBadParameters,
+                      isolate->factory()->NewStringFromAsciiChecked(kMethod),
+                      locale_holder),
+        JSLocale);
+    return MaybeHandle<JSLocale>();
+  }
+
+  Factory* factory = isolate->factory();
+
+  // NOTE: One shouldn't use temporary handles, because they can go out of
+  // scope and be garbage collected before properly assigned.
+  // DON'T DO THIS: locale_holder->set_language(*f->NewStringAscii...);
+  Handle<String> language = factory->NewStringFromAsciiChecked(icu_language);
+  locale_holder->set_language(*language);
+
+  if (strlen(icu_script) != 0) {
+    Handle<String> script = factory->NewStringFromAsciiChecked(icu_script);
+    locale_holder->set_script(*script);
+  }
+
+  if (strlen(icu_region) != 0) {
+    Handle<String> region = factory->NewStringFromAsciiChecked(icu_region);
+    locale_holder->set_region(*region);
+  }
+
+  char icu_base_name[ULOC_FULLNAME_CAPACITY];
+  uloc_getBaseName(icu_canonical, icu_base_name, ULOC_FULLNAME_CAPACITY,
+                   &status);
+  // We need to convert it back to BCP47.
+  char bcp47_result[ULOC_FULLNAME_CAPACITY];
+  uloc_toLanguageTag(icu_base_name, bcp47_result, ULOC_FULLNAME_CAPACITY, true,
+                     &status);
+  if (U_FAILURE(status) || status == U_STRING_NOT_TERMINATED_WARNING) {
+    THROW_NEW_ERROR(
+        isolate,
+        NewRangeError(MessageTemplate::kLocaleBadParameters,
+                      isolate->factory()->NewStringFromAsciiChecked(kMethod),
+                      locale_holder),
+        JSLocale);
+    return MaybeHandle<JSLocale>();
+  }
+  Handle<String> base_name = factory->NewStringFromAsciiChecked(bcp47_result);
+  locale_holder->set_base_name(*base_name);
+
+  // Produce final representation of the locale string, for toString().
+  uloc_toLanguageTag(icu_canonical, bcp47_result, ULOC_FULLNAME_CAPACITY, true,
+                     &status);
+  if (U_FAILURE(status) || status == U_STRING_NOT_TERMINATED_WARNING) {
+    THROW_NEW_ERROR(
+        isolate,
+        NewRangeError(MessageTemplate::kLocaleBadParameters,
+                      isolate->factory()->NewStringFromAsciiChecked(kMethod),
+                      locale_holder),
+        JSLocale);
+    return MaybeHandle<JSLocale>();
+  }
+  Handle<String> locale_handle =
+      factory->NewStringFromAsciiChecked(bcp47_result);
+  locale_holder->set_locale(*locale_handle);
+
+  return locale_holder;
+}
+
+}  // namespace internal
+}  // namespace v8
diff --git a/deps/v8/src/objects/js-locale.h b/deps/v8/src/objects/js-locale.h
new file mode 100644
index 00000000000000..74d64bf486932f
--- /dev/null
+++ b/deps/v8/src/objects/js-locale.h
@@ -0,0 +1,79 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef V8_INTL_SUPPORT
+#error Internationalization is expected to be enabled.
+#endif  // V8_INTL_SUPPORT
+
+#ifndef V8_OBJECTS_JS_LOCALE_H_
+#define V8_OBJECTS_JS_LOCALE_H_
+
+#include "src/api.h"
+#include "src/global-handles.h"
+#include "src/heap/factory.h"
+#include "src/isolate.h"
+#include "src/objects.h"
+#include "unicode/unistr.h"
+
+// Has to be the last include (doesn't have include guards):
+#include "src/objects/object-macros.h"
+
+namespace v8 {
+namespace internal {
+
+class JSLocale : public JSObject {
+ public:
+  // Initializes locale object with properties derived from input locale string
+  // and options.
+  static MaybeHandle<JSLocale> InitializeLocale(Isolate* isolate,
+                                                Handle<JSLocale> locale_holder,
+                                                Handle<String> locale,
+                                                Handle<JSReceiver> options);
+
+  DECL_CAST(JSLocale)
+
+  // Locale accessors.
+  DECL_ACCESSORS(language, Object)
+  DECL_ACCESSORS(script, Object)
+  DECL_ACCESSORS(region, Object)
+  DECL_ACCESSORS(base_name, Object)
+  DECL_ACCESSORS(locale, String)
+
+  // Unicode extension accessors.
+  DECL_ACCESSORS(calendar, Object)
+  DECL_ACCESSORS(case_first, Object)
+  DECL_ACCESSORS(collation, Object)
+  DECL_ACCESSORS(hour_cycle, Object)
+  DECL_ACCESSORS(numeric, Object)
+  DECL_ACCESSORS(numbering_system, Object)
+
+  DECL_PRINTER(JSLocale)
+  DECL_VERIFIER(JSLocale)
+
+  // Layout description.
+  static const int kJSLocaleOffset = JSObject::kHeaderSize;
+  // Locale fields.
+  static const int kLanguageOffset = kJSLocaleOffset + kPointerSize;
+  static const int kScriptOffset = kLanguageOffset + kPointerSize;
+  static const int kRegionOffset = kScriptOffset + kPointerSize;
+  static const int kBaseNameOffset = kRegionOffset + kPointerSize;
+  static const int kLocaleOffset = kBaseNameOffset + kPointerSize;
+  // Unicode extension fields.
+  static const int kCalendarOffset = kLocaleOffset + kPointerSize;
+  static const int kCaseFirstOffset = kCalendarOffset + kPointerSize;
+  static const int kCollationOffset = kCaseFirstOffset + kPointerSize;
+  static const int kHourCycleOffset = kCollationOffset + kPointerSize;
+  static const int kNumericOffset = kHourCycleOffset + kPointerSize;
+  static const int kNumberingSystemOffset = kNumericOffset + kPointerSize;
+  // Final size.
+  static const int kSize = kNumberingSystemOffset + kPointerSize;
+
+ private:
+  DISALLOW_IMPLICIT_CONSTRUCTORS(JSLocale);
+};
+
+}  // namespace internal
+}  // namespace v8
+
+#endif  // V8_OBJECTS_JS_LOCALE_H_
diff --git a/deps/v8/src/objects/js-promise-inl.h b/deps/v8/src/objects/js-promise-inl.h
index afe297b8800257..3eb1a4fff11e3e 100644
--- a/deps/v8/src/objects/js-promise-inl.h
+++ b/deps/v8/src/objects/js-promise-inl.h
@@ -14,7 +14,6 @@
 namespace v8 {
 namespace internal {
 
-TYPE_CHECKER(JSPromise, JS_PROMISE_TYPE)
 CAST_ACCESSOR(JSPromise)
 
 ACCESSORS(JSPromise, reactions_or_result, Object, kReactionsOrResultOffset)
diff --git a/deps/v8/src/objects/js-promise.h b/deps/v8/src/objects/js-promise.h
index 434bae893380d5..ffad6e60dced90 100644
--- a/deps/v8/src/objects/js-promise.h
+++ b/deps/v8/src/objects/js-promise.h
@@ -45,6 +45,9 @@ class JSPromise : public JSObject {
   // block in an async function.
   DECL_BOOLEAN_ACCESSORS(handled_hint)
 
+  int async_task_id() const;
+  void set_async_task_id(int id);
+
   static const char* Status(Promise::PromiseState status);
   Promise::PromiseState status() const;
   void set_status(Promise::PromiseState status);
@@ -62,7 +65,7 @@ class JSPromise : public JSObject {
   DECL_CAST(JSPromise)
 
   // Dispatched behavior.
-  DECL_PRINTER(JSPromise)
+  DECL_PRINTER_WITH_ISOLATE(JSPromise)
   DECL_VERIFIER(JSPromise)
 
   // Layout description.
@@ -77,6 +80,7 @@ class JSPromise : public JSObject {
   static const int kStatusBits = 2;
   static const int kHasHandlerBit = 2;
   static const int kHandledHintBit = 3;
+  class AsyncTaskIdField : public BitField<int, kHandledHintBit + 1, 22> {};
 
   static const int kStatusShift = 0;
   static const int kStatusMask = 0x3;
diff --git a/deps/v8/src/objects/js-regexp-inl.h b/deps/v8/src/objects/js-regexp-inl.h
index 697c81eb429d31..c6f31e81af57bb 100644
--- a/deps/v8/src/objects/js-regexp-inl.h
+++ b/deps/v8/src/objects/js-regexp-inl.h
@@ -15,8 +15,6 @@
 namespace v8 {
 namespace internal {
 
-TYPE_CHECKER(JSRegExp, JS_REGEXP_TYPE)
-
 CAST_ACCESSOR(JSRegExp)
 
 ACCESSORS(JSRegExp, data, Object, kDataOffset)
@@ -26,7 +24,7 @@ ACCESSORS(JSRegExp, last_index, Object, kLastIndexOffset)
 
 JSRegExp::Type JSRegExp::TypeTag() {
   Object* data = this->data();
-  if (data->IsUndefined(GetIsolate())) return JSRegExp::NOT_COMPILED;
+  if (data->IsUndefined()) return JSRegExp::NOT_COMPILED;
   Smi* smi = Smi::cast(FixedArray::cast(data)->get(kTagIndex));
   return static_cast<JSRegExp::Type>(smi->value());
 }
diff --git a/deps/v8/src/objects/js-regexp-string-iterator-inl.h b/deps/v8/src/objects/js-regexp-string-iterator-inl.h
index 1d6a64ec0ce7d2..ca099d48e5cf86 100644
--- a/deps/v8/src/objects/js-regexp-string-iterator-inl.h
+++ b/deps/v8/src/objects/js-regexp-string-iterator-inl.h
@@ -13,8 +13,6 @@
 namespace v8 {
 namespace internal {
 
-TYPE_CHECKER(JSRegExpStringIterator, JS_REGEXP_STRING_ITERATOR_TYPE)
-
 ACCESSORS(JSRegExpStringIterator, iterating_regexp, Object,
           kIteratingRegExpOffset)
 ACCESSORS(JSRegExpStringIterator, iterating_string, String,
diff --git a/deps/v8/src/objects/js-regexp-string-iterator.h b/deps/v8/src/objects/js-regexp-string-iterator.h
index 9821e33efbcff8..2a5b0ff9ecb90f 100644
--- a/deps/v8/src/objects/js-regexp-string-iterator.h
+++ b/deps/v8/src/objects/js-regexp-string-iterator.h
@@ -33,7 +33,7 @@ class JSRegExpStringIterator : public JSObject {
   DECL_BOOLEAN_ACCESSORS(unicode)
 
   DECL_CAST(JSRegExpStringIterator)
-  DECL_PRINTER(JSRegExpStringIterator)
+  DECL_PRINTER_WITH_ISOLATE(JSRegExpStringIterator)
   DECL_VERIFIER(JSRegExpStringIterator)
 
   static const int kIteratingRegExpOffset = JSObject::kHeaderSize;
diff --git a/deps/v8/src/objects/js-regexp.h b/deps/v8/src/objects/js-regexp.h
index 6a0c4e3391b7e3..d0904193e767bc 100644
--- a/deps/v8/src/objects/js-regexp.h
+++ b/deps/v8/src/objects/js-regexp.h
@@ -86,7 +86,7 @@ class JSRegExp : public JSObject {
   DECL_CAST(JSRegExp)
 
   // Dispatched behavior.
-  DECL_PRINTER(JSRegExp)
+  DECL_PRINTER_WITH_ISOLATE(JSRegExp)
   DECL_VERIFIER(JSRegExp)
 
   static const int kDataOffset = JSObject::kHeaderSize;
diff --git a/deps/v8/src/objects/js-relative-time-format-inl.h b/deps/v8/src/objects/js-relative-time-format-inl.h
new file mode 100644
index 00000000000000..3d2a5c8e096d7a
--- /dev/null
+++ b/deps/v8/src/objects/js-relative-time-format-inl.h
@@ -0,0 +1,62 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef V8_INTL_SUPPORT
+#error Internationalization is expected to be enabled.
+#endif  // V8_INTL_SUPPORT
+
+#ifndef V8_OBJECTS_JS_RELATIVE_TIME_FORMAT_INL_H_
+#define V8_OBJECTS_JS_RELATIVE_TIME_FORMAT_INL_H_
+
+#include "src/objects-inl.h"
+#include "src/objects/js-relative-time-format.h"
+
+// Has to be the last include (doesn't have include guards):
+#include "src/objects/object-macros.h"
+
+namespace v8 {
+namespace internal {
+
+// Base relative time format accessors.
+ACCESSORS(JSRelativeTimeFormat, locale, String, kLocaleOffset);
+ACCESSORS(JSRelativeTimeFormat, formatter, Foreign, kFormatterOffset);
+
+// TODO(ftang): Use bit field accessor for style and numeric later.
+
+inline void JSRelativeTimeFormat::set_style(Style style) {
+  DCHECK_GT(Style::COUNT, style);
+  int value = static_cast<int>(style);
+  WRITE_FIELD(this, kStyleOffset, Smi::FromInt(value));
+}
+
+inline JSRelativeTimeFormat::Style JSRelativeTimeFormat::style() const {
+  Object* value = READ_FIELD(this, kStyleOffset);
+  int style = Smi::ToInt(value);
+  DCHECK_LE(0, style);
+  DCHECK_GT(static_cast<int>(Style::COUNT), style);
+  return static_cast<Style>(style);
+}
+
+inline void JSRelativeTimeFormat::set_numeric(Numeric numeric) {
+  DCHECK_GT(Numeric::COUNT, numeric);
+  int value = static_cast<int>(numeric);
+  WRITE_FIELD(this, kNumericOffset, Smi::FromInt(value));
+}
+
+inline JSRelativeTimeFormat::Numeric JSRelativeTimeFormat::numeric() const {
+  Object* value = READ_FIELD(this, kNumericOffset);
+  int numeric = Smi::ToInt(value);
+  DCHECK_LE(0, numeric);
+  DCHECK_GT(static_cast<int>(Numeric::COUNT), numeric);
+  return static_cast<Numeric>(numeric);
+}
+
+CAST_ACCESSOR(JSRelativeTimeFormat);
+
+}  // namespace internal
+}  // namespace v8
+
+#include "src/objects/object-macros-undef.h"
+
+#endif  // V8_OBJECTS_JS_RELATIVE_TIME_FORMAT_INL_H_
diff --git a/deps/v8/src/objects/js-relative-time-format.cc b/deps/v8/src/objects/js-relative-time-format.cc
new file mode 100644
index 00000000000000..4ab12ddacaa16e
--- /dev/null
+++ b/deps/v8/src/objects/js-relative-time-format.cc
@@ -0,0 +1,227 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef V8_INTL_SUPPORT
+#error Internationalization is expected to be enabled.
+#endif  // V8_INTL_SUPPORT
+
+#include "src/objects/js-relative-time-format.h"
+
+#include <map>
+#include <memory>
+#include <string>
+
+#include "src/heap/factory.h"
+#include "src/isolate.h"
+#include "src/objects-inl.h"
+#include "src/objects/intl-objects.h"
+#include "src/objects/js-relative-time-format-inl.h"
+#include "unicode/numfmt.h"
+#include "unicode/reldatefmt.h"
+
+// Has to be the last include (doesn't have include guards):
+#include "src/objects/object-macros.h"
+
+namespace v8 {
+namespace internal {
+
+namespace {
+UDateRelativeDateTimeFormatterStyle getIcuStyle(
+    JSRelativeTimeFormat::Style style) {
+  switch (style) {
+    case JSRelativeTimeFormat::Style::LONG:
+      return UDAT_STYLE_LONG;
+    case JSRelativeTimeFormat::Style::SHORT:
+      return UDAT_STYLE_SHORT;
+    case JSRelativeTimeFormat::Style::NARROW:
+      return UDAT_STYLE_NARROW;
+    case JSRelativeTimeFormat::Style::COUNT:
+      UNREACHABLE();
+  }
+}
+
+JSRelativeTimeFormat::Style getStyle(const char* str) {
+  if (strcmp(str, "long") == 0) return JSRelativeTimeFormat::Style::LONG;
+  if (strcmp(str, "short") == 0) return JSRelativeTimeFormat::Style::SHORT;
+  if (strcmp(str, "narrow") == 0) return JSRelativeTimeFormat::Style::NARROW;
+  UNREACHABLE();
+}
+
+JSRelativeTimeFormat::Numeric getNumeric(const char* str) {
+  if (strcmp(str, "auto") == 0) return JSRelativeTimeFormat::Numeric::AUTO;
+  if (strcmp(str, "always") == 0) return JSRelativeTimeFormat::Numeric::ALWAYS;
+  UNREACHABLE();
+}
+
+}  // namespace
+
+MaybeHandle<JSRelativeTimeFormat>
+JSRelativeTimeFormat::InitializeRelativeTimeFormat(
+    Isolate* isolate, Handle<JSRelativeTimeFormat> relative_time_format_holder,
+    Handle<Object> input_locales, Handle<Object> input_options) {
+  Factory* factory = isolate->factory();
+
+  // 4. If options is undefined, then
+  Handle<JSReceiver> options;
+  if (input_options->IsUndefined(isolate)) {
+    // a. Let options be ObjectCreate(null).
+    options = isolate->factory()->NewJSObjectWithNullProto();
+    // 5. Else
+  } else {
+    // a. Let options be ? ToObject(options).
+    ASSIGN_RETURN_ON_EXCEPTION(isolate, options,
+                               Object::ToObject(isolate, input_options),
+                               JSRelativeTimeFormat);
+  }
+
+  // 10. Let r be ResolveLocale(%RelativeTimeFormat%.[[AvailableLocales]],
+  //                            requestedLocales, opt,
+  //                            %RelativeTimeFormat%.[[RelevantExtensionKeys]],
+  //                            localeData).
+  Handle<JSObject> r;
+  ASSIGN_RETURN_ON_EXCEPTION(isolate, r,
+                             Intl::ResolveLocale(isolate, "relativetimeformat",
+                                                 input_locales, options),
+                             JSRelativeTimeFormat);
+  Handle<Object> locale_obj =
+      JSObject::GetDataProperty(r, factory->locale_string());
+  Handle<String> locale;
+  ASSIGN_RETURN_ON_EXCEPTION(isolate, locale,
+                             Object::ToString(isolate, locale_obj),
+                             JSRelativeTimeFormat);
+
+  // 11. Let locale be r.[[Locale]].
+  // 12. Set relativeTimeFormat.[[Locale]] to locale.
+  relative_time_format_holder->set_locale(*locale);
+
+  // 14. Let s be ? GetOption(options, "style", "string",
+  //                          «"long", "short", "narrow"», "long").
+  std::unique_ptr<char[]> style_str = nullptr;
+  std::vector<const char*> style_values = {"long", "short", "narrow"};
+  Maybe<bool> maybe_found_style =
+      Intl::GetStringOption(isolate, options, "style", style_values,
+                            "Intl.RelativeTimeFormat", &style_str);
+  Style style_enum = Style::LONG;
+  MAYBE_RETURN(maybe_found_style, MaybeHandle<JSRelativeTimeFormat>());
+  if (maybe_found_style.FromJust()) {
+    DCHECK_NOT_NULL(style_str.get());
+    style_enum = getStyle(style_str.get());
+  }
+
+  // 15. Set relativeTimeFormat.[[Style]] to s.
+  relative_time_format_holder->set_style(style_enum);
+
+  // 16. Let numeric be ? GetOption(options, "numeric", "string",
+  //                                «"always", "auto"», "always").
+  std::unique_ptr<char[]> numeric_str = nullptr;
+  std::vector<const char*> numeric_values = {"always", "auto"};
+  Maybe<bool> maybe_found_numeric =
+      Intl::GetStringOption(isolate, options, "numeric", numeric_values,
+                            "Intl.RelativeTimeFormat", &numeric_str);
+  Numeric numeric_enum = Numeric::ALWAYS;
+  MAYBE_RETURN(maybe_found_numeric, MaybeHandle<JSRelativeTimeFormat>());
+  if (maybe_found_numeric.FromJust()) {
+    DCHECK_NOT_NULL(numeric_str.get());
+    numeric_enum = getNumeric(numeric_str.get());
+  }
+
+  // 17. Set relativeTimeFormat.[[Numeric]] to numeric.
+  relative_time_format_holder->set_numeric(numeric_enum);
+
+  std::unique_ptr<char[]> locale_name = locale->ToCString();
+  icu::Locale icu_locale(locale_name.get());
+  UErrorCode status = U_ZERO_ERROR;
+
+  // 25. Let relativeTimeFormat.[[NumberFormat]] be
+  //     ? Construct(%NumberFormat%, « nfLocale, nfOptions »).
+  icu::NumberFormat* number_format =
+      icu::NumberFormat::createInstance(icu_locale, UNUM_DECIMAL, status);
+  if (U_FAILURE(status) || number_format == nullptr) {
+    THROW_NEW_ERROR(
+        isolate,
+        NewRangeError(MessageTemplate::kRelativeDateTimeFormatterBadParameters),
+        JSRelativeTimeFormat);
+  }
+  // 23. Perform ! CreateDataPropertyOrThrow(nfOptions, "useGrouping", false).
+  number_format->setGroupingUsed(false);
+
+  // 24. Perform ! CreateDataPropertyOrThrow(nfOptions,
+  //                                         "minimumIntegerDigits", 2).
+  // Ref: https://github.com/tc39/proposal-intl-relative-time/issues/80
+  number_format->setMinimumIntegerDigits(2);
+
+  // Change UDISPCTX_CAPITALIZATION_NONE to other values if
+  // ECMA402 later include option to change capitalization.
+  // Ref: https://github.com/tc39/proposal-intl-relative-time/issues/11
+  icu::RelativeDateTimeFormatter* icu_formatter =
+      new icu::RelativeDateTimeFormatter(icu_locale, number_format,
+                                         getIcuStyle(style_enum),
+                                         UDISPCTX_CAPITALIZATION_NONE, status);
+
+  if (U_FAILURE(status) || (icu_formatter == nullptr)) {
+    THROW_NEW_ERROR(
+        isolate,
+        NewRangeError(MessageTemplate::kRelativeDateTimeFormatterBadParameters),
+        JSRelativeTimeFormat);
+  }
+  Handle<Managed<icu::RelativeDateTimeFormatter>> managed_formatter =
+      Managed<icu::RelativeDateTimeFormatter>::FromRawPtr(isolate, 0,
+                                                          icu_formatter);
+
+  // 30. Set relativeTimeFormat.[[InitializedRelativeTimeFormat]] to true.
+  relative_time_format_holder->set_formatter(*managed_formatter);
+  // 31. Return relativeTimeFormat.
+  return relative_time_format_holder;
+}
+
+Handle<JSObject> JSRelativeTimeFormat::ResolvedOptions(
+    Isolate* isolate, Handle<JSRelativeTimeFormat> format_holder) {
+  Factory* factory = isolate->factory();
+  Handle<JSObject> result = factory->NewJSObject(isolate->object_function());
+  Handle<String> locale(format_holder->locale(), isolate);
+  JSObject::AddProperty(isolate, result, factory->locale_string(), locale,
+                        NONE);
+  JSObject::AddProperty(isolate, result, factory->style_string(),
+                        format_holder->StyleAsString(isolate), NONE);
+  JSObject::AddProperty(isolate, result, factory->numeric_string(),
+                        format_holder->NumericAsString(isolate), NONE);
+  return result;
+}
+
+icu::RelativeDateTimeFormatter* JSRelativeTimeFormat::UnpackFormatter(
+    Isolate* isolate, Handle<JSRelativeTimeFormat> holder) {
+  return Managed<icu::RelativeDateTimeFormatter>::cast(holder->formatter())
+      ->raw();
+}
+
+Handle<String> JSRelativeTimeFormat::StyleAsString(Isolate* isolate) const {
+  Factory* factory = isolate->factory();
+  switch (style()) {
+    case Style::LONG:
+      return factory->long_string();
+    case Style::SHORT:
+      return factory->short_string();
+    case Style::NARROW:
+      return factory->narrow_string();
+    case Style::COUNT:
+      UNREACHABLE();
+  }
+}
+
+Handle<String> JSRelativeTimeFormat::NumericAsString(Isolate* isolate) const {
+  Factory* factory = isolate->factory();
+  switch (numeric()) {
+    case Numeric::ALWAYS:
+      return factory->always_string();
+    case Numeric::AUTO:
+      return factory->auto_string();
+    case Numeric::COUNT:
+      UNREACHABLE();
+  }
+}
+
+}  // namespace internal
+}  // namespace v8
+
+#include "src/objects/object-macros-undef.h"
diff --git a/deps/v8/src/objects/js-relative-time-format.h b/deps/v8/src/objects/js-relative-time-format.h
new file mode 100644
index 00000000000000..997fae7e4c7ef0
--- /dev/null
+++ b/deps/v8/src/objects/js-relative-time-format.h
@@ -0,0 +1,105 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef V8_INTL_SUPPORT
+#error Internationalization is expected to be enabled.
+#endif  // V8_INTL_SUPPORT
+
+#ifndef V8_OBJECTS_JS_RELATIVE_TIME_FORMAT_H_
+#define V8_OBJECTS_JS_RELATIVE_TIME_FORMAT_H_
+
+#include "src/heap/factory.h"
+#include "src/isolate.h"
+#include "src/objects.h"
+#include "unicode/uversion.h"
+
+// Has to be the last include (doesn't have include guards):
+#include "src/objects/object-macros.h"
+
+namespace U_ICU_NAMESPACE {
+class RelativeDateTimeFormatter;
+}
+
+namespace v8 {
+namespace internal {
+
+class JSRelativeTimeFormat : public JSObject {
+ public:
+  // Initializes relative time format object with properties derived from input
+  // locales and options.
+  static MaybeHandle<JSRelativeTimeFormat> InitializeRelativeTimeFormat(
+      Isolate* isolate,
+      Handle<JSRelativeTimeFormat> relative_time_format_holder,
+      Handle<Object> locales, Handle<Object> options);
+
+  static Handle<JSObject> ResolvedOptions(
+      Isolate* isolate, Handle<JSRelativeTimeFormat> format_holder);
+
+  // Unpacks formatter object from corresponding JavaScript object.
+  static icu::RelativeDateTimeFormatter* UnpackFormatter(
+      Isolate* isolate,
+      Handle<JSRelativeTimeFormat> relative_time_format_holder);
+  Handle<String> StyleAsString(Isolate* isolate) const;
+  Handle<String> NumericAsString(Isolate* isolate) const;
+
+  DECL_CAST(JSRelativeTimeFormat)
+
+  // RelativeTimeFormat accessors.
+  DECL_ACCESSORS(locale, String)
+  // TODO(ftang): Style requires only 3 bits and Numeric requires only 2 bits
+  // but here we're using 64 bits for each. We should fold these two fields into
+  // a single Flags field and use BIT_FIELD_ACCESSORS to access it.
+  //
+  // Style: identifying the relative time format style used.
+  //
+  // ecma402/#sec-properties-of-intl-relativetimeformat-instances
+
+  enum class Style {
+    LONG,    // Everything spelled out.
+    SHORT,   // Abbreviations used when possible.
+    NARROW,  // Use the shortest possible form.
+    COUNT
+  };
+  inline void set_style(Style style);
+  inline Style style() const;
+
+  // Numeric: identifying whether numerical descriptions are always used, or
+  // used only when no more specific version is available (e.g., "1 day ago" vs
+  // "yesterday").
+  //
+  // ecma402/#sec-properties-of-intl-relativetimeformat-instances
+  enum class Numeric {
+    ALWAYS,  // numerical descriptions are always used ("1 day ago")
+    AUTO,    // numerical descriptions are used only when no more specific
+             // version is available ("yesterday")
+    COUNT
+  };
+  inline void set_numeric(Numeric numeric);
+  inline Numeric numeric() const;
+
+  DECL_ACCESSORS(formatter, Foreign)
+  DECL_PRINTER_WITH_ISOLATE(JSRelativeTimeFormat)
+  DECL_VERIFIER(JSRelativeTimeFormat)
+
+  // Layout description.
+  static const int kJSRelativeTimeFormatOffset = JSObject::kHeaderSize;
+  static const int kLocaleOffset = kJSRelativeTimeFormatOffset + kPointerSize;
+  static const int kStyleOffset = kLocaleOffset + kPointerSize;
+  static const int kNumericOffset = kStyleOffset + kPointerSize;
+  static const int kFormatterOffset = kNumericOffset + kPointerSize;
+  static const int kSize = kFormatterOffset + kPointerSize;
+
+  // Constant to access field
+  static const int kFormatterField = 3;
+
+ private:
+  DISALLOW_IMPLICIT_CONSTRUCTORS(JSRelativeTimeFormat);
+};
+
+}  // namespace internal
+}  // namespace v8
+
+#include "src/objects/object-macros-undef.h"
+
+#endif  // V8_OBJECTS_JS_RELATIVE_TIME_FORMAT_H_
diff --git a/deps/v8/src/objects/literal-objects-inl.h b/deps/v8/src/objects/literal-objects-inl.h
index fa9fcedaab7715..4d247cfd29c734 100644
--- a/deps/v8/src/objects/literal-objects-inl.h
+++ b/deps/v8/src/objects/literal-objects-inl.h
@@ -14,6 +14,9 @@
 namespace v8 {
 namespace internal {
 
+SMI_ACCESSORS(ObjectBoilerplateDescription, flags,
+              FixedArray::OffsetOfElementAt(kLiteralTypeOffset));
+
 CAST_ACCESSOR(ClassBoilerplate)
 
 BIT_FIELD_ACCESSORS(ClassBoilerplate, flags, install_class_name_accessor,
@@ -43,6 +46,23 @@ ACCESSORS(ClassBoilerplate, instance_elements_template, Object,
 ACCESSORS(ClassBoilerplate, instance_computed_properties, FixedArray,
           FixedArray::OffsetOfElementAt(kPrototypeComputedPropertiesIndex));
 
+SMI_ACCESSORS(ArrayBoilerplateDescription, flags, kFlagsOffset);
+
+ACCESSORS(ArrayBoilerplateDescription, constant_elements, FixedArrayBase,
+          kConstantElementsOffset);
+
+ElementsKind ArrayBoilerplateDescription::elements_kind() const {
+  return static_cast<ElementsKind>(flags());
+}
+
+void ArrayBoilerplateDescription::set_elements_kind(ElementsKind kind) {
+  set_flags(kind);
+}
+
+bool ArrayBoilerplateDescription::is_empty() const {
+  return constant_elements()->length() == 0;
+}
+
 }  // namespace internal
 }  // namespace v8
 
diff --git a/deps/v8/src/objects/literal-objects.cc b/deps/v8/src/objects/literal-objects.cc
index 9e0405c8cb98a0..f75338c47b2d09 100644
--- a/deps/v8/src/objects/literal-objects.cc
+++ b/deps/v8/src/objects/literal-objects.cc
@@ -9,29 +9,40 @@
 #include "src/heap/factory.h"
 #include "src/isolate.h"
 #include "src/objects-inl.h"
+#include "src/objects/hash-table-inl.h"
 #include "src/objects/literal-objects-inl.h"
 
 namespace v8 {
 namespace internal {
 
-Object* BoilerplateDescription::name(int index) const {
+Object* ObjectBoilerplateDescription::name(int index) const {
   // get() already checks for out of bounds access, but we do not want to allow
   // access to the last element, if it is the number of properties.
   DCHECK_NE(size(), index);
-  return get(2 * index);
+  return get(2 * index + kDescriptionStartIndex);
 }
 
-Object* BoilerplateDescription::value(int index) const {
-  return get(2 * index + 1);
+Object* ObjectBoilerplateDescription::value(int index) const {
+  return get(2 * index + 1 + kDescriptionStartIndex);
 }
 
-int BoilerplateDescription::size() const {
-  DCHECK_EQ(0, (length() - (this->has_number_of_properties() ? 1 : 0)) % 2);
+void ObjectBoilerplateDescription::set_key_value(int index, Object* key,
+                                                 Object* value) {
+  DCHECK_LT(index, size());
+  DCHECK_GE(index, 0);
+  set(2 * index + kDescriptionStartIndex, key);
+  set(2 * index + 1 + kDescriptionStartIndex, value);
+}
+
+int ObjectBoilerplateDescription::size() const {
+  DCHECK_EQ(0, (length() - kDescriptionStartIndex -
+                (this->has_number_of_properties() ? 1 : 0)) %
+                   2);
   // Rounding is intended.
-  return length() / 2;
+  return (length() - kDescriptionStartIndex) / 2;
 }
 
-int BoilerplateDescription::backing_store_size() const {
+int ObjectBoilerplateDescription::backing_store_size() const {
   if (has_number_of_properties()) {
     // If present, the last entry contains the number of properties.
     return Smi::ToInt(this->get(length() - 1));
@@ -41,8 +52,8 @@ int BoilerplateDescription::backing_store_size() const {
   return size();
 }
 
-void BoilerplateDescription::set_backing_store_size(Isolate* isolate,
-                                                    int backing_store_size) {
+void ObjectBoilerplateDescription::set_backing_store_size(
+    Isolate* isolate, int backing_store_size) {
   DCHECK(has_number_of_properties());
   DCHECK_NE(size(), backing_store_size);
   Handle<Object> backing_store_size_obj =
@@ -50,8 +61,8 @@ void BoilerplateDescription::set_backing_store_size(Isolate* isolate,
   set(length() - 1, *backing_store_size_obj);
 }
 
-bool BoilerplateDescription::has_number_of_properties() const {
-  return length() % 2 != 0;
+bool ObjectBoilerplateDescription::has_number_of_properties() const {
+  return (length() - kDescriptionStartIndex) % 2 != 0;
 }
 
 namespace {
@@ -98,7 +109,7 @@ void AddToDescriptorArrayTemplate(
     } else {
       DCHECK(value_kind == ClassBoilerplate::kGetter ||
              value_kind == ClassBoilerplate::kSetter);
-      Object* raw_accessor = descriptor_array_template->GetValue(entry);
+      Object* raw_accessor = descriptor_array_template->GetStrongValue(entry);
       AccessorPair* pair;
       if (raw_accessor->IsAccessorPair()) {
         pair = AccessorPair::cast(raw_accessor);
@@ -259,8 +270,8 @@ void AddToDictionaryTemplate(Isolate* isolate, Handle<Dictionary> dictionary,
       } else {
         Handle<AccessorPair> pair(isolate->factory()->NewAccessorPair());
         pair->set(component, value);
-        PropertyDetails details(kAccessor, DONT_ENUM,
-                                PropertyCellType::kNoCell);
+        PropertyDetails details(kAccessor, DONT_ENUM, PropertyCellType::kNoCell,
+                                enum_order);
         dictionary->DetailsAtPut(entry, details);
         dictionary->ValueAtPut(entry, *pair);
       }
@@ -383,12 +394,10 @@ class ObjectDescriptor {
     if (HasDictionaryProperties()) {
       properties_dictionary_template_->SetNextEnumerationIndex(
           next_enumeration_index_);
-
-      isolate->heap()->RightTrimFixedArray(
-          *computed_properties_,
-          computed_properties_->length() - current_computed_index_);
+      computed_properties_ = FixedArray::ShrinkOrEmpty(computed_properties_,
+                                                       current_computed_index_);
     } else {
-      DCHECK(descriptor_array_template_->IsSortedNoDuplicates());
+      DCHECK(descriptor_array_template_->IsSortedNoDuplicates(isolate));
     }
   }
 
diff --git a/deps/v8/src/objects/literal-objects.h b/deps/v8/src/objects/literal-objects.h
index c5c2c765c9c192..43a176017d029e 100644
--- a/deps/v8/src/objects/literal-objects.h
+++ b/deps/v8/src/objects/literal-objects.h
@@ -16,16 +16,18 @@ namespace internal {
 
 class ClassLiteral;
 
-// BoilerplateDescription is a list of properties consisting of name value
+// ObjectBoilerplateDescription is a list of properties consisting of name value
 // pairs. In addition to the properties, it provides the projected number
 // of properties in the backing store. This number includes properties with
 // computed names that are not
 // in the list.
-class BoilerplateDescription : public FixedArray {
+class ObjectBoilerplateDescription : public FixedArray {
  public:
   Object* name(int index) const;
   Object* value(int index) const;
 
+  void set_key_value(int index, Object* key, Object* value);
+
   // The number of boilerplate properties.
   int size() const;
 
@@ -34,30 +36,48 @@ class BoilerplateDescription : public FixedArray {
 
   void set_backing_store_size(Isolate* isolate, int backing_store_size);
 
-  DECL_CAST(BoilerplateDescription)
-  DECL_PRINTER(BoilerplateDescription)
+  // Used to encode ObjectLiteral::Flags for nested object literals
+  // Stored as the first element of the fixed array
+  DECL_INT_ACCESSORS(flags)
+  static const int kLiteralTypeOffset = 0;
+  static const int kDescriptionStartIndex = 1;
+
+  DECL_CAST(ObjectBoilerplateDescription)
+  DECL_VERIFIER(ObjectBoilerplateDescription)
+  DECL_PRINTER(ObjectBoilerplateDescription)
 
  private:
   bool has_number_of_properties() const;
 };
 
-// Pair of {ElementsKind} and an array of constant values for {ArrayLiteral}
-// expressions. Used to communicate with the runtime for literal boilerplate
-// creation within the {Runtime_CreateArrayLiteral} method.
-class ConstantElementsPair : public Tuple2 {
+class ArrayBoilerplateDescription : public Struct {
  public:
-  DECL_INT_ACCESSORS(elements_kind)
-  DECL_ACCESSORS(constant_values, FixedArrayBase)
+  // store constant_elements of a fixed array
+  DECL_ACCESSORS(constant_elements, FixedArrayBase)
+
+  inline ElementsKind elements_kind() const;
+  inline void set_elements_kind(ElementsKind kind);
 
   inline bool is_empty() const;
 
-  DECL_CAST(ConstantElementsPair)
+  DECL_CAST(ArrayBoilerplateDescription)
+  // Dispatched behavior.
+  DECL_PRINTER(ArrayBoilerplateDescription)
+  DECL_VERIFIER(ArrayBoilerplateDescription)
+  void BriefPrintDetails(std::ostream& os);
+
+#define ARRAY_BOILERPLATE_DESCRIPTION_FIELDS(V) \
+  V(kFlagsOffset, kPointerSize)                 \
+  V(kConstantElementsOffset, kPointerSize)      \
+  V(kSize, 0)
 
-  static const int kElementsKindOffset = kValue1Offset;
-  static const int kConstantValuesOffset = kValue2Offset;
+  DEFINE_FIELD_OFFSET_CONSTANTS(HeapObject::kHeaderSize,
+                                ARRAY_BOILERPLATE_DESCRIPTION_FIELDS)
+#undef ARRAY_BOILERPLATE_DESCRIPTION_FIELDS
 
  private:
-  DISALLOW_IMPLICIT_CONSTRUCTORS(ConstantElementsPair);
+  DECL_INT_ACCESSORS(flags)
+  DISALLOW_IMPLICIT_CONSTRUCTORS(ArrayBoilerplateDescription);
 };
 
 class ClassBoilerplate : public FixedArray {
diff --git a/deps/v8/src/objects/managed.cc b/deps/v8/src/objects/managed.cc
new file mode 100644
index 00000000000000..034a2085f9e201
--- /dev/null
+++ b/deps/v8/src/objects/managed.cc
@@ -0,0 +1,38 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "src/objects/managed.h"
+
+namespace v8 {
+namespace internal {
+
+namespace {
+// Called by the GC in its second pass when a Managed<CppType> is
+// garbage collected.
+void ManagedObjectFinalizerSecondPass(const v8::WeakCallbackInfo<void>& data) {
+  auto destructor =
+      reinterpret_cast<ManagedPtrDestructor*>(data.GetParameter());
+  int64_t adjustment = 0 - static_cast<int64_t>(destructor->estimated_size_);
+  destructor->destructor_(destructor->shared_ptr_ptr_);
+  delete destructor;
+  data.GetIsolate()->AdjustAmountOfExternalAllocatedMemory(adjustment);
+}
+}  // namespace
+
+// Called by the GC in its first pass when a Managed<CppType> is
+// garbage collected.
+void ManagedObjectFinalizer(const v8::WeakCallbackInfo<void>& data) {
+  auto destructor =
+      reinterpret_cast<ManagedPtrDestructor*>(data.GetParameter());
+  GlobalHandles::Destroy(destructor->global_handle_location_);
+  Isolate* isolate = reinterpret_cast<Isolate*>(data.GetIsolate());
+  isolate->UnregisterManagedPtrDestructor(destructor);
+  // We need to do the main work as a second pass callback because
+  // it can trigger garbage collection. The first pass callbacks
+  // are not allowed to invoke V8 API.
+  data.SetSecondPassCallback(&ManagedObjectFinalizerSecondPass);
+}
+
+}  // namespace internal
+}  // namespace v8
diff --git a/deps/v8/src/objects/managed.h b/deps/v8/src/objects/managed.h
new file mode 100644
index 00000000000000..4c3d67bbfc961c
--- /dev/null
+++ b/deps/v8/src/objects/managed.h
@@ -0,0 +1,129 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef V8_OBJECTS_MANAGED_H_
+#define V8_OBJECTS_MANAGED_H_
+
+#include <memory>
+#include "src/global-handles.h"
+#include "src/handles.h"
+#include "src/heap/factory.h"
+#include "src/isolate.h"
+
+namespace v8 {
+namespace internal {
+
+// Implements a doubly-linked lists of destructors for the isolate.
+struct ManagedPtrDestructor {
+  // Estimated size of external memory associated with the managed object.
+  // This is used to adjust the garbage collector's heuristics upon
+  // allocation and deallocation of a managed object.
+  size_t estimated_size_ = 0;
+  ManagedPtrDestructor* prev_ = nullptr;
+  ManagedPtrDestructor* next_ = nullptr;
+  void* shared_ptr_ptr_ = nullptr;
+  void (*destructor_)(void* shared_ptr) = nullptr;
+  Object** global_handle_location_ = nullptr;
+
+  ManagedPtrDestructor(size_t estimated_size, void* shared_ptr_ptr,
+                       void (*destructor)(void*))
+      : estimated_size_(estimated_size),
+        shared_ptr_ptr_(shared_ptr_ptr),
+        destructor_(destructor) {}
+};
+
+// The GC finalizer of a managed object, which does not depend on
+// the template parameter.
+void ManagedObjectFinalizer(const v8::WeakCallbackInfo<void>& data);
+
+// {Managed<T>} is essentially a {std::shared_ptr<T>} allocated on the heap
+// that can be used to manage the lifetime of C++ objects that are shared
+// across multiple isolates.
+// When a {Managed<T>} object is garbage collected (or an isolate which
+// contains {Managed<T>} is torn down), the {Managed<T>} deletes its underlying
+// {std::shared_ptr<T>}, thereby decrementing its internal reference count,
+// which will delete the C++ object when the reference count drops to 0.
+template <class CppType>
+class Managed : public Foreign {
+ public:
+  // Get a raw pointer to the C++ object.
+  V8_INLINE CppType* raw() { return GetSharedPtrPtr()->get(); }
+
+  // Get a copy of the shared pointer to the C++ object.
+  V8_INLINE std::shared_ptr<CppType> get() { return *GetSharedPtrPtr(); }
+
+  static Managed<CppType>* cast(Object* obj) {
+    SLOW_DCHECK(obj->IsForeign());
+    return reinterpret_cast<Managed<CppType>*>(obj);
+  }
+
+  // Allocate a new {CppType} and wrap it in a {Managed<CppType>}.
+  template <typename... Args>
+  static Handle<Managed<CppType>> Allocate(Isolate* isolate,
+                                           size_t estimated_size,
+                                           Args&&... args) {
+    CppType* ptr = new CppType(std::forward<Args>(args)...);
+    return FromSharedPtr(isolate, estimated_size,
+                         std::shared_ptr<CppType>(ptr));
+  }
+
+  // Create a {Managed<CppType>} from an existing raw {CppType*}. The returned
+  // object will now own the memory pointed to by {CppType}.
+  static Handle<Managed<CppType>> FromRawPtr(Isolate* isolate,
+                                             size_t estimated_size,
+                                             CppType* ptr) {
+    return FromSharedPtr(isolate, estimated_size,
+                         std::shared_ptr<CppType>(ptr));
+  }
+
+  // Create a {Managed<CppType>} from an existing {std::unique_ptr<CppType>}.
+  // The returned object will now own the memory pointed to by {CppType}, and
+  // the unique pointer will be released.
+  static Handle<Managed<CppType>> FromUniquePtr(
+      Isolate* isolate, size_t estimated_size,
+      std::unique_ptr<CppType> unique_ptr) {
+    return FromSharedPtr(isolate, estimated_size, std::move(unique_ptr));
+  }
+
+  // Create a {Managed<CppType>} from an existing {std::shared_ptr<CppType>}.
+  static Handle<Managed<CppType>> FromSharedPtr(
+      Isolate* isolate, size_t estimated_size,
+      std::shared_ptr<CppType> shared_ptr) {
+    reinterpret_cast<v8::Isolate*>(isolate)
+        ->AdjustAmountOfExternalAllocatedMemory(estimated_size);
+    auto destructor = new ManagedPtrDestructor(
+        estimated_size, new std::shared_ptr<CppType>(shared_ptr), Destructor);
+    Handle<Managed<CppType>> handle = Handle<Managed<CppType>>::cast(
+        isolate->factory()->NewForeign(reinterpret_cast<Address>(destructor)));
+    Handle<Object> global_handle = isolate->global_handles()->Create(*handle);
+    destructor->global_handle_location_ = global_handle.location();
+    GlobalHandles::MakeWeak(destructor->global_handle_location_, destructor,
+                            &ManagedObjectFinalizer,
+                            v8::WeakCallbackType::kParameter);
+    isolate->RegisterManagedPtrDestructor(destructor);
+    return handle;
+  }
+
+ private:
+  // Internally this {Foreign} object stores a pointer to a new
+  // std::shared_ptr<CppType>.
+  std::shared_ptr<CppType>* GetSharedPtrPtr() {
+    auto destructor =
+        reinterpret_cast<ManagedPtrDestructor*>(foreign_address());
+    return reinterpret_cast<std::shared_ptr<CppType>*>(
+        destructor->shared_ptr_ptr_);
+  }
+
+  // Called by either isolate shutdown or the {ManagedObjectFinalizer} in
+  // order to actually delete the shared pointer (i.e. decrement its refcount).
+  static void Destructor(void* ptr) {
+    auto shared_ptr_ptr = reinterpret_cast<std::shared_ptr<CppType>*>(ptr);
+    delete shared_ptr_ptr;
+  }
+};
+
+}  // namespace internal
+}  // namespace v8
+
+#endif  // V8_OBJECTS_MANAGED_H_
diff --git a/deps/v8/src/objects/map-inl.h b/deps/v8/src/objects/map-inl.h
index 5916e6b6909bb0..57183a896eeff5 100644
--- a/deps/v8/src/objects/map-inl.h
+++ b/deps/v8/src/objects/map-inl.h
@@ -9,8 +9,10 @@
 
 #include "src/field-type.h"
 #include "src/objects-inl.h"
+#include "src/objects/api-callbacks-inl.h"
 #include "src/objects/descriptor-array.h"
 #include "src/objects/shared-function-info.h"
+#include "src/objects/templates-inl.h"
 #include "src/property.h"
 #include "src/transitions.h"
 
@@ -68,8 +70,6 @@ BIT_FIELD_ACCESSORS(Map, bit_field3, may_have_interesting_symbols,
 BIT_FIELD_ACCESSORS(Map, bit_field3, construction_counter,
                     Map::ConstructionCounterBits)
 
-TYPE_CHECKER(Map, MAP_TYPE)
-
 InterceptorInfo* Map::GetNamedInterceptor() {
   DCHECK(has_named_interceptor());
   FunctionTemplateInfo* info = GetFunctionTemplateInfo();
@@ -86,8 +86,9 @@ bool Map::IsInplaceGeneralizableField(PropertyConstness constness,
                                       Representation representation,
                                       FieldType* field_type) {
   if (FLAG_track_constant_fields && FLAG_modify_map_inplace &&
-      (constness == kConst)) {
-    // kConst -> kMutable field generalization may happen in-place.
+      (constness == PropertyConstness::kConst)) {
+    // VariableMode::kConst -> PropertyConstness::kMutable field generalization
+    // may happen in-place.
     return true;
   }
   if (representation.IsHeapObject() && !field_type->IsAny()) {
@@ -117,9 +118,9 @@ void Map::GeneralizeIfCanHaveTransitionableFastElementsKind(
     // do not have fields that can be generalized in-place (without creation
     // of a new map).
     if (FLAG_track_constant_fields && FLAG_modify_map_inplace) {
-      // The constness is either already kMutable or should become kMutable if
-      // it was kConst.
-      *constness = kMutable;
+      // The constness is either already PropertyConstness::kMutable or should
+      // become PropertyConstness::kMutable if it was VariableMode::kConst.
+      *constness = PropertyConstness::kMutable;
     }
     if (representation->IsHeapObject()) {
       // The field type is either already Any or should become Any if it was
@@ -179,17 +180,17 @@ void Map::SetEnumLength(int length) {
 FixedArrayBase* Map::GetInitialElements() const {
   FixedArrayBase* result = nullptr;
   if (has_fast_elements() || has_fast_string_wrapper_elements()) {
-    result = GetHeap()->empty_fixed_array();
+    result = GetReadOnlyRoots().empty_fixed_array();
   } else if (has_fast_sloppy_arguments_elements()) {
-    result = GetHeap()->empty_sloppy_arguments_elements();
+    result = GetReadOnlyRoots().empty_sloppy_arguments_elements();
   } else if (has_fixed_typed_array_elements()) {
     result = GetHeap()->EmptyFixedTypedArrayForMap(this);
   } else if (has_dictionary_elements()) {
-    result = GetHeap()->empty_slow_element_dictionary();
+    result = GetReadOnlyRoots().empty_slow_element_dictionary();
   } else {
     UNREACHABLE();
   }
-  DCHECK(!GetHeap()->InNewSpace(result));
+  DCHECK(!Heap::InNewSpace(result));
   return result;
 }
 
@@ -266,9 +267,11 @@ int Map::GetInObjectPropertyOffset(int index) const {
 }
 
 Handle<Map> Map::AddMissingTransitionsForTesting(
-    Handle<Map> split_map, Handle<DescriptorArray> descriptors,
+    Isolate* isolate, Handle<Map> split_map,
+    Handle<DescriptorArray> descriptors,
     Handle<LayoutDescriptor> full_layout_descriptor) {
-  return AddMissingTransitions(split_map, descriptors, full_layout_descriptor);
+  return AddMissingTransitions(isolate, split_map, descriptors,
+                               full_layout_descriptor);
 }
 
 InstanceType Map::instance_type() const {
@@ -486,25 +489,27 @@ void Map::NotifyLeafMapLayoutChange() {
   }
 }
 
+bool Map::IsJSObject(InstanceType type) {
+  STATIC_ASSERT(LAST_TYPE == LAST_JS_OBJECT_TYPE);
+  return type >= FIRST_JS_OBJECT_TYPE;
+}
+
 bool Map::CanTransition() const {
   // Only JSObject and subtypes have map transitions and back pointers.
-  STATIC_ASSERT(LAST_TYPE == LAST_JS_OBJECT_TYPE);
-  return instance_type() >= FIRST_JS_OBJECT_TYPE;
+  return IsJSObject(instance_type());
 }
 
-bool Map::IsBooleanMap() const { return this == GetHeap()->boolean_map(); }
+bool Map::IsBooleanMap() const {
+  return this == GetReadOnlyRoots().boolean_map();
+}
 bool Map::IsPrimitiveMap() const {
-  STATIC_ASSERT(FIRST_PRIMITIVE_TYPE == FIRST_TYPE);
   return instance_type() <= LAST_PRIMITIVE_TYPE;
 }
 bool Map::IsJSReceiverMap() const {
   STATIC_ASSERT(LAST_JS_RECEIVER_TYPE == LAST_TYPE);
   return instance_type() >= FIRST_JS_RECEIVER_TYPE;
 }
-bool Map::IsJSObjectMap() const {
-  STATIC_ASSERT(LAST_JS_OBJECT_TYPE == LAST_TYPE);
-  return instance_type() >= FIRST_JS_OBJECT_TYPE;
-}
+bool Map::IsJSObjectMap() const { return IsJSObject(instance_type()); }
 bool Map::IsJSPromiseMap() const { return instance_type() == JS_PROMISE_TYPE; }
 bool Map::IsJSArrayMap() const { return instance_type() == JS_ARRAY_TYPE; }
 bool Map::IsJSFunctionMap() const {
@@ -528,7 +533,7 @@ bool Map::IsJSDataViewMap() const {
 Object* Map::prototype() const { return READ_FIELD(this, kPrototypeOffset); }
 
 void Map::set_prototype(Object* value, WriteBarrierMode mode) {
-  DCHECK(value->IsNull(GetIsolate()) || value->IsJSReceiver());
+  DCHECK(value->IsNull() || value->IsJSReceiver());
   WRITE_FIELD(this, kPrototypeOffset, value);
   CONDITIONAL_WRITE_BARRIER(GetHeap(), this, kPrototypeOffset, value, mode);
 }
@@ -630,13 +635,13 @@ Object* Map::GetBackPointer() const {
   if (object->IsMap()) {
     return object;
   }
-  return GetIsolate()->heap()->undefined_value();
+  return GetReadOnlyRoots().undefined_value();
 }
 
 Map* Map::ElementsTransitionMap() {
   DisallowHeapAllocation no_gc;
-  return TransitionsAccessor(this, &no_gc)
-      .SearchSpecial(GetHeap()->elements_transition_symbol());
+  return TransitionsAccessor(GetIsolate(), this, &no_gc)
+      .SearchSpecial(GetReadOnlyRoots().elements_transition_symbol());
 }
 
 Object* Map::prototype_info() const {
@@ -654,7 +659,7 @@ void Map::set_prototype_info(Object* value, WriteBarrierMode mode) {
 void Map::SetBackPointer(Object* value, WriteBarrierMode mode) {
   CHECK_GE(instance_type(), FIRST_JS_RECEIVER_TYPE);
   CHECK(value->IsMap());
-  CHECK(GetBackPointer()->IsUndefined(GetIsolate()));
+  CHECK(GetBackPointer()->IsUndefined());
   CHECK_IMPLIES(value->IsMap(), Map::cast(value)->GetConstructor() ==
                                     constructor_or_backpointer());
   set_constructor_or_backpointer(value, mode);
@@ -699,8 +704,9 @@ void Map::SetConstructor(Object* constructor, WriteBarrierMode mode) {
   set_constructor_or_backpointer(constructor, mode);
 }
 
-Handle<Map> Map::CopyInitialMap(Handle<Map> map) {
-  return CopyInitialMap(map, map->instance_size(), map->GetInObjectProperties(),
+Handle<Map> Map::CopyInitialMap(Isolate* isolate, Handle<Map> map) {
+  return CopyInitialMap(isolate, map, map->instance_size(),
+                        map->GetInObjectProperties(),
                         map->UnusedPropertyFields());
 }
 
@@ -708,14 +714,14 @@ bool Map::IsInobjectSlackTrackingInProgress() const {
   return construction_counter() != Map::kNoSlackTracking;
 }
 
-void Map::InobjectSlackTrackingStep() {
+void Map::InobjectSlackTrackingStep(Isolate* isolate) {
   // Slack tracking should only be performed on an initial map.
-  DCHECK(GetBackPointer()->IsUndefined(GetIsolate()));
+  DCHECK(GetBackPointer()->IsUndefined());
   if (!IsInobjectSlackTrackingInProgress()) return;
   int counter = construction_counter();
   set_construction_counter(counter - 1);
   if (counter == kSlackTrackingCounterEnd) {
-    CompleteInobjectSlackTracking();
+    CompleteInobjectSlackTracking(isolate);
   }
 }
 
@@ -733,7 +739,8 @@ int NormalizedMapCache::GetIndex(Handle<Map> map) {
   return map->Hash() % NormalizedMapCache::kEntries;
 }
 
-bool NormalizedMapCache::IsNormalizedMapCache(const HeapObject* obj) {
+bool NormalizedMapCache::IsNormalizedMapCache(Isolate* isolate,
+                                              const HeapObject* obj) {
   if (!obj->IsFixedArray()) return false;
   if (FixedArray::cast(obj)->length() != NormalizedMapCache::kEntries) {
     return false;
@@ -741,7 +748,7 @@ bool NormalizedMapCache::IsNormalizedMapCache(const HeapObject* obj) {
 #ifdef VERIFY_HEAP
   if (FLAG_verify_heap) {
     reinterpret_cast<NormalizedMapCache*>(const_cast<HeapObject*>(obj))
-        ->NormalizedMapCacheVerify();
+        ->NormalizedMapCacheVerify(isolate);
   }
 #endif
   return true;
diff --git a/deps/v8/src/objects/map.h b/deps/v8/src/objects/map.h
index 47755216435df0..c3f8a33d859c1f 100644
--- a/deps/v8/src/objects/map.h
+++ b/deps/v8/src/objects/map.h
@@ -16,48 +16,52 @@
 namespace v8 {
 namespace internal {
 
-#define VISITOR_ID_LIST(V) \
-  V(AllocationSite)        \
-  V(BigInt)                \
-  V(ByteArray)             \
-  V(BytecodeArray)         \
-  V(Cell)                  \
-  V(Code)                  \
-  V(CodeDataContainer)     \
-  V(ConsString)            \
-  V(DataObject)            \
-  V(FeedbackCell)          \
-  V(FeedbackVector)        \
-  V(FixedArray)            \
-  V(FixedDoubleArray)      \
-  V(FixedFloat64Array)     \
-  V(FixedTypedArrayBase)   \
-  V(FreeSpace)             \
-  V(JSApiObject)           \
-  V(JSArrayBuffer)         \
-  V(JSFunction)            \
-  V(JSObject)              \
-  V(JSObjectFast)          \
-  V(JSWeakCollection)      \
-  V(Map)                   \
-  V(NativeContext)         \
-  V(Oddball)               \
-  V(PropertyArray)         \
-  V(PropertyCell)          \
-  V(SeqOneByteString)      \
-  V(SeqTwoByteString)      \
-  V(SharedFunctionInfo)    \
-  V(ShortcutCandidate)     \
-  V(SlicedString)          \
-  V(SmallOrderedHashMap)   \
-  V(SmallOrderedHashSet)   \
-  V(Struct)                \
-  V(Symbol)                \
-  V(ThinString)            \
-  V(TransitionArray)       \
-  V(WasmInstanceObject)    \
-  V(WeakCell)              \
-  V(WeakFixedArray)
+#define VISITOR_ID_LIST(V)            \
+  V(AllocationSite)                   \
+  V(BigInt)                           \
+  V(ByteArray)                        \
+  V(BytecodeArray)                    \
+  V(Cell)                             \
+  V(Code)                             \
+  V(CodeDataContainer)                \
+  V(ConsString)                       \
+  V(DataHandler)                      \
+  V(DataObject)                       \
+  V(EphemeronHashTable)               \
+  V(FeedbackCell)                     \
+  V(FeedbackVector)                   \
+  V(FixedArray)                       \
+  V(FixedDoubleArray)                 \
+  V(FixedFloat64Array)                \
+  V(FixedTypedArrayBase)              \
+  V(FreeSpace)                        \
+  V(JSApiObject)                      \
+  V(JSArrayBuffer)                    \
+  V(JSFunction)                       \
+  V(JSObject)                         \
+  V(JSObjectFast)                     \
+  V(JSWeakCollection)                 \
+  V(Map)                              \
+  V(NativeContext)                    \
+  V(Oddball)                          \
+  V(PropertyArray)                    \
+  V(PropertyCell)                     \
+  V(PrototypeInfo)                    \
+  V(SeqOneByteString)                 \
+  V(SeqTwoByteString)                 \
+  V(SharedFunctionInfo)               \
+  V(ShortcutCandidate)                \
+  V(SlicedString)                     \
+  V(SmallOrderedHashMap)              \
+  V(SmallOrderedHashSet)              \
+  V(Struct)                           \
+  V(Symbol)                           \
+  V(ThinString)                       \
+  V(TransitionArray)                  \
+  V(UncompiledDataWithPreParsedScope) \
+  V(WasmInstanceObject)               \
+  V(WeakCell)                         \
+  V(WeakArray)
 
 // For data objects, JS objects and structs along with generic visitor which
 // can visit object of any size we provide visitors specialized by
@@ -126,7 +130,8 @@ typedef std::vector<Handle<Map>> MapHandles;
 //      |          |   - elements_kind (bits 3..7)               |
 // +----+----------+---------------------------------------------+
 // | Int           | [bit_field3]                                |
-// |               |   - number_of_own_descriptors (bit 0..19)   |
+// |               |   - enum_length (bit 0..9)                  |
+// |               |   - number_of_own_descriptors (bit 10..19)  |
 // |               |   - is_dictionary_map (bit 20)              |
 // |               |   - owns_descriptors (bit 21)               |
 // |               |   - has_hidden_prototype (bit 22)           |
@@ -320,11 +325,11 @@ class Map : public HeapObject {
   inline bool IsInobjectSlackTrackingInProgress() const;
 
   // Does the tracking step.
-  inline void InobjectSlackTrackingStep();
+  inline void InobjectSlackTrackingStep(Isolate* isolate);
 
   // Completes inobject slack tracking for the transition tree starting at this
   // initial map.
-  void CompleteInobjectSlackTracking();
+  void CompleteInobjectSlackTracking(Isolate* isolate);
 
   // Tells whether the object in the prototype property will be used
   // for instances created from this function.  If the prototype
@@ -440,8 +445,8 @@ class Map : public HeapObject {
   static Handle<WeakCell> GetOrCreatePrototypeWeakCell(
       Handle<JSReceiver> prototype, Isolate* isolate);
 
-  Map* FindRootMap() const;
-  Map* FindFieldOwner(int descriptor) const;
+  Map* FindRootMap(Isolate* isolate) const;
+  Map* FindFieldOwner(Isolate* isolate, int descriptor) const;
 
   inline int GetInObjectPropertyOffset(int index) const;
 
@@ -465,12 +470,12 @@ class Map : public HeapObject {
                               int target_inobject, int target_unused,
                               int* old_number_of_fields) const;
   // TODO(ishell): moveit!
-  static Handle<Map> GeneralizeAllFields(Handle<Map> map);
+  static Handle<Map> GeneralizeAllFields(Isolate* isolate, Handle<Map> map);
   V8_WARN_UNUSED_RESULT static Handle<FieldType> GeneralizeFieldType(
       Representation rep1, Handle<FieldType> type1, Representation rep2,
       Handle<FieldType> type2, Isolate* isolate);
-  static void GeneralizeField(Handle<Map> map, int modify_index,
-                              PropertyConstness new_constness,
+  static void GeneralizeField(Isolate* isolate, Handle<Map> map,
+                              int modify_index, PropertyConstness new_constness,
                               Representation new_representation,
                               Handle<FieldType> new_field_type);
   // Returns true if |descriptor|'th property is a field that may be generalized
@@ -484,28 +489,31 @@ class Map : public HeapObject {
   // optimized code to more general elements kind.
   // This generalization is necessary in order to ensure that elements kind
   // transitions performed by stubs / optimized code don't silently transition
-  // kMutable fields back to kConst state or fields with HeapObject
-  // representation and "Any" type back to "Class" type.
+  // PropertyConstness::kMutable fields back to VariableMode::kConst state or
+  // fields with HeapObject representation and "Any" type back to "Class" type.
   static inline void GeneralizeIfCanHaveTransitionableFastElementsKind(
       Isolate* isolate, InstanceType instance_type,
       PropertyConstness* constness, Representation* representation,
       Handle<FieldType>* field_type);
 
-  static Handle<Map> ReconfigureProperty(Handle<Map> map, int modify_index,
+  static Handle<Map> ReconfigureProperty(Isolate* isolate, Handle<Map> map,
+                                         int modify_index,
                                          PropertyKind new_kind,
                                          PropertyAttributes new_attributes,
                                          Representation new_representation,
                                          Handle<FieldType> new_field_type);
 
-  static Handle<Map> ReconfigureElementsKind(Handle<Map> map,
+  static Handle<Map> ReconfigureElementsKind(Isolate* isolate, Handle<Map> map,
                                              ElementsKind new_elements_kind);
 
-  static Handle<Map> PrepareForDataProperty(Handle<Map> old_map,
+  static Handle<Map> PrepareForDataProperty(Isolate* isolate,
+                                            Handle<Map> old_map,
                                             int descriptor_number,
                                             PropertyConstness constness,
                                             Handle<Object> value);
 
-  static Handle<Map> Normalize(Handle<Map> map, PropertyNormalizationMode mode,
+  static Handle<Map> Normalize(Isolate* isolate, Handle<Map> map,
+                               PropertyNormalizationMode mode,
                                const char* reason);
 
   // Tells whether the map is used for JSObjects in dictionary mode (ie
@@ -521,7 +529,8 @@ class Map : public HeapObject {
   // [prototype]: implicit prototype object.
   DECL_ACCESSORS(prototype, Object)
   // TODO(jkummerow): make set_prototype private.
-  static void SetPrototype(Handle<Map> map, Handle<Object> prototype,
+  static void SetPrototype(Isolate* isolate, Handle<Map> map,
+                           Handle<Object> prototype,
                            bool enable_prototype_setup_mode = true);
 
   // [constructor]: points back to the function or FunctionTemplateInfo
@@ -626,51 +635,55 @@ class Map : public HeapObject {
   // is found by re-transitioning from the root of the transition tree using the
   // descriptor array of the map. Returns MaybeHandle<Map>() if no updated map
   // is found.
-  static MaybeHandle<Map> TryUpdate(Handle<Map> map) V8_WARN_UNUSED_RESULT;
+  static MaybeHandle<Map> TryUpdate(Isolate* isolate,
+                                    Handle<Map> map) V8_WARN_UNUSED_RESULT;
 
   // Returns a non-deprecated version of the input. This method may deprecate
   // existing maps along the way if encodings conflict. Not for use while
   // gathering type feedback. Use TryUpdate in those cases instead.
-  static Handle<Map> Update(Handle<Map> map);
+  static Handle<Map> Update(Isolate* isolate, Handle<Map> map);
 
-  static inline Handle<Map> CopyInitialMap(Handle<Map> map);
-  static Handle<Map> CopyInitialMap(Handle<Map> map, int instance_size,
-                                    int in_object_properties,
+  static inline Handle<Map> CopyInitialMap(Isolate* isolate, Handle<Map> map);
+  static Handle<Map> CopyInitialMap(Isolate* isolate, Handle<Map> map,
+                                    int instance_size, int in_object_properties,
                                     int unused_property_fields);
   static Handle<Map> CopyInitialMapNormalized(
-      Handle<Map> map,
+      Isolate* isolate, Handle<Map> map,
       PropertyNormalizationMode mode = CLEAR_INOBJECT_PROPERTIES);
-  static Handle<Map> CopyDropDescriptors(Handle<Map> map);
-  static Handle<Map> CopyInsertDescriptor(Handle<Map> map,
+  static Handle<Map> CopyDropDescriptors(Isolate* isolate, Handle<Map> map);
+  static Handle<Map> CopyInsertDescriptor(Isolate* isolate, Handle<Map> map,
                                           Descriptor* descriptor,
                                           TransitionFlag flag);
 
-  static Handle<Object> WrapFieldType(Handle<FieldType> type);
-  static FieldType* UnwrapFieldType(Object* wrapped_type);
+  static MaybeObjectHandle WrapFieldType(Handle<FieldType> type);
+  static FieldType* UnwrapFieldType(MaybeObject* wrapped_type);
 
   V8_WARN_UNUSED_RESULT static MaybeHandle<Map> CopyWithField(
-      Handle<Map> map, Handle<Name> name, Handle<FieldType> type,
-      PropertyAttributes attributes, PropertyConstness constness,
-      Representation representation, TransitionFlag flag);
+      Isolate* isolate, Handle<Map> map, Handle<Name> name,
+      Handle<FieldType> type, PropertyAttributes attributes,
+      PropertyConstness constness, Representation representation,
+      TransitionFlag flag);
 
   V8_WARN_UNUSED_RESULT static MaybeHandle<Map> CopyWithConstant(
-      Handle<Map> map, Handle<Name> name, Handle<Object> constant,
-      PropertyAttributes attributes, TransitionFlag flag);
+      Isolate* isolate, Handle<Map> map, Handle<Name> name,
+      Handle<Object> constant, PropertyAttributes attributes,
+      TransitionFlag flag);
 
   // Returns a new map with all transitions dropped from the given map and
   // the ElementsKind set.
-  static Handle<Map> TransitionElementsTo(Handle<Map> map,
+  static Handle<Map> TransitionElementsTo(Isolate* isolate, Handle<Map> map,
                                           ElementsKind to_kind);
 
-  static Handle<Map> AsElementsKind(Handle<Map> map, ElementsKind kind);
+  static Handle<Map> AsElementsKind(Isolate* isolate, Handle<Map> map,
+                                    ElementsKind kind);
 
-  static Handle<Map> CopyAsElementsKind(Handle<Map> map, ElementsKind kind,
-                                        TransitionFlag flag);
+  static Handle<Map> CopyAsElementsKind(Isolate* isolate, Handle<Map> map,
+                                        ElementsKind kind, TransitionFlag flag);
 
-  static Handle<Map> AsLanguageMode(Handle<Map> initial_map,
+  static Handle<Map> AsLanguageMode(Isolate* isolate, Handle<Map> initial_map,
                                     Handle<SharedFunctionInfo> shared_info);
 
-  static Handle<Map> CopyForPreventExtensions(Handle<Map> map,
+  static Handle<Map> CopyForPreventExtensions(Isolate* isolate, Handle<Map> map,
                                               PropertyAttributes attrs_to_add,
                                               Handle<Symbol> transition_marker,
                                               const char* reason);
@@ -681,7 +694,7 @@ class Map : public HeapObject {
   // transitions to avoid an explosion in the number of maps for objects used as
   // dictionaries.
   inline bool TooManyFastProperties(StoreFromKeyed store_mode) const;
-  static Handle<Map> TransitionToDataProperty(Handle<Map> map,
+  static Handle<Map> TransitionToDataProperty(Isolate* isolate, Handle<Map> map,
                                               Handle<Name> name,
                                               Handle<Object> value,
                                               PropertyAttributes attributes,
@@ -691,7 +704,8 @@ class Map : public HeapObject {
       Isolate* isolate, Handle<Map> map, Handle<Name> name, int descriptor,
       Handle<Object> getter, Handle<Object> setter,
       PropertyAttributes attributes);
-  static Handle<Map> ReconfigureExistingProperty(Handle<Map> map,
+  static Handle<Map> ReconfigureExistingProperty(Isolate* isolate,
+                                                 Handle<Map> map,
                                                  int descriptor,
                                                  PropertyKind kind,
                                                  PropertyAttributes attributes);
@@ -701,11 +715,13 @@ class Map : public HeapObject {
   // Returns a copy of the map, prepared for inserting into the transition
   // tree (if the |map| owns descriptors then the new one will share
   // descriptors with |map|).
-  static Handle<Map> CopyForTransition(Handle<Map> map, const char* reason);
+  static Handle<Map> CopyForTransition(Isolate* isolate, Handle<Map> map,
+                                       const char* reason);
 
   // Returns a copy of the map, with all transitions dropped from the
   // instance descriptors.
-  static Handle<Map> Copy(Handle<Map> map, const char* reason);
+  static Handle<Map> Copy(Isolate* isolate, Handle<Map> map,
+                          const char* reason);
   static Handle<Map> Create(Isolate* isolate, int inobject_properties);
 
   // Returns the next free property index (only valid for FAST MODE).
@@ -718,15 +734,18 @@ class Map : public HeapObject {
 
   static inline int SlackForArraySize(int old_size, int size_limit);
 
-  static void EnsureDescriptorSlack(Handle<Map> map, int slack);
+  static void EnsureDescriptorSlack(Isolate* isolate, Handle<Map> map,
+                                    int slack);
 
   // Returns the map to be used for instances when the given {prototype} is
   // passed to an Object.create call. Might transition the given {prototype}.
-  static Handle<Map> GetObjectCreateMap(Handle<HeapObject> prototype);
+  static Handle<Map> GetObjectCreateMap(Isolate* isolate,
+                                        Handle<HeapObject> prototype);
 
   // Similar to {GetObjectCreateMap} but does not transition {prototype} and
   // fails gracefully by returning an empty handle instead.
-  static MaybeHandle<Map> TryGetObjectCreateMap(Handle<HeapObject> prototype);
+  static MaybeHandle<Map> TryGetObjectCreateMap(Isolate* isolate,
+                                                Handle<HeapObject> prototype);
 
   // Computes a hash value for this map, to be used in HashTables and such.
   int Hash();
@@ -734,7 +753,10 @@ class Map : public HeapObject {
   // Returns the transitioned map for this map with the most generic
   // elements_kind that's found in |candidates|, or |nullptr| if no match is
   // found at all.
-  Map* FindElementsKindTransitionedMap(MapHandles const& candidates);
+  Map* FindElementsKindTransitionedMap(Isolate* isolate,
+                                       MapHandles const& candidates);
+
+  inline static bool IsJSObject(InstanceType type);
 
   inline bool CanTransition() const;
 
@@ -752,31 +774,28 @@ class Map : public HeapObject {
   inline bool IsJSGlobalObjectMap() const;
   inline bool IsJSTypedArrayMap() const;
   inline bool IsJSDataViewMap() const;
-
   inline bool IsSpecialReceiverMap() const;
+  inline bool IsCustomElementsReceiverMap() const;
 
-  static void AddDependentCode(Handle<Map> map,
-                               DependentCode::DependencyGroup group,
-                               Handle<Code> code);
+  bool IsMapInArrayPrototypeChain(Isolate* isolate) const;
 
-  bool IsMapInArrayPrototypeChain() const;
-
-  static Handle<WeakCell> WeakCellForMap(Handle<Map> map);
+  static Handle<WeakCell> WeakCellForMap(Isolate* isolate, Handle<Map> map);
 
   // Dispatched behavior.
-  DECL_PRINTER(Map)
+  DECL_PRINTER_WITH_ISOLATE(Map)
   DECL_VERIFIER(Map)
 
 #ifdef VERIFY_HEAP
-  void DictionaryMapVerify();
+  void DictionaryMapVerify(Isolate* isolate);
 #endif
 
   DECL_PRIMITIVE_ACCESSORS(visitor_id, VisitorId)
 
-  static Handle<Map> TransitionToPrototype(Handle<Map> map,
+  static Handle<Map> TransitionToPrototype(Isolate* isolate, Handle<Map> map,
                                            Handle<Object> prototype);
 
-  static Handle<Map> TransitionToImmutableProto(Handle<Map> map);
+  static Handle<Map> TransitionToImmutableProto(Isolate* isolate,
+                                                Handle<Map> map);
 
   static const int kMaxPreAllocatedPropertyFields = 255;
 
@@ -823,10 +842,11 @@ class Map : public HeapObject {
   // Returns true if given field is unboxed double.
   inline bool IsUnboxedDoubleField(FieldIndex index) const;
 
-  void PrintMapDetails(std::ostream& os, JSObject* holder = nullptr);
+  void PrintMapDetails(Isolate* isolate, std::ostream& os);
 
   static inline Handle<Map> AddMissingTransitionsForTesting(
-      Handle<Map> split_map, Handle<DescriptorArray> descriptors,
+      Isolate* isolate, Handle<Map> split_map,
+      Handle<DescriptorArray> descriptors,
       Handle<LayoutDescriptor> full_layout_descriptor);
 
   // Fires when the layout of an object with a leaf map changes.
@@ -862,81 +882,81 @@ class Map : public HeapObject {
 
   // Returns the map that this (root) map transitions to if its elements_kind
   // is changed to |elements_kind|, or |nullptr| if no such map is cached yet.
-  Map* LookupElementsTransitionMap(ElementsKind elements_kind);
+  Map* LookupElementsTransitionMap(Isolate* isolate,
+                                   ElementsKind elements_kind);
 
   // Tries to replay property transitions starting from this (root) map using
   // the descriptor array of the |map|. The |root_map| is expected to have
   // proper elements kind and therefore elements kinds transitions are not
   // taken by this function. Returns |nullptr| if matching transition map is
   // not found.
-  Map* TryReplayPropertyTransitions(Map* map);
+  Map* TryReplayPropertyTransitions(Isolate* isolate, Map* map);
 
-  static void ConnectTransition(Handle<Map> parent, Handle<Map> child,
-                                Handle<Name> name, SimpleTransitionFlag flag);
+  static void ConnectTransition(Isolate* isolate, Handle<Map> parent,
+                                Handle<Map> child, Handle<Name> name,
+                                SimpleTransitionFlag flag);
 
   bool EquivalentToForTransition(const Map* other) const;
   bool EquivalentToForElementsKindTransition(const Map* other) const;
-  static Handle<Map> RawCopy(Handle<Map> map, int instance_size,
-                             int inobject_properties);
-  static Handle<Map> ShareDescriptor(Handle<Map> map,
+  static Handle<Map> RawCopy(Isolate* isolate, Handle<Map> map,
+                             int instance_size, int inobject_properties);
+  static Handle<Map> ShareDescriptor(Isolate* isolate, Handle<Map> map,
                                      Handle<DescriptorArray> descriptors,
                                      Descriptor* descriptor);
   static Handle<Map> AddMissingTransitions(
-      Handle<Map> map, Handle<DescriptorArray> descriptors,
+      Isolate* isolate, Handle<Map> map, Handle<DescriptorArray> descriptors,
       Handle<LayoutDescriptor> full_layout_descriptor);
   static void InstallDescriptors(
-      Handle<Map> parent_map, Handle<Map> child_map, int new_descriptor,
-      Handle<DescriptorArray> descriptors,
+      Isolate* isolate, Handle<Map> parent_map, Handle<Map> child_map,
+      int new_descriptor, Handle<DescriptorArray> descriptors,
       Handle<LayoutDescriptor> full_layout_descriptor);
-  static Handle<Map> CopyAddDescriptor(Handle<Map> map, Descriptor* descriptor,
+  static Handle<Map> CopyAddDescriptor(Isolate* isolate, Handle<Map> map,
+                                       Descriptor* descriptor,
                                        TransitionFlag flag);
   static Handle<Map> CopyReplaceDescriptors(
-      Handle<Map> map, Handle<DescriptorArray> descriptors,
+      Isolate* isolate, Handle<Map> map, Handle<DescriptorArray> descriptors,
       Handle<LayoutDescriptor> layout_descriptor, TransitionFlag flag,
       MaybeHandle<Name> maybe_name, const char* reason,
       SimpleTransitionFlag simple_flag);
 
-  static Handle<Map> CopyReplaceDescriptor(Handle<Map> map,
+  static Handle<Map> CopyReplaceDescriptor(Isolate* isolate, Handle<Map> map,
                                            Handle<DescriptorArray> descriptors,
                                            Descriptor* descriptor, int index,
                                            TransitionFlag flag);
-  static V8_WARN_UNUSED_RESULT MaybeHandle<Map> TryReconfigureExistingProperty(
-      Handle<Map> map, int descriptor, PropertyKind kind,
-      PropertyAttributes attributes, const char** reason);
-
-  static Handle<Map> CopyNormalized(Handle<Map> map,
+  static Handle<Map> CopyNormalized(Isolate* isolate, Handle<Map> map,
                                     PropertyNormalizationMode mode);
 
   // TODO(ishell): Move to MapUpdater.
-  static Handle<Map> CopyGeneralizeAllFields(
-      Handle<Map> map, ElementsKind elements_kind, int modify_index,
-      PropertyKind kind, PropertyAttributes attributes, const char* reason);
+  static Handle<Map> CopyGeneralizeAllFields(Isolate* isolate, Handle<Map> map,
+                                             ElementsKind elements_kind,
+                                             int modify_index,
+                                             PropertyKind kind,
+                                             PropertyAttributes attributes,
+                                             const char* reason);
 
-  void DeprecateTransitionTree();
+  void DeprecateTransitionTree(Isolate* isolate);
 
-  void ReplaceDescriptors(DescriptorArray* new_descriptors,
+  void ReplaceDescriptors(Isolate* isolate, DescriptorArray* new_descriptors,
                           LayoutDescriptor* new_layout_descriptor);
 
   // Update field type of the given descriptor to new representation and new
   // type. The type must be prepared for storing in descriptor array:
   // it must be either a simple type or a map wrapped in a weak cell.
-  void UpdateFieldType(int descriptor_number, Handle<Name> name,
-                       PropertyConstness new_constness,
+  void UpdateFieldType(Isolate* isolate, int descriptor_number,
+                       Handle<Name> name, PropertyConstness new_constness,
                        Representation new_representation,
-                       Handle<Object> new_wrapped_type);
+                       MaybeObjectHandle new_wrapped_type);
 
   // TODO(ishell): Move to MapUpdater.
-  void PrintReconfiguration(FILE* file, int modify_index, PropertyKind kind,
-                            PropertyAttributes attributes);
+  void PrintReconfiguration(Isolate* isolate, FILE* file, int modify_index,
+                            PropertyKind kind, PropertyAttributes attributes);
   // TODO(ishell): Move to MapUpdater.
-  void PrintGeneralization(FILE* file, const char* reason, int modify_index,
-                           int split, int descriptors, bool constant_to_field,
-                           Representation old_representation,
-                           Representation new_representation,
-                           MaybeHandle<FieldType> old_field_type,
-                           MaybeHandle<Object> old_value,
-                           MaybeHandle<FieldType> new_field_type,
-                           MaybeHandle<Object> new_value);
+  void PrintGeneralization(
+      Isolate* isolate, FILE* file, const char* reason, int modify_index,
+      int split, int descriptors, bool constant_to_field,
+      Representation old_representation, Representation new_representation,
+      MaybeHandle<FieldType> old_field_type, MaybeHandle<Object> old_value,
+      MaybeHandle<FieldType> new_field_type, MaybeHandle<Object> new_value);
   static const int kFastPropertiesSoftLimit = 12;
   static const int kMaxFastProperties = 128;
 
@@ -961,9 +981,11 @@ class NormalizedMapCache : public FixedArray {
 
   DECL_CAST(NormalizedMapCache)
 
-  static inline bool IsNormalizedMapCache(const HeapObject* obj);
+  static inline bool IsNormalizedMapCache(Isolate* isolate,
+                                          const HeapObject* obj);
 
   DECL_VERIFIER(NormalizedMapCache)
+
  private:
   static const int kEntries = 64;
 
diff --git a/deps/v8/src/objects/maybe-object-inl.h b/deps/v8/src/objects/maybe-object-inl.h
index 088a8c831e8510..0c04550673ad55 100644
--- a/deps/v8/src/objects/maybe-object-inl.h
+++ b/deps/v8/src/objects/maybe-object-inl.h
@@ -5,6 +5,8 @@
 #ifndef V8_OBJECTS_MAYBE_OBJECT_INL_H_
 #define V8_OBJECTS_MAYBE_OBJECT_INL_H_
 
+#include "src/objects/maybe-object.h"
+
 #include "include/v8.h"
 #include "src/globals.h"
 
@@ -19,6 +21,11 @@ bool MaybeObject::ToSmi(Smi** value) {
   return false;
 }
 
+Smi* MaybeObject::ToSmi() {
+  DCHECK(HAS_SMI_TAG(this));
+  return Smi::cast(reinterpret_cast<Object*>(this));
+}
+
 bool MaybeObject::IsStrongOrWeakHeapObject() {
   if (IsSmi() || IsClearedWeakHeapObject()) {
     return false;
@@ -67,6 +74,10 @@ bool MaybeObject::IsWeakHeapObject() {
   return HasWeakHeapObjectTag(this) && !IsClearedWeakHeapObject();
 }
 
+bool MaybeObject::IsWeakOrClearedHeapObject() {
+  return HasWeakHeapObjectTag(this);
+}
+
 bool MaybeObject::ToWeakHeapObject(HeapObject** result) {
   if (HasWeakHeapObjectTag(this) && !IsClearedWeakHeapObject()) {
     *result = GetHeapObject();
@@ -86,6 +97,25 @@ HeapObject* MaybeObject::GetHeapObject() {
   return RemoveWeakHeapObjectMask(reinterpret_cast<HeapObjectReference*>(this));
 }
 
+Object* MaybeObject::GetHeapObjectOrSmi() {
+  if (IsSmi()) {
+    return reinterpret_cast<Object*>(this);
+  }
+  return GetHeapObject();
+}
+
+bool MaybeObject::IsObject() { return IsSmi() || IsStrongHeapObject(); }
+
+Object* MaybeObject::ToObject() {
+  DCHECK(!HasWeakHeapObjectTag(this));
+  return reinterpret_cast<Object*>(this);
+}
+
+MaybeObject* MaybeObject::MakeWeak(MaybeObject* object) {
+  DCHECK(object->IsStrongOrWeakHeapObject());
+  return AddWeakHeapObjectMask(object);
+}
+
 }  // namespace internal
 }  // namespace v8
 
diff --git a/deps/v8/src/objects/maybe-object.h b/deps/v8/src/objects/maybe-object.h
index f9f080ba31a766..c242cd55d73c11 100644
--- a/deps/v8/src/objects/maybe-object.h
+++ b/deps/v8/src/objects/maybe-object.h
@@ -21,6 +21,7 @@ class MaybeObject {
  public:
   bool IsSmi() const { return HAS_SMI_TAG(this); }
   inline bool ToSmi(Smi** value);
+  inline Smi* ToSmi();
 
   bool IsClearedWeakHeapObject() {
     return ::v8::internal::IsClearedWeakHeapObject(this);
@@ -34,10 +35,16 @@ class MaybeObject {
   inline bool ToStrongHeapObject(HeapObject** result);
   inline HeapObject* ToStrongHeapObject();
   inline bool IsWeakHeapObject();
+  inline bool IsWeakOrClearedHeapObject();
   inline bool ToWeakHeapObject(HeapObject** result);
   inline HeapObject* ToWeakHeapObject();
 
+  // Returns the HeapObject pointed to (either strongly or weakly).
   inline HeapObject* GetHeapObject();
+  inline Object* GetHeapObjectOrSmi();
+
+  inline bool IsObject();
+  inline Object* ToObject();
 
   static MaybeObject* FromSmi(Smi* smi) {
     DCHECK(HAS_SMI_TAG(smi));
@@ -49,15 +56,28 @@ class MaybeObject {
     return reinterpret_cast<MaybeObject*>(object);
   }
 
-  static MaybeObject* MakeWeak(MaybeObject* object) {
-    DCHECK(object->IsStrongOrWeakHeapObject());
-    return AddWeakHeapObjectMask(object);
-  }
+  static inline MaybeObject* MakeWeak(MaybeObject* object);
 
 #ifdef VERIFY_HEAP
   static void VerifyMaybeObjectPointer(MaybeObject* p);
 #endif
 
+  // Prints this object without details.
+  void ShortPrint(FILE* out = stdout);
+
+  // Prints this object without details to a message accumulator.
+  void ShortPrint(StringStream* accumulator);
+
+  void ShortPrint(std::ostream& os);
+
+#ifdef OBJECT_PRINT
+  void Print(Isolate* isolate);
+  void Print(Isolate* isolate, std::ostream& os);
+#else
+  void Print(Isolate* isolate) { ShortPrint(); }
+  void Print(Isolate* isolate, std::ostream& os) { ShortPrint(os); }
+#endif
+
  private:
   DISALLOW_IMPLICIT_CONSTRUCTORS(MaybeObject);
 };
@@ -66,12 +86,14 @@ class MaybeObject {
 // reference to a HeapObject, or a cleared weak reference.
 class HeapObjectReference : public MaybeObject {
  public:
-  static HeapObjectReference* Strong(HeapObject* object) {
+  static HeapObjectReference* Strong(Object* object) {
+    DCHECK(!object->IsSmi());
     DCHECK(!HasWeakHeapObjectTag(object));
     return reinterpret_cast<HeapObjectReference*>(object);
   }
 
-  static HeapObjectReference* Weak(HeapObject* object) {
+  static HeapObjectReference* Weak(Object* object) {
+    DCHECK(!object->IsSmi());
     DCHECK(!HasWeakHeapObjectTag(object));
     return AddWeakHeapObjectMask(object);
   }
diff --git a/deps/v8/src/objects/module-inl.h b/deps/v8/src/objects/module-inl.h
index 7b166598a17374..201804b5954c66 100644
--- a/deps/v8/src/objects/module-inl.h
+++ b/deps/v8/src/objects/module-inl.h
@@ -6,6 +6,7 @@
 #define V8_OBJECTS_MODULE_INL_H_
 
 #include "src/objects/module.h"
+#include "src/objects/scope-info.h"
 
 // Has to be the last include (doesn't have include guards):
 #include "src/objects/object-macros.h"
@@ -29,19 +30,11 @@ SMI_ACCESSORS(Module, dfs_ancestor_index, kDfsAncestorIndexOffset)
 SMI_ACCESSORS(Module, hash, kHashOffset)
 
 ModuleInfo* Module::info() const {
-  if (status() >= kEvaluating) {
-    return ModuleInfo::cast(code());
-  }
-  ScopeInfo* scope_info =
-      status() == kInstantiated
-          ? JSGeneratorObject::cast(code())->function()->shared()->scope_info()
-          : status() == kInstantiating
-                ? JSFunction::cast(code())->shared()->scope_info()
-                : SharedFunctionInfo::cast(code())->scope_info();
-  return scope_info->ModuleDescriptorInfo();
+  return (status() >= kEvaluating)
+             ? ModuleInfo::cast(code())
+             : GetSharedFunctionInfo()->scope_info()->ModuleDescriptorInfo();
 }
 
-TYPE_CHECKER(JSModuleNamespace, JS_MODULE_NAMESPACE_TYPE)
 CAST_ACCESSOR(JSModuleNamespace)
 ACCESSORS(JSModuleNamespace, module, Module, kModuleOffset)
 
@@ -56,10 +49,6 @@ SMI_ACCESSORS(ModuleInfoEntry, end_pos, kEndPosOffset)
 
 CAST_ACCESSOR(ModuleInfo)
 
-bool HeapObject::IsModuleInfo() const {
-  return map() == GetHeap()->module_info_map();
-}
-
 }  // namespace internal
 }  // namespace v8
 
diff --git a/deps/v8/src/objects/module.cc b/deps/v8/src/objects/module.cc
index e2472616f6d691..bca6abba0eff1e 100644
--- a/deps/v8/src/objects/module.cc
+++ b/deps/v8/src/objects/module.cc
@@ -11,6 +11,8 @@
 #include "src/api.h"
 #include "src/ast/modules.h"
 #include "src/objects-inl.h"
+#include "src/objects/hash-table-inl.h"
+#include "src/objects/module-inl.h"
 
 namespace v8 {
 namespace internal {
@@ -119,20 +121,18 @@ int ImportIndex(int cell_index) {
 
 }  // anonymous namespace
 
-void Module::CreateIndirectExport(Handle<Module> module, Handle<String> name,
+void Module::CreateIndirectExport(Isolate* isolate, Handle<Module> module,
+                                  Handle<String> name,
                                   Handle<ModuleInfoEntry> entry) {
-  Isolate* isolate = module->GetIsolate();
   Handle<ObjectHashTable> exports(module->exports(), isolate);
   DCHECK(exports->Lookup(name)->IsTheHole(isolate));
   exports = ObjectHashTable::Put(exports, name, entry);
   module->set_exports(*exports);
 }
 
-void Module::CreateExport(Handle<Module> module, int cell_index,
-                          Handle<FixedArray> names) {
+void Module::CreateExport(Isolate* isolate, Handle<Module> module,
+                          int cell_index, Handle<FixedArray> names) {
   DCHECK_LT(0, names->length());
-  Isolate* isolate = module->GetIsolate();
-
   Handle<Cell> cell =
       isolate->factory()->NewCell(isolate->factory()->undefined_value());
   module->regular_exports()->set(ExportIndex(cell_index), *cell);
@@ -163,8 +163,8 @@ Cell* Module::GetCell(int cell_index) {
   return Cell::cast(cell);
 }
 
-Handle<Object> Module::LoadVariable(Handle<Module> module, int cell_index) {
-  Isolate* isolate = module->GetIsolate();
+Handle<Object> Module::LoadVariable(Isolate* isolate, Handle<Module> module,
+                                    int cell_index) {
   return handle(module->GetCell(cell_index)->value(), isolate);
 }
 
@@ -176,12 +176,12 @@ void Module::StoreVariable(Handle<Module> module, int cell_index,
 }
 
 #ifdef DEBUG
-void Module::PrintStatusTransition(Status new_status) {
+void Module::PrintStatusTransition(Isolate* isolate, Status new_status) {
   if (FLAG_trace_module_status) {
-    OFStream os(stdout);
+    StdoutStream os;
     os << "Changing module status from " << status() << " to " << new_status
        << " for ";
-    script()->GetNameOrSourceURL()->Print(os);
+    script()->GetNameOrSourceURL()->Print(isolate, os);
 #ifndef OBJECT_PRINT
     os << "\n";
 #endif  // OBJECT_PRINT
@@ -189,35 +189,33 @@ void Module::PrintStatusTransition(Status new_status) {
 }
 #endif  // DEBUG
 
-void Module::SetStatus(Status new_status) {
+void Module::SetStatus(Isolate* isolate, Status new_status) {
   DisallowHeapAllocation no_alloc;
   DCHECK_LE(status(), new_status);
   DCHECK_NE(new_status, Module::kErrored);
 #ifdef DEBUG
-  PrintStatusTransition(new_status);
+  PrintStatusTransition(isolate, new_status);
 #endif  // DEBUG
   set_status(new_status);
 }
 
-void Module::ResetGraph(Handle<Module> module) {
+void Module::ResetGraph(Isolate* isolate, Handle<Module> module) {
   DCHECK_NE(module->status(), kInstantiating);
   DCHECK_NE(module->status(), kEvaluating);
   if (module->status() != kPreInstantiating) return;
-  Isolate* isolate = module->GetIsolate();
   Handle<FixedArray> requested_modules(module->requested_modules(), isolate);
-  Reset(module);
+  Reset(isolate, module);
   for (int i = 0; i < requested_modules->length(); ++i) {
     Handle<Object> descendant(requested_modules->get(i), isolate);
     if (descendant->IsModule()) {
-      ResetGraph(Handle<Module>::cast(descendant));
+      ResetGraph(isolate, Handle<Module>::cast(descendant));
     } else {
       DCHECK(descendant->IsUndefined(isolate));
     }
   }
 }
 
-void Module::Reset(Handle<Module> module) {
-  Isolate* isolate = module->GetIsolate();
+void Module::Reset(Isolate* isolate, Handle<Module> module) {
   Factory* factory = isolate->factory();
 
   DCHECK(module->status() == kPreInstantiating ||
@@ -242,7 +240,7 @@ void Module::Reset(Handle<Module> module) {
     module->set_code(JSFunction::cast(module->code())->shared());
   }
 #ifdef DEBUG
-  module->PrintStatusTransition(kUninstantiated);
+  module->PrintStatusTransition(isolate, kUninstantiated);
 #endif  // DEBUG
   module->set_status(kUninstantiated);
   module->set_exports(*exports);
@@ -253,17 +251,15 @@ void Module::Reset(Handle<Module> module) {
   module->set_dfs_ancestor_index(-1);
 }
 
-void Module::RecordError() {
+void Module::RecordError(Isolate* isolate) {
   DisallowHeapAllocation no_alloc;
-  Isolate* isolate = GetIsolate();
-
   DCHECK(exception()->IsTheHole(isolate));
   Object* the_exception = isolate->pending_exception();
   DCHECK(!the_exception->IsTheHole(isolate));
 
   set_code(info());
 #ifdef DEBUG
-  PrintStatusTransition(Module::kErrored);
+  PrintStatusTransition(isolate, Module::kErrored);
 #endif  // DEBUG
   set_status(Module::kErrored);
   set_exception(the_exception);
@@ -272,35 +268,57 @@ void Module::RecordError() {
 Object* Module::GetException() {
   DisallowHeapAllocation no_alloc;
   DCHECK_EQ(status(), Module::kErrored);
-  DCHECK(!exception()->IsTheHole(GetIsolate()));
+  DCHECK(!exception()->IsTheHole());
   return exception();
 }
 
-MaybeHandle<Cell> Module::ResolveImport(Handle<Module> module,
+SharedFunctionInfo* Module::GetSharedFunctionInfo() const {
+  DisallowHeapAllocation no_alloc;
+  DCHECK_NE(status(), Module::kEvaluating);
+  DCHECK_NE(status(), Module::kEvaluated);
+  switch (status()) {
+    case kUninstantiated:
+    case kPreInstantiating:
+      DCHECK(code()->IsSharedFunctionInfo());
+      return SharedFunctionInfo::cast(code());
+    case kInstantiating:
+      DCHECK(code()->IsJSFunction());
+      return JSFunction::cast(code())->shared();
+    case kInstantiated:
+      DCHECK(code()->IsJSGeneratorObject());
+      return JSGeneratorObject::cast(code())->function()->shared();
+    case kEvaluating:
+    case kEvaluated:
+    case kErrored:
+      UNREACHABLE();
+  }
+
+  UNREACHABLE();
+}
+
+MaybeHandle<Cell> Module::ResolveImport(Isolate* isolate, Handle<Module> module,
                                         Handle<String> name, int module_request,
                                         MessageLocation loc, bool must_resolve,
                                         Module::ResolveSet* resolve_set) {
-  Isolate* isolate = module->GetIsolate();
   Handle<Module> requested_module(
       Module::cast(module->requested_modules()->get(module_request)), isolate);
   Handle<String> specifier(
       String::cast(module->info()->module_requests()->get(module_request)),
       isolate);
-  MaybeHandle<Cell> result = Module::ResolveExport(
-      requested_module, specifier, name, loc, must_resolve, resolve_set);
+  MaybeHandle<Cell> result =
+      Module::ResolveExport(isolate, requested_module, specifier, name, loc,
+                            must_resolve, resolve_set);
   DCHECK_IMPLIES(isolate->has_pending_exception(), result.is_null());
   return result;
 }
 
-MaybeHandle<Cell> Module::ResolveExport(Handle<Module> module,
+MaybeHandle<Cell> Module::ResolveExport(Isolate* isolate, Handle<Module> module,
                                         Handle<String> module_specifier,
                                         Handle<String> export_name,
                                         MessageLocation loc, bool must_resolve,
                                         Module::ResolveSet* resolve_set) {
   DCHECK_GE(module->status(), kPreInstantiating);
   DCHECK_NE(module->status(), kEvaluating);
-
-  Isolate* isolate = module->GetIsolate();
   Handle<Object> object(module->exports()->Lookup(export_name), isolate);
   if (object->IsCell()) {
     // Already resolved (e.g. because it's a local export).
@@ -339,8 +357,8 @@ MaybeHandle<Cell> Module::ResolveExport(Handle<Module> module,
     MessageLocation new_loc(script, entry->beg_pos(), entry->end_pos());
 
     Handle<Cell> cell;
-    if (!ResolveImport(module, import_name, entry->module_request(), new_loc,
-                       true, resolve_set)
+    if (!ResolveImport(isolate, module, import_name, entry->module_request(),
+                       new_loc, true, resolve_set)
              .ToHandle(&cell)) {
       DCHECK(isolate->has_pending_exception());
       return MaybeHandle<Cell>();
@@ -357,16 +375,16 @@ MaybeHandle<Cell> Module::ResolveExport(Handle<Module> module,
   }
 
   DCHECK(object->IsTheHole(isolate));
-  return Module::ResolveExportUsingStarExports(
-      module, module_specifier, export_name, loc, must_resolve, resolve_set);
+  return Module::ResolveExportUsingStarExports(isolate, module,
+                                               module_specifier, export_name,
+                                               loc, must_resolve, resolve_set);
 }
 
 MaybeHandle<Cell> Module::ResolveExportUsingStarExports(
-    Handle<Module> module, Handle<String> module_specifier,
+    Isolate* isolate, Handle<Module> module, Handle<String> module_specifier,
     Handle<String> export_name, MessageLocation loc, bool must_resolve,
     Module::ResolveSet* resolve_set) {
-  Isolate* isolate = module->GetIsolate();
-  if (!export_name->Equals(isolate->heap()->default_string())) {
+  if (!export_name->Equals(ReadOnlyRoots(isolate).default_string())) {
     // Go through all star exports looking for the given name.  If multiple star
     // exports provide the name, make sure they all map it to the same cell.
     Handle<Cell> unique_cell;
@@ -383,8 +401,8 @@ MaybeHandle<Cell> Module::ResolveExportUsingStarExports(
       MessageLocation new_loc(script, entry->beg_pos(), entry->end_pos());
 
       Handle<Cell> cell;
-      if (ResolveImport(module, export_name, entry->module_request(), new_loc,
-                        false, resolve_set)
+      if (ResolveImport(isolate, module, export_name, entry->module_request(),
+                        new_loc, false, resolve_set)
               .ToHandle(&cell)) {
         if (unique_cell.is_null()) unique_cell = cell;
         if (*unique_cell != *cell) {
@@ -418,31 +436,30 @@ MaybeHandle<Cell> Module::ResolveExportUsingStarExports(
   return MaybeHandle<Cell>();
 }
 
-bool Module::Instantiate(Handle<Module> module, v8::Local<v8::Context> context,
+bool Module::Instantiate(Isolate* isolate, Handle<Module> module,
+                         v8::Local<v8::Context> context,
                          v8::Module::ResolveCallback callback) {
 #ifdef DEBUG
   if (FLAG_trace_module_status) {
-    OFStream os(stdout);
+    StdoutStream os;
     os << "Instantiating module ";
-    module->script()->GetNameOrSourceURL()->Print(os);
+    module->script()->GetNameOrSourceURL()->Print(isolate, os);
 #ifndef OBJECT_PRINT
     os << "\n";
 #endif  // OBJECT_PRINT
   }
 #endif  // DEBUG
 
-  if (!PrepareInstantiate(module, context, callback)) {
-    ResetGraph(module);
+  if (!PrepareInstantiate(isolate, module, context, callback)) {
+    ResetGraph(isolate, module);
     return false;
   }
-
-  Isolate* isolate = module->GetIsolate();
   Zone zone(isolate->allocator(), ZONE_NAME);
   ZoneForwardList<Handle<Module>> stack(&zone);
   unsigned dfs_index = 0;
-  if (!FinishInstantiate(module, &stack, &dfs_index, &zone)) {
+  if (!FinishInstantiate(isolate, module, &stack, &dfs_index, &zone)) {
     for (auto& descendant : stack) {
-      Reset(descendant);
+      Reset(isolate, descendant);
     }
     DCHECK_EQ(module->status(), kUninstantiated);
     return false;
@@ -453,16 +470,16 @@ bool Module::Instantiate(Handle<Module> module, v8::Local<v8::Context> context,
   return true;
 }
 
-bool Module::PrepareInstantiate(Handle<Module> module,
+bool Module::PrepareInstantiate(Isolate* isolate, Handle<Module> module,
                                 v8::Local<v8::Context> context,
                                 v8::Module::ResolveCallback callback) {
   DCHECK_NE(module->status(), kEvaluating);
   DCHECK_NE(module->status(), kInstantiating);
   if (module->status() >= kPreInstantiating) return true;
-  module->SetStatus(kPreInstantiating);
+  module->SetStatus(isolate, kPreInstantiating);
+  STACK_CHECK(isolate, false);
 
   // Obtain requested modules.
-  Isolate* isolate = module->GetIsolate();
   Handle<ModuleInfo> module_info(module->info(), isolate);
   Handle<FixedArray> module_requests(module_info->module_requests(), isolate);
   Handle<FixedArray> requested_modules(module->requested_modules(), isolate);
@@ -483,7 +500,7 @@ bool Module::PrepareInstantiate(Handle<Module> module,
   for (int i = 0, length = requested_modules->length(); i < length; ++i) {
     Handle<Module> requested_module(Module::cast(requested_modules->get(i)),
                                     isolate);
-    if (!PrepareInstantiate(requested_module, context, callback)) {
+    if (!PrepareInstantiate(isolate, requested_module, context, callback)) {
       return false;
     }
   }
@@ -494,7 +511,7 @@ bool Module::PrepareInstantiate(Handle<Module> module,
     int cell_index = module_info->RegularExportCellIndex(i);
     Handle<FixedArray> export_names(module_info->RegularExportExportNames(i),
                                     isolate);
-    CreateExport(module, cell_index, export_names);
+    CreateExport(isolate, module, cell_index, export_names);
   }
 
   // Partially set up indirect exports.
@@ -508,28 +525,33 @@ bool Module::PrepareInstantiate(Handle<Module> module,
         ModuleInfoEntry::cast(special_exports->get(i)), isolate);
     Handle<Object> export_name(entry->export_name(), isolate);
     if (export_name->IsUndefined(isolate)) continue;  // Star export.
-    CreateIndirectExport(module, Handle<String>::cast(export_name), entry);
+    CreateIndirectExport(isolate, module, Handle<String>::cast(export_name),
+                         entry);
   }
 
   DCHECK_EQ(module->status(), kPreInstantiating);
   return true;
 }
 
-void Module::RunInitializationCode(Handle<Module> module) {
+bool Module::RunInitializationCode(Isolate* isolate, Handle<Module> module) {
   DCHECK_EQ(module->status(), kInstantiating);
-  Isolate* isolate = module->GetIsolate();
   Handle<JSFunction> function(JSFunction::cast(module->code()), isolate);
   DCHECK_EQ(MODULE_SCOPE, function->shared()->scope_info()->scope_type());
   Handle<Object> receiver = isolate->factory()->undefined_value();
   Handle<Object> argv[] = {module};
-  Handle<Object> generator =
-      Execution::Call(isolate, function, receiver, arraysize(argv), argv)
-          .ToHandleChecked();
+  MaybeHandle<Object> maybe_generator =
+      Execution::Call(isolate, function, receiver, arraysize(argv), argv);
+  Handle<Object> generator;
+  if (!maybe_generator.ToHandle(&generator)) {
+    DCHECK(isolate->has_pending_exception());
+    return false;
+  }
   DCHECK_EQ(*function, Handle<JSGeneratorObject>::cast(generator)->function());
   module->set_code(*generator);
+  return true;
 }
 
-void Module::MaybeTransitionComponent(Handle<Module> module,
+bool Module::MaybeTransitionComponent(Isolate* isolate, Handle<Module> module,
                                       ZoneForwardList<Handle<Module>>* stack,
                                       Status new_status) {
   DCHECK(new_status == kInstantiated || new_status == kEvaluated);
@@ -546,29 +568,32 @@ void Module::MaybeTransitionComponent(Handle<Module> module,
       stack->pop_front();
       DCHECK_EQ(ancestor->status(),
                 new_status == kInstantiated ? kInstantiating : kEvaluating);
-      if (new_status == kInstantiated) RunInitializationCode(ancestor);
-      ancestor->SetStatus(new_status);
+      if (new_status == kInstantiated) {
+        if (!RunInitializationCode(isolate, ancestor)) return false;
+      }
+      ancestor->SetStatus(isolate, new_status);
     } while (*ancestor != *module);
   }
+  return true;
 }
 
-bool Module::FinishInstantiate(Handle<Module> module,
+bool Module::FinishInstantiate(Isolate* isolate, Handle<Module> module,
                                ZoneForwardList<Handle<Module>>* stack,
                                unsigned* dfs_index, Zone* zone) {
   DCHECK_NE(module->status(), kEvaluating);
   if (module->status() >= kInstantiating) return true;
   DCHECK_EQ(module->status(), kPreInstantiating);
+  STACK_CHECK(isolate, false);
 
   // Instantiate SharedFunctionInfo and mark module as instantiating for
   // the recursion.
-  Isolate* isolate = module->GetIsolate();
   Handle<SharedFunctionInfo> shared(SharedFunctionInfo::cast(module->code()),
                                     isolate);
   Handle<JSFunction> function =
       isolate->factory()->NewFunctionFromSharedFunctionInfo(
           shared, isolate->native_context());
   module->set_code(*function);
-  module->SetStatus(kInstantiating);
+  module->SetStatus(isolate, kInstantiating);
   module->set_dfs_index(*dfs_index);
   module->set_dfs_ancestor_index(*dfs_index);
   stack->push_front(module);
@@ -579,7 +604,7 @@ bool Module::FinishInstantiate(Handle<Module> module,
   for (int i = 0, length = requested_modules->length(); i < length; ++i) {
     Handle<Module> requested_module(Module::cast(requested_modules->get(i)),
                                     isolate);
-    if (!FinishInstantiate(requested_module, stack, dfs_index, zone)) {
+    if (!FinishInstantiate(isolate, requested_module, stack, dfs_index, zone)) {
       return false;
     }
 
@@ -611,8 +636,8 @@ bool Module::FinishInstantiate(Handle<Module> module,
     MessageLocation loc(script, entry->beg_pos(), entry->end_pos());
     ResolveSet resolve_set(zone);
     Handle<Cell> cell;
-    if (!ResolveImport(module, name, entry->module_request(), loc, true,
-                       &resolve_set)
+    if (!ResolveImport(isolate, module, name, entry->module_request(), loc,
+                       true, &resolve_set)
              .ToHandle(&cell)) {
       return false;
     }
@@ -628,30 +653,27 @@ bool Module::FinishInstantiate(Handle<Module> module,
     if (name->IsUndefined(isolate)) continue;  // Star export.
     MessageLocation loc(script, entry->beg_pos(), entry->end_pos());
     ResolveSet resolve_set(zone);
-    if (ResolveExport(module, Handle<String>(), Handle<String>::cast(name), loc,
-                      true, &resolve_set)
+    if (ResolveExport(isolate, module, Handle<String>(),
+                      Handle<String>::cast(name), loc, true, &resolve_set)
             .is_null()) {
       return false;
     }
   }
 
-  MaybeTransitionComponent(module, stack, kInstantiated);
-  return true;
+  return MaybeTransitionComponent(isolate, module, stack, kInstantiated);
 }
 
-MaybeHandle<Object> Module::Evaluate(Handle<Module> module) {
+MaybeHandle<Object> Module::Evaluate(Isolate* isolate, Handle<Module> module) {
 #ifdef DEBUG
   if (FLAG_trace_module_status) {
-    OFStream os(stdout);
+    StdoutStream os;
     os << "Evaluating module ";
-    module->script()->GetNameOrSourceURL()->Print(os);
+    module->script()->GetNameOrSourceURL()->Print(isolate, os);
 #ifndef OBJECT_PRINT
     os << "\n";
 #endif  // OBJECT_PRINT
   }
 #endif  // DEBUG
-
-  Isolate* isolate = module->GetIsolate();
   if (module->status() == kErrored) {
     isolate->Throw(module->GetException());
     return MaybeHandle<Object>();
@@ -663,10 +685,10 @@ MaybeHandle<Object> Module::Evaluate(Handle<Module> module) {
   ZoneForwardList<Handle<Module>> stack(&zone);
   unsigned dfs_index = 0;
   Handle<Object> result;
-  if (!Evaluate(module, &stack, &dfs_index).ToHandle(&result)) {
+  if (!Evaluate(isolate, module, &stack, &dfs_index).ToHandle(&result)) {
     for (auto& descendant : stack) {
       DCHECK_EQ(descendant->status(), kEvaluating);
-      descendant->RecordError();
+      descendant->RecordError(isolate);
     }
     DCHECK_EQ(module->GetException(), isolate->pending_exception());
     return MaybeHandle<Object>();
@@ -676,10 +698,9 @@ MaybeHandle<Object> Module::Evaluate(Handle<Module> module) {
   return result;
 }
 
-MaybeHandle<Object> Module::Evaluate(Handle<Module> module,
+MaybeHandle<Object> Module::Evaluate(Isolate* isolate, Handle<Module> module,
                                      ZoneForwardList<Handle<Module>>* stack,
                                      unsigned* dfs_index) {
-  Isolate* isolate = module->GetIsolate();
   if (module->status() == kErrored) {
     isolate->Throw(module->GetException());
     return MaybeHandle<Object>();
@@ -688,12 +709,13 @@ MaybeHandle<Object> Module::Evaluate(Handle<Module> module,
     return isolate->factory()->undefined_value();
   }
   DCHECK_EQ(module->status(), kInstantiated);
+  STACK_CHECK(isolate, MaybeHandle<Object>());
 
   Handle<JSGeneratorObject> generator(JSGeneratorObject::cast(module->code()),
                                       isolate);
   module->set_code(
       generator->function()->shared()->scope_info()->ModuleDescriptorInfo());
-  module->SetStatus(kEvaluating);
+  module->SetStatus(isolate, kEvaluating);
   module->set_dfs_index(*dfs_index);
   module->set_dfs_ancestor_index(*dfs_index);
   stack->push_front(module);
@@ -704,8 +726,8 @@ MaybeHandle<Object> Module::Evaluate(Handle<Module> module,
   for (int i = 0, length = requested_modules->length(); i < length; ++i) {
     Handle<Module> requested_module(Module::cast(requested_modules->get(i)),
                                     isolate);
-    RETURN_ON_EXCEPTION(isolate, Evaluate(requested_module, stack, dfs_index),
-                        Object);
+    RETURN_ON_EXCEPTION(
+        isolate, Evaluate(isolate, requested_module, stack, dfs_index), Object);
 
     DCHECK_GE(requested_module->status(), kEvaluating);
     DCHECK_NE(requested_module->status(), kErrored);
@@ -732,9 +754,9 @@ MaybeHandle<Object> Module::Evaluate(Handle<Module> module,
       Object);
   DCHECK(static_cast<JSIteratorResult*>(JSObject::cast(*result))
              ->done()
-             ->BooleanValue());
+             ->BooleanValue(isolate));
 
-  MaybeTransitionComponent(module, stack, kEvaluated);
+  CHECK(MaybeTransitionComponent(isolate, module, stack, kEvaluated));
   return handle(
       static_cast<JSIteratorResult*>(JSObject::cast(*result))->value(),
       isolate);
@@ -742,7 +764,7 @@ MaybeHandle<Object> Module::Evaluate(Handle<Module> module,
 
 namespace {
 
-void FetchStarExports(Handle<Module> module, Zone* zone,
+void FetchStarExports(Isolate* isolate, Handle<Module> module, Zone* zone,
                       UnorderedModuleSet* visited) {
   DCHECK_GE(module->status(), Module::kInstantiating);
 
@@ -750,8 +772,6 @@ void FetchStarExports(Handle<Module> module, Zone* zone,
 
   bool cycle = !visited->insert(module).second;
   if (cycle) return;
-
-  Isolate* isolate = module->GetIsolate();
   Handle<ObjectHashTable> exports(module->exports(), isolate);
   UnorderedStringMap more_exports(zone);
 
@@ -772,7 +792,7 @@ void FetchStarExports(Handle<Module> module, Zone* zone,
         isolate);
 
     // Recurse.
-    FetchStarExports(requested_module, zone, visited);
+    FetchStarExports(isolate, requested_module, zone, visited);
 
     // Collect all of [requested_module]'s exports that must be added to
     // [module]'s exports (i.e. to [exports]).  We record these in
@@ -785,7 +805,7 @@ void FetchStarExports(Handle<Module> module, Zone* zone,
       if (!requested_exports->ToKey(isolate, i, &key)) continue;
       Handle<String> name(String::cast(key), isolate);
 
-      if (name->Equals(isolate->heap()->default_string())) continue;
+      if (name->Equals(ReadOnlyRoots(isolate).default_string())) continue;
       if (!exports->Lookup(name)->IsTheHole(isolate)) continue;
 
       Handle<Cell> cell(Cell::cast(requested_exports->ValueAt(i)), isolate);
@@ -808,7 +828,7 @@ void FetchStarExports(Handle<Module> module, Zone* zone,
   // Copy [more_exports] into [exports].
   for (const auto& elem : more_exports) {
     if (elem.second->IsUndefined(isolate)) continue;  // Ambiguous export.
-    DCHECK(!elem.first->Equals(isolate->heap()->default_string()));
+    DCHECK(!elem.first->Equals(ReadOnlyRoots(isolate).default_string()));
     DCHECK(elem.second->IsCell());
     exports = ObjectHashTable::Put(exports, elem.first, elem.second);
   }
@@ -817,17 +837,16 @@ void FetchStarExports(Handle<Module> module, Zone* zone,
 
 }  // anonymous namespace
 
-Handle<JSModuleNamespace> Module::GetModuleNamespace(Handle<Module> module,
+Handle<JSModuleNamespace> Module::GetModuleNamespace(Isolate* isolate,
+                                                     Handle<Module> module,
                                                      int module_request) {
-  Isolate* isolate = module->GetIsolate();
   Handle<Module> requested_module(
       Module::cast(module->requested_modules()->get(module_request)), isolate);
-  return Module::GetModuleNamespace(requested_module);
+  return Module::GetModuleNamespace(isolate, requested_module);
 }
 
-Handle<JSModuleNamespace> Module::GetModuleNamespace(Handle<Module> module) {
-  Isolate* isolate = module->GetIsolate();
-
+Handle<JSModuleNamespace> Module::GetModuleNamespace(Isolate* isolate,
+                                                     Handle<Module> module) {
   Handle<HeapObject> object(module->module_namespace(), isolate);
   if (!object->IsUndefined(isolate)) {
     // Namespace object already exists.
@@ -837,7 +856,7 @@ Handle<JSModuleNamespace> Module::GetModuleNamespace(Handle<Module> module) {
   // Collect the export names.
   Zone zone(isolate->allocator(), ZONE_NAME);
   UnorderedModuleSet visited(&zone);
-  FetchStarExports(module, &zone, &visited);
+  FetchStarExports(isolate, module, &zone, &visited);
   Handle<ObjectHashTable> exports(module->exports(), isolate);
   ZoneVector<Handle<String>> names(&zone);
   names.reserve(exports->NumberOfElements());
@@ -849,12 +868,11 @@ Handle<JSModuleNamespace> Module::GetModuleNamespace(Handle<Module> module) {
   DCHECK_EQ(static_cast<int>(names.size()), exports->NumberOfElements());
 
   // Sort them alphabetically.
-  struct {
-    bool operator()(Handle<String> a, Handle<String> b) {
-      return String::Compare(a, b) == ComparisonResult::kLessThan;
-    }
-  } StringLess;
-  std::sort(names.begin(), names.end(), StringLess);
+  std::sort(names.begin(), names.end(),
+            [&isolate](Handle<String> a, Handle<String> b) {
+              return String::Compare(isolate, a, b) ==
+                     ComparisonResult::kLessThan;
+            });
 
   // Create the namespace object (initially empty).
   Handle<JSModuleNamespace> ns = isolate->factory()->NewJSModuleNamespace();
@@ -883,9 +901,8 @@ Handle<JSModuleNamespace> Module::GetModuleNamespace(Handle<Module> module) {
   return ns;
 }
 
-MaybeHandle<Object> JSModuleNamespace::GetExport(Handle<String> name) {
-  Isolate* isolate = name->GetIsolate();
-
+MaybeHandle<Object> JSModuleNamespace::GetExport(Isolate* isolate,
+                                                 Handle<String> name) {
   Handle<Object> object(module()->exports()->Lookup(name), isolate);
   if (object->IsTheHole(isolate)) {
     return isolate->factory()->undefined_value();
@@ -906,7 +923,7 @@ Maybe<PropertyAttributes> JSModuleNamespace::GetPropertyAttributes(
   Handle<String> name = Handle<String>::cast(it->GetName());
   DCHECK_EQ(it->state(), LookupIterator::ACCESSOR);
 
-  Isolate* isolate = name->GetIsolate();
+  Isolate* isolate = it->isolate();
 
   Handle<Object> lookup(object->module()->exports()->Lookup(name), isolate);
   if (lookup->IsTheHole(isolate)) {
diff --git a/deps/v8/src/objects/module.h b/deps/v8/src/objects/module.h
index 613304ae78b7b6..f45cb101ae96f2 100644
--- a/deps/v8/src/objects/module.h
+++ b/deps/v8/src/objects/module.h
@@ -67,6 +67,10 @@ class Module : public Struct {
   // The exception in the case {status} is kErrored.
   Object* GetException();
 
+  // The shared function info in case {status} is not kEvaluating, kEvaluated or
+  // kErrored.
+  SharedFunctionInfo* GetSharedFunctionInfo() const;
+
   // The namespace object (or undefined).
   DECL_ACCESSORS(module_namespace, HeapObject)
 
@@ -91,26 +95,29 @@ class Module : public Struct {
   // otherwise. (In the case where the callback throws an exception, that
   // exception is propagated.)
   static V8_WARN_UNUSED_RESULT bool Instantiate(
-      Handle<Module> module, v8::Local<v8::Context> context,
+      Isolate* isolate, Handle<Module> module, v8::Local<v8::Context> context,
       v8::Module::ResolveCallback callback);
 
   // Implementation of spec operation ModuleEvaluation.
   static V8_WARN_UNUSED_RESULT MaybeHandle<Object> Evaluate(
-      Handle<Module> module);
+      Isolate* isolate, Handle<Module> module);
 
   Cell* GetCell(int cell_index);
-  static Handle<Object> LoadVariable(Handle<Module> module, int cell_index);
+  static Handle<Object> LoadVariable(Isolate* isolate, Handle<Module> module,
+                                     int cell_index);
   static void StoreVariable(Handle<Module> module, int cell_index,
                             Handle<Object> value);
 
   // Get the namespace object for [module_request] of [module].  If it doesn't
   // exist yet, it is created.
-  static Handle<JSModuleNamespace> GetModuleNamespace(Handle<Module> module,
+  static Handle<JSModuleNamespace> GetModuleNamespace(Isolate* isolate,
+                                                      Handle<Module> module,
                                                       int module_request);
 
   // Get the namespace object for [module].  If it doesn't exist yet, it is
   // created.
-  static Handle<JSModuleNamespace> GetModuleNamespace(Handle<Module> module);
+  static Handle<JSModuleNamespace> GetModuleNamespace(Isolate* isolate,
+                                                      Handle<Module> module);
 
   static const int kCodeOffset = HeapObject::kHeaderSize;
   static const int kExportsOffset = kCodeOffset + kPointerSize;
@@ -139,9 +146,10 @@ class Module : public Struct {
 
   // Helpers for Instantiate and Evaluate.
 
-  static void CreateExport(Handle<Module> module, int cell_index,
-                           Handle<FixedArray> names);
-  static void CreateIndirectExport(Handle<Module> module, Handle<String> name,
+  static void CreateExport(Isolate* isolate, Handle<Module> module,
+                           int cell_index, Handle<FixedArray> names);
+  static void CreateIndirectExport(Isolate* isolate, Handle<Module> module,
+                                   Handle<String> name,
                                    Handle<ModuleInfoEntry> entry);
 
   // The [must_resolve] argument indicates whether or not an exception should be
@@ -154,46 +162,48 @@ class Module : public Struct {
   // exception (so check manually!).
   class ResolveSet;
   static V8_WARN_UNUSED_RESULT MaybeHandle<Cell> ResolveExport(
-      Handle<Module> module, Handle<String> module_specifier,
+      Isolate* isolate, Handle<Module> module, Handle<String> module_specifier,
       Handle<String> export_name, MessageLocation loc, bool must_resolve,
       ResolveSet* resolve_set);
   static V8_WARN_UNUSED_RESULT MaybeHandle<Cell> ResolveImport(
-      Handle<Module> module, Handle<String> name, int module_request,
-      MessageLocation loc, bool must_resolve, ResolveSet* resolve_set);
+      Isolate* isolate, Handle<Module> module, Handle<String> name,
+      int module_request, MessageLocation loc, bool must_resolve,
+      ResolveSet* resolve_set);
 
   static V8_WARN_UNUSED_RESULT MaybeHandle<Cell> ResolveExportUsingStarExports(
-      Handle<Module> module, Handle<String> module_specifier,
+      Isolate* isolate, Handle<Module> module, Handle<String> module_specifier,
       Handle<String> export_name, MessageLocation loc, bool must_resolve,
       ResolveSet* resolve_set);
 
   static V8_WARN_UNUSED_RESULT bool PrepareInstantiate(
-      Handle<Module> module, v8::Local<v8::Context> context,
+      Isolate* isolate, Handle<Module> module, v8::Local<v8::Context> context,
       v8::Module::ResolveCallback callback);
   static V8_WARN_UNUSED_RESULT bool FinishInstantiate(
-      Handle<Module> module, ZoneForwardList<Handle<Module>>* stack,
-      unsigned* dfs_index, Zone* zone);
-  static void RunInitializationCode(Handle<Module> module);
+      Isolate* isolate, Handle<Module> module,
+      ZoneForwardList<Handle<Module>>* stack, unsigned* dfs_index, Zone* zone);
+  static V8_WARN_UNUSED_RESULT bool RunInitializationCode(
+      Isolate* isolate, Handle<Module> module);
 
   static V8_WARN_UNUSED_RESULT MaybeHandle<Object> Evaluate(
-      Handle<Module> module, ZoneForwardList<Handle<Module>>* stack,
-      unsigned* dfs_index);
+      Isolate* isolate, Handle<Module> module,
+      ZoneForwardList<Handle<Module>>* stack, unsigned* dfs_index);
 
-  static void MaybeTransitionComponent(Handle<Module> module,
-                                       ZoneForwardList<Handle<Module>>* stack,
-                                       Status new_status);
+  static V8_WARN_UNUSED_RESULT bool MaybeTransitionComponent(
+      Isolate* isolate, Handle<Module> module,
+      ZoneForwardList<Handle<Module>>* stack, Status new_status);
 
   // Set module's status back to kUninstantiated and reset other internal state.
   // This is used when instantiation fails.
-  static void Reset(Handle<Module> module);
-  static void ResetGraph(Handle<Module> module);
+  static void Reset(Isolate* isolate, Handle<Module> module);
+  static void ResetGraph(Isolate* isolate, Handle<Module> module);
 
   // To set status to kErrored, RecordError should be used.
-  void SetStatus(Status status);
-  void RecordError();
+  void SetStatus(Isolate* isolate, Status status);
+  void RecordError(Isolate* isolate);
 
 #ifdef DEBUG
   // For --trace-module-status.
-  void PrintStatusTransition(Status new_status);
+  void PrintStatusTransition(Isolate* isolate, Status new_status);
 #endif  // DEBUG
 
   DISALLOW_IMPLICIT_CONSTRUCTORS(Module);
@@ -205,7 +215,7 @@ class Module : public Struct {
 class JSModuleNamespace : public JSObject {
  public:
   DECL_CAST(JSModuleNamespace)
-  DECL_PRINTER(JSModuleNamespace)
+  DECL_PRINTER_WITH_ISOLATE(JSModuleNamespace)
   DECL_VERIFIER(JSModuleNamespace)
 
   // The actual module whose namespace is being represented.
@@ -214,7 +224,8 @@ class JSModuleNamespace : public JSObject {
   // Retrieve the value exported by [module] under the given [name]. If there is
   // no such export, return Just(undefined). If the export is uninitialized,
   // schedule an exception and return Nothing.
-  V8_WARN_UNUSED_RESULT MaybeHandle<Object> GetExport(Handle<String> name);
+  V8_WARN_UNUSED_RESULT MaybeHandle<Object> GetExport(Isolate* isolate,
+                                                      Handle<String> name);
 
   // Return the (constant) property attributes for the referenced property,
   // which is assumed to correspond to an export. If the export is
diff --git a/deps/v8/src/objects/name-inl.h b/deps/v8/src/objects/name-inl.h
index b4ebeb632b338e..11b19adb3b6b4e 100644
--- a/deps/v8/src/objects/name-inl.h
+++ b/deps/v8/src/objects/name-inl.h
@@ -25,8 +25,6 @@ BOOL_ACCESSORS(Symbol, flags, is_well_known_symbol, kWellKnownSymbolBit)
 BOOL_ACCESSORS(Symbol, flags, is_public, kPublicBit)
 BOOL_ACCESSORS(Symbol, flags, is_interesting_symbol, kInterestingSymbolBit)
 
-TYPE_CHECKER(Symbol, SYMBOL_TYPE)
-
 bool Symbol::is_private_field() const {
   bool value = BooleanBit::get(flags(), kPrivateFieldBit);
   DCHECK_IMPLIES(value, is_private());
@@ -71,13 +69,13 @@ bool Name::Equals(Name* other) {
   return String::cast(this)->SlowEquals(String::cast(other));
 }
 
-bool Name::Equals(Handle<Name> one, Handle<Name> two) {
+bool Name::Equals(Isolate* isolate, Handle<Name> one, Handle<Name> two) {
   if (one.is_identical_to(two)) return true;
   if ((one->IsInternalizedString() && two->IsInternalizedString()) ||
       one->IsSymbol() || two->IsSymbol()) {
     return false;
   }
-  return String::SlowEquals(Handle<String>::cast(one),
+  return String::SlowEquals(isolate, Handle<String>::cast(one),
                             Handle<String>::cast(two));
 }
 
diff --git a/deps/v8/src/objects/name.h b/deps/v8/src/objects/name.h
index 091eb4c64165c5..779597290d2053 100644
--- a/deps/v8/src/objects/name.h
+++ b/deps/v8/src/objects/name.h
@@ -29,7 +29,8 @@ class Name : public HeapObject {
 
   // Equality operations.
   inline bool Equals(Name* other);
-  inline static bool Equals(Handle<Name> one, Handle<Name> two);
+  inline static bool Equals(Isolate* isolate, Handle<Name> one,
+                            Handle<Name> two);
 
   // Conversion.
   inline bool AsArrayIndex(uint32_t* index);
@@ -62,8 +63,8 @@ class Name : public HeapObject {
   DECL_CAST(Name)
 
   DECL_PRINTER(Name)
-  void NameShortPrint();
-  int NameShortPrint(Vector<char> str);
+  void NameShortPrint(Isolate* isolate);
+  int NameShortPrint(Isolate* isolate, Vector<char> str);
 
   // Layout description.
   static const int kHashFieldSlot = HeapObject::kHeaderSize;
@@ -176,7 +177,7 @@ class Symbol : public Name {
   DECL_CAST(Symbol)
 
   // Dispatched behavior.
-  DECL_PRINTER(Symbol)
+  DECL_PRINTER_WITH_ISOLATE(Symbol)
   DECL_VERIFIER(Symbol)
 
   // Layout description.
@@ -198,7 +199,7 @@ class Symbol : public Name {
   void SymbolShortPrint(std::ostream& os);
 
  private:
-  const char* PrivateSymbolToName() const;
+  const char* PrivateSymbolToName(Isolate* isolate) const;
 
   // TODO(cbruni): remove once the new maptracer is in place.
   friend class Name;  // For PrivateSymbolToName.
diff --git a/deps/v8/src/objects/object-macros-undef.h b/deps/v8/src/objects/object-macros-undef.h
index ea515b61ed36fb..c35aab095a57f9 100644
--- a/deps/v8/src/objects/object-macros-undef.h
+++ b/deps/v8/src/objects/object-macros-undef.h
@@ -26,7 +26,6 @@
 #undef BIT_FIELD_ACCESSORS
 #undef TYPE_CHECKER
 #undef FIELD_ADDR
-#undef FIELD_ADDR_CONST
 #undef READ_FIELD
 #undef READ_WEAK_FIELD
 #undef ACQUIRE_READ_FIELD
diff --git a/deps/v8/src/objects/object-macros.h b/deps/v8/src/objects/object-macros.h
index 03a11967034367..4bbf9e535bbf87 100644
--- a/deps/v8/src/objects/object-macros.h
+++ b/deps/v8/src/objects/object-macros.h
@@ -24,14 +24,18 @@
 
 #define DECL_INT32_ACCESSORS(name) DECL_PRIMITIVE_ACCESSORS(name, int32_t)
 
+#define DECL_UINT16_ACCESSORS(name) \
+  inline uint16_t name() const;     \
+  inline void set_##name(int value);
+
 #define DECL_ACCESSORS(name, type)    \
   inline type* name() const;          \
   inline void set_##name(type* value, \
                          WriteBarrierMode mode = UPDATE_WRITE_BARRIER);
 
-#define DECL_CAST(type)                      \
-  INLINE(static type* cast(Object* object)); \
-  INLINE(static const type* cast(const Object* object));
+#define DECL_CAST(type)                        \
+  V8_INLINE static type* cast(Object* object); \
+  V8_INLINE static const type* cast(const Object* object);
 
 #define CAST_ACCESSOR(type)                       \
   type* type::cast(Object* object) {              \
@@ -53,17 +57,26 @@
     WRITE_INT32_FIELD(this, offset, value);                               \
   }
 
-#define ACCESSORS_CHECKED2(holder, name, type, offset, get_condition, \
-                           set_condition)                             \
-  type* holder::name() const {                                        \
-    type* value = type::cast(READ_FIELD(this, offset));               \
-    DCHECK(get_condition);                                            \
-    return value;                                                     \
-  }                                                                   \
-  void holder::set_##name(type* value, WriteBarrierMode mode) {       \
-    DCHECK(set_condition);                                            \
-    WRITE_FIELD(this, offset, value);                                 \
-    CONDITIONAL_WRITE_BARRIER(GetHeap(), this, offset, value, mode);  \
+#define UINT16_ACCESSORS(holder, name, offset)                              \
+  uint16_t holder::name() const { return READ_UINT16_FIELD(this, offset); } \
+  void holder::set_##name(int value) {                                      \
+    DCHECK_GE(value, 0);                                                    \
+    DCHECK_LE(value, static_cast<uint16_t>(-1));                            \
+    WRITE_UINT16_FIELD(this, offset, value);                                \
+  }
+
+#define ACCESSORS_CHECKED2(holder, name, type, offset, get_condition,   \
+                           set_condition)                               \
+  type* holder::name() const {                                          \
+    type* value = type::cast(READ_FIELD(this, offset));                 \
+    DCHECK(get_condition);                                              \
+    return value;                                                       \
+  }                                                                     \
+  void holder::set_##name(type* value, WriteBarrierMode mode) {         \
+    DCHECK(set_condition);                                              \
+    WRITE_FIELD(this, offset, value);                                   \
+    CONDITIONAL_WRITE_BARRIER(Heap::FromWritableHeapObject(this), this, \
+                              offset, value, mode);                     \
   }
 #define ACCESSORS_CHECKED(holder, name, type, offset, condition) \
   ACCESSORS_CHECKED2(holder, name, type, offset, condition, condition)
@@ -71,17 +84,18 @@
 #define ACCESSORS(holder, name, type, offset) \
   ACCESSORS_CHECKED(holder, name, type, offset, true)
 
-#define WEAK_ACCESSORS_CHECKED2(holder, name, offset, get_condition,      \
-                                set_condition)                            \
-  MaybeObject* holder::name() const {                                     \
-    MaybeObject* value = READ_WEAK_FIELD(this, offset);                   \
-    DCHECK(get_condition);                                                \
-    return value;                                                         \
-  }                                                                       \
-  void holder::set_##name(MaybeObject* value, WriteBarrierMode mode) {    \
-    DCHECK(set_condition);                                                \
-    WRITE_WEAK_FIELD(this, offset, value);                                \
-    CONDITIONAL_WEAK_WRITE_BARRIER(GetHeap(), this, offset, value, mode); \
+#define WEAK_ACCESSORS_CHECKED2(holder, name, offset, get_condition,         \
+                                set_condition)                               \
+  MaybeObject* holder::name() const {                                        \
+    MaybeObject* value = READ_WEAK_FIELD(this, offset);                      \
+    DCHECK(get_condition);                                                   \
+    return value;                                                            \
+  }                                                                          \
+  void holder::set_##name(MaybeObject* value, WriteBarrierMode mode) {       \
+    DCHECK(set_condition);                                                   \
+    WRITE_WEAK_FIELD(this, offset, value);                                   \
+    CONDITIONAL_WEAK_WRITE_BARRIER(Heap::FromWritableHeapObject(this), this, \
+                                   offset, value, mode);                     \
   }
 
 #define WEAK_ACCESSORS_CHECKED(holder, name, offset, condition) \
@@ -146,28 +160,25 @@
   }
 
 #define FIELD_ADDR(p, offset) \
-  (reinterpret_cast<byte*>(p) + offset - kHeapObjectTag)
-
-#define FIELD_ADDR_CONST(p, offset) \
-  (reinterpret_cast<const byte*>(p) + offset - kHeapObjectTag)
+  (reinterpret_cast<Address>(p) + offset - kHeapObjectTag)
 
 #define READ_FIELD(p, offset) \
-  (*reinterpret_cast<Object* const*>(FIELD_ADDR_CONST(p, offset)))
+  (*reinterpret_cast<Object* const*>(FIELD_ADDR(p, offset)))
 
 #define READ_WEAK_FIELD(p, offset) \
-  (*reinterpret_cast<MaybeObject* const*>(FIELD_ADDR_CONST(p, offset)))
+  (*reinterpret_cast<MaybeObject* const*>(FIELD_ADDR(p, offset)))
 
 #define ACQUIRE_READ_FIELD(p, offset)           \
   reinterpret_cast<Object*>(base::Acquire_Load( \
-      reinterpret_cast<const base::AtomicWord*>(FIELD_ADDR_CONST(p, offset))))
+      reinterpret_cast<const base::AtomicWord*>(FIELD_ADDR(p, offset))))
 
 #define RELAXED_READ_FIELD(p, offset)           \
   reinterpret_cast<Object*>(base::Relaxed_Load( \
-      reinterpret_cast<const base::AtomicWord*>(FIELD_ADDR_CONST(p, offset))))
+      reinterpret_cast<const base::AtomicWord*>(FIELD_ADDR(p, offset))))
 
 #define RELAXED_READ_WEAK_FIELD(p, offset)           \
   reinterpret_cast<MaybeObject*>(base::Relaxed_Load( \
-      reinterpret_cast<const base::AtomicWord*>(FIELD_ADDR_CONST(p, offset))))
+      reinterpret_cast<const base::AtomicWord*>(FIELD_ADDR(p, offset))))
 
 #ifdef V8_CONCURRENT_MARKING
 #define WRITE_FIELD(p, offset, value)                             \
@@ -195,54 +206,67 @@
       reinterpret_cast<base::AtomicWord*>(FIELD_ADDR(p, offset)), \
       reinterpret_cast<base::AtomicWord>(value));
 
-#define WRITE_BARRIER(heap, object, offset, value)          \
-  heap->incremental_marking()->RecordWrite(                 \
-      object, HeapObject::RawField(object, offset), value); \
-  heap->RecordWrite(object, HeapObject::RawField(object, offset), value);
-
-#define WEAK_WRITE_BARRIER(heap, object, offset, value)                    \
-  heap->incremental_marking()->RecordMaybeWeakWrite(                       \
-      object, HeapObject::RawMaybeWeakField(object, offset), value);       \
-  heap->RecordWrite(object, HeapObject::RawMaybeWeakField(object, offset), \
-                    value);
-
-#define CONDITIONAL_WRITE_BARRIER(heap, object, offset, value, mode)        \
-  if (mode != SKIP_WRITE_BARRIER) {                                         \
-    if (mode == UPDATE_WRITE_BARRIER) {                                     \
-      heap->incremental_marking()->RecordWrite(                             \
-          object, HeapObject::RawField(object, offset), value);             \
-    }                                                                       \
-    heap->RecordWrite(object, HeapObject::RawField(object, offset), value); \
-  }
-
-#define CONDITIONAL_WEAK_WRITE_BARRIER(heap, object, offset, value, mode)    \
-  if (mode != SKIP_WRITE_BARRIER) {                                          \
-    if (mode == UPDATE_WRITE_BARRIER) {                                      \
-      heap->incremental_marking()->RecordMaybeWeakWrite(                     \
-          object, HeapObject::RawMaybeWeakField(object, offset), value);     \
-    }                                                                        \
-    heap->RecordWrite(object, HeapObject::RawMaybeWeakField(object, offset), \
-                      value);                                                \
-  }
-
-#define READ_DOUBLE_FIELD(p, offset) \
-  ReadDoubleValue(FIELD_ADDR_CONST(p, offset))
+#define WRITE_BARRIER(heap, object, offset, value)                      \
+  do {                                                                  \
+    Heap* __heap__ = heap;                                              \
+    __heap__->incremental_marking()->RecordWrite(                       \
+        object, HeapObject::RawField(object, offset), value);           \
+    __heap__->RecordWrite(object, HeapObject::RawField(object, offset), \
+                          value);                                       \
+  } while (false)
+
+#define WEAK_WRITE_BARRIER(heap, object, offset, value)                \
+  do {                                                                 \
+    Heap* __heap__ = heap;                                             \
+    __heap__->incremental_marking()->RecordMaybeWeakWrite(             \
+        object, HeapObject::RawMaybeWeakField(object, offset), value); \
+    __heap__->RecordWrite(                                             \
+        object, HeapObject::RawMaybeWeakField(object, offset), value); \
+  } while (false)
+
+#define CONDITIONAL_WRITE_BARRIER(heap, object, offset, value, mode)      \
+  do {                                                                    \
+    Heap* __heap__ = heap;                                                \
+    if (mode != SKIP_WRITE_BARRIER) {                                     \
+      if (mode == UPDATE_WRITE_BARRIER) {                                 \
+        __heap__->incremental_marking()->RecordWrite(                     \
+            object, HeapObject::RawField(object, offset), value);         \
+      }                                                                   \
+      __heap__->RecordWrite(object, HeapObject::RawField(object, offset), \
+                            value);                                       \
+    }                                                                     \
+  } while (false)
+
+#define CONDITIONAL_WEAK_WRITE_BARRIER(heap, object, offset, value, mode)  \
+  do {                                                                     \
+    Heap* __heap__ = heap;                                                 \
+    if (mode != SKIP_WRITE_BARRIER) {                                      \
+      if (mode == UPDATE_WRITE_BARRIER) {                                  \
+        __heap__->incremental_marking()->RecordMaybeWeakWrite(             \
+            object, HeapObject::RawMaybeWeakField(object, offset), value); \
+      }                                                                    \
+      __heap__->RecordWrite(                                               \
+          object, HeapObject::RawMaybeWeakField(object, offset), value);   \
+    }                                                                      \
+  } while (false)
+
+#define READ_DOUBLE_FIELD(p, offset) ReadDoubleValue(FIELD_ADDR(p, offset))
 
 #define WRITE_DOUBLE_FIELD(p, offset, value) \
   WriteDoubleValue(FIELD_ADDR(p, offset), value)
 
 #define READ_INT_FIELD(p, offset) \
-  (*reinterpret_cast<const int*>(FIELD_ADDR_CONST(p, offset)))
+  (*reinterpret_cast<const int*>(FIELD_ADDR(p, offset)))
 
 #define WRITE_INT_FIELD(p, offset, value) \
   (*reinterpret_cast<int*>(FIELD_ADDR(p, offset)) = value)
 
 #define RELAXED_READ_INTPTR_FIELD(p, offset) \
   static_cast<intptr_t>(base::Relaxed_Load(  \
-      reinterpret_cast<const base::AtomicWord*>(FIELD_ADDR_CONST(p, offset))))
+      reinterpret_cast<const base::AtomicWord*>(FIELD_ADDR(p, offset))))
 
 #define READ_INTPTR_FIELD(p, offset) \
-  (*reinterpret_cast<const intptr_t*>(FIELD_ADDR_CONST(p, offset)))
+  (*reinterpret_cast<const intptr_t*>(FIELD_ADDR(p, offset)))
 
 #define RELAXED_WRITE_INTPTR_FIELD(p, offset, value)              \
   base::Relaxed_Store(                                            \
@@ -253,7 +277,7 @@
   (*reinterpret_cast<intptr_t*>(FIELD_ADDR(p, offset)) = value)
 
 #define READ_UINT8_FIELD(p, offset) \
-  (*reinterpret_cast<const uint8_t*>(FIELD_ADDR_CONST(p, offset)))
+  (*reinterpret_cast<const uint8_t*>(FIELD_ADDR(p, offset)))
 
 #define WRITE_UINT8_FIELD(p, offset, value) \
   (*reinterpret_cast<uint8_t*>(FIELD_ADDR(p, offset)) = value)
@@ -263,63 +287,63 @@
                       static_cast<base::Atomic8>(value));
 
 #define READ_INT8_FIELD(p, offset) \
-  (*reinterpret_cast<const int8_t*>(FIELD_ADDR_CONST(p, offset)))
+  (*reinterpret_cast<const int8_t*>(FIELD_ADDR(p, offset)))
 
 #define RELAXED_READ_INT8_FIELD(p, offset) \
   static_cast<int8_t>(base::Relaxed_Load(  \
-      reinterpret_cast<const base::Atomic8*>(FIELD_ADDR_CONST(p, offset))))
+      reinterpret_cast<const base::Atomic8*>(FIELD_ADDR(p, offset))))
 
 #define WRITE_INT8_FIELD(p, offset, value) \
   (*reinterpret_cast<int8_t*>(FIELD_ADDR(p, offset)) = value)
 
 #define READ_UINT16_FIELD(p, offset) \
-  (*reinterpret_cast<const uint16_t*>(FIELD_ADDR_CONST(p, offset)))
+  (*reinterpret_cast<const uint16_t*>(FIELD_ADDR(p, offset)))
 
 #define WRITE_UINT16_FIELD(p, offset, value) \
   (*reinterpret_cast<uint16_t*>(FIELD_ADDR(p, offset)) = value)
 
 #define READ_INT16_FIELD(p, offset) \
-  (*reinterpret_cast<const int16_t*>(FIELD_ADDR_CONST(p, offset)))
+  (*reinterpret_cast<const int16_t*>(FIELD_ADDR(p, offset)))
 
 #define WRITE_INT16_FIELD(p, offset, value) \
   (*reinterpret_cast<int16_t*>(FIELD_ADDR(p, offset)) = value)
 
 #define READ_UINT32_FIELD(p, offset) \
-  (*reinterpret_cast<const uint32_t*>(FIELD_ADDR_CONST(p, offset)))
+  (*reinterpret_cast<const uint32_t*>(FIELD_ADDR(p, offset)))
 
 #define WRITE_UINT32_FIELD(p, offset, value) \
   (*reinterpret_cast<uint32_t*>(FIELD_ADDR(p, offset)) = value)
 
 #define READ_INT32_FIELD(p, offset) \
-  (*reinterpret_cast<const int32_t*>(FIELD_ADDR_CONST(p, offset)))
+  (*reinterpret_cast<const int32_t*>(FIELD_ADDR(p, offset)))
 
 #define WRITE_INT32_FIELD(p, offset, value) \
   (*reinterpret_cast<int32_t*>(FIELD_ADDR(p, offset)) = value)
 
 #define READ_FLOAT_FIELD(p, offset) \
-  (*reinterpret_cast<const float*>(FIELD_ADDR_CONST(p, offset)))
+  (*reinterpret_cast<const float*>(FIELD_ADDR(p, offset)))
 
 #define WRITE_FLOAT_FIELD(p, offset, value) \
   (*reinterpret_cast<float*>(FIELD_ADDR(p, offset)) = value)
 
 #define READ_UINT64_FIELD(p, offset) \
-  (*reinterpret_cast<const uint64_t*>(FIELD_ADDR_CONST(p, offset)))
+  (*reinterpret_cast<const uint64_t*>(FIELD_ADDR(p, offset)))
 
 #define WRITE_UINT64_FIELD(p, offset, value) \
   (*reinterpret_cast<uint64_t*>(FIELD_ADDR(p, offset)) = value)
 
 #define READ_INT64_FIELD(p, offset) \
-  (*reinterpret_cast<const int64_t*>(FIELD_ADDR_CONST(p, offset)))
+  (*reinterpret_cast<const int64_t*>(FIELD_ADDR(p, offset)))
 
 #define WRITE_INT64_FIELD(p, offset, value) \
   (*reinterpret_cast<int64_t*>(FIELD_ADDR(p, offset)) = value)
 
 #define READ_BYTE_FIELD(p, offset) \
-  (*reinterpret_cast<const byte*>(FIELD_ADDR_CONST(p, offset)))
+  (*reinterpret_cast<const byte*>(FIELD_ADDR(p, offset)))
 
 #define RELAXED_READ_BYTE_FIELD(p, offset) \
   static_cast<byte>(base::Relaxed_Load(    \
-      reinterpret_cast<const base::Atomic8*>(FIELD_ADDR_CONST(p, offset))))
+      reinterpret_cast<const base::Atomic8*>(FIELD_ADDR(p, offset))))
 
 #define WRITE_BYTE_FIELD(p, offset, value) \
   (*reinterpret_cast<byte*>(FIELD_ADDR(p, offset)) = value)
@@ -329,7 +353,7 @@
                       static_cast<base::Atomic8>(value));
 
 #ifdef VERIFY_HEAP
-#define DECL_VERIFIER(Name) void Name##Verify();
+#define DECL_VERIFIER(Name) void Name##Verify(Isolate* isolate);
 #else
 #define DECL_VERIFIER(Name)
 #endif
diff --git a/deps/v8/src/objects/ordered-hash-table-inl.h b/deps/v8/src/objects/ordered-hash-table-inl.h
new file mode 100644
index 00000000000000..25d5dc938a76ba
--- /dev/null
+++ b/deps/v8/src/objects/ordered-hash-table-inl.h
@@ -0,0 +1,53 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef V8_OBJECTS_ORDERED_HASH_TABLE_INL_H_
+#define V8_OBJECTS_ORDERED_HASH_TABLE_INL_H_
+
+#include "src/heap/heap.h"
+#include "src/objects/ordered-hash-table.h"
+
+namespace v8 {
+namespace internal {
+
+int OrderedHashSet::GetMapRootIndex() {
+  return Heap::kOrderedHashSetMapRootIndex;
+}
+
+int OrderedHashMap::GetMapRootIndex() {
+  return Heap::kOrderedHashMapMapRootIndex;
+}
+
+int SmallOrderedHashMap::GetMapRootIndex() {
+  return Heap::kSmallOrderedHashMapMapRootIndex;
+}
+
+int SmallOrderedHashSet::GetMapRootIndex() {
+  return Heap::kSmallOrderedHashSetMapRootIndex;
+}
+
+inline Object* OrderedHashMap::ValueAt(int entry) {
+  DCHECK_LT(entry, this->UsedCapacity());
+  return get(EntryToIndex(entry) + kValueOffset);
+}
+
+inline bool OrderedHashSet::Is(Handle<HeapObject> table) {
+  return table->IsOrderedHashSet();
+}
+
+inline bool OrderedHashMap::Is(Handle<HeapObject> table) {
+  return table->IsOrderedHashMap();
+}
+
+inline bool SmallOrderedHashSet::Is(Handle<HeapObject> table) {
+  return table->IsSmallOrderedHashSet();
+}
+
+inline bool SmallOrderedHashMap::Is(Handle<HeapObject> table) {
+  return table->IsSmallOrderedHashMap();
+}
+}  // namespace internal
+}  // namespace v8
+
+#endif  // V8_OBJECTS_ORDERED_HASH_TABLE_INL_H_
diff --git a/deps/v8/src/objects/ordered-hash-table.cc b/deps/v8/src/objects/ordered-hash-table.cc
new file mode 100644
index 00000000000000..17237546e9c078
--- /dev/null
+++ b/deps/v8/src/objects/ordered-hash-table.cc
@@ -0,0 +1,760 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "src/objects/ordered-hash-table.h"
+
+#include "src/isolate.h"
+#include "src/objects-inl.h"
+#include "src/objects/js-collection-inl.h"
+#include "src/objects/ordered-hash-table-inl.h"
+
+namespace v8 {
+namespace internal {
+
+template <class Derived, int entrysize>
+Handle<Derived> OrderedHashTable<Derived, entrysize>::Allocate(
+    Isolate* isolate, int capacity, PretenureFlag pretenure) {
+  // Capacity must be a power of two, since we depend on being able
+  // to divide and multiple by 2 (kLoadFactor) to derive capacity
+  // from number of buckets. If we decide to change kLoadFactor
+  // to something other than 2, capacity should be stored as another
+  // field of this object.
+  capacity = base::bits::RoundUpToPowerOfTwo32(Max(kMinCapacity, capacity));
+  if (capacity > kMaxCapacity) {
+    isolate->heap()->FatalProcessOutOfMemory("invalid table size");
+  }
+  int num_buckets = capacity / kLoadFactor;
+  Handle<FixedArray> backing_store = isolate->factory()->NewFixedArrayWithMap(
+      static_cast<Heap::RootListIndex>(Derived::GetMapRootIndex()),
+      kHashTableStartIndex + num_buckets + (capacity * kEntrySize), pretenure);
+  Handle<Derived> table = Handle<Derived>::cast(backing_store);
+  for (int i = 0; i < num_buckets; ++i) {
+    table->set(kHashTableStartIndex + i, Smi::FromInt(kNotFound));
+  }
+  table->SetNumberOfBuckets(num_buckets);
+  table->SetNumberOfElements(0);
+  table->SetNumberOfDeletedElements(0);
+  return table;
+}
+
+template <class Derived, int entrysize>
+Handle<Derived> OrderedHashTable<Derived, entrysize>::EnsureGrowable(
+    Isolate* isolate, Handle<Derived> table) {
+  DCHECK(!table->IsObsolete());
+
+  int nof = table->NumberOfElements();
+  int nod = table->NumberOfDeletedElements();
+  int capacity = table->Capacity();
+  if ((nof + nod) < capacity) return table;
+  // Don't need to grow if we can simply clear out deleted entries instead.
+  // Note that we can't compact in place, though, so we always allocate
+  // a new table.
+  return Rehash(isolate, table,
+                (nod < (capacity >> 1)) ? capacity << 1 : capacity);
+}
+
+template <class Derived, int entrysize>
+Handle<Derived> OrderedHashTable<Derived, entrysize>::Shrink(
+    Isolate* isolate, Handle<Derived> table) {
+  DCHECK(!table->IsObsolete());
+
+  int nof = table->NumberOfElements();
+  int capacity = table->Capacity();
+  if (nof >= (capacity >> 2)) return table;
+  return Rehash(isolate, table, capacity / 2);
+}
+
+template <class Derived, int entrysize>
+Handle<Derived> OrderedHashTable<Derived, entrysize>::Clear(
+    Isolate* isolate, Handle<Derived> table) {
+  DCHECK(!table->IsObsolete());
+
+  Handle<Derived> new_table = Allocate(
+      isolate, kMinCapacity, Heap::InNewSpace(*table) ? NOT_TENURED : TENURED);
+
+  table->SetNextTable(*new_table);
+  table->SetNumberOfDeletedElements(kClearedTableSentinel);
+
+  return new_table;
+}
+
+template <class Derived, int entrysize>
+bool OrderedHashTable<Derived, entrysize>::HasKey(Isolate* isolate,
+                                                  Derived* table, Object* key) {
+  DCHECK((entrysize == 1 && table->IsOrderedHashSet()) ||
+         (entrysize == 2 && table->IsOrderedHashMap()));
+  DisallowHeapAllocation no_gc;
+  int entry = table->FindEntry(isolate, key);
+  return entry != kNotFound;
+}
+
+Handle<OrderedHashSet> OrderedHashSet::Add(Isolate* isolate,
+                                           Handle<OrderedHashSet> table,
+                                           Handle<Object> key) {
+  int hash = key->GetOrCreateHash(isolate)->value();
+  int entry = table->HashToEntry(hash);
+  // Walk the chain of the bucket and try finding the key.
+  while (entry != kNotFound) {
+    Object* candidate_key = table->KeyAt(entry);
+    // Do not add if we have the key already
+    if (candidate_key->SameValueZero(*key)) return table;
+    entry = table->NextChainEntry(entry);
+  }
+
+  table = OrderedHashSet::EnsureGrowable(isolate, table);
+  // Read the existing bucket values.
+  int bucket = table->HashToBucket(hash);
+  int previous_entry = table->HashToEntry(hash);
+  int nof = table->NumberOfElements();
+  // Insert a new entry at the end,
+  int new_entry = nof + table->NumberOfDeletedElements();
+  int new_index = table->EntryToIndex(new_entry);
+  table->set(new_index, *key);
+  table->set(new_index + kChainOffset, Smi::FromInt(previous_entry));
+  // and point the bucket to the new entry.
+  table->set(kHashTableStartIndex + bucket, Smi::FromInt(new_entry));
+  table->SetNumberOfElements(nof + 1);
+  return table;
+}
+
+Handle<FixedArray> OrderedHashSet::ConvertToKeysArray(
+    Isolate* isolate, Handle<OrderedHashSet> table, GetKeysConversion convert) {
+  int length = table->NumberOfElements();
+  int nof_buckets = table->NumberOfBuckets();
+  // Convert the dictionary to a linear list.
+  Handle<FixedArray> result = Handle<FixedArray>::cast(table);
+  // From this point on table is no longer a valid OrderedHashSet.
+  result->set_map(ReadOnlyRoots(isolate).fixed_array_map());
+  for (int i = 0; i < length; i++) {
+    int index = kHashTableStartIndex + nof_buckets + (i * kEntrySize);
+    Object* key = table->get(index);
+    if (convert == GetKeysConversion::kConvertToString) {
+      uint32_t index_value;
+      if (key->ToArrayIndex(&index_value)) {
+        key = *isolate->factory()->Uint32ToString(index_value);
+      } else {
+        CHECK(key->IsName());
+      }
+    }
+    result->set(i, key);
+  }
+  return FixedArray::ShrinkOrEmpty(result, length);
+}
+
+HeapObject* OrderedHashSet::GetEmpty(ReadOnlyRoots ro_roots) {
+  return ro_roots.empty_ordered_hash_set();
+}
+
+HeapObject* OrderedHashMap::GetEmpty(ReadOnlyRoots ro_roots) {
+  return ro_roots.empty_ordered_hash_map();
+}
+
+template <class Derived, int entrysize>
+Handle<Derived> OrderedHashTable<Derived, entrysize>::Rehash(
+    Isolate* isolate, Handle<Derived> table, int new_capacity) {
+  DCHECK(!table->IsObsolete());
+
+  Handle<Derived> new_table = Allocate(
+      isolate, new_capacity, Heap::InNewSpace(*table) ? NOT_TENURED : TENURED);
+  int nof = table->NumberOfElements();
+  int nod = table->NumberOfDeletedElements();
+  int new_buckets = new_table->NumberOfBuckets();
+  int new_entry = 0;
+  int removed_holes_index = 0;
+
+  DisallowHeapAllocation no_gc;
+  for (int old_entry = 0; old_entry < (nof + nod); ++old_entry) {
+    Object* key = table->KeyAt(old_entry);
+    if (key->IsTheHole(isolate)) {
+      table->SetRemovedIndexAt(removed_holes_index++, old_entry);
+      continue;
+    }
+
+    Object* hash = key->GetHash();
+    int bucket = Smi::ToInt(hash) & (new_buckets - 1);
+    Object* chain_entry = new_table->get(kHashTableStartIndex + bucket);
+    new_table->set(kHashTableStartIndex + bucket, Smi::FromInt(new_entry));
+    int new_index = new_table->EntryToIndex(new_entry);
+    int old_index = table->EntryToIndex(old_entry);
+    for (int i = 0; i < entrysize; ++i) {
+      Object* value = table->get(old_index + i);
+      new_table->set(new_index + i, value);
+    }
+    new_table->set(new_index + kChainOffset, chain_entry);
+    ++new_entry;
+  }
+
+  DCHECK_EQ(nod, removed_holes_index);
+
+  new_table->SetNumberOfElements(nof);
+  table->SetNextTable(*new_table);
+
+  return new_table;
+}
+
+template <class Derived, int entrysize>
+bool OrderedHashTable<Derived, entrysize>::Delete(Isolate* isolate,
+                                                  Derived* table, Object* key) {
+  DisallowHeapAllocation no_gc;
+  int entry = table->FindEntry(isolate, key);
+  if (entry == kNotFound) return false;
+
+  int nof = table->NumberOfElements();
+  int nod = table->NumberOfDeletedElements();
+  int index = table->EntryToIndex(entry);
+
+  Object* hole = ReadOnlyRoots(isolate).the_hole_value();
+  for (int i = 0; i < entrysize; ++i) {
+    table->set(index + i, hole);
+  }
+
+  table->SetNumberOfElements(nof - 1);
+  table->SetNumberOfDeletedElements(nod + 1);
+
+  return true;
+}
+
+Object* OrderedHashMap::GetHash(Isolate* isolate, Object* key) {
+  DisallowHeapAllocation no_gc;
+
+  Object* hash = key->GetHash();
+  // If the object does not have an identity hash, it was never used as a key
+  if (hash->IsUndefined(isolate)) return Smi::FromInt(-1);
+  DCHECK(hash->IsSmi());
+  DCHECK_GE(Smi::cast(hash)->value(), 0);
+  return hash;
+}
+
+Handle<OrderedHashMap> OrderedHashMap::Add(Isolate* isolate,
+                                           Handle<OrderedHashMap> table,
+                                           Handle<Object> key,
+                                           Handle<Object> value) {
+  int hash = key->GetOrCreateHash(isolate)->value();
+  int entry = table->HashToEntry(hash);
+  // Walk the chain of the bucket and try finding the key.
+  {
+    DisallowHeapAllocation no_gc;
+    Object* raw_key = *key;
+    while (entry != kNotFound) {
+      Object* candidate_key = table->KeyAt(entry);
+      // Do not add if we have the key already
+      if (candidate_key->SameValueZero(raw_key)) return table;
+      entry = table->NextChainEntry(entry);
+    }
+  }
+
+  table = OrderedHashMap::EnsureGrowable(isolate, table);
+  // Read the existing bucket values.
+  int bucket = table->HashToBucket(hash);
+  int previous_entry = table->HashToEntry(hash);
+  int nof = table->NumberOfElements();
+  // Insert a new entry at the end,
+  int new_entry = nof + table->NumberOfDeletedElements();
+  int new_index = table->EntryToIndex(new_entry);
+  table->set(new_index, *key);
+  table->set(new_index + kValueOffset, *value);
+  table->set(new_index + kChainOffset, Smi::FromInt(previous_entry));
+  // and point the bucket to the new entry.
+  table->set(kHashTableStartIndex + bucket, Smi::FromInt(new_entry));
+  table->SetNumberOfElements(nof + 1);
+  return table;
+}
+
+template Handle<OrderedHashSet> OrderedHashTable<OrderedHashSet, 1>::Allocate(
+    Isolate* isolate, int capacity, PretenureFlag pretenure);
+
+template Handle<OrderedHashSet>
+OrderedHashTable<OrderedHashSet, 1>::EnsureGrowable(
+    Isolate* isolate, Handle<OrderedHashSet> table);
+
+template Handle<OrderedHashSet> OrderedHashTable<OrderedHashSet, 1>::Shrink(
+    Isolate* isolate, Handle<OrderedHashSet> table);
+
+template Handle<OrderedHashSet> OrderedHashTable<OrderedHashSet, 1>::Clear(
+    Isolate* isolate, Handle<OrderedHashSet> table);
+
+template bool OrderedHashTable<OrderedHashSet, 1>::HasKey(Isolate* isolate,
+                                                          OrderedHashSet* table,
+                                                          Object* key);
+
+template bool OrderedHashTable<OrderedHashSet, 1>::Delete(Isolate* isolate,
+                                                          OrderedHashSet* table,
+                                                          Object* key);
+
+template Handle<OrderedHashMap> OrderedHashTable<OrderedHashMap, 2>::Allocate(
+    Isolate* isolate, int capacity, PretenureFlag pretenure);
+
+template Handle<OrderedHashMap>
+OrderedHashTable<OrderedHashMap, 2>::EnsureGrowable(
+    Isolate* isolate, Handle<OrderedHashMap> table);
+
+template Handle<OrderedHashMap> OrderedHashTable<OrderedHashMap, 2>::Shrink(
+    Isolate* isolate, Handle<OrderedHashMap> table);
+
+template Handle<OrderedHashMap> OrderedHashTable<OrderedHashMap, 2>::Clear(
+    Isolate* isolate, Handle<OrderedHashMap> table);
+
+template bool OrderedHashTable<OrderedHashMap, 2>::HasKey(Isolate* isolate,
+                                                          OrderedHashMap* table,
+                                                          Object* key);
+
+template bool OrderedHashTable<OrderedHashMap, 2>::Delete(Isolate* isolate,
+                                                          OrderedHashMap* table,
+                                                          Object* key);
+
+template <>
+Handle<SmallOrderedHashSet>
+SmallOrderedHashTable<SmallOrderedHashSet>::Allocate(Isolate* isolate,
+                                                     int capacity,
+                                                     PretenureFlag pretenure) {
+  return isolate->factory()->NewSmallOrderedHashSet(capacity, pretenure);
+}
+
+template <>
+Handle<SmallOrderedHashMap>
+SmallOrderedHashTable<SmallOrderedHashMap>::Allocate(Isolate* isolate,
+                                                     int capacity,
+                                                     PretenureFlag pretenure) {
+  return isolate->factory()->NewSmallOrderedHashMap(capacity, pretenure);
+}
+
+template <class Derived>
+void SmallOrderedHashTable<Derived>::Initialize(Isolate* isolate,
+                                                int capacity) {
+  DisallowHeapAllocation no_gc;
+  int num_buckets = capacity / kLoadFactor;
+  int num_chains = capacity;
+
+  SetNumberOfBuckets(num_buckets);
+  SetNumberOfElements(0);
+  SetNumberOfDeletedElements(0);
+
+  Address hashtable_start = GetHashTableStartAddress(capacity);
+  memset(reinterpret_cast<byte*>(hashtable_start), kNotFound,
+         num_buckets + num_chains);
+
+  if (Heap::InNewSpace(this)) {
+    MemsetPointer(RawField(this, kDataTableStartOffset),
+                  ReadOnlyRoots(isolate).the_hole_value(),
+                  capacity * Derived::kEntrySize);
+  } else {
+    for (int i = 0; i < capacity; i++) {
+      for (int j = 0; j < Derived::kEntrySize; j++) {
+        SetDataEntry(i, j, ReadOnlyRoots(isolate).the_hole_value());
+      }
+    }
+  }
+
+#ifdef DEBUG
+  for (int i = 0; i < num_buckets; ++i) {
+    DCHECK_EQ(kNotFound, GetFirstEntry(i));
+  }
+
+  for (int i = 0; i < num_chains; ++i) {
+    DCHECK_EQ(kNotFound, GetNextEntry(i));
+  }
+
+  for (int i = 0; i < capacity; ++i) {
+    for (int j = 0; j < Derived::kEntrySize; j++) {
+      DCHECK_EQ(ReadOnlyRoots(isolate).the_hole_value(), GetDataEntry(i, j));
+    }
+  }
+#endif  // DEBUG
+}
+
+MaybeHandle<SmallOrderedHashSet> SmallOrderedHashSet::Add(
+    Isolate* isolate, Handle<SmallOrderedHashSet> table, Handle<Object> key) {
+  if (table->HasKey(isolate, key)) return table;
+
+  if (table->UsedCapacity() >= table->Capacity()) {
+    MaybeHandle<SmallOrderedHashSet> new_table =
+        SmallOrderedHashSet::Grow(isolate, table);
+    if (!new_table.ToHandle(&table)) {
+      return MaybeHandle<SmallOrderedHashSet>();
+    }
+  }
+
+  int hash = key->GetOrCreateHash(isolate)->value();
+  int nof = table->NumberOfElements();
+
+  // Read the existing bucket values.
+  int bucket = table->HashToBucket(hash);
+  int previous_entry = table->HashToFirstEntry(hash);
+
+  // Insert a new entry at the end,
+  int new_entry = nof + table->NumberOfDeletedElements();
+
+  table->SetDataEntry(new_entry, SmallOrderedHashSet::kKeyIndex, *key);
+  table->SetFirstEntry(bucket, new_entry);
+  table->SetNextEntry(new_entry, previous_entry);
+
+  // and update book keeping.
+  table->SetNumberOfElements(nof + 1);
+
+  return table;
+}
+
+MaybeHandle<SmallOrderedHashMap> SmallOrderedHashMap::Add(
+    Isolate* isolate, Handle<SmallOrderedHashMap> table, Handle<Object> key,
+    Handle<Object> value) {
+  if (table->HasKey(isolate, key)) return table;
+
+  if (table->UsedCapacity() >= table->Capacity()) {
+    MaybeHandle<SmallOrderedHashMap> new_table =
+        SmallOrderedHashMap::Grow(isolate, table);
+    if (!new_table.ToHandle(&table)) {
+      return MaybeHandle<SmallOrderedHashMap>();
+    }
+  }
+
+  int hash = key->GetOrCreateHash(isolate)->value();
+  int nof = table->NumberOfElements();
+
+  // Read the existing bucket values.
+  int bucket = table->HashToBucket(hash);
+  int previous_entry = table->HashToFirstEntry(hash);
+
+  // Insert a new entry at the end,
+  int new_entry = nof + table->NumberOfDeletedElements();
+
+  table->SetDataEntry(new_entry, SmallOrderedHashMap::kValueIndex, *value);
+  table->SetDataEntry(new_entry, SmallOrderedHashMap::kKeyIndex, *key);
+  table->SetFirstEntry(bucket, new_entry);
+  table->SetNextEntry(new_entry, previous_entry);
+
+  // and update book keeping.
+  table->SetNumberOfElements(nof + 1);
+
+  return table;
+}
+
+template <class Derived>
+bool SmallOrderedHashTable<Derived>::HasKey(Isolate* isolate,
+                                            Handle<Object> key) {
+  DisallowHeapAllocation no_gc;
+  return FindEntry(isolate, *key) != kNotFound;
+}
+
+template <class Derived>
+bool SmallOrderedHashTable<Derived>::Delete(Isolate* isolate, Derived* table,
+                                            Object* key) {
+  DisallowHeapAllocation no_gc;
+  int entry = table->FindEntry(isolate, key);
+  if (entry == kNotFound) return false;
+
+  int nof = table->NumberOfElements();
+  int nod = table->NumberOfDeletedElements();
+
+  Object* hole = ReadOnlyRoots(isolate).the_hole_value();
+  for (int j = 0; j < Derived::kEntrySize; j++) {
+    table->SetDataEntry(entry, j, hole);
+  }
+
+  table->SetNumberOfElements(nof - 1);
+  table->SetNumberOfDeletedElements(nod + 1);
+
+  return true;
+}
+
+template <class Derived>
+Handle<Derived> SmallOrderedHashTable<Derived>::Rehash(Isolate* isolate,
+                                                       Handle<Derived> table,
+                                                       int new_capacity) {
+  DCHECK_GE(kMaxCapacity, new_capacity);
+
+  Handle<Derived> new_table = SmallOrderedHashTable<Derived>::Allocate(
+      isolate, new_capacity, Heap::InNewSpace(*table) ? NOT_TENURED : TENURED);
+  int nof = table->NumberOfElements();
+  int nod = table->NumberOfDeletedElements();
+  int new_entry = 0;
+
+  {
+    DisallowHeapAllocation no_gc;
+    for (int old_entry = 0; old_entry < (nof + nod); ++old_entry) {
+      Object* key = table->KeyAt(old_entry);
+      if (key->IsTheHole(isolate)) continue;
+
+      int hash = Smi::ToInt(key->GetHash());
+      int bucket = new_table->HashToBucket(hash);
+      int chain = new_table->GetFirstEntry(bucket);
+
+      new_table->SetFirstEntry(bucket, new_entry);
+      new_table->SetNextEntry(new_entry, chain);
+
+      for (int i = 0; i < Derived::kEntrySize; ++i) {
+        Object* value = table->GetDataEntry(old_entry, i);
+        new_table->SetDataEntry(new_entry, i, value);
+      }
+
+      ++new_entry;
+    }
+
+    new_table->SetNumberOfElements(nof);
+  }
+  return new_table;
+}
+
+template <class Derived>
+MaybeHandle<Derived> SmallOrderedHashTable<Derived>::Grow(
+    Isolate* isolate, Handle<Derived> table) {
+  int capacity = table->Capacity();
+  int new_capacity = capacity;
+
+  // Don't need to grow if we can simply clear out deleted entries instead.
+  // TODO(gsathya): Compact in place, instead of allocating a new table.
+  if (table->NumberOfDeletedElements() < (capacity >> 1)) {
+    new_capacity = capacity << 1;
+
+    // The max capacity of our table is 254. We special case for 256 to
+    // account for our growth strategy, otherwise we would only fill up
+    // to 128 entries in our table.
+    if (new_capacity == kGrowthHack) {
+      new_capacity = kMaxCapacity;
+    }
+
+    // We need to migrate to a bigger hash table.
+    if (new_capacity > kMaxCapacity) {
+      return MaybeHandle<Derived>();
+    }
+  }
+
+  return Rehash(isolate, table, new_capacity);
+}
+
+template bool SmallOrderedHashTable<SmallOrderedHashSet>::HasKey(
+    Isolate* isolate, Handle<Object> key);
+template Handle<SmallOrderedHashSet>
+SmallOrderedHashTable<SmallOrderedHashSet>::Rehash(
+    Isolate* isolate, Handle<SmallOrderedHashSet> table, int new_capacity);
+template MaybeHandle<SmallOrderedHashSet>
+SmallOrderedHashTable<SmallOrderedHashSet>::Grow(
+    Isolate* isolate, Handle<SmallOrderedHashSet> table);
+template void SmallOrderedHashTable<SmallOrderedHashSet>::Initialize(
+    Isolate* isolate, int capacity);
+
+template bool SmallOrderedHashTable<SmallOrderedHashMap>::HasKey(
+    Isolate* isolate, Handle<Object> key);
+template Handle<SmallOrderedHashMap>
+SmallOrderedHashTable<SmallOrderedHashMap>::Rehash(
+    Isolate* isolate, Handle<SmallOrderedHashMap> table, int new_capacity);
+template MaybeHandle<SmallOrderedHashMap>
+SmallOrderedHashTable<SmallOrderedHashMap>::Grow(
+    Isolate* isolate, Handle<SmallOrderedHashMap> table);
+template void SmallOrderedHashTable<SmallOrderedHashMap>::Initialize(
+    Isolate* isolate, int capacity);
+
+template bool SmallOrderedHashTable<SmallOrderedHashMap>::Delete(
+    Isolate* isolate, SmallOrderedHashMap* table, Object* key);
+template bool SmallOrderedHashTable<SmallOrderedHashSet>::Delete(
+    Isolate* isolate, SmallOrderedHashSet* table, Object* key);
+
+template <class SmallTable, class LargeTable>
+Handle<HeapObject> OrderedHashTableHandler<SmallTable, LargeTable>::Allocate(
+    Isolate* isolate, int capacity) {
+  if (capacity < SmallTable::kMaxCapacity) {
+    return SmallTable::Allocate(isolate, capacity);
+  }
+
+  return LargeTable::Allocate(isolate, capacity);
+}
+
+template Handle<HeapObject>
+OrderedHashTableHandler<SmallOrderedHashSet, OrderedHashSet>::Allocate(
+    Isolate* isolate, int capacity);
+template Handle<HeapObject>
+OrderedHashTableHandler<SmallOrderedHashMap, OrderedHashMap>::Allocate(
+    Isolate* isolate, int capacity);
+
+template <class SmallTable, class LargeTable>
+bool OrderedHashTableHandler<SmallTable, LargeTable>::Delete(
+    Handle<HeapObject> table, Handle<Object> key) {
+  if (SmallTable::Is(table)) {
+    return SmallTable::Delete(Handle<SmallTable>::cast(table), key);
+  }
+
+  DCHECK(LargeTable::Is(table));
+  // Note: Once we migrate to the a big hash table, we never migrate
+  // down to a smaller hash table.
+  return LargeTable::Delete(Handle<LargeTable>::cast(table), key);
+}
+
+template <class SmallTable, class LargeTable>
+bool OrderedHashTableHandler<SmallTable, LargeTable>::HasKey(
+    Isolate* isolate, Handle<HeapObject> table, Handle<Object> key) {
+  if (SmallTable::Is(table)) {
+    return Handle<SmallTable>::cast(table)->HasKey(isolate, key);
+  }
+
+  DCHECK(LargeTable::Is(table));
+  return LargeTable::HasKey(isolate, LargeTable::cast(*table), *key);
+}
+
+template bool
+OrderedHashTableHandler<SmallOrderedHashSet, OrderedHashSet>::HasKey(
+    Isolate* isolate, Handle<HeapObject> table, Handle<Object> key);
+template bool
+OrderedHashTableHandler<SmallOrderedHashMap, OrderedHashMap>::HasKey(
+    Isolate* isolate, Handle<HeapObject> table, Handle<Object> key);
+
+Handle<OrderedHashMap> OrderedHashMapHandler::AdjustRepresentation(
+    Isolate* isolate, Handle<SmallOrderedHashMap> table) {
+  Handle<OrderedHashMap> new_table =
+      OrderedHashMap::Allocate(isolate, OrderedHashTableMinSize);
+  int nof = table->NumberOfElements();
+  int nod = table->NumberOfDeletedElements();
+
+  // TODO(gsathya): Optimize the lookup to not re calc offsets. Also,
+  // unhandlify this code as we preallocate the new backing store with
+  // the proper capacity.
+  for (int entry = 0; entry < (nof + nod); ++entry) {
+    Handle<Object> key = handle(table->KeyAt(entry), isolate);
+    if (key->IsTheHole(isolate)) continue;
+    Handle<Object> value = handle(
+        table->GetDataEntry(entry, SmallOrderedHashMap::kValueIndex), isolate);
+    new_table = OrderedHashMap::Add(isolate, new_table, key, value);
+  }
+
+  return new_table;
+}
+
+Handle<OrderedHashSet> OrderedHashSetHandler::AdjustRepresentation(
+    Isolate* isolate, Handle<SmallOrderedHashSet> table) {
+  Handle<OrderedHashSet> new_table =
+      OrderedHashSet::Allocate(isolate, OrderedHashTableMinSize);
+  int nof = table->NumberOfElements();
+  int nod = table->NumberOfDeletedElements();
+
+  // TODO(gsathya): Optimize the lookup to not re calc offsets. Also,
+  // unhandlify this code as we preallocate the new backing store with
+  // the proper capacity.
+  for (int entry = 0; entry < (nof + nod); ++entry) {
+    Handle<Object> key = handle(table->KeyAt(entry), isolate);
+    if (key->IsTheHole(isolate)) continue;
+    new_table = OrderedHashSet::Add(isolate, new_table, key);
+  }
+
+  return new_table;
+}
+
+Handle<HeapObject> OrderedHashMapHandler::Add(Isolate* isolate,
+                                              Handle<HeapObject> table,
+                                              Handle<Object> key,
+                                              Handle<Object> value) {
+  if (table->IsSmallOrderedHashMap()) {
+    Handle<SmallOrderedHashMap> small_map =
+        Handle<SmallOrderedHashMap>::cast(table);
+    MaybeHandle<SmallOrderedHashMap> new_map =
+        SmallOrderedHashMap::Add(isolate, small_map, key, value);
+    if (!new_map.is_null()) return new_map.ToHandleChecked();
+
+    // We couldn't add to the small table, let's migrate to the
+    // big table.
+    table = OrderedHashMapHandler::AdjustRepresentation(isolate, small_map);
+  }
+
+  DCHECK(table->IsOrderedHashMap());
+  return OrderedHashMap::Add(isolate, Handle<OrderedHashMap>::cast(table), key,
+                             value);
+}
+
+Handle<HeapObject> OrderedHashSetHandler::Add(Isolate* isolate,
+                                              Handle<HeapObject> table,
+                                              Handle<Object> key) {
+  if (table->IsSmallOrderedHashSet()) {
+    Handle<SmallOrderedHashSet> small_set =
+        Handle<SmallOrderedHashSet>::cast(table);
+    MaybeHandle<SmallOrderedHashSet> new_set =
+        SmallOrderedHashSet::Add(isolate, small_set, key);
+    if (!new_set.is_null()) return new_set.ToHandleChecked();
+
+    // We couldn't add to the small table, let's migrate to the
+    // big table.
+    table = OrderedHashSetHandler::AdjustRepresentation(isolate, small_set);
+  }
+
+  DCHECK(table->IsOrderedHashSet());
+  return OrderedHashSet::Add(isolate, Handle<OrderedHashSet>::cast(table), key);
+}
+
+template <class Derived, class TableType>
+void OrderedHashTableIterator<Derived, TableType>::Transition() {
+  DisallowHeapAllocation no_allocation;
+  TableType* table = TableType::cast(this->table());
+  if (!table->IsObsolete()) return;
+
+  int index = Smi::ToInt(this->index());
+  while (table->IsObsolete()) {
+    TableType* next_table = table->NextTable();
+
+    if (index > 0) {
+      int nod = table->NumberOfDeletedElements();
+
+      if (nod == TableType::kClearedTableSentinel) {
+        index = 0;
+      } else {
+        int old_index = index;
+        for (int i = 0; i < nod; ++i) {
+          int removed_index = table->RemovedIndexAt(i);
+          if (removed_index >= old_index) break;
+          --index;
+        }
+      }
+    }
+
+    table = next_table;
+  }
+
+  set_table(table);
+  set_index(Smi::FromInt(index));
+}
+
+template <class Derived, class TableType>
+bool OrderedHashTableIterator<Derived, TableType>::HasMore() {
+  DisallowHeapAllocation no_allocation;
+  ReadOnlyRoots ro_roots = GetReadOnlyRoots();
+
+  Transition();
+
+  TableType* table = TableType::cast(this->table());
+  int index = Smi::ToInt(this->index());
+  int used_capacity = table->UsedCapacity();
+
+  while (index < used_capacity && table->KeyAt(index)->IsTheHole(ro_roots)) {
+    index++;
+  }
+
+  set_index(Smi::FromInt(index));
+
+  if (index < used_capacity) return true;
+
+  set_table(TableType::GetEmpty(ro_roots));
+  return false;
+}
+
+template bool
+OrderedHashTableIterator<JSSetIterator, OrderedHashSet>::HasMore();
+
+template void
+OrderedHashTableIterator<JSSetIterator, OrderedHashSet>::MoveNext();
+
+template Object*
+OrderedHashTableIterator<JSSetIterator, OrderedHashSet>::CurrentKey();
+
+template void
+OrderedHashTableIterator<JSSetIterator, OrderedHashSet>::Transition();
+
+template bool
+OrderedHashTableIterator<JSMapIterator, OrderedHashMap>::HasMore();
+
+template void
+OrderedHashTableIterator<JSMapIterator, OrderedHashMap>::MoveNext();
+
+template Object*
+OrderedHashTableIterator<JSMapIterator, OrderedHashMap>::CurrentKey();
+
+template void
+OrderedHashTableIterator<JSMapIterator, OrderedHashMap>::Transition();
+
+}  // namespace internal
+}  // namespace v8
diff --git a/deps/v8/src/objects/ordered-hash-table.h b/deps/v8/src/objects/ordered-hash-table.h
new file mode 100644
index 00000000000000..20f3fe2eda6216
--- /dev/null
+++ b/deps/v8/src/objects/ordered-hash-table.h
@@ -0,0 +1,676 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef V8_OBJECTS_ORDERED_HASH_TABLE_H_
+#define V8_OBJECTS_ORDERED_HASH_TABLE_H_
+
+#include "src/globals.h"
+#include "src/objects/fixed-array.h"
+
+// Has to be the last include (doesn't have include guards):
+#include "src/objects/object-macros.h"
+
+namespace v8 {
+namespace internal {
+
+// Non-templatized base class for {OrderedHashTable}s.
+// TODO(hash): Unify this with the HashTableBase above.
+class OrderedHashTableBase : public FixedArray {
+ public:
+  static const int kNotFound = -1;
+  static const int kMinCapacity = 4;
+
+  static const int kNumberOfElementsIndex = 0;
+  // The next table is stored at the same index as the nof elements.
+  static const int kNextTableIndex = kNumberOfElementsIndex;
+  static const int kNumberOfDeletedElementsIndex = kNumberOfElementsIndex + 1;
+  static const int kNumberOfBucketsIndex = kNumberOfDeletedElementsIndex + 1;
+  static const int kHashTableStartIndex = kNumberOfBucketsIndex + 1;
+  static const int kRemovedHolesIndex = kHashTableStartIndex;
+
+  static constexpr const int kNumberOfElementsOffset =
+      FixedArray::OffsetOfElementAt(kNumberOfElementsIndex);
+  static constexpr const int kNextTableOffset =
+      FixedArray::OffsetOfElementAt(kNextTableIndex);
+  static constexpr const int kNumberOfDeletedElementsOffset =
+      FixedArray::OffsetOfElementAt(kNumberOfDeletedElementsIndex);
+  static constexpr const int kNumberOfBucketsOffset =
+      FixedArray::OffsetOfElementAt(kNumberOfBucketsIndex);
+  static constexpr const int kHashTableStartOffset =
+      FixedArray::OffsetOfElementAt(kHashTableStartIndex);
+
+  static const int kLoadFactor = 2;
+
+  // NumberOfDeletedElements is set to kClearedTableSentinel when
+  // the table is cleared, which allows iterator transitions to
+  // optimize that case.
+  static const int kClearedTableSentinel = -1;
+};
+
+// OrderedHashTable is a HashTable with Object keys that preserves
+// insertion order. There are Map and Set interfaces (OrderedHashMap
+// and OrderedHashTable, below). It is meant to be used by JSMap/JSSet.
+//
+// Only Object* keys are supported, with Object::SameValueZero() used as the
+// equality operator and Object::GetHash() for the hash function.
+//
+// Based on the "Deterministic Hash Table" as described by Jason Orendorff at
+// https://wiki.mozilla.org/User:Jorend/Deterministic_hash_tables
+// Originally attributed to Tyler Close.
+//
+// Memory layout:
+//   [0]: element count
+//   [1]: deleted element count
+//   [2]: bucket count
+//   [3..(3 + NumberOfBuckets() - 1)]: "hash table", where each item is an
+//                            offset into the data table (see below) where the
+//                            first item in this bucket is stored.
+//   [3 + NumberOfBuckets()..length]: "data table", an array of length
+//                            Capacity() * kEntrySize, where the first entrysize
+//                            items are handled by the derived class and the
+//                            item at kChainOffset is another entry into the
+//                            data table indicating the next entry in this hash
+//                            bucket.
+//
+// When we transition the table to a new version we obsolete it and reuse parts
+// of the memory to store information how to transition an iterator to the new
+// table:
+//
+// Memory layout for obsolete table:
+//   [0]: bucket count
+//   [1]: Next newer table
+//   [2]: Number of removed holes or -1 when the table was cleared.
+//   [3..(3 + NumberOfRemovedHoles() - 1)]: The indexes of the removed holes.
+//   [3 + NumberOfRemovedHoles()..length]: Not used
+//
+template <class Derived, int entrysize>
+class OrderedHashTable : public OrderedHashTableBase {
+ public:
+  // Returns an OrderedHashTable with a capacity of at least |capacity|.
+  static Handle<Derived> Allocate(Isolate* isolate, int capacity,
+                                  PretenureFlag pretenure = NOT_TENURED);
+
+  // Returns an OrderedHashTable (possibly |table|) with enough space
+  // to add at least one new element.
+  static Handle<Derived> EnsureGrowable(Isolate* isolate,
+                                        Handle<Derived> table);
+
+  // Returns an OrderedHashTable (possibly |table|) that's shrunken
+  // if possible.
+  static Handle<Derived> Shrink(Isolate* isolate, Handle<Derived> table);
+
+  // Returns a new empty OrderedHashTable and records the clearing so that
+  // existing iterators can be updated.
+  static Handle<Derived> Clear(Isolate* isolate, Handle<Derived> table);
+
+  // Returns true if the OrderedHashTable contains the key
+  static bool HasKey(Isolate* isolate, Derived* table, Object* key);
+
+  // Returns a true value if the OrderedHashTable contains the key and
+  // the key has been deleted. This does not shrink the table.
+  static bool Delete(Isolate* isolate, Derived* table, Object* key);
+
+  int NumberOfElements() const {
+    return Smi::ToInt(get(kNumberOfElementsIndex));
+  }
+
+  int NumberOfDeletedElements() const {
+    return Smi::ToInt(get(kNumberOfDeletedElementsIndex));
+  }
+
+  // Returns the number of contiguous entries in the data table, starting at 0,
+  // that either are real entries or have been deleted.
+  int UsedCapacity() const {
+    return NumberOfElements() + NumberOfDeletedElements();
+  }
+
+  int NumberOfBuckets() const { return Smi::ToInt(get(kNumberOfBucketsIndex)); }
+
+  // Returns an index into |this| for the given entry.
+  int EntryToIndex(int entry) {
+    return kHashTableStartIndex + NumberOfBuckets() + (entry * kEntrySize);
+  }
+
+  int HashToBucket(int hash) { return hash & (NumberOfBuckets() - 1); }
+
+  int HashToEntry(int hash) {
+    int bucket = HashToBucket(hash);
+    Object* entry = this->get(kHashTableStartIndex + bucket);
+    return Smi::ToInt(entry);
+  }
+
+  int KeyToFirstEntry(Isolate* isolate, Object* key) {
+    // This special cases for Smi, so that we avoid the HandleScope
+    // creation below.
+    if (key->IsSmi()) {
+      uint32_t hash = ComputeIntegerHash(Smi::ToInt(key));
+      return HashToEntry(hash & Smi::kMaxValue);
+    }
+    HandleScope scope(isolate);
+    Object* hash = key->GetHash();
+    // If the object does not have an identity hash, it was never used as a key
+    if (hash->IsUndefined(isolate)) return kNotFound;
+    return HashToEntry(Smi::ToInt(hash));
+  }
+
+  int FindEntry(Isolate* isolate, Object* key) {
+    int entry = KeyToFirstEntry(isolate, key);
+    // Walk the chain in the bucket to find the key.
+    while (entry != kNotFound) {
+      Object* candidate_key = KeyAt(entry);
+      if (candidate_key->SameValueZero(key)) break;
+      entry = NextChainEntry(entry);
+    }
+
+    return entry;
+  }
+
+  int NextChainEntry(int entry) {
+    Object* next_entry = get(EntryToIndex(entry) + kChainOffset);
+    return Smi::ToInt(next_entry);
+  }
+
+  // use KeyAt(i)->IsTheHole(isolate) to determine if this is a deleted entry.
+  Object* KeyAt(int entry) {
+    DCHECK_LT(entry, this->UsedCapacity());
+    return get(EntryToIndex(entry));
+  }
+
+  bool IsObsolete() { return !get(kNextTableIndex)->IsSmi(); }
+
+  // The next newer table. This is only valid if the table is obsolete.
+  Derived* NextTable() { return Derived::cast(get(kNextTableIndex)); }
+
+  // When the table is obsolete we store the indexes of the removed holes.
+  int RemovedIndexAt(int index) {
+    return Smi::ToInt(get(kRemovedHolesIndex + index));
+  }
+
+  static const int kEntrySize = entrysize + 1;
+  static const int kChainOffset = entrysize;
+
+  static const int kMaxCapacity =
+      (FixedArray::kMaxLength - kHashTableStartIndex) /
+      (1 + (kEntrySize * kLoadFactor));
+
+ protected:
+  static Handle<Derived> Rehash(Isolate* isolate, Handle<Derived> table,
+                                int new_capacity);
+
+  void SetNumberOfBuckets(int num) {
+    set(kNumberOfBucketsIndex, Smi::FromInt(num));
+  }
+
+  void SetNumberOfElements(int num) {
+    set(kNumberOfElementsIndex, Smi::FromInt(num));
+  }
+
+  void SetNumberOfDeletedElements(int num) {
+    set(kNumberOfDeletedElementsIndex, Smi::FromInt(num));
+  }
+
+  // Returns the number elements that can fit into the allocated buffer.
+  int Capacity() { return NumberOfBuckets() * kLoadFactor; }
+
+  void SetNextTable(Derived* next_table) { set(kNextTableIndex, next_table); }
+
+  void SetRemovedIndexAt(int index, int removed_index) {
+    return set(kRemovedHolesIndex + index, Smi::FromInt(removed_index));
+  }
+};
+
+class OrderedHashSet : public OrderedHashTable<OrderedHashSet, 1> {
+ public:
+  DECL_CAST(OrderedHashSet)
+
+  static Handle<OrderedHashSet> Add(Isolate* isolate,
+                                    Handle<OrderedHashSet> table,
+                                    Handle<Object> value);
+  static Handle<FixedArray> ConvertToKeysArray(Isolate* isolate,
+                                               Handle<OrderedHashSet> table,
+                                               GetKeysConversion convert);
+  static HeapObject* GetEmpty(ReadOnlyRoots ro_roots);
+  static inline int GetMapRootIndex();
+  static inline bool Is(Handle<HeapObject> table);
+};
+
+class OrderedHashMap : public OrderedHashTable<OrderedHashMap, 2> {
+ public:
+  DECL_CAST(OrderedHashMap)
+
+  // Returns a value if the OrderedHashMap contains the key, otherwise
+  // returns undefined.
+  static Handle<OrderedHashMap> Add(Isolate* isolate,
+                                    Handle<OrderedHashMap> table,
+                                    Handle<Object> key, Handle<Object> value);
+  Object* ValueAt(int entry);
+
+  static Object* GetHash(Isolate* isolate, Object* key);
+
+  static HeapObject* GetEmpty(ReadOnlyRoots ro_roots);
+  static inline int GetMapRootIndex();
+  static inline bool Is(Handle<HeapObject> table);
+
+  static const int kValueOffset = 1;
+};
+
+// This is similar to the OrderedHashTable, except for the memory
+// layout where we use byte instead of Smi. The max capacity of this
+// is only 254, we transition to an OrderedHashTable beyond that
+// limit.
+//
+// Each bucket and chain value is a byte long. The padding exists so
+// that the DataTable entries start aligned. A bucket or chain value
+// of 255 is used to denote an unknown entry.
+//
+// Memory layout: [ Header ]  [ Padding ] [ DataTable ] [ HashTable ] [ Chains ]
+//
+// The index are represented as bytes, on a 64 bit machine with
+// kEntrySize = 1, capacity = 4 and entries = 2:
+//
+// [ Header ]  :
+//    [0] : Number of elements
+//    [1] : Number of deleted elements
+//    [2] : Number of buckets
+//
+// [ Padding ] :
+//    [3 .. 7] : Padding
+//
+// [ DataTable ] :
+//    [8  .. 15] : Entry 1
+//    [16 .. 23] : Entry 2
+//    [24 .. 31] : empty
+//    [32 .. 39] : empty
+//
+// [ HashTable ] :
+//    [40] : First chain-link for bucket 1
+//    [41] : empty
+//
+// [ Chains ] :
+//    [42] : Next chain link for bucket 1
+//    [43] : empty
+//    [44] : empty
+//    [45] : empty
+//
+template <class Derived>
+class SmallOrderedHashTable : public HeapObject {
+ public:
+  // Offset points to a relative location in the table
+  typedef int Offset;
+
+  // ByteIndex points to a index in the table that needs to be
+  // converted to an Offset.
+  typedef int ByteIndex;
+
+  void Initialize(Isolate* isolate, int capacity);
+
+  static Handle<Derived> Allocate(Isolate* isolate, int capacity,
+                                  PretenureFlag pretenure = NOT_TENURED);
+
+  // Returns a true if the OrderedHashTable contains the key
+  bool HasKey(Isolate* isolate, Handle<Object> key);
+
+  // Returns a true value if the table contains the key and
+  // the key has been deleted. This does not shrink the table.
+  static bool Delete(Isolate* isolate, Derived* table, Object* key);
+
+  // Returns an SmallOrderedHashTable (possibly |table|) with enough
+  // space to add at least one new element. Returns empty handle if
+  // we've already reached MaxCapacity.
+  static MaybeHandle<Derived> Grow(Isolate* isolate, Handle<Derived> table);
+
+  static Handle<Derived> Rehash(Isolate* isolate, Handle<Derived> table,
+                                int new_capacity);
+
+  // Iterates only fields in the DataTable.
+  class BodyDescriptor;
+
+  // No weak fields.
+  typedef BodyDescriptor BodyDescriptorWeak;
+
+  // Returns total size in bytes required for a table of given
+  // capacity.
+  static int SizeFor(int capacity) {
+    DCHECK_GE(capacity, kMinCapacity);
+    DCHECK_LE(capacity, kMaxCapacity);
+
+    int data_table_size = DataTableSizeFor(capacity);
+    int hash_table_size = capacity / kLoadFactor;
+    int chain_table_size = capacity;
+    int total_size = kDataTableStartOffset + data_table_size + hash_table_size +
+                     chain_table_size;
+
+    return RoundUp(total_size, kPointerSize);
+  }
+
+  // Returns the number elements that can fit into the allocated table.
+  int Capacity() const {
+    int capacity = NumberOfBuckets() * kLoadFactor;
+    DCHECK_GE(capacity, kMinCapacity);
+    DCHECK_LE(capacity, kMaxCapacity);
+
+    return capacity;
+  }
+
+  // Returns the number elements that are present in the table.
+  int NumberOfElements() const {
+    int nof_elements = getByte(kNumberOfElementsOffset, 0);
+    DCHECK_LE(nof_elements, Capacity());
+
+    return nof_elements;
+  }
+
+  int NumberOfDeletedElements() const {
+    int nof_deleted_elements = getByte(kNumberOfDeletedElementsOffset, 0);
+    DCHECK_LE(nof_deleted_elements, Capacity());
+
+    return nof_deleted_elements;
+  }
+
+  int NumberOfBuckets() const { return getByte(kNumberOfBucketsOffset, 0); }
+
+  DECL_VERIFIER(SmallOrderedHashTable)
+
+  static const int kMinCapacity = 4;
+  static const byte kNotFound = 0xFF;
+
+  // We use the value 255 to indicate kNotFound for chain and bucket
+  // values, which means that this value can't be used a valid
+  // index.
+  static const int kMaxCapacity = 254;
+  STATIC_ASSERT(kMaxCapacity < kNotFound);
+
+  // The load factor is used to derive the number of buckets from
+  // capacity during Allocation. We also depend on this to calaculate
+  // the capacity from number of buckets after allocation. If we
+  // decide to change kLoadFactor to something other than 2, capacity
+  // should be stored as another field of this object.
+  static const int kLoadFactor = 2;
+
+  // Our growth strategy involves doubling the capacity until we reach
+  // kMaxCapacity, but since the kMaxCapacity is always less than 256,
+  // we will never fully utilize this table. We special case for 256,
+  // by changing the new capacity to be kMaxCapacity in
+  // SmallOrderedHashTable::Grow.
+  static const int kGrowthHack = 256;
+
+ protected:
+  void SetDataEntry(int entry, int relative_index, Object* value);
+
+  // TODO(gsathya): Calculate all the various possible values for this
+  // at compile time since capacity can only be 4 different values.
+  Offset GetBucketsStartOffset() const {
+    int capacity = Capacity();
+    int data_table_size = DataTableSizeFor(capacity);
+    return kDataTableStartOffset + data_table_size;
+  }
+
+  Address GetHashTableStartAddress(int capacity) const {
+    return FIELD_ADDR(this, kDataTableStartOffset + DataTableSizeFor(capacity));
+  }
+
+  void SetFirstEntry(int bucket, byte value) {
+    DCHECK_LE(static_cast<unsigned>(bucket), NumberOfBuckets());
+    setByte(GetBucketsStartOffset(), bucket, value);
+  }
+
+  int GetFirstEntry(int bucket) const {
+    DCHECK_LE(static_cast<unsigned>(bucket), NumberOfBuckets());
+    return getByte(GetBucketsStartOffset(), bucket);
+  }
+
+  // TODO(gsathya): Calculate all the various possible values for this
+  // at compile time since capacity can only be 4 different values.
+  Offset GetChainTableOffset() const {
+    int nof_buckets = NumberOfBuckets();
+    int capacity = nof_buckets * kLoadFactor;
+    DCHECK_EQ(Capacity(), capacity);
+
+    int data_table_size = DataTableSizeFor(capacity);
+    int hash_table_size = nof_buckets;
+    return kDataTableStartOffset + data_table_size + hash_table_size;
+  }
+
+  void SetNextEntry(int entry, int next_entry) {
+    DCHECK_LT(static_cast<unsigned>(entry), Capacity());
+    DCHECK_GE(static_cast<unsigned>(next_entry), 0);
+    DCHECK(next_entry <= Capacity() || next_entry == kNotFound);
+    setByte(GetChainTableOffset(), entry, next_entry);
+  }
+
+  int GetNextEntry(int entry) const {
+    DCHECK_LT(entry, Capacity());
+    return getByte(GetChainTableOffset(), entry);
+  }
+
+  Object* GetDataEntry(int entry, int relative_index) {
+    DCHECK_LT(entry, Capacity());
+    DCHECK_LE(static_cast<unsigned>(relative_index), Derived::kEntrySize);
+    Offset entry_offset = GetDataEntryOffset(entry, relative_index);
+    return READ_FIELD(this, entry_offset);
+  }
+
+  Object* KeyAt(int entry) const {
+    DCHECK_LT(entry, Capacity());
+    Offset entry_offset = GetDataEntryOffset(entry, Derived::kKeyIndex);
+    return READ_FIELD(this, entry_offset);
+  }
+
+  int HashToBucket(int hash) const { return hash & (NumberOfBuckets() - 1); }
+
+  int HashToFirstEntry(int hash) const {
+    int bucket = HashToBucket(hash);
+    int entry = GetFirstEntry(bucket);
+    DCHECK(entry < Capacity() || entry == kNotFound);
+    return entry;
+  }
+
+  void SetNumberOfBuckets(int num) { setByte(kNumberOfBucketsOffset, 0, num); }
+
+  void SetNumberOfElements(int num) {
+    DCHECK_LE(static_cast<unsigned>(num), Capacity());
+    setByte(kNumberOfElementsOffset, 0, num);
+  }
+
+  void SetNumberOfDeletedElements(int num) {
+    DCHECK_LE(static_cast<unsigned>(num), Capacity());
+    setByte(kNumberOfDeletedElementsOffset, 0, num);
+  }
+
+  int FindEntry(Isolate* isolate, Object* key) {
+    DisallowHeapAllocation no_gc;
+    Object* hash = key->GetHash();
+
+    if (hash->IsUndefined(isolate)) return kNotFound;
+    int entry = HashToFirstEntry(Smi::ToInt(hash));
+
+    // Walk the chain in the bucket to find the key.
+    while (entry != kNotFound) {
+      Object* candidate_key = KeyAt(entry);
+      if (candidate_key->SameValueZero(key)) return entry;
+      entry = GetNextEntry(entry);
+    }
+    return kNotFound;
+  }
+
+  static const Offset kNumberOfElementsOffset = kHeaderSize;
+  static const Offset kNumberOfDeletedElementsOffset =
+      kNumberOfElementsOffset + kOneByteSize;
+  static const Offset kNumberOfBucketsOffset =
+      kNumberOfDeletedElementsOffset + kOneByteSize;
+  static const constexpr Offset kDataTableStartOffset =
+      RoundUp<kPointerSize>(kNumberOfBucketsOffset);
+
+  static constexpr int DataTableSizeFor(int capacity) {
+    return capacity * Derived::kEntrySize * kPointerSize;
+  }
+
+  // This is used for accessing the non |DataTable| part of the
+  // structure.
+  byte getByte(Offset offset, ByteIndex index) const {
+    DCHECK(offset < kDataTableStartOffset || offset >= GetBucketsStartOffset());
+    return READ_BYTE_FIELD(this, offset + (index * kOneByteSize));
+  }
+
+  void setByte(Offset offset, ByteIndex index, byte value) {
+    DCHECK(offset < kDataTableStartOffset || offset >= GetBucketsStartOffset());
+    WRITE_BYTE_FIELD(this, offset + (index * kOneByteSize), value);
+  }
+
+  Offset GetDataEntryOffset(int entry, int relative_index) const {
+    DCHECK_LT(entry, Capacity());
+    int offset_in_datatable = entry * Derived::kEntrySize * kPointerSize;
+    int offset_in_entry = relative_index * kPointerSize;
+    return kDataTableStartOffset + offset_in_datatable + offset_in_entry;
+  }
+
+  int UsedCapacity() const {
+    int used = NumberOfElements() + NumberOfDeletedElements();
+    DCHECK_LE(used, Capacity());
+
+    return used;
+  }
+
+ private:
+  friend class OrderedHashMapHandler;
+  friend class OrderedHashSetHandler;
+  friend class CodeStubAssembler;
+};
+
+class SmallOrderedHashSet : public SmallOrderedHashTable<SmallOrderedHashSet> {
+ public:
+  DECL_CAST(SmallOrderedHashSet)
+
+  DECL_PRINTER(SmallOrderedHashSet)
+
+  static const int kKeyIndex = 0;
+  static const int kEntrySize = 1;
+
+  // Adds |value| to |table|, if the capacity isn't enough, a new
+  // table is created. The original |table| is returned if there is
+  // capacity to store |value| otherwise the new table is returned.
+  static MaybeHandle<SmallOrderedHashSet> Add(Isolate* isolate,
+                                              Handle<SmallOrderedHashSet> table,
+                                              Handle<Object> key);
+  static inline bool Is(Handle<HeapObject> table);
+  static inline int GetMapRootIndex();
+};
+
+class SmallOrderedHashMap : public SmallOrderedHashTable<SmallOrderedHashMap> {
+ public:
+  DECL_CAST(SmallOrderedHashMap)
+
+  DECL_PRINTER(SmallOrderedHashMap)
+
+  static const int kKeyIndex = 0;
+  static const int kValueIndex = 1;
+  static const int kEntrySize = 2;
+
+  // Adds |value| to |table|, if the capacity isn't enough, a new
+  // table is created. The original |table| is returned if there is
+  // capacity to store |value| otherwise the new table is returned.
+  static MaybeHandle<SmallOrderedHashMap> Add(Isolate* isolate,
+                                              Handle<SmallOrderedHashMap> table,
+                                              Handle<Object> key,
+                                              Handle<Object> value);
+  static inline bool Is(Handle<HeapObject> table);
+  static inline int GetMapRootIndex();
+};
+
+// TODO(gsathya): Rename this to OrderedHashTable, after we rename
+// OrderedHashTable to LargeOrderedHashTable. Also set up a
+// OrderedHashSetBase class as a base class for the two tables and use
+// that instead of a HeapObject here.
+template <class SmallTable, class LargeTable>
+class OrderedHashTableHandler {
+ public:
+  typedef int Entry;
+
+  static Handle<HeapObject> Allocate(Isolate* isolate, int capacity);
+  static bool Delete(Handle<HeapObject> table, Handle<Object> key);
+  static bool HasKey(Isolate* isolate, Handle<HeapObject> table,
+                     Handle<Object> key);
+
+  // TODO(gsathya): Move this to OrderedHashTable
+  static const int OrderedHashTableMinSize =
+      SmallOrderedHashTable<SmallTable>::kGrowthHack << 1;
+};
+
+class OrderedHashMapHandler
+    : public OrderedHashTableHandler<SmallOrderedHashMap, OrderedHashMap> {
+ public:
+  static Handle<HeapObject> Add(Isolate* isolate, Handle<HeapObject> table,
+                                Handle<Object> key, Handle<Object> value);
+  static Handle<OrderedHashMap> AdjustRepresentation(
+      Isolate* isolate, Handle<SmallOrderedHashMap> table);
+};
+
+class OrderedHashSetHandler
+    : public OrderedHashTableHandler<SmallOrderedHashSet, OrderedHashSet> {
+ public:
+  static Handle<HeapObject> Add(Isolate* isolate, Handle<HeapObject> table,
+                                Handle<Object> key);
+  static Handle<OrderedHashSet> AdjustRepresentation(
+      Isolate* isolate, Handle<SmallOrderedHashSet> table);
+};
+
+class JSCollectionIterator : public JSObject {
+ public:
+  // [table]: the backing hash table mapping keys to values.
+  DECL_ACCESSORS(table, Object)
+
+  // [index]: The index into the data table.
+  DECL_ACCESSORS(index, Object)
+
+  // Dispatched behavior.
+  DECL_PRINTER(JSCollectionIterator)
+
+  static const int kTableOffset = JSObject::kHeaderSize;
+  static const int kIndexOffset = kTableOffset + kPointerSize;
+  static const int kSize = kIndexOffset + kPointerSize;
+
+ private:
+  DISALLOW_IMPLICIT_CONSTRUCTORS(JSCollectionIterator);
+};
+
+// OrderedHashTableIterator is an iterator that iterates over the keys and
+// values of an OrderedHashTable.
+//
+// The iterator has a reference to the underlying OrderedHashTable data,
+// [table], as well as the current [index] the iterator is at.
+//
+// When the OrderedHashTable is rehashed it adds a reference from the old table
+// to the new table as well as storing enough data about the changes so that the
+// iterator [index] can be adjusted accordingly.
+//
+// When the [Next] result from the iterator is requested, the iterator checks if
+// there is a newer table that it needs to transition to.
+template <class Derived, class TableType>
+class OrderedHashTableIterator : public JSCollectionIterator {
+ public:
+  // Whether the iterator has more elements. This needs to be called before
+  // calling |CurrentKey| and/or |CurrentValue|.
+  bool HasMore();
+
+  // Move the index forward one.
+  void MoveNext() { set_index(Smi::FromInt(Smi::ToInt(index()) + 1)); }
+
+  // Returns the current key of the iterator. This should only be called when
+  // |HasMore| returns true.
+  inline Object* CurrentKey();
+
+ private:
+  // Transitions the iterator to the non obsolete backing store. This is a NOP
+  // if the [table] is not obsolete.
+  void Transition();
+
+  DISALLOW_IMPLICIT_CONSTRUCTORS(OrderedHashTableIterator);
+};
+
+}  // namespace internal
+}  // namespace v8
+
+#include "src/objects/object-macros-undef.h"
+
+#endif  // V8_OBJECTS_ORDERED_HASH_TABLE_H_
diff --git a/deps/v8/src/objects/promise-inl.h b/deps/v8/src/objects/promise-inl.h
index f9fb6110f346c1..f33bc42681eddb 100644
--- a/deps/v8/src/objects/promise-inl.h
+++ b/deps/v8/src/objects/promise-inl.h
@@ -5,6 +5,7 @@
 #ifndef V8_OBJECTS_PROMISE_INL_H_
 #define V8_OBJECTS_PROMISE_INL_H_
 
+#include "src/objects/js-promise-inl.h"
 #include "src/objects/promise.h"
 
 // Has to be the last include (doesn't have include guards):
diff --git a/deps/v8/src/objects/scope-info.cc b/deps/v8/src/objects/scope-info.cc
index 0b517d7038812b..9ec87dcb92f657 100644
--- a/deps/v8/src/objects/scope-info.cc
+++ b/deps/v8/src/objects/scope-info.cc
@@ -10,7 +10,9 @@
 #include "src/ast/scopes.h"
 #include "src/ast/variables.h"
 #include "src/bootstrapper.h"
+#include "src/heap/heap-inl.h"
 #include "src/objects-inl.h"
+#include "src/objects/module-inl.h"
 
 namespace v8 {
 namespace internal {
@@ -57,23 +59,18 @@ bool ScopeInfo::Equals(ScopeInfo* other) const {
 }
 #endif
 
+// static
 Handle<ScopeInfo> ScopeInfo::Create(Isolate* isolate, Zone* zone, Scope* scope,
                                     MaybeHandle<ScopeInfo> outer_scope) {
   // Collect variables.
-  int stack_local_count = 0;
   int context_local_count = 0;
   int module_vars_count = 0;
   // Stack allocated block scope variables are allocated in the parent
   // declaration scope, but are recorded in the block scope's scope info. First
   // slot index indicates at which offset a particular scope starts in the
   // parent declaration scope.
-  int first_slot_index = 0;
   for (Variable* var : *scope->locals()) {
     switch (var->location()) {
-      case VariableLocation::LOCAL:
-        if (stack_local_count == 0) first_slot_index = var->index();
-        stack_local_count++;
-        break;
       case VariableLocation::CONTEXT:
         context_local_count++;
         break;
@@ -142,8 +139,7 @@ Handle<ScopeInfo> ScopeInfo::Create(Isolate* isolate, Zone* zone, Scope* scope,
   const bool has_receiver = receiver_info == STACK || receiver_info == CONTEXT;
   const int parameter_count = scope->num_parameters();
   const bool has_outer_scope_info = !outer_scope.is_null();
-  const int length = kVariablePartIndex + parameter_count +
-                     (1 + stack_local_count) + 2 * context_local_count +
+  const int length = kVariablePartIndex + 2 * context_local_count +
                      (has_receiver ? 1 : 0) +
                      (has_function_name ? kFunctionNameEntries : 0) +
                      (has_inferred_function_name ? 1 : 0) +
@@ -188,50 +184,29 @@ Handle<ScopeInfo> ScopeInfo::Create(Isolate* isolate, Zone* zone, Scope* scope,
   scope_info->SetFlags(flags);
 
   scope_info->SetParameterCount(parameter_count);
-  scope_info->SetStackLocalCount(stack_local_count);
   scope_info->SetContextLocalCount(context_local_count);
 
   int index = kVariablePartIndex;
-  // Add parameters.
-  DCHECK_EQ(index, scope_info->ParameterNamesIndex());
-  if (scope->is_declaration_scope()) {
-    for (int i = 0; i < parameter_count; ++i) {
-      scope_info->set(index++,
-                      *scope->AsDeclarationScope()->parameter(i)->name());
-    }
-  }
 
-  // Add stack locals' names, context locals' names and info, module variables'
-  // names and info. We are assuming that the stack locals' slots are allocated
-  // in increasing order, so we can simply add them to the ScopeInfo object.
+  // Add context locals' names and info, module variables' names and info.
   // Context locals are added using their index.
-  DCHECK_EQ(index, scope_info->StackLocalFirstSlotIndex());
-  scope_info->set(index++, Smi::FromInt(first_slot_index));
-  DCHECK_EQ(index, scope_info->StackLocalNamesIndex());
-
-  int stack_local_base = index;
-  int context_local_base = stack_local_base + stack_local_count;
+  int context_local_base = index;
   int context_local_info_base = context_local_base + context_local_count;
   int module_var_entry = scope_info->ModuleVariablesIndex();
 
   for (Variable* var : *scope->locals()) {
     switch (var->location()) {
-      case VariableLocation::LOCAL: {
-        int local_index = var->index() - first_slot_index;
-        DCHECK_LE(0, local_index);
-        DCHECK_LT(local_index, stack_local_count);
-        scope_info->set(stack_local_base + local_index, *var->name());
-        break;
-      }
       case VariableLocation::CONTEXT: {
         // Due to duplicate parameters, context locals aren't guaranteed to come
         // in order.
         int local_index = var->index() - Context::MIN_CONTEXT_SLOTS;
         DCHECK_LE(0, local_index);
         DCHECK_LT(local_index, context_local_count);
-        uint32_t info = VariableModeField::encode(var->mode()) |
-                        InitFlagField::encode(var->initialization_flag()) |
-                        MaybeAssignedFlagField::encode(var->maybe_assigned());
+        uint32_t info =
+            VariableModeField::encode(var->mode()) |
+            InitFlagField::encode(var->initialization_flag()) |
+            MaybeAssignedFlagField::encode(var->maybe_assigned()) |
+            ParameterNumberField::encode(ParameterNumberField::kMax);
         scope_info->set(context_local_base + local_index, *var->name());
         scope_info->set(context_local_info_base + local_index,
                         Smi::FromInt(info));
@@ -245,7 +220,8 @@ Handle<ScopeInfo> ScopeInfo::Create(Isolate* isolate, Zone* zone, Scope* scope,
         uint32_t properties =
             VariableModeField::encode(var->mode()) |
             InitFlagField::encode(var->initialization_flag()) |
-            MaybeAssignedFlagField::encode(var->maybe_assigned());
+            MaybeAssignedFlagField::encode(var->maybe_assigned()) |
+            ParameterNumberField::encode(ParameterNumberField::kMax);
         scope_info->set(module_var_entry + kModuleVariablePropertiesOffset,
                         Smi::FromInt(properties));
         module_var_entry += kModuleVariableEntryLength;
@@ -256,7 +232,26 @@ Handle<ScopeInfo> ScopeInfo::Create(Isolate* isolate, Zone* zone, Scope* scope,
     }
   }
 
-  index += stack_local_count + 2 * context_local_count;
+  if (scope->is_declaration_scope()) {
+    // Mark contexts slots with the parameter number they represent. We walk the
+    // list of parameters. That can include duplicate entries if a parameter
+    // name is repeated. By walking upwards, we'll automatically mark the
+    // context slot with the highest parameter number that uses this variable.
+    // That will be the parameter number that is represented by the context
+    // slot. All lower parameters will only be available on the stack through
+    // the arguments object.
+    for (int i = 0; i < parameter_count; i++) {
+      Variable* parameter = scope->AsDeclarationScope()->parameter(i);
+      if (parameter->location() != VariableLocation::CONTEXT) continue;
+      int index = parameter->index() - Context::MIN_CONTEXT_SLOTS;
+      int info_index = context_local_info_base + index;
+      int info = Smi::ToInt(scope_info->get(info_index));
+      info = ParameterNumberField::update(info, i);
+      scope_info->set(info_index, Smi::FromInt(info));
+    }
+  }
+
+  index += 2 * context_local_count;
 
   // If the receiver is allocated, add its index.
   DCHECK_EQ(index, scope_info->ReceiverInfoIndex());
@@ -321,10 +316,11 @@ Handle<ScopeInfo> ScopeInfo::Create(Isolate* isolate, Zone* zone, Scope* scope,
   return scope_info;
 }
 
+// static
 Handle<ScopeInfo> ScopeInfo::CreateForWithScope(
     Isolate* isolate, MaybeHandle<ScopeInfo> outer_scope) {
   const bool has_outer_scope_info = !outer_scope.is_null();
-  const int length = kVariablePartIndex + 1 + (has_outer_scope_info ? 1 : 0);
+  const int length = kVariablePartIndex + (has_outer_scope_info ? 1 : 0);
 
   Factory* factory = isolate->factory();
   Handle<ScopeInfo> scope_info = factory->NewScopeInfo(length);
@@ -343,14 +339,9 @@ Handle<ScopeInfo> ScopeInfo::CreateForWithScope(
   scope_info->SetFlags(flags);
 
   scope_info->SetParameterCount(0);
-  scope_info->SetStackLocalCount(0);
   scope_info->SetContextLocalCount(0);
 
   int index = kVariablePartIndex;
-  DCHECK_EQ(index, scope_info->ParameterNamesIndex());
-  DCHECK_EQ(index, scope_info->StackLocalFirstSlotIndex());
-  scope_info->set(index++, Smi::kZero);
-  DCHECK_EQ(index, scope_info->StackLocalNamesIndex());
   DCHECK_EQ(index, scope_info->ReceiverInfoIndex());
   DCHECK_EQ(index, scope_info->FunctionNameInfoIndex());
   DCHECK_EQ(index, scope_info->InferredFunctionNameIndex());
@@ -365,77 +356,105 @@ Handle<ScopeInfo> ScopeInfo::CreateForWithScope(
   return scope_info;
 }
 
+// static
 Handle<ScopeInfo> ScopeInfo::CreateGlobalThisBinding(Isolate* isolate) {
+  return CreateForBootstrapping(isolate, SCRIPT_SCOPE);
+}
+
+// static
+Handle<ScopeInfo> ScopeInfo::CreateForEmptyFunction(Isolate* isolate) {
+  return CreateForBootstrapping(isolate, FUNCTION_SCOPE);
+}
+
+// static
+Handle<ScopeInfo> ScopeInfo::CreateForBootstrapping(Isolate* isolate,
+                                                    ScopeType type) {
   DCHECK(isolate->bootstrapper()->IsActive());
+  DCHECK(type == SCRIPT_SCOPE || type == FUNCTION_SCOPE);
 
-  const int stack_local_count = 0;
-  const int context_local_count = 1;
-  const VariableAllocationInfo receiver_info = CONTEXT;
-  const VariableAllocationInfo function_name_info = NONE;
-  const bool has_receiver = true;
-  const bool has_position_info = true;
   const int parameter_count = 0;
-  const int length = kVariablePartIndex + parameter_count +
-                     (1 + stack_local_count) + 2 * context_local_count +
+  const bool is_empty_function = type == FUNCTION_SCOPE;
+  const int context_local_count = is_empty_function ? 0 : 1;
+  const bool has_receiver = !is_empty_function;
+  const bool has_inferred_function_name = is_empty_function;
+  const bool has_position_info = true;
+  const int length = kVariablePartIndex + 2 * context_local_count +
                      (has_receiver ? 1 : 0) +
+                     (is_empty_function ? kFunctionNameEntries : 0) +
+                     (has_inferred_function_name ? 1 : 0) +
                      (has_position_info ? kPositionInfoEntries : 0);
 
   Factory* factory = isolate->factory();
   Handle<ScopeInfo> scope_info = factory->NewScopeInfo(length);
 
   // Encode the flags.
-  int flags = ScopeTypeField::encode(SCRIPT_SCOPE) |
-              CallsSloppyEvalField::encode(false) |
-              LanguageModeField::encode(LanguageMode::kSloppy) |
-              DeclarationScopeField::encode(true) |
-              ReceiverVariableField::encode(receiver_info) |
-              FunctionVariableField::encode(function_name_info) |
-              AsmModuleField::encode(false) |
-              HasSimpleParametersField::encode(true) |
-              FunctionKindField::encode(FunctionKind::kNormalFunction) |
-              HasOuterScopeInfoField::encode(false) |
-              IsDebugEvaluateScopeField::encode(false);
+  int flags =
+      ScopeTypeField::encode(type) | CallsSloppyEvalField::encode(false) |
+      LanguageModeField::encode(LanguageMode::kSloppy) |
+      DeclarationScopeField::encode(true) |
+      ReceiverVariableField::encode(is_empty_function ? UNUSED : CONTEXT) |
+      HasNewTargetField::encode(false) |
+      FunctionVariableField::encode(is_empty_function ? UNUSED : NONE) |
+      HasInferredFunctionNameField::encode(has_inferred_function_name) |
+      AsmModuleField::encode(false) | HasSimpleParametersField::encode(true) |
+      FunctionKindField::encode(FunctionKind::kNormalFunction) |
+      HasOuterScopeInfoField::encode(false) |
+      IsDebugEvaluateScopeField::encode(false);
   scope_info->SetFlags(flags);
   scope_info->SetParameterCount(parameter_count);
-  scope_info->SetStackLocalCount(stack_local_count);
   scope_info->SetContextLocalCount(context_local_count);
 
   int index = kVariablePartIndex;
-  const int first_slot_index = 0;
-  DCHECK_EQ(index, scope_info->StackLocalFirstSlotIndex());
-  scope_info->set(index++, Smi::FromInt(first_slot_index));
-  DCHECK_EQ(index, scope_info->StackLocalNamesIndex());
 
   // Here we add info for context-allocated "this".
   DCHECK_EQ(index, scope_info->ContextLocalNamesIndex());
-  scope_info->set(index++, isolate->heap()->this_string());
+  if (context_local_count) {
+    scope_info->set(index++, ReadOnlyRoots(isolate).this_string());
+  }
   DCHECK_EQ(index, scope_info->ContextLocalInfosIndex());
-  const uint32_t value = VariableModeField::encode(CONST) |
-                         InitFlagField::encode(kCreatedInitialized) |
-                         MaybeAssignedFlagField::encode(kNotAssigned);
-  scope_info->set(index++, Smi::FromInt(value));
+  if (context_local_count) {
+    const uint32_t value =
+        VariableModeField::encode(VariableMode::kConst) |
+        InitFlagField::encode(kCreatedInitialized) |
+        MaybeAssignedFlagField::encode(kNotAssigned) |
+        ParameterNumberField::encode(ParameterNumberField::kMax);
+    scope_info->set(index++, Smi::FromInt(value));
+  }
 
   // And here we record that this scopeinfo binds a receiver.
   DCHECK_EQ(index, scope_info->ReceiverInfoIndex());
   const int receiver_index = Context::MIN_CONTEXT_SLOTS + 0;
-  scope_info->set(index++, Smi::FromInt(receiver_index));
+  if (!is_empty_function) {
+    scope_info->set(index++, Smi::FromInt(receiver_index));
+  }
 
   DCHECK_EQ(index, scope_info->FunctionNameInfoIndex());
+  if (is_empty_function) {
+    scope_info->set(index++, *isolate->factory()->empty_string());
+    scope_info->set(index++, Smi::kZero);
+  }
   DCHECK_EQ(index, scope_info->InferredFunctionNameIndex());
+  if (has_inferred_function_name) {
+    scope_info->set(index++, *isolate->factory()->empty_string());
+  }
   DCHECK_EQ(index, scope_info->PositionInfoIndex());
   // Store dummy position to be in sync with the {scope_type}.
   scope_info->set(index++, Smi::kZero);
   scope_info->set(index++, Smi::kZero);
   DCHECK_EQ(index, scope_info->OuterScopeInfoIndex());
   DCHECK_EQ(index, scope_info->length());
-  DCHECK_EQ(scope_info->ParameterCount(), 0);
-  DCHECK_EQ(scope_info->ContextLength(), Context::MIN_CONTEXT_SLOTS + 1);
+  DCHECK_EQ(scope_info->ParameterCount(), parameter_count);
+  if (type == FUNCTION_SCOPE) {
+    DCHECK_EQ(scope_info->ContextLength(), 0);
+  } else {
+    DCHECK_EQ(scope_info->ContextLength(), Context::MIN_CONTEXT_SLOTS + 1);
+  }
 
   return scope_info;
 }
 
 ScopeInfo* ScopeInfo::Empty(Isolate* isolate) {
-  return isolate->heap()->empty_scope_info();
+  return ReadOnlyRoots(isolate).empty_scope_info();
 }
 
 ScopeType ScopeInfo::scope_type() const {
@@ -460,19 +479,6 @@ bool ScopeInfo::is_declaration_scope() const {
   return DeclarationScopeField::decode(Flags());
 }
 
-int ScopeInfo::LocalCount() const {
-  return StackLocalCount() + ContextLocalCount();
-}
-
-int ScopeInfo::StackSlotCount() const {
-  if (length() > 0) {
-    bool function_name_stack_slot =
-        FunctionVariableField::decode(Flags()) == STACK;
-    return StackLocalCount() + (function_name_stack_slot ? 1 : 0);
-  }
-  return 0;
-}
-
 int ScopeInfo::ContextLength() const {
   if (length() > 0) {
     int context_locals = ContextLocalCount();
@@ -576,14 +582,26 @@ Object* ScopeInfo::InferredFunctionName() const {
   return get(InferredFunctionNameIndex());
 }
 
+String* ScopeInfo::FunctionDebugName() const {
+  Object* name = FunctionName();
+  if (name->IsString() && String::cast(name)->length() > 0) {
+    return String::cast(name);
+  }
+  if (HasInferredFunctionName()) {
+    name = InferredFunctionName();
+    if (name->IsString()) return String::cast(name);
+  }
+  return GetReadOnlyRoots().empty_string();
+}
+
 int ScopeInfo::StartPosition() const {
   DCHECK(HasPositionInfo());
-  return Smi::cast(get(PositionInfoIndex()))->value();
+  return Smi::ToInt(get(PositionInfoIndex()));
 }
 
 int ScopeInfo::EndPosition() const {
   DCHECK(HasPositionInfo());
-  return Smi::cast(get(PositionInfoIndex() + 1))->value();
+  return Smi::ToInt(get(PositionInfoIndex() + 1));
 }
 
 void ScopeInfo::SetPositionInfo(int start, int end) {
@@ -603,36 +621,6 @@ ModuleInfo* ScopeInfo::ModuleDescriptorInfo() const {
   return ModuleInfo::cast(get(ModuleInfoIndex()));
 }
 
-String* ScopeInfo::ParameterName(int var) const {
-  DCHECK_LE(0, var);
-  DCHECK_LT(var, ParameterCount());
-  int info_index = ParameterNamesIndex() + var;
-  return String::cast(get(info_index));
-}
-
-String* ScopeInfo::LocalName(int var) const {
-  DCHECK_LE(0, var);
-  DCHECK_LT(var, LocalCount());
-  DCHECK(StackLocalNamesIndex() + StackLocalCount() ==
-         ContextLocalNamesIndex());
-  int info_index = StackLocalNamesIndex() + var;
-  return String::cast(get(info_index));
-}
-
-String* ScopeInfo::StackLocalName(int var) const {
-  DCHECK_LE(0, var);
-  DCHECK_LT(var, StackLocalCount());
-  int info_index = StackLocalNamesIndex() + var;
-  return String::cast(get(info_index));
-}
-
-int ScopeInfo::StackLocalIndex(int var) const {
-  DCHECK_LE(0, var);
-  DCHECK_LT(var, StackLocalCount());
-  int first_slot_index = Smi::ToInt(get(StackLocalFirstSlotIndex()));
-  return first_slot_index + var;
-}
-
 String* ScopeInfo::ContextLocalName(int var) const {
   DCHECK_LE(0, var);
   DCHECK_LT(var, ContextLocalCount());
@@ -656,6 +644,21 @@ InitializationFlag ScopeInfo::ContextLocalInitFlag(int var) const {
   return InitFlagField::decode(value);
 }
 
+bool ScopeInfo::ContextLocalIsParameter(int var) const {
+  DCHECK_LE(0, var);
+  DCHECK_LT(var, ContextLocalCount());
+  int info_index = ContextLocalInfosIndex() + var;
+  int value = Smi::ToInt(get(info_index));
+  return ParameterNumberField::decode(value) != ParameterNumberField::kMax;
+}
+
+uint32_t ScopeInfo::ContextLocalParameterNumber(int var) const {
+  DCHECK(ContextLocalIsParameter(var));
+  int info_index = ContextLocalInfosIndex() + var;
+  int value = Smi::ToInt(get(info_index));
+  return ParameterNumberField::decode(value);
+}
+
 MaybeAssignedFlag ScopeInfo::ContextLocalMaybeAssignedFlag(int var) const {
   DCHECK_LE(0, var);
   DCHECK_LT(var, ContextLocalCount());
@@ -671,26 +674,13 @@ bool ScopeInfo::VariableIsSynthetic(String* name) {
   // with user declarations, the current temporaries like .generator_object and
   // .result start with a dot, so we can use that as a flag. It's a hack!
   return name->length() == 0 || name->Get(0) == '.' ||
-         name->Equals(name->GetHeap()->this_string());
-}
-
-int ScopeInfo::StackSlotIndex(String* name) const {
-  DCHECK(name->IsInternalizedString());
-  if (length() == 0) return -1;
-  int first_slot_index = Smi::ToInt(get(StackLocalFirstSlotIndex()));
-  int start = StackLocalNamesIndex();
-  int end = start + StackLocalCount();
-  for (int i = start; i < end; ++i) {
-    if (name == get(i)) {
-      return i - start + first_slot_index;
-    }
-  }
-  return -1;
+         name->Equals(name->GetReadOnlyRoots().this_string());
 }
 
 int ScopeInfo::ModuleIndex(Handle<String> name, VariableMode* mode,
                            InitializationFlag* init_flag,
                            MaybeAssignedFlag* maybe_assigned_flag) {
+  DCHECK(name->IsInternalizedString());
   DCHECK_EQ(scope_type(), MODULE_SCOPE);
   DCHECK_NOT_NULL(mode);
   DCHECK_NOT_NULL(init_flag);
@@ -723,8 +713,19 @@ int ScopeInfo::ContextSlotIndex(Handle<ScopeInfo> scope_info,
 
   if (scope_info->length() == 0) return -1;
 
-  ContextSlotCache* context_slot_cache =
-      scope_info->GetIsolate()->context_slot_cache();
+  // Get the Isolate via the heap.
+  //
+  // Ideally we'd pass Isolate* through to this function, however this is mostly
+  // called from the parser, which is otherwise isolate independent. We can't
+  // assume that all scope infos are never RO space (like we can with JSReceiver
+  // or Context), but we can assume that *non-empty* scope infos are.
+  //
+  // So, we take the least-ugly approach of manually getting the isolate to be
+  // able to remove GetIsolate from ScopeInfo in the general case, while
+  // allowing it in this one particular case.
+  Isolate* isolate = Heap::FromWritableHeapObject(*scope_info)->isolate();
+
+  ContextSlotCache* context_slot_cache = isolate->context_slot_cache();
   int result = context_slot_cache->Lookup(*scope_info, *name, mode, init_flag,
                                           maybe_assigned_flag);
   if (result != ContextSlotCache::kNotFound) {
@@ -749,30 +750,12 @@ int ScopeInfo::ContextSlotIndex(Handle<ScopeInfo> scope_info,
     }
   }
   // Cache as not found. Mode, init flag and maybe assigned flag don't matter.
-  context_slot_cache->Update(scope_info, name, TEMPORARY, kNeedsInitialization,
-                             kNotAssigned, -1);
+  context_slot_cache->Update(scope_info, name, VariableMode::kTemporary,
+                             kNeedsInitialization, kNotAssigned, -1);
 
   return -1;
 }
 
-int ScopeInfo::ParameterIndex(String* name) const {
-  DCHECK(name->IsInternalizedString());
-  if (length() == 0) return -1;
-  // We must read parameters from the end since for
-  // multiply declared parameters the value of the
-  // last declaration of that parameter is used
-  // inside a function (and thus we need to look
-  // at the last index). Was bug# 1110337.
-  int start = ParameterNamesIndex();
-  int end = start + ParameterCount();
-  for (int i = end - 1; i >= start; --i) {
-    if (name == get(i)) {
-      return i - start;
-    }
-  }
-  return -1;
-}
-
 int ScopeInfo::ReceiverContextSlotIndex() const {
   if (length() > 0 && ReceiverVariableField::decode(Flags()) == CONTEXT) {
     return Smi::ToInt(get(ReceiverInfoIndex()));
@@ -795,23 +778,11 @@ FunctionKind ScopeInfo::function_kind() const {
   return FunctionKindField::decode(Flags());
 }
 
-int ScopeInfo::ParameterNamesIndex() const {
+int ScopeInfo::ContextLocalNamesIndex() const {
   DCHECK_LT(0, length());
   return kVariablePartIndex;
 }
 
-int ScopeInfo::StackLocalFirstSlotIndex() const {
-  return ParameterNamesIndex() + ParameterCount();
-}
-
-int ScopeInfo::StackLocalNamesIndex() const {
-  return StackLocalFirstSlotIndex() + 1;
-}
-
-int ScopeInfo::ContextLocalNamesIndex() const {
-  return StackLocalNamesIndex() + StackLocalCount();
-}
-
 int ScopeInfo::ContextLocalInfosIndex() const {
   return ContextLocalNamesIndex() + ContextLocalCount();
 }
@@ -877,6 +848,22 @@ void ScopeInfo::ModuleVariable(int i, String** name, int* index,
   }
 }
 
+std::ostream& operator<<(std::ostream& os,
+                         ScopeInfo::VariableAllocationInfo var_info) {
+  switch (var_info) {
+    case ScopeInfo::VariableAllocationInfo::NONE:
+      return os << "NONE";
+    case ScopeInfo::VariableAllocationInfo::STACK:
+      return os << "STACK";
+    case ScopeInfo::VariableAllocationInfo::CONTEXT:
+      return os << "CONTEXT";
+    case ScopeInfo::VariableAllocationInfo::UNUSED:
+      return os << "UNUSED";
+  }
+  UNREACHABLE();
+  return os;
+}
+
 Handle<ModuleInfoEntry> ModuleInfoEntry::New(Isolate* isolate,
                                              Handle<Object> export_name,
                                              Handle<Object> local_name,
@@ -967,9 +954,8 @@ String* ModuleInfo::RegularExportLocalName(int i) const {
 }
 
 int ModuleInfo::RegularExportCellIndex(int i) const {
-  return Smi::cast(regular_exports()->get(i * kRegularExportLength +
-                                          kRegularExportCellIndexOffset))
-      ->value();
+  return Smi::ToInt(regular_exports()->get(i * kRegularExportLength +
+                                           kRegularExportCellIndexOffset));
 }
 
 FixedArray* ModuleInfo::RegularExportExportNames(int i) const {
diff --git a/deps/v8/src/objects/scope-info.h b/deps/v8/src/objects/scope-info.h
index c8efa475c1159f..ac0664f7fb5618 100644
--- a/deps/v8/src/objects/scope-info.h
+++ b/deps/v8/src/objects/scope-info.h
@@ -49,16 +49,6 @@ class ScopeInfo : public FixedArray {
   // Does this scope make a sloppy eval call?
   bool CallsSloppyEval() const;
 
-  // Return the total number of locals allocated on the stack and in the
-  // context. This includes the parameters that are allocated in the context.
-  int LocalCount() const;
-
-  // Return the number of stack slots for code. This number consists of two
-  // parts:
-  //  1. One stack slot per stack allocated local.
-  //  2. One stack slot for the function name if it is stack allocated.
-  int StackSlotCount() const;
-
   // Return the number of context slots for code if a context is allocated. This
   // number consists of three parts:
   //  1. Size of fixed header for every context: Context::MIN_CONTEXT_SLOTS
@@ -103,6 +93,10 @@ class ScopeInfo : public FixedArray {
   // Return the function_name if present.
   Object* FunctionName() const;
 
+  // The function's name if it is non-empty, otherwise the inferred name or an
+  // empty string.
+  String* FunctionDebugName() const;
+
   // Return the function's inferred name if present.
   // See SharedFunctionInfo::function_identifier.
   Object* InferredFunctionName() const;
@@ -114,18 +108,6 @@ class ScopeInfo : public FixedArray {
 
   ModuleInfo* ModuleDescriptorInfo() const;
 
-  // Return the name of the given parameter.
-  String* ParameterName(int var) const;
-
-  // Return the name of the given local.
-  String* LocalName(int var) const;
-
-  // Return the name of the given stack local.
-  String* StackLocalName(int var) const;
-
-  // Return the name of the given stack local.
-  int StackLocalIndex(int var) const;
-
   // Return the name of the given context local.
   String* ContextLocalName(int var) const;
 
@@ -135,6 +117,9 @@ class ScopeInfo : public FixedArray {
   // Return the initialization flag of the given context local.
   InitializationFlag ContextLocalInitFlag(int var) const;
 
+  bool ContextLocalIsParameter(int var) const;
+  uint32_t ContextLocalParameterNumber(int var) const;
+
   // Return the initialization flag of the given context local.
   MaybeAssignedFlag ContextLocalMaybeAssignedFlag(int var) const;
 
@@ -142,12 +127,6 @@ class ScopeInfo : public FixedArray {
   // exposed to the user in a debugger.
   static bool VariableIsSynthetic(String* name);
 
-  // Lookup support for serialized scope info. Returns the
-  // the stack slot index for a given slot name if the slot is
-  // present; otherwise returns a value < 0. The name must be an internalized
-  // string.
-  int StackSlotIndex(String* name) const;
-
   // Lookup support for serialized scope info. Returns the local context slot
   // index for a given slot name if the slot is present; otherwise
   // returns a value < 0. The name must be an internalized string.
@@ -164,11 +143,6 @@ class ScopeInfo : public FixedArray {
                   InitializationFlag* init_flag,
                   MaybeAssignedFlag* maybe_assigned_flag);
 
-  // Lookup support for serialized scope info. Returns the
-  // parameter index for a given parameter name if the parameter is present;
-  // otherwise returns a value < 0. The name must be an internalized string.
-  int ParameterIndex(String* name) const;
-
   // Lookup support for serialized scope info. Returns the function context
   // slot index if the function name is present and context-allocated (named
   // function expressions, only), otherwise returns a value < 0. The name
@@ -203,6 +177,7 @@ class ScopeInfo : public FixedArray {
                                   MaybeHandle<ScopeInfo> outer_scope);
   static Handle<ScopeInfo> CreateForWithScope(
       Isolate* isolate, MaybeHandle<ScopeInfo> outer_scope);
+  static Handle<ScopeInfo> CreateForEmptyFunction(Isolate* isolate);
   static Handle<ScopeInfo> CreateGlobalThisBinding(Isolate* isolate);
 
   // Serializes empty scope info.
@@ -212,13 +187,11 @@ class ScopeInfo : public FixedArray {
 // numeric and occupies one array slot.
 // 1. A set of properties of the scope.
 // 2. The number of parameters. For non-function scopes this is 0.
-// 3. The number of non-parameter variables allocated on the stack.
-// 4. The number of non-parameter and parameter variables allocated in the
+// 3. The number of non-parameter and parameter variables allocated in the
 //    context.
 #define FOR_EACH_SCOPE_INFO_NUMERIC_FIELD(V) \
   V(Flags)                                   \
   V(ParameterCount)                          \
-  V(StackLocalCount)                         \
   V(ContextLocalCount)
 
 #define FIELD_ACCESSORS(name)       \
@@ -236,53 +209,36 @@ class ScopeInfo : public FixedArray {
 
  private:
   // The layout of the variable part of a ScopeInfo is as follows:
-  // 1. ParameterNames:
-  //    This part stores the names of the parameters for function scopes. One
-  //    slot is used per parameter, so in total this part occupies
-  //    ParameterCount() slots in the array. For other scopes than function
-  //    scopes ParameterCount() is 0.
-  // 2. StackLocalFirstSlot:
-  //    Index of a first stack slot for stack local. Stack locals belonging to
-  //    this scope are located on a stack at slots starting from this index.
-  // 3. StackLocalNames:
-  //    Contains the names of local variables that are allocated on the stack,
-  //    in increasing order of the stack slot index. First local variable has a
-  //    stack slot index defined in StackLocalFirstSlot (point 2 above).
-  //    One slot is used per stack local, so in total this part occupies
-  //    StackLocalCount() slots in the array.
-  // 4. ContextLocalNames:
+  // 1. ContextLocalNames:
   //    Contains the names of local variables and parameters that are allocated
   //    in the context. They are stored in increasing order of the context slot
   //    index starting with Context::MIN_CONTEXT_SLOTS. One slot is used per
   //    context local, so in total this part occupies ContextLocalCount() slots
   //    in the array.
-  // 5. ContextLocalInfos:
+  // 2. ContextLocalInfos:
   //    Contains the variable modes and initialization flags corresponding to
   //    the context locals in ContextLocalNames. One slot is used per
   //    context local, so in total this part occupies ContextLocalCount()
   //    slots in the array.
-  // 6. ReceiverInfo:
+  // 3. ReceiverInfo:
   //    If the scope binds a "this" value, one slot is reserved to hold the
   //    context or stack slot index for the variable.
-  // 7. FunctionNameInfo:
+  // 4. FunctionNameInfo:
   //    If the scope belongs to a named function expression this part contains
   //    information about the function variable. It always occupies two array
   //    slots:  a. The name of the function variable.
   //            b. The context or stack slot index for the variable.
-  // 8. InferredFunctionName:
+  // 5. InferredFunctionName:
   //    Contains the function's inferred name.
-  // 9. SourcePosition:
+  // 6. SourcePosition:
   //    Contains two slots with a) the startPosition and b) the endPosition if
   //    the scope belongs to a function or script.
-  // 10. OuterScopeInfoIndex:
+  // 7. OuterScopeInfoIndex:
   //    The outer scope's ScopeInfo or the hole if there's none.
-  // 11. ModuleInfo, ModuleVariableCount, and ModuleVariables:
+  // 8. ModuleInfo, ModuleVariableCount, and ModuleVariables:
   //    For a module scope, this part contains the ModuleInfo, the number of
   //    MODULE-allocated variables, and the metadata of those variables.  For
   //    non-module scopes it is empty.
-  int ParameterNamesIndex() const;
-  int StackLocalFirstSlotIndex() const;
-  int StackLocalNamesIndex() const;
   int ContextLocalNamesIndex() const;
   int ContextLocalInfosIndex() const;
   int ReceiverInfoIndex() const;
@@ -295,6 +251,8 @@ class ScopeInfo : public FixedArray {
   int ModuleVariablesIndex() const;
 
   static bool NeedsPositionInfo(ScopeType type);
+  static Handle<ScopeInfo> CreateForBootstrapping(Isolate* isolate,
+                                                  ScopeType type);
 
   int Lookup(Handle<String> name, int start, int end, VariableMode* mode,
              VariableLocation* location, InitializationFlag* init_flag,
@@ -352,10 +310,17 @@ class ScopeInfo : public FixedArray {
   class VariableModeField : public BitField<VariableMode, 0, 3> {};
   class InitFlagField : public BitField<InitializationFlag, 3, 1> {};
   class MaybeAssignedFlagField : public BitField<MaybeAssignedFlag, 4, 1> {};
+  class ParameterNumberField
+      : public BitField<uint32_t, MaybeAssignedFlagField::kNext, 16> {};
 
   friend class ScopeIterator;
+  friend std::ostream& operator<<(std::ostream& os,
+                                  ScopeInfo::VariableAllocationInfo var);
 };
 
+std::ostream& operator<<(std::ostream& os,
+                         ScopeInfo::VariableAllocationInfo var);
+
 }  // namespace internal
 }  // namespace v8
 
diff --git a/deps/v8/src/objects/script-inl.h b/deps/v8/src/objects/script-inl.h
index c8779cf9ee3014..eaea8f78e8462e 100644
--- a/deps/v8/src/objects/script-inl.h
+++ b/deps/v8/src/objects/script-inl.h
@@ -7,6 +7,7 @@
 
 #include "src/objects/script.h"
 
+#include "src/objects/shared-function-info.h"
 #include "src/objects/string-inl.h"
 
 // Has to be the last include (doesn't have include guards):
@@ -23,7 +24,6 @@ SMI_ACCESSORS(Script, id, kIdOffset)
 SMI_ACCESSORS(Script, line_offset, kLineOffsetOffset)
 SMI_ACCESSORS(Script, column_offset, kColumnOffsetOffset)
 ACCESSORS(Script, context_data, Object, kContextOffset)
-ACCESSORS(Script, wrapper, HeapObject, kWrapperOffset)
 SMI_ACCESSORS(Script, type, kTypeOffset)
 ACCESSORS(Script, line_ends, Object, kLineEndsOffset)
 ACCESSORS_CHECKED(Script, eval_from_shared_or_wrapped_arguments, Object,
@@ -37,7 +37,7 @@ SMI_ACCESSORS(Script, flags, kFlagsOffset)
 ACCESSORS(Script, source_url, Object, kSourceUrlOffset)
 ACCESSORS(Script, source_mapping_url, Object, kSourceMappingUrlOffset)
 ACCESSORS(Script, host_defined_options, FixedArray, kHostDefinedOptionsOffset)
-ACCESSORS_CHECKED(Script, wasm_compiled_module, Object,
+ACCESSORS_CHECKED(Script, wasm_module_object, Object,
                   kEvalFromSharedOrWrappedArgumentsOffset,
                   this->type() == TYPE_WASM)
 
diff --git a/deps/v8/src/objects/script.h b/deps/v8/src/objects/script.h
index 2e0f16d26dfd0e..5537ecbf1f002d 100644
--- a/deps/v8/src/objects/script.h
+++ b/deps/v8/src/objects/script.h
@@ -54,9 +54,6 @@ class Script : public Struct {
   // [context_data]: context data for the context this script was compiled in.
   DECL_ACCESSORS(context_data, Object)
 
-  // [wrapper]: the wrapper cache.  This is either undefined or a WeakCell.
-  DECL_ACCESSORS(wrapper, HeapObject)
-
   // [type]: the script type.
   DECL_INT_ACCESSORS(type)
 
@@ -97,9 +94,9 @@ class Script : public Struct {
   // [source_mapping_url]: sourceMappingURL magic comment
   DECL_ACCESSORS(source_mapping_url, Object)
 
-  // [wasm_compiled_module]: the compiled wasm module this script belongs to.
+  // [wasm_module_object]: the wasm module object this script belongs to.
   // This must only be called if the type of this script is TYPE_WASM.
-  DECL_ACCESSORS(wasm_compiled_module, Object)
+  DECL_ACCESSORS(wasm_module_object, Object)
 
   // [host_defined_options]: Options defined by the embedder.
   DECL_ACCESSORS(host_defined_options, FixedArray)
@@ -170,9 +167,6 @@ class Script : public Struct {
   static int GetLineNumber(Handle<Script> script, int code_offset);
   int GetLineNumber(int code_pos) const;
 
-  // Get the JS object wrapping the given script; create it if none exists.
-  static Handle<JSObject> GetWrapper(Handle<Script> script);
-
   // Look through the list of existing shared function infos to find one
   // that matches the function literal.  Return empty handle if not found.
   MaybeHandle<SharedFunctionInfo> FindSharedFunctionInfo(
@@ -198,8 +192,7 @@ class Script : public Struct {
   static const int kLineOffsetOffset = kNameOffset + kPointerSize;
   static const int kColumnOffsetOffset = kLineOffsetOffset + kPointerSize;
   static const int kContextOffset = kColumnOffsetOffset + kPointerSize;
-  static const int kWrapperOffset = kContextOffset + kPointerSize;
-  static const int kTypeOffset = kWrapperOffset + kPointerSize;
+  static const int kTypeOffset = kContextOffset + kPointerSize;
   static const int kLineEndsOffset = kTypeOffset + kPointerSize;
   static const int kIdOffset = kLineEndsOffset + kPointerSize;
   static const int kEvalFromSharedOrWrappedArgumentsOffset =
diff --git a/deps/v8/src/objects/shared-function-info-inl.h b/deps/v8/src/objects/shared-function-info-inl.h
index de416fcdd02441..e4a4d22f83150e 100644
--- a/deps/v8/src/objects/shared-function-info-inl.h
+++ b/deps/v8/src/objects/shared-function-info-inl.h
@@ -6,8 +6,11 @@
 #define V8_OBJECTS_SHARED_FUNCTION_INFO_INL_H_
 
 #include "src/heap/heap-inl.h"
+#include "src/objects/debug-objects-inl.h"
 #include "src/objects/scope-info.h"
 #include "src/objects/shared-function-info.h"
+#include "src/objects/templates.h"
+#include "src/wasm/wasm-objects-inl.h"
 
 // Has to be the last include (doesn't have include guards):
 #include "src/objects/object-macros.h"
@@ -19,12 +22,21 @@ CAST_ACCESSOR(PreParsedScopeData)
 ACCESSORS(PreParsedScopeData, scope_data, PodArray<uint8_t>, kScopeDataOffset)
 ACCESSORS(PreParsedScopeData, child_data, FixedArray, kChildDataOffset)
 
+CAST_ACCESSOR(UncompiledData)
+INT32_ACCESSORS(UncompiledData, start_position, kStartPositionOffset)
+INT32_ACCESSORS(UncompiledData, end_position, kEndPositionOffset)
+
+CAST_ACCESSOR(UncompiledDataWithoutPreParsedScope)
+
+CAST_ACCESSOR(UncompiledDataWithPreParsedScope)
+ACCESSORS(UncompiledDataWithPreParsedScope, pre_parsed_scope_data,
+          PreParsedScopeData, kPreParsedScopeDataOffset)
+
 CAST_ACCESSOR(InterpreterData)
 ACCESSORS(InterpreterData, bytecode_array, BytecodeArray, kBytecodeArrayOffset)
 ACCESSORS(InterpreterData, interpreter_trampoline, Code,
           kInterpreterTrampolineOffset)
 
-TYPE_CHECKER(SharedFunctionInfo, SHARED_FUNCTION_INFO_TYPE)
 CAST_ACCESSOR(SharedFunctionInfo)
 DEFINE_DEOPT_ELEMENT_ACCESSORS(SharedFunctionInfo, Object)
 
@@ -32,30 +44,20 @@ ACCESSORS(SharedFunctionInfo, name_or_scope_info, Object,
           kNameOrScopeInfoOffset)
 ACCESSORS(SharedFunctionInfo, function_data, Object, kFunctionDataOffset)
 ACCESSORS(SharedFunctionInfo, script, Object, kScriptOffset)
-ACCESSORS(SharedFunctionInfo, debug_info, Object, kDebugInfoOffset)
-ACCESSORS(SharedFunctionInfo, function_identifier, Object,
-          kFunctionIdentifierOffset)
-
-BIT_FIELD_ACCESSORS(SharedFunctionInfo, raw_start_position_and_type,
-                    is_named_expression,
-                    SharedFunctionInfo::IsNamedExpressionBit)
-BIT_FIELD_ACCESSORS(SharedFunctionInfo, raw_start_position_and_type,
-                    is_toplevel, SharedFunctionInfo::IsTopLevelBit)
+ACCESSORS(SharedFunctionInfo, function_identifier_or_debug_info, Object,
+          kFunctionIdentifierOrDebugInfoOffset)
 
 INT_ACCESSORS(SharedFunctionInfo, function_literal_id, kFunctionLiteralIdOffset)
 #if V8_SFI_HAS_UNIQUE_ID
 INT_ACCESSORS(SharedFunctionInfo, unique_id, kUniqueIdOffset)
 #endif
-INT_ACCESSORS(SharedFunctionInfo, length, kLengthOffset)
-INT_ACCESSORS(SharedFunctionInfo, internal_formal_parameter_count,
-              kFormalParameterCountOffset)
-INT_ACCESSORS(SharedFunctionInfo, expected_nof_properties,
-              kExpectedNofPropertiesOffset)
-INT_ACCESSORS(SharedFunctionInfo, raw_end_position, kEndPositionOffset)
-INT_ACCESSORS(SharedFunctionInfo, raw_start_position_and_type,
-              kStartPositionAndTypeOffset)
-INT_ACCESSORS(SharedFunctionInfo, function_token_position,
-              kFunctionTokenPositionOffset)
+UINT16_ACCESSORS(SharedFunctionInfo, length, kLengthOffset)
+UINT16_ACCESSORS(SharedFunctionInfo, internal_formal_parameter_count,
+                 kFormalParameterCountOffset)
+UINT16_ACCESSORS(SharedFunctionInfo, expected_nof_properties,
+                 kExpectedNofPropertiesOffset)
+UINT16_ACCESSORS(SharedFunctionInfo, raw_function_token_offset,
+                 kFunctionTokenOffsetOffset)
 INT_ACCESSORS(SharedFunctionInfo, flags, kFlagsOffset)
 
 bool SharedFunctionInfo::HasSharedName() const {
@@ -67,13 +69,13 @@ bool SharedFunctionInfo::HasSharedName() const {
 }
 
 String* SharedFunctionInfo::Name() const {
-  if (!HasSharedName()) return GetHeap()->empty_string();
+  if (!HasSharedName()) return GetReadOnlyRoots().empty_string();
   Object* value = name_or_scope_info();
   if (value->IsScopeInfo()) {
     if (ScopeInfo::cast(value)->HasFunctionName()) {
       return String::cast(ScopeInfo::cast(value)->FunctionName());
     }
-    return GetHeap()->empty_string();
+    return GetReadOnlyRoots().empty_string();
   }
   return String::cast(value);
 }
@@ -98,6 +100,15 @@ AbstractCode* SharedFunctionInfo::abstract_code() {
   }
 }
 
+int SharedFunctionInfo::function_token_position() const {
+  int offset = raw_function_token_offset();
+  if (offset == kFunctionTokenOutOfRange) {
+    return kNoSourcePosition;
+  } else {
+    return StartPosition() - offset;
+  }
+}
+
 BIT_FIELD_ACCESSORS(SharedFunctionInfo, flags, is_wrapped,
                     SharedFunctionInfo::IsWrappedBit)
 BIT_FIELD_ACCESSORS(SharedFunctionInfo, flags, allows_lazy_compilation,
@@ -115,6 +126,20 @@ BIT_FIELD_ACCESSORS(SharedFunctionInfo, flags,
                     requires_instance_fields_initializer,
                     SharedFunctionInfo::RequiresInstanceFieldsInitializer)
 
+BIT_FIELD_ACCESSORS(SharedFunctionInfo, flags, name_should_print_as_anonymous,
+                    SharedFunctionInfo::NameShouldPrintAsAnonymousBit)
+BIT_FIELD_ACCESSORS(SharedFunctionInfo, flags, is_anonymous_expression,
+                    SharedFunctionInfo::IsAnonymousExpressionBit)
+BIT_FIELD_ACCESSORS(SharedFunctionInfo, flags, deserialized,
+                    SharedFunctionInfo::IsDeserializedBit)
+BIT_FIELD_ACCESSORS(SharedFunctionInfo, flags, has_reported_binary_coverage,
+                    SharedFunctionInfo::HasReportedBinaryCoverageBit)
+
+BIT_FIELD_ACCESSORS(SharedFunctionInfo, flags, is_named_expression,
+                    SharedFunctionInfo::IsNamedExpressionBit)
+BIT_FIELD_ACCESSORS(SharedFunctionInfo, flags, is_toplevel,
+                    SharedFunctionInfo::IsTopLevelBit)
+
 bool SharedFunctionInfo::optimization_disabled() const {
   return disable_optimization_reason() != BailoutReason::kNoReason;
 }
@@ -201,7 +226,8 @@ void SharedFunctionInfo::set_function_map_index(int index) {
 }
 
 void SharedFunctionInfo::clear_padding() {
-  memset(this->address() + kSize, 0, kAlignedSize - kSize);
+  memset(reinterpret_cast<void*>(this->address() + kSize), 0,
+         kAlignedSize - kSize);
 }
 
 void SharedFunctionInfo::UpdateFunctionMapIndex() {
@@ -210,64 +236,70 @@ void SharedFunctionInfo::UpdateFunctionMapIndex() {
   set_function_map_index(map_index);
 }
 
-BIT_FIELD_ACCESSORS(SharedFunctionInfo, debugger_hints,
-                    name_should_print_as_anonymous,
-                    SharedFunctionInfo::NameShouldPrintAsAnonymousBit)
-BIT_FIELD_ACCESSORS(SharedFunctionInfo, debugger_hints, is_anonymous_expression,
-                    SharedFunctionInfo::IsAnonymousExpressionBit)
-BIT_FIELD_ACCESSORS(SharedFunctionInfo, debugger_hints, deserialized,
-                    SharedFunctionInfo::IsDeserializedBit)
-BIT_FIELD_ACCESSORS(SharedFunctionInfo, debugger_hints, has_no_side_effect,
-                    SharedFunctionInfo::HasNoSideEffectBit)
-BIT_FIELD_ACCESSORS(SharedFunctionInfo, debugger_hints,
-                    requires_runtime_side_effect_checks,
-                    SharedFunctionInfo::RequiresRuntimeSideEffectChecksBit)
-BIT_FIELD_ACCESSORS(SharedFunctionInfo, debugger_hints,
-                    computed_has_no_side_effect,
-                    SharedFunctionInfo::ComputedHasNoSideEffectBit)
-BIT_FIELD_ACCESSORS(SharedFunctionInfo, debugger_hints, debug_is_blackboxed,
-                    SharedFunctionInfo::DebugIsBlackboxedBit)
-BIT_FIELD_ACCESSORS(SharedFunctionInfo, debugger_hints,
-                    computed_debug_is_blackboxed,
-                    SharedFunctionInfo::ComputedDebugIsBlackboxedBit)
-BIT_FIELD_ACCESSORS(SharedFunctionInfo, debugger_hints,
-                    has_reported_binary_coverage,
-                    SharedFunctionInfo::HasReportedBinaryCoverageBit)
-BIT_FIELD_ACCESSORS(SharedFunctionInfo, debugger_hints, debugging_id,
-                    SharedFunctionInfo::DebuggingIdBits)
-
 void SharedFunctionInfo::DontAdaptArguments() {
   // TODO(leszeks): Revise this DCHECK now that the code field is gone.
-  DCHECK(!HasCodeObject());
+  DCHECK(!HasWasmExportedFunctionData());
   set_internal_formal_parameter_count(kDontAdaptArgumentsSentinel);
 }
 
-BIT_FIELD_ACCESSORS(SharedFunctionInfo, raw_start_position_and_type,
-                    raw_start_position, SharedFunctionInfo::StartPositionBits)
-
 int SharedFunctionInfo::StartPosition() const {
-  ScopeInfo* info = scope_info();
-  if (!info->HasPositionInfo()) {
-    // TODO(cbruni): use preparsed_scope_data
-    return raw_start_position();
+  Object* maybe_scope_info = name_or_scope_info();
+  if (maybe_scope_info->IsScopeInfo()) {
+    ScopeInfo* info = ScopeInfo::cast(maybe_scope_info);
+    if (info->HasPositionInfo()) {
+      return info->StartPosition();
+    }
+  } else if (HasUncompiledData()) {
+    // Works with or without scope.
+    return uncompiled_data()->start_position();
+  } else if (IsApiFunction() || HasBuiltinId()) {
+    DCHECK_IMPLIES(HasBuiltinId(), builtin_id() != Builtins::kCompileLazy);
+    return 0;
   }
-  return info->StartPosition();
+  return kNoSourcePosition;
 }
 
 int SharedFunctionInfo::EndPosition() const {
-  ScopeInfo* info = scope_info();
-  if (!info->HasPositionInfo()) {
-    // TODO(cbruni): use preparsed_scope_data
-    return raw_end_position();
+  Object* maybe_scope_info = name_or_scope_info();
+  if (maybe_scope_info->IsScopeInfo()) {
+    ScopeInfo* info = ScopeInfo::cast(maybe_scope_info);
+    if (info->HasPositionInfo()) {
+      return info->EndPosition();
+    }
+  } else if (HasUncompiledData()) {
+    // Works with or without scope.
+    return uncompiled_data()->end_position();
+  } else if (IsApiFunction() || HasBuiltinId()) {
+    DCHECK_IMPLIES(HasBuiltinId(), builtin_id() != Builtins::kCompileLazy);
+    return 0;
+  }
+  return kNoSourcePosition;
+}
+
+void SharedFunctionInfo::SetPosition(int start_position, int end_position) {
+  Object* maybe_scope_info = name_or_scope_info();
+  if (maybe_scope_info->IsScopeInfo()) {
+    ScopeInfo* info = ScopeInfo::cast(maybe_scope_info);
+    if (info->HasPositionInfo()) {
+      info->SetPositionInfo(start_position, end_position);
+    }
+  } else if (HasUncompiledData()) {
+    if (HasUncompiledDataWithPreParsedScope()) {
+      // Clear out preparsed scope data, since the position setter invalidates
+      // any scope data.
+      ClearPreParsedScopeData();
+    }
+    uncompiled_data()->set_start_position(start_position);
+    uncompiled_data()->set_end_position(end_position);
+  } else {
+    UNREACHABLE();
   }
-  return info->EndPosition();
 }
 
 Code* SharedFunctionInfo::GetCode() const {
   // ======
   // NOTE: This chain of checks MUST be kept in sync with the equivalent CSA
-  // GetSharedFunctionInfoCode method in code-stub-assembler.cc, and the
-  // architecture-specific GetSharedFunctionInfoCode methods in builtins-*.cc.
+  // GetSharedFunctionInfoCode method in code-stub-assembler.cc.
   // ======
 
   Isolate* isolate = GetIsolate();
@@ -284,18 +316,18 @@ Code* SharedFunctionInfo::GetCode() const {
     // Having a fixed array means we are an asm.js/wasm function.
     DCHECK(HasAsmWasmData());
     return isolate->builtins()->builtin(Builtins::kInstantiateAsmJs);
-  } else if (data->IsPreParsedScopeData()) {
-    // Having pre-parsed scope data means we need to compile.
-    DCHECK(HasPreParsedScopeData());
+  } else if (data->IsUncompiledData()) {
+    // Having uncompiled data (with or without scope) means we need to compile.
+    DCHECK(HasUncompiledData());
     return isolate->builtins()->builtin(Builtins::kCompileLazy);
   } else if (data->IsFunctionTemplateInfo()) {
     // Having a function template info means we are an API function.
     DCHECK(IsApiFunction());
     return isolate->builtins()->builtin(Builtins::kHandleApiCall);
-  } else if (data->IsCode()) {
-    // Having a code object means we should run it.
-    DCHECK(HasCodeObject());
-    return Code::cast(data);
+  } else if (data->IsWasmExportedFunctionData()) {
+    // Having a WasmExportedFunctionData means the code is in there.
+    DCHECK(HasWasmExportedFunctionData());
+    return wasm_exported_function_data()->wrapper_code();
   } else if (data->IsInterpreterData()) {
     Code* code = InterpreterTrampoline();
     DCHECK(code->IsCode());
@@ -317,11 +349,6 @@ ScopeInfo* SharedFunctionInfo::scope_info() const {
 
 void SharedFunctionInfo::set_scope_info(ScopeInfo* scope_info,
                                         WriteBarrierMode mode) {
-  // TODO(cbruni): this code is no longer necessary once we store the positon
-  // only on the ScopeInfo.
-  if (scope_info->HasPositionInfo()) {
-    scope_info->SetPositionInfo(raw_start_position(), raw_end_position());
-  }
   // Move the existing name onto the ScopeInfo.
   Object* name = name_or_scope_info();
   if (name->IsScopeInfo()) {
@@ -369,8 +396,8 @@ ScopeInfo* SharedFunctionInfo::GetOuterScopeInfo() const {
 void SharedFunctionInfo::set_outer_scope_info(HeapObject* value,
                                               WriteBarrierMode mode) {
   DCHECK(!is_compiled());
-  DCHECK(raw_outer_scope_info_or_feedback_metadata()->IsTheHole(GetIsolate()));
-  DCHECK(value->IsScopeInfo() || value->IsTheHole(GetIsolate()));
+  DCHECK(raw_outer_scope_info_or_feedback_metadata()->IsTheHole());
+  DCHECK(value->IsScopeInfo() || value->IsTheHole());
   return set_raw_outer_scope_info_or_feedback_metadata(value, mode);
 }
 
@@ -393,17 +420,16 @@ void SharedFunctionInfo::set_feedback_metadata(FeedbackMetadata* value,
 bool SharedFunctionInfo::is_compiled() const {
   Object* data = function_data();
   return data != Smi::FromEnum(Builtins::kCompileLazy) &&
-         !data->IsPreParsedScopeData();
+         !data->IsUncompiledData();
 }
 
-int SharedFunctionInfo::GetLength() const {
+uint16_t SharedFunctionInfo::GetLength() const {
   DCHECK(is_compiled());
   DCHECK(HasLength());
   return length();
 }
 
 bool SharedFunctionInfo::HasLength() const {
-  DCHECK_IMPLIES(length() < 0, length() == kInvalidLength);
   return length() != kInvalidLength;
 }
 
@@ -411,12 +437,6 @@ bool SharedFunctionInfo::has_simple_parameters() {
   return scope_info()->HasSimpleParameters();
 }
 
-bool SharedFunctionInfo::HasDebugInfo() const {
-  bool has_debug_info = !debug_info()->IsSmi();
-  DCHECK_EQ(debug_info()->IsStruct(), has_debug_info);
-  return has_debug_info;
-}
-
 bool SharedFunctionInfo::IsApiFunction() const {
   return function_data()->IsFunctionTemplateInfo();
 }
@@ -433,6 +453,19 @@ bool SharedFunctionInfo::HasBytecodeArray() const {
 
 BytecodeArray* SharedFunctionInfo::GetBytecodeArray() const {
   DCHECK(HasBytecodeArray());
+  if (HasDebugInfo() && GetDebugInfo()->HasInstrumentedBytecodeArray()) {
+    return GetDebugInfo()->OriginalBytecodeArray();
+  } else if (function_data()->IsBytecodeArray()) {
+    return BytecodeArray::cast(function_data());
+  } else {
+    DCHECK(function_data()->IsInterpreterData());
+    return InterpreterData::cast(function_data())->bytecode_array();
+  }
+}
+
+BytecodeArray* SharedFunctionInfo::GetDebugBytecodeArray() const {
+  DCHECK(HasBytecodeArray());
+  DCHECK(HasDebugInfo() && GetDebugInfo()->HasInstrumentedBytecodeArray());
   if (function_data()->IsBytecodeArray()) {
     return BytecodeArray::cast(function_data());
   } else {
@@ -441,8 +474,19 @@ BytecodeArray* SharedFunctionInfo::GetBytecodeArray() const {
   }
 }
 
-void SharedFunctionInfo::set_bytecode_array(class BytecodeArray* bytecode) {
-  DCHECK(function_data() == Smi::FromEnum(Builtins::kCompileLazy));
+void SharedFunctionInfo::SetDebugBytecodeArray(BytecodeArray* bytecode) {
+  DCHECK(HasBytecodeArray());
+  if (function_data()->IsBytecodeArray()) {
+    set_function_data(bytecode);
+  } else {
+    DCHECK(function_data()->IsInterpreterData());
+    interpreter_data()->set_bytecode_array(bytecode);
+  }
+}
+
+void SharedFunctionInfo::set_bytecode_array(BytecodeArray* bytecode) {
+  DCHECK(function_data() == Smi::FromEnum(Builtins::kCompileLazy) ||
+         HasUncompiledData());
   set_function_data(bytecode);
 }
 
@@ -477,7 +521,7 @@ FixedArray* SharedFunctionInfo::asm_wasm_data() const {
 
 void SharedFunctionInfo::set_asm_wasm_data(FixedArray* data) {
   DCHECK(function_data() == Smi::FromEnum(Builtins::kCompileLazy) ||
-         HasAsmWasmData());
+         HasUncompiledData() || HasAsmWasmData());
   set_function_data(data);
 }
 
@@ -498,29 +542,109 @@ void SharedFunctionInfo::set_builtin_id(int builtin_id) {
   set_function_data(Smi::FromInt(builtin_id), SKIP_WRITE_BARRIER);
 }
 
-bool SharedFunctionInfo::HasPreParsedScopeData() const {
-  return function_data()->IsPreParsedScopeData();
+bool SharedFunctionInfo::HasUncompiledData() const {
+  return function_data()->IsUncompiledData();
 }
 
-PreParsedScopeData* SharedFunctionInfo::preparsed_scope_data() const {
-  DCHECK(HasPreParsedScopeData());
-  return PreParsedScopeData::cast(function_data());
+UncompiledData* SharedFunctionInfo::uncompiled_data() const {
+  DCHECK(HasUncompiledData());
+  return UncompiledData::cast(function_data());
 }
 
-void SharedFunctionInfo::set_preparsed_scope_data(
-    PreParsedScopeData* preparsed_scope_data) {
+void SharedFunctionInfo::set_uncompiled_data(UncompiledData* uncompiled_data) {
   DCHECK(function_data() == Smi::FromEnum(Builtins::kCompileLazy));
-  set_function_data(preparsed_scope_data);
+  DCHECK(uncompiled_data->IsUncompiledData());
+  set_function_data(uncompiled_data);
+}
+
+bool SharedFunctionInfo::HasUncompiledDataWithPreParsedScope() const {
+  return function_data()->IsUncompiledDataWithPreParsedScope();
+}
+
+UncompiledDataWithPreParsedScope*
+SharedFunctionInfo::uncompiled_data_with_pre_parsed_scope() const {
+  DCHECK(HasUncompiledDataWithPreParsedScope());
+  return UncompiledDataWithPreParsedScope::cast(function_data());
+}
+
+void SharedFunctionInfo::set_uncompiled_data_with_pre_parsed_scope(
+    UncompiledDataWithPreParsedScope* uncompiled_data_with_pre_parsed_scope) {
+  DCHECK(function_data() == Smi::FromEnum(Builtins::kCompileLazy));
+  DCHECK(uncompiled_data_with_pre_parsed_scope
+             ->IsUncompiledDataWithPreParsedScope());
+  set_function_data(uncompiled_data_with_pre_parsed_scope);
+}
+
+bool SharedFunctionInfo::HasUncompiledDataWithoutPreParsedScope() const {
+  return function_data()->IsUncompiledDataWithoutPreParsedScope();
 }
 
 void SharedFunctionInfo::ClearPreParsedScopeData() {
-  DCHECK(function_data() == Smi::FromEnum(Builtins::kCompileLazy) ||
-         HasPreParsedScopeData());
-  set_builtin_id(Builtins::kCompileLazy);
+  DCHECK(HasUncompiledDataWithPreParsedScope());
+  UncompiledDataWithPreParsedScope* data =
+      uncompiled_data_with_pre_parsed_scope();
+
+  // Trim off the pre-parsed scope data from the uncompiled data by swapping the
+  // map, leaving only an uncompiled data without pre-parsed scope.
+  DisallowHeapAllocation no_gc;
+  Heap* heap = Heap::FromWritableHeapObject(data);
+
+  // Swap the map.
+  heap->NotifyObjectLayoutChange(data, UncompiledDataWithPreParsedScope::kSize,
+                                 no_gc);
+  STATIC_ASSERT(UncompiledDataWithoutPreParsedScope::kSize <
+                UncompiledDataWithPreParsedScope::kSize);
+  STATIC_ASSERT(UncompiledDataWithoutPreParsedScope::kSize ==
+                UncompiledData::kSize);
+  data->synchronized_set_map(
+      GetReadOnlyRoots().uncompiled_data_without_pre_parsed_scope_map());
+
+  // Fill the remaining space with filler.
+  heap->CreateFillerObjectAt(
+      data->address() + UncompiledDataWithoutPreParsedScope::kSize,
+      UncompiledDataWithPreParsedScope::kSize -
+          UncompiledDataWithoutPreParsedScope::kSize,
+      ClearRecordedSlots::kNo);
+
+  // Ensure that the clear was successful.
+  DCHECK(HasUncompiledDataWithoutPreParsedScope());
+}
+
+bool SharedFunctionInfo::HasWasmExportedFunctionData() const {
+  return function_data()->IsWasmExportedFunctionData();
+}
+
+WasmExportedFunctionData* SharedFunctionInfo::wasm_exported_function_data()
+    const {
+  DCHECK(HasWasmExportedFunctionData());
+  return WasmExportedFunctionData::cast(function_data());
+}
+
+bool SharedFunctionInfo::HasDebugInfo() const {
+  return function_identifier_or_debug_info()->IsDebugInfo();
+}
+
+DebugInfo* SharedFunctionInfo::GetDebugInfo() const {
+  DCHECK(HasDebugInfo());
+  return DebugInfo::cast(function_identifier_or_debug_info());
+}
+
+Object* SharedFunctionInfo::function_identifier() const {
+  Object* result;
+  if (HasDebugInfo()) {
+    result = GetDebugInfo()->function_identifier();
+  } else {
+    result = function_identifier_or_debug_info();
+  }
+  DCHECK(result->IsSmi() || result->IsString() || result->IsUndefined());
+  return result;
 }
 
-bool SharedFunctionInfo::HasCodeObject() const {
-  return function_data()->IsCode();
+void SharedFunctionInfo::SetDebugInfo(DebugInfo* debug_info) {
+  DCHECK(!HasDebugInfo());
+  DCHECK_EQ(debug_info->function_identifier(),
+            function_identifier_or_debug_info());
+  set_function_identifier_or_debug_info(debug_info);
 }
 
 bool SharedFunctionInfo::HasBuiltinFunctionId() {
@@ -533,7 +657,8 @@ BuiltinFunctionId SharedFunctionInfo::builtin_function_id() {
 }
 
 void SharedFunctionInfo::set_builtin_function_id(BuiltinFunctionId id) {
-  set_function_identifier(Smi::FromInt(id));
+  DCHECK(!HasDebugInfo());
+  set_function_identifier_or_debug_info(Smi::FromInt(id));
 }
 
 bool SharedFunctionInfo::HasInferredName() {
@@ -544,19 +669,23 @@ String* SharedFunctionInfo::inferred_name() {
   if (HasInferredName()) {
     return String::cast(function_identifier());
   }
-  DCHECK(function_identifier()->IsUndefined(GetIsolate()) ||
-         HasBuiltinFunctionId());
-  return GetHeap()->empty_string();
+  DCHECK(function_identifier()->IsUndefined() || HasBuiltinFunctionId());
+  return GetReadOnlyRoots().empty_string();
 }
 
 void SharedFunctionInfo::set_inferred_name(String* inferred_name) {
-  DCHECK(function_identifier()->IsUndefined(GetIsolate()) || HasInferredName());
-  set_function_identifier(inferred_name);
+  DCHECK(function_identifier_or_debug_info()->IsUndefined() ||
+         HasInferredName() || HasDebugInfo());
+  if (HasDebugInfo()) {
+    GetDebugInfo()->set_function_identifier(inferred_name);
+  } else {
+    set_function_identifier_or_debug_info(inferred_name);
+  }
 }
 
 bool SharedFunctionInfo::IsUserJavaScript() {
   Object* script_obj = script();
-  if (script_obj->IsUndefined(GetIsolate())) return false;
+  if (script_obj->IsUndefined()) return false;
   Script* script = Script::cast(script_obj);
   return script->IsUserJavaScript();
 }
@@ -565,34 +694,49 @@ bool SharedFunctionInfo::IsSubjectToDebugging() {
   return IsUserJavaScript() && !HasAsmWasmData();
 }
 
-bool SharedFunctionInfo::CanFlushCompiled() const {
-  bool can_decompile =
-      (HasBytecodeArray() || HasAsmWasmData() || HasPreParsedScopeData());
+bool SharedFunctionInfo::CanDiscardCompiled() const {
+  bool can_decompile = (HasBytecodeArray() || HasAsmWasmData() ||
+                        HasUncompiledDataWithPreParsedScope());
   return can_decompile;
 }
 
-void SharedFunctionInfo::FlushCompiled() {
-  DisallowHeapAllocation no_gc;
-
-  DCHECK(CanFlushCompiled());
+// static
+void SharedFunctionInfo::DiscardCompiled(
+    Isolate* isolate, Handle<SharedFunctionInfo> shared_info) {
+  DCHECK(shared_info->CanDiscardCompiled());
 
-  Oddball* the_hole = GetIsolate()->heap()->the_hole_value();
+  int start_position = shared_info->StartPosition();
+  int end_position = shared_info->EndPosition();
 
-  if (is_compiled()) {
-    HeapObject* outer_scope_info = the_hole;
-    if (!is_toplevel()) {
-      if (scope_info()->HasOuterScopeInfo()) {
-        outer_scope_info = scope_info()->OuterScopeInfo();
-      }
+  if (shared_info->is_compiled()) {
+    HeapObject* outer_scope_info;
+    if (shared_info->scope_info()->HasOuterScopeInfo()) {
+      outer_scope_info = shared_info->scope_info()->OuterScopeInfo();
+    } else {
+      outer_scope_info = ReadOnlyRoots(isolate).the_hole_value();
     }
     // Raw setter to avoid validity checks, since we're performing the unusual
     // task of decompiling.
-    set_raw_outer_scope_info_or_feedback_metadata(outer_scope_info);
+    shared_info->set_raw_outer_scope_info_or_feedback_metadata(
+        outer_scope_info);
   } else {
-    DCHECK(outer_scope_info()->IsScopeInfo() || is_toplevel());
+    DCHECK(shared_info->outer_scope_info()->IsScopeInfo() ||
+           shared_info->outer_scope_info()->IsTheHole());
   }
 
-  set_builtin_id(Builtins::kCompileLazy);
+  if (shared_info->HasUncompiledDataWithPreParsedScope()) {
+    // If this is uncompiled data with a pre-parsed scope data, we can just
+    // clear out the scope data and keep the uncompiled data.
+    shared_info->ClearPreParsedScopeData();
+  } else {
+    // Create a new UncompiledData, without pre-parsed scope, and update the
+    // function data to point to it. Use the raw function data setter to avoid
+    // validity checks, since we're performing the unusual task of decompiling.
+    Handle<UncompiledData> data =
+        isolate->factory()->NewUncompiledDataWithoutPreParsedScope(
+            start_position, end_position);
+    shared_info->set_function_data(*data);
+  }
 }
 
 }  // namespace internal
diff --git a/deps/v8/src/objects/shared-function-info.h b/deps/v8/src/objects/shared-function-info.h
index 06abe8a2c78d3c..b6fa3ddc8cabe0 100644
--- a/deps/v8/src/objects/shared-function-info.h
+++ b/deps/v8/src/objects/shared-function-info.h
@@ -5,6 +5,7 @@
 #ifndef V8_OBJECTS_SHARED_FUNCTION_INFO_H_
 #define V8_OBJECTS_SHARED_FUNCTION_INFO_H_
 
+#include "src/bailout-reason.h"
 #include "src/objects.h"
 #include "src/objects/script.h"
 
@@ -17,7 +18,10 @@ namespace internal {
 class BytecodeArray;
 class CoverageInfo;
 class DebugInfo;
+class WasmExportedFunctionData;
 
+// Data collected by the pre-parser storing information about scopes and inner
+// functions.
 class PreParsedScopeData : public Struct {
  public:
   DECL_ACCESSORS(scope_data, PodArray<uint8_t>)
@@ -35,6 +39,78 @@ class PreParsedScopeData : public Struct {
   DISALLOW_IMPLICIT_CONSTRUCTORS(PreParsedScopeData);
 };
 
+// Abstract class representing extra data for an uncompiled function, which is
+// not stored in the SharedFunctionInfo.
+class UncompiledData : public HeapObject {
+ public:
+  DECL_INT32_ACCESSORS(start_position)
+  DECL_INT32_ACCESSORS(end_position)
+
+  DECL_CAST(UncompiledData)
+
+#define UNCOMPILED_DATA_FIELDS(V)     \
+  V(kStartPositionOffset, kInt32Size) \
+  V(kEndPositionOffset, kInt32Size)   \
+  /* Total size. */                   \
+  V(kUnalignedSize, 0)
+
+  DEFINE_FIELD_OFFSET_CONSTANTS(HeapObject::kHeaderSize, UNCOMPILED_DATA_FIELDS)
+#undef UNCOMPILED_DATA_FIELDS
+
+  static const int kSize = POINTER_SIZE_ALIGN(kUnalignedSize);
+
+ private:
+  DISALLOW_IMPLICIT_CONSTRUCTORS(UncompiledData);
+};
+
+// Class representing data for an uncompiled function that does not have any
+// data from the pre-parser, either because it's a leaf function or because the
+// pre-parser bailed out.
+class UncompiledDataWithoutPreParsedScope : public UncompiledData {
+ public:
+  DECL_CAST(UncompiledDataWithoutPreParsedScope)
+  DECL_PRINTER(UncompiledDataWithoutPreParsedScope)
+  DECL_VERIFIER(UncompiledDataWithoutPreParsedScope)
+
+  static const int kSize = UncompiledData::kSize;
+
+ private:
+  DISALLOW_IMPLICIT_CONSTRUCTORS(UncompiledDataWithoutPreParsedScope);
+};
+
+// Class representing data for an uncompiled function that has pre-parsed scope
+// data.
+class UncompiledDataWithPreParsedScope : public UncompiledData {
+ public:
+  DECL_ACCESSORS(pre_parsed_scope_data, PreParsedScopeData)
+
+  DECL_CAST(UncompiledDataWithPreParsedScope)
+  DECL_PRINTER(UncompiledDataWithPreParsedScope)
+  DECL_VERIFIER(UncompiledDataWithPreParsedScope)
+
+#define UNCOMPILED_DATA_WITH_PRE_PARSED_SCOPE_FIELDS(V) \
+  V(kStartOfPointerFieldsOffset, 0)                     \
+  V(kPreParsedScopeDataOffset, kPointerSize)            \
+  V(kEndOfPointerFieldsOffset, 0)                       \
+  /* Total size. */                                     \
+  V(kUnalignedSize, 0)
+
+  DEFINE_FIELD_OFFSET_CONSTANTS(UncompiledData::kSize,
+                                UNCOMPILED_DATA_WITH_PRE_PARSED_SCOPE_FIELDS)
+#undef UNCOMPILED_DATA_WITH_PRE_PARSED_SCOPE_FIELDS
+
+  static const int kSize = POINTER_SIZE_ALIGN(kUnalignedSize);
+
+  typedef FixedBodyDescriptor<kStartOfPointerFieldsOffset,
+                              kEndOfPointerFieldsOffset, kUnalignedSize>
+      BodyDescriptor;
+  // No weak fields.
+  typedef BodyDescriptor BodyDescriptorWeak;
+
+ private:
+  DISALLOW_IMPLICIT_CONSTRUCTORS(UncompiledDataWithPreParsedScope);
+};
+
 class InterpreterData : public Struct {
  public:
   DECL_ACCESSORS(bytecode_array, BytecodeArray)
@@ -91,7 +167,7 @@ class SharedFunctionInfo : public HeapObject {
   static const int kInitialLength = kEntriesStart + kEntryLength;
 
   static const int kNotFound = -1;
-  static const int kInvalidLength = -1;
+  static const uint16_t kInvalidLength = static_cast<uint16_t>(-1);
 
   // Helpers for assembly code that does a backwards walk of the optimized code
   // map.
@@ -110,6 +186,10 @@ class SharedFunctionInfo : public HeapObject {
   // Start position of this function in the script source.
   inline int StartPosition() const;
 
+  // Set the start and end position of this function in the script source.
+  // Updates the scope info if available.
+  inline void SetPosition(int start_position, int end_position);
+
   // [outer scope info | feedback metadata] Shared storage for outer scope info
   // (on uncompiled functions) and feedback metadata (on compiled functions).
   DECL_ACCESSORS(raw_outer_scope_info_or_feedback_metadata, HeapObject)
@@ -127,16 +207,17 @@ class SharedFunctionInfo : public HeapObject {
   inline bool is_compiled() const;
 
   // [length]: The function length - usually the number of declared parameters.
-  // Use up to 2^30 parameters. The value is only reliable when the function has
-  // been compiled.
-  inline int GetLength() const;
+  // Use up to 2^16-2 parameters (16 bits of values, where one is reserved for
+  // kDontAdaptArgumentsSentinel). The value is only reliable when the function
+  // has been compiled.
+  inline uint16_t GetLength() const;
   inline bool HasLength() const;
   inline void set_length(int value);
 
   // [internal formal parameter count]: The declared number of parameters.
   // For subclass constructors, also includes new.target.
   // The size of function's frame is internal_formal_parameter_count + 1.
-  DECL_INT_ACCESSORS(internal_formal_parameter_count)
+  DECL_UINT16_ACCESSORS(internal_formal_parameter_count)
 
   // Set the formal parameter count so the function code will be
   // called without using argument adaptor frames.
@@ -144,7 +225,7 @@ class SharedFunctionInfo : public HeapObject {
 
   // [expected_nof_properties]: Expected number of properties for the
   // function. The value is only reliable when the function has been compiled.
-  DECL_INT_ACCESSORS(expected_nof_properties)
+  DECL_UINT16_ACCESSORS(expected_nof_properties)
 
   // [function_literal_id] - uniquely identifies the FunctionLiteral this
   // SharedFunctionInfo represents within its script, or -1 if this
@@ -165,8 +246,11 @@ class SharedFunctionInfo : public HeapObject {
   //    interpreter trampoline [HasInterpreterData()]
   //  - a FixedArray with Asm->Wasm conversion [HasAsmWasmData()].
   //  - a Smi containing the builtin id [HasBuiltinId()]
-  //  - a PreParsedScopeData for the parser [HasPreParsedScopeData()]
-  //  - a Code object otherwise [HasCodeObject()]
+  //  - a UncompiledDataWithoutPreParsedScope for lazy compilation
+  //    [HasUncompiledDataWithoutPreParsedScope()]
+  //  - a UncompiledDataWithPreParsedScope for lazy compilation
+  //    [HasUncompiledDataWithPreParsedScope()]
+  //  - a WasmExportedFunctionData for Wasm [HasWasmExportedFunctionData()]
   DECL_ACCESSORS(function_data, Object)
 
   inline bool IsApiFunction() const;
@@ -174,14 +258,17 @@ class SharedFunctionInfo : public HeapObject {
   inline void set_api_func_data(FunctionTemplateInfo* data);
   inline bool HasBytecodeArray() const;
   inline BytecodeArray* GetBytecodeArray() const;
-  inline void set_bytecode_array(class BytecodeArray* bytecode);
+  inline void set_bytecode_array(BytecodeArray* bytecode);
   inline Code* InterpreterTrampoline() const;
   inline bool HasInterpreterData() const;
   inline InterpreterData* interpreter_data() const;
   inline void set_interpreter_data(InterpreterData* interpreter_data);
+  inline BytecodeArray* GetDebugBytecodeArray() const;
+  inline void SetDebugBytecodeArray(BytecodeArray* bytecode);
   inline bool HasAsmWasmData() const;
   inline FixedArray* asm_wasm_data() const;
   inline void set_asm_wasm_data(FixedArray* data);
+
   // A brief note to clear up possible confusion:
   // builtin_id corresponds to the auto-generated
   // Builtins::Name id, while builtin_function_id corresponds to
@@ -190,24 +277,34 @@ class SharedFunctionInfo : public HeapObject {
   inline bool HasBuiltinId() const;
   inline int builtin_id() const;
   inline void set_builtin_id(int builtin_id);
-  inline bool HasPreParsedScopeData() const;
-  inline PreParsedScopeData* preparsed_scope_data() const;
-  inline void set_preparsed_scope_data(PreParsedScopeData* data);
+  inline bool HasUncompiledData() const;
+  inline UncompiledData* uncompiled_data() const;
+  inline void set_uncompiled_data(UncompiledData* data);
+  inline bool HasUncompiledDataWithPreParsedScope() const;
+  inline UncompiledDataWithPreParsedScope*
+  uncompiled_data_with_pre_parsed_scope() const;
+  inline void set_uncompiled_data_with_pre_parsed_scope(
+      UncompiledDataWithPreParsedScope* data);
+  inline bool HasUncompiledDataWithoutPreParsedScope() const;
+  inline bool HasWasmExportedFunctionData() const;
+  inline WasmExportedFunctionData* wasm_exported_function_data() const;
+  inline void set_wasm_exported_function_data(WasmExportedFunctionData* data);
+
+  // Clear out pre-parsed scope data from UncompiledDataWithPreParsedScope,
+  // turning it into UncompiledDataWithoutPreParsedScope.
   inline void ClearPreParsedScopeData();
-  inline bool HasCodeObject() const;
-  inline Code* code_object() const;
-  inline void set_code_object();
 
   // [function identifier]: This field holds an additional identifier for the
   // function.
   //  - a Smi identifying a builtin function [HasBuiltinFunctionId()].
   //  - a String identifying the function's inferred name [HasInferredName()].
+  //  - a DebugInfo which holds the actual function_identifier [HasDebugInfo()].
   // The inferred_name is inferred from variable or property
   // assignment of this function. It is used to facilitate debugging and
   // profiling of JavaScript code written in OO style, where almost
   // all functions are anonymous but are assigned to object
   // properties.
-  DECL_ACCESSORS(function_identifier, Object)
+  DECL_ACCESSORS(function_identifier_or_debug_info, Object)
 
   inline bool HasBuiltinFunctionId();
   inline BuiltinFunctionId builtin_function_id();
@@ -216,12 +313,10 @@ class SharedFunctionInfo : public HeapObject {
   inline String* inferred_name();
   inline void set_inferred_name(String* inferred_name);
 
-  // [script]: Script from which the function originates.
-  DECL_ACCESSORS(script, Object)
-
   // The function is subject to debugging if a debug info is attached.
   inline bool HasDebugInfo() const;
-  DebugInfo* GetDebugInfo() const;
+  inline DebugInfo* GetDebugInfo() const;
+  inline void SetDebugInfo(DebugInfo* debug_info);
 
   // Break infos are contained in DebugInfo, this is a convenience method
   // to simplify access.
@@ -233,92 +328,37 @@ class SharedFunctionInfo : public HeapObject {
   bool HasCoverageInfo() const;
   CoverageInfo* GetCoverageInfo() const;
 
-  // [debug info]: Debug information.
-  DECL_ACCESSORS(debug_info, Object)
-
-  // Bit field containing various information collected for debugging.
-  // This field is either stored on the kDebugInfo slot or inside the
-  // debug info struct.
-  int debugger_hints() const;
-  void set_debugger_hints(int value);
-
-  // Indicates that the function was created by the Function function.
-  // Though it's anonymous, toString should treat it as if it had the name
-  // "anonymous".  We don't set the name itself so that the system does not
-  // see a binding for it.
-  DECL_BOOLEAN_ACCESSORS(name_should_print_as_anonymous)
-
-  // Indicates that the function is either an anonymous expression
-  // or an arrow function (the name field can be set through the API,
-  // which does not change this flag).
-  DECL_BOOLEAN_ACCESSORS(is_anonymous_expression)
-
-  // Indicates that the the shared function info is deserialized from cache.
-  DECL_BOOLEAN_ACCESSORS(deserialized)
-
-  // Indicates that the function cannot cause side-effects.
-  DECL_BOOLEAN_ACCESSORS(has_no_side_effect)
-
-  // Indicates that the function requires runtime side-effect checks.
-  DECL_BOOLEAN_ACCESSORS(requires_runtime_side_effect_checks);
-
-  // Indicates that |has_no_side_effect| has been computed and set.
-  DECL_BOOLEAN_ACCESSORS(computed_has_no_side_effect)
-
-  // Indicates that the function should be skipped during stepping.
-  DECL_BOOLEAN_ACCESSORS(debug_is_blackboxed)
-
-  // Indicates that |debug_is_blackboxed| has been computed and set.
-  DECL_BOOLEAN_ACCESSORS(computed_debug_is_blackboxed)
-
-  // Indicates that the function has been reported for binary code coverage.
-  DECL_BOOLEAN_ACCESSORS(has_reported_binary_coverage)
-
-  // Id assigned to the function for debugging.
-  // This could also be implemented as a weak hash table.
-  inline int debugging_id() const;
-  inline void set_debugging_id(int value);
-
   // The function's name if it is non-empty, otherwise the inferred name.
   String* DebugName();
 
-  // The function cannot cause any side effects.
-  static bool HasNoSideEffect(Handle<SharedFunctionInfo> info);
-
   // Used for flags such as --turbo-filter.
   bool PassesFilter(const char* raw_filter);
 
-  // Position of the 'function' token in the script source.
-  DECL_INT_ACCESSORS(function_token_position)
-
-  // [raw_start_position_and_type]: Field used to store both the source code
-  // position, whether or not the function is a function expression,
-  // and whether or not the function is a toplevel function. The two
-  // least significants bit indicates whether the function is an
-  // expression and the rest contains the source code position.
-  // TODO(cbruni): start_position should be removed from SFI.
-  DECL_INT_ACCESSORS(raw_start_position_and_type)
+  // [script]: Script from which the function originates.
+  DECL_ACCESSORS(script, Object)
 
-  // Position of this function in the script source.
-  // TODO(cbruni): start_position should be removed from SFI.
-  DECL_INT_ACCESSORS(raw_start_position)
+  // The offset of the 'function' token in the script source relative to the
+  // start position. Can return kFunctionTokenOutOfRange if offset doesn't
+  // fit in 16 bits.
+  DECL_UINT16_ACCESSORS(raw_function_token_offset)
 
-  // End position of this function in the script source.
-  // TODO(cbruni): end_position should be removed from SFI.
-  DECL_INT_ACCESSORS(raw_end_position)
+  // The position of the 'function' token in the script source. Can return
+  // kNoSourcePosition if raw_function_token_offset() returns
+  // kFunctionTokenOutOfRange.
+  inline int function_token_position() const;
 
   // Returns true if the function has shared name.
   inline bool HasSharedName() const;
 
+  // [flags] Bit field containing various flags about the function.
+  DECL_INT_ACCESSORS(flags)
+
   // Is this function a named function expression in the source code.
   DECL_BOOLEAN_ACCESSORS(is_named_expression)
 
   // Is this function a top-level function (scripts, evals).
   DECL_BOOLEAN_ACCESSORS(is_toplevel)
 
-  // [flags] Bit field containing various flags about the function.
-  DECL_INT_ACCESSORS(flags)
-
   // Indicates if this function can be lazy compiled.
   DECL_BOOLEAN_ACCESSORS(allows_lazy_compilation)
 
@@ -344,6 +384,23 @@ class SharedFunctionInfo : public HeapObject {
   // Indicates that asm->wasm conversion failed and should not be re-attempted.
   DECL_BOOLEAN_ACCESSORS(is_asm_wasm_broken)
 
+  // Indicates that the function was created by the Function function.
+  // Though it's anonymous, toString should treat it as if it had the name
+  // "anonymous".  We don't set the name itself so that the system does not
+  // see a binding for it.
+  DECL_BOOLEAN_ACCESSORS(name_should_print_as_anonymous)
+
+  // Indicates that the function is either an anonymous expression
+  // or an arrow function (the name field can be set through the API,
+  // which does not change this flag).
+  DECL_BOOLEAN_ACCESSORS(is_anonymous_expression)
+
+  // Indicates that the the shared function info is deserialized from cache.
+  DECL_BOOLEAN_ACCESSORS(deserialized)
+
+  // Indicates that the function has been reported for binary code coverage.
+  DECL_BOOLEAN_ACCESSORS(has_reported_binary_coverage)
+
   inline FunctionKind kind() const;
 
   // Defines the index in a native context of closure's map instantiated using
@@ -392,11 +449,12 @@ class SharedFunctionInfo : public HeapObject {
 
   // True if one can flush compiled code from this function, in such a way that
   // it can later be re-compiled.
-  inline bool CanFlushCompiled() const;
+  inline bool CanDiscardCompiled() const;
 
   // Flush compiled data from this function, setting it back to CompileLazy and
   // clearing any feedback metadata.
-  inline void FlushCompiled();
+  static inline void DiscardCompiled(Isolate* isolate,
+                                     Handle<SharedFunctionInfo> shared_info);
 
   // Check whether or not this function is inlineable.
   bool IsInlineable();
@@ -416,6 +474,11 @@ class SharedFunctionInfo : public HeapObject {
   // Sets the expected number of properties based on estimate from parser.
   void SetExpectedNofPropertiesFromEstimate(FunctionLiteral* literal);
 
+  // Sets the FunctionTokenOffset field based on the given token position and
+  // start position.
+  void SetFunctionTokenPosition(int function_token_position,
+                                int start_position);
+
   inline bool construct_as_builtin() const;
 
   // Determines and sets the ConstructAsBuiltinBit in |flags|, based on the
@@ -435,13 +498,13 @@ class SharedFunctionInfo : public HeapObject {
   // Iterate over all shared function infos in a given script.
   class ScriptIterator {
    public:
-    explicit ScriptIterator(Handle<Script> script);
+    ScriptIterator(Isolate* isolate, Script* script);
     ScriptIterator(Isolate* isolate,
                    Handle<WeakFixedArray> shared_function_infos);
     SharedFunctionInfo* Next();
 
     // Reset the iterator to run on |script|.
-    void Reset(Handle<Script> script);
+    void Reset(Script* script);
 
    private:
     Isolate* isolate_;
@@ -467,7 +530,11 @@ class SharedFunctionInfo : public HeapObject {
   DECL_CAST(SharedFunctionInfo)
 
   // Constants.
-  static const int kDontAdaptArgumentsSentinel = -1;
+  static const uint16_t kDontAdaptArgumentsSentinel = static_cast<uint16_t>(-1);
+
+  static const int kMaximumFunctionTokenOffset = kMaxUInt16 - 1;
+  static const uint16_t kFunctionTokenOutOfRange = static_cast<uint16_t>(-1);
+  STATIC_ASSERT(kMaximumFunctionTokenOffset + 1 == kFunctionTokenOutOfRange);
 
 #if V8_SFI_HAS_UNIQUE_ID
   static const int kUniqueIdFieldSize = kInt32Size;
@@ -484,18 +551,15 @@ class SharedFunctionInfo : public HeapObject {
   V(kNameOrScopeInfoOffset, kPointerSize)                  \
   V(kOuterScopeInfoOrFeedbackMetadataOffset, kPointerSize) \
   V(kScriptOffset, kPointerSize)                           \
-  V(kDebugInfoOffset, kPointerSize)                        \
-  V(kFunctionIdentifierOffset, kPointerSize)               \
+  V(kFunctionIdentifierOrDebugInfoOffset, kPointerSize)    \
   V(kEndOfPointerFieldsOffset, 0)                          \
   /* Raw data fields. */                                   \
   V(kFunctionLiteralIdOffset, kInt32Size)                  \
   V(kUniqueIdOffset, kUniqueIdFieldSize)                   \
-  V(kLengthOffset, kInt32Size)                             \
-  V(kFormalParameterCountOffset, kInt32Size)               \
-  V(kExpectedNofPropertiesOffset, kInt32Size)              \
-  V(kStartPositionAndTypeOffset, kInt32Size)               \
-  V(kEndPositionOffset, kInt32Size)                        \
-  V(kFunctionTokenPositionOffset, kInt32Size)              \
+  V(kLengthOffset, kUInt16Size)                            \
+  V(kFormalParameterCountOffset, kUInt16Size)              \
+  V(kExpectedNofPropertiesOffset, kUInt16Size)             \
+  V(kFunctionTokenOffsetOffset, kUInt16Size)               \
   V(kFlagsOffset, kInt32Size)                              \
   /* Total size. */                                        \
   V(kSize, 0)
@@ -512,15 +576,6 @@ class SharedFunctionInfo : public HeapObject {
   // No weak fields.
   typedef BodyDescriptor BodyDescriptorWeak;
 
-// Bit fields in |raw_start_position_and_type|.
-#define START_POSITION_AND_TYPE_BIT_FIELDS(V, _) \
-  V(IsNamedExpressionBit, bool, 1, _)            \
-  V(IsTopLevelBit, bool, 1, _)                   \
-  V(StartPositionBits, int, 30, _)
-
-  DEFINE_BIT_FIELDS(START_POSITION_AND_TYPE_BIT_FIELDS)
-#undef START_POSITION_AND_TYPE_BIT_FIELDS
-
 // Bit positions in |flags|.
 #define FLAGS_BIT_FIELDS(V, _)                           \
   V(IsNativeBit, bool, 1, _)                             \
@@ -537,8 +592,13 @@ class SharedFunctionInfo : public HeapObject {
   V(FunctionMapIndexBits, int, 5, _)                     \
   V(DisabledOptimizationReasonBits, BailoutReason, 4, _) \
   V(RequiresInstanceFieldsInitializer, bool, 1, _)       \
-  V(ConstructAsBuiltinBit, bool, 1, _)
-
+  V(ConstructAsBuiltinBit, bool, 1, _)                   \
+  V(IsAnonymousExpressionBit, bool, 1, _)                \
+  V(NameShouldPrintAsAnonymousBit, bool, 1, _)           \
+  V(IsDeserializedBit, bool, 1, _)                       \
+  V(HasReportedBinaryCoverageBit, bool, 1, _)            \
+  V(IsNamedExpressionBit, bool, 1, _)                    \
+  V(IsTopLevelBit, bool, 1, _)
   DEFINE_BIT_FIELDS(FLAGS_BIT_FIELDS)
 #undef FLAGS_BIT_FIELDS
 
@@ -548,24 +608,6 @@ class SharedFunctionInfo : public HeapObject {
 
   STATIC_ASSERT(kLastFunctionKind <= FunctionKindBits::kMax);
 
-// Bit positions in |debugger_hints|.
-#define DEBUGGER_HINTS_BIT_FIELDS(V, _)             \
-  V(IsAnonymousExpressionBit, bool, 1, _)           \
-  V(NameShouldPrintAsAnonymousBit, bool, 1, _)      \
-  V(IsDeserializedBit, bool, 1, _)                  \
-  V(HasNoSideEffectBit, bool, 1, _)                 \
-  V(RequiresRuntimeSideEffectChecksBit, bool, 1, _) \
-  V(ComputedHasNoSideEffectBit, bool, 1, _)         \
-  V(DebugIsBlackboxedBit, bool, 1, _)               \
-  V(ComputedDebugIsBlackboxedBit, bool, 1, _)       \
-  V(HasReportedBinaryCoverageBit, bool, 1, _)       \
-  V(DebuggingIdBits, int, 20, _)
-
-  DEFINE_BIT_FIELDS(DEBUGGER_HINTS_BIT_FIELDS)
-#undef DEBUGGER_HINTS_BIT_FIELDS
-
-  static const int kNoDebuggingId = 0;
-
   // Indicates that this function uses a super property (or an eval that may
   // use a super property).
   // This is needed to set up the [[HomeObject]] on the function instance.
@@ -580,6 +622,8 @@ class SharedFunctionInfo : public HeapObject {
   // function.
   DECL_ACCESSORS(outer_scope_info, HeapObject)
 
+  inline Object* function_identifier() const;
+
   inline void set_kind(FunctionKind kind);
 
   inline void set_needs_home_object(bool value);
@@ -588,7 +632,7 @@ class SharedFunctionInfo : public HeapObject {
   friend class V8HeapExplorer;
   FRIEND_TEST(PreParserTest, LazyFunctionLength);
 
-  inline int length() const;
+  inline uint16_t length() const;
 
   DISALLOW_IMPLICIT_CONSTRUCTORS(SharedFunctionInfo);
 };
diff --git a/deps/v8/src/objects/string-inl.h b/deps/v8/src/objects/string-inl.h
index 68a295f80f1e8c..6c79e10fe0edac 100644
--- a/deps/v8/src/objects/string-inl.h
+++ b/deps/v8/src/objects/string-inl.h
@@ -289,25 +289,26 @@ bool String::Equals(String* other) {
   return SlowEquals(other);
 }
 
-bool String::Equals(Handle<String> one, Handle<String> two) {
+bool String::Equals(Isolate* isolate, Handle<String> one, Handle<String> two) {
   if (one.is_identical_to(two)) return true;
   if (one->IsInternalizedString() && two->IsInternalizedString()) {
     return false;
   }
-  return SlowEquals(one, two);
+  return SlowEquals(isolate, one, two);
 }
 
-Handle<String> String::Flatten(Handle<String> string, PretenureFlag pretenure) {
+Handle<String> String::Flatten(Isolate* isolate, Handle<String> string,
+                               PretenureFlag pretenure) {
   if (string->IsConsString()) {
     Handle<ConsString> cons = Handle<ConsString>::cast(string);
     if (cons->IsFlat()) {
-      string = handle(cons->first());
+      string = handle(cons->first(), isolate);
     } else {
-      return SlowFlatten(cons, pretenure);
+      return SlowFlatten(isolate, cons, pretenure);
     }
   }
   if (string->IsThinString()) {
-    string = handle(Handle<ThinString>::cast(string)->actual());
+    string = handle(Handle<ThinString>::cast(string)->actual(), isolate);
     DCHECK(!string->IsConsString());
   }
   return string;
@@ -529,7 +530,7 @@ HeapObject* ThinString::unchecked_actual() const {
   return reinterpret_cast<HeapObject*>(READ_FIELD(this, kActualOffset));
 }
 
-bool ExternalString::is_short() {
+bool ExternalString::is_short() const {
   InstanceType type = map()->instance_type();
   return (type & kShortExternalStringMask) == kShortExternalStringTag;
 }
@@ -539,7 +540,7 @@ Address ExternalString::resource_as_address() {
 }
 
 void ExternalString::set_address_as_resource(Address address) {
-  DCHECK(IsAligned(reinterpret_cast<intptr_t>(address), kPointerSize));
+  DCHECK(IsAligned(address, kPointerSize));
   *reinterpret_cast<Address*>(FIELD_ADDR(this, kResourceOffset)) = address;
   if (IsExternalOneByteString()) {
     ExternalOneByteString::cast(this)->update_data_cache();
diff --git a/deps/v8/src/objects/string-table.h b/deps/v8/src/objects/string-table.h
index 2e5be87b211dd1..736e87afb6940b 100644
--- a/deps/v8/src/objects/string-table.h
+++ b/deps/v8/src/objects/string-table.h
@@ -79,7 +79,7 @@ class StringTable : public HashTable<StringTable, StringTableShape> {
 
   DECL_CAST(StringTable)
 
-  static const int kMaxEmptyFactor = 8;
+  static const int kMaxEmptyFactor = 4;
   static const int kMinCapacity = 2048;
   static const int kMinShrinkCapacity = kMinCapacity;
 
@@ -103,7 +103,7 @@ class StringSetShape : public BaseShape<String*> {
 class StringSet : public HashTable<StringSet, StringSetShape> {
  public:
   static Handle<StringSet> New(Isolate* isolate);
-  static Handle<StringSet> Add(Handle<StringSet> blacklist,
+  static Handle<StringSet> Add(Isolate* isolate, Handle<StringSet> blacklist,
                                Handle<String> name);
   bool Has(Handle<String> name);
 
diff --git a/deps/v8/src/objects/string.h b/deps/v8/src/objects/string.h
index 07fe164957117d..f9b8957a314c8c 100644
--- a/deps/v8/src/objects/string.h
+++ b/deps/v8/src/objects/string.h
@@ -7,6 +7,7 @@
 
 #include "src/base/bits.h"
 #include "src/objects/name.h"
+#include "src/unicode-decoder.h"
 
 // Has to be the last include (doesn't have include guards):
 #include "src/objects/object-macros.h"
@@ -154,7 +155,7 @@ class String : public Name {
   };
 
   template <typename Char>
-  INLINE(Vector<const Char> GetCharVector());
+  V8_INLINE Vector<const Char> GetCharVector();
 
   // Get and set the length of the string.
   inline int length() const;
@@ -186,10 +187,10 @@ class String : public Name {
   inline void Set(int index, uint16_t value);
   // Get individual two byte char in the string.  Repeated calls
   // to this method are not efficient unless the string is flat.
-  INLINE(uint16_t Get(int index));
+  V8_INLINE uint16_t Get(int index);
 
   // ES6 section 7.1.3.1 ToNumber Applied to the String Type
-  static Handle<Object> ToNumber(Handle<String> subject);
+  static Handle<Object> ToNumber(Isolate* isolate, Handle<String> subject);
 
   // Flattens the string.  Checks first inline to see if it is
   // necessary.  Does nothing if the string is not a cons string.
@@ -204,7 +205,7 @@ class String : public Name {
   // Degenerate cons strings are handled specially by the garbage
   // collector (see IsShortcutCandidate).
 
-  static inline Handle<String> Flatten(Handle<String> string,
+  static inline Handle<String> Flatten(Isolate* isolate, Handle<String> string,
                                        PretenureFlag pretenure = NOT_TENURED);
 
   // Tries to return the content of a flat string as a structure holding either
@@ -229,7 +230,8 @@ class String : public Name {
   // for strings containing supplementary characters, lexicographic ordering on
   // sequences of UTF-16 code unit values differs from that on sequences of code
   // point values.
-  V8_WARN_UNUSED_RESULT static ComparisonResult Compare(Handle<String> x,
+  V8_WARN_UNUSED_RESULT static ComparisonResult Compare(Isolate* isolate,
+                                                        Handle<String> x,
                                                         Handle<String> y);
 
   // Perform ES6 21.1.3.8, including checking arguments.
@@ -277,7 +279,8 @@ class String : public Name {
 
   // String equality operations.
   inline bool Equals(String* other);
-  inline static bool Equals(Handle<String> one, Handle<String> two);
+  inline static bool Equals(Isolate* isolate, Handle<String> one,
+                            Handle<String> two);
   bool IsUtf8EqualTo(Vector<const char> str, bool allow_prefix_match = false);
 
   // Dispatches to Is{One,Two}ByteEqualTo.
@@ -315,7 +318,8 @@ class String : public Name {
 
   // Trimming.
   enum TrimMode { kTrim, kTrimStart, kTrimEnd };
-  static Handle<String> Trim(Handle<String> string, TrimMode mode);
+  static Handle<String> Trim(Isolate* isolate, Handle<String> string,
+                             TrimMode mode);
 
   DECL_CAST(String)
 
@@ -355,6 +359,8 @@ class String : public Name {
 
   // See include/v8.h for the definition.
   static const int kMaxLength = v8::String::kMaxLength;
+  static_assert(kMaxLength <= (Smi::kMaxValue / 2 - kSize),
+                "Unexpected max String length");
 
   // Max length for computing hash. For strings longer than this limit the
   // string length is used as the hash value.
@@ -434,7 +440,8 @@ class String : public Name {
   static inline ConsString* VisitFlat(Visitor* visitor, String* string,
                                       int offset = 0);
 
-  static Handle<FixedArray> CalculateLineEnds(Handle<String> string,
+  static Handle<FixedArray> CalculateLineEnds(Isolate* isolate,
+                                              Handle<String> string,
                                               bool include_ending_line);
 
  private:
@@ -442,14 +449,15 @@ class String : public Name {
   friend class StringTableInsertionKey;
   friend class InternalizedStringKey;
 
-  static Handle<String> SlowFlatten(Handle<ConsString> cons,
+  static Handle<String> SlowFlatten(Isolate* isolate, Handle<ConsString> cons,
                                     PretenureFlag tenure);
 
   // Slow case of String::Equals.  This implementation works on any strings
   // but it is most efficient on strings that are almost flat.
   bool SlowEquals(String* other);
 
-  static bool SlowEquals(Handle<String> one, Handle<String> two);
+  static bool SlowEquals(Isolate* isolate, Handle<String> one,
+                         Handle<String> two);
 
   // Slow case of AsArrayIndex.
   V8_EXPORT_PRIVATE bool SlowAsArrayIndex(uint32_t* index);
@@ -717,7 +725,9 @@ class ExternalString : public String {
   static const int kSize = kResourceDataOffset + kPointerSize;
 
   // Return whether external string is short (data pointer is not cached).
-  inline bool is_short();
+  inline bool is_short() const;
+  // Size in bytes of the external payload.
+  int ExternalPayloadSize() const;
 
   // Used in the serializer/deserializer.
   inline Address resource_as_address();
diff --git a/deps/v8/src/objects/template-objects.cc b/deps/v8/src/objects/template-objects.cc
index 24389c96a28494..1218ba5a7d134f 100644
--- a/deps/v8/src/objects/template-objects.cc
+++ b/deps/v8/src/objects/template-objects.cc
@@ -14,9 +14,7 @@ namespace internal {
 
 // static
 Handle<JSArray> TemplateObjectDescription::CreateTemplateObject(
-    Handle<TemplateObjectDescription> description) {
-  Isolate* const isolate = description->GetIsolate();
-
+    Isolate* isolate, Handle<TemplateObjectDescription> description) {
   // Create the raw object from the {raw_strings}.
   Handle<FixedArray> raw_strings(description->raw_strings(), isolate);
   Handle<JSArray> raw_object = isolate->factory()->NewJSArrayWithElements(
diff --git a/deps/v8/src/objects/template-objects.h b/deps/v8/src/objects/template-objects.h
index 6c1a99831a44fc..ad8ff95950fbb9 100644
--- a/deps/v8/src/objects/template-objects.h
+++ b/deps/v8/src/objects/template-objects.h
@@ -24,7 +24,7 @@ class TemplateObjectDescription final : public Tuple2 {
   DECL_ACCESSORS(cooked_strings, FixedArray)
 
   static Handle<JSArray> CreateTemplateObject(
-      Handle<TemplateObjectDescription> description);
+      Isolate* isolate, Handle<TemplateObjectDescription> description);
 
   DECL_CAST(TemplateObjectDescription)
 
diff --git a/deps/v8/src/objects/templates-inl.h b/deps/v8/src/objects/templates-inl.h
new file mode 100644
index 00000000000000..6473cfd1cfd582
--- /dev/null
+++ b/deps/v8/src/objects/templates-inl.h
@@ -0,0 +1,135 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef V8_OBJECTS_TEMPLATES_INL_H_
+#define V8_OBJECTS_TEMPLATES_INL_H_
+
+#include "src/objects/templates.h"
+
+#include "src/heap/heap-inl.h"
+#include "src/objects/shared-function-info-inl.h"
+
+// Has to be the last include (doesn't have include guards):
+#include "src/objects/object-macros.h"
+
+namespace v8 {
+namespace internal {
+
+ACCESSORS(TemplateInfo, tag, Object, kTagOffset)
+ACCESSORS(TemplateInfo, serial_number, Object, kSerialNumberOffset)
+SMI_ACCESSORS(TemplateInfo, number_of_properties, kNumberOfProperties)
+ACCESSORS(TemplateInfo, property_list, Object, kPropertyListOffset)
+ACCESSORS(TemplateInfo, property_accessors, Object, kPropertyAccessorsOffset)
+
+ACCESSORS(FunctionTemplateInfo, call_code, Object, kCallCodeOffset)
+ACCESSORS(FunctionTemplateInfo, prototype_template, Object,
+          kPrototypeTemplateOffset)
+ACCESSORS(FunctionTemplateInfo, prototype_provider_template, Object,
+          kPrototypeProviderTemplateOffset)
+ACCESSORS(FunctionTemplateInfo, parent_template, Object, kParentTemplateOffset)
+ACCESSORS(FunctionTemplateInfo, named_property_handler, Object,
+          kNamedPropertyHandlerOffset)
+ACCESSORS(FunctionTemplateInfo, indexed_property_handler, Object,
+          kIndexedPropertyHandlerOffset)
+ACCESSORS(FunctionTemplateInfo, instance_template, Object,
+          kInstanceTemplateOffset)
+ACCESSORS(FunctionTemplateInfo, class_name, Object, kClassNameOffset)
+ACCESSORS(FunctionTemplateInfo, signature, Object, kSignatureOffset)
+ACCESSORS(FunctionTemplateInfo, instance_call_handler, Object,
+          kInstanceCallHandlerOffset)
+ACCESSORS(FunctionTemplateInfo, access_check_info, Object,
+          kAccessCheckInfoOffset)
+ACCESSORS(FunctionTemplateInfo, shared_function_info, Object,
+          kSharedFunctionInfoOffset)
+ACCESSORS(FunctionTemplateInfo, cached_property_name, Object,
+          kCachedPropertyNameOffset)
+SMI_ACCESSORS(FunctionTemplateInfo, length, kLengthOffset)
+BOOL_ACCESSORS(FunctionTemplateInfo, flag, hidden_prototype,
+               kHiddenPrototypeBit)
+BOOL_ACCESSORS(FunctionTemplateInfo, flag, undetectable, kUndetectableBit)
+BOOL_ACCESSORS(FunctionTemplateInfo, flag, needs_access_check,
+               kNeedsAccessCheckBit)
+BOOL_ACCESSORS(FunctionTemplateInfo, flag, read_only_prototype,
+               kReadOnlyPrototypeBit)
+BOOL_ACCESSORS(FunctionTemplateInfo, flag, remove_prototype,
+               kRemovePrototypeBit)
+BOOL_ACCESSORS(FunctionTemplateInfo, flag, do_not_cache, kDoNotCacheBit)
+BOOL_ACCESSORS(FunctionTemplateInfo, flag, accept_any_receiver,
+               kAcceptAnyReceiver)
+SMI_ACCESSORS(FunctionTemplateInfo, flag, kFlagOffset)
+
+ACCESSORS(ObjectTemplateInfo, constructor, Object, kConstructorOffset)
+ACCESSORS(ObjectTemplateInfo, data, Object, kDataOffset)
+
+CAST_ACCESSOR(TemplateInfo)
+CAST_ACCESSOR(FunctionTemplateInfo)
+CAST_ACCESSOR(ObjectTemplateInfo)
+
+bool FunctionTemplateInfo::instantiated() {
+  return shared_function_info()->IsSharedFunctionInfo();
+}
+
+bool FunctionTemplateInfo::BreakAtEntry() {
+  Object* maybe_shared = shared_function_info();
+  if (maybe_shared->IsSharedFunctionInfo()) {
+    SharedFunctionInfo* shared = SharedFunctionInfo::cast(maybe_shared);
+    return shared->BreakAtEntry();
+  }
+  return false;
+}
+
+FunctionTemplateInfo* FunctionTemplateInfo::GetParent(Isolate* isolate) {
+  Object* parent = parent_template();
+  return parent->IsUndefined(isolate) ? nullptr
+                                      : FunctionTemplateInfo::cast(parent);
+}
+
+ObjectTemplateInfo* ObjectTemplateInfo::GetParent(Isolate* isolate) {
+  Object* maybe_ctor = constructor();
+  if (maybe_ctor->IsUndefined(isolate)) return nullptr;
+  FunctionTemplateInfo* constructor = FunctionTemplateInfo::cast(maybe_ctor);
+  while (true) {
+    constructor = constructor->GetParent(isolate);
+    if (constructor == nullptr) return nullptr;
+    Object* maybe_obj = constructor->instance_template();
+    if (!maybe_obj->IsUndefined(isolate)) {
+      return ObjectTemplateInfo::cast(maybe_obj);
+    }
+  }
+  return nullptr;
+}
+
+int ObjectTemplateInfo::embedder_field_count() const {
+  Object* value = data();
+  DCHECK(value->IsSmi());
+  return EmbedderFieldCount::decode(Smi::ToInt(value));
+}
+
+void ObjectTemplateInfo::set_embedder_field_count(int count) {
+  DCHECK_LE(count, JSObject::kMaxEmbedderFields);
+  return set_data(
+      Smi::FromInt(EmbedderFieldCount::update(Smi::ToInt(data()), count)));
+}
+
+bool ObjectTemplateInfo::immutable_proto() const {
+  Object* value = data();
+  DCHECK(value->IsSmi());
+  return IsImmutablePrototype::decode(Smi::ToInt(value));
+}
+
+void ObjectTemplateInfo::set_immutable_proto(bool immutable) {
+  return set_data(Smi::FromInt(
+      IsImmutablePrototype::update(Smi::ToInt(data()), immutable)));
+}
+
+bool FunctionTemplateInfo::IsTemplateFor(JSObject* object) {
+  return IsTemplateFor(object->map());
+}
+
+}  // namespace internal
+}  // namespace v8
+
+#include "src/objects/object-macros-undef.h"
+
+#endif  // V8_OBJECTS_TEMPLATES_INL_H_
diff --git a/deps/v8/src/objects/templates.h b/deps/v8/src/objects/templates.h
new file mode 100644
index 00000000000000..f9f0056a113b02
--- /dev/null
+++ b/deps/v8/src/objects/templates.h
@@ -0,0 +1,223 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef V8_OBJECTS_TEMPLATES_H_
+#define V8_OBJECTS_TEMPLATES_H_
+
+#include "src/objects.h"
+
+// Has to be the last include (doesn't have include guards):
+#include "src/objects/object-macros.h"
+
+namespace v8 {
+namespace internal {
+
+class TemplateInfo : public Struct {
+ public:
+  DECL_ACCESSORS(tag, Object)
+  DECL_ACCESSORS(serial_number, Object)
+  DECL_INT_ACCESSORS(number_of_properties)
+  DECL_ACCESSORS(property_list, Object)
+  DECL_ACCESSORS(property_accessors, Object)
+
+  DECL_VERIFIER(TemplateInfo)
+
+  DECL_CAST(TemplateInfo)
+
+  static const int kTagOffset = HeapObject::kHeaderSize;
+  static const int kSerialNumberOffset = kTagOffset + kPointerSize;
+  static const int kNumberOfProperties = kSerialNumberOffset + kPointerSize;
+  static const int kPropertyListOffset = kNumberOfProperties + kPointerSize;
+  static const int kPropertyAccessorsOffset =
+      kPropertyListOffset + kPointerSize;
+  static const int kHeaderSize = kPropertyAccessorsOffset + kPointerSize;
+
+  static const int kFastTemplateInstantiationsCacheSize = 1 * KB;
+
+  // While we could grow the slow cache until we run out of memory, we put
+  // a limit on it anyway to not crash for embedders that re-create templates
+  // instead of caching them.
+  static const int kSlowTemplateInstantiationsCacheSize = 1 * MB;
+
+ private:
+  DISALLOW_IMPLICIT_CONSTRUCTORS(TemplateInfo);
+};
+
+// See the api-exposed FunctionTemplate for more information.
+class FunctionTemplateInfo : public TemplateInfo {
+ public:
+  // Handler invoked when calling an instance of this FunctionTemplateInfo.
+  // Either CallInfoHandler or Undefined.
+  DECL_ACCESSORS(call_code, Object)
+
+  // ObjectTemplateInfo or Undefined, used for the prototype property of the
+  // resulting JSFunction instance of this FunctionTemplate.
+  DECL_ACCESSORS(prototype_template, Object)
+
+  // In the case the prototype_template is Undefined we use the
+  // protoype_provider_template to retrieve the instance prototype. Either
+  // contains an ObjectTemplateInfo or Undefined.
+  DECL_ACCESSORS(prototype_provider_template, Object)
+
+  // Used to create protoype chains. The parent_template's prototype is set as
+  // __proto__ of this FunctionTemplate's instance prototype. Is either a
+  // FunctionTemplateInfo or Undefined.
+  DECL_ACCESSORS(parent_template, Object)
+
+  // Returns an InterceptorInfo or Undefined for named properties.
+  DECL_ACCESSORS(named_property_handler, Object)
+  // Returns an InterceptorInfo or Undefined for indexed properties/elements.
+  DECL_ACCESSORS(indexed_property_handler, Object)
+
+  // An ObjectTemplateInfo that is used when instantiating the JSFunction
+  // associated with this FunctionTemplateInfo. Contains either an
+  // ObjectTemplateInfo or Undefined. A default instance_template is assigned
+  // upon first instantiation if it's Undefined.
+  DECL_ACCESSORS(instance_template, Object)
+
+  DECL_ACCESSORS(class_name, Object)
+
+  // If the signature is a FunctionTemplateInfo it is used to check whether the
+  // receiver calling the associated JSFunction is a compatible receiver, i.e.
+  // it is an instance of the signare FunctionTemplateInfo or any of the
+  // receiver's prototypes are.
+  DECL_ACCESSORS(signature, Object)
+
+  // Either a CallHandlerInfo or Undefined. If an instance_call_handler is
+  // provided the instances created from the associated JSFunction are marked as
+  // callable.
+  DECL_ACCESSORS(instance_call_handler, Object)
+
+  DECL_ACCESSORS(access_check_info, Object)
+  DECL_ACCESSORS(shared_function_info, Object)
+
+  // Internal field to store a flag bitfield.
+  DECL_INT_ACCESSORS(flag)
+
+  // "length" property of the final JSFunction.
+  DECL_INT_ACCESSORS(length)
+
+  // Either the_hole or a private symbol. Used to cache the result on
+  // the receiver under the the cached_property_name when this
+  // FunctionTemplateInfo is used as a getter.
+  DECL_ACCESSORS(cached_property_name, Object)
+
+  // Begin flag bits ---------------------
+  DECL_BOOLEAN_ACCESSORS(hidden_prototype)
+  DECL_BOOLEAN_ACCESSORS(undetectable)
+
+  // If set, object instances created by this function
+  // requires access check.
+  DECL_BOOLEAN_ACCESSORS(needs_access_check)
+
+  DECL_BOOLEAN_ACCESSORS(read_only_prototype)
+
+  // If set, do not create a prototype property for the associated
+  // JSFunction. This bit implies that neither the prototype_template nor the
+  // prototype_provoider_template are instantiated.
+  DECL_BOOLEAN_ACCESSORS(remove_prototype)
+
+  // If set, do not attach a serial number to this FunctionTemplate and thus do
+  // not keep an instance boilerplate around.
+  DECL_BOOLEAN_ACCESSORS(do_not_cache)
+
+  // If not set an access may be performed on calling the associated JSFunction.
+  DECL_BOOLEAN_ACCESSORS(accept_any_receiver)
+  // End flag bits ---------------------
+
+  DECL_CAST(FunctionTemplateInfo)
+
+  // Dispatched behavior.
+  DECL_PRINTER(FunctionTemplateInfo)
+  DECL_VERIFIER(FunctionTemplateInfo)
+
+  static const int kInvalidSerialNumber = 0;
+
+  static const int kCallCodeOffset = TemplateInfo::kHeaderSize;
+  static const int kPrototypeTemplateOffset = kCallCodeOffset + kPointerSize;
+  static const int kPrototypeProviderTemplateOffset =
+      kPrototypeTemplateOffset + kPointerSize;
+  static const int kParentTemplateOffset =
+      kPrototypeProviderTemplateOffset + kPointerSize;
+  static const int kNamedPropertyHandlerOffset =
+      kParentTemplateOffset + kPointerSize;
+  static const int kIndexedPropertyHandlerOffset =
+      kNamedPropertyHandlerOffset + kPointerSize;
+  static const int kInstanceTemplateOffset =
+      kIndexedPropertyHandlerOffset + kPointerSize;
+  static const int kClassNameOffset = kInstanceTemplateOffset + kPointerSize;
+  static const int kSignatureOffset = kClassNameOffset + kPointerSize;
+  static const int kInstanceCallHandlerOffset = kSignatureOffset + kPointerSize;
+  static const int kAccessCheckInfoOffset =
+      kInstanceCallHandlerOffset + kPointerSize;
+  static const int kSharedFunctionInfoOffset =
+      kAccessCheckInfoOffset + kPointerSize;
+  static const int kFlagOffset = kSharedFunctionInfoOffset + kPointerSize;
+  static const int kLengthOffset = kFlagOffset + kPointerSize;
+  static const int kCachedPropertyNameOffset = kLengthOffset + kPointerSize;
+  static const int kSize = kCachedPropertyNameOffset + kPointerSize;
+
+  static Handle<SharedFunctionInfo> GetOrCreateSharedFunctionInfo(
+      Isolate* isolate, Handle<FunctionTemplateInfo> info,
+      MaybeHandle<Name> maybe_name);
+  // Returns parent function template or null.
+  inline FunctionTemplateInfo* GetParent(Isolate* isolate);
+  // Returns true if |object| is an instance of this function template.
+  inline bool IsTemplateFor(JSObject* object);
+  bool IsTemplateFor(Map* map);
+  inline bool instantiated();
+
+  inline bool BreakAtEntry();
+
+  // Helper function for cached accessors.
+  static MaybeHandle<Name> TryGetCachedPropertyName(Isolate* isolate,
+                                                    Handle<Object> getter);
+
+ private:
+  // Bit position in the flag, from least significant bit position.
+  static const int kHiddenPrototypeBit = 0;
+  static const int kUndetectableBit = 1;
+  static const int kNeedsAccessCheckBit = 2;
+  static const int kReadOnlyPrototypeBit = 3;
+  static const int kRemovePrototypeBit = 4;
+  static const int kDoNotCacheBit = 5;
+  static const int kAcceptAnyReceiver = 6;
+
+  DISALLOW_IMPLICIT_CONSTRUCTORS(FunctionTemplateInfo);
+};
+
+class ObjectTemplateInfo : public TemplateInfo {
+ public:
+  DECL_ACCESSORS(constructor, Object)
+  DECL_ACCESSORS(data, Object)
+  DECL_INT_ACCESSORS(embedder_field_count)
+  DECL_BOOLEAN_ACCESSORS(immutable_proto)
+
+  DECL_CAST(ObjectTemplateInfo)
+
+  // Dispatched behavior.
+  DECL_PRINTER(ObjectTemplateInfo)
+  DECL_VERIFIER(ObjectTemplateInfo)
+
+  static const int kConstructorOffset = TemplateInfo::kHeaderSize;
+  // LSB is for immutable_proto, higher bits for embedder_field_count
+  static const int kDataOffset = kConstructorOffset + kPointerSize;
+  static const int kSize = kDataOffset + kPointerSize;
+
+  // Starting from given object template's constructor walk up the inheritance
+  // chain till a function template that has an instance template is found.
+  inline ObjectTemplateInfo* GetParent(Isolate* isolate);
+
+ private:
+  class IsImmutablePrototype : public BitField<bool, 0, 1> {};
+  class EmbedderFieldCount
+      : public BitField<int, IsImmutablePrototype::kNext, 29> {};
+};
+
+}  // namespace internal
+}  // namespace v8
+
+#include "src/objects/object-macros-undef.h"
+
+#endif  // V8_OBJECTS_TEMPLATES_H_
diff --git a/deps/v8/src/optimized-compilation-info.cc b/deps/v8/src/optimized-compilation-info.cc
index 2b211c2fdf8cee..09b8a0edeae734 100644
--- a/deps/v8/src/optimized-compilation-info.cc
+++ b/deps/v8/src/optimized-compilation-info.cc
@@ -23,12 +23,11 @@ OptimizedCompilationInfo::OptimizedCompilationInfo(
   shared_info_ = shared;
   closure_ = closure;
   optimization_id_ = isolate->NextOptimizationId();
-  dependencies_.reset(new CompilationDependencies(isolate, zone));
 
   SetFlag(kCalledWithCodeStartRegister);
   if (FLAG_function_context_specialization) MarkAsFunctionContextSpecializing();
   if (FLAG_turbo_splitting) MarkAsSplittingEnabled();
-  if (!FLAG_turbo_disable_switch_jump_table) SetFlag(kSwitchJumpTableEnabled);
+  SetFlag(kSwitchJumpTableEnabled);
   if (FLAG_untrusted_code_mitigations) MarkAsPoisoningRegisterArguments();
 
   // TODO(yangguo): Disable this in case of debugging for crbug.com/826613
@@ -42,6 +41,8 @@ OptimizedCompilationInfo::OptimizedCompilationInfo(
   if (isolate->NeedsSourcePositionsForProfiling()) {
     MarkAsSourcePositionsEnabled();
   }
+
+  SetTracingFlags(shared->PassesFilter(FLAG_trace_turbo_filter));
 }
 
 OptimizedCompilationInfo::OptimizedCompilationInfo(
@@ -58,6 +59,13 @@ OptimizedCompilationInfo::OptimizedCompilationInfo(
   }
 #endif
 #endif
+  SetTracingFlags(
+      PassesFilter(debug_name, CStrVector(FLAG_trace_turbo_filter)));
+  // Embedded builtins don't support embedded absolute code addresses, so we
+  // cannot use jump tables.
+  if (code_kind != Code::BUILTIN) {
+    SetFlag(kSwitchJumpTableEnabled);
+  }
 }
 
 OptimizedCompilationInfo::OptimizedCompilationInfo(
@@ -69,7 +77,6 @@ OptimizedCompilationInfo::OptimizedCompilationInfo(
       osr_offset_(BailoutId::None()),
       zone_(zone),
       deferred_handles_(nullptr),
-      dependencies_(nullptr),
       bailout_reason_(BailoutReason::kNoReason),
       optimization_id_(-1),
       debug_name_(debug_name) {}
@@ -78,9 +85,6 @@ OptimizedCompilationInfo::~OptimizedCompilationInfo() {
   if (GetFlag(kDisableFutureOptimization) && has_shared_info()) {
     shared_info()->DisableOptimization(bailout_reason());
   }
-  if (dependencies()) {
-    dependencies()->Rollback();
-  }
 }
 
 void OptimizedCompilationInfo::set_deferred_handles(
@@ -95,12 +99,12 @@ void OptimizedCompilationInfo::set_deferred_handles(
   deferred_handles_.reset(deferred_handles);
 }
 
-void OptimizedCompilationInfo::ReopenHandlesInNewHandleScope() {
+void OptimizedCompilationInfo::ReopenHandlesInNewHandleScope(Isolate* isolate) {
   if (!shared_info_.is_null()) {
-    shared_info_ = Handle<SharedFunctionInfo>(*shared_info_);
+    shared_info_ = Handle<SharedFunctionInfo>(*shared_info_, isolate);
   }
   if (!closure_.is_null()) {
-    closure_ = Handle<JSFunction>(*closure_);
+    closure_ = Handle<JSFunction>(*closure_, isolate);
   }
 }
 
@@ -167,5 +171,12 @@ int OptimizedCompilationInfo::AddInlinedFunction(
   return id;
 }
 
+void OptimizedCompilationInfo::SetTracingFlags(bool passes_filter) {
+  if (!passes_filter) return;
+  if (FLAG_trace_turbo) SetFlag(kTraceTurboJson);
+  if (FLAG_trace_turbo_graph) SetFlag(kTraceTurboGraph);
+  if (FLAG_trace_turbo_scheduled) SetFlag(kTraceTurboScheduled);
+}
+
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/src/optimized-compilation-info.h b/deps/v8/src/optimized-compilation-info.h
index f168db373a4a3c..a8cb8d220bfd79 100644
--- a/deps/v8/src/optimized-compilation-info.h
+++ b/deps/v8/src/optimized-compilation-info.h
@@ -7,7 +7,8 @@
 
 #include <memory>
 
-#include "src/compilation-dependencies.h"
+#include "src/bailout-reason.h"
+#include "src/code-reference.h"
 #include "src/feedback-vector.h"
 #include "src/frames.h"
 #include "src/globals.h"
@@ -41,37 +42,27 @@ class V8_EXPORT_PRIVATE OptimizedCompilationInfo final {
     kAccessorInliningEnabled = 1 << 0,
     kFunctionContextSpecializing = 1 << 1,
     kInliningEnabled = 1 << 2,
-    kPoisonLoads = 1 << 3,
-    kDisableFutureOptimization = 1 << 4,
-    kSplittingEnabled = 1 << 5,
-    kSourcePositionsEnabled = 1 << 6,
-    kBailoutOnUninitialized = 1 << 7,
-    kLoopPeelingEnabled = 1 << 8,
-    kUntrustedCodeMitigations = 1 << 9,
-    kSwitchJumpTableEnabled = 1 << 10,
-    kCalledWithCodeStartRegister = 1 << 11,
-    kPoisonRegisterArguments = 1 << 12,
-    kAllocationFoldingEnabled = 1 << 13,
-    kAnalyzeEnvironmentLiveness = 1 << 14,
-  };
-
-  // TODO(mtrofin): investigate if this might be generalized outside wasm, with
-  // the goal of better separating the compiler from where compilation lands. At
-  // that point, the Handle<Code> member of OptimizedCompilationInfo would also
-  // be removed.
-  struct WasmCodeDesc {
-    CodeDesc code_desc;
-    size_t safepoint_table_offset = 0;
-    size_t handler_table_offset = 0;
-    uint32_t frame_slot_count = 0;
-    Handle<ByteArray> source_positions_table;
+    kDisableFutureOptimization = 1 << 3,
+    kSplittingEnabled = 1 << 4,
+    kSourcePositionsEnabled = 1 << 5,
+    kBailoutOnUninitialized = 1 << 6,
+    kLoopPeelingEnabled = 1 << 7,
+    kUntrustedCodeMitigations = 1 << 8,
+    kSwitchJumpTableEnabled = 1 << 9,
+    kCalledWithCodeStartRegister = 1 << 10,
+    kPoisonRegisterArguments = 1 << 11,
+    kAllocationFoldingEnabled = 1 << 12,
+    kAnalyzeEnvironmentLiveness = 1 << 13,
+    kTraceTurboJson = 1 << 14,
+    kTraceTurboGraph = 1 << 15,
+    kTraceTurboScheduled = 1 << 16,
   };
 
   // Construct a compilation info for optimized compilation.
   OptimizedCompilationInfo(Zone* zone, Isolate* isolate,
                            Handle<SharedFunctionInfo> shared,
                            Handle<JSFunction> closure);
-  // Construct a compilation info for stub compilation (or testing).
+  // Construct a compilation info for stub compilation, Wasm, and testing.
   OptimizedCompilationInfo(Vector<const char> debug_name, Zone* zone,
                            Code::Kind code_kind);
 
@@ -82,7 +73,11 @@ class V8_EXPORT_PRIVATE OptimizedCompilationInfo final {
   Handle<SharedFunctionInfo> shared_info() const { return shared_info_; }
   bool has_shared_info() const { return !shared_info().is_null(); }
   Handle<JSFunction> closure() const { return closure_; }
-  Handle<Code> code() const { return code_; }
+  Handle<Code> code() const { return code_.as_js_code(); }
+
+  wasm::WasmCode* wasm_code() const {
+    return const_cast<wasm::WasmCode*>(code_.as_wasm_code());
+  }
   AbstractCode::Kind abstract_code_kind() const { return code_kind_; }
   Code::Kind code_kind() const {
     DCHECK(code_kind_ < static_cast<AbstractCode::Kind>(Code::NUMBER_OF_KINDS));
@@ -117,8 +112,12 @@ class V8_EXPORT_PRIVATE OptimizedCompilationInfo final {
   void MarkAsInliningEnabled() { SetFlag(kInliningEnabled); }
   bool is_inlining_enabled() const { return GetFlag(kInliningEnabled); }
 
-  void MarkAsPoisonLoads() { SetFlag(kPoisonLoads); }
-  bool is_poison_loads() const { return GetFlag(kPoisonLoads); }
+  void SetPoisoningMitigationLevel(PoisoningMitigationLevel poisoning_level) {
+    poisoning_level_ = poisoning_level;
+  }
+  PoisoningMitigationLevel GetPoisoningMitigationLevel() const {
+    return poisoning_level_;
+  }
 
   void MarkAsSplittingEnabled() { SetFlag(kSplittingEnabled); }
   bool is_splitting_enabled() const { return GetFlag(kSplittingEnabled); }
@@ -167,9 +166,20 @@ class V8_EXPORT_PRIVATE OptimizedCompilationInfo final {
     return GetFlag(kAnalyzeEnvironmentLiveness);
   }
 
+  bool trace_turbo_json_enabled() const { return GetFlag(kTraceTurboJson); }
+
+  bool trace_turbo_graph_enabled() const { return GetFlag(kTraceTurboGraph); }
+
+  bool trace_turbo_scheduled_enabled() const {
+    return GetFlag(kTraceTurboScheduled);
+  }
+
   // Code getters and setters.
 
-  void SetCode(Handle<Code> code) { code_ = code; }
+  template <typename T>
+  void SetCode(T code) {
+    code_ = CodeReference(code);
+  }
 
   bool has_context() const;
   Context* context() const;
@@ -203,7 +213,7 @@ class V8_EXPORT_PRIVATE OptimizedCompilationInfo final {
     return deferred_handles_;
   }
 
-  void ReopenHandlesInNewHandleScope();
+  void ReopenHandlesInNewHandleScope(Isolate* isolate);
 
   void AbortOptimization(BailoutReason reason) {
     DCHECK_NE(reason, BailoutReason::kNoReason);
@@ -219,8 +229,6 @@ class V8_EXPORT_PRIVATE OptimizedCompilationInfo final {
 
   BailoutReason bailout_reason() const { return bailout_reason_; }
 
-  CompilationDependencies* dependencies() { return dependencies_.get(); }
-
   int optimization_id() const {
     DCHECK(IsOptimizing());
     return optimization_id_;
@@ -255,7 +263,13 @@ class V8_EXPORT_PRIVATE OptimizedCompilationInfo final {
 
   StackFrame::Type GetOutputStackFrameType() const;
 
-  WasmCodeDesc* wasm_code_desc() { return &wasm_code_desc_; }
+  const char* trace_turbo_filename() const {
+    return trace_turbo_filename_.get();
+  }
+
+  void set_trace_turbo_filename(std::unique_ptr<char[]> filename) {
+    trace_turbo_filename_ = std::move(filename);
+  }
 
  private:
   OptimizedCompilationInfo(Vector<const char> debug_name,
@@ -264,8 +278,12 @@ class V8_EXPORT_PRIVATE OptimizedCompilationInfo final {
   void SetFlag(Flag flag) { flags_ |= flag; }
   bool GetFlag(Flag flag) const { return (flags_ & flag) != 0; }
 
+  void SetTracingFlags(bool passes_filter);
+
   // Compilation flags.
   unsigned flags_;
+  PoisoningMitigationLevel poisoning_level_ =
+      PoisoningMitigationLevel::kDontPoison;
 
   AbstractCode::Kind code_kind_;
   uint32_t stub_key_;
@@ -276,8 +294,7 @@ class V8_EXPORT_PRIVATE OptimizedCompilationInfo final {
   Handle<JSFunction> closure_;
 
   // The compiled code.
-  Handle<Code> code_;
-  WasmCodeDesc wasm_code_desc_;
+  CodeReference code_;
 
   // Entry point when compiling for OSR, {BailoutId::None} otherwise.
   BailoutId osr_offset_;
@@ -288,9 +305,6 @@ class V8_EXPORT_PRIVATE OptimizedCompilationInfo final {
 
   std::shared_ptr<DeferredHandles> deferred_handles_;
 
-  // Dependencies for this compilation, e.g. stable maps.
-  std::unique_ptr<CompilationDependencies> dependencies_;
-
   BailoutReason bailout_reason_;
 
   InlinedFunctionList inlined_functions_;
@@ -301,6 +315,7 @@ class V8_EXPORT_PRIVATE OptimizedCompilationInfo final {
   JavaScriptFrame* osr_frame_ = nullptr;
 
   Vector<const char> debug_name_;
+  std::unique_ptr<char[]> trace_turbo_filename_;
 
   DISALLOW_COPY_AND_ASSIGN(OptimizedCompilationInfo);
 };
diff --git a/deps/v8/src/ostreams.cc b/deps/v8/src/ostreams.cc
index 66b57020ade97d..04486354cbada9 100644
--- a/deps/v8/src/ostreams.cc
+++ b/deps/v8/src/ostreams.cc
@@ -12,6 +12,11 @@
 #endif
 #endif
 
+#if defined(ANDROID) && !defined(V8_ANDROID_LOG_STDOUT)
+#define LOG_TAG "v8"
+#include <android/log.h>  // NOLINT
+#endif
+
 namespace v8 {
 namespace internal {
 
@@ -37,7 +42,6 @@ std::streamsize OFStreamBase::xsputn(const char* s, std::streamsize n) {
       std::fwrite(s, 1, static_cast<size_t>(n), f_));
 }
 
-
 OFStream::OFStream(FILE* f) : std::ostream(nullptr), buf_(f) {
   DCHECK_NOT_NULL(f);
   rdbuf(&buf_);
@@ -46,6 +50,32 @@ OFStream::OFStream(FILE* f) : std::ostream(nullptr), buf_(f) {
 
 OFStream::~OFStream() {}
 
+#if defined(ANDROID) && !defined(V8_ANDROID_LOG_STDOUT)
+AndroidLogStream::~AndroidLogStream() {
+  // If there is anything left in the line buffer, print it now, even though it
+  // was not terminated by a newline.
+  if (!line_buffer_.empty()) {
+    __android_log_write(ANDROID_LOG_INFO, LOG_TAG, line_buffer_.c_str());
+  }
+}
+
+std::streamsize AndroidLogStream::xsputn(const char* s, std::streamsize n) {
+  const char* const e = s + n;
+  while (s < e) {
+    const char* newline = reinterpret_cast<const char*>(memchr(s, '\n', e - s));
+    size_t line_chars = (newline ? newline : e) - s;
+    line_buffer_.append(s, line_chars);
+    // Without terminating newline, keep the characters in the buffer for the
+    // next invocation.
+    if (!newline) break;
+    // Otherwise, write out the first line, then continue.
+    __android_log_write(ANDROID_LOG_INFO, LOG_TAG, line_buffer_.c_str());
+    line_buffer_.clear();
+    s = newline + 1;
+  }
+  return n;
+}
+#endif
 
 namespace {
 
@@ -131,3 +161,6 @@ std::ostream& operator<<(std::ostream& os, const AsHexBytes& hex) {
 
 }  // namespace internal
 }  // namespace v8
+
+#undef snprintf
+#undef LOG_TAG
diff --git a/deps/v8/src/ostreams.h b/deps/v8/src/ostreams.h
index f2f961e379c45a..c6b64a1cd95b92 100644
--- a/deps/v8/src/ostreams.h
+++ b/deps/v8/src/ostreams.h
@@ -18,7 +18,6 @@
 namespace v8 {
 namespace internal {
 
-
 class OFStreamBase : public std::streambuf {
  public:
   explicit OFStreamBase(FILE* f);
@@ -27,12 +26,11 @@ class OFStreamBase : public std::streambuf {
  protected:
   FILE* const f_;
 
-  virtual int sync();
-  virtual int_type overflow(int_type c);
-  virtual std::streamsize xsputn(const char* s, std::streamsize n);
+  int sync() override;
+  int_type overflow(int_type c) override;
+  std::streamsize xsputn(const char* s, std::streamsize n) override;
 };
 
-
 // An output stream writing to a file.
 class V8_EXPORT_PRIVATE OFStream : public std::ostream {
  public:
@@ -43,6 +41,31 @@ class V8_EXPORT_PRIVATE OFStream : public std::ostream {
   OFStreamBase buf_;
 };
 
+#if defined(ANDROID) && !defined(V8_ANDROID_LOG_STDOUT)
+class V8_EXPORT_PRIVATE AndroidLogStream : public std::streambuf {
+ public:
+  virtual ~AndroidLogStream();
+
+ protected:
+  std::streamsize xsputn(const char* s, std::streamsize n) override;
+
+ private:
+  std::string line_buffer_;
+};
+
+class StdoutStream : public std::ostream {
+ public:
+  StdoutStream() : std::ostream(&stream_) {}
+
+ private:
+  AndroidLogStream stream_;
+};
+#else
+class StdoutStream : public OFStream {
+ public:
+  StdoutStream() : OFStream(stdout) {}
+};
+#endif
 
 // Wrappers to disambiguate uint16_t and uc16.
 struct AsUC16 {
@@ -92,6 +115,23 @@ struct AsHexBytes {
   ByteOrder byte_order;
 };
 
+template <typename T>
+struct PrintIteratorRange {
+  T start;
+  T end;
+  PrintIteratorRange(T start, T end) : start(start), end(end) {}
+};
+
+// Print any collection which can be iterated via std::begin and std::end.
+// {Iterator} is the common type of {std::begin} and {std::end} called on a
+// {const T&}. This function is only instantiable if that type exists.
+template <typename T, typename Iterator = typename std::common_type<
+                          decltype(std::begin(std::declval<const T&>())),
+                          decltype(std::end(std::declval<const T&>()))>::type>
+PrintIteratorRange<Iterator> PrintCollection(const T& collection) {
+  return {std::begin(collection), std::end(collection)};
+}
+
 // Writes the given character to the output escaping everything outside of
 // printable/space ASCII range. Additionally escapes '\' making escaping
 // reversible.
@@ -113,6 +153,17 @@ V8_EXPORT_PRIVATE std::ostream& operator<<(std::ostream& os, const AsHex& v);
 V8_EXPORT_PRIVATE std::ostream& operator<<(std::ostream& os,
                                            const AsHexBytes& v);
 
+template <typename T>
+std::ostream& operator<<(std::ostream& os, const PrintIteratorRange<T>& range) {
+  const char* comma = "";
+  os << "[";
+  for (T it = range.start; it != range.end; ++it, comma = ", ") {
+    os << comma << *it;
+  }
+  os << "]";
+  return os;
+}
+
 }  // namespace internal
 }  // namespace v8
 
diff --git a/deps/v8/src/parsing/expression-scope-reparenter.cc b/deps/v8/src/parsing/expression-scope-reparenter.cc
index bdb0aeadd6d637..30e96d16881bac 100644
--- a/deps/v8/src/parsing/expression-scope-reparenter.cc
+++ b/deps/v8/src/parsing/expression-scope-reparenter.cc
@@ -55,7 +55,7 @@ void Reparenter::VisitClassLiteral(ClassLiteral* class_literal) {
 #if DEBUG
   // The same goes for the rest of the class, but we do some
   // sanity checking in debug mode.
-  ZoneList<ClassLiteralProperty*>* props = class_literal->properties();
+  ZonePtrList<ClassLiteralProperty>* props = class_literal->properties();
   for (int i = 0; i < props->length(); ++i) {
     ClassLiteralProperty* prop = props->at(i);
     // No need to visit the values, since all values are functions with
@@ -74,7 +74,7 @@ void Reparenter::VisitVariableProxy(VariableProxy* proxy) {
     }
   } else {
     // Ensure that temporaries we find are already in the correct scope.
-    DCHECK(proxy->var()->mode() != TEMPORARY ||
+    DCHECK(proxy->var()->mode() != VariableMode::kTemporary ||
            proxy->var()->scope() == scope_->GetClosureScope());
   }
 }
diff --git a/deps/v8/src/parsing/parse-info.cc b/deps/v8/src/parsing/parse-info.cc
index 451d2e81319217..9ec37373e85d82 100644
--- a/deps/v8/src/parsing/parse-info.cc
+++ b/deps/v8/src/parsing/parse-info.cc
@@ -16,7 +16,7 @@
 namespace v8 {
 namespace internal {
 
-ParseInfo::ParseInfo(AccountingAllocator* zone_allocator)
+ParseInfo::ParseInfo(Isolate* isolate, AccountingAllocator* zone_allocator)
     : zone_(std::make_shared<Zone>(zone_allocator, ZONE_NAME)),
       flags_(0),
       extension_(nullptr),
@@ -25,6 +25,7 @@ ParseInfo::ParseInfo(AccountingAllocator* zone_allocator)
       stack_limit_(0),
       hash_seed_(0),
       function_flags_(0),
+      script_id_(-1),
       start_position_(0),
       end_position_(0),
       parameters_end_pos_(kNoSourcePosition),
@@ -36,13 +37,25 @@ ParseInfo::ParseInfo(AccountingAllocator* zone_allocator)
       function_name_(nullptr),
       runtime_call_stats_(nullptr),
       source_range_map_(nullptr),
-      literal_(nullptr) {}
+      literal_(nullptr) {
+  set_hash_seed(isolate->heap()->HashSeed());
+  set_stack_limit(isolate->stack_guard()->real_climit());
+  set_unicode_cache(isolate->unicode_cache());
+  set_runtime_call_stats(isolate->counters()->runtime_call_stats());
+  set_logger(isolate->logger());
+  set_ast_string_constants(isolate->ast_string_constants());
+  if (isolate->is_block_code_coverage()) set_block_coverage_enabled();
+  if (isolate->is_collecting_type_profile()) set_collect_type_profile();
+}
 
-ParseInfo::ParseInfo(Handle<SharedFunctionInfo> shared)
-    : ParseInfo(shared->GetIsolate()->allocator()) {
-  Isolate* isolate = shared->GetIsolate();
-  InitFromIsolate(isolate);
+ParseInfo::ParseInfo(Isolate* isolate)
+    : ParseInfo(isolate, isolate->allocator()) {
+  script_id_ = isolate->heap()->NextScriptId();
+  LOG(isolate, ScriptEvent(Logger::ScriptEventType::kReserveId, script_id_));
+}
 
+ParseInfo::ParseInfo(Isolate* isolate, Handle<SharedFunctionInfo> shared)
+    : ParseInfo(isolate, isolate->allocator()) {
   // Do not support re-parsing top-level function of a wrapped script.
   // TODO(yangguo): consider whether we need a top-level function in a
   //                wrapped script at all.
@@ -59,15 +72,11 @@ ParseInfo::ParseInfo(Handle<SharedFunctionInfo> shared)
   set_language_mode(shared->language_mode());
   set_asm_wasm_broken(shared->is_asm_wasm_broken());
 
-  Handle<Script> script(Script::cast(shared->script()));
+  Handle<Script> script(Script::cast(shared->script()), isolate);
   set_script(script);
-  set_native(script->type() == Script::TYPE_NATIVE);
-  set_eval(script->compilation_type() == Script::COMPILATION_TYPE_EVAL);
-  set_module(script->origin_options().IsModule());
-  DCHECK(!(is_eval() && is_module()));
 
   if (shared->HasOuterScopeInfo()) {
-    set_outer_scope_info(handle(shared->GetOuterScopeInfo()));
+    set_outer_scope_info(handle(shared->GetOuterScopeInfo(), isolate));
   }
 
   // CollectTypeProfile uses its own feedback slots. If we have existing
@@ -78,70 +87,17 @@ ParseInfo::ParseInfo(Handle<SharedFunctionInfo> shared)
       (shared->HasFeedbackMetadata()
            ? shared->feedback_metadata()->HasTypeProfileSlot()
            : script->IsUserJavaScript()));
-  if (block_coverage_enabled() && script->IsUserJavaScript()) {
-    AllocateSourceRangeMap();
-  }
 }
 
-ParseInfo::ParseInfo(Handle<Script> script)
-    : ParseInfo(script->GetIsolate()->allocator()) {
-  InitFromIsolate(script->GetIsolate());
-
-  set_allow_lazy_parsing();
-  set_toplevel();
-  set_script(script);
-  set_wrapped_as_function(script->is_wrapped());
-
-  set_native(script->type() == Script::TYPE_NATIVE);
-  set_eval(script->compilation_type() == Script::COMPILATION_TYPE_EVAL);
-  set_module(script->origin_options().IsModule());
-  DCHECK(!(is_eval() && is_module()));
-
-  set_collect_type_profile(script->GetIsolate()->is_collecting_type_profile() &&
+ParseInfo::ParseInfo(Isolate* isolate, Handle<Script> script)
+    : ParseInfo(isolate, isolate->allocator()) {
+  SetScriptForToplevelCompile(isolate, script);
+  set_collect_type_profile(isolate->is_collecting_type_profile() &&
                            script->IsUserJavaScript());
-  if (block_coverage_enabled() && script->IsUserJavaScript()) {
-    AllocateSourceRangeMap();
-  }
 }
 
 ParseInfo::~ParseInfo() {}
 
-// static
-ParseInfo* ParseInfo::AllocateWithoutScript(Handle<SharedFunctionInfo> shared) {
-  Isolate* isolate = shared->GetIsolate();
-  ParseInfo* p = new ParseInfo(isolate->allocator());
-
-  p->InitFromIsolate(isolate);
-  p->set_toplevel(shared->is_toplevel());
-  p->set_allow_lazy_parsing(FLAG_lazy_inner_functions);
-  p->set_is_named_expression(shared->is_named_expression());
-  p->set_function_flags(shared->flags());
-  p->set_start_position(shared->StartPosition());
-  p->set_end_position(shared->EndPosition());
-  p->function_literal_id_ = shared->function_literal_id();
-  p->set_language_mode(shared->language_mode());
-
-  // BUG(5946): This function exists as a workaround until we can
-  // get rid of %SetCode in our native functions. The ParseInfo
-  // is explicitly set up for the case that:
-  // a) you have a native built-in,
-  // b) it's being run for the 2nd-Nth time in an isolate,
-  // c) we've already compiled bytecode and therefore don't need
-  //    to parse.
-  // We tolerate a ParseInfo without a Script in this case.
-  p->set_native(true);
-  p->set_eval(false);
-  p->set_module(false);
-  DCHECK_NE(shared->kind(), FunctionKind::kModule);
-
-  Handle<HeapObject> scope_info(shared->GetOuterScopeInfo());
-  if (!scope_info->IsTheHole(isolate) &&
-      Handle<ScopeInfo>::cast(scope_info)->length() > 0) {
-    p->set_outer_scope_info(Handle<ScopeInfo>::cast(scope_info));
-  }
-  return p;
-}
-
 DeclarationScope* ParseInfo::scope() const { return literal()->scope(); }
 
 bool ParseInfo::is_declaration() const {
@@ -157,18 +113,6 @@ bool ParseInfo::requires_instance_fields_initializer() const {
       function_flags_);
 }
 
-void ParseInfo::InitFromIsolate(Isolate* isolate) {
-  DCHECK_NOT_NULL(isolate);
-  set_hash_seed(isolate->heap()->HashSeed());
-  set_stack_limit(isolate->stack_guard()->real_climit());
-  set_unicode_cache(isolate->unicode_cache());
-  set_runtime_call_stats(isolate->counters()->runtime_call_stats());
-  set_logger(isolate->logger());
-  set_ast_string_constants(isolate->ast_string_constants());
-  if (isolate->is_block_code_coverage()) set_block_coverage_enabled();
-  if (isolate->is_collecting_type_profile()) set_collect_type_profile();
-}
-
 void ParseInfo::EmitBackgroundParseStatisticsOnBackgroundThread() {
   // If runtime call stats was enabled by tracing, emit a trace event at the
   // end of background parsing on the background thread.
@@ -202,6 +146,38 @@ void ParseInfo::ShareZone(ParseInfo* other) {
   zone_ = other->zone_;
 }
 
+Handle<Script> ParseInfo::CreateScript(Isolate* isolate, Handle<String> source,
+                                       ScriptOriginOptions origin_options,
+                                       NativesFlag natives) {
+  // Create a script object describing the script to be compiled.
+  Handle<Script> script;
+  if (script_id_ == -1) {
+    script = isolate->factory()->NewScript(source);
+  } else {
+    script = isolate->factory()->NewScriptWithId(source, script_id_);
+  }
+  if (isolate->NeedsSourcePositionsForProfiling()) {
+    Script::InitLineEnds(script);
+  }
+  switch (natives) {
+    case NATIVES_CODE:
+      script->set_type(Script::TYPE_NATIVE);
+      break;
+    case EXTENSION_CODE:
+      script->set_type(Script::TYPE_EXTENSION);
+      break;
+    case INSPECTOR_CODE:
+      script->set_type(Script::TYPE_INSPECTOR);
+      break;
+    case NOT_NATIVES_CODE:
+      break;
+  }
+  script->set_origin_options(origin_options);
+
+  SetScriptForToplevelCompile(isolate, script);
+  return script;
+}
+
 AstValueFactory* ParseInfo::GetOrCreateAstValueFactory() {
   if (!ast_value_factory_.get()) {
     ast_value_factory_.reset(
@@ -228,5 +204,30 @@ void ParseInfo::set_character_stream(
   character_stream_.swap(character_stream);
 }
 
+void ParseInfo::SetScriptForToplevelCompile(Isolate* isolate,
+                                            Handle<Script> script) {
+  set_script(script);
+  set_allow_lazy_parsing();
+  set_toplevel();
+  set_collect_type_profile(isolate->is_collecting_type_profile() &&
+                           script->IsUserJavaScript());
+  set_wrapped_as_function(script->is_wrapped());
+}
+
+void ParseInfo::set_script(Handle<Script> script) {
+  script_ = script;
+  DCHECK(script_id_ == -1 || script_id_ == script->id());
+  script_id_ = script->id();
+
+  set_native(script->type() == Script::TYPE_NATIVE);
+  set_eval(script->compilation_type() == Script::COMPILATION_TYPE_EVAL);
+  set_module(script->origin_options().IsModule());
+  DCHECK(!(is_eval() && is_module()));
+
+  if (block_coverage_enabled() && script->IsUserJavaScript()) {
+    AllocateSourceRangeMap();
+  }
+}
+
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/src/parsing/parse-info.h b/deps/v8/src/parsing/parse-info.h
index 08f15c865c97db..75ed6a3802d0e4 100644
--- a/deps/v8/src/parsing/parse-info.h
+++ b/deps/v8/src/parsing/parse-info.h
@@ -37,15 +37,16 @@ class Zone;
 // A container for the inputs, configuration options, and outputs of parsing.
 class V8_EXPORT_PRIVATE ParseInfo {
  public:
-  explicit ParseInfo(AccountingAllocator* zone_allocator);
-  ParseInfo(Handle<Script> script);
-  ParseInfo(Handle<SharedFunctionInfo> shared);
+  ParseInfo(Isolate*);
+  ParseInfo(Isolate*, AccountingAllocator* zone_allocator);
+  ParseInfo(Isolate* isolate, Handle<Script> script);
+  ParseInfo(Isolate* isolate, Handle<SharedFunctionInfo> shared);
 
   ~ParseInfo();
 
-  void InitFromIsolate(Isolate* isolate);
-
-  static ParseInfo* AllocateWithoutScript(Handle<SharedFunctionInfo> shared);
+  Handle<Script> CreateScript(Isolate* isolate, Handle<String> source,
+                              ScriptOriginOptions origin_options,
+                              NativesFlag natives = NOT_NATIVES_CODE);
 
   // Either returns the ast-value-factory associcated with this ParseInfo, or
   // creates and returns a new factory if none exists.
@@ -207,11 +208,11 @@ class V8_EXPORT_PRIVATE ParseInfo {
   MaybeHandle<ScopeInfo> maybe_outer_scope_info() const {
     return maybe_outer_scope_info_;
   }
-  void clear_script() { script_ = Handle<Script>::null(); }
   void set_outer_scope_info(Handle<ScopeInfo> outer_scope_info) {
     maybe_outer_scope_info_ = outer_scope_info;
   }
-  void set_script(Handle<Script> script) { script_ = script; }
+
+  int script_id() const { return script_id_; }
   //--------------------------------------------------------------------------
 
   LanguageMode language_mode() const {
@@ -222,20 +223,13 @@ class V8_EXPORT_PRIVATE ParseInfo {
     set_strict_mode(is_strict(language_mode));
   }
 
-  void ReopenHandlesInNewHandleScope() {
-    if (!script_.is_null()) {
-      script_ = Handle<Script>(*script_);
-    }
-    Handle<ScopeInfo> outer_scope_info;
-    if (maybe_outer_scope_info_.ToHandle(&outer_scope_info)) {
-      maybe_outer_scope_info_ = Handle<ScopeInfo>(*outer_scope_info);
-    }
-  }
-
   void EmitBackgroundParseStatisticsOnBackgroundThread();
   void UpdateBackgroundParseStatisticsOnMainThread(Isolate* isolate);
 
  private:
+  void SetScriptForToplevelCompile(Isolate* isolate, Handle<Script> script);
+  void set_script(Handle<Script> script);
+
   // Various configuration flags for parsing.
   enum Flag {
     // ---------- Input flags ---------------------------
@@ -268,6 +262,7 @@ class V8_EXPORT_PRIVATE ParseInfo {
   // TODO(leszeks): Move any remaining flags used here either to the flags_
   // field or to other fields.
   int function_flags_;
+  int script_id_;
   int start_position_;
   int end_position_;
   int parameters_end_pos_;
diff --git a/deps/v8/src/parsing/parser-base.h b/deps/v8/src/parsing/parser-base.h
index 1a6df3308369b0..24bf610e8a3bc9 100644
--- a/deps/v8/src/parsing/parser-base.h
+++ b/deps/v8/src/parsing/parser-base.h
@@ -282,7 +282,6 @@ class ParserBase {
         allow_harmony_static_fields_(false),
         allow_harmony_dynamic_import_(false),
         allow_harmony_import_meta_(false),
-        allow_harmony_optional_catch_binding_(false),
         allow_harmony_private_fields_(false),
         allow_eval_cache_(true) {}
 
@@ -296,7 +295,6 @@ class ParserBase {
   ALLOW_ACCESSORS(harmony_static_fields);
   ALLOW_ACCESSORS(harmony_dynamic_import);
   ALLOW_ACCESSORS(harmony_import_meta);
-  ALLOW_ACCESSORS(harmony_optional_catch_binding);
   ALLOW_ACCESSORS(eval_cache);
 
 #undef ALLOW_ACCESSORS
@@ -407,6 +405,7 @@ class ParserBase {
 
     void AddSuspend() { suspend_count_++; }
     int suspend_count() const { return suspend_count_; }
+    bool CanSuspend() const { return suspend_count_ > 0; }
 
     FunctionKind kind() const { return scope()->function_kind(); }
 
@@ -554,7 +553,7 @@ class ParserBase {
     Scope* scope;
     BlockT init_block;
     BlockT inner_block;
-    ZoneList<const AstRawString*> bound_names;
+    ZonePtrList<const AstRawString> bound_names;
   };
 
   struct ForInfo {
@@ -564,7 +563,7 @@ class ParserBase {
           mode(ForEachStatement::ENUMERATE),
           position(kNoSourcePosition),
           parsing_result() {}
-    ZoneList<const AstRawString*> bound_names;
+    ZonePtrList<const AstRawString> bound_names;
     ForEachStatement::VisitMode mode;
     int position;
     DeclarationParsingResult parsing_result;
@@ -684,7 +683,7 @@ class ParserBase {
   int script_id() { return script_id_; }
   void set_script_id(int id) { script_id_ = id; }
 
-  INLINE(Token::Value peek()) {
+  V8_INLINE Token::Value peek() {
     if (stack_overflow()) return Token::ILLEGAL;
     return scanner()->peek();
   }
@@ -696,12 +695,12 @@ class ParserBase {
                                         : scanner_->location().end_pos;
   }
 
-  INLINE(Token::Value PeekAhead()) {
+  V8_INLINE Token::Value PeekAhead() {
     if (stack_overflow()) return Token::ILLEGAL;
     return scanner()->PeekAhead();
   }
 
-  INLINE(Token::Value Next()) {
+  V8_INLINE Token::Value Next() {
     if (stack_overflow()) return Token::ILLEGAL;
     {
       if (GetCurrentStackPosition() < stack_limit_) {
@@ -1192,17 +1191,17 @@ class ParserBase {
 
   BlockT ParseVariableDeclarations(VariableDeclarationContext var_context,
                                    DeclarationParsingResult* parsing_result,
-                                   ZoneList<const AstRawString*>* names,
+                                   ZonePtrList<const AstRawString>* names,
                                    bool* ok);
-  StatementT ParseAsyncFunctionDeclaration(ZoneList<const AstRawString*>* names,
-                                           bool default_export, bool* ok);
+  StatementT ParseAsyncFunctionDeclaration(
+      ZonePtrList<const AstRawString>* names, bool default_export, bool* ok);
   StatementT ParseFunctionDeclaration(bool* ok);
-  StatementT ParseHoistableDeclaration(ZoneList<const AstRawString*>* names,
+  StatementT ParseHoistableDeclaration(ZonePtrList<const AstRawString>* names,
                                        bool default_export, bool* ok);
   StatementT ParseHoistableDeclaration(int pos, ParseFunctionFlags flags,
-                                       ZoneList<const AstRawString*>* names,
+                                       ZonePtrList<const AstRawString>* names,
                                        bool default_export, bool* ok);
-  StatementT ParseClassDeclaration(ZoneList<const AstRawString*>* names,
+  StatementT ParseClassDeclaration(ZonePtrList<const AstRawString>* names,
                                    bool default_export, bool* ok);
   StatementT ParseNativeDeclaration(bool* ok);
 
@@ -1233,22 +1232,22 @@ class ParserBase {
                                        Token::Value end_token, bool may_abort,
                                        bool* ok);
   StatementT ParseStatementListItem(bool* ok);
-  StatementT ParseStatement(ZoneList<const AstRawString*>* labels, bool* ok) {
+  StatementT ParseStatement(ZonePtrList<const AstRawString>* labels, bool* ok) {
     return ParseStatement(labels, kDisallowLabelledFunctionStatement, ok);
   }
-  StatementT ParseStatement(ZoneList<const AstRawString*>* labels,
+  StatementT ParseStatement(ZonePtrList<const AstRawString>* labels,
                             AllowLabelledFunctionStatement allow_function,
                             bool* ok);
-  BlockT ParseBlock(ZoneList<const AstRawString*>* labels, bool* ok);
+  BlockT ParseBlock(ZonePtrList<const AstRawString>* labels, bool* ok);
 
   // Parse a SubStatement in strict mode, or with an extra block scope in
   // sloppy mode to handle
   // ES#sec-functiondeclarations-in-ifstatement-statement-clauses
-  StatementT ParseScopedStatement(ZoneList<const AstRawString*>* labels,
+  StatementT ParseScopedStatement(ZonePtrList<const AstRawString>* labels,
                                   bool* ok);
 
   StatementT ParseVariableStatement(VariableDeclarationContext var_context,
-                                    ZoneList<const AstRawString*>* names,
+                                    ZonePtrList<const AstRawString>* names,
                                     bool* ok);
 
   // Magical syntax support.
@@ -1259,43 +1258,45 @@ class ParserBase {
   StatementT ParseDebuggerStatement(bool* ok);
 
   StatementT ParseExpressionOrLabelledStatement(
-      ZoneList<const AstRawString*>* labels,
+      ZonePtrList<const AstRawString>* labels,
       AllowLabelledFunctionStatement allow_function, bool* ok);
-  StatementT ParseIfStatement(ZoneList<const AstRawString*>* labels, bool* ok);
+  StatementT ParseIfStatement(ZonePtrList<const AstRawString>* labels,
+                              bool* ok);
   StatementT ParseContinueStatement(bool* ok);
-  StatementT ParseBreakStatement(ZoneList<const AstRawString*>* labels,
+  StatementT ParseBreakStatement(ZonePtrList<const AstRawString>* labels,
                                  bool* ok);
   StatementT ParseReturnStatement(bool* ok);
-  StatementT ParseWithStatement(ZoneList<const AstRawString*>* labels,
+  StatementT ParseWithStatement(ZonePtrList<const AstRawString>* labels,
                                 bool* ok);
-  StatementT ParseDoWhileStatement(ZoneList<const AstRawString*>* labels,
+  StatementT ParseDoWhileStatement(ZonePtrList<const AstRawString>* labels,
                                    bool* ok);
-  StatementT ParseWhileStatement(ZoneList<const AstRawString*>* labels,
+  StatementT ParseWhileStatement(ZonePtrList<const AstRawString>* labels,
                                  bool* ok);
   StatementT ParseThrowStatement(bool* ok);
-  StatementT ParseSwitchStatement(ZoneList<const AstRawString*>* labels,
+  StatementT ParseSwitchStatement(ZonePtrList<const AstRawString>* labels,
                                   bool* ok);
   StatementT ParseTryStatement(bool* ok);
-  StatementT ParseForStatement(ZoneList<const AstRawString*>* labels, bool* ok);
+  StatementT ParseForStatement(ZonePtrList<const AstRawString>* labels,
+                               bool* ok);
   StatementT ParseForEachStatementWithDeclarations(
-      int stmt_pos, ForInfo* for_info, ZoneList<const AstRawString*>* labels,
+      int stmt_pos, ForInfo* for_info, ZonePtrList<const AstRawString>* labels,
       Scope* inner_block_scope, bool* ok);
   StatementT ParseForEachStatementWithoutDeclarations(
       int stmt_pos, ExpressionT expression, int lhs_beg_pos, int lhs_end_pos,
-      ForInfo* for_info, ZoneList<const AstRawString*>* labels, bool* ok);
+      ForInfo* for_info, ZonePtrList<const AstRawString>* labels, bool* ok);
 
   // Parse a C-style for loop: 'for (<init>; <cond>; <next>) { ... }'
   // "for (<init>;" is assumed to have been parser already.
   ForStatementT ParseStandardForLoop(int stmt_pos,
-                                     ZoneList<const AstRawString*>* labels,
+                                     ZonePtrList<const AstRawString>* labels,
                                      ExpressionT* cond, StatementT* next,
                                      StatementT* body, bool* ok);
   // Same as the above, but handles those cases where <init> is a
   // lexical variable declaration.
   StatementT ParseStandardForLoopWithLexicalDeclarations(
       int stmt_pos, StatementT init, ForInfo* for_info,
-      ZoneList<const AstRawString*>* labels, bool* ok);
-  StatementT ParseForAwaitStatement(ZoneList<const AstRawString*>* labels,
+      ZonePtrList<const AstRawString>* labels, bool* ok);
+  StatementT ParseForAwaitStatement(ZonePtrList<const AstRawString>* labels,
                                     bool* ok);
 
   bool IsNextLetKeyword();
@@ -1561,7 +1562,6 @@ class ParserBase {
   bool allow_harmony_static_fields_;
   bool allow_harmony_dynamic_import_;
   bool allow_harmony_import_meta_;
-  bool allow_harmony_optional_catch_binding_;
   bool allow_harmony_private_fields_;
   bool allow_eval_cache_;
 
@@ -2944,7 +2944,7 @@ ParserBase<Impl>::ParseAssignmentExpression(bool accept_IN, bool* ok) {
     }
     expression = ParseArrowFunctionLiteral(accept_IN, parameters,
                                            rewritable_length, CHECK_OK);
-    DiscardExpressionClassifier();
+    Accumulate(ExpressionClassifier::AsyncArrowFormalParametersProduction);
     classifier()->RecordPatternError(arrow_loc,
                                      MessageTemplate::kUnexpectedToken,
                                      Token::String(Token::ARROW));
@@ -3424,24 +3424,12 @@ ParserBase<Impl>::ParseLeftHandSideExpression(bool* ok) {
         Call::PossiblyEval is_possibly_eval =
             CheckPossibleEvalCall(result, scope());
 
-        bool is_super_call = result->IsSuperCallReference();
         if (spread_pos.IsValid()) {
           result = impl()->SpreadCall(result, args, pos, is_possibly_eval);
         } else {
           result = factory()->NewCall(result, args, pos, is_possibly_eval);
         }
 
-        // Explicit calls to the super constructor using super() perform an
-        // implicit binding assignment to the 'this' variable.
-        if (is_super_call) {
-          classifier()->RecordAssignmentPatternError(
-              Scanner::Location(pos, scanner()->location().end_pos),
-              MessageTemplate::kInvalidDestructuringTarget);
-          ExpressionT this_expr = impl()->ThisExpression(pos);
-          result =
-              factory()->NewAssignment(Token::INIT, this_expr, result, pos);
-        }
-
         if (fni_ != nullptr) fni_->RemoveLastFunction();
         break;
       }
@@ -3863,7 +3851,7 @@ template <typename Impl>
 typename ParserBase<Impl>::BlockT ParserBase<Impl>::ParseVariableDeclarations(
     VariableDeclarationContext var_context,
     DeclarationParsingResult* parsing_result,
-    ZoneList<const AstRawString*>* names, bool* ok) {
+    ZonePtrList<const AstRawString>* names, bool* ok) {
   // VariableDeclarations ::
   //   ('var' | 'const' | 'let') (Identifier ('=' AssignmentExpression)?)+[',']
   //
@@ -3883,18 +3871,18 @@ typename ParserBase<Impl>::BlockT ParserBase<Impl>::ParseVariableDeclarations(
 
   switch (peek()) {
     case Token::VAR:
-      parsing_result->descriptor.mode = VAR;
+      parsing_result->descriptor.mode = VariableMode::kVar;
       Consume(Token::VAR);
       break;
     case Token::CONST:
       Consume(Token::CONST);
       DCHECK_NE(var_context, kStatement);
-      parsing_result->descriptor.mode = CONST;
+      parsing_result->descriptor.mode = VariableMode::kConst;
       break;
     case Token::LET:
       Consume(Token::LET);
       DCHECK_NE(var_context, kStatement);
-      parsing_result->descriptor.mode = LET;
+      parsing_result->descriptor.mode = VariableMode::kLet;
       break;
     default:
       UNREACHABLE();  // by current callers
@@ -3959,7 +3947,7 @@ typename ParserBase<Impl>::BlockT ParserBase<Impl>::ParseVariableDeclarations(
     } else {
       if (var_context != kForStatement || !PeekInOrOf()) {
         // ES6 'const' and binding patterns require initializers.
-        if (parsing_result->descriptor.mode == CONST ||
+        if (parsing_result->descriptor.mode == VariableMode::kConst ||
             !impl()->IsIdentifier(pattern)) {
           impl()->ReportMessageAt(
               Scanner::Location(decl_pos, scanner()->location().end_pos),
@@ -3969,7 +3957,7 @@ typename ParserBase<Impl>::BlockT ParserBase<Impl>::ParseVariableDeclarations(
           return impl()->NullStatement();
         }
         // 'let x' initializes 'x' to undefined.
-        if (parsing_result->descriptor.mode == LET) {
+        if (parsing_result->descriptor.mode == VariableMode::kLet) {
           value = factory()->NewUndefinedLiteral(position());
         }
       }
@@ -4021,7 +4009,7 @@ ParserBase<Impl>::ParseFunctionDeclaration(bool* ok) {
 template <typename Impl>
 typename ParserBase<Impl>::StatementT
 ParserBase<Impl>::ParseHoistableDeclaration(
-    ZoneList<const AstRawString*>* names, bool default_export, bool* ok) {
+    ZonePtrList<const AstRawString>* names, bool default_export, bool* ok) {
   Expect(Token::FUNCTION, CHECK_OK_CUSTOM(NullStatement));
   int pos = position();
   ParseFunctionFlags flags = ParseFunctionFlags::kIsNormal;
@@ -4034,7 +4022,7 @@ ParserBase<Impl>::ParseHoistableDeclaration(
 template <typename Impl>
 typename ParserBase<Impl>::StatementT
 ParserBase<Impl>::ParseHoistableDeclaration(
-    int pos, ParseFunctionFlags flags, ZoneList<const AstRawString*>* names,
+    int pos, ParseFunctionFlags flags, ZonePtrList<const AstRawString>* names,
     bool default_export, bool* ok) {
   // FunctionDeclaration ::
   //   'function' Identifier '(' FormalParameters ')' '{' FunctionBody '}'
@@ -4085,8 +4073,9 @@ ParserBase<Impl>::ParseHoistableDeclaration(
   // In ES6, a function behaves as a lexical binding, except in
   // a script scope, or the initial scope of eval or another function.
   VariableMode mode =
-      (!scope()->is_declaration_scope() || scope()->is_module_scope()) ? LET
-                                                                       : VAR;
+      (!scope()->is_declaration_scope() || scope()->is_module_scope())
+          ? VariableMode::kLet
+          : VariableMode::kVar;
   // Async functions don't undergo sloppy mode block scoped hoisting, and don't
   // allow duplicates in a block. Both are represented by the
   // sloppy_block_function_map. Don't add them to the map for async functions.
@@ -4102,7 +4091,7 @@ ParserBase<Impl>::ParseHoistableDeclaration(
 
 template <typename Impl>
 typename ParserBase<Impl>::StatementT ParserBase<Impl>::ParseClassDeclaration(
-    ZoneList<const AstRawString*>* names, bool default_export, bool* ok) {
+    ZonePtrList<const AstRawString>* names, bool default_export, bool* ok) {
   // ClassDeclaration ::
   //   'class' Identifier ('extends' LeftHandExpression)? '{' ClassBody '}'
   //   'class' ('extends' LeftHandExpression)? '{' ClassBody '}'
@@ -4172,7 +4161,7 @@ typename ParserBase<Impl>::StatementT ParserBase<Impl>::ParseNativeDeclaration(
 template <typename Impl>
 typename ParserBase<Impl>::StatementT
 ParserBase<Impl>::ParseAsyncFunctionDeclaration(
-    ZoneList<const AstRawString*>* names, bool default_export, bool* ok) {
+    ZonePtrList<const AstRawString>* names, bool default_export, bool* ok) {
   // AsyncFunctionDeclaration ::
   //   async [no LineTerminator here] function BindingIdentifier[Await]
   //       ( FormalParameters[Await] ) { AsyncFunctionBody }
@@ -4492,9 +4481,8 @@ ParserBase<Impl>::ParseArrowFunctionLiteral(
     const char* event_name =
         is_lazy_top_level_function ? "preparse-no-resolution" : "parse";
     const char* name = "arrow function";
-    logger_->FunctionEvent(event_name, nullptr, script_id(), ms,
-                           scope->start_position(), scope->end_position(), name,
-                           strlen(name));
+    logger_->FunctionEvent(event_name, script_id(), ms, scope->start_position(),
+                           scope->end_position(), name, strlen(name));
   }
 
   return function_literal;
@@ -4995,7 +4983,7 @@ typename ParserBase<Impl>::StatementT ParserBase<Impl>::ParseStatementListItem(
 
 template <typename Impl>
 typename ParserBase<Impl>::StatementT ParserBase<Impl>::ParseStatement(
-    ZoneList<const AstRawString*>* labels,
+    ZonePtrList<const AstRawString>* labels,
     AllowLabelledFunctionStatement allow_function, bool* ok) {
   // Statement ::
   //   Block
@@ -5095,7 +5083,7 @@ typename ParserBase<Impl>::StatementT ParserBase<Impl>::ParseStatement(
 
 template <typename Impl>
 typename ParserBase<Impl>::BlockT ParserBase<Impl>::ParseBlock(
-    ZoneList<const AstRawString*>* labels, bool* ok) {
+    ZonePtrList<const AstRawString>* labels, bool* ok) {
   // Block ::
   //   '{' StatementList '}'
 
@@ -5127,7 +5115,7 @@ typename ParserBase<Impl>::BlockT ParserBase<Impl>::ParseBlock(
 
 template <typename Impl>
 typename ParserBase<Impl>::StatementT ParserBase<Impl>::ParseScopedStatement(
-    ZoneList<const AstRawString*>* labels, bool* ok) {
+    ZonePtrList<const AstRawString>* labels, bool* ok) {
   if (is_strict(language_mode()) || peek() != Token::FUNCTION) {
     return ParseStatement(labels, ok);
   } else {
@@ -5147,7 +5135,7 @@ typename ParserBase<Impl>::StatementT ParserBase<Impl>::ParseScopedStatement(
 template <typename Impl>
 typename ParserBase<Impl>::StatementT ParserBase<Impl>::ParseVariableStatement(
     VariableDeclarationContext var_context,
-    ZoneList<const AstRawString*>* names, bool* ok) {
+    ZonePtrList<const AstRawString>* names, bool* ok) {
   // VariableStatement ::
   //   VariableDeclarations ';'
 
@@ -5188,7 +5176,7 @@ typename ParserBase<Impl>::StatementT ParserBase<Impl>::ParseDebuggerStatement(
 template <typename Impl>
 typename ParserBase<Impl>::StatementT
 ParserBase<Impl>::ParseExpressionOrLabelledStatement(
-    ZoneList<const AstRawString*>* labels,
+    ZonePtrList<const AstRawString>* labels,
     AllowLabelledFunctionStatement allow_function, bool* ok) {
   // ExpressionStatement | LabelledStatement ::
   //   Expression ';'
@@ -5259,7 +5247,7 @@ ParserBase<Impl>::ParseExpressionOrLabelledStatement(
 
 template <typename Impl>
 typename ParserBase<Impl>::StatementT ParserBase<Impl>::ParseIfStatement(
-    ZoneList<const AstRawString*>* labels, bool* ok) {
+    ZonePtrList<const AstRawString>* labels, bool* ok) {
   // IfStatement ::
   //   'if' '(' Expression ')' Statement ('else' Statement)?
 
@@ -5329,7 +5317,7 @@ typename ParserBase<Impl>::StatementT ParserBase<Impl>::ParseContinueStatement(
 
 template <typename Impl>
 typename ParserBase<Impl>::StatementT ParserBase<Impl>::ParseBreakStatement(
-    ZoneList<const AstRawString*>* labels, bool* ok) {
+    ZonePtrList<const AstRawString>* labels, bool* ok) {
   // BreakStatement ::
   //   'break' Identifier? ';'
 
@@ -5410,7 +5398,7 @@ typename ParserBase<Impl>::StatementT ParserBase<Impl>::ParseReturnStatement(
 
 template <typename Impl>
 typename ParserBase<Impl>::StatementT ParserBase<Impl>::ParseWithStatement(
-    ZoneList<const AstRawString*>* labels, bool* ok) {
+    ZonePtrList<const AstRawString>* labels, bool* ok) {
   // WithStatement ::
   //   'with' '(' Expression ')' Statement
 
@@ -5440,7 +5428,7 @@ typename ParserBase<Impl>::StatementT ParserBase<Impl>::ParseWithStatement(
 
 template <typename Impl>
 typename ParserBase<Impl>::StatementT ParserBase<Impl>::ParseDoWhileStatement(
-    ZoneList<const AstRawString*>* labels, bool* ok) {
+    ZonePtrList<const AstRawString>* labels, bool* ok) {
   // DoStatement ::
   //   'do' Statement 'while' '(' Expression ')' ';'
 
@@ -5475,7 +5463,7 @@ typename ParserBase<Impl>::StatementT ParserBase<Impl>::ParseDoWhileStatement(
 
 template <typename Impl>
 typename ParserBase<Impl>::StatementT ParserBase<Impl>::ParseWhileStatement(
-    ZoneList<const AstRawString*>* labels, bool* ok) {
+    ZonePtrList<const AstRawString>* labels, bool* ok) {
   // WhileStatement ::
   //   'while' '(' Expression ')' Statement
 
@@ -5524,7 +5512,7 @@ typename ParserBase<Impl>::StatementT ParserBase<Impl>::ParseThrowStatement(
 
 template <typename Impl>
 typename ParserBase<Impl>::StatementT ParserBase<Impl>::ParseSwitchStatement(
-    ZoneList<const AstRawString*>* labels, bool* ok) {
+    ZonePtrList<const AstRawString>* labels, bool* ok) {
   // SwitchStatement ::
   //   'switch' '(' Expression ')' '{' CaseClause* '}'
   // CaseClause ::
@@ -5623,12 +5611,7 @@ typename ParserBase<Impl>::StatementT ParserBase<Impl>::ParseTryStatement(
     SourceRangeScope catch_range_scope(scanner(), &catch_range);
     if (Check(Token::CATCH)) {
       bool has_binding;
-      if (allow_harmony_optional_catch_binding()) {
-        has_binding = Check(Token::LPAREN);
-      } else {
-        has_binding = true;
-        Expect(Token::LPAREN, CHECK_OK);
-      }
+      has_binding = Check(Token::LPAREN);
 
       if (has_binding) {
         catch_info.scope = NewScope(CATCH_SCOPE);
@@ -5695,7 +5678,7 @@ typename ParserBase<Impl>::StatementT ParserBase<Impl>::ParseTryStatement(
 
 template <typename Impl>
 typename ParserBase<Impl>::StatementT ParserBase<Impl>::ParseForStatement(
-    ZoneList<const AstRawString*>* labels, bool* ok) {
+    ZonePtrList<const AstRawString>* labels, bool* ok) {
   // Either a standard for loop
   //   for (<init>; <cond>; <next>) { ... }
   // or a for-each loop
@@ -5756,7 +5739,7 @@ typename ParserBase<Impl>::StatementT ParserBase<Impl>::ParseForStatement(
   if (peek() == Token::VAR) {
     ParseVariableDeclarations(kForStatement, &for_info.parsing_result, nullptr,
                               CHECK_OK);
-    DCHECK_EQ(for_info.parsing_result.descriptor.mode, VAR);
+    DCHECK_EQ(for_info.parsing_result.descriptor.mode, VariableMode::kVar);
     for_info.position = scanner()->location().beg_pos;
 
     if (CheckInOrOf(&for_info.mode)) {
@@ -5807,7 +5790,7 @@ typename ParserBase<Impl>::StatementT ParserBase<Impl>::ParseForStatement(
 template <typename Impl>
 typename ParserBase<Impl>::StatementT
 ParserBase<Impl>::ParseForEachStatementWithDeclarations(
-    int stmt_pos, ForInfo* for_info, ZoneList<const AstRawString*>* labels,
+    int stmt_pos, ForInfo* for_info, ZonePtrList<const AstRawString>* labels,
     Scope* inner_block_scope, bool* ok) {
   // Just one declaration followed by in/of.
   if (for_info->parsing_result.declarations.size() != 1) {
@@ -5904,7 +5887,7 @@ template <typename Impl>
 typename ParserBase<Impl>::StatementT
 ParserBase<Impl>::ParseForEachStatementWithoutDeclarations(
     int stmt_pos, ExpressionT expression, int lhs_beg_pos, int lhs_end_pos,
-    ForInfo* for_info, ZoneList<const AstRawString*>* labels, bool* ok) {
+    ForInfo* for_info, ZonePtrList<const AstRawString>* labels, bool* ok) {
   // Initializer is reference followed by in/of.
   if (!expression->IsArrayLiteral() && !expression->IsObjectLiteral()) {
     expression = CheckAndRewriteReferenceExpression(
@@ -5941,7 +5924,7 @@ template <typename Impl>
 typename ParserBase<Impl>::StatementT
 ParserBase<Impl>::ParseStandardForLoopWithLexicalDeclarations(
     int stmt_pos, StatementT init, ForInfo* for_info,
-    ZoneList<const AstRawString*>* labels, bool* ok) {
+    ZonePtrList<const AstRawString>* labels, bool* ok) {
   // The condition and the next statement of the for loop must be parsed
   // in a new scope.
   Scope* inner_scope = NewScope(BLOCK_SCOPE);
@@ -5996,7 +5979,7 @@ ParserBase<Impl>::ParseStandardForLoopWithLexicalDeclarations(
 
 template <typename Impl>
 typename ParserBase<Impl>::ForStatementT ParserBase<Impl>::ParseStandardForLoop(
-    int stmt_pos, ZoneList<const AstRawString*>* labels, ExpressionT* cond,
+    int stmt_pos, ZonePtrList<const AstRawString>* labels, ExpressionT* cond,
     StatementT* next, StatementT* body, bool* ok) {
   ForStatementT loop = factory()->NewForStatement(labels, stmt_pos);
   typename Types::Target target(this, loop);
@@ -6035,7 +6018,7 @@ void ParserBase<Impl>::MarkLoopVariableAsAssigned(
 
 template <typename Impl>
 typename ParserBase<Impl>::StatementT ParserBase<Impl>::ParseForAwaitStatement(
-    ZoneList<const AstRawString*>* labels, bool* ok) {
+    ZonePtrList<const AstRawString>* labels, bool* ok) {
   // for await '(' ForDeclaration of AssignmentExpression ')'
   DCHECK(is_async_function());
 
diff --git a/deps/v8/src/parsing/parser.cc b/deps/v8/src/parsing/parser.cc
index 8b4d346f5a1411..59b18fd9682c25 100644
--- a/deps/v8/src/parsing/parser.cc
+++ b/deps/v8/src/parsing/parser.cc
@@ -92,12 +92,12 @@ FunctionLiteral* Parser::DefaultConstructor(const AstRawString* name,
   // Set start and end position to the same value
   function_scope->set_start_position(pos);
   function_scope->set_end_position(pos);
-  ZoneList<Statement*>* body = nullptr;
+  ZonePtrList<Statement>* body = nullptr;
 
   {
     FunctionState function_state(&function_state_, &scope_, function_scope);
 
-    body = new (zone()) ZoneList<Statement*>(call_super ? 2 : 1, zone());
+    body = new (zone()) ZonePtrList<Statement>(call_super ? 2 : 1, zone());
     if (call_super) {
       // Create a SuperCallReference and handle in BytecodeGenerator.
       auto constructor_args_name = ast_value_factory()->empty_string();
@@ -105,11 +105,11 @@ FunctionLiteral* Parser::DefaultConstructor(const AstRawString* name,
       bool is_rest = true;
       bool is_optional = false;
       Variable* constructor_args = function_scope->DeclareParameter(
-          constructor_args_name, TEMPORARY, is_optional, is_rest, &is_duplicate,
-          ast_value_factory(), pos);
+          constructor_args_name, VariableMode::kTemporary, is_optional, is_rest,
+          &is_duplicate, ast_value_factory(), pos);
 
-      ZoneList<Expression*>* args =
-          new (zone()) ZoneList<Expression*>(1, zone());
+      ZonePtrList<Expression>* args =
+          new (zone()) ZonePtrList<Expression>(1, zone());
       Spread* spread_args = factory()->NewSpread(
           factory()->NewVariableProxy(constructor_args), pos, pos);
 
@@ -283,7 +283,8 @@ Expression* Parser::BuildUnaryExpression(Expression* expression,
 Expression* Parser::NewThrowError(Runtime::FunctionId id,
                                   MessageTemplate::Template message,
                                   const AstRawString* arg, int pos) {
-  ZoneList<Expression*>* args = new (zone()) ZoneList<Expression*>(2, zone());
+  ZonePtrList<Expression>* args =
+      new (zone()) ZonePtrList<Expression>(2, zone());
   args->Add(factory()->NewSmiLiteral(message, pos), zone());
   args->Add(factory()->NewStringLiteral(arg, pos), zone());
   CallRuntime* call_constructor = factory()->NewCallRuntime(id, args, pos);
@@ -321,7 +322,7 @@ Expression* Parser::NewTargetExpression(int pos) {
 Expression* Parser::ImportMetaExpression(int pos) {
   return factory()->NewCallRuntime(
       Runtime::kInlineGetImportMetaObject,
-      new (zone()) ZoneList<Expression*>(0, zone()), pos);
+      new (zone()) ZonePtrList<Expression>(0, zone()), pos);
 }
 
 Literal* Parser::ExpressionFromLiteral(Token::Value token, int pos) {
@@ -350,7 +351,7 @@ Literal* Parser::ExpressionFromLiteral(Token::Value token, int pos) {
 }
 
 Expression* Parser::NewV8Intrinsic(const AstRawString* name,
-                                   ZoneList<Expression*>* args, int pos,
+                                   ZonePtrList<Expression>* args, int pos,
                                    bool* ok) {
   if (extension_ != nullptr) {
     // The extension structures are only accessible while parsing the
@@ -449,7 +450,6 @@ Parser::Parser(ParseInfo* info)
   set_allow_harmony_import_meta(FLAG_harmony_import_meta);
   set_allow_harmony_bigint(FLAG_harmony_bigint);
   set_allow_harmony_numeric_separator(FLAG_harmony_numeric_separator);
-  set_allow_harmony_optional_catch_binding(FLAG_harmony_optional_catch_binding);
   set_allow_harmony_private_fields(FLAG_harmony_private_fields);
   for (int feature = 0; feature < v8::Isolate::kUseCounterFeatureCount;
        ++feature) {
@@ -458,7 +458,8 @@ Parser::Parser(ParseInfo* info)
 }
 
 void Parser::DeserializeScopeChain(
-    ParseInfo* info, MaybeHandle<ScopeInfo> maybe_outer_scope_info) {
+    Isolate* isolate, ParseInfo* info,
+    MaybeHandle<ScopeInfo> maybe_outer_scope_info) {
   // TODO(wingo): Add an outer SCRIPT_SCOPE corresponding to the native
   // context, which will have the "this" binding for script scopes.
   DeclarationScope* script_scope = NewScriptScope();
@@ -466,10 +467,9 @@ void Parser::DeserializeScopeChain(
   Scope* scope = script_scope;
   Handle<ScopeInfo> outer_scope_info;
   if (maybe_outer_scope_info.ToHandle(&outer_scope_info)) {
-    DCHECK(ThreadId::Current().Equals(
-        outer_scope_info->GetIsolate()->thread_id()));
+    DCHECK(ThreadId::Current().Equals(isolate->thread_id()));
     scope = Scope::DeserializeScopeChain(
-        zone(), *outer_scope_info, script_scope, ast_value_factory(),
+        isolate, zone(), *outer_scope_info, script_scope, ast_value_factory(),
         Scope::DeserializationMode::kScopesOnly);
   }
   original_scope_ = scope;
@@ -505,10 +505,10 @@ FunctionLiteral* Parser::ParseProgram(Isolate* isolate, ParseInfo* info) {
   fni_ = new (zone()) FuncNameInferrer(ast_value_factory(), zone());
 
   // Initialize parser state.
-  DeserializeScopeChain(info, info->maybe_outer_scope_info());
+  DeserializeScopeChain(isolate, info, info->maybe_outer_scope_info());
 
   scanner_.Initialize(info->character_stream(), info->is_module());
-  FunctionLiteral* result = DoParseProgram(info);
+  FunctionLiteral* result = DoParseProgram(isolate, info);
   MaybeResetCharacterStream(info, result);
 
   HandleSourceURLComments(isolate, info->script());
@@ -524,17 +524,18 @@ FunctionLiteral* Parser::ParseProgram(Isolate* isolate, ParseInfo* info) {
       start = 0;
       end = String::cast(script->source())->length();
     }
-    LOG(script->GetIsolate(),
-        FunctionEvent(event_name, script, -1, ms, start, end, "", 0));
+    LOG(isolate,
+        FunctionEvent(event_name, script->id(), ms, start, end, "", 0));
   }
   return result;
 }
 
-
-FunctionLiteral* Parser::DoParseProgram(ParseInfo* info) {
+FunctionLiteral* Parser::DoParseProgram(Isolate* isolate, ParseInfo* info) {
   // Note that this function can be called from the main thread or from a
   // background thread. We should not access anything Isolate / heap dependent
-  // via ParseInfo, and also not pass it forward.
+  // via ParseInfo, and also not pass it forward. If not on the main thread
+  // isolate will be nullptr.
+  DCHECK_EQ(parsing_on_main_thread_, isolate != nullptr);
   DCHECK_NULL(scope_);
   DCHECK_NULL(target_stack_);
 
@@ -558,7 +559,8 @@ FunctionLiteral* Parser::DoParseProgram(ParseInfo* info) {
     scope->set_start_position(0);
 
     FunctionState function_state(&function_state_, &scope_, scope);
-    ZoneList<Statement*>* body = new(zone()) ZoneList<Statement*>(16, zone());
+    ZonePtrList<Statement>* body =
+        new (zone()) ZonePtrList<Statement>(16, zone());
     bool ok = true;
     int beg_pos = scanner()->location().beg_pos;
     if (parsing_module_) {
@@ -568,9 +570,9 @@ FunctionLiteral* Parser::DoParseProgram(ParseInfo* info) {
       bool is_duplicate = false;
       bool is_rest = false;
       bool is_optional = false;
-      auto var =
-          scope->DeclareParameter(name, VAR, is_optional, is_rest,
-                                  &is_duplicate, ast_value_factory(), beg_pos);
+      auto var = scope->DeclareParameter(name, VariableMode::kVar, is_optional,
+                                         is_rest, &is_duplicate,
+                                         ast_value_factory(), beg_pos);
       DCHECK(!is_duplicate);
       var->AllocateTo(VariableLocation::PARAMETER, 0);
 
@@ -585,7 +587,7 @@ FunctionLiteral* Parser::DoParseProgram(ParseInfo* info) {
       ok = ok && module()->Validate(this->scope()->AsModuleScope(),
                                     pending_error_handler(), zone());
     } else if (info->is_wrapped_as_function()) {
-      ParseWrapped(info, body, scope, zone(), &ok);
+      ParseWrapped(isolate, info, body, scope, zone(), &ok);
     } else {
       // Don't count the mode in the use counters--give the program a chance
       // to enable script-wide strict mode below.
@@ -639,23 +641,26 @@ FunctionLiteral* Parser::DoParseProgram(ParseInfo* info) {
   return result;
 }
 
-ZoneList<const AstRawString*>* Parser::PrepareWrappedArguments(ParseInfo* info,
-                                                               Zone* zone) {
+ZonePtrList<const AstRawString>* Parser::PrepareWrappedArguments(
+    Isolate* isolate, ParseInfo* info, Zone* zone) {
   DCHECK(parsing_on_main_thread_);
-  Handle<FixedArray> arguments(info->script()->wrapped_arguments());
+  DCHECK_NOT_NULL(isolate);
+  Handle<FixedArray> arguments(info->script()->wrapped_arguments(), isolate);
   int arguments_length = arguments->length();
-  ZoneList<const AstRawString*>* arguments_for_wrapped_function =
-      new (zone) ZoneList<const AstRawString*>(arguments_length, zone);
+  ZonePtrList<const AstRawString>* arguments_for_wrapped_function =
+      new (zone) ZonePtrList<const AstRawString>(arguments_length, zone);
   for (int i = 0; i < arguments_length; i++) {
     const AstRawString* argument_string = ast_value_factory()->GetString(
-        Handle<String>(String::cast(arguments->get(i))));
+        Handle<String>(String::cast(arguments->get(i)), isolate));
     arguments_for_wrapped_function->Add(argument_string, zone);
   }
   return arguments_for_wrapped_function;
 }
 
-void Parser::ParseWrapped(ParseInfo* info, ZoneList<Statement*>* body,
+void Parser::ParseWrapped(Isolate* isolate, ParseInfo* info,
+                          ZonePtrList<Statement>* body,
                           DeclarationScope* outer_scope, Zone* zone, bool* ok) {
+  DCHECK_EQ(parsing_on_main_thread_, isolate != nullptr);
   DCHECK(info->is_wrapped_as_function());
   ParsingModeScope parsing_mode(this, PARSE_EAGERLY);
 
@@ -666,8 +671,8 @@ void Parser::ParseWrapped(ParseInfo* info, ZoneList<Statement*>* body,
   const AstRawString* function_name = nullptr;
   Scanner::Location location(0, 0);
 
-  ZoneList<const AstRawString*>* arguments_for_wrapped_function =
-      PrepareWrappedArguments(info, zone);
+  ZonePtrList<const AstRawString>* arguments_for_wrapped_function =
+      PrepareWrappedArguments(isolate, info, zone);
 
   FunctionLiteral* function_literal = ParseFunctionLiteral(
       function_name, location, kSkipFunctionNameCheck, kNormalFunction,
@@ -690,18 +695,19 @@ FunctionLiteral* Parser::ParseFunction(Isolate* isolate, ParseInfo* info,
   base::ElapsedTimer timer;
   if (V8_UNLIKELY(FLAG_log_function_events)) timer.Start();
 
-  DeserializeScopeChain(info, info->maybe_outer_scope_info());
+  DeserializeScopeChain(isolate, info, info->maybe_outer_scope_info());
   DCHECK_EQ(factory()->zone(), info->zone());
 
   // Initialize parser state.
-  Handle<String> name(shared_info->Name());
+  Handle<String> name(shared_info->Name(), isolate);
   info->set_function_name(ast_value_factory()->GetString(name));
   scanner_.Initialize(info->character_stream(), info->is_module());
 
-  FunctionLiteral* result = DoParseFunction(info, info->function_name());
+  FunctionLiteral* result =
+      DoParseFunction(isolate, info, info->function_name());
   MaybeResetCharacterStream(info, result);
   if (result != nullptr) {
-    Handle<String> inferred_name(shared_info->inferred_name());
+    Handle<String> inferred_name(shared_info->inferred_name(), isolate);
     result->set_inferred_name(inferred_name);
   }
 
@@ -710,10 +716,9 @@ FunctionLiteral* Parser::ParseFunction(Isolate* isolate, ParseInfo* info,
     // We need to make sure that the debug-name is available.
     ast_value_factory()->Internalize(isolate);
     DeclarationScope* function_scope = result->scope();
-    Script* script = *info->script();
     std::unique_ptr<char[]> function_name = result->GetDebugName();
-    LOG(script->GetIsolate(),
-        FunctionEvent("parse-function", script, -1, ms,
+    LOG(isolate,
+        FunctionEvent("parse-function", info->script()->id(), ms,
                       function_scope->start_position(),
                       function_scope->end_position(), function_name.get(),
                       strlen(function_name.get())));
@@ -735,8 +740,9 @@ static FunctionLiteral::FunctionType ComputeFunctionType(ParseInfo* info) {
   return FunctionLiteral::kAnonymousExpression;
 }
 
-FunctionLiteral* Parser::DoParseFunction(ParseInfo* info,
+FunctionLiteral* Parser::DoParseFunction(Isolate* isolate, ParseInfo* info,
                                          const AstRawString* raw_name) {
+  DCHECK_EQ(parsing_on_main_thread_, isolate != nullptr);
   DCHECK_NOT_NULL(raw_name);
   DCHECK_NULL(scope_);
   DCHECK_NULL(target_stack_);
@@ -858,9 +864,10 @@ FunctionLiteral* Parser::DoParseFunction(ParseInfo* info,
       result = DefaultConstructor(raw_name, IsDerivedConstructor(kind),
                                   info->start_position(), info->end_position());
     } else {
-      ZoneList<const AstRawString*>* arguments_for_wrapped_function =
-          info->is_wrapped_as_function() ? PrepareWrappedArguments(info, zone())
-                                         : nullptr;
+      ZonePtrList<const AstRawString>* arguments_for_wrapped_function =
+          info->is_wrapped_as_function()
+              ? PrepareWrappedArguments(isolate, info, zone())
+              : nullptr;
       result = ParseFunctionLiteral(
           raw_name, Scanner::Location::invalid(), kSkipFunctionNameCheck, kind,
           kNoSourcePosition, function_type, info->language_mode(),
@@ -909,8 +916,7 @@ Statement* Parser::ParseModuleItem(bool* ok) {
   return ParseStatementListItem(ok);
 }
 
-
-void Parser::ParseModuleItemList(ZoneList<Statement*>* body, bool* ok) {
+void Parser::ParseModuleItemList(ZonePtrList<Statement>* body, bool* ok) {
   // ecma262/#prod-Module
   // Module :
   //    ModuleBody?
@@ -937,10 +943,9 @@ const AstRawString* Parser::ParseModuleSpecifier(bool* ok) {
   return GetSymbol();
 }
 
-
-void Parser::ParseExportClause(ZoneList<const AstRawString*>* export_names,
+void Parser::ParseExportClause(ZonePtrList<const AstRawString>* export_names,
                                ZoneList<Scanner::Location>* export_locations,
-                               ZoneList<const AstRawString*>* local_names,
+                               ZonePtrList<const AstRawString>* local_names,
                                Scanner::Location* reserved_loc, bool* ok) {
   // ExportClause :
   //   '{' '}'
@@ -988,9 +993,8 @@ void Parser::ParseExportClause(ZoneList<const AstRawString*>* export_names,
   Expect(Token::RBRACE, CHECK_OK_VOID);
 }
 
-
-ZoneList<const Parser::NamedImport*>* Parser::ParseNamedImports(
-    int pos, bool* ok) {
+ZonePtrList<const Parser::NamedImport>* Parser::ParseNamedImports(int pos,
+                                                                  bool* ok) {
   // NamedImports :
   //   '{' '}'
   //   '{' ImportsList '}'
@@ -1006,7 +1010,7 @@ ZoneList<const Parser::NamedImport*>* Parser::ParseNamedImports(
 
   Expect(Token::LBRACE, CHECK_OK);
 
-  auto result = new (zone()) ZoneList<const NamedImport*>(1, zone());
+  auto result = new (zone()) ZonePtrList<const NamedImport>(1, zone());
   while (peek() != Token::RBRACE) {
     const AstRawString* import_name = ParseIdentifierName(CHECK_OK);
     const AstRawString* local_name = import_name;
@@ -1028,8 +1032,8 @@ ZoneList<const Parser::NamedImport*>* Parser::ParseNamedImports(
       return nullptr;
     }
 
-    DeclareVariable(local_name, CONST, kNeedsInitialization, position(),
-                    CHECK_OK);
+    DeclareVariable(local_name, VariableMode::kConst, kNeedsInitialization,
+                    position(), CHECK_OK);
 
     NamedImport* import =
         new (zone()) NamedImport(import_name, local_name, location);
@@ -1080,14 +1084,14 @@ void Parser::ParseImportDeclaration(bool* ok) {
     import_default_binding =
         ParseIdentifier(kDontAllowRestrictedIdentifiers, CHECK_OK_VOID);
     import_default_binding_loc = scanner()->location();
-    DeclareVariable(import_default_binding, CONST, kNeedsInitialization, pos,
-                    CHECK_OK_VOID);
+    DeclareVariable(import_default_binding, VariableMode::kConst,
+                    kNeedsInitialization, pos, CHECK_OK_VOID);
   }
 
   // Parse NameSpaceImport or NamedImports if present.
   const AstRawString* module_namespace_binding = nullptr;
   Scanner::Location module_namespace_binding_loc;
-  const ZoneList<const NamedImport*>* named_imports = nullptr;
+  const ZonePtrList<const NamedImport>* named_imports = nullptr;
   if (import_default_binding == nullptr || Check(Token::COMMA)) {
     switch (peek()) {
       case Token::MUL: {
@@ -1096,8 +1100,8 @@ void Parser::ParseImportDeclaration(bool* ok) {
         module_namespace_binding =
             ParseIdentifier(kDontAllowRestrictedIdentifiers, CHECK_OK_VOID);
         module_namespace_binding_loc = scanner()->location();
-        DeclareVariable(module_namespace_binding, CONST, kCreatedInitialized,
-                        pos, CHECK_OK_VOID);
+        DeclareVariable(module_namespace_binding, VariableMode::kConst,
+                        kCreatedInitialized, pos, CHECK_OK_VOID);
         break;
       }
 
@@ -1161,7 +1165,7 @@ Statement* Parser::ParseExportDefault(bool* ok) {
   Expect(Token::DEFAULT, CHECK_OK);
   Scanner::Location default_loc = scanner()->location();
 
-  ZoneList<const AstRawString*> local_names(1, zone());
+  ZonePtrList<const AstRawString> local_names(1, zone());
   Statement* result = nullptr;
   switch (peek()) {
     case Token::FUNCTION:
@@ -1193,9 +1197,10 @@ Statement* Parser::ParseExportDefault(bool* ok) {
           ast_value_factory()->star_default_star_string();
       local_names.Add(local_name, zone());
 
-      // It's fine to declare this as CONST because the user has no way of
-      // writing to it.
-      Declaration* decl = DeclareVariable(local_name, CONST, pos, CHECK_OK);
+      // It's fine to declare this as VariableMode::kConst because the user has
+      // no way of writing to it.
+      Declaration* decl =
+          DeclareVariable(local_name, VariableMode::kConst, pos, CHECK_OK);
       decl->proxy()->var()->set_initializer_position(position());
 
       Assignment* assignment = factory()->NewAssignment(
@@ -1229,7 +1234,7 @@ Statement* Parser::ParseExportDeclaration(bool* ok) {
   int pos = position();
 
   Statement* result = nullptr;
-  ZoneList<const AstRawString*> names(1, zone());
+  ZonePtrList<const AstRawString> names(1, zone());
   Scanner::Location loc = scanner()->peek_location();
   switch (peek()) {
     case Token::DEFAULT:
@@ -1259,9 +1264,9 @@ Statement* Parser::ParseExportDeclaration(bool* ok) {
       // encountered, and then throw a SyntaxError if we are in the
       // non-FromClause case.
       Scanner::Location reserved_loc = Scanner::Location::invalid();
-      ZoneList<const AstRawString*> export_names(1, zone());
+      ZonePtrList<const AstRawString> export_names(1, zone());
       ZoneList<Scanner::Location> export_locations(1, zone());
-      ZoneList<const AstRawString*> original_names(1, zone());
+      ZonePtrList<const AstRawString> original_names(1, zone());
       ParseExportClause(&export_names, &export_locations, &original_names,
                         &reserved_loc, CHECK_OK);
       const AstRawString* module_specifier = nullptr;
@@ -1356,7 +1361,7 @@ Declaration* Parser::DeclareVariable(const AstRawString* name,
   VariableProxy* proxy = factory()->NewVariableProxy(
       name, NORMAL_VARIABLE, scanner()->location().beg_pos);
   Declaration* declaration;
-  if (mode == VAR && !scope()->is_declaration_scope()) {
+  if (mode == VariableMode::kVar && !scope()->is_declaration_scope()) {
     DCHECK(scope()->is_block_scope() || scope()->is_with_scope());
     declaration = factory()->NewNestedVariableDeclaration(proxy, scope(), pos);
   } else {
@@ -1403,7 +1408,7 @@ Variable* Parser::Declare(Declaration* declaration,
 
 Block* Parser::BuildInitializationBlock(
     DeclarationParsingResult* parsing_result,
-    ZoneList<const AstRawString*>* names, bool* ok) {
+    ZonePtrList<const AstRawString>* names, bool* ok) {
   Block* result = factory()->NewBlock(1, true);
   for (auto declaration : parsing_result->declarations) {
     DeclareAndInitializeVariables(result, &(parsing_result->descriptor),
@@ -1415,7 +1420,7 @@ Block* Parser::BuildInitializationBlock(
 Statement* Parser::DeclareFunction(const AstRawString* variable_name,
                                    FunctionLiteral* function, VariableMode mode,
                                    int pos, bool is_sloppy_block_function,
-                                   ZoneList<const AstRawString*>* names,
+                                   ZonePtrList<const AstRawString>* names,
                                    bool* ok) {
   VariableProxy* proxy =
       factory()->NewVariableProxy(variable_name, NORMAL_VARIABLE, pos);
@@ -1436,10 +1441,10 @@ Statement* Parser::DeclareFunction(const AstRawString* variable_name,
 
 Statement* Parser::DeclareClass(const AstRawString* variable_name,
                                 Expression* value,
-                                ZoneList<const AstRawString*>* names,
+                                ZonePtrList<const AstRawString>* names,
                                 int class_token_pos, int end_pos, bool* ok) {
-  Declaration* decl =
-      DeclareVariable(variable_name, LET, class_token_pos, CHECK_OK);
+  Declaration* decl = DeclareVariable(variable_name, VariableMode::kLet,
+                                      class_token_pos, CHECK_OK);
   decl->proxy()->var()->set_initializer_position(end_pos);
   if (names) names->Add(variable_name, zone());
 
@@ -1459,7 +1464,7 @@ Statement* Parser::DeclareNative(const AstRawString* name, int pos, bool* ok) {
   // TODO(1240846): It's weird that native function declarations are
   // introduced dynamically when we meet their declarations, whereas
   // other functions are set up when entering the surrounding scope.
-  Declaration* decl = DeclareVariable(name, VAR, pos, CHECK_OK);
+  Declaration* decl = DeclareVariable(name, VariableMode::kVar, pos, CHECK_OK);
   NativeFunctionLiteral* lit =
       factory()->NewNativeFunctionLiteral(name, extension_, kNoSourcePosition);
   return factory()->NewExpressionStatement(
@@ -1468,8 +1473,8 @@ Statement* Parser::DeclareNative(const AstRawString* name, int pos, bool* ok) {
       pos);
 }
 
-ZoneList<const AstRawString*>* Parser::DeclareLabel(
-    ZoneList<const AstRawString*>* labels, VariableProxy* var, bool* ok) {
+ZonePtrList<const AstRawString>* Parser::DeclareLabel(
+    ZonePtrList<const AstRawString>* labels, VariableProxy* var, bool* ok) {
   DCHECK(IsIdentifier(var));
   const AstRawString* label = var->raw_name();
   // TODO(1240780): We don't check for redeclaration of labels
@@ -1483,7 +1488,7 @@ ZoneList<const AstRawString*>* Parser::DeclareLabel(
     return nullptr;
   }
   if (labels == nullptr) {
-    labels = new (zone()) ZoneList<const AstRawString*>(1, zone());
+    labels = new (zone()) ZonePtrList<const AstRawString>(1, zone());
   }
   labels->Add(label, zone());
   // Remove the "ghost" variable that turned out to be a label
@@ -1493,7 +1498,7 @@ ZoneList<const AstRawString*>* Parser::DeclareLabel(
   return labels;
 }
 
-bool Parser::ContainsLabel(ZoneList<const AstRawString*>* labels,
+bool Parser::ContainsLabel(ZonePtrList<const AstRawString>* labels,
                            const AstRawString* label) {
   DCHECK_NOT_NULL(label);
   if (labels != nullptr) {
@@ -1593,12 +1598,12 @@ void Parser::RewriteCatchPattern(CatchInfo* catch_info, bool* ok) {
     catch_info->name = ast_value_factory()->dot_catch_string();
   }
   Variable* catch_variable =
-      catch_info->scope->DeclareLocal(catch_info->name, VAR);
+      catch_info->scope->DeclareLocal(catch_info->name, VariableMode::kVar);
   if (catch_info->pattern != nullptr) {
     DeclarationDescriptor descriptor;
     descriptor.declaration_kind = DeclarationDescriptor::NORMAL;
     descriptor.scope = scope();
-    descriptor.mode = LET;
+    descriptor.mode = VariableMode::kLet;
     descriptor.declaration_pos = catch_info->pattern->position();
     descriptor.initialization_pos = catch_info->pattern->position();
 
@@ -1674,7 +1679,7 @@ Statement* Parser::RewriteTryStatement(Block* try_block, Block* catch_block,
 }
 
 void Parser::ParseAndRewriteGeneratorFunctionBody(int pos, FunctionKind kind,
-                                                  ZoneList<Statement*>* body,
+                                                  ZonePtrList<Statement>* body,
                                                   bool* ok) {
   // For ES6 Generators, we just prepend the initial yield.
   Expression* initial_yield = BuildInitialYield(pos, kind);
@@ -1684,7 +1689,7 @@ void Parser::ParseAndRewriteGeneratorFunctionBody(int pos, FunctionKind kind,
 }
 
 void Parser::ParseAndRewriteAsyncGeneratorFunctionBody(
-    int pos, FunctionKind kind, ZoneList<Statement*>* body, bool* ok) {
+    int pos, FunctionKind kind, ZonePtrList<Statement>* body, bool* ok) {
   // For ES2017 Async Generators, we produce:
   //
   // try {
@@ -1726,8 +1731,8 @@ void Parser::ParseAndRewriteAsyncGeneratorFunctionBody(
   // For AsyncGenerators, a top-level catch block will reject the Promise.
   Scope* catch_scope = NewHiddenCatchScope();
 
-  ZoneList<Expression*>* reject_args =
-      new (zone()) ZoneList<Expression*>(2, zone());
+  ZonePtrList<Expression>* reject_args =
+      new (zone()) ZonePtrList<Expression>(2, zone());
   reject_args->Add(factory()->NewVariableProxy(
                        function_state_->scope()->generator_object_var()),
                    zone());
@@ -1746,8 +1751,8 @@ void Parser::ParseAndRewriteAsyncGeneratorFunctionBody(
   try_block->statements()->Add(try_catch, zone());
 
   Block* finally_block = factory()->NewBlock(1, false);
-  ZoneList<Expression*>* close_args =
-      new (zone()) ZoneList<Expression*>(1, zone());
+  ZonePtrList<Expression>* close_args =
+      new (zone()) ZonePtrList<Expression>(1, zone());
   VariableProxy* call_proxy = factory()->NewVariableProxy(
       function_state_->scope()->generator_object_var());
   close_args->Add(call_proxy, zone());
@@ -1783,8 +1788,8 @@ Expression* Parser::BuildIteratorNextResult(VariableProxy* iterator,
                                             Variable* result, IteratorType type,
                                             int pos) {
   Expression* next_property = factory()->NewResolvedProperty(iterator, next);
-  ZoneList<Expression*>* next_arguments =
-      new (zone()) ZoneList<Expression*>(0, zone());
+  ZonePtrList<Expression>* next_arguments =
+      new (zone()) ZonePtrList<Expression>(0, zone());
   Expression* next_call =
       factory()->NewCall(next_property, next_arguments, kNoSourcePosition);
   if (type == IteratorType::kAsync) {
@@ -1796,16 +1801,16 @@ Expression* Parser::BuildIteratorNextResult(VariableProxy* iterator,
       factory()->NewAssignment(Token::ASSIGN, result_proxy, next_call, pos);
 
   // %_IsJSReceiver(...)
-  ZoneList<Expression*>* is_spec_object_args =
-      new (zone()) ZoneList<Expression*>(1, zone());
+  ZonePtrList<Expression>* is_spec_object_args =
+      new (zone()) ZonePtrList<Expression>(1, zone());
   is_spec_object_args->Add(left, zone());
   Expression* is_spec_object_call = factory()->NewCallRuntime(
       Runtime::kInlineIsJSReceiver, is_spec_object_args, pos);
 
   // %ThrowIteratorResultNotAnObject(result)
   Expression* result_proxy_again = factory()->NewVariableProxy(result);
-  ZoneList<Expression*>* throw_arguments =
-      new (zone()) ZoneList<Expression*>(1, zone());
+  ZonePtrList<Expression>* throw_arguments =
+      new (zone()) ZonePtrList<Expression>(1, zone());
   throw_arguments->Add(result_proxy_again, zone());
   Expression* throw_call = factory()->NewCallRuntime(
       Runtime::kThrowIteratorResultNotAnObject, throw_arguments, pos);
@@ -1914,7 +1919,7 @@ void Parser::DesugarBindingInForEachStatement(ForInfo* for_info,
 
     bool is_for_var_of =
         for_info->mode == ForEachStatement::ITERATE &&
-        for_info->parsing_result.descriptor.mode == VariableMode::VAR;
+        for_info->parsing_result.descriptor.mode == VariableMode::kVar;
     bool collect_names =
         IsLexicalVariableMode(for_info->parsing_result.descriptor.mode) ||
         is_for_var_of;
@@ -1966,8 +1971,9 @@ Block* Parser::CreateForEachStatementTDZ(Block* init_block,
       // TODO(adamk): This needs to be some sort of special
       // INTERNAL variable that's invisible to the debugger
       // but visible to everything else.
-      Declaration* tdz_decl = DeclareVariable(for_info.bound_names[i], LET,
-                                              kNoSourcePosition, CHECK_OK);
+      Declaration* tdz_decl =
+          DeclareVariable(for_info.bound_names[i], VariableMode::kLet,
+                          kNoSourcePosition, CHECK_OK);
       tdz_decl->proxy()->var()->set_initializer_position(position());
     }
   }
@@ -2139,7 +2145,7 @@ Statement* Parser::DesugarLexicalBindingsInForStatement(
   //  }
 
   DCHECK_GT(for_info.bound_names.length(), 0);
-  ZoneList<Variable*> temps(for_info.bound_names.length(), zone());
+  ZonePtrList<Variable> temps(for_info.bound_names.length(), zone());
 
   Block* outer_block =
       factory()->NewBlock(for_info.bound_names.length() + 4, false);
@@ -2198,7 +2204,7 @@ Statement* Parser::DesugarLexicalBindingsInForStatement(
 
     Block* ignore_completion_block =
         factory()->NewBlock(for_info.bound_names.length() + 3, true);
-    ZoneList<Variable*> inner_vars(for_info.bound_names.length(), zone());
+    ZonePtrList<Variable> inner_vars(for_info.bound_names.length(), zone());
     // For each let variable x:
     //    make statement: let/const x = temp_x.
     for (int i = 0; i < for_info.bound_names.length(); i++) {
@@ -2441,10 +2447,6 @@ void Parser::DeclareArrowFunctionFormalParameters(
 }
 
 void Parser::PrepareGeneratorVariables() {
-  // The code produced for generators relies on forced context allocation of
-  // parameters (it does not restore the frame's parameters upon resume).
-  function_state_->scope()->ForceContextAllocationForParameters();
-
   // Calling a generator returns a generator object.  That object is stored
   // in a temporary variable, a definition that is used by "yield"
   // expressions.
@@ -2457,7 +2459,7 @@ FunctionLiteral* Parser::ParseFunctionLiteral(
     FunctionNameValidity function_name_validity, FunctionKind kind,
     int function_token_pos, FunctionLiteral::FunctionType function_type,
     LanguageMode language_mode,
-    ZoneList<const AstRawString*>* arguments_for_wrapped_function, bool* ok) {
+    ZonePtrList<const AstRawString>* arguments_for_wrapped_function, bool* ok) {
   // Function ::
   //   '(' FormalParameterList? ')' '{' FunctionBody '}'
   //
@@ -2568,7 +2570,7 @@ FunctionLiteral* Parser::ParseFunctionLiteral(
   bool should_preparse =
       (parse_lazily() && is_lazy_top_level_function) || should_preparse_inner;
 
-  ZoneList<Statement*>* body = nullptr;
+  ZonePtrList<Statement>* body = nullptr;
   int expected_property_count = -1;
   int suspend_count = -1;
   int num_parameters = -1;
@@ -2651,7 +2653,7 @@ FunctionLiteral* Parser::ParseFunctionLiteral(
                                                    : "preparse-resolution")
                                    : "full-parse";
       logger_->FunctionEvent(
-          event_name, nullptr, script_id(), ms, scope->start_position(),
+          event_name, script_id(), ms, scope->start_position(),
           scope->end_position(),
           reinterpret_cast<const char*>(function_name->raw_data()),
           function_name->byte_length());
@@ -2862,7 +2864,7 @@ Block* Parser::BuildParameterInitializationBlock(
     DeclarationDescriptor descriptor;
     descriptor.declaration_kind = DeclarationDescriptor::PARAMETER;
     descriptor.scope = scope();
-    descriptor.mode = LET;
+    descriptor.mode = VariableMode::kLet;
     descriptor.declaration_pos = parameter->pattern->position();
     // The position that will be used by the AssignmentExpression
     // which copies from the temp parameter to the pattern.
@@ -2924,7 +2926,8 @@ Block* Parser::BuildParameterInitializationBlock(
 
 Scope* Parser::NewHiddenCatchScope() {
   Scope* catch_scope = NewScopeWithParent(scope(), CATCH_SCOPE);
-  catch_scope->DeclareLocal(ast_value_factory()->dot_catch_string(), VAR);
+  catch_scope->DeclareLocal(ast_value_factory()->dot_catch_string(),
+                            VariableMode::kVar);
   catch_scope->set_is_hidden();
   return catch_scope;
 }
@@ -2946,7 +2949,7 @@ Block* Parser::BuildRejectPromiseOnException(Block* inner_block) {
   {
     Expression* create_promise = factory()->NewCallRuntime(
         Context::ASYNC_FUNCTION_PROMISE_CREATE_INDEX,
-        new (zone()) ZoneList<Expression*>(0, zone()), kNoSourcePosition);
+        new (zone()) ZonePtrList<Expression>(0, zone()), kNoSourcePosition);
     Assignment* assign_promise = factory()->NewAssignment(
         Token::ASSIGN, factory()->NewVariableProxy(PromiseVariable()),
         create_promise, kNoSourcePosition);
@@ -2971,11 +2974,15 @@ Block* Parser::BuildRejectPromiseOnException(Block* inner_block) {
   // There is no TryCatchFinally node, so wrap it in an outer try/finally
   Block* outer_try_block = IgnoreCompletion(try_catch_statement);
 
-  // finally { %AsyncFunctionPromiseRelease(.promise) }
+  // finally { %AsyncFunctionPromiseRelease(.promise, can_suspend) }
   Block* finally_block;
   {
-    ZoneList<Expression*>* args = new (zone()) ZoneList<Expression*>(1, zone());
+    ZonePtrList<Expression>* args =
+        new (zone()) ZonePtrList<Expression>(1, zone());
     args->Add(factory()->NewVariableProxy(PromiseVariable()), zone());
+    args->Add(factory()->NewBooleanLiteral(function_state_->CanSuspend(),
+                                           kNoSourcePosition),
+              zone());
     Expression* call_promise_release = factory()->NewCallRuntime(
         Context::ASYNC_FUNCTION_PROMISE_RELEASE_INDEX, args, kNoSourcePosition);
     Statement* promise_release = factory()->NewExpressionStatement(
@@ -2992,7 +2999,8 @@ Block* Parser::BuildRejectPromiseOnException(Block* inner_block) {
 
 Expression* Parser::BuildResolvePromise(Expression* value, int pos) {
   // %ResolvePromise(.promise, value), .promise
-  ZoneList<Expression*>* args = new (zone()) ZoneList<Expression*>(2, zone());
+  ZonePtrList<Expression>* args =
+      new (zone()) ZonePtrList<Expression>(2, zone());
   args->Add(factory()->NewVariableProxy(PromiseVariable()), zone());
   args->Add(value, zone());
   Expression* call_runtime =
@@ -3006,7 +3014,8 @@ Expression* Parser::BuildRejectPromise(Expression* value, int pos) {
   // %promise_internal_reject(.promise, value, false), .promise
   // Disables the additional debug event for the rejection since a debug event
   // already happened for the exception that got us here.
-  ZoneList<Expression*>* args = new (zone()) ZoneList<Expression*>(3, zone());
+  ZonePtrList<Expression>* args =
+      new (zone()) ZonePtrList<Expression>(3, zone());
   args->Add(factory()->NewVariableProxy(PromiseVariable()), zone());
   args->Add(value, zone());
   args->Add(factory()->NewBooleanLiteral(false, pos), zone());
@@ -3040,13 +3049,13 @@ Expression* Parser::BuildInitialYield(int pos, FunctionKind kind) {
                              Suspend::kOnExceptionThrow);
 }
 
-ZoneList<Statement*>* Parser::ParseFunction(
+ZonePtrList<Statement>* Parser::ParseFunction(
     const AstRawString* function_name, int pos, FunctionKind kind,
     FunctionLiteral::FunctionType function_type,
     DeclarationScope* function_scope, int* num_parameters, int* function_length,
     bool* has_duplicate_parameters, int* expected_property_count,
     int* suspend_count,
-    ZoneList<const AstRawString*>* arguments_for_wrapped_function, bool* ok) {
+    ZonePtrList<const AstRawString>* arguments_for_wrapped_function, bool* ok) {
   ParsingModeScope mode(this, allow_lazy_ ? PARSE_LAZILY : PARSE_EAGERLY);
 
   FunctionState function_state(&function_state_, &scope_, function_scope);
@@ -3113,7 +3122,7 @@ ZoneList<Statement*>* Parser::ParseFunction(
   *num_parameters = formals.num_parameters();
   *function_length = formals.function_length;
 
-  ZoneList<Statement*>* body = new (zone()) ZoneList<Statement*>(8, zone());
+  ZonePtrList<Statement>* body = new (zone()) ZonePtrList<Statement>(8, zone());
   ParseFunctionBody(body, function_name, pos, formals, kind, function_type, ok);
 
   // Validate parameter names. We can do this only after parsing the function,
@@ -3145,9 +3154,9 @@ void Parser::DeclareClassVariable(const AstRawString* name,
     VariableProxy* proxy = factory()->NewVariableProxy(name, NORMAL_VARIABLE);
     Declaration* declaration =
         factory()->NewVariableDeclaration(proxy, class_token_pos);
-    class_info->variable =
-        Declare(declaration, DeclarationDescriptor::NORMAL, CONST,
-                Variable::DefaultInitializationFlag(CONST), ok);
+    class_info->variable = Declare(
+        declaration, DeclarationDescriptor::NORMAL, VariableMode::kConst,
+        Variable::DefaultInitializationFlag(VariableMode::kConst), ok);
   }
 }
 
@@ -3159,8 +3168,9 @@ Variable* Parser::CreateSyntheticContextVariable(const AstRawString* name,
   VariableProxy* proxy = factory()->NewVariableProxy(name, NORMAL_VARIABLE);
   Declaration* declaration =
       factory()->NewVariableDeclaration(proxy, kNoSourcePosition);
-  Variable* var = Declare(declaration, DeclarationDescriptor::NORMAL, CONST,
-                          Variable::DefaultInitializationFlag(CONST), CHECK_OK);
+  Variable* var = Declare(
+      declaration, DeclarationDescriptor::NORMAL, VariableMode::kConst,
+      Variable::DefaultInitializationFlag(VariableMode::kConst), CHECK_OK);
   var->ForceContextAllocation();
   return var;
 }
@@ -3223,11 +3233,11 @@ void Parser::DeclareClassProperty(const AstRawString* class_name,
 }
 
 FunctionLiteral* Parser::CreateInitializerFunction(
-    DeclarationScope* scope, ZoneList<ClassLiteral::Property*>* fields) {
+    DeclarationScope* scope, ZonePtrList<ClassLiteral::Property>* fields) {
   DCHECK_EQ(scope->function_kind(),
             FunctionKind::kClassFieldsInitializerFunction);
   // function() { .. class fields initializer .. }
-  ZoneList<Statement*>* statements = NewStatementList(1);
+  ZonePtrList<Statement>* statements = NewStatementList(1);
   InitializeClassFieldsStatement* static_fields =
       factory()->NewInitializeClassFieldsStatement(fields, kNoSourcePosition);
   statements->Add(static_fields, zone());
@@ -3325,7 +3335,8 @@ void Parser::InsertShadowingVarBindingInitializers(Block* inner_block) {
   DCHECK(function_scope->is_function_scope());
   BlockState block_state(&scope_, inner_scope);
   for (Declaration* decl : *inner_scope->declarations()) {
-    if (decl->proxy()->var()->mode() != VAR || !decl->IsVariableDeclaration()) {
+    if (decl->proxy()->var()->mode() != VariableMode::kVar ||
+        !decl->IsVariableDeclaration()) {
       continue;
     }
     const AstRawString* name = decl->proxy()->raw_name();
@@ -3426,9 +3437,7 @@ void Parser::ParseOnBackground(ParseInfo* info) {
   RuntimeCallTimerScope runtimeTimer(
       runtime_call_stats_, RuntimeCallCounterId::kParseBackgroundProgram);
   parsing_on_main_thread_ = false;
-  if (!info->script().is_null()) {
-    set_script_id(info->script()->id());
-  }
+  set_script_id(info->script_id());
 
   DCHECK_NULL(info->literal());
   FunctionLiteral* result = nullptr;
@@ -3446,9 +3455,10 @@ void Parser::ParseOnBackground(ParseInfo* info) {
   // scopes) and set their end position after we know the script length.
   if (info->is_toplevel()) {
     fni_ = new (zone()) FuncNameInferrer(ast_value_factory(), zone());
-    result = DoParseProgram(info);
+    result = DoParseProgram(/* isolate = */ nullptr, info);
   } else {
-    result = DoParseFunction(info, info->function_name());
+    result =
+        DoParseFunction(/* isolate = */ nullptr, info, info->function_name());
   }
   MaybeResetCharacterStream(info, result);
 
@@ -3485,9 +3495,9 @@ Expression* Parser::CloseTemplateLiteral(TemplateLiteralState* state, int start,
                                          Expression* tag) {
   TemplateLiteral* lit = *state;
   int pos = lit->position();
-  const ZoneList<const AstRawString*>* cooked_strings = lit->cooked();
-  const ZoneList<const AstRawString*>* raw_strings = lit->raw();
-  const ZoneList<Expression*>* expressions = lit->expressions();
+  const ZonePtrList<const AstRawString>* cooked_strings = lit->cooked();
+  const ZonePtrList<const AstRawString>* raw_strings = lit->raw();
+  const ZonePtrList<Expression>* expressions = lit->expressions();
   DCHECK_EQ(cooked_strings->length(), raw_strings->length());
   DCHECK_EQ(cooked_strings->length(), expressions->length() + 1);
 
@@ -3502,8 +3512,8 @@ Expression* Parser::CloseTemplateLiteral(TemplateLiteralState* state, int start,
         factory()->NewGetTemplateObject(cooked_strings, raw_strings, pos);
 
     // Call TagFn
-    ZoneList<Expression*>* call_args =
-        new (zone()) ZoneList<Expression*>(expressions->length() + 1, zone());
+    ZonePtrList<Expression>* call_args =
+        new (zone()) ZonePtrList<Expression>(expressions->length() + 1, zone());
     call_args->Add(template_object, zone());
     call_args->AddAll(*expressions, zone());
     return factory()->NewTaggedTemplate(tag, call_args, pos);
@@ -3512,7 +3522,7 @@ Expression* Parser::CloseTemplateLiteral(TemplateLiteralState* state, int start,
 
 namespace {
 
-bool OnlyLastArgIsSpread(ZoneList<Expression*>* args) {
+bool OnlyLastArgIsSpread(ZonePtrList<Expression>* args) {
   for (int i = 0; i < args->length() - 1; i++) {
     if (args->at(i)->IsSpread()) {
       return false;
@@ -3524,7 +3534,7 @@ bool OnlyLastArgIsSpread(ZoneList<Expression*>* args) {
 }  // namespace
 
 ArrayLiteral* Parser::ArrayLiteralFromListWithSpread(
-    ZoneList<Expression*>* list) {
+    ZonePtrList<Expression>* list) {
   // If there's only a single spread argument, a fast path using CallWithSpread
   // is taken.
   DCHECK_LT(1, list->length());
@@ -3540,64 +3550,49 @@ ArrayLiteral* Parser::ArrayLiteralFromListWithSpread(
 }
 
 Expression* Parser::SpreadCall(Expression* function,
-                               ZoneList<Expression*>* args_list, int pos,
+                               ZonePtrList<Expression>* args_list, int pos,
                                Call::PossiblyEval is_possibly_eval) {
   // Handle this case in BytecodeGenerator.
-  if (OnlyLastArgIsSpread(args_list)) {
+  if (OnlyLastArgIsSpread(args_list) || function->IsSuperCallReference()) {
     return factory()->NewCall(function, args_list, pos);
   }
 
-  if (function->IsSuperCallReference()) {
-    // Super calls
-    // $super_constructor = %_GetSuperConstructor(<this-function>)
-    // %reflect_construct($super_constructor, args, new.target)
-    ZoneList<Expression*>* args = new (zone()) ZoneList<Expression*>(3, zone());
-    ZoneList<Expression*>* tmp = new (zone()) ZoneList<Expression*>(1, zone());
-    tmp->Add(function->AsSuperCallReference()->this_function_var(), zone());
-    args->Add(factory()->NewCallRuntime(Runtime::kInlineGetSuperConstructor,
-                                        tmp, pos),
-              zone());
-    args->Add(ArrayLiteralFromListWithSpread(args_list), zone());
-    args->Add(function->AsSuperCallReference()->new_target_var(), zone());
-    return factory()->NewCallRuntime(Context::REFLECT_CONSTRUCT_INDEX, args,
-                                     pos);
-  } else {
-    ZoneList<Expression*>* args = new (zone()) ZoneList<Expression*>(3, zone());
-    if (function->IsProperty()) {
-      // Method calls
-      if (function->AsProperty()->IsSuperAccess()) {
-        Expression* home = ThisExpression(kNoSourcePosition);
-        args->Add(function, zone());
-        args->Add(home, zone());
-      } else {
-        Variable* temp = NewTemporary(ast_value_factory()->empty_string());
-        VariableProxy* obj = factory()->NewVariableProxy(temp);
-        Assignment* assign_obj = factory()->NewAssignment(
-            Token::ASSIGN, obj, function->AsProperty()->obj(),
-            kNoSourcePosition);
-        function = factory()->NewProperty(
-            assign_obj, function->AsProperty()->key(), kNoSourcePosition);
-        args->Add(function, zone());
-        obj = factory()->NewVariableProxy(temp);
-        args->Add(obj, zone());
-      }
+  ZonePtrList<Expression>* args =
+      new (zone()) ZonePtrList<Expression>(3, zone());
+  if (function->IsProperty()) {
+    // Method calls
+    if (function->AsProperty()->IsSuperAccess()) {
+      Expression* home = ThisExpression(kNoSourcePosition);
+      args->Add(function, zone());
+      args->Add(home, zone());
     } else {
-      // Non-method calls
+      Variable* temp = NewTemporary(ast_value_factory()->empty_string());
+      VariableProxy* obj = factory()->NewVariableProxy(temp);
+      Assignment* assign_obj = factory()->NewAssignment(
+          Token::ASSIGN, obj, function->AsProperty()->obj(), kNoSourcePosition);
+      function = factory()->NewProperty(
+          assign_obj, function->AsProperty()->key(), kNoSourcePosition);
       args->Add(function, zone());
-      args->Add(factory()->NewUndefinedLiteral(kNoSourcePosition), zone());
+      obj = factory()->NewVariableProxy(temp);
+      args->Add(obj, zone());
     }
-    args->Add(ArrayLiteralFromListWithSpread(args_list), zone());
-    return factory()->NewCallRuntime(Context::REFLECT_APPLY_INDEX, args, pos);
+  } else {
+    // Non-method calls
+    args->Add(function, zone());
+    args->Add(factory()->NewUndefinedLiteral(kNoSourcePosition), zone());
   }
+  args->Add(ArrayLiteralFromListWithSpread(args_list), zone());
+  return factory()->NewCallRuntime(Context::REFLECT_APPLY_INDEX, args, pos);
 }
 
 Expression* Parser::SpreadCallNew(Expression* function,
-                                  ZoneList<Expression*>* args_list, int pos) {
+                                  ZonePtrList<Expression>* args_list, int pos) {
   if (OnlyLastArgIsSpread(args_list)) {
     // Handle in BytecodeGenerator.
     return factory()->NewCallNew(function, args_list, pos);
   }
-  ZoneList<Expression*>* args = new (zone()) ZoneList<Expression*>(2, zone());
+  ZonePtrList<Expression>* args =
+      new (zone()) ZonePtrList<Expression>(2, zone());
   args->Add(function, zone());
   args->Add(ArrayLiteralFromListWithSpread(args_list), zone());
 
@@ -3625,7 +3620,7 @@ void Parser::SetAsmModule() {
   scope()->AsDeclarationScope()->set_asm_module();
 }
 
-Expression* Parser::ExpressionListToExpression(ZoneList<Expression*>* args) {
+Expression* Parser::ExpressionListToExpression(ZonePtrList<Expression>* args) {
   Expression* expr = args->at(0);
   for (int i = 1; i < args->length(); ++i) {
     expr = factory()->NewBinaryOperation(Token::COMMA, expr, args->at(i),
@@ -3635,8 +3630,9 @@ Expression* Parser::ExpressionListToExpression(ZoneList<Expression*>* args) {
 }
 
 // This method completes the desugaring of the body of async_function.
-void Parser::RewriteAsyncFunctionBody(ZoneList<Statement*>* body, Block* block,
-                                      Expression* return_value, bool* ok) {
+void Parser::RewriteAsyncFunctionBody(ZonePtrList<Statement>* body,
+                                      Block* block, Expression* return_value,
+                                      bool* ok) {
   // function async_function() {
   //   .generator_object = %CreateJSGeneratorObject();
   //   BuildRejectPromiseOnException({
@@ -3768,7 +3764,7 @@ Statement* Parser::CheckCallable(Variable* var, Expression* error, int pos) {
   return validate_var;
 }
 
-void Parser::BuildIteratorClose(ZoneList<Statement*>* statements,
+void Parser::BuildIteratorClose(ZonePtrList<Statement>* statements,
                                 Variable* iterator, Variable* input,
                                 Variable* var_output, IteratorType type) {
   //
@@ -3820,7 +3816,7 @@ void Parser::BuildIteratorClose(ZoneList<Statement*>* statements,
   // output = %_Call(iteratorReturn, iterator, input);
   Statement* call_return;
   {
-    auto args = new (zone()) ZoneList<Expression*>(3, zone());
+    auto args = new (zone()) ZonePtrList<Expression>(3, zone());
     args->Add(factory()->NewVariableProxy(var_return), zone());
     args->Add(factory()->NewVariableProxy(iterator), zone());
     args->Add(factory()->NewVariableProxy(input), zone());
@@ -3842,7 +3838,7 @@ void Parser::BuildIteratorClose(ZoneList<Statement*>* statements,
   {
     Expression* is_receiver_call;
     {
-      auto args = new (zone()) ZoneList<Expression*>(1, zone());
+      auto args = new (zone()) ZonePtrList<Expression>(1, zone());
       args->Add(factory()->NewVariableProxy(var_output), zone());
       is_receiver_call =
           factory()->NewCallRuntime(Runtime::kInlineIsJSReceiver, args, nopos);
@@ -3850,7 +3846,7 @@ void Parser::BuildIteratorClose(ZoneList<Statement*>* statements,
 
     Statement* throw_call;
     {
-      auto args = new (zone()) ZoneList<Expression*>(1, zone());
+      auto args = new (zone()) ZonePtrList<Expression>(1, zone());
       args->Add(factory()->NewVariableProxy(var_output), zone());
       Expression* call = factory()->NewCallRuntime(
           Runtime::kThrowIteratorResultNotAnObject, args, nopos);
@@ -3948,7 +3944,7 @@ void Parser::FinalizeIteratorUse(Variable* completion, Expression* condition,
     // TryCatchStatementForReThrow below (which does not clear the pending
     // message), rather than a TryCatchStatement.
     {
-      auto args = new (zone()) ZoneList<Expression*>(1, zone());
+      auto args = new (zone()) ZonePtrList<Expression>(1, zone());
       args->Add(factory()->NewVariableProxy(catch_scope->catch_variable()),
                 zone());
       rethrow = factory()->NewExpressionStatement(
@@ -3977,7 +3973,7 @@ void Parser::FinalizeIteratorUse(Variable* completion, Expression* condition,
   target->statements()->Add(try_finally, zone());
 }
 
-void Parser::BuildIteratorCloseForCompletion(ZoneList<Statement*>* statements,
+void Parser::BuildIteratorCloseForCompletion(ZonePtrList<Statement>* statements,
                                              Variable* iterator,
                                              Expression* completion,
                                              IteratorType type) {
@@ -4039,7 +4035,7 @@ void Parser::BuildIteratorCloseForCompletion(ZoneList<Statement*>* statements,
   // try { %_Call(iteratorReturn, iterator) } catch (_) { }
   Statement* try_call_return;
   {
-    auto args = new (zone()) ZoneList<Expression*>(2, zone());
+    auto args = new (zone()) ZonePtrList<Expression>(2, zone());
     args->Add(factory()->NewVariableProxy(var_return), zone());
     args->Add(factory()->NewVariableProxy(iterator), zone());
 
@@ -4069,7 +4065,7 @@ void Parser::BuildIteratorCloseForCompletion(ZoneList<Statement*>* statements,
     Variable* var_output = NewTemporary(ast_value_factory()->empty_string());
     Statement* call_return;
     {
-      auto args = new (zone()) ZoneList<Expression*>(2, zone());
+      auto args = new (zone()) ZonePtrList<Expression>(2, zone());
       args->Add(factory()->NewVariableProxy(var_return), zone());
       args->Add(factory()->NewVariableProxy(iterator), zone());
       Expression* call =
@@ -4087,7 +4083,7 @@ void Parser::BuildIteratorCloseForCompletion(ZoneList<Statement*>* statements,
 
     Expression* is_receiver_call;
     {
-      auto args = new (zone()) ZoneList<Expression*>(1, zone());
+      auto args = new (zone()) ZonePtrList<Expression>(1, zone());
       args->Add(factory()->NewVariableProxy(var_output), zone());
       is_receiver_call =
           factory()->NewCallRuntime(Runtime::kInlineIsJSReceiver, args, nopos);
@@ -4095,7 +4091,7 @@ void Parser::BuildIteratorCloseForCompletion(ZoneList<Statement*>* statements,
 
     Statement* throw_call;
     {
-      auto args = new (zone()) ZoneList<Expression*>(1, zone());
+      auto args = new (zone()) ZonePtrList<Expression>(1, zone());
       args->Add(factory()->NewVariableProxy(var_output), zone());
       Expression* call = factory()->NewCallRuntime(
           Runtime::kThrowIteratorResultNotAnObject, args, nopos);
diff --git a/deps/v8/src/parsing/parser.h b/deps/v8/src/parsing/parser.h
index 2da4490906a029..2dec83b274c157 100644
--- a/deps/v8/src/parsing/parser.h
+++ b/deps/v8/src/parsing/parser.h
@@ -125,12 +125,12 @@ struct ParserTypes<Parser> {
   typedef ClassLiteral::Property* ClassLiteralProperty;
   typedef v8::internal::Suspend* Suspend;
   typedef v8::internal::RewritableExpression* RewritableExpression;
-  typedef ZoneList<v8::internal::Expression*>* ExpressionList;
-  typedef ZoneList<ObjectLiteral::Property*>* ObjectPropertyList;
-  typedef ZoneList<ClassLiteral::Property*>* ClassPropertyList;
+  typedef ZonePtrList<v8::internal::Expression>* ExpressionList;
+  typedef ZonePtrList<ObjectLiteral::Property>* ObjectPropertyList;
+  typedef ZonePtrList<ClassLiteral::Property>* ClassPropertyList;
   typedef ParserFormalParameters FormalParameters;
   typedef v8::internal::Statement* Statement;
-  typedef ZoneList<v8::internal::Statement*>* StatementList;
+  typedef ZonePtrList<v8::internal::Statement>* StatementList;
   typedef v8::internal::Block* Block;
   typedef v8::internal::BreakableStatement* BreakableStatement;
   typedef v8::internal::ForStatement* ForStatement;
@@ -163,7 +163,7 @@ class V8_EXPORT_PRIVATE Parser : public NON_EXPORTED_BASE(ParserBase<Parser>) {
   // This only deserializes the scope chain, but doesn't connect the scopes to
   // their corresponding scope infos. Therefore, looking up variables in the
   // deserialized scopes is not possible.
-  void DeserializeScopeChain(ParseInfo* info,
+  void DeserializeScopeChain(Isolate* isolate, ParseInfo* info,
                              MaybeHandle<ScopeInfo> maybe_outer_scope_info);
 
   // Move statistics to Isolate
@@ -216,20 +216,22 @@ class V8_EXPORT_PRIVATE Parser : public NON_EXPORTED_BASE(ParserBase<Parser>) {
 
   FunctionLiteral* ParseFunction(Isolate* isolate, ParseInfo* info,
                                  Handle<SharedFunctionInfo> shared_info);
-  FunctionLiteral* DoParseFunction(ParseInfo* info,
+  FunctionLiteral* DoParseFunction(Isolate* isolate, ParseInfo* info,
                                    const AstRawString* raw_name);
 
   // Called by ParseProgram after setting up the scanner.
-  FunctionLiteral* DoParseProgram(ParseInfo* info);
+  FunctionLiteral* DoParseProgram(Isolate* isolate, ParseInfo* info);
 
   // Parse with the script as if the source is implicitly wrapped in a function.
   // We manually construct the AST and scopes for a top-level function and the
   // function wrapper.
-  void ParseWrapped(ParseInfo* info, ZoneList<Statement*>* body,
-                    DeclarationScope* scope, Zone* zone, bool* ok);
+  void ParseWrapped(Isolate* isolate, ParseInfo* info,
+                    ZonePtrList<Statement>* body, DeclarationScope* scope,
+                    Zone* zone, bool* ok);
 
-  ZoneList<const AstRawString*>* PrepareWrappedArguments(ParseInfo* info,
-                                                         Zone* zone);
+  ZonePtrList<const AstRawString>* PrepareWrappedArguments(Isolate* isolate,
+                                                           ParseInfo* info,
+                                                           Zone* zone);
 
   void StitchAst(ParseInfo* top_level_parse_info, Isolate* isolate);
 
@@ -247,7 +249,6 @@ class V8_EXPORT_PRIVATE Parser : public NON_EXPORTED_BASE(ParserBase<Parser>) {
       SET_ALLOW(harmony_dynamic_import);
       SET_ALLOW(harmony_import_meta);
       SET_ALLOW(harmony_bigint);
-      SET_ALLOW(harmony_optional_catch_binding);
       SET_ALLOW(harmony_private_fields);
       SET_ALLOW(eval_cache);
 #undef SET_ALLOW
@@ -255,15 +256,15 @@ class V8_EXPORT_PRIVATE Parser : public NON_EXPORTED_BASE(ParserBase<Parser>) {
     return reusable_preparser_;
   }
 
-  void ParseModuleItemList(ZoneList<Statement*>* body, bool* ok);
+  void ParseModuleItemList(ZonePtrList<Statement>* body, bool* ok);
   Statement* ParseModuleItem(bool* ok);
   const AstRawString* ParseModuleSpecifier(bool* ok);
   void ParseImportDeclaration(bool* ok);
   Statement* ParseExportDeclaration(bool* ok);
   Statement* ParseExportDefault(bool* ok);
-  void ParseExportClause(ZoneList<const AstRawString*>* export_names,
+  void ParseExportClause(ZonePtrList<const AstRawString>* export_names,
                          ZoneList<Scanner::Location>* export_locations,
-                         ZoneList<const AstRawString*>* local_names,
+                         ZonePtrList<const AstRawString>* local_names,
                          Scanner::Location* reserved_loc, bool* ok);
   struct NamedImport : public ZoneObject {
     const AstRawString* import_name;
@@ -275,13 +276,13 @@ class V8_EXPORT_PRIVATE Parser : public NON_EXPORTED_BASE(ParserBase<Parser>) {
           local_name(local_name),
           location(location) {}
   };
-  ZoneList<const NamedImport*>* ParseNamedImports(int pos, bool* ok);
+  ZonePtrList<const NamedImport>* ParseNamedImports(int pos, bool* ok);
   Block* BuildInitializationBlock(DeclarationParsingResult* parsing_result,
-                                  ZoneList<const AstRawString*>* names,
+                                  ZonePtrList<const AstRawString>* names,
                                   bool* ok);
-  ZoneList<const AstRawString*>* DeclareLabel(
-      ZoneList<const AstRawString*>* labels, VariableProxy* expr, bool* ok);
-  bool ContainsLabel(ZoneList<const AstRawString*>* labels,
+  ZonePtrList<const AstRawString>* DeclareLabel(
+      ZonePtrList<const AstRawString>* labels, VariableProxy* expr, bool* ok);
+  bool ContainsLabel(ZonePtrList<const AstRawString>* labels,
                      const AstRawString* label);
   Expression* RewriteReturn(Expression* return_value, int pos);
   Statement* RewriteSwitchStatement(SwitchStatement* switch_statement,
@@ -294,10 +295,10 @@ class V8_EXPORT_PRIVATE Parser : public NON_EXPORTED_BASE(ParserBase<Parser>) {
                                  const SourceRange& finally_range,
                                  const CatchInfo& catch_info, int pos);
   void ParseAndRewriteGeneratorFunctionBody(int pos, FunctionKind kind,
-                                            ZoneList<Statement*>* body,
+                                            ZonePtrList<Statement>* body,
                                             bool* ok);
   void ParseAndRewriteAsyncGeneratorFunctionBody(int pos, FunctionKind kind,
-                                                 ZoneList<Statement*>* body,
+                                                 ZonePtrList<Statement>* body,
                                                  bool* ok);
   void DeclareFunctionNameVar(const AstRawString* function_name,
                               FunctionLiteral::FunctionType function_type,
@@ -306,14 +307,14 @@ class V8_EXPORT_PRIVATE Parser : public NON_EXPORTED_BASE(ParserBase<Parser>) {
   Statement* DeclareFunction(const AstRawString* variable_name,
                              FunctionLiteral* function, VariableMode mode,
                              int pos, bool is_sloppy_block_function,
-                             ZoneList<const AstRawString*>* names, bool* ok);
+                             ZonePtrList<const AstRawString>* names, bool* ok);
   Variable* CreateSyntheticContextVariable(const AstRawString* synthetic_name,
                                            bool* ok);
   FunctionLiteral* CreateInitializerFunction(
-      DeclarationScope* scope, ZoneList<ClassLiteral::Property*>* fields);
+      DeclarationScope* scope, ZonePtrList<ClassLiteral::Property>* fields);
   V8_INLINE Statement* DeclareClass(const AstRawString* variable_name,
                                     Expression* value,
-                                    ZoneList<const AstRawString*>* names,
+                                    ZonePtrList<const AstRawString>* names,
                                     int class_token_pos, int end_pos, bool* ok);
   V8_INLINE void DeclareClassVariable(const AstRawString* name,
                                       ClassInfo* class_info,
@@ -341,7 +342,7 @@ class V8_EXPORT_PRIVATE Parser : public NON_EXPORTED_BASE(ParserBase<Parser>) {
   void DeclareAndInitializeVariables(
       Block* block, const DeclarationDescriptor* declaration_descriptor,
       const DeclarationParsingResult::Declaration* declaration,
-      ZoneList<const AstRawString*>* names, bool* ok);
+      ZonePtrList<const AstRawString>* names, bool* ok);
   void RewriteDestructuringAssignment(RewritableExpression* expr);
   Expression* RewriteDestructuringAssignment(Assignment* assignment);
 
@@ -382,7 +383,8 @@ class V8_EXPORT_PRIVATE Parser : public NON_EXPORTED_BASE(ParserBase<Parser>) {
       FunctionNameValidity function_name_validity, FunctionKind kind,
       int function_token_position, FunctionLiteral::FunctionType type,
       LanguageMode language_mode,
-      ZoneList<const AstRawString*>* arguments_for_wrapped_function, bool* ok);
+      ZonePtrList<const AstRawString>* arguments_for_wrapped_function,
+      bool* ok);
 
   ObjectLiteral* InitializeObjectLiteral(ObjectLiteral* object_literal) {
     object_literal->CalculateEmitStore(main_zone());
@@ -447,13 +449,14 @@ class V8_EXPORT_PRIVATE Parser : public NON_EXPORTED_BASE(ParserBase<Parser>) {
       const ParserFormalParameters& parameters, bool* ok);
   Block* BuildRejectPromiseOnException(Block* block);
 
-  ZoneList<Statement*>* ParseFunction(
+  ZonePtrList<Statement>* ParseFunction(
       const AstRawString* function_name, int pos, FunctionKind kind,
       FunctionLiteral::FunctionType function_type,
       DeclarationScope* function_scope, int* num_parameters,
       int* function_length, bool* has_duplicate_parameters,
       int* expected_property_count, int* suspend_count,
-      ZoneList<const AstRawString*>* arguments_for_wrapped_function, bool* ok);
+      ZonePtrList<const AstRawString>* arguments_for_wrapped_function,
+      bool* ok);
 
   void ThrowPendingError(Isolate* isolate, Handle<Script> script);
 
@@ -462,9 +465,9 @@ class V8_EXPORT_PRIVATE Parser : public NON_EXPORTED_BASE(ParserBase<Parser>) {
     TemplateLiteral(Zone* zone, int pos)
         : cooked_(8, zone), raw_(8, zone), expressions_(8, zone), pos_(pos) {}
 
-    const ZoneList<const AstRawString*>* cooked() const { return &cooked_; }
-    const ZoneList<const AstRawString*>* raw() const { return &raw_; }
-    const ZoneList<Expression*>* expressions() const { return &expressions_; }
+    const ZonePtrList<const AstRawString>* cooked() const { return &cooked_; }
+    const ZonePtrList<const AstRawString>* raw() const { return &raw_; }
+    const ZonePtrList<Expression>* expressions() const { return &expressions_; }
     int position() const { return pos_; }
 
     void AddTemplateSpan(const AstRawString* cooked, const AstRawString* raw,
@@ -480,9 +483,9 @@ class V8_EXPORT_PRIVATE Parser : public NON_EXPORTED_BASE(ParserBase<Parser>) {
     }
 
    private:
-    ZoneList<const AstRawString*> cooked_;
-    ZoneList<const AstRawString*> raw_;
-    ZoneList<Expression*> expressions_;
+    ZonePtrList<const AstRawString> cooked_;
+    ZonePtrList<const AstRawString> raw_;
+    ZonePtrList<Expression> expressions_;
     int pos_;
   };
 
@@ -502,10 +505,10 @@ class V8_EXPORT_PRIVATE Parser : public NON_EXPORTED_BASE(ParserBase<Parser>) {
   Expression* CloseTemplateLiteral(TemplateLiteralState* state, int start,
                                    Expression* tag);
 
-  ArrayLiteral* ArrayLiteralFromListWithSpread(ZoneList<Expression*>* list);
-  Expression* SpreadCall(Expression* function, ZoneList<Expression*>* args,
+  ArrayLiteral* ArrayLiteralFromListWithSpread(ZonePtrList<Expression>* list);
+  Expression* SpreadCall(Expression* function, ZonePtrList<Expression>* args,
                          int pos, Call::PossiblyEval is_possibly_eval);
-  Expression* SpreadCallNew(Expression* function, ZoneList<Expression*>* args,
+  Expression* SpreadCallNew(Expression* function, ZonePtrList<Expression>* args,
                             int pos);
   Expression* RewriteSuperCall(Expression* call_expression);
 
@@ -541,15 +544,16 @@ class V8_EXPORT_PRIVATE Parser : public NON_EXPORTED_BASE(ParserBase<Parser>) {
 
   Statement* FinalizeForOfStatement(ForOfStatement* loop, Variable* completion,
                                     IteratorType type, int pos);
-  void BuildIteratorClose(ZoneList<Statement*>* statements, Variable* iterator,
-                          Variable* input, Variable* output, IteratorType type);
-  void BuildIteratorCloseForCompletion(ZoneList<Statement*>* statements,
+  void BuildIteratorClose(ZonePtrList<Statement>* statements,
+                          Variable* iterator, Variable* input, Variable* output,
+                          IteratorType type);
+  void BuildIteratorCloseForCompletion(ZonePtrList<Statement>* statements,
                                        Variable* iterator,
                                        Expression* completion,
                                        IteratorType type);
   Statement* CheckCallable(Variable* var, Expression* error, int pos);
 
-  V8_INLINE void RewriteAsyncFunctionBody(ZoneList<Statement*>* body,
+  V8_INLINE void RewriteAsyncFunctionBody(ZonePtrList<Statement>* body,
                                           Block* block,
                                           Expression* return_value, bool* ok);
 
@@ -709,7 +713,8 @@ class V8_EXPORT_PRIVATE Parser : public NON_EXPORTED_BASE(ParserBase<Parser>) {
   // A shortcut for performing a ToString operation
   V8_INLINE Expression* ToString(Expression* expr) {
     if (expr->IsStringLiteral()) return expr;
-    ZoneList<Expression*>* args = new (zone()) ZoneList<Expression*>(1, zone());
+    ZonePtrList<Expression>* args =
+        new (zone()) ZonePtrList<Expression>(1, zone());
     args->Add(expr, zone());
     return factory()->NewCallRuntime(Runtime::kInlineToString, args,
                                      expr->position());
@@ -795,10 +800,12 @@ class V8_EXPORT_PRIVATE Parser : public NON_EXPORTED_BASE(ParserBase<Parser>) {
   V8_INLINE static std::nullptr_t NullIdentifier() { return nullptr; }
   V8_INLINE static std::nullptr_t NullExpression() { return nullptr; }
   V8_INLINE static std::nullptr_t NullLiteralProperty() { return nullptr; }
-  V8_INLINE static ZoneList<Expression*>* NullExpressionList() {
+  V8_INLINE static ZonePtrList<Expression>* NullExpressionList() {
+    return nullptr;
+  }
+  V8_INLINE static ZonePtrList<Statement>* NullStatementList() {
     return nullptr;
   }
-  V8_INLINE static ZoneList<Statement*>* NullStatementList() { return nullptr; }
   V8_INLINE static std::nullptr_t NullStatement() { return nullptr; }
 
   template <typename T>
@@ -856,23 +863,23 @@ class V8_EXPORT_PRIVATE Parser : public NON_EXPORTED_BASE(ParserBase<Parser>) {
     return factory()->NewStringLiteral(symbol, pos);
   }
 
-  V8_INLINE ZoneList<Expression*>* NewExpressionList(int size) const {
-    return new (zone()) ZoneList<Expression*>(size, zone());
+  V8_INLINE ZonePtrList<Expression>* NewExpressionList(int size) const {
+    return new (zone()) ZonePtrList<Expression>(size, zone());
   }
-  V8_INLINE ZoneList<ObjectLiteral::Property*>* NewObjectPropertyList(
+  V8_INLINE ZonePtrList<ObjectLiteral::Property>* NewObjectPropertyList(
       int size) const {
-    return new (zone()) ZoneList<ObjectLiteral::Property*>(size, zone());
+    return new (zone()) ZonePtrList<ObjectLiteral::Property>(size, zone());
   }
-  V8_INLINE ZoneList<ClassLiteral::Property*>* NewClassPropertyList(
+  V8_INLINE ZonePtrList<ClassLiteral::Property>* NewClassPropertyList(
       int size) const {
-    return new (zone()) ZoneList<ClassLiteral::Property*>(size, zone());
+    return new (zone()) ZonePtrList<ClassLiteral::Property>(size, zone());
   }
-  V8_INLINE ZoneList<Statement*>* NewStatementList(int size) const {
-    return new (zone()) ZoneList<Statement*>(size, zone());
+  V8_INLINE ZonePtrList<Statement>* NewStatementList(int size) const {
+    return new (zone()) ZonePtrList<Statement>(size, zone());
   }
 
   V8_INLINE Expression* NewV8Intrinsic(const AstRawString* name,
-                                       ZoneList<Expression*>* args, int pos,
+                                       ZonePtrList<Expression>* args, int pos,
                                        bool* ok);
 
   V8_INLINE Statement* NewThrowStatement(Expression* exception, int pos) {
@@ -881,7 +888,7 @@ class V8_EXPORT_PRIVATE Parser : public NON_EXPORTED_BASE(ParserBase<Parser>) {
   }
 
   V8_INLINE void AddParameterInitializationBlock(
-      const ParserFormalParameters& parameters, ZoneList<Statement*>* body,
+      const ParserFormalParameters& parameters, ZonePtrList<Statement>* body,
       bool is_async, bool* ok) {
     if (parameters.is_simple) return;
     auto* init_block = BuildParameterInitializationBlock(parameters, ok);
@@ -923,8 +930,9 @@ class V8_EXPORT_PRIVATE Parser : public NON_EXPORTED_BASE(ParserBase<Parser>) {
       // BuildParamerterInitializationBlock.
       scope->DeclareParameter(
           is_simple ? parameter->name : ast_value_factory()->empty_string(),
-          is_simple ? VAR : TEMPORARY, is_optional, parameter->is_rest,
-          has_duplicate, ast_value_factory(), parameter->position);
+          is_simple ? VariableMode::kVar : VariableMode::kTemporary,
+          is_optional, parameter->is_rest, has_duplicate, ast_value_factory(),
+          parameter->position);
     }
   }
 
@@ -934,7 +942,7 @@ class V8_EXPORT_PRIVATE Parser : public NON_EXPORTED_BASE(ParserBase<Parser>) {
                                             Scanner::Location* duplicate_loc,
                                             bool* ok);
 
-  Expression* ExpressionListToExpression(ZoneList<Expression*>* args);
+  Expression* ExpressionListToExpression(ZonePtrList<Expression>* args);
 
   void SetFunctionNameFromPropertyName(LiteralProperty* property,
                                        const AstRawString* name,
diff --git a/deps/v8/src/parsing/parsing.cc b/deps/v8/src/parsing/parsing.cc
index dc66876e7d20bb..378023cbebf313 100644
--- a/deps/v8/src/parsing/parsing.cc
+++ b/deps/v8/src/parsing/parsing.cc
@@ -24,10 +24,10 @@ bool ParseProgram(ParseInfo* info, Isolate* isolate) {
   VMState<PARSER> state(isolate);
 
   // Create a character stream for the parser.
-  Handle<String> source(String::cast(info->script()->source()));
-  source = String::Flatten(source);
+  Handle<String> source(String::cast(info->script()->source()), isolate);
   isolate->counters()->total_parse_size()->Increment(source->length());
-  std::unique_ptr<Utf16CharacterStream> stream(ScannerStream::For(source));
+  std::unique_ptr<Utf16CharacterStream> stream(
+      ScannerStream::For(isolate, source));
   info->set_character_stream(std::move(stream));
 
   Parser parser(info);
@@ -59,11 +59,11 @@ bool ParseFunction(ParseInfo* info, Handle<SharedFunctionInfo> shared_info,
   DCHECK_NULL(info->literal());
 
   // Create a character stream for the parser.
-  Handle<String> source(String::cast(info->script()->source()));
-  source = String::Flatten(source);
+  Handle<String> source(String::cast(info->script()->source()), isolate);
   isolate->counters()->total_parse_size()->Increment(source->length());
-  std::unique_ptr<Utf16CharacterStream> stream(ScannerStream::For(
-      source, shared_info->StartPosition(), shared_info->EndPosition()));
+  std::unique_ptr<Utf16CharacterStream> stream(
+      ScannerStream::For(isolate, source, shared_info->StartPosition(),
+                         shared_info->EndPosition()));
   info->set_character_stream(std::move(stream));
 
   VMState<PARSER> state(isolate);
diff --git a/deps/v8/src/parsing/pattern-rewriter.cc b/deps/v8/src/parsing/pattern-rewriter.cc
index b0dfe0a66f9075..b981b6d12e91e2 100644
--- a/deps/v8/src/parsing/pattern-rewriter.cc
+++ b/deps/v8/src/parsing/pattern-rewriter.cc
@@ -29,7 +29,7 @@ class PatternRewriter final : public AstVisitor<PatternRewriter> {
       Parser* parser, Block* block,
       const DeclarationDescriptor* declaration_descriptor,
       const Parser::DeclarationParsingResult::Declaration* declaration,
-      ZoneList<const AstRawString*>* names, bool* ok);
+      ZonePtrList<const AstRawString>* names, bool* ok);
 
   static void RewriteDestructuringAssignment(Parser* parser,
                                              RewritableExpression* to_rewrite,
@@ -108,7 +108,7 @@ class PatternRewriter final : public AstVisitor<PatternRewriter> {
   int value_beg_position_;
   Block* block_;
   const DeclarationDescriptor* descriptor_;
-  ZoneList<const AstRawString*>* names_;
+  ZonePtrList<const AstRawString>* names_;
   Expression* current_value_;
   int recursion_level_;
   bool* ok_;
@@ -119,7 +119,7 @@ class PatternRewriter final : public AstVisitor<PatternRewriter> {
 void Parser::DeclareAndInitializeVariables(
     Block* block, const DeclarationDescriptor* declaration_descriptor,
     const DeclarationParsingResult::Declaration* declaration,
-    ZoneList<const AstRawString*>* names, bool* ok) {
+    ZonePtrList<const AstRawString>* names, bool* ok) {
   PatternRewriter::DeclareAndInitializeVariables(
       this, block, declaration_descriptor, declaration, names, ok);
 }
@@ -140,7 +140,7 @@ void PatternRewriter::DeclareAndInitializeVariables(
     Parser* parser, Block* block,
     const DeclarationDescriptor* declaration_descriptor,
     const Parser::DeclarationParsingResult::Declaration* declaration,
-    ZoneList<const AstRawString*>* names, bool* ok) {
+    ZonePtrList<const AstRawString>* names, bool* ok) {
   DCHECK(block->ignore_completion_value());
 
   PatternRewriter rewriter(declaration_descriptor->scope, parser, BINDING);
@@ -195,7 +195,8 @@ void PatternRewriter::VisitVariableProxy(VariableProxy* pattern) {
   VariableProxy* proxy =
       factory()->NewVariableProxy(name, NORMAL_VARIABLE, pattern->position());
   Declaration* declaration;
-  if (descriptor_->mode == VAR && !descriptor_->scope->is_declaration_scope()) {
+  if (descriptor_->mode == VariableMode::kVar &&
+      !descriptor_->scope->is_declaration_scope()) {
     DCHECK(descriptor_->scope->is_block_scope() ||
            descriptor_->scope->is_with_scope());
     declaration = factory()->NewNestedVariableDeclaration(
@@ -261,7 +262,7 @@ void PatternRewriter::VisitVariableProxy(VariableProxy* pattern) {
   // For 'let' and 'const' declared variables the initialization always
   // assigns to the declared variable.
   // But for var declarations we need to do a new lookup.
-  if (descriptor_->mode == VAR) {
+  if (descriptor_->mode == VariableMode::kVar) {
     proxy = var_init_scope->NewUnresolved(factory(), name);
   } else {
     DCHECK_NOT_NULL(proxy);
@@ -367,14 +368,14 @@ void PatternRewriter::VisitObjectLiteral(ObjectLiteral* pattern,
                                          Variable** temp_var) {
   auto temp = *temp_var = CreateTempVar(current_value_);
 
-  ZoneList<Expression*>* rest_runtime_callargs = nullptr;
+  ZonePtrList<Expression>* rest_runtime_callargs = nullptr;
   if (pattern->has_rest_property()) {
     // non_rest_properties_count = pattern->properties()->length - 1;
     // args_length = 1 + non_rest_properties_count because we need to
     // pass temp as well to the runtime function.
     int args_length = pattern->properties()->length();
     rest_runtime_callargs =
-        new (zone()) ZoneList<Expression*>(args_length, zone());
+        new (zone()) ZonePtrList<Expression>(args_length, zone());
     rest_runtime_callargs->Add(factory()->NewVariableProxy(temp), zone());
   }
 
@@ -409,7 +410,7 @@ void PatternRewriter::VisitObjectLiteral(ObjectLiteral* pattern,
 
         if (property->is_computed_name()) {
           DCHECK(!key->IsPropertyName() || !key->IsNumberLiteral());
-          auto args = new (zone()) ZoneList<Expression*>(1, zone());
+          auto args = new (zone()) ZonePtrList<Expression>(1, zone());
           args->Add(key, zone());
           auto to_name_key = CreateTempVar(factory()->NewCallRuntime(
               Runtime::kToName, args, kNoSourcePosition));
@@ -592,7 +593,7 @@ void PatternRewriter::VisitArrayLiteral(ArrayLiteral* node,
     // let array = [];
     Variable* array;
     {
-      auto empty_exprs = new (zone()) ZoneList<Expression*>(0, zone());
+      auto empty_exprs = new (zone()) ZonePtrList<Expression>(0, zone());
       array = CreateTempVar(
           factory()->NewArrayLiteral(empty_exprs, kNoSourcePosition));
     }
diff --git a/deps/v8/src/parsing/preparsed-scope-data.cc b/deps/v8/src/parsing/preparsed-scope-data.cc
index 70880f55c48224..3b5105b4a82fa9 100644
--- a/deps/v8/src/parsing/preparsed-scope-data.cc
+++ b/deps/v8/src/parsing/preparsed-scope-data.cc
@@ -481,12 +481,15 @@ uint8_t ConsumedPreParsedScopeData::ByteData::ReadQuarter() {
 }
 
 ConsumedPreParsedScopeData::ConsumedPreParsedScopeData()
-    : scope_data_(new ByteData()), child_index_(0) {}
+    : isolate_(nullptr), scope_data_(new ByteData()), child_index_(0) {}
 
 ConsumedPreParsedScopeData::~ConsumedPreParsedScopeData() {}
 
-void ConsumedPreParsedScopeData::SetData(Handle<PreParsedScopeData> data) {
+void ConsumedPreParsedScopeData::SetData(Isolate* isolate,
+                                         Handle<PreParsedScopeData> data) {
+  DCHECK_NOT_NULL(isolate);
   DCHECK(data->IsPreParsedScopeData());
+  isolate_ = isolate;
   data_ = data;
 #ifdef DEBUG
   ByteData::ReadingScope reading_scope(this);
@@ -529,7 +532,7 @@ ConsumedPreParsedScopeData::GetDataForSkippableFunction(
     return nullptr;
   }
   Handle<PreParsedScopeData> child_data_handle(
-      PreParsedScopeData::cast(child_data));
+      PreParsedScopeData::cast(child_data), isolate_);
   return new (zone) ProducedPreParsedScopeData(child_data_handle, zone);
 }
 
@@ -613,8 +616,13 @@ void ConsumedPreParsedScopeData::RestoreDataForVariable(Variable* var) {
     // It's possible that "name" is a two-byte representation of the string
     // stored in the data.
     for (int i = 0; i < 2 * name->length(); i += 2) {
+#if defined(V8_TARGET_LITTLE_ENDIAN)
       DCHECK_EQ(scope_data_->ReadUint8(), name->raw_data()[i]);
       DCHECK_EQ(0, name->raw_data()[i + 1]);
+#else
+      DCHECK_EQ(scope_data_->ReadUint8(), name->raw_data()[i + 1]);
+      DCHECK_EQ(0, name->raw_data()[i]);
+#endif  // V8_TARGET_LITTLE_ENDIAN
     }
   } else {
     for (int i = 0; i < name->length(); ++i) {
diff --git a/deps/v8/src/parsing/preparsed-scope-data.h b/deps/v8/src/parsing/preparsed-scope-data.h
index b621f069d214b2..2b66c0150d74df 100644
--- a/deps/v8/src/parsing/preparsed-scope-data.h
+++ b/deps/v8/src/parsing/preparsed-scope-data.h
@@ -225,7 +225,7 @@ class ConsumedPreParsedScopeData {
   ConsumedPreParsedScopeData();
   ~ConsumedPreParsedScopeData();
 
-  void SetData(Handle<PreParsedScopeData> data);
+  void SetData(Isolate* isolate, Handle<PreParsedScopeData> data);
 
   bool HasData() const { return !data_.is_null(); }
 
@@ -243,6 +243,7 @@ class ConsumedPreParsedScopeData {
   void RestoreDataForVariable(Variable* var);
   void RestoreDataForInnerScopes(Scope* scope);
 
+  Isolate* isolate_;
   Handle<PreParsedScopeData> data_;
   std::unique_ptr<ByteData> scope_data_;
   // When consuming the data, these indexes point to the data we're going to
diff --git a/deps/v8/src/parsing/preparser.cc b/deps/v8/src/parsing/preparser.cc
index 5bb58a03aa9232..832d2033f20eae 100644
--- a/deps/v8/src/parsing/preparser.cc
+++ b/deps/v8/src/parsing/preparser.cc
@@ -268,7 +268,7 @@ PreParser::Expression PreParser::ParseFunctionLiteral(
     FunctionNameValidity function_name_validity, FunctionKind kind,
     int function_token_pos, FunctionLiteral::FunctionType function_type,
     LanguageMode language_mode,
-    ZoneList<const AstRawString*>* arguments_for_wrapped_function, bool* ok) {
+    ZonePtrList<const AstRawString>* arguments_for_wrapped_function, bool* ok) {
   // Wrapped functions are not parsed in the preparser.
   DCHECK_NULL(arguments_for_wrapped_function);
   DCHECK_NE(FunctionLiteral::kWrapped, function_type);
@@ -366,7 +366,7 @@ PreParser::Expression PreParser::ParseFunctionLiteral(
       name_byte_length = string->byte_length();
     }
     logger_->FunctionEvent(
-        event_name, nullptr, script_id(), ms, function_scope->start_position(),
+        event_name, script_id(), ms, function_scope->start_position(),
         function_scope->end_position(), name, name_byte_length);
   }
 
@@ -429,7 +429,7 @@ void PreParser::DeclareAndInitializeVariables(
     PreParserStatement block,
     const DeclarationDescriptor* declaration_descriptor,
     const DeclarationParsingResult::Declaration* declaration,
-    ZoneList<const AstRawString*>* names, bool* ok) {
+    ZonePtrList<const AstRawString>* names, bool* ok) {
   if (declaration->pattern.variables_ != nullptr) {
     DCHECK(FLAG_lazy_inner_functions);
     DCHECK(track_unresolved_variables_);
diff --git a/deps/v8/src/parsing/preparser.h b/deps/v8/src/parsing/preparser.h
index 86fa7d1150194c..aa4f06d354e85b 100644
--- a/deps/v8/src/parsing/preparser.h
+++ b/deps/v8/src/parsing/preparser.h
@@ -94,7 +94,7 @@ class PreParserExpression {
   static PreParserExpression Null() { return PreParserExpression(); }
 
   static PreParserExpression Default(
-      ZoneList<VariableProxy*>* variables = nullptr) {
+      ZonePtrList<VariableProxy>* variables = nullptr) {
     return PreParserExpression(TypeField::encode(kExpression), variables);
   }
 
@@ -133,7 +133,7 @@ class PreParserExpression {
     return PreParserExpression(TypeField::encode(kExpression));
   }
 
-  static PreParserExpression Assignment(ZoneList<VariableProxy*>* variables) {
+  static PreParserExpression Assignment(ZonePtrList<VariableProxy>* variables) {
     return PreParserExpression(TypeField::encode(kExpression) |
                                    ExpressionTypeField::encode(kAssignment),
                                variables);
@@ -144,12 +144,13 @@ class PreParserExpression {
   }
 
   static PreParserExpression ObjectLiteral(
-      ZoneList<VariableProxy*>* variables) {
+      ZonePtrList<VariableProxy>* variables) {
     return PreParserExpression(TypeField::encode(kObjectLiteralExpression),
                                variables);
   }
 
-  static PreParserExpression ArrayLiteral(ZoneList<VariableProxy*>* variables) {
+  static PreParserExpression ArrayLiteral(
+      ZonePtrList<VariableProxy>* variables) {
     return PreParserExpression(TypeField::encode(kArrayLiteralExpression),
                                variables);
   }
@@ -168,7 +169,7 @@ class PreParserExpression {
                                IsUseAsmField::encode(true));
   }
 
-  static PreParserExpression This(ZoneList<VariableProxy*>* variables) {
+  static PreParserExpression This(ZonePtrList<VariableProxy>* variables) {
     return PreParserExpression(TypeField::encode(kExpression) |
                                    ExpressionTypeField::encode(kThisExpression),
                                variables);
@@ -371,7 +372,7 @@ class PreParserExpression {
   };
 
   explicit PreParserExpression(uint32_t expression_code,
-                               ZoneList<VariableProxy*>* variables = nullptr)
+                               ZonePtrList<VariableProxy>* variables = nullptr)
       : code_(expression_code), variables_(variables) {}
 
   void AddVariable(VariableProxy* variable, Zone* zone) {
@@ -379,7 +380,7 @@ class PreParserExpression {
       return;
     }
     if (variables_ == nullptr) {
-      variables_ = new (zone) ZoneList<VariableProxy*>(1, zone);
+      variables_ = new (zone) ZonePtrList<VariableProxy>(1, zone);
     }
     variables_->Add(variable, zone);
   }
@@ -406,7 +407,7 @@ class PreParserExpression {
   uint32_t code_;
   // If the PreParser is used in the variable tracking mode, PreParserExpression
   // accumulates variables in that expression.
-  ZoneList<VariableProxy*>* variables_;
+  ZonePtrList<VariableProxy>* variables_;
 
   friend class PreParser;
   friend class PreParserFactory;
@@ -433,7 +434,7 @@ class PreParserList {
  private:
   explicit PreParserList(int n) : length_(n), variables_(nullptr) {}
   int length_;
-  ZoneList<VariableProxy*>* variables_;
+  ZonePtrList<VariableProxy>* variables_;
 
   friend class PreParser;
   friend class PreParserFactory;
@@ -446,7 +447,7 @@ inline void PreParserList<PreParserExpression>::Add(
     DCHECK(FLAG_lazy_inner_functions);
     DCHECK_NOT_NULL(zone);
     if (variables_ == nullptr) {
-      variables_ = new (zone) ZoneList<VariableProxy*>(1, zone);
+      variables_ = new (zone) ZonePtrList<VariableProxy>(1, zone);
     }
     for (auto identifier : (*expression.variables_)) {
       variables_->Add(identifier, zone);
@@ -743,8 +744,9 @@ class PreParserFactory {
     return PreParserStatement::Default();
   }
 
-  PreParserStatement NewBlock(int capacity, bool ignore_completion_value,
-                              ZoneList<const AstRawString*>* labels = nullptr) {
+  PreParserStatement NewBlock(
+      int capacity, bool ignore_completion_value,
+      ZonePtrList<const AstRawString>* labels = nullptr) {
     return PreParserStatement::Default();
   }
 
@@ -784,17 +786,17 @@ class PreParserFactory {
     return PreParserStatement::Default();
   }
 
-  PreParserStatement NewDoWhileStatement(ZoneList<const AstRawString*>* labels,
-                                         int pos) {
+  PreParserStatement NewDoWhileStatement(
+      ZonePtrList<const AstRawString>* labels, int pos) {
     return PreParserStatement::Default();
   }
 
-  PreParserStatement NewWhileStatement(ZoneList<const AstRawString*>* labels,
+  PreParserStatement NewWhileStatement(ZonePtrList<const AstRawString>* labels,
                                        int pos) {
     return PreParserStatement::Default();
   }
 
-  PreParserStatement NewSwitchStatement(ZoneList<const AstRawString*>* labels,
+  PreParserStatement NewSwitchStatement(ZonePtrList<const AstRawString>* labels,
                                         const PreParserExpression& tag,
                                         int pos) {
     return PreParserStatement::Default();
@@ -805,18 +807,18 @@ class PreParserFactory {
     return PreParserStatement::Default();
   }
 
-  PreParserStatement NewForStatement(ZoneList<const AstRawString*>* labels,
+  PreParserStatement NewForStatement(ZonePtrList<const AstRawString>* labels,
                                      int pos) {
     return PreParserStatement::Default();
   }
 
-  PreParserStatement NewForEachStatement(ForEachStatement::VisitMode visit_mode,
-                                         ZoneList<const AstRawString*>* labels,
-                                         int pos) {
+  PreParserStatement NewForEachStatement(
+      ForEachStatement::VisitMode visit_mode,
+      ZonePtrList<const AstRawString>* labels, int pos) {
     return PreParserStatement::Default();
   }
 
-  PreParserStatement NewForOfStatement(ZoneList<const AstRawString*>* labels,
+  PreParserStatement NewForOfStatement(ZonePtrList<const AstRawString>* labels,
                                        int pos) {
     return PreParserStatement::Default();
   }
@@ -842,12 +844,12 @@ class PreParserFactory {
 
 struct PreParserFormalParameters : FormalParametersBase {
   struct Parameter : public ZoneObject {
-    Parameter(ZoneList<VariableProxy*>* variables, bool is_rest)
+    Parameter(ZonePtrList<VariableProxy>* variables, bool is_rest)
         : variables_(variables), is_rest(is_rest) {}
     Parameter** next() { return &next_parameter; }
     Parameter* const* next() const { return &next_parameter; }
 
-    ZoneList<VariableProxy*>* variables_;
+    ZonePtrList<VariableProxy>* variables_;
     Parameter* next_parameter = nullptr;
     bool is_rest : 1;
   };
@@ -1013,7 +1015,8 @@ class PreParser : public ParserBase<PreParser> {
       FunctionNameValidity function_name_validity, FunctionKind kind,
       int function_token_pos, FunctionLiteral::FunctionType function_type,
       LanguageMode language_mode,
-      ZoneList<const AstRawString*>* arguments_for_wrapped_function, bool* ok);
+      ZonePtrList<const AstRawString>* arguments_for_wrapped_function,
+      bool* ok);
 
   PreParserExpression InitializeObjectLiteral(PreParserExpression literal) {
     return literal;
@@ -1065,10 +1068,10 @@ class PreParser : public ParserBase<PreParser> {
       PreParserStatement block,
       const DeclarationDescriptor* declaration_descriptor,
       const DeclarationParsingResult::Declaration* declaration,
-      ZoneList<const AstRawString*>* names, bool* ok);
+      ZonePtrList<const AstRawString>* names, bool* ok);
 
-  V8_INLINE ZoneList<const AstRawString*>* DeclareLabel(
-      ZoneList<const AstRawString*>* labels, const PreParserExpression& expr,
+  V8_INLINE ZonePtrList<const AstRawString>* DeclareLabel(
+      ZonePtrList<const AstRawString>* labels, const PreParserExpression& expr,
       bool* ok) {
     DCHECK(!parsing_module_ || !expr.AsIdentifier().IsAwait());
     DCHECK(IsIdentifier(expr));
@@ -1076,7 +1079,7 @@ class PreParser : public ParserBase<PreParser> {
   }
 
   // TODO(nikolaos): The preparser currently does not keep track of labels.
-  V8_INLINE bool ContainsLabel(ZoneList<const AstRawString*>* labels,
+  V8_INLINE bool ContainsLabel(ZonePtrList<const AstRawString>* labels,
                                const PreParserIdentifier& label) {
     return false;
   }
@@ -1100,7 +1103,8 @@ class PreParser : public ParserBase<PreParser> {
 
       if (catch_info->pattern.variables_ != nullptr) {
         for (auto variable : *catch_info->pattern.variables_) {
-          scope()->DeclareVariableName(variable->raw_name(), LET);
+          scope()->DeclareVariableName(variable->raw_name(),
+                                       VariableMode::kLet);
         }
       }
     }
@@ -1162,7 +1166,7 @@ class PreParser : public ParserBase<PreParser> {
   DeclareFunction(const PreParserIdentifier& variable_name,
                   const PreParserExpression& function, VariableMode mode,
                   int pos, bool is_sloppy_block_function,
-                  ZoneList<const AstRawString*>* names, bool* ok) {
+                  ZonePtrList<const AstRawString>* names, bool* ok) {
     DCHECK_NULL(names);
     if (variable_name.string_ != nullptr) {
       DCHECK(track_unresolved_variables_);
@@ -1177,13 +1181,13 @@ class PreParser : public ParserBase<PreParser> {
 
   V8_INLINE PreParserStatement DeclareClass(
       const PreParserIdentifier& variable_name,
-      const PreParserExpression& value, ZoneList<const AstRawString*>* names,
+      const PreParserExpression& value, ZonePtrList<const AstRawString>* names,
       int class_token_pos, int end_pos, bool* ok) {
     // Preparser shouldn't be used in contexts where we need to track the names.
     DCHECK_NULL(names);
     if (variable_name.string_ != nullptr) {
       DCHECK(track_unresolved_variables_);
-      scope()->DeclareVariableName(variable_name.string_, LET);
+      scope()->DeclareVariableName(variable_name.string_, VariableMode::kLet);
     }
     return PreParserStatement::Default();
   }
@@ -1192,7 +1196,7 @@ class PreParser : public ParserBase<PreParser> {
                                       int class_token_pos, bool* ok) {
     if (name.string_ != nullptr) {
       DCHECK(track_unresolved_variables_);
-      scope()->DeclareVariableName(name.string_, CONST);
+      scope()->DeclareVariableName(name.string_, VariableMode::kConst);
     }
   }
   V8_INLINE void DeclareClassProperty(const PreParserIdentifier& class_name,
@@ -1206,13 +1210,13 @@ class PreParser : public ParserBase<PreParser> {
       scope()->DeclareVariableName(
           ClassFieldVariableName(ast_value_factory(),
                                  class_info->computed_field_count),
-          CONST);
+          VariableMode::kConst);
     }
 
     if (kind == ClassLiteralProperty::PRIVATE_FIELD &&
         property_name.string_ != nullptr) {
       DCHECK(track_unresolved_variables_);
-      scope()->DeclareVariableName(property_name.string_, CONST);
+      scope()->DeclareVariableName(property_name.string_, VariableMode::kConst);
     }
   }
 
@@ -1380,7 +1384,7 @@ class PreParser : public ParserBase<PreParser> {
 
   V8_INLINE PreParserStatement
   BuildInitializationBlock(DeclarationParsingResult* parsing_result,
-                           ZoneList<const AstRawString*>* names, bool* ok) {
+                           ZonePtrList<const AstRawString>* names, bool* ok) {
     for (auto declaration : parsing_result->declarations) {
       DeclareAndInitializeVariables(PreParserStatement::Default(),
                                     &(parsing_result->descriptor), &declaration,
@@ -1416,7 +1420,7 @@ class PreParser : public ParserBase<PreParser> {
       DCHECK_EQ(1, for_info->parsing_result.declarations.size());
       bool is_for_var_of =
           for_info->mode == ForEachStatement::ITERATE &&
-          for_info->parsing_result.descriptor.mode == VariableMode::VAR;
+          for_info->parsing_result.descriptor.mode == VariableMode::kVar;
       bool collect_names =
           IsLexicalVariableMode(for_info->parsing_result.descriptor.mode) ||
           is_for_var_of;
@@ -1433,7 +1437,7 @@ class PreParser : public ParserBase<PreParser> {
     if (track_unresolved_variables_) {
       if (IsLexicalVariableMode(for_info.parsing_result.descriptor.mode)) {
         for (auto name : for_info.bound_names) {
-          scope()->DeclareVariableName(name, LET);
+          scope()->DeclareVariableName(name, VariableMode::kLet);
         }
         return PreParserStatement::Default();
       }
@@ -1547,13 +1551,13 @@ class PreParser : public ParserBase<PreParser> {
   }
 
   V8_INLINE PreParserExpression ThisExpression(int pos = kNoSourcePosition) {
-    ZoneList<VariableProxy*>* variables = nullptr;
+    ZonePtrList<VariableProxy>* variables = nullptr;
     if (track_unresolved_variables_) {
       VariableProxy* proxy = scope()->NewUnresolved(
           factory()->ast_node_factory(), ast_value_factory()->this_string(),
           pos, THIS_VARIABLE);
 
-      variables = new (zone()) ZoneList<VariableProxy*>(1, zone());
+      variables = new (zone()) ZonePtrList<VariableProxy>(1, zone());
       variables->Add(proxy, zone());
     }
     return PreParserExpression::This(variables);
@@ -1703,7 +1707,8 @@ class PreParser : public ParserBase<PreParser> {
       DCHECK(FLAG_lazy_inner_functions);
       if (params.variables_ != nullptr) {
         for (auto variable : *params.variables_) {
-          parameters->scope->DeclareVariableName(variable->raw_name(), VAR);
+          parameters->scope->DeclareVariableName(variable->raw_name(),
+                                                 VariableMode::kVar);
         }
       }
     }
diff --git a/deps/v8/src/parsing/rewriter.cc b/deps/v8/src/parsing/rewriter.cc
index 102efad2927796..151244f692d47d 100644
--- a/deps/v8/src/parsing/rewriter.cc
+++ b/deps/v8/src/parsing/rewriter.cc
@@ -43,7 +43,7 @@ class Processor final : public AstVisitor<Processor> {
     InitializeAstVisitor(parser->stack_limit());
   }
 
-  void Process(ZoneList<Statement*>* statements);
+  void Process(ZonePtrList<Statement>* statements);
   bool result_assigned() const { return result_assigned_; }
 
   Zone* zone() { return zone_; }
@@ -121,8 +121,7 @@ Statement* Processor::AssignUndefinedBefore(Statement* s) {
   return b;
 }
 
-
-void Processor::Process(ZoneList<Statement*>* statements) {
+void Processor::Process(ZonePtrList<Statement>* statements) {
   // If we're in a breakable scope (named block, iteration, or switch), we walk
   // all statements. The last value producing statement before the break needs
   // to assign to .result. If we're not in a breakable scope, only the last
@@ -283,7 +282,7 @@ void Processor::VisitSwitchStatement(SwitchStatement* node) {
   DCHECK(breakable_ || !is_set_);
   BreakableScope scope(this);
   // Rewrite statements in all case clauses.
-  ZoneList<CaseClause*>* clauses = node->cases();
+  ZonePtrList<CaseClause>* clauses = node->cases();
   for (int i = clauses->length() - 1; i >= 0; --i) {
     CaseClause* clause = clauses->at(i);
     Process(clause->statements());
@@ -381,7 +380,7 @@ bool Rewriter::Rewrite(ParseInfo* info) {
     return true;
   }
 
-  ZoneList<Statement*>* body = function->body();
+  ZonePtrList<Statement>* body = function->body();
   DCHECK_IMPLIES(scope->is_module_scope(), !body->is_empty());
   if (!body->is_empty()) {
     Variable* result = scope->AsDeclarationScope()->NewTemporary(
@@ -416,7 +415,7 @@ bool Rewriter::Rewrite(Parser* parser, DeclarationScope* closure_scope,
   DCHECK_EQ(closure_scope, closure_scope->GetClosureScope());
   DCHECK(block->scope() == nullptr ||
          block->scope()->GetClosureScope() == closure_scope);
-  ZoneList<Statement*>* body = block->statements();
+  ZonePtrList<Statement>* body = block->statements();
   VariableProxy* result = expr->result();
   Variable* result_var = result->var();
 
diff --git a/deps/v8/src/parsing/scanner-character-streams.cc b/deps/v8/src/parsing/scanner-character-streams.cc
index 20aa5c9f8eb05b..7ac7af74ab451c 100644
--- a/deps/v8/src/parsing/scanner-character-streams.cc
+++ b/deps/v8/src/parsing/scanner-character-streams.cc
@@ -19,175 +19,251 @@ namespace {
 const unibrow::uchar kUtf8Bom = 0xFEFF;
 }  // namespace
 
-// ----------------------------------------------------------------------------
-// BufferedUtf16CharacterStreams
-//
-// A buffered character stream based on a random access character
-// source (ReadBlock can be called with pos() pointing to any position,
-// even positions before the current).
-class BufferedUtf16CharacterStream : public Utf16CharacterStream {
- public:
-  BufferedUtf16CharacterStream();
+template <typename Char>
+struct HeapStringType;
 
- protected:
-  static const size_t kBufferSize = 512;
+template <>
+struct HeapStringType<uint8_t> {
+  typedef SeqOneByteString String;
+};
 
-  bool ReadBlock() override;
+template <>
+struct HeapStringType<uint16_t> {
+  typedef SeqTwoByteString String;
+};
 
-  // FillBuffer should read up to kBufferSize characters at position and store
-  // them into buffer_[0..]. It returns the number of characters stored.
-  virtual size_t FillBuffer(size_t position) = 0;
+template <typename Char>
+struct Range {
+  const Char* start;
+  const Char* end;
 
-  // Fixed sized buffer that this class reads from.
-  // The base class' buffer_start_ should always point to buffer_.
-  uc16 buffer_[kBufferSize];
+  size_t length() { return static_cast<size_t>(end - start); }
+  bool unaligned_start() const {
+    return reinterpret_cast<intptr_t>(start) % sizeof(Char) == 1;
+  }
 };
 
-BufferedUtf16CharacterStream::BufferedUtf16CharacterStream()
-    : Utf16CharacterStream(buffer_, buffer_, buffer_, 0) {}
+// A Char stream backed by an on-heap SeqOneByteString or SeqTwoByteString.
+template <typename Char>
+class OnHeapStream {
+ public:
+  typedef typename HeapStringType<Char>::String String;
 
-bool BufferedUtf16CharacterStream::ReadBlock() {
-  DCHECK_EQ(buffer_start_, buffer_);
+  OnHeapStream(Handle<String> string, size_t start_offset, size_t end)
+      : string_(string), start_offset_(start_offset), length_(end) {}
 
-  size_t position = pos();
-  buffer_pos_ = position;
-  buffer_cursor_ = buffer_;
-  buffer_end_ = buffer_ + FillBuffer(position);
-  DCHECK_EQ(pos(), position);
-  DCHECK_LE(buffer_end_, buffer_start_ + kBufferSize);
-  return buffer_cursor_ < buffer_end_;
-}
+  Range<Char> GetDataAt(size_t pos) {
+    return {&string_->GetChars()[start_offset_ + Min(length_, pos)],
+            &string_->GetChars()[start_offset_ + length_]};
+  }
 
-// ----------------------------------------------------------------------------
-// GenericStringUtf16CharacterStream.
-//
-// A stream w/ a data source being a (flattened) Handle<String>.
+  static const bool kCanAccessHeap = true;
+
+ private:
+  Handle<String> string_;
+  const size_t start_offset_;
+  const size_t length_;
+};
 
-class GenericStringUtf16CharacterStream : public BufferedUtf16CharacterStream {
+// A Char stream backed by an off-heap ExternalOneByteString or
+// ExternalTwoByteString.
+template <typename Char>
+class ExternalStringStream {
  public:
-  GenericStringUtf16CharacterStream(Handle<String> data, size_t start_position,
-                                    size_t end_position);
+  ExternalStringStream(const Char* data, size_t end)
+      : data_(data), length_(end) {}
 
-  bool can_access_heap() override { return true; }
+  Range<Char> GetDataAt(size_t pos) {
+    return {&data_[Min(length_, pos)], &data_[length_]};
+  }
 
- protected:
-  size_t FillBuffer(size_t position) override;
+  static const bool kCanAccessHeap = false;
 
-  Handle<String> string_;
-  size_t length_;
+ private:
+  const Char* const data_;
+  const size_t length_;
 };
 
-GenericStringUtf16CharacterStream::GenericStringUtf16CharacterStream(
-    Handle<String> data, size_t start_position, size_t end_position)
-    : string_(data), length_(end_position) {
-  DCHECK_GE(end_position, start_position);
-  DCHECK_GE(static_cast<size_t>(string_->length()),
-            end_position - start_position);
-  buffer_pos_ = start_position;
-}
+// A Char stream backed by multiple source-stream provided off-heap chunks.
+template <typename Char>
+class ChunkedStream {
+ public:
+  explicit ChunkedStream(ScriptCompiler::ExternalSourceStream* source,
+                         RuntimeCallStats* stats)
+      : source_(source), stats_(stats) {}
 
-size_t GenericStringUtf16CharacterStream::FillBuffer(size_t from_pos) {
-  if (from_pos >= length_) return 0;
+  Range<Char> GetDataAt(size_t pos) {
+    Chunk chunk = FindChunk(pos);
+    size_t buffer_end = chunk.length;
+    size_t buffer_pos = Min(buffer_end, pos - chunk.position);
+    return {&chunk.data[buffer_pos], &chunk.data[buffer_end]};
+  }
 
-  size_t length = i::Min(kBufferSize, length_ - from_pos);
-  String::WriteToFlat<uc16>(*string_, buffer_, static_cast<int>(from_pos),
-                            static_cast<int>(from_pos + length));
-  return length;
-}
+  ~ChunkedStream() {
+    for (size_t i = 0; i < chunks_.size(); i++) {
+      delete[] chunks_[i].data;
+    }
+  }
 
-// ----------------------------------------------------------------------------
-// ExternalTwoByteStringUtf16CharacterStream.
-//
-// A stream whose data source is a Handle<ExternalTwoByteString>. It avoids
-// all data copying.
+  static const bool kCanAccessHeap = false;
 
-class ExternalTwoByteStringUtf16CharacterStream : public Utf16CharacterStream {
- public:
-  ExternalTwoByteStringUtf16CharacterStream(Handle<ExternalTwoByteString> data,
-                                            size_t start_position,
-                                            size_t end_position);
+ private:
+  struct Chunk {
+    const Char* const data;
+    // The logical position of data.
+    const size_t position;
+    const size_t length;
+    size_t end_position() const { return position + length; }
+  };
 
-  bool can_access_heap() override { return false; }
+  Chunk FindChunk(size_t position) {
+    if (chunks_.empty()) FetchChunk(size_t{0});
 
- private:
-  bool ReadBlock() override;
+    // Walk forwards while the position is in front of the current chunk.
+    while (position >= chunks_.back().end_position() &&
+           chunks_.back().length > 0) {
+      FetchChunk(chunks_.back().end_position());
+    }
+
+    // Walk backwards.
+    for (auto reverse_it = chunks_.rbegin(); reverse_it != chunks_.rend();
+         ++reverse_it) {
+      if (reverse_it->position <= position) return *reverse_it;
+    }
+
+    UNREACHABLE();
+  }
+
+  void FetchChunk(size_t position) {
+    const uint8_t* data = nullptr;
+    size_t length;
+    {
+      RuntimeCallTimerScope scope(stats_,
+                                  RuntimeCallCounterId::kGetMoreDataCallback);
+      length = source_->GetMoreData(&data);
+    }
+    // Incoming data has to be aligned to Char size.
+    DCHECK_EQ(0, length % sizeof(Char));
+    chunks_.push_back(
+        {reinterpret_cast<const Char*>(data), position, length / sizeof(Char)});
+  }
 
-  const uc16* raw_data_;  // Pointer to the actual array of characters.
-  size_t start_pos_;
-  size_t end_pos_;
+  std::vector<struct Chunk> chunks_;
+  ScriptCompiler::ExternalSourceStream* source_;
+  RuntimeCallStats* stats_;
 };
 
-ExternalTwoByteStringUtf16CharacterStream::
-    ExternalTwoByteStringUtf16CharacterStream(
-        Handle<ExternalTwoByteString> data, size_t start_position,
-        size_t end_position)
-    : raw_data_(data->GetTwoByteData(static_cast<int>(start_position))),
-      start_pos_(start_position),
-      end_pos_(end_position) {
-  buffer_start_ = raw_data_;
-  buffer_cursor_ = raw_data_;
-  buffer_end_ = raw_data_ + (end_pos_ - start_pos_);
-  buffer_pos_ = start_pos_;
-}
+// Provides a buffered utf-16 view on the bytes from the underlying ByteStream.
+// Chars are buffered if either the underlying stream isn't utf-16 or the
+// underlying utf-16 stream might move (is on-heap).
+template <typename Char, template <typename T> class ByteStream>
+class BufferedCharacterStream : public Utf16CharacterStream {
+ public:
+  template <class... TArgs>
+  BufferedCharacterStream(size_t pos, TArgs... args) : byte_stream_(args...) {
+    buffer_pos_ = pos;
+  }
 
-bool ExternalTwoByteStringUtf16CharacterStream::ReadBlock() {
-  size_t position = pos();
-  bool have_data = start_pos_ <= position && position < end_pos_;
-  if (have_data) {
-    buffer_pos_ = start_pos_;
-    buffer_cursor_ = raw_data_ + (position - start_pos_),
-    buffer_end_ = raw_data_ + (end_pos_ - start_pos_);
-  } else {
+ protected:
+  bool ReadBlock() override {
+    size_t position = pos();
     buffer_pos_ = position;
-    buffer_cursor_ = raw_data_;
-    buffer_end_ = raw_data_;
+    buffer_start_ = &buffer_[0];
+    buffer_cursor_ = buffer_start_;
+
+    Range<Char> range = byte_stream_.GetDataAt(position);
+    if (range.length() == 0) {
+      buffer_end_ = buffer_start_;
+      return false;
+    }
+
+    size_t length = Min(kBufferSize, range.length());
+    i::CopyCharsUnsigned(buffer_, range.start, length);
+    buffer_end_ = &buffer_[length];
+    return true;
   }
-  return have_data;
-}
 
-// ----------------------------------------------------------------------------
-// ExternalOneByteStringUtf16CharacterStream
-//
-// A stream whose data source is a Handle<ExternalOneByteString>.
+  bool can_access_heap() override {
+    return ByteStream<uint16_t>::kCanAccessHeap;
+  }
 
-class ExternalOneByteStringUtf16CharacterStream
-    : public BufferedUtf16CharacterStream {
+ private:
+  static const size_t kBufferSize = 512;
+  uc16 buffer_[kBufferSize];
+  ByteStream<Char> byte_stream_;
+};
+
+// Provides a unbuffered utf-16 view on the bytes from the underlying
+// ByteStream.
+template <template <typename T> class ByteStream>
+class UnbufferedCharacterStream : public Utf16CharacterStream {
  public:
-  ExternalOneByteStringUtf16CharacterStream(Handle<ExternalOneByteString> data,
-                                            size_t start_position,
-                                            size_t end_position);
+  template <class... TArgs>
+  UnbufferedCharacterStream(size_t pos, TArgs... args) : byte_stream_(args...) {
+    DCHECK(!ByteStream<uint16_t>::kCanAccessHeap);
+    buffer_pos_ = pos;
+  }
+
+ protected:
+  bool ReadBlock() override {
+    size_t position = pos();
+    buffer_pos_ = position;
+    Range<uint16_t> range = byte_stream_.GetDataAt(position);
+    buffer_start_ = range.start;
+    buffer_end_ = range.end;
+    buffer_cursor_ = buffer_start_;
+    if (range.length() == 0) return false;
 
-  // For testing:
-  ExternalOneByteStringUtf16CharacterStream(const char* data, size_t length);
+    DCHECK(!range.unaligned_start());
+    DCHECK_LE(buffer_start_, buffer_end_);
+    return true;
+  }
 
   bool can_access_heap() override { return false; }
 
+ private:
+  ByteStream<uint16_t> byte_stream_;
+};
+
+// ----------------------------------------------------------------------------
+// BufferedUtf16CharacterStreams
+//
+// A buffered character stream based on a random access character
+// source (ReadBlock can be called with pos() pointing to any position,
+// even positions before the current).
+//
+// TODO(verwaest): Remove together with Utf8 external streaming streams.
+class BufferedUtf16CharacterStream : public Utf16CharacterStream {
+ public:
+  BufferedUtf16CharacterStream();
+
  protected:
-  size_t FillBuffer(size_t position) override;
+  static const size_t kBufferSize = 512;
 
-  const uint8_t* raw_data_;  // Pointer to the actual array of characters.
-  size_t length_;
-};
+  bool ReadBlock() override;
 
-ExternalOneByteStringUtf16CharacterStream::
-    ExternalOneByteStringUtf16CharacterStream(
-        Handle<ExternalOneByteString> data, size_t start_position,
-        size_t end_position)
-    : raw_data_(data->GetChars()), length_(end_position) {
-  DCHECK(end_position >= start_position);
-  buffer_pos_ = start_position;
-}
+  // FillBuffer should read up to kBufferSize characters at position and store
+  // them into buffer_[0..]. It returns the number of characters stored.
+  virtual size_t FillBuffer(size_t position) = 0;
+
+  // Fixed sized buffer that this class reads from.
+  // The base class' buffer_start_ should always point to buffer_.
+  uc16 buffer_[kBufferSize];
+};
 
-ExternalOneByteStringUtf16CharacterStream::
-    ExternalOneByteStringUtf16CharacterStream(const char* data, size_t length)
-    : raw_data_(reinterpret_cast<const uint8_t*>(data)), length_(length) {}
+BufferedUtf16CharacterStream::BufferedUtf16CharacterStream()
+    : Utf16CharacterStream(buffer_, buffer_, buffer_, 0) {}
 
-size_t ExternalOneByteStringUtf16CharacterStream::FillBuffer(size_t from_pos) {
-  if (from_pos >= length_) return 0;
+bool BufferedUtf16CharacterStream::ReadBlock() {
+  DCHECK_EQ(buffer_start_, buffer_);
 
-  size_t length = Min(kBufferSize, length_ - from_pos);
-  i::CopyCharsUnsigned(buffer_, raw_data_ + from_pos, length);
-  return length;
+  size_t position = pos();
+  buffer_pos_ = position;
+  buffer_cursor_ = buffer_;
+  buffer_end_ = buffer_ + FillBuffer(position);
+  DCHECK_EQ(pos(), position);
+  DCHECK_LE(buffer_end_, buffer_start_ + kBufferSize);
+  return buffer_cursor_ < buffer_end_;
 }
 
 // ----------------------------------------------------------------------------
@@ -197,6 +273,9 @@ size_t ExternalOneByteStringUtf16CharacterStream::FillBuffer(size_t from_pos) {
 // may 'cut' arbitrarily into utf-8 characters. Also, seeking to a given
 // character position is tricky because the byte position cannot be dericed
 // from the character position.
+//
+// TODO(verwaest): Decode utf8 chunks into utf16 chunks on the blink side
+// instead so we don't need to buffer.
 
 class Utf8ExternalStreamingStream : public BufferedUtf16CharacterStream {
  public:
@@ -468,393 +547,47 @@ size_t Utf8ExternalStreamingStream::FillBuffer(size_t position) {
   return buffer_end_ - buffer_cursor_;
 }
 
-// ----------------------------------------------------------------------------
-// Chunks - helper for One- + TwoByteExternalStreamingStream
-namespace {
-
-struct Chunk {
-  const uint8_t* data;
-  size_t byte_length;
-  size_t byte_pos;
-};
-
-typedef std::vector<struct Chunk> Chunks;
-
-void DeleteChunks(Chunks& chunks) {
-  for (size_t i = 0; i < chunks.size(); i++) delete[] chunks[i].data;
-}
-
-// Return the chunk index for the chunk containing position.
-// If position is behind the end of the stream, the index of the last,
-// zero-length chunk is returned.
-size_t FindChunk(Chunks& chunks, ScriptCompiler::ExternalSourceStream* source,
-                 size_t position, RuntimeCallStats* stats) {
-  size_t end_pos =
-      chunks.empty() ? 0 : (chunks.back().byte_pos + chunks.back().byte_length);
-
-  // Get more data if needed. We usually won't enter the loop body.
-  bool out_of_data = !chunks.empty() && chunks.back().byte_length == 0;
-  {
-    RuntimeCallTimerScope scope(stats,
-                                RuntimeCallCounterId::kGetMoreDataCallback);
-    while (!out_of_data && end_pos <= position + 1) {
-      const uint8_t* chunk = nullptr;
-      size_t len = source->GetMoreData(&chunk);
-
-      chunks.push_back({chunk, len, end_pos});
-      end_pos += len;
-      out_of_data = (len == 0);
-    }
-  }
-
-  // Here, we should always have at least one chunk, and we either have the
-  // chunk we were looking for, or we're out of data. Also, out_of_data and
-  // end_pos are current (and designate whether we have exhausted the stream,
-  // and the length of data received so far, respectively).
-  DCHECK(!chunks.empty());
-  DCHECK_EQ(end_pos, chunks.back().byte_pos + chunks.back().byte_length);
-  DCHECK_EQ(out_of_data, chunks.back().byte_length == 0);
-  DCHECK(position < end_pos || out_of_data);
-
-  // Edge case: position is behind the end of stream: Return the last (length 0)
-  // chunk to indicate the end of the stream.
-  if (position >= end_pos) {
-    DCHECK(out_of_data);
-    return chunks.size() - 1;
-  }
-
-  // We almost always 'stream', meaning we want data from the last chunk, so
-  // let's look at chunks back-to-front.
-  size_t chunk_no = chunks.size() - 1;
-  while (chunks[chunk_no].byte_pos > position) {
-    DCHECK_NE(chunk_no, 0u);
-    chunk_no--;
-  }
-  DCHECK_LE(chunks[chunk_no].byte_pos, position);
-  DCHECK_LT(position, chunks[chunk_no].byte_pos + chunks[chunk_no].byte_length);
-  return chunk_no;
-}
-
-}  // anonymous namespace
-
-// ----------------------------------------------------------------------------
-// OneByteExternalStreamingStream
-//
-// A stream of latin-1 encoded, chunked data.
-
-class OneByteExternalStreamingStream : public BufferedUtf16CharacterStream {
- public:
-  explicit OneByteExternalStreamingStream(
-      ScriptCompiler::ExternalSourceStream* source, RuntimeCallStats* stats)
-      : source_(source), stats_(stats) {}
-  ~OneByteExternalStreamingStream() override { DeleteChunks(chunks_); }
-
-  bool can_access_heap() override { return false; }
-
- protected:
-  size_t FillBuffer(size_t position) override;
-
- private:
-  Chunks chunks_;
-  ScriptCompiler::ExternalSourceStream* source_;
-  RuntimeCallStats* stats_;
-};
-
-size_t OneByteExternalStreamingStream::FillBuffer(size_t position) {
-  const Chunk& chunk = chunks_[FindChunk(chunks_, source_, position, stats_)];
-  if (chunk.byte_length == 0) return 0;
-
-  size_t start_pos = position - chunk.byte_pos;
-  size_t len = i::Min(kBufferSize, chunk.byte_length - start_pos);
-  i::CopyCharsUnsigned(buffer_, chunk.data + start_pos, len);
-  return len;
-}
-
-#if !(V8_TARGET_ARCH_MIPS || V8_TARGET_ARCH_MIPS64)
-// ----------------------------------------------------------------------------
-// TwoByteExternalStreamingStream
-//
-// A stream of ucs-2 data, delivered in chunks. Chunks may be 'cut' into the
-// middle of characters (or even contain only one byte), which adds a bit
-// of complexity. This stream avoid all data copying, except for characters
-// that cross chunk boundaries.
-
-class TwoByteExternalStreamingStream : public Utf16CharacterStream {
- public:
-  explicit TwoByteExternalStreamingStream(
-      ScriptCompiler::ExternalSourceStream* source, RuntimeCallStats* stats);
-  ~TwoByteExternalStreamingStream() override;
-
-  bool can_access_heap() override { return false; }
-
- protected:
-  bool ReadBlock() override;
-
-  Chunks chunks_;
-  ScriptCompiler::ExternalSourceStream* source_;
-  RuntimeCallStats* stats_;
-  uc16 one_char_buffer_;
-};
-
-TwoByteExternalStreamingStream::TwoByteExternalStreamingStream(
-    ScriptCompiler::ExternalSourceStream* source, RuntimeCallStats* stats)
-    : Utf16CharacterStream(&one_char_buffer_, &one_char_buffer_,
-                           &one_char_buffer_, 0),
-      source_(source),
-      stats_(stats),
-      one_char_buffer_(0) {}
-
-TwoByteExternalStreamingStream::~TwoByteExternalStreamingStream() {
-  DeleteChunks(chunks_);
-}
-
-bool TwoByteExternalStreamingStream::ReadBlock() {
-  size_t position = pos();
-
-  // We'll search for the 2nd byte of our character, to make sure we
-  // have enough data for at least one character.
-  size_t chunk_no = FindChunk(chunks_, source_, 2 * position + 1, stats_);
-
-  // Out of data? Return 0.
-  if (chunks_[chunk_no].byte_length == 0) {
-    buffer_pos_ = position;
-    buffer_cursor_ = buffer_start_;
-    buffer_end_ = buffer_start_;
-    return false;
-  }
-
-  Chunk& current = chunks_[chunk_no];
-
-  // Annoying edge case: Chunks may not be 2-byte aligned, meaning that a
-  // character may be split between the previous and the current chunk.
-  // If we find such a lonely byte at the beginning of the chunk, we'll use
-  // one_char_buffer_ to hold the full character.
-  bool lonely_byte = (chunks_[chunk_no].byte_pos == (2 * position + 1));
-  if (lonely_byte) {
-    DCHECK_NE(chunk_no, 0u);
-    Chunk& previous_chunk = chunks_[chunk_no - 1];
-#ifdef V8_TARGET_BIG_ENDIAN
-    uc16 character = current.data[0] |
-                     previous_chunk.data[previous_chunk.byte_length - 1] << 8;
-#else
-    uc16 character = previous_chunk.data[previous_chunk.byte_length - 1] |
-                     current.data[0] << 8;
-#endif
-
-    one_char_buffer_ = character;
-    buffer_pos_ = position;
-    buffer_start_ = &one_char_buffer_;
-    buffer_cursor_ = &one_char_buffer_;
-    buffer_end_ = &one_char_buffer_ + 1;
-    return true;
-  }
-
-  // Common case: character is in current chunk.
-  DCHECK_LE(current.byte_pos, 2 * position);
-  DCHECK_LT(2 * position + 1, current.byte_pos + current.byte_length);
-
-  // Determine # of full ucs-2 chars in stream, and whether we started on an odd
-  // byte boundary.
-  bool odd_start = (current.byte_pos % 2) == 1;
-  size_t number_chars = (current.byte_length - odd_start) / 2;
-
-  // Point the buffer_*_ members into the current chunk and set buffer_cursor_
-  // to point to position. Be careful when converting the byte positions (in
-  // Chunk) to the ucs-2 character positions (in buffer_*_ members).
-  buffer_start_ = reinterpret_cast<const uint16_t*>(current.data + odd_start);
-  buffer_end_ = buffer_start_ + number_chars;
-  buffer_pos_ = (current.byte_pos + odd_start) / 2;
-  buffer_cursor_ = buffer_start_ + (position - buffer_pos_);
-  DCHECK_EQ(position, pos());
-  return true;
-}
-
-#else
-
-// ----------------------------------------------------------------------------
-// TwoByteExternalBufferedStream
-//
-// This class is made specifically to address unaligned access to 16-bit data
-// in MIPS and ARM architectures. It replaces class
-// TwoByteExternalStreamingStream which in some cases does have unaligned
-// accesse to 16-bit data
-
-class TwoByteExternalBufferedStream : public Utf16CharacterStream {
- public:
-  explicit TwoByteExternalBufferedStream(
-      ScriptCompiler::ExternalSourceStream* source, RuntimeCallStats* stats);
-  ~TwoByteExternalBufferedStream();
-
-  bool can_access_heap() override { return false; }
-
- protected:
-  static const size_t kBufferSize = 512;
-
-  bool ReadBlock() override;
-
-  // FillBuffer should read up to kBufferSize characters at position and store
-  // them into buffer_[0..]. It returns the number of characters stored.
-  size_t FillBuffer(size_t position, size_t chunk_no);
-
-  // Fixed sized buffer that this class reads from.
-  // The base class' buffer_start_ should always point to buffer_.
-  uc16 buffer_[kBufferSize];
-
-  Chunks chunks_;
-  ScriptCompiler::ExternalSourceStream* source_;
-  RuntimeCallStats* stats_;
-};
-
-TwoByteExternalBufferedStream::TwoByteExternalBufferedStream(
-    ScriptCompiler::ExternalSourceStream* source, RuntimeCallStats* stats)
-    : Utf16CharacterStream(buffer_, buffer_, buffer_, 0),
-      source_(source),
-      stats_(stats) {}
-
-TwoByteExternalBufferedStream::~TwoByteExternalBufferedStream() {
-  DeleteChunks(chunks_);
-}
-
-bool TwoByteExternalBufferedStream::ReadBlock() {
-  size_t position = pos();
-  // Find chunk in which the position belongs
-  size_t chunk_no = FindChunk(chunks_, source_, 2 * position + 1, stats_);
-
-  // Out of data? Return 0.
-  if (chunks_[chunk_no].byte_length == 0) {
-    buffer_pos_ = position;
-    buffer_cursor_ = buffer_start_;
-    buffer_end_ = buffer_start_;
-    return false;
-  }
-
-  Chunk& current = chunks_[chunk_no];
-
-  bool odd_start = current.byte_pos % 2;
-  // Common case: character is in current chunk.
-  DCHECK_LE(current.byte_pos, 2 * position + odd_start);
-  DCHECK_LT(2 * position + 1, current.byte_pos + current.byte_length);
-
-  // If character starts on odd address copy text in buffer so there is always
-  // aligned access to characters. This is important on MIPS and ARM
-  // architectures. Otherwise read characters from memory directly.
-  if (!odd_start) {
-    buffer_start_ = reinterpret_cast<const uint16_t*>(current.data);
-    size_t number_chars = current.byte_length / 2;
-    buffer_end_ = buffer_start_ + number_chars;
-    buffer_pos_ = current.byte_pos / 2;
-    buffer_cursor_ = buffer_start_ + (position - buffer_pos_);
-    DCHECK_EQ(position, pos());
-    return true;
-  } else {
-    buffer_start_ = buffer_;
-    buffer_pos_ = position;
-    buffer_cursor_ = buffer_;
-    buffer_end_ = buffer_ + FillBuffer(position, chunk_no);
-    DCHECK_EQ(pos(), position);
-    DCHECK_LE(buffer_end_, buffer_start_ + kBufferSize);
-    return buffer_cursor_ < buffer_end_;
-  }
-}
-
-size_t TwoByteExternalBufferedStream::FillBuffer(size_t position,
-                                                 size_t chunk_no) {
-  DCHECK_EQ(chunks_[chunk_no].byte_pos % 2, 1u);
-  bool odd_start = true;
-  // Align buffer_pos_ to the size of the buffer.
-  {
-    size_t new_pos = position / kBufferSize * kBufferSize;
-    if (new_pos != position) {
-      chunk_no = FindChunk(chunks_, source_, 2 * new_pos + 1, stats_);
-      buffer_pos_ = new_pos;
-      buffer_cursor_ = buffer_start_ + (position - buffer_pos_);
-      position = new_pos;
-      odd_start = chunks_[chunk_no].byte_pos % 2;
-    }
-  }
-
-  Chunk* current = &chunks_[chunk_no];
-
-  // Annoying edge case: Chunks may not be 2-byte aligned, meaning that a
-  // character may be split between the previous and the current chunk.
-  // If we find such a lonely byte at the beginning of the chunk, we'll copy
-  // it to the first byte in buffer_.
-  size_t totalLength = 0;
-  bool lonely_byte = (current->byte_pos == (2 * position + 1));
-  if (lonely_byte) {
-    DCHECK_NE(chunk_no, 0u);
-    Chunk& previous_chunk = chunks_[chunk_no - 1];
-    *reinterpret_cast<uint8_t*>(buffer_) =
-        previous_chunk.data[previous_chunk.byte_length - 1];
-    totalLength++;
-  }
-
-  // Common case: character is in current chunk.
-  DCHECK_LE(current->byte_pos, 2 * position + odd_start);
-  DCHECK_LT(2 * position + 1, current->byte_pos + current->byte_length);
-
-  // Copy characters from current chunk starting from chunk_pos to the end of
-  // buffer or chunk.
-  size_t chunk_pos = position - current->byte_pos / 2;
-  size_t start_offset = odd_start && chunk_pos != 0;
-  size_t bytes_to_move =
-      i::Min(2 * kBufferSize - lonely_byte,
-             current->byte_length - 2 * chunk_pos + start_offset);
-  i::MemMove(reinterpret_cast<uint8_t*>(buffer_) + lonely_byte,
-             current->data + 2 * chunk_pos - start_offset, bytes_to_move);
-
-  // Fill up the rest of the buffer if there is space and data left.
-  totalLength += bytes_to_move;
-  position = (current->byte_pos + current->byte_length) / 2;
-  if (position - buffer_pos_ < kBufferSize) {
-    chunk_no = FindChunk(chunks_, source_, 2 * position + 1, stats_);
-    current = &chunks_[chunk_no];
-    odd_start = current->byte_pos % 2;
-    bytes_to_move = i::Min(2 * kBufferSize - totalLength, current->byte_length);
-    while (bytes_to_move) {
-      // Common case: character is in current chunk.
-      DCHECK_LE(current->byte_pos, 2 * position + odd_start);
-      DCHECK_LT(2 * position + 1, current->byte_pos + current->byte_length);
-
-      i::MemMove(reinterpret_cast<uint8_t*>(buffer_) + totalLength,
-                 current->data, bytes_to_move);
-      totalLength += bytes_to_move;
-      position = (current->byte_pos + current->byte_length) / 2;
-      chunk_no = FindChunk(chunks_, source_, 2 * position + 1, stats_);
-      current = &chunks_[chunk_no];
-      odd_start = current->byte_pos % 2;
-      bytes_to_move =
-          i::Min(2 * kBufferSize - totalLength, current->byte_length);
-    }
-  }
-  return totalLength / 2;
-}
-#endif
-
 // ----------------------------------------------------------------------------
 // ScannerStream: Create stream instances.
 
-Utf16CharacterStream* ScannerStream::For(Handle<String> data) {
-  return ScannerStream::For(data, 0, data->length());
+Utf16CharacterStream* ScannerStream::For(Isolate* isolate,
+                                         Handle<String> data) {
+  return ScannerStream::For(isolate, data, 0, data->length());
 }
 
-Utf16CharacterStream* ScannerStream::For(Handle<String> data, int start_pos,
-                                         int end_pos) {
+Utf16CharacterStream* ScannerStream::For(Isolate* isolate, Handle<String> data,
+                                         int start_pos, int end_pos) {
   DCHECK_GE(start_pos, 0);
   DCHECK_LE(start_pos, end_pos);
   DCHECK_LE(end_pos, data->length());
+  size_t start_offset = 0;
+  if (data->IsSlicedString()) {
+    SlicedString* string = SlicedString::cast(*data);
+    start_offset = string->offset();
+    data = handle(string->parent(), string->GetIsolate());
+  } else {
+    data = String::Flatten(data->GetIsolate(), data);
+  }
   if (data->IsExternalOneByteString()) {
-    return new ExternalOneByteStringUtf16CharacterStream(
-        Handle<ExternalOneByteString>::cast(data),
-        static_cast<size_t>(start_pos), static_cast<size_t>(end_pos));
+    return new BufferedCharacterStream<uint8_t, ExternalStringStream>(
+        static_cast<size_t>(start_pos),
+        ExternalOneByteString::cast(*data)->GetChars() + start_offset,
+        static_cast<size_t>(end_pos));
   } else if (data->IsExternalTwoByteString()) {
-    return new ExternalTwoByteStringUtf16CharacterStream(
-        Handle<ExternalTwoByteString>::cast(data),
-        static_cast<size_t>(start_pos), static_cast<size_t>(end_pos));
+    return new UnbufferedCharacterStream<ExternalStringStream>(
+        static_cast<size_t>(start_pos),
+        ExternalTwoByteString::cast(*data)->GetChars() + start_offset,
+        static_cast<size_t>(end_pos));
+  } else if (data->IsSeqOneByteString()) {
+    return new BufferedCharacterStream<uint8_t, OnHeapStream>(
+        static_cast<size_t>(start_pos), Handle<SeqOneByteString>::cast(data),
+        start_offset, static_cast<size_t>(end_pos));
+  } else if (data->IsSeqTwoByteString()) {
+    return new BufferedCharacterStream<uint16_t, OnHeapStream>(
+        static_cast<size_t>(start_pos), Handle<SeqTwoByteString>::cast(data),
+        start_offset, static_cast<size_t>(end_pos));
   } else {
-    // TODO(vogelheim): Maybe call data.Flatten() first?
-    return new GenericStringUtf16CharacterStream(
-        data, static_cast<size_t>(start_pos), static_cast<size_t>(end_pos));
+    UNREACHABLE();
   }
 }
 
@@ -866,7 +599,9 @@ std::unique_ptr<Utf16CharacterStream> ScannerStream::ForTesting(
 std::unique_ptr<Utf16CharacterStream> ScannerStream::ForTesting(
     const char* data, size_t length) {
   return std::unique_ptr<Utf16CharacterStream>(
-      new ExternalOneByteStringUtf16CharacterStream(data, length));
+      new BufferedCharacterStream<uint8_t, ExternalStringStream>(
+          static_cast<size_t>(0), reinterpret_cast<const uint8_t*>(data),
+          static_cast<size_t>(length)));
 }
 
 Utf16CharacterStream* ScannerStream::For(
@@ -875,18 +610,15 @@ Utf16CharacterStream* ScannerStream::For(
     RuntimeCallStats* stats) {
   switch (encoding) {
     case v8::ScriptCompiler::StreamedSource::TWO_BYTE:
-#if !(V8_TARGET_ARCH_MIPS || V8_TARGET_ARCH_MIPS64)
-      return new TwoByteExternalStreamingStream(source_stream, stats);
-#else
-      return new TwoByteExternalBufferedStream(source_stream, stats);
-#endif
+      return new UnbufferedCharacterStream<ChunkedStream>(
+          static_cast<size_t>(0), source_stream, stats);
     case v8::ScriptCompiler::StreamedSource::ONE_BYTE:
-      return new OneByteExternalStreamingStream(source_stream, stats);
+      return new BufferedCharacterStream<uint8_t, ChunkedStream>(
+          static_cast<size_t>(0), source_stream, stats);
     case v8::ScriptCompiler::StreamedSource::UTF8:
       return new Utf8ExternalStreamingStream(source_stream, stats);
   }
   UNREACHABLE();
-  return nullptr;
 }
 
 }  // namespace internal
diff --git a/deps/v8/src/parsing/scanner-character-streams.h b/deps/v8/src/parsing/scanner-character-streams.h
index 9f7d2bd5fb5c8b..12c5847f2fade6 100644
--- a/deps/v8/src/parsing/scanner-character-streams.h
+++ b/deps/v8/src/parsing/scanner-character-streams.h
@@ -19,9 +19,9 @@ class String;
 
 class V8_EXPORT_PRIVATE ScannerStream {
  public:
-  static Utf16CharacterStream* For(Handle<String> data);
-  static Utf16CharacterStream* For(Handle<String> data, int start_pos,
-                                   int end_pos);
+  static Utf16CharacterStream* For(Isolate* isolate, Handle<String> data);
+  static Utf16CharacterStream* For(Isolate* isolate, Handle<String> data,
+                                   int start_pos, int end_pos);
   static Utf16CharacterStream* For(
       ScriptCompiler::ExternalSourceStream* source_stream,
       ScriptCompiler::StreamedSource::Encoding encoding,
diff --git a/deps/v8/src/parsing/scanner.cc b/deps/v8/src/parsing/scanner.cc
index 942e5aecc57b98..93928e7c21bb5d 100644
--- a/deps/v8/src/parsing/scanner.cc
+++ b/deps/v8/src/parsing/scanner.cc
@@ -391,21 +391,6 @@ Token::Value Scanner::Next() {
   }
   has_line_terminator_before_next_ = false;
   has_multiline_comment_before_next_ = false;
-  if (static_cast<unsigned>(c0_) <= 0x7F) {
-    Token::Value token = static_cast<Token::Value>(one_char_tokens[c0_]);
-    if (token != Token::ILLEGAL) {
-      int pos = source_pos();
-      next_.token = token;
-      next_.contextual_token = Token::UNINITIALIZED;
-      next_.location.beg_pos = pos;
-      next_.location.end_pos = pos + 1;
-      next_.literal_chars = nullptr;
-      next_.raw_literal_chars = nullptr;
-      next_.invalid_template_escape_message = MessageTemplate::kNone;
-      Advance();
-      return current_.token;
-    }
-  }
   Scan();
   return current_.token;
 }
@@ -438,8 +423,8 @@ Token::Value Scanner::SkipWhiteSpace() {
 
   while (true) {
     while (true) {
-      // Don't skip behind the end of input.
-      if (c0_ == kEndOfInput) break;
+      // We won't skip behind the end of input.
+      DCHECK(!unicode_cache_->IsWhiteSpace(kEndOfInput));
 
       // Advance as long as character is a WhiteSpace or LineTerminator.
       // Remember if the latter is the case.
@@ -521,9 +506,11 @@ Token::Value Scanner::SkipSourceURLComment() {
 void Scanner::TryToParseSourceURLComment() {
   // Magic comments are of the form: //[#@]\s<name>=\s*<value>\s*.* and this
   // function will just return if it cannot parse a magic comment.
-  if (c0_ == kEndOfInput || !unicode_cache_->IsWhiteSpace(c0_)) return;
+  DCHECK(!unicode_cache_->IsWhiteSpaceOrLineTerminator(kEndOfInput));
+  if (!unicode_cache_->IsWhiteSpace(c0_)) return;
   Advance();
   LiteralBuffer name;
+
   while (c0_ != kEndOfInput &&
          !unicode_cache_->IsWhiteSpaceOrLineTerminator(c0_) && c0_ != '=') {
     name.AddChar(c0_);
@@ -543,7 +530,7 @@ void Scanner::TryToParseSourceURLComment() {
     return;
   Advance();
   value->Reset();
-  while (c0_ != kEndOfInput && unicode_cache_->IsWhiteSpace(c0_)) {
+  while (unicode_cache_->IsWhiteSpace(c0_)) {
     Advance();
   }
   while (c0_ != kEndOfInput && !unibrow::IsLineTerminator(c0_)) {
@@ -576,7 +563,8 @@ Token::Value Scanner::SkipMultiLineComment() {
   while (c0_ != kEndOfInput) {
     uc32 ch = c0_;
     Advance();
-    if (c0_ != kEndOfInput && unibrow::IsLineTerminator(ch)) {
+    DCHECK(!unibrow::IsLineTerminator(kEndOfInput));
+    if (unibrow::IsLineTerminator(ch)) {
       // Following ECMA-262, section 7.4, a comment containing
       // a newline will make the comment count as a line-terminator.
       has_multiline_comment_before_next_ = true;
@@ -617,24 +605,26 @@ void Scanner::Scan() {
   next_.literal_chars = nullptr;
   next_.raw_literal_chars = nullptr;
   next_.invalid_template_escape_message = MessageTemplate::kNone;
+
   Token::Value token;
   do {
+    if (static_cast<unsigned>(c0_) <= 0x7F) {
+      Token::Value token = static_cast<Token::Value>(one_char_tokens[c0_]);
+      if (token != Token::ILLEGAL) {
+        int pos = source_pos();
+        next_.token = token;
+        next_.contextual_token = Token::UNINITIALIZED;
+        next_.location.beg_pos = pos;
+        next_.location.end_pos = pos + 1;
+        Advance();
+        return;
+      }
+    }
+
     // Remember the position of the next token
     next_.location.beg_pos = source_pos();
 
     switch (c0_) {
-      case ' ':
-      case '\t':
-        Advance();
-        token = Token::WHITESPACE;
-        break;
-
-      case '\n':
-        Advance();
-        has_line_terminator_before_next_ = true;
-        token = Token::WHITESPACE;
-        break;
-
       case '"':
       case '\'':
         token = ScanString();
@@ -813,50 +803,6 @@ void Scanner::Scan() {
         }
         break;
 
-      case ':':
-        token = Select(Token::COLON);
-        break;
-
-      case ';':
-        token = Select(Token::SEMICOLON);
-        break;
-
-      case ',':
-        token = Select(Token::COMMA);
-        break;
-
-      case '(':
-        token = Select(Token::LPAREN);
-        break;
-
-      case ')':
-        token = Select(Token::RPAREN);
-        break;
-
-      case '[':
-        token = Select(Token::LBRACK);
-        break;
-
-      case ']':
-        token = Select(Token::RBRACK);
-        break;
-
-      case '{':
-        token = Select(Token::LBRACE);
-        break;
-
-      case '}':
-        token = Select(Token::RBRACE);
-        break;
-
-      case '?':
-        token = Select(Token::CONDITIONAL);
-        break;
-
-      case '~':
-        token = Select(Token::BIT_NOT);
-        break;
-
       case '`':
         token = ScanTemplateStart();
         break;
@@ -866,17 +812,17 @@ void Scanner::Scan() {
         break;
 
       default:
-        if (c0_ == kEndOfInput) {
-          token = Token::EOS;
-        } else if (unicode_cache_->IsIdentifierStart(c0_)) {
+        if (unicode_cache_->IsIdentifierStart(c0_) ||
+            (CombineSurrogatePair() &&
+             unicode_cache_->IsIdentifierStart(c0_))) {
           token = ScanIdentifierOrKeyword();
         } else if (IsDecimalDigit(c0_)) {
           token = ScanNumber(false);
+        } else if (c0_ == kEndOfInput) {
+          token = Token::EOS;
         } else {
           token = SkipWhiteSpace();
-          if (token == Token::ILLEGAL) {
-            Advance();
-          }
+          if (token == Token::ILLEGAL) Advance();
         }
         break;
     }
@@ -978,8 +924,8 @@ bool Scanner::ScanEscape() {
   Advance<capture_raw>();
 
   // Skip escaped newlines.
-  if (!in_template_literal && c0_ != kEndOfInput &&
-      unibrow::IsLineTerminator(c)) {
+  DCHECK(!unibrow::IsLineTerminator(kEndOfInput));
+  if (!in_template_literal && unibrow::IsLineTerminator(c)) {
     // Allow escaped CR+LF newlines in multiline string literals.
     if (IsCarriageReturn(c) && IsLineFeed(c0_)) Advance<capture_raw>();
     return true;
@@ -1053,46 +999,28 @@ uc32 Scanner::ScanOctalEscape(uc32 c, int length, bool in_template_literal) {
 
 Token::Value Scanner::ScanString() {
   uc32 quote = c0_;
-  Advance<false, false>();  // consume quote
+  Advance();  // consume quote
 
   LiteralScope literal(this);
   while (true) {
-    if (c0_ > kMaxAscii) {
-      HandleLeadSurrogate();
-      break;
-    }
-    if (c0_ == kEndOfInput || c0_ == '\n' || c0_ == '\r') return Token::ILLEGAL;
     if (c0_ == quote) {
       literal.Complete();
-      Advance<false, false>();
+      Advance();
       return Token::STRING;
     }
-    char c = static_cast<char>(c0_);
-    if (c == '\\') break;
-    Advance<false, false>();
-    AddLiteralChar(c);
-  }
-
-  bool (*line_terminator_func)(unsigned int) =
-      FLAG_harmony_subsume_json ? unibrow::IsStringLiteralLineTerminator
-                                : unibrow::IsLineTerminator;
-
-  while (c0_ != quote && c0_ != kEndOfInput && !line_terminator_func(c0_)) {
-    uc32 c = c0_;
-    Advance();
-    if (c == '\\') {
+    if (c0_ == kEndOfInput || unibrow::IsStringLiteralLineTerminator(c0_)) {
+      return Token::ILLEGAL;
+    }
+    if (c0_ == '\\') {
+      Advance();
+      // TODO(verwaest): Check whether we can remove the additional check.
       if (c0_ == kEndOfInput || !ScanEscape<false, false>()) {
         return Token::ILLEGAL;
       }
-    } else {
-      AddLiteralChar(c);
+      continue;
     }
+    AddLiteralCharAdvance();
   }
-  if (c0_ != quote) return Token::ILLEGAL;
-  literal.Complete();
-
-  Advance();  // consume quote
-  return Token::STRING;
 }
 
 Token::Value Scanner::ScanPrivateName() {
@@ -1105,7 +1033,8 @@ Token::Value Scanner::ScanPrivateName() {
   LiteralScope literal(this);
   DCHECK_EQ(c0_, '#');
   AddLiteralCharAdvance();
-  if (c0_ == kEndOfInput || !unicode_cache_->IsIdentifierStart(c0_)) {
+  DCHECK(!unicode_cache_->IsIdentifierStart(kEndOfInput));
+  if (!unicode_cache_->IsIdentifierStart(c0_)) {
     PushBack(c0_);
     ReportScannerError(source_pos(),
                        MessageTemplate::kInvalidOrUnexpectedToken);
@@ -1153,7 +1082,8 @@ Token::Value Scanner::ScanTemplateSpan() {
       ReduceRawLiteralLength(2);
       break;
     } else if (c == '\\') {
-      if (c0_ != kEndOfInput && unibrow::IsLineTerminator(c0_)) {
+      DCHECK(!unibrow::IsLineTerminator(kEndOfInput));
+      if (unibrow::IsLineTerminator(c0_)) {
         // The TV of LineContinuation :: \ LineTerminatorSequence is the empty
         // code unit sequence.
         uc32 lastChar = c0_;
@@ -1233,7 +1163,7 @@ bool Scanner::ScanDigitsWithNumericSeparators(bool (*predicate)(uc32 ch),
   bool separator_seen = false;
   while (predicate(c0_) || c0_ == '_') {
     if (c0_ == '_') {
-      Advance<false, false>();
+      Advance();
       if (c0_ == '_') {
         ReportScannerError(Location(source_pos(), source_pos() + 1),
                            MessageTemplate::kContinuousNumericSeparator);
@@ -1269,7 +1199,7 @@ bool Scanner::ScanDecimalAsSmiWithNumericSeparators(uint64_t* value) {
   bool separator_seen = false;
   while (IsDecimalDigit(c0_) || c0_ == '_') {
     if (c0_ == '_') {
-      Advance<false, false>();
+      Advance();
       if (c0_ == '_') {
         ReportScannerError(Location(source_pos(), source_pos() + 1),
                            MessageTemplate::kContinuousNumericSeparator);
@@ -1281,7 +1211,7 @@ bool Scanner::ScanDecimalAsSmiWithNumericSeparators(uint64_t* value) {
     separator_seen = false;
     *value = 10 * *value + (c0_ - '0');
     uc32 first_char = c0_;
-    Advance<false, false>();
+    Advance();
     AddLiteralChar(first_char);
   }
 
@@ -1302,7 +1232,7 @@ bool Scanner::ScanDecimalAsSmi(uint64_t* value) {
   while (IsDecimalDigit(c0_)) {
     *value = 10 * *value + (c0_ - '0');
     uc32 first_char = c0_;
-    Advance<false, false>();
+    Advance();
     AddLiteralChar(first_char);
   }
   return true;
@@ -1447,10 +1377,9 @@ Token::Value Scanner::ScanNumber(bool seen_period) {
 
         if (next_.literal_chars->one_byte_literal().length() <= 10 &&
             value <= Smi::kMaxValue && c0_ != '.' &&
-            (c0_ == kEndOfInput || !unicode_cache_->IsIdentifierStart(c0_))) {
+            !unicode_cache_->IsIdentifierStart(c0_)) {
           next_.smi_value_ = static_cast<uint32_t>(value);
           literal.Complete();
-          HandleLeadSurrogate();
 
           if (kind == DECIMAL_WITH_LEADING_ZERO) {
             octal_pos_ = Location(start_pos, source_pos());
@@ -1458,7 +1387,6 @@ Token::Value Scanner::ScanNumber(bool seen_period) {
           }
           return Token::SMI;
         }
-        HandleLeadSurrogate();
       }
 
       if (!ScanDecimalDigits()) return Token::ILLEGAL;
@@ -1506,9 +1434,9 @@ Token::Value Scanner::ScanNumber(bool seen_period) {
   // not be an identifier start or a decimal digit; see ECMA-262
   // section 7.8.3, page 17 (note that we read only one decimal digit
   // if the value is 0).
-  if (IsDecimalDigit(c0_) ||
-      (c0_ != kEndOfInput && unicode_cache_->IsIdentifierStart(c0_)))
+  if (IsDecimalDigit(c0_) || unicode_cache_->IsIdentifierStart(c0_)) {
     return Token::ILLEGAL;
+  }
 
   literal.Complete();
 
@@ -1691,24 +1619,18 @@ Token::Value Scanner::ScanIdentifierOrKeyword() {
 
 Token::Value Scanner::ScanIdentifierOrKeywordInner(LiteralScope* literal) {
   DCHECK(unicode_cache_->IsIdentifierStart(c0_));
+  bool escaped = false;
   if (IsInRange(c0_, 'a', 'z') || c0_ == '_') {
     do {
-      char first_char = static_cast<char>(c0_);
-      Advance<false, false>();
-      AddLiteralChar(first_char);
+      AddLiteralCharAdvance();
     } while (IsInRange(c0_, 'a', 'z') || c0_ == '_');
 
-    if (IsDecimalDigit(c0_) || IsInRange(c0_, 'A', 'Z') || c0_ == '_' ||
-        c0_ == '$') {
-      // Identifier starting with lowercase.
-      char first_char = static_cast<char>(c0_);
-      Advance<false, false>();
-      AddLiteralChar(first_char);
-      while (IsAsciiIdentifier(c0_)) {
-        char first_char = static_cast<char>(c0_);
-        Advance<false, false>();
-        AddLiteralChar(first_char);
-      }
+    if (IsDecimalDigit(c0_) || IsInRange(c0_, 'A', 'Z') || c0_ == '$') {
+      // Identifier starting with lowercase or _.
+      do {
+        AddLiteralCharAdvance();
+      } while (IsAsciiIdentifier(c0_));
+
       if (c0_ <= kMaxAscii && c0_ != '\\') {
         literal->Complete();
         return Token::IDENTIFIER;
@@ -1724,100 +1646,67 @@ Token::Value Scanner::ScanIdentifierOrKeywordInner(LiteralScope* literal) {
         literal->Complete();
       return token;
     }
-
-    HandleLeadSurrogate();
-  } else if (IsInRange(c0_, 'A', 'Z') || c0_ == '_' || c0_ == '$') {
+  } else if (IsInRange(c0_, 'A', 'Z') || c0_ == '$') {
     do {
-      char first_char = static_cast<char>(c0_);
-      Advance<false, false>();
-      AddLiteralChar(first_char);
+      AddLiteralCharAdvance();
     } while (IsAsciiIdentifier(c0_));
 
     if (c0_ <= kMaxAscii && c0_ != '\\') {
       literal->Complete();
       return Token::IDENTIFIER;
     }
-
-    HandleLeadSurrogate();
   } else if (c0_ == '\\') {
-    // Scan identifier start character.
+    escaped = true;
     uc32 c = ScanIdentifierUnicodeEscape();
-    // Only allow legal identifier start characters.
-    if (c < 0 ||
-        c == '\\' ||  // No recursive escapes.
-        !unicode_cache_->IsIdentifierStart(c)) {
+    DCHECK(!unicode_cache_->IsIdentifierStart(-1));
+    if (c == '\\' || !unicode_cache_->IsIdentifierStart(c)) {
       return Token::ILLEGAL;
     }
     AddLiteralChar(c);
-    return ScanIdentifierSuffix(literal, true);
-  } else {
-    uc32 first_char = c0_;
-    Advance();
-    AddLiteralChar(first_char);
   }
 
-  // Scan the rest of the identifier characters.
-  while (c0_ != kEndOfInput && unicode_cache_->IsIdentifierPart(c0_)) {
-    if (c0_ != '\\') {
-      uc32 next_char = c0_;
-      Advance();
-      AddLiteralChar(next_char);
-      continue;
-    }
-    // Fallthrough if no longer able to complete keyword.
-    return ScanIdentifierSuffix(literal, false);
-  }
-
-  if (next_.literal_chars->is_one_byte()) {
-    Vector<const uint8_t> chars = next_.literal_chars->one_byte_literal();
-    Token::Value token =
-        KeywordOrIdentifierToken(chars.start(), chars.length());
-    if (token == Token::IDENTIFIER ||
-        token == Token::FUTURE_STRICT_RESERVED_WORD ||
-        Token::IsContextualKeyword(token))
-      literal->Complete();
-    return token;
-  }
-  literal->Complete();
-  return Token::IDENTIFIER;
-}
-
-
-Token::Value Scanner::ScanIdentifierSuffix(LiteralScope* literal,
-                                           bool escaped) {
-  // Scan the rest of the identifier characters.
-  while (c0_ != kEndOfInput && unicode_cache_->IsIdentifierPart(c0_)) {
+  while (true) {
     if (c0_ == '\\') {
-      uc32 c = ScanIdentifierUnicodeEscape();
       escaped = true;
+      uc32 c = ScanIdentifierUnicodeEscape();
       // Only allow legal identifier part characters.
-      if (c < 0 ||
-          c == '\\' ||
-          !unicode_cache_->IsIdentifierPart(c)) {
+      // TODO(verwaest): Make this true.
+      // DCHECK(!unicode_cache_->IsIdentifierPart('\\'));
+      DCHECK(!unicode_cache_->IsIdentifierPart(-1));
+      if (c == '\\' || !unicode_cache_->IsIdentifierPart(c)) {
         return Token::ILLEGAL;
       }
       AddLiteralChar(c);
+    } else if (unicode_cache_->IsIdentifierPart(c0_) ||
+               (CombineSurrogatePair() &&
+                unicode_cache_->IsIdentifierPart(c0_))) {
+      AddLiteralCharAdvance();
     } else {
-      AddLiteralChar(c0_);
-      Advance();
+      break;
     }
   }
-  literal->Complete();
 
-  if (escaped && next_.literal_chars->is_one_byte()) {
+  if (next_.literal_chars->is_one_byte()) {
     Vector<const uint8_t> chars = next_.literal_chars->one_byte_literal();
     Token::Value token =
         KeywordOrIdentifierToken(chars.start(), chars.length());
     /* TODO(adamk): YIELD should be handled specially. */
     if (token == Token::IDENTIFIER || Token::IsContextualKeyword(token)) {
+      literal->Complete();
       return token;
-    } else if (token == Token::FUTURE_STRICT_RESERVED_WORD ||
-               token == Token::LET || token == Token::STATIC) {
+    }
+
+    if (!escaped) return token;
+
+    literal->Complete();
+    if (token == Token::FUTURE_STRICT_RESERVED_WORD || token == Token::LET ||
+        token == Token::STATIC) {
       return Token::ESCAPED_STRICT_RESERVED_WORD;
-    } else {
-      return Token::ESCAPED_KEYWORD;
     }
+    return Token::ESCAPED_KEYWORD;
   }
+
+  literal->Complete();
   return Token::IDENTIFIER;
 }
 
@@ -1882,7 +1771,7 @@ Maybe<RegExp::Flags> Scanner::ScanRegExpFlags() {
 
   // Scan regular expression flags.
   int flags = 0;
-  while (c0_ != kEndOfInput && unicode_cache_->IsIdentifierPart(c0_)) {
+  while (unicode_cache_->IsIdentifierPart(c0_)) {
     RegExp::Flags flag = RegExp::kNone;
     switch (c0_) {
       case 'g':
diff --git a/deps/v8/src/parsing/scanner.h b/deps/v8/src/parsing/scanner.h
index 77ea4d3272f812..34da5fafbf733f 100644
--- a/deps/v8/src/parsing/scanner.h
+++ b/deps/v8/src/parsing/scanner.h
@@ -403,12 +403,12 @@ class Scanner {
 
     ~LiteralBuffer() { backing_store_.Dispose(); }
 
-    INLINE(void AddChar(char code_unit)) {
+    V8_INLINE void AddChar(char code_unit) {
       DCHECK(IsValidAscii(code_unit));
       AddOneByteChar(static_cast<byte>(code_unit));
     }
 
-    INLINE(void AddChar(uc32 code_unit)) {
+    V8_INLINE void AddChar(uc32 code_unit) {
       if (is_one_byte_ &&
           code_unit <= static_cast<uc32>(unibrow::Latin1::kMaxChar)) {
         AddOneByteChar(static_cast<byte>(code_unit));
@@ -465,7 +465,7 @@ class Scanner {
       return iscntrl(code_unit) || isprint(code_unit);
     }
 
-    INLINE(void AddOneByteChar(byte one_byte_char)) {
+    V8_INLINE void AddOneByteChar(byte one_byte_char) {
       DCHECK(is_one_byte_);
       if (position_ >= backing_store_.length()) ExpandBuffer();
       backing_store_[position_] = one_byte_char;
@@ -575,22 +575,22 @@ class Scanner {
     next_.raw_literal_chars = free_buffer;
   }
 
-  INLINE(void AddLiteralChar(uc32 c)) {
+  V8_INLINE void AddLiteralChar(uc32 c) {
     DCHECK_NOT_NULL(next_.literal_chars);
     next_.literal_chars->AddChar(c);
   }
 
-  INLINE(void AddLiteralChar(char c)) {
+  V8_INLINE void AddLiteralChar(char c) {
     DCHECK_NOT_NULL(next_.literal_chars);
     next_.literal_chars->AddChar(c);
   }
 
-  INLINE(void AddRawLiteralChar(uc32 c)) {
+  V8_INLINE void AddRawLiteralChar(uc32 c) {
     DCHECK_NOT_NULL(next_.raw_literal_chars);
     next_.raw_literal_chars->AddChar(c);
   }
 
-  INLINE(void ReduceRawLiteralLength(int delta)) {
+  V8_INLINE void ReduceRawLiteralLength(int delta) {
     DCHECK_NOT_NULL(next_.raw_literal_chars);
     next_.raw_literal_chars->ReduceLength(delta);
   }
@@ -608,24 +608,26 @@ class Scanner {
   }
 
   // Low-level scanning support.
-  template <bool capture_raw = false, bool check_surrogate = true>
+  template <bool capture_raw = false>
   void Advance() {
     if (capture_raw) {
       AddRawLiteralChar(c0_);
     }
     c0_ = source_->Advance();
-    if (check_surrogate) HandleLeadSurrogate();
   }
 
-  void HandleLeadSurrogate() {
+  bool CombineSurrogatePair() {
+    DCHECK(!unibrow::Utf16::IsLeadSurrogate(kEndOfInput));
     if (unibrow::Utf16::IsLeadSurrogate(c0_)) {
       uc32 c1 = source_->Advance();
-      if (!unibrow::Utf16::IsTrailSurrogate(c1)) {
-        source_->Back();
-      } else {
+      DCHECK(!unibrow::Utf16::IsTrailSurrogate(kEndOfInput));
+      if (unibrow::Utf16::IsTrailSurrogate(c1)) {
         c0_ = unibrow::Utf16::CombineSurrogatePair(c0_, c1);
+        return true;
       }
+      source_->Back();
     }
+    return false;
   }
 
   void PushBack(uc32 ch) {
@@ -750,7 +752,6 @@ class Scanner {
   Token::Value ScanNumber(bool seen_period);
   Token::Value ScanIdentifierOrKeyword();
   Token::Value ScanIdentifierOrKeywordInner(LiteralScope* literal);
-  Token::Value ScanIdentifierSuffix(LiteralScope* literal, bool escaped);
 
   Token::Value ScanString();
   Token::Value ScanPrivateName();
diff --git a/deps/v8/src/perf-jit.cc b/deps/v8/src/perf-jit.cc
index 0e427df4ef453b..0a78ef9ab3e398 100644
--- a/deps/v8/src/perf-jit.cc
+++ b/deps/v8/src/perf-jit.cc
@@ -272,21 +272,41 @@ void PerfJitLogger::WriteJitCodeLoadEntry(const uint8_t* code_pointer,
 
 namespace {
 
-std::unique_ptr<char[]> GetScriptName(Handle<Script> script) {
-  Object* name_or_url = script->GetNameOrSourceURL();
-  int name_length = 0;
-  std::unique_ptr<char[]> name_string;
-  if (name_or_url->IsString()) {
-    return String::cast(name_or_url)
-        ->ToCString(DISALLOW_NULLS, FAST_STRING_TRAVERSAL, &name_length);
-  } else {
-    const char unknown[] = "<unknown>";
-    name_length = static_cast<int>(strlen(unknown));
-    char* buffer = NewArray<char>(name_length);
-    base::OS::StrNCpy(buffer, name_length + 1, unknown,
-                      static_cast<size_t>(name_length));
-    return std::unique_ptr<char[]>(buffer);
+constexpr char kUnknownScriptNameString[] = "<unknown>";
+constexpr size_t kUnknownScriptNameStringLen =
+    arraysize(kUnknownScriptNameString) - 1;
+
+size_t GetScriptNameLength(const SourcePositionInfo& info) {
+  if (!info.script.is_null()) {
+    Object* name_or_url = info.script->GetNameOrSourceURL();
+    if (name_or_url->IsString()) {
+      String* str = String::cast(name_or_url);
+      if (str->IsOneByteRepresentation()) return str->length();
+      int length;
+      str->ToCString(DISALLOW_NULLS, FAST_STRING_TRAVERSAL, &length);
+      return static_cast<size_t>(length);
+    }
   }
+  return kUnknownScriptNameStringLen;
+}
+
+Vector<const char> GetScriptName(const SourcePositionInfo& info,
+                                 std::unique_ptr<char[]>* storage) {
+  if (!info.script.is_null()) {
+    Object* name_or_url = info.script->GetNameOrSourceURL();
+    if (name_or_url->IsSeqOneByteString()) {
+      SeqOneByteString* str = SeqOneByteString::cast(name_or_url);
+      return {reinterpret_cast<char*>(str->GetChars()),
+              static_cast<size_t>(str->length())};
+    } else if (name_or_url->IsString()) {
+      int length;
+      *storage =
+          String::cast(name_or_url)
+              ->ToCString(DISALLOW_NULLS, FAST_STRING_TRAVERSAL, &length);
+      return {storage->get(), static_cast<size_t>(length)};
+    }
+  }
+  return {kUnknownScriptNameString, kUnknownScriptNameStringLen};
 }
 
 SourcePositionInfo GetSourcePositionInfo(Handle<Code> code,
@@ -312,13 +332,14 @@ void PerfJitLogger::LogWriteDebugInfo(Code* code, SharedFunctionInfo* shared) {
   if (entry_count == 0) return;
   // The WasmToJS wrapper stubs have source position entries.
   if (!shared->HasSourceCode()) return;
-  Handle<Script> script(Script::cast(shared->script()));
+  Isolate* isolate = shared->GetIsolate();
+  Handle<Script> script(Script::cast(shared->script()), isolate);
 
   PerfJitCodeDebugInfo debug_info;
 
   debug_info.event_ = PerfJitCodeLoad::kDebugInfo;
   debug_info.time_stamp_ = GetTimestamp();
-  debug_info.address_ = reinterpret_cast<uint64_t>(code->InstructionStart());
+  debug_info.address_ = code->InstructionStart();
   debug_info.entry_count_ = entry_count;
 
   uint32_t size = sizeof(debug_info);
@@ -326,15 +347,13 @@ void PerfJitLogger::LogWriteDebugInfo(Code* code, SharedFunctionInfo* shared) {
   size += entry_count * sizeof(PerfJitDebugEntry);
   // Add the size of the name after each entry.
 
-  Handle<Code> code_handle(code);
-  Handle<SharedFunctionInfo> function_handle(shared);
+  Handle<Code> code_handle(code, isolate);
+  Handle<SharedFunctionInfo> function_handle(shared, isolate);
   for (SourcePositionTableIterator iterator(code->SourcePositionTable());
        !iterator.done(); iterator.Advance()) {
     SourcePositionInfo info(GetSourcePositionInfo(code_handle, function_handle,
                                                   iterator.source_position()));
-    Handle<Script> script(Script::cast(info.function->script()));
-    std::unique_ptr<char[]> name_string = GetScriptName(script);
-    size += (static_cast<uint32_t>(strlen(name_string.get())) + 1);
+    size += GetScriptNameLength(info) + 1;
   }
 
   int padding = ((size + 7) & (~7)) - size;
@@ -351,17 +370,18 @@ void PerfJitLogger::LogWriteDebugInfo(Code* code, SharedFunctionInfo* shared) {
     // The entry point of the function will be placed straight after the ELF
     // header when processed by "perf inject". Adjust the position addresses
     // accordingly.
-    entry.address_ = reinterpret_cast<intptr_t>(
-        code_start + iterator.code_offset() + kElfHeaderSize);
+    entry.address_ = code_start + iterator.code_offset() + kElfHeaderSize;
     entry.line_number_ = info.line + 1;
     entry.column_ = info.column + 1;
     LogWriteBytes(reinterpret_cast<const char*>(&entry), sizeof(entry));
-    Handle<Script> script(Script::cast(info.function->script()));
-    std::unique_ptr<char[]> name_string = GetScriptName(script);
-    LogWriteBytes(name_string.get(),
-                  static_cast<uint32_t>(strlen(name_string.get())) + 1);
+    // The extracted name may point into heap-objects, thus disallow GC.
+    DisallowHeapAllocation no_gc;
+    std::unique_ptr<char[]> name_storage;
+    Vector<const char> name_string = GetScriptName(info, &name_storage);
+    LogWriteBytes(name_string.start(),
+                  static_cast<uint32_t>(name_string.size()) + 1);
   }
-  char padding_bytes[] = "\0\0\0\0\0\0\0\0";
+  char padding_bytes[8] = {0};
   LogWriteBytes(padding_bytes, padding);
 }
 
diff --git a/deps/v8/src/ppc/assembler-ppc-inl.h b/deps/v8/src/ppc/assembler-ppc-inl.h
index ae37b02a245bed..73c2e8dfe28907 100644
--- a/deps/v8/src/ppc/assembler-ppc-inl.h
+++ b/deps/v8/src/ppc/assembler-ppc-inl.h
@@ -80,7 +80,7 @@ Address RelocInfo::target_internal_reference() {
 
 Address RelocInfo::target_internal_reference_address() {
   DCHECK(IsInternalReference(rmode_) || IsInternalReferenceEncoded(rmode_));
-  return reinterpret_cast<Address>(pc_);
+  return pc_;
 }
 
 
@@ -99,7 +99,7 @@ Address RelocInfo::target_address_address() {
     // We return the PC for embedded constant pool since this function is used
     // by the serializer and expects the address to reside within the code
     // object.
-    return reinterpret_cast<Address>(pc_);
+    return pc_;
   }
 
   // Read the address of the word containing the target_address in an
@@ -111,7 +111,7 @@ Address RelocInfo::target_address_address() {
   // instruction bits, the size of the target will be zero, indicating that the
   // serializer should not step forward in memory after a target is resolved
   // and written.
-  return reinterpret_cast<Address>(pc_);
+  return pc_;
 }
 
 
@@ -173,7 +173,7 @@ Handle<HeapObject> RelocInfo::target_object_handle(Assembler* origin) {
       Assembler::target_address_at(pc_, constant_pool_)));
 }
 
-void RelocInfo::set_target_object(HeapObject* target,
+void RelocInfo::set_target_object(Heap* heap, HeapObject* target,
                                   WriteBarrierMode write_barrier_mode,
                                   ICacheFlushMode icache_flush_mode) {
   DCHECK(IsCodeTarget(rmode_) || rmode_ == EMBEDDED_OBJECT);
@@ -181,9 +181,8 @@ void RelocInfo::set_target_object(HeapObject* target,
                                    reinterpret_cast<Address>(target),
                                    icache_flush_mode);
   if (write_barrier_mode == UPDATE_WRITE_BARRIER && host() != nullptr) {
-    host()->GetHeap()->incremental_marking()->RecordWriteIntoCode(host(), this,
-                                                                  target);
-    host()->GetHeap()->RecordWriteIntoCode(host(), this, target);
+    heap->incremental_marking()->RecordWriteIntoCode(host(), this, target);
+    heap->RecordWriteIntoCode(host(), this, target);
   }
 }
 
@@ -200,13 +199,6 @@ void RelocInfo::set_target_external_reference(
                                    icache_flush_mode);
 }
 
-void RelocInfo::set_wasm_code_table_entry(Address target,
-                                          ICacheFlushMode icache_flush_mode) {
-  DCHECK(rmode_ == RelocInfo::WASM_CODE_TABLE_ENTRY);
-  Assembler::set_target_address_at(pc_, constant_pool_, target,
-                                   icache_flush_mode);
-}
-
 Address RelocInfo::target_runtime_entry(Assembler* origin) {
   DCHECK(IsRuntimeEntry(rmode_));
   return target_address();
@@ -231,14 +223,14 @@ void RelocInfo::WipeOut() {
          IsInternalReference(rmode_) || IsInternalReferenceEncoded(rmode_));
   if (IsInternalReference(rmode_)) {
     // Jump table entry
-    Memory::Address_at(pc_) = nullptr;
+    Memory::Address_at(pc_) = kNullAddress;
   } else if (IsInternalReferenceEncoded(rmode_)) {
     // mov sequence
     // Currently used only by deserializer, no need to flush.
-    Assembler::set_target_address_at(pc_, constant_pool_, nullptr,
+    Assembler::set_target_address_at(pc_, constant_pool_, kNullAddress,
                                      SKIP_ICACHE_FLUSH);
   } else {
-    Assembler::set_target_address_at(pc_, constant_pool_, nullptr);
+    Assembler::set_target_address_at(pc_, constant_pool_, kNullAddress);
   }
 }
 
@@ -247,7 +239,7 @@ void RelocInfo::Visit(ObjectVisitor* visitor) {
   RelocInfo::Mode mode = rmode();
   if (mode == RelocInfo::EMBEDDED_OBJECT) {
     visitor->VisitEmbeddedPointer(host(), this);
-  } else if (RelocInfo::IsCodeTarget(mode)) {
+  } else if (RelocInfo::IsCodeTargetMode(mode)) {
     visitor->VisitCodeTarget(host(), this);
   } else if (mode == RelocInfo::EXTERNAL_REFERENCE) {
     visitor->VisitExternalReference(host(), this);
@@ -296,11 +288,11 @@ Address Assembler::target_address_at(Address pc, Address constant_pool) {
                    static_cast<uint32_t>(instr2 & kImm16Mask));
     uint64_t lo = (static_cast<uint32_t>((instr4 & kImm16Mask) << 16) |
                    static_cast<uint32_t>(instr5 & kImm16Mask));
-    return reinterpret_cast<Address>((hi << 32) | lo);
+    return static_cast<Address>((hi << 32) | lo);
 #else
     // Assemble the 32 bit value.
-    return reinterpret_cast<Address>(((instr1 & kImm16Mask) << 16) |
-                                     (instr2 & kImm16Mask));
+    return static_cast<Address>(((instr1 & kImm16Mask) << 16) |
+                                (instr2 & kImm16Mask));
 #endif
   }
 
@@ -388,7 +380,7 @@ int Assembler::GetConstantPoolOffset(Address pc,
 void Assembler::PatchConstantPoolAccessInstruction(
     int pc_offset, int offset, ConstantPoolEntry::Access access,
     ConstantPoolEntry::Type type) {
-  Address pc = buffer_ + pc_offset;
+  Address pc = reinterpret_cast<Address>(buffer_) + pc_offset;
   bool overflowed = (access == ConstantPoolEntry::OVERFLOWED);
   CHECK(overflowed != is_int16(offset));
 #ifdef DEBUG
@@ -436,13 +428,18 @@ Address Assembler::target_constant_pool_address_at(
 void Assembler::deserialization_set_special_target_at(
     Address instruction_payload, Code* code, Address target) {
   set_target_address_at(instruction_payload,
-                        code ? code->constant_pool() : nullptr, target);
+                        code ? code->constant_pool() : kNullAddress, target);
+}
+
+int Assembler::deserialization_special_target_size(
+    Address instruction_payload) {
+  return kSpecialTargetSize;
 }
 
 void Assembler::deserialization_set_target_internal_reference_at(
     Address pc, Address target, RelocInfo::Mode mode) {
   if (RelocInfo::IsInternalReferenceEncoded(mode)) {
-    set_target_address_at(pc, nullptr, target, SKIP_ICACHE_FLUSH);
+    set_target_address_at(pc, kNullAddress, target, SKIP_ICACHE_FLUSH);
   } else {
     Memory::Address_at(pc) = target;
   }
@@ -471,7 +468,7 @@ void Assembler::set_target_address_at(Address pc, Address constant_pool,
     Instr instr5 = instr_at(pc + (4 * kInstrSize));
     // Needs to be fixed up when mov changes to handle 64-bit values.
     uint32_t* p = reinterpret_cast<uint32_t*>(pc);
-    uintptr_t itarget = reinterpret_cast<uintptr_t>(target);
+    uintptr_t itarget = static_cast<uintptr_t>(target);
 
     instr5 &= ~kImm16Mask;
     instr5 |= itarget & kImm16Mask;
@@ -498,7 +495,7 @@ void Assembler::set_target_address_at(Address pc, Address constant_pool,
     }
 #else
     uint32_t* p = reinterpret_cast<uint32_t*>(pc);
-    uint32_t itarget = reinterpret_cast<uint32_t>(target);
+    uint32_t itarget = static_cast<uint32_t>(target);
     int lo_word = itarget & kImm16Mask;
     int hi_word = itarget >> 16;
     instr1 &= ~kImm16Mask;
diff --git a/deps/v8/src/ppc/assembler-ppc.cc b/deps/v8/src/ppc/assembler-ppc.cc
index d0a6389393b09f..f5146278a57691 100644
--- a/deps/v8/src/ppc/assembler-ppc.cc
+++ b/deps/v8/src/ppc/assembler-ppc.cc
@@ -41,6 +41,7 @@
 #include "src/base/bits.h"
 #include "src/base/cpu.h"
 #include "src/code-stubs.h"
+#include "src/deoptimizer.h"
 #include "src/macro-assembler.h"
 #include "src/ppc/assembler-ppc-inl.h"
 
@@ -141,9 +142,9 @@ Register ToRegister(int num) {
 // -----------------------------------------------------------------------------
 // Implementation of RelocInfo
 
-const int RelocInfo::kApplyMask = 1 << RelocInfo::INTERNAL_REFERENCE |
-                                  1 << RelocInfo::INTERNAL_REFERENCE_ENCODED;
-
+const int RelocInfo::kApplyMask =
+    RelocInfo::ModeMask(RelocInfo::INTERNAL_REFERENCE) |
+    RelocInfo::ModeMask(RelocInfo::INTERNAL_REFERENCE_ENCODED);
 
 bool RelocInfo::IsCodedSpecially() {
   // The deserializer needs to know whether a pointer is specially
@@ -155,40 +156,33 @@ bool RelocInfo::IsCodedSpecially() {
 
 
 bool RelocInfo::IsInConstantPool() {
-  if (FLAG_enable_embedded_constant_pool && constant_pool_ != nullptr) {
-    return (constant_pool_ && Assembler::IsConstantPoolLoadStart(pc_));
+  if (FLAG_enable_embedded_constant_pool && constant_pool_ != kNullAddress) {
+    return Assembler::IsConstantPoolLoadStart(pc_);
   }
   return false;
 }
 
-Address RelocInfo::embedded_address() const {
-  return Assembler::target_address_at(pc_, constant_pool_);
-}
-
-uint32_t RelocInfo::embedded_size() const {
-  return static_cast<uint32_t>(reinterpret_cast<intptr_t>(
-      Assembler::target_address_at(pc_, constant_pool_)));
-}
-
-void RelocInfo::set_embedded_address(Address address,
-                                     ICacheFlushMode flush_mode) {
-  Assembler::set_target_address_at(pc_, constant_pool_, address, flush_mode);
-}
-
-void RelocInfo::set_embedded_size(uint32_t size, ICacheFlushMode flush_mode) {
-  Assembler::set_target_address_at(pc_, constant_pool_,
-                                   reinterpret_cast<Address>(size), flush_mode);
+int RelocInfo::GetDeoptimizationId(Isolate* isolate, DeoptimizeKind kind) {
+  DCHECK(IsRuntimeEntry(rmode_));
+  return Deoptimizer::GetDeoptimizationId(isolate, target_address(), kind);
 }
 
 void RelocInfo::set_js_to_wasm_address(Address address,
                                        ICacheFlushMode icache_flush_mode) {
   DCHECK_EQ(rmode_, JS_TO_WASM_CALL);
-  set_embedded_address(address, icache_flush_mode);
+  Assembler::set_target_address_at(pc_, constant_pool_, address,
+                                   icache_flush_mode);
 }
 
 Address RelocInfo::js_to_wasm_address() const {
   DCHECK_EQ(rmode_, JS_TO_WASM_CALL);
-  return embedded_address();
+  return Assembler::target_address_at(pc_, constant_pool_);
+}
+
+uint32_t RelocInfo::wasm_call_tag() const {
+  DCHECK(rmode_ == WASM_CALL || rmode_ == WASM_STUB_CALL);
+  return static_cast<uint32_t>(
+      Assembler::target_address_at(pc_, constant_pool_));
 }
 
 // -----------------------------------------------------------------------------
@@ -197,7 +191,7 @@ Address RelocInfo::js_to_wasm_address() const {
 
 Operand::Operand(Handle<HeapObject> handle) {
   rm_ = no_reg;
-  value_.immediate = reinterpret_cast<intptr_t>(handle.address());
+  value_.immediate = static_cast<intptr_t>(handle.address());
   rmode_ = RelocInfo::EMBEDDED_OBJECT;
 }
 
@@ -228,16 +222,16 @@ void Assembler::AllocateAndInstallRequestedHeapObjects(Isolate* isolate) {
     Handle<HeapObject> object;
     switch (request.kind()) {
       case HeapObjectRequest::kHeapNumber:
-        object = isolate->factory()->NewHeapNumber(request.heap_number(),
-                                                   IMMUTABLE, TENURED);
+        object =
+            isolate->factory()->NewHeapNumber(request.heap_number(), TENURED);
         break;
       case HeapObjectRequest::kCodeStub:
         request.code_stub()->set_isolate(isolate);
         object = request.code_stub()->GetCode();
         break;
     }
-    Address pc = buffer_ + request.offset();
-    Address constant_pool = nullptr;
+    Address pc = reinterpret_cast<Address>(buffer_) + request.offset();
+    Address constant_pool = kNullAddress;
     set_target_address_at(pc, constant_pool,
                           reinterpret_cast<Address>(object.location()),
                           SKIP_ICACHE_FLUSH);
@@ -247,8 +241,9 @@ void Assembler::AllocateAndInstallRequestedHeapObjects(Isolate* isolate) {
 // -----------------------------------------------------------------------------
 // Specific instructions, constants, and masks.
 
-Assembler::Assembler(IsolateData isolate_data, void* buffer, int buffer_size)
-    : AssemblerBase(isolate_data, buffer, buffer_size),
+Assembler::Assembler(const AssemblerOptions& options, void* buffer,
+                     int buffer_size)
+    : AssemblerBase(options, buffer, buffer_size),
       constant_pool_builder_(kLoadPtrMaxReachBits, kLoadDoubleMaxReachBits) {
   reloc_info_writer.Reposition(buffer_ + buffer_size_, pc_);
 
@@ -504,7 +499,7 @@ void Assembler::target_at_put(int pos, int target_pos, bool* is_branch) {
       // pointer in a register.
       Register dst = Register::from_code(instr_at(pos + kInstrSize));
       int32_t offset = target_pos + (Code::kHeaderSize - kHeapObjectTag);
-      PatchingAssembler patcher(isolate_data(),
+      PatchingAssembler patcher(options(),
                                 reinterpret_cast<byte*>(buffer_ + pos), 2);
       patcher.bitwise_mov32(dst, offset);
       break;
@@ -520,7 +515,7 @@ void Assembler::target_at_put(int pos, int target_pos, bool* is_branch) {
                           : (SIGN_EXT_IMM22(operands & kImm22Mask));
       int32_t offset = target_pos + delta;
       PatchingAssembler patcher(
-          isolate_data(), reinterpret_cast<byte*>(buffer_ + pos),
+          options(), reinterpret_cast<byte*>(buffer_ + pos),
           2 + static_cast<int32_t>(opcode == kUnboundAddLabelLongOffsetOpcode));
       patcher.bitwise_add32(dst, base, offset);
       if (opcode == kUnboundAddLabelLongOffsetOpcode) patcher.nop();
@@ -529,7 +524,7 @@ void Assembler::target_at_put(int pos, int target_pos, bool* is_branch) {
     case kUnboundMovLabelAddrOpcode: {
       // Load the address of the label in a register.
       Register dst = Register::from_code(instr_at(pos + kInstrSize));
-      PatchingAssembler patcher(isolate_data(),
+      PatchingAssembler patcher(options(),
                                 reinterpret_cast<byte*>(buffer_ + pos),
                                 kMovInstructionsNoConstantPool);
       // Keep internal references relative until EmitRelocations.
@@ -537,7 +532,7 @@ void Assembler::target_at_put(int pos, int target_pos, bool* is_branch) {
       break;
     }
     case kUnboundJumpTableEntryOpcode: {
-      PatchingAssembler patcher(isolate_data(),
+      PatchingAssembler patcher(options(),
                                 reinterpret_cast<byte*>(buffer_ + pos),
                                 kPointerSize / kInstrSize);
       // Keep internal references relative until EmitRelocations.
@@ -1305,7 +1300,7 @@ void Assembler::EnsureSpaceFor(int space_needed) {
 bool Operand::must_output_reloc_info(const Assembler* assembler) const {
   if (rmode_ == RelocInfo::EXTERNAL_REFERENCE) {
     if (assembler != nullptr && assembler->predictable_code_size()) return true;
-    return assembler->serializer_enabled();
+    return assembler->options().record_reloc_info_for_serialization;
   } else if (RelocInfo::IsNone(rmode_)) {
     return false;
   }
@@ -2077,8 +2072,8 @@ void Assembler::dp(uintptr_t data) {
 void Assembler::RecordRelocInfo(RelocInfo::Mode rmode, intptr_t data) {
   if (RelocInfo::IsNone(rmode) ||
       // Don't record external references unless the heap will be serialized.
-      (rmode == RelocInfo::EXTERNAL_REFERENCE && !serializer_enabled() &&
-       !emit_debug_code())) {
+      (RelocInfo::IsOnlyForSerializer(rmode) &&
+       !options().record_reloc_info_for_serialization && !emit_debug_code())) {
     return;
   }
   DeferredRelocInfo rinfo(pc_offset(), rmode, data);
@@ -2092,18 +2087,19 @@ void Assembler::EmitRelocations() {
   for (std::vector<DeferredRelocInfo>::iterator it = relocations_.begin();
        it != relocations_.end(); it++) {
     RelocInfo::Mode rmode = it->rmode();
-    Address pc = buffer_ + it->position();
+    Address pc = reinterpret_cast<Address>(buffer_) + it->position();
     RelocInfo rinfo(pc, rmode, it->data(), nullptr);
 
     // Fix up internal references now that they are guaranteed to be bound.
     if (RelocInfo::IsInternalReference(rmode)) {
       // Jump table entry
-      intptr_t pos = reinterpret_cast<intptr_t>(Memory::Address_at(pc));
-      Memory::Address_at(pc) = buffer_ + pos;
+      intptr_t pos = static_cast<intptr_t>(Memory::Address_at(pc));
+      Memory::Address_at(pc) = reinterpret_cast<Address>(buffer_) + pos;
     } else if (RelocInfo::IsInternalReferenceEncoded(rmode)) {
       // mov sequence
-      intptr_t pos = reinterpret_cast<intptr_t>(target_address_at(pc, nullptr));
-      set_target_address_at(pc, nullptr, buffer_ + pos, SKIP_ICACHE_FLUSH);
+      intptr_t pos = static_cast<intptr_t>(target_address_at(pc, kNullAddress));
+      set_target_address_at(pc, 0, reinterpret_cast<Address>(buffer_) + pos,
+                            SKIP_ICACHE_FLUSH);
     }
 
     reloc_info_writer.Write(&rinfo);
@@ -2147,9 +2143,9 @@ void Assembler::CheckTrampolinePool() {
   }
 }
 
-PatchingAssembler::PatchingAssembler(IsolateData isolate_data, byte* address,
-                                     int instructions)
-    : Assembler(isolate_data, address, instructions * kInstrSize + kGap) {
+PatchingAssembler::PatchingAssembler(const AssemblerOptions& options,
+                                     byte* address, int instructions)
+    : Assembler(options, address, instructions * kInstrSize + kGap) {
   DCHECK_EQ(reloc_info_writer.pos(), buffer_ + buffer_size_);
 }
 
diff --git a/deps/v8/src/ppc/assembler-ppc.h b/deps/v8/src/ppc/assembler-ppc.h
index 2ba8e3879578b5..0fde450f071503 100644
--- a/deps/v8/src/ppc/assembler-ppc.h
+++ b/deps/v8/src/ppc/assembler-ppc.h
@@ -377,28 +377,28 @@ C_REGISTERS(DECLARE_C_REGISTER)
 class Operand BASE_EMBEDDED {
  public:
   // immediate
-  INLINE(explicit Operand(intptr_t immediate,
-                          RelocInfo::Mode rmode = RelocInfo::NONE)
-         : rmode_(rmode)) {
+  V8_INLINE explicit Operand(intptr_t immediate,
+                             RelocInfo::Mode rmode = RelocInfo::NONE)
+      : rmode_(rmode) {
     value_.immediate = immediate;
   }
-  INLINE(static Operand Zero()) { return Operand(static_cast<intptr_t>(0)); }
-  INLINE(explicit Operand(const ExternalReference& f)
-         : rmode_(RelocInfo::EXTERNAL_REFERENCE)) {
-    value_.immediate = reinterpret_cast<intptr_t>(f.address());
+  V8_INLINE static Operand Zero() { return Operand(static_cast<intptr_t>(0)); }
+  V8_INLINE explicit Operand(const ExternalReference& f)
+      : rmode_(RelocInfo::EXTERNAL_REFERENCE) {
+    value_.immediate = static_cast<intptr_t>(f.address());
   }
   explicit Operand(Handle<HeapObject> handle);
-  INLINE(explicit Operand(Smi* value) : rmode_(RelocInfo::NONE)) {
+  V8_INLINE explicit Operand(Smi* value) : rmode_(RelocInfo::NONE) {
     value_.immediate = reinterpret_cast<intptr_t>(value);
   }
   // rm
-  INLINE(explicit Operand(Register rm));
+  V8_INLINE explicit Operand(Register rm);
 
   static Operand EmbeddedNumber(double number);  // Smi or HeapNumber.
   static Operand EmbeddedCode(CodeStub* stub);
 
   // Return true if this is a register operand.
-  INLINE(bool is_reg() const) { return rm_.is_valid(); }
+  V8_INLINE bool is_reg() const { return rm_.is_valid(); }
 
   bool must_output_reloc_info(const Assembler* assembler) const;
 
@@ -504,9 +504,7 @@ class Assembler : public AssemblerBase {
   // buffer for code generation and assumes its size to be buffer_size. If the
   // buffer is too small, a fatal error occurs. No deallocation of the buffer is
   // done upon destruction of the assembler.
-  Assembler(Isolate* isolate, void* buffer, int buffer_size)
-      : Assembler(IsolateData(isolate), buffer, buffer_size) {}
-  Assembler(IsolateData isolate_data, void* buffer, int buffer_size);
+  Assembler(const AssemblerOptions& options, void* buffer, int buffer_size);
   virtual ~Assembler() {}
 
   // GetCode emits any pending (non-emitted) code and fills the descriptor
@@ -553,29 +551,29 @@ class Assembler : public AssemblerBase {
   // The high 8 bits are set to zero.
   void label_at_put(Label* L, int at_offset);
 
-  INLINE(static bool IsConstantPoolLoadStart(
-      Address pc, ConstantPoolEntry::Access* access = nullptr));
-  INLINE(static bool IsConstantPoolLoadEnd(
-      Address pc, ConstantPoolEntry::Access* access = nullptr));
-  INLINE(static int GetConstantPoolOffset(Address pc,
-                                          ConstantPoolEntry::Access access,
-                                          ConstantPoolEntry::Type type));
-  INLINE(void PatchConstantPoolAccessInstruction(
+  V8_INLINE static bool IsConstantPoolLoadStart(
+      Address pc, ConstantPoolEntry::Access* access = nullptr);
+  V8_INLINE static bool IsConstantPoolLoadEnd(
+      Address pc, ConstantPoolEntry::Access* access = nullptr);
+  V8_INLINE static int GetConstantPoolOffset(Address pc,
+                                             ConstantPoolEntry::Access access,
+                                             ConstantPoolEntry::Type type);
+  V8_INLINE void PatchConstantPoolAccessInstruction(
       int pc_offset, int offset, ConstantPoolEntry::Access access,
-      ConstantPoolEntry::Type type));
+      ConstantPoolEntry::Type type);
 
   // Return the address in the constant pool of the code target address used by
   // the branch/call instruction at pc, or the object in a mov.
-  INLINE(static Address target_constant_pool_address_at(
+  V8_INLINE static Address target_constant_pool_address_at(
       Address pc, Address constant_pool, ConstantPoolEntry::Access access,
-      ConstantPoolEntry::Type type));
+      ConstantPoolEntry::Type type);
 
   // Read/Modify the code target address in the branch/call instruction at pc.
   // The isolate argument is unused (and may be nullptr) when skipping flushing.
-  INLINE(static Address target_address_at(Address pc, Address constant_pool));
-  INLINE(static void set_target_address_at(
+  V8_INLINE static Address target_address_at(Address pc, Address constant_pool);
+  V8_INLINE static void set_target_address_at(
       Address pc, Address constant_pool, Address target,
-      ICacheFlushMode icache_flush_mode = FLUSH_ICACHE_IF_NEEDED));
+      ICacheFlushMode icache_flush_mode = FLUSH_ICACHE_IF_NEEDED);
 
   // Return the code target address at a call site from the return address
   // of that call in the instruction stream.
@@ -583,13 +581,17 @@ class Assembler : public AssemblerBase {
 
   // Given the address of the beginning of a call, return the address
   // in the instruction stream that the call will return to.
-  INLINE(static Address return_address_from_call_start(Address pc));
+  V8_INLINE static Address return_address_from_call_start(Address pc);
 
   // This sets the branch destination.
   // This is for calls and branches within generated code.
   inline static void deserialization_set_special_target_at(
       Address instruction_payload, Code* code, Address target);
 
+  // Get the size of the special target encoded at 'instruction_payload'.
+  inline static int deserialization_special_target_size(
+      Address instruction_payload);
+
   // This sets the internal reference at the pc.
   inline static void deserialization_set_target_internal_reference_at(
       Address pc, Address target,
@@ -1366,8 +1368,8 @@ class Assembler : public AssemblerBase {
   void instr_at_put(int pos, Instr instr) {
     *reinterpret_cast<Instr*>(buffer_ + pos) = instr;
   }
-  static Instr instr_at(byte* pc) { return *reinterpret_cast<Instr*>(pc); }
-  static void instr_at_put(byte* pc, Instr instr) {
+  static Instr instr_at(Address pc) { return *reinterpret_cast<Instr*>(pc); }
+  static void instr_at_put(Address pc, Instr instr) {
     *reinterpret_cast<Instr*>(pc) = instr;
   }
   static Condition GetCondition(Instr instr);
@@ -1452,9 +1454,9 @@ class Assembler : public AssemblerBase {
   ConstantPoolEntry::Access ConstantPoolAddEntry(RelocInfo::Mode rmode,
                                                  intptr_t value) {
     bool sharing_ok = RelocInfo::IsNone(rmode) ||
-                      !(serializer_enabled() ||
-                        rmode < RelocInfo::FIRST_SHAREABLE_RELOC_MODE ||
-                        is_constant_pool_entry_sharing_blocked());
+                      (!options().record_reloc_info_for_serialization &&
+                       RelocInfo::IsShareableRelocMode(rmode) &&
+                       !is_constant_pool_entry_sharing_blocked());
     return constant_pool_builder_.AddEntry(pc_offset(), value, sharing_ok);
   }
   ConstantPoolEntry::Access ConstantPoolAddEntry(Double value) {
@@ -1627,23 +1629,12 @@ class Assembler : public AssemblerBase {
   Trampoline trampoline_;
   bool internal_trampoline_exception_;
 
+  void AllocateAndInstallRequestedHeapObjects(Isolate* isolate);
+
   friend class RegExpMacroAssemblerPPC;
   friend class RelocInfo;
   friend class BlockTrampolinePoolScope;
   friend class EnsureSpace;
-
-  // The following functions help with avoiding allocations of embedded heap
-  // objects during the code assembly phase. {RequestHeapObject} records the
-  // need for a future heap number allocation or code stub generation. After
-  // code assembly, {AllocateAndInstallRequestedHeapObjects} will allocate these
-  // objects and place them where they are expected (determined by the pc offset
-  // associated with each request). That is, for each request, it will patch the
-  // dummy heap object handle that we emitted during code assembly with the
-  // actual heap object handle.
-  void RequestHeapObject(HeapObjectRequest request);
-  void AllocateAndInstallRequestedHeapObjects(Isolate* isolate);
-
-  std::forward_list<HeapObjectRequest> heap_object_requests_;
 };
 
 
@@ -1654,7 +1645,8 @@ class EnsureSpace BASE_EMBEDDED {
 
 class PatchingAssembler : public Assembler {
  public:
-  PatchingAssembler(IsolateData isolate_data, byte* address, int instructions);
+  PatchingAssembler(const AssemblerOptions& options, byte* address,
+                    int instructions);
   ~PatchingAssembler();
 };
 
diff --git a/deps/v8/src/ppc/code-stubs-ppc.cc b/deps/v8/src/ppc/code-stubs-ppc.cc
index 9fd9d4d87ec4c6..f4c286fdc7d47d 100644
--- a/deps/v8/src/ppc/code-stubs-ppc.cc
+++ b/deps/v8/src/ppc/code-stubs-ppc.cc
@@ -15,6 +15,7 @@
 #include "src/ic/ic.h"
 #include "src/ic/stub-cache.h"
 #include "src/isolate.h"
+#include "src/objects/api-callbacks.h"
 #include "src/regexp/jsregexp.h"
 #include "src/regexp/regexp-macro-assembler.h"
 #include "src/runtime/runtime.h"
@@ -26,434 +27,6 @@ namespace internal {
 
 #define __ ACCESS_MASM(masm)
 
-void ArrayNArgumentsConstructorStub::Generate(MacroAssembler* masm) {
-  __ ShiftLeftImm(r0, r3, Operand(kPointerSizeLog2));
-  __ StorePX(r4, MemOperand(sp, r0));
-  __ push(r4);
-  __ push(r5);
-  __ addi(r3, r3, Operand(3));
-  __ TailCallRuntime(Runtime::kNewArray);
-}
-
-
-void DoubleToIStub::Generate(MacroAssembler* masm) {
-  Label out_of_range, only_low, negate, done, fastpath_done;
-  Register result_reg = destination();
-
-  // Immediate values for this stub fit in instructions, so it's safe to use ip.
-  Register scratch = GetRegisterThatIsNotOneOf(result_reg);
-  Register scratch_low = GetRegisterThatIsNotOneOf(result_reg, scratch);
-  Register scratch_high =
-      GetRegisterThatIsNotOneOf(result_reg, scratch, scratch_low);
-  DoubleRegister double_scratch = kScratchDoubleReg;
-
-  __ push(scratch);
-  // Account for saved regs.
-  int argument_offset = 1 * kPointerSize;
-
-  // Load double input.
-  __ lfd(double_scratch, MemOperand(sp, argument_offset));
-
-  // Do fast-path convert from double to int.
-  __ ConvertDoubleToInt64(double_scratch,
-#if !V8_TARGET_ARCH_PPC64
-                          scratch,
-#endif
-                          result_reg, d0);
-
-// Test for overflow
-#if V8_TARGET_ARCH_PPC64
-  __ TestIfInt32(result_reg, r0);
-#else
-  __ TestIfInt32(scratch, result_reg, r0);
-#endif
-  __ beq(&fastpath_done);
-
-  __ Push(scratch_high, scratch_low);
-  // Account for saved regs.
-  argument_offset += 2 * kPointerSize;
-
-  __ lwz(scratch_high,
-         MemOperand(sp, argument_offset + Register::kExponentOffset));
-  __ lwz(scratch_low,
-         MemOperand(sp, argument_offset + Register::kMantissaOffset));
-
-  __ ExtractBitMask(scratch, scratch_high, HeapNumber::kExponentMask);
-  // Load scratch with exponent - 1. This is faster than loading
-  // with exponent because Bias + 1 = 1024 which is a *PPC* immediate value.
-  STATIC_ASSERT(HeapNumber::kExponentBias + 1 == 1024);
-  __ subi(scratch, scratch, Operand(HeapNumber::kExponentBias + 1));
-  // If exponent is greater than or equal to 84, the 32 less significant
-  // bits are 0s (2^84 = 1, 52 significant bits, 32 uncoded bits),
-  // the result is 0.
-  // Compare exponent with 84 (compare exponent - 1 with 83).
-  __ cmpi(scratch, Operand(83));
-  __ bge(&out_of_range);
-
-  // If we reach this code, 31 <= exponent <= 83.
-  // So, we don't have to handle cases where 0 <= exponent <= 20 for
-  // which we would need to shift right the high part of the mantissa.
-  // Scratch contains exponent - 1.
-  // Load scratch with 52 - exponent (load with 51 - (exponent - 1)).
-  __ subfic(scratch, scratch, Operand(51));
-  __ cmpi(scratch, Operand::Zero());
-  __ ble(&only_low);
-  // 21 <= exponent <= 51, shift scratch_low and scratch_high
-  // to generate the result.
-  __ srw(scratch_low, scratch_low, scratch);
-  // Scratch contains: 52 - exponent.
-  // We needs: exponent - 20.
-  // So we use: 32 - scratch = 32 - 52 + exponent = exponent - 20.
-  __ subfic(scratch, scratch, Operand(32));
-  __ ExtractBitMask(result_reg, scratch_high, HeapNumber::kMantissaMask);
-  // Set the implicit 1 before the mantissa part in scratch_high.
-  STATIC_ASSERT(HeapNumber::kMantissaBitsInTopWord >= 16);
-  __ oris(result_reg, result_reg,
-          Operand(1 << ((HeapNumber::kMantissaBitsInTopWord) - 16)));
-  __ slw(r0, result_reg, scratch);
-  __ orx(result_reg, scratch_low, r0);
-  __ b(&negate);
-
-  __ bind(&out_of_range);
-  __ mov(result_reg, Operand::Zero());
-  __ b(&done);
-
-  __ bind(&only_low);
-  // 52 <= exponent <= 83, shift only scratch_low.
-  // On entry, scratch contains: 52 - exponent.
-  __ neg(scratch, scratch);
-  __ slw(result_reg, scratch_low, scratch);
-
-  __ bind(&negate);
-  // If input was positive, scratch_high ASR 31 equals 0 and
-  // scratch_high LSR 31 equals zero.
-  // New result = (result eor 0) + 0 = result.
-  // If the input was negative, we have to negate the result.
-  // Input_high ASR 31 equals 0xFFFFFFFF and scratch_high LSR 31 equals 1.
-  // New result = (result eor 0xFFFFFFFF) + 1 = 0 - result.
-  __ srawi(r0, scratch_high, 31);
-#if V8_TARGET_ARCH_PPC64
-  __ srdi(r0, r0, Operand(32));
-#endif
-  __ xor_(result_reg, result_reg, r0);
-  __ srwi(r0, scratch_high, Operand(31));
-  __ add(result_reg, result_reg, r0);
-
-  __ bind(&done);
-  __ Pop(scratch_high, scratch_low);
-
-  __ bind(&fastpath_done);
-  __ pop(scratch);
-
-  __ Ret();
-}
-
-void MathPowStub::Generate(MacroAssembler* masm) {
-  const Register exponent = MathPowTaggedDescriptor::exponent();
-  DCHECK(exponent == r5);
-  const DoubleRegister double_base = d1;
-  const DoubleRegister double_exponent = d2;
-  const DoubleRegister double_result = d3;
-  const DoubleRegister double_scratch = d0;
-  const Register scratch = r11;
-  const Register scratch2 = r10;
-
-  Label call_runtime, done, int_exponent;
-
-  // Detect integer exponents stored as double.
-  __ TryDoubleToInt32Exact(scratch, double_exponent, scratch2, double_scratch);
-  __ beq(&int_exponent);
-
-  __ mflr(r0);
-  __ push(r0);
-  {
-    AllowExternalCallThatCantCauseGC scope(masm);
-    __ PrepareCallCFunction(0, 2, scratch);
-    __ MovToFloatParameters(double_base, double_exponent);
-    __ CallCFunction(ExternalReference::power_double_double_function(isolate()),
-                     0, 2);
-  }
-  __ pop(r0);
-  __ mtlr(r0);
-  __ MovFromFloatResult(double_result);
-  __ b(&done);
-
-  // Calculate power with integer exponent.
-  __ bind(&int_exponent);
-
-  // Get two copies of exponent in the registers scratch and exponent.
-  // Exponent has previously been stored into scratch as untagged integer.
-  __ mr(exponent, scratch);
-
-  __ fmr(double_scratch, double_base);  // Back up base.
-  __ li(scratch2, Operand(1));
-  __ ConvertIntToDouble(scratch2, double_result);
-
-  // Get absolute value of exponent.
-  __ cmpi(scratch, Operand::Zero());
-  if (CpuFeatures::IsSupported(ISELECT)) {
-    __ neg(scratch2, scratch);
-    __ isel(lt, scratch, scratch2, scratch);
-  } else {
-    Label positive_exponent;
-    __ bge(&positive_exponent);
-    __ neg(scratch, scratch);
-    __ bind(&positive_exponent);
-  }
-
-  Label while_true, no_carry, loop_end;
-  __ bind(&while_true);
-  __ andi(scratch2, scratch, Operand(1));
-  __ beq(&no_carry, cr0);
-  __ fmul(double_result, double_result, double_scratch);
-  __ bind(&no_carry);
-  __ ShiftRightImm(scratch, scratch, Operand(1), SetRC);
-  __ beq(&loop_end, cr0);
-  __ fmul(double_scratch, double_scratch, double_scratch);
-  __ b(&while_true);
-  __ bind(&loop_end);
-
-  __ cmpi(exponent, Operand::Zero());
-  __ bge(&done);
-
-  __ li(scratch2, Operand(1));
-  __ ConvertIntToDouble(scratch2, double_scratch);
-  __ fdiv(double_result, double_scratch, double_result);
-  // Test whether result is zero.  Bail out to check for subnormal result.
-  // Due to subnormals, x^-y == (1/x)^y does not hold in all cases.
-  __ fcmpu(double_result, kDoubleRegZero);
-  __ bne(&done);
-  // double_exponent may not containe the exponent value if the input was a
-  // smi.  We set it with exponent value before bailing out.
-  __ ConvertIntToDouble(exponent, double_exponent);
-
-  // Returning or bailing out.
-  __ mflr(r0);
-  __ push(r0);
-  {
-    AllowExternalCallThatCantCauseGC scope(masm);
-    __ PrepareCallCFunction(0, 2, scratch);
-    __ MovToFloatParameters(double_base, double_exponent);
-    __ CallCFunction(
-        ExternalReference::power_double_double_function(isolate()), 0, 2);
-  }
-  __ pop(r0);
-  __ mtlr(r0);
-  __ MovFromFloatResult(double_result);
-
-  __ bind(&done);
-  __ Ret();
-}
-
-Movability CEntryStub::NeedsImmovableCode() { return kImmovable; }
-
-void CodeStub::GenerateStubsAheadOfTime(Isolate* isolate) {
-  CEntryStub::GenerateAheadOfTime(isolate);
-  CommonArrayConstructorStub::GenerateStubsAheadOfTime(isolate);
-  StoreFastElementStub::GenerateAheadOfTime(isolate);
-}
-
-
-void CodeStub::GenerateFPStubs(Isolate* isolate) {
-  // Generate if not already in cache.
-  SaveFPRegsMode mode = kSaveFPRegs;
-  CEntryStub(isolate, 1, mode).GetCode();
-}
-
-
-void CEntryStub::GenerateAheadOfTime(Isolate* isolate) {
-  CEntryStub stub(isolate, 1, kDontSaveFPRegs);
-  stub.GetCode();
-  CEntryStub save_doubles(isolate, 1, kSaveFPRegs);
-  save_doubles.GetCode();
-}
-
-
-void CEntryStub::Generate(MacroAssembler* masm) {
-  // Called from JavaScript; parameters are on stack as if calling JS function.
-  // r3: number of arguments including receiver
-  // r4: pointer to builtin function
-  // fp: frame pointer  (restored after C call)
-  // sp: stack pointer  (restored as callee's sp after C call)
-  // cp: current context  (C callee-saved)
-  //
-  // If argv_in_register():
-  // r5: pointer to the first argument
-  ProfileEntryHookStub::MaybeCallEntryHook(masm);
-
-  __ mr(r15, r4);
-
-  if (argv_in_register()) {
-    // Move argv into the correct register.
-    __ mr(r4, r5);
-  } else {
-    // Compute the argv pointer.
-    __ ShiftLeftImm(r4, r3, Operand(kPointerSizeLog2));
-    __ add(r4, r4, sp);
-    __ subi(r4, r4, Operand(kPointerSize));
-  }
-
-  // Enter the exit frame that transitions from JavaScript to C++.
-  FrameScope scope(masm, StackFrame::MANUAL);
-
-  // Need at least one extra slot for return address location.
-  int arg_stack_space = 1;
-
-  // Pass buffer for return value on stack if necessary
-  bool needs_return_buffer =
-      (result_size() == 2 && !ABI_RETURNS_OBJECT_PAIRS_IN_REGS);
-  if (needs_return_buffer) {
-    arg_stack_space += result_size();
-  }
-
-  __ EnterExitFrame(save_doubles(), arg_stack_space, is_builtin_exit()
-                                           ? StackFrame::BUILTIN_EXIT
-                                           : StackFrame::EXIT);
-
-  // Store a copy of argc in callee-saved registers for later.
-  __ mr(r14, r3);
-
-  // r3, r14: number of arguments including receiver  (C callee-saved)
-  // r4: pointer to the first argument
-  // r15: pointer to builtin function  (C callee-saved)
-
-  // Result returned in registers or stack, depending on result size and ABI.
-
-  Register isolate_reg = r5;
-  if (needs_return_buffer) {
-    // The return value is a non-scalar value.
-    // Use frame storage reserved by calling function to pass return
-    // buffer as implicit first argument.
-    __ mr(r5, r4);
-    __ mr(r4, r3);
-    __ addi(r3, sp, Operand((kStackFrameExtraParamSlot + 1) * kPointerSize));
-    isolate_reg = r6;
-  }
-
-  // Call C built-in.
-  __ mov(isolate_reg, Operand(ExternalReference::isolate_address(isolate())));
-
-  Register target = r15;
-  if (ABI_USES_FUNCTION_DESCRIPTORS) {
-    // AIX/PPC64BE Linux use a function descriptor.
-    __ LoadP(ToRegister(ABI_TOC_REGISTER), MemOperand(r15, kPointerSize));
-    __ LoadP(ip, MemOperand(r15, 0));  // Instruction address
-    target = ip;
-  } else if (ABI_CALL_VIA_IP) {
-    __ Move(ip, r15);
-    target = ip;
-  }
-
-  // To let the GC traverse the return address of the exit frames, we need to
-  // know where the return address is. The CEntryStub is unmovable, so
-  // we can store the address on the stack to be able to find it again and
-  // we never have to restore it, because it will not change.
-  Label after_call;
-  __ mov_label_addr(r0, &after_call);
-  __ StoreP(r0, MemOperand(sp, kStackFrameExtraParamSlot * kPointerSize));
-  __ Call(target);
-  __ bind(&after_call);
-
-  // If return value is on the stack, pop it to registers.
-  if (needs_return_buffer) {
-    __ LoadP(r4, MemOperand(r3, kPointerSize));
-    __ LoadP(r3, MemOperand(r3));
-  }
-
-  // Check result for exception sentinel.
-  Label exception_returned;
-  __ CompareRoot(r3, Heap::kExceptionRootIndex);
-  __ beq(&exception_returned);
-
-  // Check that there is no pending exception, otherwise we
-  // should have returned the exception sentinel.
-  if (FLAG_debug_code) {
-    Label okay;
-    ExternalReference pending_exception_address(
-        IsolateAddressId::kPendingExceptionAddress, isolate());
-
-    __ mov(r6, Operand(pending_exception_address));
-    __ LoadP(r6, MemOperand(r6));
-    __ CompareRoot(r6, Heap::kTheHoleValueRootIndex);
-    // Cannot use check here as it attempts to generate call into runtime.
-    __ beq(&okay);
-    __ stop("Unexpected pending exception");
-    __ bind(&okay);
-  }
-
-  // Exit C frame and return.
-  // r3:r4: result
-  // sp: stack pointer
-  // fp: frame pointer
-  Register argc = argv_in_register()
-                      // We don't want to pop arguments so set argc to no_reg.
-                      ? no_reg
-                      // r14: still holds argc (callee-saved).
-                      : r14;
-  __ LeaveExitFrame(save_doubles(), argc);
-  __ blr();
-
-  // Handling of exception.
-  __ bind(&exception_returned);
-
-  ExternalReference pending_handler_context_address(
-      IsolateAddressId::kPendingHandlerContextAddress, isolate());
-  ExternalReference pending_handler_entrypoint_address(
-      IsolateAddressId::kPendingHandlerEntrypointAddress, isolate());
-  ExternalReference pending_handler_constant_pool_address(
-      IsolateAddressId::kPendingHandlerConstantPoolAddress, isolate());
-  ExternalReference pending_handler_fp_address(
-      IsolateAddressId::kPendingHandlerFPAddress, isolate());
-  ExternalReference pending_handler_sp_address(
-      IsolateAddressId::kPendingHandlerSPAddress, isolate());
-
-  // Ask the runtime for help to determine the handler. This will set r3 to
-  // contain the current pending exception, don't clobber it.
-  ExternalReference find_handler(Runtime::kUnwindAndFindExceptionHandler,
-                                 isolate());
-  {
-    FrameScope scope(masm, StackFrame::MANUAL);
-    __ PrepareCallCFunction(3, 0, r3);
-    __ li(r3, Operand::Zero());
-    __ li(r4, Operand::Zero());
-    __ mov(r5, Operand(ExternalReference::isolate_address(isolate())));
-    __ CallCFunction(find_handler, 3);
-  }
-
-  // Retrieve the handler context, SP and FP.
-  __ mov(cp, Operand(pending_handler_context_address));
-  __ LoadP(cp, MemOperand(cp));
-  __ mov(sp, Operand(pending_handler_sp_address));
-  __ LoadP(sp, MemOperand(sp));
-  __ mov(fp, Operand(pending_handler_fp_address));
-  __ LoadP(fp, MemOperand(fp));
-
-  // If the handler is a JS frame, restore the context to the frame. Note that
-  // the context will be set to (cp == 0) for non-JS frames.
-  Label skip;
-  __ cmpi(cp, Operand::Zero());
-  __ beq(&skip);
-  __ StoreP(cp, MemOperand(fp, StandardFrameConstants::kContextOffset));
-  __ bind(&skip);
-
-  // Reset the masking register.
-  if (FLAG_branch_load_poisoning) {
-    __ ResetSpeculationPoisonRegister();
-  }
-
-  // Compute the handler entry address and jump to it.
-  ConstantPoolUnavailableScope constant_pool_unavailable(masm);
-  __ mov(ip, Operand(pending_handler_entrypoint_address));
-  __ LoadP(ip, MemOperand(ip));
-  if (FLAG_enable_embedded_constant_pool) {
-    __ mov(kConstantPoolRegister,
-           Operand(pending_handler_constant_pool_address));
-    __ LoadP(kConstantPoolRegister, MemOperand(kConstantPoolRegister));
-  }
-  __ Jump(ip);
-}
-
-
 void JSEntryStub::Generate(MacroAssembler* masm) {
   // r3: code entry
   // r4: function
@@ -466,22 +39,25 @@ void JSEntryStub::Generate(MacroAssembler* masm) {
 // Called from C
   __ function_descriptor();
 
-  ProfileEntryHookStub::MaybeCallEntryHook(masm);
+  {
+    NoRootArrayScope no_root_array(masm);
+    ProfileEntryHookStub::MaybeCallEntryHook(masm);
 
-  // PPC LINUX ABI:
-  // preserve LR in pre-reserved slot in caller's frame
-  __ mflr(r0);
-  __ StoreP(r0, MemOperand(sp, kStackFrameLRSlot * kPointerSize));
+    // PPC LINUX ABI:
+    // preserve LR in pre-reserved slot in caller's frame
+    __ mflr(r0);
+    __ StoreP(r0, MemOperand(sp, kStackFrameLRSlot * kPointerSize));
 
-  // Save callee saved registers on the stack.
-  __ MultiPush(kCalleeSaved);
+    // Save callee saved registers on the stack.
+    __ MultiPush(kCalleeSaved);
 
-  // Save callee-saved double registers.
-  __ MultiPushDoubles(kCalleeSavedDoubles);
-  // Set up the reserved register for 0.0.
-  __ LoadDoubleLiteral(kDoubleRegZero, Double(0.0), r0);
+    // Save callee-saved double registers.
+    __ MultiPushDoubles(kCalleeSavedDoubles);
+    // Set up the reserved register for 0.0.
+    __ LoadDoubleLiteral(kDoubleRegZero, Double(0.0), r0);
 
-  __ InitializeRootRegister();
+    __ InitializeRootRegister();
+  }
 
   // Push a frame with special values setup to mark it as an entry frame.
   // r3: code entry
@@ -500,8 +76,8 @@ void JSEntryStub::Generate(MacroAssembler* masm) {
   __ push(r0);
   __ push(r0);
   // Save copies of the top frame descriptor on the stack.
-  __ mov(r8, Operand(ExternalReference(IsolateAddressId::kCEntryFPAddress,
-                                       isolate())));
+  __ mov(r8, Operand(ExternalReference::Create(
+                 IsolateAddressId::kCEntryFPAddress, isolate())));
   __ LoadP(r0, MemOperand(r8));
   __ push(r0);
 
@@ -510,8 +86,9 @@ void JSEntryStub::Generate(MacroAssembler* masm) {
 
   // If this is the outermost JS call, set js_entry_sp value.
   Label non_outermost_js;
-  ExternalReference js_entry_sp(IsolateAddressId::kJSEntrySPAddress, isolate());
-  __ mov(r8, Operand(ExternalReference(js_entry_sp)));
+  ExternalReference js_entry_sp =
+      ExternalReference::Create(IsolateAddressId::kJSEntrySPAddress, isolate());
+  __ mov(r8, Operand(js_entry_sp));
   __ LoadP(r9, MemOperand(r8));
   __ cmpi(r9, Operand::Zero());
   __ bne(&non_outermost_js);
@@ -534,7 +111,7 @@ void JSEntryStub::Generate(MacroAssembler* masm) {
   // field in the JSEnv and return a failure sentinel.  Coming in here the
   // fp will be invalid because the PushStackHandler below sets it to 0 to
   // signal the existence of the JSEntry frame.
-  __ mov(ip, Operand(ExternalReference(
+  __ mov(ip, Operand(ExternalReference::Create(
                  IsolateAddressId::kPendingExceptionAddress, isolate())));
 
   __ StoreP(r3, MemOperand(ip));
@@ -572,14 +149,14 @@ void JSEntryStub::Generate(MacroAssembler* masm) {
   __ cmpi(r8, Operand(StackFrame::OUTERMOST_JSENTRY_FRAME));
   __ bne(&non_outermost_js_2);
   __ mov(r9, Operand::Zero());
-  __ mov(r8, Operand(ExternalReference(js_entry_sp)));
+  __ mov(r8, Operand(js_entry_sp));
   __ StoreP(r9, MemOperand(r8));
   __ bind(&non_outermost_js_2);
 
   // Restore the top frame descriptors from the stack.
   __ pop(r6);
-  __ mov(ip, Operand(ExternalReference(IsolateAddressId::kCEntryFPAddress,
-                                       isolate())));
+  __ mov(ip, Operand(ExternalReference::Create(
+                 IsolateAddressId::kCEntryFPAddress, isolate())));
   __ StoreP(r6, MemOperand(ip));
 
   // Reset the stack to the callee saved registers.
@@ -611,6 +188,19 @@ void DirectCEntryStub::Generate(MacroAssembler* masm) {
 
 
 void DirectCEntryStub::GenerateCall(MacroAssembler* masm, Register target) {
+  if (FLAG_embedded_builtins) {
+    if (masm->root_array_available() &&
+        isolate()->ShouldLoadConstantsFromRootList()) {
+      // This is basically an inlined version of Call(Handle<Code>) that loads
+      // the code object into lr instead of ip.
+      DCHECK_NE(ip, target);
+      __ IndirectLoadConstant(ip, GetCode());
+      __ addi(r0, ip, Operand(Code::kHeaderSize - kHeapObjectTag));
+      __ Move(ip, target);
+      __ Call(r0);
+      return;
+    }
+  }
   if (ABI_USES_FUNCTION_DESCRIPTORS) {
     // AIX/PPC64BE Linux use a function descriptor.
     __ LoadP(ToRegister(ABI_TOC_REGISTER), MemOperand(target, kPointerSize));
@@ -700,8 +290,8 @@ void ProfileEntryHookStub::Generate(MacroAssembler* masm) {
   // Under the simulator we need to indirect the entry hook through a
   // trampoline function at a known address.
   ApiFunction dispatcher(FUNCTION_ADDR(EntryHookTrampoline));
-  ExternalReference entry_hook = ExternalReference(
-      &dispatcher, ExternalReference::BUILTIN_CALL, isolate());
+  ExternalReference entry_hook =
+      ExternalReference::Create(&dispatcher, ExternalReference::BUILTIN_CALL);
 
   // It additionally takes an isolate as a third parameter
   __ mov(r5, Operand(ExternalReference::isolate_address(isolate())));
@@ -734,280 +324,6 @@ void ProfileEntryHookStub::Generate(MacroAssembler* masm) {
   __ Ret();
 }
 
-
-template <class T>
-static void CreateArrayDispatch(MacroAssembler* masm,
-                                AllocationSiteOverrideMode mode) {
-  if (mode == DISABLE_ALLOCATION_SITES) {
-    T stub(masm->isolate(), GetInitialFastElementsKind(), mode);
-    __ TailCallStub(&stub);
-  } else if (mode == DONT_OVERRIDE) {
-    int last_index =
-        GetSequenceIndexFromFastElementsKind(TERMINAL_FAST_ELEMENTS_KIND);
-    for (int i = 0; i <= last_index; ++i) {
-      ElementsKind kind = GetFastElementsKindFromSequenceIndex(i);
-      __ Cmpi(r6, Operand(kind), r0);
-      T stub(masm->isolate(), kind);
-      __ TailCallStub(&stub, eq);
-    }
-
-    // If we reached this point there is a problem.
-    __ Abort(AbortReason::kUnexpectedElementsKindInArrayConstructor);
-  } else {
-    UNREACHABLE();
-  }
-}
-
-
-static void CreateArrayDispatchOneArgument(MacroAssembler* masm,
-                                           AllocationSiteOverrideMode mode) {
-  // r5 - allocation site (if mode != DISABLE_ALLOCATION_SITES)
-  // r6 - kind (if mode != DISABLE_ALLOCATION_SITES)
-  // r3 - number of arguments
-  // r4 - constructor?
-  // sp[0] - last argument
-  STATIC_ASSERT(PACKED_SMI_ELEMENTS == 0);
-  STATIC_ASSERT(HOLEY_SMI_ELEMENTS == 1);
-  STATIC_ASSERT(PACKED_ELEMENTS == 2);
-  STATIC_ASSERT(HOLEY_ELEMENTS == 3);
-  STATIC_ASSERT(PACKED_DOUBLE_ELEMENTS == 4);
-  STATIC_ASSERT(HOLEY_DOUBLE_ELEMENTS == 5);
-
-  if (mode == DISABLE_ALLOCATION_SITES) {
-    ElementsKind initial = GetInitialFastElementsKind();
-    ElementsKind holey_initial = GetHoleyElementsKind(initial);
-
-    ArraySingleArgumentConstructorStub stub_holey(
-        masm->isolate(), holey_initial, DISABLE_ALLOCATION_SITES);
-    __ TailCallStub(&stub_holey);
-  } else if (mode == DONT_OVERRIDE) {
-    // is the low bit set? If so, we are holey and that is good.
-    Label normal_sequence;
-    __ andi(r0, r6, Operand(1));
-    __ bne(&normal_sequence, cr0);
-
-    // We are going to create a holey array, but our kind is non-holey.
-    // Fix kind and retry (only if we have an allocation site in the slot).
-    __ addi(r6, r6, Operand(1));
-
-    if (FLAG_debug_code) {
-      __ LoadP(r8, FieldMemOperand(r5, 0));
-      __ CompareRoot(r8, Heap::kAllocationSiteMapRootIndex);
-      __ Assert(eq, AbortReason::kExpectedAllocationSite);
-    }
-
-    // Save the resulting elements kind in type info. We can't just store r6
-    // in the AllocationSite::transition_info field because elements kind is
-    // restricted to a portion of the field...upper bits need to be left alone.
-    STATIC_ASSERT(AllocationSite::ElementsKindBits::kShift == 0);
-    __ LoadP(r7, FieldMemOperand(
-                     r5, AllocationSite::kTransitionInfoOrBoilerplateOffset));
-    __ AddSmiLiteral(r7, r7, Smi::FromInt(kFastElementsKindPackedToHoley), r0);
-    __ StoreP(
-        r7,
-        FieldMemOperand(r5, AllocationSite::kTransitionInfoOrBoilerplateOffset),
-        r0);
-
-    __ bind(&normal_sequence);
-    int last_index =
-        GetSequenceIndexFromFastElementsKind(TERMINAL_FAST_ELEMENTS_KIND);
-    for (int i = 0; i <= last_index; ++i) {
-      ElementsKind kind = GetFastElementsKindFromSequenceIndex(i);
-      __ mov(r0, Operand(kind));
-      __ cmp(r6, r0);
-      ArraySingleArgumentConstructorStub stub(masm->isolate(), kind);
-      __ TailCallStub(&stub, eq);
-    }
-
-    // If we reached this point there is a problem.
-    __ Abort(AbortReason::kUnexpectedElementsKindInArrayConstructor);
-  } else {
-    UNREACHABLE();
-  }
-}
-
-
-template <class T>
-static void ArrayConstructorStubAheadOfTimeHelper(Isolate* isolate) {
-  int to_index =
-      GetSequenceIndexFromFastElementsKind(TERMINAL_FAST_ELEMENTS_KIND);
-  for (int i = 0; i <= to_index; ++i) {
-    ElementsKind kind = GetFastElementsKindFromSequenceIndex(i);
-    T stub(isolate, kind);
-    stub.GetCode();
-    if (AllocationSite::ShouldTrack(kind)) {
-      T stub1(isolate, kind, DISABLE_ALLOCATION_SITES);
-      stub1.GetCode();
-    }
-  }
-}
-
-
-void CommonArrayConstructorStub::GenerateStubsAheadOfTime(Isolate* isolate) {
-  ArrayConstructorStubAheadOfTimeHelper<ArrayNoArgumentConstructorStub>(
-      isolate);
-  ArrayNArgumentsConstructorStub stub(isolate);
-  stub.GetCode();
-  ElementsKind kinds[2] = {PACKED_ELEMENTS, HOLEY_ELEMENTS};
-  for (int i = 0; i < 2; i++) {
-    // For internal arrays we only need a few things
-    InternalArrayNoArgumentConstructorStub stubh1(isolate, kinds[i]);
-    stubh1.GetCode();
-    InternalArraySingleArgumentConstructorStub stubh2(isolate, kinds[i]);
-    stubh2.GetCode();
-  }
-}
-
-
-void ArrayConstructorStub::GenerateDispatchToArrayStub(
-    MacroAssembler* masm, AllocationSiteOverrideMode mode) {
-  Label not_zero_case, not_one_case;
-  __ cmpi(r3, Operand::Zero());
-  __ bne(&not_zero_case);
-  CreateArrayDispatch<ArrayNoArgumentConstructorStub>(masm, mode);
-
-  __ bind(&not_zero_case);
-  __ cmpi(r3, Operand(1));
-  __ bgt(&not_one_case);
-  CreateArrayDispatchOneArgument(masm, mode);
-
-  __ bind(&not_one_case);
-  ArrayNArgumentsConstructorStub stub(masm->isolate());
-  __ TailCallStub(&stub);
-}
-
-
-void ArrayConstructorStub::Generate(MacroAssembler* masm) {
-  // ----------- S t a t e -------------
-  //  -- r3 : argc (only if argument_count() == ANY)
-  //  -- r4 : constructor
-  //  -- r5 : AllocationSite or undefined
-  //  -- r6 : new target
-  //  -- sp[0] : return address
-  //  -- sp[4] : last argument
-  // -----------------------------------
-
-  if (FLAG_debug_code) {
-    // The array construct code is only set for the global and natives
-    // builtin Array functions which always have maps.
-
-    // Initial map for the builtin Array function should be a map.
-    __ LoadP(r7, FieldMemOperand(r4, JSFunction::kPrototypeOrInitialMapOffset));
-    // Will both indicate a nullptr and a Smi.
-    __ TestIfSmi(r7, r0);
-    __ Assert(ne, AbortReason::kUnexpectedInitialMapForArrayFunction, cr0);
-    __ CompareObjectType(r7, r7, r8, MAP_TYPE);
-    __ Assert(eq, AbortReason::kUnexpectedInitialMapForArrayFunction);
-
-    // We should either have undefined in r5 or a valid AllocationSite
-    __ AssertUndefinedOrAllocationSite(r5, r7);
-  }
-
-  // Enter the context of the Array function.
-  __ LoadP(cp, FieldMemOperand(r4, JSFunction::kContextOffset));
-
-  Label subclassing;
-  __ cmp(r6, r4);
-  __ bne(&subclassing);
-
-  Label no_info;
-  // Get the elements kind and case on that.
-  __ CompareRoot(r5, Heap::kUndefinedValueRootIndex);
-  __ beq(&no_info);
-
-  __ LoadP(r6, FieldMemOperand(
-                   r5, AllocationSite::kTransitionInfoOrBoilerplateOffset));
-  __ SmiUntag(r6);
-  STATIC_ASSERT(AllocationSite::ElementsKindBits::kShift == 0);
-  __ And(r6, r6, Operand(AllocationSite::ElementsKindBits::kMask));
-  GenerateDispatchToArrayStub(masm, DONT_OVERRIDE);
-
-  __ bind(&no_info);
-  GenerateDispatchToArrayStub(masm, DISABLE_ALLOCATION_SITES);
-
-  __ bind(&subclassing);
-  __ ShiftLeftImm(r0, r3, Operand(kPointerSizeLog2));
-  __ StorePX(r4, MemOperand(sp, r0));
-  __ addi(r3, r3, Operand(3));
-  __ Push(r6, r5);
-  __ JumpToExternalReference(ExternalReference(Runtime::kNewArray, isolate()));
-}
-
-
-void InternalArrayConstructorStub::GenerateCase(MacroAssembler* masm,
-                                                ElementsKind kind) {
-  __ cmpli(r3, Operand(1));
-
-  InternalArrayNoArgumentConstructorStub stub0(isolate(), kind);
-  __ TailCallStub(&stub0, lt);
-
-  ArrayNArgumentsConstructorStub stubN(isolate());
-  __ TailCallStub(&stubN, gt);
-
-  if (IsFastPackedElementsKind(kind)) {
-    // We might need to create a holey array
-    // look at the first argument
-    __ LoadP(r6, MemOperand(sp, 0));
-    __ cmpi(r6, Operand::Zero());
-
-    InternalArraySingleArgumentConstructorStub stub1_holey(
-        isolate(), GetHoleyElementsKind(kind));
-    __ TailCallStub(&stub1_holey, ne);
-  }
-
-  InternalArraySingleArgumentConstructorStub stub1(isolate(), kind);
-  __ TailCallStub(&stub1);
-}
-
-
-void InternalArrayConstructorStub::Generate(MacroAssembler* masm) {
-  // ----------- S t a t e -------------
-  //  -- r3 : argc
-  //  -- r4 : constructor
-  //  -- sp[0] : return address
-  //  -- sp[4] : last argument
-  // -----------------------------------
-
-  if (FLAG_debug_code) {
-    // The array construct code is only set for the global and natives
-    // builtin Array functions which always have maps.
-
-    // Initial map for the builtin Array function should be a map.
-    __ LoadP(r6, FieldMemOperand(r4, JSFunction::kPrototypeOrInitialMapOffset));
-    // Will both indicate a nullptr and a Smi.
-    __ TestIfSmi(r6, r0);
-    __ Assert(ne, AbortReason::kUnexpectedInitialMapForArrayFunction, cr0);
-    __ CompareObjectType(r6, r6, r7, MAP_TYPE);
-    __ Assert(eq, AbortReason::kUnexpectedInitialMapForArrayFunction);
-  }
-
-  // Figure out the right elements kind
-  __ LoadP(r6, FieldMemOperand(r4, JSFunction::kPrototypeOrInitialMapOffset));
-  // Load the map's "bit field 2" into |result|.
-  __ lbz(r6, FieldMemOperand(r6, Map::kBitField2Offset));
-  // Retrieve elements_kind from bit field 2.
-  __ DecodeField<Map::ElementsKindBits>(r6);
-
-  if (FLAG_debug_code) {
-    Label done;
-    __ cmpi(r6, Operand(PACKED_ELEMENTS));
-    __ beq(&done);
-    __ cmpi(r6, Operand(HOLEY_ELEMENTS));
-    __ Assert(
-        eq,
-        AbortReason::kInvalidElementsKindForInternalArrayOrInternalPackedArray);
-    __ bind(&done);
-  }
-
-  Label fast_elements_case;
-  __ cmpi(r6, Operand(PACKED_ELEMENTS));
-  __ beq(&fast_elements_case);
-  GenerateCase(masm, HOLEY_ELEMENTS);
-
-  __ bind(&fast_elements_case);
-  GenerateCase(masm, PACKED_ELEMENTS);
-}
-
 static int AddressOffset(ExternalReference ref0, ExternalReference ref1) {
   return ref0.address() - ref1.address();
 }
@@ -1036,18 +352,18 @@ static void CallApiFunctionAndReturn(MacroAssembler* masm,
   DCHECK(function_address == r4 || function_address == r5);
   Register scratch = r6;
 
-  __ mov(scratch, Operand(ExternalReference::is_profiling_address(isolate)));
+  __ Move(scratch, ExternalReference::is_profiling_address(isolate));
   __ lbz(scratch, MemOperand(scratch, 0));
   __ cmpi(scratch, Operand::Zero());
 
   if (CpuFeatures::IsSupported(ISELECT)) {
-    __ mov(scratch, Operand(thunk_ref));
+    __ Move(scratch, thunk_ref);
     __ isel(eq, scratch, function_address, scratch);
   } else {
     Label profiler_disabled;
     Label end_profiler_check;
     __ beq(&profiler_disabled);
-    __ mov(scratch, Operand(thunk_ref));
+    __ Move(scratch, thunk_ref);
     __ b(&end_profiler_check);
     __ bind(&profiler_disabled);
     __ mr(scratch, function_address);
@@ -1059,7 +375,7 @@ static void CallApiFunctionAndReturn(MacroAssembler* masm,
   // r14 - next_address->kNextOffset
   // r15 - next_address->kLimitOffset
   // r16 - next_address->kLevelOffset
-  __ mov(r17, Operand(next_address));
+  __ Move(r17, next_address);
   __ LoadP(r14, MemOperand(r17, kNextOffset));
   __ LoadP(r15, MemOperand(r17, kLimitOffset));
   __ lwz(r16, MemOperand(r17, kLevelOffset));
@@ -1070,9 +386,8 @@ static void CallApiFunctionAndReturn(MacroAssembler* masm,
     FrameScope frame(masm, StackFrame::MANUAL);
     __ PushSafepointRegisters();
     __ PrepareCallCFunction(1, r3);
-    __ mov(r3, Operand(ExternalReference::isolate_address(isolate)));
-    __ CallCFunction(ExternalReference::log_enter_external_function(isolate),
-                     1);
+    __ Move(r3, ExternalReference::isolate_address(isolate));
+    __ CallCFunction(ExternalReference::log_enter_external_function(), 1);
     __ PopSafepointRegisters();
   }
 
@@ -1086,9 +401,8 @@ static void CallApiFunctionAndReturn(MacroAssembler* masm,
     FrameScope frame(masm, StackFrame::MANUAL);
     __ PushSafepointRegisters();
     __ PrepareCallCFunction(1, r3);
-    __ mov(r3, Operand(ExternalReference::isolate_address(isolate)));
-    __ CallCFunction(ExternalReference::log_leave_external_function(isolate),
-                     1);
+    __ Move(r3, ExternalReference::isolate_address(isolate));
+    __ CallCFunction(ExternalReference::log_leave_external_function(), 1);
     __ PopSafepointRegisters();
   }
 
@@ -1126,7 +440,7 @@ static void CallApiFunctionAndReturn(MacroAssembler* masm,
 
   // Check if the function scheduled an exception.
   __ LoadRoot(r14, Heap::kTheHoleValueRootIndex);
-  __ mov(r15, Operand(ExternalReference::scheduled_exception_address(isolate)));
+  __ Move(r15, ExternalReference::scheduled_exception_address(isolate));
   __ LoadP(r15, MemOperand(r15));
   __ cmp(r14, r15);
   __ bne(&promote_scheduled_exception);
@@ -1142,9 +456,8 @@ static void CallApiFunctionAndReturn(MacroAssembler* masm,
   __ StoreP(r15, MemOperand(r17, kLimitOffset));
   __ mr(r14, r3);
   __ PrepareCallCFunction(1, r15);
-  __ mov(r3, Operand(ExternalReference::isolate_address(isolate)));
-  __ CallCFunction(ExternalReference::delete_handle_scope_extensions(isolate),
-                   1);
+  __ Move(r3, ExternalReference::isolate_address(isolate));
+  __ CallCFunction(ExternalReference::delete_handle_scope_extensions(), 1);
   __ mr(r3, r14);
   __ b(&leave_exit_frame);
 }
@@ -1189,7 +502,7 @@ void CallApiCallbackStub::Generate(MacroAssembler* masm) {
   // return value default
   __ push(scratch);
   // isolate
-  __ mov(scratch, Operand(ExternalReference::isolate_address(masm->isolate())));
+  __ Move(scratch, ExternalReference::isolate_address(masm->isolate()));
   __ push(scratch);
   // holder
   __ push(holder);
@@ -1224,8 +537,7 @@ void CallApiCallbackStub::Generate(MacroAssembler* masm) {
   __ li(ip, Operand(argc()));
   __ stw(ip, MemOperand(r3, 2 * kPointerSize));
 
-  ExternalReference thunk_ref =
-      ExternalReference::invoke_function_callback(masm->isolate());
+  ExternalReference thunk_ref = ExternalReference::invoke_function_callback();
 
   AllowExternalCallThatCantCauseGC scope(masm);
   // Stores return the first js argument
@@ -1267,7 +579,7 @@ void CallApiGetterStub::Generate(MacroAssembler* masm) {
   __ push(scratch);
   __ LoadRoot(scratch, Heap::kUndefinedValueRootIndex);
   __ Push(scratch, scratch);
-  __ mov(scratch, Operand(ExternalReference::isolate_address(isolate())));
+  __ Move(scratch, ExternalReference::isolate_address(isolate()));
   __ Push(scratch, holder);
   __ Push(Smi::kZero);  // should_throw_on_error -> false
   __ LoadP(scratch, FieldMemOperand(callback, AccessorInfo::kNameOffset));
@@ -1317,7 +629,7 @@ void CallApiGetterStub::Generate(MacroAssembler* masm) {
   // r4 = v8::PropertyCallbackInfo&
 
   ExternalReference thunk_ref =
-      ExternalReference::invoke_accessor_getter_callback(isolate());
+      ExternalReference::invoke_accessor_getter_callback();
 
   __ LoadP(scratch, FieldMemOperand(callback, AccessorInfo::kJsGetterOffset));
   __ LoadP(api_function_address,
diff --git a/deps/v8/src/ppc/constants-ppc.h b/deps/v8/src/ppc/constants-ppc.h
index 44749d4eb64c6c..673e5dc9b7221a 100644
--- a/deps/v8/src/ppc/constants-ppc.h
+++ b/deps/v8/src/ppc/constants-ppc.h
@@ -23,6 +23,9 @@
 namespace v8 {
 namespace internal {
 
+// TODO(sigurds): Change this value once we use relative jumps.
+constexpr size_t kMaxPCRelativeCodeRangeInMB = 0;
+
 // Number of registers
 const int kNumRegisters = 32;
 
@@ -36,6 +39,11 @@ const int kNoRegister = -1;
 const int kLoadPtrMaxReachBits = 15;
 const int kLoadDoubleMaxReachBits = 15;
 
+// Actual value of root register is offset from the root array's start
+// to take advantage of negative displacement values.
+// TODO(sigurds): Choose best value.
+constexpr int kRootRegisterBias = 128;
+
 // sign-extend the least significant 16-bits of value <imm>
 #define SIGN_EXT_IMM16(imm) ((static_cast<int>(imm) << 16) >> 16)
 
diff --git a/deps/v8/src/ppc/deoptimizer-ppc.cc b/deps/v8/src/ppc/deoptimizer-ppc.cc
index caa1a24354b5e9..b10af51de13b36 100644
--- a/deps/v8/src/ppc/deoptimizer-ppc.cc
+++ b/deps/v8/src/ppc/deoptimizer-ppc.cc
@@ -56,8 +56,8 @@ void Deoptimizer::TableEntryGenerator::Generate() {
     }
   }
 
-  __ mov(ip, Operand(ExternalReference(IsolateAddressId::kCEntryFPAddress,
-                                       isolate())));
+  __ mov(ip, Operand(ExternalReference::Create(
+                 IsolateAddressId::kCEntryFPAddress, isolate())));
   __ StoreP(fp, MemOperand(ip));
 
   const int kSavedRegistersAreaSize =
@@ -83,7 +83,7 @@ void Deoptimizer::TableEntryGenerator::Generate() {
   __ JumpIfSmi(r4, &context_check);
   __ LoadP(r3, MemOperand(fp, JavaScriptFrameConstants::kFunctionOffset));
   __ bind(&context_check);
-  __ li(r4, Operand(type()));  // bailout type,
+  __ li(r4, Operand(static_cast<int>(deopt_kind())));
   // r5: bailout id already loaded.
   // r6: code address or 0 already loaded.
   // r7: Fp-to-sp delta.
@@ -91,7 +91,7 @@ void Deoptimizer::TableEntryGenerator::Generate() {
   // Call Deoptimizer::New().
   {
     AllowExternalCallThatCantCauseGC scope(masm());
-    __ CallCFunction(ExternalReference::new_deoptimizer_function(isolate()), 6);
+    __ CallCFunction(ExternalReference::new_deoptimizer_function(), 6);
   }
 
   // Preserve "deoptimizer" object in register r3 and get the input
@@ -157,8 +157,7 @@ void Deoptimizer::TableEntryGenerator::Generate() {
   // Call Deoptimizer::ComputeOutputFrames().
   {
     AllowExternalCallThatCantCauseGC scope(masm());
-    __ CallCFunction(
-        ExternalReference::compute_output_frames_function(isolate()), 1);
+    __ CallCFunction(ExternalReference::compute_output_frames_function(), 1);
   }
   __ pop(r3);  // Restore deoptimizer object (class Deoptimizer).
 
diff --git a/deps/v8/src/ppc/frame-constants-ppc.h b/deps/v8/src/ppc/frame-constants-ppc.h
index f91601c04602c3..a4516c367c8154 100644
--- a/deps/v8/src/ppc/frame-constants-ppc.h
+++ b/deps/v8/src/ppc/frame-constants-ppc.h
@@ -5,6 +5,7 @@
 #ifndef V8_PPC_FRAME_CONSTANTS_PPC_H_
 #define V8_PPC_FRAME_CONSTANTS_PPC_H_
 
+#include "src/base/macros.h"
 #include "src/frame-constants.h"
 
 namespace v8 {
@@ -32,6 +33,19 @@ class ExitFrameConstants : public TypedFrameConstants {
   static constexpr int kCallerSPDisplacement = 2 * kPointerSize;
 };
 
+class WasmCompileLazyFrameConstants : public TypedFrameConstants {
+ public:
+  static constexpr int kNumberOfSavedGpParamRegs = 8;
+  static constexpr int kNumberOfSavedFpParamRegs = 8;
+
+  // FP-relative.
+  static constexpr int kWasmInstanceOffset = TYPED_FRAME_PUSHED_VALUE_OFFSET(0);
+  static constexpr int kFixedFrameSizeFromFp =
+      TypedFrameConstants::kFixedFrameSizeFromFp +
+      kNumberOfSavedGpParamRegs * kPointerSize +
+      kNumberOfSavedFpParamRegs * kDoubleSize;
+};
+
 class JavaScriptFrameConstants : public AllStatic {
  public:
   // FP-relative.
diff --git a/deps/v8/src/ppc/interface-descriptors-ppc.cc b/deps/v8/src/ppc/interface-descriptors-ppc.cc
index 23245b153be98f..c446a74e1013b4 100644
--- a/deps/v8/src/ppc/interface-descriptors-ppc.cc
+++ b/deps/v8/src/ppc/interface-descriptors-ppc.cc
@@ -32,7 +32,7 @@ void RecordWriteDescriptor::InitializePlatformSpecific(
   data->InitializePlatformSpecific(kParameterCount, default_stub_registers);
 }
 
-const Register FastNewFunctionContextDescriptor::FunctionRegister() {
+const Register FastNewFunctionContextDescriptor::ScopeInfoRegister() {
   return r4;
 }
 const Register FastNewFunctionContextDescriptor::SlotsRegister() { return r3; }
@@ -57,13 +57,6 @@ const Register StoreTransitionDescriptor::MapRegister() { return r8; }
 const Register ApiGetterDescriptor::HolderRegister() { return r3; }
 const Register ApiGetterDescriptor::CallbackRegister() { return r6; }
 
-const Register MathPowTaggedDescriptor::exponent() { return r5; }
-
-const Register MathPowIntegerDescriptor::exponent() {
-  return MathPowTaggedDescriptor::exponent();
-}
-
-
 const Register GrowArrayElementsDescriptor::ObjectRegister() { return r3; }
 const Register GrowArrayElementsDescriptor::KeyRegister() { return r6; }
 
@@ -177,24 +170,7 @@ void ConstructStubDescriptor::InitializePlatformSpecific(
   data->InitializePlatformSpecific(arraysize(registers), registers);
 }
 
-
-void ConstructTrampolineDescriptor::InitializePlatformSpecific(
-    CallInterfaceDescriptorData* data) {
-  // r3 : number of arguments
-  // r4 : the target to call
-  // r6 : the new target
-  Register registers[] = {r4, r6, r3};
-  data->InitializePlatformSpecific(arraysize(registers), registers);
-}
-
-
-void TransitionElementsKindDescriptor::InitializePlatformSpecific(
-    CallInterfaceDescriptorData* data) {
-  Register registers[] = {r3, r4};
-  data->InitializePlatformSpecific(arraysize(registers), registers);
-}
-
-void AbortJSDescriptor::InitializePlatformSpecific(
+void AbortDescriptor::InitializePlatformSpecific(
     CallInterfaceDescriptorData* data) {
   Register registers[] = {r4};
   data->InitializePlatformSpecific(arraysize(registers), registers);
@@ -202,42 +178,7 @@ void AbortJSDescriptor::InitializePlatformSpecific(
 
 void AllocateHeapNumberDescriptor::InitializePlatformSpecific(
     CallInterfaceDescriptorData* data) {
-  data->InitializePlatformSpecific(0, nullptr, nullptr);
-}
-
-void ArrayConstructorDescriptor::InitializePlatformSpecific(
-    CallInterfaceDescriptorData* data) {
-  // kTarget, kNewTarget, kActualArgumentsCount, kAllocationSite
-  Register registers[] = {r4, r6, r3, r5};
-  data->InitializePlatformSpecific(arraysize(registers), registers, nullptr);
-}
-
-void ArrayNoArgumentConstructorDescriptor::InitializePlatformSpecific(
-    CallInterfaceDescriptorData* data) {
-  // register state
-  // r3 -- number of arguments
-  // r4 -- function
-  // r5 -- allocation site with elements kind
-  Register registers[] = {r4, r5, r3};
-  data->InitializePlatformSpecific(arraysize(registers), registers);
-}
-
-void ArraySingleArgumentConstructorDescriptor::InitializePlatformSpecific(
-    CallInterfaceDescriptorData* data) {
-  // register state
-  // r3 -- number of arguments
-  // r4 -- function
-  // r5 -- allocation site with elements kind
-  Register registers[] = {r4, r5, r3};
-  data->InitializePlatformSpecific(arraysize(registers), registers, nullptr);
-}
-
-
-void ArrayNArgumentsConstructorDescriptor::InitializePlatformSpecific(
-    CallInterfaceDescriptorData* data) {
-  // stack param count needs (constructor pointer, and single argument)
-  Register registers[] = {r4, r5, r3};
-  data->InitializePlatformSpecific(arraysize(registers), registers);
+  data->InitializePlatformSpecific(0, nullptr);
 }
 
 void CompareDescriptor::InitializePlatformSpecific(
@@ -253,12 +194,6 @@ void BinaryOpDescriptor::InitializePlatformSpecific(
   data->InitializePlatformSpecific(arraysize(registers), registers);
 }
 
-void StringAddDescriptor::InitializePlatformSpecific(
-    CallInterfaceDescriptorData* data) {
-  Register registers[] = {r4, r3};
-  data->InitializePlatformSpecific(arraysize(registers), registers);
-}
-
 void ArgumentAdaptorDescriptor::InitializePlatformSpecific(
     CallInterfaceDescriptorData* data) {
   Register registers[] = {
@@ -311,7 +246,9 @@ void InterpreterPushArgsThenConstructDescriptor::InitializePlatformSpecific(
   data->InitializePlatformSpecific(arraysize(registers), registers);
 }
 
-void InterpreterCEntryDescriptor::InitializePlatformSpecific(
+namespace {
+
+void InterpreterCEntryDescriptor_InitializePlatformSpecific(
     CallInterfaceDescriptorData* data) {
   Register registers[] = {
       r3,  // argument count (argc)
@@ -321,6 +258,18 @@ void InterpreterCEntryDescriptor::InitializePlatformSpecific(
   data->InitializePlatformSpecific(arraysize(registers), registers);
 }
 
+}  // namespace
+
+void InterpreterCEntry1Descriptor::InitializePlatformSpecific(
+    CallInterfaceDescriptorData* data) {
+  InterpreterCEntryDescriptor_InitializePlatformSpecific(data);
+}
+
+void InterpreterCEntry2Descriptor::InitializePlatformSpecific(
+    CallInterfaceDescriptorData* data) {
+  InterpreterCEntryDescriptor_InitializePlatformSpecific(data);
+}
+
 void ResumeGeneratorDescriptor::InitializePlatformSpecific(
     CallInterfaceDescriptorData* data) {
   Register registers[] = {
diff --git a/deps/v8/src/ppc/macro-assembler-ppc.cc b/deps/v8/src/ppc/macro-assembler-ppc.cc
index 7747c9a4a252c9..3ced36ac96cb6b 100644
--- a/deps/v8/src/ppc/macro-assembler-ppc.cc
+++ b/deps/v8/src/ppc/macro-assembler-ppc.cc
@@ -11,6 +11,7 @@
 #include "src/base/division-by-constant.h"
 #include "src/bootstrapper.h"
 #include "src/callable.h"
+#include "src/code-factory.h"
 #include "src/code-stubs.h"
 #include "src/debug/debug.h"
 #include "src/external-reference-table.h"
@@ -18,22 +19,25 @@
 #include "src/instruction-stream.h"
 #include "src/register-configuration.h"
 #include "src/runtime/runtime.h"
+#include "src/snapshot/snapshot.h"
 
 #include "src/ppc/macro-assembler-ppc.h"
 
 namespace v8 {
 namespace internal {
 
-MacroAssembler::MacroAssembler(Isolate* isolate, void* buffer, int size,
-                               CodeObjectRequired create_code_object)
-    : TurboAssembler(isolate, buffer, size, create_code_object) {}
-
-TurboAssembler::TurboAssembler(Isolate* isolate, void* buffer, int buffer_size,
-                               CodeObjectRequired create_code_object)
-    : Assembler(isolate, buffer, buffer_size), isolate_(isolate) {
+MacroAssembler::MacroAssembler(Isolate* isolate,
+                               const AssemblerOptions& options, void* buffer,
+                               int size, CodeObjectRequired create_code_object)
+    : TurboAssembler(isolate, options, buffer, size, create_code_object) {
   if (create_code_object == CodeObjectRequired::kYes) {
-    code_object_ =
-        Handle<HeapObject>::New(isolate->heap()->undefined_value(), isolate);
+    // Unlike TurboAssembler, which can be used off the main thread and may not
+    // allocate, macro assembler creates its own copy of the self-reference
+    // marker in order to disambiguate between self-references during nested
+    // code generation (e.g.: codegen of the current object triggers stub
+    // compilation through CodeStub::GetCode()).
+    code_object_ = Handle<HeapObject>::New(
+        *isolate->factory()->NewSelfReferenceMarker(), isolate);
   }
 }
 
@@ -120,6 +124,33 @@ void TurboAssembler::Jump(Register target) {
   bctr();
 }
 
+void TurboAssembler::LoadFromConstantsTable(Register destination,
+                                            int constant_index) {
+  DCHECK(isolate()->heap()->RootCanBeTreatedAsConstant(
+      Heap::kBuiltinsConstantsTableRootIndex));
+
+  const uint32_t offset =
+      FixedArray::kHeaderSize + constant_index * kPointerSize - kHeapObjectTag;
+
+  CHECK(is_uint19(offset));
+  DCHECK_NE(destination, r0);
+  LoadRoot(destination, Heap::kBuiltinsConstantsTableRootIndex);
+  LoadP(destination, MemOperand(destination, offset), r0);
+}
+
+void TurboAssembler::LoadRootRelative(Register destination, int32_t offset) {
+  LoadP(destination, MemOperand(kRootRegister, offset), r0);
+}
+
+void TurboAssembler::LoadRootRegisterOffset(Register destination,
+                                            intptr_t offset) {
+  if (offset == 0) {
+    mr(destination, kRootRegister);
+  } else {
+    addi(destination, kRootRegister, Operand(offset));
+  }
+}
+
 void MacroAssembler::JumpToJSEntry(Register target) {
   Move(ip, target);
   Jump(ip);
@@ -143,14 +174,42 @@ void TurboAssembler::Jump(intptr_t target, RelocInfo::Mode rmode,
 void TurboAssembler::Jump(Address target, RelocInfo::Mode rmode, Condition cond,
                           CRegister cr) {
   DCHECK(!RelocInfo::IsCodeTarget(rmode));
-  Jump(reinterpret_cast<intptr_t>(target), rmode, cond, cr);
+  Jump(static_cast<intptr_t>(target), rmode, cond, cr);
 }
 
 void TurboAssembler::Jump(Handle<Code> code, RelocInfo::Mode rmode,
                           Condition cond, CRegister cr) {
   DCHECK(RelocInfo::IsCodeTarget(rmode));
   // 'code' is always generated ppc code, never THUMB code
-  Jump(reinterpret_cast<intptr_t>(code.address()), rmode, cond, cr);
+  if (FLAG_embedded_builtins) {
+    if (root_array_available_ && options().isolate_independent_code) {
+      Register scratch = ip;
+      IndirectLoadConstant(scratch, code);
+      addi(scratch, scratch, Operand(Code::kHeaderSize - kHeapObjectTag));
+      Label skip;
+      if (cond != al) b(NegateCondition(cond), &skip, cr);
+      Jump(scratch);
+      bind(&skip);
+      return;
+    } else if (options().inline_offheap_trampolines) {
+      int builtin_index = Builtins::kNoBuiltinId;
+      if (isolate()->builtins()->IsBuiltinHandle(code, &builtin_index) &&
+          Builtins::IsIsolateIndependent(builtin_index)) {
+        // Inline the trampoline.
+        EmbeddedData d = EmbeddedData::FromBlob();
+        Address entry = d.InstructionStartOfBuiltin(builtin_index);
+        // Use ip directly instead of using UseScratchRegisterScope, as we do
+        // not preserve scratch registers across calls.
+        mov(ip, Operand(entry, RelocInfo::OFF_HEAP_TARGET));
+        Label skip;
+        if (cond != al) b(NegateCondition(cond), &skip, cr);
+        Jump(ip);
+        bind(&skip);
+        return;
+      }
+    }
+  }
+  Jump(static_cast<intptr_t>(code.address()), rmode, cond, cr);
 }
 
 int TurboAssembler::CallSize(Register target) { return 2 * kInstrSize; }
@@ -174,7 +233,7 @@ void MacroAssembler::CallJSEntry(Register target) {
 
 int TurboAssembler::CallSize(Address target, RelocInfo::Mode rmode,
                              Condition cond) {
-  Operand mov_operand = Operand(reinterpret_cast<intptr_t>(target), rmode);
+  Operand mov_operand = Operand(target, rmode);
   return (2 + instructions_required_for_mov(ip, mov_operand)) * kInstrSize;
 }
 
@@ -202,7 +261,7 @@ void TurboAssembler::Call(Address target, RelocInfo::Mode rmode,
   // bc( BA, .... offset, LKset);
   //
 
-  mov(ip, Operand(reinterpret_cast<intptr_t>(target), rmode));
+  mov(ip, Operand(target, rmode));
   mtctr(ip);
   bctrl();
 
@@ -219,17 +278,37 @@ void TurboAssembler::Call(Handle<Code> code, RelocInfo::Mode rmode,
   BlockTrampolinePoolScope block_trampoline_pool(this);
   DCHECK(RelocInfo::IsCodeTarget(rmode));
 
-  Label start;
-  bind(&start);
-
-#ifdef DEBUG
-  // Check the expected size before generating code to ensure we assume the same
-  // constant pool availability (e.g., whether constant pool is full or not).
-  int expected_size = CallSize(code, rmode, cond);
-#endif
-
+  if (FLAG_embedded_builtins) {
+    if (root_array_available_ && options().isolate_independent_code) {
+      // Use ip directly instead of using UseScratchRegisterScope, as we do not
+      // preserve scratch registers across calls.
+      IndirectLoadConstant(ip, code);
+      addi(ip, ip, Operand(Code::kHeaderSize - kHeapObjectTag));
+      Label skip;
+      if (cond != al) b(NegateCondition(cond), &skip);
+      Call(ip);
+      bind(&skip);
+      return;
+    } else if (options().inline_offheap_trampolines) {
+      int builtin_index = Builtins::kNoBuiltinId;
+      if (isolate()->builtins()->IsBuiltinHandle(code, &builtin_index) &&
+          Builtins::IsIsolateIndependent(builtin_index)) {
+        // Inline the trampoline.
+        DCHECK(Builtins::IsBuiltinId(builtin_index));
+        EmbeddedData d = EmbeddedData::FromBlob();
+        Address entry = d.InstructionStartOfBuiltin(builtin_index);
+        // Use ip directly instead of using UseScratchRegisterScope, as we do
+        // not preserve scratch registers across calls.
+        mov(ip, Operand(entry, RelocInfo::OFF_HEAP_TARGET));
+        Label skip;
+        if (cond != al) b(NegateCondition(cond), &skip);
+        Call(ip);
+        bind(&skip);
+        return;
+      }
+    }
+  }
   Call(code.address(), rmode, cond);
-  DCHECK_EQ(expected_size, SizeOfCodeGeneratedSince(&start));
 }
 
 void TurboAssembler::Drop(int count) {
@@ -256,9 +335,25 @@ void TurboAssembler::Push(Smi* smi) {
 }
 
 void TurboAssembler::Move(Register dst, Handle<HeapObject> value) {
+  if (FLAG_embedded_builtins) {
+    if (root_array_available_ && options().isolate_independent_code) {
+      IndirectLoadConstant(dst, value);
+      return;
+    }
+  }
   mov(dst, Operand(value));
 }
 
+void TurboAssembler::Move(Register dst, ExternalReference reference) {
+  if (FLAG_embedded_builtins) {
+    if (root_array_available_ && options().isolate_independent_code) {
+      IndirectLoadExternalReference(dst, reference);
+      return;
+    }
+  }
+  mov(dst, Operand(reference));
+}
+
 void TurboAssembler::Move(Register dst, Register src, Condition cond) {
   DCHECK(cond == al);
   if (dst != src) {
@@ -327,7 +422,7 @@ void TurboAssembler::MultiPopDoubles(RegList dregs, Register location) {
 void TurboAssembler::LoadRoot(Register destination, Heap::RootListIndex index,
                               Condition cond) {
   DCHECK(cond == al);
-  LoadP(destination, MemOperand(kRootRegister, index << kPointerSizeLog2), r0);
+  LoadP(destination, MemOperand(kRootRegister, RootRegisterOffset(index)), r0);
 }
 
 void MacroAssembler::RecordWriteField(Register object, int offset,
@@ -425,8 +520,7 @@ void TurboAssembler::CallRecordWriteStub(
   pop(slot_parameter);
   pop(object_parameter);
 
-  mov(isolate_parameter,
-      Operand(ExternalReference::isolate_address(isolate())));
+  Move(isolate_parameter, ExternalReference::isolate_address(isolate()));
   Move(remembered_set_parameter, Smi::FromEnum(remembered_set_action));
   Move(fp_mode_parameter, Smi::FromEnum(fp_mode));
   Call(callable.code(), RelocInfo::CODE_TARGET);
@@ -887,10 +981,6 @@ void TurboAssembler::EnterFrame(StackFrame::Type type,
     mov(ip, Operand(StackFrame::TypeToMarker(type)));
     PushCommonFrame(ip);
   }
-  if (type == StackFrame::INTERNAL) {
-    mov(r0, Operand(CodeObject()));
-    push(r0);
-  }
 }
 
 int TurboAssembler::LeaveFrame(StackFrame::Type type, int stack_adjustment) {
@@ -958,15 +1048,15 @@ void MacroAssembler::EnterExitFrame(bool save_doubles, int stack_space,
     StoreP(kConstantPoolRegister,
            MemOperand(fp, ExitFrameConstants::kConstantPoolOffset));
   }
-  mov(r8, Operand(CodeObject()));
+  Move(r8, CodeObject());
   StoreP(r8, MemOperand(fp, ExitFrameConstants::kCodeOffset));
 
   // Save the frame pointer and the context in top.
-  mov(r8, Operand(ExternalReference(IsolateAddressId::kCEntryFPAddress,
-                                    isolate())));
+  Move(r8, ExternalReference::Create(IsolateAddressId::kCEntryFPAddress,
+                                     isolate()));
   StoreP(fp, MemOperand(r8));
-  mov(r8,
-      Operand(ExternalReference(IsolateAddressId::kContextAddress, isolate())));
+  Move(r8,
+       ExternalReference::Create(IsolateAddressId::kContextAddress, isolate()));
   StoreP(cp, MemOperand(r8));
 
   // Optionally save all volatile double registers.
@@ -1028,19 +1118,19 @@ void MacroAssembler::LeaveExitFrame(bool save_doubles, Register argument_count,
 
   // Clear top frame.
   li(r6, Operand::Zero());
-  mov(ip, Operand(ExternalReference(IsolateAddressId::kCEntryFPAddress,
-                                    isolate())));
+  Move(ip, ExternalReference::Create(IsolateAddressId::kCEntryFPAddress,
+                                     isolate()));
   StoreP(r6, MemOperand(ip));
 
   // Restore current context from top and clear it in debug mode.
-  mov(ip,
-      Operand(ExternalReference(IsolateAddressId::kContextAddress, isolate())));
+  Move(ip,
+       ExternalReference::Create(IsolateAddressId::kContextAddress, isolate()));
   LoadP(cp, MemOperand(ip));
 
 #ifdef DEBUG
   mov(r6, Operand(Context::kInvalidContext));
-  mov(ip,
-      Operand(ExternalReference(IsolateAddressId::kContextAddress, isolate())));
+  Move(ip,
+       ExternalReference::Create(IsolateAddressId::kContextAddress, isolate()));
   StoreP(r6, MemOperand(ip));
 #endif
 
@@ -1195,15 +1285,23 @@ void MacroAssembler::CheckDebugHook(Register fun, Register new_target,
                                     const ParameterCount& actual) {
   Label skip_hook;
 
-  ExternalReference debug_hook_avtive =
+  ExternalReference debug_hook_active =
       ExternalReference::debug_hook_on_function_call_address(isolate());
-  mov(r7, Operand(debug_hook_avtive));
+  Move(r7, debug_hook_active);
   LoadByte(r7, MemOperand(r7), r0);
   extsb(r7, r7);
   CmpSmiLiteral(r7, Smi::kZero, r0);
   beq(&skip_hook);
 
   {
+    // Load receiver to pass it later to DebugOnFunctionCall hook.
+    if (actual.is_reg()) {
+      mr(r7, actual.reg());
+    } else {
+      mov(r7, Operand(actual.immediate()));
+    }
+    ShiftLeftImm(r7, r7, Operand(kPointerSizeLog2));
+    LoadPX(r7, MemOperand(sp, r7));
     FrameScope frame(this,
                      has_frame() ? StackFrame::NONE : StackFrame::INTERNAL);
     if (expected.is_reg()) {
@@ -1217,7 +1315,7 @@ void MacroAssembler::CheckDebugHook(Register fun, Register new_target,
     if (new_target.is_valid()) {
       Push(new_target);
     }
-    Push(fun, fun);
+    Push(fun, fun, r7);
     CallRuntime(Runtime::kDebugOnFunctionCall);
     Pop(fun);
     if (new_target.is_valid()) {
@@ -1289,9 +1387,9 @@ void MacroAssembler::InvokeFunction(Register fun, Register new_target,
 
   LoadP(temp_reg, FieldMemOperand(r4, JSFunction::kSharedFunctionInfoOffset));
   LoadP(cp, FieldMemOperand(r4, JSFunction::kContextOffset));
-  LoadWordArith(expected_reg,
-                FieldMemOperand(
-                    temp_reg, SharedFunctionInfo::kFormalParameterCountOffset));
+  LoadHalfWord(expected_reg,
+               FieldMemOperand(
+                   temp_reg, SharedFunctionInfo::kFormalParameterCountOffset));
 
   ParameterCount expected(expected_reg);
   InvokeFunctionCode(fun, new_target, expected, actual, flag);
@@ -1317,7 +1415,7 @@ void MacroAssembler::MaybeDropFrames() {
   // Check whether we need to drop frames to restart a function on the stack.
   ExternalReference restart_fp =
       ExternalReference::debug_restart_fp_address(isolate());
-  mov(r4, Operand(restart_fp));
+  Move(r4, restart_fp);
   LoadP(r4, MemOperand(r4));
   cmpi(r4, Operand::Zero());
   Jump(BUILTIN_CODE(isolate(), FrameDropperTrampoline), RelocInfo::CODE_TARGET,
@@ -1333,8 +1431,8 @@ void MacroAssembler::PushStackHandler() {
 
   // Link the current handler as the next handler.
   // Preserve r3-r7.
-  mov(r8,
-      Operand(ExternalReference(IsolateAddressId::kHandlerAddress, isolate())));
+  mov(r8, Operand(ExternalReference::Create(IsolateAddressId::kHandlerAddress,
+                                            isolate())));
   LoadP(r0, MemOperand(r8));
   push(r0);
 
@@ -1348,8 +1446,8 @@ void MacroAssembler::PopStackHandler() {
   STATIC_ASSERT(StackHandlerConstants::kNextOffset == 0);
 
   pop(r4);
-  mov(ip,
-      Operand(ExternalReference(IsolateAddressId::kHandlerAddress, isolate())));
+  mov(ip, Operand(ExternalReference::Create(IsolateAddressId::kHandlerAddress,
+                                            isolate())));
   StoreP(r4, MemOperand(ip));
 
   Drop(1);  // Drop padding.
@@ -1519,8 +1617,10 @@ void MacroAssembler::TryDoubleToInt32Exact(Register result,
   bind(&done);
 }
 
-void TurboAssembler::TruncateDoubleToIDelayed(Zone* zone, Register result,
-                                              DoubleRegister double_input) {
+void TurboAssembler::TruncateDoubleToI(Isolate* isolate, Zone* zone,
+                                       Register result,
+                                       DoubleRegister double_input,
+                                       StubCallMode stub_mode) {
   Label done;
 
   TryInlineTruncateDoubleToI(result, double_input, &done);
@@ -1531,8 +1631,13 @@ void TurboAssembler::TruncateDoubleToIDelayed(Zone* zone, Register result,
   // Put input on stack.
   stfdu(double_input, MemOperand(sp, -kDoubleSize));
 
-  CallStubDelayed(new (zone) DoubleToIStub(nullptr, result));
+  if (stub_mode == StubCallMode::kCallWasmRuntimeStub) {
+    Call(wasm::WasmCode::kDoubleToI, RelocInfo::WASM_STUB_CALL);
+  } else {
+    Call(BUILTIN_CODE(isolate, DoubleToI), RelocInfo::CODE_TARGET);
+  }
 
+  LoadP(result, MemOperand(sp));
   addi(sp, sp, Operand(kDoubleSize));
   pop(r0);
   mtlr(r0);
@@ -1563,22 +1668,18 @@ void TurboAssembler::TryInlineTruncateDoubleToI(Register result,
   beq(done);
 }
 
-void TurboAssembler::CallRuntimeDelayed(Zone* zone, Runtime::FunctionId fid,
-                                        SaveFPRegsMode save_doubles) {
+void TurboAssembler::CallRuntimeWithCEntry(Runtime::FunctionId fid,
+                                           Register centry) {
   const Runtime::Function* f = Runtime::FunctionForId(fid);
   // TODO(1236192): Most runtime routines don't need the number of
   // arguments passed in because it is constant. At some point we
   // should remove this need and make the runtime routine entry code
   // smarter.
   mov(r3, Operand(f->nargs));
-  mov(r4, Operand(ExternalReference(f, isolate())));
-  CallStubDelayed(new (zone) CEntryStub(nullptr,
-#if V8_TARGET_ARCH_PPC64
-                                        f->result_size,
-#else
-                                        1,
-#endif
-                                        save_doubles));
+  Move(r4, ExternalReference::Create(f));
+  DCHECK(!AreAliased(centry, r3, r4));
+  addi(centry, centry, Operand(Code::kHeaderSize - kHeapObjectTag));
+  Call(centry);
 }
 
 void MacroAssembler::CallRuntime(const Runtime::Function* f, int num_arguments,
@@ -1595,15 +1696,14 @@ void MacroAssembler::CallRuntime(const Runtime::Function* f, int num_arguments,
   // should remove this need and make the runtime routine entry code
   // smarter.
   mov(r3, Operand(num_arguments));
-  mov(r4, Operand(ExternalReference(f, isolate())));
-  CEntryStub stub(isolate(),
+  Move(r4, ExternalReference::Create(f));
 #if V8_TARGET_ARCH_PPC64
-                  f->result_size,
+  Handle<Code> code =
+      CodeFactory::CEntry(isolate(), f->result_size, save_doubles);
 #else
-                  1,
+  Handle<Code> code = CodeFactory::CEntry(isolate(), 1, save_doubles);
 #endif
-                  save_doubles);
-  CallStub(&stub);
+  Call(code, RelocInfo::CODE_TARGET);
 }
 
 void MacroAssembler::TailCallRuntime(Runtime::FunctionId fid) {
@@ -1612,21 +1712,20 @@ void MacroAssembler::TailCallRuntime(Runtime::FunctionId fid) {
   if (function->nargs >= 0) {
     mov(r3, Operand(function->nargs));
   }
-  JumpToExternalReference(ExternalReference(fid, isolate()));
+  JumpToExternalReference(ExternalReference::Create(fid));
 }
 
 
 void MacroAssembler::JumpToExternalReference(const ExternalReference& builtin,
                                              bool builtin_exit_frame) {
-  mov(r4, Operand(builtin));
-  CEntryStub stub(isolate(), 1, kDontSaveFPRegs, kArgvOnStack,
-                  builtin_exit_frame);
-  Jump(stub.GetCode(), RelocInfo::CODE_TARGET);
+  Move(r4, builtin);
+  Handle<Code> code = CodeFactory::CEntry(isolate(), 1, kDontSaveFPRegs,
+                                          kArgvOnStack, builtin_exit_frame);
+  Jump(code, RelocInfo::CODE_TARGET);
 }
 
 void MacroAssembler::JumpToInstructionStream(Address entry) {
-  mov(kOffHeapTrampolineRegister,
-      Operand(reinterpret_cast<intptr_t>(entry), RelocInfo::OFF_HEAP_TARGET));
+  mov(kOffHeapTrampolineRegister, Operand(entry, RelocInfo::OFF_HEAP_TARGET));
   Jump(kOffHeapTrampolineRegister);
 }
 
@@ -1643,7 +1742,7 @@ void MacroAssembler::IncrementCounter(StatsCounter* counter, int value,
                                       Register scratch1, Register scratch2) {
   DCHECK_GT(value, 0);
   if (FLAG_native_code_counters && counter->Enabled()) {
-    mov(scratch2, Operand(ExternalReference(counter)));
+    Move(scratch2, ExternalReference::Create(counter));
     lwz(scratch1, MemOperand(scratch2));
     addi(scratch1, scratch1, Operand(value));
     stw(scratch1, MemOperand(scratch2));
@@ -1655,7 +1754,7 @@ void MacroAssembler::DecrementCounter(StatsCounter* counter, int value,
                                       Register scratch1, Register scratch2) {
   DCHECK_GT(value, 0);
   if (FLAG_native_code_counters && counter->Enabled()) {
-    mov(scratch2, Operand(ExternalReference(counter)));
+    Move(scratch2, ExternalReference::Create(counter));
     lwz(scratch1, MemOperand(scratch2));
     subi(scratch1, scratch1, Operand(value));
     stw(scratch1, MemOperand(scratch2));
@@ -1678,18 +1777,17 @@ void TurboAssembler::Check(Condition cond, AbortReason reason, CRegister cr) {
 void TurboAssembler::Abort(AbortReason reason) {
   Label abort_start;
   bind(&abort_start);
-#ifdef DEBUG
   const char* msg = GetAbortReason(reason);
-  if (msg != nullptr) {
-    RecordComment("Abort message: ");
-    RecordComment(msg);
-  }
+#ifdef DEBUG
+  RecordComment("Abort message: ");
+  RecordComment(msg);
+#endif
 
-  if (FLAG_trap_on_abort) {
+  // Avoid emitting call to builtin if requested.
+  if (trap_on_abort()) {
     stop(msg);
     return;
   }
-#endif
 
   LoadSmiLiteral(r4, Smi::FromInt(static_cast<int>(reason)));
 
@@ -1743,18 +1841,6 @@ void MacroAssembler::AssertSmi(Register object) {
   }
 }
 
-void MacroAssembler::AssertFixedArray(Register object) {
-  if (emit_debug_code()) {
-    STATIC_ASSERT(kSmiTag == 0);
-    TestIfSmi(object, r0);
-    Check(ne, AbortReason::kOperandIsASmiAndNotAFixedArray, cr0);
-    push(object);
-    CompareObjectType(object, object, object, FIXED_ARRAY_TYPE);
-    pop(object);
-    Check(eq, AbortReason::kOperandIsNotAFixedArray);
-  }
-}
-
 void MacroAssembler::AssertConstructor(Register object) {
   if (emit_debug_code()) {
     STATIC_ASSERT(kSmiTag == 0);
@@ -1827,7 +1913,7 @@ void MacroAssembler::AssertUndefinedOrAllocationSite(Register object,
     CompareRoot(object, Heap::kUndefinedValueRootIndex);
     beq(&done_checking);
     LoadP(scratch, FieldMemOperand(object, HeapObject::kMapOffset));
-    CompareRoot(scratch, Heap::kAllocationSiteMapRootIndex);
+    CompareInstanceType(scratch, scratch, ALLOCATION_SITE_TYPE);
     Assert(eq, AbortReason::kExpectedUndefinedOrCell);
     bind(&done_checking);
   }
@@ -1900,7 +1986,7 @@ void TurboAssembler::MovToFloatParameters(DoubleRegister src1,
 void TurboAssembler::CallCFunction(ExternalReference function,
                                    int num_reg_arguments,
                                    int num_double_arguments) {
-  mov(ip, Operand(function));
+  Move(ip, function);
   CallCFunctionHelper(ip, num_reg_arguments, num_double_arguments);
 }
 
@@ -2257,7 +2343,7 @@ void TurboAssembler::Add(Register dst, Register src, intptr_t value,
 }
 
 
-void MacroAssembler::Cmpi(Register src1, const Operand& src2, Register scratch,
+void TurboAssembler::Cmpi(Register src1, const Operand& src2, Register scratch,
                           CRegister cr) {
   intptr_t value = src2.immediate();
   if (is_int16(value)) {
@@ -2590,6 +2676,7 @@ void MacroAssembler::LoadHalfWord(Register dst, const MemOperand& mem,
   int offset = mem.offset();
 
   if (!is_int16(offset)) {
+    DCHECK_NE(scratch, no_reg);
     LoadIntLiteral(scratch, offset);
     lhzx(dst, MemOperand(base, scratch));
   } else {
@@ -2968,6 +3055,16 @@ void TurboAssembler::ResetSpeculationPoisonRegister() {
   mov(kSpeculationPoisonRegister, Operand(-1));
 }
 
+void TurboAssembler::JumpIfEqual(Register x, int32_t y, Label* dest) {
+  Cmpi(x, Operand(y), r0);
+  beq(dest);
+}
+
+void TurboAssembler::JumpIfLessThan(Register x, int32_t y, Label* dest) {
+  Cmpi(x, Operand(y), r0);
+  blt(dest);
+}
+
 }  // namespace internal
 }  // namespace v8
 
diff --git a/deps/v8/src/ppc/macro-assembler-ppc.h b/deps/v8/src/ppc/macro-assembler-ppc.h
index db2a4039bdc253..daf1fbdb6a2a66 100644
--- a/deps/v8/src/ppc/macro-assembler-ppc.h
+++ b/deps/v8/src/ppc/macro-assembler-ppc.h
@@ -10,6 +10,7 @@
 #include "src/double.h"
 #include "src/globals.h"
 #include "src/ppc/assembler-ppc.h"
+#include "src/turbo-assembler.h"
 
 namespace v8 {
 namespace internal {
@@ -26,12 +27,17 @@ constexpr Register kInterpreterAccumulatorRegister = r3;
 constexpr Register kInterpreterBytecodeOffsetRegister = r15;
 constexpr Register kInterpreterBytecodeArrayRegister = r16;
 constexpr Register kInterpreterDispatchTableRegister = r17;
+
 constexpr Register kJavaScriptCallArgCountRegister = r3;
-constexpr Register kJavaScriptCallNewTargetRegister = r6;
 constexpr Register kJavaScriptCallCodeStartRegister = r5;
+constexpr Register kJavaScriptCallTargetRegister = kJSFunctionRegister;
+constexpr Register kJavaScriptCallNewTargetRegister = r6;
+constexpr Register kJavaScriptCallExtraArg1Register = r5;
+
 constexpr Register kOffHeapTrampolineRegister = ip;
 constexpr Register kRuntimeCallFunctionRegister = r4;
 constexpr Register kRuntimeCallArgCountRegister = r3;
+constexpr Register kWasmInstanceRegister = r10;
 
 // ----------------------------------------------------------------------------
 // Static helper functions
@@ -109,20 +115,14 @@ bool AreAliased(DoubleRegister reg1, DoubleRegister reg2,
 #define Div divw
 #endif
 
-class TurboAssembler : public Assembler {
+class TurboAssembler : public TurboAssemblerBase {
  public:
-  TurboAssembler(Isolate* isolate, void* buffer, int buffer_size,
-                 CodeObjectRequired create_code_object);
-
-  void set_has_frame(bool value) { has_frame_ = value; }
-  bool has_frame() { return has_frame_; }
-
-  Isolate* isolate() const { return isolate_; }
+  TurboAssembler(Isolate* isolate, const AssemblerOptions& options,
+                 void* buffer, int buffer_size,
+                 CodeObjectRequired create_code_object)
+      : TurboAssemblerBase(isolate, options, buffer, buffer_size,
+                           create_code_object) {}
 
-  Handle<HeapObject> CodeObject() {
-    DCHECK(!code_object_.is_null());
-    return code_object_;
-  }
   // Converts the integer (untagged smi) in |src| to a double, storing
   // the result to |dst|
   void ConvertIntToDouble(Register src, DoubleRegister dst);
@@ -193,6 +193,7 @@ class TurboAssembler : public Assembler {
     ExternalReference roots_array_start =
         ExternalReference::roots_array_start(isolate());
     mov(kRootRegister, Operand(roots_array_start));
+    addi(kRootRegister, kRootRegister, Operand(kRootRegisterBias));
   }
 
   // These exist to provide portability between 32 and 64bit
@@ -229,6 +230,8 @@ class TurboAssembler : public Assembler {
   void StoreSingleU(DoubleRegister src, const MemOperand& mem,
                     Register scratch = no_reg);
 
+  void Cmpi(Register src1, const Operand& src2, Register scratch,
+            CRegister cr = cr7);
   void Cmpli(Register src1, const Operand& src2, Register scratch,
              CRegister cr = cr7);
   void Cmpwi(Register src1, const Operand& src2, Register scratch,
@@ -345,8 +348,11 @@ class TurboAssembler : public Assembler {
                      Register exclusion3 = no_reg);
 
   // Load an object from the root table.
+  void LoadRoot(Register destination, Heap::RootListIndex index) override {
+    LoadRoot(destination, index, al);
+  }
   void LoadRoot(Register destination, Heap::RootListIndex index,
-                Condition cond = al);
+                Condition cond);
 
   void SwapP(Register src, Register dst, Register scratch);
   void SwapP(Register src, MemOperand dst, Register scratch);
@@ -401,8 +407,10 @@ class TurboAssembler : public Assembler {
   void CallCFunction(Register function, int num_reg_arguments,
                      int num_double_arguments);
 
-  void CallRuntimeDelayed(Zone* zone, Runtime::FunctionId fid,
-                          SaveFPRegsMode save_doubles = kDontSaveFPRegs);
+  // Call a runtime routine. This expects {centry} to contain a fitting CEntry
+  // builtin for the target runtime function and uses an indirect call.
+  void CallRuntimeWithCEntry(Runtime::FunctionId fid, Register centry);
+
   void MovFromFloatParameter(DoubleRegister dst);
   void MovFromFloatResult(DoubleRegister dst);
 
@@ -431,6 +439,12 @@ class TurboAssembler : public Assembler {
   void ShiftRightAlgPair(Register dst_low, Register dst_high, Register src_low,
                          Register src_high, uint32_t shift);
 #endif
+
+  void LoadFromConstantsTable(Register destination,
+                              int constant_index) override;
+  void LoadRootRegisterOffset(Register destination, intptr_t offset) override;
+  void LoadRootRelative(Register destination, int32_t offset) override;
+
   // Returns the size of a call in instructions. Note, the value returned is
   // only valid as long as no entries are added to the constant pool between
   // checking the call size and emitting the actual call.
@@ -443,6 +457,8 @@ class TurboAssembler : public Assembler {
             CRegister cr = cr7);
   void Jump(Handle<Code> code, RelocInfo::Mode rmode, Condition cond = al,
             CRegister cr = cr7);
+  void Jump(intptr_t target, RelocInfo::Mode rmode, Condition cond = al,
+            CRegister cr = cr7);
   void Call(Register target);
   void Call(Address target, RelocInfo::Mode rmode, Condition cond = al);
   int CallSize(Handle<Code> code,
@@ -452,7 +468,9 @@ class TurboAssembler : public Assembler {
             Condition cond = al);
   void Call(Label* target);
 
-  void CallForDeoptimization(Address target, RelocInfo::Mode rmode) {
+  void CallForDeoptimization(Address target, int deopt_id,
+                             RelocInfo::Mode rmode) {
+    USE(deopt_id);
     Call(target, rmode);
   }
 
@@ -503,6 +521,7 @@ class TurboAssembler : public Assembler {
   // Register move. May do nothing if the registers are identical.
   void Move(Register dst, Smi* smi) { LoadSmiLiteral(dst, smi); }
   void Move(Register dst, Handle<HeapObject> value);
+  void Move(Register dst, ExternalReference reference);
   void Move(Register dst, Register src, Condition cond = al);
   void Move(DoubleRegister dst, DoubleRegister src);
 
@@ -602,6 +621,9 @@ class TurboAssembler : public Assembler {
     TestIfSmi(value, r0);
     beq(smi_label, cr0);  // branch if SMI
   }
+  void JumpIfEqual(Register x, int32_t y, Label* dest);
+  void JumpIfLessThan(Register x, int32_t y, Label* dest);
+
 #if V8_TARGET_ARCH_PPC64
   inline void TestIfInt32(Register value, Register scratch,
                           CRegister cr = cr7) {
@@ -644,8 +666,8 @@ class TurboAssembler : public Assembler {
   // Only public for the test code in test-code-stubs-arm.cc.
   void TryInlineTruncateDoubleToI(Register result, DoubleRegister input,
                                   Label* done);
-  void TruncateDoubleToIDelayed(Zone* zone, Register result,
-                                DoubleRegister double_input);
+  void TruncateDoubleToI(Isolate* isolate, Zone* zone, Register result,
+                         DoubleRegister double_input, StubCallMode stub_mode);
 
   // Call a code stub.
   void CallStubDelayed(CodeStub* stub);
@@ -667,13 +689,6 @@ class TurboAssembler : public Assembler {
  private:
   static const int kSmiShift = kSmiTagSize + kSmiShiftSize;
 
-  bool has_frame_ = false;
-  Isolate* const isolate_;
-  // This handle will be patched with the code object on installation.
-  Handle<HeapObject> code_object_;
-
-  void Jump(intptr_t target, RelocInfo::Mode rmode, Condition cond = al,
-            CRegister cr = cr7);
   int CalculateStackPassedWords(int num_reg_arguments,
                                 int num_double_arguments);
   void CallCFunctionHelper(Register function, int num_reg_arguments,
@@ -684,7 +699,11 @@ class TurboAssembler : public Assembler {
 class MacroAssembler : public TurboAssembler {
  public:
   MacroAssembler(Isolate* isolate, void* buffer, int size,
-                 CodeObjectRequired create_code_object);
+                 CodeObjectRequired create_code_object)
+      : MacroAssembler(isolate, AssemblerOptions::Default(isolate), buffer,
+                       size, create_code_object) {}
+  MacroAssembler(Isolate* isolate, const AssemblerOptions& options,
+                 void* buffer, int size, CodeObjectRequired create_code_object);
 
   // ---------------------------------------------------------------------------
   // GC Support
@@ -781,7 +800,8 @@ class MacroAssembler : public TurboAssembler {
   void LoadWord(Register dst, const MemOperand& mem, Register scratch);
   void StoreWord(Register src, const MemOperand& mem, Register scratch);
 
-  void LoadHalfWord(Register dst, const MemOperand& mem, Register scratch);
+  void LoadHalfWord(Register dst, const MemOperand& mem,
+                    Register scratch = no_reg);
   void LoadHalfWordArith(Register dst, const MemOperand& mem,
                          Register scratch = no_reg);
   void StoreHalfWord(Register src, const MemOperand& mem, Register scratch);
@@ -796,8 +816,6 @@ class MacroAssembler : public TurboAssembler {
   void LoadDoubleU(DoubleRegister dst, const MemOperand& mem,
                    Register scratch = no_reg);
 
-  void Cmpi(Register src1, const Operand& src2, Register scratch,
-            CRegister cr = cr7);
   void Cmplwi(Register src1, const Operand& src2, Register scratch,
               CRegister cr = cr7);
   void And(Register ra, Register rs, const Operand& rb, RCBit rc = LeaveRC);
@@ -1006,9 +1024,6 @@ class MacroAssembler : public TurboAssembler {
 #define SmiWordOffset(offset) offset
 #endif
 
-  // Abort execution if argument is not a FixedArray, enabled via --debug-code.
-  void AssertFixedArray(Register object);
-
   // Abort execution if argument is not a Constructor, enabled via --debug-code.
   void AssertConstructor(Register object);
 
diff --git a/deps/v8/src/ppc/simulator-ppc.cc b/deps/v8/src/ppc/simulator-ppc.cc
index 6c517038bb5b2c..350d4687cef06a 100644
--- a/deps/v8/src/ppc/simulator-ppc.cc
+++ b/deps/v8/src/ppc/simulator-ppc.cc
@@ -348,7 +348,7 @@ void PPCDebugger::Debug() {
                  (strcmp(cmd, "printobject") == 0)) {
         if (argc == 2) {
           intptr_t value;
-          OFStream os(stdout);
+          StdoutStream os;
           if (GetValue(arg1, &value)) {
             Object* obj = reinterpret_cast<Object*>(value);
             os << arg1 << ": \n";
@@ -604,7 +604,7 @@ void PPCDebugger::Debug() {
         PrintF("    Stops are debug instructions inserted by\n");
         PrintF("    the Assembler::stop() function.\n");
         PrintF("    When hitting a stop, the Simulator will\n");
-        PrintF("    stop and and give control to the PPCDebugger.\n");
+        PrintF("    stop and give control to the PPCDebugger.\n");
         PrintF("    The first %d stop codes are watched:\n",
                Simulator::kNumOfWatchedStops);
         PrintF("    - They can be enabled / disabled: the Simulator\n");
@@ -1254,17 +1254,17 @@ void Simulator::SoftwareInterrupt(Instruction* instr) {
             case ExternalReference::BUILTIN_FP_FP_CALL:
             case ExternalReference::BUILTIN_COMPARE_CALL:
               PrintF("Call to host function at %p with args %f, %f",
-                     static_cast<void*>(FUNCTION_ADDR(generic_target)),
+                     reinterpret_cast<void*>(FUNCTION_ADDR(generic_target)),
                      dval0, dval1);
               break;
             case ExternalReference::BUILTIN_FP_CALL:
               PrintF("Call to host function at %p with arg %f",
-                     static_cast<void*>(FUNCTION_ADDR(generic_target)),
+                     reinterpret_cast<void*>(FUNCTION_ADDR(generic_target)),
                      dval0);
               break;
             case ExternalReference::BUILTIN_FP_INT_CALL:
               PrintF("Call to host function at %p with args %f, %" V8PRIdPTR,
-                     static_cast<void*>(FUNCTION_ADDR(generic_target)),
+                     reinterpret_cast<void*>(FUNCTION_ADDR(generic_target)),
                      dval0, ival);
               break;
             default:
@@ -1408,8 +1408,8 @@ void Simulator::SoftwareInterrupt(Instruction* instr) {
               "\t\t\t\targs %08" V8PRIxPTR ", %08" V8PRIxPTR ", %08" V8PRIxPTR
               ", %08" V8PRIxPTR ", %08" V8PRIxPTR ", %08" V8PRIxPTR
               ", %08" V8PRIxPTR ", %08" V8PRIxPTR ", %08" V8PRIxPTR,
-              static_cast<void*>(FUNCTION_ADDR(target)), arg[0], arg[1], arg[2],
-              arg[3], arg[4], arg[5], arg[6], arg[7], arg[8]);
+              reinterpret_cast<void*>(FUNCTION_ADDR(target)), arg[0], arg[1],
+              arg[2], arg[3], arg[4], arg[5], arg[6], arg[7], arg[8]);
           if (!stack_aligned) {
             PrintF(" with unaligned stack %08" V8PRIxPTR "\n",
                    get_register(sp));
@@ -3958,8 +3958,7 @@ void Simulator::Execute() {
   }
 }
 
-
-void Simulator::CallInternal(byte* entry) {
+void Simulator::CallInternal(Address entry) {
   // Adjust JS-based stack limit to C-based stack limit.
   isolate_->stack_guard()->AdjustStackLimitForSimulator();
 
@@ -3969,7 +3968,7 @@ void Simulator::CallInternal(byte* entry) {
     set_pc(*(reinterpret_cast<intptr_t*>(entry)));
   } else {
     // entry is the instruction address
-    set_pc(reinterpret_cast<intptr_t>(entry));
+    set_pc(static_cast<intptr_t>(entry));
   }
 
   if (ABI_CALL_VIA_IP) {
@@ -4080,7 +4079,7 @@ void Simulator::CallInternal(byte* entry) {
   set_register(fp, r31_val);
 }
 
-intptr_t Simulator::CallImpl(byte* entry, int argument_count,
+intptr_t Simulator::CallImpl(Address entry, int argument_count,
                              const intptr_t* arguments) {
   // Set up arguments
 
@@ -4117,22 +4116,19 @@ intptr_t Simulator::CallImpl(byte* entry, int argument_count,
   return get_register(r3);
 }
 
-
-void Simulator::CallFP(byte* entry, double d0, double d1) {
+void Simulator::CallFP(Address entry, double d0, double d1) {
   set_d_register_from_double(1, d0);
   set_d_register_from_double(2, d1);
   CallInternal(entry);
 }
 
-
-int32_t Simulator::CallFPReturnsInt(byte* entry, double d0, double d1) {
+int32_t Simulator::CallFPReturnsInt(Address entry, double d0, double d1) {
   CallFP(entry, d0, d1);
   int32_t result = get_register(r3);
   return result;
 }
 
-
-double Simulator::CallFPReturnsDouble(byte* entry, double d0, double d1) {
+double Simulator::CallFPReturnsDouble(Address entry, double d0, double d1) {
   CallFP(entry, d0, d1);
   return get_double_from_d_register(1);
 }
diff --git a/deps/v8/src/ppc/simulator-ppc.h b/deps/v8/src/ppc/simulator-ppc.h
index 45b350b742b6b6..22f34015a66e36 100644
--- a/deps/v8/src/ppc/simulator-ppc.h
+++ b/deps/v8/src/ppc/simulator-ppc.h
@@ -156,9 +156,7 @@ class Simulator : public SimulatorBase {
   void set_pc(intptr_t value);
   intptr_t get_pc() const;
 
-  Address get_sp() const {
-    return reinterpret_cast<Address>(static_cast<intptr_t>(get_register(sp)));
-  }
+  Address get_sp() const { return static_cast<Address>(get_register(sp)); }
 
   // Accessor to the internal simulator stack area.
   uintptr_t StackLimit(uintptr_t c_limit) const;
@@ -167,14 +165,14 @@ class Simulator : public SimulatorBase {
   void Execute();
 
   template <typename Return, typename... Args>
-  Return Call(byte* entry, Args... args) {
+  Return Call(Address entry, Args... args) {
     return VariadicCall<Return>(this, &Simulator::CallImpl, entry, args...);
   }
 
   // Alternative: call a 2-argument double function.
-  void CallFP(byte* entry, double d0, double d1);
-  int32_t CallFPReturnsInt(byte* entry, double d0, double d1);
-  double CallFPReturnsDouble(byte* entry, double d0, double d1);
+  void CallFP(Address entry, double d0, double d1);
+  int32_t CallFPReturnsInt(Address entry, double d0, double d1);
+  double CallFPReturnsDouble(Address entry, double d0, double d1);
 
   // Push an address onto the JS stack.
   uintptr_t PushAddress(uintptr_t address);
@@ -210,7 +208,8 @@ class Simulator : public SimulatorBase {
     end_sim_pc = -2
   };
 
-  intptr_t CallImpl(byte* entry, int argument_count, const intptr_t* arguments);
+  intptr_t CallImpl(Address entry, int argument_count,
+                    const intptr_t* arguments);
 
   enum BCType { BC_OFFSET, BC_LINK_REG, BC_CTR_REG };
 
@@ -304,7 +303,7 @@ class Simulator : public SimulatorBase {
   void SetFpResult(const double& result);
   void TrashCallerSaveRegisters();
 
-  void CallInternal(byte* entry);
+  void CallInternal(Address entry);
 
   // Architecture state.
   // Saturating instructions require a Q flag to indicate saturation.
diff --git a/deps/v8/src/profiler/allocation-tracker.cc b/deps/v8/src/profiler/allocation-tracker.cc
index 3dad4ae208e78c..21843325f93e83 100644
--- a/deps/v8/src/profiler/allocation-tracker.cc
+++ b/deps/v8/src/profiler/allocation-tracker.cc
@@ -144,8 +144,8 @@ void AddressToTraceMap::Clear() {
 void AddressToTraceMap::Print() {
   PrintF("[AddressToTraceMap (%" PRIuS "): \n", ranges_.size());
   for (RangeMap::iterator it = ranges_.begin(); it != ranges_.end(); ++it) {
-    PrintF("[%p - %p] => %u\n", static_cast<void*>(it->second.start),
-           static_cast<void*>(it->first), it->second.trace_node_id);
+    PrintF("[%p - %p] => %u\n", reinterpret_cast<void*>(it->second.start),
+           reinterpret_cast<void*>(it->first), it->second.trace_node_id);
   }
   PrintF("]\n");
 }
@@ -249,7 +249,7 @@ unsigned AllocationTracker::AddFunctionInfo(SharedFunctionInfo* shared,
       reinterpret_cast<void*>(id), SnapshotObjectIdHash(id));
   if (entry->value == nullptr) {
     FunctionInfo* info = new FunctionInfo();
-    info->name = names_->GetFunctionName(shared->DebugName());
+    info->name = names_->GetName(shared->DebugName());
     info->function_id = id;
     if (shared->script()->IsScript()) {
       Script* script = Script::cast(shared->script());
diff --git a/deps/v8/src/profiler/cpu-profiler-inl.h b/deps/v8/src/profiler/cpu-profiler-inl.h
index 3bc6541048b2d8..c26c9ee06d6d54 100644
--- a/deps/v8/src/profiler/cpu-profiler-inl.h
+++ b/deps/v8/src/profiler/cpu-profiler-inl.h
@@ -35,7 +35,11 @@ void CodeDisableOptEventRecord::UpdateCodeMap(CodeMap* code_map) {
 
 void CodeDeoptEventRecord::UpdateCodeMap(CodeMap* code_map) {
   CodeEntry* entry = code_map->FindEntry(start);
-  if (entry != nullptr) entry->set_deopt_info(deopt_reason, deopt_id);
+  if (entry == nullptr) return;
+  std::vector<CpuProfileDeoptFrame> frames_vector(
+      deopt_frames, deopt_frames + deopt_frame_count);
+  entry->set_deopt_info(deopt_reason, deopt_id, std::move(frames_vector));
+  delete[] deopt_frames;
 }
 
 
diff --git a/deps/v8/src/profiler/cpu-profiler.cc b/deps/v8/src/profiler/cpu-profiler.cc
index 841ce6000fe951..e96b4b63aa7c31 100644
--- a/deps/v8/src/profiler/cpu-profiler.cc
+++ b/deps/v8/src/profiler/cpu-profiler.cc
@@ -4,6 +4,9 @@
 
 #include "src/profiler/cpu-profiler.h"
 
+#include <unordered_map>
+#include <utility>
+
 #include "src/base/lazy-instance.h"
 #include "src/base/platform/mutex.h"
 #include "src/base/template-utils.h"
@@ -70,9 +73,9 @@ void ProfilerEventsProcessor::AddDeoptStack(Isolate* isolate, Address from,
   TickSampleEventRecord record(last_code_event_id_.Value());
   RegisterState regs;
   Address fp = isolate->c_entry_fp(isolate->thread_local_top());
-  regs.sp = fp - fp_to_sp_delta;
-  regs.fp = fp;
-  regs.pc = from;
+  regs.sp = reinterpret_cast<void*>(fp - fp_to_sp_delta);
+  regs.fp = reinterpret_cast<void*>(fp);
+  regs.pc = reinterpret_cast<void*>(from);
   record.sample.Init(isolate, regs, TickSample::kSkipCEntryFrame, false, false);
   ticks_from_vm_buffer_.Enqueue(record);
 }
@@ -84,9 +87,9 @@ void ProfilerEventsProcessor::AddCurrentStack(Isolate* isolate,
   StackFrameIterator it(isolate);
   if (!it.done()) {
     StackFrame* frame = it.frame();
-    regs.sp = frame->sp();
-    regs.fp = frame->fp();
-    regs.pc = frame->pc();
+    regs.sp = reinterpret_cast<void*>(frame->sp());
+    regs.fp = reinterpret_cast<void*>(frame->fp());
+    regs.pc = reinterpret_cast<void*>(frame->pc());
   }
   record.sample.Init(isolate, regs, TickSample::kSkipCEntryFrame, update_stats,
                      false);
@@ -235,7 +238,7 @@ void CpuProfiler::CodeEventHandler(const CodeEventsContainer& evt_rec) {
       break;
     case CodeEventRecord::CODE_DEOPT: {
       const CodeDeoptEventRecord* rec = &evt_rec.CodeDeoptEventRecord_;
-      Address pc = reinterpret_cast<Address>(rec->pc);
+      Address pc = rec->pc;
       int fp_to_sp_delta = rec->fp_to_sp_delta;
       processor_->Enqueue(evt_rec);
       processor_->AddDeoptStack(isolate_, pc, fp_to_sp_delta);
@@ -252,33 +255,30 @@ class CpuProfilersManager {
  public:
   void AddProfiler(Isolate* isolate, CpuProfiler* profiler) {
     base::LockGuard<base::Mutex> lock(&mutex_);
-    auto result = profilers_.insert(
-        std::pair<Isolate*, std::unique_ptr<std::set<CpuProfiler*>>>(
-            isolate, base::make_unique<std::set<CpuProfiler*>>()));
-    result.first->second->insert(profiler);
+    profilers_.emplace(isolate, profiler);
   }
 
   void RemoveProfiler(Isolate* isolate, CpuProfiler* profiler) {
     base::LockGuard<base::Mutex> lock(&mutex_);
-    auto it = profilers_.find(isolate);
-    DCHECK(it != profilers_.end());
-    it->second->erase(profiler);
-    if (it->second->empty()) {
+    auto range = profilers_.equal_range(isolate);
+    for (auto it = range.first; it != range.second; ++it) {
+      if (it->second != profiler) continue;
       profilers_.erase(it);
+      return;
     }
+    UNREACHABLE();
   }
 
   void CallCollectSample(Isolate* isolate) {
     base::LockGuard<base::Mutex> lock(&mutex_);
-    auto profilers = profilers_.find(isolate);
-    if (profilers == profilers_.end()) return;
-    for (auto it : *profilers->second) {
-      it->CollectSample();
+    auto range = profilers_.equal_range(isolate);
+    for (auto it = range.first; it != range.second; ++it) {
+      it->second->CollectSample();
     }
   }
 
  private:
-  std::map<Isolate*, std::unique_ptr<std::set<CpuProfiler*>>> profilers_;
+  std::unordered_multimap<Isolate*, CpuProfiler*> profilers_;
   base::Mutex mutex_;
 };
 
@@ -318,20 +318,19 @@ void CpuProfiler::set_sampling_interval(base::TimeDelta value) {
 void CpuProfiler::ResetProfiles() {
   profiles_.reset(new CpuProfilesCollection(isolate_));
   profiles_->set_cpu_profiler(this);
+  profiler_listener_.reset();
+  generator_.reset();
 }
 
 void CpuProfiler::CreateEntriesForRuntimeCallStats() {
-  static_entries_.clear();
   RuntimeCallStats* rcs = isolate_->counters()->runtime_call_stats();
   CodeMap* code_map = generator_->code_map();
   for (int i = 0; i < RuntimeCallStats::kNumberOfCounters; ++i) {
     RuntimeCallCounter* counter = rcs->GetCounter(i);
     DCHECK(counter->name());
-    std::unique_ptr<CodeEntry> entry(
-        new CodeEntry(CodeEventListener::FUNCTION_TAG, counter->name(),
-                      CodeEntry::kEmptyNamePrefix, "native V8Runtime"));
-    code_map->AddCode(reinterpret_cast<Address>(counter), entry.get(), 1);
-    static_entries_.push_back(std::move(entry));
+    auto entry = new CodeEntry(CodeEventListener::FUNCTION_TAG, counter->name(),
+                               "native V8Runtime");
+    code_map->AddCode(reinterpret_cast<Address>(counter), entry, 1);
   }
 }
 
@@ -346,20 +345,20 @@ void CpuProfiler::CollectSample() {
   }
 }
 
-void CpuProfiler::StartProfiling(const char* title, bool record_samples) {
-  if (profiles_->StartProfiling(title, record_samples)) {
+void CpuProfiler::StartProfiling(const char* title, bool record_samples,
+                                 ProfilingMode mode) {
+  if (profiles_->StartProfiling(title, record_samples, mode)) {
     TRACE_EVENT0("v8", "CpuProfiler::StartProfiling");
     StartProcessorIfNotStarted();
   }
 }
 
-
-void CpuProfiler::StartProfiling(String* title, bool record_samples) {
-  StartProfiling(profiles_->GetName(title), record_samples);
+void CpuProfiler::StartProfiling(String* title, bool record_samples,
+                                 ProfilingMode mode) {
+  StartProfiling(profiles_->GetName(title), record_samples, mode);
   isolate_->debug()->feature_tracker()->Track(DebugFeatureTracker::kProfiler);
 }
 
-
 void CpuProfiler::StartProcessorIfNotStarted() {
   if (processor_) {
     processor_->AddCurrentStack(isolate_);
@@ -369,13 +368,16 @@ void CpuProfiler::StartProcessorIfNotStarted() {
   // Disable logging when using the new implementation.
   saved_is_logging_ = logger->is_logging_;
   logger->is_logging_ = false;
-  generator_.reset(new ProfileGenerator(profiles_.get()));
+  if (!generator_) {
+    generator_.reset(new ProfileGenerator(profiles_.get()));
+    CreateEntriesForRuntimeCallStats();
+  }
   processor_.reset(new ProfilerEventsProcessor(isolate_, generator_.get(),
                                                sampling_interval_));
-  CreateEntriesForRuntimeCallStats();
-  logger->SetUpProfilerListener();
-  ProfilerListener* profiler_listener = logger->profiler_listener();
-  profiler_listener->AddObserver(this);
+  if (!profiler_listener_) {
+    profiler_listener_.reset(new ProfilerListener(isolate_, this));
+  }
+  logger->AddCodeEventListener(profiler_listener_.get());
   is_profiling_ = true;
   isolate_->set_is_profiling(true);
   // Enumerate stuff we already have in the heap.
@@ -410,12 +412,9 @@ void CpuProfiler::StopProcessor() {
   Logger* logger = isolate_->logger();
   is_profiling_ = false;
   isolate_->set_is_profiling(false);
-  ProfilerListener* profiler_listener = logger->profiler_listener();
-  profiler_listener->RemoveObserver(this);
+  logger->RemoveCodeEventListener(profiler_listener_.get());
   processor_->StopSynchronously();
-  logger->TearDownProfilerListener();
   processor_.reset();
-  generator_.reset();
   logger->is_logging_ = saved_is_logging_;
 }
 
diff --git a/deps/v8/src/profiler/cpu-profiler.h b/deps/v8/src/profiler/cpu-profiler.h
index e6e3fea33381b7..4502b35f8538b8 100644
--- a/deps/v8/src/profiler/cpu-profiler.h
+++ b/deps/v8/src/profiler/cpu-profiler.h
@@ -57,7 +57,7 @@ class CodeCreateEventRecord : public CodeEventRecord {
   CodeEntry* entry;
   unsigned size;
 
-  INLINE(void UpdateCodeMap(CodeMap* code_map));
+  V8_INLINE void UpdateCodeMap(CodeMap* code_map);
 };
 
 
@@ -66,7 +66,7 @@ class CodeMoveEventRecord : public CodeEventRecord {
   Address from;
   Address to;
 
-  INLINE(void UpdateCodeMap(CodeMap* code_map));
+  V8_INLINE void UpdateCodeMap(CodeMap* code_map);
 };
 
 
@@ -75,7 +75,7 @@ class CodeDisableOptEventRecord : public CodeEventRecord {
   Address start;
   const char* bailout_reason;
 
-  INLINE(void UpdateCodeMap(CodeMap* code_map));
+  V8_INLINE void UpdateCodeMap(CodeMap* code_map);
 };
 
 
@@ -84,10 +84,12 @@ class CodeDeoptEventRecord : public CodeEventRecord {
   Address start;
   const char* deopt_reason;
   int deopt_id;
-  void* pc;
+  Address pc;
   int fp_to_sp_delta;
+  CpuProfileDeoptFrame* deopt_frames;
+  int deopt_frame_count;
 
-  INLINE(void UpdateCodeMap(CodeMap* code_map));
+  V8_INLINE void UpdateCodeMap(CodeMap* code_map);
 };
 
 
@@ -96,7 +98,7 @@ class ReportBuiltinEventRecord : public CodeEventRecord {
   Address start;
   Builtins::Name builtin_id;
 
-  INLINE(void UpdateCodeMap(CodeMap* code_map));
+  V8_INLINE void UpdateCodeMap(CodeMap* code_map);
 };
 
 
@@ -138,7 +140,7 @@ class ProfilerEventsProcessor : public base::Thread {
   // Thread control.
   virtual void Run();
   void StopSynchronously();
-  INLINE(bool running()) { return !!base::Relaxed_Load(&running_); }
+  V8_INLINE bool running() { return !!base::Relaxed_Load(&running_); }
   void Enqueue(const CodeEventsContainer& event);
 
   // Puts current stack into tick sample events buffer.
@@ -197,10 +199,13 @@ class CpuProfiler : public CodeEventObserver {
 
   static void CollectSample(Isolate* isolate);
 
+  typedef v8::CpuProfilingMode ProfilingMode;
+
   void set_sampling_interval(base::TimeDelta value);
   void CollectSample();
-  void StartProfiling(const char* title, bool record_samples = false);
-  void StartProfiling(String* title, bool record_samples);
+  void StartProfiling(const char* title, bool record_samples = false,
+                      ProfilingMode mode = ProfilingMode::kLeafNodeLineNumbers);
+  void StartProfiling(String* title, bool record_samples, ProfilingMode mode);
   CpuProfile* StopProfiling(const char* title);
   CpuProfile* StopProfiling(String* title);
   int GetProfilesCount();
@@ -216,6 +221,10 @@ class CpuProfiler : public CodeEventObserver {
   ProfilerEventsProcessor* processor() const { return processor_.get(); }
   Isolate* isolate() const { return isolate_; }
 
+  ProfilerListener* profiler_listener_for_test() {
+    return profiler_listener_.get();
+  }
+
  private:
   void StartProcessorIfNotStarted();
   void StopProcessorIfLastProfile(const char* title);
@@ -229,7 +238,7 @@ class CpuProfiler : public CodeEventObserver {
   std::unique_ptr<CpuProfilesCollection> profiles_;
   std::unique_ptr<ProfileGenerator> generator_;
   std::unique_ptr<ProfilerEventsProcessor> processor_;
-  std::vector<std::unique_ptr<CodeEntry>> static_entries_;
+  std::unique_ptr<ProfilerListener> profiler_listener_;
   bool saved_is_logging_;
   bool is_profiling_;
 
@@ -239,5 +248,4 @@ class CpuProfiler : public CodeEventObserver {
 }  // namespace internal
 }  // namespace v8
 
-
 #endif  // V8_PROFILER_CPU_PROFILER_H_
diff --git a/deps/v8/src/profiler/heap-profiler.cc b/deps/v8/src/profiler/heap-profiler.cc
index 7e0bcec97ae75e..f930a77eb16561 100644
--- a/deps/v8/src/profiler/heap-profiler.cc
+++ b/deps/v8/src/profiler/heap-profiler.cc
@@ -16,14 +16,14 @@ namespace internal {
 
 HeapProfiler::HeapProfiler(Heap* heap)
     : ids_(new HeapObjectsMap(heap)),
-      names_(new StringsStorage(heap)),
+      names_(new StringsStorage(heap->HashSeed())),
       is_tracking_object_moves_(false) {}
 
 HeapProfiler::~HeapProfiler() = default;
 
 void HeapProfiler::DeleteAllSnapshots() {
   snapshots_.clear();
-  names_.reset(new StringsStorage(heap()));
+  names_.reset(new StringsStorage(heap()->HashSeed()));
 }
 
 
@@ -69,16 +69,25 @@ v8::HeapProfiler::RetainerInfos HeapProfiler::GetRetainerInfos(
   return infos;
 }
 
-void HeapProfiler::SetBuildEmbedderGraphCallback(
-    v8::HeapProfiler::BuildEmbedderGraphCallback callback) {
-  build_embedder_graph_callback_ = callback;
+void HeapProfiler::AddBuildEmbedderGraphCallback(
+    v8::HeapProfiler::BuildEmbedderGraphCallback callback, void* data) {
+  build_embedder_graph_callbacks_.push_back({callback, data});
+}
+
+void HeapProfiler::RemoveBuildEmbedderGraphCallback(
+    v8::HeapProfiler::BuildEmbedderGraphCallback callback, void* data) {
+  auto it = std::find(build_embedder_graph_callbacks_.begin(),
+                      build_embedder_graph_callbacks_.end(),
+                      std::make_pair(callback, data));
+  if (it != build_embedder_graph_callbacks_.end())
+    build_embedder_graph_callbacks_.erase(it);
 }
 
 void HeapProfiler::BuildEmbedderGraph(Isolate* isolate,
                                       v8::EmbedderGraph* graph) {
-  if (build_embedder_graph_callback_ != nullptr)
-    build_embedder_graph_callback_(reinterpret_cast<v8::Isolate*>(isolate),
-                                   graph);
+  for (const auto& cb : build_embedder_graph_callbacks_) {
+    cb.first(reinterpret_cast<v8::Isolate*>(isolate), graph, cb.second);
+  }
 }
 
 HeapSnapshot* HeapProfiler::TakeSnapshot(
@@ -200,7 +209,8 @@ Handle<HeapObject> HeapProfiler::FindHeapObjectById(SnapshotObjectId id) {
       // Can't break -- kFilterUnreachable requires full heap traversal.
     }
   }
-  return object != nullptr ? Handle<HeapObject>(object) : Handle<HeapObject>();
+  return object != nullptr ? Handle<HeapObject>(object, isolate())
+                           : Handle<HeapObject>();
 }
 
 
@@ -224,9 +234,9 @@ void HeapProfiler::QueryObjects(Handle<Context> context,
   HeapIterator heap_iterator(heap());
   HeapObject* heap_obj;
   while ((heap_obj = heap_iterator.next()) != nullptr) {
-    if (!heap_obj->IsJSObject() || heap_obj->IsExternal()) continue;
+    if (!heap_obj->IsJSObject() || heap_obj->IsExternal(isolate())) continue;
     v8::Local<v8::Object> v8_obj(
-        Utils::ToLocal(handle(JSObject::cast(heap_obj))));
+        Utils::ToLocal(handle(JSObject::cast(heap_obj), isolate())));
     if (!predicate->Filter(v8_obj)) continue;
     objects->Append(v8_obj);
   }
diff --git a/deps/v8/src/profiler/heap-profiler.h b/deps/v8/src/profiler/heap-profiler.h
index 507dd579bffb65..fc0b005e1c67ce 100644
--- a/deps/v8/src/profiler/heap-profiler.h
+++ b/deps/v8/src/profiler/heap-profiler.h
@@ -71,11 +71,13 @@ class HeapProfiler : public HeapObjectAllocationTracker {
       v8::HeapProfiler::GetRetainerInfosCallback callback);
   v8::HeapProfiler::RetainerInfos GetRetainerInfos(Isolate* isolate);
 
-  void SetBuildEmbedderGraphCallback(
-      v8::HeapProfiler::BuildEmbedderGraphCallback callback);
+  void AddBuildEmbedderGraphCallback(
+      v8::HeapProfiler::BuildEmbedderGraphCallback callback, void* data);
+  void RemoveBuildEmbedderGraphCallback(
+      v8::HeapProfiler::BuildEmbedderGraphCallback callback, void* data);
   void BuildEmbedderGraph(Isolate* isolate, v8::EmbedderGraph* graph);
   bool HasBuildEmbedderGraphCallback() {
-    return build_embedder_graph_callback_ != nullptr;
+    return !build_embedder_graph_callbacks_.empty();
   }
 
   bool is_tracking_object_moves() const { return is_tracking_object_moves_; }
@@ -103,8 +105,8 @@ class HeapProfiler : public HeapObjectAllocationTracker {
   std::unique_ptr<SamplingHeapProfiler> sampling_heap_profiler_;
   v8::HeapProfiler::GetRetainerInfosCallback get_retainer_infos_callback_ =
       nullptr;
-  v8::HeapProfiler::BuildEmbedderGraphCallback build_embedder_graph_callback_ =
-      nullptr;
+  std::vector<std::pair<v8::HeapProfiler::BuildEmbedderGraphCallback, void*>>
+      build_embedder_graph_callbacks_;
 
   DISALLOW_COPY_AND_ASSIGN(HeapProfiler);
 };
diff --git a/deps/v8/src/profiler/heap-snapshot-generator.cc b/deps/v8/src/profiler/heap-snapshot-generator.cc
index fb61246867709a..ff977cc0c005db 100644
--- a/deps/v8/src/profiler/heap-snapshot-generator.cc
+++ b/deps/v8/src/profiler/heap-snapshot-generator.cc
@@ -14,6 +14,12 @@
 #include "src/layout-descriptor.h"
 #include "src/objects-body-descriptors.h"
 #include "src/objects-inl.h"
+#include "src/objects/api-callbacks.h"
+#include "src/objects/hash-table-inl.h"
+#include "src/objects/js-collection-inl.h"
+#include "src/objects/js-promise-inl.h"
+#include "src/objects/js-regexp-inl.h"
+#include "src/objects/literal-objects-inl.h"
 #include "src/profiler/allocation-tracker.h"
 #include "src/profiler/heap-profiler.h"
 #include "src/profiler/heap-snapshot-generator-inl.h"
@@ -315,27 +321,29 @@ HeapObjectsMap::HeapObjectsMap(Heap* heap)
   // an entry with zero value. Otherwise it's impossible to tell if
   // LookupOrInsert has added a new item or just returning exisiting one
   // having the value of zero.
-  entries_.emplace_back(0, nullptr, 0, true);
+  entries_.emplace_back(0, kNullAddress, 0, true);
 }
 
 bool HeapObjectsMap::MoveObject(Address from, Address to, int object_size) {
-  DCHECK_NOT_NULL(to);
-  DCHECK_NOT_NULL(from);
+  DCHECK_NE(kNullAddress, to);
+  DCHECK_NE(kNullAddress, from);
   if (from == to) return false;
-  void* from_value = entries_map_.Remove(from, ComputePointerHash(from));
+  void* from_value = entries_map_.Remove(reinterpret_cast<void*>(from),
+                                         ComputeAddressHash(from));
   if (from_value == nullptr) {
     // It may occur that some untracked object moves to an address X and there
     // is a tracked object at that address. In this case we should remove the
     // entry as we know that the object has died.
-    void* to_value = entries_map_.Remove(to, ComputePointerHash(to));
+    void* to_value = entries_map_.Remove(reinterpret_cast<void*>(to),
+                                         ComputeAddressHash(to));
     if (to_value != nullptr) {
       int to_entry_info_index =
           static_cast<int>(reinterpret_cast<intptr_t>(to_value));
-      entries_.at(to_entry_info_index).addr = nullptr;
+      entries_.at(to_entry_info_index).addr = kNullAddress;
     }
   } else {
-    base::HashMap::Entry* to_entry =
-        entries_map_.LookupOrInsert(to, ComputePointerHash(to));
+    base::HashMap::Entry* to_entry = entries_map_.LookupOrInsert(
+        reinterpret_cast<void*>(to), ComputeAddressHash(to));
     if (to_entry->value != nullptr) {
       // We found the existing entry with to address for an old object.
       // Without this operation we will have two EntryInfo's with the same
@@ -344,7 +352,7 @@ bool HeapObjectsMap::MoveObject(Address from, Address to, int object_size) {
       // entry.
       int to_entry_info_index =
           static_cast<int>(reinterpret_cast<intptr_t>(to_entry->value));
-      entries_.at(to_entry_info_index).addr = nullptr;
+      entries_.at(to_entry_info_index).addr = kNullAddress;
     }
     int from_entry_info_index =
         static_cast<int>(reinterpret_cast<intptr_t>(from_value));
@@ -354,7 +362,7 @@ bool HeapObjectsMap::MoveObject(Address from, Address to, int object_size) {
     // object is migrated.
     if (FLAG_heap_profiler_trace_objects) {
       PrintF("Move object from %p to %p old size %6d new size %6d\n",
-             static_cast<void*>(from), static_cast<void*>(to),
+             reinterpret_cast<void*>(from), reinterpret_cast<void*>(to),
              entries_.at(from_entry_info_index).size, object_size);
     }
     entries_.at(from_entry_info_index).size = object_size;
@@ -370,8 +378,8 @@ void HeapObjectsMap::UpdateObjectSize(Address addr, int size) {
 
 
 SnapshotObjectId HeapObjectsMap::FindEntry(Address addr) {
-  base::HashMap::Entry* entry =
-      entries_map_.Lookup(addr, ComputePointerHash(addr));
+  base::HashMap::Entry* entry = entries_map_.Lookup(
+      reinterpret_cast<void*>(addr), ComputeAddressHash(addr));
   if (entry == nullptr) return 0;
   int entry_index = static_cast<int>(reinterpret_cast<intptr_t>(entry->value));
   EntryInfo& entry_info = entries_.at(entry_index);
@@ -384,8 +392,8 @@ SnapshotObjectId HeapObjectsMap::FindOrAddEntry(Address addr,
                                                 unsigned int size,
                                                 bool accessed) {
   DCHECK(static_cast<uint32_t>(entries_.size()) > entries_map_.occupancy());
-  base::HashMap::Entry* entry =
-      entries_map_.LookupOrInsert(addr, ComputePointerHash(addr));
+  base::HashMap::Entry* entry = entries_map_.LookupOrInsert(
+      reinterpret_cast<void*>(addr), ComputeAddressHash(addr));
   if (entry->value != nullptr) {
     int entry_index =
         static_cast<int>(reinterpret_cast<intptr_t>(entry->value));
@@ -393,7 +401,7 @@ SnapshotObjectId HeapObjectsMap::FindOrAddEntry(Address addr,
     entry_info.accessed = accessed;
     if (FLAG_heap_profiler_trace_objects) {
       PrintF("Update object size : %p with old size %d and new size %d\n",
-             static_cast<void*>(addr), entry_info.size, size);
+             reinterpret_cast<void*>(addr), entry_info.size, size);
     }
     entry_info.size = size;
     return entry_info.id;
@@ -421,8 +429,8 @@ void HeapObjectsMap::UpdateHeapObjectsMap() {
     FindOrAddEntry(obj->address(), obj->Size());
     if (FLAG_heap_profiler_trace_objects) {
       PrintF("Update object      : %p %6d. Next address is %p\n",
-             static_cast<void*>(obj->address()), obj->Size(),
-             static_cast<void*>(obj->address() + obj->Size()));
+             reinterpret_cast<void*>(obj->address()), obj->Size(),
+             reinterpret_cast<void*>(obj->address() + obj->Size()));
     }
   }
   RemoveDeadEntries();
@@ -484,7 +492,7 @@ SnapshotObjectId HeapObjectsMap::PushHeapObjectsStats(OutputStream* stream,
 
 void HeapObjectsMap::RemoveDeadEntries() {
   DCHECK(entries_.size() > 0 && entries_.at(0).id == 0 &&
-         entries_.at(0).addr == nullptr);
+         entries_.at(0).addr == kNullAddress);
   size_t first_free_entry = 1;
   for (size_t i = 1; i < entries_.size(); ++i) {
     EntryInfo& entry_info = entries_.at(i);
@@ -493,15 +501,16 @@ void HeapObjectsMap::RemoveDeadEntries() {
         entries_.at(first_free_entry) = entry_info;
       }
       entries_.at(first_free_entry).accessed = false;
-      base::HashMap::Entry* entry = entries_map_.Lookup(
-          entry_info.addr, ComputePointerHash(entry_info.addr));
+      base::HashMap::Entry* entry =
+          entries_map_.Lookup(reinterpret_cast<void*>(entry_info.addr),
+                              ComputeAddressHash(entry_info.addr));
       DCHECK(entry);
       entry->value = reinterpret_cast<void*>(first_free_entry);
       ++first_free_entry;
     } else {
       if (entry_info.addr) {
-        entries_map_.Remove(entry_info.addr,
-                            ComputePointerHash(entry_info.addr));
+        entries_map_.Remove(reinterpret_cast<void*>(entry_info.addr),
+                            ComputeAddressHash(entry_info.addr));
       }
     }
   }
@@ -767,6 +776,8 @@ const char* V8HeapExplorer::GetSystemEntryName(HeapObject* object) {
     case PROPERTY_CELL_TYPE: return "system / PropertyCell";
     case FOREIGN_TYPE: return "system / Foreign";
     case ODDBALL_TYPE: return "system / Oddball";
+    case ALLOCATION_SITE_TYPE:
+      return "system / AllocationSite";
 #define MAKE_STRUCT_CASE(NAME, Name, name) \
     case NAME##_TYPE: return "system / "#Name;
   STRUCT_LIST(MAKE_STRUCT_CASE)
@@ -775,17 +786,13 @@ const char* V8HeapExplorer::GetSystemEntryName(HeapObject* object) {
   }
 }
 
-
-int V8HeapExplorer::EstimateObjectsCount(HeapIterator* iterator) {
+int V8HeapExplorer::EstimateObjectsCount() {
+  HeapIterator it(heap_, HeapIterator::kFilterUnreachable);
   int objects_count = 0;
-  for (HeapObject* obj = iterator->next(); obj != nullptr;
-       obj = iterator->next()) {
-    objects_count++;
-  }
+  while (it.next()) ++objects_count;
   return objects_count;
 }
 
-
 class IndexedReferencesExtractor : public ObjectVisitor {
  public:
   IndexedReferencesExtractor(V8HeapExplorer* generator, HeapObject* parent_obj,
@@ -815,9 +822,8 @@ class IndexedReferencesExtractor : public ObjectVisitor {
         continue;
       }
       HeapObject* heap_object;
-      // Weak references have been handled explicitly.
-      DCHECK(!(*p)->ToWeakHeapObject(&heap_object));
-      if ((*p)->ToStrongHeapObject(&heap_object)) {
+      if ((*p)->ToWeakHeapObject(&heap_object) ||
+          (*p)->ToStrongHeapObject(&heap_object)) {
         generator_->SetHiddenReference(parent_obj_, parent_, next_index,
                                        heap_object, index * kPointerSize);
       }
@@ -832,10 +838,7 @@ class IndexedReferencesExtractor : public ObjectVisitor {
   int parent_;
 };
 
-
-bool V8HeapExplorer::ExtractReferencesPass1(int entry, HeapObject* obj) {
-  if (obj->IsFixedArray()) return false;  // FixedArrays are processed on pass 2
-
+void V8HeapExplorer::ExtractReferences(int entry, HeapObject* obj) {
   if (obj->IsJSGlobalProxy()) {
     ExtractJSGlobalProxyReferences(entry, JSGlobalProxy::cast(obj));
   } else if (obj->IsJSArrayBuffer()) {
@@ -879,24 +882,24 @@ bool V8HeapExplorer::ExtractReferencesPass1(int entry, HeapObject* obj) {
     ExtractPropertyCellReferences(entry, PropertyCell::cast(obj));
   } else if (obj->IsAllocationSite()) {
     ExtractAllocationSiteReferences(entry, AllocationSite::cast(obj));
+  } else if (obj->IsArrayBoilerplateDescription()) {
+    ExtractArrayBoilerplateDescriptionReferences(
+        entry, ArrayBoilerplateDescription::cast(obj));
   } else if (obj->IsFeedbackVector()) {
     ExtractFeedbackVectorReferences(entry, FeedbackVector::cast(obj));
   } else if (obj->IsWeakFixedArray()) {
-    ExtractWeakFixedArrayReferences(entry, WeakFixedArray::cast(obj));
-  }
-  return true;
-}
-
-
-bool V8HeapExplorer::ExtractReferencesPass2(int entry, HeapObject* obj) {
-  if (!obj->IsFixedArray()) return false;
-
-  if (obj->IsContext()) {
+    ExtractWeakArrayReferences(WeakFixedArray::kHeaderSize, entry,
+                               WeakFixedArray::cast(obj));
+  } else if (obj->IsWeakArrayList()) {
+    ExtractWeakArrayReferences(WeakArrayList::kHeaderSize, entry,
+                               WeakArrayList::cast(obj));
+  } else if (obj->IsContext()) {
     ExtractContextReferences(entry, Context::cast(obj));
-  } else {
+  } else if (obj->IsEphemeronHashTable()) {
+    ExtractEphemeronHashTableReferences(entry, EphemeronHashTable::cast(obj));
+  } else if (obj->IsFixedArray()) {
     ExtractFixedArrayReferences(entry, FixedArray::cast(obj));
   }
-  return true;
 }
 
 
@@ -915,7 +918,8 @@ void V8HeapExplorer::ExtractJSObjectReferences(
   ExtractElementReferences(js_obj, entry);
   ExtractInternalReferences(js_obj, entry);
   PrototypeIterator iter(heap_->isolate(), js_obj);
-  SetPropertyReference(obj, entry, heap_->proto_string(), iter.GetCurrent());
+  ReadOnlyRoots roots(heap_);
+  SetPropertyReference(obj, entry, roots.proto_string(), iter.GetCurrent());
   if (obj->IsJSBoundFunction()) {
     JSBoundFunction* js_fun = JSBoundFunction::cast(obj);
     TagObject(js_fun->bound_arguments(), "(bound arguments)");
@@ -937,11 +941,11 @@ void V8HeapExplorer::ExtractJSObjectReferences(
       Object* proto_or_map = js_fun->prototype_or_initial_map();
       if (!proto_or_map->IsTheHole(heap_->isolate())) {
         if (!proto_or_map->IsMap()) {
-          SetPropertyReference(obj, entry, heap_->prototype_string(),
+          SetPropertyReference(obj, entry, roots.prototype_string(),
                                proto_or_map, nullptr,
                                JSFunction::kPrototypeOrInitialMapOffset);
         } else {
-          SetPropertyReference(obj, entry, heap_->prototype_string(),
+          SetPropertyReference(obj, entry, roots.prototype_string(),
                                js_fun->prototype());
           SetInternalReference(obj, entry, "initial_map", proto_or_map,
                                JSFunction::kPrototypeOrInitialMapOffset);
@@ -1026,14 +1030,34 @@ void V8HeapExplorer::ExtractJSCollectionReferences(int entry,
 
 void V8HeapExplorer::ExtractJSWeakCollectionReferences(int entry,
                                                        JSWeakCollection* obj) {
-  if (obj->table()->IsHashTable()) {
-    ObjectHashTable* table = ObjectHashTable::cast(obj->table());
-    TagFixedArraySubType(table, JS_WEAK_COLLECTION_SUB_TYPE);
-  }
   SetInternalReference(obj, entry, "table", obj->table(),
                        JSWeakCollection::kTableOffset);
 }
 
+void V8HeapExplorer::ExtractEphemeronHashTableReferences(
+    int entry, EphemeronHashTable* table) {
+  for (int i = 0, capacity = table->Capacity(); i < capacity; ++i) {
+    int key_index = EphemeronHashTable::EntryToIndex(i) +
+                    EphemeronHashTable::kEntryKeyIndex;
+    int value_index = EphemeronHashTable::EntryToValueIndex(i);
+    Object* key = table->get(key_index);
+    Object* value = table->get(value_index);
+    SetWeakReference(table, entry, key_index, key,
+                     table->OffsetOfElementAt(key_index));
+    SetInternalReference(table, entry, value_index, value,
+                         table->OffsetOfElementAt(value_index));
+    HeapEntry* key_entry = GetEntry(key);
+    int key_entry_index = key_entry->index();
+    HeapEntry* value_entry = GetEntry(value);
+    if (key_entry && value_entry) {
+      const char* edge_name =
+          names_->GetFormatted("key %s in WeakMap", key_entry->name());
+      filler_->SetNamedAutoIndexReference(
+          HeapGraphEdge::kInternal, key_entry_index, edge_name, value_entry);
+    }
+  }
+}
+
 void V8HeapExplorer::ExtractContextReferences(int entry, Context* context) {
   if (!context->IsNativeContext() && context->is_declaration_context()) {
     ScopeInfo* scope_info = context->scope_info();
@@ -1064,7 +1088,7 @@ void V8HeapExplorer::ExtractContextReferences(int entry, Context* context) {
     SetWeakReference(context, entry, #name, context->get(Context::index), \
         FixedArray::OffsetOfElementAt(Context::index)); \
   }
-  EXTRACT_CONTEXT_FIELD(CLOSURE_INDEX, JSFunction, closure);
+  EXTRACT_CONTEXT_FIELD(SCOPE_INFO_INDEX, ScopeInfo, scope_info);
   EXTRACT_CONTEXT_FIELD(PREVIOUS_INDEX, Context, previous);
   EXTRACT_CONTEXT_FIELD(EXTENSION_INDEX, HeapObject, extension);
   EXTRACT_CONTEXT_FIELD(NATIVE_CONTEXT_INDEX, Context, native_context);
@@ -1159,7 +1183,7 @@ void V8HeapExplorer::ExtractSharedFunctionInfoReferences(
   HeapObject* obj = shared;
   String* shared_name = shared->DebugName();
   const char* name = nullptr;
-  if (shared_name != heap_->empty_string()) {
+  if (shared_name != ReadOnlyRoots(heap_).empty_string()) {
     name = names_->GetName(shared_name);
     TagObject(shared->GetCode(), names_->GetFormatted("(code for %s)", name));
   } else {
@@ -1180,12 +1204,10 @@ void V8HeapExplorer::ExtractSharedFunctionInfoReferences(
   SetInternalReference(obj, entry,
                        "function_data", shared->function_data(),
                        SharedFunctionInfo::kFunctionDataOffset);
-  SetInternalReference(obj, entry,
-                       "debug_info", shared->debug_info(),
-                       SharedFunctionInfo::kDebugInfoOffset);
-  SetInternalReference(obj, entry, "function_identifier",
-                       shared->function_identifier(),
-                       SharedFunctionInfo::kFunctionIdentifierOffset);
+  SetInternalReference(
+      obj, entry, "function_identifier_or_debug_info",
+      shared->function_identifier_or_debug_info(),
+      SharedFunctionInfo::kFunctionIdentifierOrDebugInfoOffset);
   SetInternalReference(
       obj, entry, "raw_outer_scope_info_or_feedback_metadata",
       shared->raw_outer_scope_info_or_feedback_metadata(),
@@ -1297,10 +1319,13 @@ void V8HeapExplorer::ExtractAllocationSiteReferences(int entry,
   TagObject(site->dependent_code(), "(dependent code)");
   SetInternalReference(site, entry, "dependent_code", site->dependent_code(),
                        AllocationSite::kDependentCodeOffset);
-  // Do not visit weak_next as it is not visited by the ObjectVisitor,
-  // and we're not very interested in weak_next field here.
-  STATIC_ASSERT(AllocationSite::kWeakNextOffset >=
-                AllocationSite::kPointerFieldsEndOffset);
+}
+
+void V8HeapExplorer::ExtractArrayBoilerplateDescriptionReferences(
+    int entry, ArrayBoilerplateDescription* value) {
+  SetInternalReference(value, entry, "constant_elements",
+                       value->constant_elements(),
+                       ArrayBoilerplateDescription::kConstantElementsOffset);
 }
 
 class JSArrayBufferDataEntryAllocator : public HeapEntriesAllocator {
@@ -1310,9 +1335,9 @@ class JSArrayBufferDataEntryAllocator : public HeapEntriesAllocator {
       , explorer_(explorer) {
   }
   virtual HeapEntry* AllocateEntry(HeapThing ptr) {
-    return explorer_->AddEntry(
-        static_cast<Address>(ptr),
-        HeapEntry::kNative, "system / JSArrayBufferData", size_);
+    return explorer_->AddEntry(reinterpret_cast<Address>(ptr),
+                               HeapEntry::kNative, "system / JSArrayBufferData",
+                               size_);
   }
  private:
   size_t size_;
@@ -1339,49 +1364,10 @@ void V8HeapExplorer::ExtractJSPromiseReferences(int entry, JSPromise* promise) {
 }
 
 void V8HeapExplorer::ExtractFixedArrayReferences(int entry, FixedArray* array) {
-  auto it = array_types_.find(array);
-  if (it == array_types_.end()) {
-    for (int i = 0, l = array->length(); i < l; ++i) {
-      SetInternalReference(array, entry, i, array->get(i),
-                           array->OffsetOfElementAt(i));
-    }
-    return;
-  }
-  switch (it->second) {
-    case JS_WEAK_COLLECTION_SUB_TYPE: {
-      ObjectHashTable* table = ObjectHashTable::cast(array);
-      for (int i = 0, capacity = table->Capacity(); i < capacity; ++i) {
-        int key_index =
-            ObjectHashTable::EntryToIndex(i) + ObjectHashTable::kEntryKeyIndex;
-        int value_index = ObjectHashTable::EntryToValueIndex(i);
-        Object* key = table->get(key_index);
-        Object* value = table->get(value_index);
-        SetWeakReference(table, entry, key_index, key,
-                         table->OffsetOfElementAt(key_index));
-        SetInternalReference(table, entry, value_index, value,
-                             table->OffsetOfElementAt(value_index));
-        HeapEntry* key_entry = GetEntry(key);
-        int key_entry_index = key_entry->index();
-        HeapEntry* value_entry = GetEntry(value);
-        if (key_entry && value_entry) {
-          const char* edge_name =
-              names_->GetFormatted("key %s in WeakMap", key_entry->name());
-          filler_->SetNamedAutoIndexReference(HeapGraphEdge::kInternal,
-                                              key_entry_index, edge_name,
-                                              value_entry);
-        }
-      }
-      break;
-    }
-
-    // TODO(alph): Add special processing for other types of FixedArrays.
-
-    default:
-      for (int i = 0, l = array->length(); i < l; ++i) {
-        SetInternalReference(array, entry, i, array->get(i),
-                             array->OffsetOfElementAt(i));
-      }
-      break;
+  for (int i = 0, l = array->length(); i < l; ++i) {
+    DCHECK(!HasWeakHeapObjectTag(array->get(i)));
+    SetInternalReference(array, entry, i, array->get(i),
+                         array->OffsetOfElementAt(i));
   }
 }
 
@@ -1395,14 +1381,18 @@ void V8HeapExplorer::ExtractFeedbackVectorReferences(
   }
 }
 
-void V8HeapExplorer::ExtractWeakFixedArrayReferences(int entry,
-                                                     WeakFixedArray* array) {
+template <typename T>
+void V8HeapExplorer::ExtractWeakArrayReferences(int header_size, int entry,
+                                                T* array) {
   for (int i = 0; i < array->length(); ++i) {
     MaybeObject* object = array->Get(i);
     HeapObject* heap_object;
     if (object->ToWeakHeapObject(&heap_object)) {
       SetWeakReference(array, entry, i, heap_object,
-                       WeakFixedArray::kHeaderSize + i * kPointerSize);
+                       header_size + i * kPointerSize);
+    } else if (object->ToStrongHeapObject(&heap_object)) {
+      SetInternalReference(array, entry, i, heap_object,
+                           header_size + i * kPointerSize);
     }
   }
 }
@@ -1432,7 +1422,7 @@ void V8HeapExplorer::ExtractPropertyReferences(JSObject* js_obj, int entry) {
         case kDescriptor:
           SetDataOrAccessorPropertyReference(details.kind(), js_obj, entry,
                                              descs->GetKey(i),
-                                             descs->GetValue(i));
+                                             descs->GetStrongValue(i));
           break;
       }
     }
@@ -1524,7 +1514,7 @@ void V8HeapExplorer::ExtractInternalReferences(JSObject* js_obj, int entry) {
 
 String* V8HeapExplorer::GetConstructorName(JSObject* object) {
   Isolate* isolate = object->GetIsolate();
-  if (object->IsJSFunction()) return isolate->heap()->closure_string();
+  if (object->IsJSFunction()) return ReadOnlyRoots(isolate).closure_string();
   DisallowHeapAllocation no_gc;
   HandleScope scope(isolate);
   return *JSReceiver::GetConstructorName(handle(object, isolate));
@@ -1563,9 +1553,7 @@ class RootsReferencesExtractor : public RootVisitor {
   bool visiting_weak_roots_;
 };
 
-
-bool V8HeapExplorer::IterateAndExtractReferences(
-    SnapshotFiller* filler) {
+bool V8HeapExplorer::IterateAndExtractReferences(SnapshotFiller* filler) {
   filler_ = filler;
 
   // Create references to the synthetic roots.
@@ -1582,27 +1570,8 @@ bool V8HeapExplorer::IterateAndExtractReferences(
   extractor.SetVisitingWeakRoots();
   heap_->IterateWeakGlobalHandles(&extractor);
 
-  // We have to do two passes as sometimes FixedArrays are used
-  // to weakly hold their items, and it's impossible to distinguish
-  // between these cases without processing the array owner first.
-  bool interrupted =
-      IterateAndExtractSinglePass<&V8HeapExplorer::ExtractReferencesPass1>() ||
-      IterateAndExtractSinglePass<&V8HeapExplorer::ExtractReferencesPass2>();
-
-  if (interrupted) {
-    filler_ = nullptr;
-    return false;
-  }
-
-  filler_ = nullptr;
-  return progress_->ProgressReport(true);
-}
-
-
-template<V8HeapExplorer::ExtractReferencesMethod extractor>
-bool V8HeapExplorer::IterateAndExtractSinglePass() {
-  // Now iterate the whole heap.
   bool interrupted = false;
+
   HeapIterator iterator(heap_, HeapIterator::kFilterUnreachable);
   // Heap iteration with filtering must be finished in any case.
   for (HeapObject *obj = iterator.next(); obj != nullptr;
@@ -1619,14 +1588,13 @@ bool V8HeapExplorer::IterateAndExtractSinglePass() {
 
     HeapEntry* heap_entry = GetEntry(obj);
     int entry = heap_entry->index();
-    if ((this->*extractor)(entry, obj)) {
-      SetInternalReference(obj, entry,
-                           "map", obj->map(), HeapObject::kMapOffset);
-      // Extract unvisited fields as hidden references and restore tags
-      // of visited fields.
-      IndexedReferencesExtractor refs_extractor(this, obj, entry);
-      obj->Iterate(&refs_extractor);
-    }
+    ExtractReferences(entry, obj);
+    SetInternalReference(obj, entry, "map", obj->map(), HeapObject::kMapOffset);
+    // Extract unvisited fields as hidden references and restore tags
+    // of visited fields.
+    IndexedReferencesExtractor refs_extractor(this, obj, entry);
+    obj->Iterate(&refs_extractor);
+
     // Ensure visited_fields_ doesn't leak to the next object.
     for (size_t i = 0; i < max_pointer; ++i) {
       DCHECK(!visited_fields_[i]);
@@ -1634,22 +1602,25 @@ bool V8HeapExplorer::IterateAndExtractSinglePass() {
 
     if (!progress_->ProgressReport(false)) interrupted = true;
   }
-  return interrupted;
+
+  filler_ = nullptr;
+  return interrupted ? false : progress_->ProgressReport(true);
 }
 
 
 bool V8HeapExplorer::IsEssentialObject(Object* object) {
+  ReadOnlyRoots roots(heap_);
   return object->IsHeapObject() && !object->IsOddball() &&
-         object != heap_->empty_byte_array() &&
-         object != heap_->empty_fixed_array() &&
-         object != heap_->empty_weak_fixed_array() &&
-         object != heap_->empty_descriptor_array() &&
-         object != heap_->fixed_array_map() && object != heap_->cell_map() &&
-         object != heap_->global_property_cell_map() &&
-         object != heap_->shared_function_info_map() &&
-         object != heap_->free_space_map() &&
-         object != heap_->one_pointer_filler_map() &&
-         object != heap_->two_pointer_filler_map();
+         object != roots.empty_byte_array() &&
+         object != roots.empty_fixed_array() &&
+         object != roots.empty_weak_fixed_array() &&
+         object != roots.empty_descriptor_array() &&
+         object != roots.fixed_array_map() && object != roots.cell_map() &&
+         object != roots.global_property_cell_map() &&
+         object != roots.shared_function_info_map() &&
+         object != roots.free_space_map() &&
+         object != roots.one_pointer_filler_map() &&
+         object != roots.two_pointer_filler_map();
 }
 
 bool V8HeapExplorer::IsEssentialHiddenReference(Object* parent,
@@ -1794,7 +1765,6 @@ void V8HeapExplorer::SetWeakReference(HeapObject* parent_obj,
   MarkVisitedField(field_offset);
 }
 
-
 void V8HeapExplorer::SetDataOrAccessorPropertyReference(
     PropertyKind kind, JSObject* parent_obj, int parent_entry,
     Name* reference_name, Object* child_obj, const char* name_format_string,
@@ -1880,7 +1850,6 @@ void V8HeapExplorer::SetGcSubrootReference(Root root, const char* description,
   JSGlobalObject* global = Context::cast(child_obj)->global_object();
   if (!global->IsJSGlobalObject()) return;
 
-  if (heap_->isolate()->debug()->IsDebugGlobal(global)) return;
   if (user_roots_.Contains(global)) return;
 
   user_roots_.Insert(global);
@@ -1888,24 +1857,34 @@ void V8HeapExplorer::SetGcSubrootReference(Root root, const char* description,
 }
 
 const char* V8HeapExplorer::GetStrongGcSubrootName(Object* object) {
+  ReadOnlyRoots roots(heap_);
   if (strong_gc_subroot_names_.is_empty()) {
 #define NAME_ENTRY(name) strong_gc_subroot_names_.SetTag(heap_->name(), #name);
+#define RO_NAME_ENTRY(name) \
+  strong_gc_subroot_names_.SetTag(roots.name(), #name);
 #define ROOT_NAME(type, name, camel_name) NAME_ENTRY(name)
-    STRONG_ROOT_LIST(ROOT_NAME)
+    STRONG_MUTABLE_ROOT_LIST(ROOT_NAME)
+#undef ROOT_NAME
+#define ROOT_NAME(type, name, camel_name) RO_NAME_ENTRY(name)
+    STRONG_READ_ONLY_ROOT_LIST(ROOT_NAME)
 #undef ROOT_NAME
-#define STRUCT_MAP_NAME(NAME, Name, name) NAME_ENTRY(name##_map)
+#define STRUCT_MAP_NAME(NAME, Name, name) RO_NAME_ENTRY(name##_map)
     STRUCT_LIST(STRUCT_MAP_NAME)
 #undef STRUCT_MAP_NAME
+#define ALLOCATION_SITE_MAP_NAME(NAME, Name, Size, name) \
+  RO_NAME_ENTRY(name##_map)
+    ALLOCATION_SITE_LIST(ALLOCATION_SITE_MAP_NAME)
+#undef ALLOCATION_SITE_MAP_NAME
 #define DATA_HANDLER_MAP_NAME(NAME, Name, Size, name) NAME_ENTRY(name##_map)
     DATA_HANDLER_LIST(DATA_HANDLER_MAP_NAME)
 #undef DATA_HANDLER_MAP_NAME
-#define STRING_NAME(name, str) NAME_ENTRY(name)
+#define STRING_NAME(name, str) RO_NAME_ENTRY(name)
     INTERNALIZED_STRING_LIST(STRING_NAME)
 #undef STRING_NAME
-#define SYMBOL_NAME(name) NAME_ENTRY(name)
+#define SYMBOL_NAME(name) RO_NAME_ENTRY(name)
     PRIVATE_SYMBOL_LIST(SYMBOL_NAME)
 #undef SYMBOL_NAME
-#define SYMBOL_NAME(name, description) NAME_ENTRY(name)
+#define SYMBOL_NAME(name, description) RO_NAME_ENTRY(name)
     PUBLIC_SYMBOL_LIST(SYMBOL_NAME)
     WELL_KNOWN_SYMBOL_LIST(SYMBOL_NAME)
 #undef SYMBOL_NAME
@@ -1914,6 +1893,7 @@ const char* V8HeapExplorer::GetStrongGcSubrootName(Object* object) {
     ACCESSOR_INFO_LIST(ACCESSOR_NAME)
 #undef ACCESSOR_NAME
 #undef NAME_ENTRY
+#undef RO_NAME_ENTRY
     CHECK(!strong_gc_subroot_names_.is_empty());
   }
   return strong_gc_subroot_names_.GetTag(object);
@@ -1928,12 +1908,6 @@ void V8HeapExplorer::TagObject(Object* obj, const char* tag) {
   }
 }
 
-void V8HeapExplorer::TagFixedArraySubType(const FixedArray* array,
-                                          FixedArraySubInstanceType type) {
-  DCHECK(array_types_.find(array) == array_types_.end());
-  array_types_[array] = type;
-}
-
 class GlobalObjectsEnumerator : public RootVisitor {
  public:
   void VisitRootPointers(Root root, const char* description, Object** start,
@@ -1944,7 +1918,8 @@ class GlobalObjectsEnumerator : public RootVisitor {
       if (!proxy->IsJSGlobalProxy()) continue;
       Object* global = proxy->map()->prototype();
       if (!global->IsJSGlobalObject()) continue;
-      objects_.push_back(Handle<JSGlobalObject>(JSGlobalObject::cast(global)));
+      objects_.push_back(Handle<JSGlobalObject>(JSGlobalObject::cast(global),
+                                                proxy->GetIsolate()));
     }
   }
   int count() const { return static_cast<int>(objects_.size()); }
@@ -2131,14 +2106,38 @@ HeapEntry* EmbedderGraphEntriesAllocator::AllocateEntry(HeapThing ptr) {
       static_cast<int>(size), 0);
 }
 
+class NativeGroupRetainedObjectInfo : public v8::RetainedObjectInfo {
+ public:
+  explicit NativeGroupRetainedObjectInfo(const char* label)
+      : disposed_(false),
+        hash_(reinterpret_cast<intptr_t>(label)),
+        label_(label) {}
+
+  virtual ~NativeGroupRetainedObjectInfo() {}
+  virtual void Dispose() {
+    CHECK(!disposed_);
+    disposed_ = true;
+    delete this;
+  }
+  virtual bool IsEquivalent(RetainedObjectInfo* other) {
+    return hash_ == other->GetHash() && !strcmp(label_, other->GetLabel());
+  }
+  virtual intptr_t GetHash() { return hash_; }
+  virtual const char* GetLabel() { return label_; }
+
+ private:
+  bool disposed_;
+  intptr_t hash_;
+  const char* label_;
+};
+
 NativeObjectsExplorer::NativeObjectsExplorer(
     HeapSnapshot* snapshot, SnapshottingProgressReportingInterface* progress)
     : isolate_(snapshot->profiler()->heap_object_map()->heap()->isolate()),
       snapshot_(snapshot),
       names_(snapshot_->profiler()->names()),
       embedder_queried_(false),
-      objects_by_info_(RetainedInfosMatch),
-      native_groups_(StringsMatch),
+      native_groups_(0, SeededStringHasher(isolate_->heap()->HashSeed())),
       synthetic_entries_allocator_(
           new BasicHeapEntriesAllocator(snapshot, HeapEntry::kSynthetic)),
       native_entries_allocator_(
@@ -2148,19 +2147,14 @@ NativeObjectsExplorer::NativeObjectsExplorer(
       filler_(nullptr) {}
 
 NativeObjectsExplorer::~NativeObjectsExplorer() {
-  for (base::HashMap::Entry* p = objects_by_info_.Start(); p != nullptr;
-       p = objects_by_info_.Next(p)) {
-    v8::RetainedObjectInfo* info =
-        reinterpret_cast<v8::RetainedObjectInfo*>(p->key);
+  for (auto map_entry : objects_by_info_) {
+    v8::RetainedObjectInfo* info = map_entry.first;
     info->Dispose();
-    std::vector<HeapObject*>* objects =
-        reinterpret_cast<std::vector<HeapObject*>*>(p->value);
+    std::vector<HeapObject*>* objects = map_entry.second;
     delete objects;
   }
-  for (base::HashMap::Entry* p = native_groups_.Start(); p != nullptr;
-       p = native_groups_.Next(p)) {
-    v8::RetainedObjectInfo* info =
-        reinterpret_cast<v8::RetainedObjectInfo*>(p->value);
+  for (auto map_entry : native_groups_) {
+    NativeGroupRetainedObjectInfo* info = map_entry.second;
     info->Dispose();
   }
 }
@@ -2168,7 +2162,7 @@ NativeObjectsExplorer::~NativeObjectsExplorer() {
 
 int NativeObjectsExplorer::EstimateObjectsCount() {
   FillRetainedObjects();
-  return objects_by_info_.occupancy();
+  return static_cast<int>(objects_by_info_.size());
 }
 
 
@@ -2225,14 +2219,13 @@ void NativeObjectsExplorer::FillEdges() {
 
 std::vector<HeapObject*>* NativeObjectsExplorer::GetVectorMaybeDisposeInfo(
     v8::RetainedObjectInfo* info) {
-  base::HashMap::Entry* entry =
-      objects_by_info_.LookupOrInsert(info, InfoHash(info));
-  if (entry->value != nullptr) {
+  auto map_entry = objects_by_info_.find(info);
+  if (map_entry != objects_by_info_.end()) {
     info->Dispose();
   } else {
-    entry->value = new std::vector<HeapObject*>();
+    objects_by_info_[info] = new std::vector<HeapObject*>();
   }
-  return reinterpret_cast<std::vector<HeapObject*>*>(entry->value);
+  return objects_by_info_[info];
 }
 
 HeapEntry* NativeObjectsExplorer::EntryForEmbedderGraphNode(
@@ -2299,13 +2292,10 @@ bool NativeObjectsExplorer::IterateAndExtractReferences(
     FillRetainedObjects();
     FillEdges();
     if (EstimateObjectsCount() > 0) {
-      for (base::HashMap::Entry* p = objects_by_info_.Start(); p != nullptr;
-           p = objects_by_info_.Next(p)) {
-        v8::RetainedObjectInfo* info =
-            reinterpret_cast<v8::RetainedObjectInfo*>(p->key);
+      for (auto map_entry : objects_by_info_) {
+        v8::RetainedObjectInfo* info = map_entry.first;
         SetNativeRootReference(info);
-        std::vector<HeapObject*>* objects =
-            reinterpret_cast<std::vector<HeapObject*>*>(p->value);
+        std::vector<HeapObject*>* objects = map_entry.second;
         for (HeapObject* object : *objects) {
           SetWrapperNativeReferences(object, info);
         }
@@ -2317,50 +2307,16 @@ bool NativeObjectsExplorer::IterateAndExtractReferences(
   return true;
 }
 
-
-class NativeGroupRetainedObjectInfo : public v8::RetainedObjectInfo {
- public:
-  explicit NativeGroupRetainedObjectInfo(const char* label)
-      : disposed_(false),
-        hash_(reinterpret_cast<intptr_t>(label)),
-        label_(label) {
-  }
-
-  virtual ~NativeGroupRetainedObjectInfo() {}
-  virtual void Dispose() {
-    CHECK(!disposed_);
-    disposed_ = true;
-    delete this;
-  }
-  virtual bool IsEquivalent(RetainedObjectInfo* other) {
-    return hash_ == other->GetHash() && !strcmp(label_, other->GetLabel());
-  }
-  virtual intptr_t GetHash() { return hash_; }
-  virtual const char* GetLabel() { return label_; }
-
- private:
-  bool disposed_;
-  intptr_t hash_;
-  const char* label_;
-};
-
-
 NativeGroupRetainedObjectInfo* NativeObjectsExplorer::FindOrAddGroupInfo(
     const char* label) {
   const char* label_copy = names_->GetCopy(label);
-  uint32_t hash = StringHasher::HashSequentialString(
-      label_copy,
-      static_cast<int>(strlen(label_copy)),
-      isolate_->heap()->HashSeed());
-  base::HashMap::Entry* entry =
-      native_groups_.LookupOrInsert(const_cast<char*>(label_copy), hash);
-  if (entry->value == nullptr) {
-    entry->value = new NativeGroupRetainedObjectInfo(label);
+  auto map_entry = native_groups_.find(label_copy);
+  if (map_entry == native_groups_.end()) {
+    native_groups_[label_copy] = new NativeGroupRetainedObjectInfo(label);
   }
-  return static_cast<NativeGroupRetainedObjectInfo*>(entry->value);
+  return native_groups_[label_copy];
 }
 
-
 void NativeObjectsExplorer::SetNativeRootReference(
     v8::RetainedObjectInfo* info) {
   HeapEntry* child_entry =
@@ -2396,10 +2352,8 @@ void NativeObjectsExplorer::SetWrapperNativeReferences(
 
 
 void NativeObjectsExplorer::SetRootNativeRootsReference() {
-  for (base::HashMap::Entry* entry = native_groups_.Start(); entry;
-       entry = native_groups_.Next(entry)) {
-    NativeGroupRetainedObjectInfo* group_info =
-        static_cast<NativeGroupRetainedObjectInfo*>(entry->value);
+  for (auto map_entry : native_groups_) {
+    NativeGroupRetainedObjectInfo* group_info = map_entry.second;
     HeapEntry* group_entry =
         filler_->FindOrAddEntry(group_info, native_entries_allocator_.get());
     DCHECK_NOT_NULL(group_entry);
@@ -2469,7 +2423,7 @@ bool HeapSnapshotGenerator::GenerateSnapshot() {
   }
 #endif
 
-  SetProgressTotal(2);  // 2 passes.
+  InitProgressCounter();
 
 #ifdef VERIFY_HEAP
   if (FLAG_verify_heap) {
@@ -2489,12 +2443,10 @@ bool HeapSnapshotGenerator::GenerateSnapshot() {
   return true;
 }
 
-
 void HeapSnapshotGenerator::ProgressStep() {
   ++progress_counter_;
 }
 
-
 bool HeapSnapshotGenerator::ProgressReport(bool force) {
   const int kProgressReportGranularity = 10000;
   if (control_ != nullptr &&
@@ -2505,27 +2457,22 @@ bool HeapSnapshotGenerator::ProgressReport(bool force) {
   return true;
 }
 
-
-void HeapSnapshotGenerator::SetProgressTotal(int iterations_count) {
+void HeapSnapshotGenerator::InitProgressCounter() {
   if (control_ == nullptr) return;
-  HeapIterator iterator(heap_, HeapIterator::kFilterUnreachable);
   // The +1 ensures that intermediate ProgressReport calls will never signal
   // that the work is finished (i.e. progress_counter_ == progress_total_).
   // Only the forced ProgressReport() at the end of GenerateSnapshot()
   // should signal that the work is finished because signalling finished twice
   // breaks the DevTools frontend.
-  progress_total_ =
-      iterations_count * (v8_heap_explorer_.EstimateObjectsCount(&iterator) +
-                          dom_explorer_.EstimateObjectsCount()) +
-      1;
+  progress_total_ = v8_heap_explorer_.EstimateObjectsCount() +
+                    dom_explorer_.EstimateObjectsCount() + 1;
   progress_counter_ = 0;
 }
 
-
 bool HeapSnapshotGenerator::FillReferences() {
   SnapshotFiller filler(snapshot_, &entries_);
-  return v8_heap_explorer_.IterateAndExtractReferences(&filler)
-      && dom_explorer_.IterateAndExtractReferences(&filler);
+  return v8_heap_explorer_.IterateAndExtractReferences(&filler) &&
+         dom_explorer_.IterateAndExtractReferences(&filler);
 }
 
 
diff --git a/deps/v8/src/profiler/heap-snapshot-generator.h b/deps/v8/src/profiler/heap-snapshot-generator.h
index 8e492807e92a94..4f4fbee74278f9 100644
--- a/deps/v8/src/profiler/heap-snapshot-generator.h
+++ b/deps/v8/src/profiler/heap-snapshot-generator.h
@@ -13,6 +13,8 @@
 #include "src/base/platform/time.h"
 #include "src/objects.h"
 #include "src/objects/fixed-array.h"
+#include "src/objects/hash-table.h"
+#include "src/objects/literal-objects.h"
 #include "src/profiler/strings-storage.h"
 #include "src/string-hasher.h"
 #include "src/visitors.h"
@@ -57,13 +59,13 @@ class HeapGraphEdge BASE_EMBEDDED {
            type() == kInternal || type() == kShortcut || type() == kWeak);
     return name_;
   }
-  INLINE(HeapEntry* from() const);
+  V8_INLINE HeapEntry* from() const;
   HeapEntry* to() const { return to_entry_; }
 
-  INLINE(Isolate* isolate() const);
+  V8_INLINE Isolate* isolate() const;
 
  private:
-  INLINE(HeapSnapshot* snapshot() const);
+  V8_INLINE HeapSnapshot* snapshot() const;
   int from_index() const { return FromIndexField::decode(bit_field_); }
 
   class TypeField : public BitField<Type, 0, 3> {};
@@ -120,14 +122,14 @@ class HeapEntry BASE_EMBEDDED {
   SnapshotObjectId id() const { return id_; }
   size_t self_size() const { return self_size_; }
   unsigned trace_node_id() const { return trace_node_id_; }
-  INLINE(int index() const);
+  V8_INLINE int index() const;
   int children_count() const { return children_count_; }
-  INLINE(int set_children_index(int index));
+  V8_INLINE int set_children_index(int index);
   void add_child(HeapGraphEdge* edge) {
     *(children_begin() + children_count_++) = edge;
   }
   HeapGraphEdge* child(int i) { return *(children_begin() + i); }
-  INLINE(Isolate* isolate() const);
+  V8_INLINE Isolate* isolate() const;
 
   void SetIndexedReference(
       HeapGraphEdge::Type type, int index, HeapEntry* entry);
@@ -138,8 +140,8 @@ class HeapEntry BASE_EMBEDDED {
       const char* prefix, const char* edge_name, int max_depth, int indent);
 
  private:
-  INLINE(std::deque<HeapGraphEdge*>::iterator children_begin());
-  INLINE(std::deque<HeapGraphEdge*>::iterator children_end());
+  V8_INLINE std::deque<HeapGraphEdge*>::iterator children_begin();
+  V8_INLINE std::deque<HeapGraphEdge*>::iterator children_end();
   const char* TypeAsString();
 
   unsigned type_: 4;
@@ -265,6 +267,7 @@ class HeapObjectsMap {
   };
 
   SnapshotObjectId next_id_;
+  // TODO(jkummerow): Use a map that uses {Address} as the key type.
   base::HashMap entries_map_;
   std::vector<EntryInfo> entries_;
   std::vector<TimeInterval> time_intervals_;
@@ -340,7 +343,7 @@ class V8HeapExplorer : public HeapEntriesAllocator {
                  v8::HeapProfiler::ObjectNameResolver* resolver);
   virtual ~V8HeapExplorer();
   virtual HeapEntry* AllocateEntry(HeapThing ptr);
-  int EstimateObjectsCount(HeapIterator* iterator);
+  int EstimateObjectsCount();
   bool IterateAndExtractReferences(SnapshotFiller* filler);
   void TagGlobalObjects();
   void TagCodeObject(Code* code);
@@ -353,9 +356,6 @@ class V8HeapExplorer : public HeapEntriesAllocator {
   static String* GetConstructorName(JSObject* object);
 
  private:
-  typedef bool (V8HeapExplorer::*ExtractReferencesMethod)(int entry,
-                                                          HeapObject* object);
-
   void MarkVisitedField(int offset);
 
   HeapEntry* AddEntry(HeapObject* object);
@@ -365,11 +365,7 @@ class V8HeapExplorer : public HeapEntriesAllocator {
 
   const char* GetSystemEntryName(HeapObject* object);
 
-  template<V8HeapExplorer::ExtractReferencesMethod extractor>
-  bool IterateAndExtractSinglePass();
-
-  bool ExtractReferencesPass1(int entry, HeapObject* obj);
-  bool ExtractReferencesPass2(int entry, HeapObject* obj);
+  void ExtractReferences(int entry, HeapObject* obj);
   void ExtractJSGlobalProxyReferences(int entry, JSGlobalProxy* proxy);
   void ExtractJSObjectReferences(int entry, JSObject* js_obj);
   void ExtractStringReferences(int entry, String* obj);
@@ -377,6 +373,8 @@ class V8HeapExplorer : public HeapEntriesAllocator {
   void ExtractJSCollectionReferences(int entry, JSCollection* collection);
   void ExtractJSWeakCollectionReferences(int entry,
                                          JSWeakCollection* collection);
+  void ExtractEphemeronHashTableReferences(int entry,
+                                           EphemeronHashTable* table);
   void ExtractContextReferences(int entry, Context* context);
   void ExtractMapReferences(int entry, Map* map);
   void ExtractSharedFunctionInfoReferences(int entry,
@@ -390,12 +388,15 @@ class V8HeapExplorer : public HeapEntriesAllocator {
   void ExtractWeakCellReferences(int entry, WeakCell* weak_cell);
   void ExtractPropertyCellReferences(int entry, PropertyCell* cell);
   void ExtractAllocationSiteReferences(int entry, AllocationSite* site);
+  void ExtractArrayBoilerplateDescriptionReferences(
+      int entry, ArrayBoilerplateDescription* value);
   void ExtractJSArrayBufferReferences(int entry, JSArrayBuffer* buffer);
   void ExtractJSPromiseReferences(int entry, JSPromise* promise);
   void ExtractFixedArrayReferences(int entry, FixedArray* array);
   void ExtractFeedbackVectorReferences(int entry,
                                        FeedbackVector* feedback_vector);
-  void ExtractWeakFixedArrayReferences(int entry, WeakFixedArray* array);
+  template <typename T>
+  void ExtractWeakArrayReferences(int header_size, int entry, T* array);
   void ExtractPropertyReferences(JSObject* js_obj, int entry);
   void ExtractAccessorPairProperty(JSObject* js_obj, int entry, Name* key,
                                    Object* callback_obj, int field_offset = -1);
@@ -456,8 +457,6 @@ class V8HeapExplorer : public HeapEntriesAllocator {
                              Object* child);
   const char* GetStrongGcSubrootName(Object* object);
   void TagObject(Object* obj, const char* tag);
-  void TagFixedArraySubType(const FixedArray* array,
-                            FixedArraySubInstanceType type);
 
   HeapEntry* GetEntry(Object* obj);
 
@@ -470,7 +469,6 @@ class V8HeapExplorer : public HeapEntriesAllocator {
   HeapObjectsSet objects_tags_;
   HeapObjectsSet strong_gc_subroot_names_;
   HeapObjectsSet user_roots_;
-  std::unordered_map<const FixedArray*, FixedArraySubInstanceType> array_types_;
   v8::HeapProfiler::ObjectNameResolver* global_object_name_resolver_;
 
   std::vector<bool> visited_fields_;
@@ -505,18 +503,17 @@ class NativeObjectsExplorer {
                                       v8::RetainedObjectInfo* info);
   void VisitSubtreeWrapper(Object** p, uint16_t class_id);
 
-  static uint32_t InfoHash(v8::RetainedObjectInfo* info) {
-    return ComputeIntegerHash(static_cast<uint32_t>(info->GetHash()));
-  }
-  static bool RetainedInfosMatch(void* key1, void* key2) {
-    return key1 == key2 ||
-        (reinterpret_cast<v8::RetainedObjectInfo*>(key1))->IsEquivalent(
-            reinterpret_cast<v8::RetainedObjectInfo*>(key2));
-  }
-  INLINE(static bool StringsMatch(void* key1, void* key2)) {
-    return strcmp(reinterpret_cast<char*>(key1),
-                  reinterpret_cast<char*>(key2)) == 0;
-  }
+  struct RetainedInfoHasher {
+    std::size_t operator()(v8::RetainedObjectInfo* info) const {
+      return ComputeIntegerHash(static_cast<uint32_t>(info->GetHash()));
+    }
+  };
+  struct RetainedInfoEquals {
+    bool operator()(v8::RetainedObjectInfo* info1,
+                    v8::RetainedObjectInfo* info2) const {
+      return info1 == info2 || info1->IsEquivalent(info2);
+    }
+  };
 
   NativeGroupRetainedObjectInfo* FindOrAddGroupInfo(const char* label);
 
@@ -527,9 +524,12 @@ class NativeObjectsExplorer {
   StringsStorage* names_;
   bool embedder_queried_;
   HeapObjectsSet in_groups_;
-  // RetainedObjectInfo* -> std::vector<HeapObject*>*
-  base::CustomMatcherHashMap objects_by_info_;
-  base::CustomMatcherHashMap native_groups_;
+  std::unordered_map<v8::RetainedObjectInfo*, std::vector<HeapObject*>*,
+                     RetainedInfoHasher, RetainedInfoEquals>
+      objects_by_info_;
+  std::unordered_map<const char*, NativeGroupRetainedObjectInfo*,
+                     SeededStringHasher, StringEquals>
+      native_groups_;
   std::unique_ptr<HeapEntriesAllocator> synthetic_entries_allocator_;
   std::unique_ptr<HeapEntriesAllocator> native_entries_allocator_;
   std::unique_ptr<HeapEntriesAllocator> embedder_graph_entries_allocator_;
@@ -557,7 +557,7 @@ class HeapSnapshotGenerator : public SnapshottingProgressReportingInterface {
   bool FillReferences();
   void ProgressStep();
   bool ProgressReport(bool force = false);
-  void SetProgressTotal(int iterations_count);
+  void InitProgressCounter();
 
   HeapSnapshot* snapshot_;
   v8::ActivityControl* control_;
@@ -586,12 +586,12 @@ class HeapSnapshotJSONSerializer {
   void Serialize(v8::OutputStream* stream);
 
  private:
-  INLINE(static bool StringsMatch(void* key1, void* key2)) {
+  V8_INLINE static bool StringsMatch(void* key1, void* key2) {
     return strcmp(reinterpret_cast<char*>(key1),
                   reinterpret_cast<char*>(key2)) == 0;
   }
 
-  INLINE(static uint32_t StringHash(const void* string)) {
+  V8_INLINE static uint32_t StringHash(const void* string) {
     const char* s = reinterpret_cast<const char*>(string);
     int len = static_cast<int>(strlen(s));
     return StringHasher::HashSequentialString(
diff --git a/deps/v8/src/profiler/profile-generator-inl.h b/deps/v8/src/profiler/profile-generator-inl.h
index 970d462937f32e..31652ba9f98e83 100644
--- a/deps/v8/src/profiler/profile-generator-inl.h
+++ b/deps/v8/src/profiler/profile-generator-inl.h
@@ -11,34 +11,35 @@ namespace v8 {
 namespace internal {
 
 CodeEntry::CodeEntry(CodeEventListener::LogEventsAndTags tag, const char* name,
-                     const char* name_prefix, const char* resource_name,
-                     int line_number, int column_number,
-                     std::unique_ptr<JITLineInfoTable> line_info,
+                     const char* resource_name, int line_number,
+                     int column_number,
+                     std::unique_ptr<SourcePositionTable> line_info,
                      Address instruction_start)
     : bit_field_(TagField::encode(tag) |
                  BuiltinIdField::encode(Builtins::builtin_count)),
-      name_prefix_(name_prefix),
       name_(name),
       resource_name_(resource_name),
       line_number_(line_number),
       column_number_(column_number),
       script_id_(v8::UnboundScript::kNoScriptId),
       position_(0),
-      bailout_reason_(kEmptyBailoutReason),
-      deopt_reason_(kNoDeoptReason),
-      deopt_id_(kNoDeoptimizationId),
       line_info_(std::move(line_info)),
       instruction_start_(instruction_start) {}
 
+inline CodeEntry* ProfileGenerator::FindEntry(Address address) {
+  CodeEntry* entry = code_map_.FindEntry(address);
+  if (entry) entry->mark_used();
+  return entry;
+}
+
 ProfileNode::ProfileNode(ProfileTree* tree, CodeEntry* entry,
-                         ProfileNode* parent)
+                         ProfileNode* parent, int line_number)
     : tree_(tree),
       entry_(entry),
       self_ticks_(0),
-      children_(CodeEntriesMatch),
+      line_number_(line_number),
       parent_(parent),
-      id_(tree->next_node_id()),
-      line_ticks_(LineTickMatch) {
+      id_(tree->next_node_id()) {
   tree_->EnqueueNode(this);
 }
 
diff --git a/deps/v8/src/profiler/profile-generator.cc b/deps/v8/src/profiler/profile-generator.cc
index db95718936765c..8e76d4108aae4b 100644
--- a/deps/v8/src/profiler/profile-generator.cc
+++ b/deps/v8/src/profiler/profile-generator.cc
@@ -18,33 +18,31 @@
 namespace v8 {
 namespace internal {
 
-
-JITLineInfoTable::JITLineInfoTable() {}
-
-
-JITLineInfoTable::~JITLineInfoTable() {}
-
-
-void JITLineInfoTable::SetPosition(int pc_offset, int line) {
+void SourcePositionTable::SetPosition(int pc_offset, int line) {
   DCHECK_GE(pc_offset, 0);
   DCHECK_GT(line, 0);  // The 1-based number of the source line.
-  if (GetSourceLineNumber(pc_offset) != line) {
-    pc_offset_map_.insert(std::make_pair(pc_offset, line));
+  // Check that we are inserting in ascending order, so that the vector remains
+  // sorted.
+  DCHECK(pc_offsets_to_lines_.empty() ||
+         pc_offsets_to_lines_.back().pc_offset < pc_offset);
+  if (pc_offsets_to_lines_.empty() ||
+      pc_offsets_to_lines_.back().line_number != line) {
+    pc_offsets_to_lines_.push_back({pc_offset, line});
   }
 }
 
-
-int JITLineInfoTable::GetSourceLineNumber(int pc_offset) const {
-  PcOffsetMap::const_iterator it = pc_offset_map_.lower_bound(pc_offset);
-  if (it == pc_offset_map_.end()) {
-    if (pc_offset_map_.empty()) return v8::CpuProfileNode::kNoLineNumberInfo;
-    return (--pc_offset_map_.end())->second;
+int SourcePositionTable::GetSourceLineNumber(int pc_offset) const {
+  if (pc_offsets_to_lines_.empty()) {
+    return v8::CpuProfileNode::kNoLineNumberInfo;
   }
-  return it->second;
+  auto it =
+      std::upper_bound(pc_offsets_to_lines_.begin(), pc_offsets_to_lines_.end(),
+                       PCOffsetAndLineNumber{pc_offset, 0});
+  if (it != pc_offsets_to_lines_.begin()) --it;
+  return it->line_number;
 }
 
-
-const char* const CodeEntry::kEmptyNamePrefix = "";
+const char* const CodeEntry::kWasmResourceNamePrefix = "wasm ";
 const char* const CodeEntry::kEmptyResourceName = "";
 const char* const CodeEntry::kEmptyBailoutReason = "";
 const char* const CodeEntry::kNoDeoptReason = "";
@@ -91,8 +89,6 @@ uint32_t CodeEntry::GetHash() const {
     hash ^= ComputeIntegerHash(static_cast<uint32_t>(script_id_));
     hash ^= ComputeIntegerHash(static_cast<uint32_t>(position_));
   } else {
-    hash ^= ComputeIntegerHash(
-        static_cast<uint32_t>(reinterpret_cast<uintptr_t>(name_prefix_)));
     hash ^= ComputeIntegerHash(
         static_cast<uint32_t>(reinterpret_cast<uintptr_t>(name_)));
     hash ^= ComputeIntegerHash(
@@ -102,14 +98,12 @@ uint32_t CodeEntry::GetHash() const {
   return hash;
 }
 
-
-bool CodeEntry::IsSameFunctionAs(CodeEntry* entry) const {
+bool CodeEntry::IsSameFunctionAs(const CodeEntry* entry) const {
   if (this == entry) return true;
   if (script_id_ != v8::UnboundScript::kNoScriptId) {
     return script_id_ == entry->script_id_ && position_ == entry->position_;
   }
-  return name_prefix_ == entry->name_prefix_ && name_ == entry->name_ &&
-         resource_name_ == entry->resource_name_ &&
+  return name_ == entry->name_ && resource_name_ == entry->resource_name_ &&
          line_number_ == entry->line_number_;
 }
 
@@ -121,31 +115,31 @@ void CodeEntry::SetBuiltinId(Builtins::Name id) {
 
 
 int CodeEntry::GetSourceLine(int pc_offset) const {
-  if (line_info_ && !line_info_->empty()) {
-    return line_info_->GetSourceLineNumber(pc_offset);
-  }
+  if (line_info_) return line_info_->GetSourceLineNumber(pc_offset);
   return v8::CpuProfileNode::kNoLineNumberInfo;
 }
 
 void CodeEntry::AddInlineStack(
     int pc_offset, std::vector<std::unique_ptr<CodeEntry>> inline_stack) {
-  inline_locations_.insert(std::make_pair(pc_offset, std::move(inline_stack)));
+  EnsureRareData()->inline_locations_.insert(
+      std::make_pair(pc_offset, std::move(inline_stack)));
 }
 
 const std::vector<std::unique_ptr<CodeEntry>>* CodeEntry::GetInlineStack(
     int pc_offset) const {
-  auto it = inline_locations_.find(pc_offset);
-  return it != inline_locations_.end() ? &it->second : nullptr;
+  if (!rare_data_) return nullptr;
+  auto it = rare_data_->inline_locations_.find(pc_offset);
+  return it != rare_data_->inline_locations_.end() ? &it->second : nullptr;
 }
 
-void CodeEntry::AddDeoptInlinedFrames(
-    int deopt_id, std::vector<CpuProfileDeoptFrame> inlined_frames) {
-  deopt_inlined_frames_.insert(
-      std::make_pair(deopt_id, std::move(inlined_frames)));
-}
-
-bool CodeEntry::HasDeoptInlinedFramesFor(int deopt_id) const {
-  return deopt_inlined_frames_.find(deopt_id) != deopt_inlined_frames_.end();
+void CodeEntry::set_deopt_info(
+    const char* deopt_reason, int deopt_id,
+    std::vector<CpuProfileDeoptFrame> inlined_frames) {
+  DCHECK(!has_deopt_info());
+  RareData* rare_data = EnsureRareData();
+  rare_data->deopt_reason_ = deopt_reason;
+  rare_data->deopt_id_ = deopt_id;
+  rare_data->deopt_inlined_frames_ = std::move(inlined_frames);
 }
 
 void CodeEntry::FillFunctionInfo(SharedFunctionInfo* shared) {
@@ -153,49 +147,53 @@ void CodeEntry::FillFunctionInfo(SharedFunctionInfo* shared) {
   Script* script = Script::cast(shared->script());
   set_script_id(script->id());
   set_position(shared->StartPosition());
-  set_bailout_reason(GetBailoutReason(shared->disable_optimization_reason()));
+  if (shared->optimization_disabled()) {
+    set_bailout_reason(GetBailoutReason(shared->disable_optimization_reason()));
+  }
 }
 
 CpuProfileDeoptInfo CodeEntry::GetDeoptInfo() {
   DCHECK(has_deopt_info());
 
   CpuProfileDeoptInfo info;
-  info.deopt_reason = deopt_reason_;
-  DCHECK_NE(kNoDeoptimizationId, deopt_id_);
-  if (deopt_inlined_frames_.find(deopt_id_) == deopt_inlined_frames_.end()) {
+  info.deopt_reason = rare_data_->deopt_reason_;
+  DCHECK_NE(kNoDeoptimizationId, rare_data_->deopt_id_);
+  if (rare_data_->deopt_inlined_frames_.empty()) {
     info.stack.push_back(CpuProfileDeoptFrame(
         {script_id_, static_cast<size_t>(std::max(0, position()))}));
   } else {
-    info.stack = deopt_inlined_frames_[deopt_id_];
+    info.stack = rare_data_->deopt_inlined_frames_;
   }
   return info;
 }
 
+CodeEntry::RareData* CodeEntry::EnsureRareData() {
+  if (!rare_data_) {
+    rare_data_.reset(new RareData());
+  }
+  return rare_data_.get();
+}
 
 void ProfileNode::CollectDeoptInfo(CodeEntry* entry) {
   deopt_infos_.push_back(entry->GetDeoptInfo());
   entry->clear_deopt_info();
 }
 
-
-ProfileNode* ProfileNode::FindChild(CodeEntry* entry) {
-  base::HashMap::Entry* map_entry =
-      children_.Lookup(entry, CodeEntryHash(entry));
-  return map_entry != nullptr ? reinterpret_cast<ProfileNode*>(map_entry->value)
-                              : nullptr;
+ProfileNode* ProfileNode::FindChild(CodeEntry* entry, int line_number) {
+  auto map_entry = children_.find({entry, line_number});
+  return map_entry != children_.end() ? map_entry->second : nullptr;
 }
 
-
-ProfileNode* ProfileNode::FindOrAddChild(CodeEntry* entry) {
-  base::HashMap::Entry* map_entry =
-      children_.LookupOrInsert(entry, CodeEntryHash(entry));
-  ProfileNode* node = reinterpret_cast<ProfileNode*>(map_entry->value);
-  if (!node) {
-    node = new ProfileNode(tree_, entry, this);
-    map_entry->value = node;
+ProfileNode* ProfileNode::FindOrAddChild(CodeEntry* entry, int line_number) {
+  auto map_entry = children_.find({entry, line_number});
+  if (map_entry == children_.end()) {
+    ProfileNode* node = new ProfileNode(tree_, entry, this, line_number);
+    children_[{entry, line_number}] = node;
     children_list_.push_back(node);
+    return node;
+  } else {
+    return map_entry->second;
   }
-  return node;
 }
 
 
@@ -203,10 +201,12 @@ void ProfileNode::IncrementLineTicks(int src_line) {
   if (src_line == v8::CpuProfileNode::kNoLineNumberInfo) return;
   // Increment a hit counter of a certain source line.
   // Add a new source line if not found.
-  base::HashMap::Entry* e =
-      line_ticks_.LookupOrInsert(reinterpret_cast<void*>(src_line), src_line);
-  DCHECK(e);
-  e->value = reinterpret_cast<void*>(reinterpret_cast<uintptr_t>(e->value) + 1);
+  auto map_entry = line_ticks_.find(src_line);
+  if (map_entry == line_ticks_.end()) {
+    line_ticks_[src_line] = 1;
+  } else {
+    line_ticks_[src_line]++;
+  }
 }
 
 
@@ -214,19 +214,16 @@ bool ProfileNode::GetLineTicks(v8::CpuProfileNode::LineTick* entries,
                                unsigned int length) const {
   if (entries == nullptr || length == 0) return false;
 
-  unsigned line_count = line_ticks_.occupancy();
+  unsigned line_count = static_cast<unsigned>(line_ticks_.size());
 
   if (line_count == 0) return true;
   if (length < line_count) return false;
 
   v8::CpuProfileNode::LineTick* entry = entries;
 
-  for (base::HashMap::Entry *p = line_ticks_.Start(); p != nullptr;
-       p = line_ticks_.Next(p), entry++) {
-    entry->line =
-        static_cast<unsigned int>(reinterpret_cast<uintptr_t>(p->key));
-    entry->hit_count =
-        static_cast<unsigned int>(reinterpret_cast<uintptr_t>(p->value));
+  for (auto p = line_ticks_.begin(); p != line_ticks_.end(); p++, entry++) {
+    entry->line = p->first;
+    entry->hit_count = p->second;
   }
 
   return true;
@@ -234,9 +231,9 @@ bool ProfileNode::GetLineTicks(v8::CpuProfileNode::LineTick* entries,
 
 
 void ProfileNode::Print(int indent) {
-  base::OS::Print("%5u %*s %s%s %d #%d", self_ticks_, indent, "",
-                  entry_->name_prefix(), entry_->name(), entry_->script_id(),
-                  id());
+  int line_number = line_number_ != 0 ? line_number_ : entry_->line_number();
+  base::OS::Print("%5u %*s %s:%d %d #%d", self_ticks_, indent, "",
+                  entry_->name(), line_number, entry_->script_id(), id());
   if (entry_->resource_name()[0] != '\0')
     base::OS::Print(" %s:%d", entry_->resource_name(), entry_->line_number());
   base::OS::Print("\n");
@@ -259,9 +256,8 @@ void ProfileNode::Print(int indent) {
     base::OS::Print("%*s bailed out due to '%s'\n", indent + 10, "",
                     bailout_reason);
   }
-  for (base::HashMap::Entry* p = children_.Start(); p != nullptr;
-       p = children_.Next(p)) {
-    reinterpret_cast<ProfileNode*>(p->value)->Print(indent + 2);
+  for (auto child : children_) {
+    child.second->Print(indent + 2);
   }
 }
 
@@ -282,8 +278,7 @@ ProfileTree::ProfileTree(Isolate* isolate)
       next_node_id_(1),
       root_(new ProfileNode(this, &root_entry_, nullptr)),
       isolate_(isolate),
-      next_function_id_(1),
-      function_ids_(ProfileNode::CodeEntriesMatch) {}
+      next_function_id_(1) {}
 
 ProfileTree::~ProfileTree() {
   DeleteNodesCallback cb;
@@ -293,12 +288,11 @@ ProfileTree::~ProfileTree() {
 
 unsigned ProfileTree::GetFunctionId(const ProfileNode* node) {
   CodeEntry* code_entry = node->entry();
-  base::HashMap::Entry* entry =
-      function_ids_.LookupOrInsert(code_entry, code_entry->GetHash());
-  if (!entry->value) {
-    entry->value = reinterpret_cast<void*>(next_function_id_++);
+  auto map_entry = function_ids_.find(code_entry);
+  if (map_entry == function_ids_.end()) {
+    return function_ids_[code_entry] = next_function_id_++;
   }
-  return static_cast<unsigned>(reinterpret_cast<uintptr_t>(entry->value));
+  return function_ids_[code_entry];
 }
 
 ProfileNode* ProfileTree::AddPathFromEnd(const std::vector<CodeEntry*>& path,
@@ -308,7 +302,33 @@ ProfileNode* ProfileTree::AddPathFromEnd(const std::vector<CodeEntry*>& path,
   for (auto it = path.rbegin(); it != path.rend(); ++it) {
     if (*it == nullptr) continue;
     last_entry = *it;
-    node = node->FindOrAddChild(*it);
+    node = node->FindOrAddChild(*it, v8::CpuProfileNode::kNoLineNumberInfo);
+  }
+  if (last_entry && last_entry->has_deopt_info()) {
+    node->CollectDeoptInfo(last_entry);
+  }
+  if (update_stats) {
+    node->IncrementSelfTicks();
+    if (src_line != v8::CpuProfileNode::kNoLineNumberInfo) {
+      node->IncrementLineTicks(src_line);
+    }
+  }
+  return node;
+}
+
+ProfileNode* ProfileTree::AddPathFromEnd(const ProfileStackTrace& path,
+                                         int src_line, bool update_stats,
+                                         ProfilingMode mode) {
+  ProfileNode* node = root_;
+  CodeEntry* last_entry = nullptr;
+  int parent_line_number = v8::CpuProfileNode::kNoLineNumberInfo;
+  for (auto it = path.rbegin(); it != path.rend(); ++it) {
+    if ((*it).code_entry == nullptr) continue;
+    last_entry = (*it).code_entry;
+    node = node->FindOrAddChild((*it).code_entry, parent_line_number);
+    parent_line_number = mode == ProfilingMode::kCallerLineNumbers
+                             ? (*it).line_number
+                             : v8::CpuProfileNode::kNoLineNumberInfo;
   }
   if (last_entry && last_entry->has_deopt_info()) {
     node->CollectDeoptInfo(last_entry);
@@ -327,13 +347,13 @@ class Position {
  public:
   explicit Position(ProfileNode* node)
       : node(node), child_idx_(0) { }
-  INLINE(ProfileNode* current_child()) {
+  V8_INLINE ProfileNode* current_child() {
     return node->children()->at(child_idx_);
   }
-  INLINE(bool has_current_child()) {
+  V8_INLINE bool has_current_child() {
     return child_idx_ < static_cast<int>(node->children()->size());
   }
-  INLINE(void next_child()) { ++child_idx_; }
+  V8_INLINE void next_child() { ++child_idx_; }
 
   ProfileNode* node;
  private:
@@ -366,30 +386,36 @@ void ProfileTree::TraverseDepthFirst(Callback* callback) {
 
 using v8::tracing::TracedValue;
 
+std::atomic<uint32_t> CpuProfile::last_id_;
+
 CpuProfile::CpuProfile(CpuProfiler* profiler, const char* title,
-                       bool record_samples)
+                       bool record_samples, ProfilingMode mode)
     : title_(title),
       record_samples_(record_samples),
+      mode_(mode),
       start_time_(base::TimeTicks::HighResolutionNow()),
       top_down_(profiler->isolate()),
       profiler_(profiler),
-      streaming_next_sample_(0) {
+      streaming_next_sample_(0),
+      id_(++last_id_) {
   auto value = TracedValue::Create();
   value->SetDouble("startTime",
                    (start_time_ - base::TimeTicks()).InMicroseconds());
   TRACE_EVENT_SAMPLE_WITH_ID1(TRACE_DISABLED_BY_DEFAULT("v8.cpu_profiler"),
-                              "Profile", this, "data", std::move(value));
+                              "Profile", id_, "data", std::move(value));
 }
 
 void CpuProfile::AddPath(base::TimeTicks timestamp,
-                         const std::vector<CodeEntry*>& path, int src_line,
+                         const ProfileStackTrace& path, int src_line,
                          bool update_stats) {
   ProfileNode* top_frame_node =
-      top_down_.AddPathFromEnd(path, src_line, update_stats);
+      top_down_.AddPathFromEnd(path, src_line, update_stats, mode_);
+
   if (record_samples_ && !timestamp.IsNull()) {
     timestamps_.push_back(timestamp);
     samples_.push_back(top_frame_node);
   }
+
   const int kSamplesFlushCount = 100;
   const int kNodesFlushCount = 10;
   if (samples_.size() - streaming_next_sample_ >= kSamplesFlushCount ||
@@ -468,7 +494,7 @@ void CpuProfile::StreamPendingTraceEvents() {
   }
 
   TRACE_EVENT_SAMPLE_WITH_ID1(TRACE_DISABLED_BY_DEFAULT("v8.cpu_profiler"),
-                              "ProfileChunk", this, "data", std::move(value));
+                              "ProfileChunk", id_, "data", std::move(value));
 }
 
 void CpuProfile::FinishProfile() {
@@ -477,7 +503,7 @@ void CpuProfile::FinishProfile() {
   auto value = TracedValue::Create();
   value->SetDouble("endTime", (end_time_ - base::TimeTicks()).InMicroseconds());
   TRACE_EVENT_SAMPLE_WITH_ID1(TRACE_DISABLED_BY_DEFAULT("v8.cpu_profiler"),
-                              "ProfileChunk", this, "data", std::move(value));
+                              "ProfileChunk", id_, "data", std::move(value));
 }
 
 void CpuProfile::Print() {
@@ -485,19 +511,38 @@ void CpuProfile::Print() {
   top_down_.Print();
 }
 
+CodeMap::CodeMap() = default;
+
+CodeMap::~CodeMap() {
+  // First clean the free list as it's otherwise impossible to tell
+  // the slot type.
+  unsigned free_slot = free_list_head_;
+  while (free_slot != kNoFreeSlot) {
+    unsigned next_slot = code_entries_[free_slot].next_free_slot;
+    code_entries_[free_slot].entry = nullptr;
+    free_slot = next_slot;
+  }
+  for (auto slot : code_entries_) delete slot.entry;
+}
+
 void CodeMap::AddCode(Address addr, CodeEntry* entry, unsigned size) {
-  DeleteAllCoveredCode(addr, addr + size);
-  code_map_.insert({addr, CodeEntryInfo(entry, size)});
+  ClearCodesInRange(addr, addr + size);
+  unsigned index = AddCodeEntry(addr, entry);
+  code_map_.emplace(addr, CodeEntryMapInfo{index, size});
 }
 
-void CodeMap::DeleteAllCoveredCode(Address start, Address end) {
+void CodeMap::ClearCodesInRange(Address start, Address end) {
   auto left = code_map_.upper_bound(start);
   if (left != code_map_.begin()) {
     --left;
     if (left->first + left->second.size <= start) ++left;
   }
   auto right = left;
-  while (right != code_map_.end() && right->first < end) ++right;
+  for (; right != code_map_.end() && right->first < end; ++right) {
+    if (!entry(right->second.index)->used()) {
+      DeleteCodeEntry(right->second.index);
+    }
+  }
   code_map_.erase(left, right);
 }
 
@@ -506,32 +551,52 @@ CodeEntry* CodeMap::FindEntry(Address addr) {
   if (it == code_map_.begin()) return nullptr;
   --it;
   Address end_address = it->first + it->second.size;
-  return addr < end_address ? it->second.entry : nullptr;
+  return addr < end_address ? entry(it->second.index) : nullptr;
 }
 
 void CodeMap::MoveCode(Address from, Address to) {
   if (from == to) return;
   auto it = code_map_.find(from);
   if (it == code_map_.end()) return;
-  CodeEntryInfo info = it->second;
+  CodeEntryMapInfo info = it->second;
   code_map_.erase(it);
-  AddCode(to, info.entry, info.size);
+  DCHECK(from + info.size <= to || to + info.size <= from);
+  ClearCodesInRange(to, to + info.size);
+  code_map_.emplace(to, info);
+}
+
+unsigned CodeMap::AddCodeEntry(Address start, CodeEntry* entry) {
+  if (free_list_head_ == kNoFreeSlot) {
+    code_entries_.push_back(CodeEntrySlotInfo{entry});
+    return static_cast<unsigned>(code_entries_.size()) - 1;
+  }
+  unsigned index = free_list_head_;
+  free_list_head_ = code_entries_[index].next_free_slot;
+  code_entries_[index].entry = entry;
+  return index;
+}
+
+void CodeMap::DeleteCodeEntry(unsigned index) {
+  delete code_entries_[index].entry;
+  code_entries_[index].next_free_slot = free_list_head_;
+  free_list_head_ = index;
 }
 
 void CodeMap::Print() {
   for (const auto& pair : code_map_) {
-    base::OS::Print("%p %5d %s\n", static_cast<void*>(pair.first),
-                    pair.second.size, pair.second.entry->name());
+    base::OS::Print("%p %5d %s\n", reinterpret_cast<void*>(pair.first),
+                    pair.second.size, entry(pair.second.index)->name());
   }
 }
 
 CpuProfilesCollection::CpuProfilesCollection(Isolate* isolate)
-    : resource_names_(isolate->heap()),
+    : resource_names_(isolate->heap()->HashSeed()),
       profiler_(nullptr),
       current_profiles_semaphore_(1) {}
 
 bool CpuProfilesCollection::StartProfiling(const char* title,
-                                           bool record_samples) {
+                                           bool record_samples,
+                                           ProfilingMode mode) {
   current_profiles_semaphore_.Wait();
   if (static_cast<int>(current_profiles_.size()) >= kMaxSimultaneousProfiles) {
     current_profiles_semaphore_.Signal();
@@ -546,7 +611,7 @@ bool CpuProfilesCollection::StartProfiling(const char* title,
     }
   }
   current_profiles_.emplace_back(
-      new CpuProfile(profiler_, title, record_samples));
+      new CpuProfile(profiler_, title, record_samples, mode));
   current_profiles_semaphore_.Signal();
   return true;
 }
@@ -597,8 +662,8 @@ void CpuProfilesCollection::RemoveProfile(CpuProfile* profile) {
 }
 
 void CpuProfilesCollection::AddPathToCurrentProfiles(
-    base::TimeTicks timestamp, const std::vector<CodeEntry*>& path,
-    int src_line, bool update_stats) {
+    base::TimeTicks timestamp, const ProfileStackTrace& path, int src_line,
+    bool update_stats) {
   // As starting / stopping profiles is rare relatively to this
   // method, we don't bother minimizing the duration of lock holding,
   // e.g. copying contents of the list to a local vector.
@@ -613,17 +678,18 @@ ProfileGenerator::ProfileGenerator(CpuProfilesCollection* profiles)
     : profiles_(profiles) {}
 
 void ProfileGenerator::RecordTickSample(const TickSample& sample) {
-  std::vector<CodeEntry*> entries;
+  ProfileStackTrace stack_trace;
   // Conservatively reserve space for stack frames + pc + function + vm-state.
   // There could in fact be more of them because of inlined entries.
-  entries.reserve(sample.frames_count + 3);
+  stack_trace.reserve(sample.frames_count + 3);
 
   // The ProfileNode knows nothing about all versions of generated code for
   // the same JS function. The line number information associated with
   // the latest version of generated code is used to find a source line number
   // for a JS function. Then, the detected source line is passed to
   // ProfileNode to increase the tick count for this source line.
-  int src_line = v8::CpuProfileNode::kNoLineNumberInfo;
+  const int no_line_info = v8::CpuProfileNode::kNoLineNumberInfo;
+  int src_line = no_line_info;
   bool src_line_not_found = true;
 
   if (sample.pc != nullptr) {
@@ -631,14 +697,16 @@ void ProfileGenerator::RecordTickSample(const TickSample& sample) {
       // Don't use PC when in external callback code, as it can point
       // inside callback's code, and we will erroneously report
       // that a callback calls itself.
-      entries.push_back(FindEntry(sample.external_callback_entry));
+      stack_trace.push_back(
+          {FindEntry(reinterpret_cast<Address>(sample.external_callback_entry)),
+           no_line_info});
     } else {
-      CodeEntry* pc_entry = FindEntry(sample.pc);
+      CodeEntry* pc_entry = FindEntry(reinterpret_cast<Address>(sample.pc));
       // If there is no pc_entry we're likely in native code.
       // Find out, if top of stack was pointing inside a JS function
       // meaning that we have encountered a frameless invocation.
       if (!pc_entry && !sample.has_external_callback) {
-        pc_entry = FindEntry(sample.tos);
+        pc_entry = FindEntry(reinterpret_cast<Address>(sample.tos));
       }
       // If pc is in the function code before it set up stack frame or after the
       // frame was destroyed SafeStackFrameIterator incorrectly thinks that
@@ -652,7 +720,7 @@ void ProfileGenerator::RecordTickSample(const TickSample& sample) {
           src_line = pc_entry->line_number();
         }
         src_line_not_found = false;
-        entries.push_back(pc_entry);
+        stack_trace.push_back({pc_entry, src_line});
 
         if (pc_entry->builtin_id() == Builtins::kFunctionPrototypeApply ||
             pc_entry->builtin_id() == Builtins::kFunctionPrototypeCall) {
@@ -663,7 +731,8 @@ void ProfileGenerator::RecordTickSample(const TickSample& sample) {
           // former case we don't so we simply replace the frame with
           // 'unresolved' entry.
           if (!sample.has_external_callback) {
-            entries.push_back(CodeEntry::unresolved_entry());
+            stack_trace.push_back(
+                {CodeEntry::unresolved_entry(), no_line_info});
           }
         }
       }
@@ -672,6 +741,7 @@ void ProfileGenerator::RecordTickSample(const TickSample& sample) {
     for (unsigned i = 0; i < sample.frames_count; ++i) {
       Address stack_pos = reinterpret_cast<Address>(sample.stack[i]);
       CodeEntry* entry = FindEntry(stack_pos);
+      int line_number = no_line_info;
       if (entry) {
         // Find out if the entry has an inlining stack associated.
         int pc_offset =
@@ -681,8 +751,10 @@ void ProfileGenerator::RecordTickSample(const TickSample& sample) {
         if (inline_stack) {
           std::transform(
               inline_stack->rbegin(), inline_stack->rend(),
-              std::back_inserter(entries),
-              [](const std::unique_ptr<CodeEntry>& ptr) { return ptr.get(); });
+              std::back_inserter(stack_trace),
+              [=](const std::unique_ptr<CodeEntry>& ptr) {
+                return CodeEntryAndLineNumber{ptr.get(), no_line_info};
+              });
         }
         // Skip unresolved frames (e.g. internal frame) and get source line of
         // the first JS caller.
@@ -693,33 +765,30 @@ void ProfileGenerator::RecordTickSample(const TickSample& sample) {
           }
           src_line_not_found = false;
         }
+        line_number = entry->GetSourceLine(pc_offset);
       }
-      entries.push_back(entry);
+      stack_trace.push_back({entry, line_number});
     }
   }
 
   if (FLAG_prof_browser_mode) {
     bool no_symbolized_entries = true;
-    for (auto e : entries) {
-      if (e != nullptr) {
+    for (auto e : stack_trace) {
+      if (e.code_entry != nullptr) {
         no_symbolized_entries = false;
         break;
       }
     }
     // If no frames were symbolized, put the VM state entry in.
     if (no_symbolized_entries) {
-      entries.push_back(EntryForVMState(sample.state));
+      stack_trace.push_back({EntryForVMState(sample.state), no_line_info});
     }
   }
 
-  profiles_->AddPathToCurrentProfiles(sample.timestamp, entries, src_line,
+  profiles_->AddPathToCurrentProfiles(sample.timestamp, stack_trace, src_line,
                                       sample.update_stats);
 }
 
-CodeEntry* ProfileGenerator::FindEntry(void* address) {
-  return code_map_.FindEntry(reinterpret_cast<Address>(address));
-}
-
 CodeEntry* ProfileGenerator::EntryForVMState(StateTag tag) {
   switch (tag) {
     case GC:
diff --git a/deps/v8/src/profiler/profile-generator.h b/deps/v8/src/profiler/profile-generator.h
index 5abb955a4617f9..3e301a40829ea1 100644
--- a/deps/v8/src/profiler/profile-generator.h
+++ b/deps/v8/src/profiler/profile-generator.h
@@ -5,12 +5,17 @@
 #ifndef V8_PROFILER_PROFILE_GENERATOR_H_
 #define V8_PROFILER_PROFILE_GENERATOR_H_
 
+#include <atomic>
+#include <deque>
+#include <limits>
 #include <map>
+#include <memory>
+#include <unordered_map>
+#include <utility>
 #include <vector>
 
 #include "include/v8-profiler.h"
 #include "src/allocation.h"
-#include "src/base/hashmap.h"
 #include "src/log.h"
 #include "src/profiler/strings-storage.h"
 #include "src/source-position.h"
@@ -20,64 +25,71 @@ namespace internal {
 
 struct TickSample;
 
-// Provides a mapping from the offsets within generated code to
-// the source line.
-class JITLineInfoTable : public Malloced {
+// Provides a mapping from the offsets within generated code or a bytecode array
+// to the source line.
+class SourcePositionTable : public Malloced {
  public:
-  JITLineInfoTable();
-  ~JITLineInfoTable();
+  SourcePositionTable() = default;
 
   void SetPosition(int pc_offset, int line);
   int GetSourceLineNumber(int pc_offset) const;
 
-  bool empty() const { return pc_offset_map_.empty(); }
-
  private:
-  // pc_offset -> source line
-  typedef std::map<int, int> PcOffsetMap;
-  PcOffsetMap pc_offset_map_;
-  DISALLOW_COPY_AND_ASSIGN(JITLineInfoTable);
+  struct PCOffsetAndLineNumber {
+    bool operator<(const PCOffsetAndLineNumber& other) const {
+      return pc_offset < other.pc_offset;
+    }
+    int pc_offset;
+    int line_number;
+  };
+  // This is logically a map, but we store it as a vector of pairs, sorted by
+  // the pc offset, so that we can save space and look up items using binary
+  // search.
+  std::vector<PCOffsetAndLineNumber> pc_offsets_to_lines_;
+  DISALLOW_COPY_AND_ASSIGN(SourcePositionTable);
 };
 
-
 class CodeEntry {
  public:
   // CodeEntry doesn't own name strings, just references them.
   inline CodeEntry(CodeEventListener::LogEventsAndTags tag, const char* name,
-                   const char* name_prefix = CodeEntry::kEmptyNamePrefix,
                    const char* resource_name = CodeEntry::kEmptyResourceName,
                    int line_number = v8::CpuProfileNode::kNoLineNumberInfo,
                    int column_number = v8::CpuProfileNode::kNoColumnNumberInfo,
-                   std::unique_ptr<JITLineInfoTable> line_info = nullptr,
-                   Address instruction_start = nullptr);
+                   std::unique_ptr<SourcePositionTable> line_info = nullptr,
+                   Address instruction_start = kNullAddress);
 
-  const char* name_prefix() const { return name_prefix_; }
-  bool has_name_prefix() const { return name_prefix_[0] != '\0'; }
   const char* name() const { return name_; }
   const char* resource_name() const { return resource_name_; }
   int line_number() const { return line_number_; }
   int column_number() const { return column_number_; }
-  const JITLineInfoTable* line_info() const { return line_info_.get(); }
+  const SourcePositionTable* line_info() const { return line_info_.get(); }
   int script_id() const { return script_id_; }
   void set_script_id(int script_id) { script_id_ = script_id; }
   int position() const { return position_; }
   void set_position(int position) { position_ = position; }
   void set_bailout_reason(const char* bailout_reason) {
-    bailout_reason_ = bailout_reason;
+    EnsureRareData()->bailout_reason_ = bailout_reason;
   }
-  const char* bailout_reason() const { return bailout_reason_; }
-
-  void set_deopt_info(const char* deopt_reason, int deopt_id) {
-    DCHECK(!has_deopt_info());
-    deopt_reason_ = deopt_reason;
-    deopt_id_ = deopt_id;
+  const char* bailout_reason() const {
+    return rare_data_ ? rare_data_->bailout_reason_ : kEmptyBailoutReason;
   }
+
+  void set_deopt_info(const char* deopt_reason, int deopt_id,
+                      std::vector<CpuProfileDeoptFrame> inlined_frames);
+
   CpuProfileDeoptInfo GetDeoptInfo();
-  bool has_deopt_info() const { return deopt_id_ != kNoDeoptimizationId; }
+  bool has_deopt_info() const {
+    return rare_data_ && rare_data_->deopt_id_ != kNoDeoptimizationId;
+  }
   void clear_deopt_info() {
-    deopt_reason_ = kNoDeoptReason;
-    deopt_id_ = kNoDeoptimizationId;
+    if (!rare_data_) return;
+    // TODO(alph): Clear rare_data_ if that was the only field in use.
+    rare_data_->deopt_reason_ = kNoDeoptReason;
+    rare_data_->deopt_id_ = kNoDeoptimizationId;
   }
+  void mark_used() { bit_field_ = UsedField::update(bit_field_, true); }
+  bool used() const { return UsedField::decode(bit_field_); }
 
   void FillFunctionInfo(SharedFunctionInfo* shared);
 
@@ -87,7 +99,7 @@ class CodeEntry {
   }
 
   uint32_t GetHash() const;
-  bool IsSameFunctionAs(CodeEntry* entry) const;
+  bool IsSameFunctionAs(const CodeEntry* entry) const;
 
   int GetSourceLine(int pc_offset) const;
 
@@ -96,15 +108,12 @@ class CodeEntry {
   const std::vector<std::unique_ptr<CodeEntry>>* GetInlineStack(
       int pc_offset) const;
 
-  void AddDeoptInlinedFrames(int deopt_id, std::vector<CpuProfileDeoptFrame>);
-  bool HasDeoptInlinedFramesFor(int deopt_id) const;
-
   Address instruction_start() const { return instruction_start_; }
   CodeEventListener::LogEventsAndTags tag() const {
     return TagField::decode(bit_field_);
   }
 
-  static const char* const kEmptyNamePrefix;
+  static const char* const kWasmResourceNamePrefix;
   static const char* const kEmptyResourceName;
   static const char* const kEmptyBailoutReason;
   static const char* const kNoDeoptReason;
@@ -126,6 +135,17 @@ class CodeEntry {
   }
 
  private:
+  struct RareData {
+    const char* deopt_reason_ = kNoDeoptReason;
+    const char* bailout_reason_ = kEmptyBailoutReason;
+    int deopt_id_ = kNoDeoptimizationId;
+    std::unordered_map<int, std::vector<std::unique_ptr<CodeEntry>>>
+        inline_locations_;
+    std::vector<CpuProfileDeoptFrame> deopt_inlined_frames_;
+  };
+
+  RareData* EnsureRareData();
+
   struct ProgramEntryCreateTrait {
     static CodeEntry* Create();
   };
@@ -148,38 +168,42 @@ class CodeEntry {
   static base::LazyDynamicInstance<CodeEntry, UnresolvedEntryCreateTrait>::type
       kUnresolvedEntry;
 
-  class TagField : public BitField<Logger::LogEventsAndTags, 0, 8> {};
-  class BuiltinIdField : public BitField<Builtins::Name, 8, 24> {};
+  using TagField = BitField<Logger::LogEventsAndTags, 0, 8>;
+  using BuiltinIdField = BitField<Builtins::Name, 8, 23>;
+  using UsedField = BitField<bool, 31, 1>;
 
   uint32_t bit_field_;
-  const char* name_prefix_;
   const char* name_;
   const char* resource_name_;
   int line_number_;
   int column_number_;
   int script_id_;
   int position_;
-  const char* bailout_reason_;
-  const char* deopt_reason_;
-  int deopt_id_;
-  std::unique_ptr<JITLineInfoTable> line_info_;
+  std::unique_ptr<SourcePositionTable> line_info_;
   Address instruction_start_;
-  // Should be an unordered_map, but it doesn't currently work on Win & MacOS.
-  std::map<int, std::vector<std::unique_ptr<CodeEntry>>> inline_locations_;
-  std::map<int, std::vector<CpuProfileDeoptFrame>> deopt_inlined_frames_;
+  std::unique_ptr<RareData> rare_data_;
 
   DISALLOW_COPY_AND_ASSIGN(CodeEntry);
 };
 
+struct CodeEntryAndLineNumber {
+  CodeEntry* code_entry;
+  int line_number;
+};
+
+typedef std::vector<CodeEntryAndLineNumber> ProfileStackTrace;
 
 class ProfileTree;
 
 class ProfileNode {
  public:
-  inline ProfileNode(ProfileTree* tree, CodeEntry* entry, ProfileNode* parent);
+  inline ProfileNode(ProfileTree* tree, CodeEntry* entry, ProfileNode* parent,
+                     int line_number = 0);
 
-  ProfileNode* FindChild(CodeEntry* entry);
-  ProfileNode* FindOrAddChild(CodeEntry* entry);
+  ProfileNode* FindChild(
+      CodeEntry* entry,
+      int line_number = v8::CpuProfileNode::kNoLineNumberInfo);
+  ProfileNode* FindOrAddChild(CodeEntry* entry, int line_number = 0);
   void IncrementSelfTicks() { ++self_ticks_; }
   void IncreaseSelfTicks(unsigned amount) { self_ticks_ += amount; }
   void IncrementLineTicks(int src_line);
@@ -190,7 +214,13 @@ class ProfileNode {
   unsigned id() const { return id_; }
   unsigned function_id() const;
   ProfileNode* parent() const { return parent_; }
-  unsigned int GetHitLineCount() const { return line_ticks_.occupancy(); }
+  int line_number() const {
+    return line_number_ != 0 ? line_number_ : entry_->line_number();
+  }
+
+  unsigned int GetHitLineCount() const {
+    return static_cast<unsigned int>(line_ticks_.size());
+  }
   bool GetLineTicks(v8::CpuProfileNode::LineTick* entries,
                     unsigned int length) const;
   void CollectDeoptInfo(CodeEntry* entry);
@@ -201,41 +231,53 @@ class ProfileNode {
 
   void Print(int indent);
 
-  static bool CodeEntriesMatch(void* entry1, void* entry2) {
-    return reinterpret_cast<CodeEntry*>(entry1)
-        ->IsSameFunctionAs(reinterpret_cast<CodeEntry*>(entry2));
-  }
-
  private:
-  static uint32_t CodeEntryHash(CodeEntry* entry) { return entry->GetHash(); }
-
-  static bool LineTickMatch(void* a, void* b) { return a == b; }
+  struct Equals {
+    bool operator()(CodeEntryAndLineNumber lhs,
+                    CodeEntryAndLineNumber rhs) const {
+      return lhs.code_entry->IsSameFunctionAs(rhs.code_entry) &&
+             lhs.line_number == rhs.line_number;
+    }
+  };
+  struct Hasher {
+    std::size_t operator()(CodeEntryAndLineNumber pair) const {
+      return pair.code_entry->GetHash() ^ ComputeIntegerHash(pair.line_number);
+    }
+  };
 
   ProfileTree* tree_;
   CodeEntry* entry_;
   unsigned self_ticks_;
-  // Mapping from CodeEntry* to ProfileNode*
-  base::CustomMatcherHashMap children_;
+  std::unordered_map<CodeEntryAndLineNumber, ProfileNode*, Hasher, Equals>
+      children_;
+  int line_number_;
   std::vector<ProfileNode*> children_list_;
   ProfileNode* parent_;
   unsigned id_;
-  base::CustomMatcherHashMap line_ticks_;
+  // maps line number --> number of ticks
+  std::unordered_map<int, int> line_ticks_;
 
   std::vector<CpuProfileDeoptInfo> deopt_infos_;
 
   DISALLOW_COPY_AND_ASSIGN(ProfileNode);
 };
 
-
 class ProfileTree {
  public:
   explicit ProfileTree(Isolate* isolate);
   ~ProfileTree();
 
+  typedef v8::CpuProfilingMode ProfilingMode;
+
   ProfileNode* AddPathFromEnd(
       const std::vector<CodeEntry*>& path,
       int src_line = v8::CpuProfileNode::kNoLineNumberInfo,
       bool update_stats = true);
+  ProfileNode* AddPathFromEnd(
+      const ProfileStackTrace& path,
+      int src_line = v8::CpuProfileNode::kNoLineNumberInfo,
+      bool update_stats = true,
+      ProfilingMode mode = ProfilingMode::kLeafNodeLineNumbers);
   ProfileNode* root() const { return root_; }
   unsigned next_node_id() { return next_node_id_++; }
   unsigned GetFunctionId(const ProfileNode* node);
@@ -264,7 +306,7 @@ class ProfileTree {
   Isolate* isolate_;
 
   unsigned next_function_id_;
-  base::CustomMatcherHashMap function_ids_;
+  std::unordered_map<CodeEntry*, unsigned> function_ids_;
 
   DISALLOW_COPY_AND_ASSIGN(ProfileTree);
 };
@@ -272,10 +314,13 @@ class ProfileTree {
 
 class CpuProfile {
  public:
-  CpuProfile(CpuProfiler* profiler, const char* title, bool record_samples);
+  typedef v8::CpuProfilingMode ProfilingMode;
+
+  CpuProfile(CpuProfiler* profiler, const char* title, bool record_samples,
+             ProfilingMode mode);
 
   // Add pc -> ... -> main() call path to the profile.
-  void AddPath(base::TimeTicks timestamp, const std::vector<CodeEntry*>& path,
+  void AddPath(base::TimeTicks timestamp, const ProfileStackTrace& path,
                int src_line, bool update_stats);
   void FinishProfile();
 
@@ -301,6 +346,7 @@ class CpuProfile {
 
   const char* title_;
   bool record_samples_;
+  ProfilingMode mode_;
   base::TimeTicks start_time_;
   base::TimeTicks end_time_;
   std::vector<ProfileNode*> samples_;
@@ -308,13 +354,17 @@ class CpuProfile {
   ProfileTree top_down_;
   CpuProfiler* const profiler_;
   size_t streaming_next_sample_;
+  uint32_t id_;
+
+  static std::atomic<uint32_t> last_id_;
 
   DISALLOW_COPY_AND_ASSIGN(CpuProfile);
 };
 
 class CodeMap {
  public:
-  CodeMap() {}
+  CodeMap();
+  ~CodeMap();
 
   void AddCode(Address addr, CodeEntry* entry, unsigned size);
   void MoveCode(Address from, Address to);
@@ -322,16 +372,27 @@ class CodeMap {
   void Print();
 
  private:
-  struct CodeEntryInfo {
-    CodeEntryInfo(CodeEntry* an_entry, unsigned a_size)
-        : entry(an_entry), size(a_size) { }
-    CodeEntry* entry;
+  struct CodeEntryMapInfo {
+    unsigned index;
     unsigned size;
   };
 
-  void DeleteAllCoveredCode(Address start, Address end);
+  union CodeEntrySlotInfo {
+    CodeEntry* entry;
+    unsigned next_free_slot;
+  };
+
+  static constexpr unsigned kNoFreeSlot = std::numeric_limits<unsigned>::max();
+
+  void ClearCodesInRange(Address start, Address end);
+  unsigned AddCodeEntry(Address start, CodeEntry*);
+  void DeleteCodeEntry(unsigned index);
 
-  std::map<Address, CodeEntryInfo> code_map_;
+  CodeEntry* entry(unsigned index) { return code_entries_[index].entry; }
+
+  std::deque<CodeEntrySlotInfo> code_entries_;
+  std::map<Address, CodeEntryMapInfo> code_map_;
+  unsigned free_list_head_ = kNoFreeSlot;
 
   DISALLOW_COPY_AND_ASSIGN(CodeMap);
 };
@@ -340,8 +401,11 @@ class CpuProfilesCollection {
  public:
   explicit CpuProfilesCollection(Isolate* isolate);
 
+  typedef v8::CpuProfilingMode ProfilingMode;
+
   void set_cpu_profiler(CpuProfiler* profiler) { profiler_ = profiler; }
-  bool StartProfiling(const char* title, bool record_samples);
+  bool StartProfiling(const char* title, bool record_samples,
+                      ProfilingMode mode = ProfilingMode::kLeafNodeLineNumbers);
   CpuProfile* StopProfiling(const char* title);
   std::vector<std::unique_ptr<CpuProfile>>* profiles() {
     return &finished_profiles_;
@@ -352,8 +416,8 @@ class CpuProfilesCollection {
 
   // Called from profile generator thread.
   void AddPathToCurrentProfiles(base::TimeTicks timestamp,
-                                const std::vector<CodeEntry*>& path,
-                                int src_line, bool update_stats);
+                                const ProfileStackTrace& path, int src_line,
+                                bool update_stats);
 
   // Limits the number of profiles that can be simultaneously collected.
   static const int kMaxSimultaneousProfiles = 100;
@@ -370,7 +434,6 @@ class CpuProfilesCollection {
   DISALLOW_COPY_AND_ASSIGN(CpuProfilesCollection);
 };
 
-
 class ProfileGenerator {
  public:
   explicit ProfileGenerator(CpuProfilesCollection* profiles);
@@ -380,7 +443,7 @@ class ProfileGenerator {
   CodeMap* code_map() { return &code_map_; }
 
  private:
-  CodeEntry* FindEntry(void* address);
+  CodeEntry* FindEntry(Address address);
   CodeEntry* EntryForVMState(StateTag tag);
 
   CpuProfilesCollection* profiles_;
@@ -389,7 +452,6 @@ class ProfileGenerator {
   DISALLOW_COPY_AND_ASSIGN(ProfileGenerator);
 };
 
-
 }  // namespace internal
 }  // namespace v8
 
diff --git a/deps/v8/src/profiler/profiler-listener.cc b/deps/v8/src/profiler/profiler-listener.cc
index 16ec9d883a1f7f..51327685059037 100644
--- a/deps/v8/src/profiler/profiler-listener.cc
+++ b/deps/v8/src/profiler/profiler-listener.cc
@@ -15,8 +15,11 @@
 namespace v8 {
 namespace internal {
 
-ProfilerListener::ProfilerListener(Isolate* isolate)
-    : function_and_resource_names_(isolate->heap()) {}
+ProfilerListener::ProfilerListener(Isolate* isolate,
+                                   CodeEventObserver* observer)
+    : isolate_(isolate),
+      observer_(observer),
+      function_and_resource_names_(isolate->heap()->HashSeed()) {}
 
 ProfilerListener::~ProfilerListener() = default;
 
@@ -34,10 +37,10 @@ void ProfilerListener::CodeCreateEvent(CodeEventListener::LogEventsAndTags tag,
   CodeEventsContainer evt_rec(CodeEventRecord::CODE_CREATION);
   CodeCreateEventRecord* rec = &evt_rec.CodeCreateEventRecord_;
   rec->start = code->address();
-  rec->entry = NewCodeEntry(
-      tag, GetFunctionName(name), CodeEntry::kEmptyNamePrefix,
-      CodeEntry::kEmptyResourceName, CpuProfileNode::kNoLineNumberInfo,
-      CpuProfileNode::kNoColumnNumberInfo, nullptr, code->InstructionStart());
+  rec->entry = NewCodeEntry(tag, GetName(name), CodeEntry::kEmptyResourceName,
+                            CpuProfileNode::kNoLineNumberInfo,
+                            CpuProfileNode::kNoColumnNumberInfo, nullptr,
+                            code->InstructionStart());
   RecordInliningInfo(rec->entry, code);
   rec->size = code->ExecutableSize();
   DispatchCodeEvent(evt_rec);
@@ -48,10 +51,10 @@ void ProfilerListener::CodeCreateEvent(CodeEventListener::LogEventsAndTags tag,
   CodeEventsContainer evt_rec(CodeEventRecord::CODE_CREATION);
   CodeCreateEventRecord* rec = &evt_rec.CodeCreateEventRecord_;
   rec->start = code->address();
-  rec->entry = NewCodeEntry(
-      tag, GetFunctionName(name), CodeEntry::kEmptyNamePrefix,
-      CodeEntry::kEmptyResourceName, CpuProfileNode::kNoLineNumberInfo,
-      CpuProfileNode::kNoColumnNumberInfo, nullptr, code->InstructionStart());
+  rec->entry = NewCodeEntry(tag, GetName(name), CodeEntry::kEmptyResourceName,
+                            CpuProfileNode::kNoLineNumberInfo,
+                            CpuProfileNode::kNoColumnNumberInfo, nullptr,
+                            code->InstructionStart());
   RecordInliningInfo(rec->entry, code);
   rec->size = code->ExecutableSize();
   DispatchCodeEvent(evt_rec);
@@ -64,11 +67,11 @@ void ProfilerListener::CodeCreateEvent(CodeEventListener::LogEventsAndTags tag,
   CodeEventsContainer evt_rec(CodeEventRecord::CODE_CREATION);
   CodeCreateEventRecord* rec = &evt_rec.CodeCreateEventRecord_;
   rec->start = code->address();
-  rec->entry = NewCodeEntry(
-      tag, GetFunctionName(shared->DebugName()), CodeEntry::kEmptyNamePrefix,
-      GetName(InferScriptName(script_name, shared)),
-      CpuProfileNode::kNoLineNumberInfo, CpuProfileNode::kNoColumnNumberInfo,
-      nullptr, code->InstructionStart());
+  rec->entry = NewCodeEntry(tag, GetName(shared->DebugName()),
+                            GetName(InferScriptName(script_name, shared)),
+                            CpuProfileNode::kNoLineNumberInfo,
+                            CpuProfileNode::kNoColumnNumberInfo, nullptr,
+                            code->InstructionStart());
   RecordInliningInfo(rec->entry, code);
   rec->entry->FillFunctionInfo(shared);
   rec->size = code->ExecutableSize();
@@ -83,12 +86,10 @@ void ProfilerListener::CodeCreateEvent(CodeEventListener::LogEventsAndTags tag,
   CodeEventsContainer evt_rec(CodeEventRecord::CODE_CREATION);
   CodeCreateEventRecord* rec = &evt_rec.CodeCreateEventRecord_;
   rec->start = abstract_code->address();
-  std::unique_ptr<JITLineInfoTable> line_table;
+  std::unique_ptr<SourcePositionTable> line_table;
   if (shared->script()->IsScript()) {
     Script* script = Script::cast(shared->script());
-    line_table.reset(new JITLineInfoTable());
-    int offset = abstract_code->IsCode() ? Code::kHeaderSize
-                                         : BytecodeArray::kHeaderSize;
+    line_table.reset(new SourcePositionTable());
     for (SourcePositionTableIterator it(abstract_code->source_position_table());
          !it.done(); it.Advance()) {
       // TODO(alph,tebbi) Skipping inlined positions for now, because they might
@@ -97,16 +98,14 @@ void ProfilerListener::CodeCreateEvent(CodeEventListener::LogEventsAndTags tag,
         continue;
       int position = it.source_position().ScriptOffset();
       int line_number = script->GetLineNumber(position) + 1;
-      int pc_offset = it.code_offset() + offset;
-      line_table->SetPosition(pc_offset, line_number);
+      line_table->SetPosition(it.code_offset(), line_number);
     }
   }
-  rec->entry = NewCodeEntry(
-      tag, GetFunctionName(shared->DebugName()), CodeEntry::kEmptyNamePrefix,
-      GetName(InferScriptName(script_name, shared)), line, column,
-      std::move(line_table), abstract_code->InstructionStart());
+  rec->entry =
+      NewCodeEntry(tag, GetName(shared->DebugName()),
+                   GetName(InferScriptName(script_name, shared)), line, column,
+                   std::move(line_table), abstract_code->InstructionStart());
   RecordInliningInfo(rec->entry, abstract_code);
-  RecordDeoptInlinedFrames(rec->entry, abstract_code);
   rec->entry->FillFunctionInfo(shared);
   rec->size = abstract_code->ExecutableSize();
   DispatchCodeEvent(evt_rec);
@@ -117,15 +116,11 @@ void ProfilerListener::CodeCreateEvent(CodeEventListener::LogEventsAndTags tag,
                                        wasm::WasmName name) {
   CodeEventsContainer evt_rec(CodeEventRecord::CODE_CREATION);
   CodeCreateEventRecord* rec = &evt_rec.CodeCreateEventRecord_;
-  rec->start = code->instructions().start();
-  // TODO(herhut): Instead of sanitizing here, make sure all wasm functions
-  //               have names.
-  const char* name_ptr =
-      name.start() == nullptr ? "<anonymous>" : GetFunctionName(name.start());
+  rec->start = code->instruction_start();
   rec->entry = NewCodeEntry(
-      tag, name_ptr, CodeEntry::kEmptyNamePrefix, CodeEntry::kEmptyResourceName,
+      tag, GetName(name.start()), CodeEntry::kWasmResourceNamePrefix,
       CpuProfileNode::kNoLineNumberInfo, CpuProfileNode::kNoColumnNumberInfo,
-      nullptr, code->instructions().start());
+      nullptr, code->instruction_start());
   rec->size = code->instructions().length();
   DispatchCodeEvent(evt_rec);
 }
@@ -147,16 +142,20 @@ void ProfilerListener::CodeDisableOptEvent(AbstractCode* code,
   DispatchCodeEvent(evt_rec);
 }
 
-void ProfilerListener::CodeDeoptEvent(Code* code, DeoptKind kind, Address pc,
-                                      int fp_to_sp_delta) {
+void ProfilerListener::CodeDeoptEvent(Code* code, DeoptimizeKind kind,
+                                      Address pc, int fp_to_sp_delta) {
   CodeEventsContainer evt_rec(CodeEventRecord::CODE_DEOPT);
   CodeDeoptEventRecord* rec = &evt_rec.CodeDeoptEventRecord_;
   Deoptimizer::DeoptInfo info = Deoptimizer::GetDeoptInfo(code, pc);
   rec->start = code->address();
   rec->deopt_reason = DeoptimizeReasonToString(info.deopt_reason);
   rec->deopt_id = info.deopt_id;
-  rec->pc = reinterpret_cast<void*>(pc);
+  rec->pc = pc;
   rec->fp_to_sp_delta = fp_to_sp_delta;
+
+  // When a function is deoptimized, we store the deoptimized frame information
+  // for the use of GetDeoptInfos().
+  AttachDeoptInlinedFrames(code, rec);
   DispatchCodeEvent(evt_rec);
 }
 
@@ -165,7 +164,7 @@ void ProfilerListener::GetterCallbackEvent(Name* name, Address entry_point) {
   CodeCreateEventRecord* rec = &evt_rec.CodeCreateEventRecord_;
   rec->start = entry_point;
   rec->entry =
-      NewCodeEntry(CodeEventListener::CALLBACK_TAG, GetName(name), "get ");
+      NewCodeEntry(CodeEventListener::CALLBACK_TAG, GetConsName("get ", name));
   rec->size = 1;
   DispatchCodeEvent(evt_rec);
 }
@@ -175,11 +174,11 @@ void ProfilerListener::RegExpCodeCreateEvent(AbstractCode* code,
   CodeEventsContainer evt_rec(CodeEventRecord::CODE_CREATION);
   CodeCreateEventRecord* rec = &evt_rec.CodeCreateEventRecord_;
   rec->start = code->address();
-  rec->entry = NewCodeEntry(CodeEventListener::REG_EXP_TAG, GetName(source),
-                            "RegExp: ", CodeEntry::kEmptyResourceName,
-                            CpuProfileNode::kNoLineNumberInfo,
-                            CpuProfileNode::kNoColumnNumberInfo, nullptr,
-                            code->raw_instruction_start());
+  rec->entry = NewCodeEntry(
+      CodeEventListener::REG_EXP_TAG, GetConsName("RegExp: ", source),
+      CodeEntry::kEmptyResourceName, CpuProfileNode::kNoLineNumberInfo,
+      CpuProfileNode::kNoColumnNumberInfo, nullptr,
+      code->raw_instruction_start());
   rec->size = code->ExecutableSize();
   DispatchCodeEvent(evt_rec);
 }
@@ -189,7 +188,7 @@ void ProfilerListener::SetterCallbackEvent(Name* name, Address entry_point) {
   CodeCreateEventRecord* rec = &evt_rec.CodeCreateEventRecord_;
   rec->start = entry_point;
   rec->entry =
-      NewCodeEntry(CodeEventListener::CALLBACK_TAG, GetName(name), "set ");
+      NewCodeEntry(CodeEventListener::CALLBACK_TAG, GetConsName("set ", name));
   rec->size = 1;
   DispatchCodeEvent(evt_rec);
 }
@@ -241,9 +240,8 @@ void ProfilerListener::RecordInliningInfo(CodeEntry* entry,
               : CodeEntry::kEmptyResourceName;
 
       CodeEntry* inline_entry =
-          new CodeEntry(entry->tag(), GetFunctionName(shared_info->DebugName()),
-                        CodeEntry::kEmptyNamePrefix, resource_name,
-                        CpuProfileNode::kNoLineNumberInfo,
+          new CodeEntry(entry->tag(), GetName(shared_info->DebugName()),
+                        resource_name, CpuProfileNode::kNoLineNumberInfo,
                         CpuProfileNode::kNoColumnNumberInfo, nullptr,
                         code->InstructionStart());
       inline_entry->FillFunctionInfo(shared_info);
@@ -255,16 +253,18 @@ void ProfilerListener::RecordInliningInfo(CodeEntry* entry,
   }
 }
 
-void ProfilerListener::RecordDeoptInlinedFrames(CodeEntry* entry,
-                                                AbstractCode* abstract_code) {
-  if (abstract_code->kind() != AbstractCode::OPTIMIZED_FUNCTION) return;
-  Handle<Code> code(abstract_code->GetCode());
-
+void ProfilerListener::AttachDeoptInlinedFrames(Code* code,
+                                                CodeDeoptEventRecord* rec) {
+  int deopt_id = rec->deopt_id;
   SourcePosition last_position = SourcePosition::Unknown();
   int mask = RelocInfo::ModeMask(RelocInfo::DEOPT_ID) |
              RelocInfo::ModeMask(RelocInfo::DEOPT_SCRIPT_OFFSET) |
              RelocInfo::ModeMask(RelocInfo::DEOPT_INLINING_ID);
-  for (RelocIterator it(*code, mask); !it.done(); it.next()) {
+
+  rec->deopt_frames = nullptr;
+  rec->deopt_frame_count = 0;
+
+  for (RelocIterator it(code, mask); !it.done(); it.next()) {
     RelocInfo* info = it.rinfo();
     if (info->rmode() == RelocInfo::DEOPT_SCRIPT_OFFSET) {
       int script_offset = static_cast<int>(info->data());
@@ -275,53 +275,39 @@ void ProfilerListener::RecordDeoptInlinedFrames(CodeEntry* entry,
       continue;
     }
     if (info->rmode() == RelocInfo::DEOPT_ID) {
-      int deopt_id = static_cast<int>(info->data());
+      if (deopt_id != static_cast<int>(info->data())) continue;
       DCHECK(last_position.IsKnown());
-      std::vector<CpuProfileDeoptFrame> inlined_frames;
-      for (SourcePositionInfo& pos_info : last_position.InliningStack(code)) {
+
+      // SourcePosition::InliningStack allocates a handle for the SFI of each
+      // frame. These don't escape this function, but quickly add up. This
+      // scope limits their lifetime.
+      HandleScope scope(isolate_);
+      std::vector<SourcePositionInfo> stack =
+          last_position.InliningStack(handle(code, isolate_));
+      CpuProfileDeoptFrame* deopt_frames =
+          new CpuProfileDeoptFrame[stack.size()];
+
+      int deopt_frame_count = 0;
+      for (SourcePositionInfo& pos_info : stack) {
         if (pos_info.position.ScriptOffset() == kNoSourcePosition) continue;
-        if (!pos_info.function->script()->IsScript()) continue;
-        int script_id = Script::cast(pos_info.function->script())->id();
+        if (pos_info.script.is_null()) continue;
+        int script_id = pos_info.script->id();
         size_t offset = static_cast<size_t>(pos_info.position.ScriptOffset());
-        inlined_frames.push_back(CpuProfileDeoptFrame({script_id, offset}));
-      }
-      if (!inlined_frames.empty() &&
-          !entry->HasDeoptInlinedFramesFor(deopt_id)) {
-        entry->AddDeoptInlinedFrames(deopt_id, std::move(inlined_frames));
+        deopt_frames[deopt_frame_count++] = {script_id, offset};
       }
+      rec->deopt_frames = deopt_frames;
+      rec->deopt_frame_count = deopt_frame_count;
+      break;
     }
   }
 }
 
 CodeEntry* ProfilerListener::NewCodeEntry(
     CodeEventListener::LogEventsAndTags tag, const char* name,
-    const char* name_prefix, const char* resource_name, int line_number,
-    int column_number, std::unique_ptr<JITLineInfoTable> line_info,
-    Address instruction_start) {
-  std::unique_ptr<CodeEntry> code_entry = base::make_unique<CodeEntry>(
-      tag, name, name_prefix, resource_name, line_number, column_number,
-      std::move(line_info), instruction_start);
-  CodeEntry* raw_code_entry = code_entry.get();
-  code_entries_.push_back(std::move(code_entry));
-  return raw_code_entry;
-}
-
-void ProfilerListener::AddObserver(CodeEventObserver* observer) {
-  base::LockGuard<base::Mutex> guard(&mutex_);
-  if (observers_.empty()) {
-    code_entries_.clear();
-  }
-  if (std::find(observers_.begin(), observers_.end(), observer) ==
-      observers_.end()) {
-    observers_.push_back(observer);
-  }
-}
-
-void ProfilerListener::RemoveObserver(CodeEventObserver* observer) {
-  base::LockGuard<base::Mutex> guard(&mutex_);
-  auto it = std::find(observers_.begin(), observers_.end(), observer);
-  if (it == observers_.end()) return;
-  observers_.erase(it);
+    const char* resource_name, int line_number, int column_number,
+    std::unique_ptr<SourcePositionTable> line_info, Address instruction_start) {
+  return new CodeEntry(tag, name, resource_name, line_number, column_number,
+                       std::move(line_info), instruction_start);
 }
 
 }  // namespace internal
diff --git a/deps/v8/src/profiler/profiler-listener.h b/deps/v8/src/profiler/profiler-listener.h
index 791b66f3ed0ea4..5cff7cc11d1e91 100644
--- a/deps/v8/src/profiler/profiler-listener.h
+++ b/deps/v8/src/profiler/profiler-listener.h
@@ -5,6 +5,7 @@
 #ifndef V8_PROFILER_PROFILER_LISTENER_H_
 #define V8_PROFILER_PROFILER_LISTENER_H_
 
+#include <memory>
 #include <vector>
 
 #include "src/code-events.h"
@@ -14,16 +15,17 @@ namespace v8 {
 namespace internal {
 
 class CodeEventsContainer;
+class CodeDeoptEventRecord;
 
 class CodeEventObserver {
  public:
   virtual void CodeEventHandler(const CodeEventsContainer& evt_rec) = 0;
-  virtual ~CodeEventObserver() {}
+  virtual ~CodeEventObserver() = default;
 };
 
 class ProfilerListener : public CodeEventListener {
  public:
-  explicit ProfilerListener(Isolate* isolate);
+  ProfilerListener(Isolate*, CodeEventObserver*);
   ~ProfilerListener() override;
 
   void CallbackEvent(Name* name, Address entry_point) override;
@@ -45,7 +47,7 @@ class ProfilerListener : public CodeEventListener {
   void CodeMoveEvent(AbstractCode* from, Address to) override;
   void CodeDisableOptEvent(AbstractCode* code,
                            SharedFunctionInfo* shared) override;
-  void CodeDeoptEvent(Code* code, DeoptKind kind, Address pc,
+  void CodeDeoptEvent(Code* code, DeoptimizeKind kind, Address pc,
                       int fp_to_sp_delta) override;
   void GetterCallbackEvent(Name* name, Address entry_point) override;
   void RegExpCodeCreateEvent(AbstractCode* code, String* source) override;
@@ -54,16 +56,11 @@ class ProfilerListener : public CodeEventListener {
 
   CodeEntry* NewCodeEntry(
       CodeEventListener::LogEventsAndTags tag, const char* name,
-      const char* name_prefix = CodeEntry::kEmptyNamePrefix,
       const char* resource_name = CodeEntry::kEmptyResourceName,
       int line_number = v8::CpuProfileNode::kNoLineNumberInfo,
       int column_number = v8::CpuProfileNode::kNoColumnNumberInfo,
-      std::unique_ptr<JITLineInfoTable> line_info = nullptr,
-      Address instruction_start = nullptr);
-
-  void AddObserver(CodeEventObserver* observer);
-  void RemoveObserver(CodeEventObserver* observer);
-  V8_INLINE bool HasObservers() { return !observers_.empty(); }
+      std::unique_ptr<SourcePositionTable> line_info = nullptr,
+      Address instruction_start = kNullAddress);
 
   const char* GetName(Name* name) {
     return function_and_resource_names_.GetName(name);
@@ -71,29 +68,24 @@ class ProfilerListener : public CodeEventListener {
   const char* GetName(int args_count) {
     return function_and_resource_names_.GetName(args_count);
   }
-  const char* GetFunctionName(Name* name) {
-    return function_and_resource_names_.GetFunctionName(name);
+  const char* GetName(const char* name) {
+    return function_and_resource_names_.GetCopy(name);
   }
-  const char* GetFunctionName(const char* name) {
-    return function_and_resource_names_.GetFunctionName(name);
+  const char* GetConsName(const char* prefix, Name* name) {
+    return function_and_resource_names_.GetConsName(prefix, name);
   }
-  size_t entries_count_for_test() const { return code_entries_.size(); }
 
  private:
   void RecordInliningInfo(CodeEntry* entry, AbstractCode* abstract_code);
-  void RecordDeoptInlinedFrames(CodeEntry* entry, AbstractCode* abstract_code);
+  void AttachDeoptInlinedFrames(Code* code, CodeDeoptEventRecord* rec);
   Name* InferScriptName(Name* name, SharedFunctionInfo* info);
   V8_INLINE void DispatchCodeEvent(const CodeEventsContainer& evt_rec) {
-    base::LockGuard<base::Mutex> guard(&mutex_);
-    for (auto observer : observers_) {
-      observer->CodeEventHandler(evt_rec);
-    }
+    observer_->CodeEventHandler(evt_rec);
   }
 
+  Isolate* isolate_;
+  CodeEventObserver* observer_;
   StringsStorage function_and_resource_names_;
-  std::vector<std::unique_ptr<CodeEntry>> code_entries_;
-  std::vector<CodeEventObserver*> observers_;
-  base::Mutex mutex_;
 
   DISALLOW_COPY_AND_ASSIGN(ProfilerListener);
 };
diff --git a/deps/v8/src/profiler/sampling-heap-profiler.cc b/deps/v8/src/profiler/sampling-heap-profiler.cc
index 734c2ea36d7273..4501cd6f79d6f9 100644
--- a/deps/v8/src/profiler/sampling-heap-profiler.cc
+++ b/deps/v8/src/profiler/sampling-heap-profiler.cc
@@ -204,7 +204,7 @@ SamplingHeapProfiler::AllocationNode* SamplingHeapProfiler::AddStack() {
   // the first element in the list.
   for (auto it = stack.rbegin(); it != stack.rend(); ++it) {
     SharedFunctionInfo* shared = *it;
-    const char* name = this->names()->GetFunctionName(shared->DebugName());
+    const char* name = this->names()->GetName(shared->DebugName());
     int script_id = v8::UnboundScript::kNoScriptId;
     if (shared->script()->IsScript()) {
       Script* script = Script::cast(shared->script());
@@ -282,7 +282,7 @@ v8::AllocationProfile* SamplingHeapProfiler::GetAllocationProfile() {
   {
     Script::Iterator iterator(isolate_);
     while (Script* script = iterator.Next()) {
-      scripts[script->id()] = handle(script);
+      scripts[script->id()] = handle(script, isolate_);
     }
   }
   auto profile = new v8::internal::AllocationProfile();
diff --git a/deps/v8/src/profiler/strings-storage.cc b/deps/v8/src/profiler/strings-storage.cc
index 9ea7770b4b038d..44164792793a23 100644
--- a/deps/v8/src/profiler/strings-storage.cc
+++ b/deps/v8/src/profiler/strings-storage.cc
@@ -6,21 +6,19 @@
 
 #include <memory>
 
+#include "src/allocation.h"
 #include "src/objects-inl.h"
 
 namespace v8 {
 namespace internal {
 
-
 bool StringsStorage::StringsMatch(void* key1, void* key2) {
   return strcmp(reinterpret_cast<char*>(key1), reinterpret_cast<char*>(key2)) ==
          0;
 }
 
-
-StringsStorage::StringsStorage(Heap* heap)
-    : hash_seed_(heap->HashSeed()), names_(StringsMatch) {}
-
+StringsStorage::StringsStorage(uint32_t hash_seed)
+    : hash_seed_(hash_seed), names_(StringsMatch) {}
 
 StringsStorage::~StringsStorage() {
   for (base::HashMap::Entry* p = names_.Start(); p != nullptr;
@@ -29,7 +27,6 @@ StringsStorage::~StringsStorage() {
   }
 }
 
-
 const char* StringsStorage::GetCopy(const char* src) {
   int len = static_cast<int>(strlen(src));
   base::HashMap::Entry* entry = GetEntry(src, len);
@@ -43,7 +40,6 @@ const char* StringsStorage::GetCopy(const char* src) {
   return reinterpret_cast<const char*>(entry->value);
 }
 
-
 const char* StringsStorage::GetFormatted(const char* format, ...) {
   va_list args;
   va_start(args, format);
@@ -52,7 +48,6 @@ const char* StringsStorage::GetFormatted(const char* format, ...) {
   return result;
 }
 
-
 const char* StringsStorage::AddOrDisposeString(char* str, int len) {
   base::HashMap::Entry* entry = GetEntry(str, len);
   if (entry->value == nullptr) {
@@ -65,7 +60,6 @@ const char* StringsStorage::AddOrDisposeString(char* str, int len) {
   return reinterpret_cast<const char*>(entry->value);
 }
 
-
 const char* StringsStorage::GetVFormatted(const char* format, va_list args) {
   Vector<char> str = Vector<char>::New(1024);
   int len = VSNPrintF(str, format, args);
@@ -76,7 +70,6 @@ const char* StringsStorage::GetVFormatted(const char* format, va_list args) {
   return AddOrDisposeString(str.start(), len);
 }
 
-
 const char* StringsStorage::GetName(Name* name) {
   if (name->IsString()) {
     String* str = String::cast(name);
@@ -95,12 +88,23 @@ const char* StringsStorage::GetName(int index) {
   return GetFormatted("%d", index);
 }
 
-const char* StringsStorage::GetFunctionName(Name* name) {
-  return GetName(name);
-}
+const char* StringsStorage::GetConsName(const char* prefix, Name* name) {
+  if (name->IsString()) {
+    String* str = String::cast(name);
+    int length = Min(FLAG_heap_snapshot_string_limit, str->length());
+    int actual_length = 0;
+    std::unique_ptr<char[]> data = str->ToCString(
+        DISALLOW_NULLS, ROBUST_STRING_TRAVERSAL, 0, length, &actual_length);
 
-const char* StringsStorage::GetFunctionName(const char* name) {
-  return GetCopy(name);
+    int cons_length = actual_length + static_cast<int>(strlen(prefix)) + 1;
+    char* cons_result = NewArray<char>(cons_length);
+    snprintf(cons_result, cons_length, "%s%s", prefix, data.get());
+
+    return AddOrDisposeString(cons_result, cons_length);
+  } else if (name->IsSymbol()) {
+    return "<symbol>";
+  }
+  return "";
 }
 
 base::HashMap::Entry* StringsStorage::GetEntry(const char* str, int len) {
diff --git a/deps/v8/src/profiler/strings-storage.h b/deps/v8/src/profiler/strings-storage.h
index 834b5a33350fdf..ccd58f746eaf7f 100644
--- a/deps/v8/src/profiler/strings-storage.h
+++ b/deps/v8/src/profiler/strings-storage.h
@@ -7,33 +7,43 @@
 
 #include <stdarg.h>
 
-#include "src/allocation.h"
 #include "src/base/compiler-specific.h"
 #include "src/base/hashmap.h"
+#include "src/globals.h"
 
 namespace v8 {
 namespace internal {
 
+class Name;
+
 // Provides a storage of strings allocated in C++ heap, to hold them
 // forever, even if they disappear from JS heap or external storage.
-class StringsStorage {
+class V8_EXPORT_PRIVATE StringsStorage {
  public:
-  explicit StringsStorage(Heap* heap);
+  explicit StringsStorage(uint32_t hash_seed);
   ~StringsStorage();
 
+  // Copies the given c-string and stores it, returning the stored copy, or just
+  // returns the existing string in storage if it already exists.
   const char* GetCopy(const char* src);
+  // Returns a formatted string, de-duplicated via the storage.
   PRINTF_FORMAT(2, 3) const char* GetFormatted(const char* format, ...);
-  PRINTF_FORMAT(2, 0)
-  const char* GetVFormatted(const char* format, va_list args);
+  // Returns a stored string resulting from name, or "<symbol>" for a symbol.
   const char* GetName(Name* name);
+  // Returns the string representation of the int from the store.
   const char* GetName(int index);
-  const char* GetFunctionName(Name* name);
-  const char* GetFunctionName(const char* name);
+  // Appends string resulting from name to prefix, then returns the stored
+  // result.
+  const char* GetConsName(const char* prefix, Name* name);
 
  private:
   static bool StringsMatch(void* key1, void* key2);
+  // Adds the string to storage and returns it, or if a matching string exists
+  // in the storage, deletes str and returns the matching string instead.
   const char* AddOrDisposeString(char* str, int len);
   base::CustomMatcherHashMap::Entry* GetEntry(const char* str, int len);
+  PRINTF_FORMAT(2, 0)
+  const char* GetVFormatted(const char* format, va_list args);
 
   uint32_t hash_seed_;
   base::CustomMatcherHashMap names_;
diff --git a/deps/v8/src/profiler/tick-sample.cc b/deps/v8/src/profiler/tick-sample.cc
index a6b8b26d00e3e9..ef44749100cd15 100644
--- a/deps/v8/src/profiler/tick-sample.cc
+++ b/deps/v8/src/profiler/tick-sample.cc
@@ -14,11 +14,10 @@
 namespace v8 {
 namespace {
 
-bool IsSamePage(i::byte* ptr1, i::byte* ptr2) {
+bool IsSamePage(i::Address ptr1, i::Address ptr2) {
   const uint32_t kPageSize = 4096;
-  uintptr_t mask = ~static_cast<uintptr_t>(kPageSize - 1);
-  return (reinterpret_cast<uintptr_t>(ptr1) & mask) ==
-         (reinterpret_cast<uintptr_t>(ptr2) & mask);
+  i::Address mask = ~static_cast<i::Address>(kPageSize - 1);
+  return (ptr1 & mask) == (ptr2 & mask);
 }
 
 // Check if the code at specified address could potentially be a
@@ -29,7 +28,6 @@ bool IsNoFrameRegion(i::Address address) {
     i::byte bytes[8];
     int offsets[4];
   };
-  i::byte* pc = reinterpret_cast<i::byte*>(address);
   static Pattern patterns[] = {
 #if V8_HOST_ARCH_IA32
     // push %ebp
@@ -54,10 +52,11 @@ bool IsNoFrameRegion(i::Address address) {
 #endif
     {0, {}, {}}
   };
+  i::byte* pc = reinterpret_cast<i::byte*>(address);
   for (Pattern* pattern = patterns; pattern->bytes_count; ++pattern) {
     for (int* offset_ptr = pattern->offsets; *offset_ptr != -1; ++offset_ptr) {
       int offset = *offset_ptr;
-      if (!offset || IsSamePage(pc, pc - offset)) {
+      if (!offset || IsSamePage(address, address - offset)) {
         MSAN_MEMORY_IS_INITIALIZED(pc - offset, pattern->bytes_count);
         if (!memcmp(pc - offset, pattern->bytes, pattern->bytes_count))
           return true;
@@ -95,33 +94,32 @@ bool SimulatorHelper::FillRegisters(Isolate* isolate,
   if (simulator == nullptr) return false;
 #if V8_TARGET_ARCH_ARM
   if (!simulator->has_bad_pc()) {
-    state->pc = reinterpret_cast<Address>(simulator->get_pc());
+    state->pc = reinterpret_cast<void*>(simulator->get_pc());
   }
-  state->sp = reinterpret_cast<Address>(simulator->get_register(Simulator::sp));
-  state->fp =
-      reinterpret_cast<Address>(simulator->get_register(Simulator::r11));
+  state->sp = reinterpret_cast<void*>(simulator->get_register(Simulator::sp));
+  state->fp = reinterpret_cast<void*>(simulator->get_register(Simulator::r11));
 #elif V8_TARGET_ARCH_ARM64
-  state->pc = reinterpret_cast<Address>(simulator->pc());
-  state->sp = reinterpret_cast<Address>(simulator->sp());
-  state->fp = reinterpret_cast<Address>(simulator->fp());
+  state->pc = reinterpret_cast<void*>(simulator->pc());
+  state->sp = reinterpret_cast<void*>(simulator->sp());
+  state->fp = reinterpret_cast<void*>(simulator->fp());
 #elif V8_TARGET_ARCH_MIPS || V8_TARGET_ARCH_MIPS64
   if (!simulator->has_bad_pc()) {
-    state->pc = reinterpret_cast<Address>(simulator->get_pc());
+    state->pc = reinterpret_cast<void*>(simulator->get_pc());
   }
-  state->sp = reinterpret_cast<Address>(simulator->get_register(Simulator::sp));
-  state->fp = reinterpret_cast<Address>(simulator->get_register(Simulator::fp));
+  state->sp = reinterpret_cast<void*>(simulator->get_register(Simulator::sp));
+  state->fp = reinterpret_cast<void*>(simulator->get_register(Simulator::fp));
 #elif V8_TARGET_ARCH_PPC
   if (!simulator->has_bad_pc()) {
-    state->pc = reinterpret_cast<Address>(simulator->get_pc());
+    state->pc = reinterpret_cast<void*>(simulator->get_pc());
   }
-  state->sp = reinterpret_cast<Address>(simulator->get_register(Simulator::sp));
-  state->fp = reinterpret_cast<Address>(simulator->get_register(Simulator::fp));
+  state->sp = reinterpret_cast<void*>(simulator->get_register(Simulator::sp));
+  state->fp = reinterpret_cast<void*>(simulator->get_register(Simulator::fp));
 #elif V8_TARGET_ARCH_S390
   if (!simulator->has_bad_pc()) {
-    state->pc = reinterpret_cast<Address>(simulator->get_pc());
+    state->pc = reinterpret_cast<void*>(simulator->get_pc());
   }
-  state->sp = reinterpret_cast<Address>(simulator->get_register(Simulator::sp));
-  state->fp = reinterpret_cast<Address>(simulator->get_register(Simulator::fp));
+  state->sp = reinterpret_cast<void*>(simulator->get_register(Simulator::sp));
+  state->fp = reinterpret_cast<void*>(simulator->get_register(Simulator::fp));
 #endif
   if (state->sp == 0 || state->fp == 0) {
     // It possible that the simulator is interrupted while it is updating
@@ -175,7 +173,8 @@ DISABLE_ASAN void TickSample::Init(Isolate* v8_isolate,
     MSAN_MEMORY_IS_INITIALIZED(regs.sp, sizeof(void*));
     // Sample potential return address value for frameless invocation of
     // stubs (we'll figure out later, if this value makes sense).
-    tos = i::Memory::Address_at(reinterpret_cast<i::Address>(regs.sp));
+    tos = reinterpret_cast<void*>(
+        i::Memory::Address_at(reinterpret_cast<i::Address>(regs.sp)));
   } else {
     tos = nullptr;
   }
@@ -193,7 +192,7 @@ bool TickSample::GetStackSample(Isolate* v8_isolate, RegisterState* regs,
   if (sample_info->vm_state == GC) return true;
 
   i::Address js_entry_sp = isolate->js_entry_sp();
-  if (js_entry_sp == nullptr) return true;  // Not executing JS now.
+  if (js_entry_sp == 0) return true;  // Not executing JS now.
 
 #if defined(USE_SIMULATOR)
   if (use_simulator_reg_state) {
@@ -208,8 +207,8 @@ bool TickSample::GetStackSample(Isolate* v8_isolate, RegisterState* regs,
   // Avoid this check for C++ code, as that would trigger false positives.
   if (regs->pc &&
       isolate->heap()->memory_allocator()->code_range()->contains(
-          static_cast<i::Address>(regs->pc)) &&
-      IsNoFrameRegion(static_cast<i::Address>(regs->pc))) {
+          reinterpret_cast<i::Address>(regs->pc)) &&
+      IsNoFrameRegion(reinterpret_cast<i::Address>(regs->pc))) {
     // The frame is not setup, so it'd be hard to iterate the stack. Bailout.
     return false;
   }
@@ -223,8 +222,9 @@ bool TickSample::GetStackSample(Isolate* v8_isolate, RegisterState* regs,
     i::Address* external_callback_entry_ptr =
         scope->callback_entrypoint_address();
     sample_info->external_callback_entry =
-        external_callback_entry_ptr == nullptr ? nullptr
-                                               : *external_callback_entry_ptr;
+        external_callback_entry_ptr == nullptr
+            ? nullptr
+            : reinterpret_cast<void*>(*external_callback_entry_ptr);
   }
 
   i::SafeStackFrameIterator it(isolate, reinterpret_cast<i::Address>(regs->fp),
@@ -236,14 +236,14 @@ bool TickSample::GetStackSample(Isolate* v8_isolate, RegisterState* regs,
   if (record_c_entry_frame == kIncludeCEntryFrame &&
       (it.top_frame_type() == internal::StackFrame::EXIT ||
        it.top_frame_type() == internal::StackFrame::BUILTIN_EXIT)) {
-    frames[i++] = isolate->c_function();
+    frames[i++] = reinterpret_cast<void*>(isolate->c_function());
   }
   i::RuntimeCallTimer* timer =
       isolate->counters()->runtime_call_stats()->current_timer();
   for (; !it.done() && i < frames_limit; it.Advance()) {
     while (timer && reinterpret_cast<i::Address>(timer) < it.frame()->fp() &&
            i < frames_limit) {
-      frames[i++] = reinterpret_cast<i::Address>(timer->counter());
+      frames[i++] = reinterpret_cast<void*>(timer->counter());
       timer = timer->parent();
     }
     if (i == frames_limit) break;
@@ -263,12 +263,13 @@ bool TickSample::GetStackSample(Isolate* v8_isolate, RegisterState* regs,
       // If the bytecode array is a heap object and the bytecode offset is a
       // Smi, use those, otherwise fall back to using the frame's pc.
       if (HAS_HEAP_OBJECT_TAG(bytecode_array) && HAS_SMI_TAG(bytecode_offset)) {
-        frames[i++] = reinterpret_cast<i::Address>(bytecode_array) +
-                      i::Internals::SmiValue(bytecode_offset);
+        frames[i++] = reinterpret_cast<void*>(
+            reinterpret_cast<i::Address>(bytecode_array) +
+            i::Internals::SmiValue(bytecode_offset));
         continue;
       }
     }
-    frames[i++] = it.frame()->pc();
+    frames[i++] = reinterpret_cast<void*>(it.frame()->pc());
   }
   sample_info->frames_count = i;
   return true;
diff --git a/deps/v8/src/profiler/tracing-cpu-profiler.cc b/deps/v8/src/profiler/tracing-cpu-profiler.cc
index 601adf60ac32ea..c7374f20d2756c 100644
--- a/deps/v8/src/profiler/tracing-cpu-profiler.cc
+++ b/deps/v8/src/profiler/tracing-cpu-profiler.cc
@@ -12,9 +12,10 @@ namespace v8 {
 
 std::unique_ptr<TracingCpuProfiler> TracingCpuProfiler::Create(
     v8::Isolate* isolate) {
-  return std::unique_ptr<TracingCpuProfiler>(
-      new internal::TracingCpuProfilerImpl(
-          reinterpret_cast<internal::Isolate*>(isolate)));
+  // Dummy profiler that does nothing.
+  // Remove it along with the deprecated code.
+  // The actual profiler is created by the isolate itself.
+  return std::unique_ptr<TracingCpuProfiler>(new TracingCpuProfiler());
 }
 
 namespace internal {
diff --git a/deps/v8/src/profiler/unbound-queue.h b/deps/v8/src/profiler/unbound-queue.h
index 062f1ce609302e..0efe95abdf997e 100644
--- a/deps/v8/src/profiler/unbound-queue.h
+++ b/deps/v8/src/profiler/unbound-queue.h
@@ -24,13 +24,13 @@ class UnboundQueue BASE_EMBEDDED {
   inline UnboundQueue();
   inline ~UnboundQueue();
 
-  INLINE(bool Dequeue(Record* rec));
-  INLINE(void Enqueue(const Record& rec));
-  INLINE(bool IsEmpty() const);
-  INLINE(Record* Peek() const);
+  V8_INLINE bool Dequeue(Record* rec);
+  V8_INLINE void Enqueue(const Record& rec);
+  V8_INLINE bool IsEmpty() const;
+  V8_INLINE Record* Peek() const;
 
  private:
-  INLINE(void DeleteFirst());
+  V8_INLINE void DeleteFirst();
 
   struct Node;
 
diff --git a/deps/v8/src/property-descriptor.cc b/deps/v8/src/property-descriptor.cc
index d2a7b6695e2e2b..3fdd39287b9e29 100644
--- a/deps/v8/src/property-descriptor.cc
+++ b/deps/v8/src/property-descriptor.cc
@@ -57,7 +57,7 @@ bool ToPropertyDescriptorFastPath(Isolate* isolate, Handle<JSReceiver> obj,
   // TODO(jkummerow): support dictionary properties?
   if (map->is_dictionary_map()) return false;
   Handle<DescriptorArray> descs =
-      Handle<DescriptorArray>(map->instance_descriptors());
+      Handle<DescriptorArray>(map->instance_descriptors(), isolate);
   for (int i = 0; i < map->NumberOfOwnDescriptors(); i++) {
     PropertyDetails details = descs->GetDetails(i);
     Name* key = descs->GetKey(i);
@@ -76,27 +76,27 @@ bool ToPropertyDescriptorFastPath(Isolate* isolate, Handle<JSReceiver> obj,
     } else {
       DCHECK_EQ(kDescriptor, details.location());
       if (details.kind() == kData) {
-        value = handle(descs->GetValue(i), isolate);
+        value = handle(descs->GetStrongValue(i), isolate);
       } else {
         DCHECK_EQ(kAccessor, details.kind());
         // Bail out to slow path.
         return false;
       }
     }
-    Heap* heap = isolate->heap();
-    if (key == heap->enumerable_string()) {
-      desc->set_enumerable(value->BooleanValue());
-    } else if (key == heap->configurable_string()) {
-      desc->set_configurable(value->BooleanValue());
-    } else if (key == heap->value_string()) {
+    ReadOnlyRoots roots(isolate);
+    if (key == roots.enumerable_string()) {
+      desc->set_enumerable(value->BooleanValue(isolate));
+    } else if (key == roots.configurable_string()) {
+      desc->set_configurable(value->BooleanValue(isolate));
+    } else if (key == roots.value_string()) {
       desc->set_value(value);
-    } else if (key == heap->writable_string()) {
-      desc->set_writable(value->BooleanValue());
-    } else if (key == heap->get_string()) {
+    } else if (key == roots.writable_string()) {
+      desc->set_writable(value->BooleanValue(isolate));
+    } else if (key == roots.get_string()) {
       // Bail out to slow path to throw an exception if necessary.
       if (!value->IsCallable()) return false;
       desc->set_get(value);
-    } else if (key == heap->set_string()) {
+    } else if (key == roots.set_string()) {
       // Bail out to slow path to throw an exception if necessary.
       if (!value->IsCallable()) return false;
       desc->set_set(value);
@@ -212,7 +212,7 @@ bool PropertyDescriptor::ToPropertyDescriptor(Isolate* isolate,
   }
   // 6c. Set the [[Enumerable]] field of desc to enum.
   if (!enumerable.is_null()) {
-    desc->set_enumerable(enumerable->BooleanValue());
+    desc->set_enumerable(enumerable->BooleanValue(isolate));
   }
 
   // configurable?
@@ -224,7 +224,7 @@ bool PropertyDescriptor::ToPropertyDescriptor(Isolate* isolate,
   }
   // 9c. Set the [[Configurable]] field of desc to conf.
   if (!configurable.is_null()) {
-    desc->set_configurable(configurable->BooleanValue());
+    desc->set_configurable(configurable->BooleanValue(isolate));
   }
 
   // value?
@@ -245,7 +245,7 @@ bool PropertyDescriptor::ToPropertyDescriptor(Isolate* isolate,
     return false;
   }
   // 15c. Set the [[Writable]] field of desc to writable.
-  if (!writable.is_null()) desc->set_writable(writable->BooleanValue());
+  if (!writable.is_null()) desc->set_writable(writable->BooleanValue(isolate));
 
   // getter?
   Handle<Object> getter;
@@ -361,11 +361,11 @@ Handle<PropertyDescriptorObject> PropertyDescriptor::ToPropertyDescriptorObject(
   obj->set(PropertyDescriptorObject::kFlagsIndex, Smi::FromInt(flags));
 
   obj->set(PropertyDescriptorObject::kValueIndex,
-           has_value() ? *value_ : isolate->heap()->the_hole_value());
+           has_value() ? *value_ : ReadOnlyRoots(isolate).the_hole_value());
   obj->set(PropertyDescriptorObject::kGetIndex,
-           has_get() ? *get_ : isolate->heap()->the_hole_value());
+           has_get() ? *get_ : ReadOnlyRoots(isolate).the_hole_value());
   obj->set(PropertyDescriptorObject::kSetIndex,
-           has_set() ? *set_ : isolate->heap()->the_hole_value());
+           has_set() ? *set_ : ReadOnlyRoots(isolate).the_hole_value());
 
   return obj;
 }
diff --git a/deps/v8/src/property-details.h b/deps/v8/src/property-details.h
index dbd4f93acd282f..49682588603baf 100644
--- a/deps/v8/src/property-details.h
+++ b/deps/v8/src/property-details.h
@@ -76,11 +76,12 @@ enum PropertyLocation { kField = 0, kDescriptor = 1 };
 
 // Order of modes is significant.
 // Must fit in the BitField PropertyDetails::ConstnessField.
-enum PropertyConstness { kMutable = 0, kConst = 1 };
+enum class PropertyConstness { kMutable = 0, kConst = 1 };
 
 // TODO(ishell): remove once constant field tracking is done.
 const PropertyConstness kDefaultFieldConstness =
-    FLAG_track_constant_fields ? kConst : kMutable;
+    FLAG_track_constant_fields ? PropertyConstness::kConst
+                               : PropertyConstness::kMutable;
 
 class Representation {
  public:
@@ -410,15 +411,15 @@ inline bool IsGeneralizableTo(PropertyLocation a, PropertyLocation b) {
   return b == kField || a == kDescriptor;
 }
 
-// kMutable constness is more general than kConst, kConst generalizes only to
-// itself.
+// PropertyConstness::kMutable constness is more general than
+// VariableMode::kConst, VariableMode::kConst generalizes only to itself.
 inline bool IsGeneralizableTo(PropertyConstness a, PropertyConstness b) {
-  return b == kMutable || a == kConst;
+  return b == PropertyConstness::kMutable || a == PropertyConstness::kConst;
 }
 
 inline PropertyConstness GeneralizeConstness(PropertyConstness a,
                                              PropertyConstness b) {
-  return a == kMutable ? kMutable : b;
+  return a == PropertyConstness::kMutable ? PropertyConstness::kMutable : b;
 }
 
 std::ostream& operator<<(std::ostream& os,
diff --git a/deps/v8/src/property.cc b/deps/v8/src/property.cc
index 136cb821b37f61..dfa5221bc47749 100644
--- a/deps/v8/src/property.cc
+++ b/deps/v8/src/property.cc
@@ -25,16 +25,17 @@ std::ostream& operator<<(std::ostream& os,
 Descriptor Descriptor::DataField(Handle<Name> key, int field_index,
                                  PropertyAttributes attributes,
                                  Representation representation) {
-  return DataField(key, field_index, attributes, kMutable, representation,
-                   FieldType::Any(key->GetIsolate()));
+  return DataField(key, field_index, attributes, PropertyConstness::kMutable,
+                   representation,
+                   MaybeObjectHandle(FieldType::Any(key->GetIsolate())));
 }
 
 Descriptor Descriptor::DataField(Handle<Name> key, int field_index,
                                  PropertyAttributes attributes,
                                  PropertyConstness constness,
                                  Representation representation,
-                                 Handle<Object> wrapped_field_type) {
-  DCHECK(wrapped_field_type->IsSmi() || wrapped_field_type->IsWeakCell());
+                                 MaybeObjectHandle wrapped_field_type) {
+  DCHECK(wrapped_field_type->IsSmi() || wrapped_field_type->IsWeakHeapObject());
   PropertyDetails details(kData, attributes, kField, constness, representation,
                           field_index);
   return Descriptor(key, wrapped_field_type, details);
@@ -44,12 +45,13 @@ Descriptor Descriptor::DataConstant(Handle<Name> key, int field_index,
                                     Handle<Object> value,
                                     PropertyAttributes attributes) {
   if (FLAG_track_constant_fields) {
-    Handle<Object> any_type(FieldType::Any(), key->GetIsolate());
-    return DataField(key, field_index, attributes, kConst,
+    MaybeObjectHandle any_type(FieldType::Any(), key->GetIsolate());
+    return DataField(key, field_index, attributes, PropertyConstness::kConst,
                      Representation::Tagged(), any_type);
 
   } else {
-    return Descriptor(key, value, kData, attributes, kDescriptor, kConst,
+    return Descriptor(key, MaybeObjectHandle(value), kData, attributes,
+                      kDescriptor, PropertyConstness::kConst,
                       value->OptimalRepresentation(), field_index);
   }
 }
@@ -57,7 +59,7 @@ Descriptor Descriptor::DataConstant(Handle<Name> key, int field_index,
 // Outputs PropertyDetails as a dictionary details.
 void PropertyDetails::PrintAsSlowTo(std::ostream& os) {
   os << "(";
-  if (constness() == kConst) os << "const ";
+  if (constness() == PropertyConstness::kConst) os << "const ";
   os << (kind() == kData ? "data" : "accessor");
   os << ", dict_index: " << dictionary_index();
   os << ", attrs: " << attributes() << ")";
@@ -66,7 +68,7 @@ void PropertyDetails::PrintAsSlowTo(std::ostream& os) {
 // Outputs PropertyDetails as a descriptor array details.
 void PropertyDetails::PrintAsFastTo(std::ostream& os, PrintMode mode) {
   os << "(";
-  if (constness() == kConst) os << "const ";
+  if (constness() == PropertyConstness::kConst) os << "const ";
   os << (kind() == kData ? "data" : "accessor");
   if (location() == kField) {
     os << " field";
@@ -90,7 +92,7 @@ void PropertyDetails::PrintAsFastTo(std::ostream& os, PrintMode mode) {
 
 #ifdef OBJECT_PRINT
 void PropertyDetails::Print(bool dictionary_mode) {
-  OFStream os(stdout);
+  StdoutStream os;
   if (dictionary_mode) {
     PrintAsSlowTo(os);
   } else {
diff --git a/deps/v8/src/property.h b/deps/v8/src/property.h
index eccaeb006f90ec..6a99e32ef6f687 100644
--- a/deps/v8/src/property.h
+++ b/deps/v8/src/property.h
@@ -26,7 +26,7 @@ class Descriptor final BASE_EMBEDDED {
   Descriptor() : details_(Smi::kZero) {}
 
   Handle<Name> GetKey() const { return key_; }
-  Handle<Object> GetValue() const { return value_; }
+  MaybeObjectHandle GetValue() const { return value_; }
   PropertyDetails GetDetails() const { return details_; }
 
   void SetSortedKeyIndex(int index) { details_ = details_.set_pointer(index); }
@@ -39,11 +39,12 @@ class Descriptor final BASE_EMBEDDED {
                               PropertyAttributes attributes,
                               PropertyConstness constness,
                               Representation representation,
-                              Handle<Object> wrapped_field_type);
+                              MaybeObjectHandle wrapped_field_type);
 
   static Descriptor DataConstant(Handle<Name> key, Handle<Object> value,
                                  PropertyAttributes attributes) {
-    return Descriptor(key, value, kData, attributes, kDescriptor, kConst,
+    return Descriptor(key, MaybeObjectHandle(value), kData, attributes,
+                      kDescriptor, PropertyConstness::kConst,
                       value->OptimalRepresentation(), 0);
   }
 
@@ -53,17 +54,19 @@ class Descriptor final BASE_EMBEDDED {
 
   static Descriptor AccessorConstant(Handle<Name> key, Handle<Object> foreign,
                                      PropertyAttributes attributes) {
-    return Descriptor(key, foreign, kAccessor, attributes, kDescriptor, kConst,
+    return Descriptor(key, MaybeObjectHandle(foreign), kAccessor, attributes,
+                      kDescriptor, PropertyConstness::kConst,
                       Representation::Tagged(), 0);
   }
 
  private:
   Handle<Name> key_;
-  Handle<Object> value_;
+  MaybeObjectHandle value_;
   PropertyDetails details_;
 
  protected:
-  void Init(Handle<Name> key, Handle<Object> value, PropertyDetails details) {
+  void Init(Handle<Name> key, MaybeObjectHandle value,
+            PropertyDetails details) {
     DCHECK(key->IsUniqueName());
     DCHECK_IMPLIES(key->IsPrivate(), !details.IsEnumerable());
     key_ = key;
@@ -71,13 +74,13 @@ class Descriptor final BASE_EMBEDDED {
     details_ = details;
   }
 
-  Descriptor(Handle<Name> key, Handle<Object> value, PropertyDetails details)
+  Descriptor(Handle<Name> key, MaybeObjectHandle value, PropertyDetails details)
       : key_(key), value_(value), details_(details) {
     DCHECK(key->IsUniqueName());
     DCHECK_IMPLIES(key->IsPrivate(), !details_.IsEnumerable());
   }
 
-  Descriptor(Handle<Name> key, Handle<Object> value, PropertyKind kind,
+  Descriptor(Handle<Name> key, MaybeObjectHandle value, PropertyKind kind,
              PropertyAttributes attributes, PropertyLocation location,
              PropertyConstness constness, Representation representation,
              int field_index)
diff --git a/deps/v8/src/prototype.h b/deps/v8/src/prototype.h
index 3d8a62d7b99ef3..1a0f196fb0476a 100644
--- a/deps/v8/src/prototype.h
+++ b/deps/v8/src/prototype.h
@@ -88,7 +88,7 @@ class PrototypeIterator {
     // PrototypeIterator.
     DCHECK(!handle_.is_null());
     if (handle_->IsAccessCheckNeeded()) {
-      return isolate_->MayAccess(handle(isolate_->context()),
+      return isolate_->MayAccess(handle(isolate_->context(), isolate_),
                                  Handle<JSObject>::cast(handle_));
     }
     return true;
@@ -110,7 +110,7 @@ class PrototypeIterator {
   void Advance() {
     if (handle_.is_null() && object_->IsJSProxy()) {
       is_at_end_ = true;
-      object_ = isolate_->heap()->null_value();
+      object_ = ReadOnlyRoots(isolate_).null_value();
       return;
     } else if (!handle_.is_null() && handle_->IsJSProxy()) {
       is_at_end_ = true;
@@ -137,7 +137,6 @@ class PrototypeIterator {
   }
 
   // Returns false iff a call to JSProxy::GetPrototype throws.
-  // TODO(neis): This should probably replace Advance().
   V8_WARN_UNUSED_RESULT bool AdvanceFollowingProxies() {
     DCHECK(!(handle_.is_null() && object_->IsJSProxy()));
     if (!HasAccess()) {
diff --git a/deps/v8/src/regexp/jsregexp-inl.h b/deps/v8/src/regexp/jsregexp-inl.h
index 1266da320960a1..756210b218f51b 100644
--- a/deps/v8/src/regexp/jsregexp-inl.h
+++ b/deps/v8/src/regexp/jsregexp-inl.h
@@ -8,6 +8,7 @@
 
 #include "src/allocation.h"
 #include "src/objects.h"
+#include "src/objects/js-regexp-inl.h"
 #include "src/regexp/jsregexp.h"
 
 namespace v8 {
@@ -38,11 +39,9 @@ int32_t* RegExpImpl::GlobalCache::FetchNext() {
     int last_end_index = last_match[1];
 
     if (regexp_->TypeTag() == JSRegExp::ATOM) {
-      num_matches_ = RegExpImpl::AtomExecRaw(regexp_,
-                                             subject_,
-                                             last_end_index,
-                                             register_array_,
-                                             register_array_size_);
+      num_matches_ =
+          RegExpImpl::AtomExecRaw(isolate_, regexp_, subject_, last_end_index,
+                                  register_array_, register_array_size_);
     } else {
       int last_start_index = last_match[0];
       if (last_start_index == last_end_index) {
@@ -53,11 +52,9 @@ int32_t* RegExpImpl::GlobalCache::FetchNext() {
         num_matches_ = 0;  // Signal failed match.
         return nullptr;
       }
-      num_matches_ = RegExpImpl::IrregexpExecRaw(regexp_,
-                                                 subject_,
-                                                 last_end_index,
-                                                 register_array_,
-                                                 register_array_size_);
+      num_matches_ = RegExpImpl::IrregexpExecRaw(
+          isolate_, regexp_, subject_, last_end_index, register_array_,
+          register_array_size_);
     }
 
     if (num_matches_ <= 0) return nullptr;
diff --git a/deps/v8/src/regexp/jsregexp.cc b/deps/v8/src/regexp/jsregexp.cc
index e26ebaa74042e0..79e17351272324 100644
--- a/deps/v8/src/regexp/jsregexp.cc
+++ b/deps/v8/src/regexp/jsregexp.cc
@@ -61,17 +61,17 @@ namespace internal {
 
 V8_WARN_UNUSED_RESULT
 static inline MaybeHandle<Object> ThrowRegExpException(
-    Handle<JSRegExp> re, Handle<String> pattern, Handle<String> error_text) {
-  Isolate* isolate = re->GetIsolate();
+    Isolate* isolate, Handle<JSRegExp> re, Handle<String> pattern,
+    Handle<String> error_text) {
   THROW_NEW_ERROR(isolate, NewSyntaxError(MessageTemplate::kMalformedRegExp,
                                           pattern, error_text),
                   Object);
 }
 
-
-inline void ThrowRegExpException(Handle<JSRegExp> re,
+inline void ThrowRegExpException(Isolate* isolate, Handle<JSRegExp> re,
                                  Handle<String> error_text) {
-  USE(ThrowRegExpException(re, Handle<String>(re->Pattern()), error_text));
+  USE(ThrowRegExpException(isolate, re, Handle<String>(re->Pattern(), isolate),
+                           error_text));
 }
 
 
@@ -128,12 +128,11 @@ static bool HasFewDifferentCharacters(Handle<String> pattern) {
 
 // Generic RegExp methods. Dispatches to implementation specific methods.
 
-MaybeHandle<Object> RegExpImpl::Compile(Handle<JSRegExp> re,
+MaybeHandle<Object> RegExpImpl::Compile(Isolate* isolate, Handle<JSRegExp> re,
                                         Handle<String> pattern,
                                         JSRegExp::Flags flags) {
   DCHECK(pattern->IsFlat());
 
-  Isolate* isolate = re->GetIsolate();
   Zone zone(isolate->allocator(), ZONE_NAME);
   CompilationCache* compilation_cache = isolate->compilation_cache();
   MaybeHandle<FixedArray> maybe_cached =
@@ -151,7 +150,7 @@ MaybeHandle<Object> RegExpImpl::Compile(Handle<JSRegExp> re,
   if (!RegExpParser::ParseRegExp(isolate, &zone, &reader, flags,
                                  &parse_result)) {
     // Throw an exception if we fail to parse the pattern.
-    return ThrowRegExpException(re, pattern, parse_result.error);
+    return ThrowRegExpException(isolate, re, pattern, parse_result.error);
   }
 
   bool has_been_compiled = false;
@@ -159,7 +158,7 @@ MaybeHandle<Object> RegExpImpl::Compile(Handle<JSRegExp> re,
   if (parse_result.simple && !IgnoreCase(flags) && !IsSticky(flags) &&
       !HasFewDifferentCharacters(pattern)) {
     // Parse-tree is a single atom that is equal to the pattern.
-    AtomCompile(re, pattern, flags, pattern);
+    AtomCompile(isolate, re, pattern, flags, pattern);
     has_been_compiled = true;
   } else if (parse_result.tree->IsAtom() && !IsSticky(flags) &&
              parse_result.capture_count == 0) {
@@ -170,30 +169,30 @@ MaybeHandle<Object> RegExpImpl::Compile(Handle<JSRegExp> re,
         isolate, atom_string,
         isolate->factory()->NewStringFromTwoByte(atom_pattern), Object);
     if (!IgnoreCase(atom->flags()) && !HasFewDifferentCharacters(atom_string)) {
-      AtomCompile(re, pattern, flags, atom_string);
+      AtomCompile(isolate, re, pattern, flags, atom_string);
       has_been_compiled = true;
     }
   }
   if (!has_been_compiled) {
-    IrregexpInitialize(re, pattern, flags, parse_result.capture_count);
+    IrregexpInitialize(isolate, re, pattern, flags, parse_result.capture_count);
   }
   DCHECK(re->data()->IsFixedArray());
   // Compilation succeeded so the data is set on the regexp
   // and we can store it in the cache.
-  Handle<FixedArray> data(FixedArray::cast(re->data()));
+  Handle<FixedArray> data(FixedArray::cast(re->data()), isolate);
   compilation_cache->PutRegExp(pattern, flags, data);
 
   return re;
 }
 
-MaybeHandle<Object> RegExpImpl::Exec(Handle<JSRegExp> regexp,
+MaybeHandle<Object> RegExpImpl::Exec(Isolate* isolate, Handle<JSRegExp> regexp,
                                      Handle<String> subject, int index,
                                      Handle<RegExpMatchInfo> last_match_info) {
   switch (regexp->TypeTag()) {
     case JSRegExp::ATOM:
-      return AtomExec(regexp, subject, index, last_match_info);
+      return AtomExec(isolate, regexp, subject, index, last_match_info);
     case JSRegExp::IRREGEXP: {
-      return IrregexpExec(regexp, subject, index, last_match_info);
+      return IrregexpExec(isolate, regexp, subject, index, last_match_info);
     }
     default:
       UNREACHABLE();
@@ -203,21 +202,17 @@ MaybeHandle<Object> RegExpImpl::Exec(Handle<JSRegExp> regexp,
 
 // RegExp Atom implementation: Simple string search using indexOf.
 
-
-void RegExpImpl::AtomCompile(Handle<JSRegExp> re,
-                             Handle<String> pattern,
-                             JSRegExp::Flags flags,
+void RegExpImpl::AtomCompile(Isolate* isolate, Handle<JSRegExp> re,
+                             Handle<String> pattern, JSRegExp::Flags flags,
                              Handle<String> match_pattern) {
-  re->GetIsolate()->factory()->SetRegExpAtomData(re,
-                                                 JSRegExp::ATOM,
-                                                 pattern,
-                                                 flags,
-                                                 match_pattern);
+  isolate->factory()->SetRegExpAtomData(re, JSRegExp::ATOM, pattern, flags,
+                                        match_pattern);
 }
 
-static void SetAtomLastCapture(Handle<RegExpMatchInfo> last_match_info,
+static void SetAtomLastCapture(Isolate* isolate,
+                               Handle<RegExpMatchInfo> last_match_info,
                                String* subject, int from, int to) {
-  SealHandleScope shs(last_match_info->GetIsolate());
+  SealHandleScope shs(isolate);
   last_match_info->SetNumberOfCaptureRegisters(2);
   last_match_info->SetLastSubject(subject);
   last_match_info->SetLastInput(subject);
@@ -225,18 +220,13 @@ static void SetAtomLastCapture(Handle<RegExpMatchInfo> last_match_info,
   last_match_info->SetCapture(1, to);
 }
 
-
-int RegExpImpl::AtomExecRaw(Handle<JSRegExp> regexp,
-                            Handle<String> subject,
-                            int index,
-                            int32_t* output,
+int RegExpImpl::AtomExecRaw(Isolate* isolate, Handle<JSRegExp> regexp,
+                            Handle<String> subject, int index, int32_t* output,
                             int output_size) {
-  Isolate* isolate = regexp->GetIsolate();
-
   DCHECK_LE(0, index);
   DCHECK_LE(index, subject->length());
 
-  subject = String::Flatten(subject);
+  subject = String::Flatten(isolate, subject);
   DisallowHeapAllocation no_gc;  // ensure vectors stay valid
 
   String* needle = String::cast(regexp->DataAt(JSRegExp::kAtomPatternIndex));
@@ -277,22 +267,21 @@ int RegExpImpl::AtomExecRaw(Handle<JSRegExp> regexp,
   return output_size / 2;
 }
 
-Handle<Object> RegExpImpl::AtomExec(Handle<JSRegExp> re, Handle<String> subject,
-                                    int index,
+Handle<Object> RegExpImpl::AtomExec(Isolate* isolate, Handle<JSRegExp> re,
+                                    Handle<String> subject, int index,
                                     Handle<RegExpMatchInfo> last_match_info) {
-  Isolate* isolate = re->GetIsolate();
-
   static const int kNumRegisters = 2;
   STATIC_ASSERT(kNumRegisters <= Isolate::kJSRegexpStaticOffsetsVectorSize);
   int32_t* output_registers = isolate->jsregexp_static_offsets_vector();
 
-  int res = AtomExecRaw(re, subject, index, output_registers, kNumRegisters);
+  int res =
+      AtomExecRaw(isolate, re, subject, index, output_registers, kNumRegisters);
 
   if (res == RegExpImpl::RE_FAILURE) return isolate->factory()->null_value();
 
   DCHECK_EQ(res, RegExpImpl::RE_SUCCESS);
   SealHandleScope shs(isolate);
-  SetAtomLastCapture(last_match_info, *subject, output_registers[0],
+  SetAtomLastCapture(isolate, last_match_info, *subject, output_registers[0],
                      output_registers[1]);
   return last_match_info;
 }
@@ -306,7 +295,7 @@ Handle<Object> RegExpImpl::AtomExec(Handle<JSRegExp> re, Handle<String> subject,
 // from the source pattern.
 // If compilation fails, an exception is thrown and this function
 // returns false.
-bool RegExpImpl::EnsureCompiledIrregexp(Handle<JSRegExp> re,
+bool RegExpImpl::EnsureCompiledIrregexp(Isolate* isolate, Handle<JSRegExp> re,
                                         Handle<String> sample_subject,
                                         bool is_one_byte) {
   Object* compiled_code = re->DataAt(JSRegExp::code_index(is_one_byte));
@@ -315,15 +304,13 @@ bool RegExpImpl::EnsureCompiledIrregexp(Handle<JSRegExp> re,
 #else  // V8_INTERPRETED_REGEXP (RegExp native code)
   if (compiled_code->IsCode()) return true;
 #endif
-  return CompileIrregexp(re, sample_subject, is_one_byte);
+  return CompileIrregexp(isolate, re, sample_subject, is_one_byte);
 }
 
-
-bool RegExpImpl::CompileIrregexp(Handle<JSRegExp> re,
+bool RegExpImpl::CompileIrregexp(Isolate* isolate, Handle<JSRegExp> re,
                                  Handle<String> sample_subject,
                                  bool is_one_byte) {
   // Compile the RegExp.
-  Isolate* isolate = re->GetIsolate();
   Zone zone(isolate->allocator(), ZONE_NAME);
   PostponeInterruptsScope postpone(isolate);
 #ifdef DEBUG
@@ -337,15 +324,15 @@ bool RegExpImpl::CompileIrregexp(Handle<JSRegExp> re,
 
   JSRegExp::Flags flags = re->GetFlags();
 
-  Handle<String> pattern(re->Pattern());
-  pattern = String::Flatten(pattern);
+  Handle<String> pattern(re->Pattern(), isolate);
+  pattern = String::Flatten(isolate, pattern);
   RegExpCompileData compile_data;
   FlatStringReader reader(isolate, pattern);
   if (!RegExpParser::ParseRegExp(isolate, &zone, &reader, flags,
                                  &compile_data)) {
     // Throw an exception if we fail to parse the pattern.
     // THIS SHOULD NOT HAPPEN. We already pre-parsed it successfully once.
-    USE(ThrowRegExpException(re, pattern, compile_data.error));
+    USE(ThrowRegExpException(isolate, re, pattern, compile_data.error));
     return false;
   }
   RegExpEngine::CompilationResult result =
@@ -359,11 +346,12 @@ bool RegExpImpl::CompileIrregexp(Handle<JSRegExp> re,
     }
     Handle<String> error_message = isolate->factory()->NewStringFromUtf8(
         CStrVector(result.error_message)).ToHandleChecked();
-    ThrowRegExpException(re, error_message);
+    ThrowRegExpException(isolate, re, error_message);
     return false;
   }
 
-  Handle<FixedArray> data = Handle<FixedArray>(FixedArray::cast(re->data()));
+  Handle<FixedArray> data =
+      Handle<FixedArray>(FixedArray::cast(re->data()), isolate);
   data->set(JSRegExp::code_index(is_one_byte), result.code);
   SetIrregexpCaptureNameMap(*data, compile_data.capture_name_map);
   int register_max = IrregexpMaxRegisterCount(*data);
@@ -413,27 +401,21 @@ Code* RegExpImpl::IrregexpNativeCode(FixedArray* re, bool is_one_byte) {
   return Code::cast(re->get(JSRegExp::code_index(is_one_byte)));
 }
 
-
-void RegExpImpl::IrregexpInitialize(Handle<JSRegExp> re,
+void RegExpImpl::IrregexpInitialize(Isolate* isolate, Handle<JSRegExp> re,
                                     Handle<String> pattern,
-                                    JSRegExp::Flags flags,
-                                    int capture_count) {
+                                    JSRegExp::Flags flags, int capture_count) {
   // Initialize compiled code entries to null.
-  re->GetIsolate()->factory()->SetRegExpIrregexpData(re,
-                                                     JSRegExp::IRREGEXP,
-                                                     pattern,
-                                                     flags,
-                                                     capture_count);
+  isolate->factory()->SetRegExpIrregexpData(re, JSRegExp::IRREGEXP, pattern,
+                                            flags, capture_count);
 }
 
-
-int RegExpImpl::IrregexpPrepare(Handle<JSRegExp> regexp,
+int RegExpImpl::IrregexpPrepare(Isolate* isolate, Handle<JSRegExp> regexp,
                                 Handle<String> subject) {
   DCHECK(subject->IsFlat());
 
   // Check representation of the underlying storage.
   bool is_one_byte = subject->IsOneByteRepresentationUnderneath();
-  if (!EnsureCompiledIrregexp(regexp, subject, is_one_byte)) return -1;
+  if (!EnsureCompiledIrregexp(isolate, regexp, subject, is_one_byte)) return -1;
 
 #ifdef V8_INTERPRETED_REGEXP
   // Byte-code regexp needs space allocated for all its registers.
@@ -449,14 +431,9 @@ int RegExpImpl::IrregexpPrepare(Handle<JSRegExp> regexp,
 #endif  // V8_INTERPRETED_REGEXP
 }
 
-
-int RegExpImpl::IrregexpExecRaw(Handle<JSRegExp> regexp,
-                                Handle<String> subject,
-                                int index,
-                                int32_t* output,
-                                int output_size) {
-  Isolate* isolate = regexp->GetIsolate();
-
+int RegExpImpl::IrregexpExecRaw(Isolate* isolate, Handle<JSRegExp> regexp,
+                                Handle<String> subject, int index,
+                                int32_t* output, int output_size) {
   Handle<FixedArray> irregexp(FixedArray::cast(regexp->data()), isolate);
 
   DCHECK_LE(0, index);
@@ -468,7 +445,7 @@ int RegExpImpl::IrregexpExecRaw(Handle<JSRegExp> regexp,
 #ifndef V8_INTERPRETED_REGEXP
   DCHECK(output_size >= (IrregexpNumberOfCaptures(*irregexp) + 1) * 2);
   do {
-    EnsureCompiledIrregexp(regexp, subject, is_one_byte);
+    EnsureCompiledIrregexp(isolate, regexp, subject, is_one_byte);
     Handle<Code> code(IrregexpNativeCode(*irregexp, is_one_byte), isolate);
     // The stack is used to allocate registers for the compiled regexp code.
     // This means that in case of failure, the output registers array is left
@@ -498,7 +475,7 @@ int RegExpImpl::IrregexpExecRaw(Handle<JSRegExp> regexp,
     // the, potentially, different subject (the string can switch between
     // being internal and external, and even between being Latin1 and UC16,
     // but the characters are always the same).
-    IrregexpPrepare(regexp, subject);
+    IrregexpPrepare(isolate, regexp, subject);
     is_one_byte = subject->IsOneByteRepresentationUnderneath();
   } while (true);
   UNREACHABLE();
@@ -537,12 +514,11 @@ int RegExpImpl::IrregexpExecRaw(Handle<JSRegExp> regexp,
 }
 
 MaybeHandle<Object> RegExpImpl::IrregexpExec(
-    Handle<JSRegExp> regexp, Handle<String> subject, int previous_index,
-    Handle<RegExpMatchInfo> last_match_info) {
-  Isolate* isolate = regexp->GetIsolate();
+    Isolate* isolate, Handle<JSRegExp> regexp, Handle<String> subject,
+    int previous_index, Handle<RegExpMatchInfo> last_match_info) {
   DCHECK_EQ(regexp->TypeTag(), JSRegExp::IRREGEXP);
 
-  subject = String::Flatten(subject);
+  subject = String::Flatten(isolate, subject);
 
   // Prepare space for the return values.
 #if defined(V8_INTERPRETED_REGEXP) && defined(DEBUG)
@@ -552,7 +528,8 @@ MaybeHandle<Object> RegExpImpl::IrregexpExec(
     PrintF("\n\nSubject string: '%s'\n\n", subject->ToCString().get());
   }
 #endif
-  int required_registers = RegExpImpl::IrregexpPrepare(regexp, subject);
+  int required_registers =
+      RegExpImpl::IrregexpPrepare(isolate, regexp, subject);
   if (required_registers < 0) {
     // Compiling failed with an exception.
     DCHECK(isolate->has_pending_exception());
@@ -568,13 +545,14 @@ MaybeHandle<Object> RegExpImpl::IrregexpExec(
     output_registers = isolate->jsregexp_static_offsets_vector();
   }
 
-  int res = RegExpImpl::IrregexpExecRaw(
-      regexp, subject, previous_index, output_registers, required_registers);
+  int res =
+      RegExpImpl::IrregexpExecRaw(isolate, regexp, subject, previous_index,
+                                  output_registers, required_registers);
   if (res == RE_SUCCESS) {
     int capture_count =
         IrregexpNumberOfCaptures(FixedArray::cast(regexp->data()));
-    return SetLastMatchInfo(
-        last_match_info, subject, capture_count, output_registers);
+    return SetLastMatchInfo(isolate, last_match_info, subject, capture_count,
+                            output_registers);
   }
   if (res == RE_EXCEPTION) {
     DCHECK(isolate->has_pending_exception());
@@ -585,8 +563,8 @@ MaybeHandle<Object> RegExpImpl::IrregexpExec(
 }
 
 Handle<RegExpMatchInfo> RegExpImpl::SetLastMatchInfo(
-    Handle<RegExpMatchInfo> last_match_info, Handle<String> subject,
-    int capture_count, int32_t* match) {
+    Isolate* isolate, Handle<RegExpMatchInfo> last_match_info,
+    Handle<String> subject, int capture_count, int32_t* match) {
   // This is the only place where match infos can grow. If, after executing the
   // regexp, RegExpExecStub finds that the match info is too small, it restarts
   // execution in RegExpImpl::Exec, which finally grows the match info right
@@ -600,7 +578,6 @@ Handle<RegExpMatchInfo> RegExpImpl::SetLastMatchInfo(
   if (*result != *last_match_info) {
     // The match info has been reallocated, update the corresponding reference
     // on the native context.
-    Isolate* isolate = last_match_info->GetIsolate();
     if (*last_match_info == *isolate->regexp_last_match_info()) {
       isolate->native_context()->set_regexp_last_match_info(*result);
     } else if (*last_match_info == *isolate->regexp_internal_match_info()) {
@@ -625,7 +602,8 @@ RegExpImpl::GlobalCache::GlobalCache(Handle<JSRegExp> regexp,
     : register_array_(nullptr),
       register_array_size_(0),
       regexp_(regexp),
-      subject_(subject) {
+      subject_(subject),
+      isolate_(isolate) {
 #ifdef V8_INTERPRETED_REGEXP
   bool interpreted = true;
 #else
@@ -638,7 +616,8 @@ RegExpImpl::GlobalCache::GlobalCache(Handle<JSRegExp> regexp,
     // There is no distinction between interpreted and native for atom regexps.
     interpreted = false;
   } else {
-    registers_per_match_ = RegExpImpl::IrregexpPrepare(regexp_, subject_);
+    registers_per_match_ =
+        RegExpImpl::IrregexpPrepare(isolate_, regexp_, subject_);
     if (registers_per_match_ < 0) {
       num_matches_ = -1;  // Signal exception.
       return;
@@ -964,9 +943,9 @@ class RegExpCompiler {
     return unicode_lookaround_position_register_;
   }
 
-  RegExpEngine::CompilationResult Assemble(RegExpMacroAssembler* assembler,
-                                           RegExpNode* start,
-                                           int capture_count,
+  RegExpEngine::CompilationResult Assemble(Isolate* isolate,
+                                           RegExpMacroAssembler* assembler,
+                                           RegExpNode* start, int capture_count,
                                            Handle<String> pattern);
 
   inline void AddWork(RegExpNode* node) {
@@ -1069,14 +1048,9 @@ RegExpCompiler::RegExpCompiler(Isolate* isolate, Zone* zone, int capture_count,
   DCHECK_GE(RegExpMacroAssembler::kMaxRegister, next_register_ - 1);
 }
 
-
 RegExpEngine::CompilationResult RegExpCompiler::Assemble(
-    RegExpMacroAssembler* macro_assembler,
-    RegExpNode* start,
-    int capture_count,
-    Handle<String> pattern) {
-  Isolate* isolate = pattern->GetHeap()->isolate();
-
+    Isolate* isolate, RegExpMacroAssembler* macro_assembler, RegExpNode* start,
+    int capture_count, Handle<String> pattern) {
 #ifdef DEBUG
   if (FLAG_trace_regexp_assembler)
     macro_assembler_ = new RegExpMacroAssemblerTracer(isolate, macro_assembler);
@@ -4715,7 +4689,7 @@ void DispatchTable::Dump() {
 void RegExpEngine::DotPrint(const char* label,
                             RegExpNode* node,
                             bool ignore_case) {
-  OFStream os(stdout);
+  StdoutStream os;
   DotPrinter printer(os, ignore_case);
   printer.PrintNode(label, node);
 }
@@ -6664,12 +6638,13 @@ RegExpEngine::CompilationResult RegExpEngine::Compile(
   bool is_unicode = IsUnicode(flags);
   RegExpCompiler compiler(isolate, zone, data->capture_count, is_one_byte);
 
-  if (compiler.optimize()) compiler.set_optimize(!TooMuchRegExpCode(pattern));
+  if (compiler.optimize())
+    compiler.set_optimize(!TooMuchRegExpCode(isolate, pattern));
 
   // Sample some characters from the middle of the string.
   static const int kSampleSize = 128;
 
-  sample_subject = String::Flatten(sample_subject);
+  sample_subject = String::Flatten(isolate, sample_subject);
   int chars_sampled = 0;
   int half_way = (sample_subject->length() - kSampleSize) / 2;
   for (int i = Max(0, half_way);
@@ -6771,7 +6746,7 @@ RegExpEngine::CompilationResult RegExpEngine::Compile(
   RegExpMacroAssemblerIrregexp macro_assembler(isolate, codes, zone);
 #endif  // V8_INTERPRETED_REGEXP
 
-  macro_assembler.set_slow_safe(TooMuchRegExpCode(pattern));
+  macro_assembler.set_slow_safe(TooMuchRegExpCode(isolate, pattern));
 
   // Inserted here, instead of in Assembler, because it depends on information
   // in the AST that isn't replicated in the Node structure.
@@ -6791,15 +6766,12 @@ RegExpEngine::CompilationResult RegExpEngine::Compile(
     macro_assembler.set_global_mode(mode);
   }
 
-  return compiler.Assemble(&macro_assembler,
-                           node,
-                           data->capture_count,
+  return compiler.Assemble(isolate, &macro_assembler, node, data->capture_count,
                            pattern);
 }
 
-
-bool RegExpEngine::TooMuchRegExpCode(Handle<String> pattern) {
-  Heap* heap = pattern->GetHeap();
+bool RegExpEngine::TooMuchRegExpCode(Isolate* isolate, Handle<String> pattern) {
+  Heap* heap = isolate->heap();
   bool too_much = pattern->length() > RegExpImpl::kRegExpTooLargeToOptimize;
   if (heap->isolate()->total_regexp_code_generated() >
           RegExpImpl::kRegExpCompiledLimit &&
@@ -6900,7 +6872,8 @@ void RegExpResultsCache::Enter(Isolate* isolate, Handle<String> key_string,
     }
   }
   // Convert backing store to a copy-on-write array.
-  value_array->set_map_no_write_barrier(isolate->heap()->fixed_cow_array_map());
+  value_array->set_map_no_write_barrier(
+      ReadOnlyRoots(isolate).fixed_cow_array_map());
 }
 
 
diff --git a/deps/v8/src/regexp/jsregexp.h b/deps/v8/src/regexp/jsregexp.h
index f8d21617a16eaf..fd2a90521dcf3e 100644
--- a/deps/v8/src/regexp/jsregexp.h
+++ b/deps/v8/src/regexp/jsregexp.h
@@ -73,34 +73,29 @@ class RegExpImpl {
   // the implementation wants to store in the data field.
   // Returns false if compilation fails.
   V8_WARN_UNUSED_RESULT static MaybeHandle<Object> Compile(
-      Handle<JSRegExp> re, Handle<String> pattern, JSRegExp::Flags flags);
+      Isolate* isolate, Handle<JSRegExp> re, Handle<String> pattern,
+      JSRegExp::Flags flags);
 
   // See ECMA-262 section 15.10.6.2.
   // This function calls the garbage collector if necessary.
   V8_EXPORT_PRIVATE V8_WARN_UNUSED_RESULT static MaybeHandle<Object> Exec(
-      Handle<JSRegExp> regexp, Handle<String> subject, int index,
-      Handle<RegExpMatchInfo> last_match_info);
+      Isolate* isolate, Handle<JSRegExp> regexp, Handle<String> subject,
+      int index, Handle<RegExpMatchInfo> last_match_info);
 
   // Prepares a JSRegExp object with Irregexp-specific data.
-  static void IrregexpInitialize(Handle<JSRegExp> re,
-                                 Handle<String> pattern,
-                                 JSRegExp::Flags flags,
+  static void IrregexpInitialize(Isolate* isolate, Handle<JSRegExp> re,
+                                 Handle<String> pattern, JSRegExp::Flags flags,
                                  int capture_register_count);
 
-
-  static void AtomCompile(Handle<JSRegExp> re,
-                          Handle<String> pattern,
-                          JSRegExp::Flags flags,
+  static void AtomCompile(Isolate* isolate, Handle<JSRegExp> re,
+                          Handle<String> pattern, JSRegExp::Flags flags,
                           Handle<String> match_pattern);
 
-
-  static int AtomExecRaw(Handle<JSRegExp> regexp,
-                         Handle<String> subject,
-                         int index,
-                         int32_t* output,
+  static int AtomExecRaw(Isolate* isolate, Handle<JSRegExp> regexp,
+                         Handle<String> subject, int index, int32_t* output,
                          int output_size);
 
-  static Handle<Object> AtomExec(Handle<JSRegExp> regexp,
+  static Handle<Object> AtomExec(Isolate* isolate, Handle<JSRegExp> regexp,
                                  Handle<String> subject, int index,
                                  Handle<RegExpMatchInfo> last_match_info);
 
@@ -113,7 +108,7 @@ class RegExpImpl {
   // Returns the number of integer spaces required by IrregexpExecOnce
   // as its "registers" argument.  If the regexp cannot be compiled,
   // an exception is set as pending, and this function returns negative.
-  static int IrregexpPrepare(Handle<JSRegExp> regexp,
+  static int IrregexpPrepare(Isolate* isolate, Handle<JSRegExp> regexp,
                              Handle<String> subject);
 
   // Execute a regular expression on the subject, starting from index.
@@ -122,10 +117,8 @@ class RegExpImpl {
   // The captures and subcaptures are stored into the registers vector.
   // If matching fails, returns RE_FAILURE.
   // If execution fails, sets a pending exception and returns RE_EXCEPTION.
-  static int IrregexpExecRaw(Handle<JSRegExp> regexp,
-                             Handle<String> subject,
-                             int index,
-                             int32_t* output,
+  static int IrregexpExecRaw(Isolate* isolate, Handle<JSRegExp> regexp,
+                             Handle<String> subject, int index, int32_t* output,
                              int output_size);
 
   // Execute an Irregexp bytecode pattern.
@@ -133,14 +126,14 @@ class RegExpImpl {
   // captured positions.  On a failure, the result is the null value.
   // Returns an empty handle in case of an exception.
   V8_WARN_UNUSED_RESULT static MaybeHandle<Object> IrregexpExec(
-      Handle<JSRegExp> regexp, Handle<String> subject, int index,
-      Handle<RegExpMatchInfo> last_match_info);
+      Isolate* isolate, Handle<JSRegExp> regexp, Handle<String> subject,
+      int index, Handle<RegExpMatchInfo> last_match_info);
 
   // Set last match info.  If match is nullptr, then setting captures is
   // omitted.
   static Handle<RegExpMatchInfo> SetLastMatchInfo(
-      Handle<RegExpMatchInfo> last_match_info, Handle<String> subject,
-      int capture_count, int32_t* match);
+      Isolate* isolate, Handle<RegExpMatchInfo> last_match_info,
+      Handle<String> subject, int capture_count, int32_t* match);
 
   class GlobalCache {
    public:
@@ -148,17 +141,17 @@ class RegExpImpl {
                 Handle<String> subject,
                 Isolate* isolate);
 
-    INLINE(~GlobalCache());
+    V8_INLINE ~GlobalCache();
 
     // Fetch the next entry in the cache for global regexp match results.
     // This does not set the last match info.  Upon failure, nullptr is
     // returned. The cause can be checked with Result().  The previous result is
     // still in available in memory when a failure happens.
-    INLINE(int32_t* FetchNext());
+    V8_INLINE int32_t* FetchNext();
 
-    INLINE(int32_t* LastSuccessfulMatch());
+    V8_INLINE int32_t* LastSuccessfulMatch();
 
-    INLINE(bool HasException()) { return num_matches_ < 0; }
+    V8_INLINE bool HasException() { return num_matches_ < 0; }
 
    private:
     int AdvanceZeroLength(int last_index);
@@ -172,6 +165,7 @@ class RegExpImpl {
     int register_array_size_;
     Handle<JSRegExp> regexp_;
     Handle<String> subject_;
+    Isolate* isolate_;
   };
 
   // For acting on the JSRegExp data FixedArray.
@@ -194,9 +188,10 @@ class RegExpImpl {
   static const int kRegExpTooLargeToOptimize = 20 * KB;
 
  private:
-  static bool CompileIrregexp(Handle<JSRegExp> re,
+  static bool CompileIrregexp(Isolate* isolate, Handle<JSRegExp> re,
                               Handle<String> sample_subject, bool is_one_byte);
-  static inline bool EnsureCompiledIrregexp(Handle<JSRegExp> re,
+  static inline bool EnsureCompiledIrregexp(Isolate* isolate,
+                                            Handle<JSRegExp> re,
                                             Handle<String> sample_subject,
                                             bool is_one_byte);
 };
@@ -1519,7 +1514,7 @@ class RegExpEngine: public AllStatic {
   struct CompilationResult {
     CompilationResult(Isolate* isolate, const char* error_message)
         : error_message(error_message),
-          code(isolate->heap()->the_hole_value()),
+          code(ReadOnlyRoots(isolate).the_hole_value()),
           num_registers(0) {}
     CompilationResult(Object* code, int registers)
         : error_message(nullptr), code(code), num_registers(registers) {}
@@ -1535,7 +1530,7 @@ class RegExpEngine: public AllStatic {
                                    Handle<String> sample_subject,
                                    bool is_one_byte);
 
-  static bool TooMuchRegExpCode(Handle<String> pattern);
+  static bool TooMuchRegExpCode(Isolate* isolate, Handle<String> pattern);
 
   static void DotPrint(const char* label, RegExpNode* node, bool ignore_case);
 };
diff --git a/deps/v8/src/regexp/regexp-macro-assembler-irregexp.cc b/deps/v8/src/regexp/regexp-macro-assembler-irregexp.cc
index 076197c940d9eb..eb8d4741f9bab0 100644
--- a/deps/v8/src/regexp/regexp-macro-assembler-irregexp.cc
+++ b/deps/v8/src/regexp/regexp-macro-assembler-irregexp.cc
@@ -439,8 +439,7 @@ int RegExpMacroAssemblerIrregexp::length() {
   return pc_;
 }
 
-
-void RegExpMacroAssemblerIrregexp::Copy(Address a) {
+void RegExpMacroAssemblerIrregexp::Copy(byte* a) {
   MemCopy(a, buffer_.start(), length());
 }
 
diff --git a/deps/v8/src/regexp/regexp-macro-assembler-irregexp.h b/deps/v8/src/regexp/regexp-macro-assembler-irregexp.h
index 8063ebbc2dd0a6..74c8526a239016 100644
--- a/deps/v8/src/regexp/regexp-macro-assembler-irregexp.h
+++ b/deps/v8/src/regexp/regexp-macro-assembler-irregexp.h
@@ -105,7 +105,7 @@ class RegExpMacroAssemblerIrregexp: public RegExpMacroAssembler {
   inline void Emit(uint32_t bc, uint32_t arg);
   // Bytecode buffer.
   int length();
-  void Copy(Address a);
+  void Copy(byte* a);
 
   // The buffer into which code and relocation info are generated.
   Vector<byte> buffer_;
diff --git a/deps/v8/src/regexp/regexp-macro-assembler.cc b/deps/v8/src/regexp/regexp-macro-assembler.cc
index 7798fcecc196b4..77e8847d6881ec 100644
--- a/deps/v8/src/regexp/regexp-macro-assembler.cc
+++ b/deps/v8/src/regexp/regexp-macro-assembler.cc
@@ -166,8 +166,8 @@ int NativeRegExpMacroAssembler::CheckStackGuardState(
   int return_value = 0;
   // Prepare for possible GC.
   HandleScope handles(isolate);
-  Handle<Code> code_handle(re_code);
-  Handle<String> subject_handle(*subject);
+  Handle<Code> code_handle(re_code, isolate);
+  Handle<String> subject_handle(*subject, isolate);
   bool is_one_byte = subject_handle->IsOneByteRepresentationUnderneath();
 
   StackLimitCheck check(isolate);
@@ -359,8 +359,8 @@ Address NativeRegExpMacroAssembler::GrowStack(Address stack_pointer,
   DCHECK(stack_pointer <= old_stack_base);
   DCHECK(static_cast<size_t>(old_stack_base - stack_pointer) <= size);
   Address new_stack_base = regexp_stack->EnsureCapacity(size * 2);
-  if (new_stack_base == nullptr) {
-    return nullptr;
+  if (new_stack_base == kNullAddress) {
+    return kNullAddress;
   }
   *stack_base = new_stack_base;
   intptr_t stack_content_size = old_stack_base - stack_pointer;
diff --git a/deps/v8/src/regexp/regexp-macro-assembler.h b/deps/v8/src/regexp/regexp-macro-assembler.h
index 6fcd5ec4827d74..65da4315687013 100644
--- a/deps/v8/src/regexp/regexp-macro-assembler.h
+++ b/deps/v8/src/regexp/regexp-macro-assembler.h
@@ -244,7 +244,7 @@ class NativeRegExpMacroAssembler: public RegExpMacroAssembler {
   static const byte word_character_map[256];
 
   static Address word_character_map_address() {
-    return const_cast<Address>(&word_character_map[0]);
+    return reinterpret_cast<Address>(&word_character_map[0]);
   }
 
   static Result Execute(Code* code,
diff --git a/deps/v8/src/regexp/regexp-parser.cc b/deps/v8/src/regexp/regexp-parser.cc
index ebc56650b1d8fd..b6e4485254c38a 100644
--- a/deps/v8/src/regexp/regexp-parser.cc
+++ b/deps/v8/src/regexp/regexp-parser.cc
@@ -342,20 +342,15 @@ RegExpTree* RegExpParser::ParseDisjunction() {
             uc32 p = Next();
             Advance(2);
             if (unicode()) {
-              if (FLAG_harmony_regexp_property) {
-                ZoneList<CharacterRange>* ranges =
-                    new (zone()) ZoneList<CharacterRange>(2, zone());
-                if (!ParsePropertyClass(ranges, p == 'P')) {
-                  return ReportError(CStrVector("Invalid property name"));
-                }
-                RegExpCharacterClass* cc = new (zone())
-                    RegExpCharacterClass(zone(), ranges, builder->flags());
-                builder->AddCharacterClass(cc);
-              } else {
-                // With /u, no identity escapes except for syntax characters
-                // are allowed. Otherwise, all identity escapes are allowed.
-                return ReportError(CStrVector("Invalid escape"));
+              ZoneList<CharacterRange>* ranges =
+                  new (zone()) ZoneList<CharacterRange>(2, zone());
+              if (!ParsePropertyClass(ranges, p == 'P')) {
+                return ReportError(CStrVector("Invalid property name"));
               }
+              RegExpCharacterClass* cc = new (zone())
+                  RegExpCharacterClass(zone(), ranges, builder->flags());
+              builder->AddCharacterClass(cc);
+
             } else {
               builder->AddCharacter(p);
             }
@@ -477,18 +472,17 @@ RegExpTree* RegExpParser::ParseDisjunction() {
               builder->AddCharacter('u');
             } else {
               // With /u, invalid escapes are not treated as identity escapes.
-              return ReportError(CStrVector("Invalid unicode escape"));
+              return ReportError(CStrVector("Invalid Unicode escape"));
             }
             break;
           }
           case 'k':
             // Either an identity escape or a named back-reference.  The two
             // interpretations are mutually exclusive: '\k' is interpreted as
-            // an identity escape for non-unicode patterns without named
+            // an identity escape for non-Unicode patterns without named
             // capture groups, and as the beginning of a named back-reference
             // in all other cases.
-            if (FLAG_harmony_regexp_named_captures &&
-                (unicode() || HasNamedCaptures())) {
+            if (unicode() || HasNamedCaptures()) {
               Advance(2);
               ParseNamedBackReference(builder, state CHECK_FAILED);
               break;
@@ -678,13 +672,10 @@ RegExpParser::RegExpParserState* RegExpParser::ParseOpenParenthesis(
           subexpr_type = NEGATIVE_LOOKAROUND;
           break;
         }
-        if (FLAG_harmony_regexp_named_captures) {
-          is_named_capture = true;
-          has_named_captures_ = true;
-          Advance();
-          break;
-        }
-        V8_FALLTHROUGH;
+        is_named_capture = true;
+        has_named_captures_ = true;
+        Advance();
+        break;
       default:
         ReportError(CStrVector("Invalid group"));
         return nullptr;
@@ -765,7 +756,6 @@ void RegExpParser::ScanForCaptures() {
           // * or a named capture '(?<'.
           //
           // Of these, only named captures are capturing groups.
-          if (!FLAG_harmony_regexp_named_captures) break;
 
           Advance();
           if (current() != '<') break;
@@ -830,8 +820,6 @@ static void push_code_unit(ZoneVector<uc16>* v, uint32_t code_unit) {
 }
 
 const ZoneVector<uc16>* RegExpParser::ParseCaptureGroupName() {
-  DCHECK(FLAG_harmony_regexp_named_captures);
-
   ZoneVector<uc16>* name =
       new (zone()->New(sizeof(ZoneVector<uc16>))) ZoneVector<uc16>(zone());
 
@@ -879,7 +867,6 @@ const ZoneVector<uc16>* RegExpParser::ParseCaptureGroupName() {
 
 bool RegExpParser::CreateNamedCaptureAtIndex(const ZoneVector<uc16>* name,
                                              int index) {
-  DCHECK(FLAG_harmony_regexp_named_captures);
   DCHECK(0 < index && index <= captures_started_);
   DCHECK_NOT_NULL(name);
 
@@ -1598,7 +1585,7 @@ void RegExpParser::ParseClassEscape(ZoneList<CharacterRange>* ranges,
         return;
       case 'p':
       case 'P':
-        if (FLAG_harmony_regexp_property && unicode()) {
+        if (unicode()) {
           bool negate = Next() == 'P';
           Advance(2);
           if (!ParsePropertyClass(ranges, negate)) {
@@ -1700,7 +1687,7 @@ bool RegExpParser::ParseRegExp(Isolate* isolate, Zone* zone,
     DCHECK(tree != nullptr);
     DCHECK(result->error.is_null());
     if (FLAG_trace_regexp_parser) {
-      OFStream os(stdout);
+      StdoutStream os;
       tree->Print(os, zone);
       os << "\n";
     }
diff --git a/deps/v8/src/regexp/regexp-stack.cc b/deps/v8/src/regexp/regexp-stack.cc
index 64a694cd42b559..8e9d576db15476 100644
--- a/deps/v8/src/regexp/regexp-stack.cc
+++ b/deps/v8/src/regexp/regexp-stack.cc
@@ -60,23 +60,23 @@ void RegExpStack::ThreadLocal::Free() {
 
 
 Address RegExpStack::EnsureCapacity(size_t size) {
-  if (size > kMaximumStackSize) return nullptr;
+  if (size > kMaximumStackSize) return kNullAddress;
   if (size < kMinimumStackSize) size = kMinimumStackSize;
   if (thread_local_.memory_size_ < size) {
-    Address new_memory = NewArray<byte>(static_cast<int>(size));
+    byte* new_memory = NewArray<byte>(size);
     if (thread_local_.memory_size_ > 0) {
       // Copy original memory into top of new memory.
-      MemCopy(reinterpret_cast<void*>(new_memory + size -
-                                      thread_local_.memory_size_),
-              reinterpret_cast<void*>(thread_local_.memory_),
-              thread_local_.memory_size_);
+      MemCopy(new_memory + size - thread_local_.memory_size_,
+              thread_local_.memory_, thread_local_.memory_size_);
       DeleteArray(thread_local_.memory_);
     }
     thread_local_.memory_ = new_memory;
     thread_local_.memory_size_ = size;
-    thread_local_.limit_ = new_memory + kStackLimitSlack * kPointerSize;
+    thread_local_.limit_ =
+        reinterpret_cast<Address>(new_memory) + kStackLimitSlack * kPointerSize;
   }
-  return thread_local_.memory_ + thread_local_.memory_size_;
+  return reinterpret_cast<Address>(thread_local_.memory_) +
+         thread_local_.memory_size_;
 }
 
 
diff --git a/deps/v8/src/regexp/regexp-stack.h b/deps/v8/src/regexp/regexp-stack.h
index 760f16f24f2081..37cecd355bc90d 100644
--- a/deps/v8/src/regexp/regexp-stack.h
+++ b/deps/v8/src/regexp/regexp-stack.h
@@ -46,7 +46,8 @@ class RegExpStack {
   // Gives the top of the memory used as stack.
   Address stack_base() {
     DCHECK_NE(0, thread_local_.memory_size_);
-    return thread_local_.memory_ + thread_local_.memory_size_;
+    return reinterpret_cast<Address>(thread_local_.memory_) +
+           thread_local_.memory_size_;
   }
 
   // The total size of the memory allocated for the stack.
@@ -76,7 +77,8 @@ class RegExpStack {
   ~RegExpStack();
 
   // Artificial limit used when no memory has been allocated.
-  static const uintptr_t kMemoryTop = static_cast<uintptr_t>(-1);
+  static const Address kMemoryTop =
+      static_cast<Address>(static_cast<uintptr_t>(-1));
 
   // Minimal size of allocated stack area.
   static const size_t kMinimumStackSize = 1 * KB;
@@ -88,13 +90,13 @@ class RegExpStack {
   struct ThreadLocal {
     ThreadLocal() { Clear(); }
     // If memory_size_ > 0 then memory_ must be non-nullptr.
-    Address memory_;
+    byte* memory_;
     size_t memory_size_;
     Address limit_;
     void Clear() {
       memory_ = nullptr;
       memory_size_ = 0;
-      limit_ = reinterpret_cast<Address>(kMemoryTop);
+      limit_ = kMemoryTop;
     }
     void Free();
   };
diff --git a/deps/v8/src/regexp/regexp-utils.cc b/deps/v8/src/regexp/regexp-utils.cc
index 0857342c0c4368..4b394b3e8d5bf6 100644
--- a/deps/v8/src/regexp/regexp-utils.cc
+++ b/deps/v8/src/regexp/regexp-utils.cc
@@ -7,6 +7,7 @@
 #include "src/heap/factory.h"
 #include "src/isolate.h"
 #include "src/objects-inl.h"
+#include "src/objects/js-regexp-inl.h"
 #include "src/regexp/jsregexp.h"
 
 namespace v8 {
@@ -29,7 +30,7 @@ Handle<String> RegExpUtils::GenericCaptureGetter(
   }
 
   if (ok != nullptr) *ok = true;
-  Handle<String> last_subject(match_info->LastSubject());
+  Handle<String> last_subject(match_info->LastSubject(), isolate);
   return isolate->factory()->NewSubString(last_subject, match_start, match_end);
 }
 
@@ -123,10 +124,11 @@ Maybe<bool> RegExpUtils::IsRegExp(Isolate* isolate, Handle<Object> object) {
   Handle<Object> match;
   ASSIGN_RETURN_ON_EXCEPTION_VALUE(
       isolate, match,
-      JSObject::GetProperty(receiver, isolate->factory()->match_symbol()),
+      JSObject::GetProperty(isolate, receiver,
+                            isolate->factory()->match_symbol()),
       Nothing<bool>());
 
-  if (!match->IsUndefined(isolate)) return Just(match->BooleanValue());
+  if (!match->IsUndefined(isolate)) return Just(match->BooleanValue(isolate));
   return Just(object->IsJSRegExp());
 }
 
diff --git a/deps/v8/src/regexp/x64/regexp-macro-assembler-x64.h b/deps/v8/src/regexp/x64/regexp-macro-assembler-x64.h
index e0891f3876c73d..365bbaa6b2a661 100644
--- a/deps/v8/src/regexp/x64/regexp-macro-assembler-x64.h
+++ b/deps/v8/src/regexp/x64/regexp-macro-assembler-x64.h
@@ -252,7 +252,7 @@ class RegExpMacroAssemblerX64: public NativeRegExpMacroAssembler {
   Isolate* isolate() const { return masm_.isolate(); }
 
   MacroAssembler masm_;
-  MacroAssembler::NoRootArrayScope no_root_array_scope_;
+  NoRootArrayScope no_root_array_scope_;
 
   ZoneList<int> code_relative_fixup_positions_;
 
diff --git a/deps/v8/src/register-configuration.cc b/deps/v8/src/register-configuration.cc
index f71423d26e4eb5..335de1a053556a 100644
--- a/deps/v8/src/register-configuration.cc
+++ b/deps/v8/src/register-configuration.cc
@@ -316,6 +316,12 @@ RegisterConfiguration::RegisterConfiguration(
   }
 }
 
+const char* RegisterConfiguration::GetGeneralOrSpecialRegisterName(
+    int code) const {
+  if (code < num_general_registers_) return GetGeneralRegisterName(code);
+  return Assembler::GetSpecialRegisterName(code);
+}
+
 // Assert that kFloat32, kFloat64, and kSimd128 are consecutive values.
 STATIC_ASSERT(static_cast<int>(MachineRepresentation::kSimd128) ==
               static_cast<int>(MachineRepresentation::kFloat64) + 1);
diff --git a/deps/v8/src/register-configuration.h b/deps/v8/src/register-configuration.h
index 1299baac69e50a..ad413cc18a57e9 100644
--- a/deps/v8/src/register-configuration.h
+++ b/deps/v8/src/register-configuration.h
@@ -102,7 +102,9 @@ class V8_EXPORT_PRIVATE RegisterConfiguration {
   bool IsAllocatableSimd128Code(int index) const {
     return ((1 << index) & allocatable_simd128_codes_mask_) != 0;
   }
+  const char* GetGeneralOrSpecialRegisterName(int code) const;
   const char* GetGeneralRegisterName(int code) const {
+    DCHECK_LT(code, num_general_registers_);
     return general_register_names_[code];
   }
   const char* GetFloatRegisterName(int code) const {
diff --git a/deps/v8/src/roots-inl.h b/deps/v8/src/roots-inl.h
new file mode 100644
index 00000000000000..ee5d69231cab5e
--- /dev/null
+++ b/deps/v8/src/roots-inl.h
@@ -0,0 +1,90 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef V8_ROOTS_INL_H_
+#define V8_ROOTS_INL_H_
+
+#include "src/roots.h"
+
+#include "src/heap/heap-inl.h"
+#include "src/objects/api-callbacks.h"
+
+namespace v8 {
+
+namespace internal {
+
+ReadOnlyRoots::ReadOnlyRoots(Isolate* isolate) : heap_(isolate->heap()) {}
+
+#define ROOT_ACCESSOR(type, name, camel_name)                              \
+  type* ReadOnlyRoots::name() {                                            \
+    return type::cast(heap_->roots_[Heap::k##camel_name##RootIndex]);      \
+  }                                                                        \
+  Handle<type> ReadOnlyRoots::name##_handle() {                            \
+    return Handle<type>(                                                   \
+        bit_cast<type**>(&heap_->roots_[Heap::k##camel_name##RootIndex])); \
+  }
+STRONG_READ_ONLY_ROOT_LIST(ROOT_ACCESSOR)
+#undef ROOT_ACCESSOR
+
+#define STRING_ACCESSOR(name, str)                                     \
+  String* ReadOnlyRoots::name() {                                      \
+    return String::cast(heap_->roots_[Heap::k##name##RootIndex]);      \
+  }                                                                    \
+  Handle<String> ReadOnlyRoots::name##_handle() {                      \
+    return Handle<String>(                                             \
+        bit_cast<String**>(&heap_->roots_[Heap::k##name##RootIndex])); \
+  }
+INTERNALIZED_STRING_LIST(STRING_ACCESSOR)
+#undef STRING_ACCESSOR
+
+#define SYMBOL_ACCESSOR(name)                                          \
+  Symbol* ReadOnlyRoots::name() {                                      \
+    return Symbol::cast(heap_->roots_[Heap::k##name##RootIndex]);      \
+  }                                                                    \
+  Handle<Symbol> ReadOnlyRoots::name##_handle() {                      \
+    return Handle<Symbol>(                                             \
+        bit_cast<Symbol**>(&heap_->roots_[Heap::k##name##RootIndex])); \
+  }
+PRIVATE_SYMBOL_LIST(SYMBOL_ACCESSOR)
+#undef SYMBOL_ACCESSOR
+
+#define SYMBOL_ACCESSOR(name, description)                             \
+  Symbol* ReadOnlyRoots::name() {                                      \
+    return Symbol::cast(heap_->roots_[Heap::k##name##RootIndex]);      \
+  }                                                                    \
+  Handle<Symbol> ReadOnlyRoots::name##_handle() {                      \
+    return Handle<Symbol>(                                             \
+        bit_cast<Symbol**>(&heap_->roots_[Heap::k##name##RootIndex])); \
+  }
+PUBLIC_SYMBOL_LIST(SYMBOL_ACCESSOR)
+WELL_KNOWN_SYMBOL_LIST(SYMBOL_ACCESSOR)
+#undef SYMBOL_ACCESSOR
+
+#define STRUCT_MAP_ACCESSOR(NAME, Name, name)                          \
+  Map* ReadOnlyRoots::name##_map() {                                   \
+    return Map::cast(heap_->roots_[Heap::k##Name##MapRootIndex]);      \
+  }                                                                    \
+  Handle<Map> ReadOnlyRoots::name##_map_handle() {                     \
+    return Handle<Map>(                                                \
+        bit_cast<Map**>(&heap_->roots_[Heap::k##Name##MapRootIndex])); \
+  }
+STRUCT_LIST(STRUCT_MAP_ACCESSOR)
+#undef STRUCT_MAP_ACCESSOR
+
+#define ALLOCATION_SITE_MAP_ACCESSOR(NAME, Name, Size, name)                 \
+  Map* ReadOnlyRoots::name##_map() {                                         \
+    return Map::cast(heap_->roots_[Heap::k##Name##Size##MapRootIndex]);      \
+  }                                                                          \
+  Handle<Map> ReadOnlyRoots::name##_map_handle() {                           \
+    return Handle<Map>(                                                      \
+        bit_cast<Map**>(&heap_->roots_[Heap::k##Name##Size##MapRootIndex])); \
+  }
+ALLOCATION_SITE_LIST(ALLOCATION_SITE_MAP_ACCESSOR)
+#undef ALLOCATION_SITE_MAP_ACCESSOR
+
+}  // namespace internal
+
+}  // namespace v8
+
+#endif  // V8_ROOTS_INL_H_
diff --git a/deps/v8/src/roots.h b/deps/v8/src/roots.h
new file mode 100644
index 00000000000000..4e676b456e48e9
--- /dev/null
+++ b/deps/v8/src/roots.h
@@ -0,0 +1,347 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef V8_ROOTS_H_
+#define V8_ROOTS_H_
+
+#include "src/handles.h"
+#include "src/heap-symbols.h"
+#include "src/objects-definitions.h"
+
+namespace v8 {
+
+namespace internal {
+
+// Defines all the read-only roots in Heap.
+#define STRONG_READ_ONLY_ROOT_LIST(V)                                          \
+  /* Cluster the most popular ones in a few cache lines here at the top.    */ \
+  /* The first 32 entries are most often used in the startup snapshot and   */ \
+  /* can use a shorter representation in the serialization format.          */ \
+  V(Map, free_space_map, FreeSpaceMap)                                         \
+  V(Map, one_pointer_filler_map, OnePointerFillerMap)                          \
+  V(Map, two_pointer_filler_map, TwoPointerFillerMap)                          \
+  V(Oddball, uninitialized_value, UninitializedValue)                          \
+  V(Oddball, undefined_value, UndefinedValue)                                  \
+  V(Oddball, the_hole_value, TheHoleValue)                                     \
+  V(Oddball, null_value, NullValue)                                            \
+  V(Oddball, true_value, TrueValue)                                            \
+  V(Oddball, false_value, FalseValue)                                          \
+  V(String, empty_string, empty_string)                                        \
+  V(Map, meta_map, MetaMap)                                                    \
+  V(Map, byte_array_map, ByteArrayMap)                                         \
+  V(Map, fixed_array_map, FixedArrayMap)                                       \
+  V(Map, fixed_cow_array_map, FixedCOWArrayMap)                                \
+  V(Map, hash_table_map, HashTableMap)                                         \
+  V(Map, symbol_map, SymbolMap)                                                \
+  V(Map, one_byte_string_map, OneByteStringMap)                                \
+  V(Map, one_byte_internalized_string_map, OneByteInternalizedStringMap)       \
+  V(Map, scope_info_map, ScopeInfoMap)                                         \
+  V(Map, shared_function_info_map, SharedFunctionInfoMap)                      \
+  V(Map, code_map, CodeMap)                                                    \
+  V(Map, function_context_map, FunctionContextMap)                             \
+  V(Map, cell_map, CellMap)                                                    \
+  V(Map, weak_cell_map, WeakCellMap)                                           \
+  V(Map, global_property_cell_map, GlobalPropertyCellMap)                      \
+  V(Map, foreign_map, ForeignMap)                                              \
+  V(Map, heap_number_map, HeapNumberMap)                                       \
+  V(Map, transition_array_map, TransitionArrayMap)                             \
+  V(Map, feedback_vector_map, FeedbackVectorMap)                               \
+  V(ScopeInfo, empty_scope_info, EmptyScopeInfo)                               \
+  V(FixedArray, empty_fixed_array, EmptyFixedArray)                            \
+  V(DescriptorArray, empty_descriptor_array, EmptyDescriptorArray)             \
+  /* Entries beyond the first 32                                            */ \
+  /* The roots above this line should be boring from a GC point of view.    */ \
+  /* This means they are never in new space and never on a page that is     */ \
+  /* being compacted.*/                                                        \
+  /* Oddballs */                                                               \
+  V(Oddball, arguments_marker, ArgumentsMarker)                                \
+  V(Oddball, exception, Exception)                                             \
+  V(Oddball, termination_exception, TerminationException)                      \
+  V(Oddball, optimized_out, OptimizedOut)                                      \
+  V(Oddball, stale_register, StaleRegister)                                    \
+  /* Context maps */                                                           \
+  V(Map, native_context_map, NativeContextMap)                                 \
+  V(Map, module_context_map, ModuleContextMap)                                 \
+  V(Map, eval_context_map, EvalContextMap)                                     \
+  V(Map, script_context_map, ScriptContextMap)                                 \
+  V(Map, block_context_map, BlockContextMap)                                   \
+  V(Map, catch_context_map, CatchContextMap)                                   \
+  V(Map, with_context_map, WithContextMap)                                     \
+  V(Map, debug_evaluate_context_map, DebugEvaluateContextMap)                  \
+  V(Map, script_context_table_map, ScriptContextTableMap)                      \
+  /* Maps */                                                                   \
+  V(Map, feedback_metadata_map, FeedbackMetadataArrayMap)                      \
+  V(Map, array_list_map, ArrayListMap)                                         \
+  V(Map, bigint_map, BigIntMap)                                                \
+  V(Map, object_boilerplate_description_map, ObjectBoilerplateDescriptionMap)  \
+  V(Map, bytecode_array_map, BytecodeArrayMap)                                 \
+  V(Map, code_data_container_map, CodeDataContainerMap)                        \
+  V(Map, descriptor_array_map, DescriptorArrayMap)                             \
+  V(Map, fixed_double_array_map, FixedDoubleArrayMap)                          \
+  V(Map, global_dictionary_map, GlobalDictionaryMap)                           \
+  V(Map, many_closures_cell_map, ManyClosuresCellMap)                          \
+  V(Map, module_info_map, ModuleInfoMap)                                       \
+  V(Map, mutable_heap_number_map, MutableHeapNumberMap)                        \
+  V(Map, name_dictionary_map, NameDictionaryMap)                               \
+  V(Map, no_closures_cell_map, NoClosuresCellMap)                              \
+  V(Map, number_dictionary_map, NumberDictionaryMap)                           \
+  V(Map, one_closure_cell_map, OneClosureCellMap)                              \
+  V(Map, ordered_hash_map_map, OrderedHashMapMap)                              \
+  V(Map, ordered_hash_set_map, OrderedHashSetMap)                              \
+  V(Map, property_array_map, PropertyArrayMap)                                 \
+  V(Map, side_effect_call_handler_info_map, SideEffectCallHandlerInfoMap)      \
+  V(Map, side_effect_free_call_handler_info_map,                               \
+    SideEffectFreeCallHandlerInfoMap)                                          \
+  V(Map, next_call_side_effect_free_call_handler_info_map,                     \
+    NextCallSideEffectFreeCallHandlerInfoMap)                                  \
+  V(Map, simple_number_dictionary_map, SimpleNumberDictionaryMap)              \
+  V(Map, sloppy_arguments_elements_map, SloppyArgumentsElementsMap)            \
+  V(Map, small_ordered_hash_map_map, SmallOrderedHashMapMap)                   \
+  V(Map, small_ordered_hash_set_map, SmallOrderedHashSetMap)                   \
+  V(Map, string_table_map, StringTableMap)                                     \
+  V(Map, uncompiled_data_without_pre_parsed_scope_map,                         \
+    UncompiledDataWithoutPreParsedScopeMap)                                    \
+  V(Map, uncompiled_data_with_pre_parsed_scope_map,                            \
+    UncompiledDataWithPreParsedScopeMap)                                       \
+  V(Map, weak_fixed_array_map, WeakFixedArrayMap)                              \
+  V(Map, weak_array_list_map, WeakArrayListMap)                                \
+  V(Map, ephemeron_hash_table_map, EphemeronHashTableMap)                      \
+  /* String maps */                                                            \
+  V(Map, native_source_string_map, NativeSourceStringMap)                      \
+  V(Map, string_map, StringMap)                                                \
+  V(Map, cons_one_byte_string_map, ConsOneByteStringMap)                       \
+  V(Map, cons_string_map, ConsStringMap)                                       \
+  V(Map, thin_one_byte_string_map, ThinOneByteStringMap)                       \
+  V(Map, thin_string_map, ThinStringMap)                                       \
+  V(Map, sliced_string_map, SlicedStringMap)                                   \
+  V(Map, sliced_one_byte_string_map, SlicedOneByteStringMap)                   \
+  V(Map, external_string_map, ExternalStringMap)                               \
+  V(Map, external_string_with_one_byte_data_map,                               \
+    ExternalStringWithOneByteDataMap)                                          \
+  V(Map, external_one_byte_string_map, ExternalOneByteStringMap)               \
+  V(Map, short_external_string_map, ShortExternalStringMap)                    \
+  V(Map, short_external_string_with_one_byte_data_map,                         \
+    ShortExternalStringWithOneByteDataMap)                                     \
+  V(Map, internalized_string_map, InternalizedStringMap)                       \
+  V(Map, external_internalized_string_map, ExternalInternalizedStringMap)      \
+  V(Map, external_internalized_string_with_one_byte_data_map,                  \
+    ExternalInternalizedStringWithOneByteDataMap)                              \
+  V(Map, external_one_byte_internalized_string_map,                            \
+    ExternalOneByteInternalizedStringMap)                                      \
+  V(Map, short_external_internalized_string_map,                               \
+    ShortExternalInternalizedStringMap)                                        \
+  V(Map, short_external_internalized_string_with_one_byte_data_map,            \
+    ShortExternalInternalizedStringWithOneByteDataMap)                         \
+  V(Map, short_external_one_byte_internalized_string_map,                      \
+    ShortExternalOneByteInternalizedStringMap)                                 \
+  V(Map, short_external_one_byte_string_map, ShortExternalOneByteStringMap)    \
+  /* Array element maps */                                                     \
+  V(Map, fixed_uint8_array_map, FixedUint8ArrayMap)                            \
+  V(Map, fixed_int8_array_map, FixedInt8ArrayMap)                              \
+  V(Map, fixed_uint16_array_map, FixedUint16ArrayMap)                          \
+  V(Map, fixed_int16_array_map, FixedInt16ArrayMap)                            \
+  V(Map, fixed_uint32_array_map, FixedUint32ArrayMap)                          \
+  V(Map, fixed_int32_array_map, FixedInt32ArrayMap)                            \
+  V(Map, fixed_float32_array_map, FixedFloat32ArrayMap)                        \
+  V(Map, fixed_float64_array_map, FixedFloat64ArrayMap)                        \
+  V(Map, fixed_uint8_clamped_array_map, FixedUint8ClampedArrayMap)             \
+  V(Map, fixed_biguint64_array_map, FixedBigUint64ArrayMap)                    \
+  V(Map, fixed_bigint64_array_map, FixedBigInt64ArrayMap)                      \
+  /* Oddball maps */                                                           \
+  V(Map, undefined_map, UndefinedMap)                                          \
+  V(Map, the_hole_map, TheHoleMap)                                             \
+  V(Map, null_map, NullMap)                                                    \
+  V(Map, boolean_map, BooleanMap)                                              \
+  V(Map, uninitialized_map, UninitializedMap)                                  \
+  V(Map, arguments_marker_map, ArgumentsMarkerMap)                             \
+  V(Map, exception_map, ExceptionMap)                                          \
+  V(Map, termination_exception_map, TerminationExceptionMap)                   \
+  V(Map, optimized_out_map, OptimizedOutMap)                                   \
+  V(Map, stale_register_map, StaleRegisterMap)                                 \
+  V(Map, self_reference_marker_map, SelfReferenceMarkerMap)                    \
+  /* Canonical empty values */                                                 \
+  V(EnumCache, empty_enum_cache, EmptyEnumCache)                               \
+  V(PropertyArray, empty_property_array, EmptyPropertyArray)                   \
+  V(ByteArray, empty_byte_array, EmptyByteArray)                               \
+  V(ObjectBoilerplateDescription, empty_object_boilerplate_description,        \
+    EmptyObjectBoilerplateDescription)                                         \
+  V(FixedTypedArrayBase, empty_fixed_uint8_array, EmptyFixedUint8Array)        \
+  V(FixedTypedArrayBase, empty_fixed_int8_array, EmptyFixedInt8Array)          \
+  V(FixedTypedArrayBase, empty_fixed_uint16_array, EmptyFixedUint16Array)      \
+  V(FixedTypedArrayBase, empty_fixed_int16_array, EmptyFixedInt16Array)        \
+  V(FixedTypedArrayBase, empty_fixed_uint32_array, EmptyFixedUint32Array)      \
+  V(FixedTypedArrayBase, empty_fixed_int32_array, EmptyFixedInt32Array)        \
+  V(FixedTypedArrayBase, empty_fixed_float32_array, EmptyFixedFloat32Array)    \
+  V(FixedTypedArrayBase, empty_fixed_float64_array, EmptyFixedFloat64Array)    \
+  V(FixedTypedArrayBase, empty_fixed_uint8_clamped_array,                      \
+    EmptyFixedUint8ClampedArray)                                               \
+  V(FixedTypedArrayBase, empty_fixed_biguint64_array,                          \
+    EmptyFixedBigUint64Array)                                                  \
+  V(FixedTypedArrayBase, empty_fixed_bigint64_array, EmptyFixedBigInt64Array)  \
+  V(FixedArray, empty_sloppy_arguments_elements, EmptySloppyArgumentsElements) \
+  V(NumberDictionary, empty_slow_element_dictionary,                           \
+    EmptySlowElementDictionary)                                                \
+  V(FixedArray, empty_ordered_hash_map, EmptyOrderedHashMap)                   \
+  V(FixedArray, empty_ordered_hash_set, EmptyOrderedHashSet)                   \
+  V(FeedbackMetadata, empty_feedback_metadata, EmptyFeedbackMetadata)          \
+  V(PropertyCell, empty_property_cell, EmptyPropertyCell)                      \
+  V(WeakCell, empty_weak_cell, EmptyWeakCell)                                  \
+  V(InterceptorInfo, noop_interceptor_info, NoOpInterceptorInfo)               \
+  V(WeakFixedArray, empty_weak_fixed_array, EmptyWeakFixedArray)               \
+  V(WeakArrayList, empty_weak_array_list, EmptyWeakArrayList)                  \
+  /* Special numbers */                                                        \
+  V(HeapNumber, nan_value, NanValue)                                           \
+  V(HeapNumber, hole_nan_value, HoleNanValue)                                  \
+  V(HeapNumber, infinity_value, InfinityValue)                                 \
+  V(HeapNumber, minus_zero_value, MinusZeroValue)                              \
+  V(HeapNumber, minus_infinity_value, MinusInfinityValue)                      \
+  /* Marker for self-references during code-generation */                      \
+  V(HeapObject, self_reference_marker, SelfReferenceMarker)
+
+#define STRONG_MUTABLE_ROOT_LIST(V)                                          \
+  /* Maps */                                                                 \
+  V(Map, external_map, ExternalMap)                                          \
+  V(Map, message_object_map, JSMessageObjectMap)                             \
+  /* Canonical empty values */                                               \
+  V(Script, empty_script, EmptyScript)                                       \
+  V(FeedbackCell, many_closures_cell, ManyClosuresCell)                      \
+  V(Cell, invalid_prototype_validity_cell, InvalidPrototypeValidityCell)     \
+  /* Protectors */                                                           \
+  V(Cell, array_constructor_protector, ArrayConstructorProtector)            \
+  V(PropertyCell, no_elements_protector, NoElementsProtector)                \
+  V(Cell, is_concat_spreadable_protector, IsConcatSpreadableProtector)       \
+  V(PropertyCell, array_species_protector, ArraySpeciesProtector)            \
+  V(PropertyCell, typed_array_species_protector, TypedArraySpeciesProtector) \
+  V(PropertyCell, promise_species_protector, PromiseSpeciesProtector)        \
+  V(Cell, string_length_protector, StringLengthProtector)                    \
+  V(PropertyCell, array_iterator_protector, ArrayIteratorProtector)          \
+  V(PropertyCell, array_buffer_neutering_protector,                          \
+    ArrayBufferNeuteringProtector)                                           \
+  V(PropertyCell, promise_hook_protector, PromiseHookProtector)              \
+  V(Cell, promise_resolve_protector, PromiseResolveProtector)                \
+  V(PropertyCell, promise_then_protector, PromiseThenProtector)              \
+  /* Caches */                                                               \
+  V(FixedArray, number_string_cache, NumberStringCache)                      \
+  V(FixedArray, single_character_string_cache, SingleCharacterStringCache)   \
+  V(FixedArray, string_split_cache, StringSplitCache)                        \
+  V(FixedArray, regexp_multiple_cache, RegExpMultipleCache)                  \
+  /* Lists and dictionaries */                                               \
+  V(NameDictionary, empty_property_dictionary, EmptyPropertyDictionary)      \
+  V(NameDictionary, public_symbol_table, PublicSymbolTable)                  \
+  V(NameDictionary, api_symbol_table, ApiSymbolTable)                        \
+  V(NameDictionary, api_private_symbol_table, ApiPrivateSymbolTable)         \
+  V(Object, script_list, ScriptList)                                         \
+  V(SimpleNumberDictionary, code_stubs, CodeStubs)                           \
+  V(FixedArray, materialized_objects, MaterializedObjects)                   \
+  V(FixedArray, microtask_queue, MicrotaskQueue)                             \
+  V(FixedArray, detached_contexts, DetachedContexts)                         \
+  V(HeapObject, retaining_path_targets, RetainingPathTargets)                \
+  V(WeakArrayList, retained_maps, RetainedMaps)                              \
+  /* Indirection lists for isolate-independent builtins */                   \
+  V(FixedArray, builtins_constants_table, BuiltinsConstantsTable)            \
+  /* Feedback vectors that we need for code coverage or type profile */      \
+  V(Object, feedback_vectors_for_profiling_tools,                            \
+    FeedbackVectorsForProfilingTools)                                        \
+  V(Object, weak_stack_trace_list, WeakStackTraceList)                       \
+  V(Object, noscript_shared_function_infos, NoScriptSharedFunctionInfos)     \
+  V(FixedArray, serialized_objects, SerializedObjects)                       \
+  V(FixedArray, serialized_global_proxy_sizes, SerializedGlobalProxySizes)   \
+  V(TemplateList, message_listeners, MessageListeners)                       \
+  /* DeserializeLazy handlers for lazy bytecode deserialization */           \
+  V(Object, deserialize_lazy_handler, DeserializeLazyHandler)                \
+  V(Object, deserialize_lazy_handler_wide, DeserializeLazyHandlerWide)       \
+  V(Object, deserialize_lazy_handler_extra_wide,                             \
+    DeserializeLazyHandlerExtraWide)                                         \
+  /* JS Entries */                                                           \
+  V(Code, js_entry_code, JsEntryCode)                                        \
+  V(Code, js_construct_entry_code, JsConstructEntryCode)                     \
+  V(Code, js_run_microtasks_entry_code, JsRunMicrotasksEntryCode)
+
+#define STRONG_ROOT_LIST(V)     \
+  STRONG_READ_ONLY_ROOT_LIST(V) \
+  STRONG_MUTABLE_ROOT_LIST(V)
+
+// Entries in this list are limited to Smis and are not visited during GC.
+#define SMI_ROOT_LIST(V)                                                       \
+  V(Smi, stack_limit, StackLimit)                                              \
+  V(Smi, real_stack_limit, RealStackLimit)                                     \
+  V(Smi, last_script_id, LastScriptId)                                         \
+  V(Smi, last_debugging_id, LastDebuggingId)                                   \
+  V(Smi, hash_seed, HashSeed)                                                  \
+  /* To distinguish the function templates, so that we can find them in the */ \
+  /* function cache of the native context. */                                  \
+  V(Smi, next_template_serial_number, NextTemplateSerialNumber)                \
+  V(Smi, arguments_adaptor_deopt_pc_offset, ArgumentsAdaptorDeoptPCOffset)     \
+  V(Smi, construct_stub_create_deopt_pc_offset,                                \
+    ConstructStubCreateDeoptPCOffset)                                          \
+  V(Smi, construct_stub_invoke_deopt_pc_offset,                                \
+    ConstructStubInvokeDeoptPCOffset)                                          \
+  V(Smi, interpreter_entry_return_pc_offset, InterpreterEntryReturnPCOffset)
+
+#define MUTABLE_ROOT_LIST(V)  \
+  STRONG_MUTABLE_ROOT_LIST(V) \
+  SMI_ROOT_LIST(V)            \
+  V(StringTable, string_table, StringTable)
+
+#define ROOT_LIST(V)   \
+  MUTABLE_ROOT_LIST(V) \
+  STRONG_READ_ONLY_ROOT_LIST(V)
+
+class Heap;
+class Isolate;
+class Map;
+class String;
+class Symbol;
+
+class ReadOnlyRoots {
+ public:
+  explicit ReadOnlyRoots(Heap* heap) : heap_(heap) {}
+  inline explicit ReadOnlyRoots(Isolate* isolate);
+
+#define ROOT_ACCESSOR(type, name, camel_name) \
+  inline class type* name();                  \
+  inline Handle<type> name##_handle();
+  STRONG_READ_ONLY_ROOT_LIST(ROOT_ACCESSOR)
+#undef ROOT_ACCESSOR
+
+#define STRING_ACCESSOR(name, str) \
+  inline String* name();           \
+  inline Handle<String> name##_handle();
+  INTERNALIZED_STRING_LIST(STRING_ACCESSOR)
+#undef STRING_ACCESSOR
+
+#define SYMBOL_ACCESSOR(name) \
+  inline Symbol* name();      \
+  inline Handle<Symbol> name##_handle();
+  PRIVATE_SYMBOL_LIST(SYMBOL_ACCESSOR)
+#undef SYMBOL_ACCESSOR
+
+#define SYMBOL_ACCESSOR(name, description) \
+  inline Symbol* name();                   \
+  inline Handle<Symbol> name##_handle();
+  PUBLIC_SYMBOL_LIST(SYMBOL_ACCESSOR)
+  WELL_KNOWN_SYMBOL_LIST(SYMBOL_ACCESSOR)
+#undef SYMBOL_ACCESSOR
+
+// Utility type maps.
+#define STRUCT_MAP_ACCESSOR(NAME, Name, name) \
+  inline Map* name##_map();                   \
+  inline class Handle<Map> name##_map_handle();
+  STRUCT_LIST(STRUCT_MAP_ACCESSOR)
+#undef STRUCT_MAP_ACCESSOR
+
+#define ALLOCATION_SITE_MAP_ACCESSOR(NAME, Name, Size, name) \
+  inline Map* name##_map();                                  \
+  inline class Handle<Map> name##_map_handle();
+  ALLOCATION_SITE_LIST(ALLOCATION_SITE_MAP_ACCESSOR)
+#undef ALLOCATION_SITE_MAP_ACCESSOR
+
+ private:
+  Heap* heap_;
+};
+
+}  // namespace internal
+}  // namespace v8
+
+#endif  // V8_ROOTS_H_
diff --git a/deps/v8/src/runtime/runtime-array.cc b/deps/v8/src/runtime/runtime-array.cc
index f85eea8aee48cc..df0f5ea4cfe85c 100644
--- a/deps/v8/src/runtime/runtime-array.cc
+++ b/deps/v8/src/runtime/runtime-array.cc
@@ -7,11 +7,14 @@
 #include "src/arguments.h"
 #include "src/code-stubs.h"
 #include "src/conversions-inl.h"
+#include "src/debug/debug.h"
 #include "src/elements.h"
 #include "src/heap/factory.h"
 #include "src/isolate-inl.h"
 #include "src/keys.h"
 #include "src/messages.h"
+#include "src/objects/arguments-inl.h"
+#include "src/objects/hash-table-inl.h"
 #include "src/prototype.h"
 
 namespace v8 {
@@ -28,86 +31,125 @@ RUNTIME_FUNCTION(Runtime_TransitionElementsKind) {
 }
 
 namespace {
-// As PrepareElementsForSort, but only on objects where elements is
-// a dictionary, and it will stay a dictionary.  Collates undefined and
-// unexisting elements below limit from position zero of the elements.
-Object* PrepareSlowElementsForSort(Handle<JSObject> object, uint32_t limit) {
-  DCHECK(object->HasDictionaryElements());
-  Isolate* isolate = object->GetIsolate();
-  // Must stay in dictionary mode, either because of requires_slow_elements,
-  // or because we are not going to sort (and therefore compact) all of the
-  // elements.
-  Handle<NumberDictionary> dict(object->element_dictionary(), isolate);
-  Handle<NumberDictionary> new_dict =
-      NumberDictionary::New(isolate, dict->NumberOfElements());
-
-  uint32_t pos = 0;
-  uint32_t undefs = 0;
-  uint32_t max_key = 0;
-  int capacity = dict->Capacity();
-  Smi* bailout = Smi::FromInt(-1);
-  // Entry to the new dictionary does not cause it to grow, as we have
-  // allocated one that is large enough for all entries.
-  for (int i = 0; i < capacity; i++) {
-    Object* k;
-    if (!dict->ToKey(isolate, i, &k)) continue;
-
-    DCHECK_LE(0, k->Number());
-    DCHECK_LE(k->Number(), kMaxUInt32);
-
-    HandleScope scope(isolate);
-    Handle<Object> value(dict->ValueAt(i), isolate);
-    PropertyDetails details = dict->DetailsAt(i);
-    if (details.kind() == kAccessor || details.IsReadOnly()) {
-      // Bail out and do the sorting of undefineds and array holes in JS.
-      // Also bail out if the element is not supposed to be moved.
-      return bailout;
+// Find the next free position. undefined and holes are both considered
+// free spots. Returns "Nothing" if an exception occurred.
+V8_WARN_UNUSED_RESULT
+Maybe<uint32_t> FindNextFreePosition(Isolate* isolate,
+                                     Handle<JSReceiver> receiver,
+                                     uint32_t current_pos) {
+  for (uint32_t position = current_pos;; ++position) {
+    Maybe<bool> has_element = JSReceiver::HasElement(receiver, position);
+    MAYBE_RETURN(has_element, Nothing<uint32_t>());
+    if (!has_element.FromJust()) return Just(position);
+
+    Handle<Object> element;
+    ASSIGN_RETURN_ON_EXCEPTION_VALUE(
+        isolate, element, JSReceiver::GetElement(isolate, receiver, position),
+        Nothing<uint32_t>());
+    if (element->IsUndefined(isolate)) return Just(position);
+  }
+}
+
+// As RemoveArrayHoles, but also handles Dictionary elements that stay
+// Dictionary (requires_slow_elements() is true), proxies and objects that
+// might have accessors.
+V8_WARN_UNUSED_RESULT
+Object* RemoveArrayHolesGeneric(Isolate* isolate, Handle<JSReceiver> receiver,
+                                uint32_t limit) {
+  HandleScope scope(isolate);
+
+  // For proxies, we do not collect the keys, instead we use all indices in
+  // the full range of [0, limit).
+  Handle<FixedArray> keys;
+  if (receiver->IsJSProxy()) {
+    CHECK(Smi::IsValid(limit));
+    keys = isolate->factory()->NewFixedArray(limit);
+    for (uint32_t i = 0; i < limit; ++i) {
+      keys->set(i, Smi::FromInt(i));
+    }
+  } else {
+    keys = JSReceiver::GetOwnElementIndices(isolate, receiver,
+                                            Handle<JSObject>::cast(receiver));
+  }
+
+  uint32_t num_undefined = 0;
+  uint32_t current_pos = 0;
+  int num_indices = keys->length();
+
+  // Compact keys with undefined values and moves non-undefined
+  // values to the front.
+  // The loop does two things simultaneously:
+  //   (1) Count the number of 'undefined', i.e.
+  //       i.e.: HasProperty(receiver, key) && Get(receiver, key) == undefined
+  //   (2) Move all non-undefined values to the front. The variable current_pos
+  //       is used to track free spots in the array starting at the beginning.
+  //       Holes and 'undefined' are considered free spots.
+  //       A hole is when HasElement(receiver, key) is false.
+  for (int i = 0; i < num_indices; ++i) {
+    uint32_t key = NumberToUint32(keys->get(i));
+
+    // We only care about array indices that are smaller than the limit.
+    // The keys are sorted, so we can break as soon as we encounter the first.
+    if (key >= limit) break;
+
+    Maybe<bool> has_element = JSReceiver::HasElement(receiver, key);
+    MAYBE_RETURN(has_element, ReadOnlyRoots(isolate).exception());
+    if (!has_element.FromJust()) {
+      continue;
     }
 
-    uint32_t key = NumberToUint32(k);
-    if (key < limit) {
-      if (value->IsUndefined(isolate)) {
-        undefs++;
-      } else {
-        Handle<Object> result =
-            NumberDictionary::Add(new_dict, pos, value, details);
-        // Add should not grow the dictionary since we allocated the right size.
-        DCHECK(result.is_identical_to(new_dict));
-        USE(result);
-        pos++;
-      }
+    Handle<Object> element;
+    ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
+        isolate, element, JSReceiver::GetElement(isolate, receiver, key));
+
+    if (element->IsUndefined(isolate)) {
+      ++num_undefined;
     } else {
-      Handle<Object> result =
-          NumberDictionary::Add(new_dict, key, value, details);
-      // Add should not grow the dictionary since we allocated the right size.
-      DCHECK(result.is_identical_to(new_dict));
-      USE(result);
-      max_key = Max(max_key, key);
+      // Find next free position to move elements to.
+      Maybe<uint32_t> free_position =
+          FindNextFreePosition(isolate, receiver, current_pos);
+      MAYBE_RETURN(free_position, ReadOnlyRoots(isolate).exception());
+      current_pos = free_position.FromJust();
+
+      // Do not move elements that are already in the "packed" area.
+      if (key <= current_pos) continue;
+
+      // array[current_pos] = array[key].
+      // Deleting array[key] is done later. This is to preserve the same
+      // semantics as the old JS implementation when working with non-extensible
+      // objects:
+      // If the array contains undefineds, the position at 'key' might later
+      // bet set to 'undefined'. If we delete the element now and later set it
+      // to undefined, the set operation would throw an exception.
+      RETURN_FAILURE_ON_EXCEPTION(
+          isolate, JSReceiver::SetElement(isolate, receiver, current_pos,
+                                          element, LanguageMode::kStrict));
+      ++current_pos;
     }
   }
 
-  uint32_t result = pos;
-  PropertyDetails no_details = PropertyDetails::Empty();
-  while (undefs > 0) {
-    if (pos > static_cast<uint32_t>(Smi::kMaxValue)) {
-      // Adding an entry with the key beyond smi-range requires
-      // allocation. Bailout.
-      return bailout;
-    }
-    HandleScope scope(isolate);
-    Handle<Object> result = NumberDictionary::Add(
-        new_dict, pos, isolate->factory()->undefined_value(), no_details);
-    // Add should not grow the dictionary since we allocated the right size.
-    DCHECK(result.is_identical_to(new_dict));
-    USE(result);
-    pos++;
-    undefs--;
-  }
-  max_key = Max(max_key, pos - 1);
-
-  object->set_elements(*new_dict);
-  new_dict->UpdateMaxNumberKey(max_key, object);
-  JSObject::ValidateElements(*object);
+  // Set [current_pos, current_pos + num_undefined) to undefined.
+  uint32_t result = current_pos;
+  for (uint32_t i = 0; i < num_undefined; ++i) {
+    RETURN_FAILURE_ON_EXCEPTION(
+        isolate, JSReceiver::SetElement(isolate, receiver, current_pos++,
+                                        isolate->factory()->undefined_value(),
+                                        LanguageMode::kStrict));
+  }
+  // TODO(szuend): Re-enable when we also copy from the prototype chain for
+  //               JSArrays. Then we can use HasOwnProperty instead of
+  //               HasElement and this condition will hold.
+  // DCHECK_LE(current_pos, num_indices);
+
+  // Deleting everything after the undefineds up unto the limit.
+  for (int i = num_indices - 1; i >= 0; --i) {
+    uint32_t key = NumberToUint32(keys->get(i));
+    if (key < current_pos) break;
+    if (key >= limit) continue;
+
+    Maybe<bool> delete_result = JSReceiver::DeleteElement(receiver, key);
+    MAYBE_RETURN(delete_result, ReadOnlyRoots(isolate).exception());
+  }
 
   return *isolate->factory()->NewNumberFromUint(result);
 }
@@ -116,31 +158,37 @@ Object* PrepareSlowElementsForSort(Handle<JSObject> object, uint32_t limit) {
 // start of the elements array.  If the object is in dictionary mode, it is
 // converted to fast elements mode.  Undefined values are placed after
 // non-undefined values.  Returns the number of non-undefined values.
-Object* PrepareElementsForSort(Handle<JSObject> object, uint32_t limit) {
-  Isolate* isolate = object->GetIsolate();
-  if (object->HasSloppyArgumentsElements() || !object->map()->is_extensible()) {
-    return Smi::FromInt(-1);
+V8_WARN_UNUSED_RESULT
+Object* RemoveArrayHoles(Isolate* isolate, Handle<JSReceiver> receiver,
+                         uint32_t limit) {
+  if (receiver->IsJSProxy()) {
+    return RemoveArrayHolesGeneric(isolate, receiver, limit);
   }
+
+  Handle<JSObject> object = Handle<JSObject>::cast(receiver);
   if (object->HasStringWrapperElements()) {
     int len = String::cast(Handle<JSValue>::cast(object)->value())->length();
     return Smi::FromInt(len);
   }
 
+  if (object->HasSloppyArgumentsElements() || !object->map()->is_extensible()) {
+    return RemoveArrayHolesGeneric(isolate, receiver, limit);
+  }
+
   JSObject::ValidateElements(*object);
   if (object->HasDictionaryElements()) {
     // Convert to fast elements containing only the existing properties.
     // Ordering is irrelevant, since we are going to sort anyway.
-    Handle<NumberDictionary> dict(object->element_dictionary());
+    Handle<NumberDictionary> dict(object->element_dictionary(), isolate);
     if (object->IsJSArray() || dict->requires_slow_elements() ||
         dict->max_number_key() >= limit) {
-      return PrepareSlowElementsForSort(object, limit);
+      return RemoveArrayHolesGeneric(isolate, receiver, limit);
     }
     // Convert to fast elements.
     Handle<Map> new_map =
         JSObject::GetElementsTransitionMap(object, HOLEY_ELEMENTS);
 
-    PretenureFlag tenure =
-        isolate->heap()->InNewSpace(*object) ? NOT_TENURED : TENURED;
+    PretenureFlag tenure = Heap::InNewSpace(*object) ? NOT_TENURED : TENURED;
     Handle<FixedArray> fast_elements =
         isolate->factory()->NewFixedArray(dict->NumberOfElements(), tenure);
     dict->CopyValuesTo(*fast_elements);
@@ -159,7 +207,7 @@ Object* PrepareElementsForSort(Handle<JSObject> object, uint32_t limit) {
   // Collect holes at the end, undefined before that and the rest at the
   // start, and return the number of non-hole, non-undefined values.
 
-  Handle<FixedArrayBase> elements_base(object->elements());
+  Handle<FixedArrayBase> elements_base(object->elements(), isolate);
   uint32_t elements_length = static_cast<uint32_t>(elements_base->length());
   if (limit > elements_length) {
     limit = elements_length;
@@ -169,7 +217,7 @@ Object* PrepareElementsForSort(Handle<JSObject> object, uint32_t limit) {
   }
 
   uint32_t result = 0;
-  if (elements_base->map() == isolate->heap()->fixed_double_array_map()) {
+  if (elements_base->map() == ReadOnlyRoots(isolate).fixed_double_array_map()) {
     FixedDoubleArray* elements = FixedDoubleArray::cast(*elements_base);
     // Split elements into defined and the_hole, in that order.
     unsigned int holes = limit;
@@ -245,23 +293,103 @@ Object* PrepareElementsForSort(Handle<JSObject> object, uint32_t limit) {
   return *isolate->factory()->NewNumberFromUint(result);
 }
 
+// Copy element at index from source to target only if target does not have the
+// element on its own. Returns true if a copy occurred, false if not
+// and Nothing if an exception occurred.
+V8_WARN_UNUSED_RESULT
+Maybe<bool> ConditionalCopy(Isolate* isolate, Handle<JSReceiver> source,
+                            Handle<JSReceiver> target, uint32_t index) {
+  Maybe<bool> source_has_prop = JSReceiver::HasOwnProperty(source, index);
+  MAYBE_RETURN(source_has_prop, Nothing<bool>());
+  if (!source_has_prop.FromJust()) return Just(false);
+
+  Maybe<bool> target_has_prop = JSReceiver::HasOwnProperty(target, index);
+  MAYBE_RETURN(target_has_prop, Nothing<bool>());
+  if (target_has_prop.FromJust()) return Just(false);
+
+  Handle<Object> source_element;
+  ASSIGN_RETURN_ON_EXCEPTION_VALUE(
+      isolate, source_element, JSReceiver::GetElement(isolate, source, index),
+      Nothing<bool>());
+
+  Handle<Object> set_result;
+  ASSIGN_RETURN_ON_EXCEPTION_VALUE(
+      isolate, set_result,
+      JSReceiver::SetElement(isolate, target, index, source_element,
+                             LanguageMode::kStrict),
+      Nothing<bool>());
+
+  return Just(true);
+}
+
+// Copy elements in the range 0..length from objects prototype chain
+// to object itself, if object has holes. Returns null on error and undefined on
+// success.
+V8_WARN_UNUSED_RESULT
+MaybeHandle<Object> CopyFromPrototype(Isolate* isolate,
+                                      Handle<JSReceiver> object,
+                                      uint32_t length) {
+  for (PrototypeIterator iter(isolate, object, kStartAtPrototype);
+       !iter.IsAtEnd(); iter.Advance()) {
+    Handle<JSReceiver> current(PrototypeIterator::GetCurrent<JSReceiver>(iter));
+
+    if (current->IsJSProxy()) {
+      for (uint32_t i = 0; i < length; ++i) {
+        MAYBE_RETURN_NULL(ConditionalCopy(isolate, current, object, i));
+      }
+    } else {
+      Handle<FixedArray> keys = JSReceiver::GetOwnElementIndices(
+          isolate, object, Handle<JSObject>::cast(current));
+
+      uint32_t num_indices = keys->length();
+      for (uint32_t i = 0; i < num_indices; ++i) {
+        uint32_t idx = NumberToUint32(keys->get(i));
+
+        // Prototype might have indices that go past length, but we are only
+        // interested in the range [0, length).
+        if (idx >= length) break;
+
+        MAYBE_RETURN_NULL(ConditionalCopy(isolate, current, object, idx));
+      }
+    }
+  }
+  return isolate->factory()->undefined_value();
+}
+
 }  // namespace
 
-// Moves all own elements of an object, that are below a limit, to positions
-// starting at zero. All undefined values are placed after non-undefined values,
-// and are followed by non-existing element. Does not change the length
-// property.
-// Returns the number of non-undefined elements collected.
-// Returns -1 if hole removal is not supported by this method.
-RUNTIME_FUNCTION(Runtime_RemoveArrayHoles) {
+RUNTIME_FUNCTION(Runtime_PrepareElementsForSort) {
   HandleScope scope(isolate);
   DCHECK_EQ(2, args.length());
   CONVERT_ARG_HANDLE_CHECKED(JSReceiver, object, 0);
-  CONVERT_NUMBER_CHECKED(uint32_t, limit, Uint32, args[1]);
-  if (object->IsJSProxy()) return Smi::FromInt(-1);
-  return PrepareElementsForSort(Handle<JSObject>::cast(object), limit);
-}
+  CONVERT_NUMBER_CHECKED(uint32_t, length, Uint32, args[1]);
+
+  if (isolate->debug_execution_mode() == DebugInfo::kSideEffects) {
+    if (!isolate->debug()->PerformSideEffectCheckForObject(object)) {
+      return ReadOnlyRoots(isolate).exception();
+    }
+  }
+
+  // Counter for sorting arrays that have non-packed elements and where either
+  // the ElementsProtector is invalid or the prototype does not match
+  // Array.prototype.
+  if (object->IsJSArray() &&
+      !Handle<JSArray>::cast(object)->HasFastPackedElements()) {
+    JSObject* initial_array_proto = JSObject::cast(
+        isolate->native_context()->get(Context::INITIAL_ARRAY_PROTOTYPE_INDEX));
+    if (!isolate->IsNoElementsProtectorIntact() ||
+        object->map()->prototype() != initial_array_proto) {
+      isolate->CountUsage(
+          v8::Isolate::kArrayPrototypeSortJSArrayModifiedPrototype);
+    }
+  }
 
+  if (!object->IsJSArray()) {
+    RETURN_FAILURE_ON_EXCEPTION(isolate,
+                                CopyFromPrototype(isolate, object, length));
+  }
+  return RemoveArrayHoles(isolate, object, length);
+}
 
 // Move contents of argument 0 (an array) to argument 1 (an array)
 RUNTIME_FUNCTION(Runtime_MoveArrayContents) {
@@ -272,7 +400,7 @@ RUNTIME_FUNCTION(Runtime_MoveArrayContents) {
   JSObject::ValidateElements(*from);
   JSObject::ValidateElements(*to);
 
-  Handle<FixedArrayBase> new_elements(from->elements());
+  Handle<FixedArrayBase> new_elements(from->elements(), isolate);
   ElementsKind from_kind = from->GetElementsKind();
   Handle<Map> new_map = JSObject::GetElementsTransitionMap(to, from_kind);
   JSObject::SetMapAndElements(to, new_map, new_elements);
@@ -294,7 +422,7 @@ RUNTIME_FUNCTION(Runtime_EstimateNumberOfElements) {
   CONVERT_ARG_CHECKED(JSArray, array, 0);
   FixedArrayBase* elements = array->elements();
   SealHandleScope shs(isolate);
-  if (elements->IsDictionary()) {
+  if (elements->IsNumberDictionary()) {
     int result = NumberDictionary::cast(elements)->NumberOfElements();
     return Smi::FromInt(result);
   } else {
@@ -372,10 +500,7 @@ RUNTIME_FUNCTION(Runtime_GetArrayKeys) {
     j++;
   }
 
-  if (j != keys->length()) {
-    isolate->heap()->RightTrimFixedArray(*keys, keys->length() - j);
-  }
-
+  keys = FixedArray::ShrinkOrEmpty(keys, j);
   return *isolate->factory()->NewJSArrayWithElements(keys);
 }
 
@@ -481,7 +606,7 @@ RUNTIME_FUNCTION(Runtime_NewArray) {
   // advice. Therefore we use AllocateJSObjectFromMap instead of passing
   // the constructor.
   if (to_kind != initial_map->elements_kind()) {
-    initial_map = Map::AsElementsKind(initial_map, to_kind);
+    initial_map = Map::AsElementsKind(isolate, initial_map, to_kind);
   }
 
   // If we don't care to track arrays of to_kind ElementsKind, then
@@ -563,10 +688,10 @@ RUNTIME_FUNCTION(Runtime_HasComplexElements) {
   for (PrototypeIterator iter(isolate, array, kStartAtReceiver);
        !iter.IsAtEnd(); iter.Advance()) {
     if (PrototypeIterator::GetCurrent<JSReceiver>(iter)->HasComplexElements()) {
-      return isolate->heap()->true_value();
+      return ReadOnlyRoots(isolate).true_value();
     }
   }
-  return isolate->heap()->false_value();
+  return ReadOnlyRoots(isolate).false_value();
 }
 
 // ES6 22.1.2.2 Array.isArray
@@ -575,7 +700,7 @@ RUNTIME_FUNCTION(Runtime_ArrayIsArray) {
   DCHECK_EQ(1, args.length());
   CONVERT_ARG_HANDLE_CHECKED(Object, object, 0);
   Maybe<bool> result = Object::IsArray(object);
-  MAYBE_RETURN(result, isolate->heap()->exception());
+  MAYBE_RETURN(result, ReadOnlyRoots(isolate).exception());
   return isolate->heap()->ToBoolean(result.FromJust());
 }
 
@@ -628,7 +753,7 @@ RUNTIME_FUNCTION(Runtime_ArrayIncludes_Slow) {
     }
   }
 
-  if (len == 0) return isolate->heap()->false_value();
+  if (len == 0) return ReadOnlyRoots(isolate).false_value();
 
   // Let n be ? ToInteger(fromIndex). (If fromIndex is undefined, this step
   // produces the value 0.)
@@ -647,7 +772,7 @@ RUNTIME_FUNCTION(Runtime_ArrayIncludes_Slow) {
     } else {
       DCHECK(from_index->IsHeapNumber());
       double start_from = from_index->Number();
-      if (start_from >= len) return isolate->heap()->false_value();
+      if (start_from >= len) return ReadOnlyRoots(isolate).false_value();
       if (V8_LIKELY(std::isfinite(start_from))) {
         if (start_from < 0) {
           index = static_cast<int64_t>(std::max<double>(start_from + len, 0));
@@ -669,7 +794,7 @@ RUNTIME_FUNCTION(Runtime_ArrayIncludes_Slow) {
     Maybe<bool> result = elements->IncludesValue(isolate, obj, search_element,
                                                  static_cast<uint32_t>(index),
                                                  static_cast<uint32_t>(len));
-    MAYBE_RETURN(result, isolate->heap()->exception());
+    MAYBE_RETURN(result, ReadOnlyRoots(isolate).exception());
     return *isolate->factory()->ToBoolean(result.FromJust());
   }
 
@@ -689,10 +814,10 @@ RUNTIME_FUNCTION(Runtime_ArrayIncludes_Slow) {
 
     // If SameValueZero(searchElement, elementK) is true, return true.
     if (search_element->SameValueZero(*element_k)) {
-      return isolate->heap()->true_value();
+      return ReadOnlyRoots(isolate).true_value();
     }
   }
-  return isolate->heap()->false_value();
+  return ReadOnlyRoots(isolate).false_value();
 }
 
 RUNTIME_FUNCTION(Runtime_ArrayIndexOf) {
@@ -767,7 +892,7 @@ RUNTIME_FUNCTION(Runtime_ArrayIndexOf) {
     Maybe<int64_t> result = elements->IndexOfValue(isolate, obj, search_element,
                                                    static_cast<uint32_t>(index),
                                                    static_cast<uint32_t>(len));
-    MAYBE_RETURN(result, isolate->heap()->exception());
+    MAYBE_RETURN(result, ReadOnlyRoots(isolate).exception());
     return *isolate->factory()->NewNumberFromInt64(result.FromJust());
   }
 
@@ -782,7 +907,7 @@ RUNTIME_FUNCTION(Runtime_ArrayIndexOf) {
           isolate, object, index_obj, &success);
       DCHECK(success);
       Maybe<bool> present = JSReceiver::HasProperty(&it);
-      MAYBE_RETURN(present, isolate->heap()->exception());
+      MAYBE_RETURN(present, ReadOnlyRoots(isolate).exception());
       if (!present.FromJust()) continue;
       ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, element_k,
                                          Object::GetProperty(&it));
diff --git a/deps/v8/src/runtime/runtime-bigint.cc b/deps/v8/src/runtime/runtime-bigint.cc
index ce0d8990a18624..280106751c7899 100644
--- a/deps/v8/src/runtime/runtime-bigint.cc
+++ b/deps/v8/src/runtime/runtime-bigint.cc
@@ -34,6 +34,18 @@ RUNTIME_FUNCTION(Runtime_BigIntCompareToNumber) {
   return *isolate->factory()->ToBoolean(result);
 }
 
+RUNTIME_FUNCTION(Runtime_BigIntCompareToString) {
+  HandleScope scope(isolate);
+  DCHECK_EQ(3, args.length());
+  CONVERT_ARG_HANDLE_CHECKED(Smi, mode, 0);
+  CONVERT_ARG_HANDLE_CHECKED(BigInt, lhs, 1);
+  CONVERT_ARG_HANDLE_CHECKED(String, rhs, 2);
+  bool result =
+      ComparisonResultToBool(static_cast<Operation>(mode->value()),
+                             BigInt::CompareToString(isolate, lhs, rhs));
+  return *isolate->factory()->ToBoolean(result);
+}
+
 RUNTIME_FUNCTION(Runtime_BigIntEqualToBigInt) {
   SealHandleScope shs(isolate);
   DCHECK_EQ(2, args.length());
@@ -57,7 +69,7 @@ RUNTIME_FUNCTION(Runtime_BigIntEqualToString) {
   DCHECK_EQ(2, args.length());
   CONVERT_ARG_HANDLE_CHECKED(BigInt, lhs, 0);
   CONVERT_ARG_HANDLE_CHECKED(String, rhs, 1);
-  bool result = BigInt::EqualToString(lhs, rhs);
+  bool result = BigInt::EqualToString(isolate, lhs, rhs);
   return *isolate->factory()->ToBoolean(result);
 }
 
@@ -72,7 +84,7 @@ RUNTIME_FUNCTION(Runtime_BigIntToNumber) {
   HandleScope scope(isolate);
   DCHECK_EQ(1, args.length());
   CONVERT_ARG_HANDLE_CHECKED(BigInt, x, 0);
-  return *BigInt::ToNumber(x);
+  return *BigInt::ToNumber(isolate, x);
 }
 
 RUNTIME_FUNCTION(Runtime_ToBigInt) {
@@ -99,40 +111,40 @@ RUNTIME_FUNCTION(Runtime_BigIntBinaryOp) {
   MaybeHandle<BigInt> result;
   switch (op) {
     case Operation::kAdd:
-      result = BigInt::Add(left, right);
+      result = BigInt::Add(isolate, left, right);
       break;
     case Operation::kSubtract:
-      result = BigInt::Subtract(left, right);
+      result = BigInt::Subtract(isolate, left, right);
       break;
     case Operation::kMultiply:
-      result = BigInt::Multiply(left, right);
+      result = BigInt::Multiply(isolate, left, right);
       break;
     case Operation::kDivide:
-      result = BigInt::Divide(left, right);
+      result = BigInt::Divide(isolate, left, right);
       break;
     case Operation::kModulus:
-      result = BigInt::Remainder(left, right);
+      result = BigInt::Remainder(isolate, left, right);
       break;
     case Operation::kExponentiate:
-      result = BigInt::Exponentiate(left, right);
+      result = BigInt::Exponentiate(isolate, left, right);
       break;
     case Operation::kBitwiseAnd:
-      result = BigInt::BitwiseAnd(left, right);
+      result = BigInt::BitwiseAnd(isolate, left, right);
       break;
     case Operation::kBitwiseOr:
-      result = BigInt::BitwiseOr(left, right);
+      result = BigInt::BitwiseOr(isolate, left, right);
       break;
     case Operation::kBitwiseXor:
-      result = BigInt::BitwiseXor(left, right);
+      result = BigInt::BitwiseXor(isolate, left, right);
       break;
     case Operation::kShiftLeft:
-      result = BigInt::LeftShift(left, right);
+      result = BigInt::LeftShift(isolate, left, right);
       break;
     case Operation::kShiftRight:
-      result = BigInt::SignedRightShift(left, right);
+      result = BigInt::SignedRightShift(isolate, left, right);
       break;
     case Operation::kShiftRightLogical:
-      result = BigInt::UnsignedRightShift(left, right);
+      result = BigInt::UnsignedRightShift(isolate, left, right);
       break;
     default:
       UNREACHABLE();
@@ -150,16 +162,16 @@ RUNTIME_FUNCTION(Runtime_BigIntUnaryOp) {
   MaybeHandle<BigInt> result;
   switch (op) {
     case Operation::kBitwiseNot:
-      result = BigInt::BitwiseNot(x);
+      result = BigInt::BitwiseNot(isolate, x);
       break;
     case Operation::kNegate:
-      result = BigInt::UnaryMinus(x);
+      result = BigInt::UnaryMinus(isolate, x);
       break;
     case Operation::kIncrement:
-      result = BigInt::Increment(x);
+      result = BigInt::Increment(isolate, x);
       break;
     case Operation::kDecrement:
-      result = BigInt::Decrement(x);
+      result = BigInt::Decrement(isolate, x);
       break;
     default:
       UNREACHABLE();
diff --git a/deps/v8/src/runtime/runtime-classes.cc b/deps/v8/src/runtime/runtime-classes.cc
index 7b1379cf32aaac..6c221842076046 100644
--- a/deps/v8/src/runtime/runtime-classes.cc
+++ b/deps/v8/src/runtime/runtime-classes.cc
@@ -13,6 +13,7 @@
 #include "src/elements.h"
 #include "src/isolate-inl.h"
 #include "src/messages.h"
+#include "src/objects/hash-table-inl.h"
 #include "src/objects/literal-objects-inl.h"
 #include "src/runtime/runtime.h"
 
@@ -102,7 +103,7 @@ RUNTIME_FUNCTION(Runtime_ThrowNotSuperConstructor) {
 
 RUNTIME_FUNCTION(Runtime_HomeObjectSymbol) {
   DCHECK_EQ(0, args.length());
-  return isolate->heap()->home_object_symbol();
+  return ReadOnlyRoots(isolate).home_object_symbol();
 }
 
 namespace {
@@ -127,7 +128,7 @@ inline void SetHomeObject(Isolate* isolate, JSFunction* method,
   if (method->shared()->needs_home_object()) {
     const int kPropertyIndex = JSFunction::kMaybeHomeObjectDescriptorIndex;
     CHECK_EQ(method->map()->instance_descriptors()->GetKey(kPropertyIndex),
-             isolate->heap()->home_object_symbol());
+             ReadOnlyRoots(isolate).home_object_symbol());
 
     FieldIndex field_index =
         FieldIndex::ForDescriptor(method->map(), kPropertyIndex);
@@ -286,7 +287,7 @@ bool AddDescriptorsByTemplate(
 
   Handle<NumberDictionary> elements_dictionary =
       *elements_dictionary_template ==
-              isolate->heap()->empty_slow_element_dictionary()
+              ReadOnlyRoots(isolate).empty_slow_element_dictionary()
           ? elements_dictionary_template
           : ShallowCopyDictionaryTemplate(isolate,
                                           elements_dictionary_template);
@@ -294,7 +295,7 @@ bool AddDescriptorsByTemplate(
   // Read values from |descriptors_template| and store possibly post-processed
   // values into "instantiated" |descriptors| array.
   for (int i = 0; i < nof_descriptors; i++) {
-    Object* value = descriptors_template->GetValue(i);
+    Object* value = descriptors_template->GetStrongValue(i);
     if (value->IsAccessorPair()) {
       Handle<AccessorPair> pair =
           AccessorPair::Copy(handle(AccessorPair::cast(value), isolate));
@@ -334,7 +335,7 @@ bool AddDescriptorsByTemplate(
       DCHECK(!details.representation().IsDouble());
     }
     DCHECK(value->FitsRepresentation(details.representation()));
-    descriptors->Set(i, name, value, details);
+    descriptors->Set(i, name, MaybeObject::FromObject(value), details);
   }
 
   map->InitializeDescriptors(*descriptors,
@@ -448,9 +449,9 @@ bool InitClassPrototype(Isolate* isolate,
                         Handle<Object> prototype_parent,
                         Handle<JSFunction> constructor, Arguments& args) {
   Handle<Map> map(prototype->map(), isolate);
-  map = Map::CopyDropDescriptors(map);
+  map = Map::CopyDropDescriptors(isolate, map);
   map->set_is_prototype_map(true);
-  Map::SetPrototype(map, prototype_parent);
+  Map::SetPrototype(isolate, map, prototype_parent);
   constructor->set_prototype_or_initial_map(*prototype);
   map->SetConstructor(*constructor);
   Handle<FixedArray> computed_properties(
@@ -461,7 +462,7 @@ bool InitClassPrototype(Isolate* isolate,
 
   Handle<Object> properties_template(
       class_boilerplate->instance_properties_template(), isolate);
-  if (properties_template->IsDictionary()) {
+  if (properties_template->IsNameDictionary()) {
     Handle<NameDictionary> properties_dictionary_template =
         Handle<NameDictionary>::cast(properties_template);
 
@@ -495,13 +496,13 @@ bool InitClassConstructor(Isolate* isolate,
                           Handle<Object> constructor_parent,
                           Handle<JSFunction> constructor, Arguments& args) {
   Handle<Map> map(constructor->map(), isolate);
-  map = Map::CopyDropDescriptors(map);
+  map = Map::CopyDropDescriptors(isolate, map);
   DCHECK(map->is_prototype_map());
 
   if (!constructor_parent.is_null()) {
     // Set map's prototype without enabling prototype setup mode for superclass
     // because it does not make sense.
-    Map::SetPrototype(map, constructor_parent, false);
+    Map::SetPrototype(isolate, map, constructor_parent, false);
   }
 
   Handle<NumberDictionary> elements_dictionary_template(
@@ -513,12 +514,12 @@ bool InitClassConstructor(Isolate* isolate,
   Handle<Object> properties_template(
       class_boilerplate->static_properties_template(), isolate);
 
-  if (properties_template->IsDictionary()) {
+  if (properties_template->IsNameDictionary()) {
     Handle<NameDictionary> properties_dictionary_template =
         Handle<NameDictionary>::cast(properties_template);
 
     map->set_is_dictionary_map(true);
-    map->InitializeDescriptors(isolate->heap()->empty_descriptor_array(),
+    map->InitializeDescriptors(ReadOnlyRoots(isolate).empty_descriptor_array(),
                                LayoutDescriptor::FastPointerLayout());
     map->set_is_migration_target(false);
     map->set_may_have_interesting_symbols(true);
@@ -627,7 +628,7 @@ MaybeHandle<JSReceiver> GetSuperHolder(
     Isolate* isolate, Handle<Object> receiver, Handle<JSObject> home_object,
     SuperMode mode, MaybeHandle<Name> maybe_name, uint32_t index) {
   if (home_object->IsAccessCheckNeeded() &&
-      !isolate->MayAccess(handle(isolate->context()), home_object)) {
+      !isolate->MayAccess(handle(isolate->context(), isolate), home_object)) {
     isolate->ReportFailedAccessCheck(home_object);
     RETURN_EXCEPTION_IF_SCHEDULED_EXCEPTION(isolate, JSReceiver);
   }
diff --git a/deps/v8/src/runtime/runtime-collections.cc b/deps/v8/src/runtime/runtime-collections.cc
index 7b2cae3337c265..9494f80518025e 100644
--- a/deps/v8/src/runtime/runtime-collections.cc
+++ b/deps/v8/src/runtime/runtime-collections.cc
@@ -7,36 +7,26 @@
 #include "src/arguments.h"
 #include "src/conversions-inl.h"
 #include "src/heap/factory.h"
+#include "src/objects/hash-table-inl.h"
+#include "src/objects/js-collection-inl.h"
 
 namespace v8 {
 namespace internal {
 
-RUNTIME_FUNCTION(Runtime_IsJSMapIterator) {
-  SealHandleScope shs(isolate);
-  DCHECK_EQ(1, args.length());
-  return isolate->heap()->ToBoolean(args[0]->IsJSMapIterator());
-}
-
-RUNTIME_FUNCTION(Runtime_IsJSSetIterator) {
-  SealHandleScope shs(isolate);
-  DCHECK_EQ(1, args.length());
-  return isolate->heap()->ToBoolean(args[0]->IsJSSetIterator());
-}
-
 RUNTIME_FUNCTION(Runtime_TheHole) {
   SealHandleScope shs(isolate);
   DCHECK_EQ(0, args.length());
-  return isolate->heap()->the_hole_value();
+  return ReadOnlyRoots(isolate).the_hole_value();
 }
 
 RUNTIME_FUNCTION(Runtime_SetGrow) {
   HandleScope scope(isolate);
   DCHECK_EQ(1, args.length());
   CONVERT_ARG_HANDLE_CHECKED(JSSet, holder, 0);
-  Handle<OrderedHashSet> table(OrderedHashSet::cast(holder->table()));
-  table = OrderedHashSet::EnsureGrowable(table);
+  Handle<OrderedHashSet> table(OrderedHashSet::cast(holder->table()), isolate);
+  table = OrderedHashSet::EnsureGrowable(isolate, table);
   holder->set_table(*table);
-  return isolate->heap()->undefined_value();
+  return ReadOnlyRoots(isolate).undefined_value();
 }
 
 
@@ -44,10 +34,10 @@ RUNTIME_FUNCTION(Runtime_SetShrink) {
   HandleScope scope(isolate);
   DCHECK_EQ(1, args.length());
   CONVERT_ARG_HANDLE_CHECKED(JSSet, holder, 0);
-  Handle<OrderedHashSet> table(OrderedHashSet::cast(holder->table()));
-  table = OrderedHashSet::Shrink(table);
+  Handle<OrderedHashSet> table(OrderedHashSet::cast(holder->table()), isolate);
+  table = OrderedHashSet::Shrink(isolate, table);
   holder->set_table(*table);
-  return isolate->heap()->undefined_value();
+  return ReadOnlyRoots(isolate).undefined_value();
 }
 
 RUNTIME_FUNCTION(Runtime_SetIteratorClone) {
@@ -64,20 +54,20 @@ RUNTIME_FUNCTION(Runtime_MapShrink) {
   HandleScope scope(isolate);
   DCHECK_EQ(1, args.length());
   CONVERT_ARG_HANDLE_CHECKED(JSMap, holder, 0);
-  Handle<OrderedHashMap> table(OrderedHashMap::cast(holder->table()));
-  table = OrderedHashMap::Shrink(table);
+  Handle<OrderedHashMap> table(OrderedHashMap::cast(holder->table()), isolate);
+  table = OrderedHashMap::Shrink(isolate, table);
   holder->set_table(*table);
-  return isolate->heap()->undefined_value();
+  return ReadOnlyRoots(isolate).undefined_value();
 }
 
 RUNTIME_FUNCTION(Runtime_MapGrow) {
   HandleScope scope(isolate);
   DCHECK_EQ(1, args.length());
   CONVERT_ARG_HANDLE_CHECKED(JSMap, holder, 0);
-  Handle<OrderedHashMap> table(OrderedHashMap::cast(holder->table()));
-  table = OrderedHashMap::EnsureGrowable(table);
+  Handle<OrderedHashMap> table(OrderedHashMap::cast(holder->table()), isolate);
+  table = OrderedHashMap::EnsureGrowable(isolate, table);
   holder->set_table(*table);
-  return isolate->heap()->undefined_value();
+  return ReadOnlyRoots(isolate).undefined_value();
 }
 
 RUNTIME_FUNCTION(Runtime_MapIteratorClone) {
@@ -108,9 +98,9 @@ RUNTIME_FUNCTION(Runtime_WeakCollectionDelete) {
 
 #ifdef DEBUG
   DCHECK(key->IsJSReceiver());
-  DCHECK(ObjectHashTableShape::IsLive(isolate, *key));
-  Handle<ObjectHashTable> table(
-      ObjectHashTable::cast(weak_collection->table()));
+  DCHECK(EphemeronHashTableShape::IsLive(isolate, *key));
+  Handle<EphemeronHashTable> table(
+      EphemeronHashTable::cast(weak_collection->table()), isolate);
   // Should only be called when shrinking the table is necessary. See
   // HashTable::Shrink().
   DCHECK(table->NumberOfElements() - 1 <= (table->Capacity() >> 2) &&
@@ -121,6 +111,14 @@ RUNTIME_FUNCTION(Runtime_WeakCollectionDelete) {
   return isolate->heap()->ToBoolean(was_present);
 }
 
+RUNTIME_FUNCTION(Runtime_GetWeakSetValues) {
+  HandleScope scope(isolate);
+  DCHECK_EQ(2, args.length());
+  CONVERT_ARG_HANDLE_CHECKED(JSWeakCollection, holder, 0);
+  CONVERT_NUMBER_CHECKED(int, max_values, Int32, args[1]);
+  CHECK_GE(max_values, 0);
+  return *JSWeakCollection::GetEntries(holder, max_values);
+}
 
 RUNTIME_FUNCTION(Runtime_WeakCollectionSet) {
   HandleScope scope(isolate);
@@ -132,11 +130,11 @@ RUNTIME_FUNCTION(Runtime_WeakCollectionSet) {
 
 #ifdef DEBUG
   DCHECK(key->IsJSReceiver());
-  DCHECK(ObjectHashTableShape::IsLive(isolate, *key));
-  Handle<ObjectHashTable> table(
-      ObjectHashTable::cast(weak_collection->table()));
+  DCHECK(EphemeronHashTableShape::IsLive(isolate, *key));
+  Handle<EphemeronHashTable> table(
+      EphemeronHashTable::cast(weak_collection->table()), isolate);
   // Should only be called when rehashing or resizing the table is necessary.
-  // See ObjectHashTable::Put() and HashTable::HasSufficientCapacityToAdd().
+  // See EphemeronHashTable::Put() and HashTable::HasSufficientCapacityToAdd().
   DCHECK((table->NumberOfDeletedElements() << 1) > table->NumberOfElements() ||
          !table->HasSufficientCapacityToAdd(1));
 #endif
@@ -145,30 +143,6 @@ RUNTIME_FUNCTION(Runtime_WeakCollectionSet) {
   return *weak_collection;
 }
 
-
-RUNTIME_FUNCTION(Runtime_GetWeakSetValues) {
-  HandleScope scope(isolate);
-  DCHECK_EQ(2, args.length());
-  CONVERT_ARG_HANDLE_CHECKED(JSWeakCollection, holder, 0);
-  CONVERT_NUMBER_CHECKED(int, max_values, Int32, args[1]);
-  CHECK_GE(max_values, 0);
-  return *JSWeakCollection::GetEntries(holder, max_values);
-}
-
-RUNTIME_FUNCTION(Runtime_IsJSMap) {
-  SealHandleScope shs(isolate);
-  DCHECK_EQ(1, args.length());
-  CONVERT_ARG_CHECKED(Object, obj, 0);
-  return isolate->heap()->ToBoolean(obj->IsJSMap());
-}
-
-RUNTIME_FUNCTION(Runtime_IsJSSet) {
-  SealHandleScope shs(isolate);
-  DCHECK_EQ(1, args.length());
-  CONVERT_ARG_CHECKED(Object, obj, 0);
-  return isolate->heap()->ToBoolean(obj->IsJSSet());
-}
-
 RUNTIME_FUNCTION(Runtime_IsJSWeakMap) {
   SealHandleScope shs(isolate);
   DCHECK_EQ(1, args.length());
diff --git a/deps/v8/src/runtime/runtime-compiler.cc b/deps/v8/src/runtime/runtime-compiler.cc
index 3f894fd9292ec8..2502fba30d3f40 100644
--- a/deps/v8/src/runtime/runtime-compiler.cc
+++ b/deps/v8/src/runtime/runtime-compiler.cc
@@ -36,7 +36,7 @@ RUNTIME_FUNCTION(Runtime_CompileLazy) {
     return isolate->StackOverflow();
   }
   if (!Compiler::Compile(function, Compiler::KEEP_EXCEPTION)) {
-    return isolate->heap()->exception();
+    return ReadOnlyRoots(isolate).exception();
   }
   DCHECK(function->is_compiled());
   return function->code();
@@ -51,7 +51,7 @@ RUNTIME_FUNCTION(Runtime_CompileOptimized_Concurrent) {
     return isolate->StackOverflow();
   }
   if (!Compiler::CompileOptimized(function, ConcurrencyMode::kConcurrent)) {
-    return isolate->heap()->exception();
+    return ReadOnlyRoots(isolate).exception();
   }
   DCHECK(function->is_compiled());
   return function->code();
@@ -66,10 +66,10 @@ RUNTIME_FUNCTION(Runtime_FunctionFirstExecution) {
   DCHECK_EQ(function->feedback_vector()->optimization_marker(),
             OptimizationMarker::kLogFirstExecution);
   DCHECK(FLAG_log_function_events);
-  Handle<SharedFunctionInfo> sfi(function->shared());
-  LOG(isolate, FunctionEvent("first-execution", Script::cast(sfi->script()), -1,
-                             0, sfi->StartPosition(), sfi->EndPosition(),
-                             sfi->DebugName()));
+  Handle<SharedFunctionInfo> sfi(function->shared(), isolate);
+  LOG(isolate, FunctionEvent(
+                   "first-execution", Script::cast(sfi->script())->id(), 0,
+                   sfi->StartPosition(), sfi->EndPosition(), sfi->DebugName()));
   function->feedback_vector()->ClearOptimizationMarker();
   // Return the code to continue execution, we don't care at this point whether
   // this is for lazy compilation or has been eagerly complied.
@@ -85,7 +85,7 @@ RUNTIME_FUNCTION(Runtime_CompileOptimized_NotConcurrent) {
     return isolate->StackOverflow();
   }
   if (!Compiler::CompileOptimized(function, ConcurrencyMode::kNotConcurrent)) {
-    return isolate->heap()->exception();
+    return ReadOnlyRoots(isolate).exception();
   }
   DCHECK(function->is_compiled());
   return function->code();
@@ -121,8 +121,8 @@ RUNTIME_FUNCTION(Runtime_InstantiateAsmJs) {
     memory = args.at<JSArrayBuffer>(3);
   }
   if (function->shared()->HasAsmWasmData()) {
-    Handle<SharedFunctionInfo> shared(function->shared());
-    Handle<FixedArray> data(shared->asm_wasm_data());
+    Handle<SharedFunctionInfo> shared(function->shared(), isolate);
+    Handle<FixedArray> data(shared->asm_wasm_data(), isolate);
     MaybeHandle<Object> result = AsmJs::InstantiateAsmWasm(
         isolate, shared, data, stdlib, foreign, memory);
     if (!result.is_null()) {
@@ -130,9 +130,10 @@ RUNTIME_FUNCTION(Runtime_InstantiateAsmJs) {
     }
   }
   // Remove wasm data, mark as broken for asm->wasm, replace function code with
-  // CompileLazy, and return a smi 0 to indicate failure.
+  // UncompiledData, and return a smi 0 to indicate failure.
   if (function->shared()->HasAsmWasmData()) {
-    function->shared()->FlushCompiled();
+    SharedFunctionInfo::DiscardCompiled(isolate,
+                                        handle(function->shared(), isolate));
   }
   function->shared()->set_is_asm_wasm_broken(true);
   DCHECK(function->code() ==
@@ -153,7 +154,7 @@ RUNTIME_FUNCTION(Runtime_NotifyDeoptimized) {
   TimerEventScope<TimerEventDeoptimizeCode> timer(isolate);
   TRACE_EVENT0("v8", "V8.DeoptimizeCode");
   Handle<JSFunction> function = deoptimizer->function();
-  Deoptimizer::BailoutType type = deoptimizer->bailout_type();
+  DeoptimizeKind type = deoptimizer->deopt_kind();
 
   // TODO(turbofan): We currently need the native context to materialize
   // the arguments object, but only to get to its map.
@@ -169,11 +170,11 @@ RUNTIME_FUNCTION(Runtime_NotifyDeoptimized) {
   isolate->set_context(Context::cast(top_frame->context()));
 
   // Invalidate the underlying optimized code on non-lazy deopts.
-  if (type != Deoptimizer::LAZY) {
+  if (type != DeoptimizeKind::kLazy) {
     Deoptimizer::DeoptimizeFunction(*function);
   }
 
-  return isolate->heap()->undefined_value();
+  return ReadOnlyRoots(isolate).undefined_value();
 }
 
 
@@ -203,7 +204,7 @@ BailoutId DetermineEntryAndDisarmOSRForInterpreter(JavaScriptFrame* frame) {
   // the one installed on the function (e.g. patched by debugger). This however
   // is fine because we guarantee the layout to be in sync, hence any BailoutId
   // representing the entry point will be valid for any copy of the bytecode.
-  Handle<BytecodeArray> bytecode(iframe->GetBytecodeArray());
+  Handle<BytecodeArray> bytecode(iframe->GetBytecodeArray(), iframe->isolate());
 
   DCHECK(frame->LookupCode()->is_interpreter_trampoline_builtin());
   DCHECK(frame->function()->shared()->HasBytecodeArray());
@@ -294,8 +295,8 @@ static Object* CompileGlobalEval(Isolate* isolate, Handle<String> source,
                                  Handle<SharedFunctionInfo> outer_info,
                                  LanguageMode language_mode,
                                  int eval_scope_position, int eval_position) {
-  Handle<Context> context = Handle<Context>(isolate->context());
-  Handle<Context> native_context = Handle<Context>(context->native_context());
+  Handle<Context> context(isolate->context(), isolate);
+  Handle<Context> native_context(context->native_context(), isolate);
 
   // Check if native context allows code generation from
   // strings. Throw an exception if it doesn't.
@@ -308,7 +309,7 @@ static Object* CompileGlobalEval(Isolate* isolate, Handle<String> source,
     MaybeHandle<Object> maybe_error = isolate->factory()->NewEvalError(
         MessageTemplate::kCodeGenFromStrings, error_message);
     if (maybe_error.ToHandle(&error)) isolate->Throw(*error);
-    return isolate->heap()->exception();
+    return ReadOnlyRoots(isolate).exception();
   }
 
   // Deal with a normal eval call with a string argument. Compile it
@@ -320,7 +321,7 @@ static Object* CompileGlobalEval(Isolate* isolate, Handle<String> source,
       Compiler::GetFunctionFromEval(source, outer_info, context, language_mode,
                                     restriction, kNoSourcePosition,
                                     eval_scope_position, eval_position),
-      isolate->heap()->exception());
+      ReadOnlyRoots(isolate).exception());
   return *compiled;
 }
 
diff --git a/deps/v8/src/runtime/runtime-debug.cc b/deps/v8/src/runtime/runtime-debug.cc
index a47ea2caaf181b..9711ffad54cc0d 100644
--- a/deps/v8/src/runtime/runtime-debug.cc
+++ b/deps/v8/src/runtime/runtime-debug.cc
@@ -21,6 +21,8 @@
 #include "src/interpreter/interpreter.h"
 #include "src/isolate-inl.h"
 #include "src/objects/debug-objects-inl.h"
+#include "src/objects/js-collection-inl.h"
+#include "src/objects/js-promise-inl.h"
 #include "src/runtime/runtime.h"
 #include "src/snapshot/snapshot.h"
 #include "src/wasm/wasm-objects-inl.h"
@@ -45,7 +47,8 @@ RUNTIME_FUNCTION_RETURN_PAIR(Runtime_DebugBreakOnBytecode) {
   // Get the top-most JavaScript frame.
   JavaScriptFrameIterator it(isolate);
   if (isolate->debug_execution_mode() == DebugInfo::kBreakpoints) {
-    isolate->debug()->Break(it.frame(), handle(it.frame()->function()));
+    isolate->debug()->Break(it.frame(),
+                            handle(it.frame()->function(), isolate));
   }
 
   // Return the handler from the original bytecode array.
@@ -80,8 +83,16 @@ RUNTIME_FUNCTION_RETURN_PAIR(Runtime_DebugBreakOnBytecode) {
   isolate->interpreter()->GetAndMaybeDeserializeBytecodeHandler(bytecode,
                                                                 operand_scale);
 
-  return MakePair(side_effect_check_failed ? isolate->heap()->exception()
-                                           : isolate->debug()->return_value(),
+  if (side_effect_check_failed) {
+    return MakePair(ReadOnlyRoots(isolate).exception(),
+                    Smi::FromInt(static_cast<uint8_t>(bytecode)));
+  }
+  Object* interrupt_object = isolate->stack_guard()->HandleInterrupts();
+  if (interrupt_object->IsException(isolate)) {
+    return MakePair(interrupt_object,
+                    Smi::FromInt(static_cast<uint8_t>(bytecode)));
+  }
+  return MakePair(isolate->debug()->return_value(),
                   Smi::FromInt(static_cast<uint8_t>(bytecode)));
 }
 
@@ -99,15 +110,7 @@ RUNTIME_FUNCTION(Runtime_DebugBreakAtEntry) {
   DCHECK_EQ(*function, it.frame()->function());
   isolate->debug()->Break(it.frame(), function);
 
-  return isolate->heap()->undefined_value();
-}
-
-RUNTIME_FUNCTION(Runtime_DebugApplyInstrumentation) {
-  HandleScope scope(isolate);
-  DCHECK_EQ(1, args.length());
-  CONVERT_ARG_HANDLE_CHECKED(JSFunction, function, 0);
-  isolate->debug()->ApplyInstrumentation(handle(function->shared()));
-  return isolate->heap()->undefined_value();
+  return ReadOnlyRoots(isolate).undefined_value();
 }
 
 RUNTIME_FUNCTION(Runtime_HandleDebuggerStatement) {
@@ -116,53 +119,16 @@ RUNTIME_FUNCTION(Runtime_HandleDebuggerStatement) {
   if (isolate->debug()->break_points_active()) {
     isolate->debug()->HandleDebugBreak(kIgnoreIfTopFrameBlackboxed);
   }
-  return isolate->heap()->undefined_value();
+  return isolate->stack_guard()->HandleInterrupts();
 }
 
-
 RUNTIME_FUNCTION(Runtime_ScheduleBreak) {
   SealHandleScope shs(isolate);
   DCHECK_EQ(0, args.length());
-  isolate->stack_guard()->RequestDebugBreak();
-  return isolate->heap()->undefined_value();
-}
-
-static Handle<Object> DebugGetProperty(LookupIterator* it,
-                                       bool* has_caught = nullptr) {
-  for (; it->IsFound(); it->Next()) {
-    switch (it->state()) {
-      case LookupIterator::NOT_FOUND:
-      case LookupIterator::TRANSITION:
-        UNREACHABLE();
-      case LookupIterator::ACCESS_CHECK:
-        // Ignore access checks.
-        break;
-      case LookupIterator::INTEGER_INDEXED_EXOTIC:
-      case LookupIterator::INTERCEPTOR:
-      case LookupIterator::JSPROXY:
-        return it->isolate()->factory()->undefined_value();
-      case LookupIterator::ACCESSOR: {
-        Handle<Object> accessors = it->GetAccessors();
-        if (!accessors->IsAccessorInfo()) {
-          return it->isolate()->factory()->undefined_value();
-        }
-        MaybeHandle<Object> maybe_result =
-            JSObject::GetPropertyWithAccessor(it);
-        Handle<Object> result;
-        if (!maybe_result.ToHandle(&result)) {
-          result = handle(it->isolate()->pending_exception(), it->isolate());
-          it->isolate()->clear_pending_exception();
-          if (has_caught != nullptr) *has_caught = true;
-        }
-        return result;
-      }
-
-      case LookupIterator::DATA:
-        return it->GetDataValue();
-    }
-  }
-
-  return it->isolate()->factory()->undefined_value();
+  isolate->RequestInterrupt(
+      [](v8::Isolate* isolate, void*) { v8::debug::BreakRightNow(isolate); },
+      nullptr);
+  return ReadOnlyRoots(isolate).undefined_value();
 }
 
 template <class IteratorType>
@@ -280,7 +246,7 @@ MaybeHandle<JSArray> Runtime::GetInternalProperties(Isolate* isolate,
     result->set(1, *status_str);
 
     Handle<Object> value_obj(promise->status() == Promise::kPending
-                                 ? isolate->heap()->undefined_value()
+                                 ? ReadOnlyRoots(isolate).undefined_value()
                                  : promise->result(),
                              isolate);
     Handle<String> promise_value =
@@ -320,627 +286,6 @@ MaybeHandle<JSArray> Runtime::GetInternalProperties(Isolate* isolate,
   return factory->NewJSArray(0);
 }
 
-
-RUNTIME_FUNCTION(Runtime_DebugGetInternalProperties) {
-  HandleScope scope(isolate);
-  DCHECK_EQ(1, args.length());
-  CONVERT_ARG_HANDLE_CHECKED(Object, obj, 0);
-  RETURN_RESULT_OR_FAILURE(isolate,
-                           Runtime::GetInternalProperties(isolate, obj));
-}
-
-
-// Get debugger related details for an object property, in the following format:
-// 0: Property value
-// 1: Property details
-// 2: Property value is exception
-// 3: Getter function if defined
-// 4: Setter function if defined
-// Items 2-4 are only filled if the property has either a getter or a setter.
-RUNTIME_FUNCTION(Runtime_DebugGetPropertyDetails) {
-  HandleScope scope(isolate);
-  DCHECK_EQ(2, args.length());
-  CONVERT_ARG_HANDLE_CHECKED(JSObject, obj, 0);
-  CONVERT_ARG_HANDLE_CHECKED(Object, name_obj, 1);
-
-  // Convert the {name_obj} to a Name.
-  Handle<Name> name;
-  ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, name,
-                                     Object::ToName(isolate, name_obj));
-
-  // Make sure to set the current context to the context before the debugger was
-  // entered (if the debugger is entered). The reason for switching context here
-  // is that for some property lookups (accessors and interceptors) callbacks
-  // into the embedding application can occur, and the embedding application
-  // could have the assumption that its own native context is the current
-  // context and not some internal debugger context.
-  SaveContext save(isolate);
-  if (isolate->debug()->in_debug_scope()) {
-    isolate->set_context(*isolate->debug()->debugger_entry()->GetContext());
-  }
-
-  // Check if the name is trivially convertible to an index and get the element
-  // if so.
-  uint32_t index;
-  // TODO(verwaest): Make sure DebugGetProperty can handle arrays, and remove
-  // this special case.
-  if (name->AsArrayIndex(&index)) {
-    Handle<FixedArray> details = isolate->factory()->NewFixedArray(2);
-    Handle<Object> element_or_char;
-    ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
-        isolate, element_or_char, JSReceiver::GetElement(isolate, obj, index));
-    details->set(0, *element_or_char);
-    details->set(1, PropertyDetails::Empty().AsSmi());
-    return *isolate->factory()->NewJSArrayWithElements(details);
-  }
-
-  LookupIterator it(obj, name, LookupIterator::OWN);
-  bool has_caught = false;
-  Handle<Object> value = DebugGetProperty(&it, &has_caught);
-  if (!it.IsFound()) return isolate->heap()->undefined_value();
-
-  Handle<Object> maybe_pair;
-  if (it.state() == LookupIterator::ACCESSOR) {
-    maybe_pair = it.GetAccessors();
-  }
-
-  // If the callback object is a fixed array then it contains JavaScript
-  // getter and/or setter.
-  bool has_js_accessors = !maybe_pair.is_null() && maybe_pair->IsAccessorPair();
-  Handle<FixedArray> details =
-      isolate->factory()->NewFixedArray(has_js_accessors ? 6 : 3);
-  details->set(0, *value);
-  // TODO(verwaest): Get rid of this random way of handling interceptors.
-  PropertyDetails d = it.state() == LookupIterator::INTERCEPTOR
-                          ? PropertyDetails::Empty()
-                          : it.property_details();
-  details->set(1, d.AsSmi());
-  details->set(
-      2, isolate->heap()->ToBoolean(it.state() == LookupIterator::INTERCEPTOR));
-  if (has_js_accessors) {
-    Handle<AccessorPair> accessors = Handle<AccessorPair>::cast(maybe_pair);
-    details->set(3, isolate->heap()->ToBoolean(has_caught));
-    Handle<Object> getter =
-        AccessorPair::GetComponent(accessors, ACCESSOR_GETTER);
-    Handle<Object> setter =
-        AccessorPair::GetComponent(accessors, ACCESSOR_SETTER);
-    details->set(4, *getter);
-    details->set(5, *setter);
-  }
-
-  return *isolate->factory()->NewJSArrayWithElements(details);
-}
-
-
-RUNTIME_FUNCTION(Runtime_DebugGetProperty) {
-  HandleScope scope(isolate);
-
-  DCHECK_EQ(2, args.length());
-
-  CONVERT_ARG_HANDLE_CHECKED(Object, obj, 0);
-  CONVERT_ARG_HANDLE_CHECKED(Name, name, 1);
-
-  LookupIterator it(obj, name);
-  return *DebugGetProperty(&it);
-}
-
-// Return the property kind calculated from the property details.
-// args[0]: smi with property details.
-RUNTIME_FUNCTION(Runtime_DebugPropertyKindFromDetails) {
-  SealHandleScope shs(isolate);
-  DCHECK_EQ(1, args.length());
-  CONVERT_PROPERTY_DETAILS_CHECKED(details, 0);
-  return Smi::FromInt(static_cast<int>(details.kind()));
-}
-
-
-// Return the property attribute calculated from the property details.
-// args[0]: smi with property details.
-RUNTIME_FUNCTION(Runtime_DebugPropertyAttributesFromDetails) {
-  SealHandleScope shs(isolate);
-  DCHECK_EQ(1, args.length());
-  CONVERT_PROPERTY_DETAILS_CHECKED(details, 0);
-  return Smi::FromInt(static_cast<int>(details.attributes()));
-}
-
-
-RUNTIME_FUNCTION(Runtime_CheckExecutionState) {
-  SealHandleScope shs(isolate);
-  DCHECK_EQ(1, args.length());
-  CONVERT_NUMBER_CHECKED(int, break_id, Int32, args[0]);
-  CHECK(isolate->debug()->CheckExecutionState(break_id));
-  return isolate->heap()->true_value();
-}
-
-
-RUNTIME_FUNCTION(Runtime_GetFrameCount) {
-  HandleScope scope(isolate);
-  DCHECK_EQ(1, args.length());
-  CONVERT_NUMBER_CHECKED(int, break_id, Int32, args[0]);
-  CHECK(isolate->debug()->CheckExecutionState(break_id));
-
-  // Count all frames which are relevant to debugging stack trace.
-  int n = 0;
-  StackFrame::Id id = isolate->debug()->break_frame_id();
-  if (id == StackFrame::NO_ID) {
-    // If there is no JavaScript stack frame count is 0.
-    return Smi::kZero;
-  }
-
-  std::vector<FrameSummary> frames;
-  for (StackTraceFrameIterator it(isolate, id); !it.done(); it.Advance()) {
-    frames.clear();
-    it.frame()->Summarize(&frames);
-    for (size_t i = frames.size(); i != 0; i--) {
-      // Omit functions from native and extension scripts.
-      if (frames[i - 1].is_subject_to_debugging()) n++;
-    }
-  }
-  return Smi::FromInt(n);
-}
-
-static const int kFrameDetailsFrameIdIndex = 0;
-static const int kFrameDetailsReceiverIndex = 1;
-static const int kFrameDetailsFunctionIndex = 2;
-static const int kFrameDetailsScriptIndex = 3;
-static const int kFrameDetailsArgumentCountIndex = 4;
-static const int kFrameDetailsLocalCountIndex = 5;
-static const int kFrameDetailsSourcePositionIndex = 6;
-static const int kFrameDetailsConstructCallIndex = 7;
-static const int kFrameDetailsAtReturnIndex = 8;
-static const int kFrameDetailsFlagsIndex = 9;
-static const int kFrameDetailsFirstDynamicIndex = 10;
-
-// Return an array with frame details
-// args[0]: number: break id
-// args[1]: number: frame index
-//
-// The array returned contains the following information:
-// 0: Frame id
-// 1: Receiver
-// 2: Function
-// 3: Script
-// 4: Argument count
-// 5: Local count
-// 6: Source position
-// 7: Constructor call
-// 8: Is at return
-// 9: Flags
-// Arguments name, value
-// Locals name, value
-// Return value if any
-RUNTIME_FUNCTION(Runtime_GetFrameDetails) {
-  HandleScope scope(isolate);
-  DCHECK_EQ(2, args.length());
-  CONVERT_NUMBER_CHECKED(int, break_id, Int32, args[0]);
-  CHECK(isolate->debug()->CheckExecutionState(break_id));
-
-  CONVERT_NUMBER_CHECKED(int, index, Int32, args[1]);
-  Heap* heap = isolate->heap();
-
-  // Find the relevant frame with the requested index.
-  StackFrame::Id id = isolate->debug()->break_frame_id();
-  if (id == StackFrame::NO_ID) {
-    // If there are no JavaScript stack frames return undefined.
-    return heap->undefined_value();
-  }
-
-  StackTraceFrameIterator it(isolate, id);
-  // Inlined frame index in optimized frame, starting from outer function.
-  int inlined_frame_index =
-      DebugFrameHelper::FindIndexedNonNativeFrame(&it, index);
-  if (inlined_frame_index == -1) return heap->undefined_value();
-
-  FrameInspector frame_inspector(it.frame(), inlined_frame_index, isolate);
-
-  // Traverse the saved contexts chain to find the active context for the
-  // selected frame.
-  SaveContext* save =
-      DebugFrameHelper::FindSavedContextForFrame(isolate, it.frame());
-
-  // Get the frame id.
-  Handle<Object> frame_id(DebugFrameHelper::WrapFrameId(it.frame()->id()),
-                          isolate);
-
-  if (frame_inspector.IsWasm()) {
-    // Create the details array (no dynamic information for wasm).
-    Handle<FixedArray> details =
-        isolate->factory()->NewFixedArray(kFrameDetailsFirstDynamicIndex);
-
-    // Add the frame id.
-    details->set(kFrameDetailsFrameIdIndex, *frame_id);
-
-    // Add the function name.
-    Handle<String> func_name = frame_inspector.GetFunctionName();
-    details->set(kFrameDetailsFunctionIndex, *func_name);
-
-    // Add the script wrapper
-    Handle<Object> script_wrapper =
-        Script::GetWrapper(frame_inspector.GetScript());
-    details->set(kFrameDetailsScriptIndex, *script_wrapper);
-
-    // Add the arguments count.
-    details->set(kFrameDetailsArgumentCountIndex, Smi::kZero);
-
-    // Add the locals count
-    details->set(kFrameDetailsLocalCountIndex, Smi::kZero);
-
-    // Add the source position.
-    int position = frame_inspector.GetSourcePosition();
-    details->set(kFrameDetailsSourcePositionIndex, Smi::FromInt(position));
-
-    // Add the constructor information.
-    details->set(kFrameDetailsConstructCallIndex, heap->ToBoolean(false));
-
-    // Add the at return information.
-    details->set(kFrameDetailsAtReturnIndex, heap->ToBoolean(false));
-
-    // Add flags to indicate information on whether this frame is
-    //   bit 0: invoked in the debugger context.
-    //   bit 1: optimized frame.
-    //   bit 2: inlined in optimized frame
-    int flags = inlined_frame_index << 2;
-    if (*save->context() == *isolate->debug()->debug_context()) {
-      flags |= 1 << 0;
-    }
-    details->set(kFrameDetailsFlagsIndex, Smi::FromInt(flags));
-
-    return *isolate->factory()->NewJSArrayWithElements(details);
-  }
-
-  // Find source position in unoptimized code.
-  int position = frame_inspector.GetSourcePosition();
-
-  // Handle JavaScript frames.
-  bool is_optimized = it.frame()->is_optimized();
-
-  // Check for constructor frame.
-  bool constructor = frame_inspector.IsConstructor();
-
-  // Get scope info and read from it for local variable information.
-  Handle<JSFunction> function =
-      Handle<JSFunction>::cast(frame_inspector.GetFunction());
-  CHECK(function->shared()->IsSubjectToDebugging());
-  Handle<SharedFunctionInfo> shared(function->shared());
-  Handle<ScopeInfo> scope_info(shared->scope_info());
-  DCHECK(*scope_info != ScopeInfo::Empty(isolate));
-
-  // Get the locals names and values into a temporary array.
-  Handle<Object> maybe_context = frame_inspector.GetContext();
-  const int local_count_with_synthetic = maybe_context->IsContext()
-                                             ? scope_info->LocalCount()
-                                             : scope_info->StackLocalCount();
-  int local_count = local_count_with_synthetic;
-  for (int slot = 0; slot < local_count_with_synthetic; ++slot) {
-    // Hide compiler-introduced temporary variables, whether on the stack or on
-    // the context.
-    if (ScopeInfo::VariableIsSynthetic(scope_info->LocalName(slot))) {
-      local_count--;
-    }
-  }
-
-  std::vector<Handle<Object>> locals;
-  // Fill in the values of the locals.
-  int i = 0;
-  for (; i < scope_info->StackLocalCount(); ++i) {
-    // Use the value from the stack.
-    if (ScopeInfo::VariableIsSynthetic(scope_info->LocalName(i))) continue;
-    locals.emplace_back(scope_info->LocalName(i), isolate);
-    Handle<Object> value =
-        frame_inspector.GetExpression(scope_info->StackLocalIndex(i));
-    // TODO(yangguo): We convert optimized out values to {undefined} when they
-    // are passed to the debugger. Eventually we should handle them somehow.
-    if (value->IsOptimizedOut(isolate)) {
-      value = isolate->factory()->undefined_value();
-    }
-    locals.push_back(value);
-  }
-  if (static_cast<int>(locals.size()) < local_count * 2) {
-    // Get the context containing declarations.
-    DCHECK(maybe_context->IsContext());
-    Handle<Context> context(Context::cast(*maybe_context)->closure_context());
-
-    for (; i < scope_info->LocalCount(); ++i) {
-      Handle<String> name(scope_info->LocalName(i));
-      if (ScopeInfo::VariableIsSynthetic(*name)) continue;
-      VariableMode mode;
-      InitializationFlag init_flag;
-      MaybeAssignedFlag maybe_assigned_flag;
-      locals.push_back(name);
-      int context_slot_index = ScopeInfo::ContextSlotIndex(
-          scope_info, name, &mode, &init_flag, &maybe_assigned_flag);
-      Object* value = context->get(context_slot_index);
-      locals.emplace_back(value, isolate);
-    }
-  }
-
-  // Check whether this frame is positioned at return. If not top
-  // frame or if the frame is optimized it cannot be at a return.
-  bool at_return = false;
-  if (!is_optimized && index == 0) {
-    at_return = isolate->debug()->IsBreakAtReturn(it.javascript_frame());
-  }
-
-  // If positioned just before return find the value to be returned and add it
-  // to the frame information.
-  Handle<Object> return_value = isolate->factory()->undefined_value();
-  if (at_return) {
-    return_value = handle(isolate->debug()->return_value(), isolate);
-  }
-
-  // Now advance to the arguments adapter frame (if any). It contains all
-  // the provided parameters whereas the function frame always have the number
-  // of arguments matching the functions parameters. The rest of the
-  // information (except for what is collected above) is the same.
-  if ((inlined_frame_index == 0) &&
-      it.javascript_frame()->has_adapted_arguments()) {
-    it.AdvanceOneFrame();
-    DCHECK(it.frame()->is_arguments_adaptor());
-    frame_inspector.SetArgumentsFrame(it.frame());
-  }
-
-  // Find the number of arguments to fill. At least fill the number of
-  // parameters for the function and fill more if more parameters are provided.
-  int argument_count = scope_info->ParameterCount();
-  if (argument_count < frame_inspector.GetParametersCount()) {
-    argument_count = frame_inspector.GetParametersCount();
-  }
-
-  // Calculate the size of the result.
-  int details_size = kFrameDetailsFirstDynamicIndex +
-                     2 * (argument_count + local_count) + (at_return ? 1 : 0);
-  Handle<FixedArray> details = isolate->factory()->NewFixedArray(details_size);
-
-  // Add the frame id.
-  details->set(kFrameDetailsFrameIdIndex, *frame_id);
-
-  // Add the function (same as in function frame).
-  details->set(kFrameDetailsFunctionIndex, *(frame_inspector.GetFunction()));
-
-  // Add the script wrapper
-  Handle<Object> script_wrapper =
-      Script::GetWrapper(frame_inspector.GetScript());
-  details->set(kFrameDetailsScriptIndex, *script_wrapper);
-
-  // Add the arguments count.
-  details->set(kFrameDetailsArgumentCountIndex, Smi::FromInt(argument_count));
-
-  // Add the locals count
-  details->set(kFrameDetailsLocalCountIndex, Smi::FromInt(local_count));
-
-  // Add the source position.
-  if (position != kNoSourcePosition) {
-    details->set(kFrameDetailsSourcePositionIndex, Smi::FromInt(position));
-  } else {
-    details->set(kFrameDetailsSourcePositionIndex, heap->undefined_value());
-  }
-
-  // Add the constructor information.
-  details->set(kFrameDetailsConstructCallIndex, heap->ToBoolean(constructor));
-
-  // Add the at return information.
-  details->set(kFrameDetailsAtReturnIndex, heap->ToBoolean(at_return));
-
-  // Add flags to indicate information on whether this frame is
-  //   bit 0: invoked in the debugger context.
-  //   bit 1: optimized frame.
-  //   bit 2: inlined in optimized frame
-  int flags = 0;
-  if (*save->context() == *isolate->debug()->debug_context()) {
-    flags |= 1 << 0;
-  }
-  if (is_optimized) {
-    flags |= 1 << 1;
-    flags |= inlined_frame_index << 2;
-  }
-  details->set(kFrameDetailsFlagsIndex, Smi::FromInt(flags));
-
-  // Fill the dynamic part.
-  int details_index = kFrameDetailsFirstDynamicIndex;
-
-  // Add arguments name and value.
-  for (int i = 0; i < argument_count; i++) {
-    // Name of the argument.
-    if (i < scope_info->ParameterCount()) {
-      details->set(details_index++, scope_info->ParameterName(i));
-    } else {
-      details->set(details_index++, heap->undefined_value());
-    }
-
-    // Parameter value.
-    if (i < frame_inspector.GetParametersCount()) {
-      // Get the value from the stack.
-      details->set(details_index++, *(frame_inspector.GetParameter(i)));
-    } else {
-      details->set(details_index++, heap->undefined_value());
-    }
-  }
-
-  // Add locals name and value from the temporary copy from the function frame.
-  for (const auto& local : locals) details->set(details_index++, *local);
-
-  // Add the value being returned.
-  if (at_return) {
-    details->set(details_index++, *return_value);
-  }
-
-  // Add the receiver (same as in function frame).
-  Handle<Object> receiver = frame_inspector.GetReceiver();
-  DCHECK(function->shared()->IsUserJavaScript());
-  // Optimized frames only restore the receiver as best-effort (see
-  // OptimizedFrame::Summarize).
-  DCHECK_IMPLIES(!is_optimized && is_sloppy(shared->language_mode()),
-                 receiver->IsJSReceiver());
-  details->set(kFrameDetailsReceiverIndex, *receiver);
-
-  DCHECK_EQ(details_size, details_index);
-  return *isolate->factory()->NewJSArrayWithElements(details);
-}
-
-
-RUNTIME_FUNCTION(Runtime_GetScopeCount) {
-  HandleScope scope(isolate);
-  DCHECK_EQ(2, args.length());
-  CONVERT_NUMBER_CHECKED(int, break_id, Int32, args[0]);
-  CHECK(isolate->debug()->CheckExecutionState(break_id));
-
-  CONVERT_SMI_ARG_CHECKED(wrapped_id, 1);
-
-  // Get the frame where the debugging is performed.
-  StackFrame::Id id = DebugFrameHelper::UnwrapFrameId(wrapped_id);
-  StackTraceFrameIterator it(isolate, id);
-  StandardFrame* frame = it.frame();
-  if (it.frame()->is_wasm()) return 0;
-
-  FrameInspector frame_inspector(frame, 0, isolate);
-
-  // Count the visible scopes.
-  int n = 0;
-  for (ScopeIterator it(isolate, &frame_inspector); !it.Done(); it.Next()) {
-    n++;
-  }
-
-  return Smi::FromInt(n);
-}
-
-
-// Return an array with scope details
-// args[0]: number: break id
-// args[1]: number: frame index
-// args[2]: number: inlined frame index
-// args[3]: number: scope index
-//
-// The array returned contains the following information:
-// 0: Scope type
-// 1: Scope object
-RUNTIME_FUNCTION(Runtime_GetScopeDetails) {
-  HandleScope scope(isolate);
-  DCHECK_EQ(4, args.length());
-  CONVERT_NUMBER_CHECKED(int, break_id, Int32, args[0]);
-  CHECK(isolate->debug()->CheckExecutionState(break_id));
-
-  CONVERT_SMI_ARG_CHECKED(wrapped_id, 1);
-  CONVERT_NUMBER_CHECKED(int, inlined_jsframe_index, Int32, args[2]);
-  CONVERT_NUMBER_CHECKED(int, index, Int32, args[3]);
-
-  // Get the frame where the debugging is performed.
-  StackFrame::Id id = DebugFrameHelper::UnwrapFrameId(wrapped_id);
-  StackTraceFrameIterator frame_it(isolate, id);
-  // Wasm has no scopes, this must be javascript.
-  JavaScriptFrame* frame = JavaScriptFrame::cast(frame_it.frame());
-  FrameInspector frame_inspector(frame, inlined_jsframe_index, isolate);
-
-  // Find the requested scope.
-  int n = 0;
-  ScopeIterator it(isolate, &frame_inspector);
-  for (; !it.Done() && n < index; it.Next()) {
-    n++;
-  }
-  if (it.Done()) {
-    return isolate->heap()->undefined_value();
-  }
-  RETURN_RESULT_OR_FAILURE(isolate, it.MaterializeScopeDetails());
-}
-
-
-// Return an array of scope details
-// args[0]: number: break id
-// args[1]: number: frame index
-// args[2]: number: inlined frame index
-// args[3]: boolean: ignore nested scopes
-//
-// The array returned contains arrays with the following information:
-// 0: Scope type
-// 1: Scope object
-RUNTIME_FUNCTION(Runtime_GetAllScopesDetails) {
-  HandleScope scope(isolate);
-  DCHECK(args.length() == 3 || args.length() == 4);
-  CONVERT_NUMBER_CHECKED(int, break_id, Int32, args[0]);
-  CHECK(isolate->debug()->CheckExecutionState(break_id));
-
-  CONVERT_SMI_ARG_CHECKED(wrapped_id, 1);
-  CONVERT_NUMBER_CHECKED(int, inlined_frame_index, Int32, args[2]);
-
-  ScopeIterator::Option option = ScopeIterator::DEFAULT;
-  if (args.length() == 4) {
-    CONVERT_BOOLEAN_ARG_CHECKED(flag, 3);
-    if (flag) option = ScopeIterator::IGNORE_NESTED_SCOPES;
-  }
-
-  // Get the frame where the debugging is performed.
-  StackFrame::Id id = DebugFrameHelper::UnwrapFrameId(wrapped_id);
-  StackTraceFrameIterator frame_it(isolate, id);
-  StandardFrame* frame = frame_it.frame();
-
-  // Handle wasm frames specially. They provide exactly two scopes (global /
-  // local).
-  if (frame->is_wasm_interpreter_entry()) {
-    Handle<WasmDebugInfo> debug_info(
-        WasmInterpreterEntryFrame::cast(frame)->debug_info(), isolate);
-    return *WasmDebugInfo::GetScopeDetails(debug_info, frame->fp(),
-                                           inlined_frame_index);
-  }
-
-  FrameInspector frame_inspector(frame, inlined_frame_index, isolate);
-  std::vector<Handle<JSObject>> result;
-  ScopeIterator it(isolate, &frame_inspector, option);
-  for (; !it.Done(); it.Next()) {
-    Handle<JSObject> details;
-    ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, details,
-                                       it.MaterializeScopeDetails());
-    result.push_back(details);
-  }
-
-  int result_size = static_cast<int>(result.size());
-  Handle<FixedArray> array = isolate->factory()->NewFixedArray(result_size);
-  for (int i = 0; i < result_size; ++i) {
-    array->set(i, *result[i]);
-  }
-  return *isolate->factory()->NewJSArrayWithElements(array);
-}
-
-
-RUNTIME_FUNCTION(Runtime_GetFunctionScopeCount) {
-  HandleScope scope(isolate);
-  DCHECK_EQ(1, args.length());
-
-  // Check arguments.
-  CONVERT_ARG_HANDLE_CHECKED(JSReceiver, function, 0);
-
-  // Count the visible scopes.
-  int n = 0;
-  if (function->IsJSFunction()) {
-    for (ScopeIterator it(isolate, Handle<JSFunction>::cast(function));
-         !it.Done(); it.Next()) {
-      n++;
-    }
-  }
-
-  return Smi::FromInt(n);
-}
-
-
-RUNTIME_FUNCTION(Runtime_GetFunctionScopeDetails) {
-  HandleScope scope(isolate);
-  DCHECK_EQ(2, args.length());
-
-  // Check arguments.
-  CONVERT_ARG_HANDLE_CHECKED(JSFunction, fun, 0);
-  CONVERT_NUMBER_CHECKED(int, index, Int32, args[1]);
-
-  // Find the requested scope.
-  int n = 0;
-  ScopeIterator it(isolate, fun);
-  for (; !it.Done() && n < index; it.Next()) {
-    n++;
-  }
-  if (it.Done()) {
-    return isolate->heap()->undefined_value();
-  }
-
-  RETURN_RESULT_OR_FAILURE(isolate, it.MaterializeScopeDetails());
-}
-
 RUNTIME_FUNCTION(Runtime_GetGeneratorScopeCount) {
   HandleScope scope(isolate);
   DCHECK_EQ(1, args.length());
@@ -969,7 +314,7 @@ RUNTIME_FUNCTION(Runtime_GetGeneratorScopeDetails) {
   DCHECK_EQ(2, args.length());
 
   if (!args[0]->IsJSGeneratorObject()) {
-    return isolate->heap()->undefined_value();
+    return ReadOnlyRoots(isolate).undefined_value();
   }
 
   // Check arguments.
@@ -978,7 +323,7 @@ RUNTIME_FUNCTION(Runtime_GetGeneratorScopeDetails) {
 
   // Only inspect suspended generator scopes.
   if (!gen->is_suspended()) {
-    return isolate->heap()->undefined_value();
+    return ReadOnlyRoots(isolate).undefined_value();
   }
 
   // Find the requested scope.
@@ -988,10 +333,10 @@ RUNTIME_FUNCTION(Runtime_GetGeneratorScopeDetails) {
     n++;
   }
   if (it.Done()) {
-    return isolate->heap()->undefined_value();
+    return ReadOnlyRoots(isolate).undefined_value();
   }
 
-  RETURN_RESULT_OR_FAILURE(isolate, it.MaterializeScopeDetails());
+  return *it.MaterializeScopeDetails();
 }
 
 static bool SetScopeVariableValue(ScopeIterator* it, int index,
@@ -1006,52 +351,22 @@ static bool SetScopeVariableValue(ScopeIterator* it, int index,
   return it->SetVariableValue(variable_name, new_value);
 }
 
-
 // Change variable value in closure or local scope
 // args[0]: number or JsFunction: break id or function
-// args[1]: number: frame index (when arg[0] is break id)
-// args[2]: number: inlined frame index (when arg[0] is break id)
-// args[3]: number: scope index
-// args[4]: string: variable name
-// args[5]: object: new value
+// args[1]: number: scope index
+// args[2]: string: variable name
+// args[3]: object: new value
 //
 // Return true if success and false otherwise
-RUNTIME_FUNCTION(Runtime_SetScopeVariableValue) {
+RUNTIME_FUNCTION(Runtime_SetGeneratorScopeVariableValue) {
   HandleScope scope(isolate);
-  DCHECK_EQ(6, args.length());
-
-  // Check arguments.
-  CONVERT_NUMBER_CHECKED(int, index, Int32, args[3]);
-  CONVERT_ARG_HANDLE_CHECKED(String, variable_name, 4);
-  CONVERT_ARG_HANDLE_CHECKED(Object, new_value, 5);
-
-  bool res;
-  if (args[0]->IsNumber()) {
-    CONVERT_NUMBER_CHECKED(int, break_id, Int32, args[0]);
-    CHECK(isolate->debug()->CheckExecutionState(break_id));
-
-    CONVERT_SMI_ARG_CHECKED(wrapped_id, 1);
-    CONVERT_NUMBER_CHECKED(int, inlined_jsframe_index, Int32, args[2]);
-
-    // Get the frame where the debugging is performed.
-    StackFrame::Id id = DebugFrameHelper::UnwrapFrameId(wrapped_id);
-    StackTraceFrameIterator frame_it(isolate, id);
-    // Wasm has no scopes, this must be javascript.
-    JavaScriptFrame* frame = JavaScriptFrame::cast(frame_it.frame());
-    FrameInspector frame_inspector(frame, inlined_jsframe_index, isolate);
-
-    ScopeIterator it(isolate, &frame_inspector);
-    res = SetScopeVariableValue(&it, index, variable_name, new_value);
-  } else if (args[0]->IsJSFunction()) {
-    CONVERT_ARG_HANDLE_CHECKED(JSFunction, fun, 0);
-    ScopeIterator it(isolate, fun);
-    res = SetScopeVariableValue(&it, index, variable_name, new_value);
-  } else {
-    CONVERT_ARG_HANDLE_CHECKED(JSGeneratorObject, gen, 0);
-    ScopeIterator it(isolate, gen);
-    res = SetScopeVariableValue(&it, index, variable_name, new_value);
-  }
-
+  DCHECK_EQ(4, args.length());
+  CONVERT_ARG_HANDLE_CHECKED(JSGeneratorObject, gen, 0);
+  CONVERT_NUMBER_CHECKED(int, index, Int32, args[1]);
+  CONVERT_ARG_HANDLE_CHECKED(String, variable_name, 2);
+  CONVERT_ARG_HANDLE_CHECKED(Object, new_value, 3);
+  ScopeIterator it(isolate, gen);
+  bool res = SetScopeVariableValue(&it, index, variable_name, new_value);
   return isolate->heap()->ToBoolean(res);
 }
 
@@ -1062,11 +377,12 @@ RUNTIME_FUNCTION(Runtime_GetBreakLocations) {
   CHECK(isolate->debug()->is_active());
   CONVERT_ARG_HANDLE_CHECKED(JSFunction, fun, 0);
 
-  Handle<SharedFunctionInfo> shared(fun->shared());
+  Handle<SharedFunctionInfo> shared(fun->shared(), isolate);
   // Find the number of break points
-  Handle<Object> break_locations = Debug::GetSourceBreakLocations(shared);
+  Handle<Object> break_locations =
+      Debug::GetSourceBreakLocations(isolate, shared);
   if (break_locations->IsUndefined(isolate)) {
-    return isolate->heap()->undefined_value();
+    return ReadOnlyRoots(isolate).undefined_value();
   }
   // Return array as JS array
   return *isolate->factory()->NewJSArrayWithElements(
@@ -1074,24 +390,6 @@ RUNTIME_FUNCTION(Runtime_GetBreakLocations) {
 }
 
 
-// Change the state of break on exceptions.
-// args[0]: Enum value indicating whether to affect caught/uncaught exceptions.
-// args[1]: Boolean indicating on/off.
-RUNTIME_FUNCTION(Runtime_ChangeBreakOnException) {
-  HandleScope scope(isolate);
-  DCHECK_EQ(2, args.length());
-  CONVERT_NUMBER_CHECKED(uint32_t, type_arg, Uint32, args[0]);
-  CONVERT_BOOLEAN_ARG_CHECKED(enable, 1);
-
-  // If the number doesn't match an enum value, the ChangeBreakOnException
-  // function will default to affecting caught exceptions.
-  ExceptionBreakType type = static_cast<ExceptionBreakType>(type_arg);
-  // Update break point state.
-  isolate->debug()->ChangeBreakOnException(type, enable);
-  return isolate->heap()->undefined_value();
-}
-
-
 // Returns the state of break on exceptions
 // args[0]: boolean indicating uncaught exceptions
 RUNTIME_FUNCTION(Runtime_IsBreakOnException) {
@@ -1104,256 +402,36 @@ RUNTIME_FUNCTION(Runtime_IsBreakOnException) {
   return Smi::FromInt(result);
 }
 
-
-// Prepare for stepping
-// args[0]: break id for checking execution state
-// args[1]: step action from the enumeration StepAction
-// args[2]: number of times to perform the step, for step out it is the number
-//          of frames to step down.
-RUNTIME_FUNCTION(Runtime_PrepareStep) {
-  HandleScope scope(isolate);
-  DCHECK_EQ(2, args.length());
-  CONVERT_NUMBER_CHECKED(int, break_id, Int32, args[0]);
-  CHECK(isolate->debug()->CheckExecutionState(break_id));
-
-  if (!args[1]->IsNumber()) {
-    return isolate->Throw(isolate->heap()->illegal_argument_string());
-  }
-
-  // Get the step action and check validity.
-  StepAction step_action = static_cast<StepAction>(NumberToInt32(args[1]));
-  if (step_action != StepIn && step_action != StepNext &&
-      step_action != StepOut) {
-    return isolate->Throw(isolate->heap()->illegal_argument_string());
-  }
-
-  // Clear all current stepping setup.
-  isolate->debug()->ClearStepping();
-
-  // Prepare step.
-  isolate->debug()->PrepareStep(static_cast<StepAction>(step_action));
-  return isolate->heap()->undefined_value();
-}
-
 // Clear all stepping set by PrepareStep.
 RUNTIME_FUNCTION(Runtime_ClearStepping) {
   HandleScope scope(isolate);
   DCHECK_EQ(0, args.length());
   CHECK(isolate->debug()->is_active());
   isolate->debug()->ClearStepping();
-  return isolate->heap()->undefined_value();
-}
-
-
-RUNTIME_FUNCTION(Runtime_DebugEvaluate) {
-  HandleScope scope(isolate);
-
-  // Check the execution state and decode arguments frame and source to be
-  // evaluated.
-  DCHECK_EQ(5, args.length());
-  CONVERT_NUMBER_CHECKED(int, break_id, Int32, args[0]);
-  CHECK(isolate->debug()->CheckExecutionState(break_id));
-
-  CONVERT_SMI_ARG_CHECKED(wrapped_id, 1);
-  CONVERT_NUMBER_CHECKED(int, inlined_jsframe_index, Int32, args[2]);
-  CONVERT_ARG_HANDLE_CHECKED(String, source, 3);
-  CONVERT_BOOLEAN_ARG_CHECKED(throw_on_side_effect, 4);
-
-  StackFrame::Id id = DebugFrameHelper::UnwrapFrameId(wrapped_id);
-
-  RETURN_RESULT_OR_FAILURE(
-      isolate, DebugEvaluate::Local(isolate, id, inlined_jsframe_index, source,
-                                    throw_on_side_effect));
+  return ReadOnlyRoots(isolate).undefined_value();
 }
 
-
-RUNTIME_FUNCTION(Runtime_DebugEvaluateGlobal) {
-  HandleScope scope(isolate);
-
-  // Check the execution state and decode arguments frame and source to be
-  // evaluated.
-  DCHECK_EQ(2, args.length());
-  CONVERT_NUMBER_CHECKED(int, break_id, Int32, args[0]);
-  CHECK(isolate->debug()->CheckExecutionState(break_id));
-
-  CONVERT_ARG_HANDLE_CHECKED(String, source, 1);
-
-  RETURN_RESULT_OR_FAILURE(isolate,
-                           DebugEvaluate::Global(isolate, source, false));
-}
-
-
-RUNTIME_FUNCTION(Runtime_DebugGetLoadedScripts) {
+RUNTIME_FUNCTION(Runtime_DebugGetLoadedScriptIds) {
   HandleScope scope(isolate);
   DCHECK_EQ(0, args.length());
 
   Handle<FixedArray> instances;
   {
     DebugScope debug_scope(isolate->debug());
-    if (debug_scope.failed()) {
-      DCHECK(isolate->has_pending_exception());
-      return isolate->heap()->exception();
-    }
     // Fill the script objects.
     instances = isolate->debug()->GetLoadedScripts();
   }
 
   // Convert the script objects to proper JS objects.
   for (int i = 0; i < instances->length(); i++) {
-    Handle<Script> script = Handle<Script>(Script::cast(instances->get(i)));
-    // Get the script wrapper in a local handle before calling GetScriptWrapper,
-    // because using
-    //   instances->set(i, *GetScriptWrapper(script))
-    // is unsafe as GetScriptWrapper might call GC and the C++ compiler might
-    // already have dereferenced the instances handle.
-    Handle<JSObject> wrapper = Script::GetWrapper(script);
-    instances->set(i, *wrapper);
+    Handle<Script> script(Script::cast(instances->get(i)), isolate);
+    instances->set(i, Smi::FromInt(script->id()));
   }
 
   // Return result as a JS array.
   return *isolate->factory()->NewJSArrayWithElements(instances);
 }
 
-static bool HasInPrototypeChainIgnoringProxies(Isolate* isolate,
-                                               JSObject* object,
-                                               Object* proto) {
-  PrototypeIterator iter(isolate, object, kStartAtReceiver);
-  while (true) {
-    iter.AdvanceIgnoringProxies();
-    if (iter.IsAtEnd()) return false;
-    if (iter.GetCurrent() == proto) return true;
-  }
-}
-
-
-// Scan the heap for objects with direct references to an object
-// args[0]: the object to find references to
-// args[1]: constructor function for instances to exclude (Mirror)
-// args[2]: the the maximum number of objects to return
-RUNTIME_FUNCTION(Runtime_DebugReferencedBy) {
-  HandleScope scope(isolate);
-  DCHECK_EQ(3, args.length());
-  CONVERT_ARG_HANDLE_CHECKED(JSObject, target, 0);
-  CONVERT_ARG_HANDLE_CHECKED(Object, filter, 1);
-  CHECK(filter->IsUndefined(isolate) || filter->IsJSObject());
-  CONVERT_NUMBER_CHECKED(int32_t, max_references, Int32, args[2]);
-  CHECK_GE(max_references, 0);
-
-  std::vector<Handle<JSObject>> instances;
-  Heap* heap = isolate->heap();
-  {
-    HeapIterator iterator(heap, HeapIterator::kFilterUnreachable);
-    // Get the constructor function for context extension and arguments array.
-    Object* arguments_fun = isolate->sloppy_arguments_map()->GetConstructor();
-    HeapObject* heap_obj;
-    while ((heap_obj = iterator.next()) != nullptr) {
-      if (!heap_obj->IsJSObject()) continue;
-      JSObject* obj = JSObject::cast(heap_obj);
-      if (obj->IsJSContextExtensionObject()) continue;
-      if (obj->map()->GetConstructor() == arguments_fun) continue;
-      if (!obj->ReferencesObject(*target)) continue;
-      // Check filter if supplied. This is normally used to avoid
-      // references from mirror objects.
-      if (!filter->IsUndefined(isolate) &&
-          HasInPrototypeChainIgnoringProxies(isolate, obj, *filter)) {
-        continue;
-      }
-      if (obj->IsJSGlobalObject()) {
-        obj = JSGlobalObject::cast(obj)->global_proxy();
-      }
-      instances.emplace_back(obj);
-      if (static_cast<int32_t>(instances.size()) == max_references) break;
-    }
-    // Iterate the rest of the heap to satisfy HeapIterator constraints.
-    while (iterator.next()) {
-    }
-  }
-
-  Handle<FixedArray> result;
-  if (instances.size() == 1 && instances.back().is_identical_to(target)) {
-    // Check for circular reference only. This can happen when the object is
-    // only referenced from mirrors and has a circular reference in which case
-    // the object is not really alive and would have been garbage collected if
-    // not referenced from the mirror.
-    result = isolate->factory()->empty_fixed_array();
-  } else {
-    int instances_size = static_cast<int>(instances.size());
-    result = isolate->factory()->NewFixedArray(instances_size);
-    for (int i = 0; i < instances_size; ++i) result->set(i, *instances[i]);
-  }
-  return *isolate->factory()->NewJSArrayWithElements(result);
-}
-
-
-// Scan the heap for objects constructed by a specific function.
-// args[0]: the constructor to find instances of
-// args[1]: the the maximum number of objects to return
-RUNTIME_FUNCTION(Runtime_DebugConstructedBy) {
-  HandleScope scope(isolate);
-  DCHECK_EQ(2, args.length());
-  CONVERT_ARG_HANDLE_CHECKED(JSFunction, constructor, 0);
-  CONVERT_NUMBER_CHECKED(int32_t, max_references, Int32, args[1]);
-  CHECK_GE(max_references, 0);
-
-  std::vector<Handle<JSObject>> instances;
-  Heap* heap = isolate->heap();
-  {
-    HeapIterator iterator(heap, HeapIterator::kFilterUnreachable);
-    HeapObject* heap_obj;
-    while ((heap_obj = iterator.next()) != nullptr) {
-      if (!heap_obj->IsJSObject()) continue;
-      JSObject* obj = JSObject::cast(heap_obj);
-      if (obj->map()->GetConstructor() != *constructor) continue;
-      instances.emplace_back(obj);
-      if (static_cast<int32_t>(instances.size()) == max_references) break;
-    }
-    // Iterate the rest of the heap to satisfy HeapIterator constraints.
-    while (iterator.next()) {
-    }
-  }
-
-  int instances_size = static_cast<int>(instances.size());
-  Handle<FixedArray> result = isolate->factory()->NewFixedArray(instances_size);
-  for (int i = 0; i < instances_size; ++i) result->set(i, *instances[i]);
-  return *isolate->factory()->NewJSArrayWithElements(result);
-}
-
-
-// Find the effective prototype object as returned by __proto__.
-// args[0]: the object to find the prototype for.
-RUNTIME_FUNCTION(Runtime_DebugGetPrototype) {
-  HandleScope shs(isolate);
-  DCHECK_EQ(1, args.length());
-  CONVERT_ARG_HANDLE_CHECKED(JSObject, obj, 0);
-  // TODO(1543): Come up with a solution for clients to handle potential errors
-  // thrown by an intermediate proxy.
-  RETURN_RESULT_OR_FAILURE(isolate, JSReceiver::GetPrototype(isolate, obj));
-}
-
-
-// Patches script source (should be called upon BeforeCompile event).
-// TODO(5530): Remove once uses in debug.js are gone.
-RUNTIME_FUNCTION(Runtime_DebugSetScriptSource) {
-  HandleScope scope(isolate);
-  DCHECK_EQ(2, args.length());
-
-  CONVERT_ARG_HANDLE_CHECKED(JSValue, script_wrapper, 0);
-  CONVERT_ARG_HANDLE_CHECKED(String, source, 1);
-
-  CHECK(script_wrapper->value()->IsScript());
-  Handle<Script> script(Script::cast(script_wrapper->value()));
-
-  // The following condition is not guaranteed to hold and a failure is also
-  // propagated to callers. Hence we fail gracefully here and don't crash.
-  if (script->compilation_state() != Script::COMPILATION_STATE_INITIAL) {
-    return isolate->ThrowIllegalOperation();
-  }
-
-  script->set_source(*source);
-
-  return isolate->heap()->undefined_value();
-}
-
 
 RUNTIME_FUNCTION(Runtime_FunctionGetInferredName) {
   SealHandleScope shs(isolate);
@@ -1363,41 +441,7 @@ RUNTIME_FUNCTION(Runtime_FunctionGetInferredName) {
   if (f->IsJSFunction()) {
     return JSFunction::cast(f)->shared()->inferred_name();
   }
-  return isolate->heap()->empty_string();
-}
-
-
-RUNTIME_FUNCTION(Runtime_FunctionGetDebugName) {
-  HandleScope scope(isolate);
-  DCHECK_EQ(1, args.length());
-
-  CONVERT_ARG_HANDLE_CHECKED(JSReceiver, function, 0);
-
-  if (function->IsJSBoundFunction()) {
-    RETURN_RESULT_OR_FAILURE(
-        isolate, JSBoundFunction::GetName(
-                     isolate, Handle<JSBoundFunction>::cast(function)));
-  } else {
-    return *JSFunction::GetDebugName(Handle<JSFunction>::cast(function));
-  }
-}
-
-
-RUNTIME_FUNCTION(Runtime_GetDebugContext) {
-  HandleScope scope(isolate);
-  DCHECK_EQ(0, args.length());
-  Handle<Context> context;
-  {
-    DebugScope debug_scope(isolate->debug());
-    if (debug_scope.failed()) {
-      DCHECK(isolate->has_pending_exception());
-      return isolate->heap()->exception();
-    }
-    context = isolate->debug()->GetDebugContext();
-  }
-  if (context.is_null()) return isolate->heap()->undefined_value();
-  context->set_security_token(isolate->native_context()->security_token());
-  return context->global_proxy();
+  return ReadOnlyRoots(isolate).empty_string();
 }
 
 
@@ -1408,7 +452,7 @@ RUNTIME_FUNCTION(Runtime_CollectGarbage) {
   DCHECK_EQ(1, args.length());
   isolate->heap()->CollectAllGarbage(Heap::kAbortIncrementalMarkingMask,
                                      GarbageCollectionReason::kRuntime);
-  return isolate->heap()->undefined_value();
+  return ReadOnlyRoots(isolate).undefined_value();
 }
 
 
@@ -1423,64 +467,13 @@ RUNTIME_FUNCTION(Runtime_GetHeapUsage) {
   return Smi::FromInt(usage);
 }
 
-
-// Finds the script object from the script data. NOTE: This operation uses
-// heap traversal to find the function generated for the source position
-// for the requested break point. For lazily compiled functions several heap
-// traversals might be required rendering this operation as a rather slow
-// operation. However for setting break points which is normally done through
-// some kind of user interaction the performance is not crucial.
-RUNTIME_FUNCTION(Runtime_GetScript) {
-  HandleScope scope(isolate);
-  DCHECK_EQ(1, args.length());
-  CONVERT_ARG_HANDLE_CHECKED(String, script_name, 0);
-
-  Handle<Script> found;
-  {
-    Script::Iterator iterator(isolate);
-    Script* script = nullptr;
-    while ((script = iterator.Next()) != nullptr) {
-      if (!script->name()->IsString()) continue;
-      String* name = String::cast(script->name());
-      if (name->Equals(*script_name)) {
-        found = Handle<Script>(script, isolate);
-        break;
-      }
-    }
-  }
-
-  if (found.is_null()) return isolate->heap()->undefined_value();
-  return *Script::GetWrapper(found);
-}
-
-// TODO(5530): Remove once uses in debug.js are gone.
-RUNTIME_FUNCTION(Runtime_ScriptLineCount) {
-  HandleScope scope(isolate);
-  DCHECK_EQ(1, args.length());
-  CONVERT_ARG_CHECKED(JSValue, script, 0);
-
-  CHECK(script->value()->IsScript());
-  Handle<Script> script_handle = Handle<Script>(Script::cast(script->value()));
-
-  if (script_handle->type() == Script::TYPE_WASM) {
-    // Return 0 for now; this function will disappear soon anyway.
-    return Smi::FromInt(0);
-  }
-
-  Script::InitLineEnds(script_handle);
-
-  FixedArray* line_ends_array = FixedArray::cast(script_handle->line_ends());
-  return Smi::FromInt(line_ends_array->length());
-}
-
 namespace {
 
 int ScriptLinePosition(Handle<Script> script, int line) {
   if (line < 0) return -1;
 
   if (script->type() == Script::TYPE_WASM) {
-    return WasmCompiledModule::cast(script->wasm_compiled_module())
-        ->shared()
+    return WasmModuleObject::cast(script->wasm_module_object())
         ->GetFunctionOffset(line);
   }
 
@@ -1496,11 +489,24 @@ int ScriptLinePosition(Handle<Script> script, int line) {
   return Smi::ToInt(line_ends_array->get(line - 1)) + 1;
 }
 
-}  // namespace
+int ScriptLinePositionWithOffset(Handle<Script> script, int line, int offset) {
+  if (line < 0 || offset < 0) return -1;
+
+  if (line == 0 || offset == 0)
+    return ScriptLinePosition(script, line) + offset;
+
+  Script::PositionInfo info;
+  if (!Script::GetPositionInfo(script, offset, &info, Script::NO_OFFSET)) {
+    return -1;
+  }
+
+  const int total_line = info.line + line;
+  return ScriptLinePosition(script, total_line);
+}
 
-static Handle<Object> GetJSPositionInfo(Handle<Script> script, int position,
-                                        Script::OffsetFlag offset_flag,
-                                        Isolate* isolate) {
+Handle<Object> GetJSPositionInfo(Handle<Script> script, int position,
+                                 Script::OffsetFlag offset_flag,
+                                 Isolate* isolate) {
   Script::PositionInfo info;
   if (!Script::GetPositionInfo(script, position, &info, offset_flag)) {
     return isolate->factory()->null_value();
@@ -1515,37 +521,21 @@ static Handle<Object> GetJSPositionInfo(Handle<Script> script, int position,
   Handle<JSObject> jsinfo =
       isolate->factory()->NewJSObject(isolate->object_function());
 
-  JSObject::AddProperty(jsinfo, isolate->factory()->script_string(), script,
-                        NONE);
-  JSObject::AddProperty(jsinfo, isolate->factory()->position_string(),
+  JSObject::AddProperty(isolate, jsinfo, isolate->factory()->script_string(),
+                        script, NONE);
+  JSObject::AddProperty(isolate, jsinfo, isolate->factory()->position_string(),
                         handle(Smi::FromInt(position), isolate), NONE);
-  JSObject::AddProperty(jsinfo, isolate->factory()->line_string(),
+  JSObject::AddProperty(isolate, jsinfo, isolate->factory()->line_string(),
                         handle(Smi::FromInt(info.line), isolate), NONE);
-  JSObject::AddProperty(jsinfo, isolate->factory()->column_string(),
+  JSObject::AddProperty(isolate, jsinfo, isolate->factory()->column_string(),
                         handle(Smi::FromInt(info.column), isolate), NONE);
-  JSObject::AddProperty(jsinfo, isolate->factory()->sourceText_string(),
-                        sourceText, NONE);
+  JSObject::AddProperty(isolate, jsinfo,
+                        isolate->factory()->sourceText_string(), sourceText,
+                        NONE);
 
   return jsinfo;
 }
 
-namespace {
-
-int ScriptLinePositionWithOffset(Handle<Script> script, int line, int offset) {
-  if (line < 0 || offset < 0) return -1;
-
-  if (line == 0 || offset == 0)
-    return ScriptLinePosition(script, line) + offset;
-
-  Script::PositionInfo info;
-  if (!Script::GetPositionInfo(script, offset, &info, Script::NO_OFFSET)) {
-    return -1;
-  }
-
-  const int total_line = info.line + line;
-  return ScriptLinePosition(script, total_line);
-}
-
 Handle<Object> ScriptLocationFromLine(Isolate* isolate, Handle<Script> script,
                                       Handle<Object> opt_line,
                                       Handle<Object> opt_column,
@@ -1579,7 +569,7 @@ bool GetScriptById(Isolate* isolate, int needle, Handle<Script>* result) {
   Script* script = nullptr;
   while ((script = iterator.Next()) != nullptr) {
     if (script->id() == needle) {
-      *result = handle(script);
+      *result = handle(script, isolate);
       return true;
     }
   }
@@ -1589,30 +579,6 @@ bool GetScriptById(Isolate* isolate, int needle, Handle<Script>* result) {
 
 }  // namespace
 
-// Get information on a specific source line and column possibly offset by a
-// fixed source position. This function is used to find a source position from
-// a line and column position. The fixed source position offset is typically
-// used to find a source position in a function based on a line and column in
-// the source for the function alone. The offset passed will then be the
-// start position of the source for the function within the full script source.
-// Note that incoming line and column parameters may be undefined, and are
-// assumed to be passed *with* offsets.
-// TODO(5530): Remove once uses in debug.js are gone.
-RUNTIME_FUNCTION(Runtime_ScriptLocationFromLine) {
-  HandleScope scope(isolate);
-  DCHECK_EQ(4, args.length());
-  CONVERT_ARG_HANDLE_CHECKED(JSValue, script, 0);
-  CONVERT_ARG_HANDLE_CHECKED(Object, opt_line, 1);
-  CONVERT_ARG_HANDLE_CHECKED(Object, opt_column, 2);
-  CONVERT_NUMBER_CHECKED(int32_t, offset, Int32, args[3]);
-
-  CHECK(script->value()->IsScript());
-  Handle<Script> script_handle = Handle<Script>(Script::cast(script->value()));
-
-  return *ScriptLocationFromLine(isolate, script_handle, opt_line, opt_column,
-                                 offset);
-}
-
 // TODO(5530): Rename once conflicting function has been deleted.
 RUNTIME_FUNCTION(Runtime_ScriptLocationFromLine2) {
   HandleScope scope(isolate);
@@ -1628,56 +594,27 @@ RUNTIME_FUNCTION(Runtime_ScriptLocationFromLine2) {
   return *ScriptLocationFromLine(isolate, script, opt_line, opt_column, offset);
 }
 
-// TODO(5530): Remove once uses in debug.js are gone.
-RUNTIME_FUNCTION(Runtime_ScriptPositionInfo) {
-  HandleScope scope(isolate);
-  DCHECK_EQ(3, args.length());
-  CONVERT_ARG_CHECKED(JSValue, script, 0);
-  CONVERT_NUMBER_CHECKED(int32_t, position, Int32, args[1]);
-  CONVERT_BOOLEAN_ARG_CHECKED(with_offset, 2);
-
-  CHECK(script->value()->IsScript());
-  Handle<Script> script_handle = Handle<Script>(Script::cast(script->value()));
-
-  const Script::OffsetFlag offset_flag =
-      with_offset ? Script::WITH_OFFSET : Script::NO_OFFSET;
-  return *GetJSPositionInfo(script_handle, position, offset_flag, isolate);
-}
-
-// TODO(5530): Rename once conflicting function has been deleted.
-RUNTIME_FUNCTION(Runtime_ScriptPositionInfo2) {
-  HandleScope scope(isolate);
-  DCHECK_EQ(3, args.length());
-  CONVERT_NUMBER_CHECKED(int32_t, scriptid, Int32, args[0]);
-  CONVERT_NUMBER_CHECKED(int32_t, position, Int32, args[1]);
-  CONVERT_BOOLEAN_ARG_CHECKED(with_offset, 2);
-
-  Handle<Script> script;
-  CHECK(GetScriptById(isolate, scriptid, &script));
-
-  const Script::OffsetFlag offset_flag =
-      with_offset ? Script::WITH_OFFSET : Script::NO_OFFSET;
-  return *GetJSPositionInfo(script, position, offset_flag, isolate);
-}
-
 // On function call, depending on circumstances, prepare for stepping in,
 // or perform a side effect check.
 RUNTIME_FUNCTION(Runtime_DebugOnFunctionCall) {
   HandleScope scope(isolate);
-  DCHECK_EQ(1, args.length());
+  DCHECK_EQ(2, args.length());
   CONVERT_ARG_HANDLE_CHECKED(JSFunction, fun, 0);
+  CONVERT_ARG_HANDLE_CHECKED(Object, receiver, 1);
   if (isolate->debug()->needs_check_on_function_call()) {
     // Ensure that the callee will perform debug check on function call too.
     Deoptimizer::DeoptimizeFunction(*fun);
-    if (isolate->debug()->last_step_action() >= StepIn) {
+    if (isolate->debug()->last_step_action() >= StepIn ||
+        isolate->debug()->break_on_next_function_call()) {
+      DCHECK_EQ(isolate->debug_execution_mode(), DebugInfo::kBreakpoints);
       isolate->debug()->PrepareStepIn(fun);
     }
     if (isolate->debug_execution_mode() == DebugInfo::kSideEffects &&
-        !isolate->debug()->PerformSideEffectCheck(fun)) {
-      return isolate->heap()->exception();
+        !isolate->debug()->PerformSideEffectCheck(fun, receiver)) {
+      return ReadOnlyRoots(isolate).exception();
     }
   }
-  return isolate->heap()->undefined_value();
+  return ReadOnlyRoots(isolate).undefined_value();
 }
 
 // Set one shot breakpoints for the suspended generator object.
@@ -1685,7 +622,7 @@ RUNTIME_FUNCTION(Runtime_DebugPrepareStepInSuspendedGenerator) {
   HandleScope scope(isolate);
   DCHECK_EQ(0, args.length());
   isolate->debug()->PrepareStepInSuspendedGenerator();
-  return isolate->heap()->undefined_value();
+  return ReadOnlyRoots(isolate).undefined_value();
 }
 
 RUNTIME_FUNCTION(Runtime_DebugPushPromise) {
@@ -1693,7 +630,7 @@ RUNTIME_FUNCTION(Runtime_DebugPushPromise) {
   HandleScope scope(isolate);
   CONVERT_ARG_HANDLE_CHECKED(JSObject, promise, 0);
   isolate->PushPromise(promise);
-  return isolate->heap()->undefined_value();
+  return ReadOnlyRoots(isolate).undefined_value();
 }
 
 
@@ -1701,22 +638,7 @@ RUNTIME_FUNCTION(Runtime_DebugPopPromise) {
   DCHECK_EQ(0, args.length());
   SealHandleScope shs(isolate);
   isolate->PopPromise();
-  return isolate->heap()->undefined_value();
-}
-
-RUNTIME_FUNCTION(Runtime_DebugAsyncFunctionPromiseCreated) {
-  DCHECK_EQ(1, args.length());
-  HandleScope scope(isolate);
-  CONVERT_ARG_HANDLE_CHECKED(JSObject, promise, 0);
-  isolate->PushPromise(promise);
-  int id = isolate->debug()->NextAsyncTaskId(promise);
-  Handle<Symbol> async_stack_id_symbol =
-      isolate->factory()->promise_async_stack_id_symbol();
-  JSObject::SetProperty(promise, async_stack_id_symbol,
-                        handle(Smi::FromInt(id), isolate),
-                        LanguageMode::kStrict)
-      .Assert();
-  return isolate->heap()->undefined_value();
+  return ReadOnlyRoots(isolate).undefined_value();
 }
 
 RUNTIME_FUNCTION(Runtime_DebugIsActive) {
@@ -1733,11 +655,11 @@ Handle<JSObject> MakeRangeObject(Isolate* isolate, const CoverageBlock& range) {
   Handle<String> count_string = factory->InternalizeUtf8String("count");
 
   Handle<JSObject> range_obj = factory->NewJSObjectWithNullProto();
-  JSObject::AddProperty(range_obj, start_string,
+  JSObject::AddProperty(isolate, range_obj, start_string,
                         factory->NewNumberFromInt(range.start), NONE);
-  JSObject::AddProperty(range_obj, end_string,
+  JSObject::AddProperty(isolate, range_obj, end_string,
                         factory->NewNumberFromInt(range.end), NONE);
-  JSObject::AddProperty(range_obj, count_string,
+  JSObject::AddProperty(isolate, range_obj, count_string,
                         factory->NewNumberFromUint(range.count), NONE);
 
   return range_obj;
@@ -1786,8 +708,8 @@ RUNTIME_FUNCTION(Runtime_DebugCollectCoverage) {
 
     Handle<JSArray> script_obj =
         factory->NewJSArrayWithElements(ranges_array, PACKED_ELEMENTS);
-    Handle<JSObject> wrapper = Script::GetWrapper(script_data.script);
-    JSObject::AddProperty(script_obj, script_string, wrapper, NONE);
+    JSObject::AddProperty(isolate, script_obj, script_string,
+                          handle(script_data.script->source(), isolate), NONE);
     scripts_array->set(i, *script_obj);
   }
   return *factory->NewJSArrayWithElements(scripts_array, PACKED_ELEMENTS);
@@ -1798,7 +720,7 @@ RUNTIME_FUNCTION(Runtime_DebugTogglePreciseCoverage) {
   CONVERT_BOOLEAN_ARG_CHECKED(enable, 0);
   Coverage::SelectMode(isolate, enable ? debug::Coverage::kPreciseCount
                                        : debug::Coverage::kBestEffort);
-  return isolate->heap()->undefined_value();
+  return ReadOnlyRoots(isolate).undefined_value();
 }
 
 RUNTIME_FUNCTION(Runtime_DebugToggleBlockCoverage) {
@@ -1806,7 +728,7 @@ RUNTIME_FUNCTION(Runtime_DebugToggleBlockCoverage) {
   CONVERT_BOOLEAN_ARG_CHECKED(enable, 0);
   Coverage::SelectMode(isolate, enable ? debug::Coverage::kBlockCount
                                        : debug::Coverage::kBestEffort);
-  return isolate->heap()->undefined_value();
+  return ReadOnlyRoots(isolate).undefined_value();
 }
 
 RUNTIME_FUNCTION(Runtime_IncBlockCounter) {
@@ -1826,8 +748,67 @@ RUNTIME_FUNCTION(Runtime_IncBlockCounter) {
     coverage_info->IncrementBlockCount(coverage_array_slot_index);
   }
 
-  return isolate->heap()->undefined_value();
+  return ReadOnlyRoots(isolate).undefined_value();
 }
 
+RUNTIME_FUNCTION(Runtime_DebugAsyncFunctionSuspended) {
+  DCHECK_EQ(1, args.length());
+  HandleScope scope(isolate);
+  CONVERT_ARG_HANDLE_CHECKED(JSPromise, promise, 0);
+  isolate->OnAsyncFunctionStateChanged(promise, debug::kAsyncFunctionSuspended);
+  return ReadOnlyRoots(isolate).undefined_value();
+}
+
+RUNTIME_FUNCTION(Runtime_DebugAsyncFunctionFinished) {
+  DCHECK_EQ(2, args.length());
+  HandleScope scope(isolate);
+  CONVERT_BOOLEAN_ARG_CHECKED(has_suspend, 0);
+  CONVERT_ARG_HANDLE_CHECKED(JSPromise, promise, 1);
+  isolate->PopPromise();
+  if (has_suspend) {
+    isolate->OnAsyncFunctionStateChanged(promise,
+                                         debug::kAsyncFunctionFinished);
+  }
+  return ReadOnlyRoots(isolate).undefined_value();
+}
+
+RUNTIME_FUNCTION(Runtime_LiveEditPatchScript) {
+  HandleScope scope(isolate);
+  DCHECK_EQ(2, args.length());
+  CONVERT_ARG_HANDLE_CHECKED(JSFunction, script_function, 0);
+  CONVERT_ARG_HANDLE_CHECKED(String, new_source, 1);
+
+  Handle<Script> script(Script::cast(script_function->shared()->script()),
+                        isolate);
+  v8::debug::LiveEditResult result;
+  LiveEdit::PatchScript(isolate, script, new_source, false, &result);
+  switch (result.status) {
+    case v8::debug::LiveEditResult::COMPILE_ERROR:
+      return isolate->Throw(*isolate->factory()->NewStringFromAsciiChecked(
+          "LiveEdit failed: COMPILE_ERROR"));
+    case v8::debug::LiveEditResult::BLOCKED_BY_RUNNING_GENERATOR:
+      return isolate->Throw(*isolate->factory()->NewStringFromAsciiChecked(
+          "LiveEdit failed: BLOCKED_BY_RUNNING_GENERATOR"));
+    case v8::debug::LiveEditResult::BLOCKED_BY_FUNCTION_ABOVE_BREAK_FRAME:
+      return isolate->Throw(*isolate->factory()->NewStringFromAsciiChecked(
+          "LiveEdit failed: BLOCKED_BY_FUNCTION_ABOVE_BREAK_FRAME"));
+    case v8::debug::LiveEditResult::
+        BLOCKED_BY_FUNCTION_BELOW_NON_DROPPABLE_FRAME:
+      return isolate->Throw(*isolate->factory()->NewStringFromAsciiChecked(
+          "LiveEdit failed: BLOCKED_BY_FUNCTION_BELOW_NON_DROPPABLE_FRAME"));
+    case v8::debug::LiveEditResult::BLOCKED_BY_ACTIVE_FUNCTION:
+      return isolate->Throw(*isolate->factory()->NewStringFromAsciiChecked(
+          "LiveEdit failed: BLOCKED_BY_ACTIVE_FUNCTION"));
+    case v8::debug::LiveEditResult::BLOCKED_BY_NEW_TARGET_IN_RESTART_FRAME:
+      return isolate->Throw(*isolate->factory()->NewStringFromAsciiChecked(
+          "LiveEdit failed: BLOCKED_BY_NEW_TARGET_IN_RESTART_FRAME"));
+    case v8::debug::LiveEditResult::FRAME_RESTART_IS_NOT_SUPPORTED:
+      return isolate->Throw(*isolate->factory()->NewStringFromAsciiChecked(
+          "LiveEdit failed: FRAME_RESTART_IS_NOT_SUPPORTED"));
+    case v8::debug::LiveEditResult::OK:
+      return ReadOnlyRoots(isolate).undefined_value();
+  }
+  return ReadOnlyRoots(isolate).undefined_value();
+}
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/src/runtime/runtime-error.cc b/deps/v8/src/runtime/runtime-error.cc
deleted file mode 100644
index 7cd98f223b90cb..00000000000000
--- a/deps/v8/src/runtime/runtime-error.cc
+++ /dev/null
@@ -1,30 +0,0 @@
-// Copyright 2016 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "src/runtime/runtime-utils.h"
-
-#include "src/arguments.h"
-#include "src/base/platform/time.h"
-#include "src/conversions-inl.h"
-#include "src/futex-emulation.h"
-#include "src/globals.h"
-
-namespace v8 {
-namespace internal {
-
-RUNTIME_FUNCTION(Runtime_ErrorToString) {
-  HandleScope scope(isolate);
-  DCHECK_EQ(1, args.length());
-  CONVERT_ARG_HANDLE_CHECKED(Object, recv, 0);
-  RETURN_RESULT_OR_FAILURE(isolate, ErrorUtils::ToString(isolate, recv));
-}
-
-RUNTIME_FUNCTION(Runtime_IsJSError) {
-  SealHandleScope shs(isolate);
-  DCHECK_EQ(1, args.length());
-  return isolate->heap()->ToBoolean(args[0]->IsJSError());
-}
-
-}  // namespace internal
-}  // namespace v8
diff --git a/deps/v8/src/runtime/runtime-forin.cc b/deps/v8/src/runtime/runtime-forin.cc
index 9193daf9dbd9e3..5df16faf46faca 100644
--- a/deps/v8/src/runtime/runtime-forin.cc
+++ b/deps/v8/src/runtime/runtime-forin.cc
@@ -10,6 +10,7 @@
 #include "src/isolate-inl.h"
 #include "src/keys.h"
 #include "src/objects-inl.h"
+#include "src/objects/module.h"
 
 namespace v8 {
 namespace internal {
@@ -20,8 +21,8 @@ namespace {
 // that contains all enumerable properties of the {receiver} and its prototypes
 // have none, the map of the {receiver}. This is used to speed up the check for
 // deletions during a for-in.
-MaybeHandle<HeapObject> Enumerate(Handle<JSReceiver> receiver) {
-  Isolate* const isolate = receiver->GetIsolate();
+MaybeHandle<HeapObject> Enumerate(Isolate* isolate,
+                                  Handle<JSReceiver> receiver) {
   JSObject::MakePrototypesFast(receiver, kStartAtReceiver, isolate);
   FastKeyAccumulator accumulator(isolate, receiver,
                                  KeyCollectionMode::kIncludePrototypes,
@@ -115,7 +116,7 @@ RUNTIME_FUNCTION(Runtime_ForInEnumerate) {
   HandleScope scope(isolate);
   DCHECK_EQ(1, args.length());
   CONVERT_ARG_HANDLE_CHECKED(JSReceiver, receiver, 0);
-  RETURN_RESULT_OR_FAILURE(isolate, Enumerate(receiver));
+  RETURN_RESULT_OR_FAILURE(isolate, Enumerate(isolate, receiver));
 }
 
 
diff --git a/deps/v8/src/runtime/runtime-function.cc b/deps/v8/src/runtime/runtime-function.cc
index 9f1cbc00e998b7..7199263e539613 100644
--- a/deps/v8/src/runtime/runtime-function.cc
+++ b/deps/v8/src/runtime/runtime-function.cc
@@ -28,7 +28,7 @@ RUNTIME_FUNCTION(Runtime_FunctionGetName) {
 }
 
 // TODO(5530): Remove once uses in debug.js are gone.
-RUNTIME_FUNCTION(Runtime_FunctionGetScript) {
+RUNTIME_FUNCTION(Runtime_FunctionGetScriptSource) {
   HandleScope scope(isolate);
   DCHECK_EQ(1, args.length());
   CONVERT_ARG_HANDLE_CHECKED(JSReceiver, function, 0);
@@ -36,11 +36,9 @@ RUNTIME_FUNCTION(Runtime_FunctionGetScript) {
   if (function->IsJSFunction()) {
     Handle<Object> script(
         Handle<JSFunction>::cast(function)->shared()->script(), isolate);
-    if (script->IsScript()) {
-      return *Script::GetWrapper(Handle<Script>::cast(script));
-    }
+    if (script->IsScript()) return Handle<Script>::cast(script)->source();
   }
-  return isolate->heap()->undefined_value();
+  return ReadOnlyRoots(isolate).undefined_value();
 }
 
 RUNTIME_FUNCTION(Runtime_FunctionGetScriptId) {
@@ -64,10 +62,10 @@ RUNTIME_FUNCTION(Runtime_FunctionGetSourceCode) {
   CONVERT_ARG_HANDLE_CHECKED(JSReceiver, function, 0);
   if (function->IsJSFunction()) {
     Handle<SharedFunctionInfo> shared(
-        Handle<JSFunction>::cast(function)->shared());
+        Handle<JSFunction>::cast(function)->shared(), isolate);
     return *SharedFunctionInfo::GetSourceCode(shared);
   }
-  return isolate->heap()->undefined_value();
+  return ReadOnlyRoots(isolate).undefined_value();
 }
 
 
@@ -80,13 +78,6 @@ RUNTIME_FUNCTION(Runtime_FunctionGetScriptSourcePosition) {
   return Smi::FromInt(pos);
 }
 
-RUNTIME_FUNCTION(Runtime_FunctionGetContextData) {
-  SealHandleScope shs(isolate);
-  DCHECK_EQ(1, args.length());
-
-  CONVERT_ARG_CHECKED(JSFunction, fun, 0);
-  return fun->native_context()->debug_context_id();
-}
 
 RUNTIME_FUNCTION(Runtime_FunctionIsAPIFunction) {
   SealHandleScope shs(isolate);
@@ -104,12 +95,12 @@ RUNTIME_FUNCTION(Runtime_SetCode) {
   CONVERT_ARG_HANDLE_CHECKED(JSFunction, target, 0);
   CONVERT_ARG_HANDLE_CHECKED(JSFunction, source, 1);
 
-  Handle<SharedFunctionInfo> target_shared(target->shared());
-  Handle<SharedFunctionInfo> source_shared(source->shared());
+  Handle<SharedFunctionInfo> target_shared(target->shared(), isolate);
+  Handle<SharedFunctionInfo> source_shared(source->shared(), isolate);
 
   if (!source->is_compiled() &&
       !Compiler::Compile(source, Compiler::KEEP_EXCEPTION)) {
-    return isolate->heap()->exception();
+    return ReadOnlyRoots(isolate).exception();
   }
 
   // Set the function data, scope info, formal parameter count, and the length
@@ -120,9 +111,6 @@ RUNTIME_FUNCTION(Runtime_SetCode) {
       source_shared->raw_outer_scope_info_or_feedback_metadata());
   target_shared->set_internal_formal_parameter_count(
       source_shared->internal_formal_parameter_count());
-  target_shared->set_raw_start_position_and_type(
-      source_shared->raw_start_position_and_type());
-  target_shared->set_raw_end_position(source_shared->raw_end_position());
   bool was_native = target_shared->native();
   target_shared->set_flags(source_shared->flags());
   target_shared->set_native(was_native);
@@ -139,7 +127,7 @@ RUNTIME_FUNCTION(Runtime_SetCode) {
 
   // Set the code of the target function.
   target->set_code(source_shared->GetCode());
-  Handle<Context> context(source->context());
+  Handle<Context> context(source->context(), isolate);
   target->set_context(*context);
 
   // Make sure we get a fresh copy of the feedback vector to avoid cross
@@ -150,7 +138,7 @@ RUNTIME_FUNCTION(Runtime_SetCode) {
   if (isolate->logger()->is_listening_to_code_events() ||
       isolate->is_profiling()) {
     isolate->logger()->LogExistingFunction(
-        source_shared, Handle<AbstractCode>(source_shared->abstract_code()));
+        source_shared, handle(source_shared->abstract_code(), isolate));
   }
 
   return *target;
@@ -170,7 +158,7 @@ RUNTIME_FUNCTION(Runtime_SetNativeFlag) {
     JSFunction* func = JSFunction::cast(object);
     func->shared()->set_native(true);
   }
-  return isolate->heap()->undefined_value();
+  return ReadOnlyRoots(isolate).undefined_value();
 }
 
 
@@ -205,15 +193,5 @@ RUNTIME_FUNCTION(Runtime_IsFunction) {
 }
 
 
-RUNTIME_FUNCTION(Runtime_FunctionToString) {
-  HandleScope scope(isolate);
-  DCHECK_EQ(1, args.length());
-  CONVERT_ARG_HANDLE_CHECKED(JSReceiver, function, 0);
-  return function->IsJSBoundFunction()
-             ? *JSBoundFunction::ToString(
-                   Handle<JSBoundFunction>::cast(function))
-             : *JSFunction::ToString(Handle<JSFunction>::cast(function));
-}
-
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/src/runtime/runtime-futex.cc b/deps/v8/src/runtime/runtime-futex.cc
index 5c2106e6859c4e..96f538e4f3755d 100644
--- a/deps/v8/src/runtime/runtime-futex.cc
+++ b/deps/v8/src/runtime/runtime-futex.cc
@@ -39,7 +39,7 @@ RUNTIME_FUNCTION(Runtime_SetAllowAtomicsWait) {
   CONVERT_BOOLEAN_ARG_CHECKED(set, 0);
 
   isolate->set_allow_atomics_wait(set);
-  return isolate->heap()->undefined_value();
+  return ReadOnlyRoots(isolate).undefined_value();
 }
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/src/runtime/runtime-generator.cc b/deps/v8/src/runtime/runtime-generator.cc
index 3c7c808c30b66a..02068ec7a9d17e 100644
--- a/deps/v8/src/runtime/runtime-generator.cc
+++ b/deps/v8/src/runtime/runtime-generator.cc
@@ -11,12 +11,6 @@
 namespace v8 {
 namespace internal {
 
-RUNTIME_FUNCTION(Runtime_IsJSGeneratorObject) {
-  SealHandleScope shs(isolate);
-  DCHECK_EQ(1, args.length());
-  return isolate->heap()->ToBoolean(args[0]->IsJSGeneratorObject());
-}
-
 RUNTIME_FUNCTION(Runtime_CreateJSGeneratorObject) {
   HandleScope scope(isolate);
   DCHECK_EQ(2, args.length());
@@ -26,15 +20,17 @@ RUNTIME_FUNCTION(Runtime_CreateJSGeneratorObject) {
 
   // Underlying function needs to have bytecode available.
   DCHECK(function->shared()->HasBytecodeArray());
-  int size = function->shared()->GetBytecodeArray()->register_count();
-  Handle<FixedArray> register_file = isolate->factory()->NewFixedArray(size);
+  int size = function->shared()->internal_formal_parameter_count() +
+             function->shared()->GetBytecodeArray()->register_count();
+  Handle<FixedArray> parameters_and_registers =
+      isolate->factory()->NewFixedArray(size);
 
   Handle<JSGeneratorObject> generator =
       isolate->factory()->NewJSGeneratorObject(function);
   generator->set_function(*function);
   generator->set_context(isolate->context());
   generator->set_receiver(*receiver);
-  generator->set_register_file(*register_file);
+  generator->set_parameters_and_registers(*parameters_and_registers);
   generator->set_continuation(JSGeneratorObject::kGeneratorExecuting);
   if (generator->IsJSAsyncGeneratorObject()) {
     Handle<JSAsyncGeneratorObject>::cast(generator)->set_is_awaiting(0);
@@ -56,14 +52,6 @@ RUNTIME_FUNCTION(Runtime_GeneratorGetFunction) {
   return generator->function();
 }
 
-RUNTIME_FUNCTION(Runtime_GeneratorGetReceiver) {
-  HandleScope scope(isolate);
-  DCHECK_EQ(1, args.length());
-  CONVERT_ARG_HANDLE_CHECKED(JSGeneratorObject, generator, 0);
-
-  return generator->receiver();
-}
-
 RUNTIME_FUNCTION(Runtime_GeneratorGetInputOrDebugPos) {
   // Runtime call is implemented in InterpreterIntrinsics and lowered in
   // JSIntrinsicLowering
@@ -94,23 +82,6 @@ RUNTIME_FUNCTION(Runtime_GeneratorGetResumeMode) {
   UNREACHABLE();
 }
 
-RUNTIME_FUNCTION(Runtime_GeneratorGetContinuation) {
-  HandleScope scope(isolate);
-  DCHECK_EQ(1, args.length());
-  CONVERT_ARG_HANDLE_CHECKED(JSGeneratorObject, generator, 0);
-
-  return Smi::FromInt(generator->continuation());
-}
-
-RUNTIME_FUNCTION(Runtime_GeneratorGetSourcePosition) {
-  HandleScope scope(isolate);
-  DCHECK_EQ(1, args.length());
-  CONVERT_ARG_HANDLE_CHECKED(JSGeneratorObject, generator, 0);
-
-  if (!generator->is_suspended()) return isolate->heap()->undefined_value();
-  return Smi::FromInt(generator->source_position());
-}
-
 // Return true if {generator}'s PC has a catch handler. This allows
 // catch prediction to happen from the AsyncGeneratorResumeNext stub.
 RUNTIME_FUNCTION(Runtime_AsyncGeneratorHasCatchHandlerForPC) {
@@ -125,7 +96,7 @@ RUNTIME_FUNCTION(Runtime_AsyncGeneratorHasCatchHandlerForPC) {
   // If state is 0 ("suspendedStart"), there is guaranteed to be no catch
   // handler. Otherwise, if state is below 0, the generator is closed and will
   // not reach a catch handler.
-  if (state < 1) return isolate->heap()->false_value();
+  if (state < 1) return ReadOnlyRoots(isolate).false_value();
 
   SharedFunctionInfo* shared = generator->function()->shared();
   DCHECK(shared->HasBytecodeArray());
diff --git a/deps/v8/src/runtime/runtime-internal.cc b/deps/v8/src/runtime/runtime-internal.cc
index c5a693448b6050..c5ad02efe3d510 100644
--- a/deps/v8/src/runtime/runtime-internal.cc
+++ b/deps/v8/src/runtime/runtime-internal.cc
@@ -27,13 +27,7 @@ RUNTIME_FUNCTION(Runtime_CheckIsBootstrapping) {
   SealHandleScope shs(isolate);
   DCHECK_EQ(0, args.length());
   CHECK(isolate->bootstrapper()->IsActive());
-  return isolate->heap()->undefined_value();
-}
-
-RUNTIME_FUNCTION(Runtime_IsScriptWrapper) {
-  SealHandleScope shs(isolate);
-  DCHECK_EQ(1, args.length());
-  return isolate->heap()->ToBoolean(args[0]->IsScriptWrapper());
+  return ReadOnlyRoots(isolate).undefined_value();
 }
 
 RUNTIME_FUNCTION(Runtime_ExportFromRuntime) {
@@ -55,13 +49,13 @@ RUNTIME_FUNCTION(Runtime_InstallToContext) {
   CHECK(array->HasFastElements());
   CHECK(isolate->bootstrapper()->IsActive());
   Handle<Context> native_context = isolate->native_context();
-  Handle<FixedArray> fixed_array(FixedArray::cast(array->elements()));
+  Handle<FixedArray> fixed_array(FixedArray::cast(array->elements()), isolate);
   int length = Smi::ToInt(array->length());
   for (int i = 0; i < length; i += 2) {
     CHECK(fixed_array->get(i)->IsString());
-    Handle<String> name(String::cast(fixed_array->get(i)));
+    Handle<String> name(String::cast(fixed_array->get(i)), isolate);
     CHECK(fixed_array->get(i + 1)->IsJSObject());
-    Handle<JSObject> object(JSObject::cast(fixed_array->get(i + 1)));
+    Handle<JSObject> object(JSObject::cast(fixed_array->get(i + 1)), isolate);
     int index = Context::ImportedFieldIndexForName(name);
     if (index == Context::kNotFound) {
       index = Context::IntrinsicIndexForName(name);
@@ -69,7 +63,7 @@ RUNTIME_FUNCTION(Runtime_InstallToContext) {
     CHECK_NE(index, Context::kNotFound);
     native_context->set(index, *object);
   }
-  return isolate->heap()->undefined_value();
+  return ReadOnlyRoots(isolate).undefined_value();
 }
 
 RUNTIME_FUNCTION(Runtime_Throw) {
@@ -303,7 +297,7 @@ RUNTIME_FUNCTION(Runtime_AllocateSeqOneByteString) {
   HandleScope scope(isolate);
   DCHECK_EQ(1, args.length());
   CONVERT_SMI_ARG_CHECKED(length, 0);
-  if (length == 0) return isolate->heap()->empty_string();
+  if (length == 0) return ReadOnlyRoots(isolate).empty_string();
   Handle<SeqOneByteString> result;
   ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
       isolate, result, isolate->factory()->NewRawOneByteString(length));
@@ -314,7 +308,7 @@ RUNTIME_FUNCTION(Runtime_AllocateSeqTwoByteString) {
   HandleScope scope(isolate);
   DCHECK_EQ(1, args.length());
   CONVERT_SMI_ARG_CHECKED(length, 0);
-  if (length == 0) return isolate->heap()->empty_string();
+  if (length == 0) return ReadOnlyRoots(isolate).empty_string();
   Handle<SeqTwoByteString> result;
   ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
       isolate, result, isolate->factory()->NewRawTwoByteString(length));
@@ -336,7 +330,7 @@ bool ComputeLocation(Isolate* isolate, MessageLocation* target) {
     std::vector<FrameSummary> frames;
     it.frame()->Summarize(&frames);
     auto& summary = frames.back().AsJavaScript();
-    Handle<SharedFunctionInfo> shared(summary.function()->shared());
+    Handle<SharedFunctionInfo> shared(summary.function()->shared(), isolate);
     Handle<Object> script(shared->script(), isolate);
     int pos = summary.abstract_code()->SourcePosition(summary.code_offset());
     if (script->IsScript() &&
@@ -353,7 +347,7 @@ Handle<String> RenderCallSite(Isolate* isolate, Handle<Object> object,
                               CallPrinter::ErrorHint* hint) {
   MessageLocation location;
   if (ComputeLocation(isolate, &location)) {
-    ParseInfo info(location.shared());
+    ParseInfo info(isolate, location.shared());
     if (parsing::ParseAny(&info, location.shared(), isolate)) {
       info.ast_value_factory()->Internalize(isolate);
       CallPrinter printer(isolate, location.shared()->IsUserJavaScript());
@@ -430,11 +424,6 @@ RUNTIME_FUNCTION(Runtime_ThrowConstructedNonConstructable) {
 RUNTIME_FUNCTION(Runtime_ThrowConstructorReturnedNonObject) {
   HandleScope scope(isolate);
   DCHECK_EQ(0, args.length());
-  if (FLAG_harmony_restrict_constructor_return) {
-    THROW_NEW_ERROR_RETURN_FAILURE(
-        isolate,
-        NewTypeError(MessageTemplate::kClassConstructorReturnedNonObject));
-  }
 
   THROW_NEW_ERROR_RETURN_FAILURE(
       isolate,
@@ -482,16 +471,7 @@ RUNTIME_FUNCTION(Runtime_IncrementUseCounter) {
   DCHECK_EQ(1, args.length());
   CONVERT_SMI_ARG_CHECKED(counter, 0);
   isolate->CountUsage(static_cast<v8::Isolate::UseCounterFeature>(counter));
-  return isolate->heap()->undefined_value();
-}
-
-RUNTIME_FUNCTION(
-    Runtime_IncrementUseCounterConstructorReturnNonUndefinedPrimitive) {
-  HandleScope scope(isolate);
-  DCHECK_EQ(0, args.length());
-  isolate->CountUsage(
-      v8::Isolate::UseCounterFeature::kConstructorNonUndefinedPrimitiveReturn);
-  return isolate->heap()->undefined_value();
+  return ReadOnlyRoots(isolate).undefined_value();
 }
 
 RUNTIME_FUNCTION(Runtime_GetAndResetRuntimeCallStats) {
@@ -536,7 +516,7 @@ RUNTIME_FUNCTION(Runtime_GetAndResetRuntimeCallStats) {
       std::fclose(f);
     else
       std::fflush(f);
-    return isolate->heap()->undefined_value();
+    return ReadOnlyRoots(isolate).undefined_value();
   }
 }
 
@@ -590,7 +570,7 @@ RUNTIME_FUNCTION(Runtime_CreateTemplateObject) {
   DCHECK_EQ(1, args.length());
   CONVERT_ARG_HANDLE_CHECKED(TemplateObjectDescription, description, 0);
 
-  return *TemplateObjectDescription::CreateTemplateObject(description);
+  return *TemplateObjectDescription::CreateTemplateObject(isolate, description);
 }
 
 RUNTIME_FUNCTION(Runtime_ReportMessage) {
@@ -607,7 +587,7 @@ RUNTIME_FUNCTION(Runtime_ReportMessage) {
   isolate->set_pending_exception(*message_obj);
   isolate->ReportPendingMessagesFromJavaScript();
   isolate->clear_pending_exception();
-  return isolate->heap()->undefined_value();
+  return ReadOnlyRoots(isolate).undefined_value();
 }
 
 }  // namespace internal
diff --git a/deps/v8/src/runtime/runtime-interpreter.cc b/deps/v8/src/runtime/runtime-interpreter.cc
index 836bf4d5f6b86a..bc48bb4ab751b3 100644
--- a/deps/v8/src/runtime/runtime-interpreter.cc
+++ b/deps/v8/src/runtime/runtime-interpreter.cc
@@ -58,7 +58,7 @@ void AdvanceToOffsetForTracing(
               interpreter::OperandScale::kSingle));
 }
 
-void PrintRegisters(std::ostream& os, bool is_input,
+void PrintRegisters(Isolate* isolate, std::ostream& os, bool is_input,
                     interpreter::BytecodeArrayIterator& bytecode_iterator,
                     Handle<Object> accumulator) {
   static const char kAccumulator[] = "accumulator";
@@ -82,8 +82,7 @@ void PrintRegisters(std::ostream& os, bool is_input,
   }
 
   // Print the registers.
-  JavaScriptFrameIterator frame_iterator(
-      bytecode_iterator.bytecode_array()->GetIsolate());
+  JavaScriptFrameIterator frame_iterator(isolate);
   InterpretedFrame* frame =
       reinterpret_cast<InterpretedFrame*>(frame_iterator.frame());
   int operand_count = interpreter::Bytecodes::NumberOfOperands(bytecode);
@@ -119,7 +118,7 @@ void PrintRegisters(std::ostream& os, bool is_input,
 
 RUNTIME_FUNCTION(Runtime_InterpreterTraceBytecodeEntry) {
   if (!FLAG_trace_ignition) {
-    return isolate->heap()->undefined_value();
+    return ReadOnlyRoots(isolate).undefined_value();
   }
 
   SealHandleScope shs(isolate);
@@ -132,10 +131,11 @@ RUNTIME_FUNCTION(Runtime_InterpreterTraceBytecodeEntry) {
   interpreter::BytecodeArrayIterator bytecode_iterator(bytecode_array);
   AdvanceToOffsetForTracing(bytecode_iterator, offset);
   if (offset == bytecode_iterator.current_offset()) {
-    OFStream os(stdout);
+    StdoutStream os;
 
     // Print bytecode.
-    const uint8_t* base_address = bytecode_array->GetFirstBytecodeAddress();
+    const uint8_t* base_address = reinterpret_cast<const uint8_t*>(
+        bytecode_array->GetFirstBytecodeAddress());
     const uint8_t* bytecode_address = base_address + offset;
     os << " -> " << static_cast<const void*>(bytecode_address) << " @ "
        << std::setw(4) << offset << " : ";
@@ -143,16 +143,16 @@ RUNTIME_FUNCTION(Runtime_InterpreterTraceBytecodeEntry) {
                                          bytecode_array->parameter_count());
     os << std::endl;
     // Print all input registers and accumulator.
-    PrintRegisters(os, true, bytecode_iterator, accumulator);
+    PrintRegisters(isolate, os, true, bytecode_iterator, accumulator);
 
     os << std::flush;
   }
-  return isolate->heap()->undefined_value();
+  return ReadOnlyRoots(isolate).undefined_value();
 }
 
 RUNTIME_FUNCTION(Runtime_InterpreterTraceBytecodeExit) {
   if (!FLAG_trace_ignition) {
-    return isolate->heap()->undefined_value();
+    return ReadOnlyRoots(isolate).undefined_value();
   }
 
   SealHandleScope shs(isolate);
@@ -170,12 +170,12 @@ RUNTIME_FUNCTION(Runtime_InterpreterTraceBytecodeExit) {
   if (bytecode_iterator.current_operand_scale() ==
           interpreter::OperandScale::kSingle ||
       offset > bytecode_iterator.current_offset()) {
-    OFStream os(stdout);
+    StdoutStream os;
     // Print all output registers and accumulator.
-    PrintRegisters(os, false, bytecode_iterator, accumulator);
+    PrintRegisters(isolate, os, false, bytecode_iterator, accumulator);
     os << std::flush;
   }
-  return isolate->heap()->undefined_value();
+  return ReadOnlyRoots(isolate).undefined_value();
 }
 
 #endif
@@ -184,7 +184,7 @@ RUNTIME_FUNCTION(Runtime_InterpreterTraceBytecodeExit) {
 
 RUNTIME_FUNCTION(Runtime_InterpreterTraceUpdateFeedback) {
   if (!FLAG_trace_feedback_updates) {
-    return isolate->heap()->undefined_value();
+    return ReadOnlyRoots(isolate).undefined_value();
   }
 
   SealHandleScope shs(isolate);
@@ -195,7 +195,7 @@ RUNTIME_FUNCTION(Runtime_InterpreterTraceUpdateFeedback) {
 
   int slot_count = function->feedback_vector()->metadata()->slot_count();
 
-  OFStream os(stdout);
+  StdoutStream os;
   os << "[Feedback slot " << slot << "/" << slot_count << " in ";
   function->shared()->ShortPrint(os);
   os << " updated to ";
@@ -210,7 +210,7 @@ RUNTIME_FUNCTION(Runtime_InterpreterTraceUpdateFeedback) {
 
   os << "]" << std::endl;
 
-  return isolate->heap()->undefined_value();
+  return ReadOnlyRoots(isolate).undefined_value();
 }
 
 #endif
diff --git a/deps/v8/src/runtime/runtime-intl.cc b/deps/v8/src/runtime/runtime-intl.cc
index a49a4423cfc417..98c89371d1df17 100644
--- a/deps/v8/src/runtime/runtime-intl.cc
+++ b/deps/v8/src/runtime/runtime-intl.cc
@@ -14,11 +14,13 @@
 #include "src/api-natives.h"
 #include "src/api.h"
 #include "src/arguments.h"
+#include "src/date.h"
 #include "src/global-handles.h"
 #include "src/heap/factory.h"
 #include "src/intl.h"
 #include "src/isolate-inl.h"
 #include "src/messages.h"
+#include "src/objects/intl-objects-inl.h"
 #include "src/objects/intl-objects.h"
 #include "src/utils.h"
 
@@ -31,8 +33,6 @@
 #include "unicode/decimfmt.h"
 #include "unicode/dtfmtsym.h"
 #include "unicode/dtptngen.h"
-#include "unicode/fieldpos.h"
-#include "unicode/fpositer.h"
 #include "unicode/locid.h"
 #include "unicode/numfmt.h"
 #include "unicode/numsys.h"
@@ -40,7 +40,6 @@
 #include "unicode/rbbi.h"
 #include "unicode/smpdtfmt.h"
 #include "unicode/timezone.h"
-#include "unicode/translit.h"
 #include "unicode/uchar.h"
 #include "unicode/ucol.h"
 #include "unicode/ucurr.h"
@@ -121,6 +120,11 @@ RUNTIME_FUNCTION(Runtime_AvailableLocalesOf) {
     // so we should filter from all locales, but it's not clear how; see
     // https://ssl.icu-project.org/trac/ticket/12756
     available_locales = icu::Locale::getAvailableLocales(count);
+  } else if (service->IsUtf8EqualTo(CStrVector("relativetimeformat"))) {
+    // TODO(ftang): for now just use
+    // icu::NumberFormat::getAvailableLocales(count) until we migrate to
+    // Intl::GetAvailableLocales()
+    available_locales = icu::NumberFormat::getAvailableLocales(count);
   } else {
     UNREACHABLE();
   }
@@ -174,36 +178,18 @@ RUNTIME_FUNCTION(Runtime_GetDefaultICULocale) {
   return *factory->NewStringFromStaticChars("und");
 }
 
-RUNTIME_FUNCTION(Runtime_IsInitializedIntlObject) {
-  HandleScope scope(isolate);
-
-  DCHECK_EQ(1, args.length());
-
-  CONVERT_ARG_HANDLE_CHECKED(Object, input, 0);
-
-  if (!input->IsJSObject()) return isolate->heap()->false_value();
-  Handle<JSObject> obj = Handle<JSObject>::cast(input);
-
-  Handle<Symbol> marker = isolate->factory()->intl_initialized_marker_symbol();
-  Handle<Object> tag = JSReceiver::GetDataProperty(obj, marker);
-  return isolate->heap()->ToBoolean(!tag->IsUndefined(isolate));
-}
-
 RUNTIME_FUNCTION(Runtime_IsInitializedIntlObjectOfType) {
   HandleScope scope(isolate);
 
   DCHECK_EQ(2, args.length());
 
   CONVERT_ARG_HANDLE_CHECKED(Object, input, 0);
-  CONVERT_ARG_HANDLE_CHECKED(String, expected_type, 1);
+  CONVERT_SMI_ARG_CHECKED(expected_type_int, 1);
 
-  if (!input->IsJSObject()) return isolate->heap()->false_value();
-  Handle<JSObject> obj = Handle<JSObject>::cast(input);
+  Intl::Type expected_type = Intl::TypeFromInt(expected_type_int);
 
-  Handle<Symbol> marker = isolate->factory()->intl_initialized_marker_symbol();
-  Handle<Object> tag = JSReceiver::GetDataProperty(obj, marker);
-  return isolate->heap()->ToBoolean(tag->IsString() &&
-                                    String::cast(*tag)->Equals(*expected_type));
+  return isolate->heap()->ToBoolean(
+      Intl::IsObjectOfType(isolate, input, expected_type));
 }
 
 RUNTIME_FUNCTION(Runtime_MarkAsInitializedIntlObjectOfType) {
@@ -212,12 +198,18 @@ RUNTIME_FUNCTION(Runtime_MarkAsInitializedIntlObjectOfType) {
   DCHECK_EQ(2, args.length());
 
   CONVERT_ARG_HANDLE_CHECKED(JSObject, input, 0);
-  CONVERT_ARG_HANDLE_CHECKED(String, type, 1);
+  CONVERT_ARG_HANDLE_CHECKED(Smi, type, 1);
+
+#ifdef DEBUG
+  // TypeFromSmi does correctness checks.
+  Intl::Type type_intl = Intl::TypeFromSmi(*type);
+  USE(type_intl);
+#endif
 
   Handle<Symbol> marker = isolate->factory()->intl_initialized_marker_symbol();
   JSObject::SetProperty(input, marker, type, LanguageMode::kStrict).Assert();
 
-  return isolate->heap()->undefined_value();
+  return ReadOnlyRoots(isolate).undefined_value();
 }
 
 RUNTIME_FUNCTION(Runtime_CreateDateTimeFormat) {
@@ -230,7 +222,7 @@ RUNTIME_FUNCTION(Runtime_CreateDateTimeFormat) {
   CONVERT_ARG_HANDLE_CHECKED(JSObject, resolved, 2);
 
   Handle<JSFunction> constructor(
-      isolate->native_context()->intl_date_time_format_function());
+      isolate->native_context()->intl_date_time_format_function(), isolate);
 
   Handle<JSObject> local_object;
   ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, local_object,
@@ -260,9 +252,8 @@ RUNTIME_FUNCTION(Runtime_InternalDateFormat) {
   CONVERT_ARG_HANDLE_CHECKED(JSObject, date_format_holder, 0);
   CONVERT_NUMBER_ARG_HANDLE_CHECKED(date, 1);
 
-  double date_value = date->Number();
-  // Check for +-Infinity and Nan
-  if (!std::isfinite(date_value)) {
+  double date_value = DateCache::TimeClip(date->Number());
+  if (std::isnan(date_value)) {
     THROW_NEW_ERROR_RETURN_FAILURE(
         isolate, NewRangeError(MessageTemplate::kInvalidTimeValue));
   }
@@ -280,143 +271,6 @@ RUNTIME_FUNCTION(Runtime_InternalDateFormat) {
                    result.length())));
 }
 
-namespace {
-// The list comes from third_party/icu/source/i18n/unicode/udat.h.
-// They're mapped to DateTimeFormat components listed at
-// https://tc39.github.io/ecma402/#sec-datetimeformat-abstracts .
-
-Handle<String> IcuDateFieldIdToDateType(int32_t field_id, Isolate* isolate) {
-  switch (field_id) {
-    case -1:
-      return isolate->factory()->literal_string();
-    case UDAT_YEAR_FIELD:
-    case UDAT_EXTENDED_YEAR_FIELD:
-    case UDAT_YEAR_NAME_FIELD:
-      return isolate->factory()->year_string();
-    case UDAT_MONTH_FIELD:
-    case UDAT_STANDALONE_MONTH_FIELD:
-      return isolate->factory()->month_string();
-    case UDAT_DATE_FIELD:
-      return isolate->factory()->day_string();
-    case UDAT_HOUR_OF_DAY1_FIELD:
-    case UDAT_HOUR_OF_DAY0_FIELD:
-    case UDAT_HOUR1_FIELD:
-    case UDAT_HOUR0_FIELD:
-      return isolate->factory()->hour_string();
-    case UDAT_MINUTE_FIELD:
-      return isolate->factory()->minute_string();
-    case UDAT_SECOND_FIELD:
-      return isolate->factory()->second_string();
-    case UDAT_DAY_OF_WEEK_FIELD:
-    case UDAT_DOW_LOCAL_FIELD:
-    case UDAT_STANDALONE_DAY_FIELD:
-      return isolate->factory()->weekday_string();
-    case UDAT_AM_PM_FIELD:
-      return isolate->factory()->dayperiod_string();
-    case UDAT_TIMEZONE_FIELD:
-    case UDAT_TIMEZONE_RFC_FIELD:
-    case UDAT_TIMEZONE_GENERIC_FIELD:
-    case UDAT_TIMEZONE_SPECIAL_FIELD:
-    case UDAT_TIMEZONE_LOCALIZED_GMT_OFFSET_FIELD:
-    case UDAT_TIMEZONE_ISO_FIELD:
-    case UDAT_TIMEZONE_ISO_LOCAL_FIELD:
-      return isolate->factory()->timeZoneName_string();
-    case UDAT_ERA_FIELD:
-      return isolate->factory()->era_string();
-    default:
-      // Other UDAT_*_FIELD's cannot show up because there is no way to specify
-      // them via options of Intl.DateTimeFormat.
-      UNREACHABLE();
-      // To prevent MSVC from issuing C4715 warning.
-      return Handle<String>();
-  }
-}
-
-bool AddElement(Handle<JSArray> array, int index, int32_t field_id,
-                const icu::UnicodeString& formatted, int32_t begin, int32_t end,
-                Isolate* isolate) {
-  HandleScope scope(isolate);
-  Factory* factory = isolate->factory();
-  Handle<JSObject> element = factory->NewJSObject(isolate->object_function());
-  Handle<String> value = IcuDateFieldIdToDateType(field_id, isolate);
-  JSObject::AddProperty(element, factory->type_string(), value, NONE);
-
-  icu::UnicodeString field(formatted.tempSubStringBetween(begin, end));
-  ASSIGN_RETURN_ON_EXCEPTION_VALUE(
-      isolate, value,
-      factory->NewStringFromTwoByte(Vector<const uint16_t>(
-          reinterpret_cast<const uint16_t*>(field.getBuffer()),
-          field.length())),
-      false);
-
-  JSObject::AddProperty(element, factory->value_string(), value, NONE);
-  RETURN_ON_EXCEPTION_VALUE(
-      isolate, JSObject::AddDataElement(array, index, element, NONE), false);
-  return true;
-}
-
-}  // namespace
-
-RUNTIME_FUNCTION(Runtime_InternalDateFormatToParts) {
-  HandleScope scope(isolate);
-  Factory* factory = isolate->factory();
-
-  DCHECK_EQ(2, args.length());
-
-  CONVERT_ARG_HANDLE_CHECKED(JSObject, date_format_holder, 0);
-  CONVERT_NUMBER_ARG_HANDLE_CHECKED(date, 1);
-
-  double date_value = date->Number();
-  if (!std::isfinite(date_value)) {
-    THROW_NEW_ERROR_RETURN_FAILURE(
-        isolate, NewRangeError(MessageTemplate::kInvalidTimeValue));
-  }
-
-  icu::SimpleDateFormat* date_format =
-      DateFormat::UnpackDateFormat(isolate, date_format_holder);
-  CHECK_NOT_NULL(date_format);
-
-  icu::UnicodeString formatted;
-  icu::FieldPositionIterator fp_iter;
-  icu::FieldPosition fp;
-  UErrorCode status = U_ZERO_ERROR;
-  date_format->format(date_value, formatted, &fp_iter, status);
-  if (U_FAILURE(status)) return isolate->heap()->undefined_value();
-
-  Handle<JSArray> result = factory->NewJSArray(0);
-  int32_t length = formatted.length();
-  if (length == 0) return *result;
-
-  int index = 0;
-  int32_t previous_end_pos = 0;
-  while (fp_iter.next(fp)) {
-    int32_t begin_pos = fp.getBeginIndex();
-    int32_t end_pos = fp.getEndIndex();
-
-    if (previous_end_pos < begin_pos) {
-      if (!AddElement(result, index, -1, formatted, previous_end_pos, begin_pos,
-                      isolate)) {
-        return isolate->heap()->undefined_value();
-      }
-      ++index;
-    }
-    if (!AddElement(result, index, fp.getField(), formatted, begin_pos, end_pos,
-                    isolate)) {
-      return isolate->heap()->undefined_value();
-    }
-    previous_end_pos = end_pos;
-    ++index;
-  }
-  if (previous_end_pos < length) {
-    if (!AddElement(result, index, -1, formatted, previous_end_pos, length,
-                    isolate)) {
-      return isolate->heap()->undefined_value();
-    }
-  }
-  JSObject::ValidateElements(*result);
-  return *result;
-}
-
 RUNTIME_FUNCTION(Runtime_CreateNumberFormat) {
   HandleScope scope(isolate);
 
@@ -427,7 +281,7 @@ RUNTIME_FUNCTION(Runtime_CreateNumberFormat) {
   CONVERT_ARG_HANDLE_CHECKED(JSObject, resolved, 2);
 
   Handle<JSFunction> constructor(
-      isolate->native_context()->intl_number_format_function());
+      isolate->native_context()->intl_number_format_function(), isolate);
 
   Handle<JSObject> local_object;
   ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, local_object,
@@ -439,7 +293,8 @@ RUNTIME_FUNCTION(Runtime_CreateNumberFormat) {
 
   if (!number_format) return isolate->ThrowIllegalOperation();
 
-  local_object->SetEmbedderField(0, reinterpret_cast<Smi*>(number_format));
+  local_object->SetEmbedderField(NumberFormat::kDecimalFormatIndex,
+                                 reinterpret_cast<Smi*>(number_format));
 
   Handle<Object> wrapper = isolate->global_handles()->Create(*local_object);
   GlobalHandles::MakeWeak(wrapper.location(), wrapper.location(),
@@ -454,22 +309,15 @@ RUNTIME_FUNCTION(Runtime_InternalNumberFormat) {
   DCHECK_EQ(2, args.length());
 
   CONVERT_ARG_HANDLE_CHECKED(JSObject, number_format_holder, 0);
-  CONVERT_ARG_HANDLE_CHECKED(Object, number, 1);
-
-  Handle<Object> value;
-  ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, value, Object::ToNumber(number));
-
-  icu::DecimalFormat* number_format =
-      NumberFormat::UnpackNumberFormat(isolate, number_format_holder);
-  CHECK_NOT_NULL(number_format);
+  CONVERT_ARG_HANDLE_CHECKED(Object, value, 1);
 
-  icu::UnicodeString result;
-  number_format->format(value->Number(), result);
+  Handle<Object> number_obj;
+  ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, number_obj,
+                                     Object::ToNumber(value));
 
-  RETURN_RESULT_OR_FAILURE(
-      isolate, isolate->factory()->NewStringFromTwoByte(Vector<const uint16_t>(
-                   reinterpret_cast<const uint16_t*>(result.getBuffer()),
-                   result.length())));
+  double number = number_obj->Number();
+  RETURN_RESULT_OR_FAILURE(isolate, NumberFormat::FormatNumber(
+                                        isolate, number_format_holder, number));
 }
 
 RUNTIME_FUNCTION(Runtime_CurrencyDigits) {
@@ -499,7 +347,7 @@ RUNTIME_FUNCTION(Runtime_CreateCollator) {
   CONVERT_ARG_HANDLE_CHECKED(JSObject, resolved, 2);
 
   Handle<JSFunction> constructor(
-      isolate->native_context()->intl_collator_function());
+      isolate->native_context()->intl_collator_function(), isolate);
 
   Handle<JSObject> collator_holder;
   ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, collator_holder,
@@ -525,8 +373,8 @@ RUNTIME_FUNCTION(Runtime_InternalCompare) {
   icu::Collator* collator = Collator::UnpackCollator(isolate, collator_holder);
   CHECK_NOT_NULL(collator);
 
-  string1 = String::Flatten(string1);
-  string2 = String::Flatten(string2);
+  string1 = String::Flatten(isolate, string1);
+  string2 = String::Flatten(isolate, string2);
 
   UCollationResult result;
   UErrorCode status = U_ZERO_ERROR;
@@ -559,7 +407,7 @@ RUNTIME_FUNCTION(Runtime_CreatePluralRules) {
   CONVERT_ARG_HANDLE_CHECKED(JSObject, resolved, 2);
 
   Handle<JSFunction> constructor(
-      isolate->native_context()->intl_plural_rules_function());
+      isolate->native_context()->intl_plural_rules_function(), isolate);
 
   Handle<JSObject> local_object;
   ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, local_object,
@@ -635,7 +483,7 @@ RUNTIME_FUNCTION(Runtime_CreateBreakIterator) {
   CONVERT_ARG_HANDLE_CHECKED(JSObject, resolved, 2);
 
   Handle<JSFunction> constructor(
-      isolate->native_context()->intl_v8_break_iterator_function());
+      isolate->native_context()->intl_v8_break_iterator_function(), isolate);
 
   Handle<JSObject> local_object;
   ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, local_object,
@@ -677,7 +525,7 @@ RUNTIME_FUNCTION(Runtime_BreakIteratorAdoptText) {
   delete u_text;
 
   int length = text->length();
-  text = String::Flatten(text);
+  text = String::Flatten(isolate, text);
   DisallowHeapAllocation no_gc;
   String::FlatContent flat = text->GetFlatContent();
   std::unique_ptr<uc16[]> sap;
@@ -687,7 +535,7 @@ RUNTIME_FUNCTION(Runtime_BreakIteratorAdoptText) {
 
   break_iterator->setText(*u_text);
 
-  return isolate->heap()->undefined_value();
+  return ReadOnlyRoots(isolate).undefined_value();
 }
 
 RUNTIME_FUNCTION(Runtime_BreakIteratorFirst) {
@@ -751,7 +599,7 @@ RUNTIME_FUNCTION(Runtime_BreakIteratorBreakType) {
   if (status >= UBRK_WORD_NONE && status < UBRK_WORD_NONE_LIMIT) {
     return *isolate->factory()->NewStringFromStaticChars("none");
   } else if (status >= UBRK_WORD_NUMBER && status < UBRK_WORD_NUMBER_LIMIT) {
-    return isolate->heap()->number_string();
+    return ReadOnlyRoots(isolate).number_string();
   } else if (status >= UBRK_WORD_LETTER && status < UBRK_WORD_LETTER_LIMIT) {
     return *isolate->factory()->NewStringFromStaticChars("letter");
   } else if (status >= UBRK_WORD_KANA && status < UBRK_WORD_KANA_LIMIT) {
@@ -767,7 +615,7 @@ RUNTIME_FUNCTION(Runtime_StringToLowerCaseIntl) {
   HandleScope scope(isolate);
   DCHECK_EQ(args.length(), 1);
   CONVERT_ARG_HANDLE_CHECKED(String, s, 0);
-  s = String::Flatten(s);
+  s = String::Flatten(isolate, s);
   return ConvertToLower(s, isolate);
 }
 
@@ -775,7 +623,7 @@ RUNTIME_FUNCTION(Runtime_StringToUpperCaseIntl) {
   HandleScope scope(isolate);
   DCHECK_EQ(args.length(), 1);
   CONVERT_ARG_HANDLE_CHECKED(String, s, 0);
-  s = String::Flatten(s);
+  s = String::Flatten(isolate, s);
   return ConvertToUpper(s, isolate);
 }
 
@@ -789,8 +637,8 @@ RUNTIME_FUNCTION(Runtime_StringLocaleConvertCase) {
   // Primary language tag can be up to 8 characters long in theory.
   // https://tools.ietf.org/html/bcp47#section-2.2.1
   DCHECK_LE(lang_arg->length(), 8);
-  lang_arg = String::Flatten(lang_arg);
-  s = String::Flatten(s);
+  lang_arg = String::Flatten(isolate, lang_arg);
+  s = String::Flatten(isolate, s);
 
   // All the languages requiring special-handling have two-letter codes.
   // Note that we have to check for '!= 2' here because private-use language
@@ -825,7 +673,8 @@ RUNTIME_FUNCTION(Runtime_StringLocaleConvertCase) {
 RUNTIME_FUNCTION(Runtime_DateCacheVersion) {
   HandleScope scope(isolate);
   DCHECK_EQ(0, args.length());
-  if (isolate->serializer_enabled()) return isolate->heap()->undefined_value();
+  if (isolate->serializer_enabled())
+    return ReadOnlyRoots(isolate).undefined_value();
   if (!isolate->eternal_handles()->Exists(EternalHandles::DATE_CACHE_VERSION)) {
     Handle<FixedArray> date_cache_version =
         isolate->factory()->NewFixedArray(1, TENURED);
@@ -839,5 +688,20 @@ RUNTIME_FUNCTION(Runtime_DateCacheVersion) {
   return date_cache_version->get(0);
 }
 
+RUNTIME_FUNCTION(Runtime_IntlUnwrapReceiver) {
+  HandleScope scope(isolate);
+  DCHECK_EQ(5, args.length());
+  CONVERT_ARG_HANDLE_CHECKED(JSReceiver, receiver, 0);
+  CONVERT_SMI_ARG_CHECKED(type_int, 1);
+  CONVERT_ARG_HANDLE_CHECKED(JSFunction, constructor, 2);
+  CONVERT_ARG_HANDLE_CHECKED(String, method, 3);
+  CONVERT_BOOLEAN_ARG_CHECKED(check_legacy_constructor, 4);
+
+  RETURN_RESULT_OR_FAILURE(
+      isolate, Intl::UnwrapReceiver(isolate, receiver, constructor,
+                                    Intl::TypeFromInt(type_int), method,
+                                    check_legacy_constructor));
+}
+
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/src/runtime/runtime-literals.cc b/deps/v8/src/runtime/runtime-literals.cc
index 568849b3d9da9c..68d0eafd7c9b7a 100644
--- a/deps/v8/src/runtime/runtime-literals.cc
+++ b/deps/v8/src/runtime/runtime-literals.cc
@@ -7,8 +7,10 @@
 #include "src/allocation-site-scopes.h"
 #include "src/arguments.h"
 #include "src/ast/ast.h"
-#include "src/ast/compile-time-value.h"
 #include "src/isolate-inl.h"
+#include "src/objects/hash-table-inl.h"
+#include "src/objects/js-regexp-inl.h"
+#include "src/objects/literal-objects-inl.h"
 #include "src/runtime/runtime.h"
 
 namespace v8 {
@@ -30,7 +32,7 @@ void PreInitializeLiteralSite(Handle<FeedbackVector> vector,
 }
 
 Handle<Object> InnerCreateBoilerplate(Isolate* isolate,
-                                      Handle<FixedArray> compile_time_value,
+                                      Handle<Object> description,
                                       PretenureFlag pretenure_flag);
 
 enum DeepCopyHints { kNoHints = 0, kObjectIsShallow = 1 };
@@ -47,6 +49,11 @@ class JSObjectWalkVisitor {
  protected:
   V8_WARN_UNUSED_RESULT inline MaybeHandle<JSObject> VisitElementOrProperty(
       Handle<JSObject> object, Handle<JSObject> value) {
+    // Dont create allocation sites for nested object literals
+    if (!value->IsJSArray()) {
+      return StructureWalk(value);
+    }
+
     Handle<AllocationSite> current_site = site_context()->EnterNewScope();
     MaybeHandle<JSObject> copy_of_value = StructureWalk(value);
     site_context()->ExitScope(current_site, value);
@@ -104,7 +111,8 @@ MaybeHandle<JSObject> JSObjectWalkVisitor<ContextObject>::StructureWalk(
   // Deep copy own properties. Arrays only have 1 property "length".
   if (!copy->IsJSArray()) {
     if (copy->HasFastProperties()) {
-      Handle<DescriptorArray> descriptors(copy->map()->instance_descriptors());
+      Handle<DescriptorArray> descriptors(copy->map()->instance_descriptors(),
+                                          isolate);
       int limit = copy->map()->NumberOfOwnDescriptors();
       for (int i = 0; i < limit; i++) {
         DCHECK_EQ(kField, descriptors->GetDetails(i).location());
@@ -119,14 +127,14 @@ MaybeHandle<JSObject> JSObjectWalkVisitor<ContextObject>::StructureWalk(
           if (copying) copy->FastPropertyAtPut(index, *value);
         } else if (copying && raw->IsMutableHeapNumber()) {
           DCHECK(descriptors->GetDetails(i).representation().IsDouble());
-          uint64_t double_value = HeapNumber::cast(raw)->value_as_bits();
-          Handle<HeapNumber> value = isolate->factory()->NewHeapNumber(MUTABLE);
-          value->set_value_as_bits(double_value);
+          uint64_t double_value = MutableHeapNumber::cast(raw)->value_as_bits();
+          auto value =
+              isolate->factory()->NewMutableHeapNumberFromBits(double_value);
           copy->FastPropertyAtPut(index, *value);
         }
       }
     } else {
-      Handle<NameDictionary> dict(copy->property_dictionary());
+      Handle<NameDictionary> dict(copy->property_dictionary(), isolate);
       for (int i = 0; i < dict->Capacity(); i++) {
         Object* raw = dict->ValueAt(i);
         if (!raw->IsJSObject()) continue;
@@ -146,8 +154,8 @@ MaybeHandle<JSObject> JSObjectWalkVisitor<ContextObject>::StructureWalk(
   switch (copy->GetElementsKind()) {
     case PACKED_ELEMENTS:
     case HOLEY_ELEMENTS: {
-      Handle<FixedArray> elements(FixedArray::cast(copy->elements()));
-      if (elements->map() == isolate->heap()->fixed_cow_array_map()) {
+      Handle<FixedArray> elements(FixedArray::cast(copy->elements()), isolate);
+      if (elements->map() == ReadOnlyRoots(isolate).fixed_cow_array_map()) {
 #ifdef DEBUG
         for (int i = 0; i < elements->length(); i++) {
           DCHECK(!elements->get(i)->IsJSObject());
@@ -166,7 +174,8 @@ MaybeHandle<JSObject> JSObjectWalkVisitor<ContextObject>::StructureWalk(
       break;
     }
     case DICTIONARY_ELEMENTS: {
-      Handle<NumberDictionary> element_dictionary(copy->element_dictionary());
+      Handle<NumberDictionary> element_dictionary(copy->element_dictionary(),
+                                                  isolate);
       int capacity = element_dictionary->Capacity();
       for (int i = 0; i < capacity; i++) {
         Object* raw = element_dictionary->ValueAt(i);
@@ -238,19 +247,22 @@ class AllocationSiteCreationContext : public AllocationSiteContext {
     if (top().is_null()) {
       // We are creating the top level AllocationSite as opposed to a nested
       // AllocationSite.
-      InitializeTraversal(isolate()->factory()->NewAllocationSite());
+      InitializeTraversal(isolate()->factory()->NewAllocationSite(true));
       scope_site = Handle<AllocationSite>(*top(), isolate());
       if (FLAG_trace_creation_allocation_sites) {
-        PrintF("*** Creating top level AllocationSite %p\n",
+        PrintF("*** Creating top level %s AllocationSite %p\n", "Fat",
                static_cast<void*>(*scope_site));
       }
     } else {
       DCHECK(!current().is_null());
-      scope_site = isolate()->factory()->NewAllocationSite();
+      scope_site = isolate()->factory()->NewAllocationSite(false);
       if (FLAG_trace_creation_allocation_sites) {
-        PrintF("Creating nested site (top, current, new) (%p, %p, %p)\n",
-               static_cast<void*>(*top()), static_cast<void*>(*current()),
-               static_cast<void*>(*scope_site));
+        PrintF(
+            "*** Creating nested %s AllocationSite (top, current, new) (%p, "
+            "%p, "
+            "%p)\n",
+            "Slim", static_cast<void*>(*top()), static_cast<void*>(*current()),
+            static_cast<void*>(*scope_site));
       }
       current()->set_nested_site(*scope_site);
       update_current_site(*scope_site);
@@ -268,7 +280,7 @@ class AllocationSiteCreationContext : public AllocationSiteContext {
         PrintF("*** Setting AllocationSite %p transition_info %p\n",
                static_cast<void*>(*scope_site), static_cast<void*>(*object));
       } else {
-        PrintF("Setting AllocationSite (%p, %p) transition_info %p\n",
+        PrintF("*** Setting AllocationSite (%p, %p) transition_info %p\n",
                static_cast<void*>(*top()), static_cast<void*>(*scope_site),
                static_cast<void*>(*object));
       }
@@ -310,8 +322,8 @@ struct ObjectBoilerplate {
                                  Handle<HeapObject> description, int flags,
                                  PretenureFlag pretenure_flag) {
     Handle<Context> native_context = isolate->native_context();
-    Handle<BoilerplateDescription> boilerplate_description =
-        Handle<BoilerplateDescription>::cast(description);
+    Handle<ObjectBoilerplateDescription> object_boilerplate_description =
+        Handle<ObjectBoilerplateDescription>::cast(description);
     bool use_fast_elements = (flags & ObjectLiteral::kFastElements) != 0;
     bool has_null_prototype = (flags & ObjectLiteral::kHasNullPrototype) != 0;
 
@@ -319,7 +331,8 @@ struct ObjectBoilerplate {
     // slow properties mode for now. We don't go in the map cache because
     // maps with constant functions can't be shared if the functions are
     // not the same (which is the common case).
-    int number_of_properties = boilerplate_description->backing_store_size();
+    int number_of_properties =
+        object_boilerplate_description->backing_store_size();
 
     // Ignoring number_of_properties for force dictionary map with
     // __proto__:null.
@@ -340,17 +353,16 @@ struct ObjectBoilerplate {
     if (!use_fast_elements) JSObject::NormalizeElements(boilerplate);
 
     // Add the constant properties to the boilerplate.
-    int length = boilerplate_description->size();
+    int length = object_boilerplate_description->size();
     // TODO(verwaest): Support tracking representations in the boilerplate.
     for (int index = 0; index < length; index++) {
-      Handle<Object> key(boilerplate_description->name(index), isolate);
-      Handle<Object> value(boilerplate_description->value(index), isolate);
-      if (value->IsFixedArray()) {
-        // The value contains the CompileTimeValue with the boilerplate
-        // properties of a simple object or array literal.
-        Handle<FixedArray> compile_time_value = Handle<FixedArray>::cast(value);
-        value =
-            InnerCreateBoilerplate(isolate, compile_time_value, pretenure_flag);
+      Handle<Object> key(object_boilerplate_description->name(index), isolate);
+      Handle<Object> value(object_boilerplate_description->value(index),
+                           isolate);
+
+      if (value->IsObjectBoilerplateDescription() ||
+          value->IsArrayBoilerplateDescription()) {
+        value = InnerCreateBoilerplate(isolate, value, pretenure_flag);
       }
       uint32_t element_index = 0;
       if (key->ToArrayIndex(&element_index)) {
@@ -384,14 +396,16 @@ struct ArrayBoilerplate {
   static Handle<JSObject> Create(Isolate* isolate,
                                  Handle<HeapObject> description, int flags,
                                  PretenureFlag pretenure_flag) {
-    Handle<ConstantElementsPair> elements =
-        Handle<ConstantElementsPair>::cast(description);
-    // Create the JSArray.
+    Handle<ArrayBoilerplateDescription> array_boilerplate_description =
+        Handle<ArrayBoilerplateDescription>::cast(description);
+
     ElementsKind constant_elements_kind =
-        static_cast<ElementsKind>(elements->elements_kind());
+        array_boilerplate_description->elements_kind();
 
     Handle<FixedArrayBase> constant_elements_values(
-        elements->constant_values());
+        array_boilerplate_description->constant_elements(), isolate);
+
+    // Create the JSArray.
     Handle<FixedArrayBase> copied_elements_values;
     if (IsDoubleElementsKind(constant_elements_kind)) {
       copied_elements_values = isolate->factory()->CopyFixedDoubleArray(
@@ -399,7 +413,7 @@ struct ArrayBoilerplate {
     } else {
       DCHECK(IsSmiOrObjectElementsKind(constant_elements_kind));
       const bool is_cow = (constant_elements_values->map() ==
-                           isolate->heap()->fixed_cow_array_map());
+                           ReadOnlyRoots(isolate).fixed_cow_array_map());
       if (is_cow) {
         copied_elements_values = constant_elements_values;
 #if DEBUG
@@ -417,14 +431,12 @@ struct ArrayBoilerplate {
         copied_elements_values = fixed_array_values_copy;
         FOR_WITH_HANDLE_SCOPE(
             isolate, int, i = 0, i, i < fixed_array_values->length(), i++, {
-              if (fixed_array_values->get(i)->IsFixedArray()) {
-                // The value contains the CompileTimeValue with the
-                // boilerplate description of a simple object or
-                // array literal.
-                Handle<FixedArray> compile_time_value(
-                    FixedArray::cast(fixed_array_values->get(i)));
-                Handle<Object> result = InnerCreateBoilerplate(
-                    isolate, compile_time_value, pretenure_flag);
+              Handle<Object> value(fixed_array_values->get(i), isolate);
+
+              if (value->IsArrayBoilerplateDescription() ||
+                  value->IsObjectBoilerplateDescription()) {
+                Handle<Object> result =
+                    InnerCreateBoilerplate(isolate, value, pretenure_flag);
                 fixed_array_values_copy->set(i, *result);
               }
             });
@@ -438,15 +450,22 @@ struct ArrayBoilerplate {
 };
 
 Handle<Object> InnerCreateBoilerplate(Isolate* isolate,
-                                      Handle<FixedArray> compile_time_value,
+                                      Handle<Object> description,
                                       PretenureFlag pretenure_flag) {
-  Handle<HeapObject> elements =
-      CompileTimeValue::GetElements(compile_time_value);
-  int flags = CompileTimeValue::GetLiteralTypeFlags(compile_time_value);
-  if (flags == CompileTimeValue::kArrayLiteralFlag) {
-    return ArrayBoilerplate::Create(isolate, elements, flags, pretenure_flag);
+  if (description->IsObjectBoilerplateDescription()) {
+    Handle<ObjectBoilerplateDescription> object_boilerplate_description =
+        Handle<ObjectBoilerplateDescription>::cast(description);
+    return ObjectBoilerplate::Create(isolate, object_boilerplate_description,
+                                     object_boilerplate_description->flags(),
+                                     pretenure_flag);
+  } else {
+    DCHECK(description->IsArrayBoilerplateDescription());
+    Handle<ArrayBoilerplateDescription> array_boilerplate_description =
+        Handle<ArrayBoilerplateDescription>::cast(description);
+    return ArrayBoilerplate::Create(
+        isolate, array_boilerplate_description,
+        array_boilerplate_description->elements_kind(), pretenure_flag);
   }
-  return ObjectBoilerplate::Create(isolate, elements, flags, pretenure_flag);
 }
 
 template <typename Boilerplate>
@@ -456,7 +475,7 @@ MaybeHandle<JSObject> CreateLiteral(Isolate* isolate,
                                     Handle<HeapObject> description, int flags) {
   FeedbackSlot literals_slot(FeedbackVector::ToSlot(literals_index));
   CHECK(literals_slot.ToInt() < vector->length());
-  Handle<Object> literal_site(vector->Get(literals_slot), isolate);
+  Handle<Object> literal_site(vector->Get(literals_slot)->ToObject(), isolate);
   DeepCopyHints copy_hints =
       (flags & AggregateLiteral::kIsShallow) ? kObjectIsShallow : kNoHints;
   if (FLAG_track_double_fields && !FLAG_unbox_double_fields) {
@@ -489,7 +508,7 @@ MaybeHandle<JSObject> CreateLiteral(Isolate* isolate,
       return boilerplate;
     } else {
       PretenureFlag pretenure_flag =
-          isolate->heap()->InNewSpace(*vector) ? NOT_TENURED : TENURED;
+          Heap::InNewSpace(*vector) ? NOT_TENURED : TENURED;
       boilerplate =
           Boilerplate::Create(isolate, description, flags, pretenure_flag);
     }
@@ -522,7 +541,7 @@ RUNTIME_FUNCTION(Runtime_CreateObjectLiteral) {
   DCHECK_EQ(4, args.length());
   CONVERT_ARG_HANDLE_CHECKED(FeedbackVector, vector, 0);
   CONVERT_SMI_ARG_CHECKED(literals_index, 1);
-  CONVERT_ARG_HANDLE_CHECKED(BoilerplateDescription, description, 2);
+  CONVERT_ARG_HANDLE_CHECKED(ObjectBoilerplateDescription, description, 2);
   CONVERT_SMI_ARG_CHECKED(flags, 3);
   RETURN_RESULT_OR_FAILURE(
       isolate, CreateLiteral<ObjectBoilerplate>(isolate, vector, literals_index,
@@ -534,7 +553,7 @@ RUNTIME_FUNCTION(Runtime_CreateArrayLiteral) {
   DCHECK_EQ(4, args.length());
   CONVERT_ARG_HANDLE_CHECKED(FeedbackVector, vector, 0);
   CONVERT_SMI_ARG_CHECKED(literals_index, 1);
-  CONVERT_ARG_HANDLE_CHECKED(ConstantElementsPair, elements, 2);
+  CONVERT_ARG_HANDLE_CHECKED(ArrayBoilerplateDescription, elements, 2);
   CONVERT_SMI_ARG_CHECKED(flags, 3);
   RETURN_RESULT_OR_FAILURE(
       isolate, CreateLiteral<ArrayBoilerplate>(isolate, vector, literals_index,
@@ -552,7 +571,7 @@ RUNTIME_FUNCTION(Runtime_CreateRegExpLiteral) {
   FeedbackSlot literal_slot(FeedbackVector::ToSlot(index));
 
   // Check if boilerplate exists. If not, create it first.
-  Handle<Object> literal_site(vector->Get(literal_slot), isolate);
+  Handle<Object> literal_site(vector->Get(literal_slot)->ToObject(), isolate);
   Handle<Object> boilerplate;
   if (!HasBoilerplate(isolate, literal_site)) {
     ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
diff --git a/deps/v8/src/runtime/runtime-liveedit.cc b/deps/v8/src/runtime/runtime-liveedit.cc
index ee1602b712f692..03ec0e17c05b7b 100644
--- a/deps/v8/src/runtime/runtime-liveedit.cc
+++ b/deps/v8/src/runtime/runtime-liveedit.cc
@@ -20,12 +20,11 @@ namespace internal {
 // in OpaqueReferences.
 RUNTIME_FUNCTION(Runtime_LiveEditFindSharedFunctionInfosForScript) {
   HandleScope scope(isolate);
-  CHECK(isolate->debug()->live_edit_enabled());
   DCHECK_EQ(1, args.length());
   CONVERT_ARG_CHECKED(JSValue, script_value, 0);
 
   CHECK(script_value->value()->IsScript());
-  Handle<Script> script = Handle<Script>(Script::cast(script_value->value()));
+  Handle<Script> script(Script::cast(script_value->value()), isolate);
 
   std::vector<Handle<SharedFunctionInfo>> found;
   Heap* heap = isolate->heap();
@@ -36,7 +35,7 @@ RUNTIME_FUNCTION(Runtime_LiveEditFindSharedFunctionInfosForScript) {
       if (!heap_obj->IsSharedFunctionInfo()) continue;
       SharedFunctionInfo* shared = SharedFunctionInfo::cast(heap_obj);
       if (shared->script() != *script) continue;
-      found.push_back(Handle<SharedFunctionInfo>(shared));
+      found.push_back(Handle<SharedFunctionInfo>(shared, isolate));
     }
   }
 
@@ -63,16 +62,15 @@ RUNTIME_FUNCTION(Runtime_LiveEditFindSharedFunctionInfosForScript) {
 // with the function itself going first. The root function is a script function.
 RUNTIME_FUNCTION(Runtime_LiveEditGatherCompileInfo) {
   HandleScope scope(isolate);
-  CHECK(isolate->debug()->live_edit_enabled());
   DCHECK_EQ(2, args.length());
   CONVERT_ARG_CHECKED(JSValue, script, 0);
   CONVERT_ARG_HANDLE_CHECKED(String, source, 1);
 
   CHECK(script->value()->IsScript());
-  Handle<Script> script_handle = Handle<Script>(Script::cast(script->value()));
+  Handle<Script> script_handle(Script::cast(script->value()), isolate);
 
-  RETURN_RESULT_OR_FAILURE(isolate,
-                           LiveEdit::GatherCompileInfo(script_handle, source));
+  RETURN_RESULT_OR_FAILURE(
+      isolate, LiveEdit::GatherCompileInfo(isolate, script_handle, source));
 }
 
 
@@ -81,23 +79,23 @@ RUNTIME_FUNCTION(Runtime_LiveEditGatherCompileInfo) {
 // the script with its original source and sends notification to debugger.
 RUNTIME_FUNCTION(Runtime_LiveEditReplaceScript) {
   HandleScope scope(isolate);
-  CHECK(isolate->debug()->live_edit_enabled());
   DCHECK_EQ(3, args.length());
   CONVERT_ARG_CHECKED(JSValue, original_script_value, 0);
   CONVERT_ARG_HANDLE_CHECKED(String, new_source, 1);
   CONVERT_ARG_HANDLE_CHECKED(Object, old_script_name, 2);
 
   CHECK(original_script_value->value()->IsScript());
-  Handle<Script> original_script(Script::cast(original_script_value->value()));
+  Handle<Script> original_script(Script::cast(original_script_value->value()),
+                                 isolate);
 
   Handle<Object> old_script = LiveEdit::ChangeScriptSource(
-      original_script, new_source, old_script_name);
+      isolate, original_script, new_source, old_script_name);
 
   if (old_script->IsScript()) {
     Handle<Script> script_handle = Handle<Script>::cast(old_script);
     return *Script::GetWrapper(script_handle);
   } else {
-    return isolate->heap()->null_value();
+    return ReadOnlyRoots(isolate).null_value();
   }
 }
 
@@ -105,49 +103,45 @@ RUNTIME_FUNCTION(Runtime_LiveEditReplaceScript) {
 // SharedFunctionInfos.
 RUNTIME_FUNCTION(Runtime_LiveEditFixupScript) {
   HandleScope scope(isolate);
-  CHECK(isolate->debug()->live_edit_enabled());
   DCHECK_EQ(args.length(), 2);
   CONVERT_ARG_CHECKED(JSValue, script_value, 0);
   CONVERT_INT32_ARG_CHECKED(max_function_literal_id, 1);
 
   CHECK(script_value->value()->IsScript());
-  Handle<Script> script(Script::cast(script_value->value()));
+  Handle<Script> script(Script::cast(script_value->value()), isolate);
 
-  LiveEdit::FixupScript(script, max_function_literal_id);
-  return isolate->heap()->undefined_value();
+  LiveEdit::FixupScript(isolate, script, max_function_literal_id);
+  return ReadOnlyRoots(isolate).undefined_value();
 }
 
 RUNTIME_FUNCTION(Runtime_LiveEditFunctionSourceUpdated) {
   HandleScope scope(isolate);
-  CHECK(isolate->debug()->live_edit_enabled());
   DCHECK_EQ(args.length(), 2);
   CONVERT_ARG_HANDLE_CHECKED(JSArray, shared_info, 0);
   CONVERT_INT32_ARG_CHECKED(new_function_literal_id, 1);
   CHECK(SharedInfoWrapper::IsInstance(shared_info));
 
   LiveEdit::FunctionSourceUpdated(shared_info, new_function_literal_id);
-  return isolate->heap()->undefined_value();
+  return ReadOnlyRoots(isolate).undefined_value();
 }
 
 
 // Replaces code of SharedFunctionInfo with a new one.
 RUNTIME_FUNCTION(Runtime_LiveEditReplaceFunctionCode) {
   HandleScope scope(isolate);
-  CHECK(isolate->debug()->live_edit_enabled());
   DCHECK_EQ(2, args.length());
   CONVERT_ARG_HANDLE_CHECKED(JSArray, new_compile_info, 0);
   CONVERT_ARG_HANDLE_CHECKED(JSArray, shared_info, 1);
   CHECK(SharedInfoWrapper::IsInstance(shared_info));
 
   LiveEdit::ReplaceFunctionCode(new_compile_info, shared_info);
-  return isolate->heap()->undefined_value();
+  return ReadOnlyRoots(isolate).undefined_value();
 }
 
 
 // Connects SharedFunctionInfo to another script.
 RUNTIME_FUNCTION(Runtime_LiveEditFunctionSetScript) {
   HandleScope scope(isolate);
-  CHECK(isolate->debug()->live_edit_enabled());
   DCHECK_EQ(2, args.length());
   CONVERT_ARG_HANDLE_CHECKED(Object, function_object, 0);
   CONVERT_ARG_HANDLE_CHECKED(Object, script_object, 1);
@@ -166,7 +160,7 @@ RUNTIME_FUNCTION(Runtime_LiveEditFunctionSetScript) {
     // and we check it in this function.
   }
 
-  return isolate->heap()->undefined_value();
+  return ReadOnlyRoots(isolate).undefined_value();
 }
 
 
@@ -174,7 +168,6 @@ RUNTIME_FUNCTION(Runtime_LiveEditFunctionSetScript) {
 // with a substitution one.
 RUNTIME_FUNCTION(Runtime_LiveEditReplaceRefToNestedFunction) {
   HandleScope scope(isolate);
-  CHECK(isolate->debug()->live_edit_enabled());
   DCHECK_EQ(3, args.length());
 
   CONVERT_ARG_HANDLE_CHECKED(JSValue, parent_wrapper, 0);
@@ -184,9 +177,9 @@ RUNTIME_FUNCTION(Runtime_LiveEditReplaceRefToNestedFunction) {
   CHECK(orig_wrapper->value()->IsSharedFunctionInfo());
   CHECK(subst_wrapper->value()->IsSharedFunctionInfo());
 
-  LiveEdit::ReplaceRefToNestedFunction(parent_wrapper, orig_wrapper,
-                                       subst_wrapper);
-  return isolate->heap()->undefined_value();
+  LiveEdit::ReplaceRefToNestedFunction(isolate->heap(), parent_wrapper,
+                                       orig_wrapper, subst_wrapper);
+  return ReadOnlyRoots(isolate).undefined_value();
 }
 
 
@@ -197,14 +190,13 @@ RUNTIME_FUNCTION(Runtime_LiveEditReplaceRefToNestedFunction) {
 // Each group describes a change in text; groups are sorted by change_begin.
 RUNTIME_FUNCTION(Runtime_LiveEditPatchFunctionPositions) {
   HandleScope scope(isolate);
-  CHECK(isolate->debug()->live_edit_enabled());
   DCHECK_EQ(2, args.length());
   CONVERT_ARG_HANDLE_CHECKED(JSArray, shared_array, 0);
   CONVERT_ARG_HANDLE_CHECKED(JSArray, position_change_array, 1);
   CHECK(SharedInfoWrapper::IsInstance(shared_array));
 
   LiveEdit::PatchFunctionPositions(shared_array, position_change_array);
-  return isolate->heap()->undefined_value();
+  return ReadOnlyRoots(isolate).undefined_value();
 }
 
 
@@ -214,7 +206,6 @@ RUNTIME_FUNCTION(Runtime_LiveEditPatchFunctionPositions) {
 // LiveEdit::FunctionPatchabilityStatus type.
 RUNTIME_FUNCTION(Runtime_LiveEditCheckAndDropActivations) {
   HandleScope scope(isolate);
-  CHECK(isolate->debug()->live_edit_enabled());
   DCHECK_EQ(3, args.length());
   CONVERT_ARG_HANDLE_CHECKED(JSArray, old_shared_array, 0);
   CONVERT_ARG_HANDLE_CHECKED(JSArray, new_shared_array, 1);
@@ -252,12 +243,11 @@ RUNTIME_FUNCTION(Runtime_LiveEditCheckAndDropActivations) {
 // of diff chunks.
 RUNTIME_FUNCTION(Runtime_LiveEditCompareStrings) {
   HandleScope scope(isolate);
-  CHECK(isolate->debug()->live_edit_enabled());
   DCHECK_EQ(2, args.length());
   CONVERT_ARG_HANDLE_CHECKED(String, s1, 0);
   CONVERT_ARG_HANDLE_CHECKED(String, s2, 1);
 
-  Handle<JSArray> result = LiveEdit::CompareStrings(s1, s2);
+  Handle<JSArray> result = LiveEdit::CompareStrings(isolate, s1, s2);
   uint32_t array_length = 0;
   CHECK(result->length()->ToArrayLength(&array_length));
   if (array_length > 0) {
@@ -266,41 +256,5 @@ RUNTIME_FUNCTION(Runtime_LiveEditCompareStrings) {
 
   return *result;
 }
-
-
-// Restarts a call frame and completely drops all frames above.
-// Returns true if successful. Otherwise returns undefined or an error message.
-RUNTIME_FUNCTION(Runtime_LiveEditRestartFrame) {
-  HandleScope scope(isolate);
-  CHECK(isolate->debug()->live_edit_enabled());
-  DCHECK_EQ(2, args.length());
-  CONVERT_NUMBER_CHECKED(int, break_id, Int32, args[0]);
-  CHECK(isolate->debug()->CheckExecutionState(break_id));
-
-  CONVERT_NUMBER_CHECKED(int, index, Int32, args[1]);
-  Heap* heap = isolate->heap();
-
-  // Find the relevant frame with the requested index.
-  StackFrame::Id id = isolate->debug()->break_frame_id();
-  if (id == StackFrame::NO_ID) {
-    // If there are no JavaScript stack frames return undefined.
-    return heap->undefined_value();
-  }
-
-  StackTraceFrameIterator it(isolate, id);
-  int inlined_jsframe_index =
-      DebugFrameHelper::FindIndexedNonNativeFrame(&it, index);
-  // Liveedit is not supported on Wasm.
-  if (inlined_jsframe_index == -1 || it.is_wasm()) {
-    return heap->undefined_value();
-  }
-  // We don't really care what the inlined frame index is, since we are
-  // throwing away the entire frame anyways.
-  const char* error_message = LiveEdit::RestartFrame(it.javascript_frame());
-  if (error_message) {
-    return *(isolate->factory()->InternalizeUtf8String(error_message));
-  }
-  return heap->true_value();
-}
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/src/runtime/runtime-module.cc b/deps/v8/src/runtime/runtime-module.cc
index a7580503061a16..5c59a2f997ef5e 100644
--- a/deps/v8/src/runtime/runtime-module.cc
+++ b/deps/v8/src/runtime/runtime-module.cc
@@ -7,6 +7,8 @@
 #include "src/arguments.h"
 #include "src/counters.h"
 #include "src/objects-inl.h"
+#include "src/objects/js-promise.h"
+#include "src/objects/module.h"
 
 namespace v8 {
 namespace internal {
@@ -17,7 +19,7 @@ RUNTIME_FUNCTION(Runtime_DynamicImportCall) {
   CONVERT_ARG_HANDLE_CHECKED(JSFunction, function, 0);
   CONVERT_ARG_HANDLE_CHECKED(Object, specifier, 1);
 
-  Handle<Script> script(Script::cast(function->shared()->script()));
+  Handle<Script> script(Script::cast(function->shared()->script()), isolate);
 
   while (script->has_eval_from_shared()) {
     script =
@@ -33,14 +35,14 @@ RUNTIME_FUNCTION(Runtime_GetModuleNamespace) {
   HandleScope scope(isolate);
   DCHECK_EQ(1, args.length());
   CONVERT_SMI_ARG_CHECKED(module_request, 0);
-  Handle<Module> module(isolate->context()->module());
-  return *Module::GetModuleNamespace(module, module_request);
+  Handle<Module> module(isolate->context()->module(), isolate);
+  return *Module::GetModuleNamespace(isolate, module, module_request);
 }
 
 RUNTIME_FUNCTION(Runtime_GetImportMetaObject) {
   HandleScope scope(isolate);
   DCHECK_EQ(0, args.length());
-  Handle<Module> module(isolate->context()->module());
+  Handle<Module> module(isolate->context()->module(), isolate);
   return *isolate->RunHostInitializeImportMetaObjectCallback(module);
 }
 
diff --git a/deps/v8/src/runtime/runtime-numbers.cc b/deps/v8/src/runtime/runtime-numbers.cc
index 260e6be45b400c..322586e51f1d2d 100644
--- a/deps/v8/src/runtime/runtime-numbers.cc
+++ b/deps/v8/src/runtime/runtime-numbers.cc
@@ -25,7 +25,7 @@ RUNTIME_FUNCTION(Runtime_StringToNumber) {
   HandleScope handle_scope(isolate);
   DCHECK_EQ(1, args.length());
   CONVERT_ARG_HANDLE_CHECKED(String, subject, 0);
-  return *String::ToNumber(subject);
+  return *String::ToNumber(isolate, subject);
 }
 
 
@@ -40,7 +40,7 @@ RUNTIME_FUNCTION(Runtime_StringParseInt) {
   Handle<String> subject;
   ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, subject,
                                      Object::ToString(isolate, string));
-  subject = String::Flatten(subject);
+  subject = String::Flatten(isolate, subject);
 
   // Convert {radix} to Int32.
   if (!radix->IsNumber()) {
@@ -48,7 +48,7 @@ RUNTIME_FUNCTION(Runtime_StringParseInt) {
   }
   int radix32 = DoubleToInt32(radix->Number());
   if (radix32 != 0 && (radix32 < 2 || radix32 > 36)) {
-    return isolate->heap()->nan_value();
+    return ReadOnlyRoots(isolate).nan_value();
   }
 
   double result = StringToInt(isolate, subject, radix32);
@@ -62,9 +62,9 @@ RUNTIME_FUNCTION(Runtime_StringParseFloat) {
   DCHECK_EQ(1, args.length());
   CONVERT_ARG_HANDLE_CHECKED(String, subject, 0);
 
-  double value =
-      StringToDouble(isolate->unicode_cache(), subject, ALLOW_TRAILING_JUNK,
-                     std::numeric_limits<double>::quiet_NaN());
+  double value = StringToDouble(isolate, isolate->unicode_cache(), subject,
+                                ALLOW_TRAILING_JUNK,
+                                std::numeric_limits<double>::quiet_NaN());
 
   return *isolate->factory()->NewNumber(value);
 }
@@ -77,26 +77,6 @@ RUNTIME_FUNCTION(Runtime_NumberToStringSkipCache) {
   return *isolate->factory()->NumberToString(number, false);
 }
 
-
-// Converts a Number to a Smi, if possible. Returns NaN if the number is not
-// a small integer.
-RUNTIME_FUNCTION(Runtime_NumberToSmi) {
-  SealHandleScope shs(isolate);
-  DCHECK_EQ(1, args.length());
-  CONVERT_ARG_CHECKED(Object, obj, 0);
-  if (obj->IsSmi()) {
-    return obj;
-  }
-  if (obj->IsHeapNumber()) {
-    double value = HeapNumber::cast(obj)->value();
-    int int_value = FastD2I(value);
-    if (value == FastI2D(int_value) && Smi::IsValid(int_value)) {
-      return Smi::FromInt(int_value);
-    }
-  }
-  return isolate->heap()->nan_value();
-}
-
 // Compare two Smis x, y as if they were converted to strings and then
 // compared lexicographically. Returns:
 // -1 if x < y
diff --git a/deps/v8/src/runtime/runtime-object.cc b/deps/v8/src/runtime/runtime-object.cc
index b68315f2863b89..8d40fe5226ceb6 100644
--- a/deps/v8/src/runtime/runtime-object.cc
+++ b/deps/v8/src/runtime/runtime-object.cc
@@ -9,6 +9,7 @@
 #include "src/debug/debug.h"
 #include "src/isolate-inl.h"
 #include "src/messages.h"
+#include "src/objects/hash-table-inl.h"
 #include "src/objects/property-descriptor-object.h"
 #include "src/property-descriptor.h"
 #include "src/runtime/runtime.h"
@@ -21,6 +22,9 @@ MaybeHandle<Object> Runtime::GetObjectProperty(Isolate* isolate,
                                                Handle<Object> key,
                                                bool* is_found_out) {
   if (object->IsNullOrUndefined(isolate)) {
+    if (*key == ReadOnlyRoots(isolate).iterator_symbol()) {
+      return Runtime::ThrowIteratorError(isolate, object);
+    }
     THROW_NEW_ERROR(
         isolate,
         NewTypeError(MessageTemplate::kNonObjectPropertyLoad, key, object),
@@ -126,7 +130,7 @@ static MaybeHandle<Object> KeyedGetObjectProperty(Isolate* isolate,
     if (index >= 0 && index < str->length()) {
       Factory* factory = isolate->factory();
       return factory->LookupSingleCharacterStringFromCode(
-          String::Flatten(str)->Get(index));
+          String::Flatten(isolate, str)->Get(index));
     }
   }
 
@@ -176,9 +180,9 @@ bool DeleteObjectPropertyFast(Isolate* isolate, Handle<JSReceiver> receiver,
     if (!index.is_inobject() && index.outobject_array_index() == 0) {
       DCHECK(!Map::cast(backpointer)->HasOutOfObjectProperties());
       // Clear out the properties backing store.
-      receiver->SetProperties(isolate->heap()->empty_fixed_array());
+      receiver->SetProperties(ReadOnlyRoots(isolate).empty_fixed_array());
     } else {
-      Object* filler = isolate->heap()->one_pointer_filler_map();
+      Object* filler = ReadOnlyRoots(isolate).one_pointer_filler_map();
       JSObject::cast(*receiver)->RawFastPropertyAtPut(index, filler);
       // We must clear any recorded slot for the deleted property, because
       // subsequent object modifications might put a raw double there.
@@ -198,8 +202,8 @@ bool DeleteObjectPropertyFast(Isolate* isolate, Handle<JSReceiver> receiver,
   // Finally, perform the map rollback.
   receiver->synchronized_set_map(Map::cast(backpointer));
 #if VERIFY_HEAP
-  receiver->HeapObjectVerify();
-  receiver->property_array()->PropertyArrayVerify();
+  receiver->HeapObjectVerify(isolate);
+  receiver->property_array()->PropertyArrayVerify(isolate);
 #endif
   return true;
 }
@@ -240,6 +244,56 @@ RUNTIME_FUNCTION(Runtime_ObjectKeys) {
   return *keys;
 }
 
+// ES #sec-object.getOwnPropertyNames
+RUNTIME_FUNCTION(Runtime_ObjectGetOwnPropertyNames) {
+  HandleScope scope(isolate);
+  Handle<Object> object = args.at(0);
+
+  // Convert the {object} to a proper {receiver}.
+  Handle<JSReceiver> receiver;
+  ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, receiver,
+                                     Object::ToObject(isolate, object));
+
+  // Collect the own keys for the {receiver}.
+  Handle<FixedArray> keys;
+  ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
+      isolate, keys,
+      KeyAccumulator::GetKeys(receiver, KeyCollectionMode::kOwnOnly,
+                              SKIP_SYMBOLS,
+                              GetKeysConversion::kConvertToString));
+  return *keys;
+}
+
+RUNTIME_FUNCTION(Runtime_ObjectGetOwnPropertyNamesTryFast) {
+  HandleScope scope(isolate);
+  Handle<Object> object = args.at(0);
+
+  // Convert the {object} to a proper {receiver}.
+  Handle<JSReceiver> receiver;
+  ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, receiver,
+                                     Object::ToObject(isolate, object));
+
+  Handle<Map> map(receiver->map(), isolate);
+
+  int nod = map->NumberOfOwnDescriptors();
+  Handle<FixedArray> keys;
+  if (nod != 0 && map->NumberOfEnumerableProperties() == nod) {
+    ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
+        isolate, keys,
+        KeyAccumulator::GetKeys(receiver, KeyCollectionMode::kOwnOnly,
+                                ENUMERABLE_STRINGS,
+                                GetKeysConversion::kConvertToString));
+  } else {
+    ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
+        isolate, keys,
+        KeyAccumulator::GetKeys(receiver, KeyCollectionMode::kOwnOnly,
+                                SKIP_SYMBOLS,
+                                GetKeysConversion::kConvertToString));
+  }
+
+  return *keys;
+}
+
 // ES6 19.1.3.2
 RUNTIME_FUNCTION(Runtime_ObjectHasOwnProperty) {
   HandleScope scope(isolate);
@@ -261,12 +315,12 @@ RUNTIME_FUNCTION(Runtime_ObjectHasOwnProperty) {
     if (key.is_null()) {
       DCHECK(key_is_array_index);
       // Namespace objects can't have indexed properties.
-      return isolate->heap()->false_value();
+      return ReadOnlyRoots(isolate).false_value();
     }
 
     Maybe<bool> result =
         JSReceiver::HasOwnProperty(Handle<JSReceiver>::cast(object), key);
-    if (!result.IsJust()) return isolate->heap()->exception();
+    if (!result.IsJust()) return ReadOnlyRoots(isolate).exception();
     return isolate->heap()->ToBoolean(result.FromJust());
 
   } else if (object->IsJSObject()) {
@@ -282,16 +336,16 @@ RUNTIME_FUNCTION(Runtime_ObjectHasOwnProperty) {
           key_is_array_index ? LookupIterator(isolate, js_obj, index, js_obj, c)
                              : LookupIterator(js_obj, key, js_obj, c);
       Maybe<bool> maybe = JSReceiver::HasProperty(&it);
-      if (maybe.IsNothing()) return isolate->heap()->exception();
+      if (maybe.IsNothing()) return ReadOnlyRoots(isolate).exception();
       DCHECK(!isolate->has_pending_exception());
-      if (maybe.FromJust()) return isolate->heap()->true_value();
+      if (maybe.FromJust()) return ReadOnlyRoots(isolate).true_value();
     }
 
     Map* map = js_obj->map();
     if (!map->has_hidden_prototype() &&
         (key_is_array_index ? !map->has_indexed_interceptor()
                             : !map->has_named_interceptor())) {
-      return isolate->heap()->false_value();
+      return ReadOnlyRoots(isolate).false_value();
     }
 
     // Slow case.
@@ -301,7 +355,7 @@ RUNTIME_FUNCTION(Runtime_ObjectHasOwnProperty) {
                             : LookupIterator(js_obj, key, js_obj, c);
 
     Maybe<bool> maybe = JSReceiver::HasProperty(&it);
-    if (maybe.IsNothing()) return isolate->heap()->exception();
+    if (maybe.IsNothing()) return ReadOnlyRoots(isolate).exception();
     DCHECK(!isolate->has_pending_exception());
     return isolate->heap()->ToBoolean(maybe.FromJust());
 
@@ -313,20 +367,20 @@ RUNTIME_FUNCTION(Runtime_ObjectHasOwnProperty) {
 
     Maybe<bool> result =
         JSReceiver::HasOwnProperty(Handle<JSProxy>::cast(object), key);
-    if (result.IsNothing()) return isolate->heap()->exception();
+    if (result.IsNothing()) return ReadOnlyRoots(isolate).exception();
     return isolate->heap()->ToBoolean(result.FromJust());
 
   } else if (object->IsString()) {
     return isolate->heap()->ToBoolean(
         key_is_array_index
             ? index < static_cast<uint32_t>(String::cast(*object)->length())
-            : key->Equals(isolate->heap()->length_string()));
+            : key->Equals(ReadOnlyRoots(isolate).length_string()));
   } else if (object->IsNullOrUndefined(isolate)) {
     THROW_NEW_ERROR_RETURN_FAILURE(
         isolate, NewTypeError(MessageTemplate::kUndefinedOrNullToObject));
   }
 
-  return isolate->heap()->false_value();
+  return ReadOnlyRoots(isolate).false_value();
 }
 
 RUNTIME_FUNCTION(Runtime_AddDictionaryProperty) {
@@ -360,7 +414,7 @@ RUNTIME_FUNCTION(Runtime_ObjectCreate) {
   // TODO(bmeurer): Use a dedicated cache for Object.create; think about
   // slack tracking for Object.create.
   Handle<Map> map =
-      Map::GetObjectCreateMap(Handle<HeapObject>::cast(prototype));
+      Map::GetObjectCreateMap(isolate, Handle<HeapObject>::cast(prototype));
 
   // Actually allocate the object.
   Handle<JSObject> object;
@@ -431,13 +485,13 @@ RUNTIME_FUNCTION(Runtime_InternalSetPrototype) {
       Handle<Map> function_map(function->map(), isolate);
       if (!JSFunction::SetName(function, isolate->factory()->proto_string(),
                                isolate->factory()->empty_string())) {
-        return isolate->heap()->exception();
+        return ReadOnlyRoots(isolate).exception();
       }
       CHECK_EQ(*function_map, function->map());
     }
   }
   MAYBE_RETURN(JSReceiver::SetPrototype(obj, prototype, false, kThrowOnError),
-               isolate->heap()->exception());
+               ReadOnlyRoots(isolate).exception());
   return *obj;
 }
 
@@ -548,7 +602,7 @@ RUNTIME_FUNCTION(Runtime_AddNamedProperty) {
   DCHECK(!name->ToArrayIndex(&index));
   LookupIterator it(object, name, object, LookupIterator::OWN_SKIP_INTERCEPTOR);
   Maybe<PropertyAttributes> maybe = JSReceiver::GetPropertyAttributes(&it);
-  if (maybe.IsNothing()) return isolate->heap()->exception();
+  if (maybe.IsNothing()) return ReadOnlyRoots(isolate).exception();
   DCHECK(!it.IsFound());
 #endif
 
@@ -574,7 +628,7 @@ RUNTIME_FUNCTION(Runtime_AddElement) {
   LookupIterator it(isolate, object, index, object,
                     LookupIterator::OWN_SKIP_INTERCEPTOR);
   Maybe<PropertyAttributes> maybe = JSReceiver::GetPropertyAttributes(&it);
-  if (maybe.IsNothing()) return isolate->heap()->exception();
+  if (maybe.IsNothing()) return ReadOnlyRoots(isolate).exception();
   DCHECK(!it.IsFound());
 
   if (object->IsJSArray()) {
@@ -613,7 +667,7 @@ Object* DeleteProperty(Isolate* isolate, Handle<Object> object,
                                      Object::ToObject(isolate, object));
   Maybe<bool> result =
       Runtime::DeleteObjectProperty(isolate, receiver, key, language_mode);
-  MAYBE_RETURN(result, isolate->heap()->exception());
+  MAYBE_RETURN(result, ReadOnlyRoots(isolate).exception());
   return isolate->heap()->ToBoolean(result.FromJust());
 }
 
@@ -661,7 +715,7 @@ RUNTIME_FUNCTION(Runtime_HasProperty) {
 
   // Lookup the {name} on {receiver}.
   Maybe<bool> maybe = JSReceiver::HasProperty(receiver, name);
-  if (maybe.IsNothing()) return isolate->heap()->exception();
+  if (maybe.IsNothing()) return ReadOnlyRoots(isolate).exception();
   return isolate->heap()->ToBoolean(maybe.FromJust());
 }
 
@@ -683,24 +737,6 @@ RUNTIME_FUNCTION(Runtime_GetOwnPropertyKeys) {
 }
 
 
-// Return information on whether an object has a named or indexed interceptor.
-// args[0]: object
-RUNTIME_FUNCTION(Runtime_GetInterceptorInfo) {
-  HandleScope scope(isolate);
-  DCHECK_EQ(1, args.length());
-  if (!args[0]->IsJSObject()) {
-    return Smi::kZero;
-  }
-  CONVERT_ARG_HANDLE_CHECKED(JSObject, obj, 0);
-
-  int result = 0;
-  if (obj->HasNamedInterceptor()) result |= 2;
-  if (obj->HasIndexedInterceptor()) result |= 1;
-
-  return Smi::FromInt(result);
-}
-
-
 RUNTIME_FUNCTION(Runtime_ToFastProperties) {
   HandleScope scope(isolate);
   DCHECK_EQ(1, args.length());
@@ -734,9 +770,9 @@ RUNTIME_FUNCTION(Runtime_CompleteInobjectSlackTrackingForMap) {
   DCHECK_EQ(1, args.length());
 
   CONVERT_ARG_HANDLE_CHECKED(Map, initial_map, 0);
-  initial_map->CompleteInobjectSlackTracking();
+  initial_map->CompleteInobjectSlackTracking(isolate);
 
-  return isolate->heap()->undefined_value();
+  return ReadOnlyRoots(isolate).undefined_value();
 }
 
 
@@ -782,7 +818,7 @@ RUNTIME_FUNCTION(Runtime_DefineAccessorPropertyUnchecked) {
 
   RETURN_FAILURE_ON_EXCEPTION(
       isolate, JSObject::DefineAccessor(obj, name, getter, setter, attrs));
-  return isolate->heap()->undefined_value();
+  return ReadOnlyRoots(isolate).undefined_value();
 }
 
 
@@ -799,14 +835,14 @@ RUNTIME_FUNCTION(Runtime_DefineDataPropertyInLiteral) {
   FeedbackNexus nexus(vector, FeedbackVector::ToSlot(index));
   if (nexus.ic_state() == UNINITIALIZED) {
     if (name->IsUniqueName()) {
-      nexus.ConfigureMonomorphic(name, handle(object->map()),
-                                 Handle<Code>::null());
+      nexus.ConfigureMonomorphic(name, handle(object->map(), isolate),
+                                 MaybeObjectHandle());
     } else {
       nexus.ConfigureMegamorphic(PROPERTY);
     }
   } else if (nexus.ic_state() == MONOMORPHIC) {
     if (nexus.FindFirstMap() != object->map() ||
-        nexus.GetFeedbackExtra() != *name) {
+        nexus.GetFeedbackExtra() != MaybeObject::FromObject(*name)) {
       nexus.ConfigureMegamorphic(PROPERTY);
     }
   }
@@ -825,7 +861,7 @@ RUNTIME_FUNCTION(Runtime_DefineDataPropertyInLiteral) {
     Handle<Map> function_map(function->map(), isolate);
     if (!JSFunction::SetName(function, name,
                              isolate->factory()->empty_string())) {
-      return isolate->heap()->exception();
+      return ReadOnlyRoots(isolate).exception();
     }
     // Class constructors do not reserve in-object space for name field.
     CHECK_IMPLIES(!IsClassConstructor(function->shared()->kind()),
@@ -856,14 +892,14 @@ RUNTIME_FUNCTION(Runtime_CollectTypeProfile) {
   } else if (value->IsNull(isolate)) {
     // typeof(null) is object. But it's more user-friendly to annotate
     // null as type "null".
-    type = Handle<String>(isolate->heap()->null_string());
+    type = Handle<String>(ReadOnlyRoots(isolate).null_string(), isolate);
   }
 
   DCHECK(vector->metadata()->HasTypeProfileSlot());
   FeedbackNexus nexus(vector, vector->GetTypeProfileSlot());
   nexus.Collect(type, position->value());
 
-  return isolate->heap()->undefined_value();
+  return ReadOnlyRoots(isolate).undefined_value();
 }
 
 RUNTIME_FUNCTION(Runtime_HasFastPackedElements) {
@@ -896,7 +932,7 @@ RUNTIME_FUNCTION(Runtime_ClassOf) {
   SealHandleScope shs(isolate);
   DCHECK_EQ(1, args.length());
   CONVERT_ARG_CHECKED(Object, obj, 0);
-  if (!obj->IsJSReceiver()) return isolate->heap()->null_value();
+  if (!obj->IsJSReceiver()) return ReadOnlyRoots(isolate).null_value();
   return JSReceiver::cast(obj)->class_name();
 }
 
@@ -918,7 +954,7 @@ RUNTIME_FUNCTION(Runtime_DefineGetterPropertyUnchecked) {
   if (String::cast(getter->shared()->Name())->length() == 0) {
     Handle<Map> getter_map(getter->map(), isolate);
     if (!JSFunction::SetName(getter, name, isolate->factory()->get_string())) {
-      return isolate->heap()->exception();
+      return ReadOnlyRoots(isolate).exception();
     }
     CHECK_EQ(*getter_map, getter->map());
   }
@@ -927,7 +963,23 @@ RUNTIME_FUNCTION(Runtime_DefineGetterPropertyUnchecked) {
       isolate,
       JSObject::DefineAccessor(object, name, getter,
                                isolate->factory()->null_value(), attrs));
-  return isolate->heap()->undefined_value();
+  return ReadOnlyRoots(isolate).undefined_value();
+}
+
+RUNTIME_FUNCTION(Runtime_SetDataProperties) {
+  HandleScope scope(isolate);
+  DCHECK_EQ(2, args.length());
+  CONVERT_ARG_HANDLE_CHECKED(JSReceiver, target, 0);
+  CONVERT_ARG_HANDLE_CHECKED(Object, source, 1);
+
+  // 2. If source is undefined or null, let keys be an empty List.
+  if (source->IsUndefined(isolate) || source->IsNull(isolate)) {
+    return ReadOnlyRoots(isolate).undefined_value();
+  }
+
+  MAYBE_RETURN(JSReceiver::SetOrCopyDataProperties(isolate, target, source),
+               ReadOnlyRoots(isolate).exception());
+  return ReadOnlyRoots(isolate).undefined_value();
 }
 
 RUNTIME_FUNCTION(Runtime_CopyDataProperties) {
@@ -938,13 +990,13 @@ RUNTIME_FUNCTION(Runtime_CopyDataProperties) {
 
   // 2. If source is undefined or null, let keys be an empty List.
   if (source->IsUndefined(isolate) || source->IsNull(isolate)) {
-    return isolate->heap()->undefined_value();
+    return ReadOnlyRoots(isolate).undefined_value();
   }
 
   MAYBE_RETURN(JSReceiver::SetOrCopyDataProperties(isolate, target, source,
                                                    nullptr, false),
-               isolate->heap()->exception());
-  return isolate->heap()->undefined_value();
+               ReadOnlyRoots(isolate).exception());
+  return ReadOnlyRoots(isolate).undefined_value();
 }
 
 RUNTIME_FUNCTION(Runtime_CopyDataPropertiesWithExcludedProperties) {
@@ -954,7 +1006,7 @@ RUNTIME_FUNCTION(Runtime_CopyDataPropertiesWithExcludedProperties) {
 
   // 2. If source is undefined or null, let keys be an empty List.
   if (source->IsUndefined(isolate) || source->IsNull(isolate)) {
-    return isolate->heap()->undefined_value();
+    return ReadOnlyRoots(isolate).undefined_value();
   }
 
   ScopedVector<Handle<Object>> excluded_properties(args.length() - 1);
@@ -977,7 +1029,7 @@ RUNTIME_FUNCTION(Runtime_CopyDataPropertiesWithExcludedProperties) {
       isolate->factory()->NewJSObject(isolate->object_function());
   MAYBE_RETURN(JSReceiver::SetOrCopyDataProperties(isolate, target, source,
                                                    &excluded_properties, false),
-               isolate->heap()->exception());
+               ReadOnlyRoots(isolate).exception());
   return *target;
 }
 
@@ -1019,7 +1071,7 @@ RUNTIME_FUNCTION(Runtime_DefineMethodsInternal) {
 
   for (int i = 0; i < keys->length(); ++i) {
     Handle<Name> key = Handle<Name>::cast(FixedArray::get(*keys, i, isolate));
-    if (*key == isolate->heap()->constructor_string()) continue;
+    if (*key == ReadOnlyRoots(isolate).constructor_string()) continue;
 
     PropertyDescriptor descriptor;
     Maybe<bool> did_get_descriptor =
@@ -1036,7 +1088,7 @@ RUNTIME_FUNCTION(Runtime_DefineMethodsInternal) {
         isolate, target, key, &descriptor, kDontThrow);
     CHECK(success.FromJust());
   }
-  return isolate->heap()->undefined_value();
+  return ReadOnlyRoots(isolate).undefined_value();
 }
 
 RUNTIME_FUNCTION(Runtime_DefineSetterPropertyUnchecked) {
@@ -1050,7 +1102,7 @@ RUNTIME_FUNCTION(Runtime_DefineSetterPropertyUnchecked) {
   if (String::cast(setter->shared()->Name())->length() == 0) {
     Handle<Map> setter_map(setter->map(), isolate);
     if (!JSFunction::SetName(setter, name, isolate->factory()->set_string())) {
-      return isolate->heap()->exception();
+      return ReadOnlyRoots(isolate).exception();
     }
     CHECK_EQ(*setter_map, setter->map());
   }
@@ -1059,7 +1111,7 @@ RUNTIME_FUNCTION(Runtime_DefineSetterPropertyUnchecked) {
       isolate,
       JSObject::DefineAccessor(object, name, isolate->factory()->null_value(),
                                setter, attrs));
-  return isolate->heap()->undefined_value();
+  return ReadOnlyRoots(isolate).undefined_value();
 }
 
 RUNTIME_FUNCTION(Runtime_ToObject) {
@@ -1152,10 +1204,10 @@ RUNTIME_FUNCTION(Runtime_HasInPrototypeChain) {
   DCHECK_EQ(2, args.length());
   CONVERT_ARG_HANDLE_CHECKED(Object, object, 0);
   CONVERT_ARG_HANDLE_CHECKED(Object, prototype, 1);
-  if (!object->IsJSReceiver()) return isolate->heap()->false_value();
+  if (!object->IsJSReceiver()) return ReadOnlyRoots(isolate).false_value();
   Maybe<bool> result = JSReceiver::HasInPrototypeChain(
       isolate, Handle<JSReceiver>::cast(object), prototype);
-  MAYBE_RETURN(result, isolate->heap()->exception());
+  MAYBE_RETURN(result, ReadOnlyRoots(isolate).exception());
   return isolate->heap()->ToBoolean(result.FromJust());
 }
 
@@ -1166,7 +1218,8 @@ RUNTIME_FUNCTION(Runtime_CreateIterResultObject) {
   DCHECK_EQ(2, args.length());
   CONVERT_ARG_HANDLE_CHECKED(Object, value, 0);
   CONVERT_ARG_HANDLE_CHECKED(Object, done, 1);
-  return *isolate->factory()->NewJSIteratorResult(value, done->BooleanValue());
+  return *isolate->factory()->NewJSIteratorResult(value,
+                                                  done->BooleanValue(isolate));
 }
 
 RUNTIME_FUNCTION(Runtime_CreateDataProperty) {
@@ -1178,9 +1231,9 @@ RUNTIME_FUNCTION(Runtime_CreateDataProperty) {
   bool success;
   LookupIterator it = LookupIterator::PropertyOrElement(
       isolate, o, key, &success, LookupIterator::OWN);
-  if (!success) return isolate->heap()->exception();
+  if (!success) return ReadOnlyRoots(isolate).exception();
   MAYBE_RETURN(JSReceiver::CreateDataProperty(&it, value, kThrowOnError),
-               isolate->heap()->exception());
+               ReadOnlyRoots(isolate).exception());
   return *value;
 }
 
@@ -1215,9 +1268,9 @@ RUNTIME_FUNCTION(Runtime_GetOwnPropertyDescriptor) {
   PropertyDescriptor desc;
   Maybe<bool> found =
       JSReceiver::GetOwnPropertyDescriptor(isolate, object, name, &desc);
-  MAYBE_RETURN(found, isolate->heap()->exception());
+  MAYBE_RETURN(found, ReadOnlyRoots(isolate).exception());
 
-  if (!found.FromJust()) return isolate->heap()->undefined_value();
+  if (!found.FromJust()) return ReadOnlyRoots(isolate).undefined_value();
   return *desc.ToPropertyDescriptorObject(isolate);
 }
 
@@ -1240,7 +1293,7 @@ RUNTIME_FUNCTION(Runtime_AddPrivateField) {
   CHECK(Object::AddDataProperty(&it, value, NONE, kDontThrow,
                                 Object::MAY_BE_STORE_FROM_KEYED)
             .FromJust());
-  return isolate->heap()->undefined_value();
+  return ReadOnlyRoots(isolate).undefined_value();
 }
 
 }  // namespace internal
diff --git a/deps/v8/src/runtime/runtime-operators.cc b/deps/v8/src/runtime/runtime-operators.cc
index d01d11589246e1..d2d55ed753f8fa 100644
--- a/deps/v8/src/runtime/runtime-operators.cc
+++ b/deps/v8/src/runtime/runtime-operators.cc
@@ -23,8 +23,8 @@ RUNTIME_FUNCTION(Runtime_Equal) {
   DCHECK_EQ(2, args.length());
   CONVERT_ARG_HANDLE_CHECKED(Object, x, 0);
   CONVERT_ARG_HANDLE_CHECKED(Object, y, 1);
-  Maybe<bool> result = Object::Equals(x, y);
-  if (result.IsNothing()) return isolate->heap()->exception();
+  Maybe<bool> result = Object::Equals(isolate, x, y);
+  if (result.IsNothing()) return ReadOnlyRoots(isolate).exception();
   return isolate->heap()->ToBoolean(result.FromJust());
 }
 
@@ -33,8 +33,8 @@ RUNTIME_FUNCTION(Runtime_NotEqual) {
   DCHECK_EQ(2, args.length());
   CONVERT_ARG_HANDLE_CHECKED(Object, x, 0);
   CONVERT_ARG_HANDLE_CHECKED(Object, y, 1);
-  Maybe<bool> result = Object::Equals(x, y);
-  if (result.IsNothing()) return isolate->heap()->exception();
+  Maybe<bool> result = Object::Equals(isolate, x, y);
+  if (result.IsNothing()) return ReadOnlyRoots(isolate).exception();
   return isolate->heap()->ToBoolean(!result.FromJust());
 }
 
@@ -59,8 +59,8 @@ RUNTIME_FUNCTION(Runtime_LessThan) {
   DCHECK_EQ(2, args.length());
   CONVERT_ARG_HANDLE_CHECKED(Object, x, 0);
   CONVERT_ARG_HANDLE_CHECKED(Object, y, 1);
-  Maybe<bool> result = Object::LessThan(x, y);
-  if (result.IsNothing()) return isolate->heap()->exception();
+  Maybe<bool> result = Object::LessThan(isolate, x, y);
+  if (result.IsNothing()) return ReadOnlyRoots(isolate).exception();
   return isolate->heap()->ToBoolean(result.FromJust());
 }
 
@@ -69,8 +69,8 @@ RUNTIME_FUNCTION(Runtime_GreaterThan) {
   DCHECK_EQ(2, args.length());
   CONVERT_ARG_HANDLE_CHECKED(Object, x, 0);
   CONVERT_ARG_HANDLE_CHECKED(Object, y, 1);
-  Maybe<bool> result = Object::GreaterThan(x, y);
-  if (result.IsNothing()) return isolate->heap()->exception();
+  Maybe<bool> result = Object::GreaterThan(isolate, x, y);
+  if (result.IsNothing()) return ReadOnlyRoots(isolate).exception();
   return isolate->heap()->ToBoolean(result.FromJust());
 }
 
@@ -79,8 +79,8 @@ RUNTIME_FUNCTION(Runtime_LessThanOrEqual) {
   DCHECK_EQ(2, args.length());
   CONVERT_ARG_HANDLE_CHECKED(Object, x, 0);
   CONVERT_ARG_HANDLE_CHECKED(Object, y, 1);
-  Maybe<bool> result = Object::LessThanOrEqual(x, y);
-  if (result.IsNothing()) return isolate->heap()->exception();
+  Maybe<bool> result = Object::LessThanOrEqual(isolate, x, y);
+  if (result.IsNothing()) return ReadOnlyRoots(isolate).exception();
   return isolate->heap()->ToBoolean(result.FromJust());
 }
 
@@ -89,8 +89,8 @@ RUNTIME_FUNCTION(Runtime_GreaterThanOrEqual) {
   DCHECK_EQ(2, args.length());
   CONVERT_ARG_HANDLE_CHECKED(Object, x, 0);
   CONVERT_ARG_HANDLE_CHECKED(Object, y, 1);
-  Maybe<bool> result = Object::GreaterThanOrEqual(x, y);
-  if (result.IsNothing()) return isolate->heap()->exception();
+  Maybe<bool> result = Object::GreaterThanOrEqual(isolate, x, y);
+  if (result.IsNothing()) return ReadOnlyRoots(isolate).exception();
   return isolate->heap()->ToBoolean(result.FromJust());
 }
 
diff --git a/deps/v8/src/runtime/runtime-promise.cc b/deps/v8/src/runtime/runtime-promise.cc
index f5b9db3c028b0e..ec78904710cbb4 100644
--- a/deps/v8/src/runtime/runtime-promise.cc
+++ b/deps/v8/src/runtime/runtime-promise.cc
@@ -10,6 +10,7 @@
 #include "src/debug/debug.h"
 #include "src/elements.h"
 #include "src/objects-inl.h"
+#include "src/objects/js-promise-inl.h"
 
 namespace v8 {
 namespace internal {
@@ -35,7 +36,27 @@ RUNTIME_FUNCTION(Runtime_PromiseRejectEventFromStack) {
     isolate->ReportPromiseReject(promise, value,
                                  v8::kPromiseRejectWithNoHandler);
   }
-  return isolate->heap()->undefined_value();
+  return ReadOnlyRoots(isolate).undefined_value();
+}
+
+RUNTIME_FUNCTION(Runtime_PromiseRejectAfterResolved) {
+  DCHECK_EQ(2, args.length());
+  HandleScope scope(isolate);
+  CONVERT_ARG_HANDLE_CHECKED(JSPromise, promise, 0);
+  CONVERT_ARG_HANDLE_CHECKED(Object, reason, 1);
+  isolate->ReportPromiseReject(promise, reason,
+                               v8::kPromiseRejectAfterResolved);
+  return ReadOnlyRoots(isolate).undefined_value();
+}
+
+RUNTIME_FUNCTION(Runtime_PromiseResolveAfterResolved) {
+  DCHECK_EQ(2, args.length());
+  HandleScope scope(isolate);
+  CONVERT_ARG_HANDLE_CHECKED(JSPromise, promise, 0);
+  CONVERT_ARG_HANDLE_CHECKED(Object, resolution, 1);
+  isolate->ReportPromiseReject(promise, resolution,
+                               v8::kPromiseResolveAfterResolved);
+  return ReadOnlyRoots(isolate).undefined_value();
 }
 
 RUNTIME_FUNCTION(Runtime_PromiseRevokeReject) {
@@ -46,7 +67,7 @@ RUNTIME_FUNCTION(Runtime_PromiseRevokeReject) {
   CHECK(!promise->has_handler());
   isolate->ReportPromiseReject(promise, Handle<Object>(),
                                v8::kPromiseHandlerAddedAfterReject);
-  return isolate->heap()->undefined_value();
+  return ReadOnlyRoots(isolate).undefined_value();
 }
 
 RUNTIME_FUNCTION(Runtime_EnqueueMicrotask) {
@@ -56,14 +77,14 @@ RUNTIME_FUNCTION(Runtime_EnqueueMicrotask) {
   Handle<CallableTask> microtask =
       isolate->factory()->NewCallableTask(function, isolate->native_context());
   isolate->EnqueueMicrotask(microtask);
-  return isolate->heap()->undefined_value();
+  return ReadOnlyRoots(isolate).undefined_value();
 }
 
 RUNTIME_FUNCTION(Runtime_RunMicrotasks) {
   HandleScope scope(isolate);
   DCHECK_EQ(0, args.length());
   isolate->RunMicrotasks();
-  return isolate->heap()->undefined_value();
+  return ReadOnlyRoots(isolate).undefined_value();
 }
 
 RUNTIME_FUNCTION(Runtime_RunMicrotaskCallback) {
@@ -75,7 +96,7 @@ RUNTIME_FUNCTION(Runtime_RunMicrotaskCallback) {
   void* data = ToCData<void*>(microtask_data);
   callback(data);
   RETURN_FAILURE_IF_SCHEDULED_EXCEPTION(isolate);
-  return isolate->heap()->undefined_value();
+  return ReadOnlyRoots(isolate).undefined_value();
 }
 
 RUNTIME_FUNCTION(Runtime_PromiseStatus) {
@@ -99,7 +120,7 @@ RUNTIME_FUNCTION(Runtime_PromiseMarkAsHandled) {
   CONVERT_ARG_CHECKED(JSPromise, promise, 0);
 
   promise->set_has_handler(true);
-  return isolate->heap()->undefined_value();
+  return ReadOnlyRoots(isolate).undefined_value();
 }
 
 RUNTIME_FUNCTION(Runtime_PromiseHookInit) {
@@ -108,35 +129,54 @@ RUNTIME_FUNCTION(Runtime_PromiseHookInit) {
   CONVERT_ARG_HANDLE_CHECKED(JSPromise, promise, 0);
   CONVERT_ARG_HANDLE_CHECKED(Object, parent, 1);
   isolate->RunPromiseHook(PromiseHookType::kInit, promise, parent);
-  return isolate->heap()->undefined_value();
+  return ReadOnlyRoots(isolate).undefined_value();
+}
+
+RUNTIME_FUNCTION(Runtime_AwaitPromisesInit) {
+  DCHECK_EQ(3, args.length());
+  HandleScope scope(isolate);
+  CONVERT_ARG_HANDLE_CHECKED(JSPromise, wrapped_value, 0);
+  CONVERT_ARG_HANDLE_CHECKED(JSPromise, outer_promise, 1);
+  CONVERT_ARG_HANDLE_CHECKED(JSPromise, throwaway, 2);
+  isolate->RunPromiseHook(PromiseHookType::kInit, wrapped_value, outer_promise);
+  isolate->RunPromiseHook(PromiseHookType::kInit, throwaway, wrapped_value);
+  // On inspector side we capture async stack trace and store it by
+  // outer_promise->async_task_id when async function is suspended first time.
+  // To use captured stack trace later throwaway promise should have the same
+  // async_task_id as outer_promise since we generate WillHandle and DidHandle
+  // events using throwaway promise.
+  throwaway->set_async_task_id(outer_promise->async_task_id());
+  return ReadOnlyRoots(isolate).undefined_value();
 }
 
 RUNTIME_FUNCTION(Runtime_PromiseHookBefore) {
   HandleScope scope(isolate);
   DCHECK_EQ(1, args.length());
   CONVERT_ARG_HANDLE_CHECKED(JSReceiver, maybe_promise, 0);
-  if (!maybe_promise->IsJSPromise()) return isolate->heap()->undefined_value();
+  if (!maybe_promise->IsJSPromise())
+    return ReadOnlyRoots(isolate).undefined_value();
   Handle<JSPromise> promise = Handle<JSPromise>::cast(maybe_promise);
   if (isolate->debug()->is_active()) isolate->PushPromise(promise);
   if (promise->IsJSPromise()) {
     isolate->RunPromiseHook(PromiseHookType::kBefore, promise,
                             isolate->factory()->undefined_value());
   }
-  return isolate->heap()->undefined_value();
+  return ReadOnlyRoots(isolate).undefined_value();
 }
 
 RUNTIME_FUNCTION(Runtime_PromiseHookAfter) {
   HandleScope scope(isolate);
   DCHECK_EQ(1, args.length());
   CONVERT_ARG_HANDLE_CHECKED(JSReceiver, maybe_promise, 0);
-  if (!maybe_promise->IsJSPromise()) return isolate->heap()->undefined_value();
+  if (!maybe_promise->IsJSPromise())
+    return ReadOnlyRoots(isolate).undefined_value();
   Handle<JSPromise> promise = Handle<JSPromise>::cast(maybe_promise);
   if (isolate->debug()->is_active()) isolate->PopPromise();
   if (promise->IsJSPromise()) {
     isolate->RunPromiseHook(PromiseHookType::kAfter, promise,
                             isolate->factory()->undefined_value());
   }
-  return isolate->heap()->undefined_value();
+  return ReadOnlyRoots(isolate).undefined_value();
 }
 
 RUNTIME_FUNCTION(Runtime_RejectPromise) {
@@ -145,7 +185,8 @@ RUNTIME_FUNCTION(Runtime_RejectPromise) {
   CONVERT_ARG_HANDLE_CHECKED(JSPromise, promise, 0);
   CONVERT_ARG_HANDLE_CHECKED(Object, reason, 1);
   CONVERT_ARG_HANDLE_CHECKED(Oddball, debug_event, 2);
-  return *JSPromise::Reject(promise, reason, debug_event->BooleanValue());
+  return *JSPromise::Reject(promise, reason,
+                            debug_event->BooleanValue(isolate));
 }
 
 RUNTIME_FUNCTION(Runtime_ResolvePromise) {
diff --git a/deps/v8/src/runtime/runtime-proxy.cc b/deps/v8/src/runtime/runtime-proxy.cc
index 5340d31843a2b1..8101ea6d293bfd 100644
--- a/deps/v8/src/runtime/runtime-proxy.cc
+++ b/deps/v8/src/runtime/runtime-proxy.cc
@@ -41,19 +41,23 @@ RUNTIME_FUNCTION(Runtime_JSProxyGetTarget) {
 RUNTIME_FUNCTION(Runtime_GetPropertyWithReceiver) {
   HandleScope scope(isolate);
 
-  DCHECK_EQ(3, args.length());
+  DCHECK_EQ(4, args.length());
   CONVERT_ARG_HANDLE_CHECKED(JSReceiver, holder, 0);
   CONVERT_ARG_HANDLE_CHECKED(Object, key, 1);
   CONVERT_ARG_HANDLE_CHECKED(Object, receiver, 2);
+  CONVERT_ARG_HANDLE_CHECKED(Smi, on_non_existent, 3);
 
   bool success = false;
   LookupIterator it = LookupIterator::PropertyOrElement(isolate, receiver, key,
                                                         &success, holder);
   if (!success) {
     DCHECK(isolate->has_pending_exception());
-    return isolate->heap()->exception();
+    return ReadOnlyRoots(isolate).exception();
   }
-  RETURN_RESULT_OR_FAILURE(isolate, Object::GetProperty(&it));
+
+  RETURN_RESULT_OR_FAILURE(
+      isolate, Object::GetProperty(
+                   &it, static_cast<OnNonExistent>(on_non_existent->value())));
 }
 
 RUNTIME_FUNCTION(Runtime_SetPropertyWithReceiver) {
@@ -71,11 +75,11 @@ RUNTIME_FUNCTION(Runtime_SetPropertyWithReceiver) {
                                                         &success, holder);
   if (!success) {
     DCHECK(isolate->has_pending_exception());
-    return isolate->heap()->exception();
+    return ReadOnlyRoots(isolate).exception();
   }
   Maybe<bool> result = Object::SetSuperProperty(
       &it, value, language_mode, Object::MAY_BE_STORE_FROM_KEYED);
-  MAYBE_RETURN(result, isolate->heap()->exception());
+  MAYBE_RETURN(result, ReadOnlyRoots(isolate).exception());
   return *isolate->factory()->ToBoolean(result.FromJust());
 }
 
@@ -101,7 +105,7 @@ RUNTIME_FUNCTION(Runtime_CheckProxyHasTrap) {
   CONVERT_ARG_HANDLE_CHECKED(JSReceiver, target, 1);
 
   Maybe<bool> result = JSProxy::CheckHasTrap(isolate, name, target);
-  if (!result.IsJust()) return isolate->heap()->exception();
+  if (!result.IsJust()) return ReadOnlyRoots(isolate).exception();
   return isolate->heap()->ToBoolean(result.FromJust());
 }
 
diff --git a/deps/v8/src/runtime/runtime-regexp.cc b/deps/v8/src/runtime/runtime-regexp.cc
index dd65c1dee63f09..556918b69bb06d 100644
--- a/deps/v8/src/runtime/runtime-regexp.cc
+++ b/deps/v8/src/runtime/runtime-regexp.cc
@@ -68,8 +68,9 @@ class CompiledReplacement {
       : parts_(1, zone), replacement_substrings_(0, zone), zone_(zone) {}
 
   // Return whether the replacement is simple.
-  bool Compile(Handle<JSRegExp> regexp, Handle<String> replacement,
-               int capture_count, int subject_length);
+  bool Compile(Isolate* isolate, Handle<JSRegExp> regexp,
+               Handle<String> replacement, int capture_count,
+               int subject_length);
 
   // Use Apply only if Compile returned false.
   void Apply(ReplacementStringBuilder* builder, int match_from, int match_to,
@@ -148,9 +149,6 @@ class CompiledReplacement {
     // Equivalent to String::GetSubstitution, except that this method converts
     // the replacement string into an internal representation that avoids
     // repeated parsing when used repeatedly.
-    DCHECK_IMPLIES(capture_name_map != nullptr,
-                   FLAG_harmony_regexp_named_captures);
-
     int length = characters.length();
     int last = 0;
     for (int i = 0; i < length; i++) {
@@ -315,7 +313,7 @@ class CompiledReplacement {
   Zone* zone_;
 };
 
-bool CompiledReplacement::Compile(Handle<JSRegExp> regexp,
+bool CompiledReplacement::Compile(Isolate* isolate, Handle<JSRegExp> regexp,
                                   Handle<String> replacement, int capture_count,
                                   int subject_length) {
   {
@@ -328,7 +326,6 @@ bool CompiledReplacement::Compile(Handle<JSRegExp> regexp,
       DCHECK_EQ(regexp->TypeTag(), JSRegExp::IRREGEXP);
       Object* maybe_capture_name_map = regexp->CaptureNameMap();
       if (maybe_capture_name_map->IsFixedArray()) {
-        DCHECK(FLAG_harmony_regexp_named_captures);
         capture_name_map = FixedArray::cast(maybe_capture_name_map);
       }
     }
@@ -347,7 +344,6 @@ bool CompiledReplacement::Compile(Handle<JSRegExp> regexp,
     if (simple) return true;
   }
 
-  Isolate* isolate = replacement->GetIsolate();
   // Find substrings of replacement string and create them as String objects.
   int substring_index = 0;
   for (int i = 0, n = parts_.length(); i < n; i++) {
@@ -561,7 +557,7 @@ V8_WARN_UNUSED_RESULT static Object* StringReplaceGlobalAtomRegExpWithString(
     result_len = static_cast<int>(result_len_64);
   }
   if (result_len == 0) {
-    return isolate->heap()->empty_string();
+    return ReadOnlyRoots(isolate).empty_string();
   }
 
   int subject_pos = 0;
@@ -601,7 +597,8 @@ V8_WARN_UNUSED_RESULT static Object* StringReplaceGlobalAtomRegExpWithString(
   }
 
   int32_t match_indices[] = {indices->back(), indices->back() + pattern_len};
-  RegExpImpl::SetLastMatchInfo(last_match_info, subject, 0, match_indices);
+  RegExpImpl::SetLastMatchInfo(isolate, last_match_info, subject, 0,
+                               match_indices);
 
   TruncateRegexpIndicesList(isolate);
 
@@ -620,9 +617,9 @@ V8_WARN_UNUSED_RESULT static Object* StringReplaceGlobalRegExpWithString(
   JSRegExp::Type typeTag = regexp->TypeTag();
   if (typeTag == JSRegExp::IRREGEXP) {
     // Ensure the RegExp is compiled so we can access the capture-name map.
-    if (RegExpImpl::IrregexpPrepare(regexp, subject) == -1) {
+    if (RegExpImpl::IrregexpPrepare(isolate, regexp, subject) == -1) {
       DCHECK(isolate->has_pending_exception());
-      return isolate->heap()->exception();
+      return ReadOnlyRoots(isolate).exception();
     }
   }
 
@@ -630,7 +627,7 @@ V8_WARN_UNUSED_RESULT static Object* StringReplaceGlobalRegExpWithString(
   Zone zone(isolate->allocator(), ZONE_NAME);
   CompiledReplacement compiled_replacement(&zone);
   const bool simple_replace = compiled_replacement.Compile(
-      regexp, replacement, capture_count, subject_length);
+      isolate, regexp, replacement, capture_count, subject_length);
 
   // Shortcut for simple non-regexp global replacements
   if (typeTag == JSRegExp::ATOM && simple_replace) {
@@ -644,11 +641,11 @@ V8_WARN_UNUSED_RESULT static Object* StringReplaceGlobalRegExpWithString(
   }
 
   RegExpImpl::GlobalCache global_cache(regexp, subject, isolate);
-  if (global_cache.HasException()) return isolate->heap()->exception();
+  if (global_cache.HasException()) return ReadOnlyRoots(isolate).exception();
 
   int32_t* current_match = global_cache.FetchNext();
   if (current_match == nullptr) {
-    if (global_cache.HasException()) return isolate->heap()->exception();
+    if (global_cache.HasException()) return ReadOnlyRoots(isolate).exception();
     return *subject;
   }
 
@@ -685,14 +682,14 @@ V8_WARN_UNUSED_RESULT static Object* StringReplaceGlobalRegExpWithString(
     current_match = global_cache.FetchNext();
   } while (current_match != nullptr);
 
-  if (global_cache.HasException()) return isolate->heap()->exception();
+  if (global_cache.HasException()) return ReadOnlyRoots(isolate).exception();
 
   if (prev < subject_length) {
     builder.EnsureCapacity(2);
     builder.AddSubjectSlice(prev, subject_length);
   }
 
-  RegExpImpl::SetLastMatchInfo(last_match_info, subject, capture_count,
+  RegExpImpl::SetLastMatchInfo(isolate, last_match_info, subject, capture_count,
                                global_cache.LastSuccessfulMatch());
 
   RETURN_RESULT_OR_FAILURE(isolate, builder.ToString());
@@ -717,11 +714,11 @@ V8_WARN_UNUSED_RESULT static Object* StringReplaceGlobalRegExpWithEmptyString(
   }
 
   RegExpImpl::GlobalCache global_cache(regexp, subject, isolate);
-  if (global_cache.HasException()) return isolate->heap()->exception();
+  if (global_cache.HasException()) return ReadOnlyRoots(isolate).exception();
 
   int32_t* current_match = global_cache.FetchNext();
   if (current_match == nullptr) {
-    if (global_cache.HasException()) return isolate->heap()->exception();
+    if (global_cache.HasException()) return ReadOnlyRoots(isolate).exception();
     return *subject;
   }
 
@@ -731,7 +728,7 @@ V8_WARN_UNUSED_RESULT static Object* StringReplaceGlobalRegExpWithEmptyString(
   int subject_length = subject->length();
 
   int new_length = subject_length - (end - start);
-  if (new_length == 0) return isolate->heap()->empty_string();
+  if (new_length == 0) return ReadOnlyRoots(isolate).empty_string();
 
   Handle<ResultSeqString> answer;
   if (ResultSeqString::kHasOneByteEncoding) {
@@ -758,9 +755,9 @@ V8_WARN_UNUSED_RESULT static Object* StringReplaceGlobalRegExpWithEmptyString(
     current_match = global_cache.FetchNext();
   } while (current_match != nullptr);
 
-  if (global_cache.HasException()) return isolate->heap()->exception();
+  if (global_cache.HasException()) return ReadOnlyRoots(isolate).exception();
 
-  RegExpImpl::SetLastMatchInfo(last_match_info, subject, capture_count,
+  RegExpImpl::SetLastMatchInfo(isolate, last_match_info, subject, capture_count,
                                global_cache.LastSuccessfulMatch());
 
   if (prev < subject_length) {
@@ -770,7 +767,7 @@ V8_WARN_UNUSED_RESULT static Object* StringReplaceGlobalRegExpWithEmptyString(
     position += subject_length - prev;
   }
 
-  if (position == 0) return isolate->heap()->empty_string();
+  if (position == 0) return ReadOnlyRoots(isolate).empty_string();
 
   // Shorten string and fill
   int string_size = ResultSeqString::SizeFor(position);
@@ -802,7 +799,7 @@ Object* StringReplaceGlobalRegExpWithStringHelper(
     Handle<String> replacement, Handle<RegExpMatchInfo> last_match_info) {
   CHECK(regexp->GetFlags() & JSRegExp::kGlobal);
 
-  subject = String::Flatten(subject);
+  subject = String::Flatten(isolate, subject);
 
   if (replacement->length() == 0) {
     if (subject->HasOnlyOneByteChars()) {
@@ -814,7 +811,7 @@ Object* StringReplaceGlobalRegExpWithStringHelper(
     }
   }
 
-  replacement = String::Flatten(replacement);
+  replacement = String::Flatten(isolate, replacement);
 
   return StringReplaceGlobalRegExpWithString(isolate, subject, regexp,
                                              replacement, last_match_info);
@@ -853,8 +850,8 @@ RUNTIME_FUNCTION(Runtime_StringSplit) {
   // isn't empty, we can never create more parts than ~half the length
   // of the subject.
 
-  subject = String::Flatten(subject);
-  pattern = String::Flatten(pattern);
+  subject = String::Flatten(isolate, subject);
+  pattern = String::Flatten(isolate, pattern);
 
   std::vector<int>* indices = GetRewoundRegexpIndicesList(isolate);
 
@@ -875,7 +872,7 @@ RUNTIME_FUNCTION(Runtime_StringSplit) {
 
   DCHECK(result->HasObjectElements());
 
-  Handle<FixedArray> elements(FixedArray::cast(result->elements()));
+  Handle<FixedArray> elements(FixedArray::cast(result->elements()), isolate);
 
   if (part_count == 1 && indices->at(0) == subject_length) {
     elements->set(0, *subject);
@@ -915,8 +912,8 @@ RUNTIME_FUNCTION(Runtime_RegExpExec) {
   CHECK_LE(0, index);
   CHECK_GE(subject->length(), index);
   isolate->counters()->regexp_entry_runtime()->Increment();
-  RETURN_RESULT_OR_FAILURE(
-      isolate, RegExpImpl::Exec(regexp, subject, index, last_match_info));
+  RETURN_RESULT_OR_FAILURE(isolate, RegExpImpl::Exec(isolate, regexp, subject,
+                                                     index, last_match_info));
 }
 
 RUNTIME_FUNCTION(Runtime_RegExpInternalReplace) {
@@ -941,14 +938,13 @@ class MatchInfoBackedMatch : public String::Match {
                        Handle<String> subject,
                        Handle<RegExpMatchInfo> match_info)
       : isolate_(isolate), match_info_(match_info) {
-    subject_ = String::Flatten(subject);
+    subject_ = String::Flatten(isolate, subject);
 
     if (regexp->TypeTag() == JSRegExp::IRREGEXP) {
       Object* o = regexp->CaptureNameMap();
       has_named_captures_ = o->IsFixedArray();
       if (has_named_captures_) {
-        DCHECK(FLAG_harmony_regexp_named_captures);
-        capture_name_map_ = handle(FixedArray::cast(o));
+        capture_name_map_ = handle(FixedArray::cast(o), isolate);
       }
     } else {
       has_named_captures_ = false;
@@ -1031,7 +1027,7 @@ class VectorBackedMatch : public String::Match {
         match_(match),
         match_position_(match_position),
         captures_(captures) {
-    subject_ = String::Flatten(subject);
+    subject_ = String::Flatten(isolate, subject);
 
     DCHECK(groups_obj->IsUndefined(isolate) || groups_obj->IsJSReceiver());
     has_named_captures_ = !groups_obj->IsUndefined(isolate);
@@ -1105,7 +1101,6 @@ class VectorBackedMatch : public String::Match {
 Handle<JSObject> ConstructNamedCaptureGroupsObject(
     Isolate* isolate, Handle<FixedArray> capture_map,
     std::function<Object*(int)> f_get_capture) {
-  DCHECK(FLAG_harmony_regexp_named_captures);
   Handle<JSObject> groups = isolate->factory()->NewJSObjectWithNullProto();
 
   const int capture_count = capture_map->length() >> 1;
@@ -1113,14 +1108,15 @@ Handle<JSObject> ConstructNamedCaptureGroupsObject(
     const int name_ix = i * 2;
     const int index_ix = i * 2 + 1;
 
-    Handle<String> capture_name(String::cast(capture_map->get(name_ix)));
+    Handle<String> capture_name(String::cast(capture_map->get(name_ix)),
+                                isolate);
     const int capture_ix = Smi::ToInt(capture_map->get(index_ix));
     DCHECK(1 <= capture_ix && capture_ix <= capture_count);
 
     Handle<Object> capture_value(f_get_capture(capture_ix), isolate);
     DCHECK(capture_value->IsUndefined(isolate) || capture_value->IsString());
 
-    JSObject::AddProperty(groups, capture_name, capture_value, NONE);
+    JSObject::AddProperty(isolate, groups, capture_name, capture_value, NONE);
   }
 
   return groups;
@@ -1154,26 +1150,26 @@ static Object* SearchRegExpMultiple(Isolate* isolate, Handle<String> subject,
         last_match[i] = Smi::ToInt(last_match_cache->get(i));
       }
       Handle<FixedArray> cached_fixed_array =
-          Handle<FixedArray>(FixedArray::cast(cached_answer));
+          Handle<FixedArray>(FixedArray::cast(cached_answer), isolate);
       // The cache FixedArray is a COW-array and we need to return a copy.
       Handle<FixedArray> copied_fixed_array =
           isolate->factory()->CopyFixedArrayWithMap(
               cached_fixed_array, isolate->factory()->fixed_array_map());
       JSArray::SetContent(result_array, copied_fixed_array);
-      RegExpImpl::SetLastMatchInfo(last_match_array, subject, capture_count,
-                                   last_match);
+      RegExpImpl::SetLastMatchInfo(isolate, last_match_array, subject,
+                                   capture_count, last_match);
       DeleteArray(last_match);
       return *result_array;
     }
   }
 
   RegExpImpl::GlobalCache global_cache(regexp, subject, isolate);
-  if (global_cache.HasException()) return isolate->heap()->exception();
+  if (global_cache.HasException()) return ReadOnlyRoots(isolate).exception();
 
   // Ensured in Runtime_RegExpExecMultiple.
   DCHECK(result_array->HasObjectElements());
-  Handle<FixedArray> result_elements(
-      FixedArray::cast(result_array->elements()));
+  Handle<FixedArray> result_elements(FixedArray::cast(result_array->elements()),
+                                     isolate);
   if (result_elements->length() < 16) {
     result_elements = isolate->factory()->NewFixedArrayWithHoles(16);
   }
@@ -1218,7 +1214,6 @@ static Object* SearchRegExpMultiple(Isolate* isolate, Handle<String> subject,
 
         Handle<Object> maybe_capture_map(regexp->CaptureNameMap(), isolate);
         const bool has_named_captures = maybe_capture_map->IsFixedArray();
-        DCHECK_IMPLIES(has_named_captures, FLAG_harmony_regexp_named_captures);
 
         const int argc =
             has_named_captures ? 4 + capture_count : 3 + capture_count;
@@ -1237,7 +1232,7 @@ static Object* SearchRegExpMultiple(Isolate* isolate, Handle<String> subject,
             elements->set(cursor++, *substring);
           } else {
             DCHECK_GT(0, current_match[i * 2 + 1]);
-            elements->set(cursor++, isolate->heap()->undefined_value());
+            elements->set(cursor++, ReadOnlyRoots(isolate).undefined_value());
           }
         }
 
@@ -1260,7 +1255,7 @@ static Object* SearchRegExpMultiple(Isolate* isolate, Handle<String> subject,
     }
   }
 
-  if (global_cache.HasException()) return isolate->heap()->exception();
+  if (global_cache.HasException()) return ReadOnlyRoots(isolate).exception();
 
   if (match_start >= 0) {
     // Finished matching, with at least one match.
@@ -1269,7 +1264,8 @@ static Object* SearchRegExpMultiple(Isolate* isolate, Handle<String> subject,
                                                 subject_length);
     }
 
-    RegExpImpl::SetLastMatchInfo(last_match_array, subject, capture_count,
+    RegExpImpl::SetLastMatchInfo(isolate, last_match_array, subject,
+                                 capture_count,
                                  global_cache.LastSuccessfulMatch());
 
     if (subject_length > kMinLengthToCache) {
@@ -1282,8 +1278,8 @@ static Object* SearchRegExpMultiple(Isolate* isolate, Handle<String> subject,
       for (int i = 0; i < capture_registers; i++) {
         last_match_cache->set(i, Smi::FromInt(last_match[i]));
       }
-      Handle<FixedArray> result_fixed_array = builder.array();
-      result_fixed_array->Shrink(builder.length());
+      Handle<FixedArray> result_fixed_array =
+          FixedArray::ShrinkOrEmpty(builder.array(), builder.length());
       // Cache the result and copy the FixedArray into a COW array.
       Handle<FixedArray> copied_fixed_array =
           isolate->factory()->CopyFixedArrayWithMap(
@@ -1294,7 +1290,7 @@ static Object* SearchRegExpMultiple(Isolate* isolate, Handle<String> subject,
     }
     return *builder.ToJSArray(result_array);
   } else {
-    return isolate->heap()->null_value();  // No matches at all.
+    return ReadOnlyRoots(isolate).null_value();  // No matches at all.
   }
 }
 
@@ -1316,7 +1312,7 @@ V8_WARN_UNUSED_RESULT MaybeHandle<String> RegExpReplace(
   Handle<String> replace;
   ASSIGN_RETURN_ON_EXCEPTION(isolate, replace,
                              Object::ToString(isolate, replace_obj), String);
-  replace = String::Flatten(replace);
+  replace = String::Flatten(isolate, replace);
 
   Handle<RegExpMatchInfo> last_match_info = isolate->regexp_last_match_info();
 
@@ -1337,7 +1333,8 @@ V8_WARN_UNUSED_RESULT MaybeHandle<String> RegExpReplace(
     Handle<Object> match_indices_obj;
     ASSIGN_RETURN_ON_EXCEPTION(
         isolate, match_indices_obj,
-        RegExpImpl::Exec(regexp, string, last_index, last_match_info), String);
+        RegExpImpl::Exec(isolate, regexp, string, last_index, last_match_info),
+        String);
 
     if (match_indices_obj->IsNull(isolate)) {
       if (sticky) regexp->set_last_index(Smi::kZero, SKIP_WRITE_BARRIER);
@@ -1412,7 +1409,7 @@ RUNTIME_FUNCTION(Runtime_RegExpExecMultiple) {
   CONVERT_ARG_HANDLE_CHECKED(JSArray, result_array, 3);
   CHECK(result_array->HasObjectElements());
 
-  subject = String::Flatten(subject);
+  subject = String::Flatten(isolate, subject);
   CHECK(regexp->GetFlags() & JSRegExp::kGlobal);
 
   if (regexp->CaptureCount() == 0) {
@@ -1456,7 +1453,7 @@ RUNTIME_FUNCTION(Runtime_StringReplaceNonGlobalRegExpWithFunction) {
   Handle<Object> match_indices_obj;
   ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
       isolate, match_indices_obj,
-      RegExpImpl::Exec(regexp, subject, last_index, last_match_info));
+      RegExpImpl::Exec(isolate, regexp, subject, last_index, last_match_info));
 
   if (match_indices_obj->IsNull(isolate)) {
     if (sticky) regexp->set_last_index(Smi::kZero, SKIP_WRITE_BARRIER);
@@ -1491,11 +1488,10 @@ RUNTIME_FUNCTION(Runtime_StringReplaceNonGlobalRegExpWithFunction) {
     Object* maybe_capture_map = regexp->CaptureNameMap();
     if (maybe_capture_map->IsFixedArray()) {
       has_named_captures = true;
-      capture_map = handle(FixedArray::cast(maybe_capture_map));
+      capture_map = handle(FixedArray::cast(maybe_capture_map), isolate);
     }
   }
 
-  DCHECK_IMPLIES(has_named_captures, FLAG_harmony_regexp_named_captures);
   const uint32_t argc = GetArgcForReplaceCallable(m, has_named_captures);
   if (argc == static_cast<uint32_t>(-1)) {
     THROW_NEW_ERROR_RETURN_FAILURE(
@@ -1561,8 +1557,8 @@ V8_WARN_UNUSED_RESULT MaybeHandle<Object> ToUint32(Isolate* isolate,
 Handle<JSArray> NewJSArrayWithElements(Isolate* isolate,
                                        Handle<FixedArray> elems,
                                        int num_elems) {
-  elems->Shrink(num_elems);
-  return isolate->factory()->NewJSArrayWithElements(elems);
+  return isolate->factory()->NewJSArrayWithElements(
+      FixedArray::ShrinkOrEmpty(elems, num_elems));
 }
 
 }  // namespace
@@ -1589,7 +1585,8 @@ RUNTIME_FUNCTION(Runtime_RegExpSplit) {
 
   Handle<Object> flags_obj;
   ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
-      isolate, flags_obj, JSObject::GetProperty(recv, factory->flags_string()));
+      isolate, flags_obj,
+      JSObject::GetProperty(isolate, recv, factory->flags_string()));
 
   Handle<String> flags;
   ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, flags,
@@ -1734,7 +1731,7 @@ RUNTIME_FUNCTION(Runtime_RegExpReplace) {
 
   Factory* factory = isolate->factory();
 
-  string = String::Flatten(string);
+  string = String::Flatten(isolate, string);
 
   // Fast-path for unmodified JSRegExps.
   if (RegExpUtils::IsUnmodifiedRegExp(isolate, recv)) {
@@ -1755,16 +1752,16 @@ RUNTIME_FUNCTION(Runtime_RegExpReplace) {
   Handle<Object> global_obj;
   ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
       isolate, global_obj,
-      JSReceiver::GetProperty(recv, factory->global_string()));
-  const bool global = global_obj->BooleanValue();
+      JSReceiver::GetProperty(isolate, recv, factory->global_string()));
+  const bool global = global_obj->BooleanValue(isolate);
 
   bool unicode = false;
   if (global) {
     Handle<Object> unicode_obj;
     ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
         isolate, unicode_obj,
-        JSReceiver::GetProperty(recv, factory->unicode_string()));
-    unicode = unicode_obj->BooleanValue();
+        JSReceiver::GetProperty(isolate, recv, factory->unicode_string()));
+    unicode = unicode_obj->BooleanValue(isolate);
 
     RETURN_FAILURE_ON_EXCEPTION(isolate,
                                 RegExpUtils::SetLastIndex(isolate, recv, 0));
@@ -1851,14 +1848,11 @@ RUNTIME_FUNCTION(Runtime_RegExpReplace) {
     }
 
     Handle<Object> groups_obj = isolate->factory()->undefined_value();
-    if (FLAG_harmony_regexp_named_captures) {
-      ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
-          isolate, groups_obj,
-          Object::GetProperty(result, factory->groups_string()));
-    }
+    ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
+        isolate, groups_obj,
+        Object::GetProperty(result, factory->groups_string()));
 
     const bool has_named_captures = !groups_obj->IsUndefined(isolate);
-    DCHECK_IMPLIES(has_named_captures, FLAG_harmony_regexp_named_captures);
 
     Handle<String> replacement;
     if (functional_replace) {
diff --git a/deps/v8/src/runtime/runtime-scopes.cc b/deps/v8/src/runtime/runtime-scopes.cc
index 9483949674b643..8e323b18d56c7b 100644
--- a/deps/v8/src/runtime/runtime-scopes.cc
+++ b/deps/v8/src/runtime/runtime-scopes.cc
@@ -14,6 +14,7 @@
 #include "src/frames-inl.h"
 #include "src/isolate-inl.h"
 #include "src/messages.h"
+#include "src/objects/module-inl.h"
 
 namespace v8 {
 namespace internal {
@@ -49,7 +50,7 @@ Object* DeclareGlobal(
     Handle<FeedbackVector> feedback_vector = Handle<FeedbackVector>(),
     FeedbackSlot slot = FeedbackSlot::Invalid()) {
   Handle<ScriptContextTable> script_contexts(
-      global->native_context()->script_context_table());
+      global->native_context()->script_context_table(), isolate);
   ScriptContextTable::LookupResult lookup;
   if (ScriptContextTable::Lookup(script_contexts, name, &lookup) &&
       IsLexicalVariableMode(lookup.mode)) {
@@ -70,14 +71,14 @@ Object* DeclareGlobal(
   }
   LookupIterator it(global, name, global, lookup_config);
   Maybe<PropertyAttributes> maybe = JSReceiver::GetPropertyAttributes(&it);
-  if (maybe.IsNothing()) return isolate->heap()->exception();
+  if (maybe.IsNothing()) return ReadOnlyRoots(isolate).exception();
 
   if (it.IsFound()) {
     PropertyAttributes old_attributes = maybe.FromJust();
     // The name was declared before; check for conflicting re-declarations.
 
     // Skip var re-declarations.
-    if (is_var) return isolate->heap()->undefined_value();
+    if (is_var) return ReadOnlyRoots(isolate).undefined_value();
 
     DCHECK(is_function_declaration);
     if ((old_attributes & DONT_DELETE) != 0) {
@@ -127,14 +128,14 @@ Object* DeclareGlobal(
       nexus.ConfigurePropertyCellMode(it.GetPropertyCell());
     }
   }
-  return isolate->heap()->undefined_value();
+  return ReadOnlyRoots(isolate).undefined_value();
 }
 
 Object* DeclareGlobals(Isolate* isolate, Handle<FixedArray> declarations,
                        int flags, Handle<FeedbackVector> feedback_vector) {
   HandleScope scope(isolate);
   Handle<JSGlobalObject> global(isolate->global_object());
-  Handle<Context> context(isolate->context());
+  Handle<Context> context(isolate->context(), isolate);
 
   // Traverse the name/value pairs and set the properties.
   int length = declarations->length();
@@ -158,7 +159,8 @@ Object* DeclareGlobals(Isolate* isolate, Handle<FixedArray> declarations,
       FeedbackSlot feedback_cells_slot(
           Smi::ToInt(*possibly_feedback_cell_slot));
       Handle<FeedbackCell> feedback_cell(
-          FeedbackCell::cast(feedback_vector->Get(feedback_cells_slot)),
+          FeedbackCell::cast(
+              feedback_vector->Get(feedback_cells_slot)->ToStrongHeapObject()),
           isolate);
       Handle<JSFunction> function =
           isolate->factory()->NewFunctionFromSharedFunctionInfo(
@@ -185,7 +187,7 @@ Object* DeclareGlobals(Isolate* isolate, Handle<FixedArray> declarations,
     if (isolate->has_pending_exception()) return result;
   });
 
-  return isolate->heap()->undefined_value();
+  return ReadOnlyRoots(isolate).undefined_value();
 }
 
 }  // namespace
@@ -215,7 +217,8 @@ Object* DeclareEvalHelper(Isolate* isolate, Handle<String> name,
 
   DCHECK(context->IsFunctionContext() || context->IsNativeContext() ||
          context->IsScriptContext() || context->IsEvalContext() ||
-         (context->IsBlockContext() && context->has_extension()));
+         (context->IsBlockContext() &&
+          context->scope_info()->is_declaration_scope()));
 
   bool is_function = value->IsJSFunction();
   bool is_var = !is_function;
@@ -272,44 +275,37 @@ Object* DeclareEvalHelper(Isolate* isolate, Handle<String> name,
     DCHECK_EQ(NONE, attributes);
 
     // Skip var re-declarations.
-    if (is_var) return isolate->heap()->undefined_value();
+    if (is_var) return ReadOnlyRoots(isolate).undefined_value();
 
     DCHECK(is_function);
     if (index != Context::kNotFound) {
       DCHECK(holder.is_identical_to(context));
       context->set(index, *value);
-      return isolate->heap()->undefined_value();
+      return ReadOnlyRoots(isolate).undefined_value();
     }
 
     object = Handle<JSObject>::cast(holder);
 
   } else if (context->has_extension()) {
-    // Sloppy varblock contexts might not have an extension object yet,
-    // in which case their extension is a ScopeInfo.
-    if (context->extension()->IsScopeInfo()) {
-      DCHECK(context->IsBlockContext());
-      object = isolate->factory()->NewJSObject(
-          isolate->context_extension_function());
-      Handle<HeapObject> extension = isolate->factory()->NewContextExtension(
-          handle(context->scope_info()), object);
-      context->set_extension(*extension);
-    } else {
-      object = handle(context->extension_object(), isolate);
-    }
+    object = handle(context->extension_object(), isolate);
     DCHECK(object->IsJSContextExtensionObject() || object->IsJSGlobalObject());
   } else {
-    // Sloppy eval will never have an extension object, as vars are hoisted out,
-    // and lets are known statically.
-    DCHECK(context->IsFunctionContext());
+    // Sloppy varblock and function contexts might not have an extension object
+    // yet. Sloppy eval will never have an extension object, as vars are hoisted
+    // out, and lets are known statically.
+    DCHECK((context->IsBlockContext() &&
+            context->scope_info()->is_declaration_scope()) ||
+           context->IsFunctionContext());
     object =
         isolate->factory()->NewJSObject(isolate->context_extension_function());
+
     context->set_extension(*object);
   }
 
   RETURN_FAILURE_ON_EXCEPTION(isolate, JSObject::SetOwnPropertyIgnoreAttributes(
                                            object, name, value, NONE));
 
-  return isolate->heap()->undefined_value();
+  return ReadOnlyRoots(isolate).undefined_value();
 }
 
 }  // namespace
@@ -411,13 +407,14 @@ Handle<JSObject> NewSloppyArguments(Isolate* isolate, Handle<JSFunction> callee,
       int mapped_count = Min(argument_count, parameter_count);
       Handle<FixedArray> parameter_map =
           isolate->factory()->NewFixedArray(mapped_count + 2, NOT_TENURED);
-      parameter_map->set_map(isolate->heap()->sloppy_arguments_elements_map());
+      parameter_map->set_map(
+          ReadOnlyRoots(isolate).sloppy_arguments_elements_map());
       result->set_map(isolate->native_context()->fast_aliased_arguments_map());
       result->set_elements(*parameter_map);
 
       // Store the context and the arguments array at the beginning of the
       // parameter map.
-      Handle<Context> context(isolate->context());
+      Handle<Context> context(isolate->context(), isolate);
       Handle<FixedArray> arguments =
           isolate->factory()->NewFixedArray(argument_count, NOT_TENURED);
       parameter_map->set(0, *context);
@@ -432,43 +429,24 @@ Handle<JSObject> NewSloppyArguments(Isolate* isolate, Handle<JSFunction> callee,
         --index;
       }
 
-      Handle<ScopeInfo> scope_info(callee->shared()->scope_info());
-      while (index >= 0) {
-        // Detect duplicate names to the right in the parameter list.
-        Handle<String> name(scope_info->ParameterName(index));
-        int context_local_count = scope_info->ContextLocalCount();
-        bool duplicate = false;
-        for (int j = index + 1; j < parameter_count; ++j) {
-          if (scope_info->ParameterName(j) == *name) {
-            duplicate = true;
-            break;
-          }
-        }
-
-        if (duplicate) {
-          // This goes directly in the arguments array with a hole in the
-          // parameter map.
-          arguments->set(index, parameters[index]);
-          parameter_map->set_the_hole(index + 2);
-        } else {
-          // The context index goes in the parameter map with a hole in the
-          // arguments array.
-          int context_index = -1;
-          for (int j = 0; j < context_local_count; ++j) {
-            if (scope_info->ContextLocalName(j) == *name) {
-              context_index = j;
-              break;
-            }
-          }
-
-          DCHECK_GE(context_index, 0);
-          arguments->set_the_hole(index);
-          parameter_map->set(
-              index + 2,
-              Smi::FromInt(Context::MIN_CONTEXT_SLOTS + context_index));
-        }
+      Handle<ScopeInfo> scope_info(callee->shared()->scope_info(), isolate);
 
-        --index;
+      // First mark all mappable slots as unmapped and copy the values into the
+      // arguments object.
+      for (int i = 0; i < mapped_count; i++) {
+        arguments->set(i, parameters[i]);
+        parameter_map->set_the_hole(i + 2);
+      }
+
+      // Walk all context slots to find context allocated parameters. Mark each
+      // found parameter as mapped.
+      for (int i = 0; i < scope_info->ContextLocalCount(); i++) {
+        if (!scope_info->ContextLocalIsParameter(i)) continue;
+        int parameter = scope_info->ContextLocalParameterNumber(i);
+        if (parameter >= mapped_count) continue;
+        arguments->set_the_hole(parameter);
+        Smi* slot = Smi::FromInt(Context::MIN_CONTEXT_SLOTS + i);
+        parameter_map->set(parameter + 2, slot);
       }
     } else {
       // If there is no aliasing, the arguments object elements are not
@@ -649,12 +627,11 @@ RUNTIME_FUNCTION(Runtime_NewClosure_Tenured) {
   return *function;
 }
 
-static Object* FindNameClash(Handle<ScopeInfo> scope_info,
+static Object* FindNameClash(Isolate* isolate, Handle<ScopeInfo> scope_info,
                              Handle<JSGlobalObject> global_object,
                              Handle<ScriptContextTable> script_context) {
-  Isolate* isolate = scope_info->GetIsolate();
   for (int var = 0; var < scope_info->ContextLocalCount(); var++) {
-    Handle<String> name(scope_info->ContextLocalName(var));
+    Handle<String> name(scope_info->ContextLocalName(var), isolate);
     VariableMode mode = scope_info->ContextLocalMode(var);
     ScriptContextTable::LookupResult lookup;
     if (ScriptContextTable::Lookup(script_context, name, &lookup)) {
@@ -671,7 +648,7 @@ static Object* FindNameClash(Handle<ScopeInfo> scope_info,
       LookupIterator it(global_object, name, global_object,
                         LookupIterator::OWN_SKIP_INTERCEPTOR);
       Maybe<PropertyAttributes> maybe = JSReceiver::GetPropertyAttributes(&it);
-      if (maybe.IsNothing()) return isolate->heap()->exception();
+      if (maybe.IsNothing()) return ReadOnlyRoots(isolate).exception();
       if ((maybe.FromJust() & DONT_DELETE) != 0) {
         // ES#sec-globaldeclarationinstantiation 5.a:
         // If envRec.HasVarDeclaration(name) is true, throw a SyntaxError
@@ -685,39 +662,31 @@ static Object* FindNameClash(Handle<ScopeInfo> scope_info,
       JSGlobalObject::InvalidatePropertyCell(global_object, name);
     }
   }
-  return isolate->heap()->undefined_value();
+  return ReadOnlyRoots(isolate).undefined_value();
 }
 
 
 RUNTIME_FUNCTION(Runtime_NewScriptContext) {
   HandleScope scope(isolate);
-  DCHECK_EQ(2, args.length());
+  DCHECK_EQ(1, args.length());
 
-  CONVERT_ARG_HANDLE_CHECKED(JSFunction, function, 0);
-  CONVERT_ARG_HANDLE_CHECKED(ScopeInfo, scope_info, 1);
-  Handle<JSGlobalObject> global_object(function->context()->global_object());
-  Handle<Context> native_context(global_object->native_context());
+  CONVERT_ARG_HANDLE_CHECKED(ScopeInfo, scope_info, 0);
+  Handle<Context> native_context(isolate->context(), isolate);
+  DCHECK(native_context->IsNativeContext());
+  Handle<JSGlobalObject> global_object(native_context->global_object(),
+                                       isolate);
   Handle<ScriptContextTable> script_context_table(
-      native_context->script_context_table());
+      native_context->script_context_table(), isolate);
 
   Object* name_clash_result =
-      FindNameClash(scope_info, global_object, script_context_table);
+      FindNameClash(isolate, scope_info, global_object, script_context_table);
   if (isolate->has_pending_exception()) return name_clash_result;
 
-  // Script contexts have a canonical empty function as their closure, not the
-  // anonymous closure containing the global code.  See
-  // FullCodeGenerator::PushFunctionArgumentForContextAllocation.
-  Handle<JSFunction> closure(function->shared()->IsUserJavaScript()
-                                 ? native_context->closure()
-                                 : *function);
-
   // We do not need script contexts here during bootstrap.
   DCHECK(!isolate->bootstrapper()->IsActive());
-  Handle<Context> result =
-      isolate->factory()->NewScriptContext(closure, scope_info);
 
-  DCHECK(function->context() == isolate->context());
-  DCHECK(*global_object == result->global_object());
+  Handle<Context> result =
+      isolate->factory()->NewScriptContext(native_context, scope_info);
 
   Handle<ScriptContextTable> new_script_context_table =
       ScriptContextTable::Extend(script_context_table, result);
@@ -727,54 +696,47 @@ RUNTIME_FUNCTION(Runtime_NewScriptContext) {
 
 RUNTIME_FUNCTION(Runtime_NewFunctionContext) {
   HandleScope scope(isolate);
-  DCHECK_EQ(2, args.length());
+  DCHECK_EQ(1, args.length());
 
-  CONVERT_ARG_HANDLE_CHECKED(JSFunction, function, 0);
-  CONVERT_SMI_ARG_CHECKED(scope_type, 1);
+  CONVERT_ARG_HANDLE_CHECKED(ScopeInfo, scope_info, 0);
 
-  DCHECK(function->context() == isolate->context());
-  int length = function->shared()->scope_info()->ContextLength();
-  return *isolate->factory()->NewFunctionContext(
-      length, function, static_cast<ScopeType>(scope_type));
+  Handle<Context> outer(isolate->context(), isolate);
+  return *isolate->factory()->NewFunctionContext(outer, scope_info);
 }
 
 RUNTIME_FUNCTION(Runtime_PushWithContext) {
   HandleScope scope(isolate);
-  DCHECK_EQ(3, args.length());
+  DCHECK_EQ(2, args.length());
   CONVERT_ARG_HANDLE_CHECKED(JSReceiver, extension_object, 0);
   CONVERT_ARG_HANDLE_CHECKED(ScopeInfo, scope_info, 1);
-  CONVERT_ARG_HANDLE_CHECKED(JSFunction, function, 2);
-  Handle<Context> current(isolate->context());
-  Handle<Context> context = isolate->factory()->NewWithContext(
-      function, current, scope_info, extension_object);
+  Handle<Context> current(isolate->context(), isolate);
+  Handle<Context> context =
+      isolate->factory()->NewWithContext(current, scope_info, extension_object);
   isolate->set_context(*context);
   return *context;
 }
 
 RUNTIME_FUNCTION(Runtime_PushModuleContext) {
   HandleScope scope(isolate);
-  DCHECK_EQ(3, args.length());
+  DCHECK_EQ(2, args.length());
   CONVERT_ARG_HANDLE_CHECKED(Module, module, 0);
-  CONVERT_ARG_HANDLE_CHECKED(JSFunction, function, 1);
-  CONVERT_ARG_HANDLE_CHECKED(ScopeInfo, scope_info, 2);
-  DCHECK(function->context() == isolate->context());
+  CONVERT_ARG_HANDLE_CHECKED(ScopeInfo, scope_info, 1);
 
+  Handle<Context> outer(isolate->context(), isolate);
   Handle<Context> context =
-      isolate->factory()->NewModuleContext(module, function, scope_info);
+      isolate->factory()->NewModuleContext(module, outer, scope_info);
   isolate->set_context(*context);
   return *context;
 }
 
 RUNTIME_FUNCTION(Runtime_PushCatchContext) {
   HandleScope scope(isolate);
-  DCHECK_EQ(4, args.length());
-  CONVERT_ARG_HANDLE_CHECKED(String, name, 0);
-  CONVERT_ARG_HANDLE_CHECKED(Object, thrown_object, 1);
-  CONVERT_ARG_HANDLE_CHECKED(ScopeInfo, scope_info, 2);
-  CONVERT_ARG_HANDLE_CHECKED(JSFunction, function, 3);
-  Handle<Context> current(isolate->context());
-  Handle<Context> context = isolate->factory()->NewCatchContext(
-      function, current, scope_info, name, thrown_object);
+  DCHECK_EQ(2, args.length());
+  CONVERT_ARG_HANDLE_CHECKED(Object, thrown_object, 0);
+  CONVERT_ARG_HANDLE_CHECKED(ScopeInfo, scope_info, 1);
+  Handle<Context> current(isolate->context(), isolate);
+  Handle<Context> context =
+      isolate->factory()->NewCatchContext(current, scope_info, thrown_object);
   isolate->set_context(*context);
   return *context;
 }
@@ -782,12 +744,11 @@ RUNTIME_FUNCTION(Runtime_PushCatchContext) {
 
 RUNTIME_FUNCTION(Runtime_PushBlockContext) {
   HandleScope scope(isolate);
-  DCHECK_EQ(2, args.length());
+  DCHECK_EQ(1, args.length());
   CONVERT_ARG_HANDLE_CHECKED(ScopeInfo, scope_info, 0);
-  CONVERT_ARG_HANDLE_CHECKED(JSFunction, function, 1);
-  Handle<Context> current(isolate->context());
+  Handle<Context> current(isolate->context(), isolate);
   Handle<Context> context =
-      isolate->factory()->NewBlockContext(function, current, scope_info);
+      isolate->factory()->NewBlockContext(current, scope_info);
   isolate->set_context(*context);
   return *context;
 }
@@ -808,14 +769,15 @@ RUNTIME_FUNCTION(Runtime_DeleteLookupSlot) {
   // If the slot was not found the result is true.
   if (holder.is_null()) {
     // In case of JSProxy, an exception might have been thrown.
-    if (isolate->has_pending_exception()) return isolate->heap()->exception();
-    return isolate->heap()->true_value();
+    if (isolate->has_pending_exception())
+      return ReadOnlyRoots(isolate).exception();
+    return ReadOnlyRoots(isolate).true_value();
   }
 
   // If the slot was found in a context or in module imports and exports it
   // should be DONT_DELETE.
   if (holder->IsContext() || holder->IsModule()) {
-    return isolate->heap()->false_value();
+    return ReadOnlyRoots(isolate).false_value();
   }
 
   // The slot was found in a JSReceiver, either a context extension object,
@@ -823,18 +785,16 @@ RUNTIME_FUNCTION(Runtime_DeleteLookupSlot) {
   // (respecting DONT_DELETE).
   Handle<JSReceiver> object = Handle<JSReceiver>::cast(holder);
   Maybe<bool> result = JSReceiver::DeleteProperty(object, name);
-  MAYBE_RETURN(result, isolate->heap()->exception());
+  MAYBE_RETURN(result, ReadOnlyRoots(isolate).exception());
   return isolate->heap()->ToBoolean(result.FromJust());
 }
 
 
 namespace {
 
-MaybeHandle<Object> LoadLookupSlot(Handle<String> name,
+MaybeHandle<Object> LoadLookupSlot(Isolate* isolate, Handle<String> name,
                                    ShouldThrow should_throw,
                                    Handle<Object>* receiver_return = nullptr) {
-  Isolate* const isolate = name->GetIsolate();
-
   int index;
   PropertyAttributes attributes;
   InitializationFlag flag;
@@ -844,7 +804,7 @@ MaybeHandle<Object> LoadLookupSlot(Handle<String> name,
   if (isolate->has_pending_exception()) return MaybeHandle<Object>();
 
   if (!holder.is_null() && holder->IsModule()) {
-    return Module::LoadVariable(Handle<Module>::cast(holder), index);
+    return Module::LoadVariable(isolate, Handle<Module>::cast(holder), index);
   }
   if (index != Context::kNotFound) {
     DCHECK(holder->IsContext());
@@ -900,7 +860,8 @@ RUNTIME_FUNCTION(Runtime_LoadLookupSlot) {
   HandleScope scope(isolate);
   DCHECK_EQ(1, args.length());
   CONVERT_ARG_HANDLE_CHECKED(String, name, 0);
-  RETURN_RESULT_OR_FAILURE(isolate, LoadLookupSlot(name, kThrowOnError));
+  RETURN_RESULT_OR_FAILURE(isolate,
+                           LoadLookupSlot(isolate, name, kThrowOnError));
 }
 
 
@@ -908,7 +869,7 @@ RUNTIME_FUNCTION(Runtime_LoadLookupSlotInsideTypeof) {
   HandleScope scope(isolate);
   DCHECK_EQ(1, args.length());
   CONVERT_ARG_HANDLE_CHECKED(String, name, 0);
-  RETURN_RESULT_OR_FAILURE(isolate, LoadLookupSlot(name, kDontThrow));
+  RETURN_RESULT_OR_FAILURE(isolate, LoadLookupSlot(isolate, name, kDontThrow));
 }
 
 
@@ -920,8 +881,8 @@ RUNTIME_FUNCTION_RETURN_PAIR(Runtime_LoadLookupSlotForCall) {
   Handle<Object> value;
   Handle<Object> receiver;
   ASSIGN_RETURN_ON_EXCEPTION_VALUE(
-      isolate, value, LoadLookupSlot(name, kThrowOnError, &receiver),
-      MakePair(isolate->heap()->exception(), nullptr));
+      isolate, value, LoadLookupSlot(isolate, name, kThrowOnError, &receiver),
+      MakePair(ReadOnlyRoots(isolate).exception(), nullptr));
   return MakePair(*value, *receiver);
 }
 
@@ -929,9 +890,9 @@ RUNTIME_FUNCTION_RETURN_PAIR(Runtime_LoadLookupSlotForCall) {
 namespace {
 
 MaybeHandle<Object> StoreLookupSlot(
-    Handle<String> name, Handle<Object> value, LanguageMode language_mode,
+    Isolate* isolate, Handle<String> name, Handle<Object> value,
+    LanguageMode language_mode,
     ContextLookupFlags context_lookup_flags = FOLLOW_CHAINS) {
-  Isolate* const isolate = name->GetIsolate();
   Handle<Context> context(isolate->context(), isolate);
 
   int index;
@@ -984,7 +945,7 @@ MaybeHandle<Object> StoreLookupSlot(
         isolate, NewReferenceError(MessageTemplate::kNotDefined, name), Object);
   } else {
     // If absent in sloppy mode: add the property to the global object.
-    object = Handle<JSReceiver>(context->global_object());
+    object = handle(context->global_object(), isolate);
   }
 
   ASSIGN_RETURN_ON_EXCEPTION(
@@ -1001,8 +962,8 @@ RUNTIME_FUNCTION(Runtime_StoreLookupSlot_Sloppy) {
   DCHECK_EQ(2, args.length());
   CONVERT_ARG_HANDLE_CHECKED(String, name, 0);
   CONVERT_ARG_HANDLE_CHECKED(Object, value, 1);
-  RETURN_RESULT_OR_FAILURE(isolate,
-                           StoreLookupSlot(name, value, LanguageMode::kSloppy));
+  RETURN_RESULT_OR_FAILURE(
+      isolate, StoreLookupSlot(isolate, name, value, LanguageMode::kSloppy));
 }
 
 // Store into a dynamic context for sloppy-mode block-scoped function hoisting
@@ -1016,8 +977,8 @@ RUNTIME_FUNCTION(Runtime_StoreLookupSlot_SloppyHoisting) {
   const ContextLookupFlags lookup_flags = static_cast<ContextLookupFlags>(
       FOLLOW_CONTEXT_CHAIN | STOP_AT_DECLARATION_SCOPE | SKIP_WITH_CONTEXT);
   RETURN_RESULT_OR_FAILURE(
-      isolate,
-      StoreLookupSlot(name, value, LanguageMode::kSloppy, lookup_flags));
+      isolate, StoreLookupSlot(isolate, name, value, LanguageMode::kSloppy,
+                               lookup_flags));
 }
 
 RUNTIME_FUNCTION(Runtime_StoreLookupSlot_Strict) {
@@ -1025,8 +986,8 @@ RUNTIME_FUNCTION(Runtime_StoreLookupSlot_Strict) {
   DCHECK_EQ(2, args.length());
   CONVERT_ARG_HANDLE_CHECKED(String, name, 0);
   CONVERT_ARG_HANDLE_CHECKED(Object, value, 1);
-  RETURN_RESULT_OR_FAILURE(isolate,
-                           StoreLookupSlot(name, value, LanguageMode::kStrict));
+  RETURN_RESULT_OR_FAILURE(
+      isolate, StoreLookupSlot(isolate, name, value, LanguageMode::kStrict));
 }
 
 }  // namespace internal
diff --git a/deps/v8/src/runtime/runtime-strings.cc b/deps/v8/src/runtime/runtime-strings.cc
index 6f203b3d012d98..0c3c82deda3c0c 100644
--- a/deps/v8/src/runtime/runtime-strings.cc
+++ b/deps/v8/src/runtime/runtime-strings.cc
@@ -74,8 +74,8 @@ MaybeHandle<String> StringReplaceOneCharWithString(
   recursion_limit--;
   if (subject->IsConsString()) {
     ConsString* cons = ConsString::cast(*subject);
-    Handle<String> first = Handle<String>(cons->first());
-    Handle<String> second = Handle<String>(cons->second());
+    Handle<String> first = handle(cons->first(), isolate);
+    Handle<String> second = handle(cons->second(), isolate);
     Handle<String> new_first;
     if (!StringReplaceOneCharWithString(isolate, first, search, replace, found,
                                         recursion_limit).ToHandle(&new_first)) {
@@ -123,14 +123,16 @@ RUNTIME_FUNCTION(Runtime_StringReplaceOneCharWithString) {
                                      kRecursionLimit).ToHandle(&result)) {
     return *result;
   }
-  if (isolate->has_pending_exception()) return isolate->heap()->exception();
+  if (isolate->has_pending_exception())
+    return ReadOnlyRoots(isolate).exception();
 
-  subject = String::Flatten(subject);
+  subject = String::Flatten(isolate, subject);
   if (StringReplaceOneCharWithString(isolate, subject, search, replace, &found,
                                      kRecursionLimit).ToHandle(&result)) {
     return *result;
   }
-  if (isolate->has_pending_exception()) return isolate->heap()->exception();
+  if (isolate->has_pending_exception())
+    return ReadOnlyRoots(isolate).exception();
   // In case of empty handle and no pending exception we have stack overflow.
   return isolate->StackOverflow();
 }
@@ -141,7 +143,7 @@ RUNTIME_FUNCTION(Runtime_StringTrim) {
   Handle<String> string = args.at<String>(0);
   CONVERT_SMI_ARG_CHECKED(mode, 1);
   String::TrimMode trim_mode = static_cast<String::TrimMode>(mode);
-  return *String::Trim(string, trim_mode);
+  return *String::Trim(isolate, string, trim_mode);
 }
 
 // ES6 #sec-string.prototype.includes
@@ -166,7 +168,7 @@ RUNTIME_FUNCTION(Runtime_StringIncludes) {
   Maybe<bool> is_reg_exp = RegExpUtils::IsRegExp(isolate, search);
   if (is_reg_exp.IsNothing()) {
     DCHECK(isolate->has_pending_exception());
-    return isolate->heap()->exception();
+    return ReadOnlyRoots(isolate).exception();
   }
   if (is_reg_exp.FromJust()) {
     THROW_NEW_ERROR_RETURN_FAILURE(
@@ -257,10 +259,10 @@ RUNTIME_FUNCTION(Runtime_StringCharCodeAt) {
   // Flatten the string.  If someone wants to get a char at an index
   // in a cons string, it is likely that more indices will be
   // accessed.
-  subject = String::Flatten(subject);
+  subject = String::Flatten(isolate, subject);
 
   if (i >= static_cast<uint32_t>(subject->length())) {
-    return isolate->heap()->nan_value();
+    return ReadOnlyRoots(isolate).nan_value();
   }
 
   return Smi::FromInt(subject->Get(i));
@@ -289,7 +291,7 @@ RUNTIME_FUNCTION(Runtime_StringBuilderConcat) {
 
   int special_length = special->length();
   if (!array->HasObjectElements()) {
-    return isolate->Throw(isolate->heap()->illegal_argument_string());
+    return isolate->Throw(ReadOnlyRoots(isolate).illegal_argument_string());
   }
 
   int length;
@@ -303,7 +305,7 @@ RUNTIME_FUNCTION(Runtime_StringBuilderConcat) {
     }
 
     if (array_length == 0) {
-      return isolate->heap()->empty_string();
+      return ReadOnlyRoots(isolate).empty_string();
     } else if (array_length == 1) {
       Object* first = fixed_array->get(0);
       if (first->IsString()) return first;
@@ -313,10 +315,10 @@ RUNTIME_FUNCTION(Runtime_StringBuilderConcat) {
   }
 
   if (length == -1) {
-    return isolate->Throw(isolate->heap()->illegal_argument_string());
+    return isolate->Throw(ReadOnlyRoots(isolate).illegal_argument_string());
   }
   if (length == 0) {
-    return isolate->heap()->empty_string();
+    return ReadOnlyRoots(isolate).empty_string();
   }
 
   if (one_byte) {
@@ -350,13 +352,13 @@ RUNTIME_FUNCTION(Runtime_StringBuilderJoin) {
   CHECK(array->HasObjectElements());
   CHECK_GE(array_length, 0);
 
-  Handle<FixedArray> fixed_array(FixedArray::cast(array->elements()));
+  Handle<FixedArray> fixed_array(FixedArray::cast(array->elements()), isolate);
   if (fixed_array->length() < array_length) {
     array_length = fixed_array->length();
   }
 
   if (array_length == 0) {
-    return isolate->heap()->empty_string();
+    return ReadOnlyRoots(isolate).empty_string();
   } else if (array_length == 1) {
     Object* first = fixed_array->get(0);
     CHECK(first->IsString());
@@ -570,7 +572,7 @@ static int CopyCachedOneByteCharsToArray(Heap* heap, const uint8_t* chars,
                                          FixedArray* elements, int length) {
   DisallowHeapAllocation no_gc;
   FixedArray* one_byte_cache = heap->single_character_string_cache();
-  Object* undefined = heap->undefined_value();
+  Object* undefined = ReadOnlyRoots(heap).undefined_value();
   int i;
   WriteBarrierMode mode = elements->GetWriteBarrierMode(no_gc);
   for (i = 0; i < length; ++i) {
@@ -600,7 +602,7 @@ RUNTIME_FUNCTION(Runtime_StringToArray) {
   CONVERT_ARG_HANDLE_CHECKED(String, s, 0);
   CONVERT_NUMBER_CHECKED(uint32_t, limit, Uint32, args[1]);
 
-  s = String::Flatten(s);
+  s = String::Flatten(isolate, s);
   const int length = static_cast<int>(Min<uint32_t>(s->length(), limit));
 
   Handle<FixedArray> elements;
@@ -618,8 +620,8 @@ RUNTIME_FUNCTION(Runtime_StringToArray) {
       position = CopyCachedOneByteCharsToArray(isolate->heap(), chars.start(),
                                                *elements, length);
     } else {
-      MemsetPointer(elements->data_start(), isolate->heap()->undefined_value(),
-                    length);
+      MemsetPointer(elements->data_start(),
+                    ReadOnlyRoots(isolate).undefined_value(), length);
     }
   } else {
     elements = isolate->factory()->NewFixedArray(length);
@@ -644,7 +646,7 @@ RUNTIME_FUNCTION(Runtime_StringLessThan) {
   DCHECK_EQ(2, args.length());
   CONVERT_ARG_HANDLE_CHECKED(String, x, 0);
   CONVERT_ARG_HANDLE_CHECKED(String, y, 1);
-  ComparisonResult result = String::Compare(x, y);
+  ComparisonResult result = String::Compare(isolate, x, y);
   DCHECK_NE(result, ComparisonResult::kUndefined);
   return isolate->heap()->ToBoolean(
       ComparisonResultToBool(Operation::kLessThan, result));
@@ -655,7 +657,7 @@ RUNTIME_FUNCTION(Runtime_StringLessThanOrEqual) {
   DCHECK_EQ(2, args.length());
   CONVERT_ARG_HANDLE_CHECKED(String, x, 0);
   CONVERT_ARG_HANDLE_CHECKED(String, y, 1);
-  ComparisonResult result = String::Compare(x, y);
+  ComparisonResult result = String::Compare(isolate, x, y);
   DCHECK_NE(result, ComparisonResult::kUndefined);
   return isolate->heap()->ToBoolean(
       ComparisonResultToBool(Operation::kLessThanOrEqual, result));
@@ -666,7 +668,7 @@ RUNTIME_FUNCTION(Runtime_StringGreaterThan) {
   DCHECK_EQ(2, args.length());
   CONVERT_ARG_HANDLE_CHECKED(String, x, 0);
   CONVERT_ARG_HANDLE_CHECKED(String, y, 1);
-  ComparisonResult result = String::Compare(x, y);
+  ComparisonResult result = String::Compare(isolate, x, y);
   DCHECK_NE(result, ComparisonResult::kUndefined);
   return isolate->heap()->ToBoolean(
       ComparisonResultToBool(Operation::kGreaterThan, result));
@@ -677,7 +679,7 @@ RUNTIME_FUNCTION(Runtime_StringGreaterThanOrEqual) {
   DCHECK_EQ(2, args.length());
   CONVERT_ARG_HANDLE_CHECKED(String, x, 0);
   CONVERT_ARG_HANDLE_CHECKED(String, y, 1);
-  ComparisonResult result = String::Compare(x, y);
+  ComparisonResult result = String::Compare(isolate, x, y);
   DCHECK_NE(result, ComparisonResult::kUndefined);
   return isolate->heap()->ToBoolean(
       ComparisonResultToBool(Operation::kGreaterThanOrEqual, result));
@@ -688,7 +690,7 @@ RUNTIME_FUNCTION(Runtime_StringEqual) {
   DCHECK_EQ(2, args.length());
   CONVERT_ARG_HANDLE_CHECKED(String, x, 0);
   CONVERT_ARG_HANDLE_CHECKED(String, y, 1);
-  return isolate->heap()->ToBoolean(String::Equals(x, y));
+  return isolate->heap()->ToBoolean(String::Equals(isolate, x, y));
 }
 
 RUNTIME_FUNCTION(Runtime_StringNotEqual) {
@@ -696,14 +698,14 @@ RUNTIME_FUNCTION(Runtime_StringNotEqual) {
   DCHECK_EQ(2, args.length());
   CONVERT_ARG_HANDLE_CHECKED(String, x, 0);
   CONVERT_ARG_HANDLE_CHECKED(String, y, 1);
-  return isolate->heap()->ToBoolean(!String::Equals(x, y));
+  return isolate->heap()->ToBoolean(!String::Equals(isolate, x, y));
 }
 
 RUNTIME_FUNCTION(Runtime_FlattenString) {
   HandleScope scope(isolate);
   DCHECK_EQ(1, args.length());
   CONVERT_ARG_HANDLE_CHECKED(String, str, 0);
-  return *String::Flatten(str);
+  return *String::Flatten(isolate, str);
 }
 
 RUNTIME_FUNCTION(Runtime_StringCharFromCode) {
@@ -714,7 +716,7 @@ RUNTIME_FUNCTION(Runtime_StringCharFromCode) {
     code &= 0xFFFF;
     return *isolate->factory()->LookupSingleCharacterStringFromCode(code);
   }
-  return isolate->heap()->empty_string();
+  return ReadOnlyRoots(isolate).empty_string();
 }
 
 RUNTIME_FUNCTION(Runtime_StringMaxLength) {
diff --git a/deps/v8/src/runtime/runtime-symbol.cc b/deps/v8/src/runtime/runtime-symbol.cc
index 488aa756c6e8f9..1472b4e2bed10b 100644
--- a/deps/v8/src/runtime/runtime-symbol.cc
+++ b/deps/v8/src/runtime/runtime-symbol.cc
@@ -31,14 +31,6 @@ RUNTIME_FUNCTION(Runtime_CreatePrivateFieldSymbol) {
   return *symbol;
 }
 
-RUNTIME_FUNCTION(Runtime_SymbolDescription) {
-  SealHandleScope shs(isolate);
-  DCHECK_EQ(1, args.length());
-  CONVERT_ARG_CHECKED(Symbol, symbol, 0);
-  return symbol->name();
-}
-
-
 RUNTIME_FUNCTION(Runtime_SymbolDescriptiveString) {
   HandleScope scope(isolate);
   DCHECK_EQ(1, args.length());
diff --git a/deps/v8/src/runtime/runtime-test.cc b/deps/v8/src/runtime/runtime-test.cc
index 78de914b72fc1a..157e3fd4146ac9 100644
--- a/deps/v8/src/runtime/runtime-test.cc
+++ b/deps/v8/src/runtime/runtime-test.cc
@@ -5,6 +5,7 @@
 #include "src/runtime/runtime-utils.h"
 
 #include <memory>
+#include <sstream>
 
 #include "src/api.h"
 #include "src/arguments.h"
@@ -59,7 +60,7 @@ bool IsWasmInstantiateAllowed(v8::Isolate* isolate,
   }
   v8::Local<v8::WasmCompiledModule> module =
       v8::Local<v8::WasmCompiledModule>::Cast(module_or_bytes);
-  return static_cast<uint32_t>(module->GetWasmWireBytes()->Length()) <=
+  return static_cast<uint32_t>(module->GetWasmWireBytesRef().size) <=
          ctrls.MaxWasmBufferSize;
 }
 
@@ -116,6 +117,21 @@ RUNTIME_FUNCTION(Runtime_ConstructConsString) {
   return *isolate->factory()->NewConsString(left, right, length, kIsOneByte);
 }
 
+RUNTIME_FUNCTION(Runtime_ConstructSlicedString) {
+  HandleScope scope(isolate);
+  DCHECK_EQ(2, args.length());
+  CONVERT_ARG_HANDLE_CHECKED(String, string, 0);
+  CONVERT_ARG_HANDLE_CHECKED(Smi, index, 1);
+
+  CHECK(string->IsOneByteRepresentation());
+  CHECK_LT(index->value(), string->length());
+
+  Handle<String> sliced_string = isolate->factory()->NewSubString(
+      string, index->value(), string->length());
+  CHECK(sliced_string->IsSlicedString());
+  return *sliced_string;
+}
+
 RUNTIME_FUNCTION(Runtime_DeoptimizeFunction) {
   HandleScope scope(isolate);
   DCHECK_EQ(1, args.length());
@@ -124,16 +140,16 @@ RUNTIME_FUNCTION(Runtime_DeoptimizeFunction) {
   // Ignore calls on non-function objects to avoid runtime errors.
   CONVERT_ARG_HANDLE_CHECKED(Object, function_object, 0);
   if (!function_object->IsJSFunction()) {
-    return isolate->heap()->undefined_value();
+    return ReadOnlyRoots(isolate).undefined_value();
   }
   Handle<JSFunction> function = Handle<JSFunction>::cast(function_object);
 
   // If the function is not optimized, just return.
-  if (!function->IsOptimized()) return isolate->heap()->undefined_value();
+  if (!function->IsOptimized()) return ReadOnlyRoots(isolate).undefined_value();
 
   Deoptimizer::DeoptimizeFunction(*function);
 
-  return isolate->heap()->undefined_value();
+  return ReadOnlyRoots(isolate).undefined_value();
 }
 
 
@@ -145,15 +161,15 @@ RUNTIME_FUNCTION(Runtime_DeoptimizeNow) {
 
   // Find the JavaScript function on the top of the stack.
   JavaScriptFrameIterator it(isolate);
-  if (!it.done()) function = Handle<JSFunction>(it.frame()->function());
-  if (function.is_null()) return isolate->heap()->undefined_value();
+  if (!it.done()) function = handle(it.frame()->function(), isolate);
+  if (function.is_null()) return ReadOnlyRoots(isolate).undefined_value();
 
   // If the function is not optimized, just return.
-  if (!function->IsOptimized()) return isolate->heap()->undefined_value();
+  if (!function->IsOptimized()) return ReadOnlyRoots(isolate).undefined_value();
 
   Deoptimizer::DeoptimizeFunction(*function);
 
-  return isolate->heap()->undefined_value();
+  return ReadOnlyRoots(isolate).undefined_value();
 }
 
 
@@ -161,9 +177,9 @@ RUNTIME_FUNCTION(Runtime_RunningInSimulator) {
   SealHandleScope shs(isolate);
   DCHECK_EQ(0, args.length());
 #if defined(USE_SIMULATOR)
-  return isolate->heap()->true_value();
+  return ReadOnlyRoots(isolate).true_value();
 #else
-  return isolate->heap()->false_value();
+  return ReadOnlyRoots(isolate).false_value();
 #endif
 }
 
@@ -180,14 +196,14 @@ RUNTIME_FUNCTION(Runtime_OptimizeFunctionOnNextCall) {
 
   // This function is used by fuzzers, ignore calls with bogus arguments count.
   if (args.length() != 1 && args.length() != 2) {
-    return isolate->heap()->undefined_value();
+    return ReadOnlyRoots(isolate).undefined_value();
   }
 
   // This function is used by fuzzers to get coverage for optimizations
   // in compiler. Ignore calls on non-function objects to avoid runtime errors.
   CONVERT_ARG_HANDLE_CHECKED(Object, function_object, 0);
   if (!function_object->IsJSFunction()) {
-    return isolate->heap()->undefined_value();
+    return ReadOnlyRoots(isolate).undefined_value();
   }
   Handle<JSFunction> function = Handle<JSFunction>::cast(function_object);
 
@@ -195,24 +211,24 @@ RUNTIME_FUNCTION(Runtime_OptimizeFunctionOnNextCall) {
   // JSFunction::MarkForOptimization().
 
   if (!function->shared()->allows_lazy_compilation()) {
-    return isolate->heap()->undefined_value();
+    return ReadOnlyRoots(isolate).undefined_value();
   }
 
   // If function isn't compiled, compile it now.
   if (!function->shared()->is_compiled() &&
       !Compiler::Compile(function, Compiler::CLEAR_EXCEPTION)) {
-    return isolate->heap()->undefined_value();
+    return ReadOnlyRoots(isolate).undefined_value();
   }
 
   // If the function is already optimized, just return.
   if (function->IsOptimized() || function->shared()->HasAsmWasmData()) {
-    return isolate->heap()->undefined_value();
+    return ReadOnlyRoots(isolate).undefined_value();
   }
 
   // If the function has optimized code, ensure that we check for it and return.
   if (function->HasOptimizedCode()) {
     DCHECK(function->ChecksOptimizationMarker());
-    return isolate->heap()->undefined_value();
+    return ReadOnlyRoots(isolate).undefined_value();
   }
 
   ConcurrencyMode concurrency_mode = ConcurrencyMode::kNotConcurrent;
@@ -241,7 +257,7 @@ RUNTIME_FUNCTION(Runtime_OptimizeFunctionOnNextCall) {
   JSFunction::EnsureFeedbackVector(function);
   function->MarkForOptimization(concurrency_mode);
 
-  return isolate->heap()->undefined_value();
+  return ReadOnlyRoots(isolate).undefined_value();
 }
 
 RUNTIME_FUNCTION(Runtime_OptimizeOsr) {
@@ -256,11 +272,11 @@ RUNTIME_FUNCTION(Runtime_OptimizeOsr) {
   // Find the JavaScript function on the top of the stack.
   JavaScriptFrameIterator it(isolate);
   while (!it.done() && stack_depth--) it.Advance();
-  if (!it.done()) function = Handle<JSFunction>(it.frame()->function());
-  if (function.is_null()) return isolate->heap()->undefined_value();
+  if (!it.done()) function = handle(it.frame()->function(), isolate);
+  if (function.is_null()) return ReadOnlyRoots(isolate).undefined_value();
 
   // If the function is already optimized, just return.
-  if (function->IsOptimized()) return isolate->heap()->undefined_value();
+  if (function->IsOptimized()) return ReadOnlyRoots(isolate).undefined_value();
 
   // Ensure that the function is marked for non-concurrent optimization, so that
   // subsequent runs don't also optimize.
@@ -279,7 +295,7 @@ RUNTIME_FUNCTION(Runtime_OptimizeOsr) {
         it.frame(), AbstractCode::kMaxLoopNestingMarker);
   }
 
-  return isolate->heap()->undefined_value();
+  return ReadOnlyRoots(isolate).undefined_value();
 }
 
 
@@ -290,12 +306,12 @@ RUNTIME_FUNCTION(Runtime_NeverOptimizeFunction) {
   // in compiler. Ignore calls on non-function objects to avoid runtime errors.
   CONVERT_ARG_HANDLE_CHECKED(Object, function_object, 0);
   if (!function_object->IsJSFunction()) {
-    return isolate->heap()->undefined_value();
+    return ReadOnlyRoots(isolate).undefined_value();
   }
   Handle<JSFunction> function = Handle<JSFunction>::cast(function_object);
   function->shared()->DisableOptimization(
       BailoutReason::kOptimizationDisabledForTest);
-  return isolate->heap()->undefined_value();
+  return ReadOnlyRoots(isolate).undefined_value();
 }
 
 RUNTIME_FUNCTION(Runtime_GetOptimizationStatus) {
@@ -324,7 +340,8 @@ RUNTIME_FUNCTION(Runtime_GetOptimizationStatus) {
   bool sync_with_compiler_thread = true;
   if (args.length() == 2) {
     CONVERT_ARG_HANDLE_CHECKED(Object, sync_object, 1);
-    if (!sync_object->IsString()) return isolate->heap()->undefined_value();
+    if (!sync_object->IsString())
+      return ReadOnlyRoots(isolate).undefined_value();
     Handle<String> sync = Handle<String>::cast(sync_object);
     if (sync->IsOneByteEqualTo(STATIC_CHAR_VECTOR("no sync"))) {
       sync_with_compiler_thread = false;
@@ -386,7 +403,7 @@ RUNTIME_FUNCTION(Runtime_UnblockConcurrentRecompilation) {
       isolate->concurrent_recompilation_enabled()) {
     isolate->optimizing_compile_dispatcher()->Unblock();
   }
-  return isolate->heap()->undefined_value();
+  return ReadOnlyRoots(isolate).undefined_value();
 }
 
 RUNTIME_FUNCTION(Runtime_GetDeoptCount) {
@@ -451,7 +468,7 @@ RUNTIME_FUNCTION(Runtime_ClearFunctionFeedback) {
   DCHECK_EQ(1, args.length());
   CONVERT_ARG_HANDLE_CHECKED(JSFunction, function, 0);
   function->ClearTypeFeedbackInfo();
-  return isolate->heap()->undefined_value();
+  return ReadOnlyRoots(isolate).undefined_value();
 }
 
 RUNTIME_FUNCTION(Runtime_SetWasmCompileControls) {
@@ -464,7 +481,7 @@ RUNTIME_FUNCTION(Runtime_SetWasmCompileControls) {
   ctrl.AllowAnySizeForAsync = allow_async;
   ctrl.MaxWasmBufferSize = static_cast<uint32_t>(block_size->value());
   v8_isolate->SetWasmModuleCallback(WasmModuleOverride);
-  return isolate->heap()->undefined_value();
+  return ReadOnlyRoots(isolate).undefined_value();
 }
 
 RUNTIME_FUNCTION(Runtime_SetWasmInstantiateControls) {
@@ -472,14 +489,14 @@ RUNTIME_FUNCTION(Runtime_SetWasmInstantiateControls) {
   v8::Isolate* v8_isolate = reinterpret_cast<v8::Isolate*>(isolate);
   CHECK_EQ(args.length(), 0);
   v8_isolate->SetWasmInstanceCallback(WasmInstanceOverride);
-  return isolate->heap()->undefined_value();
+  return ReadOnlyRoots(isolate).undefined_value();
 }
 
 RUNTIME_FUNCTION(Runtime_NotifyContextDisposed) {
   HandleScope scope(isolate);
   DCHECK_EQ(0, args.length());
   isolate->heap()->NotifyContextDisposed(true);
-  return isolate->heap()->undefined_value();
+  return ReadOnlyRoots(isolate).undefined_value();
 }
 
 
@@ -503,7 +520,7 @@ RUNTIME_FUNCTION(Runtime_SetAllocationTimeout) {
     }
   }
 #endif
-  return isolate->heap()->undefined_value();
+  return ReadOnlyRoots(isolate).undefined_value();
 }
 
 
@@ -511,28 +528,54 @@ RUNTIME_FUNCTION(Runtime_DebugPrint) {
   SealHandleScope shs(isolate);
   DCHECK_EQ(1, args.length());
 
-  OFStream os(stdout);
-#ifdef DEBUG
-  if (args[0]->IsString() && isolate->context() != nullptr) {
-    // If we have a string, assume it's a code "marker"
-    // and print some interesting cpu debugging info.
-    args[0]->Print(os);
-    JavaScriptFrameIterator it(isolate);
-    JavaScriptFrame* frame = it.frame();
-    os << "fp = " << static_cast<void*>(frame->fp())
-       << ", sp = " << static_cast<void*>(frame->sp())
-       << ", caller_sp = " << static_cast<void*>(frame->caller_sp()) << ": ";
+  // Hack: The argument is passed as Object* but here it's really a
+  // MaybeObject*.
+  MaybeObject* maybe_object = reinterpret_cast<MaybeObject*>(args[0]);
+
+  StdoutStream os;
+  if (maybe_object->IsClearedWeakHeapObject()) {
+    os << "[weak cleared]";
   } else {
-    os << "DebugPrint: ";
-    args[0]->Print(os);
-  }
-  if (args[0]->IsHeapObject()) {
-    HeapObject::cast(args[0])->map()->Print(os);
-  }
+    Object* object;
+    bool weak = false;
+    if (maybe_object->IsWeakHeapObject()) {
+      weak = true;
+      object = maybe_object->ToWeakHeapObject();
+    } else {
+      // Strong reference or SMI.
+      object = maybe_object->ToObject();
+    }
+
+#ifdef DEBUG
+    if (object->IsString() && isolate->context() != nullptr) {
+      DCHECK(!weak);
+      // If we have a string, assume it's a code "marker"
+      // and print some interesting cpu debugging info.
+      object->Print(isolate, os);
+      JavaScriptFrameIterator it(isolate);
+      JavaScriptFrame* frame = it.frame();
+      os << "fp = " << reinterpret_cast<void*>(frame->fp())
+         << ", sp = " << reinterpret_cast<void*>(frame->sp())
+         << ", caller_sp = " << reinterpret_cast<void*>(frame->caller_sp())
+         << ": ";
+    } else {
+      os << "DebugPrint: ";
+      if (weak) {
+        os << "[weak] ";
+      }
+      object->Print(isolate, os);
+    }
+    if (object->IsHeapObject()) {
+      HeapObject::cast(object)->map()->Print(isolate, os);
+    }
 #else
-  // ShortPrint is available in release mode. Print is not.
-  os << Brief(args[0]);
+    if (weak) {
+      os << "[weak] ";
+    }
+    // ShortPrint is available in release mode. Print is not.
+    os << Brief(object);
 #endif
+  }
   os << std::endl;
 
   return args[0];  // return TOS
@@ -554,14 +597,14 @@ RUNTIME_FUNCTION(Runtime_PrintWithNameForAssert) {
   args[1]->ShortPrint();
   PrintF("\n");
 
-  return isolate->heap()->undefined_value();
+  return ReadOnlyRoots(isolate).undefined_value();
 }
 
 RUNTIME_FUNCTION(Runtime_DebugTrace) {
   SealHandleScope shs(isolate);
   DCHECK_EQ(0, args.length());
   isolate->PrintStack(stdout);
-  return isolate->heap()->undefined_value();
+  return ReadOnlyRoots(isolate).undefined_value();
 }
 
 RUNTIME_FUNCTION(Runtime_DebugTrackRetainingPath) {
@@ -575,18 +618,18 @@ RUNTIME_FUNCTION(Runtime_DebugTrackRetainingPath) {
     RetainingPathOption option = RetainingPathOption::kDefault;
     if (args.length() == 2) {
       CONVERT_ARG_HANDLE_CHECKED(String, str, 1);
-      const char track_ephemeral_path[] = "track-ephemeral-path";
-      if (str->IsOneByteEqualTo(STATIC_CHAR_VECTOR(track_ephemeral_path))) {
-        option = RetainingPathOption::kTrackEphemeralPath;
+      const char track_ephemeron_path[] = "track-ephemeron-path";
+      if (str->IsOneByteEqualTo(STATIC_CHAR_VECTOR(track_ephemeron_path))) {
+        option = RetainingPathOption::kTrackEphemeronPath;
       } else if (str->length() != 0) {
         PrintF("Unexpected second argument of DebugTrackRetainingPath.\n");
         PrintF("Expected an empty string or '%s', got '%s'.\n",
-               track_ephemeral_path, str->ToCString().get());
+               track_ephemeron_path, str->ToCString().get());
       }
     }
     isolate->heap()->AddRetainingPathTarget(object, option);
   }
-  return isolate->heap()->undefined_value();
+  return ReadOnlyRoots(isolate).undefined_value();
 }
 
 // This will not allocate (flatten the string), but it may run
@@ -611,7 +654,7 @@ RUNTIME_FUNCTION(Runtime_SystemBreak) {
   HandleScope scope(isolate);
   DCHECK_EQ(0, args.length());
   base::OS::DebugBreak();
-  return isolate->heap()->undefined_value();
+  return ReadOnlyRoots(isolate).undefined_value();
 }
 
 
@@ -623,7 +666,7 @@ RUNTIME_FUNCTION(Runtime_SetFlags) {
   std::unique_ptr<char[]> flags =
       arg->ToCString(DISALLOW_NULLS, ROBUST_STRING_TRAVERSAL);
   FlagList::SetFlagsFromString(flags.get(), StrLength(flags.get()));
-  return isolate->heap()->undefined_value();
+  return ReadOnlyRoots(isolate).undefined_value();
 }
 
 RUNTIME_FUNCTION(Runtime_SetForceSlowPath) {
@@ -636,7 +679,7 @@ RUNTIME_FUNCTION(Runtime_SetForceSlowPath) {
     DCHECK(arg->IsFalse(isolate));
     isolate->set_force_slow_path(false);
   }
-  return isolate->heap()->undefined_value();
+  return ReadOnlyRoots(isolate).undefined_value();
 }
 
 RUNTIME_FUNCTION(Runtime_Abort) {
@@ -666,12 +709,6 @@ RUNTIME_FUNCTION(Runtime_AbortJS) {
 }
 
 
-RUNTIME_FUNCTION(Runtime_NativeScriptsCount) {
-  DCHECK_EQ(0, args.length());
-  return Smi::FromInt(Natives::GetBuiltinsCount());
-}
-
-
 RUNTIME_FUNCTION(Runtime_DisassembleFunction) {
   HandleScope scope(isolate);
 #ifdef DEBUG
@@ -680,13 +717,13 @@ RUNTIME_FUNCTION(Runtime_DisassembleFunction) {
   CONVERT_ARG_HANDLE_CHECKED(JSFunction, func, 0);
   if (!func->is_compiled() &&
       !Compiler::Compile(func, Compiler::KEEP_EXCEPTION)) {
-    return isolate->heap()->exception();
+    return ReadOnlyRoots(isolate).exception();
   }
-  OFStream os(stdout);
-  func->code()->Print(os);
+  StdoutStream os;
+  func->code()->Print(isolate, os);
   os << std::endl;
 #endif  // DEBUG
-  return isolate->heap()->undefined_value();
+  return ReadOnlyRoots(isolate).undefined_value();
 }
 
 namespace {
@@ -715,7 +752,7 @@ RUNTIME_FUNCTION(Runtime_TraceEnter) {
   PrintIndentation(isolate);
   JavaScriptFrame::PrintTop(isolate, stdout, true, false);
   PrintF(" {\n");
-  return isolate->heap()->undefined_value();
+  return ReadOnlyRoots(isolate).undefined_value();
 }
 
 
@@ -743,7 +780,7 @@ RUNTIME_FUNCTION(Runtime_InNewSpace) {
   SealHandleScope shs(isolate);
   DCHECK_EQ(1, args.length());
   CONVERT_ARG_CHECKED(Object, obj, 0);
-  return isolate->heap()->ToBoolean(isolate->heap()->InNewSpace(obj));
+  return isolate->heap()->ToBoolean(Heap::InNewSpace(obj));
 }
 
 RUNTIME_FUNCTION(Runtime_IsAsmWasmCode) {
@@ -752,14 +789,14 @@ RUNTIME_FUNCTION(Runtime_IsAsmWasmCode) {
   CONVERT_ARG_CHECKED(JSFunction, function, 0);
   if (!function->shared()->HasAsmWasmData()) {
     // Doesn't have wasm data.
-    return isolate->heap()->false_value();
+    return ReadOnlyRoots(isolate).false_value();
   }
   if (function->shared()->HasBuiltinId() &&
       function->shared()->builtin_id() == Builtins::kInstantiateAsmJs) {
     // Hasn't been compiled yet.
-    return isolate->heap()->false_value();
+    return ReadOnlyRoots(isolate).false_value();
   }
-  return isolate->heap()->true_value();
+  return ReadOnlyRoots(isolate).true_value();
 }
 
 namespace {
@@ -776,7 +813,7 @@ RUNTIME_FUNCTION(Runtime_DisallowCodegenFromStrings) {
   v8::Isolate* v8_isolate = reinterpret_cast<v8::Isolate*>(isolate);
   v8_isolate->SetAllowCodeGenerationFromStringsCallback(
       flag ? DisallowCodegenFromStringsCallback : nullptr);
-  return isolate->heap()->undefined_value();
+  return ReadOnlyRoots(isolate).undefined_value();
 }
 
 RUNTIME_FUNCTION(Runtime_DisallowWasmCodegen) {
@@ -786,7 +823,7 @@ RUNTIME_FUNCTION(Runtime_DisallowWasmCodegen) {
   v8::Isolate* v8_isolate = reinterpret_cast<v8::Isolate*>(isolate);
   v8_isolate->SetAllowWasmCodeGenerationCallback(
       flag ? DisallowCodegenFromStringsCallback : nullptr);
-  return isolate->heap()->undefined_value();
+  return ReadOnlyRoots(isolate).undefined_value();
 }
 
 RUNTIME_FUNCTION(Runtime_IsWasmCode) {
@@ -860,22 +897,26 @@ RUNTIME_FUNCTION(Runtime_PromiseSpeciesProtector) {
       isolate->IsPromiseSpeciesLookupChainIntact());
 }
 
-// Take a compiled wasm module, serialize it and copy the buffer into an array
-// buffer, which is then returned.
+// Take a compiled wasm module and serialize it into an array buffer, which is
+// then returned.
 RUNTIME_FUNCTION(Runtime_SerializeWasmModule) {
   HandleScope shs(isolate);
   DCHECK_EQ(1, args.length());
   CONVERT_ARG_HANDLE_CHECKED(WasmModuleObject, module_obj, 0);
 
-  Handle<WasmCompiledModule> orig(module_obj->compiled_module());
-  std::pair<std::unique_ptr<const byte[]>, size_t> serialized_module =
-      wasm::SerializeNativeModule(isolate, orig);
-  int data_size = static_cast<int>(serialized_module.second);
-  void* buff = isolate->array_buffer_allocator()->Allocate(data_size);
-  Handle<JSArrayBuffer> ret = isolate->factory()->NewJSArrayBuffer();
-  JSArrayBuffer::Setup(ret, isolate, false, buff, data_size);
-  memcpy(buff, serialized_module.first.get(), data_size);
-  return *ret;
+  wasm::NativeModule* native_module = module_obj->native_module();
+  size_t compiled_size =
+      wasm::GetSerializedNativeModuleSize(isolate, native_module);
+  void* array_data = isolate->array_buffer_allocator()->Allocate(compiled_size);
+  Handle<JSArrayBuffer> array_buffer = isolate->factory()->NewJSArrayBuffer();
+  JSArrayBuffer::Setup(array_buffer, isolate, false, array_data, compiled_size);
+  if (!array_data ||
+      !wasm::SerializeNativeModule(
+          isolate, native_module,
+          {reinterpret_cast<uint8_t*>(array_data), compiled_size})) {
+    return ReadOnlyRoots(isolate).undefined_value();
+  }
+  return *array_buffer;
 }
 
 // Take an array buffer and attempt to reconstruct a compiled wasm module.
@@ -886,7 +927,7 @@ RUNTIME_FUNCTION(Runtime_DeserializeWasmModule) {
   CONVERT_ARG_HANDLE_CHECKED(JSArrayBuffer, buffer, 0);
   CONVERT_ARG_HANDLE_CHECKED(JSArrayBuffer, wire_bytes, 1);
 
-  Address mem_start = static_cast<Address>(buffer->backing_store());
+  uint8_t* mem_start = reinterpret_cast<uint8_t*>(buffer->backing_store());
   size_t mem_size = static_cast<size_t>(buffer->byte_length()->Number());
 
   // Note that {wasm::DeserializeNativeModule} will allocate. We assume the
@@ -896,7 +937,7 @@ RUNTIME_FUNCTION(Runtime_DeserializeWasmModule) {
     wire_bytes->set_is_external(true);
     isolate->heap()->UnregisterArrayBuffer(*wire_bytes);
   }
-  MaybeHandle<WasmCompiledModule> maybe_compiled_module =
+  MaybeHandle<WasmModuleObject> maybe_module_object =
       wasm::DeserializeNativeModule(
           isolate, {mem_start, mem_size},
           Vector<const uint8_t>(
@@ -906,37 +947,11 @@ RUNTIME_FUNCTION(Runtime_DeserializeWasmModule) {
     wire_bytes->set_is_external(false);
     isolate->heap()->RegisterNewArrayBuffer(*wire_bytes);
   }
-  Handle<WasmCompiledModule> compiled_module;
-  if (!maybe_compiled_module.ToHandle(&compiled_module)) {
-    return isolate->heap()->undefined_value();
+  Handle<WasmModuleObject> module_object;
+  if (!maybe_module_object.ToHandle(&module_object)) {
+    return ReadOnlyRoots(isolate).undefined_value();
   }
-  return *WasmModuleObject::New(isolate, compiled_module);
-}
-
-RUNTIME_FUNCTION(Runtime_ValidateWasmInstancesChain) {
-  HandleScope shs(isolate);
-  DCHECK_EQ(2, args.length());
-  CONVERT_ARG_HANDLE_CHECKED(WasmModuleObject, module_obj, 0);
-  CONVERT_ARG_HANDLE_CHECKED(Smi, instance_count, 1);
-  WasmInstanceObject::ValidateInstancesChainForTesting(isolate, module_obj,
-                                                       instance_count->value());
-  return isolate->heap()->ToBoolean(true);
-}
-
-RUNTIME_FUNCTION(Runtime_ValidateWasmModuleState) {
-  HandleScope shs(isolate);
-  DCHECK_EQ(1, args.length());
-  CONVERT_ARG_HANDLE_CHECKED(WasmModuleObject, module_obj, 0);
-  WasmModuleObject::ValidateStateForTesting(isolate, module_obj);
-  return isolate->heap()->ToBoolean(true);
-}
-
-RUNTIME_FUNCTION(Runtime_ValidateWasmOrphanedInstance) {
-  HandleScope shs(isolate);
-  DCHECK_EQ(1, args.length());
-  CONVERT_ARG_HANDLE_CHECKED(WasmInstanceObject, instance, 0);
-  WasmInstanceObject::ValidateOrphanedInstanceForTesting(isolate, instance);
-  return isolate->heap()->ToBoolean(true);
+  return *module_object;
 }
 
 RUNTIME_FUNCTION(Runtime_HeapObjectVerify) {
@@ -944,7 +959,7 @@ RUNTIME_FUNCTION(Runtime_HeapObjectVerify) {
   DCHECK_EQ(1, args.length());
   CONVERT_ARG_HANDLE_CHECKED(Object, object, 0);
 #ifdef VERIFY_HEAP
-  object->ObjectVerify();
+  object->ObjectVerify(isolate);
 #else
   CHECK(object->IsObject());
   if (object->IsHeapObject()) {
@@ -956,6 +971,18 @@ RUNTIME_FUNCTION(Runtime_HeapObjectVerify) {
   return isolate->heap()->ToBoolean(true);
 }
 
+RUNTIME_FUNCTION(Runtime_WasmGetNumberOfInstances) {
+  SealHandleScope shs(isolate);
+  DCHECK_EQ(1, args.length());
+  CONVERT_ARG_HANDLE_CHECKED(WasmModuleObject, module_obj, 0);
+  int instance_count = 0;
+  WeakArrayList* weak_instance_list = module_obj->weak_instance_list();
+  for (int i = 0; i < weak_instance_list->length(); ++i) {
+    if (weak_instance_list->Get(i)->IsWeakHeapObject()) instance_count++;
+  }
+  return Smi::FromInt(instance_count);
+}
+
 RUNTIME_FUNCTION(Runtime_WasmNumInterpretedCalls) {
   DCHECK_EQ(1, args.length());
   HandleScope scope(isolate);
@@ -974,7 +1001,7 @@ RUNTIME_FUNCTION(Runtime_RedirectToWasmInterpreter) {
       WasmInstanceObject::GetOrCreateDebugInfo(instance);
   WasmDebugInfo::RedirectToInterpreter(debug_info,
                                        Vector<int>(&function_index, 1));
-  return isolate->heap()->undefined_value();
+  return ReadOnlyRoots(isolate).undefined_value();
 }
 
 RUNTIME_FUNCTION(Runtime_WasmTraceMemory) {
@@ -1003,7 +1030,7 @@ RUNTIME_FUNCTION(Runtime_WasmTraceMemory) {
                                   : wasm::ExecutionEngine::kTurbofan;
   wasm::TraceMemoryOperation(eng, info, func_index, pos - func_start,
                              mem_start);
-  return isolate->heap()->undefined_value();
+  return ReadOnlyRoots(isolate).undefined_value();
 }
 
 RUNTIME_FUNCTION(Runtime_IsLiftoffFunction) {
@@ -1011,9 +1038,14 @@ RUNTIME_FUNCTION(Runtime_IsLiftoffFunction) {
   DCHECK_EQ(1, args.length());
   CONVERT_ARG_HANDLE_CHECKED(JSFunction, function, 0);
   CHECK(WasmExportedFunction::IsWasmExportedFunction(*function));
-  wasm::WasmCode* wasm_code =
-      WasmExportedFunction::cast(*function)->GetWasmCode();
-  return isolate->heap()->ToBoolean(wasm_code->is_liftoff());
+  Handle<WasmExportedFunction> exp_fun =
+      Handle<WasmExportedFunction>::cast(function);
+  wasm::NativeModule* native_module =
+      exp_fun->instance()->module_object()->native_module();
+  uint32_t func_index = exp_fun->function_index();
+  return isolate->heap()->ToBoolean(
+      native_module->has_code(func_index) &&
+      native_module->code(func_index)->is_liftoff());
 }
 
 RUNTIME_FUNCTION(Runtime_CompleteInobjectSlackTracking) {
@@ -1021,9 +1053,9 @@ RUNTIME_FUNCTION(Runtime_CompleteInobjectSlackTracking) {
   DCHECK_EQ(1, args.length());
 
   CONVERT_ARG_HANDLE_CHECKED(JSObject, object, 0);
-  object->map()->CompleteInobjectSlackTracking();
+  object->map()->CompleteInobjectSlackTracking(isolate);
 
-  return isolate->heap()->undefined_value();
+  return ReadOnlyRoots(isolate).undefined_value();
 }
 
 RUNTIME_FUNCTION(Runtime_FreezeWasmLazyCompilation) {
@@ -1031,8 +1063,16 @@ RUNTIME_FUNCTION(Runtime_FreezeWasmLazyCompilation) {
   DisallowHeapAllocation no_gc;
   CONVERT_ARG_CHECKED(WasmInstanceObject, instance, 0);
 
-  instance->compiled_module()->GetNativeModule()->set_lazy_compile_frozen(true);
-  return isolate->heap()->undefined_value();
+  instance->module_object()->native_module()->set_lazy_compile_frozen(true);
+  return ReadOnlyRoots(isolate).undefined_value();
+}
+
+RUNTIME_FUNCTION(Runtime_WasmMemoryHasFullGuardRegion) {
+  DCHECK_EQ(1, args.length());
+  DisallowHeapAllocation no_gc;
+  CONVERT_ARG_CHECKED(WasmMemoryObject, memory, 0);
+
+  return isolate->heap()->ToBoolean(memory->has_full_guard_region(isolate));
 }
 
 }  // namespace internal
diff --git a/deps/v8/src/runtime/runtime-typedarray.cc b/deps/v8/src/runtime/runtime-typedarray.cc
index 66d88f98608e67..929ce5772d17d0 100644
--- a/deps/v8/src/runtime/runtime-typedarray.cc
+++ b/deps/v8/src/runtime/runtime-typedarray.cc
@@ -26,11 +26,11 @@ RUNTIME_FUNCTION(Runtime_ArrayBufferNeuter) {
   }
   Handle<JSArrayBuffer> array_buffer = Handle<JSArrayBuffer>::cast(argument);
   if (!array_buffer->is_neuterable()) {
-    return isolate->heap()->undefined_value();
+    return ReadOnlyRoots(isolate).undefined_value();
   }
   if (array_buffer->backing_store() == nullptr) {
     CHECK_EQ(Smi::kZero, array_buffer->byte_length());
-    return isolate->heap()->undefined_value();
+    return ReadOnlyRoots(isolate).undefined_value();
   }
   // Shared array buffers should never be neutered.
   CHECK(!array_buffer->is_shared());
@@ -41,7 +41,7 @@ RUNTIME_FUNCTION(Runtime_ArrayBufferNeuter) {
   isolate->heap()->UnregisterArrayBuffer(*array_buffer);
   array_buffer->Neuter();
   isolate->array_buffer_allocator()->Free(backing_store, byte_length);
-  return isolate->heap()->undefined_value();
+  return ReadOnlyRoots(isolate).undefined_value();
 }
 
 RUNTIME_FUNCTION(Runtime_TypedArrayCopyElements) {
@@ -121,7 +121,7 @@ RUNTIME_FUNCTION(Runtime_TypedArraySortFast) {
   if (length <= 1) return *array;
 
   Handle<FixedTypedArrayBase> elements(
-      FixedTypedArrayBase::cast(array->elements()));
+      FixedTypedArrayBase::cast(array->elements()), isolate);
   switch (array->type()) {
 #define TYPED_ARRAY_SORT(Type, type, TYPE, ctype, size)     \
   case kExternal##Type##Array: {                            \
diff --git a/deps/v8/src/runtime/runtime-wasm.cc b/deps/v8/src/runtime/runtime-wasm.cc
index 9f17d0a78dcd80..c692b21c53970e 100644
--- a/deps/v8/src/runtime/runtime-wasm.cc
+++ b/deps/v8/src/runtime/runtime-wasm.cc
@@ -27,21 +27,23 @@ namespace internal {
 namespace {
 
 WasmInstanceObject* GetWasmInstanceOnStackTop(Isolate* isolate) {
-  DisallowHeapAllocation no_allocation;
-  const Address entry = Isolate::c_entry_fp(isolate->thread_local_top());
-  Address pc =
-      Memory::Address_at(entry + StandardFrameConstants::kCallerPCOffset);
-  WasmInstanceObject* owning_instance = WasmInstanceObject::GetOwningInstance(
-      isolate->wasm_engine()->code_manager()->LookupCode(pc));
-  CHECK_NOT_NULL(owning_instance);
-  return owning_instance;
+  StackFrameIterator it(isolate, isolate->thread_local_top());
+  // On top: C entry stub.
+  DCHECK_EQ(StackFrame::EXIT, it.frame()->type());
+  it.Advance();
+  // Next: the wasm (compiled or interpreted) frame.
+  WasmInstanceObject* result = nullptr;
+  if (it.frame()->is_wasm_compiled()) {
+    result = WasmCompiledFrame::cast(it.frame())->wasm_instance();
+  } else {
+    DCHECK(it.frame()->is_wasm_interpreter_entry());
+    result = WasmInterpreterEntryFrame::cast(it.frame())->wasm_instance();
+  }
+  return result;
 }
 
-// TODO(titzer): rename to GetNativeContextFromWasmInstanceOnStackTop()
-Context* GetWasmContextOnStackTop(Isolate* isolate) {
-  return GetWasmInstanceOnStackTop(isolate)
-      ->compiled_module()
-      ->native_context();
+Context* GetNativeContextFromWasmInstanceOnStackTop(Isolate* isolate) {
+  return GetWasmInstanceOnStackTop(isolate)->native_context();
 }
 
 class ClearThreadInWasmScope {
@@ -65,17 +67,18 @@ class ClearThreadInWasmScope {
 
 RUNTIME_FUNCTION(Runtime_WasmGrowMemory) {
   HandleScope scope(isolate);
-  DCHECK_EQ(1, args.length());
-  CONVERT_UINT32_ARG_CHECKED(delta_pages, 0);
-  Handle<WasmInstanceObject> instance(GetWasmInstanceOnStackTop(isolate),
-                                      isolate);
+  DCHECK_EQ(2, args.length());
+  CONVERT_ARG_HANDLE_CHECKED(WasmInstanceObject, instance, 0);
+  // {delta_pages} is checked to be a positive smi in the WasmGrowMemory builtin
+  // which calls this runtime function.
+  CONVERT_UINT32_ARG_CHECKED(delta_pages, 1);
 
   // This runtime function is always being called from wasm code.
   ClearThreadInWasmScope flag_scope(true);
 
   // Set the current isolate's context.
   DCHECK_NULL(isolate->context());
-  isolate->set_context(instance->compiled_module()->native_context());
+  isolate->set_context(instance->native_context());
 
   return *isolate->factory()->NewNumberFromInt(WasmMemoryObject::Grow(
       isolate, handle(instance->memory_object(), isolate), delta_pages));
@@ -88,7 +91,7 @@ RUNTIME_FUNCTION(Runtime_ThrowWasmError) {
 
   HandleScope scope(isolate);
   DCHECK_NULL(isolate->context());
-  isolate->set_context(GetWasmContextOnStackTop(isolate));
+  isolate->set_context(GetNativeContextFromWasmInstanceOnStackTop(isolate));
   Handle<Object> error_obj = isolate->factory()->NewWasmRuntimeError(
       static_cast<MessageTemplate::Template>(message_id));
   return isolate->Throw(*error_obj);
@@ -98,7 +101,7 @@ RUNTIME_FUNCTION(Runtime_ThrowWasmStackOverflow) {
   SealHandleScope shs(isolate);
   DCHECK_LE(0, args.length());
   DCHECK_NULL(isolate->context());
-  isolate->set_context(GetWasmContextOnStackTop(isolate));
+  isolate->set_context(GetNativeContextFromWasmInstanceOnStackTop(isolate));
   return isolate->StackOverflow();
 }
 
@@ -113,7 +116,7 @@ RUNTIME_FUNCTION(Runtime_WasmThrowCreate) {
   // TODO(kschimpf): Can this be replaced with equivalent TurboFan code/calls.
   HandleScope scope(isolate);
   DCHECK_NULL(isolate->context());
-  isolate->set_context(GetWasmContextOnStackTop(isolate));
+  isolate->set_context(GetNativeContextFromWasmInstanceOnStackTop(isolate));
   DCHECK_EQ(2, args.length());
   Handle<Object> exception = isolate->factory()->NewWasmRuntimeError(
       static_cast<MessageTemplate::Template>(
@@ -133,14 +136,14 @@ RUNTIME_FUNCTION(Runtime_WasmThrowCreate) {
                                      wasm::WasmException::kRuntimeValuesStr),
                                  values, LanguageMode::kStrict)
              .is_null());
-  return isolate->heap()->undefined_value();
+  return ReadOnlyRoots(isolate).undefined_value();
 }
 
 RUNTIME_FUNCTION(Runtime_WasmThrow) {
   // TODO(kschimpf): Can this be replaced with equivalent TurboFan code/calls.
   HandleScope scope(isolate);
   DCHECK_NULL(isolate->context());
-  isolate->set_context(GetWasmContextOnStackTop(isolate));
+  isolate->set_context(GetNativeContextFromWasmInstanceOnStackTop(isolate));
   DCHECK_EQ(0, args.length());
   Handle<Object> exception(isolate->get_wasm_caught_exception(), isolate);
   CHECK(!exception.is_null());
@@ -152,12 +155,12 @@ RUNTIME_FUNCTION(Runtime_WasmGetExceptionRuntimeId) {
   // TODO(kschimpf): Can this be replaced with equivalent TurboFan code/calls.
   HandleScope scope(isolate);
   DCHECK_NULL(isolate->context());
-  isolate->set_context(GetWasmContextOnStackTop(isolate));
+  isolate->set_context(GetNativeContextFromWasmInstanceOnStackTop(isolate));
   Handle<Object> except_obj(isolate->get_wasm_caught_exception(), isolate);
   if (!except_obj.is_null() && except_obj->IsJSReceiver()) {
-    Handle<JSReceiver> exception(JSReceiver::cast(*except_obj));
+    Handle<JSReceiver> exception(JSReceiver::cast(*except_obj), isolate);
     Handle<Object> tag;
-    if (JSReceiver::GetProperty(exception,
+    if (JSReceiver::GetProperty(isolate, exception,
                                 isolate->factory()->InternalizeUtf8String(
                                     wasm::WasmException::kRuntimeIdStr))
             .ToHandle(&tag)) {
@@ -173,13 +176,13 @@ RUNTIME_FUNCTION(Runtime_WasmExceptionGetElement) {
   // TODO(kschimpf): Can this be replaced with equivalent TurboFan code/calls.
   HandleScope scope(isolate);
   DCHECK_NULL(isolate->context());
-  isolate->set_context(GetWasmContextOnStackTop(isolate));
+  isolate->set_context(GetNativeContextFromWasmInstanceOnStackTop(isolate));
   DCHECK_EQ(1, args.length());
   Handle<Object> except_obj(isolate->get_wasm_caught_exception(), isolate);
   if (!except_obj.is_null() && except_obj->IsJSReceiver()) {
-    Handle<JSReceiver> exception(JSReceiver::cast(*except_obj));
+    Handle<JSReceiver> exception(JSReceiver::cast(*except_obj), isolate);
     Handle<Object> values_obj;
-    if (JSReceiver::GetProperty(exception,
+    if (JSReceiver::GetProperty(isolate, exception,
                                 isolate->factory()->InternalizeUtf8String(
                                     wasm::WasmException::kRuntimeValuesStr))
             .ToHandle(&values_obj)) {
@@ -202,12 +205,12 @@ RUNTIME_FUNCTION(Runtime_WasmExceptionSetElement) {
   HandleScope scope(isolate);
   DCHECK_EQ(2, args.length());
   DCHECK_NULL(isolate->context());
-  isolate->set_context(GetWasmContextOnStackTop(isolate));
+  isolate->set_context(GetNativeContextFromWasmInstanceOnStackTop(isolate));
   Handle<Object> except_obj(isolate->get_wasm_caught_exception(), isolate);
   if (!except_obj.is_null() && except_obj->IsJSReceiver()) {
-    Handle<JSReceiver> exception(JSReceiver::cast(*except_obj));
+    Handle<JSReceiver> exception(JSReceiver::cast(*except_obj), isolate);
     Handle<Object> values_obj;
-    if (JSReceiver::GetProperty(exception,
+    if (JSReceiver::GetProperty(isolate, exception,
                                 isolate->factory()->InternalizeUtf8String(
                                     wasm::WasmException::kRuntimeValuesStr))
             .ToHandle(&values_obj)) {
@@ -223,7 +226,7 @@ RUNTIME_FUNCTION(Runtime_WasmExceptionSetElement) {
       }
     }
   }
-  return isolate->heap()->undefined_value();
+  return ReadOnlyRoots(isolate).undefined_value();
 }
 
 RUNTIME_FUNCTION(Runtime_WasmRunInterpreter) {
@@ -231,20 +234,21 @@ RUNTIME_FUNCTION(Runtime_WasmRunInterpreter) {
   HandleScope scope(isolate);
   CONVERT_NUMBER_CHECKED(int32_t, func_index, Int32, args[0]);
   CONVERT_ARG_HANDLE_CHECKED(Object, arg_buffer_obj, 1);
-  Handle<WasmInstanceObject> instance(GetWasmInstanceOnStackTop(isolate));
+  Handle<WasmInstanceObject> instance(GetWasmInstanceOnStackTop(isolate),
+                                      isolate);
 
   // The arg buffer is the raw pointer to the caller's stack. It looks like a
   // Smi (lowest bit not set, as checked by IsSmi), but is no valid Smi. We just
   // cast it back to the raw pointer.
   CHECK(!arg_buffer_obj->IsHeapObject());
   CHECK(arg_buffer_obj->IsSmi());
-  uint8_t* arg_buffer = reinterpret_cast<uint8_t*>(*arg_buffer_obj);
+  Address arg_buffer = reinterpret_cast<Address>(*arg_buffer_obj);
 
   ClearThreadInWasmScope wasm_flag(true);
 
   // Set the current isolate's context.
   DCHECK_NULL(isolate->context());
-  isolate->set_context(instance->compiled_module()->native_context());
+  isolate->set_context(instance->native_context());
 
   // Find the frame pointer of the interpreter entry.
   Address frame_pointer = 0;
@@ -263,9 +267,9 @@ RUNTIME_FUNCTION(Runtime_WasmRunInterpreter) {
 
   if (!success) {
     DCHECK(isolate->has_pending_exception());
-    return isolate->heap()->exception();
+    return ReadOnlyRoots(isolate).exception();
   }
-  return isolate->heap()->undefined_value();
+  return ReadOnlyRoots(isolate).undefined_value();
 }
 
 RUNTIME_FUNCTION(Runtime_WasmStackGuard) {
@@ -278,7 +282,7 @@ RUNTIME_FUNCTION(Runtime_WasmStackGuard) {
 
   // Set the current isolate's context.
   DCHECK_NULL(isolate->context());
-  isolate->set_context(GetWasmContextOnStackTop(isolate));
+  isolate->set_context(GetNativeContextFromWasmInstanceOnStackTop(isolate));
 
   // Check if this is a real stack overflow.
   StackLimitCheck check(isolate);
@@ -287,17 +291,27 @@ RUNTIME_FUNCTION(Runtime_WasmStackGuard) {
   return isolate->stack_guard()->HandleInterrupts();
 }
 
-RUNTIME_FUNCTION_RETURN_PAIR(Runtime_WasmCompileLazy) {
-  DCHECK_EQ(1, args.length());
-  CONVERT_ARG_HANDLE_CHECKED(WasmInstanceObject, instance_on_stack, 0);
-  // TODO(titzer): The location on the stack is not visited by the
-  // roots visitor because the type of the frame is a special
-  // WASM builtin. Reopen the handle in a handle scope as a workaround.
+RUNTIME_FUNCTION(Runtime_WasmCompileLazy) {
   HandleScope scope(isolate);
-  Handle<WasmInstanceObject> instance(*instance_on_stack, isolate);
+  DCHECK_EQ(2, args.length());
+  CONVERT_ARG_HANDLE_CHECKED(WasmInstanceObject, instance, 0);
+  CONVERT_SMI_ARG_CHECKED(func_index, 1);
+
+  ClearThreadInWasmScope wasm_flag(true);
 
-  Address entrypoint = wasm::CompileLazy(isolate, instance);
-  return MakePair(reinterpret_cast<Object*>(entrypoint), *instance);
+#ifdef DEBUG
+  StackFrameIterator it(isolate, isolate->thread_local_top());
+  // On top: C entry stub.
+  DCHECK_EQ(StackFrame::EXIT, it.frame()->type());
+  it.Advance();
+  // Next: the wasm lazy compile frame.
+  DCHECK_EQ(StackFrame::WASM_COMPILE_LAZY, it.frame()->type());
+  DCHECK_EQ(*instance, WasmCompileLazyFrame::cast(it.frame())->wasm_instance());
+#endif
+
+  Address entrypoint = wasm::CompileLazy(
+      isolate, instance->module_object()->native_module(), func_index);
+  return reinterpret_cast<Object*>(entrypoint);
 }
 
 }  // namespace internal
diff --git a/deps/v8/src/runtime/runtime.cc b/deps/v8/src/runtime/runtime.cc
index 3ae82d41c53a14..64f487398fd0f7 100644
--- a/deps/v8/src/runtime/runtime.cc
+++ b/deps/v8/src/runtime/runtime.cc
@@ -159,31 +159,29 @@ const Runtime::Function* Runtime::FunctionForId(Runtime::FunctionId id) {
   return &(kIntrinsicFunctions[static_cast<int>(id)]);
 }
 
-
 const Runtime::Function* Runtime::RuntimeFunctionTable(Isolate* isolate) {
-  if (isolate->external_reference_redirector()) {
-    // When running with the simulator we need to provide a table which has
-    // redirected runtime entry addresses.
-    if (!isolate->runtime_state()->redirected_intrinsic_functions()) {
-      size_t function_count = arraysize(kIntrinsicFunctions);
-      Function* redirected_functions = new Function[function_count];
-      memcpy(redirected_functions, kIntrinsicFunctions,
-             sizeof(kIntrinsicFunctions));
-      for (size_t i = 0; i < function_count; i++) {
-        ExternalReference redirected_entry(static_cast<Runtime::FunctionId>(i),
-                                           isolate);
-        redirected_functions[i].entry = redirected_entry.address();
-      }
-      isolate->runtime_state()->set_redirected_intrinsic_functions(
-          redirected_functions);
+#ifdef USE_SIMULATOR
+  // When running with the simulator we need to provide a table which has
+  // redirected runtime entry addresses.
+  if (!isolate->runtime_state()->redirected_intrinsic_functions()) {
+    size_t function_count = arraysize(kIntrinsicFunctions);
+    Function* redirected_functions = new Function[function_count];
+    memcpy(redirected_functions, kIntrinsicFunctions,
+           sizeof(kIntrinsicFunctions));
+    for (size_t i = 0; i < function_count; i++) {
+      ExternalReference redirected_entry =
+          ExternalReference::Create(static_cast<Runtime::FunctionId>(i));
+      redirected_functions[i].entry = redirected_entry.address();
     }
-
-    return isolate->runtime_state()->redirected_intrinsic_functions();
-  } else {
-    return kIntrinsicFunctions;
+    isolate->runtime_state()->set_redirected_intrinsic_functions(
+        redirected_functions);
   }
-}
 
+  return isolate->runtime_state()->redirected_intrinsic_functions();
+#else
+  return kIntrinsicFunctions;
+#endif
+}
 
 std::ostream& operator<<(std::ostream& os, Runtime::FunctionId id) {
   return os << Runtime::FunctionForId(id)->name;
diff --git a/deps/v8/src/runtime/runtime.h b/deps/v8/src/runtime/runtime.h
index 37ce74e8250f2c..accb97d0e69096 100644
--- a/deps/v8/src/runtime/runtime.h
+++ b/deps/v8/src/runtime/runtime.h
@@ -49,7 +49,7 @@ namespace internal {
   F(MoveArrayContents, 2, 1)        \
   F(NewArray, -1 /* >= 3 */, 1)     \
   F(NormalizeElements, 1, 1)        \
-  F(RemoveArrayHoles, 2, 1)         \
+  F(PrepareElementsForSort, 2, 1)   \
   F(TransitionElementsKind, 2, 1)   \
   F(TrySliceSimpleNonFastElements, 3, 1)
 
@@ -68,6 +68,7 @@ namespace internal {
   F(BigIntBinaryOp, 3, 1)            \
   F(BigIntCompareToBigInt, 3, 1)     \
   F(BigIntCompareToNumber, 3, 1)     \
+  F(BigIntCompareToString, 3, 1)     \
   F(BigIntEqualToBigInt, 2, 1)       \
   F(BigIntEqualToNumber, 2, 1)       \
   F(BigIntEqualToString, 2, 1)       \
@@ -96,8 +97,6 @@ namespace internal {
 #define FOR_EACH_INTRINSIC_COLLECTIONS(F) \
   F(GetWeakMapEntries, 2, 1)              \
   F(GetWeakSetValues, 2, 1)               \
-  F(IsJSMap, 1, 1)                        \
-  F(IsJSSet, 1, 1)                        \
   F(IsJSWeakMap, 1, 1)                    \
   F(IsJSWeakSet, 1, 1)                    \
   F(MapGrow, 1, 1)                        \
@@ -126,61 +125,32 @@ namespace internal {
   F(IsDate, 1, 1)
 
 #define FOR_EACH_INTRINSIC_DEBUG(F)             \
-  F(ChangeBreakOnException, 2, 1)               \
-  F(CheckExecutionState, 1, 1)                  \
   F(ClearStepping, 0, 1)                        \
   F(CollectGarbage, 1, 1)                       \
-  F(DebugApplyInstrumentation, 1, 1)            \
-  F(DebugAsyncFunctionPromiseCreated, 1, 1)     \
   F(DebugBreakAtEntry, 1, 1)                    \
   F(DebugCollectCoverage, 0, 1)                 \
-  F(DebugConstructedBy, 2, 1)                   \
-  F(DebugEvaluate, 5, 1)                        \
-  F(DebugEvaluateGlobal, 2, 1)                  \
-  F(DebugGetInternalProperties, 1, 1)           \
-  F(DebugGetLoadedScripts, 0, 1)                \
-  F(DebugGetProperty, 2, 1)                     \
-  F(DebugGetPropertyDetails, 2, 1)              \
-  F(DebugGetPrototype, 1, 1)                    \
+  F(DebugGetLoadedScriptIds, 0, 1)              \
   F(DebugIsActive, 0, 1)                        \
-  F(DebugOnFunctionCall, 1, 1)                  \
+  F(DebugOnFunctionCall, 2, 1)                  \
   F(DebugPopPromise, 0, 1)                      \
   F(DebugPrepareStepInSuspendedGenerator, 0, 1) \
-  F(DebugPropertyAttributesFromDetails, 1, 1)   \
-  F(DebugPropertyKindFromDetails, 1, 1)         \
   F(DebugPushPromise, 1, 1)                     \
-  F(DebugReferencedBy, 3, 1)                    \
-  F(DebugSetScriptSource, 2, 1)                 \
+  F(DebugAsyncFunctionSuspended, 1, 1)          \
+  F(DebugAsyncFunctionFinished, 2, 1)           \
   F(DebugToggleBlockCoverage, 1, 1)             \
   F(DebugTogglePreciseCoverage, 1, 1)           \
-  F(FunctionGetDebugName, 1, 1)                 \
   F(FunctionGetInferredName, 1, 1)              \
-  F(GetAllScopesDetails, 4, 1)                  \
   F(GetBreakLocations, 1, 1)                    \
-  F(GetDebugContext, 0, 1)                      \
-  F(GetFrameCount, 1, 1)                        \
-  F(GetFrameDetails, 2, 1)                      \
-  F(GetFunctionScopeCount, 1, 1)                \
-  F(GetFunctionScopeDetails, 2, 1)              \
   F(GetGeneratorScopeCount, 1, 1)               \
   F(GetGeneratorScopeDetails, 2, 1)             \
   F(GetHeapUsage, 0, 1)                         \
-  F(GetScopeCount, 2, 1)                        \
-  F(GetScopeDetails, 4, 1)                      \
-  F(GetScript, 1, 1)                            \
   F(HandleDebuggerStatement, 0, 1)              \
   F(IncBlockCounter, 2, 1)                      \
   F(IsBreakOnException, 1, 1)                   \
-  F(PrepareStep, 2, 1)                          \
   F(ScheduleBreak, 0, 1)                        \
-  F(ScriptLineCount, 1, 1)                      \
   F(ScriptLocationFromLine2, 4, 1)              \
-  F(ScriptLocationFromLine, 4, 1)               \
-  F(ScriptPositionInfo2, 3, 1)                  \
-  F(ScriptPositionInfo, 3, 1)                   \
-  F(SetScopeVariableValue, 6, 1)
-
-#define FOR_EACH_INTRINSIC_ERROR(F) F(ErrorToString, 1, 1)
+  F(SetGeneratorScopeVariableValue, 4, 1)       \
+  F(LiveEditPatchScript, 2, 1)
 
 #define FOR_EACH_INTRINSIC_FORIN(F) \
   F(ForInEnumerate, 1, 1)           \
@@ -208,14 +178,12 @@ namespace internal {
 
 #define FOR_EACH_INTRINSIC_FUNCTION(F)     \
   F(Call, -1 /* >= 2 */, 1)                \
-  F(FunctionGetContextData, 1, 1)          \
   F(FunctionGetName, 1, 1)                 \
-  F(FunctionGetScript, 1, 1)               \
+  F(FunctionGetScriptSource, 1, 1)         \
   F(FunctionGetScriptId, 1, 1)             \
   F(FunctionGetScriptSourcePosition, 1, 1) \
   F(FunctionGetSourceCode, 1, 1)           \
   F(FunctionIsAPIFunction, 1, 1)           \
-  F(FunctionToString, 1, 1)                \
   F(IsConstructor, 1, 1)                   \
   F(IsFunction, 1, 1)                      \
   F(SetCode, 2, 1)                         \
@@ -228,12 +196,9 @@ namespace internal {
   F(AsyncGeneratorYield, 3, 1)                \
   F(CreateJSGeneratorObject, 2, 1)            \
   F(GeneratorClose, 1, 1)                     \
-  F(GeneratorGetContinuation, 1, 1)           \
   F(GeneratorGetFunction, 1, 1)               \
   F(GeneratorGetInputOrDebugPos, 1, 1)        \
-  F(GeneratorGetReceiver, 1, 1)               \
-  F(GeneratorGetResumeMode, 1, 1)             \
-  F(GeneratorGetSourcePosition, 1, 1)
+  F(GeneratorGetResumeMode, 1, 1)
 
 #ifdef V8_INTL_SUPPORT
 #define FOR_EACH_INTRINSIC_INTL(F)           \
@@ -254,9 +219,8 @@ namespace internal {
   F(GetDefaultICULocale, 0, 1)               \
   F(InternalCompare, 3, 1)                   \
   F(InternalDateFormat, 2, 1)                \
-  F(InternalDateFormatToParts, 2, 1)         \
   F(InternalNumberFormat, 2, 1)              \
-  F(IsInitializedIntlObject, 1, 1)           \
+  F(IntlUnwrapReceiver, 5, 1)                \
   F(IsInitializedIntlObjectOfType, 2, 1)     \
   F(MarkAsInitializedIntlObjectOfType, 2, 1) \
   F(PluralRulesSelect, 2, 1)                 \
@@ -281,7 +245,6 @@ namespace internal {
   F(ExportFromRuntime, 1, 1)                                         \
   F(GetAndResetRuntimeCallStats, -1 /* <= 2 */, 1)                   \
   F(IncrementUseCounter, 1, 1)                                       \
-  F(IncrementUseCounterConstructorReturnNonUndefinedPrimitive, 0, 1) \
   F(InstallToContext, 1, 1)                                          \
   F(Interrupt, 0, 1)                                                 \
   F(IS_VAR, 1, 1)                                                    \
@@ -319,20 +282,6 @@ namespace internal {
   F(CreateObjectLiteral, 4, 1)         \
   F(CreateRegExpLiteral, 4, 1)
 
-#define FOR_EACH_INTRINSIC_LIVEEDIT(F)              \
-  F(LiveEditCheckAndDropActivations, 3, 1)          \
-  F(LiveEditCompareStrings, 2, 1)                   \
-  F(LiveEditFindSharedFunctionInfosForScript, 1, 1) \
-  F(LiveEditFixupScript, 2, 1)                      \
-  F(LiveEditFunctionSetScript, 2, 1)                \
-  F(LiveEditFunctionSourceUpdated, 2, 1)            \
-  F(LiveEditGatherCompileInfo, 2, 1)                \
-  F(LiveEditPatchFunctionPositions, 2, 1)           \
-  F(LiveEditReplaceFunctionCode, 2, 1)              \
-  F(LiveEditReplaceRefToNestedFunction, 3, 1)       \
-  F(LiveEditReplaceScript, 3, 1)                    \
-  F(LiveEditRestartFrame, 2, 1)
-
 #define FOR_EACH_INTRINSIC_MATHS(F) F(GenerateRandomNumbers, 0, 1)
 
 #define FOR_EACH_INTRINSIC_MODULE(F) \
@@ -346,7 +295,6 @@ namespace internal {
   F(IsSmi, 1, 1)                      \
   F(IsValidSmi, 1, 1)                 \
   F(MaxSmi, 0, 1)                     \
-  F(NumberToSmi, 1, 1)                \
   F(NumberToStringSkipCache, 1, 1)    \
   F(SmiLexicographicCompare, 2, 1)    \
   F(StringParseFloat, 1, 1)           \
@@ -373,7 +321,6 @@ namespace internal {
   F(DefineSetterPropertyUnchecked, 4, 1)                        \
   F(DeleteProperty, 3, 1)                                       \
   F(GetFunctionName, 1, 1)                                      \
-  F(GetInterceptorInfo, 1, 1)                                   \
   F(GetOwnPropertyDescriptor, 2, 1)                             \
   F(GetOwnPropertyKeys, 2, 1)                                   \
   F(GetProperty, 2, 1)                                          \
@@ -391,11 +338,14 @@ namespace internal {
   F(ObjectEntriesSkipFastPath, 1, 1)                            \
   F(ObjectHasOwnProperty, 2, 1)                                 \
   F(ObjectKeys, 1, 1)                                           \
+  F(ObjectGetOwnPropertyNames, 1, 1)                            \
+  F(ObjectGetOwnPropertyNamesTryFast, 1, 1)                     \
   F(ObjectValues, 1, 1)                                         \
   F(ObjectValuesSkipFastPath, 1, 1)                             \
   F(OptimizeObjectForAddingMultipleProperties, 2, 1)            \
   F(SameValue, 2, 1)                                            \
   F(SameValueZero, 2, 1)                                        \
+  F(SetDataProperties, 2, 1)                                    \
   F(SetProperty, 4, 1)                                          \
   F(ShrinkPropertyDictionary, 1, 1)                             \
   F(ToFastProperties, 1, 1)                                     \
@@ -427,18 +377,21 @@ namespace internal {
   F(PromiseHookAfter, 1, 1)            \
   F(PromiseHookBefore, 1, 1)           \
   F(PromiseHookInit, 2, 1)             \
+  F(AwaitPromisesInit, 3, 1)           \
   F(PromiseMarkAsHandled, 1, 1)        \
   F(PromiseRejectEventFromStack, 2, 1) \
   F(PromiseResult, 1, 1)               \
   F(PromiseRevokeReject, 1, 1)         \
   F(PromiseStatus, 1, 1)               \
   F(RejectPromise, 3, 1)               \
-  F(ResolvePromise, 2, 1)
+  F(ResolvePromise, 2, 1)              \
+  F(PromiseRejectAfterResolved, 2, 1)  \
+  F(PromiseResolveAfterResolved, 2, 1)
 
 #define FOR_EACH_INTRINSIC_PROXY(F)   \
   F(CheckProxyGetSetTrapResult, 2, 1) \
   F(CheckProxyHasTrap, 2, 1)          \
-  F(GetPropertyWithReceiver, 2, 1)    \
+  F(GetPropertyWithReceiver, 3, 1)    \
   F(IsJSProxy, 1, 1)                  \
   F(JSProxyGetHandler, 1, 1)          \
   F(JSProxyGetTarget, 1, 1)           \
@@ -463,18 +416,19 @@ namespace internal {
   F(LoadLookupSlot, 1, 1)                 \
   F(LoadLookupSlotInsideTypeof, 1, 1)     \
   F(NewArgumentsElements, 3, 1)           \
+                                          \
   F(NewClosure, 2, 1)                     \
   F(NewClosure_Tenured, 2, 1)             \
-  F(NewFunctionContext, 2, 1)             \
+  F(NewFunctionContext, 1, 1)             \
   F(NewRestParameter, 1, 1)               \
-  F(NewScriptContext, 2, 1)               \
+  F(NewScriptContext, 1, 1)               \
   F(NewSloppyArguments, 3, 1)             \
   F(NewSloppyArguments_Generic, 1, 1)     \
   F(NewStrictArguments, 1, 1)             \
-  F(PushBlockContext, 2, 1)               \
-  F(PushCatchContext, 4, 1)               \
-  F(PushModuleContext, 3, 1)              \
-  F(PushWithContext, 3, 1)                \
+  F(PushBlockContext, 1, 1)               \
+  F(PushCatchContext, 2, 1)               \
+  F(PushModuleContext, 2, 1)              \
+  F(PushWithContext, 2, 1)                \
   F(StoreLookupSlot_Sloppy, 2, 1)         \
   F(StoreLookupSlot_SloppyHoisting, 2, 1) \
   F(StoreLookupSlot_Strict, 2, 1)         \
@@ -509,7 +463,6 @@ namespace internal {
 #define FOR_EACH_INTRINSIC_SYMBOL(F)       \
   F(CreatePrivateFieldSymbol, 0, 1)        \
   F(CreatePrivateSymbol, -1 /* <= 1 */, 1) \
-  F(SymbolDescription, 1, 1)               \
   F(SymbolDescriptiveString, 1, 1)         \
   F(SymbolIsPrivate, 1, 1)
 
@@ -519,6 +472,7 @@ namespace internal {
   F(ClearFunctionFeedback, 1, 1)              \
   F(CompleteInobjectSlackTracking, 1, 1)      \
   F(ConstructConsString, 2, 1)                \
+  F(ConstructSlicedString, 2, 1)              \
   F(ConstructDouble, 2, 1)                    \
   F(DebugPrint, 1, 1)                         \
   F(DebugTrace, 0, 1)                         \
@@ -561,15 +515,9 @@ namespace internal {
   F(InNewSpace, 1, 1)                         \
   F(IsAsmWasmCode, 1, 1)                      \
   F(IsConcurrentRecompilationSupported, 0, 1) \
-  F(IsJSError, 1, 1)                          \
-  F(IsJSGeneratorObject, 1, 1)                \
-  F(IsJSMapIterator, 1, 1)                    \
-  F(IsJSSetIterator, 1, 1)                    \
   F(IsLiftoffFunction, 1, 1)                  \
-  F(IsScriptWrapper, 1, 1)                    \
   F(IsWasmCode, 1, 1)                         \
   F(IsWasmTrapHandlerEnabled, 0, 1)           \
-  F(NativeScriptsCount, 0, 1)                 \
   F(NeverOptimizeFunction, 1, 1)              \
   F(NotifyContextDisposed, 0, 1)              \
   F(OptimizeFunctionOnNextCall, -1, 1)        \
@@ -590,11 +538,10 @@ namespace internal {
   F(TraceEnter, 0, 1)                         \
   F(TraceExit, 1, 1)                          \
   F(UnblockConcurrentRecompilation, 0, 1)     \
-  F(ValidateWasmInstancesChain, 2, 1)         \
-  F(ValidateWasmModuleState, 1, 1)            \
-  F(ValidateWasmOrphanedInstance, 1, 1)       \
+  F(WasmGetNumberOfInstances, 1, 1)           \
   F(WasmNumInterpretedCalls, 1, 1)            \
-  F(WasmTraceMemory, 1, 1)
+  F(WasmTraceMemory, 1, 1)                    \
+  F(WasmMemoryHasFullGuardRegion, 1, 1)
 
 #define FOR_EACH_INTRINSIC_TYPEDARRAY(F) \
   F(ArrayBufferNeuter, 1, 1)             \
@@ -612,15 +559,15 @@ namespace internal {
   F(WasmExceptionGetElement, 1, 1)   \
   F(WasmExceptionSetElement, 2, 1)   \
   F(WasmGetExceptionRuntimeId, 0, 1) \
-  F(WasmGrowMemory, 1, 1)            \
+  F(WasmGrowMemory, 2, 1)            \
   F(WasmRunInterpreter, 2, 1)        \
   F(WasmStackGuard, 0, 1)            \
   F(WasmThrow, 0, 1)                 \
   F(WasmThrowCreate, 2, 1)           \
-  F(WasmThrowTypeError, 0, 1)
+  F(WasmThrowTypeError, 0, 1)        \
+  F(WasmCompileLazy, 2, 1)
 
 #define FOR_EACH_INTRINSIC_RETURN_PAIR(F) \
-  F(WasmCompileLazy, 1, 2)                \
   F(DebugBreakOnBytecode, 1, 2)           \
   F(LoadLookupSlotForCall, 1, 2)
 
@@ -652,7 +599,6 @@ namespace internal {
   FOR_EACH_INTRINSIC_COMPILER(F)            \
   FOR_EACH_INTRINSIC_DATE(F)                \
   FOR_EACH_INTRINSIC_DEBUG(F)               \
-  FOR_EACH_INTRINSIC_ERROR(F)               \
   FOR_EACH_INTRINSIC_FORIN(F)               \
   FOR_EACH_INTRINSIC_FUNCTION(F)            \
   FOR_EACH_INTRINSIC_GENERATOR(F)           \
@@ -661,7 +607,6 @@ namespace internal {
   FOR_EACH_INTRINSIC_INTERPRETER(F)         \
   FOR_EACH_INTRINSIC_INTL(F)                \
   FOR_EACH_INTRINSIC_LITERALS(F)            \
-  FOR_EACH_INTRINSIC_LIVEEDIT(F)            \
   FOR_EACH_INTRINSIC_MATHS(F)               \
   FOR_EACH_INTRINSIC_MODULE(F)              \
   FOR_EACH_INTRINSIC_NUMBERS(F)             \
diff --git a/deps/v8/src/s390/assembler-s390-inl.h b/deps/v8/src/s390/assembler-s390-inl.h
index 0c5f5ffed61918..b9a7a1f8ebeaa4 100644
--- a/deps/v8/src/s390/assembler-s390-inl.h
+++ b/deps/v8/src/s390/assembler-s390-inl.h
@@ -88,7 +88,7 @@ Address RelocInfo::target_internal_reference() {
 
 Address RelocInfo::target_internal_reference_address() {
   DCHECK(IsInternalReference(rmode_) || IsInternalReferenceEncoded(rmode_));
-  return reinterpret_cast<Address>(pc_);
+  return pc_;
 }
 
 Address RelocInfo::target_address() {
@@ -110,7 +110,7 @@ Address RelocInfo::target_address_address() {
   // instruction bits, the size of the target will be zero, indicating that the
   // serializer should not step forward in memory after a target is resolved
   // and written.
-  return reinterpret_cast<Address>(pc_);
+  return pc_;
 }
 
 Address RelocInfo::constant_pool_entry_address() {
@@ -137,7 +137,7 @@ Handle<Object> Assembler::code_target_object_handle_at(Address pc) {
   SixByteInstr instr =
       Instruction::InstructionBits(reinterpret_cast<const byte*>(pc));
   int index = instr & 0xFFFFFFFF;
-  return code_targets_[index];
+  return GetCodeTarget(index);
 }
 
 HeapObject* RelocInfo::target_object() {
@@ -156,7 +156,7 @@ Handle<HeapObject> RelocInfo::target_object_handle(Assembler* origin) {
   }
 }
 
-void RelocInfo::set_target_object(HeapObject* target,
+void RelocInfo::set_target_object(Heap* heap, HeapObject* target,
                                   WriteBarrierMode write_barrier_mode,
                                   ICacheFlushMode icache_flush_mode) {
   DCHECK(IsCodeTarget(rmode_) || rmode_ == EMBEDDED_OBJECT);
@@ -164,9 +164,8 @@ void RelocInfo::set_target_object(HeapObject* target,
                                    reinterpret_cast<Address>(target),
                                    icache_flush_mode);
   if (write_barrier_mode == UPDATE_WRITE_BARRIER && host() != nullptr) {
-    host()->GetHeap()->incremental_marking()->RecordWriteIntoCode(host(), this,
-                                                                  target);
-    host()->GetHeap()->RecordWriteIntoCode(host(), this, target);
+    heap->incremental_marking()->RecordWriteIntoCode(host(), this, target);
+    heap->RecordWriteIntoCode(host(), this, target);
   }
 }
 
@@ -182,13 +181,6 @@ void RelocInfo::set_target_external_reference(
                                    icache_flush_mode);
 }
 
-void RelocInfo::set_wasm_code_table_entry(Address target,
-                                          ICacheFlushMode icache_flush_mode) {
-  DCHECK(rmode_ == RelocInfo::WASM_CODE_TABLE_ENTRY);
-  Assembler::set_target_address_at(pc_, constant_pool_, target,
-                                   icache_flush_mode);
-}
-
 Address RelocInfo::target_runtime_entry(Assembler* origin) {
   DCHECK(IsRuntimeEntry(rmode_));
   return target_address();
@@ -213,14 +205,14 @@ void RelocInfo::WipeOut() {
          IsInternalReference(rmode_) || IsInternalReferenceEncoded(rmode_));
   if (IsInternalReference(rmode_)) {
     // Jump table entry
-    Memory::Address_at(pc_) = nullptr;
+    Memory::Address_at(pc_) = kNullAddress;
   } else if (IsInternalReferenceEncoded(rmode_)) {
     // mov sequence
     // Currently used only by deserializer, no need to flush.
-    Assembler::set_target_address_at(pc_, constant_pool_, nullptr,
+    Assembler::set_target_address_at(pc_, constant_pool_, kNullAddress,
                                      SKIP_ICACHE_FLUSH);
   } else {
-    Assembler::set_target_address_at(pc_, constant_pool_, nullptr);
+    Assembler::set_target_address_at(pc_, constant_pool_, kNullAddress);
   }
 }
 
@@ -229,7 +221,7 @@ void RelocInfo::Visit(ObjectVisitor* visitor) {
   RelocInfo::Mode mode = rmode();
   if (mode == RelocInfo::EMBEDDED_OBJECT) {
     visitor->VisitEmbeddedPointer(host(), this);
-  } else if (RelocInfo::IsCodeTarget(mode)) {
+  } else if (RelocInfo::IsCodeTargetMode(mode)) {
     visitor->VisitCodeTarget(host(), this);
   } else if (mode == RelocInfo::EXTERNAL_REFERENCE) {
     visitor->VisitExternalReference(host(), this);
@@ -245,23 +237,6 @@ void RelocInfo::Visit(ObjectVisitor* visitor) {
 // Operand constructors
 Operand::Operand(Register rm) : rm_(rm), rmode_(RelocInfo::NONE) {}
 
-int32_t Assembler::emit_code_target(Handle<Code> target,
-                                    RelocInfo::Mode rmode) {
-  DCHECK(RelocInfo::IsCodeTarget(rmode));
-  RecordRelocInfo(rmode);
-
-  size_t current = code_targets_.size();
-  if (current > 0 && !target.is_null() &&
-      code_targets_.back().address() == target.address()) {
-    // Optimization if we keep jumping to the same code target.
-    current--;
-  } else {
-    code_targets_.push_back(target);
-  }
-  return current;
-}
-
-
 // Fetch the 32bit value from the FIXED_SEQUENCE IIHF / IILF
 Address Assembler::target_address_at(Address pc, Address constant_pool) {
   // S390 Instruction!
@@ -272,7 +247,7 @@ Address Assembler::target_address_at(Address pc, Address constant_pool) {
 
   if (BRASL == op1 || BRCL == op1) {
     int32_t dis = static_cast<int32_t>(instr_1 & 0xFFFFFFFF) * 2;
-    return reinterpret_cast<Address>(reinterpret_cast<uint64_t>(pc) + dis);
+    return pc + dis;
   }
 
 #if V8_TARGET_ARCH_S390X
@@ -284,18 +259,18 @@ Address Assembler::target_address_at(Address pc, Address constant_pool) {
       reinterpret_cast<const byte*>(pc + instr1_length));
   // IIHF for hi_32, IILF for lo_32
   if (IIHF == op1 && IILF == op2) {
-    return reinterpret_cast<Address>(((instr_1 & 0xFFFFFFFF) << 32) |
-                                     ((instr_2 & 0xFFFFFFFF)));
+    return static_cast<Address>(((instr_1 & 0xFFFFFFFF) << 32) |
+                                ((instr_2 & 0xFFFFFFFF)));
   }
 #else
   // IILF loads 32-bits
   if (IILF == op1 || CFI == op1) {
-    return reinterpret_cast<Address>((instr_1 & 0xFFFFFFFF));
+    return static_cast<Address>((instr_1 & 0xFFFFFFFF));
   }
 #endif
 
   UNIMPLEMENTED();
-  return (Address)0;
+  return 0;
 }
 
 // This sets the branch destination (which gets loaded at the call address).
@@ -305,13 +280,18 @@ Address Assembler::target_address_at(Address pc, Address constant_pool) {
 void Assembler::deserialization_set_special_target_at(
     Address instruction_payload, Code* code, Address target) {
   set_target_address_at(instruction_payload,
-                        code ? code->constant_pool() : nullptr, target);
+                        code ? code->constant_pool() : kNullAddress, target);
+}
+
+int Assembler::deserialization_special_target_size(
+    Address instruction_payload) {
+  return kSpecialTargetSize;
 }
 
 void Assembler::deserialization_set_target_internal_reference_at(
     Address pc, Address target, RelocInfo::Mode mode) {
   if (RelocInfo::IsInternalReferenceEncoded(mode)) {
-    set_target_address_at(pc, nullptr, target, SKIP_ICACHE_FLUSH);
+    set_target_address_at(pc, kNullAddress, target, SKIP_ICACHE_FLUSH);
   } else {
     Memory::Address_at(pc) = target;
   }
diff --git a/deps/v8/src/s390/assembler-s390.cc b/deps/v8/src/s390/assembler-s390.cc
index d0b1afa80148c5..5bc778c9704bec 100644
--- a/deps/v8/src/s390/assembler-s390.cc
+++ b/deps/v8/src/s390/assembler-s390.cc
@@ -48,6 +48,7 @@
 #include "src/base/bits.h"
 #include "src/base/cpu.h"
 #include "src/code-stubs.h"
+#include "src/deoptimizer.h"
 #include "src/macro-assembler.h"
 #include "src/s390/assembler-s390-inl.h"
 
@@ -258,7 +259,8 @@ Register ToRegister(int num) {
 // Implementation of RelocInfo
 
 const int RelocInfo::kApplyMask =
-    RelocInfo::kCodeTargetMask | 1 << RelocInfo::INTERNAL_REFERENCE;
+    RelocInfo::ModeMask(RelocInfo::CODE_TARGET) |
+    RelocInfo::ModeMask(RelocInfo::INTERNAL_REFERENCE);
 
 bool RelocInfo::IsCodedSpecially() {
   // The deserializer needs to know whether a pointer is specially
@@ -270,34 +272,27 @@ bool RelocInfo::IsCodedSpecially() {
 
 bool RelocInfo::IsInConstantPool() { return false; }
 
-Address RelocInfo::embedded_address() const {
-  return Assembler::target_address_at(pc_, constant_pool_);
-}
-
-uint32_t RelocInfo::embedded_size() const {
-  return static_cast<uint32_t>(reinterpret_cast<intptr_t>(
-      Assembler::target_address_at(pc_, constant_pool_)));
-}
-
-void RelocInfo::set_embedded_address(Address address,
-                                     ICacheFlushMode flush_mode) {
-  Assembler::set_target_address_at(pc_, constant_pool_, address, flush_mode);
-}
-
-void RelocInfo::set_embedded_size(uint32_t size, ICacheFlushMode flush_mode) {
-  Assembler::set_target_address_at(pc_, constant_pool_,
-                                   reinterpret_cast<Address>(size), flush_mode);
+int RelocInfo::GetDeoptimizationId(Isolate* isolate, DeoptimizeKind kind) {
+  DCHECK(IsRuntimeEntry(rmode_));
+  return Deoptimizer::GetDeoptimizationId(isolate, target_address(), kind);
 }
 
 void RelocInfo::set_js_to_wasm_address(Address address,
                                        ICacheFlushMode icache_flush_mode) {
   DCHECK_EQ(rmode_, JS_TO_WASM_CALL);
-  set_embedded_address(address, icache_flush_mode);
+  Assembler::set_target_address_at(pc_, constant_pool_, address,
+                                   icache_flush_mode);
 }
 
 Address RelocInfo::js_to_wasm_address() const {
   DCHECK_EQ(rmode_, JS_TO_WASM_CALL);
-  return embedded_address();
+  return Assembler::target_address_at(pc_, constant_pool_);
+}
+
+uint32_t RelocInfo::wasm_call_tag() const {
+  DCHECK(rmode_ == WASM_CALL || rmode_ == WASM_STUB_CALL);
+  return static_cast<uint32_t>(
+      Assembler::target_address_at(pc_, constant_pool_));
 }
 
 // -----------------------------------------------------------------------------
@@ -307,7 +302,7 @@ Address RelocInfo::js_to_wasm_address() const {
 Operand::Operand(Handle<HeapObject> handle) {
   AllowHandleDereference using_location;
   rm_ = no_reg;
-  value_.immediate = reinterpret_cast<intptr_t>(handle.address());
+  value_.immediate = static_cast<intptr_t>(handle.address());
   rmode_ = RelocInfo::EMBEDDED_OBJECT;
 }
 
@@ -329,12 +324,12 @@ MemOperand::MemOperand(Register rx, Register rb, int32_t offset)
 void Assembler::AllocateAndInstallRequestedHeapObjects(Isolate* isolate) {
   for (auto& request : heap_object_requests_) {
     Handle<HeapObject> object;
-    Address pc = buffer_ + request.offset();
+    Address pc = reinterpret_cast<Address>(buffer_ + request.offset());
     switch (request.kind()) {
       case HeapObjectRequest::kHeapNumber:
-        object = isolate->factory()->NewHeapNumber(request.heap_number(),
-                                                   IMMUTABLE, TENURED);
-        set_target_address_at(pc, static_cast<Address>(nullptr),
+        object =
+            isolate->factory()->NewHeapNumber(request.heap_number(), TENURED);
+        set_target_address_at(pc, kNullAddress,
                               reinterpret_cast<Address>(object.location()),
                               SKIP_ICACHE_FLUSH);
         break;
@@ -343,7 +338,7 @@ void Assembler::AllocateAndInstallRequestedHeapObjects(Isolate* isolate) {
         SixByteInstr instr =
             Instruction::InstructionBits(reinterpret_cast<const byte*>(pc));
         int index = instr & 0xFFFFFFFF;
-        code_targets_[index] = request.code_stub()->GetCode();
+        UpdateCodeTarget(index, request.code_stub()->GetCode());
         break;
     }
   }
@@ -352,11 +347,11 @@ void Assembler::AllocateAndInstallRequestedHeapObjects(Isolate* isolate) {
 // -----------------------------------------------------------------------------
 // Specific instructions, constants, and masks.
 
-Assembler::Assembler(IsolateData isolate_data, void* buffer, int buffer_size)
-    : AssemblerBase(isolate_data, buffer, buffer_size) {
+Assembler::Assembler(const AssemblerOptions& options, void* buffer,
+                     int buffer_size)
+    : AssemblerBase(options, buffer, buffer_size) {
   reloc_info_writer.Reposition(buffer_ + buffer_size_, pc_);
-  code_targets_.reserve(100);
-
+  ReserveCodeTargetSpace(100);
   last_bound_pos_ = 0;
   relocations_.reserve(128);
 }
@@ -433,9 +428,9 @@ int Assembler::target_at(int pos) {
   // check which type of branch this is 16 or 26 bit offset
   Opcode opcode = Instruction::S390OpcodeValue(buffer_ + pos);
 
-  if (BRC == opcode || BRCT == opcode || BRCTG == opcode) {
+  if (BRC == opcode || BRCT == opcode || BRCTG == opcode || BRXH == opcode) {
     int16_t imm16 = SIGN_EXT_IMM16((instr & kImm16Mask));
-    imm16 <<= 1;  // BRC immediate is in # of halfwords
+    imm16 <<= 1;  // immediate is in # of halfwords
     if (imm16 == 0) return kEndOfChain;
     return pos + imm16;
   } else if (LLILF == opcode || BRCL == opcode || LARL == opcode ||
@@ -446,6 +441,13 @@ int Assembler::target_at(int pos) {
       imm32 <<= 1;  // BR* + LARL treat immediate in # of halfwords
     if (imm32 == 0) return kEndOfChain;
     return pos + imm32;
+  } else if (BRXHG == opcode) {
+    // offset is in bits 16-31 of 48 bit instruction
+    instr = instr >> 16;
+    int16_t imm16 = SIGN_EXT_IMM16((instr & kImm16Mask));
+    imm16 <<= 1;  // immediate is in # of halfwords
+    if (imm16 == 0) return kEndOfChain;
+    return pos + imm16;
   }
 
   // Unknown condition
@@ -460,10 +462,11 @@ void Assembler::target_at_put(int pos, int target_pos, bool* is_branch) {
 
   if (is_branch != nullptr) {
     *is_branch = (opcode == BRC || opcode == BRCT || opcode == BRCTG ||
-                  opcode == BRCL || opcode == BRASL);
+                  opcode == BRCL || opcode == BRASL || opcode == BRXH ||
+                  opcode == BRXHG);
   }
 
-  if (BRC == opcode || BRCT == opcode || BRCTG == opcode) {
+  if (BRC == opcode || BRCT == opcode || BRCTG == opcode || BRXH == opcode) {
     int16_t imm16 = target_pos - pos;
     instr &= (~0xFFFF);
     DCHECK(is_int16(imm16));
@@ -483,6 +486,15 @@ void Assembler::target_at_put(int pos, int target_pos, bool* is_branch) {
     instr &= (~static_cast<uint64_t>(0xFFFFFFFF));
     instr_at_put<SixByteInstr>(pos, instr | imm32);
     return;
+  } else if (BRXHG == opcode) {
+    // Immediate is in bits 16-31 of 48 bit instruction
+    int32_t imm16 = target_pos - pos;
+    instr &= (0xFFFF0000FFFF); // clear bits 16-31
+    imm16 &= 0xFFFF;           // clear high halfword
+    imm16 <<= 16;
+    // Immediate is in # of halfwords
+    instr_at_put<SixByteInstr>(pos, instr | (imm16 >> 1));
+    return;
   }
   DCHECK(false);
 }
@@ -490,10 +502,10 @@ void Assembler::target_at_put(int pos, int target_pos, bool* is_branch) {
 // Returns the maximum number of bits given instruction can address.
 int Assembler::max_reach_from(int pos) {
   Opcode opcode = Instruction::S390OpcodeValue(buffer_ + pos);
-
   // Check which type of instr.  In theory, we can return
   // the values below + 1, given offset is # of halfwords
-  if (BRC == opcode || BRCT == opcode || BRCTG == opcode) {
+  if (BRC == opcode || BRCT == opcode || BRCTG == opcode|| BRXH == opcode ||
+      BRXHG == opcode) {
     return 16;
   } else if (LLILF == opcode || BRCL == opcode || LARL == opcode ||
              BRASL == opcode) {
@@ -605,21 +617,6 @@ void Assembler::branchOnCond(Condition c, int branch_offset, bool is_bound) {
   }
 }
 
-// 32-bit Store Multiple - short displacement (12-bits unsigned)
-void Assembler::stm(Register r1, Register r2, const MemOperand& src) {
-  rs_form(STM, r1, r2, src.rb(), src.offset());
-}
-
-// 32-bit Store Multiple - long displacement (20-bits signed)
-void Assembler::stmy(Register r1, Register r2, const MemOperand& src) {
-  rsy_form(STMY, r1, r2, src.rb(), src.offset());
-}
-
-// 64-bit Store Multiple - long displacement (20-bits signed)
-void Assembler::stmg(Register r1, Register r2, const MemOperand& src) {
-  rsy_form(STMG, r1, r2, src.rb(), src.offset());
-}
-
 // Exception-generating instructions and debugging support.
 // Stops with a non-negative code less than kNumOfWatchedStops support
 // enabling/disabling and a counter feature. See simulator-s390.h .
@@ -655,671 +652,6 @@ void Assembler::nop(int type) {
   }
 }
 
-
-
-// RI1 format: <insn> R1,I2
-//    +--------+----+----+------------------+
-//    | OpCode | R1 |OpCd|        I2        |
-//    +--------+----+----+------------------+
-//    0        8    12   16                31
-#define RI1_FORM_EMIT(name, op) \
-  void Assembler::name(Register r, const Operand& i2) { ri_form(op, r, i2); }
-
-void Assembler::ri_form(Opcode op, Register r1, const Operand& i2) {
-  DCHECK(is_uint12(op));
-  DCHECK(is_uint16(i2.immediate()) || is_int16(i2.immediate()));
-  emit4bytes((op & 0xFF0) * B20 | r1.code() * B20 | (op & 0xF) * B16 |
-             (i2.immediate() & 0xFFFF));
-}
-
-// RI2 format: <insn> M1,I2
-//    +--------+----+----+------------------+
-//    | OpCode | M1 |OpCd|        I2        |
-//    +--------+----+----+------------------+
-//    0        8    12   16                31
-#define RI2_FORM_EMIT(name, op) \
-  void Assembler::name(Condition m, const Operand& i2) { ri_form(op, m, i2); }
-
-void Assembler::ri_form(Opcode op, Condition m1, const Operand& i2) {
-  DCHECK(is_uint12(op));
-  DCHECK(is_uint4(m1));
-  DCHECK(op == BRC ? is_int16(i2.immediate()) : is_uint16(i2.immediate()));
-  emit4bytes((op & 0xFF0) * B20 | m1 * B20 | (op & 0xF) * B16 |
-             (i2.immediate() & 0xFFFF));
-}
-
-// RIE-f format: <insn> R1,R2,I3,I4,I5
-//    +--------+----+----+------------------+--------+--------+
-//    | OpCode | R1 | R2 |   I3   |    I4   |   I5   | OpCode |
-//    +--------+----+----+------------------+--------+--------+
-//    0        8    12   16      24         32       40      47
-void Assembler::rie_f_form(Opcode op, Register r1, Register r2,
-                           const Operand& i3, const Operand& i4,
-                           const Operand& i5) {
-  DCHECK(is_uint16(op));
-  DCHECK(is_uint8(i3.immediate()));
-  DCHECK(is_uint8(i4.immediate()));
-  DCHECK(is_uint8(i5.immediate()));
-  uint64_t code = (static_cast<uint64_t>(op & 0xFF00)) * B32 |
-                  (static_cast<uint64_t>(r1.code())) * B36 |
-                  (static_cast<uint64_t>(r2.code())) * B32 |
-                  (static_cast<uint64_t>(i3.immediate())) * B24 |
-                  (static_cast<uint64_t>(i4.immediate())) * B16 |
-                  (static_cast<uint64_t>(i5.immediate())) * B8 |
-                  (static_cast<uint64_t>(op & 0x00FF));
-  emit6bytes(code);
-}
-
-// RIE format: <insn> R1,R3,I2
-//    +--------+----+----+------------------+--------+--------+
-//    | OpCode | R1 | R3 |        I2        |////////| OpCode |
-//    +--------+----+----+------------------+--------+--------+
-//    0        8    12   16                 32       40      47
-#define RIE_FORM_EMIT(name, op)                                       \
-  void Assembler::name(Register r1, Register r3, const Operand& i2) { \
-    rie_form(op, r1, r3, i2);                                         \
-  }
-
-void Assembler::rie_form(Opcode op, Register r1, Register r3,
-                         const Operand& i2) {
-  DCHECK(is_uint16(op));
-  DCHECK(is_int16(i2.immediate()));
-  uint64_t code = (static_cast<uint64_t>(op & 0xFF00)) * B32 |
-                  (static_cast<uint64_t>(r1.code())) * B36 |
-                  (static_cast<uint64_t>(r3.code())) * B32 |
-                  (static_cast<uint64_t>(i2.immediate() & 0xFFFF)) * B16 |
-                  (static_cast<uint64_t>(op & 0x00FF));
-  emit6bytes(code);
-}
-
-// RS1 format: <insn> R1,R3,D2(B2)
-//    +--------+----+----+----+-------------+
-//    | OpCode | R1 | R3 | B2 |     D2      |
-//    +--------+----+----+----+-------------+
-//    0        8    12   16   20           31
-#define RS1_FORM_EMIT(name, op)                                            \
-  void Assembler::name(Register r1, Register r3, Register b2, Disp d2) {   \
-    rs_form(op, r1, r3, b2, d2);                                           \
-  }                                                                        \
-  void Assembler::name(Register r1, Register r3, const MemOperand& opnd) { \
-    name(r1, r3, opnd.getBaseRegister(), opnd.getDisplacement());          \
-  }
-
-void Assembler::rs_form(Opcode op, Register r1, Register r3, Register b2,
-                        const Disp d2) {
-  DCHECK(is_uint12(d2));
-  emit4bytes(op * B24 | r1.code() * B20 | r3.code() * B16 | b2.code() * B12 |
-             d2);
-}
-
-// RS2 format: <insn> R1,M3,D2(B2)
-//    +--------+----+----+----+-------------+
-//    | OpCode | R1 | M3 | B2 |     D2      |
-//    +--------+----+----+----+-------------+
-//    0        8    12   16   20           31
-#define RS2_FORM_EMIT(name, op)                                             \
-  void Assembler::name(Register r1, Condition m3, Register b2, Disp d2) {   \
-    rs_form(op, r1, m3, b2, d2);                                            \
-  }                                                                         \
-  void Assembler::name(Register r1, Condition m3, const MemOperand& opnd) { \
-    name(r1, m3, opnd.getBaseRegister(), opnd.getDisplacement());           \
-  }
-
-void Assembler::rs_form(Opcode op, Register r1, Condition m3, Register b2,
-                        const Disp d2) {
-  DCHECK(is_uint12(d2));
-  emit4bytes(op * B24 | r1.code() * B20 | m3 * B16 | b2.code() * B12 | d2);
-}
-
-// RSI format: <insn> R1,R3,I2
-//    +--------+----+----+------------------+
-//    | OpCode | R1 | R3 |        RI2       |
-//    +--------+----+----+------------------+
-//    0        8    12   16                 31
-#define RSI_FORM_EMIT(name, op)                                       \
-  void Assembler::name(Register r1, Register r3, const Operand& i2) { \
-    rsi_form(op, r1, r3, i2);                                         \
-  }
-
-void Assembler::rsi_form(Opcode op, Register r1, Register r3,
-                         const Operand& i2) {
-  DCHECK(is_uint8(op));
-  DCHECK(is_uint16(i2.immediate()));
-  emit4bytes(op * B24 | r1.code() * B20 | r3.code() * B16 |
-             (i2.immediate() & 0xFFFF));
-}
-
-// RSL format: <insn> R1,R3,D2(B2)
-//    +--------+----+----+----+-------------+--------+--------+
-//    | OpCode | L1 |    | B2 |    D2       |        | OpCode |
-//    +--------+----+----+----+-------------+--------+--------+
-//    0        8    12   16   20            32       40      47
-#define RSL_FORM_EMIT(name, op)                           \
-  void Assembler::name(Length l1, Register b2, Disp d2) { \
-    rsl_form(op, l1, b2, d2);                             \
-  }
-
-void Assembler::rsl_form(Opcode op, Length l1, Register b2, Disp d2) {
-  DCHECK(is_uint16(op));
-  uint64_t code = (static_cast<uint64_t>(op & 0xFF00)) * B32 |
-                  (static_cast<uint64_t>(l1)) * B36 |
-                  (static_cast<uint64_t>(b2.code())) * B28 |
-                  (static_cast<uint64_t>(d2)) * B16 |
-                  (static_cast<uint64_t>(op & 0x00FF));
-  emit6bytes(code);
-}
-
-// RSY1 format: <insn> R1,R3,D2(B2)
-//    +--------+----+----+----+-------------+--------+--------+
-//    | OpCode | R1 | R3 | B2 |    DL2      |  DH2   | OpCode |
-//    +--------+----+----+----+-------------+--------+--------+
-//    0        8    12   16   20            32       40      47
-#define RSY1_FORM_EMIT(name, op)                                           \
-  void Assembler::name(Register r1, Register r3, Register b2, Disp d2) {   \
-    rsy_form(op, r1, r3, b2, d2);                                          \
-  }                                                                        \
-  void Assembler::name(Register r1, Register r3, const MemOperand& opnd) { \
-    name(r1, r3, opnd.getBaseRegister(), opnd.getDisplacement());          \
-  }
-
-void Assembler::rsy_form(Opcode op, Register r1, Register r3, Register b2,
-                         const Disp d2) {
-  DCHECK(is_int20(d2));
-  DCHECK(is_uint16(op));
-  uint64_t code = (static_cast<uint64_t>(op & 0xFF00)) * B32 |
-                  (static_cast<uint64_t>(r1.code())) * B36 |
-                  (static_cast<uint64_t>(r3.code())) * B32 |
-                  (static_cast<uint64_t>(b2.code())) * B28 |
-                  (static_cast<uint64_t>(d2 & 0x0FFF)) * B16 |
-                  (static_cast<uint64_t>(d2 & 0x0FF000)) >> 4 |
-                  (static_cast<uint64_t>(op & 0x00FF));
-  emit6bytes(code);
-}
-
-// RSY2 format: <insn> R1,M3,D2(B2)
-//    +--------+----+----+----+-------------+--------+--------+
-//    | OpCode | R1 | M3 | B2 |    DL2      |  DH2   | OpCode |
-//    +--------+----+----+----+-------------+--------+--------+
-//    0        8    12   16   20            32       40      47
-#define RSY2_FORM_EMIT(name, op)                                            \
-  void Assembler::name(Register r1, Condition m3, Register b2, Disp d2) {   \
-    rsy_form(op, r1, m3, b2, d2);                                           \
-  }                                                                         \
-  void Assembler::name(Register r1, Condition m3, const MemOperand& opnd) { \
-    name(r1, m3, opnd.getBaseRegister(), opnd.getDisplacement());           \
-  }
-
-void Assembler::rsy_form(Opcode op, Register r1, Condition m3, Register b2,
-                         const Disp d2) {
-  DCHECK(is_int20(d2));
-  DCHECK(is_uint16(op));
-  uint64_t code = (static_cast<uint64_t>(op & 0xFF00)) * B32 |
-                  (static_cast<uint64_t>(r1.code())) * B36 |
-                  (static_cast<uint64_t>(m3)) * B32 |
-                  (static_cast<uint64_t>(b2.code())) * B28 |
-                  (static_cast<uint64_t>(d2 & 0x0FFF)) * B16 |
-                  (static_cast<uint64_t>(d2 & 0x0FF000)) >> 4 |
-                  (static_cast<uint64_t>(op & 0x00FF));
-  emit6bytes(code);
-}
-
-// RXE format: <insn> R1,D2(X2,B2)
-//    +--------+----+----+----+-------------+--------+--------+
-//    | OpCode | R1 | X2 | B2 |     D2      |////////| OpCode |
-//    +--------+----+----+----+-------------+--------+--------+
-//    0        8    12   16   20            32       40      47
-#define RXE_FORM_EMIT(name, op)                                          \
-  void Assembler::name(Register r1, Register x2, Register b2, Disp d2) { \
-    rxe_form(op, r1, x2, b2, d2);                                        \
-  }                                                                      \
-  void Assembler::name(Register r1, const MemOperand& opnd) {            \
-    name(r1, opnd.getIndexRegister(), opnd.getBaseRegister(),            \
-         opnd.getDisplacement());                                        \
-  }
-
-void Assembler::rxe_form(Opcode op, Register r1, Register x2, Register b2,
-                         Disp d2) {
-  DCHECK(is_uint12(d2));
-  DCHECK(is_uint16(op));
-  uint64_t code = (static_cast<uint64_t>(op & 0xFF00)) * B32 |
-                  (static_cast<uint64_t>(r1.code())) * B36 |
-                  (static_cast<uint64_t>(x2.code())) * B32 |
-                  (static_cast<uint64_t>(b2.code())) * B28 |
-                  (static_cast<uint64_t>(d2 & 0x0FFF)) * B16 |
-                  (static_cast<uint64_t>(op & 0x00FF));
-  emit6bytes(code);
-}
-
-// RRS format: <insn> R1,R2,M3,D4(B4)
-//    +--------+----+----+----+-------------+----+---+--------+
-//    | OpCode | R1 | R2 | B4 |     D4      | M3 |///| OpCode |
-//    +--------+----+----+----+-------------+----+---+--------+
-//    0        8    12   16   20            32   36   40      47
-#define RRS_FORM_EMIT(name, op)                                        \
-  void Assembler::name(Register r1, Register r2, Register b4, Disp d4, \
-                       Condition m3) {                                 \
-    rrs_form(op, r1, r2, b4, d4, m3);                                  \
-  }                                                                    \
-  void Assembler::name(Register r1, Register r2, Condition m3,         \
-                       const MemOperand& opnd) {                       \
-    name(r1, r2, opnd.getBaseRegister(), opnd.getDisplacement(), m3);  \
-  }
-
-void Assembler::rrs_form(Opcode op, Register r1, Register r2, Register b4,
-                         Disp d4, Condition m3) {
-  DCHECK(is_uint12(d4));
-  DCHECK(is_uint16(op));
-  uint64_t code = (static_cast<uint64_t>(op & 0xFF00)) * B32 |
-                  (static_cast<uint64_t>(r1.code())) * B36 |
-                  (static_cast<uint64_t>(r2.code())) * B32 |
-                  (static_cast<uint64_t>(b4.code())) * B28 |
-                  (static_cast<uint64_t>(d4)) * B16 |
-                  (static_cast<uint64_t>(m3)) << 12 |
-                  (static_cast<uint64_t>(op & 0x00FF));
-  emit6bytes(code);
-}
-
-// RIS format: <insn> R1,I2,M3,D4(B4)
-//    +--------+----+----+----+-------------+--------+--------+
-//    | OpCode | R1 | M3 | B4 |     D4      |   I2   | OpCode |
-//    +--------+----+----+----+-------------+--------+--------+
-//    0        8    12   16   20            32        40      47
-#define RIS_FORM_EMIT(name, op)                                         \
-  void Assembler::name(Register r1, Condition m3, Register b4, Disp d4, \
-                       const Operand& i2) {                             \
-    ris_form(op, r1, m3, b4, d4, i2);                                   \
-  }                                                                     \
-  void Assembler::name(Register r1, const Operand& i2, Condition m3,    \
-                       const MemOperand& opnd) {                        \
-    name(r1, m3, opnd.getBaseRegister(), opnd.getDisplacement(), i2);   \
-  }
-
-void Assembler::ris_form(Opcode op, Register r1, Condition m3, Register b4,
-                         Disp d4, const Operand& i2) {
-  DCHECK(is_uint12(d4));
-  DCHECK(is_uint16(op));
-  DCHECK(is_uint8(i2.immediate()));
-  uint64_t code = (static_cast<uint64_t>(op & 0xFF00)) * B32 |
-                  (static_cast<uint64_t>(r1.code())) * B36 |
-                  (static_cast<uint64_t>(m3)) * B32 |
-                  (static_cast<uint64_t>(b4.code())) * B28 |
-                  (static_cast<uint64_t>(d4)) * B16 |
-                  (static_cast<uint64_t>(i2.immediate())) << 8 |
-                  (static_cast<uint64_t>(op & 0x00FF));
-  emit6bytes(code);
-}
-
-// S format: <insn> D2(B2)
-//    +------------------+----+-------------+
-//    |      OpCode      | B2 |     D2      |
-//    +------------------+----+-------------+
-//    0                  16   20           31
-#define S_FORM_EMIT(name, op)                                        \
-  void Assembler::name(Register b1, Disp d2) { s_form(op, b1, d2); } \
-  void Assembler::name(const MemOperand& opnd) {                     \
-    name(opnd.getBaseRegister(), opnd.getDisplacement());            \
-  }
-
-void Assembler::s_form(Opcode op, Register b1, Disp d2) {
-  DCHECK(is_uint12(d2));
-  emit4bytes(op << 16 | b1.code() * B12 | d2);
-}
-
-// SI format: <insn> D1(B1),I2
-//    +--------+---------+----+-------------+
-//    | OpCode |   I2    | B1 |     D1      |
-//    +--------+---------+----+-------------+
-//    0        8         16   20           31
-#define SI_FORM_EMIT(name, op)                                      \
-  void Assembler::name(const Operand& i2, Register b1, Disp d1) {   \
-    si_form(op, i2, b1, d1);                                        \
-  }                                                                 \
-  void Assembler::name(const MemOperand& opnd, const Operand& i2) { \
-    name(i2, opnd.getBaseRegister(), opnd.getDisplacement());       \
-  }
-
-void Assembler::si_form(Opcode op, const Operand& i2, Register b1, Disp d1) {
-  emit4bytes((op & 0x00FF) << 24 | i2.immediate() * B16 | b1.code() * B12 | d1);
-}
-
-// SIY format: <insn> D1(B1),I2
-//    +--------+---------+----+-------------+--------+--------+
-//    | OpCode |   I2    | B1 |     DL1     |  DH1   | OpCode |
-//    +--------+---------+----+-------------+--------+--------+
-//    0        8         16   20            32   36   40      47
-#define SIY_FORM_EMIT(name, op)                                     \
-  void Assembler::name(const Operand& i2, Register b1, Disp d1) {   \
-    siy_form(op, i2, b1, d1);                                       \
-  }                                                                 \
-  void Assembler::name(const MemOperand& opnd, const Operand& i2) { \
-    name(i2, opnd.getBaseRegister(), opnd.getDisplacement());       \
-  }
-
-void Assembler::siy_form(Opcode op, const Operand& i2, Register b1, Disp d1) {
-  DCHECK(is_uint20(d1) || is_int20(d1));
-  DCHECK(is_uint16(op));
-  DCHECK(is_uint8(i2.immediate()));
-  uint64_t code = (static_cast<uint64_t>(op & 0xFF00)) * B32 |
-                  (static_cast<uint64_t>(i2.immediate())) * B32 |
-                  (static_cast<uint64_t>(b1.code())) * B28 |
-                  (static_cast<uint64_t>(d1 & 0x0FFF)) * B16 |
-                  (static_cast<uint64_t>(d1 & 0x0FF000)) >> 4 |
-                  (static_cast<uint64_t>(op & 0x00FF));
-  emit6bytes(code);
-}
-
-// SIL format: <insn> D1(B1),I2
-//    +------------------+----+-------------+-----------------+
-//    |     OpCode       | B1 |      D1     |        I2       |
-//    +------------------+----+-------------+-----------------+
-//    0                 16   20            32                47
-#define SIL_FORM_EMIT(name, op)                                     \
-  void Assembler::name(Register b1, Disp d1, const Operand& i2) {   \
-    sil_form(op, b1, d1, i2);                                       \
-  }                                                                 \
-  void Assembler::name(const MemOperand& opnd, const Operand& i2) { \
-    name(opnd.getBaseRegister(), opnd.getDisplacement(), i2);       \
-  }
-
-void Assembler::sil_form(Opcode op, Register b1, Disp d1, const Operand& i2) {
-  DCHECK(is_uint12(d1));
-  DCHECK(is_uint16(op));
-  DCHECK(is_uint16(i2.immediate()));
-  uint64_t code = (static_cast<uint64_t>(op)) * B32 |
-                  (static_cast<uint64_t>(b1.code())) * B28 |
-                  (static_cast<uint64_t>(d1)) * B16 |
-                  (static_cast<uint64_t>(i2.immediate()));
-  emit6bytes(code);
-}
-
-// RXF format: <insn> R1,R3,D2(X2,B2)
-//    +--------+----+----+----+-------------+----+---+--------+
-//    | OpCode | R3 | X2 | B2 |     D2      | R1 |///| OpCode |
-//    +--------+----+----+----+-------------+----+---+--------+
-//    0        8    12   16   20            32   36  40      47
-#define RXF_FORM_EMIT(name, op)                                            \
-  void Assembler::name(Register r1, Register r3, Register b2, Register x2, \
-                       Disp d2) {                                          \
-    rxf_form(op, r1, r3, b2, x2, d2);                                      \
-  }                                                                        \
-  void Assembler::name(Register r1, Register r3, const MemOperand& opnd) { \
-    name(r1, r3, opnd.getBaseRegister(), opnd.getIndexRegister(),          \
-         opnd.getDisplacement());                                          \
-  }
-
-void Assembler::rxf_form(Opcode op, Register r1, Register r3, Register b2,
-                         Register x2, Disp d2) {
-  DCHECK(is_uint12(d2));
-  DCHECK(is_uint16(op));
-  uint64_t code = (static_cast<uint64_t>(op & 0xFF00)) * B32 |
-                  (static_cast<uint64_t>(r3.code())) * B36 |
-                  (static_cast<uint64_t>(x2.code())) * B32 |
-                  (static_cast<uint64_t>(b2.code())) * B28 |
-                  (static_cast<uint64_t>(d2)) * B16 |
-                  (static_cast<uint64_t>(r1.code())) * B12 |
-                  (static_cast<uint64_t>(op & 0x00FF));
-  emit6bytes(code);
-}
-
-// SS1 format: <insn> D1(L,B1),D2(B3)
-//    +--------+----+----+----+-------------+----+------------+
-//    | OpCode |    L    | B1 |     D1      | B2 |     D2     |
-//    +--------+----+----+----+-------------+----+------------+
-//    0        8    12   16   20            32   36          47
-#define SS1_FORM_EMIT(name, op)                                                \
-  void Assembler::name(Register b1, Disp d1, Register b2, Disp d2, Length l) { \
-    ss_form(op, l, b1, d1, b2, d2);                                            \
-  }                                                                            \
-  void Assembler::name(const MemOperand& opnd1, const MemOperand& opnd2,       \
-                       Length length) {                                        \
-    name(opnd1.getBaseRegister(), opnd1.getDisplacement(),                     \
-         opnd2.getBaseRegister(), opnd2.getDisplacement(), length);            \
-  }
-
-void Assembler::ss_form(Opcode op, Length l, Register b1, Disp d1, Register b2,
-                        Disp d2) {
-  DCHECK(is_uint12(d2));
-  DCHECK(is_uint12(d1));
-  DCHECK(is_uint8(op));
-  DCHECK(is_uint8(l));
-  uint64_t code =
-      (static_cast<uint64_t>(op)) * B40 | (static_cast<uint64_t>(l)) * B32 |
-      (static_cast<uint64_t>(b1.code())) * B28 |
-      (static_cast<uint64_t>(d1)) * B16 |
-      (static_cast<uint64_t>(b2.code())) * B12 | (static_cast<uint64_t>(d2));
-  emit6bytes(code);
-}
-
-// SS2 format: <insn> D1(L1,B1), D2(L3,B3)
-//    +--------+----+----+----+-------------+----+------------+
-//    | OpCode | L1 | L2 | B1 |     D1      | B2 |     D2     |
-//    +--------+----+----+----+-------------+----+------------+
-//    0        8    12   16   20            32   36          47
-#define SS2_FORM_EMIT(name, op)                                               \
-  void Assembler::name(Register b1, Disp d1, Register b2, Disp d2, Length l1, \
-                       Length l2) {                                           \
-    ss_form(op, l1, l2, b1, d1, b2, d2);                                      \
-  }                                                                           \
-  void Assembler::name(const MemOperand& opnd1, const MemOperand& opnd2,      \
-                       Length length1, Length length2) {                      \
-    name(opnd1.getBaseRegister(), opnd1.getDisplacement(),                    \
-         opnd2.getBaseRegister(), opnd2.getDisplacement(), length1, length2); \
-  }
-
-void Assembler::ss_form(Opcode op, Length l1, Length l2, Register b1, Disp d1,
-                        Register b2, Disp d2) {
-  DCHECK(is_uint12(d2));
-  DCHECK(is_uint12(d1));
-  DCHECK(is_uint8(op));
-  DCHECK(is_uint4(l2));
-  DCHECK(is_uint4(l1));
-  uint64_t code =
-      (static_cast<uint64_t>(op)) * B40 | (static_cast<uint64_t>(l1)) * B36 |
-      (static_cast<uint64_t>(l2)) * B32 |
-      (static_cast<uint64_t>(b1.code())) * B28 |
-      (static_cast<uint64_t>(d1)) * B16 |
-      (static_cast<uint64_t>(b2.code())) * B12 | (static_cast<uint64_t>(d2));
-  emit6bytes(code);
-}
-
-// SS3 format: <insn> D1(L1,B1), D2(I3,B2)
-//    +--------+----+----+----+-------------+----+------------+
-//    | OpCode | L1 | I3 | B1 |     D1      | B2 |     D2     |
-//    +--------+----+----+----+-------------+----+------------+
-//    0        8    12   16   20            32   36          47
-#define SS3_FORM_EMIT(name, op)                                              \
-  void Assembler::name(const Operand& i3, Register b1, Disp d1, Register b2, \
-                       Disp d2, Length l1) {                                 \
-    ss_form(op, l1, i3, b1, d1, b2, d2);                                     \
-  }                                                                          \
-  void Assembler::name(const MemOperand& opnd1, const MemOperand& opnd2,     \
-                       Length length) {                                      \
-    DCHECK(false);                                                           \
-  }
-void Assembler::ss_form(Opcode op, Length l1, const Operand& i3, Register b1,
-                        Disp d1, Register b2, Disp d2) {
-  DCHECK(is_uint12(d2));
-  DCHECK(is_uint12(d1));
-  DCHECK(is_uint8(op));
-  DCHECK(is_uint4(l1));
-  DCHECK(is_uint4(i3.immediate()));
-  uint64_t code =
-      (static_cast<uint64_t>(op)) * B40 | (static_cast<uint64_t>(l1)) * B36 |
-      (static_cast<uint64_t>(i3.immediate())) * B32 |
-      (static_cast<uint64_t>(b1.code())) * B28 |
-      (static_cast<uint64_t>(d1)) * B16 |
-      (static_cast<uint64_t>(b2.code())) * B12 | (static_cast<uint64_t>(d2));
-  emit6bytes(code);
-}
-
-// SS4 format: <insn> D1(R1,B1), D2(R3,B2)
-//    +--------+----+----+----+-------------+----+------------+
-//    | OpCode | R1 | R3 | B1 |     D1      | B2 |     D2     |
-//    +--------+----+----+----+-------------+----+------------+
-//    0        8    12   16   20            32   36          47
-#define SS4_FORM_EMIT(name, op)                                            \
-  void Assembler::name(Register r1, Register r3, Register b1, Disp d1,     \
-                       Register b2, Disp d2) {                             \
-    ss_form(op, r1, r3, b1, d1, b2, d2);                                   \
-  }                                                                        \
-  void Assembler::name(const MemOperand& opnd1, const MemOperand& opnd2) { \
-    DCHECK(false);                                                         \
-  }
-void Assembler::ss_form(Opcode op, Register r1, Register r3, Register b1,
-                        Disp d1, Register b2, Disp d2) {
-  DCHECK(is_uint12(d2));
-  DCHECK(is_uint12(d1));
-  DCHECK(is_uint8(op));
-  uint64_t code = (static_cast<uint64_t>(op)) * B40 |
-                  (static_cast<uint64_t>(r1.code())) * B36 |
-                  (static_cast<uint64_t>(r3.code())) * B32 |
-                  (static_cast<uint64_t>(b1.code())) * B28 |
-                  (static_cast<uint64_t>(d1)) * B16 |
-                  (static_cast<uint64_t>(b2.code())) * B12 |
-                  (static_cast<uint64_t>(d2));
-  emit6bytes(code);
-}
-
-// SS5 format: <insn> D1(R1,B1), D2(R3,B2)
-//    +--------+----+----+----+-------------+----+------------+
-//    | OpCode | R1 | R3 | B2 |     D2      | B4 |     D4     |
-//    +--------+----+----+----+-------------+----+------------+
-//    0        8    12   16   20            32   36          47
-#define SS5_FORM_EMIT(name, op)                                            \
-  void Assembler::name(Register r1, Register r3, Register b2, Disp d2,     \
-                       Register b4, Disp d4) {                             \
-    ss_form(op, r1, r3, b2, d2, b4, d4); /*SS5 use the same form as SS4*/  \
-  }                                                                        \
-  void Assembler::name(const MemOperand& opnd1, const MemOperand& opnd2) { \
-    DCHECK(false);                                                         \
-  }
-
-#define SS6_FORM_EMIT(name, op) SS1_FORM_EMIT(name, op)
-
-// SSE format: <insn> D1(B1),D2(B2)
-//    +------------------+----+-------------+----+------------+
-//    |      OpCode      | B1 |     D1      | B2 |     D2     |
-//    +------------------+----+-------------+----+------------+
-//    0        8    12   16   20            32   36           47
-#define SSE_FORM_EMIT(name, op)                                            \
-  void Assembler::name(Register b1, Disp d1, Register b2, Disp d2) {       \
-    sse_form(op, b1, d1, b2, d2);                                          \
-  }                                                                        \
-  void Assembler::name(const MemOperand& opnd1, const MemOperand& opnd2) { \
-    name(opnd1.getBaseRegister(), opnd1.getDisplacement(),                 \
-         opnd2.getBaseRegister(), opnd2.getDisplacement());                \
-  }
-void Assembler::sse_form(Opcode op, Register b1, Disp d1, Register b2,
-                         Disp d2) {
-  DCHECK(is_uint12(d2));
-  DCHECK(is_uint12(d1));
-  DCHECK(is_uint16(op));
-  uint64_t code = (static_cast<uint64_t>(op)) * B32 |
-                  (static_cast<uint64_t>(b1.code())) * B28 |
-                  (static_cast<uint64_t>(d1)) * B16 |
-                  (static_cast<uint64_t>(b2.code())) * B12 |
-                  (static_cast<uint64_t>(d2));
-  emit6bytes(code);
-}
-
-// SSF format: <insn> R3, D1(B1),D2(B2),R3
-//    +--------+----+----+----+-------------+----+------------+
-//    | OpCode | R3 |OpCd| B1 |     D1      | B2 |     D2     |
-//    +--------+----+----+----+-------------+----+------------+
-//    0        8    12   16   20            32   36           47
-#define SSF_FORM_EMIT(name, op)                                        \
-  void Assembler::name(Register r3, Register b1, Disp d1, Register b2, \
-                       Disp d2) {                                      \
-    ssf_form(op, r3, b1, d1, b2, d2);                                  \
-  }                                                                    \
-  void Assembler::name(Register r3, const MemOperand& opnd1,           \
-                       const MemOperand& opnd2) {                      \
-    name(r3, opnd1.getBaseRegister(), opnd1.getDisplacement(),         \
-         opnd2.getBaseRegister(), opnd2.getDisplacement());            \
-  }
-
-void Assembler::ssf_form(Opcode op, Register r3, Register b1, Disp d1,
-                         Register b2, Disp d2) {
-  DCHECK(is_uint12(d2));
-  DCHECK(is_uint12(d1));
-  DCHECK(is_uint12(op));
-  uint64_t code = (static_cast<uint64_t>(op & 0xFF0)) * B36 |
-                  (static_cast<uint64_t>(r3.code())) * B36 |
-                  (static_cast<uint64_t>(op & 0x00F)) * B32 |
-                  (static_cast<uint64_t>(b1.code())) * B28 |
-                  (static_cast<uint64_t>(d1)) * B16 |
-                  (static_cast<uint64_t>(b2.code())) * B12 |
-                  (static_cast<uint64_t>(d2));
-  emit6bytes(code);
-}
-
-//  RRF1 format: <insn> R1,R2,R3
-//    +------------------+----+----+----+----+
-//    |      OpCode      | R3 |    | R1 | R2 |
-//    +------------------+----+----+----+----+
-//    0                  16   20   24   28  31
-#define RRF1_FORM_EMIT(name, op)                                        \
-  void Assembler::name(Register r1, Register r2, Register r3) {         \
-    rrf1_form(op << 16 | r3.code() * B12 | r1.code() * B4 | r2.code()); \
-  }
-
-void Assembler::rrf1_form(Opcode op, Register r1, Register r2, Register r3) {
-  uint32_t code = op << 16 | r3.code() * B12 | r1.code() * B4 | r2.code();
-  emit4bytes(code);
-}
-
-void Assembler::rrf1_form(uint32_t code) { emit4bytes(code); }
-
-//  RRF2 format: <insn> R1,R2,M3
-//    +------------------+----+----+----+----+
-//    |      OpCode      | M3 |    | R1 | R2 |
-//    +------------------+----+----+----+----+
-//    0                  16   20   24   28  31
-#define RRF2_FORM_EMIT(name, op)                                 \
-  void Assembler::name(Condition m3, Register r1, Register r2) { \
-    rrf2_form(op << 16 | m3 * B12 | r1.code() * B4 | r2.code()); \
-  }
-
-void Assembler::rrf2_form(uint32_t code) { emit4bytes(code); }
-
-//  RRF3 format: <insn> R1,R2,R3,M4
-//    +------------------+----+----+----+----+
-//    |      OpCode      | R3 | M4 | R1 | R2 |
-//    +------------------+----+----+----+----+
-//    0                  16   20   24   28  31
-#define RRF3_FORM_EMIT(name, op)                                             \
-  void Assembler::name(Register r3, Conition m4, Register r1, Register r2) { \
-    rrf3_form(op << 16 | r3.code() * B12 | m4 * B8 | r1.code() * B4 |        \
-              r2.code());                                                    \
-  }
-
-void Assembler::rrf3_form(uint32_t code) { emit4bytes(code); }
-
-//  RRF-e format: <insn> R1,M3,R2,M4
-//    +------------------+----+----+----+----+
-//    |      OpCode      | M3 | M4 | R1 | R2 |
-//    +------------------+----+----+----+----+
-//    0                  16   20   24   28  31
-void Assembler::rrfe_form(Opcode op, Condition m3, Condition m4, Register r1,
-                          Register r2) {
-  uint32_t code = op << 16 | m3 * B12 | m4 * B8 | r1.code() * B4 | r2.code();
-  emit4bytes(code);
-}
-
-// end of S390 Instruction generation
-
-// start of S390 instruction
-SS1_FORM_EMIT(ed, ED)
-SS1_FORM_EMIT(mvn, MVN)
-SS1_FORM_EMIT(nc, NC)
-SI_FORM_EMIT(ni, NI)
-RI1_FORM_EMIT(nilh, NILH)
-RI1_FORM_EMIT(nill, NILL)
-RI1_FORM_EMIT(oill, OILL)
-RI1_FORM_EMIT(tmll, TMLL)
-SS1_FORM_EMIT(tr, TR)
-S_FORM_EMIT(ts, TS)
-
 // -------------------------
 // Load Address Instructions
 // -------------------------
@@ -1328,764 +660,39 @@ void Assembler::larl(Register r1, Label* l) {
   larl(r1, Operand(branch_offset(l)));
 }
 
-// -----------------
-// Load Instructions
-// -----------------
-// Load Halfword Immediate (32)
-void Assembler::lhi(Register r, const Operand& imm) { ri_form(LHI, r, imm); }
-
-// Load Halfword Immediate (64)
-void Assembler::lghi(Register r, const Operand& imm) { ri_form(LGHI, r, imm); }
-
-// -------------------------
-// Load Logical Instructions
-// -------------------------
-// Load On Condition R-R (32)
-void Assembler::locr(Condition m3, Register r1, Register r2) {
-  rrf2_form(LOCR << 16 | m3 * B12 | r1.code() * B4 | r2.code());
-}
-
-// Load On Condition R-R (64)
-void Assembler::locgr(Condition m3, Register r1, Register r2) {
-  rrf2_form(LOCGR << 16 | m3 * B12 | r1.code() * B4 | r2.code());
-}
-
-// Load On Condition R-M (32)
-void Assembler::loc(Condition m3, Register r1, const MemOperand& src) {
-  rsy_form(LOC, r1, m3, src.rb(), src.offset());
-}
-
-// Load On Condition R-M (64)
-void Assembler::locg(Condition m3, Register r1, const MemOperand& src) {
-  rsy_form(LOCG, r1, m3, src.rb(), src.offset());
-}
-
-// -------------------
-// Branch Instructions
-// -------------------
-// Branch on Count (64)
-// Branch Relative and Save (32)
-void Assembler::bras(Register r, const Operand& opnd) {
-  ri_form(BRAS, r, opnd);
-}
-
-// Branch relative on Condition (32)
-void Assembler::brc(Condition c, const Operand& opnd) { ri_form(BRC, c, opnd); }
-
-// Branch On Count (32)
-void Assembler::brct(Register r1, const Operand& imm) {
-  // BRCT encodes # of halfwords, so divide by 2.
-  int16_t numHalfwords = static_cast<int16_t>(imm.immediate()) / 2;
-  Operand halfwordOp = Operand(numHalfwords);
-  halfwordOp.setBits(16);
-  ri_form(BRCT, r1, halfwordOp);
-}
-
-// Branch On Count (32)
-void Assembler::brctg(Register r1, const Operand& imm) {
-  // BRCTG encodes # of halfwords, so divide by 2.
-  int16_t numHalfwords = static_cast<int16_t>(imm.immediate()) / 2;
-  Operand halfwordOp = Operand(numHalfwords);
-  halfwordOp.setBits(16);
-  ri_form(BRCTG, r1, halfwordOp);
-}
-
-// --------------------
-// Compare Instructions
-// --------------------
-// Compare Halfword Immediate (32)
-void Assembler::chi(Register r, const Operand& opnd) { ri_form(CHI, r, opnd); }
-
-// Compare Halfword Immediate (64)
-void Assembler::cghi(Register r, const Operand& opnd) {
-  ri_form(CGHI, r, opnd);
-}
-
-// ----------------------------
-// Compare Logical Instructions
-// ----------------------------
-// Compare Immediate (Mem - Imm) (8)
-void Assembler::cli(const MemOperand& opnd, const Operand& imm) {
-  si_form(CLI, imm, opnd.rb(), opnd.offset());
-}
-
-// Compare Immediate (Mem - Imm) (8)
-void Assembler::cliy(const MemOperand& opnd, const Operand& imm) {
-  siy_form(CLIY, imm, opnd.rb(), opnd.offset());
-}
-
-// Compare logical - mem to mem operation
-void Assembler::clc(const MemOperand& opnd1, const MemOperand& opnd2,
-                    Length length) {
-  ss_form(CLC, length - 1, opnd1.getBaseRegister(), opnd1.getDisplacement(),
-          opnd2.getBaseRegister(), opnd2.getDisplacement());
-}
-
-// ----------------------------
-// Test Under Mask Instructions
-// ----------------------------
-// Test Under Mask (Mem - Imm) (8)
-void Assembler::tm(const MemOperand& opnd, const Operand& imm) {
-  si_form(TM, imm, opnd.rb(), opnd.offset());
-}
-
-// Test Under Mask (Mem - Imm) (8)
-void Assembler::tmy(const MemOperand& opnd, const Operand& imm) {
-  siy_form(TMY, imm, opnd.rb(), opnd.offset());
-}
-
-// -------------------------------
-// Rotate and Insert Selected Bits
-// -------------------------------
-// Rotate-And-Insert-Selected-Bits
-void Assembler::risbg(Register dst, Register src, const Operand& startBit,
-                      const Operand& endBit, const Operand& shiftAmt,
-                      bool zeroBits) {
-  // High tag the top bit of I4/EndBit to zero out any unselected bits
-  if (zeroBits)
-    rie_f_form(RISBG, dst, src, startBit, Operand(endBit.immediate() | 0x80),
-               shiftAmt);
-  else
-    rie_f_form(RISBG, dst, src, startBit, endBit, shiftAmt);
-}
-
-// Rotate-And-Insert-Selected-Bits
-void Assembler::risbgn(Register dst, Register src, const Operand& startBit,
-                       const Operand& endBit, const Operand& shiftAmt,
-                       bool zeroBits) {
-  // High tag the top bit of I4/EndBit to zero out any unselected bits
-  if (zeroBits)
-    rie_f_form(RISBGN, dst, src, startBit, Operand(endBit.immediate() | 0x80),
-               shiftAmt);
-  else
-    rie_f_form(RISBGN, dst, src, startBit, endBit, shiftAmt);
-}
-
-// ---------------------------
-// Move Character Instructions
-// ---------------------------
-// Move character - mem to mem operation
-void Assembler::mvc(const MemOperand& opnd1, const MemOperand& opnd2,
-                    uint32_t length) {
-  ss_form(MVC, length - 1, opnd1.getBaseRegister(), opnd1.getDisplacement(),
-          opnd2.getBaseRegister(), opnd2.getDisplacement());
-}
-
-// -----------------------
-// 32-bit Add Instructions
-// -----------------------
-// Add Halfword Immediate (32)
-void Assembler::ahi(Register r1, const Operand& i2) { ri_form(AHI, r1, i2); }
-
-// Add Halfword Immediate (32)
-void Assembler::ahik(Register r1, Register r3, const Operand& i2) {
-  rie_form(AHIK, r1, r3, i2);
-}
-
-// Add Register-Register-Register (32)
-void Assembler::ark(Register r1, Register r2, Register r3) {
-  rrf1_form(ARK, r1, r2, r3);
-}
-
-// Add Storage-Imm (32)
-void Assembler::asi(const MemOperand& opnd, const Operand& imm) {
-  DCHECK(is_int8(imm.immediate()));
-  DCHECK(is_int20(opnd.offset()));
-  siy_form(ASI, Operand(0xFF & imm.immediate()), opnd.rb(),
-           0xFFFFF & opnd.offset());
-}
-
-// -----------------------
-// 64-bit Add Instructions
-// -----------------------
-// Add Halfword Immediate (64)
-void Assembler::aghi(Register r1, const Operand& i2) { ri_form(AGHI, r1, i2); }
-
-// Add Halfword Immediate (64)
-void Assembler::aghik(Register r1, Register r3, const Operand& i2) {
-  rie_form(AGHIK, r1, r3, i2);
-}
-
-// Add Register-Register-Register (64)
-void Assembler::agrk(Register r1, Register r2, Register r3) {
-  rrf1_form(AGRK, r1, r2, r3);
-}
-
-// Add Storage-Imm (64)
-void Assembler::agsi(const MemOperand& opnd, const Operand& imm) {
-  DCHECK(is_int8(imm.immediate()));
-  DCHECK(is_int20(opnd.offset()));
-  siy_form(AGSI, Operand(0xFF & imm.immediate()), opnd.rb(),
-           0xFFFFF & opnd.offset());
-}
-
-// -------------------------------
-// 32-bit Add Logical Instructions
-// -------------------------------
-// Add Logical Register-Register-Register (32)
-void Assembler::alrk(Register r1, Register r2, Register r3) {
-  rrf1_form(ALRK, r1, r2, r3);
-}
-
-// -------------------------------
-// 64-bit Add Logical Instructions
-// -------------------------------
-// Add Logical Register-Register-Register (64)
-void Assembler::algrk(Register r1, Register r2, Register r3) {
-  rrf1_form(ALGRK, r1, r2, r3);
-}
-
-// ----------------------------
-// 32-bit Subtract Instructions
-// ----------------------------
-// Subtract Register-Register-Register (32)
-void Assembler::srk(Register r1, Register r2, Register r3) {
-  rrf1_form(SRK, r1, r2, r3);
-}
-
-// ----------------------------
-// 64-bit Subtract Instructions
-// ----------------------------
-// Subtract Register-Register-Register (64)
-void Assembler::sgrk(Register r1, Register r2, Register r3) {
-  rrf1_form(SGRK, r1, r2, r3);
-}
-
-// ------------------------------------
-// 32-bit Subtract Logical Instructions
-// ------------------------------------
-// Subtract Logical Register-Register-Register (32)
-void Assembler::slrk(Register r1, Register r2, Register r3) {
-  rrf1_form(SLRK, r1, r2, r3);
-}
-
-// ------------------------------------
-// 64-bit Subtract Logical Instructions
-// ------------------------------------
-// Subtract Logical Register-Register-Register (64)
-void Assembler::slgrk(Register r1, Register r2, Register r3) {
-  rrf1_form(SLGRK, r1, r2, r3);
-}
-
-// ----------------------------
-// 32-bit Multiply Instructions
-// ----------------------------
-// Multiply Halfword Immediate (32)
-void Assembler::mhi(Register r1, const Operand& opnd) {
-  ri_form(MHI, r1, opnd);
-}
-
-// Multiply Single Register (32)
-void Assembler::msrkc(Register r1, Register r2, Register r3) {
-  rrf1_form(MSRKC, r1, r2, r3);
-}
-
-// Multiply Single Register (64)
-void Assembler::msgrkc(Register r1, Register r2, Register r3) {
-  rrf1_form(MSGRKC, r1, r2, r3);
-}
-
-// ----------------------------
-// 64-bit Multiply Instructions
-// ----------------------------
-// Multiply Halfword Immediate (64)
-void Assembler::mghi(Register r1, const Operand& opnd) {
-  ri_form(MGHI, r1, opnd);
-}
-
-// --------------------
-// Bitwise Instructions
-// --------------------
-// AND Register-Register-Register (32)
-void Assembler::nrk(Register r1, Register r2, Register r3) {
-  rrf1_form(NRK, r1, r2, r3);
-}
-
-// AND Register-Register-Register (64)
-void Assembler::ngrk(Register r1, Register r2, Register r3) {
-  rrf1_form(NGRK, r1, r2, r3);
-}
-
-// OR Register-Register-Register (32)
-void Assembler::ork(Register r1, Register r2, Register r3) {
-  rrf1_form(ORK, r1, r2, r3);
-}
-
-// OR Register-Register-Register (64)
-void Assembler::ogrk(Register r1, Register r2, Register r3) {
-  rrf1_form(OGRK, r1, r2, r3);
-}
-
-// XOR Register-Register-Register (32)
-void Assembler::xrk(Register r1, Register r2, Register r3) {
-  rrf1_form(XRK, r1, r2, r3);
-}
-
-// XOR Register-Register-Register (64)
-void Assembler::xgrk(Register r1, Register r2, Register r3) {
-  rrf1_form(XGRK, r1, r2, r3);
-}
-
-// XOR Storage-Storage
-void Assembler::xc(const MemOperand& opnd1, const MemOperand& opnd2,
-                   Length length) {
-  ss_form(XC, length - 1, opnd1.getBaseRegister(), opnd1.getDisplacement(),
-          opnd2.getBaseRegister(), opnd2.getDisplacement());
-}
-
 void Assembler::EnsureSpaceFor(int space_needed) {
   if (buffer_space() <= (kGap + space_needed)) {
     GrowBuffer(space_needed);
   }
 }
 
-// Rotate Left Single Logical (32)
-void Assembler::rll(Register r1, Register r3, Register opnd) {
-  DCHECK(opnd != r0);
-  rsy_form(RLL, r1, r3, opnd, 0);
-}
-
-// Rotate Left Single Logical (32)
-void Assembler::rll(Register r1, Register r3, const Operand& opnd) {
-  rsy_form(RLL, r1, r3, r0, opnd.immediate());
-}
-
-// Rotate Left Single Logical (32)
-void Assembler::rll(Register r1, Register r3, Register r2,
-                    const Operand& opnd) {
-  rsy_form(RLL, r1, r3, r2, opnd.immediate());
-}
-
-// Rotate Left Single Logical (64)
-void Assembler::rllg(Register r1, Register r3, Register opnd) {
-  DCHECK(opnd != r0);
-  rsy_form(RLLG, r1, r3, opnd, 0);
-}
-
-// Rotate Left Single Logical (64)
-void Assembler::rllg(Register r1, Register r3, const Operand& opnd) {
-  rsy_form(RLLG, r1, r3, r0, opnd.immediate());
-}
-
-// Rotate Left Single Logical (64)
-void Assembler::rllg(Register r1, Register r3, Register r2,
-                     const Operand& opnd) {
-  rsy_form(RLLG, r1, r3, r2, opnd.immediate());
-}
-
-// Shift Left Single Logical (32)
-void Assembler::sll(Register r1, Register opnd) {
-  DCHECK(opnd != r0);
-  rs_form(SLL, r1, r0, opnd, 0);
-}
-
-// Shift Left Single Logical (32)
-void Assembler::sll(Register r1, const Operand& opnd) {
-  rs_form(SLL, r1, r0, r0, opnd.immediate());
-}
-
-// Shift Left Single Logical (32)
-void Assembler::sllk(Register r1, Register r3, Register opnd) {
-  DCHECK(opnd != r0);
-  rsy_form(SLLK, r1, r3, opnd, 0);
-}
-
-// Shift Left Single Logical (32)
-void Assembler::sllk(Register r1, Register r3, const Operand& opnd) {
-  rsy_form(SLLK, r1, r3, r0, opnd.immediate());
-}
-
-// Shift Left Single Logical (64)
-void Assembler::sllg(Register r1, Register r3, Register opnd) {
-  DCHECK(opnd != r0);
-  rsy_form(SLLG, r1, r3, opnd, 0);
-}
-
-// Shift Left Single Logical (64)
-void Assembler::sllg(Register r1, Register r3, const Operand& opnd) {
-  rsy_form(SLLG, r1, r3, r0, opnd.immediate());
-}
-
-// Shift Left Double Logical (64)
-void Assembler::sldl(Register r1, Register b2, const Operand& opnd) {
-  DCHECK_EQ(r1.code() % 2, 0);
-  rs_form(SLDL, r1, r0, b2, opnd.immediate());
-}
-
-// Shift Right Single Logical (32)
-void Assembler::srl(Register r1, Register opnd) {
-  DCHECK(opnd != r0);
-  rs_form(SRL, r1, r0, opnd, 0);
-}
-
-// Shift Right Double Arith (64)
-void Assembler::srda(Register r1, Register b2, const Operand& opnd) {
-  DCHECK_EQ(r1.code() % 2, 0);
-  rs_form(SRDA, r1, r0, b2, opnd.immediate());
-}
-
-// Shift Right Double Logical (64)
-void Assembler::srdl(Register r1, Register b2, const Operand& opnd) {
-  DCHECK_EQ(r1.code() % 2, 0);
-  rs_form(SRDL, r1, r0, b2, opnd.immediate());
-}
-
-// Shift Right Single Logical (32)
-void Assembler::srl(Register r1, const Operand& opnd) {
-  rs_form(SRL, r1, r0, r0, opnd.immediate());
-}
-
-// Shift Right Single Logical (32)
-void Assembler::srlk(Register r1, Register r3, Register opnd) {
-  DCHECK(opnd != r0);
-  rsy_form(SRLK, r1, r3, opnd, 0);
-}
-
-// Shift Right Single Logical (32)
-void Assembler::srlk(Register r1, Register r3, const Operand& opnd) {
-  rsy_form(SRLK, r1, r3, r0, opnd.immediate());
-}
-
-// Shift Right Single Logical (64)
-void Assembler::srlg(Register r1, Register r3, Register opnd) {
-  DCHECK(opnd != r0);
-  rsy_form(SRLG, r1, r3, opnd, 0);
-}
-
-// Shift Right Single Logical (64)
-void Assembler::srlg(Register r1, Register r3, const Operand& opnd) {
-  rsy_form(SRLG, r1, r3, r0, opnd.immediate());
-}
-
-// Shift Left Single (32)
-void Assembler::sla(Register r1, Register opnd) {
-  DCHECK(opnd != r0);
-  rs_form(SLA, r1, r0, opnd, 0);
-}
-
-// Shift Left Single (32)
-void Assembler::sla(Register r1, const Operand& opnd) {
-  rs_form(SLA, r1, r0, r0, opnd.immediate());
-}
-
-// Shift Left Single (32)
-void Assembler::slak(Register r1, Register r3, Register opnd) {
-  DCHECK(opnd != r0);
-  rsy_form(SLAK, r1, r3, opnd, 0);
-}
-
-// Shift Left Single (32)
-void Assembler::slak(Register r1, Register r3, const Operand& opnd) {
-  rsy_form(SLAK, r1, r3, r0, opnd.immediate());
-}
-
-// Shift Left Single (64)
-void Assembler::slag(Register r1, Register r3, Register opnd) {
-  DCHECK(opnd != r0);
-  rsy_form(SLAG, r1, r3, opnd, 0);
-}
-
-// Shift Left Single (64)
-void Assembler::slag(Register r1, Register r3, const Operand& opnd) {
-  rsy_form(SLAG, r1, r3, r0, opnd.immediate());
-}
-
-// Shift Right Single (32)
-void Assembler::sra(Register r1, Register opnd) {
-  DCHECK(opnd != r0);
-  rs_form(SRA, r1, r0, opnd, 0);
-}
-
-// Shift Right Single (32)
-void Assembler::sra(Register r1, const Operand& opnd) {
-  rs_form(SRA, r1, r0, r0, opnd.immediate());
-}
-
-// Shift Right Single (32)
-void Assembler::srak(Register r1, Register r3, Register opnd) {
-  DCHECK(opnd != r0);
-  rsy_form(SRAK, r1, r3, opnd, 0);
-}
-
-// Shift Right Single (32)
-void Assembler::srak(Register r1, Register r3, const Operand& opnd) {
-  rsy_form(SRAK, r1, r3, r0, opnd.immediate());
-}
-
-// Shift Right Single (64)
-void Assembler::srag(Register r1, Register r3, Register opnd) {
-  DCHECK(opnd != r0);
-  rsy_form(SRAG, r1, r3, opnd, 0);
-}
-
-void Assembler::srag(Register r1, Register r3, const Operand& opnd) {
-  rsy_form(SRAG, r1, r3, r0, opnd.immediate());
-}
-
-// Shift Right Double
-void Assembler::srda(Register r1, const Operand& opnd) {
-  DCHECK_EQ(r1.code() % 2, 0);
-  rs_form(SRDA, r1, r0, r0, opnd.immediate());
-}
-
-// Shift Right Double Logical
-void Assembler::srdl(Register r1, const Operand& opnd) {
-  DCHECK_EQ(r1.code() % 2, 0);
-  rs_form(SRDL, r1, r0, r0, opnd.immediate());
-}
-
 void Assembler::call(Handle<Code> target, RelocInfo::Mode rmode) {
+  DCHECK(RelocInfo::IsCodeTarget(rmode));
   EnsureSpace ensure_space(this);
 
-  int32_t target_index = emit_code_target(target, rmode);
+  RecordRelocInfo(rmode);
+  int32_t target_index = AddCodeTarget(target);
   brasl(r14, Operand(target_index));
 }
 
 void Assembler::call(CodeStub* stub) {
   EnsureSpace ensure_space(this);
   RequestHeapObject(HeapObjectRequest(stub));
-  int32_t target_index =
-      emit_code_target(Handle<Code>(), RelocInfo::CODE_TARGET);
+  RecordRelocInfo(RelocInfo::CODE_TARGET);
+  int32_t target_index = AddCodeTarget(Handle<Code>());
   brasl(r14, Operand(target_index));
 }
 
 void Assembler::jump(Handle<Code> target, RelocInfo::Mode rmode,
                      Condition cond) {
+  DCHECK(RelocInfo::IsCodeTarget(rmode));
   EnsureSpace ensure_space(this);
 
-  int32_t target_index = emit_code_target(target, rmode);
+  RecordRelocInfo(rmode);
+  int32_t target_index = AddCodeTarget(target);
   brcl(cond, Operand(target_index));
 }
 
-// 32-bit Load Multiple - short displacement (12-bits unsigned)
-void Assembler::lm(Register r1, Register r2, const MemOperand& src) {
-  rs_form(LM, r1, r2, src.rb(), src.offset());
-}
-
-// 32-bit Load Multiple - long displacement (20-bits signed)
-void Assembler::lmy(Register r1, Register r2, const MemOperand& src) {
-  rsy_form(LMY, r1, r2, src.rb(), src.offset());
-}
-
-// 64-bit Load Multiple - long displacement (20-bits signed)
-void Assembler::lmg(Register r1, Register r2, const MemOperand& src) {
-  rsy_form(LMG, r1, r2, src.rb(), src.offset());
-}
-
-// 32-bit Compare and Swap
-void Assembler::cs(Register r1, Register r2, const MemOperand& src) {
-  rs_form(CS, r1, r2, src.rb(), src.offset());
-}
-
-// 32-bit Compare and Swap
-void Assembler::csy(Register r1, Register r2, const MemOperand& src) {
-  rsy_form(CSY, r1, r2, src.rb(), src.offset());
-}
-
-// 64-bit Compare and Swap
-void Assembler::csg(Register r1, Register r2, const MemOperand& src) {
-  rsy_form(CSG, r1, r2, src.rb(), src.offset());
-}
-
-// Move integer (32)
-void Assembler::mvhi(const MemOperand& opnd1, const Operand& i2) {
-  sil_form(MVHI, opnd1.getBaseRegister(), opnd1.getDisplacement(), i2);
-}
-
-// Move integer (64)
-void Assembler::mvghi(const MemOperand& opnd1, const Operand& i2) {
-  sil_form(MVGHI, opnd1.getBaseRegister(), opnd1.getDisplacement(), i2);
-}
-
-// Insert Immediate (high high)
-void Assembler::iihh(Register r1, const Operand& opnd) {
-  ri_form(IIHH, r1, opnd);
-}
-
-// Insert Immediate (high low)
-void Assembler::iihl(Register r1, const Operand& opnd) {
-  ri_form(IIHL, r1, opnd);
-}
-
-// Insert Immediate (low high)
-void Assembler::iilh(Register r1, const Operand& opnd) {
-  ri_form(IILH, r1, opnd);
-}
-
-// Insert Immediate (low low)
-void Assembler::iill(Register r1, const Operand& opnd) {
-  ri_form(IILL, r1, opnd);
-}
-
-// GPR <-> FPR Instructions
-
-// Floating point instructions
-//
-// Add Register-Storage (LB)
-void Assembler::adb(DoubleRegister r1, const MemOperand& opnd) {
-  rxe_form(ADB, Register::from_code(r1.code()), opnd.rx(), opnd.rb(),
-           opnd.offset());
-}
-
-// Add Register-Storage (LB)
-void Assembler::aeb(DoubleRegister r1, const MemOperand& opnd) {
-  rxe_form(AEB, Register::from_code(r1.code()), opnd.rx(), opnd.rb(),
-           opnd.offset());
-}
-
-// Sub Register-Storage (LB)
-void Assembler::seb(DoubleRegister r1, const MemOperand& opnd) {
-  rxe_form(SEB, Register::from_code(r1.code()), opnd.rx(), opnd.rb(),
-           opnd.offset());
-}
-
-// Divide Register-Storage (LB)
-void Assembler::ddb(DoubleRegister r1, const MemOperand& opnd) {
-  rxe_form(DDB, Register::from_code(r1.code()), opnd.rx(), opnd.rb(),
-           opnd.offset());
-}
-
-// Divide Register-Storage (LB)
-void Assembler::deb(DoubleRegister r1, const MemOperand& opnd) {
-  rxe_form(DEB, Register::from_code(r1.code()), opnd.rx(), opnd.rb(),
-           opnd.offset());
-}
-
-// Multiply Register-Storage (LB)
-void Assembler::mdb(DoubleRegister r1, const MemOperand& opnd) {
-  rxe_form(MDB, Register::from_code(r1.code()), opnd.rb(), opnd.rx(),
-           opnd.offset());
-}
-
-// Multiply Register-Storage (LB)
-void Assembler::meeb(DoubleRegister r1, const MemOperand& opnd) {
-  rxe_form(MEEB, Register::from_code(r1.code()), opnd.rb(), opnd.rx(),
-           opnd.offset());
-}
-
-// Subtract Register-Storage (LB)
-void Assembler::sdb(DoubleRegister r1, const MemOperand& opnd) {
-  rxe_form(SDB, Register::from_code(r1.code()), opnd.rx(), opnd.rb(),
-           opnd.offset());
-}
-
-void Assembler::ceb(DoubleRegister r1, const MemOperand& opnd) {
-  rxe_form(CEB, Register::from_code(r1.code()), opnd.rx(), opnd.rb(),
-           opnd.offset());
-}
-
-void Assembler::cdb(DoubleRegister r1, const MemOperand& opnd) {
-  rxe_form(CDB, Register::from_code(r1.code()), opnd.rx(), opnd.rb(),
-           opnd.offset());
-}
-
-// Square Root (LB)
-void Assembler::sqdb(DoubleRegister r1, const MemOperand& opnd) {
-  rxe_form(SQDB, Register::from_code(r1.code()), opnd.rx(), opnd.rb(),
-           opnd.offset());
-}
-
-// Convert to Fixed point (64<-S)
-void Assembler::cgebr(Condition m, Register r1, DoubleRegister r2) {
-  rrfe_form(CGEBR, m, Condition(0), r1, Register::from_code(r2.code()));
-}
-
-// Convert to Fixed point (64<-L)
-void Assembler::cgdbr(Condition m, Register r1, DoubleRegister r2) {
-  rrfe_form(CGDBR, m, Condition(0), r1, Register::from_code(r2.code()));
-}
-
-// Convert to Fixed point (32<-L)
-void Assembler::cfdbr(Condition m, Register r1, DoubleRegister r2) {
-  rrfe_form(CFDBR, m, Condition(0), r1, Register::from_code(r2.code()));
-}
-
-// Convert to Fixed Logical (64<-L)
-void Assembler::clgdbr(Condition m3, Condition m4, Register r1,
-                       DoubleRegister r2) {
-  DCHECK_EQ(m4, Condition(0));
-  rrfe_form(CLGDBR, m3, m4, r1, Register::from_code(r2.code()));
-}
-
-// Convert to Fixed Logical (64<-F32)
-void Assembler::clgebr(Condition m3, Condition m4, Register r1,
-                       DoubleRegister r2) {
-  DCHECK_EQ(m4, Condition(0));
-  rrfe_form(CLGEBR, m3, m4, r1, Register::from_code(r2.code()));
-}
-
-// Convert to Fixed Logical (32<-F64)
-void Assembler::clfdbr(Condition m3, Condition m4, Register r1,
-                       DoubleRegister r2) {
-  DCHECK_EQ(m4, Condition(0));
-  rrfe_form(CLFDBR, m3, Condition(0), r1, Register::from_code(r2.code()));
-}
-
-// Convert to Fixed Logical (32<-F32)
-void Assembler::clfebr(Condition m3, Condition m4, Register r1,
-                       DoubleRegister r2) {
-  DCHECK_EQ(m4, Condition(0));
-  rrfe_form(CLFEBR, m3, Condition(0), r1, Register::from_code(r2.code()));
-}
-
-// Convert from Fixed Logical (L<-64)
-void Assembler::celgbr(Condition m3, Condition m4, DoubleRegister r1,
-                       Register r2) {
-  DCHECK_EQ(m3, Condition(0));
-  DCHECK_EQ(m4, Condition(0));
-  rrfe_form(CELGBR, Condition(0), Condition(0), Register::from_code(r1.code()),
-            r2);
-}
-
-// Convert from Fixed Logical (F32<-32)
-void Assembler::celfbr(Condition m3, Condition m4, DoubleRegister r1,
-                       Register r2) {
-  DCHECK_EQ(m4, Condition(0));
-  rrfe_form(CELFBR, m3, Condition(0), Register::from_code(r1.code()), r2);
-}
-
-// Convert from Fixed Logical (L<-64)
-void Assembler::cdlgbr(Condition m3, Condition m4, DoubleRegister r1,
-                       Register r2) {
-  DCHECK_EQ(m3, Condition(0));
-  DCHECK_EQ(m4, Condition(0));
-  rrfe_form(CDLGBR, Condition(0), Condition(0), Register::from_code(r1.code()),
-            r2);
-}
-
-// Convert from Fixed Logical (L<-32)
-void Assembler::cdlfbr(Condition m3, Condition m4, DoubleRegister r1,
-                       Register r2) {
-  DCHECK_EQ(m4, Condition(0));
-  rrfe_form(CDLFBR, m3, Condition(0), Register::from_code(r1.code()), r2);
-}
-
-// Convert from Fixed point (S<-32)
-void Assembler::cefbr(Condition m3, DoubleRegister r1, Register r2) {
-  rrfe_form(CEFBR, m3, Condition(0), Register::from_code(r1.code()), r2);
-}
-
-// Convert to Fixed point (32<-S)
-void Assembler::cfebr(Condition m3, Register r1, DoubleRegister r2) {
-  rrfe_form(CFEBR, m3, Condition(0), r1, Register::from_code(r2.code()));
-}
-
-// Load (L <- S)
-void Assembler::ldeb(DoubleRegister d1, const MemOperand& opnd) {
-  rxe_form(LDEB, Register::from_code(d1.code()), opnd.rx(), opnd.rb(),
-           opnd.offset());
-}
-
-// Load FP Integer
-void Assembler::fiebra(DoubleRegister d1, DoubleRegister d2, FIDBRA_MASK3 m3) {
-  rrf2_form(FIEBRA << 16 | m3 * B12 | d1.code() * B4 | d2.code());
-}
-
-// Load FP Integer
-void Assembler::fidbra(DoubleRegister d1, DoubleRegister d2, FIDBRA_MASK3 m3) {
-  rrf2_form(FIDBRA << 16 | m3 * B12 | d1.code() * B4 | d2.code());
-}
-
 // end of S390instructions
 
 bool Assembler::IsNop(SixByteInstr instr, int type) {
@@ -2189,8 +796,8 @@ void Assembler::dp(uintptr_t data) {
 void Assembler::RecordRelocInfo(RelocInfo::Mode rmode, intptr_t data) {
   if (RelocInfo::IsNone(rmode) ||
       // Don't record external references unless the heap will be serialized.
-      (rmode == RelocInfo::EXTERNAL_REFERENCE && !serializer_enabled() &&
-       !emit_debug_code())) {
+      (RelocInfo::IsOnlyForSerializer(rmode) &&
+       !options().record_reloc_info_for_serialization && !emit_debug_code())) {
     return;
   }
   DeferredRelocInfo rinfo(pc_offset(), rmode, data);
@@ -2212,18 +819,19 @@ void Assembler::EmitRelocations() {
   for (std::vector<DeferredRelocInfo>::iterator it = relocations_.begin();
        it != relocations_.end(); it++) {
     RelocInfo::Mode rmode = it->rmode();
-    Address pc = buffer_ + it->position();
+    Address pc = reinterpret_cast<Address>(buffer_) + it->position();
     RelocInfo rinfo(pc, rmode, it->data(), nullptr);
 
     // Fix up internal references now that they are guaranteed to be bound.
     if (RelocInfo::IsInternalReference(rmode)) {
       // Jump table entry
-      intptr_t pos = reinterpret_cast<intptr_t>(Memory::Address_at(pc));
-      Memory::Address_at(pc) = buffer_ + pos;
+      Address pos = Memory::Address_at(pc);
+      Memory::Address_at(pc) = reinterpret_cast<Address>(buffer_) + pos;
     } else if (RelocInfo::IsInternalReferenceEncoded(rmode)) {
       // mov sequence
-      intptr_t pos = reinterpret_cast<intptr_t>(target_address_at(pc, nullptr));
-      set_target_address_at(pc, nullptr, buffer_ + pos, SKIP_ICACHE_FLUSH);
+      Address pos = target_address_at(pc, 0);
+      set_target_address_at(pc, 0, reinterpret_cast<Address>(buffer_) + pos,
+                            SKIP_ICACHE_FLUSH);
     }
 
     reloc_info_writer.Write(&rinfo);
diff --git a/deps/v8/src/s390/assembler-s390.h b/deps/v8/src/s390/assembler-s390.h
index ce3f04c996339b..480ba37093c078 100644
--- a/deps/v8/src/s390/assembler-s390.h
+++ b/deps/v8/src/s390/assembler-s390.h
@@ -347,43 +347,31 @@ C_REGISTERS(DECLARE_C_REGISTER)
 
 // Class Operand represents a shifter operand in data processing instructions
 // defining immediate numbers and masks
-typedef uint8_t Length;
-
-struct Mask {
-  uint8_t mask;
-  uint8_t value() { return mask; }
-  static Mask from_value(uint8_t input) {
-    DCHECK_LE(input, 0x0F);
-    Mask m = {input};
-    return m;
-  }
-};
-
 class Operand BASE_EMBEDDED {
  public:
   // immediate
-  INLINE(explicit Operand(intptr_t immediate,
-                          RelocInfo::Mode rmode = RelocInfo::NONE)
-         : rmode_(rmode)) {
+  V8_INLINE explicit Operand(intptr_t immediate,
+                             RelocInfo::Mode rmode = RelocInfo::NONE)
+      : rmode_(rmode) {
     value_.immediate = immediate;
   }
-  INLINE(static Operand Zero()) { return Operand(static_cast<intptr_t>(0)); }
-  INLINE(explicit Operand(const ExternalReference& f)
-         : rmode_(RelocInfo::EXTERNAL_REFERENCE)) {
-    value_.immediate = reinterpret_cast<intptr_t>(f.address());
+  V8_INLINE static Operand Zero() { return Operand(static_cast<intptr_t>(0)); }
+  V8_INLINE explicit Operand(const ExternalReference& f)
+      : rmode_(RelocInfo::EXTERNAL_REFERENCE) {
+    value_.immediate = static_cast<intptr_t>(f.address());
   }
   explicit Operand(Handle<HeapObject> handle);
-  INLINE(explicit Operand(Smi* value) : rmode_(RelocInfo::NONE)) {
+  V8_INLINE explicit Operand(Smi* value) : rmode_(RelocInfo::NONE) {
     value_.immediate = reinterpret_cast<intptr_t>(value);
   }
 
   // rm
-  INLINE(explicit Operand(Register rm));
+  V8_INLINE explicit Operand(Register rm);
 
   static Operand EmbeddedNumber(double value);  // Smi or HeapNumber
 
   // Return true if this is a register operand.
-  INLINE(bool is_reg() const) { return rm_.is_valid(); }
+  V8_INLINE bool is_reg() const { return rm_.is_valid(); }
 
   bool must_output_reloc_info(const Assembler* assembler) const;
 
@@ -500,9 +488,7 @@ class Assembler : public AssemblerBase {
   // buffer for code generation and assumes its size to be buffer_size. If the
   // buffer is too small, a fatal error occurs. No deallocation of the buffer is
   // done upon destruction of the assembler.
-  Assembler(Isolate* isolate, void* buffer, int buffer_size)
-      : Assembler(IsolateData(isolate), buffer, buffer_size) {}
-  Assembler(IsolateData isolate_data, void* buffer, int buffer_size);
+  Assembler(const AssemblerOptions& options, void* buffer, int buffer_size);
   virtual ~Assembler() {}
 
   // GetCode emits any pending (non-emitted) code and fills the descriptor
@@ -547,10 +533,10 @@ class Assembler : public AssemblerBase {
 
   // Read/Modify the code target address in the branch/call instruction at pc.
   // The isolate argument is unused (and may be nullptr) when skipping flushing.
-  INLINE(static Address target_address_at(Address pc, Address constant_pool));
-  INLINE(static void set_target_address_at(
+  V8_INLINE static Address target_address_at(Address pc, Address constant_pool);
+  V8_INLINE static void set_target_address_at(
       Address pc, Address constant_pool, Address target,
-      ICacheFlushMode icache_flush_mode = FLUSH_ICACHE_IF_NEEDED));
+      ICacheFlushMode icache_flush_mode = FLUSH_ICACHE_IF_NEEDED);
 
   // Return the code target address at a call site from the return address
   // of that call in the instruction stream.
@@ -558,7 +544,7 @@ class Assembler : public AssemblerBase {
 
   // Given the address of the beginning of a call, return the address
   // in the instruction stream that the call will return to.
-  INLINE(static Address return_address_from_call_start(Address pc));
+  V8_INLINE static Address return_address_from_call_start(Address pc);
 
   inline Handle<Object> code_target_object_handle_at(Address pc);
   // This sets the branch destination.
@@ -566,6 +552,10 @@ class Assembler : public AssemblerBase {
   inline static void deserialization_set_special_target_at(
       Address instruction_payload, Code* code, Address target);
 
+  // Get the size of the special target encoded at 'instruction_payload'.
+  inline static int deserialization_special_target_size(
+      Address instruction_payload);
+
   // This sets the internal reference at the pc.
   inline static void deserialization_set_target_internal_reference_at(
       Address pc, Address target,
@@ -604,10 +594,6 @@ class Assembler : public AssemblerBase {
   static constexpr int kCallSequenceLength = 8;
 #endif
 
-  static inline int encode_crbit(const CRegister& cr, enum CRBit crbit) {
-    return ((cr.code() * CRWIDTH) + crbit);
-  }
-
   // ---------------------------------------------------------------------------
   // Code generation
 
@@ -621,64 +607,6 @@ class Assembler : public AssemblerBase {
     return (value & mask_value) << shift;
   }
 
-  // Declare generic instruction formats by fields
-  inline void e_format(Opcode opcode) {
-    emit2bytes(getfield<uint16_t, 2, 0, 16>(opcode));
-  }
-
-  inline void i_format(Opcode opcode, int f1) {
-    emit2bytes(getfield<uint16_t, 2, 0, 8>(opcode) |
-               getfield<uint16_t, 2, 8, 16>(f1));
-  }
-
-  inline void ie_format(Opcode opcode, int f1, int f2) {
-    emit4bytes(getfield<uint32_t, 4, 0, 16>(opcode) |
-               getfield<uint32_t, 4, 24, 28>(f1) |
-               getfield<uint32_t, 4, 28, 32>(f2));
-  }
-  inline void mii_format(Opcode opcode, int f1, int f2, int f3) {
-    emit6bytes(
-        getfield<uint64_t, 6, 0, 8>(opcode) | getfield<uint64_t, 6, 8, 12>(f1) |
-        getfield<uint64_t, 6, 12, 24>(f2) | getfield<uint64_t, 6, 24, 48>(f3));
-  }
-
-  inline void ri_format(Opcode opcode, int f1, int f2) {
-    uint32_t op1 = opcode >> 4;
-    uint32_t op2 = opcode & 0xf;
-    emit4bytes(
-        getfield<uint32_t, 4, 0, 8>(op1) | getfield<uint32_t, 4, 8, 12>(f1) |
-        getfield<uint32_t, 4, 12, 16>(op2) | getfield<uint32_t, 4, 16, 32>(f2));
-  }
-
-  inline void rie_1_format(Opcode opcode, int f1, int f2, int f3, int f4) {
-    uint32_t op1 = opcode >> 8;
-    uint32_t op2 = opcode & 0xff;
-    emit6bytes(
-        getfield<uint64_t, 6, 0, 8>(op1) | getfield<uint64_t, 6, 8, 12>(f1) |
-        getfield<uint64_t, 6, 12, 16>(f2) | getfield<uint64_t, 6, 16, 32>(f3) |
-        getfield<uint64_t, 6, 32, 36>(f4) | getfield<uint64_t, 6, 40, 48>(op2));
-  }
-
-  inline void rie_2_format(Opcode opcode, int f1, int f2, int f3, int f4) {
-    uint32_t op1 = opcode >> 8;
-    uint32_t op2 = opcode & 0xff;
-    emit6bytes(
-        getfield<uint64_t, 6, 0, 8>(op1) | getfield<uint64_t, 6, 8, 12>(f1) |
-        getfield<uint64_t, 6, 12, 16>(f2) | getfield<uint64_t, 6, 16, 32>(f3) |
-        getfield<uint64_t, 6, 32, 40>(f4) | getfield<uint64_t, 6, 40, 48>(op2));
-  }
-
-  inline void rie_3_format(Opcode opcode, int f1, int f2, int f3, int f4,
-                           int f5) {
-    uint32_t op1 = opcode >> 8;
-    uint32_t op2 = opcode & 0xff;
-    emit6bytes(
-        getfield<uint64_t, 6, 0, 8>(op1) | getfield<uint64_t, 6, 8, 12>(f1) |
-        getfield<uint64_t, 6, 12, 16>(f2) | getfield<uint64_t, 6, 16, 24>(f3) |
-        getfield<uint64_t, 6, 24, 32>(f4) | getfield<uint64_t, 6, 32, 40>(f5) |
-        getfield<uint64_t, 6, 40, 48>(op2));
-  }
-
 #define DECLARE_S390_RIL_AB_INSTRUCTIONS(name, op_name, op_value) \
   template <class R1>                                             \
   inline void name(R1 r1, const Operand& i2) {                    \
@@ -702,17 +630,6 @@ class Assembler : public AssemblerBase {
 #undef DECLARE_S390_RIL_AB_INSTRUCTIONS
 #undef DECLARE_S390_RIL_C_INSTRUCTIONS
 
-  inline void ris_format(Opcode opcode, int f1, int f2, int f3, int f4,
-                         int f5) {
-    uint32_t op1 = opcode >> 8;
-    uint32_t op2 = opcode & 0xff;
-    emit6bytes(
-        getfield<uint64_t, 6, 0, 8>(op1) | getfield<uint64_t, 6, 8, 12>(f1) |
-        getfield<uint64_t, 6, 12, 16>(f2) | getfield<uint64_t, 6, 16, 20>(f3) |
-        getfield<uint64_t, 6, 20, 32>(f4) | getfield<uint64_t, 6, 32, 40>(f5) |
-        getfield<uint64_t, 6, 40, 48>(op2));
-  }
-
 #define DECLARE_S390_RR_INSTRUCTIONS(name, op_name, op_value) \
   inline void name(Register r1, Register r2) {                \
     rr_format(op_name, r1.code(), r2.code());                 \
@@ -761,22 +678,16 @@ class Assembler : public AssemblerBase {
   void lzdr(DoubleRegister r1) { rre_format(LZDR, r1.code(), 0); }
 #undef DECLARE_S390_RRE_INSTRUCTIONS
 
-  inline void rrf_format(Opcode opcode, int f1, int f2, int f3, int f4) {
-    emit4bytes(
-        getfield<uint32_t, 4, 0, 16>(opcode) |
-        getfield<uint32_t, 4, 16, 20>(f1) | getfield<uint32_t, 4, 20, 24>(f2) |
-        getfield<uint32_t, 4, 24, 28>(f3) | getfield<uint32_t, 4, 28, 32>(f4));
-  }
-
-#define DECLARE_S390_RX_INSTRUCTIONS(name, op_name, op_value)        \
-  template <class R1>                                                \
-  inline void name(R1 r1, Register x2, Register b2, Disp d2) {       \
-    rx_format(op_name, r1.code(), x2.code(), b2.code(), d2);         \
-  }                                                                  \
-  template <class R1>                                                \
-  inline void name(R1 r1, const MemOperand& opnd) {                  \
-    name(r1, opnd.getIndexRegister(),                                \
-         opnd.getBaseRegister(), opnd.getDisplacement());            \
+#define DECLARE_S390_RX_INSTRUCTIONS(name, op_name, op_value)            \
+  template <class R1>                                                    \
+  inline void name(R1 r1, Register x2, Register b2, const Operand& d2) { \
+    rx_format(op_name, r1.code(), x2.code(), b2.code(),                  \
+              d2.immediate());                                           \
+  }                                                                      \
+  template <class R1>                                                    \
+  inline void name(R1 r1, const MemOperand& opnd) {                      \
+    name(r1, opnd.getIndexRegister(), opnd.getBaseRegister(),            \
+         Operand(opnd.getDisplacement()));                               \
   }
 
   inline void rx_format(Opcode opcode, int f1, int f2, int f3, int f4) {
@@ -792,22 +703,22 @@ class Assembler : public AssemblerBase {
 
   void bc(Condition cond, const MemOperand& opnd) {
     bc(cond, opnd.getIndexRegister(),
-       opnd.getBaseRegister(), opnd.getDisplacement());
+       opnd.getBaseRegister(), Operand(opnd.getDisplacement()));
   }
-  void bc(Condition cond, Register x2, Register b2, Disp d2) {
-    rx_format(BC, cond, x2.code(), b2.code(), d2);
+  void bc(Condition cond, Register x2, Register b2, const Operand& d2) {
+    rx_format(BC, cond, x2.code(), b2.code(), d2.immediate());
   }
 #undef DECLARE_S390_RX_INSTRUCTIONS
 
-#define DECLARE_S390_RXY_INSTRUCTIONS(name, op_name, op_value)       \
-  template <class R1, class R2>                                      \
-  inline void name(R1 r1, R2 r2, Register b2, Disp d2) {             \
-    rxy_format(op_name, r1.code(), r2.code(), b2.code(), d2);        \
-  }                                                                  \
-  template <class R1>                                                \
-  inline void name(R1 r1, const MemOperand& opnd) {                  \
-    name(r1, opnd.getIndexRegister(),                                \
-         opnd.getBaseRegister(), opnd.getDisplacement());            \
+#define DECLARE_S390_RXY_INSTRUCTIONS(name, op_name, op_value)            \
+  template <class R1, class R2>                                           \
+  inline void name(R1 r1, R2 r2, Register b2, const Operand& d2) {        \
+    rxy_format(op_name, r1.code(), r2.code(), b2.code(), d2.immediate()); \
+  }                                                                       \
+  template <class R1>                                                     \
+  inline void name(R1 r1, const MemOperand& opnd) {                       \
+    name(r1, opnd.getIndexRegister(), opnd.getBaseRegister(),             \
+         Operand(opnd.getDisplacement()));                                \
   }
 
   inline void rxy_format(Opcode opcode, int f1, int f2, int f3, int f4) {
@@ -825,13 +736,541 @@ class Assembler : public AssemblerBase {
 
   void pfd(Condition cond, const MemOperand& opnd) {
     pfd(cond, opnd.getIndexRegister(),
-        opnd.getBaseRegister(), opnd.getDisplacement());
+        opnd.getBaseRegister(), Operand(opnd.getDisplacement()));
   }
-  void pfd(Condition cond, Register x2, Register b2, Disp d2) {
-    rxy_format(PFD, cond, x2.code(), b2.code(), d2);
+  void pfd(Condition cond, Register x2, Register b2, const Operand& d2) {
+    rxy_format(PFD, cond, x2.code(), b2.code(), d2.immediate());
   }
 #undef DECLARE_S390_RXY_INSTRUCTIONS
 
+
+inline void rsy_format(Opcode op, int f1, int f2, int f3, int f4) {
+  DCHECK(is_int20(f4));
+  DCHECK(is_uint16(op));
+  uint64_t code = (getfield<uint64_t, 6, 0, 8>(op >> 8) |
+                   getfield<uint64_t, 6, 8, 12>(f1) |
+                   getfield<uint64_t, 6, 12, 16>(f2) |
+                   getfield<uint64_t, 6, 16, 20>(f3) |
+                   getfield<uint64_t, 6, 20, 32>(f4 & 0x0fff) |
+                   getfield<uint64_t, 6, 32, 40>(f4 >> 12) |
+                   getfield<uint64_t, 6, 40, 48>(op & 0xff));
+  emit6bytes(code);
+}
+
+#define DECLARE_S390_RSY_A_INSTRUCTIONS(name, op_name, op_value)           \
+  void name(Register r1, Register r3, Register b2,                         \
+            const Operand& d2 = Operand::Zero()) {                         \
+    rsy_format(op_name, r1.code(), r3.code(), b2.code(), d2.immediate());  \
+  }                                                                        \
+  void name(Register r1, Register r3, Operand d2) {                        \
+    name(r1, r3, r0, d2);                                                  \
+  }                                                                        \
+  void name(Register r1, Register r3, const MemOperand& opnd) {            \
+    name(r1, r3, opnd.getBaseRegister(), Operand(opnd.getDisplacement())); \
+  }
+  S390_RSY_A_OPCODE_LIST(DECLARE_S390_RSY_A_INSTRUCTIONS);
+#undef DECLARE_S390_RSY_A_INSTRUCTIONS
+
+#define DECLARE_S390_RSY_B_INSTRUCTIONS(name, op_name, op_value)            \
+  void name(Register r1, Condition m3, Register b2, const Operand& d2) {    \
+    rsy_format(op_name, r1.code(), m3, b2.code(), d2.immediate());          \
+  }                                                                         \
+  void name(Register r1, Condition m3, const MemOperand& opnd) {            \
+    name(r1, m3, opnd.getBaseRegister(), Operand(opnd.getDisplacement()));  \
+  }
+  S390_RSY_B_OPCODE_LIST(DECLARE_S390_RSY_B_INSTRUCTIONS);
+#undef DECLARE_S390_RSY_B_INSTRUCTIONS
+
+
+inline void rs_format(Opcode op, int f1, int f2, int f3, const int f4) {
+  uint32_t code = getfield<uint32_t, 4, 0, 8>(op) |
+                  getfield<uint32_t, 4, 8, 12>(f1) |
+                  getfield<uint32_t, 4, 12, 16>(f2) |
+                  getfield<uint32_t, 4, 16, 20>(f3) |
+                  getfield<uint32_t, 4, 20, 32>(f4);
+  emit4bytes(code);
+}
+
+#define DECLARE_S390_RS_A_INSTRUCTIONS(name, op_name, op_value)             \
+  void name(Register r1, Register r3, Register b2, const Operand& d2) {     \
+    rs_format(op_name, r1.code(), r3.code(), b2.code(), d2.immediate());    \
+  }                                                                         \
+  void name(Register r1, Register r3, const MemOperand& opnd) {             \
+    name(r1, r3, opnd.getBaseRegister(), Operand(opnd.getDisplacement()));  \
+  }
+  S390_RS_A_OPCODE_LIST(DECLARE_S390_RS_A_INSTRUCTIONS);
+#undef DECLARE_S390_RS_A_INSTRUCTIONS
+
+#define DECLARE_S390_RS_B_INSTRUCTIONS(name, op_name, op_value)             \
+  void name(Register r1, Condition m3, Register b2, const Operand& d2) {    \
+    rs_format(op_name, r1.code(), m3, b2.code(), d2.immediate());           \
+  }                                                                         \
+  void name(Register r1, Condition m3, const MemOperand& opnd) {            \
+    name(r1, m3, opnd.getBaseRegister(), Operand(opnd.getDisplacement()));  \
+  }
+  S390_RS_B_OPCODE_LIST(DECLARE_S390_RS_B_INSTRUCTIONS);
+#undef DECLARE_S390_RS_B_INSTRUCTIONS
+
+#define DECLARE_S390_RS_SHIFT_FORMAT(name, opcode)                          \
+  void name(Register r1, Register r2, const Operand& opnd =                 \
+            Operand::Zero()) {                                              \
+    DCHECK(r2 != r0);                                                       \
+    rs_format(opcode, r1.code(), r0.code(), r2.code(), opnd.immediate());   \
+  }                                                                         \
+  void name(Register r1, const Operand& opnd) {                             \
+    rs_format(opcode, r1.code(), r0.code(), r0.code(), opnd.immediate());   \
+  }
+  DECLARE_S390_RS_SHIFT_FORMAT(sll, SLL)
+  DECLARE_S390_RS_SHIFT_FORMAT(srl, SRL)
+  DECLARE_S390_RS_SHIFT_FORMAT(sla, SLA)
+  DECLARE_S390_RS_SHIFT_FORMAT(sra, SRA)
+  DECLARE_S390_RS_SHIFT_FORMAT(sldl, SLDL)
+  DECLARE_S390_RS_SHIFT_FORMAT(srda, SRDA)
+  DECLARE_S390_RS_SHIFT_FORMAT(srdl, SRDL)
+#undef DECLARE_S390_RS_SHIFT_FORMAT
+
+
+inline void rxe_format(Opcode op, int f1, int f2, int f3, int f4, int f5 = 0) {
+  DCHECK(is_uint12(f4));
+  DCHECK(is_uint16(op));
+  uint64_t code = (getfield<uint64_t, 6, 0, 8>(op >> 8) |
+                   getfield<uint64_t, 6, 8, 12>(f1) |
+                   getfield<uint64_t, 6, 12, 16>(f2) |
+                   getfield<uint64_t, 6, 16, 20>(f3) |
+                   getfield<uint64_t, 6, 20, 32>(f4 & 0x0fff) |
+                   getfield<uint64_t, 6, 32, 36>(f5) |
+                   getfield<uint64_t, 6, 40, 48>(op & 0xff));
+  emit6bytes(code);
+}
+
+#define DECLARE_S390_RXE_INSTRUCTIONS(name, op_name, op_value)             \
+  void name(Register r1, Register x2, Register b2, const Operand& d2,      \
+            Condition m3 = static_cast<Condition>(0)) {                    \
+    rxe_format(op_name, r1.code(), x2.code(), b2.code(), d2.immediate(),   \
+               m3);                                                        \
+  }                                                                        \
+  template<class _R1Type>                                                  \
+  void name(_R1Type r1, const MemOperand& opnd) {                          \
+    name(Register::from_code(r1.code()), opnd.rx(), opnd.rb(),             \
+         Operand(opnd.offset()));                                          \
+  }
+  S390_RXE_OPCODE_LIST(DECLARE_S390_RXE_INSTRUCTIONS);
+#undef DECLARE_S390_RXE_INSTRUCTIONS
+
+
+inline void ri_format(Opcode opcode, int f1, int f2) {
+  uint32_t op1 = opcode >> 4;
+  uint32_t op2 = opcode & 0xf;
+  emit4bytes(getfield<uint32_t, 4, 0, 8>(op1) |
+             getfield<uint32_t, 4, 8, 12>(f1) |
+             getfield<uint32_t, 4, 12, 16>(op2) |
+             getfield<uint32_t, 4, 16, 32>(f2));
+}
+
+#define DECLARE_S390_RI_A_INSTRUCTIONS(name, op_name, op_value)            \
+  void name(Register r, const Operand& i2) {                               \
+    DCHECK(is_uint12(op_name));                                            \
+    DCHECK(is_uint16(i2.immediate()) || is_int16(i2.immediate()));         \
+    ri_format(op_name, r.code(), i2.immediate());                          \
+  }
+  S390_RI_A_OPCODE_LIST(DECLARE_S390_RI_A_INSTRUCTIONS);
+#undef DECLARE_S390_RI_A_INSTRUCTIONS
+
+#define DECLARE_S390_RI_B_INSTRUCTIONS(name, op_name, op_value)            \
+  void name(Register r1, const Operand& imm) {                             \
+    /* 2nd argument encodes # of halfwords, so divide by 2. */             \
+    int16_t numHalfwords = static_cast<int16_t>(imm.immediate()) / 2;      \
+    Operand halfwordOp = Operand(numHalfwords);                            \
+    halfwordOp.setBits(16);                                                \
+    ri_format(op_name, r1.code(), halfwordOp.immediate());                 \
+  }
+  S390_RI_B_OPCODE_LIST(DECLARE_S390_RI_B_INSTRUCTIONS);
+#undef DECLARE_S390_RI_B_INSTRUCTIONS
+
+#define DECLARE_S390_RI_C_INSTRUCTIONS(name, op_name, op_value)            \
+  void name(Condition m, const Operand& i2) {                              \
+    DCHECK(is_uint12(op_name));                                            \
+    DCHECK(is_uint4(m));                                                   \
+    DCHECK(op_name == BRC ?                                                \
+           is_int16(i2.immediate()) : is_uint16(i2.immediate()));          \
+    ri_format(op_name, m, i2.immediate());                                 \
+  }
+  S390_RI_C_OPCODE_LIST(DECLARE_S390_RI_C_INSTRUCTIONS);
+#undef DECLARE_S390_RI_C_INSTRUCTIONS
+
+
+inline void rrf_format(Opcode op, int f1, int f2, int f3, int f4) {
+  uint32_t code = getfield<uint32_t, 4, 0, 16>(op) |
+                  getfield<uint32_t, 4, 16, 20>(f1) |
+                  getfield<uint32_t, 4, 20, 24>(f2) |
+                  getfield<uint32_t, 4, 24, 28>(f3) |
+                  getfield<uint32_t, 4, 28, 32>(f4);
+  emit4bytes(code);
+}
+
+#define DECLARE_S390_RRF_A_INSTRUCTIONS(name, op_name, op_value)           \
+  void name(Register r1, Condition m4, Register r2, Register r3) {         \
+    rrf_format(op_name, r3.code(), m4, r1.code(), r2.code());              \
+  }                                                                        \
+  void name(Register r1, Register r2, Register r3) {                       \
+    name(r1, Condition(0), r2, r3);                                        \
+  }
+  S390_RRF_A_OPCODE_LIST(DECLARE_S390_RRF_A_INSTRUCTIONS);
+#undef DECLARE_S390_RRF_A_INSTRUCTIONS
+
+
+#define DECLARE_S390_RRF_B_INSTRUCTIONS(name, op_name, op_value)           \
+  void name(Register r1, Condition m4, Register r2, Register r3) {         \
+    rrf_format(op_name, r3.code(), m4, r1.code(), r2.code());              \
+  }                                                                        \
+  void name(Register r1, Register r2, Register r3) {                       \
+    name(r1, Condition(0), r2, r3);                                        \
+  }
+  S390_RRF_B_OPCODE_LIST(DECLARE_S390_RRF_B_INSTRUCTIONS);
+#undef DECLARE_S390_RRF_B_INSTRUCTIONS
+
+
+#define DECLARE_S390_RRF_C_INSTRUCTIONS(name, op_name, op_value)           \
+  template <class R1, class R2>                                            \
+  void name(Condition m3, Condition m4, R1 r1, R2 r2) {                    \
+    rrf_format(op_name, m3, m4, r1.code(), r2.code());                     \
+  }                                                                        \
+  template <class R1, class R2>                                            \
+  void name(Condition m3, R1 r1, R2 r2) {                                  \
+    name(m3, Condition(0), r1, r2);                                        \
+  }
+  S390_RRF_C_OPCODE_LIST(DECLARE_S390_RRF_C_INSTRUCTIONS);
+#undef DECLARE_S390_RRF_C_INSTRUCTIONS
+
+
+#define DECLARE_S390_RRF_D_INSTRUCTIONS(name, op_name, op_value)           \
+  template <class R1, class R2>                                            \
+  void name(Condition m3, Condition m4, R1 r1, R2 r2) {                    \
+    rrf_format(op_name, m3, m4, r1.code(), r2.code());                     \
+  }                                                                        \
+  template <class R1, class R2>                                            \
+  void name(Condition m3, R1 r1, R2 r2) {                                  \
+    name(m3, Condition(0), r1, r2);                                        \
+  }
+  S390_RRF_D_OPCODE_LIST(DECLARE_S390_RRF_D_INSTRUCTIONS);
+#undef DECLARE_S390_RRF_D_INSTRUCTIONS
+
+
+#define DECLARE_S390_RRF_E_INSTRUCTIONS(name, op_name, op_value)           \
+  template <class M3, class M4, class R1, class R2>                        \
+  void name(M3 m3, M4 m4, R1 r1, R2 r2) {                                  \
+    rrf_format(op_name, m3, m4, r1.code(), r2.code());                     \
+  }                                                                        \
+  template <class M3, class R1, class R2>                                  \
+  void name(M3 m3, R1 r1, R2 r2) {                                         \
+    name(m3, Condition(0), r1, r2);                                        \
+  }
+  S390_RRF_E_OPCODE_LIST(DECLARE_S390_RRF_E_INSTRUCTIONS);
+#undef DECLARE_S390_RRF_E_INSTRUCTIONS
+
+enum FIDBRA_FLAGS {
+  FIDBRA_CURRENT_ROUNDING_MODE = 0,
+  FIDBRA_ROUND_TO_NEAREST_AWAY_FROM_0 = 1,
+  // ...
+  FIDBRA_ROUND_TOWARD_0 = 5,
+  FIDBRA_ROUND_TOWARD_POS_INF = 6,
+  FIDBRA_ROUND_TOWARD_NEG_INF = 7
+};
+
+
+inline void rsi_format(Opcode op, int f1, int f2, int f3) {
+  DCHECK(is_uint8(op));
+  DCHECK(is_uint16(f3));
+  uint32_t code = getfield<uint32_t, 4, 0, 8>(op) |
+                  getfield<uint32_t, 4, 8, 12>(f1) |
+                  getfield<uint32_t, 4, 12, 16>(f2) |
+                  getfield<uint32_t, 4, 16, 32>(f3);
+  emit4bytes(code);
+}
+
+#define DECLARE_S390_RSI_INSTRUCTIONS(name, op_name, op_value)           \
+  void name(Register r1, Register r3, const Operand& i2) {               \
+    rsi_format(op_name, r1.code(), r3.code(), i2.immediate());           \
+  }
+  S390_RSI_OPCODE_LIST(DECLARE_S390_RSI_INSTRUCTIONS);
+#undef DECLARE_S390_RSI_INSTRUCTIONS
+
+
+inline void rsl_format(Opcode op, uint16_t f1, int f2, int f3, int f4,
+                       int f5) {
+  DCHECK(is_uint16(op));
+  uint64_t code = getfield<uint64_t, 6, 0, 8>(op >> 8) |
+                  getfield<uint64_t, 6, 8, 16>(f1) |
+                  getfield<uint64_t, 6, 16, 20>(f2) |
+                  getfield<uint64_t, 6, 20, 32>(f3) |
+                  getfield<uint64_t, 6, 32, 36>(f4) |
+                  getfield<uint64_t, 6, 36, 40>(f5) |
+                  getfield<uint64_t, 6, 40, 48>(op & 0x00FF);
+  emit6bytes(code);
+}
+
+#define DECLARE_S390_RSL_A_INSTRUCTIONS(name, op_name, op_value)         \
+  void name(const Operand& l1, Register b1, const Operand& d1) {         \
+    uint16_t L = static_cast<uint16_t>(l1.immediate() << 8);             \
+    rsl_format(op_name, L, b1.code(), d1.immediate(), 0, 0);             \
+  }
+  S390_RSL_A_OPCODE_LIST(DECLARE_S390_RSL_A_INSTRUCTIONS);
+#undef DECLARE_S390_RSL_A_INSTRUCTIONS
+
+#define DECLARE_S390_RSL_B_INSTRUCTIONS(name, op_name, op_value)         \
+  void name(const Operand& l2, Register b2, const Operand& d2,           \
+            Register r1, Condition m3) {                                 \
+    uint16_t L = static_cast<uint16_t>(l2.immediate());                  \
+    rsl_format(op_name, L, b2.code(), d2.immediate(), r1.code(), m3);    \
+  }
+  S390_RSL_B_OPCODE_LIST(DECLARE_S390_RSL_B_INSTRUCTIONS);
+#undef DECLARE_S390_RSL_B_INSTRUCTIONS
+
+
+inline void s_format(Opcode op, int f1, int f2) {
+  DCHECK_NE(op & 0xff00, 0);
+  DCHECK(is_uint12(f2));
+  uint32_t code = getfield<uint32_t, 4, 0, 16>(op) |
+                  getfield<uint32_t, 4, 16, 20>(f1) |
+                  getfield<uint32_t, 4, 20, 32>(f2);
+  emit4bytes(code);
+}
+
+#define DECLARE_S390_S_INSTRUCTIONS(name, op_name, op_value)             \
+  void name(Register b1, const Operand& d2) {                            \
+    Opcode op = op_name;                                                 \
+    if ((op & 0xFF00) == 0) {                                            \
+      op = (Opcode)(op << 8);                                            \
+    }                                                                    \
+    s_format(op, b1.code(), d2.immediate());                             \
+  }                                                                      \
+  void name(const MemOperand& opnd) {                                    \
+    Operand d2 = Operand(opnd.getDisplacement());                        \
+    name(opnd.getBaseRegister(), d2);                                    \
+  }
+  S390_S_OPCODE_LIST(DECLARE_S390_S_INSTRUCTIONS);
+#undef DECLARE_S390_S_INSTRUCTIONS
+
+
+inline void si_format(Opcode op, int f1, int f2, int f3) {
+  uint32_t code = getfield<uint32_t, 4, 0, 8>(op) |
+                  getfield<uint32_t, 4, 8, 16>(f1) |
+                  getfield<uint32_t, 4, 16, 20>(f2) |
+                  getfield<uint32_t, 4, 20, 32>(f3);
+  emit4bytes(code);
+}
+
+#define DECLARE_S390_SI_INSTRUCTIONS(name, op_name, op_value)            \
+  void name(const Operand& i2, Register b1, const Operand& d1) {         \
+    si_format(op_name, i2.immediate(), b1.code(), d1.immediate());       \
+  }                                                                      \
+  void name(const MemOperand& opnd, const Operand& i2) {                 \
+    name(i2, opnd.getBaseRegister(), Operand(opnd.getDisplacement()));   \
+  }
+  S390_SI_OPCODE_LIST(DECLARE_S390_SI_INSTRUCTIONS);
+#undef DECLARE_S390_SI_INSTRUCTIONS
+
+
+inline void siy_format(Opcode op, int f1, int f2, int f3) {
+  DCHECK(is_uint20(f3) || is_int20(f3));
+  DCHECK(is_uint16(op));
+  DCHECK(is_uint8(f1));
+  uint64_t code = getfield<uint64_t, 6, 0, 8>(op >> 8) |
+                  getfield<uint64_t, 6, 8, 16>(f1) |
+                  getfield<uint64_t, 6, 16, 20>(f2) |
+                  getfield<uint64_t, 6, 20, 32>(f3) |
+                  getfield<uint64_t, 6, 32, 40>(f3 >> 12) |
+                  getfield<uint64_t, 6, 40, 48>(op & 0x00FF);
+  emit6bytes(code);
+}
+
+#define DECLARE_S390_SIY_INSTRUCTIONS(name, op_name, op_value)           \
+  void name(const Operand& i2, Register b1, const Operand& d1) {         \
+    siy_format(op_name, i2.immediate(), b1.code(), d1.immediate());      \
+  }                                                                      \
+  void name(const MemOperand& opnd, const Operand& i2) {                 \
+    name(i2, opnd.getBaseRegister(), Operand(opnd.getDisplacement()));   \
+  }
+  S390_SIY_OPCODE_LIST(DECLARE_S390_SIY_INSTRUCTIONS);
+#undef DECLARE_S390_SIY_INSTRUCTIONS
+
+
+inline void rrs_format(Opcode op, int f1, int f2, int f3, int f4, int f5) {
+  DCHECK(is_uint12(f4));
+  DCHECK(is_uint16(op));
+  uint64_t code = getfield<uint64_t, 6, 0, 8>(op >> 8) |
+                  getfield<uint64_t, 6, 8, 12>(f1) |
+                  getfield<uint64_t, 6, 12, 16>(f2) |
+                  getfield<uint64_t, 6, 16, 20>(f3) |
+                  getfield<uint64_t, 6, 20, 32>(f4) |
+                  getfield<uint64_t, 6, 32, 36>(f5) |
+                  getfield<uint64_t, 6, 40, 48>(op & 0x00FF);
+  emit6bytes(code);
+}
+
+#define DECLARE_S390_RRS_INSTRUCTIONS(name, op_name, op_value)           \
+  void name(Register r1, Register r2, Register b4, const Operand& d4,    \
+            Condition m3) {                                              \
+    rrs_format(op_name, r1.code(), r2.code(), b4.code(), d4.immediate(), \
+               m3);                                                      \
+  }                                                                      \
+  void name(Register r1, Register r2, Condition m3,                      \
+            const MemOperand& opnd) {                                    \
+    name(r1, r2, opnd.getBaseRegister(),                                 \
+         Operand(opnd.getDisplacement()), m3);                           \
+  }
+  S390_RRS_OPCODE_LIST(DECLARE_S390_RRS_INSTRUCTIONS);
+#undef DECLARE_S390_RRS_INSTRUCTIONS
+
+
+inline void ris_format(Opcode op, int f1, int f2, int f3, int f4, int f5) {
+  DCHECK(is_uint12(f3));
+  DCHECK(is_uint16(op));
+  DCHECK(is_uint8(f5));
+  uint64_t code = getfield<uint64_t, 6, 0, 8>(op >> 8) |
+                  getfield<uint64_t, 6, 8, 12>(f1) |
+                  getfield<uint64_t, 6, 12, 16>(f2) |
+                  getfield<uint64_t, 6, 16, 20>(f3) |
+                  getfield<uint64_t, 6, 20, 32>(f4) |
+                  getfield<uint64_t, 6, 32, 40>(f5) |
+                  getfield<uint64_t, 6, 40, 48>(op & 0x00FF);
+  emit6bytes(code);
+}
+
+#define DECLARE_S390_RIS_INSTRUCTIONS(name, op_name, op_value)           \
+  void name(Register r1, Condition m3, Register b4, const Operand& d4,   \
+                       const Operand& i2) {                              \
+    ris_format(op_name, r1.code(), m3, b4.code(), d4.immediate(),        \
+               i2.immediate());                                          \
+  }                                                                      \
+  void name(Register r1, const Operand& i2, Condition m3,                \
+                       const MemOperand& opnd) {                         \
+    name(r1, m3, opnd.getBaseRegister(),                                 \
+         Operand(opnd.getDisplacement()), i2);                           \
+  }
+  S390_RIS_OPCODE_LIST(DECLARE_S390_RIS_INSTRUCTIONS);
+#undef DECLARE_S390_RIS_INSTRUCTIONS
+
+
+inline void sil_format(Opcode op, int f1, int f2, int f3) {
+  DCHECK(is_uint12(f2));
+  DCHECK(is_uint16(op));
+  DCHECK(is_uint16(f3));
+  uint64_t code = getfield<uint64_t, 6, 0, 16>(op) |
+                  getfield<uint64_t, 6, 16, 20>(f1) |
+                  getfield<uint64_t, 6, 20, 32>(f2) |
+                  getfield<uint64_t, 6, 32, 48>(f3);
+  emit6bytes(code);
+}
+
+#define DECLARE_S390_SIL_INSTRUCTIONS(name, op_name, op_value)           \
+  void name(Register b1, const Operand& d1, const Operand& i2) {         \
+    sil_format(op_name, b1.code(), d1.immediate(), i2.immediate());      \
+  }                                                                      \
+  void name(const MemOperand& opnd, const Operand& i2) {                 \
+    name(opnd.getBaseRegister(), Operand(opnd.getDisplacement()), i2);   \
+  }
+  S390_SIL_OPCODE_LIST(DECLARE_S390_SIL_INSTRUCTIONS);
+#undef DECLARE_S390_SIL_INSTRUCTIONS
+
+
+inline void rie_d_format(Opcode opcode, int f1, int f2, int f3, int f4) {
+  uint32_t op1 = opcode >> 8;
+  uint32_t op2 = opcode & 0xff;
+  uint64_t code = getfield<uint64_t, 6, 0, 8>(op1) |
+                  getfield<uint64_t, 6, 8, 12>(f1) |
+                  getfield<uint64_t, 6, 12, 16>(f2) |
+                  getfield<uint64_t, 6, 16, 32>(f3) |
+                  getfield<uint64_t, 6, 32, 40>(f4) |
+                  getfield<uint64_t, 6, 40, 48>(op2);
+  emit6bytes(code);
+}
+
+#define DECLARE_S390_RIE_D_INSTRUCTIONS(name, op_name, op_value)         \
+  void name(Register r1, Register r3, const Operand& i2) {               \
+    rie_d_format(op_name, r1.code(), r3.code(), i2.immediate(), 0);      \
+  }
+  S390_RIE_D_OPCODE_LIST(DECLARE_S390_RIE_D_INSTRUCTIONS)
+#undef DECLARE_S390_RIE_D_INSTRUCTIONS
+
+
+inline void rie_e_format(Opcode opcode, int f1, int f2, int f3) {
+  uint32_t op1 = opcode >> 8;
+  uint32_t op2 = opcode & 0xff;
+  uint64_t code = getfield<uint64_t, 6, 0, 8>(op1) |
+                  getfield<uint64_t, 6, 8, 12>(f1) |
+                  getfield<uint64_t, 6, 12, 16>(f2) |
+                  getfield<uint64_t, 6, 16, 32>(f3) |
+                  getfield<uint64_t, 6, 40, 48>(op2);
+  emit6bytes(code);
+}
+
+#define DECLARE_S390_RIE_E_INSTRUCTIONS(name, op_name, op_value)         \
+  void name(Register r1, Register r3, const Operand& i2) {               \
+    rie_e_format(op_name, r1.code(), r3.code(), i2.immediate());         \
+  }
+  S390_RIE_E_OPCODE_LIST(DECLARE_S390_RIE_E_INSTRUCTIONS)
+#undef DECLARE_S390_RIE_E_INSTRUCTIONS
+
+
+inline void rie_f_format(Opcode opcode, int f1, int f2, int f3, int f4,
+                         int f5) {
+  uint32_t op1 = opcode >> 8;
+  uint32_t op2 = opcode & 0xff;
+  uint64_t code = getfield<uint64_t, 6, 0, 8>(op1) |
+                  getfield<uint64_t, 6, 8, 12>(f1) |
+                  getfield<uint64_t, 6, 12, 16>(f2) |
+                  getfield<uint64_t, 6, 16, 24>(f3) |
+                  getfield<uint64_t, 6, 24, 32>(f4) |
+                  getfield<uint64_t, 6, 32, 40>(f5) |
+                  getfield<uint64_t, 6, 40, 48>(op2);
+  emit6bytes(code);
+}
+
+#define DECLARE_S390_RIE_F_INSTRUCTIONS(name, op_name, op_value)         \
+  void name(Register dst, Register src, const Operand& startBit,         \
+            const Operand& endBit, const Operand& shiftAmt) {            \
+    DCHECK(is_uint8(startBit.immediate()));                              \
+    DCHECK(is_uint8(endBit.immediate()));                                \
+    DCHECK(is_uint8(shiftAmt.immediate()));                              \
+    rie_f_format(op_name, dst.code(), src.code(), startBit.immediate(),  \
+                 endBit.immediate(), shiftAmt.immediate());              \
+  }
+  S390_RIE_F_OPCODE_LIST(DECLARE_S390_RIE_F_INSTRUCTIONS)
+#undef DECLARE_S390_RIE_F_INSTRUCTIONS
+
+
+inline void ss_a_format(Opcode op, int f1, int f2, int f3, int f4, int f5) {
+  DCHECK(is_uint12(f5));
+  DCHECK(is_uint12(f3));
+  DCHECK(is_uint8(f1));
+  DCHECK(is_uint8(op));
+  uint64_t code = getfield<uint64_t, 6, 0, 8>(op) |
+                  getfield<uint64_t, 6, 8, 16>(f1) |
+                  getfield<uint64_t, 6, 16, 20>(f2) |
+                  getfield<uint64_t, 6, 20, 32>(f3) |
+                  getfield<uint64_t, 6, 32, 36>(f4) |
+                  getfield<uint64_t, 6, 36, 48>(f5);
+  emit6bytes(code);
+}
+
+#define DECLARE_S390_SS_A_INSTRUCTIONS(name, op_name, op_value)          \
+  void name(Register b1, const Operand& d1, Register b2,                 \
+            const Operand& d2, const Operand& length) {                  \
+    ss_a_format(op_name, length.immediate(), b1.code(), d1.immediate(),  \
+                b2.code(), d2.immediate());                              \
+  }                                                                      \
+  void name(const MemOperand& opnd1, const MemOperand& opnd2,            \
+            const Operand& length) {                                     \
+    ss_a_format(op_name, length.immediate(),                             \
+                opnd1.getBaseRegister().code(),                          \
+                opnd1.getDisplacement(), opnd2.getBaseRegister().code(), \
+                opnd2.getDisplacement());                                \
+  }
+  S390_SS_A_OPCODE_LIST(DECLARE_S390_SS_A_INSTRUCTIONS)
+#undef DECLARE_S390_SS_A_INSTRUCTIONS
+
+
   // Helper for unconditional branch to Label with update to save register
   void b(Register r, Label* l) {
     int32_t halfwords = branch_offset(l) / 2;
@@ -879,6 +1318,19 @@ class Assembler : public AssemblerBase {
   void bunordered(Register r) { b(unordered, r); }
   void bordered(Register r) { b(ordered, r); }
 
+  // wrappers around asm instr
+  void brxh(Register dst, Register inc, Label* L) {
+    int offset_halfwords = branch_offset(L) / 2;
+    CHECK(is_int16(offset_halfwords));
+    brxh(dst, inc, Operand(offset_halfwords));
+  }
+
+  void brxhg(Register dst, Register inc, Label* L) {
+    int offset_halfwords = branch_offset(L) / 2;
+    CHECK(is_int16(offset_halfwords));
+    brxhg(dst, inc, Operand(offset_halfwords));
+  }
+
   // ---------------------------------------------------------------------------
   // Code generation
 
@@ -914,121 +1366,6 @@ class Assembler : public AssemblerBase {
   void jump(Handle<Code> target, RelocInfo::Mode rmode, Condition cond);
 
 // S390 instruction generation
-#define I_FORM(name) void name(const Operand& i)
-
-#define RR_FORM(name) void name(Register r1, Register r2)
-
-#define RR2_FORM(name) void name(Condition m1, Register r2)
-
-#define RI1_FORM(name) void name(Register r, const Operand& i)
-
-#define RI2_FORM(name) void name(Condition m, const Operand& i)
-
-#define RIE_FORM(name) void name(Register r1, Register R3, const Operand& i)
-
-#define RIE_F_FORM(name)                                                    \
-  void name(Register r1, Register r2, const Operand& i3, const Operand& i4, \
-            const Operand& i5)
-
-#define RXE_FORM(name)                            \
-  void name(Register r1, const MemOperand& opnd); \
-  void name(Register r1, Register b2, Register x2, Disp d2)
-
-#define RXF_FORM(name)                                         \
-  void name(Register r1, Register r3, const MemOperand& opnd); \
-  void name(Register r1, Register r3, Register b2, Register x2, Disp d2)
-
-#define RSI_FORM(name) void name(Register r1, Register r3, const Operand& i)
-
-#define RIS_FORM(name)                                       \
-  void name(Register r1, Condition m3, Register b4, Disp d4, \
-            const Operand& i2);                              \
-  void name(Register r1, const Operand& i2, Condition m3,    \
-            const MemOperand& opnd)
-
-#define SI_FORM(name)                                  \
-  void name(const MemOperand& opnd, const Operand& i); \
-  void name(const Operand& i2, Register b1, Disp d1)
-
-#define SIL_FORM(name)                                \
-  void name(Register b1, Disp d1, const Operand& i2); \
-  void name(const MemOperand& opnd, const Operand& i2)
-
-#define RRF1_FORM(name) void name(Register r1, Register r2, Register r3)
-
-#define RRF2_FORM(name) void name(Condition m1, Register r1, Register r2)
-
-#define RRF3_FORM(name) \
-  void name(Register r3, Condition m4, Register r1, Register r2)
-
-#define RS1_FORM(name)                                         \
-  void name(Register r1, Register r3, const MemOperand& opnd); \
-  void name(Register r1, Register r3, Register b2, Disp d2)
-
-#define RS2_FORM(name)                                          \
-  void name(Register r1, Condition m3, const MemOperand& opnd); \
-  void name(Register r1, Condition m3, Register b2, Disp d2)
-
-#define RSE_FORM(name)                                         \
-  void name(Register r1, Register r3, const MemOperand& opnd); \
-  void name(Register r1, Register r3, Register b2, Disp d2)
-
-#define RSL_FORM(name)                       \
-  void name(Length l, Register b2, Disp d2); \
-  void name(const MemOperand& opnd)
-
-#define RSY1_FORM(name)                                      \
-  void name(Register r1, Register r3, Register b2, Disp d2); \
-  void name(Register r1, Register r3, const MemOperand& opnd)
-
-#define RSY2_FORM(name)                                       \
-  void name(Register r1, Condition m3, Register b2, Disp d2); \
-  void name(Register r1, Condition m3, const MemOperand& opnd)
-
-#define RRS_FORM(name)                                                     \
-  void name(Register r1, Register r2, Register b4, Disp d4, Condition m3); \
-  void name(Register r1, Register r2, Condition m3, const MemOperand& opnd)
-
-#define S_FORM(name)               \
-  void name(Register b2, Disp d2); \
-  void name(const MemOperand& opnd)
-
-#define SIY_FORM(name)                                \
-  void name(const Operand& i2, Register b1, Disp d1); \
-  void name(const MemOperand& opnd, const Operand& i)
-
-#define SS1_FORM(name)                                                  \
-  void name(Register b1, Disp d1, Register b3, Disp d2, Length length); \
-  void name(const MemOperand& opnd1, const MemOperand& opnd2, Length length)
-
-#define SS2_FORM(name)                                                        \
-  void name(const MemOperand& opnd1, const MemOperand& opnd2, Length length1, \
-            Length length2);                                                  \
-  void name(Register b1, Disp d1, Register b2, Disp d2, Length l1, Length l2)
-
-#define SS3_FORM(name)                                                        \
-  void name(const MemOperand& opnd1, const MemOperand& opnd2, Length length); \
-  void name(const Operand& i3, Register b1, Disp d1, Register b2, Disp d2,    \
-            Length l1)
-
-#define SS4_FORM(name)                                                   \
-  void name(const MemOperand& opnd1, const MemOperand& opnd2);           \
-  void name(Register r1, Register r3, Register b1, Disp d1, Register b2, \
-            Disp d2)
-
-#define SS5_FORM(name)                                                   \
-  void name(const MemOperand& opnd1, const MemOperand& opnd2);           \
-  void name(Register r1, Register r3, Register b3, Disp d2, Register b4, \
-            Disp d4)
-
-#define SSE_FORM(name)                                   \
-  void name(Register b1, Disp d1, Register b2, Disp d2); \
-  void name(const MemOperand& opnd1, const MemOperand& opnd2)
-
-#define SSF_FORM(name)                                                \
-  void name(Register r3, Register b1, Disp d1, Register b2, Disp d2); \
-  void name(Register r3, const MemOperand& opnd1, const MemOperand& opnd2)
-
 #define DECLARE_VRR_A_INSTRUCTIONS(name, opcode_name, opcode_value)           \
   void name(DoubleRegister v1, DoubleRegister v2, Condition m5, Condition m4, \
             Condition m3) {                                                   \
@@ -1078,233 +1415,9 @@ class Assembler : public AssemblerBase {
         static_cast<Condition>(3));
   }
 
-  // S390 instruction sets
-  RXE_FORM(ddb);
-  SS1_FORM(ed);
-  RRF2_FORM(fidbr);
-  RI1_FORM(iihh);
-  RI1_FORM(iihl);
-  RI1_FORM(iilh);
-  RI1_FORM(iill);
-  RSY1_FORM(loc);
-  RXE_FORM(mdb);
-  SS4_FORM(mvck);
-  SSF_FORM(mvcos);
-  SS4_FORM(mvcs);
-  SS1_FORM(mvn);
-  SS1_FORM(nc);
-  SI_FORM(ni);
-  RI1_FORM(nilh);
-  RI1_FORM(nill);
-  RI1_FORM(oill);
-  RXE_FORM(sdb);
-  RS1_FORM(srdl);
-  RI1_FORM(tmll);
-  SS1_FORM(tr);
-  S_FORM(ts);
-
   // Load Address Instructions
   void larl(Register r, Label* l);
 
-  // Load Instructions
-  void lhi(Register r, const Operand& imm);
-  void lghi(Register r, const Operand& imm);
-
-  // Load Multiple Instructions
-  void lm(Register r1, Register r2, const MemOperand& src);
-  void lmy(Register r1, Register r2, const MemOperand& src);
-  void lmg(Register r1, Register r2, const MemOperand& src);
-
-  // Load On Condition Instructions
-  void locr(Condition m3, Register r1, Register r2);
-  void locgr(Condition m3, Register r1, Register r2);
-  void loc(Condition m3, Register r1, const MemOperand& src);
-  void locg(Condition m3, Register r1, const MemOperand& src);
-
-  // Store Instructions
-
-  // Store Multiple Instructions
-  void stm(Register r1, Register r2, const MemOperand& src);
-  void stmy(Register r1, Register r2, const MemOperand& src);
-  void stmg(Register r1, Register r2, const MemOperand& src);
-
-  // Compare Instructions
-  void chi(Register r, const Operand& opnd);
-  void cghi(Register r, const Operand& opnd);
-
-  // Compare Logical Instructions
-  void cli(const MemOperand& mem, const Operand& imm);
-  void cliy(const MemOperand& mem, const Operand& imm);
-  void clc(const MemOperand& opnd1, const MemOperand& opnd2, Length length);
-
-  // Compare and Swap Instructions
-  void cs(Register r1, Register r2, const MemOperand& src);
-  void csy(Register r1, Register r2, const MemOperand& src);
-  void csg(Register r1, Register r2, const MemOperand& src);
-
-  // Test Under Mask Instructions
-  void tm(const MemOperand& mem, const Operand& imm);
-  void tmy(const MemOperand& mem, const Operand& imm);
-
-  // Rotate Instructions
-  void rll(Register r1, Register r3, Register opnd);
-  void rll(Register r1, Register r3, const Operand& opnd);
-  void rll(Register r1, Register r3, Register r2, const Operand& opnd);
-  void rllg(Register r1, Register r3, const Operand& opnd);
-  void rllg(Register r1, Register r3, const Register opnd);
-  void rllg(Register r1, Register r3, Register r2, const Operand& opnd);
-
-  // Shift Instructions (32)
-  void sll(Register r1, Register opnd);
-  void sll(Register r1, const Operand& opnd);
-  void sllk(Register r1, Register r3, Register opnd);
-  void sllk(Register r1, Register r3, const Operand& opnd);
-  void srl(Register r1, Register opnd);
-  void srl(Register r1, const Operand& opnd);
-  void srlk(Register r1, Register r3, Register opnd);
-  void srlk(Register r1, Register r3, const Operand& opnd);
-  void sra(Register r1, Register opnd);
-  void sra(Register r1, const Operand& opnd);
-  void srak(Register r1, Register r3, Register opnd);
-  void srak(Register r1, Register r3, const Operand& opnd);
-  void sla(Register r1, Register opnd);
-  void sla(Register r1, const Operand& opnd);
-  void slak(Register r1, Register r3, Register opnd);
-  void slak(Register r1, Register r3, const Operand& opnd);
-
-  // Shift Instructions (64)
-  void sllg(Register r1, Register r3, const Operand& opnd);
-  void sllg(Register r1, Register r3, const Register opnd);
-  void srlg(Register r1, Register r3, const Operand& opnd);
-  void srlg(Register r1, Register r3, const Register opnd);
-  void srag(Register r1, Register r3, const Operand& opnd);
-  void srag(Register r1, Register r3, const Register opnd);
-  void srda(Register r1, const Operand& opnd);
-  void srdl(Register r1, const Operand& opnd);
-  void slag(Register r1, Register r3, const Operand& opnd);
-  void slag(Register r1, Register r3, const Register opnd);
-  void sldl(Register r1, Register b2, const Operand& opnd);
-  void srdl(Register r1, Register b2, const Operand& opnd);
-  void srda(Register r1, Register b2, const Operand& opnd);
-
-  // Rotate and Insert Selected Bits
-  void risbg(Register dst, Register src, const Operand& startBit,
-             const Operand& endBit, const Operand& shiftAmt,
-             bool zeroBits = true);
-  void risbgn(Register dst, Register src, const Operand& startBit,
-              const Operand& endBit, const Operand& shiftAmt,
-              bool zeroBits = true);
-
-  // Move Character (Mem to Mem)
-  void mvc(const MemOperand& opnd1, const MemOperand& opnd2, uint32_t length);
-
-  // Branch Instructions
-  void bras(Register r, const Operand& opnd);
-  void brc(Condition c, const Operand& opnd);
-  void brct(Register r1, const Operand& opnd);
-  void brctg(Register r1, const Operand& opnd);
-
-  // 32-bit Add Instructions
-  void ahi(Register r1, const Operand& opnd);
-  void ahik(Register r1, Register r3, const Operand& opnd);
-  void ark(Register r1, Register r2, Register r3);
-  void asi(const MemOperand&, const Operand&);
-
-  // 64-bit Add Instructions
-  void aghi(Register r1, const Operand& opnd);
-  void aghik(Register r1, Register r3, const Operand& opnd);
-  void agrk(Register r1, Register r2, Register r3);
-  void agsi(const MemOperand&, const Operand&);
-
-  // 32-bit Add Logical Instructions
-  void alrk(Register r1, Register r2, Register r3);
-
-  // 64-bit Add Logical Instructions
-  void algrk(Register r1, Register r2, Register r3);
-
-  // 32-bit Subtract Instructions
-  void srk(Register r1, Register r2, Register r3);
-
-  // 64-bit Subtract Instructions
-  void sgrk(Register r1, Register r2, Register r3);
-
-  // 32-bit Subtract Logical Instructions
-  void slrk(Register r1, Register r2, Register r3);
-
-  // 64-bit Subtract Logical Instructions
-  void slgrk(Register r1, Register r2, Register r3);
-
-  // 32-bit Multiply Instructions
-  void mhi(Register r1, const Operand& opnd);
-  void msrkc(Register r1, Register r2, Register r3);
-  void msgrkc(Register r1, Register r2, Register r3);
-
-  // 64-bit Multiply Instructions
-  void mghi(Register r1, const Operand& opnd);
-
-  // Bitwise Instructions (AND / OR / XOR)
-  void nrk(Register r1, Register r2, Register r3);
-  void ngrk(Register r1, Register r2, Register r3);
-  void ork(Register r1, Register r2, Register r3);
-  void ogrk(Register r1, Register r2, Register r3);
-  void xrk(Register r1, Register r2, Register r3);
-  void xgrk(Register r1, Register r2, Register r3);
-  void xc(const MemOperand& opnd1, const MemOperand& opnd2, Length length);
-
-  // Floating <-> Fixed Point Conversion Instructions
-  void cdlfbr(Condition m3, Condition m4, DoubleRegister fltReg,
-              Register fixReg);
-  void cdlgbr(Condition m3, Condition m4, DoubleRegister fltReg,
-              Register fixReg);
-  void celgbr(Condition m3, Condition m4, DoubleRegister fltReg,
-              Register fixReg);
-  void celfbr(Condition m3, Condition m4, DoubleRegister fltReg,
-              Register fixReg);
-  void clfdbr(Condition m3, Condition m4, Register fixReg,
-              DoubleRegister fltReg);
-  void clfebr(Condition m3, Condition m4, Register fixReg,
-              DoubleRegister fltReg);
-  void clgdbr(Condition m3, Condition m4, Register fixReg,
-              DoubleRegister fltReg);
-  void clgebr(Condition m3, Condition m4, Register fixReg,
-              DoubleRegister fltReg);
-  void cfdbr(Condition m, Register fixReg, DoubleRegister fltReg);
-  void cgebr(Condition m, Register fixReg, DoubleRegister fltReg);
-  void cgdbr(Condition m, Register fixReg, DoubleRegister fltReg);
-  void cfebr(Condition m3, Register fixReg, DoubleRegister fltReg);
-  void cefbr(Condition m3, DoubleRegister fltReg, Register fixReg);
-
-  // Floating Point Compare Instructions
-  void cdb(DoubleRegister r1, const MemOperand& opnd);
-  void ceb(DoubleRegister r1, const MemOperand& opnd);
-
-  // Floating Point Arithmetic Instructions
-  void adb(DoubleRegister r1, const MemOperand& opnd);
-  void aeb(DoubleRegister r1, const MemOperand& opnd);
-  void sdb(DoubleRegister r1, const MemOperand& opnd);
-  void seb(DoubleRegister r1, const MemOperand& opnd);
-  void mdb(DoubleRegister r1, const MemOperand& opnd);
-  void meeb(DoubleRegister r1, const MemOperand& opnd);
-  void ddb(DoubleRegister r1, const MemOperand& opnd);
-  void deb(DoubleRegister r1, const MemOperand& opnd);
-  void sqdb(DoubleRegister r1, const MemOperand& opnd);
-  void ldeb(DoubleRegister r1, const MemOperand& opnd);
-
-  enum FIDBRA_MASK3 {
-    FIDBRA_CURRENT_ROUNDING_MODE = 0,
-    FIDBRA_ROUND_TO_NEAREST_AWAY_FROM_0 = 1,
-    // ...
-    FIDBRA_ROUND_TOWARD_0 = 5,
-    FIDBRA_ROUND_TOWARD_POS_INF = 6,
-    FIDBRA_ROUND_TOWARD_NEG_INF = 7
-  };
-  void fiebra(DoubleRegister d1, DoubleRegister d2, FIDBRA_MASK3 m3);
-  void fidbra(DoubleRegister d1, DoubleRegister d2, FIDBRA_MASK3 m3);
-
-  // Move integer
-  void mvhi(const MemOperand& opnd1, const Operand& i2);
-  void mvghi(const MemOperand& opnd1, const Operand& i2);
-
   // Exception-generating instructions and debugging support
   void stop(const char* msg, Condition cond = al,
             int32_t code = kDefaultStopCode, CRegister cr = cr7);
@@ -1401,7 +1514,6 @@ class Assembler : public AssemblerBase {
 
  public:
   byte* buffer_pos() const { return buffer_; }
-  void RequestHeapObject(HeapObjectRequest request);
 
  protected:
   int buffer_space() const { return reloc_info_writer.pos() - pc_; }
@@ -1446,9 +1558,6 @@ class Assembler : public AssemblerBase {
   inline void TrackBranch();
   inline void UntrackBranch();
 
-  inline int32_t emit_code_target(
-      Handle<Code> target, RelocInfo::Mode rmode);
-
   // Helper to emit the binary encoding of a 2 byte instruction
   void emit2bytes(uint16_t x) {
     CheckBuffer();
@@ -1502,89 +1611,16 @@ class Assembler : public AssemblerBase {
     pc_ += 6;
   }
 
-  // Helpers to emit binary encoding for various instruction formats.
-
-  inline void rr2_form(uint8_t op, Condition m1, Register r2);
-
-  inline void ri_form(Opcode op, Register r1, const Operand& i2);
-  inline void ri_form(Opcode op, Condition m1, const Operand& i2);
-
-  inline void rie_form(Opcode op, Register r1, Register r3, const Operand& i2);
-  inline void rie_f_form(Opcode op, Register r1, Register r2, const Operand& i3,
-                         const Operand& i4, const Operand& i5);
-
-  inline void ris_form(Opcode op, Register r1, Condition m3, Register b4,
-                       Disp d4, const Operand& i2);
-
-  inline void rrf1_form(Opcode op, Register r1, Register r2, Register r3);
-  inline void rrf1_form(uint32_t x);
-  inline void rrf2_form(uint32_t x);
-  inline void rrf3_form(uint32_t x);
-  inline void rrfe_form(Opcode op, Condition m3, Condition m4, Register r1,
-                        Register r2);
-
-  inline void rrs_form(Opcode op, Register r1, Register r2, Register b4,
-                       Disp d4, Condition m3);
-
-  inline void rs_form(Opcode op, Register r1, Condition m3, Register b2,
-                      const Disp d2);
-  inline void rs_form(Opcode op, Register r1, Register r3, Register b2,
-                      const Disp d2);
-
-  inline void rsi_form(Opcode op, Register r1, Register r3, const Operand& i2);
-  inline void rsl_form(Opcode op, Length l1, Register b2, Disp d2);
-
-  inline void rsy_form(Opcode op, Register r1, Register r3, Register b2,
-                       const Disp d2);
-  inline void rsy_form(Opcode op, Register r1, Condition m3, Register b2,
-                       const Disp d2);
-
-  inline void rxe_form(Opcode op, Register r1, Register x2, Register b2,
-                       Disp d2);
-
-  inline void rxf_form(Opcode op, Register r1, Register r3, Register b2,
-                       Register x2, Disp d2);
-
-  inline void s_form(Opcode op, Register b1, Disp d2);
-
-  inline void si_form(Opcode op, const Operand& i2, Register b1, Disp d1);
-  inline void siy_form(Opcode op, const Operand& i2, Register b1, Disp d1);
-
-  inline void sil_form(Opcode op, Register b1, Disp d1, const Operand& i2);
-
-  inline void ss_form(Opcode op, Length l, Register b1, Disp d1, Register b2,
-                      Disp d2);
-  inline void ss_form(Opcode op, Length l1, Length l2, Register b1, Disp d1,
-                      Register b2, Disp d2);
-  inline void ss_form(Opcode op, Length l1, const Operand& i3, Register b1,
-                      Disp d1, Register b2, Disp d2);
-  inline void ss_form(Opcode op, Register r1, Register r2, Register b1, Disp d1,
-                      Register b2, Disp d2);
-  inline void sse_form(Opcode op, Register b1, Disp d1, Register b2, Disp d2);
-  inline void ssf_form(Opcode op, Register r3, Register b1, Disp d1,
-                       Register b2, Disp d2);
-
   // Labels
   void print(Label* L);
   int max_reach_from(int pos);
   void bind_to(Label* L, int pos);
   void next(Label* L);
 
-  // The following functions help with avoiding allocations of embedded heap
-  // objects during the code assembly phase. {RequestHeapObject} records the
-  // need for a future heap number allocation or code stub generation. After
-  // code assembly, {AllocateAndInstallRequestedHeapObjects} will allocate these
-  // objects and place them where they are expected (determined by the pc offset
-  // associated with each request). That is, for each request, it will patch the
-  // dummy heap object handle that we emitted during code assembly with the
-  // actual heap object handle.
   void AllocateAndInstallRequestedHeapObjects(Isolate* isolate);
-  std::forward_list<HeapObjectRequest> heap_object_requests_;
 
   friend class RegExpMacroAssemblerS390;
   friend class RelocInfo;
-
-  std::vector<Handle<Code>> code_targets_;
   friend class EnsureSpace;
 };
 
diff --git a/deps/v8/src/s390/code-stubs-s390.cc b/deps/v8/src/s390/code-stubs-s390.cc
index c8b24153321d25..a9c1ec17e8e7dd 100644
--- a/deps/v8/src/s390/code-stubs-s390.cc
+++ b/deps/v8/src/s390/code-stubs-s390.cc
@@ -14,6 +14,7 @@
 #include "src/ic/ic.h"
 #include "src/ic/stub-cache.h"
 #include "src/isolate.h"
+#include "src/objects/api-callbacks.h"
 #include "src/regexp/jsregexp.h"
 #include "src/regexp/regexp-macro-assembler.h"
 #include "src/runtime/runtime.h"
@@ -25,414 +26,6 @@ namespace internal {
 
 #define __ ACCESS_MASM(masm)
 
-void ArrayNArgumentsConstructorStub::Generate(MacroAssembler* masm) {
-  __ ShiftLeftP(r1, r2, Operand(kPointerSizeLog2));
-  __ StoreP(r3, MemOperand(sp, r1));
-  __ push(r3);
-  __ push(r4);
-  __ AddP(r2, r2, Operand(3));
-  __ TailCallRuntime(Runtime::kNewArray);
-}
-
-void DoubleToIStub::Generate(MacroAssembler* masm) {
-  Label out_of_range, only_low, negate, done, fastpath_done;
-  Register result_reg = destination();
-
-  // Immediate values for this stub fit in instructions, so it's safe to use ip.
-  Register scratch = GetRegisterThatIsNotOneOf(result_reg);
-  Register scratch_low = GetRegisterThatIsNotOneOf(result_reg, scratch);
-  Register scratch_high =
-      GetRegisterThatIsNotOneOf(result_reg, scratch, scratch_low);
-  DoubleRegister double_scratch = kScratchDoubleReg;
-
-  __ push(scratch);
-  // Account for saved regs.
-  int argument_offset = 1 * kPointerSize;
-
-  // Load double input.
-  __ LoadDouble(double_scratch, MemOperand(sp, argument_offset));
-
-  // Do fast-path convert from double to int.
-  __ ConvertDoubleToInt64(result_reg, double_scratch);
-
-  // Test for overflow
-  __ TestIfInt32(result_reg);
-  __ beq(&fastpath_done, Label::kNear);
-
-  __ Push(scratch_high, scratch_low);
-  // Account for saved regs.
-  argument_offset += 2 * kPointerSize;
-
-  __ LoadlW(scratch_high,
-            MemOperand(sp, argument_offset + Register::kExponentOffset));
-  __ LoadlW(scratch_low,
-            MemOperand(sp, argument_offset + Register::kMantissaOffset));
-
-  __ ExtractBitMask(scratch, scratch_high, HeapNumber::kExponentMask);
-  // Load scratch with exponent - 1. This is faster than loading
-  // with exponent because Bias + 1 = 1024 which is a *S390* immediate value.
-  STATIC_ASSERT(HeapNumber::kExponentBias + 1 == 1024);
-  __ SubP(scratch, Operand(HeapNumber::kExponentBias + 1));
-  // If exponent is greater than or equal to 84, the 32 less significant
-  // bits are 0s (2^84 = 1, 52 significant bits, 32 uncoded bits),
-  // the result is 0.
-  // Compare exponent with 84 (compare exponent - 1 with 83).
-  __ CmpP(scratch, Operand(83));
-  __ bge(&out_of_range, Label::kNear);
-
-  // If we reach this code, 31 <= exponent <= 83.
-  // So, we don't have to handle cases where 0 <= exponent <= 20 for
-  // which we would need to shift right the high part of the mantissa.
-  // Scratch contains exponent - 1.
-  // Load scratch with 52 - exponent (load with 51 - (exponent - 1)).
-  __ Load(r0, Operand(51));
-  __ SubP(scratch, r0, scratch);
-  __ CmpP(scratch, Operand::Zero());
-  __ ble(&only_low, Label::kNear);
-  // 21 <= exponent <= 51, shift scratch_low and scratch_high
-  // to generate the result.
-  __ ShiftRight(scratch_low, scratch_low, scratch);
-  // Scratch contains: 52 - exponent.
-  // We needs: exponent - 20.
-  // So we use: 32 - scratch = 32 - 52 + exponent = exponent - 20.
-  __ Load(r0, Operand(32));
-  __ SubP(scratch, r0, scratch);
-  __ ExtractBitMask(result_reg, scratch_high, HeapNumber::kMantissaMask);
-  // Set the implicit 1 before the mantissa part in scratch_high.
-  STATIC_ASSERT(HeapNumber::kMantissaBitsInTopWord >= 16);
-  __ Load(r0, Operand(1 << ((HeapNumber::kMantissaBitsInTopWord)-16)));
-  __ ShiftLeftP(r0, r0, Operand(16));
-  __ OrP(result_reg, result_reg, r0);
-  __ ShiftLeft(r0, result_reg, scratch);
-  __ OrP(result_reg, scratch_low, r0);
-  __ b(&negate, Label::kNear);
-
-  __ bind(&out_of_range);
-  __ mov(result_reg, Operand::Zero());
-  __ b(&done, Label::kNear);
-
-  __ bind(&only_low);
-  // 52 <= exponent <= 83, shift only scratch_low.
-  // On entry, scratch contains: 52 - exponent.
-  __ LoadComplementRR(scratch, scratch);
-  __ ShiftLeft(result_reg, scratch_low, scratch);
-
-  __ bind(&negate);
-  // If input was positive, scratch_high ASR 31 equals 0 and
-  // scratch_high LSR 31 equals zero.
-  // New result = (result eor 0) + 0 = result.
-  // If the input was negative, we have to negate the result.
-  // Input_high ASR 31 equals 0xFFFFFFFF and scratch_high LSR 31 equals 1.
-  // New result = (result eor 0xFFFFFFFF) + 1 = 0 - result.
-  __ ShiftRightArith(r0, scratch_high, Operand(31));
-#if V8_TARGET_ARCH_S390X
-  __ lgfr(r0, r0);
-  __ ShiftRightP(r0, r0, Operand(32));
-#endif
-  __ XorP(result_reg, r0);
-  __ ShiftRight(r0, scratch_high, Operand(31));
-  __ AddP(result_reg, r0);
-
-  __ bind(&done);
-  __ Pop(scratch_high, scratch_low);
-
-  __ bind(&fastpath_done);
-  __ pop(scratch);
-
-  __ Ret();
-}
-
-void MathPowStub::Generate(MacroAssembler* masm) {
-  const Register exponent = MathPowTaggedDescriptor::exponent();
-  DCHECK(exponent == r4);
-  const DoubleRegister double_base = d1;
-  const DoubleRegister double_exponent = d2;
-  const DoubleRegister double_result = d3;
-  const DoubleRegister double_scratch = d0;
-  const Register scratch = r1;
-  const Register scratch2 = r9;
-
-  Label call_runtime, done, int_exponent;
-
-  // Detect integer exponents stored as double.
-  __ TryDoubleToInt32Exact(scratch, double_exponent, scratch2, double_scratch);
-  __ beq(&int_exponent, Label::kNear);
-
-  __ push(r14);
-  {
-    AllowExternalCallThatCantCauseGC scope(masm);
-    __ PrepareCallCFunction(0, 2, scratch);
-    __ MovToFloatParameters(double_base, double_exponent);
-    __ CallCFunction(ExternalReference::power_double_double_function(isolate()),
-                     0, 2);
-  }
-  __ pop(r14);
-  __ MovFromFloatResult(double_result);
-  __ b(&done);
-
-  // Calculate power with integer exponent.
-  __ bind(&int_exponent);
-
-  // Get two copies of exponent in the registers scratch and exponent.
-  // Exponent has previously been stored into scratch as untagged integer.
-  __ LoadRR(exponent, scratch);
-
-  __ ldr(double_scratch, double_base);  // Back up base.
-  __ LoadImmP(scratch2, Operand(1));
-  __ ConvertIntToDouble(double_result, scratch2);
-
-  // Get absolute value of exponent.
-  Label positive_exponent;
-  __ CmpP(scratch, Operand::Zero());
-  __ bge(&positive_exponent, Label::kNear);
-  __ LoadComplementRR(scratch, scratch);
-  __ bind(&positive_exponent);
-
-  Label while_true, no_carry, loop_end;
-  __ bind(&while_true);
-  __ mov(scratch2, Operand(1));
-  __ AndP(scratch2, scratch);
-  __ beq(&no_carry, Label::kNear);
-  __ mdbr(double_result, double_scratch);
-  __ bind(&no_carry);
-  __ ShiftRightP(scratch, scratch, Operand(1));
-  __ LoadAndTestP(scratch, scratch);
-  __ beq(&loop_end, Label::kNear);
-  __ mdbr(double_scratch, double_scratch);
-  __ b(&while_true);
-  __ bind(&loop_end);
-
-  __ CmpP(exponent, Operand::Zero());
-  __ bge(&done);
-
-  // get 1/double_result:
-  __ ldr(double_scratch, double_result);
-  __ LoadImmP(scratch2, Operand(1));
-  __ ConvertIntToDouble(double_result, scratch2);
-  __ ddbr(double_result, double_scratch);
-
-  // Test whether result is zero.  Bail out to check for subnormal result.
-  // Due to subnormals, x^-y == (1/x)^y does not hold in all cases.
-  __ lzdr(kDoubleRegZero);
-  __ cdbr(double_result, kDoubleRegZero);
-  __ bne(&done, Label::kNear);
-  // double_exponent may not containe the exponent value if the input was a
-  // smi.  We set it with exponent value before bailing out.
-  __ ConvertIntToDouble(double_exponent, exponent);
-
-  // Returning or bailing out.
-  __ push(r14);
-  {
-    AllowExternalCallThatCantCauseGC scope(masm);
-    __ PrepareCallCFunction(0, 2, scratch);
-    __ MovToFloatParameters(double_base, double_exponent);
-    __ CallCFunction(
-        ExternalReference::power_double_double_function(isolate()), 0, 2);
-  }
-  __ pop(r14);
-  __ MovFromFloatResult(double_result);
-
-  __ bind(&done);
-  __ Ret();
-}
-
-Movability CEntryStub::NeedsImmovableCode() { return kImmovable; }
-
-void CodeStub::GenerateStubsAheadOfTime(Isolate* isolate) {
-  CEntryStub::GenerateAheadOfTime(isolate);
-  CommonArrayConstructorStub::GenerateStubsAheadOfTime(isolate);
-  StoreFastElementStub::GenerateAheadOfTime(isolate);
-}
-
-void CodeStub::GenerateFPStubs(Isolate* isolate) {
-  SaveFPRegsMode mode = kSaveFPRegs;
-  CEntryStub(isolate, 1, mode).GetCode();
-}
-
-void CEntryStub::GenerateAheadOfTime(Isolate* isolate) {
-  CEntryStub stub(isolate, 1, kDontSaveFPRegs);
-  stub.GetCode();
-  CEntryStub save_doubles(isolate, 1, kSaveFPRegs);
-  save_doubles.GetCode();
-}
-
-void CEntryStub::Generate(MacroAssembler* masm) {
-  // Called from JavaScript; parameters are on stack as if calling JS function.
-  // r2: number of arguments including receiver
-  // r3: pointer to builtin function
-  // fp: frame pointer  (restored after C call)
-  // sp: stack pointer  (restored as callee's sp after C call)
-  // cp: current context  (C callee-saved)
-  //
-  // If argv_in_register():
-  // r4: pointer to the first argument
-  ProfileEntryHookStub::MaybeCallEntryHook(masm);
-
-  __ LoadRR(r7, r3);
-
-  if (argv_in_register()) {
-    // Move argv into the correct register.
-    __ LoadRR(r3, r4);
-  } else {
-    // Compute the argv pointer.
-    __ ShiftLeftP(r3, r2, Operand(kPointerSizeLog2));
-    __ lay(r3, MemOperand(r3, sp, -kPointerSize));
-  }
-
-  // Enter the exit frame that transitions from JavaScript to C++.
-  FrameScope scope(masm, StackFrame::MANUAL);
-
-  // Need at least one extra slot for return address location.
-  int arg_stack_space = 1;
-
-  // Pass buffer for return value on stack if necessary
-  bool needs_return_buffer =
-      result_size() == 2 && !ABI_RETURNS_OBJECTPAIR_IN_REGS;
-  if (needs_return_buffer) {
-    arg_stack_space += result_size();
-  }
-
-#if V8_TARGET_ARCH_S390X
-  // 64-bit linux pass Argument object by reference not value
-  arg_stack_space += 2;
-#endif
-
-  __ EnterExitFrame(save_doubles(), arg_stack_space, is_builtin_exit()
-                                           ? StackFrame::BUILTIN_EXIT
-                                           : StackFrame::EXIT);
-
-  // Store a copy of argc, argv in callee-saved registers for later.
-  __ LoadRR(r6, r2);
-  __ LoadRR(r8, r3);
-  // r2, r6: number of arguments including receiver  (C callee-saved)
-  // r3, r8: pointer to the first argument
-  // r7: pointer to builtin function  (C callee-saved)
-
-  // Result returned in registers or stack, depending on result size and ABI.
-
-  Register isolate_reg = r4;
-  if (needs_return_buffer) {
-    // The return value is 16-byte non-scalar value.
-    // Use frame storage reserved by calling function to pass return
-    // buffer as implicit first argument in R2.  Shfit original parameters
-    // by one register each.
-    __ LoadRR(r4, r3);
-    __ LoadRR(r3, r2);
-    __ la(r2, MemOperand(sp, (kStackFrameExtraParamSlot + 1) * kPointerSize));
-    isolate_reg = r5;
-  }
-  // Call C built-in.
-  __ mov(isolate_reg, Operand(ExternalReference::isolate_address(isolate())));
-
-  Register target = r7;
-
-  // To let the GC traverse the return address of the exit frames, we need to
-  // know where the return address is. The CEntryStub is unmovable, so
-  // we can store the address on the stack to be able to find it again and
-  // we never have to restore it, because it will not change.
-  {
-    Label return_label;
-    __ larl(r14, &return_label);  // Generate the return addr of call later.
-    __ StoreP(r14, MemOperand(sp, kStackFrameRASlot * kPointerSize));
-
-    // zLinux ABI requires caller's frame to have sufficient space for callee
-    // preserved regsiter save area.
-    // __ lay(sp, MemOperand(sp, -kCalleeRegisterSaveAreaSize));
-    __ b(target);
-    __ bind(&return_label);
-    // __ la(sp, MemOperand(sp, +kCalleeRegisterSaveAreaSize));
-  }
-
-  // If return value is on the stack, pop it to registers.
-  if (needs_return_buffer) {
-    __ LoadP(r3, MemOperand(r2, kPointerSize));
-    __ LoadP(r2, MemOperand(r2));
-  }
-
-  // Check result for exception sentinel.
-  Label exception_returned;
-  __ CompareRoot(r2, Heap::kExceptionRootIndex);
-  __ beq(&exception_returned, Label::kNear);
-
-  // Check that there is no pending exception, otherwise we
-  // should have returned the exception sentinel.
-  if (FLAG_debug_code) {
-    Label okay;
-    ExternalReference pending_exception_address(
-        IsolateAddressId::kPendingExceptionAddress, isolate());
-    __ mov(r1, Operand(pending_exception_address));
-    __ LoadP(r1, MemOperand(r1));
-    __ CompareRoot(r1, Heap::kTheHoleValueRootIndex);
-    // Cannot use check here as it attempts to generate call into runtime.
-    __ beq(&okay, Label::kNear);
-    __ stop("Unexpected pending exception");
-    __ bind(&okay);
-  }
-
-  // Exit C frame and return.
-  // r2:r3: result
-  // sp: stack pointer
-  // fp: frame pointer
-  Register argc = argv_in_register()
-                      // We don't want to pop arguments so set argc to no_reg.
-                      ? no_reg
-                      // r6: still holds argc (callee-saved).
-                      : r6;
-  __ LeaveExitFrame(save_doubles(), argc);
-  __ b(r14);
-
-  // Handling of exception.
-  __ bind(&exception_returned);
-
-  ExternalReference pending_handler_context_address(
-      IsolateAddressId::kPendingHandlerContextAddress, isolate());
-  ExternalReference pending_handler_entrypoint_address(
-      IsolateAddressId::kPendingHandlerEntrypointAddress, isolate());
-  ExternalReference pending_handler_fp_address(
-      IsolateAddressId::kPendingHandlerFPAddress, isolate());
-  ExternalReference pending_handler_sp_address(
-      IsolateAddressId::kPendingHandlerSPAddress, isolate());
-
-  // Ask the runtime for help to determine the handler. This will set r3 to
-  // contain the current pending exception, don't clobber it.
-  ExternalReference find_handler(Runtime::kUnwindAndFindExceptionHandler,
-                                 isolate());
-  {
-    FrameScope scope(masm, StackFrame::MANUAL);
-    __ PrepareCallCFunction(3, 0, r2);
-    __ LoadImmP(r2, Operand::Zero());
-    __ LoadImmP(r3, Operand::Zero());
-    __ mov(r4, Operand(ExternalReference::isolate_address(isolate())));
-    __ CallCFunction(find_handler, 3);
-  }
-
-  // Retrieve the handler context, SP and FP.
-  __ mov(cp, Operand(pending_handler_context_address));
-  __ LoadP(cp, MemOperand(cp));
-  __ mov(sp, Operand(pending_handler_sp_address));
-  __ LoadP(sp, MemOperand(sp));
-  __ mov(fp, Operand(pending_handler_fp_address));
-  __ LoadP(fp, MemOperand(fp));
-
-  // If the handler is a JS frame, restore the context to the frame. Note that
-  // the context will be set to (cp == 0) for non-JS frames.
-  Label skip;
-  __ CmpP(cp, Operand::Zero());
-  __ beq(&skip, Label::kNear);
-  __ StoreP(cp, MemOperand(fp, StandardFrameConstants::kContextOffset));
-  __ bind(&skip);
-
-  // Reset the masking register.
-  if (FLAG_branch_load_poisoning) {
-    __ ResetSpeculationPoisonRegister();
-  }
-
-  // Compute the handler entry address and jump to it.
-  __ mov(r3, Operand(pending_handler_entrypoint_address));
-  __ LoadP(r3, MemOperand(r3));
-  __ Jump(r3);
-}
-
 void JSEntryStub::Generate(MacroAssembler* masm) {
   // r2: code entry
   // r3: function
@@ -442,75 +35,79 @@ void JSEntryStub::Generate(MacroAssembler* masm) {
 
   Label invoke, handler_entry, exit;
 
-  ProfileEntryHookStub::MaybeCallEntryHook(masm);
+  {
+    NoRootArrayScope no_root_array(masm);
+    ProfileEntryHookStub::MaybeCallEntryHook(masm);
 
 // saving floating point registers
 #if V8_TARGET_ARCH_S390X
-  // 64bit ABI requires f8 to f15 be saved
-  __ lay(sp, MemOperand(sp, -8 * kDoubleSize));
-  __ std(d8, MemOperand(sp));
-  __ std(d9, MemOperand(sp, 1 * kDoubleSize));
-  __ std(d10, MemOperand(sp, 2 * kDoubleSize));
-  __ std(d11, MemOperand(sp, 3 * kDoubleSize));
-  __ std(d12, MemOperand(sp, 4 * kDoubleSize));
-  __ std(d13, MemOperand(sp, 5 * kDoubleSize));
-  __ std(d14, MemOperand(sp, 6 * kDoubleSize));
-  __ std(d15, MemOperand(sp, 7 * kDoubleSize));
+    // 64bit ABI requires f8 to f15 be saved
+    __ lay(sp, MemOperand(sp, -8 * kDoubleSize));
+    __ std(d8, MemOperand(sp));
+    __ std(d9, MemOperand(sp, 1 * kDoubleSize));
+    __ std(d10, MemOperand(sp, 2 * kDoubleSize));
+    __ std(d11, MemOperand(sp, 3 * kDoubleSize));
+    __ std(d12, MemOperand(sp, 4 * kDoubleSize));
+    __ std(d13, MemOperand(sp, 5 * kDoubleSize));
+    __ std(d14, MemOperand(sp, 6 * kDoubleSize));
+    __ std(d15, MemOperand(sp, 7 * kDoubleSize));
 #else
-  // 31bit ABI requires you to store f4 and f6:
-  // http://refspecs.linuxbase.org/ELF/zSeries/lzsabi0_s390.html#AEN417
-  __ lay(sp, MemOperand(sp, -2 * kDoubleSize));
-  __ std(d4, MemOperand(sp));
-  __ std(d6, MemOperand(sp, kDoubleSize));
+    // 31bit ABI requires you to store f4 and f6:
+    // http://refspecs.linuxbase.org/ELF/zSeries/lzsabi0_s390.html#AEN417
+    __ lay(sp, MemOperand(sp, -2 * kDoubleSize));
+    __ std(d4, MemOperand(sp));
+    __ std(d6, MemOperand(sp, kDoubleSize));
 #endif
 
-  // zLinux ABI
-  //    Incoming parameters:
-  //          r2: code entry
-  //          r3: function
-  //          r4: receiver
-  //          r5: argc
-  //          r6: argv
-  //    Requires us to save the callee-preserved registers r6-r13
-  //    General convention is to also save r14 (return addr) and
-  //    sp/r15 as well in a single STM/STMG
-  __ lay(sp, MemOperand(sp, -10 * kPointerSize));
-  __ StoreMultipleP(r6, sp, MemOperand(sp, 0));
-
-  // Set up the reserved register for 0.0.
-  // __ LoadDoubleLiteral(kDoubleRegZero, 0.0, r0);
-
-  // Push a frame with special values setup to mark it as an entry frame.
-  //   Bad FP (-1)
-  //   SMI Marker
-  //   SMI Marker
-  //   kCEntryFPAddress
-  //   Frame type
-  __ lay(sp, MemOperand(sp, -5 * kPointerSize));
-
-  // Push a bad frame pointer to fail if it is used.
-  __ LoadImmP(r10, Operand(-1));
-
-  StackFrame::Type marker = type();
-  __ Load(r9, Operand(StackFrame::TypeToMarker(marker)));
-  __ Load(r8, Operand(StackFrame::TypeToMarker(marker)));
-  // Save copies of the top frame descriptor on the stack.
-  __ mov(r7, Operand(ExternalReference(IsolateAddressId::kCEntryFPAddress,
-                                       isolate())));
-  __ LoadP(r7, MemOperand(r7));
-  __ StoreMultipleP(r7, r10, MemOperand(sp, kPointerSize));
-  // Set up frame pointer for the frame to be pushed.
-  // Need to add kPointerSize, because sp has one extra
-  // frame already for the frame type being pushed later.
-  __ lay(fp,
-         MemOperand(sp, -EntryFrameConstants::kCallerFPOffset + kPointerSize));
-
-  __ InitializeRootRegister();
+    // zLinux ABI
+    //    Incoming parameters:
+    //          r2: code entry
+    //          r3: function
+    //          r4: receiver
+    //          r5: argc
+    //          r6: argv
+    //    Requires us to save the callee-preserved registers r6-r13
+    //    General convention is to also save r14 (return addr) and
+    //    sp/r15 as well in a single STM/STMG
+    __ lay(sp, MemOperand(sp, -10 * kPointerSize));
+    __ StoreMultipleP(r6, sp, MemOperand(sp, 0));
+
+    // Set up the reserved register for 0.0.
+    // __ LoadDoubleLiteral(kDoubleRegZero, 0.0, r0);
+
+    // Push a frame with special values setup to mark it as an entry frame.
+    //   Bad FP (-1)
+    //   SMI Marker
+    //   SMI Marker
+    //   kCEntryFPAddress
+    //   Frame type
+    __ lay(sp, MemOperand(sp, -5 * kPointerSize));
+
+    // Push a bad frame pointer to fail if it is used.
+    __ LoadImmP(r10, Operand(-1));
+
+    StackFrame::Type marker = type();
+    __ Load(r9, Operand(StackFrame::TypeToMarker(marker)));
+    __ Load(r8, Operand(StackFrame::TypeToMarker(marker)));
+    // Save copies of the top frame descriptor on the stack.
+    __ mov(r7, Operand(ExternalReference::Create(
+                   IsolateAddressId::kCEntryFPAddress, isolate())));
+    __ LoadP(r7, MemOperand(r7));
+    __ StoreMultipleP(r7, r10, MemOperand(sp, kPointerSize));
+    // Set up frame pointer for the frame to be pushed.
+    // Need to add kPointerSize, because sp has one extra
+    // frame already for the frame type being pushed later.
+    __ lay(fp, MemOperand(
+                   sp, -EntryFrameConstants::kCallerFPOffset + kPointerSize));
+
+    __ InitializeRootRegister();
+  }
 
   // If this is the outermost JS call, set js_entry_sp value.
   Label non_outermost_js;
-  ExternalReference js_entry_sp(IsolateAddressId::kJSEntrySPAddress, isolate());
-  __ mov(r7, Operand(ExternalReference(js_entry_sp)));
+  ExternalReference js_entry_sp =
+      ExternalReference::Create(IsolateAddressId::kJSEntrySPAddress, isolate());
+  __ mov(r7, Operand(js_entry_sp));
   __ LoadAndTestP(r8, MemOperand(r7));
   __ bne(&non_outermost_js, Label::kNear);
   __ StoreP(fp, MemOperand(r7));
@@ -533,7 +130,7 @@ void JSEntryStub::Generate(MacroAssembler* masm) {
   // field in the JSEnv and return a failure sentinel.  Coming in here the
   // fp will be invalid because the PushStackHandler below sets it to 0 to
   // signal the existence of the JSEntry frame.
-  __ mov(ip, Operand(ExternalReference(
+  __ mov(ip, Operand(ExternalReference::Create(
                  IsolateAddressId::kPendingExceptionAddress, isolate())));
 
   __ StoreP(r2, MemOperand(ip));
@@ -571,14 +168,14 @@ void JSEntryStub::Generate(MacroAssembler* masm) {
   __ CmpP(r7, Operand(StackFrame::OUTERMOST_JSENTRY_FRAME));
   __ bne(&non_outermost_js_2, Label::kNear);
   __ mov(r8, Operand::Zero());
-  __ mov(r7, Operand(ExternalReference(js_entry_sp)));
+  __ mov(r7, Operand(js_entry_sp));
   __ StoreP(r8, MemOperand(r7));
   __ bind(&non_outermost_js_2);
 
   // Restore the top frame descriptors from the stack.
   __ pop(r5);
-  __ mov(ip, Operand(ExternalReference(IsolateAddressId::kCEntryFPAddress,
-                                       isolate())));
+  __ mov(ip, Operand(ExternalReference::Create(
+                 IsolateAddressId::kCEntryFPAddress, isolate())));
   __ StoreP(r5, MemOperand(ip));
 
   // Reset the stack to the callee saved registers.
@@ -619,6 +216,18 @@ void DirectCEntryStub::Generate(MacroAssembler* masm) {
 }
 
 void DirectCEntryStub::GenerateCall(MacroAssembler* masm, Register target) {
+  if (FLAG_embedded_builtins) {
+    if (masm->root_array_available() &&
+        isolate()->ShouldLoadConstantsFromRootList()) {
+      // This is basically an inlined version of Call(Handle<Code>) that loads
+      // the code object into lr instead of ip.
+      __ Move(ip, target);
+      __ IndirectLoadConstant(r1, GetCode());
+      __ AddP(r1, r1, Operand(Code::kHeaderSize - kHeapObjectTag));
+      __ Call(r1);
+      return;
+    }
+  }
 #if ABI_USES_FUNCTION_DESCRIPTORS && !defined(USE_SIMULATOR)
   // Native AIX/S390X Linux use a function descriptor.
   __ LoadP(ToRegister(ABI_TOC_REGISTER), MemOperand(target, kPointerSize));
@@ -735,8 +344,8 @@ void ProfileEntryHookStub::Generate(MacroAssembler* masm) {
   __ mov(r4, Operand(ExternalReference::isolate_address(isolate())));
 
   ApiFunction dispatcher(FUNCTION_ADDR(EntryHookTrampoline));
-  __ mov(ip, Operand(ExternalReference(
-                 &dispatcher, ExternalReference::BUILTIN_CALL, isolate())));
+  __ mov(ip, Operand(ExternalReference::Create(
+                 &dispatcher, ExternalReference::BUILTIN_CALL)));
 #endif
   __ Call(ip);
 
@@ -756,268 +365,6 @@ void ProfileEntryHookStub::Generate(MacroAssembler* masm) {
   __ Ret();
 }
 
-template <class T>
-static void CreateArrayDispatch(MacroAssembler* masm,
-                                AllocationSiteOverrideMode mode) {
-  if (mode == DISABLE_ALLOCATION_SITES) {
-    T stub(masm->isolate(), GetInitialFastElementsKind(), mode);
-    __ TailCallStub(&stub);
-  } else if (mode == DONT_OVERRIDE) {
-    int last_index =
-        GetSequenceIndexFromFastElementsKind(TERMINAL_FAST_ELEMENTS_KIND);
-    for (int i = 0; i <= last_index; ++i) {
-      ElementsKind kind = GetFastElementsKindFromSequenceIndex(i);
-      __ CmpP(r5, Operand(kind));
-      T stub(masm->isolate(), kind);
-      __ TailCallStub(&stub, eq);
-    }
-
-    // If we reached this point there is a problem.
-    __ Abort(AbortReason::kUnexpectedElementsKindInArrayConstructor);
-  } else {
-    UNREACHABLE();
-  }
-}
-
-static void CreateArrayDispatchOneArgument(MacroAssembler* masm,
-                                           AllocationSiteOverrideMode mode) {
-  // r4 - allocation site (if mode != DISABLE_ALLOCATION_SITES)
-  // r5 - kind (if mode != DISABLE_ALLOCATION_SITES)
-  // r2 - number of arguments
-  // r3 - constructor?
-  // sp[0] - last argument
-  STATIC_ASSERT(PACKED_SMI_ELEMENTS == 0);
-  STATIC_ASSERT(HOLEY_SMI_ELEMENTS == 1);
-  STATIC_ASSERT(PACKED_ELEMENTS == 2);
-  STATIC_ASSERT(HOLEY_ELEMENTS == 3);
-  STATIC_ASSERT(PACKED_DOUBLE_ELEMENTS == 4);
-  STATIC_ASSERT(HOLEY_DOUBLE_ELEMENTS == 5);
-
-  if (mode == DISABLE_ALLOCATION_SITES) {
-    ElementsKind initial = GetInitialFastElementsKind();
-    ElementsKind holey_initial = GetHoleyElementsKind(initial);
-
-    ArraySingleArgumentConstructorStub stub_holey(
-        masm->isolate(), holey_initial, DISABLE_ALLOCATION_SITES);
-    __ TailCallStub(&stub_holey);
-  } else if (mode == DONT_OVERRIDE) {
-    Label normal_sequence;
-    // is the low bit set? If so, we are holey and that is good.
-    __ AndP(r0, r5, Operand(1));
-    __ bne(&normal_sequence);
-
-    // We are going to create a holey array, but our kind is non-holey.
-    // Fix kind and retry (only if we have an allocation site in the slot).
-    __ AddP(r5, r5, Operand(1));
-    if (FLAG_debug_code) {
-      __ LoadP(r7, FieldMemOperand(r4, 0));
-      __ CompareRoot(r7, Heap::kAllocationSiteMapRootIndex);
-      __ Assert(eq, AbortReason::kExpectedAllocationSite);
-    }
-
-    // Save the resulting elements kind in type info. We can't just store r5
-    // in the AllocationSite::transition_info field because elements kind is
-    // restricted to a portion of the field...upper bits need to be left alone.
-    STATIC_ASSERT(AllocationSite::ElementsKindBits::kShift == 0);
-    __ LoadP(r6, FieldMemOperand(
-                     r4, AllocationSite::kTransitionInfoOrBoilerplateOffset));
-    __ AddSmiLiteral(r6, r6, Smi::FromInt(kFastElementsKindPackedToHoley), r0);
-    __ StoreP(r6, FieldMemOperand(
-                      r4, AllocationSite::kTransitionInfoOrBoilerplateOffset));
-
-    __ bind(&normal_sequence);
-    int last_index =
-        GetSequenceIndexFromFastElementsKind(TERMINAL_FAST_ELEMENTS_KIND);
-    for (int i = 0; i <= last_index; ++i) {
-      ElementsKind kind = GetFastElementsKindFromSequenceIndex(i);
-      __ CmpP(r5, Operand(kind));
-      ArraySingleArgumentConstructorStub stub(masm->isolate(), kind);
-      __ TailCallStub(&stub, eq);
-    }
-
-    // If we reached this point there is a problem.
-    __ Abort(AbortReason::kUnexpectedElementsKindInArrayConstructor);
-  } else {
-    UNREACHABLE();
-  }
-}
-
-template <class T>
-static void ArrayConstructorStubAheadOfTimeHelper(Isolate* isolate) {
-  int to_index =
-      GetSequenceIndexFromFastElementsKind(TERMINAL_FAST_ELEMENTS_KIND);
-  for (int i = 0; i <= to_index; ++i) {
-    ElementsKind kind = GetFastElementsKindFromSequenceIndex(i);
-    T stub(isolate, kind);
-    stub.GetCode();
-    if (AllocationSite::ShouldTrack(kind)) {
-      T stub1(isolate, kind, DISABLE_ALLOCATION_SITES);
-      stub1.GetCode();
-    }
-  }
-}
-
-void CommonArrayConstructorStub::GenerateStubsAheadOfTime(Isolate* isolate) {
-  ArrayConstructorStubAheadOfTimeHelper<ArrayNoArgumentConstructorStub>(
-      isolate);
-  ArrayNArgumentsConstructorStub stub(isolate);
-  stub.GetCode();
-  ElementsKind kinds[2] = {PACKED_ELEMENTS, HOLEY_ELEMENTS};
-  for (int i = 0; i < 2; i++) {
-    // For internal arrays we only need a few things
-    InternalArrayNoArgumentConstructorStub stubh1(isolate, kinds[i]);
-    stubh1.GetCode();
-    InternalArraySingleArgumentConstructorStub stubh2(isolate, kinds[i]);
-    stubh2.GetCode();
-  }
-}
-
-void ArrayConstructorStub::GenerateDispatchToArrayStub(
-    MacroAssembler* masm, AllocationSiteOverrideMode mode) {
-  Label not_zero_case, not_one_case;
-  __ CmpP(r2, Operand::Zero());
-  __ bne(&not_zero_case);
-  CreateArrayDispatch<ArrayNoArgumentConstructorStub>(masm, mode);
-
-  __ bind(&not_zero_case);
-  __ CmpP(r2, Operand(1));
-  __ bgt(&not_one_case);
-  CreateArrayDispatchOneArgument(masm, mode);
-
-  __ bind(&not_one_case);
-  ArrayNArgumentsConstructorStub stub(masm->isolate());
-  __ TailCallStub(&stub);
-}
-
-void ArrayConstructorStub::Generate(MacroAssembler* masm) {
-  // ----------- S t a t e -------------
-  //  -- r2 : argc (only if argument_count() == ANY)
-  //  -- r3 : constructor
-  //  -- r4 : AllocationSite or undefined
-  //  -- r5 : new target
-  //  -- sp[0] : return address
-  //  -- sp[4] : last argument
-  // -----------------------------------
-
-  if (FLAG_debug_code) {
-    // The array construct code is only set for the global and natives
-    // builtin Array functions which always have maps.
-
-    // Initial map for the builtin Array function should be a map.
-    __ LoadP(r6, FieldMemOperand(r3, JSFunction::kPrototypeOrInitialMapOffset));
-    // Will both indicate a nullptr and a Smi.
-    __ TestIfSmi(r6);
-    __ Assert(ne, AbortReason::kUnexpectedInitialMapForArrayFunction, cr0);
-    __ CompareObjectType(r6, r6, r7, MAP_TYPE);
-    __ Assert(eq, AbortReason::kUnexpectedInitialMapForArrayFunction);
-
-    // We should either have undefined in r4 or a valid AllocationSite
-    __ AssertUndefinedOrAllocationSite(r4, r6);
-  }
-
-  // Enter the context of the Array function.
-  __ LoadP(cp, FieldMemOperand(r3, JSFunction::kContextOffset));
-
-  Label subclassing;
-  __ CmpP(r5, r3);
-  __ bne(&subclassing, Label::kNear);
-
-  Label no_info;
-  // Get the elements kind and case on that.
-  __ CompareRoot(r4, Heap::kUndefinedValueRootIndex);
-  __ beq(&no_info);
-
-  __ LoadP(r5, FieldMemOperand(
-                   r4, AllocationSite::kTransitionInfoOrBoilerplateOffset));
-  __ SmiUntag(r5);
-  STATIC_ASSERT(AllocationSite::ElementsKindBits::kShift == 0);
-  __ AndP(r5, Operand(AllocationSite::ElementsKindBits::kMask));
-  GenerateDispatchToArrayStub(masm, DONT_OVERRIDE);
-
-  __ bind(&no_info);
-  GenerateDispatchToArrayStub(masm, DISABLE_ALLOCATION_SITES);
-
-  __ bind(&subclassing);
-  __ ShiftLeftP(r1, r2, Operand(kPointerSizeLog2));
-  __ StoreP(r3, MemOperand(sp, r1));
-  __ AddP(r2, r2, Operand(3));
-  __ Push(r5, r4);
-  __ JumpToExternalReference(ExternalReference(Runtime::kNewArray, isolate()));
-}
-
-void InternalArrayConstructorStub::GenerateCase(MacroAssembler* masm,
-                                                ElementsKind kind) {
-  __ CmpLogicalP(r2, Operand(1));
-
-  InternalArrayNoArgumentConstructorStub stub0(isolate(), kind);
-  __ TailCallStub(&stub0, lt);
-
-  ArrayNArgumentsConstructorStub stubN(isolate());
-  __ TailCallStub(&stubN, gt);
-
-  if (IsFastPackedElementsKind(kind)) {
-    // We might need to create a holey array
-    // look at the first argument
-    __ LoadP(r5, MemOperand(sp, 0));
-    __ CmpP(r5, Operand::Zero());
-
-    InternalArraySingleArgumentConstructorStub stub1_holey(
-        isolate(), GetHoleyElementsKind(kind));
-    __ TailCallStub(&stub1_holey, ne);
-  }
-
-  InternalArraySingleArgumentConstructorStub stub1(isolate(), kind);
-  __ TailCallStub(&stub1);
-}
-
-void InternalArrayConstructorStub::Generate(MacroAssembler* masm) {
-  // ----------- S t a t e -------------
-  //  -- r2 : argc
-  //  -- r3 : constructor
-  //  -- sp[0] : return address
-  //  -- sp[4] : last argument
-  // -----------------------------------
-
-  if (FLAG_debug_code) {
-    // The array construct code is only set for the global and natives
-    // builtin Array functions which always have maps.
-
-    // Initial map for the builtin Array function should be a map.
-    __ LoadP(r5, FieldMemOperand(r3, JSFunction::kPrototypeOrInitialMapOffset));
-    // Will both indicate a nullptr and a Smi.
-    __ TestIfSmi(r5);
-    __ Assert(ne, AbortReason::kUnexpectedInitialMapForArrayFunction, cr0);
-    __ CompareObjectType(r5, r5, r6, MAP_TYPE);
-    __ Assert(eq, AbortReason::kUnexpectedInitialMapForArrayFunction);
-  }
-
-  // Figure out the right elements kind
-  __ LoadP(r5, FieldMemOperand(r3, JSFunction::kPrototypeOrInitialMapOffset));
-  // Load the map's "bit field 2" into |result|.
-  __ LoadlB(r5, FieldMemOperand(r5, Map::kBitField2Offset));
-  // Retrieve elements_kind from bit field 2.
-  __ DecodeField<Map::ElementsKindBits>(r5);
-
-  if (FLAG_debug_code) {
-    Label done;
-    __ CmpP(r5, Operand(PACKED_ELEMENTS));
-    __ beq(&done);
-    __ CmpP(r5, Operand(HOLEY_ELEMENTS));
-    __ Assert(
-        eq,
-        AbortReason::kInvalidElementsKindForInternalArrayOrInternalPackedArray);
-    __ bind(&done);
-  }
-
-  Label fast_elements_case;
-  __ CmpP(r5, Operand(PACKED_ELEMENTS));
-  __ beq(&fast_elements_case);
-  GenerateCase(masm, HOLEY_ELEMENTS);
-
-  __ bind(&fast_elements_case);
-  GenerateCase(masm, PACKED_ELEMENTS);
-}
-
 static int AddressOffset(ExternalReference ref0, ExternalReference ref1) {
   return ref0.address() - ref1.address();
 }
@@ -1045,14 +392,14 @@ static void CallApiFunctionAndReturn(MacroAssembler* masm,
   DCHECK(function_address == r3 || function_address == r4);
   Register scratch = r5;
 
-  __ mov(scratch, Operand(ExternalReference::is_profiling_address(isolate)));
+  __ Move(scratch, ExternalReference::is_profiling_address(isolate));
   __ LoadlB(scratch, MemOperand(scratch, 0));
   __ CmpP(scratch, Operand::Zero());
 
   Label profiler_disabled;
   Label end_profiler_check;
   __ beq(&profiler_disabled, Label::kNear);
-  __ mov(scratch, Operand(thunk_ref));
+  __ Move(scratch, thunk_ref);
   __ b(&end_profiler_check, Label::kNear);
   __ bind(&profiler_disabled);
   __ LoadRR(scratch, function_address);
@@ -1063,7 +410,7 @@ static void CallApiFunctionAndReturn(MacroAssembler* masm,
   // r6 - next_address->kNextOffset
   // r7 - next_address->kLimitOffset
   // r8 - next_address->kLevelOffset
-  __ mov(r9, Operand(next_address));
+  __ Move(r9, next_address);
   __ LoadP(r6, MemOperand(r9, kNextOffset));
   __ LoadP(r7, MemOperand(r9, kLimitOffset));
   __ LoadlW(r8, MemOperand(r9, kLevelOffset));
@@ -1074,9 +421,8 @@ static void CallApiFunctionAndReturn(MacroAssembler* masm,
     FrameScope frame(masm, StackFrame::MANUAL);
     __ PushSafepointRegisters();
     __ PrepareCallCFunction(1, r2);
-    __ mov(r2, Operand(ExternalReference::isolate_address(isolate)));
-    __ CallCFunction(ExternalReference::log_enter_external_function(isolate),
-                     1);
+    __ Move(r2, ExternalReference::isolate_address(isolate));
+    __ CallCFunction(ExternalReference::log_enter_external_function(), 1);
     __ PopSafepointRegisters();
   }
 
@@ -1090,9 +436,8 @@ static void CallApiFunctionAndReturn(MacroAssembler* masm,
     FrameScope frame(masm, StackFrame::MANUAL);
     __ PushSafepointRegisters();
     __ PrepareCallCFunction(1, r2);
-    __ mov(r2, Operand(ExternalReference::isolate_address(isolate)));
-    __ CallCFunction(ExternalReference::log_leave_external_function(isolate),
-                     1);
+    __ Move(r2, ExternalReference::isolate_address(isolate));
+    __ CallCFunction(ExternalReference::log_leave_external_function(), 1);
     __ PopSafepointRegisters();
   }
 
@@ -1128,7 +473,7 @@ static void CallApiFunctionAndReturn(MacroAssembler* masm,
   __ LeaveExitFrame(false, r6, stack_space_operand != nullptr);
 
   // Check if the function scheduled an exception.
-  __ mov(r7, Operand(ExternalReference::scheduled_exception_address(isolate)));
+  __ Move(r7, ExternalReference::scheduled_exception_address(isolate));
   __ LoadP(r7, MemOperand(r7));
   __ CompareRoot(r7, Heap::kTheHoleValueRootIndex);
   __ bne(&promote_scheduled_exception, Label::kNear);
@@ -1144,9 +489,8 @@ static void CallApiFunctionAndReturn(MacroAssembler* masm,
   __ StoreP(r7, MemOperand(r9, kLimitOffset));
   __ LoadRR(r6, r2);
   __ PrepareCallCFunction(1, r7);
-  __ mov(r2, Operand(ExternalReference::isolate_address(isolate)));
-  __ CallCFunction(ExternalReference::delete_handle_scope_extensions(isolate),
-                   1);
+  __ Move(r2, ExternalReference::isolate_address(isolate));
+  __ CallCFunction(ExternalReference::delete_handle_scope_extensions(), 1);
   __ LoadRR(r2, r6);
   __ b(&leave_exit_frame, Label::kNear);
 }
@@ -1191,7 +535,7 @@ void CallApiCallbackStub::Generate(MacroAssembler* masm) {
   // return value default
   __ push(scratch);
   // isolate
-  __ mov(scratch, Operand(ExternalReference::isolate_address(masm->isolate())));
+  __ Move(scratch, ExternalReference::isolate_address(masm->isolate()));
   __ push(scratch);
   // holder
   __ push(holder);
@@ -1226,8 +570,7 @@ void CallApiCallbackStub::Generate(MacroAssembler* masm) {
   __ LoadImmP(ip, Operand(argc()));
   __ StoreW(ip, MemOperand(r2, 2 * kPointerSize));
 
-  ExternalReference thunk_ref =
-      ExternalReference::invoke_function_callback(masm->isolate());
+  ExternalReference thunk_ref = ExternalReference::invoke_function_callback();
 
   AllowExternalCallThatCantCauseGC scope(masm);
   // Stores return the first js argument
@@ -1268,7 +611,7 @@ void CallApiGetterStub::Generate(MacroAssembler* masm) {
   __ push(scratch);
   __ LoadRoot(scratch, Heap::kUndefinedValueRootIndex);
   __ Push(scratch, scratch);
-  __ mov(scratch, Operand(ExternalReference::isolate_address(isolate())));
+  __ Move(scratch, ExternalReference::isolate_address(isolate()));
   __ Push(scratch, holder);
   __ Push(Smi::kZero);  // should_throw_on_error -> false
   __ LoadP(scratch, FieldMemOperand(callback, AccessorInfo::kNameOffset));
@@ -1318,7 +661,7 @@ void CallApiGetterStub::Generate(MacroAssembler* masm) {
   // r3 = v8::PropertyCallbackInfo&
 
   ExternalReference thunk_ref =
-      ExternalReference::invoke_accessor_getter_callback(isolate());
+      ExternalReference::invoke_accessor_getter_callback();
 
   __ LoadP(scratch, FieldMemOperand(callback, AccessorInfo::kJsGetterOffset));
   __ LoadP(api_function_address,
diff --git a/deps/v8/src/s390/constants-s390.h b/deps/v8/src/s390/constants-s390.h
index dee21b28ef0f0c..a9aa304cb1d588 100644
--- a/deps/v8/src/s390/constants-s390.h
+++ b/deps/v8/src/s390/constants-s390.h
@@ -29,6 +29,9 @@
 namespace v8 {
 namespace internal {
 
+// TODO(sigurds): Change this value once we use relative jumps.
+constexpr size_t kMaxPCRelativeCodeRangeInMB = 0;
+
 // Number of registers
 const int kNumRegisters = 16;
 
@@ -37,6 +40,11 @@ const int kNumDoubleRegisters = 16;
 
 const int kNoRegister = -1;
 
+// Actual value of root register is offset from the root array's start
+// to take advantage of negative displacement values.
+// TODO(sigurds): Choose best value.
+constexpr int kRootRegisterBias = 128;
+
 // sign-extend the least significant 16-bits of value <imm>
 #define SIGN_EXT_IMM16(imm) ((static_cast<int>(imm) << 16) >> 16)
 
@@ -686,7 +694,11 @@ typedef uint64_t SixByteInstr;
     0xEDAD) /* type = RSL_B CONVERT TO PACKED (from extended DFP)  */         \
   V(cdpt, CDPT, 0xEDAE) /* type = RSL_B CONVERT FROM PACKED (to long DFP)  */ \
   V(cxpt, CXPT,                                                               \
-    0xEDAF) /* type = RSL_B CONVERT FROM PACKED (to extended DFP)  */
+    0xEDAF) /* type = RSL_B CONVERT FROM PACKED (to extended DFP)  */         \
+  V(czdt, CZDT, 0xEDA8) /* type = RSL CONVERT TO ZONED (from long DFP)  */    \
+  V(czxt, CZXT, 0xEDA9) /* type = RSL CONVERT TO ZONED (from extended DFP) */ \
+  V(cdzt, CDZT, 0xEDAA) /* type = RSL CONVERT FROM ZONED (to long DFP)  */    \
+  V(cxzt, CXZT, 0xEDAB) /* type = RSL CONVERT FROM ZONED (to extended DFP) */
 
 #define S390_SI_OPCODE_LIST(V)                                          \
   V(tm, TM, 0x91)       /* type = SI    TEST UNDER MASK  */             \
@@ -856,12 +868,6 @@ typedef uint64_t SixByteInstr;
 #define S390_RI_C_OPCODE_LIST(V) \
   V(brc, BRC, 0xA74) /* type = RI_C BRANCH RELATIVE ON CONDITION  */
 
-#define S390_RSL_OPCODE_LIST(V)                                                \
-  V(czdt, CZDT, 0xEDA8) /* type = RSL CONVERT TO ZONED (from long DFP)  */     \
-  V(czxt, CZXT, 0xEDA9) /* type = RSL CONVERT TO ZONED (from extended DFP)  */ \
-  V(cdzt, CDZT, 0xEDAA) /* type = RSL CONVERT FROM ZONED (to long DFP)  */     \
-  V(cxzt, CXZT, 0xEDAB) /* type = RSL CONVERT FROM ZONED (to extended DFP) */
-
 #define S390_SMI_OPCODE_LIST(V) \
   V(bpp, BPP, 0xC7) /* type = SMI   BRANCH PREDICTION PRELOAD  */
 
@@ -1096,7 +1102,6 @@ typedef uint64_t SixByteInstr;
   V(icm, ICM, 0xBF)   /* type = RS_B  INSERT CHARACTERS UNDER MASK (low)  */
 
 #define S390_S_OPCODE_LIST(V)                                                  \
-  V(awr, AWR, 0x2E)           /* type = S     ADD UNNORMALIZED (long HFP)  */  \
   V(lpsw, LPSW, 0x82)         /* type = S     LOAD PSW  */                     \
   V(diagnose, DIAGNOSE, 0x83) /* type = S     DIAGNOSE  */                     \
   V(ts, TS, 0x93)             /* type = S     TEST AND SET  */                 \
@@ -1541,6 +1546,7 @@ typedef uint64_t SixByteInstr;
     0xEC45) /* type = RIE_E BRANCH RELATIVE ON INDEX LOW OR EQ. (64)  */
 
 #define S390_RR_OPCODE_LIST(V)                                                 \
+  V(awr, AWR, 0x2E)     /* type = RR    ADD UNNORMALIZED (long HFP)  */        \
   V(spm, SPM, 0x04)     /* type = RR    SET PROGRAM MASK  */                   \
   V(balr, BALR, 0x05)   /* type = RR    BRANCH AND LINK  */                    \
   V(bctr, BCTR, 0x06)   /* type = RR    BRANCH ON COUNT (32)  */               \
@@ -1684,7 +1690,6 @@ typedef uint64_t SixByteInstr;
   S390_RSI_OPCODE_LIST(V)   \
   S390_RI_B_OPCODE_LIST(V)  \
   S390_RI_C_OPCODE_LIST(V)  \
-  S390_RSL_OPCODE_LIST(V)   \
   S390_SMI_OPCODE_LIST(V)   \
   S390_RXY_A_OPCODE_LIST(V) \
   S390_RXY_B_OPCODE_LIST(V) \
@@ -2234,6 +2239,17 @@ class RSInstruction : Instruction {
   inline int size() const { return 4; }
 };
 
+// RSI Instruction
+class RSIInstruction : Instruction {
+ public:
+  inline int R1Value() const { return Bits<FourByteInstr, int>(23, 20); }
+  inline int R3Value() const { return Bits<FourByteInstr, int>(19, 16); }
+  inline int I2Value() const {
+    return static_cast<int32_t>(Bits<FourByteInstr, int16_t>(15, 0));
+  }
+  inline int size() const { return 4; }
+};
+
 // RSY Instruction
 class RSYInstruction : Instruction {
  public:
diff --git a/deps/v8/src/s390/deoptimizer-s390.cc b/deps/v8/src/s390/deoptimizer-s390.cc
index 291d9d5a227db7..d2ae1ded27ee6f 100644
--- a/deps/v8/src/s390/deoptimizer-s390.cc
+++ b/deps/v8/src/s390/deoptimizer-s390.cc
@@ -50,8 +50,8 @@ void Deoptimizer::TableEntryGenerator::Generate() {
   __ lay(sp, MemOperand(sp, -kNumberOfRegisters * kPointerSize));
   __ StoreMultipleP(r0, sp, MemOperand(sp));  // Save all 16 registers
 
-  __ mov(ip, Operand(ExternalReference(IsolateAddressId::kCEntryFPAddress,
-                                       isolate())));
+  __ mov(ip, Operand(ExternalReference::Create(
+                 IsolateAddressId::kCEntryFPAddress, isolate())));
   __ StoreP(fp, MemOperand(ip));
 
   const int kSavedRegistersAreaSize =
@@ -79,7 +79,7 @@ void Deoptimizer::TableEntryGenerator::Generate() {
   __ JumpIfSmi(r3, &context_check);
   __ LoadP(r2, MemOperand(fp, JavaScriptFrameConstants::kFunctionOffset));
   __ bind(&context_check);
-  __ LoadImmP(r3, Operand(type()));  // bailout type,
+  __ LoadImmP(r3, Operand(static_cast<int>(deopt_kind())));
   // r4: bailout id already loaded.
   // r5: code address or 0 already loaded.
   // r6: Fp-to-sp delta.
@@ -90,7 +90,7 @@ void Deoptimizer::TableEntryGenerator::Generate() {
   // Call Deoptimizer::New().
   {
     AllowExternalCallThatCantCauseGC scope(masm());
-    __ CallCFunction(ExternalReference::new_deoptimizer_function(isolate()), 6);
+    __ CallCFunction(ExternalReference::new_deoptimizer_function(), 6);
   }
 
   // Preserve "deoptimizer" object in register r2 and get the input
@@ -164,8 +164,7 @@ void Deoptimizer::TableEntryGenerator::Generate() {
   // Call Deoptimizer::ComputeOutputFrames().
   {
     AllowExternalCallThatCantCauseGC scope(masm());
-    __ CallCFunction(
-        ExternalReference::compute_output_frames_function(isolate()), 1);
+    __ CallCFunction(ExternalReference::compute_output_frames_function(), 1);
   }
   __ pop(r2);  // Restore deoptimizer object (class Deoptimizer).
 
diff --git a/deps/v8/src/s390/disasm-s390.cc b/deps/v8/src/s390/disasm-s390.cc
index 66d77d12504756..a26eef69e29554 100644
--- a/deps/v8/src/s390/disasm-s390.cc
+++ b/deps/v8/src/s390/disasm-s390.cc
@@ -848,10 +848,10 @@ bool Decoder::DecodeFourByte(Instruction* instr) {
       Format(instr, "llghr\t'r5,'r6");
       break;
     case LOCR:
-      Format(instr, "locr\t'm1,'r5,'r6");
+      Format(instr, "locr\t'r5,'r6,'m2");
       break;
     case LOCGR:
-      Format(instr, "locgr\t'm1,'r5,'r6");
+      Format(instr, "locgr\t'r5,'r6,'m2");
       break;
     case LNGR:
       Format(instr, "lngr\t'r5,'r6");
@@ -1069,6 +1069,9 @@ bool Decoder::DecodeFourByte(Instruction* instr) {
     case LPGFR:
       Format(instr, "lpgfr\t'r5,'r6");
       break;
+    case BRXH:
+      Format(instr, "brxh\t'r1,'r2,'i4");
+      break;
     default:
       return false;
   }
@@ -1481,6 +1484,9 @@ bool Decoder::DecodeSixByte(Instruction* instr) {
     case PFD:
       Format(instr, "pfd\t'm1,'d2('r2d,'r3)");
       break;
+    case BRXHG:
+      Format(instr, "brxhg\t'r1,'r2,'i4");
+      break;
     default:
       return false;
   }
diff --git a/deps/v8/src/s390/frame-constants-s390.h b/deps/v8/src/s390/frame-constants-s390.h
index f1c9febbb1b9f0..0d89ceedb3bc89 100644
--- a/deps/v8/src/s390/frame-constants-s390.h
+++ b/deps/v8/src/s390/frame-constants-s390.h
@@ -5,6 +5,9 @@
 #ifndef V8_S390_FRAME_CONSTANTS_S390_H_
 #define V8_S390_FRAME_CONSTANTS_S390_H_
 
+#include "src/base/macros.h"
+#include "src/frame-constants.h"
+
 namespace v8 {
 namespace internal {
 
@@ -30,6 +33,23 @@ class ExitFrameConstants : public TypedFrameConstants {
   static constexpr int kCallerSPDisplacement = 2 * kPointerSize;
 };
 
+class WasmCompileLazyFrameConstants : public TypedFrameConstants {
+ public:
+  static constexpr int kNumberOfSavedGpParamRegs = 5;
+#ifdef V8_TARGET_ARCH_S390X
+  static constexpr int kNumberOfSavedFpParamRegs = 4;
+#else
+  static constexpr int kNumberOfSavedFpParamRegs = 2;
+#endif
+
+  // FP-relative.
+  static constexpr int kWasmInstanceOffset = TYPED_FRAME_PUSHED_VALUE_OFFSET(0);
+  static constexpr int kFixedFrameSizeFromFp =
+      TypedFrameConstants::kFixedFrameSizeFromFp +
+      kNumberOfSavedGpParamRegs * kPointerSize +
+      kNumberOfSavedFpParamRegs * kDoubleSize;
+};
+
 class JavaScriptFrameConstants : public AllStatic {
  public:
   // FP-relative.
diff --git a/deps/v8/src/s390/interface-descriptors-s390.cc b/deps/v8/src/s390/interface-descriptors-s390.cc
index eae07393614064..c5fbebc5a0824e 100644
--- a/deps/v8/src/s390/interface-descriptors-s390.cc
+++ b/deps/v8/src/s390/interface-descriptors-s390.cc
@@ -32,7 +32,7 @@ void RecordWriteDescriptor::InitializePlatformSpecific(
   data->InitializePlatformSpecific(kParameterCount, default_stub_registers);
 }
 
-const Register FastNewFunctionContextDescriptor::FunctionRegister() {
+const Register FastNewFunctionContextDescriptor::ScopeInfoRegister() {
   return r3;
 }
 const Register FastNewFunctionContextDescriptor::SlotsRegister() { return r2; }
@@ -57,12 +57,6 @@ const Register StoreTransitionDescriptor::MapRegister() { return r7; }
 const Register ApiGetterDescriptor::HolderRegister() { return r2; }
 const Register ApiGetterDescriptor::CallbackRegister() { return r5; }
 
-const Register MathPowTaggedDescriptor::exponent() { return r4; }
-
-const Register MathPowIntegerDescriptor::exponent() {
-  return MathPowTaggedDescriptor::exponent();
-}
-
 const Register GrowArrayElementsDescriptor::ObjectRegister() { return r2; }
 const Register GrowArrayElementsDescriptor::KeyRegister() { return r5; }
 
@@ -175,22 +169,7 @@ void ConstructStubDescriptor::InitializePlatformSpecific(
   data->InitializePlatformSpecific(arraysize(registers), registers);
 }
 
-void ConstructTrampolineDescriptor::InitializePlatformSpecific(
-    CallInterfaceDescriptorData* data) {
-  // r2 : number of arguments
-  // r3 : the target to call
-  // r5 : the new target
-  Register registers[] = {r3, r5, r2};
-  data->InitializePlatformSpecific(arraysize(registers), registers);
-}
-
-void TransitionElementsKindDescriptor::InitializePlatformSpecific(
-    CallInterfaceDescriptorData* data) {
-  Register registers[] = {r2, r3};
-  data->InitializePlatformSpecific(arraysize(registers), registers);
-}
-
-void AbortJSDescriptor::InitializePlatformSpecific(
+void AbortDescriptor::InitializePlatformSpecific(
     CallInterfaceDescriptorData* data) {
   Register registers[] = {r3};
   data->InitializePlatformSpecific(arraysize(registers), registers);
@@ -198,41 +177,7 @@ void AbortJSDescriptor::InitializePlatformSpecific(
 
 void AllocateHeapNumberDescriptor::InitializePlatformSpecific(
     CallInterfaceDescriptorData* data) {
-  data->InitializePlatformSpecific(0, nullptr, nullptr);
-}
-
-void ArrayConstructorDescriptor::InitializePlatformSpecific(
-    CallInterfaceDescriptorData* data) {
-  // kTarget, kNewTarget, kActualArgumentsCount, kAllocationSite
-  Register registers[] = {r3, r5, r2, r4};
-  data->InitializePlatformSpecific(arraysize(registers), registers, nullptr);
-}
-
-void ArrayNoArgumentConstructorDescriptor::InitializePlatformSpecific(
-    CallInterfaceDescriptorData* data) {
-  // register state
-  // r2 -- number of arguments
-  // r3 -- function
-  // r4 -- allocation site with elements kind
-  Register registers[] = {r3, r4, r2};
-  data->InitializePlatformSpecific(arraysize(registers), registers);
-}
-
-void ArraySingleArgumentConstructorDescriptor::InitializePlatformSpecific(
-    CallInterfaceDescriptorData* data) {
-  // register state
-  // r2 -- number of arguments
-  // r3 -- function
-  // r4 -- allocation site with elements kind
-  Register registers[] = {r3, r4, r2};
-  data->InitializePlatformSpecific(arraysize(registers), registers, nullptr);
-}
-
-void ArrayNArgumentsConstructorDescriptor::InitializePlatformSpecific(
-    CallInterfaceDescriptorData* data) {
-  // stack param count needs (constructor pointer, and single argument)
-  Register registers[] = {r3, r4, r2};
-  data->InitializePlatformSpecific(arraysize(registers), registers);
+  data->InitializePlatformSpecific(0, nullptr);
 }
 
 void CompareDescriptor::InitializePlatformSpecific(
@@ -247,12 +192,6 @@ void BinaryOpDescriptor::InitializePlatformSpecific(
   data->InitializePlatformSpecific(arraysize(registers), registers);
 }
 
-void StringAddDescriptor::InitializePlatformSpecific(
-    CallInterfaceDescriptorData* data) {
-  Register registers[] = {r3, r2};
-  data->InitializePlatformSpecific(arraysize(registers), registers);
-}
-
 void ArgumentAdaptorDescriptor::InitializePlatformSpecific(
     CallInterfaceDescriptorData* data) {
   Register registers[] = {
@@ -305,7 +244,9 @@ void InterpreterPushArgsThenConstructDescriptor::InitializePlatformSpecific(
   data->InitializePlatformSpecific(arraysize(registers), registers);
 }
 
-void InterpreterCEntryDescriptor::InitializePlatformSpecific(
+namespace {
+
+void InterpreterCEntryDescriptor_InitializePlatformSpecific(
     CallInterfaceDescriptorData* data) {
   Register registers[] = {
       r2,  // argument count (argc)
@@ -315,6 +256,18 @@ void InterpreterCEntryDescriptor::InitializePlatformSpecific(
   data->InitializePlatformSpecific(arraysize(registers), registers);
 }
 
+}  // namespace
+
+void InterpreterCEntry1Descriptor::InitializePlatformSpecific(
+    CallInterfaceDescriptorData* data) {
+  InterpreterCEntryDescriptor_InitializePlatformSpecific(data);
+}
+
+void InterpreterCEntry2Descriptor::InitializePlatformSpecific(
+    CallInterfaceDescriptorData* data) {
+  InterpreterCEntryDescriptor_InitializePlatformSpecific(data);
+}
+
 void ResumeGeneratorDescriptor::InitializePlatformSpecific(
     CallInterfaceDescriptorData* data) {
   Register registers[] = {
diff --git a/deps/v8/src/s390/macro-assembler-s390.cc b/deps/v8/src/s390/macro-assembler-s390.cc
index ad074026e176f1..6d123e22d515e6 100644
--- a/deps/v8/src/s390/macro-assembler-s390.cc
+++ b/deps/v8/src/s390/macro-assembler-s390.cc
@@ -11,6 +11,7 @@
 #include "src/base/division-by-constant.h"
 #include "src/bootstrapper.h"
 #include "src/callable.h"
+#include "src/code-factory.h"
 #include "src/code-stubs.h"
 #include "src/debug/debug.h"
 #include "src/external-reference-table.h"
@@ -18,22 +19,25 @@
 #include "src/instruction-stream.h"
 #include "src/register-configuration.h"
 #include "src/runtime/runtime.h"
+#include "src/snapshot/snapshot.h"
 
 #include "src/s390/macro-assembler-s390.h"
 
 namespace v8 {
 namespace internal {
 
-MacroAssembler::MacroAssembler(Isolate* isolate, void* buffer, int size,
-                               CodeObjectRequired create_code_object)
-    : TurboAssembler(isolate, buffer, size, create_code_object) {}
-
-TurboAssembler::TurboAssembler(Isolate* isolate, void* buffer, int buffer_size,
-                               CodeObjectRequired create_code_object)
-    : Assembler(isolate, buffer, buffer_size), isolate_(isolate) {
+MacroAssembler::MacroAssembler(Isolate* isolate,
+                               const AssemblerOptions& options, void* buffer,
+                               int size, CodeObjectRequired create_code_object)
+    : TurboAssembler(isolate, options, buffer, size, create_code_object) {
   if (create_code_object == CodeObjectRequired::kYes) {
-    code_object_ =
-        Handle<HeapObject>::New(isolate->heap()->undefined_value(), isolate);
+    // Unlike TurboAssembler, which can be used off the main thread and may not
+    // allocate, macro assembler creates its own copy of the self-reference
+    // marker in order to disambiguate between self-references during nested
+    // code generation (e.g.: codegen of the current object triggers stub
+    // compilation through CodeStub::GetCode()).
+    code_object_ = Handle<HeapObject>::New(
+        *isolate->factory()->NewSelfReferenceMarker(), isolate);
   }
 }
 
@@ -115,7 +119,37 @@ int TurboAssembler::PopCallerSaved(SaveFPRegsMode fp_mode, Register exclusion1,
   return bytes;
 }
 
-void TurboAssembler::Jump(Register target) { b(target); }
+void TurboAssembler::LoadFromConstantsTable(Register destination,
+                                            int constant_index) {
+  DCHECK(isolate()->heap()->RootCanBeTreatedAsConstant(
+      Heap::kBuiltinsConstantsTableRootIndex));
+
+  const uint32_t offset =
+      FixedArray::kHeaderSize + constant_index * kPointerSize - kHeapObjectTag;
+
+  CHECK(is_uint19(offset));
+  DCHECK_NE(destination, r0);
+  LoadRoot(destination, Heap::kBuiltinsConstantsTableRootIndex);
+  LoadP(destination, MemOperand(destination, offset), r1);
+}
+
+void TurboAssembler::LoadRootRelative(Register destination, int32_t offset) {
+  LoadP(destination, MemOperand(kRootRegister, offset));
+}
+
+void TurboAssembler::LoadRootRegisterOffset(Register destination,
+                                            intptr_t offset) {
+  if (offset == 0) {
+    LoadRR(destination, kRootRegister);
+  } else if (is_uint12(offset)) {
+    la(destination, MemOperand(kRootRegister, offset));
+  } else {
+    DCHECK(is_int20(offset));
+    lay(destination, MemOperand(kRootRegister, offset));
+  }
+}
+
+void TurboAssembler::Jump(Register target, Condition cond) { b(cond, target); }
 
 void MacroAssembler::JumpToJSEntry(Register target) {
   Move(ip, target);
@@ -123,7 +157,7 @@ void MacroAssembler::JumpToJSEntry(Register target) {
 }
 
 void TurboAssembler::Jump(intptr_t target, RelocInfo::Mode rmode,
-                          Condition cond, CRegister) {
+                          Condition cond) {
   Label skip;
 
   if (cond != al) b(NegateCondition(cond), &skip);
@@ -136,15 +170,37 @@ void TurboAssembler::Jump(intptr_t target, RelocInfo::Mode rmode,
   bind(&skip);
 }
 
-void TurboAssembler::Jump(Address target, RelocInfo::Mode rmode, Condition cond,
-                          CRegister cr) {
+void TurboAssembler::Jump(Address target, RelocInfo::Mode rmode,
+                          Condition cond) {
   DCHECK(!RelocInfo::IsCodeTarget(rmode));
-  Jump(reinterpret_cast<intptr_t>(target), rmode, cond, cr);
+  Jump(static_cast<intptr_t>(target), rmode, cond);
 }
 
 void TurboAssembler::Jump(Handle<Code> code, RelocInfo::Mode rmode,
                           Condition cond) {
   DCHECK(RelocInfo::IsCodeTarget(rmode));
+  if (FLAG_embedded_builtins) {
+    if (root_array_available_ && options().isolate_independent_code) {
+      Register scratch = r1;
+      IndirectLoadConstant(scratch, code);
+      la(scratch, MemOperand(scratch, Code::kHeaderSize - kHeapObjectTag));
+      b(cond, scratch);
+      return;
+    } else if (options().inline_offheap_trampolines) {
+      int builtin_index = Builtins::kNoBuiltinId;
+      if (isolate()->builtins()->IsBuiltinHandle(code, &builtin_index) &&
+          Builtins::IsIsolateIndependent(builtin_index)) {
+        // Inline the trampoline.
+        EmbeddedData d = EmbeddedData::FromBlob();
+        Address entry = d.InstructionStartOfBuiltin(builtin_index);
+        // Use ip directly instead of using UseScratchRegisterScope, as we do
+        // not preserve scratch registers across calls.
+        mov(ip, Operand(entry, RelocInfo::OFF_HEAP_TARGET));
+        Jump(ip, cond);
+        return;
+      }
+    }
+  }
   jump(code, rmode, cond);
 }
 
@@ -202,7 +258,7 @@ void TurboAssembler::Call(Address target, RelocInfo::Mode rmode,
   bind(&start);
 #endif
 
-  mov(ip, Operand(reinterpret_cast<intptr_t>(target), rmode));
+  mov(ip, Operand(target, rmode));
   basr(r14, ip);
 
   DCHECK_EQ(expected_size, SizeOfCodeGeneratedSince(&start));
@@ -217,15 +273,31 @@ void TurboAssembler::Call(Handle<Code> code, RelocInfo::Mode rmode,
                           Condition cond) {
   DCHECK(RelocInfo::IsCodeTarget(rmode) && cond == al);
 
-#ifdef DEBUG
-  // Check the expected size before generating code to ensure we assume the same
-  // constant pool availability (e.g., whether constant pool is full or not).
-  int expected_size = CallSize(code, rmode, cond);
-  Label start;
-  bind(&start);
-#endif
+  if (FLAG_embedded_builtins) {
+    if (root_array_available_ && options().isolate_independent_code) {
+      // Use ip directly instead of using UseScratchRegisterScope, as we do not
+      // preserve scratch registers across calls.
+      IndirectLoadConstant(ip, code);
+      la(ip, MemOperand(ip, Code::kHeaderSize - kHeapObjectTag));
+      Call(ip);
+      return;
+    } else if (options().inline_offheap_trampolines) {
+      int builtin_index = Builtins::kNoBuiltinId;
+      if (isolate()->builtins()->IsBuiltinHandle(code, &builtin_index) &&
+          Builtins::IsIsolateIndependent(builtin_index)) {
+        // Inline the trampoline.
+        DCHECK(Builtins::IsBuiltinId(builtin_index));
+        EmbeddedData d = EmbeddedData::FromBlob();
+        Address entry = d.InstructionStartOfBuiltin(builtin_index);
+        // Use ip directly instead of using UseScratchRegisterScope, as we do
+        // not preserve scratch registers across calls.
+        mov(ip, Operand(entry, RelocInfo::OFF_HEAP_TARGET));
+        Call(ip);
+        return;
+      }
+    }
+  }
   call(code, rmode);
-  DCHECK_EQ(expected_size, SizeOfCodeGeneratedSince(&start));
 }
 
 void TurboAssembler::Drop(int count) {
@@ -259,12 +331,32 @@ void TurboAssembler::Push(Smi* smi) {
 }
 
 void TurboAssembler::Move(Register dst, Handle<HeapObject> value) {
+  if (FLAG_embedded_builtins) {
+    if (root_array_available_ && options().isolate_independent_code) {
+      IndirectLoadConstant(dst, value);
+      return;
+    }
+  }
   mov(dst, Operand(value));
 }
 
+void TurboAssembler::Move(Register dst, ExternalReference reference) {
+  if (FLAG_embedded_builtins) {
+    if (root_array_available_ && options().isolate_independent_code) {
+      IndirectLoadExternalReference(dst, reference);
+      return;
+    }
+  }
+  mov(dst, Operand(reference));
+}
+
 void TurboAssembler::Move(Register dst, Register src, Condition cond) {
   if (dst != src) {
-    LoadRR(dst, src);
+    if (cond == al) {
+      LoadRR(dst, src);
+    } else {
+      LoadOnConditionP(cond, dst, src);
+    }
   }
 }
 
@@ -274,6 +366,48 @@ void TurboAssembler::Move(DoubleRegister dst, DoubleRegister src) {
   }
 }
 
+// Wrapper around Assembler::mvc (SS-a format)
+void TurboAssembler::MoveChar(const MemOperand& opnd1,
+                              const MemOperand& opnd2,
+                              const Operand& length) {
+  mvc(opnd1, opnd2, Operand(static_cast<intptr_t>(length.immediate() - 1)));
+}
+
+// Wrapper around Assembler::clc (SS-a format)
+void TurboAssembler::CompareLogicalChar(const MemOperand& opnd1,
+                                        const MemOperand& opnd2,
+                                        const Operand& length) {
+  clc(opnd1, opnd2, Operand(static_cast<intptr_t>(length.immediate() - 1)));
+}
+
+// Wrapper around Assembler::xc (SS-a format)
+void TurboAssembler::ExclusiveOrChar(const MemOperand& opnd1,
+                                     const MemOperand& opnd2,
+                                     const Operand& length) {
+  xc(opnd1, opnd2, Operand(static_cast<intptr_t>(length.immediate() - 1)));
+}
+
+// Wrapper around Assembler::risbg(n) (RIE-f)
+void TurboAssembler::RotateInsertSelectBits(Register dst, Register src,
+                               const Operand& startBit, const Operand& endBit,
+                               const Operand& shiftAmt, bool zeroBits) {
+  if (zeroBits)
+    // High tag the top bit of I4/EndBit to zero out any unselected bits
+    risbg(dst, src, startBit,
+          Operand(static_cast<intptr_t>(endBit.immediate() | 0x80)), shiftAmt);
+  else
+    risbg(dst, src, startBit, endBit, shiftAmt);
+}
+
+void TurboAssembler::BranchRelativeOnIdxHighP(Register dst, Register inc,
+                                              Label* L) {
+#if V8_TARGET_ARCH_S390X
+  brxhg(dst, inc, L);
+#else
+  brxh(dst, inc, L);
+#endif // V8_TARGET_ARCH_S390X
+}
+
 void TurboAssembler::MultiPush(RegList regs, Register location) {
   int16_t num_to_push = base::bits::CountPopulation(regs);
   int16_t stack_offset = num_to_push * kPointerSize;
@@ -328,7 +462,7 @@ void TurboAssembler::MultiPopDoubles(RegList dregs, Register location) {
 
 void TurboAssembler::LoadRoot(Register destination, Heap::RootListIndex index,
                               Condition) {
-  LoadP(destination, MemOperand(kRootRegister, index << kPointerSizeLog2), r0);
+  LoadP(destination, MemOperand(kRootRegister, RootRegisterOffset(index)), r0);
 }
 
 void MacroAssembler::RecordWriteField(Register object, int offset,
@@ -424,8 +558,7 @@ void TurboAssembler::CallRecordWriteStub(
   Pop(slot_parameter);
   Pop(object_parameter);
 
-  mov(isolate_parameter,
-      Operand(ExternalReference::isolate_address(isolate())));
+  Move(isolate_parameter, ExternalReference::isolate_address(isolate()));
   Move(remembered_set_parameter, Smi::FromEnum(remembered_set_action));
   Move(fp_mode_parameter, Smi::FromEnum(fp_mode));
   Call(callable.code(), RelocInfo::CODE_TARGET);
@@ -597,7 +730,7 @@ void TurboAssembler::ConvertUnsignedIntToDouble(DoubleRegister dst,
 }
 
 void TurboAssembler::ConvertIntToFloat(DoubleRegister dst, Register src) {
-  cefbr(Condition(4), dst, src);
+  cefbra(Condition(4), dst, src);
 }
 
 void TurboAssembler::ConvertUnsignedIntToFloat(DoubleRegister dst,
@@ -912,11 +1045,6 @@ void TurboAssembler::EnterFrame(StackFrame::Type type,
 
   Load(ip, Operand(StackFrame::TypeToMarker(type)));
   PushCommonFrame(ip);
-
-  if (type == StackFrame::INTERNAL) {
-    mov(r0, Operand(CodeObject()));
-    push(r0);
-  }
 }
 
 int TurboAssembler::LeaveFrame(StackFrame::Type type, int stack_adjustment) {
@@ -982,15 +1110,15 @@ void MacroAssembler::EnterExitFrame(bool save_doubles, int stack_space,
   if (emit_debug_code()) {
     StoreP(MemOperand(fp, ExitFrameConstants::kSPOffset), Operand::Zero(), r1);
   }
-  mov(r1, Operand(CodeObject()));
+  Move(r1, CodeObject());
   StoreP(r1, MemOperand(fp, ExitFrameConstants::kCodeOffset));
 
   // Save the frame pointer and the context in top.
-  mov(r1, Operand(ExternalReference(IsolateAddressId::kCEntryFPAddress,
-                                    isolate())));
+  Move(r1, ExternalReference::Create(IsolateAddressId::kCEntryFPAddress,
+                                     isolate()));
   StoreP(fp, MemOperand(r1));
-  mov(r1,
-      Operand(ExternalReference(IsolateAddressId::kContextAddress, isolate())));
+  Move(r1,
+       ExternalReference::Create(IsolateAddressId::kContextAddress, isolate()));
   StoreP(cp, MemOperand(r1));
 
   // Optionally save all volatile double registers.
@@ -1048,19 +1176,19 @@ void MacroAssembler::LeaveExitFrame(bool save_doubles, Register argument_count,
   }
 
   // Clear top frame.
-  mov(ip, Operand(ExternalReference(IsolateAddressId::kCEntryFPAddress,
-                                    isolate())));
+  Move(ip, ExternalReference::Create(IsolateAddressId::kCEntryFPAddress,
+                                     isolate()));
   StoreP(MemOperand(ip), Operand(0, RelocInfo::NONE), r0);
 
   // Restore current context from top and clear it in debug mode.
-  mov(ip,
-      Operand(ExternalReference(IsolateAddressId::kContextAddress, isolate())));
+  Move(ip,
+       ExternalReference::Create(IsolateAddressId::kContextAddress, isolate()));
   LoadP(cp, MemOperand(ip));
 
 #ifdef DEBUG
   mov(r1, Operand(Context::kInvalidContext));
-  mov(ip,
-      Operand(ExternalReference(IsolateAddressId::kContextAddress, isolate())));
+  Move(ip,
+       ExternalReference::Create(IsolateAddressId::kContextAddress, isolate()));
   StoreP(r1, MemOperand(ip));
 #endif
 
@@ -1167,8 +1295,8 @@ void MacroAssembler::InvokePrologue(const ParameterCount& expected,
   // passed in registers.
 
   // ARM has some sanity checks as per below, considering add them for S390
-  //  DCHECK(actual.is_immediate() || actual.reg() == r2);
-  //  DCHECK(expected.is_immediate() || expected.reg() == r4);
+  DCHECK(actual.is_immediate() || actual.reg() == r2);
+  DCHECK(expected.is_immediate() || expected.reg() == r4);
 
   if (expected.is_immediate()) {
     DCHECK(actual.is_immediate());
@@ -1218,13 +1346,21 @@ void MacroAssembler::CheckDebugHook(Register fun, Register new_target,
                                     const ParameterCount& actual) {
   Label skip_hook;
 
-  ExternalReference debug_hook_avtive =
+  ExternalReference debug_hook_active =
       ExternalReference::debug_hook_on_function_call_address(isolate());
-  mov(r6, Operand(debug_hook_avtive));
+  Move(r6, debug_hook_active);
   tm(MemOperand(r6), Operand::Zero());
   bne(&skip_hook);
 
   {
+    // Load receiver to pass it later to DebugOnFunctionCall hook.
+    if (actual.is_reg()) {
+      LoadRR(r6, actual.reg());
+    } else {
+      mov(r6, Operand(actual.immediate()));
+    }
+    ShiftLeftP(r6, r6, Operand(kPointerSizeLog2));
+    LoadP(r6, MemOperand(sp, r6));
     FrameScope frame(this,
                      has_frame() ? StackFrame::NONE : StackFrame::INTERNAL);
     if (expected.is_reg()) {
@@ -1238,7 +1374,7 @@ void MacroAssembler::CheckDebugHook(Register fun, Register new_target,
     if (new_target.is_valid()) {
       Push(new_target);
     }
-    Push(fun, fun);
+    Push(fun, fun, r6);
     CallRuntime(Runtime::kDebugOnFunctionCall);
     Pop(fun);
     if (new_target.is_valid()) {
@@ -1310,9 +1446,10 @@ void MacroAssembler::InvokeFunction(Register fun, Register new_target,
   Register temp_reg = r6;
   LoadP(temp_reg, FieldMemOperand(r3, JSFunction::kSharedFunctionInfoOffset));
   LoadP(cp, FieldMemOperand(r3, JSFunction::kContextOffset));
-  LoadW(expected_reg,
-        FieldMemOperand(temp_reg,
-                        SharedFunctionInfo::kFormalParameterCountOffset));
+  LoadLogicalHalfWordP(
+      expected_reg,
+      FieldMemOperand(temp_reg,
+                      SharedFunctionInfo::kFormalParameterCountOffset));
 
   ParameterCount expected(expected_reg);
   InvokeFunctionCode(fun, new_target, expected, actual, flag);
@@ -1338,7 +1475,7 @@ void MacroAssembler::MaybeDropFrames() {
   // Check whether we need to drop frames to restart a function on the stack.
   ExternalReference restart_fp =
       ExternalReference::debug_restart_fp_address(isolate());
-  mov(r3, Operand(restart_fp));
+  Move(r3, restart_fp);
   LoadP(r3, MemOperand(r3));
   CmpP(r3, Operand::Zero());
   Jump(BUILTIN_CODE(isolate(), FrameDropperTrampoline), RelocInfo::CODE_TARGET,
@@ -1351,8 +1488,8 @@ void MacroAssembler::PushStackHandler() {
   STATIC_ASSERT(StackHandlerConstants::kNextOffset == 0 * kPointerSize);
 
   // Link the current handler as the next handler.
-  mov(r7,
-      Operand(ExternalReference(IsolateAddressId::kHandlerAddress, isolate())));
+  mov(r7, Operand(ExternalReference::Create(IsolateAddressId::kHandlerAddress,
+                                            isolate())));
 
   // Buy the full stack frame for 5 slots.
   lay(sp, MemOperand(sp, -StackHandlerConstants::kSize));
@@ -1362,8 +1499,8 @@ void MacroAssembler::PushStackHandler() {
   StoreP(r0, MemOperand(sp));  // Padding.
 
   // Copy the old handler into the next handler slot.
-  mvc(MemOperand(sp, StackHandlerConstants::kNextOffset), MemOperand(r7),
-      kPointerSize);
+  MoveChar(MemOperand(sp, StackHandlerConstants::kNextOffset), MemOperand(r7),
+      Operand(kPointerSize));
   // Set this new handler as the current one.
   StoreP(sp, MemOperand(r7));
 }
@@ -1374,8 +1511,8 @@ void MacroAssembler::PopStackHandler() {
 
   // Pop the Next Handler into r3 and store it into Handler Address reference.
   Pop(r3);
-  mov(ip,
-      Operand(ExternalReference(IsolateAddressId::kHandlerAddress, isolate())));
+  mov(ip, Operand(ExternalReference::Create(IsolateAddressId::kHandlerAddress,
+                                            isolate())));
   StoreP(r3, MemOperand(ip));
 
   Drop(1);  // Drop padding.
@@ -1398,7 +1535,7 @@ void MacroAssembler::CompareInstanceType(Register map, Register type_reg,
 }
 
 void MacroAssembler::CompareRoot(Register obj, Heap::RootListIndex index) {
-  CmpP(obj, MemOperand(kRootRegister, index << kPointerSizeLog2));
+  CmpP(obj, MemOperand(kRootRegister, RootRegisterOffset(index)));
 }
 
 void MacroAssembler::CallStub(CodeStub* stub, Condition cond) {
@@ -1437,8 +1574,10 @@ void MacroAssembler::TryDoubleToInt32Exact(Register result,
   bind(&done);
 }
 
-void TurboAssembler::TruncateDoubleToIDelayed(Zone* zone, Register result,
-                                              DoubleRegister double_input) {
+void TurboAssembler::TruncateDoubleToI(Isolate* isolate, Zone* zone,
+                                       Register result,
+                                       DoubleRegister double_input,
+                                       StubCallMode stub_mode) {
   Label done;
 
   TryInlineTruncateDoubleToI(result, double_input, &done);
@@ -1449,8 +1588,13 @@ void TurboAssembler::TruncateDoubleToIDelayed(Zone* zone, Register result,
   lay(sp, MemOperand(sp, -kDoubleSize));
   StoreDouble(double_input, MemOperand(sp));
 
-  CallStubDelayed(new (zone) DoubleToIStub(nullptr, result));
+  if (stub_mode == StubCallMode::kCallWasmRuntimeStub) {
+    Call(wasm::WasmCode::kDoubleToI, RelocInfo::WASM_STUB_CALL);
+  } else {
+    Call(BUILTIN_CODE(isolate, DoubleToI), RelocInfo::CODE_TARGET);
+  }
 
+  LoadP(result, MemOperand(sp, 0));
   la(sp, MemOperand(sp, kDoubleSize));
   pop(r14);
 
@@ -1467,18 +1611,14 @@ void TurboAssembler::TryInlineTruncateDoubleToI(Register result,
   beq(done);
 }
 
-void TurboAssembler::CallRuntimeDelayed(Zone* zone, Runtime::FunctionId fid,
-                                        SaveFPRegsMode save_doubles) {
+void TurboAssembler::CallRuntimeWithCEntry(Runtime::FunctionId fid,
+                                           Register centry) {
   const Runtime::Function* f = Runtime::FunctionForId(fid);
   mov(r2, Operand(f->nargs));
-  mov(r3, Operand(ExternalReference(f, isolate())));
-  CallStubDelayed(new (zone) CEntryStub(nullptr,
-#if V8_TARGET_ARCH_S390X
-                                        f->result_size,
-#else
-                                        1,
-#endif
-                                        save_doubles));
+  Move(r3, ExternalReference::Create(f));
+  DCHECK(!AreAliased(centry, r2, r3));
+  la(centry, MemOperand(centry, Code::kHeaderSize - kHeapObjectTag));
+  Call(centry);
 }
 
 void MacroAssembler::CallRuntime(const Runtime::Function* f, int num_arguments,
@@ -1495,15 +1635,15 @@ void MacroAssembler::CallRuntime(const Runtime::Function* f, int num_arguments,
   // should remove this need and make the runtime routine entry code
   // smarter.
   mov(r2, Operand(num_arguments));
-  mov(r3, Operand(ExternalReference(f, isolate())));
-  CEntryStub stub(isolate(),
+  Move(r3, ExternalReference::Create(f));
 #if V8_TARGET_ARCH_S390X
-                  f->result_size,
+  Handle<Code> code =
+      CodeFactory::CEntry(isolate(), f->result_size, save_doubles);
 #else
-                  1,
+  Handle<Code> code = CodeFactory::CEntry(isolate(), 1, save_doubles);
 #endif
-                  save_doubles);
-  CallStub(&stub);
+
+  Call(code, RelocInfo::CODE_TARGET);
 }
 
 void MacroAssembler::TailCallRuntime(Runtime::FunctionId fid) {
@@ -1512,20 +1652,19 @@ void MacroAssembler::TailCallRuntime(Runtime::FunctionId fid) {
   if (function->nargs >= 0) {
     mov(r2, Operand(function->nargs));
   }
-  JumpToExternalReference(ExternalReference(fid, isolate()));
+  JumpToExternalReference(ExternalReference::Create(fid));
 }
 
 void MacroAssembler::JumpToExternalReference(const ExternalReference& builtin,
                                              bool builtin_exit_frame) {
-  mov(r3, Operand(builtin));
-  CEntryStub stub(isolate(), 1, kDontSaveFPRegs, kArgvOnStack,
-                  builtin_exit_frame);
-  Jump(stub.GetCode(), RelocInfo::CODE_TARGET);
+  Move(r3, builtin);
+  Handle<Code> code = CodeFactory::CEntry(isolate(), 1, kDontSaveFPRegs,
+                                          kArgvOnStack, builtin_exit_frame);
+  Jump(code, RelocInfo::CODE_TARGET);
 }
 
 void MacroAssembler::JumpToInstructionStream(Address entry) {
-  mov(kOffHeapTrampolineRegister,
-      Operand(reinterpret_cast<intptr_t>(entry), RelocInfo::OFF_HEAP_TARGET));
+  mov(kOffHeapTrampolineRegister, Operand(entry, RelocInfo::OFF_HEAP_TARGET));
   Jump(kOffHeapTrampolineRegister);
 }
 
@@ -1541,11 +1680,11 @@ void MacroAssembler::IncrementCounter(StatsCounter* counter, int value,
                                       Register scratch1, Register scratch2) {
   DCHECK(value > 0 && is_int8(value));
   if (FLAG_native_code_counters && counter->Enabled()) {
-    mov(scratch1, Operand(ExternalReference(counter)));
+    Move(scratch2, ExternalReference::Create(counter));
     // @TODO(john.yan): can be optimized by asi()
-    LoadW(scratch2, MemOperand(scratch1));
-    AddP(scratch2, Operand(value));
-    StoreW(scratch2, MemOperand(scratch1));
+    LoadW(scratch1, MemOperand(scratch2));
+    AddP(scratch1, Operand(value));
+    StoreW(scratch1, MemOperand(scratch2));
   }
 }
 
@@ -1553,11 +1692,11 @@ void MacroAssembler::DecrementCounter(StatsCounter* counter, int value,
                                       Register scratch1, Register scratch2) {
   DCHECK(value > 0 && is_int8(value));
   if (FLAG_native_code_counters && counter->Enabled()) {
-    mov(scratch1, Operand(ExternalReference(counter)));
+    Move(scratch2, ExternalReference::Create(counter));
     // @TODO(john.yan): can be optimized by asi()
-    LoadW(scratch2, MemOperand(scratch1));
-    AddP(scratch2, Operand(-value));
-    StoreW(scratch2, MemOperand(scratch1));
+    LoadW(scratch1, MemOperand(scratch2));
+    AddP(scratch1, Operand(-value));
+    StoreW(scratch1, MemOperand(scratch2));
   }
 }
 
@@ -1576,18 +1715,17 @@ void TurboAssembler::Check(Condition cond, AbortReason reason, CRegister cr) {
 void TurboAssembler::Abort(AbortReason reason) {
   Label abort_start;
   bind(&abort_start);
-#ifdef DEBUG
   const char* msg = GetAbortReason(reason);
-  if (msg != nullptr) {
-    RecordComment("Abort message: ");
-    RecordComment(msg);
-  }
+#ifdef DEBUG
+  RecordComment("Abort message: ");
+  RecordComment(msg);
+#endif
 
-  if (FLAG_trap_on_abort) {
+  // Avoid emitting call to builtin if requested.
+  if (trap_on_abort()) {
     stop(msg);
     return;
   }
-#endif
 
   LoadSmiLiteral(r3, Smi::FromInt(static_cast<int>(reason)));
 
@@ -1642,18 +1780,6 @@ void MacroAssembler::AssertSmi(Register object) {
   }
 }
 
-void MacroAssembler::AssertFixedArray(Register object) {
-  if (emit_debug_code()) {
-    STATIC_ASSERT(kSmiTag == 0);
-    TestIfSmi(object);
-    Check(ne, AbortReason::kOperandIsASmiAndNotAFixedArray, cr0);
-    push(object);
-    CompareObjectType(object, object, object, FIXED_ARRAY_TYPE);
-    pop(object);
-    Check(eq, AbortReason::kOperandIsNotAFixedArray);
-  }
-}
-
 void MacroAssembler::AssertConstructor(Register object, Register scratch) {
   if (emit_debug_code()) {
     STATIC_ASSERT(kSmiTag == 0);
@@ -1723,7 +1849,7 @@ void MacroAssembler::AssertUndefinedOrAllocationSite(Register object,
     CompareRoot(object, Heap::kUndefinedValueRootIndex);
     beq(&done_checking, Label::kNear);
     LoadP(scratch, FieldMemOperand(object, HeapObject::kMapOffset));
-    CompareRoot(scratch, Heap::kAllocationSiteMapRootIndex);
+    CompareInstanceType(scratch, scratch, ALLOCATION_SITE_TYPE);
     Assert(eq, AbortReason::kExpectedUndefinedOrCell);
     bind(&done_checking);
   }
@@ -1790,7 +1916,7 @@ void TurboAssembler::MovToFloatParameters(DoubleRegister src1,
 void TurboAssembler::CallCFunction(ExternalReference function,
                                    int num_reg_arguments,
                                    int num_double_arguments) {
-  mov(ip, Operand(function));
+  Move(ip, function);
   CallCFunctionHelper(ip, num_reg_arguments, num_double_arguments);
 }
 
@@ -2141,7 +2267,7 @@ void TurboAssembler::Div32(Register dst, Register src1, Register src2) {
 #define Generate_DivU32(instr) \
   {                            \
     lr(r0, src1);              \
-    srdl(r0, Operand(32));     \
+    srdl(r0, r0, Operand(32)); \
     instr(r0, src2);           \
     LoadlW(dst, r1);           \
   }
@@ -2215,7 +2341,7 @@ void TurboAssembler::Mod32(Register dst, Register src1, Register src2) {
 #define Generate_ModU32(instr) \
   {                            \
     lr(r0, src1);              \
-    srdl(r0, Operand(32));     \
+    srdl(r0, r0, Operand(32)); \
     instr(r0, src2);           \
     LoadlW(dst, r0);           \
   }
@@ -2756,6 +2882,13 @@ void TurboAssembler::SubP_ExtendSrc(Register dst, const MemOperand& opnd) {
 #endif
 }
 
+// Load And Subtract 32-bit (similar to laa/lan/lao/lax)
+void TurboAssembler::LoadAndSub32(Register dst, Register src,
+                                  const MemOperand& opnd) {
+  lcr(dst, src);
+  laa(dst, dst, opnd);
+}
+
 //----------------------------------------------------------------------------
 //  Subtract Logical Instructions
 //----------------------------------------------------------------------------
@@ -2902,14 +3035,15 @@ void TurboAssembler::AndP(Register dst, Register src, const Operand& opnd) {
           base::bits::CountLeadingZeros64(shifted_value) - trailing_zeros;
       int endBit = 63 - trailing_zeros;
       // Start: startBit, End: endBit, Shift = 0, true = zero unselected bits.
-      risbg(dst, src, Operand(startBit), Operand(endBit), Operand::Zero(),
-            true);
+      RotateInsertSelectBits(dst, src, Operand(startBit), Operand(endBit),
+            Operand::Zero(), true);
       return;
     } else if (-1 == shifted_value) {
       // A Special case in which all top bits up to MSB are 1's.  In this case,
       // we can set startBit to be 0.
       int endBit = 63 - trailing_zeros;
-      risbg(dst, src, Operand::Zero(), Operand(endBit), Operand::Zero(), true);
+      RotateInsertSelectBits(dst, src, Operand::Zero(), Operand(endBit),
+            Operand::Zero(), true);
       return;
     }
   }
@@ -3235,6 +3369,16 @@ void TurboAssembler::CmpP(Register dst, const MemOperand& opnd) {
 #endif
 }
 
+// Using cs or scy based on the offset
+void TurboAssembler::CmpAndSwap(Register old_val, Register new_val,
+                                const MemOperand& opnd) {
+  if (is_uint12(opnd.offset())) {
+    cs(old_val, new_val, opnd);
+  } else {
+    csy(old_val, new_val, opnd);
+  }
+}
+
 //-----------------------------------------------------------------------------
 // Compare Logical Helpers
 //-----------------------------------------------------------------------------
@@ -3933,6 +4077,14 @@ void TurboAssembler::StoreW(Register src, const MemOperand& mem,
   }
 }
 
+void TurboAssembler::LoadHalfWordP(Register dst, Register src) {
+#if V8_TARGET_ARCH_S390X
+  lghr(dst, src);
+#else
+  lhr(dst, src);
+#endif
+}
+
 // Loads 16-bits half-word value from memory and sign extends to pointer
 // sized register
 void TurboAssembler::LoadHalfWordP(Register dst, const MemOperand& mem,
@@ -4108,7 +4260,8 @@ void TurboAssembler::ClearRightImm(Register dst, Register src,
   // Try to use RISBG if possible
   if (CpuFeatures::IsSupported(GENERAL_INSTR_EXT)) {
     int endBit = 63 - numBitsToClear;
-    risbg(dst, src, Operand::Zero(), Operand(endBit), Operand::Zero(), true);
+    RotateInsertSelectBits(dst, src, Operand::Zero(), Operand(endBit),
+          Operand::Zero(), true);
     return;
   }
 
@@ -4297,6 +4450,16 @@ void TurboAssembler::ComputeCodeStartAddress(Register dst) {
   larl(dst, Operand(-pc_offset() / 2));
 }
 
+void TurboAssembler::JumpIfEqual(Register x, int32_t y, Label* dest) {
+  Cmp32(x, Operand(y));
+  beq(dest);
+}
+
+void TurboAssembler::JumpIfLessThan(Register x, int32_t y, Label* dest) {
+  Cmp32(x, Operand(y));
+  blt(dest);
+}
+
 }  // namespace internal
 }  // namespace v8
 
diff --git a/deps/v8/src/s390/macro-assembler-s390.h b/deps/v8/src/s390/macro-assembler-s390.h
index 7c123b9c5b0d46..a82f7999f13fb3 100644
--- a/deps/v8/src/s390/macro-assembler-s390.h
+++ b/deps/v8/src/s390/macro-assembler-s390.h
@@ -9,6 +9,7 @@
 #include "src/bailout-reason.h"
 #include "src/globals.h"
 #include "src/s390/assembler-s390.h"
+#include "src/turbo-assembler.h"
 
 namespace v8 {
 namespace internal {
@@ -25,12 +26,17 @@ constexpr Register kInterpreterAccumulatorRegister = r2;
 constexpr Register kInterpreterBytecodeOffsetRegister = r6;
 constexpr Register kInterpreterBytecodeArrayRegister = r7;
 constexpr Register kInterpreterDispatchTableRegister = r8;
+
 constexpr Register kJavaScriptCallArgCountRegister = r2;
-constexpr Register kJavaScriptCallNewTargetRegister = r5;
 constexpr Register kJavaScriptCallCodeStartRegister = r4;
+constexpr Register kJavaScriptCallTargetRegister = kJSFunctionRegister;
+constexpr Register kJavaScriptCallNewTargetRegister = r5;
+constexpr Register kJavaScriptCallExtraArg1Register = r4;
+
 constexpr Register kOffHeapTrampolineRegister = ip;
 constexpr Register kRuntimeCallFunctionRegister = r3;
 constexpr Register kRuntimeCallArgCountRegister = r2;
+constexpr Register kWasmInstanceRegister = r6;
 
 // ----------------------------------------------------------------------------
 // Static helper functions
@@ -166,32 +172,35 @@ bool AreAliased(DoubleRegister reg1, DoubleRegister reg2,
 
 #endif
 
-class TurboAssembler : public Assembler {
+class TurboAssembler : public TurboAssemblerBase {
  public:
-  TurboAssembler(Isolate* isolate, void* buffer, int buffer_size,
-                 CodeObjectRequired create_code_object);
+  TurboAssembler(Isolate* isolate, const AssemblerOptions& options,
+                 void* buffer, int buffer_size,
+                 CodeObjectRequired create_code_object)
+      : TurboAssemblerBase(isolate, options, buffer, buffer_size,
+                           create_code_object) {}
 
-  Isolate* isolate() const { return isolate_; }
-
-  Handle<HeapObject> CodeObject() {
-    DCHECK(!code_object_.is_null());
-    return code_object_;
-  }
+  void LoadFromConstantsTable(Register destination,
+                              int constant_index) override;
+  void LoadRootRegisterOffset(Register destination, intptr_t offset) override;
+  void LoadRootRelative(Register destination, int32_t offset) override;
 
   // Returns the size of a call in instructions.
   static int CallSize(Register target);
   int CallSize(Address target, RelocInfo::Mode rmode, Condition cond = al);
 
   // Jump, Call, and Ret pseudo instructions implementing inter-working.
-  void Jump(Register target);
-  void Jump(Address target, RelocInfo::Mode rmode, Condition cond = al,
-            CRegister cr = cr7);
+  void Jump(Register target, Condition cond = al);
+  void Jump(Address target, RelocInfo::Mode rmode, Condition cond = al);
   void Jump(Handle<Code> code, RelocInfo::Mode rmode, Condition cond = al);
   // Jump the register contains a smi.
   inline void JumpIfSmi(Register value, Label* smi_label) {
     TestIfSmi(value);
     beq(smi_label /*, cr0*/);  // branch if SMI
   }
+  void JumpIfEqual(Register x, int32_t y, Label* dest);
+  void JumpIfLessThan(Register x, int32_t y, Label* dest);
+
   void Call(Register target);
   void Call(Address target, RelocInfo::Mode rmode, Condition cond = al);
   int CallSize(Handle<Code> code,
@@ -202,7 +211,9 @@ class TurboAssembler : public Assembler {
   void Ret() { b(r14); }
   void Ret(Condition cond) { b(cond, r14); }
 
-  void CallForDeoptimization(Address target, RelocInfo::Mode rmode) {
+  void CallForDeoptimization(Address target, int deopt_id,
+                             RelocInfo::Mode rmode) {
+    USE(deopt_id);
     Call(target, rmode);
   }
 
@@ -221,9 +232,25 @@ class TurboAssembler : public Assembler {
   // Register move. May do nothing if the registers are identical.
   void Move(Register dst, Smi* smi) { LoadSmiLiteral(dst, smi); }
   void Move(Register dst, Handle<HeapObject> value);
+  void Move(Register dst, ExternalReference reference);
   void Move(Register dst, Register src, Condition cond = al);
   void Move(DoubleRegister dst, DoubleRegister src);
 
+  void MoveChar(const MemOperand& opnd1, const MemOperand& opnd2,
+                   const Operand& length);
+
+  void CompareLogicalChar(const MemOperand& opnd1, const MemOperand& opnd2,
+                   const Operand& length);
+
+  void ExclusiveOrChar(const MemOperand& opnd1, const MemOperand& opnd2,
+                   const Operand& length);
+
+  void RotateInsertSelectBits(Register dst, Register src,
+                     const Operand& startBit, const Operand& endBit,
+                     const Operand& shiftAmt, bool zeroBits);
+
+  void BranchRelativeOnIdxHighP(Register dst, Register inc, Label* L);
+
   void SaveRegisters(RegList registers);
   void RestoreRegisters(RegList registers);
 
@@ -256,8 +283,11 @@ class TurboAssembler : public Assembler {
                      Register exclusion3 = no_reg);
 
   // Load an object from the root table.
+  void LoadRoot(Register destination, Heap::RootListIndex index) override {
+    LoadRoot(destination, index, al);
+  }
   void LoadRoot(Register destination, Heap::RootListIndex index,
-                Condition cond = al);
+                Condition cond);
   //--------------------------------------------------------------------------
   // S390 Macro Assemblers for Instructions
   //--------------------------------------------------------------------------
@@ -325,6 +355,7 @@ class TurboAssembler : public Assembler {
   void Sub32(Register dst, const MemOperand& opnd);
   void SubP(Register dst, const MemOperand& opnd);
   void SubP_ExtendSrc(Register dst, const MemOperand& opnd);
+  void LoadAndSub32(Register dst, Register src, const MemOperand& opnd);
 
   // Subtract Logical (Register - Mem)
   void SubLogical(Register dst, const MemOperand& opnd);
@@ -391,6 +422,7 @@ class TurboAssembler : public Assembler {
   void CmpP(Register dst, const Operand& opnd);
   void Cmp32(Register dst, const MemOperand& opnd);
   void CmpP(Register dst, const MemOperand& opnd);
+  void CmpAndSwap(Register old_val, Register new_val, const MemOperand& opnd);
 
   // Compare Logical
   void CmpLogical32(Register src1, Register src2);
@@ -646,6 +678,7 @@ class TurboAssembler : public Assembler {
     ExternalReference roots_array_start =
         ExternalReference::roots_array_start(isolate());
     mov(kRootRegister, Operand(roots_array_start));
+    AddP(kRootRegister, kRootRegister, Operand(kRootRegisterBias));
   }
 
   // Flush the I-cache from asm code. You should use CpuFeatures::FlushICache
@@ -759,6 +792,8 @@ class TurboAssembler : public Assembler {
 
   void StoreW(Register src, const MemOperand& mem, Register scratch = no_reg);
 
+  void LoadHalfWordP(Register dst, Register src);
+
   void LoadHalfWordP(Register dst, const MemOperand& mem,
                      Register scratch = no_reg);
 
@@ -823,9 +858,9 @@ class TurboAssembler : public Assembler {
   // Call a code stub.
   void CallStubDelayed(CodeStub* stub);
 
-  // Call a runtime routine.
-  void CallRuntimeDelayed(Zone* zone, Runtime::FunctionId fid,
-                          SaveFPRegsMode save_doubles = kDontSaveFPRegs);
+  // Call a runtime routine. This expects {centry} to contain a fitting CEntry
+  // builtin for the target runtime function and uses an indirect call.
+  void CallRuntimeWithCEntry(Runtime::FunctionId fid, Register centry);
 
   // Before calling a C-function from generated code, align arguments on stack.
   // After aligning the frame, non-register arguments must be stored in
@@ -866,8 +901,8 @@ class TurboAssembler : public Assembler {
 
   // Emit code for a truncating division by a constant. The dividend register is
   // unchanged and ip gets clobbered. Dividend and result must be different.
-  void TruncateDoubleToIDelayed(Zone* zone, Register result,
-                                DoubleRegister double_input);
+  void TruncateDoubleToI(Isolate* isolate, Zone* zone, Register result,
+                         DoubleRegister double_input, StubCallMode stub_mode);
   void TryInlineTruncateDoubleToI(Register result, DoubleRegister double_input,
                                   Label* done);
 
@@ -884,8 +919,6 @@ class TurboAssembler : public Assembler {
   // Print a message to stdout and abort execution.
   void Abort(AbortReason reason);
 
-  void set_has_frame(bool value) { has_frame_ = value; }
-  bool has_frame() { return has_frame_; }
   inline bool AllowThisStubCall(CodeStub* stub);
 
   // ---------------------------------------------------------------------------
@@ -905,8 +938,8 @@ class TurboAssembler : public Assembler {
       int shiftAmount = (64 - rangeEnd) % 64;  // Convert to shift left.
       int endBit = 63;  // End is always LSB after shifting.
       int startBit = 63 - rangeStart + rangeEnd;
-      risbg(dst, src, Operand(startBit), Operand(endBit), Operand(shiftAmount),
-            true);
+      RotateInsertSelectBits(dst, src, Operand(startBit), Operand(endBit),
+            Operand(shiftAmount), true);
     } else {
       if (rangeEnd > 0)  // Don't need to shift if rangeEnd is zero.
         ShiftRightP(dst, src, Operand(rangeEnd));
@@ -1019,22 +1052,20 @@ class TurboAssembler : public Assembler {
   void CallCFunctionHelper(Register function, int num_reg_arguments,
                            int num_double_arguments);
 
-  void Jump(intptr_t target, RelocInfo::Mode rmode, Condition cond = al,
-            CRegister cr = cr7);
+  void Jump(intptr_t target, RelocInfo::Mode rmode, Condition cond = al);
   int CalculateStackPassedWords(int num_reg_arguments,
                                 int num_double_arguments);
-
-  bool has_frame_ = false;
-  Isolate* isolate_;
-  // This handle will be patched with the code object on installation.
-  Handle<HeapObject> code_object_;
 };
 
 // MacroAssembler implements a collection of frequently used macros.
 class MacroAssembler : public TurboAssembler {
  public:
   MacroAssembler(Isolate* isolate, void* buffer, int size,
-                 CodeObjectRequired create_code_object);
+                 CodeObjectRequired create_code_object)
+      : MacroAssembler(isolate, AssemblerOptions::Default(isolate), buffer,
+                       size, create_code_object) {}
+  MacroAssembler(Isolate* isolate, const AssemblerOptions& options,
+                 void* buffer, int size, CodeObjectRequired create_code_object);
 
   // Call a code stub.
   void TailCallStub(CodeStub* stub, Condition cond = al);
@@ -1236,9 +1267,6 @@ class MacroAssembler : public TurboAssembler {
 #define SmiWordOffset(offset) offset
 #endif
 
-  // Abort execution if argument is not a FixedArray, enabled via --debug-code.
-  void AssertFixedArray(Register object);
-
   // Abort execution if argument is not a Constructor, enabled via --debug-code.
   void AssertConstructor(Register object, Register scratch);
 
diff --git a/deps/v8/src/s390/simulator-s390.cc b/deps/v8/src/s390/simulator-s390.cc
index 73ca0d5a8ac92b..147519deb29e1b 100644
--- a/deps/v8/src/s390/simulator-s390.cc
+++ b/deps/v8/src/s390/simulator-s390.cc
@@ -365,7 +365,7 @@ void S390Debugger::Debug() {
                  (strcmp(cmd, "printobject") == 0)) {
         if (argc == 2) {
           intptr_t value;
-          OFStream os(stdout);
+          StdoutStream os;
           if (GetValue(arg1, &value)) {
             Object* obj = reinterpret_cast<Object*>(value);
             os << arg1 << ": \n";
@@ -605,7 +605,7 @@ void S390Debugger::Debug() {
         PrintF("    Stops are debug instructions inserted by\n");
         PrintF("    the Assembler::stop() function.\n");
         PrintF("    When hitting a stop, the Simulator will\n");
-        PrintF("    stop and and give control to the S390Debugger.\n");
+        PrintF("    stop and give control to the S390Debugger.\n");
         PrintF("    The first %d stop codes are watched:\n",
                Simulator::kNumOfWatchedStops);
         PrintF("    - They can be enabled / disabled: the Simulator\n");
@@ -1905,17 +1905,18 @@ void Simulator::SoftwareInterrupt(Instruction* instr) {
             case ExternalReference::BUILTIN_FP_FP_CALL:
             case ExternalReference::BUILTIN_COMPARE_CALL:
               PrintF("Call to host function at %p with args %f, %f",
-                     static_cast<void*>(FUNCTION_ADDR(generic_target)), dval0,
-                     dval1);
+                     reinterpret_cast<void*>(FUNCTION_ADDR(generic_target)),
+                     dval0, dval1);
               break;
             case ExternalReference::BUILTIN_FP_CALL:
               PrintF("Call to host function at %p with arg %f",
-                     static_cast<void*>(FUNCTION_ADDR(generic_target)), dval0);
+                     reinterpret_cast<void*>(FUNCTION_ADDR(generic_target)),
+                     dval0);
               break;
             case ExternalReference::BUILTIN_FP_INT_CALL:
               PrintF("Call to host function at %p with args %f, %" V8PRIdPTR,
-                     static_cast<void*>(FUNCTION_ADDR(generic_target)), dval0,
-                     ival);
+                     reinterpret_cast<void*>(FUNCTION_ADDR(generic_target)),
+                     dval0, ival);
               break;
             default:
               UNREACHABLE();
@@ -2058,8 +2059,8 @@ void Simulator::SoftwareInterrupt(Instruction* instr) {
               "\t\t\t\targs %08" V8PRIxPTR ", %08" V8PRIxPTR ", %08" V8PRIxPTR
               ", %08" V8PRIxPTR ", %08" V8PRIxPTR ", %08" V8PRIxPTR
               ", %08" V8PRIxPTR ", %08" V8PRIxPTR ", %08" V8PRIxPTR,
-              static_cast<void*>(FUNCTION_ADDR(target)), arg[0], arg[1], arg[2],
-              arg[3], arg[4], arg[5], arg[6], arg[7], arg[8]);
+              reinterpret_cast<void*>(FUNCTION_ADDR(target)), arg[0], arg[1],
+              arg[2], arg[3], arg[4], arg[5], arg[6], arg[7], arg[8]);
           if (!stack_aligned) {
             PrintF(" with unaligned stack %08" V8PRIxPTR "\n",
                    static_cast<intptr_t>(get_register(sp)));
@@ -2390,7 +2391,7 @@ void Simulator::Execute() {
   }
 }
 
-void Simulator::CallInternal(byte* entry, int reg_arg_count) {
+void Simulator::CallInternal(Address entry, int reg_arg_count) {
   // Adjust JS-based stack limit to C-based stack limit.
   isolate_->stack_guard()->AdjustStackLimitForSimulator();
 
@@ -2400,7 +2401,7 @@ void Simulator::CallInternal(byte* entry, int reg_arg_count) {
     set_pc(*(reinterpret_cast<intptr_t*>(entry)));
   } else {
     // entry is the instruction address
-    set_pc(reinterpret_cast<intptr_t>(entry));
+    set_pc(static_cast<intptr_t>(entry));
   }
   // Remember the values of non-volatile registers.
   int64_t r6_val = get_register(r6);
@@ -2475,7 +2476,7 @@ void Simulator::CallInternal(byte* entry, int reg_arg_count) {
   set_register(r13, r13_val);
 }
 
-intptr_t Simulator::CallImpl(byte* entry, int argument_count,
+intptr_t Simulator::CallImpl(Address entry, int argument_count,
                              const intptr_t* arguments) {
   // Adjust JS-based stack limit to C-based stack limit.
   isolate_->stack_guard()->AdjustStackLimitForSimulator();
@@ -2522,7 +2523,7 @@ intptr_t Simulator::CallImpl(byte* entry, int argument_count,
   set_pc(*(reinterpret_cast<intptr_t*>(entry)));
 #else
   // entry is the instruction address
-  set_pc(reinterpret_cast<intptr_t>(entry));
+  set_pc(static_cast<intptr_t>(entry));
 #endif
 
   // Put target address in ip (for JS prologue).
@@ -2597,19 +2598,19 @@ intptr_t Simulator::CallImpl(byte* entry, int argument_count,
   return get_register(r2);
 }
 
-void Simulator::CallFP(byte* entry, double d0, double d1) {
+void Simulator::CallFP(Address entry, double d0, double d1) {
   set_d_register_from_double(0, d0);
   set_d_register_from_double(1, d1);
   CallInternal(entry);
 }
 
-int32_t Simulator::CallFPReturnsInt(byte* entry, double d0, double d1) {
+int32_t Simulator::CallFPReturnsInt(Address entry, double d0, double d1) {
   CallFP(entry, d0, d1);
   int32_t result = get_register(r2);
   return result;
 }
 
-double Simulator::CallFPReturnsDouble(byte* entry, double d0, double d1) {
+double Simulator::CallFPReturnsDouble(Address entry, double d0, double d1) {
   CallFP(entry, d0, d1);
   return get_double_from_d_register(0);
 }
@@ -2679,6 +2680,12 @@ uintptr_t Simulator::PopAddress() {
   int d2 = AS(RSInstruction)->D2Value();          \
   int length = 4;
 
+#define DECODE_RSI_INSTRUCTION(r1, r3, i2)        \
+  int r1 = AS(RSIInstruction)->R1Value();         \
+  int r3 = AS(RSIInstruction)->R3Value();         \
+  int32_t i2 = AS(RSIInstruction)->I2Value();     \
+  int length = 4;
+
 #define DECODE_SI_INSTRUCTION_I_UINT8(b1, d1_val, imm_val) \
   int b1 = AS(SIInstruction)->B1Value();                   \
   intptr_t d1_val = AS(SIInstruction)->D1Value();          \
@@ -2748,6 +2755,12 @@ uintptr_t Simulator::PopAddress() {
   int32_t i2 = AS(RIEInstruction)->I6Value(); \
   int length = 6;
 
+#define DECODE_RIE_E_INSTRUCTION(r1, r2, i2)  \
+  int r1 = AS(RIEInstruction)->R1Value();     \
+  int r2 = AS(RIEInstruction)->R2Value();     \
+  int32_t i2 = AS(RIEInstruction)->I6Value(); \
+  int length = 6;
+
 #define DECODE_RIE_F_INSTRUCTION(r1, r2, i3, i4, i5) \
   int r1 = AS(RIEInstruction)->R1Value();            \
   int r2 = AS(RIEInstruction)->R2Value();            \
@@ -3865,9 +3878,19 @@ EVALUATE(LE) {
 }
 
 EVALUATE(BRXH) {
-  UNIMPLEMENTED();
-  USE(instr);
-  return 0;
+  DCHECK_OPCODE(BRXH);
+  DECODE_RSI_INSTRUCTION(r1, r3, i2);
+  int32_t r1_val = (r1 == 0) ? 0 : get_low_register<int32_t>(r1);
+  int32_t r3_val = (r3 == 0) ? 0 : get_low_register<int32_t>(r3);
+  intptr_t branch_address = get_pc() + (2 * i2);
+  r1_val += r3_val;
+  int32_t compare_val = r3 % 2 == 0 ?
+          get_low_register<int32_t>(r3 + 1) : r3_val;
+  if (r1_val > compare_val) {
+    set_pc(branch_address);
+  }
+  set_low_register(r1, r1_val);
+  return length;
 }
 
 EVALUATE(BRXLE) {
@@ -7138,9 +7161,13 @@ EVALUATE(LLGCR) {
 }
 
 EVALUATE(LLGHR) {
-  UNIMPLEMENTED();
-  USE(instr);
-  return 0;
+  DCHECK_OPCODE(LLGHR);
+  DECODE_RRE_INSTRUCTION(r1, r2);
+  uint64_t r2_val = get_low_register<uint64_t>(r2);
+  r2_val <<= 48;
+  r2_val >>= 48;
+  set_register(r1, r2_val);
+  return length;
 }
 
 EVALUATE(MLGR) {
@@ -9189,28 +9216,38 @@ EVALUATE(STOC) {
   return 0;
 }
 
+#define ATOMIC_LOAD_AND_UPDATE_WORD32(op)                       \
+  DECODE_RSY_A_INSTRUCTION(r1, r3, b2, d2);                     \
+  int64_t b2_val = (b2 == 0) ? 0 : get_register(b2);            \
+  intptr_t addr = static_cast<intptr_t>(b2_val) + d2;           \
+  int32_t r3_val = get_low_register<int32_t>(r3);               \
+  DCHECK_EQ(addr & 0x3, 0);                              \
+  int32_t r1_val = op(reinterpret_cast<int32_t*>(addr),         \
+                      r3_val, __ATOMIC_SEQ_CST);                \
+  set_low_register(r1, r1_val);
+
 EVALUATE(LAN) {
-  UNIMPLEMENTED();
-  USE(instr);
-  return 0;
+  DCHECK_OPCODE(LAN);
+  ATOMIC_LOAD_AND_UPDATE_WORD32(__atomic_fetch_and);
+  return length;
 }
 
 EVALUATE(LAO) {
-  UNIMPLEMENTED();
-  USE(instr);
-  return 0;
+  DCHECK_OPCODE(LAO);
+  ATOMIC_LOAD_AND_UPDATE_WORD32(__atomic_fetch_or);
+  return length;
 }
 
 EVALUATE(LAX) {
-  UNIMPLEMENTED();
-  USE(instr);
-  return 0;
+  DCHECK_OPCODE(LAX);
+  ATOMIC_LOAD_AND_UPDATE_WORD32(__atomic_fetch_xor);
+  return length;
 }
 
 EVALUATE(LAA) {
-  UNIMPLEMENTED();
-  USE(instr);
-  return 0;
+  DCHECK_OPCODE(LAA);
+  ATOMIC_LOAD_AND_UPDATE_WORD32(__atomic_fetch_add);
+  return length;
 }
 
 EVALUATE(LAAL) {
@@ -9219,10 +9256,21 @@ EVALUATE(LAAL) {
   return 0;
 }
 
+#undef ATOMIC_LOAD_AND_UPDATE_WORD32
+
 EVALUATE(BRXHG) {
-  UNIMPLEMENTED();
-  USE(instr);
-  return 0;
+  DCHECK_OPCODE(BRXHG);
+  DECODE_RIE_E_INSTRUCTION(r1, r3, i2);
+  int64_t r1_val = (r1 == 0) ? 0 : get_register(r1);
+  int64_t r3_val = (r3 == 0) ? 0 : get_register(r3);
+  intptr_t branch_address = get_pc() + (2 * i2);
+  r1_val += r3_val;
+  int64_t compare_val = r3 % 2 == 0 ? get_register(r3 + 1) : r3_val;
+  if (r1_val > compare_val) {
+    set_pc(branch_address);
+  }
+  set_register(r1, r1_val);
+  return length;
 }
 
 EVALUATE(BRXLG) {
diff --git a/deps/v8/src/s390/simulator-s390.h b/deps/v8/src/s390/simulator-s390.h
index 7c4eb74b6c0f7a..dba7ce8947d5dc 100644
--- a/deps/v8/src/s390/simulator-s390.h
+++ b/deps/v8/src/s390/simulator-s390.h
@@ -153,9 +153,7 @@ class Simulator : public SimulatorBase {
   void set_pc(intptr_t value);
   intptr_t get_pc() const;
 
-  Address get_sp() const {
-    return reinterpret_cast<Address>(static_cast<intptr_t>(get_register(sp)));
-  }
+  Address get_sp() const { return static_cast<Address>(get_register(sp)); }
 
   // Accessor to the internal simulator stack area.
   uintptr_t StackLimit(uintptr_t c_limit) const;
@@ -164,14 +162,14 @@ class Simulator : public SimulatorBase {
   void Execute();
 
   template <typename Return, typename... Args>
-  Return Call(byte* entry, Args... args) {
+  Return Call(Address entry, Args... args) {
     return VariadicCall<Return>(this, &Simulator::CallImpl, entry, args...);
   }
 
   // Alternative: call a 2-argument double function.
-  void CallFP(byte* entry, double d0, double d1);
-  int32_t CallFPReturnsInt(byte* entry, double d0, double d1);
-  double CallFPReturnsDouble(byte* entry, double d0, double d1);
+  void CallFP(Address entry, double d0, double d1);
+  int32_t CallFPReturnsInt(Address entry, double d0, double d1);
+  double CallFPReturnsDouble(Address entry, double d0, double d1);
 
   // Push an address onto the JS stack.
   uintptr_t PushAddress(uintptr_t address);
@@ -207,7 +205,8 @@ class Simulator : public SimulatorBase {
     end_sim_pc = -2
   };
 
-  intptr_t CallImpl(byte* entry, int argument_count, const intptr_t* arguments);
+  intptr_t CallImpl(Address entry, int argument_count,
+                    const intptr_t* arguments);
 
   // Unsupported instructions use Format to print an error and stop execution.
   void Format(Instruction* instr, const char* format);
@@ -404,7 +403,7 @@ class Simulator : public SimulatorBase {
   void SetFpResult(const double& result);
   void TrashCallerSaveRegisters();
 
-  void CallInternal(byte* entry, int reg_arg_count = 3);
+  void CallInternal(Address entry, int reg_arg_count = 3);
 
   // Architecture state.
   // On z9 and higher and supported Linux on z Systems platforms, all registers
diff --git a/deps/v8/src/safepoint-table.cc b/deps/v8/src/safepoint-table.cc
index 176693d2aa5114..e5062a7e2caa7e 100644
--- a/deps/v8/src/safepoint-table.cc
+++ b/deps/v8/src/safepoint-table.cc
@@ -71,6 +71,7 @@ SafepointEntry SafepointTable::FindEntry(Address pc) const {
   // We use kMaxUInt32 as sentinel value, so check that we don't hit that.
   DCHECK_NE(kMaxUInt32, pc_offset);
   unsigned len = length();
+  CHECK_GT(len, 0);
   // If pc == kMaxUInt32, then this entry covers all call sites in the function.
   if (len == 1 && GetPcOffset(0) == kMaxUInt32) return GetEntry(0);
   for (unsigned i = 0; i < len; i++) {
diff --git a/deps/v8/src/setup-isolate-deserialize.cc b/deps/v8/src/setup-isolate-deserialize.cc
index e232b471485ef5..a99d735af64761 100644
--- a/deps/v8/src/setup-isolate-deserialize.cc
+++ b/deps/v8/src/setup-isolate-deserialize.cc
@@ -21,10 +21,10 @@ void SetupIsolateDelegate::SetupInterpreter(
     interpreter::Interpreter* interpreter) {
 #if defined(V8_USE_SNAPSHOT) && !defined(V8_USE_SNAPSHOT_WITH_UNWINDING_INFO)
   if (FLAG_perf_prof_unwinding_info) {
-    OFStream os(stdout);
-    os << "Warning: The --perf-prof-unwinding-info flag can be passed at "
-          "mksnapshot time to get better results."
-       << std::endl;
+    StdoutStream{}
+        << "Warning: The --perf-prof-unwinding-info flag can be passed at "
+           "mksnapshot time to get better results."
+        << std::endl;
   }
 #endif
   CHECK(interpreter->IsDispatchTableInitialized());
diff --git a/deps/v8/src/signature.h b/deps/v8/src/signature.h
index 90f38d03532514..1c84703147f4f3 100644
--- a/deps/v8/src/signature.h
+++ b/deps/v8/src/signature.h
@@ -6,6 +6,7 @@
 #define V8_SIGNATURE_H_
 
 #include "src/base/iterator.h"
+#include "src/machine-type.h"
 #include "src/zone/zone.h"
 
 namespace v8 {
@@ -98,6 +99,8 @@ class Signature : public ZoneObject {
   const T* reps_;
 };
 
+typedef Signature<MachineType> MachineSignature;
+
 }  // namespace internal
 }  // namespace v8
 
diff --git a/deps/v8/src/simulator-base.cc b/deps/v8/src/simulator-base.cc
index f075ad72ac259f..e5ecbc0a6d8fa5 100644
--- a/deps/v8/src/simulator-base.cc
+++ b/deps/v8/src/simulator-base.cc
@@ -59,19 +59,15 @@ void SimulatorBase::GlobalTearDown() {
 }
 
 // static
-void SimulatorBase::Initialize(Isolate* isolate) {
-  ExternalReference::set_redirector(isolate, &RedirectExternalReference);
-}
-
-// static
-void* SimulatorBase::RedirectExternalReference(void* external_function,
-                                               ExternalReference::Type type) {
+Address SimulatorBase::RedirectExternalReference(Address external_function,
+                                                 ExternalReference::Type type) {
   base::LockGuard<base::Mutex> lock_guard(Simulator::redirection_mutex());
   Redirection* redirection = Redirection::Get(external_function, type);
   return redirection->address_of_instruction();
 }
 
-Redirection::Redirection(void* external_function, ExternalReference::Type type)
+Redirection::Redirection(Address external_function,
+                         ExternalReference::Type type)
     : external_function_(external_function), type_(type), next_(nullptr) {
   next_ = Simulator::redirection();
   base::LockGuard<base::Mutex> lock_guard(Simulator::i_cache_mutex());
@@ -89,7 +85,7 @@ Redirection::Redirection(void* external_function, ExternalReference::Type type)
 }
 
 // static
-Redirection* Redirection::Get(void* external_function,
+Redirection* Redirection::Get(Address external_function,
                               ExternalReference::Type type) {
   Redirection* current = Simulator::redirection();
   for (; current != nullptr; current = current->next_) {
diff --git a/deps/v8/src/simulator-base.h b/deps/v8/src/simulator-base.h
index 9564af8a2e76f4..afd01fb18dd55f 100644
--- a/deps/v8/src/simulator-base.h
+++ b/deps/v8/src/simulator-base.h
@@ -25,9 +25,6 @@ class SimulatorBase {
   static void InitializeOncePerProcess();
   static void GlobalTearDown();
 
-  // Call on isolate initialization.
-  static void Initialize(Isolate* isolate);
-
   static base::Mutex* redirection_mutex() { return redirection_mutex_; }
   static Redirection* redirection() { return redirection_; }
   static void set_redirection(Redirection* r) { redirection_ = r; }
@@ -35,9 +32,13 @@ class SimulatorBase {
   static base::Mutex* i_cache_mutex() { return i_cache_mutex_; }
   static base::CustomMatcherHashMap* i_cache() { return i_cache_; }
 
+  // Runtime call support.
+  static Address RedirectExternalReference(Address external_function,
+                                           ExternalReference::Type type);
+
  protected:
   template <typename Return, typename SimT, typename CallImpl, typename... Args>
-  static Return VariadicCall(SimT* sim, CallImpl call, byte* entry,
+  static Return VariadicCall(SimT* sim, CallImpl call, Address entry,
                              Args... args) {
     // Convert all arguments to intptr_t. Fails if any argument is not integral
     // or pointer.
@@ -67,10 +68,6 @@ class SimulatorBase {
       intptr_t ret) {}
 
  private:
-  // Runtime call support.
-  static void* RedirectExternalReference(void* external_function,
-                                         ExternalReference::Type type);
-
   static base::Mutex* redirection_mutex_;
   static Redirection* redirection_;
 
@@ -122,7 +119,7 @@ class SimulatorBase {
 //  - V8_TARGET_ARCH_S390: svc (Supervisor Call)
 class Redirection {
  public:
-  Redirection(void* external_function, ExternalReference::Type type);
+  Redirection(Address external_function, ExternalReference::Type type);
 
   Address address_of_instruction() {
 #if ABI_USES_FUNCTION_DESCRIPTORS
@@ -132,10 +129,12 @@ class Redirection {
 #endif
   }
 
-  void* external_function() { return external_function_; }
+  void* external_function() {
+    return reinterpret_cast<void*>(external_function_);
+  }
   ExternalReference::Type type() { return type_; }
 
-  static Redirection* Get(void* external_function,
+  static Redirection* Get(Address external_function,
                           ExternalReference::Type type);
 
   static Redirection* FromInstruction(Instruction* instruction) {
@@ -160,7 +159,7 @@ class Redirection {
   }
 
  private:
-  void* external_function_;
+  Address external_function_;
   uint32_t instruction_;
   ExternalReference::Type type_;
   Redirection* next_;
diff --git a/deps/v8/src/simulator.h b/deps/v8/src/simulator.h
index a2af7f59d55921..a7badaa6e506d5 100644
--- a/deps/v8/src/simulator.h
+++ b/deps/v8/src/simulator.h
@@ -89,11 +89,14 @@ class GeneratedCode {
  public:
   using Signature = Return(Args...);
 
-  template <typename T>
-  static GeneratedCode FromAddress(Isolate* isolate, T* addr) {
+  static GeneratedCode FromAddress(Isolate* isolate, Address addr) {
     return GeneratedCode(isolate, reinterpret_cast<Signature*>(addr));
   }
 
+  static GeneratedCode FromBuffer(Isolate* isolate, byte* buffer) {
+    return GeneratedCode(isolate, reinterpret_cast<Signature*>(buffer));
+  }
+
   static GeneratedCode FromCode(Code* code) {
     return FromAddress(code->GetIsolate(), code->entry());
   }
@@ -102,7 +105,7 @@ class GeneratedCode {
   // Defined in simulator-base.h.
   Return Call(Args... args) {
     return Simulator::current(isolate_)->template Call<Return>(
-        reinterpret_cast<byte*>(fn_ptr_), args...);
+        reinterpret_cast<Address>(fn_ptr_), args...);
   }
 #else
   DISABLE_CFI_ICALL Return Call(Args... args) {
diff --git a/deps/v8/src/snapshot/builtin-deserializer-allocator.cc b/deps/v8/src/snapshot/builtin-deserializer-allocator.cc
index 59cab6d40a5e4c..4e3d546fa0a010 100644
--- a/deps/v8/src/snapshot/builtin-deserializer-allocator.cc
+++ b/deps/v8/src/snapshot/builtin-deserializer-allocator.cc
@@ -44,16 +44,16 @@ Address BuiltinDeserializerAllocator::Allocate(AllocationSpace space,
     DCHECK(Internals::HasHeapObjectTag(obj));
     return HeapObject::cast(obj)->address();
   } else if (BSU::IsHandlerIndex(code_object_id)) {
-    if (handler_allocation_ != nullptr) {
+    if (handler_allocation_ != kNullAddress) {
       // Lazy deserialization.
       DCHECK_NULL(handler_allocations_);
       return handler_allocation_;
     } else {
       // Eager deserialization.
-      DCHECK_NULL(handler_allocation_);
+      DCHECK_EQ(kNullAddress, handler_allocation_);
       DCHECK_NOT_NULL(handler_allocations_);
       int index = HandlerAllocationIndex(code_object_id);
-      DCHECK_NOT_NULL(handler_allocations_->at(index));
+      DCHECK_NE(kNullAddress, handler_allocations_->at(index));
       return handler_allocations_->at(index);
     }
   }
@@ -74,7 +74,7 @@ BuiltinDeserializerAllocator::CreateReservationsForEagerBuiltinsAndHandlers() {
     uint32_t builtin_size =
         deserializer()->ExtractCodeObjectSize(Builtins::kDeserializeLazy);
     DCHECK_LE(builtin_size, MemoryAllocator::PageAreaSize(CODE_SPACE));
-    result.push_back({builtin_size, nullptr, nullptr});
+    result.push_back({builtin_size, kNullAddress, kNullAddress});
   }
 
   for (int i = 0; i < BSU::kNumberOfBuiltins; i++) {
@@ -88,7 +88,7 @@ BuiltinDeserializerAllocator::CreateReservationsForEagerBuiltinsAndHandlers() {
 
     uint32_t builtin_size = deserializer()->ExtractCodeObjectSize(i);
     DCHECK_LE(builtin_size, MemoryAllocator::PageAreaSize(CODE_SPACE));
-    result.push_back({builtin_size, nullptr, nullptr});
+    result.push_back({builtin_size, kNullAddress, kNullAddress});
   }
 
   // Reservations for bytecode handlers.
@@ -110,7 +110,7 @@ BuiltinDeserializerAllocator::CreateReservationsForEagerBuiltinsAndHandlers() {
         const int index = BSU::BytecodeToIndex(bytecode, operand_scale);
         uint32_t handler_size = deserializer()->ExtractCodeObjectSize(index);
         DCHECK_LE(handler_size, MemoryAllocator::PageAreaSize(CODE_SPACE));
-        result.push_back({handler_size, nullptr, nullptr});
+        result.push_back({handler_size, kNullAddress, kNullAddress});
       });
 
   return result;
diff --git a/deps/v8/src/snapshot/builtin-deserializer-allocator.h b/deps/v8/src/snapshot/builtin-deserializer-allocator.h
index 207f02811af000..65c5872d7a1d8c 100644
--- a/deps/v8/src/snapshot/builtin-deserializer-allocator.h
+++ b/deps/v8/src/snapshot/builtin-deserializer-allocator.h
@@ -135,7 +135,7 @@ class BuiltinDeserializerAllocator final {
 
   // Stores the allocated space for a single handler during lazy
   // deserialization.
-  Address handler_allocation_ = nullptr;
+  Address handler_allocation_ = kNullAddress;
 
   bool next_reference_is_weak_ = false;
 
diff --git a/deps/v8/src/snapshot/builtin-deserializer.cc b/deps/v8/src/snapshot/builtin-deserializer.cc
index 8e3ad8c20ccce1..0e32844ba012b0 100644
--- a/deps/v8/src/snapshot/builtin-deserializer.cc
+++ b/deps/v8/src/snapshot/builtin-deserializer.cc
@@ -73,6 +73,20 @@ void BuiltinDeserializer::DeserializeEagerBuiltinsAndHandlers() {
   }
 #endif
 
+#ifdef ENABLE_DISASSEMBLER
+  if (FLAG_print_builtin_code) {
+    // We can't print builtins during deserialization because they may refer
+    // to not yet deserialized builtins.
+    for (int i = 0; i < BSU::kNumberOfBuiltins; i++) {
+      if (!IsLazyDeserializationEnabled() || !Builtins::IsLazy(i)) {
+        Code* code = builtins->builtin(i);
+        const char* name = Builtins::name(i);
+        code->PrintBuiltinCode(isolate(), name);
+      }
+    }
+  }
+#endif
+
   // Deserialize bytecode handlers.
 
   Interpreter* interpreter = isolate()->interpreter();
@@ -113,12 +127,8 @@ Code* BuiltinDeserializer::DeserializeBuiltin(int builtin_id) {
 
 #ifdef ENABLE_DISASSEMBLER
   if (FLAG_print_builtin_code) {
-    CodeTracer::Scope tracing_scope(isolate()->GetCodeTracer());
-    OFStream os(tracing_scope.file());
-
-    DCHECK(isolate()->builtins()->is_initialized());
-    code->Disassemble(Builtins::name(builtin_id), os);
-    os << std::flush;
+    const char* name = Builtins::name(builtin_id);
+    code->PrintBuiltinCode(isolate(), name);
   }
 #endif  // ENABLE_DISASSEMBLER
 
@@ -129,19 +139,7 @@ Code* BuiltinDeserializer::DeserializeHandler(Bytecode bytecode,
                                               OperandScale operand_scale) {
   allocator()->ReserveForHandler(bytecode, operand_scale);
   DisallowHeapAllocation no_gc;
-  Code* code = DeserializeHandlerRaw(bytecode, operand_scale);
-
-#ifdef ENABLE_DISASSEMBLER
-  if (FLAG_print_builtin_code) {
-    CodeTracer::Scope tracing_scope(isolate()->GetCodeTracer());
-    OFStream os(tracing_scope.file());
-
-    code->Disassemble(Bytecodes::ToString(bytecode), os);
-    os << std::flush;
-  }
-#endif  // ENABLE_DISASSEMBLER
-
-  return code;
+  return DeserializeHandlerRaw(bytecode, operand_scale);
 }
 
 Code* BuiltinDeserializer::DeserializeBuiltinRaw(int builtin_id) {
@@ -196,13 +194,15 @@ Code* BuiltinDeserializer::DeserializeHandlerRaw(Bytecode bytecode,
   Assembler::FlushICache(code->raw_instruction_start(),
                          code->raw_instruction_size());
 
-  const char* handler_name =
-      isolate()->interpreter()->LookupNameOfBytecodeHandler(code);
-  if (handler_name == nullptr) {
-    handler_name = "UnknownBytecodeHadler";
-  }
+  std::string name = Bytecodes::ToString(bytecode, operand_scale);
   PROFILE(isolate(), CodeCreateEvent(CodeEventListener::HANDLER_TAG,
-                                     AbstractCode::cast(code), handler_name));
+                                     AbstractCode::cast(code), name.c_str()));
+#ifdef ENABLE_DISASSEMBLER
+  if (FLAG_print_builtin_code) {
+    code->PrintBuiltinCode(isolate(), name.c_str());
+  }
+#endif  // ENABLE_DISASSEMBLER
+
   return code;
 }
 
diff --git a/deps/v8/src/snapshot/builtin-serializer-allocator.cc b/deps/v8/src/snapshot/builtin-serializer-allocator.cc
index af33e1ee498ea0..a50fc23dd8820f 100644
--- a/deps/v8/src/snapshot/builtin-serializer-allocator.cc
+++ b/deps/v8/src/snapshot/builtin-serializer-allocator.cc
@@ -18,12 +18,11 @@ SerializerReference BuiltinSerializerAllocator::Allocate(AllocationSpace space,
   // system.  Instead of worrying about chunk indices and offsets, we simply
   // need to generate unique offsets here.
 
-  const uint32_t virtual_chunk_index = 0;
-  const auto ref = SerializerReference::BackReference(
-      CODE_SPACE, virtual_chunk_index, virtual_chunk_offset_);
+  const auto ref =
+      SerializerReference::BuiltinReference(next_builtin_reference_index_);
 
-  virtual_chunk_size_ += size;
-  virtual_chunk_offset_ += kObjectAlignment;  // Needs to be aligned.
+  allocated_bytes_ += size;
+  next_builtin_reference_index_++;
 
   return ref;
 }
@@ -31,11 +30,8 @@ SerializerReference BuiltinSerializerAllocator::Allocate(AllocationSpace space,
 #ifdef DEBUG
 bool BuiltinSerializerAllocator::BackReferenceIsAlreadyAllocated(
     SerializerReference reference) const {
-  DCHECK(reference.is_back_reference());
-  AllocationSpace space = reference.space();
-  DCHECK_EQ(space, CODE_SPACE);
-  DCHECK_EQ(reference.chunk_index(), 0);
-  return reference.chunk_offset() < virtual_chunk_offset_;
+  DCHECK(reference.is_builtin_reference());
+  return reference.builtin_index() < next_builtin_reference_index_;
 }
 #endif  // DEBUG
 
@@ -55,7 +51,7 @@ void BuiltinSerializerAllocator::OutputStatistics() {
   PrintF("\n");
 
   for (int space = FIRST_SPACE; space < kNumberOfSpaces; space++) {
-    uint32_t space_size = (space == CODE_SPACE) ? virtual_chunk_size_ : 0;
+    uint32_t space_size = (space == CODE_SPACE) ? allocated_bytes_ : 0;
     PrintF("%16d", space_size);
   }
   PrintF("\n");
diff --git a/deps/v8/src/snapshot/builtin-serializer-allocator.h b/deps/v8/src/snapshot/builtin-serializer-allocator.h
index a2c9a036e4038b..5a92843685d5c0 100644
--- a/deps/v8/src/snapshot/builtin-serializer-allocator.h
+++ b/deps/v8/src/snapshot/builtin-serializer-allocator.h
@@ -38,10 +38,8 @@ class BuiltinSerializerAllocator final {
   static constexpr int kNumberOfSpaces =
       SerializerDeserializer::kNumberOfSpaces;
 
-  // We need to track a faked offset to create back-references. The size is
-  // kept simply to display statistics.
-  uint32_t virtual_chunk_size_ = 0;
-  uint32_t virtual_chunk_offset_ = 0;
+  uint32_t allocated_bytes_ = 0;
+  uint32_t next_builtin_reference_index_ = 0;
 
   DISALLOW_COPY_AND_ASSIGN(BuiltinSerializerAllocator)
 };
diff --git a/deps/v8/src/snapshot/code-serializer.cc b/deps/v8/src/snapshot/code-serializer.cc
index d096500686e31b..8729547ef246b9 100644
--- a/deps/v8/src/snapshot/code-serializer.cc
+++ b/deps/v8/src/snapshot/code-serializer.cc
@@ -8,6 +8,7 @@
 
 #include "src/code-stubs.h"
 #include "src/counters.h"
+#include "src/debug/debug.h"
 #include "src/log.h"
 #include "src/macro-assembler.h"
 #include "src/objects-inl.h"
@@ -30,6 +31,11 @@ ScriptData::ScriptData(const byte* data, int length)
   }
 }
 
+CodeSerializer::CodeSerializer(Isolate* isolate, uint32_t source_hash)
+    : Serializer(isolate), source_hash_(source_hash) {
+  allocator()->UseCustomChunkSize(FLAG_serialization_chunk_size);
+}
+
 // static
 ScriptCompiler::CachedData* CodeSerializer::Serialize(
     Handle<SharedFunctionInfo> info) {
@@ -51,11 +57,14 @@ ScriptCompiler::CachedData* CodeSerializer::Serialize(
   // TODO(7110): Enable serialization of Asm modules once the AsmWasmData is
   // context independent.
   if (script->ContainsAsmModule()) return nullptr;
-  if (isolate->debug()->is_loaded()) return nullptr;
+  if (isolate->debug()->is_active()) return nullptr;
+
+  isolate->heap()->read_only_space()->ClearStringPaddingIfNeeded();
 
   // Serialize code object.
   Handle<String> source(String::cast(script->source()), isolate);
-  CodeSerializer cs(isolate, SerializedCodeData::SourceHash(source));
+  CodeSerializer cs(isolate, SerializedCodeData::SourceHash(
+                                 source, script->origin_options()));
   DisallowHeapAllocation no_gc;
   cs.reference_map()->AddAttachedReference(*source);
   ScriptData* script_data = cs.SerializeSharedFunctionInfo(info);
@@ -155,29 +164,27 @@ void CodeSerializer::SerializeObject(HeapObject* obj, HowToCode how_to_code,
     UNREACHABLE();
   }
 
+  ReadOnlyRoots roots(isolate());
   if (ElideObject(obj)) {
-    return SerializeObject(isolate()->heap()->undefined_value(), how_to_code,
-                           where_to_point, skip);
+    return SerializeObject(roots.undefined_value(), how_to_code, where_to_point,
+                           skip);
   }
 
   if (obj->IsScript()) {
     Script* script_obj = Script::cast(obj);
     DCHECK_NE(script_obj->compilation_type(), Script::COMPILATION_TYPE_EVAL);
-    // Wrapper object is a context-dependent JSValue. Reset it here.
-    script_obj->set_wrapper(isolate()->heap()->undefined_value());
     // We want to differentiate between undefined and uninitialized_symbol for
     // context_data for now. It is hack to allow debugging for scripts that are
     // included as a part of custom snapshot. (see debug::Script::IsEmbedded())
     Object* context_data = script_obj->context_data();
-    if (context_data != isolate()->heap()->undefined_value() &&
-        context_data != isolate()->heap()->uninitialized_symbol()) {
-      script_obj->set_context_data(isolate()->heap()->undefined_value());
+    if (context_data != roots.undefined_value() &&
+        context_data != roots.uninitialized_symbol()) {
+      script_obj->set_context_data(roots.undefined_value());
     }
     // We don't want to serialize host options to avoid serializing unnecessary
     // object graph.
     FixedArray* host_options = script_obj->host_defined_options();
-    script_obj->set_host_defined_options(
-        isolate()->heap()->empty_fixed_array());
+    script_obj->set_host_defined_options(roots.empty_fixed_array());
     SerializeGeneric(obj, how_to_code, where_to_point);
     script_obj->set_host_defined_options(host_options);
     script_obj->set_context_data(context_data);
@@ -189,16 +196,34 @@ void CodeSerializer::SerializeObject(HeapObject* obj, HowToCode how_to_code,
     // TODO(7110): Enable serializing of Asm modules once the AsmWasmData
     // is context independent.
     DCHECK(!sfi->IsApiFunction() && !sfi->HasAsmWasmData());
-    // Clear debug info.
-    Object* debug_info = sfi->debug_info();
-    sfi->set_debug_info(Smi::kZero);
+
+    DebugInfo* debug_info = nullptr;
+    BytecodeArray* debug_bytecode_array = nullptr;
+    if (sfi->HasDebugInfo()) {
+      // Clear debug info.
+      debug_info = sfi->GetDebugInfo();
+      if (debug_info->HasInstrumentedBytecodeArray()) {
+        debug_bytecode_array = debug_info->DebugBytecodeArray();
+        sfi->SetDebugBytecodeArray(debug_info->OriginalBytecodeArray());
+      }
+      sfi->set_function_identifier_or_debug_info(
+          debug_info->function_identifier());
+    }
+    DCHECK(!sfi->HasDebugInfo());
 
     // Mark SFI to indicate whether the code is cached.
     bool was_deserialized = sfi->deserialized();
     sfi->set_deserialized(sfi->is_compiled());
     SerializeGeneric(obj, how_to_code, where_to_point);
     sfi->set_deserialized(was_deserialized);
-    sfi->set_debug_info(debug_info);
+
+    // Restore debug info
+    if (debug_info != nullptr) {
+      sfi->set_function_identifier_or_debug_info(debug_info);
+      if (debug_bytecode_array != nullptr) {
+        sfi->SetDebugBytecodeArray(debug_bytecode_array);
+      }
+    }
     return;
   }
 
@@ -231,7 +256,7 @@ void CodeSerializer::SerializeGeneric(HeapObject* heap_object,
 void CodeSerializer::SerializeCodeStub(Code* code_stub, HowToCode how_to_code,
                                        WhereToPoint where_to_point) {
   // We only arrive here if we have not encountered this code stub before.
-  DCHECK(!reference_map()->Lookup(code_stub).is_valid());
+  DCHECK(!reference_map()->LookupReference(code_stub).is_valid());
   uint32_t stub_key = code_stub->stub_key();
   DCHECK(CodeStub::MajorKeyFromKey(stub_key) != CodeStub::NoCache);
   DCHECK(!CodeStub::GetCode(isolate(), stub_key).is_null());
@@ -248,7 +273,8 @@ void CodeSerializer::SerializeCodeStub(Code* code_stub, HowToCode how_to_code,
 }
 
 MaybeHandle<SharedFunctionInfo> CodeSerializer::Deserialize(
-    Isolate* isolate, ScriptData* cached_data, Handle<String> source) {
+    Isolate* isolate, ScriptData* cached_data, Handle<String> source,
+    ScriptOriginOptions origin_options) {
   base::ElapsedTimer timer;
   if (FLAG_profile_deserialization) timer.Start();
 
@@ -257,12 +283,13 @@ MaybeHandle<SharedFunctionInfo> CodeSerializer::Deserialize(
   SerializedCodeData::SanityCheckResult sanity_check_result =
       SerializedCodeData::CHECK_SUCCESS;
   const SerializedCodeData scd = SerializedCodeData::FromCachedData(
-      isolate, cached_data, SerializedCodeData::SourceHash(source),
+      isolate, cached_data,
+      SerializedCodeData::SourceHash(source, origin_options),
       &sanity_check_result);
   if (sanity_check_result != SerializedCodeData::CHECK_SUCCESS) {
     if (FLAG_profile_deserialization) PrintF("[Cached code failed check]\n");
     DCHECK(cached_data->rejected());
-    source->GetIsolate()->counters()->code_cache_reject_reason()->AddSample(
+    isolate->counters()->code_cache_reject_reason()->AddSample(
         sanity_check_result);
     return MaybeHandle<SharedFunctionInfo>();
   }
@@ -286,7 +313,7 @@ MaybeHandle<SharedFunctionInfo> CodeSerializer::Deserialize(
 
   if (isolate->logger()->is_listening_to_code_events() ||
       isolate->is_profiling()) {
-    String* name = isolate->heap()->empty_string();
+    String* name = ReadOnlyRoots(isolate).empty_string();
     if (result->script()->IsScript()) {
       Script* script = Script::cast(result->script());
       if (script->name()->IsString()) name = String::cast(script->name());
@@ -424,8 +451,15 @@ SerializedCodeData::SanityCheckResult SerializedCodeData::SanityCheck(
   return CHECK_SUCCESS;
 }
 
-uint32_t SerializedCodeData::SourceHash(Handle<String> source) {
-  return source->length();
+uint32_t SerializedCodeData::SourceHash(Handle<String> source,
+                                        ScriptOriginOptions origin_options) {
+  const uint32_t source_length = source->length();
+
+  static constexpr uint32_t kModuleFlagMask = (1 << 31);
+  const uint32_t is_module = origin_options.IsModule() ? kModuleFlagMask : 0;
+  DCHECK_EQ(0, source_length & kModuleFlagMask);
+
+  return source_length | is_module;
 }
 
 // Return ScriptData object and relinquish ownership over it to the caller.
diff --git a/deps/v8/src/snapshot/code-serializer.h b/deps/v8/src/snapshot/code-serializer.h
index f6b51bf9b1a0bc..c4878811ec3203 100644
--- a/deps/v8/src/snapshot/code-serializer.h
+++ b/deps/v8/src/snapshot/code-serializer.h
@@ -50,15 +50,15 @@ class CodeSerializer : public Serializer<> {
   ScriptData* SerializeSharedFunctionInfo(Handle<SharedFunctionInfo> info);
 
   V8_WARN_UNUSED_RESULT static MaybeHandle<SharedFunctionInfo> Deserialize(
-      Isolate* isolate, ScriptData* cached_data, Handle<String> source);
+      Isolate* isolate, ScriptData* cached_data, Handle<String> source,
+      ScriptOriginOptions origin_options);
 
   const std::vector<uint32_t>* stub_keys() const { return &stub_keys_; }
 
   uint32_t source_hash() const { return source_hash_; }
 
  protected:
-  explicit CodeSerializer(Isolate* isolate, uint32_t source_hash)
-      : Serializer(isolate), source_hash_(source_hash) {}
+  CodeSerializer(Isolate* isolate, uint32_t source_hash);
   ~CodeSerializer() override { OutputStatistics("CodeSerializer"); }
 
   virtual void SerializeCodeObject(Code* code_object, HowToCode how_to_code,
@@ -148,7 +148,8 @@ class SerializedCodeData : public SerializedData {
 
   Vector<const uint32_t> CodeStubKeys() const;
 
-  static uint32_t SourceHash(Handle<String> source);
+  static uint32_t SourceHash(Handle<String> source,
+                             ScriptOriginOptions origin_options);
 
  private:
   explicit SerializedCodeData(ScriptData* data);
diff --git a/deps/v8/src/snapshot/default-deserializer-allocator.cc b/deps/v8/src/snapshot/default-deserializer-allocator.cc
index 37d57286bc457d..610b87c771be88 100644
--- a/deps/v8/src/snapshot/default-deserializer-allocator.cc
+++ b/deps/v8/src/snapshot/default-deserializer-allocator.cc
@@ -45,7 +45,7 @@ Address DefaultDeserializerAllocator::AllocateRaw(AllocationSpace space,
   } else {
     DCHECK_LT(space, kNumberOfPreallocatedSpaces);
     Address address = high_water_[space];
-    DCHECK_NOT_NULL(address);
+    DCHECK_NE(address, kNullAddress);
     high_water_[space] += size;
 #ifdef DEBUG
     // Assert that the current reserved chunk is still big enough.
@@ -71,9 +71,9 @@ Address DefaultDeserializerAllocator::Allocate(AllocationSpace space,
     // aligned object when the filler maps have not been deserialized yet.
     // We require filler maps as padding to align the object.
     Heap* heap = isolate()->heap();
-    DCHECK(heap->free_space_map()->IsMap());
-    DCHECK(heap->one_pointer_filler_map()->IsMap());
-    DCHECK(heap->two_pointer_filler_map()->IsMap());
+    DCHECK(ReadOnlyRoots(heap).free_space_map()->IsMap());
+    DCHECK(ReadOnlyRoots(heap).one_pointer_filler_map()->IsMap());
+    DCHECK(ReadOnlyRoots(heap).two_pointer_filler_map()->IsMap());
     obj = heap->AlignWithFiller(obj, size, reserved, next_alignment_);
     address = obj->address();
     next_alignment_ = kWordAligned;
@@ -125,7 +125,8 @@ void DefaultDeserializerAllocator::DecodeReservation(
   DCHECK_EQ(0, reservations_[FIRST_SPACE].size());
   int current_space = FIRST_SPACE;
   for (auto& r : res) {
-    reservations_[current_space].push_back({r.chunk_size(), NULL, NULL});
+    reservations_[current_space].push_back(
+        {r.chunk_size(), kNullAddress, kNullAddress});
     if (r.is_last()) current_space++;
   }
   DCHECK_EQ(kNumberOfSpaces, current_space);
diff --git a/deps/v8/src/snapshot/default-serializer-allocator.cc b/deps/v8/src/snapshot/default-serializer-allocator.cc
index c00f05970471f7..d0efc2bd6503f8 100644
--- a/deps/v8/src/snapshot/default-serializer-allocator.cc
+++ b/deps/v8/src/snapshot/default-serializer-allocator.cc
@@ -5,6 +5,7 @@
 #include "src/snapshot/default-serializer-allocator.h"
 
 #include "src/heap/heap-inl.h"
+#include "src/snapshot/references.h"
 #include "src/snapshot/serializer.h"
 #include "src/snapshot/snapshot-source-sink.h"
 
@@ -19,18 +20,34 @@ DefaultSerializerAllocator::DefaultSerializerAllocator(
   }
 }
 
+void DefaultSerializerAllocator::UseCustomChunkSize(uint32_t chunk_size) {
+  custom_chunk_size_ = chunk_size;
+}
+
+static uint32_t PageSizeOfSpace(int space) {
+  return static_cast<uint32_t>(
+      MemoryAllocator::PageAreaSize(static_cast<AllocationSpace>(space)));
+}
+
+uint32_t DefaultSerializerAllocator::TargetChunkSize(int space) {
+  if (custom_chunk_size_ == 0) return PageSizeOfSpace(space);
+  DCHECK_LE(custom_chunk_size_, PageSizeOfSpace(space));
+  return custom_chunk_size_;
+}
+
 SerializerReference DefaultSerializerAllocator::Allocate(AllocationSpace space,
                                                          uint32_t size) {
   DCHECK(space >= 0 && space < kNumberOfPreallocatedSpaces);
-  DCHECK(size > 0 && size <= MaxChunkSizeInSpace(space));
+  DCHECK(size > 0 && size <= PageSizeOfSpace(space));
 
   // Maps are allocated through AllocateMap.
   DCHECK_NE(MAP_SPACE, space);
 
-  uint32_t new_chunk_size = pending_chunk_[space] + size;
-  if (new_chunk_size > MaxChunkSizeInSpace(space)) {
-    // The new chunk size would not fit onto a single page. Complete the
-    // current chunk and start a new one.
+  uint32_t old_chunk_size = pending_chunk_[space];
+  uint32_t new_chunk_size = old_chunk_size + size;
+  // Start a new chunk if the new size exceeds the target chunk size.
+  // We may exceed the target chunk size if the single object size does.
+  if (new_chunk_size > TargetChunkSize(space) && old_chunk_size != 0) {
     serializer_->PutNextChunk(space);
     completed_chunks_[space].push_back(pending_chunk_[space]);
     pending_chunk_[space] = 0;
@@ -136,13 +153,5 @@ void DefaultSerializerAllocator::OutputStatistics() {
   PrintF("%16d\n", large_objects_total_size_);
 }
 
-// static
-uint32_t DefaultSerializerAllocator::MaxChunkSizeInSpace(int space) {
-  DCHECK(0 <= space && space < kNumberOfPreallocatedSpaces);
-
-  return static_cast<uint32_t>(
-      MemoryAllocator::PageAreaSize(static_cast<AllocationSpace>(space)));
-}
-
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/src/snapshot/default-serializer-allocator.h b/deps/v8/src/snapshot/default-serializer-allocator.h
index b01532752adff4..e410eab565c831 100644
--- a/deps/v8/src/snapshot/default-serializer-allocator.h
+++ b/deps/v8/src/snapshot/default-serializer-allocator.h
@@ -23,6 +23,8 @@ class DefaultSerializerAllocator final {
   SerializerReference AllocateLargeObject(uint32_t size);
   SerializerReference AllocateOffHeapBackingStore();
 
+  void UseCustomChunkSize(uint32_t chunk_size);
+
 #ifdef DEBUG
   bool BackReferenceIsAlreadyAllocated(
       SerializerReference back_reference) const;
@@ -33,13 +35,15 @@ class DefaultSerializerAllocator final {
   void OutputStatistics();
 
  private:
+  // We try to not exceed this size for every chunk. We will not succeed for
+  // larger objects though.
+  uint32_t TargetChunkSize(int space);
+
   static constexpr int kNumberOfPreallocatedSpaces =
       SerializerDeserializer::kNumberOfPreallocatedSpaces;
   static constexpr int kNumberOfSpaces =
       SerializerDeserializer::kNumberOfSpaces;
 
-  static uint32_t MaxChunkSizeInSpace(int space);
-
   // Objects from the same space are put into chunks for bulk-allocation
   // when deserializing. We have to make sure that each chunk fits into a
   // page. So we track the chunk size in pending_chunk_ of a space, but
@@ -61,6 +65,8 @@ class DefaultSerializerAllocator final {
   // from index 0.
   uint32_t seen_backing_stores_index_ = 1;
 
+  uint32_t custom_chunk_size_ = 0;
+
   // The current serializer.
   Serializer<DefaultSerializerAllocator>* const serializer_;
 
diff --git a/deps/v8/src/snapshot/deserializer.cc b/deps/v8/src/snapshot/deserializer.cc
index 6436228b20beab..735fa9a7ad1bac 100644
--- a/deps/v8/src/snapshot/deserializer.cc
+++ b/deps/v8/src/snapshot/deserializer.cc
@@ -6,6 +6,7 @@
 
 #include "src/assembler-inl.h"
 #include "src/isolate.h"
+#include "src/objects/api-callbacks.h"
 #include "src/objects/hash-table.h"
 #include "src/objects/maybe-object.h"
 #include "src/objects/string.h"
@@ -72,7 +73,7 @@ void Deserializer<AllocatorT>::VisitRootPointers(Root root,
   // The space must be new space.  Any other space would cause ReadChunk to try
   // to update the remembered using nullptr as the address.
   ReadData(reinterpret_cast<MaybeObject**>(start),
-           reinterpret_cast<MaybeObject**>(end), NEW_SPACE, nullptr);
+           reinterpret_cast<MaybeObject**>(end), NEW_SPACE, kNullAddress);
 }
 
 template <class AllocatorT>
@@ -160,15 +161,19 @@ HeapObject* Deserializer<AllocatorT>::PostProcessNewObject(HeapObject* obj,
 
         if (canonical != nullptr) return canonical;
 
-        new_internalized_strings_.push_back(handle(string));
+        new_internalized_strings_.push_back(handle(string, isolate_));
         return string;
       }
     } else if (obj->IsScript()) {
-      new_scripts_.push_back(handle(Script::cast(obj)));
+      new_scripts_.push_back(handle(Script::cast(obj), isolate_));
     } else {
       DCHECK(CanBeDeferred(obj));
     }
+  } else if (obj->IsScript()) {
+    LOG(isolate_, ScriptEvent(Logger::ScriptEventType::kDeserialize,
+                              Script::cast(obj)->id()));
   }
+
   if (obj->IsAllocationSite()) {
     // Allocation sites are present in the snapshot, and must be linked into
     // a list at deserialization time.
@@ -177,7 +182,7 @@ HeapObject* Deserializer<AllocatorT>::PostProcessNewObject(HeapObject* obj,
     // as a (weak) root. If this root is relocated correctly, this becomes
     // unnecessary.
     if (isolate_->heap()->allocation_sites_list() == Smi::kZero) {
-      site->set_weak_next(isolate_->heap()->undefined_value());
+      site->set_weak_next(ReadOnlyRoots(isolate_).undefined_value());
     } else {
       site->set_weak_next(isolate_->heap()->allocation_sites_list());
     }
@@ -190,15 +195,15 @@ HeapObject* Deserializer<AllocatorT>::PostProcessNewObject(HeapObject* obj,
       new_code_objects_.push_back(Code::cast(obj));
     }
   } else if (obj->IsAccessorInfo()) {
-    if (isolate_->external_reference_redirector()) {
-      accessor_infos_.push_back(AccessorInfo::cast(obj));
-    }
+#ifdef USE_SIMULATOR
+    accessor_infos_.push_back(AccessorInfo::cast(obj));
+#endif
   } else if (obj->IsCallHandlerInfo()) {
-    if (isolate_->external_reference_redirector()) {
-      call_handler_infos_.push_back(CallHandlerInfo::cast(obj));
-    }
+#ifdef USE_SIMULATOR
+    call_handler_infos_.push_back(CallHandlerInfo::cast(obj));
+#endif
   } else if (obj->IsExternalString()) {
-    if (obj->map() == isolate_->heap()->native_source_string_map()) {
+    if (obj->map() == ReadOnlyRoots(isolate_).native_source_string_map()) {
       ExternalOneByteString* string = ExternalOneByteString::cast(obj);
       DCHECK(string->is_short());
       string->set_resource(
@@ -208,7 +213,7 @@ HeapObject* Deserializer<AllocatorT>::PostProcessNewObject(HeapObject* obj,
       ExternalString* string = ExternalString::cast(obj);
       uint32_t index = string->resource_as_uint32();
       Address address =
-          reinterpret_cast<Address>(isolate_->api_external_references()[index]);
+          static_cast<Address>(isolate_->api_external_references()[index]);
       string->set_address_as_resource(address);
     }
     isolate_->heap()->RegisterExternalString(String::cast(obj));
@@ -271,33 +276,37 @@ int Deserializer<AllocatorT>::MaybeReplaceWithDeserializeLazy(int builtin_id) {
 template <class AllocatorT>
 HeapObject* Deserializer<AllocatorT>::GetBackReferencedObject(int space) {
   HeapObject* obj;
-  SerializerReference back_reference =
-      SerializerReference::FromBitfield(source_.GetInt());
-
   switch (space) {
     case LO_SPACE:
-      obj = allocator()->GetLargeObject(back_reference.large_object_index());
+      obj = allocator()->GetLargeObject(source_.GetInt());
       break;
     case MAP_SPACE:
-      obj = allocator()->GetMap(back_reference.map_index());
+      obj = allocator()->GetMap(source_.GetInt());
       break;
-    case RO_SPACE:
+    case RO_SPACE: {
+      uint32_t chunk_index = source_.GetInt();
+      uint32_t chunk_offset = source_.GetInt();
       if (isolate()->heap()->deserialization_complete()) {
         PagedSpace* read_only_space = isolate()->heap()->read_only_space();
-        Page* page = read_only_space->FirstPage();
-        for (uint32_t i = 0; i < back_reference.chunk_index(); ++i) {
+        Page* page = read_only_space->first_page();
+        for (uint32_t i = 0; i < chunk_index; ++i) {
           page = page->next_page();
         }
-        Address address = page->OffsetToAddress(back_reference.chunk_offset());
+        Address address = page->OffsetToAddress(chunk_offset);
         obj = HeapObject::FromAddress(address);
-        break;
+      } else {
+        obj = allocator()->GetObject(static_cast<AllocationSpace>(space),
+                                     chunk_index, chunk_offset);
       }
-      V8_FALLTHROUGH;
-    default:
+      break;
+    }
+    default: {
+      uint32_t chunk_index = source_.GetInt();
+      uint32_t chunk_offset = source_.GetInt();
       obj = allocator()->GetObject(static_cast<AllocationSpace>(space),
-                                   back_reference.chunk_index(),
-                                   back_reference.chunk_offset());
+                                   chunk_index, chunk_offset);
       break;
+    }
   }
 
   if (deserializing_user_code() && obj->IsThinString()) {
@@ -353,7 +362,7 @@ Object* Deserializer<AllocatorT>::ReadDataSingle() {
   MaybeObject** start = &o;
   MaybeObject** end = start + 1;
   int source_space = NEW_SPACE;
-  Address current_object = nullptr;
+  Address current_object = kNullAddress;
 
   CHECK(ReadData(start, end, source_space, current_object));
   HeapObject* heap_object;
@@ -380,7 +389,7 @@ bool Deserializer<AllocatorT>::ReadData(MaybeObject** current,
   // are no new space objects in current boot snapshots, so it's not needed,
   // but that may change.
   bool write_barrier_needed =
-      (current_object_address != nullptr && source_space != NEW_SPACE &&
+      (current_object_address != kNullAddress && source_space != NEW_SPACE &&
        source_space != CODE_SPACE);
   while (current < limit) {
     byte data = source_.Get();
@@ -488,7 +497,7 @@ bool Deserializer<AllocatorT>::ReadData(MaybeObject** current,
       case kSkip: {
         int size = source_.GetInt();
         current = reinterpret_cast<MaybeObject**>(
-            reinterpret_cast<intptr_t>(current) + size);
+            reinterpret_cast<Address>(current) + size);
         break;
       }
 
@@ -528,7 +537,7 @@ bool Deserializer<AllocatorT>::ReadData(MaybeObject** current,
       }
 
       case kOffHeapTarget: {
-#ifdef V8_EMBEDDED_BUILTINS
+        DCHECK(FLAG_embedded_builtins);
         int skip = source_.GetInt();
         int builtin_index = source_.GetInt();
         DCHECK(Builtins::IsBuiltinId(builtin_index));
@@ -538,26 +547,24 @@ bool Deserializer<AllocatorT>::ReadData(MaybeObject** current,
 
         CHECK_NOT_NULL(isolate->embedded_blob());
         EmbeddedData d = EmbeddedData::FromBlob();
-        const uint8_t* address = d.InstructionStartOfBuiltin(builtin_index);
-        CHECK_NOT_NULL(address);
+        Address address = d.InstructionStartOfBuiltin(builtin_index);
+        CHECK_NE(kNullAddress, address);
 
         if (RelocInfo::OffHeapTargetIsCodedSpecially()) {
           Address location_of_branch_data = reinterpret_cast<Address>(current);
+          int skip = Assembler::deserialization_special_target_size(
+              location_of_branch_data);
           Assembler::deserialization_set_special_target_at(
               location_of_branch_data,
               Code::cast(HeapObject::FromAddress(current_object_address)),
-              const_cast<Address>(address));
-          location_of_branch_data += Assembler::kSpecialTargetSize;
+              address);
+          location_of_branch_data += skip;
           current = reinterpret_cast<MaybeObject**>(location_of_branch_data);
         } else {
-          MaybeObject* o =
-              reinterpret_cast<MaybeObject*>(const_cast<uint8_t*>(address));
+          MaybeObject* o = reinterpret_cast<MaybeObject*>(address);
           UnalignedCopy(current, &o);
           current++;
         }
-#else
-        UNREACHABLE();
-#endif
         break;
       }
 
@@ -601,15 +608,16 @@ bool Deserializer<AllocatorT>::ReadData(MaybeObject** current,
       // Do not move current.
       case kVariableRawCode: {
         int size_in_bytes = source_.GetInt();
-        source_.CopyRaw(current_object_address + Code::kDataStart,
-                        size_in_bytes);
+        source_.CopyRaw(
+            reinterpret_cast<byte*>(current_object_address + Code::kDataStart),
+            size_in_bytes);
         break;
       }
 
       case kVariableRepeat: {
         int repeats = source_.GetInt();
         MaybeObject* object = current[-1];
-        DCHECK(!isolate->heap()->InNewSpace(object));
+        DCHECK(!Heap::InNewSpace(object));
         DCHECK(!allocator()->next_reference_is_weak());
         for (int i = 0; i < repeats; i++) UnalignedCopy(current++, &object);
         break;
@@ -636,7 +644,7 @@ bool Deserializer<AllocatorT>::ReadData(MaybeObject** current,
           DCHECK_WITH_MSG(
               reference_id < num_api_references_,
               "too few external references provided through the API");
-          address = reinterpret_cast<Address>(
+          address = static_cast<Address>(
               isolate->api_external_references()[reference_id]);
         } else {
           address = reinterpret_cast<Address>(NoExternalReferencesCallback);
@@ -675,7 +683,7 @@ bool Deserializer<AllocatorT>::ReadData(MaybeObject** current,
         Heap::RootListIndex root_index = static_cast<Heap::RootListIndex>(id);
         MaybeObject* object =
             MaybeObject::FromObject(isolate->heap()->root(root_index));
-        DCHECK(!isolate->heap()->InNewSpace(object));
+        DCHECK(!Heap::InNewSpace(object));
         DCHECK(!allocator()->next_reference_is_weak());
         UnalignedCopy(current++, &object);
         break;
@@ -700,7 +708,7 @@ bool Deserializer<AllocatorT>::ReadData(MaybeObject** current,
         }
 
         UnalignedCopy(current, &hot_maybe_object);
-        if (write_barrier_needed && isolate->heap()->InNewSpace(hot_object)) {
+        if (write_barrier_needed && Heap::InNewSpace(hot_object)) {
           Address current_address = reinterpret_cast<Address>(current);
           isolate->heap()->RecordWrite(
               HeapObject::FromAddress(current_object_address),
@@ -728,7 +736,7 @@ bool Deserializer<AllocatorT>::ReadData(MaybeObject** current,
         MaybeObject* object;
         DCHECK(!allocator()->next_reference_is_weak());
         UnalignedCopy(&object, current - 1);
-        DCHECK(!isolate->heap()->InNewSpace(object));
+        DCHECK(!Heap::InNewSpace(object));
         for (int i = 0; i < repeats; i++) UnalignedCopy(current++, &object);
         break;
       }
@@ -750,24 +758,6 @@ bool Deserializer<AllocatorT>::ReadData(MaybeObject** current,
   return true;
 }
 
-namespace {
-
-int FixupJSConstructStub(Isolate* isolate, int builtin_id) {
-  if (isolate->serializer_enabled()) return builtin_id;
-
-  if (FLAG_harmony_restrict_constructor_return &&
-      builtin_id == Builtins::kJSConstructStubGenericUnrestrictedReturn) {
-    return Builtins::kJSConstructStubGenericRestrictedReturn;
-  } else if (!FLAG_harmony_restrict_constructor_return &&
-             builtin_id == Builtins::kJSConstructStubGenericRestrictedReturn) {
-    return Builtins::kJSConstructStubGenericUnrestrictedReturn;
-  } else {
-    return builtin_id;
-  }
-}
-
-}  // namespace
-
 template <class AllocatorT>
 void** Deserializer<AllocatorT>::ReadExternalReferenceCase(
     HowToCode how, Isolate* isolate, void** current,
@@ -779,10 +769,12 @@ void** Deserializer<AllocatorT>::ReadExternalReferenceCase(
 
   if (how == kFromCode) {
     Address location_of_branch_data = reinterpret_cast<Address>(current);
+    int skip =
+        Assembler::deserialization_special_target_size(location_of_branch_data);
     Assembler::deserialization_set_special_target_at(
         location_of_branch_data,
         Code::cast(HeapObject::FromAddress(current_object_address)), address);
-    location_of_branch_data += Assembler::kSpecialTargetSize;
+    location_of_branch_data += skip;
     current = reinterpret_cast<void**>(location_of_branch_data);
   } else {
     void* new_current = reinterpret_cast<void**>(address);
@@ -826,20 +818,19 @@ MaybeObject** Deserializer<AllocatorT>::ReadDataCase(
       int id = source_.GetInt();
       Heap::RootListIndex root_index = static_cast<Heap::RootListIndex>(id);
       new_object = isolate->heap()->root(root_index);
-      emit_write_barrier = isolate->heap()->InNewSpace(new_object);
+      emit_write_barrier = Heap::InNewSpace(new_object);
       hot_objects_.Add(HeapObject::cast(new_object));
     } else if (where == kPartialSnapshotCache) {
       int cache_index = source_.GetInt();
       new_object = isolate->partial_snapshot_cache()->at(cache_index);
-      emit_write_barrier = isolate->heap()->InNewSpace(new_object);
+      emit_write_barrier = Heap::InNewSpace(new_object);
     } else if (where == kAttachedReference) {
       int index = source_.GetInt();
       new_object = *attached_objects_[index];
-      emit_write_barrier = isolate->heap()->InNewSpace(new_object);
+      emit_write_barrier = Heap::InNewSpace(new_object);
     } else {
       DCHECK_EQ(where, kBuiltin);
-      int raw_id = MaybeReplaceWithDeserializeLazy(source_.GetInt());
-      int builtin_id = FixupJSConstructStub(isolate, raw_id);
+      int builtin_id = MaybeReplaceWithDeserializeLazy(source_.GetInt());
       new_object = isolate->builtins()->builtin(builtin_id);
       emit_write_barrier = false;
     }
@@ -861,11 +852,13 @@ MaybeObject** Deserializer<AllocatorT>::ReadDataCase(
     if (how == kFromCode) {
       DCHECK(!allocator()->next_reference_is_weak());
       Address location_of_branch_data = reinterpret_cast<Address>(current);
+      int skip = Assembler::deserialization_special_target_size(
+          location_of_branch_data);
       Assembler::deserialization_set_special_target_at(
           location_of_branch_data,
           Code::cast(HeapObject::FromAddress(current_object_address)),
           reinterpret_cast<Address>(new_object));
-      location_of_branch_data += Assembler::kSpecialTargetSize;
+      location_of_branch_data += skip;
       current = reinterpret_cast<MaybeObject**>(location_of_branch_data);
       current_was_incremented = true;
     } else {
diff --git a/deps/v8/src/snapshot/embedded-empty.cc b/deps/v8/src/snapshot/embedded-empty.cc
index 3294a6788ecd89..77e83b73ce4ac1 100644
--- a/deps/v8/src/snapshot/embedded-empty.cc
+++ b/deps/v8/src/snapshot/embedded-empty.cc
@@ -9,7 +9,6 @@
 namespace v8 {
 namespace internal {
 
-#ifdef V8_EMBEDDED_BUILTINS
 const uint8_t* DefaultEmbeddedBlob() { return nullptr; }
 uint32_t DefaultEmbeddedBlobSize() { return 0; }
 
@@ -18,7 +17,5 @@ const uint8_t* TrustedEmbeddedBlob() { return nullptr; }
 uint32_t TrustedEmbeddedBlobSize() { return 0; }
 #endif
 
-#endif
-
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/src/snapshot/mksnapshot.cc b/deps/v8/src/snapshot/mksnapshot.cc
index c862d63090c510..1cf0bfa9a5b4f1 100644
--- a/deps/v8/src/snapshot/mksnapshot.cc
+++ b/deps/v8/src/snapshot/mksnapshot.cc
@@ -7,7 +7,7 @@
 #include <stdio.h>
 
 #include "include/libplatform/libplatform.h"
-#include "src/assembler.h"
+#include "src/assembler-arch.h"
 #include "src/base/platform/platform.h"
 #include "src/flags.h"
 #include "src/msan.h"
@@ -22,7 +22,6 @@ class SnapshotWriter {
   SnapshotWriter()
       : snapshot_cpp_path_(nullptr), snapshot_blob_path_(nullptr) {}
 
-#ifdef V8_EMBEDDED_BUILTINS
   void SetEmbeddedFile(const char* embedded_cpp_file) {
     embedded_cpp_path_ = embedded_cpp_file;
   }
@@ -30,7 +29,6 @@ class SnapshotWriter {
   void SetEmbeddedVariant(const char* embedded_variant) {
     embedded_variant_ = embedded_variant;
   }
-#endif
 
   void SetSnapshotFile(const char* snapshot_cpp_file) {
     snapshot_cpp_path_ = snapshot_cpp_file;
@@ -51,11 +49,9 @@ class SnapshotWriter {
     MaybeWriteStartupBlob(blob_vector);
   }
 
-#ifdef V8_EMBEDDED_BUILTINS
   void WriteEmbedded(const i::EmbeddedData* blob) const {
     MaybeWriteEmbeddedFile(blob);
   }
-#endif
 
  private:
   void MaybeWriteStartupBlob(const i::Vector<const i::byte>& blob) const {
@@ -120,7 +116,6 @@ class SnapshotWriter {
     fprintf(fp, "\n");
   }
 
-#ifdef V8_EMBEDDED_BUILTINS
   void MaybeWriteEmbeddedFile(const i::EmbeddedData* blob) const {
     if (embedded_cpp_path_ == nullptr) return;
 
@@ -207,7 +202,6 @@ class SnapshotWriter {
     if (current_line_length != 0) fprintf(fp, "\\n\"\n");
     fprintf(fp, ");\n");
   }
-#endif
 
   static FILE* GetFileDescriptorOrDie(const char* filename) {
     FILE* fp = v8::base::OS::FOpen(filename, "wb");
@@ -218,10 +212,8 @@ class SnapshotWriter {
     return fp;
   }
 
-#ifdef V8_EMBEDDED_BUILTINS
   const char* embedded_cpp_path_ = nullptr;
   const char* embedded_variant_ = "Default";
-#endif
   const char* snapshot_cpp_path_;
   const char* snapshot_blob_path_;
 };
@@ -349,14 +341,12 @@ v8::StartupData WarmUpSnapshotDataBlob(v8::SnapshotCreator* snapshot_creator,
   return result;
 }
 
-#ifdef V8_EMBEDDED_BUILTINS
 void WriteEmbeddedFile(v8::SnapshotCreator* creator, SnapshotWriter* writer) {
   i::Isolate* isolate = reinterpret_cast<i::Isolate*>(creator->GetIsolate());
   isolate->PrepareEmbeddedBlobForSerialization();
   i::EmbeddedData embedded_blob = i::EmbeddedData::FromBlob();
   writer->WriteEmbedded(&embedded_blob);
 }
-#endif  // V8_EMBEDDED_BUILTINS
 }  // namespace
 
 int main(int argc, char** argv) {
@@ -385,11 +375,11 @@ int main(int argc, char** argv) {
     SnapshotWriter writer;
     if (i::FLAG_startup_src) writer.SetSnapshotFile(i::FLAG_startup_src);
     if (i::FLAG_startup_blob) writer.SetStartupBlobFile(i::FLAG_startup_blob);
-#ifdef V8_EMBEDDED_BUILTINS
-    if (i::FLAG_embedded_src) writer.SetEmbeddedFile(i::FLAG_embedded_src);
-    if (i::FLAG_embedded_variant)
-      writer.SetEmbeddedVariant(i::FLAG_embedded_variant);
-#endif
+    if (i::FLAG_embedded_builtins) {
+      if (i::FLAG_embedded_src) writer.SetEmbeddedFile(i::FLAG_embedded_src);
+      if (i::FLAG_embedded_variant)
+        writer.SetEmbeddedVariant(i::FLAG_embedded_variant);
+    }
 
     std::unique_ptr<char> embed_script(
         GetExtraCode(argc >= 2 ? argv[1] : nullptr, "embedding"));
@@ -398,14 +388,23 @@ int main(int argc, char** argv) {
 
     v8::StartupData blob;
     {
-      v8::SnapshotCreator snapshot_creator;
-#ifdef V8_EMBEDDED_BUILTINS
-      // This process is a bit tricky since we might go on to make a second
-      // snapshot if a warmup script is passed. In that case, create the first
-      // snapshot without off-heap trampolines and only move code off-heap for
-      // the warmed-up snapshot.
-      if (!warmup_script) WriteEmbeddedFile(&snapshot_creator, &writer);
-#endif
+      v8::Isolate* isolate = v8::Isolate::Allocate();
+      if (i::FLAG_embedded_builtins) {
+        // Set code range such that relative jumps for builtins to
+        // builtin calls in the snapshot are possible.
+        i::Isolate* i_isolate = reinterpret_cast<i::Isolate*>(isolate);
+        size_t code_range_size = std::min(i::kMaximalCodeRangeSize / i::MB,
+                                          i::kMaxPCRelativeCodeRangeInMB);
+        i_isolate->heap()->ConfigureHeap(0, 0, code_range_size);
+      }
+      v8::SnapshotCreator snapshot_creator(isolate);
+      if (i::FLAG_embedded_builtins) {
+        // This process is a bit tricky since we might go on to make a second
+        // snapshot if a warmup script is passed. In that case, create the first
+        // snapshot without off-heap trampolines and only move code off-heap for
+        // the warmed-up snapshot.
+        if (!warmup_script) WriteEmbeddedFile(&snapshot_creator, &writer);
+      }
       blob = CreateSnapshotDataBlob(&snapshot_creator, embed_script.get());
     }
 
@@ -413,9 +412,9 @@ int main(int argc, char** argv) {
       CHECK(blob.raw_size > 0 && blob.data != nullptr);
       v8::StartupData cold = blob;
       v8::SnapshotCreator snapshot_creator(nullptr, &cold);
-#ifdef V8_EMBEDDED_BUILTINS
-      WriteEmbeddedFile(&snapshot_creator, &writer);
-#endif
+      if (i::FLAG_embedded_builtins) {
+        WriteEmbeddedFile(&snapshot_creator, &writer);
+      }
       blob = WarmUpSnapshotDataBlob(&snapshot_creator, warmup_script.get());
       delete[] cold.data;
     }
diff --git a/deps/v8/src/snapshot/object-deserializer.cc b/deps/v8/src/snapshot/object-deserializer.cc
index 1769f9ca2436bf..716b6f9729838d 100644
--- a/deps/v8/src/snapshot/object-deserializer.cc
+++ b/deps/v8/src/snapshot/object-deserializer.cc
@@ -9,7 +9,6 @@
 #include "src/isolate.h"
 #include "src/objects.h"
 #include "src/snapshot/code-serializer.h"
-#include "src/wasm/wasm-objects.h"
 
 namespace v8 {
 namespace internal {
@@ -33,38 +32,6 @@ ObjectDeserializer::DeserializeSharedFunctionInfo(
              : MaybeHandle<SharedFunctionInfo>();
 }
 
-MaybeHandle<WasmCompiledModule>
-ObjectDeserializer::DeserializeWasmCompiledModule(
-    Isolate* isolate, const SerializedCodeData* data,
-    Vector<const byte> wire_bytes) {
-  ObjectDeserializer d(data);
-
-  d.AddAttachedObject(isolate->native_context());
-
-  MaybeHandle<String> maybe_wire_bytes_as_string =
-      isolate->factory()->NewStringFromOneByte(wire_bytes, TENURED);
-  Handle<String> wire_bytes_as_string;
-  if (!maybe_wire_bytes_as_string.ToHandle(&wire_bytes_as_string)) {
-    return MaybeHandle<WasmCompiledModule>();
-  }
-  d.AddAttachedObject(wire_bytes_as_string);
-
-  Vector<const uint32_t> code_stub_keys = data->CodeStubKeys();
-  for (int i = 0; i < code_stub_keys.length(); i++) {
-    d.AddAttachedObject(
-        CodeStub::GetCode(isolate, code_stub_keys[i]).ToHandleChecked());
-  }
-
-  Handle<HeapObject> result;
-  if (!d.Deserialize(isolate).ToHandle(&result))
-    return MaybeHandle<WasmCompiledModule>();
-
-  if (!result->IsWasmCompiledModule()) return MaybeHandle<WasmCompiledModule>();
-
-  // Cast without type checks, as the module wrapper is not there yet.
-  return handle(static_cast<WasmCompiledModule*>(*result), isolate);
-}
-
 MaybeHandle<HeapObject> ObjectDeserializer::Deserialize(Isolate* isolate) {
   Initialize(isolate);
 
@@ -79,7 +46,7 @@ MaybeHandle<HeapObject> ObjectDeserializer::Deserialize(Isolate* isolate) {
     VisitRootPointer(Root::kPartialSnapshotCache, nullptr, &root);
     DeserializeDeferredObjects();
     FlushICacheForNewCodeObjectsAndRecordEmbeddedObjects();
-    result = Handle<HeapObject>(HeapObject::cast(root));
+    result = handle(HeapObject::cast(root), isolate);
     Rehash();
     allocator()->RegisterDeserializedObjectsForBlackAllocation();
   }
@@ -114,9 +81,11 @@ void ObjectDeserializer::CommitPostProcessedObjects() {
   for (Handle<Script> script : new_scripts()) {
     // Assign a new script id to avoid collision.
     script->set_id(isolate()->heap()->NextScriptId());
+    LOG(isolate(),
+        ScriptEvent(Logger::ScriptEventType::kDeserialize, script->id()));
     // Add script to list.
     Handle<Object> list =
-        FixedArrayOfWeakCells::Add(factory->script_list(), script);
+        FixedArrayOfWeakCells::Add(isolate(), factory->script_list(), script);
     heap->SetRootScriptList(*list);
   }
 }
diff --git a/deps/v8/src/snapshot/object-deserializer.h b/deps/v8/src/snapshot/object-deserializer.h
index 8f236f5f20c072..1e8bf1b64903d6 100644
--- a/deps/v8/src/snapshot/object-deserializer.h
+++ b/deps/v8/src/snapshot/object-deserializer.h
@@ -12,7 +12,6 @@ namespace internal {
 
 class SerializedCodeData;
 class SharedFunctionInfo;
-class WasmCompiledModule;
 
 // Deserializes the object graph rooted at a given object.
 class ObjectDeserializer final : public Deserializer<> {
@@ -20,10 +19,6 @@ class ObjectDeserializer final : public Deserializer<> {
   static MaybeHandle<SharedFunctionInfo> DeserializeSharedFunctionInfo(
       Isolate* isolate, const SerializedCodeData* data, Handle<String> source);
 
-  static MaybeHandle<WasmCompiledModule> DeserializeWasmCompiledModule(
-      Isolate* isolate, const SerializedCodeData* data,
-      Vector<const byte> wire_bytes);
-
  private:
   explicit ObjectDeserializer(const SerializedCodeData* data)
       : Deserializer(data, true) {}
diff --git a/deps/v8/src/snapshot/partial-deserializer.cc b/deps/v8/src/snapshot/partial-deserializer.cc
index afa6aa5fc5eae3..626106a3532926 100644
--- a/deps/v8/src/snapshot/partial-deserializer.cc
+++ b/deps/v8/src/snapshot/partial-deserializer.cc
@@ -39,7 +39,7 @@ MaybeHandle<Object> PartialDeserializer::Deserialize(
   DisallowHeapAllocation no_gc;
   // Keep track of the code space start and end pointers in case new
   // code objects were unserialized
-  OldSpace* code_space = isolate->heap()->code_space();
+  CodeSpace* code_space = isolate->heap()->code_space();
   Address start_address = code_space->top();
   Object* root;
   VisitRootPointer(Root::kPartialSnapshotCache, nullptr, &root);
diff --git a/deps/v8/src/snapshot/partial-serializer.cc b/deps/v8/src/snapshot/partial-serializer.cc
index 8b4c9d8d922406..5161629fa47020 100644
--- a/deps/v8/src/snapshot/partial-serializer.cc
+++ b/deps/v8/src/snapshot/partial-serializer.cc
@@ -20,6 +20,7 @@ PartialSerializer::PartialSerializer(
       can_be_rehashed_(true),
       context_(nullptr) {
   InitializeCodeAddressMap();
+  allocator()->UseCustomChunkSize(FLAG_serialization_chunk_size);
 }
 
 PartialSerializer::~PartialSerializer() {
@@ -36,11 +37,11 @@ void PartialSerializer::Serialize(Context** o, bool include_global_proxy) {
   // it before serializing, it will get re-added to the context list
   // explicitly when it's loaded.
   context_->set(Context::NEXT_CONTEXT_LINK,
-                isolate()->heap()->undefined_value());
-  DCHECK(!context_->global_object()->IsUndefined(context_->GetIsolate()));
+                ReadOnlyRoots(isolate()).undefined_value());
+  DCHECK(!context_->global_object()->IsUndefined());
   // Reset math random cache to get fresh random numbers.
   context_->set_math_random_index(Smi::kZero);
-  context_->set_math_random_cache(isolate()->heap()->undefined_value());
+  context_->set_math_random_cache(ReadOnlyRoots(isolate()).undefined_value());
 
   VisitRootPointer(Root::kPartialSnapshotCache, nullptr,
                    reinterpret_cast<Object**>(o));
@@ -105,7 +106,7 @@ void PartialSerializer::SerializeObject(HeapObject* obj, HowToCode how_to_code,
     // Unconditionally reset the JSFunction to its SFI's code, since we can't
     // serialize optimized code anyway.
     JSFunction* closure = JSFunction::cast(obj);
-    closure->set_code(closure->shared()->GetCode());
+    if (closure->is_compiled()) closure->set_code(closure->shared()->GetCode());
   }
 
   CheckRehashability(obj);
@@ -124,8 +125,8 @@ bool PartialSerializer::ShouldBeInThePartialSnapshotCache(HeapObject* o) {
   return o->IsName() || o->IsSharedFunctionInfo() || o->IsHeapNumber() ||
          o->IsCode() || o->IsScopeInfo() || o->IsAccessorInfo() ||
          o->IsTemplateInfo() ||
-         o->map() ==
-             startup_serializer_->isolate()->heap()->fixed_cow_array_map();
+         o->map() == ReadOnlyRoots(startup_serializer_->isolate())
+                         .fixed_cow_array_map();
 }
 
 void PartialSerializer::SerializeEmbedderFields() {
@@ -139,7 +140,7 @@ void PartialSerializer::SerializeEmbedderFields() {
     HandleScope scope(isolate());
     Handle<JSObject> obj(embedder_field_holders_.back(), isolate());
     embedder_field_holders_.pop_back();
-    SerializerReference reference = reference_map()->Lookup(*obj);
+    SerializerReference reference = reference_map()->LookupReference(*obj);
     DCHECK(reference.is_back_reference());
     int embedder_fields_count = obj->GetEmbedderFieldCount();
     for (int i = 0; i < embedder_fields_count; i++) {
diff --git a/deps/v8/src/snapshot/references.h b/deps/v8/src/snapshot/references.h
new file mode 100644
index 00000000000000..6beb2065c1196a
--- /dev/null
+++ b/deps/v8/src/snapshot/references.h
@@ -0,0 +1,197 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef V8_SNAPSHOT_REFERENCES_H_
+#define V8_SNAPSHOT_REFERENCES_H_
+
+#include "src/assert-scope.h"
+#include "src/base/hashmap.h"
+#include "src/utils.h"
+
+namespace v8 {
+namespace internal {
+
+class SerializerReference {
+ private:
+  enum SpecialValueType {
+    kInvalidValue,
+    kAttachedReference,
+    kOffHeapBackingStore,
+    kBuiltinReference,
+  };
+
+  static const int kSpecialValueSpace = LAST_SPACE + 1;
+  STATIC_ASSERT(kSpecialValueSpace < (1 << kSpaceTagSize));
+
+  SerializerReference(SpecialValueType type, uint32_t value)
+      : bitfield_(SpaceBits::encode(kSpecialValueSpace) |
+                  SpecialValueTypeBits::encode(type)),
+        value_(value) {}
+
+ public:
+  SerializerReference() : SerializerReference(kInvalidValue, 0) {}
+
+  SerializerReference(uint32_t space, uint32_t chunk_index,
+                      uint32_t chunk_offset)
+      : bitfield_(SpaceBits::encode(space) |
+                  ChunkIndexBits::encode(chunk_index)),
+        value_(chunk_offset) {}
+
+  static SerializerReference BackReference(AllocationSpace space,
+                                           uint32_t chunk_index,
+                                           uint32_t chunk_offset) {
+    DCHECK(IsAligned(chunk_offset, kObjectAlignment));
+    DCHECK_LT(space, LO_SPACE);
+    return SerializerReference(space, chunk_index, chunk_offset);
+  }
+
+  static SerializerReference MapReference(uint32_t index) {
+    return SerializerReference(MAP_SPACE, 0, index);
+  }
+
+  static SerializerReference OffHeapBackingStoreReference(uint32_t index) {
+    return SerializerReference(kOffHeapBackingStore, index);
+  }
+
+  static SerializerReference LargeObjectReference(uint32_t index) {
+    return SerializerReference(LO_SPACE, 0, index);
+  }
+
+  static SerializerReference AttachedReference(uint32_t index) {
+    return SerializerReference(kAttachedReference, index);
+  }
+
+  static SerializerReference BuiltinReference(uint32_t index) {
+    return SerializerReference(kBuiltinReference, index);
+  }
+
+  bool is_valid() const {
+    return SpaceBits::decode(bitfield_) != kSpecialValueSpace ||
+           SpecialValueTypeBits::decode(bitfield_) != kInvalidValue;
+  }
+
+  bool is_back_reference() const {
+    return SpaceBits::decode(bitfield_) <= LAST_SPACE;
+  }
+
+  AllocationSpace space() const {
+    DCHECK(is_back_reference());
+    return static_cast<AllocationSpace>(SpaceBits::decode(bitfield_));
+  }
+
+  uint32_t chunk_offset() const {
+    DCHECK(is_back_reference());
+    return value_;
+  }
+
+  uint32_t chunk_index() const {
+    DCHECK(space() != MAP_SPACE && space() != LO_SPACE);
+    return ChunkIndexBits::decode(bitfield_);
+  }
+
+  uint32_t map_index() const {
+    DCHECK_EQ(MAP_SPACE, SpaceBits::decode(bitfield_));
+    return value_;
+  }
+
+  bool is_off_heap_backing_store_reference() const {
+    return SpaceBits::decode(bitfield_) == kSpecialValueSpace &&
+           SpecialValueTypeBits::decode(bitfield_) == kOffHeapBackingStore;
+  }
+
+  uint32_t off_heap_backing_store_index() const {
+    DCHECK(is_off_heap_backing_store_reference());
+    return value_;
+  }
+
+  uint32_t large_object_index() const {
+    DCHECK_EQ(LO_SPACE, SpaceBits::decode(bitfield_));
+    return value_;
+  }
+
+  bool is_attached_reference() const {
+    return SpaceBits::decode(bitfield_) == kSpecialValueSpace &&
+           SpecialValueTypeBits::decode(bitfield_) == kAttachedReference;
+  }
+
+  uint32_t attached_reference_index() const {
+    DCHECK(is_attached_reference());
+    return value_;
+  }
+
+  bool is_builtin_reference() const {
+    return SpaceBits::decode(bitfield_) == kSpecialValueSpace &&
+           SpecialValueTypeBits::decode(bitfield_) == kBuiltinReference;
+  }
+
+  uint32_t builtin_index() const {
+    DCHECK(is_builtin_reference());
+    return value_;
+  }
+
+ private:
+  class SpaceBits : public BitField<int, 0, kSpaceTagSize> {};
+  class ChunkIndexBits
+      : public BitField<uint32_t, SpaceBits::kNext, 32 - kSpaceTagSize> {};
+  class SpecialValueTypeBits
+      : public BitField<SpecialValueType, SpaceBits::kNext,
+                        32 - kSpaceTagSize> {};
+
+  // We use two fields to store a reference.
+  // In case of a normal back reference, the bitfield_ stores the space and
+  // the chunk index. In case of special references, it uses a special value
+  // for space and stores the special value type.
+  uint32_t bitfield_;
+  // value_ stores either chunk offset or special value.
+  uint32_t value_;
+
+  friend class SerializerReferenceMap;
+};
+
+class SerializerReferenceMap
+    : public base::TemplateHashMapImpl<uintptr_t, SerializerReference,
+                                       base::KeyEqualityMatcher<intptr_t>,
+                                       base::DefaultAllocationPolicy> {
+ public:
+  typedef base::TemplateHashMapEntry<uintptr_t, SerializerReference> Entry;
+
+  SerializerReferenceMap() : no_allocation_(), attached_reference_index_(0) {}
+
+  SerializerReference LookupReference(void* value) const {
+    uintptr_t key = Key(value);
+    Entry* entry = Lookup(key, Hash(key));
+    if (entry == nullptr) return SerializerReference();
+    return entry->value;
+  }
+
+  void Add(void* obj, SerializerReference reference) {
+    DCHECK(reference.is_valid());
+    DCHECK(!LookupReference(obj).is_valid());
+    uintptr_t key = Key(obj);
+    LookupOrInsert(key, Hash(key))->value = reference;
+  }
+
+  SerializerReference AddAttachedReference(void* attached_reference) {
+    SerializerReference reference =
+        SerializerReference::AttachedReference(attached_reference_index_++);
+    Add(attached_reference, reference);
+    return reference;
+  }
+
+ private:
+  static inline uintptr_t Key(void* value) {
+    return reinterpret_cast<uintptr_t>(value);
+  }
+
+  static uint32_t Hash(uintptr_t key) { return static_cast<uint32_t>(key); }
+
+  DisallowHeapAllocation no_allocation_;
+  int attached_reference_index_;
+  DISALLOW_COPY_AND_ASSIGN(SerializerReferenceMap);
+};
+
+}  // namespace internal
+}  // namespace v8
+
+#endif  // V8_SNAPSHOT_REFERENCES_H_
diff --git a/deps/v8/src/snapshot/serializer-common.cc b/deps/v8/src/snapshot/serializer-common.cc
index d4f0c9eff72a92..d5a8cf1273b328 100644
--- a/deps/v8/src/snapshot/serializer-common.cc
+++ b/deps/v8/src/snapshot/serializer-common.cc
@@ -34,7 +34,7 @@ ExternalReferenceEncoder::ExternalReferenceEncoder(Isolate* isolate) {
   const intptr_t* api_references = isolate->api_external_references();
   if (api_references == nullptr) return;
   for (uint32_t i = 0; api_references[i] != 0; ++i) {
-    Address addr = reinterpret_cast<Address>(api_references[i]);
+    Address addr = static_cast<Address>(api_references[i]);
     // Ignore duplicate references.
     // This can happen due to ICF. See http://crbug.com/726896.
     if (map_->Get(addr).IsNothing()) map_->Set(addr, Value::Encode(i, true));
@@ -47,10 +47,11 @@ ExternalReferenceEncoder::~ExternalReferenceEncoder() {
   if (!i::FLAG_external_reference_stats) return;
   if (api_references_ == nullptr) return;
   for (uint32_t i = 0; api_references_[i] != 0; ++i) {
-    Address addr = reinterpret_cast<Address>(api_references_[i]);
+    Address addr = static_cast<Address>(api_references_[i]);
     DCHECK(map_->Get(addr).IsJust());
-    v8::base::OS::Print("index=%5d count=%5d  %-60s\n", i, count_[i],
-                        ExternalReferenceTable::ResolveSymbol(addr));
+    v8::base::OS::Print(
+        "index=%5d count=%5d  %-60s\n", i, count_[i],
+        ExternalReferenceTable::ResolveSymbol(reinterpret_cast<void*>(addr)));
   }
 #endif  // DEBUG
 }
@@ -70,7 +71,7 @@ ExternalReferenceEncoder::Value ExternalReferenceEncoder::Encode(
     Address address) {
   Maybe<uint32_t> maybe_index = map_->Get(address);
   if (maybe_index.IsNothing()) {
-    void* addr = address;
+    void* addr = reinterpret_cast<void*>(address);
     v8::base::OS::PrintError("Unknown external reference %p.\n", addr);
     v8::base::OS::PrintError("%s", ExternalReferenceTable::ResolveSymbol(addr));
     v8::base::OS::Abort();
@@ -86,8 +87,9 @@ const char* ExternalReferenceEncoder::NameOfAddress(Isolate* isolate,
                                                     Address address) const {
   Maybe<uint32_t> maybe_index = map_->Get(address);
   if (maybe_index.IsNothing()) return "<unknown>";
-  return isolate->heap()->external_reference_table()->name(
-      maybe_index.FromJust());
+  Value value(maybe_index.FromJust());
+  if (value.is_from_api()) return "<from api>";
+  return isolate->heap()->external_reference_table()->name(value.index());
 }
 
 void SerializedData::AllocateData(uint32_t size) {
diff --git a/deps/v8/src/snapshot/serializer-common.h b/deps/v8/src/snapshot/serializer-common.h
index 26c2da2247a481..f4db5513bb1a2b 100644
--- a/deps/v8/src/snapshot/serializer-common.h
+++ b/deps/v8/src/snapshot/serializer-common.h
@@ -9,12 +9,14 @@
 #include "src/base/bits.h"
 #include "src/external-reference-table.h"
 #include "src/globals.h"
+#include "src/snapshot/references.h"
 #include "src/utils.h"
 #include "src/visitors.h"
 
 namespace v8 {
 namespace internal {
 
+class CallHandlerInfo;
 class Isolate;
 
 class ExternalReferenceEncoder {
@@ -29,7 +31,6 @@ class ExternalReferenceEncoder {
 
     bool is_from_api() const { return IsFromAPI::decode(value_); }
     uint32_t index() const { return Index::decode(value_); }
-    uint32_t raw() const { return value_; }
 
    private:
     class Index : public BitField<uint32_t, 0, 31> {};
@@ -105,8 +106,12 @@ class SerializerDeserializer : public RootVisitor {
   // No reservation for large object space necessary.
   // We also handle map space differenly.
   STATIC_ASSERT(MAP_SPACE == CODE_SPACE + 1);
+
+  // We do not support young generation large objects.
+  STATIC_ASSERT(LAST_SPACE == NEW_LO_SPACE);
+  STATIC_ASSERT(LAST_SPACE - 1 == LO_SPACE);
   static const int kNumberOfPreallocatedSpaces = CODE_SPACE + 1;
-  static const int kNumberOfSpaces = LAST_SPACE + 1;
+  static const int kNumberOfSpaces = LO_SPACE + 1;
 
  protected:
   static bool CanBeDeferred(HeapObject* o);
@@ -319,11 +324,12 @@ class SerializedData {
 
  protected:
   void SetHeaderValue(uint32_t offset, uint32_t value) {
-    WriteLittleEndianValue(data_ + offset, value);
+    WriteLittleEndianValue(reinterpret_cast<Address>(data_) + offset, value);
   }
 
   uint32_t GetHeaderValue(uint32_t offset) const {
-    return ReadLittleEndianValue<uint32_t>(data_ + offset);
+    return ReadLittleEndianValue<uint32_t>(reinterpret_cast<Address>(data_) +
+                                           offset);
   }
 
   void AllocateData(uint32_t size);
diff --git a/deps/v8/src/snapshot/serializer.cc b/deps/v8/src/snapshot/serializer.cc
index c093707e5e3003..17ddfc27374424 100644
--- a/deps/v8/src/snapshot/serializer.cc
+++ b/deps/v8/src/snapshot/serializer.cc
@@ -25,13 +25,19 @@ Serializer<AllocatorT>::Serializer(Isolate* isolate)
   if (FLAG_serialization_statistics) {
     instance_type_count_ = NewArray<int>(kInstanceTypes);
     instance_type_size_ = NewArray<size_t>(kInstanceTypes);
+    read_only_instance_type_count_ = NewArray<int>(kInstanceTypes);
+    read_only_instance_type_size_ = NewArray<size_t>(kInstanceTypes);
     for (int i = 0; i < kInstanceTypes; i++) {
       instance_type_count_[i] = 0;
       instance_type_size_[i] = 0;
+      read_only_instance_type_count_[i] = 0;
+      read_only_instance_type_size_[i] = 0;
     }
   } else {
     instance_type_count_ = nullptr;
     instance_type_size_ = nullptr;
+    read_only_instance_type_count_ = nullptr;
+    read_only_instance_type_size_ = nullptr;
   }
 #endif  // OBJECT_PRINT
 }
@@ -43,16 +49,24 @@ Serializer<AllocatorT>::~Serializer() {
   if (instance_type_count_ != nullptr) {
     DeleteArray(instance_type_count_);
     DeleteArray(instance_type_size_);
+    DeleteArray(read_only_instance_type_count_);
+    DeleteArray(read_only_instance_type_size_);
   }
 #endif  // OBJECT_PRINT
 }
 
 #ifdef OBJECT_PRINT
 template <class AllocatorT>
-void Serializer<AllocatorT>::CountInstanceType(Map* map, int size) {
+void Serializer<AllocatorT>::CountInstanceType(Map* map, int size,
+                                               AllocationSpace space) {
   int instance_type = map->instance_type();
-  instance_type_count_[instance_type]++;
-  instance_type_size_[instance_type] += size;
+  if (space != RO_SPACE) {
+    instance_type_count_[instance_type]++;
+    instance_type_size_[instance_type] += size;
+  } else {
+    read_only_instance_type_count_[instance_type]++;
+    read_only_instance_type_size_[instance_type] += size;
+  }
 }
 #endif  // OBJECT_PRINT
 
@@ -72,6 +86,21 @@ void Serializer<AllocatorT>::OutputStatistics(const char* name) {
   }
   INSTANCE_TYPE_LIST(PRINT_INSTANCE_TYPE)
 #undef PRINT_INSTANCE_TYPE
+  size_t read_only_total = 0;
+#define UPDATE_TOTAL(Name) \
+  read_only_total += read_only_instance_type_size_[Name];
+  INSTANCE_TYPE_LIST(UPDATE_TOTAL)
+#undef UPDATE_TOTAL
+  if (read_only_total > 0) {
+    PrintF("\n  Read Only Instance types (count and bytes):\n");
+#define PRINT_INSTANCE_TYPE(Name)                                           \
+  if (read_only_instance_type_count_[Name]) {                               \
+    PrintF("%10d %10" PRIuS "  %s\n", read_only_instance_type_count_[Name], \
+           read_only_instance_type_size_[Name], #Name);                     \
+  }
+    INSTANCE_TYPE_LIST(PRINT_INSTANCE_TYPE)
+#undef PRINT_INSTANCE_TYPE
+  }
   PrintF("\n");
 #endif  // OBJECT_PRINT
 }
@@ -113,7 +142,7 @@ void Serializer<AllocatorT>::VisitRootPointers(Root root,
 template <class AllocatorT>
 void Serializer<AllocatorT>::PrintStack() {
   for (const auto o : stack_) {
-    o->Print();
+    o->Print(isolate());
     PrintF("\n");
   }
 }
@@ -148,7 +177,7 @@ bool Serializer<AllocatorT>::SerializeBackReference(HeapObject* obj,
                                                     HowToCode how_to_code,
                                                     WhereToPoint where_to_point,
                                                     int skip) {
-  SerializerReference reference = reference_map_.Lookup(obj);
+  SerializerReference reference = reference_map_.LookupReference(obj);
   if (!reference.is_valid()) return false;
   // Encode the location of an already deserialized object in order to write
   // its location into a later object.  We can encode the location as an
@@ -235,8 +264,7 @@ void Serializer<AllocatorT>::PutRoot(
                 kNumberOfRootArrayConstants - 1);
 
   if (how_to_code == kPlain && where_to_point == kStartOfObject &&
-      root_index < kNumberOfRootArrayConstants &&
-      !isolate()->heap()->InNewSpace(object)) {
+      root_index < kNumberOfRootArrayConstants && !Heap::InNewSpace(object)) {
     if (skip == 0) {
       sink_.Put(kRootArrayConstants + root_index, "RootConstant");
     } else {
@@ -262,7 +290,21 @@ template <class AllocatorT>
 void Serializer<AllocatorT>::PutBackReference(HeapObject* object,
                                               SerializerReference reference) {
   DCHECK(allocator()->BackReferenceIsAlreadyAllocated(reference));
-  sink_.PutInt(reference.back_reference(), "BackRefValue");
+  switch (reference.space()) {
+    case MAP_SPACE:
+      sink_.PutInt(reference.map_index(), "BackRefMapIndex");
+      break;
+
+    case LO_SPACE:
+      sink_.PutInt(reference.large_object_index(), "BackRefLargeObjectIndex");
+      break;
+
+    default:
+      sink_.PutInt(reference.chunk_index(), "BackRefChunkIndex");
+      sink_.PutInt(reference.chunk_offset(), "BackRefChunkOffset");
+      break;
+  }
+
   hot_objects_.Add(object);
 }
 
@@ -319,9 +361,11 @@ template <class AllocatorT>
 Code* Serializer<AllocatorT>::CopyCode(Code* code) {
   code_buffer_.clear();  // Clear buffer without deleting backing store.
   int size = code->CodeSize();
-  code_buffer_.insert(code_buffer_.end(), code->address(),
-                      code->address() + size);
-  return Code::cast(HeapObject::FromAddress(&code_buffer_.front()));
+  code_buffer_.insert(code_buffer_.end(),
+                      reinterpret_cast<byte*>(code->address()),
+                      reinterpret_cast<byte*>(code->address() + size));
+  return Code::cast(HeapObject::FromAddress(
+      reinterpret_cast<Address>(&code_buffer_.front())));
 }
 
 template <class AllocatorT>
@@ -360,7 +404,7 @@ void Serializer<AllocatorT>::ObjectSerializer::SerializePrologue(
 
 #ifdef OBJECT_PRINT
   if (FLAG_serialization_statistics) {
-    serializer_->CountInstanceType(map, size);
+    serializer_->CountInstanceType(map, size, space);
   }
 #endif  // OBJECT_PRINT
 
@@ -375,7 +419,7 @@ template <class AllocatorT>
 int32_t Serializer<AllocatorT>::ObjectSerializer::SerializeBackingStore(
     void* backing_store, int32_t byte_length) {
   SerializerReference reference =
-      serializer_->reference_map()->Lookup(backing_store);
+      serializer_->reference_map()->LookupReference(backing_store);
 
   // Serialize the off-heap backing store.
   if (!reference.is_valid()) {
@@ -455,7 +499,7 @@ void Serializer<AllocatorT>::ObjectSerializer::SerializeExternalString() {
   // for native native source code strings, we replace the resource field
   // with the native source id.
   // For the rest we serialize them to look like ordinary sequential strings.
-  if (object_->map() != heap->native_source_string_map()) {
+  if (object_->map() != ReadOnlyRoots(heap).native_source_string_map()) {
     ExternalString* string = ExternalString::cast(object_);
     Address resource = string->resource_as_address();
     ExternalReferenceEncoder::Value reference;
@@ -487,9 +531,9 @@ void Serializer<
     AllocatorT>::ObjectSerializer::SerializeExternalStringAsSequentialString() {
   // Instead of serializing this as an external string, we serialize
   // an imaginary sequential string with the same content.
-  Isolate* isolate = serializer_->isolate();
+  ReadOnlyRoots roots(serializer_->isolate());
   DCHECK(object_->IsExternalString());
-  DCHECK(object_->map() != isolate->heap()->native_source_string_map());
+  DCHECK(object_->map() != roots.native_source_string_map());
   ExternalString* string = ExternalString::cast(object_);
   int length = string->length();
   Map* map;
@@ -499,15 +543,14 @@ void Serializer<
   // Find the map and size for the imaginary sequential string.
   bool internalized = object_->IsInternalizedString();
   if (object_->IsExternalOneByteString()) {
-    map = internalized ? isolate->heap()->one_byte_internalized_string_map()
-                       : isolate->heap()->one_byte_string_map();
+    map = internalized ? roots.one_byte_internalized_string_map()
+                       : roots.one_byte_string_map();
     allocation_size = SeqOneByteString::SizeFor(length);
     content_size = length * kCharSize;
     resource = reinterpret_cast<const byte*>(
         ExternalOneByteString::cast(string)->resource()->data());
   } else {
-    map = internalized ? isolate->heap()->internalized_string_map()
-                       : isolate->heap()->string_map();
+    map = internalized ? roots.internalized_string_map() : roots.string_map();
     allocation_size = SeqTwoByteString::SizeFor(length);
     content_size = length * kShortSize;
     resource = reinterpret_cast<const byte*>(
@@ -526,7 +569,7 @@ void Serializer<
   sink_->PutInt(bytes_to_output, "length");
 
   // Serialize string header (except for map).
-  Address string_start = string->address();
+  uint8_t* string_start = reinterpret_cast<uint8_t*>(string->address());
   for (int i = HeapObject::kHeaderSize; i < SeqString::kHeaderSize; i++) {
     sink_->PutSection(string_start[i], "StringHeader");
   }
@@ -545,12 +588,13 @@ void Serializer<
 // TODO(all): replace this with proper iteration of weak slots in serializer.
 class UnlinkWeakNextScope {
  public:
-  explicit UnlinkWeakNextScope(HeapObject* object) : object_(nullptr) {
+  explicit UnlinkWeakNextScope(Heap* heap, HeapObject* object)
+      : object_(nullptr) {
     if (object->IsAllocationSite()) {
       object_ = object;
       next_ = AllocationSite::cast(object)->weak_next();
       AllocationSite::cast(object)->set_weak_next(
-          object->GetHeap()->undefined_value());
+          ReadOnlyRoots(heap).undefined_value());
     }
   }
 
@@ -578,12 +622,16 @@ void Serializer<AllocatorT>::ObjectSerializer::Serialize() {
   if (object_->IsExternalString()) {
     SerializeExternalString();
     return;
-  } else if (object_->IsSeqOneByteString()) {
-    // Clear padding bytes at the end. Done here to avoid having to do this
-    // at allocation sites in generated code.
-    SeqOneByteString::cast(object_)->clear_padding();
-  } else if (object_->IsSeqTwoByteString()) {
-    SeqTwoByteString::cast(object_)->clear_padding();
+  } else if (!serializer_->isolate()->heap()->InReadOnlySpace(object_)) {
+    // Only clear padding for strings outside RO_SPACE. RO_SPACE should have
+    // been cleared elsewhere.
+    if (object_->IsSeqOneByteString()) {
+      // Clear padding bytes at the end. Done here to avoid having to do this
+      // at allocation sites in generated code.
+      SeqOneByteString::cast(object_)->clear_padding();
+    } else if (object_->IsSeqTwoByteString()) {
+      SeqTwoByteString::cast(object_)->clear_padding();
+    }
   }
   if (object_->IsJSTypedArray()) {
     SerializeJSTypedArray();
@@ -599,7 +647,7 @@ void Serializer<AllocatorT>::ObjectSerializer::Serialize() {
 
   if (object_->IsScript()) {
     // Clear cached line ends.
-    Object* undefined = serializer_->isolate()->heap()->undefined_value();
+    Object* undefined = ReadOnlyRoots(serializer_->isolate()).undefined_value();
     Script::cast(object_)->set_line_ends(undefined);
   }
 
@@ -612,6 +660,7 @@ void Serializer<AllocatorT>::ObjectSerializer::SerializeObject() {
   Map* map = object_->map();
   AllocationSpace space =
       MemoryChunk::FromAddress(object_->address())->owner()->identity();
+  DCHECK(space != NEW_LO_SPACE);
   SerializePrologue(space, size, map);
 
   // Serialize the rest of the object.
@@ -642,7 +691,7 @@ void Serializer<AllocatorT>::ObjectSerializer::SerializeDeferred() {
   int size = object_->Size();
   Map* map = object_->map();
   SerializerReference back_reference =
-      serializer_->reference_map()->Lookup(object_);
+      serializer_->reference_map()->LookupReference(object_);
   DCHECK(back_reference.is_back_reference());
 
   // Serialize the rest of the object.
@@ -660,7 +709,7 @@ void Serializer<AllocatorT>::ObjectSerializer::SerializeDeferred() {
 template <class AllocatorT>
 void Serializer<AllocatorT>::ObjectSerializer::SerializeContent(Map* map,
                                                                 int size) {
-  UnlinkWeakNextScope unlink_weak_next(object_);
+  UnlinkWeakNextScope unlink_weak_next(serializer_->isolate()->heap(), object_);
   if (object_->IsCode()) {
     // For code objects, output raw bytes first.
     OutputCode(size);
@@ -707,7 +756,7 @@ void Serializer<AllocatorT>::ObjectSerializer::VisitPointers(
           Heap::RootIsImmortalImmovable(root_index) &&
           *current == current[-1]) {
         DCHECK_EQ(reference_type, HeapObjectReferenceType::STRONG);
-        DCHECK(!serializer_->isolate()->heap()->InNewSpace(current_contents));
+        DCHECK(!Heap::InNewSpace(current_contents));
         int repeat_count = 1;
         while (&current[repeat_count] < end - 1 &&
                current[repeat_count] == *current) {
@@ -776,7 +825,7 @@ void Serializer<AllocatorT>::ObjectSerializer::VisitExternalReference(
                "ExternalRef");
   }
   sink_->PutInt(skip, "SkipB4ExternalRef");
-  DCHECK_NOT_NULL(target);  // Code does not reference null.
+  DCHECK_NE(target, kNullAddress);  // Code does not reference null.
   sink_->PutInt(encoded_reference.index(), "reference index");
   bytes_processed_so_far_ += rinfo->target_address_size();
 }
@@ -791,18 +840,18 @@ void Serializer<AllocatorT>::ObjectSerializer::VisitInternalReference(
   // inline. That would cause the skip to be negative. Instead, we store the
   // offset from code entry.
   Address entry = Code::cast(object_)->entry();
-  intptr_t pc_offset = rinfo->target_internal_reference_address() - entry;
-  intptr_t target_offset = rinfo->target_internal_reference() - entry;
-  DCHECK(0 <= pc_offset &&
-         pc_offset <= Code::cast(object_)->raw_instruction_size());
-  DCHECK(0 <= target_offset &&
-         target_offset <= Code::cast(object_)->raw_instruction_size());
+  DCHECK_GE(rinfo->target_internal_reference_address(), entry);
+  uintptr_t pc_offset = rinfo->target_internal_reference_address() - entry;
+  DCHECK_LE(pc_offset, Code::cast(object_)->raw_instruction_size());
+  DCHECK_GE(rinfo->target_internal_reference(), entry);
+  uintptr_t target_offset = rinfo->target_internal_reference() - entry;
+  DCHECK_LE(target_offset, Code::cast(object_)->raw_instruction_size());
   sink_->Put(rinfo->rmode() == RelocInfo::INTERNAL_REFERENCE
                  ? kInternalReference
                  : kInternalReferenceEncoded,
              "InternalRef");
-  sink_->PutInt(static_cast<uintptr_t>(pc_offset), "internal ref address");
-  sink_->PutInt(static_cast<uintptr_t>(target_offset), "internal ref value");
+  sink_->PutInt(pc_offset, "internal ref address");
+  sink_->PutInt(target_offset, "internal ref value");
 }
 
 template <class AllocatorT>
@@ -822,12 +871,12 @@ void Serializer<AllocatorT>::ObjectSerializer::VisitRuntimeEntry(
 template <class AllocatorT>
 void Serializer<AllocatorT>::ObjectSerializer::VisitOffHeapTarget(
     Code* host, RelocInfo* rinfo) {
-#ifdef V8_EMBEDDED_BUILTINS
+  DCHECK(FLAG_embedded_builtins);
   {
     STATIC_ASSERT(EmbeddedData::kTableSize == Builtins::builtin_count);
-    CHECK(Builtins::IsEmbeddedBuiltin(host));
+    CHECK(Builtins::IsIsolateIndependentBuiltin(host));
     Address addr = rinfo->target_off_heap_target();
-    CHECK_NOT_NULL(addr);
+    CHECK_NE(kNullAddress, addr);
     CHECK_NOT_NULL(
         InstructionStream::TryLookupCode(serializer_->isolate(), addr));
   }
@@ -837,9 +886,46 @@ void Serializer<AllocatorT>::ObjectSerializer::VisitOffHeapTarget(
   sink_->PutInt(skip, "SkipB4OffHeapTarget");
   sink_->PutInt(host->builtin_index(), "builtin index");
   bytes_processed_so_far_ += rinfo->target_address_size();
-#else
-  UNREACHABLE();
-#endif
+}
+
+namespace {
+class CompareRelocInfo {
+ public:
+  bool operator()(RelocInfo x, RelocInfo y) {
+    // Everything that does not use target_address_address will compare equal.
+    Address x_num = 0;
+    Address y_num = 0;
+    if (HasTargetAddressAddress(x.rmode())) {
+      x_num = x.target_address_address();
+    }
+    if (HasTargetAddressAddress(y.rmode())) {
+      y_num = y.target_address_address();
+    }
+    return x_num > y_num;
+  }
+
+ private:
+  static bool HasTargetAddressAddress(RelocInfo::Mode mode) {
+    return RelocInfo::IsEmbeddedObject(mode) || RelocInfo::IsCodeTarget(mode) ||
+           RelocInfo::IsExternalReference(mode) ||
+           RelocInfo::IsRuntimeEntry(mode);
+  }
+};
+}  // namespace
+
+template <class AllocatorT>
+void Serializer<AllocatorT>::ObjectSerializer::VisitRelocInfo(
+    RelocIterator* it) {
+  std::priority_queue<RelocInfo, std::vector<RelocInfo>, CompareRelocInfo>
+      reloc_queue;
+  for (; !it->done(); it->next()) {
+    reloc_queue.push(*it->rinfo());
+  }
+  while (!reloc_queue.empty()) {
+    RelocInfo rinfo = reloc_queue.top();
+    reloc_queue.pop();
+    rinfo.Visit(this);
+  }
 }
 
 template <class AllocatorT>
@@ -872,23 +958,28 @@ void Serializer<AllocatorT>::ObjectSerializer::OutputRawData(Address up_to) {
     }
 #ifdef MEMORY_SANITIZER
     // Check that we do not serialize uninitialized memory.
-    __msan_check_mem_is_initialized(object_start + base, bytes_to_output);
+    __msan_check_mem_is_initialized(
+        reinterpret_cast<void*>(object_start + base), bytes_to_output);
 #endif  // MEMORY_SANITIZER
     if (object_->IsBytecodeArray()) {
       // The code age byte can be changed concurrently by GC.
       const int bytes_to_age_byte = BytecodeArray::kBytecodeAgeOffset - base;
       if (0 <= bytes_to_age_byte && bytes_to_age_byte < bytes_to_output) {
-        sink_->PutRaw(object_start + base, bytes_to_age_byte, "Bytes");
+        sink_->PutRaw(reinterpret_cast<byte*>(object_start + base),
+                      bytes_to_age_byte, "Bytes");
         byte bytecode_age = BytecodeArray::kNoAgeBytecodeAge;
         sink_->PutRaw(&bytecode_age, 1, "Bytes");
         const int bytes_written = bytes_to_age_byte + 1;
-        sink_->PutRaw(object_start + base + bytes_written,
-                      bytes_to_output - bytes_written, "Bytes");
+        sink_->PutRaw(
+            reinterpret_cast<byte*>(object_start + base + bytes_written),
+            bytes_to_output - bytes_written, "Bytes");
       } else {
-        sink_->PutRaw(object_start + base, bytes_to_output, "Bytes");
+        sink_->PutRaw(reinterpret_cast<byte*>(object_start + base),
+                      bytes_to_output, "Bytes");
       }
     } else {
-      sink_->PutRaw(object_start + base, bytes_to_output, "Bytes");
+      sink_->PutRaw(reinterpret_cast<byte*>(object_start + base),
+                    bytes_to_output, "Bytes");
     }
   }
 }
@@ -900,7 +991,8 @@ int Serializer<AllocatorT>::ObjectSerializer::SkipTo(Address to) {
   int to_skip = up_to_offset - bytes_processed_so_far_;
   bytes_processed_so_far_ += to_skip;
   // This assert will fail if the reloc info gives us the target_address_address
-  // locations in a non-ascending order.  Luckily that doesn't happen.
+  // locations in a non-ascending order. We make sure this doesn't happen by
+  // sorting the relocation info.
   DCHECK_GE(to_skip, 0);
   return to_skip;
 }
@@ -909,24 +1001,22 @@ template <class AllocatorT>
 void Serializer<AllocatorT>::ObjectSerializer::OutputCode(int size) {
   DCHECK_EQ(kPointerSize, bytes_processed_so_far_);
   Code* code = Code::cast(object_);
-  if (FLAG_predictable) {
-    // To make snapshots reproducible, we make a copy of the code object
-    // and wipe all pointers in the copy, which we then serialize.
-    code = serializer_->CopyCode(code);
-    int mode_mask = RelocInfo::kCodeTargetMask |
-                    RelocInfo::ModeMask(RelocInfo::EMBEDDED_OBJECT) |
-                    RelocInfo::ModeMask(RelocInfo::EXTERNAL_REFERENCE) |
-                    RelocInfo::ModeMask(RelocInfo::RUNTIME_ENTRY) |
-                    RelocInfo::ModeMask(RelocInfo::INTERNAL_REFERENCE) |
-                    RelocInfo::ModeMask(RelocInfo::INTERNAL_REFERENCE_ENCODED);
-    for (RelocIterator it(code, mode_mask); !it.done(); it.next()) {
-      RelocInfo* rinfo = it.rinfo();
-      rinfo->WipeOut();
-    }
-    // We need to wipe out the header fields *after* wiping out the
-    // relocations, because some of these fields are needed for the latter.
-    code->WipeOutHeader();
+  // To make snapshots reproducible, we make a copy of the code object
+  // and wipe all pointers in the copy, which we then serialize.
+  code = serializer_->CopyCode(code);
+  int mode_mask = RelocInfo::ModeMask(RelocInfo::CODE_TARGET) |
+                  RelocInfo::ModeMask(RelocInfo::EMBEDDED_OBJECT) |
+                  RelocInfo::ModeMask(RelocInfo::EXTERNAL_REFERENCE) |
+                  RelocInfo::ModeMask(RelocInfo::RUNTIME_ENTRY) |
+                  RelocInfo::ModeMask(RelocInfo::INTERNAL_REFERENCE) |
+                  RelocInfo::ModeMask(RelocInfo::INTERNAL_REFERENCE_ENCODED);
+  for (RelocIterator it(code, mode_mask); !it.done(); it.next()) {
+    RelocInfo* rinfo = it.rinfo();
+    rinfo->WipeOut();
   }
+  // We need to wipe out the header fields *after* wiping out the
+  // relocations, because some of these fields are needed for the latter.
+  code->WipeOutHeader();
 
   Address start = code->address() + Code::kDataStart;
   int bytes_to_output = size - Code::kDataStart;
@@ -936,9 +1026,10 @@ void Serializer<AllocatorT>::ObjectSerializer::OutputCode(int size) {
 
 #ifdef MEMORY_SANITIZER
   // Check that we do not serialize uninitialized memory.
-  __msan_check_mem_is_initialized(start, bytes_to_output);
+  __msan_check_mem_is_initialized(reinterpret_cast<void*>(start),
+                                  bytes_to_output);
 #endif  // MEMORY_SANITIZER
-  sink_->PutRaw(start, bytes_to_output, "Code");
+  sink_->PutRaw(reinterpret_cast<byte*>(start), bytes_to_output, "Code");
 }
 
 // Explicit instantiation.
diff --git a/deps/v8/src/snapshot/serializer.h b/deps/v8/src/snapshot/serializer.h
index 9f8db6ccfe2917..21cca458855f9c 100644
--- a/deps/v8/src/snapshot/serializer.h
+++ b/deps/v8/src/snapshot/serializer.h
@@ -21,11 +21,11 @@ namespace internal {
 class CodeAddressMap : public CodeEventLogger {
  public:
   explicit CodeAddressMap(Isolate* isolate) : isolate_(isolate) {
-    isolate->logger()->addCodeEventListener(this);
+    isolate->logger()->AddCodeEventListener(this);
   }
 
   ~CodeAddressMap() override {
-    isolate_->logger()->removeCodeEventListener(this);
+    isolate_->logger()->RemoveCodeEventListener(this);
   }
 
   void CodeMoveEvent(AbstractCode* from, Address to) override {
@@ -96,12 +96,13 @@ class CodeAddressMap : public CodeEventLogger {
     }
 
     base::HashMap::Entry* FindOrCreateEntry(Address code_address) {
-      return impl_.LookupOrInsert(code_address,
-                                  ComputePointerHash(code_address));
+      return impl_.LookupOrInsert(reinterpret_cast<void*>(code_address),
+                                  ComputeAddressHash(code_address));
     }
 
     base::HashMap::Entry* FindEntry(Address code_address) {
-      return impl_.Lookup(code_address, ComputePointerHash(code_address));
+      return impl_.Lookup(reinterpret_cast<void*>(code_address),
+                          ComputeAddressHash(code_address));
     }
 
     void RemoveEntry(base::HashMap::Entry* entry) {
@@ -140,7 +141,7 @@ class Serializer : public SerializerDeserializer {
   const std::vector<byte>* Payload() const { return sink_.data(); }
 
   bool ReferenceMapContains(HeapObject* o) {
-    return reference_map()->Lookup(o).is_valid();
+    return reference_map()->LookupReference(o).is_valid();
   }
 
   Isolate* isolate() const { return isolate_; }
@@ -218,14 +219,14 @@ class Serializer : public SerializerDeserializer {
   Code* CopyCode(Code* code);
 
   void QueueDeferredObject(HeapObject* obj) {
-    DCHECK(reference_map_.Lookup(obj).is_back_reference());
+    DCHECK(reference_map_.LookupReference(obj).is_back_reference());
     deferred_objects_.push_back(obj);
   }
 
   void OutputStatistics(const char* name);
 
 #ifdef OBJECT_PRINT
-  void CountInstanceType(Map* map, int size);
+  void CountInstanceType(Map* map, int size, AllocationSpace space);
 #endif  // OBJECT_PRINT
 
 #ifdef DEBUG
@@ -255,6 +256,8 @@ class Serializer : public SerializerDeserializer {
   static const int kInstanceTypes = LAST_TYPE + 1;
   int* instance_type_count_;
   size_t* instance_type_size_;
+  int* read_only_instance_type_count_;
+  size_t* read_only_instance_type_size_;
 #endif  // OBJECT_PRINT
 
 #ifdef DEBUG
@@ -266,6 +269,8 @@ class Serializer : public SerializerDeserializer {
   DISALLOW_COPY_AND_ASSIGN(Serializer);
 };
 
+class RelocInfoIterator;
+
 template <class AllocatorT>
 class Serializer<AllocatorT>::ObjectSerializer : public ObjectVisitor {
  public:
@@ -299,6 +304,8 @@ class Serializer<AllocatorT>::ObjectSerializer : public ObjectVisitor {
   void VisitCodeTarget(Code* host, RelocInfo* target) override;
   void VisitRuntimeEntry(Code* host, RelocInfo* reloc) override;
   void VisitOffHeapTarget(Code* host, RelocInfo* target) override;
+  // Relocation info needs to be visited sorted by target_address_address.
+  void VisitRelocInfo(RelocIterator* it) override;
 
  private:
   void SerializePrologue(AllocationSpace space, int size, Map* map);
diff --git a/deps/v8/src/snapshot/snapshot-common.cc b/deps/v8/src/snapshot/snapshot-common.cc
index a59e1552c6e1d0..5da7bb0f494098 100644
--- a/deps/v8/src/snapshot/snapshot-common.cc
+++ b/deps/v8/src/snapshot/snapshot-common.cc
@@ -7,6 +7,7 @@
 #include "src/snapshot/snapshot.h"
 
 #include "src/api.h"
+#include "src/assembler-inl.h"
 #include "src/base/platform/platform.h"
 #include "src/callable.h"
 #include "src/interface-descriptors.h"
@@ -259,8 +260,9 @@ v8::StartupData Snapshot::CreateSnapshotBlob(
             reinterpret_cast<const char*>(startup_snapshot->RawData().start()),
             payload_length);
   if (FLAG_profile_deserialization) {
-    PrintF("Snapshot blob consists of:\n%10d bytes for startup\n",
-           payload_length);
+    PrintF("Snapshot blob consists of:\n%10d bytes in %d chunks for startup\n",
+           payload_length,
+           static_cast<uint32_t>(startup_snapshot->Reservations().size()));
   }
   payload_offset += payload_length;
 
@@ -285,7 +287,8 @@ v8::StartupData Snapshot::CreateSnapshotBlob(
         reinterpret_cast<const char*>(context_snapshot->RawData().start()),
         payload_length);
     if (FLAG_profile_deserialization) {
-      PrintF("%10d bytes for context #%d\n", payload_length, i);
+      PrintF("%10d bytes in %d chunks for context #%d\n", payload_length,
+             static_cast<uint32_t>(context_snapshot->Reservations().size()), i);
     }
     payload_offset += payload_length;
   }
@@ -295,7 +298,6 @@ v8::StartupData Snapshot::CreateSnapshotBlob(
   return result;
 }
 
-#ifdef V8_EMBEDDED_BUILTINS
 namespace {
 bool BuiltinAliasesOffHeapTrampolineRegister(Isolate* isolate, Code* code) {
   DCHECK(Builtins::IsIsolateIndependent(code->builtin_index()));
@@ -327,6 +329,48 @@ bool BuiltinAliasesOffHeapTrampolineRegister(Isolate* isolate, Code* code) {
 
   return false;
 }
+
+void FinalizeEmbeddedCodeTargets(Isolate* isolate, EmbeddedData* blob) {
+  static const int kRelocMask =
+      RelocInfo::ModeMask(RelocInfo::CODE_TARGET) |
+      RelocInfo::ModeMask(RelocInfo::RELATIVE_CODE_TARGET);
+
+  for (int i = 0; i < Builtins::builtin_count; i++) {
+    if (!Builtins::IsIsolateIndependent(i)) continue;
+
+    Code* code = isolate->builtins()->builtin(i);
+    RelocIterator on_heap_it(code, kRelocMask);
+    RelocIterator off_heap_it(blob, code, kRelocMask);
+
+#if defined(V8_TARGET_ARCH_X64) || defined(V8_TARGET_ARCH_ARM64) || \
+    defined(V8_TARGET_ARCH_ARM)
+    // On X64, ARM, ARM64 we emit relative builtin-to-builtin jumps for isolate
+    // independent builtins in the snapshot. This fixes up the relative jumps
+    // to the right offsets in the snapshot.
+    while (!on_heap_it.done()) {
+      DCHECK(!off_heap_it.done());
+
+      RelocInfo* rinfo = on_heap_it.rinfo();
+      DCHECK_EQ(rinfo->rmode(), off_heap_it.rinfo()->rmode());
+      Code* target = Code::GetCodeFromTargetAddress(rinfo->target_address());
+      CHECK(Builtins::IsIsolateIndependentBuiltin(target));
+
+      off_heap_it.rinfo()->set_target_address(
+          blob->InstructionStartOfBuiltin(target->builtin_index()));
+
+      on_heap_it.next();
+      off_heap_it.next();
+    }
+    DCHECK(off_heap_it.done());
+#else
+    // Architectures other than x64 and arm/arm64 do not use pc-relative calls
+    // and thus must not contain embedded code targets. Instead, we use an
+    // indirection through the root register.
+    CHECK(on_heap_it.done());
+    CHECK(off_heap_it.done());
+#endif  // defined(V8_TARGET_ARCH_X64) || defined(V8_TARGET_ARCH_ARM64)
+  }
+}
 }  // namespace
 
 // static
@@ -345,11 +389,11 @@ EmbeddedData EmbeddedData::FromIsolate(Isolate* isolate) {
     if (Builtins::IsIsolateIndependent(i)) {
       DCHECK(!Builtins::IsLazy(i));
 
-      // Sanity-check that the given builtin is process-independent and does not
+      // Sanity-check that the given builtin is isolate-independent and does not
       // use the trampoline register in its calling convention.
-      if (!code->IsProcessIndependent()) {
+      if (!code->IsIsolateIndependent(isolate)) {
         saw_unsafe_builtin = true;
-        fprintf(stderr, "%s is not process-independent.\n", Builtins::name(i));
+        fprintf(stderr, "%s is not isolate-independent.\n", Builtins::name(i));
       }
       if (BuiltinAliasesOffHeapTrampolineRegister(isolate, code)) {
         saw_unsafe_builtin = true;
@@ -370,7 +414,11 @@ EmbeddedData EmbeddedData::FromIsolate(Isolate* isolate) {
       lengths[i] = 0;
     }
   }
-  CHECK(!saw_unsafe_builtin);
+  CHECK_WITH_MSG(
+      !saw_unsafe_builtin,
+      "One or more builtins marked as isolate-independent either contains "
+      "isolate-dependent code or aliases the off-heap trampoline register. "
+      "If in doubt, ask jgruber@");
 
   const uint32_t blob_size = RawDataOffset() + raw_data_size;
   uint8_t* blob = new uint8_t[blob_size];
@@ -391,11 +439,26 @@ EmbeddedData EmbeddedData::FromIsolate(Isolate* isolate) {
     uint8_t* dst = blob + RawDataOffset() + offset;
     DCHECK_LE(RawDataOffset() + offset + code->raw_instruction_size(),
               blob_size);
-    std::memcpy(dst, code->raw_instruction_start(),
+    std::memcpy(dst, reinterpret_cast<uint8_t*>(code->raw_instruction_start()),
                 code->raw_instruction_size());
   }
 
-  return {blob, blob_size};
+  EmbeddedData d(blob, blob_size);
+
+  // Fix up call targets that point to other embedded builtins.
+  FinalizeEmbeddedCodeTargets(isolate, &d);
+
+  // Hash the blob and store the result.
+  STATIC_ASSERT(HashSize() == kSizetSize);
+  const size_t hash = d.CreateHash();
+  std::memcpy(blob + HashOffset(), &hash, HashSize());
+
+  DCHECK_EQ(hash, d.CreateHash());
+  DCHECK_EQ(hash, d.Hash());
+
+  if (FLAG_serialization_statistics) d.PrintStatistics();
+
+  return d;
 }
 
 EmbeddedData EmbeddedData::FromBlob() {
@@ -406,13 +469,13 @@ EmbeddedData EmbeddedData::FromBlob() {
   return {data, size};
 }
 
-const uint8_t* EmbeddedData::InstructionStartOfBuiltin(int i) const {
+Address EmbeddedData::InstructionStartOfBuiltin(int i) const {
   DCHECK(Builtins::IsBuiltinId(i));
-
   const uint32_t* offsets = Offsets();
   const uint8_t* result = RawData() + offsets[i];
-  DCHECK_LT(result, data_ + size_);
-  return result;
+  DCHECK_LE(result, data_ + size_);
+  DCHECK_IMPLIES(result == data_ + size_, InstructionSizeOfBuiltin(i) == 0);
+  return reinterpret_cast<Address>(result);
 }
 
 uint32_t EmbeddedData::InstructionSizeOfBuiltin(int i) const {
@@ -420,7 +483,12 @@ uint32_t EmbeddedData::InstructionSizeOfBuiltin(int i) const {
   const uint32_t* lengths = Lengths();
   return lengths[i];
 }
-#endif
+
+size_t EmbeddedData::CreateHash() const {
+  STATIC_ASSERT(HashOffset() == 0);
+  STATIC_ASSERT(HashSize() == kSizetSize);
+  return base::hash_range(data_ + HashSize(), data_ + size_);
+}
 
 uint32_t Snapshot::ExtractNumContexts(const v8::StartupData* data) {
   CHECK_LT(kNumberOfContextsOffset, data->raw_size);
@@ -428,6 +496,48 @@ uint32_t Snapshot::ExtractNumContexts(const v8::StartupData* data) {
   return num_contexts;
 }
 
+void EmbeddedData::PrintStatistics() const {
+  DCHECK(FLAG_serialization_statistics);
+
+  constexpr int kCount = Builtins::builtin_count;
+
+  int embedded_count = 0;
+  int instruction_size = 0;
+  int sizes[kCount];
+  for (int i = 0; i < kCount; i++) {
+    if (!Builtins::IsIsolateIndependent(i)) continue;
+    const int size = InstructionSizeOfBuiltin(i);
+    instruction_size += size;
+    sizes[embedded_count] = size;
+    embedded_count++;
+  }
+
+  // Sort for percentiles.
+  std::sort(&sizes[0], &sizes[embedded_count]);
+
+  const int k50th = embedded_count * 0.5;
+  const int k75th = embedded_count * 0.75;
+  const int k90th = embedded_count * 0.90;
+  const int k99th = embedded_count * 0.99;
+
+  const int metadata_size =
+      static_cast<int>(HashSize() + OffsetsSize() + LengthsSize());
+
+  PrintF("EmbeddedData:\n");
+  PrintF("  Total size:                         %d\n",
+         static_cast<int>(size()));
+  PrintF("  Metadata size:                      %d\n", metadata_size);
+  PrintF("  Instruction size:                   %d\n", instruction_size);
+  PrintF("  Padding:                            %d\n",
+         static_cast<int>(size() - metadata_size - instruction_size));
+  PrintF("  Embedded builtin count:             %d\n", embedded_count);
+  PrintF("  Instruction size (50th percentile): %d\n", sizes[k50th]);
+  PrintF("  Instruction size (75th percentile): %d\n", sizes[k75th]);
+  PrintF("  Instruction size (90th percentile): %d\n", sizes[k90th]);
+  PrintF("  Instruction size (99th percentile): %d\n", sizes[k99th]);
+  PrintF("\n");
+}
+
 uint32_t Snapshot::ExtractContextOffset(const v8::StartupData* data,
                                         uint32_t index) {
   // Extract the offset of the context at a given index from the StartupData,
diff --git a/deps/v8/src/snapshot/snapshot.h b/deps/v8/src/snapshot/snapshot.h
index b86a4ac9f9048d..26f1cdb44bdb15 100644
--- a/deps/v8/src/snapshot/snapshot.h
+++ b/deps/v8/src/snapshot/snapshot.h
@@ -79,7 +79,6 @@ class BuiltinSnapshotData final : public SnapshotData {
   // ... list of builtins offsets
 };
 
-#ifdef V8_EMBEDDED_BUILTINS
 class EmbeddedData final {
  public:
   static EmbeddedData FromIsolate(Isolate* isolate);
@@ -90,7 +89,7 @@ class EmbeddedData final {
 
   void Dispose() { delete[] data_; }
 
-  const uint8_t* InstructionStartOfBuiltin(int i) const;
+  Address InstructionStartOfBuiltin(int i) const;
   uint32_t InstructionSizeOfBuiltin(int i) const;
 
   bool ContainsBuiltin(int i) const { return InstructionSizeOfBuiltin(i) > 0; }
@@ -100,16 +99,26 @@ class EmbeddedData final {
     return RoundUp<kCodeAlignment>(InstructionSizeOfBuiltin(i));
   }
 
+  size_t CreateHash() const;
+  size_t Hash() const {
+    return *reinterpret_cast<const size_t*>(data_ + HashOffset());
+  }
+
   // The layout of the blob is as follows:
   //
-  // [0] offset of instruction stream 0
-  // ... offsets
-  // [N] length of instruction stream 0
-  // ... lengths
-  // ... instruction streams
+  // [0]     hash of the remaining blob
+  // [1]     offset of instruction stream 0
+  // ...     offsets
+  // [N + 1] length of instruction stream 0
+  // ...     lengths
+  // ...     instruction streams
 
   static constexpr uint32_t kTableSize = Builtins::builtin_count;
-  static constexpr uint32_t OffsetsOffset() { return 0; }
+  static constexpr uint32_t HashOffset() { return 0; }
+  static constexpr uint32_t HashSize() { return kSizetSize; }
+  static constexpr uint32_t OffsetsOffset() {
+    return HashOffset() + HashSize();
+  }
   static constexpr uint32_t OffsetsSize() { return kUInt32Size * kTableSize; }
   static constexpr uint32_t LengthsOffset() {
     return OffsetsOffset() + OffsetsSize();
@@ -130,10 +139,11 @@ class EmbeddedData final {
   }
   const uint8_t* RawData() const { return data_ + RawDataOffset(); }
 
+  void PrintStatistics() const;
+
   const uint8_t* data_;
   uint32_t size_;
 };
-#endif
 
 class Snapshot : public AllStatic {
  public:
@@ -194,10 +204,11 @@ class Snapshot : public AllStatic {
                                                uint32_t index);
 
   static uint32_t GetHeaderValue(const v8::StartupData* data, uint32_t offset) {
-    return ReadLittleEndianValue<uint32_t>(data->data + offset);
+    return ReadLittleEndianValue<uint32_t>(
+        reinterpret_cast<Address>(data->data) + offset);
   }
   static void SetHeaderValue(char* data, uint32_t offset, uint32_t value) {
-    WriteLittleEndianValue(data + offset, value);
+    WriteLittleEndianValue(reinterpret_cast<Address>(data) + offset, value);
   }
 
   static void CheckVersion(const v8::StartupData* data);
diff --git a/deps/v8/src/snapshot/startup-deserializer.cc b/deps/v8/src/snapshot/startup-deserializer.cc
index 16d731493de642..e19c67051b787d 100644
--- a/deps/v8/src/snapshot/startup-deserializer.cc
+++ b/deps/v8/src/snapshot/startup-deserializer.cc
@@ -6,6 +6,7 @@
 
 #include "src/api.h"
 #include "src/assembler-inl.h"
+#include "src/code-stubs.h"
 #include "src/heap/heap-inl.h"
 #include "src/snapshot/builtin-deserializer.h"
 #include "src/snapshot/snapshot.h"
@@ -51,12 +52,13 @@ void StartupDeserializer::DeserializeInto(Isolate* isolate) {
     FlushICacheForNewIsolate();
   }
 
-  isolate->heap()->set_native_contexts_list(isolate->heap()->undefined_value());
+  isolate->heap()->set_native_contexts_list(
+      ReadOnlyRoots(isolate).undefined_value());
   // The allocation site list is build during root iteration, but if no sites
   // were encountered then it needs to be initialized to undefined.
   if (isolate->heap()->allocation_sites_list() == Smi::kZero) {
     isolate->heap()->set_allocation_sites_list(
-        isolate->heap()->undefined_value());
+        ReadOnlyRoots(isolate).undefined_value());
   }
 
   // Issue code events for newly deserialized code objects.
@@ -95,7 +97,13 @@ void StartupDeserializer::PrintDisassembledCodeObjects() {
     for (HeapObject* obj = iterator.next(); obj != nullptr;
          obj = iterator.next()) {
       if (obj->IsCode()) {
-        Code::cast(obj)->Disassemble(nullptr, os);
+        Code* code = Code::cast(obj);
+        // Printing of builtins and bytecode handlers is handled during their
+        // deserialization.
+        if (code->kind() != Code::BUILTIN &&
+            code->kind() != Code::BYTECODE_HANDLER) {
+          code->PrintBuiltinCode(isolate(), nullptr);
+        }
       }
     }
   }
diff --git a/deps/v8/src/snapshot/startup-serializer.cc b/deps/v8/src/snapshot/startup-serializer.cc
index dc85a57e11a1ab..2d606dc2e41b06 100644
--- a/deps/v8/src/snapshot/startup-serializer.cc
+++ b/deps/v8/src/snapshot/startup-serializer.cc
@@ -46,15 +46,18 @@ void StartupSerializer::SerializeObject(HeapObject* obj, HowToCode how_to_code,
   if (SerializeBackReference(obj, how_to_code, where_to_point, skip)) return;
 
   FlushSkip(skip);
+  bool use_simulator = false;
+#ifdef USE_SIMULATOR
+  use_simulator = true;
+#endif
 
-  if (isolate()->external_reference_redirector() && obj->IsAccessorInfo()) {
+  if (use_simulator && obj->IsAccessorInfo()) {
     // Wipe external reference redirects in the accessor info.
     AccessorInfo* info = AccessorInfo::cast(obj);
     Address original_address = Foreign::cast(info->getter())->foreign_address();
     Foreign::cast(info->js_getter())->set_foreign_address(original_address);
     accessor_infos_.push_back(info);
-  } else if (isolate()->external_reference_redirector() &&
-             obj->IsCallHandlerInfo()) {
+  } else if (use_simulator && obj->IsCallHandlerInfo()) {
     CallHandlerInfo* info = CallHandlerInfo::cast(obj);
     Address original_address =
         Foreign::cast(info->callback())->foreign_address();
@@ -62,12 +65,12 @@ void StartupSerializer::SerializeObject(HeapObject* obj, HowToCode how_to_code,
     call_handler_infos_.push_back(info);
   } else if (obj->IsScript() && Script::cast(obj)->IsUserJavaScript()) {
     Script::cast(obj)->set_context_data(
-        isolate()->heap()->uninitialized_symbol());
+        ReadOnlyRoots(isolate()).uninitialized_symbol());
   } else if (obj->IsSharedFunctionInfo()) {
     // Clear inferred name for native functions.
     SharedFunctionInfo* shared = SharedFunctionInfo::cast(obj);
     if (!shared->IsSubjectToDebugging() && shared->HasInferredName()) {
-      shared->set_inferred_name(isolate()->heap()->empty_string());
+      shared->set_inferred_name(ReadOnlyRoots(isolate()).empty_string());
     }
   }
 
@@ -83,7 +86,7 @@ void StartupSerializer::SerializeWeakReferencesAndDeferred() {
   // This comes right after serialization of the partial snapshot, where we
   // add entries to the partial snapshot cache of the startup snapshot. Add
   // one entry with 'undefined' to terminate the partial snapshot cache.
-  Object* undefined = isolate()->heap()->undefined_value();
+  Object* undefined = ReadOnlyRoots(isolate()).undefined_value();
   VisitRootPointer(Root::kPartialSnapshotCache, nullptr, &undefined);
   isolate()->heap()->IterateWeakRoots(this, VISIT_FOR_SERIALIZATION);
   SerializeDeferredObjects();
@@ -194,7 +197,7 @@ void SerializedHandleChecker::VisitRootPointers(Root root,
     if (serialized_.find(*p) != serialized_.end()) continue;
     PrintF("%s handle not serialized: ",
            root == Root::kGlobalHandles ? "global" : "eternal");
-    (*p)->Print();
+    (*p)->Print(isolate_);
     ok_ = false;
   }
 }
diff --git a/deps/v8/src/source-position-table.cc b/deps/v8/src/source-position-table.cc
index 1057aba08c6402..6ae24533dfbd3c 100644
--- a/deps/v8/src/source-position-table.cc
+++ b/deps/v8/src/source-position-table.cc
@@ -111,6 +111,22 @@ Vector<const byte> VectorFromByteArray(ByteArray* byte_array) {
                             byte_array->length());
 }
 
+#ifdef ENABLE_SLOW_DCHECKS
+void CheckTableEquals(std::vector<PositionTableEntry>& raw_entries,
+                      SourcePositionTableIterator& encoded) {
+  // Brute force testing: Record all positions and decode
+  // the entire table to verify they are identical.
+  auto raw = raw_entries.begin();
+  for (; !encoded.done(); encoded.Advance(), raw++) {
+    DCHECK(raw != raw_entries.end());
+    DCHECK_EQ(encoded.code_offset(), raw->code_offset);
+    DCHECK_EQ(encoded.source_position().raw(), raw->source_position);
+    DCHECK_EQ(encoded.is_statement(), raw->is_statement);
+  }
+  DCHECK(raw == raw_entries.end());
+}
+#endif
+
 }  // namespace
 
 SourcePositionTableBuilder::SourcePositionTableBuilder(
@@ -143,21 +159,30 @@ Handle<ByteArray> SourcePositionTableBuilder::ToSourcePositionTable(
 
   Handle<ByteArray> table = isolate->factory()->NewByteArray(
       static_cast<int>(bytes_.size()), TENURED);
+  MemCopy(table->GetDataStartAddress(), bytes_.data(), bytes_.size());
 
-  MemCopy(table->GetDataStartAddress(), &*bytes_.begin(), bytes_.size());
+#ifdef ENABLE_SLOW_DCHECKS
+  // Brute force testing: Record all positions and decode
+  // the entire table to verify they are identical.
+  SourcePositionTableIterator it(*table);
+  CheckTableEquals(raw_entries_, it);
+  // No additional source positions after creating the table.
+  mode_ = OMIT_SOURCE_POSITIONS;
+#endif
+  return table;
+}
+
+OwnedVector<byte> SourcePositionTableBuilder::ToSourcePositionTableVector() {
+  if (bytes_.empty()) return OwnedVector<byte>();
+  DCHECK(!Omit());
+
+  OwnedVector<byte> table = OwnedVector<byte>::Of(bytes_);
 
 #ifdef ENABLE_SLOW_DCHECKS
   // Brute force testing: Record all positions and decode
   // the entire table to verify they are identical.
-  auto raw = raw_entries_.begin();
-  for (SourcePositionTableIterator encoded(*table); !encoded.done();
-       encoded.Advance(), raw++) {
-    DCHECK(raw != raw_entries_.end());
-    DCHECK_EQ(encoded.code_offset(), raw->code_offset);
-    DCHECK_EQ(encoded.source_position().raw(), raw->source_position);
-    DCHECK_EQ(encoded.is_statement(), raw->is_statement);
-  }
-  DCHECK(raw == raw_entries_.end());
+  SourcePositionTableIterator it(table.as_vector());
+  CheckTableEquals(raw_entries_, it);
   // No additional source positions after creating the table.
   mode_ = OMIT_SOURCE_POSITIONS;
 #endif
diff --git a/deps/v8/src/source-position-table.h b/deps/v8/src/source-position-table.h
index 652f5aa34a031f..60853bc938cda6 100644
--- a/deps/v8/src/source-position-table.h
+++ b/deps/v8/src/source-position-table.h
@@ -42,6 +42,7 @@ class V8_EXPORT_PRIVATE SourcePositionTableBuilder {
                    bool is_statement);
 
   Handle<ByteArray> ToSourcePositionTable(Isolate* isolate);
+  OwnedVector<byte> ToSourcePositionTableVector();
 
  private:
   void AddEntry(const PositionTableEntry& entry);
diff --git a/deps/v8/src/source-position.cc b/deps/v8/src/source-position.cc
index ab1f1e77d8e8e4..2df5380a243011 100644
--- a/deps/v8/src/source-position.cc
+++ b/deps/v8/src/source-position.cc
@@ -10,17 +10,9 @@ namespace v8 {
 namespace internal {
 
 std::ostream& operator<<(std::ostream& out, const SourcePositionInfo& pos) {
-  Handle<SharedFunctionInfo> function(pos.function);
-  String* name = nullptr;
-  if (function->script()->IsScript()) {
-    Script* script = Script::cast(function->script());
-    if (script->name()->IsString()) {
-      name = String::cast(script->name());
-    }
-  }
   out << "<";
-  if (name != nullptr) {
-    out << name->ToCString(DISALLOW_NULLS).get();
+  if (!pos.script.is_null() && pos.script->name()->IsString()) {
+    out << String::cast(pos.script->name())->ToCString(DISALLOW_NULLS).get();
   } else {
     out << "unknown";
   }
@@ -64,20 +56,21 @@ std::vector<SourcePositionInfo> SourcePosition::InliningStack(
 
 std::vector<SourcePositionInfo> SourcePosition::InliningStack(
     Handle<Code> code) const {
+  Isolate* isolate = code->GetIsolate();
   Handle<DeoptimizationData> deopt_data(
-      DeoptimizationData::cast(code->deoptimization_data()));
+      DeoptimizationData::cast(code->deoptimization_data()), isolate);
   SourcePosition pos = *this;
   std::vector<SourcePositionInfo> stack;
   while (pos.isInlined()) {
     InliningPosition inl =
         deopt_data->InliningPositions()->get(pos.InliningId());
     Handle<SharedFunctionInfo> function(
-        deopt_data->GetInlinedFunction(inl.inlined_function_id));
+        deopt_data->GetInlinedFunction(inl.inlined_function_id), isolate);
     stack.push_back(SourcePositionInfo(pos, function));
     pos = inl.position;
   }
   Handle<SharedFunctionInfo> function(
-      SharedFunctionInfo::cast(deopt_data->SharedFunctionInfo()));
+      SharedFunctionInfo::cast(deopt_data->SharedFunctionInfo()), isolate);
   stack.push_back(SourcePositionInfo(pos, function));
   return stack;
 }
@@ -102,6 +95,11 @@ void SourcePosition::Print(std::ostream& out,
   out << ":" << pos.line + 1 << ":" << pos.column + 1 << ">";
 }
 
+void SourcePosition::PrintJson(std::ostream& out) const {
+  out << "{ \"scriptOffset\" : " << ScriptOffset() << ", "
+      << "  \"inliningId\" : " << InliningId() << "}";
+}
+
 void SourcePosition::Print(std::ostream& out, Code* code) const {
   DeoptimizationData* deopt_data =
       DeoptimizationData::cast(code->deoptimization_data());
@@ -125,9 +123,11 @@ void SourcePosition::Print(std::ostream& out, Code* code) const {
 
 SourcePositionInfo::SourcePositionInfo(SourcePosition pos,
                                        Handle<SharedFunctionInfo> f)
-    : position(pos), function(f) {
-  if (function->script()->IsScript()) {
-    Handle<Script> script(Script::cast(function->script()));
+    : position(pos),
+      script(f.is_null() || !f->script()->IsScript()
+                 ? Handle<Script>::null()
+                 : handle(Script::cast(f->script()), f->GetIsolate())) {
+  if (!script.is_null()) {
     Script::PositionInfo info;
     if (Script::GetPositionInfo(script, pos.ScriptOffset(), &info,
                                 Script::WITH_OFFSET)) {
diff --git a/deps/v8/src/source-position.h b/deps/v8/src/source-position.h
index de2cbce84e9cb2..4931d1d7ad9ebe 100644
--- a/deps/v8/src/source-position.h
+++ b/deps/v8/src/source-position.h
@@ -48,6 +48,7 @@ class SourcePosition final {
       OptimizedCompilationInfo* cinfo) const;
 
   void Print(std::ostream& out, Code* code) const;
+  void PrintJson(std::ostream& out) const;
 
   int ScriptOffset() const { return ScriptOffsetField::decode(value_) - 1; }
   int InliningId() const { return InliningIdField::decode(value_) - 1; }
@@ -105,7 +106,7 @@ struct SourcePositionInfo {
   SourcePositionInfo(SourcePosition pos, Handle<SharedFunctionInfo> f);
 
   SourcePosition position;
-  Handle<SharedFunctionInfo> function;
+  Handle<Script> script;
   int line = -1;
   int column = -1;
 };
diff --git a/deps/v8/src/splay-tree.h b/deps/v8/src/splay-tree.h
index e26d21331ff162..e16575419f3fd2 100644
--- a/deps/v8/src/splay-tree.h
+++ b/deps/v8/src/splay-tree.h
@@ -39,15 +39,13 @@ class SplayTree {
       : root_(nullptr), allocator_(allocator) {}
   ~SplayTree();
 
-  INLINE(void* operator new(size_t size,
-                            AllocationPolicy allocator = AllocationPolicy())) {
+  V8_INLINE void* operator new(
+      size_t size, AllocationPolicy allocator = AllocationPolicy()) {
     return allocator.New(static_cast<int>(size));
   }
-  INLINE(void operator delete(void* p)) {
-    AllocationPolicy::Delete(p);
-  }
+  V8_INLINE void operator delete(void* p) { AllocationPolicy::Delete(p); }
   // Please the MSVC compiler.  We should never have to execute this.
-  INLINE(void operator delete(void* p, AllocationPolicy policy)) {
+  V8_INLINE void operator delete(void* p, AllocationPolicy policy) {
     UNREACHABLE();
   }
 
@@ -102,15 +100,15 @@ class SplayTree {
     Node(const Key& key, const Value& value)
         : key_(key), value_(value), left_(nullptr), right_(nullptr) {}
 
-    INLINE(void* operator new(size_t size, AllocationPolicy allocator)) {
+    V8_INLINE void* operator new(size_t size, AllocationPolicy allocator) {
       return allocator.New(static_cast<int>(size));
     }
-    INLINE(void operator delete(void* p)) {
+    V8_INLINE void operator delete(void* p) {
       return AllocationPolicy::Delete(p);
     }
     // Please the MSVC compiler.  We should never have to execute
     // this.
-    INLINE(void operator delete(void* p, AllocationPolicy allocator)) {
+    V8_INLINE void operator delete(void* p, AllocationPolicy allocator) {
       UNREACHABLE();
     }
 
diff --git a/deps/v8/src/string-builder.cc b/deps/v8/src/string-builder.cc
index 6c5144d574aea6..bee5db95085980 100644
--- a/deps/v8/src/string-builder.cc
+++ b/deps/v8/src/string-builder.cc
@@ -52,7 +52,8 @@ IncrementalStringBuilder::IncrementalStringBuilder(Isolate* isolate)
       part_length_(kInitialPartLength),
       current_index_(0) {
   // Create an accumulator handle starting with the empty string.
-  accumulator_ = Handle<String>::New(isolate->heap()->empty_string(), isolate);
+  accumulator_ =
+      Handle<String>::New(ReadOnlyRoots(isolate).empty_string(), isolate);
   current_part_ =
       factory()->NewRawOneByteString(part_length_).ToHandleChecked();
 }
diff --git a/deps/v8/src/string-builder.h b/deps/v8/src/string-builder.h
index 66776dfe67f01b..c1b232701d443a 100644
--- a/deps/v8/src/string-builder.h
+++ b/deps/v8/src/string-builder.h
@@ -270,12 +270,12 @@ class IncrementalStringBuilder {
  public:
   explicit IncrementalStringBuilder(Isolate* isolate);
 
-  INLINE(String::Encoding CurrentEncoding()) { return encoding_; }
+  V8_INLINE String::Encoding CurrentEncoding() { return encoding_; }
 
   template <typename SrcChar, typename DestChar>
-  INLINE(void Append(SrcChar c));
+  V8_INLINE void Append(SrcChar c);
 
-  INLINE(void AppendCharacter(uint8_t c)) {
+  V8_INLINE void AppendCharacter(uint8_t c) {
     if (encoding_ == String::ONE_BYTE_ENCODING) {
       Append<uint8_t, uint8_t>(c);
     } else {
@@ -283,7 +283,7 @@ class IncrementalStringBuilder {
     }
   }
 
-  INLINE(void AppendCString(const char* s)) {
+  V8_INLINE void AppendCString(const char* s) {
     const uint8_t* u = reinterpret_cast<const uint8_t*>(s);
     if (encoding_ == String::ONE_BYTE_ENCODING) {
       while (*u != '\0') Append<uint8_t, uint8_t>(*(u++));
@@ -292,7 +292,7 @@ class IncrementalStringBuilder {
     }
   }
 
-  INLINE(void AppendCString(const uc16* s)) {
+  V8_INLINE void AppendCString(const uc16* s) {
     if (encoding_ == String::ONE_BYTE_ENCODING) {
       while (*s != '\0') Append<uc16, uint8_t>(*(s++));
     } else {
@@ -300,7 +300,7 @@ class IncrementalStringBuilder {
     }
   }
 
-  INLINE(bool CurrentPartCanFit(int length)) {
+  V8_INLINE bool CurrentPartCanFit(int length) {
     return part_length_ - current_index_ > length;
   }
 
@@ -308,7 +308,7 @@ class IncrementalStringBuilder {
   // serialized without allocating a new string part. The worst case length of
   // an escaped character is 6. Shifting the remaining string length right by 3
   // is a more pessimistic estimate, but faster to calculate.
-  INLINE(int EscapedLengthIfCurrentPartFits(int length)) {
+  V8_INLINE int EscapedLengthIfCurrentPartFits(int length) {
     if (length > kMaxPartLength) return 0;
     STATIC_ASSERT((kMaxPartLength << 3) <= String::kMaxLength);
     // This shift will not overflow because length is already less than the
@@ -321,9 +321,11 @@ class IncrementalStringBuilder {
 
   MaybeHandle<String> Finish();
 
-  INLINE(bool HasOverflowed()) const { return overflowed_; }
+  V8_INLINE bool HasOverflowed() const { return overflowed_; }
 
-  INLINE(int Length()) const { return accumulator_->length() + current_index_; }
+  V8_INLINE int Length() const {
+    return accumulator_->length() + current_index_;
+  }
 
   // Change encoding to two-byte.
   void ChangeEncoding() {
@@ -348,8 +350,8 @@ class IncrementalStringBuilder {
       cursor_ = start_;
     }
 
-    INLINE(void Append(DestChar c)) { *(cursor_++) = c; }
-    INLINE(void AppendCString(const char* s)) {
+    V8_INLINE void Append(DestChar c) { *(cursor_++) = c; }
+    V8_INLINE void AppendCString(const char* s) {
       const uint8_t* u = reinterpret_cast<const uint8_t*>(s);
       while (*u != '\0') Append(*(u++));
     }
@@ -402,15 +404,15 @@ class IncrementalStringBuilder {
  private:
   Factory* factory() { return isolate_->factory(); }
 
-  INLINE(Handle<String> accumulator()) { return accumulator_; }
+  V8_INLINE Handle<String> accumulator() { return accumulator_; }
 
-  INLINE(void set_accumulator(Handle<String> string)) {
+  V8_INLINE void set_accumulator(Handle<String> string) {
     *accumulator_.location() = *string;
   }
 
-  INLINE(Handle<String> current_part()) { return current_part_; }
+  V8_INLINE Handle<String> current_part() { return current_part_; }
 
-  INLINE(void set_current_part(Handle<String> string)) {
+  V8_INLINE void set_current_part(Handle<String> string) {
     *current_part_.location() = *string;
   }
 
diff --git a/deps/v8/src/string-hasher-inl.h b/deps/v8/src/string-hasher-inl.h
index b002f12d4ad022..c742c651642e2e 100644
--- a/deps/v8/src/string-hasher-inl.h
+++ b/deps/v8/src/string-hasher-inl.h
@@ -142,6 +142,11 @@ void IteratingStringHasher::VisitTwoByteString(const uint16_t* chars,
   AddCharacters(chars, length);
 }
 
+std::size_t SeededStringHasher::operator()(const char* name) const {
+  return StringHasher::HashSequentialString(
+      name, static_cast<int>(strlen(name)), hashseed_);
+}
+
 }  // namespace internal
 }  // namespace v8
 
diff --git a/deps/v8/src/string-hasher.h b/deps/v8/src/string-hasher.h
index 867a480a4187c1..b9f45972e7aa6f 100644
--- a/deps/v8/src/string-hasher.h
+++ b/deps/v8/src/string-hasher.h
@@ -39,13 +39,13 @@ class V8_EXPORT_PRIVATE StringHasher {
   static const int kZeroHash = 27;
 
   // Reusable parts of the hashing algorithm.
-  INLINE(static uint32_t AddCharacterCore(uint32_t running_hash, uint16_t c));
-  INLINE(static uint32_t GetHashCore(uint32_t running_hash));
-  INLINE(static uint32_t ComputeRunningHash(uint32_t running_hash,
-                                            const uc16* chars, int length));
-  INLINE(static uint32_t ComputeRunningHashOneByte(uint32_t running_hash,
-                                                   const char* chars,
-                                                   int length));
+  V8_INLINE static uint32_t AddCharacterCore(uint32_t running_hash, uint16_t c);
+  V8_INLINE static uint32_t GetHashCore(uint32_t running_hash);
+  V8_INLINE static uint32_t ComputeRunningHash(uint32_t running_hash,
+                                               const uc16* chars, int length);
+  V8_INLINE static uint32_t ComputeRunningHashOneByte(uint32_t running_hash,
+                                                      const char* chars,
+                                                      int length);
 
  protected:
   // Returns the value to store in the hash field of a string with
@@ -84,6 +84,21 @@ class IteratingStringHasher : public StringHasher {
   DISALLOW_COPY_AND_ASSIGN(IteratingStringHasher);
 };
 
+// Useful for std containers that require something ()'able.
+struct SeededStringHasher {
+  explicit SeededStringHasher(uint32_t hashseed) : hashseed_(hashseed) {}
+  inline std::size_t operator()(const char* name) const;
+
+  uint32_t hashseed_;
+};
+
+// Useful for std containers that require something ()'able.
+struct StringEquals {
+  bool operator()(const char* name1, const char* name2) const {
+    return strcmp(name1, name2) == 0;
+  }
+};
+
 }  // namespace internal
 }  // namespace v8
 
diff --git a/deps/v8/src/string-search.h b/deps/v8/src/string-search.h
index aa7b847ce6e121..bf96879a2904cc 100644
--- a/deps/v8/src/string-search.h
+++ b/deps/v8/src/string-search.h
@@ -567,9 +567,9 @@ int SearchString(Isolate* isolate,
 // and pattern as vectors before calling SearchString. Used from the
 // StringIndexOf builtin.
 template <typename SubjectChar, typename PatternChar>
-int SearchStringRaw(Isolate* isolate, const SubjectChar* subject_ptr,
-                    int subject_length, const PatternChar* pattern_ptr,
-                    int pattern_length, int start_index) {
+intptr_t SearchStringRaw(Isolate* isolate, const SubjectChar* subject_ptr,
+                         int subject_length, const PatternChar* pattern_ptr,
+                         int pattern_length, int start_index) {
   DisallowHeapAllocation no_gc;
   Vector<const SubjectChar> subject(subject_ptr, subject_length);
   Vector<const PatternChar> pattern(pattern_ptr, pattern_length);
diff --git a/deps/v8/src/torque/Torque.g4 b/deps/v8/src/torque/Torque.g4
new file mode 100644
index 00000000000000..662f96dc382dbc
--- /dev/null
+++ b/deps/v8/src/torque/Torque.g4
@@ -0,0 +1,295 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+grammar Torque;
+
+options {
+  language=Cpp;
+}
+
+// parser rules start with lowercase letters, lexer rules with uppercase
+MACRO: 'macro';
+BUILTIN: 'builtin';
+RUNTIME: 'runtime';
+MODULE: 'module';
+JAVASCRIPT: 'javascript';
+DEFERRED: 'deferred';
+IF: 'if';
+FOR: 'for';
+WHILE: 'while';
+RETURN: 'return';
+CONSTEXPR: 'constexpr';
+CONTINUE: 'continue';
+BREAK: 'break';
+GOTO: 'goto';
+OTHERWISE: 'otherwise';
+TRY: 'try';
+LABEL: 'label';
+LABELS: 'labels';
+TAIL: 'tail';
+ISNT: 'isnt';
+IS: 'is';
+LET: 'let';
+EXTERN: 'extern';
+ASSERT_TOKEN: 'assert';
+CHECK_TOKEN: 'check';
+UNREACHABLE_TOKEN: 'unreachable';
+DEBUG_TOKEN: 'debug';
+
+ASSIGNMENT: '=';
+ASSIGNMENT_OPERATOR
+        : '*='
+        | '/='
+        | '%='
+        | '+='
+        | '-='
+        | '<<='
+        | '>>='
+        | '>>>='
+        | '&='
+        | '^='
+        | '|='
+        ;
+
+EQUAL: '==';
+PLUS: '+';
+MINUS: '-';
+MULTIPLY: '*';
+DIVIDE: '/';
+MODULO: '%';
+BIT_OR: '|';
+BIT_AND: '&';
+BIT_NOT: '~';
+MAX: 'max';
+MIN: 'min';
+NOT_EQUAL: '!=';
+LESS_THAN: '<';
+LESS_THAN_EQUAL: '<=';
+GREATER_THAN: '>';
+GREATER_THAN_EQUAL: '>=';
+SHIFT_LEFT: '<<';
+SHIFT_RIGHT: '>>';
+SHIFT_RIGHT_ARITHMETIC: '>>>';
+VARARGS: '...';
+
+EQUALITY_OPERATOR: EQUAL | NOT_EQUAL;
+
+INCREMENT: '++';
+DECREMENT: '--';
+NOT: '!';
+
+STRING_LITERAL : ('"' ( ESCAPE | ~('"' | '\\' | '\n' | '\r') ) * '"')
+               | ('\'' ( ESCAPE | ~('\'' | '\\' | '\n' | '\r') ) * '\'');
+fragment ESCAPE : '\\' ( '\'' | '\\' | '"' | 'n' | 'r' );
+
+IDENTIFIER  :   [A-Za-z][0-9A-Za-z_]* ;
+
+WS  : [ \t\r\n\f]+ -> channel(HIDDEN);
+
+BLOCK_COMMENT
+        : '/*' .*? ('*/' | EOF)  -> channel(HIDDEN)
+        ;
+
+LINE_COMMENT
+        : '//' ~[\r\n]*  -> channel(HIDDEN)
+        ;
+
+fragment DECIMAL_DIGIT
+        : [0-9]
+        ;
+
+fragment DECIMAL_INTEGER_LITERAL
+        : '0'
+        | [1-9] DECIMAL_DIGIT*
+        ;
+
+fragment EXPONENT_PART
+        : [eE] [+-]? DECIMAL_DIGIT+
+        ;
+
+DECIMAL_LITERAL
+        : MINUS? DECIMAL_INTEGER_LITERAL '.' DECIMAL_DIGIT* EXPONENT_PART?
+        | MINUS? '.' DECIMAL_DIGIT+ EXPONENT_PART?
+        | MINUS? DECIMAL_INTEGER_LITERAL EXPONENT_PART?
+        | MINUS? '0x' [0-9a-fA-F]+
+        ;
+
+type : CONSTEXPR? IDENTIFIER
+     | BUILTIN '(' typeList ')' '=>' type
+     | type BIT_OR type
+     | '(' type ')'
+     ;
+
+typeList : (type (',' type)*)?;
+genericSpecializationTypeList: '<' typeList '>';
+
+optionalGenericTypeList: ('<' IDENTIFIER ':' 'type' (',' IDENTIFIER ':' 'type')* '>')?;
+
+typeListMaybeVarArgs: '(' type? (',' type)* (',' VARARGS)? ')'
+                    | '(' VARARGS ')';
+
+labelParameter: IDENTIFIER ( '(' typeList ')' )?;
+
+optionalType: (':' type)?;
+optionalLabelList: (LABELS labelParameter (',' labelParameter)*)?;
+optionalOtherwise: (OTHERWISE IDENTIFIER (',' IDENTIFIER)*)?;
+
+parameter: IDENTIFIER ':' type?;
+parameterList
+        : '(' parameter? (',' parameter)* ')'
+        | '(' parameter ',' parameter ',' VARARGS IDENTIFIER ')';
+labelDeclaration: IDENTIFIER parameterList?;
+
+expression
+        : conditionalExpression;
+
+conditionalExpression
+        : logicalORExpression
+        | conditionalExpression '?' logicalORExpression ':' logicalORExpression;
+
+logicalORExpression
+        : logicalANDExpression
+        | logicalORExpression '||' logicalANDExpression;
+
+logicalANDExpression
+        : bitwiseExpression
+        | logicalANDExpression '&&' bitwiseExpression;
+
+bitwiseExpression
+        : equalityExpression
+        | bitwiseExpression op=(BIT_AND | BIT_OR)  equalityExpression;
+
+equalityExpression
+        : relationalExpression
+        | equalityExpression
+          op=(EQUAL | NOT_EQUAL)
+          relationalExpression;
+
+relationalExpression
+        : shiftExpression
+        | relationalExpression
+          op=(LESS_THAN | LESS_THAN_EQUAL | GREATER_THAN | GREATER_THAN_EQUAL)
+          shiftExpression;
+
+shiftExpression
+        : additiveExpression
+        | shiftExpression op=(SHIFT_RIGHT | SHIFT_LEFT | SHIFT_RIGHT_ARITHMETIC) additiveExpression;
+
+additiveExpression
+        : multiplicativeExpression
+        | additiveExpression op=(PLUS | MINUS) multiplicativeExpression;
+
+multiplicativeExpression
+        : unaryExpression
+        | multiplicativeExpression op=(MULTIPLY | DIVIDE | MODULO) unaryExpression;
+
+unaryExpression
+        : assignmentExpression
+        | op=(PLUS | MINUS | BIT_NOT | NOT) unaryExpression;
+
+locationExpression
+        : IDENTIFIER genericSpecializationTypeList?
+        | locationExpression '.' IDENTIFIER
+        | locationExpression '[' expression ']';
+
+incrementDecrement
+        : INCREMENT locationExpression
+        | DECREMENT locationExpression
+        | locationExpression op=INCREMENT
+        | locationExpression op=DECREMENT
+        ;
+
+assignment
+        : incrementDecrement
+        | locationExpression ((ASSIGNMENT | ASSIGNMENT_OPERATOR) expression)?;
+
+assignmentExpression
+        : primaryExpression
+        | assignment;
+
+primaryExpression
+        : helperCall
+        | DECIMAL_LITERAL
+        | STRING_LITERAL
+        | ('(' expression ')');
+
+forInitialization : variableDeclarationWithInitialization?;
+forLoop: FOR '(' forInitialization ';' expression ';' assignment ')' statementBlock;
+
+rangeSpecifier: '[' begin=expression? ':' end=expression? ']';
+forOfRange: rangeSpecifier?;
+forOfLoop: FOR '(' variableDeclaration 'of' expression forOfRange ')' statementBlock;
+
+argument: expression;
+argumentList: '(' argument? (',' argument)* ')';
+
+helperCall: (MIN | MAX | IDENTIFIER) genericSpecializationTypeList? argumentList optionalOtherwise;
+
+labelReference: IDENTIFIER;
+variableDeclaration: LET IDENTIFIER ':' type;
+variableDeclarationWithInitialization: variableDeclaration (ASSIGNMENT expression)?;
+helperCallStatement: (TAIL)? helperCall;
+expressionStatement: assignment;
+ifStatement: IF CONSTEXPR? '(' expression ')' statementBlock ('else' statementBlock)?;
+whileLoop: WHILE '(' expression ')' statementBlock;
+returnStatement: RETURN expression?;
+breakStatement: BREAK;
+continueStatement: CONTINUE;
+gotoStatement: GOTO labelReference argumentList?;
+handlerWithStatement: LABEL labelDeclaration statementBlock;
+tryLabelStatement: TRY statementBlock handlerWithStatement+;
+
+diagnosticStatement: ((ASSERT_TOKEN | CHECK_TOKEN) '(' expression ')') | UNREACHABLE_TOKEN | DEBUG_TOKEN;
+
+statement : variableDeclarationWithInitialization ';'
+          | helperCallStatement ';'
+          | expressionStatement ';'
+          | returnStatement ';'
+          | breakStatement ';'
+          | continueStatement ';'
+          | gotoStatement ';'
+          | ifStatement
+          | diagnosticStatement ';'
+          | whileLoop
+          | forOfLoop
+          | forLoop
+          | tryLabelStatement
+          ;
+
+statementList : statement*;
+statementScope : DEFERRED? '{' statementList '}';
+statementBlock
+        : statement
+        | statementScope;
+
+helperBody : statementScope;
+
+extendsDeclaration: 'extends' IDENTIFIER;
+generatesDeclaration: 'generates' STRING_LITERAL;
+constexprDeclaration: 'constexpr' STRING_LITERAL;
+typeDeclaration : 'type' IDENTIFIER extendsDeclaration? generatesDeclaration? constexprDeclaration?';';
+typeAliasDeclaration : 'type' IDENTIFIER '=' type ';';
+
+externalBuiltin : EXTERN JAVASCRIPT? BUILTIN IDENTIFIER optionalGenericTypeList '(' typeList ')' optionalType ';';
+externalMacro : EXTERN ('operator' STRING_LITERAL)? MACRO IDENTIFIER optionalGenericTypeList typeListMaybeVarArgs optionalType optionalLabelList ';';
+externalRuntime : EXTERN RUNTIME IDENTIFIER typeListMaybeVarArgs optionalType ';';
+builtinDeclaration : JAVASCRIPT? BUILTIN IDENTIFIER optionalGenericTypeList parameterList optionalType (helperBody | ';');
+genericSpecialization: IDENTIFIER genericSpecializationTypeList parameterList optionalType optionalLabelList helperBody;
+macroDeclaration : ('operator' STRING_LITERAL)? MACRO IDENTIFIER optionalGenericTypeList parameterList optionalType optionalLabelList (helperBody | ';');
+externConstDeclaration : 'const' IDENTIFIER ':' type generatesDeclaration ';';
+
+declaration
+        : typeDeclaration
+        | typeAliasDeclaration
+        | builtinDeclaration
+        | genericSpecialization
+        | macroDeclaration
+        | externalMacro
+        | externalBuiltin
+        | externalRuntime
+        | externConstDeclaration;
+
+moduleDeclaration : MODULE IDENTIFIER '{' declaration* '}';
+
+file: (moduleDeclaration | declaration)*;
diff --git a/deps/v8/src/torque/TorqueBaseListener.cpp b/deps/v8/src/torque/TorqueBaseListener.cpp
new file mode 100644
index 00000000000000..259494041ac2d1
--- /dev/null
+++ b/deps/v8/src/torque/TorqueBaseListener.cpp
@@ -0,0 +1,7 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Generated from Torque.g4 by ANTLR 4.7.1
+
+#include "TorqueBaseListener.h"
diff --git a/deps/v8/src/torque/TorqueBaseListener.h b/deps/v8/src/torque/TorqueBaseListener.h
new file mode 100644
index 00000000000000..8f6095721b796d
--- /dev/null
+++ b/deps/v8/src/torque/TorqueBaseListener.h
@@ -0,0 +1,343 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+#ifndef V8_TORQUE_TORQUEBASELISTENER_H_
+#define V8_TORQUE_TORQUEBASELISTENER_H_
+
+// Generated from Torque.g4 by ANTLR 4.7.1
+
+#pragma once
+
+#include "./antlr4-runtime.h"
+#include "TorqueListener.h"
+
+/**
+ * This class provides an empty implementation of TorqueListener,
+ * which can be extended to create a listener which only needs to handle a
+ * subset of the available methods.
+ */
+class TorqueBaseListener : public TorqueListener {
+ public:
+  void enterType(TorqueParser::TypeContext* /*ctx*/) override {}
+  void exitType(TorqueParser::TypeContext* /*ctx*/) override {}
+
+  void enterTypeList(TorqueParser::TypeListContext* /*ctx*/) override {}
+  void exitTypeList(TorqueParser::TypeListContext* /*ctx*/) override {}
+
+  void enterGenericSpecializationTypeList(
+      TorqueParser::GenericSpecializationTypeListContext* /*ctx*/) override {}
+  void exitGenericSpecializationTypeList(
+      TorqueParser::GenericSpecializationTypeListContext* /*ctx*/) override {}
+
+  void enterOptionalGenericTypeList(
+      TorqueParser::OptionalGenericTypeListContext* /*ctx*/) override {}
+  void exitOptionalGenericTypeList(
+      TorqueParser::OptionalGenericTypeListContext* /*ctx*/) override {}
+
+  void enterTypeListMaybeVarArgs(
+      TorqueParser::TypeListMaybeVarArgsContext* /*ctx*/) override {}
+  void exitTypeListMaybeVarArgs(
+      TorqueParser::TypeListMaybeVarArgsContext* /*ctx*/) override {}
+
+  void enterLabelParameter(
+      TorqueParser::LabelParameterContext* /*ctx*/) override {}
+  void exitLabelParameter(
+      TorqueParser::LabelParameterContext* /*ctx*/) override {}
+
+  void enterOptionalType(TorqueParser::OptionalTypeContext* /*ctx*/) override {}
+  void exitOptionalType(TorqueParser::OptionalTypeContext* /*ctx*/) override {}
+
+  void enterOptionalLabelList(
+      TorqueParser::OptionalLabelListContext* /*ctx*/) override {}
+  void exitOptionalLabelList(
+      TorqueParser::OptionalLabelListContext* /*ctx*/) override {}
+
+  void enterOptionalOtherwise(
+      TorqueParser::OptionalOtherwiseContext* /*ctx*/) override {}
+  void exitOptionalOtherwise(
+      TorqueParser::OptionalOtherwiseContext* /*ctx*/) override {}
+
+  void enterParameter(TorqueParser::ParameterContext* /*ctx*/) override {}
+  void exitParameter(TorqueParser::ParameterContext* /*ctx*/) override {}
+
+  void enterParameterList(
+      TorqueParser::ParameterListContext* /*ctx*/) override {}
+  void exitParameterList(TorqueParser::ParameterListContext* /*ctx*/) override {
+  }
+
+  void enterLabelDeclaration(
+      TorqueParser::LabelDeclarationContext* /*ctx*/) override {}
+  void exitLabelDeclaration(
+      TorqueParser::LabelDeclarationContext* /*ctx*/) override {}
+
+  void enterExpression(TorqueParser::ExpressionContext* /*ctx*/) override {}
+  void exitExpression(TorqueParser::ExpressionContext* /*ctx*/) override {}
+
+  void enterConditionalExpression(
+      TorqueParser::ConditionalExpressionContext* /*ctx*/) override {}
+  void exitConditionalExpression(
+      TorqueParser::ConditionalExpressionContext* /*ctx*/) override {}
+
+  void enterLogicalORExpression(
+      TorqueParser::LogicalORExpressionContext* /*ctx*/) override {}
+  void exitLogicalORExpression(
+      TorqueParser::LogicalORExpressionContext* /*ctx*/) override {}
+
+  void enterLogicalANDExpression(
+      TorqueParser::LogicalANDExpressionContext* /*ctx*/) override {}
+  void exitLogicalANDExpression(
+      TorqueParser::LogicalANDExpressionContext* /*ctx*/) override {}
+
+  void enterBitwiseExpression(
+      TorqueParser::BitwiseExpressionContext* /*ctx*/) override {}
+  void exitBitwiseExpression(
+      TorqueParser::BitwiseExpressionContext* /*ctx*/) override {}
+
+  void enterEqualityExpression(
+      TorqueParser::EqualityExpressionContext* /*ctx*/) override {}
+  void exitEqualityExpression(
+      TorqueParser::EqualityExpressionContext* /*ctx*/) override {}
+
+  void enterRelationalExpression(
+      TorqueParser::RelationalExpressionContext* /*ctx*/) override {}
+  void exitRelationalExpression(
+      TorqueParser::RelationalExpressionContext* /*ctx*/) override {}
+
+  void enterShiftExpression(
+      TorqueParser::ShiftExpressionContext* /*ctx*/) override {}
+  void exitShiftExpression(
+      TorqueParser::ShiftExpressionContext* /*ctx*/) override {}
+
+  void enterAdditiveExpression(
+      TorqueParser::AdditiveExpressionContext* /*ctx*/) override {}
+  void exitAdditiveExpression(
+      TorqueParser::AdditiveExpressionContext* /*ctx*/) override {}
+
+  void enterMultiplicativeExpression(
+      TorqueParser::MultiplicativeExpressionContext* /*ctx*/) override {}
+  void exitMultiplicativeExpression(
+      TorqueParser::MultiplicativeExpressionContext* /*ctx*/) override {}
+
+  void enterUnaryExpression(
+      TorqueParser::UnaryExpressionContext* /*ctx*/) override {}
+  void exitUnaryExpression(
+      TorqueParser::UnaryExpressionContext* /*ctx*/) override {}
+
+  void enterLocationExpression(
+      TorqueParser::LocationExpressionContext* /*ctx*/) override {}
+  void exitLocationExpression(
+      TorqueParser::LocationExpressionContext* /*ctx*/) override {}
+
+  void enterIncrementDecrement(
+      TorqueParser::IncrementDecrementContext* /*ctx*/) override {}
+  void exitIncrementDecrement(
+      TorqueParser::IncrementDecrementContext* /*ctx*/) override {}
+
+  void enterAssignment(TorqueParser::AssignmentContext* /*ctx*/) override {}
+  void exitAssignment(TorqueParser::AssignmentContext* /*ctx*/) override {}
+
+  void enterAssignmentExpression(
+      TorqueParser::AssignmentExpressionContext* /*ctx*/) override {}
+  void exitAssignmentExpression(
+      TorqueParser::AssignmentExpressionContext* /*ctx*/) override {}
+
+  void enterPrimaryExpression(
+      TorqueParser::PrimaryExpressionContext* /*ctx*/) override {}
+  void exitPrimaryExpression(
+      TorqueParser::PrimaryExpressionContext* /*ctx*/) override {}
+
+  void enterForInitialization(
+      TorqueParser::ForInitializationContext* /*ctx*/) override {}
+  void exitForInitialization(
+      TorqueParser::ForInitializationContext* /*ctx*/) override {}
+
+  void enterForLoop(TorqueParser::ForLoopContext* /*ctx*/) override {}
+  void exitForLoop(TorqueParser::ForLoopContext* /*ctx*/) override {}
+
+  void enterRangeSpecifier(
+      TorqueParser::RangeSpecifierContext* /*ctx*/) override {}
+  void exitRangeSpecifier(
+      TorqueParser::RangeSpecifierContext* /*ctx*/) override {}
+
+  void enterForOfRange(TorqueParser::ForOfRangeContext* /*ctx*/) override {}
+  void exitForOfRange(TorqueParser::ForOfRangeContext* /*ctx*/) override {}
+
+  void enterForOfLoop(TorqueParser::ForOfLoopContext* /*ctx*/) override {}
+  void exitForOfLoop(TorqueParser::ForOfLoopContext* /*ctx*/) override {}
+
+  void enterArgument(TorqueParser::ArgumentContext* /*ctx*/) override {}
+  void exitArgument(TorqueParser::ArgumentContext* /*ctx*/) override {}
+
+  void enterArgumentList(TorqueParser::ArgumentListContext* /*ctx*/) override {}
+  void exitArgumentList(TorqueParser::ArgumentListContext* /*ctx*/) override {}
+
+  void enterHelperCall(TorqueParser::HelperCallContext* /*ctx*/) override {}
+  void exitHelperCall(TorqueParser::HelperCallContext* /*ctx*/) override {}
+
+  void enterLabelReference(
+      TorqueParser::LabelReferenceContext* /*ctx*/) override {}
+  void exitLabelReference(
+      TorqueParser::LabelReferenceContext* /*ctx*/) override {}
+
+  void enterVariableDeclaration(
+      TorqueParser::VariableDeclarationContext* /*ctx*/) override {}
+  void exitVariableDeclaration(
+      TorqueParser::VariableDeclarationContext* /*ctx*/) override {}
+
+  void enterVariableDeclarationWithInitialization(
+      TorqueParser::VariableDeclarationWithInitializationContext* /*ctx*/)
+      override {}
+  void exitVariableDeclarationWithInitialization(
+      TorqueParser::VariableDeclarationWithInitializationContext* /*ctx*/)
+      override {}
+
+  void enterHelperCallStatement(
+      TorqueParser::HelperCallStatementContext* /*ctx*/) override {}
+  void exitHelperCallStatement(
+      TorqueParser::HelperCallStatementContext* /*ctx*/) override {}
+
+  void enterExpressionStatement(
+      TorqueParser::ExpressionStatementContext* /*ctx*/) override {}
+  void exitExpressionStatement(
+      TorqueParser::ExpressionStatementContext* /*ctx*/) override {}
+
+  void enterIfStatement(TorqueParser::IfStatementContext* /*ctx*/) override {}
+  void exitIfStatement(TorqueParser::IfStatementContext* /*ctx*/) override {}
+
+  void enterWhileLoop(TorqueParser::WhileLoopContext* /*ctx*/) override {}
+  void exitWhileLoop(TorqueParser::WhileLoopContext* /*ctx*/) override {}
+
+  void enterReturnStatement(
+      TorqueParser::ReturnStatementContext* /*ctx*/) override {}
+  void exitReturnStatement(
+      TorqueParser::ReturnStatementContext* /*ctx*/) override {}
+
+  void enterBreakStatement(
+      TorqueParser::BreakStatementContext* /*ctx*/) override {}
+  void exitBreakStatement(
+      TorqueParser::BreakStatementContext* /*ctx*/) override {}
+
+  void enterContinueStatement(
+      TorqueParser::ContinueStatementContext* /*ctx*/) override {}
+  void exitContinueStatement(
+      TorqueParser::ContinueStatementContext* /*ctx*/) override {}
+
+  void enterGotoStatement(
+      TorqueParser::GotoStatementContext* /*ctx*/) override {}
+  void exitGotoStatement(TorqueParser::GotoStatementContext* /*ctx*/) override {
+  }
+
+  void enterHandlerWithStatement(
+      TorqueParser::HandlerWithStatementContext* /*ctx*/) override {}
+  void exitHandlerWithStatement(
+      TorqueParser::HandlerWithStatementContext* /*ctx*/) override {}
+
+  void enterTryLabelStatement(
+      TorqueParser::TryLabelStatementContext* /*ctx*/) override {}
+  void exitTryLabelStatement(
+      TorqueParser::TryLabelStatementContext* /*ctx*/) override {}
+
+  void enterDiagnosticStatement(
+      TorqueParser::DiagnosticStatementContext* /*ctx*/) override {}
+  void exitDiagnosticStatement(
+      TorqueParser::DiagnosticStatementContext* /*ctx*/) override {}
+
+  void enterStatement(TorqueParser::StatementContext* /*ctx*/) override {}
+  void exitStatement(TorqueParser::StatementContext* /*ctx*/) override {}
+
+  void enterStatementList(
+      TorqueParser::StatementListContext* /*ctx*/) override {}
+  void exitStatementList(TorqueParser::StatementListContext* /*ctx*/) override {
+  }
+
+  void enterStatementScope(
+      TorqueParser::StatementScopeContext* /*ctx*/) override {}
+  void exitStatementScope(
+      TorqueParser::StatementScopeContext* /*ctx*/) override {}
+
+  void enterStatementBlock(
+      TorqueParser::StatementBlockContext* /*ctx*/) override {}
+  void exitStatementBlock(
+      TorqueParser::StatementBlockContext* /*ctx*/) override {}
+
+  void enterHelperBody(TorqueParser::HelperBodyContext* /*ctx*/) override {}
+  void exitHelperBody(TorqueParser::HelperBodyContext* /*ctx*/) override {}
+
+  void enterExtendsDeclaration(
+      TorqueParser::ExtendsDeclarationContext* /*ctx*/) override {}
+  void exitExtendsDeclaration(
+      TorqueParser::ExtendsDeclarationContext* /*ctx*/) override {}
+
+  void enterGeneratesDeclaration(
+      TorqueParser::GeneratesDeclarationContext* /*ctx*/) override {}
+  void exitGeneratesDeclaration(
+      TorqueParser::GeneratesDeclarationContext* /*ctx*/) override {}
+
+  void enterConstexprDeclaration(
+      TorqueParser::ConstexprDeclarationContext* /*ctx*/) override {}
+  void exitConstexprDeclaration(
+      TorqueParser::ConstexprDeclarationContext* /*ctx*/) override {}
+
+  void enterTypeDeclaration(
+      TorqueParser::TypeDeclarationContext* /*ctx*/) override {}
+  void exitTypeDeclaration(
+      TorqueParser::TypeDeclarationContext* /*ctx*/) override {}
+
+  void enterTypeAliasDeclaration(
+      TorqueParser::TypeAliasDeclarationContext* /*ctx*/) override {}
+  void exitTypeAliasDeclaration(
+      TorqueParser::TypeAliasDeclarationContext* /*ctx*/) override {}
+
+  void enterExternalBuiltin(
+      TorqueParser::ExternalBuiltinContext* /*ctx*/) override {}
+  void exitExternalBuiltin(
+      TorqueParser::ExternalBuiltinContext* /*ctx*/) override {}
+
+  void enterExternalMacro(
+      TorqueParser::ExternalMacroContext* /*ctx*/) override {}
+  void exitExternalMacro(TorqueParser::ExternalMacroContext* /*ctx*/) override {
+  }
+
+  void enterExternalRuntime(
+      TorqueParser::ExternalRuntimeContext* /*ctx*/) override {}
+  void exitExternalRuntime(
+      TorqueParser::ExternalRuntimeContext* /*ctx*/) override {}
+
+  void enterBuiltinDeclaration(
+      TorqueParser::BuiltinDeclarationContext* /*ctx*/) override {}
+  void exitBuiltinDeclaration(
+      TorqueParser::BuiltinDeclarationContext* /*ctx*/) override {}
+
+  void enterGenericSpecialization(
+      TorqueParser::GenericSpecializationContext* /*ctx*/) override {}
+  void exitGenericSpecialization(
+      TorqueParser::GenericSpecializationContext* /*ctx*/) override {}
+
+  void enterMacroDeclaration(
+      TorqueParser::MacroDeclarationContext* /*ctx*/) override {}
+  void exitMacroDeclaration(
+      TorqueParser::MacroDeclarationContext* /*ctx*/) override {}
+
+  void enterExternConstDeclaration(
+      TorqueParser::ExternConstDeclarationContext* /*ctx*/) override {}
+  void exitExternConstDeclaration(
+      TorqueParser::ExternConstDeclarationContext* /*ctx*/) override {}
+
+  void enterDeclaration(TorqueParser::DeclarationContext* /*ctx*/) override {}
+  void exitDeclaration(TorqueParser::DeclarationContext* /*ctx*/) override {}
+
+  void enterModuleDeclaration(
+      TorqueParser::ModuleDeclarationContext* /*ctx*/) override {}
+  void exitModuleDeclaration(
+      TorqueParser::ModuleDeclarationContext* /*ctx*/) override {}
+
+  void enterFile(TorqueParser::FileContext* /*ctx*/) override {}
+  void exitFile(TorqueParser::FileContext* /*ctx*/) override {}
+
+  void enterEveryRule(antlr4::ParserRuleContext* /*ctx*/) override {}
+  void exitEveryRule(antlr4::ParserRuleContext* /*ctx*/) override {}
+  void visitTerminal(antlr4::tree::TerminalNode* /*node*/) override {}
+  void visitErrorNode(antlr4::tree::ErrorNode* /*node*/) override {}
+};
+
+#endif  // V8_TORQUE_TORQUEBASELISTENER_H_
diff --git a/deps/v8/src/torque/TorqueBaseVisitor.cpp b/deps/v8/src/torque/TorqueBaseVisitor.cpp
new file mode 100644
index 00000000000000..7f9c942307953a
--- /dev/null
+++ b/deps/v8/src/torque/TorqueBaseVisitor.cpp
@@ -0,0 +1,7 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Generated from Torque.g4 by ANTLR 4.7.1
+
+#include "TorqueBaseVisitor.h"
diff --git a/deps/v8/src/torque/TorqueBaseVisitor.h b/deps/v8/src/torque/TorqueBaseVisitor.h
new file mode 100644
index 00000000000000..a1129c1643f60e
--- /dev/null
+++ b/deps/v8/src/torque/TorqueBaseVisitor.h
@@ -0,0 +1,359 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+#ifndef V8_TORQUE_TORQUEBASEVISITOR_H_
+#define V8_TORQUE_TORQUEBASEVISITOR_H_
+
+// Generated from Torque.g4 by ANTLR 4.7.1
+
+#pragma once
+
+#include "./antlr4-runtime.h"
+#include "TorqueVisitor.h"
+
+/**
+ * This class provides an empty implementation of TorqueVisitor, which can be
+ * extended to create a visitor which only needs to handle a subset of the
+ * available methods.
+ */
+class TorqueBaseVisitor : public TorqueVisitor {
+ public:
+  antlrcpp::Any visitType(TorqueParser::TypeContext* ctx) override {
+    return visitChildren(ctx);
+  }
+
+  antlrcpp::Any visitTypeList(TorqueParser::TypeListContext* ctx) override {
+    return visitChildren(ctx);
+  }
+
+  antlrcpp::Any visitGenericSpecializationTypeList(
+      TorqueParser::GenericSpecializationTypeListContext* ctx) override {
+    return visitChildren(ctx);
+  }
+
+  antlrcpp::Any visitOptionalGenericTypeList(
+      TorqueParser::OptionalGenericTypeListContext* ctx) override {
+    return visitChildren(ctx);
+  }
+
+  antlrcpp::Any visitTypeListMaybeVarArgs(
+      TorqueParser::TypeListMaybeVarArgsContext* ctx) override {
+    return visitChildren(ctx);
+  }
+
+  antlrcpp::Any visitLabelParameter(
+      TorqueParser::LabelParameterContext* ctx) override {
+    return visitChildren(ctx);
+  }
+
+  antlrcpp::Any visitOptionalType(
+      TorqueParser::OptionalTypeContext* ctx) override {
+    return visitChildren(ctx);
+  }
+
+  antlrcpp::Any visitOptionalLabelList(
+      TorqueParser::OptionalLabelListContext* ctx) override {
+    return visitChildren(ctx);
+  }
+
+  antlrcpp::Any visitOptionalOtherwise(
+      TorqueParser::OptionalOtherwiseContext* ctx) override {
+    return visitChildren(ctx);
+  }
+
+  antlrcpp::Any visitParameter(TorqueParser::ParameterContext* ctx) override {
+    return visitChildren(ctx);
+  }
+
+  antlrcpp::Any visitParameterList(
+      TorqueParser::ParameterListContext* ctx) override {
+    return visitChildren(ctx);
+  }
+
+  antlrcpp::Any visitLabelDeclaration(
+      TorqueParser::LabelDeclarationContext* ctx) override {
+    return visitChildren(ctx);
+  }
+
+  antlrcpp::Any visitExpression(TorqueParser::ExpressionContext* ctx) override {
+    return visitChildren(ctx);
+  }
+
+  antlrcpp::Any visitConditionalExpression(
+      TorqueParser::ConditionalExpressionContext* ctx) override {
+    return visitChildren(ctx);
+  }
+
+  antlrcpp::Any visitLogicalORExpression(
+      TorqueParser::LogicalORExpressionContext* ctx) override {
+    return visitChildren(ctx);
+  }
+
+  antlrcpp::Any visitLogicalANDExpression(
+      TorqueParser::LogicalANDExpressionContext* ctx) override {
+    return visitChildren(ctx);
+  }
+
+  antlrcpp::Any visitBitwiseExpression(
+      TorqueParser::BitwiseExpressionContext* ctx) override {
+    return visitChildren(ctx);
+  }
+
+  antlrcpp::Any visitEqualityExpression(
+      TorqueParser::EqualityExpressionContext* ctx) override {
+    return visitChildren(ctx);
+  }
+
+  antlrcpp::Any visitRelationalExpression(
+      TorqueParser::RelationalExpressionContext* ctx) override {
+    return visitChildren(ctx);
+  }
+
+  antlrcpp::Any visitShiftExpression(
+      TorqueParser::ShiftExpressionContext* ctx) override {
+    return visitChildren(ctx);
+  }
+
+  antlrcpp::Any visitAdditiveExpression(
+      TorqueParser::AdditiveExpressionContext* ctx) override {
+    return visitChildren(ctx);
+  }
+
+  antlrcpp::Any visitMultiplicativeExpression(
+      TorqueParser::MultiplicativeExpressionContext* ctx) override {
+    return visitChildren(ctx);
+  }
+
+  antlrcpp::Any visitUnaryExpression(
+      TorqueParser::UnaryExpressionContext* ctx) override {
+    return visitChildren(ctx);
+  }
+
+  antlrcpp::Any visitLocationExpression(
+      TorqueParser::LocationExpressionContext* ctx) override {
+    return visitChildren(ctx);
+  }
+
+  antlrcpp::Any visitIncrementDecrement(
+      TorqueParser::IncrementDecrementContext* ctx) override {
+    return visitChildren(ctx);
+  }
+
+  antlrcpp::Any visitAssignment(TorqueParser::AssignmentContext* ctx) override {
+    return visitChildren(ctx);
+  }
+
+  antlrcpp::Any visitAssignmentExpression(
+      TorqueParser::AssignmentExpressionContext* ctx) override {
+    return visitChildren(ctx);
+  }
+
+  antlrcpp::Any visitPrimaryExpression(
+      TorqueParser::PrimaryExpressionContext* ctx) override {
+    return visitChildren(ctx);
+  }
+
+  antlrcpp::Any visitForInitialization(
+      TorqueParser::ForInitializationContext* ctx) override {
+    return visitChildren(ctx);
+  }
+
+  antlrcpp::Any visitForLoop(TorqueParser::ForLoopContext* ctx) override {
+    return visitChildren(ctx);
+  }
+
+  antlrcpp::Any visitRangeSpecifier(
+      TorqueParser::RangeSpecifierContext* ctx) override {
+    return visitChildren(ctx);
+  }
+
+  antlrcpp::Any visitForOfRange(TorqueParser::ForOfRangeContext* ctx) override {
+    return visitChildren(ctx);
+  }
+
+  antlrcpp::Any visitForOfLoop(TorqueParser::ForOfLoopContext* ctx) override {
+    return visitChildren(ctx);
+  }
+
+  antlrcpp::Any visitArgument(TorqueParser::ArgumentContext* ctx) override {
+    return visitChildren(ctx);
+  }
+
+  antlrcpp::Any visitArgumentList(
+      TorqueParser::ArgumentListContext* ctx) override {
+    return visitChildren(ctx);
+  }
+
+  antlrcpp::Any visitHelperCall(TorqueParser::HelperCallContext* ctx) override {
+    return visitChildren(ctx);
+  }
+
+  antlrcpp::Any visitLabelReference(
+      TorqueParser::LabelReferenceContext* ctx) override {
+    return visitChildren(ctx);
+  }
+
+  antlrcpp::Any visitVariableDeclaration(
+      TorqueParser::VariableDeclarationContext* ctx) override {
+    return visitChildren(ctx);
+  }
+
+  antlrcpp::Any visitVariableDeclarationWithInitialization(
+      TorqueParser::VariableDeclarationWithInitializationContext* ctx)
+      override {
+    return visitChildren(ctx);
+  }
+
+  antlrcpp::Any visitHelperCallStatement(
+      TorqueParser::HelperCallStatementContext* ctx) override {
+    return visitChildren(ctx);
+  }
+
+  antlrcpp::Any visitExpressionStatement(
+      TorqueParser::ExpressionStatementContext* ctx) override {
+    return visitChildren(ctx);
+  }
+
+  antlrcpp::Any visitIfStatement(
+      TorqueParser::IfStatementContext* ctx) override {
+    return visitChildren(ctx);
+  }
+
+  antlrcpp::Any visitWhileLoop(TorqueParser::WhileLoopContext* ctx) override {
+    return visitChildren(ctx);
+  }
+
+  antlrcpp::Any visitReturnStatement(
+      TorqueParser::ReturnStatementContext* ctx) override {
+    return visitChildren(ctx);
+  }
+
+  antlrcpp::Any visitBreakStatement(
+      TorqueParser::BreakStatementContext* ctx) override {
+    return visitChildren(ctx);
+  }
+
+  antlrcpp::Any visitContinueStatement(
+      TorqueParser::ContinueStatementContext* ctx) override {
+    return visitChildren(ctx);
+  }
+
+  antlrcpp::Any visitGotoStatement(
+      TorqueParser::GotoStatementContext* ctx) override {
+    return visitChildren(ctx);
+  }
+
+  antlrcpp::Any visitHandlerWithStatement(
+      TorqueParser::HandlerWithStatementContext* ctx) override {
+    return visitChildren(ctx);
+  }
+
+  antlrcpp::Any visitTryLabelStatement(
+      TorqueParser::TryLabelStatementContext* ctx) override {
+    return visitChildren(ctx);
+  }
+
+  antlrcpp::Any visitDiagnosticStatement(
+      TorqueParser::DiagnosticStatementContext* ctx) override {
+    return visitChildren(ctx);
+  }
+
+  antlrcpp::Any visitStatement(TorqueParser::StatementContext* ctx) override {
+    return visitChildren(ctx);
+  }
+
+  antlrcpp::Any visitStatementList(
+      TorqueParser::StatementListContext* ctx) override {
+    return visitChildren(ctx);
+  }
+
+  antlrcpp::Any visitStatementScope(
+      TorqueParser::StatementScopeContext* ctx) override {
+    return visitChildren(ctx);
+  }
+
+  antlrcpp::Any visitStatementBlock(
+      TorqueParser::StatementBlockContext* ctx) override {
+    return visitChildren(ctx);
+  }
+
+  antlrcpp::Any visitHelperBody(TorqueParser::HelperBodyContext* ctx) override {
+    return visitChildren(ctx);
+  }
+
+  antlrcpp::Any visitExtendsDeclaration(
+      TorqueParser::ExtendsDeclarationContext* ctx) override {
+    return visitChildren(ctx);
+  }
+
+  antlrcpp::Any visitGeneratesDeclaration(
+      TorqueParser::GeneratesDeclarationContext* ctx) override {
+    return visitChildren(ctx);
+  }
+
+  antlrcpp::Any visitConstexprDeclaration(
+      TorqueParser::ConstexprDeclarationContext* ctx) override {
+    return visitChildren(ctx);
+  }
+
+  antlrcpp::Any visitTypeDeclaration(
+      TorqueParser::TypeDeclarationContext* ctx) override {
+    return visitChildren(ctx);
+  }
+
+  antlrcpp::Any visitTypeAliasDeclaration(
+      TorqueParser::TypeAliasDeclarationContext* ctx) override {
+    return visitChildren(ctx);
+  }
+
+  antlrcpp::Any visitExternalBuiltin(
+      TorqueParser::ExternalBuiltinContext* ctx) override {
+    return visitChildren(ctx);
+  }
+
+  antlrcpp::Any visitExternalMacro(
+      TorqueParser::ExternalMacroContext* ctx) override {
+    return visitChildren(ctx);
+  }
+
+  antlrcpp::Any visitExternalRuntime(
+      TorqueParser::ExternalRuntimeContext* ctx) override {
+    return visitChildren(ctx);
+  }
+
+  antlrcpp::Any visitBuiltinDeclaration(
+      TorqueParser::BuiltinDeclarationContext* ctx) override {
+    return visitChildren(ctx);
+  }
+
+  antlrcpp::Any visitGenericSpecialization(
+      TorqueParser::GenericSpecializationContext* ctx) override {
+    return visitChildren(ctx);
+  }
+
+  antlrcpp::Any visitMacroDeclaration(
+      TorqueParser::MacroDeclarationContext* ctx) override {
+    return visitChildren(ctx);
+  }
+
+  antlrcpp::Any visitExternConstDeclaration(
+      TorqueParser::ExternConstDeclarationContext* ctx) override {
+    return visitChildren(ctx);
+  }
+
+  antlrcpp::Any visitDeclaration(
+      TorqueParser::DeclarationContext* ctx) override {
+    return visitChildren(ctx);
+  }
+
+  antlrcpp::Any visitModuleDeclaration(
+      TorqueParser::ModuleDeclarationContext* ctx) override {
+    return visitChildren(ctx);
+  }
+
+  antlrcpp::Any visitFile(TorqueParser::FileContext* ctx) override {
+    return visitChildren(ctx);
+  }
+};
+
+#endif  // V8_TORQUE_TORQUEBASEVISITOR_H_
diff --git a/deps/v8/src/torque/TorqueLexer.cpp b/deps/v8/src/torque/TorqueLexer.cpp
new file mode 100644
index 00000000000000..b82fa7a721cffb
--- /dev/null
+++ b/deps/v8/src/torque/TorqueLexer.cpp
@@ -0,0 +1,976 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Generated from Torque.g4 by ANTLR 4.7.1
+
+#include "TorqueLexer.h"
+
+using namespace antlr4;
+
+TorqueLexer::TorqueLexer(CharStream* input) : Lexer(input) {
+  _interpreter = new atn::LexerATNSimulator(this, _atn, _decisionToDFA,
+                                            _sharedContextCache);
+}
+
+TorqueLexer::~TorqueLexer() { delete _interpreter; }
+
+std::string TorqueLexer::getGrammarFileName() const { return "Torque.g4"; }
+
+const std::vector<std::string>& TorqueLexer::getRuleNames() const {
+  return _ruleNames;
+}
+
+const std::vector<std::string>& TorqueLexer::getChannelNames() const {
+  return _channelNames;
+}
+
+const std::vector<std::string>& TorqueLexer::getModeNames() const {
+  return _modeNames;
+}
+
+const std::vector<std::string>& TorqueLexer::getTokenNames() const {
+  return _tokenNames;
+}
+
+dfa::Vocabulary& TorqueLexer::getVocabulary() const { return _vocabulary; }
+
+const std::vector<uint16_t> TorqueLexer::getSerializedATN() const {
+  return _serializedATN;
+}
+
+const atn::ATN& TorqueLexer::getATN() const { return _atn; }
+
+// Static vars and initialization.
+std::vector<dfa::DFA> TorqueLexer::_decisionToDFA;
+atn::PredictionContextCache TorqueLexer::_sharedContextCache;
+
+// We own the ATN which in turn owns the ATN states.
+atn::ATN TorqueLexer::_atn;
+std::vector<uint16_t> TorqueLexer::_serializedATN;
+
+std::vector<std::string> TorqueLexer::_ruleNames = {u8"T__0",
+                                                    u8"T__1",
+                                                    u8"T__2",
+                                                    u8"T__3",
+                                                    u8"T__4",
+                                                    u8"T__5",
+                                                    u8"T__6",
+                                                    u8"T__7",
+                                                    u8"T__8",
+                                                    u8"T__9",
+                                                    u8"T__10",
+                                                    u8"T__11",
+                                                    u8"T__12",
+                                                    u8"T__13",
+                                                    u8"T__14",
+                                                    u8"T__15",
+                                                    u8"T__16",
+                                                    u8"T__17",
+                                                    u8"T__18",
+                                                    u8"T__19",
+                                                    u8"T__20",
+                                                    u8"MACRO",
+                                                    u8"BUILTIN",
+                                                    u8"RUNTIME",
+                                                    u8"MODULE",
+                                                    u8"JAVASCRIPT",
+                                                    u8"DEFERRED",
+                                                    u8"IF",
+                                                    u8"FOR",
+                                                    u8"WHILE",
+                                                    u8"RETURN",
+                                                    u8"CONSTEXPR",
+                                                    u8"CONTINUE",
+                                                    u8"BREAK",
+                                                    u8"GOTO",
+                                                    u8"OTHERWISE",
+                                                    u8"TRY",
+                                                    u8"LABEL",
+                                                    u8"LABELS",
+                                                    u8"TAIL",
+                                                    u8"ISNT",
+                                                    u8"IS",
+                                                    u8"LET",
+                                                    u8"EXTERN",
+                                                    u8"ASSERT_TOKEN",
+                                                    u8"CHECK_TOKEN",
+                                                    u8"UNREACHABLE_TOKEN",
+                                                    u8"DEBUG_TOKEN",
+                                                    u8"ASSIGNMENT",
+                                                    u8"ASSIGNMENT_OPERATOR",
+                                                    u8"EQUAL",
+                                                    u8"PLUS",
+                                                    u8"MINUS",
+                                                    u8"MULTIPLY",
+                                                    u8"DIVIDE",
+                                                    u8"MODULO",
+                                                    u8"BIT_OR",
+                                                    u8"BIT_AND",
+                                                    u8"BIT_NOT",
+                                                    u8"MAX",
+                                                    u8"MIN",
+                                                    u8"NOT_EQUAL",
+                                                    u8"LESS_THAN",
+                                                    u8"LESS_THAN_EQUAL",
+                                                    u8"GREATER_THAN",
+                                                    u8"GREATER_THAN_EQUAL",
+                                                    u8"SHIFT_LEFT",
+                                                    u8"SHIFT_RIGHT",
+                                                    u8"SHIFT_RIGHT_ARITHMETIC",
+                                                    u8"VARARGS",
+                                                    u8"EQUALITY_OPERATOR",
+                                                    u8"INCREMENT",
+                                                    u8"DECREMENT",
+                                                    u8"NOT",
+                                                    u8"STRING_LITERAL",
+                                                    u8"ESCAPE",
+                                                    u8"IDENTIFIER",
+                                                    u8"WS",
+                                                    u8"BLOCK_COMMENT",
+                                                    u8"LINE_COMMENT",
+                                                    u8"DECIMAL_DIGIT",
+                                                    u8"DECIMAL_INTEGER_LITERAL",
+                                                    u8"EXPONENT_PART",
+                                                    u8"DECIMAL_LITERAL"};
+
+std::vector<std::string> TorqueLexer::_channelNames = {"DEFAULT_TOKEN_CHANNEL",
+                                                       "HIDDEN"};
+
+std::vector<std::string> TorqueLexer::_modeNames = {u8"DEFAULT_MODE"};
+
+std::vector<std::string> TorqueLexer::_literalNames = {"",
+                                                       u8"'('",
+                                                       u8"')'",
+                                                       u8"'=>'",
+                                                       u8"','",
+                                                       u8"':'",
+                                                       u8"'type'",
+                                                       u8"'?'",
+                                                       u8"'||'",
+                                                       u8"'&&'",
+                                                       u8"'.'",
+                                                       u8"'['",
+                                                       u8"']'",
+                                                       u8"';'",
+                                                       u8"'of'",
+                                                       u8"'else'",
+                                                       u8"'{'",
+                                                       u8"'}'",
+                                                       u8"'extends'",
+                                                       u8"'generates'",
+                                                       u8"'operator'",
+                                                       u8"'const'",
+                                                       u8"'macro'",
+                                                       u8"'builtin'",
+                                                       u8"'runtime'",
+                                                       u8"'module'",
+                                                       u8"'javascript'",
+                                                       u8"'deferred'",
+                                                       u8"'if'",
+                                                       u8"'for'",
+                                                       u8"'while'",
+                                                       u8"'return'",
+                                                       u8"'constexpr'",
+                                                       u8"'continue'",
+                                                       u8"'break'",
+                                                       u8"'goto'",
+                                                       u8"'otherwise'",
+                                                       u8"'try'",
+                                                       u8"'label'",
+                                                       u8"'labels'",
+                                                       u8"'tail'",
+                                                       u8"'isnt'",
+                                                       u8"'is'",
+                                                       u8"'let'",
+                                                       u8"'extern'",
+                                                       u8"'assert'",
+                                                       u8"'check'",
+                                                       u8"'unreachable'",
+                                                       u8"'debug'",
+                                                       u8"'='",
+                                                       "",
+                                                       u8"'=='",
+                                                       u8"'+'",
+                                                       u8"'-'",
+                                                       u8"'*'",
+                                                       u8"'/'",
+                                                       u8"'%'",
+                                                       u8"'|'",
+                                                       u8"'&'",
+                                                       u8"'~'",
+                                                       u8"'max'",
+                                                       u8"'min'",
+                                                       u8"'!='",
+                                                       u8"'<'",
+                                                       u8"'<='",
+                                                       u8"'>'",
+                                                       u8"'>='",
+                                                       u8"'<<'",
+                                                       u8"'>>'",
+                                                       u8"'>>>'",
+                                                       u8"'...'",
+                                                       "",
+                                                       u8"'++'",
+                                                       u8"'--'",
+                                                       u8"'!'"};
+
+std::vector<std::string> TorqueLexer::_symbolicNames = {
+    "",
+    "",
+    "",
+    "",
+    "",
+    "",
+    "",
+    "",
+    "",
+    "",
+    "",
+    "",
+    "",
+    "",
+    "",
+    "",
+    "",
+    "",
+    "",
+    "",
+    "",
+    "",
+    u8"MACRO",
+    u8"BUILTIN",
+    u8"RUNTIME",
+    u8"MODULE",
+    u8"JAVASCRIPT",
+    u8"DEFERRED",
+    u8"IF",
+    u8"FOR",
+    u8"WHILE",
+    u8"RETURN",
+    u8"CONSTEXPR",
+    u8"CONTINUE",
+    u8"BREAK",
+    u8"GOTO",
+    u8"OTHERWISE",
+    u8"TRY",
+    u8"LABEL",
+    u8"LABELS",
+    u8"TAIL",
+    u8"ISNT",
+    u8"IS",
+    u8"LET",
+    u8"EXTERN",
+    u8"ASSERT_TOKEN",
+    u8"CHECK_TOKEN",
+    u8"UNREACHABLE_TOKEN",
+    u8"DEBUG_TOKEN",
+    u8"ASSIGNMENT",
+    u8"ASSIGNMENT_OPERATOR",
+    u8"EQUAL",
+    u8"PLUS",
+    u8"MINUS",
+    u8"MULTIPLY",
+    u8"DIVIDE",
+    u8"MODULO",
+    u8"BIT_OR",
+    u8"BIT_AND",
+    u8"BIT_NOT",
+    u8"MAX",
+    u8"MIN",
+    u8"NOT_EQUAL",
+    u8"LESS_THAN",
+    u8"LESS_THAN_EQUAL",
+    u8"GREATER_THAN",
+    u8"GREATER_THAN_EQUAL",
+    u8"SHIFT_LEFT",
+    u8"SHIFT_RIGHT",
+    u8"SHIFT_RIGHT_ARITHMETIC",
+    u8"VARARGS",
+    u8"EQUALITY_OPERATOR",
+    u8"INCREMENT",
+    u8"DECREMENT",
+    u8"NOT",
+    u8"STRING_LITERAL",
+    u8"IDENTIFIER",
+    u8"WS",
+    u8"BLOCK_COMMENT",
+    u8"LINE_COMMENT",
+    u8"DECIMAL_LITERAL"};
+
+dfa::Vocabulary TorqueLexer::_vocabulary(_literalNames, _symbolicNames);
+
+std::vector<std::string> TorqueLexer::_tokenNames;
+
+TorqueLexer::Initializer::Initializer() {
+  // This code could be in a static initializer lambda, but VS doesn't allow
+  // access to private class members from there.
+  for (size_t i = 0; i < _symbolicNames.size(); ++i) {
+    std::string name = _vocabulary.getLiteralName(i);
+    if (name.empty()) {
+      name = _vocabulary.getSymbolicName(i);
+    }
+
+    if (name.empty()) {
+      _tokenNames.push_back("<INVALID>");
+    } else {
+      _tokenNames.push_back(name);
+    }
+  }
+
+  _serializedATN = {
+      0x3,   0x608b, 0xa72a, 0x8133, 0xb9ed, 0x417c, 0x3be7, 0x7786, 0x5964,
+      0x2,   0x52,   0x290,  0x8,    0x1,    0x4,    0x2,    0x9,    0x2,
+      0x4,   0x3,    0x9,    0x3,    0x4,    0x4,    0x9,    0x4,    0x4,
+      0x5,   0x9,    0x5,    0x4,    0x6,    0x9,    0x6,    0x4,    0x7,
+      0x9,   0x7,    0x4,    0x8,    0x9,    0x8,    0x4,    0x9,    0x9,
+      0x9,   0x4,    0xa,    0x9,    0xa,    0x4,    0xb,    0x9,    0xb,
+      0x4,   0xc,    0x9,    0xc,    0x4,    0xd,    0x9,    0xd,    0x4,
+      0xe,   0x9,    0xe,    0x4,    0xf,    0x9,    0xf,    0x4,    0x10,
+      0x9,   0x10,   0x4,    0x11,   0x9,    0x11,   0x4,    0x12,   0x9,
+      0x12,  0x4,    0x13,   0x9,    0x13,   0x4,    0x14,   0x9,    0x14,
+      0x4,   0x15,   0x9,    0x15,   0x4,    0x16,   0x9,    0x16,   0x4,
+      0x17,  0x9,    0x17,   0x4,    0x18,   0x9,    0x18,   0x4,    0x19,
+      0x9,   0x19,   0x4,    0x1a,   0x9,    0x1a,   0x4,    0x1b,   0x9,
+      0x1b,  0x4,    0x1c,   0x9,    0x1c,   0x4,    0x1d,   0x9,    0x1d,
+      0x4,   0x1e,   0x9,    0x1e,   0x4,    0x1f,   0x9,    0x1f,   0x4,
+      0x20,  0x9,    0x20,   0x4,    0x21,   0x9,    0x21,   0x4,    0x22,
+      0x9,   0x22,   0x4,    0x23,   0x9,    0x23,   0x4,    0x24,   0x9,
+      0x24,  0x4,    0x25,   0x9,    0x25,   0x4,    0x26,   0x9,    0x26,
+      0x4,   0x27,   0x9,    0x27,   0x4,    0x28,   0x9,    0x28,   0x4,
+      0x29,  0x9,    0x29,   0x4,    0x2a,   0x9,    0x2a,   0x4,    0x2b,
+      0x9,   0x2b,   0x4,    0x2c,   0x9,    0x2c,   0x4,    0x2d,   0x9,
+      0x2d,  0x4,    0x2e,   0x9,    0x2e,   0x4,    0x2f,   0x9,    0x2f,
+      0x4,   0x30,   0x9,    0x30,   0x4,    0x31,   0x9,    0x31,   0x4,
+      0x32,  0x9,    0x32,   0x4,    0x33,   0x9,    0x33,   0x4,    0x34,
+      0x9,   0x34,   0x4,    0x35,   0x9,    0x35,   0x4,    0x36,   0x9,
+      0x36,  0x4,    0x37,   0x9,    0x37,   0x4,    0x38,   0x9,    0x38,
+      0x4,   0x39,   0x9,    0x39,   0x4,    0x3a,   0x9,    0x3a,   0x4,
+      0x3b,  0x9,    0x3b,   0x4,    0x3c,   0x9,    0x3c,   0x4,    0x3d,
+      0x9,   0x3d,   0x4,    0x3e,   0x9,    0x3e,   0x4,    0x3f,   0x9,
+      0x3f,  0x4,    0x40,   0x9,    0x40,   0x4,    0x41,   0x9,    0x41,
+      0x4,   0x42,   0x9,    0x42,   0x4,    0x43,   0x9,    0x43,   0x4,
+      0x44,  0x9,    0x44,   0x4,    0x45,   0x9,    0x45,   0x4,    0x46,
+      0x9,   0x46,   0x4,    0x47,   0x9,    0x47,   0x4,    0x48,   0x9,
+      0x48,  0x4,    0x49,   0x9,    0x49,   0x4,    0x4a,   0x9,    0x4a,
+      0x4,   0x4b,   0x9,    0x4b,   0x4,    0x4c,   0x9,    0x4c,   0x4,
+      0x4d,  0x9,    0x4d,   0x4,    0x4e,   0x9,    0x4e,   0x4,    0x4f,
+      0x9,   0x4f,   0x4,    0x50,   0x9,    0x50,   0x4,    0x51,   0x9,
+      0x51,  0x4,    0x52,   0x9,    0x52,   0x4,    0x53,   0x9,    0x53,
+      0x4,   0x54,   0x9,    0x54,   0x4,    0x55,   0x9,    0x55,   0x3,
+      0x2,   0x3,    0x2,    0x3,    0x3,    0x3,    0x3,    0x3,    0x4,
+      0x3,   0x4,    0x3,    0x4,    0x3,    0x5,    0x3,    0x5,    0x3,
+      0x6,   0x3,    0x6,    0x3,    0x7,    0x3,    0x7,    0x3,    0x7,
+      0x3,   0x7,    0x3,    0x7,    0x3,    0x8,    0x3,    0x8,    0x3,
+      0x9,   0x3,    0x9,    0x3,    0x9,    0x3,    0xa,    0x3,    0xa,
+      0x3,   0xa,    0x3,    0xb,    0x3,    0xb,    0x3,    0xc,    0x3,
+      0xc,   0x3,    0xd,    0x3,    0xd,    0x3,    0xe,    0x3,    0xe,
+      0x3,   0xf,    0x3,    0xf,    0x3,    0xf,    0x3,    0x10,   0x3,
+      0x10,  0x3,    0x10,   0x3,    0x10,   0x3,    0x10,   0x3,    0x11,
+      0x3,   0x11,   0x3,    0x12,   0x3,    0x12,   0x3,    0x13,   0x3,
+      0x13,  0x3,    0x13,   0x3,    0x13,   0x3,    0x13,   0x3,    0x13,
+      0x3,   0x13,   0x3,    0x13,   0x3,    0x14,   0x3,    0x14,   0x3,
+      0x14,  0x3,    0x14,   0x3,    0x14,   0x3,    0x14,   0x3,    0x14,
+      0x3,   0x14,   0x3,    0x14,   0x3,    0x14,   0x3,    0x15,   0x3,
+      0x15,  0x3,    0x15,   0x3,    0x15,   0x3,    0x15,   0x3,    0x15,
+      0x3,   0x15,   0x3,    0x15,   0x3,    0x15,   0x3,    0x16,   0x3,
+      0x16,  0x3,    0x16,   0x3,    0x16,   0x3,    0x16,   0x3,    0x16,
+      0x3,   0x17,   0x3,    0x17,   0x3,    0x17,   0x3,    0x17,   0x3,
+      0x17,  0x3,    0x17,   0x3,    0x18,   0x3,    0x18,   0x3,    0x18,
+      0x3,   0x18,   0x3,    0x18,   0x3,    0x18,   0x3,    0x18,   0x3,
+      0x18,  0x3,    0x19,   0x3,    0x19,   0x3,    0x19,   0x3,    0x19,
+      0x3,   0x19,   0x3,    0x19,   0x3,    0x19,   0x3,    0x19,   0x3,
+      0x1a,  0x3,    0x1a,   0x3,    0x1a,   0x3,    0x1a,   0x3,    0x1a,
+      0x3,   0x1a,   0x3,    0x1a,   0x3,    0x1b,   0x3,    0x1b,   0x3,
+      0x1b,  0x3,    0x1b,   0x3,    0x1b,   0x3,    0x1b,   0x3,    0x1b,
+      0x3,   0x1b,   0x3,    0x1b,   0x3,    0x1b,   0x3,    0x1b,   0x3,
+      0x1c,  0x3,    0x1c,   0x3,    0x1c,   0x3,    0x1c,   0x3,    0x1c,
+      0x3,   0x1c,   0x3,    0x1c,   0x3,    0x1c,   0x3,    0x1c,   0x3,
+      0x1d,  0x3,    0x1d,   0x3,    0x1d,   0x3,    0x1e,   0x3,    0x1e,
+      0x3,   0x1e,   0x3,    0x1e,   0x3,    0x1f,   0x3,    0x1f,   0x3,
+      0x1f,  0x3,    0x1f,   0x3,    0x1f,   0x3,    0x1f,   0x3,    0x20,
+      0x3,   0x20,   0x3,    0x20,   0x3,    0x20,   0x3,    0x20,   0x3,
+      0x20,  0x3,    0x20,   0x3,    0x21,   0x3,    0x21,   0x3,    0x21,
+      0x3,   0x21,   0x3,    0x21,   0x3,    0x21,   0x3,    0x21,   0x3,
+      0x21,  0x3,    0x21,   0x3,    0x21,   0x3,    0x22,   0x3,    0x22,
+      0x3,   0x22,   0x3,    0x22,   0x3,    0x22,   0x3,    0x22,   0x3,
+      0x22,  0x3,    0x22,   0x3,    0x22,   0x3,    0x23,   0x3,    0x23,
+      0x3,   0x23,   0x3,    0x23,   0x3,    0x23,   0x3,    0x23,   0x3,
+      0x24,  0x3,    0x24,   0x3,    0x24,   0x3,    0x24,   0x3,    0x24,
+      0x3,   0x25,   0x3,    0x25,   0x3,    0x25,   0x3,    0x25,   0x3,
+      0x25,  0x3,    0x25,   0x3,    0x25,   0x3,    0x25,   0x3,    0x25,
+      0x3,   0x25,   0x3,    0x26,   0x3,    0x26,   0x3,    0x26,   0x3,
+      0x26,  0x3,    0x27,   0x3,    0x27,   0x3,    0x27,   0x3,    0x27,
+      0x3,   0x27,   0x3,    0x27,   0x3,    0x28,   0x3,    0x28,   0x3,
+      0x28,  0x3,    0x28,   0x3,    0x28,   0x3,    0x28,   0x3,    0x28,
+      0x3,   0x29,   0x3,    0x29,   0x3,    0x29,   0x3,    0x29,   0x3,
+      0x29,  0x3,    0x2a,   0x3,    0x2a,   0x3,    0x2a,   0x3,    0x2a,
+      0x3,   0x2a,   0x3,    0x2b,   0x3,    0x2b,   0x3,    0x2b,   0x3,
+      0x2c,  0x3,    0x2c,   0x3,    0x2c,   0x3,    0x2c,   0x3,    0x2d,
+      0x3,   0x2d,   0x3,    0x2d,   0x3,    0x2d,   0x3,    0x2d,   0x3,
+      0x2d,  0x3,    0x2d,   0x3,    0x2e,   0x3,    0x2e,   0x3,    0x2e,
+      0x3,   0x2e,   0x3,    0x2e,   0x3,    0x2e,   0x3,    0x2e,   0x3,
+      0x2f,  0x3,    0x2f,   0x3,    0x2f,   0x3,    0x2f,   0x3,    0x2f,
+      0x3,   0x2f,   0x3,    0x30,   0x3,    0x30,   0x3,    0x30,   0x3,
+      0x30,  0x3,    0x30,   0x3,    0x30,   0x3,    0x30,   0x3,    0x30,
+      0x3,   0x30,   0x3,    0x30,   0x3,    0x30,   0x3,    0x30,   0x3,
+      0x31,  0x3,    0x31,   0x3,    0x31,   0x3,    0x31,   0x3,    0x31,
+      0x3,   0x31,   0x3,    0x32,   0x3,    0x32,   0x3,    0x33,   0x3,
+      0x33,  0x3,    0x33,   0x3,    0x33,   0x3,    0x33,   0x3,    0x33,
+      0x3,   0x33,   0x3,    0x33,   0x3,    0x33,   0x3,    0x33,   0x3,
+      0x33,  0x3,    0x33,   0x3,    0x33,   0x3,    0x33,   0x3,    0x33,
+      0x3,   0x33,   0x3,    0x33,   0x3,    0x33,   0x3,    0x33,   0x3,
+      0x33,  0x3,    0x33,   0x3,    0x33,   0x3,    0x33,   0x3,    0x33,
+      0x3,   0x33,   0x3,    0x33,   0x5,    0x33,   0x1ca,  0xa,    0x33,
+      0x3,   0x34,   0x3,    0x34,   0x3,    0x34,   0x3,    0x35,   0x3,
+      0x35,  0x3,    0x36,   0x3,    0x36,   0x3,    0x37,   0x3,    0x37,
+      0x3,   0x38,   0x3,    0x38,   0x3,    0x39,   0x3,    0x39,   0x3,
+      0x3a,  0x3,    0x3a,   0x3,    0x3b,   0x3,    0x3b,   0x3,    0x3c,
+      0x3,   0x3c,   0x3,    0x3d,   0x3,    0x3d,   0x3,    0x3d,   0x3,
+      0x3d,  0x3,    0x3e,   0x3,    0x3e,   0x3,    0x3e,   0x3,    0x3e,
+      0x3,   0x3f,   0x3,    0x3f,   0x3,    0x3f,   0x3,    0x40,   0x3,
+      0x40,  0x3,    0x41,   0x3,    0x41,   0x3,    0x41,   0x3,    0x42,
+      0x3,   0x42,   0x3,    0x43,   0x3,    0x43,   0x3,    0x43,   0x3,
+      0x44,  0x3,    0x44,   0x3,    0x44,   0x3,    0x45,   0x3,    0x45,
+      0x3,   0x45,   0x3,    0x46,   0x3,    0x46,   0x3,    0x46,   0x3,
+      0x46,  0x3,    0x47,   0x3,    0x47,   0x3,    0x47,   0x3,    0x47,
+      0x3,   0x48,   0x3,    0x48,   0x5,    0x48,   0x204,  0xa,    0x48,
+      0x3,   0x49,   0x3,    0x49,   0x3,    0x49,   0x3,    0x4a,   0x3,
+      0x4a,  0x3,    0x4a,   0x3,    0x4b,   0x3,    0x4b,   0x3,    0x4c,
+      0x3,   0x4c,   0x3,    0x4c,   0x7,    0x4c,   0x211,  0xa,    0x4c,
+      0xc,   0x4c,   0xe,    0x4c,   0x214,  0xb,    0x4c,   0x3,    0x4c,
+      0x3,   0x4c,   0x3,    0x4c,   0x3,    0x4c,   0x7,    0x4c,   0x21a,
+      0xa,   0x4c,   0xc,    0x4c,   0xe,    0x4c,   0x21d,  0xb,    0x4c,
+      0x3,   0x4c,   0x5,    0x4c,   0x220,  0xa,    0x4c,   0x3,    0x4d,
+      0x3,   0x4d,   0x3,    0x4d,   0x3,    0x4e,   0x3,    0x4e,   0x7,
+      0x4e,  0x227,  0xa,    0x4e,   0xc,    0x4e,   0xe,    0x4e,   0x22a,
+      0xb,   0x4e,   0x3,    0x4f,   0x6,    0x4f,   0x22d,  0xa,    0x4f,
+      0xd,   0x4f,   0xe,    0x4f,   0x22e,  0x3,    0x4f,   0x3,    0x4f,
+      0x3,   0x50,   0x3,    0x50,   0x3,    0x50,   0x3,    0x50,   0x7,
+      0x50,  0x237,  0xa,    0x50,   0xc,    0x50,   0xe,    0x50,   0x23a,
+      0xb,   0x50,   0x3,    0x50,   0x3,    0x50,   0x3,    0x50,   0x5,
+      0x50,  0x23f,  0xa,    0x50,   0x3,    0x50,   0x3,    0x50,   0x3,
+      0x51,  0x3,    0x51,   0x3,    0x51,   0x3,    0x51,   0x7,    0x51,
+      0x247, 0xa,    0x51,   0xc,    0x51,   0xe,    0x51,   0x24a,  0xb,
+      0x51,  0x3,    0x51,   0x3,    0x51,   0x3,    0x52,   0x3,    0x52,
+      0x3,   0x53,   0x3,    0x53,   0x3,    0x53,   0x7,    0x53,   0x253,
+      0xa,   0x53,   0xc,    0x53,   0xe,    0x53,   0x256,  0xb,    0x53,
+      0x5,   0x53,   0x258,  0xa,    0x53,   0x3,    0x54,   0x3,    0x54,
+      0x5,   0x54,   0x25c,  0xa,    0x54,   0x3,    0x54,   0x6,    0x54,
+      0x25f, 0xa,    0x54,   0xd,    0x54,   0xe,    0x54,   0x260,  0x3,
+      0x55,  0x5,    0x55,   0x264,  0xa,    0x55,   0x3,    0x55,   0x3,
+      0x55,  0x3,    0x55,   0x7,    0x55,   0x269,  0xa,    0x55,   0xc,
+      0x55,  0xe,    0x55,   0x26c,  0xb,    0x55,   0x3,    0x55,   0x5,
+      0x55,  0x26f,  0xa,    0x55,   0x3,    0x55,   0x5,    0x55,   0x272,
+      0xa,   0x55,   0x3,    0x55,   0x3,    0x55,   0x6,    0x55,   0x276,
+      0xa,   0x55,   0xd,    0x55,   0xe,    0x55,   0x277,  0x3,    0x55,
+      0x5,   0x55,   0x27b,  0xa,    0x55,   0x3,    0x55,   0x5,    0x55,
+      0x27e, 0xa,    0x55,   0x3,    0x55,   0x3,    0x55,   0x5,    0x55,
+      0x282, 0xa,    0x55,   0x3,    0x55,   0x5,    0x55,   0x285,  0xa,
+      0x55,  0x3,    0x55,   0x3,    0x55,   0x3,    0x55,   0x3,    0x55,
+      0x6,   0x55,   0x28b,  0xa,    0x55,   0xd,    0x55,   0xe,    0x55,
+      0x28c, 0x5,    0x55,   0x28f,  0xa,    0x55,   0x3,    0x238,  0x2,
+      0x56,  0x3,    0x3,    0x5,    0x4,    0x7,    0x5,    0x9,    0x6,
+      0xb,   0x7,    0xd,    0x8,    0xf,    0x9,    0x11,   0xa,    0x13,
+      0xb,   0x15,   0xc,    0x17,   0xd,    0x19,   0xe,    0x1b,   0xf,
+      0x1d,  0x10,   0x1f,   0x11,   0x21,   0x12,   0x23,   0x13,   0x25,
+      0x14,  0x27,   0x15,   0x29,   0x16,   0x2b,   0x17,   0x2d,   0x18,
+      0x2f,  0x19,   0x31,   0x1a,   0x33,   0x1b,   0x35,   0x1c,   0x37,
+      0x1d,  0x39,   0x1e,   0x3b,   0x1f,   0x3d,   0x20,   0x3f,   0x21,
+      0x41,  0x22,   0x43,   0x23,   0x45,   0x24,   0x47,   0x25,   0x49,
+      0x26,  0x4b,   0x27,   0x4d,   0x28,   0x4f,   0x29,   0x51,   0x2a,
+      0x53,  0x2b,   0x55,   0x2c,   0x57,   0x2d,   0x59,   0x2e,   0x5b,
+      0x2f,  0x5d,   0x30,   0x5f,   0x31,   0x61,   0x32,   0x63,   0x33,
+      0x65,  0x34,   0x67,   0x35,   0x69,   0x36,   0x6b,   0x37,   0x6d,
+      0x38,  0x6f,   0x39,   0x71,   0x3a,   0x73,   0x3b,   0x75,   0x3c,
+      0x77,  0x3d,   0x79,   0x3e,   0x7b,   0x3f,   0x7d,   0x40,   0x7f,
+      0x41,  0x81,   0x42,   0x83,   0x43,   0x85,   0x44,   0x87,   0x45,
+      0x89,  0x46,   0x8b,   0x47,   0x8d,   0x48,   0x8f,   0x49,   0x91,
+      0x4a,  0x93,   0x4b,   0x95,   0x4c,   0x97,   0x4d,   0x99,   0x2,
+      0x9b,  0x4e,   0x9d,   0x4f,   0x9f,   0x50,   0xa1,   0x51,   0xa3,
+      0x2,   0xa5,   0x2,    0xa7,   0x2,    0xa9,   0x52,   0x3,    0x2,
+      0xe,   0x6,    0x2,    0xc,    0xc,    0xf,    0xf,    0x24,   0x24,
+      0x5e,  0x5e,   0x6,    0x2,    0xc,    0xc,    0xf,    0xf,    0x29,
+      0x29,  0x5e,   0x5e,   0x7,    0x2,    0x24,   0x24,   0x29,   0x29,
+      0x5e,  0x5e,   0x70,   0x70,   0x74,   0x74,   0x4,    0x2,    0x43,
+      0x5c,  0x63,   0x7c,   0x6,    0x2,    0x32,   0x3b,   0x43,   0x5c,
+      0x61,  0x61,   0x63,   0x7c,   0x5,    0x2,    0xb,    0xc,    0xe,
+      0xf,   0x22,   0x22,   0x4,    0x2,    0xc,    0xc,    0xf,    0xf,
+      0x3,   0x2,    0x32,   0x3b,   0x3,    0x2,    0x33,   0x3b,   0x4,
+      0x2,   0x47,   0x47,   0x67,   0x67,   0x4,    0x2,    0x2d,   0x2d,
+      0x2f,  0x2f,   0x5,    0x2,    0x32,   0x3b,   0x43,   0x48,   0x63,
+      0x68,  0x2,    0x2b1,  0x2,    0x3,    0x3,    0x2,    0x2,    0x2,
+      0x2,   0x5,    0x3,    0x2,    0x2,    0x2,    0x2,    0x7,    0x3,
+      0x2,   0x2,    0x2,    0x2,    0x9,    0x3,    0x2,    0x2,    0x2,
+      0x2,   0xb,    0x3,    0x2,    0x2,    0x2,    0x2,    0xd,    0x3,
+      0x2,   0x2,    0x2,    0x2,    0xf,    0x3,    0x2,    0x2,    0x2,
+      0x2,   0x11,   0x3,    0x2,    0x2,    0x2,    0x2,    0x13,   0x3,
+      0x2,   0x2,    0x2,    0x2,    0x15,   0x3,    0x2,    0x2,    0x2,
+      0x2,   0x17,   0x3,    0x2,    0x2,    0x2,    0x2,    0x19,   0x3,
+      0x2,   0x2,    0x2,    0x2,    0x1b,   0x3,    0x2,    0x2,    0x2,
+      0x2,   0x1d,   0x3,    0x2,    0x2,    0x2,    0x2,    0x1f,   0x3,
+      0x2,   0x2,    0x2,    0x2,    0x21,   0x3,    0x2,    0x2,    0x2,
+      0x2,   0x23,   0x3,    0x2,    0x2,    0x2,    0x2,    0x25,   0x3,
+      0x2,   0x2,    0x2,    0x2,    0x27,   0x3,    0x2,    0x2,    0x2,
+      0x2,   0x29,   0x3,    0x2,    0x2,    0x2,    0x2,    0x2b,   0x3,
+      0x2,   0x2,    0x2,    0x2,    0x2d,   0x3,    0x2,    0x2,    0x2,
+      0x2,   0x2f,   0x3,    0x2,    0x2,    0x2,    0x2,    0x31,   0x3,
+      0x2,   0x2,    0x2,    0x2,    0x33,   0x3,    0x2,    0x2,    0x2,
+      0x2,   0x35,   0x3,    0x2,    0x2,    0x2,    0x2,    0x37,   0x3,
+      0x2,   0x2,    0x2,    0x2,    0x39,   0x3,    0x2,    0x2,    0x2,
+      0x2,   0x3b,   0x3,    0x2,    0x2,    0x2,    0x2,    0x3d,   0x3,
+      0x2,   0x2,    0x2,    0x2,    0x3f,   0x3,    0x2,    0x2,    0x2,
+      0x2,   0x41,   0x3,    0x2,    0x2,    0x2,    0x2,    0x43,   0x3,
+      0x2,   0x2,    0x2,    0x2,    0x45,   0x3,    0x2,    0x2,    0x2,
+      0x2,   0x47,   0x3,    0x2,    0x2,    0x2,    0x2,    0x49,   0x3,
+      0x2,   0x2,    0x2,    0x2,    0x4b,   0x3,    0x2,    0x2,    0x2,
+      0x2,   0x4d,   0x3,    0x2,    0x2,    0x2,    0x2,    0x4f,   0x3,
+      0x2,   0x2,    0x2,    0x2,    0x51,   0x3,    0x2,    0x2,    0x2,
+      0x2,   0x53,   0x3,    0x2,    0x2,    0x2,    0x2,    0x55,   0x3,
+      0x2,   0x2,    0x2,    0x2,    0x57,   0x3,    0x2,    0x2,    0x2,
+      0x2,   0x59,   0x3,    0x2,    0x2,    0x2,    0x2,    0x5b,   0x3,
+      0x2,   0x2,    0x2,    0x2,    0x5d,   0x3,    0x2,    0x2,    0x2,
+      0x2,   0x5f,   0x3,    0x2,    0x2,    0x2,    0x2,    0x61,   0x3,
+      0x2,   0x2,    0x2,    0x2,    0x63,   0x3,    0x2,    0x2,    0x2,
+      0x2,   0x65,   0x3,    0x2,    0x2,    0x2,    0x2,    0x67,   0x3,
+      0x2,   0x2,    0x2,    0x2,    0x69,   0x3,    0x2,    0x2,    0x2,
+      0x2,   0x6b,   0x3,    0x2,    0x2,    0x2,    0x2,    0x6d,   0x3,
+      0x2,   0x2,    0x2,    0x2,    0x6f,   0x3,    0x2,    0x2,    0x2,
+      0x2,   0x71,   0x3,    0x2,    0x2,    0x2,    0x2,    0x73,   0x3,
+      0x2,   0x2,    0x2,    0x2,    0x75,   0x3,    0x2,    0x2,    0x2,
+      0x2,   0x77,   0x3,    0x2,    0x2,    0x2,    0x2,    0x79,   0x3,
+      0x2,   0x2,    0x2,    0x2,    0x7b,   0x3,    0x2,    0x2,    0x2,
+      0x2,   0x7d,   0x3,    0x2,    0x2,    0x2,    0x2,    0x7f,   0x3,
+      0x2,   0x2,    0x2,    0x2,    0x81,   0x3,    0x2,    0x2,    0x2,
+      0x2,   0x83,   0x3,    0x2,    0x2,    0x2,    0x2,    0x85,   0x3,
+      0x2,   0x2,    0x2,    0x2,    0x87,   0x3,    0x2,    0x2,    0x2,
+      0x2,   0x89,   0x3,    0x2,    0x2,    0x2,    0x2,    0x8b,   0x3,
+      0x2,   0x2,    0x2,    0x2,    0x8d,   0x3,    0x2,    0x2,    0x2,
+      0x2,   0x8f,   0x3,    0x2,    0x2,    0x2,    0x2,    0x91,   0x3,
+      0x2,   0x2,    0x2,    0x2,    0x93,   0x3,    0x2,    0x2,    0x2,
+      0x2,   0x95,   0x3,    0x2,    0x2,    0x2,    0x2,    0x97,   0x3,
+      0x2,   0x2,    0x2,    0x2,    0x9b,   0x3,    0x2,    0x2,    0x2,
+      0x2,   0x9d,   0x3,    0x2,    0x2,    0x2,    0x2,    0x9f,   0x3,
+      0x2,   0x2,    0x2,    0x2,    0xa1,   0x3,    0x2,    0x2,    0x2,
+      0x2,   0xa9,   0x3,    0x2,    0x2,    0x2,    0x3,    0xab,   0x3,
+      0x2,   0x2,    0x2,    0x5,    0xad,   0x3,    0x2,    0x2,    0x2,
+      0x7,   0xaf,   0x3,    0x2,    0x2,    0x2,    0x9,    0xb2,   0x3,
+      0x2,   0x2,    0x2,    0xb,    0xb4,   0x3,    0x2,    0x2,    0x2,
+      0xd,   0xb6,   0x3,    0x2,    0x2,    0x2,    0xf,    0xbb,   0x3,
+      0x2,   0x2,    0x2,    0x11,   0xbd,   0x3,    0x2,    0x2,    0x2,
+      0x13,  0xc0,   0x3,    0x2,    0x2,    0x2,    0x15,   0xc3,   0x3,
+      0x2,   0x2,    0x2,    0x17,   0xc5,   0x3,    0x2,    0x2,    0x2,
+      0x19,  0xc7,   0x3,    0x2,    0x2,    0x2,    0x1b,   0xc9,   0x3,
+      0x2,   0x2,    0x2,    0x1d,   0xcb,   0x3,    0x2,    0x2,    0x2,
+      0x1f,  0xce,   0x3,    0x2,    0x2,    0x2,    0x21,   0xd3,   0x3,
+      0x2,   0x2,    0x2,    0x23,   0xd5,   0x3,    0x2,    0x2,    0x2,
+      0x25,  0xd7,   0x3,    0x2,    0x2,    0x2,    0x27,   0xdf,   0x3,
+      0x2,   0x2,    0x2,    0x29,   0xe9,   0x3,    0x2,    0x2,    0x2,
+      0x2b,  0xf2,   0x3,    0x2,    0x2,    0x2,    0x2d,   0xf8,   0x3,
+      0x2,   0x2,    0x2,    0x2f,   0xfe,   0x3,    0x2,    0x2,    0x2,
+      0x31,  0x106,  0x3,    0x2,    0x2,    0x2,    0x33,   0x10e,  0x3,
+      0x2,   0x2,    0x2,    0x35,   0x115,  0x3,    0x2,    0x2,    0x2,
+      0x37,  0x120,  0x3,    0x2,    0x2,    0x2,    0x39,   0x129,  0x3,
+      0x2,   0x2,    0x2,    0x3b,   0x12c,  0x3,    0x2,    0x2,    0x2,
+      0x3d,  0x130,  0x3,    0x2,    0x2,    0x2,    0x3f,   0x136,  0x3,
+      0x2,   0x2,    0x2,    0x41,   0x13d,  0x3,    0x2,    0x2,    0x2,
+      0x43,  0x147,  0x3,    0x2,    0x2,    0x2,    0x45,   0x150,  0x3,
+      0x2,   0x2,    0x2,    0x47,   0x156,  0x3,    0x2,    0x2,    0x2,
+      0x49,  0x15b,  0x3,    0x2,    0x2,    0x2,    0x4b,   0x165,  0x3,
+      0x2,   0x2,    0x2,    0x4d,   0x169,  0x3,    0x2,    0x2,    0x2,
+      0x4f,  0x16f,  0x3,    0x2,    0x2,    0x2,    0x51,   0x176,  0x3,
+      0x2,   0x2,    0x2,    0x53,   0x17b,  0x3,    0x2,    0x2,    0x2,
+      0x55,  0x180,  0x3,    0x2,    0x2,    0x2,    0x57,   0x183,  0x3,
+      0x2,   0x2,    0x2,    0x59,   0x187,  0x3,    0x2,    0x2,    0x2,
+      0x5b,  0x18e,  0x3,    0x2,    0x2,    0x2,    0x5d,   0x195,  0x3,
+      0x2,   0x2,    0x2,    0x5f,   0x19b,  0x3,    0x2,    0x2,    0x2,
+      0x61,  0x1a7,  0x3,    0x2,    0x2,    0x2,    0x63,   0x1ad,  0x3,
+      0x2,   0x2,    0x2,    0x65,   0x1c9,  0x3,    0x2,    0x2,    0x2,
+      0x67,  0x1cb,  0x3,    0x2,    0x2,    0x2,    0x69,   0x1ce,  0x3,
+      0x2,   0x2,    0x2,    0x6b,   0x1d0,  0x3,    0x2,    0x2,    0x2,
+      0x6d,  0x1d2,  0x3,    0x2,    0x2,    0x2,    0x6f,   0x1d4,  0x3,
+      0x2,   0x2,    0x2,    0x71,   0x1d6,  0x3,    0x2,    0x2,    0x2,
+      0x73,  0x1d8,  0x3,    0x2,    0x2,    0x2,    0x75,   0x1da,  0x3,
+      0x2,   0x2,    0x2,    0x77,   0x1dc,  0x3,    0x2,    0x2,    0x2,
+      0x79,  0x1de,  0x3,    0x2,    0x2,    0x2,    0x7b,   0x1e2,  0x3,
+      0x2,   0x2,    0x2,    0x7d,   0x1e6,  0x3,    0x2,    0x2,    0x2,
+      0x7f,  0x1e9,  0x3,    0x2,    0x2,    0x2,    0x81,   0x1eb,  0x3,
+      0x2,   0x2,    0x2,    0x83,   0x1ee,  0x3,    0x2,    0x2,    0x2,
+      0x85,  0x1f0,  0x3,    0x2,    0x2,    0x2,    0x87,   0x1f3,  0x3,
+      0x2,   0x2,    0x2,    0x89,   0x1f6,  0x3,    0x2,    0x2,    0x2,
+      0x8b,  0x1f9,  0x3,    0x2,    0x2,    0x2,    0x8d,   0x1fd,  0x3,
+      0x2,   0x2,    0x2,    0x8f,   0x203,  0x3,    0x2,    0x2,    0x2,
+      0x91,  0x205,  0x3,    0x2,    0x2,    0x2,    0x93,   0x208,  0x3,
+      0x2,   0x2,    0x2,    0x95,   0x20b,  0x3,    0x2,    0x2,    0x2,
+      0x97,  0x21f,  0x3,    0x2,    0x2,    0x2,    0x99,   0x221,  0x3,
+      0x2,   0x2,    0x2,    0x9b,   0x224,  0x3,    0x2,    0x2,    0x2,
+      0x9d,  0x22c,  0x3,    0x2,    0x2,    0x2,    0x9f,   0x232,  0x3,
+      0x2,   0x2,    0x2,    0xa1,   0x242,  0x3,    0x2,    0x2,    0x2,
+      0xa3,  0x24d,  0x3,    0x2,    0x2,    0x2,    0xa5,   0x257,  0x3,
+      0x2,   0x2,    0x2,    0xa7,   0x259,  0x3,    0x2,    0x2,    0x2,
+      0xa9,  0x28e,  0x3,    0x2,    0x2,    0x2,    0xab,   0xac,   0x7,
+      0x2a,  0x2,    0x2,    0xac,   0x4,    0x3,    0x2,    0x2,    0x2,
+      0xad,  0xae,   0x7,    0x2b,   0x2,    0x2,    0xae,   0x6,    0x3,
+      0x2,   0x2,    0x2,    0xaf,   0xb0,   0x7,    0x3f,   0x2,    0x2,
+      0xb0,  0xb1,   0x7,    0x40,   0x2,    0x2,    0xb1,   0x8,    0x3,
+      0x2,   0x2,    0x2,    0xb2,   0xb3,   0x7,    0x2e,   0x2,    0x2,
+      0xb3,  0xa,    0x3,    0x2,    0x2,    0x2,    0xb4,   0xb5,   0x7,
+      0x3c,  0x2,    0x2,    0xb5,   0xc,    0x3,    0x2,    0x2,    0x2,
+      0xb6,  0xb7,   0x7,    0x76,   0x2,    0x2,    0xb7,   0xb8,   0x7,
+      0x7b,  0x2,    0x2,    0xb8,   0xb9,   0x7,    0x72,   0x2,    0x2,
+      0xb9,  0xba,   0x7,    0x67,   0x2,    0x2,    0xba,   0xe,    0x3,
+      0x2,   0x2,    0x2,    0xbb,   0xbc,   0x7,    0x41,   0x2,    0x2,
+      0xbc,  0x10,   0x3,    0x2,    0x2,    0x2,    0xbd,   0xbe,   0x7,
+      0x7e,  0x2,    0x2,    0xbe,   0xbf,   0x7,    0x7e,   0x2,    0x2,
+      0xbf,  0x12,   0x3,    0x2,    0x2,    0x2,    0xc0,   0xc1,   0x7,
+      0x28,  0x2,    0x2,    0xc1,   0xc2,   0x7,    0x28,   0x2,    0x2,
+      0xc2,  0x14,   0x3,    0x2,    0x2,    0x2,    0xc3,   0xc4,   0x7,
+      0x30,  0x2,    0x2,    0xc4,   0x16,   0x3,    0x2,    0x2,    0x2,
+      0xc5,  0xc6,   0x7,    0x5d,   0x2,    0x2,    0xc6,   0x18,   0x3,
+      0x2,   0x2,    0x2,    0xc7,   0xc8,   0x7,    0x5f,   0x2,    0x2,
+      0xc8,  0x1a,   0x3,    0x2,    0x2,    0x2,    0xc9,   0xca,   0x7,
+      0x3d,  0x2,    0x2,    0xca,   0x1c,   0x3,    0x2,    0x2,    0x2,
+      0xcb,  0xcc,   0x7,    0x71,   0x2,    0x2,    0xcc,   0xcd,   0x7,
+      0x68,  0x2,    0x2,    0xcd,   0x1e,   0x3,    0x2,    0x2,    0x2,
+      0xce,  0xcf,   0x7,    0x67,   0x2,    0x2,    0xcf,   0xd0,   0x7,
+      0x6e,  0x2,    0x2,    0xd0,   0xd1,   0x7,    0x75,   0x2,    0x2,
+      0xd1,  0xd2,   0x7,    0x67,   0x2,    0x2,    0xd2,   0x20,   0x3,
+      0x2,   0x2,    0x2,    0xd3,   0xd4,   0x7,    0x7d,   0x2,    0x2,
+      0xd4,  0x22,   0x3,    0x2,    0x2,    0x2,    0xd5,   0xd6,   0x7,
+      0x7f,  0x2,    0x2,    0xd6,   0x24,   0x3,    0x2,    0x2,    0x2,
+      0xd7,  0xd8,   0x7,    0x67,   0x2,    0x2,    0xd8,   0xd9,   0x7,
+      0x7a,  0x2,    0x2,    0xd9,   0xda,   0x7,    0x76,   0x2,    0x2,
+      0xda,  0xdb,   0x7,    0x67,   0x2,    0x2,    0xdb,   0xdc,   0x7,
+      0x70,  0x2,    0x2,    0xdc,   0xdd,   0x7,    0x66,   0x2,    0x2,
+      0xdd,  0xde,   0x7,    0x75,   0x2,    0x2,    0xde,   0x26,   0x3,
+      0x2,   0x2,    0x2,    0xdf,   0xe0,   0x7,    0x69,   0x2,    0x2,
+      0xe0,  0xe1,   0x7,    0x67,   0x2,    0x2,    0xe1,   0xe2,   0x7,
+      0x70,  0x2,    0x2,    0xe2,   0xe3,   0x7,    0x67,   0x2,    0x2,
+      0xe3,  0xe4,   0x7,    0x74,   0x2,    0x2,    0xe4,   0xe5,   0x7,
+      0x63,  0x2,    0x2,    0xe5,   0xe6,   0x7,    0x76,   0x2,    0x2,
+      0xe6,  0xe7,   0x7,    0x67,   0x2,    0x2,    0xe7,   0xe8,   0x7,
+      0x75,  0x2,    0x2,    0xe8,   0x28,   0x3,    0x2,    0x2,    0x2,
+      0xe9,  0xea,   0x7,    0x71,   0x2,    0x2,    0xea,   0xeb,   0x7,
+      0x72,  0x2,    0x2,    0xeb,   0xec,   0x7,    0x67,   0x2,    0x2,
+      0xec,  0xed,   0x7,    0x74,   0x2,    0x2,    0xed,   0xee,   0x7,
+      0x63,  0x2,    0x2,    0xee,   0xef,   0x7,    0x76,   0x2,    0x2,
+      0xef,  0xf0,   0x7,    0x71,   0x2,    0x2,    0xf0,   0xf1,   0x7,
+      0x74,  0x2,    0x2,    0xf1,   0x2a,   0x3,    0x2,    0x2,    0x2,
+      0xf2,  0xf3,   0x7,    0x65,   0x2,    0x2,    0xf3,   0xf4,   0x7,
+      0x71,  0x2,    0x2,    0xf4,   0xf5,   0x7,    0x70,   0x2,    0x2,
+      0xf5,  0xf6,   0x7,    0x75,   0x2,    0x2,    0xf6,   0xf7,   0x7,
+      0x76,  0x2,    0x2,    0xf7,   0x2c,   0x3,    0x2,    0x2,    0x2,
+      0xf8,  0xf9,   0x7,    0x6f,   0x2,    0x2,    0xf9,   0xfa,   0x7,
+      0x63,  0x2,    0x2,    0xfa,   0xfb,   0x7,    0x65,   0x2,    0x2,
+      0xfb,  0xfc,   0x7,    0x74,   0x2,    0x2,    0xfc,   0xfd,   0x7,
+      0x71,  0x2,    0x2,    0xfd,   0x2e,   0x3,    0x2,    0x2,    0x2,
+      0xfe,  0xff,   0x7,    0x64,   0x2,    0x2,    0xff,   0x100,  0x7,
+      0x77,  0x2,    0x2,    0x100,  0x101,  0x7,    0x6b,   0x2,    0x2,
+      0x101, 0x102,  0x7,    0x6e,   0x2,    0x2,    0x102,  0x103,  0x7,
+      0x76,  0x2,    0x2,    0x103,  0x104,  0x7,    0x6b,   0x2,    0x2,
+      0x104, 0x105,  0x7,    0x70,   0x2,    0x2,    0x105,  0x30,   0x3,
+      0x2,   0x2,    0x2,    0x106,  0x107,  0x7,    0x74,   0x2,    0x2,
+      0x107, 0x108,  0x7,    0x77,   0x2,    0x2,    0x108,  0x109,  0x7,
+      0x70,  0x2,    0x2,    0x109,  0x10a,  0x7,    0x76,   0x2,    0x2,
+      0x10a, 0x10b,  0x7,    0x6b,   0x2,    0x2,    0x10b,  0x10c,  0x7,
+      0x6f,  0x2,    0x2,    0x10c,  0x10d,  0x7,    0x67,   0x2,    0x2,
+      0x10d, 0x32,   0x3,    0x2,    0x2,    0x2,    0x10e,  0x10f,  0x7,
+      0x6f,  0x2,    0x2,    0x10f,  0x110,  0x7,    0x71,   0x2,    0x2,
+      0x110, 0x111,  0x7,    0x66,   0x2,    0x2,    0x111,  0x112,  0x7,
+      0x77,  0x2,    0x2,    0x112,  0x113,  0x7,    0x6e,   0x2,    0x2,
+      0x113, 0x114,  0x7,    0x67,   0x2,    0x2,    0x114,  0x34,   0x3,
+      0x2,   0x2,    0x2,    0x115,  0x116,  0x7,    0x6c,   0x2,    0x2,
+      0x116, 0x117,  0x7,    0x63,   0x2,    0x2,    0x117,  0x118,  0x7,
+      0x78,  0x2,    0x2,    0x118,  0x119,  0x7,    0x63,   0x2,    0x2,
+      0x119, 0x11a,  0x7,    0x75,   0x2,    0x2,    0x11a,  0x11b,  0x7,
+      0x65,  0x2,    0x2,    0x11b,  0x11c,  0x7,    0x74,   0x2,    0x2,
+      0x11c, 0x11d,  0x7,    0x6b,   0x2,    0x2,    0x11d,  0x11e,  0x7,
+      0x72,  0x2,    0x2,    0x11e,  0x11f,  0x7,    0x76,   0x2,    0x2,
+      0x11f, 0x36,   0x3,    0x2,    0x2,    0x2,    0x120,  0x121,  0x7,
+      0x66,  0x2,    0x2,    0x121,  0x122,  0x7,    0x67,   0x2,    0x2,
+      0x122, 0x123,  0x7,    0x68,   0x2,    0x2,    0x123,  0x124,  0x7,
+      0x67,  0x2,    0x2,    0x124,  0x125,  0x7,    0x74,   0x2,    0x2,
+      0x125, 0x126,  0x7,    0x74,   0x2,    0x2,    0x126,  0x127,  0x7,
+      0x67,  0x2,    0x2,    0x127,  0x128,  0x7,    0x66,   0x2,    0x2,
+      0x128, 0x38,   0x3,    0x2,    0x2,    0x2,    0x129,  0x12a,  0x7,
+      0x6b,  0x2,    0x2,    0x12a,  0x12b,  0x7,    0x68,   0x2,    0x2,
+      0x12b, 0x3a,   0x3,    0x2,    0x2,    0x2,    0x12c,  0x12d,  0x7,
+      0x68,  0x2,    0x2,    0x12d,  0x12e,  0x7,    0x71,   0x2,    0x2,
+      0x12e, 0x12f,  0x7,    0x74,   0x2,    0x2,    0x12f,  0x3c,   0x3,
+      0x2,   0x2,    0x2,    0x130,  0x131,  0x7,    0x79,   0x2,    0x2,
+      0x131, 0x132,  0x7,    0x6a,   0x2,    0x2,    0x132,  0x133,  0x7,
+      0x6b,  0x2,    0x2,    0x133,  0x134,  0x7,    0x6e,   0x2,    0x2,
+      0x134, 0x135,  0x7,    0x67,   0x2,    0x2,    0x135,  0x3e,   0x3,
+      0x2,   0x2,    0x2,    0x136,  0x137,  0x7,    0x74,   0x2,    0x2,
+      0x137, 0x138,  0x7,    0x67,   0x2,    0x2,    0x138,  0x139,  0x7,
+      0x76,  0x2,    0x2,    0x139,  0x13a,  0x7,    0x77,   0x2,    0x2,
+      0x13a, 0x13b,  0x7,    0x74,   0x2,    0x2,    0x13b,  0x13c,  0x7,
+      0x70,  0x2,    0x2,    0x13c,  0x40,   0x3,    0x2,    0x2,    0x2,
+      0x13d, 0x13e,  0x7,    0x65,   0x2,    0x2,    0x13e,  0x13f,  0x7,
+      0x71,  0x2,    0x2,    0x13f,  0x140,  0x7,    0x70,   0x2,    0x2,
+      0x140, 0x141,  0x7,    0x75,   0x2,    0x2,    0x141,  0x142,  0x7,
+      0x76,  0x2,    0x2,    0x142,  0x143,  0x7,    0x67,   0x2,    0x2,
+      0x143, 0x144,  0x7,    0x7a,   0x2,    0x2,    0x144,  0x145,  0x7,
+      0x72,  0x2,    0x2,    0x145,  0x146,  0x7,    0x74,   0x2,    0x2,
+      0x146, 0x42,   0x3,    0x2,    0x2,    0x2,    0x147,  0x148,  0x7,
+      0x65,  0x2,    0x2,    0x148,  0x149,  0x7,    0x71,   0x2,    0x2,
+      0x149, 0x14a,  0x7,    0x70,   0x2,    0x2,    0x14a,  0x14b,  0x7,
+      0x76,  0x2,    0x2,    0x14b,  0x14c,  0x7,    0x6b,   0x2,    0x2,
+      0x14c, 0x14d,  0x7,    0x70,   0x2,    0x2,    0x14d,  0x14e,  0x7,
+      0x77,  0x2,    0x2,    0x14e,  0x14f,  0x7,    0x67,   0x2,    0x2,
+      0x14f, 0x44,   0x3,    0x2,    0x2,    0x2,    0x150,  0x151,  0x7,
+      0x64,  0x2,    0x2,    0x151,  0x152,  0x7,    0x74,   0x2,    0x2,
+      0x152, 0x153,  0x7,    0x67,   0x2,    0x2,    0x153,  0x154,  0x7,
+      0x63,  0x2,    0x2,    0x154,  0x155,  0x7,    0x6d,   0x2,    0x2,
+      0x155, 0x46,   0x3,    0x2,    0x2,    0x2,    0x156,  0x157,  0x7,
+      0x69,  0x2,    0x2,    0x157,  0x158,  0x7,    0x71,   0x2,    0x2,
+      0x158, 0x159,  0x7,    0x76,   0x2,    0x2,    0x159,  0x15a,  0x7,
+      0x71,  0x2,    0x2,    0x15a,  0x48,   0x3,    0x2,    0x2,    0x2,
+      0x15b, 0x15c,  0x7,    0x71,   0x2,    0x2,    0x15c,  0x15d,  0x7,
+      0x76,  0x2,    0x2,    0x15d,  0x15e,  0x7,    0x6a,   0x2,    0x2,
+      0x15e, 0x15f,  0x7,    0x67,   0x2,    0x2,    0x15f,  0x160,  0x7,
+      0x74,  0x2,    0x2,    0x160,  0x161,  0x7,    0x79,   0x2,    0x2,
+      0x161, 0x162,  0x7,    0x6b,   0x2,    0x2,    0x162,  0x163,  0x7,
+      0x75,  0x2,    0x2,    0x163,  0x164,  0x7,    0x67,   0x2,    0x2,
+      0x164, 0x4a,   0x3,    0x2,    0x2,    0x2,    0x165,  0x166,  0x7,
+      0x76,  0x2,    0x2,    0x166,  0x167,  0x7,    0x74,   0x2,    0x2,
+      0x167, 0x168,  0x7,    0x7b,   0x2,    0x2,    0x168,  0x4c,   0x3,
+      0x2,   0x2,    0x2,    0x169,  0x16a,  0x7,    0x6e,   0x2,    0x2,
+      0x16a, 0x16b,  0x7,    0x63,   0x2,    0x2,    0x16b,  0x16c,  0x7,
+      0x64,  0x2,    0x2,    0x16c,  0x16d,  0x7,    0x67,   0x2,    0x2,
+      0x16d, 0x16e,  0x7,    0x6e,   0x2,    0x2,    0x16e,  0x4e,   0x3,
+      0x2,   0x2,    0x2,    0x16f,  0x170,  0x7,    0x6e,   0x2,    0x2,
+      0x170, 0x171,  0x7,    0x63,   0x2,    0x2,    0x171,  0x172,  0x7,
+      0x64,  0x2,    0x2,    0x172,  0x173,  0x7,    0x67,   0x2,    0x2,
+      0x173, 0x174,  0x7,    0x6e,   0x2,    0x2,    0x174,  0x175,  0x7,
+      0x75,  0x2,    0x2,    0x175,  0x50,   0x3,    0x2,    0x2,    0x2,
+      0x176, 0x177,  0x7,    0x76,   0x2,    0x2,    0x177,  0x178,  0x7,
+      0x63,  0x2,    0x2,    0x178,  0x179,  0x7,    0x6b,   0x2,    0x2,
+      0x179, 0x17a,  0x7,    0x6e,   0x2,    0x2,    0x17a,  0x52,   0x3,
+      0x2,   0x2,    0x2,    0x17b,  0x17c,  0x7,    0x6b,   0x2,    0x2,
+      0x17c, 0x17d,  0x7,    0x75,   0x2,    0x2,    0x17d,  0x17e,  0x7,
+      0x70,  0x2,    0x2,    0x17e,  0x17f,  0x7,    0x76,   0x2,    0x2,
+      0x17f, 0x54,   0x3,    0x2,    0x2,    0x2,    0x180,  0x181,  0x7,
+      0x6b,  0x2,    0x2,    0x181,  0x182,  0x7,    0x75,   0x2,    0x2,
+      0x182, 0x56,   0x3,    0x2,    0x2,    0x2,    0x183,  0x184,  0x7,
+      0x6e,  0x2,    0x2,    0x184,  0x185,  0x7,    0x67,   0x2,    0x2,
+      0x185, 0x186,  0x7,    0x76,   0x2,    0x2,    0x186,  0x58,   0x3,
+      0x2,   0x2,    0x2,    0x187,  0x188,  0x7,    0x67,   0x2,    0x2,
+      0x188, 0x189,  0x7,    0x7a,   0x2,    0x2,    0x189,  0x18a,  0x7,
+      0x76,  0x2,    0x2,    0x18a,  0x18b,  0x7,    0x67,   0x2,    0x2,
+      0x18b, 0x18c,  0x7,    0x74,   0x2,    0x2,    0x18c,  0x18d,  0x7,
+      0x70,  0x2,    0x2,    0x18d,  0x5a,   0x3,    0x2,    0x2,    0x2,
+      0x18e, 0x18f,  0x7,    0x63,   0x2,    0x2,    0x18f,  0x190,  0x7,
+      0x75,  0x2,    0x2,    0x190,  0x191,  0x7,    0x75,   0x2,    0x2,
+      0x191, 0x192,  0x7,    0x67,   0x2,    0x2,    0x192,  0x193,  0x7,
+      0x74,  0x2,    0x2,    0x193,  0x194,  0x7,    0x76,   0x2,    0x2,
+      0x194, 0x5c,   0x3,    0x2,    0x2,    0x2,    0x195,  0x196,  0x7,
+      0x65,  0x2,    0x2,    0x196,  0x197,  0x7,    0x6a,   0x2,    0x2,
+      0x197, 0x198,  0x7,    0x67,   0x2,    0x2,    0x198,  0x199,  0x7,
+      0x65,  0x2,    0x2,    0x199,  0x19a,  0x7,    0x6d,   0x2,    0x2,
+      0x19a, 0x5e,   0x3,    0x2,    0x2,    0x2,    0x19b,  0x19c,  0x7,
+      0x77,  0x2,    0x2,    0x19c,  0x19d,  0x7,    0x70,   0x2,    0x2,
+      0x19d, 0x19e,  0x7,    0x74,   0x2,    0x2,    0x19e,  0x19f,  0x7,
+      0x67,  0x2,    0x2,    0x19f,  0x1a0,  0x7,    0x63,   0x2,    0x2,
+      0x1a0, 0x1a1,  0x7,    0x65,   0x2,    0x2,    0x1a1,  0x1a2,  0x7,
+      0x6a,  0x2,    0x2,    0x1a2,  0x1a3,  0x7,    0x63,   0x2,    0x2,
+      0x1a3, 0x1a4,  0x7,    0x64,   0x2,    0x2,    0x1a4,  0x1a5,  0x7,
+      0x6e,  0x2,    0x2,    0x1a5,  0x1a6,  0x7,    0x67,   0x2,    0x2,
+      0x1a6, 0x60,   0x3,    0x2,    0x2,    0x2,    0x1a7,  0x1a8,  0x7,
+      0x66,  0x2,    0x2,    0x1a8,  0x1a9,  0x7,    0x67,   0x2,    0x2,
+      0x1a9, 0x1aa,  0x7,    0x64,   0x2,    0x2,    0x1aa,  0x1ab,  0x7,
+      0x77,  0x2,    0x2,    0x1ab,  0x1ac,  0x7,    0x69,   0x2,    0x2,
+      0x1ac, 0x62,   0x3,    0x2,    0x2,    0x2,    0x1ad,  0x1ae,  0x7,
+      0x3f,  0x2,    0x2,    0x1ae,  0x64,   0x3,    0x2,    0x2,    0x2,
+      0x1af, 0x1b0,  0x7,    0x2c,   0x2,    0x2,    0x1b0,  0x1ca,  0x7,
+      0x3f,  0x2,    0x2,    0x1b1,  0x1b2,  0x7,    0x31,   0x2,    0x2,
+      0x1b2, 0x1ca,  0x7,    0x3f,   0x2,    0x2,    0x1b3,  0x1b4,  0x7,
+      0x27,  0x2,    0x2,    0x1b4,  0x1ca,  0x7,    0x3f,   0x2,    0x2,
+      0x1b5, 0x1b6,  0x7,    0x2d,   0x2,    0x2,    0x1b6,  0x1ca,  0x7,
+      0x3f,  0x2,    0x2,    0x1b7,  0x1b8,  0x7,    0x2f,   0x2,    0x2,
+      0x1b8, 0x1ca,  0x7,    0x3f,   0x2,    0x2,    0x1b9,  0x1ba,  0x7,
+      0x3e,  0x2,    0x2,    0x1ba,  0x1bb,  0x7,    0x3e,   0x2,    0x2,
+      0x1bb, 0x1ca,  0x7,    0x3f,   0x2,    0x2,    0x1bc,  0x1bd,  0x7,
+      0x40,  0x2,    0x2,    0x1bd,  0x1be,  0x7,    0x40,   0x2,    0x2,
+      0x1be, 0x1ca,  0x7,    0x3f,   0x2,    0x2,    0x1bf,  0x1c0,  0x7,
+      0x40,  0x2,    0x2,    0x1c0,  0x1c1,  0x7,    0x40,   0x2,    0x2,
+      0x1c1, 0x1c2,  0x7,    0x40,   0x2,    0x2,    0x1c2,  0x1ca,  0x7,
+      0x3f,  0x2,    0x2,    0x1c3,  0x1c4,  0x7,    0x28,   0x2,    0x2,
+      0x1c4, 0x1ca,  0x7,    0x3f,   0x2,    0x2,    0x1c5,  0x1c6,  0x7,
+      0x60,  0x2,    0x2,    0x1c6,  0x1ca,  0x7,    0x3f,   0x2,    0x2,
+      0x1c7, 0x1c8,  0x7,    0x7e,   0x2,    0x2,    0x1c8,  0x1ca,  0x7,
+      0x3f,  0x2,    0x2,    0x1c9,  0x1af,  0x3,    0x2,    0x2,    0x2,
+      0x1c9, 0x1b1,  0x3,    0x2,    0x2,    0x2,    0x1c9,  0x1b3,  0x3,
+      0x2,   0x2,    0x2,    0x1c9,  0x1b5,  0x3,    0x2,    0x2,    0x2,
+      0x1c9, 0x1b7,  0x3,    0x2,    0x2,    0x2,    0x1c9,  0x1b9,  0x3,
+      0x2,   0x2,    0x2,    0x1c9,  0x1bc,  0x3,    0x2,    0x2,    0x2,
+      0x1c9, 0x1bf,  0x3,    0x2,    0x2,    0x2,    0x1c9,  0x1c3,  0x3,
+      0x2,   0x2,    0x2,    0x1c9,  0x1c5,  0x3,    0x2,    0x2,    0x2,
+      0x1c9, 0x1c7,  0x3,    0x2,    0x2,    0x2,    0x1ca,  0x66,   0x3,
+      0x2,   0x2,    0x2,    0x1cb,  0x1cc,  0x7,    0x3f,   0x2,    0x2,
+      0x1cc, 0x1cd,  0x7,    0x3f,   0x2,    0x2,    0x1cd,  0x68,   0x3,
+      0x2,   0x2,    0x2,    0x1ce,  0x1cf,  0x7,    0x2d,   0x2,    0x2,
+      0x1cf, 0x6a,   0x3,    0x2,    0x2,    0x2,    0x1d0,  0x1d1,  0x7,
+      0x2f,  0x2,    0x2,    0x1d1,  0x6c,   0x3,    0x2,    0x2,    0x2,
+      0x1d2, 0x1d3,  0x7,    0x2c,   0x2,    0x2,    0x1d3,  0x6e,   0x3,
+      0x2,   0x2,    0x2,    0x1d4,  0x1d5,  0x7,    0x31,   0x2,    0x2,
+      0x1d5, 0x70,   0x3,    0x2,    0x2,    0x2,    0x1d6,  0x1d7,  0x7,
+      0x27,  0x2,    0x2,    0x1d7,  0x72,   0x3,    0x2,    0x2,    0x2,
+      0x1d8, 0x1d9,  0x7,    0x7e,   0x2,    0x2,    0x1d9,  0x74,   0x3,
+      0x2,   0x2,    0x2,    0x1da,  0x1db,  0x7,    0x28,   0x2,    0x2,
+      0x1db, 0x76,   0x3,    0x2,    0x2,    0x2,    0x1dc,  0x1dd,  0x7,
+      0x80,  0x2,    0x2,    0x1dd,  0x78,   0x3,    0x2,    0x2,    0x2,
+      0x1de, 0x1df,  0x7,    0x6f,   0x2,    0x2,    0x1df,  0x1e0,  0x7,
+      0x63,  0x2,    0x2,    0x1e0,  0x1e1,  0x7,    0x7a,   0x2,    0x2,
+      0x1e1, 0x7a,   0x3,    0x2,    0x2,    0x2,    0x1e2,  0x1e3,  0x7,
+      0x6f,  0x2,    0x2,    0x1e3,  0x1e4,  0x7,    0x6b,   0x2,    0x2,
+      0x1e4, 0x1e5,  0x7,    0x70,   0x2,    0x2,    0x1e5,  0x7c,   0x3,
+      0x2,   0x2,    0x2,    0x1e6,  0x1e7,  0x7,    0x23,   0x2,    0x2,
+      0x1e7, 0x1e8,  0x7,    0x3f,   0x2,    0x2,    0x1e8,  0x7e,   0x3,
+      0x2,   0x2,    0x2,    0x1e9,  0x1ea,  0x7,    0x3e,   0x2,    0x2,
+      0x1ea, 0x80,   0x3,    0x2,    0x2,    0x2,    0x1eb,  0x1ec,  0x7,
+      0x3e,  0x2,    0x2,    0x1ec,  0x1ed,  0x7,    0x3f,   0x2,    0x2,
+      0x1ed, 0x82,   0x3,    0x2,    0x2,    0x2,    0x1ee,  0x1ef,  0x7,
+      0x40,  0x2,    0x2,    0x1ef,  0x84,   0x3,    0x2,    0x2,    0x2,
+      0x1f0, 0x1f1,  0x7,    0x40,   0x2,    0x2,    0x1f1,  0x1f2,  0x7,
+      0x3f,  0x2,    0x2,    0x1f2,  0x86,   0x3,    0x2,    0x2,    0x2,
+      0x1f3, 0x1f4,  0x7,    0x3e,   0x2,    0x2,    0x1f4,  0x1f5,  0x7,
+      0x3e,  0x2,    0x2,    0x1f5,  0x88,   0x3,    0x2,    0x2,    0x2,
+      0x1f6, 0x1f7,  0x7,    0x40,   0x2,    0x2,    0x1f7,  0x1f8,  0x7,
+      0x40,  0x2,    0x2,    0x1f8,  0x8a,   0x3,    0x2,    0x2,    0x2,
+      0x1f9, 0x1fa,  0x7,    0x40,   0x2,    0x2,    0x1fa,  0x1fb,  0x7,
+      0x40,  0x2,    0x2,    0x1fb,  0x1fc,  0x7,    0x40,   0x2,    0x2,
+      0x1fc, 0x8c,   0x3,    0x2,    0x2,    0x2,    0x1fd,  0x1fe,  0x7,
+      0x30,  0x2,    0x2,    0x1fe,  0x1ff,  0x7,    0x30,   0x2,    0x2,
+      0x1ff, 0x200,  0x7,    0x30,   0x2,    0x2,    0x200,  0x8e,   0x3,
+      0x2,   0x2,    0x2,    0x201,  0x204,  0x5,    0x67,   0x34,   0x2,
+      0x202, 0x204,  0x5,    0x7d,   0x3f,   0x2,    0x203,  0x201,  0x3,
+      0x2,   0x2,    0x2,    0x203,  0x202,  0x3,    0x2,    0x2,    0x2,
+      0x204, 0x90,   0x3,    0x2,    0x2,    0x2,    0x205,  0x206,  0x7,
+      0x2d,  0x2,    0x2,    0x206,  0x207,  0x7,    0x2d,   0x2,    0x2,
+      0x207, 0x92,   0x3,    0x2,    0x2,    0x2,    0x208,  0x209,  0x7,
+      0x2f,  0x2,    0x2,    0x209,  0x20a,  0x7,    0x2f,   0x2,    0x2,
+      0x20a, 0x94,   0x3,    0x2,    0x2,    0x2,    0x20b,  0x20c,  0x7,
+      0x23,  0x2,    0x2,    0x20c,  0x96,   0x3,    0x2,    0x2,    0x2,
+      0x20d, 0x212,  0x7,    0x24,   0x2,    0x2,    0x20e,  0x211,  0x5,
+      0x99,  0x4d,   0x2,    0x20f,  0x211,  0xa,    0x2,    0x2,    0x2,
+      0x210, 0x20e,  0x3,    0x2,    0x2,    0x2,    0x210,  0x20f,  0x3,
+      0x2,   0x2,    0x2,    0x211,  0x214,  0x3,    0x2,    0x2,    0x2,
+      0x212, 0x210,  0x3,    0x2,    0x2,    0x2,    0x212,  0x213,  0x3,
+      0x2,   0x2,    0x2,    0x213,  0x215,  0x3,    0x2,    0x2,    0x2,
+      0x214, 0x212,  0x3,    0x2,    0x2,    0x2,    0x215,  0x220,  0x7,
+      0x24,  0x2,    0x2,    0x216,  0x21b,  0x7,    0x29,   0x2,    0x2,
+      0x217, 0x21a,  0x5,    0x99,   0x4d,   0x2,    0x218,  0x21a,  0xa,
+      0x3,   0x2,    0x2,    0x219,  0x217,  0x3,    0x2,    0x2,    0x2,
+      0x219, 0x218,  0x3,    0x2,    0x2,    0x2,    0x21a,  0x21d,  0x3,
+      0x2,   0x2,    0x2,    0x21b,  0x219,  0x3,    0x2,    0x2,    0x2,
+      0x21b, 0x21c,  0x3,    0x2,    0x2,    0x2,    0x21c,  0x21e,  0x3,
+      0x2,   0x2,    0x2,    0x21d,  0x21b,  0x3,    0x2,    0x2,    0x2,
+      0x21e, 0x220,  0x7,    0x29,   0x2,    0x2,    0x21f,  0x20d,  0x3,
+      0x2,   0x2,    0x2,    0x21f,  0x216,  0x3,    0x2,    0x2,    0x2,
+      0x220, 0x98,   0x3,    0x2,    0x2,    0x2,    0x221,  0x222,  0x7,
+      0x5e,  0x2,    0x2,    0x222,  0x223,  0x9,    0x4,    0x2,    0x2,
+      0x223, 0x9a,   0x3,    0x2,    0x2,    0x2,    0x224,  0x228,  0x9,
+      0x5,   0x2,    0x2,    0x225,  0x227,  0x9,    0x6,    0x2,    0x2,
+      0x226, 0x225,  0x3,    0x2,    0x2,    0x2,    0x227,  0x22a,  0x3,
+      0x2,   0x2,    0x2,    0x228,  0x226,  0x3,    0x2,    0x2,    0x2,
+      0x228, 0x229,  0x3,    0x2,    0x2,    0x2,    0x229,  0x9c,   0x3,
+      0x2,   0x2,    0x2,    0x22a,  0x228,  0x3,    0x2,    0x2,    0x2,
+      0x22b, 0x22d,  0x9,    0x7,    0x2,    0x2,    0x22c,  0x22b,  0x3,
+      0x2,   0x2,    0x2,    0x22d,  0x22e,  0x3,    0x2,    0x2,    0x2,
+      0x22e, 0x22c,  0x3,    0x2,    0x2,    0x2,    0x22e,  0x22f,  0x3,
+      0x2,   0x2,    0x2,    0x22f,  0x230,  0x3,    0x2,    0x2,    0x2,
+      0x230, 0x231,  0x8,    0x4f,   0x2,    0x2,    0x231,  0x9e,   0x3,
+      0x2,   0x2,    0x2,    0x232,  0x233,  0x7,    0x31,   0x2,    0x2,
+      0x233, 0x234,  0x7,    0x2c,   0x2,    0x2,    0x234,  0x238,  0x3,
+      0x2,   0x2,    0x2,    0x235,  0x237,  0xb,    0x2,    0x2,    0x2,
+      0x236, 0x235,  0x3,    0x2,    0x2,    0x2,    0x237,  0x23a,  0x3,
+      0x2,   0x2,    0x2,    0x238,  0x239,  0x3,    0x2,    0x2,    0x2,
+      0x238, 0x236,  0x3,    0x2,    0x2,    0x2,    0x239,  0x23e,  0x3,
+      0x2,   0x2,    0x2,    0x23a,  0x238,  0x3,    0x2,    0x2,    0x2,
+      0x23b, 0x23c,  0x7,    0x2c,   0x2,    0x2,    0x23c,  0x23f,  0x7,
+      0x31,  0x2,    0x2,    0x23d,  0x23f,  0x7,    0x2,    0x2,    0x3,
+      0x23e, 0x23b,  0x3,    0x2,    0x2,    0x2,    0x23e,  0x23d,  0x3,
+      0x2,   0x2,    0x2,    0x23f,  0x240,  0x3,    0x2,    0x2,    0x2,
+      0x240, 0x241,  0x8,    0x50,   0x2,    0x2,    0x241,  0xa0,   0x3,
+      0x2,   0x2,    0x2,    0x242,  0x243,  0x7,    0x31,   0x2,    0x2,
+      0x243, 0x244,  0x7,    0x31,   0x2,    0x2,    0x244,  0x248,  0x3,
+      0x2,   0x2,    0x2,    0x245,  0x247,  0xa,    0x8,    0x2,    0x2,
+      0x246, 0x245,  0x3,    0x2,    0x2,    0x2,    0x247,  0x24a,  0x3,
+      0x2,   0x2,    0x2,    0x248,  0x246,  0x3,    0x2,    0x2,    0x2,
+      0x248, 0x249,  0x3,    0x2,    0x2,    0x2,    0x249,  0x24b,  0x3,
+      0x2,   0x2,    0x2,    0x24a,  0x248,  0x3,    0x2,    0x2,    0x2,
+      0x24b, 0x24c,  0x8,    0x51,   0x2,    0x2,    0x24c,  0xa2,   0x3,
+      0x2,   0x2,    0x2,    0x24d,  0x24e,  0x9,    0x9,    0x2,    0x2,
+      0x24e, 0xa4,   0x3,    0x2,    0x2,    0x2,    0x24f,  0x258,  0x7,
+      0x32,  0x2,    0x2,    0x250,  0x254,  0x9,    0xa,    0x2,    0x2,
+      0x251, 0x253,  0x5,    0xa3,   0x52,   0x2,    0x252,  0x251,  0x3,
+      0x2,   0x2,    0x2,    0x253,  0x256,  0x3,    0x2,    0x2,    0x2,
+      0x254, 0x252,  0x3,    0x2,    0x2,    0x2,    0x254,  0x255,  0x3,
+      0x2,   0x2,    0x2,    0x255,  0x258,  0x3,    0x2,    0x2,    0x2,
+      0x256, 0x254,  0x3,    0x2,    0x2,    0x2,    0x257,  0x24f,  0x3,
+      0x2,   0x2,    0x2,    0x257,  0x250,  0x3,    0x2,    0x2,    0x2,
+      0x258, 0xa6,   0x3,    0x2,    0x2,    0x2,    0x259,  0x25b,  0x9,
+      0xb,   0x2,    0x2,    0x25a,  0x25c,  0x9,    0xc,    0x2,    0x2,
+      0x25b, 0x25a,  0x3,    0x2,    0x2,    0x2,    0x25b,  0x25c,  0x3,
+      0x2,   0x2,    0x2,    0x25c,  0x25e,  0x3,    0x2,    0x2,    0x2,
+      0x25d, 0x25f,  0x5,    0xa3,   0x52,   0x2,    0x25e,  0x25d,  0x3,
+      0x2,   0x2,    0x2,    0x25f,  0x260,  0x3,    0x2,    0x2,    0x2,
+      0x260, 0x25e,  0x3,    0x2,    0x2,    0x2,    0x260,  0x261,  0x3,
+      0x2,   0x2,    0x2,    0x261,  0xa8,   0x3,    0x2,    0x2,    0x2,
+      0x262, 0x264,  0x5,    0x6b,   0x36,   0x2,    0x263,  0x262,  0x3,
+      0x2,   0x2,    0x2,    0x263,  0x264,  0x3,    0x2,    0x2,    0x2,
+      0x264, 0x265,  0x3,    0x2,    0x2,    0x2,    0x265,  0x266,  0x5,
+      0xa5,  0x53,   0x2,    0x266,  0x26a,  0x7,    0x30,   0x2,    0x2,
+      0x267, 0x269,  0x5,    0xa3,   0x52,   0x2,    0x268,  0x267,  0x3,
+      0x2,   0x2,    0x2,    0x269,  0x26c,  0x3,    0x2,    0x2,    0x2,
+      0x26a, 0x268,  0x3,    0x2,    0x2,    0x2,    0x26a,  0x26b,  0x3,
+      0x2,   0x2,    0x2,    0x26b,  0x26e,  0x3,    0x2,    0x2,    0x2,
+      0x26c, 0x26a,  0x3,    0x2,    0x2,    0x2,    0x26d,  0x26f,  0x5,
+      0xa7,  0x54,   0x2,    0x26e,  0x26d,  0x3,    0x2,    0x2,    0x2,
+      0x26e, 0x26f,  0x3,    0x2,    0x2,    0x2,    0x26f,  0x28f,  0x3,
+      0x2,   0x2,    0x2,    0x270,  0x272,  0x5,    0x6b,   0x36,   0x2,
+      0x271, 0x270,  0x3,    0x2,    0x2,    0x2,    0x271,  0x272,  0x3,
+      0x2,   0x2,    0x2,    0x272,  0x273,  0x3,    0x2,    0x2,    0x2,
+      0x273, 0x275,  0x7,    0x30,   0x2,    0x2,    0x274,  0x276,  0x5,
+      0xa3,  0x52,   0x2,    0x275,  0x274,  0x3,    0x2,    0x2,    0x2,
+      0x276, 0x277,  0x3,    0x2,    0x2,    0x2,    0x277,  0x275,  0x3,
+      0x2,   0x2,    0x2,    0x277,  0x278,  0x3,    0x2,    0x2,    0x2,
+      0x278, 0x27a,  0x3,    0x2,    0x2,    0x2,    0x279,  0x27b,  0x5,
+      0xa7,  0x54,   0x2,    0x27a,  0x279,  0x3,    0x2,    0x2,    0x2,
+      0x27a, 0x27b,  0x3,    0x2,    0x2,    0x2,    0x27b,  0x28f,  0x3,
+      0x2,   0x2,    0x2,    0x27c,  0x27e,  0x5,    0x6b,   0x36,   0x2,
+      0x27d, 0x27c,  0x3,    0x2,    0x2,    0x2,    0x27d,  0x27e,  0x3,
+      0x2,   0x2,    0x2,    0x27e,  0x27f,  0x3,    0x2,    0x2,    0x2,
+      0x27f, 0x281,  0x5,    0xa5,   0x53,   0x2,    0x280,  0x282,  0x5,
+      0xa7,  0x54,   0x2,    0x281,  0x280,  0x3,    0x2,    0x2,    0x2,
+      0x281, 0x282,  0x3,    0x2,    0x2,    0x2,    0x282,  0x28f,  0x3,
+      0x2,   0x2,    0x2,    0x283,  0x285,  0x5,    0x6b,   0x36,   0x2,
+      0x284, 0x283,  0x3,    0x2,    0x2,    0x2,    0x284,  0x285,  0x3,
+      0x2,   0x2,    0x2,    0x285,  0x286,  0x3,    0x2,    0x2,    0x2,
+      0x286, 0x287,  0x7,    0x32,   0x2,    0x2,    0x287,  0x288,  0x7,
+      0x7a,  0x2,    0x2,    0x288,  0x28a,  0x3,    0x2,    0x2,    0x2,
+      0x289, 0x28b,  0x9,    0xd,    0x2,    0x2,    0x28a,  0x289,  0x3,
+      0x2,   0x2,    0x2,    0x28b,  0x28c,  0x3,    0x2,    0x2,    0x2,
+      0x28c, 0x28a,  0x3,    0x2,    0x2,    0x2,    0x28c,  0x28d,  0x3,
+      0x2,   0x2,    0x2,    0x28d,  0x28f,  0x3,    0x2,    0x2,    0x2,
+      0x28e, 0x263,  0x3,    0x2,    0x2,    0x2,    0x28e,  0x271,  0x3,
+      0x2,   0x2,    0x2,    0x28e,  0x27d,  0x3,    0x2,    0x2,    0x2,
+      0x28e, 0x284,  0x3,    0x2,    0x2,    0x2,    0x28f,  0xaa,   0x3,
+      0x2,   0x2,    0x2,    0x1e,   0x2,    0x1c9,  0x203,  0x210,  0x212,
+      0x219, 0x21b,  0x21f,  0x228,  0x22e,  0x238,  0x23e,  0x248,  0x254,
+      0x257, 0x25b,  0x260,  0x263,  0x26a,  0x26e,  0x271,  0x277,  0x27a,
+      0x27d, 0x281,  0x284,  0x28c,  0x28e,  0x3,    0x2,    0x3,    0x2,
+  };
+
+  atn::ATNDeserializer deserializer;
+  _atn = deserializer.deserialize(_serializedATN);
+
+  size_t count = _atn.getNumberOfDecisions();
+  _decisionToDFA.reserve(count);
+  for (size_t i = 0; i < count; i++) {
+    _decisionToDFA.emplace_back(_atn.getDecisionState(i), i);
+  }
+}
+
+TorqueLexer::Initializer TorqueLexer::_init;
diff --git a/deps/v8/src/torque/TorqueLexer.h b/deps/v8/src/torque/TorqueLexer.h
new file mode 100644
index 00000000000000..6823dccfd5d858
--- /dev/null
+++ b/deps/v8/src/torque/TorqueLexer.h
@@ -0,0 +1,137 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+#ifndef V8_TORQUE_TORQUELEXER_H_
+#define V8_TORQUE_TORQUELEXER_H_
+
+// Generated from Torque.g4 by ANTLR 4.7.1
+
+#pragma once
+
+#include "./antlr4-runtime.h"
+
+class TorqueLexer : public antlr4::Lexer {
+ public:
+  enum {
+    T__0 = 1,
+    T__1 = 2,
+    T__2 = 3,
+    T__3 = 4,
+    T__4 = 5,
+    T__5 = 6,
+    T__6 = 7,
+    T__7 = 8,
+    T__8 = 9,
+    T__9 = 10,
+    T__10 = 11,
+    T__11 = 12,
+    T__12 = 13,
+    T__13 = 14,
+    T__14 = 15,
+    T__15 = 16,
+    T__16 = 17,
+    T__17 = 18,
+    T__18 = 19,
+    T__19 = 20,
+    T__20 = 21,
+    MACRO = 22,
+    BUILTIN = 23,
+    RUNTIME = 24,
+    MODULE = 25,
+    JAVASCRIPT = 26,
+    DEFERRED = 27,
+    IF = 28,
+    FOR = 29,
+    WHILE = 30,
+    RETURN = 31,
+    CONSTEXPR = 32,
+    CONTINUE = 33,
+    BREAK = 34,
+    GOTO = 35,
+    OTHERWISE = 36,
+    TRY = 37,
+    LABEL = 38,
+    LABELS = 39,
+    TAIL = 40,
+    ISNT = 41,
+    IS = 42,
+    LET = 43,
+    EXTERN = 44,
+    ASSERT_TOKEN = 45,
+    CHECK_TOKEN = 46,
+    UNREACHABLE_TOKEN = 47,
+    DEBUG_TOKEN = 48,
+    ASSIGNMENT = 49,
+    ASSIGNMENT_OPERATOR = 50,
+    EQUAL = 51,
+    PLUS = 52,
+    MINUS = 53,
+    MULTIPLY = 54,
+    DIVIDE = 55,
+    MODULO = 56,
+    BIT_OR = 57,
+    BIT_AND = 58,
+    BIT_NOT = 59,
+    MAX = 60,
+    MIN = 61,
+    NOT_EQUAL = 62,
+    LESS_THAN = 63,
+    LESS_THAN_EQUAL = 64,
+    GREATER_THAN = 65,
+    GREATER_THAN_EQUAL = 66,
+    SHIFT_LEFT = 67,
+    SHIFT_RIGHT = 68,
+    SHIFT_RIGHT_ARITHMETIC = 69,
+    VARARGS = 70,
+    EQUALITY_OPERATOR = 71,
+    INCREMENT = 72,
+    DECREMENT = 73,
+    NOT = 74,
+    STRING_LITERAL = 75,
+    IDENTIFIER = 76,
+    WS = 77,
+    BLOCK_COMMENT = 78,
+    LINE_COMMENT = 79,
+    DECIMAL_LITERAL = 80
+  };
+
+  explicit TorqueLexer(antlr4::CharStream* input);
+  ~TorqueLexer();
+
+  std::string getGrammarFileName() const override;
+  const std::vector<std::string>& getRuleNames() const override;
+
+  const std::vector<std::string>& getChannelNames() const override;
+  const std::vector<std::string>& getModeNames() const override;
+  const std::vector<std::string>& getTokenNames()
+      const override;  // deprecated, use vocabulary instead
+  antlr4::dfa::Vocabulary& getVocabulary() const override;
+
+  const std::vector<uint16_t> getSerializedATN() const override;
+  const antlr4::atn::ATN& getATN() const override;
+
+ private:
+  static std::vector<antlr4::dfa::DFA> _decisionToDFA;
+  static antlr4::atn::PredictionContextCache _sharedContextCache;
+  static std::vector<std::string> _ruleNames;
+  static std::vector<std::string> _tokenNames;
+  static std::vector<std::string> _channelNames;
+  static std::vector<std::string> _modeNames;
+
+  static std::vector<std::string> _literalNames;
+  static std::vector<std::string> _symbolicNames;
+  static antlr4::dfa::Vocabulary _vocabulary;
+  static antlr4::atn::ATN _atn;
+  static std::vector<uint16_t> _serializedATN;
+
+  // Individual action functions triggered by action() above.
+
+  // Individual semantic predicate functions triggered by sempred() above.
+
+  struct Initializer {
+    Initializer();
+  };
+  static Initializer _init;
+};
+
+#endif  // V8_TORQUE_TORQUELEXER_H_
diff --git a/deps/v8/src/torque/TorqueListener.cpp b/deps/v8/src/torque/TorqueListener.cpp
new file mode 100644
index 00000000000000..440b95058468eb
--- /dev/null
+++ b/deps/v8/src/torque/TorqueListener.cpp
@@ -0,0 +1,7 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Generated from Torque.g4 by ANTLR 4.7.1
+
+#include "TorqueListener.h"
diff --git a/deps/v8/src/torque/TorqueListener.h b/deps/v8/src/torque/TorqueListener.h
new file mode 100644
index 00000000000000..eb8d7de85b6753
--- /dev/null
+++ b/deps/v8/src/torque/TorqueListener.h
@@ -0,0 +1,321 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+#ifndef V8_TORQUE_TORQUELISTENER_H_
+#define V8_TORQUE_TORQUELISTENER_H_
+
+// Generated from Torque.g4 by ANTLR 4.7.1
+
+#pragma once
+
+#include "./antlr4-runtime.h"
+#include "TorqueParser.h"
+
+/**
+ * This interface defines an abstract listener for a parse tree produced by
+ * TorqueParser.
+ */
+class TorqueListener : public antlr4::tree::ParseTreeListener {
+ public:
+  virtual void enterType(TorqueParser::TypeContext* ctx) = 0;
+  virtual void exitType(TorqueParser::TypeContext* ctx) = 0;
+
+  virtual void enterTypeList(TorqueParser::TypeListContext* ctx) = 0;
+  virtual void exitTypeList(TorqueParser::TypeListContext* ctx) = 0;
+
+  virtual void enterGenericSpecializationTypeList(
+      TorqueParser::GenericSpecializationTypeListContext* ctx) = 0;
+  virtual void exitGenericSpecializationTypeList(
+      TorqueParser::GenericSpecializationTypeListContext* ctx) = 0;
+
+  virtual void enterOptionalGenericTypeList(
+      TorqueParser::OptionalGenericTypeListContext* ctx) = 0;
+  virtual void exitOptionalGenericTypeList(
+      TorqueParser::OptionalGenericTypeListContext* ctx) = 0;
+
+  virtual void enterTypeListMaybeVarArgs(
+      TorqueParser::TypeListMaybeVarArgsContext* ctx) = 0;
+  virtual void exitTypeListMaybeVarArgs(
+      TorqueParser::TypeListMaybeVarArgsContext* ctx) = 0;
+
+  virtual void enterLabelParameter(
+      TorqueParser::LabelParameterContext* ctx) = 0;
+  virtual void exitLabelParameter(TorqueParser::LabelParameterContext* ctx) = 0;
+
+  virtual void enterOptionalType(TorqueParser::OptionalTypeContext* ctx) = 0;
+  virtual void exitOptionalType(TorqueParser::OptionalTypeContext* ctx) = 0;
+
+  virtual void enterOptionalLabelList(
+      TorqueParser::OptionalLabelListContext* ctx) = 0;
+  virtual void exitOptionalLabelList(
+      TorqueParser::OptionalLabelListContext* ctx) = 0;
+
+  virtual void enterOptionalOtherwise(
+      TorqueParser::OptionalOtherwiseContext* ctx) = 0;
+  virtual void exitOptionalOtherwise(
+      TorqueParser::OptionalOtherwiseContext* ctx) = 0;
+
+  virtual void enterParameter(TorqueParser::ParameterContext* ctx) = 0;
+  virtual void exitParameter(TorqueParser::ParameterContext* ctx) = 0;
+
+  virtual void enterParameterList(TorqueParser::ParameterListContext* ctx) = 0;
+  virtual void exitParameterList(TorqueParser::ParameterListContext* ctx) = 0;
+
+  virtual void enterLabelDeclaration(
+      TorqueParser::LabelDeclarationContext* ctx) = 0;
+  virtual void exitLabelDeclaration(
+      TorqueParser::LabelDeclarationContext* ctx) = 0;
+
+  virtual void enterExpression(TorqueParser::ExpressionContext* ctx) = 0;
+  virtual void exitExpression(TorqueParser::ExpressionContext* ctx) = 0;
+
+  virtual void enterConditionalExpression(
+      TorqueParser::ConditionalExpressionContext* ctx) = 0;
+  virtual void exitConditionalExpression(
+      TorqueParser::ConditionalExpressionContext* ctx) = 0;
+
+  virtual void enterLogicalORExpression(
+      TorqueParser::LogicalORExpressionContext* ctx) = 0;
+  virtual void exitLogicalORExpression(
+      TorqueParser::LogicalORExpressionContext* ctx) = 0;
+
+  virtual void enterLogicalANDExpression(
+      TorqueParser::LogicalANDExpressionContext* ctx) = 0;
+  virtual void exitLogicalANDExpression(
+      TorqueParser::LogicalANDExpressionContext* ctx) = 0;
+
+  virtual void enterBitwiseExpression(
+      TorqueParser::BitwiseExpressionContext* ctx) = 0;
+  virtual void exitBitwiseExpression(
+      TorqueParser::BitwiseExpressionContext* ctx) = 0;
+
+  virtual void enterEqualityExpression(
+      TorqueParser::EqualityExpressionContext* ctx) = 0;
+  virtual void exitEqualityExpression(
+      TorqueParser::EqualityExpressionContext* ctx) = 0;
+
+  virtual void enterRelationalExpression(
+      TorqueParser::RelationalExpressionContext* ctx) = 0;
+  virtual void exitRelationalExpression(
+      TorqueParser::RelationalExpressionContext* ctx) = 0;
+
+  virtual void enterShiftExpression(
+      TorqueParser::ShiftExpressionContext* ctx) = 0;
+  virtual void exitShiftExpression(
+      TorqueParser::ShiftExpressionContext* ctx) = 0;
+
+  virtual void enterAdditiveExpression(
+      TorqueParser::AdditiveExpressionContext* ctx) = 0;
+  virtual void exitAdditiveExpression(
+      TorqueParser::AdditiveExpressionContext* ctx) = 0;
+
+  virtual void enterMultiplicativeExpression(
+      TorqueParser::MultiplicativeExpressionContext* ctx) = 0;
+  virtual void exitMultiplicativeExpression(
+      TorqueParser::MultiplicativeExpressionContext* ctx) = 0;
+
+  virtual void enterUnaryExpression(
+      TorqueParser::UnaryExpressionContext* ctx) = 0;
+  virtual void exitUnaryExpression(
+      TorqueParser::UnaryExpressionContext* ctx) = 0;
+
+  virtual void enterLocationExpression(
+      TorqueParser::LocationExpressionContext* ctx) = 0;
+  virtual void exitLocationExpression(
+      TorqueParser::LocationExpressionContext* ctx) = 0;
+
+  virtual void enterIncrementDecrement(
+      TorqueParser::IncrementDecrementContext* ctx) = 0;
+  virtual void exitIncrementDecrement(
+      TorqueParser::IncrementDecrementContext* ctx) = 0;
+
+  virtual void enterAssignment(TorqueParser::AssignmentContext* ctx) = 0;
+  virtual void exitAssignment(TorqueParser::AssignmentContext* ctx) = 0;
+
+  virtual void enterAssignmentExpression(
+      TorqueParser::AssignmentExpressionContext* ctx) = 0;
+  virtual void exitAssignmentExpression(
+      TorqueParser::AssignmentExpressionContext* ctx) = 0;
+
+  virtual void enterPrimaryExpression(
+      TorqueParser::PrimaryExpressionContext* ctx) = 0;
+  virtual void exitPrimaryExpression(
+      TorqueParser::PrimaryExpressionContext* ctx) = 0;
+
+  virtual void enterForInitialization(
+      TorqueParser::ForInitializationContext* ctx) = 0;
+  virtual void exitForInitialization(
+      TorqueParser::ForInitializationContext* ctx) = 0;
+
+  virtual void enterForLoop(TorqueParser::ForLoopContext* ctx) = 0;
+  virtual void exitForLoop(TorqueParser::ForLoopContext* ctx) = 0;
+
+  virtual void enterRangeSpecifier(
+      TorqueParser::RangeSpecifierContext* ctx) = 0;
+  virtual void exitRangeSpecifier(TorqueParser::RangeSpecifierContext* ctx) = 0;
+
+  virtual void enterForOfRange(TorqueParser::ForOfRangeContext* ctx) = 0;
+  virtual void exitForOfRange(TorqueParser::ForOfRangeContext* ctx) = 0;
+
+  virtual void enterForOfLoop(TorqueParser::ForOfLoopContext* ctx) = 0;
+  virtual void exitForOfLoop(TorqueParser::ForOfLoopContext* ctx) = 0;
+
+  virtual void enterArgument(TorqueParser::ArgumentContext* ctx) = 0;
+  virtual void exitArgument(TorqueParser::ArgumentContext* ctx) = 0;
+
+  virtual void enterArgumentList(TorqueParser::ArgumentListContext* ctx) = 0;
+  virtual void exitArgumentList(TorqueParser::ArgumentListContext* ctx) = 0;
+
+  virtual void enterHelperCall(TorqueParser::HelperCallContext* ctx) = 0;
+  virtual void exitHelperCall(TorqueParser::HelperCallContext* ctx) = 0;
+
+  virtual void enterLabelReference(
+      TorqueParser::LabelReferenceContext* ctx) = 0;
+  virtual void exitLabelReference(TorqueParser::LabelReferenceContext* ctx) = 0;
+
+  virtual void enterVariableDeclaration(
+      TorqueParser::VariableDeclarationContext* ctx) = 0;
+  virtual void exitVariableDeclaration(
+      TorqueParser::VariableDeclarationContext* ctx) = 0;
+
+  virtual void enterVariableDeclarationWithInitialization(
+      TorqueParser::VariableDeclarationWithInitializationContext* ctx) = 0;
+  virtual void exitVariableDeclarationWithInitialization(
+      TorqueParser::VariableDeclarationWithInitializationContext* ctx) = 0;
+
+  virtual void enterHelperCallStatement(
+      TorqueParser::HelperCallStatementContext* ctx) = 0;
+  virtual void exitHelperCallStatement(
+      TorqueParser::HelperCallStatementContext* ctx) = 0;
+
+  virtual void enterExpressionStatement(
+      TorqueParser::ExpressionStatementContext* ctx) = 0;
+  virtual void exitExpressionStatement(
+      TorqueParser::ExpressionStatementContext* ctx) = 0;
+
+  virtual void enterIfStatement(TorqueParser::IfStatementContext* ctx) = 0;
+  virtual void exitIfStatement(TorqueParser::IfStatementContext* ctx) = 0;
+
+  virtual void enterWhileLoop(TorqueParser::WhileLoopContext* ctx) = 0;
+  virtual void exitWhileLoop(TorqueParser::WhileLoopContext* ctx) = 0;
+
+  virtual void enterReturnStatement(
+      TorqueParser::ReturnStatementContext* ctx) = 0;
+  virtual void exitReturnStatement(
+      TorqueParser::ReturnStatementContext* ctx) = 0;
+
+  virtual void enterBreakStatement(
+      TorqueParser::BreakStatementContext* ctx) = 0;
+  virtual void exitBreakStatement(TorqueParser::BreakStatementContext* ctx) = 0;
+
+  virtual void enterContinueStatement(
+      TorqueParser::ContinueStatementContext* ctx) = 0;
+  virtual void exitContinueStatement(
+      TorqueParser::ContinueStatementContext* ctx) = 0;
+
+  virtual void enterGotoStatement(TorqueParser::GotoStatementContext* ctx) = 0;
+  virtual void exitGotoStatement(TorqueParser::GotoStatementContext* ctx) = 0;
+
+  virtual void enterHandlerWithStatement(
+      TorqueParser::HandlerWithStatementContext* ctx) = 0;
+  virtual void exitHandlerWithStatement(
+      TorqueParser::HandlerWithStatementContext* ctx) = 0;
+
+  virtual void enterTryLabelStatement(
+      TorqueParser::TryLabelStatementContext* ctx) = 0;
+  virtual void exitTryLabelStatement(
+      TorqueParser::TryLabelStatementContext* ctx) = 0;
+
+  virtual void enterDiagnosticStatement(
+      TorqueParser::DiagnosticStatementContext* ctx) = 0;
+  virtual void exitDiagnosticStatement(
+      TorqueParser::DiagnosticStatementContext* ctx) = 0;
+
+  virtual void enterStatement(TorqueParser::StatementContext* ctx) = 0;
+  virtual void exitStatement(TorqueParser::StatementContext* ctx) = 0;
+
+  virtual void enterStatementList(TorqueParser::StatementListContext* ctx) = 0;
+  virtual void exitStatementList(TorqueParser::StatementListContext* ctx) = 0;
+
+  virtual void enterStatementScope(
+      TorqueParser::StatementScopeContext* ctx) = 0;
+  virtual void exitStatementScope(TorqueParser::StatementScopeContext* ctx) = 0;
+
+  virtual void enterStatementBlock(
+      TorqueParser::StatementBlockContext* ctx) = 0;
+  virtual void exitStatementBlock(TorqueParser::StatementBlockContext* ctx) = 0;
+
+  virtual void enterHelperBody(TorqueParser::HelperBodyContext* ctx) = 0;
+  virtual void exitHelperBody(TorqueParser::HelperBodyContext* ctx) = 0;
+
+  virtual void enterExtendsDeclaration(
+      TorqueParser::ExtendsDeclarationContext* ctx) = 0;
+  virtual void exitExtendsDeclaration(
+      TorqueParser::ExtendsDeclarationContext* ctx) = 0;
+
+  virtual void enterGeneratesDeclaration(
+      TorqueParser::GeneratesDeclarationContext* ctx) = 0;
+  virtual void exitGeneratesDeclaration(
+      TorqueParser::GeneratesDeclarationContext* ctx) = 0;
+
+  virtual void enterConstexprDeclaration(
+      TorqueParser::ConstexprDeclarationContext* ctx) = 0;
+  virtual void exitConstexprDeclaration(
+      TorqueParser::ConstexprDeclarationContext* ctx) = 0;
+
+  virtual void enterTypeDeclaration(
+      TorqueParser::TypeDeclarationContext* ctx) = 0;
+  virtual void exitTypeDeclaration(
+      TorqueParser::TypeDeclarationContext* ctx) = 0;
+
+  virtual void enterTypeAliasDeclaration(
+      TorqueParser::TypeAliasDeclarationContext* ctx) = 0;
+  virtual void exitTypeAliasDeclaration(
+      TorqueParser::TypeAliasDeclarationContext* ctx) = 0;
+
+  virtual void enterExternalBuiltin(
+      TorqueParser::ExternalBuiltinContext* ctx) = 0;
+  virtual void exitExternalBuiltin(
+      TorqueParser::ExternalBuiltinContext* ctx) = 0;
+
+  virtual void enterExternalMacro(TorqueParser::ExternalMacroContext* ctx) = 0;
+  virtual void exitExternalMacro(TorqueParser::ExternalMacroContext* ctx) = 0;
+
+  virtual void enterExternalRuntime(
+      TorqueParser::ExternalRuntimeContext* ctx) = 0;
+  virtual void exitExternalRuntime(
+      TorqueParser::ExternalRuntimeContext* ctx) = 0;
+
+  virtual void enterBuiltinDeclaration(
+      TorqueParser::BuiltinDeclarationContext* ctx) = 0;
+  virtual void exitBuiltinDeclaration(
+      TorqueParser::BuiltinDeclarationContext* ctx) = 0;
+
+  virtual void enterGenericSpecialization(
+      TorqueParser::GenericSpecializationContext* ctx) = 0;
+  virtual void exitGenericSpecialization(
+      TorqueParser::GenericSpecializationContext* ctx) = 0;
+
+  virtual void enterMacroDeclaration(
+      TorqueParser::MacroDeclarationContext* ctx) = 0;
+  virtual void exitMacroDeclaration(
+      TorqueParser::MacroDeclarationContext* ctx) = 0;
+
+  virtual void enterExternConstDeclaration(
+      TorqueParser::ExternConstDeclarationContext* ctx) = 0;
+  virtual void exitExternConstDeclaration(
+      TorqueParser::ExternConstDeclarationContext* ctx) = 0;
+
+  virtual void enterDeclaration(TorqueParser::DeclarationContext* ctx) = 0;
+  virtual void exitDeclaration(TorqueParser::DeclarationContext* ctx) = 0;
+
+  virtual void enterModuleDeclaration(
+      TorqueParser::ModuleDeclarationContext* ctx) = 0;
+  virtual void exitModuleDeclaration(
+      TorqueParser::ModuleDeclarationContext* ctx) = 0;
+
+  virtual void enterFile(TorqueParser::FileContext* ctx) = 0;
+  virtual void exitFile(TorqueParser::FileContext* ctx) = 0;
+};
+
+#endif  // V8_TORQUE_TORQUELISTENER_H_
diff --git a/deps/v8/src/torque/TorqueParser.cpp b/deps/v8/src/torque/TorqueParser.cpp
new file mode 100644
index 00000000000000..91c80af77fff5c
--- /dev/null
+++ b/deps/v8/src/torque/TorqueParser.cpp
@@ -0,0 +1,7731 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Generated from Torque.g4 by ANTLR 4.7.1
+
+#include "TorqueListener.h"
+#include "TorqueVisitor.h"
+
+#include "TorqueParser.h"
+
+using namespace antlrcpp;
+using namespace antlr4;
+
+TorqueParser::TorqueParser(TokenStream* input) : Parser(input) {
+  _interpreter = new atn::ParserATNSimulator(this, _atn, _decisionToDFA,
+                                             _sharedContextCache);
+}
+
+TorqueParser::~TorqueParser() { delete _interpreter; }
+
+std::string TorqueParser::getGrammarFileName() const { return "Torque.g4"; }
+
+const std::vector<std::string>& TorqueParser::getRuleNames() const {
+  return _ruleNames;
+}
+
+dfa::Vocabulary& TorqueParser::getVocabulary() const { return _vocabulary; }
+
+//----------------- TypeContext
+//------------------------------------------------------------------
+
+TorqueParser::TypeContext::TypeContext(ParserRuleContext* parent,
+                                       size_t invokingState)
+    : ParserRuleContext(parent, invokingState) {}
+
+tree::TerminalNode* TorqueParser::TypeContext::IDENTIFIER() {
+  return getToken(TorqueParser::IDENTIFIER, 0);
+}
+
+tree::TerminalNode* TorqueParser::TypeContext::CONSTEXPR() {
+  return getToken(TorqueParser::CONSTEXPR, 0);
+}
+
+tree::TerminalNode* TorqueParser::TypeContext::BUILTIN() {
+  return getToken(TorqueParser::BUILTIN, 0);
+}
+
+TorqueParser::TypeListContext* TorqueParser::TypeContext::typeList() {
+  return getRuleContext<TorqueParser::TypeListContext>(0);
+}
+
+std::vector<TorqueParser::TypeContext*> TorqueParser::TypeContext::type() {
+  return getRuleContexts<TorqueParser::TypeContext>();
+}
+
+TorqueParser::TypeContext* TorqueParser::TypeContext::type(size_t i) {
+  return getRuleContext<TorqueParser::TypeContext>(i);
+}
+
+tree::TerminalNode* TorqueParser::TypeContext::BIT_OR() {
+  return getToken(TorqueParser::BIT_OR, 0);
+}
+
+size_t TorqueParser::TypeContext::getRuleIndex() const {
+  return TorqueParser::RuleType;
+}
+
+void TorqueParser::TypeContext::enterRule(tree::ParseTreeListener* listener) {
+  auto parserListener = dynamic_cast<TorqueListener*>(listener);
+  if (parserListener != nullptr) parserListener->enterType(this);
+}
+
+void TorqueParser::TypeContext::exitRule(tree::ParseTreeListener* listener) {
+  auto parserListener = dynamic_cast<TorqueListener*>(listener);
+  if (parserListener != nullptr) parserListener->exitType(this);
+}
+
+antlrcpp::Any TorqueParser::TypeContext::accept(
+    tree::ParseTreeVisitor* visitor) {
+  if (auto parserVisitor = dynamic_cast<TorqueVisitor*>(visitor))
+    return parserVisitor->visitType(this);
+  else
+    return visitor->visitChildren(this);
+}
+
+TorqueParser::TypeContext* TorqueParser::type() { return type(0); }
+
+TorqueParser::TypeContext* TorqueParser::type(int precedence) {
+  ParserRuleContext* parentContext = _ctx;
+  size_t parentState = getState();
+  TorqueParser::TypeContext* _localctx =
+      _tracker.createInstance<TypeContext>(_ctx, parentState);
+  TorqueParser::TypeContext* previousContext = _localctx;
+  size_t startState = 0;
+  enterRecursionRule(_localctx, 0, TorqueParser::RuleType, precedence);
+
+  size_t _la = 0;
+
+  auto onExit = finally([=] { unrollRecursionContexts(parentContext); });
+  try {
+    size_t alt;
+    enterOuterAlt(_localctx, 1);
+    setState(156);
+    _errHandler->sync(this);
+    switch (_input->LA(1)) {
+      case TorqueParser::CONSTEXPR:
+      case TorqueParser::IDENTIFIER: {
+        setState(142);
+        _errHandler->sync(this);
+
+        _la = _input->LA(1);
+        if (_la == TorqueParser::CONSTEXPR) {
+          setState(141);
+          match(TorqueParser::CONSTEXPR);
+        }
+        setState(144);
+        match(TorqueParser::IDENTIFIER);
+        break;
+      }
+
+      case TorqueParser::BUILTIN: {
+        setState(145);
+        match(TorqueParser::BUILTIN);
+        setState(146);
+        match(TorqueParser::T__0);
+        setState(147);
+        typeList();
+        setState(148);
+        match(TorqueParser::T__1);
+        setState(149);
+        match(TorqueParser::T__2);
+        setState(150);
+        type(3);
+        break;
+      }
+
+      case TorqueParser::T__0: {
+        setState(152);
+        match(TorqueParser::T__0);
+        setState(153);
+        type(0);
+        setState(154);
+        match(TorqueParser::T__1);
+        break;
+      }
+
+      default:
+        throw NoViableAltException(this);
+    }
+    _ctx->stop = _input->LT(-1);
+    setState(163);
+    _errHandler->sync(this);
+    alt = getInterpreter<atn::ParserATNSimulator>()->adaptivePredict(_input, 2,
+                                                                     _ctx);
+    while (alt != 2 && alt != atn::ATN::INVALID_ALT_NUMBER) {
+      if (alt == 1) {
+        if (!_parseListeners.empty()) triggerExitRuleEvent();
+        previousContext = _localctx;
+        _localctx =
+            _tracker.createInstance<TypeContext>(parentContext, parentState);
+        pushNewRecursionContext(_localctx, startState, RuleType);
+        setState(158);
+
+        if (!(precpred(_ctx, 2)))
+          throw FailedPredicateException(this, "precpred(_ctx, 2)");
+        setState(159);
+        match(TorqueParser::BIT_OR);
+        setState(160);
+        type(3);
+      }
+      setState(165);
+      _errHandler->sync(this);
+      alt = getInterpreter<atn::ParserATNSimulator>()->adaptivePredict(_input,
+                                                                       2, _ctx);
+    }
+  } catch (RecognitionException& e) {
+    _errHandler->reportError(this, e);
+    _localctx->exception = std::current_exception();
+    _errHandler->recover(this, _localctx->exception);
+  }
+  return _localctx;
+}
+
+//----------------- TypeListContext
+//------------------------------------------------------------------
+
+TorqueParser::TypeListContext::TypeListContext(ParserRuleContext* parent,
+                                               size_t invokingState)
+    : ParserRuleContext(parent, invokingState) {}
+
+std::vector<TorqueParser::TypeContext*> TorqueParser::TypeListContext::type() {
+  return getRuleContexts<TorqueParser::TypeContext>();
+}
+
+TorqueParser::TypeContext* TorqueParser::TypeListContext::type(size_t i) {
+  return getRuleContext<TorqueParser::TypeContext>(i);
+}
+
+size_t TorqueParser::TypeListContext::getRuleIndex() const {
+  return TorqueParser::RuleTypeList;
+}
+
+void TorqueParser::TypeListContext::enterRule(
+    tree::ParseTreeListener* listener) {
+  auto parserListener = dynamic_cast<TorqueListener*>(listener);
+  if (parserListener != nullptr) parserListener->enterTypeList(this);
+}
+
+void TorqueParser::TypeListContext::exitRule(
+    tree::ParseTreeListener* listener) {
+  auto parserListener = dynamic_cast<TorqueListener*>(listener);
+  if (parserListener != nullptr) parserListener->exitTypeList(this);
+}
+
+antlrcpp::Any TorqueParser::TypeListContext::accept(
+    tree::ParseTreeVisitor* visitor) {
+  if (auto parserVisitor = dynamic_cast<TorqueVisitor*>(visitor))
+    return parserVisitor->visitTypeList(this);
+  else
+    return visitor->visitChildren(this);
+}
+
+TorqueParser::TypeListContext* TorqueParser::typeList() {
+  TypeListContext* _localctx =
+      _tracker.createInstance<TypeListContext>(_ctx, getState());
+  enterRule(_localctx, 2, TorqueParser::RuleTypeList);
+  size_t _la = 0;
+
+  auto onExit = finally([=] { exitRule(); });
+  try {
+    enterOuterAlt(_localctx, 1);
+    setState(174);
+    _errHandler->sync(this);
+
+    _la = _input->LA(1);
+    if ((((_la & ~0x3fULL) == 0) &&
+         ((1ULL << _la) &
+          ((1ULL << TorqueParser::T__0) | (1ULL << TorqueParser::BUILTIN) |
+           (1ULL << TorqueParser::CONSTEXPR))) != 0) ||
+        _la == TorqueParser::IDENTIFIER) {
+      setState(166);
+      type(0);
+      setState(171);
+      _errHandler->sync(this);
+      _la = _input->LA(1);
+      while (_la == TorqueParser::T__3) {
+        setState(167);
+        match(TorqueParser::T__3);
+        setState(168);
+        type(0);
+        setState(173);
+        _errHandler->sync(this);
+        _la = _input->LA(1);
+      }
+    }
+
+  } catch (RecognitionException& e) {
+    _errHandler->reportError(this, e);
+    _localctx->exception = std::current_exception();
+    _errHandler->recover(this, _localctx->exception);
+  }
+
+  return _localctx;
+}
+
+//----------------- GenericSpecializationTypeListContext
+//------------------------------------------------------------------
+
+TorqueParser::GenericSpecializationTypeListContext::
+    GenericSpecializationTypeListContext(ParserRuleContext* parent,
+                                         size_t invokingState)
+    : ParserRuleContext(parent, invokingState) {}
+
+TorqueParser::TypeListContext*
+TorqueParser::GenericSpecializationTypeListContext::typeList() {
+  return getRuleContext<TorqueParser::TypeListContext>(0);
+}
+
+size_t TorqueParser::GenericSpecializationTypeListContext::getRuleIndex()
+    const {
+  return TorqueParser::RuleGenericSpecializationTypeList;
+}
+
+void TorqueParser::GenericSpecializationTypeListContext::enterRule(
+    tree::ParseTreeListener* listener) {
+  auto parserListener = dynamic_cast<TorqueListener*>(listener);
+  if (parserListener != nullptr)
+    parserListener->enterGenericSpecializationTypeList(this);
+}
+
+void TorqueParser::GenericSpecializationTypeListContext::exitRule(
+    tree::ParseTreeListener* listener) {
+  auto parserListener = dynamic_cast<TorqueListener*>(listener);
+  if (parserListener != nullptr)
+    parserListener->exitGenericSpecializationTypeList(this);
+}
+
+antlrcpp::Any TorqueParser::GenericSpecializationTypeListContext::accept(
+    tree::ParseTreeVisitor* visitor) {
+  if (auto parserVisitor = dynamic_cast<TorqueVisitor*>(visitor))
+    return parserVisitor->visitGenericSpecializationTypeList(this);
+  else
+    return visitor->visitChildren(this);
+}
+
+TorqueParser::GenericSpecializationTypeListContext*
+TorqueParser::genericSpecializationTypeList() {
+  GenericSpecializationTypeListContext* _localctx =
+      _tracker.createInstance<GenericSpecializationTypeListContext>(_ctx,
+                                                                    getState());
+  enterRule(_localctx, 4, TorqueParser::RuleGenericSpecializationTypeList);
+
+  auto onExit = finally([=] { exitRule(); });
+  try {
+    enterOuterAlt(_localctx, 1);
+    setState(176);
+    match(TorqueParser::LESS_THAN);
+    setState(177);
+    typeList();
+    setState(178);
+    match(TorqueParser::GREATER_THAN);
+
+  } catch (RecognitionException& e) {
+    _errHandler->reportError(this, e);
+    _localctx->exception = std::current_exception();
+    _errHandler->recover(this, _localctx->exception);
+  }
+
+  return _localctx;
+}
+
+//----------------- OptionalGenericTypeListContext
+//------------------------------------------------------------------
+
+TorqueParser::OptionalGenericTypeListContext::OptionalGenericTypeListContext(
+    ParserRuleContext* parent, size_t invokingState)
+    : ParserRuleContext(parent, invokingState) {}
+
+std::vector<tree::TerminalNode*>
+TorqueParser::OptionalGenericTypeListContext::IDENTIFIER() {
+  return getTokens(TorqueParser::IDENTIFIER);
+}
+
+tree::TerminalNode* TorqueParser::OptionalGenericTypeListContext::IDENTIFIER(
+    size_t i) {
+  return getToken(TorqueParser::IDENTIFIER, i);
+}
+
+size_t TorqueParser::OptionalGenericTypeListContext::getRuleIndex() const {
+  return TorqueParser::RuleOptionalGenericTypeList;
+}
+
+void TorqueParser::OptionalGenericTypeListContext::enterRule(
+    tree::ParseTreeListener* listener) {
+  auto parserListener = dynamic_cast<TorqueListener*>(listener);
+  if (parserListener != nullptr)
+    parserListener->enterOptionalGenericTypeList(this);
+}
+
+void TorqueParser::OptionalGenericTypeListContext::exitRule(
+    tree::ParseTreeListener* listener) {
+  auto parserListener = dynamic_cast<TorqueListener*>(listener);
+  if (parserListener != nullptr)
+    parserListener->exitOptionalGenericTypeList(this);
+}
+
+antlrcpp::Any TorqueParser::OptionalGenericTypeListContext::accept(
+    tree::ParseTreeVisitor* visitor) {
+  if (auto parserVisitor = dynamic_cast<TorqueVisitor*>(visitor))
+    return parserVisitor->visitOptionalGenericTypeList(this);
+  else
+    return visitor->visitChildren(this);
+}
+
+TorqueParser::OptionalGenericTypeListContext*
+TorqueParser::optionalGenericTypeList() {
+  OptionalGenericTypeListContext* _localctx =
+      _tracker.createInstance<OptionalGenericTypeListContext>(_ctx, getState());
+  enterRule(_localctx, 6, TorqueParser::RuleOptionalGenericTypeList);
+  size_t _la = 0;
+
+  auto onExit = finally([=] { exitRule(); });
+  try {
+    enterOuterAlt(_localctx, 1);
+    setState(194);
+    _errHandler->sync(this);
+
+    _la = _input->LA(1);
+    if (_la == TorqueParser::LESS_THAN) {
+      setState(180);
+      match(TorqueParser::LESS_THAN);
+      setState(181);
+      match(TorqueParser::IDENTIFIER);
+      setState(182);
+      match(TorqueParser::T__4);
+      setState(183);
+      match(TorqueParser::T__5);
+      setState(190);
+      _errHandler->sync(this);
+      _la = _input->LA(1);
+      while (_la == TorqueParser::T__3) {
+        setState(184);
+        match(TorqueParser::T__3);
+        setState(185);
+        match(TorqueParser::IDENTIFIER);
+        setState(186);
+        match(TorqueParser::T__4);
+        setState(187);
+        match(TorqueParser::T__5);
+        setState(192);
+        _errHandler->sync(this);
+        _la = _input->LA(1);
+      }
+      setState(193);
+      match(TorqueParser::GREATER_THAN);
+    }
+
+  } catch (RecognitionException& e) {
+    _errHandler->reportError(this, e);
+    _localctx->exception = std::current_exception();
+    _errHandler->recover(this, _localctx->exception);
+  }
+
+  return _localctx;
+}
+
+//----------------- TypeListMaybeVarArgsContext
+//------------------------------------------------------------------
+
+TorqueParser::TypeListMaybeVarArgsContext::TypeListMaybeVarArgsContext(
+    ParserRuleContext* parent, size_t invokingState)
+    : ParserRuleContext(parent, invokingState) {}
+
+std::vector<TorqueParser::TypeContext*>
+TorqueParser::TypeListMaybeVarArgsContext::type() {
+  return getRuleContexts<TorqueParser::TypeContext>();
+}
+
+TorqueParser::TypeContext* TorqueParser::TypeListMaybeVarArgsContext::type(
+    size_t i) {
+  return getRuleContext<TorqueParser::TypeContext>(i);
+}
+
+tree::TerminalNode* TorqueParser::TypeListMaybeVarArgsContext::VARARGS() {
+  return getToken(TorqueParser::VARARGS, 0);
+}
+
+size_t TorqueParser::TypeListMaybeVarArgsContext::getRuleIndex() const {
+  return TorqueParser::RuleTypeListMaybeVarArgs;
+}
+
+void TorqueParser::TypeListMaybeVarArgsContext::enterRule(
+    tree::ParseTreeListener* listener) {
+  auto parserListener = dynamic_cast<TorqueListener*>(listener);
+  if (parserListener != nullptr)
+    parserListener->enterTypeListMaybeVarArgs(this);
+}
+
+void TorqueParser::TypeListMaybeVarArgsContext::exitRule(
+    tree::ParseTreeListener* listener) {
+  auto parserListener = dynamic_cast<TorqueListener*>(listener);
+  if (parserListener != nullptr) parserListener->exitTypeListMaybeVarArgs(this);
+}
+
+antlrcpp::Any TorqueParser::TypeListMaybeVarArgsContext::accept(
+    tree::ParseTreeVisitor* visitor) {
+  if (auto parserVisitor = dynamic_cast<TorqueVisitor*>(visitor))
+    return parserVisitor->visitTypeListMaybeVarArgs(this);
+  else
+    return visitor->visitChildren(this);
+}
+
+TorqueParser::TypeListMaybeVarArgsContext*
+TorqueParser::typeListMaybeVarArgs() {
+  TypeListMaybeVarArgsContext* _localctx =
+      _tracker.createInstance<TypeListMaybeVarArgsContext>(_ctx, getState());
+  enterRule(_localctx, 8, TorqueParser::RuleTypeListMaybeVarArgs);
+  size_t _la = 0;
+
+  auto onExit = finally([=] { exitRule(); });
+  try {
+    size_t alt;
+    setState(215);
+    _errHandler->sync(this);
+    switch (getInterpreter<atn::ParserATNSimulator>()->adaptivePredict(
+        _input, 10, _ctx)) {
+      case 1: {
+        enterOuterAlt(_localctx, 1);
+        setState(196);
+        match(TorqueParser::T__0);
+        setState(198);
+        _errHandler->sync(this);
+
+        _la = _input->LA(1);
+        if ((((_la & ~0x3fULL) == 0) &&
+             ((1ULL << _la) &
+              ((1ULL << TorqueParser::T__0) | (1ULL << TorqueParser::BUILTIN) |
+               (1ULL << TorqueParser::CONSTEXPR))) != 0) ||
+            _la == TorqueParser::IDENTIFIER) {
+          setState(197);
+          type(0);
+        }
+        setState(204);
+        _errHandler->sync(this);
+        alt = getInterpreter<atn::ParserATNSimulator>()->adaptivePredict(
+            _input, 8, _ctx);
+        while (alt != 2 && alt != atn::ATN::INVALID_ALT_NUMBER) {
+          if (alt == 1) {
+            setState(200);
+            match(TorqueParser::T__3);
+            setState(201);
+            type(0);
+          }
+          setState(206);
+          _errHandler->sync(this);
+          alt = getInterpreter<atn::ParserATNSimulator>()->adaptivePredict(
+              _input, 8, _ctx);
+        }
+        setState(209);
+        _errHandler->sync(this);
+
+        _la = _input->LA(1);
+        if (_la == TorqueParser::T__3) {
+          setState(207);
+          match(TorqueParser::T__3);
+          setState(208);
+          match(TorqueParser::VARARGS);
+        }
+        setState(211);
+        match(TorqueParser::T__1);
+        break;
+      }
+
+      case 2: {
+        enterOuterAlt(_localctx, 2);
+        setState(212);
+        match(TorqueParser::T__0);
+        setState(213);
+        match(TorqueParser::VARARGS);
+        setState(214);
+        match(TorqueParser::T__1);
+        break;
+      }
+    }
+
+  } catch (RecognitionException& e) {
+    _errHandler->reportError(this, e);
+    _localctx->exception = std::current_exception();
+    _errHandler->recover(this, _localctx->exception);
+  }
+
+  return _localctx;
+}
+
+//----------------- LabelParameterContext
+//------------------------------------------------------------------
+
+TorqueParser::LabelParameterContext::LabelParameterContext(
+    ParserRuleContext* parent, size_t invokingState)
+    : ParserRuleContext(parent, invokingState) {}
+
+tree::TerminalNode* TorqueParser::LabelParameterContext::IDENTIFIER() {
+  return getToken(TorqueParser::IDENTIFIER, 0);
+}
+
+TorqueParser::TypeListContext* TorqueParser::LabelParameterContext::typeList() {
+  return getRuleContext<TorqueParser::TypeListContext>(0);
+}
+
+size_t TorqueParser::LabelParameterContext::getRuleIndex() const {
+  return TorqueParser::RuleLabelParameter;
+}
+
+void TorqueParser::LabelParameterContext::enterRule(
+    tree::ParseTreeListener* listener) {
+  auto parserListener = dynamic_cast<TorqueListener*>(listener);
+  if (parserListener != nullptr) parserListener->enterLabelParameter(this);
+}
+
+void TorqueParser::LabelParameterContext::exitRule(
+    tree::ParseTreeListener* listener) {
+  auto parserListener = dynamic_cast<TorqueListener*>(listener);
+  if (parserListener != nullptr) parserListener->exitLabelParameter(this);
+}
+
+antlrcpp::Any TorqueParser::LabelParameterContext::accept(
+    tree::ParseTreeVisitor* visitor) {
+  if (auto parserVisitor = dynamic_cast<TorqueVisitor*>(visitor))
+    return parserVisitor->visitLabelParameter(this);
+  else
+    return visitor->visitChildren(this);
+}
+
+TorqueParser::LabelParameterContext* TorqueParser::labelParameter() {
+  LabelParameterContext* _localctx =
+      _tracker.createInstance<LabelParameterContext>(_ctx, getState());
+  enterRule(_localctx, 10, TorqueParser::RuleLabelParameter);
+  size_t _la = 0;
+
+  auto onExit = finally([=] { exitRule(); });
+  try {
+    enterOuterAlt(_localctx, 1);
+    setState(217);
+    match(TorqueParser::IDENTIFIER);
+    setState(222);
+    _errHandler->sync(this);
+
+    _la = _input->LA(1);
+    if (_la == TorqueParser::T__0) {
+      setState(218);
+      match(TorqueParser::T__0);
+      setState(219);
+      typeList();
+      setState(220);
+      match(TorqueParser::T__1);
+    }
+
+  } catch (RecognitionException& e) {
+    _errHandler->reportError(this, e);
+    _localctx->exception = std::current_exception();
+    _errHandler->recover(this, _localctx->exception);
+  }
+
+  return _localctx;
+}
+
+//----------------- OptionalTypeContext
+//------------------------------------------------------------------
+
+TorqueParser::OptionalTypeContext::OptionalTypeContext(
+    ParserRuleContext* parent, size_t invokingState)
+    : ParserRuleContext(parent, invokingState) {}
+
+TorqueParser::TypeContext* TorqueParser::OptionalTypeContext::type() {
+  return getRuleContext<TorqueParser::TypeContext>(0);
+}
+
+size_t TorqueParser::OptionalTypeContext::getRuleIndex() const {
+  return TorqueParser::RuleOptionalType;
+}
+
+void TorqueParser::OptionalTypeContext::enterRule(
+    tree::ParseTreeListener* listener) {
+  auto parserListener = dynamic_cast<TorqueListener*>(listener);
+  if (parserListener != nullptr) parserListener->enterOptionalType(this);
+}
+
+void TorqueParser::OptionalTypeContext::exitRule(
+    tree::ParseTreeListener* listener) {
+  auto parserListener = dynamic_cast<TorqueListener*>(listener);
+  if (parserListener != nullptr) parserListener->exitOptionalType(this);
+}
+
+antlrcpp::Any TorqueParser::OptionalTypeContext::accept(
+    tree::ParseTreeVisitor* visitor) {
+  if (auto parserVisitor = dynamic_cast<TorqueVisitor*>(visitor))
+    return parserVisitor->visitOptionalType(this);
+  else
+    return visitor->visitChildren(this);
+}
+
+TorqueParser::OptionalTypeContext* TorqueParser::optionalType() {
+  OptionalTypeContext* _localctx =
+      _tracker.createInstance<OptionalTypeContext>(_ctx, getState());
+  enterRule(_localctx, 12, TorqueParser::RuleOptionalType);
+  size_t _la = 0;
+
+  auto onExit = finally([=] { exitRule(); });
+  try {
+    enterOuterAlt(_localctx, 1);
+    setState(226);
+    _errHandler->sync(this);
+
+    _la = _input->LA(1);
+    if (_la == TorqueParser::T__4) {
+      setState(224);
+      match(TorqueParser::T__4);
+      setState(225);
+      type(0);
+    }
+
+  } catch (RecognitionException& e) {
+    _errHandler->reportError(this, e);
+    _localctx->exception = std::current_exception();
+    _errHandler->recover(this, _localctx->exception);
+  }
+
+  return _localctx;
+}
+
+//----------------- OptionalLabelListContext
+//------------------------------------------------------------------
+
+TorqueParser::OptionalLabelListContext::OptionalLabelListContext(
+    ParserRuleContext* parent, size_t invokingState)
+    : ParserRuleContext(parent, invokingState) {}
+
+tree::TerminalNode* TorqueParser::OptionalLabelListContext::LABELS() {
+  return getToken(TorqueParser::LABELS, 0);
+}
+
+std::vector<TorqueParser::LabelParameterContext*>
+TorqueParser::OptionalLabelListContext::labelParameter() {
+  return getRuleContexts<TorqueParser::LabelParameterContext>();
+}
+
+TorqueParser::LabelParameterContext*
+TorqueParser::OptionalLabelListContext::labelParameter(size_t i) {
+  return getRuleContext<TorqueParser::LabelParameterContext>(i);
+}
+
+size_t TorqueParser::OptionalLabelListContext::getRuleIndex() const {
+  return TorqueParser::RuleOptionalLabelList;
+}
+
+void TorqueParser::OptionalLabelListContext::enterRule(
+    tree::ParseTreeListener* listener) {
+  auto parserListener = dynamic_cast<TorqueListener*>(listener);
+  if (parserListener != nullptr) parserListener->enterOptionalLabelList(this);
+}
+
+void TorqueParser::OptionalLabelListContext::exitRule(
+    tree::ParseTreeListener* listener) {
+  auto parserListener = dynamic_cast<TorqueListener*>(listener);
+  if (parserListener != nullptr) parserListener->exitOptionalLabelList(this);
+}
+
+antlrcpp::Any TorqueParser::OptionalLabelListContext::accept(
+    tree::ParseTreeVisitor* visitor) {
+  if (auto parserVisitor = dynamic_cast<TorqueVisitor*>(visitor))
+    return parserVisitor->visitOptionalLabelList(this);
+  else
+    return visitor->visitChildren(this);
+}
+
+TorqueParser::OptionalLabelListContext* TorqueParser::optionalLabelList() {
+  OptionalLabelListContext* _localctx =
+      _tracker.createInstance<OptionalLabelListContext>(_ctx, getState());
+  enterRule(_localctx, 14, TorqueParser::RuleOptionalLabelList);
+  size_t _la = 0;
+
+  auto onExit = finally([=] { exitRule(); });
+  try {
+    enterOuterAlt(_localctx, 1);
+    setState(237);
+    _errHandler->sync(this);
+
+    _la = _input->LA(1);
+    if (_la == TorqueParser::LABELS) {
+      setState(228);
+      match(TorqueParser::LABELS);
+      setState(229);
+      labelParameter();
+      setState(234);
+      _errHandler->sync(this);
+      _la = _input->LA(1);
+      while (_la == TorqueParser::T__3) {
+        setState(230);
+        match(TorqueParser::T__3);
+        setState(231);
+        labelParameter();
+        setState(236);
+        _errHandler->sync(this);
+        _la = _input->LA(1);
+      }
+    }
+
+  } catch (RecognitionException& e) {
+    _errHandler->reportError(this, e);
+    _localctx->exception = std::current_exception();
+    _errHandler->recover(this, _localctx->exception);
+  }
+
+  return _localctx;
+}
+
+//----------------- OptionalOtherwiseContext
+//------------------------------------------------------------------
+
+TorqueParser::OptionalOtherwiseContext::OptionalOtherwiseContext(
+    ParserRuleContext* parent, size_t invokingState)
+    : ParserRuleContext(parent, invokingState) {}
+
+tree::TerminalNode* TorqueParser::OptionalOtherwiseContext::OTHERWISE() {
+  return getToken(TorqueParser::OTHERWISE, 0);
+}
+
+std::vector<tree::TerminalNode*>
+TorqueParser::OptionalOtherwiseContext::IDENTIFIER() {
+  return getTokens(TorqueParser::IDENTIFIER);
+}
+
+tree::TerminalNode* TorqueParser::OptionalOtherwiseContext::IDENTIFIER(
+    size_t i) {
+  return getToken(TorqueParser::IDENTIFIER, i);
+}
+
+size_t TorqueParser::OptionalOtherwiseContext::getRuleIndex() const {
+  return TorqueParser::RuleOptionalOtherwise;
+}
+
+void TorqueParser::OptionalOtherwiseContext::enterRule(
+    tree::ParseTreeListener* listener) {
+  auto parserListener = dynamic_cast<TorqueListener*>(listener);
+  if (parserListener != nullptr) parserListener->enterOptionalOtherwise(this);
+}
+
+void TorqueParser::OptionalOtherwiseContext::exitRule(
+    tree::ParseTreeListener* listener) {
+  auto parserListener = dynamic_cast<TorqueListener*>(listener);
+  if (parserListener != nullptr) parserListener->exitOptionalOtherwise(this);
+}
+
+antlrcpp::Any TorqueParser::OptionalOtherwiseContext::accept(
+    tree::ParseTreeVisitor* visitor) {
+  if (auto parserVisitor = dynamic_cast<TorqueVisitor*>(visitor))
+    return parserVisitor->visitOptionalOtherwise(this);
+  else
+    return visitor->visitChildren(this);
+}
+
+TorqueParser::OptionalOtherwiseContext* TorqueParser::optionalOtherwise() {
+  OptionalOtherwiseContext* _localctx =
+      _tracker.createInstance<OptionalOtherwiseContext>(_ctx, getState());
+  enterRule(_localctx, 16, TorqueParser::RuleOptionalOtherwise);
+
+  auto onExit = finally([=] { exitRule(); });
+  try {
+    size_t alt;
+    enterOuterAlt(_localctx, 1);
+    setState(248);
+    _errHandler->sync(this);
+
+    switch (getInterpreter<atn::ParserATNSimulator>()->adaptivePredict(
+        _input, 16, _ctx)) {
+      case 1: {
+        setState(239);
+        match(TorqueParser::OTHERWISE);
+        setState(240);
+        match(TorqueParser::IDENTIFIER);
+        setState(245);
+        _errHandler->sync(this);
+        alt = getInterpreter<atn::ParserATNSimulator>()->adaptivePredict(
+            _input, 15, _ctx);
+        while (alt != 2 && alt != atn::ATN::INVALID_ALT_NUMBER) {
+          if (alt == 1) {
+            setState(241);
+            match(TorqueParser::T__3);
+            setState(242);
+            match(TorqueParser::IDENTIFIER);
+          }
+          setState(247);
+          _errHandler->sync(this);
+          alt = getInterpreter<atn::ParserATNSimulator>()->adaptivePredict(
+              _input, 15, _ctx);
+        }
+        break;
+      }
+    }
+
+  } catch (RecognitionException& e) {
+    _errHandler->reportError(this, e);
+    _localctx->exception = std::current_exception();
+    _errHandler->recover(this, _localctx->exception);
+  }
+
+  return _localctx;
+}
+
+//----------------- ParameterContext
+//------------------------------------------------------------------
+
+TorqueParser::ParameterContext::ParameterContext(ParserRuleContext* parent,
+                                                 size_t invokingState)
+    : ParserRuleContext(parent, invokingState) {}
+
+tree::TerminalNode* TorqueParser::ParameterContext::IDENTIFIER() {
+  return getToken(TorqueParser::IDENTIFIER, 0);
+}
+
+TorqueParser::TypeContext* TorqueParser::ParameterContext::type() {
+  return getRuleContext<TorqueParser::TypeContext>(0);
+}
+
+size_t TorqueParser::ParameterContext::getRuleIndex() const {
+  return TorqueParser::RuleParameter;
+}
+
+void TorqueParser::ParameterContext::enterRule(
+    tree::ParseTreeListener* listener) {
+  auto parserListener = dynamic_cast<TorqueListener*>(listener);
+  if (parserListener != nullptr) parserListener->enterParameter(this);
+}
+
+void TorqueParser::ParameterContext::exitRule(
+    tree::ParseTreeListener* listener) {
+  auto parserListener = dynamic_cast<TorqueListener*>(listener);
+  if (parserListener != nullptr) parserListener->exitParameter(this);
+}
+
+antlrcpp::Any TorqueParser::ParameterContext::accept(
+    tree::ParseTreeVisitor* visitor) {
+  if (auto parserVisitor = dynamic_cast<TorqueVisitor*>(visitor))
+    return parserVisitor->visitParameter(this);
+  else
+    return visitor->visitChildren(this);
+}
+
+TorqueParser::ParameterContext* TorqueParser::parameter() {
+  ParameterContext* _localctx =
+      _tracker.createInstance<ParameterContext>(_ctx, getState());
+  enterRule(_localctx, 18, TorqueParser::RuleParameter);
+  size_t _la = 0;
+
+  auto onExit = finally([=] { exitRule(); });
+  try {
+    enterOuterAlt(_localctx, 1);
+    setState(250);
+    match(TorqueParser::IDENTIFIER);
+    setState(251);
+    match(TorqueParser::T__4);
+    setState(253);
+    _errHandler->sync(this);
+
+    _la = _input->LA(1);
+    if ((((_la & ~0x3fULL) == 0) &&
+         ((1ULL << _la) &
+          ((1ULL << TorqueParser::T__0) | (1ULL << TorqueParser::BUILTIN) |
+           (1ULL << TorqueParser::CONSTEXPR))) != 0) ||
+        _la == TorqueParser::IDENTIFIER) {
+      setState(252);
+      type(0);
+    }
+
+  } catch (RecognitionException& e) {
+    _errHandler->reportError(this, e);
+    _localctx->exception = std::current_exception();
+    _errHandler->recover(this, _localctx->exception);
+  }
+
+  return _localctx;
+}
+
+//----------------- ParameterListContext
+//------------------------------------------------------------------
+
+TorqueParser::ParameterListContext::ParameterListContext(
+    ParserRuleContext* parent, size_t invokingState)
+    : ParserRuleContext(parent, invokingState) {}
+
+std::vector<TorqueParser::ParameterContext*>
+TorqueParser::ParameterListContext::parameter() {
+  return getRuleContexts<TorqueParser::ParameterContext>();
+}
+
+TorqueParser::ParameterContext* TorqueParser::ParameterListContext::parameter(
+    size_t i) {
+  return getRuleContext<TorqueParser::ParameterContext>(i);
+}
+
+tree::TerminalNode* TorqueParser::ParameterListContext::VARARGS() {
+  return getToken(TorqueParser::VARARGS, 0);
+}
+
+tree::TerminalNode* TorqueParser::ParameterListContext::IDENTIFIER() {
+  return getToken(TorqueParser::IDENTIFIER, 0);
+}
+
+size_t TorqueParser::ParameterListContext::getRuleIndex() const {
+  return TorqueParser::RuleParameterList;
+}
+
+void TorqueParser::ParameterListContext::enterRule(
+    tree::ParseTreeListener* listener) {
+  auto parserListener = dynamic_cast<TorqueListener*>(listener);
+  if (parserListener != nullptr) parserListener->enterParameterList(this);
+}
+
+void TorqueParser::ParameterListContext::exitRule(
+    tree::ParseTreeListener* listener) {
+  auto parserListener = dynamic_cast<TorqueListener*>(listener);
+  if (parserListener != nullptr) parserListener->exitParameterList(this);
+}
+
+antlrcpp::Any TorqueParser::ParameterListContext::accept(
+    tree::ParseTreeVisitor* visitor) {
+  if (auto parserVisitor = dynamic_cast<TorqueVisitor*>(visitor))
+    return parserVisitor->visitParameterList(this);
+  else
+    return visitor->visitChildren(this);
+}
+
+TorqueParser::ParameterListContext* TorqueParser::parameterList() {
+  ParameterListContext* _localctx =
+      _tracker.createInstance<ParameterListContext>(_ctx, getState());
+  enterRule(_localctx, 20, TorqueParser::RuleParameterList);
+  size_t _la = 0;
+
+  auto onExit = finally([=] { exitRule(); });
+  try {
+    setState(276);
+    _errHandler->sync(this);
+    switch (getInterpreter<atn::ParserATNSimulator>()->adaptivePredict(
+        _input, 20, _ctx)) {
+      case 1: {
+        enterOuterAlt(_localctx, 1);
+        setState(255);
+        match(TorqueParser::T__0);
+        setState(257);
+        _errHandler->sync(this);
+
+        _la = _input->LA(1);
+        if (_la == TorqueParser::IDENTIFIER) {
+          setState(256);
+          parameter();
+        }
+        setState(263);
+        _errHandler->sync(this);
+        _la = _input->LA(1);
+        while (_la == TorqueParser::T__3) {
+          setState(259);
+          match(TorqueParser::T__3);
+          setState(260);
+          parameter();
+          setState(265);
+          _errHandler->sync(this);
+          _la = _input->LA(1);
+        }
+        setState(266);
+        match(TorqueParser::T__1);
+        break;
+      }
+
+      case 2: {
+        enterOuterAlt(_localctx, 2);
+        setState(267);
+        match(TorqueParser::T__0);
+        setState(268);
+        parameter();
+        setState(269);
+        match(TorqueParser::T__3);
+        setState(270);
+        parameter();
+        setState(271);
+        match(TorqueParser::T__3);
+        setState(272);
+        match(TorqueParser::VARARGS);
+        setState(273);
+        match(TorqueParser::IDENTIFIER);
+        setState(274);
+        match(TorqueParser::T__1);
+        break;
+      }
+    }
+
+  } catch (RecognitionException& e) {
+    _errHandler->reportError(this, e);
+    _localctx->exception = std::current_exception();
+    _errHandler->recover(this, _localctx->exception);
+  }
+
+  return _localctx;
+}
+
+//----------------- LabelDeclarationContext
+//------------------------------------------------------------------
+
+TorqueParser::LabelDeclarationContext::LabelDeclarationContext(
+    ParserRuleContext* parent, size_t invokingState)
+    : ParserRuleContext(parent, invokingState) {}
+
+tree::TerminalNode* TorqueParser::LabelDeclarationContext::IDENTIFIER() {
+  return getToken(TorqueParser::IDENTIFIER, 0);
+}
+
+TorqueParser::ParameterListContext*
+TorqueParser::LabelDeclarationContext::parameterList() {
+  return getRuleContext<TorqueParser::ParameterListContext>(0);
+}
+
+size_t TorqueParser::LabelDeclarationContext::getRuleIndex() const {
+  return TorqueParser::RuleLabelDeclaration;
+}
+
+void TorqueParser::LabelDeclarationContext::enterRule(
+    tree::ParseTreeListener* listener) {
+  auto parserListener = dynamic_cast<TorqueListener*>(listener);
+  if (parserListener != nullptr) parserListener->enterLabelDeclaration(this);
+}
+
+void TorqueParser::LabelDeclarationContext::exitRule(
+    tree::ParseTreeListener* listener) {
+  auto parserListener = dynamic_cast<TorqueListener*>(listener);
+  if (parserListener != nullptr) parserListener->exitLabelDeclaration(this);
+}
+
+antlrcpp::Any TorqueParser::LabelDeclarationContext::accept(
+    tree::ParseTreeVisitor* visitor) {
+  if (auto parserVisitor = dynamic_cast<TorqueVisitor*>(visitor))
+    return parserVisitor->visitLabelDeclaration(this);
+  else
+    return visitor->visitChildren(this);
+}
+
+TorqueParser::LabelDeclarationContext* TorqueParser::labelDeclaration() {
+  LabelDeclarationContext* _localctx =
+      _tracker.createInstance<LabelDeclarationContext>(_ctx, getState());
+  enterRule(_localctx, 22, TorqueParser::RuleLabelDeclaration);
+  size_t _la = 0;
+
+  auto onExit = finally([=] { exitRule(); });
+  try {
+    enterOuterAlt(_localctx, 1);
+    setState(278);
+    match(TorqueParser::IDENTIFIER);
+    setState(280);
+    _errHandler->sync(this);
+
+    _la = _input->LA(1);
+    if (_la == TorqueParser::T__0) {
+      setState(279);
+      parameterList();
+    }
+
+  } catch (RecognitionException& e) {
+    _errHandler->reportError(this, e);
+    _localctx->exception = std::current_exception();
+    _errHandler->recover(this, _localctx->exception);
+  }
+
+  return _localctx;
+}
+
+//----------------- ExpressionContext
+//------------------------------------------------------------------
+
+TorqueParser::ExpressionContext::ExpressionContext(ParserRuleContext* parent,
+                                                   size_t invokingState)
+    : ParserRuleContext(parent, invokingState) {}
+
+TorqueParser::ConditionalExpressionContext*
+TorqueParser::ExpressionContext::conditionalExpression() {
+  return getRuleContext<TorqueParser::ConditionalExpressionContext>(0);
+}
+
+size_t TorqueParser::ExpressionContext::getRuleIndex() const {
+  return TorqueParser::RuleExpression;
+}
+
+void TorqueParser::ExpressionContext::enterRule(
+    tree::ParseTreeListener* listener) {
+  auto parserListener = dynamic_cast<TorqueListener*>(listener);
+  if (parserListener != nullptr) parserListener->enterExpression(this);
+}
+
+void TorqueParser::ExpressionContext::exitRule(
+    tree::ParseTreeListener* listener) {
+  auto parserListener = dynamic_cast<TorqueListener*>(listener);
+  if (parserListener != nullptr) parserListener->exitExpression(this);
+}
+
+antlrcpp::Any TorqueParser::ExpressionContext::accept(
+    tree::ParseTreeVisitor* visitor) {
+  if (auto parserVisitor = dynamic_cast<TorqueVisitor*>(visitor))
+    return parserVisitor->visitExpression(this);
+  else
+    return visitor->visitChildren(this);
+}
+
+TorqueParser::ExpressionContext* TorqueParser::expression() {
+  ExpressionContext* _localctx =
+      _tracker.createInstance<ExpressionContext>(_ctx, getState());
+  enterRule(_localctx, 24, TorqueParser::RuleExpression);
+
+  auto onExit = finally([=] { exitRule(); });
+  try {
+    enterOuterAlt(_localctx, 1);
+    setState(282);
+    conditionalExpression(0);
+
+  } catch (RecognitionException& e) {
+    _errHandler->reportError(this, e);
+    _localctx->exception = std::current_exception();
+    _errHandler->recover(this, _localctx->exception);
+  }
+
+  return _localctx;
+}
+
+//----------------- ConditionalExpressionContext
+//------------------------------------------------------------------
+
+TorqueParser::ConditionalExpressionContext::ConditionalExpressionContext(
+    ParserRuleContext* parent, size_t invokingState)
+    : ParserRuleContext(parent, invokingState) {}
+
+std::vector<TorqueParser::LogicalORExpressionContext*>
+TorqueParser::ConditionalExpressionContext::logicalORExpression() {
+  return getRuleContexts<TorqueParser::LogicalORExpressionContext>();
+}
+
+TorqueParser::LogicalORExpressionContext*
+TorqueParser::ConditionalExpressionContext::logicalORExpression(size_t i) {
+  return getRuleContext<TorqueParser::LogicalORExpressionContext>(i);
+}
+
+TorqueParser::ConditionalExpressionContext*
+TorqueParser::ConditionalExpressionContext::conditionalExpression() {
+  return getRuleContext<TorqueParser::ConditionalExpressionContext>(0);
+}
+
+size_t TorqueParser::ConditionalExpressionContext::getRuleIndex() const {
+  return TorqueParser::RuleConditionalExpression;
+}
+
+void TorqueParser::ConditionalExpressionContext::enterRule(
+    tree::ParseTreeListener* listener) {
+  auto parserListener = dynamic_cast<TorqueListener*>(listener);
+  if (parserListener != nullptr)
+    parserListener->enterConditionalExpression(this);
+}
+
+void TorqueParser::ConditionalExpressionContext::exitRule(
+    tree::ParseTreeListener* listener) {
+  auto parserListener = dynamic_cast<TorqueListener*>(listener);
+  if (parserListener != nullptr)
+    parserListener->exitConditionalExpression(this);
+}
+
+antlrcpp::Any TorqueParser::ConditionalExpressionContext::accept(
+    tree::ParseTreeVisitor* visitor) {
+  if (auto parserVisitor = dynamic_cast<TorqueVisitor*>(visitor))
+    return parserVisitor->visitConditionalExpression(this);
+  else
+    return visitor->visitChildren(this);
+}
+
+TorqueParser::ConditionalExpressionContext*
+TorqueParser::conditionalExpression() {
+  return conditionalExpression(0);
+}
+
+TorqueParser::ConditionalExpressionContext* TorqueParser::conditionalExpression(
+    int precedence) {
+  ParserRuleContext* parentContext = _ctx;
+  size_t parentState = getState();
+  TorqueParser::ConditionalExpressionContext* _localctx =
+      _tracker.createInstance<ConditionalExpressionContext>(_ctx, parentState);
+  TorqueParser::ConditionalExpressionContext* previousContext = _localctx;
+  size_t startState = 26;
+  enterRecursionRule(_localctx, 26, TorqueParser::RuleConditionalExpression,
+                     precedence);
+
+  auto onExit = finally([=] { unrollRecursionContexts(parentContext); });
+  try {
+    size_t alt;
+    enterOuterAlt(_localctx, 1);
+    setState(285);
+    logicalORExpression(0);
+    _ctx->stop = _input->LT(-1);
+    setState(295);
+    _errHandler->sync(this);
+    alt = getInterpreter<atn::ParserATNSimulator>()->adaptivePredict(_input, 22,
+                                                                     _ctx);
+    while (alt != 2 && alt != atn::ATN::INVALID_ALT_NUMBER) {
+      if (alt == 1) {
+        if (!_parseListeners.empty()) triggerExitRuleEvent();
+        previousContext = _localctx;
+        _localctx = _tracker.createInstance<ConditionalExpressionContext>(
+            parentContext, parentState);
+        pushNewRecursionContext(_localctx, startState,
+                                RuleConditionalExpression);
+        setState(287);
+
+        if (!(precpred(_ctx, 1)))
+          throw FailedPredicateException(this, "precpred(_ctx, 1)");
+        setState(288);
+        match(TorqueParser::T__6);
+        setState(289);
+        logicalORExpression(0);
+        setState(290);
+        match(TorqueParser::T__4);
+        setState(291);
+        logicalORExpression(0);
+      }
+      setState(297);
+      _errHandler->sync(this);
+      alt = getInterpreter<atn::ParserATNSimulator>()->adaptivePredict(
+          _input, 22, _ctx);
+    }
+  } catch (RecognitionException& e) {
+    _errHandler->reportError(this, e);
+    _localctx->exception = std::current_exception();
+    _errHandler->recover(this, _localctx->exception);
+  }
+  return _localctx;
+}
+
+//----------------- LogicalORExpressionContext
+//------------------------------------------------------------------
+
+TorqueParser::LogicalORExpressionContext::LogicalORExpressionContext(
+    ParserRuleContext* parent, size_t invokingState)
+    : ParserRuleContext(parent, invokingState) {}
+
+TorqueParser::LogicalANDExpressionContext*
+TorqueParser::LogicalORExpressionContext::logicalANDExpression() {
+  return getRuleContext<TorqueParser::LogicalANDExpressionContext>(0);
+}
+
+TorqueParser::LogicalORExpressionContext*
+TorqueParser::LogicalORExpressionContext::logicalORExpression() {
+  return getRuleContext<TorqueParser::LogicalORExpressionContext>(0);
+}
+
+size_t TorqueParser::LogicalORExpressionContext::getRuleIndex() const {
+  return TorqueParser::RuleLogicalORExpression;
+}
+
+void TorqueParser::LogicalORExpressionContext::enterRule(
+    tree::ParseTreeListener* listener) {
+  auto parserListener = dynamic_cast<TorqueListener*>(listener);
+  if (parserListener != nullptr) parserListener->enterLogicalORExpression(this);
+}
+
+void TorqueParser::LogicalORExpressionContext::exitRule(
+    tree::ParseTreeListener* listener) {
+  auto parserListener = dynamic_cast<TorqueListener*>(listener);
+  if (parserListener != nullptr) parserListener->exitLogicalORExpression(this);
+}
+
+antlrcpp::Any TorqueParser::LogicalORExpressionContext::accept(
+    tree::ParseTreeVisitor* visitor) {
+  if (auto parserVisitor = dynamic_cast<TorqueVisitor*>(visitor))
+    return parserVisitor->visitLogicalORExpression(this);
+  else
+    return visitor->visitChildren(this);
+}
+
+TorqueParser::LogicalORExpressionContext* TorqueParser::logicalORExpression() {
+  return logicalORExpression(0);
+}
+
+TorqueParser::LogicalORExpressionContext* TorqueParser::logicalORExpression(
+    int precedence) {
+  ParserRuleContext* parentContext = _ctx;
+  size_t parentState = getState();
+  TorqueParser::LogicalORExpressionContext* _localctx =
+      _tracker.createInstance<LogicalORExpressionContext>(_ctx, parentState);
+  TorqueParser::LogicalORExpressionContext* previousContext = _localctx;
+  size_t startState = 28;
+  enterRecursionRule(_localctx, 28, TorqueParser::RuleLogicalORExpression,
+                     precedence);
+
+  auto onExit = finally([=] { unrollRecursionContexts(parentContext); });
+  try {
+    size_t alt;
+    enterOuterAlt(_localctx, 1);
+    setState(299);
+    logicalANDExpression(0);
+    _ctx->stop = _input->LT(-1);
+    setState(306);
+    _errHandler->sync(this);
+    alt = getInterpreter<atn::ParserATNSimulator>()->adaptivePredict(_input, 23,
+                                                                     _ctx);
+    while (alt != 2 && alt != atn::ATN::INVALID_ALT_NUMBER) {
+      if (alt == 1) {
+        if (!_parseListeners.empty()) triggerExitRuleEvent();
+        previousContext = _localctx;
+        _localctx = _tracker.createInstance<LogicalORExpressionContext>(
+            parentContext, parentState);
+        pushNewRecursionContext(_localctx, startState, RuleLogicalORExpression);
+        setState(301);
+
+        if (!(precpred(_ctx, 1)))
+          throw FailedPredicateException(this, "precpred(_ctx, 1)");
+        setState(302);
+        match(TorqueParser::T__7);
+        setState(303);
+        logicalANDExpression(0);
+      }
+      setState(308);
+      _errHandler->sync(this);
+      alt = getInterpreter<atn::ParserATNSimulator>()->adaptivePredict(
+          _input, 23, _ctx);
+    }
+  } catch (RecognitionException& e) {
+    _errHandler->reportError(this, e);
+    _localctx->exception = std::current_exception();
+    _errHandler->recover(this, _localctx->exception);
+  }
+  return _localctx;
+}
+
+//----------------- LogicalANDExpressionContext
+//------------------------------------------------------------------
+
+TorqueParser::LogicalANDExpressionContext::LogicalANDExpressionContext(
+    ParserRuleContext* parent, size_t invokingState)
+    : ParserRuleContext(parent, invokingState) {}
+
+TorqueParser::BitwiseExpressionContext*
+TorqueParser::LogicalANDExpressionContext::bitwiseExpression() {
+  return getRuleContext<TorqueParser::BitwiseExpressionContext>(0);
+}
+
+TorqueParser::LogicalANDExpressionContext*
+TorqueParser::LogicalANDExpressionContext::logicalANDExpression() {
+  return getRuleContext<TorqueParser::LogicalANDExpressionContext>(0);
+}
+
+size_t TorqueParser::LogicalANDExpressionContext::getRuleIndex() const {
+  return TorqueParser::RuleLogicalANDExpression;
+}
+
+void TorqueParser::LogicalANDExpressionContext::enterRule(
+    tree::ParseTreeListener* listener) {
+  auto parserListener = dynamic_cast<TorqueListener*>(listener);
+  if (parserListener != nullptr)
+    parserListener->enterLogicalANDExpression(this);
+}
+
+void TorqueParser::LogicalANDExpressionContext::exitRule(
+    tree::ParseTreeListener* listener) {
+  auto parserListener = dynamic_cast<TorqueListener*>(listener);
+  if (parserListener != nullptr) parserListener->exitLogicalANDExpression(this);
+}
+
+antlrcpp::Any TorqueParser::LogicalANDExpressionContext::accept(
+    tree::ParseTreeVisitor* visitor) {
+  if (auto parserVisitor = dynamic_cast<TorqueVisitor*>(visitor))
+    return parserVisitor->visitLogicalANDExpression(this);
+  else
+    return visitor->visitChildren(this);
+}
+
+TorqueParser::LogicalANDExpressionContext*
+TorqueParser::logicalANDExpression() {
+  return logicalANDExpression(0);
+}
+
+TorqueParser::LogicalANDExpressionContext* TorqueParser::logicalANDExpression(
+    int precedence) {
+  ParserRuleContext* parentContext = _ctx;
+  size_t parentState = getState();
+  TorqueParser::LogicalANDExpressionContext* _localctx =
+      _tracker.createInstance<LogicalANDExpressionContext>(_ctx, parentState);
+  TorqueParser::LogicalANDExpressionContext* previousContext = _localctx;
+  size_t startState = 30;
+  enterRecursionRule(_localctx, 30, TorqueParser::RuleLogicalANDExpression,
+                     precedence);
+
+  auto onExit = finally([=] { unrollRecursionContexts(parentContext); });
+  try {
+    size_t alt;
+    enterOuterAlt(_localctx, 1);
+    setState(310);
+    bitwiseExpression(0);
+    _ctx->stop = _input->LT(-1);
+    setState(317);
+    _errHandler->sync(this);
+    alt = getInterpreter<atn::ParserATNSimulator>()->adaptivePredict(_input, 24,
+                                                                     _ctx);
+    while (alt != 2 && alt != atn::ATN::INVALID_ALT_NUMBER) {
+      if (alt == 1) {
+        if (!_parseListeners.empty()) triggerExitRuleEvent();
+        previousContext = _localctx;
+        _localctx = _tracker.createInstance<LogicalANDExpressionContext>(
+            parentContext, parentState);
+        pushNewRecursionContext(_localctx, startState,
+                                RuleLogicalANDExpression);
+        setState(312);
+
+        if (!(precpred(_ctx, 1)))
+          throw FailedPredicateException(this, "precpred(_ctx, 1)");
+        setState(313);
+        match(TorqueParser::T__8);
+        setState(314);
+        bitwiseExpression(0);
+      }
+      setState(319);
+      _errHandler->sync(this);
+      alt = getInterpreter<atn::ParserATNSimulator>()->adaptivePredict(
+          _input, 24, _ctx);
+    }
+  } catch (RecognitionException& e) {
+    _errHandler->reportError(this, e);
+    _localctx->exception = std::current_exception();
+    _errHandler->recover(this, _localctx->exception);
+  }
+  return _localctx;
+}
+
+//----------------- BitwiseExpressionContext
+//------------------------------------------------------------------
+
+TorqueParser::BitwiseExpressionContext::BitwiseExpressionContext(
+    ParserRuleContext* parent, size_t invokingState)
+    : ParserRuleContext(parent, invokingState) {}
+
+TorqueParser::EqualityExpressionContext*
+TorqueParser::BitwiseExpressionContext::equalityExpression() {
+  return getRuleContext<TorqueParser::EqualityExpressionContext>(0);
+}
+
+TorqueParser::BitwiseExpressionContext*
+TorqueParser::BitwiseExpressionContext::bitwiseExpression() {
+  return getRuleContext<TorqueParser::BitwiseExpressionContext>(0);
+}
+
+tree::TerminalNode* TorqueParser::BitwiseExpressionContext::BIT_AND() {
+  return getToken(TorqueParser::BIT_AND, 0);
+}
+
+tree::TerminalNode* TorqueParser::BitwiseExpressionContext::BIT_OR() {
+  return getToken(TorqueParser::BIT_OR, 0);
+}
+
+size_t TorqueParser::BitwiseExpressionContext::getRuleIndex() const {
+  return TorqueParser::RuleBitwiseExpression;
+}
+
+void TorqueParser::BitwiseExpressionContext::enterRule(
+    tree::ParseTreeListener* listener) {
+  auto parserListener = dynamic_cast<TorqueListener*>(listener);
+  if (parserListener != nullptr) parserListener->enterBitwiseExpression(this);
+}
+
+void TorqueParser::BitwiseExpressionContext::exitRule(
+    tree::ParseTreeListener* listener) {
+  auto parserListener = dynamic_cast<TorqueListener*>(listener);
+  if (parserListener != nullptr) parserListener->exitBitwiseExpression(this);
+}
+
+antlrcpp::Any TorqueParser::BitwiseExpressionContext::accept(
+    tree::ParseTreeVisitor* visitor) {
+  if (auto parserVisitor = dynamic_cast<TorqueVisitor*>(visitor))
+    return parserVisitor->visitBitwiseExpression(this);
+  else
+    return visitor->visitChildren(this);
+}
+
+TorqueParser::BitwiseExpressionContext* TorqueParser::bitwiseExpression() {
+  return bitwiseExpression(0);
+}
+
+TorqueParser::BitwiseExpressionContext* TorqueParser::bitwiseExpression(
+    int precedence) {
+  ParserRuleContext* parentContext = _ctx;
+  size_t parentState = getState();
+  TorqueParser::BitwiseExpressionContext* _localctx =
+      _tracker.createInstance<BitwiseExpressionContext>(_ctx, parentState);
+  TorqueParser::BitwiseExpressionContext* previousContext = _localctx;
+  size_t startState = 32;
+  enterRecursionRule(_localctx, 32, TorqueParser::RuleBitwiseExpression,
+                     precedence);
+
+  size_t _la = 0;
+
+  auto onExit = finally([=] { unrollRecursionContexts(parentContext); });
+  try {
+    size_t alt;
+    enterOuterAlt(_localctx, 1);
+    setState(321);
+    equalityExpression(0);
+    _ctx->stop = _input->LT(-1);
+    setState(328);
+    _errHandler->sync(this);
+    alt = getInterpreter<atn::ParserATNSimulator>()->adaptivePredict(_input, 25,
+                                                                     _ctx);
+    while (alt != 2 && alt != atn::ATN::INVALID_ALT_NUMBER) {
+      if (alt == 1) {
+        if (!_parseListeners.empty()) triggerExitRuleEvent();
+        previousContext = _localctx;
+        _localctx = _tracker.createInstance<BitwiseExpressionContext>(
+            parentContext, parentState);
+        pushNewRecursionContext(_localctx, startState, RuleBitwiseExpression);
+        setState(323);
+
+        if (!(precpred(_ctx, 1)))
+          throw FailedPredicateException(this, "precpred(_ctx, 1)");
+        setState(324);
+        dynamic_cast<BitwiseExpressionContext*>(_localctx)->op = _input->LT(1);
+        _la = _input->LA(1);
+        if (!(_la == TorqueParser::BIT_OR
+
+              || _la == TorqueParser::BIT_AND)) {
+          dynamic_cast<BitwiseExpressionContext*>(_localctx)->op =
+              _errHandler->recoverInline(this);
+        } else {
+          _errHandler->reportMatch(this);
+          consume();
+        }
+        setState(325);
+        equalityExpression(0);
+      }
+      setState(330);
+      _errHandler->sync(this);
+      alt = getInterpreter<atn::ParserATNSimulator>()->adaptivePredict(
+          _input, 25, _ctx);
+    }
+  } catch (RecognitionException& e) {
+    _errHandler->reportError(this, e);
+    _localctx->exception = std::current_exception();
+    _errHandler->recover(this, _localctx->exception);
+  }
+  return _localctx;
+}
+
+//----------------- EqualityExpressionContext
+//------------------------------------------------------------------
+
+TorqueParser::EqualityExpressionContext::EqualityExpressionContext(
+    ParserRuleContext* parent, size_t invokingState)
+    : ParserRuleContext(parent, invokingState) {}
+
+TorqueParser::RelationalExpressionContext*
+TorqueParser::EqualityExpressionContext::relationalExpression() {
+  return getRuleContext<TorqueParser::RelationalExpressionContext>(0);
+}
+
+TorqueParser::EqualityExpressionContext*
+TorqueParser::EqualityExpressionContext::equalityExpression() {
+  return getRuleContext<TorqueParser::EqualityExpressionContext>(0);
+}
+
+tree::TerminalNode* TorqueParser::EqualityExpressionContext::EQUAL() {
+  return getToken(TorqueParser::EQUAL, 0);
+}
+
+tree::TerminalNode* TorqueParser::EqualityExpressionContext::NOT_EQUAL() {
+  return getToken(TorqueParser::NOT_EQUAL, 0);
+}
+
+size_t TorqueParser::EqualityExpressionContext::getRuleIndex() const {
+  return TorqueParser::RuleEqualityExpression;
+}
+
+void TorqueParser::EqualityExpressionContext::enterRule(
+    tree::ParseTreeListener* listener) {
+  auto parserListener = dynamic_cast<TorqueListener*>(listener);
+  if (parserListener != nullptr) parserListener->enterEqualityExpression(this);
+}
+
+void TorqueParser::EqualityExpressionContext::exitRule(
+    tree::ParseTreeListener* listener) {
+  auto parserListener = dynamic_cast<TorqueListener*>(listener);
+  if (parserListener != nullptr) parserListener->exitEqualityExpression(this);
+}
+
+antlrcpp::Any TorqueParser::EqualityExpressionContext::accept(
+    tree::ParseTreeVisitor* visitor) {
+  if (auto parserVisitor = dynamic_cast<TorqueVisitor*>(visitor))
+    return parserVisitor->visitEqualityExpression(this);
+  else
+    return visitor->visitChildren(this);
+}
+
+TorqueParser::EqualityExpressionContext* TorqueParser::equalityExpression() {
+  return equalityExpression(0);
+}
+
+TorqueParser::EqualityExpressionContext* TorqueParser::equalityExpression(
+    int precedence) {
+  ParserRuleContext* parentContext = _ctx;
+  size_t parentState = getState();
+  TorqueParser::EqualityExpressionContext* _localctx =
+      _tracker.createInstance<EqualityExpressionContext>(_ctx, parentState);
+  TorqueParser::EqualityExpressionContext* previousContext = _localctx;
+  size_t startState = 34;
+  enterRecursionRule(_localctx, 34, TorqueParser::RuleEqualityExpression,
+                     precedence);
+
+  size_t _la = 0;
+
+  auto onExit = finally([=] { unrollRecursionContexts(parentContext); });
+  try {
+    size_t alt;
+    enterOuterAlt(_localctx, 1);
+    setState(332);
+    relationalExpression(0);
+    _ctx->stop = _input->LT(-1);
+    setState(339);
+    _errHandler->sync(this);
+    alt = getInterpreter<atn::ParserATNSimulator>()->adaptivePredict(_input, 26,
+                                                                     _ctx);
+    while (alt != 2 && alt != atn::ATN::INVALID_ALT_NUMBER) {
+      if (alt == 1) {
+        if (!_parseListeners.empty()) triggerExitRuleEvent();
+        previousContext = _localctx;
+        _localctx = _tracker.createInstance<EqualityExpressionContext>(
+            parentContext, parentState);
+        pushNewRecursionContext(_localctx, startState, RuleEqualityExpression);
+        setState(334);
+
+        if (!(precpred(_ctx, 1)))
+          throw FailedPredicateException(this, "precpred(_ctx, 1)");
+        setState(335);
+        dynamic_cast<EqualityExpressionContext*>(_localctx)->op = _input->LT(1);
+        _la = _input->LA(1);
+        if (!(_la == TorqueParser::EQUAL
+
+              || _la == TorqueParser::NOT_EQUAL)) {
+          dynamic_cast<EqualityExpressionContext*>(_localctx)->op =
+              _errHandler->recoverInline(this);
+        } else {
+          _errHandler->reportMatch(this);
+          consume();
+        }
+        setState(336);
+        relationalExpression(0);
+      }
+      setState(341);
+      _errHandler->sync(this);
+      alt = getInterpreter<atn::ParserATNSimulator>()->adaptivePredict(
+          _input, 26, _ctx);
+    }
+  } catch (RecognitionException& e) {
+    _errHandler->reportError(this, e);
+    _localctx->exception = std::current_exception();
+    _errHandler->recover(this, _localctx->exception);
+  }
+  return _localctx;
+}
+
+//----------------- RelationalExpressionContext
+//------------------------------------------------------------------
+
+TorqueParser::RelationalExpressionContext::RelationalExpressionContext(
+    ParserRuleContext* parent, size_t invokingState)
+    : ParserRuleContext(parent, invokingState) {}
+
+TorqueParser::ShiftExpressionContext*
+TorqueParser::RelationalExpressionContext::shiftExpression() {
+  return getRuleContext<TorqueParser::ShiftExpressionContext>(0);
+}
+
+TorqueParser::RelationalExpressionContext*
+TorqueParser::RelationalExpressionContext::relationalExpression() {
+  return getRuleContext<TorqueParser::RelationalExpressionContext>(0);
+}
+
+tree::TerminalNode* TorqueParser::RelationalExpressionContext::LESS_THAN() {
+  return getToken(TorqueParser::LESS_THAN, 0);
+}
+
+tree::TerminalNode*
+TorqueParser::RelationalExpressionContext::LESS_THAN_EQUAL() {
+  return getToken(TorqueParser::LESS_THAN_EQUAL, 0);
+}
+
+tree::TerminalNode* TorqueParser::RelationalExpressionContext::GREATER_THAN() {
+  return getToken(TorqueParser::GREATER_THAN, 0);
+}
+
+tree::TerminalNode*
+TorqueParser::RelationalExpressionContext::GREATER_THAN_EQUAL() {
+  return getToken(TorqueParser::GREATER_THAN_EQUAL, 0);
+}
+
+size_t TorqueParser::RelationalExpressionContext::getRuleIndex() const {
+  return TorqueParser::RuleRelationalExpression;
+}
+
+void TorqueParser::RelationalExpressionContext::enterRule(
+    tree::ParseTreeListener* listener) {
+  auto parserListener = dynamic_cast<TorqueListener*>(listener);
+  if (parserListener != nullptr)
+    parserListener->enterRelationalExpression(this);
+}
+
+void TorqueParser::RelationalExpressionContext::exitRule(
+    tree::ParseTreeListener* listener) {
+  auto parserListener = dynamic_cast<TorqueListener*>(listener);
+  if (parserListener != nullptr) parserListener->exitRelationalExpression(this);
+}
+
+antlrcpp::Any TorqueParser::RelationalExpressionContext::accept(
+    tree::ParseTreeVisitor* visitor) {
+  if (auto parserVisitor = dynamic_cast<TorqueVisitor*>(visitor))
+    return parserVisitor->visitRelationalExpression(this);
+  else
+    return visitor->visitChildren(this);
+}
+
+TorqueParser::RelationalExpressionContext*
+TorqueParser::relationalExpression() {
+  return relationalExpression(0);
+}
+
+TorqueParser::RelationalExpressionContext* TorqueParser::relationalExpression(
+    int precedence) {
+  ParserRuleContext* parentContext = _ctx;
+  size_t parentState = getState();
+  TorqueParser::RelationalExpressionContext* _localctx =
+      _tracker.createInstance<RelationalExpressionContext>(_ctx, parentState);
+  TorqueParser::RelationalExpressionContext* previousContext = _localctx;
+  size_t startState = 36;
+  enterRecursionRule(_localctx, 36, TorqueParser::RuleRelationalExpression,
+                     precedence);
+
+  size_t _la = 0;
+
+  auto onExit = finally([=] { unrollRecursionContexts(parentContext); });
+  try {
+    size_t alt;
+    enterOuterAlt(_localctx, 1);
+    setState(343);
+    shiftExpression(0);
+    _ctx->stop = _input->LT(-1);
+    setState(350);
+    _errHandler->sync(this);
+    alt = getInterpreter<atn::ParserATNSimulator>()->adaptivePredict(_input, 27,
+                                                                     _ctx);
+    while (alt != 2 && alt != atn::ATN::INVALID_ALT_NUMBER) {
+      if (alt == 1) {
+        if (!_parseListeners.empty()) triggerExitRuleEvent();
+        previousContext = _localctx;
+        _localctx = _tracker.createInstance<RelationalExpressionContext>(
+            parentContext, parentState);
+        pushNewRecursionContext(_localctx, startState,
+                                RuleRelationalExpression);
+        setState(345);
+
+        if (!(precpred(_ctx, 1)))
+          throw FailedPredicateException(this, "precpred(_ctx, 1)");
+        setState(346);
+        dynamic_cast<RelationalExpressionContext*>(_localctx)->op =
+            _input->LT(1);
+        _la = _input->LA(1);
+        if (!(((((_la - 63) & ~0x3fULL) == 0) &&
+               ((1ULL << (_la - 63)) &
+                ((1ULL << (TorqueParser::LESS_THAN - 63)) |
+                 (1ULL << (TorqueParser::LESS_THAN_EQUAL - 63)) |
+                 (1ULL << (TorqueParser::GREATER_THAN - 63)) |
+                 (1ULL << (TorqueParser::GREATER_THAN_EQUAL - 63)))) != 0))) {
+          dynamic_cast<RelationalExpressionContext*>(_localctx)->op =
+              _errHandler->recoverInline(this);
+        } else {
+          _errHandler->reportMatch(this);
+          consume();
+        }
+        setState(347);
+        shiftExpression(0);
+      }
+      setState(352);
+      _errHandler->sync(this);
+      alt = getInterpreter<atn::ParserATNSimulator>()->adaptivePredict(
+          _input, 27, _ctx);
+    }
+  } catch (RecognitionException& e) {
+    _errHandler->reportError(this, e);
+    _localctx->exception = std::current_exception();
+    _errHandler->recover(this, _localctx->exception);
+  }
+  return _localctx;
+}
+
+//----------------- ShiftExpressionContext
+//------------------------------------------------------------------
+
+TorqueParser::ShiftExpressionContext::ShiftExpressionContext(
+    ParserRuleContext* parent, size_t invokingState)
+    : ParserRuleContext(parent, invokingState) {}
+
+TorqueParser::AdditiveExpressionContext*
+TorqueParser::ShiftExpressionContext::additiveExpression() {
+  return getRuleContext<TorqueParser::AdditiveExpressionContext>(0);
+}
+
+TorqueParser::ShiftExpressionContext*
+TorqueParser::ShiftExpressionContext::shiftExpression() {
+  return getRuleContext<TorqueParser::ShiftExpressionContext>(0);
+}
+
+tree::TerminalNode* TorqueParser::ShiftExpressionContext::SHIFT_RIGHT() {
+  return getToken(TorqueParser::SHIFT_RIGHT, 0);
+}
+
+tree::TerminalNode* TorqueParser::ShiftExpressionContext::SHIFT_LEFT() {
+  return getToken(TorqueParser::SHIFT_LEFT, 0);
+}
+
+tree::TerminalNode*
+TorqueParser::ShiftExpressionContext::SHIFT_RIGHT_ARITHMETIC() {
+  return getToken(TorqueParser::SHIFT_RIGHT_ARITHMETIC, 0);
+}
+
+size_t TorqueParser::ShiftExpressionContext::getRuleIndex() const {
+  return TorqueParser::RuleShiftExpression;
+}
+
+void TorqueParser::ShiftExpressionContext::enterRule(
+    tree::ParseTreeListener* listener) {
+  auto parserListener = dynamic_cast<TorqueListener*>(listener);
+  if (parserListener != nullptr) parserListener->enterShiftExpression(this);
+}
+
+void TorqueParser::ShiftExpressionContext::exitRule(
+    tree::ParseTreeListener* listener) {
+  auto parserListener = dynamic_cast<TorqueListener*>(listener);
+  if (parserListener != nullptr) parserListener->exitShiftExpression(this);
+}
+
+antlrcpp::Any TorqueParser::ShiftExpressionContext::accept(
+    tree::ParseTreeVisitor* visitor) {
+  if (auto parserVisitor = dynamic_cast<TorqueVisitor*>(visitor))
+    return parserVisitor->visitShiftExpression(this);
+  else
+    return visitor->visitChildren(this);
+}
+
+TorqueParser::ShiftExpressionContext* TorqueParser::shiftExpression() {
+  return shiftExpression(0);
+}
+
+TorqueParser::ShiftExpressionContext* TorqueParser::shiftExpression(
+    int precedence) {
+  ParserRuleContext* parentContext = _ctx;
+  size_t parentState = getState();
+  TorqueParser::ShiftExpressionContext* _localctx =
+      _tracker.createInstance<ShiftExpressionContext>(_ctx, parentState);
+  TorqueParser::ShiftExpressionContext* previousContext = _localctx;
+  size_t startState = 38;
+  enterRecursionRule(_localctx, 38, TorqueParser::RuleShiftExpression,
+                     precedence);
+
+  size_t _la = 0;
+
+  auto onExit = finally([=] { unrollRecursionContexts(parentContext); });
+  try {
+    size_t alt;
+    enterOuterAlt(_localctx, 1);
+    setState(354);
+    additiveExpression(0);
+    _ctx->stop = _input->LT(-1);
+    setState(361);
+    _errHandler->sync(this);
+    alt = getInterpreter<atn::ParserATNSimulator>()->adaptivePredict(_input, 28,
+                                                                     _ctx);
+    while (alt != 2 && alt != atn::ATN::INVALID_ALT_NUMBER) {
+      if (alt == 1) {
+        if (!_parseListeners.empty()) triggerExitRuleEvent();
+        previousContext = _localctx;
+        _localctx = _tracker.createInstance<ShiftExpressionContext>(
+            parentContext, parentState);
+        pushNewRecursionContext(_localctx, startState, RuleShiftExpression);
+        setState(356);
+
+        if (!(precpred(_ctx, 1)))
+          throw FailedPredicateException(this, "precpred(_ctx, 1)");
+        setState(357);
+        dynamic_cast<ShiftExpressionContext*>(_localctx)->op = _input->LT(1);
+        _la = _input->LA(1);
+        if (!(((((_la - 67) & ~0x3fULL) == 0) &&
+               ((1ULL << (_la - 67)) &
+                ((1ULL << (TorqueParser::SHIFT_LEFT - 67)) |
+                 (1ULL << (TorqueParser::SHIFT_RIGHT - 67)) |
+                 (1ULL << (TorqueParser::SHIFT_RIGHT_ARITHMETIC - 67)))) !=
+                   0))) {
+          dynamic_cast<ShiftExpressionContext*>(_localctx)->op =
+              _errHandler->recoverInline(this);
+        } else {
+          _errHandler->reportMatch(this);
+          consume();
+        }
+        setState(358);
+        additiveExpression(0);
+      }
+      setState(363);
+      _errHandler->sync(this);
+      alt = getInterpreter<atn::ParserATNSimulator>()->adaptivePredict(
+          _input, 28, _ctx);
+    }
+  } catch (RecognitionException& e) {
+    _errHandler->reportError(this, e);
+    _localctx->exception = std::current_exception();
+    _errHandler->recover(this, _localctx->exception);
+  }
+  return _localctx;
+}
+
+//----------------- AdditiveExpressionContext
+//------------------------------------------------------------------
+
+TorqueParser::AdditiveExpressionContext::AdditiveExpressionContext(
+    ParserRuleContext* parent, size_t invokingState)
+    : ParserRuleContext(parent, invokingState) {}
+
+TorqueParser::MultiplicativeExpressionContext*
+TorqueParser::AdditiveExpressionContext::multiplicativeExpression() {
+  return getRuleContext<TorqueParser::MultiplicativeExpressionContext>(0);
+}
+
+TorqueParser::AdditiveExpressionContext*
+TorqueParser::AdditiveExpressionContext::additiveExpression() {
+  return getRuleContext<TorqueParser::AdditiveExpressionContext>(0);
+}
+
+tree::TerminalNode* TorqueParser::AdditiveExpressionContext::PLUS() {
+  return getToken(TorqueParser::PLUS, 0);
+}
+
+tree::TerminalNode* TorqueParser::AdditiveExpressionContext::MINUS() {
+  return getToken(TorqueParser::MINUS, 0);
+}
+
+size_t TorqueParser::AdditiveExpressionContext::getRuleIndex() const {
+  return TorqueParser::RuleAdditiveExpression;
+}
+
+void TorqueParser::AdditiveExpressionContext::enterRule(
+    tree::ParseTreeListener* listener) {
+  auto parserListener = dynamic_cast<TorqueListener*>(listener);
+  if (parserListener != nullptr) parserListener->enterAdditiveExpression(this);
+}
+
+void TorqueParser::AdditiveExpressionContext::exitRule(
+    tree::ParseTreeListener* listener) {
+  auto parserListener = dynamic_cast<TorqueListener*>(listener);
+  if (parserListener != nullptr) parserListener->exitAdditiveExpression(this);
+}
+
+antlrcpp::Any TorqueParser::AdditiveExpressionContext::accept(
+    tree::ParseTreeVisitor* visitor) {
+  if (auto parserVisitor = dynamic_cast<TorqueVisitor*>(visitor))
+    return parserVisitor->visitAdditiveExpression(this);
+  else
+    return visitor->visitChildren(this);
+}
+
+TorqueParser::AdditiveExpressionContext* TorqueParser::additiveExpression() {
+  return additiveExpression(0);
+}
+
+TorqueParser::AdditiveExpressionContext* TorqueParser::additiveExpression(
+    int precedence) {
+  ParserRuleContext* parentContext = _ctx;
+  size_t parentState = getState();
+  TorqueParser::AdditiveExpressionContext* _localctx =
+      _tracker.createInstance<AdditiveExpressionContext>(_ctx, parentState);
+  TorqueParser::AdditiveExpressionContext* previousContext = _localctx;
+  size_t startState = 40;
+  enterRecursionRule(_localctx, 40, TorqueParser::RuleAdditiveExpression,
+                     precedence);
+
+  size_t _la = 0;
+
+  auto onExit = finally([=] { unrollRecursionContexts(parentContext); });
+  try {
+    size_t alt;
+    enterOuterAlt(_localctx, 1);
+    setState(365);
+    multiplicativeExpression(0);
+    _ctx->stop = _input->LT(-1);
+    setState(372);
+    _errHandler->sync(this);
+    alt = getInterpreter<atn::ParserATNSimulator>()->adaptivePredict(_input, 29,
+                                                                     _ctx);
+    while (alt != 2 && alt != atn::ATN::INVALID_ALT_NUMBER) {
+      if (alt == 1) {
+        if (!_parseListeners.empty()) triggerExitRuleEvent();
+        previousContext = _localctx;
+        _localctx = _tracker.createInstance<AdditiveExpressionContext>(
+            parentContext, parentState);
+        pushNewRecursionContext(_localctx, startState, RuleAdditiveExpression);
+        setState(367);
+
+        if (!(precpred(_ctx, 1)))
+          throw FailedPredicateException(this, "precpred(_ctx, 1)");
+        setState(368);
+        dynamic_cast<AdditiveExpressionContext*>(_localctx)->op = _input->LT(1);
+        _la = _input->LA(1);
+        if (!(_la == TorqueParser::PLUS
+
+              || _la == TorqueParser::MINUS)) {
+          dynamic_cast<AdditiveExpressionContext*>(_localctx)->op =
+              _errHandler->recoverInline(this);
+        } else {
+          _errHandler->reportMatch(this);
+          consume();
+        }
+        setState(369);
+        multiplicativeExpression(0);
+      }
+      setState(374);
+      _errHandler->sync(this);
+      alt = getInterpreter<atn::ParserATNSimulator>()->adaptivePredict(
+          _input, 29, _ctx);
+    }
+  } catch (RecognitionException& e) {
+    _errHandler->reportError(this, e);
+    _localctx->exception = std::current_exception();
+    _errHandler->recover(this, _localctx->exception);
+  }
+  return _localctx;
+}
+
+//----------------- MultiplicativeExpressionContext
+//------------------------------------------------------------------
+
+TorqueParser::MultiplicativeExpressionContext::MultiplicativeExpressionContext(
+    ParserRuleContext* parent, size_t invokingState)
+    : ParserRuleContext(parent, invokingState) {}
+
+TorqueParser::UnaryExpressionContext*
+TorqueParser::MultiplicativeExpressionContext::unaryExpression() {
+  return getRuleContext<TorqueParser::UnaryExpressionContext>(0);
+}
+
+TorqueParser::MultiplicativeExpressionContext*
+TorqueParser::MultiplicativeExpressionContext::multiplicativeExpression() {
+  return getRuleContext<TorqueParser::MultiplicativeExpressionContext>(0);
+}
+
+tree::TerminalNode* TorqueParser::MultiplicativeExpressionContext::MULTIPLY() {
+  return getToken(TorqueParser::MULTIPLY, 0);
+}
+
+tree::TerminalNode* TorqueParser::MultiplicativeExpressionContext::DIVIDE() {
+  return getToken(TorqueParser::DIVIDE, 0);
+}
+
+tree::TerminalNode* TorqueParser::MultiplicativeExpressionContext::MODULO() {
+  return getToken(TorqueParser::MODULO, 0);
+}
+
+size_t TorqueParser::MultiplicativeExpressionContext::getRuleIndex() const {
+  return TorqueParser::RuleMultiplicativeExpression;
+}
+
+void TorqueParser::MultiplicativeExpressionContext::enterRule(
+    tree::ParseTreeListener* listener) {
+  auto parserListener = dynamic_cast<TorqueListener*>(listener);
+  if (parserListener != nullptr)
+    parserListener->enterMultiplicativeExpression(this);
+}
+
+void TorqueParser::MultiplicativeExpressionContext::exitRule(
+    tree::ParseTreeListener* listener) {
+  auto parserListener = dynamic_cast<TorqueListener*>(listener);
+  if (parserListener != nullptr)
+    parserListener->exitMultiplicativeExpression(this);
+}
+
+antlrcpp::Any TorqueParser::MultiplicativeExpressionContext::accept(
+    tree::ParseTreeVisitor* visitor) {
+  if (auto parserVisitor = dynamic_cast<TorqueVisitor*>(visitor))
+    return parserVisitor->visitMultiplicativeExpression(this);
+  else
+    return visitor->visitChildren(this);
+}
+
+TorqueParser::MultiplicativeExpressionContext*
+TorqueParser::multiplicativeExpression() {
+  return multiplicativeExpression(0);
+}
+
+TorqueParser::MultiplicativeExpressionContext*
+TorqueParser::multiplicativeExpression(int precedence) {
+  ParserRuleContext* parentContext = _ctx;
+  size_t parentState = getState();
+  TorqueParser::MultiplicativeExpressionContext* _localctx =
+      _tracker.createInstance<MultiplicativeExpressionContext>(_ctx,
+                                                               parentState);
+  TorqueParser::MultiplicativeExpressionContext* previousContext = _localctx;
+  size_t startState = 42;
+  enterRecursionRule(_localctx, 42, TorqueParser::RuleMultiplicativeExpression,
+                     precedence);
+
+  size_t _la = 0;
+
+  auto onExit = finally([=] { unrollRecursionContexts(parentContext); });
+  try {
+    size_t alt;
+    enterOuterAlt(_localctx, 1);
+    setState(376);
+    unaryExpression();
+    _ctx->stop = _input->LT(-1);
+    setState(383);
+    _errHandler->sync(this);
+    alt = getInterpreter<atn::ParserATNSimulator>()->adaptivePredict(_input, 30,
+                                                                     _ctx);
+    while (alt != 2 && alt != atn::ATN::INVALID_ALT_NUMBER) {
+      if (alt == 1) {
+        if (!_parseListeners.empty()) triggerExitRuleEvent();
+        previousContext = _localctx;
+        _localctx = _tracker.createInstance<MultiplicativeExpressionContext>(
+            parentContext, parentState);
+        pushNewRecursionContext(_localctx, startState,
+                                RuleMultiplicativeExpression);
+        setState(378);
+
+        if (!(precpred(_ctx, 1)))
+          throw FailedPredicateException(this, "precpred(_ctx, 1)");
+        setState(379);
+        dynamic_cast<MultiplicativeExpressionContext*>(_localctx)->op =
+            _input->LT(1);
+        _la = _input->LA(1);
+        if (!((((_la & ~0x3fULL) == 0) &&
+               ((1ULL << _la) & ((1ULL << TorqueParser::MULTIPLY) |
+                                 (1ULL << TorqueParser::DIVIDE) |
+                                 (1ULL << TorqueParser::MODULO))) != 0))) {
+          dynamic_cast<MultiplicativeExpressionContext*>(_localctx)->op =
+              _errHandler->recoverInline(this);
+        } else {
+          _errHandler->reportMatch(this);
+          consume();
+        }
+        setState(380);
+        unaryExpression();
+      }
+      setState(385);
+      _errHandler->sync(this);
+      alt = getInterpreter<atn::ParserATNSimulator>()->adaptivePredict(
+          _input, 30, _ctx);
+    }
+  } catch (RecognitionException& e) {
+    _errHandler->reportError(this, e);
+    _localctx->exception = std::current_exception();
+    _errHandler->recover(this, _localctx->exception);
+  }
+  return _localctx;
+}
+
+//----------------- UnaryExpressionContext
+//------------------------------------------------------------------
+
+TorqueParser::UnaryExpressionContext::UnaryExpressionContext(
+    ParserRuleContext* parent, size_t invokingState)
+    : ParserRuleContext(parent, invokingState) {}
+
+TorqueParser::AssignmentExpressionContext*
+TorqueParser::UnaryExpressionContext::assignmentExpression() {
+  return getRuleContext<TorqueParser::AssignmentExpressionContext>(0);
+}
+
+TorqueParser::UnaryExpressionContext*
+TorqueParser::UnaryExpressionContext::unaryExpression() {
+  return getRuleContext<TorqueParser::UnaryExpressionContext>(0);
+}
+
+tree::TerminalNode* TorqueParser::UnaryExpressionContext::PLUS() {
+  return getToken(TorqueParser::PLUS, 0);
+}
+
+tree::TerminalNode* TorqueParser::UnaryExpressionContext::MINUS() {
+  return getToken(TorqueParser::MINUS, 0);
+}
+
+tree::TerminalNode* TorqueParser::UnaryExpressionContext::BIT_NOT() {
+  return getToken(TorqueParser::BIT_NOT, 0);
+}
+
+tree::TerminalNode* TorqueParser::UnaryExpressionContext::NOT() {
+  return getToken(TorqueParser::NOT, 0);
+}
+
+size_t TorqueParser::UnaryExpressionContext::getRuleIndex() const {
+  return TorqueParser::RuleUnaryExpression;
+}
+
+void TorqueParser::UnaryExpressionContext::enterRule(
+    tree::ParseTreeListener* listener) {
+  auto parserListener = dynamic_cast<TorqueListener*>(listener);
+  if (parserListener != nullptr) parserListener->enterUnaryExpression(this);
+}
+
+void TorqueParser::UnaryExpressionContext::exitRule(
+    tree::ParseTreeListener* listener) {
+  auto parserListener = dynamic_cast<TorqueListener*>(listener);
+  if (parserListener != nullptr) parserListener->exitUnaryExpression(this);
+}
+
+antlrcpp::Any TorqueParser::UnaryExpressionContext::accept(
+    tree::ParseTreeVisitor* visitor) {
+  if (auto parserVisitor = dynamic_cast<TorqueVisitor*>(visitor))
+    return parserVisitor->visitUnaryExpression(this);
+  else
+    return visitor->visitChildren(this);
+}
+
+TorqueParser::UnaryExpressionContext* TorqueParser::unaryExpression() {
+  UnaryExpressionContext* _localctx =
+      _tracker.createInstance<UnaryExpressionContext>(_ctx, getState());
+  enterRule(_localctx, 44, TorqueParser::RuleUnaryExpression);
+  size_t _la = 0;
+
+  auto onExit = finally([=] { exitRule(); });
+  try {
+    setState(389);
+    _errHandler->sync(this);
+    switch (_input->LA(1)) {
+      case TorqueParser::T__0:
+      case TorqueParser::MAX:
+      case TorqueParser::MIN:
+      case TorqueParser::INCREMENT:
+      case TorqueParser::DECREMENT:
+      case TorqueParser::STRING_LITERAL:
+      case TorqueParser::IDENTIFIER:
+      case TorqueParser::DECIMAL_LITERAL: {
+        enterOuterAlt(_localctx, 1);
+        setState(386);
+        assignmentExpression();
+        break;
+      }
+
+      case TorqueParser::PLUS:
+      case TorqueParser::MINUS:
+      case TorqueParser::BIT_NOT:
+      case TorqueParser::NOT: {
+        enterOuterAlt(_localctx, 2);
+        setState(387);
+        dynamic_cast<UnaryExpressionContext*>(_localctx)->op = _input->LT(1);
+        _la = _input->LA(1);
+        if (!(((((_la - 52) & ~0x3fULL) == 0) &&
+               ((1ULL << (_la - 52)) & ((1ULL << (TorqueParser::PLUS - 52)) |
+                                        (1ULL << (TorqueParser::MINUS - 52)) |
+                                        (1ULL << (TorqueParser::BIT_NOT - 52)) |
+                                        (1ULL << (TorqueParser::NOT - 52)))) !=
+                   0))) {
+          dynamic_cast<UnaryExpressionContext*>(_localctx)->op =
+              _errHandler->recoverInline(this);
+        } else {
+          _errHandler->reportMatch(this);
+          consume();
+        }
+        setState(388);
+        unaryExpression();
+        break;
+      }
+
+      default:
+        throw NoViableAltException(this);
+    }
+
+  } catch (RecognitionException& e) {
+    _errHandler->reportError(this, e);
+    _localctx->exception = std::current_exception();
+    _errHandler->recover(this, _localctx->exception);
+  }
+
+  return _localctx;
+}
+
+//----------------- LocationExpressionContext
+//------------------------------------------------------------------
+
+TorqueParser::LocationExpressionContext::LocationExpressionContext(
+    ParserRuleContext* parent, size_t invokingState)
+    : ParserRuleContext(parent, invokingState) {}
+
+tree::TerminalNode* TorqueParser::LocationExpressionContext::IDENTIFIER() {
+  return getToken(TorqueParser::IDENTIFIER, 0);
+}
+
+TorqueParser::GenericSpecializationTypeListContext*
+TorqueParser::LocationExpressionContext::genericSpecializationTypeList() {
+  return getRuleContext<TorqueParser::GenericSpecializationTypeListContext>(0);
+}
+
+TorqueParser::LocationExpressionContext*
+TorqueParser::LocationExpressionContext::locationExpression() {
+  return getRuleContext<TorqueParser::LocationExpressionContext>(0);
+}
+
+TorqueParser::ExpressionContext*
+TorqueParser::LocationExpressionContext::expression() {
+  return getRuleContext<TorqueParser::ExpressionContext>(0);
+}
+
+size_t TorqueParser::LocationExpressionContext::getRuleIndex() const {
+  return TorqueParser::RuleLocationExpression;
+}
+
+void TorqueParser::LocationExpressionContext::enterRule(
+    tree::ParseTreeListener* listener) {
+  auto parserListener = dynamic_cast<TorqueListener*>(listener);
+  if (parserListener != nullptr) parserListener->enterLocationExpression(this);
+}
+
+void TorqueParser::LocationExpressionContext::exitRule(
+    tree::ParseTreeListener* listener) {
+  auto parserListener = dynamic_cast<TorqueListener*>(listener);
+  if (parserListener != nullptr) parserListener->exitLocationExpression(this);
+}
+
+antlrcpp::Any TorqueParser::LocationExpressionContext::accept(
+    tree::ParseTreeVisitor* visitor) {
+  if (auto parserVisitor = dynamic_cast<TorqueVisitor*>(visitor))
+    return parserVisitor->visitLocationExpression(this);
+  else
+    return visitor->visitChildren(this);
+}
+
+TorqueParser::LocationExpressionContext* TorqueParser::locationExpression() {
+  return locationExpression(0);
+}
+
+TorqueParser::LocationExpressionContext* TorqueParser::locationExpression(
+    int precedence) {
+  ParserRuleContext* parentContext = _ctx;
+  size_t parentState = getState();
+  TorqueParser::LocationExpressionContext* _localctx =
+      _tracker.createInstance<LocationExpressionContext>(_ctx, parentState);
+  TorqueParser::LocationExpressionContext* previousContext = _localctx;
+  size_t startState = 46;
+  enterRecursionRule(_localctx, 46, TorqueParser::RuleLocationExpression,
+                     precedence);
+
+  auto onExit = finally([=] { unrollRecursionContexts(parentContext); });
+  try {
+    size_t alt;
+    enterOuterAlt(_localctx, 1);
+    setState(392);
+    match(TorqueParser::IDENTIFIER);
+    setState(394);
+    _errHandler->sync(this);
+
+    switch (getInterpreter<atn::ParserATNSimulator>()->adaptivePredict(
+        _input, 32, _ctx)) {
+      case 1: {
+        setState(393);
+        genericSpecializationTypeList();
+        break;
+      }
+    }
+    _ctx->stop = _input->LT(-1);
+    setState(406);
+    _errHandler->sync(this);
+    alt = getInterpreter<atn::ParserATNSimulator>()->adaptivePredict(_input, 34,
+                                                                     _ctx);
+    while (alt != 2 && alt != atn::ATN::INVALID_ALT_NUMBER) {
+      if (alt == 1) {
+        if (!_parseListeners.empty()) triggerExitRuleEvent();
+        previousContext = _localctx;
+        setState(404);
+        _errHandler->sync(this);
+        switch (getInterpreter<atn::ParserATNSimulator>()->adaptivePredict(
+            _input, 33, _ctx)) {
+          case 1: {
+            _localctx = _tracker.createInstance<LocationExpressionContext>(
+                parentContext, parentState);
+            pushNewRecursionContext(_localctx, startState,
+                                    RuleLocationExpression);
+            setState(396);
+
+            if (!(precpred(_ctx, 2)))
+              throw FailedPredicateException(this, "precpred(_ctx, 2)");
+            setState(397);
+            match(TorqueParser::T__9);
+            setState(398);
+            match(TorqueParser::IDENTIFIER);
+            break;
+          }
+
+          case 2: {
+            _localctx = _tracker.createInstance<LocationExpressionContext>(
+                parentContext, parentState);
+            pushNewRecursionContext(_localctx, startState,
+                                    RuleLocationExpression);
+            setState(399);
+
+            if (!(precpred(_ctx, 1)))
+              throw FailedPredicateException(this, "precpred(_ctx, 1)");
+            setState(400);
+            match(TorqueParser::T__10);
+            setState(401);
+            expression();
+            setState(402);
+            match(TorqueParser::T__11);
+            break;
+          }
+        }
+      }
+      setState(408);
+      _errHandler->sync(this);
+      alt = getInterpreter<atn::ParserATNSimulator>()->adaptivePredict(
+          _input, 34, _ctx);
+    }
+  } catch (RecognitionException& e) {
+    _errHandler->reportError(this, e);
+    _localctx->exception = std::current_exception();
+    _errHandler->recover(this, _localctx->exception);
+  }
+  return _localctx;
+}
+
+//----------------- IncrementDecrementContext
+//------------------------------------------------------------------
+
+TorqueParser::IncrementDecrementContext::IncrementDecrementContext(
+    ParserRuleContext* parent, size_t invokingState)
+    : ParserRuleContext(parent, invokingState) {}
+
+tree::TerminalNode* TorqueParser::IncrementDecrementContext::INCREMENT() {
+  return getToken(TorqueParser::INCREMENT, 0);
+}
+
+TorqueParser::LocationExpressionContext*
+TorqueParser::IncrementDecrementContext::locationExpression() {
+  return getRuleContext<TorqueParser::LocationExpressionContext>(0);
+}
+
+tree::TerminalNode* TorqueParser::IncrementDecrementContext::DECREMENT() {
+  return getToken(TorqueParser::DECREMENT, 0);
+}
+
+size_t TorqueParser::IncrementDecrementContext::getRuleIndex() const {
+  return TorqueParser::RuleIncrementDecrement;
+}
+
+void TorqueParser::IncrementDecrementContext::enterRule(
+    tree::ParseTreeListener* listener) {
+  auto parserListener = dynamic_cast<TorqueListener*>(listener);
+  if (parserListener != nullptr) parserListener->enterIncrementDecrement(this);
+}
+
+void TorqueParser::IncrementDecrementContext::exitRule(
+    tree::ParseTreeListener* listener) {
+  auto parserListener = dynamic_cast<TorqueListener*>(listener);
+  if (parserListener != nullptr) parserListener->exitIncrementDecrement(this);
+}
+
+antlrcpp::Any TorqueParser::IncrementDecrementContext::accept(
+    tree::ParseTreeVisitor* visitor) {
+  if (auto parserVisitor = dynamic_cast<TorqueVisitor*>(visitor))
+    return parserVisitor->visitIncrementDecrement(this);
+  else
+    return visitor->visitChildren(this);
+}
+
+TorqueParser::IncrementDecrementContext* TorqueParser::incrementDecrement() {
+  IncrementDecrementContext* _localctx =
+      _tracker.createInstance<IncrementDecrementContext>(_ctx, getState());
+  enterRule(_localctx, 48, TorqueParser::RuleIncrementDecrement);
+
+  auto onExit = finally([=] { exitRule(); });
+  try {
+    setState(419);
+    _errHandler->sync(this);
+    switch (getInterpreter<atn::ParserATNSimulator>()->adaptivePredict(
+        _input, 35, _ctx)) {
+      case 1: {
+        enterOuterAlt(_localctx, 1);
+        setState(409);
+        match(TorqueParser::INCREMENT);
+        setState(410);
+        locationExpression(0);
+        break;
+      }
+
+      case 2: {
+        enterOuterAlt(_localctx, 2);
+        setState(411);
+        match(TorqueParser::DECREMENT);
+        setState(412);
+        locationExpression(0);
+        break;
+      }
+
+      case 3: {
+        enterOuterAlt(_localctx, 3);
+        setState(413);
+        locationExpression(0);
+        setState(414);
+        dynamic_cast<IncrementDecrementContext*>(_localctx)->op =
+            match(TorqueParser::INCREMENT);
+        break;
+      }
+
+      case 4: {
+        enterOuterAlt(_localctx, 4);
+        setState(416);
+        locationExpression(0);
+        setState(417);
+        dynamic_cast<IncrementDecrementContext*>(_localctx)->op =
+            match(TorqueParser::DECREMENT);
+        break;
+      }
+    }
+
+  } catch (RecognitionException& e) {
+    _errHandler->reportError(this, e);
+    _localctx->exception = std::current_exception();
+    _errHandler->recover(this, _localctx->exception);
+  }
+
+  return _localctx;
+}
+
+//----------------- AssignmentContext
+//------------------------------------------------------------------
+
+TorqueParser::AssignmentContext::AssignmentContext(ParserRuleContext* parent,
+                                                   size_t invokingState)
+    : ParserRuleContext(parent, invokingState) {}
+
+TorqueParser::IncrementDecrementContext*
+TorqueParser::AssignmentContext::incrementDecrement() {
+  return getRuleContext<TorqueParser::IncrementDecrementContext>(0);
+}
+
+TorqueParser::LocationExpressionContext*
+TorqueParser::AssignmentContext::locationExpression() {
+  return getRuleContext<TorqueParser::LocationExpressionContext>(0);
+}
+
+TorqueParser::ExpressionContext* TorqueParser::AssignmentContext::expression() {
+  return getRuleContext<TorqueParser::ExpressionContext>(0);
+}
+
+tree::TerminalNode* TorqueParser::AssignmentContext::ASSIGNMENT() {
+  return getToken(TorqueParser::ASSIGNMENT, 0);
+}
+
+tree::TerminalNode* TorqueParser::AssignmentContext::ASSIGNMENT_OPERATOR() {
+  return getToken(TorqueParser::ASSIGNMENT_OPERATOR, 0);
+}
+
+size_t TorqueParser::AssignmentContext::getRuleIndex() const {
+  return TorqueParser::RuleAssignment;
+}
+
+void TorqueParser::AssignmentContext::enterRule(
+    tree::ParseTreeListener* listener) {
+  auto parserListener = dynamic_cast<TorqueListener*>(listener);
+  if (parserListener != nullptr) parserListener->enterAssignment(this);
+}
+
+void TorqueParser::AssignmentContext::exitRule(
+    tree::ParseTreeListener* listener) {
+  auto parserListener = dynamic_cast<TorqueListener*>(listener);
+  if (parserListener != nullptr) parserListener->exitAssignment(this);
+}
+
+antlrcpp::Any TorqueParser::AssignmentContext::accept(
+    tree::ParseTreeVisitor* visitor) {
+  if (auto parserVisitor = dynamic_cast<TorqueVisitor*>(visitor))
+    return parserVisitor->visitAssignment(this);
+  else
+    return visitor->visitChildren(this);
+}
+
+TorqueParser::AssignmentContext* TorqueParser::assignment() {
+  AssignmentContext* _localctx =
+      _tracker.createInstance<AssignmentContext>(_ctx, getState());
+  enterRule(_localctx, 50, TorqueParser::RuleAssignment);
+  size_t _la = 0;
+
+  auto onExit = finally([=] { exitRule(); });
+  try {
+    setState(427);
+    _errHandler->sync(this);
+    switch (getInterpreter<atn::ParserATNSimulator>()->adaptivePredict(
+        _input, 37, _ctx)) {
+      case 1: {
+        enterOuterAlt(_localctx, 1);
+        setState(421);
+        incrementDecrement();
+        break;
+      }
+
+      case 2: {
+        enterOuterAlt(_localctx, 2);
+        setState(422);
+        locationExpression(0);
+        setState(425);
+        _errHandler->sync(this);
+
+        switch (getInterpreter<atn::ParserATNSimulator>()->adaptivePredict(
+            _input, 36, _ctx)) {
+          case 1: {
+            setState(423);
+            _la = _input->LA(1);
+            if (!(_la == TorqueParser::ASSIGNMENT
+
+                  || _la == TorqueParser::ASSIGNMENT_OPERATOR)) {
+              _errHandler->recoverInline(this);
+            } else {
+              _errHandler->reportMatch(this);
+              consume();
+            }
+            setState(424);
+            expression();
+            break;
+          }
+        }
+        break;
+      }
+    }
+
+  } catch (RecognitionException& e) {
+    _errHandler->reportError(this, e);
+    _localctx->exception = std::current_exception();
+    _errHandler->recover(this, _localctx->exception);
+  }
+
+  return _localctx;
+}
+
+//----------------- AssignmentExpressionContext
+//------------------------------------------------------------------
+
+TorqueParser::AssignmentExpressionContext::AssignmentExpressionContext(
+    ParserRuleContext* parent, size_t invokingState)
+    : ParserRuleContext(parent, invokingState) {}
+
+TorqueParser::PrimaryExpressionContext*
+TorqueParser::AssignmentExpressionContext::primaryExpression() {
+  return getRuleContext<TorqueParser::PrimaryExpressionContext>(0);
+}
+
+TorqueParser::AssignmentContext*
+TorqueParser::AssignmentExpressionContext::assignment() {
+  return getRuleContext<TorqueParser::AssignmentContext>(0);
+}
+
+size_t TorqueParser::AssignmentExpressionContext::getRuleIndex() const {
+  return TorqueParser::RuleAssignmentExpression;
+}
+
+void TorqueParser::AssignmentExpressionContext::enterRule(
+    tree::ParseTreeListener* listener) {
+  auto parserListener = dynamic_cast<TorqueListener*>(listener);
+  if (parserListener != nullptr)
+    parserListener->enterAssignmentExpression(this);
+}
+
+void TorqueParser::AssignmentExpressionContext::exitRule(
+    tree::ParseTreeListener* listener) {
+  auto parserListener = dynamic_cast<TorqueListener*>(listener);
+  if (parserListener != nullptr) parserListener->exitAssignmentExpression(this);
+}
+
+antlrcpp::Any TorqueParser::AssignmentExpressionContext::accept(
+    tree::ParseTreeVisitor* visitor) {
+  if (auto parserVisitor = dynamic_cast<TorqueVisitor*>(visitor))
+    return parserVisitor->visitAssignmentExpression(this);
+  else
+    return visitor->visitChildren(this);
+}
+
+TorqueParser::AssignmentExpressionContext*
+TorqueParser::assignmentExpression() {
+  AssignmentExpressionContext* _localctx =
+      _tracker.createInstance<AssignmentExpressionContext>(_ctx, getState());
+  enterRule(_localctx, 52, TorqueParser::RuleAssignmentExpression);
+
+  auto onExit = finally([=] { exitRule(); });
+  try {
+    setState(431);
+    _errHandler->sync(this);
+    switch (getInterpreter<atn::ParserATNSimulator>()->adaptivePredict(
+        _input, 38, _ctx)) {
+      case 1: {
+        enterOuterAlt(_localctx, 1);
+        setState(429);
+        primaryExpression();
+        break;
+      }
+
+      case 2: {
+        enterOuterAlt(_localctx, 2);
+        setState(430);
+        assignment();
+        break;
+      }
+    }
+
+  } catch (RecognitionException& e) {
+    _errHandler->reportError(this, e);
+    _localctx->exception = std::current_exception();
+    _errHandler->recover(this, _localctx->exception);
+  }
+
+  return _localctx;
+}
+
+//----------------- PrimaryExpressionContext
+//------------------------------------------------------------------
+
+TorqueParser::PrimaryExpressionContext::PrimaryExpressionContext(
+    ParserRuleContext* parent, size_t invokingState)
+    : ParserRuleContext(parent, invokingState) {}
+
+TorqueParser::HelperCallContext*
+TorqueParser::PrimaryExpressionContext::helperCall() {
+  return getRuleContext<TorqueParser::HelperCallContext>(0);
+}
+
+tree::TerminalNode* TorqueParser::PrimaryExpressionContext::DECIMAL_LITERAL() {
+  return getToken(TorqueParser::DECIMAL_LITERAL, 0);
+}
+
+tree::TerminalNode* TorqueParser::PrimaryExpressionContext::STRING_LITERAL() {
+  return getToken(TorqueParser::STRING_LITERAL, 0);
+}
+
+TorqueParser::ExpressionContext*
+TorqueParser::PrimaryExpressionContext::expression() {
+  return getRuleContext<TorqueParser::ExpressionContext>(0);
+}
+
+
+size_t TorqueParser::PrimaryExpressionContext::getRuleIndex() const {
+  return TorqueParser::RulePrimaryExpression;
+}
+
+void TorqueParser::PrimaryExpressionContext::enterRule(
+    tree::ParseTreeListener* listener) {
+  auto parserListener = dynamic_cast<TorqueListener*>(listener);
+  if (parserListener != nullptr) parserListener->enterPrimaryExpression(this);
+}
+
+void TorqueParser::PrimaryExpressionContext::exitRule(
+    tree::ParseTreeListener* listener) {
+  auto parserListener = dynamic_cast<TorqueListener*>(listener);
+  if (parserListener != nullptr) parserListener->exitPrimaryExpression(this);
+}
+
+antlrcpp::Any TorqueParser::PrimaryExpressionContext::accept(
+    tree::ParseTreeVisitor* visitor) {
+  if (auto parserVisitor = dynamic_cast<TorqueVisitor*>(visitor))
+    return parserVisitor->visitPrimaryExpression(this);
+  else
+    return visitor->visitChildren(this);
+}
+
+TorqueParser::PrimaryExpressionContext* TorqueParser::primaryExpression() {
+  PrimaryExpressionContext* _localctx =
+      _tracker.createInstance<PrimaryExpressionContext>(_ctx, getState());
+  enterRule(_localctx, 54, TorqueParser::RulePrimaryExpression);
+
+  auto onExit = finally([=] { exitRule(); });
+  try {
+    setState(440);
+    _errHandler->sync(this);
+    switch (_input->LA(1)) {
+      case TorqueParser::MAX:
+      case TorqueParser::MIN:
+      case TorqueParser::IDENTIFIER: {
+        enterOuterAlt(_localctx, 1);
+        setState(433);
+        helperCall();
+        break;
+      }
+
+      case TorqueParser::DECIMAL_LITERAL: {
+        enterOuterAlt(_localctx, 2);
+        setState(434);
+        match(TorqueParser::DECIMAL_LITERAL);
+        break;
+      }
+
+      case TorqueParser::STRING_LITERAL: {
+        enterOuterAlt(_localctx, 3);
+        setState(435);
+        match(TorqueParser::STRING_LITERAL);
+        break;
+      }
+
+      case TorqueParser::T__0: {
+        enterOuterAlt(_localctx, 4);
+        setState(436);
+        match(TorqueParser::T__0);
+        setState(437);
+        expression();
+        setState(438);
+        match(TorqueParser::T__1);
+        break;
+      }
+
+      default:
+        throw NoViableAltException(this);
+    }
+
+  } catch (RecognitionException& e) {
+    _errHandler->reportError(this, e);
+    _localctx->exception = std::current_exception();
+    _errHandler->recover(this, _localctx->exception);
+  }
+
+  return _localctx;
+}
+
+//----------------- ForInitializationContext
+//------------------------------------------------------------------
+
+TorqueParser::ForInitializationContext::ForInitializationContext(
+    ParserRuleContext* parent, size_t invokingState)
+    : ParserRuleContext(parent, invokingState) {}
+
+TorqueParser::VariableDeclarationWithInitializationContext* TorqueParser::
+    ForInitializationContext::variableDeclarationWithInitialization() {
+  return getRuleContext<
+      TorqueParser::VariableDeclarationWithInitializationContext>(0);
+}
+
+size_t TorqueParser::ForInitializationContext::getRuleIndex() const {
+  return TorqueParser::RuleForInitialization;
+}
+
+void TorqueParser::ForInitializationContext::enterRule(
+    tree::ParseTreeListener* listener) {
+  auto parserListener = dynamic_cast<TorqueListener*>(listener);
+  if (parserListener != nullptr) parserListener->enterForInitialization(this);
+}
+
+void TorqueParser::ForInitializationContext::exitRule(
+    tree::ParseTreeListener* listener) {
+  auto parserListener = dynamic_cast<TorqueListener*>(listener);
+  if (parserListener != nullptr) parserListener->exitForInitialization(this);
+}
+
+antlrcpp::Any TorqueParser::ForInitializationContext::accept(
+    tree::ParseTreeVisitor* visitor) {
+  if (auto parserVisitor = dynamic_cast<TorqueVisitor*>(visitor))
+    return parserVisitor->visitForInitialization(this);
+  else
+    return visitor->visitChildren(this);
+}
+
+TorqueParser::ForInitializationContext* TorqueParser::forInitialization() {
+  ForInitializationContext* _localctx =
+      _tracker.createInstance<ForInitializationContext>(_ctx, getState());
+  enterRule(_localctx, 56, TorqueParser::RuleForInitialization);
+  size_t _la = 0;
+
+  auto onExit = finally([=] { exitRule(); });
+  try {
+    enterOuterAlt(_localctx, 1);
+    setState(443);
+    _errHandler->sync(this);
+
+    _la = _input->LA(1);
+    if (_la == TorqueParser::LET) {
+      setState(442);
+      variableDeclarationWithInitialization();
+    }
+
+  } catch (RecognitionException& e) {
+    _errHandler->reportError(this, e);
+    _localctx->exception = std::current_exception();
+    _errHandler->recover(this, _localctx->exception);
+  }
+
+  return _localctx;
+}
+
+//----------------- ForLoopContext
+//------------------------------------------------------------------
+
+TorqueParser::ForLoopContext::ForLoopContext(ParserRuleContext* parent,
+                                             size_t invokingState)
+    : ParserRuleContext(parent, invokingState) {}
+
+tree::TerminalNode* TorqueParser::ForLoopContext::FOR() {
+  return getToken(TorqueParser::FOR, 0);
+}
+
+TorqueParser::ForInitializationContext*
+TorqueParser::ForLoopContext::forInitialization() {
+  return getRuleContext<TorqueParser::ForInitializationContext>(0);
+}
+
+TorqueParser::ExpressionContext* TorqueParser::ForLoopContext::expression() {
+  return getRuleContext<TorqueParser::ExpressionContext>(0);
+}
+
+TorqueParser::AssignmentContext* TorqueParser::ForLoopContext::assignment() {
+  return getRuleContext<TorqueParser::AssignmentContext>(0);
+}
+
+TorqueParser::StatementBlockContext*
+TorqueParser::ForLoopContext::statementBlock() {
+  return getRuleContext<TorqueParser::StatementBlockContext>(0);
+}
+
+size_t TorqueParser::ForLoopContext::getRuleIndex() const {
+  return TorqueParser::RuleForLoop;
+}
+
+void TorqueParser::ForLoopContext::enterRule(
+    tree::ParseTreeListener* listener) {
+  auto parserListener = dynamic_cast<TorqueListener*>(listener);
+  if (parserListener != nullptr) parserListener->enterForLoop(this);
+}
+
+void TorqueParser::ForLoopContext::exitRule(tree::ParseTreeListener* listener) {
+  auto parserListener = dynamic_cast<TorqueListener*>(listener);
+  if (parserListener != nullptr) parserListener->exitForLoop(this);
+}
+
+antlrcpp::Any TorqueParser::ForLoopContext::accept(
+    tree::ParseTreeVisitor* visitor) {
+  if (auto parserVisitor = dynamic_cast<TorqueVisitor*>(visitor))
+    return parserVisitor->visitForLoop(this);
+  else
+    return visitor->visitChildren(this);
+}
+
+TorqueParser::ForLoopContext* TorqueParser::forLoop() {
+  ForLoopContext* _localctx =
+      _tracker.createInstance<ForLoopContext>(_ctx, getState());
+  enterRule(_localctx, 58, TorqueParser::RuleForLoop);
+
+  auto onExit = finally([=] { exitRule(); });
+  try {
+    enterOuterAlt(_localctx, 1);
+    setState(445);
+    match(TorqueParser::FOR);
+    setState(446);
+    match(TorqueParser::T__0);
+    setState(447);
+    forInitialization();
+    setState(448);
+    match(TorqueParser::T__12);
+    setState(449);
+    expression();
+    setState(450);
+    match(TorqueParser::T__12);
+    setState(451);
+    assignment();
+    setState(452);
+    match(TorqueParser::T__1);
+    setState(453);
+    statementBlock();
+
+  } catch (RecognitionException& e) {
+    _errHandler->reportError(this, e);
+    _localctx->exception = std::current_exception();
+    _errHandler->recover(this, _localctx->exception);
+  }
+
+  return _localctx;
+}
+
+//----------------- RangeSpecifierContext
+//------------------------------------------------------------------
+
+TorqueParser::RangeSpecifierContext::RangeSpecifierContext(
+    ParserRuleContext* parent, size_t invokingState)
+    : ParserRuleContext(parent, invokingState) {}
+
+std::vector<TorqueParser::ExpressionContext*>
+TorqueParser::RangeSpecifierContext::expression() {
+  return getRuleContexts<TorqueParser::ExpressionContext>();
+}
+
+TorqueParser::ExpressionContext*
+TorqueParser::RangeSpecifierContext::expression(size_t i) {
+  return getRuleContext<TorqueParser::ExpressionContext>(i);
+}
+
+size_t TorqueParser::RangeSpecifierContext::getRuleIndex() const {
+  return TorqueParser::RuleRangeSpecifier;
+}
+
+void TorqueParser::RangeSpecifierContext::enterRule(
+    tree::ParseTreeListener* listener) {
+  auto parserListener = dynamic_cast<TorqueListener*>(listener);
+  if (parserListener != nullptr) parserListener->enterRangeSpecifier(this);
+}
+
+void TorqueParser::RangeSpecifierContext::exitRule(
+    tree::ParseTreeListener* listener) {
+  auto parserListener = dynamic_cast<TorqueListener*>(listener);
+  if (parserListener != nullptr) parserListener->exitRangeSpecifier(this);
+}
+
+antlrcpp::Any TorqueParser::RangeSpecifierContext::accept(
+    tree::ParseTreeVisitor* visitor) {
+  if (auto parserVisitor = dynamic_cast<TorqueVisitor*>(visitor))
+    return parserVisitor->visitRangeSpecifier(this);
+  else
+    return visitor->visitChildren(this);
+}
+
+TorqueParser::RangeSpecifierContext* TorqueParser::rangeSpecifier() {
+  RangeSpecifierContext* _localctx =
+      _tracker.createInstance<RangeSpecifierContext>(_ctx, getState());
+  enterRule(_localctx, 60, TorqueParser::RuleRangeSpecifier);
+  size_t _la = 0;
+
+  auto onExit = finally([=] { exitRule(); });
+  try {
+    enterOuterAlt(_localctx, 1);
+    setState(455);
+    match(TorqueParser::T__10);
+    setState(457);
+    _errHandler->sync(this);
+
+    _la = _input->LA(1);
+    if ((((_la & ~0x3fULL) == 0) &&
+         ((1ULL << _la) &
+          ((1ULL << TorqueParser::T__0) | (1ULL << TorqueParser::PLUS) |
+           (1ULL << TorqueParser::MINUS) | (1ULL << TorqueParser::BIT_NOT) |
+           (1ULL << TorqueParser::MAX) | (1ULL << TorqueParser::MIN))) != 0) ||
+        ((((_la - 72) & ~0x3fULL) == 0) &&
+         ((1ULL << (_la - 72)) &
+          ((1ULL << (TorqueParser::INCREMENT - 72)) |
+           (1ULL << (TorqueParser::DECREMENT - 72)) |
+           (1ULL << (TorqueParser::NOT - 72)) |
+           (1ULL << (TorqueParser::STRING_LITERAL - 72)) |
+           (1ULL << (TorqueParser::IDENTIFIER - 72)) |
+           (1ULL << (TorqueParser::DECIMAL_LITERAL - 72)))) != 0)) {
+      setState(456);
+      dynamic_cast<RangeSpecifierContext*>(_localctx)->begin = expression();
+    }
+    setState(459);
+    match(TorqueParser::T__4);
+    setState(461);
+    _errHandler->sync(this);
+
+    _la = _input->LA(1);
+    if ((((_la & ~0x3fULL) == 0) &&
+         ((1ULL << _la) &
+          ((1ULL << TorqueParser::T__0) | (1ULL << TorqueParser::PLUS) |
+           (1ULL << TorqueParser::MINUS) | (1ULL << TorqueParser::BIT_NOT) |
+           (1ULL << TorqueParser::MAX) | (1ULL << TorqueParser::MIN))) != 0) ||
+        ((((_la - 72) & ~0x3fULL) == 0) &&
+         ((1ULL << (_la - 72)) &
+          ((1ULL << (TorqueParser::INCREMENT - 72)) |
+           (1ULL << (TorqueParser::DECREMENT - 72)) |
+           (1ULL << (TorqueParser::NOT - 72)) |
+           (1ULL << (TorqueParser::STRING_LITERAL - 72)) |
+           (1ULL << (TorqueParser::IDENTIFIER - 72)) |
+           (1ULL << (TorqueParser::DECIMAL_LITERAL - 72)))) != 0)) {
+      setState(460);
+      dynamic_cast<RangeSpecifierContext*>(_localctx)->end = expression();
+    }
+    setState(463);
+    match(TorqueParser::T__11);
+
+  } catch (RecognitionException& e) {
+    _errHandler->reportError(this, e);
+    _localctx->exception = std::current_exception();
+    _errHandler->recover(this, _localctx->exception);
+  }
+
+  return _localctx;
+}
+
+//----------------- ForOfRangeContext
+//------------------------------------------------------------------
+
+TorqueParser::ForOfRangeContext::ForOfRangeContext(ParserRuleContext* parent,
+                                                   size_t invokingState)
+    : ParserRuleContext(parent, invokingState) {}
+
+TorqueParser::RangeSpecifierContext*
+TorqueParser::ForOfRangeContext::rangeSpecifier() {
+  return getRuleContext<TorqueParser::RangeSpecifierContext>(0);
+}
+
+size_t TorqueParser::ForOfRangeContext::getRuleIndex() const {
+  return TorqueParser::RuleForOfRange;
+}
+
+void TorqueParser::ForOfRangeContext::enterRule(
+    tree::ParseTreeListener* listener) {
+  auto parserListener = dynamic_cast<TorqueListener*>(listener);
+  if (parserListener != nullptr) parserListener->enterForOfRange(this);
+}
+
+void TorqueParser::ForOfRangeContext::exitRule(
+    tree::ParseTreeListener* listener) {
+  auto parserListener = dynamic_cast<TorqueListener*>(listener);
+  if (parserListener != nullptr) parserListener->exitForOfRange(this);
+}
+
+antlrcpp::Any TorqueParser::ForOfRangeContext::accept(
+    tree::ParseTreeVisitor* visitor) {
+  if (auto parserVisitor = dynamic_cast<TorqueVisitor*>(visitor))
+    return parserVisitor->visitForOfRange(this);
+  else
+    return visitor->visitChildren(this);
+}
+
+TorqueParser::ForOfRangeContext* TorqueParser::forOfRange() {
+  ForOfRangeContext* _localctx =
+      _tracker.createInstance<ForOfRangeContext>(_ctx, getState());
+  enterRule(_localctx, 62, TorqueParser::RuleForOfRange);
+  size_t _la = 0;
+
+  auto onExit = finally([=] { exitRule(); });
+  try {
+    enterOuterAlt(_localctx, 1);
+    setState(466);
+    _errHandler->sync(this);
+
+    _la = _input->LA(1);
+    if (_la == TorqueParser::T__10) {
+      setState(465);
+      rangeSpecifier();
+    }
+
+  } catch (RecognitionException& e) {
+    _errHandler->reportError(this, e);
+    _localctx->exception = std::current_exception();
+    _errHandler->recover(this, _localctx->exception);
+  }
+
+  return _localctx;
+}
+
+//----------------- ForOfLoopContext
+//------------------------------------------------------------------
+
+TorqueParser::ForOfLoopContext::ForOfLoopContext(ParserRuleContext* parent,
+                                                 size_t invokingState)
+    : ParserRuleContext(parent, invokingState) {}
+
+tree::TerminalNode* TorqueParser::ForOfLoopContext::FOR() {
+  return getToken(TorqueParser::FOR, 0);
+}
+
+TorqueParser::VariableDeclarationContext*
+TorqueParser::ForOfLoopContext::variableDeclaration() {
+  return getRuleContext<TorqueParser::VariableDeclarationContext>(0);
+}
+
+TorqueParser::ExpressionContext* TorqueParser::ForOfLoopContext::expression() {
+  return getRuleContext<TorqueParser::ExpressionContext>(0);
+}
+
+TorqueParser::ForOfRangeContext* TorqueParser::ForOfLoopContext::forOfRange() {
+  return getRuleContext<TorqueParser::ForOfRangeContext>(0);
+}
+
+TorqueParser::StatementBlockContext*
+TorqueParser::ForOfLoopContext::statementBlock() {
+  return getRuleContext<TorqueParser::StatementBlockContext>(0);
+}
+
+size_t TorqueParser::ForOfLoopContext::getRuleIndex() const {
+  return TorqueParser::RuleForOfLoop;
+}
+
+void TorqueParser::ForOfLoopContext::enterRule(
+    tree::ParseTreeListener* listener) {
+  auto parserListener = dynamic_cast<TorqueListener*>(listener);
+  if (parserListener != nullptr) parserListener->enterForOfLoop(this);
+}
+
+void TorqueParser::ForOfLoopContext::exitRule(
+    tree::ParseTreeListener* listener) {
+  auto parserListener = dynamic_cast<TorqueListener*>(listener);
+  if (parserListener != nullptr) parserListener->exitForOfLoop(this);
+}
+
+antlrcpp::Any TorqueParser::ForOfLoopContext::accept(
+    tree::ParseTreeVisitor* visitor) {
+  if (auto parserVisitor = dynamic_cast<TorqueVisitor*>(visitor))
+    return parserVisitor->visitForOfLoop(this);
+  else
+    return visitor->visitChildren(this);
+}
+
+TorqueParser::ForOfLoopContext* TorqueParser::forOfLoop() {
+  ForOfLoopContext* _localctx =
+      _tracker.createInstance<ForOfLoopContext>(_ctx, getState());
+  enterRule(_localctx, 64, TorqueParser::RuleForOfLoop);
+
+  auto onExit = finally([=] { exitRule(); });
+  try {
+    enterOuterAlt(_localctx, 1);
+    setState(468);
+    match(TorqueParser::FOR);
+    setState(469);
+    match(TorqueParser::T__0);
+    setState(470);
+    variableDeclaration();
+    setState(471);
+    match(TorqueParser::T__13);
+    setState(472);
+    expression();
+    setState(473);
+    forOfRange();
+    setState(474);
+    match(TorqueParser::T__1);
+    setState(475);
+    statementBlock();
+
+  } catch (RecognitionException& e) {
+    _errHandler->reportError(this, e);
+    _localctx->exception = std::current_exception();
+    _errHandler->recover(this, _localctx->exception);
+  }
+
+  return _localctx;
+}
+
+//----------------- ArgumentContext
+//------------------------------------------------------------------
+
+TorqueParser::ArgumentContext::ArgumentContext(ParserRuleContext* parent,
+                                               size_t invokingState)
+    : ParserRuleContext(parent, invokingState) {}
+
+TorqueParser::ExpressionContext* TorqueParser::ArgumentContext::expression() {
+  return getRuleContext<TorqueParser::ExpressionContext>(0);
+}
+
+size_t TorqueParser::ArgumentContext::getRuleIndex() const {
+  return TorqueParser::RuleArgument;
+}
+
+void TorqueParser::ArgumentContext::enterRule(
+    tree::ParseTreeListener* listener) {
+  auto parserListener = dynamic_cast<TorqueListener*>(listener);
+  if (parserListener != nullptr) parserListener->enterArgument(this);
+}
+
+void TorqueParser::ArgumentContext::exitRule(
+    tree::ParseTreeListener* listener) {
+  auto parserListener = dynamic_cast<TorqueListener*>(listener);
+  if (parserListener != nullptr) parserListener->exitArgument(this);
+}
+
+antlrcpp::Any TorqueParser::ArgumentContext::accept(
+    tree::ParseTreeVisitor* visitor) {
+  if (auto parserVisitor = dynamic_cast<TorqueVisitor*>(visitor))
+    return parserVisitor->visitArgument(this);
+  else
+    return visitor->visitChildren(this);
+}
+
+TorqueParser::ArgumentContext* TorqueParser::argument() {
+  ArgumentContext* _localctx =
+      _tracker.createInstance<ArgumentContext>(_ctx, getState());
+  enterRule(_localctx, 66, TorqueParser::RuleArgument);
+
+  auto onExit = finally([=] { exitRule(); });
+  try {
+    enterOuterAlt(_localctx, 1);
+    setState(477);
+    expression();
+
+  } catch (RecognitionException& e) {
+    _errHandler->reportError(this, e);
+    _localctx->exception = std::current_exception();
+    _errHandler->recover(this, _localctx->exception);
+  }
+
+  return _localctx;
+}
+
+//----------------- ArgumentListContext
+//------------------------------------------------------------------
+
+TorqueParser::ArgumentListContext::ArgumentListContext(
+    ParserRuleContext* parent, size_t invokingState)
+    : ParserRuleContext(parent, invokingState) {}
+
+std::vector<TorqueParser::ArgumentContext*>
+TorqueParser::ArgumentListContext::argument() {
+  return getRuleContexts<TorqueParser::ArgumentContext>();
+}
+
+TorqueParser::ArgumentContext* TorqueParser::ArgumentListContext::argument(
+    size_t i) {
+  return getRuleContext<TorqueParser::ArgumentContext>(i);
+}
+
+size_t TorqueParser::ArgumentListContext::getRuleIndex() const {
+  return TorqueParser::RuleArgumentList;
+}
+
+void TorqueParser::ArgumentListContext::enterRule(
+    tree::ParseTreeListener* listener) {
+  auto parserListener = dynamic_cast<TorqueListener*>(listener);
+  if (parserListener != nullptr) parserListener->enterArgumentList(this);
+}
+
+void TorqueParser::ArgumentListContext::exitRule(
+    tree::ParseTreeListener* listener) {
+  auto parserListener = dynamic_cast<TorqueListener*>(listener);
+  if (parserListener != nullptr) parserListener->exitArgumentList(this);
+}
+
+antlrcpp::Any TorqueParser::ArgumentListContext::accept(
+    tree::ParseTreeVisitor* visitor) {
+  if (auto parserVisitor = dynamic_cast<TorqueVisitor*>(visitor))
+    return parserVisitor->visitArgumentList(this);
+  else
+    return visitor->visitChildren(this);
+}
+
+TorqueParser::ArgumentListContext* TorqueParser::argumentList() {
+  ArgumentListContext* _localctx =
+      _tracker.createInstance<ArgumentListContext>(_ctx, getState());
+  enterRule(_localctx, 68, TorqueParser::RuleArgumentList);
+  size_t _la = 0;
+
+  auto onExit = finally([=] { exitRule(); });
+  try {
+    enterOuterAlt(_localctx, 1);
+    setState(479);
+    match(TorqueParser::T__0);
+    setState(481);
+    _errHandler->sync(this);
+
+    _la = _input->LA(1);
+    if ((((_la & ~0x3fULL) == 0) &&
+         ((1ULL << _la) &
+          ((1ULL << TorqueParser::T__0) | (1ULL << TorqueParser::PLUS) |
+           (1ULL << TorqueParser::MINUS) | (1ULL << TorqueParser::BIT_NOT) |
+           (1ULL << TorqueParser::MAX) | (1ULL << TorqueParser::MIN))) != 0) ||
+        ((((_la - 72) & ~0x3fULL) == 0) &&
+         ((1ULL << (_la - 72)) &
+          ((1ULL << (TorqueParser::INCREMENT - 72)) |
+           (1ULL << (TorqueParser::DECREMENT - 72)) |
+           (1ULL << (TorqueParser::NOT - 72)) |
+           (1ULL << (TorqueParser::STRING_LITERAL - 72)) |
+           (1ULL << (TorqueParser::IDENTIFIER - 72)) |
+           (1ULL << (TorqueParser::DECIMAL_LITERAL - 72)))) != 0)) {
+      setState(480);
+      argument();
+    }
+    setState(487);
+    _errHandler->sync(this);
+    _la = _input->LA(1);
+    while (_la == TorqueParser::T__3) {
+      setState(483);
+      match(TorqueParser::T__3);
+      setState(484);
+      argument();
+      setState(489);
+      _errHandler->sync(this);
+      _la = _input->LA(1);
+    }
+    setState(490);
+    match(TorqueParser::T__1);
+
+  } catch (RecognitionException& e) {
+    _errHandler->reportError(this, e);
+    _localctx->exception = std::current_exception();
+    _errHandler->recover(this, _localctx->exception);
+  }
+
+  return _localctx;
+}
+
+//----------------- HelperCallContext
+//------------------------------------------------------------------
+
+TorqueParser::HelperCallContext::HelperCallContext(ParserRuleContext* parent,
+                                                   size_t invokingState)
+    : ParserRuleContext(parent, invokingState) {}
+
+TorqueParser::ArgumentListContext*
+TorqueParser::HelperCallContext::argumentList() {
+  return getRuleContext<TorqueParser::ArgumentListContext>(0);
+}
+
+TorqueParser::OptionalOtherwiseContext*
+TorqueParser::HelperCallContext::optionalOtherwise() {
+  return getRuleContext<TorqueParser::OptionalOtherwiseContext>(0);
+}
+
+tree::TerminalNode* TorqueParser::HelperCallContext::MIN() {
+  return getToken(TorqueParser::MIN, 0);
+}
+
+tree::TerminalNode* TorqueParser::HelperCallContext::MAX() {
+  return getToken(TorqueParser::MAX, 0);
+}
+
+tree::TerminalNode* TorqueParser::HelperCallContext::IDENTIFIER() {
+  return getToken(TorqueParser::IDENTIFIER, 0);
+}
+
+TorqueParser::GenericSpecializationTypeListContext*
+TorqueParser::HelperCallContext::genericSpecializationTypeList() {
+  return getRuleContext<TorqueParser::GenericSpecializationTypeListContext>(0);
+}
+
+size_t TorqueParser::HelperCallContext::getRuleIndex() const {
+  return TorqueParser::RuleHelperCall;
+}
+
+void TorqueParser::HelperCallContext::enterRule(
+    tree::ParseTreeListener* listener) {
+  auto parserListener = dynamic_cast<TorqueListener*>(listener);
+  if (parserListener != nullptr) parserListener->enterHelperCall(this);
+}
+
+void TorqueParser::HelperCallContext::exitRule(
+    tree::ParseTreeListener* listener) {
+  auto parserListener = dynamic_cast<TorqueListener*>(listener);
+  if (parserListener != nullptr) parserListener->exitHelperCall(this);
+}
+
+antlrcpp::Any TorqueParser::HelperCallContext::accept(
+    tree::ParseTreeVisitor* visitor) {
+  if (auto parserVisitor = dynamic_cast<TorqueVisitor*>(visitor))
+    return parserVisitor->visitHelperCall(this);
+  else
+    return visitor->visitChildren(this);
+}
+
+TorqueParser::HelperCallContext* TorqueParser::helperCall() {
+  HelperCallContext* _localctx =
+      _tracker.createInstance<HelperCallContext>(_ctx, getState());
+  enterRule(_localctx, 70, TorqueParser::RuleHelperCall);
+  size_t _la = 0;
+
+  auto onExit = finally([=] { exitRule(); });
+  try {
+    enterOuterAlt(_localctx, 1);
+    setState(492);
+    _la = _input->LA(1);
+    if (!(((((_la - 60) & ~0x3fULL) == 0) &&
+           ((1ULL << (_la - 60)) &
+            ((1ULL << (TorqueParser::MAX - 60)) |
+             (1ULL << (TorqueParser::MIN - 60)) |
+             (1ULL << (TorqueParser::IDENTIFIER - 60)))) != 0))) {
+      _errHandler->recoverInline(this);
+    } else {
+      _errHandler->reportMatch(this);
+      consume();
+    }
+    setState(494);
+    _errHandler->sync(this);
+
+    _la = _input->LA(1);
+    if (_la == TorqueParser::LESS_THAN) {
+      setState(493);
+      genericSpecializationTypeList();
+    }
+    setState(496);
+    argumentList();
+    setState(497);
+    optionalOtherwise();
+
+  } catch (RecognitionException& e) {
+    _errHandler->reportError(this, e);
+    _localctx->exception = std::current_exception();
+    _errHandler->recover(this, _localctx->exception);
+  }
+
+  return _localctx;
+}
+
+//----------------- LabelReferenceContext
+//------------------------------------------------------------------
+
+TorqueParser::LabelReferenceContext::LabelReferenceContext(
+    ParserRuleContext* parent, size_t invokingState)
+    : ParserRuleContext(parent, invokingState) {}
+
+tree::TerminalNode* TorqueParser::LabelReferenceContext::IDENTIFIER() {
+  return getToken(TorqueParser::IDENTIFIER, 0);
+}
+
+size_t TorqueParser::LabelReferenceContext::getRuleIndex() const {
+  return TorqueParser::RuleLabelReference;
+}
+
+void TorqueParser::LabelReferenceContext::enterRule(
+    tree::ParseTreeListener* listener) {
+  auto parserListener = dynamic_cast<TorqueListener*>(listener);
+  if (parserListener != nullptr) parserListener->enterLabelReference(this);
+}
+
+void TorqueParser::LabelReferenceContext::exitRule(
+    tree::ParseTreeListener* listener) {
+  auto parserListener = dynamic_cast<TorqueListener*>(listener);
+  if (parserListener != nullptr) parserListener->exitLabelReference(this);
+}
+
+antlrcpp::Any TorqueParser::LabelReferenceContext::accept(
+    tree::ParseTreeVisitor* visitor) {
+  if (auto parserVisitor = dynamic_cast<TorqueVisitor*>(visitor))
+    return parserVisitor->visitLabelReference(this);
+  else
+    return visitor->visitChildren(this);
+}
+
+TorqueParser::LabelReferenceContext* TorqueParser::labelReference() {
+  LabelReferenceContext* _localctx =
+      _tracker.createInstance<LabelReferenceContext>(_ctx, getState());
+  enterRule(_localctx, 72, TorqueParser::RuleLabelReference);
+
+  auto onExit = finally([=] { exitRule(); });
+  try {
+    enterOuterAlt(_localctx, 1);
+    setState(499);
+    match(TorqueParser::IDENTIFIER);
+
+  } catch (RecognitionException& e) {
+    _errHandler->reportError(this, e);
+    _localctx->exception = std::current_exception();
+    _errHandler->recover(this, _localctx->exception);
+  }
+
+  return _localctx;
+}
+
+//----------------- VariableDeclarationContext
+//------------------------------------------------------------------
+
+TorqueParser::VariableDeclarationContext::VariableDeclarationContext(
+    ParserRuleContext* parent, size_t invokingState)
+    : ParserRuleContext(parent, invokingState) {}
+
+tree::TerminalNode* TorqueParser::VariableDeclarationContext::LET() {
+  return getToken(TorqueParser::LET, 0);
+}
+
+tree::TerminalNode* TorqueParser::VariableDeclarationContext::IDENTIFIER() {
+  return getToken(TorqueParser::IDENTIFIER, 0);
+}
+
+TorqueParser::TypeContext* TorqueParser::VariableDeclarationContext::type() {
+  return getRuleContext<TorqueParser::TypeContext>(0);
+}
+
+size_t TorqueParser::VariableDeclarationContext::getRuleIndex() const {
+  return TorqueParser::RuleVariableDeclaration;
+}
+
+void TorqueParser::VariableDeclarationContext::enterRule(
+    tree::ParseTreeListener* listener) {
+  auto parserListener = dynamic_cast<TorqueListener*>(listener);
+  if (parserListener != nullptr) parserListener->enterVariableDeclaration(this);
+}
+
+void TorqueParser::VariableDeclarationContext::exitRule(
+    tree::ParseTreeListener* listener) {
+  auto parserListener = dynamic_cast<TorqueListener*>(listener);
+  if (parserListener != nullptr) parserListener->exitVariableDeclaration(this);
+}
+
+antlrcpp::Any TorqueParser::VariableDeclarationContext::accept(
+    tree::ParseTreeVisitor* visitor) {
+  if (auto parserVisitor = dynamic_cast<TorqueVisitor*>(visitor))
+    return parserVisitor->visitVariableDeclaration(this);
+  else
+    return visitor->visitChildren(this);
+}
+
+TorqueParser::VariableDeclarationContext* TorqueParser::variableDeclaration() {
+  VariableDeclarationContext* _localctx =
+      _tracker.createInstance<VariableDeclarationContext>(_ctx, getState());
+  enterRule(_localctx, 74, TorqueParser::RuleVariableDeclaration);
+
+  auto onExit = finally([=] { exitRule(); });
+  try {
+    enterOuterAlt(_localctx, 1);
+    setState(501);
+    match(TorqueParser::LET);
+    setState(502);
+    match(TorqueParser::IDENTIFIER);
+    setState(503);
+    match(TorqueParser::T__4);
+    setState(504);
+    type(0);
+
+  } catch (RecognitionException& e) {
+    _errHandler->reportError(this, e);
+    _localctx->exception = std::current_exception();
+    _errHandler->recover(this, _localctx->exception);
+  }
+
+  return _localctx;
+}
+
+//----------------- VariableDeclarationWithInitializationContext
+//------------------------------------------------------------------
+
+TorqueParser::VariableDeclarationWithInitializationContext::
+    VariableDeclarationWithInitializationContext(ParserRuleContext* parent,
+                                                 size_t invokingState)
+    : ParserRuleContext(parent, invokingState) {}
+
+TorqueParser::VariableDeclarationContext* TorqueParser::
+    VariableDeclarationWithInitializationContext::variableDeclaration() {
+  return getRuleContext<TorqueParser::VariableDeclarationContext>(0);
+}
+
+tree::TerminalNode*
+TorqueParser::VariableDeclarationWithInitializationContext::ASSIGNMENT() {
+  return getToken(TorqueParser::ASSIGNMENT, 0);
+}
+
+TorqueParser::ExpressionContext*
+TorqueParser::VariableDeclarationWithInitializationContext::expression() {
+  return getRuleContext<TorqueParser::ExpressionContext>(0);
+}
+
+size_t
+TorqueParser::VariableDeclarationWithInitializationContext::getRuleIndex()
+    const {
+  return TorqueParser::RuleVariableDeclarationWithInitialization;
+}
+
+void TorqueParser::VariableDeclarationWithInitializationContext::enterRule(
+    tree::ParseTreeListener* listener) {
+  auto parserListener = dynamic_cast<TorqueListener*>(listener);
+  if (parserListener != nullptr)
+    parserListener->enterVariableDeclarationWithInitialization(this);
+}
+
+void TorqueParser::VariableDeclarationWithInitializationContext::exitRule(
+    tree::ParseTreeListener* listener) {
+  auto parserListener = dynamic_cast<TorqueListener*>(listener);
+  if (parserListener != nullptr)
+    parserListener->exitVariableDeclarationWithInitialization(this);
+}
+
+antlrcpp::Any
+TorqueParser::VariableDeclarationWithInitializationContext::accept(
+    tree::ParseTreeVisitor* visitor) {
+  if (auto parserVisitor = dynamic_cast<TorqueVisitor*>(visitor))
+    return parserVisitor->visitVariableDeclarationWithInitialization(this);
+  else
+    return visitor->visitChildren(this);
+}
+
+TorqueParser::VariableDeclarationWithInitializationContext*
+TorqueParser::variableDeclarationWithInitialization() {
+  VariableDeclarationWithInitializationContext* _localctx =
+      _tracker.createInstance<VariableDeclarationWithInitializationContext>(
+          _ctx, getState());
+  enterRule(_localctx, 76,
+            TorqueParser::RuleVariableDeclarationWithInitialization);
+  size_t _la = 0;
+
+  auto onExit = finally([=] { exitRule(); });
+  try {
+    enterOuterAlt(_localctx, 1);
+    setState(506);
+    variableDeclaration();
+    setState(509);
+    _errHandler->sync(this);
+
+    _la = _input->LA(1);
+    if (_la == TorqueParser::ASSIGNMENT) {
+      setState(507);
+      match(TorqueParser::ASSIGNMENT);
+      setState(508);
+      expression();
+    }
+
+  } catch (RecognitionException& e) {
+    _errHandler->reportError(this, e);
+    _localctx->exception = std::current_exception();
+    _errHandler->recover(this, _localctx->exception);
+  }
+
+  return _localctx;
+}
+
+//----------------- HelperCallStatementContext
+//------------------------------------------------------------------
+
+TorqueParser::HelperCallStatementContext::HelperCallStatementContext(
+    ParserRuleContext* parent, size_t invokingState)
+    : ParserRuleContext(parent, invokingState) {}
+
+TorqueParser::HelperCallContext*
+TorqueParser::HelperCallStatementContext::helperCall() {
+  return getRuleContext<TorqueParser::HelperCallContext>(0);
+}
+
+tree::TerminalNode* TorqueParser::HelperCallStatementContext::TAIL() {
+  return getToken(TorqueParser::TAIL, 0);
+}
+
+size_t TorqueParser::HelperCallStatementContext::getRuleIndex() const {
+  return TorqueParser::RuleHelperCallStatement;
+}
+
+void TorqueParser::HelperCallStatementContext::enterRule(
+    tree::ParseTreeListener* listener) {
+  auto parserListener = dynamic_cast<TorqueListener*>(listener);
+  if (parserListener != nullptr) parserListener->enterHelperCallStatement(this);
+}
+
+void TorqueParser::HelperCallStatementContext::exitRule(
+    tree::ParseTreeListener* listener) {
+  auto parserListener = dynamic_cast<TorqueListener*>(listener);
+  if (parserListener != nullptr) parserListener->exitHelperCallStatement(this);
+}
+
+antlrcpp::Any TorqueParser::HelperCallStatementContext::accept(
+    tree::ParseTreeVisitor* visitor) {
+  if (auto parserVisitor = dynamic_cast<TorqueVisitor*>(visitor))
+    return parserVisitor->visitHelperCallStatement(this);
+  else
+    return visitor->visitChildren(this);
+}
+
+TorqueParser::HelperCallStatementContext* TorqueParser::helperCallStatement() {
+  HelperCallStatementContext* _localctx =
+      _tracker.createInstance<HelperCallStatementContext>(_ctx, getState());
+  enterRule(_localctx, 78, TorqueParser::RuleHelperCallStatement);
+  size_t _la = 0;
+
+  auto onExit = finally([=] { exitRule(); });
+  try {
+    enterOuterAlt(_localctx, 1);
+    setState(512);
+    _errHandler->sync(this);
+
+    _la = _input->LA(1);
+    if (_la == TorqueParser::TAIL) {
+      setState(511);
+      match(TorqueParser::TAIL);
+    }
+    setState(514);
+    helperCall();
+
+  } catch (RecognitionException& e) {
+    _errHandler->reportError(this, e);
+    _localctx->exception = std::current_exception();
+    _errHandler->recover(this, _localctx->exception);
+  }
+
+  return _localctx;
+}
+
+//----------------- ExpressionStatementContext
+//------------------------------------------------------------------
+
+TorqueParser::ExpressionStatementContext::ExpressionStatementContext(
+    ParserRuleContext* parent, size_t invokingState)
+    : ParserRuleContext(parent, invokingState) {}
+
+TorqueParser::AssignmentContext*
+TorqueParser::ExpressionStatementContext::assignment() {
+  return getRuleContext<TorqueParser::AssignmentContext>(0);
+}
+
+size_t TorqueParser::ExpressionStatementContext::getRuleIndex() const {
+  return TorqueParser::RuleExpressionStatement;
+}
+
+void TorqueParser::ExpressionStatementContext::enterRule(
+    tree::ParseTreeListener* listener) {
+  auto parserListener = dynamic_cast<TorqueListener*>(listener);
+  if (parserListener != nullptr) parserListener->enterExpressionStatement(this);
+}
+
+void TorqueParser::ExpressionStatementContext::exitRule(
+    tree::ParseTreeListener* listener) {
+  auto parserListener = dynamic_cast<TorqueListener*>(listener);
+  if (parserListener != nullptr) parserListener->exitExpressionStatement(this);
+}
+
+antlrcpp::Any TorqueParser::ExpressionStatementContext::accept(
+    tree::ParseTreeVisitor* visitor) {
+  if (auto parserVisitor = dynamic_cast<TorqueVisitor*>(visitor))
+    return parserVisitor->visitExpressionStatement(this);
+  else
+    return visitor->visitChildren(this);
+}
+
+TorqueParser::ExpressionStatementContext* TorqueParser::expressionStatement() {
+  ExpressionStatementContext* _localctx =
+      _tracker.createInstance<ExpressionStatementContext>(_ctx, getState());
+  enterRule(_localctx, 80, TorqueParser::RuleExpressionStatement);
+
+  auto onExit = finally([=] { exitRule(); });
+  try {
+    enterOuterAlt(_localctx, 1);
+    setState(516);
+    assignment();
+
+  } catch (RecognitionException& e) {
+    _errHandler->reportError(this, e);
+    _localctx->exception = std::current_exception();
+    _errHandler->recover(this, _localctx->exception);
+  }
+
+  return _localctx;
+}
+
+//----------------- IfStatementContext
+//------------------------------------------------------------------
+
+TorqueParser::IfStatementContext::IfStatementContext(ParserRuleContext* parent,
+                                                     size_t invokingState)
+    : ParserRuleContext(parent, invokingState) {}
+
+tree::TerminalNode* TorqueParser::IfStatementContext::IF() {
+  return getToken(TorqueParser::IF, 0);
+}
+
+TorqueParser::ExpressionContext*
+TorqueParser::IfStatementContext::expression() {
+  return getRuleContext<TorqueParser::ExpressionContext>(0);
+}
+
+std::vector<TorqueParser::StatementBlockContext*>
+TorqueParser::IfStatementContext::statementBlock() {
+  return getRuleContexts<TorqueParser::StatementBlockContext>();
+}
+
+TorqueParser::StatementBlockContext*
+TorqueParser::IfStatementContext::statementBlock(size_t i) {
+  return getRuleContext<TorqueParser::StatementBlockContext>(i);
+}
+
+tree::TerminalNode* TorqueParser::IfStatementContext::CONSTEXPR() {
+  return getToken(TorqueParser::CONSTEXPR, 0);
+}
+
+size_t TorqueParser::IfStatementContext::getRuleIndex() const {
+  return TorqueParser::RuleIfStatement;
+}
+
+void TorqueParser::IfStatementContext::enterRule(
+    tree::ParseTreeListener* listener) {
+  auto parserListener = dynamic_cast<TorqueListener*>(listener);
+  if (parserListener != nullptr) parserListener->enterIfStatement(this);
+}
+
+void TorqueParser::IfStatementContext::exitRule(
+    tree::ParseTreeListener* listener) {
+  auto parserListener = dynamic_cast<TorqueListener*>(listener);
+  if (parserListener != nullptr) parserListener->exitIfStatement(this);
+}
+
+antlrcpp::Any TorqueParser::IfStatementContext::accept(
+    tree::ParseTreeVisitor* visitor) {
+  if (auto parserVisitor = dynamic_cast<TorqueVisitor*>(visitor))
+    return parserVisitor->visitIfStatement(this);
+  else
+    return visitor->visitChildren(this);
+}
+
+TorqueParser::IfStatementContext* TorqueParser::ifStatement() {
+  IfStatementContext* _localctx =
+      _tracker.createInstance<IfStatementContext>(_ctx, getState());
+  enterRule(_localctx, 82, TorqueParser::RuleIfStatement);
+  size_t _la = 0;
+
+  auto onExit = finally([=] { exitRule(); });
+  try {
+    enterOuterAlt(_localctx, 1);
+    setState(518);
+    match(TorqueParser::IF);
+    setState(520);
+    _errHandler->sync(this);
+
+    _la = _input->LA(1);
+    if (_la == TorqueParser::CONSTEXPR) {
+      setState(519);
+      match(TorqueParser::CONSTEXPR);
+    }
+    setState(522);
+    match(TorqueParser::T__0);
+    setState(523);
+    expression();
+    setState(524);
+    match(TorqueParser::T__1);
+    setState(525);
+    statementBlock();
+    setState(528);
+    _errHandler->sync(this);
+
+    switch (getInterpreter<atn::ParserATNSimulator>()->adaptivePredict(
+        _input, 50, _ctx)) {
+      case 1: {
+        setState(526);
+        match(TorqueParser::T__14);
+        setState(527);
+        statementBlock();
+        break;
+      }
+    }
+
+  } catch (RecognitionException& e) {
+    _errHandler->reportError(this, e);
+    _localctx->exception = std::current_exception();
+    _errHandler->recover(this, _localctx->exception);
+  }
+
+  return _localctx;
+}
+
+//----------------- WhileLoopContext
+//------------------------------------------------------------------
+
+TorqueParser::WhileLoopContext::WhileLoopContext(ParserRuleContext* parent,
+                                                 size_t invokingState)
+    : ParserRuleContext(parent, invokingState) {}
+
+tree::TerminalNode* TorqueParser::WhileLoopContext::WHILE() {
+  return getToken(TorqueParser::WHILE, 0);
+}
+
+TorqueParser::ExpressionContext* TorqueParser::WhileLoopContext::expression() {
+  return getRuleContext<TorqueParser::ExpressionContext>(0);
+}
+
+TorqueParser::StatementBlockContext*
+TorqueParser::WhileLoopContext::statementBlock() {
+  return getRuleContext<TorqueParser::StatementBlockContext>(0);
+}
+
+size_t TorqueParser::WhileLoopContext::getRuleIndex() const {
+  return TorqueParser::RuleWhileLoop;
+}
+
+void TorqueParser::WhileLoopContext::enterRule(
+    tree::ParseTreeListener* listener) {
+  auto parserListener = dynamic_cast<TorqueListener*>(listener);
+  if (parserListener != nullptr) parserListener->enterWhileLoop(this);
+}
+
+void TorqueParser::WhileLoopContext::exitRule(
+    tree::ParseTreeListener* listener) {
+  auto parserListener = dynamic_cast<TorqueListener*>(listener);
+  if (parserListener != nullptr) parserListener->exitWhileLoop(this);
+}
+
+antlrcpp::Any TorqueParser::WhileLoopContext::accept(
+    tree::ParseTreeVisitor* visitor) {
+  if (auto parserVisitor = dynamic_cast<TorqueVisitor*>(visitor))
+    return parserVisitor->visitWhileLoop(this);
+  else
+    return visitor->visitChildren(this);
+}
+
+TorqueParser::WhileLoopContext* TorqueParser::whileLoop() {
+  WhileLoopContext* _localctx =
+      _tracker.createInstance<WhileLoopContext>(_ctx, getState());
+  enterRule(_localctx, 84, TorqueParser::RuleWhileLoop);
+
+  auto onExit = finally([=] { exitRule(); });
+  try {
+    enterOuterAlt(_localctx, 1);
+    setState(530);
+    match(TorqueParser::WHILE);
+    setState(531);
+    match(TorqueParser::T__0);
+    setState(532);
+    expression();
+    setState(533);
+    match(TorqueParser::T__1);
+    setState(534);
+    statementBlock();
+
+  } catch (RecognitionException& e) {
+    _errHandler->reportError(this, e);
+    _localctx->exception = std::current_exception();
+    _errHandler->recover(this, _localctx->exception);
+  }
+
+  return _localctx;
+}
+
+//----------------- ReturnStatementContext
+//------------------------------------------------------------------
+
+TorqueParser::ReturnStatementContext::ReturnStatementContext(
+    ParserRuleContext* parent, size_t invokingState)
+    : ParserRuleContext(parent, invokingState) {}
+
+tree::TerminalNode* TorqueParser::ReturnStatementContext::RETURN() {
+  return getToken(TorqueParser::RETURN, 0);
+}
+
+TorqueParser::ExpressionContext*
+TorqueParser::ReturnStatementContext::expression() {
+  return getRuleContext<TorqueParser::ExpressionContext>(0);
+}
+
+size_t TorqueParser::ReturnStatementContext::getRuleIndex() const {
+  return TorqueParser::RuleReturnStatement;
+}
+
+void TorqueParser::ReturnStatementContext::enterRule(
+    tree::ParseTreeListener* listener) {
+  auto parserListener = dynamic_cast<TorqueListener*>(listener);
+  if (parserListener != nullptr) parserListener->enterReturnStatement(this);
+}
+
+void TorqueParser::ReturnStatementContext::exitRule(
+    tree::ParseTreeListener* listener) {
+  auto parserListener = dynamic_cast<TorqueListener*>(listener);
+  if (parserListener != nullptr) parserListener->exitReturnStatement(this);
+}
+
+antlrcpp::Any TorqueParser::ReturnStatementContext::accept(
+    tree::ParseTreeVisitor* visitor) {
+  if (auto parserVisitor = dynamic_cast<TorqueVisitor*>(visitor))
+    return parserVisitor->visitReturnStatement(this);
+  else
+    return visitor->visitChildren(this);
+}
+
+TorqueParser::ReturnStatementContext* TorqueParser::returnStatement() {
+  ReturnStatementContext* _localctx =
+      _tracker.createInstance<ReturnStatementContext>(_ctx, getState());
+  enterRule(_localctx, 86, TorqueParser::RuleReturnStatement);
+  size_t _la = 0;
+
+  auto onExit = finally([=] { exitRule(); });
+  try {
+    enterOuterAlt(_localctx, 1);
+    setState(536);
+    match(TorqueParser::RETURN);
+    setState(538);
+    _errHandler->sync(this);
+
+    _la = _input->LA(1);
+    if ((((_la & ~0x3fULL) == 0) &&
+         ((1ULL << _la) &
+          ((1ULL << TorqueParser::T__0) | (1ULL << TorqueParser::PLUS) |
+           (1ULL << TorqueParser::MINUS) | (1ULL << TorqueParser::BIT_NOT) |
+           (1ULL << TorqueParser::MAX) | (1ULL << TorqueParser::MIN))) != 0) ||
+        ((((_la - 72) & ~0x3fULL) == 0) &&
+         ((1ULL << (_la - 72)) &
+          ((1ULL << (TorqueParser::INCREMENT - 72)) |
+           (1ULL << (TorqueParser::DECREMENT - 72)) |
+           (1ULL << (TorqueParser::NOT - 72)) |
+           (1ULL << (TorqueParser::STRING_LITERAL - 72)) |
+           (1ULL << (TorqueParser::IDENTIFIER - 72)) |
+           (1ULL << (TorqueParser::DECIMAL_LITERAL - 72)))) != 0)) {
+      setState(537);
+      expression();
+    }
+
+  } catch (RecognitionException& e) {
+    _errHandler->reportError(this, e);
+    _localctx->exception = std::current_exception();
+    _errHandler->recover(this, _localctx->exception);
+  }
+
+  return _localctx;
+}
+
+//----------------- BreakStatementContext
+//------------------------------------------------------------------
+
+TorqueParser::BreakStatementContext::BreakStatementContext(
+    ParserRuleContext* parent, size_t invokingState)
+    : ParserRuleContext(parent, invokingState) {}
+
+tree::TerminalNode* TorqueParser::BreakStatementContext::BREAK() {
+  return getToken(TorqueParser::BREAK, 0);
+}
+
+size_t TorqueParser::BreakStatementContext::getRuleIndex() const {
+  return TorqueParser::RuleBreakStatement;
+}
+
+void TorqueParser::BreakStatementContext::enterRule(
+    tree::ParseTreeListener* listener) {
+  auto parserListener = dynamic_cast<TorqueListener*>(listener);
+  if (parserListener != nullptr) parserListener->enterBreakStatement(this);
+}
+
+void TorqueParser::BreakStatementContext::exitRule(
+    tree::ParseTreeListener* listener) {
+  auto parserListener = dynamic_cast<TorqueListener*>(listener);
+  if (parserListener != nullptr) parserListener->exitBreakStatement(this);
+}
+
+antlrcpp::Any TorqueParser::BreakStatementContext::accept(
+    tree::ParseTreeVisitor* visitor) {
+  if (auto parserVisitor = dynamic_cast<TorqueVisitor*>(visitor))
+    return parserVisitor->visitBreakStatement(this);
+  else
+    return visitor->visitChildren(this);
+}
+
+TorqueParser::BreakStatementContext* TorqueParser::breakStatement() {
+  BreakStatementContext* _localctx =
+      _tracker.createInstance<BreakStatementContext>(_ctx, getState());
+  enterRule(_localctx, 88, TorqueParser::RuleBreakStatement);
+
+  auto onExit = finally([=] { exitRule(); });
+  try {
+    enterOuterAlt(_localctx, 1);
+    setState(540);
+    match(TorqueParser::BREAK);
+
+  } catch (RecognitionException& e) {
+    _errHandler->reportError(this, e);
+    _localctx->exception = std::current_exception();
+    _errHandler->recover(this, _localctx->exception);
+  }
+
+  return _localctx;
+}
+
+//----------------- ContinueStatementContext
+//------------------------------------------------------------------
+
+TorqueParser::ContinueStatementContext::ContinueStatementContext(
+    ParserRuleContext* parent, size_t invokingState)
+    : ParserRuleContext(parent, invokingState) {}
+
+tree::TerminalNode* TorqueParser::ContinueStatementContext::CONTINUE() {
+  return getToken(TorqueParser::CONTINUE, 0);
+}
+
+size_t TorqueParser::ContinueStatementContext::getRuleIndex() const {
+  return TorqueParser::RuleContinueStatement;
+}
+
+void TorqueParser::ContinueStatementContext::enterRule(
+    tree::ParseTreeListener* listener) {
+  auto parserListener = dynamic_cast<TorqueListener*>(listener);
+  if (parserListener != nullptr) parserListener->enterContinueStatement(this);
+}
+
+void TorqueParser::ContinueStatementContext::exitRule(
+    tree::ParseTreeListener* listener) {
+  auto parserListener = dynamic_cast<TorqueListener*>(listener);
+  if (parserListener != nullptr) parserListener->exitContinueStatement(this);
+}
+
+antlrcpp::Any TorqueParser::ContinueStatementContext::accept(
+    tree::ParseTreeVisitor* visitor) {
+  if (auto parserVisitor = dynamic_cast<TorqueVisitor*>(visitor))
+    return parserVisitor->visitContinueStatement(this);
+  else
+    return visitor->visitChildren(this);
+}
+
+TorqueParser::ContinueStatementContext* TorqueParser::continueStatement() {
+  ContinueStatementContext* _localctx =
+      _tracker.createInstance<ContinueStatementContext>(_ctx, getState());
+  enterRule(_localctx, 90, TorqueParser::RuleContinueStatement);
+
+  auto onExit = finally([=] { exitRule(); });
+  try {
+    enterOuterAlt(_localctx, 1);
+    setState(542);
+    match(TorqueParser::CONTINUE);
+
+  } catch (RecognitionException& e) {
+    _errHandler->reportError(this, e);
+    _localctx->exception = std::current_exception();
+    _errHandler->recover(this, _localctx->exception);
+  }
+
+  return _localctx;
+}
+
+//----------------- GotoStatementContext
+//------------------------------------------------------------------
+
+TorqueParser::GotoStatementContext::GotoStatementContext(
+    ParserRuleContext* parent, size_t invokingState)
+    : ParserRuleContext(parent, invokingState) {}
+
+tree::TerminalNode* TorqueParser::GotoStatementContext::GOTO() {
+  return getToken(TorqueParser::GOTO, 0);
+}
+
+TorqueParser::LabelReferenceContext*
+TorqueParser::GotoStatementContext::labelReference() {
+  return getRuleContext<TorqueParser::LabelReferenceContext>(0);
+}
+
+TorqueParser::ArgumentListContext*
+TorqueParser::GotoStatementContext::argumentList() {
+  return getRuleContext<TorqueParser::ArgumentListContext>(0);
+}
+
+size_t TorqueParser::GotoStatementContext::getRuleIndex() const {
+  return TorqueParser::RuleGotoStatement;
+}
+
+void TorqueParser::GotoStatementContext::enterRule(
+    tree::ParseTreeListener* listener) {
+  auto parserListener = dynamic_cast<TorqueListener*>(listener);
+  if (parserListener != nullptr) parserListener->enterGotoStatement(this);
+}
+
+void TorqueParser::GotoStatementContext::exitRule(
+    tree::ParseTreeListener* listener) {
+  auto parserListener = dynamic_cast<TorqueListener*>(listener);
+  if (parserListener != nullptr) parserListener->exitGotoStatement(this);
+}
+
+antlrcpp::Any TorqueParser::GotoStatementContext::accept(
+    tree::ParseTreeVisitor* visitor) {
+  if (auto parserVisitor = dynamic_cast<TorqueVisitor*>(visitor))
+    return parserVisitor->visitGotoStatement(this);
+  else
+    return visitor->visitChildren(this);
+}
+
+TorqueParser::GotoStatementContext* TorqueParser::gotoStatement() {
+  GotoStatementContext* _localctx =
+      _tracker.createInstance<GotoStatementContext>(_ctx, getState());
+  enterRule(_localctx, 92, TorqueParser::RuleGotoStatement);
+  size_t _la = 0;
+
+  auto onExit = finally([=] { exitRule(); });
+  try {
+    enterOuterAlt(_localctx, 1);
+    setState(544);
+    match(TorqueParser::GOTO);
+    setState(545);
+    labelReference();
+    setState(547);
+    _errHandler->sync(this);
+
+    _la = _input->LA(1);
+    if (_la == TorqueParser::T__0) {
+      setState(546);
+      argumentList();
+    }
+
+  } catch (RecognitionException& e) {
+    _errHandler->reportError(this, e);
+    _localctx->exception = std::current_exception();
+    _errHandler->recover(this, _localctx->exception);
+  }
+
+  return _localctx;
+}
+
+//----------------- HandlerWithStatementContext
+//------------------------------------------------------------------
+
+TorqueParser::HandlerWithStatementContext::HandlerWithStatementContext(
+    ParserRuleContext* parent, size_t invokingState)
+    : ParserRuleContext(parent, invokingState) {}
+
+tree::TerminalNode* TorqueParser::HandlerWithStatementContext::LABEL() {
+  return getToken(TorqueParser::LABEL, 0);
+}
+
+TorqueParser::LabelDeclarationContext*
+TorqueParser::HandlerWithStatementContext::labelDeclaration() {
+  return getRuleContext<TorqueParser::LabelDeclarationContext>(0);
+}
+
+TorqueParser::StatementBlockContext*
+TorqueParser::HandlerWithStatementContext::statementBlock() {
+  return getRuleContext<TorqueParser::StatementBlockContext>(0);
+}
+
+size_t TorqueParser::HandlerWithStatementContext::getRuleIndex() const {
+  return TorqueParser::RuleHandlerWithStatement;
+}
+
+void TorqueParser::HandlerWithStatementContext::enterRule(
+    tree::ParseTreeListener* listener) {
+  auto parserListener = dynamic_cast<TorqueListener*>(listener);
+  if (parserListener != nullptr)
+    parserListener->enterHandlerWithStatement(this);
+}
+
+void TorqueParser::HandlerWithStatementContext::exitRule(
+    tree::ParseTreeListener* listener) {
+  auto parserListener = dynamic_cast<TorqueListener*>(listener);
+  if (parserListener != nullptr) parserListener->exitHandlerWithStatement(this);
+}
+
+antlrcpp::Any TorqueParser::HandlerWithStatementContext::accept(
+    tree::ParseTreeVisitor* visitor) {
+  if (auto parserVisitor = dynamic_cast<TorqueVisitor*>(visitor))
+    return parserVisitor->visitHandlerWithStatement(this);
+  else
+    return visitor->visitChildren(this);
+}
+
+TorqueParser::HandlerWithStatementContext*
+TorqueParser::handlerWithStatement() {
+  HandlerWithStatementContext* _localctx =
+      _tracker.createInstance<HandlerWithStatementContext>(_ctx, getState());
+  enterRule(_localctx, 94, TorqueParser::RuleHandlerWithStatement);
+
+  auto onExit = finally([=] { exitRule(); });
+  try {
+    enterOuterAlt(_localctx, 1);
+    setState(549);
+    match(TorqueParser::LABEL);
+    setState(550);
+    labelDeclaration();
+    setState(551);
+    statementBlock();
+
+  } catch (RecognitionException& e) {
+    _errHandler->reportError(this, e);
+    _localctx->exception = std::current_exception();
+    _errHandler->recover(this, _localctx->exception);
+  }
+
+  return _localctx;
+}
+
+//----------------- TryLabelStatementContext
+//------------------------------------------------------------------
+
+TorqueParser::TryLabelStatementContext::TryLabelStatementContext(
+    ParserRuleContext* parent, size_t invokingState)
+    : ParserRuleContext(parent, invokingState) {}
+
+tree::TerminalNode* TorqueParser::TryLabelStatementContext::TRY() {
+  return getToken(TorqueParser::TRY, 0);
+}
+
+TorqueParser::StatementBlockContext*
+TorqueParser::TryLabelStatementContext::statementBlock() {
+  return getRuleContext<TorqueParser::StatementBlockContext>(0);
+}
+
+std::vector<TorqueParser::HandlerWithStatementContext*>
+TorqueParser::TryLabelStatementContext::handlerWithStatement() {
+  return getRuleContexts<TorqueParser::HandlerWithStatementContext>();
+}
+
+TorqueParser::HandlerWithStatementContext*
+TorqueParser::TryLabelStatementContext::handlerWithStatement(size_t i) {
+  return getRuleContext<TorqueParser::HandlerWithStatementContext>(i);
+}
+
+size_t TorqueParser::TryLabelStatementContext::getRuleIndex() const {
+  return TorqueParser::RuleTryLabelStatement;
+}
+
+void TorqueParser::TryLabelStatementContext::enterRule(
+    tree::ParseTreeListener* listener) {
+  auto parserListener = dynamic_cast<TorqueListener*>(listener);
+  if (parserListener != nullptr) parserListener->enterTryLabelStatement(this);
+}
+
+void TorqueParser::TryLabelStatementContext::exitRule(
+    tree::ParseTreeListener* listener) {
+  auto parserListener = dynamic_cast<TorqueListener*>(listener);
+  if (parserListener != nullptr) parserListener->exitTryLabelStatement(this);
+}
+
+antlrcpp::Any TorqueParser::TryLabelStatementContext::accept(
+    tree::ParseTreeVisitor* visitor) {
+  if (auto parserVisitor = dynamic_cast<TorqueVisitor*>(visitor))
+    return parserVisitor->visitTryLabelStatement(this);
+  else
+    return visitor->visitChildren(this);
+}
+
+TorqueParser::TryLabelStatementContext* TorqueParser::tryLabelStatement() {
+  TryLabelStatementContext* _localctx =
+      _tracker.createInstance<TryLabelStatementContext>(_ctx, getState());
+  enterRule(_localctx, 96, TorqueParser::RuleTryLabelStatement);
+
+  auto onExit = finally([=] { exitRule(); });
+  try {
+    size_t alt;
+    enterOuterAlt(_localctx, 1);
+    setState(553);
+    match(TorqueParser::TRY);
+    setState(554);
+    statementBlock();
+    setState(556);
+    _errHandler->sync(this);
+    alt = 1;
+    do {
+      switch (alt) {
+        case 1: {
+          setState(555);
+          handlerWithStatement();
+          break;
+        }
+
+        default:
+          throw NoViableAltException(this);
+      }
+      setState(558);
+      _errHandler->sync(this);
+      alt = getInterpreter<atn::ParserATNSimulator>()->adaptivePredict(
+          _input, 53, _ctx);
+    } while (alt != 2 && alt != atn::ATN::INVALID_ALT_NUMBER);
+
+  } catch (RecognitionException& e) {
+    _errHandler->reportError(this, e);
+    _localctx->exception = std::current_exception();
+    _errHandler->recover(this, _localctx->exception);
+  }
+
+  return _localctx;
+}
+
+//----------------- DiagnosticStatementContext
+//------------------------------------------------------------------
+
+TorqueParser::DiagnosticStatementContext::DiagnosticStatementContext(
+    ParserRuleContext* parent, size_t invokingState)
+    : ParserRuleContext(parent, invokingState) {}
+
+TorqueParser::ExpressionContext*
+TorqueParser::DiagnosticStatementContext::expression() {
+  return getRuleContext<TorqueParser::ExpressionContext>(0);
+}
+
+tree::TerminalNode* TorqueParser::DiagnosticStatementContext::ASSERT_TOKEN() {
+  return getToken(TorqueParser::ASSERT_TOKEN, 0);
+}
+
+tree::TerminalNode* TorqueParser::DiagnosticStatementContext::CHECK_TOKEN() {
+  return getToken(TorqueParser::CHECK_TOKEN, 0);
+}
+
+tree::TerminalNode*
+TorqueParser::DiagnosticStatementContext::UNREACHABLE_TOKEN() {
+  return getToken(TorqueParser::UNREACHABLE_TOKEN, 0);
+}
+
+tree::TerminalNode* TorqueParser::DiagnosticStatementContext::DEBUG_TOKEN() {
+  return getToken(TorqueParser::DEBUG_TOKEN, 0);
+}
+
+size_t TorqueParser::DiagnosticStatementContext::getRuleIndex() const {
+  return TorqueParser::RuleDiagnosticStatement;
+}
+
+void TorqueParser::DiagnosticStatementContext::enterRule(
+    tree::ParseTreeListener* listener) {
+  auto parserListener = dynamic_cast<TorqueListener*>(listener);
+  if (parserListener != nullptr) parserListener->enterDiagnosticStatement(this);
+}
+
+void TorqueParser::DiagnosticStatementContext::exitRule(
+    tree::ParseTreeListener* listener) {
+  auto parserListener = dynamic_cast<TorqueListener*>(listener);
+  if (parserListener != nullptr) parserListener->exitDiagnosticStatement(this);
+}
+
+antlrcpp::Any TorqueParser::DiagnosticStatementContext::accept(
+    tree::ParseTreeVisitor* visitor) {
+  if (auto parserVisitor = dynamic_cast<TorqueVisitor*>(visitor))
+    return parserVisitor->visitDiagnosticStatement(this);
+  else
+    return visitor->visitChildren(this);
+}
+
+TorqueParser::DiagnosticStatementContext* TorqueParser::diagnosticStatement() {
+  DiagnosticStatementContext* _localctx =
+      _tracker.createInstance<DiagnosticStatementContext>(_ctx, getState());
+  enterRule(_localctx, 98, TorqueParser::RuleDiagnosticStatement);
+  size_t _la = 0;
+
+  auto onExit = finally([=] { exitRule(); });
+  try {
+    setState(567);
+    _errHandler->sync(this);
+    switch (_input->LA(1)) {
+      case TorqueParser::ASSERT_TOKEN:
+      case TorqueParser::CHECK_TOKEN: {
+        enterOuterAlt(_localctx, 1);
+        setState(560);
+        _la = _input->LA(1);
+        if (!(_la == TorqueParser::ASSERT_TOKEN
+
+              || _la == TorqueParser::CHECK_TOKEN)) {
+          _errHandler->recoverInline(this);
+        } else {
+          _errHandler->reportMatch(this);
+          consume();
+        }
+        setState(561);
+        match(TorqueParser::T__0);
+        setState(562);
+        expression();
+        setState(563);
+        match(TorqueParser::T__1);
+        break;
+      }
+
+      case TorqueParser::UNREACHABLE_TOKEN: {
+        enterOuterAlt(_localctx, 2);
+        setState(565);
+        match(TorqueParser::UNREACHABLE_TOKEN);
+        break;
+      }
+
+      case TorqueParser::DEBUG_TOKEN: {
+        enterOuterAlt(_localctx, 3);
+        setState(566);
+        match(TorqueParser::DEBUG_TOKEN);
+        break;
+      }
+
+      default:
+        throw NoViableAltException(this);
+    }
+
+  } catch (RecognitionException& e) {
+    _errHandler->reportError(this, e);
+    _localctx->exception = std::current_exception();
+    _errHandler->recover(this, _localctx->exception);
+  }
+
+  return _localctx;
+}
+
+//----------------- StatementContext
+//------------------------------------------------------------------
+
+TorqueParser::StatementContext::StatementContext(ParserRuleContext* parent,
+                                                 size_t invokingState)
+    : ParserRuleContext(parent, invokingState) {}
+
+TorqueParser::VariableDeclarationWithInitializationContext*
+TorqueParser::StatementContext::variableDeclarationWithInitialization() {
+  return getRuleContext<
+      TorqueParser::VariableDeclarationWithInitializationContext>(0);
+}
+
+TorqueParser::HelperCallStatementContext*
+TorqueParser::StatementContext::helperCallStatement() {
+  return getRuleContext<TorqueParser::HelperCallStatementContext>(0);
+}
+
+TorqueParser::ExpressionStatementContext*
+TorqueParser::StatementContext::expressionStatement() {
+  return getRuleContext<TorqueParser::ExpressionStatementContext>(0);
+}
+
+TorqueParser::ReturnStatementContext*
+TorqueParser::StatementContext::returnStatement() {
+  return getRuleContext<TorqueParser::ReturnStatementContext>(0);
+}
+
+TorqueParser::BreakStatementContext*
+TorqueParser::StatementContext::breakStatement() {
+  return getRuleContext<TorqueParser::BreakStatementContext>(0);
+}
+
+TorqueParser::ContinueStatementContext*
+TorqueParser::StatementContext::continueStatement() {
+  return getRuleContext<TorqueParser::ContinueStatementContext>(0);
+}
+
+TorqueParser::GotoStatementContext*
+TorqueParser::StatementContext::gotoStatement() {
+  return getRuleContext<TorqueParser::GotoStatementContext>(0);
+}
+
+TorqueParser::IfStatementContext*
+TorqueParser::StatementContext::ifStatement() {
+  return getRuleContext<TorqueParser::IfStatementContext>(0);
+}
+
+TorqueParser::DiagnosticStatementContext*
+TorqueParser::StatementContext::diagnosticStatement() {
+  return getRuleContext<TorqueParser::DiagnosticStatementContext>(0);
+}
+
+TorqueParser::WhileLoopContext* TorqueParser::StatementContext::whileLoop() {
+  return getRuleContext<TorqueParser::WhileLoopContext>(0);
+}
+
+TorqueParser::ForOfLoopContext* TorqueParser::StatementContext::forOfLoop() {
+  return getRuleContext<TorqueParser::ForOfLoopContext>(0);
+}
+
+TorqueParser::ForLoopContext* TorqueParser::StatementContext::forLoop() {
+  return getRuleContext<TorqueParser::ForLoopContext>(0);
+}
+
+TorqueParser::TryLabelStatementContext*
+TorqueParser::StatementContext::tryLabelStatement() {
+  return getRuleContext<TorqueParser::TryLabelStatementContext>(0);
+}
+
+size_t TorqueParser::StatementContext::getRuleIndex() const {
+  return TorqueParser::RuleStatement;
+}
+
+void TorqueParser::StatementContext::enterRule(
+    tree::ParseTreeListener* listener) {
+  auto parserListener = dynamic_cast<TorqueListener*>(listener);
+  if (parserListener != nullptr) parserListener->enterStatement(this);
+}
+
+void TorqueParser::StatementContext::exitRule(
+    tree::ParseTreeListener* listener) {
+  auto parserListener = dynamic_cast<TorqueListener*>(listener);
+  if (parserListener != nullptr) parserListener->exitStatement(this);
+}
+
+antlrcpp::Any TorqueParser::StatementContext::accept(
+    tree::ParseTreeVisitor* visitor) {
+  if (auto parserVisitor = dynamic_cast<TorqueVisitor*>(visitor))
+    return parserVisitor->visitStatement(this);
+  else
+    return visitor->visitChildren(this);
+}
+
+TorqueParser::StatementContext* TorqueParser::statement() {
+  StatementContext* _localctx =
+      _tracker.createInstance<StatementContext>(_ctx, getState());
+  enterRule(_localctx, 100, TorqueParser::RuleStatement);
+
+  auto onExit = finally([=] { exitRule(); });
+  try {
+    setState(598);
+    _errHandler->sync(this);
+    switch (getInterpreter<atn::ParserATNSimulator>()->adaptivePredict(
+        _input, 55, _ctx)) {
+      case 1: {
+        enterOuterAlt(_localctx, 1);
+        setState(569);
+        variableDeclarationWithInitialization();
+        setState(570);
+        match(TorqueParser::T__12);
+        break;
+      }
+
+      case 2: {
+        enterOuterAlt(_localctx, 2);
+        setState(572);
+        helperCallStatement();
+        setState(573);
+        match(TorqueParser::T__12);
+        break;
+      }
+
+      case 3: {
+        enterOuterAlt(_localctx, 3);
+        setState(575);
+        expressionStatement();
+        setState(576);
+        match(TorqueParser::T__12);
+        break;
+      }
+
+      case 4: {
+        enterOuterAlt(_localctx, 4);
+        setState(578);
+        returnStatement();
+        setState(579);
+        match(TorqueParser::T__12);
+        break;
+      }
+
+      case 5: {
+        enterOuterAlt(_localctx, 5);
+        setState(581);
+        breakStatement();
+        setState(582);
+        match(TorqueParser::T__12);
+        break;
+      }
+
+      case 6: {
+        enterOuterAlt(_localctx, 6);
+        setState(584);
+        continueStatement();
+        setState(585);
+        match(TorqueParser::T__12);
+        break;
+      }
+
+      case 7: {
+        enterOuterAlt(_localctx, 7);
+        setState(587);
+        gotoStatement();
+        setState(588);
+        match(TorqueParser::T__12);
+        break;
+      }
+
+      case 8: {
+        enterOuterAlt(_localctx, 8);
+        setState(590);
+        ifStatement();
+        break;
+      }
+
+      case 9: {
+        enterOuterAlt(_localctx, 9);
+        setState(591);
+        diagnosticStatement();
+        setState(592);
+        match(TorqueParser::T__12);
+        break;
+      }
+
+      case 10: {
+        enterOuterAlt(_localctx, 10);
+        setState(594);
+        whileLoop();
+        break;
+      }
+
+      case 11: {
+        enterOuterAlt(_localctx, 11);
+        setState(595);
+        forOfLoop();
+        break;
+      }
+
+      case 12: {
+        enterOuterAlt(_localctx, 12);
+        setState(596);
+        forLoop();
+        break;
+      }
+
+      case 13: {
+        enterOuterAlt(_localctx, 13);
+        setState(597);
+        tryLabelStatement();
+        break;
+      }
+    }
+
+  } catch (RecognitionException& e) {
+    _errHandler->reportError(this, e);
+    _localctx->exception = std::current_exception();
+    _errHandler->recover(this, _localctx->exception);
+  }
+
+  return _localctx;
+}
+
+//----------------- StatementListContext
+//------------------------------------------------------------------
+
+TorqueParser::StatementListContext::StatementListContext(
+    ParserRuleContext* parent, size_t invokingState)
+    : ParserRuleContext(parent, invokingState) {}
+
+std::vector<TorqueParser::StatementContext*>
+TorqueParser::StatementListContext::statement() {
+  return getRuleContexts<TorqueParser::StatementContext>();
+}
+
+TorqueParser::StatementContext* TorqueParser::StatementListContext::statement(
+    size_t i) {
+  return getRuleContext<TorqueParser::StatementContext>(i);
+}
+
+size_t TorqueParser::StatementListContext::getRuleIndex() const {
+  return TorqueParser::RuleStatementList;
+}
+
+void TorqueParser::StatementListContext::enterRule(
+    tree::ParseTreeListener* listener) {
+  auto parserListener = dynamic_cast<TorqueListener*>(listener);
+  if (parserListener != nullptr) parserListener->enterStatementList(this);
+}
+
+void TorqueParser::StatementListContext::exitRule(
+    tree::ParseTreeListener* listener) {
+  auto parserListener = dynamic_cast<TorqueListener*>(listener);
+  if (parserListener != nullptr) parserListener->exitStatementList(this);
+}
+
+antlrcpp::Any TorqueParser::StatementListContext::accept(
+    tree::ParseTreeVisitor* visitor) {
+  if (auto parserVisitor = dynamic_cast<TorqueVisitor*>(visitor))
+    return parserVisitor->visitStatementList(this);
+  else
+    return visitor->visitChildren(this);
+}
+
+TorqueParser::StatementListContext* TorqueParser::statementList() {
+  StatementListContext* _localctx =
+      _tracker.createInstance<StatementListContext>(_ctx, getState());
+  enterRule(_localctx, 102, TorqueParser::RuleStatementList);
+  size_t _la = 0;
+
+  auto onExit = finally([=] { exitRule(); });
+  try {
+    enterOuterAlt(_localctx, 1);
+    setState(603);
+    _errHandler->sync(this);
+    _la = _input->LA(1);
+    while (((((_la - 28) & ~0x3fULL) == 0) &&
+            ((1ULL << (_la - 28)) &
+             ((1ULL << (TorqueParser::IF - 28)) |
+              (1ULL << (TorqueParser::FOR - 28)) |
+              (1ULL << (TorqueParser::WHILE - 28)) |
+              (1ULL << (TorqueParser::RETURN - 28)) |
+              (1ULL << (TorqueParser::CONTINUE - 28)) |
+              (1ULL << (TorqueParser::BREAK - 28)) |
+              (1ULL << (TorqueParser::GOTO - 28)) |
+              (1ULL << (TorqueParser::TRY - 28)) |
+              (1ULL << (TorqueParser::TAIL - 28)) |
+              (1ULL << (TorqueParser::LET - 28)) |
+              (1ULL << (TorqueParser::ASSERT_TOKEN - 28)) |
+              (1ULL << (TorqueParser::CHECK_TOKEN - 28)) |
+              (1ULL << (TorqueParser::UNREACHABLE_TOKEN - 28)) |
+              (1ULL << (TorqueParser::DEBUG_TOKEN - 28)) |
+              (1ULL << (TorqueParser::MAX - 28)) |
+              (1ULL << (TorqueParser::MIN - 28)) |
+              (1ULL << (TorqueParser::INCREMENT - 28)) |
+              (1ULL << (TorqueParser::DECREMENT - 28)) |
+              (1ULL << (TorqueParser::IDENTIFIER - 28)))) != 0)) {
+      setState(600);
+      statement();
+      setState(605);
+      _errHandler->sync(this);
+      _la = _input->LA(1);
+    }
+
+  } catch (RecognitionException& e) {
+    _errHandler->reportError(this, e);
+    _localctx->exception = std::current_exception();
+    _errHandler->recover(this, _localctx->exception);
+  }
+
+  return _localctx;
+}
+
+//----------------- StatementScopeContext
+//------------------------------------------------------------------
+
+TorqueParser::StatementScopeContext::StatementScopeContext(
+    ParserRuleContext* parent, size_t invokingState)
+    : ParserRuleContext(parent, invokingState) {}
+
+TorqueParser::StatementListContext*
+TorqueParser::StatementScopeContext::statementList() {
+  return getRuleContext<TorqueParser::StatementListContext>(0);
+}
+
+tree::TerminalNode* TorqueParser::StatementScopeContext::DEFERRED() {
+  return getToken(TorqueParser::DEFERRED, 0);
+}
+
+size_t TorqueParser::StatementScopeContext::getRuleIndex() const {
+  return TorqueParser::RuleStatementScope;
+}
+
+void TorqueParser::StatementScopeContext::enterRule(
+    tree::ParseTreeListener* listener) {
+  auto parserListener = dynamic_cast<TorqueListener*>(listener);
+  if (parserListener != nullptr) parserListener->enterStatementScope(this);
+}
+
+void TorqueParser::StatementScopeContext::exitRule(
+    tree::ParseTreeListener* listener) {
+  auto parserListener = dynamic_cast<TorqueListener*>(listener);
+  if (parserListener != nullptr) parserListener->exitStatementScope(this);
+}
+
+antlrcpp::Any TorqueParser::StatementScopeContext::accept(
+    tree::ParseTreeVisitor* visitor) {
+  if (auto parserVisitor = dynamic_cast<TorqueVisitor*>(visitor))
+    return parserVisitor->visitStatementScope(this);
+  else
+    return visitor->visitChildren(this);
+}
+
+TorqueParser::StatementScopeContext* TorqueParser::statementScope() {
+  StatementScopeContext* _localctx =
+      _tracker.createInstance<StatementScopeContext>(_ctx, getState());
+  enterRule(_localctx, 104, TorqueParser::RuleStatementScope);
+  size_t _la = 0;
+
+  auto onExit = finally([=] { exitRule(); });
+  try {
+    enterOuterAlt(_localctx, 1);
+    setState(607);
+    _errHandler->sync(this);
+
+    _la = _input->LA(1);
+    if (_la == TorqueParser::DEFERRED) {
+      setState(606);
+      match(TorqueParser::DEFERRED);
+    }
+    setState(609);
+    match(TorqueParser::T__15);
+    setState(610);
+    statementList();
+    setState(611);
+    match(TorqueParser::T__16);
+
+  } catch (RecognitionException& e) {
+    _errHandler->reportError(this, e);
+    _localctx->exception = std::current_exception();
+    _errHandler->recover(this, _localctx->exception);
+  }
+
+  return _localctx;
+}
+
+//----------------- StatementBlockContext
+//------------------------------------------------------------------
+
+TorqueParser::StatementBlockContext::StatementBlockContext(
+    ParserRuleContext* parent, size_t invokingState)
+    : ParserRuleContext(parent, invokingState) {}
+
+TorqueParser::StatementContext*
+TorqueParser::StatementBlockContext::statement() {
+  return getRuleContext<TorqueParser::StatementContext>(0);
+}
+
+TorqueParser::StatementScopeContext*
+TorqueParser::StatementBlockContext::statementScope() {
+  return getRuleContext<TorqueParser::StatementScopeContext>(0);
+}
+
+size_t TorqueParser::StatementBlockContext::getRuleIndex() const {
+  return TorqueParser::RuleStatementBlock;
+}
+
+void TorqueParser::StatementBlockContext::enterRule(
+    tree::ParseTreeListener* listener) {
+  auto parserListener = dynamic_cast<TorqueListener*>(listener);
+  if (parserListener != nullptr) parserListener->enterStatementBlock(this);
+}
+
+void TorqueParser::StatementBlockContext::exitRule(
+    tree::ParseTreeListener* listener) {
+  auto parserListener = dynamic_cast<TorqueListener*>(listener);
+  if (parserListener != nullptr) parserListener->exitStatementBlock(this);
+}
+
+antlrcpp::Any TorqueParser::StatementBlockContext::accept(
+    tree::ParseTreeVisitor* visitor) {
+  if (auto parserVisitor = dynamic_cast<TorqueVisitor*>(visitor))
+    return parserVisitor->visitStatementBlock(this);
+  else
+    return visitor->visitChildren(this);
+}
+
+TorqueParser::StatementBlockContext* TorqueParser::statementBlock() {
+  StatementBlockContext* _localctx =
+      _tracker.createInstance<StatementBlockContext>(_ctx, getState());
+  enterRule(_localctx, 106, TorqueParser::RuleStatementBlock);
+
+  auto onExit = finally([=] { exitRule(); });
+  try {
+    setState(615);
+    _errHandler->sync(this);
+    switch (_input->LA(1)) {
+      case TorqueParser::IF:
+      case TorqueParser::FOR:
+      case TorqueParser::WHILE:
+      case TorqueParser::RETURN:
+      case TorqueParser::CONTINUE:
+      case TorqueParser::BREAK:
+      case TorqueParser::GOTO:
+      case TorqueParser::TRY:
+      case TorqueParser::TAIL:
+      case TorqueParser::LET:
+      case TorqueParser::ASSERT_TOKEN:
+      case TorqueParser::CHECK_TOKEN:
+      case TorqueParser::UNREACHABLE_TOKEN:
+      case TorqueParser::DEBUG_TOKEN:
+      case TorqueParser::MAX:
+      case TorqueParser::MIN:
+      case TorqueParser::INCREMENT:
+      case TorqueParser::DECREMENT:
+      case TorqueParser::IDENTIFIER: {
+        enterOuterAlt(_localctx, 1);
+        setState(613);
+        statement();
+        break;
+      }
+
+      case TorqueParser::T__15:
+      case TorqueParser::DEFERRED: {
+        enterOuterAlt(_localctx, 2);
+        setState(614);
+        statementScope();
+        break;
+      }
+
+      default:
+        throw NoViableAltException(this);
+    }
+
+  } catch (RecognitionException& e) {
+    _errHandler->reportError(this, e);
+    _localctx->exception = std::current_exception();
+    _errHandler->recover(this, _localctx->exception);
+  }
+
+  return _localctx;
+}
+
+//----------------- HelperBodyContext
+//------------------------------------------------------------------
+
+TorqueParser::HelperBodyContext::HelperBodyContext(ParserRuleContext* parent,
+                                                   size_t invokingState)
+    : ParserRuleContext(parent, invokingState) {}
+
+TorqueParser::StatementScopeContext*
+TorqueParser::HelperBodyContext::statementScope() {
+  return getRuleContext<TorqueParser::StatementScopeContext>(0);
+}
+
+size_t TorqueParser::HelperBodyContext::getRuleIndex() const {
+  return TorqueParser::RuleHelperBody;
+}
+
+void TorqueParser::HelperBodyContext::enterRule(
+    tree::ParseTreeListener* listener) {
+  auto parserListener = dynamic_cast<TorqueListener*>(listener);
+  if (parserListener != nullptr) parserListener->enterHelperBody(this);
+}
+
+void TorqueParser::HelperBodyContext::exitRule(
+    tree::ParseTreeListener* listener) {
+  auto parserListener = dynamic_cast<TorqueListener*>(listener);
+  if (parserListener != nullptr) parserListener->exitHelperBody(this);
+}
+
+antlrcpp::Any TorqueParser::HelperBodyContext::accept(
+    tree::ParseTreeVisitor* visitor) {
+  if (auto parserVisitor = dynamic_cast<TorqueVisitor*>(visitor))
+    return parserVisitor->visitHelperBody(this);
+  else
+    return visitor->visitChildren(this);
+}
+
+TorqueParser::HelperBodyContext* TorqueParser::helperBody() {
+  HelperBodyContext* _localctx =
+      _tracker.createInstance<HelperBodyContext>(_ctx, getState());
+  enterRule(_localctx, 108, TorqueParser::RuleHelperBody);
+
+  auto onExit = finally([=] { exitRule(); });
+  try {
+    enterOuterAlt(_localctx, 1);
+    setState(617);
+    statementScope();
+
+  } catch (RecognitionException& e) {
+    _errHandler->reportError(this, e);
+    _localctx->exception = std::current_exception();
+    _errHandler->recover(this, _localctx->exception);
+  }
+
+  return _localctx;
+}
+
+//----------------- ExtendsDeclarationContext
+//------------------------------------------------------------------
+
+TorqueParser::ExtendsDeclarationContext::ExtendsDeclarationContext(
+    ParserRuleContext* parent, size_t invokingState)
+    : ParserRuleContext(parent, invokingState) {}
+
+tree::TerminalNode* TorqueParser::ExtendsDeclarationContext::IDENTIFIER() {
+  return getToken(TorqueParser::IDENTIFIER, 0);
+}
+
+size_t TorqueParser::ExtendsDeclarationContext::getRuleIndex() const {
+  return TorqueParser::RuleExtendsDeclaration;
+}
+
+void TorqueParser::ExtendsDeclarationContext::enterRule(
+    tree::ParseTreeListener* listener) {
+  auto parserListener = dynamic_cast<TorqueListener*>(listener);
+  if (parserListener != nullptr) parserListener->enterExtendsDeclaration(this);
+}
+
+void TorqueParser::ExtendsDeclarationContext::exitRule(
+    tree::ParseTreeListener* listener) {
+  auto parserListener = dynamic_cast<TorqueListener*>(listener);
+  if (parserListener != nullptr) parserListener->exitExtendsDeclaration(this);
+}
+
+antlrcpp::Any TorqueParser::ExtendsDeclarationContext::accept(
+    tree::ParseTreeVisitor* visitor) {
+  if (auto parserVisitor = dynamic_cast<TorqueVisitor*>(visitor))
+    return parserVisitor->visitExtendsDeclaration(this);
+  else
+    return visitor->visitChildren(this);
+}
+
+TorqueParser::ExtendsDeclarationContext* TorqueParser::extendsDeclaration() {
+  ExtendsDeclarationContext* _localctx =
+      _tracker.createInstance<ExtendsDeclarationContext>(_ctx, getState());
+  enterRule(_localctx, 110, TorqueParser::RuleExtendsDeclaration);
+
+  auto onExit = finally([=] { exitRule(); });
+  try {
+    enterOuterAlt(_localctx, 1);
+    setState(619);
+    match(TorqueParser::T__17);
+    setState(620);
+    match(TorqueParser::IDENTIFIER);
+
+  } catch (RecognitionException& e) {
+    _errHandler->reportError(this, e);
+    _localctx->exception = std::current_exception();
+    _errHandler->recover(this, _localctx->exception);
+  }
+
+  return _localctx;
+}
+
+//----------------- GeneratesDeclarationContext
+//------------------------------------------------------------------
+
+TorqueParser::GeneratesDeclarationContext::GeneratesDeclarationContext(
+    ParserRuleContext* parent, size_t invokingState)
+    : ParserRuleContext(parent, invokingState) {}
+
+tree::TerminalNode*
+TorqueParser::GeneratesDeclarationContext::STRING_LITERAL() {
+  return getToken(TorqueParser::STRING_LITERAL, 0);
+}
+
+size_t TorqueParser::GeneratesDeclarationContext::getRuleIndex() const {
+  return TorqueParser::RuleGeneratesDeclaration;
+}
+
+void TorqueParser::GeneratesDeclarationContext::enterRule(
+    tree::ParseTreeListener* listener) {
+  auto parserListener = dynamic_cast<TorqueListener*>(listener);
+  if (parserListener != nullptr)
+    parserListener->enterGeneratesDeclaration(this);
+}
+
+void TorqueParser::GeneratesDeclarationContext::exitRule(
+    tree::ParseTreeListener* listener) {
+  auto parserListener = dynamic_cast<TorqueListener*>(listener);
+  if (parserListener != nullptr) parserListener->exitGeneratesDeclaration(this);
+}
+
+antlrcpp::Any TorqueParser::GeneratesDeclarationContext::accept(
+    tree::ParseTreeVisitor* visitor) {
+  if (auto parserVisitor = dynamic_cast<TorqueVisitor*>(visitor))
+    return parserVisitor->visitGeneratesDeclaration(this);
+  else
+    return visitor->visitChildren(this);
+}
+
+TorqueParser::GeneratesDeclarationContext*
+TorqueParser::generatesDeclaration() {
+  GeneratesDeclarationContext* _localctx =
+      _tracker.createInstance<GeneratesDeclarationContext>(_ctx, getState());
+  enterRule(_localctx, 112, TorqueParser::RuleGeneratesDeclaration);
+
+  auto onExit = finally([=] { exitRule(); });
+  try {
+    enterOuterAlt(_localctx, 1);
+    setState(622);
+    match(TorqueParser::T__18);
+    setState(623);
+    match(TorqueParser::STRING_LITERAL);
+
+  } catch (RecognitionException& e) {
+    _errHandler->reportError(this, e);
+    _localctx->exception = std::current_exception();
+    _errHandler->recover(this, _localctx->exception);
+  }
+
+  return _localctx;
+}
+
+//----------------- ConstexprDeclarationContext
+//------------------------------------------------------------------
+
+TorqueParser::ConstexprDeclarationContext::ConstexprDeclarationContext(
+    ParserRuleContext* parent, size_t invokingState)
+    : ParserRuleContext(parent, invokingState) {}
+
+tree::TerminalNode*
+TorqueParser::ConstexprDeclarationContext::STRING_LITERAL() {
+  return getToken(TorqueParser::STRING_LITERAL, 0);
+}
+
+size_t TorqueParser::ConstexprDeclarationContext::getRuleIndex() const {
+  return TorqueParser::RuleConstexprDeclaration;
+}
+
+void TorqueParser::ConstexprDeclarationContext::enterRule(
+    tree::ParseTreeListener* listener) {
+  auto parserListener = dynamic_cast<TorqueListener*>(listener);
+  if (parserListener != nullptr)
+    parserListener->enterConstexprDeclaration(this);
+}
+
+void TorqueParser::ConstexprDeclarationContext::exitRule(
+    tree::ParseTreeListener* listener) {
+  auto parserListener = dynamic_cast<TorqueListener*>(listener);
+  if (parserListener != nullptr) parserListener->exitConstexprDeclaration(this);
+}
+
+antlrcpp::Any TorqueParser::ConstexprDeclarationContext::accept(
+    tree::ParseTreeVisitor* visitor) {
+  if (auto parserVisitor = dynamic_cast<TorqueVisitor*>(visitor))
+    return parserVisitor->visitConstexprDeclaration(this);
+  else
+    return visitor->visitChildren(this);
+}
+
+TorqueParser::ConstexprDeclarationContext*
+TorqueParser::constexprDeclaration() {
+  ConstexprDeclarationContext* _localctx =
+      _tracker.createInstance<ConstexprDeclarationContext>(_ctx, getState());
+  enterRule(_localctx, 114, TorqueParser::RuleConstexprDeclaration);
+
+  auto onExit = finally([=] { exitRule(); });
+  try {
+    enterOuterAlt(_localctx, 1);
+    setState(625);
+    match(TorqueParser::CONSTEXPR);
+    setState(626);
+    match(TorqueParser::STRING_LITERAL);
+
+  } catch (RecognitionException& e) {
+    _errHandler->reportError(this, e);
+    _localctx->exception = std::current_exception();
+    _errHandler->recover(this, _localctx->exception);
+  }
+
+  return _localctx;
+}
+
+//----------------- TypeDeclarationContext
+//------------------------------------------------------------------
+
+TorqueParser::TypeDeclarationContext::TypeDeclarationContext(
+    ParserRuleContext* parent, size_t invokingState)
+    : ParserRuleContext(parent, invokingState) {}
+
+tree::TerminalNode* TorqueParser::TypeDeclarationContext::IDENTIFIER() {
+  return getToken(TorqueParser::IDENTIFIER, 0);
+}
+
+TorqueParser::ExtendsDeclarationContext*
+TorqueParser::TypeDeclarationContext::extendsDeclaration() {
+  return getRuleContext<TorqueParser::ExtendsDeclarationContext>(0);
+}
+
+TorqueParser::GeneratesDeclarationContext*
+TorqueParser::TypeDeclarationContext::generatesDeclaration() {
+  return getRuleContext<TorqueParser::GeneratesDeclarationContext>(0);
+}
+
+TorqueParser::ConstexprDeclarationContext*
+TorqueParser::TypeDeclarationContext::constexprDeclaration() {
+  return getRuleContext<TorqueParser::ConstexprDeclarationContext>(0);
+}
+
+size_t TorqueParser::TypeDeclarationContext::getRuleIndex() const {
+  return TorqueParser::RuleTypeDeclaration;
+}
+
+void TorqueParser::TypeDeclarationContext::enterRule(
+    tree::ParseTreeListener* listener) {
+  auto parserListener = dynamic_cast<TorqueListener*>(listener);
+  if (parserListener != nullptr) parserListener->enterTypeDeclaration(this);
+}
+
+void TorqueParser::TypeDeclarationContext::exitRule(
+    tree::ParseTreeListener* listener) {
+  auto parserListener = dynamic_cast<TorqueListener*>(listener);
+  if (parserListener != nullptr) parserListener->exitTypeDeclaration(this);
+}
+
+antlrcpp::Any TorqueParser::TypeDeclarationContext::accept(
+    tree::ParseTreeVisitor* visitor) {
+  if (auto parserVisitor = dynamic_cast<TorqueVisitor*>(visitor))
+    return parserVisitor->visitTypeDeclaration(this);
+  else
+    return visitor->visitChildren(this);
+}
+
+TorqueParser::TypeDeclarationContext* TorqueParser::typeDeclaration() {
+  TypeDeclarationContext* _localctx =
+      _tracker.createInstance<TypeDeclarationContext>(_ctx, getState());
+  enterRule(_localctx, 116, TorqueParser::RuleTypeDeclaration);
+  size_t _la = 0;
+
+  auto onExit = finally([=] { exitRule(); });
+  try {
+    enterOuterAlt(_localctx, 1);
+    setState(628);
+    match(TorqueParser::T__5);
+    setState(629);
+    match(TorqueParser::IDENTIFIER);
+    setState(631);
+    _errHandler->sync(this);
+
+    _la = _input->LA(1);
+    if (_la == TorqueParser::T__17) {
+      setState(630);
+      extendsDeclaration();
+    }
+    setState(634);
+    _errHandler->sync(this);
+
+    _la = _input->LA(1);
+    if (_la == TorqueParser::T__18) {
+      setState(633);
+      generatesDeclaration();
+    }
+    setState(637);
+    _errHandler->sync(this);
+
+    _la = _input->LA(1);
+    if (_la == TorqueParser::CONSTEXPR) {
+      setState(636);
+      constexprDeclaration();
+    }
+    setState(639);
+    match(TorqueParser::T__12);
+
+  } catch (RecognitionException& e) {
+    _errHandler->reportError(this, e);
+    _localctx->exception = std::current_exception();
+    _errHandler->recover(this, _localctx->exception);
+  }
+
+  return _localctx;
+}
+
+//----------------- TypeAliasDeclarationContext
+//------------------------------------------------------------------
+
+TorqueParser::TypeAliasDeclarationContext::TypeAliasDeclarationContext(
+    ParserRuleContext* parent, size_t invokingState)
+    : ParserRuleContext(parent, invokingState) {}
+
+tree::TerminalNode* TorqueParser::TypeAliasDeclarationContext::IDENTIFIER() {
+  return getToken(TorqueParser::IDENTIFIER, 0);
+}
+
+TorqueParser::TypeContext* TorqueParser::TypeAliasDeclarationContext::type() {
+  return getRuleContext<TorqueParser::TypeContext>(0);
+}
+
+size_t TorqueParser::TypeAliasDeclarationContext::getRuleIndex() const {
+  return TorqueParser::RuleTypeAliasDeclaration;
+}
+
+void TorqueParser::TypeAliasDeclarationContext::enterRule(
+    tree::ParseTreeListener* listener) {
+  auto parserListener = dynamic_cast<TorqueListener*>(listener);
+  if (parserListener != nullptr)
+    parserListener->enterTypeAliasDeclaration(this);
+}
+
+void TorqueParser::TypeAliasDeclarationContext::exitRule(
+    tree::ParseTreeListener* listener) {
+  auto parserListener = dynamic_cast<TorqueListener*>(listener);
+  if (parserListener != nullptr) parserListener->exitTypeAliasDeclaration(this);
+}
+
+antlrcpp::Any TorqueParser::TypeAliasDeclarationContext::accept(
+    tree::ParseTreeVisitor* visitor) {
+  if (auto parserVisitor = dynamic_cast<TorqueVisitor*>(visitor))
+    return parserVisitor->visitTypeAliasDeclaration(this);
+  else
+    return visitor->visitChildren(this);
+}
+
+TorqueParser::TypeAliasDeclarationContext*
+TorqueParser::typeAliasDeclaration() {
+  TypeAliasDeclarationContext* _localctx =
+      _tracker.createInstance<TypeAliasDeclarationContext>(_ctx, getState());
+  enterRule(_localctx, 118, TorqueParser::RuleTypeAliasDeclaration);
+
+  auto onExit = finally([=] { exitRule(); });
+  try {
+    enterOuterAlt(_localctx, 1);
+    setState(641);
+    match(TorqueParser::T__5);
+    setState(642);
+    match(TorqueParser::IDENTIFIER);
+    setState(643);
+    match(TorqueParser::ASSIGNMENT);
+    setState(644);
+    type(0);
+    setState(645);
+    match(TorqueParser::T__12);
+
+  } catch (RecognitionException& e) {
+    _errHandler->reportError(this, e);
+    _localctx->exception = std::current_exception();
+    _errHandler->recover(this, _localctx->exception);
+  }
+
+  return _localctx;
+}
+
+//----------------- ExternalBuiltinContext
+//------------------------------------------------------------------
+
+TorqueParser::ExternalBuiltinContext::ExternalBuiltinContext(
+    ParserRuleContext* parent, size_t invokingState)
+    : ParserRuleContext(parent, invokingState) {}
+
+tree::TerminalNode* TorqueParser::ExternalBuiltinContext::EXTERN() {
+  return getToken(TorqueParser::EXTERN, 0);
+}
+
+tree::TerminalNode* TorqueParser::ExternalBuiltinContext::BUILTIN() {
+  return getToken(TorqueParser::BUILTIN, 0);
+}
+
+tree::TerminalNode* TorqueParser::ExternalBuiltinContext::IDENTIFIER() {
+  return getToken(TorqueParser::IDENTIFIER, 0);
+}
+
+TorqueParser::OptionalGenericTypeListContext*
+TorqueParser::ExternalBuiltinContext::optionalGenericTypeList() {
+  return getRuleContext<TorqueParser::OptionalGenericTypeListContext>(0);
+}
+
+TorqueParser::TypeListContext*
+TorqueParser::ExternalBuiltinContext::typeList() {
+  return getRuleContext<TorqueParser::TypeListContext>(0);
+}
+
+TorqueParser::OptionalTypeContext*
+TorqueParser::ExternalBuiltinContext::optionalType() {
+  return getRuleContext<TorqueParser::OptionalTypeContext>(0);
+}
+
+tree::TerminalNode* TorqueParser::ExternalBuiltinContext::JAVASCRIPT() {
+  return getToken(TorqueParser::JAVASCRIPT, 0);
+}
+
+size_t TorqueParser::ExternalBuiltinContext::getRuleIndex() const {
+  return TorqueParser::RuleExternalBuiltin;
+}
+
+void TorqueParser::ExternalBuiltinContext::enterRule(
+    tree::ParseTreeListener* listener) {
+  auto parserListener = dynamic_cast<TorqueListener*>(listener);
+  if (parserListener != nullptr) parserListener->enterExternalBuiltin(this);
+}
+
+void TorqueParser::ExternalBuiltinContext::exitRule(
+    tree::ParseTreeListener* listener) {
+  auto parserListener = dynamic_cast<TorqueListener*>(listener);
+  if (parserListener != nullptr) parserListener->exitExternalBuiltin(this);
+}
+
+antlrcpp::Any TorqueParser::ExternalBuiltinContext::accept(
+    tree::ParseTreeVisitor* visitor) {
+  if (auto parserVisitor = dynamic_cast<TorqueVisitor*>(visitor))
+    return parserVisitor->visitExternalBuiltin(this);
+  else
+    return visitor->visitChildren(this);
+}
+
+TorqueParser::ExternalBuiltinContext* TorqueParser::externalBuiltin() {
+  ExternalBuiltinContext* _localctx =
+      _tracker.createInstance<ExternalBuiltinContext>(_ctx, getState());
+  enterRule(_localctx, 120, TorqueParser::RuleExternalBuiltin);
+  size_t _la = 0;
+
+  auto onExit = finally([=] { exitRule(); });
+  try {
+    enterOuterAlt(_localctx, 1);
+    setState(647);
+    match(TorqueParser::EXTERN);
+    setState(649);
+    _errHandler->sync(this);
+
+    _la = _input->LA(1);
+    if (_la == TorqueParser::JAVASCRIPT) {
+      setState(648);
+      match(TorqueParser::JAVASCRIPT);
+    }
+    setState(651);
+    match(TorqueParser::BUILTIN);
+    setState(652);
+    match(TorqueParser::IDENTIFIER);
+    setState(653);
+    optionalGenericTypeList();
+    setState(654);
+    match(TorqueParser::T__0);
+    setState(655);
+    typeList();
+    setState(656);
+    match(TorqueParser::T__1);
+    setState(657);
+    optionalType();
+    setState(658);
+    match(TorqueParser::T__12);
+
+  } catch (RecognitionException& e) {
+    _errHandler->reportError(this, e);
+    _localctx->exception = std::current_exception();
+    _errHandler->recover(this, _localctx->exception);
+  }
+
+  return _localctx;
+}
+
+//----------------- ExternalMacroContext
+//------------------------------------------------------------------
+
+TorqueParser::ExternalMacroContext::ExternalMacroContext(
+    ParserRuleContext* parent, size_t invokingState)
+    : ParserRuleContext(parent, invokingState) {}
+
+tree::TerminalNode* TorqueParser::ExternalMacroContext::EXTERN() {
+  return getToken(TorqueParser::EXTERN, 0);
+}
+
+tree::TerminalNode* TorqueParser::ExternalMacroContext::MACRO() {
+  return getToken(TorqueParser::MACRO, 0);
+}
+
+tree::TerminalNode* TorqueParser::ExternalMacroContext::IDENTIFIER() {
+  return getToken(TorqueParser::IDENTIFIER, 0);
+}
+
+TorqueParser::OptionalGenericTypeListContext*
+TorqueParser::ExternalMacroContext::optionalGenericTypeList() {
+  return getRuleContext<TorqueParser::OptionalGenericTypeListContext>(0);
+}
+
+TorqueParser::TypeListMaybeVarArgsContext*
+TorqueParser::ExternalMacroContext::typeListMaybeVarArgs() {
+  return getRuleContext<TorqueParser::TypeListMaybeVarArgsContext>(0);
+}
+
+TorqueParser::OptionalTypeContext*
+TorqueParser::ExternalMacroContext::optionalType() {
+  return getRuleContext<TorqueParser::OptionalTypeContext>(0);
+}
+
+TorqueParser::OptionalLabelListContext*
+TorqueParser::ExternalMacroContext::optionalLabelList() {
+  return getRuleContext<TorqueParser::OptionalLabelListContext>(0);
+}
+
+tree::TerminalNode* TorqueParser::ExternalMacroContext::STRING_LITERAL() {
+  return getToken(TorqueParser::STRING_LITERAL, 0);
+}
+
+
+size_t TorqueParser::ExternalMacroContext::getRuleIndex() const {
+  return TorqueParser::RuleExternalMacro;
+}
+
+void TorqueParser::ExternalMacroContext::enterRule(
+    tree::ParseTreeListener* listener) {
+  auto parserListener = dynamic_cast<TorqueListener*>(listener);
+  if (parserListener != nullptr) parserListener->enterExternalMacro(this);
+}
+
+void TorqueParser::ExternalMacroContext::exitRule(
+    tree::ParseTreeListener* listener) {
+  auto parserListener = dynamic_cast<TorqueListener*>(listener);
+  if (parserListener != nullptr) parserListener->exitExternalMacro(this);
+}
+
+antlrcpp::Any TorqueParser::ExternalMacroContext::accept(
+    tree::ParseTreeVisitor* visitor) {
+  if (auto parserVisitor = dynamic_cast<TorqueVisitor*>(visitor))
+    return parserVisitor->visitExternalMacro(this);
+  else
+    return visitor->visitChildren(this);
+}
+
+TorqueParser::ExternalMacroContext* TorqueParser::externalMacro() {
+  ExternalMacroContext* _localctx =
+      _tracker.createInstance<ExternalMacroContext>(_ctx, getState());
+  enterRule(_localctx, 122, TorqueParser::RuleExternalMacro);
+  size_t _la = 0;
+
+  auto onExit = finally([=] { exitRule(); });
+  try {
+    enterOuterAlt(_localctx, 1);
+    setState(660);
+    match(TorqueParser::EXTERN);
+    setState(663);
+    _errHandler->sync(this);
+
+    _la = _input->LA(1);
+    if (_la == TorqueParser::T__19) {
+      setState(661);
+      match(TorqueParser::T__19);
+      setState(662);
+      match(TorqueParser::STRING_LITERAL);
+    }
+    setState(665);
+    match(TorqueParser::MACRO);
+    setState(666);
+    match(TorqueParser::IDENTIFIER);
+    setState(667);
+    optionalGenericTypeList();
+    setState(668);
+    typeListMaybeVarArgs();
+    setState(669);
+    optionalType();
+    setState(670);
+    optionalLabelList();
+    setState(671);
+    match(TorqueParser::T__12);
+
+  } catch (RecognitionException& e) {
+    _errHandler->reportError(this, e);
+    _localctx->exception = std::current_exception();
+    _errHandler->recover(this, _localctx->exception);
+  }
+
+  return _localctx;
+}
+
+//----------------- ExternalRuntimeContext
+//------------------------------------------------------------------
+
+TorqueParser::ExternalRuntimeContext::ExternalRuntimeContext(
+    ParserRuleContext* parent, size_t invokingState)
+    : ParserRuleContext(parent, invokingState) {}
+
+tree::TerminalNode* TorqueParser::ExternalRuntimeContext::EXTERN() {
+  return getToken(TorqueParser::EXTERN, 0);
+}
+
+tree::TerminalNode* TorqueParser::ExternalRuntimeContext::RUNTIME() {
+  return getToken(TorqueParser::RUNTIME, 0);
+}
+
+tree::TerminalNode* TorqueParser::ExternalRuntimeContext::IDENTIFIER() {
+  return getToken(TorqueParser::IDENTIFIER, 0);
+}
+
+TorqueParser::TypeListMaybeVarArgsContext*
+TorqueParser::ExternalRuntimeContext::typeListMaybeVarArgs() {
+  return getRuleContext<TorqueParser::TypeListMaybeVarArgsContext>(0);
+}
+
+TorqueParser::OptionalTypeContext*
+TorqueParser::ExternalRuntimeContext::optionalType() {
+  return getRuleContext<TorqueParser::OptionalTypeContext>(0);
+}
+
+size_t TorqueParser::ExternalRuntimeContext::getRuleIndex() const {
+  return TorqueParser::RuleExternalRuntime;
+}
+
+void TorqueParser::ExternalRuntimeContext::enterRule(
+    tree::ParseTreeListener* listener) {
+  auto parserListener = dynamic_cast<TorqueListener*>(listener);
+  if (parserListener != nullptr) parserListener->enterExternalRuntime(this);
+}
+
+void TorqueParser::ExternalRuntimeContext::exitRule(
+    tree::ParseTreeListener* listener) {
+  auto parserListener = dynamic_cast<TorqueListener*>(listener);
+  if (parserListener != nullptr) parserListener->exitExternalRuntime(this);
+}
+
+antlrcpp::Any TorqueParser::ExternalRuntimeContext::accept(
+    tree::ParseTreeVisitor* visitor) {
+  if (auto parserVisitor = dynamic_cast<TorqueVisitor*>(visitor))
+    return parserVisitor->visitExternalRuntime(this);
+  else
+    return visitor->visitChildren(this);
+}
+
+TorqueParser::ExternalRuntimeContext* TorqueParser::externalRuntime() {
+  ExternalRuntimeContext* _localctx =
+      _tracker.createInstance<ExternalRuntimeContext>(_ctx, getState());
+  enterRule(_localctx, 124, TorqueParser::RuleExternalRuntime);
+
+  auto onExit = finally([=] { exitRule(); });
+  try {
+    enterOuterAlt(_localctx, 1);
+    setState(673);
+    match(TorqueParser::EXTERN);
+    setState(674);
+    match(TorqueParser::RUNTIME);
+    setState(675);
+    match(TorqueParser::IDENTIFIER);
+    setState(676);
+    typeListMaybeVarArgs();
+    setState(677);
+    optionalType();
+    setState(678);
+    match(TorqueParser::T__12);
+
+  } catch (RecognitionException& e) {
+    _errHandler->reportError(this, e);
+    _localctx->exception = std::current_exception();
+    _errHandler->recover(this, _localctx->exception);
+  }
+
+  return _localctx;
+}
+
+//----------------- BuiltinDeclarationContext
+//------------------------------------------------------------------
+
+TorqueParser::BuiltinDeclarationContext::BuiltinDeclarationContext(
+    ParserRuleContext* parent, size_t invokingState)
+    : ParserRuleContext(parent, invokingState) {}
+
+tree::TerminalNode* TorqueParser::BuiltinDeclarationContext::BUILTIN() {
+  return getToken(TorqueParser::BUILTIN, 0);
+}
+
+tree::TerminalNode* TorqueParser::BuiltinDeclarationContext::IDENTIFIER() {
+  return getToken(TorqueParser::IDENTIFIER, 0);
+}
+
+TorqueParser::OptionalGenericTypeListContext*
+TorqueParser::BuiltinDeclarationContext::optionalGenericTypeList() {
+  return getRuleContext<TorqueParser::OptionalGenericTypeListContext>(0);
+}
+
+TorqueParser::ParameterListContext*
+TorqueParser::BuiltinDeclarationContext::parameterList() {
+  return getRuleContext<TorqueParser::ParameterListContext>(0);
+}
+
+TorqueParser::OptionalTypeContext*
+TorqueParser::BuiltinDeclarationContext::optionalType() {
+  return getRuleContext<TorqueParser::OptionalTypeContext>(0);
+}
+
+TorqueParser::HelperBodyContext*
+TorqueParser::BuiltinDeclarationContext::helperBody() {
+  return getRuleContext<TorqueParser::HelperBodyContext>(0);
+}
+
+tree::TerminalNode* TorqueParser::BuiltinDeclarationContext::JAVASCRIPT() {
+  return getToken(TorqueParser::JAVASCRIPT, 0);
+}
+
+size_t TorqueParser::BuiltinDeclarationContext::getRuleIndex() const {
+  return TorqueParser::RuleBuiltinDeclaration;
+}
+
+void TorqueParser::BuiltinDeclarationContext::enterRule(
+    tree::ParseTreeListener* listener) {
+  auto parserListener = dynamic_cast<TorqueListener*>(listener);
+  if (parserListener != nullptr) parserListener->enterBuiltinDeclaration(this);
+}
+
+void TorqueParser::BuiltinDeclarationContext::exitRule(
+    tree::ParseTreeListener* listener) {
+  auto parserListener = dynamic_cast<TorqueListener*>(listener);
+  if (parserListener != nullptr) parserListener->exitBuiltinDeclaration(this);
+}
+
+antlrcpp::Any TorqueParser::BuiltinDeclarationContext::accept(
+    tree::ParseTreeVisitor* visitor) {
+  if (auto parserVisitor = dynamic_cast<TorqueVisitor*>(visitor))
+    return parserVisitor->visitBuiltinDeclaration(this);
+  else
+    return visitor->visitChildren(this);
+}
+
+TorqueParser::BuiltinDeclarationContext* TorqueParser::builtinDeclaration() {
+  BuiltinDeclarationContext* _localctx =
+      _tracker.createInstance<BuiltinDeclarationContext>(_ctx, getState());
+  enterRule(_localctx, 126, TorqueParser::RuleBuiltinDeclaration);
+  size_t _la = 0;
+
+  auto onExit = finally([=] { exitRule(); });
+  try {
+    enterOuterAlt(_localctx, 1);
+    setState(681);
+    _errHandler->sync(this);
+
+    _la = _input->LA(1);
+    if (_la == TorqueParser::JAVASCRIPT) {
+      setState(680);
+      match(TorqueParser::JAVASCRIPT);
+    }
+    setState(683);
+    match(TorqueParser::BUILTIN);
+    setState(684);
+    match(TorqueParser::IDENTIFIER);
+    setState(685);
+    optionalGenericTypeList();
+    setState(686);
+    parameterList();
+    setState(687);
+    optionalType();
+    setState(690);
+    _errHandler->sync(this);
+    switch (_input->LA(1)) {
+      case TorqueParser::T__15:
+      case TorqueParser::DEFERRED: {
+        setState(688);
+        helperBody();
+        break;
+      }
+
+      case TorqueParser::T__12: {
+        setState(689);
+        match(TorqueParser::T__12);
+        break;
+      }
+
+      default:
+        throw NoViableAltException(this);
+    }
+
+  } catch (RecognitionException& e) {
+    _errHandler->reportError(this, e);
+    _localctx->exception = std::current_exception();
+    _errHandler->recover(this, _localctx->exception);
+  }
+
+  return _localctx;
+}
+
+//----------------- GenericSpecializationContext
+//------------------------------------------------------------------
+
+TorqueParser::GenericSpecializationContext::GenericSpecializationContext(
+    ParserRuleContext* parent, size_t invokingState)
+    : ParserRuleContext(parent, invokingState) {}
+
+tree::TerminalNode* TorqueParser::GenericSpecializationContext::IDENTIFIER() {
+  return getToken(TorqueParser::IDENTIFIER, 0);
+}
+
+TorqueParser::GenericSpecializationTypeListContext*
+TorqueParser::GenericSpecializationContext::genericSpecializationTypeList() {
+  return getRuleContext<TorqueParser::GenericSpecializationTypeListContext>(0);
+}
+
+TorqueParser::ParameterListContext*
+TorqueParser::GenericSpecializationContext::parameterList() {
+  return getRuleContext<TorqueParser::ParameterListContext>(0);
+}
+
+TorqueParser::OptionalTypeContext*
+TorqueParser::GenericSpecializationContext::optionalType() {
+  return getRuleContext<TorqueParser::OptionalTypeContext>(0);
+}
+
+TorqueParser::OptionalLabelListContext*
+TorqueParser::GenericSpecializationContext::optionalLabelList() {
+  return getRuleContext<TorqueParser::OptionalLabelListContext>(0);
+}
+
+TorqueParser::HelperBodyContext*
+TorqueParser::GenericSpecializationContext::helperBody() {
+  return getRuleContext<TorqueParser::HelperBodyContext>(0);
+}
+
+size_t TorqueParser::GenericSpecializationContext::getRuleIndex() const {
+  return TorqueParser::RuleGenericSpecialization;
+}
+
+void TorqueParser::GenericSpecializationContext::enterRule(
+    tree::ParseTreeListener* listener) {
+  auto parserListener = dynamic_cast<TorqueListener*>(listener);
+  if (parserListener != nullptr)
+    parserListener->enterGenericSpecialization(this);
+}
+
+void TorqueParser::GenericSpecializationContext::exitRule(
+    tree::ParseTreeListener* listener) {
+  auto parserListener = dynamic_cast<TorqueListener*>(listener);
+  if (parserListener != nullptr)
+    parserListener->exitGenericSpecialization(this);
+}
+
+antlrcpp::Any TorqueParser::GenericSpecializationContext::accept(
+    tree::ParseTreeVisitor* visitor) {
+  if (auto parserVisitor = dynamic_cast<TorqueVisitor*>(visitor))
+    return parserVisitor->visitGenericSpecialization(this);
+  else
+    return visitor->visitChildren(this);
+}
+
+TorqueParser::GenericSpecializationContext*
+TorqueParser::genericSpecialization() {
+  GenericSpecializationContext* _localctx =
+      _tracker.createInstance<GenericSpecializationContext>(_ctx, getState());
+  enterRule(_localctx, 128, TorqueParser::RuleGenericSpecialization);
+
+  auto onExit = finally([=] { exitRule(); });
+  try {
+    enterOuterAlt(_localctx, 1);
+    setState(692);
+    match(TorqueParser::IDENTIFIER);
+    setState(693);
+    genericSpecializationTypeList();
+    setState(694);
+    parameterList();
+    setState(695);
+    optionalType();
+    setState(696);
+    optionalLabelList();
+    setState(697);
+    helperBody();
+
+  } catch (RecognitionException& e) {
+    _errHandler->reportError(this, e);
+    _localctx->exception = std::current_exception();
+    _errHandler->recover(this, _localctx->exception);
+  }
+
+  return _localctx;
+}
+
+//----------------- MacroDeclarationContext
+//------------------------------------------------------------------
+
+TorqueParser::MacroDeclarationContext::MacroDeclarationContext(
+    ParserRuleContext* parent, size_t invokingState)
+    : ParserRuleContext(parent, invokingState) {}
+
+tree::TerminalNode* TorqueParser::MacroDeclarationContext::MACRO() {
+  return getToken(TorqueParser::MACRO, 0);
+}
+
+tree::TerminalNode* TorqueParser::MacroDeclarationContext::IDENTIFIER() {
+  return getToken(TorqueParser::IDENTIFIER, 0);
+}
+
+TorqueParser::OptionalGenericTypeListContext*
+TorqueParser::MacroDeclarationContext::optionalGenericTypeList() {
+  return getRuleContext<TorqueParser::OptionalGenericTypeListContext>(0);
+}
+
+TorqueParser::ParameterListContext*
+TorqueParser::MacroDeclarationContext::parameterList() {
+  return getRuleContext<TorqueParser::ParameterListContext>(0);
+}
+
+TorqueParser::OptionalTypeContext*
+TorqueParser::MacroDeclarationContext::optionalType() {
+  return getRuleContext<TorqueParser::OptionalTypeContext>(0);
+}
+
+TorqueParser::OptionalLabelListContext*
+TorqueParser::MacroDeclarationContext::optionalLabelList() {
+  return getRuleContext<TorqueParser::OptionalLabelListContext>(0);
+}
+
+TorqueParser::HelperBodyContext*
+TorqueParser::MacroDeclarationContext::helperBody() {
+  return getRuleContext<TorqueParser::HelperBodyContext>(0);
+}
+
+tree::TerminalNode* TorqueParser::MacroDeclarationContext::STRING_LITERAL() {
+  return getToken(TorqueParser::STRING_LITERAL, 0);
+}
+
+size_t TorqueParser::MacroDeclarationContext::getRuleIndex() const {
+  return TorqueParser::RuleMacroDeclaration;
+}
+
+void TorqueParser::MacroDeclarationContext::enterRule(
+    tree::ParseTreeListener* listener) {
+  auto parserListener = dynamic_cast<TorqueListener*>(listener);
+  if (parserListener != nullptr) parserListener->enterMacroDeclaration(this);
+}
+
+void TorqueParser::MacroDeclarationContext::exitRule(
+    tree::ParseTreeListener* listener) {
+  auto parserListener = dynamic_cast<TorqueListener*>(listener);
+  if (parserListener != nullptr) parserListener->exitMacroDeclaration(this);
+}
+
+antlrcpp::Any TorqueParser::MacroDeclarationContext::accept(
+    tree::ParseTreeVisitor* visitor) {
+  if (auto parserVisitor = dynamic_cast<TorqueVisitor*>(visitor))
+    return parserVisitor->visitMacroDeclaration(this);
+  else
+    return visitor->visitChildren(this);
+}
+
+TorqueParser::MacroDeclarationContext* TorqueParser::macroDeclaration() {
+  MacroDeclarationContext* _localctx =
+      _tracker.createInstance<MacroDeclarationContext>(_ctx, getState());
+  enterRule(_localctx, 130, TorqueParser::RuleMacroDeclaration);
+  size_t _la = 0;
+
+  auto onExit = finally([=] { exitRule(); });
+  try {
+    enterOuterAlt(_localctx, 1);
+    setState(701);
+    _errHandler->sync(this);
+
+    _la = _input->LA(1);
+    if (_la == TorqueParser::T__19) {
+      setState(699);
+      match(TorqueParser::T__19);
+      setState(700);
+      match(TorqueParser::STRING_LITERAL);
+    }
+    setState(703);
+    match(TorqueParser::MACRO);
+    setState(704);
+    match(TorqueParser::IDENTIFIER);
+    setState(705);
+    optionalGenericTypeList();
+    setState(706);
+    parameterList();
+    setState(707);
+    optionalType();
+    setState(708);
+    optionalLabelList();
+    setState(711);
+    _errHandler->sync(this);
+    switch (_input->LA(1)) {
+      case TorqueParser::T__15:
+      case TorqueParser::DEFERRED: {
+        setState(709);
+        helperBody();
+        break;
+      }
+
+      case TorqueParser::T__12: {
+        setState(710);
+        match(TorqueParser::T__12);
+        break;
+      }
+
+      default:
+        throw NoViableAltException(this);
+    }
+
+  } catch (RecognitionException& e) {
+    _errHandler->reportError(this, e);
+    _localctx->exception = std::current_exception();
+    _errHandler->recover(this, _localctx->exception);
+  }
+
+  return _localctx;
+}
+
+//----------------- ExternConstDeclarationContext
+//------------------------------------------------------------------
+
+TorqueParser::ExternConstDeclarationContext::ExternConstDeclarationContext(
+    ParserRuleContext* parent, size_t invokingState)
+    : ParserRuleContext(parent, invokingState) {}
+
+tree::TerminalNode* TorqueParser::ExternConstDeclarationContext::IDENTIFIER() {
+  return getToken(TorqueParser::IDENTIFIER, 0);
+}
+
+TorqueParser::TypeContext* TorqueParser::ExternConstDeclarationContext::type() {
+  return getRuleContext<TorqueParser::TypeContext>(0);
+}
+
+TorqueParser::GeneratesDeclarationContext*
+TorqueParser::ExternConstDeclarationContext::generatesDeclaration() {
+  return getRuleContext<TorqueParser::GeneratesDeclarationContext>(0);
+}
+
+size_t TorqueParser::ExternConstDeclarationContext::getRuleIndex() const {
+  return TorqueParser::RuleExternConstDeclaration;
+}
+
+void TorqueParser::ExternConstDeclarationContext::enterRule(
+    tree::ParseTreeListener* listener) {
+  auto parserListener = dynamic_cast<TorqueListener*>(listener);
+  if (parserListener != nullptr)
+    parserListener->enterExternConstDeclaration(this);
+}
+
+void TorqueParser::ExternConstDeclarationContext::exitRule(
+    tree::ParseTreeListener* listener) {
+  auto parserListener = dynamic_cast<TorqueListener*>(listener);
+  if (parserListener != nullptr)
+    parserListener->exitExternConstDeclaration(this);
+}
+
+antlrcpp::Any TorqueParser::ExternConstDeclarationContext::accept(
+    tree::ParseTreeVisitor* visitor) {
+  if (auto parserVisitor = dynamic_cast<TorqueVisitor*>(visitor))
+    return parserVisitor->visitExternConstDeclaration(this);
+  else
+    return visitor->visitChildren(this);
+}
+
+TorqueParser::ExternConstDeclarationContext*
+TorqueParser::externConstDeclaration() {
+  ExternConstDeclarationContext* _localctx =
+      _tracker.createInstance<ExternConstDeclarationContext>(_ctx, getState());
+  enterRule(_localctx, 132, TorqueParser::RuleExternConstDeclaration);
+
+  auto onExit = finally([=] { exitRule(); });
+  try {
+    enterOuterAlt(_localctx, 1);
+    setState(713);
+    match(TorqueParser::T__20);
+    setState(714);
+    match(TorqueParser::IDENTIFIER);
+    setState(715);
+    match(TorqueParser::T__4);
+    setState(716);
+    type(0);
+    setState(717);
+    generatesDeclaration();
+    setState(718);
+    match(TorqueParser::T__12);
+
+  } catch (RecognitionException& e) {
+    _errHandler->reportError(this, e);
+    _localctx->exception = std::current_exception();
+    _errHandler->recover(this, _localctx->exception);
+  }
+
+  return _localctx;
+}
+
+//----------------- DeclarationContext
+//------------------------------------------------------------------
+
+TorqueParser::DeclarationContext::DeclarationContext(ParserRuleContext* parent,
+                                                     size_t invokingState)
+    : ParserRuleContext(parent, invokingState) {}
+
+TorqueParser::TypeDeclarationContext*
+TorqueParser::DeclarationContext::typeDeclaration() {
+  return getRuleContext<TorqueParser::TypeDeclarationContext>(0);
+}
+
+TorqueParser::TypeAliasDeclarationContext*
+TorqueParser::DeclarationContext::typeAliasDeclaration() {
+  return getRuleContext<TorqueParser::TypeAliasDeclarationContext>(0);
+}
+
+TorqueParser::BuiltinDeclarationContext*
+TorqueParser::DeclarationContext::builtinDeclaration() {
+  return getRuleContext<TorqueParser::BuiltinDeclarationContext>(0);
+}
+
+TorqueParser::GenericSpecializationContext*
+TorqueParser::DeclarationContext::genericSpecialization() {
+  return getRuleContext<TorqueParser::GenericSpecializationContext>(0);
+}
+
+TorqueParser::MacroDeclarationContext*
+TorqueParser::DeclarationContext::macroDeclaration() {
+  return getRuleContext<TorqueParser::MacroDeclarationContext>(0);
+}
+
+TorqueParser::ExternalMacroContext*
+TorqueParser::DeclarationContext::externalMacro() {
+  return getRuleContext<TorqueParser::ExternalMacroContext>(0);
+}
+
+TorqueParser::ExternalBuiltinContext*
+TorqueParser::DeclarationContext::externalBuiltin() {
+  return getRuleContext<TorqueParser::ExternalBuiltinContext>(0);
+}
+
+TorqueParser::ExternalRuntimeContext*
+TorqueParser::DeclarationContext::externalRuntime() {
+  return getRuleContext<TorqueParser::ExternalRuntimeContext>(0);
+}
+
+TorqueParser::ExternConstDeclarationContext*
+TorqueParser::DeclarationContext::externConstDeclaration() {
+  return getRuleContext<TorqueParser::ExternConstDeclarationContext>(0);
+}
+
+size_t TorqueParser::DeclarationContext::getRuleIndex() const {
+  return TorqueParser::RuleDeclaration;
+}
+
+void TorqueParser::DeclarationContext::enterRule(
+    tree::ParseTreeListener* listener) {
+  auto parserListener = dynamic_cast<TorqueListener*>(listener);
+  if (parserListener != nullptr) parserListener->enterDeclaration(this);
+}
+
+void TorqueParser::DeclarationContext::exitRule(
+    tree::ParseTreeListener* listener) {
+  auto parserListener = dynamic_cast<TorqueListener*>(listener);
+  if (parserListener != nullptr) parserListener->exitDeclaration(this);
+}
+
+antlrcpp::Any TorqueParser::DeclarationContext::accept(
+    tree::ParseTreeVisitor* visitor) {
+  if (auto parserVisitor = dynamic_cast<TorqueVisitor*>(visitor))
+    return parserVisitor->visitDeclaration(this);
+  else
+    return visitor->visitChildren(this);
+}
+
+TorqueParser::DeclarationContext* TorqueParser::declaration() {
+  DeclarationContext* _localctx =
+      _tracker.createInstance<DeclarationContext>(_ctx, getState());
+  enterRule(_localctx, 134, TorqueParser::RuleDeclaration);
+
+  auto onExit = finally([=] { exitRule(); });
+  try {
+    setState(729);
+    _errHandler->sync(this);
+    switch (getInterpreter<atn::ParserATNSimulator>()->adaptivePredict(
+        _input, 68, _ctx)) {
+      case 1: {
+        enterOuterAlt(_localctx, 1);
+        setState(720);
+        typeDeclaration();
+        break;
+      }
+
+      case 2: {
+        enterOuterAlt(_localctx, 2);
+        setState(721);
+        typeAliasDeclaration();
+        break;
+      }
+
+      case 3: {
+        enterOuterAlt(_localctx, 3);
+        setState(722);
+        builtinDeclaration();
+        break;
+      }
+
+      case 4: {
+        enterOuterAlt(_localctx, 4);
+        setState(723);
+        genericSpecialization();
+        break;
+      }
+
+      case 5: {
+        enterOuterAlt(_localctx, 5);
+        setState(724);
+        macroDeclaration();
+        break;
+      }
+
+      case 6: {
+        enterOuterAlt(_localctx, 6);
+        setState(725);
+        externalMacro();
+        break;
+      }
+
+      case 7: {
+        enterOuterAlt(_localctx, 7);
+        setState(726);
+        externalBuiltin();
+        break;
+      }
+
+      case 8: {
+        enterOuterAlt(_localctx, 8);
+        setState(727);
+        externalRuntime();
+        break;
+      }
+
+      case 9: {
+        enterOuterAlt(_localctx, 9);
+        setState(728);
+        externConstDeclaration();
+        break;
+      }
+    }
+
+  } catch (RecognitionException& e) {
+    _errHandler->reportError(this, e);
+    _localctx->exception = std::current_exception();
+    _errHandler->recover(this, _localctx->exception);
+  }
+
+  return _localctx;
+}
+
+//----------------- ModuleDeclarationContext
+//------------------------------------------------------------------
+
+TorqueParser::ModuleDeclarationContext::ModuleDeclarationContext(
+    ParserRuleContext* parent, size_t invokingState)
+    : ParserRuleContext(parent, invokingState) {}
+
+tree::TerminalNode* TorqueParser::ModuleDeclarationContext::MODULE() {
+  return getToken(TorqueParser::MODULE, 0);
+}
+
+tree::TerminalNode* TorqueParser::ModuleDeclarationContext::IDENTIFIER() {
+  return getToken(TorqueParser::IDENTIFIER, 0);
+}
+
+std::vector<TorqueParser::DeclarationContext*>
+TorqueParser::ModuleDeclarationContext::declaration() {
+  return getRuleContexts<TorqueParser::DeclarationContext>();
+}
+
+TorqueParser::DeclarationContext*
+TorqueParser::ModuleDeclarationContext::declaration(size_t i) {
+  return getRuleContext<TorqueParser::DeclarationContext>(i);
+}
+
+size_t TorqueParser::ModuleDeclarationContext::getRuleIndex() const {
+  return TorqueParser::RuleModuleDeclaration;
+}
+
+void TorqueParser::ModuleDeclarationContext::enterRule(
+    tree::ParseTreeListener* listener) {
+  auto parserListener = dynamic_cast<TorqueListener*>(listener);
+  if (parserListener != nullptr) parserListener->enterModuleDeclaration(this);
+}
+
+void TorqueParser::ModuleDeclarationContext::exitRule(
+    tree::ParseTreeListener* listener) {
+  auto parserListener = dynamic_cast<TorqueListener*>(listener);
+  if (parserListener != nullptr) parserListener->exitModuleDeclaration(this);
+}
+
+antlrcpp::Any TorqueParser::ModuleDeclarationContext::accept(
+    tree::ParseTreeVisitor* visitor) {
+  if (auto parserVisitor = dynamic_cast<TorqueVisitor*>(visitor))
+    return parserVisitor->visitModuleDeclaration(this);
+  else
+    return visitor->visitChildren(this);
+}
+
+TorqueParser::ModuleDeclarationContext* TorqueParser::moduleDeclaration() {
+  ModuleDeclarationContext* _localctx =
+      _tracker.createInstance<ModuleDeclarationContext>(_ctx, getState());
+  enterRule(_localctx, 136, TorqueParser::RuleModuleDeclaration);
+  size_t _la = 0;
+
+  auto onExit = finally([=] { exitRule(); });
+  try {
+    enterOuterAlt(_localctx, 1);
+    setState(731);
+    match(TorqueParser::MODULE);
+    setState(732);
+    match(TorqueParser::IDENTIFIER);
+    setState(733);
+    match(TorqueParser::T__15);
+    setState(737);
+    _errHandler->sync(this);
+    _la = _input->LA(1);
+    while ((((_la & ~0x3fULL) == 0) &&
+            ((1ULL << _la) &
+             ((1ULL << TorqueParser::T__5) | (1ULL << TorqueParser::T__19) |
+              (1ULL << TorqueParser::T__20) | (1ULL << TorqueParser::MACRO) |
+              (1ULL << TorqueParser::BUILTIN) |
+              (1ULL << TorqueParser::JAVASCRIPT) |
+              (1ULL << TorqueParser::EXTERN))) != 0) ||
+           _la == TorqueParser::IDENTIFIER) {
+      setState(734);
+      declaration();
+      setState(739);
+      _errHandler->sync(this);
+      _la = _input->LA(1);
+    }
+    setState(740);
+    match(TorqueParser::T__16);
+
+  } catch (RecognitionException& e) {
+    _errHandler->reportError(this, e);
+    _localctx->exception = std::current_exception();
+    _errHandler->recover(this, _localctx->exception);
+  }
+
+  return _localctx;
+}
+
+//----------------- FileContext
+//------------------------------------------------------------------
+
+TorqueParser::FileContext::FileContext(ParserRuleContext* parent,
+                                       size_t invokingState)
+    : ParserRuleContext(parent, invokingState) {}
+
+std::vector<TorqueParser::ModuleDeclarationContext*>
+TorqueParser::FileContext::moduleDeclaration() {
+  return getRuleContexts<TorqueParser::ModuleDeclarationContext>();
+}
+
+TorqueParser::ModuleDeclarationContext*
+TorqueParser::FileContext::moduleDeclaration(size_t i) {
+  return getRuleContext<TorqueParser::ModuleDeclarationContext>(i);
+}
+
+std::vector<TorqueParser::DeclarationContext*>
+TorqueParser::FileContext::declaration() {
+  return getRuleContexts<TorqueParser::DeclarationContext>();
+}
+
+TorqueParser::DeclarationContext* TorqueParser::FileContext::declaration(
+    size_t i) {
+  return getRuleContext<TorqueParser::DeclarationContext>(i);
+}
+
+size_t TorqueParser::FileContext::getRuleIndex() const {
+  return TorqueParser::RuleFile;
+}
+
+void TorqueParser::FileContext::enterRule(tree::ParseTreeListener* listener) {
+  auto parserListener = dynamic_cast<TorqueListener*>(listener);
+  if (parserListener != nullptr) parserListener->enterFile(this);
+}
+
+void TorqueParser::FileContext::exitRule(tree::ParseTreeListener* listener) {
+  auto parserListener = dynamic_cast<TorqueListener*>(listener);
+  if (parserListener != nullptr) parserListener->exitFile(this);
+}
+
+antlrcpp::Any TorqueParser::FileContext::accept(
+    tree::ParseTreeVisitor* visitor) {
+  if (auto parserVisitor = dynamic_cast<TorqueVisitor*>(visitor))
+    return parserVisitor->visitFile(this);
+  else
+    return visitor->visitChildren(this);
+}
+
+TorqueParser::FileContext* TorqueParser::file() {
+  FileContext* _localctx =
+      _tracker.createInstance<FileContext>(_ctx, getState());
+  enterRule(_localctx, 138, TorqueParser::RuleFile);
+  size_t _la = 0;
+
+  auto onExit = finally([=] { exitRule(); });
+  try {
+    enterOuterAlt(_localctx, 1);
+    setState(746);
+    _errHandler->sync(this);
+    _la = _input->LA(1);
+    while ((((_la & ~0x3fULL) == 0) &&
+            ((1ULL << _la) &
+             ((1ULL << TorqueParser::T__5) | (1ULL << TorqueParser::T__19) |
+              (1ULL << TorqueParser::T__20) | (1ULL << TorqueParser::MACRO) |
+              (1ULL << TorqueParser::BUILTIN) | (1ULL << TorqueParser::MODULE) |
+              (1ULL << TorqueParser::JAVASCRIPT) |
+              (1ULL << TorqueParser::EXTERN))) != 0) ||
+           _la == TorqueParser::IDENTIFIER) {
+      setState(744);
+      _errHandler->sync(this);
+      switch (_input->LA(1)) {
+        case TorqueParser::MODULE: {
+          setState(742);
+          moduleDeclaration();
+          break;
+        }
+
+        case TorqueParser::T__5:
+        case TorqueParser::T__19:
+        case TorqueParser::T__20:
+        case TorqueParser::MACRO:
+        case TorqueParser::BUILTIN:
+        case TorqueParser::JAVASCRIPT:
+        case TorqueParser::EXTERN:
+        case TorqueParser::IDENTIFIER: {
+          setState(743);
+          declaration();
+          break;
+        }
+
+        default:
+          throw NoViableAltException(this);
+      }
+      setState(748);
+      _errHandler->sync(this);
+      _la = _input->LA(1);
+    }
+
+  } catch (RecognitionException& e) {
+    _errHandler->reportError(this, e);
+    _localctx->exception = std::current_exception();
+    _errHandler->recover(this, _localctx->exception);
+  }
+
+  return _localctx;
+}
+
+bool TorqueParser::sempred(RuleContext* context, size_t ruleIndex,
+                           size_t predicateIndex) {
+  switch (ruleIndex) {
+    case 0:
+      return typeSempred(dynamic_cast<TypeContext*>(context), predicateIndex);
+    case 13:
+      return conditionalExpressionSempred(
+          dynamic_cast<ConditionalExpressionContext*>(context), predicateIndex);
+    case 14:
+      return logicalORExpressionSempred(
+          dynamic_cast<LogicalORExpressionContext*>(context), predicateIndex);
+    case 15:
+      return logicalANDExpressionSempred(
+          dynamic_cast<LogicalANDExpressionContext*>(context), predicateIndex);
+    case 16:
+      return bitwiseExpressionSempred(
+          dynamic_cast<BitwiseExpressionContext*>(context), predicateIndex);
+    case 17:
+      return equalityExpressionSempred(
+          dynamic_cast<EqualityExpressionContext*>(context), predicateIndex);
+    case 18:
+      return relationalExpressionSempred(
+          dynamic_cast<RelationalExpressionContext*>(context), predicateIndex);
+    case 19:
+      return shiftExpressionSempred(
+          dynamic_cast<ShiftExpressionContext*>(context), predicateIndex);
+    case 20:
+      return additiveExpressionSempred(
+          dynamic_cast<AdditiveExpressionContext*>(context), predicateIndex);
+    case 21:
+      return multiplicativeExpressionSempred(
+          dynamic_cast<MultiplicativeExpressionContext*>(context),
+          predicateIndex);
+    case 23:
+      return locationExpressionSempred(
+          dynamic_cast<LocationExpressionContext*>(context), predicateIndex);
+
+    default:
+      break;
+  }
+  return true;
+}
+
+bool TorqueParser::typeSempred(TypeContext* _localctx, size_t predicateIndex) {
+  switch (predicateIndex) {
+    case 0:
+      return precpred(_ctx, 2);
+
+    default:
+      break;
+  }
+  return true;
+}
+
+bool TorqueParser::conditionalExpressionSempred(
+    ConditionalExpressionContext* _localctx, size_t predicateIndex) {
+  switch (predicateIndex) {
+    case 1:
+      return precpred(_ctx, 1);
+
+    default:
+      break;
+  }
+  return true;
+}
+
+bool TorqueParser::logicalORExpressionSempred(
+    LogicalORExpressionContext* _localctx, size_t predicateIndex) {
+  switch (predicateIndex) {
+    case 2:
+      return precpred(_ctx, 1);
+
+    default:
+      break;
+  }
+  return true;
+}
+
+bool TorqueParser::logicalANDExpressionSempred(
+    LogicalANDExpressionContext* _localctx, size_t predicateIndex) {
+  switch (predicateIndex) {
+    case 3:
+      return precpred(_ctx, 1);
+
+    default:
+      break;
+  }
+  return true;
+}
+
+bool TorqueParser::bitwiseExpressionSempred(BitwiseExpressionContext* _localctx,
+                                            size_t predicateIndex) {
+  switch (predicateIndex) {
+    case 4:
+      return precpred(_ctx, 1);
+
+    default:
+      break;
+  }
+  return true;
+}
+
+bool TorqueParser::equalityExpressionSempred(
+    EqualityExpressionContext* _localctx, size_t predicateIndex) {
+  switch (predicateIndex) {
+    case 5:
+      return precpred(_ctx, 1);
+
+    default:
+      break;
+  }
+  return true;
+}
+
+bool TorqueParser::relationalExpressionSempred(
+    RelationalExpressionContext* _localctx, size_t predicateIndex) {
+  switch (predicateIndex) {
+    case 6:
+      return precpred(_ctx, 1);
+
+    default:
+      break;
+  }
+  return true;
+}
+
+bool TorqueParser::shiftExpressionSempred(ShiftExpressionContext* _localctx,
+                                          size_t predicateIndex) {
+  switch (predicateIndex) {
+    case 7:
+      return precpred(_ctx, 1);
+
+    default:
+      break;
+  }
+  return true;
+}
+
+bool TorqueParser::additiveExpressionSempred(
+    AdditiveExpressionContext* _localctx, size_t predicateIndex) {
+  switch (predicateIndex) {
+    case 8:
+      return precpred(_ctx, 1);
+
+    default:
+      break;
+  }
+  return true;
+}
+
+bool TorqueParser::multiplicativeExpressionSempred(
+    MultiplicativeExpressionContext* _localctx, size_t predicateIndex) {
+  switch (predicateIndex) {
+    case 9:
+      return precpred(_ctx, 1);
+
+    default:
+      break;
+  }
+  return true;
+}
+
+bool TorqueParser::locationExpressionSempred(
+    LocationExpressionContext* _localctx, size_t predicateIndex) {
+  switch (predicateIndex) {
+    case 10:
+      return precpred(_ctx, 2);
+    case 11:
+      return precpred(_ctx, 1);
+
+    default:
+      break;
+  }
+  return true;
+}
+
+// Static vars and initialization.
+std::vector<dfa::DFA> TorqueParser::_decisionToDFA;
+atn::PredictionContextCache TorqueParser::_sharedContextCache;
+
+// We own the ATN which in turn owns the ATN states.
+atn::ATN TorqueParser::_atn;
+std::vector<uint16_t> TorqueParser::_serializedATN;
+
+std::vector<std::string> TorqueParser::_ruleNames = {
+    "type",
+    "typeList",
+    "genericSpecializationTypeList",
+    "optionalGenericTypeList",
+    "typeListMaybeVarArgs",
+    "labelParameter",
+    "optionalType",
+    "optionalLabelList",
+    "optionalOtherwise",
+    "parameter",
+    "parameterList",
+    "labelDeclaration",
+    "expression",
+    "conditionalExpression",
+    "logicalORExpression",
+    "logicalANDExpression",
+    "bitwiseExpression",
+    "equalityExpression",
+    "relationalExpression",
+    "shiftExpression",
+    "additiveExpression",
+    "multiplicativeExpression",
+    "unaryExpression",
+    "locationExpression",
+    "incrementDecrement",
+    "assignment",
+    "assignmentExpression",
+    "primaryExpression",
+    "forInitialization",
+    "forLoop",
+    "rangeSpecifier",
+    "forOfRange",
+    "forOfLoop",
+    "argument",
+    "argumentList",
+    "helperCall",
+    "labelReference",
+    "variableDeclaration",
+    "variableDeclarationWithInitialization",
+    "helperCallStatement",
+    "expressionStatement",
+    "ifStatement",
+    "whileLoop",
+    "returnStatement",
+    "breakStatement",
+    "continueStatement",
+    "gotoStatement",
+    "handlerWithStatement",
+    "tryLabelStatement",
+    "diagnosticStatement",
+    "statement",
+    "statementList",
+    "statementScope",
+    "statementBlock",
+    "helperBody",
+    "extendsDeclaration",
+    "generatesDeclaration",
+    "constexprDeclaration",
+    "typeDeclaration",
+    "typeAliasDeclaration",
+    "externalBuiltin",
+    "externalMacro",
+    "externalRuntime",
+    "builtinDeclaration",
+    "genericSpecialization",
+    "macroDeclaration",
+    "externConstDeclaration",
+    "declaration",
+    "moduleDeclaration",
+    "file"};
+
+std::vector<std::string> TorqueParser::_literalNames = {"",
+                                                        "'('",
+                                                        "')'",
+                                                        "'=>'",
+                                                        "','",
+                                                        "':'",
+                                                        "'type'",
+                                                        "'?'",
+                                                        "'||'",
+                                                        "'&&'",
+                                                        "'.'",
+                                                        "'['",
+                                                        "']'",
+                                                        "';'",
+                                                        "'of'",
+                                                        "'else'",
+                                                        "'{'",
+                                                        "'}'",
+                                                        "'extends'",
+                                                        "'generates'",
+                                                        "'operator'",
+                                                        "'const'",
+                                                        "'macro'",
+                                                        "'builtin'",
+                                                        "'runtime'",
+                                                        "'module'",
+                                                        "'javascript'",
+                                                        "'deferred'",
+                                                        "'if'",
+                                                        "'for'",
+                                                        "'while'",
+                                                        "'return'",
+                                                        "'constexpr'",
+                                                        "'continue'",
+                                                        "'break'",
+                                                        "'goto'",
+                                                        "'otherwise'",
+                                                        "'try'",
+                                                        "'label'",
+                                                        "'labels'",
+                                                        "'tail'",
+                                                        "'isnt'",
+                                                        "'is'",
+                                                        "'let'",
+                                                        "'extern'",
+                                                        "'assert'",
+                                                        "'check'",
+                                                        "'unreachable'",
+                                                        "'debug'",
+                                                        "'='",
+                                                        "",
+                                                        "'=='",
+                                                        "'+'",
+                                                        "'-'",
+                                                        "'*'",
+                                                        "'/'",
+                                                        "'%'",
+                                                        "'|'",
+                                                        "'&'",
+                                                        "'~'",
+                                                        "'max'",
+                                                        "'min'",
+                                                        "'!='",
+                                                        "'<'",
+                                                        "'<='",
+                                                        "'>'",
+                                                        "'>='",
+                                                        "'<<'",
+                                                        "'>>'",
+                                                        "'>>>'",
+                                                        "'...'",
+                                                        "",
+                                                        "'++'",
+                                                        "'--'",
+                                                        "'!'"};
+
+std::vector<std::string> TorqueParser::_symbolicNames = {
+    "",
+    "",
+    "",
+    "",
+    "",
+    "",
+    "",
+    "",
+    "",
+    "",
+    "",
+    "",
+    "",
+    "",
+    "",
+    "",
+    "",
+    "",
+    "",
+    "",
+    "",
+    "",
+    "MACRO",
+    "BUILTIN",
+    "RUNTIME",
+    "MODULE",
+    "JAVASCRIPT",
+    "DEFERRED",
+    "IF",
+    "FOR",
+    "WHILE",
+    "RETURN",
+    "CONSTEXPR",
+    "CONTINUE",
+    "BREAK",
+    "GOTO",
+    "OTHERWISE",
+    "TRY",
+    "LABEL",
+    "LABELS",
+    "TAIL",
+    "ISNT",
+    "IS",
+    "LET",
+    "EXTERN",
+    "ASSERT_TOKEN",
+    "CHECK_TOKEN",
+    "UNREACHABLE_TOKEN",
+    "DEBUG_TOKEN",
+    "ASSIGNMENT",
+    "ASSIGNMENT_OPERATOR",
+    "EQUAL",
+    "PLUS",
+    "MINUS",
+    "MULTIPLY",
+    "DIVIDE",
+    "MODULO",
+    "BIT_OR",
+    "BIT_AND",
+    "BIT_NOT",
+    "MAX",
+    "MIN",
+    "NOT_EQUAL",
+    "LESS_THAN",
+    "LESS_THAN_EQUAL",
+    "GREATER_THAN",
+    "GREATER_THAN_EQUAL",
+    "SHIFT_LEFT",
+    "SHIFT_RIGHT",
+    "SHIFT_RIGHT_ARITHMETIC",
+    "VARARGS",
+    "EQUALITY_OPERATOR",
+    "INCREMENT",
+    "DECREMENT",
+    "NOT",
+    "STRING_LITERAL",
+    "IDENTIFIER",
+    "WS",
+    "BLOCK_COMMENT",
+    "LINE_COMMENT",
+    "DECIMAL_LITERAL"};
+
+dfa::Vocabulary TorqueParser::_vocabulary(_literalNames, _symbolicNames);
+
+std::vector<std::string> TorqueParser::_tokenNames;
+
+TorqueParser::Initializer::Initializer() {
+  for (size_t i = 0; i < _symbolicNames.size(); ++i) {
+    std::string name = _vocabulary.getLiteralName(i);
+    if (name.empty()) {
+      name = _vocabulary.getSymbolicName(i);
+    }
+
+    if (name.empty()) {
+      _tokenNames.push_back("<INVALID>");
+    } else {
+      _tokenNames.push_back(name);
+    }
+  }
+
+  _serializedATN = {
+      0x3,   0x608b, 0xa72a, 0x8133, 0xb9ed, 0x417c, 0x3be7, 0x7786, 0x5964,
+      0x3,   0x52,   0x2f0,  0x4,    0x2,    0x9,    0x2,    0x4,    0x3,
+      0x9,   0x3,    0x4,    0x4,    0x9,    0x4,    0x4,    0x5,    0x9,
+      0x5,   0x4,    0x6,    0x9,    0x6,    0x4,    0x7,    0x9,    0x7,
+      0x4,   0x8,    0x9,    0x8,    0x4,    0x9,    0x9,    0x9,    0x4,
+      0xa,   0x9,    0xa,    0x4,    0xb,    0x9,    0xb,    0x4,    0xc,
+      0x9,   0xc,    0x4,    0xd,    0x9,    0xd,    0x4,    0xe,    0x9,
+      0xe,   0x4,    0xf,    0x9,    0xf,    0x4,    0x10,   0x9,    0x10,
+      0x4,   0x11,   0x9,    0x11,   0x4,    0x12,   0x9,    0x12,   0x4,
+      0x13,  0x9,    0x13,   0x4,    0x14,   0x9,    0x14,   0x4,    0x15,
+      0x9,   0x15,   0x4,    0x16,   0x9,    0x16,   0x4,    0x17,   0x9,
+      0x17,  0x4,    0x18,   0x9,    0x18,   0x4,    0x19,   0x9,    0x19,
+      0x4,   0x1a,   0x9,    0x1a,   0x4,    0x1b,   0x9,    0x1b,   0x4,
+      0x1c,  0x9,    0x1c,   0x4,    0x1d,   0x9,    0x1d,   0x4,    0x1e,
+      0x9,   0x1e,   0x4,    0x1f,   0x9,    0x1f,   0x4,    0x20,   0x9,
+      0x20,  0x4,    0x21,   0x9,    0x21,   0x4,    0x22,   0x9,    0x22,
+      0x4,   0x23,   0x9,    0x23,   0x4,    0x24,   0x9,    0x24,   0x4,
+      0x25,  0x9,    0x25,   0x4,    0x26,   0x9,    0x26,   0x4,    0x27,
+      0x9,   0x27,   0x4,    0x28,   0x9,    0x28,   0x4,    0x29,   0x9,
+      0x29,  0x4,    0x2a,   0x9,    0x2a,   0x4,    0x2b,   0x9,    0x2b,
+      0x4,   0x2c,   0x9,    0x2c,   0x4,    0x2d,   0x9,    0x2d,   0x4,
+      0x2e,  0x9,    0x2e,   0x4,    0x2f,   0x9,    0x2f,   0x4,    0x30,
+      0x9,   0x30,   0x4,    0x31,   0x9,    0x31,   0x4,    0x32,   0x9,
+      0x32,  0x4,    0x33,   0x9,    0x33,   0x4,    0x34,   0x9,    0x34,
+      0x4,   0x35,   0x9,    0x35,   0x4,    0x36,   0x9,    0x36,   0x4,
+      0x37,  0x9,    0x37,   0x4,    0x38,   0x9,    0x38,   0x4,    0x39,
+      0x9,   0x39,   0x4,    0x3a,   0x9,    0x3a,   0x4,    0x3b,   0x9,
+      0x3b,  0x4,    0x3c,   0x9,    0x3c,   0x4,    0x3d,   0x9,    0x3d,
+      0x4,   0x3e,   0x9,    0x3e,   0x4,    0x3f,   0x9,    0x3f,   0x4,
+      0x40,  0x9,    0x40,   0x4,    0x41,   0x9,    0x41,   0x4,    0x42,
+      0x9,   0x42,   0x4,    0x43,   0x9,    0x43,   0x4,    0x44,   0x9,
+      0x44,  0x4,    0x45,   0x9,    0x45,   0x4,    0x46,   0x9,    0x46,
+      0x4,   0x47,   0x9,    0x47,   0x3,    0x2,    0x3,    0x2,    0x5,
+      0x2,   0x91,   0xa,    0x2,    0x3,    0x2,    0x3,    0x2,    0x3,
+      0x2,   0x3,    0x2,    0x3,    0x2,    0x3,    0x2,    0x3,    0x2,
+      0x3,   0x2,    0x3,    0x2,    0x3,    0x2,    0x3,    0x2,    0x3,
+      0x2,   0x5,    0x2,    0x9f,   0xa,    0x2,    0x3,    0x2,    0x3,
+      0x2,   0x3,    0x2,    0x7,    0x2,    0xa4,   0xa,    0x2,    0xc,
+      0x2,   0xe,    0x2,    0xa7,   0xb,    0x2,    0x3,    0x3,    0x3,
+      0x3,   0x3,    0x3,    0x7,    0x3,    0xac,   0xa,    0x3,    0xc,
+      0x3,   0xe,    0x3,    0xaf,   0xb,    0x3,    0x5,    0x3,    0xb1,
+      0xa,   0x3,    0x3,    0x4,    0x3,    0x4,    0x3,    0x4,    0x3,
+      0x4,   0x3,    0x5,    0x3,    0x5,    0x3,    0x5,    0x3,    0x5,
+      0x3,   0x5,    0x3,    0x5,    0x3,    0x5,    0x3,    0x5,    0x7,
+      0x5,   0xbf,   0xa,    0x5,    0xc,    0x5,    0xe,    0x5,    0xc2,
+      0xb,   0x5,    0x3,    0x5,    0x5,    0x5,    0xc5,   0xa,    0x5,
+      0x3,   0x6,    0x3,    0x6,    0x5,    0x6,    0xc9,   0xa,    0x6,
+      0x3,   0x6,    0x3,    0x6,    0x7,    0x6,    0xcd,   0xa,    0x6,
+      0xc,   0x6,    0xe,    0x6,    0xd0,   0xb,    0x6,    0x3,    0x6,
+      0x3,   0x6,    0x5,    0x6,    0xd4,   0xa,    0x6,    0x3,    0x6,
+      0x3,   0x6,    0x3,    0x6,    0x3,    0x6,    0x5,    0x6,    0xda,
+      0xa,   0x6,    0x3,    0x7,    0x3,    0x7,    0x3,    0x7,    0x3,
+      0x7,   0x3,    0x7,    0x5,    0x7,    0xe1,   0xa,    0x7,    0x3,
+      0x8,   0x3,    0x8,    0x5,    0x8,    0xe5,   0xa,    0x8,    0x3,
+      0x9,   0x3,    0x9,    0x3,    0x9,    0x3,    0x9,    0x7,    0x9,
+      0xeb,  0xa,    0x9,    0xc,    0x9,    0xe,    0x9,    0xee,   0xb,
+      0x9,   0x5,    0x9,    0xf0,   0xa,    0x9,    0x3,    0xa,    0x3,
+      0xa,   0x3,    0xa,    0x3,    0xa,    0x7,    0xa,    0xf6,   0xa,
+      0xa,   0xc,    0xa,    0xe,    0xa,    0xf9,   0xb,    0xa,    0x5,
+      0xa,   0xfb,   0xa,    0xa,    0x3,    0xb,    0x3,    0xb,    0x3,
+      0xb,   0x5,    0xb,    0x100,  0xa,    0xb,    0x3,    0xc,    0x3,
+      0xc,   0x5,    0xc,    0x104,  0xa,    0xc,    0x3,    0xc,    0x3,
+      0xc,   0x7,    0xc,    0x108,  0xa,    0xc,    0xc,    0xc,    0xe,
+      0xc,   0x10b,  0xb,    0xc,    0x3,    0xc,    0x3,    0xc,    0x3,
+      0xc,   0x3,    0xc,    0x3,    0xc,    0x3,    0xc,    0x3,    0xc,
+      0x3,   0xc,    0x3,    0xc,    0x3,    0xc,    0x5,    0xc,    0x117,
+      0xa,   0xc,    0x3,    0xd,    0x3,    0xd,    0x5,    0xd,    0x11b,
+      0xa,   0xd,    0x3,    0xe,    0x3,    0xe,    0x3,    0xf,    0x3,
+      0xf,   0x3,    0xf,    0x3,    0xf,    0x3,    0xf,    0x3,    0xf,
+      0x3,   0xf,    0x3,    0xf,    0x3,    0xf,    0x7,    0xf,    0x128,
+      0xa,   0xf,    0xc,    0xf,    0xe,    0xf,    0x12b,  0xb,    0xf,
+      0x3,   0x10,   0x3,    0x10,   0x3,    0x10,   0x3,    0x10,   0x3,
+      0x10,  0x3,    0x10,   0x7,    0x10,   0x133,  0xa,    0x10,   0xc,
+      0x10,  0xe,    0x10,   0x136,  0xb,    0x10,   0x3,    0x11,   0x3,
+      0x11,  0x3,    0x11,   0x3,    0x11,   0x3,    0x11,   0x3,    0x11,
+      0x7,   0x11,   0x13e,  0xa,    0x11,   0xc,    0x11,   0xe,    0x11,
+      0x141, 0xb,    0x11,   0x3,    0x12,   0x3,    0x12,   0x3,    0x12,
+      0x3,   0x12,   0x3,    0x12,   0x3,    0x12,   0x7,    0x12,   0x149,
+      0xa,   0x12,   0xc,    0x12,   0xe,    0x12,   0x14c,  0xb,    0x12,
+      0x3,   0x13,   0x3,    0x13,   0x3,    0x13,   0x3,    0x13,   0x3,
+      0x13,  0x3,    0x13,   0x7,    0x13,   0x154,  0xa,    0x13,   0xc,
+      0x13,  0xe,    0x13,   0x157,  0xb,    0x13,   0x3,    0x14,   0x3,
+      0x14,  0x3,    0x14,   0x3,    0x14,   0x3,    0x14,   0x3,    0x14,
+      0x7,   0x14,   0x15f,  0xa,    0x14,   0xc,    0x14,   0xe,    0x14,
+      0x162, 0xb,    0x14,   0x3,    0x15,   0x3,    0x15,   0x3,    0x15,
+      0x3,   0x15,   0x3,    0x15,   0x3,    0x15,   0x7,    0x15,   0x16a,
+      0xa,   0x15,   0xc,    0x15,   0xe,    0x15,   0x16d,  0xb,    0x15,
+      0x3,   0x16,   0x3,    0x16,   0x3,    0x16,   0x3,    0x16,   0x3,
+      0x16,  0x3,    0x16,   0x7,    0x16,   0x175,  0xa,    0x16,   0xc,
+      0x16,  0xe,    0x16,   0x178,  0xb,    0x16,   0x3,    0x17,   0x3,
+      0x17,  0x3,    0x17,   0x3,    0x17,   0x3,    0x17,   0x3,    0x17,
+      0x7,   0x17,   0x180,  0xa,    0x17,   0xc,    0x17,   0xe,    0x17,
+      0x183, 0xb,    0x17,   0x3,    0x18,   0x3,    0x18,   0x3,    0x18,
+      0x5,   0x18,   0x188,  0xa,    0x18,   0x3,    0x19,   0x3,    0x19,
+      0x3,   0x19,   0x5,    0x19,   0x18d,  0xa,    0x19,   0x3,    0x19,
+      0x3,   0x19,   0x3,    0x19,   0x3,    0x19,   0x3,    0x19,   0x3,
+      0x19,  0x3,    0x19,   0x3,    0x19,   0x7,    0x19,   0x197,  0xa,
+      0x19,  0xc,    0x19,   0xe,    0x19,   0x19a,  0xb,    0x19,   0x3,
+      0x1a,  0x3,    0x1a,   0x3,    0x1a,   0x3,    0x1a,   0x3,    0x1a,
+      0x3,   0x1a,   0x3,    0x1a,   0x3,    0x1a,   0x3,    0x1a,   0x3,
+      0x1a,  0x5,    0x1a,   0x1a6,  0xa,    0x1a,   0x3,    0x1b,   0x3,
+      0x1b,  0x3,    0x1b,   0x3,    0x1b,   0x5,    0x1b,   0x1ac,  0xa,
+      0x1b,  0x5,    0x1b,   0x1ae,  0xa,    0x1b,   0x3,    0x1c,   0x3,
+      0x1c,  0x5,    0x1c,   0x1b2,  0xa,    0x1c,   0x3,    0x1d,   0x3,
+      0x1d,  0x3,    0x1d,   0x3,    0x1d,   0x3,    0x1d,   0x3,    0x1d,
+      0x3,   0x1d,   0x5,    0x1d,   0x1bb,  0xa,    0x1d,   0x3,    0x1e,
+      0x5,   0x1e,   0x1be,  0xa,    0x1e,   0x3,    0x1f,   0x3,    0x1f,
+      0x3,   0x1f,   0x3,    0x1f,   0x3,    0x1f,   0x3,    0x1f,   0x3,
+      0x1f,  0x3,    0x1f,   0x3,    0x1f,   0x3,    0x1f,   0x3,    0x20,
+      0x3,   0x20,   0x5,    0x20,   0x1cc,  0xa,    0x20,   0x3,    0x20,
+      0x3,   0x20,   0x5,    0x20,   0x1d0,  0xa,    0x20,   0x3,    0x20,
+      0x3,   0x20,   0x3,    0x21,   0x5,    0x21,   0x1d5,  0xa,    0x21,
+      0x3,   0x22,   0x3,    0x22,   0x3,    0x22,   0x3,    0x22,   0x3,
+      0x22,  0x3,    0x22,   0x3,    0x22,   0x3,    0x22,   0x3,    0x22,
+      0x3,   0x23,   0x3,    0x23,   0x3,    0x24,   0x3,    0x24,   0x5,
+      0x24,  0x1e4,  0xa,    0x24,   0x3,    0x24,   0x3,    0x24,   0x7,
+      0x24,  0x1e8,  0xa,    0x24,   0xc,    0x24,   0xe,    0x24,   0x1eb,
+      0xb,   0x24,   0x3,    0x24,   0x3,    0x24,   0x3,    0x25,   0x3,
+      0x25,  0x5,    0x25,   0x1f1,  0xa,    0x25,   0x3,    0x25,   0x3,
+      0x25,  0x3,    0x25,   0x3,    0x26,   0x3,    0x26,   0x3,    0x27,
+      0x3,   0x27,   0x3,    0x27,   0x3,    0x27,   0x3,    0x27,   0x3,
+      0x28,  0x3,    0x28,   0x3,    0x28,   0x5,    0x28,   0x200,  0xa,
+      0x28,  0x3,    0x29,   0x5,    0x29,   0x203,  0xa,    0x29,   0x3,
+      0x29,  0x3,    0x29,   0x3,    0x2a,   0x3,    0x2a,   0x3,    0x2b,
+      0x3,   0x2b,   0x5,    0x2b,   0x20b,  0xa,    0x2b,   0x3,    0x2b,
+      0x3,   0x2b,   0x3,    0x2b,   0x3,    0x2b,   0x3,    0x2b,   0x3,
+      0x2b,  0x5,    0x2b,   0x213,  0xa,    0x2b,   0x3,    0x2c,   0x3,
+      0x2c,  0x3,    0x2c,   0x3,    0x2c,   0x3,    0x2c,   0x3,    0x2c,
+      0x3,   0x2d,   0x3,    0x2d,   0x5,    0x2d,   0x21d,  0xa,    0x2d,
+      0x3,   0x2e,   0x3,    0x2e,   0x3,    0x2f,   0x3,    0x2f,   0x3,
+      0x30,  0x3,    0x30,   0x3,    0x30,   0x5,    0x30,   0x226,  0xa,
+      0x30,  0x3,    0x31,   0x3,    0x31,   0x3,    0x31,   0x3,    0x31,
+      0x3,   0x32,   0x3,    0x32,   0x3,    0x32,   0x6,    0x32,   0x22f,
+      0xa,   0x32,   0xd,    0x32,   0xe,    0x32,   0x230,  0x3,    0x33,
+      0x3,   0x33,   0x3,    0x33,   0x3,    0x33,   0x3,    0x33,   0x3,
+      0x33,  0x3,    0x33,   0x5,    0x33,   0x23a,  0xa,    0x33,   0x3,
+      0x34,  0x3,    0x34,   0x3,    0x34,   0x3,    0x34,   0x3,    0x34,
+      0x3,   0x34,   0x3,    0x34,   0x3,    0x34,   0x3,    0x34,   0x3,
+      0x34,  0x3,    0x34,   0x3,    0x34,   0x3,    0x34,   0x3,    0x34,
+      0x3,   0x34,   0x3,    0x34,   0x3,    0x34,   0x3,    0x34,   0x3,
+      0x34,  0x3,    0x34,   0x3,    0x34,   0x3,    0x34,   0x3,    0x34,
+      0x3,   0x34,   0x3,    0x34,   0x3,    0x34,   0x3,    0x34,   0x3,
+      0x34,  0x3,    0x34,   0x5,    0x34,   0x259,  0xa,    0x34,   0x3,
+      0x35,  0x7,    0x35,   0x25c,  0xa,    0x35,   0xc,    0x35,   0xe,
+      0x35,  0x25f,  0xb,    0x35,   0x3,    0x36,   0x5,    0x36,   0x262,
+      0xa,   0x36,   0x3,    0x36,   0x3,    0x36,   0x3,    0x36,   0x3,
+      0x36,  0x3,    0x37,   0x3,    0x37,   0x5,    0x37,   0x26a,  0xa,
+      0x37,  0x3,    0x38,   0x3,    0x38,   0x3,    0x39,   0x3,    0x39,
+      0x3,   0x39,   0x3,    0x3a,   0x3,    0x3a,   0x3,    0x3a,   0x3,
+      0x3b,  0x3,    0x3b,   0x3,    0x3b,   0x3,    0x3c,   0x3,    0x3c,
+      0x3,   0x3c,   0x5,    0x3c,   0x27a,  0xa,    0x3c,   0x3,    0x3c,
+      0x5,   0x3c,   0x27d,  0xa,    0x3c,   0x3,    0x3c,   0x5,    0x3c,
+      0x280, 0xa,    0x3c,   0x3,    0x3c,   0x3,    0x3c,   0x3,    0x3d,
+      0x3,   0x3d,   0x3,    0x3d,   0x3,    0x3d,   0x3,    0x3d,   0x3,
+      0x3d,  0x3,    0x3e,   0x3,    0x3e,   0x5,    0x3e,   0x28c,  0xa,
+      0x3e,  0x3,    0x3e,   0x3,    0x3e,   0x3,    0x3e,   0x3,    0x3e,
+      0x3,   0x3e,   0x3,    0x3e,   0x3,    0x3e,   0x3,    0x3e,   0x3,
+      0x3e,  0x3,    0x3f,   0x3,    0x3f,   0x3,    0x3f,   0x5,    0x3f,
+      0x29a, 0xa,    0x3f,   0x3,    0x3f,   0x3,    0x3f,   0x3,    0x3f,
+      0x3,   0x3f,   0x3,    0x3f,   0x3,    0x3f,   0x3,    0x3f,   0x3,
+      0x3f,  0x3,    0x40,   0x3,    0x40,   0x3,    0x40,   0x3,    0x40,
+      0x3,   0x40,   0x3,    0x40,   0x3,    0x40,   0x3,    0x41,   0x5,
+      0x41,  0x2ac,  0xa,    0x41,   0x3,    0x41,   0x3,    0x41,   0x3,
+      0x41,  0x3,    0x41,   0x3,    0x41,   0x3,    0x41,   0x3,    0x41,
+      0x5,   0x41,   0x2b5,  0xa,    0x41,   0x3,    0x42,   0x3,    0x42,
+      0x3,   0x42,   0x3,    0x42,   0x3,    0x42,   0x3,    0x42,   0x3,
+      0x42,  0x3,    0x43,   0x3,    0x43,   0x5,    0x43,   0x2c0,  0xa,
+      0x43,  0x3,    0x43,   0x3,    0x43,   0x3,    0x43,   0x3,    0x43,
+      0x3,   0x43,   0x3,    0x43,   0x3,    0x43,   0x3,    0x43,   0x5,
+      0x43,  0x2ca,  0xa,    0x43,   0x3,    0x44,   0x3,    0x44,   0x3,
+      0x44,  0x3,    0x44,   0x3,    0x44,   0x3,    0x44,   0x3,    0x44,
+      0x3,   0x45,   0x3,    0x45,   0x3,    0x45,   0x3,    0x45,   0x3,
+      0x45,  0x3,    0x45,   0x3,    0x45,   0x3,    0x45,   0x3,    0x45,
+      0x5,   0x45,   0x2dc,  0xa,    0x45,   0x3,    0x46,   0x3,    0x46,
+      0x3,   0x46,   0x3,    0x46,   0x7,    0x46,   0x2e2,  0xa,    0x46,
+      0xc,   0x46,   0xe,    0x46,   0x2e5,  0xb,    0x46,   0x3,    0x46,
+      0x3,   0x46,   0x3,    0x47,   0x3,    0x47,   0x7,    0x47,   0x2eb,
+      0xa,   0x47,   0xc,    0x47,   0xe,    0x47,   0x2ee,  0xb,    0x47,
+      0x3,   0x47,   0x2,    0xd,    0x2,    0x1c,   0x1e,   0x20,   0x22,
+      0x24,  0x26,   0x28,   0x2a,   0x2c,   0x30,   0x48,   0x2,    0x4,
+      0x6,   0x8,    0xa,    0xc,    0xe,    0x10,   0x12,   0x14,   0x16,
+      0x18,  0x1a,   0x1c,   0x1e,   0x20,   0x22,   0x24,   0x26,   0x28,
+      0x2a,  0x2c,   0x2e,   0x30,   0x32,   0x34,   0x36,   0x38,   0x3a,
+      0x3c,  0x3e,   0x40,   0x42,   0x44,   0x46,   0x48,   0x4a,   0x4c,
+      0x4e,  0x50,   0x52,   0x54,   0x56,   0x58,   0x5a,   0x5c,   0x5e,
+      0x60,  0x62,   0x64,   0x66,   0x68,   0x6a,   0x6c,   0x6e,   0x70,
+      0x72,  0x74,   0x76,   0x78,   0x7a,   0x7c,   0x7e,   0x80,   0x82,
+      0x84,  0x86,   0x88,   0x8a,   0x8c,   0x2,    0xc,    0x3,    0x2,
+      0x3b,  0x3c,   0x4,    0x2,    0x35,   0x35,   0x40,   0x40,   0x3,
+      0x2,   0x41,   0x44,   0x3,    0x2,    0x45,   0x47,   0x3,    0x2,
+      0x36,  0x37,   0x3,    0x2,    0x38,   0x3a,   0x5,    0x2,    0x36,
+      0x37,  0x3d,   0x3d,   0x4c,   0x4c,   0x3,    0x2,    0x33,   0x34,
+      0x4,   0x2,    0x3e,   0x3f,   0x4e,   0x4e,   0x3,    0x2,    0x2f,
+      0x30,  0x2,    0x309,  0x2,    0x9e,   0x3,    0x2,    0x2,    0x2,
+      0x4,   0xb0,   0x3,    0x2,    0x2,    0x2,    0x6,    0xb2,   0x3,
+      0x2,   0x2,    0x2,    0x8,    0xc4,   0x3,    0x2,    0x2,    0x2,
+      0xa,   0xd9,   0x3,    0x2,    0x2,    0x2,    0xc,    0xdb,   0x3,
+      0x2,   0x2,    0x2,    0xe,    0xe4,   0x3,    0x2,    0x2,    0x2,
+      0x10,  0xef,   0x3,    0x2,    0x2,    0x2,    0x12,   0xfa,   0x3,
+      0x2,   0x2,    0x2,    0x14,   0xfc,   0x3,    0x2,    0x2,    0x2,
+      0x16,  0x116,  0x3,    0x2,    0x2,    0x2,    0x18,   0x118,  0x3,
+      0x2,   0x2,    0x2,    0x1a,   0x11c,  0x3,    0x2,    0x2,    0x2,
+      0x1c,  0x11e,  0x3,    0x2,    0x2,    0x2,    0x1e,   0x12c,  0x3,
+      0x2,   0x2,    0x2,    0x20,   0x137,  0x3,    0x2,    0x2,    0x2,
+      0x22,  0x142,  0x3,    0x2,    0x2,    0x2,    0x24,   0x14d,  0x3,
+      0x2,   0x2,    0x2,    0x26,   0x158,  0x3,    0x2,    0x2,    0x2,
+      0x28,  0x163,  0x3,    0x2,    0x2,    0x2,    0x2a,   0x16e,  0x3,
+      0x2,   0x2,    0x2,    0x2c,   0x179,  0x3,    0x2,    0x2,    0x2,
+      0x2e,  0x187,  0x3,    0x2,    0x2,    0x2,    0x30,   0x189,  0x3,
+      0x2,   0x2,    0x2,    0x32,   0x1a5,  0x3,    0x2,    0x2,    0x2,
+      0x34,  0x1ad,  0x3,    0x2,    0x2,    0x2,    0x36,   0x1b1,  0x3,
+      0x2,   0x2,    0x2,    0x38,   0x1ba,  0x3,    0x2,    0x2,    0x2,
+      0x3a,  0x1bd,  0x3,    0x2,    0x2,    0x2,    0x3c,   0x1bf,  0x3,
+      0x2,   0x2,    0x2,    0x3e,   0x1c9,  0x3,    0x2,    0x2,    0x2,
+      0x40,  0x1d4,  0x3,    0x2,    0x2,    0x2,    0x42,   0x1d6,  0x3,
+      0x2,   0x2,    0x2,    0x44,   0x1df,  0x3,    0x2,    0x2,    0x2,
+      0x46,  0x1e1,  0x3,    0x2,    0x2,    0x2,    0x48,   0x1ee,  0x3,
+      0x2,   0x2,    0x2,    0x4a,   0x1f5,  0x3,    0x2,    0x2,    0x2,
+      0x4c,  0x1f7,  0x3,    0x2,    0x2,    0x2,    0x4e,   0x1fc,  0x3,
+      0x2,   0x2,    0x2,    0x50,   0x202,  0x3,    0x2,    0x2,    0x2,
+      0x52,  0x206,  0x3,    0x2,    0x2,    0x2,    0x54,   0x208,  0x3,
+      0x2,   0x2,    0x2,    0x56,   0x214,  0x3,    0x2,    0x2,    0x2,
+      0x58,  0x21a,  0x3,    0x2,    0x2,    0x2,    0x5a,   0x21e,  0x3,
+      0x2,   0x2,    0x2,    0x5c,   0x220,  0x3,    0x2,    0x2,    0x2,
+      0x5e,  0x222,  0x3,    0x2,    0x2,    0x2,    0x60,   0x227,  0x3,
+      0x2,   0x2,    0x2,    0x62,   0x22b,  0x3,    0x2,    0x2,    0x2,
+      0x64,  0x239,  0x3,    0x2,    0x2,    0x2,    0x66,   0x258,  0x3,
+      0x2,   0x2,    0x2,    0x68,   0x25d,  0x3,    0x2,    0x2,    0x2,
+      0x6a,  0x261,  0x3,    0x2,    0x2,    0x2,    0x6c,   0x269,  0x3,
+      0x2,   0x2,    0x2,    0x6e,   0x26b,  0x3,    0x2,    0x2,    0x2,
+      0x70,  0x26d,  0x3,    0x2,    0x2,    0x2,    0x72,   0x270,  0x3,
+      0x2,   0x2,    0x2,    0x74,   0x273,  0x3,    0x2,    0x2,    0x2,
+      0x76,  0x276,  0x3,    0x2,    0x2,    0x2,    0x78,   0x283,  0x3,
+      0x2,   0x2,    0x2,    0x7a,   0x289,  0x3,    0x2,    0x2,    0x2,
+      0x7c,  0x296,  0x3,    0x2,    0x2,    0x2,    0x7e,   0x2a3,  0x3,
+      0x2,   0x2,    0x2,    0x80,   0x2ab,  0x3,    0x2,    0x2,    0x2,
+      0x82,  0x2b6,  0x3,    0x2,    0x2,    0x2,    0x84,   0x2bf,  0x3,
+      0x2,   0x2,    0x2,    0x86,   0x2cb,  0x3,    0x2,    0x2,    0x2,
+      0x88,  0x2db,  0x3,    0x2,    0x2,    0x2,    0x8a,   0x2dd,  0x3,
+      0x2,   0x2,    0x2,    0x8c,   0x2ec,  0x3,    0x2,    0x2,    0x2,
+      0x8e,  0x90,   0x8,    0x2,    0x1,    0x2,    0x8f,   0x91,   0x7,
+      0x22,  0x2,    0x2,    0x90,   0x8f,   0x3,    0x2,    0x2,    0x2,
+      0x90,  0x91,   0x3,    0x2,    0x2,    0x2,    0x91,   0x92,   0x3,
+      0x2,   0x2,    0x2,    0x92,   0x9f,   0x7,    0x4e,   0x2,    0x2,
+      0x93,  0x94,   0x7,    0x19,   0x2,    0x2,    0x94,   0x95,   0x7,
+      0x3,   0x2,    0x2,    0x95,   0x96,   0x5,    0x4,    0x3,    0x2,
+      0x96,  0x97,   0x7,    0x4,    0x2,    0x2,    0x97,   0x98,   0x7,
+      0x5,   0x2,    0x2,    0x98,   0x99,   0x5,    0x2,    0x2,    0x5,
+      0x99,  0x9f,   0x3,    0x2,    0x2,    0x2,    0x9a,   0x9b,   0x7,
+      0x3,   0x2,    0x2,    0x9b,   0x9c,   0x5,    0x2,    0x2,    0x2,
+      0x9c,  0x9d,   0x7,    0x4,    0x2,    0x2,    0x9d,   0x9f,   0x3,
+      0x2,   0x2,    0x2,    0x9e,   0x8e,   0x3,    0x2,    0x2,    0x2,
+      0x9e,  0x93,   0x3,    0x2,    0x2,    0x2,    0x9e,   0x9a,   0x3,
+      0x2,   0x2,    0x2,    0x9f,   0xa5,   0x3,    0x2,    0x2,    0x2,
+      0xa0,  0xa1,   0xc,    0x4,    0x2,    0x2,    0xa1,   0xa2,   0x7,
+      0x3b,  0x2,    0x2,    0xa2,   0xa4,   0x5,    0x2,    0x2,    0x5,
+      0xa3,  0xa0,   0x3,    0x2,    0x2,    0x2,    0xa4,   0xa7,   0x3,
+      0x2,   0x2,    0x2,    0xa5,   0xa3,   0x3,    0x2,    0x2,    0x2,
+      0xa5,  0xa6,   0x3,    0x2,    0x2,    0x2,    0xa6,   0x3,    0x3,
+      0x2,   0x2,    0x2,    0xa7,   0xa5,   0x3,    0x2,    0x2,    0x2,
+      0xa8,  0xad,   0x5,    0x2,    0x2,    0x2,    0xa9,   0xaa,   0x7,
+      0x6,   0x2,    0x2,    0xaa,   0xac,   0x5,    0x2,    0x2,    0x2,
+      0xab,  0xa9,   0x3,    0x2,    0x2,    0x2,    0xac,   0xaf,   0x3,
+      0x2,   0x2,    0x2,    0xad,   0xab,   0x3,    0x2,    0x2,    0x2,
+      0xad,  0xae,   0x3,    0x2,    0x2,    0x2,    0xae,   0xb1,   0x3,
+      0x2,   0x2,    0x2,    0xaf,   0xad,   0x3,    0x2,    0x2,    0x2,
+      0xb0,  0xa8,   0x3,    0x2,    0x2,    0x2,    0xb0,   0xb1,   0x3,
+      0x2,   0x2,    0x2,    0xb1,   0x5,    0x3,    0x2,    0x2,    0x2,
+      0xb2,  0xb3,   0x7,    0x41,   0x2,    0x2,    0xb3,   0xb4,   0x5,
+      0x4,   0x3,    0x2,    0xb4,   0xb5,   0x7,    0x43,   0x2,    0x2,
+      0xb5,  0x7,    0x3,    0x2,    0x2,    0x2,    0xb6,   0xb7,   0x7,
+      0x41,  0x2,    0x2,    0xb7,   0xb8,   0x7,    0x4e,   0x2,    0x2,
+      0xb8,  0xb9,   0x7,    0x7,    0x2,    0x2,    0xb9,   0xc0,   0x7,
+      0x8,   0x2,    0x2,    0xba,   0xbb,   0x7,    0x6,    0x2,    0x2,
+      0xbb,  0xbc,   0x7,    0x4e,   0x2,    0x2,    0xbc,   0xbd,   0x7,
+      0x7,   0x2,    0x2,    0xbd,   0xbf,   0x7,    0x8,    0x2,    0x2,
+      0xbe,  0xba,   0x3,    0x2,    0x2,    0x2,    0xbf,   0xc2,   0x3,
+      0x2,   0x2,    0x2,    0xc0,   0xbe,   0x3,    0x2,    0x2,    0x2,
+      0xc0,  0xc1,   0x3,    0x2,    0x2,    0x2,    0xc1,   0xc3,   0x3,
+      0x2,   0x2,    0x2,    0xc2,   0xc0,   0x3,    0x2,    0x2,    0x2,
+      0xc3,  0xc5,   0x7,    0x43,   0x2,    0x2,    0xc4,   0xb6,   0x3,
+      0x2,   0x2,    0x2,    0xc4,   0xc5,   0x3,    0x2,    0x2,    0x2,
+      0xc5,  0x9,    0x3,    0x2,    0x2,    0x2,    0xc6,   0xc8,   0x7,
+      0x3,   0x2,    0x2,    0xc7,   0xc9,   0x5,    0x2,    0x2,    0x2,
+      0xc8,  0xc7,   0x3,    0x2,    0x2,    0x2,    0xc8,   0xc9,   0x3,
+      0x2,   0x2,    0x2,    0xc9,   0xce,   0x3,    0x2,    0x2,    0x2,
+      0xca,  0xcb,   0x7,    0x6,    0x2,    0x2,    0xcb,   0xcd,   0x5,
+      0x2,   0x2,    0x2,    0xcc,   0xca,   0x3,    0x2,    0x2,    0x2,
+      0xcd,  0xd0,   0x3,    0x2,    0x2,    0x2,    0xce,   0xcc,   0x3,
+      0x2,   0x2,    0x2,    0xce,   0xcf,   0x3,    0x2,    0x2,    0x2,
+      0xcf,  0xd3,   0x3,    0x2,    0x2,    0x2,    0xd0,   0xce,   0x3,
+      0x2,   0x2,    0x2,    0xd1,   0xd2,   0x7,    0x6,    0x2,    0x2,
+      0xd2,  0xd4,   0x7,    0x48,   0x2,    0x2,    0xd3,   0xd1,   0x3,
+      0x2,   0x2,    0x2,    0xd3,   0xd4,   0x3,    0x2,    0x2,    0x2,
+      0xd4,  0xd5,   0x3,    0x2,    0x2,    0x2,    0xd5,   0xda,   0x7,
+      0x4,   0x2,    0x2,    0xd6,   0xd7,   0x7,    0x3,    0x2,    0x2,
+      0xd7,  0xd8,   0x7,    0x48,   0x2,    0x2,    0xd8,   0xda,   0x7,
+      0x4,   0x2,    0x2,    0xd9,   0xc6,   0x3,    0x2,    0x2,    0x2,
+      0xd9,  0xd6,   0x3,    0x2,    0x2,    0x2,    0xda,   0xb,    0x3,
+      0x2,   0x2,    0x2,    0xdb,   0xe0,   0x7,    0x4e,   0x2,    0x2,
+      0xdc,  0xdd,   0x7,    0x3,    0x2,    0x2,    0xdd,   0xde,   0x5,
+      0x4,   0x3,    0x2,    0xde,   0xdf,   0x7,    0x4,    0x2,    0x2,
+      0xdf,  0xe1,   0x3,    0x2,    0x2,    0x2,    0xe0,   0xdc,   0x3,
+      0x2,   0x2,    0x2,    0xe0,   0xe1,   0x3,    0x2,    0x2,    0x2,
+      0xe1,  0xd,    0x3,    0x2,    0x2,    0x2,    0xe2,   0xe3,   0x7,
+      0x7,   0x2,    0x2,    0xe3,   0xe5,   0x5,    0x2,    0x2,    0x2,
+      0xe4,  0xe2,   0x3,    0x2,    0x2,    0x2,    0xe4,   0xe5,   0x3,
+      0x2,   0x2,    0x2,    0xe5,   0xf,    0x3,    0x2,    0x2,    0x2,
+      0xe6,  0xe7,   0x7,    0x29,   0x2,    0x2,    0xe7,   0xec,   0x5,
+      0xc,   0x7,    0x2,    0xe8,   0xe9,   0x7,    0x6,    0x2,    0x2,
+      0xe9,  0xeb,   0x5,    0xc,    0x7,    0x2,    0xea,   0xe8,   0x3,
+      0x2,   0x2,    0x2,    0xeb,   0xee,   0x3,    0x2,    0x2,    0x2,
+      0xec,  0xea,   0x3,    0x2,    0x2,    0x2,    0xec,   0xed,   0x3,
+      0x2,   0x2,    0x2,    0xed,   0xf0,   0x3,    0x2,    0x2,    0x2,
+      0xee,  0xec,   0x3,    0x2,    0x2,    0x2,    0xef,   0xe6,   0x3,
+      0x2,   0x2,    0x2,    0xef,   0xf0,   0x3,    0x2,    0x2,    0x2,
+      0xf0,  0x11,   0x3,    0x2,    0x2,    0x2,    0xf1,   0xf2,   0x7,
+      0x26,  0x2,    0x2,    0xf2,   0xf7,   0x7,    0x4e,   0x2,    0x2,
+      0xf3,  0xf4,   0x7,    0x6,    0x2,    0x2,    0xf4,   0xf6,   0x7,
+      0x4e,  0x2,    0x2,    0xf5,   0xf3,   0x3,    0x2,    0x2,    0x2,
+      0xf6,  0xf9,   0x3,    0x2,    0x2,    0x2,    0xf7,   0xf5,   0x3,
+      0x2,   0x2,    0x2,    0xf7,   0xf8,   0x3,    0x2,    0x2,    0x2,
+      0xf8,  0xfb,   0x3,    0x2,    0x2,    0x2,    0xf9,   0xf7,   0x3,
+      0x2,   0x2,    0x2,    0xfa,   0xf1,   0x3,    0x2,    0x2,    0x2,
+      0xfa,  0xfb,   0x3,    0x2,    0x2,    0x2,    0xfb,   0x13,   0x3,
+      0x2,   0x2,    0x2,    0xfc,   0xfd,   0x7,    0x4e,   0x2,    0x2,
+      0xfd,  0xff,   0x7,    0x7,    0x2,    0x2,    0xfe,   0x100,  0x5,
+      0x2,   0x2,    0x2,    0xff,   0xfe,   0x3,    0x2,    0x2,    0x2,
+      0xff,  0x100,  0x3,    0x2,    0x2,    0x2,    0x100,  0x15,   0x3,
+      0x2,   0x2,    0x2,    0x101,  0x103,  0x7,    0x3,    0x2,    0x2,
+      0x102, 0x104,  0x5,    0x14,   0xb,    0x2,    0x103,  0x102,  0x3,
+      0x2,   0x2,    0x2,    0x103,  0x104,  0x3,    0x2,    0x2,    0x2,
+      0x104, 0x109,  0x3,    0x2,    0x2,    0x2,    0x105,  0x106,  0x7,
+      0x6,   0x2,    0x2,    0x106,  0x108,  0x5,    0x14,   0xb,    0x2,
+      0x107, 0x105,  0x3,    0x2,    0x2,    0x2,    0x108,  0x10b,  0x3,
+      0x2,   0x2,    0x2,    0x109,  0x107,  0x3,    0x2,    0x2,    0x2,
+      0x109, 0x10a,  0x3,    0x2,    0x2,    0x2,    0x10a,  0x10c,  0x3,
+      0x2,   0x2,    0x2,    0x10b,  0x109,  0x3,    0x2,    0x2,    0x2,
+      0x10c, 0x117,  0x7,    0x4,    0x2,    0x2,    0x10d,  0x10e,  0x7,
+      0x3,   0x2,    0x2,    0x10e,  0x10f,  0x5,    0x14,   0xb,    0x2,
+      0x10f, 0x110,  0x7,    0x6,    0x2,    0x2,    0x110,  0x111,  0x5,
+      0x14,  0xb,    0x2,    0x111,  0x112,  0x7,    0x6,    0x2,    0x2,
+      0x112, 0x113,  0x7,    0x48,   0x2,    0x2,    0x113,  0x114,  0x7,
+      0x4e,  0x2,    0x2,    0x114,  0x115,  0x7,    0x4,    0x2,    0x2,
+      0x115, 0x117,  0x3,    0x2,    0x2,    0x2,    0x116,  0x101,  0x3,
+      0x2,   0x2,    0x2,    0x116,  0x10d,  0x3,    0x2,    0x2,    0x2,
+      0x117, 0x17,   0x3,    0x2,    0x2,    0x2,    0x118,  0x11a,  0x7,
+      0x4e,  0x2,    0x2,    0x119,  0x11b,  0x5,    0x16,   0xc,    0x2,
+      0x11a, 0x119,  0x3,    0x2,    0x2,    0x2,    0x11a,  0x11b,  0x3,
+      0x2,   0x2,    0x2,    0x11b,  0x19,   0x3,    0x2,    0x2,    0x2,
+      0x11c, 0x11d,  0x5,    0x1c,   0xf,    0x2,    0x11d,  0x1b,   0x3,
+      0x2,   0x2,    0x2,    0x11e,  0x11f,  0x8,    0xf,    0x1,    0x2,
+      0x11f, 0x120,  0x5,    0x1e,   0x10,   0x2,    0x120,  0x129,  0x3,
+      0x2,   0x2,    0x2,    0x121,  0x122,  0xc,    0x3,    0x2,    0x2,
+      0x122, 0x123,  0x7,    0x9,    0x2,    0x2,    0x123,  0x124,  0x5,
+      0x1e,  0x10,   0x2,    0x124,  0x125,  0x7,    0x7,    0x2,    0x2,
+      0x125, 0x126,  0x5,    0x1e,   0x10,   0x2,    0x126,  0x128,  0x3,
+      0x2,   0x2,    0x2,    0x127,  0x121,  0x3,    0x2,    0x2,    0x2,
+      0x128, 0x12b,  0x3,    0x2,    0x2,    0x2,    0x129,  0x127,  0x3,
+      0x2,   0x2,    0x2,    0x129,  0x12a,  0x3,    0x2,    0x2,    0x2,
+      0x12a, 0x1d,   0x3,    0x2,    0x2,    0x2,    0x12b,  0x129,  0x3,
+      0x2,   0x2,    0x2,    0x12c,  0x12d,  0x8,    0x10,   0x1,    0x2,
+      0x12d, 0x12e,  0x5,    0x20,   0x11,   0x2,    0x12e,  0x134,  0x3,
+      0x2,   0x2,    0x2,    0x12f,  0x130,  0xc,    0x3,    0x2,    0x2,
+      0x130, 0x131,  0x7,    0xa,    0x2,    0x2,    0x131,  0x133,  0x5,
+      0x20,  0x11,   0x2,    0x132,  0x12f,  0x3,    0x2,    0x2,    0x2,
+      0x133, 0x136,  0x3,    0x2,    0x2,    0x2,    0x134,  0x132,  0x3,
+      0x2,   0x2,    0x2,    0x134,  0x135,  0x3,    0x2,    0x2,    0x2,
+      0x135, 0x1f,   0x3,    0x2,    0x2,    0x2,    0x136,  0x134,  0x3,
+      0x2,   0x2,    0x2,    0x137,  0x138,  0x8,    0x11,   0x1,    0x2,
+      0x138, 0x139,  0x5,    0x22,   0x12,   0x2,    0x139,  0x13f,  0x3,
+      0x2,   0x2,    0x2,    0x13a,  0x13b,  0xc,    0x3,    0x2,    0x2,
+      0x13b, 0x13c,  0x7,    0xb,    0x2,    0x2,    0x13c,  0x13e,  0x5,
+      0x22,  0x12,   0x2,    0x13d,  0x13a,  0x3,    0x2,    0x2,    0x2,
+      0x13e, 0x141,  0x3,    0x2,    0x2,    0x2,    0x13f,  0x13d,  0x3,
+      0x2,   0x2,    0x2,    0x13f,  0x140,  0x3,    0x2,    0x2,    0x2,
+      0x140, 0x21,   0x3,    0x2,    0x2,    0x2,    0x141,  0x13f,  0x3,
+      0x2,   0x2,    0x2,    0x142,  0x143,  0x8,    0x12,   0x1,    0x2,
+      0x143, 0x144,  0x5,    0x24,   0x13,   0x2,    0x144,  0x14a,  0x3,
+      0x2,   0x2,    0x2,    0x145,  0x146,  0xc,    0x3,    0x2,    0x2,
+      0x146, 0x147,  0x9,    0x2,    0x2,    0x2,    0x147,  0x149,  0x5,
+      0x24,  0x13,   0x2,    0x148,  0x145,  0x3,    0x2,    0x2,    0x2,
+      0x149, 0x14c,  0x3,    0x2,    0x2,    0x2,    0x14a,  0x148,  0x3,
+      0x2,   0x2,    0x2,    0x14a,  0x14b,  0x3,    0x2,    0x2,    0x2,
+      0x14b, 0x23,   0x3,    0x2,    0x2,    0x2,    0x14c,  0x14a,  0x3,
+      0x2,   0x2,    0x2,    0x14d,  0x14e,  0x8,    0x13,   0x1,    0x2,
+      0x14e, 0x14f,  0x5,    0x26,   0x14,   0x2,    0x14f,  0x155,  0x3,
+      0x2,   0x2,    0x2,    0x150,  0x151,  0xc,    0x3,    0x2,    0x2,
+      0x151, 0x152,  0x9,    0x3,    0x2,    0x2,    0x152,  0x154,  0x5,
+      0x26,  0x14,   0x2,    0x153,  0x150,  0x3,    0x2,    0x2,    0x2,
+      0x154, 0x157,  0x3,    0x2,    0x2,    0x2,    0x155,  0x153,  0x3,
+      0x2,   0x2,    0x2,    0x155,  0x156,  0x3,    0x2,    0x2,    0x2,
+      0x156, 0x25,   0x3,    0x2,    0x2,    0x2,    0x157,  0x155,  0x3,
+      0x2,   0x2,    0x2,    0x158,  0x159,  0x8,    0x14,   0x1,    0x2,
+      0x159, 0x15a,  0x5,    0x28,   0x15,   0x2,    0x15a,  0x160,  0x3,
+      0x2,   0x2,    0x2,    0x15b,  0x15c,  0xc,    0x3,    0x2,    0x2,
+      0x15c, 0x15d,  0x9,    0x4,    0x2,    0x2,    0x15d,  0x15f,  0x5,
+      0x28,  0x15,   0x2,    0x15e,  0x15b,  0x3,    0x2,    0x2,    0x2,
+      0x15f, 0x162,  0x3,    0x2,    0x2,    0x2,    0x160,  0x15e,  0x3,
+      0x2,   0x2,    0x2,    0x160,  0x161,  0x3,    0x2,    0x2,    0x2,
+      0x161, 0x27,   0x3,    0x2,    0x2,    0x2,    0x162,  0x160,  0x3,
+      0x2,   0x2,    0x2,    0x163,  0x164,  0x8,    0x15,   0x1,    0x2,
+      0x164, 0x165,  0x5,    0x2a,   0x16,   0x2,    0x165,  0x16b,  0x3,
+      0x2,   0x2,    0x2,    0x166,  0x167,  0xc,    0x3,    0x2,    0x2,
+      0x167, 0x168,  0x9,    0x5,    0x2,    0x2,    0x168,  0x16a,  0x5,
+      0x2a,  0x16,   0x2,    0x169,  0x166,  0x3,    0x2,    0x2,    0x2,
+      0x16a, 0x16d,  0x3,    0x2,    0x2,    0x2,    0x16b,  0x169,  0x3,
+      0x2,   0x2,    0x2,    0x16b,  0x16c,  0x3,    0x2,    0x2,    0x2,
+      0x16c, 0x29,   0x3,    0x2,    0x2,    0x2,    0x16d,  0x16b,  0x3,
+      0x2,   0x2,    0x2,    0x16e,  0x16f,  0x8,    0x16,   0x1,    0x2,
+      0x16f, 0x170,  0x5,    0x2c,   0x17,   0x2,    0x170,  0x176,  0x3,
+      0x2,   0x2,    0x2,    0x171,  0x172,  0xc,    0x3,    0x2,    0x2,
+      0x172, 0x173,  0x9,    0x6,    0x2,    0x2,    0x173,  0x175,  0x5,
+      0x2c,  0x17,   0x2,    0x174,  0x171,  0x3,    0x2,    0x2,    0x2,
+      0x175, 0x178,  0x3,    0x2,    0x2,    0x2,    0x176,  0x174,  0x3,
+      0x2,   0x2,    0x2,    0x176,  0x177,  0x3,    0x2,    0x2,    0x2,
+      0x177, 0x2b,   0x3,    0x2,    0x2,    0x2,    0x178,  0x176,  0x3,
+      0x2,   0x2,    0x2,    0x179,  0x17a,  0x8,    0x17,   0x1,    0x2,
+      0x17a, 0x17b,  0x5,    0x2e,   0x18,   0x2,    0x17b,  0x181,  0x3,
+      0x2,   0x2,    0x2,    0x17c,  0x17d,  0xc,    0x3,    0x2,    0x2,
+      0x17d, 0x17e,  0x9,    0x7,    0x2,    0x2,    0x17e,  0x180,  0x5,
+      0x2e,  0x18,   0x2,    0x17f,  0x17c,  0x3,    0x2,    0x2,    0x2,
+      0x180, 0x183,  0x3,    0x2,    0x2,    0x2,    0x181,  0x17f,  0x3,
+      0x2,   0x2,    0x2,    0x181,  0x182,  0x3,    0x2,    0x2,    0x2,
+      0x182, 0x2d,   0x3,    0x2,    0x2,    0x2,    0x183,  0x181,  0x3,
+      0x2,   0x2,    0x2,    0x184,  0x188,  0x5,    0x36,   0x1c,   0x2,
+      0x185, 0x186,  0x9,    0x8,    0x2,    0x2,    0x186,  0x188,  0x5,
+      0x2e,  0x18,   0x2,    0x187,  0x184,  0x3,    0x2,    0x2,    0x2,
+      0x187, 0x185,  0x3,    0x2,    0x2,    0x2,    0x188,  0x2f,   0x3,
+      0x2,   0x2,    0x2,    0x189,  0x18a,  0x8,    0x19,   0x1,    0x2,
+      0x18a, 0x18c,  0x7,    0x4e,   0x2,    0x2,    0x18b,  0x18d,  0x5,
+      0x6,   0x4,    0x2,    0x18c,  0x18b,  0x3,    0x2,    0x2,    0x2,
+      0x18c, 0x18d,  0x3,    0x2,    0x2,    0x2,    0x18d,  0x198,  0x3,
+      0x2,   0x2,    0x2,    0x18e,  0x18f,  0xc,    0x4,    0x2,    0x2,
+      0x18f, 0x190,  0x7,    0xc,    0x2,    0x2,    0x190,  0x197,  0x7,
+      0x4e,  0x2,    0x2,    0x191,  0x192,  0xc,    0x3,    0x2,    0x2,
+      0x192, 0x193,  0x7,    0xd,    0x2,    0x2,    0x193,  0x194,  0x5,
+      0x1a,  0xe,    0x2,    0x194,  0x195,  0x7,    0xe,    0x2,    0x2,
+      0x195, 0x197,  0x3,    0x2,    0x2,    0x2,    0x196,  0x18e,  0x3,
+      0x2,   0x2,    0x2,    0x196,  0x191,  0x3,    0x2,    0x2,    0x2,
+      0x197, 0x19a,  0x3,    0x2,    0x2,    0x2,    0x198,  0x196,  0x3,
+      0x2,   0x2,    0x2,    0x198,  0x199,  0x3,    0x2,    0x2,    0x2,
+      0x199, 0x31,   0x3,    0x2,    0x2,    0x2,    0x19a,  0x198,  0x3,
+      0x2,   0x2,    0x2,    0x19b,  0x19c,  0x7,    0x4a,   0x2,    0x2,
+      0x19c, 0x1a6,  0x5,    0x30,   0x19,   0x2,    0x19d,  0x19e,  0x7,
+      0x4b,  0x2,    0x2,    0x19e,  0x1a6,  0x5,    0x30,   0x19,   0x2,
+      0x19f, 0x1a0,  0x5,    0x30,   0x19,   0x2,    0x1a0,  0x1a1,  0x7,
+      0x4a,  0x2,    0x2,    0x1a1,  0x1a6,  0x3,    0x2,    0x2,    0x2,
+      0x1a2, 0x1a3,  0x5,    0x30,   0x19,   0x2,    0x1a3,  0x1a4,  0x7,
+      0x4b,  0x2,    0x2,    0x1a4,  0x1a6,  0x3,    0x2,    0x2,    0x2,
+      0x1a5, 0x19b,  0x3,    0x2,    0x2,    0x2,    0x1a5,  0x19d,  0x3,
+      0x2,   0x2,    0x2,    0x1a5,  0x19f,  0x3,    0x2,    0x2,    0x2,
+      0x1a5, 0x1a2,  0x3,    0x2,    0x2,    0x2,    0x1a6,  0x33,   0x3,
+      0x2,   0x2,    0x2,    0x1a7,  0x1ae,  0x5,    0x32,   0x1a,   0x2,
+      0x1a8, 0x1ab,  0x5,    0x30,   0x19,   0x2,    0x1a9,  0x1aa,  0x9,
+      0x9,   0x2,    0x2,    0x1aa,  0x1ac,  0x5,    0x1a,   0xe,    0x2,
+      0x1ab, 0x1a9,  0x3,    0x2,    0x2,    0x2,    0x1ab,  0x1ac,  0x3,
+      0x2,   0x2,    0x2,    0x1ac,  0x1ae,  0x3,    0x2,    0x2,    0x2,
+      0x1ad, 0x1a7,  0x3,    0x2,    0x2,    0x2,    0x1ad,  0x1a8,  0x3,
+      0x2,   0x2,    0x2,    0x1ae,  0x35,   0x3,    0x2,    0x2,    0x2,
+      0x1af, 0x1b2,  0x5,    0x38,   0x1d,   0x2,    0x1b0,  0x1b2,  0x5,
+      0x34,  0x1b,   0x2,    0x1b1,  0x1af,  0x3,    0x2,    0x2,    0x2,
+      0x1b1, 0x1b0,  0x3,    0x2,    0x2,    0x2,    0x1b2,  0x37,   0x3,
+      0x2,   0x2,    0x2,    0x1b3,  0x1bb,  0x5,    0x48,   0x25,   0x2,
+      0x1b4, 0x1bb,  0x7,    0x52,   0x2,    0x2,    0x1b5,  0x1bb,  0x7,
+      0x4d,  0x2,    0x2,    0x1b6,  0x1b7,  0x7,    0x3,    0x2,    0x2,
+      0x1b7, 0x1b8,  0x5,    0x1a,   0xe,    0x2,    0x1b8,  0x1b9,  0x7,
+      0x4,   0x2,    0x2,    0x1b9,  0x1bb,  0x3,    0x2,    0x2,    0x2,
+      0x1ba, 0x1b3,  0x3,    0x2,    0x2,    0x2,    0x1ba,  0x1b4,  0x3,
+      0x2,   0x2,    0x2,    0x1ba,  0x1b5,  0x3,    0x2,    0x2,    0x2,
+      0x1ba, 0x1b6,  0x3,    0x2,    0x2,    0x2,    0x1bb,  0x39,   0x3,
+      0x2,   0x2,    0x2,    0x1bc,  0x1be,  0x5,    0x4e,   0x28,   0x2,
+      0x1bd, 0x1bc,  0x3,    0x2,    0x2,    0x2,    0x1bd,  0x1be,  0x3,
+      0x2,   0x2,    0x2,    0x1be,  0x3b,   0x3,    0x2,    0x2,    0x2,
+      0x1bf, 0x1c0,  0x7,    0x1f,   0x2,    0x2,    0x1c0,  0x1c1,  0x7,
+      0x3,   0x2,    0x2,    0x1c1,  0x1c2,  0x5,    0x3a,   0x1e,   0x2,
+      0x1c2, 0x1c3,  0x7,    0xf,    0x2,    0x2,    0x1c3,  0x1c4,  0x5,
+      0x1a,  0xe,    0x2,    0x1c4,  0x1c5,  0x7,    0xf,    0x2,    0x2,
+      0x1c5, 0x1c6,  0x5,    0x34,   0x1b,   0x2,    0x1c6,  0x1c7,  0x7,
+      0x4,   0x2,    0x2,    0x1c7,  0x1c8,  0x5,    0x6c,   0x37,   0x2,
+      0x1c8, 0x3d,   0x3,    0x2,    0x2,    0x2,    0x1c9,  0x1cb,  0x7,
+      0xd,   0x2,    0x2,    0x1ca,  0x1cc,  0x5,    0x1a,   0xe,    0x2,
+      0x1cb, 0x1ca,  0x3,    0x2,    0x2,    0x2,    0x1cb,  0x1cc,  0x3,
+      0x2,   0x2,    0x2,    0x1cc,  0x1cd,  0x3,    0x2,    0x2,    0x2,
+      0x1cd, 0x1cf,  0x7,    0x7,    0x2,    0x2,    0x1ce,  0x1d0,  0x5,
+      0x1a,  0xe,    0x2,    0x1cf,  0x1ce,  0x3,    0x2,    0x2,    0x2,
+      0x1cf, 0x1d0,  0x3,    0x2,    0x2,    0x2,    0x1d0,  0x1d1,  0x3,
+      0x2,   0x2,    0x2,    0x1d1,  0x1d2,  0x7,    0xe,    0x2,    0x2,
+      0x1d2, 0x3f,   0x3,    0x2,    0x2,    0x2,    0x1d3,  0x1d5,  0x5,
+      0x3e,  0x20,   0x2,    0x1d4,  0x1d3,  0x3,    0x2,    0x2,    0x2,
+      0x1d4, 0x1d5,  0x3,    0x2,    0x2,    0x2,    0x1d5,  0x41,   0x3,
+      0x2,   0x2,    0x2,    0x1d6,  0x1d7,  0x7,    0x1f,   0x2,    0x2,
+      0x1d7, 0x1d8,  0x7,    0x3,    0x2,    0x2,    0x1d8,  0x1d9,  0x5,
+      0x4c,  0x27,   0x2,    0x1d9,  0x1da,  0x7,    0x10,   0x2,    0x2,
+      0x1da, 0x1db,  0x5,    0x1a,   0xe,    0x2,    0x1db,  0x1dc,  0x5,
+      0x40,  0x21,   0x2,    0x1dc,  0x1dd,  0x7,    0x4,    0x2,    0x2,
+      0x1dd, 0x1de,  0x5,    0x6c,   0x37,   0x2,    0x1de,  0x43,   0x3,
+      0x2,   0x2,    0x2,    0x1df,  0x1e0,  0x5,    0x1a,   0xe,    0x2,
+      0x1e0, 0x45,   0x3,    0x2,    0x2,    0x2,    0x1e1,  0x1e3,  0x7,
+      0x3,   0x2,    0x2,    0x1e2,  0x1e4,  0x5,    0x44,   0x23,   0x2,
+      0x1e3, 0x1e2,  0x3,    0x2,    0x2,    0x2,    0x1e3,  0x1e4,  0x3,
+      0x2,   0x2,    0x2,    0x1e4,  0x1e9,  0x3,    0x2,    0x2,    0x2,
+      0x1e5, 0x1e6,  0x7,    0x6,    0x2,    0x2,    0x1e6,  0x1e8,  0x5,
+      0x44,  0x23,   0x2,    0x1e7,  0x1e5,  0x3,    0x2,    0x2,    0x2,
+      0x1e8, 0x1eb,  0x3,    0x2,    0x2,    0x2,    0x1e9,  0x1e7,  0x3,
+      0x2,   0x2,    0x2,    0x1e9,  0x1ea,  0x3,    0x2,    0x2,    0x2,
+      0x1ea, 0x1ec,  0x3,    0x2,    0x2,    0x2,    0x1eb,  0x1e9,  0x3,
+      0x2,   0x2,    0x2,    0x1ec,  0x1ed,  0x7,    0x4,    0x2,    0x2,
+      0x1ed, 0x47,   0x3,    0x2,    0x2,    0x2,    0x1ee,  0x1f0,  0x9,
+      0xa,   0x2,    0x2,    0x1ef,  0x1f1,  0x5,    0x6,    0x4,    0x2,
+      0x1f0, 0x1ef,  0x3,    0x2,    0x2,    0x2,    0x1f0,  0x1f1,  0x3,
+      0x2,   0x2,    0x2,    0x1f1,  0x1f2,  0x3,    0x2,    0x2,    0x2,
+      0x1f2, 0x1f3,  0x5,    0x46,   0x24,   0x2,    0x1f3,  0x1f4,  0x5,
+      0x12,  0xa,    0x2,    0x1f4,  0x49,   0x3,    0x2,    0x2,    0x2,
+      0x1f5, 0x1f6,  0x7,    0x4e,   0x2,    0x2,    0x1f6,  0x4b,   0x3,
+      0x2,   0x2,    0x2,    0x1f7,  0x1f8,  0x7,    0x2d,   0x2,    0x2,
+      0x1f8, 0x1f9,  0x7,    0x4e,   0x2,    0x2,    0x1f9,  0x1fa,  0x7,
+      0x7,   0x2,    0x2,    0x1fa,  0x1fb,  0x5,    0x2,    0x2,    0x2,
+      0x1fb, 0x4d,   0x3,    0x2,    0x2,    0x2,    0x1fc,  0x1ff,  0x5,
+      0x4c,  0x27,   0x2,    0x1fd,  0x1fe,  0x7,    0x33,   0x2,    0x2,
+      0x1fe, 0x200,  0x5,    0x1a,   0xe,    0x2,    0x1ff,  0x1fd,  0x3,
+      0x2,   0x2,    0x2,    0x1ff,  0x200,  0x3,    0x2,    0x2,    0x2,
+      0x200, 0x4f,   0x3,    0x2,    0x2,    0x2,    0x201,  0x203,  0x7,
+      0x2a,  0x2,    0x2,    0x202,  0x201,  0x3,    0x2,    0x2,    0x2,
+      0x202, 0x203,  0x3,    0x2,    0x2,    0x2,    0x203,  0x204,  0x3,
+      0x2,   0x2,    0x2,    0x204,  0x205,  0x5,    0x48,   0x25,   0x2,
+      0x205, 0x51,   0x3,    0x2,    0x2,    0x2,    0x206,  0x207,  0x5,
+      0x34,  0x1b,   0x2,    0x207,  0x53,   0x3,    0x2,    0x2,    0x2,
+      0x208, 0x20a,  0x7,    0x1e,   0x2,    0x2,    0x209,  0x20b,  0x7,
+      0x22,  0x2,    0x2,    0x20a,  0x209,  0x3,    0x2,    0x2,    0x2,
+      0x20a, 0x20b,  0x3,    0x2,    0x2,    0x2,    0x20b,  0x20c,  0x3,
+      0x2,   0x2,    0x2,    0x20c,  0x20d,  0x7,    0x3,    0x2,    0x2,
+      0x20d, 0x20e,  0x5,    0x1a,   0xe,    0x2,    0x20e,  0x20f,  0x7,
+      0x4,   0x2,    0x2,    0x20f,  0x212,  0x5,    0x6c,   0x37,   0x2,
+      0x210, 0x211,  0x7,    0x11,   0x2,    0x2,    0x211,  0x213,  0x5,
+      0x6c,  0x37,   0x2,    0x212,  0x210,  0x3,    0x2,    0x2,    0x2,
+      0x212, 0x213,  0x3,    0x2,    0x2,    0x2,    0x213,  0x55,   0x3,
+      0x2,   0x2,    0x2,    0x214,  0x215,  0x7,    0x20,   0x2,    0x2,
+      0x215, 0x216,  0x7,    0x3,    0x2,    0x2,    0x216,  0x217,  0x5,
+      0x1a,  0xe,    0x2,    0x217,  0x218,  0x7,    0x4,    0x2,    0x2,
+      0x218, 0x219,  0x5,    0x6c,   0x37,   0x2,    0x219,  0x57,   0x3,
+      0x2,   0x2,    0x2,    0x21a,  0x21c,  0x7,    0x21,   0x2,    0x2,
+      0x21b, 0x21d,  0x5,    0x1a,   0xe,    0x2,    0x21c,  0x21b,  0x3,
+      0x2,   0x2,    0x2,    0x21c,  0x21d,  0x3,    0x2,    0x2,    0x2,
+      0x21d, 0x59,   0x3,    0x2,    0x2,    0x2,    0x21e,  0x21f,  0x7,
+      0x24,  0x2,    0x2,    0x21f,  0x5b,   0x3,    0x2,    0x2,    0x2,
+      0x220, 0x221,  0x7,    0x23,   0x2,    0x2,    0x221,  0x5d,   0x3,
+      0x2,   0x2,    0x2,    0x222,  0x223,  0x7,    0x25,   0x2,    0x2,
+      0x223, 0x225,  0x5,    0x4a,   0x26,   0x2,    0x224,  0x226,  0x5,
+      0x46,  0x24,   0x2,    0x225,  0x224,  0x3,    0x2,    0x2,    0x2,
+      0x225, 0x226,  0x3,    0x2,    0x2,    0x2,    0x226,  0x5f,   0x3,
+      0x2,   0x2,    0x2,    0x227,  0x228,  0x7,    0x28,   0x2,    0x2,
+      0x228, 0x229,  0x5,    0x18,   0xd,    0x2,    0x229,  0x22a,  0x5,
+      0x6c,  0x37,   0x2,    0x22a,  0x61,   0x3,    0x2,    0x2,    0x2,
+      0x22b, 0x22c,  0x7,    0x27,   0x2,    0x2,    0x22c,  0x22e,  0x5,
+      0x6c,  0x37,   0x2,    0x22d,  0x22f,  0x5,    0x60,   0x31,   0x2,
+      0x22e, 0x22d,  0x3,    0x2,    0x2,    0x2,    0x22f,  0x230,  0x3,
+      0x2,   0x2,    0x2,    0x230,  0x22e,  0x3,    0x2,    0x2,    0x2,
+      0x230, 0x231,  0x3,    0x2,    0x2,    0x2,    0x231,  0x63,   0x3,
+      0x2,   0x2,    0x2,    0x232,  0x233,  0x9,    0xb,    0x2,    0x2,
+      0x233, 0x234,  0x7,    0x3,    0x2,    0x2,    0x234,  0x235,  0x5,
+      0x1a,  0xe,    0x2,    0x235,  0x236,  0x7,    0x4,    0x2,    0x2,
+      0x236, 0x23a,  0x3,    0x2,    0x2,    0x2,    0x237,  0x23a,  0x7,
+      0x31,  0x2,    0x2,    0x238,  0x23a,  0x7,    0x32,   0x2,    0x2,
+      0x239, 0x232,  0x3,    0x2,    0x2,    0x2,    0x239,  0x237,  0x3,
+      0x2,   0x2,    0x2,    0x239,  0x238,  0x3,    0x2,    0x2,    0x2,
+      0x23a, 0x65,   0x3,    0x2,    0x2,    0x2,    0x23b,  0x23c,  0x5,
+      0x4e,  0x28,   0x2,    0x23c,  0x23d,  0x7,    0xf,    0x2,    0x2,
+      0x23d, 0x259,  0x3,    0x2,    0x2,    0x2,    0x23e,  0x23f,  0x5,
+      0x50,  0x29,   0x2,    0x23f,  0x240,  0x7,    0xf,    0x2,    0x2,
+      0x240, 0x259,  0x3,    0x2,    0x2,    0x2,    0x241,  0x242,  0x5,
+      0x52,  0x2a,   0x2,    0x242,  0x243,  0x7,    0xf,    0x2,    0x2,
+      0x243, 0x259,  0x3,    0x2,    0x2,    0x2,    0x244,  0x245,  0x5,
+      0x58,  0x2d,   0x2,    0x245,  0x246,  0x7,    0xf,    0x2,    0x2,
+      0x246, 0x259,  0x3,    0x2,    0x2,    0x2,    0x247,  0x248,  0x5,
+      0x5a,  0x2e,   0x2,    0x248,  0x249,  0x7,    0xf,    0x2,    0x2,
+      0x249, 0x259,  0x3,    0x2,    0x2,    0x2,    0x24a,  0x24b,  0x5,
+      0x5c,  0x2f,   0x2,    0x24b,  0x24c,  0x7,    0xf,    0x2,    0x2,
+      0x24c, 0x259,  0x3,    0x2,    0x2,    0x2,    0x24d,  0x24e,  0x5,
+      0x5e,  0x30,   0x2,    0x24e,  0x24f,  0x7,    0xf,    0x2,    0x2,
+      0x24f, 0x259,  0x3,    0x2,    0x2,    0x2,    0x250,  0x259,  0x5,
+      0x54,  0x2b,   0x2,    0x251,  0x252,  0x5,    0x64,   0x33,   0x2,
+      0x252, 0x253,  0x7,    0xf,    0x2,    0x2,    0x253,  0x259,  0x3,
+      0x2,   0x2,    0x2,    0x254,  0x259,  0x5,    0x56,   0x2c,   0x2,
+      0x255, 0x259,  0x5,    0x42,   0x22,   0x2,    0x256,  0x259,  0x5,
+      0x3c,  0x1f,   0x2,    0x257,  0x259,  0x5,    0x62,   0x32,   0x2,
+      0x258, 0x23b,  0x3,    0x2,    0x2,    0x2,    0x258,  0x23e,  0x3,
+      0x2,   0x2,    0x2,    0x258,  0x241,  0x3,    0x2,    0x2,    0x2,
+      0x258, 0x244,  0x3,    0x2,    0x2,    0x2,    0x258,  0x247,  0x3,
+      0x2,   0x2,    0x2,    0x258,  0x24a,  0x3,    0x2,    0x2,    0x2,
+      0x258, 0x24d,  0x3,    0x2,    0x2,    0x2,    0x258,  0x250,  0x3,
+      0x2,   0x2,    0x2,    0x258,  0x251,  0x3,    0x2,    0x2,    0x2,
+      0x258, 0x254,  0x3,    0x2,    0x2,    0x2,    0x258,  0x255,  0x3,
+      0x2,   0x2,    0x2,    0x258,  0x256,  0x3,    0x2,    0x2,    0x2,
+      0x258, 0x257,  0x3,    0x2,    0x2,    0x2,    0x259,  0x67,   0x3,
+      0x2,   0x2,    0x2,    0x25a,  0x25c,  0x5,    0x66,   0x34,   0x2,
+      0x25b, 0x25a,  0x3,    0x2,    0x2,    0x2,    0x25c,  0x25f,  0x3,
+      0x2,   0x2,    0x2,    0x25d,  0x25b,  0x3,    0x2,    0x2,    0x2,
+      0x25d, 0x25e,  0x3,    0x2,    0x2,    0x2,    0x25e,  0x69,   0x3,
+      0x2,   0x2,    0x2,    0x25f,  0x25d,  0x3,    0x2,    0x2,    0x2,
+      0x260, 0x262,  0x7,    0x1d,   0x2,    0x2,    0x261,  0x260,  0x3,
+      0x2,   0x2,    0x2,    0x261,  0x262,  0x3,    0x2,    0x2,    0x2,
+      0x262, 0x263,  0x3,    0x2,    0x2,    0x2,    0x263,  0x264,  0x7,
+      0x12,  0x2,    0x2,    0x264,  0x265,  0x5,    0x68,   0x35,   0x2,
+      0x265, 0x266,  0x7,    0x13,   0x2,    0x2,    0x266,  0x6b,   0x3,
+      0x2,   0x2,    0x2,    0x267,  0x26a,  0x5,    0x66,   0x34,   0x2,
+      0x268, 0x26a,  0x5,    0x6a,   0x36,   0x2,    0x269,  0x267,  0x3,
+      0x2,   0x2,    0x2,    0x269,  0x268,  0x3,    0x2,    0x2,    0x2,
+      0x26a, 0x6d,   0x3,    0x2,    0x2,    0x2,    0x26b,  0x26c,  0x5,
+      0x6a,  0x36,   0x2,    0x26c,  0x6f,   0x3,    0x2,    0x2,    0x2,
+      0x26d, 0x26e,  0x7,    0x14,   0x2,    0x2,    0x26e,  0x26f,  0x7,
+      0x4e,  0x2,    0x2,    0x26f,  0x71,   0x3,    0x2,    0x2,    0x2,
+      0x270, 0x271,  0x7,    0x15,   0x2,    0x2,    0x271,  0x272,  0x7,
+      0x4d,  0x2,    0x2,    0x272,  0x73,   0x3,    0x2,    0x2,    0x2,
+      0x273, 0x274,  0x7,    0x22,   0x2,    0x2,    0x274,  0x275,  0x7,
+      0x4d,  0x2,    0x2,    0x275,  0x75,   0x3,    0x2,    0x2,    0x2,
+      0x276, 0x277,  0x7,    0x8,    0x2,    0x2,    0x277,  0x279,  0x7,
+      0x4e,  0x2,    0x2,    0x278,  0x27a,  0x5,    0x70,   0x39,   0x2,
+      0x279, 0x278,  0x3,    0x2,    0x2,    0x2,    0x279,  0x27a,  0x3,
+      0x2,   0x2,    0x2,    0x27a,  0x27c,  0x3,    0x2,    0x2,    0x2,
+      0x27b, 0x27d,  0x5,    0x72,   0x3a,   0x2,    0x27c,  0x27b,  0x3,
+      0x2,   0x2,    0x2,    0x27c,  0x27d,  0x3,    0x2,    0x2,    0x2,
+      0x27d, 0x27f,  0x3,    0x2,    0x2,    0x2,    0x27e,  0x280,  0x5,
+      0x74,  0x3b,   0x2,    0x27f,  0x27e,  0x3,    0x2,    0x2,    0x2,
+      0x27f, 0x280,  0x3,    0x2,    0x2,    0x2,    0x280,  0x281,  0x3,
+      0x2,   0x2,    0x2,    0x281,  0x282,  0x7,    0xf,    0x2,    0x2,
+      0x282, 0x77,   0x3,    0x2,    0x2,    0x2,    0x283,  0x284,  0x7,
+      0x8,   0x2,    0x2,    0x284,  0x285,  0x7,    0x4e,   0x2,    0x2,
+      0x285, 0x286,  0x7,    0x33,   0x2,    0x2,    0x286,  0x287,  0x5,
+      0x2,   0x2,    0x2,    0x287,  0x288,  0x7,    0xf,    0x2,    0x2,
+      0x288, 0x79,   0x3,    0x2,    0x2,    0x2,    0x289,  0x28b,  0x7,
+      0x2e,  0x2,    0x2,    0x28a,  0x28c,  0x7,    0x1c,   0x2,    0x2,
+      0x28b, 0x28a,  0x3,    0x2,    0x2,    0x2,    0x28b,  0x28c,  0x3,
+      0x2,   0x2,    0x2,    0x28c,  0x28d,  0x3,    0x2,    0x2,    0x2,
+      0x28d, 0x28e,  0x7,    0x19,   0x2,    0x2,    0x28e,  0x28f,  0x7,
+      0x4e,  0x2,    0x2,    0x28f,  0x290,  0x5,    0x8,    0x5,    0x2,
+      0x290, 0x291,  0x7,    0x3,    0x2,    0x2,    0x291,  0x292,  0x5,
+      0x4,   0x3,    0x2,    0x292,  0x293,  0x7,    0x4,    0x2,    0x2,
+      0x293, 0x294,  0x5,    0xe,    0x8,    0x2,    0x294,  0x295,  0x7,
+      0xf,   0x2,    0x2,    0x295,  0x7b,   0x3,    0x2,    0x2,    0x2,
+      0x296, 0x299,  0x7,    0x2e,   0x2,    0x2,    0x297,  0x298,  0x7,
+      0x16,  0x2,    0x2,    0x298,  0x29a,  0x7,    0x4d,   0x2,    0x2,
+      0x299, 0x297,  0x3,    0x2,    0x2,    0x2,    0x299,  0x29a,  0x3,
+      0x2,   0x2,    0x2,    0x29a,  0x29b,  0x3,    0x2,    0x2,    0x2,
+      0x29b, 0x29c,  0x7,    0x18,   0x2,    0x2,    0x29c,  0x29d,  0x7,
+      0x4e,  0x2,    0x2,    0x29d,  0x29e,  0x5,    0x8,    0x5,    0x2,
+      0x29e, 0x29f,  0x5,    0xa,    0x6,    0x2,    0x29f,  0x2a0,  0x5,
+      0xe,   0x8,    0x2,    0x2a0,  0x2a1,  0x5,    0x10,   0x9,    0x2,
+      0x2a1, 0x2a2,  0x7,    0xf,    0x2,    0x2,    0x2a2,  0x7d,   0x3,
+      0x2,   0x2,    0x2,    0x2a3,  0x2a4,  0x7,    0x2e,   0x2,    0x2,
+      0x2a4, 0x2a5,  0x7,    0x1a,   0x2,    0x2,    0x2a5,  0x2a6,  0x7,
+      0x4e,  0x2,    0x2,    0x2a6,  0x2a7,  0x5,    0xa,    0x6,    0x2,
+      0x2a7, 0x2a8,  0x5,    0xe,    0x8,    0x2,    0x2a8,  0x2a9,  0x7,
+      0xf,   0x2,    0x2,    0x2a9,  0x7f,   0x3,    0x2,    0x2,    0x2,
+      0x2aa, 0x2ac,  0x7,    0x1c,   0x2,    0x2,    0x2ab,  0x2aa,  0x3,
+      0x2,   0x2,    0x2,    0x2ab,  0x2ac,  0x3,    0x2,    0x2,    0x2,
+      0x2ac, 0x2ad,  0x3,    0x2,    0x2,    0x2,    0x2ad,  0x2ae,  0x7,
+      0x19,  0x2,    0x2,    0x2ae,  0x2af,  0x7,    0x4e,   0x2,    0x2,
+      0x2af, 0x2b0,  0x5,    0x8,    0x5,    0x2,    0x2b0,  0x2b1,  0x5,
+      0x16,  0xc,    0x2,    0x2b1,  0x2b4,  0x5,    0xe,    0x8,    0x2,
+      0x2b2, 0x2b5,  0x5,    0x6e,   0x38,   0x2,    0x2b3,  0x2b5,  0x7,
+      0xf,   0x2,    0x2,    0x2b4,  0x2b2,  0x3,    0x2,    0x2,    0x2,
+      0x2b4, 0x2b3,  0x3,    0x2,    0x2,    0x2,    0x2b5,  0x81,   0x3,
+      0x2,   0x2,    0x2,    0x2b6,  0x2b7,  0x7,    0x4e,   0x2,    0x2,
+      0x2b7, 0x2b8,  0x5,    0x6,    0x4,    0x2,    0x2b8,  0x2b9,  0x5,
+      0x16,  0xc,    0x2,    0x2b9,  0x2ba,  0x5,    0xe,    0x8,    0x2,
+      0x2ba, 0x2bb,  0x5,    0x10,   0x9,    0x2,    0x2bb,  0x2bc,  0x5,
+      0x6e,  0x38,   0x2,    0x2bc,  0x83,   0x3,    0x2,    0x2,    0x2,
+      0x2bd, 0x2be,  0x7,    0x16,   0x2,    0x2,    0x2be,  0x2c0,  0x7,
+      0x4d,  0x2,    0x2,    0x2bf,  0x2bd,  0x3,    0x2,    0x2,    0x2,
+      0x2bf, 0x2c0,  0x3,    0x2,    0x2,    0x2,    0x2c0,  0x2c1,  0x3,
+      0x2,   0x2,    0x2,    0x2c1,  0x2c2,  0x7,    0x18,   0x2,    0x2,
+      0x2c2, 0x2c3,  0x7,    0x4e,   0x2,    0x2,    0x2c3,  0x2c4,  0x5,
+      0x8,   0x5,    0x2,    0x2c4,  0x2c5,  0x5,    0x16,   0xc,    0x2,
+      0x2c5, 0x2c6,  0x5,    0xe,    0x8,    0x2,    0x2c6,  0x2c9,  0x5,
+      0x10,  0x9,    0x2,    0x2c7,  0x2ca,  0x5,    0x6e,   0x38,   0x2,
+      0x2c8, 0x2ca,  0x7,    0xf,    0x2,    0x2,    0x2c9,  0x2c7,  0x3,
+      0x2,   0x2,    0x2,    0x2c9,  0x2c8,  0x3,    0x2,    0x2,    0x2,
+      0x2ca, 0x85,   0x3,    0x2,    0x2,    0x2,    0x2cb,  0x2cc,  0x7,
+      0x17,  0x2,    0x2,    0x2cc,  0x2cd,  0x7,    0x4e,   0x2,    0x2,
+      0x2cd, 0x2ce,  0x7,    0x7,    0x2,    0x2,    0x2ce,  0x2cf,  0x5,
+      0x2,   0x2,    0x2,    0x2cf,  0x2d0,  0x5,    0x72,   0x3a,   0x2,
+      0x2d0, 0x2d1,  0x7,    0xf,    0x2,    0x2,    0x2d1,  0x87,   0x3,
+      0x2,   0x2,    0x2,    0x2d2,  0x2dc,  0x5,    0x76,   0x3c,   0x2,
+      0x2d3, 0x2dc,  0x5,    0x78,   0x3d,   0x2,    0x2d4,  0x2dc,  0x5,
+      0x80,  0x41,   0x2,    0x2d5,  0x2dc,  0x5,    0x82,   0x42,   0x2,
+      0x2d6, 0x2dc,  0x5,    0x84,   0x43,   0x2,    0x2d7,  0x2dc,  0x5,
+      0x7c,  0x3f,   0x2,    0x2d8,  0x2dc,  0x5,    0x7a,   0x3e,   0x2,
+      0x2d9, 0x2dc,  0x5,    0x7e,   0x40,   0x2,    0x2da,  0x2dc,  0x5,
+      0x86,  0x44,   0x2,    0x2db,  0x2d2,  0x3,    0x2,    0x2,    0x2,
+      0x2db, 0x2d3,  0x3,    0x2,    0x2,    0x2,    0x2db,  0x2d4,  0x3,
+      0x2,   0x2,    0x2,    0x2db,  0x2d5,  0x3,    0x2,    0x2,    0x2,
+      0x2db, 0x2d6,  0x3,    0x2,    0x2,    0x2,    0x2db,  0x2d7,  0x3,
+      0x2,   0x2,    0x2,    0x2db,  0x2d8,  0x3,    0x2,    0x2,    0x2,
+      0x2db, 0x2d9,  0x3,    0x2,    0x2,    0x2,    0x2db,  0x2da,  0x3,
+      0x2,   0x2,    0x2,    0x2dc,  0x89,   0x3,    0x2,    0x2,    0x2,
+      0x2dd, 0x2de,  0x7,    0x1b,   0x2,    0x2,    0x2de,  0x2df,  0x7,
+      0x4e,  0x2,    0x2,    0x2df,  0x2e3,  0x7,    0x12,   0x2,    0x2,
+      0x2e0, 0x2e2,  0x5,    0x88,   0x45,   0x2,    0x2e1,  0x2e0,  0x3,
+      0x2,   0x2,    0x2,    0x2e2,  0x2e5,  0x3,    0x2,    0x2,    0x2,
+      0x2e3, 0x2e1,  0x3,    0x2,    0x2,    0x2,    0x2e3,  0x2e4,  0x3,
+      0x2,   0x2,    0x2,    0x2e4,  0x2e6,  0x3,    0x2,    0x2,    0x2,
+      0x2e5, 0x2e3,  0x3,    0x2,    0x2,    0x2,    0x2e6,  0x2e7,  0x7,
+      0x13,  0x2,    0x2,    0x2e7,  0x8b,   0x3,    0x2,    0x2,    0x2,
+      0x2e8, 0x2eb,  0x5,    0x8a,   0x46,   0x2,    0x2e9,  0x2eb,  0x5,
+      0x88,  0x45,   0x2,    0x2ea,  0x2e8,  0x3,    0x2,    0x2,    0x2,
+      0x2ea, 0x2e9,  0x3,    0x2,    0x2,    0x2,    0x2eb,  0x2ee,  0x3,
+      0x2,   0x2,    0x2,    0x2ec,  0x2ea,  0x3,    0x2,    0x2,    0x2,
+      0x2ec, 0x2ed,  0x3,    0x2,    0x2,    0x2,    0x2ed,  0x8d,   0x3,
+      0x2,   0x2,    0x2,    0x2ee,  0x2ec,  0x3,    0x2,    0x2,    0x2,
+      0x4a,  0x90,   0x9e,   0xa5,   0xad,   0xb0,   0xc0,   0xc4,   0xc8,
+      0xce,  0xd3,   0xd9,   0xe0,   0xe4,   0xec,   0xef,   0xf7,   0xfa,
+      0xff,  0x103,  0x109,  0x116,  0x11a,  0x129,  0x134,  0x13f,  0x14a,
+      0x155, 0x160,  0x16b,  0x176,  0x181,  0x187,  0x18c,  0x196,  0x198,
+      0x1a5, 0x1ab,  0x1ad,  0x1b1,  0x1ba,  0x1bd,  0x1cb,  0x1cf,  0x1d4,
+      0x1e3, 0x1e9,  0x1f0,  0x1ff,  0x202,  0x20a,  0x212,  0x21c,  0x225,
+      0x230, 0x239,  0x258,  0x25d,  0x261,  0x269,  0x279,  0x27c,  0x27f,
+      0x28b, 0x299,  0x2ab,  0x2b4,  0x2bf,  0x2c9,  0x2db,  0x2e3,  0x2ea,
+      0x2ec,
+  };
+
+  atn::ATNDeserializer deserializer;
+  _atn = deserializer.deserialize(_serializedATN);
+
+  size_t count = _atn.getNumberOfDecisions();
+  _decisionToDFA.reserve(count);
+  for (size_t i = 0; i < count; i++) {
+    _decisionToDFA.emplace_back(_atn.getDecisionState(i), i);
+  }
+}
+
+TorqueParser::Initializer TorqueParser::_init;
diff --git a/deps/v8/src/torque/TorqueParser.h b/deps/v8/src/torque/TorqueParser.h
new file mode 100644
index 00000000000000..27a0c408b5ddf3
--- /dev/null
+++ b/deps/v8/src/torque/TorqueParser.h
@@ -0,0 +1,1516 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+#ifndef V8_TORQUE_TORQUEPARSER_H_
+#define V8_TORQUE_TORQUEPARSER_H_
+
+// Generated from Torque.g4 by ANTLR 4.7.1
+
+#pragma once
+
+#include "./antlr4-runtime.h"
+
+class TorqueParser : public antlr4::Parser {
+ public:
+  enum {
+    T__0 = 1,
+    T__1 = 2,
+    T__2 = 3,
+    T__3 = 4,
+    T__4 = 5,
+    T__5 = 6,
+    T__6 = 7,
+    T__7 = 8,
+    T__8 = 9,
+    T__9 = 10,
+    T__10 = 11,
+    T__11 = 12,
+    T__12 = 13,
+    T__13 = 14,
+    T__14 = 15,
+    T__15 = 16,
+    T__16 = 17,
+    T__17 = 18,
+    T__18 = 19,
+    T__19 = 20,
+    T__20 = 21,
+    MACRO = 22,
+    BUILTIN = 23,
+    RUNTIME = 24,
+    MODULE = 25,
+    JAVASCRIPT = 26,
+    DEFERRED = 27,
+    IF = 28,
+    FOR = 29,
+    WHILE = 30,
+    RETURN = 31,
+    CONSTEXPR = 32,
+    CONTINUE = 33,
+    BREAK = 34,
+    GOTO = 35,
+    OTHERWISE = 36,
+    TRY = 37,
+    LABEL = 38,
+    LABELS = 39,
+    TAIL = 40,
+    ISNT = 41,
+    IS = 42,
+    LET = 43,
+    EXTERN = 44,
+    ASSERT_TOKEN = 45,
+    CHECK_TOKEN = 46,
+    UNREACHABLE_TOKEN = 47,
+    DEBUG_TOKEN = 48,
+    ASSIGNMENT = 49,
+    ASSIGNMENT_OPERATOR = 50,
+    EQUAL = 51,
+    PLUS = 52,
+    MINUS = 53,
+    MULTIPLY = 54,
+    DIVIDE = 55,
+    MODULO = 56,
+    BIT_OR = 57,
+    BIT_AND = 58,
+    BIT_NOT = 59,
+    MAX = 60,
+    MIN = 61,
+    NOT_EQUAL = 62,
+    LESS_THAN = 63,
+    LESS_THAN_EQUAL = 64,
+    GREATER_THAN = 65,
+    GREATER_THAN_EQUAL = 66,
+    SHIFT_LEFT = 67,
+    SHIFT_RIGHT = 68,
+    SHIFT_RIGHT_ARITHMETIC = 69,
+    VARARGS = 70,
+    EQUALITY_OPERATOR = 71,
+    INCREMENT = 72,
+    DECREMENT = 73,
+    NOT = 74,
+    STRING_LITERAL = 75,
+    IDENTIFIER = 76,
+    WS = 77,
+    BLOCK_COMMENT = 78,
+    LINE_COMMENT = 79,
+    DECIMAL_LITERAL = 80
+  };
+
+  enum {
+    RuleType = 0,
+    RuleTypeList = 1,
+    RuleGenericSpecializationTypeList = 2,
+    RuleOptionalGenericTypeList = 3,
+    RuleTypeListMaybeVarArgs = 4,
+    RuleLabelParameter = 5,
+    RuleOptionalType = 6,
+    RuleOptionalLabelList = 7,
+    RuleOptionalOtherwise = 8,
+    RuleParameter = 9,
+    RuleParameterList = 10,
+    RuleLabelDeclaration = 11,
+    RuleExpression = 12,
+    RuleConditionalExpression = 13,
+    RuleLogicalORExpression = 14,
+    RuleLogicalANDExpression = 15,
+    RuleBitwiseExpression = 16,
+    RuleEqualityExpression = 17,
+    RuleRelationalExpression = 18,
+    RuleShiftExpression = 19,
+    RuleAdditiveExpression = 20,
+    RuleMultiplicativeExpression = 21,
+    RuleUnaryExpression = 22,
+    RuleLocationExpression = 23,
+    RuleIncrementDecrement = 24,
+    RuleAssignment = 25,
+    RuleAssignmentExpression = 26,
+    RulePrimaryExpression = 27,
+    RuleForInitialization = 28,
+    RuleForLoop = 29,
+    RuleRangeSpecifier = 30,
+    RuleForOfRange = 31,
+    RuleForOfLoop = 32,
+    RuleArgument = 33,
+    RuleArgumentList = 34,
+    RuleHelperCall = 35,
+    RuleLabelReference = 36,
+    RuleVariableDeclaration = 37,
+    RuleVariableDeclarationWithInitialization = 38,
+    RuleHelperCallStatement = 39,
+    RuleExpressionStatement = 40,
+    RuleIfStatement = 41,
+    RuleWhileLoop = 42,
+    RuleReturnStatement = 43,
+    RuleBreakStatement = 44,
+    RuleContinueStatement = 45,
+    RuleGotoStatement = 46,
+    RuleHandlerWithStatement = 47,
+    RuleTryLabelStatement = 48,
+    RuleDiagnosticStatement = 49,
+    RuleStatement = 50,
+    RuleStatementList = 51,
+    RuleStatementScope = 52,
+    RuleStatementBlock = 53,
+    RuleHelperBody = 54,
+    RuleExtendsDeclaration = 55,
+    RuleGeneratesDeclaration = 56,
+    RuleConstexprDeclaration = 57,
+    RuleTypeDeclaration = 58,
+    RuleTypeAliasDeclaration = 59,
+    RuleExternalBuiltin = 60,
+    RuleExternalMacro = 61,
+    RuleExternalRuntime = 62,
+    RuleBuiltinDeclaration = 63,
+    RuleGenericSpecialization = 64,
+    RuleMacroDeclaration = 65,
+    RuleExternConstDeclaration = 66,
+    RuleDeclaration = 67,
+    RuleModuleDeclaration = 68,
+    RuleFile = 69
+  };
+
+  explicit TorqueParser(antlr4::TokenStream* input);
+  ~TorqueParser();
+
+  std::string getGrammarFileName() const override;
+  const antlr4::atn::ATN& getATN() const override { return _atn; };
+  const std::vector<std::string>& getTokenNames() const override {
+    return _tokenNames;
+  };  // deprecated: use vocabulary instead.
+  const std::vector<std::string>& getRuleNames() const override;
+  antlr4::dfa::Vocabulary& getVocabulary() const override;
+
+  class TypeContext;
+  class TypeListContext;
+  class GenericSpecializationTypeListContext;
+  class OptionalGenericTypeListContext;
+  class TypeListMaybeVarArgsContext;
+  class LabelParameterContext;
+  class OptionalTypeContext;
+  class OptionalLabelListContext;
+  class OptionalOtherwiseContext;
+  class ParameterContext;
+  class ParameterListContext;
+  class LabelDeclarationContext;
+  class ExpressionContext;
+  class ConditionalExpressionContext;
+  class LogicalORExpressionContext;
+  class LogicalANDExpressionContext;
+  class BitwiseExpressionContext;
+  class EqualityExpressionContext;
+  class RelationalExpressionContext;
+  class ShiftExpressionContext;
+  class AdditiveExpressionContext;
+  class MultiplicativeExpressionContext;
+  class UnaryExpressionContext;
+  class LocationExpressionContext;
+  class IncrementDecrementContext;
+  class AssignmentContext;
+  class AssignmentExpressionContext;
+  class PrimaryExpressionContext;
+  class ForInitializationContext;
+  class ForLoopContext;
+  class RangeSpecifierContext;
+  class ForOfRangeContext;
+  class ForOfLoopContext;
+  class ArgumentContext;
+  class ArgumentListContext;
+  class HelperCallContext;
+  class LabelReferenceContext;
+  class VariableDeclarationContext;
+  class VariableDeclarationWithInitializationContext;
+  class HelperCallStatementContext;
+  class ExpressionStatementContext;
+  class IfStatementContext;
+  class WhileLoopContext;
+  class ReturnStatementContext;
+  class BreakStatementContext;
+  class ContinueStatementContext;
+  class GotoStatementContext;
+  class HandlerWithStatementContext;
+  class TryLabelStatementContext;
+  class DiagnosticStatementContext;
+  class StatementContext;
+  class StatementListContext;
+  class StatementScopeContext;
+  class StatementBlockContext;
+  class HelperBodyContext;
+  class ExtendsDeclarationContext;
+  class GeneratesDeclarationContext;
+  class ConstexprDeclarationContext;
+  class TypeDeclarationContext;
+  class TypeAliasDeclarationContext;
+  class ExternalBuiltinContext;
+  class ExternalMacroContext;
+  class ExternalRuntimeContext;
+  class BuiltinDeclarationContext;
+  class GenericSpecializationContext;
+  class MacroDeclarationContext;
+  class ExternConstDeclarationContext;
+  class DeclarationContext;
+  class ModuleDeclarationContext;
+  class FileContext;
+
+  class TypeContext : public antlr4::ParserRuleContext {
+   public:
+    TypeContext(antlr4::ParserRuleContext* parent, size_t invokingState);
+    size_t getRuleIndex() const override;
+    antlr4::tree::TerminalNode* IDENTIFIER();
+    antlr4::tree::TerminalNode* CONSTEXPR();
+    antlr4::tree::TerminalNode* BUILTIN();
+    TypeListContext* typeList();
+    std::vector<TypeContext*> type();
+    TypeContext* type(size_t i);
+    antlr4::tree::TerminalNode* BIT_OR();
+
+    void enterRule(antlr4::tree::ParseTreeListener* listener) override;
+    void exitRule(antlr4::tree::ParseTreeListener* listener) override;
+
+    antlrcpp::Any accept(antlr4::tree::ParseTreeVisitor* visitor) override;
+  };
+
+  TypeContext* type();
+  TypeContext* type(int precedence);
+  class TypeListContext : public antlr4::ParserRuleContext {
+   public:
+    TypeListContext(antlr4::ParserRuleContext* parent, size_t invokingState);
+    size_t getRuleIndex() const override;
+    std::vector<TypeContext*> type();
+    TypeContext* type(size_t i);
+
+    void enterRule(antlr4::tree::ParseTreeListener* listener) override;
+    void exitRule(antlr4::tree::ParseTreeListener* listener) override;
+
+    antlrcpp::Any accept(antlr4::tree::ParseTreeVisitor* visitor) override;
+  };
+
+  TypeListContext* typeList();
+
+  class GenericSpecializationTypeListContext
+      : public antlr4::ParserRuleContext {
+   public:
+    GenericSpecializationTypeListContext(antlr4::ParserRuleContext* parent,
+                                         size_t invokingState);
+    size_t getRuleIndex() const override;
+    TypeListContext* typeList();
+
+    void enterRule(antlr4::tree::ParseTreeListener* listener) override;
+    void exitRule(antlr4::tree::ParseTreeListener* listener) override;
+
+    antlrcpp::Any accept(antlr4::tree::ParseTreeVisitor* visitor) override;
+  };
+
+  GenericSpecializationTypeListContext* genericSpecializationTypeList();
+
+  class OptionalGenericTypeListContext : public antlr4::ParserRuleContext {
+   public:
+    OptionalGenericTypeListContext(antlr4::ParserRuleContext* parent,
+                                   size_t invokingState);
+    size_t getRuleIndex() const override;
+    std::vector<antlr4::tree::TerminalNode*> IDENTIFIER();
+    antlr4::tree::TerminalNode* IDENTIFIER(size_t i);
+
+    void enterRule(antlr4::tree::ParseTreeListener* listener) override;
+    void exitRule(antlr4::tree::ParseTreeListener* listener) override;
+
+    antlrcpp::Any accept(antlr4::tree::ParseTreeVisitor* visitor) override;
+  };
+
+  OptionalGenericTypeListContext* optionalGenericTypeList();
+
+  class TypeListMaybeVarArgsContext : public antlr4::ParserRuleContext {
+   public:
+    TypeListMaybeVarArgsContext(antlr4::ParserRuleContext* parent,
+                                size_t invokingState);
+    size_t getRuleIndex() const override;
+    std::vector<TypeContext*> type();
+    TypeContext* type(size_t i);
+    antlr4::tree::TerminalNode* VARARGS();
+
+    void enterRule(antlr4::tree::ParseTreeListener* listener) override;
+    void exitRule(antlr4::tree::ParseTreeListener* listener) override;
+
+    antlrcpp::Any accept(antlr4::tree::ParseTreeVisitor* visitor) override;
+  };
+
+  TypeListMaybeVarArgsContext* typeListMaybeVarArgs();
+
+  class LabelParameterContext : public antlr4::ParserRuleContext {
+   public:
+    LabelParameterContext(antlr4::ParserRuleContext* parent,
+                          size_t invokingState);
+    size_t getRuleIndex() const override;
+    antlr4::tree::TerminalNode* IDENTIFIER();
+    TypeListContext* typeList();
+
+    void enterRule(antlr4::tree::ParseTreeListener* listener) override;
+    void exitRule(antlr4::tree::ParseTreeListener* listener) override;
+
+    antlrcpp::Any accept(antlr4::tree::ParseTreeVisitor* visitor) override;
+  };
+
+  LabelParameterContext* labelParameter();
+
+  class OptionalTypeContext : public antlr4::ParserRuleContext {
+   public:
+    OptionalTypeContext(antlr4::ParserRuleContext* parent,
+                        size_t invokingState);
+    size_t getRuleIndex() const override;
+    TypeContext* type();
+
+    void enterRule(antlr4::tree::ParseTreeListener* listener) override;
+    void exitRule(antlr4::tree::ParseTreeListener* listener) override;
+
+    antlrcpp::Any accept(antlr4::tree::ParseTreeVisitor* visitor) override;
+  };
+
+  OptionalTypeContext* optionalType();
+
+  class OptionalLabelListContext : public antlr4::ParserRuleContext {
+   public:
+    OptionalLabelListContext(antlr4::ParserRuleContext* parent,
+                             size_t invokingState);
+    size_t getRuleIndex() const override;
+    antlr4::tree::TerminalNode* LABELS();
+    std::vector<LabelParameterContext*> labelParameter();
+    LabelParameterContext* labelParameter(size_t i);
+
+    void enterRule(antlr4::tree::ParseTreeListener* listener) override;
+    void exitRule(antlr4::tree::ParseTreeListener* listener) override;
+
+    antlrcpp::Any accept(antlr4::tree::ParseTreeVisitor* visitor) override;
+  };
+
+  OptionalLabelListContext* optionalLabelList();
+
+  class OptionalOtherwiseContext : public antlr4::ParserRuleContext {
+   public:
+    OptionalOtherwiseContext(antlr4::ParserRuleContext* parent,
+                             size_t invokingState);
+    size_t getRuleIndex() const override;
+    antlr4::tree::TerminalNode* OTHERWISE();
+    std::vector<antlr4::tree::TerminalNode*> IDENTIFIER();
+    antlr4::tree::TerminalNode* IDENTIFIER(size_t i);
+
+    void enterRule(antlr4::tree::ParseTreeListener* listener) override;
+    void exitRule(antlr4::tree::ParseTreeListener* listener) override;
+
+    antlrcpp::Any accept(antlr4::tree::ParseTreeVisitor* visitor) override;
+  };
+
+  OptionalOtherwiseContext* optionalOtherwise();
+
+  class ParameterContext : public antlr4::ParserRuleContext {
+   public:
+    ParameterContext(antlr4::ParserRuleContext* parent, size_t invokingState);
+    size_t getRuleIndex() const override;
+    antlr4::tree::TerminalNode* IDENTIFIER();
+    TypeContext* type();
+
+    void enterRule(antlr4::tree::ParseTreeListener* listener) override;
+    void exitRule(antlr4::tree::ParseTreeListener* listener) override;
+
+    antlrcpp::Any accept(antlr4::tree::ParseTreeVisitor* visitor) override;
+  };
+
+  ParameterContext* parameter();
+
+  class ParameterListContext : public antlr4::ParserRuleContext {
+   public:
+    ParameterListContext(antlr4::ParserRuleContext* parent,
+                         size_t invokingState);
+    size_t getRuleIndex() const override;
+    std::vector<ParameterContext*> parameter();
+    ParameterContext* parameter(size_t i);
+    antlr4::tree::TerminalNode* VARARGS();
+    antlr4::tree::TerminalNode* IDENTIFIER();
+
+    void enterRule(antlr4::tree::ParseTreeListener* listener) override;
+    void exitRule(antlr4::tree::ParseTreeListener* listener) override;
+
+    antlrcpp::Any accept(antlr4::tree::ParseTreeVisitor* visitor) override;
+  };
+
+  ParameterListContext* parameterList();
+
+  class LabelDeclarationContext : public antlr4::ParserRuleContext {
+   public:
+    LabelDeclarationContext(antlr4::ParserRuleContext* parent,
+                            size_t invokingState);
+    size_t getRuleIndex() const override;
+    antlr4::tree::TerminalNode* IDENTIFIER();
+    ParameterListContext* parameterList();
+
+    void enterRule(antlr4::tree::ParseTreeListener* listener) override;
+    void exitRule(antlr4::tree::ParseTreeListener* listener) override;
+
+    antlrcpp::Any accept(antlr4::tree::ParseTreeVisitor* visitor) override;
+  };
+
+  LabelDeclarationContext* labelDeclaration();
+
+  class ExpressionContext : public antlr4::ParserRuleContext {
+   public:
+    ExpressionContext(antlr4::ParserRuleContext* parent, size_t invokingState);
+    size_t getRuleIndex() const override;
+    ConditionalExpressionContext* conditionalExpression();
+
+    void enterRule(antlr4::tree::ParseTreeListener* listener) override;
+    void exitRule(antlr4::tree::ParseTreeListener* listener) override;
+
+    antlrcpp::Any accept(antlr4::tree::ParseTreeVisitor* visitor) override;
+  };
+
+  ExpressionContext* expression();
+
+  class ConditionalExpressionContext : public antlr4::ParserRuleContext {
+   public:
+    ConditionalExpressionContext(antlr4::ParserRuleContext* parent,
+                                 size_t invokingState);
+    size_t getRuleIndex() const override;
+    std::vector<LogicalORExpressionContext*> logicalORExpression();
+    LogicalORExpressionContext* logicalORExpression(size_t i);
+    ConditionalExpressionContext* conditionalExpression();
+
+    void enterRule(antlr4::tree::ParseTreeListener* listener) override;
+    void exitRule(antlr4::tree::ParseTreeListener* listener) override;
+
+    antlrcpp::Any accept(antlr4::tree::ParseTreeVisitor* visitor) override;
+  };
+
+  ConditionalExpressionContext* conditionalExpression();
+  ConditionalExpressionContext* conditionalExpression(int precedence);
+  class LogicalORExpressionContext : public antlr4::ParserRuleContext {
+   public:
+    LogicalORExpressionContext(antlr4::ParserRuleContext* parent,
+                               size_t invokingState);
+    size_t getRuleIndex() const override;
+    LogicalANDExpressionContext* logicalANDExpression();
+    LogicalORExpressionContext* logicalORExpression();
+
+    void enterRule(antlr4::tree::ParseTreeListener* listener) override;
+    void exitRule(antlr4::tree::ParseTreeListener* listener) override;
+
+    antlrcpp::Any accept(antlr4::tree::ParseTreeVisitor* visitor) override;
+  };
+
+  LogicalORExpressionContext* logicalORExpression();
+  LogicalORExpressionContext* logicalORExpression(int precedence);
+  class LogicalANDExpressionContext : public antlr4::ParserRuleContext {
+   public:
+    LogicalANDExpressionContext(antlr4::ParserRuleContext* parent,
+                                size_t invokingState);
+    size_t getRuleIndex() const override;
+    BitwiseExpressionContext* bitwiseExpression();
+    LogicalANDExpressionContext* logicalANDExpression();
+
+    void enterRule(antlr4::tree::ParseTreeListener* listener) override;
+    void exitRule(antlr4::tree::ParseTreeListener* listener) override;
+
+    antlrcpp::Any accept(antlr4::tree::ParseTreeVisitor* visitor) override;
+  };
+
+  LogicalANDExpressionContext* logicalANDExpression();
+  LogicalANDExpressionContext* logicalANDExpression(int precedence);
+  class BitwiseExpressionContext : public antlr4::ParserRuleContext {
+   public:
+    antlr4::Token* op = nullptr;
+    BitwiseExpressionContext(antlr4::ParserRuleContext* parent,
+                             size_t invokingState);
+    size_t getRuleIndex() const override;
+    EqualityExpressionContext* equalityExpression();
+    BitwiseExpressionContext* bitwiseExpression();
+    antlr4::tree::TerminalNode* BIT_AND();
+    antlr4::tree::TerminalNode* BIT_OR();
+
+    void enterRule(antlr4::tree::ParseTreeListener* listener) override;
+    void exitRule(antlr4::tree::ParseTreeListener* listener) override;
+
+    antlrcpp::Any accept(antlr4::tree::ParseTreeVisitor* visitor) override;
+  };
+
+  BitwiseExpressionContext* bitwiseExpression();
+  BitwiseExpressionContext* bitwiseExpression(int precedence);
+  class EqualityExpressionContext : public antlr4::ParserRuleContext {
+   public:
+    antlr4::Token* op = nullptr;
+    EqualityExpressionContext(antlr4::ParserRuleContext* parent,
+                              size_t invokingState);
+    size_t getRuleIndex() const override;
+    RelationalExpressionContext* relationalExpression();
+    EqualityExpressionContext* equalityExpression();
+    antlr4::tree::TerminalNode* EQUAL();
+    antlr4::tree::TerminalNode* NOT_EQUAL();
+
+    void enterRule(antlr4::tree::ParseTreeListener* listener) override;
+    void exitRule(antlr4::tree::ParseTreeListener* listener) override;
+
+    antlrcpp::Any accept(antlr4::tree::ParseTreeVisitor* visitor) override;
+  };
+
+  EqualityExpressionContext* equalityExpression();
+  EqualityExpressionContext* equalityExpression(int precedence);
+  class RelationalExpressionContext : public antlr4::ParserRuleContext {
+   public:
+    antlr4::Token* op = nullptr;
+    RelationalExpressionContext(antlr4::ParserRuleContext* parent,
+                                size_t invokingState);
+    size_t getRuleIndex() const override;
+    ShiftExpressionContext* shiftExpression();
+    RelationalExpressionContext* relationalExpression();
+    antlr4::tree::TerminalNode* LESS_THAN();
+    antlr4::tree::TerminalNode* LESS_THAN_EQUAL();
+    antlr4::tree::TerminalNode* GREATER_THAN();
+    antlr4::tree::TerminalNode* GREATER_THAN_EQUAL();
+
+    void enterRule(antlr4::tree::ParseTreeListener* listener) override;
+    void exitRule(antlr4::tree::ParseTreeListener* listener) override;
+
+    antlrcpp::Any accept(antlr4::tree::ParseTreeVisitor* visitor) override;
+  };
+
+  RelationalExpressionContext* relationalExpression();
+  RelationalExpressionContext* relationalExpression(int precedence);
+  class ShiftExpressionContext : public antlr4::ParserRuleContext {
+   public:
+    antlr4::Token* op = nullptr;
+    ShiftExpressionContext(antlr4::ParserRuleContext* parent,
+                           size_t invokingState);
+    size_t getRuleIndex() const override;
+    AdditiveExpressionContext* additiveExpression();
+    ShiftExpressionContext* shiftExpression();
+    antlr4::tree::TerminalNode* SHIFT_RIGHT();
+    antlr4::tree::TerminalNode* SHIFT_LEFT();
+    antlr4::tree::TerminalNode* SHIFT_RIGHT_ARITHMETIC();
+
+    void enterRule(antlr4::tree::ParseTreeListener* listener) override;
+    void exitRule(antlr4::tree::ParseTreeListener* listener) override;
+
+    antlrcpp::Any accept(antlr4::tree::ParseTreeVisitor* visitor) override;
+  };
+
+  ShiftExpressionContext* shiftExpression();
+  ShiftExpressionContext* shiftExpression(int precedence);
+  class AdditiveExpressionContext : public antlr4::ParserRuleContext {
+   public:
+    antlr4::Token* op = nullptr;
+    AdditiveExpressionContext(antlr4::ParserRuleContext* parent,
+                              size_t invokingState);
+    size_t getRuleIndex() const override;
+    MultiplicativeExpressionContext* multiplicativeExpression();
+    AdditiveExpressionContext* additiveExpression();
+    antlr4::tree::TerminalNode* PLUS();
+    antlr4::tree::TerminalNode* MINUS();
+
+    void enterRule(antlr4::tree::ParseTreeListener* listener) override;
+    void exitRule(antlr4::tree::ParseTreeListener* listener) override;
+
+    antlrcpp::Any accept(antlr4::tree::ParseTreeVisitor* visitor) override;
+  };
+
+  AdditiveExpressionContext* additiveExpression();
+  AdditiveExpressionContext* additiveExpression(int precedence);
+  class MultiplicativeExpressionContext : public antlr4::ParserRuleContext {
+   public:
+    antlr4::Token* op = nullptr;
+    MultiplicativeExpressionContext(antlr4::ParserRuleContext* parent,
+                                    size_t invokingState);
+    size_t getRuleIndex() const override;
+    UnaryExpressionContext* unaryExpression();
+    MultiplicativeExpressionContext* multiplicativeExpression();
+    antlr4::tree::TerminalNode* MULTIPLY();
+    antlr4::tree::TerminalNode* DIVIDE();
+    antlr4::tree::TerminalNode* MODULO();
+
+    void enterRule(antlr4::tree::ParseTreeListener* listener) override;
+    void exitRule(antlr4::tree::ParseTreeListener* listener) override;
+
+    antlrcpp::Any accept(antlr4::tree::ParseTreeVisitor* visitor) override;
+  };
+
+  MultiplicativeExpressionContext* multiplicativeExpression();
+  MultiplicativeExpressionContext* multiplicativeExpression(int precedence);
+  class UnaryExpressionContext : public antlr4::ParserRuleContext {
+   public:
+    antlr4::Token* op = nullptr;
+    UnaryExpressionContext(antlr4::ParserRuleContext* parent,
+                           size_t invokingState);
+    size_t getRuleIndex() const override;
+    AssignmentExpressionContext* assignmentExpression();
+    UnaryExpressionContext* unaryExpression();
+    antlr4::tree::TerminalNode* PLUS();
+    antlr4::tree::TerminalNode* MINUS();
+    antlr4::tree::TerminalNode* BIT_NOT();
+    antlr4::tree::TerminalNode* NOT();
+
+    void enterRule(antlr4::tree::ParseTreeListener* listener) override;
+    void exitRule(antlr4::tree::ParseTreeListener* listener) override;
+
+    antlrcpp::Any accept(antlr4::tree::ParseTreeVisitor* visitor) override;
+  };
+
+  UnaryExpressionContext* unaryExpression();
+
+  class LocationExpressionContext : public antlr4::ParserRuleContext {
+   public:
+    LocationExpressionContext(antlr4::ParserRuleContext* parent,
+                              size_t invokingState);
+    size_t getRuleIndex() const override;
+    antlr4::tree::TerminalNode* IDENTIFIER();
+    GenericSpecializationTypeListContext* genericSpecializationTypeList();
+    LocationExpressionContext* locationExpression();
+    ExpressionContext* expression();
+
+    void enterRule(antlr4::tree::ParseTreeListener* listener) override;
+    void exitRule(antlr4::tree::ParseTreeListener* listener) override;
+
+    antlrcpp::Any accept(antlr4::tree::ParseTreeVisitor* visitor) override;
+  };
+
+  LocationExpressionContext* locationExpression();
+  LocationExpressionContext* locationExpression(int precedence);
+  class IncrementDecrementContext : public antlr4::ParserRuleContext {
+   public:
+    antlr4::Token* op = nullptr;
+    IncrementDecrementContext(antlr4::ParserRuleContext* parent,
+                              size_t invokingState);
+    size_t getRuleIndex() const override;
+    antlr4::tree::TerminalNode* INCREMENT();
+    LocationExpressionContext* locationExpression();
+    antlr4::tree::TerminalNode* DECREMENT();
+
+    void enterRule(antlr4::tree::ParseTreeListener* listener) override;
+    void exitRule(antlr4::tree::ParseTreeListener* listener) override;
+
+    antlrcpp::Any accept(antlr4::tree::ParseTreeVisitor* visitor) override;
+  };
+
+  IncrementDecrementContext* incrementDecrement();
+
+  class AssignmentContext : public antlr4::ParserRuleContext {
+   public:
+    AssignmentContext(antlr4::ParserRuleContext* parent, size_t invokingState);
+    size_t getRuleIndex() const override;
+    IncrementDecrementContext* incrementDecrement();
+    LocationExpressionContext* locationExpression();
+    ExpressionContext* expression();
+    antlr4::tree::TerminalNode* ASSIGNMENT();
+    antlr4::tree::TerminalNode* ASSIGNMENT_OPERATOR();
+
+    void enterRule(antlr4::tree::ParseTreeListener* listener) override;
+    void exitRule(antlr4::tree::ParseTreeListener* listener) override;
+
+    antlrcpp::Any accept(antlr4::tree::ParseTreeVisitor* visitor) override;
+  };
+
+  AssignmentContext* assignment();
+
+  class AssignmentExpressionContext : public antlr4::ParserRuleContext {
+   public:
+    AssignmentExpressionContext(antlr4::ParserRuleContext* parent,
+                                size_t invokingState);
+    size_t getRuleIndex() const override;
+    PrimaryExpressionContext* primaryExpression();
+    AssignmentContext* assignment();
+
+    void enterRule(antlr4::tree::ParseTreeListener* listener) override;
+    void exitRule(antlr4::tree::ParseTreeListener* listener) override;
+
+    antlrcpp::Any accept(antlr4::tree::ParseTreeVisitor* visitor) override;
+  };
+
+  AssignmentExpressionContext* assignmentExpression();
+
+  class PrimaryExpressionContext : public antlr4::ParserRuleContext {
+   public:
+    PrimaryExpressionContext(antlr4::ParserRuleContext* parent,
+                             size_t invokingState);
+    size_t getRuleIndex() const override;
+    HelperCallContext* helperCall();
+    antlr4::tree::TerminalNode* DECIMAL_LITERAL();
+    antlr4::tree::TerminalNode* STRING_LITERAL();
+    ExpressionContext* expression();
+
+    void enterRule(antlr4::tree::ParseTreeListener* listener) override;
+    void exitRule(antlr4::tree::ParseTreeListener* listener) override;
+
+    antlrcpp::Any accept(antlr4::tree::ParseTreeVisitor* visitor) override;
+  };
+
+  PrimaryExpressionContext* primaryExpression();
+
+  class ForInitializationContext : public antlr4::ParserRuleContext {
+   public:
+    ForInitializationContext(antlr4::ParserRuleContext* parent,
+                             size_t invokingState);
+    size_t getRuleIndex() const override;
+    VariableDeclarationWithInitializationContext*
+    variableDeclarationWithInitialization();
+
+    void enterRule(antlr4::tree::ParseTreeListener* listener) override;
+    void exitRule(antlr4::tree::ParseTreeListener* listener) override;
+
+    antlrcpp::Any accept(antlr4::tree::ParseTreeVisitor* visitor) override;
+  };
+
+  ForInitializationContext* forInitialization();
+
+  class ForLoopContext : public antlr4::ParserRuleContext {
+   public:
+    ForLoopContext(antlr4::ParserRuleContext* parent, size_t invokingState);
+    size_t getRuleIndex() const override;
+    antlr4::tree::TerminalNode* FOR();
+    ForInitializationContext* forInitialization();
+    ExpressionContext* expression();
+    AssignmentContext* assignment();
+    StatementBlockContext* statementBlock();
+
+    void enterRule(antlr4::tree::ParseTreeListener* listener) override;
+    void exitRule(antlr4::tree::ParseTreeListener* listener) override;
+
+    antlrcpp::Any accept(antlr4::tree::ParseTreeVisitor* visitor) override;
+  };
+
+  ForLoopContext* forLoop();
+
+  class RangeSpecifierContext : public antlr4::ParserRuleContext {
+   public:
+    TorqueParser::ExpressionContext* begin = nullptr;
+    TorqueParser::ExpressionContext* end = nullptr;
+    RangeSpecifierContext(antlr4::ParserRuleContext* parent,
+                          size_t invokingState);
+    size_t getRuleIndex() const override;
+    std::vector<ExpressionContext*> expression();
+    ExpressionContext* expression(size_t i);
+
+    void enterRule(antlr4::tree::ParseTreeListener* listener) override;
+    void exitRule(antlr4::tree::ParseTreeListener* listener) override;
+
+    antlrcpp::Any accept(antlr4::tree::ParseTreeVisitor* visitor) override;
+  };
+
+  RangeSpecifierContext* rangeSpecifier();
+
+  class ForOfRangeContext : public antlr4::ParserRuleContext {
+   public:
+    ForOfRangeContext(antlr4::ParserRuleContext* parent, size_t invokingState);
+    size_t getRuleIndex() const override;
+    RangeSpecifierContext* rangeSpecifier();
+
+    void enterRule(antlr4::tree::ParseTreeListener* listener) override;
+    void exitRule(antlr4::tree::ParseTreeListener* listener) override;
+
+    antlrcpp::Any accept(antlr4::tree::ParseTreeVisitor* visitor) override;
+  };
+
+  ForOfRangeContext* forOfRange();
+
+  class ForOfLoopContext : public antlr4::ParserRuleContext {
+   public:
+    ForOfLoopContext(antlr4::ParserRuleContext* parent, size_t invokingState);
+    size_t getRuleIndex() const override;
+    antlr4::tree::TerminalNode* FOR();
+    VariableDeclarationContext* variableDeclaration();
+    ExpressionContext* expression();
+    ForOfRangeContext* forOfRange();
+    StatementBlockContext* statementBlock();
+
+    void enterRule(antlr4::tree::ParseTreeListener* listener) override;
+    void exitRule(antlr4::tree::ParseTreeListener* listener) override;
+
+    antlrcpp::Any accept(antlr4::tree::ParseTreeVisitor* visitor) override;
+  };
+
+  ForOfLoopContext* forOfLoop();
+
+  class ArgumentContext : public antlr4::ParserRuleContext {
+   public:
+    ArgumentContext(antlr4::ParserRuleContext* parent, size_t invokingState);
+    size_t getRuleIndex() const override;
+    ExpressionContext* expression();
+
+    void enterRule(antlr4::tree::ParseTreeListener* listener) override;
+    void exitRule(antlr4::tree::ParseTreeListener* listener) override;
+
+    antlrcpp::Any accept(antlr4::tree::ParseTreeVisitor* visitor) override;
+  };
+
+  ArgumentContext* argument();
+
+  class ArgumentListContext : public antlr4::ParserRuleContext {
+   public:
+    ArgumentListContext(antlr4::ParserRuleContext* parent,
+                        size_t invokingState);
+    size_t getRuleIndex() const override;
+    std::vector<ArgumentContext*> argument();
+    ArgumentContext* argument(size_t i);
+
+    void enterRule(antlr4::tree::ParseTreeListener* listener) override;
+    void exitRule(antlr4::tree::ParseTreeListener* listener) override;
+
+    antlrcpp::Any accept(antlr4::tree::ParseTreeVisitor* visitor) override;
+  };
+
+  ArgumentListContext* argumentList();
+
+  class HelperCallContext : public antlr4::ParserRuleContext {
+   public:
+    HelperCallContext(antlr4::ParserRuleContext* parent, size_t invokingState);
+    size_t getRuleIndex() const override;
+    ArgumentListContext* argumentList();
+    OptionalOtherwiseContext* optionalOtherwise();
+    antlr4::tree::TerminalNode* MIN();
+    antlr4::tree::TerminalNode* MAX();
+    antlr4::tree::TerminalNode* IDENTIFIER();
+    GenericSpecializationTypeListContext* genericSpecializationTypeList();
+
+    void enterRule(antlr4::tree::ParseTreeListener* listener) override;
+    void exitRule(antlr4::tree::ParseTreeListener* listener) override;
+
+    antlrcpp::Any accept(antlr4::tree::ParseTreeVisitor* visitor) override;
+  };
+
+  HelperCallContext* helperCall();
+
+  class LabelReferenceContext : public antlr4::ParserRuleContext {
+   public:
+    LabelReferenceContext(antlr4::ParserRuleContext* parent,
+                          size_t invokingState);
+    size_t getRuleIndex() const override;
+    antlr4::tree::TerminalNode* IDENTIFIER();
+
+    void enterRule(antlr4::tree::ParseTreeListener* listener) override;
+    void exitRule(antlr4::tree::ParseTreeListener* listener) override;
+
+    antlrcpp::Any accept(antlr4::tree::ParseTreeVisitor* visitor) override;
+  };
+
+  LabelReferenceContext* labelReference();
+
+  class VariableDeclarationContext : public antlr4::ParserRuleContext {
+   public:
+    VariableDeclarationContext(antlr4::ParserRuleContext* parent,
+                               size_t invokingState);
+    size_t getRuleIndex() const override;
+    antlr4::tree::TerminalNode* LET();
+    antlr4::tree::TerminalNode* IDENTIFIER();
+    TypeContext* type();
+
+    void enterRule(antlr4::tree::ParseTreeListener* listener) override;
+    void exitRule(antlr4::tree::ParseTreeListener* listener) override;
+
+    antlrcpp::Any accept(antlr4::tree::ParseTreeVisitor* visitor) override;
+  };
+
+  VariableDeclarationContext* variableDeclaration();
+
+  class VariableDeclarationWithInitializationContext
+      : public antlr4::ParserRuleContext {
+   public:
+    VariableDeclarationWithInitializationContext(
+        antlr4::ParserRuleContext* parent, size_t invokingState);
+    size_t getRuleIndex() const override;
+    VariableDeclarationContext* variableDeclaration();
+    antlr4::tree::TerminalNode* ASSIGNMENT();
+    ExpressionContext* expression();
+
+    void enterRule(antlr4::tree::ParseTreeListener* listener) override;
+    void exitRule(antlr4::tree::ParseTreeListener* listener) override;
+
+    antlrcpp::Any accept(antlr4::tree::ParseTreeVisitor* visitor) override;
+  };
+
+  VariableDeclarationWithInitializationContext*
+  variableDeclarationWithInitialization();
+
+  class HelperCallStatementContext : public antlr4::ParserRuleContext {
+   public:
+    HelperCallStatementContext(antlr4::ParserRuleContext* parent,
+                               size_t invokingState);
+    size_t getRuleIndex() const override;
+    HelperCallContext* helperCall();
+    antlr4::tree::TerminalNode* TAIL();
+
+    void enterRule(antlr4::tree::ParseTreeListener* listener) override;
+    void exitRule(antlr4::tree::ParseTreeListener* listener) override;
+
+    antlrcpp::Any accept(antlr4::tree::ParseTreeVisitor* visitor) override;
+  };
+
+  HelperCallStatementContext* helperCallStatement();
+
+  class ExpressionStatementContext : public antlr4::ParserRuleContext {
+   public:
+    ExpressionStatementContext(antlr4::ParserRuleContext* parent,
+                               size_t invokingState);
+    size_t getRuleIndex() const override;
+    AssignmentContext* assignment();
+
+    void enterRule(antlr4::tree::ParseTreeListener* listener) override;
+    void exitRule(antlr4::tree::ParseTreeListener* listener) override;
+
+    antlrcpp::Any accept(antlr4::tree::ParseTreeVisitor* visitor) override;
+  };
+
+  ExpressionStatementContext* expressionStatement();
+
+  class IfStatementContext : public antlr4::ParserRuleContext {
+   public:
+    IfStatementContext(antlr4::ParserRuleContext* parent, size_t invokingState);
+    size_t getRuleIndex() const override;
+    antlr4::tree::TerminalNode* IF();
+    ExpressionContext* expression();
+    std::vector<StatementBlockContext*> statementBlock();
+    StatementBlockContext* statementBlock(size_t i);
+    antlr4::tree::TerminalNode* CONSTEXPR();
+
+    void enterRule(antlr4::tree::ParseTreeListener* listener) override;
+    void exitRule(antlr4::tree::ParseTreeListener* listener) override;
+
+    antlrcpp::Any accept(antlr4::tree::ParseTreeVisitor* visitor) override;
+  };
+
+  IfStatementContext* ifStatement();
+
+  class WhileLoopContext : public antlr4::ParserRuleContext {
+   public:
+    WhileLoopContext(antlr4::ParserRuleContext* parent, size_t invokingState);
+    size_t getRuleIndex() const override;
+    antlr4::tree::TerminalNode* WHILE();
+    ExpressionContext* expression();
+    StatementBlockContext* statementBlock();
+
+    void enterRule(antlr4::tree::ParseTreeListener* listener) override;
+    void exitRule(antlr4::tree::ParseTreeListener* listener) override;
+
+    antlrcpp::Any accept(antlr4::tree::ParseTreeVisitor* visitor) override;
+  };
+
+  WhileLoopContext* whileLoop();
+
+  class ReturnStatementContext : public antlr4::ParserRuleContext {
+   public:
+    ReturnStatementContext(antlr4::ParserRuleContext* parent,
+                           size_t invokingState);
+    size_t getRuleIndex() const override;
+    antlr4::tree::TerminalNode* RETURN();
+    ExpressionContext* expression();
+
+    void enterRule(antlr4::tree::ParseTreeListener* listener) override;
+    void exitRule(antlr4::tree::ParseTreeListener* listener) override;
+
+    antlrcpp::Any accept(antlr4::tree::ParseTreeVisitor* visitor) override;
+  };
+
+  ReturnStatementContext* returnStatement();
+
+  class BreakStatementContext : public antlr4::ParserRuleContext {
+   public:
+    BreakStatementContext(antlr4::ParserRuleContext* parent,
+                          size_t invokingState);
+    size_t getRuleIndex() const override;
+    antlr4::tree::TerminalNode* BREAK();
+
+    void enterRule(antlr4::tree::ParseTreeListener* listener) override;
+    void exitRule(antlr4::tree::ParseTreeListener* listener) override;
+
+    antlrcpp::Any accept(antlr4::tree::ParseTreeVisitor* visitor) override;
+  };
+
+  BreakStatementContext* breakStatement();
+
+  class ContinueStatementContext : public antlr4::ParserRuleContext {
+   public:
+    ContinueStatementContext(antlr4::ParserRuleContext* parent,
+                             size_t invokingState);
+    size_t getRuleIndex() const override;
+    antlr4::tree::TerminalNode* CONTINUE();
+
+    void enterRule(antlr4::tree::ParseTreeListener* listener) override;
+    void exitRule(antlr4::tree::ParseTreeListener* listener) override;
+
+    antlrcpp::Any accept(antlr4::tree::ParseTreeVisitor* visitor) override;
+  };
+
+  ContinueStatementContext* continueStatement();
+
+  class GotoStatementContext : public antlr4::ParserRuleContext {
+   public:
+    GotoStatementContext(antlr4::ParserRuleContext* parent,
+                         size_t invokingState);
+    size_t getRuleIndex() const override;
+    antlr4::tree::TerminalNode* GOTO();
+    LabelReferenceContext* labelReference();
+    ArgumentListContext* argumentList();
+
+    void enterRule(antlr4::tree::ParseTreeListener* listener) override;
+    void exitRule(antlr4::tree::ParseTreeListener* listener) override;
+
+    antlrcpp::Any accept(antlr4::tree::ParseTreeVisitor* visitor) override;
+  };
+
+  GotoStatementContext* gotoStatement();
+
+  class HandlerWithStatementContext : public antlr4::ParserRuleContext {
+   public:
+    HandlerWithStatementContext(antlr4::ParserRuleContext* parent,
+                                size_t invokingState);
+    size_t getRuleIndex() const override;
+    antlr4::tree::TerminalNode* LABEL();
+    LabelDeclarationContext* labelDeclaration();
+    StatementBlockContext* statementBlock();
+
+    void enterRule(antlr4::tree::ParseTreeListener* listener) override;
+    void exitRule(antlr4::tree::ParseTreeListener* listener) override;
+
+    antlrcpp::Any accept(antlr4::tree::ParseTreeVisitor* visitor) override;
+  };
+
+  HandlerWithStatementContext* handlerWithStatement();
+
+  class TryLabelStatementContext : public antlr4::ParserRuleContext {
+   public:
+    TryLabelStatementContext(antlr4::ParserRuleContext* parent,
+                             size_t invokingState);
+    size_t getRuleIndex() const override;
+    antlr4::tree::TerminalNode* TRY();
+    StatementBlockContext* statementBlock();
+    std::vector<HandlerWithStatementContext*> handlerWithStatement();
+    HandlerWithStatementContext* handlerWithStatement(size_t i);
+
+    void enterRule(antlr4::tree::ParseTreeListener* listener) override;
+    void exitRule(antlr4::tree::ParseTreeListener* listener) override;
+
+    antlrcpp::Any accept(antlr4::tree::ParseTreeVisitor* visitor) override;
+  };
+
+  TryLabelStatementContext* tryLabelStatement();
+
+  class DiagnosticStatementContext : public antlr4::ParserRuleContext {
+   public:
+    DiagnosticStatementContext(antlr4::ParserRuleContext* parent,
+                               size_t invokingState);
+    size_t getRuleIndex() const override;
+    ExpressionContext* expression();
+    antlr4::tree::TerminalNode* ASSERT_TOKEN();
+    antlr4::tree::TerminalNode* CHECK_TOKEN();
+    antlr4::tree::TerminalNode* UNREACHABLE_TOKEN();
+    antlr4::tree::TerminalNode* DEBUG_TOKEN();
+
+    void enterRule(antlr4::tree::ParseTreeListener* listener) override;
+    void exitRule(antlr4::tree::ParseTreeListener* listener) override;
+
+    antlrcpp::Any accept(antlr4::tree::ParseTreeVisitor* visitor) override;
+  };
+
+  DiagnosticStatementContext* diagnosticStatement();
+
+  class StatementContext : public antlr4::ParserRuleContext {
+   public:
+    StatementContext(antlr4::ParserRuleContext* parent, size_t invokingState);
+    size_t getRuleIndex() const override;
+    VariableDeclarationWithInitializationContext*
+    variableDeclarationWithInitialization();
+    HelperCallStatementContext* helperCallStatement();
+    ExpressionStatementContext* expressionStatement();
+    ReturnStatementContext* returnStatement();
+    BreakStatementContext* breakStatement();
+    ContinueStatementContext* continueStatement();
+    GotoStatementContext* gotoStatement();
+    IfStatementContext* ifStatement();
+    DiagnosticStatementContext* diagnosticStatement();
+    WhileLoopContext* whileLoop();
+    ForOfLoopContext* forOfLoop();
+    ForLoopContext* forLoop();
+    TryLabelStatementContext* tryLabelStatement();
+
+    void enterRule(antlr4::tree::ParseTreeListener* listener) override;
+    void exitRule(antlr4::tree::ParseTreeListener* listener) override;
+
+    antlrcpp::Any accept(antlr4::tree::ParseTreeVisitor* visitor) override;
+  };
+
+  StatementContext* statement();
+
+  class StatementListContext : public antlr4::ParserRuleContext {
+   public:
+    StatementListContext(antlr4::ParserRuleContext* parent,
+                         size_t invokingState);
+    size_t getRuleIndex() const override;
+    std::vector<StatementContext*> statement();
+    StatementContext* statement(size_t i);
+
+    void enterRule(antlr4::tree::ParseTreeListener* listener) override;
+    void exitRule(antlr4::tree::ParseTreeListener* listener) override;
+
+    antlrcpp::Any accept(antlr4::tree::ParseTreeVisitor* visitor) override;
+  };
+
+  StatementListContext* statementList();
+
+  class StatementScopeContext : public antlr4::ParserRuleContext {
+   public:
+    StatementScopeContext(antlr4::ParserRuleContext* parent,
+                          size_t invokingState);
+    size_t getRuleIndex() const override;
+    StatementListContext* statementList();
+    antlr4::tree::TerminalNode* DEFERRED();
+
+    void enterRule(antlr4::tree::ParseTreeListener* listener) override;
+    void exitRule(antlr4::tree::ParseTreeListener* listener) override;
+
+    antlrcpp::Any accept(antlr4::tree::ParseTreeVisitor* visitor) override;
+  };
+
+  StatementScopeContext* statementScope();
+
+  class StatementBlockContext : public antlr4::ParserRuleContext {
+   public:
+    StatementBlockContext(antlr4::ParserRuleContext* parent,
+                          size_t invokingState);
+    size_t getRuleIndex() const override;
+    StatementContext* statement();
+    StatementScopeContext* statementScope();
+
+    void enterRule(antlr4::tree::ParseTreeListener* listener) override;
+    void exitRule(antlr4::tree::ParseTreeListener* listener) override;
+
+    antlrcpp::Any accept(antlr4::tree::ParseTreeVisitor* visitor) override;
+  };
+
+  StatementBlockContext* statementBlock();
+
+  class HelperBodyContext : public antlr4::ParserRuleContext {
+   public:
+    HelperBodyContext(antlr4::ParserRuleContext* parent, size_t invokingState);
+    size_t getRuleIndex() const override;
+    StatementScopeContext* statementScope();
+
+    void enterRule(antlr4::tree::ParseTreeListener* listener) override;
+    void exitRule(antlr4::tree::ParseTreeListener* listener) override;
+
+    antlrcpp::Any accept(antlr4::tree::ParseTreeVisitor* visitor) override;
+  };
+
+  HelperBodyContext* helperBody();
+
+  class ExtendsDeclarationContext : public antlr4::ParserRuleContext {
+   public:
+    ExtendsDeclarationContext(antlr4::ParserRuleContext* parent,
+                              size_t invokingState);
+    size_t getRuleIndex() const override;
+    antlr4::tree::TerminalNode* IDENTIFIER();
+
+    void enterRule(antlr4::tree::ParseTreeListener* listener) override;
+    void exitRule(antlr4::tree::ParseTreeListener* listener) override;
+
+    antlrcpp::Any accept(antlr4::tree::ParseTreeVisitor* visitor) override;
+  };
+
+  ExtendsDeclarationContext* extendsDeclaration();
+
+  class GeneratesDeclarationContext : public antlr4::ParserRuleContext {
+   public:
+    GeneratesDeclarationContext(antlr4::ParserRuleContext* parent,
+                                size_t invokingState);
+    size_t getRuleIndex() const override;
+    antlr4::tree::TerminalNode* STRING_LITERAL();
+
+    void enterRule(antlr4::tree::ParseTreeListener* listener) override;
+    void exitRule(antlr4::tree::ParseTreeListener* listener) override;
+
+    antlrcpp::Any accept(antlr4::tree::ParseTreeVisitor* visitor) override;
+  };
+
+  GeneratesDeclarationContext* generatesDeclaration();
+
+  class ConstexprDeclarationContext : public antlr4::ParserRuleContext {
+   public:
+    ConstexprDeclarationContext(antlr4::ParserRuleContext* parent,
+                                size_t invokingState);
+    size_t getRuleIndex() const override;
+    antlr4::tree::TerminalNode* STRING_LITERAL();
+
+    void enterRule(antlr4::tree::ParseTreeListener* listener) override;
+    void exitRule(antlr4::tree::ParseTreeListener* listener) override;
+
+    antlrcpp::Any accept(antlr4::tree::ParseTreeVisitor* visitor) override;
+  };
+
+  ConstexprDeclarationContext* constexprDeclaration();
+
+  class TypeDeclarationContext : public antlr4::ParserRuleContext {
+   public:
+    TypeDeclarationContext(antlr4::ParserRuleContext* parent,
+                           size_t invokingState);
+    size_t getRuleIndex() const override;
+    antlr4::tree::TerminalNode* IDENTIFIER();
+    ExtendsDeclarationContext* extendsDeclaration();
+    GeneratesDeclarationContext* generatesDeclaration();
+    ConstexprDeclarationContext* constexprDeclaration();
+
+    void enterRule(antlr4::tree::ParseTreeListener* listener) override;
+    void exitRule(antlr4::tree::ParseTreeListener* listener) override;
+
+    antlrcpp::Any accept(antlr4::tree::ParseTreeVisitor* visitor) override;
+  };
+
+  TypeDeclarationContext* typeDeclaration();
+
+  class TypeAliasDeclarationContext : public antlr4::ParserRuleContext {
+   public:
+    TypeAliasDeclarationContext(antlr4::ParserRuleContext* parent,
+                                size_t invokingState);
+    size_t getRuleIndex() const override;
+    antlr4::tree::TerminalNode* IDENTIFIER();
+    TypeContext* type();
+
+    void enterRule(antlr4::tree::ParseTreeListener* listener) override;
+    void exitRule(antlr4::tree::ParseTreeListener* listener) override;
+
+    antlrcpp::Any accept(antlr4::tree::ParseTreeVisitor* visitor) override;
+  };
+
+  TypeAliasDeclarationContext* typeAliasDeclaration();
+
+  class ExternalBuiltinContext : public antlr4::ParserRuleContext {
+   public:
+    ExternalBuiltinContext(antlr4::ParserRuleContext* parent,
+                           size_t invokingState);
+    size_t getRuleIndex() const override;
+    antlr4::tree::TerminalNode* EXTERN();
+    antlr4::tree::TerminalNode* BUILTIN();
+    antlr4::tree::TerminalNode* IDENTIFIER();
+    OptionalGenericTypeListContext* optionalGenericTypeList();
+    TypeListContext* typeList();
+    OptionalTypeContext* optionalType();
+    antlr4::tree::TerminalNode* JAVASCRIPT();
+
+    void enterRule(antlr4::tree::ParseTreeListener* listener) override;
+    void exitRule(antlr4::tree::ParseTreeListener* listener) override;
+
+    antlrcpp::Any accept(antlr4::tree::ParseTreeVisitor* visitor) override;
+  };
+
+  ExternalBuiltinContext* externalBuiltin();
+
+  class ExternalMacroContext : public antlr4::ParserRuleContext {
+   public:
+    ExternalMacroContext(antlr4::ParserRuleContext* parent,
+                         size_t invokingState);
+    size_t getRuleIndex() const override;
+    antlr4::tree::TerminalNode* EXTERN();
+    antlr4::tree::TerminalNode* MACRO();
+    antlr4::tree::TerminalNode* IDENTIFIER();
+    OptionalGenericTypeListContext* optionalGenericTypeList();
+    TypeListMaybeVarArgsContext* typeListMaybeVarArgs();
+    OptionalTypeContext* optionalType();
+    OptionalLabelListContext* optionalLabelList();
+    antlr4::tree::TerminalNode* STRING_LITERAL();
+
+    void enterRule(antlr4::tree::ParseTreeListener* listener) override;
+    void exitRule(antlr4::tree::ParseTreeListener* listener) override;
+
+    antlrcpp::Any accept(antlr4::tree::ParseTreeVisitor* visitor) override;
+  };
+
+  ExternalMacroContext* externalMacro();
+
+  class ExternalRuntimeContext : public antlr4::ParserRuleContext {
+   public:
+    ExternalRuntimeContext(antlr4::ParserRuleContext* parent,
+                           size_t invokingState);
+    size_t getRuleIndex() const override;
+    antlr4::tree::TerminalNode* EXTERN();
+    antlr4::tree::TerminalNode* RUNTIME();
+    antlr4::tree::TerminalNode* IDENTIFIER();
+    TypeListMaybeVarArgsContext* typeListMaybeVarArgs();
+    OptionalTypeContext* optionalType();
+
+    void enterRule(antlr4::tree::ParseTreeListener* listener) override;
+    void exitRule(antlr4::tree::ParseTreeListener* listener) override;
+
+    antlrcpp::Any accept(antlr4::tree::ParseTreeVisitor* visitor) override;
+  };
+
+  ExternalRuntimeContext* externalRuntime();
+
+  class BuiltinDeclarationContext : public antlr4::ParserRuleContext {
+   public:
+    BuiltinDeclarationContext(antlr4::ParserRuleContext* parent,
+                              size_t invokingState);
+    size_t getRuleIndex() const override;
+    antlr4::tree::TerminalNode* BUILTIN();
+    antlr4::tree::TerminalNode* IDENTIFIER();
+    OptionalGenericTypeListContext* optionalGenericTypeList();
+    ParameterListContext* parameterList();
+    OptionalTypeContext* optionalType();
+    HelperBodyContext* helperBody();
+    antlr4::tree::TerminalNode* JAVASCRIPT();
+
+    void enterRule(antlr4::tree::ParseTreeListener* listener) override;
+    void exitRule(antlr4::tree::ParseTreeListener* listener) override;
+
+    antlrcpp::Any accept(antlr4::tree::ParseTreeVisitor* visitor) override;
+  };
+
+  BuiltinDeclarationContext* builtinDeclaration();
+
+  class GenericSpecializationContext : public antlr4::ParserRuleContext {
+   public:
+    GenericSpecializationContext(antlr4::ParserRuleContext* parent,
+                                 size_t invokingState);
+    size_t getRuleIndex() const override;
+    antlr4::tree::TerminalNode* IDENTIFIER();
+    GenericSpecializationTypeListContext* genericSpecializationTypeList();
+    ParameterListContext* parameterList();
+    OptionalTypeContext* optionalType();
+    OptionalLabelListContext* optionalLabelList();
+    HelperBodyContext* helperBody();
+
+    void enterRule(antlr4::tree::ParseTreeListener* listener) override;
+    void exitRule(antlr4::tree::ParseTreeListener* listener) override;
+
+    antlrcpp::Any accept(antlr4::tree::ParseTreeVisitor* visitor) override;
+  };
+
+  GenericSpecializationContext* genericSpecialization();
+
+  class MacroDeclarationContext : public antlr4::ParserRuleContext {
+   public:
+    MacroDeclarationContext(antlr4::ParserRuleContext* parent,
+                            size_t invokingState);
+    size_t getRuleIndex() const override;
+    antlr4::tree::TerminalNode* MACRO();
+    antlr4::tree::TerminalNode* IDENTIFIER();
+    OptionalGenericTypeListContext* optionalGenericTypeList();
+    ParameterListContext* parameterList();
+    OptionalTypeContext* optionalType();
+    OptionalLabelListContext* optionalLabelList();
+    HelperBodyContext* helperBody();
+    antlr4::tree::TerminalNode* STRING_LITERAL();
+
+    void enterRule(antlr4::tree::ParseTreeListener* listener) override;
+    void exitRule(antlr4::tree::ParseTreeListener* listener) override;
+
+    antlrcpp::Any accept(antlr4::tree::ParseTreeVisitor* visitor) override;
+  };
+
+  MacroDeclarationContext* macroDeclaration();
+
+  class ExternConstDeclarationContext : public antlr4::ParserRuleContext {
+   public:
+    ExternConstDeclarationContext(antlr4::ParserRuleContext* parent,
+                                  size_t invokingState);
+    size_t getRuleIndex() const override;
+    antlr4::tree::TerminalNode* IDENTIFIER();
+    TypeContext* type();
+    GeneratesDeclarationContext* generatesDeclaration();
+
+    void enterRule(antlr4::tree::ParseTreeListener* listener) override;
+    void exitRule(antlr4::tree::ParseTreeListener* listener) override;
+
+    antlrcpp::Any accept(antlr4::tree::ParseTreeVisitor* visitor) override;
+  };
+
+  ExternConstDeclarationContext* externConstDeclaration();
+
+  class DeclarationContext : public antlr4::ParserRuleContext {
+   public:
+    DeclarationContext(antlr4::ParserRuleContext* parent, size_t invokingState);
+    size_t getRuleIndex() const override;
+    TypeDeclarationContext* typeDeclaration();
+    TypeAliasDeclarationContext* typeAliasDeclaration();
+    BuiltinDeclarationContext* builtinDeclaration();
+    GenericSpecializationContext* genericSpecialization();
+    MacroDeclarationContext* macroDeclaration();
+    ExternalMacroContext* externalMacro();
+    ExternalBuiltinContext* externalBuiltin();
+    ExternalRuntimeContext* externalRuntime();
+    ExternConstDeclarationContext* externConstDeclaration();
+
+    void enterRule(antlr4::tree::ParseTreeListener* listener) override;
+    void exitRule(antlr4::tree::ParseTreeListener* listener) override;
+
+    antlrcpp::Any accept(antlr4::tree::ParseTreeVisitor* visitor) override;
+  };
+
+  DeclarationContext* declaration();
+
+  class ModuleDeclarationContext : public antlr4::ParserRuleContext {
+   public:
+    ModuleDeclarationContext(antlr4::ParserRuleContext* parent,
+                             size_t invokingState);
+    size_t getRuleIndex() const override;
+    antlr4::tree::TerminalNode* MODULE();
+    antlr4::tree::TerminalNode* IDENTIFIER();
+    std::vector<DeclarationContext*> declaration();
+    DeclarationContext* declaration(size_t i);
+
+    void enterRule(antlr4::tree::ParseTreeListener* listener) override;
+    void exitRule(antlr4::tree::ParseTreeListener* listener) override;
+
+    antlrcpp::Any accept(antlr4::tree::ParseTreeVisitor* visitor) override;
+  };
+
+  ModuleDeclarationContext* moduleDeclaration();
+
+  class FileContext : public antlr4::ParserRuleContext {
+   public:
+    FileContext(antlr4::ParserRuleContext* parent, size_t invokingState);
+    size_t getRuleIndex() const override;
+    std::vector<ModuleDeclarationContext*> moduleDeclaration();
+    ModuleDeclarationContext* moduleDeclaration(size_t i);
+    std::vector<DeclarationContext*> declaration();
+    DeclarationContext* declaration(size_t i);
+
+    void enterRule(antlr4::tree::ParseTreeListener* listener) override;
+    void exitRule(antlr4::tree::ParseTreeListener* listener) override;
+
+    antlrcpp::Any accept(antlr4::tree::ParseTreeVisitor* visitor) override;
+  };
+
+  FileContext* file();
+
+  bool sempred(antlr4::RuleContext* _localctx, size_t ruleIndex,
+               size_t predicateIndex) override;
+  bool typeSempred(TypeContext* _localctx, size_t predicateIndex);
+  bool conditionalExpressionSempred(ConditionalExpressionContext* _localctx,
+                                    size_t predicateIndex);
+  bool logicalORExpressionSempred(LogicalORExpressionContext* _localctx,
+                                  size_t predicateIndex);
+  bool logicalANDExpressionSempred(LogicalANDExpressionContext* _localctx,
+                                   size_t predicateIndex);
+  bool bitwiseExpressionSempred(BitwiseExpressionContext* _localctx,
+                                size_t predicateIndex);
+  bool equalityExpressionSempred(EqualityExpressionContext* _localctx,
+                                 size_t predicateIndex);
+  bool relationalExpressionSempred(RelationalExpressionContext* _localctx,
+                                   size_t predicateIndex);
+  bool shiftExpressionSempred(ShiftExpressionContext* _localctx,
+                              size_t predicateIndex);
+  bool additiveExpressionSempred(AdditiveExpressionContext* _localctx,
+                                 size_t predicateIndex);
+  bool multiplicativeExpressionSempred(
+      MultiplicativeExpressionContext* _localctx, size_t predicateIndex);
+  bool locationExpressionSempred(LocationExpressionContext* _localctx,
+                                 size_t predicateIndex);
+
+ private:
+  static std::vector<antlr4::dfa::DFA> _decisionToDFA;
+  static antlr4::atn::PredictionContextCache _sharedContextCache;
+  static std::vector<std::string> _ruleNames;
+  static std::vector<std::string> _tokenNames;
+
+  static std::vector<std::string> _literalNames;
+  static std::vector<std::string> _symbolicNames;
+  static antlr4::dfa::Vocabulary _vocabulary;
+  static antlr4::atn::ATN _atn;
+  static std::vector<uint16_t> _serializedATN;
+
+  struct Initializer {
+    Initializer();
+  };
+  static Initializer _init;
+};
+
+#endif  // V8_TORQUE_TORQUEPARSER_H_
diff --git a/deps/v8/src/torque/TorqueVisitor.cpp b/deps/v8/src/torque/TorqueVisitor.cpp
new file mode 100644
index 00000000000000..15104d7a61809c
--- /dev/null
+++ b/deps/v8/src/torque/TorqueVisitor.cpp
@@ -0,0 +1,7 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Generated from Torque.g4 by ANTLR 4.7.1
+
+#include "TorqueVisitor.h"
diff --git a/deps/v8/src/torque/TorqueVisitor.h b/deps/v8/src/torque/TorqueVisitor.h
new file mode 100644
index 00000000000000..f576062bd29c9c
--- /dev/null
+++ b/deps/v8/src/torque/TorqueVisitor.h
@@ -0,0 +1,231 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+#ifndef V8_TORQUE_TORQUEVISITOR_H_
+#define V8_TORQUE_TORQUEVISITOR_H_
+
+// Generated from Torque.g4 by ANTLR 4.7.1
+
+#pragma once
+
+#include "./antlr4-runtime.h"
+#include "TorqueParser.h"
+
+/**
+ * This class defines an abstract visitor for a parse tree
+ * produced by TorqueParser.
+ */
+class TorqueVisitor : public antlr4::tree::AbstractParseTreeVisitor {
+ public:
+  /**
+   * Visit parse trees produced by TorqueParser.
+   */
+  virtual antlrcpp::Any visitType(TorqueParser::TypeContext* context) = 0;
+
+  virtual antlrcpp::Any visitTypeList(
+      TorqueParser::TypeListContext* context) = 0;
+
+  virtual antlrcpp::Any visitGenericSpecializationTypeList(
+      TorqueParser::GenericSpecializationTypeListContext* context) = 0;
+
+  virtual antlrcpp::Any visitOptionalGenericTypeList(
+      TorqueParser::OptionalGenericTypeListContext* context) = 0;
+
+  virtual antlrcpp::Any visitTypeListMaybeVarArgs(
+      TorqueParser::TypeListMaybeVarArgsContext* context) = 0;
+
+  virtual antlrcpp::Any visitLabelParameter(
+      TorqueParser::LabelParameterContext* context) = 0;
+
+  virtual antlrcpp::Any visitOptionalType(
+      TorqueParser::OptionalTypeContext* context) = 0;
+
+  virtual antlrcpp::Any visitOptionalLabelList(
+      TorqueParser::OptionalLabelListContext* context) = 0;
+
+  virtual antlrcpp::Any visitOptionalOtherwise(
+      TorqueParser::OptionalOtherwiseContext* context) = 0;
+
+  virtual antlrcpp::Any visitParameter(
+      TorqueParser::ParameterContext* context) = 0;
+
+  virtual antlrcpp::Any visitParameterList(
+      TorqueParser::ParameterListContext* context) = 0;
+
+  virtual antlrcpp::Any visitLabelDeclaration(
+      TorqueParser::LabelDeclarationContext* context) = 0;
+
+  virtual antlrcpp::Any visitExpression(
+      TorqueParser::ExpressionContext* context) = 0;
+
+  virtual antlrcpp::Any visitConditionalExpression(
+      TorqueParser::ConditionalExpressionContext* context) = 0;
+
+  virtual antlrcpp::Any visitLogicalORExpression(
+      TorqueParser::LogicalORExpressionContext* context) = 0;
+
+  virtual antlrcpp::Any visitLogicalANDExpression(
+      TorqueParser::LogicalANDExpressionContext* context) = 0;
+
+  virtual antlrcpp::Any visitBitwiseExpression(
+      TorqueParser::BitwiseExpressionContext* context) = 0;
+
+  virtual antlrcpp::Any visitEqualityExpression(
+      TorqueParser::EqualityExpressionContext* context) = 0;
+
+  virtual antlrcpp::Any visitRelationalExpression(
+      TorqueParser::RelationalExpressionContext* context) = 0;
+
+  virtual antlrcpp::Any visitShiftExpression(
+      TorqueParser::ShiftExpressionContext* context) = 0;
+
+  virtual antlrcpp::Any visitAdditiveExpression(
+      TorqueParser::AdditiveExpressionContext* context) = 0;
+
+  virtual antlrcpp::Any visitMultiplicativeExpression(
+      TorqueParser::MultiplicativeExpressionContext* context) = 0;
+
+  virtual antlrcpp::Any visitUnaryExpression(
+      TorqueParser::UnaryExpressionContext* context) = 0;
+
+  virtual antlrcpp::Any visitLocationExpression(
+      TorqueParser::LocationExpressionContext* context) = 0;
+
+  virtual antlrcpp::Any visitIncrementDecrement(
+      TorqueParser::IncrementDecrementContext* context) = 0;
+
+  virtual antlrcpp::Any visitAssignment(
+      TorqueParser::AssignmentContext* context) = 0;
+
+  virtual antlrcpp::Any visitAssignmentExpression(
+      TorqueParser::AssignmentExpressionContext* context) = 0;
+
+  virtual antlrcpp::Any visitPrimaryExpression(
+      TorqueParser::PrimaryExpressionContext* context) = 0;
+
+  virtual antlrcpp::Any visitForInitialization(
+      TorqueParser::ForInitializationContext* context) = 0;
+
+  virtual antlrcpp::Any visitForLoop(TorqueParser::ForLoopContext* context) = 0;
+
+  virtual antlrcpp::Any visitRangeSpecifier(
+      TorqueParser::RangeSpecifierContext* context) = 0;
+
+  virtual antlrcpp::Any visitForOfRange(
+      TorqueParser::ForOfRangeContext* context) = 0;
+
+  virtual antlrcpp::Any visitForOfLoop(
+      TorqueParser::ForOfLoopContext* context) = 0;
+
+  virtual antlrcpp::Any visitArgument(
+      TorqueParser::ArgumentContext* context) = 0;
+
+  virtual antlrcpp::Any visitArgumentList(
+      TorqueParser::ArgumentListContext* context) = 0;
+
+  virtual antlrcpp::Any visitHelperCall(
+      TorqueParser::HelperCallContext* context) = 0;
+
+  virtual antlrcpp::Any visitLabelReference(
+      TorqueParser::LabelReferenceContext* context) = 0;
+
+  virtual antlrcpp::Any visitVariableDeclaration(
+      TorqueParser::VariableDeclarationContext* context) = 0;
+
+  virtual antlrcpp::Any visitVariableDeclarationWithInitialization(
+      TorqueParser::VariableDeclarationWithInitializationContext* context) = 0;
+
+  virtual antlrcpp::Any visitHelperCallStatement(
+      TorqueParser::HelperCallStatementContext* context) = 0;
+
+  virtual antlrcpp::Any visitExpressionStatement(
+      TorqueParser::ExpressionStatementContext* context) = 0;
+
+  virtual antlrcpp::Any visitIfStatement(
+      TorqueParser::IfStatementContext* context) = 0;
+
+  virtual antlrcpp::Any visitWhileLoop(
+      TorqueParser::WhileLoopContext* context) = 0;
+
+  virtual antlrcpp::Any visitReturnStatement(
+      TorqueParser::ReturnStatementContext* context) = 0;
+
+  virtual antlrcpp::Any visitBreakStatement(
+      TorqueParser::BreakStatementContext* context) = 0;
+
+  virtual antlrcpp::Any visitContinueStatement(
+      TorqueParser::ContinueStatementContext* context) = 0;
+
+  virtual antlrcpp::Any visitGotoStatement(
+      TorqueParser::GotoStatementContext* context) = 0;
+
+  virtual antlrcpp::Any visitHandlerWithStatement(
+      TorqueParser::HandlerWithStatementContext* context) = 0;
+
+  virtual antlrcpp::Any visitTryLabelStatement(
+      TorqueParser::TryLabelStatementContext* context) = 0;
+
+  virtual antlrcpp::Any visitDiagnosticStatement(
+      TorqueParser::DiagnosticStatementContext* context) = 0;
+
+  virtual antlrcpp::Any visitStatement(
+      TorqueParser::StatementContext* context) = 0;
+
+  virtual antlrcpp::Any visitStatementList(
+      TorqueParser::StatementListContext* context) = 0;
+
+  virtual antlrcpp::Any visitStatementScope(
+      TorqueParser::StatementScopeContext* context) = 0;
+
+  virtual antlrcpp::Any visitStatementBlock(
+      TorqueParser::StatementBlockContext* context) = 0;
+
+  virtual antlrcpp::Any visitHelperBody(
+      TorqueParser::HelperBodyContext* context) = 0;
+
+  virtual antlrcpp::Any visitExtendsDeclaration(
+      TorqueParser::ExtendsDeclarationContext* context) = 0;
+
+  virtual antlrcpp::Any visitGeneratesDeclaration(
+      TorqueParser::GeneratesDeclarationContext* context) = 0;
+
+  virtual antlrcpp::Any visitConstexprDeclaration(
+      TorqueParser::ConstexprDeclarationContext* context) = 0;
+
+  virtual antlrcpp::Any visitTypeDeclaration(
+      TorqueParser::TypeDeclarationContext* context) = 0;
+
+  virtual antlrcpp::Any visitTypeAliasDeclaration(
+      TorqueParser::TypeAliasDeclarationContext* context) = 0;
+
+  virtual antlrcpp::Any visitExternalBuiltin(
+      TorqueParser::ExternalBuiltinContext* context) = 0;
+
+  virtual antlrcpp::Any visitExternalMacro(
+      TorqueParser::ExternalMacroContext* context) = 0;
+
+  virtual antlrcpp::Any visitExternalRuntime(
+      TorqueParser::ExternalRuntimeContext* context) = 0;
+
+  virtual antlrcpp::Any visitBuiltinDeclaration(
+      TorqueParser::BuiltinDeclarationContext* context) = 0;
+
+  virtual antlrcpp::Any visitGenericSpecialization(
+      TorqueParser::GenericSpecializationContext* context) = 0;
+
+  virtual antlrcpp::Any visitMacroDeclaration(
+      TorqueParser::MacroDeclarationContext* context) = 0;
+
+  virtual antlrcpp::Any visitExternConstDeclaration(
+      TorqueParser::ExternConstDeclarationContext* context) = 0;
+
+  virtual antlrcpp::Any visitDeclaration(
+      TorqueParser::DeclarationContext* context) = 0;
+
+  virtual antlrcpp::Any visitModuleDeclaration(
+      TorqueParser::ModuleDeclarationContext* context) = 0;
+
+  virtual antlrcpp::Any visitFile(TorqueParser::FileContext* context) = 0;
+};
+
+#endif  // V8_TORQUE_TORQUEVISITOR_H_
diff --git a/deps/v8/src/torque/ast-generator.cc b/deps/v8/src/torque/ast-generator.cc
new file mode 100644
index 00000000000000..9fd072912a034a
--- /dev/null
+++ b/deps/v8/src/torque/ast-generator.cc
@@ -0,0 +1,778 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include <string>
+
+#include "src/base/macros.h"
+#include "src/torque/ast-generator.h"
+
+namespace v8 {
+namespace internal {
+namespace torque {
+
+namespace {
+
+std::vector<std::string> GetIdentifierVector(
+    std::vector<antlr4::tree::TerminalNode*> source) {
+  std::vector<std::string> result;
+  for (auto s : source) {
+    result.push_back(s->getSymbol()->getText());
+  }
+  return result;
+}
+
+std::string StringLiteralUnquote(const std::string& s) {
+  assert('"' == s.front() || '\'' == s.front());
+  assert('"' == s.back() || '\'' == s.back());
+  std::stringstream result;
+  for (size_t i = 1; i < s.length() - 1; ++i) {
+    if (s[i] == '\\') {
+      switch (s[++i]) {
+        case 'n':
+          result << '\n';
+          break;
+        case 'r':
+          result << '\r';
+          break;
+        case 't':
+          result << '\t';
+          break;
+        case '\'':
+        case '"':
+        case '\\':
+          result << s[i];
+          break;
+        default:
+          UNREACHABLE();
+      }
+    } else {
+      result << s[i];
+    }
+  }
+  return result.str();
+}
+
+}  // namespace
+
+LabelAndTypesVector AstGenerator::GetOptionalLabelAndTypeList(
+    TorqueParser::OptionalLabelListContext* context) {
+  LabelAndTypesVector labels;
+  if (context) {
+    for (auto* label : context->labelParameter()) {
+      LabelAndTypes new_label;
+      new_label.name = label->IDENTIFIER()->getSymbol()->getText();
+      if (label->typeList() != nullptr) {
+        for (auto* type : label->typeList()->type()) {
+          new_label.types.emplace_back(GetType(type));
+        }
+      }
+      labels.emplace_back(new_label);
+    }
+  }
+  return labels;
+}
+
+TypeExpression* AstGenerator::GetType(TorqueParser::TypeContext* context) {
+  if (context->BUILTIN()) {
+    ParameterList parameters = context->typeList()->accept(this);
+    TypeExpression* return_type = GetType(context->type(0));
+    return RegisterNode(
+        new FunctionTypeExpression(Pos(context), parameters, return_type));
+  } else if (context->BIT_OR()) {
+    return RegisterNode(new UnionTypeExpression(
+        Pos(context), GetType(context->type(0)), GetType(context->type(1))));
+  } else if (context->IDENTIFIER()) {
+    bool is_constexpr = context->CONSTEXPR() != nullptr;
+    std::string name = context->IDENTIFIER()->getSymbol()->getText();
+    return RegisterNode(
+        new BasicTypeExpression(Pos(context), is_constexpr, std::move(name)));
+  } else {
+    DCHECK_EQ(1, context->type().size());
+    return GetType(context->type(0));
+  }
+}
+
+TypeExpression* AstGenerator::GetOptionalType(
+    TorqueParser::OptionalTypeContext* context) {
+  if (!context->type())
+    return RegisterNode(new BasicTypeExpression(Pos(context), false, "void"));
+  return GetType(context->type());
+}
+
+std::vector<TypeExpression*> AstGenerator::GetTypeVector(
+    TorqueParser::TypeListContext* type_list) {
+  std::vector<TypeExpression*> result;
+  for (auto t : type_list->type()) {
+    result.push_back(GetType(t));
+  }
+  return result;
+}
+
+ParameterList AstGenerator::GetOptionalParameterList(
+    TorqueParser::ParameterListContext* context) {
+  if (context != nullptr) {
+    return context->accept(this).as<ParameterList>();
+  } else {
+    return ParameterList();
+  }
+}
+
+Statement* AstGenerator::GetOptionalHelperBody(
+    TorqueParser::HelperBodyContext* context) {
+  if (context) return context->accept(this).as<Statement*>();
+  return nullptr;
+}
+
+antlrcpp::Any AstGenerator::visitParameterList(
+    TorqueParser::ParameterListContext* context) {
+  ParameterList result{{}, {}, context->VARARGS(), {}};
+  if (context->VARARGS()) {
+    result.arguments_variable = context->IDENTIFIER()->getSymbol()->getText();
+  }
+  for (auto* parameter : context->parameter()) {
+    parameter->accept(this);
+    result.names.push_back(parameter->IDENTIFIER()->getSymbol()->getText());
+    result.types.push_back(GetType(parameter->type()));
+  }
+  return std::move(result);
+}
+
+antlrcpp::Any AstGenerator::visitTypeList(
+    TorqueParser::TypeListContext* context) {
+  ParameterList result{{}, {}, false, {}};
+  result.types = GetTypeVector(context);
+  return std::move(result);
+}
+
+antlrcpp::Any AstGenerator::visitTypeListMaybeVarArgs(
+    TorqueParser::TypeListMaybeVarArgsContext* context) {
+  ParameterList result{{}, {}, context->VARARGS(), {}};
+  result.types.reserve(context->type().size());
+  for (auto* type : context->type()) {
+    result.types.push_back(GetType(type));
+  }
+  return std::move(result);
+}
+
+antlrcpp::Any AstGenerator::visitModuleDeclaration(
+    TorqueParser::ModuleDeclarationContext* context) {
+  ModuleDeclaration* result = RegisterNode(new ExplicitModuleDeclaration{
+      Pos(context), context->IDENTIFIER()->getSymbol()->getText(), {}});
+  for (auto* declaration : context->declaration()) {
+    result->declarations.push_back(
+        declaration->accept(this).as<Declaration*>());
+  }
+  return implicit_cast<Declaration*>(result);
+}
+
+antlrcpp::Any AstGenerator::visitMacroDeclaration(
+    TorqueParser::MacroDeclarationContext* context) {
+  auto generic_parameters =
+      GetIdentifierVector(context->optionalGenericTypeList()->IDENTIFIER());
+  MacroDeclaration* macro = RegisterNode(new TorqueMacroDeclaration{
+      Pos(context), context->IDENTIFIER()->getSymbol()->getText(),
+      GetOptionalParameterList(context->parameterList()),
+      GetOptionalType(context->optionalType()),
+      GetOptionalLabelAndTypeList(context->optionalLabelList())});
+  if (auto* op = context->STRING_LITERAL()) {
+    macro->op = StringLiteralUnquote(op->getSymbol()->getText());
+  }
+  base::Optional<Statement*> body;
+  if (context->helperBody())
+    body = context->helperBody()->accept(this).as<Statement*>();
+  Declaration* result = nullptr;
+  if (generic_parameters.size() != 0) {
+    result = RegisterNode(
+        new GenericDeclaration{Pos(context), macro, generic_parameters, body});
+  } else {
+    if (!body) ReportError("A non-generic declaration needs a body.");
+    result = RegisterNode(new StandardDeclaration{Pos(context), macro, *body});
+  }
+  return result;
+}
+
+antlrcpp::Any AstGenerator::visitBuiltinDeclaration(
+    TorqueParser::BuiltinDeclarationContext* context) {
+  auto generic_parameters =
+      GetIdentifierVector(context->optionalGenericTypeList()->IDENTIFIER());
+  base::Optional<Statement*> body;
+  if (context->helperBody())
+    body = context->helperBody()->accept(this).as<Statement*>();
+
+  TorqueBuiltinDeclaration* builtin = RegisterNode(new TorqueBuiltinDeclaration{
+      Pos(context), context->JAVASCRIPT() != nullptr,
+      context->IDENTIFIER()->getSymbol()->getText(),
+      std::move(context->parameterList()->accept(this).as<ParameterList>()),
+      GetOptionalType(context->optionalType())});
+
+  Declaration* result = nullptr;
+  if (generic_parameters.size() != 0) {
+    result = RegisterNode(new GenericDeclaration{Pos(context), builtin,
+                                                 generic_parameters, body});
+  } else {
+    if (!body) ReportError("A non-generic declaration needs a body.");
+    result =
+        RegisterNode(new StandardDeclaration{Pos(context), builtin, *body});
+  }
+  return result;
+}
+
+antlrcpp::Any AstGenerator::visitExternalMacro(
+    TorqueParser::ExternalMacroContext* context) {
+  auto generic_parameters =
+      GetIdentifierVector(context->optionalGenericTypeList()->IDENTIFIER());
+  MacroDeclaration* macro = RegisterNode(new ExternalMacroDeclaration{
+      Pos(context),
+      context->IDENTIFIER()->getSymbol()->getText(),
+      {},
+      std::move(
+          context->typeListMaybeVarArgs()->accept(this).as<ParameterList>()),
+      GetOptionalType(context->optionalType()),
+      GetOptionalLabelAndTypeList(context->optionalLabelList())});
+  if (auto* op = context->STRING_LITERAL())
+    macro->op = StringLiteralUnquote(op->getSymbol()->getText());
+  Declaration* result = nullptr;
+  if (generic_parameters.size() != 0) {
+    result = RegisterNode(new GenericDeclaration{Pos(context), macro,
+                                                 generic_parameters, nullptr});
+  } else {
+    result =
+        RegisterNode(new StandardDeclaration{Pos(context), macro, nullptr});
+  }
+  return result;
+}
+
+antlrcpp::Any AstGenerator::visitExternalBuiltin(
+    TorqueParser::ExternalBuiltinContext* context) {
+  auto generic_parameters =
+      GetIdentifierVector(context->optionalGenericTypeList()->IDENTIFIER());
+  ExternalBuiltinDeclaration* builtin =
+      RegisterNode(new ExternalBuiltinDeclaration{
+          Pos(context), context->JAVASCRIPT() != nullptr,
+          context->IDENTIFIER()->getSymbol()->getText(),
+          std::move(context->typeList()->accept(this).as<ParameterList>()),
+          GetOptionalType(context->optionalType())});
+
+  Declaration* result = nullptr;
+  if (generic_parameters.size() != 0) {
+    result = RegisterNode(new GenericDeclaration{Pos(context), builtin,
+                                                 generic_parameters, nullptr});
+  } else {
+    result =
+        RegisterNode(new StandardDeclaration{Pos(context), builtin, nullptr});
+  }
+  return result;
+}
+
+antlrcpp::Any AstGenerator::visitExternalRuntime(
+    TorqueParser::ExternalRuntimeContext* context) {
+  ExternalRuntimeDeclaration* runtime =
+      RegisterNode(new ExternalRuntimeDeclaration{
+          Pos(context), context->IDENTIFIER()->getSymbol()->getText(),
+          std::move(context->typeListMaybeVarArgs()
+                        ->accept(this)
+                        .as<ParameterList>()),
+          GetOptionalType(context->optionalType())});
+  return implicit_cast<Declaration*>(
+      RegisterNode(new StandardDeclaration{Pos(context), runtime, nullptr}));
+}
+
+antlrcpp::Any AstGenerator::visitGenericSpecialization(
+    TorqueParser::GenericSpecializationContext* context) {
+  auto name = context->IDENTIFIER()->getSymbol()->getText();
+  auto specialization_parameters =
+      GetTypeVector(context->genericSpecializationTypeList()->typeList());
+  return implicit_cast<Declaration*>(RegisterNode(new SpecializationDeclaration{
+      Pos(context), name, false, specialization_parameters,
+      GetOptionalParameterList(context->parameterList()),
+      GetOptionalType(context->optionalType()),
+      GetOptionalLabelAndTypeList(context->optionalLabelList()),
+      context->helperBody()->accept(this).as<Statement*>()}));
+}
+
+antlrcpp::Any AstGenerator::visitExternConstDeclaration(
+    TorqueParser::ExternConstDeclarationContext* context) {
+  return implicit_cast<Declaration*>(RegisterNode(new ExternConstDeclaration{
+      Pos(context), context->IDENTIFIER()->getSymbol()->getText(),
+      GetType(context->type()),
+      StringLiteralUnquote(context->generatesDeclaration()
+                               ->STRING_LITERAL()
+                               ->getSymbol()
+                               ->getText())}));
+}
+
+antlrcpp::Any AstGenerator::visitTypeDeclaration(
+    TorqueParser::TypeDeclarationContext* context) {
+  TypeDeclaration* result = RegisterNode(new TypeDeclaration{
+      Pos(context), context->IDENTIFIER()->getSymbol()->getText(), {}, {}});
+  if (context->extendsDeclaration())
+    result->extends =
+        context->extendsDeclaration()->IDENTIFIER()->getSymbol()->getText();
+  if (context->generatesDeclaration()) {
+    result->generates = StringLiteralUnquote(context->generatesDeclaration()
+                                                 ->STRING_LITERAL()
+                                                 ->getSymbol()
+                                                 ->getText());
+  }
+  if (context->constexprDeclaration()) {
+    result->constexpr_generates =
+        StringLiteralUnquote(context->constexprDeclaration()
+                                 ->STRING_LITERAL()
+                                 ->getSymbol()
+                                 ->getText());
+  }
+  return implicit_cast<Declaration*>(result);
+}
+
+antlrcpp::Any AstGenerator::visitTypeAliasDeclaration(
+    TorqueParser::TypeAliasDeclarationContext* context) {
+  TypeAliasDeclaration* result = RegisterNode(new TypeAliasDeclaration{
+      Pos(context), context->IDENTIFIER()->getSymbol()->getText(),
+      GetType(context->type())});
+  return implicit_cast<Declaration*>(result);
+}
+
+antlrcpp::Any AstGenerator::visitVariableDeclaration(
+    TorqueParser::VariableDeclarationContext* context) {
+  return RegisterNode(
+      new VarDeclarationStatement{Pos(context),
+                                  context->IDENTIFIER()->getSymbol()->getText(),
+                                  GetType(context->type()),
+                                  {}});
+}
+
+antlrcpp::Any AstGenerator::visitVariableDeclarationWithInitialization(
+    TorqueParser::VariableDeclarationWithInitializationContext* context) {
+  VarDeclarationStatement* result =
+      VarDeclarationStatement::cast(context->variableDeclaration()
+                                        ->accept(this)
+                                        .as<VarDeclarationStatement*>());
+  result->pos = Pos(context);
+  if (context->expression())
+    result->initializer = context->expression()->accept(this).as<Expression*>();
+  return implicit_cast<Statement*>(result);
+}
+
+antlrcpp::Any AstGenerator::visitHelperCall(
+    TorqueParser::HelperCallContext* context) {
+  antlr4::tree::TerminalNode* callee;
+  bool is_operator = context->MIN() || context->MAX();
+  if (context->MIN()) callee = context->MIN();
+  if (context->MAX()) callee = context->MAX();
+  if (context->IDENTIFIER()) callee = context->IDENTIFIER();
+  std::vector<std::string> labels;
+  for (auto label : context->optionalOtherwise()->IDENTIFIER()) {
+    labels.push_back(label->getSymbol()->getText());
+  }
+  std::vector<TypeExpression*> templateArguments;
+  if (context->genericSpecializationTypeList()) {
+    templateArguments =
+        GetTypeVector(context->genericSpecializationTypeList()->typeList());
+  }
+  CallExpression* result =
+      RegisterNode(new CallExpression{Pos(context),
+                                      callee->getSymbol()->getText(),
+                                      is_operator,
+                                      templateArguments,
+                                      {},
+                                      labels});
+  for (auto* arg : context->argumentList()->argument()) {
+    result->arguments.push_back(arg->accept(this).as<Expression*>());
+  }
+  return implicit_cast<Expression*>(result);
+}
+
+antlrcpp::Any AstGenerator::visitHelperCallStatement(
+    TorqueParser::HelperCallStatementContext* context) {
+  Statement* result;
+  if (context->TAIL()) {
+    result = RegisterNode(new TailCallStatement{
+        Pos(context),
+        CallExpression::cast(
+            context->helperCall()->accept(this).as<Expression*>())});
+  } else {
+    result = RegisterNode(new ExpressionStatement{
+        Pos(context), context->helperCall()->accept(this).as<Expression*>()});
+  }
+  return result;
+}
+
+antlrcpp::Any AstGenerator::visitStatementScope(
+    TorqueParser::StatementScopeContext* context) {
+  BlockStatement* result = RegisterNode(
+      new BlockStatement{Pos(context), context->DEFERRED() != nullptr, {}});
+  for (auto* child : context->statementList()->statement()) {
+    result->statements.push_back(child->accept(this).as<Statement*>());
+  }
+  return implicit_cast<Statement*>(result);
+}
+
+antlrcpp::Any AstGenerator::visitExpressionStatement(
+    TorqueParser::ExpressionStatementContext* context) {
+  return implicit_cast<Statement*>(RegisterNode(new ExpressionStatement{
+      Pos(context), context->assignment()->accept(this).as<Expression*>()}));
+}
+
+antlrcpp::Any AstGenerator::visitReturnStatement(
+    TorqueParser::ReturnStatementContext* context) {
+  if (context->expression() != nullptr) {
+    return implicit_cast<Statement*>(RegisterNode(new ReturnStatement{
+        Pos(context), context->expression()->accept(this).as<Expression*>()}));
+  } else {
+    return implicit_cast<Statement*>(
+        RegisterNode(new ReturnStatement{Pos(context), {}}));
+  }
+}
+
+antlrcpp::Any AstGenerator::visitBreakStatement(
+    TorqueParser::BreakStatementContext* context) {
+  return implicit_cast<Statement*>(
+      RegisterNode(new BreakStatement{Pos(context)}));
+}
+
+antlrcpp::Any AstGenerator::visitContinueStatement(
+    TorqueParser::ContinueStatementContext* context) {
+  return implicit_cast<Statement*>(
+      RegisterNode(new ContinueStatement{Pos(context)}));
+}
+
+antlrcpp::Any AstGenerator::visitGotoStatement(
+    TorqueParser::GotoStatementContext* context) {
+  GotoStatement* result = RegisterNode(new GotoStatement{Pos(context), {}, {}});
+  if (context->labelReference())
+    result->label =
+        context->labelReference()->IDENTIFIER()->getSymbol()->getText();
+  if (context->argumentList() != nullptr) {
+    for (auto a : context->argumentList()->argument()) {
+      result->arguments.push_back(a->accept(this).as<Expression*>());
+    }
+  }
+  return implicit_cast<Statement*>(result);
+}
+
+antlrcpp::Any AstGenerator::visitIfStatement(
+    TorqueParser::IfStatementContext* context) {
+  IfStatement* result = RegisterNode(new IfStatement{
+      Pos(context),
+      std::move(context->expression()->accept(this).as<Expression*>()),
+      context->CONSTEXPR() != nullptr,
+      std::move(context->statementBlock(0)->accept(this).as<Statement*>()),
+      {}});
+  if (context->statementBlock(1))
+    result->if_false =
+        std::move(context->statementBlock(1)->accept(this).as<Statement*>());
+  return implicit_cast<Statement*>(result);
+}
+
+antlrcpp::Any AstGenerator::visitWhileLoop(
+    TorqueParser::WhileLoopContext* context) {
+  return implicit_cast<Statement*>(RegisterNode(new WhileStatement{
+      Pos(context), context->expression()->accept(this).as<Expression*>(),
+      context->statementBlock()->accept(this).as<Statement*>()}));
+}
+
+antlrcpp::Any AstGenerator::visitForLoop(
+    TorqueParser::ForLoopContext* context) {
+  ForLoopStatement* result = RegisterNode(new ForLoopStatement{
+      Pos(context),
+      {},
+      context->expression()->accept(this).as<Expression*>(),
+      context->assignment()->accept(this).as<Expression*>(),
+      context->statementBlock()->accept(this).as<Statement*>()});
+  if (auto* init = context->forInitialization()
+                       ->variableDeclarationWithInitialization()) {
+    result->var_declaration =
+        VarDeclarationStatement::cast(init->accept(this).as<Statement*>());
+  }
+  return implicit_cast<Statement*>(result);
+}
+
+antlrcpp::Any AstGenerator::visitForOfLoop(
+    TorqueParser::ForOfLoopContext* context) {
+  ForOfLoopStatement* result = RegisterNode(new ForOfLoopStatement{
+      Pos(context),
+      context->variableDeclaration()
+          ->accept(this)
+          .as<VarDeclarationStatement*>(),
+      context->expression()->accept(this).as<Expression*>(),
+      {},
+      {},
+      context->statementBlock()->accept(this).as<Statement*>()});
+  if (auto* range = context->forOfRange()->rangeSpecifier()) {
+    if (auto* begin = range->begin) {
+      result->begin = begin->accept(this).as<Expression*>();
+    }
+    if (auto* end = range->end) {
+      result->end = end->accept(this).as<Expression*>();
+    }
+  }
+  return implicit_cast<Statement*>(result);
+}
+
+antlrcpp::Any AstGenerator::visitTryLabelStatement(
+    TorqueParser::TryLabelStatementContext* context) {
+  TryLabelStatement* result = RegisterNode(new TryLabelStatement{
+      Pos(context), context->statementBlock()->accept(this).as<Statement*>()});
+  for (auto* handler : context->handlerWithStatement()) {
+    handler->labelDeclaration()->accept(this);
+    auto parameter_list = handler->labelDeclaration()->parameterList();
+    ParameterList label_parameters = parameter_list == nullptr
+                                         ? ParameterList()
+                                         : handler->labelDeclaration()
+                                               ->parameterList()
+                                               ->accept(this)
+                                               .as<ParameterList>();
+    LabelBlock* label_block = RegisterNode(new LabelBlock{
+        Pos(handler->statementBlock()),
+        handler->labelDeclaration()->IDENTIFIER()->getSymbol()->getText(),
+        label_parameters,
+        handler->statementBlock()->accept(this).as<Statement*>()});
+    result->label_blocks.push_back(label_block);
+  }
+  return implicit_cast<Statement*>(result);
+}
+
+antlrcpp::Any AstGenerator::visitPrimaryExpression(
+    TorqueParser::PrimaryExpressionContext* context) {
+  if (auto* e = context->helperCall()) return e->accept(this);
+  if (auto* e = context->DECIMAL_LITERAL())
+    return implicit_cast<Expression*>(RegisterNode(
+        new NumberLiteralExpression{Pos(context), e->getSymbol()->getText()}));
+  if (auto* e = context->STRING_LITERAL())
+    return implicit_cast<Expression*>(RegisterNode(
+        new StringLiteralExpression{Pos(context), e->getSymbol()->getText()}));
+  return context->expression()->accept(this);
+}
+
+antlrcpp::Any AstGenerator::visitAssignment(
+    TorqueParser::AssignmentContext* context) {
+  if (auto* e = context->incrementDecrement()) return e->accept(this);
+  LocationExpression* location = LocationExpression::cast(
+      context->locationExpression()->accept(this).as<Expression*>());
+  if (auto* e = context->expression()) {
+    AssignmentExpression* result = RegisterNode(new AssignmentExpression{
+        Pos(context), location, {}, e->accept(this).as<Expression*>()});
+    if (auto* op_node = context->ASSIGNMENT_OPERATOR()) {
+      std::string op = op_node->getSymbol()->getText();
+      result->op = op.substr(0, op.length() - 1);
+    }
+    return implicit_cast<Expression*>(result);
+  }
+  return implicit_cast<Expression*>(location);
+}
+
+antlrcpp::Any AstGenerator::visitIncrementDecrement(
+    TorqueParser::IncrementDecrementContext* context) {
+  bool postfix = context->op;
+  return implicit_cast<Expression*>(
+      RegisterNode(new IncrementDecrementExpression{
+          Pos(context),
+          LocationExpression::cast(
+              context->locationExpression()->accept(this).as<Expression*>()),
+          context->INCREMENT() ? IncrementDecrementOperator::kIncrement
+                               : IncrementDecrementOperator::kDecrement,
+          postfix}));
+}
+
+antlrcpp::Any AstGenerator::visitLocationExpression(
+    TorqueParser::LocationExpressionContext* context) {
+  if (auto* l = context->locationExpression()) {
+    Expression* location = l->accept(this).as<Expression*>();
+    if (auto* e = context->expression()) {
+      return implicit_cast<Expression*>(
+          RegisterNode(new ElementAccessExpression{
+              Pos(context), location, e->accept(this).as<Expression*>()}));
+    }
+    return implicit_cast<Expression*>(RegisterNode(new FieldAccessExpression{
+        Pos(context), location,
+        context->IDENTIFIER()->getSymbol()->getText()}));
+  }
+  std::vector<TypeExpression*> templateArguments;
+  if (context->genericSpecializationTypeList()) {
+    templateArguments =
+        GetTypeVector(context->genericSpecializationTypeList()->typeList());
+  }
+  return implicit_cast<Expression*>(RegisterNode(new IdentifierExpression{
+      Pos(context), context->IDENTIFIER()->getSymbol()->getText(),
+      std::move(templateArguments)}));
+}
+
+antlrcpp::Any AstGenerator::visitUnaryExpression(
+    TorqueParser::UnaryExpressionContext* context) {
+  if (auto* e = context->assignmentExpression()) return e->accept(this);
+  std::vector<Expression*> args;
+  args.push_back(context->unaryExpression()->accept(this).as<Expression*>());
+  return implicit_cast<Expression*>(RegisterNode(new CallExpression{
+      Pos(context), context->op->getText(), true, {}, std::move(args), {}}));
+}
+
+antlrcpp::Any AstGenerator::visitMultiplicativeExpression(
+    TorqueParser::MultiplicativeExpressionContext* context) {
+  auto* right = context->unaryExpression();
+  if (auto* left = context->multiplicativeExpression()) {
+    return implicit_cast<Expression*>(
+        RegisterNode(new CallExpression{Pos(context),
+                                        context->op->getText(),
+                                        true,
+                                        {},
+                                        {left->accept(this).as<Expression*>(),
+                                         right->accept(this).as<Expression*>()},
+                                        {}}));
+  }
+  return right->accept(this);
+}
+
+antlrcpp::Any AstGenerator::visitAdditiveExpression(
+    TorqueParser::AdditiveExpressionContext* context) {
+  auto* right = context->multiplicativeExpression();
+  if (auto* left = context->additiveExpression()) {
+    return implicit_cast<Expression*>(
+        RegisterNode(new CallExpression{Pos(context),
+                                        context->op->getText(),
+                                        true,
+                                        {},
+                                        {left->accept(this).as<Expression*>(),
+                                         right->accept(this).as<Expression*>()},
+                                        {}}));
+  }
+  return right->accept(this);
+}
+
+antlrcpp::Any AstGenerator::visitShiftExpression(
+    TorqueParser::ShiftExpressionContext* context) {
+  auto* right = context->additiveExpression();
+  if (auto* left = context->shiftExpression()) {
+    return implicit_cast<Expression*>(
+        RegisterNode(new CallExpression{Pos(context),
+                                        context->op->getText(),
+                                        true,
+                                        {},
+                                        {left->accept(this).as<Expression*>(),
+                                         right->accept(this).as<Expression*>()},
+                                        {}}));
+  }
+  return right->accept(this);
+}
+
+antlrcpp::Any AstGenerator::visitRelationalExpression(
+    TorqueParser::RelationalExpressionContext* context) {
+  auto* right = context->shiftExpression();
+  if (auto* left = context->relationalExpression()) {
+    return implicit_cast<Expression*>(
+        RegisterNode(new CallExpression{Pos(context),
+                                        context->op->getText(),
+                                        true,
+                                        {},
+                                        {left->accept(this).as<Expression*>(),
+                                         right->accept(this).as<Expression*>()},
+                                        {}}));
+  }
+  return right->accept(this);
+}
+
+antlrcpp::Any AstGenerator::visitEqualityExpression(
+    TorqueParser::EqualityExpressionContext* context) {
+  auto* right = context->relationalExpression();
+  if (auto* left = context->equalityExpression()) {
+    return implicit_cast<Expression*>(
+        RegisterNode(new CallExpression{Pos(context),
+                                        context->op->getText(),
+                                        true,
+                                        {},
+                                        {left->accept(this).as<Expression*>(),
+                                         right->accept(this).as<Expression*>()},
+                                        {}}));
+  }
+  return right->accept(this);
+}
+
+antlrcpp::Any AstGenerator::visitBitwiseExpression(
+    TorqueParser::BitwiseExpressionContext* context) {
+  auto* right = context->equalityExpression();
+  if (auto* left = context->bitwiseExpression()) {
+    return implicit_cast<Expression*>(
+        RegisterNode(new CallExpression{Pos(context),
+                                        context->op->getText(),
+                                        true,
+                                        {},
+                                        {left->accept(this).as<Expression*>(),
+                                         right->accept(this).as<Expression*>()},
+                                        {}}));
+  }
+  return right->accept(this);
+}
+
+antlrcpp::Any AstGenerator::visitLogicalANDExpression(
+    TorqueParser::LogicalANDExpressionContext* context) {
+  auto* right = context->bitwiseExpression();
+  if (auto* left = context->logicalANDExpression()) {
+    return implicit_cast<Expression*>(RegisterNode(new LogicalAndExpression{
+        Pos(context), left->accept(this).as<Expression*>(),
+        right->accept(this).as<Expression*>()}));
+  }
+  return right->accept(this);
+}
+
+antlrcpp::Any AstGenerator::visitLogicalORExpression(
+    TorqueParser::LogicalORExpressionContext* context) {
+  auto* right = context->logicalANDExpression();
+  if (auto* left = context->logicalORExpression()) {
+    return implicit_cast<Expression*>(RegisterNode(new LogicalOrExpression{
+        Pos(context), left->accept(this).as<Expression*>(),
+        right->accept(this).as<Expression*>()}));
+  }
+  return right->accept(this);
+}
+
+antlrcpp::Any AstGenerator::visitConditionalExpression(
+    TorqueParser::ConditionalExpressionContext* context) {
+  if (auto* condition = context->conditionalExpression()) {
+    return implicit_cast<Expression*>(RegisterNode(new ConditionalExpression{
+        Pos(context), condition->accept(this).as<Expression*>(),
+        context->logicalORExpression(0)->accept(this).as<Expression*>(),
+        context->logicalORExpression(1)->accept(this).as<Expression*>()}));
+  }
+  return context->logicalORExpression(0)->accept(this);
+}
+
+antlrcpp::Any AstGenerator::visitDiagnosticStatement(
+    TorqueParser::DiagnosticStatementContext* context) {
+  if (context->ASSERT_TOKEN() || context->CHECK_TOKEN()) {
+    size_t a = context->expression()->start->getStartIndex();
+    size_t b = context->expression()->stop->getStopIndex();
+    antlr4::misc::Interval interval(a, b);
+    std::string source = source_file_context_->stream->getText(interval);
+    return implicit_cast<Statement*>(RegisterNode(new AssertStatement{
+        Pos(context), context->ASSERT_TOKEN() != nullptr,
+        context->expression()->accept(this).as<Expression*>(), source}));
+  } else if (context->UNREACHABLE_TOKEN()) {
+    return implicit_cast<Statement*>(
+        RegisterNode(new DebugStatement{Pos(context), "unreachable", true}));
+  } else {
+    DCHECK(context->DEBUG_TOKEN());
+    return implicit_cast<Statement*>(
+        RegisterNode(new DebugStatement{Pos(context), "debug", false}));
+  }
+}
+
+void AstGenerator::visitSourceFile(SourceFileContext* context) {
+  source_file_context_ = context;
+  current_source_file_ = SourceFileMap::Get().AddSource(context->name);
+  for (auto* declaration : context->file->children) {
+    ast_.declarations().push_back(declaration->accept(this).as<Declaration*>());
+  }
+  source_file_context_ = nullptr;
+}
+
+SourcePosition AstGenerator::Pos(antlr4::ParserRuleContext* context) {
+  antlr4::misc::Interval i = context->getSourceInterval();
+  auto token = source_file_context_->tokens->get(i.a);
+  int line = static_cast<int>(token->getLine());
+  int column = static_cast<int>(token->getCharPositionInLine());
+  return SourcePosition{current_source_file_, line, column};
+}
+
+}  // namespace torque
+}  // namespace internal
+}  // namespace v8
diff --git a/deps/v8/src/torque/ast-generator.h b/deps/v8/src/torque/ast-generator.h
new file mode 100644
index 00000000000000..9ec6f3d6ecf305
--- /dev/null
+++ b/deps/v8/src/torque/ast-generator.h
@@ -0,0 +1,189 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef V8_TORQUE_AST_GENERATOR_H_
+#define V8_TORQUE_AST_GENERATOR_H_
+
+#include "src/torque/TorqueBaseVisitor.h"
+#include "src/torque/ast.h"
+#include "src/torque/global-context.h"
+
+namespace v8 {
+namespace internal {
+namespace torque {
+
+class AstGenerator : public TorqueBaseVisitor {
+ public:
+  antlrcpp::Any visitParameterList(
+      TorqueParser::ParameterListContext* context) override;
+
+  antlrcpp::Any visitTypeList(TorqueParser::TypeListContext* context) override;
+
+  antlrcpp::Any visitTypeListMaybeVarArgs(
+      TorqueParser::TypeListMaybeVarArgsContext* context) override;
+
+  antlrcpp::Any visitModuleDeclaration(
+      TorqueParser::ModuleDeclarationContext* context) override;
+
+  antlrcpp::Any visitMacroDeclaration(
+      TorqueParser::MacroDeclarationContext* context) override;
+
+  antlrcpp::Any visitBuiltinDeclaration(
+      TorqueParser::BuiltinDeclarationContext* context) override;
+
+  antlrcpp::Any visitExternalMacro(
+      TorqueParser::ExternalMacroContext* context) override;
+
+  antlrcpp::Any visitExternalBuiltin(
+      TorqueParser::ExternalBuiltinContext* context) override;
+
+  antlrcpp::Any visitExternalRuntime(
+      TorqueParser::ExternalRuntimeContext* context) override;
+
+  antlrcpp::Any visitGenericSpecialization(
+      TorqueParser::GenericSpecializationContext* context) override;
+
+  antlrcpp::Any visitExternConstDeclaration(
+      TorqueParser::ExternConstDeclarationContext* context) override;
+
+  antlrcpp::Any visitTypeDeclaration(
+      TorqueParser::TypeDeclarationContext* context) override;
+
+  antlrcpp::Any visitTypeAliasDeclaration(
+      TorqueParser::TypeAliasDeclarationContext* context) override;
+
+  antlrcpp::Any visitVariableDeclaration(
+      TorqueParser::VariableDeclarationContext* context) override;
+
+  antlrcpp::Any visitVariableDeclarationWithInitialization(
+      TorqueParser::VariableDeclarationWithInitializationContext* context)
+      override;
+
+  antlrcpp::Any visitHelperCall(
+      TorqueParser::HelperCallContext* context) override;
+
+  antlrcpp::Any visitHelperCallStatement(
+      TorqueParser::HelperCallStatementContext* context) override;
+
+  antlrcpp::Any visitConditionalExpression(
+      TorqueParser::ConditionalExpressionContext* context) override;
+
+  antlrcpp::Any visitLogicalORExpression(
+      TorqueParser::LogicalORExpressionContext* context) override;
+
+  antlrcpp::Any visitLogicalANDExpression(
+      TorqueParser::LogicalANDExpressionContext* context) override;
+
+  antlrcpp::Any visitBitwiseExpression(
+      TorqueParser::BitwiseExpressionContext* context) override;
+
+  antlrcpp::Any visitEqualityExpression(
+      TorqueParser::EqualityExpressionContext* context) override;
+
+  antlrcpp::Any visitRelationalExpression(
+      TorqueParser::RelationalExpressionContext* context) override;
+
+  antlrcpp::Any visitShiftExpression(
+      TorqueParser::ShiftExpressionContext* context) override;
+
+  antlrcpp::Any visitAdditiveExpression(
+      TorqueParser::AdditiveExpressionContext* context) override;
+
+  antlrcpp::Any visitMultiplicativeExpression(
+      TorqueParser::MultiplicativeExpressionContext* context) override;
+
+  antlrcpp::Any visitUnaryExpression(
+      TorqueParser::UnaryExpressionContext* context) override;
+
+  antlrcpp::Any visitLocationExpression(
+      TorqueParser::LocationExpressionContext* locationExpression) override;
+
+  antlrcpp::Any visitIncrementDecrement(
+      TorqueParser::IncrementDecrementContext* context) override;
+
+  antlrcpp::Any visitAssignment(
+      TorqueParser::AssignmentContext* context) override;
+
+  antlrcpp::Any visitPrimaryExpression(
+      TorqueParser::PrimaryExpressionContext* context) override;
+
+  antlrcpp::Any visitTryLabelStatement(
+      TorqueParser::TryLabelStatementContext* context) override;
+
+  antlrcpp::Any visitStatementScope(
+      TorqueParser::StatementScopeContext* context) override;
+
+  antlrcpp::Any visitExpressionStatement(
+      TorqueParser::ExpressionStatementContext* context) override;
+
+  antlrcpp::Any visitReturnStatement(
+      TorqueParser::ReturnStatementContext* context) override;
+
+  antlrcpp::Any visitGotoStatement(
+      TorqueParser::GotoStatementContext* context) override;
+
+  antlrcpp::Any visitIfStatement(
+      TorqueParser::IfStatementContext* context) override;
+
+  antlrcpp::Any visitWhileLoop(
+      TorqueParser::WhileLoopContext* context) override;
+
+  antlrcpp::Any visitBreakStatement(
+      TorqueParser::BreakStatementContext* context) override;
+
+  antlrcpp::Any visitContinueStatement(
+      TorqueParser::ContinueStatementContext* context) override;
+
+  antlrcpp::Any visitForLoop(TorqueParser::ForLoopContext* context) override;
+
+  antlrcpp::Any visitForOfLoop(
+      TorqueParser::ForOfLoopContext* context) override;
+
+  antlrcpp::Any visitDiagnosticStatement(
+      TorqueParser::DiagnosticStatementContext* context) override;
+
+  antlrcpp::Any aggregateResult(antlrcpp::Any aggregate,
+                                const antlrcpp::Any& nextResult) override {
+    if (aggregate.isNull())
+      return std::move(const_cast<antlrcpp::Any&>(nextResult));
+    if (nextResult.isNull()) return aggregate;
+    UNREACHABLE();
+    return {};
+  }
+
+  template <class T>
+  T* RegisterNode(T* node) {
+    ast_.AddNode(std::unique_ptr<AstNode>(node));
+    return node;
+  }
+
+  LabelAndTypesVector GetOptionalLabelAndTypeList(
+      TorqueParser::OptionalLabelListContext* context);
+  TypeExpression* GetType(TorqueParser::TypeContext* context);
+  TypeExpression* GetOptionalType(TorqueParser::OptionalTypeContext* context);
+  std::vector<TypeExpression*> GetTypeVector(
+      TorqueParser::TypeListContext* type_list);
+
+  ParameterList GetOptionalParameterList(
+      TorqueParser::ParameterListContext* context);
+
+  Statement* GetOptionalHelperBody(TorqueParser::HelperBodyContext* context);
+
+  void visitSourceFile(SourceFileContext* context);
+
+  SourcePosition Pos(antlr4::ParserRuleContext* context);
+
+  Ast GetAst() && { return std::move(ast_); }
+
+ private:
+  Ast ast_;
+  SourceId current_source_file_;
+  SourceFileContext* source_file_context_;
+};
+
+}  // namespace torque
+}  // namespace internal
+}  // namespace v8
+
+#endif  // V8_TORQUE_AST_GENERATOR_H_
diff --git a/deps/v8/src/torque/ast.h b/deps/v8/src/torque/ast.h
new file mode 100644
index 00000000000000..216d8843f3310e
--- /dev/null
+++ b/deps/v8/src/torque/ast.h
@@ -0,0 +1,701 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef V8_TORQUE_AST_H_
+#define V8_TORQUE_AST_H_
+
+#include <iostream>
+#include <memory>
+#include <string>
+#include <vector>
+
+#include "src/base/optional.h"
+#include "src/torque/contextual.h"
+
+namespace v8 {
+namespace internal {
+namespace torque {
+
+enum class SourceId : int {};
+
+struct SourcePosition {
+  SourceId source;
+  int line;
+  int column;
+};
+
+DECLARE_CONTEXTUAL_VARIABLE(CurrentSourcePosition, SourcePosition)
+
+#define AST_EXPRESSION_NODE_KIND_LIST(V) \
+  V(CallExpression)                      \
+  V(LogicalOrExpression)                 \
+  V(LogicalAndExpression)                \
+  V(ConditionalExpression)               \
+  V(IdentifierExpression)                \
+  V(StringLiteralExpression)             \
+  V(NumberLiteralExpression)             \
+  V(FieldAccessExpression)               \
+  V(ElementAccessExpression)             \
+  V(AssignmentExpression)                \
+  V(IncrementDecrementExpression)
+
+#define AST_TYPE_EXPRESSION_NODE_KIND_LIST(V) \
+  V(BasicTypeExpression)                      \
+  V(FunctionTypeExpression)                   \
+  V(UnionTypeExpression)
+
+#define AST_STATEMENT_NODE_KIND_LIST(V) \
+  V(BlockStatement)                     \
+  V(ExpressionStatement)                \
+  V(IfStatement)                        \
+  V(WhileStatement)                     \
+  V(ForLoopStatement)                   \
+  V(ForOfLoopStatement)                 \
+  V(BreakStatement)                     \
+  V(ContinueStatement)                  \
+  V(ReturnStatement)                    \
+  V(DebugStatement)                     \
+  V(AssertStatement)                    \
+  V(TailCallStatement)                  \
+  V(VarDeclarationStatement)            \
+  V(GotoStatement)                      \
+  V(TryLabelStatement)
+
+#define AST_DECLARATION_NODE_KIND_LIST(V) \
+  V(TypeDeclaration)                      \
+  V(TypeAliasDeclaration)                 \
+  V(StandardDeclaration)                  \
+  V(GenericDeclaration)                   \
+  V(SpecializationDeclaration)            \
+  V(ExternConstDeclaration)               \
+  V(DefaultModuleDeclaration)             \
+  V(ExplicitModuleDeclaration)
+
+#define AST_CALLABLE_NODE_KIND_LIST(V) \
+  V(TorqueMacroDeclaration)            \
+  V(TorqueBuiltinDeclaration)          \
+  V(ExternalMacroDeclaration)          \
+  V(ExternalBuiltinDeclaration)        \
+  V(ExternalRuntimeDeclaration)
+
+#define AST_NODE_KIND_LIST(V)           \
+  AST_EXPRESSION_NODE_KIND_LIST(V)      \
+  AST_TYPE_EXPRESSION_NODE_KIND_LIST(V) \
+  AST_STATEMENT_NODE_KIND_LIST(V)       \
+  AST_DECLARATION_NODE_KIND_LIST(V)     \
+  AST_CALLABLE_NODE_KIND_LIST(V)        \
+  V(LabelBlock)
+
+struct AstNode {
+ public:
+  enum class Kind {
+#define ENUM_ITEM(name) k##name,
+    AST_NODE_KIND_LIST(ENUM_ITEM)
+#undef ENUM_ITEM
+  };
+
+  AstNode(Kind k, SourcePosition p) : kind(k), pos(p) {}
+  virtual ~AstNode() {}
+
+  const Kind kind;
+  SourcePosition pos;
+};
+
+struct AstNodeClassCheck {
+  template <class T>
+  static bool IsInstanceOf(AstNode* node);
+};
+
+// Boilerplate for most derived classes.
+#define DEFINE_AST_NODE_LEAF_BOILERPLATE(T)                        \
+  static const Kind kKind = Kind::k##T;                            \
+  static T* cast(AstNode* node) {                                  \
+    if (node->kind != kKind) return nullptr;                       \
+    return static_cast<T*>(node);                                  \
+  }                                                                \
+  static T* DynamicCast(AstNode* node) {                           \
+    if (!node) return nullptr;                                     \
+    if (!AstNodeClassCheck::IsInstanceOf<T>(node)) return nullptr; \
+    return static_cast<T*>(node);                                  \
+  }
+
+// Boilerplate for classes with subclasses.
+#define DEFINE_AST_NODE_INNER_BOILERPLATE(T)                       \
+  static T* cast(AstNode* node) {                                  \
+    DCHECK(AstNodeClassCheck::IsInstanceOf<T>(node));              \
+    return static_cast<T*>(node);                                  \
+  }                                                                \
+  static T* DynamicCast(AstNode* node) {                           \
+    if (!node) return nullptr;                                     \
+    if (!AstNodeClassCheck::IsInstanceOf<T>(node)) return nullptr; \
+    return static_cast<T*>(node);                                  \
+  }
+
+struct Expression : AstNode {
+  Expression(Kind k, SourcePosition p) : AstNode(k, p) {}
+  DEFINE_AST_NODE_INNER_BOILERPLATE(Expression)
+};
+
+struct LocationExpression : Expression {
+  LocationExpression(Kind k, SourcePosition p) : Expression(k, p) {}
+  DEFINE_AST_NODE_INNER_BOILERPLATE(LocationExpression)
+};
+
+struct TypeExpression : AstNode {
+  TypeExpression(Kind k, SourcePosition p) : AstNode(k, p) {}
+  DEFINE_AST_NODE_INNER_BOILERPLATE(TypeExpression)
+};
+
+struct Declaration : AstNode {
+  Declaration(Kind k, SourcePosition p) : AstNode(k, p) {}
+  DEFINE_AST_NODE_INNER_BOILERPLATE(Declaration)
+};
+
+struct Statement : AstNode {
+  Statement(Kind k, SourcePosition p) : AstNode(k, p) {}
+  DEFINE_AST_NODE_INNER_BOILERPLATE(Statement)
+};
+
+class Module;
+
+struct ModuleDeclaration : Declaration {
+  ModuleDeclaration(AstNode::Kind kind, SourcePosition p,
+                    std::vector<Declaration*> d)
+      : Declaration(kind, p), module(nullptr), declarations(std::move(d)) {}
+  virtual bool IsDefault() const = 0;
+  //  virtual std::string GetName() const = 0;
+  void SetModule(Module* m) { module = m; }
+  Module* GetModule() const { return module; }
+  Module* module;
+  std::vector<Declaration*> declarations;
+};
+
+struct DefaultModuleDeclaration : ModuleDeclaration {
+  DEFINE_AST_NODE_LEAF_BOILERPLATE(DefaultModuleDeclaration)
+  DefaultModuleDeclaration(SourcePosition p, std::vector<Declaration*> d)
+      : ModuleDeclaration(kKind, p, d) {}
+  bool IsDefault() const override { return true; }
+};
+
+struct ExplicitModuleDeclaration : ModuleDeclaration {
+  DEFINE_AST_NODE_LEAF_BOILERPLATE(ExplicitModuleDeclaration)
+  ExplicitModuleDeclaration(SourcePosition p, std::string n,
+                            std::vector<Declaration*> d)
+      : ModuleDeclaration(kKind, p, d), name(std::move(n)) {}
+  bool IsDefault() const override { return false; }
+  std::string name;
+};
+
+class SourceFileMap : public ContextualClass<SourceFileMap> {
+ public:
+  SourceFileMap() {}
+  const std::string& GetSource(SourceId id) const {
+    return sources_[static_cast<int>(id)];
+  }
+
+  std::string PositionAsString(SourcePosition pos) {
+    return GetSource(pos.source) + ":" + std::to_string(pos.line) + ":" +
+           std::to_string(pos.column);
+  }
+
+  SourceId AddSource(std::string path) {
+    sources_.push_back(std::move(path));
+    return static_cast<SourceId>(sources_.size() - 1);
+  }
+
+ private:
+  std::vector<std::string> sources_;
+};
+
+inline std::string PositionAsString(SourcePosition pos) {
+  return SourceFileMap::Get().PositionAsString(pos);
+}
+
+class Ast {
+ public:
+  Ast() : default_module_{SourcePosition(), {}} {}
+
+  std::vector<Declaration*>& declarations() {
+    return default_module_.declarations;
+  }
+  const std::vector<Declaration*>& declarations() const {
+    return default_module_.declarations;
+  }
+  void AddNode(std::unique_ptr<AstNode> node) {
+    nodes_.emplace_back(std::move(node));
+  }
+  DefaultModuleDeclaration* default_module() { return &default_module_; }
+
+ private:
+  DefaultModuleDeclaration default_module_;
+  std::vector<std::unique_ptr<AstNode>> nodes_;
+};
+
+struct IdentifierExpression : LocationExpression {
+  DEFINE_AST_NODE_LEAF_BOILERPLATE(IdentifierExpression)
+  IdentifierExpression(SourcePosition p, std::string n,
+                       std::vector<TypeExpression*> args)
+      : LocationExpression(kKind, p),
+        name(std::move(n)),
+        generic_arguments(std::move(args)) {}
+  std::string name;
+  std::vector<TypeExpression*> generic_arguments;
+};
+
+struct CallExpression : Expression {
+  DEFINE_AST_NODE_LEAF_BOILERPLATE(CallExpression)
+  CallExpression(SourcePosition p, std::string c, bool o,
+                 std::vector<TypeExpression*> ga, std::vector<Expression*> a,
+                 std::vector<std::string> l)
+      : Expression(kKind, p),
+        callee(p, std::move(c), std::move(ga)),
+        is_operator(o),
+        arguments(std::move(a)),
+        labels(l) {}
+  IdentifierExpression callee;
+  bool is_operator;
+  std::vector<Expression*> arguments;
+  std::vector<std::string> labels;
+};
+
+struct LogicalOrExpression : Expression {
+  DEFINE_AST_NODE_LEAF_BOILERPLATE(LogicalOrExpression)
+  LogicalOrExpression(SourcePosition p, Expression* l, Expression* r)
+      : Expression(kKind, p), left(l), right(r) {}
+  Expression* left;
+  Expression* right;
+};
+
+struct LogicalAndExpression : Expression {
+  DEFINE_AST_NODE_LEAF_BOILERPLATE(LogicalAndExpression)
+  LogicalAndExpression(SourcePosition p, Expression* l, Expression* r)
+      : Expression(kKind, p), left(l), right(r) {}
+  Expression* left;
+  Expression* right;
+};
+
+struct ConditionalExpression : Expression {
+  DEFINE_AST_NODE_LEAF_BOILERPLATE(ConditionalExpression)
+  ConditionalExpression(SourcePosition p, Expression* c, Expression* t,
+                        Expression* f)
+      : Expression(kKind, p), condition(c), if_true(t), if_false(f) {}
+  Expression* condition;
+  Expression* if_true;
+  Expression* if_false;
+};
+
+struct StringLiteralExpression : Expression {
+  DEFINE_AST_NODE_LEAF_BOILERPLATE(StringLiteralExpression)
+  StringLiteralExpression(SourcePosition p, std::string l)
+      : Expression(kKind, p), literal(std::move(l)) {}
+  std::string literal;
+};
+
+struct NumberLiteralExpression : Expression {
+  DEFINE_AST_NODE_LEAF_BOILERPLATE(NumberLiteralExpression)
+  NumberLiteralExpression(SourcePosition p, std::string n)
+      : Expression(kKind, p), number(std::move(n)) {}
+  std::string number;
+};
+
+struct ElementAccessExpression : LocationExpression {
+  DEFINE_AST_NODE_LEAF_BOILERPLATE(ElementAccessExpression)
+  ElementAccessExpression(SourcePosition p, Expression* a, Expression* i)
+      : LocationExpression(kKind, p), array(a), index(i) {}
+  Expression* array;
+  Expression* index;
+};
+
+struct FieldAccessExpression : LocationExpression {
+  DEFINE_AST_NODE_LEAF_BOILERPLATE(FieldAccessExpression)
+  FieldAccessExpression(SourcePosition p, Expression* o, std::string f)
+      : LocationExpression(kKind, p), object(o), field(std::move(f)) {}
+  Expression* object;
+  std::string field;
+};
+
+struct AssignmentExpression : Expression {
+  DEFINE_AST_NODE_LEAF_BOILERPLATE(AssignmentExpression)
+  AssignmentExpression(SourcePosition p, LocationExpression* l,
+                       base::Optional<std::string> o, Expression* v)
+      : Expression(kKind, p), location(l), op(std::move(o)), value(v) {}
+  LocationExpression* location;
+  base::Optional<std::string> op;
+  Expression* value;
+};
+
+enum class IncrementDecrementOperator { kIncrement, kDecrement };
+
+struct IncrementDecrementExpression : Expression {
+  DEFINE_AST_NODE_LEAF_BOILERPLATE(IncrementDecrementExpression)
+  IncrementDecrementExpression(SourcePosition p, LocationExpression* l,
+                               IncrementDecrementOperator o, bool pf)
+      : Expression(kKind, p), location(l), op(o), postfix(pf) {}
+  LocationExpression* location;
+  IncrementDecrementOperator op;
+  bool postfix;
+};
+
+struct ParameterList {
+  std::vector<std::string> names;
+  std::vector<TypeExpression*> types;
+  bool has_varargs;
+  std::string arguments_variable;
+};
+
+struct BasicTypeExpression : TypeExpression {
+  DEFINE_AST_NODE_LEAF_BOILERPLATE(BasicTypeExpression)
+  BasicTypeExpression(SourcePosition p, bool c, std::string n)
+      : TypeExpression(kKind, p), is_constexpr(c), name(n) {}
+  bool is_constexpr;
+  std::string name;
+};
+
+struct FunctionTypeExpression : TypeExpression {
+  DEFINE_AST_NODE_LEAF_BOILERPLATE(FunctionTypeExpression)
+  FunctionTypeExpression(SourcePosition p, ParameterList pl, TypeExpression* r)
+      : TypeExpression(kKind, p), parameters(pl), return_type(r) {}
+  ParameterList parameters;
+  TypeExpression* return_type;
+};
+
+struct UnionTypeExpression : TypeExpression {
+  DEFINE_AST_NODE_LEAF_BOILERPLATE(UnionTypeExpression)
+  UnionTypeExpression(SourcePosition pos, TypeExpression* a, TypeExpression* b)
+      : TypeExpression(kKind, pos), a(a), b(b) {}
+  TypeExpression* a;
+  TypeExpression* b;
+};
+
+struct ExpressionStatement : Statement {
+  DEFINE_AST_NODE_LEAF_BOILERPLATE(ExpressionStatement)
+  ExpressionStatement(SourcePosition p, Expression* e)
+      : Statement(kKind, p), expression(e) {}
+  Expression* expression;
+};
+
+struct IfStatement : Statement {
+  DEFINE_AST_NODE_LEAF_BOILERPLATE(IfStatement)
+  IfStatement(SourcePosition p, Expression* c, bool cexpr, Statement* t,
+              base::Optional<Statement*> f)
+      : Statement(kKind, p),
+        condition(c),
+        is_constexpr(cexpr),
+        if_true(t),
+        if_false(f) {}
+  Expression* condition;
+  bool is_constexpr;
+  Statement* if_true;
+  base::Optional<Statement*> if_false;
+};
+
+struct WhileStatement : Statement {
+  DEFINE_AST_NODE_LEAF_BOILERPLATE(WhileStatement)
+  WhileStatement(SourcePosition p, Expression* c, Statement* b)
+      : Statement(kKind, p), condition(c), body(b) {}
+  Expression* condition;
+  Statement* body;
+};
+
+struct ReturnStatement : Statement {
+  DEFINE_AST_NODE_LEAF_BOILERPLATE(ReturnStatement)
+  ReturnStatement(SourcePosition p, base::Optional<Expression*> v)
+      : Statement(kKind, p), value(v) {}
+  base::Optional<Expression*> value;
+};
+
+struct DebugStatement : Statement {
+  DEFINE_AST_NODE_LEAF_BOILERPLATE(DebugStatement)
+  DebugStatement(SourcePosition p, const std::string& r, bool n)
+      : Statement(kKind, p), reason(r), never_continues(n) {}
+  std::string reason;
+  bool never_continues;
+};
+
+struct AssertStatement : Statement {
+  DEFINE_AST_NODE_LEAF_BOILERPLATE(AssertStatement)
+  AssertStatement(SourcePosition pos, bool debug_only, Expression* expression,
+                  std::string source)
+      : Statement(kKind, pos),
+        debug_only(debug_only),
+        expression(expression),
+        source(std::move(source)) {}
+  bool debug_only;
+  Expression* expression;
+  std::string source;
+};
+
+struct TailCallStatement : Statement {
+  DEFINE_AST_NODE_LEAF_BOILERPLATE(TailCallStatement)
+  TailCallStatement(SourcePosition p, CallExpression* c)
+      : Statement(kKind, p), call(c) {}
+  CallExpression* call;
+};
+
+struct VarDeclarationStatement : Statement {
+  DEFINE_AST_NODE_LEAF_BOILERPLATE(VarDeclarationStatement)
+  VarDeclarationStatement(SourcePosition p, std::string n, TypeExpression* t,
+                          base::Optional<Expression*> i)
+      : Statement(kKind, p), name(std::move(n)), type(t), initializer(i) {}
+  std::string name;
+  TypeExpression* type;
+  base::Optional<Expression*> initializer;
+};
+
+struct BreakStatement : Statement {
+  DEFINE_AST_NODE_LEAF_BOILERPLATE(BreakStatement)
+  explicit BreakStatement(SourcePosition p) : Statement(kKind, p) {}
+};
+
+struct ContinueStatement : Statement {
+  DEFINE_AST_NODE_LEAF_BOILERPLATE(ContinueStatement)
+  explicit ContinueStatement(SourcePosition p) : Statement(kKind, p) {}
+};
+
+struct GotoStatement : Statement {
+  DEFINE_AST_NODE_LEAF_BOILERPLATE(GotoStatement)
+  GotoStatement(SourcePosition p, std::string l,
+                const std::vector<Expression*>& a)
+      : Statement(kKind, p), label(std::move(l)), arguments(std::move(a)) {}
+  std::string label;
+  std::vector<Expression*> arguments;
+};
+
+struct ForLoopStatement : Statement {
+  DEFINE_AST_NODE_LEAF_BOILERPLATE(ForLoopStatement)
+  ForLoopStatement(SourcePosition p, base::Optional<VarDeclarationStatement*> d,
+                   Expression* t, Expression* a, Statement* b)
+      : Statement(kKind, p),
+        var_declaration(d),
+        test(std::move(t)),
+        action(std::move(a)),
+        body(std::move(b)) {}
+  base::Optional<VarDeclarationStatement*> var_declaration;
+  Expression* test;
+  Expression* action;
+  Statement* body;
+};
+
+struct ForOfLoopStatement : Statement {
+  DEFINE_AST_NODE_LEAF_BOILERPLATE(ForOfLoopStatement)
+  ForOfLoopStatement(SourcePosition p, VarDeclarationStatement* d,
+                     Expression* i, base::Optional<Expression*> bg,
+                     base::Optional<Expression*> e, Statement* bd)
+      : Statement(kKind, p),
+        var_declaration(d),
+        iterable(std::move(i)),
+        begin(std::move(bg)),
+        end(std::move(e)),
+        body(std::move(bd)) {}
+  VarDeclarationStatement* var_declaration;
+  Expression* iterable;
+  base::Optional<Expression*> begin;
+  base::Optional<Expression*> end;
+  Statement* body;
+};
+
+struct LabelBlock : AstNode {
+  DEFINE_AST_NODE_LEAF_BOILERPLATE(LabelBlock)
+  LabelBlock(SourcePosition p, const std::string& l,
+             const ParameterList& p_list, Statement* b)
+      : AstNode(kKind, p),
+        label(std::move(l)),
+        parameters(p_list),
+        body(std::move(b)) {}
+  std::string label;
+  ParameterList parameters;
+  Statement* body;
+};
+
+struct TryLabelStatement : Statement {
+  DEFINE_AST_NODE_LEAF_BOILERPLATE(TryLabelStatement)
+  TryLabelStatement(SourcePosition p, Statement* t)
+      : Statement(kKind, p), try_block(std::move(t)) {}
+  Statement* try_block;
+  std::vector<LabelBlock*> label_blocks;
+};
+
+struct BlockStatement : Statement {
+  DEFINE_AST_NODE_LEAF_BOILERPLATE(BlockStatement)
+  BlockStatement(SourcePosition p, bool d, std::vector<Statement*> s)
+      : Statement(kKind, p), deferred(d), statements(std::move(s)) {}
+  bool deferred;
+  std::vector<Statement*> statements;
+};
+
+struct TypeDeclaration : Declaration {
+  DEFINE_AST_NODE_LEAF_BOILERPLATE(TypeDeclaration)
+  TypeDeclaration(SourcePosition p, std::string n,
+                  base::Optional<std::string> e, base::Optional<std::string> g)
+      : Declaration(kKind, p),
+        name(std::move(n)),
+        extends(std::move(e)),
+        generates(std::move(g)) {}
+  std::string name;
+  base::Optional<std::string> extends;
+  base::Optional<std::string> generates;
+  base::Optional<std::string> constexpr_generates;
+};
+
+struct TypeAliasDeclaration : Declaration {
+  DEFINE_AST_NODE_LEAF_BOILERPLATE(TypeAliasDeclaration)
+  TypeAliasDeclaration(SourcePosition p, std::string n, TypeExpression* t)
+      : Declaration(kKind, p), name(std::move(n)), type(t) {}
+  std::string name;
+  TypeExpression* type;
+};
+
+struct LabelAndTypes {
+  std::string name;
+  std::vector<TypeExpression*> types;
+};
+
+typedef std::vector<LabelAndTypes> LabelAndTypesVector;
+
+struct CallableNodeSignature {
+  ParameterList parameters;
+  TypeExpression* return_type;
+  LabelAndTypesVector labels;
+};
+
+struct CallableNode : AstNode {
+  CallableNode(AstNode::Kind kind, SourcePosition p, std::string n,
+               ParameterList pl, TypeExpression* r,
+               const LabelAndTypesVector& l)
+      : AstNode(kind, p),
+        name(std::move(n)),
+        signature(new CallableNodeSignature{pl, r, l}) {}
+  DEFINE_AST_NODE_INNER_BOILERPLATE(CallableNode)
+  std::string name;
+  std::unique_ptr<CallableNodeSignature> signature;
+};
+
+struct MacroDeclaration : CallableNode {
+  DEFINE_AST_NODE_INNER_BOILERPLATE(MacroDeclaration)
+  MacroDeclaration(AstNode::Kind kind, SourcePosition p, std::string n,
+                   base::Optional<std::string> o, ParameterList pl,
+                   TypeExpression* r, const LabelAndTypesVector& l)
+      : CallableNode(kind, p, n, pl, r, l), op(std::move(o)) {}
+  base::Optional<std::string> op;
+};
+
+struct ExternalMacroDeclaration : MacroDeclaration {
+  DEFINE_AST_NODE_LEAF_BOILERPLATE(ExternalMacroDeclaration)
+  ExternalMacroDeclaration(SourcePosition p, std::string n,
+                           base::Optional<std::string> o, ParameterList pl,
+                           TypeExpression* r, const LabelAndTypesVector& l)
+      : MacroDeclaration(kKind, p, n, o, pl, r, l) {}
+};
+
+struct TorqueMacroDeclaration : MacroDeclaration {
+  DEFINE_AST_NODE_LEAF_BOILERPLATE(TorqueMacroDeclaration)
+  TorqueMacroDeclaration(SourcePosition p, std::string n, ParameterList pl,
+                         TypeExpression* r, const LabelAndTypesVector& l)
+      : MacroDeclaration(kKind, p, n, {}, pl, r, l) {}
+};
+
+struct BuiltinDeclaration : CallableNode {
+  BuiltinDeclaration(AstNode::Kind kind, SourcePosition p, bool j,
+                     std::string n, ParameterList pl, TypeExpression* r)
+      : CallableNode(kind, p, n, pl, r, {}), javascript_linkage(j) {}
+  bool javascript_linkage;
+};
+
+struct ExternalBuiltinDeclaration : BuiltinDeclaration {
+  DEFINE_AST_NODE_LEAF_BOILERPLATE(ExternalBuiltinDeclaration)
+  ExternalBuiltinDeclaration(SourcePosition p, bool j, std::string n,
+                             ParameterList pl, TypeExpression* r)
+      : BuiltinDeclaration(kKind, p, j, n, pl, r) {}
+};
+
+struct TorqueBuiltinDeclaration : BuiltinDeclaration {
+  DEFINE_AST_NODE_LEAF_BOILERPLATE(TorqueBuiltinDeclaration)
+  TorqueBuiltinDeclaration(SourcePosition p, bool j, std::string n,
+                           ParameterList pl, TypeExpression* r)
+      : BuiltinDeclaration(kKind, p, j, n, pl, r) {}
+};
+
+struct ExternalRuntimeDeclaration : CallableNode {
+  DEFINE_AST_NODE_LEAF_BOILERPLATE(ExternalRuntimeDeclaration)
+  ExternalRuntimeDeclaration(SourcePosition p, std::string n, ParameterList pl,
+                             TypeExpression* r)
+      : CallableNode(kKind, p, n, pl, r, {}) {}
+};
+
+struct StandardDeclaration : Declaration {
+  DEFINE_AST_NODE_LEAF_BOILERPLATE(StandardDeclaration)
+  StandardDeclaration(SourcePosition p, CallableNode* c, Statement* b)
+      : Declaration(kKind, p), callable(c), body(b) {}
+  CallableNode* callable;
+  Statement* body;
+};
+
+struct GenericDeclaration : Declaration {
+  DEFINE_AST_NODE_LEAF_BOILERPLATE(GenericDeclaration)
+  GenericDeclaration(SourcePosition p, CallableNode* c,
+                     std::vector<std::string> gp,
+                     base::Optional<Statement*> b = base::nullopt)
+      : Declaration(kKind, p),
+        callable(c),
+        generic_parameters(std::move(gp)),
+        body(b) {}
+  CallableNode* callable;
+  std::vector<std::string> generic_parameters;
+  base::Optional<Statement*> body;
+};
+
+struct SpecializationDeclaration : Declaration {
+  DEFINE_AST_NODE_LEAF_BOILERPLATE(SpecializationDeclaration)
+  SpecializationDeclaration(SourcePosition p, std::string n, bool e,
+                            std::vector<TypeExpression*> gp, ParameterList pl,
+                            TypeExpression* r, LabelAndTypesVector l,
+                            Statement* b)
+      : Declaration(kKind, p),
+        name(std::move(n)),
+        external(e),
+        generic_parameters(gp),
+        signature(new CallableNodeSignature{pl, r, l}),
+        body(b) {}
+  std::string name;
+  bool external;
+  std::vector<TypeExpression*> generic_parameters;
+  std::unique_ptr<CallableNodeSignature> signature;
+  Statement* body;
+};
+
+struct ExternConstDeclaration : Declaration {
+  DEFINE_AST_NODE_LEAF_BOILERPLATE(ExternConstDeclaration)
+  ExternConstDeclaration(SourcePosition p, std::string n, TypeExpression* t,
+                         std::string l)
+      : Declaration(kKind, p),
+        name(std::move(n)),
+        type(t),
+        literal(std::move(l)) {}
+  std::string name;
+  TypeExpression* type;
+  std::string literal;
+};
+
+#define ENUM_ITEM(name)                     \
+  case AstNode::Kind::k##name:              \
+    return std::is_base_of<T, name>::value; \
+    break;
+
+template <class T>
+bool AstNodeClassCheck::IsInstanceOf(AstNode* node) {
+  switch (node->kind) {
+    AST_NODE_KIND_LIST(ENUM_ITEM)
+    default:
+      UNIMPLEMENTED();
+  }
+  return true;
+}
+
+#undef ENUM_ITEM
+
+}  // namespace torque
+}  // namespace internal
+}  // namespace v8
+
+#endif  // V8_TORQUE_AST_H_
diff --git a/deps/v8/src/torque/contextual.h b/deps/v8/src/torque/contextual.h
new file mode 100644
index 00000000000000..9cd56a2ed910ba
--- /dev/null
+++ b/deps/v8/src/torque/contextual.h
@@ -0,0 +1,87 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef V8_TORQUE_CONTEXTUAL_H_
+#define V8_TORQUE_CONTEXTUAL_H_
+
+#include <type_traits>
+
+#include "src/base/macros.h"
+#include "src/base/platform/platform.h"
+
+namespace v8 {
+namespace internal {
+namespace torque {
+
+// {ContextualVariable} provides a clean alternative to a global variable.
+// The contextual variable is mutable, and supports managing the value of
+// a variable in a well-nested fashion via the {Scope} class.
+// {ContextualVariable} only stores a pointer to the current value, which
+// is stored in a {Scope} object. The most recent value can be retrieved
+// via Get(). Because only {Scope} has actual storage, there must be at
+// least one active {Scope} (i.e. in a surrounding C++ scope), whenever Get()
+// is called.
+// Note that contextual variables must only be used from the same thread,
+// i.e. {Scope} and Get() have to be in the same thread.
+template <class Derived, class VarType>
+class ContextualVariable {
+ public:
+  // A {Scope} contains a new object of type {VarType} and gives
+  // ContextualVariable::Get() access to it. Upon destruction, the contextual
+  // variable is restored to the state before the {Scope} was created. Scopes
+  // have to follow a stack discipline:  A {Scope} has to be destructed before
+  // any older scope is destructed.
+  class Scope {
+   public:
+    template <class... Args>
+    explicit Scope(Args&&... args)
+        : current_(std::forward<Args>(args)...), previous_(top_) {
+      top_ = &current_;
+    }
+    ~Scope() {
+      // Ensure stack discipline.
+      DCHECK_EQ(&current_, top_);
+      top_ = previous_;
+    }
+
+   private:
+    VarType current_;
+    VarType* previous_;
+
+    static_assert(std::is_base_of<ContextualVariable, Derived>::value,
+                  "Curiously Recurring Template Pattern");
+
+    DISALLOW_NEW_AND_DELETE();
+    DISALLOW_COPY_AND_ASSIGN(Scope);
+  };
+
+  // Access the most recent active {Scope}. There has to be an active {Scope}
+  // for this contextual variable.
+  static VarType& Get() {
+    DCHECK_NOT_NULL(top_);
+    return *top_;
+  }
+
+ private:
+  static thread_local VarType* top_;
+};
+
+template <class Derived, class VarType>
+thread_local VarType* ContextualVariable<Derived, VarType>::top_ = nullptr;
+
+// Usage: DECLARE_CONTEXTUAL_VARIABLE(VarName, VarType)
+#define DECLARE_CONTEXTUAL_VARIABLE(VarName, ...) \
+  struct VarName                                  \
+      : v8::internal::torque::ContextualVariable<VarName, __VA_ARGS__> {};
+
+// By inheriting from {ContextualClass} a class can become a contextual variable
+// of itself, which is very similar to a singleton.
+template <class T>
+using ContextualClass = ContextualVariable<T, T>;
+
+}  // namespace torque
+}  // namespace internal
+}  // namespace v8
+
+#endif  // V8_TORQUE_CONTEXTUAL_H_
diff --git a/deps/v8/src/torque/declarable.cc b/deps/v8/src/torque/declarable.cc
new file mode 100644
index 00000000000000..66f56a19c81324
--- /dev/null
+++ b/deps/v8/src/torque/declarable.cc
@@ -0,0 +1,74 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include <fstream>
+#include <iostream>
+
+#include "src/torque/declarable.h"
+
+namespace v8 {
+namespace internal {
+namespace torque {
+
+std::ostream& operator<<(std::ostream& os, const Callable& m) {
+  os << "callable " << m.name() << "(" << m.signature().parameter_types
+     << "): " << *m.signature().return_type;
+  return os;
+}
+
+std::ostream& operator<<(std::ostream& os, const Variable& v) {
+  os << "variable " << v.name() << ": " << *v.type();
+  return os;
+}
+
+std::ostream& operator<<(std::ostream& os, const Builtin& b) {
+  os << "builtin " << *b.signature().return_type << " " << b.name()
+     << b.signature().parameter_types;
+  return os;
+}
+
+std::ostream& operator<<(std::ostream& os, const RuntimeFunction& b) {
+  os << "runtime function " << *b.signature().return_type << " " << b.name()
+     << b.signature().parameter_types;
+  return os;
+}
+
+void PrintLabel(std::ostream& os, const Label& l, bool with_names) {
+  os << l.name();
+  if (l.GetParameterCount() != 0) {
+    os << "(";
+    if (with_names) {
+      PrintCommaSeparatedList(os, l.GetParameters(),
+                              [](Variable* v) -> std::string {
+                                std::stringstream stream;
+                                stream << v->name();
+                                stream << ": ";
+                                stream << *(v->type());
+                                return stream.str();
+                              });
+    } else {
+      PrintCommaSeparatedList(
+          os, l.GetParameters(),
+          [](Variable* v) -> const Type& { return *(v->type()); });
+    }
+    os << ")";
+  }
+}
+
+std::ostream& operator<<(std::ostream& os, const Label& l) {
+  PrintLabel(os, l, true);
+  return os;
+}
+
+std::ostream& operator<<(std::ostream& os, const Generic& g) {
+  os << "generic " << g.name() << "<";
+  PrintCommaSeparatedList(os, g.declaration()->generic_parameters);
+  os << ">";
+
+  return os;
+}
+
+}  // namespace torque
+}  // namespace internal
+}  // namespace v8
diff --git a/deps/v8/src/torque/declarable.h b/deps/v8/src/torque/declarable.h
new file mode 100644
index 00000000000000..85a1255560d87c
--- /dev/null
+++ b/deps/v8/src/torque/declarable.h
@@ -0,0 +1,355 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef V8_TORQUE_DECLARABLE_H_
+#define V8_TORQUE_DECLARABLE_H_
+
+#include <cassert>
+#include <string>
+
+#include "src/base/functional.h"
+#include "src/base/logging.h"
+#include "src/torque/ast.h"
+#include "src/torque/types.h"
+#include "src/torque/utils.h"
+
+namespace v8 {
+namespace internal {
+namespace torque {
+
+class Scope;
+class ScopeChain;
+
+class Declarable {
+ public:
+  virtual ~Declarable() {}
+  enum Kind {
+    kVariable,
+    kParameter,
+    kMacro,
+    kMacroList,
+    kBuiltin,
+    kRuntimeFunction,
+    kGeneric,
+    kGenericList,
+    kTypeAlias,
+    kLabel,
+    kConstant
+  };
+  Kind kind() const { return kind_; }
+  bool IsMacro() const { return kind() == kMacro; }
+  bool IsBuiltin() const { return kind() == kBuiltin; }
+  bool IsRuntimeFunction() const { return kind() == kRuntimeFunction; }
+  bool IsGeneric() const { return kind() == kGeneric; }
+  bool IsTypeAlias() const { return kind() == kTypeAlias; }
+  bool IsParameter() const { return kind() == kParameter; }
+  bool IsLabel() const { return kind() == kLabel; }
+  bool IsVariable() const { return kind() == kVariable; }
+  bool IsMacroList() const { return kind() == kMacroList; }
+  bool IsGenericList() const { return kind() == kGenericList; }
+  bool IsConstant() const { return kind() == kConstant; }
+  bool IsValue() const { return IsVariable() || IsConstant() || IsParameter(); }
+  virtual const char* type_name() const { return "<<unknown>>"; }
+
+ protected:
+  explicit Declarable(Kind kind) : kind_(kind) {}
+
+ private:
+  const Kind kind_;
+};
+
+#define DECLARE_DECLARABLE_BOILERPLATE(x, y)                  \
+  static x* cast(Declarable* declarable) {                    \
+    DCHECK(declarable->Is##x());                              \
+    return static_cast<x*>(declarable);                       \
+  }                                                           \
+  static const x* cast(const Declarable* declarable) {        \
+    DCHECK(declarable->Is##x());                              \
+    return static_cast<const x*>(declarable);                 \
+  }                                                           \
+  const char* type_name() const override { return #y; }       \
+  static x* DynamicCast(Declarable* declarable) {             \
+    if (!declarable) return nullptr;                          \
+    if (!declarable->Is##x()) return nullptr;                 \
+    return static_cast<x*>(declarable);                       \
+  }                                                           \
+  static const x* DynamicCast(const Declarable* declarable) { \
+    if (!declarable) return nullptr;                          \
+    if (!declarable->Is##x()) return nullptr;                 \
+    return static_cast<const x*>(declarable);                 \
+  }
+
+class Value : public Declarable {
+ public:
+  const std::string& name() const { return name_; }
+  virtual bool IsConst() const { return true; }
+  virtual std::string value() const = 0;
+  virtual std::string RValue() const { return value(); }
+  DECLARE_DECLARABLE_BOILERPLATE(Value, value);
+  const Type* type() const { return type_; }
+
+ protected:
+  Value(Kind kind, const Type* type, const std::string& name)
+      : Declarable(kind), type_(type), name_(name) {}
+
+ private:
+  const Type* type_;
+  std::string name_;
+};
+
+class Parameter : public Value {
+ public:
+  DECLARE_DECLARABLE_BOILERPLATE(Parameter, parameter);
+  std::string value() const override { return var_name_; }
+
+ private:
+  friend class Declarations;
+  Parameter(const std::string& name, const Type* type,
+            const std::string& var_name)
+      : Value(Declarable::kParameter, type, name), var_name_(var_name) {}
+
+  std::string var_name_;
+};
+
+class Variable : public Value {
+ public:
+  DECLARE_DECLARABLE_BOILERPLATE(Variable, variable);
+  bool IsConst() const override { return false; }
+  std::string value() const override { return value_; }
+  std::string RValue() const override {
+    if (!IsDefined()) {
+      ReportError("Reading uninitialized variable.");
+    }
+    std::string result = "(*" + value() + ")";
+    if (!type()->IsConstexpr()) result += ".value()";
+    return result;
+  }
+  void Define() {
+    if (defined_ && type()->IsConstexpr()) {
+      ReportError("Cannot re-define a constexpr variable.");
+    }
+    defined_ = true;
+  }
+  bool IsDefined() const { return defined_; }
+
+ private:
+  friend class Declarations;
+  Variable(const std::string& name, const std::string& value, const Type* type)
+      : Value(Declarable::kVariable, type, name),
+        value_(value),
+        defined_(false) {}
+
+  std::string value_;
+  bool defined_;
+};
+
+class Label : public Declarable {
+ public:
+  void AddVariable(Variable* var) { parameters_.push_back(var); }
+  std::string name() const { return name_; }
+  std::string generated() const { return generated_; }
+  Variable* GetParameter(size_t i) const { return parameters_[i]; }
+  size_t GetParameterCount() const { return parameters_.size(); }
+  const std::vector<Variable*>& GetParameters() const { return parameters_; }
+
+  DECLARE_DECLARABLE_BOILERPLATE(Label, label);
+  void MarkUsed() { used_ = true; }
+  bool IsUsed() const { return used_; }
+
+ private:
+  friend class Declarations;
+  explicit Label(const std::string& name)
+      : Declarable(Declarable::kLabel),
+        name_(name),
+        generated_("label_" + name + "_" + std::to_string(next_id_++)),
+        used_(false) {}
+
+  std::string name_;
+  std::string generated_;
+  std::vector<Variable*> parameters_;
+  static size_t next_id_;
+  bool used_;
+};
+
+class Constant : public Value {
+ public:
+  DECLARE_DECLARABLE_BOILERPLATE(Constant, constant);
+  std::string value() const override { return value_; }
+
+ private:
+  friend class Declarations;
+  explicit Constant(const std::string& name, const Type* type,
+                    const std::string& value)
+      : Value(Declarable::kConstant, type, name), value_(value) {}
+
+  std::string value_;
+};
+
+class Callable : public Declarable {
+ public:
+  static Callable* cast(Declarable* declarable) {
+    assert(declarable->IsMacro() || declarable->IsBuiltin() ||
+           declarable->IsRuntimeFunction());
+    return static_cast<Callable*>(declarable);
+  }
+  static const Callable* cast(const Declarable* declarable) {
+    assert(declarable->IsMacro() || declarable->IsBuiltin() ||
+           declarable->IsRuntimeFunction());
+    return static_cast<const Callable*>(declarable);
+  }
+  const std::string& name() const { return name_; }
+  const Signature& signature() const { return signature_; }
+  const NameVector& parameter_names() const {
+    return signature_.parameter_names;
+  }
+  bool HasReturnValue() const {
+    return !signature_.return_type->IsVoidOrNever();
+  }
+  void IncrementReturns() { ++returns_; }
+  bool HasReturns() const { return returns_; }
+
+ protected:
+  Callable(Declarable::Kind kind, const std::string& name,
+           const Signature& signature)
+      : Declarable(kind), name_(name), signature_(signature), returns_(0) {}
+
+ private:
+  std::string name_;
+  Signature signature_;
+  size_t returns_;
+};
+
+class Macro : public Callable {
+ public:
+  DECLARE_DECLARABLE_BOILERPLATE(Macro, macro);
+
+ protected:
+  Macro(Declarable::Kind type, const std::string& name,
+        const Signature& signature)
+      : Callable(type, name, signature) {}
+
+ private:
+  friend class Declarations;
+  Macro(const std::string& name, const Signature& signature)
+      : Macro(Declarable::kMacro, name, signature) {}
+};
+
+class MacroList : public Declarable {
+ public:
+  DECLARE_DECLARABLE_BOILERPLATE(MacroList, macro_list);
+  const std::vector<Macro*>& list() { return list_; }
+  Macro* AddMacro(Macro* macro) {
+    list_.emplace_back(macro);
+    return macro;
+  }
+
+ private:
+  friend class Declarations;
+  MacroList() : Declarable(Declarable::kMacroList) {}
+
+  std::vector<Macro*> list_;
+};
+
+class Builtin : public Callable {
+ public:
+  enum Kind { kStub, kFixedArgsJavaScript, kVarArgsJavaScript };
+  DECLARE_DECLARABLE_BOILERPLATE(Builtin, builtin);
+  Kind kind() const { return kind_; }
+  bool IsStub() const { return kind_ == kStub; }
+  bool IsVarArgsJavaScript() const { return kind_ == kVarArgsJavaScript; }
+  bool IsFixedArgsJavaScript() const { return kind_ == kFixedArgsJavaScript; }
+  bool IsExternal() const { return external_; }
+
+ private:
+  friend class Declarations;
+  Builtin(const std::string& name, Builtin::Kind kind, bool external,
+          const Signature& signature)
+      : Callable(Declarable::kBuiltin, name, signature),
+        kind_(kind),
+        external_(external) {}
+
+  Kind kind_;
+  bool external_;
+};
+
+class RuntimeFunction : public Callable {
+ public:
+  DECLARE_DECLARABLE_BOILERPLATE(RuntimeFunction, runtime);
+
+ private:
+  friend class Declarations;
+  RuntimeFunction(const std::string& name, const Signature& signature)
+      : Callable(Declarable::kRuntimeFunction, name, signature) {}
+};
+
+class Generic : public Declarable {
+ public:
+  DECLARE_DECLARABLE_BOILERPLATE(Generic, generic);
+
+  GenericDeclaration* declaration() const { return declaration_; }
+  const std::string& name() const { return name_; }
+  Module* module() const { return module_; }
+
+ private:
+  friend class Declarations;
+  Generic(const std::string& name, Module* module,
+          GenericDeclaration* declaration)
+      : Declarable(Declarable::kGeneric),
+        name_(name),
+        module_(module),
+        declaration_(declaration) {}
+
+  std::string name_;
+  Module* module_;
+  GenericDeclaration* declaration_;
+};
+
+class GenericList : public Declarable {
+ public:
+  DECLARE_DECLARABLE_BOILERPLATE(GenericList, generic_list);
+  const std::vector<Generic*>& list() { return list_; }
+  Generic* AddGeneric(Generic* generic) {
+    list_.push_back(generic);
+    return generic;
+  }
+
+ private:
+  friend class Declarations;
+  GenericList() : Declarable(Declarable::kGenericList) {}
+
+  std::vector<Generic*> list_;
+};
+
+typedef std::pair<Generic*, TypeVector> SpecializationKey;
+
+class TypeAlias : public Declarable {
+ public:
+  DECLARE_DECLARABLE_BOILERPLATE(TypeAlias, type_alias);
+
+  const Type* type() const { return type_; }
+
+ private:
+  friend class Declarations;
+  explicit TypeAlias(const Type* type)
+      : Declarable(Declarable::kTypeAlias), type_(type) {}
+
+  const Type* type_;
+};
+
+void PrintLabel(std::ostream& os, const Label& l, bool with_names);
+
+std::ostream& operator<<(std::ostream& os, const Callable& m);
+std::ostream& operator<<(std::ostream& os, const Variable& v);
+std::ostream& operator<<(std::ostream& os, const Builtin& b);
+std::ostream& operator<<(std::ostream& os, const Label& l);
+std::ostream& operator<<(std::ostream& os, const RuntimeFunction& b);
+std::ostream& operator<<(std::ostream& os, const Generic& g);
+
+#undef DECLARE_DECLARABLE_BOILERPLATE
+
+}  // namespace torque
+}  // namespace internal
+}  // namespace v8
+
+#endif  // V8_TORQUE_DECLARABLE_H_
diff --git a/deps/v8/src/torque/declaration-visitor.cc b/deps/v8/src/torque/declaration-visitor.cc
new file mode 100644
index 00000000000000..798a925db5014e
--- /dev/null
+++ b/deps/v8/src/torque/declaration-visitor.cc
@@ -0,0 +1,596 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "src/torque/declaration-visitor.h"
+
+namespace v8 {
+namespace internal {
+namespace torque {
+
+void DeclarationVisitor::Visit(Expression* expr) {
+  CurrentSourcePosition::Scope scope(expr->pos);
+  switch (expr->kind) {
+#define ENUM_ITEM(name)        \
+  case AstNode::Kind::k##name: \
+    return Visit(name::cast(expr));
+    AST_EXPRESSION_NODE_KIND_LIST(ENUM_ITEM)
+#undef ENUM_ITEM
+    default:
+      UNIMPLEMENTED();
+  }
+}
+
+void DeclarationVisitor::Visit(Statement* stmt) {
+  CurrentSourcePosition::Scope scope(stmt->pos);
+  switch (stmt->kind) {
+#define ENUM_ITEM(name)        \
+  case AstNode::Kind::k##name: \
+    return Visit(name::cast(stmt));
+    AST_STATEMENT_NODE_KIND_LIST(ENUM_ITEM)
+#undef ENUM_ITEM
+    default:
+      UNIMPLEMENTED();
+  }
+}
+
+void DeclarationVisitor::Visit(Declaration* decl) {
+  CurrentSourcePosition::Scope scope(decl->pos);
+  switch (decl->kind) {
+#define ENUM_ITEM(name)        \
+  case AstNode::Kind::k##name: \
+    return Visit(name::cast(decl));
+    AST_DECLARATION_NODE_KIND_LIST(ENUM_ITEM)
+#undef ENUM_ITEM
+    default:
+      UNIMPLEMENTED();
+  }
+}
+
+void DeclarationVisitor::Visit(CallableNode* decl, const Signature& signature,
+                               Statement* body) {
+  switch (decl->kind) {
+#define ENUM_ITEM(name)        \
+  case AstNode::Kind::k##name: \
+    return Visit(name::cast(decl), signature, body);
+    AST_CALLABLE_NODE_KIND_LIST(ENUM_ITEM)
+#undef ENUM_ITEM
+    default:
+      UNIMPLEMENTED();
+  }
+}
+
+Builtin* DeclarationVisitor::BuiltinDeclarationCommon(
+    BuiltinDeclaration* decl, bool external, const Signature& signature) {
+  const bool javascript = decl->javascript_linkage;
+  const bool varargs = decl->signature->parameters.has_varargs;
+  Builtin::Kind kind = !javascript ? Builtin::kStub
+                                   : varargs ? Builtin::kVarArgsJavaScript
+                                             : Builtin::kFixedArgsJavaScript;
+
+  if (signature.types().size() == 0 ||
+      !(signature.types()[0] ==
+        declarations()->LookupGlobalType(CONTEXT_TYPE_STRING))) {
+    std::stringstream stream;
+    stream << "first parameter to builtin " << decl->name
+           << " is not a context but should be";
+    ReportError(stream.str());
+  }
+
+  if (varargs && !javascript) {
+    std::stringstream stream;
+    stream << "builtin " << decl->name
+           << " with rest parameters must be a JavaScript builtin";
+    ReportError(stream.str());
+  }
+
+  if (javascript) {
+    if (signature.types().size() < 2 ||
+        !(signature.types()[1] ==
+          declarations()->LookupGlobalType(OBJECT_TYPE_STRING))) {
+      std::stringstream stream;
+      stream << "second parameter to javascript builtin " << decl->name
+             << " is " << *signature.types()[1] << " but should be Object";
+      ReportError(stream.str());
+    }
+  }
+
+  std::string generated_name = GetGeneratedCallableName(
+      decl->name, declarations()->GetCurrentSpecializationTypeNamesVector());
+  return declarations()->DeclareBuiltin(generated_name, kind, external,
+                                        signature);
+}
+
+void DeclarationVisitor::Visit(ExternalRuntimeDeclaration* decl,
+                               const Signature& signature, Statement* body) {
+  if (global_context_.verbose()) {
+    std::cout << "found declaration of external runtime " << decl->name
+              << " with signature ";
+  }
+
+  if (signature.parameter_types.types.size() == 0 ||
+      !(signature.parameter_types.types[0] ==
+        declarations()->LookupGlobalType(CONTEXT_TYPE_STRING))) {
+    std::stringstream stream;
+    stream << "first parameter to runtime " << decl->name
+           << " is not a context but should be";
+    ReportError(stream.str());
+  }
+
+  declarations()->DeclareRuntimeFunction(decl->name, signature);
+}
+
+void DeclarationVisitor::Visit(ExternalMacroDeclaration* decl,
+                               const Signature& signature, Statement* body) {
+  if (global_context_.verbose()) {
+    std::cout << "found declaration of external macro " << decl->name
+              << " with signature ";
+  }
+
+  std::string generated_name = GetGeneratedCallableName(
+      decl->name, declarations()->GetCurrentSpecializationTypeNamesVector());
+  declarations()->DeclareMacro(generated_name, signature, decl->op);
+}
+
+void DeclarationVisitor::Visit(TorqueBuiltinDeclaration* decl,
+                               const Signature& signature, Statement* body) {
+  Builtin* builtin = BuiltinDeclarationCommon(decl, false, signature);
+  CurrentCallableActivator activator(global_context_, builtin, decl);
+  DeclareSignature(signature);
+  if (signature.parameter_types.var_args) {
+    declarations()->DeclareConstant(
+        decl->signature->parameters.arguments_variable,
+        TypeOracle::GetArgumentsType(), "arguments");
+  }
+  torque_builtins_.push_back(builtin);
+  Visit(body);
+}
+
+void DeclarationVisitor::Visit(TorqueMacroDeclaration* decl,
+                               const Signature& signature, Statement* body) {
+  std::string generated_name = GetGeneratedCallableName(
+      decl->name, declarations()->GetCurrentSpecializationTypeNamesVector());
+  Macro* macro =
+      declarations()->DeclareMacro(generated_name, signature, decl->op);
+
+  CurrentCallableActivator activator(global_context_, macro, decl);
+
+  DeclareSignature(signature);
+  Variable* return_variable = nullptr;
+  if (!signature.return_type->IsVoidOrNever()) {
+    return_variable = declarations()->DeclareVariable(kReturnValueVariable,
+                                                      signature.return_type);
+  }
+
+  PushControlSplit();
+  if (body != nullptr) {
+    Visit(body);
+  }
+  auto changed_vars = PopControlSplit();
+  if (return_variable) changed_vars.insert(return_variable);
+  global_context_.AddControlSplitChangedVariables(
+      decl, declarations()->GetCurrentSpecializationTypeNamesVector(),
+      changed_vars);
+}
+
+void DeclarationVisitor::Visit(StandardDeclaration* decl) {
+  Signature signature = MakeSignature(decl->callable->signature.get());
+  Visit(decl->callable, signature, decl->body);
+}
+
+void DeclarationVisitor::Visit(GenericDeclaration* decl) {
+  declarations()->DeclareGeneric(decl->callable->name, CurrentModule(), decl);
+}
+
+void DeclarationVisitor::Visit(SpecializationDeclaration* decl) {
+  if ((decl->body != nullptr) == decl->external) {
+    std::stringstream stream;
+    stream << "specialization of " << decl->name
+           << " must either be marked 'extern' or have a body";
+    ReportError(stream.str());
+  }
+
+  GenericList* generic_list = declarations()->LookupGeneric(decl->name);
+  // Find the matching generic specialization based on the concrete parameter
+  // list.
+  CallableNode* matching_callable = nullptr;
+  SpecializationKey matching_key;
+  Signature signature_with_types = MakeSignature(decl->signature.get());
+  for (Generic* generic : generic_list->list()) {
+    SpecializationKey key = {generic, GetTypeVector(decl->generic_parameters)};
+    CallableNode* callable_candidate = generic->declaration()->callable;
+    // Abuse the Specialization nodes' scope to temporarily declare the
+    // specialization aliases for the generic types to compare signatures. This
+    // scope is never used for anything else, so it's OK to pollute it.
+    Declarations::CleanNodeScopeActivator specialization_activator(
+        declarations(), decl);
+    DeclareSpecializedTypes(key);
+    Signature generic_signature_with_types =
+        MakeSignature(generic->declaration()->callable->signature.get());
+    if (signature_with_types.HasSameTypesAs(generic_signature_with_types)) {
+      if (matching_callable != nullptr) {
+        std::stringstream stream;
+        stream << "specialization of " << callable_candidate->name
+               << " is ambigous, it matches more than one generic declaration ("
+               << *matching_key.first << " and " << *key.first << ")";
+        ReportError(stream.str());
+      }
+      matching_callable = callable_candidate;
+      matching_key = key;
+    }
+  }
+
+  if (matching_callable == nullptr) {
+    std::stringstream stream;
+    stream << "specialization of " << decl->name
+           << " doesn't match any generic declaration";
+    ReportError(stream.str());
+  }
+
+  // Make sure the declarations of the parameter types for the specialization
+  // are the ones from the matching generic.
+  {
+    Declarations::CleanNodeScopeActivator specialization_activator(
+        declarations(), decl);
+    DeclareSpecializedTypes(matching_key);
+  }
+
+  SpecializeGeneric({matching_key, matching_callable, decl->signature.get(),
+                     decl->body, decl->pos});
+}
+
+void DeclarationVisitor::Visit(ReturnStatement* stmt) {
+  if (stmt->value) {
+    Visit(*stmt->value);
+  }
+}
+
+void DeclarationVisitor::Visit(VarDeclarationStatement* stmt) {
+  std::string variable_name = stmt->name;
+  const Type* type = declarations()->GetType(stmt->type);
+  if (type->IsConstexpr()) {
+    ReportError("cannot declare variable with constexpr type");
+  }
+  declarations()->DeclareVariable(variable_name, type);
+  if (global_context_.verbose()) {
+    std::cout << "declared variable " << variable_name << " with type " << *type
+              << "\n";
+  }
+  if (stmt->initializer) {
+    Visit(*stmt->initializer);
+    if (global_context_.verbose()) {
+      std::cout << "variable has initialization expression at "
+                << CurrentPositionAsString() << "\n";
+    }
+  }
+}
+
+void DeclarationVisitor::Visit(LogicalOrExpression* expr) {
+  {
+    Declarations::NodeScopeActivator scope(declarations(), expr->left);
+    declarations()->DeclareLabel(kFalseLabelName);
+    Visit(expr->left);
+  }
+  Visit(expr->right);
+}
+
+void DeclarationVisitor::Visit(LogicalAndExpression* expr) {
+  {
+    Declarations::NodeScopeActivator scope(declarations(), expr->left);
+    declarations()->DeclareLabel(kTrueLabelName);
+    Visit(expr->left);
+  }
+  Visit(expr->right);
+}
+
+void DeclarationVisitor::DeclareExpressionForBranch(Expression* node) {
+  Declarations::NodeScopeActivator scope(declarations(), node);
+  // Conditional expressions can either explicitly return a bit
+  // type, or they can be backed by macros that don't return but
+  // take a true and false label. By declaring the labels before
+  // visiting the conditional expression, those label-based
+  // macro conditionals will be able to find them through normal
+  // label lookups.
+  declarations()->DeclareLabel(kTrueLabelName);
+  declarations()->DeclareLabel(kFalseLabelName);
+  Visit(node);
+}
+
+void DeclarationVisitor::Visit(ConditionalExpression* expr) {
+  DeclareExpressionForBranch(expr->condition);
+  PushControlSplit();
+  Visit(expr->if_true);
+  Visit(expr->if_false);
+  auto changed_vars = PopControlSplit();
+  global_context_.AddControlSplitChangedVariables(
+      expr, declarations()->GetCurrentSpecializationTypeNamesVector(),
+      changed_vars);
+}
+
+void DeclarationVisitor::Visit(IfStatement* stmt) {
+  if (!stmt->is_constexpr) {
+    PushControlSplit();
+  }
+  DeclareExpressionForBranch(stmt->condition);
+  Visit(stmt->if_true);
+  if (stmt->if_false) Visit(*stmt->if_false);
+  if (!stmt->is_constexpr) {
+    auto changed_vars = PopControlSplit();
+    global_context_.AddControlSplitChangedVariables(
+        stmt, declarations()->GetCurrentSpecializationTypeNamesVector(),
+        changed_vars);
+  }
+}
+
+void DeclarationVisitor::Visit(WhileStatement* stmt) {
+  Declarations::NodeScopeActivator scope(declarations(), stmt);
+  DeclareExpressionForBranch(stmt->condition);
+  PushControlSplit();
+  Visit(stmt->body);
+  auto changed_vars = PopControlSplit();
+  global_context_.AddControlSplitChangedVariables(
+      stmt, declarations()->GetCurrentSpecializationTypeNamesVector(),
+      changed_vars);
+}
+
+void DeclarationVisitor::Visit(ForOfLoopStatement* stmt) {
+  // Scope for for iteration variable
+  Declarations::NodeScopeActivator scope(declarations(), stmt);
+  Visit(stmt->var_declaration);
+  Visit(stmt->iterable);
+  if (stmt->begin) Visit(*stmt->begin);
+  if (stmt->end) Visit(*stmt->end);
+  PushControlSplit();
+  Visit(stmt->body);
+  auto changed_vars = PopControlSplit();
+  global_context_.AddControlSplitChangedVariables(
+      stmt, declarations()->GetCurrentSpecializationTypeNamesVector(),
+      changed_vars);
+}
+
+void DeclarationVisitor::Visit(ForLoopStatement* stmt) {
+  Declarations::NodeScopeActivator scope(declarations(), stmt);
+  if (stmt->var_declaration) Visit(*stmt->var_declaration);
+  PushControlSplit();
+  DeclareExpressionForBranch(stmt->test);
+  Visit(stmt->body);
+  Visit(stmt->action);
+  auto changed_vars = PopControlSplit();
+  global_context_.AddControlSplitChangedVariables(
+      stmt, declarations()->GetCurrentSpecializationTypeNamesVector(),
+      changed_vars);
+}
+
+void DeclarationVisitor::Visit(TryLabelStatement* stmt) {
+  // Activate a new scope to declare handler labels, they should not be
+  // visible outside the label block.
+  {
+    Declarations::NodeScopeActivator scope(declarations(), stmt);
+
+    // Declare labels
+    for (LabelBlock* block : stmt->label_blocks) {
+      CurrentSourcePosition::Scope scope(block->pos);
+      Label* shared_label = declarations()->DeclareLabel(block->label);
+      {
+        Declarations::NodeScopeActivator scope(declarations(), block->body);
+        if (block->parameters.has_varargs) {
+          std::stringstream stream;
+          stream << "cannot use ... for label parameters";
+          ReportError(stream.str());
+        }
+
+        size_t i = 0;
+        for (auto p : block->parameters.names) {
+          shared_label->AddVariable(declarations()->DeclareVariable(
+              p, declarations()->GetType(block->parameters.types[i])));
+          ++i;
+        }
+      }
+      if (global_context_.verbose()) {
+        std::cout << " declaring label " << block->label << "\n";
+      }
+    }
+
+    Visit(stmt->try_block);
+  }
+
+  for (LabelBlock* block : stmt->label_blocks) {
+    Visit(block->body);
+  }
+}
+
+void DeclarationVisitor::GenerateHeader(std::string& file_name) {
+  std::stringstream new_contents_stream;
+  new_contents_stream
+      << "#ifndef V8_BUILTINS_BUILTIN_DEFINITIONS_FROM_DSL_H_\n"
+         "#define V8_BUILTINS_BUILTIN_DEFINITIONS_FROM_DSL_H_\n"
+         "\n"
+         "#define BUILTIN_LIST_FROM_DSL(CPP, API, TFJ, TFC, TFS, TFH, ASM) "
+         "\\\n";
+  for (auto builtin : torque_builtins_) {
+    int firstParameterIndex = 1;
+    bool declareParameters = true;
+    if (builtin->IsStub()) {
+      new_contents_stream << "TFS(" << builtin->name();
+    } else {
+      new_contents_stream << "TFJ(" << builtin->name();
+      if (builtin->IsVarArgsJavaScript()) {
+        new_contents_stream
+            << ", SharedFunctionInfo::kDontAdaptArgumentsSentinel";
+        declareParameters = false;
+      } else {
+        assert(builtin->IsFixedArgsJavaScript());
+        // FixedArg javascript builtins need to offer the parameter
+        // count.
+        assert(builtin->parameter_names().size() >= 2);
+        new_contents_stream << ", " << (builtin->parameter_names().size() - 2);
+        // And the receiver is explicitly declared.
+        new_contents_stream << ", kReceiver";
+        firstParameterIndex = 2;
+      }
+    }
+    if (declareParameters) {
+      int index = 0;
+      for (auto parameter : builtin->parameter_names()) {
+        if (index >= firstParameterIndex) {
+          new_contents_stream << ", k" << CamelifyString(parameter);
+        }
+        index++;
+      }
+    }
+    new_contents_stream << ") \\\n";
+  }
+  new_contents_stream
+      << "\n"
+         "#endif  // V8_BUILTINS_BUILTIN_DEFINITIONS_FROM_DSL_H_\n";
+
+  std::string new_contents(new_contents_stream.str());
+  ReplaceFileContentsIfDifferent(file_name, new_contents);
+}
+
+void DeclarationVisitor::Visit(IdentifierExpression* expr) {
+  if (expr->generic_arguments.size() != 0) {
+    TypeVector specialization_types;
+    for (auto t : expr->generic_arguments) {
+      specialization_types.push_back(declarations()->GetType(t));
+    }
+    // Specialize all versions of the generic, since the exact parameter type
+    // list cannot be resolved until the call's parameter expressions are
+    // evaluated. This is an overly conservative but simple way to make sure
+    // that the correct specialization exists.
+    for (auto generic : declarations()->LookupGeneric(expr->name)->list()) {
+      CallableNode* callable = generic->declaration()->callable;
+      if (generic->declaration()->body) {
+        QueueGenericSpecialization({generic, specialization_types}, callable,
+                                   callable->signature.get(),
+                                   generic->declaration()->body);
+      }
+    }
+  }
+}
+
+void DeclarationVisitor::Visit(CallExpression* expr) {
+  Visit(&expr->callee);
+  for (Expression* arg : expr->arguments) Visit(arg);
+}
+
+void DeclarationVisitor::Visit(TypeDeclaration* decl) {
+  std::string generates = decl->generates ? *decl->generates : std::string("");
+  const AbstractType* type = declarations()->DeclareAbstractType(
+      decl->name, generates, {}, decl->extends);
+
+  if (decl->constexpr_generates) {
+    std::string constexpr_name = CONSTEXPR_TYPE_PREFIX + decl->name;
+    base::Optional<std::string> constexpr_extends;
+    if (decl->extends)
+      constexpr_extends = CONSTEXPR_TYPE_PREFIX + *decl->extends;
+    declarations()->DeclareAbstractType(
+        constexpr_name, *decl->constexpr_generates, type, constexpr_extends);
+  }
+}
+
+void DeclarationVisitor::MarkLocationModified(Expression* location) {
+  if (IdentifierExpression* id = IdentifierExpression::cast(location)) {
+    const Value* value = declarations()->LookupValue(id->name);
+    if (value->IsVariable()) {
+      const Variable* variable = Variable::cast(value);
+      bool was_live = MarkVariableModified(variable);
+      if (was_live && global_context_.verbose()) {
+        std::cout << *variable << " was modified in control split at "
+                  << PositionAsString(id->pos) << "\n";
+      }
+    }
+  }
+}
+
+bool DeclarationVisitor::MarkVariableModified(const Variable* variable) {
+  auto e = live_and_changed_variables_.rend();
+  auto c = live_and_changed_variables_.rbegin();
+  bool was_live_in_preceeding_split = false;
+  while (c != e) {
+    if (c->live.find(variable) != c->live.end()) {
+      c->changed.insert(variable);
+      was_live_in_preceeding_split = true;
+    }
+    c++;
+  }
+  return was_live_in_preceeding_split;
+}
+
+void DeclarationVisitor::DeclareSignature(const Signature& signature) {
+  auto type_iterator = signature.parameter_types.types.begin();
+  for (auto name : signature.parameter_names) {
+    const Type* t(*type_iterator++);
+    if (name.size() != 0) {
+      declarations()->DeclareParameter(name, GetParameterVariableFromName(name),
+                                       t);
+    }
+  }
+  for (auto& label : signature.labels) {
+    auto label_params = label.types;
+    Label* new_label = declarations()->DeclareLabel(label.name);
+    size_t i = 0;
+    for (auto var_type : label_params) {
+      std::string var_name = label.name + std::to_string(i++);
+      new_label->AddVariable(
+          declarations()->DeclareVariable(var_name, var_type));
+    }
+  }
+}
+
+void DeclarationVisitor::DeclareSpecializedTypes(const SpecializationKey& key) {
+  size_t i = 0;
+  Generic* generic = key.first;
+  const std::size_t generic_parameter_count =
+      generic->declaration()->generic_parameters.size();
+  if (generic_parameter_count != key.second.size()) {
+    std::stringstream stream;
+    stream << "Wrong generic argument count for specialization of \""
+           << generic->name() << "\", expected: " << generic_parameter_count
+           << ", actual: " << key.second.size();
+    ReportError(stream.str());
+  }
+
+  for (auto type : key.second) {
+    std::string generic_type_name =
+        generic->declaration()->generic_parameters[i++];
+    declarations()->DeclareType(generic_type_name, type);
+  }
+}
+
+void DeclarationVisitor::Specialize(const SpecializationKey& key,
+                                    CallableNode* callable,
+                                    const CallableNodeSignature* signature,
+                                    Statement* body) {
+  Generic* generic = key.first;
+
+  // TODO(tebbi): The error should point to the source position where the
+  // instantiation was requested.
+  CurrentSourcePosition::Scope pos_scope(generic->declaration()->pos);
+  size_t generic_parameter_count =
+      generic->declaration()->generic_parameters.size();
+  if (generic_parameter_count != key.second.size()) {
+    std::stringstream stream;
+    stream << "number of template parameters ("
+           << std::to_string(key.second.size())
+           << ") to intantiation of generic " << callable->name
+           << " doesnt match the generic's declaration ("
+           << std::to_string(generic_parameter_count) << ")";
+    ReportError(stream.str());
+  }
+
+  Signature type_signature;
+  {
+    // Manually activate the specialized generic's scope when declaring the
+    // generic parameter specializations.
+    Declarations::GenericScopeActivator namespace_scope(declarations(), key);
+    DeclareSpecializedTypes(key);
+    type_signature = MakeSignature(signature);
+  }
+
+  Visit(callable, type_signature, body);
+}
+
+}  // namespace torque
+}  // namespace internal
+}  // namespace v8
diff --git a/deps/v8/src/torque/declaration-visitor.h b/deps/v8/src/torque/declaration-visitor.h
new file mode 100644
index 00000000000000..3299dc501fc56f
--- /dev/null
+++ b/deps/v8/src/torque/declaration-visitor.h
@@ -0,0 +1,181 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef V8_TORQUE_DECLARATION_VISITOR_H_
+#define V8_TORQUE_DECLARATION_VISITOR_H_
+
+#include <set>
+#include <string>
+
+#include "src/base/macros.h"
+#include "src/torque/declarations.h"
+#include "src/torque/file-visitor.h"
+#include "src/torque/global-context.h"
+#include "src/torque/scope.h"
+#include "src/torque/types.h"
+#include "src/torque/utils.h"
+
+namespace v8 {
+namespace internal {
+namespace torque {
+
+class DeclarationVisitor : public FileVisitor {
+ public:
+  explicit DeclarationVisitor(GlobalContext& global_context)
+      : FileVisitor(global_context),
+        scope_(declarations(), global_context.GetDefaultModule()) {}
+
+  void Visit(Ast* ast) {
+    Visit(ast->default_module());
+    DrainSpecializationQueue();
+  }
+
+  void Visit(Expression* expr);
+  void Visit(Statement* stmt);
+  void Visit(Declaration* decl);
+
+  void Visit(ModuleDeclaration* decl) {
+    ScopedModuleActivator activator(this, decl->GetModule());
+    Declarations::ModuleScopeActivator scope(declarations(), decl->GetModule());
+    for (Declaration* child : decl->declarations) Visit(child);
+  }
+  void Visit(DefaultModuleDeclaration* decl) {
+    decl->SetModule(global_context_.GetDefaultModule());
+    Visit(implicit_cast<ModuleDeclaration*>(decl));
+  }
+  void Visit(ExplicitModuleDeclaration* decl) {
+    decl->SetModule(global_context_.GetModule(decl->name));
+    Visit(implicit_cast<ModuleDeclaration*>(decl));
+  }
+
+  void Visit(IdentifierExpression* expr);
+  void Visit(NumberLiteralExpression* expr) {}
+  void Visit(StringLiteralExpression* expr) {}
+  void Visit(CallExpression* expr);
+  void Visit(ElementAccessExpression* expr) {
+    Visit(expr->array);
+    Visit(expr->index);
+  }
+  void Visit(FieldAccessExpression* expr) { Visit(expr->object); }
+  void Visit(BlockStatement* expr) {
+    Declarations::NodeScopeActivator scope(declarations(), expr);
+    for (Statement* stmt : expr->statements) Visit(stmt);
+  }
+  void Visit(ExpressionStatement* stmt) { Visit(stmt->expression); }
+  void Visit(TailCallStatement* stmt) { Visit(stmt->call); }
+  void Visit(TypeDeclaration* decl);
+
+  void Visit(TypeAliasDeclaration* decl) {
+    const Type* type = declarations()->GetType(decl->type);
+    type->AddAlias(decl->name);
+    declarations()->DeclareType(decl->name, type);
+  }
+
+  Builtin* BuiltinDeclarationCommon(BuiltinDeclaration* decl, bool external,
+                                    const Signature& signature);
+
+  void Visit(ExternalBuiltinDeclaration* decl, const Signature& signature,
+             Statement* body) {
+    BuiltinDeclarationCommon(decl, true, signature);
+  }
+
+  void Visit(ExternalRuntimeDeclaration* decl, const Signature& sig,
+             Statement* body);
+  void Visit(ExternalMacroDeclaration* decl, const Signature& sig,
+             Statement* body);
+  void Visit(TorqueBuiltinDeclaration* decl, const Signature& signature,
+             Statement* body);
+  void Visit(TorqueMacroDeclaration* decl, const Signature& signature,
+             Statement* body);
+
+  void Visit(CallableNode* decl, const Signature& signature, Statement* body);
+
+  void Visit(StandardDeclaration* decl);
+  void Visit(GenericDeclaration* decl);
+  void Visit(SpecializationDeclaration* decl);
+  void Visit(ReturnStatement* stmt);
+
+  void Visit(DebugStatement* stmt) {}
+  void Visit(AssertStatement* stmt) {
+    bool do_check = !stmt->debug_only;
+#if defined(DEBUG)
+    do_check = true;
+#endif
+    if (do_check) DeclareExpressionForBranch(stmt->expression);
+  }
+
+  void Visit(VarDeclarationStatement* stmt);
+
+  void Visit(ExternConstDeclaration* decl) {
+    // TODO(szuend): When module-wide const bindings are available, only
+    //               constexpr types should be allowed here.
+    declarations()->DeclareConstant(
+        decl->name, declarations()->GetType(decl->type), decl->literal);
+  }
+
+  void Visit(LogicalOrExpression* expr);
+  void Visit(LogicalAndExpression* expr);
+  void DeclareExpressionForBranch(Expression* node);
+
+  void Visit(ConditionalExpression* expr);
+  void Visit(IfStatement* stmt);
+  void Visit(WhileStatement* stmt);
+  void Visit(ForOfLoopStatement* stmt);
+
+  void Visit(AssignmentExpression* expr) {
+    MarkLocationModified(expr->location);
+    Visit(expr->location);
+    Visit(expr->value);
+  }
+
+  void Visit(BreakStatement* stmt) {}
+  void Visit(ContinueStatement* stmt) {}
+  void Visit(GotoStatement* expr) {}
+  void Visit(ForLoopStatement* stmt);
+
+  void Visit(IncrementDecrementExpression* expr) {
+    MarkLocationModified(expr->location);
+    Visit(expr->location);
+  }
+
+  void Visit(TryLabelStatement* stmt);
+  void GenerateHeader(std::string& file_name);
+
+ private:
+  struct LiveAndChanged {
+    std::set<const Variable*> live;
+    std::set<const Variable*> changed;
+  };
+
+  void PushControlSplit() {
+    LiveAndChanged live_and_changed;
+    live_and_changed.live = declarations()->GetLiveVariables();
+    live_and_changed_variables_.push_back(live_and_changed);
+  }
+
+  std::set<const Variable*> PopControlSplit() {
+    auto result = live_and_changed_variables_.back().changed;
+    live_and_changed_variables_.pop_back();
+    return result;
+  }
+
+  void MarkLocationModified(Expression* location);
+  bool MarkVariableModified(const Variable* variable);
+  void DeclareSignature(const Signature& signature);
+  void DeclareSpecializedTypes(const SpecializationKey& key);
+
+  void Specialize(const SpecializationKey& key, CallableNode* callable,
+                  const CallableNodeSignature* signature,
+                  Statement* body) override;
+
+  Declarations::ModuleScopeActivator scope_;
+  std::vector<Builtin*> torque_builtins_;
+  std::vector<LiveAndChanged> live_and_changed_variables_;
+};
+
+}  // namespace torque
+}  // namespace internal
+}  // namespace v8
+
+#endif  // V8_TORQUE_DECLARATION_VISITOR_H_
diff --git a/deps/v8/src/torque/declarations.cc b/deps/v8/src/torque/declarations.cc
new file mode 100644
index 00000000000000..4108914f8d0c1a
--- /dev/null
+++ b/deps/v8/src/torque/declarations.cc
@@ -0,0 +1,353 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "src/torque/declarations.h"
+#include "src/torque/declarable.h"
+#include "src/torque/type-oracle.h"
+
+namespace v8 {
+namespace internal {
+namespace torque {
+
+Scope* Declarations::GetModuleScope(const Module* module) {
+  auto i = module_scopes_.find(module);
+  if (i != module_scopes_.end()) return i->second;
+  Scope* result = chain_.NewScope();
+  module_scopes_[module] = result;
+  return result;
+}
+
+Scope* Declarations::GetNodeScope(const AstNode* node, bool reset_scope) {
+  std::pair<const AstNode*, TypeVector> key(
+      node, current_generic_specialization_ == nullptr
+                ? TypeVector()
+                : current_generic_specialization_->second);
+  if (!reset_scope) {
+    auto i = scopes_.find(key);
+    if (i != scopes_.end()) return i->second;
+  }
+  Scope* result = chain_.NewScope();
+  scopes_[key] = result;
+  return result;
+}
+
+Scope* Declarations::GetGenericScope(Generic* generic,
+                                     const TypeVector& types) {
+  std::pair<const AstNode*, TypeVector> key(generic->declaration()->callable,
+                                            types);
+  auto i = scopes_.find(key);
+  if (i != scopes_.end()) return i->second;
+  Scope* result = chain_.NewScope();
+  scopes_[key] = result;
+  return result;
+}
+
+void Declarations::CheckAlreadyDeclared(const std::string& name,
+                                        const char* new_type) {
+  auto i = chain_.ShallowLookup(name);
+  if (i != nullptr) {
+    std::stringstream s;
+    s << "cannot redeclare " << name << " (type " << new_type << ")";
+    ReportError(s.str());
+  }
+}
+
+const Type* Declarations::LookupType(const std::string& name) {
+  Declarable* raw = Lookup(name);
+  if (raw->IsTypeAlias()) {
+    return TypeAlias::cast(raw)->type();
+  }
+  std::stringstream s;
+  s << "declaration \"" << name << "\" is not a Type";
+  ReportError(s.str());
+  return nullptr;
+}
+
+const Type* Declarations::LookupGlobalType(const std::string& name) {
+  Declarable* raw = LookupGlobalScope(name);
+  if (!raw->IsTypeAlias()) {
+    std::stringstream s;
+    s << "declaration \"" << name << "\" is not a Type";
+    ReportError(s.str());
+  }
+  return TypeAlias::cast(raw)->type();
+}
+
+const Type* Declarations::GetType(TypeExpression* type_expression) {
+  if (auto* basic = BasicTypeExpression::DynamicCast(type_expression)) {
+    std::string name =
+        (basic->is_constexpr ? CONSTEXPR_TYPE_PREFIX : "") + basic->name;
+    return LookupType(name);
+  } else if (auto* union_type = UnionTypeExpression::cast(type_expression)) {
+    return TypeOracle::GetUnionType(GetType(union_type->a),
+                                    GetType(union_type->b));
+  } else {
+    auto* function_type_exp = FunctionTypeExpression::cast(type_expression);
+    TypeVector argument_types;
+    for (TypeExpression* type_exp : function_type_exp->parameters.types) {
+      argument_types.push_back(GetType(type_exp));
+    }
+    return TypeOracle::GetFunctionPointerType(
+        argument_types, GetType(function_type_exp->return_type));
+  }
+}
+
+Builtin* Declarations::FindSomeInternalBuiltinWithType(
+    const FunctionPointerType* type) {
+  for (auto& declarable : declarables_) {
+    if (Builtin* builtin = Builtin::DynamicCast(declarable.get())) {
+      if (!builtin->IsExternal() && builtin->kind() == Builtin::kStub &&
+          builtin->signature().return_type == type->return_type() &&
+          builtin->signature().parameter_types.types ==
+              type->parameter_types()) {
+        return builtin;
+      }
+    }
+  }
+  return nullptr;
+}
+
+Value* Declarations::LookupValue(const std::string& name) {
+  Declarable* d = Lookup(name);
+  if (!d->IsValue()) {
+    std::stringstream s;
+    s << "declaration \"" << name << "\" is not a Value";
+    ReportError(s.str());
+  }
+  return Value::cast(d);
+}
+
+Label* Declarations::LookupLabel(const std::string& name) {
+  Declarable* d = Lookup(name);
+  if (!d->IsLabel()) {
+    std::stringstream s;
+    s << "declaration \"" << name << "\" is not a Label";
+    ReportError(s.str());
+  }
+  return Label::cast(d);
+}
+
+Macro* Declarations::TryLookupMacro(const std::string& name,
+                                    const TypeVector& types) {
+  Declarable* declarable = TryLookup(name);
+  if (declarable != nullptr) {
+    if (declarable->IsMacroList()) {
+      for (auto& m : MacroList::cast(declarable)->list()) {
+        if (m->signature().parameter_types.types == types &&
+            !m->signature().parameter_types.var_args) {
+          return m;
+        }
+      }
+    }
+  }
+  return nullptr;
+}
+
+Macro* Declarations::LookupMacro(const std::string& name,
+                                 const TypeVector& types) {
+  Macro* result = TryLookupMacro(name, types);
+  if (result != nullptr) return result;
+  std::stringstream stream;
+  stream << "macro " << name << " with parameter types " << types
+         << " is not defined";
+  ReportError(stream.str());
+  return nullptr;
+}
+
+Builtin* Declarations::LookupBuiltin(const std::string& name) {
+  Declarable* declarable = Lookup(name);
+  if (declarable != nullptr) {
+    if (declarable->IsBuiltin()) {
+      return Builtin::cast(declarable);
+    }
+    ReportError(name + " is not a builtin");
+  }
+  ReportError(std::string("builtin ") + name + " is not defined");
+  return nullptr;
+}
+
+GenericList* Declarations::LookupGeneric(const std::string& name) {
+  Declarable* declarable_list = Lookup(name);
+  if (declarable_list != nullptr) {
+    if (declarable_list->IsGenericList()) {
+      return GenericList::cast(declarable_list);
+    }
+    ReportError(name + " is not a generic");
+  }
+  ReportError(std::string("generic ") + name + " is not defined");
+  return nullptr;
+}
+
+const AbstractType* Declarations::DeclareAbstractType(
+    const std::string& name, const std::string& generated,
+    base::Optional<const AbstractType*> non_constexpr_version,
+    const base::Optional<std::string>& parent) {
+  CheckAlreadyDeclared(name, "type");
+  const Type* parent_type = nullptr;
+  if (parent) {
+    Declarable* maybe_parent_type = Lookup(*parent);
+    if (maybe_parent_type == nullptr) {
+      std::stringstream s;
+      s << "cannot find parent type \"" << *parent << "\"";
+      ReportError(s.str());
+    }
+    if (!maybe_parent_type->IsTypeAlias()) {
+      std::stringstream s;
+      s << "parent \"" << *parent << "\" of type \"" << name << "\""
+        << " is not a type";
+      ReportError(s.str());
+    }
+    parent_type = TypeAlias::cast(maybe_parent_type)->type();
+  }
+  const AbstractType* type = TypeOracle::GetAbstractType(
+      parent_type, name, generated, non_constexpr_version);
+  DeclareType(name, type);
+  return type;
+}
+
+void Declarations::DeclareType(const std::string& name, const Type* type) {
+  CheckAlreadyDeclared(name, "type");
+  TypeAlias* result = new TypeAlias(type);
+  Declare(name, std::unique_ptr<TypeAlias>(result));
+}
+
+Label* Declarations::DeclareLabel(const std::string& name) {
+  CheckAlreadyDeclared(name, "label");
+  Label* result = new Label(name);
+  Declare(name, std::unique_ptr<Declarable>(result));
+  return result;
+}
+
+MacroList* Declarations::GetMacroListForName(const std::string& name,
+                                             const Signature& signature) {
+  auto previous = chain_.Lookup(name);
+  MacroList* macro_list = nullptr;
+  if (previous == nullptr) {
+    macro_list = new MacroList();
+    Declare(name, std::unique_ptr<Declarable>(macro_list));
+  } else if (!previous->IsMacroList()) {
+    std::stringstream s;
+    s << "cannot redeclare non-macro " << name << " as a macro";
+    ReportError(s.str());
+  } else {
+    macro_list = MacroList::cast(previous);
+  }
+  for (auto& macro : macro_list->list()) {
+    if (signature.parameter_types.types ==
+            macro->signature().parameter_types.types &&
+        signature.parameter_types.var_args ==
+            macro->signature().parameter_types.var_args) {
+      std::stringstream s;
+      s << "cannot redeclare " << name
+        << " as a macro with identical parameter list "
+        << signature.parameter_types;
+      ReportError(s.str());
+    }
+  }
+  return macro_list;
+}
+
+Macro* Declarations::DeclareMacro(const std::string& name,
+                                  const Signature& signature,
+                                  base::Optional<std::string> op) {
+  Macro* macro =
+      RegisterDeclarable(std::unique_ptr<Macro>(new Macro(name, signature)));
+  GetMacroListForName(name, signature)->AddMacro(macro);
+  if (op) GetMacroListForName(*op, signature)->AddMacro(macro);
+  return macro;
+}
+
+Builtin* Declarations::DeclareBuiltin(const std::string& name,
+                                      Builtin::Kind kind, bool external,
+                                      const Signature& signature) {
+  CheckAlreadyDeclared(name, "builtin");
+  Builtin* result = new Builtin(name, kind, external, signature);
+  Declare(name, std::unique_ptr<Declarable>(result));
+  return result;
+}
+
+RuntimeFunction* Declarations::DeclareRuntimeFunction(
+    const std::string& name, const Signature& signature) {
+  CheckAlreadyDeclared(name, "runtime function");
+  RuntimeFunction* result = new RuntimeFunction(name, signature);
+  Declare(name, std::unique_ptr<Declarable>(result));
+  return result;
+}
+
+Variable* Declarations::DeclareVariable(const std::string& var,
+                                        const Type* type) {
+  std::string name(var + std::to_string(GetNextUniqueDeclarationNumber()));
+  CheckAlreadyDeclared(var, "variable");
+  Variable* result = new Variable(var, name, type);
+  Declare(var, std::unique_ptr<Declarable>(result));
+  return result;
+}
+
+Parameter* Declarations::DeclareParameter(const std::string& name,
+                                          const std::string& var_name,
+                                          const Type* type) {
+  CheckAlreadyDeclared(name, "parameter");
+  Parameter* result = new Parameter(name, type, var_name);
+  Declare(name, std::unique_ptr<Declarable>(result));
+  return result;
+}
+
+Label* Declarations::DeclarePrivateLabel(const std::string& raw_name) {
+  std::string name =
+      raw_name + "_" + std::to_string(GetNextUniqueDeclarationNumber());
+  CheckAlreadyDeclared(name, "label");
+  Label* result = new Label(name);
+  Declare(name, std::unique_ptr<Declarable>(result));
+  return result;
+}
+
+void Declarations::DeclareConstant(const std::string& name, const Type* type,
+                                   const std::string& value) {
+  CheckAlreadyDeclared(name, "constant, parameter or arguments");
+  Constant* result = new Constant(name, type, value);
+  Declare(name, std::unique_ptr<Declarable>(result));
+}
+
+Generic* Declarations::DeclareGeneric(const std::string& name, Module* module,
+                                      GenericDeclaration* generic) {
+  auto previous = chain_.Lookup(name);
+  GenericList* generic_list = nullptr;
+  if (previous == nullptr) {
+    generic_list = new GenericList();
+    Declare(name, std::unique_ptr<Declarable>(generic_list));
+  } else if (!previous->IsGenericList()) {
+    std::stringstream s;
+    s << "cannot redeclare non-generic " << name << " as a generic";
+    ReportError(s.str());
+  } else {
+    generic_list = GenericList::cast(previous);
+  }
+  Generic* result = RegisterDeclarable(
+      std::unique_ptr<Generic>(new Generic(name, module, generic)));
+  generic_list->AddGeneric(result);
+  generic_declaration_scopes_[result] = GetScopeChainSnapshot();
+  return result;
+}
+
+TypeVector Declarations::GetCurrentSpecializationTypeNamesVector() {
+  TypeVector result;
+  if (current_generic_specialization_ != nullptr) {
+    result = current_generic_specialization_->second;
+  }
+  return result;
+}
+
+std::string GetGeneratedCallableName(const std::string& name,
+                                     const TypeVector& specialized_types) {
+  std::string result = name;
+  for (auto type : specialized_types) {
+    std::string type_string = type->MangledName();
+    result += std::to_string(type_string.size()) + type_string;
+  }
+  return result;
+}
+
+}  // namespace torque
+}  // namespace internal
+}  // namespace v8
diff --git a/deps/v8/src/torque/declarations.h b/deps/v8/src/torque/declarations.h
new file mode 100644
index 00000000000000..04d5f62410ab5b
--- /dev/null
+++ b/deps/v8/src/torque/declarations.h
@@ -0,0 +1,225 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef V8_TORQUE_DECLARATIONS_H_
+#define V8_TORQUE_DECLARATIONS_H_
+
+#include <string>
+
+#include "src/torque/declarable.h"
+#include "src/torque/scope.h"
+#include "src/torque/utils.h"
+
+namespace v8 {
+namespace internal {
+namespace torque {
+
+static constexpr const char* const kFromConstexprMacroName = "from_constexpr";
+static constexpr const char* kTrueLabelName = "_True";
+static constexpr const char* kFalseLabelName = "_False";
+
+class Declarations {
+ public:
+  Declarations()
+      : unique_declaration_number_(0),
+        current_generic_specialization_(nullptr) {}
+
+  Declarable* TryLookup(const std::string& name) { return chain_.Lookup(name); }
+
+  Declarable* Lookup(const std::string& name) {
+    Declarable* d = TryLookup(name);
+    if (d == nullptr) {
+      std::stringstream s;
+      s << "cannot find \"" << name << "\"";
+      ReportError(s.str());
+    }
+    return d;
+  }
+
+  Declarable* LookupGlobalScope(const std::string& name) {
+    Declarable* d = chain_.LookupGlobalScope(name);
+    if (d == nullptr) {
+      std::stringstream s;
+      s << "cannot find \"" << name << "\" in global scope";
+      ReportError(s.str());
+    }
+    return d;
+  }
+
+  const Type* LookupType(const std::string& name);
+  const Type* LookupGlobalType(const std::string& name);
+  const Type* GetType(TypeExpression* type_expression);
+
+  Builtin* FindSomeInternalBuiltinWithType(const FunctionPointerType* type);
+
+  Value* LookupValue(const std::string& name);
+
+  Macro* TryLookupMacro(const std::string& name, const TypeVector& types);
+  Macro* LookupMacro(const std::string& name, const TypeVector& types);
+
+  Builtin* LookupBuiltin(const std::string& name);
+
+  Label* TryLookupLabel(const std::string& name) {
+    Declarable* d = TryLookup(name);
+    return d && d->IsLabel() ? Label::cast(d) : nullptr;
+  }
+  Label* LookupLabel(const std::string& name);
+
+  GenericList* LookupGeneric(const std::string& name);
+
+  const AbstractType* DeclareAbstractType(
+      const std::string& name, const std::string& generated,
+      base::Optional<const AbstractType*> non_constexpr_version,
+      const base::Optional<std::string>& parent = {});
+
+  void DeclareType(const std::string& name, const Type* type);
+
+  Label* DeclareLabel(const std::string& name);
+
+  Macro* DeclareMacro(const std::string& name, const Signature& signature,
+                      base::Optional<std::string> op = {});
+
+  Builtin* DeclareBuiltin(const std::string& name, Builtin::Kind kind,
+                          bool external, const Signature& signature);
+
+  RuntimeFunction* DeclareRuntimeFunction(const std::string& name,
+                                          const Signature& signature);
+
+  Variable* DeclareVariable(const std::string& var, const Type* type);
+
+  Parameter* DeclareParameter(const std::string& name,
+                              const std::string& mangled_name,
+                              const Type* type);
+
+  Label* DeclarePrivateLabel(const std::string& name);
+
+  void DeclareConstant(const std::string& name, const Type* type,
+                       const std::string& value);
+
+  Generic* DeclareGeneric(const std::string& name, Module* module,
+                          GenericDeclaration* generic);
+
+  TypeVector GetCurrentSpecializationTypeNamesVector();
+
+  ScopeChain::Snapshot GetScopeChainSnapshot() { return chain_.TaskSnapshot(); }
+
+  std::set<const Variable*> GetLiveVariables() {
+    return chain_.GetLiveVariables();
+  }
+
+  Statement* next_body() const { return next_body_; }
+
+  void PrintScopeChain() { chain_.Print(); }
+
+  class ModuleScopeActivator;
+  class NodeScopeActivator;
+  class CleanNodeScopeActivator;
+  class GenericScopeActivator;
+  class ScopedGenericSpecializationKey;
+  class ScopedGenericScopeChainSnapshot;
+
+ private:
+  Scope* GetModuleScope(const Module* module);
+  Scope* GetNodeScope(const AstNode* node, bool reset_scope = false);
+  Scope* GetGenericScope(Generic* generic, const TypeVector& types);
+
+  template <class T>
+  T* RegisterDeclarable(std::unique_ptr<T> d) {
+    T* ptr = d.get();
+    declarables_.push_back(std::move(d));
+    return ptr;
+  }
+
+  MacroList* GetMacroListForName(const std::string& name,
+                                 const Signature& signature);
+
+  void Declare(const std::string& name, std::unique_ptr<Declarable> d) {
+    chain_.Declare(name, RegisterDeclarable(std::move(d)));
+  }
+
+  int GetNextUniqueDeclarationNumber() { return unique_declaration_number_++; }
+
+  void CheckAlreadyDeclared(const std::string& name, const char* new_type);
+
+  int unique_declaration_number_;
+  ScopeChain chain_;
+  const SpecializationKey* current_generic_specialization_;
+  Statement* next_body_;
+  std::vector<std::unique_ptr<Declarable>> declarables_;
+  std::map<const Module*, Scope*> module_scopes_;
+  std::map<std::pair<const AstNode*, TypeVector>, Scope*> scopes_;
+  std::map<Generic*, ScopeChain::Snapshot> generic_declaration_scopes_;
+};
+
+class Declarations::NodeScopeActivator {
+ public:
+  NodeScopeActivator(Declarations* declarations, AstNode* node)
+      : activator_(declarations->GetNodeScope(node)) {}
+
+ private:
+  Scope::Activator activator_;
+};
+
+class Declarations::ModuleScopeActivator {
+ public:
+  ModuleScopeActivator(Declarations* declarations, const Module* module)
+      : activator_(declarations->GetModuleScope(module)) {}
+
+ private:
+  Scope::Activator activator_;
+};
+
+class Declarations::CleanNodeScopeActivator {
+ public:
+  CleanNodeScopeActivator(Declarations* declarations, AstNode* node)
+      : activator_(declarations->GetNodeScope(node, true)) {}
+
+ private:
+  Scope::Activator activator_;
+};
+
+class Declarations::GenericScopeActivator {
+ public:
+  GenericScopeActivator(Declarations* declarations,
+                        const SpecializationKey& key)
+      : activator_(declarations->GetGenericScope(key.first, key.second)) {}
+
+ private:
+  Scope::Activator activator_;
+};
+
+class Declarations::ScopedGenericSpecializationKey {
+ public:
+  ScopedGenericSpecializationKey(Declarations* declarations,
+                                 const SpecializationKey& key)
+      : declarations_(declarations) {
+    declarations->current_generic_specialization_ = &key;
+  }
+  ~ScopedGenericSpecializationKey() {
+    declarations_->current_generic_specialization_ = nullptr;
+  }
+
+ private:
+  Declarations* declarations_;
+};
+
+class Declarations::ScopedGenericScopeChainSnapshot {
+ public:
+  ScopedGenericScopeChainSnapshot(Declarations* declarations,
+                                  const SpecializationKey& key)
+      : restorer_(declarations->generic_declaration_scopes_[key.first]) {}
+  ~ScopedGenericScopeChainSnapshot() {}
+
+ private:
+  ScopeChain::ScopedSnapshotRestorer restorer_;
+};
+
+std::string GetGeneratedCallableName(const std::string& name,
+                                     const TypeVector& specialized_types);
+
+}  // namespace torque
+}  // namespace internal
+}  // namespace v8
+
+#endif  // V8_TORQUE_DECLARATIONS_H_
diff --git a/deps/v8/src/torque/file-visitor.cc b/deps/v8/src/torque/file-visitor.cc
new file mode 100644
index 00000000000000..3ff7cd9baa3d87
--- /dev/null
+++ b/deps/v8/src/torque/file-visitor.cc
@@ -0,0 +1,76 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "src/torque/file-visitor.h"
+
+#include "src/torque/declarable.h"
+#include "src/torque/parameter-difference.h"
+
+namespace v8 {
+namespace internal {
+namespace torque {
+
+Signature FileVisitor::MakeSignature(const CallableNodeSignature* signature) {
+  LabelDeclarationVector definition_vector;
+  for (auto label : signature->labels) {
+    LabelDeclaration def = {label.name, GetTypeVector(label.types)};
+    definition_vector.push_back(def);
+  }
+  Signature result{signature->parameters.names,
+                   {GetTypeVector(signature->parameters.types),
+                    signature->parameters.has_varargs},
+                   declarations()->GetType(signature->return_type),
+                   definition_vector};
+  return result;
+}
+
+void FileVisitor::QueueGenericSpecialization(
+    const SpecializationKey& key, CallableNode* callable,
+    const CallableNodeSignature* signature, base::Optional<Statement*> body) {
+  pending_specializations_.push_back(
+      {key, callable, signature, body, CurrentSourcePosition::Get()});
+}
+
+void FileVisitor::SpecializeGeneric(
+    const PendingSpecialization& specialization) {
+  CurrentSourcePosition::Scope scope(specialization.request_position);
+  if (completed_specializations_.find(specialization.key) !=
+      completed_specializations_.end()) {
+    std::stringstream stream;
+    stream << "cannot redeclare specialization of "
+           << specialization.key.first->name() << " with types <"
+           << specialization.key.second << ">";
+    ReportError(stream.str());
+  }
+  if (!specialization.body) {
+    std::stringstream stream;
+    stream << "missing specialization of " << specialization.key.first->name()
+           << " with types <" << specialization.key.second << ">";
+    ReportError(stream.str());
+  }
+  Declarations::ScopedGenericSpecializationKey instantiation(
+      declarations(), specialization.key);
+  FileVisitor::ScopedModuleActivator activator(
+      this, specialization.key.first->module());
+  Specialize(specialization.key, specialization.callable,
+             specialization.signature, *specialization.body);
+  completed_specializations_.insert(specialization.key);
+}
+
+void FileVisitor::DrainSpecializationQueue() {
+  while (pending_specializations_.size() != 0) {
+    PendingSpecialization specialization(pending_specializations_.front());
+    pending_specializations_.pop_front();
+    if (completed_specializations_.find(specialization.key) ==
+        completed_specializations_.end()) {
+      Declarations::ScopedGenericScopeChainSnapshot scope(declarations(),
+                                                          specialization.key);
+      SpecializeGeneric(specialization);
+    }
+  }
+}
+
+}  // namespace torque
+}  // namespace internal
+}  // namespace v8
diff --git a/deps/v8/src/torque/file-visitor.h b/deps/v8/src/torque/file-visitor.h
new file mode 100644
index 00000000000000..0c5faae3b44f56
--- /dev/null
+++ b/deps/v8/src/torque/file-visitor.h
@@ -0,0 +1,101 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef V8_TORQUE_FILE_VISITOR_H_
+#define V8_TORQUE_FILE_VISITOR_H_
+
+#include <deque>
+#include <string>
+
+#include "src/torque/ast.h"
+#include "src/torque/global-context.h"
+#include "src/torque/types.h"
+#include "src/torque/utils.h"
+
+#include "src/torque/TorqueBaseVisitor.h"
+
+namespace v8 {
+namespace internal {
+namespace torque {
+
+class FileVisitor {
+ public:
+  explicit FileVisitor(GlobalContext& global_context)
+      : global_context_(global_context),
+        declarations_(global_context.declarations()),
+        module_(global_context.GetDefaultModule()) {}
+
+  TypeVector GetTypeVector(const std::vector<TypeExpression*>& v) {
+    TypeVector result;
+    for (TypeExpression* t : v) {
+      result.push_back(declarations()->GetType(t));
+    }
+    return result;
+  }
+
+  Ast* ast() { return global_context_.ast(); }
+  Declarations* declarations() { return global_context_.declarations(); }
+
+  void DrainSpecializationQueue();
+
+  class ScopedModuleActivator {
+   public:
+    ScopedModuleActivator(FileVisitor* visitor, Module* module)
+        : visitor_(visitor), saved_module_(visitor->CurrentModule()) {
+      visitor->module_ = module;
+    }
+    ~ScopedModuleActivator() { visitor_->module_ = saved_module_; }
+
+   private:
+    FileVisitor* visitor_;
+    Module* saved_module_;
+  };
+
+ protected:
+  static constexpr const char* kReturnValueVariable = "_return";
+  static constexpr const char* kDoneLabelName = "_done";
+  static constexpr const char* kForIndexValueVariable = "_for_index";
+
+  Module* CurrentModule() const { return module_; }
+
+  friend class ScopedModuleActivator;
+
+  std::string GetParameterVariableFromName(const std::string& name) {
+    return std::string("p_") + name;
+  }
+
+  Signature MakeSignature(const CallableNodeSignature* signature);
+
+  struct PendingSpecialization {
+    SpecializationKey key;
+    CallableNode* callable;
+    const CallableNodeSignature* signature;
+    base::Optional<Statement*> body;
+    SourcePosition request_position;
+  };
+
+  void QueueGenericSpecialization(const SpecializationKey& key,
+                                  CallableNode* callable,
+                                  const CallableNodeSignature* signature,
+                                  base::Optional<Statement*> body);
+
+  void SpecializeGeneric(const PendingSpecialization& specialization);
+
+  virtual void Specialize(const SpecializationKey&, CallableNode* callable,
+                          const CallableNodeSignature* signature,
+                          Statement* body) = 0;
+
+  GlobalContext& global_context_;
+  Declarations* declarations_;
+  std::deque<PendingSpecialization> pending_specializations_;
+  std::set<SpecializationKey> completed_specializations_;
+  Callable* current_callable_;
+  Module* module_;
+};
+
+}  // namespace torque
+}  // namespace internal
+}  // namespace v8
+
+#endif  // V8_TORQUE_FILE_VISITOR_H_
diff --git a/deps/v8/src/torque/global-context.h b/deps/v8/src/torque/global-context.h
new file mode 100644
index 00000000000000..4dc55349508781
--- /dev/null
+++ b/deps/v8/src/torque/global-context.h
@@ -0,0 +1,159 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef V8_TORQUE_GLOBAL_CONTEXT_H_
+#define V8_TORQUE_GLOBAL_CONTEXT_H_
+
+#include "src/torque/TorqueLexer.h"
+#include "src/torque/TorqueParser.h"
+#include "src/torque/declarable.h"
+#include "src/torque/declarations.h"
+#include "src/torque/scope.h"
+#include "src/torque/type-oracle.h"
+
+namespace v8 {
+namespace internal {
+namespace torque {
+
+class GlobalContext;
+class Scope;
+class TypeOracle;
+
+class Module {
+ public:
+  explicit Module(const std::string& name, bool is_default)
+      : name_(name), is_default_(is_default) {}
+  const std::string& name() const { return name_; }
+  bool IsDefault() const { return is_default_; }
+  std::ostream& source_stream() { return source_stream_; }
+  std::ostream& header_stream() { return header_stream_; }
+  std::string source() { return source_stream_.str(); }
+  std::string header() { return header_stream_.str(); }
+
+ private:
+  std::string name_;
+  bool is_default_;
+  std::stringstream header_stream_;
+  std::stringstream source_stream_;
+};
+
+struct SourceFileContext {
+  std::string name;
+  std::unique_ptr<antlr4::ANTLRFileStream> stream;
+  std::unique_ptr<TorqueLexer> lexer;
+  std::unique_ptr<antlr4::CommonTokenStream> tokens;
+  std::unique_ptr<TorqueParser> parser;
+  TorqueParser::FileContext* file;
+};
+
+class GlobalContext {
+ public:
+  explicit GlobalContext(Ast ast)
+      : verbose_(false),
+        next_label_number_(0),
+        default_module_(GetModule("base", true)),
+        ast_(std::move(ast)) {}
+  Module* GetDefaultModule() { return default_module_; }
+  Module* GetModule(const std::string& name, bool is_default = false) {
+    auto i = modules_.find(name);
+    if (i != modules_.end()) {
+      return i->second.get();
+    }
+    Module* module = new Module(name, is_default);
+    modules_[name] = std::unique_ptr<Module>(module);
+    return module;
+  }
+
+  int GetNextLabelNumber() { return next_label_number_++; }
+
+  const std::map<std::string, std::unique_ptr<Module>>& GetModules() const {
+    return modules_;
+  }
+
+  void SetVerbose() { verbose_ = true; }
+  bool verbose() const { return verbose_; }
+
+  void AddControlSplitChangedVariables(const AstNode* node,
+                                       const TypeVector& specialization_types,
+                                       const std::set<const Variable*>& vars) {
+    auto key = std::make_pair(node, specialization_types);
+    control_split_changed_variables_[key] = vars;
+  }
+
+  const std::set<const Variable*>& GetControlSplitChangedVariables(
+      const AstNode* node, const TypeVector& specialization_types) {
+    auto key = std::make_pair(node, specialization_types);
+    assert(control_split_changed_variables_.find(key) !=
+           control_split_changed_variables_.end());
+    return control_split_changed_variables_.find(key)->second;
+  }
+
+  void MarkVariableChanged(const AstNode* node,
+                           const TypeVector& specialization_types,
+                           Variable* var) {
+    auto key = std::make_pair(node, specialization_types);
+    control_split_changed_variables_[key].insert(var);
+  }
+
+  friend class CurrentCallableActivator;
+  friend class BreakContinueActivator;
+
+  Callable* GetCurrentCallable() const { return current_callable_; }
+  Label* GetCurrentBreak() const { return break_continue_stack_.back().first; }
+  Label* GetCurrentContinue() const {
+    return break_continue_stack_.back().second;
+  }
+
+  Declarations* declarations() { return &declarations_; }
+  Ast* ast() { return &ast_; }
+
+ private:
+  bool verbose_;
+  int next_label_number_;
+  Declarations declarations_;
+  Callable* current_callable_;
+  std::vector<std::pair<Label*, Label*>> break_continue_stack_;
+  std::map<std::string, std::unique_ptr<Module>> modules_;
+  Module* default_module_;
+  std::map<std::pair<const AstNode*, TypeVector>, std::set<const Variable*>>
+      control_split_changed_variables_;
+  Ast ast_;
+};
+
+class CurrentCallableActivator {
+ public:
+  CurrentCallableActivator(GlobalContext& context, Callable* callable,
+                           CallableNode* decl)
+      : context_(context), scope_activator_(context.declarations(), decl) {
+    remembered_callable_ = context_.current_callable_;
+    context_.current_callable_ = callable;
+  }
+  ~CurrentCallableActivator() {
+    context_.current_callable_ = remembered_callable_;
+  }
+
+ private:
+  GlobalContext& context_;
+  Callable* remembered_callable_;
+  Declarations::NodeScopeActivator scope_activator_;
+};
+
+class BreakContinueActivator {
+ public:
+  BreakContinueActivator(GlobalContext& context, Label* break_label,
+                         Label* continue_label)
+      : context_(context) {
+    context_.break_continue_stack_.push_back({break_label, continue_label});
+  }
+  ~BreakContinueActivator() { context_.break_continue_stack_.pop_back(); }
+
+ private:
+  GlobalContext& context_;
+};
+
+}  // namespace torque
+}  // namespace internal
+}  // namespace v8
+
+#endif  // V8_TORQUE_GLOBAL_CONTEXT_H_
diff --git a/deps/v8/src/torque/implementation-visitor.cc b/deps/v8/src/torque/implementation-visitor.cc
new file mode 100644
index 00000000000000..72c7efff20fa8f
--- /dev/null
+++ b/deps/v8/src/torque/implementation-visitor.cc
@@ -0,0 +1,1769 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "src/torque/implementation-visitor.h"
+#include "src/torque/parameter-difference.h"
+
+#include "include/v8.h"
+
+namespace v8 {
+namespace internal {
+namespace torque {
+
+VisitResult ImplementationVisitor::Visit(Expression* expr) {
+  CurrentSourcePosition::Scope scope(expr->pos);
+  switch (expr->kind) {
+#define ENUM_ITEM(name)        \
+  case AstNode::Kind::k##name: \
+    return Visit(name::cast(expr));
+    AST_EXPRESSION_NODE_KIND_LIST(ENUM_ITEM)
+#undef ENUM_ITEM
+    default:
+      UNIMPLEMENTED();
+  }
+  return VisitResult();
+}
+
+const Type* ImplementationVisitor::Visit(Statement* stmt) {
+  CurrentSourcePosition::Scope scope(stmt->pos);
+  GenerateIndent();
+  source_out() << "// " << CurrentPositionAsString() << "\n";
+  switch (stmt->kind) {
+#define ENUM_ITEM(name)        \
+  case AstNode::Kind::k##name: \
+    return Visit(name::cast(stmt));
+    AST_STATEMENT_NODE_KIND_LIST(ENUM_ITEM)
+#undef ENUM_ITEM
+    default:
+      UNIMPLEMENTED();
+  }
+  UNREACHABLE();
+  return nullptr;
+}
+
+void ImplementationVisitor::Visit(Declaration* decl) {
+  CurrentSourcePosition::Scope scope(decl->pos);
+  switch (decl->kind) {
+#define ENUM_ITEM(name)        \
+  case AstNode::Kind::k##name: \
+    return Visit(name::cast(decl));
+    AST_DECLARATION_NODE_KIND_LIST(ENUM_ITEM)
+#undef ENUM_ITEM
+    default:
+      UNIMPLEMENTED();
+  }
+}
+
+void ImplementationVisitor::Visit(CallableNode* decl,
+                                  const Signature& signature, Statement* body) {
+  switch (decl->kind) {
+#define ENUM_ITEM(name)        \
+  case AstNode::Kind::k##name: \
+    return Visit(name::cast(decl), signature, body);
+    AST_CALLABLE_NODE_KIND_LIST(ENUM_ITEM)
+#undef ENUM_ITEM
+    default:
+      UNIMPLEMENTED();
+  }
+}
+
+void ImplementationVisitor::BeginModuleFile(Module* module) {
+  std::ostream& source = module->source_stream();
+  std::ostream& header = module->header_stream();
+
+  if (module->IsDefault()) {
+    source << "#include \"src/code-stub-assembler.h\"";
+  } else {
+    source << "#include \"src/builtins/builtins-" +
+                  DashifyString(module->name()) + "-gen.h\"";
+  }
+  source << std::endl;
+  source << "#include \"src/builtins/builtins-utils-gen.h\"" << std::endl;
+  source << "#include \"src/builtins/builtins.h\"" << std::endl;
+  source << "#include \"src/code-factory.h\"" << std::endl;
+  source << "#include \"src/elements-kind.h\"" << std::endl;
+  source << "#include \"src/heap/factory-inl.h\"" << std::endl;
+  source << "#include \"src/objects.h\"" << std::endl;
+
+  source << "#include \"builtins-" + DashifyString(module->name()) +
+                "-from-dsl-gen.h\"";
+  source << std::endl << std::endl;
+
+  source << "namespace v8 {" << std::endl
+         << "namespace internal {" << std::endl
+         << "" << std::endl
+         << "using Node = compiler::Node;" << std::endl
+         << "" << std::endl;
+
+  std::string upper_name(module->name());
+  transform(upper_name.begin(), upper_name.end(), upper_name.begin(),
+            ::toupper);
+  std::string headerDefine =
+      std::string("V8_TORQUE_") + upper_name + "_FROM_DSL_BASE_H__";
+  header << "#ifndef " << headerDefine << std::endl;
+  header << "#define " << headerDefine << std::endl << std::endl;
+  if (module->IsDefault()) {
+    header << "#include \"src/code-stub-assembler.h\"";
+  } else {
+    header << "#include \"src/builtins/builtins-" +
+                  DashifyString(module->name()) + "-gen.h\""
+           << std::endl;
+  }
+  header << std::endl << std::endl;
+
+  header << "namespace v8 {" << std::endl
+         << "namespace internal {" << std::endl
+         << "" << std::endl;
+
+  header << "class " << GetDSLAssemblerName(module) << ": public "
+         << GetBaseAssemblerName(module) << " {" << std::endl;
+  header << " public:" << std::endl;
+  header << "  explicit " << GetDSLAssemblerName(module)
+         << "(compiler::CodeAssemblerState* state) : "
+         << GetBaseAssemblerName(module) << "(state) {}" << std::endl;
+
+  header << std::endl;
+  header << "  using Node = compiler::Node;" << std::endl;
+  header << "  template <class T>" << std::endl;
+  header << "  using TNode = compiler::TNode<T>;" << std::endl;
+  header << "  template <class T>" << std::endl;
+  header << "  using SloppyTNode = compiler::SloppyTNode<T>;" << std::endl
+         << std::endl;
+}
+
+void ImplementationVisitor::EndModuleFile(Module* module) {
+  std::ostream& source = module->source_stream();
+  std::ostream& header = module->header_stream();
+
+  DrainSpecializationQueue();
+
+  std::string upper_name(module->name());
+  transform(upper_name.begin(), upper_name.end(), upper_name.begin(),
+            ::toupper);
+  std::string headerDefine =
+      std::string("V8_TORQUE_") + upper_name + "_FROM_DSL_BASE_H__";
+
+  source << "}  // namepsace internal" << std::endl
+         << "}  // namespace v8" << std::endl
+         << "" << std::endl;
+
+  header << "};" << std::endl << "" << std::endl;
+  header << "}  // namepsace internal" << std::endl
+         << "}  // namespace v8" << std::endl
+         << "" << std::endl;
+  header << "#endif  // " << headerDefine << std::endl;
+}
+
+void ImplementationVisitor::Visit(ModuleDeclaration* decl) {
+  Module* module = decl->GetModule();
+  Module* saved_module = module_;
+  module_ = module;
+  Declarations::ModuleScopeActivator scope(declarations(), decl->GetModule());
+  for (auto& child : decl->declarations) Visit(child);
+  module_ = saved_module;
+}
+
+void ImplementationVisitor::Visit(TorqueMacroDeclaration* decl,
+                                  const Signature& sig, Statement* body) {
+  Signature signature = MakeSignature(decl->signature.get());
+  std::string name = GetGeneratedCallableName(
+      decl->name, declarations()->GetCurrentSpecializationTypeNamesVector());
+  const TypeVector& list = signature.types();
+  Macro* macro = declarations()->LookupMacro(name, list);
+
+  CurrentCallableActivator activator(global_context_, macro, decl);
+
+  if (body != nullptr) {
+    header_out() << "  ";
+    GenerateMacroFunctionDeclaration(header_out(), "", macro);
+    header_out() << ";" << std::endl;
+
+    GenerateMacroFunctionDeclaration(
+        source_out(), GetDSLAssemblerName(CurrentModule()) + "::", macro);
+    source_out() << " {" << std::endl;
+
+    const Variable* result_var = nullptr;
+    if (macro->HasReturnValue()) {
+      result_var =
+          GenerateVariableDeclaration(decl, kReturnValueVariable, {}, {});
+    }
+    Label* macro_end = declarations()->DeclareLabel("macro_end");
+    GenerateLabelDefinition(macro_end, decl);
+
+    const Type* result = Visit(body);
+    if (result->IsNever()) {
+      if (!macro->signature().return_type->IsNever() && !macro->HasReturns()) {
+        std::stringstream s;
+        s << "macro " << decl->name
+          << " that never returns must have return type never";
+        ReportError(s.str());
+      }
+    } else {
+      if (macro->signature().return_type->IsNever()) {
+        std::stringstream s;
+        s << "macro " << decl->name
+          << " has implicit return at end of its declartion but return type "
+             "never";
+        ReportError(s.str());
+      } else if (!macro->signature().return_type->IsVoid()) {
+        std::stringstream s;
+        s << "macro " << decl->name
+          << " expects to return a value but doesn't on all paths";
+        ReportError(s.str());
+      }
+    }
+    if (macro->HasReturns()) {
+      if (!result->IsNever()) {
+        GenerateLabelGoto(macro_end);
+      }
+      GenerateLabelBind(macro_end);
+    }
+    if (result_var != nullptr) {
+      GenerateIndent();
+      source_out() << "return "
+                   << VisitResult(result_var->type(), result_var).RValue()
+                   << ";" << std::endl;
+    }
+    source_out() << "}" << std::endl << std::endl;
+  }
+}
+
+void ImplementationVisitor::Visit(TorqueBuiltinDeclaration* decl,
+                                  const Signature& signature, Statement* body) {
+  std::string name = GetGeneratedCallableName(
+      decl->name, declarations()->GetCurrentSpecializationTypeNamesVector());
+  source_out() << "TF_BUILTIN(" << name << ", "
+               << GetDSLAssemblerName(CurrentModule()) << ") {" << std::endl;
+  Builtin* builtin = declarations()->LookupBuiltin(name);
+  CurrentCallableActivator activator(global_context_, builtin, decl);
+
+  // Context
+  const Value* val =
+      declarations()->LookupValue(decl->signature->parameters.names[0]);
+  GenerateIndent();
+  source_out() << "TNode<Context> " << val->value()
+               << " = UncheckedCast<Context>(Parameter("
+               << "Descriptor::kContext));" << std::endl;
+  GenerateIndent();
+  source_out() << "USE(" << val->value() << ");" << std::endl;
+
+  size_t first = 1;
+  if (builtin->IsVarArgsJavaScript()) {
+    assert(decl->signature->parameters.has_varargs);
+    Constant* arguments = Constant::cast(declarations()->LookupValue(
+        decl->signature->parameters.arguments_variable));
+    std::string arguments_name = arguments->value();
+    GenerateIndent();
+    source_out()
+        << "Node* argc = Parameter(Descriptor::kJSActualArgumentsCount);"
+        << std::endl;
+    GenerateIndent();
+    source_out() << "CodeStubArguments arguments_impl(this, "
+                    "ChangeInt32ToIntPtr(argc));"
+                 << std::endl;
+    const Value* receiver =
+        declarations()->LookupValue(decl->signature->parameters.names[1]);
+    GenerateIndent();
+    source_out() << "TNode<Object> " << receiver->value()
+                 << " = arguments_impl.GetReceiver();" << std::endl;
+    GenerateIndent();
+    source_out() << "auto arguments = &arguments_impl;" << std::endl;
+    GenerateIndent();
+    source_out() << "USE(arguments);" << std::endl;
+    GenerateIndent();
+    source_out() << "USE(" << receiver->value() << ");" << std::endl;
+    first = 2;
+  }
+
+  GenerateParameterList(decl->signature->parameters.names, first);
+  Visit(body);
+  source_out() << "}" << std::endl << std::endl;
+}
+
+const Type* ImplementationVisitor::Visit(VarDeclarationStatement* stmt) {
+  base::Optional<VisitResult> init_result;
+  if (stmt->initializer) {
+    init_result = Visit(*stmt->initializer);
+  }
+  GenerateVariableDeclaration(stmt, stmt->name, {}, init_result);
+  return TypeOracle::GetVoidType();
+}
+
+const Type* ImplementationVisitor::Visit(TailCallStatement* stmt) {
+  return Visit(stmt->call, true).type();
+}
+
+VisitResult ImplementationVisitor::Visit(ConditionalExpression* expr) {
+  std::string f1 = NewTempVariable();
+  std::string f2 = NewTempVariable();
+
+  // The code for both paths of the conditional need to be generated first in
+  // lambdas before evaluating the conditional expression because the common
+  // type of the result of both the true and false of the condition needs to be
+  // known when declaring the variable to hold the result of the conditional.
+  VisitResult left, right;
+  GenerateIndent();
+  source_out() << "auto " << f1 << " = [=]() ";
+  {
+    ScopedIndent indent(this, false);
+    source_out() << "" << std::endl;
+    left = Visit(expr->if_true);
+    GenerateIndent();
+    source_out() << "return " << left.RValue() << ";" << std::endl;
+  }
+  source_out() << ";" << std::endl;
+  GenerateIndent();
+  source_out() << "auto " << f2 << " = [=]() ";
+  {
+    ScopedIndent indent(this, false);
+    source_out() << "" << std::endl;
+    right = Visit(expr->if_false);
+    GenerateIndent();
+    source_out() << "return " << right.RValue() << ";" << std::endl;
+  }
+  source_out() << ";" << std::endl;
+
+  const Type* common_type = GetCommonType(left.type(), right.type());
+  std::string result_var = NewTempVariable();
+  Variable* result = GenerateVariableDeclaration(expr, result_var, common_type);
+
+  {
+    ScopedIndent indent(this);
+    Declarations::NodeScopeActivator scope(declarations(), expr->condition);
+
+    Label* true_label = declarations()->LookupLabel(kTrueLabelName);
+    GenerateLabelDefinition(true_label);
+    Label* false_label = declarations()->LookupLabel(kFalseLabelName);
+    GenerateLabelDefinition(false_label);
+    Label* done_label = declarations()->DeclarePrivateLabel(kDoneLabelName);
+    GenerateLabelDefinition(done_label, expr);
+
+    VisitResult condition_result = Visit(expr->condition);
+    if (!condition_result.type()->IsNever()) {
+      condition_result =
+          GenerateImplicitConvert(TypeOracle::GetBoolType(), condition_result);
+      GenerateBranch(condition_result, true_label, false_label);
+    }
+    GenerateLabelBind(true_label);
+    GenerateIndent();
+    VisitResult left_result = {right.type(), f1 + "()"};
+    GenerateAssignToVariable(result, left_result);
+    GenerateLabelGoto(done_label);
+
+    GenerateLabelBind(false_label);
+    GenerateIndent();
+    VisitResult right_result = {right.type(), f2 + "()"};
+    GenerateAssignToVariable(result, right_result);
+    GenerateLabelGoto(done_label);
+
+    GenerateLabelBind(done_label);
+  }
+  return VisitResult(common_type, result);
+}
+
+VisitResult ImplementationVisitor::Visit(LogicalOrExpression* expr) {
+  VisitResult left_result;
+  {
+    Declarations::NodeScopeActivator scope(declarations(), expr->left);
+    Label* false_label = declarations()->LookupLabel(kFalseLabelName);
+    GenerateLabelDefinition(false_label);
+    left_result = Visit(expr->left);
+    if (left_result.type()->IsBool()) {
+      Label* true_label = declarations()->LookupLabel(kTrueLabelName);
+      GenerateIndent();
+      source_out() << "GotoIf(" << left_result.RValue() << ", "
+                   << true_label->generated() << ");" << std::endl;
+    } else if (!left_result.type()->IsConstexprBool()) {
+      GenerateLabelBind(false_label);
+    }
+  }
+  VisitResult right_result = Visit(expr->right);
+  if (right_result.type() != left_result.type()) {
+    std::stringstream stream;
+    stream << "types of left and right expression of logical OR don't match (\""
+           << *left_result.type() << "\" vs. \"" << *right_result.type()
+           << "\")";
+    ReportError(stream.str());
+  }
+  if (left_result.type()->IsConstexprBool()) {
+    return VisitResult(left_result.type(), std::string("(") +
+                                               left_result.RValue() + " || " +
+                                               right_result.RValue() + ")");
+  } else {
+    return right_result;
+  }
+}
+
+VisitResult ImplementationVisitor::Visit(LogicalAndExpression* expr) {
+  VisitResult left_result;
+  {
+    Declarations::NodeScopeActivator scope(declarations(), expr->left);
+    Label* true_label = declarations()->LookupLabel(kTrueLabelName);
+    GenerateLabelDefinition(true_label);
+    left_result = Visit(expr->left);
+    if (left_result.type()->IsBool()) {
+      Label* false_label = declarations()->LookupLabel(kFalseLabelName);
+      GenerateIndent();
+      source_out() << "GotoIfNot(" << left_result.RValue() << ", "
+                   << false_label->generated() << ");" << std::endl;
+    } else if (!left_result.type()->IsConstexprBool()) {
+      GenerateLabelBind(true_label);
+    }
+  }
+  VisitResult right_result = Visit(expr->right);
+  if (right_result.type() != left_result.type()) {
+    std::stringstream stream;
+    stream
+        << "types of left and right expression of logical AND don't match (\""
+        << *left_result.type() << "\" vs. \"" << *right_result.type() << "\")";
+    ReportError(stream.str());
+  }
+  if (left_result.type()->IsConstexprBool()) {
+    return VisitResult(left_result.type(), std::string("(") +
+                                               left_result.RValue() + " && " +
+                                               right_result.RValue() + ")");
+  } else {
+    return right_result;
+  }
+}
+
+VisitResult ImplementationVisitor::Visit(IncrementDecrementExpression* expr) {
+  VisitResult value_copy;
+  auto location_ref = GetLocationReference(expr->location);
+  VisitResult current_value =
+      GenerateFetchFromLocation(expr->location, location_ref);
+  if (expr->postfix) {
+    value_copy = GenerateCopy(current_value);
+  }
+  VisitResult one = {TypeOracle::GetConstInt31Type(), "1"};
+  Arguments args;
+  args.parameters = {current_value, one};
+  VisitResult assignment_value = GenerateCall(
+      expr->op == IncrementDecrementOperator::kIncrement ? "+" : "-", args);
+  GenerateAssignToLocation(expr->location, location_ref, assignment_value);
+  return expr->postfix ? value_copy : assignment_value;
+}
+
+VisitResult ImplementationVisitor::Visit(AssignmentExpression* expr) {
+  LocationReference location_ref = GetLocationReference(expr->location);
+  VisitResult assignment_value;
+  if (expr->op) {
+    VisitResult location_value =
+        GenerateFetchFromLocation(expr->location, location_ref);
+    assignment_value = Visit(expr->value);
+    Arguments args;
+    args.parameters = {assignment_value, assignment_value};
+    assignment_value = GenerateCall(*expr->op, args);
+    GenerateAssignToLocation(expr->location, location_ref, assignment_value);
+  } else {
+    assignment_value = Visit(expr->value);
+    GenerateAssignToLocation(expr->location, location_ref, assignment_value);
+  }
+  return assignment_value;
+}
+
+VisitResult ImplementationVisitor::Visit(NumberLiteralExpression* expr) {
+  // TODO(tebbi): Do not silently loose precision; support 64bit literals.
+  double d = std::stod(expr->number.c_str());
+  int32_t i = static_cast<int32_t>(d);
+  const Type* result_type =
+      declarations()->LookupType(CONST_FLOAT64_TYPE_STRING);
+  if (i == d) {
+    if ((i >> 30) == (i >> 31)) {
+      result_type = declarations()->LookupType(CONST_INT31_TYPE_STRING);
+    } else {
+      result_type = declarations()->LookupType(CONST_INT32_TYPE_STRING);
+    }
+  }
+  std::string temp = GenerateNewTempVariable(result_type);
+  source_out() << expr->number << ";" << std::endl;
+  return VisitResult{result_type, temp};
+}
+
+VisitResult ImplementationVisitor::Visit(StringLiteralExpression* expr) {
+  std::string temp = GenerateNewTempVariable(TypeOracle::GetConstStringType());
+  source_out() << "\"" << expr->literal.substr(1, expr->literal.size() - 2)
+               << "\";" << std::endl;
+  return VisitResult{TypeOracle::GetConstStringType(), temp};
+}
+
+VisitResult ImplementationVisitor::GetBuiltinCode(Builtin* builtin) {
+  if (builtin->IsExternal() || builtin->kind() != Builtin::kStub) {
+    ReportError(
+        "creating function pointers is only allowed for internal builtins with "
+        "stub linkage");
+  }
+  const Type* type = TypeOracle::GetFunctionPointerType(
+      builtin->signature().parameter_types.types,
+      builtin->signature().return_type);
+  std::string code =
+      "HeapConstant(Builtins::CallableFor(isolate(), Builtins::k" +
+      builtin->name() + ").code())";
+  return VisitResult(type, code);
+}
+
+VisitResult ImplementationVisitor::Visit(IdentifierExpression* expr) {
+  std::string name = expr->name;
+  if (expr->generic_arguments.size() != 0) {
+    GenericList* generic_list = declarations()->LookupGeneric(expr->name);
+    for (Generic* generic : generic_list->list()) {
+      TypeVector specialization_types = GetTypeVector(expr->generic_arguments);
+      name = GetGeneratedCallableName(name, specialization_types);
+      CallableNode* callable = generic->declaration()->callable;
+      QueueGenericSpecialization({generic, specialization_types}, callable,
+                                 callable->signature.get(),
+                                 generic->declaration()->body);
+    }
+  }
+
+  if (Builtin* builtin = Builtin::DynamicCast(declarations()->Lookup(name))) {
+    return GetBuiltinCode(builtin);
+  }
+
+  return GenerateFetchFromLocation(expr, GetLocationReference(expr));
+}
+
+const Type* ImplementationVisitor::Visit(GotoStatement* stmt) {
+  Label* label = declarations()->LookupLabel(stmt->label);
+
+  if (stmt->arguments.size() != label->GetParameterCount()) {
+    std::stringstream stream;
+    stream << "goto to label has incorrect number of parameters (expected "
+           << std::to_string(label->GetParameterCount()) << " found "
+           << std::to_string(stmt->arguments.size()) << ")";
+    ReportError(stream.str());
+  }
+
+  size_t i = 0;
+  for (Expression* e : stmt->arguments) {
+    VisitResult result = Visit(e);
+    Variable* var = label->GetParameter(i++);
+    GenerateAssignToVariable(var, result);
+  }
+
+  GenerateLabelGoto(label);
+  label->MarkUsed();
+  return TypeOracle::GetNeverType();
+}
+
+const Type* ImplementationVisitor::Visit(IfStatement* stmt) {
+  ScopedIndent indent(this);
+
+  bool has_else = stmt->if_false.has_value();
+
+  if (stmt->is_constexpr) {
+    VisitResult expression_result = Visit(stmt->condition);
+
+    if (!(expression_result.type() == TypeOracle::GetConstexprBoolType())) {
+      std::stringstream stream;
+      stream << "expression should return type constexpr bool "
+             << "but returns type " << *expression_result.type();
+      ReportError(stream.str());
+    }
+
+    const Type* left_result;
+    const Type* right_result = TypeOracle::GetVoidType();
+    {
+      GenerateIndent();
+      source_out() << "if ((" << expression_result.RValue() << ")) ";
+      ScopedIndent indent(this, false);
+      source_out() << std::endl;
+      left_result = Visit(stmt->if_true);
+    }
+
+    if (has_else) {
+      source_out() << " else ";
+      ScopedIndent indent(this, false);
+      source_out() << std::endl;
+      right_result = Visit(*stmt->if_false);
+    }
+    if (left_result->IsNever() != right_result->IsNever()) {
+      std::stringstream stream;
+      stream << "either both or neither branches in a constexpr if statement "
+                "must reach their end at"
+             << PositionAsString(stmt->pos);
+      ReportError(stream.str());
+    }
+
+    source_out() << std::endl;
+
+    return left_result;
+  } else {
+    Label* true_label = nullptr;
+    Label* false_label = nullptr;
+    {
+      Declarations::NodeScopeActivator scope(declarations(), &*stmt->condition);
+      true_label = declarations()->LookupLabel(kTrueLabelName);
+      GenerateLabelDefinition(true_label);
+      false_label = declarations()->LookupLabel(kFalseLabelName);
+      GenerateLabelDefinition(false_label, !has_else ? stmt : nullptr);
+    }
+
+    Label* done_label = nullptr;
+    bool live = false;
+    if (has_else) {
+      done_label = declarations()->DeclarePrivateLabel("if_done_label");
+      GenerateLabelDefinition(done_label, stmt);
+    } else {
+      done_label = false_label;
+      live = true;
+    }
+    std::vector<Statement*> blocks = {stmt->if_true};
+    std::vector<Label*> labels = {true_label, false_label};
+    if (has_else) blocks.push_back(*stmt->if_false);
+    if (GenerateExpressionBranch(stmt->condition, labels, blocks, done_label)) {
+      live = true;
+    }
+    if (live) {
+      GenerateLabelBind(done_label);
+    }
+    return live ? TypeOracle::GetVoidType() : TypeOracle::GetNeverType();
+  }
+}
+
+const Type* ImplementationVisitor::Visit(WhileStatement* stmt) {
+  ScopedIndent indent(this);
+
+  Label* body_label = nullptr;
+  Label* exit_label = nullptr;
+  {
+    Declarations::NodeScopeActivator scope(declarations(), stmt->condition);
+    body_label = declarations()->LookupLabel(kTrueLabelName);
+    GenerateLabelDefinition(body_label);
+    exit_label = declarations()->LookupLabel(kFalseLabelName);
+    GenerateLabelDefinition(exit_label);
+  }
+
+  Label* header_label = declarations()->DeclarePrivateLabel("header");
+  GenerateLabelDefinition(header_label, stmt);
+  GenerateLabelGoto(header_label);
+  GenerateLabelBind(header_label);
+
+  Declarations::NodeScopeActivator scope(declarations(), stmt->body);
+  BreakContinueActivator activator(global_context_, exit_label, header_label);
+
+  GenerateExpressionBranch(stmt->condition, {body_label, exit_label},
+                           {stmt->body}, header_label);
+
+  GenerateLabelBind(exit_label);
+  return TypeOracle::GetVoidType();
+}
+
+const Type* ImplementationVisitor::Visit(BlockStatement* block) {
+  Declarations::NodeScopeActivator scope(declarations(), block);
+  ScopedIndent indent(this);
+  const Type* type = TypeOracle::GetVoidType();
+  for (Statement* s : block->statements) {
+    if (type->IsNever()) {
+      std::stringstream stream;
+      stream << "statement after non-returning statement";
+      ReportError(stream.str());
+    }
+    type = Visit(s);
+  }
+  return type;
+}
+
+const Type* ImplementationVisitor::Visit(DebugStatement* stmt) {
+#if defined(DEBUG)
+  GenerateIndent();
+  source_out() << "Print(\""
+               << "halting because of '" << stmt->reason << "' at "
+               << PositionAsString(stmt->pos) << "\");" << std::endl;
+#endif
+  GenerateIndent();
+  if (stmt->never_continues) {
+    source_out() << "Unreachable();" << std::endl;
+    return TypeOracle::GetNeverType();
+  } else {
+    source_out() << "DebugBreak();" << std::endl;
+    return TypeOracle::GetVoidType();
+  }
+}
+
+namespace {
+
+std::string FormatAssertSource(const std::string& str) {
+  // Replace all whitespace characters with a space character.
+  std::string str_no_newlines = str;
+  std::replace_if(str_no_newlines.begin(), str_no_newlines.end(),
+                  [](unsigned char c) { return isspace(c); }, ' ');
+
+  // str might include indentation, squash multiple space characters into one.
+  std::string result;
+  std::unique_copy(str_no_newlines.begin(), str_no_newlines.end(),
+                   std::back_inserter(result),
+                   [](char a, char b) { return a == ' ' && b == ' '; });
+  return result;
+}
+
+}  // namespace
+
+const Type* ImplementationVisitor::Visit(AssertStatement* stmt) {
+  bool do_check = !stmt->debug_only;
+#if defined(DEBUG)
+  do_check = true;
+#endif
+  if (do_check) {
+    // CSA_ASSERT & co. are not used here on purpose for two reasons. First,
+    // Torque allows and handles two types of expressions in the if protocol
+    // automagically, ones that return TNode<BoolT> and those that use the
+    // BranchIf(..., Label* true, Label* false) idiom. Because the machinery to
+    // handle this is embedded in the expression handling and to it's not
+    // possible to make the decision to use CSA_ASSERT or CSA_ASSERT_BRANCH
+    // isn't trivial up-front. Secondly, on failure, the assert text should be
+    // the corresponding Torque code, not the -gen.cc code, which would be the
+    // case when using CSA_ASSERT_XXX.
+    Label* true_label = nullptr;
+    Label* false_label = nullptr;
+    Declarations::NodeScopeActivator scope(declarations(), stmt->expression);
+    true_label = declarations()->LookupLabel(kTrueLabelName);
+    GenerateLabelDefinition(true_label);
+    false_label = declarations()->LookupLabel(kFalseLabelName);
+    GenerateLabelDefinition(false_label);
+
+    VisitResult expression_result = Visit(stmt->expression);
+    if (expression_result.type() == TypeOracle::GetBoolType()) {
+      GenerateBranch(expression_result, true_label, false_label);
+    } else {
+      if (expression_result.type() != TypeOracle::GetNeverType()) {
+        std::stringstream s;
+        s << "unexpected return type " << *expression_result.type()
+          << " for branch expression";
+        ReportError(s.str());
+      }
+    }
+
+    GenerateLabelBind(false_label);
+    GenerateIndent();
+    source_out() << "Print(\""
+                 << "assert '" << FormatAssertSource(stmt->source)
+                 << "' failed at " << PositionAsString(stmt->pos) << "\");"
+                 << std::endl;
+    GenerateIndent();
+    source_out() << "Unreachable();" << std::endl;
+
+    GenerateLabelBind(true_label);
+  }
+  return TypeOracle::GetVoidType();
+}
+
+const Type* ImplementationVisitor::Visit(ExpressionStatement* stmt) {
+  const Type* type = Visit(stmt->expression).type();
+  return type->IsNever() ? type : TypeOracle::GetVoidType();
+}
+
+const Type* ImplementationVisitor::Visit(ReturnStatement* stmt) {
+  Callable* current_callable = global_context_.GetCurrentCallable();
+  if (current_callable->signature().return_type->IsNever()) {
+    std::stringstream s;
+    s << "cannot return from a function with return type never";
+    ReportError(s.str());
+  }
+  Label* end = current_callable->IsMacro()
+                   ? declarations()->LookupLabel("macro_end")
+                   : nullptr;
+  if (current_callable->HasReturnValue()) {
+    if (!stmt->value) {
+      std::stringstream s;
+      s << "return expression needs to be specified for a return type of "
+        << *current_callable->signature().return_type;
+      ReportError(s.str());
+    }
+    VisitResult expression_result = Visit(*stmt->value);
+    VisitResult return_result = GenerateImplicitConvert(
+        current_callable->signature().return_type, expression_result);
+    if (current_callable->IsMacro()) {
+      Variable* var =
+          Variable::cast(declarations()->LookupValue(kReturnValueVariable));
+      GenerateAssignToVariable(var, return_result);
+      GenerateLabelGoto(end);
+    } else if (current_callable->IsBuiltin()) {
+      if (Builtin::cast(current_callable)->IsVarArgsJavaScript()) {
+        GenerateIndent();
+        source_out() << "arguments->PopAndReturn(" << return_result.RValue()
+                     << ");" << std::endl;
+      } else {
+        GenerateIndent();
+        source_out() << "Return(" << return_result.RValue() << ");"
+                     << std::endl;
+      }
+    } else {
+      UNREACHABLE();
+    }
+  } else {
+    if (stmt->value) {
+      std::stringstream s;
+      s << "return expression can't be specified for a void or never return "
+           "type";
+      ReportError(s.str());
+    }
+    GenerateLabelGoto(end);
+  }
+  current_callable->IncrementReturns();
+  return TypeOracle::GetNeverType();
+}
+
+const Type* ImplementationVisitor::Visit(ForOfLoopStatement* stmt) {
+  Declarations::NodeScopeActivator scope(declarations(), stmt);
+
+  VisitResult expression_result = Visit(stmt->iterable);
+  VisitResult begin = stmt->begin
+                          ? Visit(*stmt->begin)
+                          : VisitResult(TypeOracle::GetConstInt31Type(), "0");
+
+  VisitResult end = stmt->end
+                        ? Visit(*stmt->end)
+                        : GenerateCall(".length", {{expression_result}, {}});
+
+  Label* body_label = declarations()->DeclarePrivateLabel("body");
+  GenerateLabelDefinition(body_label);
+  Label* increment_label = declarations()->DeclarePrivateLabel("increment");
+  GenerateLabelDefinition(increment_label);
+  Label* exit_label = declarations()->DeclarePrivateLabel("exit");
+  GenerateLabelDefinition(exit_label);
+
+  const Type* common_type = GetCommonType(begin.type(), end.type());
+  Variable* index_var = GenerateVariableDeclaration(
+      stmt, std::string(kForIndexValueVariable) + "_" + NewTempVariable(),
+      common_type, begin);
+
+  VisitResult index_for_read = {index_var->type(), index_var};
+
+  Label* header_label = declarations()->DeclarePrivateLabel("header");
+  GenerateLabelDefinition(header_label, stmt);
+
+  GenerateLabelGoto(header_label);
+
+  GenerateLabelBind(header_label);
+
+  BreakContinueActivator activator(global_context_, exit_label,
+                                   increment_label);
+
+  VisitResult result = GenerateCall("<", {{index_for_read, end}, {}});
+  GenerateBranch(result, body_label, exit_label);
+
+  GenerateLabelBind(body_label);
+  VisitResult element_result =
+      GenerateCall("[]", {{expression_result, index_for_read}, {}});
+  GenerateVariableDeclaration(stmt->var_declaration,
+                              stmt->var_declaration->name, {}, element_result);
+  Visit(stmt->body);
+  GenerateLabelGoto(increment_label);
+
+  GenerateLabelBind(increment_label);
+  Arguments increment_args;
+  increment_args.parameters = {index_for_read,
+                               {TypeOracle::GetConstInt31Type(), "1"}};
+  VisitResult increment_result = GenerateCall("+", increment_args);
+
+  GenerateAssignToVariable(index_var, increment_result);
+
+  GenerateLabelGoto(header_label);
+
+  GenerateLabelBind(exit_label);
+  return TypeOracle::GetVoidType();
+}
+
+const Type* ImplementationVisitor::Visit(TryLabelStatement* stmt) {
+  ScopedIndent indent(this);
+  Label* try_done = declarations()->DeclarePrivateLabel("try_done");
+  GenerateLabelDefinition(try_done);
+  const Type* try_result = TypeOracle::GetNeverType();
+  std::vector<Label*> labels;
+
+  // Output labels for the goto handlers and for the merge after the try.
+  {
+    // Activate a new scope to see handler labels
+    Declarations::NodeScopeActivator scope(declarations(), stmt);
+    for (LabelBlock* block : stmt->label_blocks) {
+      CurrentSourcePosition::Scope scope(block->pos);
+      Label* label = declarations()->LookupLabel(block->label);
+      labels.push_back(label);
+      GenerateLabelDefinition(label);
+    }
+
+    size_t i = 0;
+    for (auto label : labels) {
+      Declarations::NodeScopeActivator scope(declarations(),
+                                             stmt->label_blocks[i]->body);
+      for (auto& v : label->GetParameters()) {
+        GenerateVariableDeclaration(stmt, v->name(), v->type());
+        v->Define();
+      }
+      ++i;
+    }
+
+    Label* try_begin_label = declarations()->DeclarePrivateLabel("try_begin");
+    GenerateLabelDefinition(try_begin_label);
+    GenerateLabelGoto(try_begin_label);
+
+    // Visit try
+    if (GenerateLabeledStatementBlocks({stmt->try_block},
+                                       std::vector<Label*>({try_begin_label}),
+                                       try_done)) {
+      try_result = TypeOracle::GetVoidType();
+    }
+  }
+
+  // Make sure that each label clause is actually used. It's not just a friendly
+  // thing to do, it will cause problems downstream in the compiler if there are
+  // bound labels that are never jumped to.
+  auto label_iterator = stmt->label_blocks.begin();
+  for (auto label : labels) {
+    CurrentSourcePosition::Scope scope((*label_iterator)->pos);
+    if (!label->IsUsed()) {
+      std::stringstream s;
+      s << "label ";
+      s << (*label_iterator)->label;
+      s << " has a handler block but is never referred to in try block";
+      ReportError(s.str());
+    }
+    label_iterator++;
+  }
+
+  // Visit and output the code for each catch block, one-by-one.
+  std::vector<Statement*> bodies;
+  for (LabelBlock* block : stmt->label_blocks) bodies.push_back(block->body);
+  if (GenerateLabeledStatementBlocks(bodies, labels, try_done)) {
+    try_result = TypeOracle::GetVoidType();
+  }
+
+  if (!try_result->IsNever()) {
+    GenerateLabelBind(try_done);
+  }
+  return try_result;
+}
+
+const Type* ImplementationVisitor::Visit(BreakStatement* stmt) {
+  Label* break_label = global_context_.GetCurrentBreak();
+  if (break_label == nullptr) {
+    ReportError("break used outside of loop");
+  }
+  GenerateLabelGoto(break_label);
+  return TypeOracle::GetNeverType();
+}
+
+const Type* ImplementationVisitor::Visit(ContinueStatement* stmt) {
+  Label* continue_label = global_context_.GetCurrentContinue();
+  if (continue_label == nullptr) {
+    ReportError("continue used outside of loop");
+  }
+  GenerateLabelGoto(continue_label);
+  return TypeOracle::GetNeverType();
+}
+
+const Type* ImplementationVisitor::Visit(ForLoopStatement* stmt) {
+  Declarations::NodeScopeActivator scope(declarations(), stmt);
+
+  if (stmt->var_declaration) Visit(*stmt->var_declaration);
+
+  Label* body_label = nullptr;
+  Label* exit_label = nullptr;
+  {
+    Declarations::NodeScopeActivator scope(declarations(), stmt->test);
+    body_label = declarations()->LookupLabel(kTrueLabelName);
+    GenerateLabelDefinition(body_label);
+    exit_label = declarations()->LookupLabel(kFalseLabelName);
+    GenerateLabelDefinition(exit_label);
+  }
+
+  Label* header_label = declarations()->DeclarePrivateLabel("header");
+  GenerateLabelDefinition(header_label, stmt);
+  GenerateLabelGoto(header_label);
+  GenerateLabelBind(header_label);
+
+  Label* assignment_label = declarations()->DeclarePrivateLabel("assignment");
+  GenerateLabelDefinition(assignment_label);
+
+  BreakContinueActivator activator(global_context_, exit_label,
+                                   assignment_label);
+
+  std::vector<Label*> labels = {body_label, exit_label};
+  if (GenerateExpressionBranch(stmt->test, labels, {stmt->body},
+                               assignment_label)) {
+    ScopedIndent indent(this);
+    GenerateLabelBind(assignment_label);
+    Visit(stmt->action);
+    GenerateLabelGoto(header_label);
+  }
+
+  GenerateLabelBind(exit_label);
+  return TypeOracle::GetVoidType();
+}
+
+void ImplementationVisitor::GenerateImplementation(const std::string& dir,
+                                                   Module* module) {
+  std::string new_source(module->source());
+  std::string base_file_name =
+      "builtins-" + DashifyString(module->name()) + "-from-dsl-gen";
+
+  std::string source_file_name = dir + "/" + base_file_name + ".cc";
+  ReplaceFileContentsIfDifferent(source_file_name, new_source);
+  std::string new_header(module->header());
+  std::string header_file_name = dir + "/" + base_file_name + ".h";
+  ReplaceFileContentsIfDifferent(header_file_name, new_header);
+}
+
+std::string ImplementationVisitor::GetBaseAssemblerName(Module* module) {
+  if (module == global_context_.GetDefaultModule()) {
+    return "CodeStubAssembler";
+  } else {
+    std::string assembler_name(CamelifyString(module->name()) +
+                               "BuiltinsAssembler");
+    return assembler_name;
+  }
+}
+
+std::string ImplementationVisitor::GetDSLAssemblerName(Module* module) {
+  std::string assembler_name(CamelifyString(module->name()) +
+                             "BuiltinsFromDSLAssembler");
+  return assembler_name;
+}
+
+void ImplementationVisitor::GenerateIndent() {
+  for (size_t i = 0; i <= indent_; ++i) {
+    source_out() << "  ";
+  }
+}
+
+void ImplementationVisitor::GenerateMacroFunctionDeclaration(
+    std::ostream& o, const std::string& macro_prefix, Macro* macro) {
+  if (global_context_.verbose()) {
+    std::cout << "generating source for declaration " << *macro << ""
+              << std::endl;
+  }
+
+  // Quite a hack here. Make sure that TNode is namespace qualified if the
+  // macro name is also qualified.
+  std::string return_type_name(
+      macro->signature().return_type->GetGeneratedTypeName());
+  if (macro_prefix != "" && (return_type_name.length() > 5) &&
+      (return_type_name.substr(0, 5) == "TNode")) {
+    o << "compiler::";
+  }
+  o << return_type_name;
+  o << " " << macro_prefix << macro->name() << "(";
+
+  DCHECK_EQ(macro->signature().types().size(), macro->parameter_names().size());
+  auto type_iterator = macro->signature().types().begin();
+  bool first = true;
+  for (const std::string& name : macro->parameter_names()) {
+    if (!first) {
+      o << ", ";
+    }
+    const Value* parameter = declarations()->LookupValue(name);
+    const Type* parameter_type = *type_iterator;
+    const std::string& generated_type_name =
+        parameter_type->GetGeneratedTypeName();
+    o << generated_type_name << " " << parameter->value();
+    type_iterator++;
+    first = false;
+  }
+
+  for (const LabelDeclaration& label_info : macro->signature().labels) {
+    Label* label = declarations()->LookupLabel(label_info.name);
+    if (!first) {
+      o << ", ";
+    }
+    o << "Label* " << label->generated();
+    for (Variable* var : label->GetParameters()) {
+      std::string generated_type_name("TVariable<");
+      generated_type_name += var->type()->GetGeneratedTNodeTypeName();
+      generated_type_name += ">*";
+      o << ", ";
+      o << generated_type_name << " " << var->value();
+    }
+  }
+
+  o << ")";
+}
+
+namespace {
+
+void PrintMacroSignatures(std::stringstream& s, const std::string& name,
+                          const std::vector<Macro*>& macros) {
+  for (Macro* m : macros) {
+    s << "\n  " << name;
+    PrintSignature(s, m->signature(), false);
+  }
+}
+
+void FailMacroLookup(const std::string& reason, const std::string& name,
+                     const Arguments& arguments,
+                     const std::vector<Macro*>& candidates) {
+  std::stringstream stream;
+  stream << "\n"
+         << reason << ": \n  " << name << "("
+         << arguments.parameters.GetTypeVector() << ")";
+  if (arguments.labels.size() != 0) {
+    stream << " labels ";
+    for (auto l : arguments.labels) {
+      PrintLabel(stream, *l, false);
+    }
+  }
+  stream << "\ncandidates are:";
+  PrintMacroSignatures(stream, name, candidates);
+  ReportError(stream.str());
+}
+
+}  // namespace
+
+Callable* ImplementationVisitor::LookupCall(const std::string& name,
+                                            const Arguments& arguments) {
+  Callable* result = nullptr;
+  TypeVector parameter_types(arguments.parameters.GetTypeVector());
+  Declarable* declarable = declarations()->Lookup(name);
+  if (declarable->IsBuiltin()) {
+    result = Builtin::cast(declarable);
+  } else if (declarable->IsRuntimeFunction()) {
+    result = RuntimeFunction::cast(declarable);
+  } else if (declarable->IsMacroList()) {
+    std::vector<Macro*> candidates;
+    std::vector<Macro*> macros_with_same_name;
+    for (Macro* m : MacroList::cast(declarable)->list()) {
+      bool try_bool_context =
+          arguments.labels.size() == 0 &&
+          m->signature().return_type == TypeOracle::GetNeverType();
+      Label* true_label = nullptr;
+      Label* false_label = nullptr;
+      if (try_bool_context) {
+        true_label = declarations()->TryLookupLabel(kTrueLabelName);
+        false_label = declarations()->TryLookupLabel(kFalseLabelName);
+      }
+      if (IsCompatibleSignature(m->signature(), parameter_types,
+                                arguments.labels) ||
+          (true_label && false_label &&
+           IsCompatibleSignature(m->signature(), parameter_types,
+                                 {true_label, false_label}))) {
+        candidates.push_back(m);
+      } else {
+        macros_with_same_name.push_back(m);
+      }
+    }
+
+    if (candidates.empty() && macros_with_same_name.empty()) {
+      std::stringstream stream;
+      stream << "no matching declaration found for " << name;
+      ReportError(stream.str());
+    } else if (candidates.empty()) {
+      FailMacroLookup("cannot find macro with name", name, arguments,
+                      macros_with_same_name);
+    }
+
+    auto is_better_candidate = [&](Macro* a, Macro* b) {
+      return ParameterDifference(a->signature().parameter_types.types,
+                                 parameter_types)
+          .StrictlyBetterThan(ParameterDifference(
+              b->signature().parameter_types.types, parameter_types));
+    };
+
+    Macro* best = *std::min_element(candidates.begin(), candidates.end(),
+                                    is_better_candidate);
+    for (Macro* candidate : candidates) {
+      if (candidate != best && !is_better_candidate(best, candidate)) {
+        FailMacroLookup("ambiguous macro", name, arguments, candidates);
+      }
+    }
+    result = best;
+  } else {
+    std::stringstream stream;
+    stream << "can't call " << declarable->type_name() << " " << name
+           << " because it's not callable"
+           << ": call parameters were (" << parameter_types << ")";
+    ReportError(stream.str());
+  }
+
+  size_t caller_size = parameter_types.size();
+  size_t callee_size = result->signature().types().size();
+  if (caller_size != callee_size &&
+      !result->signature().parameter_types.var_args) {
+    std::stringstream stream;
+    stream << "parameter count mismatch calling " << *result << " - expected "
+           << std::to_string(callee_size) << ", found "
+           << std::to_string(caller_size);
+    ReportError(stream.str());
+  }
+
+  return result;
+}
+
+void ImplementationVisitor::GenerateChangedVarsFromControlSplit(AstNode* node) {
+  const std::set<const Variable*>& changed_vars =
+      global_context_.GetControlSplitChangedVariables(
+          node, declarations()->GetCurrentSpecializationTypeNamesVector());
+  source_out() << "{";
+  bool first = true;
+  for (auto v : changed_vars) {
+    if (v->type()->IsConstexpr()) continue;
+    if (first) {
+      first = false;
+    } else {
+      source_out() << ", ";
+    }
+    source_out() << v->value();
+  }
+  source_out() << "}";
+}
+
+const Type* ImplementationVisitor::GetCommonType(const Type* left,
+                                                 const Type* right) {
+  const Type* common_type;
+  if (IsAssignableFrom(left, right)) {
+    common_type = left;
+  } else if (IsAssignableFrom(right, left)) {
+    common_type = right;
+  } else {
+    common_type = TypeOracle::GetUnionType(left, right);
+  }
+  common_type = common_type->NonConstexprVersion();
+  return common_type;
+}
+
+VisitResult ImplementationVisitor::GenerateCopy(const VisitResult& to_copy) {
+  std::string temp = GenerateNewTempVariable(to_copy.type());
+  source_out() << to_copy.RValue() << ";" << std::endl;
+  GenerateIndent();
+  source_out() << "USE(" << temp << ");" << std::endl;
+  return VisitResult(to_copy.type(), temp);
+}
+
+LocationReference ImplementationVisitor::GetLocationReference(
+    LocationExpression* location) {
+  switch (location->kind) {
+    case AstNode::Kind::kIdentifierExpression:
+      return GetLocationReference(static_cast<IdentifierExpression*>(location));
+    case AstNode::Kind::kFieldAccessExpression:
+      return GetLocationReference(
+          static_cast<FieldAccessExpression*>(location));
+    case AstNode::Kind::kElementAccessExpression:
+      return GetLocationReference(
+          static_cast<ElementAccessExpression*>(location));
+    default:
+      UNREACHABLE();
+  }
+}
+
+VisitResult ImplementationVisitor::GenerateFetchFromLocation(
+    LocationExpression* location, LocationReference reference) {
+  switch (location->kind) {
+    case AstNode::Kind::kIdentifierExpression:
+      return GenerateFetchFromLocation(
+          static_cast<IdentifierExpression*>(location), reference);
+    case AstNode::Kind::kFieldAccessExpression:
+      return GenerateFetchFromLocation(
+          static_cast<FieldAccessExpression*>(location), reference);
+    case AstNode::Kind::kElementAccessExpression:
+      return GenerateFetchFromLocation(
+          static_cast<ElementAccessExpression*>(location), reference);
+    default:
+      UNREACHABLE();
+  }
+}
+
+void ImplementationVisitor::GenerateAssignToVariable(Variable* var,
+                                                     VisitResult value) {
+  VisitResult casted_value = GenerateImplicitConvert(var->type(), value);
+  GenerateIndent();
+  VisitResult variable_result = {var->type(), var};
+  source_out() << variable_result.LValue() << " = " << casted_value.RValue()
+               << ";\n";
+  var->Define();
+}
+
+void ImplementationVisitor::GenerateAssignToLocation(
+    LocationExpression* location, const LocationReference& reference,
+    VisitResult assignment_value) {
+  if (IdentifierExpression::cast(location)) {
+    Value* value = reference.value;
+    if (value->IsConst()) {
+      std::stringstream s;
+      s << "\"" << value->name()
+        << "\" is declared const (maybe implicitly) and cannot be assigned to";
+      ReportError(s.str());
+    }
+    Variable* var = Variable::cast(value);
+    GenerateAssignToVariable(var, assignment_value);
+  } else if (auto access = FieldAccessExpression::cast(location)) {
+    GenerateCall(std::string(".") + access->field + "=",
+                 {{reference.base, assignment_value}, {}});
+  } else {
+    DCHECK_NOT_NULL(ElementAccessExpression::cast(location));
+    GenerateCall("[]=",
+                 {{reference.base, reference.index, assignment_value}, {}});
+  }
+}
+
+Variable* ImplementationVisitor::GenerateVariableDeclaration(
+    AstNode* node, const std::string& name,
+    const base::Optional<const Type*>& type,
+    const base::Optional<VisitResult>& initialization) {
+
+  Variable* variable = nullptr;
+  if (declarations()->TryLookup(name)) {
+    variable = Variable::cast(declarations()->LookupValue(name));
+  } else {
+    variable = declarations()->DeclareVariable(name, *type);
+    // Because the variable is being defined during code generation, it must be
+    // assumed that it changes along all control split paths because it's no
+    // longer possible to run the control-flow anlaysis in the declaration pass
+    // over the variable.
+    global_context_.MarkVariableChanged(
+        node, declarations()->GetCurrentSpecializationTypeNamesVector(),
+        variable);
+  }
+
+  GenerateIndent();
+  if (variable->type()->IsConstexpr()) {
+    source_out() << variable->type()->GetGeneratedTypeName();
+    source_out() << " " << variable->value() << "_impl;" << std::endl;
+  } else {
+    source_out() << "TVARIABLE(";
+    source_out() << variable->type()->GetGeneratedTNodeTypeName();
+    source_out() << ", " << variable->value() << "_impl);" << std::endl;
+  }
+  GenerateIndent();
+  source_out() << "auto " << variable->value() << " = &" << variable->value()
+               << "_impl;" << std::endl;
+  GenerateIndent();
+  source_out() << "USE(" << variable->value() << ");" << std::endl;
+  if (initialization) {
+    GenerateAssignToVariable(variable, *initialization);
+  }
+  return variable;
+}
+
+void ImplementationVisitor::GenerateParameter(
+    const std::string& parameter_name) {
+  const Value* val = declarations()->LookupValue(parameter_name);
+  std::string var = val->value();
+  GenerateIndent();
+  source_out() << val->type()->GetGeneratedTypeName() << " " << var << " = ";
+
+  source_out() << "UncheckedCast<" << val->type()->GetGeneratedTNodeTypeName()
+               << ">(Parameter(Descriptor::k" << CamelifyString(parameter_name)
+               << "));" << std::endl;
+  GenerateIndent();
+  source_out() << "USE(" << var << ");" << std::endl;
+}
+
+void ImplementationVisitor::GenerateParameterList(const NameVector& list,
+                                                  size_t first) {
+  for (auto p : list) {
+    if (first == 0) {
+      GenerateParameter(p);
+    } else {
+      first--;
+    }
+  }
+}
+
+VisitResult ImplementationVisitor::GeneratePointerCall(
+    Expression* callee, const Arguments& arguments, bool is_tailcall) {
+  TypeVector parameter_types(arguments.parameters.GetTypeVector());
+  VisitResult callee_result = Visit(callee);
+  if (!callee_result.type()->IsFunctionPointerType()) {
+    std::stringstream stream;
+    stream << "Expected a function pointer type but found "
+           << *callee_result.type();
+    ReportError(stream.str());
+  }
+  const FunctionPointerType* type =
+      FunctionPointerType::cast(callee_result.type());
+
+  if (type->parameter_types().size() != parameter_types.size()) {
+    std::stringstream stream;
+    stream << "parameter count mismatch calling function pointer with Type: "
+           << *type << " - expected "
+           << std::to_string(type->parameter_types().size()) << ", found "
+           << std::to_string(parameter_types.size());
+    ReportError(stream.str());
+  }
+
+  ParameterTypes types{type->parameter_types(), false};
+  Signature sig;
+  sig.parameter_types = types;
+  if (!IsCompatibleSignature(sig, parameter_types, {})) {
+    std::stringstream stream;
+    stream << "parameters do not match function pointer signature. Expected: ("
+           << type->parameter_types() << ") but got: (" << parameter_types
+           << ")";
+    ReportError(stream.str());
+  }
+
+  std::vector<std::string> variables;
+  for (size_t current = 0; current < arguments.parameters.size(); ++current) {
+    const Type* to_type = type->parameter_types()[current];
+    VisitResult result =
+        GenerateImplicitConvert(to_type, arguments.parameters[current]);
+    variables.push_back(result.RValue());
+  }
+
+  std::string result_variable_name;
+  bool no_result = type->return_type()->IsVoidOrNever() || is_tailcall;
+  if (no_result) {
+    GenerateIndent();
+  } else {
+    result_variable_name = GenerateNewTempVariable(type->return_type());
+    source_out() << "UncheckedCast<";
+    source_out() << type->return_type()->GetGeneratedTNodeTypeName();
+    source_out() << ">(";
+  }
+
+  Builtin* example_builtin =
+      declarations()->FindSomeInternalBuiltinWithType(type);
+  if (!example_builtin) {
+    std::stringstream stream;
+    stream << "unable to find any builtin with type \"" << *type << "\"";
+    ReportError(stream.str());
+  }
+
+  if (is_tailcall) {
+    source_out() << "TailCallStub(";
+  } else {
+    source_out() << "CallStub(";
+  }
+  source_out() << "Builtins::CallableFor(isolate(), Builtins::k"
+               << example_builtin->name() << ").descriptor(), "
+               << callee_result.RValue() << ", ";
+
+  size_t total_parameters = 0;
+  for (size_t i = 0; i < arguments.parameters.size(); ++i) {
+    if (total_parameters++ != 0) {
+      source_out() << ", ";
+    }
+    source_out() << variables[i];
+  }
+  if (!no_result) {
+    source_out() << ")";
+  }
+  source_out() << ");" << std::endl;
+  return VisitResult(type->return_type(), result_variable_name);
+}
+
+VisitResult ImplementationVisitor::GenerateCall(
+    const std::string& callable_name, Arguments arguments, bool is_tailcall) {
+  Callable* callable = LookupCall(callable_name, arguments);
+
+  // Operators used in a branching context can also be function calls that never
+  // return but have a True and False label
+  if (arguments.labels.size() == 0 &&
+      callable->signature().labels.size() == 2) {
+    Label* true_label = declarations()->LookupLabel(kTrueLabelName);
+    arguments.labels.push_back(true_label);
+    Label* false_label = declarations()->LookupLabel(kFalseLabelName);
+    arguments.labels.push_back(false_label);
+  }
+
+  const Type* result_type = callable->signature().return_type;
+
+  std::vector<std::string> variables;
+  for (size_t current = 0; current < arguments.parameters.size(); ++current) {
+    const Type* to_type = (current >= callable->signature().types().size())
+                              ? TypeOracle::GetObjectType()
+                              : callable->signature().types()[current];
+    VisitResult result =
+        GenerateImplicitConvert(to_type, arguments.parameters[current]);
+    variables.push_back(result.RValue());
+  }
+
+  std::string result_variable_name;
+  if (result_type->IsVoidOrNever() || is_tailcall) {
+    GenerateIndent();
+  } else {
+    result_variable_name = GenerateNewTempVariable(result_type);
+    if (!result_type->IsConstexpr()) {
+      source_out() << "UncheckedCast<";
+      source_out() << result_type->GetGeneratedTNodeTypeName();
+      source_out() << ">(";
+    }
+  }
+  if (callable->IsBuiltin()) {
+    if (is_tailcall) {
+      source_out() << "TailCallBuiltin(Builtins::k" << callable->name() << ", ";
+    } else {
+      source_out() << "CallBuiltin(Builtins::k" << callable->name() << ", ";
+    }
+  } else if (callable->IsMacro()) {
+    if (is_tailcall) {
+      std::stringstream stream;
+      stream << "can't tail call a macro";
+      ReportError(stream.str());
+    }
+    source_out() << callable->name() << "(";
+  } else if (callable->IsRuntimeFunction()) {
+    if (is_tailcall) {
+      source_out() << "TailCallRuntime(Runtime::k" << callable->name() << ", ";
+    } else {
+      source_out() << "CallRuntime(Runtime::k" << callable->name() << ", ";
+    }
+  } else {
+    UNREACHABLE();
+  }
+  if (global_context_.verbose()) {
+    std::cout << "generating code for call to " << callable_name << "\n";
+  }
+
+  size_t total_parameters = 0;
+  for (size_t i = 0; i < arguments.parameters.size(); ++i) {
+    if (total_parameters++ != 0) {
+      source_out() << ", ";
+    }
+    source_out() << variables[i];
+  }
+
+  size_t label_count = callable->signature().labels.size();
+  if (label_count != arguments.labels.size()) {
+    std::stringstream s;
+    s << "unexpected number of otherwise labels for " << callable->name()
+      << " (expected " << std::to_string(label_count) << " found "
+      << std::to_string(arguments.labels.size()) << ")";
+    ReportError(s.str());
+  }
+  for (size_t i = 0; i < label_count; ++i) {
+    if (total_parameters++ != 0) {
+      source_out() << ", ";
+    }
+    Label* label = arguments.labels[i];
+    size_t callee_label_parameters =
+        callable->signature().labels[i].types.size();
+    if (label->GetParameterCount() != callee_label_parameters) {
+      std::stringstream s;
+      s << "label " << label->name()
+        << " doesn't have the right number of parameters (found "
+        << std::to_string(label->GetParameterCount()) << " expected "
+        << std::to_string(callee_label_parameters) << ")";
+      ReportError(s.str());
+    }
+    source_out() << label->generated();
+    size_t j = 0;
+    for (auto t : callable->signature().labels[i].types) {
+      source_out() << ", ";
+      Variable* variable = label->GetParameter(j);
+      if (!(variable->type() == t)) {
+        std::stringstream s;
+        s << "mismatch of label parameters (expected " << *t << " got "
+          << *label->GetParameter(j)->type() << " for parameter "
+          << std::to_string(i + 1) << ")";
+        ReportError(s.str());
+      }
+      j++;
+      source_out() << variable->value();
+    }
+    label->MarkUsed();
+  }
+
+  if (global_context_.verbose()) {
+    std::cout << "finished generating code for call to " << callable_name
+              << "\n";
+  }
+  if (!result_type->IsVoidOrNever() && !is_tailcall &&
+      !result_type->IsConstexpr()) {
+    source_out() << ")";
+  }
+  source_out() << ");" << std::endl;
+  return VisitResult(result_type, result_variable_name);
+}
+
+void ImplementationVisitor::Visit(StandardDeclaration* decl) {
+  Signature signature = MakeSignature(decl->callable->signature.get());
+  Visit(decl->callable, signature, decl->body);
+}
+
+void ImplementationVisitor::Visit(SpecializationDeclaration* decl) {
+  Signature signature_with_types = MakeSignature(decl->signature.get());
+  Declarations::NodeScopeActivator specialization_activator(declarations(),
+                                                            decl);
+  GenericList* generic_list = declarations()->LookupGeneric(decl->name);
+  for (Generic* generic : generic_list->list()) {
+    CallableNode* callable = generic->declaration()->callable;
+    Signature generic_signature_with_types =
+        MakeSignature(callable->signature.get());
+    if (signature_with_types.HasSameTypesAs(generic_signature_with_types)) {
+      TypeVector specialization_types = GetTypeVector(decl->generic_parameters);
+      SpecializeGeneric({{generic, specialization_types},
+                         callable,
+                         decl->signature.get(),
+                         decl->body,
+                         decl->pos});
+      return;
+    }
+  }
+  // Because the DeclarationVisitor already performed the same lookup
+  // as above to find aspecialization match and already threw if it didn't
+  // find one, failure to find a match here should never happen.
+  // TODO(danno): Remember the specialization found in the declaration visitor
+  //              so that the lookup doesn't have to be repeated here.
+  UNREACHABLE();
+}
+
+VisitResult ImplementationVisitor::Visit(CallExpression* expr,
+                                         bool is_tailcall) {
+  Arguments arguments;
+  std::string name = expr->callee.name;
+  bool has_template_arguments = expr->callee.generic_arguments.size() != 0;
+  if (has_template_arguments) {
+    TypeVector specialization_types =
+        GetTypeVector(expr->callee.generic_arguments);
+    name = GetGeneratedCallableName(name, specialization_types);
+    for (auto generic :
+         declarations()->LookupGeneric(expr->callee.name)->list()) {
+      CallableNode* callable = generic->declaration()->callable;
+      if (generic->declaration()->body) {
+        QueueGenericSpecialization({generic, specialization_types}, callable,
+                                   callable->signature.get(),
+                                   generic->declaration()->body);
+      }
+    }
+  }
+  for (Expression* arg : expr->arguments)
+    arguments.parameters.push_back(Visit(arg));
+  arguments.labels = LabelsFromIdentifiers(expr->labels);
+  VisitResult result;
+  if (!has_template_arguments &&
+      declarations()->Lookup(expr->callee.name)->IsValue()) {
+    result = GeneratePointerCall(&expr->callee, arguments, is_tailcall);
+  } else {
+    result = GenerateCall(name, arguments, is_tailcall);
+  }
+  if (!result.type()->IsVoidOrNever()) {
+    GenerateIndent();
+    source_out() << "USE(" << result.RValue() << ");" << std::endl;
+  }
+  if (is_tailcall) {
+    result = {TypeOracle::GetNeverType(), ""};
+  }
+  return result;
+}
+
+bool ImplementationVisitor::GenerateLabeledStatementBlocks(
+    const std::vector<Statement*>& blocks,
+    const std::vector<Label*>& statement_labels, Label* merge_label) {
+  bool live = false;
+  auto label_iterator = statement_labels.begin();
+  for (Statement* block : blocks) {
+    GenerateIndent();
+    source_out() << "if (" << (*label_iterator)->generated() << "->is_used())"
+                 << std::endl;
+    ScopedIndent indent(this);
+
+    GenerateLabelBind(*label_iterator++);
+    if (!Visit(block)->IsNever()) {
+      GenerateLabelGoto(merge_label);
+      live = true;
+    }
+  }
+  return live;
+}
+
+void ImplementationVisitor::GenerateBranch(const VisitResult& condition,
+                                           Label* true_label,
+                                           Label* false_label) {
+  GenerateIndent();
+  source_out() << "Branch(" << condition.RValue() << ", "
+               << true_label->generated() << ", " << false_label->generated()
+               << ");" << std::endl;
+}
+
+bool ImplementationVisitor::GenerateExpressionBranch(
+    Expression* expression, const std::vector<Label*>& statement_labels,
+    const std::vector<Statement*>& statement_blocks, Label* merge_label) {
+  // Activate a new scope to define True/False catch labels
+  Declarations::NodeScopeActivator scope(declarations(), expression);
+
+  VisitResult expression_result = Visit(expression);
+  if (expression_result.type() == TypeOracle::GetBoolType()) {
+    GenerateBranch(expression_result, statement_labels[0], statement_labels[1]);
+  } else {
+    if (expression_result.type() != TypeOracle::GetNeverType()) {
+      std::stringstream s;
+      s << "unexpected return type " << *expression_result.type()
+        << " for branch expression";
+      ReportError(s.str());
+    }
+  }
+
+  return GenerateLabeledStatementBlocks(statement_blocks, statement_labels,
+                                        merge_label);
+}
+
+VisitResult ImplementationVisitor::GenerateImplicitConvert(
+    const Type* destination_type, VisitResult source) {
+  if (destination_type == source.type()) {
+    return source;
+  }
+
+  if (TypeOracle::IsImplicitlyConvertableFrom(destination_type,
+                                              source.type())) {
+    std::string name =
+        GetGeneratedCallableName(kFromConstexprMacroName, {destination_type});
+    return GenerateCall(name, {{source}, {}}, false);
+  } else if (IsAssignableFrom(destination_type, source.type())) {
+    if (source.declarable()) {
+      return VisitResult(destination_type, *source.declarable());
+    } else {
+      return VisitResult(destination_type, source.value());
+    }
+  } else {
+    std::stringstream s;
+    s << "cannot use expression of type " << *source.type()
+      << " as a value of type " << *destination_type;
+    ReportError(s.str());
+  }
+  return VisitResult(TypeOracle::GetVoidType(), "");
+}
+
+std::string ImplementationVisitor::NewTempVariable() {
+  std::string name("t");
+  name += std::to_string(next_temp_++);
+  return name;
+}
+
+std::string ImplementationVisitor::GenerateNewTempVariable(const Type* type) {
+  std::string temp = NewTempVariable();
+  GenerateIndent();
+  source_out() << type->GetGeneratedTypeName() << " " << temp << " = ";
+  return temp;
+}
+
+void ImplementationVisitor::GenerateLabelDefinition(Label* label,
+                                                    AstNode* node) {
+  std::string label_string = label->generated();
+  std::string label_string_impl = label_string + "_impl";
+  GenerateIndent();
+  source_out() << "Label " + label_string_impl + "(this";
+  if (node != nullptr) {
+    source_out() << ", ";
+    GenerateChangedVarsFromControlSplit(node);
+  }
+  source_out() << ");" << std::endl;
+  GenerateIndent();
+  source_out() << "Label* " + label_string + " = &" << label_string_impl << ";"
+               << std::endl;
+  GenerateIndent();
+  source_out() << "USE(" << label_string << ");" << std::endl;
+}
+
+void ImplementationVisitor::GenerateLabelBind(Label* label) {
+  GenerateIndent();
+  source_out() << "BIND(" << label->generated() << ");" << std::endl;
+}
+
+void ImplementationVisitor::GenerateLabelGoto(Label* label) {
+  GenerateIndent();
+  source_out() << "Goto(" << label->generated() << ");" << std::endl;
+}
+
+std::vector<Label*> ImplementationVisitor::LabelsFromIdentifiers(
+    const std::vector<std::string>& names) {
+  std::vector<Label*> result;
+  for (auto name : names) {
+    result.push_back(declarations()->LookupLabel(name));
+  }
+  return result;
+}
+
+}  // namespace torque
+}  // namespace internal
+}  // namespace v8
diff --git a/deps/v8/src/torque/implementation-visitor.h b/deps/v8/src/torque/implementation-visitor.h
new file mode 100644
index 00000000000000..bc570e9afcad1a
--- /dev/null
+++ b/deps/v8/src/torque/implementation-visitor.h
@@ -0,0 +1,255 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef V8_TORQUE_IMPLEMENTATION_VISITOR_H_
+#define V8_TORQUE_IMPLEMENTATION_VISITOR_H_
+
+#include <string>
+
+#include "src/base/macros.h"
+#include "src/torque/ast.h"
+#include "src/torque/file-visitor.h"
+#include "src/torque/global-context.h"
+#include "src/torque/types.h"
+#include "src/torque/utils.h"
+
+namespace v8 {
+namespace internal {
+namespace torque {
+
+struct LocationReference {
+  LocationReference(Value* v, VisitResult b, VisitResult i)
+      : value(v), base(b), index(i) {}
+  Value* value;
+  VisitResult base;
+  VisitResult index;
+};
+
+class ImplementationVisitor : public FileVisitor {
+ public:
+  explicit ImplementationVisitor(GlobalContext& global_context)
+      : FileVisitor(global_context), indent_(0), next_temp_(0) {}
+
+  void Visit(Ast* ast) { Visit(ast->default_module()); }
+
+  VisitResult Visit(Expression* expr);
+  const Type* Visit(Statement* stmt);
+  void Visit(Declaration* decl);
+
+  LocationReference GetLocationReference(LocationExpression* location);
+  LocationReference GetLocationReference(IdentifierExpression* expr) {
+    return LocationReference(declarations()->LookupValue(expr->name), {}, {});
+  }
+  LocationReference GetLocationReference(FieldAccessExpression* expr) {
+    return LocationReference({}, Visit(expr->object), {});
+  }
+  LocationReference GetLocationReference(ElementAccessExpression* expr) {
+    return LocationReference({}, Visit(expr->array), Visit(expr->index));
+  }
+
+  VisitResult GenerateFetchFromLocation(LocationExpression* location,
+                                        LocationReference reference);
+  VisitResult GenerateFetchFromLocation(IdentifierExpression* expr,
+                                        LocationReference reference) {
+    Value* value = reference.value;
+    if (value->IsVariable() && !Variable::cast(value)->IsDefined()) {
+      std::stringstream s;
+      s << "\"" << value->name() << "\" is used before it is defined";
+      ReportError(s.str());
+    }
+    return VisitResult(value->type(), value);
+  }
+  VisitResult GenerateFetchFromLocation(FieldAccessExpression* expr,
+                                        LocationReference reference) {
+    Arguments arguments;
+    arguments.parameters = {reference.base};
+    return GenerateCall(std::string(".") + expr->field, arguments);
+  }
+  VisitResult GenerateFetchFromLocation(ElementAccessExpression* expr,
+                                        LocationReference reference) {
+    Arguments arguments;
+    arguments.parameters = {reference.base, reference.index};
+    return GenerateCall("[]", arguments);
+  }
+
+  VisitResult GetBuiltinCode(Builtin* builtin);
+
+  VisitResult Visit(IdentifierExpression* expr);
+  VisitResult Visit(FieldAccessExpression* expr) {
+    return GenerateFetchFromLocation(expr, GetLocationReference(expr));
+  }
+  VisitResult Visit(ElementAccessExpression* expr) {
+    return GenerateFetchFromLocation(expr, GetLocationReference(expr));
+  }
+
+  void Visit(ModuleDeclaration* decl);
+  void Visit(DefaultModuleDeclaration* decl) {
+    Visit(implicit_cast<ModuleDeclaration*>(decl));
+  }
+  void Visit(ExplicitModuleDeclaration* decl) {
+    Visit(implicit_cast<ModuleDeclaration*>(decl));
+  }
+  void Visit(TypeDeclaration* decl) {}
+  void Visit(TypeAliasDeclaration* decl) {}
+  void Visit(ExternConstDeclaration* decl) {}
+  void Visit(StandardDeclaration* decl);
+  void Visit(GenericDeclaration* decl) {}
+  void Visit(SpecializationDeclaration* decl);
+
+  void Visit(TorqueMacroDeclaration* decl, const Signature& signature,
+             Statement* body);
+  void Visit(TorqueBuiltinDeclaration* decl, const Signature& signature,
+             Statement* body);
+  void Visit(ExternalMacroDeclaration* decl, const Signature& signature,
+             Statement* body) {}
+  void Visit(ExternalBuiltinDeclaration* decl, const Signature& signature,
+             Statement* body) {}
+  void Visit(ExternalRuntimeDeclaration* decl, const Signature& signature,
+             Statement* body) {}
+  void Visit(CallableNode* decl, const Signature& signature, Statement* body);
+
+  VisitResult Visit(CallExpression* expr, bool is_tail = false);
+  const Type* Visit(TailCallStatement* stmt);
+
+  VisitResult Visit(ConditionalExpression* expr);
+
+  VisitResult Visit(LogicalOrExpression* expr);
+  VisitResult Visit(LogicalAndExpression* expr);
+
+  LocationReference GetLocationReference(
+      TorqueParser::LocationExpressionContext* locationExpression);
+
+  VisitResult Visit(IncrementDecrementExpression* expr);
+  VisitResult Visit(AssignmentExpression* expr);
+  VisitResult Visit(StringLiteralExpression* expr);
+  VisitResult Visit(NumberLiteralExpression* expr);
+
+  const Type* Visit(TryLabelStatement* stmt);
+  const Type* Visit(ReturnStatement* stmt);
+  const Type* Visit(GotoStatement* stmt);
+  const Type* Visit(IfStatement* stmt);
+  const Type* Visit(WhileStatement* stmt);
+  const Type* Visit(BreakStatement* stmt);
+  const Type* Visit(ContinueStatement* stmt);
+  const Type* Visit(ForLoopStatement* stmt);
+  const Type* Visit(VarDeclarationStatement* stmt);
+  const Type* Visit(ForOfLoopStatement* stmt);
+  const Type* Visit(BlockStatement* block);
+  const Type* Visit(ExpressionStatement* stmt);
+  const Type* Visit(DebugStatement* stmt);
+  const Type* Visit(AssertStatement* stmt);
+
+  void BeginModuleFile(Module* module);
+  void EndModuleFile(Module* module);
+
+  void GenerateImplementation(const std::string& dir, Module* module);
+
+ private:
+  std::string GetBaseAssemblerName(Module* module);
+
+  std::string GetDSLAssemblerName(Module* module);
+
+  void GenerateIndent();
+
+  class ScopedIndent {
+   public:
+    explicit ScopedIndent(ImplementationVisitor* visitor, bool new_lines = true)
+        : new_lines_(new_lines), visitor_(visitor) {
+      if (new_lines) visitor->GenerateIndent();
+      visitor->source_out() << "{";
+      if (new_lines) visitor->source_out() << std::endl;
+      visitor->indent_++;
+    }
+    ~ScopedIndent() {
+      visitor_->indent_--;
+      visitor_->GenerateIndent();
+      visitor_->source_out() << "}";
+      if (new_lines_) visitor_->source_out() << std::endl;
+    }
+
+   private:
+    bool new_lines_;
+    ImplementationVisitor* visitor_;
+  };
+
+  Callable* LookupCall(const std::string& name, const Arguments& arguments);
+
+  void GenerateChangedVarsFromControlSplit(AstNode* node);
+
+  const Type* GetCommonType(const Type* left, const Type* right);
+
+  VisitResult GenerateCopy(const VisitResult& to_copy);
+
+  void GenerateAssignToVariable(Variable* var, VisitResult value);
+
+  void GenerateAssignToLocation(LocationExpression* location,
+                                const LocationReference& reference,
+                                VisitResult assignment_value);
+
+  Variable* GenerateVariableDeclaration(
+      AstNode* node, const std::string& name,
+      const base::Optional<const Type*>& type,
+      const base::Optional<VisitResult>& initialization = {});
+
+  void GenerateParameter(const std::string& parameter_name);
+
+  void GenerateParameterList(const NameVector& list, size_t first = 0);
+
+  VisitResult GenerateCall(const std::string& callable_name,
+                           Arguments parameters, bool tail_call = false);
+  VisitResult GeneratePointerCall(Expression* callee,
+                                  const Arguments& parameters, bool tail_call);
+
+  bool GenerateLabeledStatementBlocks(
+      const std::vector<Statement*>& blocks,
+      const std::vector<Label*>& statement_labels, Label* merge_label);
+
+  void GenerateBranch(const VisitResult& condition, Label* true_label,
+                      Label* false_label);
+
+  bool GenerateExpressionBranch(Expression* expression,
+                                const std::vector<Label*>& statement_labels,
+                                const std::vector<Statement*>& statement_blocks,
+                                Label* merge_label);
+
+  void GenerateMacroFunctionDeclaration(std::ostream& o,
+                                        const std::string& macro_prefix,
+                                        Macro* macro);
+
+  VisitResult GenerateImplicitConvert(const Type* destination_type,
+                                      VisitResult source);
+
+  void Specialize(const SpecializationKey& key, CallableNode* callable,
+                  const CallableNodeSignature* signature,
+                  Statement* body) override {
+    Declarations::GenericScopeActivator scope(declarations(), key);
+    Visit(callable, MakeSignature(signature), body);
+  }
+
+  std::string NewTempVariable();
+
+  std::string GenerateNewTempVariable(const Type* type);
+
+  void GenerateLabelDefinition(Label* label, AstNode* node = nullptr);
+
+  void GenerateLabelBind(Label* label);
+
+  void GenerateLabelGoto(Label* label);
+
+  std::vector<Label*> LabelsFromIdentifiers(
+      const std::vector<std::string>& names);
+
+  std::ostream& source_out() { return module_->source_stream(); }
+
+  std::ostream& header_out() { return module_->header_stream(); }
+
+  size_t indent_;
+  int32_t next_temp_;
+};
+
+}  // namespace torque
+}  // namespace internal
+}  // namespace v8
+
+#endif  // V8_TORQUE_IMPLEMENTATION_VISITOR_H_
diff --git a/deps/v8/src/torque/parameter-difference.h b/deps/v8/src/torque/parameter-difference.h
new file mode 100644
index 00000000000000..aaa1745af29657
--- /dev/null
+++ b/deps/v8/src/torque/parameter-difference.h
@@ -0,0 +1,77 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef V8_TORQUE_PARAMETER_DIFFERENCE_H_
+#define V8_TORQUE_PARAMETER_DIFFERENCE_H_
+
+#include <vector>
+
+#include "src/torque/types.h"
+
+namespace v8 {
+namespace internal {
+namespace torque {
+
+class ParameterDifference {
+ public:
+  ParameterDifference(const TypeVector& to, const TypeVector& from) {
+    DCHECK_EQ(to.size(), from.size());
+    for (size_t i = 0; i < to.size(); ++i) {
+      AddParameter(to[i], from[i]);
+    }
+  }
+
+  // An overload is selected if it is strictly better than all alternatives.
+  // This means that it has to be strictly better in at least one parameter,
+  // and better or equally good in all others.
+  //
+  // When comparing a pair of corresponding parameters of two overloads...
+  // ... they are considered equally good if:
+  //     - They are equal.
+  //     - Both require some implicit conversion.
+  // ... one is considered better if:
+  //     - It is a strict subtype of the other.
+  //     - It doesn't require an implicit conversion, while the other does.
+  bool StrictlyBetterThan(const ParameterDifference& other) const {
+    DCHECK_EQ(difference_.size(), other.difference_.size());
+    bool better_parameter_found = false;
+    for (size_t i = 0; i < difference_.size(); ++i) {
+      base::Optional<const Type*> a = difference_[i];
+      base::Optional<const Type*> b = other.difference_[i];
+      if (a == b) {
+        continue;
+      } else if (a && b && a != b && (*a)->IsSubtypeOf(*b)) {
+        DCHECK(!(*b)->IsSubtypeOf(*a));
+        better_parameter_found = true;
+      } else if (a && !b) {
+        better_parameter_found = true;
+      } else {
+        return false;
+      }
+    }
+    return better_parameter_found;
+  }
+
+ private:
+  // Pointwise difference between call arguments and a signature.
+  // {base::nullopt} means that an implicit conversion was necessary,
+  // otherwise we store the supertype found in the signature.
+  std::vector<base::Optional<const Type*>> difference_;
+
+  void AddParameter(const Type* to, const Type* from) {
+    if (from->IsSubtypeOf(to)) {
+      difference_.push_back(to);
+    } else if (IsAssignableFrom(to, from)) {
+      difference_.push_back(base::nullopt);
+    } else {
+      UNREACHABLE();
+    }
+  }
+};
+
+}  // namespace torque
+}  // namespace internal
+}  // namespace v8
+
+#endif  // V8_TORQUE_PARAMETER_DIFFERENCE_H_
diff --git a/deps/v8/src/torque/scope.cc b/deps/v8/src/torque/scope.cc
new file mode 100644
index 00000000000000..4cb14420201320
--- /dev/null
+++ b/deps/v8/src/torque/scope.cc
@@ -0,0 +1,51 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include <fstream>
+#include <iostream>
+#include <string>
+
+#include "src/torque/global-context.h"
+
+#include "src/torque/scope.h"
+
+namespace v8 {
+namespace internal {
+namespace torque {
+
+Scope::Scope(ScopeChain& scope_chain)
+    : scope_chain_(scope_chain),
+      scope_number_(scope_chain_.GetNextScopeNumber()),
+      private_label_number_(0) {}
+
+Scope* ScopeChain::NewScope() {
+  Scope* new_scope = new Scope(*this);
+  scopes_.emplace_back(std::unique_ptr<Scope>(new_scope));
+  return new_scope;
+}
+
+void Scope::AddLiveVariables(std::set<const Variable*>& set) {
+  for (auto& current : lookup_) {
+    if (current.second->IsVariable()) {
+      set.insert(Variable::cast(current.second));
+    }
+  }
+}
+
+void Scope::Print() {
+  std::cout << "scope #" << std::to_string(scope_number_) << "\n";
+  for (auto& i : lookup_) {
+    std::cout << i.first << ": " << i.second << "\n";
+  }
+}
+
+Scope::Activator::Activator(Scope* scope) : scope_(scope) {
+  scope->GetScopeChain().PushScope(scope);
+}
+
+Scope::Activator::~Activator() { scope_->GetScopeChain().PopScope(); }
+
+}  // namespace torque
+}  // namespace internal
+}  // namespace v8
diff --git a/deps/v8/src/torque/scope.h b/deps/v8/src/torque/scope.h
new file mode 100644
index 00000000000000..be000233bd8dc4
--- /dev/null
+++ b/deps/v8/src/torque/scope.h
@@ -0,0 +1,167 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef V8_TORQUE_SCOPE_H_
+#define V8_TORQUE_SCOPE_H_
+
+#include <string>
+
+#include "./antlr4-runtime.h"
+#include "src/torque/ast.h"
+#include "src/torque/types.h"
+#include "src/torque/utils.h"
+
+namespace v8 {
+namespace internal {
+namespace torque {
+
+class ScopeChain;
+
+class Scope {
+ public:
+  explicit Scope(ScopeChain& scope_chain);
+
+  void Stream(std::ostream& stream) const {
+    stream << "scope " << std::to_string(scope_number_) << " {";
+    for (auto& c : lookup_) {
+      stream << c.first << ",";
+    }
+    stream << "}";
+  }
+
+  int scope_number() const { return scope_number_; }
+
+  ScopeChain& GetScopeChain() const { return scope_chain_; }
+
+  void AddLiveVariables(std::set<const Variable*>& set);
+
+  void Print();
+
+  class Activator;
+
+ private:
+  friend class ScopeChain;
+
+  void CheckAlreadyDeclared(SourcePosition pos, const std::string& name,
+                            const char* new_type);
+
+  void Declare(const std::string& name, Declarable* d) {
+    DCHECK_EQ(lookup_.end(), lookup_.find(name));
+    DCHECK(d != nullptr);
+    lookup_[name] = d;
+  }
+
+  Declarable* Lookup(const std::string& name) {
+    auto i = lookup_.find(name);
+    if (i == lookup_.end()) {
+      return nullptr;
+    }
+    return i->second;
+  }
+
+  ScopeChain& scope_chain_;
+  int scope_number_;
+  int private_label_number_;
+  std::map<std::string, Declarable*> lookup_;
+};
+
+class Scope::Activator {
+ public:
+  explicit Activator(Scope* scope);
+  ~Activator();
+
+ private:
+  Scope* scope_;
+};
+
+class ScopeChain {
+ public:
+  ScopeChain() : next_scope_number_(0) {}
+  Scope* NewScope();
+
+  Scope* TopScope() const { return current_scopes_.back(); }
+  void PushScope(Scope* scope) { current_scopes_.push_back(scope); }
+  void PopScope() { current_scopes_.pop_back(); }
+
+  std::set<const Variable*> GetLiveVariables() {
+    std::set<const Variable*> result;
+    for (auto scope : current_scopes_) {
+      scope->AddLiveVariables(result);
+    }
+    return result;
+  }
+
+  void Declare(const std::string& name, Declarable* d) {
+    TopScope()->Declare(name, d);
+  }
+
+  Declarable* Lookup(const std::string& name) {
+    auto e = current_scopes_.rend();
+    auto c = current_scopes_.rbegin();
+    while (c != e) {
+      Declarable* result = (*c)->Lookup(name);
+      if (result != nullptr) return result;
+      ++c;
+    }
+    return nullptr;
+  }
+
+  Declarable* ShallowLookup(const std::string& name) {
+    auto& e = current_scopes_.back();
+    return e->Lookup(name);
+  }
+
+  Declarable* LookupGlobalScope(const std::string& name) {
+    auto& e = current_scopes_.front();
+    return e->Lookup(name);
+  }
+
+  void Print() {
+    for (auto s : current_scopes_) {
+      s->Print();
+    }
+  }
+
+  struct Snapshot {
+    ScopeChain* chain;
+    std::vector<Scope*> current_scopes;
+  };
+
+  Snapshot TaskSnapshot() { return {this, current_scopes_}; }
+
+  class ScopedSnapshotRestorer {
+   public:
+    explicit ScopedSnapshotRestorer(const Snapshot& snapshot)
+        : chain_(snapshot.chain) {
+      saved_ = chain_->current_scopes_;
+      chain_->current_scopes_ = snapshot.current_scopes;
+    }
+    ~ScopedSnapshotRestorer() { chain_->current_scopes_ = saved_; }
+
+   private:
+    ScopeChain* chain_;
+    std::vector<Scope*> saved_;
+  };
+
+ private:
+  friend class Scope;
+  friend class ScopedSnapshotRestorer;
+
+  int GetNextScopeNumber() { return next_scope_number_++; }
+
+  int next_scope_number_;
+  std::vector<std::unique_ptr<Scope>> scopes_;
+  std::vector<Scope*> current_scopes_;
+};
+
+inline std::ostream& operator<<(std::ostream& os, const Scope& scope) {
+  scope.Stream(os);
+  return os;
+}
+
+}  // namespace torque
+}  // namespace internal
+}  // namespace v8
+
+#endif  // V8_TORQUE_SCOPE_H_
diff --git a/deps/v8/src/torque/torque.cc b/deps/v8/src/torque/torque.cc
new file mode 100644
index 00000000000000..c771623738a428
--- /dev/null
+++ b/deps/v8/src/torque/torque.cc
@@ -0,0 +1,138 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include <iostream>
+
+#include "./antlr4-runtime.h"
+#include "src/torque/TorqueBaseVisitor.h"
+#include "src/torque/TorqueLexer.h"
+#include "src/torque/ast-generator.h"
+#include "src/torque/declarable.h"
+#include "src/torque/declaration-visitor.h"
+#include "src/torque/global-context.h"
+#include "src/torque/implementation-visitor.h"
+#include "src/torque/scope.h"
+#include "src/torque/type-oracle.h"
+#include "src/torque/types.h"
+#include "src/torque/utils.h"
+
+namespace v8 {
+namespace internal {
+namespace torque {
+
+size_t Label::next_id_ = 0;
+
+class FailedParseErrorStrategy : public antlr4::DefaultErrorStrategy {
+ public:
+  FailedParseErrorStrategy() : DefaultErrorStrategy(), failed_(false) {}
+  void reportError(antlr4::Parser* recognizer,
+                   const antlr4::RecognitionException& e) override {
+    antlr4::DefaultErrorStrategy::reportError(recognizer, e);
+    failed_ = true;
+  }
+
+  bool FailedParse() const { return failed_; }
+
+ public:
+  bool failed_;
+};
+
+class TorqueErrorListener : public antlr4::BaseErrorListener {
+ public:
+  TorqueErrorListener() : BaseErrorListener() {}
+
+  void syntaxError(antlr4::Recognizer* recognizer,
+                   antlr4::Token* /*offendingSymbol*/, size_t line,
+                   size_t charPositionInLine, const std::string& msg,
+                   std::exception_ptr /*e*/) {
+    std::cerr << recognizer->getInputStream()->getSourceName() << ": " << line
+              << ":" << charPositionInLine << " " << msg << "\n";
+  }
+};
+
+int WrappedMain(int argc, const char** argv) {
+  std::string output_directory;
+  std::vector<SourceFileContext> file_contexts;
+  AstGenerator ast_generator;
+  SourceFileContext context;
+  size_t lexer_errors = 0;
+  auto error_strategy = std::make_shared<FailedParseErrorStrategy>();
+  TorqueErrorListener error_listener;
+  bool verbose = false;
+  SourceFileMap::Scope scope;
+  for (int i = 1; i < argc; ++i) {
+    // Check for options
+    if (!strcmp("-o", argv[i])) {
+      output_directory = argv[++i];
+      continue;
+    }
+    if (!strcmp("-v", argv[i])) {
+      verbose = true;
+      continue;
+    }
+
+    // Otherwise it's a .tq
+    // file, parse it and
+    // remember the syntax tree
+    context.name = argv[i];
+    context.stream = std::unique_ptr<antlr4::ANTLRFileStream>(
+        new antlr4::ANTLRFileStream(context.name.c_str()));
+    context.lexer =
+        std::unique_ptr<TorqueLexer>(new TorqueLexer(context.stream.get()));
+    context.lexer->removeErrorListeners();
+    context.lexer->addErrorListener(&error_listener);
+    context.tokens = std::unique_ptr<antlr4::CommonTokenStream>(
+        new antlr4::CommonTokenStream(context.lexer.get()));
+    context.tokens->fill();
+    lexer_errors += context.lexer->getNumberOfSyntaxErrors();
+    context.parser =
+        std::unique_ptr<TorqueParser>(new TorqueParser(context.tokens.get()));
+    context.parser->setErrorHandler(error_strategy);
+    context.parser->removeErrorListeners();
+    context.parser->addErrorListener(&error_listener);
+    context.file = context.parser->file();
+    ast_generator.visitSourceFile(&context);
+  }
+
+  if (lexer_errors != 0 || error_strategy->FailedParse()) {
+    return -1;
+  }
+
+  GlobalContext global_context(std::move(ast_generator).GetAst());
+  if (verbose) global_context.SetVerbose();
+  TypeOracle::Scope type_oracle(global_context.declarations());
+
+  if (output_directory.length() != 0) {
+    {
+      DeclarationVisitor visitor(global_context);
+
+      visitor.Visit(global_context.ast());
+
+      std::string output_header_path = output_directory;
+      output_header_path += "/builtin-definitions-from-dsl.h";
+      visitor.GenerateHeader(output_header_path);
+    }
+
+    ImplementationVisitor visitor(global_context);
+    for (auto& module : global_context.GetModules()) {
+      visitor.BeginModuleFile(module.second.get());
+    }
+
+    visitor.Visit(global_context.ast());
+
+    for (auto& module : global_context.GetModules()) {
+      visitor.EndModuleFile(module.second.get());
+      visitor.GenerateImplementation(output_directory, module.second.get());
+    }
+  }
+  return 0;
+}
+
+}  // namespace torque
+}  // namespace internal
+}  // namespace v8
+
+int main(int argc, const char** argv) {
+  return v8::internal::torque::WrappedMain(argc, argv);
+}
diff --git a/deps/v8/src/torque/type-oracle.h b/deps/v8/src/torque/type-oracle.h
new file mode 100644
index 00000000000000..037a5d09593cf4
--- /dev/null
+++ b/deps/v8/src/torque/type-oracle.h
@@ -0,0 +1,110 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef V8_TORQUE_TYPE_ORACLE_H_
+#define V8_TORQUE_TYPE_ORACLE_H_
+
+#include "src/torque/contextual.h"
+#include "src/torque/declarable.h"
+#include "src/torque/declarations.h"
+#include "src/torque/types.h"
+#include "src/torque/utils.h"
+
+namespace v8 {
+namespace internal {
+namespace torque {
+
+class TypeOracle : public ContextualClass<TypeOracle> {
+ public:
+  explicit TypeOracle(Declarations* declarations)
+      : declarations_(declarations) {}
+
+  static const AbstractType* GetAbstractType(
+      const Type* parent, std::string name, std::string generated,
+      base::Optional<const AbstractType*> non_constexpr_version) {
+    AbstractType* result = new AbstractType(
+        parent, std::move(name), std::move(generated), non_constexpr_version);
+    Get().nominal_types_.push_back(std::unique_ptr<AbstractType>(result));
+    return result;
+  }
+
+  static const FunctionPointerType* GetFunctionPointerType(
+      TypeVector argument_types, const Type* return_type) {
+    const Type* code_type = Get().GetBuiltinType(CODE_TYPE_STRING);
+    return Get().function_pointer_types_.Add(
+        FunctionPointerType(code_type, argument_types, return_type));
+  }
+
+  static const Type* GetUnionType(UnionType type) {
+    if (base::Optional<const Type*> single = type.GetSingleMember()) {
+      return *single;
+    }
+    return Get().union_types_.Add(std::move(type));
+  }
+
+  static const Type* GetUnionType(const Type* a, const Type* b) {
+    if (a->IsSubtypeOf(b)) return b;
+    if (b->IsSubtypeOf(a)) return a;
+    UnionType result = UnionType::FromType(a);
+    result.Extend(b);
+    return GetUnionType(std::move(result));
+  }
+
+  static const Type* GetArgumentsType() {
+    return Get().GetBuiltinType(ARGUMENTS_TYPE_STRING);
+  }
+
+  static const Type* GetBoolType() {
+    return Get().GetBuiltinType(BOOL_TYPE_STRING);
+  }
+
+  static const Type* GetConstexprBoolType() {
+    return Get().GetBuiltinType(CONSTEXPR_BOOL_TYPE_STRING);
+  }
+
+  static const Type* GetVoidType() {
+    return Get().GetBuiltinType(VOID_TYPE_STRING);
+  }
+
+  static const Type* GetObjectType() {
+    return Get().GetBuiltinType(OBJECT_TYPE_STRING);
+  }
+
+  static const Type* GetConstStringType() {
+    return Get().GetBuiltinType(CONST_STRING_TYPE_STRING);
+  }
+
+  static const Type* GetIntPtrType() {
+    return Get().GetBuiltinType(INTPTR_TYPE_STRING);
+  }
+
+  static const Type* GetNeverType() {
+    return Get().GetBuiltinType(NEVER_TYPE_STRING);
+  }
+
+  static const Type* GetConstInt31Type() {
+    return Get().GetBuiltinType(CONST_INT31_TYPE_STRING);
+  }
+
+  static bool IsImplicitlyConvertableFrom(const Type* to, const Type* from) {
+    std::string name = GetGeneratedCallableName(kFromConstexprMacroName, {to});
+    return Get().declarations_->TryLookupMacro(name, {from}) != nullptr;
+  }
+
+ private:
+  const Type* GetBuiltinType(const std::string& name) {
+    return declarations_->LookupGlobalType(name);
+  }
+
+  Declarations* declarations_;
+  Deduplicator<FunctionPointerType> function_pointer_types_;
+  Deduplicator<UnionType> union_types_;
+  std::vector<std::unique_ptr<Type>> nominal_types_;
+};
+
+}  // namespace torque
+}  // namespace internal
+}  // namespace v8
+
+#endif  // V8_TORQUE_TYPE_ORACLE_H_
diff --git a/deps/v8/src/torque/types.cc b/deps/v8/src/torque/types.cc
new file mode 100644
index 00000000000000..cb24c41b1e4607
--- /dev/null
+++ b/deps/v8/src/torque/types.cc
@@ -0,0 +1,262 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include <fstream>
+#include <iostream>
+
+#include "src/torque/declarable.h"
+#include "src/torque/type-oracle.h"
+#include "src/torque/types.h"
+
+namespace v8 {
+namespace internal {
+namespace torque {
+
+std::string Type::ToString() const {
+  if (aliases_.size() == 0) return ToExplicitString();
+  if (aliases_.size() == 1) return *aliases_.begin();
+  std::stringstream result;
+  int i = 0;
+  for (const std::string& alias : aliases_) {
+    if (i == 0) {
+      result << alias << " (aka. ";
+    } else if (i == 1) {
+      result << alias;
+    } else {
+      result << ", " << alias;
+    }
+    ++i;
+  }
+  result << ")";
+  return result.str();
+}
+
+bool Type::IsSubtypeOf(const Type* supertype) const {
+  if (const UnionType* union_type = UnionType::DynamicCast(supertype)) {
+    return union_type->IsSupertypeOf(this);
+  }
+  const Type* subtype = this;
+  while (subtype != nullptr) {
+    if (subtype == supertype) return true;
+    subtype = subtype->parent();
+  }
+  return false;
+}
+
+// static
+const Type* Type::CommonSupertype(const Type* a, const Type* b) {
+  int diff = a->Depth() - b->Depth();
+  const Type* a_supertype = a;
+  const Type* b_supertype = b;
+  for (; diff > 0; --diff) a_supertype = a_supertype->parent();
+  for (; diff < 0; ++diff) b_supertype = b_supertype->parent();
+  while (a_supertype && b_supertype) {
+    if (a_supertype == b_supertype) return a_supertype;
+    a_supertype = a_supertype->parent();
+    b_supertype = b_supertype->parent();
+  }
+  ReportError("types " + a->ToString() + " and " + b->ToString() +
+              " have no common supertype");
+}
+
+int Type::Depth() const {
+  int result = 0;
+  for (const Type* current = parent_; current; current = current->parent_) {
+    ++result;
+  }
+  return result;
+}
+
+bool Type::IsAbstractName(const std::string& name) const {
+  if (!IsAbstractType()) return false;
+  return AbstractType::cast(this)->name() == name;
+}
+
+std::string AbstractType::GetGeneratedTNodeTypeName() const {
+  std::string result = GetGeneratedTypeName();
+  DCHECK_EQ(result.substr(0, 6), "TNode<");
+  result = result.substr(6, result.length() - 7);
+  return result;
+}
+
+std::string FunctionPointerType::ToExplicitString() const {
+  std::stringstream result;
+  result << "builtin (";
+  PrintCommaSeparatedList(result, parameter_types_);
+  result << ") => " << *return_type_;
+  return result.str();
+}
+
+std::string FunctionPointerType::MangledName() const {
+  std::stringstream result;
+  result << "FT";
+  for (const Type* t : parameter_types_) {
+    std::string arg_type_string = t->MangledName();
+    result << arg_type_string.size() << arg_type_string;
+  }
+  std::string return_type_string = return_type_->MangledName();
+  result << return_type_string.size() << return_type_string;
+  return result.str();
+}
+
+std::string UnionType::ToExplicitString() const {
+  std::stringstream result;
+  result << "(";
+  bool first = true;
+  for (const Type* t : types_) {
+    if (!first) {
+      result << " | ";
+    }
+    first = false;
+    result << *t;
+  }
+  result << ")";
+  return result.str();
+}
+
+std::string UnionType::MangledName() const {
+  std::stringstream result;
+  result << "UT";
+  for (const Type* t : types_) {
+    std::string arg_type_string = t->MangledName();
+    result << arg_type_string.size() << arg_type_string;
+  }
+  return result.str();
+}
+
+std::string UnionType::GetGeneratedTNodeTypeName() const {
+  if (types_.size() <= 3) {
+    std::set<std::string> members;
+    for (const Type* t : types_) {
+      members.insert(t->GetGeneratedTNodeTypeName());
+    }
+    if (members == std::set<std::string>{"Smi", "HeapNumber"}) {
+      return "Number";
+    }
+    if (members == std::set<std::string>{"Smi", "HeapNumber", "BigInt"}) {
+      return "Numeric";
+    }
+  }
+  return parent()->GetGeneratedTNodeTypeName();
+}
+
+const Type* UnionType::NonConstexprVersion() const {
+  if (IsConstexpr()) {
+    auto it = types_.begin();
+    UnionType result((*it)->NonConstexprVersion());
+    ++it;
+    for (; it != types_.end(); ++it) {
+      result.Extend((*it)->NonConstexprVersion());
+    }
+    return TypeOracle::GetUnionType(std::move(result));
+  }
+  return this;
+}
+
+void PrintSignature(std::ostream& os, const Signature& sig, bool with_names) {
+  os << "(";
+  for (size_t i = 0; i < sig.parameter_types.types.size(); ++i) {
+    if (i > 0) os << ", ";
+    if (with_names && !sig.parameter_names.empty()) {
+      os << sig.parameter_names[i] << ": ";
+    }
+    os << *sig.parameter_types.types[i];
+  }
+  if (sig.parameter_types.var_args) {
+    if (sig.parameter_names.size()) os << ", ";
+    os << "...";
+  }
+  os << ")";
+  os << ": " << *sig.return_type;
+
+  if (sig.labels.empty()) return;
+
+  os << " labels ";
+  for (size_t i = 0; i < sig.labels.size(); ++i) {
+    if (i > 0) os << ", ";
+    if (with_names) os << sig.labels[i].name;
+
+    if (sig.labels[i].types.size() > 0) os << "(" << sig.labels[i].types << ")";
+  }
+}
+
+std::ostream& operator<<(std::ostream& os, const Signature& sig) {
+  PrintSignature(os, sig, true);
+  return os;
+}
+
+std::ostream& operator<<(std::ostream& os, const TypeVector& types) {
+  PrintCommaSeparatedList(os, types);
+  return os;
+}
+
+std::ostream& operator<<(std::ostream& os, const ParameterTypes& p) {
+  PrintCommaSeparatedList(os, p.types);
+  if (p.var_args) {
+    if (p.types.size() > 0) os << ", ";
+    os << "...";
+  }
+  return os;
+}
+
+bool Signature::HasSameTypesAs(const Signature& other) const {
+  if (!(parameter_types.types == other.parameter_types.types &&
+        parameter_types.var_args == other.parameter_types.var_args &&
+        return_type == other.return_type)) {
+    return false;
+  }
+  if (labels.size() != other.labels.size()) {
+    return false;
+  }
+  size_t i = 0;
+  for (auto l : labels) {
+    if (l.types != other.labels[i++].types) {
+      return false;
+    }
+  }
+  return true;
+}
+
+bool IsAssignableFrom(const Type* to, const Type* from) {
+  if (to == from) return true;
+  if (from->IsSubtypeOf(to)) return true;
+  return TypeOracle::IsImplicitlyConvertableFrom(to, from);
+}
+
+bool IsCompatibleSignature(const Signature& sig, const TypeVector& types,
+                           const std::vector<Label*>& labels) {
+  auto i = sig.parameter_types.types.begin();
+  if (sig.parameter_types.types.size() > types.size()) return false;
+  // TODO(danno): The test below is actually insufficient. The labels'
+  // parameters must be checked too. ideally, the named part of
+  // LabelDeclarationVector would be factored out so that the label count and
+  // parameter types could be passed separately.
+  if (sig.labels.size() != labels.size()) return false;
+  for (auto current : types) {
+    if (i == sig.parameter_types.types.end()) {
+      if (!sig.parameter_types.var_args) return false;
+      if (!IsAssignableFrom(TypeOracle::GetObjectType(), current)) return false;
+    } else {
+      if (!IsAssignableFrom(*i++, current)) return false;
+    }
+  }
+  return true;
+}
+
+bool operator<(const Type& a, const Type& b) {
+  return a.MangledName() < b.MangledName();
+}
+
+VisitResult::VisitResult(const Type* type, const Value* declarable)
+    : type_(type), value_(declarable->value()), declarable_(declarable) {}
+
+std::string VisitResult::LValue() const { return std::string("*") + value_; }
+
+std::string VisitResult::RValue() const {
+  return (declarable_) ? (*declarable_)->RValue() : value_;
+}
+
+}  // namespace torque
+}  // namespace internal
+}  // namespace v8
diff --git a/deps/v8/src/torque/types.h b/deps/v8/src/torque/types.h
new file mode 100644
index 00000000000000..b92b7ab7a75299
--- /dev/null
+++ b/deps/v8/src/torque/types.h
@@ -0,0 +1,381 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef V8_TORQUE_TYPES_H_
+#define V8_TORQUE_TYPES_H_
+
+#include <algorithm>
+#include <set>
+#include <string>
+#include <vector>
+
+#include "src/base/optional.h"
+#include "src/torque/utils.h"
+
+namespace v8 {
+namespace internal {
+namespace torque {
+
+static const char* const CONSTEXPR_TYPE_PREFIX = "constexpr ";
+static const char* const NEVER_TYPE_STRING = "never";
+static const char* const CONSTEXPR_BOOL_TYPE_STRING = "constexpr bool";
+static const char* const BOOL_TYPE_STRING = "bool";
+static const char* const VOID_TYPE_STRING = "void";
+static const char* const ARGUMENTS_TYPE_STRING = "constexpr Arguments";
+static const char* const CONTEXT_TYPE_STRING = "Context";
+static const char* const OBJECT_TYPE_STRING = "Object";
+static const char* const CONST_STRING_TYPE_STRING = "constexpr string";
+static const char* const CODE_TYPE_STRING = "Code";
+static const char* const INTPTR_TYPE_STRING = "intptr";
+static const char* const CONST_INT31_TYPE_STRING = "constexpr int31";
+static const char* const CONST_INT32_TYPE_STRING = "constexpr int32";
+static const char* const CONST_FLOAT64_TYPE_STRING = "constexpr float64";
+
+class Label;
+class Value;
+
+class TypeBase {
+ public:
+  enum class Kind { kAbstractType, kFunctionPointerType, kUnionType };
+  virtual ~TypeBase() {}
+  bool IsAbstractType() const { return kind() == Kind::kAbstractType; }
+  bool IsFunctionPointerType() const {
+    return kind() == Kind::kFunctionPointerType;
+  }
+  bool IsUnionType() const { return kind() == Kind::kUnionType; }
+
+ protected:
+  explicit TypeBase(Kind kind) : kind_(kind) {}
+  Kind kind() const { return kind_; }
+
+ private:
+  const Kind kind_;
+};
+
+#define DECLARE_TYPE_BOILERPLATE(x)                         \
+  static x* cast(TypeBase* declarable) {                    \
+    DCHECK(declarable->Is##x());                            \
+    return static_cast<x*>(declarable);                     \
+  }                                                         \
+  static const x* cast(const TypeBase* declarable) {        \
+    DCHECK(declarable->Is##x());                            \
+    return static_cast<const x*>(declarable);               \
+  }                                                         \
+  static x* DynamicCast(TypeBase* declarable) {             \
+    if (!declarable) return nullptr;                        \
+    if (!declarable->Is##x()) return nullptr;               \
+    return static_cast<x*>(declarable);                     \
+  }                                                         \
+  static const x* DynamicCast(const TypeBase* declarable) { \
+    if (!declarable) return nullptr;                        \
+    if (!declarable->Is##x()) return nullptr;               \
+    return static_cast<const x*>(declarable);               \
+  }
+
+class Type : public TypeBase {
+ public:
+  virtual bool IsSubtypeOf(const Type* supertype) const;
+
+  std::string ToString() const;
+  virtual std::string MangledName() const = 0;
+  bool IsVoid() const { return IsAbstractName(VOID_TYPE_STRING); }
+  bool IsNever() const { return IsAbstractName(NEVER_TYPE_STRING); }
+  bool IsBool() const { return IsAbstractName(BOOL_TYPE_STRING); }
+  bool IsConstexprBool() const {
+    return IsAbstractName(CONSTEXPR_BOOL_TYPE_STRING);
+  }
+  bool IsVoidOrNever() const { return IsVoid() || IsNever(); }
+  virtual std::string GetGeneratedTypeName() const = 0;
+  virtual std::string GetGeneratedTNodeTypeName() const = 0;
+  virtual bool IsConstexpr() const = 0;
+  virtual const Type* NonConstexprVersion() const = 0;
+  static const Type* CommonSupertype(const Type* a, const Type* b);
+  void AddAlias(std::string alias) const { aliases_.insert(std::move(alias)); }
+
+ protected:
+  Type(TypeBase::Kind kind, const Type* parent)
+      : TypeBase(kind), parent_(parent) {}
+  const Type* parent() const { return parent_; }
+  void set_parent(const Type* t) { parent_ = t; }
+  int Depth() const;
+  virtual std::string ToExplicitString() const = 0;
+
+ private:
+  bool IsAbstractName(const std::string& name) const;
+
+  // If {parent_} is not nullptr, then this type is a subtype of {parent_}.
+  const Type* parent_;
+  mutable std::set<std::string> aliases_;
+};
+
+using TypeVector = std::vector<const Type*>;
+
+class AbstractType final : public Type {
+ public:
+  DECLARE_TYPE_BOILERPLATE(AbstractType);
+  const std::string& name() const { return name_; }
+  std::string ToExplicitString() const override { return name(); }
+  std::string MangledName() const override { return "AT" + name(); }
+  std::string GetGeneratedTypeName() const override { return generated_type_; }
+  std::string GetGeneratedTNodeTypeName() const override;
+  bool IsConstexpr() const override {
+    return name().substr(0, strlen(CONSTEXPR_TYPE_PREFIX)) ==
+           CONSTEXPR_TYPE_PREFIX;
+  }
+  const Type* NonConstexprVersion() const override {
+    if (IsConstexpr()) return *non_constexpr_version_;
+    return this;
+  }
+
+ private:
+  friend class TypeOracle;
+  AbstractType(const Type* parent, const std::string& name,
+               const std::string& generated_type,
+               base::Optional<const AbstractType*> non_constexpr_version)
+      : Type(Kind::kAbstractType, parent),
+        name_(name),
+        generated_type_(generated_type),
+        non_constexpr_version_(non_constexpr_version) {
+    DCHECK_EQ(non_constexpr_version_.has_value(), IsConstexpr());
+    if (parent) DCHECK(parent->IsConstexpr() == IsConstexpr());
+  }
+
+  const std::string name_;
+  const std::string generated_type_;
+  base::Optional<const AbstractType*> non_constexpr_version_;
+};
+
+// For now, function pointers are restricted to Code objects of Torque-defined
+// builtins.
+class FunctionPointerType final : public Type {
+ public:
+  DECLARE_TYPE_BOILERPLATE(FunctionPointerType);
+  std::string ToExplicitString() const override;
+  std::string MangledName() const override;
+  std::string GetGeneratedTypeName() const override {
+    return parent()->GetGeneratedTypeName();
+  }
+  std::string GetGeneratedTNodeTypeName() const override {
+    return parent()->GetGeneratedTNodeTypeName();
+  }
+  bool IsConstexpr() const override {
+    DCHECK(!parent()->IsConstexpr());
+    return false;
+  }
+  const Type* NonConstexprVersion() const override { return this; }
+
+  const TypeVector& parameter_types() const { return parameter_types_; }
+  const Type* return_type() const { return return_type_; }
+
+  friend size_t hash_value(const FunctionPointerType& p) {
+    size_t result = base::hash_value(p.return_type_);
+    for (const Type* parameter : p.parameter_types_) {
+      result = base::hash_combine(result, parameter);
+    }
+    return result;
+  }
+  bool operator==(const FunctionPointerType& other) const {
+    return parameter_types_ == other.parameter_types_ &&
+           return_type_ == other.return_type_;
+  }
+
+ private:
+  friend class TypeOracle;
+  FunctionPointerType(const Type* parent, TypeVector parameter_types,
+                      const Type* return_type)
+      : Type(Kind::kFunctionPointerType, parent),
+        parameter_types_(parameter_types),
+        return_type_(return_type) {}
+
+  const TypeVector parameter_types_;
+  const Type* const return_type_;
+};
+
+bool operator<(const Type& a, const Type& b);
+struct TypeLess {
+  bool operator()(const Type* const a, const Type* const b) const {
+    return *a < *b;
+  }
+};
+
+class UnionType final : public Type {
+ public:
+  DECLARE_TYPE_BOILERPLATE(UnionType);
+  std::string ToExplicitString() const override;
+  std::string MangledName() const override;
+  std::string GetGeneratedTypeName() const override {
+    return "TNode<" + GetGeneratedTNodeTypeName() + ">";
+  }
+  std::string GetGeneratedTNodeTypeName() const override;
+
+  bool IsConstexpr() const override {
+    DCHECK_EQ(false, parent()->IsConstexpr());
+    return false;
+  }
+  const Type* NonConstexprVersion() const override;
+
+  friend size_t hash_value(const UnionType& p) {
+    size_t result = 0;
+    for (const Type* t : p.types_) {
+      result = base::hash_combine(result, t);
+    }
+    return result;
+  }
+  bool operator==(const UnionType& other) const {
+    return types_ == other.types_;
+  }
+
+  base::Optional<const Type*> GetSingleMember() const {
+    if (types_.size() == 1) {
+      DCHECK_EQ(*types_.begin(), parent());
+      return *types_.begin();
+    }
+    return base::nullopt;
+  }
+
+  const Type* Normalize() const {
+    if (types_.size() == 1) {
+      return parent();
+    }
+    return this;
+  }
+
+  bool IsSubtypeOf(const Type* other) const override {
+    for (const Type* member : types_) {
+      if (!member->IsSubtypeOf(other)) return false;
+    }
+    return true;
+  }
+
+  bool IsSupertypeOf(const Type* other) const {
+    for (const Type* member : types_) {
+      if (other->IsSubtypeOf(member)) {
+        return true;
+      }
+    }
+    return false;
+  }
+
+  void Extend(const Type* t) {
+    if (const UnionType* union_type = UnionType::DynamicCast(t)) {
+      for (const Type* member : union_type->types_) {
+        Extend(member);
+      }
+    } else {
+      if (t->IsSubtypeOf(this)) return;
+      set_parent(CommonSupertype(parent(), t));
+      for (const Type* member : types_) {
+        if (member->IsSubtypeOf(t)) {
+          types_.erase(member);
+        }
+      }
+      types_.insert(t);
+    }
+  }
+
+  static UnionType FromType(const Type* t) {
+    const UnionType* union_type = UnionType::DynamicCast(t);
+    return union_type ? UnionType(*union_type) : UnionType(t);
+  }
+
+ private:
+  explicit UnionType(const Type* t) : Type(Kind::kUnionType, t), types_({t}) {}
+
+  std::set<const Type*, TypeLess> types_;
+};
+
+inline std::ostream& operator<<(std::ostream& os, const Type& t) {
+  os << t.ToString();
+  return os;
+}
+
+class VisitResult {
+ public:
+  VisitResult() {}
+  VisitResult(const Type* type, const std::string& value)
+      : type_(type), value_(value), declarable_{} {}
+  VisitResult(const Type* type, const Value* declarable);
+  const Type* type() const { return type_; }
+  // const std::string& variable() const { return variable_; }
+  base::Optional<const Value*> declarable() const { return declarable_; }
+  std::string value() const { return value_; }
+  std::string LValue() const;
+  std::string RValue() const;
+
+ private:
+  const Type* type_;
+  std::string value_;
+  base::Optional<const Value*> declarable_;
+};
+
+class VisitResultVector : public std::vector<VisitResult> {
+ public:
+  VisitResultVector() : std::vector<VisitResult>() {}
+  VisitResultVector(std::initializer_list<VisitResult> init)
+      : std::vector<VisitResult>(init) {}
+  TypeVector GetTypeVector() const {
+    TypeVector result;
+    for (auto& visit_result : *this) {
+      result.push_back(visit_result.type());
+    }
+    return result;
+  }
+};
+
+std::ostream& operator<<(std::ostream& os, const TypeVector& types);
+
+struct NameAndType {
+  std::string name;
+  const Type* type;
+};
+
+typedef std::vector<NameAndType> NameAndTypeVector;
+
+struct LabelDefinition {
+  std::string name;
+  NameAndTypeVector parameters;
+};
+
+typedef std::vector<LabelDefinition> LabelDefinitionVector;
+
+struct LabelDeclaration {
+  std::string name;
+  TypeVector types;
+};
+
+typedef std::vector<LabelDeclaration> LabelDeclarationVector;
+
+struct ParameterTypes {
+  TypeVector types;
+  bool var_args;
+};
+
+std::ostream& operator<<(std::ostream& os, const ParameterTypes& parameters);
+
+struct Signature {
+  const TypeVector& types() const { return parameter_types.types; }
+  NameVector parameter_names;
+  ParameterTypes parameter_types;
+  const Type* return_type;
+  LabelDeclarationVector labels;
+  bool HasSameTypesAs(const Signature& other) const;
+};
+
+struct Arguments {
+  VisitResultVector parameters;
+  std::vector<Label*> labels;
+};
+
+void PrintSignature(std::ostream& os, const Signature& sig, bool with_names);
+std::ostream& operator<<(std::ostream& os, const Signature& sig);
+
+bool IsAssignableFrom(const Type* to, const Type* from);
+bool IsCompatibleSignature(const Signature& sig, const TypeVector& types,
+                           const std::vector<Label*>& labels);
+
+}  // namespace torque
+}  // namespace internal
+}  // namespace v8
+
+#endif  // V8_TORQUE_TYPES_H_
diff --git a/deps/v8/src/torque/utils.cc b/deps/v8/src/torque/utils.cc
new file mode 100644
index 00000000000000..24aeb6fc11c608
--- /dev/null
+++ b/deps/v8/src/torque/utils.cc
@@ -0,0 +1,69 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include <algorithm>
+#include <fstream>
+#include <iostream>
+#include <string>
+
+#include "src/torque/ast.h"
+#include "src/torque/utils.h"
+
+namespace v8 {
+namespace internal {
+namespace torque {
+
+std::string CurrentPositionAsString() {
+  return PositionAsString(CurrentSourcePosition::Get());
+}
+
+[[noreturn]] void ReportError(const std::string& error) {
+  std::cerr << CurrentPositionAsString() << ": Torque error: " << error << "\n";
+  throw(-1);
+}
+
+std::string CamelifyString(const std::string& underscore_string) {
+  std::string result;
+  bool word_beginning = true;
+  for (auto current : underscore_string) {
+    if (current == '_' || current == '-') {
+      word_beginning = true;
+      continue;
+    }
+    if (word_beginning) {
+      current = toupper(current);
+    }
+    result += current;
+    word_beginning = false;
+  }
+  return result;
+}
+
+std::string DashifyString(const std::string& underscore_string) {
+  std::string result = underscore_string;
+  std::replace(result.begin(), result.end(), '_', '-');
+  return result;
+}
+
+void ReplaceFileContentsIfDifferent(const std::string& file_path,
+                                    const std::string& contents) {
+  std::ifstream old_contents_stream(file_path.c_str());
+  std::string old_contents;
+  if (old_contents_stream.good()) {
+    std::istreambuf_iterator<char> eos;
+    old_contents =
+        std::string(std::istreambuf_iterator<char>(old_contents_stream), eos);
+    old_contents_stream.close();
+  }
+  if (old_contents.length() == 0 || old_contents != contents) {
+    std::ofstream new_contents_stream;
+    new_contents_stream.open(file_path.c_str());
+    new_contents_stream << contents;
+    new_contents_stream.close();
+  }
+}
+
+}  // namespace torque
+}  // namespace internal
+}  // namespace v8
diff --git a/deps/v8/src/torque/utils.h b/deps/v8/src/torque/utils.h
new file mode 100644
index 00000000000000..59379fa526dfe2
--- /dev/null
+++ b/deps/v8/src/torque/utils.h
@@ -0,0 +1,86 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef V8_TORQUE_UTILS_H_
+#define V8_TORQUE_UTILS_H_
+
+#include <string>
+#include <unordered_set>
+#include <vector>
+
+#include "src/base/functional.h"
+
+namespace v8 {
+namespace internal {
+namespace torque {
+
+typedef std::vector<std::string> NameVector;
+
+[[noreturn]] void ReportError(const std::string& error);
+
+std::string CamelifyString(const std::string& underscore_string);
+std::string DashifyString(const std::string& underscore_string);
+
+void ReplaceFileContentsIfDifferent(const std::string& file_path,
+                                    const std::string& contents);
+
+std::string CurrentPositionAsString();
+
+template <class T>
+class Deduplicator {
+ public:
+  const T* Add(T x) { return &*(storage_.insert(std::move(x)).first); }
+
+ private:
+  std::unordered_set<T, base::hash<T>> storage_;
+};
+
+template <class C, class T>
+void PrintCommaSeparatedList(std::ostream& os, const T& list, C transform) {
+  bool first = true;
+  for (auto& e : list) {
+    if (first) {
+      first = false;
+    } else {
+      os << ", ";
+    }
+    os << transform(e);
+  }
+}
+
+template <class T,
+          typename std::enable_if<
+              std::is_pointer<typename T::value_type>::value, int>::type = 0>
+void PrintCommaSeparatedList(std::ostream& os, const T& list) {
+  bool first = true;
+  for (auto& e : list) {
+    if (first) {
+      first = false;
+    } else {
+      os << ", ";
+    }
+    os << *e;
+  }
+}
+
+template <class T,
+          typename std::enable_if<
+              !std::is_pointer<typename T::value_type>::value, int>::type = 0>
+void PrintCommaSeparatedList(std::ostream& os, const T& list) {
+  bool first = true;
+  for (auto& e : list) {
+    if (first) {
+      first = false;
+    } else {
+      os << ", ";
+    }
+    os << e;
+  }
+}
+
+}  // namespace torque
+}  // namespace internal
+}  // namespace v8
+
+#endif  // V8_TORQUE_UTILS_H_
diff --git a/deps/v8/src/tracing/trace-event.h b/deps/v8/src/tracing/trace-event.h
index bd56f8a555281c..52b3bc34610be2 100644
--- a/deps/v8/src/tracing/trace-event.h
+++ b/deps/v8/src/tracing/trace-event.h
@@ -242,16 +242,30 @@ enum CategoryGroupEnabledFlags {
     }                                                                        \
   } while (0)
 
-// Adds a trace event with a given id and timestamp. Not Implemented.
-#define INTERNAL_TRACE_EVENT_ADD_WITH_ID_AND_TIMESTAMP(     \
-    phase, category_group, name, id, timestamp, flags, ...) \
-  UNIMPLEMENTED()
+// Adds a trace event with a given id and timestamp.
+#define INTERNAL_TRACE_EVENT_ADD_WITH_ID_AND_TIMESTAMP(                        \
+    phase, category_group, name, id, timestamp, flags, ...)                    \
+  do {                                                                         \
+    INTERNAL_TRACE_EVENT_GET_CATEGORY_INFO(category_group);                    \
+    if (INTERNAL_TRACE_EVENT_CATEGORY_GROUP_ENABLED_FOR_RECORDING_MODE()) {    \
+      unsigned int trace_event_flags = flags | TRACE_EVENT_FLAG_HAS_ID;        \
+      v8::internal::tracing::TraceID trace_event_trace_id(id,                  \
+                                                          &trace_event_flags); \
+      v8::internal::tracing::AddTraceEventWithTimestamp(                       \
+          phase, INTERNAL_TRACE_EVENT_UID(category_group_enabled), name,       \
+          trace_event_trace_id.scope(), trace_event_trace_id.raw_id(),         \
+          v8::internal::tracing::kNoId, trace_event_flags, timestamp,          \
+          ##__VA_ARGS__);                                                      \
+    }                                                                          \
+  } while (0)
 
-// Adds a trace event with a given id, thread_id, and timestamp. Not
-// Implemented.
+// Adds a trace event with a given id, thread_id, and timestamp. This redirects
+// to INTERNAL_TRACE_EVENT_ADD_WITH_ID_AND_TIMESTAMP as we presently do not care
+// about the thread id.
 #define INTERNAL_TRACE_EVENT_ADD_WITH_ID_TID_AND_TIMESTAMP(            \
     phase, category_group, name, id, thread_id, timestamp, flags, ...) \
-  UNIMPLEMENTED()
+  INTERNAL_TRACE_EVENT_ADD_WITH_ID_AND_TIMESTAMP(                      \
+      phase, category_group, name, id, timestamp, flags, ##__VA_ARGS__)
 
 // Enter and leave a context based on the current scope.
 #define INTERNAL_TRACE_EVENT_SCOPED_CONTEXT(category_group, name, context) \
diff --git a/deps/v8/src/transitions-inl.h b/deps/v8/src/transitions-inl.h
index 59aac025ee0b3f..8e0396cd93b5e3 100644
--- a/deps/v8/src/transitions-inl.h
+++ b/deps/v8/src/transitions-inl.h
@@ -8,6 +8,8 @@
 #include "src/transitions.h"
 
 #include "src/ic/handler-configuration-inl.h"
+#include "src/objects/fixed-array-inl.h"
+#include "src/objects/maybe-object-inl.h"
 
 // Has to be the last include (doesn't have include guards):
 #include "src/objects/object-macros.h"
@@ -15,15 +17,6 @@
 namespace v8 {
 namespace internal {
 
-WeakCell* TransitionsAccessor::GetTargetCell() {
-  DCHECK(!needs_reload_);
-  if (target_cell_ == nullptr) {
-    target_cell_ =
-        StoreHandler::GetTransitionCell(raw_transitions_->ToStrongHeapObject());
-  }
-  return target_cell_;
-}
-
 TransitionArray* TransitionsAccessor::transitions() {
   DCHECK_EQ(kFullTransitionArray, encoding());
   return TransitionArray::cast(raw_transitions_->ToStrongHeapObject());
@@ -32,74 +25,73 @@ TransitionArray* TransitionsAccessor::transitions() {
 CAST_ACCESSOR(TransitionArray)
 
 bool TransitionArray::HasPrototypeTransitions() {
-  return get(kPrototypeTransitionsIndex) != Smi::kZero;
+  return Get(kPrototypeTransitionsIndex) != MaybeObject::FromSmi(Smi::kZero);
 }
 
-
-FixedArray* TransitionArray::GetPrototypeTransitions() {
+WeakFixedArray* TransitionArray::GetPrototypeTransitions() {
   DCHECK(HasPrototypeTransitions());  // Callers must check first.
-  Object* prototype_transitions = get(kPrototypeTransitionsIndex);
-  return FixedArray::cast(prototype_transitions);
+  Object* prototype_transitions =
+      Get(kPrototypeTransitionsIndex)->ToStrongHeapObject();
+  return WeakFixedArray::cast(prototype_transitions);
 }
 
-
-void TransitionArray::SetPrototypeTransitions(FixedArray* transitions) {
-  DCHECK(transitions->IsFixedArray());
-  set(kPrototypeTransitionsIndex, transitions);
+HeapObjectReference** TransitionArray::GetKeySlot(int transition_number) {
+  DCHECK(transition_number < number_of_transitions());
+  return reinterpret_cast<HeapObjectReference**>(
+      RawFieldOfElementAt(ToKeyIndex(transition_number)));
 }
 
-
-Object** TransitionArray::GetPrototypeTransitionsSlot() {
-  return RawFieldOfElementAt(kPrototypeTransitionsIndex);
+void TransitionArray::SetPrototypeTransitions(WeakFixedArray* transitions) {
+  DCHECK(transitions->IsWeakFixedArray());
+  WeakFixedArray::Set(kPrototypeTransitionsIndex,
+                      HeapObjectReference::Strong(transitions));
 }
 
-
-Object** TransitionArray::GetKeySlot(int transition_number) {
-  DCHECK(transition_number < number_of_transitions());
-  return RawFieldOfElementAt(ToKeyIndex(transition_number));
+int TransitionArray::NumberOfPrototypeTransitions(
+    WeakFixedArray* proto_transitions) {
+  if (proto_transitions->length() == 0) return 0;
+  MaybeObject* raw =
+      proto_transitions->Get(kProtoTransitionNumberOfEntriesOffset);
+  return Smi::ToInt(raw->ToSmi());
 }
 
-
 Name* TransitionArray::GetKey(int transition_number) {
   DCHECK(transition_number < number_of_transitions());
-  return Name::cast(get(ToKeyIndex(transition_number)));
+  return Name::cast(Get(ToKeyIndex(transition_number))->ToStrongHeapObject());
 }
 
 Name* TransitionsAccessor::GetKey(int transition_number) {
-  Map* map = nullptr;
   switch (encoding()) {
     case kPrototypeInfo:
     case kUninitialized:
       UNREACHABLE();
       return nullptr;
-    case kWeakRef:
-      map = Map::cast(raw_transitions_->ToWeakHeapObject());
-      break;
-    case kHandler: {
-      WeakCell* cell = GetTargetCell();
-      DCHECK(!cell->cleared());
-      map = Map::cast(cell->value());
-      break;
+    case kWeakRef: {
+      Map* map = Map::cast(raw_transitions_->ToWeakHeapObject());
+      return GetSimpleTransitionKey(map);
     }
     case kFullTransitionArray:
       return transitions()->GetKey(transition_number);
   }
-  return GetSimpleTransitionKey(map);
+  UNREACHABLE();
 }
 
 void TransitionArray::SetKey(int transition_number, Name* key) {
   DCHECK(transition_number < number_of_transitions());
-  set(ToKeyIndex(transition_number), key);
+  WeakFixedArray::Set(ToKeyIndex(transition_number),
+                      HeapObjectReference::Strong(key));
 }
 
-Object** TransitionArray::GetTargetSlot(int transition_number) {
+HeapObjectReference** TransitionArray::GetTargetSlot(int transition_number) {
   DCHECK(transition_number < number_of_transitions());
-  return RawFieldOfElementAt(ToTargetIndex(transition_number));
+  return reinterpret_cast<HeapObjectReference**>(
+      RawFieldOfElementAt(ToTargetIndex(transition_number)));
 }
 
 // static
-PropertyDetails TransitionsAccessor::GetTargetDetails(Name* name, Map* target) {
-  DCHECK(!IsSpecialTransition(name));
+PropertyDetails TransitionsAccessor::GetTargetDetails(Isolate* isolate,
+                                                      Name* name, Map* target) {
+  DCHECK(!IsSpecialTransition(isolate, name));
   int descriptor = target->LastAdded();
   DescriptorArray* descriptors = target->instance_descriptors();
   // Transitions are allowed only for the last added property.
@@ -108,18 +100,17 @@ PropertyDetails TransitionsAccessor::GetTargetDetails(Name* name, Map* target) {
 }
 
 // static
-Map* TransitionsAccessor::GetTargetFromRaw(Object* raw) {
-  if (raw->IsWeakCell()) return Map::cast(WeakCell::cast(raw)->value());
-  return Map::cast(StoreHandler::GetTransitionCell(raw)->value());
+Map* TransitionsAccessor::GetTargetFromRaw(MaybeObject* raw) {
+  return Map::cast(raw->ToWeakHeapObject());
 }
 
-Object* TransitionArray::GetRawTarget(int transition_number) {
+MaybeObject* TransitionArray::GetRawTarget(int transition_number) {
   DCHECK(transition_number < number_of_transitions());
-  return get(ToTargetIndex(transition_number));
+  return Get(ToTargetIndex(transition_number));
 }
 
 Map* TransitionArray::GetTarget(int transition_number) {
-  Object* raw = GetRawTarget(transition_number);
+  MaybeObject* raw = GetRawTarget(transition_number);
   return TransitionsAccessor::GetTargetFromRaw(raw);
 }
 
@@ -131,27 +122,24 @@ Map* TransitionsAccessor::GetTarget(int transition_number) {
       return nullptr;
     case kWeakRef:
       return Map::cast(raw_transitions_->ToWeakHeapObject());
-    case kHandler: {
-      WeakCell* cell = GetTargetCell();
-      DCHECK(!cell->cleared());
-      return Map::cast(cell->value());
-    }
     case kFullTransitionArray:
       return transitions()->GetTarget(transition_number);
   }
   UNREACHABLE();
 }
 
-void TransitionArray::SetTarget(int transition_number, Object* value) {
-  DCHECK(!value->IsMap());
+void TransitionArray::SetRawTarget(int transition_number, MaybeObject* value) {
   DCHECK(transition_number < number_of_transitions());
-  set(ToTargetIndex(transition_number), value);
+  DCHECK(value->IsWeakHeapObject() && value->ToWeakHeapObject()->IsMap());
+  WeakFixedArray::Set(ToTargetIndex(transition_number), value);
 }
 
 bool TransitionArray::GetTargetIfExists(int transition_number, Isolate* isolate,
                                         Map** target) {
-  Object* raw = GetRawTarget(transition_number);
-  if (raw->IsUndefined(isolate)) {
+  MaybeObject* raw = GetRawTarget(transition_number);
+  HeapObject* heap_object;
+  if (raw->ToStrongHeapObject(&heap_object) &&
+      heap_object->IsUndefined(isolate)) {
     return false;
   }
   *target = TransitionsAccessor::GetTargetFromRaw(raw);
@@ -160,8 +148,13 @@ bool TransitionArray::GetTargetIfExists(int transition_number, Isolate* isolate,
 
 int TransitionArray::SearchName(Name* name, int* out_insertion_index) {
   DCHECK(name->IsUniqueName());
-  return internal::Search<ALL_ENTRIES>(this, name, number_of_entries(),
-                                       out_insertion_index);
+  return internal::Search<ALL_ENTRIES>(
+      GetIsolate(), this, name, number_of_entries(), out_insertion_index);
+}
+
+int TransitionArray::number_of_transitions() const {
+  if (length() < kFirstIndex) return 0;
+  return Smi::ToInt(Get(kTransitionLengthIndex)->ToSmi());
 }
 
 int TransitionArray::CompareKeys(Name* key1, uint32_t hash1, PropertyKind kind1,
@@ -200,9 +193,11 @@ int TransitionArray::CompareDetails(PropertyKind kind1,
   return 0;
 }
 
-void TransitionArray::Set(int transition_number, Name* key, Object* target) {
-  set(ToKeyIndex(transition_number), key);
-  set(ToTargetIndex(transition_number), target);
+void TransitionArray::Set(int transition_number, Name* key,
+                          MaybeObject* target) {
+  WeakFixedArray::Set(ToKeyIndex(transition_number),
+                      MaybeObject::FromObject(key));
+  WeakFixedArray::Set(ToTargetIndex(transition_number), target);
 }
 
 int TransitionArray::Capacity() {
@@ -212,7 +207,9 @@ int TransitionArray::Capacity() {
 
 void TransitionArray::SetNumberOfTransitions(int number_of_transitions) {
   DCHECK(number_of_transitions <= Capacity());
-  set(kTransitionLengthIndex, Smi::FromInt(number_of_transitions));
+  WeakFixedArray::Set(
+      kTransitionLengthIndex,
+      MaybeObject::FromSmi(Smi::FromInt(number_of_transitions)));
 }
 
 }  // namespace internal
diff --git a/deps/v8/src/transitions.cc b/deps/v8/src/transitions.cc
index 3f312a23066476..fcecf6965892f2 100644
--- a/deps/v8/src/transitions.cc
+++ b/deps/v8/src/transitions.cc
@@ -20,9 +20,7 @@ void TransitionsAccessor::Initialize() {
   } else if (raw_transitions_->IsWeakHeapObject()) {
     encoding_ = kWeakRef;
   } else if (raw_transitions_->ToStrongHeapObject(&heap_object)) {
-    if (heap_object->IsStoreHandler()) {
-      encoding_ = kHandler;
-    } else if (heap_object->IsTransitionArray()) {
+    if (heap_object->IsTransitionArray()) {
       encoding_ = kFullTransitionArray;
     } else {
       DCHECK(heap_object->IsPrototypeInfo());
@@ -31,7 +29,6 @@ void TransitionsAccessor::Initialize() {
   } else {
     UNREACHABLE();
   }
-  target_cell_ = nullptr;
 #if DEBUG
   needs_reload_ = false;
 #endif
@@ -41,8 +38,6 @@ Map* TransitionsAccessor::GetSimpleTransition() {
   switch (encoding()) {
     case kWeakRef:
       return Map::cast(raw_transitions_->ToWeakHeapObject());
-    case kHandler:
-      return Map::cast(GetTargetCell()->value());
     default:
       return nullptr;
   }
@@ -52,10 +47,6 @@ bool TransitionsAccessor::HasSimpleTransitionTo(Map* map) {
   switch (encoding()) {
     case kWeakRef:
       return raw_transitions_->ToWeakHeapObject() == map;
-    case kHandler:
-      return StoreHandler::GetTransitionCell(
-                 raw_transitions_->ToStrongHeapObject())
-                 ->value() == map;
     case kPrototypeInfo:
     case kUninitialized:
     case kFullTransitionArray:
@@ -67,7 +58,6 @@ bool TransitionsAccessor::HasSimpleTransitionTo(Map* map) {
 void TransitionsAccessor::Insert(Handle<Name> name, Handle<Map> target,
                                  SimpleTransitionFlag flag) {
   DCHECK(!map_handle_.is_null());
-  Isolate* isolate = map_->GetIsolate();
   target->SetBackPointer(map_);
 
   // If the map doesn't have any transitions at all yet, install the new one.
@@ -77,7 +67,8 @@ void TransitionsAccessor::Insert(Handle<Name> name, Handle<Map> target,
       return;
     }
     // If the flag requires a full TransitionArray, allocate one.
-    Handle<TransitionArray> result = TransitionArray::Allocate(isolate, 0, 1);
+    Handle<TransitionArray> result =
+        isolate_->factory()->NewTransitionArray(0, 1);
     ReplaceTransitions(MaybeObject::FromObject(*result));
     Reload();
   }
@@ -88,9 +79,9 @@ void TransitionsAccessor::Insert(Handle<Name> name, Handle<Map> target,
   if (simple_transition != nullptr) {
     Name* key = GetSimpleTransitionKey(simple_transition);
     PropertyDetails old_details = GetSimpleTargetDetails(simple_transition);
-    PropertyDetails new_details = is_special_transition
-                                      ? PropertyDetails::Empty()
-                                      : GetTargetDetails(*name, *target);
+    PropertyDetails new_details =
+        is_special_transition ? PropertyDetails::Empty()
+                              : GetTargetDetails(isolate_, *name, *target);
     if (flag == SIMPLE_PROPERTY_TRANSITION && key->Equals(*name) &&
         old_details.kind() == new_details.kind() &&
         old_details.attributes() == new_details.attributes()) {
@@ -98,19 +89,17 @@ void TransitionsAccessor::Insert(Handle<Name> name, Handle<Map> target,
       return;
     }
     // Otherwise allocate a full TransitionArray with slack for a new entry.
-    Handle<Map> map(simple_transition);
-    Handle<WeakCell> weak_cell = Map::WeakCellForMap(map);
-    Handle<TransitionArray> result = TransitionArray::Allocate(isolate, 1, 1);
+    Handle<Map> map(simple_transition, isolate_);
+    Handle<TransitionArray> result =
+        isolate_->factory()->NewTransitionArray(1, 1);
     // Reload state; allocations might have caused it to be cleared.
     Reload();
     simple_transition = GetSimpleTransition();
     if (simple_transition != nullptr) {
       DCHECK_EQ(*map, simple_transition);
       if (encoding_ == kWeakRef) {
-        result->Set(0, GetSimpleTransitionKey(simple_transition), *weak_cell);
-      } else if (encoding_ == kHandler) {
         result->Set(0, GetSimpleTransitionKey(simple_transition),
-                    raw_transitions_->ToStrongHeapObject());
+                    HeapObjectReference::Weak(simple_transition));
       } else {
         UNREACHABLE();
       }
@@ -124,16 +113,13 @@ void TransitionsAccessor::Insert(Handle<Name> name, Handle<Map> target,
   // At this point, we know that the map has a full TransitionArray.
   DCHECK_EQ(kFullTransitionArray, encoding());
 
-  Handle<WeakCell> weak_cell_with_target = Map::WeakCellForMap(target);
-  Reload();
-
   int number_of_transitions = 0;
   int new_nof = 0;
   int insertion_index = kNotFound;
-  DCHECK_EQ(is_special_transition, IsSpecialTransition(*name));
+  DCHECK_EQ(is_special_transition, IsSpecialTransition(isolate_, *name));
   PropertyDetails details = is_special_transition
                                 ? PropertyDetails::Empty()
-                                : GetTargetDetails(*name, *target);
+                                : GetTargetDetails(isolate_, *name, *target);
 
   {
     DisallowHeapAllocation no_gc;
@@ -144,11 +130,11 @@ void TransitionsAccessor::Insert(Handle<Name> name, Handle<Map> target,
     int index =
         is_special_transition
             ? array->SearchSpecial(Symbol::cast(*name), &insertion_index)
-            : array->Search(details.kind(), *name, details.attributes(),
-                            &insertion_index);
+            : array->Search(isolate_, details.kind(), *name,
+                            details.attributes(), &insertion_index);
     // If an existing entry was found, overwrite it and return.
     if (index != kNotFound) {
-      array->SetTarget(index, *weak_cell_with_target);
+      array->SetRawTarget(index, HeapObjectReference::Weak(*target));
       return;
     }
 
@@ -161,18 +147,18 @@ void TransitionsAccessor::Insert(Handle<Name> name, Handle<Map> target,
       array->SetNumberOfTransitions(new_nof);
       for (index = number_of_transitions; index > insertion_index; --index) {
         array->SetKey(index, array->GetKey(index - 1));
-        array->SetTarget(index, array->GetRawTarget(index - 1));
+        array->SetRawTarget(index, array->GetRawTarget(index - 1));
       }
       array->SetKey(index, *name);
-      array->SetTarget(index, *weak_cell_with_target);
-      SLOW_DCHECK(array->IsSortedNoDuplicates());
+      array->SetRawTarget(index, HeapObjectReference::Weak(*target));
+      SLOW_DCHECK(array->IsSortedNoDuplicates(isolate_));
       return;
     }
   }
 
   // We're gonna need a bigger TransitionArray.
-  Handle<TransitionArray> result = TransitionArray::Allocate(
-      isolate, new_nof,
+  Handle<TransitionArray> result = isolate_->factory()->NewTransitionArray(
+      new_nof,
       Map::SlackForArraySize(number_of_transitions, kMaxNumberOfTransitions));
 
   // The map's transition array may have shrunk during the allocation above as
@@ -191,8 +177,8 @@ void TransitionsAccessor::Insert(Handle<Name> name, Handle<Map> target,
     int index =
         is_special_transition
             ? array->SearchSpecial(Symbol::cast(*name), &insertion_index)
-            : array->Search(details.kind(), *name, details.attributes(),
-                            &insertion_index);
+            : array->Search(isolate_, details.kind(), *name,
+                            details.attributes(), &insertion_index);
     if (index == kNotFound) {
       ++new_nof;
     } else {
@@ -200,7 +186,6 @@ void TransitionsAccessor::Insert(Handle<Name> name, Handle<Map> target,
     }
     DCHECK(insertion_index >= 0 && insertion_index <= number_of_transitions);
 
-    result->Shrink(TransitionArray::ToKeyIndex(new_nof));
     result->SetNumberOfTransitions(new_nof);
   }
 
@@ -212,40 +197,34 @@ void TransitionsAccessor::Insert(Handle<Name> name, Handle<Map> target,
   for (int i = 0; i < insertion_index; ++i) {
     result->Set(i, array->GetKey(i), array->GetRawTarget(i));
   }
-  result->Set(insertion_index, *name, *weak_cell_with_target);
+  result->Set(insertion_index, *name, HeapObjectReference::Weak(*target));
   for (int i = insertion_index; i < number_of_transitions; ++i) {
     result->Set(i + 1, array->GetKey(i), array->GetRawTarget(i));
   }
 
-  SLOW_DCHECK(result->IsSortedNoDuplicates());
+  SLOW_DCHECK(result->IsSortedNoDuplicates(isolate_));
   ReplaceTransitions(MaybeObject::FromObject(*result));
 }
 
 Map* TransitionsAccessor::SearchTransition(Name* name, PropertyKind kind,
                                            PropertyAttributes attributes) {
   DCHECK(name->IsUniqueName());
-  Map* map = nullptr;
   switch (encoding()) {
     case kPrototypeInfo:
     case kUninitialized:
       return nullptr;
-    case kWeakRef:
-      map = Map::cast(raw_transitions_->ToWeakHeapObject());
-      break;
-    case kHandler: {
-      WeakCell* cell = GetTargetCell();
-      DCHECK(!cell->cleared());
-      map = Map::cast(cell->value());
-      break;
+    case kWeakRef: {
+      Map* map = Map::cast(raw_transitions_->ToWeakHeapObject());
+      if (!IsMatchingMap(map, name, kind, attributes)) return nullptr;
+      return map;
     }
     case kFullTransitionArray: {
-      int transition = transitions()->Search(kind, name, attributes);
+      int transition = transitions()->Search(isolate_, kind, name, attributes);
       if (transition == kNotFound) return nullptr;
       return transitions()->GetTarget(transition);
     }
   }
-  if (!IsMatchingMap(map, name, kind, attributes)) return nullptr;
-  return map;
+  UNREACHABLE();
 }
 
 Map* TransitionsAccessor::SearchSpecial(Symbol* name) {
@@ -256,13 +235,13 @@ Map* TransitionsAccessor::SearchSpecial(Symbol* name) {
 }
 
 // static
-bool TransitionsAccessor::IsSpecialTransition(Name* name) {
+bool TransitionsAccessor::IsSpecialTransition(Isolate* isolate, Name* name) {
   if (!name->IsSymbol()) return false;
-  Heap* heap = name->GetHeap();
-  return name == heap->nonextensible_symbol() ||
-         name == heap->sealed_symbol() || name == heap->frozen_symbol() ||
-         name == heap->elements_transition_symbol() ||
-         name == heap->strict_function_transition_symbol();
+  ReadOnlyRoots roots(isolate);
+  return name == roots.nonextensible_symbol() ||
+         name == roots.sealed_symbol() || name == roots.frozen_symbol() ||
+         name == roots.elements_transition_symbol() ||
+         name == roots.strict_function_transition_symbol();
 }
 
 MaybeHandle<Map> TransitionsAccessor::FindTransitionToDataProperty(
@@ -278,39 +257,33 @@ MaybeHandle<Map> TransitionsAccessor::FindTransitionToDataProperty(
   if (requested_location == kFieldOnly && details.location() != kField) {
     return MaybeHandle<Map>();
   }
-  return Handle<Map>(target);
+  return Handle<Map>(target, isolate_);
 }
 
 Handle<String> TransitionsAccessor::ExpectedTransitionKey() {
   DisallowHeapAllocation no_gc;
-  Map* target = nullptr;
   switch (encoding()) {
     case kPrototypeInfo:
     case kUninitialized:
     case kFullTransitionArray:
       return Handle<String>::null();
-    case kWeakRef:
-      target = Map::cast(raw_transitions_->ToWeakHeapObject());
-      break;
-    case kHandler: {
-      WeakCell* cell = GetTargetCell();
-      DCHECK(!cell->cleared());
-      target = Map::cast(cell->value());
-      break;
+    case kWeakRef: {
+      Map* target = Map::cast(raw_transitions_->ToWeakHeapObject());
+      PropertyDetails details = GetSimpleTargetDetails(target);
+      if (details.location() != kField) return Handle<String>::null();
+      DCHECK_EQ(kData, details.kind());
+      if (details.attributes() != NONE) return Handle<String>::null();
+      Name* name = GetSimpleTransitionKey(target);
+      if (!name->IsString()) return Handle<String>::null();
+      return handle(String::cast(name), isolate_);
     }
   }
-  PropertyDetails details = GetSimpleTargetDetails(target);
-  if (details.location() != kField) return Handle<String>::null();
-  DCHECK_EQ(kData, details.kind());
-  if (details.attributes() != NONE) return Handle<String>::null();
-  Name* name = GetSimpleTransitionKey(target);
-  if (!name->IsString()) return Handle<String>::null();
-  return handle(String::cast(name));
+  UNREACHABLE();
 }
 
 Handle<Map> TransitionsAccessor::ExpectedTransitionTarget() {
   DCHECK(!ExpectedTransitionKey().is_null());
-  return handle(GetTarget(0));
+  return handle(GetTarget(0), isolate_);
 }
 
 bool TransitionsAccessor::CanHaveMoreTransitions() {
@@ -334,7 +307,8 @@ bool TransitionsAccessor::IsMatchingMap(Map* target, Name* name,
 }
 
 // static
-bool TransitionArray::CompactPrototypeTransitionArray(FixedArray* array) {
+bool TransitionArray::CompactPrototypeTransitionArray(Isolate* isolate,
+                                                      WeakFixedArray* array) {
   const int header = kProtoTransitionHeaderSize;
   int number_of_transitions = NumberOfPrototypeTransitions(array);
   if (number_of_transitions == 0) {
@@ -343,17 +317,21 @@ bool TransitionArray::CompactPrototypeTransitionArray(FixedArray* array) {
   }
   int new_number_of_transitions = 0;
   for (int i = 0; i < number_of_transitions; i++) {
-    Object* cell = array->get(header + i);
-    if (!WeakCell::cast(cell)->cleared()) {
+    MaybeObject* target = array->Get(header + i);
+    DCHECK(target->IsClearedWeakHeapObject() ||
+           (target->IsWeakHeapObject() && target->ToWeakHeapObject()->IsMap()));
+    if (!target->IsClearedWeakHeapObject()) {
       if (new_number_of_transitions != i) {
-        array->set(header + new_number_of_transitions, cell);
+        array->Set(header + new_number_of_transitions, target);
       }
       new_number_of_transitions++;
     }
   }
   // Fill slots that became free with undefined value.
+  MaybeObject* undefined =
+      MaybeObject::FromObject(*isolate->factory()->undefined_value());
   for (int i = new_number_of_transitions; i < number_of_transitions; i++) {
-    array->set_undefined(header + i);
+    array->Set(header + i, undefined);
   }
   if (number_of_transitions != new_number_of_transitions) {
     SetNumberOfPrototypeTransitions(array, new_number_of_transitions);
@@ -363,14 +341,15 @@ bool TransitionArray::CompactPrototypeTransitionArray(FixedArray* array) {
 
 
 // static
-Handle<FixedArray> TransitionArray::GrowPrototypeTransitionArray(
-    Handle<FixedArray> array, int new_capacity, Isolate* isolate) {
+Handle<WeakFixedArray> TransitionArray::GrowPrototypeTransitionArray(
+    Handle<WeakFixedArray> array, int new_capacity, Isolate* isolate) {
   // Grow array by factor 2 up to MaxCachedPrototypeTransitions.
   int capacity = array->length() - kProtoTransitionHeaderSize;
   new_capacity = Min(kMaxCachedPrototypeTransitions, new_capacity);
   DCHECK_GT(new_capacity, capacity);
   int grow_by = new_capacity - capacity;
-  array = isolate->factory()->CopyFixedArrayAndGrow(array, grow_by, TENURED);
+  array =
+      isolate->factory()->CopyWeakFixedArrayAndGrow(array, grow_by, TENURED);
   if (capacity < 0) {
     // There was no prototype transitions array before, so the size
     // couldn't be copied. Initialize it explicitly.
@@ -389,16 +368,16 @@ void TransitionsAccessor::PutPrototypeTransition(Handle<Object> prototype,
 
   const int header = TransitionArray::kProtoTransitionHeaderSize;
 
-  Handle<FixedArray> cache(GetPrototypeTransitions());
+  Handle<WeakFixedArray> cache(GetPrototypeTransitions(), isolate_);
   int capacity = cache->length() - header;
   int transitions = TransitionArray::NumberOfPrototypeTransitions(*cache) + 1;
 
   if (transitions > capacity) {
     // Grow the array if compacting it doesn't free space.
-    if (!TransitionArray::CompactPrototypeTransitionArray(*cache)) {
+    if (!TransitionArray::CompactPrototypeTransitionArray(isolate_, *cache)) {
       if (capacity == TransitionArray::kMaxCachedPrototypeTransitions) return;
       cache = TransitionArray::GrowPrototypeTransitionArray(
-          cache, 2 * transitions, target_map->GetIsolate());
+          cache, 2 * transitions, isolate_);
       Reload();
       SetPrototypeTransitions(cache);
     }
@@ -408,42 +387,43 @@ void TransitionsAccessor::PutPrototypeTransition(Handle<Object> prototype,
   int last = TransitionArray::NumberOfPrototypeTransitions(*cache);
   int entry = header + last;
 
-  Handle<WeakCell> target_cell = Map::WeakCellForMap(target_map);
-  Reload();  // Reload after possible GC.
-  cache->set(entry, *target_cell);
+  cache->Set(entry, HeapObjectReference::Weak(*target_map));
   TransitionArray::SetNumberOfPrototypeTransitions(*cache, last + 1);
 }
 
 Handle<Map> TransitionsAccessor::GetPrototypeTransition(
     Handle<Object> prototype) {
   DisallowHeapAllocation no_gc;
-  FixedArray* cache = GetPrototypeTransitions();
+  WeakFixedArray* cache = GetPrototypeTransitions();
   int length = TransitionArray::NumberOfPrototypeTransitions(cache);
   for (int i = 0; i < length; i++) {
-    WeakCell* target_cell = WeakCell::cast(
-        cache->get(TransitionArray::kProtoTransitionHeaderSize + i));
-    if (!target_cell->cleared() &&
-        Map::cast(target_cell->value())->prototype() == *prototype) {
-      return handle(Map::cast(target_cell->value()));
+    MaybeObject* target =
+        cache->Get(TransitionArray::kProtoTransitionHeaderSize + i);
+    DCHECK(target->IsClearedWeakHeapObject() || target->IsWeakHeapObject());
+    if (!target->IsClearedWeakHeapObject()) {
+      Map* map = Map::cast(target->ToWeakHeapObject());
+      if (map->prototype() == *prototype) {
+        return handle(map, isolate_);
+      }
     }
   }
   return Handle<Map>();
 }
 
-FixedArray* TransitionsAccessor::GetPrototypeTransitions() {
+WeakFixedArray* TransitionsAccessor::GetPrototypeTransitions() {
   if (encoding() != kFullTransitionArray ||
       !transitions()->HasPrototypeTransitions()) {
-    return map_->GetHeap()->empty_fixed_array();
+    return ReadOnlyRoots(isolate_).empty_weak_fixed_array();
   }
   return transitions()->GetPrototypeTransitions();
 }
 
 // static
 void TransitionArray::SetNumberOfPrototypeTransitions(
-    FixedArray* proto_transitions, int value) {
+    WeakFixedArray* proto_transitions, int value) {
   DCHECK_NE(proto_transitions->length(), 0);
-  proto_transitions->set(kProtoTransitionNumberOfEntriesOffset,
-                         Smi::FromInt(value));
+  proto_transitions->Set(kProtoTransitionNumberOfEntriesOffset,
+                         MaybeObject::FromSmi(Smi::FromInt(value)));
 }
 
 int TransitionsAccessor::NumberOfTransitions() {
@@ -452,7 +432,6 @@ int TransitionsAccessor::NumberOfTransitions() {
     case kUninitialized:
       return 0;
     case kWeakRef:
-    case kHandler:
       return 1;
     case kFullTransitionArray:
       return transitions()->number_of_transitions();
@@ -461,20 +440,11 @@ int TransitionsAccessor::NumberOfTransitions() {
   return 0;  // Make GCC happy.
 }
 
-Handle<TransitionArray> TransitionArray::Allocate(Isolate* isolate,
-                                                  int number_of_transitions,
-                                                  int slack) {
-  Handle<FixedArray> array = isolate->factory()->NewTransitionArray(
-      LengthFor(number_of_transitions + slack));
-  array->set(kPrototypeTransitionsIndex, Smi::kZero);
-  array->set(kTransitionLengthIndex, Smi::FromInt(number_of_transitions));
-  return Handle<TransitionArray>::cast(array);
-}
-
-void TransitionArray::Zap() {
-  MemsetPointer(data_start() + kPrototypeTransitionsIndex,
-                GetHeap()->the_hole_value(),
-                length() - kPrototypeTransitionsIndex);
+void TransitionArray::Zap(Isolate* isolate) {
+  MemsetPointer(
+      data_start() + kPrototypeTransitionsIndex,
+      MaybeObject::FromObject(ReadOnlyRoots(isolate).the_hole_value()),
+      length() - kPrototypeTransitionsIndex);
   SetNumberOfTransitions(0);
 }
 
@@ -490,14 +460,14 @@ void TransitionsAccessor::ReplaceTransitions(MaybeObject* new_transitions) {
     // keep referenced objects alive, so we zap it.
     // When there is another reference to the array somewhere (e.g. a handle),
     // not zapping turns from a waste of memory into a source of crashes.
-    old_transitions->Zap();
+    old_transitions->Zap(isolate_);
   }
   map_->set_raw_transitions(new_transitions);
   MarkNeedsReload();
 }
 
 void TransitionsAccessor::SetPrototypeTransitions(
-    Handle<FixedArray> proto_transitions) {
+    Handle<WeakFixedArray> proto_transitions) {
   EnsureHasFullTransitionArray();
   transitions()->SetPrototypeTransitions(*proto_transitions);
 }
@@ -505,21 +475,17 @@ void TransitionsAccessor::SetPrototypeTransitions(
 void TransitionsAccessor::EnsureHasFullTransitionArray() {
   if (encoding() == kFullTransitionArray) return;
   int nof = encoding() == kUninitialized ? 0 : 1;
-  Handle<TransitionArray> result =
-      TransitionArray::Allocate(map_->GetIsolate(), nof);
+  Handle<TransitionArray> result = isolate_->factory()->NewTransitionArray(nof);
   Reload();  // Reload after possible GC.
   if (nof == 1) {
     if (encoding() == kUninitialized) {
       // If allocation caused GC and cleared the target, trim the new array.
-      result->Shrink(TransitionArray::ToKeyIndex(0));
       result->SetNumberOfTransitions(0);
     } else {
       // Otherwise populate the new array.
-      Handle<Map> target(GetSimpleTransition());
-      Handle<WeakCell> weak_cell_with_target = Map::WeakCellForMap(target);
-      Reload();  // Reload after possible GC.
+      Handle<Map> target(GetSimpleTransition(), isolate_);
       Name* key = GetSimpleTransitionKey(*target);
-      result->Set(0, key, *weak_cell_with_target);
+      result->Set(0, key, HeapObjectReference::Weak(*target));
     }
   }
   ReplaceTransitions(MaybeObject::FromObject(*result));
@@ -528,40 +494,38 @@ void TransitionsAccessor::EnsureHasFullTransitionArray() {
 
 void TransitionsAccessor::TraverseTransitionTreeInternal(
     TraverseCallback callback, void* data, DisallowHeapAllocation* no_gc) {
-  Map* simple_target = nullptr;
   switch (encoding()) {
     case kPrototypeInfo:
     case kUninitialized:
       break;
-    case kWeakRef:
-      simple_target = Map::cast(raw_transitions_->ToWeakHeapObject());
-      break;
-    case kHandler:
-      simple_target = Map::cast(GetTargetCell()->value());
+    case kWeakRef: {
+      Map* simple_target = Map::cast(raw_transitions_->ToWeakHeapObject());
+      TransitionsAccessor(isolate_, simple_target, no_gc)
+          .TraverseTransitionTreeInternal(callback, data, no_gc);
       break;
+    }
     case kFullTransitionArray: {
       if (transitions()->HasPrototypeTransitions()) {
-        FixedArray* proto_trans = transitions()->GetPrototypeTransitions();
+        WeakFixedArray* proto_trans = transitions()->GetPrototypeTransitions();
         int length = TransitionArray::NumberOfPrototypeTransitions(proto_trans);
         for (int i = 0; i < length; ++i) {
           int index = TransitionArray::kProtoTransitionHeaderSize + i;
-          WeakCell* cell = WeakCell::cast(proto_trans->get(index));
-          if (cell->cleared()) continue;
-          TransitionsAccessor(Map::cast(cell->value()), no_gc)
+          MaybeObject* target = proto_trans->Get(index);
+          DCHECK(target->IsClearedWeakHeapObject() ||
+                 target->IsWeakHeapObject());
+          if (target->IsClearedWeakHeapObject()) continue;
+          TransitionsAccessor(isolate_, Map::cast(target->ToWeakHeapObject()),
+                              no_gc)
               .TraverseTransitionTreeInternal(callback, data, no_gc);
         }
       }
       for (int i = 0; i < transitions()->number_of_transitions(); ++i) {
-        TransitionsAccessor(transitions()->GetTarget(i), no_gc)
+        TransitionsAccessor(isolate_, transitions()->GetTarget(i), no_gc)
             .TraverseTransitionTreeInternal(callback, data, no_gc);
       }
       break;
     }
   }
-  if (simple_target != nullptr) {
-    TransitionsAccessor(simple_target, no_gc)
-        .TraverseTransitionTreeInternal(callback, data, no_gc);
-  }
   callback(map_, data);
 }
 
@@ -576,12 +540,12 @@ void TransitionsAccessor::CheckNewTransitionsAreConsistent(
     if (target->instance_descriptors() == map_->instance_descriptors()) {
       Name* key = old_transitions->GetKey(i);
       int new_target_index;
-      if (IsSpecialTransition(key)) {
+      if (IsSpecialTransition(isolate_, key)) {
         new_target_index = new_transitions->SearchSpecial(Symbol::cast(key));
       } else {
-        PropertyDetails details = GetTargetDetails(key, target);
-        new_target_index =
-            new_transitions->Search(details.kind(), key, details.attributes());
+        PropertyDetails details = GetTargetDetails(isolate_, key, target);
+        new_target_index = new_transitions->Search(isolate_, details.kind(),
+                                                   key, details.attributes());
       }
       DCHECK_NE(TransitionArray::kNotFound, new_target_index);
       DCHECK_EQ(target, new_transitions->GetTarget(new_target_index));
@@ -592,7 +556,8 @@ void TransitionsAccessor::CheckNewTransitionsAreConsistent(
 
 // Private non-static helper functions (operating on full transition arrays).
 
-int TransitionArray::SearchDetails(int transition, PropertyKind kind,
+int TransitionArray::SearchDetails(Isolate* isolate, int transition,
+                                   PropertyKind kind,
                                    PropertyAttributes attributes,
                                    int* out_insertion_index) {
   int nof_transitions = number_of_transitions();
@@ -602,7 +567,7 @@ int TransitionArray::SearchDetails(int transition, PropertyKind kind,
        transition++) {
     Map* target = GetTarget(transition);
     PropertyDetails target_details =
-        TransitionsAccessor::GetTargetDetails(key, target);
+        TransitionsAccessor::GetTargetDetails(isolate, key, target);
 
     int cmp = CompareDetails(kind, attributes, target_details.kind(),
                              target_details.attributes());
@@ -616,42 +581,42 @@ int TransitionArray::SearchDetails(int transition, PropertyKind kind,
   return kNotFound;
 }
 
-
-int TransitionArray::Search(PropertyKind kind, Name* name,
+int TransitionArray::Search(Isolate* isolate, PropertyKind kind, Name* name,
                             PropertyAttributes attributes,
                             int* out_insertion_index) {
   int transition = SearchName(name, out_insertion_index);
   if (transition == kNotFound) return kNotFound;
-  return SearchDetails(transition, kind, attributes, out_insertion_index);
+  return SearchDetails(isolate, transition, kind, attributes,
+                       out_insertion_index);
 }
 
-void TransitionArray::Sort() {
+void TransitionArray::Sort(Isolate* isolate) {
   DisallowHeapAllocation no_gc;
   // In-place insertion sort.
   int length = number_of_transitions();
   for (int i = 1; i < length; i++) {
     Name* key = GetKey(i);
-    Object* target = GetRawTarget(i);
+    MaybeObject* target = GetRawTarget(i);
     PropertyKind kind = kData;
     PropertyAttributes attributes = NONE;
-    if (!TransitionsAccessor::IsSpecialTransition(key)) {
+    if (!TransitionsAccessor::IsSpecialTransition(isolate, key)) {
       Map* target_map = TransitionsAccessor::GetTargetFromRaw(target);
       PropertyDetails details =
-          TransitionsAccessor::GetTargetDetails(key, target_map);
+          TransitionsAccessor::GetTargetDetails(isolate, key, target_map);
       kind = details.kind();
       attributes = details.attributes();
     }
     int j;
     for (j = i - 1; j >= 0; j--) {
       Name* temp_key = GetKey(j);
-      Object* temp_target = GetRawTarget(j);
+      MaybeObject* temp_target = GetRawTarget(j);
       PropertyKind temp_kind = kData;
       PropertyAttributes temp_attributes = NONE;
-      if (!TransitionsAccessor::IsSpecialTransition(temp_key)) {
+      if (!TransitionsAccessor::IsSpecialTransition(isolate, temp_key)) {
         Map* temp_target_map =
             TransitionsAccessor::GetTargetFromRaw(temp_target);
-        PropertyDetails details =
-            TransitionsAccessor::GetTargetDetails(temp_key, temp_target_map);
+        PropertyDetails details = TransitionsAccessor::GetTargetDetails(
+            isolate, temp_key, temp_target_map);
         temp_kind = details.kind();
         temp_attributes = details.attributes();
       }
@@ -660,15 +625,15 @@ void TransitionArray::Sort() {
                       key, key->Hash(), kind, attributes);
       if (cmp > 0) {
         SetKey(j + 1, temp_key);
-        SetTarget(j + 1, temp_target);
+        SetRawTarget(j + 1, temp_target);
       } else {
         break;
       }
     }
     SetKey(j + 1, key);
-    SetTarget(j + 1, target);
+    SetRawTarget(j + 1, target);
   }
-  DCHECK(IsSortedNoDuplicates());
+  DCHECK(IsSortedNoDuplicates(isolate));
 }
 
 }  // namespace internal
diff --git a/deps/v8/src/transitions.h b/deps/v8/src/transitions.h
index 562f0ebe92fc2a..bd0d91336322e4 100644
--- a/deps/v8/src/transitions.h
+++ b/deps/v8/src/transitions.h
@@ -37,11 +37,13 @@ namespace internal {
 // cleared when the map they refer to is not otherwise reachable.
 class TransitionsAccessor {
  public:
-  TransitionsAccessor(Map* map, DisallowHeapAllocation* no_gc) : map_(map) {
+  TransitionsAccessor(Isolate* isolate, Map* map, DisallowHeapAllocation* no_gc)
+      : isolate_(isolate), map_(map) {
     Initialize();
     USE(no_gc);
   }
-  explicit TransitionsAccessor(Handle<Map> map) : map_handle_(map), map_(*map) {
+  TransitionsAccessor(Isolate* isolate, Handle<Map> map)
+      : isolate_(isolate), map_handle_(map), map_(*map) {
     Initialize();
   }
 
@@ -57,7 +59,7 @@ class TransitionsAccessor {
   Map* SearchSpecial(Symbol* name);
   // Returns true for non-property transitions like elements kind, or
   // or frozen/sealed transitions.
-  static bool IsSpecialTransition(Name* name);
+  static bool IsSpecialTransition(Isolate* isolate, Name* name);
 
   enum RequestedLocation { kAnyLocation, kFieldOnly };
   MaybeHandle<Map> FindTransitionToDataProperty(
@@ -78,7 +80,8 @@ class TransitionsAccessor {
   bool CanHaveMoreTransitions();
   inline Name* GetKey(int transition_number);
   inline Map* GetTarget(int transition_number);
-  static inline PropertyDetails GetTargetDetails(Name* name, Map* target);
+  static inline PropertyDetails GetTargetDetails(Isolate* isolate, Name* name,
+                                                 Map* target);
 
   static bool IsMatchingMap(Map* target, Name* name, PropertyKind kind,
                             PropertyAttributes attributes);
@@ -106,8 +109,8 @@ class TransitionsAccessor {
 
 #if DEBUG || OBJECT_PRINT
   void PrintTransitions(std::ostream& os);
-  static void PrintOneTransition(std::ostream& os, Name* key, Map* target,
-                                 Object* raw_target);
+  static void PrintOneTransition(Isolate* isolate, std::ostream& os, Name* key,
+                                 Map* target);
   void PrintTransitionTree();
   void PrintTransitionTree(std::ostream& os, int level,
                            DisallowHeapAllocation* no_gc);
@@ -116,7 +119,7 @@ class TransitionsAccessor {
   void CheckNewTransitionsAreConsistent(TransitionArray* old_transitions,
                                         Object* transitions);
   bool IsConsistentWithBackPointers();
-  bool IsSortedNoDuplicates();
+  bool IsSortedNoDuplicates(Isolate* isolate);
 #endif
 
  protected:
@@ -125,9 +128,6 @@ class TransitionsAccessor {
     kPrototypeInfo,
     kUninitialized,
     kWeakRef,
-    // TODO(ishell): drop support for kHandler encoding since we use maps
-    // as transition handlers.
-    kHandler,
     kFullTransitionArray,
   };
 
@@ -155,7 +155,7 @@ class TransitionsAccessor {
     return transition->instance_descriptors()->GetKey(descriptor);
   }
 
-  static inline Map* GetTargetFromRaw(Object* raw);
+  static inline Map* GetTargetFromRaw(MaybeObject* raw);
 
   void MarkNeedsReload() {
 #if DEBUG
@@ -170,24 +170,22 @@ class TransitionsAccessor {
 
   void ReplaceTransitions(MaybeObject* new_transitions);
 
-  inline WeakCell* GetTargetCell();
-
   inline Map* GetTargetMapFromWeakRef();
 
   void EnsureHasFullTransitionArray();
-  void SetPrototypeTransitions(Handle<FixedArray> proto_transitions);
-  FixedArray* GetPrototypeTransitions();
+  void SetPrototypeTransitions(Handle<WeakFixedArray> proto_transitions);
+  WeakFixedArray* GetPrototypeTransitions();
 
   void TraverseTransitionTreeInternal(TraverseCallback callback, void* data,
                                       DisallowHeapAllocation* no_gc);
 
   inline TransitionArray* transitions();
 
+  Isolate* isolate_;
   Handle<Map> map_handle_;
   Map* map_;
   MaybeObject* raw_transitions_;
   Encoding encoding_;
-  WeakCell* target_cell_;
 #if DEBUG
   bool needs_reload_;
 #endif
@@ -200,30 +198,29 @@ class TransitionsAccessor {
 // The TransitionArray class exposes a very low-level interface. Most clients
 // should use TransitionsAccessors.
 // TransitionArrays have the following format:
-// [0] Link to next TransitionArray (for weak handling support)
-// [1] Smi(0) or fixed array of prototype transitions
+// [0] Link to next TransitionArray (for weak handling support) (strong ref)
+// [1] Smi(0) or WeakFixedArray of prototype transitions (strong ref)
 // [2] Number of transitions (can be zero after trimming)
-// [3] First transition key
-// [4] First transition target
+// [3] First transition key (strong ref)
+// [4] First transition target (weak ref)
 // ...
 // [3 + number of transitions * kTransitionSize]: start of slack
-class TransitionArray : public FixedArray {
+class TransitionArray : public WeakFixedArray {
  public:
   DECL_CAST(TransitionArray)
 
-  inline FixedArray* GetPrototypeTransitions();
-  inline Object** GetPrototypeTransitionsSlot();
+  inline WeakFixedArray* GetPrototypeTransitions();
   inline bool HasPrototypeTransitions();
 
   // Accessors for fetching instance transition at transition number.
   inline void SetKey(int transition_number, Name* value);
   inline Name* GetKey(int transition_number);
-  inline Object** GetKeySlot(int transition_number);
+  inline HeapObjectReference** GetKeySlot(int transition_number);
 
   inline Map* GetTarget(int transition_number);
-  inline void SetTarget(int transition_number, Object* target);
-  inline Object* GetRawTarget(int transition_number);
-  inline Object** GetTargetSlot(int transition_number);
+  inline void SetRawTarget(int transition_number, MaybeObject* target);
+  inline MaybeObject* GetRawTarget(int transition_number);
+  inline HeapObjectReference** GetTargetSlot(int transition_number);
   inline bool GetTargetIfExists(int transition_number, Isolate* isolate,
                                 Map** target);
 
@@ -235,18 +232,14 @@ class TransitionArray : public FixedArray {
   int GetSortedKeyIndex(int transition_number) { return transition_number; }
   inline int number_of_entries() const { return number_of_transitions(); }
 #ifdef DEBUG
-  bool IsSortedNoDuplicates(int valid_entries = -1);
+  bool IsSortedNoDuplicates(Isolate* isolate, int valid_entries = -1);
 #endif
 
-  void Sort();
+  void Sort(Isolate* isolate);
 
-#if defined(DEBUG) || defined(OBJECT_PRINT)
-  // For our gdb macros.
-  void Print();
-  void Print(std::ostream& os);
-#endif
+  void PrintInternal(Isolate* isolate, std::ostream& os);
 
-  DECL_PRINTER(TransitionArray)
+  DECL_PRINTER_WITH_ISOLATE(TransitionArray)
   DECL_VERIFIER(TransitionArray)
 
   // Layout for full transition arrays.
@@ -274,6 +267,7 @@ class TransitionArray : public FixedArray {
   }
 
  private:
+  friend class Factory;
   friend class MarkCompactCollector;
   friend class TransitionsAccessor;
 
@@ -288,14 +282,11 @@ class TransitionArray : public FixedArray {
   static const int kProtoTransitionHeaderSize = 1;
   static const int kMaxCachedPrototypeTransitions = 256;
 
-  inline void SetPrototypeTransitions(FixedArray* prototype_transitions);
+  inline void SetPrototypeTransitions(WeakFixedArray* prototype_transitions);
 
-  static int NumberOfPrototypeTransitions(FixedArray* proto_transitions) {
-    if (proto_transitions->length() == 0) return 0;
-    Object* raw = proto_transitions->get(kProtoTransitionNumberOfEntriesOffset);
-    return Smi::ToInt(raw);
-  }
-  static void SetNumberOfPrototypeTransitions(FixedArray* proto_transitions,
+  static inline int NumberOfPrototypeTransitions(
+      WeakFixedArray* proto_transitions);
+  static void SetNumberOfPrototypeTransitions(WeakFixedArray* proto_transitions,
                                               int value);
 
   static const int kProtoTransitionNumberOfEntriesOffset = 0;
@@ -307,14 +298,9 @@ class TransitionArray : public FixedArray {
     return ToKeyIndex(number_of_transitions);
   }
 
-  // Allocates a TransitionArray.
-  static Handle<TransitionArray> Allocate(Isolate* isolate,
-                                          int number_of_transitions,
-                                          int slack = 0);
-
   // Search a  transition for a given kind, property name and attributes.
-  int Search(PropertyKind kind, Name* name, PropertyAttributes attributes,
-             int* out_insertion_index = nullptr);
+  int Search(Isolate* isolate, PropertyKind kind, Name* name,
+             PropertyAttributes attributes, int* out_insertion_index = nullptr);
 
   // Search a non-property transition (like elements kind, observe or frozen
   // transitions).
@@ -323,18 +309,16 @@ class TransitionArray : public FixedArray {
   }
   // Search a first transition for a given property name.
   inline int SearchName(Name* name, int* out_insertion_index = nullptr);
-  int SearchDetails(int transition, PropertyKind kind,
+  int SearchDetails(Isolate* isolate, int transition, PropertyKind kind,
                     PropertyAttributes attributes, int* out_insertion_index);
 
-  int number_of_transitions() const {
-    if (length() < kFirstIndex) return 0;
-    return Smi::ToInt(get(kTransitionLengthIndex));
-  }
+  inline int number_of_transitions() const;
 
-  static bool CompactPrototypeTransitionArray(FixedArray* array);
+  static bool CompactPrototypeTransitionArray(Isolate* isolate,
+                                              WeakFixedArray* array);
 
-  static Handle<FixedArray> GrowPrototypeTransitionArray(
-      Handle<FixedArray> array, int new_capacity, Isolate* isolate);
+  static Handle<WeakFixedArray> GrowPrototypeTransitionArray(
+      Handle<WeakFixedArray> array, int new_capacity, Isolate* isolate);
 
   // Compares two tuples <key, kind, attributes>, returns -1 if
   // tuple1 is "less" than tuple2, 0 if tuple1 equal to tuple2 and 1 otherwise.
@@ -355,9 +339,9 @@ class TransitionArray : public FixedArray {
                                    PropertyKind kind2,
                                    PropertyAttributes attributes2);
 
-  inline void Set(int transition_number, Name* key, Object* target);
+  inline void Set(int transition_number, Name* key, MaybeObject* target);
 
-  void Zap();
+  void Zap(Isolate* isolate);
 
   DISALLOW_IMPLICIT_CONSTRUCTORS(TransitionArray);
 };
diff --git a/deps/v8/src/trap-handler/handler-inside-linux.cc b/deps/v8/src/trap-handler/handler-inside-linux.cc
new file mode 100644
index 00000000000000..867f90bfe7d20a
--- /dev/null
+++ b/deps/v8/src/trap-handler/handler-inside-linux.cc
@@ -0,0 +1,133 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// PLEASE READ BEFORE CHANGING THIS FILE!
+//
+// This file implements the out of bounds signal handler for
+// WebAssembly. Signal handlers are notoriously difficult to get
+// right, and getting it wrong can lead to security
+// vulnerabilities. In order to minimize this risk, here are some
+// rules to follow.
+//
+// 1. Do not introduce any new external dependencies. This file needs
+//    to be self contained so it is easy to audit everything that a
+//    signal handler might do.
+//
+// 2. Any changes must be reviewed by someone from the crash reporting
+//    or security team. See OWNERS for suggested reviewers.
+//
+// For more information, see https://goo.gl/yMeyUY.
+//
+// This file contains most of the code that actually runs in a signal handler
+// context. Some additional code is used both inside and outside the signal
+// handler. This code can be found in handler-shared.cc.
+
+#include <signal.h>
+#include <stddef.h>
+#include <stdlib.h>
+
+#include "src/trap-handler/trap-handler-internal.h"
+#include "src/trap-handler/trap-handler.h"
+
+namespace v8 {
+namespace internal {
+namespace trap_handler {
+
+bool IsKernelGeneratedSignal(siginfo_t* info) {
+  return info->si_code > 0 && info->si_code != SI_USER &&
+         info->si_code != SI_QUEUE && info->si_code != SI_TIMER &&
+         info->si_code != SI_ASYNCIO && info->si_code != SI_MESGQ;
+}
+
+class SigUnmaskStack {
+ public:
+  explicit SigUnmaskStack(sigset_t sigs) {
+    // TODO(eholk): consider using linux-syscall-support for calling this
+    // syscall.
+    pthread_sigmask(SIG_UNBLOCK, &sigs, &old_mask_);
+  }
+
+  ~SigUnmaskStack() { pthread_sigmask(SIG_SETMASK, &old_mask_, nullptr); }
+
+ private:
+  sigset_t old_mask_;
+
+  // We'd normally use DISALLOW_COPY_AND_ASSIGN, but we're avoiding a dependency
+  // on base/macros.h
+  SigUnmaskStack(const SigUnmaskStack&) = delete;
+  void operator=(const SigUnmaskStack&) = delete;
+};
+
+bool TryHandleSignal(int signum, siginfo_t* info, ucontext_t* context) {
+  // Bail out early in case we got called for the wrong kind of signal.
+  if (signum != SIGSEGV) {
+    return false;
+  }
+
+  // Make sure the signal was generated by the kernel and not some other source.
+  if (!IsKernelGeneratedSignal(info)) {
+    return false;
+  }
+
+  // Ensure the faulting thread was actually running Wasm code.
+  if (!IsThreadInWasm()) {
+    return false;
+  }
+
+  // Clear g_thread_in_wasm_code, primarily to protect against nested faults.
+  g_thread_in_wasm_code = false;
+
+  // Begin signal mask scope. We need to be sure to restore the signal mask
+  // before we restore the g_thread_in_wasm_code flag.
+  {
+    // Unmask the signal so that if this signal handler crashes, the crash will
+    // be handled by the crash reporter.  Otherwise, the process might be killed
+    // with the crash going unreported.
+    sigset_t sigs;
+    // Fortunately, sigemptyset and sigaddset are async-signal-safe according to
+    // the POSIX standard.
+    sigemptyset(&sigs);
+    sigaddset(&sigs, SIGSEGV);
+    SigUnmaskStack unmask(sigs);
+
+    uintptr_t fault_addr = context->uc_mcontext.gregs[REG_RIP];
+    uintptr_t landing_pad = 0;
+    if (TryFindLandingPad(fault_addr, &landing_pad)) {
+      // Tell the caller to return to the landing pad.
+      context->uc_mcontext.gregs[REG_RIP] = landing_pad;
+      // We will return to wasm code, so restore the g_thread_in_wasm_code flag.
+      g_thread_in_wasm_code = true;
+      return true;
+    }
+  }  // end signal mask scope
+
+  // If we get here, it's not a recoverable wasm fault, so we go to the next
+  // handler. Leave the g_thread_in_wasm_code flag unset since we do not return
+  // to wasm code.
+  return false;
+}
+
+void HandleSignal(int signum, siginfo_t* info, void* context) {
+  ucontext_t* uc = reinterpret_cast<ucontext_t*>(context);
+
+  if (!TryHandleSignal(signum, info, uc)) {
+    // Since V8 didn't handle this signal, we want to re-raise the same signal.
+    // For kernel-generated SEGV signals, we do this by restoring the original
+    // SEGV handler and then returning. The fault will happen again and the
+    // usual SEGV handling will happen.
+    //
+    // We handle user-generated signals by calling raise() instead. This is for
+    // completeness. We should never actually see one of these, but just in
+    // case, we do the right thing.
+    RestoreOriginalSignalHandler();
+    if (!IsKernelGeneratedSignal(info)) {
+      raise(signum);
+    }
+  }
+  // TryHandleSignal modifies context to change where we return to.
+}
+
+}  // namespace trap_handler
+}  // namespace internal
+}  // namespace v8
diff --git a/deps/v8/src/trap-handler/handler-inside.cc b/deps/v8/src/trap-handler/handler-inside.cc
index d3c543f4f4357c..adab6a0f47ba0d 100644
--- a/deps/v8/src/trap-handler/handler-inside.cc
+++ b/deps/v8/src/trap-handler/handler-inside.cc
@@ -23,10 +23,6 @@
 // context. Some additional code is used both inside and outside the signal
 // handler. This code can be found in handler-shared.cc.
 
-#include <signal.h>
-#include <stddef.h>
-#include <stdlib.h>
-
 #include "src/trap-handler/trap-handler-internal.h"
 #include "src/trap-handler/trap-handler.h"
 
@@ -34,85 +30,7 @@ namespace v8 {
 namespace internal {
 namespace trap_handler {
 
-namespace {
-
-bool IsKernelGeneratedSignal(siginfo_t* info) {
-  return info->si_code > 0 && info->si_code != SI_USER &&
-         info->si_code != SI_QUEUE && info->si_code != SI_TIMER &&
-         info->si_code != SI_ASYNCIO && info->si_code != SI_MESGQ;
-}
-
 #if V8_TRAP_HANDLER_SUPPORTED
-class SigUnmaskStack {
- public:
-  explicit SigUnmaskStack(sigset_t sigs) {
-    // TODO(eholk): consider using linux-syscall-support for calling this
-    // syscall.
-    pthread_sigmask(SIG_UNBLOCK, &sigs, &old_mask_);
-  }
-
-  ~SigUnmaskStack() { pthread_sigmask(SIG_SETMASK, &old_mask_, nullptr); }
-
- private:
-  sigset_t old_mask_;
-
-  // We'd normally use DISALLOW_COPY_AND_ASSIGN, but we're avoiding a dependency
-  // on base/macros.h
-  SigUnmaskStack(const SigUnmaskStack&) = delete;
-  void operator=(const SigUnmaskStack&) = delete;
-};
-#endif
-}  // namespace
-
-#if V8_TRAP_HANDLER_SUPPORTED && V8_OS_LINUX
-bool TryHandleSignal(int signum, siginfo_t* info, ucontext_t* context) {
-  // Bail out early in case we got called for the wrong kind of signal.
-  if (signum != SIGSEGV) {
-    return false;
-  }
-
-  // Make sure the signal was generated by the kernel and not some other source.
-  if (!IsKernelGeneratedSignal(info)) {
-    return false;
-  }
-
-  // Ensure the faulting thread was actually running Wasm code.
-  if (!IsThreadInWasm()) {
-    return false;
-  }
-
-  // Clear g_thread_in_wasm_code, primarily to protect against nested faults.
-  g_thread_in_wasm_code = false;
-
-  // Begin signal mask scope. We need to be sure to restore the signal mask
-  // before we restore the g_thread_in_wasm_code flag.
-  {
-    // Unmask the signal so that if this signal handler crashes, the crash will
-    // be handled by the crash reporter.  Otherwise, the process might be killed
-    // with the crash going unreported.
-    sigset_t sigs;
-    // Fortunately, sigemptyset and sigaddset are async-signal-safe according to
-    // the POSIX standard.
-    sigemptyset(&sigs);
-    sigaddset(&sigs, SIGSEGV);
-    SigUnmaskStack unmask(sigs);
-
-    uintptr_t fault_addr = context->uc_mcontext.gregs[REG_RIP];
-    uintptr_t landing_pad = 0;
-    if (TryFindLandingPad(fault_addr, &landing_pad)) {
-      // Tell the caller to return to the landing pad.
-      context->uc_mcontext.gregs[REG_RIP] = landing_pad;
-      // We will return to wasm code, so restore the g_thread_in_wasm_code flag.
-      g_thread_in_wasm_code = true;
-      return true;
-    }
-  }  // end signal mask scope
-
-  // If we get here, it's not a recoverable wasm fault, so we go to the next
-  // handler. Leave the g_thread_in_wasm_code flag unset since we do not return
-  // to wasm code.
-  return false;
-}
 
 // This function contains the platform independent portions of fault
 // classification.
@@ -132,7 +50,7 @@ bool TryFindLandingPad(uintptr_t fault_addr, uintptr_t* landing_pad) {
     if (data == nullptr) {
       continue;
     }
-    const uintptr_t base = reinterpret_cast<uintptr_t>(data->base);
+    const Address base = data->base;
 
     if (fault_addr >= base && fault_addr < base + data->size) {
       // Hurray, we found the code object. Check for protected addresses.
@@ -154,29 +72,8 @@ bool TryFindLandingPad(uintptr_t fault_addr, uintptr_t* landing_pad) {
   }
   return false;
 }
-#endif  // V8_TRAP_HANDLER_SUPPORTED && V8_OS_LINUX
-
-#if V8_TRAP_HANDLER_SUPPORTED
-void HandleSignal(int signum, siginfo_t* info, void* context) {
-  ucontext_t* uc = reinterpret_cast<ucontext_t*>(context);
+#endif  // V8_TRAP_HANDLER_SUPPORTED
 
-  if (!TryHandleSignal(signum, info, uc)) {
-    // Since V8 didn't handle this signal, we want to re-raise the same signal.
-    // For kernel-generated SEGV signals, we do this by restoring the original
-    // SEGV handler and then returning. The fault will happen again and the
-    // usual SEGV handling will happen.
-    //
-    // We handle user-generated signals by calling raise() instead. This is for
-    // completeness. We should never actually see one of these, but just in
-    // case, we do the right thing.
-    RestoreOriginalSignalHandler();
-    if (!IsKernelGeneratedSignal(info)) {
-      raise(signum);
-    }
-  }
-  // TryHandleSignal modifies context to change where we return to.
-}
-#endif
 }  // namespace trap_handler
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/src/trap-handler/handler-outside-linux.cc b/deps/v8/src/trap-handler/handler-outside-linux.cc
new file mode 100644
index 00000000000000..34f39833157686
--- /dev/null
+++ b/deps/v8/src/trap-handler/handler-outside-linux.cc
@@ -0,0 +1,73 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// PLEASE READ BEFORE CHANGING THIS FILE!
+//
+// This file implements the support code for the out of bounds signal handler.
+// Nothing in here actually runs in the signal handler, but the code here
+// manipulates data structures used by the signal handler so we still need to be
+// careful. In order to minimize this risk, here are some rules to follow.
+//
+// 1. Avoid introducing new external dependencies. The files in src/trap-handler
+//    should be as self-contained as possible to make it easy to audit the code.
+//
+// 2. Any changes must be reviewed by someone from the crash reporting
+//    or security team. Se OWNERS for suggested reviewers.
+//
+// For more information, see https://goo.gl/yMeyUY.
+//
+// For the code that runs in the signal handler itself, see handler-inside.cc.
+
+#include <signal.h>
+
+#include "src/trap-handler/trap-handler-internal.h"
+#include "src/trap-handler/trap-handler.h"
+
+namespace v8 {
+namespace internal {
+namespace trap_handler {
+
+#if V8_TRAP_HANDLER_SUPPORTED
+bool RegisterDefaultTrapHandler() {
+  CHECK(!g_is_default_signal_handler_registered);
+
+  struct sigaction action;
+  action.sa_sigaction = HandleSignal;
+  action.sa_flags = SA_SIGINFO;
+  sigemptyset(&action.sa_mask);
+  // {sigaction} installs a new custom segfault handler. On success, it returns
+  // 0. If we get a nonzero value, we report an error to the caller by returning
+  // false.
+  if (sigaction(SIGSEGV, &action, &g_old_handler) != 0) {
+    return false;
+  }
+
+// Sanitizers often prevent us from installing our own signal handler. Attempt
+// to detect this and if so, refuse to enable trap handling.
+//
+// TODO(chromium:830894): Remove this once all bots support custom signal
+// handlers.
+#if defined(ADDRESS_SANITIZER) || defined(MEMORY_SANITIZER) || \
+    defined(THREAD_SANITIZER) || defined(LEAK_SANITIZER) ||    \
+    defined(UNDEFINED_SANITIZER)
+  struct sigaction installed_handler;
+  CHECK_EQ(sigaction(SIGSEGV, NULL, &installed_handler), 0);
+  // If the installed handler does not point to HandleSignal, then
+  // allow_user_segv_handler is 0.
+  if (installed_handler.sa_sigaction != HandleSignal) {
+    printf(
+        "WARNING: sanitizers are preventing signal handler installation. "
+        "Trap handlers are disabled.\n");
+    return false;
+  }
+#endif
+
+  g_is_default_signal_handler_registered = true;
+  return true;
+}
+#endif
+
+}  // namespace trap_handler
+}  // namespace internal
+}  // namespace v8
diff --git a/deps/v8/src/trap-handler/handler-outside-win.cc b/deps/v8/src/trap-handler/handler-outside-win.cc
new file mode 100644
index 00000000000000..3bfcb05a1fbb1e
--- /dev/null
+++ b/deps/v8/src/trap-handler/handler-outside-win.cc
@@ -0,0 +1,35 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// PLEASE READ BEFORE CHANGING THIS FILE!
+//
+// This file implements the support code for the out of bounds signal handler.
+// Nothing in here actually runs in the signal handler, but the code here
+// manipulates data structures used by the signal handler so we still need to be
+// careful. In order to minimize this risk, here are some rules to follow.
+//
+// 1. Avoid introducing new external dependencies. The files in src/trap-handler
+//    should be as self-contained as possible to make it easy to audit the code.
+//
+// 2. Any changes must be reviewed by someone from the crash reporting
+//    or security team. Se OWNERS for suggested reviewers.
+//
+// For more information, see https://goo.gl/yMeyUY.
+//
+// For the code that runs in the signal handler itself, see handler-inside.cc.
+
+namespace v8 {
+namespace internal {
+namespace trap_handler {
+
+#if V8_TRAP_HANDLER_SUPPORTED
+bool RegisterDefaultTrapHandler() {
+  // Not yet implemented
+  return false;
+}
+#endif
+
+}  // namespace trap_handler
+}  // namespace internal
+}  // namespace v8
diff --git a/deps/v8/src/trap-handler/handler-outside.cc b/deps/v8/src/trap-handler/handler-outside.cc
index 0b2301953d1dc1..635326dcf151c9 100644
--- a/deps/v8/src/trap-handler/handler-outside.cc
+++ b/deps/v8/src/trap-handler/handler-outside.cc
@@ -59,11 +59,7 @@ bool IsDisjoint(const CodeProtectionInfo* a, const CodeProtectionInfo* b) {
   if (a == nullptr || b == nullptr) {
     return true;
   }
-
-  const auto a_base = reinterpret_cast<uintptr_t>(a->base);
-  const auto b_base = reinterpret_cast<uintptr_t>(b->base);
-
-  return a_base >= b_base + b->size || b_base >= a_base + a->size;
+  return a->base >= b->base + b->size || b->base >= a->base + a->size;
 }
 #endif
 
@@ -115,7 +111,7 @@ void ValidateCodeObjects() {
 }  // namespace
 
 CodeProtectionInfo* CreateHandlerData(
-    void* base, size_t size, size_t num_protected_instructions,
+    Address base, size_t size, size_t num_protected_instructions,
     const ProtectedInstructionData* protected_instructions) {
   const size_t alloc_size = HandlerDataSize(num_protected_instructions);
   CodeProtectionInfo* data =
@@ -136,7 +132,7 @@ CodeProtectionInfo* CreateHandlerData(
 }
 
 int RegisterHandlerData(
-    void* base, size_t size, size_t num_protected_instructions,
+    Address base, size_t size, size_t num_protected_instructions,
     const ProtectedInstructionData* protected_instructions) {
   // TODO(eholk): in debug builds, make sure this data isn't already registered.
 
@@ -240,52 +236,17 @@ void ReleaseHandlerData(int index) {
   free(data);
 }
 
-bool RegisterDefaultSignalHandler() {
-#if V8_TRAP_HANDLER_SUPPORTED
-  CHECK(!g_is_default_signal_handler_registered);
-
-  struct sigaction action;
-  action.sa_sigaction = HandleSignal;
-  action.sa_flags = SA_SIGINFO;
-  sigemptyset(&action.sa_mask);
-  // {sigaction} installs a new custom segfault handler. On success, it returns
-  // 0. If we get a nonzero value, we report an error to the caller by returning
-  // false.
-  if (sigaction(SIGSEGV, &action, &g_old_handler) != 0) {
-    return false;
-  }
-
-// Sanitizers often prevent us from installing our own signal handler. Attempt
-// to detect this and if so, refuse to enable trap handling.
-//
-// TODO(chromium:830894): Remove this once all bots support custom signal
-// handlers.
-#if defined(ADDRESS_SANITIZER) || defined(MEMORY_SANITIZER) || \
-    defined(THREAD_SANITIZER) || defined(LEAK_SANITIZER) ||    \
-    defined(UNDEFINED_SANITIZER)
-  struct sigaction installed_handler;
-  CHECK_EQ(sigaction(SIGSEGV, NULL, &installed_handler), 0);
-  // If the installed handler does not point to HandleSignal, then
-  // allow_user_segv_handler is 0.
-  if (installed_handler.sa_sigaction != HandleSignal) {
-    printf(
-        "WARNING: sanitizers are preventing signal handler installation. "
-        "Trap handlers are disabled.");
-    return false;
-  }
-#endif
-
-  g_is_default_signal_handler_registered = true;
-  return true;
-#else
-  return false;
-#endif
-}
-
 size_t GetRecoveredTrapCount() {
   return gRecoveredTrapCount.load(std::memory_order_relaxed);
 }
 
+#if !V8_TRAP_HANDLER_SUPPORTED
+// This version is provided for systems that do not support trap handlers.
+// Otherwise, the correct one should be implemented in the appropriate
+// platform-specific handler-outside.cc.
+bool RegisterDefaultTrapHandler() { return false; }
+#endif
+
 bool g_is_trap_handler_enabled;
 
 bool EnableTrapHandler(bool use_v8_signal_handler) {
@@ -293,7 +254,7 @@ bool EnableTrapHandler(bool use_v8_signal_handler) {
     return false;
   }
   if (use_v8_signal_handler) {
-    g_is_trap_handler_enabled = RegisterDefaultSignalHandler();
+    g_is_trap_handler_enabled = RegisterDefaultTrapHandler();
     return g_is_trap_handler_enabled;
   }
   g_is_trap_handler_enabled = true;
diff --git a/deps/v8/src/trap-handler/trap-handler-internal.h b/deps/v8/src/trap-handler/trap-handler-internal.h
index a8cc371c362207..66ae4f652a5e78 100644
--- a/deps/v8/src/trap-handler/trap-handler-internal.h
+++ b/deps/v8/src/trap-handler/trap-handler-internal.h
@@ -22,7 +22,7 @@ namespace trap_handler {
 // protected memory access instructions and an offset to a landing pad to handle
 // faults on that instruction.
 struct CodeProtectionInfo {
-  void* base;
+  Address base;
   size_t size;
   size_t num_protected_instructions;
   ProtectedInstructionData instructions[1];
diff --git a/deps/v8/src/trap-handler/trap-handler.h b/deps/v8/src/trap-handler/trap-handler.h
index 01c814fbf7affa..bd4ccc1f65c4c1 100644
--- a/deps/v8/src/trap-handler/trap-handler.h
+++ b/deps/v8/src/trap-handler/trap-handler.h
@@ -45,7 +45,7 @@ const int kInvalidIndex = -1;
 ///
 /// This returns a number that can be used to identify the handler data to
 /// ReleaseHandlerData, or -1 on failure.
-int RegisterHandlerData(void* base, size_t size,
+int RegisterHandlerData(Address base, size_t size,
                         size_t num_protected_instructions,
                         const ProtectedInstructionData* protected_instructions);
 
@@ -99,7 +99,7 @@ class ThreadInWasmScope {
   ~ThreadInWasmScope() { ClearThreadInWasm(); }
 };
 
-bool RegisterDefaultSignalHandler();
+bool RegisterDefaultTrapHandler();
 V8_EXPORT_PRIVATE void RestoreOriginalSignalHandler();
 
 #if V8_OS_LINUX
diff --git a/deps/v8/src/turbo-assembler.cc b/deps/v8/src/turbo-assembler.cc
new file mode 100644
index 00000000000000..079feabb2e6194
--- /dev/null
+++ b/deps/v8/src/turbo-assembler.cc
@@ -0,0 +1,122 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "src/turbo-assembler.h"
+
+#include "src/builtins/builtins.h"
+#include "src/builtins/constants-table-builder.h"
+#include "src/heap/heap-inl.h"
+#include "src/snapshot/serializer-common.h"
+
+namespace v8 {
+namespace internal {
+
+TurboAssemblerBase::TurboAssemblerBase(Isolate* isolate,
+                                       const AssemblerOptions& options,
+                                       void* buffer, int buffer_size,
+                                       CodeObjectRequired create_code_object)
+    : Assembler(options, buffer, buffer_size), isolate_(isolate) {
+  if (create_code_object == CodeObjectRequired::kYes) {
+    code_object_ = Handle<HeapObject>::New(
+        ReadOnlyRoots(isolate).self_reference_marker(), isolate);
+  }
+}
+
+void TurboAssemblerBase::IndirectLoadConstant(Register destination,
+                                              Handle<HeapObject> object) {
+  CHECK(isolate()->ShouldLoadConstantsFromRootList());
+  CHECK(root_array_available_);
+
+  // Before falling back to the (fairly slow) lookup from the constants table,
+  // check if any of the fast paths can be applied.
+
+  int builtin_index;
+  Heap::RootListIndex root_index;
+  if (isolate()->heap()->IsRootHandle(object, &root_index)) {
+    // Roots are loaded relative to the root register.
+    LoadRoot(destination, root_index);
+  } else if (isolate()->builtins()->IsBuiltinHandle(object, &builtin_index)) {
+    // Similar to roots, builtins may be loaded from the builtins table.
+    LoadRootRelative(destination,
+                     RootRegisterOffsetForBuiltinIndex(builtin_index));
+  } else if (object.is_identical_to(code_object_) &&
+             Builtins::IsBuiltinId(maybe_builtin_index_)) {
+    // The self-reference loaded through Codevalue() may also be a builtin
+    // and thus viable for a fast load.
+    LoadRootRelative(destination,
+                     RootRegisterOffsetForBuiltinIndex(maybe_builtin_index_));
+  } else {
+    // Ensure the given object is in the builtins constants table and fetch its
+    // index.
+    BuiltinsConstantsTableBuilder* builder =
+        isolate()->builtins_constants_table_builder();
+    uint32_t index = builder->AddObject(object);
+
+    // Slow load from the constants table.
+    LoadFromConstantsTable(destination, index);
+  }
+}
+
+void TurboAssemblerBase::IndirectLoadExternalReference(
+    Register destination, ExternalReference reference) {
+  CHECK(isolate()->ShouldLoadConstantsFromRootList());
+  CHECK(root_array_available_);
+
+  if (IsAddressableThroughRootRegister(isolate(), reference)) {
+    // Some external references can be efficiently loaded as an offset from
+    // kRootRegister.
+    intptr_t offset =
+        RootRegisterOffsetForExternalReference(isolate(), reference);
+    LoadRootRegisterOffset(destination, offset);
+  } else {
+    // Otherwise, do a memory load from the external reference table.
+
+    // Encode as an index into the external reference table stored on the
+    // isolate.
+    ExternalReferenceEncoder encoder(isolate());
+    ExternalReferenceEncoder::Value v = encoder.Encode(reference.address());
+    CHECK(!v.is_from_api());
+
+    LoadRootRelative(destination,
+                     RootRegisterOffsetForExternalReferenceIndex(v.index()));
+  }
+}
+
+// static
+int32_t TurboAssemblerBase::RootRegisterOffset(Heap::RootListIndex root_index) {
+  return (root_index << kPointerSizeLog2) - kRootRegisterBias;
+}
+
+// static
+int32_t TurboAssemblerBase::RootRegisterOffsetForExternalReferenceIndex(
+    int reference_index) {
+  return Heap::roots_to_external_reference_table_offset() - kRootRegisterBias +
+         ExternalReferenceTable::OffsetOfEntry(reference_index);
+}
+
+// static
+intptr_t TurboAssemblerBase::RootRegisterOffsetForExternalReference(
+    Isolate* isolate, const ExternalReference& reference) {
+  return static_cast<intptr_t>(reference.address()) - kRootRegisterBias -
+         reinterpret_cast<intptr_t>(isolate->heap()->roots_array_start());
+}
+
+// static
+bool TurboAssemblerBase::IsAddressableThroughRootRegister(
+    Isolate* isolate, const ExternalReference& reference) {
+  Address start = reinterpret_cast<Address>(isolate);
+  Address end = isolate->heap()->root_register_addressable_end();
+  Address address = reference.address();
+  return start <= address && address < end;
+}
+
+// static
+int32_t TurboAssemblerBase::RootRegisterOffsetForBuiltinIndex(
+    int builtin_index) {
+  return Heap::roots_to_builtins_offset() - kRootRegisterBias +
+         builtin_index * kPointerSize;
+}
+
+}  // namespace internal
+}  // namespace v8
diff --git a/deps/v8/src/turbo-assembler.h b/deps/v8/src/turbo-assembler.h
new file mode 100644
index 00000000000000..67f895b1cab471
--- /dev/null
+++ b/deps/v8/src/turbo-assembler.h
@@ -0,0 +1,114 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef V8_TURBO_ASSEMBLER_H_
+#define V8_TURBO_ASSEMBLER_H_
+
+#include "src/assembler-arch.h"
+#include "src/heap/heap.h"
+
+namespace v8 {
+namespace internal {
+
+// Common base class for platform-specific TurboAssemblers containing
+// platform-independent bits.
+class TurboAssemblerBase : public Assembler {
+ public:
+  Isolate* isolate() const { return isolate_; }
+
+  Handle<HeapObject> CodeObject() const {
+    DCHECK(!code_object_.is_null());
+    return code_object_;
+  }
+
+  bool root_array_available() const { return root_array_available_; }
+  void set_root_array_available(bool v) { root_array_available_ = v; }
+
+  bool trap_on_abort() const { return trap_on_abort_; }
+  void set_trap_on_abort(bool v) { trap_on_abort_ = v; }
+
+  void set_builtin_index(int i) { maybe_builtin_index_ = i; }
+
+  void set_has_frame(bool v) { has_frame_ = v; }
+  bool has_frame() const { return has_frame_; }
+
+  // Loads the given constant or external reference without embedding its direct
+  // pointer. The produced code is isolate-independent.
+  void IndirectLoadConstant(Register destination, Handle<HeapObject> object);
+  void IndirectLoadExternalReference(Register destination,
+                                     ExternalReference reference);
+
+  virtual void LoadFromConstantsTable(Register destination,
+                                      int constant_index) = 0;
+
+  virtual void LoadRootRegisterOffset(Register destination,
+                                      intptr_t offset) = 0;
+  virtual void LoadRootRelative(Register destination, int32_t offset) = 0;
+
+  virtual void LoadRoot(Register destination, Heap::RootListIndex index) = 0;
+
+  static int32_t RootRegisterOffset(Heap::RootListIndex root_index);
+  static int32_t RootRegisterOffsetForExternalReferenceIndex(
+      int reference_index);
+
+  static int32_t RootRegisterOffsetForBuiltinIndex(int builtin_index);
+
+  static intptr_t RootRegisterOffsetForExternalReference(
+      Isolate* isolate, const ExternalReference& reference);
+
+  // An address is addressable through kRootRegister if it is located within
+  // [isolate, roots_ + root_register_addressable_end_offset[.
+  static bool IsAddressableThroughRootRegister(
+      Isolate* isolate, const ExternalReference& reference);
+
+ protected:
+  TurboAssemblerBase(Isolate* isolate, const AssemblerOptions& options,
+                     void* buffer, int buffer_size,
+                     CodeObjectRequired create_code_object);
+
+  Isolate* const isolate_ = nullptr;
+
+  // This handle will be patched with the code object on installation.
+  Handle<HeapObject> code_object_;
+
+  // Whether kRootRegister has been initialized.
+  bool root_array_available_ = true;
+
+  // Immediately trap instead of calling {Abort} when debug code fails.
+  bool trap_on_abort_ = FLAG_trap_on_abort;
+
+  // May be set while generating builtins.
+  int maybe_builtin_index_ = Builtins::kNoBuiltinId;
+
+  bool has_frame_ = false;
+
+  DISALLOW_IMPLICIT_CONSTRUCTORS(TurboAssemblerBase);
+};
+
+// Avoids emitting calls to the {Builtins::kAbort} builtin when emitting debug
+// code during the lifetime of this scope object. For disabling debug code
+// entirely use the {DontEmitDebugCodeScope} instead.
+class TrapOnAbortScope BASE_EMBEDDED {
+ public:
+  explicit TrapOnAbortScope(TurboAssemblerBase* assembler)
+      : assembler_(assembler), old_value_(assembler->trap_on_abort()) {
+    assembler_->set_trap_on_abort(true);
+  }
+  ~TrapOnAbortScope() { assembler_->set_trap_on_abort(old_value_); }
+
+ private:
+  TurboAssemblerBase* assembler_;
+  bool old_value_;
+};
+
+// Helper stubs can be called in different ways depending on where the target
+// code is located and how the call sequence is expected to look like:
+//  - JavaScript: Call on-heap {Code} object via {RelocInfo::CODE_TARGET}.
+//  - WebAssembly: Call native {WasmCode} stub via {RelocInfo::WASM_STUB_CALL}.
+enum class StubCallMode { kCallOnHeapBuiltin, kCallWasmRuntimeStub };
+
+}  // namespace internal
+}  // namespace v8
+
+#endif  // V8_TURBO_ASSEMBLER_H_
diff --git a/deps/v8/src/type-hints.cc b/deps/v8/src/type-hints.cc
index d74a9139018eca..2b7090ad08df41 100644
--- a/deps/v8/src/type-hints.cc
+++ b/deps/v8/src/type-hints.cc
@@ -75,18 +75,10 @@ std::ostream& operator<<(std::ostream& os, const StringAddFlags& flags) {
   switch (flags) {
     case STRING_ADD_CHECK_NONE:
       return os << "CheckNone";
-    case STRING_ADD_CHECK_LEFT:
-      return os << "CheckLeft";
-    case STRING_ADD_CHECK_RIGHT:
-      return os << "CheckRight";
-    case STRING_ADD_CHECK_BOTH:
-      return os << "CheckBoth";
     case STRING_ADD_CONVERT_LEFT:
       return os << "ConvertLeft";
     case STRING_ADD_CONVERT_RIGHT:
       return os << "ConvertRight";
-    case STRING_ADD_CONVERT:
-      break;
   }
   UNREACHABLE();
 }
diff --git a/deps/v8/src/type-hints.h b/deps/v8/src/type-hints.h
index e9ac639723386e..df5af6c49d2b25 100644
--- a/deps/v8/src/type-hints.h
+++ b/deps/v8/src/type-hints.h
@@ -62,17 +62,10 @@ std::ostream& operator<<(std::ostream&, ForInHint);
 
 enum StringAddFlags {
   // Omit both parameter checks.
-  STRING_ADD_CHECK_NONE = 0,
-  // Check left parameter.
-  STRING_ADD_CHECK_LEFT = 1 << 0,
-  // Check right parameter.
-  STRING_ADD_CHECK_RIGHT = 1 << 1,
-  // Check both parameters.
-  STRING_ADD_CHECK_BOTH = STRING_ADD_CHECK_LEFT | STRING_ADD_CHECK_RIGHT,
+  STRING_ADD_CHECK_NONE,
   // Convert parameters when check fails (instead of throwing an exception).
-  STRING_ADD_CONVERT = 1 << 2,
-  STRING_ADD_CONVERT_LEFT = STRING_ADD_CHECK_LEFT | STRING_ADD_CONVERT,
-  STRING_ADD_CONVERT_RIGHT = STRING_ADD_CHECK_RIGHT | STRING_ADD_CONVERT
+  STRING_ADD_CONVERT_LEFT,
+  STRING_ADD_CONVERT_RIGHT,
 };
 
 std::ostream& operator<<(std::ostream& os, const StringAddFlags& flags);
diff --git a/deps/v8/src/unicode-inl.h b/deps/v8/src/unicode-inl.h
index 7c0386ce5238eb..01408581152f51 100644
--- a/deps/v8/src/unicode-inl.h
+++ b/deps/v8/src/unicode-inl.h
@@ -85,6 +85,7 @@ unsigned Utf8::Encode(char* str,
     str[1] = 0x80 | (c & kMask);
     return 2;
   } else if (c <= kMaxThreeByteChar) {
+    DCHECK(!Utf16::IsLeadSurrogate(Utf16::kNoPreviousCharacter));
     if (Utf16::IsSurrogatePair(previous, c)) {
       const int kUnmatchedSize = kSizeOfUnmatchedSurrogate;
       return Encode(str - kUnmatchedSize,
@@ -127,8 +128,8 @@ unsigned Utf8::Length(uchar c, int previous) {
   } else if (c <= kMaxTwoByteChar) {
     return 2;
   } else if (c <= kMaxThreeByteChar) {
-    if (Utf16::IsTrailSurrogate(c) &&
-        Utf16::IsLeadSurrogate(previous)) {
+    DCHECK(!Utf16::IsLeadSurrogate(Utf16::kNoPreviousCharacter));
+    if (Utf16::IsSurrogatePair(previous, c)) {
       return kSizeOfUnmatchedSurrogate - kBytesSavedByCombiningSurrogates;
     }
     return 3;
diff --git a/deps/v8/src/unicode.h b/deps/v8/src/unicode.h
index 75f53e22d1920d..dddf22c4c66561 100644
--- a/deps/v8/src/unicode.h
+++ b/deps/v8/src/unicode.h
@@ -39,8 +39,12 @@ class Predicate {
     inline CacheEntry()
         : bit_field_(CodePointField::encode(0) | ValueField::encode(0)) {}
     inline CacheEntry(uchar code_point, bool value)
-        : bit_field_(CodePointField::encode(code_point) |
-                     ValueField::encode(value)) {}
+        : bit_field_(
+              CodePointField::encode(CodePointField::kMask & code_point) |
+              ValueField::encode(value)) {
+      DCHECK_IMPLIES((CodePointField::kMask & code_point) != code_point,
+                     code_point == static_cast<uchar>(-1));
+    }
 
     uchar code_point() const { return CodePointField::decode(bit_field_); }
     bool value() const { return ValueField::decode(bit_field_); }
@@ -94,22 +98,20 @@ class UnicodeData {
 
 class Utf16 {
  public:
+  static const int kNoPreviousCharacter = -1;
   static inline bool IsSurrogatePair(int lead, int trail) {
     return IsLeadSurrogate(lead) && IsTrailSurrogate(trail);
   }
   static inline bool IsLeadSurrogate(int code) {
-    if (code == kNoPreviousCharacter) return false;
     return (code & 0xfc00) == 0xd800;
   }
   static inline bool IsTrailSurrogate(int code) {
-    if (code == kNoPreviousCharacter) return false;
     return (code & 0xfc00) == 0xdc00;
   }
 
   static inline int CombineSurrogatePair(uchar lead, uchar trail) {
     return 0x10000 + ((lead & 0x3ff) << 10) + (trail & 0x3ff);
   }
-  static const int kNoPreviousCharacter = -1;
   static const uchar kMaxNonSurrogateCharCode = 0xffff;
   // Encoding a single UTF-16 code unit will produce 1, 2 or 3 bytes
   // of UTF-8 data.  The special case where the unit is a surrogate
diff --git a/deps/v8/src/uri.cc b/deps/v8/src/uri.cc
index 775c0ede2cf369..72fada759c0fd4 100644
--- a/deps/v8/src/uri.cc
+++ b/deps/v8/src/uri.cc
@@ -175,7 +175,7 @@ bool IntoOneAndTwoByte(Handle<String> uri, bool is_uri,
 
 MaybeHandle<String> Uri::Decode(Isolate* isolate, Handle<String> uri,
                                 bool is_uri) {
-  uri = String::Flatten(uri);
+  uri = String::Flatten(isolate, uri);
   std::vector<uint8_t> one_byte_buffer;
   std::vector<uc16> two_byte_buffer;
 
@@ -273,7 +273,7 @@ void EncodePair(uc16 cc1, uc16 cc2, std::vector<uint8_t>* buffer) {
 
 MaybeHandle<String> Uri::Encode(Isolate* isolate, Handle<String> uri,
                                 bool is_uri) {
-  uri = String::Flatten(uri);
+  uri = String::Flatten(isolate, uri);
   int uri_length = uri->length();
   std::vector<uint8_t> buffer;
   buffer.reserve(uri_length);
@@ -492,7 +492,7 @@ static MaybeHandle<String> EscapePrivate(Isolate* isolate,
 
 MaybeHandle<String> Uri::Escape(Isolate* isolate, Handle<String> string) {
   Handle<String> result;
-  string = String::Flatten(string);
+  string = String::Flatten(isolate, string);
   return string->IsOneByteRepresentationUnderneath()
              ? EscapePrivate<uint8_t>(isolate, string)
              : EscapePrivate<uc16>(isolate, string);
@@ -500,7 +500,7 @@ MaybeHandle<String> Uri::Escape(Isolate* isolate, Handle<String> string) {
 
 MaybeHandle<String> Uri::Unescape(Isolate* isolate, Handle<String> string) {
   Handle<String> result;
-  string = String::Flatten(string);
+  string = String::Flatten(isolate, string);
   return string->IsOneByteRepresentationUnderneath()
              ? UnescapePrivate<uint8_t>(isolate, string)
              : UnescapePrivate<uc16>(isolate, string);
diff --git a/deps/v8/src/utils.cc b/deps/v8/src/utils.cc
index 8f20fba139a3a7..64aa446ef20d5d 100644
--- a/deps/v8/src/utils.cc
+++ b/deps/v8/src/utils.cc
@@ -442,6 +442,53 @@ bool DoubleToBoolean(double d) {
   return true;
 }
 
+// The filter is a pattern that matches function names in this way:
+//   "*"      all; the default
+//   "-"      all but the top-level function
+//   "-name"  all but the function "name"
+//   ""       only the top-level function
+//   "name"   only the function "name"
+//   "name*"  only functions starting with "name"
+//   "~"      none; the tilde is not an identifier
+bool PassesFilter(Vector<const char> name, Vector<const char> filter) {
+  if (filter.size() == 0) return name.size() == 0;
+  auto filter_it = filter.begin();
+  bool positive_filter = true;
+  if (*filter_it == '-') {
+    ++filter_it;
+    positive_filter = false;
+  }
+  if (filter_it == filter.end()) return name.size() != 0;
+  if (*filter_it == '*') return positive_filter;
+  if (*filter_it == '~') return !positive_filter;
+
+  bool prefix_match = filter[filter.size() - 1] == '*';
+  size_t min_match_length = filter.size();
+  if (!positive_filter) min_match_length--;  // Subtract 1 for leading '-'.
+  if (prefix_match) min_match_length--;      // Subtract 1 for trailing '*'.
+
+  if (name.size() < min_match_length) return !positive_filter;
+
+  // TODO(sigurds): Use the new version of std::mismatch here, once we
+  // can assume C++14.
+  auto res = std::mismatch(filter_it, filter.end(), name.begin());
+  if (res.first == filter.end()) {
+    if (res.second == name.end()) {
+      // The strings match, so {name} passes if we have a {positive_filter}.
+      return positive_filter;
+    }
+    // {name} is longer than the filter, so {name} passes if we don't have a
+    // {positive_filter}.
+    return !positive_filter;
+  }
+  if (*res.first == '*') {
+    // We matched up to the wildcard, so {name} passes if we have a
+    // {positive_filter}.
+    return positive_filter;
+  }
+  // We don't match, so {name} passes if we don't have a {positive_filter}.
+  return !positive_filter;
+}
 
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/src/utils.h b/deps/v8/src/utils.h
index 35a9e7b15ec881..a19d79654ad7d2 100644
--- a/deps/v8/src/utils.h
+++ b/deps/v8/src/utils.h
@@ -21,7 +21,6 @@
 #include "src/base/v8-fallthrough.h"
 #include "src/globals.h"
 #include "src/vector.h"
-#include "src/zone/zone.h"
 
 #if defined(V8_OS_AIX)
 #include <fenv.h>  // NOLINT(build/c++11)
@@ -510,6 +509,9 @@ inline uint32_t ComputePointerHash(void* ptr) {
       static_cast<uint32_t>(reinterpret_cast<intptr_t>(ptr)));
 }
 
+inline uint32_t ComputeAddressHash(Address address) {
+  return ComputeIntegerHash(static_cast<uint32_t>(address & 0xFFFFFFFFul));
+}
 
 // ----------------------------------------------------------------------------
 // Generated memcpy/memmove
@@ -1237,29 +1239,31 @@ Vector<const char> ReadFile(FILE* file,
                             bool* exists,
                             bool verbose = true);
 
-
 template <typename sourcechar, typename sinkchar>
-INLINE(static void CopyCharsUnsigned(sinkchar* dest, const sourcechar* src,
-                                     size_t chars));
+V8_INLINE static void CopyCharsUnsigned(sinkchar* dest, const sourcechar* src,
+                                        size_t chars);
 #if defined(V8_HOST_ARCH_ARM)
-INLINE(void CopyCharsUnsigned(uint8_t* dest, const uint8_t* src, size_t chars));
-INLINE(void CopyCharsUnsigned(uint16_t* dest, const uint8_t* src,
-                              size_t chars));
-INLINE(void CopyCharsUnsigned(uint16_t* dest, const uint16_t* src,
-                              size_t chars));
+V8_INLINE void CopyCharsUnsigned(uint8_t* dest, const uint8_t* src,
+                                 size_t chars);
+V8_INLINE void CopyCharsUnsigned(uint16_t* dest, const uint8_t* src,
+                                 size_t chars);
+V8_INLINE void CopyCharsUnsigned(uint16_t* dest, const uint16_t* src,
+                                 size_t chars);
 #elif defined(V8_HOST_ARCH_MIPS)
-INLINE(void CopyCharsUnsigned(uint8_t* dest, const uint8_t* src, size_t chars));
-INLINE(void CopyCharsUnsigned(uint16_t* dest, const uint16_t* src,
-                              size_t chars));
+V8_INLINE void CopyCharsUnsigned(uint8_t* dest, const uint8_t* src,
+                                 size_t chars);
+V8_INLINE void CopyCharsUnsigned(uint16_t* dest, const uint16_t* src,
+                                 size_t chars);
 #elif defined(V8_HOST_ARCH_PPC) || defined(V8_HOST_ARCH_S390)
-INLINE(void CopyCharsUnsigned(uint8_t* dest, const uint8_t* src, size_t chars));
-INLINE(void CopyCharsUnsigned(uint16_t* dest, const uint16_t* src,
-                              size_t chars));
+V8_INLINE void CopyCharsUnsigned(uint8_t* dest, const uint8_t* src,
+                                 size_t chars);
+V8_INLINE void CopyCharsUnsigned(uint16_t* dest, const uint16_t* src,
+                                 size_t chars);
 #endif
 
 // Copy from 8bit/16bit chars to 8bit/16bit chars.
 template <typename sourcechar, typename sinkchar>
-INLINE(void CopyChars(sinkchar* dest, const sourcechar* src, size_t chars));
+V8_INLINE void CopyChars(sinkchar* dest, const sourcechar* src, size_t chars);
 
 template <typename sourcechar, typename sinkchar>
 void CopyChars(sinkchar* dest, const sourcechar* src, size_t chars) {
@@ -1578,61 +1582,61 @@ inline uintptr_t GetCurrentStackPosition() {
 }
 
 template <typename V>
-static inline V ReadUnalignedValue(const void* p) {
+static inline V ReadUnalignedValue(Address p) {
   ASSERT_TRIVIALLY_COPYABLE(V);
 #if !(V8_TARGET_ARCH_MIPS || V8_TARGET_ARCH_MIPS64 || V8_TARGET_ARCH_ARM)
   return *reinterpret_cast<const V*>(p);
 #else   // V8_TARGET_ARCH_MIPS || V8_TARGET_ARCH_MIPS64 || V8_TARGET_ARCH_ARM
   V r;
-  memmove(&r, p, sizeof(V));
+  memmove(&r, reinterpret_cast<void*>(p), sizeof(V));
   return r;
 #endif  // V8_TARGET_ARCH_MIPS || V8_TARGET_ARCH_MIPS64 || V8_TARGET_ARCH_ARM
 }
 
 template <typename V>
-static inline void WriteUnalignedValue(void* p, V value) {
+static inline void WriteUnalignedValue(Address p, V value) {
   ASSERT_TRIVIALLY_COPYABLE(V);
 #if !(V8_TARGET_ARCH_MIPS || V8_TARGET_ARCH_MIPS64 || V8_TARGET_ARCH_ARM)
   *(reinterpret_cast<V*>(p)) = value;
 #else   // V8_TARGET_ARCH_MIPS || V8_TARGET_ARCH_MIPS64 || V8_TARGET_ARCH_ARM
-  memmove(p, &value, sizeof(V));
+  memmove(reinterpret_cast<void*>(p), &value, sizeof(V));
 #endif  // V8_TARGET_ARCH_MIPS || V8_TARGET_ARCH_MIPS64 || V8_TARGET_ARCH_ARM
 }
 
-static inline double ReadFloatValue(const void* p) {
+static inline double ReadFloatValue(Address p) {
   return ReadUnalignedValue<float>(p);
 }
 
-static inline double ReadDoubleValue(const void* p) {
+static inline double ReadDoubleValue(Address p) {
   return ReadUnalignedValue<double>(p);
 }
 
-static inline void WriteDoubleValue(void* p, double value) {
+static inline void WriteDoubleValue(Address p, double value) {
   WriteUnalignedValue(p, value);
 }
 
-static inline uint16_t ReadUnalignedUInt16(const void* p) {
+static inline uint16_t ReadUnalignedUInt16(Address p) {
   return ReadUnalignedValue<uint16_t>(p);
 }
 
-static inline void WriteUnalignedUInt16(void* p, uint16_t value) {
+static inline void WriteUnalignedUInt16(Address p, uint16_t value) {
   WriteUnalignedValue(p, value);
 }
 
-static inline uint32_t ReadUnalignedUInt32(const void* p) {
+static inline uint32_t ReadUnalignedUInt32(Address p) {
   return ReadUnalignedValue<uint32_t>(p);
 }
 
-static inline void WriteUnalignedUInt32(void* p, uint32_t value) {
+static inline void WriteUnalignedUInt32(Address p, uint32_t value) {
   WriteUnalignedValue(p, value);
 }
 
 template <typename V>
-static inline V ReadLittleEndianValue(const void* p) {
+static inline V ReadLittleEndianValue(Address p) {
 #if defined(V8_TARGET_LITTLE_ENDIAN)
   return ReadUnalignedValue<V>(p);
 #elif defined(V8_TARGET_BIG_ENDIAN)
-  V ret = 0;
+  V ret{};
   const byte* src = reinterpret_cast<const byte*>(p);
   byte* dst = reinterpret_cast<byte*>(&ret);
   for (size_t i = 0; i < sizeof(V); i++) {
@@ -1643,7 +1647,7 @@ static inline V ReadLittleEndianValue(const void* p) {
 }
 
 template <typename V>
-static inline void WriteLittleEndianValue(void* p, V value) {
+static inline void WriteLittleEndianValue(Address p, V value) {
 #if defined(V8_TARGET_LITTLE_ENDIAN)
   WriteUnalignedValue<V>(p, value);
 #elif defined(V8_TARGET_BIG_ENDIAN)
@@ -1661,13 +1665,13 @@ static inline V ByteReverse(V value) {
   switch (size_of_v) {
     case 2:
 #if V8_HAS_BUILTIN_BSWAP16
-      return __builtin_bswap16(value);
+      return static_cast<V>(__builtin_bswap16(static_cast<uint16_t>(value)));
 #else
       return value << 8 | (value >> 8 & 0x00FF);
 #endif
     case 4:
 #if V8_HAS_BUILTIN_BSWAP32
-      return __builtin_bswap32(value);
+      return static_cast<V>(__builtin_bswap32(static_cast<uint32_t>(value)));
 #else
     {
       size_t bits_of_v = size_of_v * kBitsPerByte;
@@ -1679,7 +1683,7 @@ static inline V ByteReverse(V value) {
 #endif
     case 8:
 #if V8_HAS_BUILTIN_BSWAP64
-      return __builtin_bswap64(value);
+      return static_cast<V>(__builtin_bswap64(static_cast<uint64_t>(value)));
 #else
     {
       size_t bits_of_v = size_of_v * kBitsPerByte;
@@ -1800,20 +1804,8 @@ class ThreadedList final {
   DISALLOW_COPY_AND_ASSIGN(ThreadedList);
 };
 
-// Can be used to create a threaded list of |T|.
-template <typename T>
-class ThreadedListZoneEntry final : public ZoneObject {
- public:
-  explicit ThreadedListZoneEntry(T value) : value_(value), next_(nullptr) {}
-
-  T value() { return value_; }
-  ThreadedListZoneEntry<T>** next() { return &next_; }
-
- private:
-  T value_;
-  ThreadedListZoneEntry<T>* next_;
-  DISALLOW_COPY_AND_ASSIGN(ThreadedListZoneEntry);
-};
+V8_EXPORT_PRIVATE bool PassesFilter(Vector<const char> name,
+                                    Vector<const char> filter);
 
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/src/v8.cc b/deps/v8/src/v8.cc
index d3b4c471a4f8a4..e8f1f0e84601d1 100644
--- a/deps/v8/src/v8.cc
+++ b/deps/v8/src/v8.cc
@@ -14,6 +14,7 @@
 #include "src/deoptimizer.h"
 #include "src/elements.h"
 #include "src/frames.h"
+#include "src/interface-descriptors.h"
 #include "src/isolate.h"
 #include "src/libsampler/sampler.h"
 #include "src/objects-inl.h"
@@ -46,6 +47,7 @@ void V8::TearDown() {
 #if defined(USE_SIMULATOR)
   Simulator::GlobalTearDown();
 #endif
+  CallDescriptors::TearDown();
   Bootstrapper::TearDownExtensions();
   ElementsAccessor::TearDown();
   RegisteredExtension::UnregisterAll();
@@ -80,8 +82,8 @@ void V8::InitializeOncePerProcessImpl() {
   sampler::Sampler::SetUp();
   CpuFeatures::Probe(false);
   ElementsAccessor::InitializeOncePerProcess();
-  ExternalReference::SetUp();
   Bootstrapper::InitializeOncePerProcess();
+  CallDescriptors::InitializeOncePerProcess();
 }
 
 
diff --git a/deps/v8/src/v8memory.h b/deps/v8/src/v8memory.h
index 8672c477f8eedb..2c38437b9ebba0 100644
--- a/deps/v8/src/v8memory.h
+++ b/deps/v8/src/v8memory.h
@@ -33,6 +33,10 @@ class Memory {
     return *reinterpret_cast<uint64_t*>(addr);
   }
 
+  static int64_t& int64_at(Address addr) {
+    return *reinterpret_cast<int64_t*>(addr);
+  }
+
   static int& int_at(Address addr)  {
     return *reinterpret_cast<int*>(addr);
   }
@@ -70,10 +74,7 @@ class Memory {
   }
 
   static bool IsAddressInRange(Address base, Address address, uint32_t size) {
-    uintptr_t numeric_base = reinterpret_cast<uintptr_t>(base);
-    uintptr_t numeric_address = reinterpret_cast<uintptr_t>(address);
-    return numeric_base <= numeric_address &&
-           numeric_address < numeric_base + size;
+    return base <= address && address < base + size;
   }
 };
 
diff --git a/deps/v8/src/value-serializer.cc b/deps/v8/src/value-serializer.cc
index 030501e3087f9c..79ad64e66d9a4b 100644
--- a/deps/v8/src/value-serializer.cc
+++ b/deps/v8/src/value-serializer.cc
@@ -15,6 +15,9 @@
 #include "src/heap/factory.h"
 #include "src/isolate.h"
 #include "src/objects-inl.h"
+#include "src/objects/js-collection-inl.h"
+#include "src/objects/js-regexp-inl.h"
+#include "src/objects/ordered-hash-table-inl.h"
 #include "src/snapshot/code-serializer.h"
 #include "src/transitions.h"
 #include "src/wasm/wasm-engine.h"
@@ -353,9 +356,11 @@ Maybe<bool> ValueSerializer::WriteObject(Handle<Object> object) {
       WriteOddball(Oddball::cast(*object));
       return ThrowIfOutOfMemory();
     case HEAP_NUMBER_TYPE:
-    case MUTABLE_HEAP_NUMBER_TYPE:
       WriteHeapNumber(HeapNumber::cast(*object));
       return ThrowIfOutOfMemory();
+    case MUTABLE_HEAP_NUMBER_TYPE:
+      WriteMutableHeapNumber(MutableHeapNumber::cast(*object));
+      return ThrowIfOutOfMemory();
     case BIGINT_TYPE:
       WriteBigInt(BigInt::cast(*object));
       return ThrowIfOutOfMemory();
@@ -422,13 +427,18 @@ void ValueSerializer::WriteHeapNumber(HeapNumber* number) {
   WriteDouble(number->value());
 }
 
+void ValueSerializer::WriteMutableHeapNumber(MutableHeapNumber* number) {
+  WriteTag(SerializationTag::kDouble);
+  WriteDouble(number->value());
+}
+
 void ValueSerializer::WriteBigInt(BigInt* bigint) {
   WriteTag(SerializationTag::kBigInt);
   WriteBigIntContents(bigint);
 }
 
 void ValueSerializer::WriteString(Handle<String> string) {
-  string = String::Flatten(string);
+  string = String::Flatten(isolate_, string);
   DisallowHeapAllocation no_gc;
   String::FlatContent flat = string->GetFlatContent();
   DCHECK(flat.IsFlat());
@@ -525,7 +535,7 @@ Maybe<bool> ValueSerializer::WriteJSReceiver(Handle<JSReceiver> receiver) {
 }
 
 Maybe<bool> ValueSerializer::WriteJSObject(Handle<JSObject> object) {
-  DCHECK_GT(object->map()->instance_type(), LAST_CUSTOM_ELEMENTS_RECEIVER);
+  DCHECK(!object->map()->IsCustomElementsReceiverMap());
   const bool can_serialize_fast =
       object->HasFastProperties() && object->elements()->length() == 0;
   if (!can_serialize_fast) return WriteJSObjectSlow(object);
@@ -733,12 +743,12 @@ void ValueSerializer::WriteJSRegExp(JSRegExp* regexp) {
 
 Maybe<bool> ValueSerializer::WriteJSMap(Handle<JSMap> map) {
   // First copy the key-value pairs, since getters could mutate them.
-  Handle<OrderedHashMap> table(OrderedHashMap::cast(map->table()));
+  Handle<OrderedHashMap> table(OrderedHashMap::cast(map->table()), isolate_);
   int length = table->NumberOfElements() * 2;
   Handle<FixedArray> entries = isolate_->factory()->NewFixedArray(length);
   {
     DisallowHeapAllocation no_gc;
-    Oddball* the_hole = isolate_->heap()->the_hole_value();
+    Oddball* the_hole = ReadOnlyRoots(isolate_).the_hole_value();
     int capacity = table->UsedCapacity();
     int result_index = 0;
     for (int i = 0; i < capacity; i++) {
@@ -764,12 +774,12 @@ Maybe<bool> ValueSerializer::WriteJSMap(Handle<JSMap> map) {
 
 Maybe<bool> ValueSerializer::WriteJSSet(Handle<JSSet> set) {
   // First copy the element pointers, since getters could mutate them.
-  Handle<OrderedHashSet> table(OrderedHashSet::cast(set->table()));
+  Handle<OrderedHashSet> table(OrderedHashSet::cast(set->table()), isolate_);
   int length = table->NumberOfElements();
   Handle<FixedArray> entries = isolate_->factory()->NewFixedArray(length);
   {
     DisallowHeapAllocation no_gc;
-    Oddball* the_hole = isolate_->heap()->the_hole_value();
+    Oddball* the_hole = ReadOnlyRoots(isolate_).the_hole_value();
     int capacity = table->UsedCapacity();
     int result_index = 0;
     for (int i = 0; i < capacity; i++) {
@@ -872,23 +882,29 @@ Maybe<bool> ValueSerializer::WriteWasmModule(Handle<WasmModuleObject> object) {
     }
   }
 
-  Handle<WasmCompiledModule> compiled_part(object->compiled_module(), isolate_);
   WasmEncodingTag encoding_tag = WasmEncodingTag::kRawBytes;
   WriteTag(SerializationTag::kWasmModule);
   WriteRawBytes(&encoding_tag, sizeof(encoding_tag));
 
-  Handle<String> wire_bytes(compiled_part->shared()->module_bytes(), isolate_);
-  int wire_bytes_length = wire_bytes->length();
-  WriteVarint<uint32_t>(wire_bytes_length);
+  wasm::NativeModule* native_module = object->native_module();
+  Vector<const uint8_t> wire_bytes = native_module->wire_bytes();
+  WriteVarint<uint32_t>(static_cast<uint32_t>(wire_bytes.size()));
   uint8_t* destination;
-  if (ReserveRawBytes(wire_bytes_length).To(&destination)) {
-    String::WriteToFlat(*wire_bytes, destination, 0, wire_bytes_length);
+  if (ReserveRawBytes(wire_bytes.size()).To(&destination)) {
+    memcpy(destination, wire_bytes.start(), wire_bytes.size());
+  }
+
+  size_t module_size =
+      wasm::GetSerializedNativeModuleSize(isolate_, native_module);
+  CHECK_GE(std::numeric_limits<uint32_t>::max(), module_size);
+  WriteVarint<uint32_t>(static_cast<uint32_t>(module_size));
+  uint8_t* module_buffer;
+  if (ReserveRawBytes(module_size).To(&module_buffer)) {
+    if (!wasm::SerializeNativeModule(isolate_, native_module,
+                                     {module_buffer, module_size})) {
+      return Nothing<bool>();
+    }
   }
-
-  std::pair<std::unique_ptr<const byte[]>, size_t> serialized_module =
-      wasm::SerializeNativeModule(isolate_, compiled_part);
-  WriteVarint<uint32_t>(static_cast<uint32_t>(serialized_module.second));
-  WriteRawBytes(serialized_module.first.get(), serialized_module.second);
   return ThrowIfOutOfMemory();
 }
 
@@ -984,7 +1000,7 @@ ValueDeserializer::ValueDeserializer(Isolate* isolate,
       end_(data.start() + data.length()),
       pretenure_(data.length() > kPretenureThreshold ? TENURED : NOT_TENURED),
       id_map_(isolate->global_handles()->Create(
-          isolate_->heap()->empty_fixed_array())) {}
+          ReadOnlyRoots(isolate_).empty_fixed_array())) {}
 
 ValueDeserializer::~ValueDeserializer() {
   GlobalHandles::Destroy(Handle<Object>::cast(id_map_).location());
@@ -1490,12 +1506,12 @@ MaybeHandle<JSValue> ValueDeserializer::ReadJSValue(SerializationTag tag) {
     case SerializationTag::kTrueObject:
       value = Handle<JSValue>::cast(isolate_->factory()->NewJSObject(
           isolate_->boolean_function(), pretenure_));
-      value->set_value(isolate_->heap()->true_value());
+      value->set_value(ReadOnlyRoots(isolate_).true_value());
       break;
     case SerializationTag::kFalseObject:
       value = Handle<JSValue>::cast(isolate_->factory()->NewJSObject(
           isolate_->boolean_function(), pretenure_));
-      value->set_value(isolate_->heap()->false_value());
+      value->set_value(ReadOnlyRoots(isolate_).false_value());
       break;
     case SerializationTag::kNumberObject: {
       double number;
@@ -1785,12 +1801,8 @@ MaybeHandle<JSObject> ValueDeserializer::ReadWasmModule() {
   }
 
   // Try to deserialize the compiled module first.
-  Handle<WasmCompiledModule> compiled_module;
-  MaybeHandle<JSObject> result;
-  if (wasm::DeserializeNativeModule(isolate_, compiled_bytes, wire_bytes)
-          .ToHandle(&compiled_module)) {
-    result = WasmModuleObject::New(isolate_, compiled_module);
-  }
+  MaybeHandle<WasmModuleObject> result =
+      wasm::DeserializeNativeModule(isolate_, compiled_bytes, wire_bytes);
   if (result.is_null()) {
     wasm::ErrorThrower thrower(isolate_, "ValueDeserializer::ReadWasmModule");
     result = isolate_->wasm_engine()->SyncCompile(
@@ -1898,7 +1910,7 @@ Maybe<uint32_t> ValueDeserializer::ReadJSObjectProperties(
       // transition was found.
       Handle<Object> key;
       Handle<Map> target;
-      TransitionsAccessor transitions(map);
+      TransitionsAccessor transitions(isolate_, map);
       Handle<String> expected_key = transitions.ExpectedTransitionKey();
       if (!expected_key.is_null() && ReadExpectedString(expected_key)) {
         key = expected_key;
@@ -1911,7 +1923,7 @@ Maybe<uint32_t> ValueDeserializer::ReadJSObjectProperties(
           key =
               isolate_->factory()->InternalizeString(Handle<String>::cast(key));
           // Don't reuse |transitions| because it could be stale.
-          transitioning = TransitionsAccessor(map)
+          transitioning = TransitionsAccessor(isolate_, map)
                               .FindTransitionToField(Handle<String>::cast(key))
                               .ToHandle(&target);
         } else {
@@ -1938,8 +1950,9 @@ Maybe<uint32_t> ValueDeserializer::ReadJSObjectProperties(
                    ->NowContains(value)) {
             Handle<FieldType> value_type =
                 value->OptimalType(isolate_, expected_representation);
-            Map::GeneralizeField(target, descriptor, details.constness(),
-                                 expected_representation, value_type);
+            Map::GeneralizeField(isolate_, target, descriptor,
+                                 details.constness(), expected_representation,
+                                 value_type);
           }
           DCHECK(target->instance_descriptors()
                      ->GetFieldType(descriptor)
diff --git a/deps/v8/src/value-serializer.h b/deps/v8/src/value-serializer.h
index e162ce22d70ed2..91f8ecc7dd2b91 100644
--- a/deps/v8/src/value-serializer.h
+++ b/deps/v8/src/value-serializer.h
@@ -29,6 +29,7 @@ class JSMap;
 class JSRegExp;
 class JSSet;
 class JSValue;
+class MutableHeapNumber;
 class Object;
 class Oddball;
 class Smi;
@@ -115,6 +116,7 @@ class ValueSerializer {
   void WriteOddball(Oddball* oddball);
   void WriteSmi(Smi* smi);
   void WriteHeapNumber(HeapNumber* number);
+  void WriteMutableHeapNumber(MutableHeapNumber* number);
   void WriteBigInt(BigInt* bigint);
   void WriteString(Handle<String> string);
   Maybe<bool> WriteJSReceiver(Handle<JSReceiver> receiver)
diff --git a/deps/v8/src/vector.h b/deps/v8/src/vector.h
index 97ce43e8aac28f..355fc8082948a0 100644
--- a/deps/v8/src/vector.h
+++ b/deps/v8/src/vector.h
@@ -5,8 +5,9 @@
 #ifndef V8_VECTOR_H_
 #define V8_VECTOR_H_
 
-#include <string.h>
 #include <algorithm>
+#include <cstring>
+#include <iterator>
 
 #include "src/allocation.h"
 #include "src/checks.h"
@@ -150,9 +151,6 @@ class Vector {
     return true;
   }
 
- protected:
-  void set_start(T* start) { start_ = start; }
-
  private:
   T* start_;
   size_t length_;
@@ -183,6 +181,66 @@ class ScopedVector : public Vector<T> {
   DISALLOW_IMPLICIT_CONSTRUCTORS(ScopedVector);
 };
 
+template <typename T>
+class OwnedVector {
+ public:
+  MOVE_ONLY_WITH_DEFAULT_CONSTRUCTORS(OwnedVector);
+  OwnedVector(std::unique_ptr<T[]> data, size_t length)
+      : data_(std::move(data)), length_(length) {
+    DCHECK_IMPLIES(length_ > 0, data_ != nullptr);
+  }
+  // Implicit conversion from {OwnedVector<U>} to {OwnedVector<T>}, instantiable
+  // if {std::unique_ptr<U>} can be converted to {std::unique_ptr<T>}.
+  // Can be used to convert {OwnedVector<T>} to {OwnedVector<const T>}.
+  template <typename U,
+            typename = typename std::enable_if<std::is_convertible<
+                std::unique_ptr<U>, std::unique_ptr<T>>::value>::type>
+  OwnedVector(OwnedVector<U>&& other)
+      : data_(other.ReleaseData()), length_(other.size()) {}
+
+  // Returns the length of the vector as a size_t.
+  constexpr size_t size() const { return length_; }
+
+  // Returns whether or not the vector is empty.
+  constexpr bool is_empty() const { return length_ == 0; }
+
+  // Returns the pointer to the start of the data in the vector.
+  T* start() const {
+    DCHECK_IMPLIES(length_ > 0, data_ != nullptr);
+    return data_.get();
+  }
+
+  // Returns a {Vector<T>} view of the data in this vector.
+  Vector<T> as_vector() const { return Vector<T>(start(), size()); }
+
+  // Releases the backing data from this vector and transfers ownership to the
+  // caller. This vectors data can no longer be used afterwards.
+  std::unique_ptr<T[]> ReleaseData() { return std::move(data_); }
+
+  // Allocates a new vector of the specified size via the default allocator.
+  static OwnedVector<T> New(size_t size) {
+    if (size == 0) return {};
+    return OwnedVector<T>(std::unique_ptr<T[]>(new T[size]), size);
+  }
+
+  // Allocates a new vector containing the specified collection of values.
+  // {Iterator} is the common type of {std::begin} and {std::end} called on a
+  // {const U&}. This function is only instantiable if that type exists.
+  template <typename U, typename Iterator = typename std::common_type<
+                            decltype(std::begin(std::declval<const U&>())),
+                            decltype(std::end(std::declval<const U&>()))>::type>
+  static OwnedVector<T> Of(const U& collection) {
+    Iterator begin = std::begin(collection);
+    Iterator end = std::end(collection);
+    OwnedVector<T> vec = New(std::distance(begin, end));
+    std::copy(begin, end, vec.start());
+    return vec;
+  }
+
+ private:
+  std::unique_ptr<T[]> data_;
+  size_t length_ = 0;
+};
 
 inline int StrLength(const char* string) {
   size_t length = strlen(string);
diff --git a/deps/v8/src/visitors.h b/deps/v8/src/visitors.h
index f242f3c044f12a..9098d8b47191e0 100644
--- a/deps/v8/src/visitors.h
+++ b/deps/v8/src/visitors.h
@@ -78,6 +78,8 @@ class RootVisitor BASE_EMBEDDED {
   static const char* RootName(Root root);
 };
 
+class RelocIterator;
+
 // Abstract base class for visiting, and optionally modifying, the
 // pointers contained in Objects. Used in GC and serialization/deserialization.
 class ObjectVisitor BASE_EMBEDDED {
@@ -122,6 +124,9 @@ class ObjectVisitor BASE_EMBEDDED {
 
   // Visits an off-heap target in the instruction stream.
   virtual void VisitOffHeapTarget(Code* host, RelocInfo* rinfo) {}
+
+  // Visits the relocation info using the given iterator.
+  virtual void VisitRelocInfo(RelocIterator* it);
 };
 
 }  // namespace internal
diff --git a/deps/v8/src/vm-state.h b/deps/v8/src/vm-state.h
index 38852e55712652..cf74c6387075a9 100644
--- a/deps/v8/src/vm-state.h
+++ b/deps/v8/src/vm-state.h
@@ -34,7 +34,7 @@ class ExternalCallbackScope BASE_EMBEDDED {
   inline ~ExternalCallbackScope();
   Address callback() { return callback_; }
   Address* callback_entrypoint_address() {
-    if (callback_ == nullptr) return nullptr;
+    if (callback_ == kNullAddress) return nullptr;
 #if USES_FUNCTION_DESCRIPTORS
     return FUNCTION_ENTRYPOINT_ADDRESS(callback_);
 #else
diff --git a/deps/v8/src/wasm/baseline/arm/liftoff-assembler-arm.h b/deps/v8/src/wasm/baseline/arm/liftoff-assembler-arm.h
index 91df3f0528cc6d..ca55fe5d523732 100644
--- a/deps/v8/src/wasm/baseline/arm/liftoff-assembler-arm.h
+++ b/deps/v8/src/wasm/baseline/arm/liftoff-assembler-arm.h
@@ -13,16 +13,20 @@ namespace v8 {
 namespace internal {
 namespace wasm {
 
-uint32_t LiftoffAssembler::PrepareStackFrame() {
+int LiftoffAssembler::PrepareStackFrame() {
   BAILOUT("PrepareStackFrame");
   return 0;
 }
 
-void LiftoffAssembler::PatchPrepareStackFrame(uint32_t offset,
+void LiftoffAssembler::PatchPrepareStackFrame(int offset,
                                               uint32_t stack_slots) {
   BAILOUT("PatchPrepareStackFrame");
 }
 
+void LiftoffAssembler::FinishCode() { CheckConstPool(true, false); }
+
+void LiftoffAssembler::AbortCompilation() { FinishCode(); }
+
 void LiftoffAssembler::LoadConstant(LiftoffRegister reg, WasmValue value,
                                     RelocInfo::Mode rmode) {
   BAILOUT("LoadConstant");
@@ -44,17 +48,28 @@ void LiftoffAssembler::FillInstanceInto(Register dst) {
 void LiftoffAssembler::Load(LiftoffRegister dst, Register src_addr,
                             Register offset_reg, uint32_t offset_imm,
                             LoadType type, LiftoffRegList pinned,
-                            uint32_t* protected_load_pc) {
+                            uint32_t* protected_load_pc, bool is_load_mem) {
   BAILOUT("Load");
 }
 
 void LiftoffAssembler::Store(Register dst_addr, Register offset_reg,
                              uint32_t offset_imm, LiftoffRegister src,
                              StoreType type, LiftoffRegList pinned,
-                             uint32_t* protected_store_pc) {
+                             uint32_t* protected_store_pc, bool is_store_mem) {
   BAILOUT("Store");
 }
 
+void LiftoffAssembler::ChangeEndiannessLoad(LiftoffRegister dst, LoadType type,
+                                            LiftoffRegList pinned) {
+  BAILOUT("ChangeEndiannessLoad");
+}
+
+void LiftoffAssembler::ChangeEndiannessStore(LiftoffRegister src,
+                                             StoreType type,
+                                             LiftoffRegList pinned) {
+  BAILOUT("ChangeEndiannessStore");
+}
+
 void LiftoffAssembler::LoadCallerFrameSlot(LiftoffRegister dst,
                                            uint32_t caller_slot_idx,
                                            ValueType type) {
@@ -66,11 +81,6 @@ void LiftoffAssembler::MoveStackValue(uint32_t dst_index, uint32_t src_index,
   BAILOUT("MoveStackValue");
 }
 
-void LiftoffAssembler::MoveToReturnRegister(LiftoffRegister reg,
-                                            ValueType type) {
-  BAILOUT("MoveToReturnRegister");
-}
-
 void LiftoffAssembler::Move(Register dst, Register src, ValueType type) {
   BAILOUT("Move Register");
 }
@@ -122,6 +132,11 @@ void LiftoffAssembler::FillI64Half(Register, uint32_t half_index) {
   void LiftoffAssembler::emit_##name(DoubleRegister dst, DoubleRegister src) { \
     BAILOUT("fp unop: " #name);                                                \
   }
+#define UNIMPLEMENTED_FP_UNOP_RETURN_TRUE(name)                                \
+  bool LiftoffAssembler::emit_##name(DoubleRegister dst, DoubleRegister src) { \
+    BAILOUT("fp unop: " #name);                                                \
+    return true;                                                               \
+  }
 #define UNIMPLEMENTED_I32_SHIFTOP(name)                                        \
   void LiftoffAssembler::emit_##name(Register dst, Register src,               \
                                      Register amount, LiftoffRegList pinned) { \
@@ -144,6 +159,7 @@ UNIMPLEMENTED_I32_SHIFTOP(i32_sar)
 UNIMPLEMENTED_I32_SHIFTOP(i32_shr)
 UNIMPLEMENTED_I64_BINOP(i64_add)
 UNIMPLEMENTED_I64_BINOP(i64_sub)
+UNIMPLEMENTED_I64_BINOP(i64_mul)
 UNIMPLEMENTED_I64_SHIFTOP(i64_shl)
 UNIMPLEMENTED_I64_SHIFTOP(i64_sar)
 UNIMPLEMENTED_I64_SHIFTOP(i64_shr)
@@ -154,6 +170,8 @@ UNIMPLEMENTED_FP_BINOP(f32_add)
 UNIMPLEMENTED_FP_BINOP(f32_sub)
 UNIMPLEMENTED_FP_BINOP(f32_mul)
 UNIMPLEMENTED_FP_BINOP(f32_div)
+UNIMPLEMENTED_FP_BINOP(f32_min)
+UNIMPLEMENTED_FP_BINOP(f32_max)
 UNIMPLEMENTED_FP_UNOP(f32_abs)
 UNIMPLEMENTED_FP_UNOP(f32_neg)
 UNIMPLEMENTED_FP_UNOP(f32_ceil)
@@ -165,12 +183,14 @@ UNIMPLEMENTED_FP_BINOP(f64_add)
 UNIMPLEMENTED_FP_BINOP(f64_sub)
 UNIMPLEMENTED_FP_BINOP(f64_mul)
 UNIMPLEMENTED_FP_BINOP(f64_div)
+UNIMPLEMENTED_FP_BINOP(f64_min)
+UNIMPLEMENTED_FP_BINOP(f64_max)
 UNIMPLEMENTED_FP_UNOP(f64_abs)
 UNIMPLEMENTED_FP_UNOP(f64_neg)
-UNIMPLEMENTED_FP_UNOP(f64_ceil)
-UNIMPLEMENTED_FP_UNOP(f64_floor)
-UNIMPLEMENTED_FP_UNOP(f64_trunc)
-UNIMPLEMENTED_FP_UNOP(f64_nearest_int)
+UNIMPLEMENTED_FP_UNOP_RETURN_TRUE(f64_ceil)
+UNIMPLEMENTED_FP_UNOP_RETURN_TRUE(f64_floor)
+UNIMPLEMENTED_FP_UNOP_RETURN_TRUE(f64_trunc)
+UNIMPLEMENTED_FP_UNOP_RETURN_TRUE(f64_nearest_int)
 UNIMPLEMENTED_FP_UNOP(f64_sqrt)
 
 #undef UNIMPLEMENTED_GP_BINOP
@@ -178,12 +198,63 @@ UNIMPLEMENTED_FP_UNOP(f64_sqrt)
 #undef UNIMPLEMENTED_GP_UNOP
 #undef UNIMPLEMENTED_FP_BINOP
 #undef UNIMPLEMENTED_FP_UNOP
+#undef UNIMPLEMENTED_FP_UNOP_RETURN_TRUE
 #undef UNIMPLEMENTED_I32_SHIFTOP
 #undef UNIMPLEMENTED_I64_SHIFTOP
 
+void LiftoffAssembler::emit_i32_divs(Register dst, Register lhs, Register rhs,
+                                     Label* trap_div_by_zero,
+                                     Label* trap_div_unrepresentable) {
+  BAILOUT("i32_divs");
+}
+
+void LiftoffAssembler::emit_i32_divu(Register dst, Register lhs, Register rhs,
+                                     Label* trap_div_by_zero) {
+  BAILOUT("i32_divu");
+}
+
+void LiftoffAssembler::emit_i32_rems(Register dst, Register lhs, Register rhs,
+                                     Label* trap_div_by_zero) {
+  BAILOUT("i32_rems");
+}
+
+void LiftoffAssembler::emit_i32_remu(Register dst, Register lhs, Register rhs,
+                                     Label* trap_div_by_zero) {
+  BAILOUT("i32_remu");
+}
+
+bool LiftoffAssembler::emit_i64_divs(LiftoffRegister dst, LiftoffRegister lhs,
+                                     LiftoffRegister rhs,
+                                     Label* trap_div_by_zero,
+                                     Label* trap_div_unrepresentable) {
+  return false;
+}
+
+bool LiftoffAssembler::emit_i64_divu(LiftoffRegister dst, LiftoffRegister lhs,
+                                     LiftoffRegister rhs,
+                                     Label* trap_div_by_zero) {
+  return false;
+}
+
+bool LiftoffAssembler::emit_i64_rems(LiftoffRegister dst, LiftoffRegister lhs,
+                                     LiftoffRegister rhs,
+                                     Label* trap_div_by_zero) {
+  return false;
+}
+
+bool LiftoffAssembler::emit_i64_remu(LiftoffRegister dst, LiftoffRegister lhs,
+                                     LiftoffRegister rhs,
+                                     Label* trap_div_by_zero) {
+  return false;
+}
+
+void LiftoffAssembler::emit_i32_to_intptr(Register dst, Register src) {
+  UNREACHABLE();
+}
+
 bool LiftoffAssembler::emit_type_conversion(WasmOpcode opcode,
                                             LiftoffRegister dst,
-                                            LiftoffRegister src) {
+                                            LiftoffRegister src, Label* trap) {
   BAILOUT("emit_type_conversion");
   return true;
 }
@@ -229,7 +300,9 @@ void LiftoffAssembler::emit_f64_set_cond(Condition cond, Register dst,
   BAILOUT("emit_f64_set_cond");
 }
 
-void LiftoffAssembler::StackCheck(Label* ool_code) { BAILOUT("StackCheck"); }
+void LiftoffAssembler::StackCheck(Label* ool_code, Register limit_address) {
+  BAILOUT("StackCheck");
+}
 
 void LiftoffAssembler::CallTrapCallbackForTesting() {
   BAILOUT("CallTrapCallbackForTesting");
@@ -239,17 +312,6 @@ void LiftoffAssembler::AssertUnreachable(AbortReason reason) {
   BAILOUT("AssertUnreachable");
 }
 
-void LiftoffAssembler::PushCallerFrameSlot(const VarState& src,
-                                           uint32_t src_index,
-                                           RegPairHalf half) {
-  BAILOUT("PushCallerFrameSlot");
-}
-
-void LiftoffAssembler::PushCallerFrameSlot(LiftoffRegister reg,
-                                           ValueType type) {
-  BAILOUT("PushCallerFrameSlot reg");
-}
-
 void LiftoffAssembler::PushRegisters(LiftoffRegList regs) {
   BAILOUT("PushRegisters");
 }
@@ -262,48 +324,28 @@ void LiftoffAssembler::DropStackSlotsAndRet(uint32_t num_stack_slots) {
   BAILOUT("DropStackSlotsAndRet");
 }
 
-void LiftoffAssembler::PrepareCCall(wasm::FunctionSig* sig,
-                                    const LiftoffRegister* args,
-                                    ValueType out_argument_type) {
-  BAILOUT("PrepareCCall");
-}
-
-void LiftoffAssembler::SetCCallRegParamAddr(Register dst, int param_byte_offset,
-                                            ValueType type) {
-  BAILOUT("SetCCallRegParamAddr");
-}
-
-void LiftoffAssembler::SetCCallStackParamAddr(int stack_param_idx,
-                                              int param_byte_offset,
-                                              ValueType type) {
-  BAILOUT("SetCCallStackParamAddr");
-}
-
-void LiftoffAssembler::LoadCCallOutArgument(LiftoffRegister dst, ValueType type,
-                                            int param_byte_offset) {
-  BAILOUT("LoadCCallOutArgument");
-}
-
-void LiftoffAssembler::CallC(ExternalReference ext_ref, uint32_t num_params) {
+void LiftoffAssembler::CallC(wasm::FunctionSig* sig,
+                             const LiftoffRegister* args,
+                             const LiftoffRegister* rets,
+                             ValueType out_argument_type, int stack_bytes,
+                             ExternalReference ext_ref) {
   BAILOUT("CallC");
 }
 
-void LiftoffAssembler::FinishCCall() { BAILOUT("FinishCCall"); }
-
 void LiftoffAssembler::CallNativeWasmCode(Address addr) {
   BAILOUT("CallNativeWasmCode");
 }
 
-void LiftoffAssembler::CallRuntime(Zone* zone, Runtime::FunctionId fid) {
-  BAILOUT("CallRuntime");
-}
-
 void LiftoffAssembler::CallIndirect(wasm::FunctionSig* sig,
                                     compiler::CallDescriptor* call_descriptor,
                                     Register target) {
   BAILOUT("CallIndirect");
 }
 
+void LiftoffAssembler::CallRuntimeStub(WasmCode::RuntimeStubId sid) {
+  BAILOUT("CallRuntimeStub");
+}
+
 void LiftoffAssembler::AllocateStackSlot(Register addr, uint32_t size) {
   BAILOUT("AllocateStackSlot");
 }
@@ -312,6 +354,10 @@ void LiftoffAssembler::DeallocateStackSlot(uint32_t size) {
   BAILOUT("DeallocateStackSlot");
 }
 
+void LiftoffStackSlots::Construct() {
+  asm_->BAILOUT("LiftoffStackSlots::Construct");
+}
+
 }  // namespace wasm
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/src/wasm/baseline/arm64/liftoff-assembler-arm64.h b/deps/v8/src/wasm/baseline/arm64/liftoff-assembler-arm64.h
index c997e9706d8cd6..a8928210bb0c18 100644
--- a/deps/v8/src/wasm/baseline/arm64/liftoff-assembler-arm64.h
+++ b/deps/v8/src/wasm/baseline/arm64/liftoff-assembler-arm64.h
@@ -13,306 +13,965 @@ namespace v8 {
 namespace internal {
 namespace wasm {
 
-uint32_t LiftoffAssembler::PrepareStackFrame() {
-  BAILOUT("PrepareStackFrame");
-  return 0;
+namespace liftoff {
+
+// Liftoff Frames.
+//
+//  slot      Frame
+//       +--------------------+---------------------------
+//  n+4  | optional padding slot to keep the stack 16 byte aligned.
+//  n+3  |   parameter n      |
+//  ...  |       ...          |
+//   4   |   parameter 1      | or parameter 2
+//   3   |   parameter 0      | or parameter 1
+//   2   |  (result address)  | or parameter 0
+//  -----+--------------------+---------------------------
+//   1   | return addr (lr)   |
+//   0   | previous frame (fp)|
+//  -----+--------------------+  <-- frame ptr (fp)
+//  -1   | 0xa: WASM_COMPILED |
+//  -2   |     instance       |
+//  -----+--------------------+---------------------------
+//  -3   |     slot 0         |   ^
+//  -4   |     slot 1         |   |
+//       |                    | Frame slots
+//       |                    |   |
+//       |                    |   v
+//       | optional padding slot to keep the stack 16 byte aligned.
+//  -----+--------------------+  <-- stack ptr (sp)
+//
+
+constexpr int32_t kInstanceOffset = 2 * kPointerSize;
+constexpr int32_t kFirstStackSlotOffset = kInstanceOffset + kPointerSize;
+constexpr int32_t kConstantStackSpace = 0;
+
+inline MemOperand GetStackSlot(uint32_t index) {
+  int32_t offset =
+      kFirstStackSlotOffset + index * LiftoffAssembler::kStackSlotSize;
+  return MemOperand(fp, -offset);
+}
+
+inline MemOperand GetInstanceOperand() {
+  return MemOperand(fp, -kInstanceOffset);
+}
+
+inline CPURegister GetRegFromType(const LiftoffRegister& reg, ValueType type) {
+  switch (type) {
+    case kWasmI32:
+      return reg.gp().W();
+    case kWasmI64:
+      return reg.gp().X();
+    case kWasmF32:
+      return reg.fp().S();
+    case kWasmF64:
+      return reg.fp().D();
+    default:
+      UNREACHABLE();
+  }
+}
+
+inline CPURegList PadRegList(RegList list) {
+  if ((base::bits::CountPopulation(list) & 1) != 0) list |= padreg.bit();
+  return CPURegList(CPURegister::kRegister, kXRegSizeInBits, list);
+}
+
+inline CPURegList PadVRegList(RegList list) {
+  if ((base::bits::CountPopulation(list) & 1) != 0) list |= fp_scratch.bit();
+  return CPURegList(CPURegister::kVRegister, kDRegSizeInBits, list);
+}
+
+inline CPURegister AcquireByType(UseScratchRegisterScope* temps,
+                                 ValueType type) {
+  switch (type) {
+    case kWasmI32:
+      return temps->AcquireW();
+    case kWasmI64:
+      return temps->AcquireX();
+    case kWasmF32:
+      return temps->AcquireS();
+    case kWasmF64:
+      return temps->AcquireD();
+    default:
+      UNREACHABLE();
+  }
+}
+
+inline MemOperand GetMemOp(LiftoffAssembler* assm,
+                           UseScratchRegisterScope* temps, Register addr,
+                           Register offset, uint32_t offset_imm) {
+  // Wasm memory is limited to a size <2GB, so all offsets can be encoded as
+  // immediate value (in 31 bits, interpreted as signed value).
+  // If the offset is bigger, we always trap and this code is not reached.
+  DCHECK(is_uint31(offset_imm));
+  if (offset.IsValid()) {
+    if (offset_imm == 0) return MemOperand(addr.X(), offset.W(), UXTW);
+    Register tmp = temps->AcquireW();
+    assm->Add(tmp, offset.W(), offset_imm);
+    return MemOperand(addr.X(), tmp, UXTW);
+  }
+  return MemOperand(addr.X(), offset_imm);
+}
+
+}  // namespace liftoff
+
+int LiftoffAssembler::PrepareStackFrame() {
+  int offset = pc_offset();
+  InstructionAccurateScope scope(this, 1);
+  sub(sp, sp, 0);
+  return offset;
 }
 
-void LiftoffAssembler::PatchPrepareStackFrame(uint32_t offset,
+void LiftoffAssembler::PatchPrepareStackFrame(int offset,
                                               uint32_t stack_slots) {
-  BAILOUT("PatchPrepareStackFrame");
+  static_assert(kStackSlotSize == kXRegSize,
+                "kStackSlotSize must equal kXRegSize");
+  uint32_t bytes = liftoff::kConstantStackSpace + kStackSlotSize * stack_slots;
+  // The stack pointer is required to be quadword aligned.
+  // Misalignment will cause a stack alignment fault.
+  bytes = RoundUp(bytes, kQuadWordSizeInBytes);
+  if (!IsImmAddSub(bytes)) {
+    // Round the stack to a page to try to fit a add/sub immediate.
+    bytes = RoundUp(bytes, 0x1000);
+    if (!IsImmAddSub(bytes)) {
+      // Stack greater than 4M! Because this is a quite improbable case, we
+      // just fallback to Turbofan.
+      BAILOUT("Stack too big");
+      return;
+    }
+  }
+#ifdef USE_SIMULATOR
+  // When using the simulator, deal with Liftoff which allocates the stack
+  // before checking it.
+  // TODO(arm): Remove this when the stack check mechanism will be updated.
+  if (bytes > KB / 2) {
+    BAILOUT("Stack limited to 512 bytes to avoid a bug in StackCheck");
+    return;
+  }
+#endif
+  PatchingAssembler patching_assembler(AssemblerOptions{}, buffer_ + offset, 1);
+  patching_assembler.PatchSubSp(bytes);
 }
 
+void LiftoffAssembler::FinishCode() { CheckConstPool(true, false); }
+
+void LiftoffAssembler::AbortCompilation() { AbortedCodeGeneration(); }
+
 void LiftoffAssembler::LoadConstant(LiftoffRegister reg, WasmValue value,
                                     RelocInfo::Mode rmode) {
-  BAILOUT("LoadConstant");
+  switch (value.type()) {
+    case kWasmI32:
+      Mov(reg.gp().W(), Immediate(value.to_i32(), rmode));
+      break;
+    case kWasmI64:
+      Mov(reg.gp().X(), Immediate(value.to_i64(), rmode));
+      break;
+    case kWasmF32:
+      Fmov(reg.fp().S(), value.to_f32_boxed().get_scalar());
+      break;
+    case kWasmF64:
+      Fmov(reg.fp().D(), value.to_f64_boxed().get_scalar());
+      break;
+    default:
+      UNREACHABLE();
+  }
 }
 
 void LiftoffAssembler::LoadFromInstance(Register dst, uint32_t offset,
                                         int size) {
-  BAILOUT("LoadFromInstance");
+  DCHECK_LE(offset, kMaxInt);
+  Ldr(dst, liftoff::GetInstanceOperand());
+  DCHECK(size == 4 || size == 8);
+  if (size == 4) {
+    Ldr(dst.W(), MemOperand(dst, offset));
+  } else {
+    Ldr(dst, MemOperand(dst, offset));
+  }
 }
 
 void LiftoffAssembler::SpillInstance(Register instance) {
-  BAILOUT("SpillInstance");
+  Str(instance, liftoff::GetInstanceOperand());
 }
 
 void LiftoffAssembler::FillInstanceInto(Register dst) {
-  BAILOUT("FillInstanceInto");
+  Ldr(dst, liftoff::GetInstanceOperand());
 }
 
 void LiftoffAssembler::Load(LiftoffRegister dst, Register src_addr,
                             Register offset_reg, uint32_t offset_imm,
                             LoadType type, LiftoffRegList pinned,
-                            uint32_t* protected_load_pc) {
-  BAILOUT("Load");
+                            uint32_t* protected_load_pc, bool is_load_mem) {
+  UseScratchRegisterScope temps(this);
+  MemOperand src_op =
+      liftoff::GetMemOp(this, &temps, src_addr, offset_reg, offset_imm);
+  if (protected_load_pc) *protected_load_pc = pc_offset();
+  switch (type.value()) {
+    case LoadType::kI32Load8U:
+    case LoadType::kI64Load8U:
+      Ldrb(dst.gp().W(), src_op);
+      break;
+    case LoadType::kI32Load8S:
+      Ldrsb(dst.gp().W(), src_op);
+      break;
+    case LoadType::kI64Load8S:
+      Ldrsb(dst.gp().X(), src_op);
+      break;
+    case LoadType::kI32Load16U:
+    case LoadType::kI64Load16U:
+      Ldrh(dst.gp().W(), src_op);
+      break;
+    case LoadType::kI32Load16S:
+      Ldrsh(dst.gp().W(), src_op);
+      break;
+    case LoadType::kI64Load16S:
+      Ldrsh(dst.gp().X(), src_op);
+      break;
+    case LoadType::kI32Load:
+    case LoadType::kI64Load32U:
+      Ldr(dst.gp().W(), src_op);
+      break;
+    case LoadType::kI64Load32S:
+      Ldrsw(dst.gp().X(), src_op);
+      break;
+    case LoadType::kI64Load:
+      Ldr(dst.gp().X(), src_op);
+      break;
+    case LoadType::kF32Load:
+      Ldr(dst.fp().S(), src_op);
+      break;
+    case LoadType::kF64Load:
+      Ldr(dst.fp().D(), src_op);
+      break;
+    default:
+      UNREACHABLE();
+  }
 }
 
 void LiftoffAssembler::Store(Register dst_addr, Register offset_reg,
                              uint32_t offset_imm, LiftoffRegister src,
                              StoreType type, LiftoffRegList pinned,
-                             uint32_t* protected_store_pc) {
-  BAILOUT("Store");
+                             uint32_t* protected_store_pc, bool is_store_mem) {
+  UseScratchRegisterScope temps(this);
+  MemOperand dst_op =
+      liftoff::GetMemOp(this, &temps, dst_addr, offset_reg, offset_imm);
+  if (protected_store_pc) *protected_store_pc = pc_offset();
+  switch (type.value()) {
+    case StoreType::kI32Store8:
+    case StoreType::kI64Store8:
+      Strb(src.gp().W(), dst_op);
+      break;
+    case StoreType::kI32Store16:
+    case StoreType::kI64Store16:
+      Strh(src.gp().W(), dst_op);
+      break;
+    case StoreType::kI32Store:
+    case StoreType::kI64Store32:
+      Str(src.gp().W(), dst_op);
+      break;
+    case StoreType::kI64Store:
+      Str(src.gp().X(), dst_op);
+      break;
+    case StoreType::kF32Store:
+      Str(src.fp().S(), dst_op);
+      break;
+    case StoreType::kF64Store:
+      Str(src.fp().D(), dst_op);
+      break;
+    default:
+      UNREACHABLE();
+  }
+}
+
+void LiftoffAssembler::ChangeEndiannessLoad(LiftoffRegister dst, LoadType type,
+                                            LiftoffRegList pinned) {
+  // Nop.
+}
+
+void LiftoffAssembler::ChangeEndiannessStore(LiftoffRegister src,
+                                             StoreType type,
+                                             LiftoffRegList pinned) {
+  // Nop.
 }
 
 void LiftoffAssembler::LoadCallerFrameSlot(LiftoffRegister dst,
                                            uint32_t caller_slot_idx,
                                            ValueType type) {
-  BAILOUT("LoadCallerFrameSlot");
+  int32_t offset = (caller_slot_idx + 1) * LiftoffAssembler::kStackSlotSize;
+  Ldr(liftoff::GetRegFromType(dst, type), MemOperand(fp, offset));
 }
 
 void LiftoffAssembler::MoveStackValue(uint32_t dst_index, uint32_t src_index,
                                       ValueType type) {
-  BAILOUT("MoveStackValue");
-}
-
-void LiftoffAssembler::MoveToReturnRegister(LiftoffRegister reg,
-                                            ValueType type) {
-  BAILOUT("MoveToReturnRegister");
+  UseScratchRegisterScope temps(this);
+  CPURegister scratch = liftoff::AcquireByType(&temps, type);
+  Ldr(scratch, liftoff::GetStackSlot(src_index));
+  Str(scratch, liftoff::GetStackSlot(dst_index));
 }
 
 void LiftoffAssembler::Move(Register dst, Register src, ValueType type) {
-  BAILOUT("Move Register");
+  if (type == kWasmI32) {
+    Mov(dst.W(), src.W());
+  } else {
+    DCHECK_EQ(kWasmI64, type);
+    Mov(dst.X(), src.X());
+  }
 }
 
 void LiftoffAssembler::Move(DoubleRegister dst, DoubleRegister src,
                             ValueType type) {
-  BAILOUT("Move DoubleRegister");
+  if (type == kWasmF32) {
+    Fmov(dst.S(), src.S());
+  } else {
+    DCHECK_EQ(kWasmF64, type);
+    Fmov(dst.D(), src.D());
+  }
 }
 
 void LiftoffAssembler::Spill(uint32_t index, LiftoffRegister reg,
                              ValueType type) {
-  BAILOUT("Spill register");
+  RecordUsedSpillSlot(index);
+  MemOperand dst = liftoff::GetStackSlot(index);
+  Str(liftoff::GetRegFromType(reg, type), dst);
 }
 
 void LiftoffAssembler::Spill(uint32_t index, WasmValue value) {
-  BAILOUT("Spill value");
+  RecordUsedSpillSlot(index);
+  MemOperand dst = liftoff::GetStackSlot(index);
+  UseScratchRegisterScope temps(this);
+  CPURegister src = CPURegister::no_reg();
+  switch (value.type()) {
+    case kWasmI32:
+      src = temps.AcquireW();
+      Mov(src.W(), value.to_i32());
+      break;
+    case kWasmI64:
+      src = temps.AcquireX();
+      Mov(src.X(), value.to_i64());
+      break;
+    default:
+      // We do not track f32 and f64 constants, hence they are unreachable.
+      UNREACHABLE();
+  }
+  Str(src, dst);
 }
 
 void LiftoffAssembler::Fill(LiftoffRegister reg, uint32_t index,
                             ValueType type) {
-  BAILOUT("Fill");
+  MemOperand src = liftoff::GetStackSlot(index);
+  Ldr(liftoff::GetRegFromType(reg, type), src);
 }
 
 void LiftoffAssembler::FillI64Half(Register, uint32_t half_index) {
-  BAILOUT("FillI64Half");
+  UNREACHABLE();
 }
 
-#define UNIMPLEMENTED_GP_BINOP(name)                             \
+#define I32_BINOP(name, instruction)                             \
   void LiftoffAssembler::emit_##name(Register dst, Register lhs, \
                                      Register rhs) {             \
-    BAILOUT("gp binop: " #name);                                 \
+    instruction(dst.W(), lhs.W(), rhs.W());                      \
   }
-#define UNIMPLEMENTED_I64_BINOP(name)                                          \
+#define I64_BINOP(name, instruction)                                           \
   void LiftoffAssembler::emit_##name(LiftoffRegister dst, LiftoffRegister lhs, \
                                      LiftoffRegister rhs) {                    \
-    BAILOUT("i64 binop: " #name);                                              \
+    instruction(dst.gp().X(), lhs.gp().X(), rhs.gp().X());                     \
+  }
+#define FP32_BINOP(name, instruction)                                        \
+  void LiftoffAssembler::emit_##name(DoubleRegister dst, DoubleRegister lhs, \
+                                     DoubleRegister rhs) {                   \
+    instruction(dst.S(), lhs.S(), rhs.S());                                  \
   }
-#define UNIMPLEMENTED_GP_UNOP(name)                                \
-  bool LiftoffAssembler::emit_##name(Register dst, Register src) { \
-    BAILOUT("gp unop: " #name);                                    \
-    return true;                                                   \
+#define FP32_UNOP(name, instruction)                                           \
+  void LiftoffAssembler::emit_##name(DoubleRegister dst, DoubleRegister src) { \
+    instruction(dst.S(), src.S());                                             \
   }
-#define UNIMPLEMENTED_FP_BINOP(name)                                         \
+#define FP64_BINOP(name, instruction)                                        \
   void LiftoffAssembler::emit_##name(DoubleRegister dst, DoubleRegister lhs, \
                                      DoubleRegister rhs) {                   \
-    BAILOUT("fp binop: " #name);                                             \
+    instruction(dst.D(), lhs.D(), rhs.D());                                  \
   }
-#define UNIMPLEMENTED_FP_UNOP(name)                                            \
+#define FP64_UNOP(name, instruction)                                           \
   void LiftoffAssembler::emit_##name(DoubleRegister dst, DoubleRegister src) { \
-    BAILOUT("fp unop: " #name);                                                \
+    instruction(dst.D(), src.D());                                             \
+  }
+#define FP64_UNOP_RETURN_TRUE(name, instruction)                               \
+  bool LiftoffAssembler::emit_##name(DoubleRegister dst, DoubleRegister src) { \
+    instruction(dst.D(), src.D());                                             \
+    return true;                                                               \
   }
-#define UNIMPLEMENTED_I32_SHIFTOP(name)                                        \
+#define I32_SHIFTOP(name, instruction)                                         \
   void LiftoffAssembler::emit_##name(Register dst, Register src,               \
                                      Register amount, LiftoffRegList pinned) { \
-    BAILOUT("i32 shiftop: " #name);                                            \
+    instruction(dst.W(), src.W(), amount.W());                                 \
   }
-#define UNIMPLEMENTED_I64_SHIFTOP(name)                                        \
+#define I64_SHIFTOP(name, instruction)                                         \
   void LiftoffAssembler::emit_##name(LiftoffRegister dst, LiftoffRegister src, \
                                      Register amount, LiftoffRegList pinned) { \
-    BAILOUT("i64 shiftop: " #name);                                            \
-  }
-
-UNIMPLEMENTED_GP_BINOP(i32_add)
-UNIMPLEMENTED_GP_BINOP(i32_sub)
-UNIMPLEMENTED_GP_BINOP(i32_mul)
-UNIMPLEMENTED_GP_BINOP(i32_and)
-UNIMPLEMENTED_GP_BINOP(i32_or)
-UNIMPLEMENTED_GP_BINOP(i32_xor)
-UNIMPLEMENTED_I32_SHIFTOP(i32_shl)
-UNIMPLEMENTED_I32_SHIFTOP(i32_sar)
-UNIMPLEMENTED_I32_SHIFTOP(i32_shr)
-UNIMPLEMENTED_I64_BINOP(i64_add)
-UNIMPLEMENTED_I64_BINOP(i64_sub)
-UNIMPLEMENTED_I64_BINOP(i64_and)
-UNIMPLEMENTED_I64_BINOP(i64_or)
-UNIMPLEMENTED_I64_BINOP(i64_xor)
-UNIMPLEMENTED_I64_SHIFTOP(i64_shl)
-UNIMPLEMENTED_I64_SHIFTOP(i64_sar)
-UNIMPLEMENTED_I64_SHIFTOP(i64_shr)
-UNIMPLEMENTED_GP_UNOP(i32_clz)
-UNIMPLEMENTED_GP_UNOP(i32_ctz)
-UNIMPLEMENTED_GP_UNOP(i32_popcnt)
-UNIMPLEMENTED_FP_BINOP(f32_add)
-UNIMPLEMENTED_FP_BINOP(f32_sub)
-UNIMPLEMENTED_FP_BINOP(f32_mul)
-UNIMPLEMENTED_FP_BINOP(f32_div)
-UNIMPLEMENTED_FP_UNOP(f32_abs)
-UNIMPLEMENTED_FP_UNOP(f32_neg)
-UNIMPLEMENTED_FP_UNOP(f32_ceil)
-UNIMPLEMENTED_FP_UNOP(f32_floor)
-UNIMPLEMENTED_FP_UNOP(f32_trunc)
-UNIMPLEMENTED_FP_UNOP(f32_nearest_int)
-UNIMPLEMENTED_FP_UNOP(f32_sqrt)
-UNIMPLEMENTED_FP_BINOP(f64_add)
-UNIMPLEMENTED_FP_BINOP(f64_sub)
-UNIMPLEMENTED_FP_BINOP(f64_mul)
-UNIMPLEMENTED_FP_BINOP(f64_div)
-UNIMPLEMENTED_FP_UNOP(f64_abs)
-UNIMPLEMENTED_FP_UNOP(f64_neg)
-UNIMPLEMENTED_FP_UNOP(f64_ceil)
-UNIMPLEMENTED_FP_UNOP(f64_floor)
-UNIMPLEMENTED_FP_UNOP(f64_trunc)
-UNIMPLEMENTED_FP_UNOP(f64_nearest_int)
-UNIMPLEMENTED_FP_UNOP(f64_sqrt)
-
-#undef UNIMPLEMENTED_GP_BINOP
-#undef UNIMPLEMENTED_I64_BINOP
-#undef UNIMPLEMENTED_GP_UNOP
-#undef UNIMPLEMENTED_FP_BINOP
-#undef UNIMPLEMENTED_FP_UNOP
-#undef UNIMPLEMENTED_I32_SHIFTOP
-#undef UNIMPLEMENTED_I64_SHIFTOP
+    instruction(dst.gp().X(), src.gp().X(), amount.X());                       \
+  }
+
+I32_BINOP(i32_add, Add)
+I32_BINOP(i32_sub, Sub)
+I32_BINOP(i32_mul, Mul)
+I32_BINOP(i32_and, And)
+I32_BINOP(i32_or, Orr)
+I32_BINOP(i32_xor, Eor)
+I32_SHIFTOP(i32_shl, Lsl)
+I32_SHIFTOP(i32_sar, Asr)
+I32_SHIFTOP(i32_shr, Lsr)
+I64_BINOP(i64_add, Add)
+I64_BINOP(i64_sub, Sub)
+I64_BINOP(i64_mul, Mul)
+I64_BINOP(i64_and, And)
+I64_BINOP(i64_or, Orr)
+I64_BINOP(i64_xor, Eor)
+I64_SHIFTOP(i64_shl, Lsl)
+I64_SHIFTOP(i64_sar, Asr)
+I64_SHIFTOP(i64_shr, Lsr)
+FP32_BINOP(f32_add, Fadd)
+FP32_BINOP(f32_sub, Fsub)
+FP32_BINOP(f32_mul, Fmul)
+FP32_BINOP(f32_div, Fdiv)
+FP32_BINOP(f32_min, Fmin)
+FP32_BINOP(f32_max, Fmax)
+FP32_UNOP(f32_abs, Fabs)
+FP32_UNOP(f32_neg, Fneg)
+FP32_UNOP(f32_ceil, Frintp)
+FP32_UNOP(f32_floor, Frintm)
+FP32_UNOP(f32_trunc, Frintz)
+FP32_UNOP(f32_nearest_int, Frintn)
+FP32_UNOP(f32_sqrt, Fsqrt)
+FP64_BINOP(f64_add, Fadd)
+FP64_BINOP(f64_sub, Fsub)
+FP64_BINOP(f64_mul, Fmul)
+FP64_BINOP(f64_div, Fdiv)
+FP64_BINOP(f64_min, Fmin)
+FP64_BINOP(f64_max, Fmax)
+FP64_UNOP(f64_abs, Fabs)
+FP64_UNOP(f64_neg, Fneg)
+FP64_UNOP_RETURN_TRUE(f64_ceil, Frintp)
+FP64_UNOP_RETURN_TRUE(f64_floor, Frintm)
+FP64_UNOP_RETURN_TRUE(f64_trunc, Frintz)
+FP64_UNOP_RETURN_TRUE(f64_nearest_int, Frintn)
+FP64_UNOP(f64_sqrt, Fsqrt)
+
+#undef I32_BINOP
+#undef I64_BINOP
+#undef FP32_BINOP
+#undef FP32_UNOP
+#undef FP64_BINOP
+#undef FP64_UNOP
+#undef FP64_UNOP_RETURN_TRUE
+#undef I32_SHIFTOP
+#undef I64_SHIFTOP
+
+bool LiftoffAssembler::emit_i32_clz(Register dst, Register src) {
+  Clz(dst.W(), src.W());
+  return true;
+}
+
+bool LiftoffAssembler::emit_i32_ctz(Register dst, Register src) {
+  Rbit(dst.W(), src.W());
+  Clz(dst.W(), dst.W());
+  return true;
+}
+
+bool LiftoffAssembler::emit_i32_popcnt(Register dst, Register src) {
+  UseScratchRegisterScope temps(this);
+  VRegister scratch = temps.AcquireV(kFormat8B);
+  Fmov(scratch.S(), src.W());
+  Cnt(scratch, scratch);
+  Addv(scratch.B(), scratch);
+  Fmov(dst.W(), scratch.S());
+  return true;
+}
+
+void LiftoffAssembler::emit_i32_divs(Register dst, Register lhs, Register rhs,
+                                     Label* trap_div_by_zero,
+                                     Label* trap_div_unrepresentable) {
+  Register dst_w = dst.W();
+  Register lhs_w = lhs.W();
+  Register rhs_w = rhs.W();
+  bool can_use_dst = !dst_w.Aliases(lhs_w) && !dst_w.Aliases(rhs_w);
+  if (can_use_dst) {
+    // Do div early.
+    Sdiv(dst_w, lhs_w, rhs_w);
+  }
+  // Check for division by zero.
+  Cbz(rhs_w, trap_div_by_zero);
+  // Check for kMinInt / -1. This is unrepresentable.
+  Cmp(rhs_w, -1);
+  Ccmp(lhs_w, 1, NoFlag, eq);
+  B(trap_div_unrepresentable, vs);
+  if (!can_use_dst) {
+    // Do div.
+    Sdiv(dst_w, lhs_w, rhs_w);
+  }
+}
+
+void LiftoffAssembler::emit_i32_divu(Register dst, Register lhs, Register rhs,
+                                     Label* trap_div_by_zero) {
+  // Check for division by zero.
+  Cbz(rhs.W(), trap_div_by_zero);
+  // Do div.
+  Udiv(dst.W(), lhs.W(), rhs.W());
+}
+
+void LiftoffAssembler::emit_i32_rems(Register dst, Register lhs, Register rhs,
+                                     Label* trap_div_by_zero) {
+  Register dst_w = dst.W();
+  Register lhs_w = lhs.W();
+  Register rhs_w = rhs.W();
+  // Do early div.
+  // No need to check kMinInt / -1 because the result is kMinInt and then
+  // kMinInt * -1 -> kMinInt. In this case, the Msub result is therefore 0.
+  UseScratchRegisterScope temps(this);
+  Register scratch = temps.AcquireW();
+  Sdiv(scratch, lhs_w, rhs_w);
+  // Check for division by zero.
+  Cbz(rhs_w, trap_div_by_zero);
+  // Compute remainder.
+  Msub(dst_w, scratch, rhs_w, lhs_w);
+}
+
+void LiftoffAssembler::emit_i32_remu(Register dst, Register lhs, Register rhs,
+                                     Label* trap_div_by_zero) {
+  Register dst_w = dst.W();
+  Register lhs_w = lhs.W();
+  Register rhs_w = rhs.W();
+  // Do early div.
+  UseScratchRegisterScope temps(this);
+  Register scratch = temps.AcquireW();
+  Udiv(scratch, lhs_w, rhs_w);
+  // Check for division by zero.
+  Cbz(rhs_w, trap_div_by_zero);
+  // Compute remainder.
+  Msub(dst_w, scratch, rhs_w, lhs_w);
+}
+
+bool LiftoffAssembler::emit_i64_divs(LiftoffRegister dst, LiftoffRegister lhs,
+                                     LiftoffRegister rhs,
+                                     Label* trap_div_by_zero,
+                                     Label* trap_div_unrepresentable) {
+  Register dst_x = dst.gp().X();
+  Register lhs_x = lhs.gp().X();
+  Register rhs_x = rhs.gp().X();
+  bool can_use_dst = !dst_x.Aliases(lhs_x) && !dst_x.Aliases(rhs_x);
+  if (can_use_dst) {
+    // Do div early.
+    Sdiv(dst_x, lhs_x, rhs_x);
+  }
+  // Check for division by zero.
+  Cbz(rhs_x, trap_div_by_zero);
+  // Check for kMinInt / -1. This is unrepresentable.
+  Cmp(rhs_x, -1);
+  Ccmp(lhs_x, 1, NoFlag, eq);
+  B(trap_div_unrepresentable, vs);
+  if (!can_use_dst) {
+    // Do div.
+    Sdiv(dst_x, lhs_x, rhs_x);
+  }
+  return true;
+}
+
+bool LiftoffAssembler::emit_i64_divu(LiftoffRegister dst, LiftoffRegister lhs,
+                                     LiftoffRegister rhs,
+                                     Label* trap_div_by_zero) {
+  // Check for division by zero.
+  Cbz(rhs.gp().X(), trap_div_by_zero);
+  // Do div.
+  Udiv(dst.gp().X(), lhs.gp().X(), rhs.gp().X());
+  return true;
+}
+
+bool LiftoffAssembler::emit_i64_rems(LiftoffRegister dst, LiftoffRegister lhs,
+                                     LiftoffRegister rhs,
+                                     Label* trap_div_by_zero) {
+  Register dst_x = dst.gp().X();
+  Register lhs_x = lhs.gp().X();
+  Register rhs_x = rhs.gp().X();
+  // Do early div.
+  // No need to check kMinInt / -1 because the result is kMinInt and then
+  // kMinInt * -1 -> kMinInt. In this case, the Msub result is therefore 0.
+  UseScratchRegisterScope temps(this);
+  Register scratch = temps.AcquireX();
+  Sdiv(scratch, lhs_x, rhs_x);
+  // Check for division by zero.
+  Cbz(rhs_x, trap_div_by_zero);
+  // Compute remainder.
+  Msub(dst_x, scratch, rhs_x, lhs_x);
+  return true;
+}
+
+bool LiftoffAssembler::emit_i64_remu(LiftoffRegister dst, LiftoffRegister lhs,
+                                     LiftoffRegister rhs,
+                                     Label* trap_div_by_zero) {
+  Register dst_x = dst.gp().X();
+  Register lhs_x = lhs.gp().X();
+  Register rhs_x = rhs.gp().X();
+  // Do early div.
+  UseScratchRegisterScope temps(this);
+  Register scratch = temps.AcquireX();
+  Udiv(scratch, lhs_x, rhs_x);
+  // Check for division by zero.
+  Cbz(rhs_x, trap_div_by_zero);
+  // Compute remainder.
+  Msub(dst_x, scratch, rhs_x, lhs_x);
+  return true;
+}
+
+void LiftoffAssembler::emit_i32_to_intptr(Register dst, Register src) {
+  Sxtw(dst, src);
+}
 
 bool LiftoffAssembler::emit_type_conversion(WasmOpcode opcode,
                                             LiftoffRegister dst,
-                                            LiftoffRegister src) {
-  BAILOUT("emit_type_conversion");
-  return true;
+                                            LiftoffRegister src, Label* trap) {
+  switch (opcode) {
+    case kExprI32ConvertI64:
+      if (src != dst) Mov(dst.gp().W(), src.gp().W());
+      return true;
+    case kExprI32SConvertF32:
+      Fcvtzs(dst.gp().W(), src.fp().S());  // f32 -> i32 round to zero.
+      // Check underflow and NaN.
+      Fcmp(src.fp().S(), static_cast<float>(INT32_MIN));
+      // Check overflow.
+      Ccmp(dst.gp().W(), -1, VFlag, ge);
+      B(trap, vs);
+      return true;
+    case kExprI32UConvertF32:
+      Fcvtzu(dst.gp().W(), src.fp().S());  // f32 -> i32 round to zero.
+      // Check underflow and NaN.
+      Fcmp(src.fp().S(), -1.0);
+      // Check overflow.
+      Ccmp(dst.gp().W(), -1, ZFlag, gt);
+      B(trap, eq);
+      return true;
+    case kExprI32SConvertF64: {
+      // INT32_MIN and INT32_MAX are valid results, we cannot test the result
+      // to detect the overflows. We could have done two immediate floating
+      // point comparisons but it would have generated two conditional branches.
+      UseScratchRegisterScope temps(this);
+      VRegister fp_ref = temps.AcquireD();
+      VRegister fp_cmp = temps.AcquireD();
+      Fcvtzs(dst.gp().W(), src.fp().D());  // f64 -> i32 round to zero.
+      Frintz(fp_ref, src.fp().D());        // f64 -> f64 round to zero.
+      Scvtf(fp_cmp, dst.gp().W());         // i32 -> f64.
+      // If comparison fails, we have an overflow or a NaN.
+      Fcmp(fp_cmp, fp_ref);
+      B(trap, ne);
+      return true;
+    }
+    case kExprI32UConvertF64: {
+      // INT32_MAX is a valid result, we cannot test the result to detect the
+      // overflows. We could have done two immediate floating point comparisons
+      // but it would have generated two conditional branches.
+      UseScratchRegisterScope temps(this);
+      VRegister fp_ref = temps.AcquireD();
+      VRegister fp_cmp = temps.AcquireD();
+      Fcvtzu(dst.gp().W(), src.fp().D());  // f64 -> i32 round to zero.
+      Frintz(fp_ref, src.fp().D());        // f64 -> f64 round to zero.
+      Ucvtf(fp_cmp, dst.gp().W());         // i32 -> f64.
+      // If comparison fails, we have an overflow or a NaN.
+      Fcmp(fp_cmp, fp_ref);
+      B(trap, ne);
+      return true;
+    }
+    case kExprI32ReinterpretF32:
+      Fmov(dst.gp().W(), src.fp().S());
+      return true;
+    case kExprI64SConvertI32:
+      Sxtw(dst.gp().X(), src.gp().W());
+      return true;
+    case kExprI64SConvertF32:
+      Fcvtzs(dst.gp().X(), src.fp().S());  // f32 -> i64 round to zero.
+      // Check underflow and NaN.
+      Fcmp(src.fp().S(), static_cast<float>(INT64_MIN));
+      // Check overflow.
+      Ccmp(dst.gp().X(), -1, VFlag, ge);
+      B(trap, vs);
+      return true;
+    case kExprI64UConvertF32:
+      Fcvtzu(dst.gp().X(), src.fp().S());  // f32 -> i64 round to zero.
+      // Check underflow and NaN.
+      Fcmp(src.fp().S(), -1.0);
+      // Check overflow.
+      Ccmp(dst.gp().X(), -1, ZFlag, gt);
+      B(trap, eq);
+      return true;
+    case kExprI64SConvertF64:
+      Fcvtzs(dst.gp().X(), src.fp().D());  // f64 -> i64 round to zero.
+      // Check underflow and NaN.
+      Fcmp(src.fp().D(), static_cast<float>(INT64_MIN));
+      // Check overflow.
+      Ccmp(dst.gp().X(), -1, VFlag, ge);
+      B(trap, vs);
+      return true;
+    case kExprI64UConvertF64:
+      Fcvtzu(dst.gp().X(), src.fp().D());  // f64 -> i64 round to zero.
+      // Check underflow and NaN.
+      Fcmp(src.fp().D(), -1.0);
+      // Check overflow.
+      Ccmp(dst.gp().X(), -1, ZFlag, gt);
+      B(trap, eq);
+      return true;
+    case kExprI64UConvertI32:
+      Mov(dst.gp().W(), src.gp().W());
+      return true;
+    case kExprI64ReinterpretF64:
+      Fmov(dst.gp().X(), src.fp().D());
+      return true;
+    case kExprF32SConvertI32:
+      Scvtf(dst.fp().S(), src.gp().W());
+      return true;
+    case kExprF32UConvertI32:
+      Ucvtf(dst.fp().S(), src.gp().W());
+      return true;
+    case kExprF32SConvertI64:
+      Scvtf(dst.fp().S(), src.gp().X());
+      return true;
+    case kExprF32UConvertI64:
+      Ucvtf(dst.fp().S(), src.gp().X());
+      return true;
+    case kExprF32ConvertF64:
+      Fcvt(dst.fp().S(), src.fp().D());
+      return true;
+    case kExprF32ReinterpretI32:
+      Fmov(dst.fp().S(), src.gp().W());
+      return true;
+    case kExprF64SConvertI32:
+      Scvtf(dst.fp().D(), src.gp().W());
+      return true;
+    case kExprF64UConvertI32:
+      Ucvtf(dst.fp().D(), src.gp().W());
+      return true;
+    case kExprF64SConvertI64:
+      Scvtf(dst.fp().D(), src.gp().X());
+      return true;
+    case kExprF64UConvertI64:
+      Ucvtf(dst.fp().D(), src.gp().X());
+      return true;
+    case kExprF64ConvertF32:
+      Fcvt(dst.fp().D(), src.fp().S());
+      return true;
+    case kExprF64ReinterpretI64:
+      Fmov(dst.fp().D(), src.gp().X());
+      return true;
+    default:
+      UNREACHABLE();
+  }
 }
 
-void LiftoffAssembler::emit_jump(Label* label) { BAILOUT("emit_jump"); }
+void LiftoffAssembler::emit_jump(Label* label) { B(label); }
 
-void LiftoffAssembler::emit_jump(Register target) { BAILOUT("emit_jump"); }
+void LiftoffAssembler::emit_jump(Register target) { Br(target); }
 
 void LiftoffAssembler::emit_cond_jump(Condition cond, Label* label,
                                       ValueType type, Register lhs,
                                       Register rhs) {
-  BAILOUT("emit_cond_jump");
+  switch (type) {
+    case kWasmI32:
+      if (rhs.IsValid()) {
+        Cmp(lhs.W(), rhs.W());
+      } else {
+        Cmp(lhs.W(), wzr);
+      }
+      break;
+    case kWasmI64:
+      if (rhs.IsValid()) {
+        Cmp(lhs.X(), rhs.X());
+      } else {
+        Cmp(lhs.X(), xzr);
+      }
+      break;
+    default:
+      UNREACHABLE();
+  }
+  B(label, cond);
 }
 
 void LiftoffAssembler::emit_i32_eqz(Register dst, Register src) {
-  BAILOUT("emit_i32_eqz");
+  Cmp(src.W(), wzr);
+  Cset(dst.W(), eq);
 }
 
 void LiftoffAssembler::emit_i32_set_cond(Condition cond, Register dst,
                                          Register lhs, Register rhs) {
-  BAILOUT("emit_i32_set_cond");
+  Cmp(lhs.W(), rhs.W());
+  Cset(dst.W(), cond);
 }
 
 void LiftoffAssembler::emit_i64_eqz(Register dst, LiftoffRegister src) {
-  BAILOUT("emit_i64_eqz");
+  Cmp(src.gp().X(), xzr);
+  Cset(dst.W(), eq);
 }
 
 void LiftoffAssembler::emit_i64_set_cond(Condition cond, Register dst,
                                          LiftoffRegister lhs,
                                          LiftoffRegister rhs) {
-  BAILOUT("emit_i64_set_cond");
+  Cmp(lhs.gp().X(), rhs.gp().X());
+  Cset(dst.W(), cond);
 }
 
 void LiftoffAssembler::emit_f32_set_cond(Condition cond, Register dst,
                                          DoubleRegister lhs,
                                          DoubleRegister rhs) {
-  BAILOUT("emit_f32_set_cond");
+  Fcmp(lhs.S(), rhs.S());
+  Cset(dst.W(), cond);
+  if (cond != ne) {
+    // If V flag set, at least one of the arguments was a Nan -> false.
+    Csel(dst.W(), wzr, dst.W(), vs);
+  }
 }
 
 void LiftoffAssembler::emit_f64_set_cond(Condition cond, Register dst,
                                          DoubleRegister lhs,
                                          DoubleRegister rhs) {
-  BAILOUT("emit_f64_set_cond");
+  Fcmp(lhs.D(), rhs.D());
+  Cset(dst.W(), cond);
+  if (cond != ne) {
+    // If V flag set, at least one of the arguments was a Nan -> false.
+    Csel(dst.W(), wzr, dst.W(), vs);
+  }
 }
 
-void LiftoffAssembler::StackCheck(Label* ool_code) { BAILOUT("StackCheck"); }
+void LiftoffAssembler::StackCheck(Label* ool_code, Register limit_address) {
+  Ldr(limit_address, MemOperand(limit_address));
+  Cmp(sp, limit_address);
+  B(ool_code, ls);
+}
 
 void LiftoffAssembler::CallTrapCallbackForTesting() {
-  BAILOUT("CallTrapCallbackForTesting");
+  CallCFunction(ExternalReference::wasm_call_trap_callback_for_testing(), 0);
 }
 
 void LiftoffAssembler::AssertUnreachable(AbortReason reason) {
-  BAILOUT("AssertUnreachable");
-}
-
-void LiftoffAssembler::PushCallerFrameSlot(const VarState& src,
-                                           uint32_t src_index,
-                                           RegPairHalf half) {
-  BAILOUT("PushCallerFrameSlot");
-}
-
-void LiftoffAssembler::PushCallerFrameSlot(LiftoffRegister reg,
-                                           ValueType type) {
-  BAILOUT("PushCallerFrameSlot reg");
+  TurboAssembler::AssertUnreachable(reason);
 }
 
 void LiftoffAssembler::PushRegisters(LiftoffRegList regs) {
-  BAILOUT("PushRegisters");
+  PushCPURegList(liftoff::PadRegList(regs.GetGpList()));
+  PushCPURegList(liftoff::PadVRegList(regs.GetFpList()));
 }
 
 void LiftoffAssembler::PopRegisters(LiftoffRegList regs) {
-  BAILOUT("PopRegisters");
+  PopCPURegList(liftoff::PadVRegList(regs.GetFpList()));
+  PopCPURegList(liftoff::PadRegList(regs.GetGpList()));
 }
 
 void LiftoffAssembler::DropStackSlotsAndRet(uint32_t num_stack_slots) {
-  BAILOUT("DropStackSlotsAndRet");
-}
-
-void LiftoffAssembler::PrepareCCall(wasm::FunctionSig* sig,
-                                    const LiftoffRegister* args,
-                                    ValueType out_argument_type) {
-  BAILOUT("PrepareCCall");
-}
-
-void LiftoffAssembler::SetCCallRegParamAddr(Register dst, int param_byte_offset,
-                                            ValueType type) {
-  BAILOUT("SetCCallRegParamAddr");
-}
-
-void LiftoffAssembler::SetCCallStackParamAddr(int stack_param_idx,
-                                              int param_byte_offset,
-                                              ValueType type) {
-  BAILOUT("SetCCallStackParamAddr");
-}
+  DropSlots(num_stack_slots);
+  Ret();
+}
+
+void LiftoffAssembler::CallC(wasm::FunctionSig* sig,
+                             const LiftoffRegister* args,
+                             const LiftoffRegister* rets,
+                             ValueType out_argument_type, int stack_bytes,
+                             ExternalReference ext_ref) {
+  // The stack pointer is required to be quadword aligned.
+  int total_size = RoundUp(stack_bytes, kQuadWordSizeInBytes);
+  // Reserve space in the stack.
+  Claim(total_size, 1);
+
+  int arg_bytes = 0;
+  for (ValueType param_type : sig->parameters()) {
+    Poke(liftoff::GetRegFromType(*args++, param_type), arg_bytes);
+    arg_bytes += ValueTypes::MemSize(param_type);
+  }
+  DCHECK_LE(arg_bytes, stack_bytes);
+
+  // Pass a pointer to the buffer with the arguments to the C function.
+  Mov(x0, sp);
+
+  // Now call the C function.
+  constexpr int kNumCCallArgs = 1;
+  CallCFunction(ext_ref, kNumCCallArgs);
+
+  // Move return value to the right register.
+  const LiftoffRegister* next_result_reg = rets;
+  if (sig->return_count() > 0) {
+    DCHECK_EQ(1, sig->return_count());
+    constexpr Register kReturnReg = x0;
+    if (kReturnReg != next_result_reg->gp()) {
+      Move(*next_result_reg, LiftoffRegister(kReturnReg), sig->GetReturn(0));
+    }
+    ++next_result_reg;
+  }
 
-void LiftoffAssembler::LoadCCallOutArgument(LiftoffRegister dst, ValueType type,
-                                            int param_byte_offset) {
-  BAILOUT("LoadCCallOutArgument");
-}
+  // Load potential output value from the buffer on the stack.
+  if (out_argument_type != kWasmStmt) {
+    Peek(liftoff::GetRegFromType(*next_result_reg, out_argument_type), 0);
+  }
 
-void LiftoffAssembler::CallC(ExternalReference ext_ref, uint32_t num_params) {
-  BAILOUT("CallC");
+  Drop(total_size, 1);
 }
 
-void LiftoffAssembler::FinishCCall() { BAILOUT("FinishCCall"); }
-
 void LiftoffAssembler::CallNativeWasmCode(Address addr) {
-  BAILOUT("CallNativeWasmCode");
-}
-
-void LiftoffAssembler::CallRuntime(Zone* zone, Runtime::FunctionId fid) {
-  BAILOUT("CallRuntime");
+  Call(addr, RelocInfo::WASM_CALL);
 }
 
 void LiftoffAssembler::CallIndirect(wasm::FunctionSig* sig,
                                     compiler::CallDescriptor* call_descriptor,
                                     Register target) {
-  BAILOUT("CallIndirect");
+  // For Arm64, we have more cache registers than wasm parameters. That means
+  // that target will always be in a register.
+  DCHECK(target.IsValid());
+  Call(target);
+}
+
+void LiftoffAssembler::CallRuntimeStub(WasmCode::RuntimeStubId sid) {
+  // A direct call to a wasm runtime stub defined in this module.
+  // Just encode the stub index. This will be patched at relocation.
+  Call(static_cast<Address>(sid), RelocInfo::WASM_STUB_CALL);
 }
 
 void LiftoffAssembler::AllocateStackSlot(Register addr, uint32_t size) {
-  BAILOUT("AllocateStackSlot");
+  // The stack pointer is required to be quadword aligned.
+  size = RoundUp(size, kQuadWordSizeInBytes);
+  Claim(size, 1);
+  Mov(addr, sp);
 }
 
 void LiftoffAssembler::DeallocateStackSlot(uint32_t size) {
-  BAILOUT("DeallocateStackSlot");
+  // The stack pointer is required to be quadword aligned.
+  size = RoundUp(size, kQuadWordSizeInBytes);
+  Drop(size, 1);
+}
+
+void LiftoffStackSlots::Construct() {
+  size_t slot_count = slots_.size();
+  // The stack pointer is required to be quadword aligned.
+  asm_->Claim(RoundUp(slot_count, 2));
+  size_t slot_index = 0;
+  for (auto& slot : slots_) {
+    size_t poke_offset = (slot_count - slot_index - 1) * kXRegSize;
+    switch (slot.src_.loc()) {
+      case LiftoffAssembler::VarState::kStack: {
+        UseScratchRegisterScope temps(asm_);
+        CPURegister scratch = liftoff::AcquireByType(&temps, slot.src_.type());
+        asm_->Ldr(scratch, liftoff::GetStackSlot(slot.src_index_));
+        asm_->Poke(scratch, poke_offset);
+        break;
+      }
+      case LiftoffAssembler::VarState::kRegister:
+        asm_->Poke(liftoff::GetRegFromType(slot.src_.reg(), slot.src_.type()),
+                   poke_offset);
+        break;
+      case LiftoffAssembler::VarState::KIntConst:
+        DCHECK(slot.src_.type() == kWasmI32 || slot.src_.type() == kWasmI64);
+        if (slot.src_.i32_const() == 0) {
+          Register zero_reg = slot.src_.type() == kWasmI32 ? wzr : xzr;
+          asm_->Poke(zero_reg, poke_offset);
+        } else {
+          UseScratchRegisterScope temps(asm_);
+          Register scratch = slot.src_.type() == kWasmI32 ? temps.AcquireW()
+                                                          : temps.AcquireX();
+          asm_->Mov(scratch, int64_t{slot.src_.i32_const()});
+          asm_->Poke(scratch, poke_offset);
+        }
+        break;
+    }
+    slot_index++;
+  }
 }
 
 }  // namespace wasm
diff --git a/deps/v8/src/wasm/baseline/ia32/liftoff-assembler-ia32.h b/deps/v8/src/wasm/baseline/ia32/liftoff-assembler-ia32.h
index 82b8e7e81680f9..ae8c9e012f0b68 100644
--- a/deps/v8/src/wasm/baseline/ia32/liftoff-assembler-ia32.h
+++ b/deps/v8/src/wasm/baseline/ia32/liftoff-assembler-ia32.h
@@ -8,14 +8,17 @@
 #include "src/wasm/baseline/liftoff-assembler.h"
 
 #include "src/assembler.h"
-#include "src/wasm/wasm-opcodes.h"
+#include "src/wasm/value-type.h"
 
 namespace v8 {
 namespace internal {
 namespace wasm {
 
-#define REQUIRE_CPU_FEATURE(name)                                   \
-  if (!CpuFeatures::IsSupported(name)) return bailout("no " #name); \
+#define REQUIRE_CPU_FEATURE(name, ...)   \
+  if (!CpuFeatures::IsSupported(name)) { \
+    bailout("no " #name);                \
+    return __VA_ARGS__;                  \
+  }                                      \
   CpuFeatureScope feature(this, name);
 
 namespace liftoff {
@@ -45,17 +48,17 @@ static_assert(kByteRegs.GetNumRegsSet() == 4, "should have four byte regs");
 static_assert((kByteRegs & kGpCacheRegList) == kByteRegs,
               "kByteRegs only contains gp cache registers");
 
-// Use this register to store the address of the last argument pushed on the
-// stack for a call to C. This register must be callee saved according to the c
-// calling convention.
-static constexpr Register kCCallLastArgAddrReg = ebx;
-
-inline void Load(LiftoffAssembler* assm, LiftoffRegister dst, Operand src,
-                 ValueType type) {
+inline void Load(LiftoffAssembler* assm, LiftoffRegister dst, Register base,
+                 int32_t offset, ValueType type) {
+  Operand src(base, offset);
   switch (type) {
     case kWasmI32:
       assm->mov(dst.gp(), src);
       break;
+    case kWasmI64:
+      assm->mov(dst.low_gp(), src);
+      assm->mov(dst.high_gp(), Operand(base, offset + 4));
+      break;
     case kWasmF32:
       assm->movss(dst.fp(), src);
       break;
@@ -67,6 +70,28 @@ inline void Load(LiftoffAssembler* assm, LiftoffRegister dst, Operand src,
   }
 }
 
+inline void Store(LiftoffAssembler* assm, Register base, int32_t offset,
+                  LiftoffRegister src, ValueType type) {
+  Operand dst(base, offset);
+  switch (type) {
+    case kWasmI32:
+      assm->mov(dst, src.gp());
+      break;
+    case kWasmI64:
+      assm->mov(dst, src.low_gp());
+      assm->mov(Operand(base, offset + 4), src.high_gp());
+      break;
+    case kWasmF32:
+      assm->movss(dst, src.fp());
+      break;
+    case kWasmF64:
+      assm->movsd(dst, src.fp());
+      break;
+    default:
+      UNREACHABLE();
+  }
+}
+
 inline void push(LiftoffAssembler* assm, LiftoffRegister reg, ValueType type) {
   switch (type) {
     case kWasmI32:
@@ -89,34 +114,75 @@ inline void push(LiftoffAssembler* assm, LiftoffRegister reg, ValueType type) {
   }
 }
 
-}  // namespace liftoff
+template <typename... Regs>
+inline void SpillRegisters(LiftoffAssembler* assm, Regs... regs) {
+  for (LiftoffRegister r : {LiftoffRegister(regs)...}) {
+    if (assm->cache_state()->is_used(r)) assm->SpillRegister(r);
+  }
+}
 
-static constexpr DoubleRegister kScratchDoubleReg = xmm7;
+constexpr DoubleRegister kScratchDoubleReg = xmm7;
 
-uint32_t LiftoffAssembler::PrepareStackFrame() {
-  uint32_t offset = static_cast<uint32_t>(pc_offset());
+constexpr int kSubSpSize = 6;  // 6 bytes for "sub esp, <imm32>"
+
+}  // namespace liftoff
+
+int LiftoffAssembler::PrepareStackFrame() {
+  int offset = pc_offset();
   sub_sp_32(0);
+  DCHECK_EQ(liftoff::kSubSpSize, pc_offset() - offset);
   return offset;
 }
 
-void LiftoffAssembler::PatchPrepareStackFrame(uint32_t offset,
+void LiftoffAssembler::PatchPrepareStackFrame(int offset,
                                               uint32_t stack_slots) {
   uint32_t bytes = liftoff::kConstantStackSpace + kStackSlotSize * stack_slots;
   DCHECK_LE(bytes, kMaxInt);
   // We can't run out of space, just pass anything big enough to not cause the
   // assembler to try to grow the buffer.
   constexpr int kAvailableSpace = 64;
-  Assembler patching_assembler(isolate(), buffer_ + offset, kAvailableSpace);
+  Assembler patching_assembler(AssemblerOptions{}, buffer_ + offset,
+                               kAvailableSpace);
+#if V8_OS_WIN
+  constexpr int kPageSize = 4 * 1024;
+  if (bytes > kPageSize) {
+    // Generate OOL code (at the end of the function, where the current
+    // assembler is pointing) to do the explicit stack limit check (see
+    // https://docs.microsoft.com/en-us/previous-versions/visualstudio/
+    // visual-studio-6.0/aa227153(v=vs.60)).
+    // At the function start, emit a jump to that OOL code (from {offset} to
+    // {pc_offset()}).
+    int ool_offset = pc_offset() - offset;
+    patching_assembler.jmp_rel(ool_offset);
+    DCHECK_GE(liftoff::kSubSpSize, patching_assembler.pc_offset());
+    patching_assembler.Nop(liftoff::kSubSpSize -
+                           patching_assembler.pc_offset());
+
+    // Now generate the OOL code.
+    // Use {edi} as scratch register; it is not being used as parameter
+    // register (see wasm-linkage.h).
+    mov(edi, bytes);
+    AllocateStackFrame(edi);
+    // Jump back to the start of the function (from {pc_offset()} to {offset +
+    // kSubSpSize}).
+    int func_start_offset = offset + liftoff::kSubSpSize - pc_offset();
+    jmp_rel(func_start_offset);
+    return;
+  }
+#endif
   patching_assembler.sub_sp_32(bytes);
+  DCHECK_EQ(liftoff::kSubSpSize, patching_assembler.pc_offset());
 }
 
+void LiftoffAssembler::FinishCode() {}
+
+void LiftoffAssembler::AbortCompilation() {}
+
 void LiftoffAssembler::LoadConstant(LiftoffRegister reg, WasmValue value,
                                     RelocInfo::Mode rmode) {
   switch (value.type()) {
     case kWasmI32:
-      TurboAssembler::Move(
-          reg.gp(),
-          Immediate(reinterpret_cast<Address>(value.to_i32()), rmode));
+      TurboAssembler::Move(reg.gp(), Immediate(value.to_i32(), rmode));
       break;
     case kWasmI64: {
       DCHECK(RelocInfo::IsNone(rmode));
@@ -156,7 +222,7 @@ void LiftoffAssembler::FillInstanceInto(Register dst) {
 void LiftoffAssembler::Load(LiftoffRegister dst, Register src_addr,
                             Register offset_reg, uint32_t offset_imm,
                             LoadType type, LiftoffRegList pinned,
-                            uint32_t* protected_load_pc) {
+                            uint32_t* protected_load_pc, bool is_load_mem) {
   DCHECK_EQ(type.value_type() == kWasmI64, dst.is_pair());
   // Wasm memory is limited to a size <2GB, so all offsets can be encoded as
   // immediate value (in 31 bits, interpreted as signed value).
@@ -237,7 +303,7 @@ void LiftoffAssembler::Load(LiftoffRegister dst, Register src_addr,
 void LiftoffAssembler::Store(Register dst_addr, Register offset_reg,
                              uint32_t offset_imm, LiftoffRegister src,
                              StoreType type, LiftoffRegList pinned,
-                             uint32_t* protected_store_pc) {
+                             uint32_t* protected_store_pc, bool is_store_mem) {
   DCHECK_EQ(type.value_type() == kWasmI64, src.is_pair());
   // Wasm memory is limited to a size <2GB, so all offsets can be encoded as
   // immediate value (in 31 bits, interpreted as signed value).
@@ -298,11 +364,21 @@ void LiftoffAssembler::Store(Register dst_addr, Register offset_reg,
   }
 }
 
+void LiftoffAssembler::ChangeEndiannessLoad(LiftoffRegister dst, LoadType type,
+                                            LiftoffRegList pinned) {
+  // Nop.
+}
+
+void LiftoffAssembler::ChangeEndiannessStore(LiftoffRegister src,
+                                             StoreType type,
+                                             LiftoffRegList pinned) {
+  // Nop.
+}
+
 void LiftoffAssembler::LoadCallerFrameSlot(LiftoffRegister dst,
                                            uint32_t caller_slot_idx,
                                            ValueType type) {
-  Operand src(ebp, kPointerSize * (caller_slot_idx + 1));
-  liftoff::Load(this, dst, src, type);
+  liftoff::Load(this, dst, ebp, kPointerSize * (caller_slot_idx + 1), type);
 }
 
 void LiftoffAssembler::MoveStackValue(uint32_t dst_index, uint32_t src_index,
@@ -318,16 +394,6 @@ void LiftoffAssembler::MoveStackValue(uint32_t dst_index, uint32_t src_index,
   }
 }
 
-void LiftoffAssembler::MoveToReturnRegister(LiftoffRegister reg,
-                                            ValueType type) {
-  // TODO(wasm): Extract the destination register from the CallDescriptor.
-  // TODO(wasm): Add multi-return support.
-  LiftoffRegister dst = reg.is_pair() ? LiftoffRegister::ForPair(eax, edx)
-                                      : reg.is_gp() ? LiftoffRegister(eax)
-                                                    : LiftoffRegister(xmm1);
-  if (reg != dst) Move(dst, reg, type);
-}
-
 void LiftoffAssembler::Move(Register dst, Register src, ValueType type) {
   DCHECK_NE(dst, src);
   DCHECK_EQ(kWasmI32, type);
@@ -432,25 +498,126 @@ void LiftoffAssembler::emit_i32_sub(Register dst, Register lhs, Register rhs) {
   }
 }
 
-#define COMMUTATIVE_I32_BINOP(name, instruction)                     \
-  void LiftoffAssembler::emit_i32_##name(Register dst, Register lhs, \
-                                         Register rhs) {             \
-    if (dst == rhs) {                                                \
-      instruction(dst, lhs);                                         \
-    } else {                                                         \
-      if (dst != lhs) mov(dst, lhs);                                 \
-      instruction(dst, rhs);                                         \
-    }                                                                \
+namespace liftoff {
+template <void (Assembler::*op)(Register, Register)>
+void EmitCommutativeBinOp(LiftoffAssembler* assm, Register dst, Register lhs,
+                          Register rhs) {
+  if (dst == rhs) {
+    (assm->*op)(dst, lhs);
+  } else {
+    if (dst != lhs) assm->mov(dst, lhs);
+    (assm->*op)(dst, rhs);
+  }
+}
+}  // namespace liftoff
+
+void LiftoffAssembler::emit_i32_mul(Register dst, Register lhs, Register rhs) {
+  liftoff::EmitCommutativeBinOp<&Assembler::imul>(this, dst, lhs, rhs);
+}
+
+namespace liftoff {
+enum class DivOrRem : uint8_t { kDiv, kRem };
+template <bool is_signed, DivOrRem div_or_rem>
+void EmitInt32DivOrRem(LiftoffAssembler* assm, Register dst, Register lhs,
+                       Register rhs, Label* trap_div_by_zero,
+                       Label* trap_div_unrepresentable) {
+  constexpr bool needs_unrepresentable_check =
+      is_signed && div_or_rem == DivOrRem::kDiv;
+  constexpr bool special_case_minus_1 =
+      is_signed && div_or_rem == DivOrRem::kRem;
+  DCHECK_EQ(needs_unrepresentable_check, trap_div_unrepresentable != nullptr);
+
+  // For division, the lhs is always taken from {edx:eax}. Thus, make sure that
+  // these registers are unused. If {rhs} is stored in one of them, move it to
+  // another temporary register.
+  // Do all this before any branch, such that the code is executed
+  // unconditionally, as the cache state will also be modified unconditionally.
+  liftoff::SpillRegisters(assm, eax, edx);
+  if (rhs == eax || rhs == edx) {
+    LiftoffRegList unavailable = LiftoffRegList::ForRegs(eax, edx, lhs);
+    Register tmp = assm->GetUnusedRegister(kGpReg, unavailable).gp();
+    assm->mov(tmp, rhs);
+    rhs = tmp;
+  }
+
+  // Check for division by zero.
+  assm->test(rhs, rhs);
+  assm->j(zero, trap_div_by_zero);
+
+  Label done;
+  if (needs_unrepresentable_check) {
+    // Check for {kMinInt / -1}. This is unrepresentable.
+    Label do_div;
+    assm->cmp(rhs, -1);
+    assm->j(not_equal, &do_div);
+    assm->cmp(lhs, kMinInt);
+    assm->j(equal, trap_div_unrepresentable);
+    assm->bind(&do_div);
+  } else if (special_case_minus_1) {
+    // {lhs % -1} is always 0 (needs to be special cased because {kMinInt / -1}
+    // cannot be computed).
+    Label do_rem;
+    assm->cmp(rhs, -1);
+    assm->j(not_equal, &do_rem);
+    assm->xor_(dst, dst);
+    assm->jmp(&done);
+    assm->bind(&do_rem);
+  }
+
+  // Now move {lhs} into {eax}, then zero-extend or sign-extend into {edx}, then
+  // do the division.
+  if (lhs != eax) assm->mov(eax, lhs);
+  if (is_signed) {
+    assm->cdq();
+    assm->idiv(rhs);
+  } else {
+    assm->xor_(edx, edx);
+    assm->div(rhs);
   }
 
-// clang-format off
-COMMUTATIVE_I32_BINOP(mul, imul)
-COMMUTATIVE_I32_BINOP(and, and_)
-COMMUTATIVE_I32_BINOP(or, or_)
-COMMUTATIVE_I32_BINOP(xor, xor_)
-// clang-format on
+  // Move back the result (in {eax} or {edx}) into the {dst} register.
+  constexpr Register kResultReg = div_or_rem == DivOrRem::kDiv ? eax : edx;
+  if (dst != kResultReg) assm->mov(dst, kResultReg);
+  if (special_case_minus_1) assm->bind(&done);
+}
+}  // namespace liftoff
+
+void LiftoffAssembler::emit_i32_divs(Register dst, Register lhs, Register rhs,
+                                     Label* trap_div_by_zero,
+                                     Label* trap_div_unrepresentable) {
+  liftoff::EmitInt32DivOrRem<true, liftoff::DivOrRem::kDiv>(
+      this, dst, lhs, rhs, trap_div_by_zero, trap_div_unrepresentable);
+}
+
+void LiftoffAssembler::emit_i32_divu(Register dst, Register lhs, Register rhs,
+                                     Label* trap_div_by_zero) {
+  liftoff::EmitInt32DivOrRem<false, liftoff::DivOrRem::kDiv>(
+      this, dst, lhs, rhs, trap_div_by_zero, nullptr);
+}
 
-#undef COMMUTATIVE_I32_BINOP
+void LiftoffAssembler::emit_i32_rems(Register dst, Register lhs, Register rhs,
+                                     Label* trap_div_by_zero) {
+  liftoff::EmitInt32DivOrRem<true, liftoff::DivOrRem::kRem>(
+      this, dst, lhs, rhs, trap_div_by_zero, nullptr);
+}
+
+void LiftoffAssembler::emit_i32_remu(Register dst, Register lhs, Register rhs,
+                                     Label* trap_div_by_zero) {
+  liftoff::EmitInt32DivOrRem<false, liftoff::DivOrRem::kRem>(
+      this, dst, lhs, rhs, trap_div_by_zero, nullptr);
+}
+
+void LiftoffAssembler::emit_i32_and(Register dst, Register lhs, Register rhs) {
+  liftoff::EmitCommutativeBinOp<&Assembler::and_>(this, dst, lhs, rhs);
+}
+
+void LiftoffAssembler::emit_i32_or(Register dst, Register lhs, Register rhs) {
+  liftoff::EmitCommutativeBinOp<&Assembler::or_>(this, dst, lhs, rhs);
+}
+
+void LiftoffAssembler::emit_i32_xor(Register dst, Register lhs, Register rhs) {
+  liftoff::EmitCommutativeBinOp<&Assembler::xor_>(this, dst, lhs, rhs);
+}
 
 namespace liftoff {
 inline void EmitShiftOperation(LiftoffAssembler* assm, Register dst,
@@ -592,6 +759,71 @@ void LiftoffAssembler::emit_i64_sub(LiftoffRegister dst, LiftoffRegister lhs,
   liftoff::OpWithCarry<&Assembler::sub, &Assembler::sbb>(this, dst, lhs, rhs);
 }
 
+void LiftoffAssembler::emit_i64_mul(LiftoffRegister dst, LiftoffRegister lhs,
+                                    LiftoffRegister rhs) {
+  // Idea:
+  //        [           lhs_hi  |           lhs_lo  ] * [  rhs_hi  |  rhs_lo  ]
+  //    =   [  lhs_hi * rhs_lo  |                   ]  (32 bit mul, shift 32)
+  //      + [  lhs_lo * rhs_hi  |                   ]  (32 bit mul, shift 32)
+  //      + [             lhs_lo * rhs_lo           ]  (32x32->64 mul, shift 0)
+
+  // For simplicity, we move lhs and rhs into fixed registers.
+  Register dst_hi = edx;
+  Register dst_lo = eax;
+  Register lhs_hi = ecx;
+  Register lhs_lo = dst_lo;
+  Register rhs_hi = dst_hi;
+  Register rhs_lo = ebx;
+
+  // Spill all these registers if they are still holding other values.
+  liftoff::SpillRegisters(this, dst_hi, dst_lo, lhs_hi, rhs_lo);
+
+  // Move lhs and rhs into the respective registers.
+  ParallelRegisterMove(
+      {{LiftoffRegister::ForPair(lhs_lo, lhs_hi), lhs, kWasmI64},
+       {LiftoffRegister::ForPair(rhs_lo, rhs_hi), rhs, kWasmI64}});
+
+  // First mul: lhs_hi' = lhs_hi * rhs_lo.
+  imul(lhs_hi, rhs_lo);
+  // Second mul: rhi_hi' = rhs_hi * lhs_lo.
+  imul(rhs_hi, lhs_lo);
+  // Add them: lhs_hi'' = lhs_hi' + rhs_hi' = lhs_hi * rhs_lo + rhs_hi * lhs_lo.
+  add(lhs_hi, rhs_hi);
+  // Third mul: edx:eax (dst_hi:dst_lo) = eax * ebx (lhs_lo * rhs_lo).
+  mul(rhs_lo);
+  // Add lhs_hi'' to dst_hi.
+  add(dst_hi, lhs_hi);
+
+  // Finally, move back the temporary result to the actual dst register pair.
+  LiftoffRegister dst_tmp = LiftoffRegister::ForPair(dst_lo, dst_hi);
+  if (dst != dst_tmp) Move(dst, dst_tmp, kWasmI64);
+}
+
+bool LiftoffAssembler::emit_i64_divs(LiftoffRegister dst, LiftoffRegister lhs,
+                                     LiftoffRegister rhs,
+                                     Label* trap_div_by_zero,
+                                     Label* trap_div_unrepresentable) {
+  return false;
+}
+
+bool LiftoffAssembler::emit_i64_divu(LiftoffRegister dst, LiftoffRegister lhs,
+                                     LiftoffRegister rhs,
+                                     Label* trap_div_by_zero) {
+  return false;
+}
+
+bool LiftoffAssembler::emit_i64_rems(LiftoffRegister dst, LiftoffRegister lhs,
+                                     LiftoffRegister rhs,
+                                     Label* trap_div_by_zero) {
+  return false;
+}
+
+bool LiftoffAssembler::emit_i64_remu(LiftoffRegister dst, LiftoffRegister lhs,
+                                     LiftoffRegister rhs,
+                                     Label* trap_div_by_zero) {
+  return false;
+}
+
 namespace liftoff {
 inline bool PairContains(LiftoffRegister pair, Register reg) {
   return pair.low_gp() == reg || pair.high_gp() == reg;
@@ -660,6 +892,10 @@ void LiftoffAssembler::emit_i64_shr(LiftoffRegister dst, LiftoffRegister src,
                                    &TurboAssembler::ShrPair_cl, pinned);
 }
 
+void LiftoffAssembler::emit_i32_to_intptr(Register dst, Register src) {
+  UNREACHABLE();
+}
+
 void LiftoffAssembler::emit_f32_add(DoubleRegister dst, DoubleRegister lhs,
                                     DoubleRegister rhs) {
   if (CpuFeatures::IsSupported(AVX)) {
@@ -679,9 +915,9 @@ void LiftoffAssembler::emit_f32_sub(DoubleRegister dst, DoubleRegister lhs,
     CpuFeatureScope scope(this, AVX);
     vsubss(dst, lhs, rhs);
   } else if (dst == rhs) {
-    movss(kScratchDoubleReg, rhs);
+    movss(liftoff::kScratchDoubleReg, rhs);
     movss(dst, lhs);
-    subss(dst, kScratchDoubleReg);
+    subss(dst, liftoff::kScratchDoubleReg);
   } else {
     if (dst != lhs) movss(dst, lhs);
     subss(dst, rhs);
@@ -707,20 +943,93 @@ void LiftoffAssembler::emit_f32_div(DoubleRegister dst, DoubleRegister lhs,
     CpuFeatureScope scope(this, AVX);
     vdivss(dst, lhs, rhs);
   } else if (dst == rhs) {
-    movss(kScratchDoubleReg, rhs);
+    movss(liftoff::kScratchDoubleReg, rhs);
     movss(dst, lhs);
-    divss(dst, kScratchDoubleReg);
+    divss(dst, liftoff::kScratchDoubleReg);
   } else {
     if (dst != lhs) movss(dst, lhs);
     divss(dst, rhs);
   }
 }
 
+namespace liftoff {
+enum class MinOrMax : uint8_t { kMin, kMax };
+template <typename type>
+inline void EmitFloatMinOrMax(LiftoffAssembler* assm, DoubleRegister dst,
+                              DoubleRegister lhs, DoubleRegister rhs,
+                              MinOrMax min_or_max) {
+  Label is_nan;
+  Label lhs_below_rhs;
+  Label lhs_above_rhs;
+  Label done;
+
+  // We need one tmp register to extract the sign bit. Get it right at the
+  // beginning, such that the spilling code is not accidentially jumped over.
+  Register tmp = assm->GetUnusedRegister(kGpReg).gp();
+
+#define dop(name, ...)            \
+  do {                            \
+    if (sizeof(type) == 4) {      \
+      assm->name##s(__VA_ARGS__); \
+    } else {                      \
+      assm->name##d(__VA_ARGS__); \
+    }                             \
+  } while (false)
+
+  // Check the easy cases first: nan (e.g. unordered), smaller and greater.
+  // NaN has to be checked first, because PF=1 implies CF=1.
+  dop(ucomis, lhs, rhs);
+  assm->j(parity_even, &is_nan, Label::kNear);   // PF=1
+  assm->j(below, &lhs_below_rhs, Label::kNear);  // CF=1
+  assm->j(above, &lhs_above_rhs, Label::kNear);  // CF=0 && ZF=0
+
+  // If we get here, then either
+  // a) {lhs == rhs},
+  // b) {lhs == -0.0} and {rhs == 0.0}, or
+  // c) {lhs == 0.0} and {rhs == -0.0}.
+  // For a), it does not matter whether we return {lhs} or {rhs}. Check the sign
+  // bit of {rhs} to differentiate b) and c).
+  dop(movmskp, tmp, rhs);
+  assm->test(tmp, Immediate(1));
+  assm->j(zero, &lhs_below_rhs, Label::kNear);
+  assm->jmp(&lhs_above_rhs, Label::kNear);
+
+  assm->bind(&is_nan);
+  // Create a NaN output.
+  dop(xorp, dst, dst);
+  dop(divs, dst, dst);
+  assm->jmp(&done, Label::kNear);
+
+  assm->bind(&lhs_below_rhs);
+  DoubleRegister lhs_below_rhs_src = min_or_max == MinOrMax::kMin ? lhs : rhs;
+  if (dst != lhs_below_rhs_src) dop(movs, dst, lhs_below_rhs_src);
+  assm->jmp(&done, Label::kNear);
+
+  assm->bind(&lhs_above_rhs);
+  DoubleRegister lhs_above_rhs_src = min_or_max == MinOrMax::kMin ? rhs : lhs;
+  if (dst != lhs_above_rhs_src) dop(movs, dst, lhs_above_rhs_src);
+
+  assm->bind(&done);
+}
+}  // namespace liftoff
+
+void LiftoffAssembler::emit_f32_min(DoubleRegister dst, DoubleRegister lhs,
+                                    DoubleRegister rhs) {
+  liftoff::EmitFloatMinOrMax<float>(this, dst, lhs, rhs,
+                                    liftoff::MinOrMax::kMin);
+}
+
+void LiftoffAssembler::emit_f32_max(DoubleRegister dst, DoubleRegister lhs,
+                                    DoubleRegister rhs) {
+  liftoff::EmitFloatMinOrMax<float>(this, dst, lhs, rhs,
+                                    liftoff::MinOrMax::kMax);
+}
+
 void LiftoffAssembler::emit_f32_abs(DoubleRegister dst, DoubleRegister src) {
   static constexpr uint32_t kSignBit = uint32_t{1} << 31;
   if (dst == src) {
-    TurboAssembler::Move(kScratchDoubleReg, kSignBit - 1);
-    Andps(dst, kScratchDoubleReg);
+    TurboAssembler::Move(liftoff::kScratchDoubleReg, kSignBit - 1);
+    Andps(dst, liftoff::kScratchDoubleReg);
   } else {
     TurboAssembler::Move(dst, kSignBit - 1);
     Andps(dst, src);
@@ -730,8 +1039,8 @@ void LiftoffAssembler::emit_f32_abs(DoubleRegister dst, DoubleRegister src) {
 void LiftoffAssembler::emit_f32_neg(DoubleRegister dst, DoubleRegister src) {
   static constexpr uint32_t kSignBit = uint32_t{1} << 31;
   if (dst == src) {
-    TurboAssembler::Move(kScratchDoubleReg, kSignBit);
-    Xorps(dst, kScratchDoubleReg);
+    TurboAssembler::Move(liftoff::kScratchDoubleReg, kSignBit);
+    Xorps(dst, liftoff::kScratchDoubleReg);
   } else {
     TurboAssembler::Move(dst, kSignBit);
     Xorps(dst, src);
@@ -782,9 +1091,9 @@ void LiftoffAssembler::emit_f64_sub(DoubleRegister dst, DoubleRegister lhs,
     CpuFeatureScope scope(this, AVX);
     vsubsd(dst, lhs, rhs);
   } else if (dst == rhs) {
-    movsd(kScratchDoubleReg, rhs);
+    movsd(liftoff::kScratchDoubleReg, rhs);
     movsd(dst, lhs);
-    subsd(dst, kScratchDoubleReg);
+    subsd(dst, liftoff::kScratchDoubleReg);
   } else {
     if (dst != lhs) movsd(dst, lhs);
     subsd(dst, rhs);
@@ -810,20 +1119,32 @@ void LiftoffAssembler::emit_f64_div(DoubleRegister dst, DoubleRegister lhs,
     CpuFeatureScope scope(this, AVX);
     vdivsd(dst, lhs, rhs);
   } else if (dst == rhs) {
-    movsd(kScratchDoubleReg, rhs);
+    movsd(liftoff::kScratchDoubleReg, rhs);
     movsd(dst, lhs);
-    divsd(dst, kScratchDoubleReg);
+    divsd(dst, liftoff::kScratchDoubleReg);
   } else {
     if (dst != lhs) movsd(dst, lhs);
     divsd(dst, rhs);
   }
 }
 
+void LiftoffAssembler::emit_f64_min(DoubleRegister dst, DoubleRegister lhs,
+                                    DoubleRegister rhs) {
+  liftoff::EmitFloatMinOrMax<double>(this, dst, lhs, rhs,
+                                     liftoff::MinOrMax::kMin);
+}
+
+void LiftoffAssembler::emit_f64_max(DoubleRegister dst, DoubleRegister lhs,
+                                    DoubleRegister rhs) {
+  liftoff::EmitFloatMinOrMax<double>(this, dst, lhs, rhs,
+                                     liftoff::MinOrMax::kMax);
+}
+
 void LiftoffAssembler::emit_f64_abs(DoubleRegister dst, DoubleRegister src) {
   static constexpr uint64_t kSignBit = uint64_t{1} << 63;
   if (dst == src) {
-    TurboAssembler::Move(kScratchDoubleReg, kSignBit - 1);
-    Andpd(dst, kScratchDoubleReg);
+    TurboAssembler::Move(liftoff::kScratchDoubleReg, kSignBit - 1);
+    Andpd(dst, liftoff::kScratchDoubleReg);
   } else {
     TurboAssembler::Move(dst, kSignBit - 1);
     Andpd(dst, src);
@@ -833,46 +1154,126 @@ void LiftoffAssembler::emit_f64_abs(DoubleRegister dst, DoubleRegister src) {
 void LiftoffAssembler::emit_f64_neg(DoubleRegister dst, DoubleRegister src) {
   static constexpr uint64_t kSignBit = uint64_t{1} << 63;
   if (dst == src) {
-    TurboAssembler::Move(kScratchDoubleReg, kSignBit);
-    Xorpd(dst, kScratchDoubleReg);
+    TurboAssembler::Move(liftoff::kScratchDoubleReg, kSignBit);
+    Xorpd(dst, liftoff::kScratchDoubleReg);
   } else {
     TurboAssembler::Move(dst, kSignBit);
     Xorpd(dst, src);
   }
 }
 
-void LiftoffAssembler::emit_f64_ceil(DoubleRegister dst, DoubleRegister src) {
-  REQUIRE_CPU_FEATURE(SSE4_1);
+bool LiftoffAssembler::emit_f64_ceil(DoubleRegister dst, DoubleRegister src) {
+  REQUIRE_CPU_FEATURE(SSE4_1, true);
   roundsd(dst, src, kRoundUp);
+  return true;
 }
 
-void LiftoffAssembler::emit_f64_floor(DoubleRegister dst, DoubleRegister src) {
-  REQUIRE_CPU_FEATURE(SSE4_1);
+bool LiftoffAssembler::emit_f64_floor(DoubleRegister dst, DoubleRegister src) {
+  REQUIRE_CPU_FEATURE(SSE4_1, true);
   roundsd(dst, src, kRoundDown);
+  return true;
 }
 
-void LiftoffAssembler::emit_f64_trunc(DoubleRegister dst, DoubleRegister src) {
-  REQUIRE_CPU_FEATURE(SSE4_1);
+bool LiftoffAssembler::emit_f64_trunc(DoubleRegister dst, DoubleRegister src) {
+  REQUIRE_CPU_FEATURE(SSE4_1, true);
   roundsd(dst, src, kRoundToZero);
+  return true;
 }
 
-void LiftoffAssembler::emit_f64_nearest_int(DoubleRegister dst,
+bool LiftoffAssembler::emit_f64_nearest_int(DoubleRegister dst,
                                             DoubleRegister src) {
-  REQUIRE_CPU_FEATURE(SSE4_1);
+  REQUIRE_CPU_FEATURE(SSE4_1, true);
   roundsd(dst, src, kRoundToNearest);
+  return true;
 }
 
 void LiftoffAssembler::emit_f64_sqrt(DoubleRegister dst, DoubleRegister src) {
   Sqrtsd(dst, src);
 }
 
+namespace liftoff {
+// Used for float to int conversions. If the value in {converted_back} equals
+// {src} afterwards, the conversion succeeded.
+template <typename dst_type, typename src_type>
+inline void ConvertFloatToIntAndBack(LiftoffAssembler* assm, Register dst,
+                                     DoubleRegister src,
+                                     DoubleRegister converted_back,
+                                     LiftoffRegList pinned) {
+  if (std::is_same<double, src_type>::value) {  // f64
+    if (std::is_signed<dst_type>::value) {      // f64 -> i32
+      assm->cvttsd2si(dst, src);
+      assm->Cvtsi2sd(converted_back, dst);
+    } else {  // f64 -> u32
+      assm->Cvttsd2ui(dst, src, liftoff::kScratchDoubleReg);
+      assm->Cvtui2sd(converted_back, dst);
+    }
+  } else {                                  // f32
+    if (std::is_signed<dst_type>::value) {  // f32 -> i32
+      assm->cvttss2si(dst, src);
+      assm->Cvtsi2ss(converted_back, dst);
+    } else {  // f32 -> u32
+      assm->Cvttss2ui(dst, src, liftoff::kScratchDoubleReg);
+      assm->Cvtui2ss(converted_back, dst,
+                     assm->GetUnusedRegister(kGpReg, pinned).gp());
+    }
+  }
+}
+
+template <typename dst_type, typename src_type>
+inline bool EmitTruncateFloatToInt(LiftoffAssembler* assm, Register dst,
+                                   DoubleRegister src, Label* trap) {
+  if (!CpuFeatures::IsSupported(SSE4_1)) {
+    assm->bailout("no SSE4.1");
+    return true;
+  }
+  CpuFeatureScope feature(assm, SSE4_1);
+
+  LiftoffRegList pinned = LiftoffRegList::ForRegs(src, dst);
+  DoubleRegister rounded =
+      pinned.set(assm->GetUnusedRegister(kFpReg, pinned)).fp();
+  DoubleRegister converted_back =
+      pinned.set(assm->GetUnusedRegister(kFpReg, pinned)).fp();
+
+  if (std::is_same<double, src_type>::value) {  // f64
+    assm->roundsd(rounded, src, kRoundToZero);
+  } else {  // f32
+    assm->roundss(rounded, src, kRoundToZero);
+  }
+  ConvertFloatToIntAndBack<dst_type, src_type>(assm, dst, rounded,
+                                               converted_back, pinned);
+  if (std::is_same<double, src_type>::value) {  // f64
+    assm->ucomisd(converted_back, rounded);
+  } else {  // f32
+    assm->ucomiss(converted_back, rounded);
+  }
+
+  // Jump to trap if PF is 0 (one of the operands was NaN) or they are not
+  // equal.
+  assm->j(parity_even, trap);
+  assm->j(not_equal, trap);
+  return true;
+}
+}  // namespace liftoff
+
 bool LiftoffAssembler::emit_type_conversion(WasmOpcode opcode,
                                             LiftoffRegister dst,
-                                            LiftoffRegister src) {
+                                            LiftoffRegister src, Label* trap) {
   switch (opcode) {
     case kExprI32ConvertI64:
       if (dst.gp() != src.low_gp()) mov(dst.gp(), src.low_gp());
       return true;
+    case kExprI32SConvertF32:
+      return liftoff::EmitTruncateFloatToInt<int32_t, float>(this, dst.gp(),
+                                                             src.fp(), trap);
+    case kExprI32UConvertF32:
+      return liftoff::EmitTruncateFloatToInt<uint32_t, float>(this, dst.gp(),
+                                                              src.fp(), trap);
+    case kExprI32SConvertF64:
+      return liftoff::EmitTruncateFloatToInt<int32_t, double>(this, dst.gp(),
+                                                              src.fp(), trap);
+    case kExprI32UConvertF64:
+      return liftoff::EmitTruncateFloatToInt<uint32_t, double>(this, dst.gp(),
+                                                               src.fp(), trap);
     case kExprI32ReinterpretF32:
       Movd(dst.gp(), src.fp());
       return true;
@@ -912,7 +1313,7 @@ bool LiftoffAssembler::emit_type_conversion(WasmOpcode opcode,
       Cvtsi2sd(dst.fp(), src.gp());
       return true;
     case kExprF64UConvertI32:
-      LoadUint32(dst.fp(), src.gp());
+      Cvtui2sd(dst.fp(), src.gp());
       return true;
     case kExprF64ConvertF32:
       cvtss2sd(dst.fp(), src.fp());
@@ -1090,55 +1491,20 @@ void LiftoffAssembler::emit_f64_set_cond(Condition cond, Register dst,
   liftoff::EmitFloatSetCond<&Assembler::ucomisd>(this, cond, dst, lhs, rhs);
 }
 
-void LiftoffAssembler::StackCheck(Label* ool_code) {
-  cmp(esp,
-      Operand(Immediate(ExternalReference::address_of_stack_limit(isolate()))));
+void LiftoffAssembler::StackCheck(Label* ool_code, Register limit_address) {
+  cmp(esp, Operand(limit_address, 0));
   j(below_equal, ool_code);
 }
 
 void LiftoffAssembler::CallTrapCallbackForTesting() {
   PrepareCallCFunction(0, GetUnusedRegister(kGpReg).gp());
-  CallCFunction(
-      ExternalReference::wasm_call_trap_callback_for_testing(isolate()), 0);
+  CallCFunction(ExternalReference::wasm_call_trap_callback_for_testing(), 0);
 }
 
 void LiftoffAssembler::AssertUnreachable(AbortReason reason) {
   TurboAssembler::AssertUnreachable(reason);
 }
 
-void LiftoffAssembler::PushCallerFrameSlot(const VarState& src,
-                                           uint32_t src_index,
-                                           RegPairHalf half) {
-  switch (src.loc()) {
-    case VarState::kStack:
-      if (src.type() == kWasmF64) {
-        DCHECK_EQ(kLowWord, half);
-        push(liftoff::GetHalfStackSlot(2 * src_index - 1));
-      }
-      push(liftoff::GetHalfStackSlot(2 * src_index -
-                                     (half == kLowWord ? 0 : 1)));
-      break;
-    case VarState::kRegister:
-      if (src.type() == kWasmI64) {
-        PushCallerFrameSlot(
-            half == kLowWord ? src.reg().low() : src.reg().high(), kWasmI32);
-      } else {
-        PushCallerFrameSlot(src.reg(), src.type());
-      }
-      break;
-    case VarState::KIntConst:
-      // The high word is the sign extension of the low word.
-      push(Immediate(half == kLowWord ? src.i32_const()
-                                      : src.i32_const() >> 31));
-      break;
-  }
-}
-
-void LiftoffAssembler::PushCallerFrameSlot(LiftoffRegister reg,
-                                           ValueType type) {
-  liftoff::push(this, reg, type);
-}
-
 void LiftoffAssembler::PushRegisters(LiftoffRegList regs) {
   LiftoffRegList gp_regs = regs & kGpCacheRegList;
   while (!gp_regs.is_empty()) {
@@ -1184,82 +1550,75 @@ void LiftoffAssembler::DropStackSlotsAndRet(uint32_t num_stack_slots) {
   ret(static_cast<int>(num_stack_slots * kPointerSize));
 }
 
-void LiftoffAssembler::PrepareCCall(wasm::FunctionSig* sig,
-                                    const LiftoffRegister* args,
-                                    ValueType out_argument_type) {
-  int pushed_bytes = 0;
+void LiftoffAssembler::CallC(wasm::FunctionSig* sig,
+                             const LiftoffRegister* args,
+                             const LiftoffRegister* rets,
+                             ValueType out_argument_type, int stack_bytes,
+                             ExternalReference ext_ref) {
+  sub(esp, Immediate(stack_bytes));
+
+  int arg_bytes = 0;
   for (ValueType param_type : sig->parameters()) {
-    pushed_bytes += RoundUp<kPointerSize>(WasmOpcodes::MemSize(param_type));
-    liftoff::push(this, *args++, param_type);
+    liftoff::Store(this, esp, arg_bytes, *args++, param_type);
+    arg_bytes += ValueTypes::MemSize(param_type);
   }
-  if (out_argument_type != kWasmStmt) {
-    int size = RoundUp<kPointerSize>(WasmOpcodes::MemSize(out_argument_type));
-    sub(esp, Immediate(size));
-    pushed_bytes += size;
+  DCHECK_LE(arg_bytes, stack_bytes);
+
+  constexpr Register kScratch = eax;
+  constexpr Register kArgumentBuffer = ecx;
+  constexpr int kNumCCallArgs = 1;
+  mov(kArgumentBuffer, esp);
+  PrepareCallCFunction(kNumCCallArgs, kScratch);
+
+  // Pass a pointer to the buffer with the arguments to the C function. ia32
+  // does not use registers here, so push to the stack.
+  mov(Operand(esp, 0), kArgumentBuffer);
+
+  // Now call the C function.
+  CallCFunction(ext_ref, kNumCCallArgs);
+
+  // Move return value to the right register.
+  const LiftoffRegister* next_result_reg = rets;
+  if (sig->return_count() > 0) {
+    DCHECK_EQ(1, sig->return_count());
+    constexpr Register kReturnReg = eax;
+    if (kReturnReg != next_result_reg->gp()) {
+      Move(*next_result_reg, LiftoffRegister(kReturnReg), sig->GetReturn(0));
+    }
+    ++next_result_reg;
   }
-  // Save the original sp (before the first push), such that we can later
-  // compute pointers to the pushed values. Do this only *after* pushing the
-  // values, because {kCCallLastArgAddrReg} might collide with an arg register.
-  lea(liftoff::kCCallLastArgAddrReg, Operand(esp, pushed_bytes));
-  constexpr Register kScratch = ecx;
-  static_assert(kScratch != liftoff::kCCallLastArgAddrReg, "collision");
-  int num_c_call_arguments = static_cast<int>(sig->parameter_count()) +
-                             (out_argument_type != kWasmStmt);
-  PrepareCallCFunction(num_c_call_arguments, kScratch);
-}
 
-void LiftoffAssembler::SetCCallRegParamAddr(Register dst, int param_byte_offset,
-                                            ValueType type) {
-  // Check that we don't accidentally override kCCallLastArgAddrReg.
-  DCHECK_NE(liftoff::kCCallLastArgAddrReg, dst);
-  lea(dst, Operand(liftoff::kCCallLastArgAddrReg, -param_byte_offset));
-}
-
-void LiftoffAssembler::SetCCallStackParamAddr(int stack_param_idx,
-                                              int param_byte_offset,
-                                              ValueType type) {
-  static constexpr Register kScratch = ecx;
-  SetCCallRegParamAddr(kScratch, param_byte_offset, type);
-  mov(Operand(esp, stack_param_idx * kPointerSize), kScratch);
-}
-
-void LiftoffAssembler::LoadCCallOutArgument(LiftoffRegister dst, ValueType type,
-                                            int param_byte_offset) {
-  // Check that we don't accidentally override kCCallLastArgAddrReg.
-  DCHECK_NE(LiftoffRegister(liftoff::kCCallLastArgAddrReg), dst);
-  Operand src(liftoff::kCCallLastArgAddrReg, -param_byte_offset);
-  liftoff::Load(this, dst, src, type);
-}
-
-void LiftoffAssembler::CallC(ExternalReference ext_ref, uint32_t num_params) {
-  CallCFunction(ext_ref, static_cast<int>(num_params));
-}
+  // Load potential output value from the buffer on the stack.
+  if (out_argument_type != kWasmStmt) {
+    liftoff::Load(this, *next_result_reg, esp, 0, out_argument_type);
+  }
 
-void LiftoffAssembler::FinishCCall() {
-  mov(esp, liftoff::kCCallLastArgAddrReg);
+  add(esp, Immediate(stack_bytes));
 }
 
 void LiftoffAssembler::CallNativeWasmCode(Address addr) {
   wasm_call(addr, RelocInfo::WASM_CALL);
 }
 
-void LiftoffAssembler::CallRuntime(Zone* zone, Runtime::FunctionId fid) {
-  // Set instance to zero.
-  xor_(esi, esi);
-  CallRuntimeDelayed(zone, fid);
-}
-
 void LiftoffAssembler::CallIndirect(wasm::FunctionSig* sig,
                                     compiler::CallDescriptor* call_descriptor,
                                     Register target) {
-  if (target == no_reg) {
-    add(esp, Immediate(kPointerSize));
-    call(Operand(esp, -4));
+  // Since we have more cache registers than parameter registers, the
+  // {LiftoffCompiler} should always be able to place {target} in a register.
+  DCHECK(target.is_valid());
+  if (FLAG_untrusted_code_mitigations) {
+    RetpolineCall(target);
   } else {
     call(target);
   }
 }
 
+void LiftoffAssembler::CallRuntimeStub(WasmCode::RuntimeStubId sid) {
+  // A direct call to a wasm runtime stub defined in this module.
+  // Just encode the stub index. This will be patched at relocation.
+  wasm_call(static_cast<Address>(sid), RelocInfo::WASM_STUB_CALL);
+}
+
 void LiftoffAssembler::AllocateStackSlot(Register addr, uint32_t size) {
   sub(esp, Immediate(size));
   mov(addr, esp);
@@ -1269,6 +1628,36 @@ void LiftoffAssembler::DeallocateStackSlot(uint32_t size) {
   add(esp, Immediate(size));
 }
 
+void LiftoffStackSlots::Construct() {
+  for (auto& slot : slots_) {
+    const LiftoffAssembler::VarState& src = slot.src_;
+    switch (src.loc()) {
+      case LiftoffAssembler::VarState::kStack:
+        if (src.type() == kWasmF64) {
+          DCHECK_EQ(kLowWord, slot.half_);
+          asm_->push(liftoff::GetHalfStackSlot(2 * slot.src_index_ - 1));
+        }
+        asm_->push(liftoff::GetHalfStackSlot(2 * slot.src_index_ -
+                                             (slot.half_ == kLowWord ? 0 : 1)));
+        break;
+      case LiftoffAssembler::VarState::kRegister:
+        if (src.type() == kWasmI64) {
+          liftoff::push(
+              asm_, slot.half_ == kLowWord ? src.reg().low() : src.reg().high(),
+              kWasmI32);
+        } else {
+          liftoff::push(asm_, src.reg(), src.type());
+        }
+        break;
+      case LiftoffAssembler::VarState::KIntConst:
+        // The high word is the sign extension of the low word.
+        asm_->push(Immediate(slot.half_ == kLowWord ? src.i32_const()
+                                                    : src.i32_const() >> 31));
+        break;
+    }
+  }
+}
+
 #undef REQUIRE_CPU_FEATURE
 
 }  // namespace wasm
diff --git a/deps/v8/src/wasm/baseline/liftoff-assembler-defs.h b/deps/v8/src/wasm/baseline/liftoff-assembler-defs.h
index 26f59c68be392a..b7fdf5fe605741 100644
--- a/deps/v8/src/wasm/baseline/liftoff-assembler-defs.h
+++ b/deps/v8/src/wasm/baseline/liftoff-assembler-defs.h
@@ -30,6 +30,8 @@ constexpr RegList kLiftoffAssemblerGpCacheRegs =
 constexpr RegList kLiftoffAssemblerFpCacheRegs =
     DoubleRegister::ListOf<xmm0, xmm1, xmm2, xmm3, xmm4, xmm5, xmm6>();
 
+constexpr Register kNoParamRegister = edi;
+
 #elif V8_TARGET_ARCH_X64
 
 constexpr RegList kLiftoffAssemblerGpCacheRegs =
@@ -38,6 +40,8 @@ constexpr RegList kLiftoffAssemblerGpCacheRegs =
 constexpr RegList kLiftoffAssemblerFpCacheRegs =
     DoubleRegister::ListOf<xmm0, xmm1, xmm2, xmm3, xmm4, xmm5, xmm6, xmm7>();
 
+constexpr Register kNoParamRegister = r8;
+
 #elif V8_TARGET_ARCH_MIPS
 
 constexpr RegList kLiftoffAssemblerGpCacheRegs =
@@ -47,6 +51,8 @@ constexpr RegList kLiftoffAssemblerFpCacheRegs =
     DoubleRegister::ListOf<f0, f2, f4, f6, f8, f10, f12, f14, f16, f18, f20,
                            f22, f24>();
 
+constexpr Register kNoParamRegister = t0;
+
 #elif V8_TARGET_ARCH_MIPS64
 
 constexpr RegList kLiftoffAssemblerGpCacheRegs =
@@ -56,12 +62,34 @@ constexpr RegList kLiftoffAssemblerFpCacheRegs =
     DoubleRegister::ListOf<f0, f2, f4, f6, f8, f10, f12, f14, f16, f18, f20,
                            f22, f24, f26>();
 
+constexpr Register kNoParamRegister = t0;
+
+#elif V8_TARGET_ARCH_ARM64
+
+// x16: ip0, x17: ip1, x26: root, x27: cp, x29: fp, x30: lr, x31: xzr.
+constexpr RegList kLiftoffAssemblerGpCacheRegs =
+    CPURegister::ListOf<x0, x1, x2, x3, x4, x5, x6, x7, x8, x9, x10, x11, x12,
+                        x13, x14, x15, x18, x19, x20, x21, x22, x23, x24, x25,
+                        x28>();
+
+// d15: fp_zero, d30-d31: macro-assembler scratch V Registers.
+constexpr RegList kLiftoffAssemblerFpCacheRegs =
+    CPURegister::ListOf<d0, d1, d2, d3, d4, d5, d6, d7, d8, d9, d10, d11, d12,
+                        d13, d14, d16, d17, d18, d19, d20, d21, d22, d23, d24,
+                        d25, d26, d27, d28, d29>();
+
+constexpr Register kNoParamRegister = x28;
+
 #else
 
 constexpr RegList kLiftoffAssemblerGpCacheRegs = 0xff;
 
 constexpr RegList kLiftoffAssemblerFpCacheRegs = 0xff;
 
+// This should be an allocatable, general purpose register
+// that is not used for parameters, see {wasm-linkage.cc}.
+constexpr Register kNoParamRegister = Register::no_reg();
+
 #endif
 
 #if V8_TARGET_ARCH_IA32 || V8_TARGET_ARCH_X64
@@ -90,6 +118,19 @@ constexpr Condition kUnsignedLessEqual = ule;
 constexpr Condition kUnsignedGreaterThan = ugt;
 constexpr Condition kUnsignedGreaterEqual = uge;
 
+#elif V8_TARGET_ARCH_ARM || V8_TARGET_ARCH_ARM64
+
+constexpr Condition kEqual = eq;
+constexpr Condition kUnequal = ne;
+constexpr Condition kSignedLessThan = lt;
+constexpr Condition kSignedLessEqual = le;
+constexpr Condition kSignedGreaterThan = gt;
+constexpr Condition kSignedGreaterEqual = ge;
+constexpr Condition kUnsignedLessThan = lo;
+constexpr Condition kUnsignedLessEqual = ls;
+constexpr Condition kUnsignedGreaterThan = hi;
+constexpr Condition kUnsignedGreaterEqual = hs;
+
 #else
 
 // On unimplemented platforms, just make this compile.
diff --git a/deps/v8/src/wasm/baseline/liftoff-assembler.cc b/deps/v8/src/wasm/baseline/liftoff-assembler.cc
index 9f910d59fc7a17..0e913c19dc4033 100644
--- a/deps/v8/src/wasm/baseline/liftoff-assembler.cc
+++ b/deps/v8/src/wasm/baseline/liftoff-assembler.cc
@@ -4,10 +4,11 @@
 
 #include "src/wasm/baseline/liftoff-assembler.h"
 
+#include <sstream>
+
 #include "src/assembler-inl.h"
 #include "src/compiler/linkage.h"
 #include "src/compiler/wasm-compiler.h"
-#include "src/counters.h"
 #include "src/macro-assembler-inl.h"
 #include "src/wasm/function-body-decoder-impl.h"
 #include "src/wasm/wasm-opcodes.h"
@@ -335,10 +336,21 @@ void LiftoffAssembler::CacheState::Split(const CacheState& source) {
   *this = source;
 }
 
+namespace {
+
+constexpr AssemblerOptions DefaultLiftoffOptions() {
+  return AssemblerOptions{};
+}
+
+}  // namespace
+
 // TODO(clemensh): Provide a reasonably sized buffer, based on wasm function
 // size.
-LiftoffAssembler::LiftoffAssembler(Isolate* isolate)
-    : TurboAssembler(isolate, nullptr, 0, CodeObjectRequired::kNo) {}
+LiftoffAssembler::LiftoffAssembler()
+    : TurboAssembler(nullptr, DefaultLiftoffOptions(), nullptr, 0,
+                     CodeObjectRequired::kNo) {
+  set_trap_on_abort(true);  // Avoid calls to Abort.
+}
 
 LiftoffAssembler::~LiftoffAssembler() {
   if (num_locals_ > kInlineLocalTypes) {
@@ -452,6 +464,7 @@ void LiftoffAssembler::PrepareCall(wasm::FunctionSig* sig,
     slot.MakeStack();
   }
 
+  LiftoffStackSlots stack_slots(this);
   StackTransferRecipe stack_transfers(this);
   LiftoffRegList param_regs;
 
@@ -480,7 +493,7 @@ void LiftoffAssembler::PrepareCall(wasm::FunctionSig* sig,
     const int num_lowered_params = is_pair ? 2 : 1;
     const uint32_t stack_idx = param_base + param;
     const VarState& slot = cache_state_.stack_state[stack_idx];
-    // Process both halfs of register pair separately, because they are passed
+    // Process both halfs of a register pair separately, because they are passed
     // as separate parameters. One or both of them could end up on the stack.
     for (int lowered_idx = 0; lowered_idx < num_lowered_params; ++lowered_idx) {
       const RegPairHalf half =
@@ -500,7 +513,7 @@ void LiftoffAssembler::PrepareCall(wasm::FunctionSig* sig,
         }
       } else {
         DCHECK(loc.IsCallerFrameSlot());
-        PushCallerFrameSlot(slot, stack_idx, half);
+        stack_slots.Add(slot, stack_idx, half);
       }
     }
   }
@@ -518,11 +531,14 @@ void LiftoffAssembler::PrepareCall(wasm::FunctionSig* sig,
                                    kWasmIntPtr);
       *target = new_target.gp();
     } else {
-      PushCallerFrameSlot(LiftoffRegister(*target), kWasmIntPtr);
+      stack_slots.Add(LiftoffAssembler::VarState(LiftoffAssembler::kWasmIntPtr,
+                                                 LiftoffRegister(*target)));
       *target = no_reg;
     }
   }
 
+  // Create all the slots.
+  stack_slots.Construct();
   // Execute the stack transfers before filling the instance register.
   stack_transfers.Execute();
 
@@ -586,6 +602,34 @@ void LiftoffAssembler::ParallelRegisterMove(
   }
 }
 
+bool LiftoffAssembler::ValidateCacheState() const {
+  uint32_t register_use_count[kAfterMaxLiftoffRegCode] = {0};
+  LiftoffRegList used_regs;
+  for (const VarState& var : cache_state_.stack_state) {
+    if (!var.is_reg()) continue;
+    LiftoffRegister reg = var.reg();
+    if (kNeedI64RegPair && reg.is_pair()) {
+      ++register_use_count[reg.low().liftoff_code()];
+      ++register_use_count[reg.high().liftoff_code()];
+    } else {
+      ++register_use_count[reg.liftoff_code()];
+    }
+    used_regs.set(reg);
+  }
+  bool valid = memcmp(register_use_count, cache_state_.register_use_count,
+                      sizeof(register_use_count)) == 0 &&
+               used_regs == cache_state_.used_registers;
+  if (valid) return true;
+  std::ostringstream os;
+  os << "Error in LiftoffAssembler::ValidateCacheState().\n";
+  os << "expected: used_regs " << used_regs << ", counts "
+     << PrintCollection(register_use_count) << "\n";
+  os << "found:    used_regs " << cache_state_.used_registers << ", counts "
+     << PrintCollection(cache_state_.register_use_count) << "\n";
+  os << "Use --trace-liftoff to debug.";
+  FATAL("%s", os.str().c_str());
+}
+
 LiftoffRegister LiftoffAssembler::SpillOneRegister(LiftoffRegList candidates,
                                                    LiftoffRegList pinned) {
   // Spill one cached value to free a register.
@@ -625,7 +669,7 @@ void LiftoffAssembler::set_num_locals(uint32_t num_locals) {
 }
 
 std::ostream& operator<<(std::ostream& os, VarState slot) {
-  os << WasmOpcodes::TypeName(slot.type()) << ":";
+  os << ValueTypes::TypeName(slot.type()) << ":";
   switch (slot.loc()) {
     case VarState::kStack:
       return os << "s";
diff --git a/deps/v8/src/wasm/baseline/liftoff-assembler.h b/deps/v8/src/wasm/baseline/liftoff-assembler.h
index fafce663b7f592..822c620b82d232 100644
--- a/deps/v8/src/wasm/baseline/liftoff-assembler.h
+++ b/deps/v8/src/wasm/baseline/liftoff-assembler.h
@@ -14,16 +14,20 @@
 #include "src/wasm/baseline/liftoff-assembler-defs.h"
 #include "src/wasm/baseline/liftoff-register.h"
 #include "src/wasm/function-body-decoder.h"
+#include "src/wasm/wasm-code-manager.h"
 #include "src/wasm/wasm-module.h"
 #include "src/wasm/wasm-opcodes.h"
 #include "src/wasm/wasm-value.h"
 
 namespace v8 {
 namespace internal {
-namespace wasm {
 
 // Forward declarations.
-struct ModuleEnv;
+namespace compiler {
+class CallDescriptor;
+}
+
+namespace wasm {
 
 class LiftoffAssembler : public TurboAssembler {
  public:
@@ -243,7 +247,7 @@ class LiftoffAssembler : public TurboAssembler {
     CacheState(const CacheState&) = delete;
   };
 
-  explicit LiftoffAssembler(Isolate* isolate);
+  LiftoffAssembler();
   ~LiftoffAssembler();
 
   LiftoffRegister PopToRegister(LiftoffRegList pinned = {});
@@ -294,16 +298,6 @@ class LiftoffAssembler : public TurboAssembler {
     return SpillOneRegister(candidates, pinned);
   }
 
-  void DropStackSlot(VarState* slot) {
-    // The only loc we care about is register. Other types don't occupy
-    // anything.
-    if (!slot->is_reg()) return;
-    // Free the register, then set the loc to "stack".
-    // No need to write back, the value should be dropped.
-    cache_state_.dec_used(slot->reg());
-    slot->MakeStack();
-  }
-
   void MergeFullStackWith(CacheState&);
   void MergeStackWith(CacheState&, uint32_t arity);
 
@@ -339,6 +333,9 @@ class LiftoffAssembler : public TurboAssembler {
   };
   void ParallelRegisterMove(std::initializer_list<ParallelRegisterMoveTuple>);
 
+  // Validate that the register use counts reflect the state of the cache.
+  bool ValidateCacheState() const;
+
   ////////////////////////////////////
   // Platform-specific part.        //
   ////////////////////////////////////
@@ -347,8 +344,10 @@ class LiftoffAssembler : public TurboAssembler {
   // size of the stack frame is known. It returns an offset in the machine code
   // which can later be patched (via {PatchPrepareStackFrame)} when the size of
   // the frame is known.
-  inline uint32_t PrepareStackFrame();
-  inline void PatchPrepareStackFrame(uint32_t offset, uint32_t stack_slots);
+  inline int PrepareStackFrame();
+  inline void PatchPrepareStackFrame(int offset, uint32_t stack_slots);
+  inline void FinishCode();
+  inline void AbortCompilation();
 
   inline void LoadConstant(LiftoffRegister, WasmValue,
                            RelocInfo::Mode rmode = RelocInfo::NONE);
@@ -357,15 +356,20 @@ class LiftoffAssembler : public TurboAssembler {
   inline void FillInstanceInto(Register dst);
   inline void Load(LiftoffRegister dst, Register src_addr, Register offset_reg,
                    uint32_t offset_imm, LoadType type, LiftoffRegList pinned,
-                   uint32_t* protected_load_pc = nullptr);
+                   uint32_t* protected_load_pc = nullptr,
+                   bool is_load_mem = false);
   inline void Store(Register dst_addr, Register offset_reg, uint32_t offset_imm,
                     LiftoffRegister src, StoreType type, LiftoffRegList pinned,
-                    uint32_t* protected_store_pc = nullptr);
+                    uint32_t* protected_store_pc = nullptr,
+                    bool is_store_mem = false);
+  inline void ChangeEndiannessLoad(LiftoffRegister dst, LoadType type,
+                                   LiftoffRegList pinned);
+  inline void ChangeEndiannessStore(LiftoffRegister src, StoreType type,
+                                    LiftoffRegList pinned);
   inline void LoadCallerFrameSlot(LiftoffRegister, uint32_t caller_slot_idx,
                                   ValueType);
   inline void MoveStackValue(uint32_t dst_index, uint32_t src_index, ValueType);
 
-  inline void MoveToReturnRegister(LiftoffRegister src, ValueType);
   inline void Move(Register dst, Register src, ValueType);
   inline void Move(DoubleRegister dst, DoubleRegister src, ValueType);
 
@@ -381,6 +385,15 @@ class LiftoffAssembler : public TurboAssembler {
   inline void emit_i32_add(Register dst, Register lhs, Register rhs);
   inline void emit_i32_sub(Register dst, Register lhs, Register rhs);
   inline void emit_i32_mul(Register dst, Register lhs, Register rhs);
+  inline void emit_i32_divs(Register dst, Register lhs, Register rhs,
+                            Label* trap_div_by_zero,
+                            Label* trap_div_unrepresentable);
+  inline void emit_i32_divu(Register dst, Register lhs, Register rhs,
+                            Label* trap_div_by_zero);
+  inline void emit_i32_rems(Register dst, Register lhs, Register rhs,
+                            Label* trap_rem_by_zero);
+  inline void emit_i32_remu(Register dst, Register lhs, Register rhs,
+                            Label* trap_rem_by_zero);
   inline void emit_i32_and(Register dst, Register lhs, Register rhs);
   inline void emit_i32_or(Register dst, Register lhs, Register rhs);
   inline void emit_i32_xor(Register dst, Register lhs, Register rhs);
@@ -401,6 +414,17 @@ class LiftoffAssembler : public TurboAssembler {
                            LiftoffRegister rhs);
   inline void emit_i64_sub(LiftoffRegister dst, LiftoffRegister lhs,
                            LiftoffRegister rhs);
+  inline void emit_i64_mul(LiftoffRegister dst, LiftoffRegister lhs,
+                           LiftoffRegister rhs);
+  inline bool emit_i64_divs(LiftoffRegister dst, LiftoffRegister lhs,
+                            LiftoffRegister rhs, Label* trap_div_by_zero,
+                            Label* trap_div_unrepresentable);
+  inline bool emit_i64_divu(LiftoffRegister dst, LiftoffRegister lhs,
+                            LiftoffRegister rhs, Label* trap_div_by_zero);
+  inline bool emit_i64_rems(LiftoffRegister dst, LiftoffRegister lhs,
+                            LiftoffRegister rhs, Label* trap_rem_by_zero);
+  inline bool emit_i64_remu(LiftoffRegister dst, LiftoffRegister lhs,
+                            LiftoffRegister rhs, Label* trap_rem_by_zero);
   inline void emit_i64_and(LiftoffRegister dst, LiftoffRegister lhs,
                            LiftoffRegister rhs);
   inline void emit_i64_or(LiftoffRegister dst, LiftoffRegister lhs,
@@ -414,6 +438,8 @@ class LiftoffAssembler : public TurboAssembler {
   inline void emit_i64_shr(LiftoffRegister dst, LiftoffRegister src,
                            Register amount, LiftoffRegList pinned = {});
 
+  inline void emit_i32_to_intptr(Register dst, Register src);
+
   inline void emit_ptrsize_add(Register dst, Register lhs, Register rhs) {
     if (kPointerSize == 8) {
       emit_i64_add(LiftoffRegister(dst), LiftoffRegister(lhs),
@@ -432,6 +458,11 @@ class LiftoffAssembler : public TurboAssembler {
                            DoubleRegister rhs);
   inline void emit_f32_div(DoubleRegister dst, DoubleRegister lhs,
                            DoubleRegister rhs);
+  inline void emit_f32_min(DoubleRegister dst, DoubleRegister lhs,
+                           DoubleRegister rhs);
+  inline void emit_f32_max(DoubleRegister dst, DoubleRegister lhs,
+                           DoubleRegister rhs);
+
   // f32 unops.
   inline void emit_f32_abs(DoubleRegister dst, DoubleRegister src);
   inline void emit_f32_neg(DoubleRegister dst, DoubleRegister src);
@@ -450,19 +481,23 @@ class LiftoffAssembler : public TurboAssembler {
                            DoubleRegister rhs);
   inline void emit_f64_div(DoubleRegister dst, DoubleRegister lhs,
                            DoubleRegister rhs);
+  inline void emit_f64_min(DoubleRegister dst, DoubleRegister lhs,
+                           DoubleRegister rhs);
+  inline void emit_f64_max(DoubleRegister dst, DoubleRegister lhs,
+                           DoubleRegister rhs);
 
   // f64 unops.
   inline void emit_f64_abs(DoubleRegister dst, DoubleRegister src);
   inline void emit_f64_neg(DoubleRegister dst, DoubleRegister src);
-  inline void emit_f64_ceil(DoubleRegister dst, DoubleRegister src);
-  inline void emit_f64_floor(DoubleRegister dst, DoubleRegister src);
-  inline void emit_f64_trunc(DoubleRegister dst, DoubleRegister src);
-  inline void emit_f64_nearest_int(DoubleRegister dst, DoubleRegister src);
+  inline bool emit_f64_ceil(DoubleRegister dst, DoubleRegister src);
+  inline bool emit_f64_floor(DoubleRegister dst, DoubleRegister src);
+  inline bool emit_f64_trunc(DoubleRegister dst, DoubleRegister src);
+  inline bool emit_f64_nearest_int(DoubleRegister dst, DoubleRegister src);
   inline void emit_f64_sqrt(DoubleRegister dst, DoubleRegister src);
 
   // type conversions.
   inline bool emit_type_conversion(WasmOpcode opcode, LiftoffRegister dst,
-                                   LiftoffRegister src);
+                                   LiftoffRegister src, Label* trap = nullptr);
 
   inline void emit_jump(Label*);
   inline void emit_jump(Register);
@@ -481,47 +516,32 @@ class LiftoffAssembler : public TurboAssembler {
   inline void emit_f64_set_cond(Condition condition, Register dst,
                                 DoubleRegister lhs, DoubleRegister rhs);
 
-  inline void StackCheck(Label* ool_code);
+  inline void StackCheck(Label* ool_code, Register limit_address);
 
   inline void CallTrapCallbackForTesting();
 
   inline void AssertUnreachable(AbortReason reason);
 
-  // Push a value to the stack (will become a caller frame slot).
-  inline void PushCallerFrameSlot(const VarState& src, uint32_t src_index,
-                                  RegPairHalf half);
-  inline void PushCallerFrameSlot(LiftoffRegister reg, ValueType type);
   inline void PushRegisters(LiftoffRegList);
   inline void PopRegisters(LiftoffRegList);
 
   inline void DropStackSlotsAndRet(uint32_t num_stack_slots);
 
-  // {PrepareCCall} pushes the arguments on the stack (in the caller frame),
-  // then aligns the stack to do a c call. Pointers to the pushed arguments are
-  // later loaded to registers or stack slots via {SetCCall*ParamAddr}. After
-  // the c call, the output parameter (if it exists) can be loaded via
-  // {LoadCCallOutArgument}. {FinishCCall} resets the stack pointer to the state
-  // before {PrepareCCall}.
-  // The {FunctionSig} passed to {PrepareCCall} describes the types of
-  // parameters which are then passed ot the C function via pointers, excluding
-  // the out argument.
-  inline void PrepareCCall(wasm::FunctionSig* sig, const LiftoffRegister* args,
-                           ValueType out_argument_type);
-  inline void SetCCallRegParamAddr(Register dst, int param_byte_offset,
-                                   ValueType type);
-  inline void SetCCallStackParamAddr(int stack_param_idx, int param_byte_offset,
-                                     ValueType type);
-  inline void LoadCCallOutArgument(LiftoffRegister dst, ValueType type,
-                                   int param_byte_offset);
-  inline void CallC(ExternalReference ext_ref, uint32_t num_params);
-  inline void FinishCCall();
+  // Execute a C call. Arguments are pushed to the stack and a pointer to this
+  // region is passed to the C function. If {out_argument_type != kWasmStmt},
+  // this is the return value of the C function, stored in {rets[0]}. Further
+  // outputs (specified in {sig->returns()}) are read from the buffer and stored
+  // in the remaining {rets} registers.
+  inline void CallC(wasm::FunctionSig* sig, const LiftoffRegister* args,
+                    const LiftoffRegister* rets, ValueType out_argument_type,
+                    int stack_bytes, ExternalReference ext_ref);
 
   inline void CallNativeWasmCode(Address addr);
-  inline void CallRuntime(Zone* zone, Runtime::FunctionId fid);
   // Indirect call: If {target == no_reg}, then pop the target from the stack.
   inline void CallIndirect(wasm::FunctionSig* sig,
                            compiler::CallDescriptor* call_descriptor,
                            Register target);
+  inline void CallRuntimeStub(WasmCode::RuntimeStubId sid);
 
   // Reserve space in the current frame, store address to space in {addr}.
   inline void AllocateStackSlot(Register addr, uint32_t size);
@@ -552,10 +572,17 @@ class LiftoffAssembler : public TurboAssembler {
   }
 
   CacheState* cache_state() { return &cache_state_; }
+  const CacheState* cache_state() const { return &cache_state_; }
 
   bool did_bailout() { return bailout_reason_ != nullptr; }
   const char* bailout_reason() const { return bailout_reason_; }
 
+  void bailout(const char* reason) {
+    if (bailout_reason_ != nullptr) return;
+    AbortCompilation();
+    bailout_reason_ = reason;
+  }
+
  private:
   uint32_t num_locals_ = 0;
   static constexpr uint32_t kInlineLocalTypes = 8;
@@ -571,10 +598,6 @@ class LiftoffAssembler : public TurboAssembler {
 
   LiftoffRegister SpillOneRegister(LiftoffRegList candidates,
                                    LiftoffRegList pinned);
-
-  void bailout(const char* reason) {
-    if (bailout_reason_ == nullptr) bailout_reason_ = reason;
-  }
 };
 
 std::ostream& operator<<(std::ostream& os, LiftoffAssembler::VarState);
@@ -590,13 +613,26 @@ template <void (LiftoffAssembler::*op)(Register, Register, Register)>
 void EmitI64IndependentHalfOperation(LiftoffAssembler* assm,
                                      LiftoffRegister dst, LiftoffRegister lhs,
                                      LiftoffRegister rhs) {
-  // Register pairs are either the same, or they don't overlap at all, so the
-  // low and high registers must be disjoint. Just handle them separately.
-  DCHECK_EQ(LiftoffRegList{},
-            LiftoffRegList::ForRegs(dst.low(), lhs.low(), rhs.low()) &
-                LiftoffRegList::ForRegs(dst.high(), lhs.high(), rhs.high()));
-  (assm->*op)(dst.low_gp(), lhs.low_gp(), rhs.low_gp());
+  // If {dst.low_gp()} does not overlap with {lhs.high_gp()} or {rhs.high_gp()},
+  // just first compute the lower half, then the upper half.
+  if (dst.low() != lhs.high() && dst.low() != rhs.high()) {
+    (assm->*op)(dst.low_gp(), lhs.low_gp(), rhs.low_gp());
+    (assm->*op)(dst.high_gp(), lhs.high_gp(), rhs.high_gp());
+    return;
+  }
+  // If {dst.high_gp()} does not overlap with {lhs.low_gp()} or {rhs.low_gp()},
+  // we can compute this the other way around.
+  if (dst.high() != lhs.low() && dst.high() != rhs.low()) {
+    (assm->*op)(dst.high_gp(), lhs.high_gp(), rhs.high_gp());
+    (assm->*op)(dst.low_gp(), lhs.low_gp(), rhs.low_gp());
+    return;
+  }
+  // Otherwise, we need a temporary register.
+  Register tmp =
+      assm->GetUnusedRegister(kGpReg, LiftoffRegList::ForRegs(lhs, rhs)).gp();
+  (assm->*op)(tmp, lhs.low_gp(), rhs.low_gp());
   (assm->*op)(dst.high_gp(), lhs.high_gp(), rhs.high_gp());
+  assm->Move(dst.low_gp(), tmp, kWasmI32);
 }
 }  // namespace liftoff
 
@@ -624,6 +660,37 @@ void LiftoffAssembler::emit_i64_xor(LiftoffRegister dst, LiftoffRegister lhs,
 // platform-dependent part.
 // =======================================================================
 
+class LiftoffStackSlots {
+ public:
+  explicit LiftoffStackSlots(LiftoffAssembler* wasm_asm) : asm_(wasm_asm) {}
+
+  void Add(const LiftoffAssembler::VarState& src, uint32_t src_index,
+           RegPairHalf half) {
+    slots_.emplace_back(src, src_index, half);
+  }
+  void Add(const LiftoffAssembler::VarState& src) { slots_.emplace_back(src); }
+
+  inline void Construct();
+
+ private:
+  struct Slot {
+    // Allow move construction.
+    Slot(Slot&&) = default;
+    Slot(const LiftoffAssembler::VarState& src, uint32_t src_index,
+         RegPairHalf half)
+        : src_(src), src_index_(src_index), half_(half) {}
+    explicit Slot(const LiftoffAssembler::VarState& src)
+        : src_(src), half_(kLowWord) {}
+
+    const LiftoffAssembler::VarState src_;
+    uint32_t src_index_ = 0;
+    RegPairHalf half_;
+  };
+
+  std::vector<Slot> slots_;
+  LiftoffAssembler* const asm_;
+};
+
 }  // namespace wasm
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/src/wasm/baseline/liftoff-compiler.cc b/deps/v8/src/wasm/baseline/liftoff-compiler.cc
index 914fc2aafa91c6..88a9bf299b43bf 100644
--- a/deps/v8/src/wasm/baseline/liftoff-compiler.cc
+++ b/deps/v8/src/wasm/baseline/liftoff-compiler.cc
@@ -2,16 +2,20 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#include "src/wasm/baseline/liftoff-assembler.h"
+#include "src/wasm/baseline/liftoff-compiler.h"
 
 #include "src/assembler-inl.h"
 #include "src/base/optional.h"
+// TODO(clemensh): Remove dependences on compiler stuff.
 #include "src/compiler/linkage.h"
 #include "src/compiler/wasm-compiler.h"
 #include "src/counters.h"
 #include "src/macro-assembler-inl.h"
+#include "src/wasm/baseline/liftoff-assembler.h"
 #include "src/wasm/function-body-decoder-impl.h"
+#include "src/wasm/function-compiler.h"
 #include "src/wasm/memory-tracing.h"
+#include "src/wasm/wasm-linkage.h"
 #include "src/wasm/wasm-objects.h"
 #include "src/wasm/wasm-opcodes.h"
 
@@ -19,15 +23,13 @@ namespace v8 {
 namespace internal {
 namespace wasm {
 
-using WasmCompilationData = compiler::WasmCompilationData;
-
 constexpr auto kRegister = LiftoffAssembler::VarState::kRegister;
 constexpr auto KIntConst = LiftoffAssembler::VarState::KIntConst;
 constexpr auto kStack = LiftoffAssembler::VarState::kStack;
 
 namespace {
 
-#define __ asm_->
+#define __ asm_.
 
 #define TRACE(...)                                            \
   do {                                                        \
@@ -41,6 +43,15 @@ namespace {
   __ LoadFromInstance(dst.gp(), WASM_INSTANCE_OBJECT_OFFSET(name), \
                       LoadType(type).size());
 
+#ifdef DEBUG
+#define DEBUG_CODE_COMMENT(str) \
+  do {                          \
+    __ RecordComment(str);      \
+  } while (false)
+#else
+#define DEBUG_CODE_COMMENT(str) ((void)0)
+#endif
+
 constexpr LoadType::LoadTypeValue kPointerLoadType =
     kPointerSize == 8 ? LoadType::kI64Load : LoadType::kI32Load;
 
@@ -51,15 +62,10 @@ constexpr LoadType::LoadTypeValue kPointerLoadType =
 class MovableLabel {
  public:
   Label* get() { return label_.get(); }
-  MovableLabel() : MovableLabel(new Label()) {}
-
-  operator bool() const { return label_ != nullptr; }
-
-  static MovableLabel None() { return MovableLabel(nullptr); }
+  MovableLabel() : label_(new Label()) {}
 
  private:
   std::unique_ptr<Label> label_;
-  explicit MovableLabel(Label* label) : label_(label) {}
 };
 #else
 // On all other platforms, just store the Label directly.
@@ -67,10 +73,6 @@ class MovableLabel {
  public:
   Label* get() { return &label_; }
 
-  operator bool() const { return true; }
-
-  static MovableLabel None() { return MovableLabel(); }
-
  private:
   Label label_;
 };
@@ -113,32 +115,25 @@ class LiftoffCompiler {
   struct OutOfLineCode {
     MovableLabel label;
     MovableLabel continuation;
-    Builtins::Name builtin;
-    wasm::WasmCodePosition position;
+    WasmCode::RuntimeStubId stub;
+    WasmCodePosition position;
     LiftoffRegList regs_to_save;
     uint32_t pc;  // for trap handler.
 
     // Named constructors:
-    static OutOfLineCode Trap(Builtins::Name b, wasm::WasmCodePosition pos,
+    static OutOfLineCode Trap(WasmCode::RuntimeStubId s, WasmCodePosition pos,
                               uint32_t pc) {
-      return {{}, {}, b, pos, {}, pc};
+      DCHECK_LT(0, pos);
+      return {{}, {}, s, pos, {}, pc};
     }
-    static OutOfLineCode StackCheck(wasm::WasmCodePosition pos,
-                                    LiftoffRegList regs) {
-      return {{}, MovableLabel::None(), Builtins::kWasmStackGuard, pos, regs,
-              0};
+    static OutOfLineCode StackCheck(WasmCodePosition pos, LiftoffRegList regs) {
+      return {{}, {}, WasmCode::kWasmStackGuard, pos, regs, 0};
     }
   };
 
-  LiftoffCompiler(LiftoffAssembler* liftoff_asm,
-                  compiler::CallDescriptor* call_descriptor,
-                  compiler::ModuleEnv* env,
-                  SourcePositionTableBuilder* source_position_table_builder,
-                  WasmCompilationData* wasm_compilation_data,
-                  Zone* compilation_zone, std::unique_ptr<Zone>* codegen_zone,
-                  WasmCode* const* code_table_entry)
-      : asm_(liftoff_asm),
-        descriptor_(
+  LiftoffCompiler(compiler::CallDescriptor* call_descriptor, ModuleEnv* env,
+                  Zone* compilation_zone)
+      : descriptor_(
             GetLoweredCallDescriptor(compilation_zone, call_descriptor)),
         env_(env),
         min_size_(uint64_t{env_->module->initial_pages} * wasm::kWasmPageSize),
@@ -146,17 +141,29 @@ class LiftoffCompiler {
                                ? env_->module->maximum_pages
                                : wasm::kV8MaxWasmMemoryPages} *
                   wasm::kWasmPageSize),
-        source_position_table_builder_(source_position_table_builder),
-        wasm_compilation_data_(wasm_compilation_data),
         compilation_zone_(compilation_zone),
-        codegen_zone_(codegen_zone),
-        safepoint_table_builder_(compilation_zone_),
-        code_table_entry_(code_table_entry) {}
+        safepoint_table_builder_(compilation_zone_) {}
 
   ~LiftoffCompiler() { BindUnboundLabels(nullptr); }
 
   bool ok() const { return ok_; }
 
+  void GetCode(CodeDesc* desc) { asm_.GetCode(nullptr, desc); }
+
+  OwnedVector<uint8_t> GetSourcePositionTable() {
+    return source_position_table_builder_.ToSourcePositionTableVector();
+  }
+
+  OwnedVector<trap_handler::ProtectedInstructionData> GetProtectedInstructions()
+      const {
+    return OwnedVector<trap_handler::ProtectedInstructionData>::Of(
+        protected_instructions_);
+  }
+
+  uint32_t GetTotalFrameSlotCount() const {
+    return __ GetTotalFrameSlotCount();
+  }
+
   void unsupported(Decoder* decoder, const char* reason) {
     ok_ = false;
     TRACE("unsupported: %s\n", reason);
@@ -165,8 +172,8 @@ class LiftoffCompiler {
   }
 
   bool DidAssemblerBailout(Decoder* decoder) {
-    if (decoder->failed() || !asm_->did_bailout()) return false;
-    unsupported(decoder, asm_->bailout_reason());
+    if (decoder->failed() || !__ did_bailout()) return false;
+    unsupported(decoder, __ bailout_reason());
     return true;
   }
 
@@ -178,8 +185,7 @@ class LiftoffCompiler {
     for (ValueType supported : supported_types) {
       if (type == supported) return true;
     }
-    SNPrintF(ArrayVector(buffer), "%s %s", WasmOpcodes::TypeName(type),
-             context);
+    SNPrintF(ArrayVector(buffer), "%s %s", ValueTypes::TypeName(type), context);
     unsupported(decoder, buffer);
     return false;
   }
@@ -216,6 +222,33 @@ class LiftoffCompiler {
     }
   }
 
+  void CollectReservedRegsForParameters(uint32_t input_idx_start,
+                                        uint32_t num_params,
+                                        LiftoffRegList& param_regs) {
+    uint32_t input_idx = input_idx_start;
+    for (uint32_t param_idx = 0; param_idx < num_params; ++param_idx) {
+      ValueType type = __ local_type(param_idx);
+      const int num_lowered_params = 1 + needs_reg_pair(type);
+      RegClass rc = num_lowered_params == 1 ? reg_class_for(type) : kGpReg;
+
+      for (int pair_idx = 0; pair_idx < num_lowered_params; ++pair_idx) {
+        compiler::LinkageLocation param_loc =
+            descriptor_->GetInputLocation(input_idx + pair_idx);
+        if (param_loc.IsRegister()) {
+          DCHECK(!param_loc.IsAnyRegister());
+          int reg_code = param_loc.AsRegister();
+          RegList cache_regs = rc == kGpReg ? kLiftoffAssemblerGpCacheRegs
+                                            : kLiftoffAssemblerFpCacheRegs;
+          if (cache_regs & (1 << reg_code)) {
+            LiftoffRegister in_reg = LiftoffRegister::from_code(rc, reg_code);
+            param_regs.set(in_reg);
+          }
+        }
+      }
+      input_idx += num_lowered_params;
+    }
+  }
+
   // Returns the number of inputs processed (1 or 2).
   uint32_t ProcessParameter(ValueType type, uint32_t input_idx) {
     const int num_lowered_params = 1 + needs_reg_pair(type);
@@ -261,79 +294,23 @@ class LiftoffCompiler {
     return num_lowered_params;
   }
 
-  void StackCheck(wasm::WasmCodePosition position) {
-    if (FLAG_wasm_no_stack_checks ||
-        !wasm_compilation_data_->runtime_exception_support()) {
-      return;
-    }
+  void StackCheck(WasmCodePosition position) {
+    if (FLAG_wasm_no_stack_checks || !env_->runtime_exception_support) return;
     out_of_line_code_.push_back(
         OutOfLineCode::StackCheck(position, __ cache_state()->used_registers));
     OutOfLineCode& ool = out_of_line_code_.back();
-    __ StackCheck(ool.label.get());
-    if (ool.continuation) __ bind(ool.continuation.get());
-  }
-
-  // Inserts a check whether the optimized version of this code already exists.
-  // If so, it redirects execution to the optimized code.
-  void JumpToOptimizedCodeIfExisting() {
-    // Check whether we have an optimized function before
-    // continuing to execute the Liftoff-compiled code.
-    // TODO(clemensh): Reduce number of temporary registers.
-    LiftoffRegList pinned;
-    LiftoffRegister wasm_code_addr =
-        pinned.set(__ GetUnusedRegister(kGpReg, pinned));
-    LiftoffRegister target_code_addr =
-        pinned.set(__ GetUnusedRegister(kGpReg, pinned));
-    LiftoffRegister code_start_address =
-        pinned.set(__ GetUnusedRegister(kGpReg, pinned));
-
-    // Get the current code's target address ({instructions_.start()}).
-    __ ComputeCodeStartAddress(code_start_address.gp());
-
-    static LoadType kPointerLoadType =
-        LoadType::ForValueType(LiftoffAssembler::kWasmIntPtr);
-    using int_t = std::conditional<kPointerSize == 8, uint64_t, uint32_t>::type;
-    static_assert(sizeof(int_t) == sizeof(uintptr_t), "weird uintptr_t");
-    // Get the address of the WasmCode* currently stored in the code table.
-    __ LoadConstant(target_code_addr,
-                    WasmValue(reinterpret_cast<int_t>(code_table_entry_)),
-                    RelocInfo::WASM_CODE_TABLE_ENTRY);
-    // Load the corresponding WasmCode*.
-    __ Load(wasm_code_addr, target_code_addr.gp(), Register::no_reg(), 0,
-            kPointerLoadType, pinned);
-    // Load its target address ({instuctions_.start()}).
-    __ Load(target_code_addr, wasm_code_addr.gp(), Register::no_reg(),
-            WasmCode::kInstructionStartOffset, kPointerLoadType, pinned);
-
-    // If the current code's target address is the same as the
-    // target address of the stored WasmCode, then continue executing, otherwise
-    // jump to the updated WasmCode.
-    Label cont;
-    __ emit_cond_jump(kEqual, &cont, LiftoffAssembler::kWasmIntPtr,
-                      target_code_addr.gp(), code_start_address.gp());
-    __ LeaveFrame(StackFrame::WASM_COMPILED);
-    __ emit_jump(target_code_addr.gp());
-    __ bind(&cont);
+    LiftoffRegister limit_address = __ GetUnusedRegister(kGpReg);
+    LOAD_INSTANCE_FIELD(limit_address, StackLimitAddress, kPointerLoadType);
+    __ StackCheck(ool.label.get(), limit_address.gp());
+    __ bind(ool.continuation.get());
   }
 
   void StartFunctionBody(Decoder* decoder, Control* block) {
-    __ EnterFrame(StackFrame::WASM_COMPILED);
-    __ set_has_frame(true);
-    pc_offset_stack_frame_construction_ = __ PrepareStackFrame();
-    // {PrepareStackFrame} is the first platform-specific assembler method.
-    // If this failed, we can bail out immediately, avoiding runtime overhead
-    // and potential failures because of other unimplemented methods.
-    // A platform implementing {PrepareStackFrame} must ensure that we can
-    // finish compilation without errors even if we hit unimplemented
-    // LiftoffAssembler methods.
-    if (DidAssemblerBailout(decoder)) return;
-    // Parameter 0 is the instance parameter.
-    uint32_t num_params =
-        static_cast<uint32_t>(decoder->sig_->parameter_count());
     for (uint32_t i = 0; i < __ num_locals(); ++i) {
       if (!CheckSupportedType(decoder, kTypes_ilfd, __ local_type(i), "param"))
         return;
     }
+
     // Input 0 is the call target, the instance is at 1.
     constexpr int kInstanceParameterIndex = 1;
     // Store the instance parameter to a special stack slot.
@@ -342,6 +319,23 @@ class LiftoffCompiler {
     DCHECK(instance_loc.IsRegister());
     DCHECK(!instance_loc.IsAnyRegister());
     Register instance_reg = Register::from_code(instance_loc.AsRegister());
+    DCHECK_EQ(kWasmInstanceRegister, instance_reg);
+
+    // Parameter 0 is the instance parameter.
+    uint32_t num_params =
+        static_cast<uint32_t>(decoder->sig_->parameter_count());
+
+    __ EnterFrame(StackFrame::WASM_COMPILED);
+    __ set_has_frame(true);
+    pc_offset_stack_frame_construction_ = __ PrepareStackFrame();
+    // {PrepareStackFrame} is the first platform-specific assembler method.
+    // If this failed, we can bail out immediately, avoiding runtime overhead
+    // and potential failures because of other unimplemented methods.
+    // A platform implementing {PrepareStackFrame} must ensure that we can
+    // finish compilation without errors even if we hit unimplemented
+    // LiftoffAssembler methods.
+    if (DidAssemblerBailout(decoder)) return;
+
     __ SpillInstance(instance_reg);
     // Input 0 is the code target, 1 is the instance. First parameter at 2.
     uint32_t input_idx = kInstanceParameterIndex + 1;
@@ -384,46 +378,39 @@ class LiftoffCompiler {
     StackCheck(0);
 
     DCHECK_EQ(__ num_locals(), __ cache_state()->stack_height());
-
-    // TODO(kimanh): if possible, we want to move this check further up,
-    // in order to avoid unnecessary overhead each time we enter
-    // a Liftoff-compiled function that will jump to a Turbofan-compiled
-    // function.
-    if (FLAG_wasm_tier_up) {
-      JumpToOptimizedCodeIfExisting();
-    }
   }
 
   void GenerateOutOfLineCode(OutOfLineCode& ool) {
     __ bind(ool.label.get());
-    const bool is_stack_check = ool.builtin == Builtins::kWasmStackGuard;
+    const bool is_stack_check = ool.stub == WasmCode::kWasmStackGuard;
     const bool is_mem_out_of_bounds =
-        ool.builtin == Builtins::kThrowWasmTrapMemOutOfBounds;
+        ool.stub == WasmCode::kThrowWasmTrapMemOutOfBounds;
 
     if (is_mem_out_of_bounds && env_->use_trap_handler) {
       uint32_t pc = static_cast<uint32_t>(__ pc_offset());
       DCHECK_EQ(pc, __ pc_offset());
-      wasm_compilation_data_->AddProtectedInstruction(ool.pc, pc);
+      protected_instructions_.emplace_back(
+          trap_handler::ProtectedInstructionData{ool.pc, pc});
     }
 
-    if (!wasm_compilation_data_->runtime_exception_support()) {
+    if (!env_->runtime_exception_support) {
       // We cannot test calls to the runtime in cctest/test-run-wasm.
       // Therefore we emit a call to C here instead of a call to the runtime.
       // In this mode, we never generate stack checks.
       DCHECK(!is_stack_check);
       __ CallTrapCallbackForTesting();
       __ LeaveFrame(StackFrame::WASM_COMPILED);
-      __ Ret();
+      __ DropStackSlotsAndRet(
+          static_cast<uint32_t>(descriptor_->StackParameterCount()));
       return;
     }
 
     if (!ool.regs_to_save.is_empty()) __ PushRegisters(ool.regs_to_save);
 
-    source_position_table_builder_->AddPosition(
+    source_position_table_builder_.AddPosition(
         __ pc_offset(), SourcePosition(ool.position), false);
-    __ Call(__ isolate()->builtins()->builtin_handle(ool.builtin),
-            RelocInfo::CODE_TARGET);
-    safepoint_table_builder_.DefineSafepoint(asm_, Safepoint::kSimple, 0,
+    __ CallRuntimeStub(ool.stub);
+    safepoint_table_builder_.DefineSafepoint(&asm_, Safepoint::kSimple, 0,
                                              Safepoint::kNoLazyDeopt);
     DCHECK_EQ(ool.continuation.get()->is_bound(), is_stack_check);
     if (!ool.regs_to_save.is_empty()) __ PopRegisters(ool.regs_to_save);
@@ -439,18 +426,24 @@ class LiftoffCompiler {
     for (OutOfLineCode& ool : out_of_line_code_) {
       GenerateOutOfLineCode(ool);
     }
-    safepoint_table_builder_.Emit(asm_, __ GetTotalFrameSlotCount());
     __ PatchPrepareStackFrame(pc_offset_stack_frame_construction_,
                               __ GetTotalFrameSlotCount());
+    __ FinishCode();
+    safepoint_table_builder_.Emit(&asm_, __ GetTotalFrameSlotCount());
+    // The previous calls may have also generated a bailout.
+    DidAssemblerBailout(decoder);
   }
 
   void OnFirstError(Decoder* decoder) {
     ok_ = false;
     BindUnboundLabels(decoder);
+    asm_.AbortCompilation();
   }
 
-  void NextInstruction(Decoder* decoder, WasmOpcode) {
+  void NextInstruction(Decoder* decoder, WasmOpcode opcode) {
     TraceCacheState(decoder);
+    SLOW_DCHECK(__ ValidateCacheState());
+    DEBUG_CODE_COMMENT(WasmOpcodes::OpcodeName(opcode));
   }
 
   void Block(Decoder* decoder, Control* block) {
@@ -529,111 +522,40 @@ class LiftoffCompiler {
                      ValueType out_argument_type,
                      const LiftoffRegister* arg_regs,
                      ExternalReference ext_ref) {
-    static constexpr int kMaxReturns = 1;
-    static constexpr int kMaxArgs = 2;
-    static constexpr MachineType kReps[]{
-        MachineType::Uint32(), MachineType::Pointer(), MachineType::Pointer()};
-    static_assert(arraysize(kReps) == kMaxReturns + kMaxArgs, "mismatch");
-
-    const bool has_out_argument = out_argument_type != kWasmStmt;
-    const uint32_t num_returns = static_cast<uint32_t>(sig->return_count());
-    // {total_num_args} is {num_args + 1} if the return value is stored in an
-    // out parameter, or {num_args} otherwise.
-    const uint32_t num_args = static_cast<uint32_t>(sig->parameter_count());
-    const uint32_t total_num_args = num_args + has_out_argument;
-    DCHECK_LE(num_args, kMaxArgs);
-    DCHECK_LE(num_returns, kMaxReturns);
-
-    MachineSignature machine_sig(num_returns, total_num_args,
-                                 kReps + (kMaxReturns - num_returns));
-    auto* call_descriptor = compiler::Linkage::GetSimplifiedCDescriptor(
-        compilation_zone_, &machine_sig);
-
     // Before making a call, spill all cache registers.
     __ SpillAllRegisters();
 
     // Store arguments on our stack, then align the stack for calling to C.
-    __ PrepareCCall(sig, arg_regs, out_argument_type);
-
-    // The arguments to the c function are pointers to the stack slots we just
-    // pushed.
-    int num_stack_params = 0;   // Number of stack parameters.
-    int input_idx = 1;          // Input 0 is the call target.
-    int param_byte_offset = 0;  // Byte offset into the pushed arguments.
-    auto add_argument = [&](ValueType arg_type) {
-      compiler::LinkageLocation loc =
-          call_descriptor->GetInputLocation(input_idx);
-      param_byte_offset +=
-          RoundUp<kPointerSize>(WasmOpcodes::MemSize(arg_type));
-      ++input_idx;
-      if (loc.IsRegister()) {
-        Register reg = Register::from_code(loc.AsRegister());
-        // Load address of that parameter to the register.
-        __ SetCCallRegParamAddr(reg, param_byte_offset, arg_type);
-      } else {
-        DCHECK(loc.IsCallerFrameSlot());
-        __ SetCCallStackParamAddr(num_stack_params, param_byte_offset,
-                                  arg_type);
-        ++num_stack_params;
-      }
-    };
-    for (ValueType arg_type : sig->parameters()) {
-      add_argument(arg_type);
-    }
-    if (has_out_argument) {
-      add_argument(out_argument_type);
-    }
-    DCHECK_EQ(input_idx, call_descriptor->InputCount());
-
-    // Now execute the call.
-    uint32_t c_call_arg_count =
-        static_cast<uint32_t>(sig->parameter_count()) + has_out_argument;
-    __ CallC(ext_ref, c_call_arg_count);
-
-    // Reset the stack pointer.
-    __ FinishCCall();
-
-    // Load return value.
-    const LiftoffRegister* next_result_reg = result_regs;
-    if (sig->return_count() > 0) {
-      DCHECK_EQ(1, sig->return_count());
-      compiler::LinkageLocation return_loc =
-          call_descriptor->GetReturnLocation(0);
-      DCHECK(return_loc.IsRegister());
-      Register return_reg = Register::from_code(return_loc.AsRegister());
-      if (return_reg != next_result_reg->gp()) {
-        __ Move(*next_result_reg, LiftoffRegister(return_reg),
-                sig->GetReturn(0));
-      }
-      ++next_result_reg;
-    }
-
-    // Load potential return value from output argument.
-    if (has_out_argument) {
-      __ LoadCCallOutArgument(*next_result_reg, out_argument_type,
-                              param_byte_offset);
+    int param_bytes = 0;
+    for (ValueType param_type : sig->parameters()) {
+      param_bytes += ValueTypes::MemSize(param_type);
     }
+    int out_arg_bytes = out_argument_type == kWasmStmt
+                            ? 0
+                            : ValueTypes::MemSize(out_argument_type);
+    int stack_bytes = std::max(param_bytes, out_arg_bytes);
+    __ CallC(sig, arg_regs, result_regs, out_argument_type, stack_bytes,
+             ext_ref);
   }
 
   template <ValueType src_type, ValueType result_type, class EmitFn>
   void EmitUnOp(EmitFn fn) {
     static RegClass src_rc = reg_class_for(src_type);
     static RegClass result_rc = reg_class_for(result_type);
-    LiftoffRegList pinned;
-    LiftoffRegister src = pinned.set(__ PopToRegister(pinned));
+    LiftoffRegister src = __ PopToRegister();
     LiftoffRegister dst = src_rc == result_rc
-                              ? __ GetUnusedRegister(result_rc, {src}, pinned)
-                              : __ GetUnusedRegister(result_rc, pinned);
+                              ? __ GetUnusedRegister(result_rc, {src})
+                              : __ GetUnusedRegister(result_rc);
     fn(dst, src);
     __ PushRegister(result_type, dst);
   }
 
   void EmitI32UnOpWithCFallback(bool (LiftoffAssembler::*emit_fn)(Register,
                                                                   Register),
-                                ExternalReference (*fallback_fn)(Isolate*)) {
+                                ExternalReference (*fallback_fn)()) {
     auto emit_with_c_fallback = [=](LiftoffRegister dst, LiftoffRegister src) {
-      if (emit_fn && (asm_->*emit_fn)(dst.gp(), src.gp())) return;
-      ExternalReference ext_ref = fallback_fn(asm_->isolate());
+      if (emit_fn && (asm_.*emit_fn)(dst.gp(), src.gp())) return;
+      ExternalReference ext_ref = fallback_fn();
       ValueType sig_i_i_reps[] = {kWasmI32, kWasmI32};
       FunctionSig sig_i_i(1, 1, sig_i_i_reps);
       GenerateCCall(&dst, &sig_i_i, kWasmStmt, &src, ext_ref);
@@ -641,22 +563,52 @@ class LiftoffCompiler {
     EmitUnOp<kWasmI32, kWasmI32>(emit_with_c_fallback);
   }
 
-  void EmitTypeConversion(WasmOpcode opcode, ValueType dst_type,
-                          ValueType src_type,
-                          ExternalReference (*fallback_fn)(Isolate*)) {
-    RegClass src_rc = reg_class_for(src_type);
-    RegClass dst_rc = reg_class_for(dst_type);
-    LiftoffRegList pinned;
-    LiftoffRegister src = pinned.set(__ PopToRegister());
-    LiftoffRegister dst = src_rc == dst_rc
-                              ? __ GetUnusedRegister(dst_rc, {src}, pinned)
-                              : __ GetUnusedRegister(dst_rc, pinned);
-    if (!__ emit_type_conversion(opcode, dst, src)) {
-      DCHECK_NOT_NULL(fallback_fn);
-      ExternalReference ext_ref = fallback_fn(asm_->isolate());
-      ValueType sig_reps[] = {src_type};
+  template <ValueType type>
+  void EmitFloatUnOpWithCFallback(
+      bool (LiftoffAssembler::*emit_fn)(DoubleRegister, DoubleRegister),
+      ExternalReference (*fallback_fn)()) {
+    auto emit_with_c_fallback = [=](LiftoffRegister dst, LiftoffRegister src) {
+      if ((asm_.*emit_fn)(dst.fp(), src.fp())) return;
+      ExternalReference ext_ref = fallback_fn();
+      ValueType sig_reps[] = {type};
       FunctionSig sig(0, 1, sig_reps);
-      GenerateCCall(&dst, &sig, dst_type, &src, ext_ref);
+      GenerateCCall(&dst, &sig, type, &src, ext_ref);
+    };
+    EmitUnOp<type, type>(emit_with_c_fallback);
+  }
+
+  enum TypeConversionTrapping : bool { kCanTrap = true, kNoTrap = false };
+  template <ValueType dst_type, ValueType src_type,
+            TypeConversionTrapping can_trap>
+  void EmitTypeConversion(WasmOpcode opcode, ExternalReference (*fallback_fn)(),
+                          WasmCodePosition trap_position) {
+    static constexpr RegClass src_rc = reg_class_for(src_type);
+    static constexpr RegClass dst_rc = reg_class_for(dst_type);
+    LiftoffRegister src = __ PopToRegister();
+    LiftoffRegister dst = src_rc == dst_rc ? __ GetUnusedRegister(dst_rc, {src})
+                                           : __ GetUnusedRegister(dst_rc);
+    DCHECK_EQ(can_trap, trap_position > 0);
+    Label* trap = can_trap ? AddOutOfLineTrap(
+                                 trap_position,
+                                 WasmCode::kThrowWasmTrapFloatUnrepresentable)
+                           : nullptr;
+    if (!__ emit_type_conversion(opcode, dst, src, trap)) {
+      DCHECK_NOT_NULL(fallback_fn);
+      ExternalReference ext_ref = fallback_fn();
+      if (can_trap) {
+        // External references for potentially trapping conversions return int.
+        ValueType sig_reps[] = {kWasmI32, src_type};
+        FunctionSig sig(1, 1, sig_reps);
+        LiftoffRegister ret_reg =
+            __ GetUnusedRegister(kGpReg, LiftoffRegList::ForRegs(dst));
+        LiftoffRegister dst_regs[] = {ret_reg, dst};
+        GenerateCCall(dst_regs, &sig, dst_type, &src, ext_ref);
+        __ emit_cond_jump(kEqual, trap, kWasmI32, ret_reg.gp());
+      } else {
+        ValueType sig_reps[] = {src_type};
+        FunctionSig sig(0, 1, sig_reps);
+        GenerateCCall(&dst, &sig, dst_type, &src, ext_ref);
+      }
     }
     __ PushRegister(dst_type, dst);
   }
@@ -677,10 +629,13 @@ class LiftoffCompiler {
           __ emit_##fn(dst.fp(), src.fp());             \
         });                                             \
     break;
-#define CASE_TYPE_CONVERSION(opcode, dst_type, src_type, ext_ref)       \
-  case WasmOpcode::kExpr##opcode:                                       \
-    EmitTypeConversion(kExpr##opcode, kWasm##dst_type, kWasm##src_type, \
-                       ext_ref);                                        \
+#define CASE_FLOAT_UNOP_WITH_CFALLBACK(type, fn)                        \
+  EmitFloatUnOpWithCFallback<kWasm##type>(&LiftoffAssembler::emit_##fn, \
+                                          &ExternalReference::wasm_##fn);
+#define CASE_TYPE_CONVERSION(opcode, dst_type, src_type, ext_ref, can_trap) \
+  case WasmOpcode::kExpr##opcode:                                           \
+    EmitTypeConversion<kWasm##dst_type, kWasm##src_type, can_trap>(         \
+        kExpr##opcode, ext_ref, can_trap ? decoder->position() : 0);        \
     break;
     switch (opcode) {
       CASE_I32_UNOP(I32Eqz, i32_eqz)
@@ -695,32 +650,44 @@ class LiftoffCompiler {
       CASE_FLOAT_UNOP(F32Sqrt, F32, f32_sqrt)
       CASE_FLOAT_UNOP(F64Abs, F64, f64_abs)
       CASE_FLOAT_UNOP(F64Neg, F64, f64_neg)
-      CASE_FLOAT_UNOP(F64Ceil, F64, f64_ceil)
-      CASE_FLOAT_UNOP(F64Floor, F64, f64_floor)
-      CASE_FLOAT_UNOP(F64Trunc, F64, f64_trunc)
-      CASE_FLOAT_UNOP(F64NearestInt, F64, f64_nearest_int)
+      CASE_FLOAT_UNOP_WITH_CFALLBACK(F64, f64_ceil)
+      CASE_FLOAT_UNOP_WITH_CFALLBACK(F64, f64_floor)
+      CASE_FLOAT_UNOP_WITH_CFALLBACK(F64, f64_trunc)
+      CASE_FLOAT_UNOP_WITH_CFALLBACK(F64, f64_nearest_int)
       CASE_FLOAT_UNOP(F64Sqrt, F64, f64_sqrt)
-      CASE_TYPE_CONVERSION(I32ConvertI64, I32, I64, nullptr)
-      CASE_TYPE_CONVERSION(I32ReinterpretF32, I32, F32, nullptr)
-      CASE_TYPE_CONVERSION(I64SConvertI32, I64, I32, nullptr)
-      CASE_TYPE_CONVERSION(I64UConvertI32, I64, I32, nullptr)
-      CASE_TYPE_CONVERSION(I64ReinterpretF64, I64, F64, nullptr)
-      CASE_TYPE_CONVERSION(F32SConvertI32, F32, I32, nullptr)
-      CASE_TYPE_CONVERSION(F32UConvertI32, F32, I32, nullptr)
+      CASE_TYPE_CONVERSION(I32ConvertI64, I32, I64, nullptr, kNoTrap)
+      CASE_TYPE_CONVERSION(I32SConvertF32, I32, F32, nullptr, kCanTrap)
+      CASE_TYPE_CONVERSION(I32UConvertF32, I32, F32, nullptr, kCanTrap)
+      CASE_TYPE_CONVERSION(I32SConvertF64, I32, F64, nullptr, kCanTrap)
+      CASE_TYPE_CONVERSION(I32UConvertF64, I32, F64, nullptr, kCanTrap)
+      CASE_TYPE_CONVERSION(I32ReinterpretF32, I32, F32, nullptr, kNoTrap)
+      CASE_TYPE_CONVERSION(I64SConvertI32, I64, I32, nullptr, kNoTrap)
+      CASE_TYPE_CONVERSION(I64UConvertI32, I64, I32, nullptr, kNoTrap)
+      CASE_TYPE_CONVERSION(I64SConvertF32, I64, F32,
+                           &ExternalReference::wasm_float32_to_int64, kCanTrap)
+      CASE_TYPE_CONVERSION(I64UConvertF32, I64, F32,
+                           &ExternalReference::wasm_float32_to_uint64, kCanTrap)
+      CASE_TYPE_CONVERSION(I64SConvertF64, I64, F64,
+                           &ExternalReference::wasm_float64_to_int64, kCanTrap)
+      CASE_TYPE_CONVERSION(I64UConvertF64, I64, F64,
+                           &ExternalReference::wasm_float64_to_uint64, kCanTrap)
+      CASE_TYPE_CONVERSION(I64ReinterpretF64, I64, F64, nullptr, kNoTrap)
+      CASE_TYPE_CONVERSION(F32SConvertI32, F32, I32, nullptr, kNoTrap)
+      CASE_TYPE_CONVERSION(F32UConvertI32, F32, I32, nullptr, kNoTrap)
       CASE_TYPE_CONVERSION(F32SConvertI64, F32, I64,
-                           &ExternalReference::wasm_int64_to_float32)
+                           &ExternalReference::wasm_int64_to_float32, kNoTrap)
       CASE_TYPE_CONVERSION(F32UConvertI64, F32, I64,
-                           &ExternalReference::wasm_uint64_to_float32)
-      CASE_TYPE_CONVERSION(F32ConvertF64, F32, F64, nullptr)
-      CASE_TYPE_CONVERSION(F32ReinterpretI32, F32, I32, nullptr)
-      CASE_TYPE_CONVERSION(F64SConvertI32, F64, I32, nullptr)
-      CASE_TYPE_CONVERSION(F64UConvertI32, F64, I32, nullptr)
+                           &ExternalReference::wasm_uint64_to_float32, kNoTrap)
+      CASE_TYPE_CONVERSION(F32ConvertF64, F32, F64, nullptr, kNoTrap)
+      CASE_TYPE_CONVERSION(F32ReinterpretI32, F32, I32, nullptr, kNoTrap)
+      CASE_TYPE_CONVERSION(F64SConvertI32, F64, I32, nullptr, kNoTrap)
+      CASE_TYPE_CONVERSION(F64UConvertI32, F64, I32, nullptr, kNoTrap)
       CASE_TYPE_CONVERSION(F64SConvertI64, F64, I64,
-                           &ExternalReference::wasm_int64_to_float64)
+                           &ExternalReference::wasm_int64_to_float64, kNoTrap)
       CASE_TYPE_CONVERSION(F64UConvertI64, F64, I64,
-                           &ExternalReference::wasm_uint64_to_float64)
-      CASE_TYPE_CONVERSION(F64ConvertF32, F64, F32, nullptr)
-      CASE_TYPE_CONVERSION(F64ReinterpretI64, F64, I64, nullptr)
+                           &ExternalReference::wasm_uint64_to_float64, kNoTrap)
+      CASE_TYPE_CONVERSION(F64ConvertF32, F64, F32, nullptr, kNoTrap)
+      CASE_TYPE_CONVERSION(F64ReinterpretI64, F64, I64, nullptr, kNoTrap)
       case kExprI32Popcnt:
         EmitI32UnOpWithCFallback(&LiftoffAssembler::emit_i32_popcnt,
                                  &ExternalReference::wasm_word32_popcnt);
@@ -736,6 +703,7 @@ class LiftoffCompiler {
     }
 #undef CASE_I32_UNOP
 #undef CASE_FLOAT_UNOP
+#undef CASE_FLOAT_UNOP_WITH_CFALLBACK
 #undef CASE_TYPE_CONVERSION
   }
 
@@ -743,17 +711,39 @@ class LiftoffCompiler {
   void EmitBinOp(EmitFn fn) {
     static constexpr RegClass src_rc = reg_class_for(src_type);
     static constexpr RegClass result_rc = reg_class_for(result_type);
-    LiftoffRegList pinned;
-    LiftoffRegister rhs = pinned.set(__ PopToRegister(pinned));
-    LiftoffRegister lhs = pinned.set(__ PopToRegister(pinned));
-    LiftoffRegister dst =
-        src_rc == result_rc
-            ? __ GetUnusedRegister(result_rc, {lhs, rhs}, pinned)
-            : __ GetUnusedRegister(result_rc);
+    LiftoffRegister rhs = __ PopToRegister();
+    LiftoffRegister lhs = __ PopToRegister(LiftoffRegList::ForRegs(rhs));
+    LiftoffRegister dst = src_rc == result_rc
+                              ? __ GetUnusedRegister(result_rc, {lhs, rhs})
+                              : __ GetUnusedRegister(result_rc);
     fn(dst, lhs, rhs);
     __ PushRegister(result_type, dst);
   }
 
+  void EmitDivOrRem64CCall(LiftoffRegister dst, LiftoffRegister lhs,
+                           LiftoffRegister rhs, ExternalReference ext_ref,
+                           Label* trap_by_zero,
+                           Label* trap_unrepresentable = nullptr) {
+    // Cannot emit native instructions, build C call.
+    LiftoffRegister ret =
+        __ GetUnusedRegister(kGpReg, LiftoffRegList::ForRegs(dst));
+    LiftoffRegister tmp =
+        __ GetUnusedRegister(kGpReg, LiftoffRegList::ForRegs(dst, ret));
+    LiftoffRegister arg_regs[] = {lhs, rhs};
+    LiftoffRegister result_regs[] = {ret, dst};
+    ValueType sig_types[] = {kWasmI32, kWasmI64, kWasmI64};
+    // <i64, i64> -> i32 (with i64 output argument)
+    FunctionSig sig(1, 2, sig_types);
+    GenerateCCall(result_regs, &sig, kWasmI64, arg_regs, ext_ref);
+    __ LoadConstant(tmp, WasmValue(int32_t{0}));
+    __ emit_cond_jump(kEqual, trap_by_zero, kWasmI32, ret.gp(), tmp.gp());
+    if (trap_unrepresentable) {
+      __ LoadConstant(tmp, WasmValue(int32_t{-1}));
+      __ emit_cond_jump(kEqual, trap_unrepresentable, kWasmI32, ret.gp(),
+                        tmp.gp());
+    }
+  }
+
   void BinOp(Decoder* decoder, WasmOpcode opcode, FunctionSig*,
              const Value& lhs, const Value& rhs, Value* result) {
 #define CASE_I32_BINOP(opcode, fn)                                           \
@@ -817,7 +807,7 @@ class LiftoffCompiler {
     return EmitBinOp<kWasmI32, kWasmI32>(                                    \
         [=](LiftoffRegister dst, LiftoffRegister lhs, LiftoffRegister rhs) { \
           LiftoffRegister args[] = {lhs, rhs};                               \
-          auto ext_ref = ExternalReference::ext_ref_fn(__ isolate());        \
+          auto ext_ref = ExternalReference::ext_ref_fn();                    \
           ValueType sig_i_ii_reps[] = {kWasmI32, kWasmI32, kWasmI32};        \
           FunctionSig sig_i_ii(1, 2, sig_i_ii_reps);                         \
           GenerateCCall(&dst, &sig_i_ii, kWasmStmt, args, ext_ref);          \
@@ -844,6 +834,7 @@ class LiftoffCompiler {
       CASE_I32_CMPOP(I32GeU, kUnsignedGreaterEqual)
       CASE_I64_BINOP(I64Add, i64_add)
       CASE_I64_BINOP(I64Sub, i64_sub)
+      CASE_I64_BINOP(I64Mul, i64_mul)
       CASE_I64_CMPOP(I64Eq, kEqual)
       CASE_I64_CMPOP(I64Ne, kUnequal)
       CASE_I64_CMPOP(I64LtS, kSignedLessThan)
@@ -878,10 +869,113 @@ class LiftoffCompiler {
       CASE_FLOAT_BINOP(F32Sub, F32, f32_sub)
       CASE_FLOAT_BINOP(F32Mul, F32, f32_mul)
       CASE_FLOAT_BINOP(F32Div, F32, f32_div)
+      CASE_FLOAT_BINOP(F32Min, F32, f32_min)
+      CASE_FLOAT_BINOP(F32Max, F32, f32_max)
       CASE_FLOAT_BINOP(F64Add, F64, f64_add)
       CASE_FLOAT_BINOP(F64Sub, F64, f64_sub)
       CASE_FLOAT_BINOP(F64Mul, F64, f64_mul)
       CASE_FLOAT_BINOP(F64Div, F64, f64_div)
+      CASE_FLOAT_BINOP(F64Min, F64, f64_min)
+      CASE_FLOAT_BINOP(F64Max, F64, f64_max)
+      case WasmOpcode::kExprI32DivS:
+        EmitBinOp<kWasmI32, kWasmI32>([this, decoder](LiftoffRegister dst,
+                                                      LiftoffRegister lhs,
+                                                      LiftoffRegister rhs) {
+          WasmCodePosition position = decoder->position();
+          AddOutOfLineTrap(position, WasmCode::kThrowWasmTrapDivByZero);
+          // Adding the second trap might invalidate the pointer returned for
+          // the first one, thus get both pointers afterwards.
+          AddOutOfLineTrap(position,
+                           WasmCode::kThrowWasmTrapDivUnrepresentable);
+          Label* div_by_zero = out_of_line_code_.end()[-2].label.get();
+          Label* div_unrepresentable = out_of_line_code_.end()[-1].label.get();
+          __ emit_i32_divs(dst.gp(), lhs.gp(), rhs.gp(), div_by_zero,
+                           div_unrepresentable);
+        });
+        break;
+      case WasmOpcode::kExprI32DivU:
+        EmitBinOp<kWasmI32, kWasmI32>([this, decoder](LiftoffRegister dst,
+                                                      LiftoffRegister lhs,
+                                                      LiftoffRegister rhs) {
+          Label* div_by_zero = AddOutOfLineTrap(
+              decoder->position(), WasmCode::kThrowWasmTrapDivByZero);
+          __ emit_i32_divu(dst.gp(), lhs.gp(), rhs.gp(), div_by_zero);
+        });
+        break;
+      case WasmOpcode::kExprI32RemS:
+        EmitBinOp<kWasmI32, kWasmI32>([this, decoder](LiftoffRegister dst,
+                                                      LiftoffRegister lhs,
+                                                      LiftoffRegister rhs) {
+          Label* rem_by_zero = AddOutOfLineTrap(
+              decoder->position(), WasmCode::kThrowWasmTrapRemByZero);
+          __ emit_i32_rems(dst.gp(), lhs.gp(), rhs.gp(), rem_by_zero);
+        });
+        break;
+      case WasmOpcode::kExprI32RemU:
+        EmitBinOp<kWasmI32, kWasmI32>([this, decoder](LiftoffRegister dst,
+                                                      LiftoffRegister lhs,
+                                                      LiftoffRegister rhs) {
+          Label* rem_by_zero = AddOutOfLineTrap(
+              decoder->position(), WasmCode::kThrowWasmTrapRemByZero);
+          __ emit_i32_remu(dst.gp(), lhs.gp(), rhs.gp(), rem_by_zero);
+        });
+        break;
+      case WasmOpcode::kExprI64DivS:
+        EmitBinOp<kWasmI64, kWasmI64>([this, decoder](LiftoffRegister dst,
+                                                      LiftoffRegister lhs,
+                                                      LiftoffRegister rhs) {
+          WasmCodePosition position = decoder->position();
+          AddOutOfLineTrap(position, WasmCode::kThrowWasmTrapDivByZero);
+          // Adding the second trap might invalidate the pointer returned for
+          // the first one, thus get both pointers afterwards.
+          AddOutOfLineTrap(position,
+                           WasmCode::kThrowWasmTrapDivUnrepresentable);
+          Label* div_by_zero = out_of_line_code_.end()[-2].label.get();
+          Label* div_unrepresentable = out_of_line_code_.end()[-1].label.get();
+          if (!__ emit_i64_divs(dst, lhs, rhs, div_by_zero,
+                                div_unrepresentable)) {
+            ExternalReference ext_ref = ExternalReference::wasm_int64_div();
+            EmitDivOrRem64CCall(dst, lhs, rhs, ext_ref, div_by_zero,
+                                div_unrepresentable);
+          }
+        });
+        break;
+      case WasmOpcode::kExprI64DivU:
+        EmitBinOp<kWasmI64, kWasmI64>([this, decoder](LiftoffRegister dst,
+                                                      LiftoffRegister lhs,
+                                                      LiftoffRegister rhs) {
+          Label* div_by_zero = AddOutOfLineTrap(
+              decoder->position(), WasmCode::kThrowWasmTrapDivByZero);
+          if (!__ emit_i64_divu(dst, lhs, rhs, div_by_zero)) {
+            ExternalReference ext_ref = ExternalReference::wasm_uint64_div();
+            EmitDivOrRem64CCall(dst, lhs, rhs, ext_ref, div_by_zero);
+          }
+        });
+        break;
+      case WasmOpcode::kExprI64RemS:
+        EmitBinOp<kWasmI64, kWasmI64>([this, decoder](LiftoffRegister dst,
+                                                      LiftoffRegister lhs,
+                                                      LiftoffRegister rhs) {
+          Label* rem_by_zero = AddOutOfLineTrap(
+              decoder->position(), WasmCode::kThrowWasmTrapRemByZero);
+          if (!__ emit_i64_rems(dst, lhs, rhs, rem_by_zero)) {
+            ExternalReference ext_ref = ExternalReference::wasm_int64_mod();
+            EmitDivOrRem64CCall(dst, lhs, rhs, ext_ref, rem_by_zero);
+          }
+        });
+        break;
+      case WasmOpcode::kExprI64RemU:
+        EmitBinOp<kWasmI64, kWasmI64>([this, decoder](LiftoffRegister dst,
+                                                      LiftoffRegister lhs,
+                                                      LiftoffRegister rhs) {
+          Label* rem_by_zero = AddOutOfLineTrap(
+              decoder->position(), WasmCode::kThrowWasmTrapRemByZero);
+          if (!__ emit_i64_remu(dst, lhs, rhs, rem_by_zero)) {
+            ExternalReference ext_ref = ExternalReference::wasm_uint64_mod();
+            EmitDivOrRem64CCall(dst, lhs, rhs, ext_ref, rem_by_zero);
+          }
+        });
+        break;
       default:
         return unsupported(decoder, WasmOpcodes::OpcodeName(opcode));
     }
@@ -933,7 +1027,9 @@ class LiftoffCompiler {
   }
 
   void Drop(Decoder* decoder, const Value& value) {
-    __ DropStackSlot(&__ cache_state()->stack_state.back());
+    auto& slot = __ cache_state()->stack_state.back();
+    // If the dropped slot contains a register, decrement it's use count.
+    if (slot.is_reg()) __ cache_state()->dec_used(slot.reg());
     __ cache_state()->stack_state.pop_back();
   }
 
@@ -947,7 +1043,14 @@ class LiftoffCompiler {
     if (!values.is_empty()) {
       if (values.size() > 1) return unsupported(decoder, "multi-return");
       LiftoffRegister reg = __ PopToRegister();
-      __ MoveToReturnRegister(reg, values[0].type);
+      LiftoffRegister return_reg =
+          kNeedI64RegPair && values[0].type == kWasmI64
+              ? LiftoffRegister::ForPair(kGpReturnRegisters[0],
+                                         kGpReturnRegisters[1])
+              : reg_class_for(values[0].type) == kGpReg
+                    ? LiftoffRegister(kGpReturnRegisters[0])
+                    : LiftoffRegister(kFpReturnRegisters[0]);
+      if (reg != return_reg) __ Move(return_reg, reg, values[0].type);
     }
     __ LeaveFrame(StackFrame::WASM_COMPILED);
     __ DropStackSlotsAndRet(
@@ -955,21 +1058,20 @@ class LiftoffCompiler {
   }
 
   void GetLocal(Decoder* decoder, Value* result,
-                const LocalIndexOperand<validate>& operand) {
-    auto& slot = __ cache_state()->stack_state[operand.index];
-    DCHECK_EQ(slot.type(), operand.type);
+                const LocalIndexImmediate<validate>& imm) {
+    auto& slot = __ cache_state()->stack_state[imm.index];
+    DCHECK_EQ(slot.type(), imm.type);
     switch (slot.loc()) {
       case kRegister:
         __ PushRegister(slot.type(), slot.reg());
         break;
       case KIntConst:
-        __ cache_state()->stack_state.emplace_back(operand.type,
-                                                   slot.i32_const());
+        __ cache_state()->stack_state.emplace_back(imm.type, slot.i32_const());
         break;
       case kStack: {
-        auto rc = reg_class_for(operand.type);
+        auto rc = reg_class_for(imm.type);
         LiftoffRegister reg = __ GetUnusedRegister(rc);
-        __ Fill(reg, operand.index, operand.type);
+        __ Fill(reg, imm.index, imm.type);
         __ PushRegister(slot.type(), reg);
         break;
       }
@@ -987,6 +1089,7 @@ class LiftoffCompiler {
         return;
       }
       state.dec_used(slot_reg);
+      dst_slot.MakeStack();
     }
     DCHECK_EQ(type, __ local_type(local_index));
     RegClass rc = reg_class_for(type);
@@ -1002,12 +1105,12 @@ class LiftoffCompiler {
     auto& target_slot = state.stack_state[local_index];
     switch (source_slot.loc()) {
       case kRegister:
-        __ DropStackSlot(&target_slot);
+        if (target_slot.is_reg()) state.dec_used(target_slot.reg());
         target_slot = source_slot;
         if (is_tee) state.inc_used(target_slot.reg());
         break;
       case KIntConst:
-        __ DropStackSlot(&target_slot);
+        if (target_slot.is_reg()) state.dec_used(target_slot.reg());
         target_slot = source_slot;
         break;
       case kStack:
@@ -1018,48 +1121,90 @@ class LiftoffCompiler {
   }
 
   void SetLocal(Decoder* decoder, const Value& value,
-                const LocalIndexOperand<validate>& operand) {
-    SetLocal(operand.index, false);
+                const LocalIndexImmediate<validate>& imm) {
+    SetLocal(imm.index, false);
   }
 
   void TeeLocal(Decoder* decoder, const Value& value, Value* result,
-                const LocalIndexOperand<validate>& operand) {
-    SetLocal(operand.index, true);
+                const LocalIndexImmediate<validate>& imm) {
+    SetLocal(imm.index, true);
+  }
+
+  LiftoffRegister GetGlobalBaseAndOffset(const WasmGlobal* global,
+                                         LiftoffRegList& pinned,
+                                         uint32_t* offset) {
+    LiftoffRegister addr = pinned.set(__ GetUnusedRegister(kGpReg));
+    if (global->mutability && global->imported) {
+      DCHECK(FLAG_experimental_wasm_mut_global);
+      LOAD_INSTANCE_FIELD(addr, ImportedMutableGlobals, kPointerLoadType);
+      __ Load(addr, addr.gp(), no_reg, global->index * sizeof(Address),
+              kPointerLoadType, pinned);
+      *offset = 0;
+    } else {
+      LOAD_INSTANCE_FIELD(addr, GlobalsStart, kPointerLoadType);
+      *offset = global->offset;
+    }
+    return addr;
   }
 
   void GetGlobal(Decoder* decoder, Value* result,
-                 const GlobalIndexOperand<validate>& operand) {
-    const auto* global = &env_->module->globals[operand.index];
+                 const GlobalIndexImmediate<validate>& imm) {
+    const auto* global = &env_->module->globals[imm.index];
     if (!CheckSupportedType(decoder, kTypes_ilfd, global->type, "global"))
       return;
     LiftoffRegList pinned;
-    LiftoffRegister addr = pinned.set(__ GetUnusedRegister(kGpReg));
-    LOAD_INSTANCE_FIELD(addr, GlobalsStart, kPointerLoadType);
+    uint32_t offset = 0;
+    LiftoffRegister addr = GetGlobalBaseAndOffset(global, pinned, &offset);
     LiftoffRegister value =
         pinned.set(__ GetUnusedRegister(reg_class_for(global->type), pinned));
     LoadType type = LoadType::ForValueType(global->type);
-    __ Load(value, addr.gp(), no_reg, global->offset, type, pinned);
+    __ Load(value, addr.gp(), no_reg, offset, type, pinned);
     __ PushRegister(global->type, value);
   }
 
   void SetGlobal(Decoder* decoder, const Value& value,
-                 const GlobalIndexOperand<validate>& operand) {
-    auto* global = &env_->module->globals[operand.index];
+                 const GlobalIndexImmediate<validate>& imm) {
+    auto* global = &env_->module->globals[imm.index];
     if (!CheckSupportedType(decoder, kTypes_ilfd, global->type, "global"))
       return;
     LiftoffRegList pinned;
-    LiftoffRegister addr = pinned.set(__ GetUnusedRegister(kGpReg));
-    LOAD_INSTANCE_FIELD(addr, GlobalsStart, kPointerLoadType);
+    uint32_t offset = 0;
+    LiftoffRegister addr = GetGlobalBaseAndOffset(global, pinned, &offset);
     LiftoffRegister reg = pinned.set(__ PopToRegister(pinned));
     StoreType type = StoreType::ForValueType(global->type);
-    __ Store(addr.gp(), no_reg, global->offset, reg, type, pinned);
+    __ Store(addr.gp(), no_reg, offset, reg, type, pinned);
   }
 
-  void Unreachable(Decoder* decoder) { unsupported(decoder, "unreachable"); }
+  void Unreachable(Decoder* decoder) {
+    Label* unreachable_label = AddOutOfLineTrap(
+        decoder->position(), WasmCode::kThrowWasmTrapUnreachable);
+    __ emit_jump(unreachable_label);
+    __ AssertUnreachable(AbortReason::kUnexpectedReturnFromWasmTrap);
+  }
 
   void Select(Decoder* decoder, const Value& cond, const Value& fval,
               const Value& tval, Value* result) {
-    unsupported(decoder, "select");
+    LiftoffRegList pinned;
+    Register condition = pinned.set(__ PopToRegister()).gp();
+    ValueType type = __ cache_state()->stack_state.end()[-1].type();
+    DCHECK_EQ(type, __ cache_state()->stack_state.end()[-2].type());
+    LiftoffRegister false_value = pinned.set(__ PopToRegister(pinned));
+    LiftoffRegister true_value = __ PopToRegister(pinned);
+    LiftoffRegister dst =
+        __ GetUnusedRegister(true_value.reg_class(), {true_value, false_value});
+    __ PushRegister(type, dst);
+
+    // Now emit the actual code to move either {true_value} or {false_value}
+    // into {dst}.
+    Label cont;
+    Label case_false;
+    __ emit_cond_jump(kEqual, &case_false, kWasmI32, condition);
+    if (dst != true_value) __ Move(dst, true_value, type);
+    __ emit_jump(&cont);
+
+    __ bind(&case_false);
+    if (dst != false_value) __ Move(dst, false_value, type);
+    __ bind(&cont);
   }
 
   void Br(Control* target) {
@@ -1125,22 +1270,22 @@ class LiftoffCompiler {
                     br_targets);
   }
 
-  void BrTable(Decoder* decoder, const BranchTableOperand<validate>& operand,
+  void BrTable(Decoder* decoder, const BranchTableImmediate<validate>& imm,
                const Value& key) {
     LiftoffRegList pinned;
     LiftoffRegister value = pinned.set(__ PopToRegister());
-    BranchTableIterator<validate> table_iterator(decoder, operand);
+    BranchTableIterator<validate> table_iterator(decoder, imm);
     std::map<uint32_t, MovableLabel> br_targets;
 
-    if (operand.table_count > 0) {
+    if (imm.table_count > 0) {
       LiftoffRegister tmp = __ GetUnusedRegister(kGpReg, pinned);
-      __ LoadConstant(tmp, WasmValue(uint32_t{operand.table_count}));
+      __ LoadConstant(tmp, WasmValue(uint32_t{imm.table_count}));
       Label case_default;
       __ emit_cond_jump(kUnsignedGreaterEqual, &case_default, kWasmI32,
                         value.gp(), tmp.gp());
 
-      GenerateBrTable(decoder, tmp, value, 0, operand.table_count,
-                      table_iterator, br_targets);
+      GenerateBrTable(decoder, tmp, value, 0, imm.table_count, table_iterator,
+                      br_targets);
 
       __ bind(&case_default);
     }
@@ -1156,15 +1301,15 @@ class LiftoffCompiler {
     __ cache_state()->Steal(if_block->else_state->state);
   }
 
-  Label* AddOutOfLineTrap(wasm::WasmCodePosition position,
-                          Builtins::Name builtin, uint32_t pc = 0) {
+  Label* AddOutOfLineTrap(WasmCodePosition position,
+                          WasmCode::RuntimeStubId stub, uint32_t pc = 0) {
     DCHECK(!FLAG_wasm_no_bounds_checks);
     // The pc is needed for memory OOB trap with trap handler enabled. Other
     // callers should not even compute it.
-    DCHECK_EQ(pc != 0, builtin == Builtins::kThrowWasmTrapMemOutOfBounds &&
+    DCHECK_EQ(pc != 0, stub == WasmCode::kThrowWasmTrapMemOutOfBounds &&
                            env_->use_trap_handler);
 
-    out_of_line_code_.push_back(OutOfLineCode::Trap(builtin, position, pc));
+    out_of_line_code_.push_back(OutOfLineCode::Trap(stub, position, pc));
     return out_of_line_code_.back().label.get();
   }
 
@@ -1184,7 +1329,7 @@ class LiftoffCompiler {
     // instruction we are about to generate. It would be better to just not add
     // protected instruction info when the pc is 0.
     Label* trap_label = AddOutOfLineTrap(
-        decoder->position(), Builtins::kThrowWasmTrapMemOutOfBounds,
+        decoder->position(), WasmCode::kThrowWasmTrapMemOutOfBounds,
         env_->use_trap_handler ? __ pc_offset() : 0);
 
     if (statically_oob) {
@@ -1252,16 +1397,18 @@ class LiftoffCompiler {
     __ Store(info.gp(), no_reg, offsetof(wasm::MemoryTracingInfo, mem_rep),
              address, StoreType::kI32Store8, pinned);
 
-    source_position_table_builder_->AddPosition(
-        __ pc_offset(), SourcePosition(position), false);
+    source_position_table_builder_.AddPosition(__ pc_offset(),
+                                               SourcePosition(position), false);
 
     Register args[] = {info.gp()};
-    GenerateRuntimeCall(arraysize(args), args);
+    GenerateRuntimeCall(Runtime::kWasmTraceMemory, arraysize(args), args);
+    __ DeallocateStackSlot(sizeof(wasm::MemoryTracingInfo));
   }
 
-  void GenerateRuntimeCall(int num_args, Register* args) {
+  void GenerateRuntimeCall(Runtime::FunctionId runtime_function, int num_args,
+                           Register* args) {
     auto call_descriptor = compiler::Linkage::GetRuntimeCallDescriptor(
-        compilation_zone_, Runtime::kWasmTraceMemory, num_args,
+        compilation_zone_, runtime_function, num_args,
         compiler::Operator::kNoProperties, compiler::CallDescriptor::kNoFlags);
     // Currently, only one argument is supported. More arguments require some
     // caution for the parallel register moves (reuse StackTransferRecipe).
@@ -1275,99 +1422,166 @@ class LiftoffCompiler {
               LiftoffAssembler::kWasmIntPtr);
     } else {
       DCHECK(param_loc.IsCallerFrameSlot());
-      __ PushCallerFrameSlot(LiftoffRegister(args[0]),
-                             LiftoffAssembler::kWasmIntPtr);
+      LiftoffStackSlots stack_slots(&asm_);
+      stack_slots.Add(LiftoffAssembler::VarState(LiftoffAssembler::kWasmIntPtr,
+                                                 LiftoffRegister(args[0])));
+      stack_slots.Construct();
     }
 
-    // Allocate the codegen zone if not done before.
-    if (!*codegen_zone_) {
-      codegen_zone_->reset(
-          new Zone(__ isolate()->allocator(), "LiftoffCodegenZone"));
+    // Set context to zero (Smi::kZero) for the runtime call.
+    __ TurboAssembler::Move(kContextRegister, Smi::kZero);
+    LiftoffRegister centry(kJavaScriptCallCodeStartRegister);
+    LOAD_INSTANCE_FIELD(centry, CEntryStub, kPointerLoadType);
+    __ CallRuntimeWithCEntry(runtime_function, centry.gp());
+    safepoint_table_builder_.DefineSafepoint(&asm_, Safepoint::kSimple, 0,
+                                             Safepoint::kNoLazyDeopt);
+  }
+
+  LiftoffRegister AddMemoryMasking(LiftoffRegister index, uint32_t* offset,
+                                   LiftoffRegList& pinned) {
+    if (!FLAG_untrusted_code_mitigations || env_->use_trap_handler) {
+      return index;
     }
-    __ CallRuntime(codegen_zone_->get(), Runtime::kWasmTraceMemory);
-    __ DeallocateStackSlot(sizeof(wasm::MemoryTracingInfo));
+    DEBUG_CODE_COMMENT("Mask memory index");
+    // Make sure that we can overwrite {index}.
+    if (__ cache_state()->is_used(index)) {
+      LiftoffRegister old_index = index;
+      pinned.clear(old_index);
+      index = pinned.set(__ GetUnusedRegister(kGpReg, pinned));
+      if (index != old_index) __ Move(index.gp(), old_index.gp(), kWasmI32);
+    }
+    LiftoffRegister tmp = __ GetUnusedRegister(kGpReg, pinned);
+    __ LoadConstant(tmp, WasmValue(*offset));
+    __ emit_i32_add(index.gp(), index.gp(), tmp.gp());
+    LOAD_INSTANCE_FIELD(tmp, MemoryMask, LoadType::kI32Load);
+    __ emit_i32_and(index.gp(), index.gp(), tmp.gp());
+    *offset = 0;
+    return index;
   }
 
   void LoadMem(Decoder* decoder, LoadType type,
-               const MemoryAccessOperand<validate>& operand,
+               const MemoryAccessImmediate<validate>& imm,
                const Value& index_val, Value* result) {
     ValueType value_type = type.value_type();
     if (!CheckSupportedType(decoder, kTypes_ilfd, value_type, "load")) return;
     LiftoffRegList pinned;
-    Register index = pinned.set(__ PopToRegister()).gp();
-    if (BoundsCheckMem(decoder, type.size(), operand.offset, index, pinned)) {
+    LiftoffRegister index = pinned.set(__ PopToRegister());
+    if (BoundsCheckMem(decoder, type.size(), imm.offset, index.gp(), pinned)) {
       return;
     }
+    uint32_t offset = imm.offset;
+    index = AddMemoryMasking(index, &offset, pinned);
+    DEBUG_CODE_COMMENT("Load from memory");
     LiftoffRegister addr = pinned.set(__ GetUnusedRegister(kGpReg, pinned));
     LOAD_INSTANCE_FIELD(addr, MemoryStart, kPointerLoadType);
     RegClass rc = reg_class_for(value_type);
     LiftoffRegister value = pinned.set(__ GetUnusedRegister(rc, pinned));
     uint32_t protected_load_pc = 0;
-    __ Load(value, addr.gp(), index, operand.offset, type, pinned,
-            &protected_load_pc);
+    __ Load(value, addr.gp(), index.gp(), offset, type, pinned,
+            &protected_load_pc, true);
     if (env_->use_trap_handler) {
       AddOutOfLineTrap(decoder->position(),
-                       Builtins::kThrowWasmTrapMemOutOfBounds,
+                       WasmCode::kThrowWasmTrapMemOutOfBounds,
                        protected_load_pc);
     }
     __ PushRegister(value_type, value);
 
     if (FLAG_wasm_trace_memory) {
-      TraceMemoryOperation(false, type.mem_type().representation(), index,
-                           operand.offset, decoder->position());
+      TraceMemoryOperation(false, type.mem_type().representation(), index.gp(),
+                           offset, decoder->position());
     }
   }
 
   void StoreMem(Decoder* decoder, StoreType type,
-                const MemoryAccessOperand<validate>& operand,
+                const MemoryAccessImmediate<validate>& imm,
                 const Value& index_val, const Value& value_val) {
     ValueType value_type = type.value_type();
     if (!CheckSupportedType(decoder, kTypes_ilfd, value_type, "store")) return;
     LiftoffRegList pinned;
     LiftoffRegister value = pinned.set(__ PopToRegister());
-    Register index = pinned.set(__ PopToRegister(pinned)).gp();
-    if (BoundsCheckMem(decoder, type.size(), operand.offset, index, pinned)) {
+    LiftoffRegister index = pinned.set(__ PopToRegister(pinned));
+    if (BoundsCheckMem(decoder, type.size(), imm.offset, index.gp(), pinned)) {
       return;
     }
+    uint32_t offset = imm.offset;
+    index = AddMemoryMasking(index, &offset, pinned);
+    DEBUG_CODE_COMMENT("Store to memory");
     LiftoffRegister addr = pinned.set(__ GetUnusedRegister(kGpReg, pinned));
     LOAD_INSTANCE_FIELD(addr, MemoryStart, kPointerLoadType);
     uint32_t protected_store_pc = 0;
-    __ Store(addr.gp(), index, operand.offset, value, type, pinned,
-             &protected_store_pc);
+    __ Store(addr.gp(), index.gp(), offset, value, type, pinned,
+             &protected_store_pc, true);
     if (env_->use_trap_handler) {
       AddOutOfLineTrap(decoder->position(),
-                       Builtins::kThrowWasmTrapMemOutOfBounds,
+                       WasmCode::kThrowWasmTrapMemOutOfBounds,
                        protected_store_pc);
     }
     if (FLAG_wasm_trace_memory) {
-      TraceMemoryOperation(true, type.mem_rep(), index, operand.offset,
+      TraceMemoryOperation(true, type.mem_rep(), index.gp(), offset,
                            decoder->position());
     }
   }
 
   void CurrentMemoryPages(Decoder* decoder, Value* result) {
-    unsupported(decoder, "current_memory");
+    LiftoffRegList pinned;
+    LiftoffRegister mem_size = pinned.set(__ GetUnusedRegister(kGpReg));
+    LiftoffRegister tmp_const =
+        pinned.set(__ GetUnusedRegister(kGpReg, pinned));
+    LOAD_INSTANCE_FIELD(mem_size, MemorySize, LoadType::kI32Load);
+    // TODO(clemensh): Shift by immediate directly.
+    __ LoadConstant(tmp_const,
+                    WasmValue(int32_t{WhichPowerOf2(wasm::kWasmPageSize)}));
+    __ emit_i32_shr(mem_size.gp(), mem_size.gp(), tmp_const.gp(), pinned);
+    __ PushRegister(kWasmI32, mem_size);
   }
-  void GrowMemory(Decoder* decoder, const Value& value, Value* result) {
-    unsupported(decoder, "grow_memory");
+
+  void GrowMemory(Decoder* decoder, const Value& value, Value* result_val) {
+    // Pop the input, then spill all cache registers to make the runtime call.
+    LiftoffRegList pinned;
+    LiftoffRegister input = pinned.set(__ PopToRegister());
+    __ SpillAllRegisters();
+
+    constexpr Register kGpReturnReg = kGpReturnRegisters[0];
+    static_assert(kLiftoffAssemblerGpCacheRegs & Register::bit<kGpReturnReg>(),
+                  "first return register is a cache register (needs more "
+                  "complex code here otherwise)");
+    LiftoffRegister result = pinned.set(LiftoffRegister(kGpReturnReg));
+
+    WasmGrowMemoryDescriptor descriptor;
+    DCHECK_EQ(0, descriptor.GetStackParameterCount());
+    DCHECK_EQ(1, descriptor.GetRegisterParameterCount());
+    DCHECK_EQ(ValueTypes::MachineTypeFor(kWasmI32),
+              descriptor.GetParameterType(0));
+
+    Register param_reg = descriptor.GetRegisterParameter(0);
+    if (input.gp() != param_reg) __ Move(param_reg, input.gp(), kWasmI32);
+
+    __ CallRuntimeStub(wasm::WasmCode::kWasmGrowMemory);
+    safepoint_table_builder_.DefineSafepoint(&asm_, Safepoint::kSimple, 0,
+                                             Safepoint::kNoLazyDeopt);
+
+    if (kReturnRegister0 != result.gp()) {
+      __ Move(result.gp(), kReturnRegister0, kWasmI32);
+    }
+
+    __ PushRegister(kWasmI32, result);
   }
 
-  void CallDirect(Decoder* decoder,
-                  const CallFunctionOperand<validate>& operand,
+  void CallDirect(Decoder* decoder, const CallFunctionImmediate<validate>& imm,
                   const Value args[], Value returns[]) {
-    if (operand.sig->return_count() > 1)
+    if (imm.sig->return_count() > 1)
       return unsupported(decoder, "multi-return");
-    if (operand.sig->return_count() == 1 &&
-        !CheckSupportedType(decoder, kTypes_ilfd, operand.sig->GetReturn(0),
+    if (imm.sig->return_count() == 1 &&
+        !CheckSupportedType(decoder, kTypes_ilfd, imm.sig->GetReturn(0),
                             "return"))
       return;
 
     auto call_descriptor =
-        compiler::GetWasmCallDescriptor(compilation_zone_, operand.sig);
+        compiler::GetWasmCallDescriptor(compilation_zone_, imm.sig);
     call_descriptor =
         GetLoweredCallDescriptor(compilation_zone_, call_descriptor);
 
-    if (operand.index < env_->module->num_imported_functions) {
+    if (imm.index < env_->module->num_imported_functions) {
       // A direct call to an imported function.
       LiftoffRegList pinned;
       LiftoffRegister tmp = pinned.set(__ GetUnusedRegister(kGpReg, pinned));
@@ -1377,55 +1591,54 @@ class LiftoffCompiler {
       LOAD_INSTANCE_FIELD(imported_targets, ImportedFunctionTargets,
                           kPointerLoadType);
       __ Load(target, imported_targets.gp(), no_reg,
-              operand.index * sizeof(Address), kPointerLoadType, pinned);
+              imm.index * sizeof(Address), kPointerLoadType, pinned);
 
       LiftoffRegister imported_instances = tmp;
       LOAD_INSTANCE_FIELD(imported_instances, ImportedFunctionInstances,
                           kPointerLoadType);
       LiftoffRegister target_instance = tmp;
       __ Load(target_instance, imported_instances.gp(), no_reg,
-              compiler::FixedArrayOffsetMinusTag(operand.index),
-              kPointerLoadType, pinned);
+              compiler::FixedArrayOffsetMinusTag(imm.index), kPointerLoadType,
+              pinned);
 
       LiftoffRegister* explicit_instance = &target_instance;
       Register target_reg = target.gp();
-      __ PrepareCall(operand.sig, call_descriptor, &target_reg,
-                     explicit_instance);
-      source_position_table_builder_->AddPosition(
+      __ PrepareCall(imm.sig, call_descriptor, &target_reg, explicit_instance);
+      source_position_table_builder_.AddPosition(
           __ pc_offset(), SourcePosition(decoder->position()), false);
 
-      __ CallIndirect(operand.sig, call_descriptor, target_reg);
+      __ CallIndirect(imm.sig, call_descriptor, target_reg);
 
-      safepoint_table_builder_.DefineSafepoint(asm_, Safepoint::kSimple, 0,
+      safepoint_table_builder_.DefineSafepoint(&asm_, Safepoint::kSimple, 0,
                                                Safepoint::kNoLazyDeopt);
 
-      __ FinishCall(operand.sig, call_descriptor);
+      __ FinishCall(imm.sig, call_descriptor);
     } else {
       // A direct call within this module just gets the current instance.
-      __ PrepareCall(operand.sig, call_descriptor);
+      __ PrepareCall(imm.sig, call_descriptor);
 
-      source_position_table_builder_->AddPosition(
+      source_position_table_builder_.AddPosition(
           __ pc_offset(), SourcePosition(decoder->position()), false);
 
       // Just encode the function index. This will be patched at instantiation.
-      Address addr = reinterpret_cast<Address>(operand.index);
+      Address addr = static_cast<Address>(imm.index);
       __ CallNativeWasmCode(addr);
 
-      safepoint_table_builder_.DefineSafepoint(asm_, Safepoint::kSimple, 0,
+      safepoint_table_builder_.DefineSafepoint(&asm_, Safepoint::kSimple, 0,
                                                Safepoint::kNoLazyDeopt);
 
-      __ FinishCall(operand.sig, call_descriptor);
+      __ FinishCall(imm.sig, call_descriptor);
     }
   }
 
   void CallIndirect(Decoder* decoder, const Value& index_val,
-                    const CallIndirectOperand<validate>& operand,
+                    const CallIndirectImmediate<validate>& imm,
                     const Value args[], Value returns[]) {
-    if (operand.sig->return_count() > 1) {
+    if (imm.sig->return_count() > 1) {
       return unsupported(decoder, "multi-return");
     }
-    if (operand.sig->return_count() == 1 &&
-        !CheckSupportedType(decoder, kTypes_ilfd, operand.sig->GetReturn(0),
+    if (imm.sig->return_count() == 1 &&
+        !CheckSupportedType(decoder, kTypes_ilfd, imm.sig->GetReturn(0),
                             "return")) {
       return;
     }
@@ -1450,9 +1663,9 @@ class LiftoffCompiler {
 
     // Bounds check against the table size.
     Label* invalid_func_label = AddOutOfLineTrap(
-        decoder->position(), Builtins::kThrowWasmTrapFuncInvalid);
+        decoder->position(), WasmCode::kThrowWasmTrapFuncInvalid);
 
-    uint32_t canonical_sig_num = env_->module->signature_ids[operand.sig_index];
+    uint32_t canonical_sig_num = env_->module->signature_ids[imm.sig_index];
     DCHECK_GE(canonical_sig_num, 0);
     DCHECK_GE(kMaxInt, canonical_sig_num);
 
@@ -1463,6 +1676,30 @@ class LiftoffCompiler {
     __ emit_cond_jump(kUnsignedGreaterEqual, invalid_func_label, kWasmI32,
                       index.gp(), tmp_const.gp());
 
+    // Mask the index to prevent SSCA.
+    if (FLAG_untrusted_code_mitigations) {
+      DEBUG_CODE_COMMENT("Mask indirect call index");
+      // mask = ((index - size) & ~index) >> 31
+      // Reuse allocated registers; note: size is still stored in {tmp_const}.
+      LiftoffRegister diff = table;
+      LiftoffRegister neg_index = tmp_const;
+      LiftoffRegister mask = scratch;
+      // 1) diff = index - size
+      __ emit_i32_sub(diff.gp(), index.gp(), tmp_const.gp());
+      // 2) neg_index = ~index
+      __ LoadConstant(neg_index, WasmValue(int32_t{-1}));
+      __ emit_i32_xor(neg_index.gp(), neg_index.gp(), index.gp());
+      // 3) mask = diff & neg_index
+      __ emit_i32_and(mask.gp(), diff.gp(), neg_index.gp());
+      // 4) mask = mask >> 31
+      __ LoadConstant(tmp_const, WasmValue(int32_t{31}));
+      __ emit_i32_sar(mask.gp(), mask.gp(), tmp_const.gp(), pinned);
+
+      // Apply mask.
+      __ emit_i32_and(index.gp(), index.gp(), mask.gp());
+    }
+
+    DEBUG_CODE_COMMENT("Check indirect call signature");
     // Load the signature from {instance->ift_sig_ids[key]}
     LOAD_INSTANCE_FIELD(table, IndirectFunctionTableSigIds, kPointerLoadType);
     __ LoadConstant(tmp_const,
@@ -1476,11 +1713,12 @@ class LiftoffCompiler {
     __ LoadConstant(tmp_const, WasmValue(canonical_sig_num));
 
     Label* sig_mismatch_label = AddOutOfLineTrap(
-        decoder->position(), Builtins::kThrowWasmTrapFuncSigMismatch);
+        decoder->position(), WasmCode::kThrowWasmTrapFuncSigMismatch);
     __ emit_cond_jump(kUnequal, sig_mismatch_label,
                       LiftoffAssembler::kWasmIntPtr, scratch.gp(),
                       tmp_const.gp());
 
+    DEBUG_CODE_COMMENT("Execute indirect call");
     if (kPointerSize == 8) {
       // {index} has already been multiplied by 4. Multiply by another 2.
       __ LoadConstant(tmp_const, WasmValue(2));
@@ -1499,22 +1737,22 @@ class LiftoffCompiler {
             pinned);
     LiftoffRegister* explicit_instance = &tmp_const;
 
-    source_position_table_builder_->AddPosition(
+    source_position_table_builder_.AddPosition(
         __ pc_offset(), SourcePosition(decoder->position()), false);
 
     auto call_descriptor =
-        compiler::GetWasmCallDescriptor(compilation_zone_, operand.sig);
+        compiler::GetWasmCallDescriptor(compilation_zone_, imm.sig);
     call_descriptor =
         GetLoweredCallDescriptor(compilation_zone_, call_descriptor);
 
     Register target = scratch.gp();
-    __ PrepareCall(operand.sig, call_descriptor, &target, explicit_instance);
-    __ CallIndirect(operand.sig, call_descriptor, target);
+    __ PrepareCall(imm.sig, call_descriptor, &target, explicit_instance);
+    __ CallIndirect(imm.sig, call_descriptor, target);
 
-    safepoint_table_builder_.DefineSafepoint(asm_, Safepoint::kSimple, 0,
+    safepoint_table_builder_.DefineSafepoint(&asm_, Safepoint::kSimple, 0,
                                              Safepoint::kNoLazyDeopt);
 
-    __ FinishCall(operand.sig, call_descriptor);
+    __ FinishCall(imm.sig, call_descriptor);
   }
 
   void SimdOp(Decoder* decoder, WasmOpcode opcode, Vector<Value> args,
@@ -1522,77 +1760,66 @@ class LiftoffCompiler {
     unsupported(decoder, "simd");
   }
   void SimdLaneOp(Decoder* decoder, WasmOpcode opcode,
-                  const SimdLaneOperand<validate>& operand,
+                  const SimdLaneImmediate<validate>& imm,
                   const Vector<Value> inputs, Value* result) {
     unsupported(decoder, "simd");
   }
   void SimdShiftOp(Decoder* decoder, WasmOpcode opcode,
-                   const SimdShiftOperand<validate>& operand,
-                   const Value& input, Value* result) {
+                   const SimdShiftImmediate<validate>& imm, const Value& input,
+                   Value* result) {
     unsupported(decoder, "simd");
   }
   void Simd8x16ShuffleOp(Decoder* decoder,
-                         const Simd8x16ShuffleOperand<validate>& operand,
+                         const Simd8x16ShuffleImmediate<validate>& imm,
                          const Value& input0, const Value& input1,
                          Value* result) {
     unsupported(decoder, "simd");
   }
-  void Throw(Decoder* decoder, const ExceptionIndexOperand<validate>&,
+  void Throw(Decoder* decoder, const ExceptionIndexImmediate<validate>&,
              Control* block, const Vector<Value>& args) {
     unsupported(decoder, "throw");
   }
   void CatchException(Decoder* decoder,
-                      const ExceptionIndexOperand<validate>& operand,
+                      const ExceptionIndexImmediate<validate>& imm,
                       Control* block, Vector<Value> caught_values) {
     unsupported(decoder, "catch");
   }
   void AtomicOp(Decoder* decoder, WasmOpcode opcode, Vector<Value> args,
-                const MemoryAccessOperand<validate>& operand, Value* result) {
+                const MemoryAccessImmediate<validate>& imm, Value* result) {
     unsupported(decoder, "atomicop");
   }
 
  private:
-  LiftoffAssembler* const asm_;
+  LiftoffAssembler asm_;
   compiler::CallDescriptor* const descriptor_;
-  compiler::ModuleEnv* const env_;
+  ModuleEnv* const env_;
   // {min_size_} and {max_size_} are cached values computed from the ModuleEnv.
   const uint64_t min_size_;
   const uint64_t max_size_;
   bool ok_ = true;
   std::vector<OutOfLineCode> out_of_line_code_;
-  SourcePositionTableBuilder* const source_position_table_builder_;
-  WasmCompilationData* wasm_compilation_data_;
+  SourcePositionTableBuilder source_position_table_builder_;
+  std::vector<trap_handler::ProtectedInstructionData> protected_instructions_;
   // Zone used to store information during compilation. The result will be
   // stored independently, such that this zone can die together with the
   // LiftoffCompiler after compilation.
   Zone* compilation_zone_;
-  // This zone is allocated when needed, held externally, and survives until
-  // code generation (in FinishCompilation).
-  std::unique_ptr<Zone>* codegen_zone_;
   SafepointTableBuilder safepoint_table_builder_;
   // The pc offset of the instructions to reserve the stack frame. Needed to
   // patch the actually needed stack size in the end.
   uint32_t pc_offset_stack_frame_construction_ = 0;
 
-  // Points to the cell within the {code_table_} of the NativeModule,
-  // which  corresponds to the currently compiled function
-  WasmCode* const* code_table_entry_ = nullptr;
-
   void TraceCacheState(Decoder* decoder) const {
 #ifdef DEBUG
     if (!FLAG_trace_liftoff || !FLAG_trace_wasm_decoder) return;
-    OFStream os(stdout);
+    StdoutStream os;
     for (int control_depth = decoder->control_depth() - 1; control_depth >= -1;
          --control_depth) {
-      LiftoffAssembler::CacheState* cache_state =
-          control_depth == -1
-              ? asm_->cache_state()
-              : &decoder->control_at(control_depth)->label_state;
-      bool first = true;
-      for (LiftoffAssembler::VarState& slot : cache_state->stack_state) {
-        os << (first ? "" : "-") << slot;
-        first = false;
-      }
+      auto* cache_state =
+          control_depth == -1 ? __ cache_state()
+                              : &decoder->control_at(control_depth)
+                                     ->label_state;
+      os << PrintCollection(cache_state->stack_state);
       if (control_depth != -1) PrintF("; ");
     }
     os << "\n";
@@ -1601,55 +1828,75 @@ class LiftoffCompiler {
 };
 
 }  // namespace
-}  // namespace wasm
 
-bool compiler::WasmCompilationUnit::ExecuteLiftoffCompilation() {
+bool LiftoffCompilationUnit::ExecuteCompilation() {
   base::ElapsedTimer compile_timer;
   if (FLAG_trace_wasm_decode_time) {
     compile_timer.Start();
   }
 
-  Zone zone(isolate_->allocator(), "LiftoffCompilationZone");
-  const wasm::WasmModule* module = env_ ? env_->module : nullptr;
-  auto call_descriptor = compiler::GetWasmCallDescriptor(&zone, func_body_.sig);
+  Zone zone(wasm_unit_->isolate_->allocator(), "LiftoffCompilationZone");
+  const wasm::WasmModule* module =
+      wasm_unit_->env_ ? wasm_unit_->env_->module : nullptr;
+  auto call_descriptor =
+      compiler::GetWasmCallDescriptor(&zone, wasm_unit_->func_body_.sig);
   base::Optional<TimedHistogramScope> liftoff_compile_time_scope(
-      base::in_place, counters()->liftoff_compile_time());
-  wasm::WasmCode* const* code_table_entry =
-      native_module_->code_table().data() + func_index_;
+      base::in_place, wasm_unit_->counters_->liftoff_compile_time());
   wasm::WasmFullDecoder<wasm::Decoder::kValidate, wasm::LiftoffCompiler>
-      decoder(&zone, module, func_body_, &liftoff_.asm_, call_descriptor, env_,
-              &liftoff_.source_position_table_builder_, &wasm_compilation_data_,
-              &zone, &liftoff_.codegen_zone_, code_table_entry);
+      decoder(&zone, module, wasm_unit_->func_body_, call_descriptor,
+              wasm_unit_->env_, &zone);
   decoder.Decode();
   liftoff_compile_time_scope.reset();
-  if (!decoder.interface().ok()) {
+  wasm::LiftoffCompiler* compiler = &decoder.interface();
+  if (decoder.failed()) return false;  // validation error
+  if (!compiler->ok()) {
     // Liftoff compilation failed.
-    isolate_->counters()->liftoff_unsupported_functions()->Increment();
+    wasm_unit_->counters_->liftoff_unsupported_functions()->Increment();
     return false;
   }
-  if (decoder.failed()) return false;  // Validation error
+
+  wasm_unit_->counters_->liftoff_compiled_functions()->Increment();
 
   if (FLAG_trace_wasm_decode_time) {
     double compile_ms = compile_timer.Elapsed().InMillisecondsF();
     PrintF(
         "wasm-compilation liftoff phase 1 ok: %u bytes, %0.3f ms decode and "
         "compile\n",
-        static_cast<unsigned>(func_body_.end - func_body_.start), compile_ms);
+        static_cast<unsigned>(wasm_unit_->func_body_.end -
+                              wasm_unit_->func_body_.start),
+        compile_ms);
   }
 
+  CodeDesc desc;
+  compiler->GetCode(&desc);
+  OwnedVector<byte> source_positions = compiler->GetSourcePositionTable();
+  OwnedVector<trap_handler::ProtectedInstructionData> protected_instructions =
+      compiler->GetProtectedInstructions();
+  uint32_t frame_slot_count = compiler->GetTotalFrameSlotCount();
+  int safepoint_table_offset = compiler->GetSafepointTableOffset();
+
+  code_ = wasm_unit_->native_module_->AddCode(
+      wasm_unit_->func_index_, desc, frame_slot_count, safepoint_table_offset,
+      0, std::move(protected_instructions), std::move(source_positions),
+      wasm::WasmCode::kLiftoff);
+
   // Record the memory cost this unit places on the system until
   // it is finalized.
-  memory_cost_ = liftoff_.asm_.pc_offset();
-  liftoff_.safepoint_table_offset_ =
-      decoder.interface().GetSafepointTableOffset();
-  isolate_->counters()->liftoff_compiled_functions()->Increment();
+  wasm_unit_->memory_cost_ = sizeof(*this);
+
   return true;
 }
 
+wasm::WasmCode* LiftoffCompilationUnit::FinishCompilation(wasm::ErrorThrower*) {
+  return code_;
+}
+
 #undef __
 #undef TRACE
 #undef WASM_INSTANCE_OBJECT_OFFSET
 #undef LOAD_INSTANCE_FIELD
+#undef DEBUG_CODE_COMMENT
 
+}  // namespace wasm
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/src/wasm/baseline/liftoff-compiler.h b/deps/v8/src/wasm/baseline/liftoff-compiler.h
new file mode 100644
index 00000000000000..ce828c459b31a9
--- /dev/null
+++ b/deps/v8/src/wasm/baseline/liftoff-compiler.h
@@ -0,0 +1,39 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef V8_WASM_BASELINE_LIFTOFF_COMPILER_H_
+#define V8_WASM_BASELINE_LIFTOFF_COMPILER_H_
+
+#include "src/base/macros.h"
+
+namespace v8 {
+namespace internal {
+namespace wasm {
+
+class ErrorThrower;
+class WasmCode;
+class WasmCompilationUnit;
+
+class LiftoffCompilationUnit final {
+ public:
+  explicit LiftoffCompilationUnit(WasmCompilationUnit* wasm_unit)
+      : wasm_unit_(wasm_unit) {}
+
+  bool ExecuteCompilation();
+  wasm::WasmCode* FinishCompilation(wasm::ErrorThrower*);
+
+ private:
+  WasmCompilationUnit* const wasm_unit_;
+
+  // Result of compilation:
+  WasmCode* code_;
+
+  DISALLOW_COPY_AND_ASSIGN(LiftoffCompilationUnit);
+};
+
+}  // namespace wasm
+}  // namespace internal
+}  // namespace v8
+
+#endif  // V8_WASM_BASELINE_LIFTOFF_COMPILER_H_
diff --git a/deps/v8/src/wasm/baseline/liftoff-register.h b/deps/v8/src/wasm/baseline/liftoff-register.h
index 3db7bdc1a4110e..19bf88948d8823 100644
--- a/deps/v8/src/wasm/baseline/liftoff-register.h
+++ b/deps/v8/src/wasm/baseline/liftoff-register.h
@@ -289,13 +289,14 @@ class LiftoffRegList {
 
   template <typename... Regs>
   static LiftoffRegList ForRegs(Regs... regs) {
-    std::array<LiftoffRegister, sizeof...(regs)> regs_arr{
-        {LiftoffRegister(regs)...}};
     LiftoffRegList list;
-    for (LiftoffRegister reg : regs_arr) list.set(reg);
+    for (LiftoffRegister reg : {LiftoffRegister(regs)...}) list.set(reg);
     return list;
   }
 
+  RegList GetGpList() { return regs_ & kGpMask; }
+  RegList GetFpList() { return (regs_ & kFpMask) >> kAfterMaxLiftoffGpRegCode; }
+
  private:
   storage_t regs_ = 0;
 
@@ -313,6 +314,16 @@ static constexpr LiftoffRegList GetCacheRegList(RegClass rc) {
   return rc == kGpReg ? kGpCacheRegList : kFpCacheRegList;
 }
 
+inline std::ostream& operator<<(std::ostream& os, LiftoffRegList reglist) {
+  os << "{";
+  for (bool first = true; !reglist.is_empty(); first = false) {
+    LiftoffRegister reg = reglist.GetFirstRegSet();
+    reglist.clear(reg);
+    os << (first ? "" : ", ") << reg;
+  }
+  return os << "}";
+}
+
 }  // namespace wasm
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/src/wasm/baseline/mips/liftoff-assembler-mips.h b/deps/v8/src/wasm/baseline/mips/liftoff-assembler-mips.h
index 317677c97c7300..d2ea65211b51f7 100644
--- a/deps/v8/src/wasm/baseline/mips/liftoff-assembler-mips.h
+++ b/deps/v8/src/wasm/baseline/mips/liftoff-assembler-mips.h
@@ -33,17 +33,17 @@ inline MemOperand GetHalfStackSlot(uint32_t half_index) {
 
 inline MemOperand GetInstanceOperand() { return MemOperand(fp, -8); }
 
-// Use this register to store the address of the last argument pushed on the
-// stack for a call to C. This register must be callee saved according to the c
-// calling convention.
-static constexpr Register kCCallLastArgAddrReg = s1;
-
-inline void Load(LiftoffAssembler* assm, LiftoffRegister dst, MemOperand src,
-                 ValueType type) {
+inline void Load(LiftoffAssembler* assm, LiftoffRegister dst, Register base,
+                 int32_t offset, ValueType type) {
+  MemOperand src(base, offset);
   switch (type) {
     case kWasmI32:
       assm->lw(dst.gp(), src);
       break;
+    case kWasmI64:
+      assm->lw(dst.low_gp(), src);
+      assm->lw(dst.high_gp(), MemOperand(base, offset + 4));
+      break;
     case kWasmF32:
       assm->lwc1(dst.fp(), src);
       break;
@@ -55,6 +55,28 @@ inline void Load(LiftoffAssembler* assm, LiftoffRegister dst, MemOperand src,
   }
 }
 
+inline void Store(LiftoffAssembler* assm, Register base, int32_t offset,
+                  LiftoffRegister src, ValueType type) {
+  MemOperand dst(base, offset);
+  switch (type) {
+    case kWasmI32:
+      assm->Usw(src.gp(), dst);
+      break;
+    case kWasmI64:
+      assm->Usw(src.low_gp(), dst);
+      assm->Usw(src.high_gp(), MemOperand(base, offset + 4));
+      break;
+    case kWasmF32:
+      assm->Uswc1(src.fp(), dst, t8);
+      break;
+    case kWasmF64:
+      assm->Usdc1(src.fp(), dst, t8);
+      break;
+    default:
+      UNREACHABLE();
+  }
+}
+
 inline void push(LiftoffAssembler* assm, LiftoffRegister reg, ValueType type) {
   switch (type) {
     case kWasmI32:
@@ -78,8 +100,8 @@ inline void push(LiftoffAssembler* assm, LiftoffRegister reg, ValueType type) {
 
 }  // namespace liftoff
 
-uint32_t LiftoffAssembler::PrepareStackFrame() {
-  uint32_t offset = static_cast<uint32_t>(pc_offset());
+int LiftoffAssembler::PrepareStackFrame() {
+  int offset = pc_offset();
   // When constant that represents size of stack frame can't be represented
   // as 16bit we need three instructions to add it to sp, so we reserve space
   // for this case.
@@ -89,21 +111,26 @@ uint32_t LiftoffAssembler::PrepareStackFrame() {
   return offset;
 }
 
-void LiftoffAssembler::PatchPrepareStackFrame(uint32_t offset,
+void LiftoffAssembler::PatchPrepareStackFrame(int offset,
                                               uint32_t stack_slots) {
   uint32_t bytes = liftoff::kConstantStackSpace + kStackSlotSize * stack_slots;
   DCHECK_LE(bytes, kMaxInt);
   // We can't run out of space, just pass anything big enough to not cause the
   // assembler to try to grow the buffer.
   constexpr int kAvailableSpace = 256;
-  TurboAssembler patching_assembler(isolate(), buffer_ + offset,
-                                    kAvailableSpace, CodeObjectRequired::kNo);
+  TurboAssembler patching_assembler(nullptr, AssemblerOptions{},
+                                    buffer_ + offset, kAvailableSpace,
+                                    CodeObjectRequired::kNo);
   // If bytes can be represented as 16bit, addiu will be generated and two
   // nops will stay untouched. Otherwise, lui-ori sequence will load it to
   // register and, as third instruction, addu will be generated.
   patching_assembler.Addu(sp, sp, Operand(-bytes));
 }
 
+void LiftoffAssembler::FinishCode() {}
+
+void LiftoffAssembler::AbortCompilation() {}
+
 void LiftoffAssembler::LoadConstant(LiftoffRegister reg, WasmValue value,
                                     RelocInfo::Mode rmode) {
   switch (value.type()) {
@@ -148,8 +175,7 @@ void LiftoffAssembler::FillInstanceInto(Register dst) {
 void LiftoffAssembler::Load(LiftoffRegister dst, Register src_addr,
                             Register offset_reg, uint32_t offset_imm,
                             LoadType type, LiftoffRegList pinned,
-                            uint32_t* protected_load_pc) {
-  // TODO(ksreten): Add check if unaligned memory access
+                            uint32_t* protected_load_pc, bool is_load_mem) {
   Register src = no_reg;
   if (offset_reg != no_reg) {
     src = GetUnusedRegister(kGpReg, pinned).gp();
@@ -219,13 +245,18 @@ void LiftoffAssembler::Load(LiftoffRegister dst, Register src_addr,
     default:
       UNREACHABLE();
   }
+
+#if defined(V8_TARGET_BIG_ENDIAN)
+  if (is_load_mem) {
+    ChangeEndiannessLoad(dst, type, pinned);
+  }
+#endif
 }
 
 void LiftoffAssembler::Store(Register dst_addr, Register offset_reg,
                              uint32_t offset_imm, LiftoffRegister src,
                              StoreType type, LiftoffRegList pinned,
-                             uint32_t* protected_store_pc) {
-  // TODO(ksreten): Add check if unaligned memory access
+                             uint32_t* protected_store_pc, bool is_store_mem) {
   Register dst = no_reg;
   if (offset_reg != no_reg) {
     dst = GetUnusedRegister(kGpReg, pinned).gp();
@@ -234,6 +265,18 @@ void LiftoffAssembler::Store(Register dst_addr, Register offset_reg,
   MemOperand dst_op = (offset_reg != no_reg) ? MemOperand(dst, offset_imm)
                                              : MemOperand(dst_addr, offset_imm);
 
+#if defined(V8_TARGET_BIG_ENDIAN)
+  if (is_store_mem) {
+    LiftoffRegister tmp = GetUnusedRegister(src.reg_class(), pinned);
+    // Save original value.
+    Move(tmp, src, type.value_type());
+
+    src = tmp;
+    pinned.set(tmp);
+    ChangeEndiannessStore(src, type, pinned);
+  }
+#endif
+
   if (protected_store_pc) *protected_store_pc = pc_offset();
   switch (type.value()) {
     case StoreType::kI64Store8:
@@ -273,11 +316,139 @@ void LiftoffAssembler::Store(Register dst_addr, Register offset_reg,
   }
 }
 
+void LiftoffAssembler::ChangeEndiannessLoad(LiftoffRegister dst, LoadType type,
+                                            LiftoffRegList pinned) {
+  bool is_float = false;
+  LiftoffRegister tmp = dst;
+  switch (type.value()) {
+    case LoadType::kI64Load8U:
+    case LoadType::kI64Load8S:
+      // Swap low and high registers.
+      TurboAssembler::Move(kScratchReg, tmp.low_gp());
+      TurboAssembler::Move(tmp.low_gp(), tmp.high_gp());
+      TurboAssembler::Move(tmp.high_gp(), kScratchReg);
+      V8_FALLTHROUGH;
+    case LoadType::kI32Load8U:
+    case LoadType::kI32Load8S:
+      // No need to change endianness for byte size.
+      return;
+    case LoadType::kF32Load:
+      is_float = true;
+      tmp = GetUnusedRegister(kGpReg, pinned);
+      emit_type_conversion(kExprI32ReinterpretF32, tmp, dst);
+      V8_FALLTHROUGH;
+    case LoadType::kI32Load:
+      TurboAssembler::ByteSwapSigned(tmp.gp(), tmp.gp(), 4);
+      break;
+    case LoadType::kI32Load16S:
+      TurboAssembler::ByteSwapSigned(tmp.gp(), tmp.gp(), 2);
+      break;
+    case LoadType::kI32Load16U:
+      TurboAssembler::ByteSwapUnsigned(tmp.gp(), tmp.gp(), 2);
+      break;
+    case LoadType::kF64Load:
+      is_float = true;
+      tmp = GetUnusedRegister(kGpRegPair, pinned);
+      emit_type_conversion(kExprI64ReinterpretF64, tmp, dst);
+      V8_FALLTHROUGH;
+    case LoadType::kI64Load:
+      TurboAssembler::Move(kScratchReg, tmp.low_gp());
+      TurboAssembler::ByteSwapSigned(tmp.low_gp(), tmp.high_gp(), 4);
+      TurboAssembler::ByteSwapSigned(tmp.high_gp(), kScratchReg, 4);
+      break;
+    case LoadType::kI64Load16U:
+      TurboAssembler::ByteSwapUnsigned(tmp.low_gp(), tmp.high_gp(), 2);
+      TurboAssembler::Move(tmp.high_gp(), zero_reg);
+      break;
+    case LoadType::kI64Load16S:
+      TurboAssembler::ByteSwapSigned(tmp.low_gp(), tmp.high_gp(), 2);
+      sra(tmp.high_gp(), tmp.high_gp(), 31);
+      break;
+    case LoadType::kI64Load32U:
+      TurboAssembler::ByteSwapSigned(tmp.low_gp(), tmp.high_gp(), 4);
+      TurboAssembler::Move(tmp.high_gp(), zero_reg);
+      break;
+    case LoadType::kI64Load32S:
+      TurboAssembler::ByteSwapSigned(tmp.low_gp(), tmp.high_gp(), 4);
+      sra(tmp.high_gp(), tmp.high_gp(), 31);
+      break;
+    default:
+      UNREACHABLE();
+  }
+
+  if (is_float) {
+    switch (type.value()) {
+      case LoadType::kF32Load:
+        emit_type_conversion(kExprF32ReinterpretI32, dst, tmp);
+        break;
+      case LoadType::kF64Load:
+        emit_type_conversion(kExprF64ReinterpretI64, dst, tmp);
+        break;
+      default:
+        UNREACHABLE();
+    }
+  }
+}
+
+void LiftoffAssembler::ChangeEndiannessStore(LiftoffRegister src,
+                                             StoreType type,
+                                             LiftoffRegList pinned) {
+  bool is_float = false;
+  LiftoffRegister tmp = src;
+  switch (type.value()) {
+    case StoreType::kI64Store8:
+      // Swap low and high registers.
+      TurboAssembler::Move(kScratchReg, tmp.low_gp());
+      TurboAssembler::Move(tmp.low_gp(), tmp.high_gp());
+      TurboAssembler::Move(tmp.high_gp(), kScratchReg);
+      V8_FALLTHROUGH;
+    case StoreType::kI32Store8:
+      // No need to change endianness for byte size.
+      return;
+    case StoreType::kF32Store:
+      is_float = true;
+      tmp = GetUnusedRegister(kGpReg, pinned);
+      emit_type_conversion(kExprI32ReinterpretF32, tmp, src);
+      V8_FALLTHROUGH;
+    case StoreType::kI32Store:
+    case StoreType::kI32Store16:
+      TurboAssembler::ByteSwapSigned(tmp.gp(), tmp.gp(), 4);
+      break;
+    case StoreType::kF64Store:
+      is_float = true;
+      tmp = GetUnusedRegister(kGpRegPair, pinned);
+      emit_type_conversion(kExprI64ReinterpretF64, tmp, src);
+      V8_FALLTHROUGH;
+    case StoreType::kI64Store:
+    case StoreType::kI64Store32:
+    case StoreType::kI64Store16:
+      TurboAssembler::Move(kScratchReg, tmp.low_gp());
+      TurboAssembler::ByteSwapSigned(tmp.low_gp(), tmp.high_gp(), 4);
+      TurboAssembler::ByteSwapSigned(tmp.high_gp(), kScratchReg, 4);
+      break;
+    default:
+      UNREACHABLE();
+  }
+
+  if (is_float) {
+    switch (type.value()) {
+      case StoreType::kF32Store:
+        emit_type_conversion(kExprF32ReinterpretI32, src, tmp);
+        break;
+      case StoreType::kF64Store:
+        emit_type_conversion(kExprF64ReinterpretI64, src, tmp);
+        break;
+      default:
+        UNREACHABLE();
+    }
+  }
+}
+
 void LiftoffAssembler::LoadCallerFrameSlot(LiftoffRegister dst,
                                            uint32_t caller_slot_idx,
                                            ValueType type) {
-  MemOperand src(fp, kPointerSize * (caller_slot_idx + 1));
-  liftoff::Load(this, dst, src, type);
+  int32_t offset = kPointerSize * (caller_slot_idx + 1);
+  liftoff::Load(this, dst, fp, offset, type);
 }
 
 void LiftoffAssembler::MoveStackValue(uint32_t dst_index, uint32_t src_index,
@@ -288,16 +459,6 @@ void LiftoffAssembler::MoveStackValue(uint32_t dst_index, uint32_t src_index,
   Spill(dst_index, reg, type);
 }
 
-void LiftoffAssembler::MoveToReturnRegister(LiftoffRegister reg,
-                                            ValueType type) {
-  // TODO(wasm): Extract the destination register from the CallDescriptor.
-  // TODO(wasm): Add multi-return support.
-  LiftoffRegister dst =
-      reg.is_pair() ? LiftoffRegister::ForPair(v0, v1)
-                    : reg.is_gp() ? LiftoffRegister(v0) : LiftoffRegister(f2);
-  if (reg != dst) Move(dst, reg, type);
-}
-
 void LiftoffAssembler::Move(Register dst, Register src, ValueType type) {
   DCHECK_NE(dst, src);
   TurboAssembler::mov(dst, src);
@@ -343,16 +504,15 @@ void LiftoffAssembler::Spill(uint32_t index, WasmValue value) {
       break;
     }
     case kWasmI64: {
-      LiftoffRegister low = GetUnusedRegister(kGpReg);
-      LiftoffRegister high = GetUnusedRegister(kGpReg);
+      LiftoffRegister tmp = GetUnusedRegister(kGpRegPair);
 
       int32_t low_word = value.to_i64();
       int32_t high_word = value.to_i64() >> 32;
-      TurboAssembler::li(low.gp(), Operand(low_word));
-      TurboAssembler::li(high.gp(), Operand(high_word));
+      TurboAssembler::li(tmp.low_gp(), Operand(low_word));
+      TurboAssembler::li(tmp.high_gp(), Operand(high_word));
 
-      sw(low.gp(), dst);
-      sw(high.gp(), liftoff::GetHalfStackSlot(2 * index + 1));
+      sw(tmp.low_gp(), dst);
+      sw(tmp.high_gp(), liftoff::GetHalfStackSlot(2 * index + 1));
       break;
     }
     default:
@@ -392,6 +552,41 @@ void LiftoffAssembler::emit_i32_mul(Register dst, Register lhs, Register rhs) {
   TurboAssembler::Mul(dst, lhs, rhs);
 }
 
+void LiftoffAssembler::emit_i32_divs(Register dst, Register lhs, Register rhs,
+                                     Label* trap_div_by_zero,
+                                     Label* trap_div_unrepresentable) {
+  TurboAssembler::Branch(trap_div_by_zero, eq, rhs, Operand(zero_reg));
+
+  // Check if lhs == kMinInt and rhs == -1, since this case is unrepresentable.
+  TurboAssembler::li(kScratchReg, 1);
+  TurboAssembler::li(kScratchReg2, 1);
+  TurboAssembler::LoadZeroOnCondition(kScratchReg, lhs, Operand(kMinInt), eq);
+  TurboAssembler::LoadZeroOnCondition(kScratchReg2, rhs, Operand(-1), eq);
+  addu(kScratchReg, kScratchReg, kScratchReg2);
+  TurboAssembler::Branch(trap_div_unrepresentable, eq, kScratchReg,
+                         Operand(zero_reg));
+
+  TurboAssembler::Div(dst, lhs, rhs);
+}
+
+void LiftoffAssembler::emit_i32_divu(Register dst, Register lhs, Register rhs,
+                                     Label* trap_div_by_zero) {
+  TurboAssembler::Branch(trap_div_by_zero, eq, rhs, Operand(zero_reg));
+  TurboAssembler::Divu(dst, lhs, rhs);
+}
+
+void LiftoffAssembler::emit_i32_rems(Register dst, Register lhs, Register rhs,
+                                     Label* trap_div_by_zero) {
+  TurboAssembler::Branch(trap_div_by_zero, eq, rhs, Operand(zero_reg));
+  TurboAssembler::Mod(dst, lhs, rhs);
+}
+
+void LiftoffAssembler::emit_i32_remu(Register dst, Register lhs, Register rhs,
+                                     Label* trap_div_by_zero) {
+  TurboAssembler::Branch(trap_div_by_zero, eq, rhs, Operand(zero_reg));
+  TurboAssembler::Modu(dst, lhs, rhs);
+}
+
 #define I32_BINOP(name, instruction)                                 \
   void LiftoffAssembler::emit_i32_##name(Register dst, Register lhs, \
                                          Register rhs) {             \
@@ -435,16 +630,51 @@ I32_SHIFTOP(shr, srlv)
 
 #undef I32_SHIFTOP
 
-#define UNIMPLEMENTED_I64_BINOP(name)                                  \
-  void LiftoffAssembler::emit_i64_##name(                              \
-      LiftoffRegister dst, LiftoffRegister lhs, LiftoffRegister rhs) { \
-    BAILOUT("i64 binop: " #name);                                      \
-  }
+void LiftoffAssembler::emit_i64_mul(LiftoffRegister dst, LiftoffRegister lhs,
+                                    LiftoffRegister rhs) {
+  TurboAssembler::MulPair(dst.low_gp(), dst.high_gp(), lhs.low_gp(),
+                          lhs.high_gp(), rhs.low_gp(), rhs.high_gp(),
+                          kScratchReg, kScratchReg2);
+}
+
+bool LiftoffAssembler::emit_i64_divs(LiftoffRegister dst, LiftoffRegister lhs,
+                                     LiftoffRegister rhs,
+                                     Label* trap_div_by_zero,
+                                     Label* trap_div_unrepresentable) {
+  return false;
+}
 
-UNIMPLEMENTED_I64_BINOP(add)
-UNIMPLEMENTED_I64_BINOP(sub)
+bool LiftoffAssembler::emit_i64_divu(LiftoffRegister dst, LiftoffRegister lhs,
+                                     LiftoffRegister rhs,
+                                     Label* trap_div_by_zero) {
+  return false;
+}
+
+bool LiftoffAssembler::emit_i64_rems(LiftoffRegister dst, LiftoffRegister lhs,
+                                     LiftoffRegister rhs,
+                                     Label* trap_div_by_zero) {
+  return false;
+}
 
-#undef UNIMPLEMENTED_I64_BINOP
+bool LiftoffAssembler::emit_i64_remu(LiftoffRegister dst, LiftoffRegister lhs,
+                                     LiftoffRegister rhs,
+                                     Label* trap_div_by_zero) {
+  return false;
+}
+
+void LiftoffAssembler::emit_i64_add(LiftoffRegister dst, LiftoffRegister lhs,
+                                    LiftoffRegister rhs) {
+  TurboAssembler::AddPair(dst.low_gp(), dst.high_gp(), lhs.low_gp(),
+                          lhs.high_gp(), rhs.low_gp(), rhs.high_gp(),
+                          kScratchReg, kScratchReg2);
+}
+
+void LiftoffAssembler::emit_i64_sub(LiftoffRegister dst, LiftoffRegister lhs,
+                                    LiftoffRegister rhs) {
+  TurboAssembler::SubPair(dst.low_gp(), dst.high_gp(), lhs.low_gp(),
+                          lhs.high_gp(), rhs.low_gp(), rhs.high_gp(),
+                          kScratchReg, kScratchReg2);
+}
 
 namespace liftoff {
 
@@ -464,14 +694,16 @@ inline void Emit64BitShiftOperation(
   pinned.set(src);
   pinned.set(amount);
 
+  // If some of destination registers are in use, get another, unused pair.
+  // That way we prevent overwriting some input registers while shifting.
+  // Do this before any branch so that the cache state will be correct for
+  // all conditions.
+  LiftoffRegister tmp = assm->GetUnusedRegister(kGpRegPair, pinned);
+
   // If shift amount is 0, don't do the shifting.
   assm->TurboAssembler::Branch(&move, eq, amount, Operand(zero_reg));
 
   if (liftoff::IsRegInRegPair(dst, amount) || dst.overlaps(src)) {
-    // If some of destination registers are in use, get another, unused pair.
-    // That way we prevent overwriting some input registers while shifting.
-    LiftoffRegister tmp = assm->GetUnusedRegister(kGpRegPair, pinned);
-
     // Do the actual shift.
     (assm->*emit_shift)(tmp.low_gp(), tmp.high_gp(), src.low_gp(),
                         src.high_gp(), amount, kScratchReg, kScratchReg2);
@@ -512,6 +744,62 @@ void LiftoffAssembler::emit_i64_shr(LiftoffRegister dst, LiftoffRegister src,
                                    &TurboAssembler::ShrPair, pinned);
 }
 
+void LiftoffAssembler::emit_i32_to_intptr(Register dst, Register src) {
+  UNREACHABLE();
+}
+
+void LiftoffAssembler::emit_f32_neg(DoubleRegister dst, DoubleRegister src) {
+  TurboAssembler::Neg_s(dst, src);
+}
+
+void LiftoffAssembler::emit_f64_neg(DoubleRegister dst, DoubleRegister src) {
+  TurboAssembler::Neg_d(dst, src);
+}
+
+void LiftoffAssembler::emit_f32_min(DoubleRegister dst, DoubleRegister lhs,
+                                    DoubleRegister rhs) {
+  Label ool, done;
+  TurboAssembler::Float32Min(dst, lhs, rhs, &ool);
+  Branch(&done);
+
+  bind(&ool);
+  TurboAssembler::Float32MinOutOfLine(dst, lhs, rhs);
+  bind(&done);
+}
+
+void LiftoffAssembler::emit_f32_max(DoubleRegister dst, DoubleRegister lhs,
+                                    DoubleRegister rhs) {
+  Label ool, done;
+  TurboAssembler::Float32Max(dst, lhs, rhs, &ool);
+  Branch(&done);
+
+  bind(&ool);
+  TurboAssembler::Float32MaxOutOfLine(dst, lhs, rhs);
+  bind(&done);
+}
+
+void LiftoffAssembler::emit_f64_min(DoubleRegister dst, DoubleRegister lhs,
+                                    DoubleRegister rhs) {
+  Label ool, done;
+  TurboAssembler::Float64Min(dst, lhs, rhs, &ool);
+  Branch(&done);
+
+  bind(&ool);
+  TurboAssembler::Float64MinOutOfLine(dst, lhs, rhs);
+  bind(&done);
+}
+
+void LiftoffAssembler::emit_f64_max(DoubleRegister dst, DoubleRegister lhs,
+                                    DoubleRegister rhs) {
+  Label ool, done;
+  TurboAssembler::Float64Max(dst, lhs, rhs, &ool);
+  Branch(&done);
+
+  bind(&ool);
+  TurboAssembler::Float64MaxOutOfLine(dst, lhs, rhs);
+  bind(&done);
+}
+
 #define FP_BINOP(name, instruction)                                          \
   void LiftoffAssembler::emit_##name(DoubleRegister dst, DoubleRegister lhs, \
                                      DoubleRegister rhs) {                   \
@@ -527,7 +815,6 @@ FP_BINOP(f32_sub, sub_s)
 FP_BINOP(f32_mul, mul_s)
 FP_BINOP(f32_div, div_s)
 FP_UNOP(f32_abs, abs_s)
-FP_UNOP(f32_neg, neg_s)
 FP_UNOP(f32_ceil, Ceil_s_s)
 FP_UNOP(f32_floor, Floor_s_s)
 FP_UNOP(f32_trunc, Trunc_s_s)
@@ -538,56 +825,146 @@ FP_BINOP(f64_sub, sub_d)
 FP_BINOP(f64_mul, mul_d)
 FP_BINOP(f64_div, div_d)
 FP_UNOP(f64_abs, abs_d)
-FP_UNOP(f64_neg, neg_d)
 FP_UNOP(f64_sqrt, sqrt_d)
 
 #undef FP_BINOP
 #undef FP_UNOP
 
-void LiftoffAssembler::emit_f64_ceil(DoubleRegister dst, DoubleRegister src) {
+bool LiftoffAssembler::emit_f64_ceil(DoubleRegister dst, DoubleRegister src) {
   if ((IsMipsArchVariant(kMips32r2) || IsMipsArchVariant(kMips32r6)) &&
       IsFp64Mode()) {
     Ceil_d_d(dst, src);
-  } else {
-    BAILOUT("emit_f64_ceil");
+    return true;
   }
+  return false;
 }
 
-void LiftoffAssembler::emit_f64_floor(DoubleRegister dst, DoubleRegister src) {
+bool LiftoffAssembler::emit_f64_floor(DoubleRegister dst, DoubleRegister src) {
   if ((IsMipsArchVariant(kMips32r2) || IsMipsArchVariant(kMips32r6)) &&
       IsFp64Mode()) {
     Floor_d_d(dst, src);
-  } else {
-    BAILOUT("emit_f64_floor");
+    return true;
   }
+  return false;
 }
 
-void LiftoffAssembler::emit_f64_trunc(DoubleRegister dst, DoubleRegister src) {
+bool LiftoffAssembler::emit_f64_trunc(DoubleRegister dst, DoubleRegister src) {
   if ((IsMipsArchVariant(kMips32r2) || IsMipsArchVariant(kMips32r6)) &&
       IsFp64Mode()) {
     Trunc_d_d(dst, src);
-  } else {
-    BAILOUT("emit_f64_trunc");
+    return true;
   }
+  return false;
 }
 
-void LiftoffAssembler::emit_f64_nearest_int(DoubleRegister dst,
+bool LiftoffAssembler::emit_f64_nearest_int(DoubleRegister dst,
                                             DoubleRegister src) {
   if ((IsMipsArchVariant(kMips32r2) || IsMipsArchVariant(kMips32r6)) &&
       IsFp64Mode()) {
     Round_d_d(dst, src);
-  } else {
-    BAILOUT("emit_f64_nearest_int");
+    return true;
   }
+  return false;
 }
 
 bool LiftoffAssembler::emit_type_conversion(WasmOpcode opcode,
                                             LiftoffRegister dst,
-                                            LiftoffRegister src) {
+                                            LiftoffRegister src, Label* trap) {
   switch (opcode) {
     case kExprI32ConvertI64:
       TurboAssembler::Move(dst.gp(), src.low_gp());
       return true;
+    case kExprI32SConvertF32: {
+      LiftoffRegister rounded =
+          GetUnusedRegister(kFpReg, LiftoffRegList::ForRegs(src));
+      LiftoffRegister converted_back =
+          GetUnusedRegister(kFpReg, LiftoffRegList::ForRegs(src, rounded));
+
+      // Real conversion.
+      TurboAssembler::Trunc_s_s(rounded.fp(), src.fp());
+      trunc_w_s(kScratchDoubleReg, rounded.fp());
+      mfc1(dst.gp(), kScratchDoubleReg);
+      // Avoid INT32_MAX as an overflow indicator and use INT32_MIN instead,
+      // because INT32_MIN allows easier out-of-bounds detection.
+      TurboAssembler::Addu(kScratchReg, dst.gp(), 1);
+      TurboAssembler::Slt(kScratchReg2, kScratchReg, dst.gp());
+      TurboAssembler::Movn(dst.gp(), kScratchReg, kScratchReg2);
+
+      // Checking if trap.
+      mtc1(dst.gp(), kScratchDoubleReg);
+      cvt_s_w(converted_back.fp(), kScratchDoubleReg);
+      TurboAssembler::CompareF32(EQ, rounded.fp(), converted_back.fp());
+      TurboAssembler::BranchFalseF(trap);
+      return true;
+    }
+    case kExprI32UConvertF32: {
+      LiftoffRegister rounded =
+          GetUnusedRegister(kFpReg, LiftoffRegList::ForRegs(src));
+      LiftoffRegister converted_back =
+          GetUnusedRegister(kFpReg, LiftoffRegList::ForRegs(src, rounded));
+
+      // Real conversion.
+      TurboAssembler::Trunc_s_s(rounded.fp(), src.fp());
+      TurboAssembler::Trunc_uw_s(dst.gp(), rounded.fp(), kScratchDoubleReg);
+      // Avoid UINT32_MAX as an overflow indicator and use 0 instead,
+      // because 0 allows easier out-of-bounds detection.
+      TurboAssembler::Addu(kScratchReg, dst.gp(), 1);
+      TurboAssembler::Movz(dst.gp(), zero_reg, kScratchReg);
+
+      // Checking if trap.
+      TurboAssembler::Cvt_d_uw(converted_back.fp(), dst.gp(),
+                               kScratchDoubleReg);
+      cvt_s_d(converted_back.fp(), converted_back.fp());
+      TurboAssembler::CompareF32(EQ, rounded.fp(), converted_back.fp());
+      TurboAssembler::BranchFalseF(trap);
+      return true;
+    }
+    case kExprI32SConvertF64: {
+      if ((IsMipsArchVariant(kMips32r2) || IsMipsArchVariant(kMips32r6)) &&
+          IsFp64Mode()) {
+        LiftoffRegister rounded =
+            GetUnusedRegister(kFpReg, LiftoffRegList::ForRegs(src));
+        LiftoffRegister converted_back =
+            GetUnusedRegister(kFpReg, LiftoffRegList::ForRegs(src, rounded));
+
+        // Real conversion.
+        TurboAssembler::Trunc_d_d(rounded.fp(), src.fp());
+        TurboAssembler::Trunc_w_d(kScratchDoubleReg, rounded.fp());
+        mfc1(dst.gp(), kScratchDoubleReg);
+
+        // Checking if trap.
+        cvt_d_w(converted_back.fp(), kScratchDoubleReg);
+        TurboAssembler::CompareF64(EQ, rounded.fp(), converted_back.fp());
+        TurboAssembler::BranchFalseF(trap);
+        return true;
+      } else {
+        BAILOUT("emit_type_conversion kExprI32SConvertF64");
+        return true;
+      }
+    }
+    case kExprI32UConvertF64: {
+      if ((IsMipsArchVariant(kMips32r2) || IsMipsArchVariant(kMips32r6)) &&
+          IsFp64Mode()) {
+        LiftoffRegister rounded =
+            GetUnusedRegister(kFpReg, LiftoffRegList::ForRegs(src));
+        LiftoffRegister converted_back =
+            GetUnusedRegister(kFpReg, LiftoffRegList::ForRegs(src, rounded));
+
+        // Real conversion.
+        TurboAssembler::Trunc_d_d(rounded.fp(), src.fp());
+        TurboAssembler::Trunc_uw_d(dst.gp(), rounded.fp(), kScratchDoubleReg);
+
+        // Checking if trap.
+        TurboAssembler::Cvt_d_uw(converted_back.fp(), dst.gp(),
+                                 kScratchDoubleReg);
+        TurboAssembler::CompareF64(EQ, rounded.fp(), converted_back.fp());
+        TurboAssembler::BranchFalseF(trap);
+        return true;
+      } else {
+        BAILOUT("emit_type_conversion kExprI32UConvertF64");
+        return true;
+      }
+    }
     case kExprI32ReinterpretF32:
       mfc1(dst.gp(), src.fp());
       return true;
@@ -653,7 +1030,9 @@ void LiftoffAssembler::emit_jump(Label* label) {
   TurboAssembler::Branch(label);
 }
 
-void LiftoffAssembler::emit_jump(Register target) { BAILOUT("emit_jump"); }
+void LiftoffAssembler::emit_jump(Register target) {
+  TurboAssembler::Jump(target);
+}
 
 void LiftoffAssembler::emit_cond_jump(Condition cond, Label* label,
                                       ValueType type, Register lhs,
@@ -746,74 +1125,110 @@ void LiftoffAssembler::emit_i64_set_cond(Condition cond, Register dst,
   TurboAssembler::Move(dst, tmp);
 }
 
+namespace liftoff {
+
+inline FPUCondition ConditionToConditionCmpFPU(bool& predicate,
+                                               Condition condition) {
+  switch (condition) {
+    case kEqual:
+      predicate = true;
+      return EQ;
+    case kUnequal:
+      predicate = false;
+      return EQ;
+    case kUnsignedLessThan:
+      predicate = true;
+      return OLT;
+    case kUnsignedGreaterEqual:
+      predicate = false;
+      return OLT;
+    case kUnsignedLessEqual:
+      predicate = true;
+      return OLE;
+    case kUnsignedGreaterThan:
+      predicate = false;
+      return OLE;
+    default:
+      predicate = true;
+      break;
+  }
+  UNREACHABLE();
+}
+
+};  // namespace liftoff
+
 void LiftoffAssembler::emit_f32_set_cond(Condition cond, Register dst,
                                          DoubleRegister lhs,
                                          DoubleRegister rhs) {
-  BAILOUT("emit_f32_set_cond");
+  Label not_nan, cont;
+  TurboAssembler::CompareIsNanF32(lhs, rhs);
+  TurboAssembler::BranchFalseF(&not_nan);
+  // If one of the operands is NaN, return 1 for f32.ne, else 0.
+  if (cond == ne) {
+    TurboAssembler::li(dst, 1);
+  } else {
+    TurboAssembler::Move(dst, zero_reg);
+  }
+  TurboAssembler::Branch(&cont);
+
+  bind(&not_nan);
+
+  TurboAssembler::li(dst, 1);
+  bool predicate;
+  FPUCondition fcond = liftoff::ConditionToConditionCmpFPU(predicate, cond);
+  TurboAssembler::CompareF32(fcond, lhs, rhs);
+  if (predicate) {
+    TurboAssembler::LoadZeroIfNotFPUCondition(dst);
+  } else {
+    TurboAssembler::LoadZeroIfFPUCondition(dst);
+  }
+
+  bind(&cont);
 }
 
 void LiftoffAssembler::emit_f64_set_cond(Condition cond, Register dst,
                                          DoubleRegister lhs,
                                          DoubleRegister rhs) {
-  BAILOUT("emit_f64_set_cond");
+  Label not_nan, cont;
+  TurboAssembler::CompareIsNanF64(lhs, rhs);
+  TurboAssembler::BranchFalseF(&not_nan);
+  // If one of the operands is NaN, return 1 for f64.ne, else 0.
+  if (cond == ne) {
+    TurboAssembler::li(dst, 1);
+  } else {
+    TurboAssembler::Move(dst, zero_reg);
+  }
+  TurboAssembler::Branch(&cont);
+
+  bind(&not_nan);
+
+  TurboAssembler::li(dst, 1);
+  bool predicate;
+  FPUCondition fcond = liftoff::ConditionToConditionCmpFPU(predicate, cond);
+  TurboAssembler::CompareF64(fcond, lhs, rhs);
+  if (predicate) {
+    TurboAssembler::LoadZeroIfNotFPUCondition(dst);
+  } else {
+    TurboAssembler::LoadZeroIfFPUCondition(dst);
+  }
+
+  bind(&cont);
 }
 
-void LiftoffAssembler::StackCheck(Label* ool_code) {
-  LiftoffRegister tmp = GetUnusedRegister(kGpReg);
-  TurboAssembler::li(
-      tmp.gp(), Operand(ExternalReference::address_of_stack_limit(isolate())));
-  TurboAssembler::Ulw(tmp.gp(), MemOperand(tmp.gp()));
-  TurboAssembler::Branch(ool_code, ule, sp, Operand(tmp.gp()));
+void LiftoffAssembler::StackCheck(Label* ool_code, Register limit_address) {
+  TurboAssembler::Ulw(limit_address, MemOperand(limit_address));
+  TurboAssembler::Branch(ool_code, ule, sp, Operand(limit_address));
 }
 
 void LiftoffAssembler::CallTrapCallbackForTesting() {
   PrepareCallCFunction(0, GetUnusedRegister(kGpReg).gp());
-  CallCFunction(
-      ExternalReference::wasm_call_trap_callback_for_testing(isolate()), 0);
+  CallCFunction(ExternalReference::wasm_call_trap_callback_for_testing(), 0);
 }
 
 void LiftoffAssembler::AssertUnreachable(AbortReason reason) {
   if (emit_debug_code()) Abort(reason);
 }
 
-void LiftoffAssembler::PushCallerFrameSlot(const VarState& src,
-                                           uint32_t src_index,
-                                           RegPairHalf half) {
-  switch (src.loc()) {
-    case VarState::kStack: {
-      if (src.type() == kWasmF64) {
-        DCHECK_EQ(kLowWord, half);
-        lw(at, liftoff::GetHalfStackSlot(2 * src_index - 1));
-        push(at);
-      }
-      lw(at,
-         liftoff::GetHalfStackSlot(2 * src_index + (half == kLowWord ? 0 : 1)));
-      push(at);
-      break;
-    }
-    case VarState::kRegister:
-      if (src.type() == kWasmI64) {
-        PushCallerFrameSlot(
-            half == kLowWord ? src.reg().low() : src.reg().high(), kWasmI32);
-      } else {
-        PushCallerFrameSlot(src.reg(), src.type());
-      }
-      break;
-    case VarState::KIntConst: {
-      // The high word is the sign extension of the low word.
-      li(at,
-         Operand(half == kLowWord ? src.i32_const() : src.i32_const() >> 31));
-      push(at);
-      break;
-    }
-  }
-}
-
-void LiftoffAssembler::PushCallerFrameSlot(LiftoffRegister reg,
-                                           ValueType type) {
-  liftoff::push(this, reg, type);
-}
-
 void LiftoffAssembler::PushRegisters(LiftoffRegList regs) {
   LiftoffRegList gp_regs = regs & kGpCacheRegList;
   unsigned num_gp_regs = gp_regs.GetNumRegsSet();
@@ -869,82 +1284,70 @@ void LiftoffAssembler::DropStackSlotsAndRet(uint32_t num_stack_slots) {
   TurboAssembler::DropAndRet(static_cast<int>(num_stack_slots));
 }
 
-void LiftoffAssembler::PrepareCCall(wasm::FunctionSig* sig,
-                                    const LiftoffRegister* args,
-                                    ValueType out_argument_type) {
-  int pushed_bytes = 0;
+void LiftoffAssembler::CallC(wasm::FunctionSig* sig,
+                             const LiftoffRegister* args,
+                             const LiftoffRegister* rets,
+                             ValueType out_argument_type, int stack_bytes,
+                             ExternalReference ext_ref) {
+  addiu(sp, sp, -stack_bytes);
+
+  int arg_bytes = 0;
   for (ValueType param_type : sig->parameters()) {
-    pushed_bytes += RoundUp<kPointerSize>(WasmOpcodes::MemSize(param_type));
-    liftoff::push(this, *args++, param_type);
+    liftoff::Store(this, sp, arg_bytes, *args++, param_type);
+    arg_bytes += ValueTypes::MemSize(param_type);
   }
-  if (out_argument_type != kWasmStmt) {
-    int size = RoundUp<kPointerSize>(WasmOpcodes::MemSize(out_argument_type));
-    addiu(sp, sp, -size);
-    pushed_bytes += size;
+  DCHECK_LE(arg_bytes, stack_bytes);
+
+  // Pass a pointer to the buffer with the arguments to the C function.
+  // On mips, the first argument is passed in {a0}.
+  constexpr Register kFirstArgReg = a0;
+  mov(kFirstArgReg, sp);
+
+  // Now call the C function.
+  constexpr int kNumCCallArgs = 1;
+  PrepareCallCFunction(kNumCCallArgs, kScratchReg);
+  CallCFunction(ext_ref, kNumCCallArgs);
+
+  // Move return value to the right register.
+  const LiftoffRegister* next_result_reg = rets;
+  if (sig->return_count() > 0) {
+    DCHECK_EQ(1, sig->return_count());
+    constexpr Register kReturnReg = v0;
+    if (kReturnReg != next_result_reg->gp()) {
+      Move(*next_result_reg, LiftoffRegister(kReturnReg), sig->GetReturn(0));
+    }
+    ++next_result_reg;
   }
-  // Save the original sp (before the first push), such that we can later
-  // compute pointers to the pushed values. Do this only *after* pushing the
-  // values, because {kCCallLastArgAddrReg} might collide with an arg register.
-  addiu(liftoff::kCCallLastArgAddrReg, sp, pushed_bytes);
-  constexpr Register kScratch = at;
-  static_assert(kScratch != liftoff::kCCallLastArgAddrReg, "collision");
-  int num_c_call_arguments = static_cast<int>(sig->parameter_count()) +
-                             (out_argument_type != kWasmStmt);
-  PrepareCallCFunction(num_c_call_arguments, kScratch);
-}
-
-void LiftoffAssembler::SetCCallRegParamAddr(Register dst, int param_byte_offset,
-                                            ValueType type) {
-  // Check that we don't accidentally override kCCallLastArgAddrReg.
-  DCHECK_NE(liftoff::kCCallLastArgAddrReg, dst);
-  addiu(dst, liftoff::kCCallLastArgAddrReg, -param_byte_offset);
-}
-
-void LiftoffAssembler::SetCCallStackParamAddr(int stack_param_idx,
-                                              int param_byte_offset,
-                                              ValueType type) {
-  static constexpr Register kScratch = at;
-  SetCCallRegParamAddr(kScratch, param_byte_offset, type);
-  sw(kScratch, MemOperand(sp, stack_param_idx * kPointerSize));
-}
 
-void LiftoffAssembler::LoadCCallOutArgument(LiftoffRegister dst, ValueType type,
-                                            int param_byte_offset) {
-  // Check that we don't accidentally override kCCallLastArgAddrReg.
-  DCHECK_NE(LiftoffRegister(liftoff::kCCallLastArgAddrReg), dst);
-  MemOperand src(liftoff::kCCallLastArgAddrReg, -param_byte_offset);
-  liftoff::Load(this, dst, src, type);
-}
-
-void LiftoffAssembler::CallC(ExternalReference ext_ref, uint32_t num_params) {
-  CallCFunction(ext_ref, static_cast<int>(num_params));
-}
+  // Load potential output value from the buffer on the stack.
+  if (out_argument_type != kWasmStmt) {
+    liftoff::Load(this, *next_result_reg, sp, 0, out_argument_type);
+  }
 
-void LiftoffAssembler::FinishCCall() {
-  TurboAssembler::Move(sp, liftoff::kCCallLastArgAddrReg);
+  addiu(sp, sp, stack_bytes);
 }
 
 void LiftoffAssembler::CallNativeWasmCode(Address addr) {
   Call(addr, RelocInfo::WASM_CALL);
 }
 
-void LiftoffAssembler::CallRuntime(Zone* zone, Runtime::FunctionId fid) {
-  // Set instance to zero.
-  TurboAssembler::Move(cp, zero_reg);
-  CallRuntimeDelayed(zone, fid);
-}
-
 void LiftoffAssembler::CallIndirect(wasm::FunctionSig* sig,
                                     compiler::CallDescriptor* call_descriptor,
                                     Register target) {
   if (target == no_reg) {
-    pop(at);
-    Call(at);
+    pop(kScratchReg);
+    Call(kScratchReg);
   } else {
     Call(target);
   }
 }
 
+void LiftoffAssembler::CallRuntimeStub(WasmCode::RuntimeStubId sid) {
+  // A direct call to a wasm runtime stub defined in this module.
+  // Just encode the stub index. This will be patched at relocation.
+  Call(static_cast<Address>(sid), RelocInfo::WASM_STUB_CALL);
+}
+
 void LiftoffAssembler::AllocateStackSlot(Register addr, uint32_t size) {
   addiu(sp, sp, -size);
   TurboAssembler::Move(addr, sp);
@@ -954,6 +1357,44 @@ void LiftoffAssembler::DeallocateStackSlot(uint32_t size) {
   addiu(sp, sp, size);
 }
 
+void LiftoffStackSlots::Construct() {
+  for (auto& slot : slots_) {
+    const LiftoffAssembler::VarState& src = slot.src_;
+    switch (src.loc()) {
+      case LiftoffAssembler::VarState::kStack: {
+        if (src.type() == kWasmF64) {
+          DCHECK_EQ(kLowWord, slot.half_);
+          asm_->lw(kScratchReg,
+                   liftoff::GetHalfStackSlot(2 * slot.src_index_ - 1));
+          asm_->push(kScratchReg);
+        }
+        asm_->lw(kScratchReg,
+                 liftoff::GetHalfStackSlot(2 * slot.src_index_ +
+                                           (slot.half_ == kLowWord ? 0 : 1)));
+        asm_->push(kScratchReg);
+        break;
+      }
+      case LiftoffAssembler::VarState::kRegister:
+        if (src.type() == kWasmI64) {
+          liftoff::push(
+              asm_, slot.half_ == kLowWord ? src.reg().low() : src.reg().high(),
+              kWasmI32);
+        } else {
+          liftoff::push(asm_, src.reg(), src.type());
+        }
+        break;
+      case LiftoffAssembler::VarState::KIntConst: {
+        // The high word is the sign extension of the low word.
+        asm_->li(kScratchReg,
+                 Operand(slot.half_ == kLowWord ? src.i32_const()
+                                                : src.i32_const() >> 31));
+        asm_->push(kScratchReg);
+        break;
+      }
+    }
+  }
+}
+
 }  // namespace wasm
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/src/wasm/baseline/mips64/liftoff-assembler-mips64.h b/deps/v8/src/wasm/baseline/mips64/liftoff-assembler-mips64.h
index 9397494cab555c..fdbbe0f7d463a4 100644
--- a/deps/v8/src/wasm/baseline/mips64/liftoff-assembler-mips64.h
+++ b/deps/v8/src/wasm/baseline/mips64/liftoff-assembler-mips64.h
@@ -28,11 +28,6 @@ inline MemOperand GetStackSlot(uint32_t index) {
 
 inline MemOperand GetInstanceOperand() { return MemOperand(fp, -16); }
 
-// Use this register to store the address of the last argument pushed on the
-// stack for a call to C. This register must be callee saved according to the c
-// calling convention.
-static constexpr Register kCCallLastArgAddrReg = s1;
-
 inline void Load(LiftoffAssembler* assm, LiftoffRegister dst, MemOperand src,
                  ValueType type) {
   switch (type) {
@@ -53,6 +48,27 @@ inline void Load(LiftoffAssembler* assm, LiftoffRegister dst, MemOperand src,
   }
 }
 
+inline void Store(LiftoffAssembler* assm, Register base, int32_t offset,
+                  LiftoffRegister src, ValueType type) {
+  MemOperand dst(base, offset);
+  switch (type) {
+    case kWasmI32:
+      assm->Usw(src.gp(), dst);
+      break;
+    case kWasmI64:
+      assm->Usd(src.gp(), dst);
+      break;
+    case kWasmF32:
+      assm->Uswc1(src.fp(), dst, t8);
+      break;
+    case kWasmF64:
+      assm->Usdc1(src.fp(), dst, t8);
+      break;
+    default:
+      UNREACHABLE();
+  }
+}
+
 inline void push(LiftoffAssembler* assm, LiftoffRegister reg, ValueType type) {
   switch (type) {
     case kWasmI32:
@@ -74,8 +90,8 @@ inline void push(LiftoffAssembler* assm, LiftoffRegister reg, ValueType type) {
 
 }  // namespace liftoff
 
-uint32_t LiftoffAssembler::PrepareStackFrame() {
-  uint32_t offset = static_cast<uint32_t>(pc_offset());
+int LiftoffAssembler::PrepareStackFrame() {
+  int offset = pc_offset();
   // When constant that represents size of stack frame can't be represented
   // as 16bit we need three instructions to add it to sp, so we reserve space
   // for this case.
@@ -85,21 +101,26 @@ uint32_t LiftoffAssembler::PrepareStackFrame() {
   return offset;
 }
 
-void LiftoffAssembler::PatchPrepareStackFrame(uint32_t offset,
+void LiftoffAssembler::PatchPrepareStackFrame(int offset,
                                               uint32_t stack_slots) {
   uint64_t bytes = liftoff::kConstantStackSpace + kStackSlotSize * stack_slots;
   DCHECK_LE(bytes, kMaxInt);
   // We can't run out of space, just pass anything big enough to not cause the
   // assembler to try to grow the buffer.
   constexpr int kAvailableSpace = 256;
-  TurboAssembler patching_assembler(isolate(), buffer_ + offset,
-                                    kAvailableSpace, CodeObjectRequired::kNo);
+  TurboAssembler patching_assembler(nullptr, AssemblerOptions{},
+                                    buffer_ + offset, kAvailableSpace,
+                                    CodeObjectRequired::kNo);
   // If bytes can be represented as 16bit, daddiu will be generated and two
   // nops will stay untouched. Otherwise, lui-ori sequence will load it to
   // register and, as third instruction, daddu will be generated.
   patching_assembler.Daddu(sp, sp, Operand(-bytes));
 }
 
+void LiftoffAssembler::FinishCode() {}
+
+void LiftoffAssembler::AbortCompilation() {}
+
 void LiftoffAssembler::LoadConstant(LiftoffRegister reg, WasmValue value,
                                     RelocInfo::Mode rmode) {
   switch (value.type()) {
@@ -143,8 +164,7 @@ void LiftoffAssembler::FillInstanceInto(Register dst) {
 void LiftoffAssembler::Load(LiftoffRegister dst, Register src_addr,
                             Register offset_reg, uint32_t offset_imm,
                             LoadType type, LiftoffRegList pinned,
-                            uint32_t* protected_load_pc) {
-  // TODO(ksreten): Add check if unaligned memory access
+                            uint32_t* protected_load_pc, bool is_load_mem) {
   MemOperand src_op(src_addr, offset_imm);
   if (offset_reg != no_reg) {
     Register src = GetUnusedRegister(kGpReg, pinned).gp();
@@ -170,10 +190,10 @@ void LiftoffAssembler::Load(LiftoffRegister dst, Register src_addr,
     case LoadType::kI64Load16S:
       TurboAssembler::Ulh(dst.gp(), src_op);
       break;
-    case LoadType::kI32Load:
     case LoadType::kI64Load32U:
       TurboAssembler::Ulwu(dst.gp(), src_op);
       break;
+    case LoadType::kI32Load:
     case LoadType::kI64Load32S:
       TurboAssembler::Ulw(dst.gp(), src_op);
       break;
@@ -189,13 +209,18 @@ void LiftoffAssembler::Load(LiftoffRegister dst, Register src_addr,
     default:
       UNREACHABLE();
   }
+
+#if defined(V8_TARGET_BIG_ENDIAN)
+  if (is_load_mem) {
+    ChangeEndiannessLoad(dst, type, pinned);
+  }
+#endif
 }
 
 void LiftoffAssembler::Store(Register dst_addr, Register offset_reg,
                              uint32_t offset_imm, LiftoffRegister src,
                              StoreType type, LiftoffRegList pinned,
-                             uint32_t* protected_store_pc) {
-  // TODO(ksreten): Add check if unaligned memory access
+                             uint32_t* protected_store_pc, bool is_store_mem) {
   Register dst = no_reg;
   if (offset_reg != no_reg) {
     dst = GetUnusedRegister(kGpReg, pinned).gp();
@@ -204,6 +229,18 @@ void LiftoffAssembler::Store(Register dst_addr, Register offset_reg,
   MemOperand dst_op = (offset_reg != no_reg) ? MemOperand(dst, offset_imm)
                                              : MemOperand(dst_addr, offset_imm);
 
+#if defined(V8_TARGET_BIG_ENDIAN)
+  if (is_store_mem) {
+    LiftoffRegister tmp = GetUnusedRegister(src.reg_class(), pinned);
+    // Save original value.
+    Move(tmp, src, type.value_type());
+
+    src = tmp;
+    pinned.set(tmp);
+    ChangeEndiannessStore(src, type, pinned);
+  }
+#endif
+
   if (protected_store_pc) *protected_store_pc = pc_offset();
   switch (type.value()) {
     case StoreType::kI32Store8:
@@ -232,6 +269,114 @@ void LiftoffAssembler::Store(Register dst_addr, Register offset_reg,
   }
 }
 
+void LiftoffAssembler::ChangeEndiannessLoad(LiftoffRegister dst, LoadType type,
+                                            LiftoffRegList pinned) {
+  bool is_float = false;
+  LiftoffRegister tmp = dst;
+  switch (type.value()) {
+    case LoadType::kI64Load8U:
+    case LoadType::kI64Load8S:
+    case LoadType::kI32Load8U:
+    case LoadType::kI32Load8S:
+      // No need to change endianness for byte size.
+      return;
+    case LoadType::kF32Load:
+      is_float = true;
+      tmp = GetUnusedRegister(kGpReg, pinned);
+      emit_type_conversion(kExprI32ReinterpretF32, tmp, dst);
+      V8_FALLTHROUGH;
+    case LoadType::kI64Load32U:
+      TurboAssembler::ByteSwapUnsigned(tmp.gp(), tmp.gp(), 4);
+      dsrl32(tmp.gp(), tmp.gp(), 0);
+      break;
+    case LoadType::kI32Load:
+    case LoadType::kI64Load32S:
+      TurboAssembler::ByteSwapSigned(tmp.gp(), tmp.gp(), 4);
+      dsra32(tmp.gp(), tmp.gp(), 0);
+      break;
+    case LoadType::kI32Load16S:
+    case LoadType::kI64Load16S:
+      TurboAssembler::ByteSwapSigned(tmp.gp(), tmp.gp(), 2);
+      dsra32(tmp.gp(), tmp.gp(), 0);
+      break;
+    case LoadType::kI32Load16U:
+    case LoadType::kI64Load16U:
+      TurboAssembler::ByteSwapUnsigned(tmp.gp(), tmp.gp(), 2);
+      dsrl32(tmp.gp(), tmp.gp(), 0);
+      break;
+    case LoadType::kF64Load:
+      is_float = true;
+      tmp = GetUnusedRegister(kGpReg, pinned);
+      emit_type_conversion(kExprI64ReinterpretF64, tmp, dst);
+      V8_FALLTHROUGH;
+    case LoadType::kI64Load:
+      TurboAssembler::ByteSwapSigned(tmp.gp(), tmp.gp(), 8);
+      break;
+    default:
+      UNREACHABLE();
+  }
+
+  if (is_float) {
+    switch (type.value()) {
+      case LoadType::kF32Load:
+        emit_type_conversion(kExprF32ReinterpretI32, dst, tmp);
+        break;
+      case LoadType::kF64Load:
+        emit_type_conversion(kExprF64ReinterpretI64, dst, tmp);
+        break;
+      default:
+        UNREACHABLE();
+    }
+  }
+}
+
+void LiftoffAssembler::ChangeEndiannessStore(LiftoffRegister src,
+                                             StoreType type,
+                                             LiftoffRegList pinned) {
+  bool is_float = false;
+  LiftoffRegister tmp = src;
+  switch (type.value()) {
+    case StoreType::kI64Store8:
+    case StoreType::kI32Store8:
+      // No need to change endianness for byte size.
+      return;
+    case StoreType::kF32Store:
+      is_float = true;
+      tmp = GetUnusedRegister(kGpReg, pinned);
+      emit_type_conversion(kExprI32ReinterpretF32, tmp, src);
+      V8_FALLTHROUGH;
+    case StoreType::kI32Store:
+    case StoreType::kI32Store16:
+      TurboAssembler::ByteSwapSigned(tmp.gp(), tmp.gp(), 4);
+      break;
+    case StoreType::kF64Store:
+      is_float = true;
+      tmp = GetUnusedRegister(kGpReg, pinned);
+      emit_type_conversion(kExprI64ReinterpretF64, tmp, src);
+      V8_FALLTHROUGH;
+    case StoreType::kI64Store:
+    case StoreType::kI64Store32:
+    case StoreType::kI64Store16:
+      TurboAssembler::ByteSwapSigned(tmp.gp(), tmp.gp(), 8);
+      break;
+    default:
+      UNREACHABLE();
+  }
+
+  if (is_float) {
+    switch (type.value()) {
+      case StoreType::kF32Store:
+        emit_type_conversion(kExprF32ReinterpretI32, src, tmp);
+        break;
+      case StoreType::kF64Store:
+        emit_type_conversion(kExprF64ReinterpretI64, src, tmp);
+        break;
+      default:
+        UNREACHABLE();
+    }
+  }
+}
+
 void LiftoffAssembler::LoadCallerFrameSlot(LiftoffRegister dst,
                                            uint32_t caller_slot_idx,
                                            ValueType type) {
@@ -247,12 +392,6 @@ void LiftoffAssembler::MoveStackValue(uint32_t dst_index, uint32_t src_index,
   Spill(dst_index, reg, type);
 }
 
-void LiftoffAssembler::MoveToReturnRegister(LiftoffRegister reg,
-                                            ValueType type) {
-  LiftoffRegister dst = reg.is_gp() ? LiftoffRegister(v0) : LiftoffRegister(f2);
-  if (reg != dst) Move(dst, reg, type);
-}
-
 void LiftoffAssembler::Move(Register dst, Register src, ValueType type) {
   DCHECK_NE(dst, src);
   // TODO(ksreten): Handle different sizes here.
@@ -339,6 +478,41 @@ void LiftoffAssembler::emit_i32_mul(Register dst, Register lhs, Register rhs) {
   TurboAssembler::Mul(dst, lhs, rhs);
 }
 
+void LiftoffAssembler::emit_i32_divs(Register dst, Register lhs, Register rhs,
+                                     Label* trap_div_by_zero,
+                                     Label* trap_div_unrepresentable) {
+  TurboAssembler::Branch(trap_div_by_zero, eq, rhs, Operand(zero_reg));
+
+  // Check if lhs == kMinInt and rhs == -1, since this case is unrepresentable.
+  TurboAssembler::li(kScratchReg, 1);
+  TurboAssembler::li(kScratchReg2, 1);
+  TurboAssembler::LoadZeroOnCondition(kScratchReg, lhs, Operand(kMinInt), eq);
+  TurboAssembler::LoadZeroOnCondition(kScratchReg2, rhs, Operand(-1), eq);
+  daddu(kScratchReg, kScratchReg, kScratchReg2);
+  TurboAssembler::Branch(trap_div_unrepresentable, eq, kScratchReg,
+                         Operand(zero_reg));
+
+  TurboAssembler::Div(dst, lhs, rhs);
+}
+
+void LiftoffAssembler::emit_i32_divu(Register dst, Register lhs, Register rhs,
+                                     Label* trap_div_by_zero) {
+  TurboAssembler::Branch(trap_div_by_zero, eq, rhs, Operand(zero_reg));
+  TurboAssembler::Divu(dst, lhs, rhs);
+}
+
+void LiftoffAssembler::emit_i32_rems(Register dst, Register lhs, Register rhs,
+                                     Label* trap_div_by_zero) {
+  TurboAssembler::Branch(trap_div_by_zero, eq, rhs, Operand(zero_reg));
+  TurboAssembler::Mod(dst, lhs, rhs);
+}
+
+void LiftoffAssembler::emit_i32_remu(Register dst, Register lhs, Register rhs,
+                                     Label* trap_div_by_zero) {
+  TurboAssembler::Branch(trap_div_by_zero, eq, rhs, Operand(zero_reg));
+  TurboAssembler::Modu(dst, lhs, rhs);
+}
+
 #define I32_BINOP(name, instruction)                                 \
   void LiftoffAssembler::emit_i32_##name(Register dst, Register lhs, \
                                          Register rhs) {             \
@@ -382,26 +556,67 @@ I32_SHIFTOP(shr, srlv)
 
 #undef I32_SHIFTOP
 
-void LiftoffAssembler::emit_i64_add(LiftoffRegister dst, LiftoffRegister lhs,
+void LiftoffAssembler::emit_i64_mul(LiftoffRegister dst, LiftoffRegister lhs,
                                     LiftoffRegister rhs) {
-  TurboAssembler::Daddu(dst.gp(), lhs.gp(), rhs.gp());
+  TurboAssembler::Dmul(dst.gp(), lhs.gp(), rhs.gp());
 }
 
-void LiftoffAssembler::emit_i64_sub(LiftoffRegister dst, LiftoffRegister lhs,
-                                    LiftoffRegister rhs) {
-  BAILOUT("i64_sub");
+bool LiftoffAssembler::emit_i64_divs(LiftoffRegister dst, LiftoffRegister lhs,
+                                     LiftoffRegister rhs,
+                                     Label* trap_div_by_zero,
+                                     Label* trap_div_unrepresentable) {
+  TurboAssembler::Branch(trap_div_by_zero, eq, rhs.gp(), Operand(zero_reg));
+
+  // Check if lhs == MinInt64 and rhs == -1, since this case is unrepresentable.
+  TurboAssembler::li(kScratchReg, 1);
+  TurboAssembler::li(kScratchReg2, 1);
+  TurboAssembler::LoadZeroOnCondition(
+      kScratchReg, lhs.gp(), Operand(std::numeric_limits<int64_t>::min()), eq);
+  TurboAssembler::LoadZeroOnCondition(kScratchReg2, rhs.gp(), Operand(-1), eq);
+  daddu(kScratchReg, kScratchReg, kScratchReg2);
+  TurboAssembler::Branch(trap_div_unrepresentable, eq, kScratchReg,
+                         Operand(zero_reg));
+
+  TurboAssembler::Ddiv(dst.gp(), lhs.gp(), rhs.gp());
+  return true;
+}
+
+bool LiftoffAssembler::emit_i64_divu(LiftoffRegister dst, LiftoffRegister lhs,
+                                     LiftoffRegister rhs,
+                                     Label* trap_div_by_zero) {
+  TurboAssembler::Branch(trap_div_by_zero, eq, rhs.gp(), Operand(zero_reg));
+  TurboAssembler::Ddivu(dst.gp(), lhs.gp(), rhs.gp());
+  return true;
+}
+
+bool LiftoffAssembler::emit_i64_rems(LiftoffRegister dst, LiftoffRegister lhs,
+                                     LiftoffRegister rhs,
+                                     Label* trap_div_by_zero) {
+  TurboAssembler::Branch(trap_div_by_zero, eq, rhs.gp(), Operand(zero_reg));
+  TurboAssembler::Dmod(dst.gp(), lhs.gp(), rhs.gp());
+  return true;
+}
+
+bool LiftoffAssembler::emit_i64_remu(LiftoffRegister dst, LiftoffRegister lhs,
+                                     LiftoffRegister rhs,
+                                     Label* trap_div_by_zero) {
+  TurboAssembler::Branch(trap_div_by_zero, eq, rhs.gp(), Operand(zero_reg));
+  TurboAssembler::Dmodu(dst.gp(), lhs.gp(), rhs.gp());
+  return true;
 }
 
-#define I64_BINOP(name)                                                \
+#define I64_BINOP(name, instruction)                                   \
   void LiftoffAssembler::emit_i64_##name(                              \
       LiftoffRegister dst, LiftoffRegister lhs, LiftoffRegister rhs) { \
-    BAILOUT("i64_" #name);                                             \
+    instruction(dst.gp(), lhs.gp(), rhs.gp());                         \
   }
 
 // clang-format off
-I64_BINOP(and)
-I64_BINOP(or)
-I64_BINOP(xor)
+I64_BINOP(add, daddu)
+I64_BINOP(sub, dsubu)
+I64_BINOP(and, and_)
+I64_BINOP(or, or_)
+I64_BINOP(xor, xor_)
 // clang-format on
 
 #undef I64_BINOP
@@ -419,6 +634,62 @@ I64_SHIFTOP(shr, dsrlv)
 
 #undef I64_SHIFTOP
 
+void LiftoffAssembler::emit_i32_to_intptr(Register dst, Register src) {
+  addu(dst, src, zero_reg);
+}
+
+void LiftoffAssembler::emit_f32_neg(DoubleRegister dst, DoubleRegister src) {
+  TurboAssembler::Neg_s(dst, src);
+}
+
+void LiftoffAssembler::emit_f64_neg(DoubleRegister dst, DoubleRegister src) {
+  TurboAssembler::Neg_d(dst, src);
+}
+
+void LiftoffAssembler::emit_f32_min(DoubleRegister dst, DoubleRegister lhs,
+                                    DoubleRegister rhs) {
+  Label ool, done;
+  TurboAssembler::Float32Min(dst, lhs, rhs, &ool);
+  Branch(&done);
+
+  bind(&ool);
+  TurboAssembler::Float32MinOutOfLine(dst, lhs, rhs);
+  bind(&done);
+}
+
+void LiftoffAssembler::emit_f32_max(DoubleRegister dst, DoubleRegister lhs,
+                                    DoubleRegister rhs) {
+  Label ool, done;
+  TurboAssembler::Float32Max(dst, lhs, rhs, &ool);
+  Branch(&done);
+
+  bind(&ool);
+  TurboAssembler::Float32MaxOutOfLine(dst, lhs, rhs);
+  bind(&done);
+}
+
+void LiftoffAssembler::emit_f64_min(DoubleRegister dst, DoubleRegister lhs,
+                                    DoubleRegister rhs) {
+  Label ool, done;
+  TurboAssembler::Float64Min(dst, lhs, rhs, &ool);
+  Branch(&done);
+
+  bind(&ool);
+  TurboAssembler::Float64MinOutOfLine(dst, lhs, rhs);
+  bind(&done);
+}
+
+void LiftoffAssembler::emit_f64_max(DoubleRegister dst, DoubleRegister lhs,
+                                    DoubleRegister rhs) {
+  Label ool, done;
+  TurboAssembler::Float64Max(dst, lhs, rhs, &ool);
+  Branch(&done);
+
+  bind(&ool);
+  TurboAssembler::Float64MaxOutOfLine(dst, lhs, rhs);
+  bind(&done);
+}
+
 #define FP_BINOP(name, instruction)                                          \
   void LiftoffAssembler::emit_##name(DoubleRegister dst, DoubleRegister lhs, \
                                      DoubleRegister rhs) {                   \
@@ -428,13 +699,17 @@ I64_SHIFTOP(shr, dsrlv)
   void LiftoffAssembler::emit_##name(DoubleRegister dst, DoubleRegister src) { \
     instruction(dst, src);                                                     \
   }
+#define FP_UNOP_RETURN_TRUE(name, instruction)                                 \
+  bool LiftoffAssembler::emit_##name(DoubleRegister dst, DoubleRegister src) { \
+    instruction(dst, src);                                                     \
+    return true;                                                               \
+  }
 
 FP_BINOP(f32_add, add_s)
 FP_BINOP(f32_sub, sub_s)
 FP_BINOP(f32_mul, mul_s)
 FP_BINOP(f32_div, div_s)
 FP_UNOP(f32_abs, abs_s)
-FP_UNOP(f32_neg, neg_s)
 FP_UNOP(f32_ceil, Ceil_s_s)
 FP_UNOP(f32_floor, Floor_s_s)
 FP_UNOP(f32_trunc, Trunc_s_s)
@@ -445,23 +720,100 @@ FP_BINOP(f64_sub, sub_d)
 FP_BINOP(f64_mul, mul_d)
 FP_BINOP(f64_div, div_d)
 FP_UNOP(f64_abs, abs_d)
-FP_UNOP(f64_neg, neg_d)
-FP_UNOP(f64_ceil, Ceil_d_d)
-FP_UNOP(f64_floor, Floor_d_d)
-FP_UNOP(f64_trunc, Trunc_d_d)
-FP_UNOP(f64_nearest_int, Round_d_d)
+FP_UNOP_RETURN_TRUE(f64_ceil, Ceil_d_d)
+FP_UNOP_RETURN_TRUE(f64_floor, Floor_d_d)
+FP_UNOP_RETURN_TRUE(f64_trunc, Trunc_d_d)
+FP_UNOP_RETURN_TRUE(f64_nearest_int, Round_d_d)
 FP_UNOP(f64_sqrt, sqrt_d)
 
 #undef FP_BINOP
 #undef FP_UNOP
+#undef FP_UNOP_RETURN_TRUE
 
 bool LiftoffAssembler::emit_type_conversion(WasmOpcode opcode,
                                             LiftoffRegister dst,
-                                            LiftoffRegister src) {
+                                            LiftoffRegister src, Label* trap) {
   switch (opcode) {
     case kExprI32ConvertI64:
       TurboAssembler::Ext(dst.gp(), src.gp(), 0, 32);
       return true;
+    case kExprI32SConvertF32: {
+      LiftoffRegister rounded =
+          GetUnusedRegister(kFpReg, LiftoffRegList::ForRegs(src));
+      LiftoffRegister converted_back =
+          GetUnusedRegister(kFpReg, LiftoffRegList::ForRegs(src, rounded));
+
+      // Real conversion.
+      TurboAssembler::Trunc_s_s(rounded.fp(), src.fp());
+      trunc_w_s(kScratchDoubleReg, rounded.fp());
+      mfc1(dst.gp(), kScratchDoubleReg);
+      // Avoid INT32_MAX as an overflow indicator and use INT32_MIN instead,
+      // because INT32_MIN allows easier out-of-bounds detection.
+      TurboAssembler::Addu(kScratchReg, dst.gp(), 1);
+      TurboAssembler::Slt(kScratchReg2, kScratchReg, dst.gp());
+      TurboAssembler::Movn(dst.gp(), kScratchReg, kScratchReg2);
+
+      // Checking if trap.
+      mtc1(dst.gp(), kScratchDoubleReg);
+      cvt_s_w(converted_back.fp(), kScratchDoubleReg);
+      TurboAssembler::CompareF32(EQ, rounded.fp(), converted_back.fp());
+      TurboAssembler::BranchFalseF(trap);
+      return true;
+    }
+    case kExprI32UConvertF32: {
+      LiftoffRegister rounded =
+          GetUnusedRegister(kFpReg, LiftoffRegList::ForRegs(src));
+      LiftoffRegister converted_back =
+          GetUnusedRegister(kFpReg, LiftoffRegList::ForRegs(src, rounded));
+
+      // Real conversion.
+      TurboAssembler::Trunc_s_s(rounded.fp(), src.fp());
+      TurboAssembler::Trunc_uw_s(dst.gp(), rounded.fp(), kScratchDoubleReg);
+      // Avoid UINT32_MAX as an overflow indicator and use 0 instead,
+      // because 0 allows easier out-of-bounds detection.
+      TurboAssembler::Addu(kScratchReg, dst.gp(), 1);
+      TurboAssembler::Movz(dst.gp(), zero_reg, kScratchReg);
+
+      // Checking if trap.
+      TurboAssembler::Cvt_d_uw(converted_back.fp(), dst.gp());
+      cvt_s_d(converted_back.fp(), converted_back.fp());
+      TurboAssembler::CompareF32(EQ, rounded.fp(), converted_back.fp());
+      TurboAssembler::BranchFalseF(trap);
+      return true;
+    }
+    case kExprI32SConvertF64: {
+      LiftoffRegister rounded =
+          GetUnusedRegister(kFpReg, LiftoffRegList::ForRegs(src));
+      LiftoffRegister converted_back =
+          GetUnusedRegister(kFpReg, LiftoffRegList::ForRegs(src, rounded));
+
+      // Real conversion.
+      TurboAssembler::Trunc_d_d(rounded.fp(), src.fp());
+      trunc_w_d(kScratchDoubleReg, rounded.fp());
+      mfc1(dst.gp(), kScratchDoubleReg);
+
+      // Checking if trap.
+      cvt_d_w(converted_back.fp(), kScratchDoubleReg);
+      TurboAssembler::CompareF64(EQ, rounded.fp(), converted_back.fp());
+      TurboAssembler::BranchFalseF(trap);
+      return true;
+    }
+    case kExprI32UConvertF64: {
+      LiftoffRegister rounded =
+          GetUnusedRegister(kFpReg, LiftoffRegList::ForRegs(src));
+      LiftoffRegister converted_back =
+          GetUnusedRegister(kFpReg, LiftoffRegList::ForRegs(src, rounded));
+
+      // Real conversion.
+      TurboAssembler::Trunc_d_d(rounded.fp(), src.fp());
+      TurboAssembler::Trunc_uw_d(dst.gp(), rounded.fp(), kScratchDoubleReg);
+
+      // Checking if trap.
+      TurboAssembler::Cvt_d_uw(converted_back.fp(), dst.gp());
+      TurboAssembler::CompareF64(EQ, rounded.fp(), converted_back.fp());
+      TurboAssembler::BranchFalseF(trap);
+      return true;
+    }
     case kExprI32ReinterpretF32:
       TurboAssembler::FmoveLow(dst.gp(), src.fp());
       return true;
@@ -471,6 +823,70 @@ bool LiftoffAssembler::emit_type_conversion(WasmOpcode opcode,
     case kExprI64UConvertI32:
       TurboAssembler::Dext(dst.gp(), src.gp(), 0, 32);
       return true;
+    case kExprI64SConvertF32: {
+      LiftoffRegister rounded =
+          GetUnusedRegister(kFpReg, LiftoffRegList::ForRegs(src));
+      LiftoffRegister converted_back =
+          GetUnusedRegister(kFpReg, LiftoffRegList::ForRegs(src, rounded));
+
+      // Real conversion.
+      TurboAssembler::Trunc_s_s(rounded.fp(), src.fp());
+      trunc_l_s(kScratchDoubleReg, rounded.fp());
+      dmfc1(dst.gp(), kScratchDoubleReg);
+      // Avoid INT64_MAX as an overflow indicator and use INT64_MIN instead,
+      // because INT64_MIN allows easier out-of-bounds detection.
+      TurboAssembler::Daddu(kScratchReg, dst.gp(), 1);
+      TurboAssembler::Slt(kScratchReg2, kScratchReg, dst.gp());
+      TurboAssembler::Movn(dst.gp(), kScratchReg, kScratchReg2);
+
+      // Checking if trap.
+      dmtc1(dst.gp(), kScratchDoubleReg);
+      cvt_s_l(converted_back.fp(), kScratchDoubleReg);
+      TurboAssembler::CompareF32(EQ, rounded.fp(), converted_back.fp());
+      TurboAssembler::BranchFalseF(trap);
+      return true;
+    }
+    case kExprI64UConvertF32: {
+      // Real conversion.
+      TurboAssembler::Trunc_ul_s(dst.gp(), src.fp(), kScratchDoubleReg,
+                                 kScratchReg);
+
+      // Checking if trap.
+      TurboAssembler::Branch(trap, eq, kScratchReg, Operand(zero_reg));
+      return true;
+    }
+    case kExprI64SConvertF64: {
+      LiftoffRegister rounded =
+          GetUnusedRegister(kFpReg, LiftoffRegList::ForRegs(src));
+      LiftoffRegister converted_back =
+          GetUnusedRegister(kFpReg, LiftoffRegList::ForRegs(src, rounded));
+
+      // Real conversion.
+      TurboAssembler::Trunc_d_d(rounded.fp(), src.fp());
+      trunc_l_d(kScratchDoubleReg, rounded.fp());
+      dmfc1(dst.gp(), kScratchDoubleReg);
+      // Avoid INT64_MAX as an overflow indicator and use INT64_MIN instead,
+      // because INT64_MIN allows easier out-of-bounds detection.
+      TurboAssembler::Daddu(kScratchReg, dst.gp(), 1);
+      TurboAssembler::Slt(kScratchReg2, kScratchReg, dst.gp());
+      TurboAssembler::Movn(dst.gp(), kScratchReg, kScratchReg2);
+
+      // Checking if trap.
+      dmtc1(dst.gp(), kScratchDoubleReg);
+      cvt_d_l(converted_back.fp(), kScratchDoubleReg);
+      TurboAssembler::CompareF64(EQ, rounded.fp(), converted_back.fp());
+      TurboAssembler::BranchFalseF(trap);
+      return true;
+    }
+    case kExprI64UConvertF64: {
+      // Real conversion.
+      TurboAssembler::Trunc_ul_d(dst.gp(), src.fp(), kScratchDoubleReg,
+                                 kScratchReg);
+
+      // Checking if trap.
+      TurboAssembler::Branch(trap, eq, kScratchReg, Operand(zero_reg));
+      return true;
+    }
     case kExprI64ReinterpretF64:
       dmfc1(dst.gp(), src.fp());
       return true;
@@ -515,7 +931,9 @@ void LiftoffAssembler::emit_jump(Label* label) {
   TurboAssembler::Branch(label);
 }
 
-void LiftoffAssembler::emit_jump(Register target) { BAILOUT("emit_jump"); }
+void LiftoffAssembler::emit_jump(Register target) {
+  TurboAssembler::Jump(target);
+}
 
 void LiftoffAssembler::emit_cond_jump(Condition cond, Label* label,
                                       ValueType type, Register lhs,
@@ -571,60 +989,110 @@ void LiftoffAssembler::emit_i64_set_cond(Condition cond, Register dst,
   TurboAssembler::Move(dst, tmp);
 }
 
+namespace liftoff {
+
+inline FPUCondition ConditionToConditionCmpFPU(bool& predicate,
+                                               Condition condition) {
+  switch (condition) {
+    case kEqual:
+      predicate = true;
+      return EQ;
+    case kUnequal:
+      predicate = false;
+      return EQ;
+    case kUnsignedLessThan:
+      predicate = true;
+      return OLT;
+    case kUnsignedGreaterEqual:
+      predicate = false;
+      return OLT;
+    case kUnsignedLessEqual:
+      predicate = true;
+      return OLE;
+    case kUnsignedGreaterThan:
+      predicate = false;
+      return OLE;
+    default:
+      predicate = true;
+      break;
+  }
+  UNREACHABLE();
+}
+
+};  // namespace liftoff
+
 void LiftoffAssembler::emit_f32_set_cond(Condition cond, Register dst,
                                          DoubleRegister lhs,
                                          DoubleRegister rhs) {
-  BAILOUT("emit_f32_set_cond");
+  Label not_nan, cont;
+  TurboAssembler::CompareIsNanF32(lhs, rhs);
+  TurboAssembler::BranchFalseF(&not_nan);
+  // If one of the operands is NaN, return 1 for f32.ne, else 0.
+  if (cond == ne) {
+    TurboAssembler::li(dst, 1);
+  } else {
+    TurboAssembler::Move(dst, zero_reg);
+  }
+  TurboAssembler::Branch(&cont);
+
+  bind(&not_nan);
+
+  TurboAssembler::li(dst, 1);
+  bool predicate;
+  FPUCondition fcond = liftoff::ConditionToConditionCmpFPU(predicate, cond);
+  TurboAssembler::CompareF32(fcond, lhs, rhs);
+  if (predicate) {
+    TurboAssembler::LoadZeroIfNotFPUCondition(dst);
+  } else {
+    TurboAssembler::LoadZeroIfFPUCondition(dst);
+  }
+
+  bind(&cont);
 }
 
 void LiftoffAssembler::emit_f64_set_cond(Condition cond, Register dst,
                                          DoubleRegister lhs,
                                          DoubleRegister rhs) {
-  BAILOUT("emit_f64_set_cond");
+  Label not_nan, cont;
+  TurboAssembler::CompareIsNanF64(lhs, rhs);
+  TurboAssembler::BranchFalseF(&not_nan);
+  // If one of the operands is NaN, return 1 for f64.ne, else 0.
+  if (cond == ne) {
+    TurboAssembler::li(dst, 1);
+  } else {
+    TurboAssembler::Move(dst, zero_reg);
+  }
+  TurboAssembler::Branch(&cont);
+
+  bind(&not_nan);
+
+  TurboAssembler::li(dst, 1);
+  bool predicate;
+  FPUCondition fcond = liftoff::ConditionToConditionCmpFPU(predicate, cond);
+  TurboAssembler::CompareF64(fcond, lhs, rhs);
+  if (predicate) {
+    TurboAssembler::LoadZeroIfNotFPUCondition(dst);
+  } else {
+    TurboAssembler::LoadZeroIfFPUCondition(dst);
+  }
+
+  bind(&cont);
 }
 
-void LiftoffAssembler::StackCheck(Label* ool_code) {
-  LiftoffRegister tmp = GetUnusedRegister(kGpReg);
-  TurboAssembler::li(
-      tmp.gp(), Operand(ExternalReference::address_of_stack_limit(isolate())));
-  TurboAssembler::Uld(tmp.gp(), MemOperand(tmp.gp()));
-  TurboAssembler::Branch(ool_code, ule, sp, Operand(tmp.gp()));
+void LiftoffAssembler::StackCheck(Label* ool_code, Register limit_address) {
+  TurboAssembler::Uld(limit_address, MemOperand(limit_address));
+  TurboAssembler::Branch(ool_code, ule, sp, Operand(limit_address));
 }
 
 void LiftoffAssembler::CallTrapCallbackForTesting() {
   PrepareCallCFunction(0, GetUnusedRegister(kGpReg).gp());
-  CallCFunction(
-      ExternalReference::wasm_call_trap_callback_for_testing(isolate()), 0);
+  CallCFunction(ExternalReference::wasm_call_trap_callback_for_testing(), 0);
 }
 
 void LiftoffAssembler::AssertUnreachable(AbortReason reason) {
   if (emit_debug_code()) Abort(reason);
 }
 
-void LiftoffAssembler::PushCallerFrameSlot(const VarState& src,
-                                           uint32_t src_index,
-                                           RegPairHalf half) {
-  switch (src.loc()) {
-    case VarState::kStack:
-      ld(at, liftoff::GetStackSlot(src_index));
-      push(at);
-      break;
-    case VarState::kRegister:
-      PushCallerFrameSlot(src.reg(), src.type());
-      break;
-    case VarState::KIntConst: {
-      li(at, Operand(src.i32_const()));
-      push(at);
-      break;
-    }
-  }
-}
-
-void LiftoffAssembler::PushCallerFrameSlot(LiftoffRegister reg,
-                                           ValueType type) {
-  liftoff::push(this, reg, type);
-}
-
 void LiftoffAssembler::PushRegisters(LiftoffRegList regs) {
   LiftoffRegList gp_regs = regs & kGpCacheRegList;
   unsigned num_gp_regs = gp_regs.GetNumRegsSet();
@@ -680,79 +1148,70 @@ void LiftoffAssembler::DropStackSlotsAndRet(uint32_t num_stack_slots) {
   TurboAssembler::DropAndRet(static_cast<int>(num_stack_slots));
 }
 
-void LiftoffAssembler::PrepareCCall(wasm::FunctionSig* sig,
-                                    const LiftoffRegister* args,
-                                    ValueType out_argument_type) {
+void LiftoffAssembler::CallC(wasm::FunctionSig* sig,
+                             const LiftoffRegister* args,
+                             const LiftoffRegister* rets,
+                             ValueType out_argument_type, int stack_bytes,
+                             ExternalReference ext_ref) {
+  daddiu(sp, sp, -stack_bytes);
+
+  int arg_bytes = 0;
   for (ValueType param_type : sig->parameters()) {
-    liftoff::push(this, *args++, param_type);
+    liftoff::Store(this, sp, arg_bytes, *args++, param_type);
+    arg_bytes += ValueTypes::MemSize(param_type);
+  }
+  DCHECK_LE(arg_bytes, stack_bytes);
+
+  // Pass a pointer to the buffer with the arguments to the C function.
+  // On mips, the first argument is passed in {a0}.
+  constexpr Register kFirstArgReg = a0;
+  mov(kFirstArgReg, sp);
+
+  // Now call the C function.
+  constexpr int kNumCCallArgs = 1;
+  PrepareCallCFunction(kNumCCallArgs, kScratchReg);
+  CallCFunction(ext_ref, kNumCCallArgs);
+
+  // Move return value to the right register.
+  const LiftoffRegister* next_result_reg = rets;
+  if (sig->return_count() > 0) {
+    DCHECK_EQ(1, sig->return_count());
+    constexpr Register kReturnReg = v0;
+    if (kReturnReg != next_result_reg->gp()) {
+      Move(*next_result_reg, LiftoffRegister(kReturnReg), sig->GetReturn(0));
+    }
+    ++next_result_reg;
   }
-  if (out_argument_type != kWasmStmt) {
-    daddiu(sp, sp, -kPointerSize);
-  }
-  // Save the original sp (before the first push), such that we can later
-  // compute pointers to the pushed values. Do this only *after* pushing the
-  // values, because {kCCallLastArgAddrReg} might collide with an arg register.
-  int num_c_call_arguments = static_cast<int>(sig->parameter_count()) +
-                             (out_argument_type != kWasmStmt);
-  int pushed_bytes = kPointerSize * num_c_call_arguments;
-  daddiu(liftoff::kCCallLastArgAddrReg, sp, pushed_bytes);
-  constexpr Register kScratch = at;
-  static_assert(kScratch != liftoff::kCCallLastArgAddrReg, "collision");
-  PrepareCallCFunction(num_c_call_arguments, kScratch);
-}
-
-void LiftoffAssembler::SetCCallRegParamAddr(Register dst, int param_byte_offset,
-                                            ValueType type) {
-  // Check that we don't accidentally override kCCallLastArgAddrReg.
-  DCHECK_NE(liftoff::kCCallLastArgAddrReg, dst);
-  daddiu(dst, liftoff::kCCallLastArgAddrReg, -param_byte_offset);
-}
-
-void LiftoffAssembler::SetCCallStackParamAddr(int stack_param_idx,
-                                              int param_byte_offset,
-                                              ValueType type) {
-  static constexpr Register kScratch = at;
-  SetCCallRegParamAddr(kScratch, param_byte_offset, type);
-  sd(kScratch, MemOperand(sp, stack_param_idx * kPointerSize));
-}
-
-void LiftoffAssembler::LoadCCallOutArgument(LiftoffRegister dst, ValueType type,
-                                            int param_byte_offset) {
-  // Check that we don't accidentally override kCCallLastArgAddrReg.
-  DCHECK_NE(LiftoffRegister(liftoff::kCCallLastArgAddrReg), dst);
-  MemOperand src(liftoff::kCCallLastArgAddrReg, -param_byte_offset);
-  liftoff::Load(this, dst, src, type);
-}
 
-void LiftoffAssembler::CallC(ExternalReference ext_ref, uint32_t num_params) {
-  CallCFunction(ext_ref, static_cast<int>(num_params));
-}
+  // Load potential output value from the buffer on the stack.
+  if (out_argument_type != kWasmStmt) {
+    liftoff::Load(this, *next_result_reg, MemOperand(sp, 0), out_argument_type);
+  }
 
-void LiftoffAssembler::FinishCCall() {
-  TurboAssembler::Move(sp, liftoff::kCCallLastArgAddrReg);
+  daddiu(sp, sp, stack_bytes);
 }
 
 void LiftoffAssembler::CallNativeWasmCode(Address addr) {
   Call(addr, RelocInfo::WASM_CALL);
 }
 
-void LiftoffAssembler::CallRuntime(Zone* zone, Runtime::FunctionId fid) {
-  // Set instance to zero.
-  TurboAssembler::Move(cp, zero_reg);
-  CallRuntimeDelayed(zone, fid);
-}
-
 void LiftoffAssembler::CallIndirect(wasm::FunctionSig* sig,
                                     compiler::CallDescriptor* call_descriptor,
                                     Register target) {
   if (target == no_reg) {
-    pop(at);
-    Call(at);
+    pop(kScratchReg);
+    Call(kScratchReg);
   } else {
     Call(target);
   }
 }
 
+void LiftoffAssembler::CallRuntimeStub(WasmCode::RuntimeStubId sid) {
+  // A direct call to a wasm runtime stub defined in this module.
+  // Just encode the stub index. This will be patched at relocation.
+  Call(static_cast<Address>(sid), RelocInfo::WASM_STUB_CALL);
+}
+
 void LiftoffAssembler::AllocateStackSlot(Register addr, uint32_t size) {
   daddiu(sp, sp, -size);
   TurboAssembler::Move(addr, sp);
@@ -762,6 +1221,26 @@ void LiftoffAssembler::DeallocateStackSlot(uint32_t size) {
   daddiu(sp, sp, size);
 }
 
+void LiftoffStackSlots::Construct() {
+  for (auto& slot : slots_) {
+    const LiftoffAssembler::VarState& src = slot.src_;
+    switch (src.loc()) {
+      case LiftoffAssembler::VarState::kStack:
+        asm_->ld(kScratchReg, liftoff::GetStackSlot(slot.src_index_));
+        asm_->push(kScratchReg);
+        break;
+      case LiftoffAssembler::VarState::kRegister:
+        liftoff::push(asm_, src.reg(), src.type());
+        break;
+      case LiftoffAssembler::VarState::KIntConst: {
+        asm_->li(kScratchReg, Operand(src.i32_const()));
+        asm_->push(kScratchReg);
+        break;
+      }
+    }
+  }
+}
+
 }  // namespace wasm
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/src/wasm/baseline/ppc/liftoff-assembler-ppc.h b/deps/v8/src/wasm/baseline/ppc/liftoff-assembler-ppc.h
index 39aa3fcb94df01..a4bd20622e9547 100644
--- a/deps/v8/src/wasm/baseline/ppc/liftoff-assembler-ppc.h
+++ b/deps/v8/src/wasm/baseline/ppc/liftoff-assembler-ppc.h
@@ -13,16 +13,20 @@ namespace v8 {
 namespace internal {
 namespace wasm {
 
-uint32_t LiftoffAssembler::PrepareStackFrame() {
+int LiftoffAssembler::PrepareStackFrame() {
   BAILOUT("PrepareStackFrame");
   return 0;
 }
 
-void LiftoffAssembler::PatchPrepareStackFrame(uint32_t offset,
+void LiftoffAssembler::PatchPrepareStackFrame(int offset,
                                               uint32_t stack_slots) {
   BAILOUT("PatchPrepareStackFrame");
 }
 
+void LiftoffAssembler::FinishCode() { EmitConstantPool(); }
+
+void LiftoffAssembler::AbortCompilation() { FinishCode(); }
+
 void LiftoffAssembler::LoadConstant(LiftoffRegister reg, WasmValue value,
                                     RelocInfo::Mode rmode) {
   BAILOUT("LoadConstant");
@@ -44,17 +48,28 @@ void LiftoffAssembler::FillInstanceInto(Register dst) {
 void LiftoffAssembler::Load(LiftoffRegister dst, Register src_addr,
                             Register offset_reg, uint32_t offset_imm,
                             LoadType type, LiftoffRegList pinned,
-                            uint32_t* protected_load_pc) {
+                            uint32_t* protected_load_pc, bool is_load_mem) {
   BAILOUT("Load");
 }
 
 void LiftoffAssembler::Store(Register dst_addr, Register offset_reg,
                              uint32_t offset_imm, LiftoffRegister src,
                              StoreType type, LiftoffRegList pinned,
-                             uint32_t* protected_store_pc) {
+                             uint32_t* protected_store_pc, bool is_store_mem) {
   BAILOUT("Store");
 }
 
+void LiftoffAssembler::ChangeEndiannessLoad(LiftoffRegister dst, LoadType type,
+                                            LiftoffRegList pinned) {
+  BAILOUT("ChangeEndiannessLoad");
+}
+
+void LiftoffAssembler::ChangeEndiannessStore(LiftoffRegister src,
+                                             StoreType type,
+                                             LiftoffRegList pinned) {
+  BAILOUT("ChangeEndiannessStore");
+}
+
 void LiftoffAssembler::LoadCallerFrameSlot(LiftoffRegister dst,
                                            uint32_t caller_slot_idx,
                                            ValueType type) {
@@ -66,11 +81,6 @@ void LiftoffAssembler::MoveStackValue(uint32_t dst_index, uint32_t src_index,
   BAILOUT("MoveStackValue");
 }
 
-void LiftoffAssembler::MoveToReturnRegister(LiftoffRegister reg,
-                                            ValueType type) {
-  BAILOUT("MoveToReturnRegister");
-}
-
 void LiftoffAssembler::Move(Register dst, Register src, ValueType type) {
   BAILOUT("Move Register");
 }
@@ -122,6 +132,11 @@ void LiftoffAssembler::FillI64Half(Register, uint32_t half_index) {
   void LiftoffAssembler::emit_##name(DoubleRegister dst, DoubleRegister src) { \
     BAILOUT("fp unop: " #name);                                                \
   }
+#define UNIMPLEMENTED_FP_UNOP_RETURN_TRUE(name)                                \
+  bool LiftoffAssembler::emit_##name(DoubleRegister dst, DoubleRegister src) { \
+    BAILOUT("fp unop: " #name);                                                \
+    return true;                                                               \
+  }
 #define UNIMPLEMENTED_I32_SHIFTOP(name)                                        \
   void LiftoffAssembler::emit_##name(Register dst, Register src,               \
                                      Register amount, LiftoffRegList pinned) { \
@@ -144,6 +159,7 @@ UNIMPLEMENTED_I32_SHIFTOP(i32_sar)
 UNIMPLEMENTED_I32_SHIFTOP(i32_shr)
 UNIMPLEMENTED_I64_BINOP(i64_add)
 UNIMPLEMENTED_I64_BINOP(i64_sub)
+UNIMPLEMENTED_I64_BINOP(i64_mul)
 #ifdef V8_TARGET_ARCH_PPC64
 UNIMPLEMENTED_I64_BINOP(i64_and)
 UNIMPLEMENTED_I64_BINOP(i64_or)
@@ -159,6 +175,8 @@ UNIMPLEMENTED_FP_BINOP(f32_add)
 UNIMPLEMENTED_FP_BINOP(f32_sub)
 UNIMPLEMENTED_FP_BINOP(f32_mul)
 UNIMPLEMENTED_FP_BINOP(f32_div)
+UNIMPLEMENTED_FP_BINOP(f32_min)
+UNIMPLEMENTED_FP_BINOP(f32_max)
 UNIMPLEMENTED_FP_UNOP(f32_abs)
 UNIMPLEMENTED_FP_UNOP(f32_neg)
 UNIMPLEMENTED_FP_UNOP(f32_ceil)
@@ -170,12 +188,14 @@ UNIMPLEMENTED_FP_BINOP(f64_add)
 UNIMPLEMENTED_FP_BINOP(f64_sub)
 UNIMPLEMENTED_FP_BINOP(f64_mul)
 UNIMPLEMENTED_FP_BINOP(f64_div)
+UNIMPLEMENTED_FP_BINOP(f64_min)
+UNIMPLEMENTED_FP_BINOP(f64_max)
 UNIMPLEMENTED_FP_UNOP(f64_abs)
 UNIMPLEMENTED_FP_UNOP(f64_neg)
-UNIMPLEMENTED_FP_UNOP(f64_ceil)
-UNIMPLEMENTED_FP_UNOP(f64_floor)
-UNIMPLEMENTED_FP_UNOP(f64_trunc)
-UNIMPLEMENTED_FP_UNOP(f64_nearest_int)
+UNIMPLEMENTED_FP_UNOP_RETURN_TRUE(f64_ceil)
+UNIMPLEMENTED_FP_UNOP_RETURN_TRUE(f64_floor)
+UNIMPLEMENTED_FP_UNOP_RETURN_TRUE(f64_trunc)
+UNIMPLEMENTED_FP_UNOP_RETURN_TRUE(f64_nearest_int)
 UNIMPLEMENTED_FP_UNOP(f64_sqrt)
 
 #undef UNIMPLEMENTED_GP_BINOP
@@ -183,12 +203,67 @@ UNIMPLEMENTED_FP_UNOP(f64_sqrt)
 #undef UNIMPLEMENTED_GP_UNOP
 #undef UNIMPLEMENTED_FP_BINOP
 #undef UNIMPLEMENTED_FP_UNOP
+#undef UNIMPLEMENTED_FP_UNOP_RETURN_TRUE
 #undef UNIMPLEMENTED_I32_SHIFTOP
 #undef UNIMPLEMENTED_I64_SHIFTOP
 
+void LiftoffAssembler::emit_i32_divs(Register dst, Register lhs, Register rhs,
+                                     Label* trap_div_by_zero,
+                                     Label* trap_div_unrepresentable) {
+  BAILOUT("i32_divs");
+}
+
+void LiftoffAssembler::emit_i32_divu(Register dst, Register lhs, Register rhs,
+                                     Label* trap_div_by_zero) {
+  BAILOUT("i32_divu");
+}
+
+void LiftoffAssembler::emit_i32_rems(Register dst, Register lhs, Register rhs,
+                                     Label* trap_div_by_zero) {
+  BAILOUT("i32_rems");
+}
+
+void LiftoffAssembler::emit_i32_remu(Register dst, Register lhs, Register rhs,
+                                     Label* trap_div_by_zero) {
+  BAILOUT("i32_remu");
+}
+
+bool LiftoffAssembler::emit_i64_divs(LiftoffRegister dst, LiftoffRegister lhs,
+                                     LiftoffRegister rhs,
+                                     Label* trap_div_by_zero,
+                                     Label* trap_div_unrepresentable) {
+  BAILOUT("i64_divs");
+  return true;
+}
+
+bool LiftoffAssembler::emit_i64_divu(LiftoffRegister dst, LiftoffRegister lhs,
+                                     LiftoffRegister rhs,
+                                     Label* trap_div_by_zero) {
+  BAILOUT("i64_divu");
+  return true;
+}
+
+bool LiftoffAssembler::emit_i64_rems(LiftoffRegister dst, LiftoffRegister lhs,
+                                     LiftoffRegister rhs,
+                                     Label* trap_div_by_zero) {
+  BAILOUT("i64_rems");
+  return true;
+}
+
+bool LiftoffAssembler::emit_i64_remu(LiftoffRegister dst, LiftoffRegister lhs,
+                                     LiftoffRegister rhs,
+                                     Label* trap_div_by_zero) {
+  BAILOUT("i64_remu");
+  return true;
+}
+
+void LiftoffAssembler::emit_i32_to_intptr(Register dst, Register src) {
+  UNREACHABLE();
+}
+
 bool LiftoffAssembler::emit_type_conversion(WasmOpcode opcode,
                                             LiftoffRegister dst,
-                                            LiftoffRegister src) {
+                                            LiftoffRegister src, Label* trap) {
   BAILOUT("emit_type_conversion");
   return true;
 }
@@ -234,7 +309,9 @@ void LiftoffAssembler::emit_f64_set_cond(Condition cond, Register dst,
   BAILOUT("emit_f64_set_cond");
 }
 
-void LiftoffAssembler::StackCheck(Label* ool_code) { BAILOUT("StackCheck"); }
+void LiftoffAssembler::StackCheck(Label* ool_code, Register limit_address) {
+  BAILOUT("StackCheck");
+}
 
 void LiftoffAssembler::CallTrapCallbackForTesting() {
   BAILOUT("CallTrapCallbackForTesting");
@@ -244,17 +321,6 @@ void LiftoffAssembler::AssertUnreachable(AbortReason reason) {
   BAILOUT("AssertUnreachable");
 }
 
-void LiftoffAssembler::PushCallerFrameSlot(const VarState& src,
-                                           uint32_t src_index,
-                                           RegPairHalf half) {
-  BAILOUT("PushCallerFrameSlot");
-}
-
-void LiftoffAssembler::PushCallerFrameSlot(LiftoffRegister reg,
-                                           ValueType type) {
-  BAILOUT("PushCallerFrameSlot reg");
-}
-
 void LiftoffAssembler::PushRegisters(LiftoffRegList regs) {
   BAILOUT("PushRegisters");
 }
@@ -267,48 +333,28 @@ void LiftoffAssembler::DropStackSlotsAndRet(uint32_t num_stack_slots) {
   BAILOUT("DropStackSlotsAndRet");
 }
 
-void LiftoffAssembler::PrepareCCall(wasm::FunctionSig* sig,
-                                    const LiftoffRegister* args,
-                                    ValueType out_argument_type) {
-  BAILOUT("PrepareCCall");
-}
-
-void LiftoffAssembler::SetCCallRegParamAddr(Register dst, int param_byte_offset,
-                                            ValueType type) {
-  BAILOUT("SetCCallRegParamAddr");
-}
-
-void LiftoffAssembler::SetCCallStackParamAddr(int stack_param_idx,
-                                              int param_byte_offset,
-                                              ValueType type) {
-  BAILOUT("SetCCallStackParamAddr");
-}
-
-void LiftoffAssembler::LoadCCallOutArgument(LiftoffRegister dst, ValueType type,
-                                            int param_byte_offset) {
-  BAILOUT("LoadCCallOutArgument");
-}
-
-void LiftoffAssembler::CallC(ExternalReference ext_ref, uint32_t num_params) {
+void LiftoffAssembler::CallC(wasm::FunctionSig* sig,
+                             const LiftoffRegister* args,
+                             const LiftoffRegister* rets,
+                             ValueType out_argument_type, int stack_bytes,
+                             ExternalReference ext_ref) {
   BAILOUT("CallC");
 }
 
-void LiftoffAssembler::FinishCCall() { BAILOUT("FinishCCall"); }
-
 void LiftoffAssembler::CallNativeWasmCode(Address addr) {
   BAILOUT("CallNativeWasmCode");
 }
 
-void LiftoffAssembler::CallRuntime(Zone* zone, Runtime::FunctionId fid) {
-  BAILOUT("CallRuntime");
-}
-
 void LiftoffAssembler::CallIndirect(wasm::FunctionSig* sig,
                                     compiler::CallDescriptor* call_descriptor,
                                     Register target) {
   BAILOUT("CallIndirect");
 }
 
+void LiftoffAssembler::CallRuntimeStub(WasmCode::RuntimeStubId sid) {
+  BAILOUT("CallRuntimeStub");
+}
+
 void LiftoffAssembler::AllocateStackSlot(Register addr, uint32_t size) {
   BAILOUT("AllocateStackSlot");
 }
@@ -317,6 +363,10 @@ void LiftoffAssembler::DeallocateStackSlot(uint32_t size) {
   BAILOUT("DeallocateStackSlot");
 }
 
+void LiftoffStackSlots::Construct() {
+  asm_->BAILOUT("LiftoffStackSlots::Construct");
+}
+
 }  // namespace wasm
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/src/wasm/baseline/s390/liftoff-assembler-s390.h b/deps/v8/src/wasm/baseline/s390/liftoff-assembler-s390.h
index a66e6684ea3dc0..ee142c7be47815 100644
--- a/deps/v8/src/wasm/baseline/s390/liftoff-assembler-s390.h
+++ b/deps/v8/src/wasm/baseline/s390/liftoff-assembler-s390.h
@@ -13,16 +13,20 @@ namespace v8 {
 namespace internal {
 namespace wasm {
 
-uint32_t LiftoffAssembler::PrepareStackFrame() {
+int LiftoffAssembler::PrepareStackFrame() {
   BAILOUT("PrepareStackFrame");
   return 0;
 }
 
-void LiftoffAssembler::PatchPrepareStackFrame(uint32_t offset,
+void LiftoffAssembler::PatchPrepareStackFrame(int offset,
                                               uint32_t stack_slots) {
   BAILOUT("PatchPrepareStackFrame");
 }
 
+void LiftoffAssembler::FinishCode() {}
+
+void LiftoffAssembler::AbortCompilation() {}
+
 void LiftoffAssembler::LoadConstant(LiftoffRegister reg, WasmValue value,
                                     RelocInfo::Mode rmode) {
   BAILOUT("LoadConstant");
@@ -44,17 +48,28 @@ void LiftoffAssembler::FillInstanceInto(Register dst) {
 void LiftoffAssembler::Load(LiftoffRegister dst, Register src_addr,
                             Register offset_reg, uint32_t offset_imm,
                             LoadType type, LiftoffRegList pinned,
-                            uint32_t* protected_load_pc) {
+                            uint32_t* protected_load_pc, bool is_load_mem) {
   BAILOUT("Load");
 }
 
 void LiftoffAssembler::Store(Register dst_addr, Register offset_reg,
                              uint32_t offset_imm, LiftoffRegister src,
                              StoreType type, LiftoffRegList pinned,
-                             uint32_t* protected_store_pc) {
+                             uint32_t* protected_store_pc, bool is_store_mem) {
   BAILOUT("Store");
 }
 
+void LiftoffAssembler::ChangeEndiannessLoad(LiftoffRegister dst, LoadType type,
+                                            LiftoffRegList pinned) {
+  BAILOUT("ChangeEndiannessLoad");
+}
+
+void LiftoffAssembler::ChangeEndiannessStore(LiftoffRegister src,
+                                             StoreType type,
+                                             LiftoffRegList pinned) {
+  BAILOUT("ChangeEndiannessStore");
+}
+
 void LiftoffAssembler::LoadCallerFrameSlot(LiftoffRegister dst,
                                            uint32_t caller_slot_idx,
                                            ValueType type) {
@@ -66,11 +81,6 @@ void LiftoffAssembler::MoveStackValue(uint32_t dst_index, uint32_t src_index,
   BAILOUT("MoveStackValue");
 }
 
-void LiftoffAssembler::MoveToReturnRegister(LiftoffRegister reg,
-                                            ValueType type) {
-  BAILOUT("MoveToReturnRegister");
-}
-
 void LiftoffAssembler::Move(Register dst, Register src, ValueType type) {
   BAILOUT("Move Register");
 }
@@ -122,6 +132,11 @@ void LiftoffAssembler::FillI64Half(Register, uint32_t half_index) {
   void LiftoffAssembler::emit_##name(DoubleRegister dst, DoubleRegister src) { \
     BAILOUT("fp unop: " #name);                                                \
   }
+#define UNIMPLEMENTED_FP_UNOP_RETURN_TRUE(name)                                \
+  bool LiftoffAssembler::emit_##name(DoubleRegister dst, DoubleRegister src) { \
+    BAILOUT("fp unop: " #name);                                                \
+    return true;                                                               \
+  }
 #define UNIMPLEMENTED_I32_SHIFTOP(name)                                        \
   void LiftoffAssembler::emit_##name(Register dst, Register src,               \
                                      Register amount, LiftoffRegList pinned) { \
@@ -144,6 +159,7 @@ UNIMPLEMENTED_I32_SHIFTOP(i32_sar)
 UNIMPLEMENTED_I32_SHIFTOP(i32_shr)
 UNIMPLEMENTED_I64_BINOP(i64_add)
 UNIMPLEMENTED_I64_BINOP(i64_sub)
+UNIMPLEMENTED_I64_BINOP(i64_mul)
 #ifdef V8_TARGET_ARCH_S390X
 UNIMPLEMENTED_I64_BINOP(i64_and)
 UNIMPLEMENTED_I64_BINOP(i64_or)
@@ -159,6 +175,8 @@ UNIMPLEMENTED_FP_BINOP(f32_add)
 UNIMPLEMENTED_FP_BINOP(f32_sub)
 UNIMPLEMENTED_FP_BINOP(f32_mul)
 UNIMPLEMENTED_FP_BINOP(f32_div)
+UNIMPLEMENTED_FP_BINOP(f32_min)
+UNIMPLEMENTED_FP_BINOP(f32_max)
 UNIMPLEMENTED_FP_UNOP(f32_abs)
 UNIMPLEMENTED_FP_UNOP(f32_neg)
 UNIMPLEMENTED_FP_UNOP(f32_ceil)
@@ -170,12 +188,14 @@ UNIMPLEMENTED_FP_BINOP(f64_add)
 UNIMPLEMENTED_FP_BINOP(f64_sub)
 UNIMPLEMENTED_FP_BINOP(f64_mul)
 UNIMPLEMENTED_FP_BINOP(f64_div)
+UNIMPLEMENTED_FP_BINOP(f64_min)
+UNIMPLEMENTED_FP_BINOP(f64_max)
 UNIMPLEMENTED_FP_UNOP(f64_abs)
 UNIMPLEMENTED_FP_UNOP(f64_neg)
-UNIMPLEMENTED_FP_UNOP(f64_ceil)
-UNIMPLEMENTED_FP_UNOP(f64_floor)
-UNIMPLEMENTED_FP_UNOP(f64_trunc)
-UNIMPLEMENTED_FP_UNOP(f64_nearest_int)
+UNIMPLEMENTED_FP_UNOP_RETURN_TRUE(f64_ceil)
+UNIMPLEMENTED_FP_UNOP_RETURN_TRUE(f64_floor)
+UNIMPLEMENTED_FP_UNOP_RETURN_TRUE(f64_trunc)
+UNIMPLEMENTED_FP_UNOP_RETURN_TRUE(f64_nearest_int)
 UNIMPLEMENTED_FP_UNOP(f64_sqrt)
 
 #undef UNIMPLEMENTED_GP_BINOP
@@ -183,12 +203,67 @@ UNIMPLEMENTED_FP_UNOP(f64_sqrt)
 #undef UNIMPLEMENTED_GP_UNOP
 #undef UNIMPLEMENTED_FP_BINOP
 #undef UNIMPLEMENTED_FP_UNOP
+#undef UNIMPLEMENTED_FP_UNOP_RETURN_TRUE
 #undef UNIMPLEMENTED_I32_SHIFTOP
 #undef UNIMPLEMENTED_I64_SHIFTOP
 
+void LiftoffAssembler::emit_i32_divs(Register dst, Register lhs, Register rhs,
+                                     Label* trap_div_by_zero,
+                                     Label* trap_div_unrepresentable) {
+  BAILOUT("i32_divs");
+}
+
+void LiftoffAssembler::emit_i32_divu(Register dst, Register lhs, Register rhs,
+                                     Label* trap_div_by_zero) {
+  BAILOUT("i32_divu");
+}
+
+void LiftoffAssembler::emit_i32_rems(Register dst, Register lhs, Register rhs,
+                                     Label* trap_div_by_zero) {
+  BAILOUT("i32_rems");
+}
+
+void LiftoffAssembler::emit_i32_remu(Register dst, Register lhs, Register rhs,
+                                     Label* trap_div_by_zero) {
+  BAILOUT("i32_remu");
+}
+
+bool LiftoffAssembler::emit_i64_divs(LiftoffRegister dst, LiftoffRegister lhs,
+                                     LiftoffRegister rhs,
+                                     Label* trap_div_by_zero,
+                                     Label* trap_div_unrepresentable) {
+  BAILOUT("i64_divs");
+  return true;
+}
+
+bool LiftoffAssembler::emit_i64_divu(LiftoffRegister dst, LiftoffRegister lhs,
+                                     LiftoffRegister rhs,
+                                     Label* trap_div_by_zero) {
+  BAILOUT("i64_divu");
+  return true;
+}
+
+bool LiftoffAssembler::emit_i64_rems(LiftoffRegister dst, LiftoffRegister lhs,
+                                     LiftoffRegister rhs,
+                                     Label* trap_div_by_zero) {
+  BAILOUT("i64_rems");
+  return true;
+}
+
+bool LiftoffAssembler::emit_i64_remu(LiftoffRegister dst, LiftoffRegister lhs,
+                                     LiftoffRegister rhs,
+                                     Label* trap_div_by_zero) {
+  BAILOUT("i64_remu");
+  return true;
+}
+
+void LiftoffAssembler::emit_i32_to_intptr(Register dst, Register src) {
+  UNREACHABLE();
+}
+
 bool LiftoffAssembler::emit_type_conversion(WasmOpcode opcode,
                                             LiftoffRegister dst,
-                                            LiftoffRegister src) {
+                                            LiftoffRegister src, Label* trap) {
   BAILOUT("emit_type_conversion");
   return true;
 }
@@ -234,7 +309,9 @@ void LiftoffAssembler::emit_f64_set_cond(Condition cond, Register dst,
   BAILOUT("emit_f64_set_cond");
 }
 
-void LiftoffAssembler::StackCheck(Label* ool_code) { BAILOUT("StackCheck"); }
+void LiftoffAssembler::StackCheck(Label* ool_code, Register limit_address) {
+  BAILOUT("StackCheck");
+}
 
 void LiftoffAssembler::CallTrapCallbackForTesting() {
   BAILOUT("CallTrapCallbackForTesting");
@@ -244,17 +321,6 @@ void LiftoffAssembler::AssertUnreachable(AbortReason reason) {
   BAILOUT("AssertUnreachable");
 }
 
-void LiftoffAssembler::PushCallerFrameSlot(const VarState& src,
-                                           uint32_t src_index,
-                                           RegPairHalf half) {
-  BAILOUT("PushCallerFrameSlot");
-}
-
-void LiftoffAssembler::PushCallerFrameSlot(LiftoffRegister reg,
-                                           ValueType type) {
-  BAILOUT("PushCallerFrameSlot reg");
-}
-
 void LiftoffAssembler::PushRegisters(LiftoffRegList regs) {
   BAILOUT("PushRegisters");
 }
@@ -267,48 +333,28 @@ void LiftoffAssembler::DropStackSlotsAndRet(uint32_t num_stack_slots) {
   BAILOUT("DropStackSlotsAndRet");
 }
 
-void LiftoffAssembler::PrepareCCall(wasm::FunctionSig* sig,
-                                    const LiftoffRegister* args,
-                                    ValueType out_argument_type) {
-  BAILOUT("PrepareCCall");
-}
-
-void LiftoffAssembler::SetCCallRegParamAddr(Register dst, int param_byte_offset,
-                                            ValueType type) {
-  BAILOUT("SetCCallRegParamAddr");
-}
-
-void LiftoffAssembler::SetCCallStackParamAddr(int stack_param_idx,
-                                              int param_byte_offset,
-                                              ValueType type) {
-  BAILOUT("SetCCallStackParamAddr");
-}
-
-void LiftoffAssembler::LoadCCallOutArgument(LiftoffRegister dst, ValueType type,
-                                            int param_byte_offset) {
-  BAILOUT("LoadCCallOutArgument");
-}
-
-void LiftoffAssembler::CallC(ExternalReference ext_ref, uint32_t num_params) {
+void LiftoffAssembler::CallC(wasm::FunctionSig* sig,
+                             const LiftoffRegister* args,
+                             const LiftoffRegister* rets,
+                             ValueType out_argument_type, int stack_bytes,
+                             ExternalReference ext_ref) {
   BAILOUT("CallC");
 }
 
-void LiftoffAssembler::FinishCCall() { BAILOUT("FinishCCall"); }
-
 void LiftoffAssembler::CallNativeWasmCode(Address addr) {
   BAILOUT("CallNativeWasmCode");
 }
 
-void LiftoffAssembler::CallRuntime(Zone* zone, Runtime::FunctionId fid) {
-  BAILOUT("CallRuntime");
-}
-
 void LiftoffAssembler::CallIndirect(wasm::FunctionSig* sig,
                                     compiler::CallDescriptor* call_descriptor,
                                     Register target) {
   BAILOUT("CallIndirect");
 }
 
+void LiftoffAssembler::CallRuntimeStub(WasmCode::RuntimeStubId sid) {
+  BAILOUT("CallRuntimeStub");
+}
+
 void LiftoffAssembler::AllocateStackSlot(Register addr, uint32_t size) {
   BAILOUT("AllocateStackSlot");
 }
@@ -317,6 +363,10 @@ void LiftoffAssembler::DeallocateStackSlot(uint32_t size) {
   BAILOUT("DeallocateStackSlot");
 }
 
+void LiftoffStackSlots::Construct() {
+  asm_->BAILOUT("LiftoffStackSlots::Construct");
+}
+
 }  // namespace wasm
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/src/wasm/baseline/x64/liftoff-assembler-x64.h b/deps/v8/src/wasm/baseline/x64/liftoff-assembler-x64.h
index f071a003ea816b..9bf94de8ba62b2 100644
--- a/deps/v8/src/wasm/baseline/x64/liftoff-assembler-x64.h
+++ b/deps/v8/src/wasm/baseline/x64/liftoff-assembler-x64.h
@@ -8,14 +8,17 @@
 #include "src/wasm/baseline/liftoff-assembler.h"
 
 #include "src/assembler.h"
-#include "src/wasm/wasm-opcodes.h"
+#include "src/wasm/value-type.h"
 
 namespace v8 {
 namespace internal {
 namespace wasm {
 
-#define REQUIRE_CPU_FEATURE(name)                                   \
-  if (!CpuFeatures::IsSupported(name)) return bailout("no " #name); \
+#define REQUIRE_CPU_FEATURE(name, ...)   \
+  if (!CpuFeatures::IsSupported(name)) { \
+    bailout("no " #name);                \
+    return __VA_ARGS__;                  \
+  }                                      \
   CpuFeatureScope feature(this, name);
 
 namespace liftoff {
@@ -34,11 +37,6 @@ inline Operand GetStackSlot(uint32_t index) {
 // TODO(clemensh): Make this a constexpr variable once Operand is constexpr.
 inline Operand GetInstanceOperand() { return Operand(rbp, -16); }
 
-// Use this register to store the address of the last argument pushed on the
-// stack for a call to C. This register must be callee saved according to the c
-// calling convention.
-static constexpr Register kCCallLastArgAddrReg = rbx;
-
 inline Operand GetMemOp(LiftoffAssembler* assm, Register addr, Register offset,
                         uint32_t offset_imm, LiftoffRegList pinned) {
   // Wasm memory is limited to a size <2GB, so all offsets can be encoded as
@@ -69,6 +67,26 @@ inline void Load(LiftoffAssembler* assm, LiftoffRegister dst, Operand src,
   }
 }
 
+inline void Store(LiftoffAssembler* assm, Operand dst, LiftoffRegister src,
+                  ValueType type) {
+  switch (type) {
+    case kWasmI32:
+      assm->movl(dst, src.gp());
+      break;
+    case kWasmI64:
+      assm->movq(dst, src.gp());
+      break;
+    case kWasmF32:
+      assm->Movss(dst, src.fp());
+      break;
+    case kWasmF64:
+      assm->Movsd(dst, src.fp());
+      break;
+    default:
+      UNREACHABLE();
+  }
+}
+
 inline void push(LiftoffAssembler* assm, LiftoffRegister reg, ValueType type) {
   switch (type) {
     case kWasmI32:
@@ -88,25 +106,37 @@ inline void push(LiftoffAssembler* assm, LiftoffRegister reg, ValueType type) {
   }
 }
 
+template <typename... Regs>
+inline void SpillRegisters(LiftoffAssembler* assm, Regs... regs) {
+  for (LiftoffRegister r : {LiftoffRegister(regs)...}) {
+    if (assm->cache_state()->is_used(r)) assm->SpillRegister(r);
+  }
+}
+
 }  // namespace liftoff
 
-uint32_t LiftoffAssembler::PrepareStackFrame() {
-  uint32_t offset = static_cast<uint32_t>(pc_offset());
+int LiftoffAssembler::PrepareStackFrame() {
+  int offset = pc_offset();
   sub_sp_32(0);
   return offset;
 }
 
-void LiftoffAssembler::PatchPrepareStackFrame(uint32_t offset,
+void LiftoffAssembler::PatchPrepareStackFrame(int offset,
                                               uint32_t stack_slots) {
   uint32_t bytes = liftoff::kConstantStackSpace + kStackSlotSize * stack_slots;
   DCHECK_LE(bytes, kMaxInt);
   // We can't run out of space, just pass anything big enough to not cause the
   // assembler to try to grow the buffer.
   constexpr int kAvailableSpace = 64;
-  Assembler patching_assembler(isolate(), buffer_ + offset, kAvailableSpace);
+  Assembler patching_assembler(AssemblerOptions{}, buffer_ + offset,
+                               kAvailableSpace);
   patching_assembler.sub_sp_32(bytes);
 }
 
+void LiftoffAssembler::FinishCode() {}
+
+void LiftoffAssembler::AbortCompilation() {}
+
 void LiftoffAssembler::LoadConstant(LiftoffRegister reg, WasmValue value,
                                     RelocInfo::Mode rmode) {
   switch (value.type()) {
@@ -158,7 +188,7 @@ void LiftoffAssembler::FillInstanceInto(Register dst) {
 void LiftoffAssembler::Load(LiftoffRegister dst, Register src_addr,
                             Register offset_reg, uint32_t offset_imm,
                             LoadType type, LiftoffRegList pinned,
-                            uint32_t* protected_load_pc) {
+                            uint32_t* protected_load_pc, bool is_load_mem) {
   if (emit_debug_code() && offset_reg != no_reg) {
     AssertZeroExtended(offset_reg);
   }
@@ -210,7 +240,7 @@ void LiftoffAssembler::Load(LiftoffRegister dst, Register src_addr,
 void LiftoffAssembler::Store(Register dst_addr, Register offset_reg,
                              uint32_t offset_imm, LiftoffRegister src,
                              StoreType type, LiftoffRegList pinned,
-                             uint32_t* protected_store_pc) {
+                             uint32_t* protected_store_pc, bool is_store_mem) {
   if (emit_debug_code() && offset_reg != no_reg) {
     AssertZeroExtended(offset_reg);
   }
@@ -244,6 +274,17 @@ void LiftoffAssembler::Store(Register dst_addr, Register offset_reg,
   }
 }
 
+void LiftoffAssembler::ChangeEndiannessLoad(LiftoffRegister dst, LoadType type,
+                                            LiftoffRegList pinned) {
+  // Nop.
+}
+
+void LiftoffAssembler::ChangeEndiannessStore(LiftoffRegister src,
+                                             StoreType type,
+                                             LiftoffRegList pinned) {
+  // Nop.
+}
+
 void LiftoffAssembler::LoadCallerFrameSlot(LiftoffRegister dst,
                                            uint32_t caller_slot_idx,
                                            ValueType type) {
@@ -264,15 +305,6 @@ void LiftoffAssembler::MoveStackValue(uint32_t dst_index, uint32_t src_index,
   }
 }
 
-void LiftoffAssembler::MoveToReturnRegister(LiftoffRegister reg,
-                                            ValueType type) {
-  // TODO(wasm): Extract the destination register from the CallDescriptor.
-  // TODO(wasm): Add multi-return support.
-  LiftoffRegister dst =
-      reg.is_gp() ? LiftoffRegister(rax) : LiftoffRegister(xmm1);
-  if (reg != dst) Move(dst, reg, type);
-}
-
 void LiftoffAssembler::Move(Register dst, Register src, ValueType type) {
   DCHECK_NE(dst, src);
   if (type == kWasmI32) {
@@ -405,6 +437,119 @@ void LiftoffAssembler::emit_i32_mul(Register dst, Register lhs, Register rhs) {
                                                                      lhs, rhs);
 }
 
+namespace liftoff {
+enum class DivOrRem : uint8_t { kDiv, kRem };
+template <typename type, DivOrRem div_or_rem>
+void EmitIntDivOrRem(LiftoffAssembler* assm, Register dst, Register lhs,
+                     Register rhs, Label* trap_div_by_zero,
+                     Label* trap_div_unrepresentable) {
+  constexpr bool needs_unrepresentable_check =
+      std::is_signed<type>::value && div_or_rem == DivOrRem::kDiv;
+  constexpr bool special_case_minus_1 =
+      std::is_signed<type>::value && div_or_rem == DivOrRem::kRem;
+  DCHECK_EQ(needs_unrepresentable_check, trap_div_unrepresentable != nullptr);
+
+#define iop(name, ...)            \
+  do {                            \
+    if (sizeof(type) == 4) {      \
+      assm->name##l(__VA_ARGS__); \
+    } else {                      \
+      assm->name##q(__VA_ARGS__); \
+    }                             \
+  } while (false)
+
+  // For division, the lhs is always taken from {edx:eax}. Thus, make sure that
+  // these registers are unused. If {rhs} is stored in one of them, move it to
+  // another temporary register.
+  // Do all this before any branch, such that the code is executed
+  // unconditionally, as the cache state will also be modified unconditionally.
+  liftoff::SpillRegisters(assm, rdx, rax);
+  if (rhs == rax || rhs == rdx) {
+    LiftoffRegList unavailable = LiftoffRegList::ForRegs(rax, rdx, lhs);
+    Register tmp = assm->GetUnusedRegister(kGpReg, unavailable).gp();
+    iop(mov, tmp, rhs);
+    rhs = tmp;
+  }
+
+  // Check for division by zero.
+  iop(test, rhs, rhs);
+  assm->j(zero, trap_div_by_zero);
+
+  Label done;
+  if (needs_unrepresentable_check) {
+    // Check for {kMinInt / -1}. This is unrepresentable.
+    Label do_div;
+    iop(cmp, rhs, Immediate(-1));
+    assm->j(not_equal, &do_div);
+    // {lhs} is min int if {lhs - 1} overflows.
+    iop(cmp, lhs, Immediate(1));
+    assm->j(overflow, trap_div_unrepresentable);
+    assm->bind(&do_div);
+  } else if (special_case_minus_1) {
+    // {lhs % -1} is always 0 (needs to be special cased because {kMinInt / -1}
+    // cannot be computed).
+    Label do_rem;
+    iop(cmp, rhs, Immediate(-1));
+    assm->j(not_equal, &do_rem);
+    // clang-format off
+    // (conflicts with presubmit checks because it is confused about "xor")
+    iop(xor, dst, dst);
+    // clang-format on
+    assm->jmp(&done);
+    assm->bind(&do_rem);
+  }
+
+  // Now move {lhs} into {eax}, then zero-extend or sign-extend into {edx}, then
+  // do the division.
+  if (lhs != rax) iop(mov, rax, lhs);
+  if (std::is_same<int32_t, type>::value) {  // i32
+    assm->cdq();
+    assm->idivl(rhs);
+  } else if (std::is_same<uint32_t, type>::value) {  // u32
+    assm->xorl(rdx, rdx);
+    assm->divl(rhs);
+  } else if (std::is_same<int64_t, type>::value) {  // i64
+    assm->cqo();
+    assm->idivq(rhs);
+  } else {  // u64
+    assm->xorq(rdx, rdx);
+    assm->divq(rhs);
+  }
+
+  // Move back the result (in {eax} or {edx}) into the {dst} register.
+  constexpr Register kResultReg = div_or_rem == DivOrRem::kDiv ? rax : rdx;
+  if (dst != kResultReg) {
+    iop(mov, dst, kResultReg);
+  }
+  if (special_case_minus_1) assm->bind(&done);
+}
+}  // namespace liftoff
+
+void LiftoffAssembler::emit_i32_divs(Register dst, Register lhs, Register rhs,
+                                     Label* trap_div_by_zero,
+                                     Label* trap_div_unrepresentable) {
+  liftoff::EmitIntDivOrRem<int32_t, liftoff::DivOrRem::kDiv>(
+      this, dst, lhs, rhs, trap_div_by_zero, trap_div_unrepresentable);
+}
+
+void LiftoffAssembler::emit_i32_divu(Register dst, Register lhs, Register rhs,
+                                     Label* trap_div_by_zero) {
+  liftoff::EmitIntDivOrRem<uint32_t, liftoff::DivOrRem::kDiv>(
+      this, dst, lhs, rhs, trap_div_by_zero, nullptr);
+}
+
+void LiftoffAssembler::emit_i32_rems(Register dst, Register lhs, Register rhs,
+                                     Label* trap_div_by_zero) {
+  liftoff::EmitIntDivOrRem<int32_t, liftoff::DivOrRem::kRem>(
+      this, dst, lhs, rhs, trap_div_by_zero, nullptr);
+}
+
+void LiftoffAssembler::emit_i32_remu(Register dst, Register lhs, Register rhs,
+                                     Label* trap_div_by_zero) {
+  liftoff::EmitIntDivOrRem<uint32_t, liftoff::DivOrRem::kRem>(
+      this, dst, lhs, rhs, trap_div_by_zero, nullptr);
+}
+
 void LiftoffAssembler::emit_i32_and(Register dst, Register lhs, Register rhs) {
   liftoff::EmitCommutativeBinOp<&Assembler::andl, &Assembler::movl>(this, dst,
                                                                     lhs, rhs);
@@ -535,6 +680,46 @@ void LiftoffAssembler::emit_i64_sub(LiftoffRegister dst, LiftoffRegister lhs,
   }
 }
 
+void LiftoffAssembler::emit_i64_mul(LiftoffRegister dst, LiftoffRegister lhs,
+                                    LiftoffRegister rhs) {
+  liftoff::EmitCommutativeBinOp<&Assembler::imulq, &Assembler::movq>(
+      this, dst.gp(), lhs.gp(), rhs.gp());
+}
+
+bool LiftoffAssembler::emit_i64_divs(LiftoffRegister dst, LiftoffRegister lhs,
+                                     LiftoffRegister rhs,
+                                     Label* trap_div_by_zero,
+                                     Label* trap_div_unrepresentable) {
+  liftoff::EmitIntDivOrRem<int64_t, liftoff::DivOrRem::kDiv>(
+      this, dst.gp(), lhs.gp(), rhs.gp(), trap_div_by_zero,
+      trap_div_unrepresentable);
+  return true;
+}
+
+bool LiftoffAssembler::emit_i64_divu(LiftoffRegister dst, LiftoffRegister lhs,
+                                     LiftoffRegister rhs,
+                                     Label* trap_div_by_zero) {
+  liftoff::EmitIntDivOrRem<uint64_t, liftoff::DivOrRem::kDiv>(
+      this, dst.gp(), lhs.gp(), rhs.gp(), trap_div_by_zero, nullptr);
+  return true;
+}
+
+bool LiftoffAssembler::emit_i64_rems(LiftoffRegister dst, LiftoffRegister lhs,
+                                     LiftoffRegister rhs,
+                                     Label* trap_div_by_zero) {
+  liftoff::EmitIntDivOrRem<int64_t, liftoff::DivOrRem::kRem>(
+      this, dst.gp(), lhs.gp(), rhs.gp(), trap_div_by_zero, nullptr);
+  return true;
+}
+
+bool LiftoffAssembler::emit_i64_remu(LiftoffRegister dst, LiftoffRegister lhs,
+                                     LiftoffRegister rhs,
+                                     Label* trap_div_by_zero) {
+  liftoff::EmitIntDivOrRem<uint64_t, liftoff::DivOrRem::kRem>(
+      this, dst.gp(), lhs.gp(), rhs.gp(), trap_div_by_zero, nullptr);
+  return true;
+}
+
 void LiftoffAssembler::emit_i64_and(LiftoffRegister dst, LiftoffRegister lhs,
                                     LiftoffRegister rhs) {
   liftoff::EmitCommutativeBinOp<&Assembler::andq, &Assembler::movq>(
@@ -571,6 +756,10 @@ void LiftoffAssembler::emit_i64_shr(LiftoffRegister dst, LiftoffRegister src,
                                         &Assembler::shrq_cl, pinned);
 }
 
+void LiftoffAssembler::emit_i32_to_intptr(Register dst, Register src) {
+  movsxlq(dst, src);
+}
+
 void LiftoffAssembler::emit_f32_add(DoubleRegister dst, DoubleRegister lhs,
                                     DoubleRegister rhs) {
   if (CpuFeatures::IsSupported(AVX)) {
@@ -627,6 +816,75 @@ void LiftoffAssembler::emit_f32_div(DoubleRegister dst, DoubleRegister lhs,
   }
 }
 
+namespace liftoff {
+enum class MinOrMax : uint8_t { kMin, kMax };
+template <typename type>
+inline void EmitFloatMinOrMax(LiftoffAssembler* assm, DoubleRegister dst,
+                              DoubleRegister lhs, DoubleRegister rhs,
+                              MinOrMax min_or_max) {
+  Label is_nan;
+  Label lhs_below_rhs;
+  Label lhs_above_rhs;
+  Label done;
+
+#define dop(name, ...)            \
+  do {                            \
+    if (sizeof(type) == 4) {      \
+      assm->name##s(__VA_ARGS__); \
+    } else {                      \
+      assm->name##d(__VA_ARGS__); \
+    }                             \
+  } while (false)
+
+  // Check the easy cases first: nan (e.g. unordered), smaller and greater.
+  // NaN has to be checked first, because PF=1 implies CF=1.
+  dop(Ucomis, lhs, rhs);
+  assm->j(parity_even, &is_nan, Label::kNear);   // PF=1
+  assm->j(below, &lhs_below_rhs, Label::kNear);  // CF=1
+  assm->j(above, &lhs_above_rhs, Label::kNear);  // CF=0 && ZF=0
+
+  // If we get here, then either
+  // a) {lhs == rhs},
+  // b) {lhs == -0.0} and {rhs == 0.0}, or
+  // c) {lhs == 0.0} and {rhs == -0.0}.
+  // For a), it does not matter whether we return {lhs} or {rhs}. Check the sign
+  // bit of {rhs} to differentiate b) and c).
+  dop(Movmskp, kScratchRegister, rhs);
+  assm->testl(kScratchRegister, Immediate(1));
+  assm->j(zero, &lhs_below_rhs, Label::kNear);
+  assm->jmp(&lhs_above_rhs, Label::kNear);
+
+  assm->bind(&is_nan);
+  // Create a NaN output.
+  dop(Xorp, dst, dst);
+  dop(Divs, dst, dst);
+  assm->jmp(&done, Label::kNear);
+
+  assm->bind(&lhs_below_rhs);
+  DoubleRegister lhs_below_rhs_src = min_or_max == MinOrMax::kMin ? lhs : rhs;
+  if (dst != lhs_below_rhs_src) dop(Movs, dst, lhs_below_rhs_src);
+  assm->jmp(&done, Label::kNear);
+
+  assm->bind(&lhs_above_rhs);
+  DoubleRegister lhs_above_rhs_src = min_or_max == MinOrMax::kMin ? rhs : lhs;
+  if (dst != lhs_above_rhs_src) dop(Movs, dst, lhs_above_rhs_src);
+
+  assm->bind(&done);
+}
+}  // namespace liftoff
+
+void LiftoffAssembler::emit_f32_min(DoubleRegister dst, DoubleRegister lhs,
+                                    DoubleRegister rhs) {
+  liftoff::EmitFloatMinOrMax<float>(this, dst, lhs, rhs,
+                                    liftoff::MinOrMax::kMin);
+}
+
+void LiftoffAssembler::emit_f32_max(DoubleRegister dst, DoubleRegister lhs,
+                                    DoubleRegister rhs) {
+  liftoff::EmitFloatMinOrMax<float>(this, dst, lhs, rhs,
+                                    liftoff::MinOrMax::kMax);
+}
+
 void LiftoffAssembler::emit_f32_abs(DoubleRegister dst, DoubleRegister src) {
   static constexpr uint32_t kSignBit = uint32_t{1} << 31;
   if (dst == src) {
@@ -730,6 +988,18 @@ void LiftoffAssembler::emit_f64_div(DoubleRegister dst, DoubleRegister lhs,
   }
 }
 
+void LiftoffAssembler::emit_f64_min(DoubleRegister dst, DoubleRegister lhs,
+                                    DoubleRegister rhs) {
+  liftoff::EmitFloatMinOrMax<double>(this, dst, lhs, rhs,
+                                     liftoff::MinOrMax::kMin);
+}
+
+void LiftoffAssembler::emit_f64_max(DoubleRegister dst, DoubleRegister lhs,
+                                    DoubleRegister rhs) {
+  liftoff::EmitFloatMinOrMax<double>(this, dst, lhs, rhs,
+                                     liftoff::MinOrMax::kMax);
+}
+
 void LiftoffAssembler::emit_f64_abs(DoubleRegister dst, DoubleRegister src) {
   static constexpr uint64_t kSignBit = uint64_t{1} << 63;
   if (dst == src) {
@@ -752,44 +1022,149 @@ void LiftoffAssembler::emit_f64_neg(DoubleRegister dst, DoubleRegister src) {
   }
 }
 
-void LiftoffAssembler::emit_f64_ceil(DoubleRegister dst, DoubleRegister src) {
-  REQUIRE_CPU_FEATURE(SSE4_1);
+bool LiftoffAssembler::emit_f64_ceil(DoubleRegister dst, DoubleRegister src) {
+  REQUIRE_CPU_FEATURE(SSE4_1, true);
   Roundsd(dst, src, kRoundUp);
+  return true;
 }
 
-void LiftoffAssembler::emit_f64_floor(DoubleRegister dst, DoubleRegister src) {
-  REQUIRE_CPU_FEATURE(SSE4_1);
+bool LiftoffAssembler::emit_f64_floor(DoubleRegister dst, DoubleRegister src) {
+  REQUIRE_CPU_FEATURE(SSE4_1, true);
   Roundsd(dst, src, kRoundDown);
+  return true;
 }
 
-void LiftoffAssembler::emit_f64_trunc(DoubleRegister dst, DoubleRegister src) {
-  REQUIRE_CPU_FEATURE(SSE4_1);
+bool LiftoffAssembler::emit_f64_trunc(DoubleRegister dst, DoubleRegister src) {
+  REQUIRE_CPU_FEATURE(SSE4_1, true);
   Roundsd(dst, src, kRoundToZero);
+  return true;
 }
 
-void LiftoffAssembler::emit_f64_nearest_int(DoubleRegister dst,
+bool LiftoffAssembler::emit_f64_nearest_int(DoubleRegister dst,
                                             DoubleRegister src) {
-  REQUIRE_CPU_FEATURE(SSE4_1);
+  REQUIRE_CPU_FEATURE(SSE4_1, true);
   Roundsd(dst, src, kRoundToNearest);
+  return true;
 }
 
 void LiftoffAssembler::emit_f64_sqrt(DoubleRegister dst, DoubleRegister src) {
   Sqrtsd(dst, src);
 }
 
+namespace liftoff {
+// Used for float to int conversions. If the value in {converted_back} equals
+// {src} afterwards, the conversion succeeded.
+template <typename dst_type, typename src_type>
+inline void ConvertFloatToIntAndBack(LiftoffAssembler* assm, Register dst,
+                                     DoubleRegister src,
+                                     DoubleRegister converted_back) {
+  if (std::is_same<double, src_type>::value) {  // f64
+    if (std::is_same<int32_t, dst_type>::value) {  // f64 -> i32
+      assm->Cvttsd2si(dst, src);
+      assm->Cvtlsi2sd(converted_back, dst);
+    } else if (std::is_same<uint32_t, dst_type>::value) {  // f64 -> u32
+      assm->Cvttsd2siq(dst, src);
+      assm->movl(dst, dst);
+      assm->Cvtqsi2sd(converted_back, dst);
+    } else if (std::is_same<int64_t, dst_type>::value) {  // f64 -> i64
+      assm->Cvttsd2siq(dst, src);
+      assm->Cvtqsi2sd(converted_back, dst);
+    } else {
+      UNREACHABLE();
+    }
+  } else {                                  // f32
+    if (std::is_same<int32_t, dst_type>::value) {  // f32 -> i32
+      assm->Cvttss2si(dst, src);
+      assm->Cvtlsi2ss(converted_back, dst);
+    } else if (std::is_same<uint32_t, dst_type>::value) {  // f32 -> u32
+      assm->Cvttss2siq(dst, src);
+      assm->movl(dst, dst);
+      assm->Cvtqsi2ss(converted_back, dst);
+    } else if (std::is_same<int64_t, dst_type>::value) {  // f32 -> i64
+      assm->Cvttss2siq(dst, src);
+      assm->Cvtqsi2ss(converted_back, dst);
+    } else {
+      UNREACHABLE();
+    }
+  }
+}
+
+template <typename dst_type, typename src_type>
+inline bool EmitTruncateFloatToInt(LiftoffAssembler* assm, Register dst,
+                                   DoubleRegister src, Label* trap) {
+  if (!CpuFeatures::IsSupported(SSE4_1)) {
+    assm->bailout("no SSE4.1");
+    return true;
+  }
+  CpuFeatureScope feature(assm, SSE4_1);
+
+  LiftoffRegList pinned = LiftoffRegList::ForRegs(src, dst);
+  DoubleRegister rounded =
+      pinned.set(assm->GetUnusedRegister(kFpReg, pinned)).fp();
+  DoubleRegister converted_back = assm->GetUnusedRegister(kFpReg, pinned).fp();
+
+  if (std::is_same<double, src_type>::value) {  // f64
+    assm->Roundsd(rounded, src, kRoundToZero);
+  } else {  // f32
+    assm->Roundss(rounded, src, kRoundToZero);
+  }
+  ConvertFloatToIntAndBack<dst_type, src_type>(assm, dst, rounded,
+                                               converted_back);
+  if (std::is_same<double, src_type>::value) {  // f64
+    assm->Ucomisd(converted_back, rounded);
+  } else {  // f32
+    assm->Ucomiss(converted_back, rounded);
+  }
+
+  // Jump to trap if PF is 0 (one of the operands was NaN) or they are not
+  // equal.
+  assm->j(parity_even, trap);
+  assm->j(not_equal, trap);
+  return true;
+}
+}  // namespace liftoff
+
 bool LiftoffAssembler::emit_type_conversion(WasmOpcode opcode,
                                             LiftoffRegister dst,
-                                            LiftoffRegister src) {
+                                            LiftoffRegister src, Label* trap) {
   switch (opcode) {
     case kExprI32ConvertI64:
       movl(dst.gp(), src.gp());
       return true;
+    case kExprI32SConvertF32:
+      return liftoff::EmitTruncateFloatToInt<int32_t, float>(this, dst.gp(),
+                                                             src.fp(), trap);
+    case kExprI32UConvertF32:
+      return liftoff::EmitTruncateFloatToInt<uint32_t, float>(this, dst.gp(),
+                                                              src.fp(), trap);
+    case kExprI32SConvertF64:
+      return liftoff::EmitTruncateFloatToInt<int32_t, double>(this, dst.gp(),
+                                                              src.fp(), trap);
+    case kExprI32UConvertF64:
+      return liftoff::EmitTruncateFloatToInt<uint32_t, double>(this, dst.gp(),
+                                                               src.fp(), trap);
     case kExprI32ReinterpretF32:
       Movd(dst.gp(), src.fp());
       return true;
     case kExprI64SConvertI32:
       movsxlq(dst.gp(), src.gp());
       return true;
+    case kExprI64SConvertF32:
+      return liftoff::EmitTruncateFloatToInt<int64_t, float>(this, dst.gp(),
+                                                             src.fp(), trap);
+    case kExprI64UConvertF32: {
+      REQUIRE_CPU_FEATURE(SSE4_1, true);
+      Cvttss2uiq(dst.gp(), src.fp(), trap);
+      return true;
+    }
+    case kExprI64SConvertF64:
+      return liftoff::EmitTruncateFloatToInt<int64_t, double>(this, dst.gp(),
+                                                              src.fp(), trap);
+    case kExprI64UConvertF64: {
+      REQUIRE_CPU_FEATURE(SSE4_1, true);
+      Cvttsd2uiq(dst.gp(), src.fp(), trap);
+      return true;
+    }
     case kExprI64UConvertI32:
       AssertZeroExtended(src.gp());
       if (dst.gp() != src.gp()) movl(dst.gp(), src.gp());
@@ -808,7 +1183,7 @@ bool LiftoffAssembler::emit_type_conversion(WasmOpcode opcode,
       Cvtqsi2ss(dst.fp(), src.gp());
       return true;
     case kExprF32UConvertI64:
-      Cvtqui2ss(dst.fp(), src.gp(), kScratchRegister);
+      Cvtqui2ss(dst.fp(), src.gp());
       return true;
     case kExprF32ConvertF64:
       Cvtsd2ss(dst.fp(), src.fp());
@@ -827,7 +1202,7 @@ bool LiftoffAssembler::emit_type_conversion(WasmOpcode opcode,
       Cvtqsi2sd(dst.fp(), src.gp());
       return true;
     case kExprF64UConvertI64:
-      Cvtqui2sd(dst.fp(), src.gp(), kScratchRegister);
+      Cvtqui2sd(dst.fp(), src.gp());
       return true;
     case kExprF64ConvertF32:
       Cvtss2sd(dst.fp(), src.fp());
@@ -901,7 +1276,7 @@ void EmitFloatSetCond(LiftoffAssembler* assm, Condition cond, Register dst,
   Label not_nan;
 
   (assm->*cmp_op)(lhs, rhs);
-  // IF PF is one, one of the operands was Nan. This needs special handling.
+  // If PF is one, one of the operands was NaN. This needs special handling.
   assm->j(parity_odd, &not_nan, Label::kNear);
   // Return 1 for f32.ne, 0 for all other cases.
   if (cond == not_equal) {
@@ -932,43 +1307,20 @@ void LiftoffAssembler::emit_f64_set_cond(Condition cond, Register dst,
                                                       rhs);
 }
 
-void LiftoffAssembler::StackCheck(Label* ool_code) {
-  Operand stack_limit = ExternalOperand(
-      ExternalReference::address_of_stack_limit(isolate()), kScratchRegister);
-  cmpp(rsp, stack_limit);
+void LiftoffAssembler::StackCheck(Label* ool_code, Register limit_address) {
+  cmpp(rsp, Operand(limit_address, 0));
   j(below_equal, ool_code);
 }
 
 void LiftoffAssembler::CallTrapCallbackForTesting() {
   PrepareCallCFunction(0);
-  CallCFunction(
-      ExternalReference::wasm_call_trap_callback_for_testing(isolate()), 0);
+  CallCFunction(ExternalReference::wasm_call_trap_callback_for_testing(), 0);
 }
 
 void LiftoffAssembler::AssertUnreachable(AbortReason reason) {
   TurboAssembler::AssertUnreachable(reason);
 }
 
-void LiftoffAssembler::PushCallerFrameSlot(const VarState& src,
-                                           uint32_t src_index, RegPairHalf) {
-  switch (src.loc()) {
-    case VarState::kStack:
-      pushq(liftoff::GetStackSlot(src_index));
-      break;
-    case VarState::kRegister:
-      PushCallerFrameSlot(src.reg(), src.type());
-      break;
-    case VarState::KIntConst:
-      pushq(Immediate(src.i32_const()));
-      break;
-  }
-}
-
-void LiftoffAssembler::PushCallerFrameSlot(LiftoffRegister reg,
-                                           ValueType type) {
-  liftoff::push(this, reg, type);
-}
-
 void LiftoffAssembler::PushRegisters(LiftoffRegList regs) {
   LiftoffRegList gp_regs = regs & kGpCacheRegList;
   while (!gp_regs.is_empty()) {
@@ -1014,65 +1366,58 @@ void LiftoffAssembler::DropStackSlotsAndRet(uint32_t num_stack_slots) {
   ret(static_cast<int>(num_stack_slots * kPointerSize));
 }
 
-void LiftoffAssembler::PrepareCCall(wasm::FunctionSig* sig,
-                                    const LiftoffRegister* args,
-                                    ValueType out_argument_type) {
+void LiftoffAssembler::CallC(wasm::FunctionSig* sig,
+                             const LiftoffRegister* args,
+                             const LiftoffRegister* rets,
+                             ValueType out_argument_type, int stack_bytes,
+                             ExternalReference ext_ref) {
+  subp(rsp, Immediate(stack_bytes));
+
+  int arg_bytes = 0;
   for (ValueType param_type : sig->parameters()) {
-    liftoff::push(this, *args++, param_type);
+    liftoff::Store(this, Operand(rsp, arg_bytes), *args++, param_type);
+    arg_bytes += ValueTypes::MemSize(param_type);
   }
-  if (out_argument_type != kWasmStmt) {
-    subq(rsp, Immediate(kPointerSize));
+  DCHECK_LE(arg_bytes, stack_bytes);
+
+// Pass a pointer to the buffer with the arguments to the C function.
+// On win64, the first argument is in {rcx}, otherwise it is {rdi}.
+#ifdef _WIN64
+  constexpr Register kFirstArgReg = rcx;
+#else
+  constexpr Register kFirstArgReg = rdi;
+#endif
+  movp(kFirstArgReg, rsp);
+
+  constexpr int kNumCCallArgs = 1;
+
+  // Now call the C function.
+  PrepareCallCFunction(kNumCCallArgs);
+  CallCFunction(ext_ref, kNumCCallArgs);
+
+  // Move return value to the right register.
+  const LiftoffRegister* next_result_reg = rets;
+  if (sig->return_count() > 0) {
+    DCHECK_EQ(1, sig->return_count());
+    constexpr Register kReturnReg = rax;
+    if (kReturnReg != next_result_reg->gp()) {
+      Move(*next_result_reg, LiftoffRegister(kReturnReg), sig->GetReturn(0));
+    }
+    ++next_result_reg;
   }
-  // Save the original sp (before the first push), such that we can later
-  // compute pointers to the pushed values. Do this only *after* pushing the
-  // values, because {kCCallLastArgAddrReg} might collide with an arg register.
-  int num_c_call_arguments = static_cast<int>(sig->parameter_count()) +
-                             (out_argument_type != kWasmStmt);
-  int pushed_bytes = kPointerSize * num_c_call_arguments;
-  leaq(liftoff::kCCallLastArgAddrReg, Operand(rsp, pushed_bytes));
-  PrepareCallCFunction(num_c_call_arguments);
-}
-
-void LiftoffAssembler::SetCCallRegParamAddr(Register dst, int param_byte_offset,
-                                            ValueType type) {
-  // Check that we don't accidentally override kCCallLastArgAddrReg.
-  DCHECK_NE(liftoff::kCCallLastArgAddrReg, dst);
-  leaq(dst, Operand(liftoff::kCCallLastArgAddrReg, -param_byte_offset));
-}
-
-void LiftoffAssembler::SetCCallStackParamAddr(int stack_param_idx,
-                                              int param_byte_offset,
-                                              ValueType type) {
-  // On x64, all C call arguments fit in registers.
-  UNREACHABLE();
-}
 
-void LiftoffAssembler::LoadCCallOutArgument(LiftoffRegister dst, ValueType type,
-                                            int param_byte_offset) {
-  // Check that we don't accidentally override kCCallLastArgAddrReg.
-  DCHECK_NE(LiftoffRegister(liftoff::kCCallLastArgAddrReg), dst);
-  Operand src(liftoff::kCCallLastArgAddrReg, -param_byte_offset);
-  liftoff::Load(this, dst, src, type);
-}
-
-void LiftoffAssembler::CallC(ExternalReference ext_ref, uint32_t num_params) {
-  CallCFunction(ext_ref, static_cast<int>(num_params));
-}
+  // Load potential output value from the buffer on the stack.
+  if (out_argument_type != kWasmStmt) {
+    liftoff::Load(this, *next_result_reg, Operand(rsp, 0), out_argument_type);
+  }
 
-void LiftoffAssembler::FinishCCall() {
-  movp(rsp, liftoff::kCCallLastArgAddrReg);
+  addp(rsp, Immediate(stack_bytes));
 }
 
 void LiftoffAssembler::CallNativeWasmCode(Address addr) {
   near_call(addr, RelocInfo::WASM_CALL);
 }
 
-void LiftoffAssembler::CallRuntime(Zone* zone, Runtime::FunctionId fid) {
-  // Set instance to zero.
-  xorp(rsi, rsi);
-  CallRuntimeDelayed(zone, fid);
-}
-
 void LiftoffAssembler::CallIndirect(wasm::FunctionSig* sig,
                                     compiler::CallDescriptor* call_descriptor,
                                     Register target) {
@@ -1080,7 +1425,17 @@ void LiftoffAssembler::CallIndirect(wasm::FunctionSig* sig,
     popq(kScratchRegister);
     target = kScratchRegister;
   }
-  call(target);
+  if (FLAG_untrusted_code_mitigations) {
+    RetpolineCall(target);
+  } else {
+    call(target);
+  }
+}
+
+void LiftoffAssembler::CallRuntimeStub(WasmCode::RuntimeStubId sid) {
+  // A direct call to a wasm runtime stub defined in this module.
+  // Just encode the stub index. This will be patched at relocation.
+  near_call(static_cast<Address>(sid), RelocInfo::WASM_STUB_CALL);
 }
 
 void LiftoffAssembler::AllocateStackSlot(Register addr, uint32_t size) {
@@ -1092,6 +1447,23 @@ void LiftoffAssembler::DeallocateStackSlot(uint32_t size) {
   addp(rsp, Immediate(size));
 }
 
+void LiftoffStackSlots::Construct() {
+  for (auto& slot : slots_) {
+    const LiftoffAssembler::VarState& src = slot.src_;
+    switch (src.loc()) {
+      case LiftoffAssembler::VarState::kStack:
+        asm_->pushq(liftoff::GetStackSlot(slot.src_index_));
+        break;
+      case LiftoffAssembler::VarState::kRegister:
+        liftoff::push(asm_, src.reg(), src.type());
+        break;
+      case LiftoffAssembler::VarState::KIntConst:
+        asm_->pushq(Immediate(src.i32_const()));
+        break;
+    }
+  }
+}
+
 #undef REQUIRE_CPU_FEATURE
 
 }  // namespace wasm
diff --git a/deps/v8/src/wasm/compilation-manager.cc b/deps/v8/src/wasm/compilation-manager.cc
deleted file mode 100644
index b94e88feeea931..00000000000000
--- a/deps/v8/src/wasm/compilation-manager.cc
+++ /dev/null
@@ -1,62 +0,0 @@
-// Copyright 2017 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "src/wasm/compilation-manager.h"
-#include "src/wasm/module-compiler.h"
-
-#include "src/objects-inl.h"
-
-namespace v8 {
-namespace internal {
-namespace wasm {
-
-AsyncCompileJob* CompilationManager::CreateAsyncCompileJob(
-    Isolate* isolate, std::unique_ptr<byte[]> bytes_copy, size_t length,
-    Handle<Context> context, Handle<JSPromise> promise) {
-  AsyncCompileJob* job = new AsyncCompileJob(isolate, std::move(bytes_copy),
-                                             length, context, promise);
-  // Pass ownership to the unique_ptr in {jobs_}.
-  jobs_[job] = std::unique_ptr<AsyncCompileJob>(job);
-  return job;
-}
-
-void CompilationManager::StartAsyncCompileJob(
-    Isolate* isolate, std::unique_ptr<byte[]> bytes_copy, size_t length,
-    Handle<Context> context, Handle<JSPromise> promise) {
-  AsyncCompileJob* job = CreateAsyncCompileJob(isolate, std::move(bytes_copy),
-                                               length, context, promise);
-  job->Start();
-}
-
-std::shared_ptr<StreamingDecoder> CompilationManager::StartStreamingCompilation(
-    Isolate* isolate, Handle<Context> context, Handle<JSPromise> promise) {
-  AsyncCompileJob* job = CreateAsyncCompileJob(
-      isolate, std::unique_ptr<byte[]>(nullptr), 0, context, promise);
-  return job->CreateStreamingDecoder();
-}
-
-std::unique_ptr<AsyncCompileJob> CompilationManager::RemoveJob(
-    AsyncCompileJob* job) {
-  auto item = jobs_.find(job);
-  DCHECK(item != jobs_.end());
-  std::unique_ptr<AsyncCompileJob> result = std::move(item->second);
-  jobs_.erase(item);
-  return result;
-}
-
-void CompilationManager::TearDown() { jobs_.clear(); }
-
-void CompilationManager::AbortAllJobs() {
-  // Iterate over a copy of {jobs_}, because {job->Abort} modifies {jobs_}.
-  std::vector<AsyncCompileJob*> copy;
-  copy.reserve(jobs_.size());
-
-  for (auto& entry : jobs_) copy.push_back(entry.first);
-
-  for (auto* job : copy) job->Abort();
-}
-
-}  // namespace wasm
-}  // namespace internal
-}  // namespace v8
diff --git a/deps/v8/src/wasm/compilation-manager.h b/deps/v8/src/wasm/compilation-manager.h
deleted file mode 100644
index 38e80c6c2d87fa..00000000000000
--- a/deps/v8/src/wasm/compilation-manager.h
+++ /dev/null
@@ -1,62 +0,0 @@
-// Copyright 2017 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef V8_WASM_COMPILATION_MANAGER_H_
-#define V8_WASM_COMPILATION_MANAGER_H_
-
-#include <unordered_map>
-
-#include "src/handles.h"
-#include "src/isolate.h"
-
-namespace v8 {
-namespace internal {
-namespace wasm {
-
-class AsyncCompileJob;
-
-// The CompilationManager manages a list of active WebAssembly compile jobs. The
-// manager owns the memory of the compile jobs and can trigger the abortion of
-// compile jobs. If the isolate tears down, the CompilationManager makes sure
-// that all compile jobs finish executing before the isolate becomes
-// unavailable.
-class CompilationManager {
- public:
-  void StartAsyncCompileJob(Isolate* isolate,
-                            std::unique_ptr<byte[]> bytes_copy, size_t length,
-                            Handle<Context> context, Handle<JSPromise> promise);
-
-  std::shared_ptr<StreamingDecoder> StartStreamingCompilation(
-      Isolate* isolate, Handle<Context> context, Handle<JSPromise> promise);
-
-  // Remove {job} from the list of active compile jobs.
-  std::unique_ptr<AsyncCompileJob> RemoveJob(AsyncCompileJob* job);
-
-  // Cancel all AsyncCompileJobs and delete their state immediately.
-  void TearDown();
-
-  // Cancel all AsyncCompileJobs so that they are not processed any further,
-  // but delay the deletion of their state until all tasks accessing the
-  // AsyncCompileJob finish their execution.
-  void AbortAllJobs();
-
-  // Returns true if at lease one AsyncCompileJob is currently running.
-  bool HasRunningCompileJob() const { return !jobs_.empty(); }
-
- private:
-  AsyncCompileJob* CreateAsyncCompileJob(Isolate* isolate,
-                                         std::unique_ptr<byte[]> bytes_copy,
-                                         size_t length, Handle<Context> context,
-                                         Handle<JSPromise> promise);
-
-  // We use an AsyncCompileJob as the key for itself so that we can delete the
-  // job from the map when it is finished.
-  std::unordered_map<AsyncCompileJob*, std::unique_ptr<AsyncCompileJob>> jobs_;
-};
-
-}  // namespace wasm
-}  // namespace internal
-}  // namespace v8
-
-#endif  // V8_WASM_COMPILATION_MANAGER_H_
diff --git a/deps/v8/src/wasm/decoder.h b/deps/v8/src/wasm/decoder.h
index d7e76e4a77c570..cca823b84d01b2 100644
--- a/deps/v8/src/wasm/decoder.h
+++ b/deps/v8/src/wasm/decoder.h
@@ -280,7 +280,7 @@ class Decoder {
     } else if (!validate_size(pc, sizeof(IntType), msg)) {
       return IntType{0};
     }
-    return ReadLittleEndianValue<IntType>(pc);
+    return ReadLittleEndianValue<IntType>(reinterpret_cast<Address>(pc));
   }
 
   template <typename IntType>
diff --git a/deps/v8/src/wasm/function-body-decoder-impl.h b/deps/v8/src/wasm/function-body-decoder-impl.h
index c8c1aeec8b7f8f..621f905d447c65 100644
--- a/deps/v8/src/wasm/function-body-decoder-impl.h
+++ b/deps/v8/src/wasm/function-body-decoder-impl.h
@@ -38,13 +38,13 @@ struct WasmException;
   }())
 
 #define RET_ON_PROTOTYPE_OPCODE(flag)                                          \
-  DCHECK(!this->module_ || !this->module_->is_asm_js());                       \
+  DCHECK(!this->module_ || this->module_->origin == kWasmOrigin);              \
   if (!FLAG_experimental_wasm_##flag) {                                        \
     this->error("Invalid opcode (enable with --experimental-wasm-" #flag ")"); \
   }
 
 #define CHECK_PROTOTYPE_OPCODE(flag)                                           \
-  DCHECK(!this->module_ || !this->module_->is_asm_js());                       \
+  DCHECK(!this->module_ || this->module_->origin == kWasmOrigin);              \
   if (!FLAG_experimental_wasm_##flag) {                                        \
     this->error("Invalid opcode (enable with --experimental-wasm-" #flag ")"); \
     break;                                                                     \
@@ -126,53 +126,52 @@ Vector<T> vec2vec(std::vector<T, Allocator>& vec) {
   return Vector<T>(vec.data(), vec.size());
 }
 
-
-// Helpers for decoding different kinds of operands which follow bytecodes.
+// Helpers for decoding different kinds of immediates which follow bytecodes.
 template <Decoder::ValidateFlag validate>
-struct LocalIndexOperand {
+struct LocalIndexImmediate {
   uint32_t index;
   ValueType type = kWasmStmt;
   unsigned length;
 
-  inline LocalIndexOperand(Decoder* decoder, const byte* pc) {
+  inline LocalIndexImmediate(Decoder* decoder, const byte* pc) {
     index = decoder->read_u32v<validate>(pc + 1, &length, "local index");
   }
 };
 
 template <Decoder::ValidateFlag validate>
-struct ExceptionIndexOperand {
+struct ExceptionIndexImmediate {
   uint32_t index;
   const WasmException* exception = nullptr;
   unsigned length;
 
-  inline ExceptionIndexOperand(Decoder* decoder, const byte* pc) {
+  inline ExceptionIndexImmediate(Decoder* decoder, const byte* pc) {
     index = decoder->read_u32v<validate>(pc + 1, &length, "exception index");
   }
 };
 
 template <Decoder::ValidateFlag validate>
-struct ImmI32Operand {
+struct ImmI32Immediate {
   int32_t value;
   unsigned length;
-  inline ImmI32Operand(Decoder* decoder, const byte* pc) {
+  inline ImmI32Immediate(Decoder* decoder, const byte* pc) {
     value = decoder->read_i32v<validate>(pc + 1, &length, "immi32");
   }
 };
 
 template <Decoder::ValidateFlag validate>
-struct ImmI64Operand {
+struct ImmI64Immediate {
   int64_t value;
   unsigned length;
-  inline ImmI64Operand(Decoder* decoder, const byte* pc) {
+  inline ImmI64Immediate(Decoder* decoder, const byte* pc) {
     value = decoder->read_i64v<validate>(pc + 1, &length, "immi64");
   }
 };
 
 template <Decoder::ValidateFlag validate>
-struct ImmF32Operand {
+struct ImmF32Immediate {
   float value;
   unsigned length = 4;
-  inline ImmF32Operand(Decoder* decoder, const byte* pc) {
+  inline ImmF32Immediate(Decoder* decoder, const byte* pc) {
     // Avoid bit_cast because it might not preserve the signalling bit of a NaN.
     uint32_t tmp = decoder->read_u32<validate>(pc + 1, "immf32");
     memcpy(&value, &tmp, sizeof(value));
@@ -180,10 +179,10 @@ struct ImmF32Operand {
 };
 
 template <Decoder::ValidateFlag validate>
-struct ImmF64Operand {
+struct ImmF64Immediate {
   double value;
   unsigned length = 8;
-  inline ImmF64Operand(Decoder* decoder, const byte* pc) {
+  inline ImmF64Immediate(Decoder* decoder, const byte* pc) {
     // Avoid bit_cast because it might not preserve the signalling bit of a NaN.
     uint64_t tmp = decoder->read_u64<validate>(pc + 1, "immf64");
     memcpy(&value, &tmp, sizeof(value));
@@ -191,25 +190,25 @@ struct ImmF64Operand {
 };
 
 template <Decoder::ValidateFlag validate>
-struct GlobalIndexOperand {
+struct GlobalIndexImmediate {
   uint32_t index;
   ValueType type = kWasmStmt;
   const WasmGlobal* global = nullptr;
   unsigned length;
 
-  inline GlobalIndexOperand(Decoder* decoder, const byte* pc) {
+  inline GlobalIndexImmediate(Decoder* decoder, const byte* pc) {
     index = decoder->read_u32v<validate>(pc + 1, &length, "global index");
   }
 };
 
 template <Decoder::ValidateFlag validate>
-struct BlockTypeOperand {
+struct BlockTypeImmediate {
   unsigned length = 1;
   ValueType type = kWasmStmt;
   uint32_t sig_index = 0;
   FunctionSig* sig = nullptr;
 
-  inline BlockTypeOperand(Decoder* decoder, const byte* pc) {
+  inline BlockTypeImmediate(Decoder* decoder, const byte* pc) {
     uint8_t val = decoder->read_u8<validate>(pc + 1, "block type");
     if (!decode_local_type(val, &type)) {
       // Handle multi-value blocks.
@@ -249,6 +248,9 @@ struct BlockTypeOperand {
       case kLocalS128:
         *result = kWasmS128;
         return true;
+      case kLocalAnyFunc:
+        *result = kWasmAnyFunc;
+        return true;
       case kLocalAnyRef:
         *result = kWasmAnyRef;
         return true;
@@ -280,21 +282,21 @@ struct BlockTypeOperand {
 };
 
 template <Decoder::ValidateFlag validate>
-struct BreakDepthOperand {
+struct BreakDepthImmediate {
   uint32_t depth;
   unsigned length;
-  inline BreakDepthOperand(Decoder* decoder, const byte* pc) {
+  inline BreakDepthImmediate(Decoder* decoder, const byte* pc) {
     depth = decoder->read_u32v<validate>(pc + 1, &length, "break depth");
   }
 };
 
 template <Decoder::ValidateFlag validate>
-struct CallIndirectOperand {
+struct CallIndirectImmediate {
   uint32_t table_index;
   uint32_t sig_index;
   FunctionSig* sig = nullptr;
   unsigned length = 0;
-  inline CallIndirectOperand(Decoder* decoder, const byte* pc) {
+  inline CallIndirectImmediate(Decoder* decoder, const byte* pc) {
     unsigned len = 0;
     sig_index = decoder->read_u32v<validate>(pc + 1, &len, "signature index");
     if (!VALIDATE(decoder->ok())) return;
@@ -308,20 +310,20 @@ struct CallIndirectOperand {
 };
 
 template <Decoder::ValidateFlag validate>
-struct CallFunctionOperand {
+struct CallFunctionImmediate {
   uint32_t index;
   FunctionSig* sig = nullptr;
   unsigned length;
-  inline CallFunctionOperand(Decoder* decoder, const byte* pc) {
+  inline CallFunctionImmediate(Decoder* decoder, const byte* pc) {
     index = decoder->read_u32v<validate>(pc + 1, &length, "function index");
   }
 };
 
 template <Decoder::ValidateFlag validate>
-struct MemoryIndexOperand {
+struct MemoryIndexImmediate {
   uint32_t index;
   unsigned length = 1;
-  inline MemoryIndexOperand(Decoder* decoder, const byte* pc) {
+  inline MemoryIndexImmediate(Decoder* decoder, const byte* pc) {
     index = decoder->read_u8<validate>(pc + 1, "memory index");
     if (!VALIDATE(index == 0)) {
       decoder->errorf(pc + 1, "expected memory index 0, found %u", index);
@@ -330,11 +332,11 @@ struct MemoryIndexOperand {
 };
 
 template <Decoder::ValidateFlag validate>
-struct BranchTableOperand {
+struct BranchTableImmediate {
   uint32_t table_count;
   const byte* start;
   const byte* table;
-  inline BranchTableOperand(Decoder* decoder, const byte* pc) {
+  inline BranchTableImmediate(Decoder* decoder, const byte* pc) {
     DCHECK_EQ(kExprBrTable, decoder->read_u8<validate>(pc, "opcode"));
     start = pc + 1;
     unsigned len = 0;
@@ -348,7 +350,7 @@ template <Decoder::ValidateFlag validate>
 class BranchTableIterator {
  public:
   unsigned cur_index() { return index_; }
-  bool has_next() { return decoder_->ok() && index_ <= table_count_; }
+  bool has_next() { return VALIDATE(decoder_->ok()) && index_ <= table_count_; }
   uint32_t next() {
     DCHECK(has_next());
     index_++;
@@ -358,7 +360,7 @@ class BranchTableIterator {
     pc_ += length;
     return result;
   }
-  // length, including the length of the {BranchTableOperand}, but not the
+  // length, including the length of the {BranchTableImmediate}, but not the
   // opcode.
   unsigned length() {
     while (has_next()) next();
@@ -367,28 +369,27 @@ class BranchTableIterator {
   const byte* pc() { return pc_; }
 
   BranchTableIterator(Decoder* decoder,
-                      const BranchTableOperand<validate>& operand)
+                      const BranchTableImmediate<validate>& imm)
       : decoder_(decoder),
-        start_(operand.start),
-        pc_(operand.table),
-        index_(0),
-        table_count_(operand.table_count) {}
+        start_(imm.start),
+        pc_(imm.table),
+        table_count_(imm.table_count) {}
 
  private:
   Decoder* decoder_;
   const byte* start_;
   const byte* pc_;
-  uint32_t index_;        // the current index.
+  uint32_t index_ = 0;    // the current index.
   uint32_t table_count_;  // the count of entries, not including default.
 };
 
 template <Decoder::ValidateFlag validate>
-struct MemoryAccessOperand {
+struct MemoryAccessImmediate {
   uint32_t alignment;
   uint32_t offset;
   unsigned length = 0;
-  inline MemoryAccessOperand(Decoder* decoder, const byte* pc,
-                             uint32_t max_alignment) {
+  inline MemoryAccessImmediate(Decoder* decoder, const byte* pc,
+                               uint32_t max_alignment) {
     unsigned alignment_length;
     alignment =
         decoder->read_u32v<validate>(pc + 1, &alignment_length, "alignment");
@@ -406,34 +407,34 @@ struct MemoryAccessOperand {
   }
 };
 
-// Operand for SIMD lane operations.
+// Immediate for SIMD lane operations.
 template <Decoder::ValidateFlag validate>
-struct SimdLaneOperand {
+struct SimdLaneImmediate {
   uint8_t lane;
   unsigned length = 1;
 
-  inline SimdLaneOperand(Decoder* decoder, const byte* pc) {
+  inline SimdLaneImmediate(Decoder* decoder, const byte* pc) {
     lane = decoder->read_u8<validate>(pc + 2, "lane");
   }
 };
 
-// Operand for SIMD shift operations.
+// Immediate for SIMD shift operations.
 template <Decoder::ValidateFlag validate>
-struct SimdShiftOperand {
+struct SimdShiftImmediate {
   uint8_t shift;
   unsigned length = 1;
 
-  inline SimdShiftOperand(Decoder* decoder, const byte* pc) {
+  inline SimdShiftImmediate(Decoder* decoder, const byte* pc) {
     shift = decoder->read_u8<validate>(pc + 2, "shift");
   }
 };
 
-// Operand for SIMD S8x16 shuffle operations.
+// Immediate for SIMD S8x16 shuffle operations.
 template <Decoder::ValidateFlag validate>
-struct Simd8x16ShuffleOperand {
+struct Simd8x16ShuffleImmediate {
   uint8_t shuffle[kSimd128Size] = {0};
 
-  inline Simd8x16ShuffleOperand(Decoder* decoder, const byte* pc) {
+  inline Simd8x16ShuffleImmediate(Decoder* decoder, const byte* pc) {
     for (uint32_t i = 0; i < kSimd128Size; ++i) {
       shuffle[i] = decoder->read_u8<validate>(pc + 2 + i, "shuffle");
       if (!VALIDATE(decoder->ok())) return;
@@ -590,72 +591,71 @@ struct ControlWithNamedConstructors : public ControlBase<Value> {
 // This is the list of callback functions that an interface for the
 // WasmFullDecoder should implement.
 // F(Name, args...)
-#define INTERFACE_FUNCTIONS(F)                                                 \
-  /* General: */                                                               \
-  F(StartFunction)                                                             \
-  F(StartFunctionBody, Control* block)                                         \
-  F(FinishFunction)                                                            \
-  F(OnFirstError)                                                              \
-  F(NextInstruction, WasmOpcode)                                               \
-  /* Control: */                                                               \
-  F(Block, Control* block)                                                     \
-  F(Loop, Control* block)                                                      \
-  F(Try, Control* block)                                                       \
-  F(If, const Value& cond, Control* if_block)                                  \
-  F(FallThruTo, Control* c)                                                    \
-  F(PopControl, Control* block)                                                \
-  F(EndControl, Control* block)                                                \
-  /* Instructions: */                                                          \
-  F(UnOp, WasmOpcode opcode, FunctionSig*, const Value& value, Value* result)  \
-  F(BinOp, WasmOpcode opcode, FunctionSig*, const Value& lhs,                  \
-    const Value& rhs, Value* result)                                           \
-  F(I32Const, Value* result, int32_t value)                                    \
-  F(I64Const, Value* result, int64_t value)                                    \
-  F(F32Const, Value* result, float value)                                      \
-  F(F64Const, Value* result, double value)                                     \
-  F(RefNull, Value* result)                                                    \
-  F(Drop, const Value& value)                                                  \
-  F(DoReturn, Vector<Value> values, bool implicit)                             \
-  F(GetLocal, Value* result, const LocalIndexOperand<validate>& operand)       \
-  F(SetLocal, const Value& value, const LocalIndexOperand<validate>& operand)  \
-  F(TeeLocal, const Value& value, Value* result,                               \
-    const LocalIndexOperand<validate>& operand)                                \
-  F(GetGlobal, Value* result, const GlobalIndexOperand<validate>& operand)     \
-  F(SetGlobal, const Value& value,                                             \
-    const GlobalIndexOperand<validate>& operand)                               \
-  F(Unreachable)                                                               \
-  F(Select, const Value& cond, const Value& fval, const Value& tval,           \
-    Value* result)                                                             \
-  F(Br, Control* target)                                                       \
-  F(BrIf, const Value& cond, Control* target)                                  \
-  F(BrTable, const BranchTableOperand<validate>& operand, const Value& key)    \
-  F(Else, Control* if_block)                                                   \
-  F(LoadMem, LoadType type, const MemoryAccessOperand<validate>& operand,      \
-    const Value& index, Value* result)                                         \
-  F(StoreMem, StoreType type, const MemoryAccessOperand<validate>& operand,    \
-    const Value& index, const Value& value)                                    \
-  F(CurrentMemoryPages, Value* result)                                         \
-  F(GrowMemory, const Value& value, Value* result)                             \
-  F(CallDirect, const CallFunctionOperand<validate>& operand,                  \
-    const Value args[], Value returns[])                                       \
-  F(CallIndirect, const Value& index,                                          \
-    const CallIndirectOperand<validate>& operand, const Value args[],          \
-    Value returns[])                                                           \
-  F(SimdOp, WasmOpcode opcode, Vector<Value> args, Value* result)              \
-  F(SimdLaneOp, WasmOpcode opcode, const SimdLaneOperand<validate>& operand,   \
-    const Vector<Value> inputs, Value* result)                                 \
-  F(SimdShiftOp, WasmOpcode opcode, const SimdShiftOperand<validate>& operand, \
-    const Value& input, Value* result)                                         \
-  F(Simd8x16ShuffleOp, const Simd8x16ShuffleOperand<validate>& operand,        \
-    const Value& input0, const Value& input1, Value* result)                   \
-  F(Throw, const ExceptionIndexOperand<validate>&, Control* block,             \
-    const Vector<Value>& args)                                                 \
-  F(CatchException, const ExceptionIndexOperand<validate>& operand,            \
-    Control* block, Vector<Value> caught_values)                               \
-  F(AtomicOp, WasmOpcode opcode, Vector<Value> args,                           \
-    const MemoryAccessOperand<validate>& operand, Value* result)
-
-// Generic Wasm bytecode decoder with utilities for decoding operands,
+#define INTERFACE_FUNCTIONS(F)                                                \
+  /* General: */                                                              \
+  F(StartFunction)                                                            \
+  F(StartFunctionBody, Control* block)                                        \
+  F(FinishFunction)                                                           \
+  F(OnFirstError)                                                             \
+  F(NextInstruction, WasmOpcode)                                              \
+  /* Control: */                                                              \
+  F(Block, Control* block)                                                    \
+  F(Loop, Control* block)                                                     \
+  F(Try, Control* block)                                                      \
+  F(If, const Value& cond, Control* if_block)                                 \
+  F(FallThruTo, Control* c)                                                   \
+  F(PopControl, Control* block)                                               \
+  F(EndControl, Control* block)                                               \
+  /* Instructions: */                                                         \
+  F(UnOp, WasmOpcode opcode, FunctionSig*, const Value& value, Value* result) \
+  F(BinOp, WasmOpcode opcode, FunctionSig*, const Value& lhs,                 \
+    const Value& rhs, Value* result)                                          \
+  F(I32Const, Value* result, int32_t value)                                   \
+  F(I64Const, Value* result, int64_t value)                                   \
+  F(F32Const, Value* result, float value)                                     \
+  F(F64Const, Value* result, double value)                                    \
+  F(RefNull, Value* result)                                                   \
+  F(Drop, const Value& value)                                                 \
+  F(DoReturn, Vector<Value> values, bool implicit)                            \
+  F(GetLocal, Value* result, const LocalIndexImmediate<validate>& imm)        \
+  F(SetLocal, const Value& value, const LocalIndexImmediate<validate>& imm)   \
+  F(TeeLocal, const Value& value, Value* result,                              \
+    const LocalIndexImmediate<validate>& imm)                                 \
+  F(GetGlobal, Value* result, const GlobalIndexImmediate<validate>& imm)      \
+  F(SetGlobal, const Value& value, const GlobalIndexImmediate<validate>& imm) \
+  F(Unreachable)                                                              \
+  F(Select, const Value& cond, const Value& fval, const Value& tval,          \
+    Value* result)                                                            \
+  F(Br, Control* target)                                                      \
+  F(BrIf, const Value& cond, Control* target)                                 \
+  F(BrTable, const BranchTableImmediate<validate>& imm, const Value& key)     \
+  F(Else, Control* if_block)                                                  \
+  F(LoadMem, LoadType type, const MemoryAccessImmediate<validate>& imm,       \
+    const Value& index, Value* result)                                        \
+  F(StoreMem, StoreType type, const MemoryAccessImmediate<validate>& imm,     \
+    const Value& index, const Value& value)                                   \
+  F(CurrentMemoryPages, Value* result)                                        \
+  F(GrowMemory, const Value& value, Value* result)                            \
+  F(CallDirect, const CallFunctionImmediate<validate>& imm,                   \
+    const Value args[], Value returns[])                                      \
+  F(CallIndirect, const Value& index,                                         \
+    const CallIndirectImmediate<validate>& imm, const Value args[],           \
+    Value returns[])                                                          \
+  F(SimdOp, WasmOpcode opcode, Vector<Value> args, Value* result)             \
+  F(SimdLaneOp, WasmOpcode opcode, const SimdLaneImmediate<validate>& imm,    \
+    const Vector<Value> inputs, Value* result)                                \
+  F(SimdShiftOp, WasmOpcode opcode, const SimdShiftImmediate<validate>& imm,  \
+    const Value& input, Value* result)                                        \
+  F(Simd8x16ShuffleOp, const Simd8x16ShuffleImmediate<validate>& imm,         \
+    const Value& input0, const Value& input1, Value* result)                  \
+  F(Throw, const ExceptionIndexImmediate<validate>&, Control* block,          \
+    const Vector<Value>& args)                                                \
+  F(CatchException, const ExceptionIndexImmediate<validate>& imm,             \
+    Control* block, Vector<Value> caught_values)                              \
+  F(AtomicOp, WasmOpcode opcode, Vector<Value> args,                          \
+    const MemoryAccessImmediate<validate>& imm, Value* result)
+
+// Generic Wasm bytecode decoder with utilities for decoding immediates,
 // lengths, etc.
 template <Decoder::ValidateFlag validate>
 class WasmDecoder : public Decoder {
@@ -690,7 +690,7 @@ class WasmDecoder : public Decoder {
     if (decoder->failed()) return false;
 
     TRACE("local decls count: %u\n", entries);
-    while (entries-- > 0 && decoder->ok() && decoder->more()) {
+    while (entries-- > 0 && VALIDATE(decoder->ok()) && decoder->more()) {
       uint32_t count = decoder->consume_u32v("local count");
       if (decoder->failed()) return false;
 
@@ -749,7 +749,7 @@ class WasmDecoder : public Decoder {
     BitVector* assigned = new (zone) BitVector(locals_count, zone);
     int depth = 0;
     // Iteratively process all AST nodes nested inside the loop.
-    while (pc < decoder->end() && decoder->ok()) {
+    while (pc < decoder->end() && VALIDATE(decoder->ok())) {
       WasmOpcode opcode = static_cast<WasmOpcode>(*pc);
       unsigned length = 1;
       switch (opcode) {
@@ -762,13 +762,13 @@ class WasmDecoder : public Decoder {
           break;
         case kExprSetLocal:  // fallthru
         case kExprTeeLocal: {
-          LocalIndexOperand<Decoder::kValidate> operand(decoder, pc);
+          LocalIndexImmediate<Decoder::kValidate> imm(decoder, pc);
           if (assigned->length() > 0 &&
-              operand.index < static_cast<uint32_t>(assigned->length())) {
+              imm.index < static_cast<uint32_t>(assigned->length())) {
             // Unverified code might have an out-of-bounds index.
-            assigned->Add(operand.index);
+            assigned->Add(imm.index);
           }
-          length = 1 + operand.length;
+          length = 1 + imm.length;
           break;
         }
         case kExprGrowMemory:
@@ -789,100 +789,98 @@ class WasmDecoder : public Decoder {
       if (depth <= 0) break;
       pc += length;
     }
-    return decoder->ok() ? assigned : nullptr;
+    return VALIDATE(decoder->ok()) ? assigned : nullptr;
   }
 
   inline bool Validate(const byte* pc,
-                       LocalIndexOperand<Decoder::kValidate>& operand) {
-    if (!VALIDATE(operand.index < total_locals())) {
-      errorf(pc + 1, "invalid local index: %u", operand.index);
+                       LocalIndexImmediate<Decoder::kValidate>& imm) {
+    if (!VALIDATE(imm.index < total_locals())) {
+      errorf(pc + 1, "invalid local index: %u", imm.index);
       return false;
     }
-    operand.type = local_types_ ? local_types_->at(operand.index) : kWasmStmt;
+    imm.type = local_types_ ? local_types_->at(imm.index) : kWasmStmt;
     return true;
   }
 
-  inline bool Validate(const byte* pc,
-                       ExceptionIndexOperand<validate>& operand) {
+  inline bool Validate(const byte* pc, ExceptionIndexImmediate<validate>& imm) {
     if (!VALIDATE(module_ != nullptr &&
-                  operand.index < module_->exceptions.size())) {
-      errorf(pc + 1, "Invalid exception index: %u", operand.index);
+                  imm.index < module_->exceptions.size())) {
+      errorf(pc + 1, "Invalid exception index: %u", imm.index);
       return false;
     }
-    operand.exception = &module_->exceptions[operand.index];
+    imm.exception = &module_->exceptions[imm.index];
     return true;
   }
 
-  inline bool Validate(const byte* pc, GlobalIndexOperand<validate>& operand) {
-    if (!VALIDATE(module_ != nullptr &&
-                  operand.index < module_->globals.size())) {
-      errorf(pc + 1, "invalid global index: %u", operand.index);
+  inline bool Validate(const byte* pc, GlobalIndexImmediate<validate>& imm) {
+    if (!VALIDATE(module_ != nullptr && imm.index < module_->globals.size())) {
+      errorf(pc + 1, "invalid global index: %u", imm.index);
       return false;
     }
-    operand.global = &module_->globals[operand.index];
-    operand.type = operand.global->type;
+    imm.global = &module_->globals[imm.index];
+    imm.type = imm.global->type;
     return true;
   }
 
-  inline bool Complete(const byte* pc, CallFunctionOperand<validate>& operand) {
+  inline bool Complete(const byte* pc, CallFunctionImmediate<validate>& imm) {
     if (!VALIDATE(module_ != nullptr &&
-                  operand.index < module_->functions.size())) {
+                  imm.index < module_->functions.size())) {
       return false;
     }
-    operand.sig = module_->functions[operand.index].sig;
+    imm.sig = module_->functions[imm.index].sig;
     return true;
   }
 
-  inline bool Validate(const byte* pc, CallFunctionOperand<validate>& operand) {
-    if (Complete(pc, operand)) {
+  inline bool Validate(const byte* pc, CallFunctionImmediate<validate>& imm) {
+    if (Complete(pc, imm)) {
       return true;
     }
-    errorf(pc + 1, "invalid function index: %u", operand.index);
+    errorf(pc + 1, "invalid function index: %u", imm.index);
     return false;
   }
 
-  inline bool Complete(const byte* pc, CallIndirectOperand<validate>& operand) {
+  inline bool Complete(const byte* pc, CallIndirectImmediate<validate>& imm) {
     if (!VALIDATE(module_ != nullptr &&
-                  operand.sig_index < module_->signatures.size())) {
+                  imm.sig_index < module_->signatures.size())) {
       return false;
     }
-    operand.sig = module_->signatures[operand.sig_index];
+    imm.sig = module_->signatures[imm.sig_index];
     return true;
   }
 
-  inline bool Validate(const byte* pc, CallIndirectOperand<validate>& operand) {
-    if (!VALIDATE(module_ != nullptr && !module_->function_tables.empty())) {
+  inline bool Validate(const byte* pc, CallIndirectImmediate<validate>& imm) {
+    if (!VALIDATE(module_ != nullptr && !module_->tables.empty())) {
       error("function table has to exist to execute call_indirect");
       return false;
     }
-    if (!Complete(pc, operand)) {
-      errorf(pc + 1, "invalid signature index: #%u", operand.sig_index);
+    if (!Complete(pc, imm)) {
+      errorf(pc + 1, "invalid signature index: #%u", imm.sig_index);
       return false;
     }
     return true;
   }
 
-  inline bool Validate(const byte* pc, BreakDepthOperand<validate>& operand,
+  inline bool Validate(const byte* pc, BreakDepthImmediate<validate>& imm,
                        size_t control_depth) {
-    if (!VALIDATE(operand.depth < control_depth)) {
-      errorf(pc + 1, "invalid break depth: %u", operand.depth);
+    if (!VALIDATE(imm.depth < control_depth)) {
+      errorf(pc + 1, "invalid break depth: %u", imm.depth);
       return false;
     }
     return true;
   }
 
-  bool Validate(const byte* pc, BranchTableOperand<validate>& operand,
+  bool Validate(const byte* pc, BranchTableImmediate<validate>& imm,
                 size_t block_depth) {
-    if (!VALIDATE(operand.table_count < kV8MaxWasmFunctionSize)) {
+    if (!VALIDATE(imm.table_count < kV8MaxWasmFunctionSize)) {
       errorf(pc + 1, "invalid table count (> max function size): %u",
-             operand.table_count);
+             imm.table_count);
       return false;
     }
-    return checkAvailable(operand.table_count);
+    return checkAvailable(imm.table_count);
   }
 
   inline bool Validate(const byte* pc, WasmOpcode opcode,
-                       SimdLaneOperand<validate>& operand) {
+                       SimdLaneImmediate<validate>& imm) {
     uint8_t num_lanes = 0;
     switch (opcode) {
       case kExprF32x4ExtractLane:
@@ -903,7 +901,7 @@ class WasmDecoder : public Decoder {
         UNREACHABLE();
         break;
     }
-    if (!VALIDATE(operand.lane >= 0 && operand.lane < num_lanes)) {
+    if (!VALIDATE(imm.lane >= 0 && imm.lane < num_lanes)) {
       error(pc_ + 2, "invalid lane index");
       return false;
     } else {
@@ -912,7 +910,7 @@ class WasmDecoder : public Decoder {
   }
 
   inline bool Validate(const byte* pc, WasmOpcode opcode,
-                       SimdShiftOperand<validate>& operand) {
+                       SimdShiftImmediate<validate>& imm) {
     uint8_t max_shift = 0;
     switch (opcode) {
       case kExprI32x4Shl:
@@ -934,7 +932,7 @@ class WasmDecoder : public Decoder {
         UNREACHABLE();
         break;
     }
-    if (!VALIDATE(operand.shift >= 0 && operand.shift < max_shift)) {
+    if (!VALIDATE(imm.shift >= 0 && imm.shift < max_shift)) {
       error(pc_ + 2, "invalid shift amount");
       return false;
     } else {
@@ -943,10 +941,11 @@ class WasmDecoder : public Decoder {
   }
 
   inline bool Validate(const byte* pc,
-                       Simd8x16ShuffleOperand<validate>& operand) {
+                       Simd8x16ShuffleImmediate<validate>& imm) {
     uint8_t max_lane = 0;
-    for (uint32_t i = 0; i < kSimd128Size; ++i)
-      max_lane = std::max(max_lane, operand.shuffle[i]);
+    for (uint32_t i = 0; i < kSimd128Size; ++i) {
+      max_lane = std::max(max_lane, imm.shuffle[i]);
+    }
     // Shuffle indices must be in [0..31] for a 16 lane shuffle.
     if (!VALIDATE(max_lane <= 2 * kSimd128Size)) {
       error(pc_ + 2, "invalid shuffle mask");
@@ -955,6 +954,24 @@ class WasmDecoder : public Decoder {
     return true;
   }
 
+  inline bool Complete(BlockTypeImmediate<validate>& imm) {
+    if (imm.type != kWasmVar) return true;
+    if (!VALIDATE((module_ && imm.sig_index < module_->signatures.size()))) {
+      return false;
+    }
+    imm.sig = module_->signatures[imm.sig_index];
+    return true;
+  }
+
+  inline bool Validate(BlockTypeImmediate<validate>& imm) {
+    if (!Complete(imm)) {
+      errorf(pc_, "block type index %u out of bounds (%zu signatures)",
+             imm.sig_index, module_ ? module_->signatures.size() : 0);
+      return false;
+    }
+    return true;
+  }
+
   static unsigned OpcodeLength(Decoder* decoder, const byte* pc) {
     WasmOpcode opcode = static_cast<WasmOpcode>(*pc);
     switch (opcode) {
@@ -963,69 +980,69 @@ class WasmDecoder : public Decoder {
       FOREACH_STORE_MEM_OPCODE(DECLARE_OPCODE_CASE)
 #undef DECLARE_OPCODE_CASE
       {
-        MemoryAccessOperand<validate> operand(decoder, pc, UINT32_MAX);
-        return 1 + operand.length;
+        MemoryAccessImmediate<validate> imm(decoder, pc, UINT32_MAX);
+        return 1 + imm.length;
       }
       case kExprBr:
       case kExprBrIf: {
-        BreakDepthOperand<validate> operand(decoder, pc);
-        return 1 + operand.length;
+        BreakDepthImmediate<validate> imm(decoder, pc);
+        return 1 + imm.length;
       }
       case kExprSetGlobal:
       case kExprGetGlobal: {
-        GlobalIndexOperand<validate> operand(decoder, pc);
-        return 1 + operand.length;
+        GlobalIndexImmediate<validate> imm(decoder, pc);
+        return 1 + imm.length;
       }
 
       case kExprCallFunction: {
-        CallFunctionOperand<validate> operand(decoder, pc);
-        return 1 + operand.length;
+        CallFunctionImmediate<validate> imm(decoder, pc);
+        return 1 + imm.length;
       }
       case kExprCallIndirect: {
-        CallIndirectOperand<validate> operand(decoder, pc);
-        return 1 + operand.length;
+        CallIndirectImmediate<validate> imm(decoder, pc);
+        return 1 + imm.length;
       }
 
       case kExprTry:
       case kExprIf:  // fall through
       case kExprLoop:
       case kExprBlock: {
-        BlockTypeOperand<validate> operand(decoder, pc);
-        return 1 + operand.length;
+        BlockTypeImmediate<validate> imm(decoder, pc);
+        return 1 + imm.length;
       }
 
       case kExprThrow:
       case kExprCatch: {
-        ExceptionIndexOperand<validate> operand(decoder, pc);
-        return 1 + operand.length;
+        ExceptionIndexImmediate<validate> imm(decoder, pc);
+        return 1 + imm.length;
       }
 
       case kExprSetLocal:
       case kExprTeeLocal:
       case kExprGetLocal: {
-        LocalIndexOperand<Decoder::kValidate> operand(decoder, pc);
-        return 1 + operand.length;
+        LocalIndexImmediate<Decoder::kValidate> imm(decoder, pc);
+        return 1 + imm.length;
       }
       case kExprBrTable: {
-        BranchTableOperand<validate> operand(decoder, pc);
-        BranchTableIterator<validate> iterator(decoder, operand);
+        BranchTableImmediate<validate> imm(decoder, pc);
+        BranchTableIterator<validate> iterator(decoder, imm);
         return 1 + iterator.length();
       }
       case kExprI32Const: {
-        ImmI32Operand<validate> operand(decoder, pc);
-        return 1 + operand.length;
+        ImmI32Immediate<validate> imm(decoder, pc);
+        return 1 + imm.length;
       }
       case kExprI64Const: {
-        ImmI64Operand<validate> operand(decoder, pc);
-        return 1 + operand.length;
+        ImmI64Immediate<validate> imm(decoder, pc);
+        return 1 + imm.length;
       }
       case kExprRefNull: {
         return 1;
       }
       case kExprGrowMemory:
       case kExprMemorySize: {
-        MemoryIndexOperand<validate> operand(decoder, pc);
-        return 1 + operand.length;
+        MemoryIndexImmediate<validate> imm(decoder, pc);
+        return 1 + imm.length;
       }
       case kExprF32Const:
         return 5;
@@ -1050,8 +1067,8 @@ class WasmDecoder : public Decoder {
           FOREACH_SIMD_MEM_OPCODE(DECLARE_OPCODE_CASE)
 #undef DECLARE_OPCODE_CASE
           {
-            MemoryAccessOperand<validate> operand(decoder, pc + 1, UINT32_MAX);
-            return 2 + operand.length;
+            MemoryAccessImmediate<validate> imm(decoder, pc + 1, UINT32_MAX);
+            return 2 + imm.length;
           }
           // Shuffles require a byte per lane, or 16 immediate bytes.
           case kExprS8x16Shuffle:
@@ -1070,8 +1087,8 @@ class WasmDecoder : public Decoder {
           FOREACH_ATOMIC_OPCODE(DECLARE_OPCODE_CASE)
 #undef DECLARE_OPCODE_CASE
           {
-            MemoryAccessOperand<validate> operand(decoder, pc + 1, UINT32_MAX);
-            return 2 + operand.length;
+            MemoryAccessImmediate<validate> imm(decoder, pc + 1, UINT32_MAX);
+            return 2 + imm.length;
           }
           default:
             decoder->error(pc, "invalid Atomics opcode");
@@ -1118,16 +1135,16 @@ class WasmDecoder : public Decoder {
       case kExprMemorySize:
         return {0, 1};
       case kExprCallFunction: {
-        CallFunctionOperand<validate> operand(this, pc);
-        CHECK(Complete(pc, operand));
-        return {operand.sig->parameter_count(), operand.sig->return_count()};
+        CallFunctionImmediate<validate> imm(this, pc);
+        CHECK(Complete(pc, imm));
+        return {imm.sig->parameter_count(), imm.sig->return_count()};
       }
       case kExprCallIndirect: {
-        CallIndirectOperand<validate> operand(this, pc);
-        CHECK(Complete(pc, operand));
+        CallIndirectImmediate<validate> imm(this, pc);
+        CHECK(Complete(pc, imm));
         // Indirect calls pop an additional argument for the table index.
-        return {operand.sig->parameter_count() + 1,
-                operand.sig->return_count()};
+        return {imm.sig->parameter_count() + 1,
+                imm.sig->return_count()};
       }
       case kExprBr:
       case kExprBlock:
@@ -1143,11 +1160,11 @@ class WasmDecoder : public Decoder {
       case kSimdPrefix: {
         opcode = static_cast<WasmOpcode>(opcode << 8 | *(pc + 1));
         switch (opcode) {
-          case kExprI32AtomicStore:
-          case kExprI32AtomicStore8U:
-          case kExprI32AtomicStore16U:
-          case kExprS128StoreMem:
-            return {2, 0};
+          FOREACH_SIMD_1_OPERAND_1_PARAM_OPCODE(DECLARE_OPCODE_CASE)
+            return {1, 1};
+          FOREACH_SIMD_1_OPERAND_2_PARAM_OPCODE(DECLARE_OPCODE_CASE)
+          FOREACH_SIMD_MASK_OPERAND_OPCODE(DECLARE_OPCODE_CASE)
+            return {2, 1};
           default: {
             sig = WasmOpcodes::Signature(opcode);
             if (sig) {
@@ -1168,19 +1185,20 @@ class WasmDecoder : public Decoder {
 };
 
 #define CALL_INTERFACE(name, ...) interface_.name(this, ##__VA_ARGS__)
-#define CALL_INTERFACE_IF_REACHABLE(name, ...)       \
-  do {                                               \
-    DCHECK(!control_.empty());                       \
-    if (this->ok() && control_.back().reachable()) { \
-      interface_.name(this, ##__VA_ARGS__);          \
-    }                                                \
+#define CALL_INTERFACE_IF_REACHABLE(name, ...)                 \
+  do {                                                         \
+    DCHECK(!control_.empty());                                 \
+    if (VALIDATE(this->ok()) && control_.back().reachable()) { \
+      interface_.name(this, ##__VA_ARGS__);                    \
+    }                                                          \
   } while (false)
-#define CALL_INTERFACE_IF_PARENT_REACHABLE(name, ...)                         \
-  do {                                                                        \
-    DCHECK(!control_.empty());                                                \
-    if (this->ok() && (control_.size() == 1 || control_at(1)->reachable())) { \
-      interface_.name(this, ##__VA_ARGS__);                                   \
-    }                                                                         \
+#define CALL_INTERFACE_IF_PARENT_REACHABLE(name, ...)           \
+  do {                                                          \
+    DCHECK(!control_.empty());                                  \
+    if (VALIDATE(this->ok()) &&                                 \
+        (control_.size() == 1 || control_at(1)->reachable())) { \
+      interface_.name(this, ##__VA_ARGS__);                     \
+    }                                                           \
   } while (false)
 
 template <Decoder::ValidateFlag validate, typename Interface>
@@ -1251,9 +1269,10 @@ class WasmFullDecoder : public WasmDecoder<validate> {
 
     if (FLAG_trace_wasm_decode_time) {
       double ms = decode_timer.Elapsed().InMillisecondsF();
-      PrintF("wasm-decode %s (%0.3f ms)\n\n", this->ok() ? "ok" : "failed", ms);
+      PrintF("wasm-decode %s (%0.3f ms)\n\n",
+             VALIDATE(this->ok()) ? "ok" : "failed", ms);
     } else {
-      TRACE("wasm-decode %s\n\n", this->ok() ? "ok" : "failed");
+      TRACE("wasm-decode %s\n\n", VALIDATE(this->ok()) ? "ok" : "failed");
     }
 
     return true;
@@ -1404,7 +1423,7 @@ class WasmFullDecoder : public WasmDecoder<validate> {
 #define TRACE_PART(...)
 #endif
 
-      FunctionSig* sig = WasmOpcodes::Signature(opcode);
+      FunctionSig* sig = const_cast<FunctionSig*>(kSimpleOpcodeSigs[opcode]);
       if (sig) {
         BuildSimpleOperator(opcode, sig);
       } else {
@@ -1413,14 +1432,14 @@ class WasmFullDecoder : public WasmDecoder<validate> {
           case kExprNop:
             break;
           case kExprBlock: {
-            BlockTypeOperand<validate> operand(this, this->pc_);
-            if (!LookupBlockType(&operand)) break;
-            PopArgs(operand.sig);
+            BlockTypeImmediate<validate> imm(this, this->pc_);
+            if (!this->Validate(imm)) break;
+            PopArgs(imm.sig);
             auto* block = PushBlock();
-            SetBlockType(block, operand);
+            SetBlockType(block, imm);
             CALL_INTERFACE_IF_REACHABLE(Block, block);
             PushMergeValues(block, &block->start_merge);
-            len = 1 + operand.length;
+            len = 1 + imm.length;
             break;
           }
           case kExprRethrow: {
@@ -1431,23 +1450,23 @@ class WasmFullDecoder : public WasmDecoder<validate> {
           }
           case kExprThrow: {
             CHECK_PROTOTYPE_OPCODE(eh);
-            ExceptionIndexOperand<Decoder::kValidate> operand(this, this->pc_);
-            len = 1 + operand.length;
-            if (!this->Validate(this->pc_, operand)) break;
-            PopArgs(operand.exception->ToFunctionSig());
-            CALL_INTERFACE_IF_REACHABLE(Throw, operand, &control_.back(),
+            ExceptionIndexImmediate<Decoder::kValidate> imm(this, this->pc_);
+            len = 1 + imm.length;
+            if (!this->Validate(this->pc_, imm)) break;
+            PopArgs(imm.exception->ToFunctionSig());
+            CALL_INTERFACE_IF_REACHABLE(Throw, imm, &control_.back(),
                                         vec2vec(args_));
             EndControl();
             break;
           }
           case kExprTry: {
             CHECK_PROTOTYPE_OPCODE(eh);
-            BlockTypeOperand<validate> operand(this, this->pc_);
-            if (!LookupBlockType(&operand)) break;
-            PopArgs(operand.sig);
+            BlockTypeImmediate<validate> imm(this, this->pc_);
+            if (!this->Validate(imm)) break;
+            PopArgs(imm.sig);
             auto* try_block = PushTry();
-            SetBlockType(try_block, operand);
-            len = 1 + operand.length;
+            SetBlockType(try_block, imm);
+            len = 1 + imm.length;
             CALL_INTERFACE_IF_REACHABLE(Try, try_block);
             PushMergeValues(try_block, &try_block->start_merge);
             break;
@@ -1455,10 +1474,10 @@ class WasmFullDecoder : public WasmDecoder<validate> {
           case kExprCatch: {
             // TODO(kschimpf): Fix to use type signature of exception.
             CHECK_PROTOTYPE_OPCODE(eh);
-            ExceptionIndexOperand<Decoder::kValidate> operand(this, this->pc_);
-            len = 1 + operand.length;
+            ExceptionIndexImmediate<Decoder::kValidate> imm(this, this->pc_);
+            len = 1 + imm.length;
 
-            if (!this->Validate(this->pc_, operand)) break;
+            if (!this->Validate(this->pc_, imm)) break;
 
             if (!VALIDATE(!control_.empty())) {
               this->error("catch does not match any try");
@@ -1478,14 +1497,13 @@ class WasmFullDecoder : public WasmDecoder<validate> {
             c->kind = kControlTryCatch;
             FallThruTo(c);
             stack_.resize(c->stack_depth);
-            const WasmExceptionSig* sig = operand.exception->sig;
+            const WasmExceptionSig* sig = imm.exception->sig;
             for (size_t i = 0, e = sig->parameter_count(); i < e; ++i) {
               Push(sig->GetParam(i));
             }
             Vector<Value> values(stack_.data() + c->stack_depth,
                                  sig->parameter_count());
-            CALL_INTERFACE_IF_PARENT_REACHABLE(CatchException, operand, c,
-                                               values);
+            CALL_INTERFACE_IF_PARENT_REACHABLE(CatchException, imm, c, values);
             c->reachability = control_at(1)->innerReachability();
             break;
           }
@@ -1496,26 +1514,26 @@ class WasmFullDecoder : public WasmDecoder<validate> {
             break;
           }
           case kExprLoop: {
-            BlockTypeOperand<validate> operand(this, this->pc_);
-            if (!LookupBlockType(&operand)) break;
-            PopArgs(operand.sig);
+            BlockTypeImmediate<validate> imm(this, this->pc_);
+            if (!this->Validate(imm)) break;
+            PopArgs(imm.sig);
             auto* block = PushLoop();
-            SetBlockType(&control_.back(), operand);
-            len = 1 + operand.length;
+            SetBlockType(&control_.back(), imm);
+            len = 1 + imm.length;
             CALL_INTERFACE_IF_REACHABLE(Loop, block);
             PushMergeValues(block, &block->start_merge);
             break;
           }
           case kExprIf: {
-            BlockTypeOperand<validate> operand(this, this->pc_);
-            if (!LookupBlockType(&operand)) break;
+            BlockTypeImmediate<validate> imm(this, this->pc_);
+            if (!this->Validate(imm)) break;
             auto cond = Pop(0, kWasmI32);
-            PopArgs(operand.sig);
-            if (!this->ok()) break;
+            PopArgs(imm.sig);
+            if (!VALIDATE(this->ok())) break;
             auto* if_block = PushIf();
-            SetBlockType(if_block, operand);
+            SetBlockType(if_block, imm);
             CALL_INTERFACE_IF_REACHABLE(If, cond, if_block);
-            len = 1 + operand.length;
+            len = 1 + imm.length;
             PushMergeValues(if_block, &if_block->start_merge);
             break;
           }
@@ -1588,38 +1606,38 @@ class WasmFullDecoder : public WasmDecoder<validate> {
             break;
           }
           case kExprBr: {
-            BreakDepthOperand<validate> operand(this, this->pc_);
-            if (!this->Validate(this->pc_, operand, control_.size())) break;
-            Control* c = control_at(operand.depth);
+            BreakDepthImmediate<validate> imm(this, this->pc_);
+            if (!this->Validate(this->pc_, imm, control_.size())) break;
+            Control* c = control_at(imm.depth);
             if (!TypeCheckBreak(c)) break;
             if (control_.back().reachable()) {
               CALL_INTERFACE(Br, c);
               c->br_merge()->reached = true;
             }
-            len = 1 + operand.length;
+            len = 1 + imm.length;
             EndControl();
             break;
           }
           case kExprBrIf: {
-            BreakDepthOperand<validate> operand(this, this->pc_);
+            BreakDepthImmediate<validate> imm(this, this->pc_);
             auto cond = Pop(0, kWasmI32);
             if (this->failed()) break;
-            if (!this->Validate(this->pc_, operand, control_.size())) break;
-            Control* c = control_at(operand.depth);
+            if (!this->Validate(this->pc_, imm, control_.size())) break;
+            Control* c = control_at(imm.depth);
             if (!TypeCheckBreak(c)) break;
             if (control_.back().reachable()) {
               CALL_INTERFACE(BrIf, cond, c);
               c->br_merge()->reached = true;
             }
-            len = 1 + operand.length;
+            len = 1 + imm.length;
             break;
           }
           case kExprBrTable: {
-            BranchTableOperand<validate> operand(this, this->pc_);
-            BranchTableIterator<validate> iterator(this, operand);
+            BranchTableImmediate<validate> imm(this, this->pc_);
+            BranchTableIterator<validate> iterator(this, imm);
             auto key = Pop(0, kWasmI32);
             if (this->failed()) break;
-            if (!this->Validate(this->pc_, operand, control_.size())) break;
+            if (!this->Validate(this->pc_, imm, control_.size())) break;
             uint32_t br_arity = 0;
             std::vector<bool> br_targets(control_.size());
             while (iterator.has_next()) {
@@ -1651,7 +1669,7 @@ class WasmFullDecoder : public WasmDecoder<validate> {
             if (this->failed()) break;
 
             if (control_.back().reachable()) {
-              CALL_INTERFACE(BrTable, operand, key);
+              CALL_INTERFACE(BrTable, imm, key);
 
               for (uint32_t depth = control_depth(); depth-- > 0;) {
                 if (!br_targets[depth]) continue;
@@ -1673,31 +1691,31 @@ class WasmFullDecoder : public WasmDecoder<validate> {
             break;
           }
           case kExprI32Const: {
-            ImmI32Operand<validate> operand(this, this->pc_);
+            ImmI32Immediate<validate> imm(this, this->pc_);
             auto* value = Push(kWasmI32);
-            CALL_INTERFACE_IF_REACHABLE(I32Const, value, operand.value);
-            len = 1 + operand.length;
+            CALL_INTERFACE_IF_REACHABLE(I32Const, value, imm.value);
+            len = 1 + imm.length;
             break;
           }
           case kExprI64Const: {
-            ImmI64Operand<validate> operand(this, this->pc_);
+            ImmI64Immediate<validate> imm(this, this->pc_);
             auto* value = Push(kWasmI64);
-            CALL_INTERFACE_IF_REACHABLE(I64Const, value, operand.value);
-            len = 1 + operand.length;
+            CALL_INTERFACE_IF_REACHABLE(I64Const, value, imm.value);
+            len = 1 + imm.length;
             break;
           }
           case kExprF32Const: {
-            ImmF32Operand<validate> operand(this, this->pc_);
+            ImmF32Immediate<validate> imm(this, this->pc_);
             auto* value = Push(kWasmF32);
-            CALL_INTERFACE_IF_REACHABLE(F32Const, value, operand.value);
-            len = 1 + operand.length;
+            CALL_INTERFACE_IF_REACHABLE(F32Const, value, imm.value);
+            len = 1 + imm.length;
             break;
           }
           case kExprF64Const: {
-            ImmF64Operand<validate> operand(this, this->pc_);
+            ImmF64Immediate<validate> imm(this, this->pc_);
             auto* value = Push(kWasmF64);
-            CALL_INTERFACE_IF_REACHABLE(F64Const, value, operand.value);
-            len = 1 + operand.length;
+            CALL_INTERFACE_IF_REACHABLE(F64Const, value, imm.value);
+            len = 1 + imm.length;
             break;
           }
           case kExprRefNull: {
@@ -1708,28 +1726,28 @@ class WasmFullDecoder : public WasmDecoder<validate> {
             break;
           }
           case kExprGetLocal: {
-            LocalIndexOperand<Decoder::kValidate> operand(this, this->pc_);
-            if (!this->Validate(this->pc_, operand)) break;
-            auto* value = Push(operand.type);
-            CALL_INTERFACE_IF_REACHABLE(GetLocal, value, operand);
-            len = 1 + operand.length;
+            LocalIndexImmediate<Decoder::kValidate> imm(this, this->pc_);
+            if (!this->Validate(this->pc_, imm)) break;
+            auto* value = Push(imm.type);
+            CALL_INTERFACE_IF_REACHABLE(GetLocal, value, imm);
+            len = 1 + imm.length;
             break;
           }
           case kExprSetLocal: {
-            LocalIndexOperand<Decoder::kValidate> operand(this, this->pc_);
-            if (!this->Validate(this->pc_, operand)) break;
-            auto value = Pop(0, local_type_vec_[operand.index]);
-            CALL_INTERFACE_IF_REACHABLE(SetLocal, value, operand);
-            len = 1 + operand.length;
+            LocalIndexImmediate<Decoder::kValidate> imm(this, this->pc_);
+            if (!this->Validate(this->pc_, imm)) break;
+            auto value = Pop(0, local_type_vec_[imm.index]);
+            CALL_INTERFACE_IF_REACHABLE(SetLocal, value, imm);
+            len = 1 + imm.length;
             break;
           }
           case kExprTeeLocal: {
-            LocalIndexOperand<Decoder::kValidate> operand(this, this->pc_);
-            if (!this->Validate(this->pc_, operand)) break;
-            auto value = Pop(0, local_type_vec_[operand.index]);
+            LocalIndexImmediate<Decoder::kValidate> imm(this, this->pc_);
+            if (!this->Validate(this->pc_, imm)) break;
+            auto value = Pop(0, local_type_vec_[imm.index]);
             auto* result = Push(value.type);
-            CALL_INTERFACE_IF_REACHABLE(TeeLocal, value, result, operand);
-            len = 1 + operand.length;
+            CALL_INTERFACE_IF_REACHABLE(TeeLocal, value, result, imm);
+            len = 1 + imm.length;
             break;
           }
           case kExprDrop: {
@@ -1738,24 +1756,24 @@ class WasmFullDecoder : public WasmDecoder<validate> {
             break;
           }
           case kExprGetGlobal: {
-            GlobalIndexOperand<validate> operand(this, this->pc_);
-            len = 1 + operand.length;
-            if (!this->Validate(this->pc_, operand)) break;
-            auto* result = Push(operand.type);
-            CALL_INTERFACE_IF_REACHABLE(GetGlobal, result, operand);
+            GlobalIndexImmediate<validate> imm(this, this->pc_);
+            len = 1 + imm.length;
+            if (!this->Validate(this->pc_, imm)) break;
+            auto* result = Push(imm.type);
+            CALL_INTERFACE_IF_REACHABLE(GetGlobal, result, imm);
             break;
           }
           case kExprSetGlobal: {
-            GlobalIndexOperand<validate> operand(this, this->pc_);
-            len = 1 + operand.length;
-            if (!this->Validate(this->pc_, operand)) break;
-            if (!VALIDATE(operand.global->mutability)) {
+            GlobalIndexImmediate<validate> imm(this, this->pc_);
+            len = 1 + imm.length;
+            if (!this->Validate(this->pc_, imm)) break;
+            if (!VALIDATE(imm.global->mutability)) {
               this->errorf(this->pc_, "immutable global #%u cannot be assigned",
-                           operand.index);
+                           imm.index);
               break;
             }
-            auto value = Pop(0, operand.type);
-            CALL_INTERFACE_IF_REACHABLE(SetGlobal, value, operand);
+            auto value = Pop(0, imm.type);
+            CALL_INTERFACE_IF_REACHABLE(SetGlobal, value, imm);
             break;
           }
           case kExprI32LoadMem8S:
@@ -1829,10 +1847,10 @@ class WasmFullDecoder : public WasmDecoder<validate> {
             break;
           case kExprGrowMemory: {
             if (!CheckHasMemory()) break;
-            MemoryIndexOperand<validate> operand(this, this->pc_);
-            len = 1 + operand.length;
+            MemoryIndexImmediate<validate> imm(this, this->pc_);
+            len = 1 + imm.length;
             DCHECK_NOT_NULL(this->module_);
-            if (!VALIDATE(this->module_->is_wasm())) {
+            if (!VALIDATE(this->module_->origin == kWasmOrigin)) {
               this->error("grow_memory is not supported for asmjs modules");
               break;
             }
@@ -1843,32 +1861,31 @@ class WasmFullDecoder : public WasmDecoder<validate> {
           }
           case kExprMemorySize: {
             if (!CheckHasMemory()) break;
-            MemoryIndexOperand<validate> operand(this, this->pc_);
+            MemoryIndexImmediate<validate> imm(this, this->pc_);
             auto* result = Push(kWasmI32);
-            len = 1 + operand.length;
+            len = 1 + imm.length;
             CALL_INTERFACE_IF_REACHABLE(CurrentMemoryPages, result);
             break;
           }
           case kExprCallFunction: {
-            CallFunctionOperand<validate> operand(this, this->pc_);
-            len = 1 + operand.length;
-            if (!this->Validate(this->pc_, operand)) break;
+            CallFunctionImmediate<validate> imm(this, this->pc_);
+            len = 1 + imm.length;
+            if (!this->Validate(this->pc_, imm)) break;
             // TODO(clemensh): Better memory management.
-            PopArgs(operand.sig);
-            auto* returns = PushReturns(operand.sig);
-            CALL_INTERFACE_IF_REACHABLE(CallDirect, operand, args_.data(),
-                                        returns);
+            PopArgs(imm.sig);
+            auto* returns = PushReturns(imm.sig);
+            CALL_INTERFACE_IF_REACHABLE(CallDirect, imm, args_.data(), returns);
             break;
           }
           case kExprCallIndirect: {
-            CallIndirectOperand<validate> operand(this, this->pc_);
-            len = 1 + operand.length;
-            if (!this->Validate(this->pc_, operand)) break;
+            CallIndirectImmediate<validate> imm(this, this->pc_);
+            len = 1 + imm.length;
+            if (!this->Validate(this->pc_, imm)) break;
             auto index = Pop(0, kWasmI32);
-            PopArgs(operand.sig);
-            auto* returns = PushReturns(operand.sig);
-            CALL_INTERFACE_IF_REACHABLE(CallIndirect, index, operand,
-                                        args_.data(), returns);
+            PopArgs(imm.sig);
+            auto* returns = PushReturns(imm.sig);
+            CALL_INTERFACE_IF_REACHABLE(CallIndirect, index, imm, args_.data(),
+                                        returns);
             break;
           }
           case kNumericPrefix: {
@@ -1911,9 +1928,18 @@ class WasmFullDecoder : public WasmDecoder<validate> {
             len += DecodeAtomicOpcode(opcode);
             break;
           }
+// Note that prototype opcodes are not handled in the fastpath
+// above this switch, to avoid checking a feature flag.
+#define SIMPLE_PROTOTYPE_CASE(name, opc, sig) \
+  case kExpr##name: /* fallthrough */
+            FOREACH_SIMPLE_PROTOTYPE_OPCODE(SIMPLE_PROTOTYPE_CASE)
+#undef SIMPLE_PROTOTYPE_CASE
+            BuildSimplePrototypeOperator(opcode);
+            break;
           default: {
             // Deal with special asmjs opcodes.
-            if (this->module_ != nullptr && this->module_->is_asm_js()) {
+            if (this->module_ != nullptr &&
+                this->module_->origin == kAsmJsOrigin) {
               sig = WasmOpcodes::AsmjsSignature(opcode);
               if (sig) {
                 BuildSimpleOperator(opcode, sig);
@@ -1957,29 +1983,29 @@ class WasmFullDecoder : public WasmDecoder<validate> {
           if (WasmOpcodes::IsPrefixOpcode(opcode)) {
             opcode = static_cast<WasmOpcode>(opcode << 8 | *(val.pc + 1));
           }
-          TRACE_PART(" %c@%d:%s", WasmOpcodes::ShortNameOf(val.type),
+          TRACE_PART(" %c@%d:%s", ValueTypes::ShortNameOf(val.type),
                      static_cast<int>(val.pc - this->start_),
                      WasmOpcodes::OpcodeName(opcode));
-          // If the decoder failed, don't try to decode the operands, as this
+          // If the decoder failed, don't try to decode the immediates, as this
           // can trigger a DCHECK failure.
           if (this->failed()) continue;
           switch (opcode) {
             case kExprI32Const: {
-              ImmI32Operand<Decoder::kNoValidate> operand(this, val.pc);
-              TRACE_PART("[%d]", operand.value);
+              ImmI32Immediate<Decoder::kNoValidate> imm(this, val.pc);
+              TRACE_PART("[%d]", imm.value);
               break;
             }
             case kExprGetLocal:
             case kExprSetLocal:
             case kExprTeeLocal: {
-              LocalIndexOperand<Decoder::kNoValidate> operand(this, val.pc);
-              TRACE_PART("[%u]", operand.index);
+              LocalIndexImmediate<Decoder::kNoValidate> imm(this, val.pc);
+              TRACE_PART("[%u]", imm.index);
               break;
             }
             case kExprGetGlobal:
             case kExprSetGlobal: {
-              GlobalIndexOperand<Decoder::kNoValidate> operand(this, val.pc);
-              TRACE_PART("[%u]", operand.index);
+              GlobalIndexImmediate<Decoder::kNoValidate> imm(this, val.pc);
+              TRACE_PART("[%u]", imm.index);
               break;
             }
             default:
@@ -1990,7 +2016,9 @@ class WasmFullDecoder : public WasmDecoder<validate> {
 #endif
       this->pc_ += len;
     }  // end decode loop
-    if (this->pc_ > this->end_ && this->ok()) this->error("Beyond end of code");
+    if (!VALIDATE(this->pc_ == this->end_) && this->ok()) {
+      this->error("Beyond end of code");
+    }
   }
 
   void EndControl() {
@@ -2001,22 +2029,6 @@ class WasmFullDecoder : public WasmDecoder<validate> {
     current->reachability = kUnreachable;
   }
 
-  bool LookupBlockType(BlockTypeOperand<validate>* operand) {
-    if (operand->type == kWasmVar) {
-      if (!VALIDATE(this->module_ &&
-                    operand->sig_index < this->module_->signatures.size())) {
-        this->errorf(
-            this->pc_, "block type index %u out of bounds (%d signatures)",
-            operand->sig_index,
-            static_cast<int>(this->module_
-                                 ? this->module_->signatures.size() : 0));
-        return false;
-      }
-      operand->sig = this->module_->signatures[operand->sig_index];
-    }
-    return true;
-  }
-
   template<typename func>
   void InitMerge(Merge<Value>* merge, uint32_t arity, func get_val) {
     merge->arity = arity;
@@ -2030,14 +2042,14 @@ class WasmFullDecoder : public WasmDecoder<validate> {
     }
   }
 
-  void SetBlockType(Control* c, BlockTypeOperand<validate>& operand) {
-    DCHECK_EQ(operand.in_arity(), this->args_.size());
+  void SetBlockType(Control* c, BlockTypeImmediate<validate>& imm) {
+    DCHECK_EQ(imm.in_arity(), this->args_.size());
     const byte* pc = this->pc_;
     Value* args = this->args_.data();
-    InitMerge(&c->end_merge, operand.out_arity(), [pc, &operand](uint32_t i) {
-      return Value::New(pc, operand.out_type(i));
+    InitMerge(&c->end_merge, imm.out_arity(), [pc, &imm](uint32_t i) {
+      return Value::New(pc, imm.out_type(i));
     });
-    InitMerge(&c->start_merge, operand.in_arity(),
+    InitMerge(&c->start_merge, imm.in_arity(),
               [args](uint32_t i) { return args[i]; });
   }
 
@@ -2093,65 +2105,65 @@ class WasmFullDecoder : public WasmDecoder<validate> {
 
   int DecodeLoadMem(LoadType type, int prefix_len = 0) {
     if (!CheckHasMemory()) return 0;
-    MemoryAccessOperand<validate> operand(this, this->pc_ + prefix_len,
-                                          type.size_log_2());
+    MemoryAccessImmediate<validate> imm(this, this->pc_ + prefix_len,
+                                        type.size_log_2());
     auto index = Pop(0, kWasmI32);
     auto* result = Push(type.value_type());
-    CALL_INTERFACE_IF_REACHABLE(LoadMem, type, operand, index, result);
-    return operand.length;
+    CALL_INTERFACE_IF_REACHABLE(LoadMem, type, imm, index, result);
+    return imm.length;
   }
 
   int DecodeStoreMem(StoreType store, int prefix_len = 0) {
     if (!CheckHasMemory()) return 0;
-    MemoryAccessOperand<validate> operand(this, this->pc_ + prefix_len,
-                                          store.size_log_2());
+    MemoryAccessImmediate<validate> imm(this, this->pc_ + prefix_len,
+                                        store.size_log_2());
     auto value = Pop(1, store.value_type());
     auto index = Pop(0, kWasmI32);
-    CALL_INTERFACE_IF_REACHABLE(StoreMem, store, operand, index, value);
-    return operand.length;
+    CALL_INTERFACE_IF_REACHABLE(StoreMem, store, imm, index, value);
+    return imm.length;
   }
 
   unsigned SimdExtractLane(WasmOpcode opcode, ValueType type) {
-    SimdLaneOperand<validate> operand(this, this->pc_);
-    if (this->Validate(this->pc_, opcode, operand)) {
-      Value inputs[] = {Pop(0, ValueType::kSimd128)};
+    SimdLaneImmediate<validate> imm(this, this->pc_);
+    if (this->Validate(this->pc_, opcode, imm)) {
+      Value inputs[] = {Pop(0, kWasmS128)};
       auto* result = Push(type);
-      CALL_INTERFACE_IF_REACHABLE(SimdLaneOp, opcode, operand,
-                                  ArrayVector(inputs), result);
+      CALL_INTERFACE_IF_REACHABLE(SimdLaneOp, opcode, imm, ArrayVector(inputs),
+                                  result);
     }
-    return operand.length;
+    return imm.length;
   }
 
   unsigned SimdReplaceLane(WasmOpcode opcode, ValueType type) {
-    SimdLaneOperand<validate> operand(this, this->pc_);
-    if (this->Validate(this->pc_, opcode, operand)) {
+    SimdLaneImmediate<validate> imm(this, this->pc_);
+    if (this->Validate(this->pc_, opcode, imm)) {
       Value inputs[2];
       inputs[1] = Pop(1, type);
-      inputs[0] = Pop(0, ValueType::kSimd128);
-      auto* result = Push(ValueType::kSimd128);
-      CALL_INTERFACE_IF_REACHABLE(SimdLaneOp, opcode, operand,
-                                  ArrayVector(inputs), result);
+      inputs[0] = Pop(0, kWasmS128);
+      auto* result = Push(kWasmS128);
+      CALL_INTERFACE_IF_REACHABLE(SimdLaneOp, opcode, imm, ArrayVector(inputs),
+                                  result);
     }
-    return operand.length;
+    return imm.length;
   }
 
   unsigned SimdShiftOp(WasmOpcode opcode) {
-    SimdShiftOperand<validate> operand(this, this->pc_);
-    if (this->Validate(this->pc_, opcode, operand)) {
-      auto input = Pop(0, ValueType::kSimd128);
-      auto* result = Push(ValueType::kSimd128);
-      CALL_INTERFACE_IF_REACHABLE(SimdShiftOp, opcode, operand, input, result);
+    SimdShiftImmediate<validate> imm(this, this->pc_);
+    if (this->Validate(this->pc_, opcode, imm)) {
+      auto input = Pop(0, kWasmS128);
+      auto* result = Push(kWasmS128);
+      CALL_INTERFACE_IF_REACHABLE(SimdShiftOp, opcode, imm, input, result);
     }
-    return operand.length;
+    return imm.length;
   }
 
   unsigned Simd8x16ShuffleOp() {
-    Simd8x16ShuffleOperand<validate> operand(this, this->pc_);
-    if (this->Validate(this->pc_, operand)) {
-      auto input1 = Pop(1, ValueType::kSimd128);
-      auto input0 = Pop(0, ValueType::kSimd128);
-      auto* result = Push(ValueType::kSimd128);
-      CALL_INTERFACE_IF_REACHABLE(Simd8x16ShuffleOp, operand, input0, input1,
+    Simd8x16ShuffleImmediate<validate> imm(this, this->pc_);
+    if (this->Validate(this->pc_, imm)) {
+      auto input1 = Pop(1, kWasmS128);
+      auto input0 = Pop(0, kWasmS128);
+      auto* result = Push(kWasmS128);
+      CALL_INTERFACE_IF_REACHABLE(Simd8x16ShuffleOp, imm, input0, input1,
                                   result);
     }
     return 16;
@@ -2161,23 +2173,23 @@ class WasmFullDecoder : public WasmDecoder<validate> {
     unsigned len = 0;
     switch (opcode) {
       case kExprF32x4ExtractLane: {
-        len = SimdExtractLane(opcode, ValueType::kFloat32);
+        len = SimdExtractLane(opcode, kWasmF32);
         break;
       }
       case kExprI32x4ExtractLane:
       case kExprI16x8ExtractLane:
       case kExprI8x16ExtractLane: {
-        len = SimdExtractLane(opcode, ValueType::kWord32);
+        len = SimdExtractLane(opcode, kWasmI32);
         break;
       }
       case kExprF32x4ReplaceLane: {
-        len = SimdReplaceLane(opcode, ValueType::kFloat32);
+        len = SimdReplaceLane(opcode, kWasmF32);
         break;
       }
       case kExprI32x4ReplaceLane:
       case kExprI16x8ReplaceLane:
       case kExprI8x16ReplaceLane: {
-        len = SimdReplaceLane(opcode, ValueType::kWord32);
+        len = SimdReplaceLane(opcode, kWasmI32);
         break;
       }
       case kExprI32x4Shl:
@@ -2224,11 +2236,11 @@ class WasmFullDecoder : public WasmDecoder<validate> {
     if (sig != nullptr) {
       MachineType memtype;
       switch (opcode) {
-#define CASE_ATOMIC_STORE_OP(Name, Type)     \
-  case kExpr##Name: {                        \
-    memtype = MachineType::Type();           \
-    ret_type = MachineRepresentation::kNone; \
-    break;                                   \
+#define CASE_ATOMIC_STORE_OP(Name, Type) \
+  case kExpr##Name: {                    \
+    memtype = MachineType::Type();       \
+    ret_type = kWasmStmt;                \
+    break;                               \
   }
         ATOMIC_STORE_OP_LIST(CASE_ATOMIC_STORE_OP)
 #undef CASE_ATOMIC_OP
@@ -2244,14 +2256,12 @@ class WasmFullDecoder : public WasmDecoder<validate> {
           this->error("invalid atomic opcode");
           return 0;
       }
-      MemoryAccessOperand<validate> operand(
+      MemoryAccessImmediate<validate> imm(
           this, this->pc_ + 1, ElementSizeLog2Of(memtype.representation()));
-      len += operand.length;
+      len += imm.length;
       PopArgs(sig);
-      auto result = ret_type == MachineRepresentation::kNone
-                        ? nullptr
-                        : Push(GetReturnType(sig));
-      CALL_INTERFACE_IF_REACHABLE(AtomicOp, opcode, vec2vec(args_), operand,
+      auto result = ret_type == kWasmStmt ? nullptr : Push(GetReturnType(sig));
+      CALL_INTERFACE_IF_REACHABLE(AtomicOp, opcode, vec2vec(args_), imm,
                                   result);
     } else {
       this->error("invalid atomic opcode");
@@ -2311,8 +2321,8 @@ class WasmFullDecoder : public WasmDecoder<validate> {
                   expected == kWasmVar)) {
       this->errorf(val.pc, "%s[%d] expected type %s, found %s of type %s",
                    SafeOpcodeNameAt(this->pc_), index,
-                   WasmOpcodes::TypeName(expected), SafeOpcodeNameAt(val.pc),
-                   WasmOpcodes::TypeName(val.type));
+                   ValueTypes::TypeName(expected), SafeOpcodeNameAt(val.pc),
+                   ValueTypes::TypeName(val.type));
     }
     return val;
   }
@@ -2358,7 +2368,7 @@ class WasmFullDecoder : public WasmDecoder<validate> {
         if (!VALIDATE(val.type == kWasmVar)) {
           this->errorf(
               this->pc_, "type error in merge[%u] (expected %s, got %s)", i,
-              WasmOpcodes::TypeName(old.type), WasmOpcodes::TypeName(val.type));
+              ValueTypes::TypeName(old.type), ValueTypes::TypeName(val.type));
           return false;
         }
         val.type = old.type;
@@ -2425,14 +2435,18 @@ class WasmFullDecoder : public WasmDecoder<validate> {
     CALL_INTERFACE(OnFirstError);
   }
 
-  inline void BuildSimpleOperator(WasmOpcode opcode, FunctionSig* sig) {
+  void BuildSimplePrototypeOperator(WasmOpcode opcode) {
     if (WasmOpcodes::IsSignExtensionOpcode(opcode)) {
       RET_ON_PROTOTYPE_OPCODE(se);
     }
     if (WasmOpcodes::IsAnyRefOpcode(opcode)) {
       RET_ON_PROTOTYPE_OPCODE(anyref);
     }
+    FunctionSig* sig = WasmOpcodes::Signature(opcode);
+    BuildSimpleOperator(opcode, sig);
+  }
 
+  inline void BuildSimpleOperator(WasmOpcode opcode, FunctionSig* sig) {
     switch (sig->parameter_count()) {
       case 1: {
         auto val = Pop(0, sig->GetParam(0));
diff --git a/deps/v8/src/wasm/function-body-decoder.cc b/deps/v8/src/wasm/function-body-decoder.cc
index 7298ad97ae7b58..41398eba258e44 100644
--- a/deps/v8/src/wasm/function-body-decoder.cc
+++ b/deps/v8/src/wasm/function-body-decoder.cc
@@ -5,22 +5,19 @@
 #include "src/signature.h"
 
 #include "src/base/platform/elapsed-timer.h"
+#include "src/compiler/wasm-compiler.h"
 #include "src/flags.h"
 #include "src/handles.h"
 #include "src/objects-inl.h"
-#include "src/zone/zone-containers.h"
-
+#include "src/ostreams.h"
 #include "src/wasm/decoder.h"
 #include "src/wasm/function-body-decoder-impl.h"
 #include "src/wasm/function-body-decoder.h"
 #include "src/wasm/wasm-limits.h"
+#include "src/wasm/wasm-linkage.h"
 #include "src/wasm/wasm-module.h"
 #include "src/wasm/wasm-opcodes.h"
 
-#include "src/ostreams.h"
-
-#include "src/compiler/wasm-compiler.h"
-
 namespace v8 {
 namespace internal {
 namespace wasm {
@@ -74,9 +71,9 @@ class WasmGraphBuildingInterface {
 
   struct TryInfo : public ZoneObject {
     SsaEnv* catch_env;
-    TFNode* exception;
+    TFNode* exception = nullptr;
 
-    explicit TryInfo(SsaEnv* c) : catch_env(c), exception(nullptr) {}
+    explicit TryInfo(SsaEnv* c) : catch_env(c) {}
   };
 
   struct Control : public ControlWithNamedConstructors<Control, Value> {
@@ -105,7 +102,7 @@ class WasmGraphBuildingInterface {
         static_cast<int>(decoder->sig_->parameter_count() + 1 + 1));
     // Initialize the instance parameter (index 0).
     builder_->set_instance_node(
-        builder_->Param(compiler::kWasmInstanceParameterIndex));
+        builder_->Param(wasm::kWasmInstanceParameterIndex));
     // Initialize local variables. Parameters are shifted by 1 because of the
     // the instance parameter.
     uint32_t index = 0;
@@ -254,32 +251,32 @@ class WasmGraphBuildingInterface {
   }
 
   void GetLocal(Decoder* decoder, Value* result,
-                const LocalIndexOperand<validate>& operand) {
+                const LocalIndexImmediate<validate>& imm) {
     if (!ssa_env_->locals) return;  // unreachable
-    result->node = ssa_env_->locals[operand.index];
+    result->node = ssa_env_->locals[imm.index];
   }
 
   void SetLocal(Decoder* decoder, const Value& value,
-                const LocalIndexOperand<validate>& operand) {
+                const LocalIndexImmediate<validate>& imm) {
     if (!ssa_env_->locals) return;  // unreachable
-    ssa_env_->locals[operand.index] = value.node;
+    ssa_env_->locals[imm.index] = value.node;
   }
 
   void TeeLocal(Decoder* decoder, const Value& value, Value* result,
-                const LocalIndexOperand<validate>& operand) {
+                const LocalIndexImmediate<validate>& imm) {
     result->node = value.node;
     if (!ssa_env_->locals) return;  // unreachable
-    ssa_env_->locals[operand.index] = value.node;
+    ssa_env_->locals[imm.index] = value.node;
   }
 
   void GetGlobal(Decoder* decoder, Value* result,
-                 const GlobalIndexOperand<validate>& operand) {
-    result->node = BUILD(GetGlobal, operand.index);
+                 const GlobalIndexImmediate<validate>& imm) {
+    result->node = BUILD(GetGlobal, imm.index);
   }
 
   void SetGlobal(Decoder* decoder, const Value& value,
-                 const GlobalIndexOperand<validate>& operand) {
-    BUILD(SetGlobal, operand.index, value.node);
+                 const GlobalIndexImmediate<validate>& imm) {
+    BUILD(SetGlobal, imm.index, value.node);
   }
 
   void Unreachable(Decoder* decoder) {
@@ -311,28 +308,28 @@ class WasmGraphBuildingInterface {
     ssa_env_ = fenv;
   }
 
-  void BrTable(Decoder* decoder, const BranchTableOperand<validate>& operand,
+  void BrTable(Decoder* decoder, const BranchTableImmediate<validate>& imm,
                const Value& key) {
-    if (operand.table_count == 0) {
+    if (imm.table_count == 0) {
       // Only a default target. Do the equivalent of br.
-      uint32_t target = BranchTableIterator<validate>(decoder, operand).next();
+      uint32_t target = BranchTableIterator<validate>(decoder, imm).next();
       Br(decoder, decoder->control_at(target));
       return;
     }
 
     SsaEnv* break_env = ssa_env_;
     // Build branches to the various blocks based on the table.
-    TFNode* sw = BUILD(Switch, operand.table_count + 1, key.node);
+    TFNode* sw = BUILD(Switch, imm.table_count + 1, key.node);
 
     SsaEnv* copy = Steal(decoder->zone(), break_env);
     ssa_env_ = copy;
-    BranchTableIterator<validate> iterator(decoder, operand);
+    BranchTableIterator<validate> iterator(decoder, imm);
     while (iterator.has_next()) {
       uint32_t i = iterator.cur_index();
       uint32_t target = iterator.next();
       ssa_env_ = Split(decoder, copy);
-      ssa_env_->control = (i == operand.table_count) ? BUILD(IfDefault, sw)
-                                                     : BUILD(IfValue, i, sw);
+      ssa_env_->control =
+          (i == imm.table_count) ? BUILD(IfDefault, sw) : BUILD(IfValue, i, sw);
       Br(decoder, decoder->control_at(target));
     }
     DCHECK(decoder->ok());
@@ -344,19 +341,18 @@ class WasmGraphBuildingInterface {
   }
 
   void LoadMem(Decoder* decoder, LoadType type,
-               const MemoryAccessOperand<validate>& operand, const Value& index,
+               const MemoryAccessImmediate<validate>& imm, const Value& index,
                Value* result) {
     result->node =
         BUILD(LoadMem, type.value_type(), type.mem_type(), index.node,
-              operand.offset, operand.alignment, decoder->position());
+              imm.offset, imm.alignment, decoder->position());
   }
 
   void StoreMem(Decoder* decoder, StoreType type,
-                const MemoryAccessOperand<validate>& operand,
-                const Value& index, const Value& value) {
-    BUILD(StoreMem, type.mem_rep(), index.node, operand.offset,
-          operand.alignment, value.node, decoder->position(),
-          type.value_type());
+                const MemoryAccessImmediate<validate>& imm, const Value& index,
+                const Value& value) {
+    BUILD(StoreMem, type.mem_rep(), index.node, imm.offset, imm.alignment,
+          value.node, decoder->position(), type.value_type());
   }
 
   void CurrentMemoryPages(Decoder* decoder, Value* result) {
@@ -369,16 +365,15 @@ class WasmGraphBuildingInterface {
     LoadContextIntoSsa(ssa_env_);
   }
 
-  void CallDirect(Decoder* decoder,
-                  const CallFunctionOperand<validate>& operand,
+  void CallDirect(Decoder* decoder, const CallFunctionImmediate<validate>& imm,
                   const Value args[], Value returns[]) {
-    DoCall(decoder, nullptr, operand.sig, operand.index, args, returns);
+    DoCall(decoder, nullptr, imm.sig, imm.index, args, returns);
   }
 
   void CallIndirect(Decoder* decoder, const Value& index,
-                    const CallIndirectOperand<validate>& operand,
+                    const CallIndirectImmediate<validate>& imm,
                     const Value args[], Value returns[]) {
-    DoCall(decoder, index.node, operand.sig, operand.sig_index, args, returns);
+    DoCall(decoder, index.node, imm.sig, imm.sig_index, args, returns);
   }
 
   void SimdOp(Decoder* decoder, WasmOpcode opcode, Vector<Value> args,
@@ -389,48 +384,48 @@ class WasmGraphBuildingInterface {
   }
 
   void SimdLaneOp(Decoder* decoder, WasmOpcode opcode,
-                  const SimdLaneOperand<validate> operand, Vector<Value> inputs,
+                  const SimdLaneImmediate<validate> imm, Vector<Value> inputs,
                   Value* result) {
     TFNode** nodes = GetNodes(inputs);
-    result->node = BUILD(SimdLaneOp, opcode, operand.lane, nodes);
+    result->node = BUILD(SimdLaneOp, opcode, imm.lane, nodes);
   }
 
   void SimdShiftOp(Decoder* decoder, WasmOpcode opcode,
-                   const SimdShiftOperand<validate> operand, const Value& input,
+                   const SimdShiftImmediate<validate> imm, const Value& input,
                    Value* result) {
     TFNode* inputs[] = {input.node};
-    result->node = BUILD(SimdShiftOp, opcode, operand.shift, inputs);
+    result->node = BUILD(SimdShiftOp, opcode, imm.shift, inputs);
   }
 
   void Simd8x16ShuffleOp(Decoder* decoder,
-                         const Simd8x16ShuffleOperand<validate>& operand,
+                         const Simd8x16ShuffleImmediate<validate>& imm,
                          const Value& input0, const Value& input1,
                          Value* result) {
     TFNode* input_nodes[] = {input0.node, input1.node};
-    result->node = BUILD(Simd8x16ShuffleOp, operand.shuffle, input_nodes);
+    result->node = BUILD(Simd8x16ShuffleOp, imm.shuffle, input_nodes);
   }
 
   TFNode* GetExceptionTag(Decoder* decoder,
-                          const ExceptionIndexOperand<validate>& operand) {
+                          const ExceptionIndexImmediate<validate>& imm) {
     // TODO(kschimpf): Need to get runtime exception tag values. This
     // code only handles non-imported/exported exceptions.
-    return BUILD(Int32Constant, operand.index);
+    return BUILD(Int32Constant, imm.index);
   }
 
-  void Throw(Decoder* decoder, const ExceptionIndexOperand<validate>& operand,
+  void Throw(Decoder* decoder, const ExceptionIndexImmediate<validate>& imm,
              Control* block, const Vector<Value>& value_args) {
     int count = value_args.length();
     ZoneVector<TFNode*> args(count, decoder->zone());
     for (int i = 0; i < count; ++i) {
       args[i] = value_args[i].node;
     }
-    BUILD(Throw, operand.index, operand.exception, vec2vec(args));
+    BUILD(Throw, imm.index, imm.exception, vec2vec(args));
     Unreachable(decoder);
     EndControl(decoder, block);
   }
 
   void CatchException(Decoder* decoder,
-                      const ExceptionIndexOperand<validate>& operand,
+                      const ExceptionIndexImmediate<validate>& imm,
                       Control* block, Vector<Value> values) {
     DCHECK(block->is_try_catch());
     current_catch_ = block->previous_catch;
@@ -450,8 +445,7 @@ class WasmGraphBuildingInterface {
     } else {
       // Get the exception and see if wanted exception.
       TFNode* caught_tag = BUILD(GetExceptionRuntimeId);
-      TFNode* exception_tag =
-          BUILD(ConvertExceptionTagToRuntimeId, operand.index);
+      TFNode* exception_tag = BUILD(ConvertExceptionTagToRuntimeId, imm.index);
       compare_i32 = BUILD(Binop, kExprI32Eq, caught_tag, exception_tag);
     }
 
@@ -482,7 +476,7 @@ class WasmGraphBuildingInterface {
     } else {
       // TODO(kschimpf): Can't use BUILD() here, GetExceptionValues() returns
       // TFNode** rather than TFNode*. Fix to add landing pads.
-      TFNode** caught_values = builder_->GetExceptionValues(operand.exception);
+      TFNode** caught_values = builder_->GetExceptionValues(imm.exception);
       for (size_t i = 0, e = values.size(); i < e; ++i) {
         values[i].node = caught_values[i];
       }
@@ -490,10 +484,10 @@ class WasmGraphBuildingInterface {
   }
 
   void AtomicOp(Decoder* decoder, WasmOpcode opcode, Vector<Value> args,
-                const MemoryAccessOperand<validate>& operand, Value* result) {
+                const MemoryAccessImmediate<validate>& imm, Value* result) {
     TFNode** inputs = GetNodes(args);
-    TFNode* node = BUILD(AtomicOp, opcode, inputs, operand.alignment,
-                         operand.offset, decoder->position());
+    TFNode* node = BUILD(AtomicOp, opcode, inputs, imm.alignment, imm.offset,
+                         decoder->position());
     if (result) result->node = node;
   }
 
@@ -580,9 +574,9 @@ class WasmGraphBuildingInterface {
       try_info->exception = if_exception;
     } else {
       DCHECK_EQ(SsaEnv::kMerged, try_info->catch_env->state);
-      try_info->exception =
-          builder_->CreateOrMergeIntoPhi(kWasmI32, try_info->catch_env->control,
-                                         try_info->exception, if_exception);
+      try_info->exception = builder_->CreateOrMergeIntoPhi(
+          MachineRepresentation::kWord32, try_info->catch_env->control,
+          try_info->exception, if_exception);
     }
 
     SetEnv(success_env);
@@ -624,7 +618,8 @@ class WasmGraphBuildingInterface {
       DCHECK(val.type == old.type || val.type == kWasmVar);
       old.node = first ? val.node
                        : builder_->CreateOrMergeIntoPhi(
-                             old.type, target->control, old.node, val.node);
+                             ValueTypes::MachineRepresentationFor(old.type),
+                             target->control, old.node, val.node);
     }
   }
 
@@ -676,7 +671,8 @@ class WasmGraphBuildingInterface {
         // Merge locals.
         for (int i = decoder->NumLocals() - 1; i >= 0; i--) {
           to->locals[i] = builder_->CreateOrMergeIntoPhi(
-              decoder->GetLocalType(i), merge, to->locals[i], from->locals[i]);
+              ValueTypes::MachineRepresentationFor(decoder->GetLocalType(i)),
+              merge, to->locals[i], from->locals[i]);
         }
         // Merge the instance caches.
         builder_->MergeInstanceCacheInto(&to->instance_cache,
@@ -850,21 +846,29 @@ DecodeResult VerifyWasmCode(AccountingAllocator* allocator,
 
 DecodeResult VerifyWasmCodeWithStats(AccountingAllocator* allocator,
                                      const wasm::WasmModule* module,
-                                     FunctionBody& body, bool is_wasm,
+                                     FunctionBody& body, ModuleOrigin origin,
                                      Counters* counters) {
   CHECK_LE(0, body.end - body.start);
-  auto time_counter = is_wasm ? counters->wasm_decode_wasm_function_time()
-                              : counters->wasm_decode_asm_function_time();
+  auto time_counter = origin == kWasmOrigin
+                          ? counters->wasm_decode_wasm_function_time()
+                          : counters->wasm_decode_asm_function_time();
   TimedHistogramScope wasm_decode_function_time_scope(time_counter);
   return VerifyWasmCode(allocator, module, body);
 }
 
 DecodeResult BuildTFGraph(AccountingAllocator* allocator, TFBuilder* builder,
-                          FunctionBody& body) {
+                          FunctionBody& body,
+                          compiler::NodeOriginTable* node_origins) {
   Zone zone(allocator, ZONE_NAME);
   WasmFullDecoder<Decoder::kValidate, WasmGraphBuildingInterface> decoder(
       &zone, builder->module(), body, builder);
+  if (node_origins) {
+    builder->AddBytecodePositionDecorator(node_origins, &decoder);
+  }
   decoder.Decode();
+  if (node_origins) {
+    builder->RemoveBytecodePositionDecorator();
+  }
   return decoder.toResult(nullptr);
 }
 
@@ -904,15 +908,23 @@ const char* RawOpcodeName(WasmOpcode opcode) {
 bool PrintRawWasmCode(AccountingAllocator* allocator, const FunctionBody& body,
                       const wasm::WasmModule* module,
                       PrintLocals print_locals) {
-  OFStream os(stdout);
+  StdoutStream os;
+  return PrintRawWasmCode(allocator, body, module, print_locals, os);
+}
+
+bool PrintRawWasmCode(AccountingAllocator* allocator, const FunctionBody& body,
+                      const wasm::WasmModule* module, PrintLocals print_locals,
+                      std::ostream& os, std::vector<int>* line_numbers) {
   Zone zone(allocator, ZONE_NAME);
   WasmDecoder<Decoder::kNoValidate> decoder(module, body.sig, body.start,
                                             body.end);
   int line_nr = 0;
+  constexpr int kNoByteCode = -1;
 
   // Print the function signature.
   if (body.sig) {
     os << "// signature: " << *body.sig << std::endl;
+    if (line_numbers) line_numbers->push_back(kNoByteCode);
     ++line_nr;
   }
 
@@ -928,23 +940,26 @@ bool PrintRawWasmCode(AccountingAllocator* allocator, const FunctionBody& body,
         if (decls.type_list[pos] == type) {
           ++count;
         } else {
-          os << " " << count << " " << WasmOpcodes::TypeName(type);
+          os << " " << count << " " << ValueTypes::TypeName(type);
           type = decls.type_list[pos];
           count = 1;
         }
       }
     }
     os << std::endl;
+    if (line_numbers) line_numbers->push_back(kNoByteCode);
     ++line_nr;
 
     for (const byte* locals = body.start; locals < i.pc(); locals++) {
       os << (locals == body.start ? "0x" : " 0x") << AsHex(*locals, 2) << ",";
     }
     os << std::endl;
+    if (line_numbers) line_numbers->push_back(kNoByteCode);
     ++line_nr;
   }
 
   os << "// body: " << std::endl;
+  if (line_numbers) line_numbers->push_back(kNoByteCode);
   ++line_nr;
   unsigned control_depth = 0;
   for (; i.has_next(); i.next()) {
@@ -952,6 +967,7 @@ bool PrintRawWasmCode(AccountingAllocator* allocator, const FunctionBody& body,
         WasmDecoder<Decoder::kNoValidate>::OpcodeLength(&decoder, i.pc());
 
     WasmOpcode opcode = i.current();
+    if (line_numbers) line_numbers->push_back(i.position());
     if (opcode == kExprElse) control_depth--;
 
     int num_whitespaces = control_depth < 32 ? 2 * control_depth : 64;
@@ -999,10 +1015,12 @@ bool PrintRawWasmCode(AccountingAllocator* allocator, const FunctionBody& body,
       case kExprIf:
       case kExprBlock:
       case kExprTry: {
-        BlockTypeOperand<Decoder::kNoValidate> operand(&i, i.pc());
+        BlockTypeImmediate<Decoder::kNoValidate> imm(&i, i.pc());
         os << "   // @" << i.pc_offset();
-        for (unsigned i = 0; i < operand.out_arity(); i++) {
-          os << " " << WasmOpcodes::TypeName(operand.out_type(i));
+        if (decoder.Complete(imm)) {
+          for (unsigned i = 0; i < imm.out_arity(); i++) {
+            os << " " << ValueTypes::TypeName(imm.out_type(i));
+          }
         }
         control_depth++;
         break;
@@ -1012,33 +1030,33 @@ bool PrintRawWasmCode(AccountingAllocator* allocator, const FunctionBody& body,
         control_depth--;
         break;
       case kExprBr: {
-        BreakDepthOperand<Decoder::kNoValidate> operand(&i, i.pc());
-        os << "   // depth=" << operand.depth;
+        BreakDepthImmediate<Decoder::kNoValidate> imm(&i, i.pc());
+        os << "   // depth=" << imm.depth;
         break;
       }
       case kExprBrIf: {
-        BreakDepthOperand<Decoder::kNoValidate> operand(&i, i.pc());
-        os << "   // depth=" << operand.depth;
+        BreakDepthImmediate<Decoder::kNoValidate> imm(&i, i.pc());
+        os << "   // depth=" << imm.depth;
         break;
       }
       case kExprBrTable: {
-        BranchTableOperand<Decoder::kNoValidate> operand(&i, i.pc());
-        os << " // entries=" << operand.table_count;
+        BranchTableImmediate<Decoder::kNoValidate> imm(&i, i.pc());
+        os << " // entries=" << imm.table_count;
         break;
       }
       case kExprCallIndirect: {
-        CallIndirectOperand<Decoder::kNoValidate> operand(&i, i.pc());
-        os << "   // sig #" << operand.sig_index;
-        if (decoder.Complete(i.pc(), operand)) {
-          os << ": " << *operand.sig;
+        CallIndirectImmediate<Decoder::kNoValidate> imm(&i, i.pc());
+        os << "   // sig #" << imm.sig_index;
+        if (decoder.Complete(i.pc(), imm)) {
+          os << ": " << *imm.sig;
         }
         break;
       }
       case kExprCallFunction: {
-        CallFunctionOperand<Decoder::kNoValidate> operand(&i, i.pc());
-        os << " // function #" << operand.index;
-        if (decoder.Complete(i.pc(), operand)) {
-          os << ": " << *operand.sig;
+        CallFunctionImmediate<Decoder::kNoValidate> imm(&i, i.pc());
+        os << " // function #" << imm.index;
+        if (decoder.Complete(i.pc(), imm)) {
+          os << ": " << *imm.sig;
         }
         break;
       }
@@ -1048,6 +1066,7 @@ bool PrintRawWasmCode(AccountingAllocator* allocator, const FunctionBody& body,
     os << std::endl;
     ++line_nr;
   }
+  DCHECK(!line_numbers || line_numbers->size() == static_cast<size_t>(line_nr));
 
   return decoder.ok();
 }
diff --git a/deps/v8/src/wasm/function-body-decoder.h b/deps/v8/src/wasm/function-body-decoder.h
index 50eb2295c9a34a..7dbb800399e6fe 100644
--- a/deps/v8/src/wasm/function-body-decoder.h
+++ b/deps/v8/src/wasm/function-body-decoder.h
@@ -20,6 +20,7 @@ class BitVector;  // forward declaration
 class Counters;
 
 namespace compiler {  // external declarations from compiler.
+class NodeOriginTable;
 class WasmGraphBuilder;
 }
 
@@ -27,6 +28,7 @@ namespace wasm {
 
 typedef compiler::WasmGraphBuilder TFBuilder;
 struct WasmModule;  // forward declaration of module interface.
+enum ModuleOrigin : uint8_t;
 
 // A wrapper around the signature and bytes of a function.
 struct FunctionBody {
@@ -48,16 +50,23 @@ V8_EXPORT_PRIVATE DecodeResult VerifyWasmCode(AccountingAllocator* allocator,
 // isolate::async_counters() to guarantee usability of counters argument.
 DecodeResult VerifyWasmCodeWithStats(AccountingAllocator* allocator,
                                      const wasm::WasmModule* module,
-                                     FunctionBody& body, bool is_wasm,
+                                     FunctionBody& body, ModuleOrigin origin,
                                      Counters* counters);
 
 DecodeResult BuildTFGraph(AccountingAllocator* allocator, TFBuilder* builder,
-                          FunctionBody& body);
+                          FunctionBody& body,
+                          compiler::NodeOriginTable* node_origins);
 enum PrintLocals { kPrintLocals, kOmitLocals };
 V8_EXPORT_PRIVATE
 bool PrintRawWasmCode(AccountingAllocator* allocator, const FunctionBody& body,
                       const wasm::WasmModule* module, PrintLocals print_locals);
 
+V8_EXPORT_PRIVATE
+bool PrintRawWasmCode(AccountingAllocator* allocator, const FunctionBody& body,
+                      const wasm::WasmModule* module, PrintLocals print_locals,
+                      std::ostream& out,
+                      std::vector<int>* line_numbers = nullptr);
+
 // A simplified form of AST printing, e.g. from a debugger.
 void PrintRawWasmCode(const byte* start, const byte* end);
 
@@ -72,16 +81,16 @@ inline DecodeResult BuildTFGraph(AccountingAllocator* allocator,
                                  TFBuilder* builder, FunctionSig* sig,
                                  const byte* start, const byte* end) {
   FunctionBody body(sig, 0, start, end);
-  return BuildTFGraph(allocator, builder, body);
+  return BuildTFGraph(allocator, builder, body, nullptr);
 }
 
 struct BodyLocalDecls {
   // The size of the encoded declarations.
-  uint32_t encoded_size;  // size of encoded declarations
+  uint32_t encoded_size = 0;  // size of encoded declarations
 
   ZoneVector<ValueType> type_list;
 
-  explicit BodyLocalDecls(Zone* zone) : encoded_size(0), type_list(zone) {}
+  explicit BodyLocalDecls(Zone* zone) : type_list(zone) {}
 };
 
 V8_EXPORT_PRIVATE bool DecodeLocalDecls(BodyLocalDecls* decls,
diff --git a/deps/v8/src/wasm/function-compiler.cc b/deps/v8/src/wasm/function-compiler.cc
new file mode 100644
index 00000000000000..0009ed3bc1ac61
--- /dev/null
+++ b/deps/v8/src/wasm/function-compiler.cc
@@ -0,0 +1,149 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "src/wasm/function-compiler.h"
+
+#include "src/compiler/wasm-compiler.h"
+#include "src/counters.h"
+#include "src/macro-assembler-inl.h"
+#include "src/wasm/baseline/liftoff-compiler.h"
+#include "src/wasm/wasm-code-manager.h"
+
+namespace v8 {
+namespace internal {
+namespace wasm {
+
+namespace {
+const char* GetCompilationModeAsString(
+    WasmCompilationUnit::CompilationMode mode) {
+  switch (mode) {
+    case WasmCompilationUnit::CompilationMode::kLiftoff:
+      return "liftoff";
+    case WasmCompilationUnit::CompilationMode::kTurbofan:
+      return "turbofan";
+  }
+  UNREACHABLE();
+}
+}  // namespace
+
+// static
+WasmCompilationUnit::CompilationMode
+WasmCompilationUnit::GetDefaultCompilationMode() {
+  return FLAG_liftoff ? CompilationMode::kLiftoff : CompilationMode::kTurbofan;
+}
+
+WasmCompilationUnit::WasmCompilationUnit(Isolate* isolate, ModuleEnv* env,
+                                         wasm::NativeModule* native_module,
+                                         wasm::FunctionBody body,
+                                         wasm::WasmName name, int index,
+                                         CompilationMode mode,
+                                         Counters* counters, bool lower_simd)
+    : isolate_(isolate),
+      env_(env),
+      func_body_(body),
+      func_name_(name),
+      counters_(counters ? counters : isolate->counters()),
+      func_index_(index),
+      native_module_(native_module),
+      lower_simd_(lower_simd),
+      mode_(mode) {
+  DCHECK_GE(index, env->module->num_imported_functions);
+  DCHECK_LT(index, env->module->functions.size());
+  // Always disable Liftoff for asm.js, for two reasons:
+  //    1) asm-specific opcodes are not implemented, and
+  //    2) tier-up does not work with lazy compilation.
+  if (env->module->origin == kAsmJsOrigin) mode = CompilationMode::kTurbofan;
+  SwitchMode(mode);
+}
+
+// Declared here such that {LiftoffCompilationUnit} and
+// {TurbofanWasmCompilationUnit} can be opaque in the header file.
+WasmCompilationUnit::~WasmCompilationUnit() {}
+
+void WasmCompilationUnit::ExecuteCompilation() {
+  auto size_histogram = SELECT_WASM_COUNTER(counters_, env_->module->origin,
+                                            wasm, function_size_bytes);
+  size_histogram->AddSample(
+      static_cast<int>(func_body_.end - func_body_.start));
+  auto timed_histogram = SELECT_WASM_COUNTER(counters_, env_->module->origin,
+                                             wasm_compile, function_time);
+  TimedHistogramScope wasm_compile_function_time_scope(timed_histogram);
+
+  if (FLAG_trace_wasm_compiler) {
+    PrintF("Compiling wasm function %d with %s\n\n", func_index_,
+           GetCompilationModeAsString(mode_));
+  }
+
+  switch (mode_) {
+    case WasmCompilationUnit::CompilationMode::kLiftoff:
+      if (liftoff_unit_->ExecuteCompilation()) break;
+      // Otherwise, fall back to turbofan.
+      SwitchMode(CompilationMode::kTurbofan);
+      V8_FALLTHROUGH;
+    case WasmCompilationUnit::CompilationMode::kTurbofan:
+      turbofan_unit_->ExecuteCompilation();
+      break;
+  }
+}
+
+wasm::WasmCode* WasmCompilationUnit::FinishCompilation(
+    wasm::ErrorThrower* thrower) {
+  wasm::WasmCode* ret;
+  switch (mode_) {
+    case CompilationMode::kLiftoff:
+      ret = liftoff_unit_->FinishCompilation(thrower);
+      break;
+    case CompilationMode::kTurbofan:
+      ret = turbofan_unit_->FinishCompilation(thrower);
+      break;
+    default:
+      UNREACHABLE();
+  }
+  if (ret == nullptr) {
+    thrower->RuntimeError("Error finalizing code.");
+  }
+  return ret;
+}
+
+void WasmCompilationUnit::SwitchMode(CompilationMode new_mode) {
+  // This method is being called in the constructor, where neither
+  // {liftoff_unit_} nor {turbofan_unit_} are set, or to switch mode from
+  // kLiftoff to kTurbofan, in which case {liftoff_unit_} is already set.
+  mode_ = new_mode;
+  switch (new_mode) {
+    case CompilationMode::kLiftoff:
+      DCHECK(!turbofan_unit_);
+      DCHECK(!liftoff_unit_);
+      liftoff_unit_.reset(new LiftoffCompilationUnit(this));
+      return;
+    case CompilationMode::kTurbofan:
+      DCHECK(!turbofan_unit_);
+      liftoff_unit_.reset();
+      turbofan_unit_.reset(new compiler::TurbofanWasmCompilationUnit(this));
+      return;
+  }
+  UNREACHABLE();
+}
+
+// static
+wasm::WasmCode* WasmCompilationUnit::CompileWasmFunction(
+    wasm::NativeModule* native_module, wasm::ErrorThrower* thrower,
+    Isolate* isolate, ModuleEnv* env, const wasm::WasmFunction* function,
+    CompilationMode mode) {
+  ModuleWireBytes wire_bytes(native_module->wire_bytes());
+  wasm::FunctionBody function_body{
+      function->sig, function->code.offset(),
+      wire_bytes.start() + function->code.offset(),
+      wire_bytes.start() + function->code.end_offset()};
+
+  WasmCompilationUnit unit(isolate, env, native_module, function_body,
+                           wire_bytes.GetNameOrNull(function, env->module),
+                           function->func_index, mode);
+  unit.ExecuteCompilation();
+  return unit.FinishCompilation(thrower);
+}
+
+}  // namespace wasm
+}  // namespace internal
+}  // namespace v8
diff --git a/deps/v8/src/wasm/function-compiler.h b/deps/v8/src/wasm/function-compiler.h
new file mode 100644
index 00000000000000..65fc35709fd3e1
--- /dev/null
+++ b/deps/v8/src/wasm/function-compiler.h
@@ -0,0 +1,112 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef V8_WASM_FUNCTION_COMPILER_H_
+#define V8_WASM_FUNCTION_COMPILER_H_
+
+#include "src/wasm/function-body-decoder.h"
+
+namespace v8 {
+namespace internal {
+
+namespace compiler {
+class TurbofanWasmCompilationUnit;
+}  // namespace compiler
+
+namespace wasm {
+
+class LiftoffCompilationUnit;
+struct ModuleWireBytes;
+class NativeModule;
+class WasmCode;
+struct WasmFunction;
+
+enum RuntimeExceptionSupport : bool {
+  kRuntimeExceptionSupport = true,
+  kNoRuntimeExceptionSupport = false
+};
+
+enum UseTrapHandler : bool { kUseTrapHandler = true, kNoTrapHandler = false };
+
+// The {ModuleEnv} encapsulates the module data that is used during compilation.
+// ModuleEnvs are shareable across multiple compilations.
+struct ModuleEnv {
+  // A pointer to the decoded module's static representation.
+  const WasmModule* const module;
+
+  // True if trap handling should be used in compiled code, rather than
+  // compiling in bounds checks for each memory access.
+  const UseTrapHandler use_trap_handler;
+
+  // If the runtime doesn't support exception propagation,
+  // we won't generate stack checks, and trap handling will also
+  // be generated differently.
+  const RuntimeExceptionSupport runtime_exception_support;
+
+  constexpr ModuleEnv(const WasmModule* module, UseTrapHandler use_trap_handler,
+                      RuntimeExceptionSupport runtime_exception_support)
+      : module(module),
+        use_trap_handler(use_trap_handler),
+        runtime_exception_support(runtime_exception_support) {}
+};
+
+class WasmCompilationUnit final {
+ public:
+  enum class CompilationMode : uint8_t { kLiftoff, kTurbofan };
+  static CompilationMode GetDefaultCompilationMode();
+
+  // If constructing from a background thread, pass in a Counters*, and ensure
+  // that the Counters live at least as long as this compilation unit (which
+  // typically means to hold a std::shared_ptr<Counters>).
+  // If no such pointer is passed, Isolate::counters() will be called. This is
+  // only allowed to happen on the foreground thread.
+  WasmCompilationUnit(Isolate*, ModuleEnv*, wasm::NativeModule*,
+                      wasm::FunctionBody, wasm::WasmName, int index,
+                      CompilationMode = GetDefaultCompilationMode(),
+                      Counters* = nullptr, bool lower_simd = false);
+
+  ~WasmCompilationUnit();
+
+  void ExecuteCompilation();
+  wasm::WasmCode* FinishCompilation(wasm::ErrorThrower* thrower);
+
+  static wasm::WasmCode* CompileWasmFunction(
+      wasm::NativeModule* native_module, wasm::ErrorThrower* thrower,
+      Isolate* isolate, ModuleEnv* env, const wasm::WasmFunction* function,
+      CompilationMode = GetDefaultCompilationMode());
+
+  size_t memory_cost() const { return memory_cost_; }
+  wasm::NativeModule* native_module() const { return native_module_; }
+  CompilationMode mode() const { return mode_; }
+
+ private:
+  friend class LiftoffCompilationUnit;
+  friend class compiler::TurbofanWasmCompilationUnit;
+
+  Isolate* isolate_;
+  ModuleEnv* env_;
+  wasm::FunctionBody func_body_;
+  wasm::WasmName func_name_;
+  Counters* counters_;
+  int func_index_;
+  size_t memory_cost_ = 0;
+  wasm::NativeModule* native_module_;
+  // TODO(wasm): Put {lower_simd_} inside the {ModuleEnv}.
+  bool lower_simd_;
+  CompilationMode mode_;
+  // LiftoffCompilationUnit, set if {mode_ == kLiftoff}.
+  std::unique_ptr<LiftoffCompilationUnit> liftoff_unit_;
+  // TurbofanWasmCompilationUnit, set if {mode_ == kTurbofan}.
+  std::unique_ptr<compiler::TurbofanWasmCompilationUnit> turbofan_unit_;
+
+  void SwitchMode(CompilationMode new_mode);
+
+  DISALLOW_COPY_AND_ASSIGN(WasmCompilationUnit);
+};
+
+}  // namespace wasm
+}  // namespace internal
+}  // namespace v8
+
+#endif  // V8_WASM_FUNCTION_COMPILER_H_
diff --git a/deps/v8/src/wasm/jump-table-assembler.cc b/deps/v8/src/wasm/jump-table-assembler.cc
new file mode 100644
index 00000000000000..3ac9d13e89f1d4
--- /dev/null
+++ b/deps/v8/src/wasm/jump-table-assembler.cc
@@ -0,0 +1,210 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "src/wasm/jump-table-assembler.h"
+
+#include "src/assembler-inl.h"
+#include "src/macro-assembler-inl.h"
+
+namespace v8 {
+namespace internal {
+namespace wasm {
+
+// The implementation is compact enough to implement it inline here. If it gets
+// much bigger, we might want to split it in a separate file per architecture.
+#if V8_TARGET_ARCH_X64
+void JumpTableAssembler::EmitLazyCompileJumpSlot(uint32_t func_index,
+                                                 Address lazy_compile_target) {
+  // TODO(clemensh): Try more efficient sequences.
+  // Alternative 1:
+  // [header]:  mov r10, [lazy_compile_target]
+  //            jmp r10
+  // [slot 0]:  push [0]
+  //            jmp [header]  // pc-relative --> slot size: 10 bytes
+  //
+  // Alternative 2:
+  // [header]:  lea r10, [rip - [header]]
+  //            shr r10, 3  // compute index from offset
+  //            push r10
+  //            mov r10, [lazy_compile_target]
+  //            jmp r10
+  // [slot 0]:  call [header]
+  //            ret   // -> slot size: 5 bytes
+
+  // Use a push, because mov to an extended register takes 6 bytes.
+  pushq(Immediate(func_index));                           // max 5 bytes
+  movq(kScratchRegister, uint64_t{lazy_compile_target});  // max 10 bytes
+  jmp(kScratchRegister);                                  // 3 bytes
+}
+
+void JumpTableAssembler::EmitJumpSlot(Address target) {
+  movq(kScratchRegister, static_cast<uint64_t>(target));
+  jmp(kScratchRegister);
+}
+
+void JumpTableAssembler::NopBytes(int bytes) {
+  DCHECK_LE(0, bytes);
+  Nop(bytes);
+}
+
+#elif V8_TARGET_ARCH_IA32
+void JumpTableAssembler::EmitLazyCompileJumpSlot(uint32_t func_index,
+                                                 Address lazy_compile_target) {
+  mov(edi, func_index);                       // 5 bytes
+  jmp(lazy_compile_target, RelocInfo::NONE);  // 5 bytes
+}
+
+void JumpTableAssembler::EmitJumpSlot(Address target) {
+  jmp(target, RelocInfo::NONE);
+}
+
+void JumpTableAssembler::NopBytes(int bytes) {
+  DCHECK_LE(0, bytes);
+  Nop(bytes);
+}
+
+#elif V8_TARGET_ARCH_ARM
+void JumpTableAssembler::EmitLazyCompileJumpSlot(uint32_t func_index,
+                                                 Address lazy_compile_target) {
+  // Load function index to r4.
+  // This generates [movw, movt] on ARMv7 and later, [ldr, constant pool marker,
+  // constant] on ARMv6.
+  Move32BitImmediate(r4, Operand(func_index));
+  // EmitJumpSlot emits either [b], [movw, movt, mov] (ARMv7+), or [ldr,
+  // constant].
+  // In total, this is <=5 instructions on all architectures.
+  // TODO(arm): Optimize this for code size; lazy compile is not performance
+  // critical, as it's only executed once per function.
+  EmitJumpSlot(lazy_compile_target);
+}
+
+void JumpTableAssembler::EmitJumpSlot(Address target) {
+  int offset =
+      target - reinterpret_cast<Address>(pc_) - Instruction::kPcLoadDelta;
+  DCHECK_EQ(0, offset % kInstrSize);
+  // If the offset is within 64 MB, emit a direct jump. Otherwise jump
+  // indirectly.
+  if (is_int26(offset)) {
+    b(offset);  // 1 instr
+  } else {
+    // {Move32BitImmediate} emits either [movw, movt, mov] or [ldr, constant].
+    Move32BitImmediate(pc, Operand(target));
+  }
+
+  CheckConstPool(true, false);  // force emit of const pool
+}
+
+void JumpTableAssembler::NopBytes(int bytes) {
+  DCHECK_LE(0, bytes);
+  DCHECK_EQ(0, bytes % kInstrSize);
+  for (; bytes > 0; bytes -= kInstrSize) {
+    nop();
+  }
+}
+
+#elif V8_TARGET_ARCH_ARM64
+void JumpTableAssembler::EmitLazyCompileJumpSlot(uint32_t func_index,
+                                                 Address lazy_compile_target) {
+  Mov(w8, func_index);                         // max. 2 instr
+  Jump(lazy_compile_target, RelocInfo::NONE);  // 1 instr
+}
+
+void JumpTableAssembler::EmitJumpSlot(Address target) {
+  Jump(target, RelocInfo::NONE);
+}
+
+void JumpTableAssembler::NopBytes(int bytes) {
+  DCHECK_LE(0, bytes);
+  DCHECK_EQ(0, bytes % kInstructionSize);
+  for (; bytes > 0; bytes -= kInstructionSize) {
+    nop();
+  }
+}
+
+#elif V8_TARGET_ARCH_S390
+void JumpTableAssembler::EmitLazyCompileJumpSlot(uint32_t func_index,
+                                                 Address lazy_compile_target) {
+  // Load function index to r7. 6 bytes
+  lgfi(r7, Operand(func_index));
+  // Jump to {lazy_compile_target}. 6 bytes or 12 bytes
+  mov(r1, Operand(lazy_compile_target));
+  b(r1);  // 2 bytes
+}
+
+void JumpTableAssembler::EmitJumpSlot(Address target) {
+  mov(r1, Operand(target));
+  b(r1);
+}
+
+void JumpTableAssembler::NopBytes(int bytes) {
+  DCHECK_LE(0, bytes);
+  DCHECK_EQ(0, bytes % 2);
+  for (; bytes > 0; bytes -= 2) {
+    nop(0);
+  }
+}
+
+#elif V8_TARGET_ARCH_MIPS || V8_TARGET_ARCH_MIPS64
+void JumpTableAssembler::EmitLazyCompileJumpSlot(uint32_t func_index,
+                                                 Address lazy_compile_target) {
+  li(t0, func_index);  // max. 2 instr
+  // Jump produces max. 4 instructions for 32-bit platform
+  // and max. 6 instructions for 64-bit platform.
+  Jump(lazy_compile_target, RelocInfo::NONE);
+}
+
+void JumpTableAssembler::EmitJumpSlot(Address target) {
+  Jump(target, RelocInfo::NONE);
+}
+
+void JumpTableAssembler::NopBytes(int bytes) {
+  DCHECK_LE(0, bytes);
+  DCHECK_EQ(0, bytes % kInstrSize);
+  for (; bytes > 0; bytes -= kInstrSize) {
+    nop();
+  }
+}
+
+#elif V8_TARGET_ARCH_PPC
+void JumpTableAssembler::EmitLazyCompileJumpSlot(uint32_t func_index,
+                                                 Address lazy_compile_target) {
+  // Load function index to r8. max 5 instrs
+  mov(r15, Operand(func_index));
+  // Jump to {lazy_compile_target}. max 5 instrs
+  mov(r0, Operand(lazy_compile_target));
+  mtctr(r0);
+  bctr();
+}
+
+void JumpTableAssembler::EmitJumpSlot(Address target) {
+  mov(r0, Operand(target));
+  mtctr(r0);
+  bctr();
+}
+
+void JumpTableAssembler::NopBytes(int bytes) {
+  DCHECK_LE(0, bytes);
+  DCHECK_EQ(0, bytes % 4);
+  for (; bytes > 0; bytes -= 4) {
+    nop(0);
+  }
+}
+
+#else
+void JumpTableAssembler::EmitLazyCompileJumpSlot(uint32_t func_index,
+                                                 Address lazy_compile_target) {
+  UNIMPLEMENTED();
+}
+
+void JumpTableAssembler::EmitJumpSlot(Address target) { UNIMPLEMENTED(); }
+
+void JumpTableAssembler::NopBytes(int bytes) {
+  DCHECK_LE(0, bytes);
+  UNIMPLEMENTED();
+}
+#endif
+
+}  // namespace wasm
+}  // namespace internal
+}  // namespace v8
diff --git a/deps/v8/src/wasm/jump-table-assembler.h b/deps/v8/src/wasm/jump-table-assembler.h
new file mode 100644
index 00000000000000..0fa753f03d5649
--- /dev/null
+++ b/deps/v8/src/wasm/jump-table-assembler.h
@@ -0,0 +1,76 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef V8_WASM_JUMP_TABLE_ASSEMBLER_H_
+#define V8_WASM_JUMP_TABLE_ASSEMBLER_H_
+
+#include "src/macro-assembler.h"
+#include "src/wasm/wasm-code-manager.h"
+
+namespace v8 {
+namespace internal {
+namespace wasm {
+
+class JumpTableAssembler : public TurboAssembler {
+ public:
+  // {JumpTableAssembler} is never used during snapshot generation, and its code
+  // must be independent of the code range of any isolate anyway. So just use
+  // this default {Options} for each {JumpTableAssembler}.
+  JumpTableAssembler()
+      : TurboAssembler(nullptr, AssemblerOptions{}, nullptr, 0,
+                       CodeObjectRequired::kNo) {}
+
+  // Instantiate a {JumpTableAssembler} for patching.
+  explicit JumpTableAssembler(Address slot_addr, int size = 256)
+      : TurboAssembler(nullptr, AssemblerOptions{},
+                       reinterpret_cast<void*>(slot_addr), size,
+                       CodeObjectRequired::kNo) {}
+
+#if V8_TARGET_ARCH_X64
+  static constexpr int kJumpTableSlotSize = 18;
+#elif V8_TARGET_ARCH_IA32
+  static constexpr int kJumpTableSlotSize = 10;
+#elif V8_TARGET_ARCH_ARM
+  static constexpr int kJumpTableSlotSize = 5 * kInstrSize;
+#elif V8_TARGET_ARCH_ARM64
+  static constexpr int kJumpTableSlotSize = 3 * kInstructionSize;
+#elif V8_TARGET_ARCH_S390X
+  static constexpr int kJumpTableSlotSize = 20;
+#elif V8_TARGET_ARCH_S390
+  static constexpr int kJumpTableSlotSize = 14;
+#elif V8_TARGET_ARCH_PPC64
+  static constexpr int kJumpTableSlotSize = 48;
+#elif V8_TARGET_ARCH_PPC
+  static constexpr int kJumpTableSlotSize = 24;
+#elif V8_TARGET_ARCH_MIPS
+  static constexpr int kJumpTableSlotSize = 6 * kInstrSize;
+#elif V8_TARGET_ARCH_MIPS64
+  static constexpr int kJumpTableSlotSize = 8 * kInstrSize;
+#else
+  static constexpr int kJumpTableSlotSize = 1;
+#endif
+
+  void EmitLazyCompileJumpSlot(uint32_t func_index,
+                               Address lazy_compile_target);
+
+  void EmitJumpSlot(Address target);
+
+  void NopBytes(int bytes);
+
+  static void PatchJumpTableSlot(Address slot, Address new_target,
+                                 WasmCode::FlushICache flush_i_cache) {
+    JumpTableAssembler jsasm(slot);
+    jsasm.EmitJumpSlot(new_target);
+    jsasm.NopBytes(kJumpTableSlotSize - jsasm.pc_offset());
+    if (flush_i_cache) {
+      Assembler::FlushICache(slot, kJumpTableSlotSize);
+    }
+  }
+};
+
+}  // namespace wasm
+}  // namespace internal
+}  // namespace v8
+
+#endif  // V8_WASM_JUMP_TABLE_ASSEMBLER_H_
diff --git a/deps/v8/src/wasm/local-decl-encoder.cc b/deps/v8/src/wasm/local-decl-encoder.cc
index ab179f3a9d61a5..a0c7c32b005ffa 100644
--- a/deps/v8/src/wasm/local-decl-encoder.cc
+++ b/deps/v8/src/wasm/local-decl-encoder.cc
@@ -4,6 +4,7 @@
 
 #include "src/wasm/local-decl-encoder.h"
 
+#include "src/signature.h"
 #include "src/wasm/leb-helper.h"
 
 namespace v8 {
@@ -26,7 +27,7 @@ size_t LocalDeclEncoder::Emit(byte* buffer) const {
   LEBHelper::write_u32v(&pos, static_cast<uint32_t>(local_decls.size()));
   for (auto& local_decl : local_decls) {
     LEBHelper::write_u32v(&pos, local_decl.first);
-    *pos = WasmOpcodes::ValueTypeCodeFor(local_decl.second);
+    *pos = ValueTypes::ValueTypeCodeFor(local_decl.second);
     ++pos;
   }
   DCHECK_EQ(Size(), pos - buffer);
diff --git a/deps/v8/src/wasm/memory-tracing.cc b/deps/v8/src/wasm/memory-tracing.cc
index 75a790db504933..6fa7219cda9d29 100644
--- a/deps/v8/src/wasm/memory-tracing.cc
+++ b/deps/v8/src/wasm/memory-tracing.cc
@@ -15,11 +15,13 @@ void TraceMemoryOperation(ExecutionEngine engine, const MemoryTracingInfo* info,
   EmbeddedVector<char, 64> value;
   auto mem_rep = static_cast<MachineRepresentation>(info->mem_rep);
   switch (mem_rep) {
-#define TRACE_TYPE(rep, str, format, ctype1, ctype2)                    \
-  case MachineRepresentation::rep:                                      \
-    SNPrintF(value, str ":" format,                                     \
-             ReadLittleEndianValue<ctype1>(mem_start + info->address),  \
-             ReadLittleEndianValue<ctype2>(mem_start + info->address)); \
+#define TRACE_TYPE(rep, str, format, ctype1, ctype2)                     \
+  case MachineRepresentation::rep:                                       \
+    SNPrintF(value, str ":" format,                                      \
+             ReadLittleEndianValue<ctype1>(                              \
+                 reinterpret_cast<Address>(mem_start) + info->address),  \
+             ReadLittleEndianValue<ctype2>(                              \
+                 reinterpret_cast<Address>(mem_start) + info->address)); \
     break;
     TRACE_TYPE(kWord8, " i8", "%d / %02x", uint8_t, uint8_t)
     TRACE_TYPE(kWord16, "i16", "%d / %04x", uint16_t, uint16_t)
diff --git a/deps/v8/src/wasm/module-compiler.cc b/deps/v8/src/wasm/module-compiler.cc
index dd8794ca54d15c..0c58672f82b067 100644
--- a/deps/v8/src/wasm/module-compiler.cc
+++ b/deps/v8/src/wasm/module-compiler.cc
@@ -6,22 +6,20 @@
 
 #include "src/api.h"
 #include "src/asmjs/asm-js.h"
-#include "src/assembler-inl.h"
 #include "src/base/optional.h"
 #include "src/base/template-utils.h"
 #include "src/base/utils/random-number-generator.h"
-#include "src/code-stubs.h"
 #include "src/compiler/wasm-compiler.h"
 #include "src/counters.h"
 #include "src/identity-map.h"
 #include "src/property-descriptor.h"
 #include "src/trap-handler/trap-handler.h"
-#include "src/wasm/compilation-manager.h"
 #include "src/wasm/module-decoder.h"
+#include "src/wasm/streaming-decoder.h"
 #include "src/wasm/wasm-code-manager.h"
-#include "src/wasm/wasm-code-specialization.h"
 #include "src/wasm/wasm-engine.h"
 #include "src/wasm/wasm-js.h"
+#include "src/wasm/wasm-limits.h"
 #include "src/wasm/wasm-memory.h"
 #include "src/wasm/wasm-objects-inl.h"
 #include "src/wasm/wasm-result.h"
@@ -31,11 +29,6 @@
     if (FLAG_trace_wasm_instances) PrintF(__VA_ARGS__); \
   } while (false)
 
-#define TRACE_CHAIN(instance)        \
-  do {                               \
-    instance->PrintInstancesChain(); \
-  } while (false)
-
 #define TRACE_COMPILE(...)                             \
   do {                                                 \
     if (FLAG_trace_wasm_compiler) PrintF(__VA_ARGS__); \
@@ -57,10 +50,12 @@ namespace wasm {
 
 enum class CompilationEvent : uint8_t {
   kFinishedBaselineCompilation,
-  kFailedCompilation
+  kFinishedTopTierCompilation,
+  kFailedCompilation,
+  kDestroyed
 };
 
-enum class NotifyCompilationCallback : uint8_t { kNotify, kNoNotify };
+enum class CompileMode : uint8_t { kRegular, kTiering };
 
 // The CompilationState keeps track of the compilation state of the
 // owning NativeModule, i.e. which functions are left to be compiled.
@@ -68,51 +63,28 @@ enum class NotifyCompilationCallback : uint8_t { kNotify, kNoNotify };
 // compilation of functions.
 class CompilationState {
  public:
-  class CodeGenerationSchedule {
-   public:
-    explicit CodeGenerationSchedule(
-        base::RandomNumberGenerator* random_number_generator,
-        size_t max_memory = 0);
-
-    void Schedule(std::unique_ptr<compiler::WasmCompilationUnit> item);
-
-    bool IsEmpty() const { return schedule_.empty(); }
-
-    std::unique_ptr<compiler::WasmCompilationUnit> GetNext();
-
-    bool CanAcceptWork() const;
-
-    bool ShouldIncreaseWorkload() const;
-
-   private:
-    size_t GetRandomIndexInSchedule();
-
-    base::RandomNumberGenerator* random_number_generator_ = nullptr;
-    std::vector<std::unique_ptr<compiler::WasmCompilationUnit>> schedule_;
-    const size_t max_memory_;
-    size_t allocated_memory_ = 0;
-  };
-
-  explicit CompilationState(internal::Isolate* isolate);
+  CompilationState(internal::Isolate*, const ModuleEnv&);
   ~CompilationState();
 
   // Needs to be set before {AddCompilationUnits} is run, which triggers
   // background compilation.
   void SetNumberOfFunctionsToCompile(size_t num_functions);
   void AddCallback(
-      std::function<void(CompilationEvent, Handle<Object>)> callback);
+      std::function<void(CompilationEvent, ErrorThrower*)> callback);
 
   // Inserts new functions to compile and kicks off compilation.
   void AddCompilationUnits(
-      std::vector<std::unique_ptr<compiler::WasmCompilationUnit>>& units);
-  std::unique_ptr<compiler::WasmCompilationUnit> GetNextCompilationUnit();
-  std::unique_ptr<compiler::WasmCompilationUnit> GetNextExecutedUnit();
+      std::vector<std::unique_ptr<WasmCompilationUnit>>& baseline_units,
+      std::vector<std::unique_ptr<WasmCompilationUnit>>& tiering_units);
+  std::unique_ptr<WasmCompilationUnit> GetNextCompilationUnit();
+  std::unique_ptr<WasmCompilationUnit> GetNextExecutedUnit();
+
   bool HasCompilationUnitToFinish();
 
-  void OnError(Handle<Object> error, NotifyCompilationCallback notify);
-  void OnFinishedUnit(NotifyCompilationCallback notify);
-  void ScheduleUnitForFinishing(
-      std::unique_ptr<compiler::WasmCompilationUnit>& unit);
+  void OnError(ErrorThrower* thrower);
+  void OnFinishedUnit();
+  void ScheduleUnitForFinishing(std::unique_ptr<WasmCompilationUnit> unit,
+                                WasmCompilationUnit::CompilationMode mode);
 
   void CancelAndWait();
   void OnBackgroundTaskStopped();
@@ -133,10 +105,30 @@ class CompilationState {
     return failed_;
   }
 
+  bool baseline_compilation_finished() const {
+    return baseline_compilation_finished_;
+  }
+
+  CompileMode compile_mode() const { return compile_mode_; }
+  ModuleEnv* module_env() { return &module_env_; }
+
  private:
-  void NotifyOnEvent(CompilationEvent event, Handle<Object> error);
+  void NotifyOnEvent(CompilationEvent event, ErrorThrower* thrower);
 
-  Isolate* isolate_;
+  std::vector<std::unique_ptr<WasmCompilationUnit>>& finish_units() {
+    return baseline_compilation_finished_ ? tiering_finish_units_
+                                          : baseline_finish_units_;
+  }
+
+  // TODO(7423): Get rid of the Isolate field to make sure the CompilationState
+  // can be shared across multiple Isolates.
+  Isolate* const isolate_;
+  WasmEngine* const wasm_engine_;
+  // TODO(clemensh): Remove ModuleEnv, generate it when needed.
+  ModuleEnv module_env_;
+  const size_t max_memory_;
+  const CompileMode compile_mode_;
+  bool baseline_compilation_finished_ = false;
 
   // This mutex protects all information of this CompilationState which is being
   // accessed concurrently.
@@ -145,74 +137,75 @@ class CompilationState {
   //////////////////////////////////////////////////////////////////////////////
   // Protected by {mutex_}:
 
-  std::vector<std::unique_ptr<compiler::WasmCompilationUnit>>
-      compilation_units_;
-  CodeGenerationSchedule executed_units_;
+  std::vector<std::unique_ptr<WasmCompilationUnit>> baseline_compilation_units_;
+  std::vector<std::unique_ptr<WasmCompilationUnit>> tiering_compilation_units_;
+
   bool finisher_is_running_ = false;
   bool failed_ = false;
   size_t num_background_tasks_ = 0;
 
+  std::vector<std::unique_ptr<WasmCompilationUnit>> baseline_finish_units_;
+  std::vector<std::unique_ptr<WasmCompilationUnit>> tiering_finish_units_;
+
+  size_t allocated_memory_ = 0;
+
   // End of fields protected by {mutex_}.
   //////////////////////////////////////////////////////////////////////////////
 
-  std::vector<std::function<void(CompilationEvent, Handle<Object>)>> callbacks_;
+  // TODO(mstarzinger): We should make sure this allows at most one callback
+  // to exist for each {CompilationState} because reifying the error object on
+  // the given {ErrorThrower} can be done at most once.
+  std::vector<std::function<void(CompilationEvent, ErrorThrower*)>> callbacks_;
 
   // When canceling the background_task_manager_, use {CancelAndWait} on
   // the CompilationState in order to cleanly clean up.
   CancelableTaskManager background_task_manager_;
   CancelableTaskManager foreground_task_manager_;
-  std::shared_ptr<v8::TaskRunner> background_task_runner_;
   std::shared_ptr<v8::TaskRunner> foreground_task_runner_;
 
   const size_t max_background_tasks_ = 0;
 
   size_t outstanding_units_ = 0;
+  size_t num_tiering_units_ = 0;
 };
 
 namespace {
 
 class JSToWasmWrapperCache {
  public:
-  Handle<Code> CloneOrCompileJSToWasmWrapper(Isolate* isolate,
-                                             wasm::WasmModule* module,
-                                             wasm::WasmCode* wasm_code,
-                                             uint32_t index,
-                                             bool use_trap_handler) {
-    const wasm::WasmFunction* func = &module->functions[index];
-    int cached_idx = sig_map_.Find(func->sig);
-    if (cached_idx >= 0) {
-      Handle<Code> code = isolate->factory()->CopyCode(code_cache_[cached_idx]);
-      // Now patch the call to wasm code.
-      RelocIterator it(*code, RelocInfo::ModeMask(RelocInfo::JS_TO_WASM_CALL));
-      DCHECK(!it.done());
-      it.rinfo()->set_js_to_wasm_address(
-          wasm_code == nullptr ? nullptr : wasm_code->instructions().start());
-      return code;
-    }
-
-    Handle<Code> code = compiler::CompileJSToWasmWrapper(
-        isolate, module, weak_instance_, wasm_code, index, use_trap_handler);
-    uint32_t new_cache_idx = sig_map_.FindOrInsert(func->sig);
-    DCHECK_EQ(code_cache_.size(), new_cache_idx);
+  Handle<Code> GetOrCompileJSToWasmWrapper(
+      Isolate* isolate, const wasm::NativeModule* native_module,
+      uint32_t func_index, wasm::UseTrapHandler use_trap_handler) {
+    const wasm::WasmModule* module = native_module->module();
+    const wasm::WasmFunction* func = &module->functions[func_index];
+    bool is_import = func_index < module->num_imported_functions;
+    auto& cache = cache_[is_import ? 1 : 0];
+    int cached_idx = cache.sig_map.Find(func->sig);
+    if (cached_idx >= 0) return cache.code_cache[cached_idx];
+
+    Handle<Code> code =
+        compiler::CompileJSToWasmWrapper(isolate, native_module, func->sig,
+                                         is_import, use_trap_handler)
+            .ToHandleChecked();
+    uint32_t new_cache_idx = cache.sig_map.FindOrInsert(func->sig);
+    DCHECK_EQ(cache.code_cache.size(), new_cache_idx);
     USE(new_cache_idx);
-    code_cache_.push_back(code);
+    cache.code_cache.push_back(code);
     return code;
   }
 
-  void SetWeakInstance(Handle<WeakCell> weak_instance) {
-    weak_instance_ = weak_instance;
-  }
-
  private:
-  // sig_map_ maps signatures to an index in code_cache_.
-  wasm::SignatureMap sig_map_;
-  std::vector<Handle<Code>> code_cache_;
-  Handle<WeakCell> weak_instance_;
+  // We generate different code for calling imports than calling wasm functions
+  // in this module. Both are cached separately.
+  // [0] for non-imports, [1] for imports.
+  struct Cache {
+    wasm::SignatureMap sig_map;
+    std::vector<Handle<Code>> code_cache;
+  } cache_[2];
 };
 
-// A helper class to simplify instantiating a module from a compiled module.
-// It closes over the {Isolate}, the {ErrorThrower}, the {WasmCompiledModule},
-// etc.
+// A helper class to simplify instantiating a module from a module object.
+// It closes over the {Isolate}, the {ErrorThrower}, etc.
 class InstanceBuilder {
  public:
   InstanceBuilder(Isolate* isolate, ErrorThrower* thrower,
@@ -241,28 +234,23 @@ class InstanceBuilder {
   };
 
   Isolate* isolate_;
-  WasmModule* const module_;
-  const std::shared_ptr<Counters> async_counters_;
+  const WasmModule* const module_;
   ErrorThrower* thrower_;
   Handle<WasmModuleObject> module_object_;
   MaybeHandle<JSReceiver> ffi_;
   MaybeHandle<JSArrayBuffer> memory_;
   Handle<JSArrayBuffer> globals_;
-  Handle<WasmCompiledModule> compiled_module_;
   std::vector<TableInstance> table_instances_;
   std::vector<Handle<JSFunction>> js_wrappers_;
   Handle<WasmExportedFunction> start_function_;
   JSToWasmWrapperCache js_to_wasm_cache_;
   std::vector<SanitizedImport> sanitized_imports_;
 
-  const std::shared_ptr<Counters>& async_counters() const {
-    return async_counters_;
+  wasm::UseTrapHandler use_trap_handler() const {
+    return module_object_->native_module()->use_trap_handler() ? kUseTrapHandler
+                                                               : kNoTrapHandler;
   }
 
-  Counters* counters() const { return async_counters().get(); }
-
-  bool use_trap_handler() const { return compiled_module_->use_trap_handler(); }
-
 // Helper routines to print out errors with imports.
 #define ERROR_THROWER_WITH_MESSAGE(TYPE)                                      \
   void Report##TYPE(const char* error, uint32_t index,                        \
@@ -300,17 +288,23 @@ class InstanceBuilder {
   // Load data segments into the memory.
   void LoadDataSegments(Handle<WasmInstanceObject> instance);
 
-  void WriteGlobalValue(WasmGlobal& global, Handle<Object> value);
+  void WriteGlobalValue(const WasmGlobal& global, double value);
+  void WriteGlobalValue(const WasmGlobal& global,
+                        Handle<WasmGlobalObject> value);
 
   void SanitizeImports();
 
+  // Find the imported memory buffer if there is one. This is used to see if we
+  // need to recompile with bounds checks before creating the instance.
+  MaybeHandle<JSArrayBuffer> FindImportedMemoryBuffer() const;
+
   // Process the imports, including functions, tables, globals, and memory, in
   // order, loading them from the {ffi_} object. Returns the number of imported
   // functions.
   int ProcessImports(Handle<WasmInstanceObject> instance);
 
   template <typename T>
-  T* GetRawGlobalPtr(WasmGlobal& global);
+  T* GetRawGlobalPtr(const WasmGlobal& global);
 
   // Process initialization of globals.
   void InitGlobals();
@@ -322,11 +316,9 @@ class InstanceBuilder {
 
   // Process the exports, creating wrappers for functions, tables, memories,
   // and globals.
-  void ProcessExports(Handle<WasmInstanceObject> instance,
-                      Handle<WasmCompiledModule> compiled_module);
+  void ProcessExports(Handle<WasmInstanceObject> instance);
 
-  void InitializeTables(Handle<WasmInstanceObject> instance,
-                        CodeSpecialization* code_specialization);
+  void InitializeTables(Handle<WasmInstanceObject> instance);
 
   void LoadTableSegments(Handle<WasmInstanceObject> instance);
 };
@@ -345,166 +337,38 @@ MaybeHandle<WasmInstanceObject> InstantiateToInstanceObject(
   return {};
 }
 
-// A helper class to prevent pathological patching behavior for indirect
-// references to code which must be updated after lazy compiles.
-// Utilizes a reverse mapping to prevent O(n^2) behavior.
-class IndirectPatcher {
- public:
-  void Patch(WasmInstanceObject* caller_instance,
-             WasmInstanceObject* target_instance, int func_index,
-             Address old_target, const WasmCode* new_code) {
-    DisallowHeapAllocation no_gc;
-    TRACE_LAZY(
-        "IndirectPatcher::Patch(caller=%p, target=%p, func_index=%i, "
-        "old_target=%p, "
-        "new_code=%p)\n",
-        caller_instance, target_instance, func_index, old_target, new_code);
-    if (mapping_.size() == 0 || misses_ >= kMaxMisses) {
-      BuildMapping(caller_instance);
-    }
-    // Patch entries for the given function index.
-    WasmCodeManager* code_manager =
-        caller_instance->GetIsolate()->wasm_engine()->code_manager();
-    USE(code_manager);
-    auto& entries = mapping_[func_index];
-    int patched = 0;
-    for (auto index : entries) {
-      if (index < 0) {
-        // Imported function entry.
-        int i = -1 - index;
-        ImportedFunctionEntry entry(caller_instance, i);
-        if (entry.target() == old_target) {
-          DCHECK_EQ(
-              func_index,
-              code_manager->GetCodeFromStartAddress(entry.target())->index());
-          entry.set(target_instance, new_code);
-          patched++;
-        }
-      } else {
-        // Indirect function table entry.
-        int i = index;
-        IndirectFunctionTableEntry entry(caller_instance, i);
-        if (entry.target() == old_target) {
-          DCHECK_EQ(
-              func_index,
-              code_manager->GetCodeFromStartAddress(entry.target())->index());
-          entry.set(entry.sig_id(), target_instance, new_code);
-          patched++;
-        }
-      }
-    }
-    if (patched == 0) misses_++;
-  }
-
- private:
-  void BuildMapping(WasmInstanceObject* caller_instance) {
-    mapping_.clear();
-    misses_ = 0;
-    TRACE_LAZY("BuildMapping for (caller=%p)...\n", caller_instance);
-    Isolate* isolate = caller_instance->GetIsolate();
-    WasmCodeManager* code_manager = isolate->wasm_engine()->code_manager();
-    uint32_t num_imported_functions =
-        caller_instance->module()->num_imported_functions;
-    // Process the imported function entries.
-    for (unsigned i = 0; i < num_imported_functions; i++) {
-      ImportedFunctionEntry entry(caller_instance, i);
-      WasmCode* code = code_manager->GetCodeFromStartAddress(entry.target());
-      if (code->kind() != WasmCode::kLazyStub) continue;
-      TRACE_LAZY(" +import[%u] -> #%d (%p)\n", i, code->index(),
-                 code->instructions().start());
-      DCHECK(!entry.is_js_receiver_entry());
-      WasmInstanceObject* target_instance = entry.instance();
-      WasmCode* new_code =
-          target_instance->compiled_module()->GetNativeModule()->GetCode(
-              code->index());
-      if (new_code->kind() != WasmCode::kLazyStub) {
-        // Patch an imported function entry which is already compiled.
-        entry.set(target_instance, new_code);
-      } else {
-        int key = code->index();
-        int index = -1 - i;
-        mapping_[key].push_back(index);
-      }
-    }
-    // Process the indirect function table entries.
-    size_t ift_size = caller_instance->indirect_function_table_size();
-    for (unsigned i = 0; i < ift_size; i++) {
-      IndirectFunctionTableEntry entry(caller_instance, i);
-      if (entry.target() == nullptr) continue;  // null IFT entry
-      WasmCode* code = code_manager->GetCodeFromStartAddress(entry.target());
-      if (code->kind() != WasmCode::kLazyStub) continue;
-      TRACE_LAZY(" +indirect[%u] -> #%d (lazy:%p)\n", i, code->index(),
-                 code->instructions().start());
-      WasmInstanceObject* target_instance = entry.instance();
-      WasmCode* new_code =
-          target_instance->compiled_module()->GetNativeModule()->GetCode(
-              code->index());
-      if (new_code->kind() != WasmCode::kLazyStub) {
-        // Patch an indirect function table entry which is already compiled.
-        entry.set(entry.sig_id(), target_instance, new_code);
-      } else {
-        int key = code->index();
-        int index = i;
-        mapping_[key].push_back(index);
-      }
-    }
-  }
-
-  static constexpr int kMaxMisses = 5;  // maximum misses before rebuilding
-  std::unordered_map<int, std::vector<int>> mapping_;
-  int misses_ = 0;
-};
-
-compiler::ModuleEnv CreateModuleEnvFromCompiledModule(
-    Isolate* isolate, Handle<WasmCompiledModule> compiled_module) {
-  DisallowHeapAllocation no_gc;
-  WasmModule* module = compiled_module->shared()->module();
-  compiler::ModuleEnv result(module, compiled_module->use_trap_handler());
-  return result;
-}
-
-const wasm::WasmCode* LazyCompileFunction(
-    Isolate* isolate, Handle<WasmCompiledModule> compiled_module,
-    int func_index) {
+wasm::WasmCode* LazyCompileFunction(Isolate* isolate,
+                                    NativeModule* native_module,
+                                    int func_index) {
   base::ElapsedTimer compilation_timer;
-  wasm::WasmCode* existing_code = compiled_module->GetNativeModule()->GetCode(
-      static_cast<uint32_t>(func_index));
-  if (existing_code != nullptr &&
-      existing_code->kind() == wasm::WasmCode::kFunction) {
-    TRACE_LAZY("Function %d already compiled.\n", func_index);
-    return existing_code;
-  }
+  DCHECK(!native_module->has_code(static_cast<uint32_t>(func_index)));
 
   compilation_timer.Start();
+
+  ModuleEnv* module_env = native_module->compilation_state()->module_env();
   // TODO(wasm): Refactor this to only get the name if it is really needed for
   // tracing / debugging.
-  std::string func_name;
+  WasmName func_name;
   {
-    WasmName name = Vector<const char>::cast(
-        compiled_module->shared()->GetRawFunctionName(func_index));
-    // Copy to std::string, because the underlying string object might move on
-    // the heap.
-    func_name.assign(name.start(), static_cast<size_t>(name.length()));
+    ModuleWireBytes wire_bytes(native_module->wire_bytes());
+    WireBytesRef name_ref =
+        module_env->module->LookupFunctionName(wire_bytes, func_index);
+    func_name = wire_bytes.GetName(name_ref);
   }
 
-  TRACE_LAZY("Compiling function %s, %d.\n", func_name.c_str(), func_index);
+  TRACE_LAZY("Compiling function '%.*s' (#%d).\n", func_name.length(),
+             func_name.start(), func_index);
 
-  compiler::ModuleEnv module_env =
-      CreateModuleEnvFromCompiledModule(isolate, compiled_module);
+  const uint8_t* module_start = native_module->wire_bytes().start();
 
-  const uint8_t* module_start =
-      compiled_module->shared()->module_bytes()->GetChars();
-
-  const WasmFunction* func = &module_env.module->functions[func_index];
+  const WasmFunction* func = &module_env->module->functions[func_index];
   FunctionBody body{func->sig, func->code.offset(),
                     module_start + func->code.offset(),
                     module_start + func->code.end_offset()};
 
   ErrorThrower thrower(isolate, "WasmLazyCompile");
-  compiler::WasmCompilationUnit unit(isolate, &module_env,
-                                     compiled_module->GetNativeModule(), body,
-                                     CStrVector(func_name.c_str()), func_index,
-                                     CEntryStub(isolate, 1).GetCode());
+  WasmCompilationUnit unit(isolate, module_env, native_module, body, func_name,
+                           func_index);
   unit.ExecuteCompilation();
   wasm::WasmCode* wasm_code = unit.FinishCompilation(&thrower);
 
@@ -517,10 +381,6 @@ const wasm::WasmCode* LazyCompileFunction(
   // module creation time, and return a function that always traps here.
   CHECK(!thrower.error());
 
-  // Now specialize the generated code for this instance.
-  CodeSpecialization code_specialization;
-  code_specialization.RelocateDirectCalls(compiled_module->GetNativeModule());
-  code_specialization.ApplyToWasmCode(wasm_code, SKIP_ICACHE_FLUSH);
   int64_t func_size =
       static_cast<int64_t>(func->code.end_offset() - func->code.offset());
   int64_t compilation_time = compilation_timer.Elapsed().InMicroseconds();
@@ -528,8 +388,6 @@ const wasm::WasmCode* LazyCompileFunction(
   auto counters = isolate->counters();
   counters->wasm_lazily_compiled_functions()->Increment();
 
-  Assembler::FlushICache(wasm_code->instructions().start(),
-                         wasm_code->instructions().size());
   counters->wasm_generated_code_size()->Increment(
       static_cast<int>(wasm_code->instructions().size()));
   counters->wasm_reloc_size()->Increment(
@@ -538,328 +396,31 @@ const wasm::WasmCode* LazyCompileFunction(
   counters->wasm_lazy_compilation_throughput()->AddSample(
       compilation_time != 0 ? static_cast<int>(func_size / compilation_time)
                             : 0);
-  return wasm_code;
-}
 
-namespace {
-
-int AdvanceSourcePositionTableIterator(SourcePositionTableIterator& iterator,
-                                       int offset) {
-  DCHECK(!iterator.done());
-  int byte_pos;
-  do {
-    byte_pos = iterator.source_position().ScriptOffset();
-    iterator.Advance();
-  } while (!iterator.done() && iterator.code_offset() <= offset);
-  return byte_pos;
-}
-
-const wasm::WasmCode* LazyCompileFromJsToWasm(
-    Isolate* isolate, Handle<WasmInstanceObject> instance,
-    Handle<Code> js_to_wasm_caller, uint32_t callee_func_index) {
-  Decoder decoder(nullptr, nullptr);
-  Handle<WasmCompiledModule> compiled_module(instance->compiled_module(),
-                                             isolate);
-
-  TRACE_LAZY(
-      "Starting lazy compilation (func %u, js_to_wasm: true, patch caller: "
-      "true). \n",
-      callee_func_index);
-  LazyCompileFunction(isolate, compiled_module, callee_func_index);
-  {
-    DisallowHeapAllocation no_gc;
-    CodeSpaceMemoryModificationScope modification_scope(isolate->heap());
-    RelocIterator it(*js_to_wasm_caller,
-                     RelocInfo::ModeMask(RelocInfo::JS_TO_WASM_CALL));
-    DCHECK(!it.done());
-    const wasm::WasmCode* callee_compiled =
-        compiled_module->GetNativeModule()->GetCode(callee_func_index);
-    DCHECK_NOT_NULL(callee_compiled);
-    DCHECK_EQ(WasmCode::kLazyStub,
-              isolate->wasm_engine()
-                  ->code_manager()
-                  ->GetCodeFromStartAddress(it.rinfo()->js_to_wasm_address())
-                  ->kind());
-    it.rinfo()->set_js_to_wasm_address(callee_compiled->instructions().start());
-    TRACE_LAZY("Patched 1 location in js-to-wasm %p.\n", *js_to_wasm_caller);
-
-#ifdef DEBUG
-    it.next();
-    DCHECK(it.done());
-#endif
-  }
-
-  wasm::WasmCode* ret =
-      compiled_module->GetNativeModule()->GetCode(callee_func_index);
-  DCHECK_NOT_NULL(ret);
-  DCHECK_EQ(wasm::WasmCode::kFunction, ret->kind());
-  return ret;
-}
-
-const wasm::WasmCode* LazyCompileIndirectCall(
-    Isolate* isolate, Handle<WasmInstanceObject> instance,
-    uint32_t func_index) {
-  TRACE_LAZY(
-      "Starting lazy compilation (func %u, js_to_wasm: false, patch caller: "
-      "false). \n",
-      func_index);
-  Handle<WasmCompiledModule> compiled_module(instance->compiled_module(),
-                                             isolate);
-  return LazyCompileFunction(isolate, compiled_module, func_index);
-}
-
-const wasm::WasmCode* LazyCompileDirectCall(Isolate* isolate,
-                                            Handle<WasmInstanceObject> instance,
-                                            const wasm::WasmCode* wasm_caller,
-                                            int32_t caller_ret_offset) {
-  DCHECK_LE(0, caller_ret_offset);
-
-  Decoder decoder(nullptr, nullptr);
-
-  // Gather all the targets of direct calls inside the code of {wasm_caller}
-  // and place their function indexes in {direct_callees}.
-  std::vector<int32_t> direct_callees;
-  // The last one before {caller_ret_offset} must be the call that triggered
-  // this lazy compilation.
-  int callee_pos = -1;
-  uint32_t num_non_compiled_callees = 0;  // For stats.
-  {
-    DisallowHeapAllocation no_gc;
-    Handle<WasmCompiledModule> caller_module(
-        wasm_caller->native_module()->compiled_module(), isolate);
-    SeqOneByteString* module_bytes = caller_module->shared()->module_bytes();
-    uint32_t caller_func_index = wasm_caller->index();
-    SourcePositionTableIterator source_pos_iterator(
-        wasm_caller->source_positions());
-
-    const byte* func_bytes =
-        module_bytes->GetChars() + caller_module->shared()
-                                       ->module()
-                                       ->functions[caller_func_index]
-                                       .code.offset();
-    for (RelocIterator it(wasm_caller->instructions(),
-                          wasm_caller->reloc_info(),
-                          wasm_caller->constant_pool(),
-                          RelocInfo::ModeMask(RelocInfo::WASM_CALL));
-         !it.done(); it.next()) {
-      // TODO(clemensh): Introduce safe_cast<T, bool> which (D)CHECKS
-      // (depending on the bool) against limits of T and then static_casts.
-      size_t offset_l = it.rinfo()->pc() - wasm_caller->instructions().start();
-      DCHECK_GE(kMaxInt, offset_l);
-      int offset = static_cast<int>(offset_l);
-      int byte_pos =
-          AdvanceSourcePositionTableIterator(source_pos_iterator, offset);
-
-      WasmCode* callee = isolate->wasm_engine()->code_manager()->LookupCode(
-          it.rinfo()->target_address());
-      if (callee->kind() == WasmCode::kLazyStub) {
-        // The callee has not been compiled.
-        ++num_non_compiled_callees;
-        int32_t callee_func_index =
-            ExtractDirectCallIndex(decoder, func_bytes + byte_pos);
-        DCHECK_LT(callee_func_index,
-                  caller_module->GetNativeModule()->FunctionCount());
-        // {caller_ret_offset} points to one instruction after the call.
-        // Remember the last called function before that offset.
-        if (offset < caller_ret_offset) {
-          callee_pos = static_cast<int>(direct_callees.size());
-        }
-        direct_callees.push_back(callee_func_index);
-      } else {
-        // If the callee is not the lazy compile stub, assume this callee
-        // has already been compiled.
-        direct_callees.push_back(-1);
-        continue;
-      }
-    }
-
-    TRACE_LAZY("Found %d non-compiled callees in function=%p.\n",
-               num_non_compiled_callees, wasm_caller);
-    USE(num_non_compiled_callees);
-  }
-  CHECK_LE(0, callee_pos);
-
-  // TODO(wasm): compile all functions in non_compiled_callees in
-  // background, wait for direct_callees[callee_pos].
-  auto callee_func_index = direct_callees[callee_pos];
-  TRACE_LAZY(
-      "Starting lazy compilation (function=%p retaddr=+%d direct_callees[%d] "
-      "-> %d).\n",
-      wasm_caller, caller_ret_offset, callee_pos, callee_func_index);
-
-  Handle<WasmCompiledModule> compiled_module(instance->compiled_module(),
-                                             isolate);
-  const WasmCode* ret =
-      LazyCompileFunction(isolate, compiled_module, callee_func_index);
-  DCHECK_NOT_NULL(ret);
-
-  int patched = 0;
-  {
-    DisallowHeapAllocation no_gc;
-    // Now patch the code in {wasm_caller} with all functions which are now
-    // compiled. This will pick up any other compiled functions, not only {ret}.
-    size_t pos = 0;
-    for (RelocIterator
-             it(wasm_caller->instructions(), wasm_caller->reloc_info(),
-                wasm_caller->constant_pool(),
-                RelocInfo::ModeMask(RelocInfo::WASM_CALL));
-         !it.done(); it.next(), ++pos) {
-      auto callee_index = direct_callees[pos];
-      if (callee_index < 0) continue;  // callee already compiled.
-      const WasmCode* callee_compiled =
-          compiled_module->GetNativeModule()->GetCode(callee_index);
-      if (callee_compiled->kind() != WasmCode::kFunction) continue;
-      DCHECK_EQ(WasmCode::kLazyStub,
-                isolate->wasm_engine()
-                    ->code_manager()
-                    ->GetCodeFromStartAddress(it.rinfo()->wasm_call_address())
-                    ->kind());
-      it.rinfo()->set_wasm_call_address(
-          callee_compiled->instructions().start());
-      ++patched;
-    }
-    DCHECK_EQ(direct_callees.size(), pos);
-  }
-
-  DCHECK_LT(0, patched);
-  TRACE_LAZY("Patched %d calls(s) in %p.\n", patched, wasm_caller);
-  USE(patched);
-
-  return ret;
+  return wasm_code;
 }
 
-}  // namespace
-
-Address CompileLazy(Isolate* isolate,
-                    Handle<WasmInstanceObject> target_instance) {
+Address CompileLazy(Isolate* isolate, NativeModule* native_module,
+                    uint32_t func_index) {
   HistogramTimerScope lazy_time_scope(
       isolate->counters()->wasm_lazy_compilation_time());
 
-  //==========================================================================
-  // Begin stack walk.
-  //==========================================================================
-  StackFrameIterator it(isolate);
-
-  //==========================================================================
-  // First frame: C entry stub.
-  //==========================================================================
-  DCHECK(!it.done());
-  DCHECK_EQ(StackFrame::EXIT, it.frame()->type());
-  it.Advance();
-
-  //==========================================================================
-  // Second frame: WasmCompileLazy builtin.
-  //==========================================================================
-  DCHECK(!it.done());
-  int target_func_index = -1;
-  bool indirectly_called = false;
-  const wasm::WasmCode* lazy_stub =
-      isolate->wasm_engine()->code_manager()->LookupCode(it.frame()->pc());
-  CHECK_EQ(wasm::WasmCode::kLazyStub, lazy_stub->kind());
-  if (!lazy_stub->IsAnonymous()) {
-    // If the lazy stub is not "anonymous", then its copy encodes the target
-    // function index. Used for import and indirect calls.
-    target_func_index = lazy_stub->index();
-    indirectly_called = true;
-  }
-  it.Advance();
-
-  //==========================================================================
-  // Third frame: The calling wasm code (direct or indirect), or js-to-wasm
-  // wrapper.
-  //==========================================================================
-  DCHECK(!it.done());
-  DCHECK(it.frame()->is_js_to_wasm() || it.frame()->is_wasm_compiled());
-  Handle<Code> js_to_wasm_caller_code;
-  const WasmCode* wasm_caller_code = nullptr;
-  int32_t caller_ret_offset = -1;
-  if (it.frame()->is_js_to_wasm()) {
-    js_to_wasm_caller_code = handle(it.frame()->LookupCode(), isolate);
-    // This wasn't actually an indirect call, but a JS->wasm call.
-    indirectly_called = false;
-  } else {
-    wasm_caller_code =
-        isolate->wasm_engine()->code_manager()->LookupCode(it.frame()->pc());
-    auto offset = it.frame()->pc() - wasm_caller_code->instructions().start();
-    caller_ret_offset = static_cast<int32_t>(offset);
-    DCHECK_EQ(offset, caller_ret_offset);
-  }
-
-  //==========================================================================
-  // Begin compilation.
-  //==========================================================================
-  Handle<WasmCompiledModule> compiled_module(
-      target_instance->compiled_module());
-
-  NativeModule* native_module = compiled_module->GetNativeModule();
   DCHECK(!native_module->lazy_compile_frozen());
 
   NativeModuleModificationScope native_module_modification_scope(native_module);
 
-  const wasm::WasmCode* result = nullptr;
+  wasm::WasmCode* result =
+      LazyCompileFunction(isolate, native_module, func_index);
+  DCHECK_NOT_NULL(result);
+  DCHECK_EQ(func_index, result->index());
 
-  if (!js_to_wasm_caller_code.is_null()) {
-    result = LazyCompileFromJsToWasm(isolate, target_instance,
-                                     js_to_wasm_caller_code, target_func_index);
-    DCHECK_NOT_NULL(result);
-    DCHECK_EQ(target_func_index, result->index());
-  } else {
-    DCHECK_NOT_NULL(wasm_caller_code);
-    if (target_func_index < 0) {
-      result = LazyCompileDirectCall(isolate, target_instance, wasm_caller_code,
-                                     caller_ret_offset);
-      DCHECK_NOT_NULL(result);
-    } else {
-      result =
-          LazyCompileIndirectCall(isolate, target_instance, target_func_index);
-      DCHECK_NOT_NULL(result);
-    }
-  }
-
-  //==========================================================================
-  // Update import and indirect function tables in the caller.
-  //==========================================================================
-  if (indirectly_called) {
-    DCHECK_NOT_NULL(wasm_caller_code);
-    Handle<WasmInstanceObject> caller_instance(
-        WasmInstanceObject::GetOwningInstance(wasm_caller_code), isolate);
-    if (!caller_instance->has_managed_indirect_patcher()) {
-      auto patcher = Managed<IndirectPatcher>::Allocate(isolate);
-      caller_instance->set_managed_indirect_patcher(*patcher);
-    }
-    IndirectPatcher* patcher = Managed<IndirectPatcher>::cast(
-                                   caller_instance->managed_indirect_patcher())
-                                   ->get();
-    Address old_target = lazy_stub->instructions().start();
-    patcher->Patch(*caller_instance, *target_instance, target_func_index,
-                   old_target, result);
-  }
-
-  return result->instructions().start();
+  return result->instruction_start();
 }
 
 namespace {
 bool compile_lazy(const WasmModule* module) {
   return FLAG_wasm_lazy_compilation ||
-         (FLAG_asm_wasm_lazy_compilation && module->is_asm_js());
-}
-
-void FlushICache(const wasm::NativeModule* native_module) {
-  for (uint32_t i = 0, e = native_module->FunctionCount(); i < e; ++i) {
-    const wasm::WasmCode* code = native_module->GetCode(i);
-    if (code == nullptr) continue;
-    Assembler::FlushICache(code->instructions().start(),
-                           code->instructions().size());
-  }
-}
-
-void FlushICache(Handle<FixedArray> functions) {
-  for (int i = 0, e = functions->length(); i < e; ++i) {
-    if (!functions->get(i)->IsCode()) continue;
-    Code* code = Code::cast(functions->get(i));
-    Assembler::FlushICache(code->raw_instruction_start(),
-                           code->raw_instruction_size());
-  }
+         (FLAG_asm_wasm_lazy_compilation && module->origin == kAsmJsOrigin);
 }
 
 byte* raw_buffer_ptr(MaybeHandle<JSArrayBuffer> buffer, int offset) {
@@ -878,17 +439,11 @@ void RecordStats(const wasm::WasmCode* code, Counters* counters) {
       static_cast<int>(code->reloc_info().size()));
 }
 
-void RecordStats(Handle<FixedArray> functions, Counters* counters) {
-  DisallowHeapAllocation no_gc;
-  for (int i = 0; i < functions->length(); ++i) {
-    Object* val = functions->get(i);
-    if (val->IsCode()) RecordStats(Code::cast(val), counters);
-  }
-}
-
 void RecordStats(const wasm::NativeModule* native_module, Counters* counters) {
-  for (uint32_t i = 0, e = native_module->FunctionCount(); i < e; ++i) {
-    const wasm::WasmCode* code = native_module->GetCode(i);
+  for (uint32_t i = native_module->num_imported_functions(),
+                e = native_module->num_functions();
+       i < e; ++i) {
+    const wasm::WasmCode* code = native_module->code(i);
     if (code != nullptr) RecordStats(code, counters);
   }
 }
@@ -905,20 +460,13 @@ double MonotonicallyIncreasingTimeInMs() {
          base::Time::kMillisecondsPerSecond;
 }
 
-std::unique_ptr<compiler::ModuleEnv> CreateDefaultModuleEnv(
-    Isolate* isolate, WasmModule* module) {
-  // TODO(kschimpf): Add module-specific policy handling here (see v8:7143)?
-  bool use_trap_handler = trap_handler::IsTrapHandlerEnabled();
-  return base::make_unique<compiler::ModuleEnv>(module, use_trap_handler);
-}
-
-Handle<WasmCompiledModule> NewCompiledModule(Isolate* isolate,
-                                             WasmModule* module,
-                                             Handle<FixedArray> export_wrappers,
-                                             compiler::ModuleEnv* env) {
-  Handle<WasmCompiledModule> compiled_module = WasmCompiledModule::New(
-      isolate, module, export_wrappers, env->use_trap_handler);
-  return compiled_module;
+ModuleEnv CreateDefaultModuleEnv(const WasmModule* module,
+                                 bool allow_trap_handler = true) {
+  UseTrapHandler use_trap_handler =
+      trap_handler::IsTrapHandlerEnabled() && allow_trap_handler
+          ? kUseTrapHandler
+          : kNoTrapHandler;
+  return ModuleEnv(module, use_trap_handler, kRuntimeExceptionSupport);
 }
 
 size_t GetMaxUsableMemorySize(Isolate* isolate) {
@@ -932,40 +480,60 @@ size_t GetMaxUsableMemorySize(Isolate* isolate) {
 // CompilationState when {Commit} is called.
 class CompilationUnitBuilder {
  public:
-  explicit CompilationUnitBuilder(NativeModule* native_module,
-                                  compiler::ModuleEnv* module_env,
-                                  Handle<Code> centry_stub)
+  explicit CompilationUnitBuilder(NativeModule* native_module)
       : native_module_(native_module),
-        compilation_state_(native_module->compilation_state()),
-        module_env_(module_env),
-        centry_stub_(centry_stub) {}
+        compilation_state_(native_module->compilation_state()) {}
 
   void AddUnit(const WasmFunction* function, uint32_t buffer_offset,
                Vector<const uint8_t> bytes, WasmName name) {
-    units_.emplace_back(new compiler::WasmCompilationUnit(
-        compilation_state_->isolate(), module_env_, native_module_,
-        wasm::FunctionBody{function->sig, buffer_offset, bytes.begin(),
-                           bytes.end()},
-        name, function->func_index, centry_stub_,
-        compiler::WasmCompilationUnit::GetDefaultCompilationMode(),
-        compilation_state_->isolate()->async_counters().get()));
+    switch (compilation_state_->compile_mode()) {
+      case CompileMode::kTiering:
+        tiering_units_.emplace_back(
+            CreateUnit(function, buffer_offset, bytes, name,
+                       WasmCompilationUnit::CompilationMode::kTurbofan));
+        baseline_units_.emplace_back(
+            CreateUnit(function, buffer_offset, bytes, name,
+                       WasmCompilationUnit::CompilationMode::kLiftoff));
+        return;
+      case CompileMode::kRegular:
+        baseline_units_.emplace_back(
+            CreateUnit(function, buffer_offset, bytes, name,
+                       WasmCompilationUnit::GetDefaultCompilationMode()));
+        return;
+    }
+    UNREACHABLE();
   }
 
   bool Commit() {
-    if (units_.empty()) return false;
-    compilation_state_->AddCompilationUnits(units_);
-    units_.clear();
+    if (baseline_units_.empty() && tiering_units_.empty()) return false;
+    compilation_state_->AddCompilationUnits(baseline_units_, tiering_units_);
+    Clear();
     return true;
   }
 
-  void Clear() { units_.clear(); }
+  void Clear() {
+    baseline_units_.clear();
+    tiering_units_.clear();
+  }
 
  private:
+  std::unique_ptr<WasmCompilationUnit> CreateUnit(
+      const WasmFunction* function, uint32_t buffer_offset,
+      Vector<const uint8_t> bytes, WasmName name,
+      WasmCompilationUnit::CompilationMode mode) {
+    return base::make_unique<WasmCompilationUnit>(
+        compilation_state_->isolate(), compilation_state_->module_env(),
+        native_module_,
+        wasm::FunctionBody{function->sig, buffer_offset, bytes.begin(),
+                           bytes.end()},
+        name, function->func_index, mode,
+        compilation_state_->isolate()->async_counters().get());
+  }
+
   NativeModule* native_module_;
   CompilationState* compilation_state_;
-  compiler::ModuleEnv* module_env_;
-  Handle<Code> centry_stub_;
-  std::vector<std::unique_ptr<compiler::WasmCompilationUnit>> units_;
+  std::vector<std::unique_ptr<WasmCompilationUnit>> baseline_units_;
+  std::vector<std::unique_ptr<WasmCompilationUnit>> tiering_units_;
 };
 
 // Run by each compilation task and by the main thread (i.e. in both
@@ -978,44 +546,35 @@ bool FetchAndExecuteCompilationUnit(CompilationState* compilation_state) {
   DisallowHandleDereference no_deref;
   DisallowCodeDependencyChange no_dependency_change;
 
-  std::unique_ptr<compiler::WasmCompilationUnit> unit =
+  std::unique_ptr<WasmCompilationUnit> unit =
       compilation_state->GetNextCompilationUnit();
   if (unit == nullptr) return false;
 
+  // TODO(kimanh): We need to find out in which mode the unit
+  // should be compiled in before compiling it, as it might fallback
+  // to Turbofan if it cannot be compiled using Liftoff. This can be removed
+  // later as soon as Liftoff can compile any function. Then, we can directly
+  // access {unit->mode()} within {ScheduleUnitForFinishing()}.
+  WasmCompilationUnit::CompilationMode mode = unit->mode();
   unit->ExecuteCompilation();
-  compilation_state->ScheduleUnitForFinishing(unit);
+  compilation_state->ScheduleUnitForFinishing(std::move(unit), mode);
 
   return true;
 }
 
-size_t GetNumFunctionsToCompile(const std::vector<WasmFunction>& functions,
-                                compiler::ModuleEnv* module_env) {
-  // TODO(kimanh): Remove, FLAG_skip_compiling_wasm_funcs: previously used for
-  // debugging, and now not necessarily working anymore.
-  uint32_t start = module_env->module->num_imported_functions +
-                   FLAG_skip_compiling_wasm_funcs;
-  uint32_t num_funcs = static_cast<uint32_t>(functions.size());
-  uint32_t funcs_to_compile = start > num_funcs ? 0 : num_funcs - start;
-  return funcs_to_compile;
-}
-
-void InitializeCompilationUnits(const std::vector<WasmFunction>& functions,
-                                const ModuleWireBytes& wire_bytes,
-                                compiler::ModuleEnv* module_env,
-                                Handle<Code> centry_stub,
-                                NativeModule* native_module) {
-  uint32_t start = module_env->module->num_imported_functions +
-                   FLAG_skip_compiling_wasm_funcs;
-  uint32_t num_funcs = static_cast<uint32_t>(functions.size());
-
-  CompilationUnitBuilder builder(native_module, module_env, centry_stub);
-  for (uint32_t i = start; i < num_funcs; ++i) {
-    const WasmFunction* func = &functions[i];
+void InitializeCompilationUnits(NativeModule* native_module) {
+  ModuleWireBytes wire_bytes(native_module->wire_bytes());
+  const WasmModule* module = native_module->module();
+  CompilationUnitBuilder builder(native_module);
+  uint32_t start = module->num_imported_functions;
+  uint32_t end = start + module->num_declared_functions;
+  for (uint32_t i = start; i < end; ++i) {
+    const WasmFunction* func = &module->functions[i];
     uint32_t buffer_offset = func->code.offset();
     Vector<const uint8_t> bytes(wire_bytes.start() + func->code.offset(),
                                 func->code.end_offset() - func->code.offset());
 
-    WasmName name = wire_bytes.GetName(func, module_env->module);
+    WasmName name = wire_bytes.GetName(func, module);
     DCHECK_NOT_NULL(native_module);
     builder.AddUnit(func, buffer_offset, bytes, name);
   }
@@ -1026,13 +585,18 @@ void FinishCompilationUnits(CompilationState* compilation_state,
                             ErrorThrower* thrower) {
   while (true) {
     if (compilation_state->failed()) break;
-    std::unique_ptr<compiler::WasmCompilationUnit> unit =
+    std::unique_ptr<WasmCompilationUnit> unit =
         compilation_state->GetNextExecutedUnit();
     if (unit == nullptr) break;
     wasm::WasmCode* result = unit->FinishCompilation(thrower);
 
+    if (thrower->error()) {
+      compilation_state->Abort();
+      break;
+    }
+
     // Update the compilation state.
-    compilation_state->OnFinishedUnit(NotifyCompilationCallback::kNoNotify);
+    compilation_state->OnFinishedUnit();
     DCHECK_IMPLIES(result == nullptr, thrower->error());
     if (result == nullptr) break;
   }
@@ -1042,10 +606,8 @@ void FinishCompilationUnits(CompilationState* compilation_state,
 }
 
 void CompileInParallel(Isolate* isolate, NativeModule* native_module,
-                       const ModuleWireBytes& wire_bytes,
-                       compiler::ModuleEnv* module_env,
-                       Handle<Code> centry_stub, ErrorThrower* thrower) {
-  const WasmModule* module = module_env->module;
+                       Handle<WasmModuleObject> module_object,
+                       ErrorThrower* thrower) {
   // Data structures for the parallel compilation.
 
   //-----------------------------------------------------------------------
@@ -1058,12 +620,15 @@ void CompileInParallel(Isolate* isolate, NativeModule* native_module,
   // 2.a) The background threads and the main thread pick one compilation
   //      unit at a time and execute the parallel phase of the compilation
   //      unit. After finishing the execution of the parallel phase, the
-  //      result is enqueued in {executed_units}.
-  // 2.b) If {executed_units} contains a compilation unit, the main thread
-  //      dequeues it and finishes the compilation.
+  //      result is enqueued in {baseline_finish_units_}.
+  // 2.b) If {baseline_finish_units_} contains a compilation unit, the main
+  //      thread dequeues it and finishes the compilation.
   // 3) After the parallel phase of all compilation units has started, the
-  //    main thread waits for all {BackgroundCompileTasks} instances to finish.
-  // 4) The main thread finishes the compilation.
+  //    main thread continues to finish all compilation units as long as
+  //    baseline-compilation units are left to be processed.
+  // 4) If tier-up is enabled, the main thread restarts background tasks
+  //    that take care of compiling and finishing the top-tier compilation
+  //    units.
 
   // Turn on the {CanonicalHandleScope} so that the background threads can
   // use the node cache.
@@ -1074,63 +639,68 @@ void CompileInParallel(Isolate* isolate, NativeModule* native_module,
   // the compilation units. This foreground thread will be
   // responsible for finishing compilation.
   compilation_state->SetFinisherIsRunning(true);
-  size_t functions_count =
-      GetNumFunctionsToCompile(module->functions, module_env);
-  compilation_state->SetNumberOfFunctionsToCompile(functions_count);
+  uint32_t num_wasm_functions =
+      native_module->num_functions() - native_module->num_imported_functions();
+  compilation_state->SetNumberOfFunctionsToCompile(num_wasm_functions);
 
   // 1) The main thread allocates a compilation unit for each wasm function
   //    and stores them in the vector {compilation_units} within the
   //    {compilation_state}. By adding units to the {compilation_state}, new
   //    {BackgroundCompileTask} instances are spawned which run on
   //    background threads.
-  InitializeCompilationUnits(module->functions, wire_bytes, module_env,
-                             centry_stub, native_module);
+  InitializeCompilationUnits(native_module);
 
   // 2.a) The background threads and the main thread pick one compilation
   //      unit at a time and execute the parallel phase of the compilation
   //      unit. After finishing the execution of the parallel phase, the
-  //      result is enqueued in {executed_units}.
+  //      result is enqueued in {baseline_finish_units_}.
   //      The foreground task bypasses waiting on memory threshold, because
   //      its results will immediately be converted to code (below).
-  while (FetchAndExecuteCompilationUnit(compilation_state)) {
-    // 2.b) If {executed_units} contains a compilation unit, the main thread
-    //      dequeues it and finishes the compilation unit. Compilation units
-    //      are finished concurrently to the background threads to save
+  while (FetchAndExecuteCompilationUnit(compilation_state) &&
+         !compilation_state->baseline_compilation_finished()) {
+    // 2.b) If {baseline_finish_units_} contains a compilation unit, the main
+    //      thread dequeues it and finishes the compilation unit. Compilation
+    //      units are finished concurrently to the background threads to save
     //      memory.
     FinishCompilationUnits(compilation_state, thrower);
 
     if (compilation_state->failed()) break;
   }
 
-  // 3) After the parallel phase of all compilation units has started, the
-  //    main thread waits for all {BackgroundCompileTasks} instances to finish -
-  //    which happens once they all realize there's no next work item to
-  //    process. If compilation already failed, all background tasks have
-  //    already been canceled in {FinishCompilationUnits}, and there are
-  //    no units to finish.
-  if (!compilation_state->failed()) {
-    compilation_state->CancelAndWait();
-
-    // 4) Finish all compilation units which have been executed while we waited.
+  while (!compilation_state->failed()) {
+    // 3) After the parallel phase of all compilation units has started, the
+    //    main thread continues to finish compilation units as long as
+    //    baseline compilation units are left to be processed. If compilation
+    //    already failed, all background tasks have already been canceled
+    //    in {FinishCompilationUnits}, and there are no units to finish.
     FinishCompilationUnits(compilation_state, thrower);
+
+    if (compilation_state->baseline_compilation_finished()) break;
+  }
+
+  // 4) If tiering-compilation is enabled, we need to set the finisher
+  //    to false, such that the background threads will spawn a foreground
+  //    thread to finish the top-tier compilation units.
+  if (!compilation_state->failed() &&
+      compilation_state->compile_mode() == CompileMode::kTiering) {
+    compilation_state->SetFinisherIsRunning(false);
+    compilation_state->RestartBackgroundTasks();
   }
 }
 
 void CompileSequentially(Isolate* isolate, NativeModule* native_module,
-                         const ModuleWireBytes& wire_bytes,
-                         compiler::ModuleEnv* module_env,
-                         ErrorThrower* thrower) {
+                         ModuleEnv* module_env, ErrorThrower* thrower) {
   DCHECK(!thrower->error());
 
+  ModuleWireBytes wire_bytes(native_module->wire_bytes());
   const WasmModule* module = module_env->module;
-  for (uint32_t i = FLAG_skip_compiling_wasm_funcs;
-       i < module->functions.size(); ++i) {
+  for (uint32_t i = 0; i < module->functions.size(); ++i) {
     const WasmFunction& func = module->functions[i];
     if (func.imported) continue;  // Imports are compiled at instantiation time.
 
     // Compile the function.
-    wasm::WasmCode* code = compiler::WasmCompilationUnit::CompileWasmFunction(
-        native_module, thrower, isolate, wire_bytes, module_env, &func);
+    wasm::WasmCode* code = WasmCompilationUnit::CompileWasmFunction(
+        native_module, thrower, isolate, module_env, &func);
     if (code == nullptr) {
       TruncatedUserString<> name(wire_bytes.GetName(&func, module));
       thrower->CompileError("Compilation of #%d:%.*s failed.", i, name.length(),
@@ -1140,21 +710,22 @@ void CompileSequentially(Isolate* isolate, NativeModule* native_module,
   }
 }
 
-void ValidateSequentially(Isolate* isolate, const ModuleWireBytes& wire_bytes,
-                          compiler::ModuleEnv* module_env,
+void ValidateSequentially(Isolate* isolate, NativeModule* native_module,
                           ErrorThrower* thrower) {
   DCHECK(!thrower->error());
 
-  const WasmModule* module = module_env->module;
-  for (uint32_t i = 0; i < module->functions.size(); ++i) {
+  ModuleWireBytes wire_bytes(native_module->wire_bytes());
+  const WasmModule* module = native_module->module();
+  uint32_t start = module->num_imported_functions;
+  uint32_t end = start + module->num_declared_functions;
+  for (uint32_t i = start; i < end; ++i) {
     const WasmFunction& func = module->functions[i];
-    if (func.imported) continue;
 
     const byte* base = wire_bytes.start();
     FunctionBody body{func.sig, func.code.offset(), base + func.code.offset(),
                       base + func.code.end_offset()};
     DecodeResult result = VerifyWasmCodeWithStats(
-        isolate->allocator(), module, body, module->is_wasm(),
+        isolate->allocator(), module, body, module->origin,
         isolate->async_counters().get());
     if (result.failed()) {
       TruncatedUserString<> name(wire_bytes.GetName(&func, module));
@@ -1166,89 +737,22 @@ void ValidateSequentially(Isolate* isolate, const ModuleWireBytes& wire_bytes,
   }
 }
 
-MaybeHandle<WasmModuleObject> CompileToModuleObjectInternal(
-    Isolate* isolate, ErrorThrower* thrower, std::unique_ptr<WasmModule> module,
-    const ModuleWireBytes& wire_bytes, Handle<Script> asm_js_script,
-    Vector<const byte> asm_js_offset_table_bytes) {
-  WasmModule* wasm_module = module.get();
-  Handle<Code> centry_stub = CEntryStub(isolate, 1).GetCode();
-  TimedHistogramScope wasm_compile_module_time_scope(
-      wasm_module->is_wasm()
-          ? isolate->async_counters()->wasm_compile_wasm_module_time()
-          : isolate->async_counters()->wasm_compile_asm_module_time());
-  // TODO(6792): No longer needed once WebAssembly code is off heap. Use
-  // base::Optional to be able to close the scope before notifying the debugger.
-  base::Optional<CodeSpaceMemoryModificationScope> modification_scope(
-      base::in_place_t(), isolate->heap());
-
-  // Check whether lazy compilation is enabled for this module.
-  bool lazy_compile = compile_lazy(wasm_module);
-
-  Factory* factory = isolate->factory();
-  // Create heap objects for script, module bytes and asm.js offset table to
-  // be stored in the shared module data.
-  Handle<Script> script;
-  Handle<ByteArray> asm_js_offset_table;
-  if (asm_js_script.is_null()) {
-    script = CreateWasmScript(isolate, wire_bytes);
-  } else {
-    script = asm_js_script;
-    asm_js_offset_table =
-        isolate->factory()->NewByteArray(asm_js_offset_table_bytes.length());
-    asm_js_offset_table->copy_in(0, asm_js_offset_table_bytes.start(),
-                                 asm_js_offset_table_bytes.length());
-  }
-  // TODO(wasm): only save the sections necessary to deserialize a
-  // {WasmModule}. E.g. function bodies could be omitted.
-  Handle<String> module_bytes =
-      factory
-          ->NewStringFromOneByte({wire_bytes.start(), wire_bytes.length()},
-                                 TENURED)
-          .ToHandleChecked();
-  DCHECK(module_bytes->IsSeqOneByteString());
-
-  // The {module_wrapper} will take ownership of the {WasmModule} object,
-  // and it will be destroyed when the GC reclaims the wrapper object.
-  Handle<WasmModuleWrapper> module_wrapper =
-      WasmModuleWrapper::From(isolate, module.release());
-
-  // Create the shared module data.
-  // TODO(clemensh): For the same module (same bytes / same hash), we should
-  // only have one WasmSharedModuleData. Otherwise, we might only set
-  // breakpoints on a (potentially empty) subset of the instances.
-
-  Handle<WasmSharedModuleData> shared = WasmSharedModuleData::New(
-      isolate, module_wrapper, Handle<SeqOneByteString>::cast(module_bytes),
-      script, asm_js_offset_table);
-
-  int export_wrappers_size =
-      static_cast<int>(wasm_module->num_exported_functions);
-  Handle<FixedArray> export_wrappers =
-      factory->NewFixedArray(static_cast<int>(export_wrappers_size), TENURED);
-  Handle<Code> init_builtin = BUILTIN_CODE(isolate, Illegal);
-  for (int i = 0, e = export_wrappers->length(); i < e; ++i) {
-    export_wrappers->set(i, *init_builtin);
-  }
-  auto env = CreateDefaultModuleEnv(isolate, wasm_module);
+void CompileNativeModule(Isolate* isolate, ErrorThrower* thrower,
+                         Handle<WasmModuleObject> module_object,
+                         const WasmModule* wasm_module, ModuleEnv* env) {
+  NativeModule* const native_module = module_object->native_module();
+  ModuleWireBytes wire_bytes(native_module->wire_bytes());
 
-  // Create the compiled module object and populate with compiled functions
-  // and information needed at instantiation time. This object needs to be
-  // serializable. Instantiation may occur off a deserialized version of this
-  // object.
-  Handle<WasmCompiledModule> compiled_module =
-      NewCompiledModule(isolate, shared->module(), export_wrappers, env.get());
-  NativeModule* native_module = compiled_module->GetNativeModule();
-  compiled_module->set_shared(*shared);
-  if (lazy_compile) {
-    if (wasm_module->is_wasm()) {
+  if (compile_lazy(wasm_module)) {
+    if (wasm_module->origin == kWasmOrigin) {
       // Validate wasm modules for lazy compilation. Don't validate asm.js
       // modules, they are valid by construction (otherwise a CHECK will fail
       // during lazy compilation).
       // TODO(clemensh): According to the spec, we can actually skip validation
       // at module creation time, and return a function that always traps at
       // (lazy) compilation time.
-      ValidateSequentially(isolate, wire_bytes, env.get(), thrower);
-      if (thrower->error()) return {};
+      ValidateSequentially(isolate, native_module, thrower);
+      if (thrower->error()) return;
     }
 
     native_module->SetLazyBuiltin(BUILTIN_CODE(isolate, WasmCompileLazy));
@@ -1261,35 +765,14 @@ MaybeHandle<WasmModuleObject> CompileToModuleObjectInternal(
         V8::GetCurrentPlatform()->NumberOfWorkerThreads() > 0;
 
     if (compile_parallel) {
-      CompileInParallel(isolate, native_module, wire_bytes, env.get(),
-                        centry_stub, thrower);
+      CompileInParallel(isolate, native_module, module_object, thrower);
     } else {
-      CompileSequentially(isolate, native_module, wire_bytes, env.get(),
-                          thrower);
+      CompileSequentially(isolate, native_module, env, thrower);
     }
-    if (thrower->error()) return {};
+    if (thrower->error()) return;
 
-    RecordStats(native_module, isolate->async_counters().get());
+    RecordStats(native_module, isolate->counters());
   }
-
-  // Compile JS->wasm wrappers for exported functions.
-  CompileJsToWasmWrappers(isolate, compiled_module,
-                          isolate->async_counters().get());
-
-  Handle<WasmModuleObject> result =
-      WasmModuleObject::New(isolate, compiled_module);
-
-  // If we created a wasm script, finish it now and make it public to the
-  // debugger.
-  if (asm_js_script.is_null()) {
-    // Close the CodeSpaceMemoryModificationScope before calling into the
-    // debugger.
-    modification_scope.reset();
-    script->set_wasm_compiled_module(*compiled_module);
-    isolate->debug()->OnAfterCompile(script);
-  }
-
-  return result;
 }
 
 // The runnable task that finishes compilation in foreground (e.g. updating
@@ -1317,7 +800,7 @@ class FinishCompileTask : public CancelableTask {
     while (true) {
       compilation_state_->RestartBackgroundTasks();
 
-      std::unique_ptr<compiler::WasmCompilationUnit> unit =
+      std::unique_ptr<WasmCompilationUnit> unit =
           compilation_state_->GetNextExecutedUnit();
 
       if (unit == nullptr) {
@@ -1337,19 +820,29 @@ class FinishCompileTask : public CancelableTask {
 
       if (thrower.error()) {
         DCHECK_NULL(result);
-        USE(result);
-        SaveContext saved_context(isolate);
-        isolate->set_context(
-            unit->native_module()->compiled_module()->native_context());
-        Handle<Object> error = thrower.Reify();
-        compilation_state_->OnError(error, NotifyCompilationCallback::kNotify);
+        compilation_state_->OnError(&thrower);
         compilation_state_->SetFinisherIsRunning(false);
+        thrower.Reset();
         break;
       }
 
+      if (compilation_state_->baseline_compilation_finished()) {
+        // If Liftoff compilation finishes it will directly start executing.
+        // As soon as we have Turbofan-compiled code available, it will
+        // directly be used by Liftoff-compiled code via the jump table.
+        DCHECK_EQ(CompileMode::kTiering, compilation_state_->compile_mode());
+        DCHECK(!result->is_liftoff());
+
+        if (wasm::WasmCode::ShouldBeLogged(isolate)) result->LogCode(isolate);
+
+        // Update the counters to include the top-tier code.
+        RecordStats(result,
+                    compilation_state_->isolate()->async_counters().get());
+      }
+
       // Update the compilation state, and possibly notify
       // threads waiting for events.
-      compilation_state_->OnFinishedUnit(NotifyCompilationCallback::kNotify);
+      compilation_state_->OnFinishedUnit();
 
       if (deadline < MonotonicallyIncreasingTimeInMs()) {
         // We reached the deadline. We reschedule this task and return
@@ -1392,12 +885,69 @@ class BackgroundCompileTask : public CancelableTask {
 }  // namespace
 
 MaybeHandle<WasmModuleObject> CompileToModuleObject(
-    Isolate* isolate, ErrorThrower* thrower, std::unique_ptr<WasmModule> module,
-    const ModuleWireBytes& wire_bytes, Handle<Script> asm_js_script,
+    Isolate* isolate, ErrorThrower* thrower,
+    std::shared_ptr<const WasmModule> module, const ModuleWireBytes& wire_bytes,
+    Handle<Script> asm_js_script,
     Vector<const byte> asm_js_offset_table_bytes) {
-  return CompileToModuleObjectInternal(isolate, thrower, std::move(module),
-                                       wire_bytes, asm_js_script,
-                                       asm_js_offset_table_bytes);
+  const WasmModule* wasm_module = module.get();
+  TimedHistogramScope wasm_compile_module_time_scope(SELECT_WASM_COUNTER(
+      isolate->counters(), wasm_module->origin, wasm_compile, module_time));
+  // TODO(6792): No longer needed once WebAssembly code is off heap. Use
+  // base::Optional to be able to close the scope before notifying the debugger.
+  base::Optional<CodeSpaceMemoryModificationScope> modification_scope(
+      base::in_place_t(), isolate->heap());
+
+  // Create heap objects for script, module bytes and asm.js offset table to
+  // be stored in the module object.
+  Handle<Script> script;
+  Handle<ByteArray> asm_js_offset_table;
+  if (asm_js_script.is_null()) {
+    script = CreateWasmScript(isolate, wire_bytes);
+  } else {
+    script = asm_js_script;
+    asm_js_offset_table =
+        isolate->factory()->NewByteArray(asm_js_offset_table_bytes.length());
+    asm_js_offset_table->copy_in(0, asm_js_offset_table_bytes.start(),
+                                 asm_js_offset_table_bytes.length());
+  }
+  // TODO(wasm): only save the sections necessary to deserialize a
+  // {WasmModule}. E.g. function bodies could be omitted.
+  OwnedVector<uint8_t> wire_bytes_copy =
+      OwnedVector<uint8_t>::Of(wire_bytes.module_bytes());
+
+  // Create the module object.
+  // TODO(clemensh): For the same module (same bytes / same hash), we should
+  // only have one WasmModuleObject. Otherwise, we might only set
+  // breakpoints on a (potentially empty) subset of the instances.
+
+  ModuleEnv env = CreateDefaultModuleEnv(wasm_module);
+
+  // Create the compiled module object and populate with compiled functions
+  // and information needed at instantiation time. This object needs to be
+  // serializable. Instantiation may occur off a deserialized version of this
+  // object.
+  Handle<WasmModuleObject> module_object = WasmModuleObject::New(
+      isolate, std::move(module), env, std::move(wire_bytes_copy), script,
+      asm_js_offset_table);
+  CompileNativeModule(isolate, thrower, module_object, wasm_module, &env);
+  if (thrower->error()) return {};
+
+  // Compile JS->wasm wrappers for exported functions.
+  CompileJsToWasmWrappers(isolate, module_object);
+
+  // If we created a wasm script, finish it now and make it public to the
+  // debugger.
+  if (asm_js_script.is_null()) {
+    // Close the CodeSpaceMemoryModificationScope before calling into the
+    // debugger.
+    modification_scope.reset();
+    isolate->debug()->OnAfterCompile(script);
+  }
+
+  // Log the code within the generated module for profiling.
+  module_object->native_module()->LogWasmCodes(isolate);
+
+  return module_object;
 }
 
 InstanceBuilder::InstanceBuilder(Isolate* isolate, ErrorThrower* thrower,
@@ -1405,8 +955,7 @@ InstanceBuilder::InstanceBuilder(Isolate* isolate, ErrorThrower* thrower,
                                  MaybeHandle<JSReceiver> ffi,
                                  MaybeHandle<JSArrayBuffer> memory)
     : isolate_(isolate),
-      module_(module_object->compiled_module()->shared()->module()),
-      async_counters_(isolate->async_counters()),
+      module_(module_object->module()),
       thrower_(thrower),
       module_object_(module_object),
       ffi_(ffi),
@@ -1432,82 +981,104 @@ MaybeHandle<WasmInstanceObject> InstanceBuilder::Build() {
   // From here on, we expect the build pipeline to run without exiting to JS.
   DisallowJavascriptExecution no_js(isolate_);
   // Record build time into correct bucket, then build instance.
-  TimedHistogramScope wasm_instantiate_module_time_scope(
-      module_->is_wasm() ? counters()->wasm_instantiate_wasm_module_time()
-                         : counters()->wasm_instantiate_asm_module_time());
-  Factory* factory = isolate_->factory();
+  TimedHistogramScope wasm_instantiate_module_time_scope(SELECT_WASM_COUNTER(
+      isolate_->counters(), module_->origin, wasm_instantiate, module_time));
 
   //--------------------------------------------------------------------------
-  // Reuse the compiled module (if no owner), otherwise clone.
+  // Allocate the memory array buffer.
   //--------------------------------------------------------------------------
-  Handle<FixedArray> export_wrappers;
-  wasm::NativeModule* native_module = nullptr;
-  // Root the old instance, if any, in case later allocation causes GC,
-  // to prevent the finalizer running for the old instance.
-  MaybeHandle<WasmInstanceObject> old_instance;
-
-  TRACE("Starting new module instantiation\n");
-  Handle<WasmCompiledModule> original =
-      handle(module_object_->compiled_module());
-  {
-    if (original->has_instance()) {
-      old_instance = handle(original->owning_instance());
-      // Clone, but don't insert yet the clone in the instances chain.
-      // We do that last. Since we are holding on to the old instance,
-      // the owner + original state used for cloning and patching
-      // won't be mutated by possible finalizer runs.
-      TRACE("Cloning from %zu\n", original->GetNativeModule()->instance_id);
-      compiled_module_ = WasmCompiledModule::Clone(isolate_, original);
-      native_module = compiled_module_->GetNativeModule();
-      export_wrappers = handle(compiled_module_->export_wrappers(), isolate_);
-      for (int i = 0; i < export_wrappers->length(); ++i) {
-        Handle<Code> orig_code(Code::cast(export_wrappers->get(i)), isolate_);
-        DCHECK_EQ(orig_code->kind(), Code::JS_TO_WASM_FUNCTION);
-        Handle<Code> code = factory->CopyCode(orig_code);
-        export_wrappers->set(i, *code);
+  // We allocate the memory buffer before cloning or reusing the compiled module
+  // so we will know whether we need to recompile with bounds checks.
+  uint32_t initial_pages = module_->initial_pages;
+  auto initial_pages_counter = SELECT_WASM_COUNTER(
+      isolate_->counters(), module_->origin, wasm, min_mem_pages_count);
+  initial_pages_counter->AddSample(initial_pages);
+  // Asm.js has memory_ already set at this point, so we don't want to
+  // overwrite it.
+  if (memory_.is_null()) {
+    memory_ = FindImportedMemoryBuffer();
+  }
+  if (!memory_.is_null()) {
+    // Set externally passed ArrayBuffer non neuterable.
+    Handle<JSArrayBuffer> memory = memory_.ToHandleChecked();
+    memory->set_is_neuterable(false);
+
+    DCHECK_IMPLIES(use_trap_handler(),
+                   module_->origin == kAsmJsOrigin ||
+                       memory->is_wasm_memory() ||
+                       memory->backing_store() == nullptr ||
+                       // TODO(836800) Remove once is_wasm_memory transfers over
+                       // post-message.
+                       (FLAG_experimental_wasm_threads && memory->is_shared()));
+  } else if (initial_pages > 0 || use_trap_handler()) {
+    // We need to unconditionally create a guard region if using trap handlers,
+    // even when the size is zero to prevent null-dereference issues
+    // (e.g. https://crbug.com/769637).
+    // Allocate memory if the initial size is more than 0 pages.
+    memory_ = AllocateMemory(initial_pages);
+    if (memory_.is_null()) return {};  // failed to allocate memory
+  }
+
+  //--------------------------------------------------------------------------
+  // Recompile module if using trap handlers but could not get guarded memory
+  //--------------------------------------------------------------------------
+  if (module_->origin == kWasmOrigin && use_trap_handler()) {
+    // Make sure the memory has suitable guard regions.
+    WasmMemoryTracker* const memory_tracker =
+        isolate_->wasm_engine()->memory_tracker();
+
+    if (!memory_tracker->HasFullGuardRegions(
+            memory_.ToHandleChecked()->backing_store())) {
+      if (!FLAG_wasm_trap_handler_fallback) {
+        return {};
       }
-      RecordStats(native_module, counters());
-      RecordStats(export_wrappers, counters());
-    } else {
-      // No instance owned the original compiled module.
-      compiled_module_ = original;
-      export_wrappers = handle(compiled_module_->export_wrappers(), isolate_);
-      native_module = compiled_module_->GetNativeModule();
-      TRACE("Reusing existing instance %zu\n",
-            compiled_module_->GetNativeModule()->instance_id);
+
+      TRACE("Recompiling module without bounds checks\n");
+      constexpr bool allow_trap_handler = false;
+      ModuleEnv env = CreateDefaultModuleEnv(module_, allow_trap_handler);
+      // Disable trap handlers on this native module.
+      NativeModule* native_module = module_object_->native_module();
+      native_module->DisableTrapHandler();
+
+      // Recompile all functions in this native module.
+      ErrorThrower thrower(isolate_, "recompile");
+      CompileNativeModule(isolate_, &thrower, module_object_, module_, &env);
+      if (thrower.error()) {
+        return {};
+      }
+      DCHECK(!native_module->use_trap_handler());
     }
-    Handle<WeakCell> weak_native_context =
-        isolate_->factory()->NewWeakCell(isolate_->native_context());
-    compiled_module_->set_weak_native_context(*weak_native_context);
-  }
-  base::Optional<wasm::NativeModuleModificationScope>
-      native_module_modification_scope;
-  if (native_module != nullptr) {
-    native_module_modification_scope.emplace(native_module);
   }
 
   //--------------------------------------------------------------------------
   // Create the WebAssembly.Instance object.
   //--------------------------------------------------------------------------
-  CodeSpecialization code_specialization;
+  wasm::NativeModule* native_module = module_object_->native_module();
+  TRACE("New module instantiation for %p\n", native_module);
   Handle<WasmInstanceObject> instance =
-      WasmInstanceObject::New(isolate_, compiled_module_);
-  Handle<WeakCell> weak_instance = factory->NewWeakCell(instance);
-  Handle<WeakCell> old_weak_instance(original->weak_owning_instance(),
-                                     isolate_);
-  code_specialization.UpdateInstanceReferences(old_weak_instance,
-                                               weak_instance);
-  js_to_wasm_cache_.SetWeakInstance(weak_instance);
+      WasmInstanceObject::New(isolate_, module_object_);
+  wasm::NativeModuleModificationScope native_modification_scope(native_module);
 
   //--------------------------------------------------------------------------
   // Set up the globals for the new instance.
   //--------------------------------------------------------------------------
   MaybeHandle<JSArrayBuffer> old_globals;
-  uint32_t globals_size = module_->globals_size;
-  if (globals_size > 0) {
-    constexpr bool enable_guard_regions = false;
-    if (!NewArrayBuffer(isolate_, globals_size, enable_guard_regions)
-             .ToHandle(&globals_)) {
+  uint32_t globals_buffer_size = module_->globals_buffer_size;
+  if (globals_buffer_size > 0) {
+    void* backing_store =
+        isolate_->array_buffer_allocator()->Allocate(globals_buffer_size);
+    if (backing_store == nullptr) {
+      thrower_->RangeError("Out of memory: wasm globals");
+      return {};
+    }
+    globals_ =
+        isolate_->factory()->NewJSArrayBuffer(SharedFlag::kNotShared, TENURED);
+    constexpr bool is_external = false;
+    constexpr bool is_wasm_memory = false;
+    JSArrayBuffer::Setup(globals_, isolate_, is_external, backing_store,
+                         globals_buffer_size, SharedFlag::kNotShared,
+                         is_wasm_memory);
+    if (globals_.is_null()) {
       thrower_->RangeError("Out of memory: wasm globals");
       return {};
     }
@@ -1517,14 +1088,24 @@ MaybeHandle<WasmInstanceObject> InstanceBuilder::Build() {
   }
 
   //--------------------------------------------------------------------------
-  // Reserve the metadata for indirect function tables.
+  // Set up the array of references to imported globals' array buffers.
   //--------------------------------------------------------------------------
-  int function_table_count = static_cast<int>(module_->function_tables.size());
-  table_instances_.reserve(module_->function_tables.size());
-  for (int index = 0; index < function_table_count; ++index) {
-    table_instances_.emplace_back();
+  if (module_->num_imported_mutable_globals > 0) {
+    DCHECK(FLAG_experimental_wasm_mut_global);
+    // TODO(binji): This allocates one slot for each mutable global, which is
+    // more than required if multiple globals are imported from the same
+    // module.
+    Handle<FixedArray> buffers_array = isolate_->factory()->NewFixedArray(
+        module_->num_imported_mutable_globals, TENURED);
+    instance->set_imported_mutable_globals_buffers(*buffers_array);
   }
 
+  //--------------------------------------------------------------------------
+  // Reserve the metadata for indirect function tables.
+  //--------------------------------------------------------------------------
+  int table_count = static_cast<int>(module_->tables.size());
+  table_instances_.resize(table_count);
+
   //--------------------------------------------------------------------------
   // Process the imports for the module.
   //--------------------------------------------------------------------------
@@ -1539,33 +1120,8 @@ MaybeHandle<WasmInstanceObject> InstanceBuilder::Build() {
   //--------------------------------------------------------------------------
   // Initialize the indirect tables.
   //--------------------------------------------------------------------------
-  if (function_table_count > 0) {
-    InitializeTables(instance, &code_specialization);
-  }
-
-  //--------------------------------------------------------------------------
-  // Allocate the memory array buffer.
-  //--------------------------------------------------------------------------
-  uint32_t initial_pages = module_->initial_pages;
-  (module_->is_wasm() ? counters()->wasm_wasm_min_mem_pages_count()
-                      : counters()->wasm_asm_min_mem_pages_count())
-      ->AddSample(initial_pages);
-
-  if (!memory_.is_null()) {
-    // Set externally passed ArrayBuffer non neuterable.
-    Handle<JSArrayBuffer> memory = memory_.ToHandleChecked();
-    memory->set_is_neuterable(false);
-
-    DCHECK_IMPLIES(use_trap_handler(), module_->is_asm_js() ||
-                                           memory->is_wasm_memory() ||
-                                           memory->backing_store() == nullptr);
-  } else if (initial_pages > 0 || use_trap_handler()) {
-    // We need to unconditionally create a guard region if using trap handlers,
-    // even when the size is zero to prevent null-derefence issues
-    // (e.g. https://crbug.com/769637).
-    // Allocate memory if the initial size is more than 0 pages.
-    memory_ = AllocateMemory(initial_pages);
-    if (memory_.is_null()) return {};  // failed to allocate memory
+  if (table_count > 0) {
+    InitializeTables(instance);
   }
 
   //--------------------------------------------------------------------------
@@ -1597,7 +1153,7 @@ MaybeHandle<WasmInstanceObject> InstanceBuilder::Build() {
   //--------------------------------------------------------------------------
   // Check that indirect function table segments are within bounds.
   //--------------------------------------------------------------------------
-  for (WasmTableInit& table_init : module_->table_inits) {
+  for (const WasmTableInit& table_init : module_->table_inits) {
     DCHECK(table_init.table_index < table_instances_.size());
     uint32_t base = EvalUint32InitExpr(table_init.offset);
     size_t table_size = table_instances_[table_init.table_index].table_size;
@@ -1610,7 +1166,7 @@ MaybeHandle<WasmInstanceObject> InstanceBuilder::Build() {
   //--------------------------------------------------------------------------
   // Check that memory segments are within bounds.
   //--------------------------------------------------------------------------
-  for (WasmDataSegment& seg : module_->data_segments) {
+  for (const WasmDataSegment& seg : module_->data_segments) {
     uint32_t base = EvalUint32InitExpr(seg.dest_addr);
     if (!in_bounds(base, seg.source.length(), instance->memory_size())) {
       thrower_->LinkError("data segment is out of bounds");
@@ -1621,13 +1177,13 @@ MaybeHandle<WasmInstanceObject> InstanceBuilder::Build() {
   //--------------------------------------------------------------------------
   // Set up the exports object for the new instance.
   //--------------------------------------------------------------------------
-  ProcessExports(instance, compiled_module_);
+  ProcessExports(instance);
   if (thrower_->error()) return {};
 
   //--------------------------------------------------------------------------
   // Initialize the indirect function tables.
   //--------------------------------------------------------------------------
-  if (function_table_count > 0) {
+  if (table_count > 0) {
     LoadTableSegments(instance);
   }
 
@@ -1638,42 +1194,18 @@ MaybeHandle<WasmInstanceObject> InstanceBuilder::Build() {
     LoadDataSegments(instance);
   }
 
-  // Patch all code with the relocations registered in code_specialization.
-  code_specialization.RelocateDirectCalls(native_module);
-  code_specialization.ApplyToWholeModule(native_module, SKIP_ICACHE_FLUSH);
-
-  FlushICache(native_module);
-  FlushICache(export_wrappers);
-
-  //--------------------------------------------------------------------------
-  // Unpack and notify signal handler of protected instructions.
-  //--------------------------------------------------------------------------
-  if (use_trap_handler()) {
-    native_module->UnpackAndRegisterProtectedInstructions();
-  }
-
   //--------------------------------------------------------------------------
-  // Insert the compiled module into the weak list of compiled modules.
+  // Install a finalizer on the new instance object.
   //--------------------------------------------------------------------------
-  {
-    if (!old_instance.is_null()) {
-      // Publish the new instance to the instances chain.
-      DisallowHeapAllocation no_gc;
-      compiled_module_->InsertInChain(*module_object_);
-    }
-    module_object_->set_compiled_module(*compiled_module_);
-    compiled_module_->set_weak_owning_instance(*weak_instance);
-    WasmInstanceObject::InstallFinalizer(isolate_, instance);
-  }
+  WasmInstanceObject::InstallFinalizer(isolate_, instance);
 
   //--------------------------------------------------------------------------
   // Debugging support.
   //--------------------------------------------------------------------------
   // Set all breakpoints that were set on the shared module.
-  WasmSharedModuleData::SetBreakpointsOnNewInstance(
-      handle(compiled_module_->shared(), isolate_), instance);
+  WasmModuleObject::SetBreakpointsOnNewInstance(module_object_, instance);
 
-  if (FLAG_wasm_interpret_all && module_->is_wasm()) {
+  if (FLAG_wasm_interpret_all && module_->origin == kWasmOrigin) {
     Handle<WasmDebugInfo> debug_info =
         WasmInstanceObject::GetOrCreateDebugInfo(instance);
     std::vector<int> func_indexes;
@@ -1692,22 +1224,19 @@ MaybeHandle<WasmInstanceObject> InstanceBuilder::Build() {
   //--------------------------------------------------------------------------
   if (module_->start_function_index >= 0) {
     int start_index = module_->start_function_index;
-    wasm::WasmCode* start_code =
-        native_module->GetIndirectlyCallableCode(start_index);
     FunctionSig* sig = module_->functions[start_index].sig;
-    Handle<Code> wrapper_code = js_to_wasm_cache_.CloneOrCompileJSToWasmWrapper(
-        isolate_, module_, start_code, start_index,
-        compiled_module_->use_trap_handler());
+    Handle<Code> wrapper_code = js_to_wasm_cache_.GetOrCompileJSToWasmWrapper(
+        isolate_, native_module, start_index, use_trap_handler());
+    // TODO(clemensh): Don't generate an exported function for the start
+    // function. Use CWasmEntry instead.
     start_function_ = WasmExportedFunction::New(
         isolate_, instance, MaybeHandle<String>(), start_index,
         static_cast<int>(sig->parameter_count()), wrapper_code);
-    RecordStats(start_code, counters());
   }
 
   DCHECK(!isolate_->has_pending_exception());
-  TRACE("Successfully built instance %zu\n",
-        compiled_module_->GetNativeModule()->instance_id);
-  TRACE_CHAIN(module_object_->compiled_module());
+  TRACE("Successfully built instance for module %p\n",
+        module_object_->native_module());
   return instance;
 }
 
@@ -1813,8 +1342,8 @@ uint32_t InstanceBuilder::EvalUint32InitExpr(const WasmInitExpr& expr) {
 
 // Load data segments into the memory.
 void InstanceBuilder::LoadDataSegments(Handle<WasmInstanceObject> instance) {
-  Handle<SeqOneByteString> module_bytes(
-      compiled_module_->shared()->module_bytes(), isolate_);
+  Vector<const uint8_t> wire_bytes =
+      module_object_->native_module()->wire_bytes();
   for (const WasmDataSegment& segment : module_->data_segments) {
     uint32_t source_size = segment.source.length();
     // Segments of size == 0 are just nops.
@@ -1822,18 +1351,15 @@ void InstanceBuilder::LoadDataSegments(Handle<WasmInstanceObject> instance) {
     uint32_t dest_offset = EvalUint32InitExpr(segment.dest_addr);
     DCHECK(in_bounds(dest_offset, source_size, instance->memory_size()));
     byte* dest = instance->memory_start() + dest_offset;
-    const byte* src = reinterpret_cast<const byte*>(
-        module_bytes->GetCharsAddress() + segment.source.offset());
+    const byte* src = wire_bytes.start() + segment.source.offset();
     memcpy(dest, src, source_size);
   }
 }
 
-void InstanceBuilder::WriteGlobalValue(WasmGlobal& global,
-                                       Handle<Object> value) {
-  double num = value->Number();
+void InstanceBuilder::WriteGlobalValue(const WasmGlobal& global, double num) {
   TRACE("init [globals_start=%p + %u] = %lf, type = %s\n",
         reinterpret_cast<void*>(raw_buffer_ptr(globals_, 0)), global.offset,
-        num, WasmOpcodes::TypeName(global.type));
+        num, ValueTypes::TypeName(global.type));
   switch (global.type) {
     case kWasmI32:
       *GetRawGlobalPtr<int32_t>(global) = static_cast<int32_t>(num);
@@ -1853,16 +1379,52 @@ void InstanceBuilder::WriteGlobalValue(WasmGlobal& global,
   }
 }
 
+void InstanceBuilder::WriteGlobalValue(const WasmGlobal& global,
+                                       Handle<WasmGlobalObject> value) {
+  TRACE("init [globals_start=%p + %u] = ",
+        reinterpret_cast<void*>(raw_buffer_ptr(globals_, 0)), global.offset);
+  switch (global.type) {
+    case kWasmI32: {
+      int32_t num = value->GetI32();
+      *GetRawGlobalPtr<int32_t>(global) = num;
+      TRACE("%d", num);
+      break;
+    }
+    case kWasmI64: {
+      int64_t num = value->GetI64();
+      *GetRawGlobalPtr<int64_t>(global) = num;
+      TRACE("%" PRId64, num);
+      break;
+    }
+    case kWasmF32: {
+      float num = value->GetF32();
+      *GetRawGlobalPtr<float>(global) = num;
+      TRACE("%f", num);
+      break;
+    }
+    case kWasmF64: {
+      double num = value->GetF64();
+      *GetRawGlobalPtr<double>(global) = num;
+      TRACE("%lf", num);
+      break;
+    }
+    default:
+      UNREACHABLE();
+  }
+  TRACE(", type = %s (from WebAssembly.Global)\n",
+        ValueTypes::TypeName(global.type));
+}
+
 void InstanceBuilder::SanitizeImports() {
-  Handle<SeqOneByteString> module_bytes(
-      module_object_->compiled_module()->shared()->module_bytes());
+  Vector<const uint8_t> wire_bytes =
+      module_object_->native_module()->wire_bytes();
   for (size_t index = 0; index < module_->import_table.size(); ++index) {
-    WasmImport& import = module_->import_table[index];
+    const WasmImport& import = module_->import_table[index];
 
     Handle<String> module_name;
     MaybeHandle<String> maybe_module_name =
-        WasmSharedModuleData::ExtractUtf8StringFromModuleBytes(
-            isolate_, module_bytes, import.module_name);
+        WasmModuleObject::ExtractUtf8StringFromModuleBytes(isolate_, wire_bytes,
+                                                           import.module_name);
     if (!maybe_module_name.ToHandle(&module_name)) {
       thrower_->LinkError("Could not resolve module name for import %zu",
                           index);
@@ -1871,8 +1433,8 @@ void InstanceBuilder::SanitizeImports() {
 
     Handle<String> import_name;
     MaybeHandle<String> maybe_import_name =
-        WasmSharedModuleData::ExtractUtf8StringFromModuleBytes(
-            isolate_, module_bytes, import.field_name);
+        WasmModuleObject::ExtractUtf8StringFromModuleBytes(isolate_, wire_bytes,
+                                                           import.field_name);
     if (!maybe_import_name.ToHandle(&import_name)) {
       thrower_->LinkError("Could not resolve import name for import %zu",
                           index);
@@ -1881,7 +1443,7 @@ void InstanceBuilder::SanitizeImports() {
 
     int int_index = static_cast<int>(index);
     MaybeHandle<Object> result =
-        module_->is_asm_js()
+        module_->origin == kAsmJsOrigin
             ? LookupImportAsm(int_index, import_name)
             : LookupImport(int_index, module_name, import_name);
     if (thrower_->error()) {
@@ -1893,23 +1455,41 @@ void InstanceBuilder::SanitizeImports() {
   }
 }
 
+MaybeHandle<JSArrayBuffer> InstanceBuilder::FindImportedMemoryBuffer() const {
+  DCHECK_EQ(module_->import_table.size(), sanitized_imports_.size());
+  for (size_t index = 0; index < module_->import_table.size(); index++) {
+    const WasmImport& import = module_->import_table[index];
+
+    if (import.kind == kExternalMemory) {
+      const auto& value = sanitized_imports_[index].value;
+      if (!value->IsWasmMemoryObject()) {
+        return {};
+      }
+      auto memory = Handle<WasmMemoryObject>::cast(value);
+      Handle<JSArrayBuffer> buffer(memory->array_buffer(), isolate_);
+      return buffer;
+    }
+  }
+  return {};
+}
+
 // Process the imports, including functions, tables, globals, and memory, in
 // order, loading them from the {ffi_} object. Returns the number of imported
 // functions.
 int InstanceBuilder::ProcessImports(Handle<WasmInstanceObject> instance) {
   int num_imported_functions = 0;
   int num_imported_tables = 0;
+  int num_imported_mutable_globals = 0;
 
   DCHECK_EQ(module_->import_table.size(), sanitized_imports_.size());
-  for (int index = 0; index < static_cast<int>(module_->import_table.size());
-       ++index) {
-    WasmImport& import = module_->import_table[index];
+  int num_imports = static_cast<int>(module_->import_table.size());
+  NativeModule* native_module = instance->module_object()->native_module();
+  for (int index = 0; index < num_imports; ++index) {
+    const WasmImport& import = module_->import_table[index];
 
     Handle<String> module_name = sanitized_imports_[index].module_name;
     Handle<String> import_name = sanitized_imports_[index].import_name;
     Handle<Object> value = sanitized_imports_[index].value;
-    NativeModule* native_module =
-        instance->compiled_module()->GetNativeModule();
 
     switch (import.kind) {
       case kExternalFunction: {
@@ -1939,23 +1519,23 @@ int InstanceBuilder::ProcessImports(Handle<WasmInstanceObject> instance) {
             return -1;
           }
           // The import reference is the instance object itself.
-          auto wasm_code = imported_function->GetWasmCode();
-          ImportedFunctionEntry(*instance, func_index)
-              .set(*imported_instance, wasm_code);
-          native_module->SetCode(func_index, wasm_code);
+          Address imported_target = imported_function->GetWasmCallTarget();
+          ImportedFunctionEntry entry(instance, func_index);
+          entry.set_wasm_to_wasm(*imported_instance, imported_target);
         } else {
           // The imported function is a callable.
           Handle<JSReceiver> js_receiver(JSReceiver::cast(*value), isolate_);
-          Handle<Code> wrapper_code = compiler::CompileWasmToJSWrapper(
-              isolate_, js_receiver, expected_sig, func_index,
-              module_->origin(),
-              instance->compiled_module()->use_trap_handler());
-          RecordStats(*wrapper_code, counters());
+          Handle<Code> wrapper_code =
+              compiler::CompileWasmToJSWrapper(
+                  isolate_, js_receiver, expected_sig, func_index,
+                  module_->origin, use_trap_handler())
+                  .ToHandleChecked();
+          RecordStats(*wrapper_code, isolate_->counters());
 
           WasmCode* wasm_code = native_module->AddCodeCopy(
               wrapper_code, wasm::WasmCode::kWasmToJsWrapper, func_index);
-          ImportedFunctionEntry(*instance, func_index)
-              .set(*js_receiver, wasm_code);
+          ImportedFunctionEntry entry(instance, func_index);
+          entry.set_wasm_to_js(*js_receiver, wasm_code);
         }
         num_imported_functions++;
         break;
@@ -1968,7 +1548,7 @@ int InstanceBuilder::ProcessImports(Handle<WasmInstanceObject> instance) {
         }
         uint32_t table_num = import.index;
         DCHECK_EQ(table_num, num_imported_tables);
-        WasmIndirectFunctionTable& table = module_->function_tables[table_num];
+        const WasmTable& table = module_->tables[table_num];
         TableInstance& table_instance = table_instances_[table_num];
         table_instance.table_object = Handle<WasmTableObject>::cast(value);
         instance->set_table_object(*table_instance.table_object);
@@ -2025,14 +1605,14 @@ int InstanceBuilder::ProcessImports(Handle<WasmInstanceObject> instance) {
           // so putting {-1} in the table will cause checks to always fail.
           auto target = Handle<WasmExportedFunction>::cast(val);
           Handle<WasmInstanceObject> imported_instance =
-              handle(target->instance());
-          const wasm::WasmCode* exported_code = target->GetWasmCode();
+              handle(target->instance(), isolate_);
+          Address exported_call_target = target->GetWasmCallTarget();
           FunctionSig* sig = imported_instance->module()
-                                 ->functions[exported_code->index()]
+                                 ->functions[target->function_index()]
                                  .sig;
-          IndirectFunctionTableEntry(*instance, i)
+          IndirectFunctionTableEntry(instance, i)
               .set(module_->signature_map.Find(sig), *imported_instance,
-                   exported_code);
+                   exported_call_target);
         }
         num_imported_tables++;
         break;
@@ -2049,7 +1629,8 @@ int InstanceBuilder::ProcessImports(Handle<WasmInstanceObject> instance) {
         auto memory = Handle<WasmMemoryObject>::cast(value);
         instance->set_memory_object(*memory);
         Handle<JSArrayBuffer> buffer(memory->array_buffer(), isolate_);
-        memory_ = buffer;
+        // memory_ should have already been assigned in Build().
+        DCHECK_EQ(*memory_.ToHandleChecked(), *buffer);
         uint32_t imported_cur_pages = static_cast<uint32_t>(
             buffer->byte_length()->Number() / kWasmPageSize);
         if (imported_cur_pages < module_->initial_pages) {
@@ -2085,14 +1666,23 @@ int InstanceBuilder::ProcessImports(Handle<WasmInstanceObject> instance) {
         break;
       }
       case kExternalGlobal: {
-        // Global imports are converted to numbers and written into the
-        // {globals_} array buffer.
-        if (module_->globals[import.index].type == kWasmI64) {
+        // Immutable global imports are converted to numbers and written into
+        // the {globals_} array buffer.
+        //
+        // Mutable global imports instead have their backing array buffers
+        // referenced by this instance, and store the address of the imported
+        // global in the {imported_mutable_globals_} array.
+        const WasmGlobal& global = module_->globals[import.index];
+
+        // The mutable-global proposal allows importing i64 values, but only if
+        // they are passed as a WebAssembly.Global object.
+        if (global.type == kWasmI64 && !(FLAG_experimental_wasm_mut_global &&
+                                         value->IsWasmGlobalObject())) {
           ReportLinkError("global import cannot have type i64", index,
                           module_name, import_name);
           return -1;
         }
-        if (module_->is_asm_js()) {
+        if (module_->origin == kAsmJsOrigin) {
           // Accepting {JSFunction} on top of just primitive values here is a
           // workaround to support legacy asm.js code with broken binding. Note
           // that using {NaN} (or Smi::kZero) here is what using the observable
@@ -2101,19 +1691,65 @@ int InstanceBuilder::ProcessImports(Handle<WasmInstanceObject> instance) {
           // or friends are patched, we might need to check for that as well.
           if (value->IsJSFunction()) value = isolate_->factory()->nan_value();
           if (value->IsPrimitive() && !value->IsSymbol()) {
-            if (module_->globals[import.index].type == kWasmI32) {
+            if (global.type == kWasmI32) {
               value = Object::ToInt32(isolate_, value).ToHandleChecked();
             } else {
               value = Object::ToNumber(value).ToHandleChecked();
             }
           }
         }
-        if (!value->IsNumber()) {
-          ReportLinkError("global import must be a number", index, module_name,
-                          import_name);
-          return -1;
+        if (FLAG_experimental_wasm_mut_global) {
+          if (value->IsWasmGlobalObject()) {
+            auto global_object = Handle<WasmGlobalObject>::cast(value);
+            if (global_object->type() != global.type) {
+              ReportLinkError(
+                  "imported global does not match the expected type", index,
+                  module_name, import_name);
+              return -1;
+            }
+            if (global_object->is_mutable() != global.mutability) {
+              ReportLinkError(
+                  "imported global does not match the expected mutability",
+                  index, module_name, import_name);
+              return -1;
+            }
+            if (global.mutability) {
+              Handle<JSArrayBuffer> buffer(global_object->array_buffer(),
+                                           isolate_);
+              int index = num_imported_mutable_globals++;
+              instance->imported_mutable_globals_buffers()->set(index, *buffer);
+              // It is safe in this case to store the raw pointer to the buffer
+              // since the backing store of the JSArrayBuffer will not be
+              // relocated.
+              instance->imported_mutable_globals()[index] =
+                  reinterpret_cast<Address>(
+                      raw_buffer_ptr(buffer, global_object->offset()));
+            } else {
+              WriteGlobalValue(global, global_object);
+            }
+          } else if (value->IsNumber()) {
+            if (global.mutability) {
+              ReportLinkError(
+                  "imported mutable global must be a WebAssembly.Global object",
+                  index, module_name, import_name);
+              return -1;
+            }
+            WriteGlobalValue(global, value->Number());
+          } else {
+            ReportLinkError(
+                "global import must be a number or WebAssembly.Global object",
+                index, module_name, import_name);
+            return -1;
+          }
+        } else {
+          if (value->IsNumber()) {
+            WriteGlobalValue(global, value->Number());
+          } else {
+            ReportLinkError("global import must be a number", index,
+                            module_name, import_name);
+            return -1;
+          }
         }
-        WriteGlobalValue(module_->globals[import.index], value);
         break;
       }
       default:
@@ -2122,17 +1758,25 @@ int InstanceBuilder::ProcessImports(Handle<WasmInstanceObject> instance) {
     }
   }
 
+  DCHECK_EQ(module_->num_imported_mutable_globals,
+            num_imported_mutable_globals);
+
   return num_imported_functions;
 }
 
 template <typename T>
-T* InstanceBuilder::GetRawGlobalPtr(WasmGlobal& global) {
+T* InstanceBuilder::GetRawGlobalPtr(const WasmGlobal& global) {
   return reinterpret_cast<T*>(raw_buffer_ptr(globals_, global.offset));
 }
 
 // Process initialization of globals.
 void InstanceBuilder::InitGlobals() {
   for (auto global : module_->globals) {
+    if (global.mutability && global.imported) {
+      DCHECK(FLAG_experimental_wasm_mut_global);
+      continue;
+    }
+
     switch (global.init.kind) {
       case WasmInitExpr::kI32Const:
         *GetRawGlobalPtr<int32_t>(global) = global.init.val.i32_const;
@@ -2175,14 +1819,12 @@ Handle<JSArrayBuffer> InstanceBuilder::AllocateMemory(uint32_t num_pages) {
     thrower_->RangeError("Out of memory: wasm memory too large");
     return Handle<JSArrayBuffer>::null();
   }
-  const bool enable_guard_regions = use_trap_handler();
   const bool is_shared_memory =
       module_->has_shared_memory && i::FLAG_experimental_wasm_threads;
   i::SharedFlag shared_flag =
       is_shared_memory ? i::SharedFlag::kShared : i::SharedFlag::kNotShared;
   Handle<JSArrayBuffer> mem_buffer;
-  if (!NewArrayBuffer(isolate_, num_pages * kWasmPageSize, enable_guard_regions,
-                      shared_flag)
+  if (!NewArrayBuffer(isolate_, num_pages * kWasmPageSize, shared_flag)
            .ToHandle(&mem_buffer)) {
     thrower_->RangeError("Out of memory: wasm memory");
   }
@@ -2194,7 +1836,7 @@ bool InstanceBuilder::NeedsWrappers() const {
   for (auto& table_instance : table_instances_) {
     if (!table_instance.js_wrappers.is_null()) return true;
   }
-  for (auto& table : module_->function_tables) {
+  for (auto& table : module_->tables) {
     if (table.exported) return true;
   }
   return false;
@@ -2202,10 +1844,8 @@ bool InstanceBuilder::NeedsWrappers() const {
 
 // Process the exports, creating wrappers for functions, tables, memories,
 // and globals.
-void InstanceBuilder::ProcessExports(
-    Handle<WasmInstanceObject> instance,
-    Handle<WasmCompiledModule> compiled_module) {
-  Handle<FixedArray> export_wrappers(compiled_module->export_wrappers(),
+void InstanceBuilder::ProcessExports(Handle<WasmInstanceObject> instance) {
+  Handle<FixedArray> export_wrappers(module_object_->export_wrappers(),
                                      isolate_);
   if (NeedsWrappers()) {
     // Fill the table to cache the exported JSFunction wrappers.
@@ -2217,7 +1857,7 @@ void InstanceBuilder::ProcessExports(
     // imported WebAssembly functions into the js_wrappers_ list.
     for (int index = 0, end = static_cast<int>(module_->import_table.size());
          index < end; ++index) {
-      WasmImport& import = module_->import_table[index];
+      const WasmImport& import = module_->import_table[index];
       if (import.kind == kExternalFunction) {
         Handle<Object> value = sanitized_imports_[index].value;
         if (WasmExportedFunction::IsWasmExportedFunction(*value)) {
@@ -2228,15 +1868,22 @@ void InstanceBuilder::ProcessExports(
   }
 
   Handle<JSObject> exports_object;
-  if (module_->is_wasm()) {
-    // Create the "exports" object.
-    exports_object = isolate_->factory()->NewJSObjectWithNullProto();
-  } else if (module_->is_asm_js()) {
-    Handle<JSFunction> object_function = Handle<JSFunction>(
-        isolate_->native_context()->object_function(), isolate_);
-    exports_object = isolate_->factory()->NewJSObject(object_function);
-  } else {
-    UNREACHABLE();
+  bool is_asm_js = false;
+  switch (module_->origin) {
+    case kWasmOrigin: {
+      // Create the "exports" object.
+      exports_object = isolate_->factory()->NewJSObjectWithNullProto();
+      break;
+    }
+    case kAsmJsOrigin: {
+      Handle<JSFunction> object_function = Handle<JSFunction>(
+          isolate_->native_context()->object_function(), isolate_);
+      exports_object = isolate_->factory()->NewJSObject(object_function);
+      is_asm_js = true;
+      break;
+    }
+    default:
+      UNREACHABLE();
   }
   instance->set_exports_object(*exports_object);
 
@@ -2244,20 +1891,19 @@ void InstanceBuilder::ProcessExports(
       isolate_->factory()->InternalizeUtf8String(AsmJs::kSingleFunctionName);
 
   PropertyDescriptor desc;
-  desc.set_writable(module_->is_asm_js());
+  desc.set_writable(is_asm_js);
   desc.set_enumerable(true);
-  desc.set_configurable(module_->is_asm_js());
+  desc.set_configurable(is_asm_js);
 
   // Process each export in the export table.
   int export_index = 0;  // Index into {export_wrappers}.
-  for (WasmExport& exp : module_->export_table) {
-    Handle<String> name =
-        WasmSharedModuleData::ExtractUtf8StringFromModuleBytes(
-            isolate_, handle(compiled_module_->shared(), isolate_), exp.name)
-            .ToHandleChecked();
+  for (const WasmExport& exp : module_->export_table) {
+    Handle<String> name = WasmModuleObject::ExtractUtf8StringFromModuleBytes(
+                              isolate_, module_object_, exp.name)
+                              .ToHandleChecked();
     Handle<JSObject> export_to;
-    if (module_->is_asm_js() && exp.kind == kExternalFunction &&
-        String::Equals(name, single_function_name)) {
+    if (is_asm_js && exp.kind == kExternalFunction &&
+        String::Equals(isolate_, name, single_function_name)) {
       export_to = instance;
     } else {
       export_to = exports_object;
@@ -2266,23 +1912,21 @@ void InstanceBuilder::ProcessExports(
     switch (exp.kind) {
       case kExternalFunction: {
         // Wrap and export the code as a JSFunction.
-        WasmFunction& function = module_->functions[exp.index];
+        const WasmFunction& function = module_->functions[exp.index];
         Handle<JSFunction> js_function = js_wrappers_[exp.index];
         if (js_function.is_null()) {
           // Wrap the exported code as a JSFunction.
           Handle<Code> export_code =
               export_wrappers->GetValueChecked<Code>(isolate_, export_index);
           MaybeHandle<String> func_name;
-          if (module_->is_asm_js()) {
+          if (is_asm_js) {
             // For modules arising from asm.js, honor the names section.
-            WireBytesRef func_name_ref =
-                module_->LookupName(compiled_module_->shared()->module_bytes(),
-                                    function.func_index);
-            func_name =
-                WasmSharedModuleData::ExtractUtf8StringFromModuleBytes(
-                    isolate_, handle(compiled_module_->shared(), isolate_),
-                    func_name_ref)
-                    .ToHandleChecked();
+            WireBytesRef func_name_ref = module_->LookupFunctionName(
+                module_object_->native_module()->wire_bytes(),
+                function.func_index);
+            func_name = WasmModuleObject::ExtractUtf8StringFromModuleBytes(
+                            isolate_, module_object_, func_name_ref)
+                            .ToHandleChecked();
           }
           js_function = WasmExportedFunction::New(
               isolate_, instance, func_name, function.func_index,
@@ -2296,7 +1940,7 @@ void InstanceBuilder::ProcessExports(
       case kExternalTable: {
         // Export a table as a WebAssembly.Table object.
         TableInstance& table_instance = table_instances_[exp.index];
-        WasmIndirectFunctionTable& table = module_->function_tables[exp.index];
+        const WasmTable& table = module_->tables[exp.index];
         if (table_instance.table_object.is_null()) {
           uint32_t maximum = table.has_maximum_size ? table.maximum_size
                                                     : FLAG_wasm_max_table_size;
@@ -2317,27 +1961,61 @@ void InstanceBuilder::ProcessExports(
         break;
       }
       case kExternalGlobal: {
-        // Export the value of the global variable as a number.
-        WasmGlobal& global = module_->globals[exp.index];
-        double num = 0;
-        switch (global.type) {
-          case kWasmI32:
-            num = *GetRawGlobalPtr<int32_t>(global);
-            break;
-          case kWasmF32:
-            num = *GetRawGlobalPtr<float>(global);
-            break;
-          case kWasmF64:
-            num = *GetRawGlobalPtr<double>(global);
-            break;
-          case kWasmI64:
-            thrower_->LinkError(
-                "export of globals of type I64 is not allowed.");
-            return;
-          default:
-            UNREACHABLE();
+        const WasmGlobal& global = module_->globals[exp.index];
+        if (FLAG_experimental_wasm_mut_global) {
+          Handle<JSArrayBuffer> buffer;
+          uint32_t offset;
+
+          if (global.mutability && global.imported) {
+            Handle<FixedArray> buffers_array(
+                instance->imported_mutable_globals_buffers(), isolate_);
+            buffer = buffers_array->GetValueChecked<JSArrayBuffer>(
+                isolate_, global.index);
+            Address global_addr =
+                instance->imported_mutable_globals()[global.index];
+
+            uint32_t buffer_size = 0;
+            CHECK(buffer->byte_length()->ToUint32(&buffer_size));
+
+            Address backing_store =
+                reinterpret_cast<Address>(buffer->backing_store());
+            CHECK(global_addr >= backing_store &&
+                  global_addr < backing_store + buffer_size);
+            offset = static_cast<uint32_t>(global_addr - backing_store);
+          } else {
+            buffer = handle(instance->globals_buffer(), isolate_);
+            offset = global.offset;
+          }
+
+          // Since the global's array buffer is always provided, allocation
+          // should never fail.
+          Handle<WasmGlobalObject> global_obj =
+              WasmGlobalObject::New(isolate_, buffer, global.type, offset,
+                                    global.mutability)
+                  .ToHandleChecked();
+          desc.set_value(global_obj);
+        } else {
+          // Export the value of the global variable as a number.
+          double num = 0;
+          switch (global.type) {
+            case kWasmI32:
+              num = *GetRawGlobalPtr<int32_t>(global);
+              break;
+            case kWasmF32:
+              num = *GetRawGlobalPtr<float>(global);
+              break;
+            case kWasmF64:
+              num = *GetRawGlobalPtr<double>(global);
+              break;
+            case kWasmI64:
+              thrower_->LinkError(
+                  "export of globals of type I64 is not allowed.");
+              return;
+            default:
+              UNREACHABLE();
+          }
+          desc.set_value(isolate_->factory()->NewNumber(num));
         }
-        desc.set_value(isolate_->factory()->NewNumber(num));
         break;
       }
       default:
@@ -2356,7 +2034,7 @@ void InstanceBuilder::ProcessExports(
   }
   DCHECK_EQ(export_index, export_wrappers->length());
 
-  if (module_->is_wasm()) {
+  if (module_->origin == kWasmOrigin) {
     v8::Maybe<bool> success =
         JSReceiver::SetIntegrityLevel(exports_object, FROZEN, kDontThrow);
     DCHECK(success.FromMaybe(false));
@@ -2364,12 +2042,10 @@ void InstanceBuilder::ProcessExports(
   }
 }
 
-void InstanceBuilder::InitializeTables(
-    Handle<WasmInstanceObject> instance,
-    CodeSpecialization* code_specialization) {
-  size_t table_count = module_->function_tables.size();
+void InstanceBuilder::InitializeTables(Handle<WasmInstanceObject> instance) {
+  size_t table_count = module_->tables.size();
   for (size_t index = 0; index < table_count; ++index) {
-    WasmIndirectFunctionTable& table = module_->function_tables[index];
+    const WasmTable& table = module_->tables[index];
     TableInstance& table_instance = table_instances_[index];
 
     if (!instance->has_indirect_function_table()) {
@@ -2381,9 +2057,9 @@ void InstanceBuilder::InitializeTables(
 }
 
 void InstanceBuilder::LoadTableSegments(Handle<WasmInstanceObject> instance) {
-  NativeModule* native_module = compiled_module_->GetNativeModule();
-  int function_table_count = static_cast<int>(module_->function_tables.size());
-  for (int index = 0; index < function_table_count; ++index) {
+  NativeModule* native_module = module_object_->native_module();
+  int table_count = static_cast<int>(module_->tables.size());
+  for (int index = 0; index < table_count; ++index) {
     TableInstance& table_instance = table_instances_[index];
 
     // TODO(titzer): this does redundant work if there are multiple tables,
@@ -2394,24 +2070,25 @@ void InstanceBuilder::LoadTableSegments(Handle<WasmInstanceObject> instance) {
       DCHECK(in_bounds(base, num_entries, table_instance.table_size));
       for (uint32_t i = 0; i < num_entries; ++i) {
         uint32_t func_index = table_init.entries[i];
-        WasmFunction* function = &module_->functions[func_index];
+        const WasmFunction* function = &module_->functions[func_index];
         int table_index = static_cast<int>(i + base);
 
         // Update the local dispatch table first.
         uint32_t sig_id = module_->signature_ids[function->sig_index];
-        wasm::WasmCode* wasm_code =
-            native_module->GetIndirectlyCallableCode(func_index);
-
-        if (func_index < module_->num_imported_functions) {
-          // Imported functions have the target instance put into the IFT.
-          WasmInstanceObject* target_instance =
-              ImportedFunctionEntry(*instance, func_index).instance();
-          IndirectFunctionTableEntry(*instance, table_index)
-              .set(sig_id, target_instance, wasm_code);
+        WasmInstanceObject* target_instance = *instance;
+        Address call_target;
+        const bool is_import = func_index < module_->num_imported_functions;
+        if (is_import) {
+          // For imported calls, take target instance and address from the
+          // import table.
+          ImportedFunctionEntry entry(instance, func_index);
+          target_instance = entry.instance();
+          call_target = entry.target();
         } else {
-          IndirectFunctionTableEntry(*instance, table_index)
-              .set(sig_id, *instance, wasm_code);
+          call_target = native_module->GetCallTargetForFunction(func_index);
         }
+        IndirectFunctionTableEntry(instance, table_index)
+            .set(sig_id, target_instance, call_target);
 
         if (!table_instance.table_object.is_null()) {
           // Update the table object's other dispatch tables.
@@ -2422,19 +2099,16 @@ void InstanceBuilder::LoadTableSegments(Handle<WasmInstanceObject> instance) {
             // at module compile time and cached instead.
 
             Handle<Code> wrapper_code =
-                js_to_wasm_cache_.CloneOrCompileJSToWasmWrapper(
-                    isolate_, module_, wasm_code, func_index,
-                    instance->compiled_module()->use_trap_handler());
+                js_to_wasm_cache_.GetOrCompileJSToWasmWrapper(
+                    isolate_, native_module, func_index, use_trap_handler());
             MaybeHandle<String> func_name;
-            if (module_->is_asm_js()) {
+            if (module_->origin == kAsmJsOrigin) {
               // For modules arising from asm.js, honor the names section.
-              WireBytesRef func_name_ref = module_->LookupName(
-                  compiled_module_->shared()->module_bytes(), func_index);
-              func_name =
-                  WasmSharedModuleData::ExtractUtf8StringFromModuleBytes(
-                      isolate_, handle(compiled_module_->shared(), isolate_),
-                      func_name_ref)
-                      .ToHandleChecked();
+              WireBytesRef func_name_ref = module_->LookupFunctionName(
+                  native_module->wire_bytes(), func_index);
+              func_name = WasmModuleObject::ExtractUtf8StringFromModuleBytes(
+                              isolate_, module_object_, func_name_ref)
+                              .ToHandleChecked();
             }
             Handle<WasmExportedFunction> js_function =
                 WasmExportedFunction::New(
@@ -2448,7 +2122,7 @@ void InstanceBuilder::LoadTableSegments(Handle<WasmInstanceObject> instance) {
           // UpdateDispatchTables() should update this instance as well.
           WasmTableObject::UpdateDispatchTables(
               isolate_, table_instance.table_object, table_index, function->sig,
-              instance, wasm_code);
+              instance, call_target);
         }
       }
     }
@@ -2464,22 +2138,22 @@ void InstanceBuilder::LoadTableSegments(Handle<WasmInstanceObject> instance) {
   }
 }
 
-AsyncCompileJob::AsyncCompileJob(Isolate* isolate,
-                                 std::unique_ptr<byte[]> bytes_copy,
-                                 size_t length, Handle<Context> context,
-                                 Handle<JSPromise> promise)
+AsyncCompileJob::AsyncCompileJob(
+    Isolate* isolate, std::unique_ptr<byte[]> bytes_copy, size_t length,
+    Handle<Context> context,
+    std::unique_ptr<CompilationResultResolver> resolver)
     : isolate_(isolate),
       async_counters_(isolate->async_counters()),
       bytes_copy_(std::move(bytes_copy)),
-      wire_bytes_(bytes_copy_.get(), bytes_copy_.get() + length) {
+      wire_bytes_(bytes_copy_.get(), bytes_copy_.get() + length),
+      resolver_(std::move(resolver)) {
   v8::Isolate* v8_isolate = reinterpret_cast<v8::Isolate*>(isolate);
   v8::Platform* platform = V8::GetCurrentPlatform();
   foreground_task_runner_ = platform->GetForegroundTaskRunner(v8_isolate);
-  background_task_runner_ = platform->GetWorkerThreadsTaskRunner(v8_isolate);
-  // The handles for the context and promise must be deferred.
+  // The handle for the context must be deferred.
   DeferredHandleScope deferred(isolate);
-  context_ = Handle<Context>(*context);
-  module_promise_ = Handle<JSPromise>(*promise);
+  native_context_ = Handle<Context>(context->native_context(), isolate);
+  DCHECK(native_context_->IsNativeContext());
   deferred_handles_.push_back(deferred.Detach());
 }
 
@@ -2489,12 +2163,10 @@ void AsyncCompileJob::Start() {
 
 void AsyncCompileJob::Abort() {
   background_task_manager_.CancelAndWait();
-  if (!compiled_module_.is_null()) {
-    compiled_module_->GetNativeModule()->compilation_state()->Abort();
-  }
+  if (native_module_) native_module_->compilation_state()->Abort();
   if (num_pending_foreground_tasks_ == 0) {
     // No task is pending, we can just remove the AsyncCompileJob.
-    isolate_->wasm_engine()->compilation_manager()->RemoveJob(this);
+    isolate_->wasm_engine()->RemoveCompileJob(this);
   } else {
     // There is still a compilation task in the task queue. We enter the
     // AbortCompilation state and wait for this compilation task to abort the
@@ -2521,15 +2193,14 @@ class AsyncStreamingProcessor final : public StreamingProcessor {
 
   void OnFinishedChunk() override;
 
-  void OnFinishedStream(std::unique_ptr<uint8_t[]> bytes,
-                        size_t length) override;
+  void OnFinishedStream(OwnedVector<uint8_t> bytes) override;
 
   void OnError(DecodeResult result) override;
 
   void OnAbort() override;
 
  private:
-  // Finishes the AsyncCOmpileJob with an error.
+  // Finishes the AsyncCompileJob with an error.
   void FinishAsyncCompileJobWithError(ResultBase result);
 
   void CommitCompilationUnits();
@@ -2552,23 +2223,30 @@ AsyncCompileJob::~AsyncCompileJob() {
   for (auto d : deferred_handles_) delete d;
 }
 
+void AsyncCompileJob::FinishCompile() {
+  RecordStats(native_module_, counters());
+
+  // Finish the wasm script now and make it public to the debugger.
+  Handle<Script> script(module_object_->script(), isolate_);
+  isolate_->debug()->OnAfterCompile(script);
+
+  // Log the code within the generated module for profiling.
+  native_module_->LogWasmCodes(isolate_);
+
+  // TODO(wasm): compiling wrappers should be made async as well.
+  DoSync<CompileWrappers>();
+}
+
 void AsyncCompileJob::AsyncCompileFailed(Handle<Object> error_reason) {
   if (stream_) stream_->NotifyError();
   // {job} keeps the {this} pointer alive.
   std::shared_ptr<AsyncCompileJob> job =
-      isolate_->wasm_engine()->compilation_manager()->RemoveJob(this);
-  MaybeHandle<Object> promise_result =
-      JSPromise::Reject(module_promise_, error_reason);
-  CHECK_EQ(promise_result.is_null(), isolate_->has_pending_exception());
+      isolate_->wasm_engine()->RemoveCompileJob(this);
+  resolver_->OnCompilationFailed(error_reason);
 }
 
-void AsyncCompileJob::AsyncCompileSucceeded(Handle<Object> result) {
-  // {job} keeps the {this} pointer alive.
-  std::shared_ptr<AsyncCompileJob> job =
-      isolate_->wasm_engine()->compilation_manager()->RemoveJob(this);
-  MaybeHandle<Object> promise_result =
-      JSPromise::Resolve(module_promise_, result);
-  CHECK_EQ(promise_result.is_null(), isolate_->has_pending_exception());
+void AsyncCompileJob::AsyncCompileSucceeded(Handle<WasmModuleObject> result) {
+  resolver_->OnCompilationSucceeded(result);
 }
 
 // A closure to run a compilation step (either as foreground or background
@@ -2586,7 +2264,7 @@ class AsyncCompileJob::CompileStep {
       --job_->num_pending_foreground_tasks_;
       DCHECK_EQ(0, job_->num_pending_foreground_tasks_);
       SaveContext saved_context(job_->isolate_);
-      job_->isolate_->set_context(*job_->context_);
+      job_->isolate_->set_context(*job_->native_context_);
       RunInForeground();
     } else {
       RunInBackground();
@@ -2635,12 +2313,15 @@ void AsyncCompileJob::DoSync(Args&&... args) {
 }
 
 void AsyncCompileJob::StartBackgroundTask() {
+  auto task = base::make_unique<CompileTask>(this, false);
+
   // If --wasm-num-compilation-tasks=0 is passed, do only spawn foreground
   // tasks. This is used to make timing deterministic.
-  v8::TaskRunner* task_runner = FLAG_wasm_num_compilation_tasks > 0
-                                    ? background_task_runner_.get()
-                                    : foreground_task_runner_.get();
-  task_runner->PostTask(base::make_unique<CompileTask>(this, false));
+  if (FLAG_wasm_num_compilation_tasks > 0) {
+    V8::GetCurrentPlatform()->CallOnWorkerThread(std::move(task));
+  } else {
+    foreground_task_runner_->PostTask(std::move(task));
+  }
 }
 
 template <typename Step, typename... Args>
@@ -2682,7 +2363,7 @@ class AsyncCompileJob::DecodeModule : public AsyncCompileJob::CompileStep {
     } else {
       // Decode passed.
       job_->module_ = std::move(result.val);
-      job_->DoSync<PrepareAndStartCompile>(job_->module_.get(), true);
+      job_->DoSync<PrepareAndStartCompile>(true);
     }
   }
 };
@@ -2710,11 +2391,10 @@ class AsyncCompileJob::DecodeFail : public CompileStep {
 //==========================================================================
 class AsyncCompileJob::PrepareAndStartCompile : public CompileStep {
  public:
-  explicit PrepareAndStartCompile(WasmModule* module, bool start_compilation)
-      : module_(module), start_compilation_(start_compilation) {}
+  explicit PrepareAndStartCompile(bool start_compilation)
+      : start_compilation_(start_compilation) {}
 
  private:
-  WasmModule* module_;
   bool start_compilation_;
 
   void RunInForeground() override {
@@ -2724,47 +2404,47 @@ class AsyncCompileJob::PrepareAndStartCompile : public CompileStep {
     // is done.
     job_->background_task_manager_.CancelAndWait();
 
-    Isolate* isolate = job_->isolate_;
-
-    job_->module_env_ = CreateDefaultModuleEnv(isolate, module_);
-
-    Handle<Code> centry_stub = CEntryStub(isolate, 1).GetCode();
-    {
-      // Now reopen the handles in a deferred scope in order to use
-      // them in the concurrent steps.
-      DeferredHandleScope deferred(isolate);
-      job_->centry_stub_ = Handle<Code>(*centry_stub, isolate);
-      job_->deferred_handles_.push_back(deferred.Detach());
-    }
+    // Create heap objects for script and module bytes to be stored in the
+    // module object. Asm.js is not compiled asynchronously.
+    Handle<Script> script = CreateWasmScript(job_->isolate_, job_->wire_bytes_);
+    Handle<ByteArray> asm_js_offset_table;
 
-    DCHECK_LE(module_->num_imported_functions, module_->functions.size());
-    // Create the compiled module object and populate with compiled functions
-    // and information needed at instantiation time. This object needs to be
-    // serializable. Instantiation may occur off a deserialized version of
-    // this object.
-    int export_wrapper_size = static_cast<int>(module_->num_exported_functions);
-    Handle<FixedArray> export_wrappers =
-        job_->isolate_->factory()->NewFixedArray(export_wrapper_size, TENURED);
+    const WasmModule* module = job_->module_.get();
+    ModuleEnv env = CreateDefaultModuleEnv(module);
+    // TODO(wasm): Improve efficiency of storing module wire bytes. Only store
+    // relevant sections, not function bodies
 
-    job_->compiled_module_ = NewCompiledModule(
-        job_->isolate_, module_, export_wrappers, job_->module_env_.get());
+    // Create the module object and populate with compiled functions and
+    // information needed at instantiation time.
+    // TODO(clemensh): For the same module (same bytes / same hash), we should
+    // only have one {WasmModuleObject}. Otherwise, we might only set
+    // breakpoints on a (potentially empty) subset of the instances.
+    // Create the module object.
+    job_->module_object_ = WasmModuleObject::New(
+        job_->isolate_, job_->module_, env,
+        {std::move(job_->bytes_copy_), job_->wire_bytes_.length()}, script,
+        asm_js_offset_table);
+    job_->native_module_ = job_->module_object_->native_module();
 
     {
       DeferredHandleScope deferred(job_->isolate_);
-      job_->compiled_module_ = handle(*job_->compiled_module_, job_->isolate_);
+      job_->module_object_ = handle(*job_->module_object_, job_->isolate_);
       job_->deferred_handles_.push_back(deferred.Detach());
     }
     size_t num_functions =
-        module_->functions.size() - module_->num_imported_functions;
+        module->functions.size() - module->num_imported_functions;
 
     if (num_functions == 0) {
+      // Tiering has nothing to do if module is empty.
+      job_->tiering_completed_ = true;
+
       // Degenerate case of an empty module.
-      job_->DoSync<FinishCompile>();
+      job_->FinishCompile();
       return;
     }
 
     CompilationState* compilation_state =
-        job_->compiled_module_->GetNativeModule()->compilation_state();
+        job_->native_module_->compilation_state();
     {
       // Instance field {job_} cannot be captured by copy, therefore
       // we need to add a local helper variable {job}. We want to
@@ -2772,19 +2452,48 @@ class AsyncCompileJob::PrepareAndStartCompile : public CompileStep {
       // on the current step we are in.
       AsyncCompileJob* job = job_;
       compilation_state->AddCallback(
-          [job](CompilationEvent event, Handle<Object> error) {
+          [job](CompilationEvent event, ErrorThrower* thrower) {
+            // Callback is called from a foreground thread.
             switch (event) {
               case CompilationEvent::kFinishedBaselineCompilation:
                 if (job->DecrementAndCheckFinisherCount()) {
-                  job->DoSync<FinishCompile>();
+                  SaveContext saved_context(job->isolate());
+                  job->isolate()->set_context(*job->native_context_);
+                  job->FinishCompile();
                 }
                 return;
-              case CompilationEvent::kFailedCompilation:
+              case CompilationEvent::kFinishedTopTierCompilation:
+                // It is only safe to remove the AsyncCompileJob if no
+                // foreground task is currently pending, and no finisher is
+                // outstanding (streaming compilation).
+                if (job->num_pending_foreground_tasks_ == 0 &&
+                    job->outstanding_finishers_.load() == 0) {
+                  job->isolate_->wasm_engine()->RemoveCompileJob(job);
+                } else {
+                  // If a foreground task was pending or a finsher was pending,
+                  // we will rely on FinishModule to remove the job.
+                  job->tiering_completed_ = true;
+                }
+                return;
+              case CompilationEvent::kFailedCompilation: {
+                // Tier-up compilation should not fail if baseline compilation
+                // did not fail.
+                DCHECK(!job->native_module_->compilation_state()
+                            ->baseline_compilation_finished());
+
+                SaveContext saved_context(job->isolate());
+                job->isolate()->set_context(*job->native_context_);
+                Handle<Object> error = thrower->Reify();
+
                 DeferredHandleScope deferred(job->isolate());
                 error = handle(*error, job->isolate());
                 job->deferred_handles_.push_back(deferred.Detach());
                 job->DoSync<CompileFailed>(error);
                 return;
+              }
+              case CompilationEvent::kDestroyed:
+                // Nothing to do.
+                return;
             }
             UNREACHABLE();
           });
@@ -2795,13 +2504,10 @@ class AsyncCompileJob::PrepareAndStartCompile : public CompileStep {
       // InitializeCompilationUnits always returns 0 for streaming compilation,
       // then DoAsync would do the same as NextStep already.
 
-      size_t functions_count =
-          GetNumFunctionsToCompile(module_->functions, job_->module_env_.get());
-      compilation_state->SetNumberOfFunctionsToCompile(functions_count);
+      compilation_state->SetNumberOfFunctionsToCompile(
+          module->num_declared_functions);
       // Add compilation units and kick off compilation.
-      InitializeCompilationUnits(module_->functions, job_->wire_bytes_,
-                                 job_->module_env_.get(), job_->centry_stub_,
-                                 job_->compiled_module_->GetNativeModule());
+      InitializeCompilationUnits(job_->native_module_);
     }
   }
 };
@@ -2824,90 +2530,54 @@ class AsyncCompileJob::CompileFailed : public CompileStep {
 };
 
 //==========================================================================
-// Step 5 (sync): Finish heap-allocated data structures.
-//==========================================================================
-class AsyncCompileJob::FinishCompile : public CompileStep {
-  void RunInForeground() override {
-    TRACE_COMPILE("(5b) Finish compile...\n");
-    RecordStats(job_->compiled_module_->GetNativeModule(), job_->counters());
-
-    // Create heap objects for script and module bytes to be stored in the
-    // shared module data. Asm.js is not compiled asynchronously.
-    Handle<Script> script = CreateWasmScript(job_->isolate_, job_->wire_bytes_);
-    Handle<ByteArray> asm_js_offset_table;
-    // TODO(wasm): Improve efficiency of storing module wire bytes.
-    //   1. Only store relevant sections, not function bodies
-    //   2. Don't make a second copy of the bytes here; reuse the copy made
-    //      for asynchronous compilation and store it as an external one
-    //      byte string for serialization/deserialization.
-    Handle<String> module_bytes =
-        job_->isolate_->factory()
-            ->NewStringFromOneByte(
-                {job_->wire_bytes_.start(), job_->wire_bytes_.length()},
-                TENURED)
-            .ToHandleChecked();
-    DCHECK(module_bytes->IsSeqOneByteString());
-
-    // The {module_wrapper} will take ownership of the {WasmModule} object,
-    // and it will be destroyed when the GC reclaims the wrapper object.
-    Handle<WasmModuleWrapper> module_wrapper =
-        WasmModuleWrapper::From(job_->isolate_, job_->module_.release());
-
-    // Create the shared module data.
-    // TODO(clemensh): For the same module (same bytes / same hash), we should
-    // only have one WasmSharedModuleData. Otherwise, we might only set
-    // breakpoints on a (potentially empty) subset of the instances.
-
-    Handle<WasmSharedModuleData> shared =
-        WasmSharedModuleData::New(job_->isolate_, module_wrapper,
-                                  Handle<SeqOneByteString>::cast(module_bytes),
-                                  script, asm_js_offset_table);
-    job_->compiled_module_->set_shared(*shared);
-    script->set_wasm_compiled_module(*job_->compiled_module_);
-
-    // Finish the wasm script now and make it public to the debugger.
-    job_->isolate_->debug()->OnAfterCompile(
-        handle(job_->compiled_module_->shared()->script()));
-
-    // TODO(wasm): compiling wrappers should be made async as well.
-    job_->DoSync<CompileWrappers>();
-  }
-};
-
-//==========================================================================
-// Step 6 (sync): Compile JS->wasm wrappers.
+// Step 5 (sync): Compile JS->wasm wrappers.
 //==========================================================================
 class AsyncCompileJob::CompileWrappers : public CompileStep {
   // TODO(wasm): Compile all wrappers here, including the start function wrapper
   // and the wrappers for the function table elements.
   void RunInForeground() override {
-    TRACE_COMPILE("(6) Compile wrappers...\n");
+    TRACE_COMPILE("(5) Compile wrappers...\n");
     // TODO(6792): No longer needed once WebAssembly code is off heap.
     CodeSpaceMemoryModificationScope modification_scope(job_->isolate_->heap());
     // Compile JS->wasm wrappers for exported functions.
-    CompileJsToWasmWrappers(job_->isolate_, job_->compiled_module_,
-                            job_->counters());
+    CompileJsToWasmWrappers(job_->isolate_, job_->module_object_);
     job_->DoSync<FinishModule>();
   }
 };
 
 //==========================================================================
-// Step 7 (sync): Finish the module and resolve the promise.
+// Step 6 (sync): Finish the module and resolve the promise.
 //==========================================================================
 class AsyncCompileJob::FinishModule : public CompileStep {
   void RunInForeground() override {
-    TRACE_COMPILE("(7) Finish module...\n");
-    Handle<WasmModuleObject> result =
-        WasmModuleObject::New(job_->isolate_, job_->compiled_module_);
-    // {job_} is deleted in AsyncCompileSucceeded, therefore the {return}.
-    return job_->AsyncCompileSucceeded(result);
+    TRACE_COMPILE("(6) Finish module...\n");
+    job_->AsyncCompileSucceeded(job_->module_object_);
+
+    size_t num_functions =
+        job_->module_->functions.size() - job_->module_->num_imported_functions;
+    if (job_->native_module_->compilation_state()->compile_mode() ==
+            CompileMode::kRegular ||
+        num_functions == 0) {
+      // If we do not tier up, the async compile job is done here and
+      // can be deleted.
+      job_->isolate_->wasm_engine()->RemoveCompileJob(job_);
+      return;
+    }
+    // If background tiering compilation finished before we resolved the
+    // promise, switch to patching now. Otherwise, patching will be scheduled
+    // by a callback.
+    DCHECK_EQ(CompileMode::kTiering,
+              job_->native_module_->compilation_state()->compile_mode());
+    if (job_->tiering_completed_) {
+      job_->isolate_->wasm_engine()->RemoveCompileJob(job_);
+    }
   }
 };
 
 class AsyncCompileJob::AbortCompilation : public CompileStep {
   void RunInForeground() override {
     TRACE_COMPILE("Abort asynchronous compilation ...\n");
-    job_->isolate_->wasm_engine()->compilation_manager()->RemoveJob(job_);
+    job_->isolate_->wasm_engine()->RemoveCompileJob(job_);
   }
 };
 
@@ -2926,8 +2596,8 @@ void AsyncStreamingProcessor::FinishAsyncCompileJobWithError(ResultBase error) {
 
   // Check if there is already a CompiledModule, in which case we have to clean
   // up the CompilationState as well.
-  if (!job_->compiled_module_.is_null()) {
-    job_->compiled_module_->GetNativeModule()->compilation_state()->Abort();
+  if (job_->native_module_) {
+    job_->native_module_->compilation_state()->Abort();
 
     if (job_->num_pending_foreground_tasks_ == 0) {
       job_->DoSync<AsyncCompileJob::DecodeFail>(std::move(result));
@@ -2949,6 +2619,7 @@ bool AsyncStreamingProcessor::ProcessModuleHeader(Vector<const uint8_t> bytes,
                                                   uint32_t offset) {
   TRACE_STREAMING("Process module header...\n");
   decoder_.StartDecoding(job_->isolate());
+  job_->module_ = decoder_.shared_module();
   decoder_.DecodeModuleHeader(bytes, offset);
   if (!decoder_.ok()) {
     FinishAsyncCompileJobWithError(decoder_.FinishDecoding(false));
@@ -2999,8 +2670,7 @@ bool AsyncStreamingProcessor::ProcessCodeSectionHeader(size_t functions_count,
     FinishAsyncCompileJobWithError(decoder_.FinishDecoding(false));
     return false;
   }
-  job_->NextStep<AsyncCompileJob::PrepareAndStartCompile>(decoder_.module(),
-                                                          false);
+  job_->NextStep<AsyncCompileJob::PrepareAndStartCompile>(false);
   // Execute the PrepareAndStartCompile step immediately and not in a separate
   // task. The step expects to be run on a separate foreground thread though, so
   // we to increment {num_pending_foreground_tasks_} to look like one.
@@ -3009,15 +2679,14 @@ bool AsyncStreamingProcessor::ProcessCodeSectionHeader(size_t functions_count,
   constexpr bool on_foreground = true;
   job_->step_->Run(on_foreground);
 
-  NativeModule* native_module = job_->compiled_module_->GetNativeModule();
-  native_module->compilation_state()->SetNumberOfFunctionsToCompile(
+  job_->native_module_->compilation_state()->SetNumberOfFunctionsToCompile(
       functions_count);
 
   // Set outstanding_finishers_ to 2, because both the AsyncCompileJob and the
   // AsyncStreamingProcessor have to finish.
-  job_->outstanding_finishers_.SetValue(2);
-  compilation_unit_builder_.reset(new CompilationUnitBuilder(
-      native_module, job_->module_env_.get(), job_->centry_stub_));
+  job_->outstanding_finishers_.store(2);
+  compilation_unit_builder_.reset(
+      new CompilationUnitBuilder(job_->native_module_));
   return true;
 }
 
@@ -3026,7 +2695,6 @@ bool AsyncStreamingProcessor::ProcessFunctionBody(Vector<const uint8_t> bytes,
                                                   uint32_t offset) {
   TRACE_STREAMING("Process function body %d ...\n", next_function_);
 
-  if (next_function_ >= FLAG_skip_compiling_wasm_funcs) {
     decoder_.DecodeFunctionBody(
         next_function_, static_cast<uint32_t>(bytes.length()), offset, false);
 
@@ -3034,7 +2702,6 @@ bool AsyncStreamingProcessor::ProcessFunctionBody(Vector<const uint8_t> bytes,
     const WasmFunction* func = &decoder_.module()->functions[index];
     WasmName name = {nullptr, 0};
     compilation_unit_builder_->AddUnit(func, offset, bytes, name);
-  }
   ++next_function_;
   // This method always succeeds. The return value is necessary to comply with
   // the StreamingProcessor interface.
@@ -3052,25 +2719,24 @@ void AsyncStreamingProcessor::OnFinishedChunk() {
 }
 
 // Finish the processing of the stream.
-void AsyncStreamingProcessor::OnFinishedStream(std::unique_ptr<uint8_t[]> bytes,
-                                               size_t length) {
+void AsyncStreamingProcessor::OnFinishedStream(OwnedVector<uint8_t> bytes) {
   TRACE_STREAMING("Finish stream...\n");
-  job_->bytes_copy_ = std::move(bytes);
-  job_->wire_bytes_ = ModuleWireBytes(job_->bytes_copy_.get(),
-                                      job_->bytes_copy_.get() + length);
+  if (job_->native_module_) {
+    job_->wire_bytes_ = ModuleWireBytes(bytes.as_vector());
+    job_->native_module_->set_wire_bytes(std::move(bytes));
+  }
   ModuleResult result = decoder_.FinishDecoding(false);
   DCHECK(result.ok());
-  job_->module_ = std::move(result.val);
+  DCHECK_EQ(job_->module_, result.val);
   if (job_->DecrementAndCheckFinisherCount()) {
-    if (job_->compiled_module_.is_null()) {
+    if (job_->native_module_ == nullptr) {
       // We are processing a WebAssembly module without code section. We need to
       // prepare compilation first before we can finish it.
       // {PrepareAndStartCompile} will call {FinishCompile} by itself if there
       // is no code section.
-      job_->DoSync<AsyncCompileJob::PrepareAndStartCompile>(job_->module_.get(),
-                                                            true);
+      job_->DoSync<AsyncCompileJob::PrepareAndStartCompile>(true);
     } else {
-      job_->DoSync<AsyncCompileJob::FinishCompile>();
+      job_->FinishCompile();
     }
   }
 }
@@ -3086,155 +2752,173 @@ void AsyncStreamingProcessor::OnAbort() {
   job_->Abort();
 }
 
-CompilationState::CodeGenerationSchedule::CodeGenerationSchedule(
-    base::RandomNumberGenerator* random_number_generator, size_t max_memory)
-    : random_number_generator_(random_number_generator),
-      max_memory_(max_memory) {
-  DCHECK_NOT_NULL(random_number_generator_);
-  DCHECK_GT(max_memory_, 0);
-}
-
-void CompilationState::CodeGenerationSchedule::Schedule(
-    std::unique_ptr<compiler::WasmCompilationUnit> item) {
-  size_t cost = item->memory_cost();
-  schedule_.push_back(std::move(item));
-  allocated_memory_ += cost;
-}
-
-bool CompilationState::CodeGenerationSchedule::CanAcceptWork() const {
-  return allocated_memory_ <= max_memory_;
-}
-
-bool CompilationState::CodeGenerationSchedule::ShouldIncreaseWorkload() const {
-  // Half the memory is unused again, we can increase the workload again.
-  return allocated_memory_ <= max_memory_ / 2;
-}
-
-std::unique_ptr<compiler::WasmCompilationUnit>
-CompilationState::CodeGenerationSchedule::GetNext() {
-  DCHECK(!IsEmpty());
-  size_t index = GetRandomIndexInSchedule();
-  auto ret = std::move(schedule_[index]);
-  std::swap(schedule_[schedule_.size() - 1], schedule_[index]);
-  schedule_.pop_back();
-  allocated_memory_ -= ret->memory_cost();
-  return ret;
-}
-
-size_t CompilationState::CodeGenerationSchedule::GetRandomIndexInSchedule() {
-  double factor = random_number_generator_->NextDouble();
-  size_t index = (size_t)(factor * schedule_.size());
-  DCHECK_GE(index, 0);
-  DCHECK_LT(index, schedule_.size());
-  return index;
-}
-
 void CompilationStateDeleter::operator()(
     CompilationState* compilation_state) const {
   delete compilation_state;
 }
 
 std::unique_ptr<CompilationState, CompilationStateDeleter> NewCompilationState(
-    Isolate* isolate) {
+    Isolate* isolate, const ModuleEnv& env) {
   return std::unique_ptr<CompilationState, CompilationStateDeleter>(
-      new CompilationState(isolate));
+      new CompilationState(isolate, env));
+}
+
+ModuleEnv* GetModuleEnv(CompilationState* compilation_state) {
+  return compilation_state->module_env();
 }
 
-CompilationState::CompilationState(internal::Isolate* isolate)
+CompilationState::CompilationState(internal::Isolate* isolate,
+                                   const ModuleEnv& env)
     : isolate_(isolate),
-      executed_units_(isolate->random_number_generator(),
-                      GetMaxUsableMemorySize(isolate) / 2),
+      wasm_engine_(isolate->wasm_engine()),
+      module_env_(env),
+      max_memory_(GetMaxUsableMemorySize(isolate) / 2),
+      compile_mode_(FLAG_wasm_tier_up && env.module->origin == kWasmOrigin
+                        ? CompileMode::kTiering
+                        : CompileMode::kRegular),
       max_background_tasks_(std::max(
           1, std::min(FLAG_wasm_num_compilation_tasks,
                       V8::GetCurrentPlatform()->NumberOfWorkerThreads()))) {
+  DCHECK_LT(0, max_memory_);
   v8::Isolate* v8_isolate = reinterpret_cast<v8::Isolate*>(isolate_);
   v8::Platform* platform = V8::GetCurrentPlatform();
   foreground_task_runner_ = platform->GetForegroundTaskRunner(v8_isolate);
-  background_task_runner_ = platform->GetWorkerThreadsTaskRunner(v8_isolate);
 
-  // Register task manager for clean shutdown in case of an isolate shutdown.
-  isolate_->wasm_engine()->Register(&background_task_manager_);
+  // Register task manager for clean shutdown in case of an engine shutdown.
+  wasm_engine_->Register(&background_task_manager_);
+  wasm_engine_->Register(&foreground_task_manager_);
 }
 
 CompilationState::~CompilationState() {
   CancelAndWait();
   foreground_task_manager_.CancelAndWait();
+  wasm_engine_->Unregister(&foreground_task_manager_);
+  NotifyOnEvent(CompilationEvent::kDestroyed, nullptr);
 }
 
 void CompilationState::SetNumberOfFunctionsToCompile(size_t num_functions) {
   DCHECK(!failed());
   outstanding_units_ = num_functions;
+
+  if (compile_mode_ == CompileMode::kTiering) {
+    outstanding_units_ += num_functions;
+    num_tiering_units_ = num_functions;
+  }
 }
 
 void CompilationState::AddCallback(
-    std::function<void(CompilationEvent, Handle<Object>)> callback) {
+    std::function<void(CompilationEvent, ErrorThrower*)> callback) {
   callbacks_.push_back(callback);
 }
 
 void CompilationState::AddCompilationUnits(
-    std::vector<std::unique_ptr<compiler::WasmCompilationUnit>>& units) {
+    std::vector<std::unique_ptr<WasmCompilationUnit>>& baseline_units,
+    std::vector<std::unique_ptr<WasmCompilationUnit>>& tiering_units) {
   {
     base::LockGuard<base::Mutex> guard(&mutex_);
-    compilation_units_.insert(compilation_units_.end(),
-                              std::make_move_iterator(units.begin()),
-                              std::make_move_iterator(units.end()));
+
+    if (compile_mode_ == CompileMode::kTiering) {
+      DCHECK_EQ(baseline_units.size(), tiering_units.size());
+      DCHECK_EQ(tiering_units.back()->mode(),
+                WasmCompilationUnit::CompilationMode::kTurbofan);
+      tiering_compilation_units_.insert(
+          tiering_compilation_units_.end(),
+          std::make_move_iterator(tiering_units.begin()),
+          std::make_move_iterator(tiering_units.end()));
+    } else {
+      DCHECK(tiering_compilation_units_.empty());
+    }
+
+    baseline_compilation_units_.insert(
+        baseline_compilation_units_.end(),
+        std::make_move_iterator(baseline_units.begin()),
+        std::make_move_iterator(baseline_units.end()));
   }
-  RestartBackgroundTasks(units.size());
+
+  RestartBackgroundTasks();
 }
 
-std::unique_ptr<compiler::WasmCompilationUnit>
+std::unique_ptr<WasmCompilationUnit>
 CompilationState::GetNextCompilationUnit() {
   base::LockGuard<base::Mutex> guard(&mutex_);
-  if (!compilation_units_.empty()) {
-    std::unique_ptr<compiler::WasmCompilationUnit> unit =
-        std::move(compilation_units_.back());
-    compilation_units_.pop_back();
+
+  std::vector<std::unique_ptr<WasmCompilationUnit>>& units =
+      baseline_compilation_units_.empty() ? tiering_compilation_units_
+                                          : baseline_compilation_units_;
+
+  if (!units.empty()) {
+    std::unique_ptr<WasmCompilationUnit> unit = std::move(units.back());
+    units.pop_back();
     return unit;
   }
 
-  return std::unique_ptr<compiler::WasmCompilationUnit>();
+  return std::unique_ptr<WasmCompilationUnit>();
 }
 
-std::unique_ptr<compiler::WasmCompilationUnit>
-CompilationState::GetNextExecutedUnit() {
+std::unique_ptr<WasmCompilationUnit> CompilationState::GetNextExecutedUnit() {
   base::LockGuard<base::Mutex> guard(&mutex_);
-  if (!executed_units_.IsEmpty()) {
-    return executed_units_.GetNext();
-  }
-
-  return std::unique_ptr<compiler::WasmCompilationUnit>();
+  std::vector<std::unique_ptr<WasmCompilationUnit>>& units = finish_units();
+  if (units.empty()) return {};
+  std::unique_ptr<WasmCompilationUnit> ret = std::move(units.back());
+  units.pop_back();
+  allocated_memory_ -= ret->memory_cost();
+  return ret;
 }
 
 bool CompilationState::HasCompilationUnitToFinish() {
   base::LockGuard<base::Mutex> guard(&mutex_);
-  return !executed_units_.IsEmpty();
+  return !finish_units().empty();
 }
 
-void CompilationState::OnError(Handle<Object> error,
-                               NotifyCompilationCallback notify) {
+void CompilationState::OnError(ErrorThrower* thrower) {
   Abort();
-  if (notify == NotifyCompilationCallback::kNotify) {
-    NotifyOnEvent(CompilationEvent::kFailedCompilation, error);
-  }
+  DCHECK(thrower->error());
+  NotifyOnEvent(CompilationEvent::kFailedCompilation, thrower);
 }
 
-void CompilationState::OnFinishedUnit(NotifyCompilationCallback notify) {
+void CompilationState::OnFinishedUnit() {
   DCHECK_GT(outstanding_units_, 0);
   --outstanding_units_;
 
   if (outstanding_units_ == 0) {
     CancelAndWait();
-    if (notify == NotifyCompilationCallback::kNotify) {
-      NotifyOnEvent(CompilationEvent::kFinishedBaselineCompilation,
-                    Handle<Object>::null());
-    }
+    baseline_compilation_finished_ = true;
+
+    DCHECK(compile_mode_ == CompileMode::kRegular ||
+           compile_mode_ == CompileMode::kTiering);
+    NotifyOnEvent(compile_mode_ == CompileMode::kRegular
+                      ? CompilationEvent::kFinishedBaselineCompilation
+                      : CompilationEvent::kFinishedTopTierCompilation,
+                  nullptr);
+
+  } else if (outstanding_units_ == num_tiering_units_) {
+    DCHECK_EQ(compile_mode_, CompileMode::kTiering);
+    baseline_compilation_finished_ = true;
+
+    // TODO(wasm): For streaming compilation, we want to start top tier
+    // compilation before all functions have been compiled with Liftoff, e.g.
+    // in the case when all received functions have been compiled with Liftoff
+    // and we are waiting for new functions to compile.
+
+    // If we are in {kRegular} mode, {num_tiering_units_} is 0, therefore
+    // this case is already caught by the previous check.
+    NotifyOnEvent(CompilationEvent::kFinishedBaselineCompilation, nullptr);
+    RestartBackgroundTasks();
   }
 }
 
 void CompilationState::ScheduleUnitForFinishing(
-    std::unique_ptr<compiler::WasmCompilationUnit>& unit) {
+    std::unique_ptr<WasmCompilationUnit> unit,
+    WasmCompilationUnit::CompilationMode mode) {
+  size_t cost = unit->memory_cost();
   base::LockGuard<base::Mutex> guard(&mutex_);
-  executed_units_.Schedule(std::move(unit));
+  if (compile_mode_ == CompileMode::kTiering &&
+      mode == WasmCompilationUnit::CompilationMode::kTurbofan) {
+    tiering_finish_units_.push_back(std::move(unit));
+  } else {
+    baseline_finish_units_.push_back(std::move(unit));
+  }
+  allocated_memory_ += cost;
 
   if (!finisher_is_running_ && !failed_) {
     ScheduleFinisherTask();
@@ -3245,7 +2929,7 @@ void CompilationState::ScheduleUnitForFinishing(
 
 void CompilationState::CancelAndWait() {
   background_task_manager_.CancelAndWait();
-  isolate_->wasm_engine()->Unregister(&background_task_manager_);
+  wasm_engine_->Unregister(&background_task_manager_);
 }
 
 void CompilationState::OnBackgroundTaskStopped() {
@@ -3255,26 +2939,34 @@ void CompilationState::OnBackgroundTaskStopped() {
 }
 
 void CompilationState::RestartBackgroundTasks(size_t max) {
-  size_t num_restart = max;
+  size_t num_restart;
   {
     base::LockGuard<base::Mutex> guard(&mutex_);
-    if (!executed_units_.ShouldIncreaseWorkload()) return;
+    // No need to restart tasks if compilation already failed.
+    if (failed_) return;
+
+    bool should_increase_workload = allocated_memory_ <= max_memory_ / 2;
+    if (!should_increase_workload) return;
     DCHECK_LE(num_background_tasks_, max_background_tasks_);
     if (num_background_tasks_ == max_background_tasks_) return;
-    num_restart = std::min(
-        num_restart, std::min(compilation_units_.size(),
-                              max_background_tasks_ - num_background_tasks_));
+    size_t num_compilation_units =
+        baseline_compilation_units_.size() + tiering_compilation_units_.size();
+    size_t stopped_tasks = max_background_tasks_ - num_background_tasks_;
+    num_restart = std::min(max, std::min(num_compilation_units, stopped_tasks));
     num_background_tasks_ += num_restart;
   }
 
-  // If --wasm-num-compilation-tasks=0 is passed, do only spawn foreground
-  // tasks. This is used to make timing deterministic.
-  v8::TaskRunner* task_runner = FLAG_wasm_num_compilation_tasks > 0
-                                    ? background_task_runner_.get()
-                                    : foreground_task_runner_.get();
   for (; num_restart > 0; --num_restart) {
-    task_runner->PostTask(base::make_unique<BackgroundCompileTask>(
-        this, &background_task_manager_));
+    auto task = base::make_unique<BackgroundCompileTask>(
+        this, &background_task_manager_);
+
+    // If --wasm-num-compilation-tasks=0 is passed, do only spawn foreground
+    // tasks. This is used to make timing deterministic.
+    if (FLAG_wasm_num_compilation_tasks > 0) {
+      V8::GetCurrentPlatform()->CallOnWorkerThread(std::move(task));
+    } else {
+      foreground_task_runner_->PostTask(std::move(task));
+    }
   }
 }
 
@@ -3293,7 +2985,8 @@ void CompilationState::ScheduleFinisherTask() {
 bool CompilationState::StopBackgroundCompilationTaskForThrottling() {
   base::LockGuard<base::Mutex> guard(&mutex_);
   DCHECK_LE(1, num_background_tasks_);
-  if (executed_units_.CanAcceptWork()) return false;
+  bool can_accept_work = allocated_memory_ < max_memory_;
+  if (can_accept_work) return false;
   --num_background_tasks_;
   return true;
 }
@@ -3307,32 +3000,27 @@ void CompilationState::Abort() {
 }
 
 void CompilationState::NotifyOnEvent(CompilationEvent event,
-                                     Handle<Object> error) {
+                                     ErrorThrower* thrower) {
   for (auto& callback_function : callbacks_) {
-    callback_function(event, error);
+    callback_function(event, thrower);
   }
 }
 
 void CompileJsToWasmWrappers(Isolate* isolate,
-                             Handle<WasmCompiledModule> compiled_module,
-                             Counters* counters) {
+                             Handle<WasmModuleObject> module_object) {
   JSToWasmWrapperCache js_to_wasm_cache;
-  Handle<WeakCell> weak_instance(compiled_module->weak_owning_instance(),
-                                 isolate);
-  js_to_wasm_cache.SetWeakInstance(weak_instance);
   int wrapper_index = 0;
-  Handle<FixedArray> export_wrappers(compiled_module->export_wrappers(),
-                                     isolate);
-  NativeModule* native_module = compiled_module->GetNativeModule();
-  for (auto exp : compiled_module->shared()->module()->export_table) {
+  Handle<FixedArray> export_wrappers(module_object->export_wrappers(), isolate);
+  NativeModule* native_module = module_object->native_module();
+  wasm::UseTrapHandler use_trap_handler =
+      native_module->use_trap_handler() ? kUseTrapHandler : kNoTrapHandler;
+  const WasmModule* module = native_module->module();
+  for (auto exp : module->export_table) {
     if (exp.kind != kExternalFunction) continue;
-    wasm::WasmCode* wasm_code =
-        native_module->GetIndirectlyCallableCode(exp.index);
-    Handle<Code> wrapper_code = js_to_wasm_cache.CloneOrCompileJSToWasmWrapper(
-        isolate, compiled_module->shared()->module(), wasm_code, exp.index,
-        compiled_module->use_trap_handler());
+    Handle<Code> wrapper_code = js_to_wasm_cache.GetOrCompileJSToWasmWrapper(
+        isolate, native_module, exp.index, use_trap_handler);
     export_wrappers->set(wrapper_index, *wrapper_code);
-    RecordStats(*wrapper_code, counters);
+    RecordStats(*wrapper_code, isolate->counters());
     ++wrapper_index;
   }
 }
@@ -3372,7 +3060,6 @@ Handle<Script> CreateWasmScript(Isolate* isolate,
 }  // namespace v8
 
 #undef TRACE
-#undef TRACE_CHAIN
 #undef TRACE_COMPILE
 #undef TRACE_STREAMING
 #undef TRACE_LAZY
diff --git a/deps/v8/src/wasm/module-compiler.h b/deps/v8/src/wasm/module-compiler.h
index 917d9b2ef07486..eb9f271543c986 100644
--- a/deps/v8/src/wasm/module-compiler.h
+++ b/deps/v8/src/wasm/module-compiler.h
@@ -5,38 +5,52 @@
 #ifndef V8_WASM_MODULE_COMPILER_H_
 #define V8_WASM_MODULE_COMPILER_H_
 
+#include <atomic>
 #include <functional>
+#include <memory>
 
-#include "src/base/atomic-utils.h"
 #include "src/cancelable-task.h"
-#include "src/isolate.h"
-
-#include "src/wasm/module-decoder.h"
-#include "src/wasm/streaming-decoder.h"
+#include "src/globals.h"
 #include "src/wasm/wasm-module.h"
-#include "src/wasm/wasm-objects.h"
 
 namespace v8 {
 namespace internal {
+
+class JSArrayBuffer;
+class JSPromise;
+class Counters;
+class WasmModuleObject;
+class WasmInstanceObject;
+
+template <typename T>
+class Vector;
+
 namespace wasm {
 
+class CompilationResultResolver;
+class CompilationState;
+class ErrorThrower;
 class ModuleCompiler;
+class NativeModule;
 class WasmCode;
-class CompilationState;
+struct ModuleEnv;
+struct WasmModule;
 
 struct CompilationStateDeleter {
   void operator()(CompilationState* compilation_state) const;
 };
 
 // Wrapper to create a CompilationState exists in order to avoid having
-// the the CompilationState in the header file.
+// the CompilationState in the header file.
 std::unique_ptr<CompilationState, CompilationStateDeleter> NewCompilationState(
-    Isolate* isolate);
+    Isolate* isolate, const ModuleEnv& env);
+
+ModuleEnv* GetModuleEnv(CompilationState* compilation_state);
 
 MaybeHandle<WasmModuleObject> CompileToModuleObject(
-    Isolate* isolate, ErrorThrower* thrower, std::unique_ptr<WasmModule> module,
-    const ModuleWireBytes& wire_bytes, Handle<Script> asm_js_script,
-    Vector<const byte> asm_js_offset_table_bytes);
+    Isolate* isolate, ErrorThrower* thrower,
+    std::shared_ptr<const WasmModule> module, const ModuleWireBytes& wire_bytes,
+    Handle<Script> asm_js_script, Vector<const byte> asm_js_offset_table_bytes);
 
 MaybeHandle<WasmInstanceObject> InstantiateToInstanceObject(
     Isolate* isolate, ErrorThrower* thrower,
@@ -45,22 +59,14 @@ MaybeHandle<WasmInstanceObject> InstantiateToInstanceObject(
 
 V8_EXPORT_PRIVATE
 void CompileJsToWasmWrappers(Isolate* isolate,
-                             Handle<WasmCompiledModule> compiled_module,
-                             Counters* counters);
+                             Handle<WasmModuleObject> module_object);
 
 V8_EXPORT_PRIVATE Handle<Script> CreateWasmScript(
     Isolate* isolate, const ModuleWireBytes& wire_bytes);
 
 // Triggered by the WasmCompileLazy builtin.
-// Walks the stack (top three frames) to determine the wasm instance involved
-// and which function to compile.
-// Then triggers WasmCompiledModule::CompileLazy, taking care of correctly
-// patching the call site or indirect function tables.
-// Returns either the Code object that has been lazily compiled, or Illegal if
-// an error occurred. In the latter case, a pending exception has been set,
-// which will be triggered when returning from the runtime function, i.e. the
-// Illegal builtin will never be called.
-Address CompileLazy(Isolate* isolate, Handle<WasmInstanceObject> instance);
+// Returns the instruction start of the compiled code object.
+Address CompileLazy(Isolate*, NativeModule*, uint32_t func_index);
 
 // Encapsulates all the state and steps of an asynchronous compilation.
 // An asynchronous compile job consists of a number of tasks that are executed
@@ -73,7 +79,8 @@ class AsyncCompileJob {
  public:
   explicit AsyncCompileJob(Isolate* isolate, std::unique_ptr<byte[]> bytes_copy,
                            size_t length, Handle<Context> context,
-                           Handle<JSPromise> promise);
+                           std::unique_ptr<CompilationResultResolver> resolver);
+  ~AsyncCompileJob();
 
   void Start();
 
@@ -81,7 +88,7 @@ class AsyncCompileJob {
 
   void Abort();
 
-  ~AsyncCompileJob();
+  Isolate* isolate() const { return isolate_; }
 
  private:
   class CompileTask;
@@ -92,21 +99,21 @@ class AsyncCompileJob {
   class DecodeFail;
   class PrepareAndStartCompile;
   class CompileFailed;
-  class WaitForBackgroundTasks;
-  class FinishCompilationUnits;
-  class FinishCompile;
   class CompileWrappers;
   class FinishModule;
   class AbortCompilation;
+  class UpdateToTopTierCompiledCode;
 
   const std::shared_ptr<Counters>& async_counters() const {
     return async_counters_;
   }
   Counters* counters() const { return async_counters().get(); }
 
+  void FinishCompile();
+
   void AsyncCompileFailed(Handle<Object> error_reason);
 
-  void AsyncCompileSucceeded(Handle<Object> result);
+  void AsyncCompileSucceeded(Handle<WasmModuleObject> result);
 
   void StartForegroundTask();
 
@@ -127,40 +134,39 @@ class AsyncCompileJob {
   template <typename Step, typename... Args>
   void NextStep(Args&&... args);
 
-  Isolate* isolate() { return isolate_; }
-
   friend class AsyncStreamingProcessor;
 
   Isolate* isolate_;
   const std::shared_ptr<Counters> async_counters_;
+  // Copy of the module wire bytes, moved into the {native_module_} on it's
+  // creation.
   std::unique_ptr<byte[]> bytes_copy_;
+  // Reference to the wire bytes (hold in {bytes_copy_} or as part of
+  // {native_module_}).
   ModuleWireBytes wire_bytes_;
-  Handle<Context> context_;
-  Handle<JSPromise> module_promise_;
-  std::unique_ptr<compiler::ModuleEnv> module_env_;
-  std::unique_ptr<WasmModule> module_;
+  Handle<Context> native_context_;
+  std::unique_ptr<CompilationResultResolver> resolver_;
+  std::shared_ptr<const WasmModule> module_;
 
   std::vector<DeferredHandles*> deferred_handles_;
   Handle<WasmModuleObject> module_object_;
-  Handle<WasmCompiledModule> compiled_module_;
+  NativeModule* native_module_ = nullptr;
 
   std::unique_ptr<CompileStep> step_;
   CancelableTaskManager background_task_manager_;
-  Handle<Code> centry_stub_;
 
   std::shared_ptr<v8::TaskRunner> foreground_task_runner_;
-  std::shared_ptr<v8::TaskRunner> background_task_runner_;
 
   // For async compilation the AsyncCompileJob is the only finisher. For
   // streaming compilation also the AsyncStreamingProcessor has to finish before
   // compilation can be finished.
-  base::AtomicNumber<int32_t> outstanding_finishers_{1};
+  std::atomic<int32_t> outstanding_finishers_{1};
 
   // Decrements the number of outstanding finishers. The last caller of this
   // function should finish the asynchronous compilation, see the comment on
   // {outstanding_finishers_}.
   V8_WARN_UNUSED_RESULT bool DecrementAndCheckFinisherCount() {
-    return outstanding_finishers_.Decrement(1) == 0;
+    return outstanding_finishers_.fetch_sub(1) == 1;
   }
 
   // Counts the number of pending foreground tasks.
@@ -171,6 +177,8 @@ class AsyncCompileJob {
   // compilation. The AsyncCompileJob does not actively use the
   // StreamingDecoder.
   std::shared_ptr<StreamingDecoder> stream_;
+
+  bool tiering_completed_ = false;
 };
 }  // namespace wasm
 }  // namespace internal
diff --git a/deps/v8/src/wasm/module-decoder.cc b/deps/v8/src/wasm/module-decoder.cc
index 3bf22f10473b86..3099f971d950d9 100644
--- a/deps/v8/src/wasm/module-decoder.cc
+++ b/deps/v8/src/wasm/module-decoder.cc
@@ -291,12 +291,12 @@ class ModuleDecoderImpl : public Decoder {
   void StartDecoding(Isolate* isolate) {
     CHECK_NULL(module_);
     SetCounters(isolate->counters());
-    module_.reset(new WasmModule(
-        base::make_unique<Zone>(isolate->allocator(), "signatures")));
+    module_.reset(new WasmModule(base::make_unique<Zone>(
+        isolate->wasm_engine()->allocator(), "signatures")));
     module_->initial_pages = 0;
     module_->maximum_pages = 0;
     module_->mem_export = false;
-    module_->set_origin(origin_);
+    module_->origin = origin_;
   }
 
   void DecodeModuleHeader(Vector<const uint8_t> bytes, uint8_t offset) {
@@ -473,38 +473,42 @@ class ModuleDecoderImpl : public Decoder {
         case kExternalTable: {
           // ===== Imported table ==========================================
           if (!AddTable(module_.get())) break;
-          import->index =
-              static_cast<uint32_t>(module_->function_tables.size());
-          module_->function_tables.emplace_back();
-          WasmIndirectFunctionTable* table = &module_->function_tables.back();
+          import->index = static_cast<uint32_t>(module_->tables.size());
+          module_->tables.emplace_back();
+          WasmTable* table = &module_->tables.back();
           table->imported = true;
-          expect_u8("element type", kWasmAnyFunctionTypeCode);
+          expect_u8("element type", kLocalAnyFunc);
+          uint8_t flags = validate_table_flags("element count");
           consume_resizable_limits(
               "element count", "elements", FLAG_wasm_max_table_size,
               &table->initial_size, &table->has_maximum_size,
-              FLAG_wasm_max_table_size, &table->maximum_size);
+              FLAG_wasm_max_table_size, &table->maximum_size, flags);
           break;
         }
         case kExternalMemory: {
           // ===== Imported memory =========================================
           if (!AddMemory(module_.get())) break;
+          uint8_t flags = validate_memory_flags(&module_->has_shared_memory);
           consume_resizable_limits(
               "memory", "pages", FLAG_wasm_max_mem_pages,
               &module_->initial_pages, &module_->has_maximum_pages,
-              kSpecMaxWasmMemoryPages, &module_->maximum_pages,
-              &module_->has_shared_memory);
+              kSpecMaxWasmMemoryPages, &module_->maximum_pages, flags);
           break;
         }
         case kExternalGlobal: {
           // ===== Imported global =========================================
           import->index = static_cast<uint32_t>(module_->globals.size());
           module_->globals.push_back(
-              {kWasmStmt, false, WasmInitExpr(), 0, true, false});
+              {kWasmStmt, false, WasmInitExpr(), {0}, true, false});
           WasmGlobal* global = &module_->globals.back();
           global->type = consume_value_type();
           global->mutability = consume_mutability();
           if (global->mutability) {
-            error("mutable globals cannot be imported");
+            if (FLAG_experimental_wasm_mut_global) {
+              module_->num_imported_mutable_globals++;
+            } else {
+              error("mutable globals cannot be imported");
+            }
           }
           break;
         }
@@ -518,12 +522,15 @@ class ModuleDecoderImpl : public Decoder {
   void DecodeFunctionSection() {
     uint32_t functions_count =
         consume_count("functions count", kV8MaxWasmFunctions);
-    (IsWasm() ? GetCounters()->wasm_functions_per_wasm_module()
-              : GetCounters()->wasm_functions_per_asm_module())
-        ->AddSample(static_cast<int>(functions_count));
-    module_->functions.reserve(functions_count);
+    auto counter =
+        SELECT_WASM_COUNTER(GetCounters(), origin_, wasm_functions_per, module);
+    counter->AddSample(static_cast<int>(functions_count));
+    DCHECK_EQ(module_->functions.size(), module_->num_imported_functions);
+    uint32_t total_function_count =
+        module_->num_imported_functions + functions_count;
+    module_->functions.reserve(total_function_count);
     module_->num_declared_functions = functions_count;
-    for (uint32_t i = 0; ok() && i < functions_count; ++i) {
+    for (uint32_t i = 0; i < functions_count; ++i) {
       uint32_t func_index = static_cast<uint32_t>(module_->functions.size());
       module_->functions.push_back({nullptr,     // sig
                                     func_index,  // func_index
@@ -533,21 +540,27 @@ class ModuleDecoderImpl : public Decoder {
                                     false});     // exported
       WasmFunction* function = &module_->functions.back();
       function->sig_index = consume_sig_index(module_.get(), &function->sig);
+      if (!ok()) return;
     }
+    DCHECK_EQ(module_->functions.size(), total_function_count);
   }
 
   void DecodeTableSection() {
-    uint32_t table_count = consume_count("table count", kV8MaxWasmTables);
+    // TODO(ahaas): Set the correct limit to {kV8MaxWasmTables} once the
+    // implementation of AnyRef landed.
+    uint32_t max_count = FLAG_experimental_wasm_anyref ? 10 : kV8MaxWasmTables;
+    uint32_t table_count = consume_count("table count", max_count);
 
     for (uint32_t i = 0; ok() && i < table_count; i++) {
       if (!AddTable(module_.get())) break;
-      module_->function_tables.emplace_back();
-      WasmIndirectFunctionTable* table = &module_->function_tables.back();
-      expect_u8("table type", kWasmAnyFunctionTypeCode);
-      consume_resizable_limits("table elements", "elements",
-                               FLAG_wasm_max_table_size, &table->initial_size,
-                               &table->has_maximum_size,
-                               FLAG_wasm_max_table_size, &table->maximum_size);
+      module_->tables.emplace_back();
+      WasmTable* table = &module_->tables.back();
+      table->type = consume_reference_type();
+      uint8_t flags = validate_table_flags("table elements");
+      consume_resizable_limits(
+          "table elements", "elements", FLAG_wasm_max_table_size,
+          &table->initial_size, &table->has_maximum_size,
+          FLAG_wasm_max_table_size, &table->maximum_size, flags);
     }
   }
 
@@ -556,10 +569,11 @@ class ModuleDecoderImpl : public Decoder {
 
     for (uint32_t i = 0; ok() && i < memory_count; i++) {
       if (!AddMemory(module_.get())) break;
+      uint8_t flags = validate_memory_flags(&module_->has_shared_memory);
       consume_resizable_limits(
           "memory", "pages", FLAG_wasm_max_mem_pages, &module_->initial_pages,
           &module_->has_maximum_pages, kSpecMaxWasmMemoryPages,
-          &module_->maximum_pages, &module_->has_shared_memory);
+          &module_->maximum_pages, flags);
     }
   }
 
@@ -571,7 +585,7 @@ class ModuleDecoderImpl : public Decoder {
       TRACE("DecodeGlobal[%d] module+%d\n", i, static_cast<int>(pc_ - start_));
       // Add an uninitialized global and pass a pointer to it.
       module_->globals.push_back(
-          {kWasmStmt, false, WasmInitExpr(), 0, false, false});
+          {kWasmStmt, false, WasmInitExpr(), {0}, false, false});
       WasmGlobal* global = &module_->globals.back();
       DecodeGlobalInModule(module_.get(), i + imported_globals, global);
     }
@@ -580,7 +594,7 @@ class ModuleDecoderImpl : public Decoder {
 
   void DecodeExportSection() {
     uint32_t export_table_count =
-        consume_count("exports count", kV8MaxWasmImports);
+        consume_count("exports count", kV8MaxWasmExports);
     module_->export_table.reserve(export_table_count);
     for (uint32_t i = 0; ok() && i < export_table_count; ++i) {
       TRACE("DecodeExportTable[%d] module+%d\n", i,
@@ -606,7 +620,7 @@ class ModuleDecoderImpl : public Decoder {
           break;
         }
         case kExternalTable: {
-          WasmIndirectFunctionTable* table = nullptr;
+          WasmTable* table = nullptr;
           exp->index = consume_table_index(module_.get(), &table);
           if (table) table->exported = true;
           break;
@@ -625,7 +639,7 @@ class ModuleDecoderImpl : public Decoder {
           WasmGlobal* global = nullptr;
           exp->index = consume_global_index(module_.get(), &global);
           if (global) {
-            if (global->mutability) {
+            if (!FLAG_experimental_wasm_mut_global && global->mutability) {
               error("mutable globals cannot be exported");
             }
             global->exported = true;
@@ -682,7 +696,7 @@ class ModuleDecoderImpl : public Decoder {
     uint32_t element_count =
         consume_count("element count", FLAG_wasm_max_table_size);
 
-    if (element_count > 0 && module_->function_tables.size() == 0) {
+    if (element_count > 0 && module_->tables.size() == 0) {
       error(pc_, "The element section requires a table");
     }
     for (uint32_t i = 0; ok() && i < element_count; ++i) {
@@ -691,7 +705,7 @@ class ModuleDecoderImpl : public Decoder {
       if (table_index != 0) {
         errorf(pos, "illegal table index %u != 0", table_index);
       }
-      if (table_index >= module_->function_tables.size()) {
+      if (table_index >= module_->tables.size()) {
         errorf(pos, "out of bounds table index %u", table_index);
         break;
       }
@@ -889,11 +903,9 @@ class ModuleDecoderImpl : public Decoder {
     return consume_init_expr(nullptr, kWasmStmt);
   }
 
-  WasmModule* module() { return module_.get(); }
-
-  bool IsWasm() { return origin_ == kWasmOrigin; }
+  const std::shared_ptr<WasmModule>& shared_module() const { return module_; }
 
-  Counters* GetCounters() {
+  Counters* GetCounters() const {
     DCHECK_NOT_NULL(counters_);
     return counters_;
   }
@@ -904,7 +916,7 @@ class ModuleDecoderImpl : public Decoder {
   }
 
  private:
-  std::unique_ptr<WasmModule> module_;
+  std::shared_ptr<WasmModule> module_;
   Counters* counters_ = nullptr;
   // The type section is the first section in a module.
   uint8_t next_section_ = kFirstSectionInModule;
@@ -922,7 +934,8 @@ class ModuleDecoderImpl : public Decoder {
   }
 
   bool AddTable(WasmModule* module) {
-    if (module->function_tables.size() > 0) {
+    if (FLAG_experimental_wasm_anyref) return true;
+    if (module->tables.size() > 0) {
       error("At most one table is supported");
       return false;
     } else {
@@ -958,14 +971,14 @@ class ModuleDecoderImpl : public Decoder {
         errorf(pos,
                "type mismatch in global initialization "
                "(from global #%u), expected %s, got %s",
-               other_index, WasmOpcodes::TypeName(global->type),
-               WasmOpcodes::TypeName(module->globals[other_index].type));
+               other_index, ValueTypes::TypeName(global->type),
+               ValueTypes::TypeName(module->globals[other_index].type));
       }
     } else {
       if (global->type != TypeOf(module, global->init)) {
         errorf(pos, "type error in global initialization, expected %s, got %s",
-               WasmOpcodes::TypeName(global->type),
-               WasmOpcodes::TypeName(TypeOf(module, global->init)));
+               ValueTypes::TypeName(global->type),
+               ValueTypes::TypeName(TypeOf(module, global->init)));
       }
     }
   }
@@ -986,18 +999,23 @@ class ModuleDecoderImpl : public Decoder {
   // Calculate individual global offsets and total size of globals table.
   void CalculateGlobalOffsets(WasmModule* module) {
     uint32_t offset = 0;
+    uint32_t num_imported_mutable_globals = 0;
     if (module->globals.size() == 0) {
-      module->globals_size = 0;
+      module->globals_buffer_size = 0;
       return;
     }
     for (WasmGlobal& global : module->globals) {
-      byte size =
-          WasmOpcodes::MemSize(WasmOpcodes::MachineTypeFor(global.type));
-      offset = (offset + size - 1) & ~(size - 1);  // align
-      global.offset = offset;
-      offset += size;
+      byte size = ValueTypes::MemSize(ValueTypes::MachineTypeFor(global.type));
+      if (global.mutability && global.imported) {
+        DCHECK(FLAG_experimental_wasm_mut_global);
+        global.index = num_imported_mutable_globals++;
+      } else {
+        offset = (offset + size - 1) & ~(size - 1);  // align
+        global.offset = offset;
+        offset += size;
+      }
     }
-    module->globals_size = offset;
+    module->globals_buffer_size = offset;
   }
 
   // Verifies the body (code) of a given function.
@@ -1007,7 +1025,7 @@ class ModuleDecoderImpl : public Decoder {
     WasmFunctionName func_name(function,
                                wire_bytes.GetNameOrNull(function, module));
     if (FLAG_trace_wasm_decoder || FLAG_trace_wasm_decode_time) {
-      OFStream os(stdout);
+      StdoutStream os;
       os << "Verifying wasm function " << func_name << std::endl;
     }
     FunctionBody body = {
@@ -1015,7 +1033,7 @@ class ModuleDecoderImpl : public Decoder {
         start_ + GetBufferRelativeOffset(function->code.offset()),
         start_ + GetBufferRelativeOffset(function->code.end_offset())};
     DecodeResult result = VerifyWasmCodeWithStats(allocator, module, body,
-                                                  IsWasm(), GetCounters());
+                                                  origin_, GetCounters());
     if (result.failed()) {
       // Wrap the error message from the function decoder.
       std::ostringstream wrapped;
@@ -1064,9 +1082,8 @@ class ModuleDecoderImpl : public Decoder {
     return consume_index("global index", module->globals, global);
   }
 
-  uint32_t consume_table_index(WasmModule* module,
-                               WasmIndirectFunctionTable** table) {
-    return consume_index("table index", module->function_tables, table);
+  uint32_t consume_table_index(WasmModule* module, WasmTable** table) {
+    return consume_index("table index", module->tables, table);
   }
 
   template <typename T>
@@ -1083,33 +1100,43 @@ class ModuleDecoderImpl : public Decoder {
     return index;
   }
 
-  void consume_resizable_limits(const char* name, const char* units,
-                                uint32_t max_initial, uint32_t* initial,
-                                bool* has_max, uint32_t max_maximum,
-                                uint32_t* maximum,
-                                bool* has_shared_memory = nullptr) {
+  uint8_t validate_table_flags(const char* name) {
     uint8_t flags = consume_u8("resizable limits flags");
     const byte* pos = pc();
+    if (flags & 0xFE) {
+      errorf(pos - 1, "invalid %s limits flags", name);
+    }
+    return flags;
+  }
 
+  uint8_t validate_memory_flags(bool* has_shared_memory) {
+    uint8_t flags = consume_u8("resizable limits flags");
+    const byte* pos = pc();
+    *has_shared_memory = false;
     if (FLAG_experimental_wasm_threads) {
-      bool is_memory = (strcmp(name, "memory") == 0);
-      if (flags & 0xFC || (!is_memory && (flags & 0xFE))) {
-        errorf(pos - 1, "invalid %s limits flags", name);
-      }
-      if (flags == 3) {
+      if (flags & 0xFC) {
+        errorf(pos - 1, "invalid memory limits flags");
+      } else if (flags == 3) {
         DCHECK_NOT_NULL(has_shared_memory);
         *has_shared_memory = true;
       } else if (flags == 2) {
         errorf(pos - 1,
-               "%s limits flags should have maximum defined if shared is true",
-               name);
+               "memory limits flags should have maximum defined if shared is "
+               "true");
       }
     } else {
       if (flags & 0xFE) {
-        errorf(pos - 1, "invalid %s limits flags", name);
+        errorf(pos - 1, "invalid memory limits flags");
       }
     }
+    return flags;
+  }
 
+  void consume_resizable_limits(const char* name, const char* units,
+                                uint32_t max_initial, uint32_t* initial,
+                                bool* has_max, uint32_t max_maximum,
+                                uint32_t* maximum, uint8_t flags) {
+    const byte* pos = pc();
     *initial = consume_u32v("initial size");
     *has_max = false;
     if (*initial > max_initial) {
@@ -1154,14 +1181,14 @@ class ModuleDecoderImpl : public Decoder {
     unsigned len = 0;
     switch (opcode) {
       case kExprGetGlobal: {
-        GlobalIndexOperand<Decoder::kValidate> operand(this, pc() - 1);
-        if (module->globals.size() <= operand.index) {
+        GlobalIndexImmediate<Decoder::kValidate> imm(this, pc() - 1);
+        if (module->globals.size() <= imm.index) {
           error("global index is out of bounds");
           expr.kind = WasmInitExpr::kNone;
           expr.val.i32_const = 0;
           break;
         }
-        WasmGlobal* global = &module->globals[operand.index];
+        WasmGlobal* global = &module->globals[imm.index];
         if (global->mutability || !global->imported) {
           error(
               "only immutable imported globals can be used in initializer "
@@ -1171,36 +1198,36 @@ class ModuleDecoderImpl : public Decoder {
           break;
         }
         expr.kind = WasmInitExpr::kGlobalIndex;
-        expr.val.global_index = operand.index;
-        len = operand.length;
+        expr.val.global_index = imm.index;
+        len = imm.length;
         break;
       }
       case kExprI32Const: {
-        ImmI32Operand<Decoder::kValidate> operand(this, pc() - 1);
+        ImmI32Immediate<Decoder::kValidate> imm(this, pc() - 1);
         expr.kind = WasmInitExpr::kI32Const;
-        expr.val.i32_const = operand.value;
-        len = operand.length;
+        expr.val.i32_const = imm.value;
+        len = imm.length;
         break;
       }
       case kExprF32Const: {
-        ImmF32Operand<Decoder::kValidate> operand(this, pc() - 1);
+        ImmF32Immediate<Decoder::kValidate> imm(this, pc() - 1);
         expr.kind = WasmInitExpr::kF32Const;
-        expr.val.f32_const = operand.value;
-        len = operand.length;
+        expr.val.f32_const = imm.value;
+        len = imm.length;
         break;
       }
       case kExprI64Const: {
-        ImmI64Operand<Decoder::kValidate> operand(this, pc() - 1);
+        ImmI64Immediate<Decoder::kValidate> imm(this, pc() - 1);
         expr.kind = WasmInitExpr::kI64Const;
-        expr.val.i64_const = operand.value;
-        len = operand.length;
+        expr.val.i64_const = imm.value;
+        len = imm.length;
         break;
       }
       case kExprF64Const: {
-        ImmF64Operand<Decoder::kValidate> operand(this, pc() - 1);
+        ImmF64Immediate<Decoder::kValidate> imm(this, pc() - 1);
         expr.kind = WasmInitExpr::kF64Const;
-        expr.val.f64_const = operand.value;
-        len = operand.length;
+        expr.val.f64_const = imm.value;
+        len = imm.length;
         break;
       }
       case kExprRefNull: {
@@ -1223,8 +1250,8 @@ class ModuleDecoderImpl : public Decoder {
     }
     if (expected != kWasmStmt && TypeOf(module, expr) != kWasmI32) {
       errorf(pos, "type error in init expression, expected %s, got %s",
-             WasmOpcodes::TypeName(expected),
-             WasmOpcodes::TypeName(TypeOf(module, expr)));
+             ValueTypes::TypeName(expected),
+             ValueTypes::TypeName(TypeOf(module, expr)));
     }
     return expr;
   }
@@ -1250,11 +1277,14 @@ class ModuleDecoderImpl : public Decoder {
       case kLocalF64:
         return kWasmF64;
       default:
-        if (IsWasm()) {
+        if (origin_ == kWasmOrigin) {
           switch (t) {
             case kLocalS128:
               if (FLAG_experimental_wasm_simd) return kWasmS128;
               break;
+            case kLocalAnyFunc:
+              if (FLAG_experimental_wasm_anyref) return kWasmAnyFunc;
+              break;
             case kLocalAnyRef:
               if (FLAG_experimental_wasm_anyref) return kWasmAnyRef;
               break;
@@ -1267,6 +1297,26 @@ class ModuleDecoderImpl : public Decoder {
     }
   }
 
+  // Reads a single 8-bit integer, interpreting it as a reference type.
+  ValueType consume_reference_type() {
+    byte val = consume_u8("reference type");
+    ValueTypeCode t = static_cast<ValueTypeCode>(val);
+    switch (t) {
+      case kLocalAnyFunc:
+        return kWasmAnyFunc;
+      case kLocalAnyRef:
+        if (!FLAG_experimental_wasm_anyref) {
+          error(pc_ - 1,
+                "Invalid type. Set --experimental-wasm-anyref to use 'AnyRef'");
+        }
+        return kWasmAnyRef;
+      default:
+        break;
+    }
+    error(pc_ - 1, "invalid reference type");
+    return kWasmStmt;
+  }
+
   FunctionSig* consume_sig(Zone* zone) {
     constexpr bool has_return_values = true;
     return consume_sig_internal(zone, has_return_values);
@@ -1320,18 +1370,16 @@ class ModuleDecoderImpl : public Decoder {
 ModuleResult DecodeWasmModule(Isolate* isolate, const byte* module_start,
                               const byte* module_end, bool verify_functions,
                               ModuleOrigin origin, Counters* counters) {
-  auto counter = origin == kWasmOrigin
-                     ? counters->wasm_decode_wasm_module_time()
-                     : counters->wasm_decode_asm_module_time();
+  auto counter =
+      SELECT_WASM_COUNTER(counters, origin, wasm_decode, module_time);
   TimedHistogramScope wasm_decode_module_time_scope(counter);
   size_t size = module_end - module_start;
   if (module_start > module_end) return ModuleResult::Error("start > end");
   if (size >= kV8MaxWasmModuleSize)
     return ModuleResult::Error("size > maximum module size: %zu", size);
   // TODO(bradnelson): Improve histogram handling of size_t.
-  auto size_counter = origin == kWasmOrigin
-                          ? counters->wasm_wasm_module_size_bytes()
-                          : counters->wasm_asm_module_size_bytes();
+  auto size_counter =
+      SELECT_WASM_COUNTER(counters, origin, wasm, module_size_bytes);
   size_counter->AddSample(static_cast<int>(size));
   // Signatures are stored in zone memory, which have the same lifetime
   // as the {module}.
@@ -1342,10 +1390,8 @@ ModuleResult DecodeWasmModule(Isolate* isolate, const byte* module_start,
   // allocated on the C++ heap.
   // https://bugs.chromium.org/p/chromium/issues/detail?id=657320
   if (result.ok()) {
-    auto peak_counter =
-        origin == kWasmOrigin
-            ? counters->wasm_decode_wasm_module_peak_memory_bytes()
-            : counters->wasm_decode_asm_module_peak_memory_bytes();
+    auto peak_counter = SELECT_WASM_COUNTER(counters, origin, wasm_decode,
+                                            module_peak_memory_bytes);
     peak_counter->AddSample(
         static_cast<int>(result.val->signature_zone->allocation_size()));
   }
@@ -1355,7 +1401,9 @@ ModuleResult DecodeWasmModule(Isolate* isolate, const byte* module_start,
 ModuleDecoder::ModuleDecoder() = default;
 ModuleDecoder::~ModuleDecoder() = default;
 
-WasmModule* ModuleDecoder::module() const { return impl_->module(); }
+const std::shared_ptr<WasmModule>& ModuleDecoder::shared_module() const {
+  return impl_->shared_module();
+}
 
 void ModuleDecoder::StartDecoding(Isolate* isolate, ModuleOrigin origin) {
   DCHECK_NULL(impl_);
@@ -1449,9 +1497,8 @@ FunctionResult DecodeWasmFunction(Isolate* isolate, Zone* zone,
   size_t size = function_end - function_start;
   if (function_start > function_end)
     return FunctionResult::Error("start > end");
-  auto size_histogram = module->is_wasm()
-                            ? counters->wasm_wasm_function_size_bytes()
-                            : counters->wasm_asm_function_size_bytes();
+  auto size_histogram =
+      SELECT_WASM_COUNTER(counters, module->origin, wasm, function_size_bytes);
   // TODO(bradnelson): Improve histogram handling of ptrdiff_t.
   size_histogram->AddSample(static_cast<int>(size));
   if (size > kV8MaxWasmFunctionSize)
diff --git a/deps/v8/src/wasm/module-decoder.h b/deps/v8/src/wasm/module-decoder.h
index d7ce2c679a73d1..dc6d4c4ae05459 100644
--- a/deps/v8/src/wasm/module-decoder.h
+++ b/deps/v8/src/wasm/module-decoder.h
@@ -13,12 +13,9 @@
 
 namespace v8 {
 namespace internal {
+namespace wasm {
 
-namespace compiler {
 struct ModuleEnv;
-}
-
-namespace wasm {
 
 inline bool IsValidSectionCode(uint8_t byte) {
   return kTypeSectionCode <= byte && byte <= kLastKnownModuleSection;
@@ -26,7 +23,7 @@ inline bool IsValidSectionCode(uint8_t byte) {
 
 const char* SectionName(SectionCode code);
 
-typedef Result<std::unique_ptr<WasmModule>> ModuleResult;
+typedef Result<std::shared_ptr<WasmModule>> ModuleResult;
 typedef Result<std::unique_ptr<WasmFunction>> FunctionResult;
 typedef std::vector<std::pair<int, int>> FunctionOffsets;
 typedef Result<FunctionOffsets> FunctionOffsetsResult;
@@ -82,10 +79,9 @@ V8_EXPORT_PRIVATE FunctionResult SyncDecodeWasmFunction(
     const WasmModule* module, const byte* function_start,
     const byte* function_end);
 
-V8_EXPORT_PRIVATE FunctionResult
-AsyncDecodeWasmFunction(Isolate* isolate, Zone* zone, compiler::ModuleEnv* env,
-                        const byte* function_start, const byte* function_end,
-                        const std::shared_ptr<Counters> async_counters);
+V8_EXPORT_PRIVATE FunctionResult AsyncDecodeWasmFunction(
+    Isolate* isolate, Zone* zone, ModuleEnv* env, const byte* function_start,
+    const byte* function_end, const std::shared_ptr<Counters> async_counters);
 
 V8_EXPORT_PRIVATE WasmInitExpr DecodeWasmInitExprForTesting(const byte* start,
                                                             const byte* end);
@@ -142,7 +138,8 @@ class ModuleDecoder {
 
   ModuleResult FinishDecoding(bool verify_functions = true);
 
-  WasmModule* module() const;
+  const std::shared_ptr<WasmModule>& shared_module() const;
+  WasmModule* module() const { return shared_module().get(); }
 
   bool ok();
 
diff --git a/deps/v8/src/wasm/signature-map.cc b/deps/v8/src/wasm/signature-map.cc
index 15b8ec0aa307e1..b4054596f88864 100644
--- a/deps/v8/src/wasm/signature-map.cc
+++ b/deps/v8/src/wasm/signature-map.cc
@@ -4,6 +4,8 @@
 
 #include "src/wasm/signature-map.h"
 
+#include "src/signature.h"
+
 namespace v8 {
 namespace internal {
 namespace wasm {
diff --git a/deps/v8/src/wasm/signature-map.h b/deps/v8/src/wasm/signature-map.h
index b7802bd2b85394..3fab0fde167d65 100644
--- a/deps/v8/src/wasm/signature-map.h
+++ b/deps/v8/src/wasm/signature-map.h
@@ -7,13 +7,18 @@
 
 #include <map>
 
-#include "src/signature.h"
-#include "src/wasm/wasm-opcodes.h"
+#include "src/wasm/value-type.h"
 
 namespace v8 {
 namespace internal {
+
+template <typename T>
+class Signature;
+
 namespace wasm {
 
+using FunctionSig = Signature<ValueType>;
+
 // A signature map canonicalizes signatures into a range of indices so that
 // two different {FunctionSig} instances with the same contents map to the
 // same index.
diff --git a/deps/v8/src/wasm/streaming-decoder.cc b/deps/v8/src/wasm/streaming-decoder.cc
index 1b5eaab332b2ef..07b425aad050e5 100644
--- a/deps/v8/src/wasm/streaming-decoder.cc
+++ b/deps/v8/src/wasm/streaming-decoder.cc
@@ -12,6 +12,7 @@
 #include "src/wasm/decoder.h"
 #include "src/wasm/leb-helper.h"
 #include "src/wasm/module-decoder.h"
+#include "src/wasm/wasm-limits.h"
 #include "src/wasm/wasm-objects.h"
 #include "src/wasm/wasm-result.h"
 
@@ -63,8 +64,8 @@ void StreamingDecoder::Finish() {
     return;
   }
 
-  std::unique_ptr<uint8_t[]> bytes(new uint8_t[total_size_]);
-  uint8_t* cursor = bytes.get();
+  OwnedVector<uint8_t> bytes = OwnedVector<uint8_t>::New(total_size_);
+  uint8_t* cursor = bytes.start();
   {
 #define BYTES(x) (x & 0xFF), (x >> 8) & 0xFF, (x >> 16) & 0xFF, (x >> 24) & 0xFF
     uint8_t module_header[]{BYTES(kWasmMagic), BYTES(kWasmVersion)};
@@ -73,11 +74,11 @@ void StreamingDecoder::Finish() {
     cursor += arraysize(module_header);
   }
   for (auto&& buffer : section_buffers_) {
-    DCHECK_LE(cursor - bytes.get() + buffer->length(), total_size_);
+    DCHECK_LE(cursor - bytes.start() + buffer->length(), total_size_);
     memcpy(cursor, buffer->bytes(), buffer->length());
     cursor += buffer->length();
   }
-  processor_->OnFinishedStream(std::move(bytes), total_size_);
+  processor_->OnFinishedStream(std::move(bytes));
 }
 
 void StreamingDecoder::Abort() {
diff --git a/deps/v8/src/wasm/streaming-decoder.h b/deps/v8/src/wasm/streaming-decoder.h
index 571179c64dbb70..7b986bc28b0be3 100644
--- a/deps/v8/src/wasm/streaming-decoder.h
+++ b/deps/v8/src/wasm/streaming-decoder.h
@@ -44,8 +44,7 @@ class V8_EXPORT_PRIVATE StreamingProcessor {
   // Report the end of the stream. If the stream was successful, all
   // received bytes are passed by parameter. If there has been an error, an
   // empty array is passed.
-  virtual void OnFinishedStream(std::unique_ptr<uint8_t[]> bytes,
-                                size_t length) = 0;
+  virtual void OnFinishedStream(OwnedVector<uint8_t> bytes) = 0;
   // Report an error detected in the StreamingDecoder.
   virtual void OnError(DecodeResult result) = 0;
   // Report the abortion of the stream.
diff --git a/deps/v8/src/wasm/value-type.h b/deps/v8/src/wasm/value-type.h
new file mode 100644
index 00000000000000..cf0360e9324394
--- /dev/null
+++ b/deps/v8/src/wasm/value-type.h
@@ -0,0 +1,346 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef V8_WASM_VALUE_TYPE_H_
+#define V8_WASM_VALUE_TYPE_H_
+
+#include "src/machine-type.h"
+#include "src/wasm/wasm-constants.h"
+
+namespace v8 {
+namespace internal {
+namespace wasm {
+
+enum ValueType : uint8_t {
+  kWasmStmt,
+  kWasmI32,
+  kWasmI64,
+  kWasmF32,
+  kWasmF64,
+  kWasmS128,
+  kWasmAnyRef,
+  kWasmAnyFunc,
+  kWasmVar,
+};
+
+// TODO(clemensh): Compute memtype and size from ValueType once we have c++14
+// constexpr support.
+#define FOREACH_LOAD_TYPE(V) \
+  V(I32, , Int32, 2)         \
+  V(I32, 8S, Int8, 0)        \
+  V(I32, 8U, Uint8, 0)       \
+  V(I32, 16S, Int16, 1)      \
+  V(I32, 16U, Uint16, 1)     \
+  V(I64, , Int64, 3)         \
+  V(I64, 8S, Int8, 0)        \
+  V(I64, 8U, Uint8, 0)       \
+  V(I64, 16S, Int16, 1)      \
+  V(I64, 16U, Uint16, 1)     \
+  V(I64, 32S, Int32, 2)      \
+  V(I64, 32U, Uint32, 2)     \
+  V(F32, , Float32, 2)       \
+  V(F64, , Float64, 3)       \
+  V(S128, , Simd128, 4)
+
+class LoadType {
+ public:
+  enum LoadTypeValue : uint8_t {
+#define DEF_ENUM(type, suffix, ...) k##type##Load##suffix,
+    FOREACH_LOAD_TYPE(DEF_ENUM)
+#undef DEF_ENUM
+  };
+
+  // Allow implicit convertion of the enum value to this wrapper.
+  constexpr LoadType(LoadTypeValue val)  // NOLINT(runtime/explicit)
+      : val_(val) {}
+
+  constexpr LoadTypeValue value() const { return val_; }
+  constexpr unsigned size_log_2() const { return kLoadSizeLog2[val_]; }
+  constexpr unsigned size() const { return 1 << size_log_2(); }
+  constexpr ValueType value_type() const { return kValueType[val_]; }
+  constexpr MachineType mem_type() const { return kMemType[val_]; }
+
+  static LoadType ForValueType(ValueType type) {
+    switch (type) {
+      case kWasmI32:
+        return kI32Load;
+      case kWasmI64:
+        return kI64Load;
+      case kWasmF32:
+        return kF32Load;
+      case kWasmF64:
+        return kF64Load;
+      default:
+        UNREACHABLE();
+    }
+  }
+
+ private:
+  const LoadTypeValue val_;
+
+  static constexpr uint8_t kLoadSizeLog2[] = {
+#define LOAD_SIZE(_, __, ___, size) size,
+      FOREACH_LOAD_TYPE(LOAD_SIZE)
+#undef LOAD_SIZE
+  };
+
+  static constexpr ValueType kValueType[] = {
+#define VALUE_TYPE(type, ...) kWasm##type,
+      FOREACH_LOAD_TYPE(VALUE_TYPE)
+#undef VALUE_TYPE
+  };
+
+  static constexpr MachineType kMemType[] = {
+#define MEMTYPE(_, __, memtype, ___) MachineType::memtype(),
+      FOREACH_LOAD_TYPE(MEMTYPE)
+#undef MEMTYPE
+  };
+};
+
+#define FOREACH_STORE_TYPE(V) \
+  V(I32, , Word32, 2)         \
+  V(I32, 8, Word8, 0)         \
+  V(I32, 16, Word16, 1)       \
+  V(I64, , Word64, 3)         \
+  V(I64, 8, Word8, 0)         \
+  V(I64, 16, Word16, 1)       \
+  V(I64, 32, Word32, 2)       \
+  V(F32, , Float32, 2)        \
+  V(F64, , Float64, 3)        \
+  V(S128, , Simd128, 4)
+
+class StoreType {
+ public:
+  enum StoreTypeValue : uint8_t {
+#define DEF_ENUM(type, suffix, ...) k##type##Store##suffix,
+    FOREACH_STORE_TYPE(DEF_ENUM)
+#undef DEF_ENUM
+  };
+
+  // Allow implicit convertion of the enum value to this wrapper.
+  constexpr StoreType(StoreTypeValue val)  // NOLINT(runtime/explicit)
+      : val_(val) {}
+
+  constexpr StoreTypeValue value() const { return val_; }
+  constexpr unsigned size_log_2() const { return kStoreSizeLog2[val_]; }
+  constexpr unsigned size() const { return 1 << size_log_2(); }
+  constexpr ValueType value_type() const { return kValueType[val_]; }
+  constexpr MachineRepresentation mem_rep() const { return kMemRep[val_]; }
+
+  static StoreType ForValueType(ValueType type) {
+    switch (type) {
+      case kWasmI32:
+        return kI32Store;
+      case kWasmI64:
+        return kI64Store;
+      case kWasmF32:
+        return kF32Store;
+      case kWasmF64:
+        return kF64Store;
+      default:
+        UNREACHABLE();
+    }
+  }
+
+ private:
+  const StoreTypeValue val_;
+
+  static constexpr uint8_t kStoreSizeLog2[] = {
+#define STORE_SIZE(_, __, ___, size) size,
+      FOREACH_STORE_TYPE(STORE_SIZE)
+#undef STORE_SIZE
+  };
+
+  static constexpr ValueType kValueType[] = {
+#define VALUE_TYPE(type, ...) kWasm##type,
+      FOREACH_STORE_TYPE(VALUE_TYPE)
+#undef VALUE_TYPE
+  };
+
+  static constexpr MachineRepresentation kMemRep[] = {
+#define MEMREP(_, __, memrep, ___) MachineRepresentation::k##memrep,
+      FOREACH_STORE_TYPE(MEMREP)
+#undef MEMREP
+  };
+};
+
+// A collection of ValueType-related static methods.
+class V8_EXPORT_PRIVATE ValueTypes {
+ public:
+  static byte MemSize(MachineType type) {
+    return 1 << i::ElementSizeLog2Of(type.representation());
+  }
+
+  static int ElementSizeInBytes(ValueType type) {
+    switch (type) {
+      case kWasmI32:
+      case kWasmF32:
+        return 4;
+      case kWasmI64:
+      case kWasmF64:
+        return 8;
+      case kWasmS128:
+        return 16;
+      default:
+        UNREACHABLE();
+    }
+  }
+
+  static int ElementSizeLog2Of(ValueType type) {
+    switch (type) {
+      case kWasmI32:
+      case kWasmF32:
+        return 2;
+      case kWasmI64:
+      case kWasmF64:
+        return 3;
+      case kWasmS128:
+        return 4;
+      default:
+        UNREACHABLE();
+    }
+  }
+
+  static byte MemSize(ValueType type) { return 1 << ElementSizeLog2Of(type); }
+
+  static ValueTypeCode ValueTypeCodeFor(ValueType type) {
+    switch (type) {
+      case kWasmI32:
+        return kLocalI32;
+      case kWasmI64:
+        return kLocalI64;
+      case kWasmF32:
+        return kLocalF32;
+      case kWasmF64:
+        return kLocalF64;
+      case kWasmS128:
+        return kLocalS128;
+      case kWasmAnyRef:
+        return kLocalAnyRef;
+      case kWasmStmt:
+        return kLocalVoid;
+      default:
+        UNREACHABLE();
+    }
+  }
+
+  static MachineType MachineTypeFor(ValueType type) {
+    switch (type) {
+      case kWasmI32:
+        return MachineType::Int32();
+      case kWasmI64:
+        return MachineType::Int64();
+      case kWasmF32:
+        return MachineType::Float32();
+      case kWasmF64:
+        return MachineType::Float64();
+      case kWasmAnyFunc:
+      case kWasmAnyRef:
+        return MachineType::TaggedPointer();
+      case kWasmS128:
+        return MachineType::Simd128();
+      case kWasmStmt:
+        return MachineType::None();
+      default:
+        UNREACHABLE();
+    }
+  }
+
+  static MachineRepresentation MachineRepresentationFor(ValueType type) {
+    switch (type) {
+      case kWasmI32:
+        return MachineRepresentation::kWord32;
+      case kWasmI64:
+        return MachineRepresentation::kWord64;
+      case kWasmF32:
+        return MachineRepresentation::kFloat32;
+      case kWasmF64:
+        return MachineRepresentation::kFloat64;
+      case kWasmAnyRef:
+        return MachineRepresentation::kTaggedPointer;
+      case kWasmS128:
+        return MachineRepresentation::kSimd128;
+      case kWasmStmt:
+        return MachineRepresentation::kNone;
+      default:
+        UNREACHABLE();
+    }
+  }
+
+  static ValueType ValueTypeFor(MachineType type) {
+    switch (type.representation()) {
+      case MachineRepresentation::kWord8:
+      case MachineRepresentation::kWord16:
+      case MachineRepresentation::kWord32:
+        return kWasmI32;
+      case MachineRepresentation::kWord64:
+        return kWasmI64;
+      case MachineRepresentation::kFloat32:
+        return kWasmF32;
+      case MachineRepresentation::kFloat64:
+        return kWasmF64;
+      case MachineRepresentation::kTaggedPointer:
+        return kWasmAnyRef;
+      case MachineRepresentation::kSimd128:
+        return kWasmS128;
+      default:
+        UNREACHABLE();
+    }
+  }
+
+  static char ShortNameOf(ValueType type) {
+    switch (type) {
+      case kWasmI32:
+        return 'i';
+      case kWasmI64:
+        return 'l';
+      case kWasmF32:
+        return 'f';
+      case kWasmF64:
+        return 'd';
+      case kWasmAnyRef:
+        return 'r';
+      case kWasmS128:
+        return 's';
+      case kWasmStmt:
+        return 'v';
+      case kWasmVar:
+        return '*';
+      default:
+        return '?';
+    }
+  }
+
+  static const char* TypeName(ValueType type) {
+    switch (type) {
+      case kWasmI32:
+        return "i32";
+      case kWasmI64:
+        return "i64";
+      case kWasmF32:
+        return "f32";
+      case kWasmF64:
+        return "f64";
+      case kWasmAnyRef:
+        return "ref";
+      case kWasmS128:
+        return "s128";
+      case kWasmStmt:
+        return "<stmt>";
+      case kWasmVar:
+        return "<var>";
+      default:
+        return "<unknown>";
+    }
+  }
+
+ private:
+  DISALLOW_IMPLICIT_CONSTRUCTORS(ValueTypes);
+};
+
+}  // namespace wasm
+}  // namespace internal
+}  // namespace v8
+
+#endif  // V8_WASM_VALUE_TYPE_H_
diff --git a/deps/v8/src/wasm/wasm-code-manager.cc b/deps/v8/src/wasm/wasm-code-manager.cc
index f72c0a3a472b42..0c05e94cf8465c 100644
--- a/deps/v8/src/wasm/wasm-code-manager.cc
+++ b/deps/v8/src/wasm/wasm-code-manager.cc
@@ -7,15 +7,16 @@
 #include <iomanip>
 
 #include "src/assembler-inl.h"
-#include "src/base/atomic-utils.h"
 #include "src/base/macros.h"
 #include "src/base/platform/platform.h"
-#include "src/code-stubs.h"
 #include "src/codegen.h"
 #include "src/disassembler.h"
 #include "src/globals.h"
+#include "src/macro-assembler-inl.h"
 #include "src/macro-assembler.h"
 #include "src/objects-inl.h"
+#include "src/wasm/function-compiler.h"
+#include "src/wasm/jump-table-assembler.h"
 #include "src/wasm/wasm-module.h"
 #include "src/wasm/wasm-objects-inl.h"
 #include "src/wasm/wasm-objects.h"
@@ -35,145 +36,74 @@ namespace {
 // given address into a code object. Use with {std::upper_bound} for example.
 struct WasmCodeUniquePtrComparator {
   bool operator()(Address pc, const std::unique_ptr<WasmCode>& code) const {
-    DCHECK_NOT_NULL(pc);
+    DCHECK_NE(kNullAddress, pc);
     DCHECK_NOT_NULL(code);
-    return pc < code->instructions().start();
+    return pc < code->instruction_start();
   }
 };
 
-#if V8_TARGET_ARCH_X64
-#define __ masm->
-constexpr bool kModuleCanAllocateMoreMemory = false;
-
-void GenerateJumpTrampoline(MacroAssembler* masm, Address target) {
-  __ movq(kScratchRegister, reinterpret_cast<uint64_t>(target));
-  __ jmp(kScratchRegister);
-}
-#undef __
-#elif V8_TARGET_ARCH_S390X
-#define __ masm->
-constexpr bool kModuleCanAllocateMoreMemory = false;
-
-void GenerateJumpTrampoline(MacroAssembler* masm, Address target) {
-  __ mov(ip, Operand(bit_cast<intptr_t, Address>(target)));
-  __ b(ip);
-}
-#undef __
-#else
-const bool kModuleCanAllocateMoreMemory = true;
-#endif
-
-void RelocateCode(WasmCode* code, const WasmCode* orig,
-                  WasmCode::FlushICache flush_icache) {
-  intptr_t delta = code->instructions().start() - orig->instructions().start();
-  for (RelocIterator it(code->instructions(), code->reloc_info(),
-                        code->constant_pool(), RelocInfo::kApplyMask);
-       !it.done(); it.next()) {
-    it.rinfo()->apply(delta);
-  }
-  if (flush_icache) {
-    Assembler::FlushICache(code->instructions().start(),
-                           code->instructions().size());
-  }
-}
-
 }  // namespace
 
-DisjointAllocationPool::DisjointAllocationPool(Address start, Address end) {
-  ranges_.push_back({start, end});
-}
-
-void DisjointAllocationPool::Merge(DisjointAllocationPool&& other) {
+void DisjointAllocationPool::Merge(AddressRange range) {
   auto dest_it = ranges_.begin();
   auto dest_end = ranges_.end();
 
-  for (auto src_it = other.ranges_.begin(), src_end = other.ranges_.end();
-       src_it != src_end;) {
-    if (dest_it == dest_end) {
-      // everything else coming from src will be inserted
-      // at the back of ranges_ from now on.
-      ranges_.push_back(*src_it);
-      ++src_it;
-      continue;
-    }
-    // Before or adjacent to dest. Insert or merge, and advance
-    // just src.
-    if (dest_it->first >= src_it->second) {
-      if (dest_it->first == src_it->second) {
-        dest_it->first = src_it->first;
-      } else {
-        ranges_.insert(dest_it, {src_it->first, src_it->second});
-      }
-      ++src_it;
-      continue;
-    }
-    // Src is strictly after dest. Skip over this dest.
-    if (dest_it->second < src_it->first) {
-      ++dest_it;
-      continue;
-    }
-    // Src is adjacent from above. Merge and advance
-    // just src, because the next src, if any, is bound to be
-    // strictly above the newly-formed range.
-    DCHECK_EQ(dest_it->second, src_it->first);
-    dest_it->second = src_it->second;
-    ++src_it;
-    // Now that we merged, maybe this new range is adjacent to
-    // the next. Since we assume src to have come from the
-    // same original memory pool, it follows that the next src
-    // must be above or adjacent to the new bubble.
-    auto next_dest = dest_it;
-    ++next_dest;
-    if (next_dest != dest_end && dest_it->second == next_dest->first) {
-      dest_it->second = next_dest->second;
-      ranges_.erase(next_dest);
-    }
+  // Skip over dest ranges strictly before {range}.
+  while (dest_it != dest_end && dest_it->end < range.start) ++dest_it;
+
+  // After last dest range: insert and done.
+  if (dest_it == dest_end) {
+    ranges_.push_back(range);
+    return;
+  }
+
+  // Adjacent (from below) to dest: merge and done.
+  if (dest_it->start == range.end) {
+    dest_it->start = range.start;
+    return;
+  }
+
+  // Before dest: insert and done.
+  if (dest_it->start > range.end) {
+    ranges_.insert(dest_it, range);
+    return;
+  }
 
-    // src_it points now at the next, if any, src
-    DCHECK_IMPLIES(src_it != src_end, src_it->first >= dest_it->second);
+  // Src is adjacent from above. Merge and check whether the merged range is now
+  // adjacent to the next range.
+  DCHECK_EQ(dest_it->end, range.start);
+  dest_it->end = range.end;
+  auto next_dest = dest_it;
+  ++next_dest;
+  if (next_dest != dest_end && dest_it->end == next_dest->start) {
+    dest_it->end = next_dest->end;
+    ranges_.erase(next_dest);
   }
 }
 
-DisjointAllocationPool DisjointAllocationPool::Extract(size_t size,
-                                                       ExtractionMode mode) {
-  DisjointAllocationPool ret;
-  for (auto it = ranges_.begin(), end = ranges_.end(); it != end;) {
-    auto current = it;
-    ++it;
-    DCHECK_LT(current->first, current->second);
-    size_t current_size = reinterpret_cast<size_t>(current->second) -
-                          reinterpret_cast<size_t>(current->first);
-    if (size == current_size) {
-      ret.ranges_.push_back(*current);
-      ranges_.erase(current);
-      return ret;
-    }
-    if (size < current_size) {
-      ret.ranges_.push_back({current->first, current->first + size});
-      current->first += size;
-      DCHECK(current->first < current->second);
-      return ret;
-    }
-    if (mode != kContiguous) {
-      size -= current_size;
-      ret.ranges_.push_back(*current);
-      ranges_.erase(current);
+AddressRange DisjointAllocationPool::Allocate(size_t size) {
+  for (auto it = ranges_.begin(), end = ranges_.end(); it != end; ++it) {
+    size_t range_size = it->size();
+    if (size > range_size) continue;
+    AddressRange ret{it->start, it->start + size};
+    if (size == range_size) {
+      ranges_.erase(it);
+    } else {
+      it->start += size;
+      DCHECK_LT(it->start, it->end);
     }
+    return ret;
   }
-  if (size > 0) {
-    Merge(std::move(ret));
-    return {};
-  }
-  return ret;
+  return {};
 }
 
 Address WasmCode::constant_pool() const {
   if (FLAG_enable_embedded_constant_pool) {
     if (constant_pool_offset_ < instructions().size()) {
-      return instructions().start() + constant_pool_offset_;
+      return instruction_start() + constant_pool_offset_;
     }
   }
-  return nullptr;
+  return kNullAddress;
 }
 
 size_t WasmCode::trap_handler_index() const {
@@ -185,65 +115,123 @@ void WasmCode::set_trap_handler_index(size_t value) {
   trap_handler_index_ = value;
 }
 
-bool WasmCode::HasTrapHandlerIndex() const { return trap_handler_index_ >= 0; }
+void WasmCode::RegisterTrapHandlerData() {
+  DCHECK(!HasTrapHandlerIndex());
+  if (kind() != wasm::WasmCode::kFunction) return;
+
+  Address base = instruction_start();
+
+  size_t size = instructions().size();
+  const int index =
+      RegisterHandlerData(base, size, protected_instructions().size(),
+                          protected_instructions().start());
+
+  // TODO(eholk): if index is negative, fail.
+  CHECK_LE(0, index);
+  set_trap_handler_index(static_cast<size_t>(index));
+}
 
-void WasmCode::ResetTrapHandlerIndex() { trap_handler_index_ = -1; }
+bool WasmCode::HasTrapHandlerIndex() const { return trap_handler_index_ >= 0; }
 
 bool WasmCode::ShouldBeLogged(Isolate* isolate) {
   return isolate->logger()->is_listening_to_code_events() ||
-         isolate->is_profiling() || FLAG_print_wasm_code || FLAG_print_code;
+         isolate->is_profiling();
 }
 
 void WasmCode::LogCode(Isolate* isolate) const {
   DCHECK(ShouldBeLogged(isolate));
-  if (native_module()->compiled_module()->has_shared() && index_.IsJust()) {
-    uint32_t index = this->index();
-    Handle<WasmSharedModuleData> shared_handle(
-        native_module()->compiled_module()->shared(), isolate);
-    int name_length;
-    Handle<String> name(
-        WasmSharedModuleData::GetFunctionName(isolate, shared_handle, index));
-    auto cname =
-        name->ToCString(AllowNullsFlag::DISALLOW_NULLS,
-                        RobustnessFlag::ROBUST_STRING_TRAVERSAL, &name_length);
-    PROFILE(isolate,
-            CodeCreateEvent(CodeEventListener::FUNCTION_TAG, this,
-                            {cname.get(), static_cast<size_t>(name_length)}));
-
-#ifdef ENABLE_DISASSEMBLER
-    if (FLAG_print_code || FLAG_print_wasm_code) {
-      // TODO(wasm): Use proper log files, here and elsewhere.
-      OFStream os(stdout);
-      os << "--- Wasm " << (is_liftoff() ? "liftoff" : "turbofan")
-         << " code ---\n";
-      this->Disassemble(cname.get(), isolate, os);
-      os << "--- End code ---\n";
-    }
-#endif
+  if (IsAnonymous()) return;
+  ModuleWireBytes wire_bytes(native_module()->wire_bytes());
+  // TODO(herhut): Allow to log code without on-heap round-trip of the name.
+  ModuleEnv* module_env = GetModuleEnv(native_module()->compilation_state());
+  WireBytesRef name_ref =
+      module_env->module->LookupFunctionName(wire_bytes, index());
+  WasmName name_vec = wire_bytes.GetName(name_ref);
+  MaybeHandle<String> maybe_name =
+      isolate->factory()->NewStringFromUtf8(Vector<const char>::cast(name_vec));
+  Handle<String> name;
+  if (!maybe_name.ToHandle(&name)) {
+    name = isolate->factory()->NewStringFromAsciiChecked("<name too long>");
+  }
+  int name_length;
+  auto cname =
+      name->ToCString(AllowNullsFlag::DISALLOW_NULLS,
+                      RobustnessFlag::ROBUST_STRING_TRAVERSAL, &name_length);
+  PROFILE(isolate,
+          CodeCreateEvent(CodeEventListener::FUNCTION_TAG, this,
+                          {cname.get(), static_cast<size_t>(name_length)}));
+  if (!source_positions().is_empty()) {
+    LOG_CODE_EVENT(isolate, CodeLinePosInfoRecordEvent(instruction_start(),
+                                                       source_positions()));
+  }
+}
 
-    if (!source_positions().is_empty()) {
-      LOG_CODE_EVENT(isolate, CodeLinePosInfoRecordEvent(instructions().start(),
-                                                         source_positions()));
+void WasmCode::Validate() const {
+#ifdef DEBUG
+  // We run NativeModule::Lookup, which accesses owned_code_, thuse we need to
+  // hold the mutex to avoid race conditions.
+  base::LockGuard<base::Mutex> lock(&native_module_->allocation_mutex_);
+  // We expect certain relocation info modes to never appear in {WasmCode}
+  // objects or to be restricted to a small set of valid values. Hence the
+  // iteration below does not use a mask, but visits all relocation data.
+  for (RelocIterator it(instructions(), reloc_info(), constant_pool());
+       !it.done(); it.next()) {
+    RelocInfo::Mode mode = it.rinfo()->rmode();
+    switch (mode) {
+      case RelocInfo::WASM_CALL: {
+        Address target = it.rinfo()->wasm_call_address();
+        WasmCode* code = native_module_->Lookup(target);
+        CHECK_NOT_NULL(code);
+        CHECK_EQ(WasmCode::kJumpTable, code->kind());
+        CHECK(code->contains(target));
+        break;
+      }
+      case RelocInfo::WASM_STUB_CALL: {
+        Address target = it.rinfo()->wasm_stub_call_address();
+        WasmCode* code = native_module_->Lookup(target);
+        CHECK_NOT_NULL(code);
+        CHECK_EQ(WasmCode::kRuntimeStub, code->kind());
+        CHECK_EQ(target, code->instruction_start());
+        break;
+      }
+      case RelocInfo::INTERNAL_REFERENCE:
+      case RelocInfo::INTERNAL_REFERENCE_ENCODED: {
+        Address target = it.rinfo()->target_internal_reference();
+        CHECK(contains(target));
+        break;
+      }
+      case RelocInfo::JS_TO_WASM_CALL:
+      case RelocInfo::EXTERNAL_REFERENCE:
+      case RelocInfo::OFF_HEAP_TARGET:
+      case RelocInfo::COMMENT:
+      case RelocInfo::CONST_POOL:
+      case RelocInfo::VENEER_POOL:
+        // These are OK to appear.
+        break;
+      default:
+        FATAL("Unexpected mode: %d", mode);
     }
   }
+#endif
 }
 
-void WasmCode::Print(Isolate* isolate) const {
-  OFStream os(stdout);
-  Disassemble(nullptr, isolate, os);
+void WasmCode::Print(const char* name) const {
+  StdoutStream os;
+  os << "--- WebAssembly code ---\n";
+  Disassemble(name, os);
+  os << "--- End code ---\n";
 }
 
-void WasmCode::Disassemble(const char* name, Isolate* isolate,
-                           std::ostream& os) const {
+void WasmCode::Disassemble(const char* name, std::ostream& os,
+                           Address current_pc) const {
   if (name) os << "name: " << name << "\n";
-  if (index_.IsJust()) os << "index: " << index_.FromJust() << "\n";
+  if (!IsAnonymous()) os << "index: " << index() << "\n";
   os << "kind: " << GetWasmCodeKindAsString(kind_) << "\n";
   os << "compiler: " << (is_liftoff() ? "Liftoff" : "TurboFan") << "\n";
   size_t body_size = instructions().size();
   os << "Body (size = " << body_size << ")\n";
 
 #ifdef ENABLE_DISASSEMBLER
-
   size_t instruction_size = body_size;
   if (constant_pool_offset_ && constant_pool_offset_ < instruction_size) {
     instruction_size = constant_pool_offset_;
@@ -253,10 +241,9 @@ void WasmCode::Disassemble(const char* name, Isolate* isolate,
   }
   DCHECK_LT(0, instruction_size);
   os << "Instructions (size = " << instruction_size << ")\n";
-  // TODO(mtrofin): rework the dependency on isolate and code in
-  // Disassembler::Decode.
-  Disassembler::Decode(isolate, &os, instructions().start(),
-                       instructions().start() + instruction_size, nullptr);
+  Disassembler::Decode(nullptr, &os, instructions().start(),
+                       instructions().start() + instruction_size,
+                       CodeReference(this), current_pc);
   os << "\n";
 
   if (!source_positions().is_empty()) {
@@ -270,10 +257,10 @@ void WasmCode::Disassemble(const char* name, Isolate* isolate,
     os << "\n";
   }
 
-  os << "RelocInfo (size = " << reloc_size_ << ")\n";
+  os << "RelocInfo (size = " << reloc_info_.size() << ")\n";
   for (RelocIterator it(instructions(), reloc_info(), constant_pool());
        !it.done(); it.next()) {
-    it.rinfo()->Print(isolate, os);
+    it.rinfo()->Print(nullptr, os);
   }
   os << "\n";
 #endif  // ENABLE_DISASSEMBLER
@@ -287,22 +274,17 @@ const char* GetWasmCodeKindAsString(WasmCode::Kind kind) {
       return "wasm-to-js";
     case WasmCode::kLazyStub:
       return "lazy-compile";
-    case WasmCode::kInterpreterStub:
-      return "interpreter-entry";
-    case WasmCode::kCopiedStub:
-      return "copied stub";
-    case WasmCode::kTrampoline:
-      return "trampoline";
+    case WasmCode::kRuntimeStub:
+      return "runtime-stub";
+    case WasmCode::kInterpreterEntry:
+      return "interpreter entry";
+    case WasmCode::kJumpTable:
+      return "jump table";
   }
   return "unknown kind";
 }
 
 WasmCode::~WasmCode() {
-  // Depending on finalizer order, the WasmCompiledModule finalizer may be
-  // called first, case in which we release here. If the InstanceFinalizer is
-  // called first, the handlers will be cleared in Reset, as-if the NativeModule
-  // may be later used again (which would be the case if the WasmCompiledModule
-  // were still held by a WasmModuleObject)
   if (HasTrapHandlerIndex()) {
     CHECK_LT(trap_handler_index(),
              static_cast<size_t>(std::numeric_limits<int>::max()));
@@ -310,490 +292,346 @@ WasmCode::~WasmCode() {
   }
 }
 
-// Helper class to selectively clone and patch code from a
-// {source_native_module} into a {cloning_native_module}.
-class NativeModule::CloneCodeHelper {
- public:
-  explicit CloneCodeHelper(NativeModule* source_native_module,
-                           NativeModule* cloning_native_module);
-
-  void SelectForCloning(int32_t code_index);
-
-  void CloneAndPatchCode(bool patch_stub_to_stub_calls);
-
-  void PatchTrampolineAndStubCalls(const WasmCode* original_code,
-                                   const WasmCode* new_code,
-                                   WasmCode::FlushICache flush_icache);
-
- private:
-  void PatchStubToStubCalls();
-
-  NativeModule* source_native_module_;
-  NativeModule* cloning_native_module_;
-  std::vector<uint32_t> selection_;
-  std::unordered_map<Address, Address, AddressHasher> reverse_lookup_;
-};
-
-NativeModule::CloneCodeHelper::CloneCodeHelper(
-    NativeModule* source_native_module, NativeModule* cloning_native_module)
-    : source_native_module_(source_native_module),
-      cloning_native_module_(cloning_native_module) {
-  for (auto& pair : source_native_module_->trampolines_) {
-    Address old_dest = pair.second;
-    auto local = cloning_native_module_->trampolines_.find(pair.first);
-    DCHECK(local != cloning_native_module_->trampolines_.end());
-    Address new_dest = local->second;
-    reverse_lookup_.emplace(old_dest, new_dest);
-  }
-
-  for (auto& pair : source_native_module_->stubs_) {
-    Address old_dest = pair.second->instructions().start();
-    auto local = cloning_native_module_->stubs_.find(pair.first);
-    DCHECK(local != cloning_native_module_->stubs_.end());
-    Address new_dest = local->second->instructions().start();
-    reverse_lookup_.emplace(old_dest, new_dest);
-  }
-}
-
-void NativeModule::CloneCodeHelper::SelectForCloning(int32_t code_index) {
-  selection_.emplace_back(code_index);
-}
+NativeModule::NativeModule(Isolate* isolate, bool can_request_more,
+                           VirtualMemory* code_space,
+                           WasmCodeManager* code_manager,
+                           std::shared_ptr<const WasmModule> module,
+                           const ModuleEnv& env)
+    : module_(std::move(module)),
+      compilation_state_(NewCompilationState(isolate, env)),
+      free_code_space_({code_space->address(), code_space->end()}),
+      wasm_code_manager_(code_manager),
+      can_request_more_memory_(can_request_more),
+      use_trap_handler_(env.use_trap_handler) {
+  DCHECK_EQ(module_.get(), env.module);
+  DCHECK_NOT_NULL(module_);
+  VirtualMemory my_mem;
+  owned_code_space_.push_back(my_mem);
+  owned_code_space_.back().TakeControl(code_space);
+  owned_code_.reserve(num_functions());
 
-void NativeModule::CloneCodeHelper::CloneAndPatchCode(
-    bool patch_stub_to_stub_calls) {
-  if (patch_stub_to_stub_calls) {
-    PatchStubToStubCalls();
-  }
+  uint32_t num_wasm_functions = module_->num_declared_functions;
+  if (num_wasm_functions > 0) {
+    code_table_.reset(new WasmCode*[num_wasm_functions]);
+    memset(code_table_.get(), 0, num_wasm_functions * sizeof(WasmCode*));
 
-  WasmCode* anonymous_lazy_builtin = nullptr;
-  for (uint32_t index : selection_) {
-    const WasmCode* original_code = source_native_module_->GetCode(index);
-    switch (original_code->kind()) {
-      case WasmCode::kLazyStub: {
-        // Use the first anonymous lazy compile stub hit in this loop as the
-        // canonical copy for all further ones by remembering it locally via
-        // the {anonymous_lazy_builtin} variable.
-        if (!original_code->IsAnonymous()) {
-          WasmCode* new_code = cloning_native_module_->CloneCode(
-              original_code, WasmCode::kNoFlushICache);
-          PatchTrampolineAndStubCalls(original_code, new_code,
-                                      WasmCode::kFlushICache);
-          break;
-        }
-        if (anonymous_lazy_builtin == nullptr) {
-          WasmCode* new_code = cloning_native_module_->CloneCode(
-              original_code, WasmCode::kNoFlushICache);
-          PatchTrampolineAndStubCalls(original_code, new_code,
-                                      WasmCode::kFlushICache);
-          anonymous_lazy_builtin = new_code;
-        }
-        cloning_native_module_->code_table_[index] = anonymous_lazy_builtin;
-      } break;
-      case WasmCode::kFunction: {
-        WasmCode* new_code = cloning_native_module_->CloneCode(
-            original_code, WasmCode::kNoFlushICache);
-        PatchTrampolineAndStubCalls(original_code, new_code,
-                                    WasmCode::kFlushICache);
-      } break;
-      default:
-        UNREACHABLE();
-    }
+    jump_table_ = CreateEmptyJumpTable(num_wasm_functions);
   }
 }
 
-void NativeModule::CloneCodeHelper::PatchStubToStubCalls() {
-  for (auto& pair : cloning_native_module_->stubs_) {
-    WasmCode* new_stub = pair.second;
-    WasmCode* old_stub = source_native_module_->stubs_.find(pair.first)->second;
-    PatchTrampolineAndStubCalls(old_stub, new_stub, WasmCode::kFlushICache);
-  }
-}
+void NativeModule::ReserveCodeTableForTesting(uint32_t max_functions) {
+  DCHECK_LE(num_functions(), max_functions);
+  WasmCode** new_table = new WasmCode*[max_functions];
+  memset(new_table, 0, max_functions * sizeof(*new_table));
+  memcpy(new_table, code_table_.get(),
+         module_->num_declared_functions * sizeof(*new_table));
+  code_table_.reset(new_table);
 
-void NativeModule::CloneCodeHelper::PatchTrampolineAndStubCalls(
-    const WasmCode* original_code, const WasmCode* new_code,
-    WasmCode::FlushICache flush_icache) {
-  // Relocate everything in kApplyMask using this delta, and patch all code
-  // targets to call the new trampolines and stubs.
-  intptr_t delta =
-      new_code->instructions().start() - original_code->instructions().start();
-  int mask = RelocInfo::kApplyMask | RelocInfo::kCodeTargetMask;
-  RelocIterator orig_it(original_code->instructions(),
-                        original_code->reloc_info(),
-                        original_code->constant_pool(), mask);
-  for (RelocIterator it(new_code->instructions(), new_code->reloc_info(),
-                        new_code->constant_pool(), mask);
-       !it.done(); it.next(), orig_it.next()) {
-    if (RelocInfo::IsCodeTarget(it.rinfo()->rmode())) {
-      Address target = orig_it.rinfo()->target_address();
-#if V8_TARGET_ARCH_X64 || V8_TARGET_ARCH_S390X
-      auto found = reverse_lookup_.find(target);
-      DCHECK(found != reverse_lookup_.end());
-      target = found->second;
-#endif
-      it.rinfo()->set_target_address(target, SKIP_WRITE_BARRIER);
-    } else {
-      it.rinfo()->apply(delta);
-    }
-  }
-  if (flush_icache) {
-    Assembler::FlushICache(new_code->instructions().start(),
-                           new_code->instructions().size());
-  }
+  // Re-allocate jump table.
+  jump_table_ = CreateEmptyJumpTable(max_functions);
 }
 
-base::AtomicNumber<size_t> NativeModule::next_id_;
-
-NativeModule::NativeModule(uint32_t num_functions, uint32_t num_imports,
-                           bool can_request_more, VirtualMemory* mem,
-                           WasmCodeManager* code_manager)
-    : instance_id(next_id_.Increment(1)),
-      code_table_(num_functions),
-      num_imported_functions_(num_imports),
-      compilation_state_(NewCompilationState(
-          reinterpret_cast<Isolate*>(code_manager->isolate_))),
-      free_memory_(reinterpret_cast<Address>(mem->address()),
-                   reinterpret_cast<Address>(mem->end())),
-      wasm_code_manager_(code_manager),
-      can_request_more_memory_(can_request_more) {
-  VirtualMemory my_mem;
-  owned_memory_.push_back(my_mem);
-  owned_memory_.back().TakeControl(mem);
-  owned_code_.reserve(num_functions);
-}
+void NativeModule::LogWasmCodes(Isolate* isolate) {
+  if (!wasm::WasmCode::ShouldBeLogged(isolate)) return;
 
-void NativeModule::ResizeCodeTableForTesting(size_t num_functions,
-                                             size_t max_functions) {
-  DCHECK_LE(num_functions, max_functions);
-  if (num_imported_functions_ == num_functions) {
-    // For some tests, the code table might have been initialized to store
-    // a number of imported functions on creation. If that is the case,
-    // we need to retroactively reserve the space.
-    DCHECK_EQ(code_table_.capacity(), num_imported_functions_);
-    DCHECK_EQ(code_table_.size(), num_imported_functions_);
-    DCHECK_EQ(num_functions, 1);
-    code_table_.reserve(max_functions);
-  } else {
-    DCHECK_GT(num_functions, FunctionCount());
-    if (code_table_.capacity() == 0) {
-      code_table_.reserve(max_functions);
-    }
-    DCHECK_EQ(code_table_.capacity(), max_functions);
-    code_table_.resize(num_functions);
+  // TODO(titzer): we skip the logging of the import wrappers
+  // here, but they should be included somehow.
+  for (wasm::WasmCode* code : code_table()) {
+    if (code != nullptr) code->LogCode(isolate);
   }
 }
 
-WasmCode* NativeModule::GetCode(uint32_t index) const {
-  DCHECK_LT(index, FunctionCount());
-  return code_table_[index];
-}
-
-void NativeModule::SetCode(uint32_t index, WasmCode* wasm_code) {
-  DCHECK_LT(index, FunctionCount());
-  code_table_[index] = wasm_code;
-}
-
-uint32_t NativeModule::FunctionCount() const {
-  DCHECK_LE(code_table_.size(), std::numeric_limits<uint32_t>::max());
-  return static_cast<uint32_t>(code_table_.size());
-}
-
 WasmCode* NativeModule::AddOwnedCode(
-    Vector<const byte> orig_instructions,
-    std::unique_ptr<const byte[]> reloc_info, size_t reloc_size,
-    std::unique_ptr<const byte[]> source_pos, size_t source_pos_size,
-    Maybe<uint32_t> index, WasmCode::Kind kind, size_t constant_pool_offset,
+    Maybe<uint32_t> index, Vector<const byte> instructions,
     uint32_t stack_slots, size_t safepoint_table_offset,
-    size_t handler_table_offset,
-    std::shared_ptr<ProtectedInstructions> protected_instructions,
-    WasmCode::Tier tier, WasmCode::FlushICache flush_icache) {
-  // both allocation and insertion in owned_code_ happen in the same critical
-  // section, thus ensuring owned_code_'s elements are rarely if ever moved.
-  base::LockGuard<base::Mutex> lock(&allocation_mutex_);
-  Address executable_buffer = AllocateForCode(orig_instructions.size());
-  if (executable_buffer == nullptr) {
-    V8::FatalProcessOutOfMemory(nullptr, "NativeModule::AddOwnedCode");
-    UNREACHABLE();
-  }
-  memcpy(executable_buffer, orig_instructions.start(),
-         orig_instructions.size());
-  std::unique_ptr<WasmCode> code(new WasmCode(
-      {executable_buffer, orig_instructions.size()}, std::move(reloc_info),
-      reloc_size, std::move(source_pos), source_pos_size, this, index, kind,
-      constant_pool_offset, stack_slots, safepoint_table_offset,
-      handler_table_offset, std::move(protected_instructions), tier));
-  WasmCode* ret = code.get();
-
-  // TODO(mtrofin): We allocate in increasing address order, and
-  // even if we end up with segmented memory, we may end up only with a few
-  // large moves - if, for example, a new segment is below the current ones.
-  auto insert_before = std::upper_bound(owned_code_.begin(), owned_code_.end(),
-                                        ret->instructions().start(),
-                                        WasmCodeUniquePtrComparator());
-  owned_code_.insert(insert_before, std::move(code));
-  if (flush_icache) {
-    Assembler::FlushICache(ret->instructions().start(),
-                           ret->instructions().size());
+    size_t handler_table_offset, size_t constant_pool_offset,
+    OwnedVector<trap_handler::ProtectedInstructionData> protected_instructions,
+    OwnedVector<const byte> reloc_info,
+    OwnedVector<const byte> source_position_table, WasmCode::Kind kind,
+    WasmCode::Tier tier) {
+  WasmCode* code;
+  {
+    // Both allocation and insertion in owned_code_ happen in the same critical
+    // section, thus ensuring owned_code_'s elements are rarely if ever moved.
+    base::LockGuard<base::Mutex> lock(&allocation_mutex_);
+    Address executable_buffer = AllocateForCode(instructions.size());
+    if (executable_buffer == kNullAddress) {
+      V8::FatalProcessOutOfMemory(nullptr, "NativeModule::AddOwnedCode");
+      UNREACHABLE();
+    }
+    // Ownership will be transferred to {owned_code_} below.
+    code = new WasmCode(
+        this, index,
+        {reinterpret_cast<byte*>(executable_buffer), instructions.size()},
+        stack_slots, safepoint_table_offset, handler_table_offset,
+        constant_pool_offset, std::move(protected_instructions),
+        std::move(reloc_info), std::move(source_position_table), kind, tier);
+
+    if (owned_code_.empty() ||
+        code->instruction_start() > owned_code_.back()->instruction_start()) {
+      // Common case.
+      owned_code_.emplace_back(code);
+    } else {
+      // Slow but unlikely case.
+      // TODO(mtrofin): We allocate in increasing address order, and
+      // even if we end up with segmented memory, we may end up only with a few
+      // large moves - if, for example, a new segment is below the current ones.
+      auto insert_before = std::upper_bound(
+          owned_code_.begin(), owned_code_.end(), code->instruction_start(),
+          WasmCodeUniquePtrComparator{});
+      owned_code_.emplace(insert_before, code);
+    }
   }
-  return ret;
+  memcpy(reinterpret_cast<void*>(code->instruction_start()),
+         instructions.start(), instructions.size());
+
+  return code;
 }
 
 WasmCode* NativeModule::AddCodeCopy(Handle<Code> code, WasmCode::Kind kind,
                                     uint32_t index) {
+  // TODO(wasm): Adding instance-specific wasm-to-js wrappers as owned code to
+  // this NativeModule is a memory leak until the whole NativeModule dies.
   WasmCode* ret = AddAnonymousCode(code, kind);
-  code_table_[index] = ret;
   ret->index_ = Just(index);
+  if (index >= module_->num_imported_functions) set_code(index, ret);
   return ret;
 }
 
-WasmCode* NativeModule::AddInterpreterWrapper(Handle<Code> code,
-                                              uint32_t index) {
-  WasmCode* ret = AddAnonymousCode(code, WasmCode::kInterpreterStub);
+WasmCode* NativeModule::AddInterpreterEntry(Handle<Code> code, uint32_t index) {
+  WasmCode* ret = AddAnonymousCode(code, WasmCode::kInterpreterEntry);
   ret->index_ = Just(index);
+  PatchJumpTable(index, ret->instruction_start(), WasmCode::kFlushICache);
   return ret;
 }
 
 void NativeModule::SetLazyBuiltin(Handle<Code> code) {
+  uint32_t num_wasm_functions = module_->num_declared_functions;
+  if (num_wasm_functions == 0) return;
   WasmCode* lazy_builtin = AddAnonymousCode(code, WasmCode::kLazyStub);
-  for (uint32_t i = num_imported_functions(), e = FunctionCount(); i < e; ++i) {
-    code_table_[i] = lazy_builtin;
-  }
-}
-
-WasmCompiledModule* NativeModule::compiled_module() const {
-  DCHECK_NOT_NULL(compiled_module_);
-  return *compiled_module_;
-}
-
-void NativeModule::SetCompiledModule(
-    Handle<WasmCompiledModule> compiled_module) {
-  DCHECK_NULL(compiled_module_);
-  compiled_module_ = compiled_module->GetIsolate()
-                         ->global_handles()
-                         ->Create(*compiled_module)
-                         .location();
-  GlobalHandles::MakeWeak(reinterpret_cast<Object***>(&compiled_module_));
+  // Fill the jump table with jumps to the lazy compile stub.
+  Address lazy_compile_target = lazy_builtin->instruction_start();
+  JumpTableAssembler jtasm(
+      jump_table_->instruction_start(),
+      static_cast<int>(jump_table_->instructions().size()) + 256);
+  for (uint32_t i = 0; i < num_wasm_functions; ++i) {
+    // Check that the offset in the jump table increases as expected.
+    DCHECK_EQ(i * JumpTableAssembler::kJumpTableSlotSize, jtasm.pc_offset());
+    jtasm.EmitLazyCompileJumpSlot(i + module_->num_imported_functions,
+                                  lazy_compile_target);
+    jtasm.NopBytes((i + 1) * JumpTableAssembler::kJumpTableSlotSize -
+                   jtasm.pc_offset());
+  }
+  Assembler::FlushICache(jump_table_->instructions().start(),
+                         jump_table_->instructions().size());
+}
+
+void NativeModule::SetRuntimeStubs(Isolate* isolate) {
+  DCHECK_NULL(runtime_stub_table_[0]);  // Only called once.
+#define COPY_BUILTIN(Name)                                                     \
+  runtime_stub_table_[WasmCode::k##Name] =                                     \
+      AddAnonymousCode(isolate->builtins()->builtin_handle(Builtins::k##Name), \
+                       WasmCode::kRuntimeStub);
+#define COPY_BUILTIN_TRAP(Name) COPY_BUILTIN(ThrowWasm##Name)
+  WASM_RUNTIME_STUB_LIST(COPY_BUILTIN, COPY_BUILTIN_TRAP);
+#undef COPY_BUILTIN_TRAP
+#undef COPY_BUILTIN
 }
 
 WasmCode* NativeModule::AddAnonymousCode(Handle<Code> code,
                                          WasmCode::Kind kind) {
-  std::unique_ptr<byte[]> reloc_info;
-  if (code->relocation_size() > 0) {
-    reloc_info.reset(new byte[code->relocation_size()]);
-    memcpy(reloc_info.get(), code->relocation_start(), code->relocation_size());
-  }
-  std::unique_ptr<byte[]> source_pos;
-  Handle<ByteArray> source_pos_table(code->SourcePositionTable());
-  if (source_pos_table->length() > 0) {
-    source_pos.reset(new byte[source_pos_table->length()]);
-    source_pos_table->copy_out(0, source_pos.get(), source_pos_table->length());
-  }
-  std::shared_ptr<ProtectedInstructions> protected_instructions(
-      new ProtectedInstructions(0));
-  Vector<const byte> orig_instructions(
-      code->raw_instruction_start(),
-      static_cast<size_t>(code->raw_instruction_size()));
+  OwnedVector<byte> reloc_info =
+      OwnedVector<byte>::New(code->relocation_size());
+  memcpy(reloc_info.start(), code->relocation_start(), code->relocation_size());
+  Handle<ByteArray> source_pos_table(code->SourcePositionTable(),
+                                     code->GetIsolate());
+  OwnedVector<byte> source_pos =
+      OwnedVector<byte>::New(source_pos_table->length());
+  source_pos_table->copy_out(0, source_pos.start(), source_pos_table->length());
+  Vector<const byte> instructions(
+      reinterpret_cast<byte*>(code->InstructionStart()),
+      static_cast<size_t>(code->InstructionSize()));
   int stack_slots = code->has_safepoint_info() ? code->stack_slots() : 0;
   int safepoint_table_offset =
       code->has_safepoint_info() ? code->safepoint_table_offset() : 0;
   WasmCode* ret =
-      AddOwnedCode(orig_instructions,      // instructions
-                   std::move(reloc_info),  // reloc_info
-                   static_cast<size_t>(code->relocation_size()),  // reloc_size
-                   std::move(source_pos),  // source positions
-                   static_cast<size_t>(source_pos_table->length()),
-                   Nothing<uint32_t>(),           // index
-                   kind,                          // kind
-                   code->constant_pool_offset(),  // constant_pool_offset
+      AddOwnedCode(Nothing<uint32_t>(),           // index
+                   instructions,                  // instructions
                    stack_slots,                   // stack_slots
                    safepoint_table_offset,        // safepoint_table_offset
                    code->handler_table_offset(),  // handler_table_offset
-                   protected_instructions,        // protected_instructions
-                   WasmCode::kOther,              // kind
-                   WasmCode::kNoFlushICache);     // flush_icache
-  intptr_t delta = ret->instructions().start() - code->raw_instruction_start();
-  int mask = RelocInfo::kApplyMask | RelocInfo::kCodeTargetMask |
-             RelocInfo::ModeMask(RelocInfo::EMBEDDED_OBJECT);
-
-  RelocIterator orig_it(*code, mask);
+                   code->constant_pool_offset(),  // constant_pool_offset
+                   {},                            // protected_instructions
+                   std::move(reloc_info),         // reloc_info
+                   std::move(source_pos),         // source positions
+                   kind,                          // kind
+                   WasmCode::kOther);             // tier
+
+  // Apply the relocation delta by iterating over the RelocInfo.
+  intptr_t delta = ret->instruction_start() - code->InstructionStart();
+  int mode_mask = RelocInfo::kApplyMask |
+                  RelocInfo::ModeMask(RelocInfo::WASM_STUB_CALL);
+  RelocIterator orig_it(*code, mode_mask);
   for (RelocIterator it(ret->instructions(), ret->reloc_info(),
-                        ret->constant_pool(), mask);
+                        ret->constant_pool(), mode_mask);
        !it.done(); it.next(), orig_it.next()) {
-    if (RelocInfo::IsCodeTarget(it.rinfo()->rmode())) {
-      Code* call_target =
-          Code::GetCodeFromTargetAddress(orig_it.rinfo()->target_address());
-      it.rinfo()->set_target_address(GetLocalAddressFor(handle(call_target)),
-                                     SKIP_WRITE_BARRIER, SKIP_ICACHE_FLUSH);
+    RelocInfo::Mode mode = it.rinfo()->rmode();
+    if (RelocInfo::IsWasmStubCall(mode)) {
+      uint32_t stub_call_tag = orig_it.rinfo()->wasm_call_tag();
+      DCHECK_LT(stub_call_tag, WasmCode::kRuntimeStubCount);
+      WasmCode* code =
+          runtime_stub(static_cast<WasmCode::RuntimeStubId>(stub_call_tag));
+      it.rinfo()->set_wasm_stub_call_address(code->instruction_start(),
+                                             SKIP_ICACHE_FLUSH);
     } else {
-      if (RelocInfo::IsEmbeddedObject(it.rinfo()->rmode())) {
-        DCHECK(Heap::IsImmovable(it.rinfo()->target_object()));
-      } else {
-        it.rinfo()->apply(delta);
-      }
+      it.rinfo()->apply(delta);
     }
   }
+
   // Flush the i-cache here instead of in AddOwnedCode, to include the changes
   // made while iterating over the RelocInfo above.
   Assembler::FlushICache(ret->instructions().start(),
                          ret->instructions().size());
-  if (FLAG_print_wasm_code) {
-    // TODO(mstarzinger): don't need the isolate here.
-    ret->Print(code->GetIsolate());
-  }
+  if (FLAG_print_code || FLAG_print_wasm_code) ret->Print();
+  ret->Validate();
   return ret;
 }
 
 WasmCode* NativeModule::AddCode(
-    const CodeDesc& desc, uint32_t frame_slots, uint32_t index,
+    uint32_t index, const CodeDesc& desc, uint32_t stack_slots,
     size_t safepoint_table_offset, size_t handler_table_offset,
-    std::unique_ptr<ProtectedInstructions> protected_instructions,
-    Handle<ByteArray> source_pos_table, WasmCode::Tier tier) {
-  std::unique_ptr<byte[]> reloc_info;
-  if (desc.reloc_size) {
-    reloc_info.reset(new byte[desc.reloc_size]);
-    memcpy(reloc_info.get(), desc.buffer + desc.buffer_size - desc.reloc_size,
-           desc.reloc_size);
-  }
-  std::unique_ptr<byte[]> source_pos;
-  if (source_pos_table->length() > 0) {
-    source_pos.reset(new byte[source_pos_table->length()]);
-    source_pos_table->copy_out(0, source_pos.get(), source_pos_table->length());
-  }
-  TurboAssembler* origin = reinterpret_cast<TurboAssembler*>(desc.origin);
+    OwnedVector<trap_handler::ProtectedInstructionData> protected_instructions,
+    OwnedVector<const byte> source_pos_table, WasmCode::Tier tier) {
+  OwnedVector<byte> reloc_info = OwnedVector<byte>::New(desc.reloc_size);
+  memcpy(reloc_info.start(), desc.buffer + desc.buffer_size - desc.reloc_size,
+         desc.reloc_size);
   WasmCode* ret = AddOwnedCode(
-      {desc.buffer, static_cast<size_t>(desc.instr_size)},
-      std::move(reloc_info), static_cast<size_t>(desc.reloc_size),
-      std::move(source_pos), static_cast<size_t>(source_pos_table->length()),
-      Just(index), WasmCode::kFunction,
-      desc.instr_size - desc.constant_pool_size, frame_slots,
-      safepoint_table_offset, handler_table_offset,
-      std::move(protected_instructions), tier, WasmCode::kNoFlushICache);
-
-  code_table_[index] = ret;
-  // TODO(mtrofin): this is a copy and paste from Code::CopyFrom.
-  int mode_mask = RelocInfo::kCodeTargetMask |
-                  RelocInfo::ModeMask(RelocInfo::EMBEDDED_OBJECT) |
-                  RelocInfo::ModeMask(RelocInfo::RUNTIME_ENTRY) |
-                  RelocInfo::kApplyMask;
-  // Needed to find target_object and runtime_entry on X64
-
-  AllowDeferredHandleDereference embedding_raw_address;
+      Just(index), {desc.buffer, static_cast<size_t>(desc.instr_size)},
+      stack_slots, safepoint_table_offset, handler_table_offset,
+      desc.instr_size - desc.constant_pool_size,
+      std::move(protected_instructions), std::move(reloc_info),
+      std::move(source_pos_table), WasmCode::kFunction, tier);
+
+  // Apply the relocation delta by iterating over the RelocInfo.
+  intptr_t delta = ret->instructions().start() - desc.buffer;
+  int mode_mask = RelocInfo::kApplyMask |
+                  RelocInfo::ModeMask(RelocInfo::WASM_CALL) |
+                  RelocInfo::ModeMask(RelocInfo::WASM_STUB_CALL);
   for (RelocIterator it(ret->instructions(), ret->reloc_info(),
                         ret->constant_pool(), mode_mask);
        !it.done(); it.next()) {
     RelocInfo::Mode mode = it.rinfo()->rmode();
-    if (mode == RelocInfo::EMBEDDED_OBJECT) {
-      Handle<HeapObject> p = it.rinfo()->target_object_handle(origin);
-      DCHECK(p->IsUndefined(p->GetIsolate()) || p->IsNull(p->GetIsolate()));
-      it.rinfo()->set_target_object(*p, SKIP_WRITE_BARRIER, SKIP_ICACHE_FLUSH);
-    } else if (RelocInfo::IsCodeTarget(mode)) {
-      // rewrite code handles to direct pointers to the first instruction in the
-      // code object
-      Handle<Object> p = it.rinfo()->target_object_handle(origin);
-      Code* code = Code::cast(*p);
-      it.rinfo()->set_target_address(GetLocalAddressFor(handle(code)),
-                                     SKIP_WRITE_BARRIER, SKIP_ICACHE_FLUSH);
-    } else if (RelocInfo::IsRuntimeEntry(mode)) {
-      Address p = it.rinfo()->target_runtime_entry(origin);
-      it.rinfo()->set_target_runtime_entry(p, SKIP_WRITE_BARRIER,
-                                           SKIP_ICACHE_FLUSH);
+    if (RelocInfo::IsWasmCall(mode)) {
+      uint32_t call_tag = it.rinfo()->wasm_call_tag();
+      Address target = GetCallTargetForFunction(call_tag);
+      it.rinfo()->set_wasm_call_address(target, SKIP_ICACHE_FLUSH);
+    } else if (RelocInfo::IsWasmStubCall(mode)) {
+      uint32_t stub_call_tag = it.rinfo()->wasm_call_tag();
+      DCHECK_LT(stub_call_tag, WasmCode::kRuntimeStubCount);
+      WasmCode* code =
+          runtime_stub(static_cast<WasmCode::RuntimeStubId>(stub_call_tag));
+      it.rinfo()->set_wasm_stub_call_address(code->instruction_start(),
+                                             SKIP_ICACHE_FLUSH);
     } else {
-      intptr_t delta = ret->instructions().start() - desc.buffer;
       it.rinfo()->apply(delta);
     }
   }
+
+  {
+    // TODO(clemensh): Remove the need for locking here. Probably requires
+    // word-aligning the jump table slots.
+    base::LockGuard<base::Mutex> lock(&allocation_mutex_);
+    if (!ret->protected_instructions_.is_empty()) {
+      ret->RegisterTrapHandlerData();
+    }
+    set_code(index, ret);
+    PatchJumpTable(index, ret->instruction_start(), WasmCode::kFlushICache);
+  }
+
   // Flush the i-cache here instead of in AddOwnedCode, to include the changes
   // made while iterating over the RelocInfo above.
   Assembler::FlushICache(ret->instructions().start(),
                          ret->instructions().size());
+  if (FLAG_print_code || FLAG_print_wasm_code) ret->Print();
+  ret->Validate();
   return ret;
 }
 
-#if V8_TARGET_ARCH_X64 || V8_TARGET_ARCH_S390X
-Address NativeModule::CreateTrampolineTo(Handle<Code> code) {
-  MacroAssembler masm(code->GetIsolate(), nullptr, 0, CodeObjectRequired::kNo);
-  Address dest = code->raw_instruction_start();
-  GenerateJumpTrampoline(&masm, dest);
-  CodeDesc code_desc;
-  masm.GetCode(nullptr, &code_desc);
-  Vector<const byte> instructions(code_desc.buffer,
-                                  static_cast<size_t>(code_desc.instr_size));
-  WasmCode* wasm_code = AddOwnedCode(instructions,           // instructions
-                                     nullptr,                // reloc_info
-                                     0,                      // reloc_size
-                                     nullptr,                // source_pos
-                                     0,                      // source_pos_size
-                                     Nothing<uint32_t>(),    // index
-                                     WasmCode::kTrampoline,  // kind
-                                     0,   // constant_pool_offset
-                                     0,   // stack_slots
-                                     0,   // safepoint_table_offset
-                                     0,   // handler_table_offset
-                                     {},  // protected_instructions
-                                     WasmCode::kOther,         // tier
-                                     WasmCode::kFlushICache);  // flush_icache
-  Address ret = wasm_code->instructions().start();
-  trampolines_.emplace(std::make_pair(dest, ret));
-  return ret;
-}
-#else
-Address NativeModule::CreateTrampolineTo(Handle<Code> code) {
-  Address ret = code->raw_instruction_start();
-  trampolines_.insert(std::make_pair(ret, ret));
-  return ret;
+WasmCode* NativeModule::AddDeserializedCode(
+    uint32_t index, Vector<const byte> instructions, uint32_t stack_slots,
+    size_t safepoint_table_offset, size_t handler_table_offset,
+    size_t constant_pool_offset,
+    OwnedVector<trap_handler::ProtectedInstructionData> protected_instructions,
+    OwnedVector<const byte> reloc_info,
+    OwnedVector<const byte> source_position_table, WasmCode::Tier tier) {
+  WasmCode* code = AddOwnedCode(
+      Just(index), instructions, stack_slots, safepoint_table_offset,
+      handler_table_offset, constant_pool_offset,
+      std::move(protected_instructions), std::move(reloc_info),
+      std::move(source_position_table), WasmCode::kFunction, tier);
+
+  if (!code->protected_instructions_.is_empty()) {
+    code->RegisterTrapHandlerData();
+  }
+  set_code(index, code);
+  PatchJumpTable(index, code->instruction_start(), WasmCode::kFlushICache);
+  // Note: we do not flush the i-cache here, since the code needs to be
+  // relocated anyway. The caller is responsible for flushing the i-cache later.
+  return code;
 }
-#endif
 
-Address NativeModule::GetLocalAddressFor(Handle<Code> code) {
-  if (!Heap::IsImmovable(*code)) {
-    DCHECK(code->kind() == Code::STUB &&
-           CodeStub::MajorKeyFromKey(code->stub_key()) == CodeStub::DoubleToI);
-    uint32_t key = code->stub_key();
-    auto copy = stubs_.find(key);
-    if (copy == stubs_.end()) {
-      WasmCode* ret = AddAnonymousCode(code, WasmCode::kCopiedStub);
-      copy = stubs_.emplace(std::make_pair(key, ret)).first;
-    }
-    return copy->second->instructions().start();
-  } else {
-    Address index = code->raw_instruction_start();
-    auto trampoline_iter = trampolines_.find(index);
-    if (trampoline_iter == trampolines_.end()) {
-      return CreateTrampolineTo(code);
-    } else {
-      return trampoline_iter->second;
-    }
-  }
+WasmCode* NativeModule::CreateEmptyJumpTable(uint32_t num_wasm_functions) {
+  // Only call this if we really need a jump table.
+  DCHECK_LT(0, num_wasm_functions);
+  OwnedVector<byte> instructions = OwnedVector<byte>::New(
+      num_wasm_functions * JumpTableAssembler::kJumpTableSlotSize);
+  memset(instructions.start(), 0, instructions.size());
+  return AddOwnedCode(Nothing<uint32_t>(),       // index
+                      instructions.as_vector(),  // instructions
+                      0,                         // stack_slots
+                      0,                         // safepoint_table_offset
+                      0,                         // handler_table_offset
+                      0,                         // constant_pool_offset
+                      {},                        // protected_instructions
+                      {},                        // reloc_info
+                      {},                        // source_pos
+                      WasmCode::kJumpTable,      // kind
+                      WasmCode::kOther);         // tier
+}
+
+void NativeModule::PatchJumpTable(uint32_t func_index, Address target,
+                                  WasmCode::FlushICache flush_icache) {
+  DCHECK_LE(module_->num_imported_functions, func_index);
+  uint32_t slot_idx = func_index - module_->num_imported_functions;
+  Address jump_table_slot = jump_table_->instruction_start() +
+                            slot_idx * JumpTableAssembler::kJumpTableSlotSize;
+  JumpTableAssembler::PatchJumpTableSlot(jump_table_slot, target, flush_icache);
 }
 
 Address NativeModule::AllocateForCode(size_t size) {
-  // this happens under a lock assumed by the caller.
+  // This happens under a lock assumed by the caller.
   size = RoundUp(size, kCodeAlignment);
-  DisjointAllocationPool mem = free_memory_.Allocate(size);
-  if (mem.IsEmpty()) {
-    if (!can_request_more_memory_) return nullptr;
+  AddressRange mem = free_code_space_.Allocate(size);
+  if (mem.is_empty()) {
+    if (!can_request_more_memory_) return kNullAddress;
 
-    Address hint = owned_memory_.empty()
-                       ? nullptr
-                       : reinterpret_cast<Address>(owned_memory_.back().end());
+    Address hint = owned_code_space_.empty() ? kNullAddress
+                                             : owned_code_space_.back().end();
     VirtualMemory empty_mem;
-    owned_memory_.push_back(empty_mem);
-    VirtualMemory& new_mem = owned_memory_.back();
-    wasm_code_manager_->TryAllocate(size, &new_mem, hint);
-    if (!new_mem.IsReserved()) return nullptr;
-    DisjointAllocationPool mem_pool(
-        reinterpret_cast<Address>(new_mem.address()),
-        reinterpret_cast<Address>(new_mem.end()));
+    owned_code_space_.push_back(empty_mem);
+    VirtualMemory& new_mem = owned_code_space_.back();
+    wasm_code_manager_->TryAllocate(size, &new_mem,
+                                    reinterpret_cast<void*>(hint));
+    if (!new_mem.IsReserved()) return kNullAddress;
     wasm_code_manager_->AssignRanges(new_mem.address(), new_mem.end(), this);
 
-    free_memory_.Merge(std::move(mem_pool));
-    mem = free_memory_.Allocate(size);
-    if (mem.IsEmpty()) return nullptr;
+    free_code_space_.Merge({new_mem.address(), new_mem.end()});
+    mem = free_code_space_.Allocate(size);
+    if (mem.is_empty()) return kNullAddress;
   }
-  Address ret = mem.ranges().front().first;
-  Address end = ret + size;
-  Address commit_start = RoundUp(ret, AllocatePageSize());
-  Address commit_end = RoundUp(end, AllocatePageSize());
-  // {commit_start} will be either ret or the start of the next page.
+  Address commit_start = RoundUp(mem.start, AllocatePageSize());
+  Address commit_end = RoundUp(mem.end, AllocatePageSize());
+  // {commit_start} will be either mem.start or the start of the next page.
   // {commit_end} will be the start of the page after the one in which
   // the allocation ends.
   // We start from an aligned start, and we know we allocated vmem in
@@ -806,195 +644,109 @@ Address NativeModule::AllocateForCode(size_t size) {
     // On Windows, we cannot commit a range that straddles different
     // reservations of virtual memory. Because we bump-allocate, and because, if
     // we need more memory, we append that memory at the end of the
-    // owned_memory_ list, we traverse that list in reverse order to find the
-    // reservation(s) that guide how to chunk the region to commit.
-    for (auto it = owned_memory_.crbegin(), rend = owned_memory_.crend();
+    // owned_code_space_ list, we traverse that list in reverse order to find
+    // the reservation(s) that guide how to chunk the region to commit.
+    for (auto it = owned_code_space_.crbegin(),
+              rend = owned_code_space_.crend();
          it != rend && commit_start < commit_end; ++it) {
       if (commit_end > it->end() || it->address() >= commit_end) continue;
-      Address start =
-          std::max(commit_start, reinterpret_cast<Address>(it->address()));
+      Address start = std::max(commit_start, it->address());
       size_t commit_size = static_cast<size_t>(commit_end - start);
       DCHECK(IsAligned(commit_size, AllocatePageSize()));
       if (!wasm_code_manager_->Commit(start, commit_size)) {
-        return nullptr;
+        return kNullAddress;
       }
-      committed_memory_ += commit_size;
+      committed_code_space_ += commit_size;
       commit_end = start;
     }
 #else
     size_t commit_size = static_cast<size_t>(commit_end - commit_start);
     DCHECK(IsAligned(commit_size, AllocatePageSize()));
     if (!wasm_code_manager_->Commit(commit_start, commit_size)) {
-      return nullptr;
+      return kNullAddress;
     }
-    committed_memory_ += commit_size;
+    committed_code_space_ += commit_size;
 #endif
   }
-  DCHECK(IsAligned(reinterpret_cast<intptr_t>(ret), kCodeAlignment));
-  allocated_memory_.Merge(std::move(mem));
-  TRACE_HEAP("ID: %zu. Code alloc: %p,+%zu\n", instance_id,
-             reinterpret_cast<void*>(ret), size);
-  return ret;
+  DCHECK(IsAligned(mem.start, kCodeAlignment));
+  allocated_code_space_.Merge(std::move(mem));
+  TRACE_HEAP("Code alloc for %p: %" PRIuPTR ",+%zu\n", this, mem.start, size);
+  return mem.start;
 }
 
-WasmCode* NativeModule::Lookup(Address pc) {
+WasmCode* NativeModule::Lookup(Address pc) const {
   if (owned_code_.empty()) return nullptr;
   auto iter = std::upper_bound(owned_code_.begin(), owned_code_.end(), pc,
                                WasmCodeUniquePtrComparator());
   if (iter == owned_code_.begin()) return nullptr;
   --iter;
-  WasmCode* candidate = (*iter).get();
+  WasmCode* candidate = iter->get();
   DCHECK_NOT_NULL(candidate);
-  if (candidate->instructions().start() <= pc &&
-      pc < candidate->instructions().start() +
-               candidate->instructions().size()) {
-    return candidate;
-  }
-  return nullptr;
+  return candidate->contains(pc) ? candidate : nullptr;
 }
 
-WasmCode* NativeModule::GetIndirectlyCallableCode(uint32_t func_index) {
-  WasmCode* code = GetCode(func_index);
-  if (!code || code->kind() != WasmCode::kLazyStub) {
-    return code;
-  }
-#if DEBUG
-  auto num_imported_functions =
-      compiled_module()->shared()->module()->num_imported_functions;
-  if (func_index < num_imported_functions) {
-    DCHECK(!code->IsAnonymous());
-  }
-#endif
-  if (!code->IsAnonymous()) {
-    // If the function wasn't imported, its index should match.
-    DCHECK_IMPLIES(func_index >= num_imported_functions,
-                   func_index == code->index());
-    return code;
-  }
-  if (!lazy_compile_stubs_.get()) {
-    lazy_compile_stubs_ =
-        base::make_unique<std::vector<WasmCode*>>(FunctionCount());
-  }
-  WasmCode* cloned_code = lazy_compile_stubs_.get()->at(func_index);
-  if (cloned_code == nullptr) {
-    cloned_code = CloneCode(code, WasmCode::kNoFlushICache);
-    RelocateCode(cloned_code, code, WasmCode::kFlushICache);
-    cloned_code->index_ = Just(func_index);
-    lazy_compile_stubs_.get()->at(func_index) = cloned_code;
-  }
-  DCHECK_EQ(func_index, cloned_code->index());
-  return cloned_code;
-}
+Address NativeModule::GetCallTargetForFunction(uint32_t func_index) const {
+  // TODO(clemensh): Measure performance win of returning instruction start
+  // directly if we have turbofan code. Downside: Redirecting functions (e.g.
+  // for debugging) gets much harder.
 
-void NativeModule::CloneTrampolinesAndStubs(
-    const NativeModule* other, WasmCode::FlushICache flush_icache) {
-  for (auto& pair : other->trampolines_) {
-    Address key = pair.first;
-    Address local =
-        GetLocalAddressFor(handle(Code::GetCodeFromTargetAddress(key)));
-    DCHECK_NOT_NULL(local);
-    trampolines_.emplace(std::make_pair(key, local));
-  }
-  for (auto& pair : other->stubs_) {
-    uint32_t key = pair.first;
-    WasmCode* clone = CloneCode(pair.second, flush_icache);
-    stubs_.emplace(std::make_pair(key, clone));
-  }
+  // Return the jump table slot for that function index.
+  DCHECK_NOT_NULL(jump_table_);
+  uint32_t slot_idx = func_index - module_->num_imported_functions;
+  DCHECK_LT(slot_idx, jump_table_->instructions().size() /
+                          JumpTableAssembler::kJumpTableSlotSize);
+  return jump_table_->instruction_start() +
+         slot_idx * JumpTableAssembler::kJumpTableSlotSize;
 }
 
-WasmCode* NativeModule::CloneCode(const WasmCode* original_code,
-                                  WasmCode::FlushICache flush_icache) {
-  std::unique_ptr<byte[]> reloc_info;
-  if (original_code->reloc_info().size() > 0) {
-    reloc_info.reset(new byte[original_code->reloc_info().size()]);
-    memcpy(reloc_info.get(), original_code->reloc_info().start(),
-           original_code->reloc_info().size());
-  }
-  std::unique_ptr<byte[]> source_pos;
-  if (original_code->source_positions().size() > 0) {
-    source_pos.reset(new byte[original_code->source_positions().size()]);
-    memcpy(source_pos.get(), original_code->source_positions().start(),
-           original_code->source_positions().size());
-  }
-  WasmCode* ret = AddOwnedCode(
-      original_code->instructions(), std::move(reloc_info),
-      original_code->reloc_info().size(), std::move(source_pos),
-      original_code->source_positions().size(), original_code->index_,
-      original_code->kind(), original_code->constant_pool_offset_,
-      original_code->stack_slots(), original_code->safepoint_table_offset_,
-      original_code->handler_table_offset_,
-      original_code->protected_instructions_, original_code->tier(),
-      flush_icache);
-  if (!ret->IsAnonymous()) {
-    code_table_[ret->index()] = ret;
-  }
-  return ret;
+uint32_t NativeModule::GetFunctionIndexFromJumpTableSlot(
+    Address slot_address) const {
+  DCHECK(is_jump_table_slot(slot_address));
+  uint32_t offset =
+      static_cast<uint32_t>(slot_address - jump_table_->instruction_start());
+  uint32_t slot_idx = offset / JumpTableAssembler::kJumpTableSlotSize;
+  DCHECK_LT(slot_idx, module_->num_declared_functions);
+  return module_->num_imported_functions + slot_idx;
 }
 
-void NativeModule::UnpackAndRegisterProtectedInstructions() {
-  for (uint32_t i = num_imported_functions(), e = FunctionCount(); i < e; ++i) {
-    WasmCode* code = GetCode(i);
-
-    if (code == nullptr) continue;
-    if (code->kind() != wasm::WasmCode::kFunction) continue;
-    if (code->HasTrapHandlerIndex()) continue;
-
-    Address base = code->instructions().start();
-
-    size_t size = code->instructions().size();
-    const int index =
-        RegisterHandlerData(base, size, code->protected_instructions().size(),
-                            code->protected_instructions().data());
+void NativeModule::DisableTrapHandler() {
+  // Switch {use_trap_handler_} from true to false.
+  DCHECK(use_trap_handler_);
+  use_trap_handler_ = false;
 
-    // TODO(eholk): if index is negative, fail.
-    CHECK_LE(0, index);
-    code->set_trap_handler_index(static_cast<size_t>(index));
-  }
-}
+  // Clear the code table (just to increase the chances to hit an error if we
+  // forget to re-add all code).
+  uint32_t num_wasm_functions = module_->num_declared_functions;
+  memset(code_table_.get(), 0, num_wasm_functions * sizeof(WasmCode*));
 
-void NativeModule::ReleaseProtectedInstructions() {
-  for (uint32_t i = num_imported_functions(), e = FunctionCount(); i < e; ++i) {
-    WasmCode* wasm_code = GetCode(i);
-    if (wasm_code->HasTrapHandlerIndex()) {
-      CHECK_LT(wasm_code->trap_handler_index(),
-               static_cast<size_t>(std::numeric_limits<int>::max()));
-      trap_handler::ReleaseHandlerData(
-          static_cast<int>(wasm_code->trap_handler_index()));
-      wasm_code->ResetTrapHandlerIndex();
-    }
-  }
+  // TODO(clemensh): Actually free the owned code, such that the memory can be
+  // recycled.
 }
 
 NativeModule::~NativeModule() {
   TRACE_HEAP("Deleting native module: %p\n", reinterpret_cast<void*>(this));
-  // Clear the handle at the beginning of destructor to make it robust against
-  // potential GCs in the rest of the desctructor.
-  if (compiled_module_ != nullptr) {
-    Isolate* isolate = compiled_module()->GetIsolate();
-    isolate->global_handles()->Destroy(
-        reinterpret_cast<Object**>(compiled_module_));
-    compiled_module_ = nullptr;
-  }
-  wasm_code_manager_->FreeNativeModuleMemories(this);
+  compilation_state_.reset();  // Cancels tasks, needs to be done first.
+  wasm_code_manager_->FreeNativeModule(this);
 }
 
-WasmCodeManager::WasmCodeManager(v8::Isolate* isolate, size_t max_committed)
-    : isolate_(isolate) {
+WasmCodeManager::WasmCodeManager(size_t max_committed) {
   DCHECK_LE(max_committed, kMaxWasmCodeMemory);
-  remaining_uncommitted_.SetValue(max_committed);
+  remaining_uncommitted_code_space_.store(max_committed);
 }
 
 bool WasmCodeManager::Commit(Address start, size_t size) {
-  DCHECK(IsAligned(reinterpret_cast<size_t>(start), AllocatePageSize()));
+  DCHECK(IsAligned(start, AllocatePageSize()));
   DCHECK(IsAligned(size, AllocatePageSize()));
-  if (size > static_cast<size_t>(std::numeric_limits<intptr_t>::max())) {
-    return false;
-  }
-  // reserve the size.
-  intptr_t new_value = remaining_uncommitted_.Decrement(size);
-  if (new_value < 0) {
-    remaining_uncommitted_.Increment(size);
-    return false;
+  // Reserve the size. Use CAS loop to avoid underflow on
+  // {remaining_uncommitted_}. Temporary underflow would allow concurrent
+  // threads to over-commit.
+  while (true) {
+    size_t old_value = remaining_uncommitted_code_space_.load();
+    if (old_value < size) return false;
+    if (remaining_uncommitted_code_space_.compare_exchange_weak(
+            old_value, old_value - size)) {
+      break;
+    }
   }
   PageAllocator::Permission permission = FLAG_wasm_write_protect_code_memory
                                              ? PageAllocator::kReadWrite
@@ -1004,40 +756,18 @@ bool WasmCodeManager::Commit(Address start, size_t size) {
   TRACE_HEAP("Setting rw permissions for %p:%p\n",
              reinterpret_cast<void*>(start),
              reinterpret_cast<void*>(start + size));
+
   if (!ret) {
     // Highly unlikely.
-    remaining_uncommitted_.Increment(size);
+    remaining_uncommitted_code_space_.fetch_add(size);
     return false;
   }
-  // This API assumes main thread
-  isolate_->AdjustAmountOfExternalAllocatedMemory(size);
-  if (WouldGCHelp()) {
-    // This API does not assume main thread, and would schedule
-    // a GC if called from a different thread, instead of synchronously
-    // doing one.
-    isolate_->MemoryPressureNotification(MemoryPressureLevel::kCritical);
-  }
   return ret;
 }
 
-bool WasmCodeManager::WouldGCHelp() const {
-  // If all we have is one module, or none, no GC would help.
-  // GC would help if there's some remaining native modules that
-  // would be collected.
-  if (active_ <= 1) return false;
-  // We have an expectation on the largest size a native function
-  // may have.
-  constexpr size_t kMaxNativeFunction = 32 * MB;
-  intptr_t remaining = remaining_uncommitted_.Value();
-  DCHECK_GE(remaining, 0);
-  return static_cast<size_t>(remaining) < kMaxNativeFunction;
-}
-
-void WasmCodeManager::AssignRanges(void* start, void* end,
+void WasmCodeManager::AssignRanges(Address start, Address end,
                                    NativeModule* native_module) {
-  lookup_map_.insert(std::make_pair(
-      reinterpret_cast<Address>(start),
-      std::make_pair(reinterpret_cast<Address>(end), native_module)));
+  lookup_map_.insert(std::make_pair(start, std::make_pair(end, native_module)));
 }
 
 void WasmCodeManager::TryAllocate(size_t size, VirtualMemory* ret, void* hint) {
@@ -1049,60 +779,75 @@ void WasmCodeManager::TryAllocate(size_t size, VirtualMemory* ret, void* hint) {
                                  hint, ret)) {
     DCHECK(!ret->IsReserved());
   }
-  TRACE_HEAP("VMem alloc: %p:%p (%zu)\n", ret->address(), ret->end(),
-             ret->size());
+  TRACE_HEAP("VMem alloc: %p:%p (%zu)\n",
+             reinterpret_cast<void*>(ret->address()),
+             reinterpret_cast<void*>(ret->end()), ret->size());
 }
 
-size_t WasmCodeManager::GetAllocationChunk(const WasmModule& module) {
-  // TODO(mtrofin): this should pick up its 'maximal code range size'
-  // from something embedder-provided
-  if (kRequiresCodeRange) return kMaxWasmCodeMemory;
-  DCHECK(kModuleCanAllocateMoreMemory);
-  size_t ret = AllocatePageSize();
-  // a ballpark guesstimate on native inflation factor.
-  constexpr size_t kMultiplier = 4;
-
-  for (auto& function : module.functions) {
-    ret += kMultiplier * function.code.length();
+// static
+size_t WasmCodeManager::EstimateNativeModuleSize(const WasmModule* module) {
+  constexpr size_t kCodeSizeMultiplier = 4;
+  constexpr size_t kImportSize = 32 * kPointerSize;
+
+  uint32_t num_wasm_functions = module->num_declared_functions;
+
+  size_t estimate =
+      AllocatePageSize() /* TODO(titzer): 1 page spot bonus */ +
+      sizeof(NativeModule) +
+      (sizeof(WasmCode*) * num_wasm_functions /* code table size */) +
+      (sizeof(WasmCode) * num_wasm_functions /* code object size */) +
+      (kImportSize * module->num_imported_functions /* import size */) +
+      (JumpTableAssembler::kJumpTableSlotSize *
+       num_wasm_functions /* jump table size */);
+
+  for (auto& function : module->functions) {
+    estimate += kCodeSizeMultiplier * function.code.length();
   }
-  return ret;
-}
 
-std::unique_ptr<NativeModule> WasmCodeManager::NewNativeModule(
-    const WasmModule& module) {
-  size_t code_size = GetAllocationChunk(module);
-  return NewNativeModule(
-      code_size, static_cast<uint32_t>(module.functions.size()),
-      module.num_imported_functions, kModuleCanAllocateMoreMemory);
+  return estimate;
 }
 
 std::unique_ptr<NativeModule> WasmCodeManager::NewNativeModule(
-    size_t size_estimate, uint32_t num_functions,
-    uint32_t num_imported_functions, bool can_request_more) {
+    Isolate* isolate, size_t memory_estimate, bool can_request_more,
+    std::shared_ptr<const WasmModule> module, const ModuleEnv& env) {
+  // TODO(titzer): we force a critical memory pressure notification
+  // when the code space is almost exhausted, but only upon the next module
+  // creation. This is only for one isolate, and it should really do this for
+  // all isolates, at the point of commit.
+  constexpr size_t kCriticalThreshold = 32 * 1024 * 1024;
+  bool force_critical_notification =
+      (active_ > 1) &&
+      (remaining_uncommitted_code_space_.load() < kCriticalThreshold);
+
+  if (force_critical_notification) {
+    (reinterpret_cast<v8::Isolate*>(isolate))
+        ->MemoryPressureNotification(MemoryPressureLevel::kCritical);
+  }
+
   VirtualMemory mem;
-  TryAllocate(size_estimate, &mem);
+  // If the code must be contiguous, reserve enough address space up front.
+  size_t vmem_size = kRequiresCodeRange ? kMaxWasmCodeMemory : memory_estimate;
+  TryAllocate(vmem_size, &mem);
   if (mem.IsReserved()) {
-    void* start = mem.address();
+    Address start = mem.address();
     size_t size = mem.size();
-    void* end = mem.end();
+    Address end = mem.end();
     std::unique_ptr<NativeModule> ret(new NativeModule(
-        num_functions, num_imported_functions, can_request_more, &mem, this));
-    TRACE_HEAP("New Module: ID:%zu. Mem: %p,+%zu\n", ret->instance_id, start,
+        isolate, can_request_more, &mem, this, std::move(module), env));
+    TRACE_HEAP("New NativeModule %p: Mem: %" PRIuPTR ",+%zu\n", this, start,
                size);
     AssignRanges(start, end, ret.get());
     ++active_;
     return ret;
   }
 
-  V8::FatalProcessOutOfMemory(reinterpret_cast<Isolate*>(isolate_),
-                              "WasmCodeManager::NewNativeModule");
+  V8::FatalProcessOutOfMemory(isolate, "WasmCodeManager::NewNativeModule");
   return nullptr;
 }
 
 bool NativeModule::SetExecutable(bool executable) {
   if (is_executable_ == executable) return true;
-  TRACE_HEAP("Setting module %zu as executable: %d.\n", instance_id,
-             executable);
+  TRACE_HEAP("Setting module %p as executable: %d.\n", this, executable);
   PageAllocator::Permission permission =
       executable ? PageAllocator::kReadExecute : PageAllocator::kReadWrite;
 
@@ -1117,7 +862,7 @@ bool NativeModule::SetExecutable(bool executable) {
     // use. On 32-bit though, the scarce resource is the address space -
     // committed or not.
     if (can_request_more_memory_) {
-      for (auto& vmem : owned_memory_) {
+      for (auto& vmem : owned_code_space_) {
         if (!SetPermissions(vmem.address(), vmem.size(), permission)) {
           return false;
         }
@@ -1128,63 +873,41 @@ bool NativeModule::SetExecutable(bool executable) {
       return true;
     }
 #endif
-    for (auto& range : allocated_memory_.ranges()) {
-      // allocated_memory_ is fine-grained, so we need to
+    for (auto& range : allocated_code_space_.ranges()) {
+      // allocated_code_space_ is fine-grained, so we need to
       // page-align it.
-      size_t range_size = RoundUp(
-          static_cast<size_t>(range.second - range.first), AllocatePageSize());
-      if (!SetPermissions(range.first, range_size, permission)) {
+      size_t range_size = RoundUp(range.size(), AllocatePageSize());
+      if (!SetPermissions(range.start, range_size, permission)) {
         return false;
       }
       TRACE_HEAP("Set %p:%p to executable:%d\n",
-                 reinterpret_cast<void*>(range.first),
-                 reinterpret_cast<void*>(range.second), executable);
+                 reinterpret_cast<void*>(range.start),
+                 reinterpret_cast<void*>(range.end), executable);
     }
   }
   is_executable_ = executable;
   return true;
 }
 
-std::unique_ptr<NativeModule> NativeModule::Clone() {
-  std::unique_ptr<NativeModule> ret = wasm_code_manager_->NewNativeModule(
-      owned_memory_.front().size(), FunctionCount(), num_imported_functions(),
-      can_request_more_memory_);
-  TRACE_HEAP("%zu cloned from %zu\n", ret->instance_id, instance_id);
-  if (!ret) return ret;
-
-  // Clone trampolines and stubs. They are later patched, so no icache flush
-  // needed yet.
-  ret->CloneTrampolinesAndStubs(this, WasmCode::kNoFlushICache);
-
-  // Create a helper for cloning and patching code.
-  CloneCodeHelper helper(this, ret.get());
-  for (uint32_t i = num_imported_functions(), e = FunctionCount(); i < e; ++i) {
-    helper.SelectForCloning(i);
-  }
-  helper.CloneAndPatchCode(true);
-
-  return ret;
-}
-
-void WasmCodeManager::FreeNativeModuleMemories(NativeModule* native_module) {
+void WasmCodeManager::FreeNativeModule(NativeModule* native_module) {
   DCHECK_GE(active_, 1);
   --active_;
-  TRACE_HEAP("Freeing %zu\n", native_module->instance_id);
-  for (auto& vmem : native_module->owned_memory_) {
-    lookup_map_.erase(reinterpret_cast<Address>(vmem.address()));
+  TRACE_HEAP("Freeing NativeModule %p\n", this);
+  for (auto& vmem : native_module->owned_code_space_) {
+    lookup_map_.erase(vmem.address());
     Free(&vmem);
     DCHECK(!vmem.IsReserved());
   }
-  native_module->owned_memory_.clear();
-
-  // No need to tell the GC anything if we're destroying the heap,
-  // which we currently indicate by having the isolate_ as null
-  if (isolate_ == nullptr) return;
-  size_t freed_mem = native_module->committed_memory_;
-  DCHECK(IsAligned(freed_mem, AllocatePageSize()));
-  remaining_uncommitted_.Increment(freed_mem);
-  isolate_->AdjustAmountOfExternalAllocatedMemory(
-      -static_cast<int64_t>(freed_mem));
+  native_module->owned_code_space_.clear();
+
+  size_t code_size = native_module->committed_code_space_;
+  DCHECK(IsAligned(code_size, AllocatePageSize()));
+
+  if (module_code_size_mb_) {
+    module_code_size_mb_->AddSample(static_cast<int>(code_size / MB));
+  }
+
+  remaining_uncommitted_code_space_.fetch_add(code_size);
 }
 
 // TODO(wasm): We can make this more efficient if needed. For
@@ -1196,11 +919,11 @@ WasmCode* WasmCodeManager::GetCodeFromStartAddress(Address pc) const {
   WasmCode* code = LookupCode(pc);
   // This method can only be called for valid instruction start addresses.
   DCHECK_NOT_NULL(code);
-  DCHECK_EQ(pc, code->instructions().start());
+  DCHECK_EQ(pc, code->instruction_start());
   return code;
 }
 
-WasmCode* WasmCodeManager::LookupCode(Address pc) const {
+NativeModule* WasmCodeManager::LookupNativeModule(Address pc) const {
   if (lookup_map_.empty()) return nullptr;
 
   auto iter = lookup_map_.upper_bound(pc);
@@ -1211,23 +934,25 @@ WasmCode* WasmCodeManager::LookupCode(Address pc) const {
   NativeModule* candidate = iter->second.second;
 
   DCHECK_NOT_NULL(candidate);
-  if (range_start <= pc && pc < range_end) {
-    return candidate->Lookup(pc);
-  }
-  return nullptr;
+  return range_start <= pc && pc < range_end ? candidate : nullptr;
+}
+
+WasmCode* WasmCodeManager::LookupCode(Address pc) const {
+  NativeModule* candidate = LookupNativeModule(pc);
+  return candidate ? candidate->Lookup(pc) : nullptr;
 }
 
 void WasmCodeManager::Free(VirtualMemory* mem) {
   DCHECK(mem->IsReserved());
-  void* start = mem->address();
-  void* end = mem->end();
+  void* start = reinterpret_cast<void*>(mem->address());
+  void* end = reinterpret_cast<void*>(mem->end());
   size_t size = mem->size();
   mem->Free();
   TRACE_HEAP("VMem Release: %p:%p (%zu)\n", start, end, size);
 }
 
-intptr_t WasmCodeManager::remaining_uncommitted() const {
-  return remaining_uncommitted_.Value();
+size_t WasmCodeManager::remaining_uncommitted_code_space() const {
+  return remaining_uncommitted_code_space_.load();
 }
 
 NativeModuleModificationScope::NativeModuleModificationScope(
diff --git a/deps/v8/src/wasm/wasm-code-manager.h b/deps/v8/src/wasm/wasm-code-manager.h
index c2a338c9face31..dd898dcd4d41b2 100644
--- a/deps/v8/src/wasm/wasm-code-manager.h
+++ b/deps/v8/src/wasm/wasm-code-manager.h
@@ -17,12 +17,11 @@
 #include "src/wasm/module-compiler.h"
 
 namespace v8 {
-class Isolate;
 namespace internal {
 
 struct CodeDesc;
 class Code;
-class WasmCompiledModule;
+class Histogram;
 
 namespace wasm {
 
@@ -30,64 +29,83 @@ class NativeModule;
 class WasmCodeManager;
 struct WasmModule;
 
+// Convenience macro listing all wasm runtime stubs. Note that the first few
+// elements of the list coincide with {compiler::TrapId}, order matters.
+#define WASM_RUNTIME_STUB_LIST(V, VTRAP) \
+  FOREACH_WASM_TRAPREASON(VTRAP)         \
+  V(WasmAllocateHeapNumber)              \
+  V(WasmArgumentsAdaptor)                \
+  V(WasmCallJavaScript)                  \
+  V(WasmGrowMemory)                      \
+  V(WasmStackGuard)                      \
+  V(WasmToNumber)                        \
+  V(DoubleToI)
+
+struct AddressRange {
+  Address start;
+  Address end;
+
+  AddressRange(Address s, Address e) : start(s), end(e) {
+    DCHECK_LE(start, end);
+    DCHECK_IMPLIES(start == kNullAddress, end == kNullAddress);
+  }
+  AddressRange() : AddressRange(kNullAddress, kNullAddress) {}
+
+  size_t size() const { return static_cast<size_t>(end - start); }
+  bool is_empty() const { return start == end; }
+  operator bool() const { return start == kNullAddress; }
+};
+
 // Sorted, disjoint and non-overlapping memory ranges. A range is of the
 // form [start, end). So there's no [start, end), [end, other_end),
 // because that should have been reduced to [start, other_end).
-using AddressRange = std::pair<Address, Address>;
 class V8_EXPORT_PRIVATE DisjointAllocationPool final {
  public:
-  enum ExtractionMode : bool { kAny = false, kContiguous = true };
-  DisjointAllocationPool() {}
+  DisjointAllocationPool() = default;
 
-  explicit DisjointAllocationPool(Address, Address);
+  explicit DisjointAllocationPool(AddressRange range) : ranges_({range}) {}
 
   DisjointAllocationPool(DisjointAllocationPool&& other) = default;
   DisjointAllocationPool& operator=(DisjointAllocationPool&& other) = default;
 
-  // Merge the ranges of the parameter into this object. Ordering is
-  // preserved. The assumption is that the passed parameter is
-  // not intersecting this object - for example, it was obtained
-  // from a previous Allocate{Pool}.
-  void Merge(DisjointAllocationPool&&);
+  // Merge the parameter range into this object while preserving ordering of the
+  // ranges. The assumption is that the passed parameter is not intersecting
+  // this object - for example, it was obtained from a previous Allocate.
+  void Merge(AddressRange);
 
   // Allocate a contiguous range of size {size}. Return an empty pool on
   // failure.
-  DisjointAllocationPool Allocate(size_t size) {
-    return Extract(size, kContiguous);
-  }
-
-  // Allocate a sub-pool of size {size}. Return an empty pool on failure.
-  DisjointAllocationPool AllocatePool(size_t size) {
-    return Extract(size, kAny);
-  }
+  AddressRange Allocate(size_t size);
 
   bool IsEmpty() const { return ranges_.empty(); }
   const std::list<AddressRange>& ranges() const { return ranges_; }
 
  private:
-  // Extract out a total of {size}. By default, the return may
-  // be more than one range. If kContiguous is passed, the return
-  // will be one range. If the operation fails, this object is
-  // unchanged, and the return {IsEmpty()}
-  DisjointAllocationPool Extract(size_t size, ExtractionMode mode);
-
   std::list<AddressRange> ranges_;
 
   DISALLOW_COPY_AND_ASSIGN(DisjointAllocationPool)
 };
 
-using ProtectedInstructions =
-    std::vector<trap_handler::ProtectedInstructionData>;
-
 class V8_EXPORT_PRIVATE WasmCode final {
  public:
   enum Kind {
     kFunction,
     kWasmToJsWrapper,
     kLazyStub,
-    kInterpreterStub,
-    kCopiedStub,
-    kTrampoline
+    kRuntimeStub,
+    kInterpreterEntry,
+    kJumpTable
+  };
+
+  // Each runtime stub is identified by an id. This id is used to reference the
+  // stub via {RelocInfo::WASM_STUB_CALL} and gets resolved during relocation.
+  enum RuntimeStubId {
+#define DEF_ENUM(Name) k##Name,
+#define DEF_ENUM_TRAP(Name) kThrowWasm##Name,
+    WASM_RUNTIME_STUB_LIST(DEF_ENUM, DEF_ENUM_TRAP)
+#undef DEF_ENUM_TRAP
+#undef DEF_ENUM
+        kRuntimeStubCount
   };
 
   // kOther is used if we have WasmCode that is neither
@@ -96,16 +114,16 @@ class V8_EXPORT_PRIVATE WasmCode final {
   enum Tier : int8_t { kLiftoff, kTurbofan, kOther };
 
   Vector<byte> instructions() const { return instructions_; }
-  Vector<const byte> reloc_info() const {
-    return {reloc_info_.get(), reloc_size_};
+  Address instruction_start() const {
+    return reinterpret_cast<Address>(instructions_.start());
   }
+  Vector<const byte> reloc_info() const { return reloc_info_.as_vector(); }
   Vector<const byte> source_positions() const {
-    return {source_position_table_.get(), source_position_size_};
+    return source_position_table_.as_vector();
   }
 
   uint32_t index() const { return index_.ToChecked(); }
-  // Anonymous functions are functions that don't carry an index, like
-  // trampolines.
+  // Anonymous functions are functions that don't carry an index.
   bool IsAnonymous() const { return index_.IsNothing(); }
   Kind kind() const { return kind_; }
   NativeModule* native_module() const { return native_module_; }
@@ -116,16 +134,20 @@ class V8_EXPORT_PRIVATE WasmCode final {
   size_t handler_table_offset() const { return handler_table_offset_; }
   uint32_t stack_slots() const { return stack_slots_; }
   bool is_liftoff() const { return tier_ == kLiftoff; }
+  bool contains(Address pc) const {
+    return reinterpret_cast<Address>(instructions_.start()) <= pc &&
+           pc < reinterpret_cast<Address>(instructions_.end());
+  }
 
-  const ProtectedInstructions& protected_instructions() const {
-    // TODO(mstarzinger): Code that doesn't have trapping instruction should
-    // not be required to have this vector, make it possible to be null.
-    DCHECK_NOT_NULL(protected_instructions_);
-    return *protected_instructions_.get();
+  Vector<trap_handler::ProtectedInstructionData> protected_instructions()
+      const {
+    return protected_instructions_.as_vector();
   }
 
-  void Print(Isolate* isolate) const;
-  void Disassemble(const char* name, Isolate* isolate, std::ostream& os) const;
+  void Validate() const;
+  void Print(const char* name = nullptr) const;
+  void Disassemble(const char* name, std::ostream& os,
+                   Address current_pc = kNullAddress) const;
 
   static bool ShouldBeLogged(Isolate* isolate);
   void LogCode(Isolate* isolate) const;
@@ -134,27 +156,20 @@ class V8_EXPORT_PRIVATE WasmCode final {
 
   enum FlushICache : bool { kFlushICache = true, kNoFlushICache = false };
 
-  // Offset of {instructions_.start()}. It is used for tiering, when
-  // we check if optimized code is available during the prologue
-  // of Liftoff-compiled code.
-  static constexpr int kInstructionStartOffset = 0;
-
  private:
   friend class NativeModule;
 
-  WasmCode(Vector<byte> instructions, std::unique_ptr<const byte[]> reloc_info,
-           size_t reloc_size, std::unique_ptr<const byte[]> source_pos,
-           size_t source_pos_size, NativeModule* native_module,
-           Maybe<uint32_t> index, Kind kind, size_t constant_pool_offset,
-           uint32_t stack_slots, size_t safepoint_table_offset,
-           size_t handler_table_offset,
-           std::shared_ptr<ProtectedInstructions> protected_instructions,
-           Tier tier)
+  WasmCode(NativeModule* native_module, Maybe<uint32_t> index,
+           Vector<byte> instructions, uint32_t stack_slots,
+           size_t safepoint_table_offset, size_t handler_table_offset,
+           size_t constant_pool_offset,
+           OwnedVector<trap_handler::ProtectedInstructionData>
+               protected_instructions,
+           OwnedVector<const byte> reloc_info,
+           OwnedVector<const byte> source_position_table, Kind kind, Tier tier)
       : instructions_(instructions),
         reloc_info_(std::move(reloc_info)),
-        reloc_size_(reloc_size),
-        source_position_table_(std::move(source_pos)),
-        source_position_size_(source_pos_size),
+        source_position_table_(std::move(source_position_table)),
         native_module_(native_module),
         index_(index),
         kind_(kind),
@@ -167,7 +182,6 @@ class V8_EXPORT_PRIVATE WasmCode final {
     DCHECK_LE(safepoint_table_offset, instructions.size());
     DCHECK_LE(constant_pool_offset, instructions.size());
     DCHECK_LE(handler_table_offset, instructions.size());
-    DCHECK_EQ(kInstructionStartOffset, OFFSET_OF(WasmCode, instructions_));
   }
 
   // Code objects that have been registered with the global trap handler within
@@ -175,13 +189,14 @@ class V8_EXPORT_PRIVATE WasmCode final {
   size_t trap_handler_index() const;
   void set_trap_handler_index(size_t);
   bool HasTrapHandlerIndex() const;
-  void ResetTrapHandlerIndex();
+
+  // Register protected instruction information with the trap handler. Sets
+  // trap_handler_index.
+  void RegisterTrapHandlerData();
 
   Vector<byte> instructions_;
-  std::unique_ptr<const byte[]> reloc_info_;
-  size_t reloc_size_ = 0;
-  std::unique_ptr<const byte[]> source_position_table_;
-  size_t source_position_size_ = 0;
+  OwnedVector<const byte> reloc_info_;
+  OwnedVector<const byte> source_position_table_;
   NativeModule* native_module_ = nullptr;
   Maybe<uint32_t> index_;
   Kind kind_;
@@ -193,7 +208,7 @@ class V8_EXPORT_PRIVATE WasmCode final {
   size_t safepoint_table_offset_ = 0;
   size_t handler_table_offset_ = 0;
   intptr_t trap_handler_index_ = -1;
-  std::shared_ptr<ProtectedInstructions> protected_instructions_;
+  OwnedVector<trap_handler::ProtectedInstructionData> protected_instructions_;
   Tier tier_;
 
   DISALLOW_COPY_AND_ASSIGN(WasmCode);
@@ -202,94 +217,130 @@ class V8_EXPORT_PRIVATE WasmCode final {
 // Return a textual description of the kind.
 const char* GetWasmCodeKindAsString(WasmCode::Kind);
 
-// Note that we currently need to add code on the main thread, because we may
-// trigger a GC if we believe there's a chance the GC would clear up native
-// modules. The code is ready for concurrency otherwise, we just need to be
-// careful about this GC consideration. See WouldGCHelp and
-// WasmCodeManager::Commit.
 class V8_EXPORT_PRIVATE NativeModule final {
  public:
-  std::unique_ptr<NativeModule> Clone();
-
-  WasmCode* AddCode(const CodeDesc& desc, uint32_t frame_count, uint32_t index,
+#if V8_TARGET_ARCH_X64 || V8_TARGET_ARCH_S390X || V8_TARGET_ARCH_ARM64
+  static constexpr bool kCanAllocateMoreMemory = false;
+#else
+  static constexpr bool kCanAllocateMoreMemory = true;
+#endif
+
+  // {AddCode} is thread safe w.r.t. other calls to {AddCode} or {AddCodeCopy},
+  // i.e. it can be called concurrently from background threads.
+  WasmCode* AddCode(uint32_t index, const CodeDesc& desc, uint32_t stack_slots,
                     size_t safepoint_table_offset, size_t handler_table_offset,
-                    std::unique_ptr<ProtectedInstructions>,
-                    Handle<ByteArray> source_position_table,
+                    OwnedVector<trap_handler::ProtectedInstructionData>
+                        protected_instructions,
+                    OwnedVector<const byte> source_position_table,
                     WasmCode::Tier tier);
 
+  WasmCode* AddDeserializedCode(
+      uint32_t index, Vector<const byte> instructions, uint32_t stack_slots,
+      size_t safepoint_table_offset, size_t handler_table_offset,
+      size_t constant_pool_offset,
+      OwnedVector<trap_handler::ProtectedInstructionData>
+          protected_instructions,
+      OwnedVector<const byte> reloc_info,
+      OwnedVector<const byte> source_position_table, WasmCode::Tier tier);
+
   // A way to copy over JS-allocated code. This is because we compile
   // certain wrappers using a different pipeline.
   WasmCode* AddCodeCopy(Handle<Code> code, WasmCode::Kind kind, uint32_t index);
 
-  // Add an interpreter wrapper. For the same reason as AddCodeCopy, we
+  // Add an interpreter entry. For the same reason as AddCodeCopy, we
   // currently compile these using a different pipeline and we can't get a
   // CodeDesc here. When adding interpreter wrappers, we do not insert them in
-  // the code_table, however, we let them self-identify as the {index} function
-  WasmCode* AddInterpreterWrapper(Handle<Code> code, uint32_t index);
+  // the code_table, however, we let them self-identify as the {index} function.
+  WasmCode* AddInterpreterEntry(Handle<Code> code, uint32_t index);
 
   // When starting lazy compilation, provide the WasmLazyCompile builtin by
-  // calling SetLazyBuiltin. It will initialize the code table with it. Copies
-  // of it might be cloned from them later when creating entries for exported
-  // functions and indirect callable functions, so that they may be identified
-  // by the runtime.
+  // calling SetLazyBuiltin. It will be copied into this NativeModule and the
+  // jump table will be populated with that copy.
   void SetLazyBuiltin(Handle<Code> code);
 
-  // FunctionCount is WasmModule::functions.size().
-  uint32_t FunctionCount() const;
-  WasmCode* GetCode(uint32_t index) const;
-  void SetCode(uint32_t index, WasmCode* wasm_code);
+  // Initializes all runtime stubs by copying them over from the JS-allocated
+  // heap into this native module. It must be called exactly once per native
+  // module before adding other WasmCode so that runtime stub ids can be
+  // resolved during relocation.
+  void SetRuntimeStubs(Isolate* isolate);
 
-  // Register/release the protected instructions in all code objects with the
-  // global trap handler for this process.
-  void UnpackAndRegisterProtectedInstructions();
-  void ReleaseProtectedInstructions();
+  WasmCode* code(uint32_t index) const {
+    DCHECK_LT(index, num_functions());
+    DCHECK_LE(module_->num_imported_functions, index);
+    return code_table_[index - module_->num_imported_functions];
+  }
 
-  // Gets code suitable for indirect or import calls for the given function
-  // index. If the code at the given index is the lazy compile stub, it will
-  // clone a non-anonymous lazy compile stub for the purpose.
-  WasmCode* GetIndirectlyCallableCode(uint32_t func_index);
+  bool has_code(uint32_t index) const { return code(index) != nullptr; }
+
+  WasmCode* runtime_stub(WasmCode::RuntimeStubId index) const {
+    DCHECK_LT(index, WasmCode::kRuntimeStubCount);
+    WasmCode* code = runtime_stub_table_[index];
+    DCHECK_NOT_NULL(code);
+    return code;
+  }
+
+  Address jump_table_start() const {
+    return jump_table_ ? jump_table_->instruction_start() : kNullAddress;
+  }
+
+  bool is_jump_table_slot(Address address) const {
+    return jump_table_->contains(address);
+  }
+
+  uint32_t GetFunctionIndexFromJumpTableSlot(Address slot_address) const;
+
+  // Transition this module from code relying on trap handlers (i.e. without
+  // explicit memory bounds checks) to code that does not require trap handlers
+  // (i.e. code with explicit bounds checks).
+  // This method must only be called if {use_trap_handler()} is true (it will be
+  // false afterwards). All code in this {NativeModule} needs to be re-added
+  // after calling this method.
+  void DisableTrapHandler();
+
+  // Returns the target to call for the given function (returns a jump table
+  // slot within {jump_table_}).
+  Address GetCallTargetForFunction(uint32_t func_index) const;
 
   bool SetExecutable(bool executable);
 
   // For cctests, where we build both WasmModule and the runtime objects
   // on the fly, and bypass the instance builder pipeline.
-  void ResizeCodeTableForTesting(size_t num_functions, size_t max_functions);
+  void ReserveCodeTableForTesting(uint32_t max_functions);
 
-  CompilationState* compilation_state() { return compilation_state_.get(); }
+  void LogWasmCodes(Isolate* isolate);
 
-  // TODO(mstarzinger): The link to the {compiled_module} is deprecated and all
-  // uses should vanish to make {NativeModule} independent of the Isolate.
-  WasmCompiledModule* compiled_module() const;
-  void SetCompiledModule(Handle<WasmCompiledModule>);
+  CompilationState* compilation_state() { return compilation_state_.get(); }
 
-  uint32_t num_imported_functions() const { return num_imported_functions_; }
+  uint32_t num_functions() const {
+    return module_->num_declared_functions + module_->num_imported_functions;
+  }
+  uint32_t num_imported_functions() const {
+    return module_->num_imported_functions;
+  }
+  Vector<WasmCode*> code_table() const {
+    return {code_table_.get(), module_->num_declared_functions};
+  }
+  bool use_trap_handler() const { return use_trap_handler_; }
+  void set_lazy_compile_frozen(bool frozen) { lazy_compile_frozen_ = frozen; }
+  bool lazy_compile_frozen() const { return lazy_compile_frozen_; }
+  Vector<const byte> wire_bytes() const { return wire_bytes_.as_vector(); }
+  void set_wire_bytes(OwnedVector<const byte> wire_bytes) {
+    wire_bytes_ = std::move(wire_bytes);
+  }
+  const WasmModule* module() const { return module_.get(); }
 
-  const std::vector<WasmCode*>& code_table() const { return code_table_; }
+  WasmCode* Lookup(Address) const;
 
-  size_t committed_memory() const { return committed_memory_; }
-  const size_t instance_id = 0;
   ~NativeModule();
 
-  void set_lazy_compile_frozen(bool frozen) { frozen_ = frozen; }
-  bool lazy_compile_frozen() const { return frozen_; }
-
  private:
+  friend class WasmCode;
   friend class WasmCodeManager;
-  friend class NativeModuleSerializer;
-  friend class NativeModuleDeserializer;
   friend class NativeModuleModificationScope;
 
-  class CloneCodeHelper;
-  struct AddressHasher {
-    size_t operator()(const Address& addr) const {
-      return std::hash<intptr_t>()(reinterpret_cast<intptr_t>(addr));
-    }
-  };
-
-  static base::AtomicNumber<size_t> next_id_;
-  NativeModule(uint32_t num_functions, uint32_t num_imports,
-               bool can_request_more, VirtualMemory* vmem,
-               WasmCodeManager* code_manager);
+  NativeModule(Isolate* isolate, bool can_request_more,
+               VirtualMemory* code_space, WasmCodeManager* code_manager,
+               std::shared_ptr<const WasmModule> module, const ModuleEnv& env);
 
   WasmCode* AddAnonymousCode(Handle<Code>, WasmCode::Kind kind);
   Address AllocateForCode(size_t size);
@@ -298,79 +349,89 @@ class V8_EXPORT_PRIVATE NativeModule final {
   // module is owned by that module. Various callers get to decide on how the
   // code is obtained (CodeDesc vs, as a point in time, Code*), the kind,
   // whether it has an index or is anonymous, etc.
-  WasmCode* AddOwnedCode(Vector<const byte> orig_instructions,
-                         std::unique_ptr<const byte[]> reloc_info,
-                         size_t reloc_size,
-                         std::unique_ptr<const byte[]> source_pos,
-                         size_t source_pos_size, Maybe<uint32_t> index,
-                         WasmCode::Kind kind, size_t constant_pool_offset,
+  WasmCode* AddOwnedCode(Maybe<uint32_t> index, Vector<const byte> instructions,
                          uint32_t stack_slots, size_t safepoint_table_offset,
                          size_t handler_table_offset,
-                         std::shared_ptr<ProtectedInstructions>, WasmCode::Tier,
-                         WasmCode::FlushICache);
-  WasmCode* CloneCode(const WasmCode*, WasmCode::FlushICache);
-  void CloneTrampolinesAndStubs(const NativeModule* other,
-                                WasmCode::FlushICache);
-  WasmCode* Lookup(Address);
-  Address GetLocalAddressFor(Handle<Code>);
-  Address CreateTrampolineTo(Handle<Code>);
+                         size_t constant_pool_offset,
+                         OwnedVector<trap_handler::ProtectedInstructionData>,
+                         OwnedVector<const byte> reloc_info,
+                         OwnedVector<const byte> source_position_table,
+                         WasmCode::Kind, WasmCode::Tier);
+
+  WasmCode* CreateEmptyJumpTable(uint32_t num_wasm_functions);
+
+  void PatchJumpTable(uint32_t func_index, Address target,
+                      WasmCode::FlushICache);
+
+  void set_code(uint32_t index, WasmCode* code) {
+    DCHECK_LT(index, num_functions());
+    DCHECK_LE(module_->num_imported_functions, index);
+    DCHECK_EQ(code->index(), index);
+    code_table_[index - module_->num_imported_functions] = code;
+  }
+
+  // TODO(clemensh): Make this a unique_ptr (requires refactoring
+  // AsyncCompileJob).
+  std::shared_ptr<const WasmModule> module_;
 
   // Holds all allocated code objects, is maintained to be in ascending order
   // according to the codes instruction start address to allow lookups.
   std::vector<std::unique_ptr<WasmCode>> owned_code_;
 
-  std::vector<WasmCode*> code_table_;
-  std::unique_ptr<std::vector<WasmCode*>> lazy_compile_stubs_;
-  uint32_t num_imported_functions_;
+  std::unique_ptr<WasmCode* []> code_table_;
+
+  OwnedVector<const byte> wire_bytes_;
 
-  // Maps from instruction start of an immovable code object to instruction
-  // start of the trampoline.
-  std::unordered_map<Address, Address, AddressHasher> trampolines_;
+  WasmCode* runtime_stub_table_[WasmCode::kRuntimeStubCount] = {nullptr};
 
-  // Maps from stub key to wasm code (containing a copy of that stub).
-  std::unordered_map<uint32_t, WasmCode*> stubs_;
+  // Jump table used to easily redirect wasm function calls.
+  WasmCode* jump_table_ = nullptr;
 
+  // The compilation state keeps track of compilation tasks for this module.
+  // Note that its destructor blocks until all tasks are finished/aborted and
+  // hence needs to be destructed first when this native module dies.
   std::unique_ptr<CompilationState, CompilationStateDeleter> compilation_state_;
 
-  // A phantom reference to the {WasmCompiledModule}. It is intentionally not
-  // typed {Handle<WasmCompiledModule>} because this location will be cleared
-  // when the phantom reference is cleared.
-  WasmCompiledModule** compiled_module_ = nullptr;
+  // This mutex protects concurrent calls to {AddCode} and {AddCodeCopy}.
+  mutable base::Mutex allocation_mutex_;
+
+  DisjointAllocationPool free_code_space_;
+  DisjointAllocationPool allocated_code_space_;
+  std::list<VirtualMemory> owned_code_space_;
 
-  DisjointAllocationPool free_memory_;
-  DisjointAllocationPool allocated_memory_;
-  std::list<VirtualMemory> owned_memory_;
   WasmCodeManager* wasm_code_manager_;
-  base::Mutex allocation_mutex_;
-  size_t committed_memory_ = 0;
+  size_t committed_code_space_ = 0;
+  int modification_scope_depth_ = 0;
   bool can_request_more_memory_;
+  bool use_trap_handler_ = false;
   bool is_executable_ = false;
-  bool frozen_ = false;
-  int modification_scope_depth_ = 0;
+  bool lazy_compile_frozen_ = false;
 
   DISALLOW_COPY_AND_ASSIGN(NativeModule);
 };
 
 class V8_EXPORT_PRIVATE WasmCodeManager final {
  public:
-  // The only reason we depend on Isolate is to report native memory used
-  // and held by a GC-ed object. We'll need to mitigate that when we
-  // start sharing wasm heaps.
-  WasmCodeManager(v8::Isolate*, size_t max_committed);
+  explicit WasmCodeManager(size_t max_committed);
   // Create a new NativeModule. The caller is responsible for its
   // lifetime. The native module will be given some memory for code,
   // which will be page size aligned. The size of the initial memory
   // is determined with a heuristic based on the total size of wasm
   // code. The native module may later request more memory.
-  std::unique_ptr<NativeModule> NewNativeModule(const WasmModule&);
-  std::unique_ptr<NativeModule> NewNativeModule(size_t memory_estimate,
-                                                uint32_t num_functions,
-                                                uint32_t num_imported_functions,
-                                                bool can_request_more);
+  // TODO(titzer): isolate is only required here for CompilationState.
+  std::unique_ptr<NativeModule> NewNativeModule(
+      Isolate* isolate, size_t memory_estimate, bool can_request_more,
+      std::shared_ptr<const WasmModule> module, const ModuleEnv& env);
 
+  NativeModule* LookupNativeModule(Address pc) const;
   WasmCode* LookupCode(Address pc) const;
   WasmCode* GetCodeFromStartAddress(Address pc) const;
-  intptr_t remaining_uncommitted() const;
+  size_t remaining_uncommitted_code_space() const;
+
+  void SetModuleCodeSizeHistogram(Histogram* histogram) {
+    module_code_size_mb_ = histogram;
+  }
+  static size_t EstimateNativeModuleSize(const WasmModule* module);
 
  private:
   friend class NativeModule;
@@ -378,23 +439,21 @@ class V8_EXPORT_PRIVATE WasmCodeManager final {
   void TryAllocate(size_t size, VirtualMemory*, void* hint = nullptr);
   bool Commit(Address, size_t);
   // Currently, we uncommit a whole module, so all we need is account
-  // for the freed memory size. We do that in FreeNativeModuleMemories.
+  // for the freed memory size. We do that in FreeNativeModule.
   // There's no separate Uncommit.
 
-  void FreeNativeModuleMemories(NativeModule*);
+  void FreeNativeModule(NativeModule*);
   void Free(VirtualMemory* mem);
-  void AssignRanges(void* start, void* end, NativeModule*);
-  size_t GetAllocationChunk(const WasmModule& module);
-  bool WouldGCHelp() const;
+  void AssignRanges(Address start, Address end, NativeModule*);
 
   std::map<Address, std::pair<Address, NativeModule*>> lookup_map_;
-  // count of NativeModules not yet collected. Helps determine if it's
+  // Count of NativeModules not yet collected. Helps determine if it's
   // worth requesting a GC on memory pressure.
   size_t active_ = 0;
-  base::AtomicNumber<intptr_t> remaining_uncommitted_;
+  std::atomic<size_t> remaining_uncommitted_code_space_;
 
-  // TODO(mtrofin): remove the dependency on isolate.
-  v8::Isolate* isolate_;
+  // Histogram to update with the maximum used code space for each NativeModule.
+  Histogram* module_code_size_mb_ = nullptr;
 
   DISALLOW_COPY_AND_ASSIGN(WasmCodeManager);
 };
diff --git a/deps/v8/src/wasm/wasm-code-specialization.cc b/deps/v8/src/wasm/wasm-code-specialization.cc
deleted file mode 100644
index bb3a08269954cc..00000000000000
--- a/deps/v8/src/wasm/wasm-code-specialization.cc
+++ /dev/null
@@ -1,226 +0,0 @@
-// Copyright 2017 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "src/wasm/wasm-code-specialization.h"
-
-#include "src/assembler-inl.h"
-#include "src/base/optional.h"
-#include "src/objects-inl.h"
-#include "src/source-position-table.h"
-#include "src/wasm/decoder.h"
-#include "src/wasm/wasm-code-manager.h"
-#include "src/wasm/wasm-module.h"
-#include "src/wasm/wasm-objects-inl.h"
-
-namespace v8 {
-namespace internal {
-namespace wasm {
-
-uint32_t ExtractDirectCallIndex(wasm::Decoder& decoder, const byte* pc) {
-  DCHECK_EQ(static_cast<int>(kExprCallFunction), static_cast<int>(*pc));
-  decoder.Reset(pc + 1, pc + 6);
-  uint32_t call_idx = decoder.consume_u32v("call index");
-  DCHECK(decoder.ok());
-  DCHECK_GE(kMaxInt, call_idx);
-  return call_idx;
-}
-
-namespace {
-
-int AdvanceSourcePositionTableIterator(SourcePositionTableIterator& iterator,
-                                       size_t offset_l) {
-  DCHECK_GE(kMaxInt, offset_l);
-  int offset = static_cast<int>(offset_l);
-  DCHECK(!iterator.done());
-  int byte_pos;
-  do {
-    byte_pos = iterator.source_position().ScriptOffset();
-    iterator.Advance();
-  } while (!iterator.done() && iterator.code_offset() <= offset);
-  return byte_pos;
-}
-
-class PatchDirectCallsHelper {
- public:
-  PatchDirectCallsHelper(NativeModule* native_module, const WasmCode* code)
-      : source_pos_it(code->source_positions()), decoder(nullptr, nullptr) {
-    uint32_t func_index = code->index();
-    WasmCompiledModule* comp_mod = native_module->compiled_module();
-    func_bytes =
-        comp_mod->shared()->module_bytes()->GetChars() +
-        comp_mod->shared()->module()->functions[func_index].code.offset();
-  }
-
-  SourcePositionTableIterator source_pos_it;
-  Decoder decoder;
-  const byte* func_bytes;
-};
-
-}  // namespace
-
-CodeSpecialization::CodeSpecialization() {}
-
-CodeSpecialization::~CodeSpecialization() {}
-
-void CodeSpecialization::UpdateInstanceReferences(
-    Handle<WeakCell> old_weak_instance, Handle<WeakCell> new_weak_instance) {
-  DCHECK(!old_weak_instance.is_null());
-  DCHECK(!new_weak_instance.is_null());
-  old_weak_instance_ = old_weak_instance;
-  new_weak_instance_ = new_weak_instance;
-}
-
-void CodeSpecialization::RelocateDirectCalls(NativeModule* native_module) {
-  DCHECK_NULL(relocate_direct_calls_module_);
-  DCHECK_NOT_NULL(native_module);
-  relocate_direct_calls_module_ = native_module;
-}
-
-bool CodeSpecialization::ApplyToWholeModule(NativeModule* native_module,
-                                            ICacheFlushMode icache_flush_mode) {
-  DisallowHeapAllocation no_gc;
-  WasmCompiledModule* compiled_module = native_module->compiled_module();
-  WasmSharedModuleData* shared = compiled_module->shared();
-  WasmModule* module = shared->module();
-  std::vector<WasmFunction>* wasm_functions = &shared->module()->functions;
-  DCHECK_EQ(compiled_module->export_wrappers()->length(),
-            shared->module()->num_exported_functions);
-
-  bool changed = false;
-  int func_index = module->num_imported_functions;
-
-  // Patch all wasm functions.
-  for (int num_wasm_functions = static_cast<int>(wasm_functions->size());
-       func_index < num_wasm_functions; ++func_index) {
-    WasmCode* wasm_function = native_module->GetCode(func_index);
-    // TODO(clemensh): Get rid of this nullptr check
-    if (wasm_function == nullptr ||
-        wasm_function->kind() != WasmCode::kFunction) {
-      continue;
-    }
-    changed |= ApplyToWasmCode(wasm_function, icache_flush_mode);
-  }
-
-  bool patch_wasm_weak_instances =
-      !old_weak_instance_.is_identical_to(new_weak_instance_);
-
-  // Patch all exported functions (JS_TO_WASM_FUNCTION).
-  int reloc_mode = 0;
-  // Patch CODE_TARGET if we shall relocate direct calls. If we patch direct
-  // calls, the instance registered for that (relocate_direct_calls_module_)
-  // should match the instance we currently patch (instance).
-  if (relocate_direct_calls_module_ != nullptr) {
-    DCHECK_EQ(native_module, relocate_direct_calls_module_);
-    reloc_mode |= RelocInfo::ModeMask(RelocInfo::JS_TO_WASM_CALL);
-  }
-  // Instance references are simply embedded objects.
-  if (patch_wasm_weak_instances) {
-    reloc_mode |= RelocInfo::ModeMask(RelocInfo::EMBEDDED_OBJECT);
-  }
-  if (!reloc_mode) return changed;
-  int wrapper_index = 0;
-  for (auto exp : module->export_table) {
-    if (exp.kind != kExternalFunction) continue;
-    Code* export_wrapper =
-        Code::cast(compiled_module->export_wrappers()->get(wrapper_index++));
-    if (export_wrapper->kind() != Code::JS_TO_WASM_FUNCTION) continue;
-    for (RelocIterator it(export_wrapper, reloc_mode); !it.done(); it.next()) {
-      RelocInfo::Mode mode = it.rinfo()->rmode();
-      switch (mode) {
-        case RelocInfo::JS_TO_WASM_CALL: {
-          changed = true;
-          const WasmCode* new_code =
-              native_module->GetIndirectlyCallableCode(exp.index);
-          it.rinfo()->set_js_to_wasm_address(new_code->instructions().start(),
-                                             icache_flush_mode);
-        } break;
-        case RelocInfo::EMBEDDED_OBJECT: {
-          changed = true;
-          const HeapObject* old = it.rinfo()->target_object();
-          if (*old_weak_instance_ == old) {
-            it.rinfo()->set_target_object(
-                *new_weak_instance_, WriteBarrierMode::UPDATE_WRITE_BARRIER,
-                icache_flush_mode);
-          }
-        } break;
-        default:
-          UNREACHABLE();
-      }
-    }
-  }
-  DCHECK_EQ(module->functions.size(), func_index);
-  DCHECK_EQ(compiled_module->export_wrappers()->length(), wrapper_index);
-  return changed;
-}
-
-bool CodeSpecialization::ApplyToWasmCode(wasm::WasmCode* code,
-                                         ICacheFlushMode icache_flush_mode) {
-  DisallowHeapAllocation no_gc;
-  DCHECK_EQ(wasm::WasmCode::kFunction, code->kind());
-
-  bool reloc_direct_calls = relocate_direct_calls_module_ != nullptr;
-
-  int reloc_mode = 0;
-  auto add_mode = [&reloc_mode](bool cond, RelocInfo::Mode mode) {
-    if (cond) reloc_mode |= RelocInfo::ModeMask(mode);
-  };
-  add_mode(reloc_direct_calls, RelocInfo::WASM_CALL);
-
-  // Always patch the code table entry address which is used in Liftoff
-  // prologue to jump to optimized code if existent.
-  reloc_mode |= RelocInfo::ModeMask(RelocInfo::WASM_CODE_TABLE_ENTRY);
-
-  base::Optional<PatchDirectCallsHelper> patch_direct_calls_helper;
-  bool changed = false;
-
-  NativeModule* native_module = code->native_module();
-
-  RelocIterator it(code->instructions(), code->reloc_info(),
-                   code->constant_pool(), reloc_mode);
-  for (; !it.done(); it.next()) {
-    RelocInfo::Mode mode = it.rinfo()->rmode();
-    switch (mode) {
-      case RelocInfo::WASM_CALL: {
-        DCHECK(reloc_direct_calls);
-        // Iterate simultaneously over the relocation information and the source
-        // position table. For each call in the reloc info, move the source
-        // position iterator forward to that position to find the byte offset of
-        // the respective call. Then extract the call index from the module wire
-        // bytes to find the new compiled function.
-        size_t offset = it.rinfo()->pc() - code->instructions().start();
-        if (!patch_direct_calls_helper) {
-          patch_direct_calls_helper.emplace(relocate_direct_calls_module_,
-                                            code);
-        }
-        int byte_pos = AdvanceSourcePositionTableIterator(
-            patch_direct_calls_helper->source_pos_it, offset);
-        uint32_t called_func_index = ExtractDirectCallIndex(
-            patch_direct_calls_helper->decoder,
-            patch_direct_calls_helper->func_bytes + byte_pos);
-        const WasmCode* new_code = native_module->GetCode(called_func_index);
-        it.rinfo()->set_wasm_call_address(new_code->instructions().start(),
-                                          icache_flush_mode);
-        changed = true;
-      } break;
-      case RelocInfo::WASM_CODE_TABLE_ENTRY: {
-        DCHECK(FLAG_wasm_tier_up);
-        WasmCode* const* code_table_entry =
-            native_module->code_table().data() + code->index();
-        it.rinfo()->set_wasm_code_table_entry(
-            const_cast<Address>(
-                reinterpret_cast<byte const*>(code_table_entry)),
-            icache_flush_mode);
-      } break;
-
-      default:
-        UNREACHABLE();
-    }
-  }
-
-  return changed;
-}
-
-}  // namespace wasm
-}  // namespace internal
-}  // namespace v8
diff --git a/deps/v8/src/wasm/wasm-code-specialization.h b/deps/v8/src/wasm/wasm-code-specialization.h
deleted file mode 100644
index 20977d70d5fb06..00000000000000
--- a/deps/v8/src/wasm/wasm-code-specialization.h
+++ /dev/null
@@ -1,54 +0,0 @@
-// Copyright 2017 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef V8_WASM_WASM_CODE_SPECIALIZATION_H_
-#define V8_WASM_WASM_CODE_SPECIALIZATION_H_
-
-#include "src/assembler.h"
-#include "src/wasm/decoder.h"
-#include "src/wasm/wasm-objects.h"
-
-namespace v8 {
-namespace internal {
-namespace wasm {
-
-uint32_t ExtractDirectCallIndex(wasm::Decoder& decoder, const byte* pc);
-
-// Helper class to specialize wasm code for a specific instance, or to update
-// code when memory / globals / tables change.
-// This class in unhandlified, and contains a DisallowHeapAllocation field to
-// ensure that no allocations happen while it is alive.
-//
-// Set up all relocations / patching that should be performed by the Relocate* /
-// Patch* methods, then apply all changes in one step using the Apply* methods.
-class CodeSpecialization {
- public:
-  CodeSpecialization();
-  ~CodeSpecialization();
-
-  // Update instance references in code. Instance references should only
-  // appear in export wrappers.
-  void UpdateInstanceReferences(Handle<WeakCell> old_weak_instance,
-                                Handle<WeakCell> new_weak_instance);
-  // Update all direct call sites based on the code table in the given instance.
-  void RelocateDirectCalls(NativeModule* module);
-  // Apply all relocations and patching to all code in the instance (wasm code
-  // and exported functions).
-  bool ApplyToWholeModule(NativeModule*,
-                          ICacheFlushMode = FLUSH_ICACHE_IF_NEEDED);
-  // Apply all relocations and patching to one wasm code object.
-  bool ApplyToWasmCode(wasm::WasmCode*,
-                       ICacheFlushMode = FLUSH_ICACHE_IF_NEEDED);
-
- private:
-  Handle<WeakCell> old_weak_instance_;
-  Handle<WeakCell> new_weak_instance_;
-  NativeModule* relocate_direct_calls_module_ = nullptr;
-};
-
-}  // namespace wasm
-}  // namespace internal
-}  // namespace v8
-
-#endif  // V8_WASM_WASM_CODE_SPECIALIZATION_H_
diff --git a/deps/v8/src/wasm/wasm-constants.h b/deps/v8/src/wasm/wasm-constants.h
index dc6f1ee67555bf..0233ced6ac1ddb 100644
--- a/deps/v8/src/wasm/wasm-constants.h
+++ b/deps/v8/src/wasm/wasm-constants.h
@@ -21,11 +21,11 @@ enum ValueTypeCode : uint8_t {
   kLocalF32 = 0x7d,
   kLocalF64 = 0x7c,
   kLocalS128 = 0x7b,
+  kLocalAnyFunc = 0x70,
   kLocalAnyRef = 0x6f
 };
 // Binary encoding of other types.
 constexpr uint8_t kWasmFunctionTypeCode = 0x60;
-constexpr uint8_t kWasmAnyFunctionTypeCode = 0x70;
 
 // Binary encoding of import/export kinds.
 enum ImportExportKindCode : uint8_t {
diff --git a/deps/v8/src/wasm/wasm-debug.cc b/deps/v8/src/wasm/wasm-debug.cc
index 33e82e2158b46a..069d5e8ed6032d 100644
--- a/deps/v8/src/wasm/wasm-debug.cc
+++ b/deps/v8/src/wasm/wasm-debug.cc
@@ -70,9 +70,10 @@ MaybeHandle<String> GetLocalName(Isolate* isolate,
   DCHECK_LE(0, func_index);
   DCHECK_LE(0, local_index);
   if (!debug_info->has_locals_names()) {
-    Handle<WasmSharedModuleData> shared(
-        debug_info->wasm_instance()->compiled_module()->shared(), isolate);
-    Handle<FixedArray> locals_names = wasm::DecodeLocalNames(isolate, shared);
+    Handle<WasmModuleObject> module_object(
+        debug_info->wasm_instance()->module_object(), isolate);
+    Handle<FixedArray> locals_names =
+        wasm::DecodeLocalNames(isolate, module_object);
     debug_info->set_locals_names(*locals_names);
   }
 
@@ -88,7 +89,7 @@ MaybeHandle<String> GetLocalName(Isolate* isolate,
       func_locals_names->get(local_index)->IsUndefined(isolate)) {
     return {};
   }
-  return handle(String::cast(func_locals_names->get(local_index)));
+  return handle(String::cast(func_locals_names->get(local_index)), isolate);
 }
 
 class InterpreterHandle {
@@ -132,21 +133,18 @@ class InterpreterHandle {
   static Vector<const byte> GetBytes(WasmDebugInfo* debug_info) {
     // Return raw pointer into heap. The WasmInterpreter will make its own copy
     // of this data anyway, and there is no heap allocation in-between.
-    SeqOneByteString* bytes_str = debug_info->wasm_instance()
-                                      ->compiled_module()
-                                      ->shared()
-                                      ->module_bytes();
-    return {bytes_str->GetChars(), static_cast<size_t>(bytes_str->length())};
+    NativeModule* native_module =
+        debug_info->wasm_instance()->module_object()->native_module();
+    return native_module->wire_bytes();
   }
 
  public:
   // TODO(wasm): properly handlify this constructor.
   InterpreterHandle(Isolate* isolate, WasmDebugInfo* debug_info)
       : isolate_(isolate),
-        module_(
-            debug_info->wasm_instance()->compiled_module()->shared()->module()),
+        module_(debug_info->wasm_instance()->module_object()->module()),
         interpreter_(isolate, module_, GetBytes(debug_info),
-                     handle(debug_info->wasm_instance())) {}
+                     handle(debug_info->wasm_instance(), isolate)) {}
 
   ~InterpreterHandle() { DCHECK_EQ(0, activations_.size()); }
 
@@ -169,16 +167,16 @@ class InterpreterHandle {
   // was not handled inside this activation. In the latter case, a pending
   // exception will have been set on the isolate.
   bool Execute(Handle<WasmInstanceObject> instance_object,
-               Address frame_pointer, uint32_t func_index,
-               uint8_t* arg_buffer) {
+               Address frame_pointer, uint32_t func_index, Address arg_buffer) {
     DCHECK_GE(module()->functions.size(), func_index);
     FunctionSig* sig = module()->functions[func_index].sig;
     DCHECK_GE(kMaxInt, sig->parameter_count());
     int num_params = static_cast<int>(sig->parameter_count());
     ScopedVector<WasmValue> wasm_args(num_params);
-    uint8_t* arg_buf_ptr = arg_buffer;
+    Address arg_buf_ptr = arg_buffer;
     for (int i = 0; i < num_params; ++i) {
-      uint32_t param_size = 1 << ElementSizeLog2Of(sig->GetParam(i));
+      uint32_t param_size = static_cast<uint32_t>(
+          ValueTypes::ElementSizeInBytes(sig->GetParam(i)));
 #define CASE_ARG_TYPE(type, ctype)                                    \
   case type:                                                          \
     DCHECK_EQ(param_size, sizeof(ctype));                             \
@@ -241,10 +239,11 @@ class InterpreterHandle {
     DCHECK_EQ(1, kV8MaxWasmFunctionReturns);
     if (sig->return_count()) {
       WasmValue ret_val = thread->GetReturnValue(0);
-#define CASE_RET_TYPE(type, ctype)                                       \
-  case type:                                                             \
-    DCHECK_EQ(1 << ElementSizeLog2Of(sig->GetReturn(0)), sizeof(ctype)); \
-    WriteUnalignedValue<ctype>(arg_buffer, ret_val.to<ctype>());         \
+#define CASE_RET_TYPE(type, ctype)                               \
+  case type:                                                     \
+    DCHECK_EQ(ValueTypes::ElementSizeInBytes(sig->GetReturn(0)), \
+              sizeof(ctype));                                    \
+    WriteUnalignedValue<ctype>(arg_buffer, ret_val.to<ctype>()); \
     break;
       switch (sig->GetReturn(0)) {
         CASE_RET_TYPE(kWasmI32, uint32_t)
@@ -293,25 +292,23 @@ class InterpreterHandle {
     // interpreter.
     DCHECK_EQ(this, Managed<wasm::InterpreterHandle>::cast(
                         instance_obj->debug_info()->interpreter_handle())
-                        ->get());
+                        ->raw());
     return instance_obj;
   }
 
   void NotifyDebugEventListeners(WasmInterpreter::Thread* thread) {
     // Enter the debugger.
     DebugScope debug_scope(isolate_->debug());
-    if (debug_scope.failed()) return;
-
     // Postpone interrupt during breakpoint processing.
     PostponeInterruptsScope postpone(isolate_);
 
     // Check whether we hit a breakpoint.
     if (isolate_->debug()->break_points_active()) {
-      Handle<WasmSharedModuleData> shared(
-          GetInstanceObject()->compiled_module()->shared(), isolate_);
-      int position = GetTopPosition(shared);
+      Handle<WasmModuleObject> module_object(
+          GetInstanceObject()->module_object(), isolate_);
+      int position = GetTopPosition(module_object);
       Handle<FixedArray> breakpoints;
-      if (WasmSharedModuleData::CheckBreakPoints(isolate_, shared, position)
+      if (WasmModuleObject::CheckBreakPoints(isolate_, module_object, position)
               .ToHandle(&breakpoints)) {
         // We hit one or several breakpoints. Clear stepping, notify the
         // listeners and return.
@@ -344,13 +341,13 @@ class InterpreterHandle {
     isolate_->debug()->OnDebugBreak(isolate_->factory()->empty_fixed_array());
   }
 
-  int GetTopPosition(Handle<WasmSharedModuleData> shared) {
+  int GetTopPosition(Handle<WasmModuleObject> module_object) {
     DCHECK_EQ(1, interpreter()->GetThreadCount());
     WasmInterpreter::Thread* thread = interpreter()->GetThread(0);
     DCHECK_LT(0, thread->GetFrameCount());
 
     auto frame = thread->GetFrame(thread->GetFrameCount() - 1);
-    return shared->GetFunctionOffset(frame->function()->func_index) +
+    return module_object->GetFunctionOffset(frame->function()->func_index) +
            frame->pc();
   }
 
@@ -411,7 +408,7 @@ class InterpreterHandle {
 
   Handle<JSObject> GetGlobalScopeObject(wasm::InterpretedFrame* frame,
                                         Handle<WasmDebugInfo> debug_info) {
-    Isolate* isolate = debug_info->GetIsolate();
+    Isolate* isolate = isolate_;
     Handle<WasmInstanceObject> instance(debug_info->wasm_instance(), isolate);
 
     // TODO(clemensh): Add globals to the global scope.
@@ -435,7 +432,7 @@ class InterpreterHandle {
 
   Handle<JSObject> GetLocalScopeObject(wasm::InterpretedFrame* frame,
                                        Handle<WasmDebugInfo> debug_info) {
-    Isolate* isolate = debug_info->GetIsolate();
+    Isolate* isolate = isolate_;
 
     Handle<JSObject> local_scope_object =
         isolate_->factory()->NewJSObjectWithNullProto();
@@ -534,31 +531,25 @@ wasm::InterpreterHandle* GetOrCreateInterpreterHandle(
     Isolate* isolate, Handle<WasmDebugInfo> debug_info) {
   Handle<Object> handle(debug_info->interpreter_handle(), isolate);
   if (handle->IsUndefined(isolate)) {
-    handle = Managed<wasm::InterpreterHandle>::Allocate(isolate, isolate,
-                                                        *debug_info);
+    size_t interpreter_size = 0;  // TODO(titzer): estimate size properly.
+    handle = Managed<wasm::InterpreterHandle>::Allocate(
+        isolate, interpreter_size, isolate, *debug_info);
     debug_info->set_interpreter_handle(*handle);
   }
 
-  return Handle<Managed<wasm::InterpreterHandle>>::cast(handle)->get();
+  return Handle<Managed<wasm::InterpreterHandle>>::cast(handle)->raw();
 }
 
 wasm::InterpreterHandle* GetInterpreterHandle(WasmDebugInfo* debug_info) {
   Object* handle_obj = debug_info->interpreter_handle();
-  DCHECK(!handle_obj->IsUndefined(debug_info->GetIsolate()));
-  return Managed<wasm::InterpreterHandle>::cast(handle_obj)->get();
+  DCHECK(!handle_obj->IsUndefined());
+  return Managed<wasm::InterpreterHandle>::cast(handle_obj)->raw();
 }
 
 wasm::InterpreterHandle* GetInterpreterHandleOrNull(WasmDebugInfo* debug_info) {
   Object* handle_obj = debug_info->interpreter_handle();
-  if (handle_obj->IsUndefined(debug_info->GetIsolate())) return nullptr;
-  return Managed<wasm::InterpreterHandle>::cast(handle_obj)->get();
-}
-
-int GetNumFunctions(WasmInstanceObject* instance) {
-  size_t num_functions =
-      instance->compiled_module()->shared()->module()->functions.size();
-  DCHECK_GE(kMaxInt, num_functions);
-  return static_cast<int>(num_functions);
+  if (handle_obj->IsUndefined()) return nullptr;
+  return Managed<wasm::InterpreterHandle>::cast(handle_obj)->raw();
 }
 
 Handle<FixedArray> GetOrCreateInterpretedFunctions(
@@ -566,59 +557,15 @@ Handle<FixedArray> GetOrCreateInterpretedFunctions(
   Handle<Object> obj(debug_info->interpreted_functions(), isolate);
   if (!obj->IsUndefined(isolate)) return Handle<FixedArray>::cast(obj);
 
-  Handle<FixedArray> new_arr = isolate->factory()->NewFixedArray(
-      GetNumFunctions(debug_info->wasm_instance()));
+  int num_functions = debug_info->wasm_instance()
+                          ->module_object()
+                          ->native_module()
+                          ->num_functions();
+  Handle<FixedArray> new_arr = isolate->factory()->NewFixedArray(num_functions);
   debug_info->set_interpreted_functions(*new_arr);
   return new_arr;
 }
 
-using CodeRelocationMap = std::map<Address, Address>;
-
-void RedirectCallsitesInCode(Isolate* isolate, const wasm::WasmCode* code,
-                             CodeRelocationMap* map) {
-  DisallowHeapAllocation no_gc;
-  for (RelocIterator it(code->instructions(), code->reloc_info(),
-                        code->constant_pool(),
-                        RelocInfo::ModeMask(RelocInfo::WASM_CALL));
-       !it.done(); it.next()) {
-    Address target = it.rinfo()->target_address();
-    auto new_target = map->find(target);
-    if (new_target == map->end()) continue;
-    it.rinfo()->set_wasm_call_address(new_target->second);
-  }
-}
-
-void RedirectCallsitesInJSWrapperCode(Isolate* isolate, Code* code,
-                                      CodeRelocationMap* map) {
-  DisallowHeapAllocation no_gc;
-  for (RelocIterator it(code, RelocInfo::ModeMask(RelocInfo::JS_TO_WASM_CALL));
-       !it.done(); it.next()) {
-    Address target = it.rinfo()->js_to_wasm_address();
-    auto new_target = map->find(target);
-    if (new_target == map->end()) continue;
-    it.rinfo()->set_js_to_wasm_address(new_target->second);
-  }
-}
-
-void RedirectCallsitesInInstance(Isolate* isolate, WasmInstanceObject* instance,
-                                 CodeRelocationMap* map) {
-  DisallowHeapAllocation no_gc;
-  // Redirect all calls in wasm functions.
-  for (uint32_t i = 0, e = GetNumFunctions(instance); i < e; ++i) {
-    wasm::WasmCode* code =
-        instance->compiled_module()->GetNativeModule()->GetCode(i);
-    RedirectCallsitesInCode(isolate, code, map);
-  }
-  // TODO(6668): Find instances that imported our code and also patch those.
-
-  // Redirect all calls in exported functions.
-  FixedArray* export_wrapper = instance->compiled_module()->export_wrappers();
-  for (int i = 0, e = export_wrapper->length(); i != e; ++i) {
-    Code* code = Code::cast(export_wrapper->get(i));
-    RedirectCallsitesInJSWrapperCode(isolate, code, map);
-  }
-}
-
 }  // namespace
 
 Handle<WasmDebugInfo> WasmDebugInfo::New(Handle<WasmInstanceObject> instance) {
@@ -635,10 +582,11 @@ wasm::WasmInterpreter* WasmDebugInfo::SetupForTesting(
     Handle<WasmInstanceObject> instance_obj) {
   Handle<WasmDebugInfo> debug_info = WasmDebugInfo::New(instance_obj);
   Isolate* isolate = instance_obj->GetIsolate();
-  auto interp_handle =
-      Managed<wasm::InterpreterHandle>::Allocate(isolate, isolate, *debug_info);
+  size_t interpreter_size = 0;  // TODO(titzer): estimate size properly.
+  auto interp_handle = Managed<wasm::InterpreterHandle>::Allocate(
+      isolate, interpreter_size, isolate, *debug_info);
   debug_info->set_interpreter_handle(*interp_handle);
-  auto ret = interp_handle->get()->interpreter();
+  auto ret = interp_handle->raw()->interpreter();
   ret->SetCallIndirectTestMode();
   return ret;
 }
@@ -661,9 +609,8 @@ void WasmDebugInfo::RedirectToInterpreter(Handle<WasmDebugInfo> debug_info,
       GetOrCreateInterpretedFunctions(isolate, debug_info);
   Handle<WasmInstanceObject> instance(debug_info->wasm_instance(), isolate);
   wasm::NativeModule* native_module =
-      instance->compiled_module()->GetNativeModule();
-  wasm::WasmModule* module = instance->module();
-  CodeRelocationMap code_to_relocate;
+      instance->module_object()->native_module();
+  const wasm::WasmModule* module = instance->module();
 
   // We may modify js wrappers, as well as wasm functions. Hence the 2
   // modification scopes.
@@ -676,21 +623,14 @@ void WasmDebugInfo::RedirectToInterpreter(Handle<WasmDebugInfo> debug_info,
     DCHECK_GT(module->functions.size(), func_index);
     if (!interpreted_functions->get(func_index)->IsUndefined(isolate)) continue;
 
-    Handle<Code> new_code = compiler::CompileWasmInterpreterEntry(
+    MaybeHandle<Code> new_code = compiler::CompileWasmInterpreterEntry(
         isolate, func_index, module->functions[func_index].sig);
-    const wasm::WasmCode* wasm_new_code =
-        native_module->AddInterpreterWrapper(new_code, func_index);
-    const wasm::WasmCode* old_code =
-        native_module->GetCode(static_cast<uint32_t>(func_index));
+    const wasm::WasmCode* wasm_new_code = native_module->AddInterpreterEntry(
+        new_code.ToHandleChecked(), func_index);
     Handle<Foreign> foreign_holder = isolate->factory()->NewForeign(
-        wasm_new_code->instructions().start(), TENURED);
+        wasm_new_code->instruction_start(), TENURED);
     interpreted_functions->set(func_index, *foreign_holder);
-    DCHECK_EQ(0, code_to_relocate.count(old_code->instructions().start()));
-    code_to_relocate.insert(
-        std::make_pair(old_code->instructions().start(),
-                       wasm_new_code->instructions().start()));
   }
-  RedirectCallsitesInInstance(isolate, *instance, &code_to_relocate);
 }
 
 void WasmDebugInfo::PrepareStep(StepAction step_action) {
@@ -698,9 +638,10 @@ void WasmDebugInfo::PrepareStep(StepAction step_action) {
 }
 
 bool WasmDebugInfo::RunInterpreter(Address frame_pointer, int func_index,
-                                   uint8_t* arg_buffer) {
+                                   Address arg_buffer) {
   DCHECK_LE(0, func_index);
-  Handle<WasmInstanceObject> instance(wasm_instance());
+  Handle<WasmInstanceObject> instance(wasm_instance(),
+                                      wasm_instance()->GetIsolate());
   return GetInterpreterHandle(this)->Execute(
       instance, frame_pointer, static_cast<uint32_t>(func_index), arg_buffer);
 }
@@ -756,11 +697,12 @@ Handle<JSFunction> WasmDebugInfo::GetCWasmEntry(
   if (!debug_info->has_c_wasm_entries()) {
     auto entries = isolate->factory()->NewFixedArray(4, TENURED);
     debug_info->set_c_wasm_entries(*entries);
-    auto managed_map = Managed<wasm::SignatureMap>::Allocate(isolate);
+    size_t map_size = 0;  // size estimate not so important here.
+    auto managed_map = Managed<wasm::SignatureMap>::Allocate(isolate, map_size);
     debug_info->set_c_wasm_entry_map(*managed_map);
   }
   Handle<FixedArray> entries(debug_info->c_wasm_entries(), isolate);
-  wasm::SignatureMap* map = debug_info->c_wasm_entry_map()->get();
+  wasm::SignatureMap* map = debug_info->c_wasm_entry_map()->raw();
   int32_t index = map->Find(sig);
   if (index == -1) {
     index = static_cast<int32_t>(map->FindOrInsert(sig));
@@ -770,19 +712,25 @@ Handle<JSFunction> WasmDebugInfo::GetCWasmEntry(
       debug_info->set_c_wasm_entries(*entries);
     }
     DCHECK(entries->get(index)->IsUndefined(isolate));
-    Handle<Code> new_entry_code = compiler::CompileCWasmEntry(isolate, sig);
+    Handle<Code> new_entry_code =
+        compiler::CompileCWasmEntry(isolate, sig).ToHandleChecked();
+    Handle<WasmExportedFunctionData> function_data =
+        Handle<WasmExportedFunctionData>::cast(isolate->factory()->NewStruct(
+            WASM_EXPORTED_FUNCTION_DATA_TYPE, TENURED));
+    function_data->set_wrapper_code(*new_entry_code);
+    function_data->set_instance(debug_info->wasm_instance());
+    function_data->set_function_index(-1);
     Handle<String> name = isolate->factory()->InternalizeOneByteString(
         STATIC_CHAR_VECTOR("c-wasm-entry"));
     NewFunctionArgs args = NewFunctionArgs::ForWasm(
-        name, new_entry_code, isolate->sloppy_function_map());
+        name, function_data, isolate->sloppy_function_map());
     Handle<JSFunction> new_entry = isolate->factory()->NewFunction(args);
-    new_entry->set_context(
-        debug_info->wasm_instance()->compiled_module()->native_context());
+    new_entry->set_context(debug_info->wasm_instance()->native_context());
     new_entry->shared()->set_internal_formal_parameter_count(
         compiler::CWasmEntryParameters::kNumParameters);
     entries->set(index, *new_entry);
   }
-  return handle(JSFunction::cast(entries->get(index)));
+  return handle(JSFunction::cast(entries->get(index)), isolate);
 }
 
 }  // namespace internal
diff --git a/deps/v8/src/wasm/wasm-engine.cc b/deps/v8/src/wasm/wasm-engine.cc
index ad50765a38e762..c9aff8cd1b0238 100644
--- a/deps/v8/src/wasm/wasm-engine.cc
+++ b/deps/v8/src/wasm/wasm-engine.cc
@@ -4,13 +4,23 @@
 
 #include "src/wasm/wasm-engine.h"
 
+#include "src/compilation-statistics.h"
 #include "src/objects-inl.h"
+#include "src/objects/js-promise.h"
 #include "src/wasm/module-compiler.h"
+#include "src/wasm/module-decoder.h"
+#include "src/wasm/streaming-decoder.h"
+#include "src/wasm/wasm-objects.h"
 
 namespace v8 {
 namespace internal {
 namespace wasm {
 
+WasmEngine::WasmEngine(std::unique_ptr<WasmCodeManager> code_manager)
+    : code_manager_(std::move(code_manager)) {}
+
+WasmEngine::~WasmEngine() = default;
+
 bool WasmEngine::SyncValidate(Isolate* isolate, const ModuleWireBytes& bytes) {
   // TODO(titzer): remove dependency on the isolate.
   if (bytes.start() == nullptr || bytes.length() == 0) return false;
@@ -27,7 +37,7 @@ MaybeHandle<WasmModuleObject> WasmEngine::SyncCompileTranslatedAsmJs(
                                              bytes.end(), false, kAsmJsOrigin);
   CHECK(!result.failed());
 
-  // Transfer ownership of the WasmModule to the {WasmModuleWrapper} generated
+  // Transfer ownership of the WasmModule to the {Managed<WasmModule>} generated
   // in {CompileToModuleObject}.
   return CompileToModuleObject(isolate, thrower, std::move(result.val), bytes,
                                asm_js_script, asm_js_offset_table_bytes);
@@ -42,7 +52,7 @@ MaybeHandle<WasmModuleObject> WasmEngine::SyncCompile(
     return {};
   }
 
-  // Transfer ownership of the WasmModule to the {WasmModuleWrapper} generated
+  // Transfer ownership of the WasmModule to the {Managed<WasmModule>} generated
   // in {CompileToModuleObject}.
   return CompileToModuleObject(isolate, thrower, std::move(result.val), bytes,
                                Handle<Script>(), Vector<const byte>());
@@ -56,24 +66,45 @@ MaybeHandle<WasmInstanceObject> WasmEngine::SyncInstantiate(
                                      memory);
 }
 
-void WasmEngine::AsyncInstantiate(Isolate* isolate, Handle<JSPromise> promise,
-                                  Handle<WasmModuleObject> module_object,
-                                  MaybeHandle<JSReceiver> imports) {
+void WasmEngine::AsyncInstantiate(
+    Isolate* isolate, std::unique_ptr<InstantiationResultResolver> resolver,
+    Handle<WasmModuleObject> module_object, MaybeHandle<JSReceiver> imports) {
   ErrorThrower thrower(isolate, nullptr);
+  // Instantiate a TryCatch so that caught exceptions won't progagate out.
+  // They will still be set as pending exceptions on the isolate.
+  // TODO(clemensh): Avoid TryCatch, use Execution::TryCall internally to invoke
+  // start function and report thrown exception explicitly via out argument.
+  v8::TryCatch catcher(reinterpret_cast<v8::Isolate*>(isolate));
+  catcher.SetVerbose(false);
+  catcher.SetCaptureMessage(false);
+
   MaybeHandle<WasmInstanceObject> instance_object = SyncInstantiate(
       isolate, &thrower, module_object, imports, Handle<JSArrayBuffer>::null());
-  if (thrower.error()) {
-    MaybeHandle<Object> result = JSPromise::Reject(promise, thrower.Reify());
-    CHECK_EQ(result.is_null(), isolate->has_pending_exception());
+
+  if (!instance_object.is_null()) {
+    resolver->OnInstantiationSucceeded(instance_object.ToHandleChecked());
     return;
   }
-  Handle<WasmInstanceObject> instance = instance_object.ToHandleChecked();
-  MaybeHandle<Object> result = JSPromise::Resolve(promise, instance);
-  CHECK_EQ(result.is_null(), isolate->has_pending_exception());
+
+  // We either have a pending exception (if the start function threw), or an
+  // exception in the ErrorThrower.
+  DCHECK_EQ(1, isolate->has_pending_exception() + thrower.error());
+  if (thrower.error()) {
+    resolver->OnInstantiationFailed(thrower.Reify());
+  } else {
+    // The start function has thrown an exception. We have to move the
+    // exception to the promise chain.
+    Handle<Object> exception(isolate->pending_exception(), isolate);
+    isolate->clear_pending_exception();
+    DCHECK(*isolate->external_caught_exception_address());
+    *isolate->external_caught_exception_address() = false;
+    resolver->OnInstantiationFailed(exception);
+  }
 }
 
-void WasmEngine::AsyncCompile(Isolate* isolate, Handle<JSPromise> promise,
-                              const ModuleWireBytes& bytes, bool is_shared) {
+void WasmEngine::AsyncCompile(
+    Isolate* isolate, std::unique_ptr<CompilationResultResolver> resolver,
+    const ModuleWireBytes& bytes, bool is_shared) {
   if (!FLAG_wasm_async_compilation) {
     // Asynchronous compilation disabled; fall back on synchronous compilation.
     ErrorThrower thrower(isolate, "WasmCompile");
@@ -90,22 +121,18 @@ void WasmEngine::AsyncCompile(Isolate* isolate, Handle<JSPromise> promise,
       module_object = SyncCompile(isolate, &thrower, bytes);
     }
     if (thrower.error()) {
-      MaybeHandle<Object> result = JSPromise::Reject(promise, thrower.Reify());
-      CHECK_EQ(result.is_null(), isolate->has_pending_exception());
+      resolver->OnCompilationFailed(thrower.Reify());
       return;
     }
     Handle<WasmModuleObject> module = module_object.ToHandleChecked();
-    MaybeHandle<Object> result = JSPromise::Resolve(promise, module);
-    CHECK_EQ(result.is_null(), isolate->has_pending_exception());
+    resolver->OnCompilationSucceeded(module);
     return;
   }
 
   if (FLAG_wasm_test_streaming) {
     std::shared_ptr<StreamingDecoder> streaming_decoder =
-        isolate->wasm_engine()
-            ->compilation_manager()
-            ->StartStreamingCompilation(isolate, handle(isolate->context()),
-                                        promise);
+        isolate->wasm_engine()->StartStreamingCompilation(
+            isolate, handle(isolate->context(), isolate), std::move(resolver));
     streaming_decoder->OnBytesReceived(bytes.module_bytes());
     streaming_decoder->Finish();
     return;
@@ -114,9 +141,35 @@ void WasmEngine::AsyncCompile(Isolate* isolate, Handle<JSPromise> promise,
   // during asynchronous compilation.
   std::unique_ptr<byte[]> copy(new byte[bytes.length()]);
   memcpy(copy.get(), bytes.start(), bytes.length());
-  isolate->wasm_engine()->compilation_manager()->StartAsyncCompileJob(
-      isolate, std::move(copy), bytes.length(), handle(isolate->context()),
-      promise);
+
+  AsyncCompileJob* job = CreateAsyncCompileJob(
+      isolate, std::move(copy), bytes.length(),
+      handle(isolate->context(), isolate), std::move(resolver));
+  job->Start();
+}
+
+std::shared_ptr<StreamingDecoder> WasmEngine::StartStreamingCompilation(
+    Isolate* isolate, Handle<Context> context,
+    std::unique_ptr<CompilationResultResolver> resolver) {
+  AsyncCompileJob* job =
+      CreateAsyncCompileJob(isolate, std::unique_ptr<byte[]>(nullptr), 0,
+                            context, std::move(resolver));
+  return job->CreateStreamingDecoder();
+}
+
+CompilationStatistics* WasmEngine::GetOrCreateTurboStatistics() {
+  if (compilation_stats_ == nullptr) {
+    compilation_stats_.reset(new CompilationStatistics());
+  }
+  return compilation_stats_.get();
+}
+
+void WasmEngine::DumpAndResetTurboStatistics() {
+  if (compilation_stats_ != nullptr) {
+    StdoutStream os;
+    os << AsPrintableStatistics{*compilation_stats_.get(), false} << std::endl;
+  }
+  compilation_stats_.reset();
 }
 
 void WasmEngine::Register(CancelableTaskManager* task_manager) {
@@ -127,6 +180,38 @@ void WasmEngine::Unregister(CancelableTaskManager* task_manager) {
   task_managers_.remove(task_manager);
 }
 
+AsyncCompileJob* WasmEngine::CreateAsyncCompileJob(
+    Isolate* isolate, std::unique_ptr<byte[]> bytes_copy, size_t length,
+    Handle<Context> context,
+    std::unique_ptr<CompilationResultResolver> resolver) {
+  AsyncCompileJob* job = new AsyncCompileJob(
+      isolate, std::move(bytes_copy), length, context, std::move(resolver));
+  // Pass ownership to the unique_ptr in {jobs_}.
+  jobs_[job] = std::unique_ptr<AsyncCompileJob>(job);
+  return job;
+}
+
+std::unique_ptr<AsyncCompileJob> WasmEngine::RemoveCompileJob(
+    AsyncCompileJob* job) {
+  auto item = jobs_.find(job);
+  DCHECK(item != jobs_.end());
+  std::unique_ptr<AsyncCompileJob> result = std::move(item->second);
+  jobs_.erase(item);
+  return result;
+}
+
+void WasmEngine::AbortCompileJobsOnIsolate(Isolate* isolate) {
+  // Iterate over a copy of {jobs_}, because {job->Abort} modifies {jobs_}.
+  std::vector<AsyncCompileJob*> isolate_jobs;
+
+  for (auto& entry : jobs_) {
+    if (entry.first->isolate() != isolate) continue;
+    isolate_jobs.push_back(entry.first);
+  }
+
+  for (auto* job : isolate_jobs) job->Abort();
+}
+
 void WasmEngine::TearDown() {
   // Cancel all registered task managers.
   for (auto task_manager : task_managers_) {
@@ -134,7 +219,7 @@ void WasmEngine::TearDown() {
   }
 
   // Cancel all AsyncCompileJobs.
-  compilation_manager_.TearDown();
+  jobs_.clear();
 }
 
 }  // namespace wasm
diff --git a/deps/v8/src/wasm/wasm-engine.h b/deps/v8/src/wasm/wasm-engine.h
index b1a5a0a9b95b12..41243bdef43689 100644
--- a/deps/v8/src/wasm/wasm-engine.h
+++ b/deps/v8/src/wasm/wasm-engine.h
@@ -7,13 +7,14 @@
 
 #include <memory>
 
-#include "src/wasm/compilation-manager.h"
 #include "src/wasm/wasm-code-manager.h"
 #include "src/wasm/wasm-memory.h"
+#include "src/zone/accounting-allocator.h"
 
 namespace v8 {
 namespace internal {
 
+class CompilationStatistics;
 class WasmModuleObject;
 class WasmInstanceObject;
 
@@ -22,12 +23,26 @@ namespace wasm {
 class ErrorThrower;
 struct ModuleWireBytes;
 
+class V8_EXPORT_PRIVATE CompilationResultResolver {
+ public:
+  virtual void OnCompilationSucceeded(Handle<WasmModuleObject> result) = 0;
+  virtual void OnCompilationFailed(Handle<Object> error_reason) = 0;
+  virtual ~CompilationResultResolver() {}
+};
+
+class V8_EXPORT_PRIVATE InstantiationResultResolver {
+ public:
+  virtual void OnInstantiationSucceeded(Handle<WasmInstanceObject> result) = 0;
+  virtual void OnInstantiationFailed(Handle<Object> error_reason) = 0;
+  virtual ~InstantiationResultResolver() {}
+};
+
 // The central data structure that represents an engine instance capable of
 // loading, instantiating, and executing WASM code.
 class V8_EXPORT_PRIVATE WasmEngine {
  public:
-  explicit WasmEngine(std::unique_ptr<WasmCodeManager> code_manager)
-      : code_manager_(std::move(code_manager)) {}
+  explicit WasmEngine(std::unique_ptr<WasmCodeManager> code_manager);
+  ~WasmEngine();
 
   // Synchronously validates the given bytes that represent an encoded WASM
   // module.
@@ -55,36 +70,66 @@ class V8_EXPORT_PRIVATE WasmEngine {
       MaybeHandle<JSArrayBuffer> memory);
 
   // Begin an asynchronous compilation of the given bytes that represent an
-  // encoded WASM module, placing the result in the supplied {promise}.
+  // encoded WASM module.
   // The {is_shared} flag indicates if the bytes backing the module could
   // be shared across threads, i.e. could be concurrently modified.
-  void AsyncCompile(Isolate* isolate, Handle<JSPromise> promise,
+  void AsyncCompile(Isolate* isolate,
+                    std::unique_ptr<CompilationResultResolver> resolver,
                     const ModuleWireBytes& bytes, bool is_shared);
 
-  // Begin an asynchronous instantiation of the given WASM module, placing the
-  // result in the supplied {promise}.
-  void AsyncInstantiate(Isolate* isolate, Handle<JSPromise> promise,
+  // Begin an asynchronous instantiation of the given WASM module.
+  void AsyncInstantiate(Isolate* isolate,
+                        std::unique_ptr<InstantiationResultResolver> resolver,
                         Handle<WasmModuleObject> module_object,
                         MaybeHandle<JSReceiver> imports);
 
-  CompilationManager* compilation_manager() { return &compilation_manager_; }
+  std::shared_ptr<StreamingDecoder> StartStreamingCompilation(
+      Isolate* isolate, Handle<Context> context,
+      std::unique_ptr<CompilationResultResolver> resolver);
 
   WasmCodeManager* code_manager() const { return code_manager_.get(); }
 
   WasmMemoryTracker* memory_tracker() { return &memory_tracker_; }
 
-  // We register and unregister CancelableTaskManagers that run
-  // isolate-dependent tasks. These tasks need to be shutdown if the isolate is
-  // shut down.
+  AccountingAllocator* allocator() { return &allocator_; }
+
+  // Compilation statistics for TurboFan compilations.
+  CompilationStatistics* GetOrCreateTurboStatistics();
+
+  // Prints the gathered compilation statistics, then resets them.
+  void DumpAndResetTurboStatistics();
+
+  // We register and unregister CancelableTaskManagers that run engine-dependent
+  // tasks. These tasks need to be shutdown if the engine is shut down.
   void Register(CancelableTaskManager* task_manager);
   void Unregister(CancelableTaskManager* task_manager);
 
+  // Remove {job} from the list of active compile jobs.
+  std::unique_ptr<AsyncCompileJob> RemoveCompileJob(AsyncCompileJob* job);
+
+  // Returns true if at lease one AsyncCompileJob is currently running.
+  bool HasRunningCompileJob() const { return !jobs_.empty(); }
+
+  // Cancel all AsyncCompileJobs that belong to the given Isolate. Their
+  // deletion is delayed until all tasks accessing the AsyncCompileJob finish
+  // their execution. This is used to clean-up the isolate to be reused.
+  void AbortCompileJobsOnIsolate(Isolate*);
+
   void TearDown();
 
  private:
-  CompilationManager compilation_manager_;
+  AsyncCompileJob* CreateAsyncCompileJob(
+      Isolate* isolate, std::unique_ptr<byte[]> bytes_copy, size_t length,
+      Handle<Context> context,
+      std::unique_ptr<CompilationResultResolver> resolver);
+
+  // We use an AsyncCompileJob as the key for itself so that we can delete the
+  // job from the map when it is finished.
+  std::unordered_map<AsyncCompileJob*, std::unique_ptr<AsyncCompileJob>> jobs_;
   std::unique_ptr<WasmCodeManager> code_manager_;
+  std::unique_ptr<CompilationStatistics> compilation_stats_;
   WasmMemoryTracker memory_tracker_;
+  AccountingAllocator allocator_;
 
   // Contains all CancelableTaskManagers that run tasks that are dependent
   // on the isolate.
diff --git a/deps/v8/src/wasm/wasm-external-refs.cc b/deps/v8/src/wasm/wasm-external-refs.cc
index 0a9d1401e3d88b..0f63c35bec4ff1 100644
--- a/deps/v8/src/wasm/wasm-external-refs.cc
+++ b/deps/v8/src/wasm/wasm-external-refs.cc
@@ -18,35 +18,48 @@ namespace v8 {
 namespace internal {
 namespace wasm {
 
-void f32_trunc_wrapper(float* param) { *param = truncf(*param); }
+void f32_trunc_wrapper(Address data) {
+  WriteUnalignedValue<float>(data, truncf(ReadUnalignedValue<float>(data)));
+}
 
-void f32_floor_wrapper(float* param) { *param = floorf(*param); }
+void f32_floor_wrapper(Address data) {
+  WriteUnalignedValue<float>(data, floorf(ReadUnalignedValue<float>(data)));
+}
 
-void f32_ceil_wrapper(float* param) { *param = ceilf(*param); }
+void f32_ceil_wrapper(Address data) {
+  WriteUnalignedValue<float>(data, ceilf(ReadUnalignedValue<float>(data)));
+}
 
-void f32_nearest_int_wrapper(float* param) { *param = nearbyintf(*param); }
+void f32_nearest_int_wrapper(Address data) {
+  WriteUnalignedValue<float>(data, nearbyintf(ReadUnalignedValue<float>(data)));
+}
 
-void f64_trunc_wrapper(double* param) {
-  WriteDoubleValue(param, trunc(ReadDoubleValue(param)));
+void f64_trunc_wrapper(Address data) {
+  WriteUnalignedValue<double>(data, trunc(ReadUnalignedValue<double>(data)));
 }
 
-void f64_floor_wrapper(double* param) {
-  WriteDoubleValue(param, floor(ReadDoubleValue(param)));
+void f64_floor_wrapper(Address data) {
+  WriteUnalignedValue<double>(data, floor(ReadUnalignedValue<double>(data)));
 }
 
-void f64_ceil_wrapper(double* param) {
-  WriteDoubleValue(param, ceil(ReadDoubleValue(param)));
+void f64_ceil_wrapper(Address data) {
+  WriteUnalignedValue<double>(data, ceil(ReadUnalignedValue<double>(data)));
 }
 
-void f64_nearest_int_wrapper(double* param) {
-  WriteDoubleValue(param, nearbyint(ReadDoubleValue(param)));
+void f64_nearest_int_wrapper(Address data) {
+  WriteUnalignedValue<double>(data,
+                              nearbyint(ReadUnalignedValue<double>(data)));
 }
 
-void int64_to_float32_wrapper(int64_t* input, float* output) {
-  *output = static_cast<float>(ReadUnalignedValue<int64_t>(input));
+void int64_to_float32_wrapper(Address data) {
+  int64_t input = ReadUnalignedValue<int64_t>(data);
+  WriteUnalignedValue<float>(data, static_cast<float>(input));
 }
 
-void uint64_to_float32_wrapper(uint64_t* input, float* output) {
+void uint64_to_float32_wrapper(Address data) {
+  uint64_t input = ReadUnalignedValue<uint64_t>(data);
+  float result = static_cast<float>(input);
+
 #if V8_CC_MSVC
   // With MSVC we use static_cast<float>(uint32_t) instead of
   // static_cast<float>(uint64_t) to achieve round-to-nearest-ties-even
@@ -55,8 +68,8 @@ void uint64_to_float32_wrapper(uint64_t* input, float* output) {
   // achieve proper rounding in all cases we have to adjust the high_word
   // with a "rounding bit" sometimes. The rounding bit is stored in the LSB of
   // the high_word if the low_word may affect the rounding of the high_word.
-  uint32_t low_word = static_cast<uint32_t>(*input & 0xFFFFFFFF);
-  uint32_t high_word = static_cast<uint32_t>(*input >> 32);
+  uint32_t low_word = static_cast<uint32_t>(input & 0xFFFFFFFF);
+  uint32_t high_word = static_cast<uint32_t>(input >> 32);
 
   float shift = static_cast<float>(1ull << 32);
   // If the MSB of the high_word is set, then we make space for a rounding bit.
@@ -70,166 +83,168 @@ void uint64_to_float32_wrapper(uint64_t* input, float* output) {
     high_word |= 1;
   }
 
-  float result = static_cast<float>(high_word);
+  result = static_cast<float>(high_word);
   result *= shift;
   result += static_cast<float>(low_word);
-  *output = result;
-
-#else
-  *output = static_cast<float>(ReadUnalignedValue<uint64_t>(input));
 #endif
+
+  WriteUnalignedValue<float>(data, result);
 }
 
-void int64_to_float64_wrapper(int64_t* input, double* output) {
-  WriteDoubleValue(output,
-                   static_cast<double>(ReadUnalignedValue<int64_t>(input)));
+void int64_to_float64_wrapper(Address data) {
+  int64_t input = ReadUnalignedValue<int64_t>(data);
+  WriteUnalignedValue<double>(data, static_cast<double>(input));
 }
 
-void uint64_to_float64_wrapper(uint64_t* input, double* output) {
+void uint64_to_float64_wrapper(Address data) {
+  uint64_t input = ReadUnalignedValue<uint64_t>(data);
+  double result = static_cast<double>(input);
+
 #if V8_CC_MSVC
   // With MSVC we use static_cast<double>(uint32_t) instead of
   // static_cast<double>(uint64_t) to achieve round-to-nearest-ties-even
   // semantics. The idea is to calculate
   // static_cast<double>(high_word) * 2^32 + static_cast<double>(low_word).
-  uint32_t low_word = static_cast<uint32_t>(*input & 0xFFFFFFFF);
-  uint32_t high_word = static_cast<uint32_t>(*input >> 32);
+  uint32_t low_word = static_cast<uint32_t>(input & 0xFFFFFFFF);
+  uint32_t high_word = static_cast<uint32_t>(input >> 32);
 
   double shift = static_cast<double>(1ull << 32);
 
-  double result = static_cast<double>(high_word);
+  result = static_cast<double>(high_word);
   result *= shift;
   result += static_cast<double>(low_word);
-  *output = result;
-
-#else
-  WriteDoubleValue(output,
-                   static_cast<double>(ReadUnalignedValue<uint64_t>(input)));
 #endif
+
+  WriteUnalignedValue<double>(data, result);
 }
 
-int32_t float32_to_int64_wrapper(float* input, int64_t* output) {
+int32_t float32_to_int64_wrapper(Address data) {
   // We use "<" here to check the upper bound because of rounding problems: With
   // "<=" some inputs would be considered within int64 range which are actually
   // not within int64 range.
-  if (*input >= static_cast<float>(std::numeric_limits<int64_t>::min()) &&
-      *input < static_cast<float>(std::numeric_limits<int64_t>::max())) {
-    WriteUnalignedValue<int64_t>(output, static_cast<int64_t>(*input));
+  float input = ReadUnalignedValue<float>(data);
+  if (input >= static_cast<float>(std::numeric_limits<int64_t>::min()) &&
+      input < static_cast<float>(std::numeric_limits<int64_t>::max())) {
+    WriteUnalignedValue<int64_t>(data, static_cast<int64_t>(input));
     return 1;
   }
   return 0;
 }
 
-int32_t float32_to_uint64_wrapper(float* input, uint64_t* output) {
+int32_t float32_to_uint64_wrapper(Address data) {
+  float input = ReadUnalignedValue<float>(data);
   // We use "<" here to check the upper bound because of rounding problems: With
   // "<=" some inputs would be considered within uint64 range which are actually
   // not within uint64 range.
-  if (*input > -1.0 &&
-      *input < static_cast<float>(std::numeric_limits<uint64_t>::max())) {
-    WriteUnalignedValue<uint64_t>(output, static_cast<uint64_t>(*input));
+  if (input > -1.0 &&
+      input < static_cast<float>(std::numeric_limits<uint64_t>::max())) {
+    WriteUnalignedValue<uint64_t>(data, static_cast<uint64_t>(input));
     return 1;
   }
   return 0;
 }
 
-int32_t float64_to_int64_wrapper(double* input, int64_t* output) {
+int32_t float64_to_int64_wrapper(Address data) {
   // We use "<" here to check the upper bound because of rounding problems: With
   // "<=" some inputs would be considered within int64 range which are actually
   // not within int64 range.
-  double input_val = ReadDoubleValue(input);
-  if (input_val >= static_cast<double>(std::numeric_limits<int64_t>::min()) &&
-      input_val < static_cast<double>(std::numeric_limits<int64_t>::max())) {
-    WriteUnalignedValue<int64_t>(output, static_cast<int64_t>(input_val));
+  double input = ReadUnalignedValue<double>(data);
+  if (input >= static_cast<double>(std::numeric_limits<int64_t>::min()) &&
+      input < static_cast<double>(std::numeric_limits<int64_t>::max())) {
+    WriteUnalignedValue<int64_t>(data, static_cast<int64_t>(input));
     return 1;
   }
   return 0;
 }
 
-int32_t float64_to_uint64_wrapper(double* input, uint64_t* output) {
+int32_t float64_to_uint64_wrapper(Address data) {
   // We use "<" here to check the upper bound because of rounding problems: With
   // "<=" some inputs would be considered within uint64 range which are actually
   // not within uint64 range.
-  double input_val = ReadDoubleValue(input);
-  if (input_val > -1.0 &&
-      input_val < static_cast<double>(std::numeric_limits<uint64_t>::max())) {
-    WriteUnalignedValue<uint64_t>(output, static_cast<uint64_t>(input_val));
+  double input = ReadUnalignedValue<double>(data);
+  if (input > -1.0 &&
+      input < static_cast<double>(std::numeric_limits<uint64_t>::max())) {
+    WriteUnalignedValue<uint64_t>(data, static_cast<uint64_t>(input));
     return 1;
   }
   return 0;
 }
 
-int32_t int64_div_wrapper(int64_t* dst, int64_t* src) {
-  int64_t src_val = ReadUnalignedValue<int64_t>(src);
-  int64_t dst_val = ReadUnalignedValue<int64_t>(dst);
-  if (src_val == 0) {
+int32_t int64_div_wrapper(Address data) {
+  int64_t dividend = ReadUnalignedValue<int64_t>(data);
+  int64_t divisor = ReadUnalignedValue<int64_t>(data + sizeof(dividend));
+  if (divisor == 0) {
     return 0;
   }
-  if (src_val == -1 && dst_val == std::numeric_limits<int64_t>::min()) {
+  if (divisor == -1 && dividend == std::numeric_limits<int64_t>::min()) {
     return -1;
   }
-  WriteUnalignedValue<int64_t>(dst, dst_val / src_val);
+  WriteUnalignedValue<int64_t>(data, dividend / divisor);
   return 1;
 }
 
-int32_t int64_mod_wrapper(int64_t* dst, int64_t* src) {
-  int64_t src_val = ReadUnalignedValue<int64_t>(src);
-  int64_t dst_val = ReadUnalignedValue<int64_t>(dst);
-  if (src_val == 0) {
+int32_t int64_mod_wrapper(Address data) {
+  int64_t dividend = ReadUnalignedValue<int64_t>(data);
+  int64_t divisor = ReadUnalignedValue<int64_t>(data + sizeof(dividend));
+  if (divisor == 0) {
     return 0;
   }
-  WriteUnalignedValue<int64_t>(dst, dst_val % src_val);
+  WriteUnalignedValue<int64_t>(data, dividend % divisor);
   return 1;
 }
 
-int32_t uint64_div_wrapper(uint64_t* dst, uint64_t* src) {
-  uint64_t src_val = ReadUnalignedValue<uint64_t>(src);
-  uint64_t dst_val = ReadUnalignedValue<uint64_t>(dst);
-  if (src_val == 0) {
+int32_t uint64_div_wrapper(Address data) {
+  uint64_t dividend = ReadUnalignedValue<uint64_t>(data);
+  uint64_t divisor = ReadUnalignedValue<uint64_t>(data + sizeof(dividend));
+  if (divisor == 0) {
     return 0;
   }
-  WriteUnalignedValue<uint64_t>(dst, dst_val / src_val);
+  WriteUnalignedValue<uint64_t>(data, dividend / divisor);
   return 1;
 }
 
-int32_t uint64_mod_wrapper(uint64_t* dst, uint64_t* src) {
-  uint64_t src_val = ReadUnalignedValue<uint64_t>(src);
-  uint64_t dst_val = ReadUnalignedValue<uint64_t>(dst);
-  if (src_val == 0) {
+int32_t uint64_mod_wrapper(Address data) {
+  uint64_t dividend = ReadUnalignedValue<uint64_t>(data);
+  uint64_t divisor = ReadUnalignedValue<uint64_t>(data + sizeof(dividend));
+  if (divisor == 0) {
     return 0;
   }
-  WriteUnalignedValue<uint64_t>(dst, dst_val % src_val);
+  WriteUnalignedValue<uint64_t>(data, dividend % divisor);
   return 1;
 }
 
-uint32_t word32_ctz_wrapper(uint32_t* input) {
-  return base::bits::CountTrailingZeros(*input);
+uint32_t word32_ctz_wrapper(Address data) {
+  return base::bits::CountTrailingZeros(ReadUnalignedValue<uint32_t>(data));
 }
 
-uint32_t word64_ctz_wrapper(uint64_t* input) {
-  return base::bits::CountTrailingZeros(ReadUnalignedValue<uint64_t>(input));
+uint32_t word64_ctz_wrapper(Address data) {
+  return base::bits::CountTrailingZeros(ReadUnalignedValue<uint64_t>(data));
 }
 
-uint32_t word32_popcnt_wrapper(uint32_t* input) {
-  return base::bits::CountPopulation(*input);
+uint32_t word32_popcnt_wrapper(Address data) {
+  return base::bits::CountPopulation(ReadUnalignedValue<uint32_t>(data));
 }
 
-uint32_t word64_popcnt_wrapper(uint64_t* input) {
-  return base::bits::CountPopulation(ReadUnalignedValue<uint64_t>(input));
+uint32_t word64_popcnt_wrapper(Address data) {
+  return base::bits::CountPopulation(ReadUnalignedValue<uint64_t>(data));
 }
 
-uint32_t word32_rol_wrapper(uint32_t* input_p, uint32_t* shift_p) {
-  uint32_t shift = (*shift_p & 31);
-  return (*input_p << shift) | (*input_p >> (32 - shift));
+uint32_t word32_rol_wrapper(Address data) {
+  uint32_t input = ReadUnalignedValue<uint32_t>(data);
+  uint32_t shift = ReadUnalignedValue<uint32_t>(data + sizeof(input)) & 31;
+  return (input << shift) | (input >> (32 - shift));
 }
 
-uint32_t word32_ror_wrapper(uint32_t* input_p, uint32_t* shift_p) {
-  uint32_t shift = (*shift_p & 31);
-  return (*input_p >> shift) | (*input_p << (32 - shift));
+uint32_t word32_ror_wrapper(Address data) {
+  uint32_t input = ReadUnalignedValue<uint32_t>(data);
+  uint32_t shift = ReadUnalignedValue<uint32_t>(data + sizeof(input)) & 31;
+  return (input >> shift) | (input << (32 - shift));
 }
 
-void float64_pow_wrapper(double* param0, double* param1) {
-  double x = ReadDoubleValue(param0);
-  double y = ReadDoubleValue(param1);
-  WriteDoubleValue(param0, Pow(x, y));
+void float64_pow_wrapper(Address data) {
+  double x = ReadUnalignedValue<double>(data);
+  double y = ReadUnalignedValue<double>(data + sizeof(x));
+  WriteUnalignedValue<double>(data, Pow(x, y));
 }
 
 void set_thread_in_wasm_flag() { trap_handler::SetThreadInWasm(); }
diff --git a/deps/v8/src/wasm/wasm-external-refs.h b/deps/v8/src/wasm/wasm-external-refs.h
index d44f5b242f41c5..438235179bacdd 100644
--- a/deps/v8/src/wasm/wasm-external-refs.h
+++ b/deps/v8/src/wasm/wasm-external-refs.h
@@ -2,68 +2,70 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#include <stdint.h>
-
 #ifndef V8_WASM_WASM_EXTERNAL_REFS_H_
 #define V8_WASM_WASM_EXTERNAL_REFS_H_
 
+#include <stdint.h>
+
+#include "src/globals.h"
+
 namespace v8 {
 namespace internal {
 namespace wasm {
 
-void f32_trunc_wrapper(float* param);
+void f32_trunc_wrapper(Address data);
 
-void f32_floor_wrapper(float* param);
+void f32_floor_wrapper(Address data);
 
-void f32_ceil_wrapper(float* param);
+void f32_ceil_wrapper(Address data);
 
-void f32_nearest_int_wrapper(float* param);
+void f32_nearest_int_wrapper(Address data);
 
-void f64_trunc_wrapper(double* param);
+void f64_trunc_wrapper(Address data);
 
-void f64_floor_wrapper(double* param);
+void f64_floor_wrapper(Address data);
 
-void f64_ceil_wrapper(double* param);
+void f64_ceil_wrapper(Address data);
 
-void f64_nearest_int_wrapper(double* param);
+void f64_nearest_int_wrapper(Address data);
 
-void int64_to_float32_wrapper(int64_t* input, float* output);
+void int64_to_float32_wrapper(Address data);
 
-void uint64_to_float32_wrapper(uint64_t* input, float* output);
+void uint64_to_float32_wrapper(Address data);
 
-void int64_to_float64_wrapper(int64_t* input, double* output);
+void int64_to_float64_wrapper(Address data);
 
-void uint64_to_float64_wrapper(uint64_t* input, double* output);
+void uint64_to_float64_wrapper(Address data);
 
-int32_t float32_to_int64_wrapper(float* input, int64_t* output);
+int32_t float32_to_int64_wrapper(Address data);
 
-int32_t float32_to_uint64_wrapper(float* input, uint64_t* output);
+int32_t float32_to_uint64_wrapper(Address data);
 
-int32_t float64_to_int64_wrapper(double* input, int64_t* output);
+int32_t float64_to_int64_wrapper(Address data);
 
-int32_t float64_to_uint64_wrapper(double* input, uint64_t* output);
+int32_t float64_to_uint64_wrapper(Address data);
 
-int32_t int64_div_wrapper(int64_t* dst, int64_t* src);
+int32_t int64_div_wrapper(Address data);
 
-int32_t int64_mod_wrapper(int64_t* dst, int64_t* src);
+int32_t int64_mod_wrapper(Address data);
 
-int32_t uint64_div_wrapper(uint64_t* dst, uint64_t* src);
+int32_t uint64_div_wrapper(Address data);
 
-int32_t uint64_mod_wrapper(uint64_t* dst, uint64_t* src);
+int32_t uint64_mod_wrapper(Address data);
 
-uint32_t word32_ctz_wrapper(uint32_t* input);
+uint32_t word32_ctz_wrapper(Address data);
 
-uint32_t word64_ctz_wrapper(uint64_t* input);
+uint32_t word64_ctz_wrapper(Address data);
 
-uint32_t word32_popcnt_wrapper(uint32_t* input);
+uint32_t word32_popcnt_wrapper(Address data);
 
-uint32_t word64_popcnt_wrapper(uint64_t* input);
+uint32_t word64_popcnt_wrapper(Address data);
 
-uint32_t word32_rol_wrapper(uint32_t* input_p, uint32_t* shift_p);
+uint32_t word32_rol_wrapper(Address data);
 
-uint32_t word32_ror_wrapper(uint32_t* input_p, uint32_t* shift_p);
+uint32_t word32_ror_wrapper(Address data);
 
-void float64_pow_wrapper(double* param0, double* param1);
+void float64_pow_wrapper(Address data);
 
 void set_thread_in_wasm_flag();
 void clear_thread_in_wasm_flag();
diff --git a/deps/v8/src/wasm/wasm-interpreter.cc b/deps/v8/src/wasm/wasm-interpreter.cc
index b158e2c44ff52e..022159e1577cf1 100644
--- a/deps/v8/src/wasm/wasm-interpreter.cc
+++ b/deps/v8/src/wasm/wasm-interpreter.cc
@@ -40,7 +40,7 @@ namespace wasm {
 #define FOREACH_INTERNAL_OPCODE(V) V(Breakpoint, 0xFF)
 
 #define WASM_CTYPES(V) \
-  V(I32, int32_t) V(I64, int64_t) V(F32, float) V(F64, double)
+  V(I32, int32_t) V(I64, int64_t) V(F32, float) V(F64, double) V(S128, Simd128)
 
 #define FOREACH_SIMPLE_BINOP(V) \
   V(I32Add, uint32_t, +)        \
@@ -377,7 +377,7 @@ uint32_t ExecuteI32Ctz(uint32_t val, TrapReason* trap) {
 }
 
 uint32_t ExecuteI32Popcnt(uint32_t val, TrapReason* trap) {
-  return word32_popcnt_wrapper(&val);
+  return base::bits::CountPopulation(val);
 }
 
 inline uint32_t ExecuteI32Eqz(uint32_t val, TrapReason* trap) {
@@ -393,7 +393,7 @@ inline uint64_t ExecuteI64Ctz(uint64_t val, TrapReason* trap) {
 }
 
 inline int64_t ExecuteI64Popcnt(uint64_t val, TrapReason* trap) {
-  return word64_popcnt_wrapper(&val);
+  return base::bits::CountPopulation(val);
 }
 
 inline int32_t ExecuteI64Eqz(uint64_t val, TrapReason* trap) {
@@ -465,16 +465,32 @@ int_type ExecuteConvertSaturate(float_type a) {
                               : std::numeric_limits<int_type>::max());
 }
 
+template <typename dst_type, typename src_type, void (*fn)(Address)>
+inline dst_type CallExternalIntToFloatFunction(src_type input) {
+  uint8_t data[std::max(sizeof(dst_type), sizeof(src_type))];
+  Address data_addr = reinterpret_cast<Address>(data);
+  WriteUnalignedValue<src_type>(data_addr, input);
+  fn(data_addr);
+  return ReadUnalignedValue<dst_type>(data_addr);
+}
+
+template <typename dst_type, typename src_type, int32_t (*fn)(Address)>
+inline dst_type CallExternalFloatToIntFunction(src_type input,
+                                               TrapReason* trap) {
+  uint8_t data[std::max(sizeof(dst_type), sizeof(src_type))];
+  Address data_addr = reinterpret_cast<Address>(data);
+  WriteUnalignedValue<src_type>(data_addr, input);
+  if (!fn(data_addr)) *trap = kTrapFloatUnrepresentable;
+  return ReadUnalignedValue<dst_type>(data_addr);
+}
+
 inline uint32_t ExecuteI32ConvertI64(int64_t a, TrapReason* trap) {
   return static_cast<uint32_t>(a & 0xFFFFFFFF);
 }
 
 int64_t ExecuteI64SConvertF32(float a, TrapReason* trap) {
-  int64_t output;
-  if (!float32_to_int64_wrapper(&a, &output)) {
-    *trap = kTrapFloatUnrepresentable;
-  }
-  return output;
+  return CallExternalFloatToIntFunction<int64_t, float,
+                                        float32_to_int64_wrapper>(a, trap);
 }
 
 int64_t ExecuteI64SConvertSatF32(float a) {
@@ -489,11 +505,8 @@ int64_t ExecuteI64SConvertSatF32(float a) {
 }
 
 int64_t ExecuteI64SConvertF64(double a, TrapReason* trap) {
-  int64_t output;
-  if (!float64_to_int64_wrapper(&a, &output)) {
-    *trap = kTrapFloatUnrepresentable;
-  }
-  return output;
+  return CallExternalFloatToIntFunction<int64_t, double,
+                                        float64_to_int64_wrapper>(a, trap);
 }
 
 int64_t ExecuteI64SConvertSatF64(double a) {
@@ -508,11 +521,8 @@ int64_t ExecuteI64SConvertSatF64(double a) {
 }
 
 uint64_t ExecuteI64UConvertF32(float a, TrapReason* trap) {
-  uint64_t output;
-  if (!float32_to_uint64_wrapper(&a, &output)) {
-    *trap = kTrapFloatUnrepresentable;
-  }
-  return output;
+  return CallExternalFloatToIntFunction<uint64_t, float,
+                                        float32_to_uint64_wrapper>(a, trap);
 }
 
 uint64_t ExecuteI64UConvertSatF32(float a) {
@@ -527,11 +537,8 @@ uint64_t ExecuteI64UConvertSatF32(float a) {
 }
 
 uint64_t ExecuteI64UConvertF64(double a, TrapReason* trap) {
-  uint64_t output;
-  if (!float64_to_uint64_wrapper(&a, &output)) {
-    *trap = kTrapFloatUnrepresentable;
-  }
-  return output;
+  return CallExternalFloatToIntFunction<uint64_t, double,
+                                        float64_to_uint64_wrapper>(a, trap);
 }
 
 uint64_t ExecuteI64UConvertSatF64(double a) {
@@ -562,15 +569,12 @@ inline float ExecuteF32UConvertI32(uint32_t a, TrapReason* trap) {
 }
 
 inline float ExecuteF32SConvertI64(int64_t a, TrapReason* trap) {
-  float output;
-  int64_to_float32_wrapper(&a, &output);
-  return output;
+  return static_cast<float>(a);
 }
 
 inline float ExecuteF32UConvertI64(uint64_t a, TrapReason* trap) {
-  float output;
-  uint64_to_float32_wrapper(&a, &output);
-  return output;
+  return CallExternalIntToFloatFunction<float, uint64_t,
+                                        uint64_to_float32_wrapper>(a);
 }
 
 inline float ExecuteF32ConvertF64(double a, TrapReason* trap) {
@@ -590,15 +594,12 @@ inline double ExecuteF64UConvertI32(uint32_t a, TrapReason* trap) {
 }
 
 inline double ExecuteF64SConvertI64(int64_t a, TrapReason* trap) {
-  double output;
-  int64_to_float64_wrapper(&a, &output);
-  return output;
+  return static_cast<double>(a);
 }
 
 inline double ExecuteF64UConvertI64(uint64_t a, TrapReason* trap) {
-  double output;
-  uint64_to_float64_wrapper(&a, &output);
-  return output;
+  return CallExternalIntToFloatFunction<double, uint64_t,
+                                        uint64_to_float64_wrapper>(a);
 }
 
 inline double ExecuteF64ConvertF32(float a, TrapReason* trap) {
@@ -655,18 +656,17 @@ struct InterpreterCode {
 class SideTable : public ZoneObject {
  public:
   ControlTransferMap map_;
-  uint32_t max_stack_height_;
+  uint32_t max_stack_height_ = 0;
 
   SideTable(Zone* zone, const WasmModule* module, InterpreterCode* code)
-      : map_(zone), max_stack_height_(0) {
+      : map_(zone) {
     // Create a zone for all temporary objects.
     Zone control_transfer_zone(zone->allocator(), ZONE_NAME);
 
     // Represents a control flow label.
     class CLabel : public ZoneObject {
       explicit CLabel(Zone* zone, uint32_t target_stack_height, uint32_t arity)
-          : target(nullptr),
-            target_stack_height(target_stack_height),
+          : target_stack_height(target_stack_height),
             arity(arity),
             refs(zone) {}
 
@@ -675,7 +675,7 @@ class SideTable : public ZoneObject {
         const byte* from_pc;
         const uint32_t stack_height;
       };
-      const byte* target;
+      const byte* target = nullptr;
       uint32_t target_stack_height;
       // Arity when branching to this label.
       const uint32_t arity;
@@ -786,35 +786,33 @@ class SideTable : public ZoneObject {
         case kExprBlock:
         case kExprLoop: {
           bool is_loop = opcode == kExprLoop;
-          BlockTypeOperand<Decoder::kNoValidate> operand(&i, i.pc());
-          if (operand.type == kWasmVar) {
-            operand.sig = module->signatures[operand.sig_index];
+          BlockTypeImmediate<Decoder::kNoValidate> imm(&i, i.pc());
+          if (imm.type == kWasmVar) {
+            imm.sig = module->signatures[imm.sig_index];
           }
           TRACE("control @%u: %s, arity %d->%d\n", i.pc_offset(),
-                is_loop ? "Loop" : "Block",
-                operand.in_arity(), operand.out_arity());
-          CLabel* label = CLabel::New(&control_transfer_zone, stack_height,
-                                      is_loop ? operand.in_arity()
-                                              : operand.out_arity());
-          control_stack.emplace_back(i.pc(), label, operand.out_arity());
+                is_loop ? "Loop" : "Block", imm.in_arity(), imm.out_arity());
+          CLabel* label =
+              CLabel::New(&control_transfer_zone, stack_height,
+                          is_loop ? imm.in_arity() : imm.out_arity());
+          control_stack.emplace_back(i.pc(), label, imm.out_arity());
           copy_unreachable();
           if (is_loop) label->Bind(i.pc());
           break;
         }
         case kExprIf: {
-          BlockTypeOperand<Decoder::kNoValidate> operand(&i, i.pc());
-          if (operand.type == kWasmVar) {
-            operand.sig = module->signatures[operand.sig_index];
+          BlockTypeImmediate<Decoder::kNoValidate> imm(&i, i.pc());
+          if (imm.type == kWasmVar) {
+            imm.sig = module->signatures[imm.sig_index];
           }
           TRACE("control @%u: If, arity %d->%d\n", i.pc_offset(),
-                operand.in_arity(), operand.out_arity());
-          CLabel* end_label =
-              CLabel::New(&control_transfer_zone, stack_height,
-                          operand.out_arity());
+                imm.in_arity(), imm.out_arity());
+          CLabel* end_label = CLabel::New(&control_transfer_zone, stack_height,
+                                          imm.out_arity());
           CLabel* else_label =
               CLabel::New(&control_transfer_zone, stack_height, 0);
           control_stack.emplace_back(i.pc(), end_label, else_label,
-                                     operand.out_arity());
+                                     imm.out_arity());
           copy_unreachable();
           if (!unreachable) else_label->Ref(i.pc(), stack_height);
           break;
@@ -850,24 +848,24 @@ class SideTable : public ZoneObject {
           break;
         }
         case kExprBr: {
-          BreakDepthOperand<Decoder::kNoValidate> operand(&i, i.pc());
-          TRACE("control @%u: Br[depth=%u]\n", i.pc_offset(), operand.depth);
-          Control* c = &control_stack[control_stack.size() - operand.depth - 1];
+          BreakDepthImmediate<Decoder::kNoValidate> imm(&i, i.pc());
+          TRACE("control @%u: Br[depth=%u]\n", i.pc_offset(), imm.depth);
+          Control* c = &control_stack[control_stack.size() - imm.depth - 1];
           if (!unreachable) c->end_label->Ref(i.pc(), stack_height);
           break;
         }
         case kExprBrIf: {
-          BreakDepthOperand<Decoder::kNoValidate> operand(&i, i.pc());
-          TRACE("control @%u: BrIf[depth=%u]\n", i.pc_offset(), operand.depth);
-          Control* c = &control_stack[control_stack.size() - operand.depth - 1];
+          BreakDepthImmediate<Decoder::kNoValidate> imm(&i, i.pc());
+          TRACE("control @%u: BrIf[depth=%u]\n", i.pc_offset(), imm.depth);
+          Control* c = &control_stack[control_stack.size() - imm.depth - 1];
           if (!unreachable) c->end_label->Ref(i.pc(), stack_height);
           break;
         }
         case kExprBrTable: {
-          BranchTableOperand<Decoder::kNoValidate> operand(&i, i.pc());
-          BranchTableIterator<Decoder::kNoValidate> iterator(&i, operand);
+          BranchTableImmediate<Decoder::kNoValidate> imm(&i, i.pc());
+          BranchTableIterator<Decoder::kNoValidate> iterator(&i, imm);
           TRACE("control @%u: BrTable[count=%u]\n", i.pc_offset(),
-                operand.table_count);
+                imm.table_count);
           if (!unreachable) {
             while (iterator.has_next()) {
               uint32_t j = iterator.cur_index();
@@ -971,16 +969,14 @@ class CodeMap {
   InterpreterCode* GetIndirectCode(uint32_t table_index, uint32_t entry_index) {
     uint32_t saved_index;
     USE(saved_index);
-    if (table_index >= module_->function_tables.size()) return nullptr;
+    if (table_index >= module_->tables.size()) return nullptr;
     // Mask table index for SSCA mitigation.
     saved_index = table_index;
-    table_index &=
-        static_cast<int32_t>((table_index - module_->function_tables.size()) &
-                             ~static_cast<int32_t>(table_index)) >>
-        31;
+    table_index &= static_cast<int32_t>((table_index - module_->tables.size()) &
+                                        ~static_cast<int32_t>(table_index)) >>
+                   31;
     DCHECK_EQ(table_index, saved_index);
-    const WasmIndirectFunctionTable* table =
-        &module_->function_tables[table_index];
+    const WasmTable* table = &module_->tables[table_index];
     if (entry_index >= table->values.size()) return nullptr;
     // Mask entry_index for SSCA mitigation.
     saved_index = entry_index;
@@ -1083,7 +1079,6 @@ class ThreadImpl {
              Handle<WasmInstanceObject> instance_object)
       : codemap_(codemap),
         instance_object_(instance_object),
-        zone_(zone),
         frames_(zone),
         activations_(zone) {}
 
@@ -1125,7 +1120,7 @@ class ThreadImpl {
 
   void Reset() {
     TRACE("----- RESET -----\n");
-    sp_ = stack_start_;
+    sp_ = stack_.get();
     frames_.clear();
     state_ = WasmInterpreter::STOPPED;
     trap_reason_ = kTrapCount;
@@ -1148,12 +1143,12 @@ class ThreadImpl {
 
   WasmValue GetStackValue(sp_t index) {
     DCHECK_GT(StackHeight(), index);
-    return stack_start_[index];
+    return stack_[index];
   }
 
   void SetStackValue(sp_t index, WasmValue value) {
     DCHECK_GT(StackHeight(), index);
-    stack_start_[index] = value;
+    stack_[index] = value;
   }
 
   TrapReason GetTrapReason() { return trap_reason_; }
@@ -1192,7 +1187,7 @@ class ThreadImpl {
     // first).
     DCHECK_EQ(activations_.back().fp, frames_.size());
     DCHECK_LE(activations_.back().sp, StackHeight());
-    sp_ = stack_start_ + activations_.back().sp;
+    sp_ = stack_.get() + activations_.back().sp;
     activations_.pop_back();
   }
 
@@ -1214,7 +1209,7 @@ class ThreadImpl {
     DCHECK_LE(act.fp, frames_.size());
     frames_.resize(act.fp);
     DCHECK_LE(act.sp, StackHeight());
-    sp_ = stack_start_ + act.sp;
+    sp_ = stack_.get() + act.sp;
     state_ = WasmInterpreter::STOPPED;
     return WasmInterpreter::Thread::UNWOUND;
   }
@@ -1243,8 +1238,7 @@ class ThreadImpl {
 
   CodeMap* codemap_;
   Handle<WasmInstanceObject> instance_object_;
-  Zone* zone_;
-  WasmValue* stack_start_ = nullptr;  // Start of allocated stack space.
+  std::unique_ptr<WasmValue[]> stack_;
   WasmValue* stack_limit_ = nullptr;  // End of allocated stack space.
   WasmValue* sp_ = nullptr;           // Current stack pointer.
   ZoneVector<Frame> frames_;
@@ -1288,9 +1282,9 @@ class ThreadImpl {
     for (auto p : code->locals.type_list) {
       WasmValue val;
       switch (p) {
-#define CASE_TYPE(wasm, ctype)              \
-  case kWasm##wasm:                         \
-    val = WasmValue(static_cast<ctype>(0)); \
+#define CASE_TYPE(wasm, ctype) \
+  case kWasm##wasm:            \
+    val = WasmValue(ctype{});  \
     break;
         WASM_CTYPES(CASE_TYPE)
 #undef CASE_TYPE
@@ -1331,14 +1325,12 @@ class ThreadImpl {
   pc_t ReturnPc(Decoder* decoder, InterpreterCode* code, pc_t pc) {
     switch (code->orig_start[pc]) {
       case kExprCallFunction: {
-        CallFunctionOperand<Decoder::kNoValidate> operand(decoder,
-                                                          code->at(pc));
-        return pc + 1 + operand.length;
+        CallFunctionImmediate<Decoder::kNoValidate> imm(decoder, code->at(pc));
+        return pc + 1 + imm.length;
       }
       case kExprCallIndirect: {
-        CallIndirectOperand<Decoder::kNoValidate> operand(decoder,
-                                                          code->at(pc));
-        return pc + 1 + operand.length;
+        CallIndirectImmediate<Decoder::kNoValidate> imm(decoder, code->at(pc));
+        return pc + 1 + imm.length;
       }
       default:
         UNREACHABLE();
@@ -1348,7 +1340,7 @@ class ThreadImpl {
   bool DoReturn(Decoder* decoder, InterpreterCode** code, pc_t* pc, pc_t* limit,
                 size_t arity) {
     DCHECK_GT(frames_.size(), 0);
-    WasmValue* sp_dest = stack_start_ + frames_.back().sp;
+    WasmValue* sp_dest = stack_.get() + frames_.back().sp;
     frames_.pop_back();
     if (frames_.size() == current_activation().fp) {
       // A return from the last frame terminates the execution.
@@ -1398,24 +1390,24 @@ class ThreadImpl {
   }
 
   template <typename mtype>
-  inline byte* BoundsCheckMem(uint32_t offset, uint32_t index) {
+  inline Address BoundsCheckMem(uint32_t offset, uint32_t index) {
     size_t mem_size = instance_object_->memory_size();
-    if (sizeof(mtype) > mem_size) return nullptr;
-    if (offset > (mem_size - sizeof(mtype))) return nullptr;
-    if (index > (mem_size - sizeof(mtype) - offset)) return nullptr;
+    if (sizeof(mtype) > mem_size) return kNullAddress;
+    if (offset > (mem_size - sizeof(mtype))) return kNullAddress;
+    if (index > (mem_size - sizeof(mtype) - offset)) return kNullAddress;
     // Compute the effective address of the access, making sure to condition
     // the index even in the in-bounds case.
-    return instance_object_->memory_start() + offset +
-           (index & instance_object_->memory_mask());
+    return reinterpret_cast<Address>(instance_object_->memory_start()) +
+           offset + (index & instance_object_->memory_mask());
   }
 
   template <typename ctype, typename mtype>
   bool ExecuteLoad(Decoder* decoder, InterpreterCode* code, pc_t pc, int& len,
                    MachineRepresentation rep) {
-    MemoryAccessOperand<Decoder::kNoValidate> operand(decoder, code->at(pc),
-                                                      sizeof(ctype));
+    MemoryAccessImmediate<Decoder::kNoValidate> imm(decoder, code->at(pc),
+                                                    sizeof(ctype));
     uint32_t index = Pop().to<uint32_t>();
-    byte* addr = BoundsCheckMem<mtype>(operand.offset, index);
+    Address addr = BoundsCheckMem<mtype>(imm.offset, index);
     if (!addr) {
       DoTrap(kTrapMemOutOfBounds, pc);
       return false;
@@ -1424,10 +1416,10 @@ class ThreadImpl {
         converter<ctype, mtype>{}(ReadLittleEndianValue<mtype>(addr)));
 
     Push(result);
-    len = 1 + operand.length;
+    len = 1 + imm.length;
 
     if (FLAG_wasm_trace_memory) {
-      wasm::MemoryTracingInfo info(operand.offset + index, false, rep);
+      wasm::MemoryTracingInfo info(imm.offset + index, false, rep);
       TraceMemoryOperation(ExecutionEngine::kInterpreter, &info,
                            code->function->func_index, static_cast<int>(pc),
                            instance_object_->memory_start());
@@ -1439,21 +1431,21 @@ class ThreadImpl {
   template <typename ctype, typename mtype>
   bool ExecuteStore(Decoder* decoder, InterpreterCode* code, pc_t pc, int& len,
                     MachineRepresentation rep) {
-    MemoryAccessOperand<Decoder::kNoValidate> operand(decoder, code->at(pc),
-                                                      sizeof(ctype));
+    MemoryAccessImmediate<Decoder::kNoValidate> imm(decoder, code->at(pc),
+                                                    sizeof(ctype));
     ctype val = Pop().to<ctype>();
 
     uint32_t index = Pop().to<uint32_t>();
-    byte* addr = BoundsCheckMem<mtype>(operand.offset, index);
+    Address addr = BoundsCheckMem<mtype>(imm.offset, index);
     if (!addr) {
       DoTrap(kTrapMemOutOfBounds, pc);
       return false;
     }
     WriteLittleEndianValue<mtype>(addr, converter<mtype, ctype>{}(val));
-    len = 1 + operand.length;
+    len = 1 + imm.length;
 
     if (FLAG_wasm_trace_memory) {
-      wasm::MemoryTracingInfo info(operand.offset + index, true, rep);
+      wasm::MemoryTracingInfo info(imm.offset + index, true, rep);
       TraceMemoryOperation(ExecutionEngine::kInterpreter, &info,
                            code->function->func_index, static_cast<int>(pc),
                            instance_object_->memory_start());
@@ -1462,20 +1454,21 @@ class ThreadImpl {
     return true;
   }
 
-  template <typename type>
+  template <typename type, typename op_type>
   bool ExtractAtomicOpParams(Decoder* decoder, InterpreterCode* code,
                              Address& address, pc_t pc, int& len,
-                             type* val = nullptr) {
-    MemoryAccessOperand<Decoder::kNoValidate> operand(decoder, code->at(pc + 1),
-                                                      sizeof(type));
-    if (val) *val = Pop().to<uint32_t>();
+                             type* val = nullptr, type* val2 = nullptr) {
+    MemoryAccessImmediate<Decoder::kNoValidate> imm(decoder, code->at(pc + 1),
+                                                    sizeof(type));
+    if (val2) *val2 = static_cast<type>(Pop().to<op_type>());
+    if (val) *val = static_cast<type>(Pop().to<op_type>());
     uint32_t index = Pop().to<uint32_t>();
-    address = BoundsCheckMem<type>(operand.offset, index);
+    address = BoundsCheckMem<type>(imm.offset, index);
     if (!address) {
       DoTrap(kTrapMemOutOfBounds, pc);
       return false;
     }
-    len = 2 + operand.length;
+    len = 2 + imm.length;
     return true;
   }
 
@@ -1518,63 +1511,133 @@ class ThreadImpl {
                        InterpreterCode* code, pc_t pc, int& len) {
     WasmValue result;
     switch (opcode) {
-#define ATOMIC_BINOP_CASE(name, type, operation)                            \
+// Disabling on Mips as 32 bit atomics are not correctly laid out for load/store
+// on big endian and 64 bit atomics fail to compile.
+#if !(V8_TARGET_ARCH_MIPS && V8_TARGET_BIG_ENDIAN)
+#define ATOMIC_BINOP_CASE(name, type, op_type, operation)                   \
   case kExpr##name: {                                                       \
     type val;                                                               \
     Address addr;                                                           \
-    if (!ExtractAtomicOpParams<type>(decoder, code, addr, pc, len, &val)) { \
+    if (!ExtractAtomicOpParams<type, op_type>(decoder, code, addr, pc, len, \
+                                              &val)) {                      \
       return false;                                                         \
     }                                                                       \
     static_assert(sizeof(std::atomic<type>) == sizeof(type),                \
                   "Size mismatch for types std::atomic<" #type              \
                   ">, and " #type);                                         \
-    result = WasmValue(                                                     \
-        std::operation(reinterpret_cast<std::atomic<type>*>(addr), val));   \
+    result = WasmValue(static_cast<op_type>(                                \
+        std::operation(reinterpret_cast<std::atomic<type>*>(addr), val)));  \
     Push(result);                                                           \
     break;                                                                  \
   }
-      ATOMIC_BINOP_CASE(I32AtomicAdd, uint32_t, atomic_fetch_add);
-      ATOMIC_BINOP_CASE(I32AtomicAdd8U, uint8_t, atomic_fetch_add);
-      ATOMIC_BINOP_CASE(I32AtomicAdd16U, uint16_t, atomic_fetch_add);
-      ATOMIC_BINOP_CASE(I32AtomicSub, uint32_t, atomic_fetch_sub);
-      ATOMIC_BINOP_CASE(I32AtomicSub8U, uint8_t, atomic_fetch_sub);
-      ATOMIC_BINOP_CASE(I32AtomicSub16U, uint16_t, atomic_fetch_sub);
-      ATOMIC_BINOP_CASE(I32AtomicAnd, uint32_t, atomic_fetch_and);
-      ATOMIC_BINOP_CASE(I32AtomicAnd8U, uint8_t, atomic_fetch_and);
-      ATOMIC_BINOP_CASE(I32AtomicAnd16U, uint16_t, atomic_fetch_and);
-      ATOMIC_BINOP_CASE(I32AtomicOr, uint32_t, atomic_fetch_or);
-      ATOMIC_BINOP_CASE(I32AtomicOr8U, uint8_t, atomic_fetch_or);
-      ATOMIC_BINOP_CASE(I32AtomicOr16U, uint16_t, atomic_fetch_or);
-      ATOMIC_BINOP_CASE(I32AtomicXor, uint32_t, atomic_fetch_xor);
-      ATOMIC_BINOP_CASE(I32AtomicXor8U, uint8_t, atomic_fetch_xor);
-      ATOMIC_BINOP_CASE(I32AtomicXor16U, uint16_t, atomic_fetch_xor);
-      ATOMIC_BINOP_CASE(I32AtomicExchange, uint32_t, atomic_exchange);
-      ATOMIC_BINOP_CASE(I32AtomicExchange8U, uint8_t, atomic_exchange);
-      ATOMIC_BINOP_CASE(I32AtomicExchange16U, uint16_t, atomic_exchange);
+      ATOMIC_BINOP_CASE(I32AtomicAdd, uint32_t, uint32_t, atomic_fetch_add);
+      ATOMIC_BINOP_CASE(I32AtomicAdd8U, uint8_t, uint32_t, atomic_fetch_add);
+      ATOMIC_BINOP_CASE(I32AtomicAdd16U, uint16_t, uint32_t, atomic_fetch_add);
+      ATOMIC_BINOP_CASE(I32AtomicSub, uint32_t, uint32_t, atomic_fetch_sub);
+      ATOMIC_BINOP_CASE(I32AtomicSub8U, uint8_t, uint32_t, atomic_fetch_sub);
+      ATOMIC_BINOP_CASE(I32AtomicSub16U, uint16_t, uint32_t, atomic_fetch_sub);
+      ATOMIC_BINOP_CASE(I32AtomicAnd, uint32_t, uint32_t, atomic_fetch_and);
+      ATOMIC_BINOP_CASE(I32AtomicAnd8U, uint8_t, uint32_t, atomic_fetch_and);
+      ATOMIC_BINOP_CASE(I32AtomicAnd16U, uint16_t, uint32_t, atomic_fetch_and);
+      ATOMIC_BINOP_CASE(I32AtomicOr, uint32_t, uint32_t, atomic_fetch_or);
+      ATOMIC_BINOP_CASE(I32AtomicOr8U, uint8_t, uint32_t, atomic_fetch_or);
+      ATOMIC_BINOP_CASE(I32AtomicOr16U, uint16_t, uint32_t, atomic_fetch_or);
+      ATOMIC_BINOP_CASE(I32AtomicXor, uint32_t, uint32_t, atomic_fetch_xor);
+      ATOMIC_BINOP_CASE(I32AtomicXor8U, uint8_t, uint32_t, atomic_fetch_xor);
+      ATOMIC_BINOP_CASE(I32AtomicXor16U, uint16_t, uint32_t, atomic_fetch_xor);
+      ATOMIC_BINOP_CASE(I32AtomicExchange, uint32_t, uint32_t, atomic_exchange);
+      ATOMIC_BINOP_CASE(I32AtomicExchange8U, uint8_t, uint32_t,
+                        atomic_exchange);
+      ATOMIC_BINOP_CASE(I32AtomicExchange16U, uint16_t, uint32_t,
+                        atomic_exchange);
+      ATOMIC_BINOP_CASE(I64AtomicAdd, uint64_t, uint64_t, atomic_fetch_add);
+      ATOMIC_BINOP_CASE(I64AtomicAdd8U, uint8_t, uint64_t, atomic_fetch_add);
+      ATOMIC_BINOP_CASE(I64AtomicAdd16U, uint16_t, uint64_t, atomic_fetch_add);
+      ATOMIC_BINOP_CASE(I64AtomicAdd32U, uint32_t, uint64_t, atomic_fetch_add);
+      ATOMIC_BINOP_CASE(I64AtomicSub, uint64_t, uint64_t, atomic_fetch_sub);
+      ATOMIC_BINOP_CASE(I64AtomicSub8U, uint8_t, uint64_t, atomic_fetch_sub);
+      ATOMIC_BINOP_CASE(I64AtomicSub16U, uint16_t, uint64_t, atomic_fetch_sub);
+      ATOMIC_BINOP_CASE(I64AtomicSub32U, uint32_t, uint64_t, atomic_fetch_sub);
+      ATOMIC_BINOP_CASE(I64AtomicAnd, uint64_t, uint64_t, atomic_fetch_and);
+      ATOMIC_BINOP_CASE(I64AtomicAnd8U, uint8_t, uint64_t, atomic_fetch_and);
+      ATOMIC_BINOP_CASE(I64AtomicAnd16U, uint16_t, uint64_t, atomic_fetch_and);
+      ATOMIC_BINOP_CASE(I64AtomicAnd32U, uint32_t, uint64_t, atomic_fetch_and);
+      ATOMIC_BINOP_CASE(I64AtomicOr, uint64_t, uint64_t, atomic_fetch_or);
+      ATOMIC_BINOP_CASE(I64AtomicOr8U, uint8_t, uint64_t, atomic_fetch_or);
+      ATOMIC_BINOP_CASE(I64AtomicOr16U, uint16_t, uint64_t, atomic_fetch_or);
+      ATOMIC_BINOP_CASE(I64AtomicOr32U, uint32_t, uint64_t, atomic_fetch_or);
+      ATOMIC_BINOP_CASE(I64AtomicXor, uint64_t, uint64_t, atomic_fetch_xor);
+      ATOMIC_BINOP_CASE(I64AtomicXor8U, uint8_t, uint64_t, atomic_fetch_xor);
+      ATOMIC_BINOP_CASE(I64AtomicXor16U, uint16_t, uint64_t, atomic_fetch_xor);
+      ATOMIC_BINOP_CASE(I64AtomicXor32U, uint32_t, uint64_t, atomic_fetch_xor);
+      ATOMIC_BINOP_CASE(I64AtomicExchange, uint64_t, uint64_t, atomic_exchange);
+      ATOMIC_BINOP_CASE(I64AtomicExchange8U, uint8_t, uint64_t,
+                        atomic_exchange);
+      ATOMIC_BINOP_CASE(I64AtomicExchange16U, uint16_t, uint64_t,
+                        atomic_exchange);
+      ATOMIC_BINOP_CASE(I64AtomicExchange32U, uint32_t, uint64_t,
+                        atomic_exchange);
 #undef ATOMIC_BINOP_CASE
-#define ATOMIC_LOAD_CASE(name, type, operation)                                \
+#define ATOMIC_COMPARE_EXCHANGE_CASE(name, type, op_type)                   \
+  case kExpr##name: {                                                       \
+    type val;                                                               \
+    type val2;                                                              \
+    Address addr;                                                           \
+    if (!ExtractAtomicOpParams<type, op_type>(decoder, code, addr, pc, len, \
+                                              &val, &val2)) {               \
+      return false;                                                         \
+    }                                                                       \
+    static_assert(sizeof(std::atomic<type>) == sizeof(type),                \
+                  "Size mismatch for types std::atomic<" #type              \
+                  ">, and " #type);                                         \
+    std::atomic_compare_exchange_strong(                                    \
+        reinterpret_cast<std::atomic<type>*>(addr), &val, val2);            \
+    Push(WasmValue(static_cast<op_type>(val)));                             \
+    break;                                                                  \
+  }
+      ATOMIC_COMPARE_EXCHANGE_CASE(I32AtomicCompareExchange, uint32_t,
+                                   uint32_t);
+      ATOMIC_COMPARE_EXCHANGE_CASE(I32AtomicCompareExchange8U, uint8_t,
+                                   uint32_t);
+      ATOMIC_COMPARE_EXCHANGE_CASE(I32AtomicCompareExchange16U, uint16_t,
+                                   uint32_t);
+      ATOMIC_COMPARE_EXCHANGE_CASE(I64AtomicCompareExchange, uint64_t,
+                                   uint64_t);
+      ATOMIC_COMPARE_EXCHANGE_CASE(I64AtomicCompareExchange8U, uint8_t,
+                                   uint64_t);
+      ATOMIC_COMPARE_EXCHANGE_CASE(I64AtomicCompareExchange16U, uint16_t,
+                                   uint64_t);
+      ATOMIC_COMPARE_EXCHANGE_CASE(I64AtomicCompareExchange32U, uint32_t,
+                                   uint64_t);
+#undef ATOMIC_COMPARE_EXCHANGE_CASE
+#define ATOMIC_LOAD_CASE(name, type, op_type, operation)                       \
   case kExpr##name: {                                                          \
     Address addr;                                                              \
-    if (!ExtractAtomicOpParams<type>(decoder, code, addr, pc, len)) {          \
+    if (!ExtractAtomicOpParams<type, op_type>(decoder, code, addr, pc, len)) { \
       return false;                                                            \
     }                                                                          \
     static_assert(sizeof(std::atomic<type>) == sizeof(type),                   \
                   "Size mismatch for types std::atomic<" #type                 \
                   ">, and " #type);                                            \
-    result =                                                                   \
-        WasmValue(std::operation(reinterpret_cast<std::atomic<type>*>(addr))); \
+    result = WasmValue(static_cast<op_type>(                                   \
+        std::operation(reinterpret_cast<std::atomic<type>*>(addr))));          \
     Push(result);                                                              \
     break;                                                                     \
   }
-      ATOMIC_LOAD_CASE(I32AtomicLoad, uint32_t, atomic_load);
-      ATOMIC_LOAD_CASE(I32AtomicLoad8U, uint8_t, atomic_load);
-      ATOMIC_LOAD_CASE(I32AtomicLoad16U, uint16_t, atomic_load);
+      ATOMIC_LOAD_CASE(I32AtomicLoad, uint32_t, uint32_t, atomic_load);
+      ATOMIC_LOAD_CASE(I32AtomicLoad8U, uint8_t, uint32_t, atomic_load);
+      ATOMIC_LOAD_CASE(I32AtomicLoad16U, uint16_t, uint32_t, atomic_load);
+      ATOMIC_LOAD_CASE(I64AtomicLoad, uint64_t, uint64_t, atomic_load);
+      ATOMIC_LOAD_CASE(I64AtomicLoad8U, uint8_t, uint64_t, atomic_load);
+      ATOMIC_LOAD_CASE(I64AtomicLoad16U, uint16_t, uint64_t, atomic_load);
+      ATOMIC_LOAD_CASE(I64AtomicLoad32U, uint32_t, uint64_t, atomic_load);
 #undef ATOMIC_LOAD_CASE
-#define ATOMIC_STORE_CASE(name, type, operation)                            \
+#define ATOMIC_STORE_CASE(name, type, op_type, operation)                   \
   case kExpr##name: {                                                       \
     type val;                                                               \
     Address addr;                                                           \
-    if (!ExtractAtomicOpParams<type>(decoder, code, addr, pc, len, &val)) { \
+    if (!ExtractAtomicOpParams<type, op_type>(decoder, code, addr, pc, len, \
+                                              &val)) {                      \
       return false;                                                         \
     }                                                                       \
     static_assert(sizeof(std::atomic<type>) == sizeof(type),                \
@@ -1583,16 +1646,393 @@ class ThreadImpl {
     std::operation(reinterpret_cast<std::atomic<type>*>(addr), val);        \
     break;                                                                  \
   }
-      ATOMIC_STORE_CASE(I32AtomicStore, uint32_t, atomic_store);
-      ATOMIC_STORE_CASE(I32AtomicStore8U, uint8_t, atomic_store);
-      ATOMIC_STORE_CASE(I32AtomicStore16U, uint16_t, atomic_store);
+      ATOMIC_STORE_CASE(I32AtomicStore, uint32_t, uint32_t, atomic_store);
+      ATOMIC_STORE_CASE(I32AtomicStore8U, uint8_t, uint32_t, atomic_store);
+      ATOMIC_STORE_CASE(I32AtomicStore16U, uint16_t, uint32_t, atomic_store);
+      ATOMIC_STORE_CASE(I64AtomicStore, uint64_t, uint64_t, atomic_store);
+      ATOMIC_STORE_CASE(I64AtomicStore8U, uint8_t, uint64_t, atomic_store);
+      ATOMIC_STORE_CASE(I64AtomicStore16U, uint16_t, uint64_t, atomic_store);
+      ATOMIC_STORE_CASE(I64AtomicStore32U, uint32_t, uint64_t, atomic_store);
 #undef ATOMIC_STORE_CASE
+#endif  // !(V8_TARGET_ARCH_MIPS && V8_TARGET_BIG_ENDIAN)
       default:
+        UNREACHABLE();
         return false;
     }
     return true;
   }
 
+  byte* GetGlobalPtr(const WasmGlobal* global) {
+    if (global->mutability && global->imported) {
+      DCHECK(FLAG_experimental_wasm_mut_global);
+      return reinterpret_cast<byte*>(
+          instance_object_->imported_mutable_globals()[global->index]);
+    } else {
+      return instance_object_->globals_start() + global->offset;
+    }
+  }
+
+  bool ExecuteSimdOp(WasmOpcode opcode, Decoder* decoder, InterpreterCode* code,
+                     pc_t pc, int& len) {
+    switch (opcode) {
+#define SPLAT_CASE(format, sType, valType, num) \
+  case kExpr##format##Splat: {                  \
+    WasmValue val = Pop();                      \
+    valType v = val.to<valType>();              \
+    sType s;                                    \
+    for (int i = 0; i < num; i++) s.val[i] = v; \
+    Push(WasmValue(Simd128(s)));                \
+    return true;                                \
+  }
+      SPLAT_CASE(I32x4, int4, int32_t, 4)
+      SPLAT_CASE(F32x4, float4, float, 4)
+      SPLAT_CASE(I16x8, int8, int32_t, 8)
+      SPLAT_CASE(I8x16, int16, int32_t, 16)
+#undef SPLAT_CASE
+#define EXTRACT_LANE_CASE(format, name)                                 \
+  case kExpr##format##ExtractLane: {                                    \
+    SimdLaneImmediate<Decoder::kNoValidate> imm(decoder, code->at(pc)); \
+    ++len;                                                              \
+    WasmValue val = Pop();                                              \
+    Simd128 s = val.to_s128();                                          \
+    Push(WasmValue(s.to_##name().val[imm.lane]));                       \
+    return true;                                                        \
+  }
+      EXTRACT_LANE_CASE(I32x4, i32x4)
+      EXTRACT_LANE_CASE(F32x4, f32x4)
+      EXTRACT_LANE_CASE(I16x8, i16x8)
+      EXTRACT_LANE_CASE(I8x16, i8x16)
+#undef EXTRACT_LANE_CASE
+#define BINOP_CASE(op, name, stype, count, expr) \
+  case kExpr##op: {                              \
+    WasmValue v2 = Pop();                        \
+    WasmValue v1 = Pop();                        \
+    stype s1 = v1.to_s128().to_##name();         \
+    stype s2 = v2.to_s128().to_##name();         \
+    stype res;                                   \
+    for (size_t i = 0; i < count; ++i) {         \
+      auto a = s1.val[i];                        \
+      auto b = s2.val[i];                        \
+      res.val[i] = expr;                         \
+    }                                            \
+    Push(WasmValue(Simd128(res)));               \
+    return true;                                 \
+  }
+      BINOP_CASE(F32x4Add, f32x4, float4, 4, a + b)
+      BINOP_CASE(F32x4Sub, f32x4, float4, 4, a - b)
+      BINOP_CASE(F32x4Mul, f32x4, float4, 4, a * b)
+      BINOP_CASE(F32x4Min, f32x4, float4, 4, a < b ? a : b)
+      BINOP_CASE(F32x4Max, f32x4, float4, 4, a > b ? a : b)
+      BINOP_CASE(I32x4Add, i32x4, int4, 4, a + b)
+      BINOP_CASE(I32x4Sub, i32x4, int4, 4, a - b)
+      BINOP_CASE(I32x4Mul, i32x4, int4, 4, a * b)
+      BINOP_CASE(I32x4MinS, i32x4, int4, 4, a < b ? a : b)
+      BINOP_CASE(I32x4MinU, i32x4, int4, 4,
+                 static_cast<uint32_t>(a) < static_cast<uint32_t>(b) ? a : b)
+      BINOP_CASE(I32x4MaxS, i32x4, int4, 4, a > b ? a : b)
+      BINOP_CASE(I32x4MaxU, i32x4, int4, 4,
+                 static_cast<uint32_t>(a) > static_cast<uint32_t>(b) ? a : b)
+      BINOP_CASE(S128And, i32x4, int4, 4, a & b)
+      BINOP_CASE(S128Or, i32x4, int4, 4, a | b)
+      BINOP_CASE(S128Xor, i32x4, int4, 4, a ^ b)
+      BINOP_CASE(I16x8Add, i16x8, int8, 8, a + b)
+      BINOP_CASE(I16x8Sub, i16x8, int8, 8, a - b)
+      BINOP_CASE(I16x8Mul, i16x8, int8, 8, a * b)
+      BINOP_CASE(I16x8MinS, i16x8, int8, 8, a < b ? a : b)
+      BINOP_CASE(I16x8MinU, i16x8, int8, 8,
+                 static_cast<uint16_t>(a) < static_cast<uint16_t>(b) ? a : b)
+      BINOP_CASE(I16x8MaxS, i16x8, int8, 8, a > b ? a : b)
+      BINOP_CASE(I16x8MaxU, i16x8, int8, 8,
+                 static_cast<uint16_t>(a) > static_cast<uint16_t>(b) ? a : b)
+      BINOP_CASE(I16x8AddSaturateS, i16x8, int8, 8, SaturateAdd<int16_t>(a, b))
+      BINOP_CASE(I16x8AddSaturateU, i16x8, int8, 8, SaturateAdd<uint16_t>(a, b))
+      BINOP_CASE(I16x8SubSaturateS, i16x8, int8, 8, SaturateSub<int16_t>(a, b))
+      BINOP_CASE(I16x8SubSaturateU, i16x8, int8, 8, SaturateSub<uint16_t>(a, b))
+      BINOP_CASE(I8x16Add, i8x16, int16, 16, a + b)
+      BINOP_CASE(I8x16Sub, i8x16, int16, 16, a - b)
+      BINOP_CASE(I8x16Mul, i8x16, int16, 16, a * b)
+      BINOP_CASE(I8x16MinS, i8x16, int16, 16, a < b ? a : b)
+      BINOP_CASE(I8x16MinU, i8x16, int16, 16,
+                 static_cast<uint8_t>(a) < static_cast<uint8_t>(b) ? a : b)
+      BINOP_CASE(I8x16MaxS, i8x16, int16, 16, a > b ? a : b)
+      BINOP_CASE(I8x16MaxU, i8x16, int16, 16,
+                 static_cast<uint8_t>(a) > static_cast<uint8_t>(b) ? a : b)
+      BINOP_CASE(I8x16AddSaturateS, i8x16, int16, 16, SaturateAdd<int8_t>(a, b))
+      BINOP_CASE(I8x16AddSaturateU, i8x16, int16, 16,
+                 SaturateAdd<uint8_t>(a, b))
+      BINOP_CASE(I8x16SubSaturateS, i8x16, int16, 16, SaturateSub<int8_t>(a, b))
+      BINOP_CASE(I8x16SubSaturateU, i8x16, int16, 16,
+                 SaturateSub<uint8_t>(a, b))
+#undef BINOP_CASE
+#define UNOP_CASE(op, name, stype, count, expr) \
+  case kExpr##op: {                             \
+    WasmValue v = Pop();                        \
+    stype s = v.to_s128().to_##name();          \
+    stype res;                                  \
+    for (size_t i = 0; i < count; ++i) {        \
+      auto a = s.val[i];                        \
+      res.val[i] = expr;                        \
+    }                                           \
+    Push(WasmValue(Simd128(res)));              \
+    return true;                                \
+  }
+      UNOP_CASE(F32x4Abs, f32x4, float4, 4, std::abs(a))
+      UNOP_CASE(F32x4Neg, f32x4, float4, 4, -a)
+      UNOP_CASE(F32x4RecipApprox, f32x4, float4, 4, 1.0f / a)
+      UNOP_CASE(F32x4RecipSqrtApprox, f32x4, float4, 4, 1.0f / std::sqrt(a))
+      UNOP_CASE(I32x4Neg, i32x4, int4, 4, -a)
+      UNOP_CASE(S128Not, i32x4, int4, 4, ~a)
+      UNOP_CASE(I16x8Neg, i16x8, int8, 8, -a)
+      UNOP_CASE(I8x16Neg, i8x16, int16, 16, -a)
+#undef UNOP_CASE
+#define CMPOP_CASE(op, name, stype, out_stype, count, expr) \
+  case kExpr##op: {                                         \
+    WasmValue v2 = Pop();                                   \
+    WasmValue v1 = Pop();                                   \
+    stype s1 = v1.to_s128().to_##name();                    \
+    stype s2 = v2.to_s128().to_##name();                    \
+    out_stype res;                                          \
+    for (size_t i = 0; i < count; ++i) {                    \
+      auto a = s1.val[i];                                   \
+      auto b = s2.val[i];                                   \
+      res.val[i] = expr ? -1 : 0;                           \
+    }                                                       \
+    Push(WasmValue(Simd128(res)));                          \
+    return true;                                            \
+  }
+      CMPOP_CASE(F32x4Eq, f32x4, float4, int4, 4, a == b)
+      CMPOP_CASE(F32x4Ne, f32x4, float4, int4, 4, a != b)
+      CMPOP_CASE(F32x4Gt, f32x4, float4, int4, 4, a > b)
+      CMPOP_CASE(F32x4Ge, f32x4, float4, int4, 4, a >= b)
+      CMPOP_CASE(F32x4Lt, f32x4, float4, int4, 4, a < b)
+      CMPOP_CASE(F32x4Le, f32x4, float4, int4, 4, a <= b)
+      CMPOP_CASE(I32x4Eq, i32x4, int4, int4, 4, a == b)
+      CMPOP_CASE(I32x4Ne, i32x4, int4, int4, 4, a != b)
+      CMPOP_CASE(I32x4GtS, i32x4, int4, int4, 4, a > b)
+      CMPOP_CASE(I32x4GeS, i32x4, int4, int4, 4, a >= b)
+      CMPOP_CASE(I32x4LtS, i32x4, int4, int4, 4, a < b)
+      CMPOP_CASE(I32x4LeS, i32x4, int4, int4, 4, a <= b)
+      CMPOP_CASE(I32x4GtU, i32x4, int4, int4, 4,
+                 static_cast<uint32_t>(a) > static_cast<uint32_t>(b))
+      CMPOP_CASE(I32x4GeU, i32x4, int4, int4, 4,
+                 static_cast<uint32_t>(a) >= static_cast<uint32_t>(b))
+      CMPOP_CASE(I32x4LtU, i32x4, int4, int4, 4,
+                 static_cast<uint32_t>(a) < static_cast<uint32_t>(b))
+      CMPOP_CASE(I32x4LeU, i32x4, int4, int4, 4,
+                 static_cast<uint32_t>(a) <= static_cast<uint32_t>(b))
+      CMPOP_CASE(I16x8Eq, i16x8, int8, int8, 8, a == b)
+      CMPOP_CASE(I16x8Ne, i16x8, int8, int8, 8, a != b)
+      CMPOP_CASE(I16x8GtS, i16x8, int8, int8, 8, a > b)
+      CMPOP_CASE(I16x8GeS, i16x8, int8, int8, 8, a >= b)
+      CMPOP_CASE(I16x8LtS, i16x8, int8, int8, 8, a < b)
+      CMPOP_CASE(I16x8LeS, i16x8, int8, int8, 8, a <= b)
+      CMPOP_CASE(I16x8GtU, i16x8, int8, int8, 8,
+                 static_cast<uint16_t>(a) > static_cast<uint16_t>(b))
+      CMPOP_CASE(I16x8GeU, i16x8, int8, int8, 8,
+                 static_cast<uint16_t>(a) >= static_cast<uint16_t>(b))
+      CMPOP_CASE(I16x8LtU, i16x8, int8, int8, 8,
+                 static_cast<uint16_t>(a) < static_cast<uint16_t>(b))
+      CMPOP_CASE(I16x8LeU, i16x8, int8, int8, 8,
+                 static_cast<uint16_t>(a) <= static_cast<uint16_t>(b))
+      CMPOP_CASE(I8x16Eq, i8x16, int16, int16, 16, a == b)
+      CMPOP_CASE(I8x16Ne, i8x16, int16, int16, 16, a != b)
+      CMPOP_CASE(I8x16GtS, i8x16, int16, int16, 16, a > b)
+      CMPOP_CASE(I8x16GeS, i8x16, int16, int16, 16, a >= b)
+      CMPOP_CASE(I8x16LtS, i8x16, int16, int16, 16, a < b)
+      CMPOP_CASE(I8x16LeS, i8x16, int16, int16, 16, a <= b)
+      CMPOP_CASE(I8x16GtU, i8x16, int16, int16, 16,
+                 static_cast<uint8_t>(a) > static_cast<uint8_t>(b))
+      CMPOP_CASE(I8x16GeU, i8x16, int16, int16, 16,
+                 static_cast<uint8_t>(a) >= static_cast<uint8_t>(b))
+      CMPOP_CASE(I8x16LtU, i8x16, int16, int16, 16,
+                 static_cast<uint8_t>(a) < static_cast<uint8_t>(b))
+      CMPOP_CASE(I8x16LeU, i8x16, int16, int16, 16,
+                 static_cast<uint8_t>(a) <= static_cast<uint8_t>(b))
+#undef CMPOP_CASE
+#define REPLACE_LANE_CASE(format, name, stype, ctype)                   \
+  case kExpr##format##ReplaceLane: {                                    \
+    SimdLaneImmediate<Decoder::kNoValidate> imm(decoder, code->at(pc)); \
+    ++len;                                                              \
+    WasmValue new_val = Pop();                                          \
+    WasmValue simd_val = Pop();                                         \
+    stype s = simd_val.to_s128().to_##name();                           \
+    s.val[imm.lane] = new_val.to<ctype>();                              \
+    Push(WasmValue(Simd128(s)));                                        \
+    return true;                                                        \
+  }
+      REPLACE_LANE_CASE(F32x4, f32x4, float4, float)
+      REPLACE_LANE_CASE(I32x4, i32x4, int4, int32_t)
+      REPLACE_LANE_CASE(I16x8, i16x8, int8, int32_t)
+      REPLACE_LANE_CASE(I8x16, i8x16, int16, int32_t)
+#undef REPLACE_LANE_CASE
+      case kExprS128LoadMem:
+        return ExecuteLoad<Simd128, Simd128>(decoder, code, pc, len,
+                                             MachineRepresentation::kSimd128);
+      case kExprS128StoreMem:
+        return ExecuteStore<Simd128, Simd128>(decoder, code, pc, len,
+                                              MachineRepresentation::kSimd128);
+#define SHIFT_CASE(op, name, stype, count, expr)                         \
+  case kExpr##op: {                                                      \
+    SimdShiftImmediate<Decoder::kNoValidate> imm(decoder, code->at(pc)); \
+    ++len;                                                               \
+    WasmValue v = Pop();                                                 \
+    stype s = v.to_s128().to_##name();                                   \
+    stype res;                                                           \
+    for (size_t i = 0; i < count; ++i) {                                 \
+      auto a = s.val[i];                                                 \
+      res.val[i] = expr;                                                 \
+    }                                                                    \
+    Push(WasmValue(Simd128(res)));                                       \
+    return true;                                                         \
+  }
+        SHIFT_CASE(I32x4Shl, i32x4, int4, 4, a << imm.shift)
+        SHIFT_CASE(I32x4ShrS, i32x4, int4, 4, a >> imm.shift)
+        SHIFT_CASE(I32x4ShrU, i32x4, int4, 4,
+                   static_cast<uint32_t>(a) >> imm.shift)
+        SHIFT_CASE(I16x8Shl, i16x8, int8, 8, a << imm.shift)
+        SHIFT_CASE(I16x8ShrS, i16x8, int8, 8, a >> imm.shift)
+        SHIFT_CASE(I16x8ShrU, i16x8, int8, 8,
+                   static_cast<uint16_t>(a) >> imm.shift)
+        SHIFT_CASE(I8x16Shl, i8x16, int16, 16, a << imm.shift)
+        SHIFT_CASE(I8x16ShrS, i8x16, int16, 16, a >> imm.shift)
+        SHIFT_CASE(I8x16ShrU, i8x16, int16, 16,
+                   static_cast<uint8_t>(a) >> imm.shift)
+#undef SHIFT_CASE
+#define CONVERT_CASE(op, src_type, name, dst_type, count, start_index, ctype, \
+                     expr)                                                    \
+  case kExpr##op: {                                                           \
+    WasmValue v = Pop();                                                      \
+    src_type s = v.to_s128().to_##name();                                     \
+    dst_type res;                                                             \
+    for (size_t i = 0; i < count; ++i) {                                      \
+      ctype a = s.val[start_index + i];                                       \
+      res.val[i] = expr;                                                      \
+    }                                                                         \
+    Push(WasmValue(Simd128(res)));                                            \
+    return true;                                                              \
+  }
+        CONVERT_CASE(F32x4SConvertI32x4, int4, i32x4, float4, 4, 0, int32_t,
+                     static_cast<float>(a))
+        CONVERT_CASE(F32x4UConvertI32x4, int4, i32x4, float4, 4, 0, uint32_t,
+                     static_cast<float>(a))
+        CONVERT_CASE(I32x4SConvertF32x4, float4, f32x4, int4, 4, 0, double,
+                     std::isnan(a) ? 0
+                                   : a<kMinInt ? kMinInt : a> kMaxInt
+                                         ? kMaxInt
+                                         : static_cast<int32_t>(a))
+        CONVERT_CASE(I32x4UConvertF32x4, float4, f32x4, int4, 4, 0, double,
+                     std::isnan(a)
+                         ? 0
+                         : a<0 ? 0 : a> kMaxUInt32 ? kMaxUInt32
+                                                   : static_cast<uint32_t>(a))
+        CONVERT_CASE(I32x4SConvertI16x8High, int8, i16x8, int4, 4, 4, int16_t,
+                     a)
+        CONVERT_CASE(I32x4UConvertI16x8High, int8, i16x8, int4, 4, 4, uint16_t,
+                     a)
+        CONVERT_CASE(I32x4SConvertI16x8Low, int8, i16x8, int4, 4, 0, int16_t, a)
+        CONVERT_CASE(I32x4UConvertI16x8Low, int8, i16x8, int4, 4, 0, uint16_t,
+                     a)
+        CONVERT_CASE(I16x8SConvertI8x16High, int16, i8x16, int8, 8, 8, int8_t,
+                     a)
+        CONVERT_CASE(I16x8UConvertI8x16High, int16, i8x16, int8, 8, 8, uint8_t,
+                     a)
+        CONVERT_CASE(I16x8SConvertI8x16Low, int16, i8x16, int8, 8, 0, int8_t, a)
+        CONVERT_CASE(I16x8UConvertI8x16Low, int16, i8x16, int8, 8, 0, uint8_t,
+                     a)
+#undef CONVERT_CASE
+#define PACK_CASE(op, src_type, name, dst_type, count, ctype, dst_ctype,    \
+                  is_unsigned)                                              \
+  case kExpr##op: {                                                         \
+    WasmValue v2 = Pop();                                                   \
+    WasmValue v1 = Pop();                                                   \
+    src_type s1 = v1.to_s128().to_##name();                                 \
+    src_type s2 = v2.to_s128().to_##name();                                 \
+    dst_type res;                                                           \
+    int64_t min = std::numeric_limits<ctype>::min();                        \
+    int64_t max = std::numeric_limits<ctype>::max();                        \
+    for (size_t i = 0; i < count; ++i) {                                    \
+      int32_t v = i < count / 2 ? s1.val[i] : s2.val[i - count / 2];        \
+      int64_t a = is_unsigned ? static_cast<int64_t>(v & 0xFFFFFFFFu) : v;  \
+      res.val[i] = static_cast<dst_ctype>(std::max(min, std::min(max, a))); \
+    }                                                                       \
+    Push(WasmValue(Simd128(res)));                                          \
+    return true;                                                            \
+  }
+        PACK_CASE(I16x8SConvertI32x4, int4, i32x4, int8, 8, int16_t, int16_t,
+                  false)
+        PACK_CASE(I16x8UConvertI32x4, int4, i32x4, int8, 8, uint16_t, int16_t,
+                  true)
+        PACK_CASE(I8x16SConvertI16x8, int8, i16x8, int16, 16, int8_t, int8_t,
+                  false)
+        PACK_CASE(I8x16UConvertI16x8, int8, i16x8, int16, 16, uint8_t, int8_t,
+                  true)
+#undef PACK_CASE
+      case kExprS128Select: {
+        int4 v2 = Pop().to_s128().to_i32x4();
+        int4 v1 = Pop().to_s128().to_i32x4();
+        int4 bool_val = Pop().to_s128().to_i32x4();
+        int4 res;
+        for (size_t i = 0; i < 4; ++i) {
+          res.val[i] = v2.val[i] ^ ((v1.val[i] ^ v2.val[i]) & bool_val.val[i]);
+        }
+        Push(WasmValue(Simd128(res)));
+        return true;
+      }
+#define ADD_HORIZ_CASE(op, name, stype, count)                    \
+  case kExpr##op: {                                               \
+    WasmValue v2 = Pop();                                         \
+    WasmValue v1 = Pop();                                         \
+    stype s1 = v1.to_s128().to_##name();                          \
+    stype s2 = v2.to_s128().to_##name();                          \
+    stype res;                                                    \
+    for (size_t i = 0; i < count / 2; ++i) {                      \
+      res.val[i] = s1.val[i * 2] + s1.val[i * 2 + 1];             \
+      res.val[i + count / 2] = s2.val[i * 2] + s2.val[i * 2 + 1]; \
+    }                                                             \
+    Push(WasmValue(Simd128(res)));                                \
+    return true;                                                  \
+  }
+        ADD_HORIZ_CASE(I32x4AddHoriz, i32x4, int4, 4)
+        ADD_HORIZ_CASE(F32x4AddHoriz, f32x4, float4, 4)
+        ADD_HORIZ_CASE(I16x8AddHoriz, i16x8, int8, 8)
+#undef ADD_HORIZ_CASE
+      case kExprS8x16Shuffle: {
+        Simd8x16ShuffleImmediate<Decoder::kNoValidate> imm(decoder,
+                                                           code->at(pc));
+        len += 16;
+        int16 v2 = Pop().to_s128().to_i8x16();
+        int16 v1 = Pop().to_s128().to_i8x16();
+        int16 res;
+        for (size_t i = 0; i < kSimd128Size; ++i) {
+          int lane = imm.shuffle[i];
+          res.val[i] =
+              lane < kSimd128Size ? v1.val[lane] : v2.val[lane - kSimd128Size];
+        }
+        Push(WasmValue(Simd128(res)));
+        return true;
+      }
+#define REDUCTION_CASE(op, name, stype, count, operation) \
+  case kExpr##op: {                                       \
+    stype s = Pop().to_s128().to_##name();                \
+    int32_t res = s.val[0];                               \
+    for (size_t i = 1; i < count; ++i) {                  \
+      res = res operation static_cast<int32_t>(s.val[i]); \
+    }                                                     \
+    Push(WasmValue(res));                                 \
+    return true;                                          \
+  }
+        REDUCTION_CASE(S1x4AnyTrue, i32x4, int4, 4, |)
+        REDUCTION_CASE(S1x4AllTrue, i32x4, int4, 4, &)
+        REDUCTION_CASE(S1x8AnyTrue, i16x8, int8, 8, |)
+        REDUCTION_CASE(S1x8AllTrue, i16x8, int8, 8, &)
+        REDUCTION_CASE(S1x16AnyTrue, i8x16, int16, 16, |)
+        REDUCTION_CASE(S1x16AllTrue, i8x16, int16, 16, &)
+#undef REDUCTION_CASE
+      default:
+        return false;
+    }
+  }
+
   // Check if our control stack (frames_) exceeds the limit. Trigger stack
   // overflow if it does, and unwinding the current frame.
   // Returns true if execution can continue, false if the current activation was
@@ -1607,7 +2047,7 @@ class ThreadImpl {
     const size_t stack_size_limit = FLAG_stack_size * KB;
     // Sum up the value stack size and the control stack size.
     const size_t current_stack_size =
-        (sp_ - stack_start_) + frames_.size() * sizeof(Frame);
+        (sp_ - stack_.get()) + frames_.size() * sizeof(Frame);
     if (V8_LIKELY(current_stack_size <= stack_size_limit)) {
       return true;
     }
@@ -1628,7 +2068,7 @@ class ThreadImpl {
     DCHECK_LE(code->function->sig->parameter_count() +
                   code->locals.type_list.size() +
                   code->side_table->max_stack_height_,
-              stack_limit_ - stack_start_ - frames_.back().sp);
+              stack_limit_ - stack_.get() - frames_.back().sp);
 
     Decoder decoder(code->start, code->end);
     pc_t limit = code->end - code->start;
@@ -1693,25 +2133,22 @@ class ThreadImpl {
         case kExprNop:
           break;
         case kExprBlock: {
-          BlockTypeOperand<Decoder::kNoValidate> operand(&decoder,
-                                                         code->at(pc));
-          len = 1 + operand.length;
+          BlockTypeImmediate<Decoder::kNoValidate> imm(&decoder, code->at(pc));
+          len = 1 + imm.length;
           break;
         }
         case kExprLoop: {
-          BlockTypeOperand<Decoder::kNoValidate> operand(&decoder,
-                                                         code->at(pc));
-          len = 1 + operand.length;
+          BlockTypeImmediate<Decoder::kNoValidate> imm(&decoder, code->at(pc));
+          len = 1 + imm.length;
           break;
         }
         case kExprIf: {
-          BlockTypeOperand<Decoder::kNoValidate> operand(&decoder,
-                                                         code->at(pc));
+          BlockTypeImmediate<Decoder::kNoValidate> imm(&decoder, code->at(pc));
           WasmValue cond = Pop();
           bool is_true = cond.to<uint32_t>() != 0;
           if (is_true) {
             // fall through to the true block.
-            len = 1 + operand.length;
+            len = 1 + imm.length;
             TRACE("  true => fallthrough\n");
           } else {
             len = LookupTargetDelta(code, pc);
@@ -1732,33 +2169,31 @@ class ThreadImpl {
           break;
         }
         case kExprBr: {
-          BreakDepthOperand<Decoder::kNoValidate> operand(&decoder,
-                                                          code->at(pc));
-          len = DoBreak(code, pc, operand.depth);
+          BreakDepthImmediate<Decoder::kNoValidate> imm(&decoder, code->at(pc));
+          len = DoBreak(code, pc, imm.depth);
           TRACE("  br => @%zu\n", pc + len);
           break;
         }
         case kExprBrIf: {
-          BreakDepthOperand<Decoder::kNoValidate> operand(&decoder,
-                                                          code->at(pc));
+          BreakDepthImmediate<Decoder::kNoValidate> imm(&decoder, code->at(pc));
           WasmValue cond = Pop();
           bool is_true = cond.to<uint32_t>() != 0;
           if (is_true) {
-            len = DoBreak(code, pc, operand.depth);
+            len = DoBreak(code, pc, imm.depth);
             TRACE("  br_if => @%zu\n", pc + len);
           } else {
             TRACE("  false => fallthrough\n");
-            len = 1 + operand.length;
+            len = 1 + imm.length;
           }
           break;
         }
         case kExprBrTable: {
-          BranchTableOperand<Decoder::kNoValidate> operand(&decoder,
-                                                           code->at(pc));
-          BranchTableIterator<Decoder::kNoValidate> iterator(&decoder, operand);
+          BranchTableImmediate<Decoder::kNoValidate> imm(&decoder,
+                                                         code->at(pc));
+          BranchTableIterator<Decoder::kNoValidate> iterator(&decoder, imm);
           uint32_t key = Pop().to<uint32_t>();
           uint32_t depth = 0;
-          if (key >= operand.table_count) key = operand.table_count;
+          if (key >= imm.table_count) key = imm.table_count;
           for (uint32_t i = 0; i <= key; i++) {
             DCHECK(iterator.has_next());
             depth = iterator.next();
@@ -1780,51 +2215,48 @@ class ThreadImpl {
           break;
         }
         case kExprI32Const: {
-          ImmI32Operand<Decoder::kNoValidate> operand(&decoder, code->at(pc));
-          Push(WasmValue(operand.value));
-          len = 1 + operand.length;
+          ImmI32Immediate<Decoder::kNoValidate> imm(&decoder, code->at(pc));
+          Push(WasmValue(imm.value));
+          len = 1 + imm.length;
           break;
         }
         case kExprI64Const: {
-          ImmI64Operand<Decoder::kNoValidate> operand(&decoder, code->at(pc));
-          Push(WasmValue(operand.value));
-          len = 1 + operand.length;
+          ImmI64Immediate<Decoder::kNoValidate> imm(&decoder, code->at(pc));
+          Push(WasmValue(imm.value));
+          len = 1 + imm.length;
           break;
         }
         case kExprF32Const: {
-          ImmF32Operand<Decoder::kNoValidate> operand(&decoder, code->at(pc));
-          Push(WasmValue(operand.value));
-          len = 1 + operand.length;
+          ImmF32Immediate<Decoder::kNoValidate> imm(&decoder, code->at(pc));
+          Push(WasmValue(imm.value));
+          len = 1 + imm.length;
           break;
         }
         case kExprF64Const: {
-          ImmF64Operand<Decoder::kNoValidate> operand(&decoder, code->at(pc));
-          Push(WasmValue(operand.value));
-          len = 1 + operand.length;
+          ImmF64Immediate<Decoder::kNoValidate> imm(&decoder, code->at(pc));
+          Push(WasmValue(imm.value));
+          len = 1 + imm.length;
           break;
         }
         case kExprGetLocal: {
-          LocalIndexOperand<Decoder::kNoValidate> operand(&decoder,
-                                                          code->at(pc));
-          Push(GetStackValue(frames_.back().sp + operand.index));
-          len = 1 + operand.length;
+          LocalIndexImmediate<Decoder::kNoValidate> imm(&decoder, code->at(pc));
+          Push(GetStackValue(frames_.back().sp + imm.index));
+          len = 1 + imm.length;
           break;
         }
         case kExprSetLocal: {
-          LocalIndexOperand<Decoder::kNoValidate> operand(&decoder,
-                                                          code->at(pc));
+          LocalIndexImmediate<Decoder::kNoValidate> imm(&decoder, code->at(pc));
           WasmValue val = Pop();
-          SetStackValue(frames_.back().sp + operand.index, val);
-          len = 1 + operand.length;
+          SetStackValue(frames_.back().sp + imm.index, val);
+          len = 1 + imm.length;
           break;
         }
         case kExprTeeLocal: {
-          LocalIndexOperand<Decoder::kNoValidate> operand(&decoder,
-                                                          code->at(pc));
+          LocalIndexImmediate<Decoder::kNoValidate> imm(&decoder, code->at(pc));
           WasmValue val = Pop();
-          SetStackValue(frames_.back().sp + operand.index, val);
+          SetStackValue(frames_.back().sp + imm.index, val);
           Push(val);
-          len = 1 + operand.length;
+          len = 1 + imm.length;
           break;
         }
         case kExprDrop: {
@@ -1832,9 +2264,9 @@ class ThreadImpl {
           break;
         }
         case kExprCallFunction: {
-          CallFunctionOperand<Decoder::kNoValidate> operand(&decoder,
-                                                            code->at(pc));
-          InterpreterCode* target = codemap()->GetCode(operand.index);
+          CallFunctionImmediate<Decoder::kNoValidate> imm(&decoder,
+                                                          code->at(pc));
+          InterpreterCode* target = codemap()->GetCode(imm.index);
           if (target->function->imported) {
             CommitPc(pc);
             ExternalCallResult result =
@@ -1851,7 +2283,7 @@ class ThreadImpl {
                 UNREACHABLE();
               case ExternalCallResult::EXTERNAL_RETURNED:
                 PAUSE_IF_BREAK_FLAG(AfterCall);
-                len = 1 + operand.length;
+                len = 1 + imm.length;
                 break;
               case ExternalCallResult::EXTERNAL_UNWOUND:
                 return;
@@ -1865,13 +2297,13 @@ class ThreadImpl {
           continue;  // don't bump pc
         } break;
         case kExprCallIndirect: {
-          CallIndirectOperand<Decoder::kNoValidate> operand(&decoder,
-                                                            code->at(pc));
+          CallIndirectImmediate<Decoder::kNoValidate> imm(&decoder,
+                                                          code->at(pc));
           uint32_t entry_index = Pop().to<uint32_t>();
           // Assume only one table for now.
-          DCHECK_LE(module()->function_tables.size(), 1u);
+          DCHECK_LE(module()->tables.size(), 1u);
           ExternalCallResult result =
-              CallIndirectFunction(0, entry_index, operand.sig_index);
+              CallIndirectFunction(0, entry_index, imm.sig_index);
           switch (result.type) {
             case ExternalCallResult::INTERNAL:
               // The import is a function of this instance. Call it directly.
@@ -1886,17 +2318,17 @@ class ThreadImpl {
               return DoTrap(kTrapFuncSigMismatch, pc);
             case ExternalCallResult::EXTERNAL_RETURNED:
               PAUSE_IF_BREAK_FLAG(AfterCall);
-              len = 1 + operand.length;
+              len = 1 + imm.length;
               break;
             case ExternalCallResult::EXTERNAL_UNWOUND:
               return;
           }
         } break;
         case kExprGetGlobal: {
-          GlobalIndexOperand<Decoder::kNoValidate> operand(&decoder,
-                                                           code->at(pc));
-          const WasmGlobal* global = &module()->globals[operand.index];
-          byte* ptr = instance_object_->globals_start() + global->offset;
+          GlobalIndexImmediate<Decoder::kNoValidate> imm(&decoder,
+                                                         code->at(pc));
+          const WasmGlobal* global = &module()->globals[imm.index];
+          byte* ptr = GetGlobalPtr(global);
           WasmValue val;
           switch (global->type) {
 #define CASE_TYPE(wasm, ctype)                       \
@@ -1909,14 +2341,14 @@ class ThreadImpl {
               UNREACHABLE();
           }
           Push(val);
-          len = 1 + operand.length;
+          len = 1 + imm.length;
           break;
         }
         case kExprSetGlobal: {
-          GlobalIndexOperand<Decoder::kNoValidate> operand(&decoder,
-                                                           code->at(pc));
-          const WasmGlobal* global = &module()->globals[operand.index];
-          byte* ptr = instance_object_->globals_start() + global->offset;
+          GlobalIndexImmediate<Decoder::kNoValidate> imm(&decoder,
+                                                         code->at(pc));
+          const WasmGlobal* global = &module()->globals[imm.index];
+          byte* ptr = GetGlobalPtr(global);
           WasmValue val = Pop();
           switch (global->type) {
 #define CASE_TYPE(wasm, ctype)                        \
@@ -1928,7 +2360,7 @@ class ThreadImpl {
             default:
               UNREACHABLE();
           }
-          len = 1 + operand.length;
+          len = 1 + imm.length;
           break;
         }
 
@@ -1979,7 +2411,7 @@ class ThreadImpl {
   case kExpr##name: {                                               \
     uint32_t index = Pop().to<uint32_t>();                          \
     ctype result;                                                   \
-    byte* addr = BoundsCheckMem<mtype>(0, index);                   \
+    Address addr = BoundsCheckMem<mtype>(0, index);                 \
     if (!addr) {                                                    \
       result = defval;                                              \
     } else {                                                        \
@@ -2004,7 +2436,7 @@ class ThreadImpl {
   case kExpr##name: {                                                          \
     WasmValue val = Pop();                                                     \
     uint32_t index = Pop().to<uint32_t>();                                     \
-    byte* addr = BoundsCheckMem<mtype>(0, index);                              \
+    Address addr = BoundsCheckMem<mtype>(0, index);                            \
     if (addr) {                                                                \
       *(reinterpret_cast<mtype*>(addr)) = static_cast<mtype>(val.to<ctype>()); \
     }                                                                          \
@@ -2019,25 +2451,26 @@ class ThreadImpl {
           ASMJS_STORE_CASE(F64AsmjsStoreMem, double, double);
 #undef ASMJS_STORE_CASE
         case kExprGrowMemory: {
-          MemoryIndexOperand<Decoder::kNoValidate> operand(&decoder,
-                                                           code->at(pc));
+          MemoryIndexImmediate<Decoder::kNoValidate> imm(&decoder,
+                                                         code->at(pc));
           uint32_t delta_pages = Pop().to<uint32_t>();
-          Handle<WasmMemoryObject> memory(instance_object_->memory_object());
+          Handle<WasmMemoryObject> memory(instance_object_->memory_object(),
+                                          instance_object_->GetIsolate());
           Isolate* isolate = memory->GetIsolate();
           int32_t result = WasmMemoryObject::Grow(isolate, memory, delta_pages);
           Push(WasmValue(result));
-          len = 1 + operand.length;
+          len = 1 + imm.length;
           // Treat one grow_memory instruction like 1000 other instructions,
           // because it is a really expensive operation.
           if (max > 0) max = std::max(0, max - 1000);
           break;
         }
         case kExprMemorySize: {
-          MemoryIndexOperand<Decoder::kNoValidate> operand(&decoder,
-                                                           code->at(pc));
+          MemoryIndexImmediate<Decoder::kNoValidate> imm(&decoder,
+                                                         code->at(pc));
           Push(WasmValue(static_cast<uint32_t>(instance_object_->memory_size() /
                                                kWasmPageSize)));
-          len = 1 + operand.length;
+          len = 1 + imm.length;
           break;
         }
         // We need to treat kExprI32ReinterpretF32 and kExprI64ReinterpretF64
@@ -2053,6 +2486,18 @@ class ThreadImpl {
           Push(WasmValue(ExecuteI64ReinterpretF64(val)));
           break;
         }
+#define SIGN_EXTENSION_CASE(name, wtype, ntype)        \
+  case kExpr##name: {                                  \
+    ntype val = static_cast<ntype>(Pop().to<wtype>()); \
+    Push(WasmValue(static_cast<wtype>(val)));          \
+    break;                                             \
+  }
+          SIGN_EXTENSION_CASE(I32SExtendI8, int32_t, int8_t);
+          SIGN_EXTENSION_CASE(I32SExtendI16, int32_t, int16_t);
+          SIGN_EXTENSION_CASE(I64SExtendI8, int64_t, int8_t);
+          SIGN_EXTENSION_CASE(I64SExtendI16, int64_t, int16_t);
+          SIGN_EXTENSION_CASE(I64SExtendI32, int64_t, int32_t);
+#undef SIGN_EXTENSION_CASE
         case kNumericPrefix: {
           ++len;
           if (!ExecuteNumericOp(opcode, &decoder, code, pc, len)) return;
@@ -2062,6 +2507,11 @@ class ThreadImpl {
           if (!ExecuteAtomicOp(opcode, &decoder, code, pc, len)) return;
           break;
         }
+        case kSimdPrefix: {
+          ++len;
+          if (!ExecuteSimdOp(opcode, &decoder, code, pc, len)) return;
+          break;
+        }
 
 #define EXECUTE_SIMPLE_BINOP(name, ctype, op)               \
   case kExpr##name: {                                       \
@@ -2176,18 +2626,18 @@ class ThreadImpl {
 
   void EnsureStackSpace(size_t size) {
     if (V8_LIKELY(static_cast<size_t>(stack_limit_ - sp_) >= size)) return;
-    size_t old_size = stack_limit_ - stack_start_;
+    size_t old_size = stack_limit_ - stack_.get();
     size_t requested_size =
-        base::bits::RoundUpToPowerOfTwo64((sp_ - stack_start_) + size);
+        base::bits::RoundUpToPowerOfTwo64((sp_ - stack_.get()) + size);
     size_t new_size = Max(size_t{8}, Max(2 * old_size, requested_size));
-    WasmValue* new_stack = zone_->NewArray<WasmValue>(new_size);
-    memcpy(new_stack, stack_start_, old_size * sizeof(*sp_));
-    sp_ = new_stack + (sp_ - stack_start_);
-    stack_start_ = new_stack;
-    stack_limit_ = new_stack + new_size;
+    std::unique_ptr<WasmValue[]> new_stack(new WasmValue[new_size]);
+    memcpy(new_stack.get(), stack_.get(), old_size * sizeof(*sp_));
+    sp_ = new_stack.get() + (sp_ - stack_.get());
+    stack_ = std::move(new_stack);
+    stack_limit_ = stack_.get() + new_size;
   }
 
-  sp_t StackHeight() { return sp_ - stack_start_; }
+  sp_t StackHeight() { return sp_ - stack_.get(); }
 
   void TraceValueStack() {
 #ifdef DEBUG
@@ -2259,26 +2709,23 @@ class ThreadImpl {
     size_t offset = 0;
     WasmValue* wasm_args = sp_ - num_args;
     for (int i = 0; i < num_args; ++i) {
-      uint32_t param_size = 1 << ElementSizeLog2Of(sig->GetParam(i));
+      int param_size = ValueTypes::ElementSizeInBytes(sig->GetParam(i));
       if (arg_buffer.size() < offset + param_size) {
         arg_buffer.resize(std::max(2 * arg_buffer.size(), offset + param_size));
       }
+      Address address = reinterpret_cast<Address>(arg_buffer.data()) + offset;
       switch (sig->GetParam(i)) {
         case kWasmI32:
-          WriteUnalignedValue(arg_buffer.data() + offset,
-                              wasm_args[i].to<uint32_t>());
+          WriteUnalignedValue(address, wasm_args[i].to<uint32_t>());
           break;
         case kWasmI64:
-          WriteUnalignedValue(arg_buffer.data() + offset,
-                              wasm_args[i].to<uint64_t>());
+          WriteUnalignedValue(address, wasm_args[i].to<uint64_t>());
           break;
         case kWasmF32:
-          WriteUnalignedValue(arg_buffer.data() + offset,
-                              wasm_args[i].to<float>());
+          WriteUnalignedValue(address, wasm_args[i].to<float>());
           break;
         case kWasmF64:
-          WriteUnalignedValue(arg_buffer.data() + offset,
-                              wasm_args[i].to<double>());
+          WriteUnalignedValue(address, wasm_args[i].to<double>());
           break;
         default:
           UNIMPLEMENTED();
@@ -2288,9 +2735,9 @@ class ThreadImpl {
 
     // Ensure that there is enough space in the arg_buffer to hold the return
     // value(s).
-    uint32_t return_size = 0;
+    size_t return_size = 0;
     for (ValueType t : sig->returns()) {
-      return_size += 1 << ElementSizeLog2Of(t);
+      return_size += ValueTypes::ElementSizeInBytes(t);
     }
     if (arg_buffer.size() < return_size) {
       arg_buffer.resize(return_size);
@@ -2306,7 +2753,7 @@ class ThreadImpl {
                   "code below needs adaption");
     Handle<Object> args[compiler::CWasmEntryParameters::kNumParameters];
     args[compiler::CWasmEntryParameters::kCodeObject] = Handle<Object>::cast(
-        isolate->factory()->NewForeign(code->instructions().start(), TENURED));
+        isolate->factory()->NewForeign(code->instruction_start(), TENURED));
     args[compiler::CWasmEntryParameters::kWasmInstance] = instance;
     args[compiler::CWasmEntryParameters::kArgumentsBuffer] = arg_buffer_obj;
 
@@ -2318,7 +2765,12 @@ class ThreadImpl {
           maybe_retval.is_null() ? " with exception" : "");
 
     if (maybe_retval.is_null()) {
-      DCHECK(!trap_handler::IsThreadInWasm());
+      // JSEntryStub may through a stack overflow before we actually get to wasm
+      // code or back to the interpreter, meaning the thread-in-wasm flag won't
+      // be cleared.
+      if (trap_handler::IsThreadInWasm()) {
+        trap_handler::ClearThreadInWasm();
+      }
       return TryHandleException(isolate);
     }
 
@@ -2330,18 +2782,19 @@ class ThreadImpl {
     if (sig->return_count() > 0) {
       // TODO(wasm): Handle multiple returns.
       DCHECK_EQ(1, sig->return_count());
+      Address address = reinterpret_cast<Address>(arg_buffer.data());
       switch (sig->GetReturn()) {
         case kWasmI32:
-          Push(WasmValue(ReadUnalignedValue<uint32_t>(arg_buffer.data())));
+          Push(WasmValue(ReadUnalignedValue<uint32_t>(address)));
           break;
         case kWasmI64:
-          Push(WasmValue(ReadUnalignedValue<uint64_t>(arg_buffer.data())));
+          Push(WasmValue(ReadUnalignedValue<uint64_t>(address)));
           break;
         case kWasmF32:
-          Push(WasmValue(ReadUnalignedValue<float>(arg_buffer.data())));
+          Push(WasmValue(ReadUnalignedValue<float>(address)));
           break;
         case kWasmF64:
-          Push(WasmValue(ReadUnalignedValue<double>(arg_buffer.data())));
+          Push(WasmValue(ReadUnalignedValue<double>(address)));
           break;
         default:
           UNIMPLEMENTED();
@@ -2350,6 +2803,19 @@ class ThreadImpl {
     return {ExternalCallResult::EXTERNAL_RETURNED};
   }
 
+  static WasmCode* GetTargetCode(WasmCodeManager* code_manager,
+                                 Address target) {
+    NativeModule* native_module = code_manager->LookupNativeModule(target);
+    if (native_module->is_jump_table_slot(target)) {
+      uint32_t func_index =
+          native_module->GetFunctionIndexFromJumpTableSlot(target);
+      return native_module->code(func_index);
+    }
+    WasmCode* code = native_module->Lookup(target);
+    DCHECK_EQ(code->instruction_start(), target);
+    return code;
+  }
+
   ExternalCallResult CallImportedFunction(uint32_t function_index) {
     // Use a new HandleScope to avoid leaking / accumulating handles in the
     // outer scope.
@@ -2358,13 +2824,10 @@ class ThreadImpl {
 
     DCHECK_GT(module()->num_imported_functions, function_index);
     Handle<WasmInstanceObject> instance;
-    WasmCode* code;
-    {
-      ImportedFunctionEntry entry(*instance_object_, function_index);
-      instance = handle(entry.instance(), isolate);
-      code = isolate->wasm_engine()->code_manager()->GetCodeFromStartAddress(
-          entry.target());
-    }
+    ImportedFunctionEntry entry(instance_object_, function_index);
+    instance = handle(entry.instance(), isolate);
+    WasmCode* code =
+        GetTargetCode(isolate->wasm_engine()->code_manager(), entry.target());
     FunctionSig* sig = codemap()->module()->functions[function_index].sig;
     return CallExternalWasmFunction(isolate, instance, code, sig);
   }
@@ -2404,20 +2867,16 @@ class ThreadImpl {
       return {ExternalCallResult::INVALID_FUNC};
     }
 
-    WasmCode* code;
-    Handle<WasmInstanceObject> instance;
-    {
-      IndirectFunctionTableEntry entry(*instance_object_, entry_index);
-      // Signature check.
-      if (entry.sig_id() != static_cast<int32_t>(expected_sig_id)) {
-        return {ExternalCallResult::SIGNATURE_MISMATCH};
-      }
-
-      instance = handle(entry.instance(), isolate);
-      code = isolate->wasm_engine()->code_manager()->GetCodeFromStartAddress(
-          entry.target());
+    IndirectFunctionTableEntry entry(instance_object_, entry_index);
+    // Signature check.
+    if (entry.sig_id() != static_cast<int32_t>(expected_sig_id)) {
+      return {ExternalCallResult::SIGNATURE_MISMATCH};
     }
 
+    Handle<WasmInstanceObject> instance = handle(entry.instance(), isolate);
+    WasmCode* code =
+        GetTargetCode(isolate->wasm_engine()->code_manager(), entry.target());
+
     // Call either an internal or external WASM function.
     HandleScope scope(isolate);
     FunctionSig* signature = module()->signatures[sig_index];
@@ -2431,7 +2890,7 @@ class ThreadImpl {
     }
 
     // Call to external function.
-    if (code->kind() == wasm::WasmCode::kInterpreterStub ||
+    if (code->kind() == wasm::WasmCode::kInterpreterEntry ||
         code->kind() == wasm::WasmCode::kWasmToJsWrapper) {
       return CallExternalWasmFunction(isolate, instance, code, signature);
     }
@@ -2741,7 +3200,7 @@ WasmValue InterpretedFrame::GetLocalValue(int index) const {
 WasmValue InterpretedFrame::GetStackValue(int index) const {
   return ToImpl(this)->GetStackValue(index);
 }
-void InterpretedFrame::Deleter::operator()(InterpretedFrame* ptr) {
+void InterpretedFrameDeleter::operator()(InterpretedFrame* ptr) {
   delete ToImpl(ptr);
 }
 
diff --git a/deps/v8/src/wasm/wasm-interpreter.h b/deps/v8/src/wasm/wasm-interpreter.h
index 29b78c5a61c7a1..896196ef678ae2 100644
--- a/deps/v8/src/wasm/wasm-interpreter.h
+++ b/deps/v8/src/wasm/wasm-interpreter.h
@@ -10,9 +10,6 @@
 #include "src/zone/zone-containers.h"
 
 namespace v8 {
-namespace base {
-class AccountingAllocator;
-}
 
 namespace internal {
 class WasmInstanceObject;
@@ -70,12 +67,6 @@ class InterpretedFrame {
   WasmValue GetLocalValue(int index) const;
   WasmValue GetStackValue(int index) const;
 
-  // Deleter struct to delete the underlying InterpretedFrameImpl without
-  // violating language specifications.
-  struct Deleter {
-    void operator()(InterpretedFrame* ptr);
-  };
-
  private:
   friend class WasmInterpreter;
   // Don't instante InterpretedFrames; they will be allocated as
@@ -84,6 +75,12 @@ class InterpretedFrame {
   DISALLOW_COPY_AND_ASSIGN(InterpretedFrame);
 };
 
+// Deleter struct to delete the underlying InterpretedFrameImpl without
+// violating language specifications.
+struct InterpretedFrameDeleter {
+  void operator()(InterpretedFrame* ptr);
+};
+
 // An interpreter capable of executing WebAssembly.
 class V8_EXPORT_PRIVATE WasmInterpreter {
  public:
@@ -105,7 +102,7 @@ class V8_EXPORT_PRIVATE WasmInterpreter {
     AfterCall = 1 << 1
   };
 
-  using FramePtr = std::unique_ptr<InterpretedFrame, InterpretedFrame::Deleter>;
+  using FramePtr = std::unique_ptr<InterpretedFrame, InterpretedFrameDeleter>;
 
   // Representation of a thread in the interpreter.
   class V8_EXPORT_PRIVATE Thread {
diff --git a/deps/v8/src/wasm/wasm-js.cc b/deps/v8/src/wasm/wasm-js.cc
index 13f87ec8dfe116..1f216c030899d3 100644
--- a/deps/v8/src/wasm/wasm-js.cc
+++ b/deps/v8/src/wasm/wasm-js.cc
@@ -13,6 +13,8 @@
 #include "src/heap/factory.h"
 #include "src/isolate.h"
 #include "src/objects-inl.h"
+#include "src/objects/js-promise-inl.h"
+#include "src/objects/templates.h"
 #include "src/parsing/parse-info.h"
 #include "src/trap-handler/trap-handler.h"
 #include "src/wasm/wasm-engine.h"
@@ -162,6 +164,177 @@ void WebAssemblyCompileStreaming(
   i_isolate->wasm_compile_streaming_callback()(args);
 }
 
+namespace {
+// This class resolves the result of WebAssembly.compile. It just places the
+// compilation result in the supplied {promise}.
+class AsyncCompilationResolver : public i::wasm::CompilationResultResolver {
+ public:
+  AsyncCompilationResolver(i::Isolate* isolate, i::Handle<i::JSPromise> promise)
+      : promise_(isolate->global_handles()->Create(*promise)) {}
+
+  ~AsyncCompilationResolver() {
+    i::GlobalHandles::Destroy(i::Handle<i::Object>::cast(promise_).location());
+  }
+
+  void OnCompilationSucceeded(i::Handle<i::WasmModuleObject> result) override {
+    i::MaybeHandle<i::Object> promise_result =
+        i::JSPromise::Resolve(promise_, result);
+    CHECK_EQ(promise_result.is_null(),
+             promise_->GetIsolate()->has_pending_exception());
+  }
+
+  void OnCompilationFailed(i::Handle<i::Object> error_reason) override {
+    i::MaybeHandle<i::Object> promise_result =
+        i::JSPromise::Reject(promise_, error_reason);
+    CHECK_EQ(promise_result.is_null(),
+             promise_->GetIsolate()->has_pending_exception());
+  }
+
+ private:
+  i::Handle<i::JSPromise> promise_;
+};
+
+// This class resolves the result of WebAssembly.instantiate(module, imports).
+// It just places the instantiation result in the supplied {promise}.
+class InstantiateModuleResultResolver
+    : public i::wasm::InstantiationResultResolver {
+ public:
+  InstantiateModuleResultResolver(i::Isolate* isolate,
+                                  i::Handle<i::JSPromise> promise)
+      : promise_(isolate->global_handles()->Create(*promise)) {}
+
+  ~InstantiateModuleResultResolver() {
+    i::GlobalHandles::Destroy(i::Handle<i::Object>::cast(promise_).location());
+  }
+
+  void OnInstantiationSucceeded(
+      i::Handle<i::WasmInstanceObject> instance) override {
+    i::MaybeHandle<i::Object> promise_result =
+        i::JSPromise::Resolve(promise_, instance);
+    CHECK_EQ(promise_result.is_null(),
+             promise_->GetIsolate()->has_pending_exception());
+  }
+
+  void OnInstantiationFailed(i::Handle<i::Object> error_reason) override {
+    i::MaybeHandle<i::Object> promise_result =
+        i::JSPromise::Reject(promise_, error_reason);
+    CHECK_EQ(promise_result.is_null(),
+             promise_->GetIsolate()->has_pending_exception());
+  }
+
+ private:
+  i::Handle<i::JSPromise> promise_;
+};
+
+// This class resolves the result of WebAssembly.instantiate(bytes, imports).
+// For that it creates a new {JSObject} which contains both the provided
+// {WasmModuleObject} and the resulting {WebAssemblyInstanceObject} itself.
+class InstantiateBytesResultResolver
+    : public i::wasm::InstantiationResultResolver {
+ public:
+  InstantiateBytesResultResolver(i::Isolate* isolate,
+                                 i::Handle<i::JSPromise> promise,
+                                 i::Handle<i::WasmModuleObject> module)
+      : isolate_(isolate),
+        promise_(isolate_->global_handles()->Create(*promise)),
+        module_(isolate_->global_handles()->Create(*module)) {}
+
+  ~InstantiateBytesResultResolver() {
+    i::GlobalHandles::Destroy(i::Handle<i::Object>::cast(promise_).location());
+    i::GlobalHandles::Destroy(i::Handle<i::Object>::cast(module_).location());
+  }
+
+  void OnInstantiationSucceeded(
+      i::Handle<i::WasmInstanceObject> instance) override {
+    // The result is a JSObject with 2 fields which contain the
+    // WasmInstanceObject and the WasmModuleObject.
+    i::Handle<i::JSObject> result =
+        isolate_->factory()->NewJSObject(isolate_->object_function());
+
+    const uint8_t* instance_str = reinterpret_cast<const uint8_t*>("instance");
+    i::Handle<i::String> instance_name =
+        isolate_->factory()
+            ->NewStringFromOneByte(i::Vector<const uint8_t>(
+                instance_str,
+                i::StrLength(reinterpret_cast<const char*>(instance_str))))
+            .ToHandleChecked();
+
+    const uint8_t* module_str = reinterpret_cast<const uint8_t*>("module");
+    i::Handle<i::String> module_name =
+        isolate_->factory()
+            ->NewStringFromOneByte(i::Vector<const uint8_t>(
+                module_str,
+                i::StrLength(reinterpret_cast<const char*>(module_str))))
+            .ToHandleChecked();
+
+    i::JSObject::AddProperty(isolate_, result, instance_name, instance,
+                             i::NONE);
+    i::JSObject::AddProperty(isolate_, result, module_name, module_, i::NONE);
+
+    i::MaybeHandle<i::Object> promise_result =
+        i::JSPromise::Resolve(promise_, result);
+    CHECK_EQ(promise_result.is_null(), isolate_->has_pending_exception());
+  }
+
+  void OnInstantiationFailed(i::Handle<i::Object> error_reason) override {
+    i::MaybeHandle<i::Object> promise_result =
+        i::JSPromise::Reject(promise_, error_reason);
+    CHECK_EQ(promise_result.is_null(), isolate_->has_pending_exception());
+  }
+
+ private:
+  i::Isolate* isolate_;
+  i::Handle<i::JSPromise> promise_;
+  i::Handle<i::WasmModuleObject> module_;
+};
+
+// This class is the {CompilationResultResolver} for
+// WebAssembly.instantiate(bytes, imports). When compilation finishes,
+// {AsyncInstantiate} is started on the compilation result.
+class AsyncInstantiateCompileResultResolver
+    : public i::wasm::CompilationResultResolver {
+ public:
+  AsyncInstantiateCompileResultResolver(
+      i::Isolate* isolate, i::Handle<i::JSPromise> promise,
+      i::MaybeHandle<i::JSReceiver> maybe_imports)
+      : isolate_(isolate),
+        promise_(isolate_->global_handles()->Create(*promise)),
+        maybe_imports_(maybe_imports.is_null()
+                           ? maybe_imports
+                           : isolate_->global_handles()->Create(
+                                 *maybe_imports.ToHandleChecked())) {}
+
+  ~AsyncInstantiateCompileResultResolver() {
+    i::GlobalHandles::Destroy(i::Handle<i::Object>::cast(promise_).location());
+    if (!maybe_imports_.is_null()) {
+      i::GlobalHandles::Destroy(
+          i::Handle<i::Object>::cast(maybe_imports_.ToHandleChecked())
+              .location());
+    }
+  }
+
+  void OnCompilationSucceeded(i::Handle<i::WasmModuleObject> result) override {
+    isolate_->wasm_engine()->AsyncInstantiate(
+        isolate_,
+        base::make_unique<InstantiateBytesResultResolver>(isolate_, promise_,
+                                                          result),
+        result, maybe_imports_);
+  }
+
+  void OnCompilationFailed(i::Handle<i::Object> error_reason) override {
+    i::MaybeHandle<i::Object> promise_result =
+        i::JSPromise::Reject(promise_, error_reason);
+    CHECK_EQ(promise_result.is_null(), isolate_->has_pending_exception());
+  }
+
+ private:
+  i::Isolate* isolate_;
+  i::Handle<i::JSPromise> promise_;
+  i::MaybeHandle<i::JSReceiver> maybe_imports_;
+};
+
+}  // namespace
+
 // WebAssembly.compile(bytes) -> Promise
 void WebAssemblyCompile(const v8::FunctionCallbackInfo<v8::Value>& args) {
   v8::Isolate* isolate = args.GetIsolate();
@@ -176,21 +349,23 @@ void WebAssemblyCompile(const v8::FunctionCallbackInfo<v8::Value>& args) {
   }
 
   Local<Context> context = isolate->GetCurrentContext();
-  ASSIGN(Promise::Resolver, resolver, Promise::Resolver::New(context));
+  ASSIGN(Promise::Resolver, promise_resolver, Promise::Resolver::New(context));
+  Local<Promise> promise = promise_resolver->GetPromise();
   v8::ReturnValue<v8::Value> return_value = args.GetReturnValue();
-  return_value.Set(resolver->GetPromise());
+  return_value.Set(promise);
+
+  std::unique_ptr<i::wasm::CompilationResultResolver> resolver(
+      new AsyncCompilationResolver(i_isolate, Utils::OpenHandle(*promise)));
 
   bool is_shared = false;
   auto bytes = GetFirstArgumentAsBytes(args, &thrower, &is_shared);
   if (thrower.error()) {
-    auto maybe = resolver->Reject(context, Utils::ToLocal(thrower.Reify()));
-    CHECK_IMPLIES(!maybe.FromMaybe(false),
-                  i_isolate->has_scheduled_exception());
+    resolver->OnCompilationFailed(thrower.Reify());
     return;
   }
-  i::Handle<i::JSPromise> promise = Utils::OpenHandle(*resolver->GetPromise());
   // Asynchronous compilation handles copying wire bytes if necessary.
-  i_isolate->wasm_engine()->AsyncCompile(i_isolate, promise, bytes, is_shared);
+  i_isolate->wasm_engine()->AsyncCompile(i_isolate, std::move(resolver), bytes,
+                                         is_shared);
 }
 
 // WebAssembly.validate(bytes) -> bool
@@ -462,53 +637,67 @@ void WebAssemblyInstantiate(const v8::FunctionCallbackInfo<v8::Value>& args) {
 
   Local<Context> context = isolate->GetCurrentContext();
 
-  ASSIGN(Promise::Resolver, resolver, Promise::Resolver::New(context));
-  Local<Promise> promise = resolver->GetPromise();
+  ASSIGN(Promise::Resolver, promise_resolver, Promise::Resolver::New(context));
+  Local<Promise> promise = promise_resolver->GetPromise();
   args.GetReturnValue().Set(promise);
 
+  std::unique_ptr<i::wasm::InstantiationResultResolver> resolver(
+      new InstantiateModuleResultResolver(i_isolate,
+                                          Utils::OpenHandle(*promise)));
+
   Local<Value> first_arg_value = args[0];
-  // If args.Length < 2, this will be undefined - see FunctionCallbackInfo.
-  Local<Value> ffi = args[1];
   i::Handle<i::Object> first_arg = Utils::OpenHandle(*first_arg_value);
   if (!first_arg->IsJSObject()) {
     thrower.TypeError(
         "Argument 0 must be a buffer source or a WebAssembly.Module object");
-    auto maybe = resolver->Reject(context, Utils::ToLocal(thrower.Reify()));
-    CHECK_IMPLIES(!maybe.FromMaybe(false),
-                  i_isolate->has_scheduled_exception());
+    resolver->OnInstantiationFailed(thrower.Reify());
+    return;
+  }
+
+  // If args.Length < 2, this will be undefined - see FunctionCallbackInfo.
+  Local<Value> ffi = args[1];
+  i::MaybeHandle<i::JSReceiver> maybe_imports =
+      GetValueAsImports(ffi, &thrower);
+
+  if (thrower.error()) {
+    resolver->OnInstantiationFailed(thrower.Reify());
     return;
   }
 
   if (first_arg->IsWasmModuleObject()) {
     i::Handle<i::WasmModuleObject> module_obj =
         i::Handle<i::WasmModuleObject>::cast(first_arg);
-    // If args.Length < 2, this will be undefined - see FunctionCallbackInfo.
-    i::MaybeHandle<i::JSReceiver> maybe_imports =
-        GetValueAsImports(ffi, &thrower);
 
-    if (thrower.error()) {
-      auto maybe = resolver->Reject(context, Utils::ToLocal(thrower.Reify()));
-      CHECK_IMPLIES(!maybe.FromMaybe(false),
-                    i_isolate->has_scheduled_exception());
-      return;
-    }
+    i_isolate->wasm_engine()->AsyncInstantiate(i_isolate, std::move(resolver),
+                                               module_obj, maybe_imports);
+    return;
+  }
 
-    i_isolate->wasm_engine()->AsyncInstantiate(
-        i_isolate, Utils::OpenHandle(*promise), module_obj, maybe_imports);
+  bool is_shared = false;
+  auto bytes = GetFirstArgumentAsBytes(args, &thrower, &is_shared);
+  if (thrower.error()) {
+    resolver->OnInstantiationFailed(thrower.Reify());
     return;
   }
 
-  // We did not get a WasmModuleObject as input, we first have to compile the
-  // input.
-  ASSIGN(Function, async_compile, Function::New(context, WebAssemblyCompile));
-  ASSIGN(Value, async_compile_retval,
-         async_compile->Call(context, args.Holder(), 1, &first_arg_value));
-  promise = Local<Promise>::Cast(async_compile_retval);
-  DCHECK(!promise.IsEmpty());
-  ASSIGN(Function, instantiate_impl,
-         Function::New(context, WebAssemblyInstantiateCallback, ffi));
-  ASSIGN(Promise, result, promise->Then(context, instantiate_impl));
-  args.GetReturnValue().Set(result);
+  // We start compilation now, we have no use for the
+  // {InstantiationResultResolver}.
+  resolver.reset();
+
+  std::unique_ptr<i::wasm::CompilationResultResolver> compilation_resolver(
+      new AsyncInstantiateCompileResultResolver(
+          i_isolate, Utils::OpenHandle(*promise), maybe_imports));
+
+  // The first parameter is a buffer source, we have to check if we are allowed
+  // to compile it.
+  if (!i::wasm::IsWasmCodegenAllowed(i_isolate, i_isolate->native_context())) {
+    thrower.CompileError("Wasm code generation disallowed by embedder");
+    compilation_resolver->OnCompilationFailed(thrower.Reify());
+  }
+
+  // Asynchronous compilation handles copying wire bytes if necessary.
+  i_isolate->wasm_engine()->AsyncCompile(
+      i_isolate, std::move(compilation_resolver), bytes, is_shared);
 }
 
 bool GetIntegerProperty(v8::Isolate* isolate, ErrorThrower* thrower,
@@ -650,15 +839,12 @@ void WebAssemblyMemory(const v8::FunctionCallbackInfo<v8::Value>& args) {
     }
   }
 
-  size_t size = static_cast<size_t>(i::wasm::kWasmPageSize) *
-                static_cast<size_t>(initial);
-  const bool enable_guard_regions =
-      internal::trap_handler::IsTrapHandlerEnabled();
   i::SharedFlag shared_flag =
       is_shared_memory ? i::SharedFlag::kShared : i::SharedFlag::kNotShared;
   i::Handle<i::JSArrayBuffer> buffer;
-  if (!i::wasm::NewArrayBuffer(i_isolate, size, enable_guard_regions,
-                               shared_flag)
+  size_t size = static_cast<size_t>(i::wasm::kWasmPageSize) *
+                static_cast<size_t>(initial);
+  if (!i::wasm::NewArrayBuffer(i_isolate, size, shared_flag)
            .ToHandle(&buffer)) {
     thrower.RangeError("could not allocate memory");
     return;
@@ -692,10 +878,6 @@ void WebAssemblyGlobal(const v8::FunctionCallbackInfo<v8::Value>& args) {
   Local<Context> context = isolate->GetCurrentContext();
   Local<v8::Object> descriptor = Local<Object>::Cast(args[0]);
 
-  // The descriptor's 'value'.
-  v8::MaybeLocal<v8::Value> maybe_value =
-      descriptor->Get(context, v8_str(isolate, "value"));
-
   // The descriptor's 'mutable'.
   bool is_mutable = false;
   {
@@ -707,11 +889,13 @@ void WebAssemblyGlobal(const v8::FunctionCallbackInfo<v8::Value>& args) {
     }
   }
 
-  // The descriptor's 'type'.
+  // The descriptor's type, called 'value'. It is called 'value' because this
+  // descriptor is planned to be re-used as the global's type for reflection,
+  // so calling it 'type' is redundant.
   i::wasm::ValueType type;
   {
     v8::MaybeLocal<v8::Value> maybe =
-        descriptor->Get(context, v8_str(isolate, "type"));
+        descriptor->Get(context, v8_str(isolate, "value"));
     v8::Local<v8::Value> value;
     if (!maybe.ToLocal(&value)) return;
     v8::Local<v8::String> string;
@@ -728,7 +912,7 @@ void WebAssemblyGlobal(const v8::FunctionCallbackInfo<v8::Value>& args) {
       type = i::wasm::kWasmF64;
     } else {
       thrower.TypeError(
-          "Descriptor property 'type' must be 'i32', 'f32', or 'f64'");
+          "Descriptor property 'value' must be 'i32', 'f32', or 'f64'");
       return;
     }
   }
@@ -744,38 +928,43 @@ void WebAssemblyGlobal(const v8::FunctionCallbackInfo<v8::Value>& args) {
     return;
   }
 
-  // Convert value to a WebAssembly value.
-  v8::Local<v8::Value> value;
-  if (maybe_value.ToLocal(&value)) {
-    switch (type) {
-      case i::wasm::kWasmI32: {
-        int32_t i32_value = 0;
+  // Convert value to a WebAssembly value, the default value is 0.
+  Local<v8::Value> value = Local<Value>::Cast(args[1]);
+  switch (type) {
+    case i::wasm::kWasmI32: {
+      int32_t i32_value = 0;
+      if (!value->IsUndefined()) {
         v8::Local<v8::Int32> int32_value;
         if (!value->ToInt32(context).ToLocal(&int32_value)) return;
         if (!int32_value->Int32Value(context).To(&i32_value)) return;
-        global_obj->SetI32(i32_value);
-        break;
       }
-      case i::wasm::kWasmF32: {
+      global_obj->SetI32(i32_value);
+      break;
+    }
+    case i::wasm::kWasmF32: {
+      float f32_value = 0;
+      if (!value->IsUndefined()) {
         double f64_value = 0;
         v8::Local<v8::Number> number_value;
         if (!value->ToNumber(context).ToLocal(&number_value)) return;
         if (!number_value->NumberValue(context).To(&f64_value)) return;
-        float f32_value = static_cast<float>(f64_value);
-        global_obj->SetF32(f32_value);
-        break;
+        f32_value = static_cast<float>(f64_value);
       }
-      case i::wasm::kWasmF64: {
-        double f64_value = 0;
+      global_obj->SetF32(f32_value);
+      break;
+    }
+    case i::wasm::kWasmF64: {
+      double f64_value = 0;
+      if (!value->IsUndefined()) {
         v8::Local<v8::Number> number_value;
         if (!value->ToNumber(context).ToLocal(&number_value)) return;
         if (!number_value->NumberValue(context).To(&f64_value)) return;
-        global_obj->SetF64(f64_value);
-        break;
       }
-      default:
-        UNREACHABLE();
+      global_obj->SetF64(f64_value);
+      break;
     }
+    default:
+      UNREACHABLE();
   }
 
   i::Handle<i::JSObject> global_js_object(global_obj);
@@ -805,7 +994,7 @@ void WebAssemblyInstanceGetExports(
   HandleScope scope(isolate);
   ScheduledErrorThrower thrower(i_isolate, "WebAssembly.Instance.exports()");
   EXTRACT_THIS(receiver, WasmInstanceObject);
-  i::Handle<i::JSObject> exports_object(receiver->exports_object());
+  i::Handle<i::JSObject> exports_object(receiver->exports_object(), i_isolate);
   args.GetReturnValue().Set(Utils::ToLocal(exports_object));
 }
 
@@ -852,7 +1041,7 @@ void WebAssemblyTableGrow(const v8::FunctionCallbackInfo<v8::Value>& args) {
     i::Handle<i::FixedArray> new_array =
         i_isolate->factory()->NewFixedArray(new_size);
     for (int i = 0; i < old_size; ++i) new_array->set(i, old_array->get(i));
-    i::Object* null = i_isolate->heap()->null_value();
+    i::Object* null = i::ReadOnlyRoots(i_isolate).null_value();
     for (int i = old_size; i < new_size; ++i) new_array->set(i, null);
     receiver->set_functions(*new_array);
   }
@@ -909,20 +1098,7 @@ void WebAssemblyTableSet(const v8::FunctionCallbackInfo<v8::Value>& args) {
     return;
   }
 
-  // TODO(v8:7232) Allow reset/mutation after addressing referenced issue.
-  int32_t int_index = static_cast<int32_t>(index);
-  if (receiver->functions()->get(int_index) !=
-          i_isolate->heap()->undefined_value() &&
-      receiver->functions()->get(int_index) !=
-          i_isolate->heap()->null_value()) {
-    for (i::StackFrameIterator it(i_isolate); !it.done(); it.Advance()) {
-      if (it.frame()->type() == i::StackFrame::WASM_TO_JS) {
-        thrower.RangeError("Modifying existing entry in table not supported.");
-        return;
-      }
-    }
-  }
-  i::WasmTableObject::Set(i_isolate, receiver, static_cast<int32_t>(int_index),
+  i::WasmTableObject::Set(i_isolate, receiver, static_cast<int32_t>(index),
                           value->IsNull(i_isolate)
                               ? i::Handle<i::JSFunction>::null()
                               : i::Handle<i::JSFunction>::cast(value));
@@ -945,7 +1121,7 @@ void WebAssemblyMemoryGrow(const v8::FunctionCallbackInfo<v8::Value>& args) {
       max_size64 > static_cast<int64_t>(i::FLAG_wasm_max_mem_pages)) {
     max_size64 = i::FLAG_wasm_max_mem_pages;
   }
-  i::Handle<i::JSArrayBuffer> old_buffer(receiver->array_buffer());
+  i::Handle<i::JSArrayBuffer> old_buffer(receiver->array_buffer(), i_isolate);
   if (!old_buffer->is_growable()) {
     thrower.RangeError("This memory cannot be grown");
     return;
@@ -979,7 +1155,8 @@ void WebAssemblyMemoryGetBuffer(
 
   i::Handle<i::Object> buffer_obj(receiver->array_buffer(), i_isolate);
   DCHECK(buffer_obj->IsJSArrayBuffer());
-  i::Handle<i::JSArrayBuffer> buffer(i::JSArrayBuffer::cast(*buffer_obj));
+  i::Handle<i::JSArrayBuffer> buffer(i::JSArrayBuffer::cast(*buffer_obj),
+                                     i_isolate);
   if (buffer->is_shared()) {
     // TODO(gdeepti): More needed here for when cached buffer, and current
     // buffer are out of sync, handle that here when bounds checks, and Grow
@@ -1044,6 +1221,11 @@ void WebAssemblyGlobalSetValue(
   ScheduledErrorThrower thrower(i_isolate, "set WebAssembly.Global.value");
   EXTRACT_THIS(receiver, WasmGlobalObject);
 
+  if (!receiver->is_mutable()) {
+    thrower.TypeError("Can't set the value of an immutable global.");
+    return;
+  }
+
   switch (receiver->type()) {
     case i::wasm::kWasmI32: {
       int32_t i32_value = 0;
@@ -1101,7 +1283,7 @@ Handle<JSFunction> InstallFunc(Isolate* isolate, Handle<JSObject> object,
   Handle<JSFunction> function = CreateFunc(isolate, name, func);
   function->shared()->set_length(length);
   PropertyAttributes attributes = static_cast<PropertyAttributes>(DONT_ENUM);
-  JSObject::AddProperty(object, name, function, attributes);
+  JSObject::AddProperty(isolate, object, name, function, attributes);
   return function;
 }
 
@@ -1136,6 +1318,7 @@ void InstallGetterSetter(Isolate* isolate, Handle<JSObject> object,
       CreateFunc(isolate, GetterName(isolate, name), getter);
   Handle<JSFunction> setter_func =
       CreateFunc(isolate, SetterName(isolate, name), setter);
+  setter_func->shared()->set_length(1);
 
   v8::PropertyAttribute attributes =
       static_cast<v8::PropertyAttribute>(v8::DontEnum);
@@ -1168,8 +1351,8 @@ void WasmJs::Install(Isolate* isolate, bool exposed_on_global_object) {
 
   PropertyAttributes ro_attributes =
       static_cast<PropertyAttributes>(DONT_ENUM | READ_ONLY);
-  JSObject::AddProperty(webassembly, factory->to_string_tag_symbol(), name,
-                        ro_attributes);
+  JSObject::AddProperty(isolate, webassembly, factory->to_string_tag_symbol(),
+                        name, ro_attributes);
   InstallFunc(isolate, webassembly, "compile", WebAssemblyCompile, 1);
   InstallFunc(isolate, webassembly, "validate", WebAssemblyValidate, 1);
   InstallFunc(isolate, webassembly, "instantiate", WebAssemblyInstantiate, 1);
@@ -1183,7 +1366,7 @@ void WasmJs::Install(Isolate* isolate, bool exposed_on_global_object) {
 
   // Expose the API on the global object if configured to do so.
   if (exposed_on_global_object) {
-    JSObject::AddProperty(global, name, webassembly, attributes);
+    JSObject::AddProperty(isolate, global, name, webassembly, attributes);
   }
 
   // Setup Module
@@ -1192,7 +1375,7 @@ void WasmJs::Install(Isolate* isolate, bool exposed_on_global_object) {
   context->set_wasm_module_constructor(*module_constructor);
   JSFunction::EnsureHasInitialMap(module_constructor);
   Handle<JSObject> module_proto(
-      JSObject::cast(module_constructor->instance_prototype()));
+      JSObject::cast(module_constructor->instance_prototype()), isolate);
   i::Handle<i::Map> module_map =
       isolate->factory()->NewMap(i::WASM_MODULE_TYPE, WasmModuleObject::kSize);
   JSFunction::SetInitialMap(module_constructor, module_map, module_proto);
@@ -1202,7 +1385,7 @@ void WasmJs::Install(Isolate* isolate, bool exposed_on_global_object) {
               1);
   InstallFunc(isolate, module_constructor, "customSections",
               WebAssemblyModuleCustomSections, 2);
-  JSObject::AddProperty(module_proto, factory->to_string_tag_symbol(),
+  JSObject::AddProperty(isolate, module_proto, factory->to_string_tag_symbol(),
                         v8_str(isolate, "WebAssembly.Module"), ro_attributes);
 
   // Setup Instance
@@ -1211,13 +1394,14 @@ void WasmJs::Install(Isolate* isolate, bool exposed_on_global_object) {
   context->set_wasm_instance_constructor(*instance_constructor);
   JSFunction::EnsureHasInitialMap(instance_constructor);
   Handle<JSObject> instance_proto(
-      JSObject::cast(instance_constructor->instance_prototype()));
+      JSObject::cast(instance_constructor->instance_prototype()), isolate);
   i::Handle<i::Map> instance_map = isolate->factory()->NewMap(
       i::WASM_INSTANCE_TYPE, WasmInstanceObject::kSize);
   JSFunction::SetInitialMap(instance_constructor, instance_map, instance_proto);
   InstallGetter(isolate, instance_proto, "exports",
                 WebAssemblyInstanceGetExports);
-  JSObject::AddProperty(instance_proto, factory->to_string_tag_symbol(),
+  JSObject::AddProperty(isolate, instance_proto,
+                        factory->to_string_tag_symbol(),
                         v8_str(isolate, "WebAssembly.Instance"), ro_attributes);
 
   // Setup Table
@@ -1226,7 +1410,7 @@ void WasmJs::Install(Isolate* isolate, bool exposed_on_global_object) {
   context->set_wasm_table_constructor(*table_constructor);
   JSFunction::EnsureHasInitialMap(table_constructor);
   Handle<JSObject> table_proto(
-      JSObject::cast(table_constructor->instance_prototype()));
+      JSObject::cast(table_constructor->instance_prototype()), isolate);
   i::Handle<i::Map> table_map =
       isolate->factory()->NewMap(i::WASM_TABLE_TYPE, WasmTableObject::kSize);
   JSFunction::SetInitialMap(table_constructor, table_map, table_proto);
@@ -1234,7 +1418,7 @@ void WasmJs::Install(Isolate* isolate, bool exposed_on_global_object) {
   InstallFunc(isolate, table_proto, "grow", WebAssemblyTableGrow, 1);
   InstallFunc(isolate, table_proto, "get", WebAssemblyTableGet, 1);
   InstallFunc(isolate, table_proto, "set", WebAssemblyTableSet, 2);
-  JSObject::AddProperty(table_proto, factory->to_string_tag_symbol(),
+  JSObject::AddProperty(isolate, table_proto, factory->to_string_tag_symbol(),
                         v8_str(isolate, "WebAssembly.Table"), ro_attributes);
 
   // Setup Memory
@@ -1243,13 +1427,13 @@ void WasmJs::Install(Isolate* isolate, bool exposed_on_global_object) {
   context->set_wasm_memory_constructor(*memory_constructor);
   JSFunction::EnsureHasInitialMap(memory_constructor);
   Handle<JSObject> memory_proto(
-      JSObject::cast(memory_constructor->instance_prototype()));
+      JSObject::cast(memory_constructor->instance_prototype()), isolate);
   i::Handle<i::Map> memory_map =
       isolate->factory()->NewMap(i::WASM_MEMORY_TYPE, WasmMemoryObject::kSize);
   JSFunction::SetInitialMap(memory_constructor, memory_map, memory_proto);
   InstallFunc(isolate, memory_proto, "grow", WebAssemblyMemoryGrow, 1);
   InstallGetter(isolate, memory_proto, "buffer", WebAssemblyMemoryGetBuffer);
-  JSObject::AddProperty(memory_proto, factory->to_string_tag_symbol(),
+  JSObject::AddProperty(isolate, memory_proto, factory->to_string_tag_symbol(),
                         v8_str(isolate, "WebAssembly.Memory"), ro_attributes);
 
   // Setup Global
@@ -1259,30 +1443,34 @@ void WasmJs::Install(Isolate* isolate, bool exposed_on_global_object) {
     context->set_wasm_global_constructor(*global_constructor);
     JSFunction::EnsureHasInitialMap(global_constructor);
     Handle<JSObject> global_proto(
-        JSObject::cast(global_constructor->instance_prototype()));
+        JSObject::cast(global_constructor->instance_prototype()), isolate);
     i::Handle<i::Map> global_map = isolate->factory()->NewMap(
         i::WASM_GLOBAL_TYPE, WasmGlobalObject::kSize);
     JSFunction::SetInitialMap(global_constructor, global_map, global_proto);
     InstallFunc(isolate, global_proto, "valueOf", WebAssemblyGlobalValueOf, 0);
     InstallGetterSetter(isolate, global_proto, "value",
                         WebAssemblyGlobalGetValue, WebAssemblyGlobalSetValue);
-    JSObject::AddProperty(global_proto, factory->to_string_tag_symbol(),
+    JSObject::AddProperty(isolate, global_proto,
+                          factory->to_string_tag_symbol(),
                           v8_str(isolate, "WebAssembly.Global"), ro_attributes);
   }
 
   // Setup errors
   attributes = static_cast<PropertyAttributes>(DONT_ENUM);
   Handle<JSFunction> compile_error(
-      isolate->native_context()->wasm_compile_error_function());
-  JSObject::AddProperty(webassembly, isolate->factory()->CompileError_string(),
+      isolate->native_context()->wasm_compile_error_function(), isolate);
+  JSObject::AddProperty(isolate, webassembly,
+                        isolate->factory()->CompileError_string(),
                         compile_error, attributes);
   Handle<JSFunction> link_error(
-      isolate->native_context()->wasm_link_error_function());
-  JSObject::AddProperty(webassembly, isolate->factory()->LinkError_string(),
-                        link_error, attributes);
+      isolate->native_context()->wasm_link_error_function(), isolate);
+  JSObject::AddProperty(isolate, webassembly,
+                        isolate->factory()->LinkError_string(), link_error,
+                        attributes);
   Handle<JSFunction> runtime_error(
-      isolate->native_context()->wasm_runtime_error_function());
-  JSObject::AddProperty(webassembly, isolate->factory()->RuntimeError_string(),
+      isolate->native_context()->wasm_runtime_error_function(), isolate);
+  JSObject::AddProperty(isolate, webassembly,
+                        isolate->factory()->RuntimeError_string(),
                         runtime_error, attributes);
 }
 
diff --git a/deps/v8/src/wasm/wasm-linkage.h b/deps/v8/src/wasm/wasm-linkage.h
new file mode 100644
index 00000000000000..65fc0a260062f8
--- /dev/null
+++ b/deps/v8/src/wasm/wasm-linkage.h
@@ -0,0 +1,182 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef V8_WASM_WASM_LINKAGE_H_
+#define V8_WASM_WASM_LINKAGE_H_
+
+#include "src/assembler-arch.h"
+#include "src/machine-type.h"
+#include "src/signature.h"
+#include "src/wasm/value-type.h"
+
+namespace v8 {
+namespace internal {
+namespace wasm {
+
+#if V8_TARGET_ARCH_IA32
+// ===========================================================================
+// == ia32 ===================================================================
+// ===========================================================================
+constexpr Register kGpParamRegisters[] = {esi, eax, edx, ecx, ebx};
+constexpr Register kGpReturnRegisters[] = {eax, edx};
+constexpr DoubleRegister kFpParamRegisters[] = {xmm1, xmm2, xmm3,
+                                                xmm4, xmm5, xmm6};
+constexpr DoubleRegister kFpReturnRegisters[] = {xmm1, xmm2};
+
+#elif V8_TARGET_ARCH_X64
+// ===========================================================================
+// == x64 ====================================================================
+// ===========================================================================
+constexpr Register kGpParamRegisters[] = {rsi, rax, rdx, rcx, rbx, rdi};
+constexpr Register kGpReturnRegisters[] = {rax, rdx};
+constexpr DoubleRegister kFpParamRegisters[] = {xmm1, xmm2, xmm3,
+                                                xmm4, xmm5, xmm6};
+constexpr DoubleRegister kFpReturnRegisters[] = {xmm1, xmm2};
+
+#elif V8_TARGET_ARCH_ARM
+// ===========================================================================
+// == arm ====================================================================
+// ===========================================================================
+constexpr Register kGpParamRegisters[] = {r3, r0, r1, r2};
+constexpr Register kGpReturnRegisters[] = {r0, r1};
+constexpr DoubleRegister kFpParamRegisters[] = {d0, d1, d2, d3, d4, d5, d6, d7};
+constexpr DoubleRegister kFpReturnRegisters[] = {d0, d1};
+
+#elif V8_TARGET_ARCH_ARM64
+// ===========================================================================
+// == arm64 ====================================================================
+// ===========================================================================
+constexpr Register kGpParamRegisters[] = {x7, x0, x1, x2, x3, x4, x5, x6};
+constexpr Register kGpReturnRegisters[] = {x0, x1};
+constexpr DoubleRegister kFpParamRegisters[] = {d0, d1, d2, d3, d4, d5, d6, d7};
+constexpr DoubleRegister kFpReturnRegisters[] = {d0, d1};
+
+#elif V8_TARGET_ARCH_MIPS
+// ===========================================================================
+// == mips ===================================================================
+// ===========================================================================
+constexpr Register kGpParamRegisters[] = {a0, a1, a2, a3};
+constexpr Register kGpReturnRegisters[] = {v0, v1};
+constexpr DoubleRegister kFpParamRegisters[] = {f2, f4, f6, f8, f10, f12, f14};
+constexpr DoubleRegister kFpReturnRegisters[] = {f2, f4};
+
+#elif V8_TARGET_ARCH_MIPS64
+// ===========================================================================
+// == mips64 =================================================================
+// ===========================================================================
+constexpr Register kGpParamRegisters[] = {a0, a1, a2, a3, a4, a5, a6, a7};
+constexpr Register kGpReturnRegisters[] = {v0, v1};
+constexpr DoubleRegister kFpParamRegisters[] = {f2, f4, f6, f8, f10, f12, f14};
+constexpr DoubleRegister kFpReturnRegisters[] = {f2, f4};
+
+#elif V8_TARGET_ARCH_PPC || V8_TARGET_ARCH_PPC64
+// ===========================================================================
+// == ppc & ppc64 ============================================================
+// ===========================================================================
+constexpr Register kGpParamRegisters[] = {r10, r3, r4, r5, r6, r7, r8, r9};
+constexpr Register kGpReturnRegisters[] = {r3, r4};
+constexpr DoubleRegister kFpParamRegisters[] = {d1, d2, d3, d4, d5, d6, d7, d8};
+constexpr DoubleRegister kFpReturnRegisters[] = {d1, d2};
+
+#elif V8_TARGET_ARCH_S390X
+// ===========================================================================
+// == s390x ==================================================================
+// ===========================================================================
+constexpr Register kGpParamRegisters[] = {r6, r2, r3, r4, r5};
+constexpr Register kGpReturnRegisters[] = {r2, r3};
+constexpr DoubleRegister kFpParamRegisters[] = {d0, d2, d4, d6};
+constexpr DoubleRegister kFpReturnRegisters[] = {d0, d2, d4, d6};
+
+#elif V8_TARGET_ARCH_S390
+// ===========================================================================
+// == s390 ===================================================================
+// ===========================================================================
+constexpr Register kGpParamRegisters[] = {r6, r2, r3, r4, r5};
+constexpr Register kGpReturnRegisters[] = {r2, r3};
+constexpr DoubleRegister kFpParamRegisters[] = {d0, d2};
+constexpr DoubleRegister kFpReturnRegisters[] = {d0, d2};
+
+#else
+// ===========================================================================
+// == unknown ================================================================
+// ===========================================================================
+// Do not use any registers, we will just always use the stack.
+constexpr Register kGpParamRegisters[] = {};
+constexpr Register kGpReturnRegisters[] = {};
+constexpr DoubleRegister kFpParamRegisters[] = {};
+constexpr DoubleRegister kFpReturnRegisters[] = {};
+
+#endif
+
+// The parameter index where the instance parameter should be placed in wasm
+// call descriptors. This is used by the Int64Lowering::LowerNode method.
+constexpr int kWasmInstanceParameterIndex = 0;
+
+class LinkageAllocator {
+ public:
+  template <size_t kNumGpRegs, size_t kNumFpRegs>
+  constexpr LinkageAllocator(const Register (&gp)[kNumGpRegs],
+                             const DoubleRegister (&fp)[kNumFpRegs])
+      : LinkageAllocator(gp, kNumGpRegs, fp, kNumFpRegs) {}
+
+  constexpr LinkageAllocator(const Register* gp, int gpc,
+                             const DoubleRegister* fp, int fpc)
+      : gp_count_(gpc), gp_regs_(gp), fp_count_(fpc), fp_regs_(fp) {}
+
+  bool has_more_gp_regs() const { return gp_offset_ < gp_count_; }
+  bool has_more_fp_regs() const { return fp_offset_ < fp_count_; }
+
+  Register NextGpReg() {
+    DCHECK_LT(gp_offset_, gp_count_);
+    return gp_regs_[gp_offset_++];
+  }
+
+  DoubleRegister NextFpReg() {
+    DCHECK_LT(fp_offset_, fp_count_);
+    return fp_regs_[fp_offset_++];
+  }
+
+  // Stackslots are counted upwards starting from 0 (or the offset set by
+  // {SetStackOffset}.
+  int NumStackSlots(MachineRepresentation type) {
+    return std::max(1, ElementSizeInBytes(type) / kPointerSize);
+  }
+
+  // Stackslots are counted upwards starting from 0 (or the offset set by
+  // {SetStackOffset}. If {type} needs more than
+  // one stack slot, the lowest used stack slot is returned.
+  int NextStackSlot(MachineRepresentation type) {
+    int num_stack_slots = NumStackSlots(type);
+    int offset = stack_offset_;
+    stack_offset_ += num_stack_slots;
+    return offset;
+  }
+
+  // Set an offset for the stack slots returned by {NextStackSlot} and
+  // {NumStackSlots}. Can only be called before any call to {NextStackSlot}.
+  void SetStackOffset(int num) {
+    DCHECK_LE(0, num);
+    DCHECK_EQ(0, stack_offset_);
+    stack_offset_ = num;
+  }
+
+  int NumStackSlots() const { return stack_offset_; }
+
+ private:
+  const int gp_count_;
+  int gp_offset_ = 0;
+  const Register* const gp_regs_;
+
+  const int fp_count_;
+  int fp_offset_ = 0;
+  const DoubleRegister* const fp_regs_;
+
+  int stack_offset_ = 0;
+};
+
+}  // namespace wasm
+}  // namespace internal
+}  // namespace v8
+
+#endif  // V8_WASM_WASM_LINKAGE_H_
diff --git a/deps/v8/src/wasm/wasm-memory.cc b/deps/v8/src/wasm/wasm-memory.cc
index 9bb8002a4f0b14..bda06e42cdffc5 100644
--- a/deps/v8/src/wasm/wasm-memory.cc
+++ b/deps/v8/src/wasm/wasm-memory.cc
@@ -2,6 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
+#include <limits>
+
 #include "src/wasm/wasm-memory.h"
 #include "src/objects-inl.h"
 #include "src/wasm/wasm-engine.h"
@@ -13,18 +15,25 @@ namespace internal {
 namespace wasm {
 
 namespace {
+
+constexpr size_t kNegativeGuardSize = 1u << 31;  // 2GiB
+
 void* TryAllocateBackingStore(WasmMemoryTracker* memory_tracker, Heap* heap,
-                              size_t size, bool require_guard_regions,
+                              size_t size, bool require_full_guard_regions,
                               void** allocation_base,
                               size_t* allocation_length) {
+  using AllocationStatus = WasmMemoryTracker::AllocationStatus;
 #if V8_TARGET_ARCH_32_BIT
-  DCHECK(!require_guard_regions);
+  DCHECK(!require_full_guard_regions);
 #endif
   // We always allocate the largest possible offset into the heap, so the
   // addressable memory after the guard page can be made inaccessible.
+  //
+  // To protect against 32-bit integer overflow issues, we also protect the 2GiB
+  // before the valid part of the memory buffer.
   *allocation_length =
-      require_guard_regions
-          ? RoundUp(kWasmMaxHeapOffset, CommitPageSize())
+      require_full_guard_regions
+          ? RoundUp(kWasmMaxHeapOffset + kNegativeGuardSize, CommitPageSize())
           : RoundUp(
                 base::bits::RoundUpToPowerOfTwo32(static_cast<uint32_t>(size)),
                 kWasmPageSize);
@@ -36,10 +45,12 @@ void* TryAllocateBackingStore(WasmMemoryTracker* memory_tracker, Heap* heap,
   // Try up to three times; getting rid of dead JSArrayBuffer allocations might
   // require two GCs.
   // TODO(gc): Fix this to only require one GC (crbug.com/v8/7621).
+  bool did_retry = false;
   for (int trial = 0;; ++trial) {
     if (memory_tracker->ReserveAddressSpace(*allocation_length)) break;
     // Collect garbage and retry.
     heap->MemoryPressureNotification(MemoryPressureLevel::kCritical, true);
+    did_retry = true;
     // After first and second GC: retry.
     if (trial < 2) continue;
     // We are over the address space limit. Fail.
@@ -51,6 +62,8 @@ void* TryAllocateBackingStore(WasmMemoryTracker* memory_tracker, Heap* heap,
     if (FLAG_abort_on_stack_or_string_length_overflow) {
       FATAL("could not allocate wasm memory");
     }
+    memory_tracker->AddAllocationStatusSample(
+        AllocationStatus::kAddressSpaceLimitReachedFailure);
     return nullptr;
   }
 
@@ -59,9 +72,13 @@ void* TryAllocateBackingStore(WasmMemoryTracker* memory_tracker, Heap* heap,
                                    PageAllocator::kNoAccess);
   if (*allocation_base == nullptr) {
     memory_tracker->ReleaseReservation(*allocation_length);
+    memory_tracker->AddAllocationStatusSample(AllocationStatus::kOtherFailure);
     return nullptr;
   }
-  void* memory = *allocation_base;
+  byte* memory = reinterpret_cast<byte*>(*allocation_base);
+  if (require_full_guard_regions) {
+    memory += kNegativeGuardSize;
+  }
 
   // Make the part we care about accessible.
   if (size > 0) {
@@ -76,17 +93,14 @@ void* TryAllocateBackingStore(WasmMemoryTracker* memory_tracker, Heap* heap,
 
   memory_tracker->RegisterAllocation(*allocation_base, *allocation_length,
                                      memory, size);
+  memory_tracker->AddAllocationStatusSample(
+      did_retry ? AllocationStatus::kSuccessAfterRetry
+                : AllocationStatus::kSuccess);
   return memory;
 }
 }  // namespace
 
 WasmMemoryTracker::~WasmMemoryTracker() {
-  if (empty_backing_store_.allocation_base != nullptr) {
-    CHECK(FreePages(empty_backing_store_.allocation_base,
-                    empty_backing_store_.allocation_length));
-    InternalReleaseAllocation(empty_backing_store_.buffer_start);
-  }
-
   // All reserved address space should be released before the allocation tracker
   // is destroyed.
   DCHECK_EQ(reserved_address_space_, 0u);
@@ -97,8 +111,14 @@ bool WasmMemoryTracker::ReserveAddressSpace(size_t num_bytes) {
 // Address space reservations are currently only meaningful using guard
 // regions, which is currently only supported on 64-bit systems. On other
 // platforms, we always fall back on bounds checks.
-#if V8_TARGET_ARCH_64_BIT
-  constexpr size_t kAddressSpaceLimit = 0x10000000000L;  // 1 TiB
+#if V8_TARGET_ARCH_MIPS64
+  // MIPS64 has a user space of 2^40 bytes on most processors,
+  // address space limits needs to be smaller.
+  constexpr size_t kAddressSpaceLimit = 0x2100000000L;  // 132 GiB
+#elif V8_TARGET_ARCH_64_BIT
+  // We set the limit to 1 TiB + 4 GiB so that there is room for mini-guards
+  // once we fill everything up with full-sized guard regions.
+  constexpr size_t kAddressSpaceLimit = 0x10100000000L;  // 1 TiB + 4GiB
 #else
   constexpr size_t kAddressSpaceLimit = 0x80000000;  // 2 GiB
 #endif
@@ -116,21 +136,16 @@ void WasmMemoryTracker::ReleaseReservation(size_t num_bytes) {
   size_t const old_reserved = reserved_address_space_.fetch_sub(num_bytes);
   USE(old_reserved);
   DCHECK_LE(num_bytes, old_reserved);
-  DCHECK_GE(old_reserved - num_bytes, allocated_address_space_);
 }
 
 void WasmMemoryTracker::RegisterAllocation(void* allocation_base,
                                            size_t allocation_length,
                                            void* buffer_start,
                                            size_t buffer_length) {
-  // Make sure the caller has reserved the address space before registering the
-  // allocation.
-  DCHECK_LE(allocated_address_space_ + allocation_length,
-            reserved_address_space_);
-
   base::LockGuard<base::Mutex> scope_lock(&mutex_);
 
   allocated_address_space_ += allocation_length;
+  AddAddressSpaceSample();
 
   allocations_.emplace(buffer_start,
                        AllocationData{allocation_base, allocation_length,
@@ -139,9 +154,6 @@ void WasmMemoryTracker::RegisterAllocation(void* allocation_base,
 
 WasmMemoryTracker::AllocationData WasmMemoryTracker::ReleaseAllocation(
     const void* buffer_start) {
-  if (IsEmptyBackingStore(buffer_start)) {
-    return AllocationData();
-  }
   return InternalReleaseAllocation(buffer_start);
 }
 
@@ -158,6 +170,7 @@ WasmMemoryTracker::AllocationData WasmMemoryTracker::InternalReleaseAllocation(
     DCHECK_LE(num_bytes, allocated_address_space_);
     reserved_address_space_ -= num_bytes;
     allocated_address_space_ -= num_bytes;
+    AddAddressSpaceSample();
 
     AllocationData allocation_data = find_result->second;
     allocations_.erase(find_result);
@@ -181,38 +194,22 @@ bool WasmMemoryTracker::IsWasmMemory(const void* buffer_start) {
   return allocations_.find(buffer_start) != allocations_.end();
 }
 
-void* WasmMemoryTracker::GetEmptyBackingStore(void** allocation_base,
-                                              size_t* allocation_length,
-                                              Heap* heap) {
-  if (empty_backing_store_.allocation_base == nullptr) {
-    constexpr size_t buffer_length = 0;
-    const bool require_guard_regions = trap_handler::IsTrapHandlerEnabled();
-    void* local_allocation_base;
-    size_t local_allocation_length;
-    void* buffer_start = TryAllocateBackingStore(
-        this, heap, buffer_length, require_guard_regions,
-        &local_allocation_base, &local_allocation_length);
-
-    empty_backing_store_ =
-        AllocationData(local_allocation_base, local_allocation_length,
-                       buffer_start, buffer_length);
+bool WasmMemoryTracker::HasFullGuardRegions(const void* buffer_start) {
+  base::LockGuard<base::Mutex> scope_lock(&mutex_);
+  const auto allocation = allocations_.find(buffer_start);
+
+  if (allocation == allocations_.end()) {
+    return false;
   }
-  *allocation_base = empty_backing_store_.allocation_base;
-  *allocation_length = empty_backing_store_.allocation_length;
-  return empty_backing_store_.buffer_start;
-}
 
-bool WasmMemoryTracker::IsEmptyBackingStore(const void* buffer_start) const {
-  return buffer_start == empty_backing_store_.buffer_start;
+  Address start = reinterpret_cast<Address>(buffer_start);
+  Address limit =
+      reinterpret_cast<Address>(allocation->second.allocation_base) +
+      allocation->second.allocation_length;
+  return start + kWasmMaxHeapOffset < limit;
 }
 
 bool WasmMemoryTracker::FreeMemoryIfIsWasmMemory(const void* buffer_start) {
-  if (IsEmptyBackingStore(buffer_start)) {
-    // We don't need to do anything for the empty backing store, because this
-    // will be freed when WasmMemoryTracker shuts down. Return true so callers
-    // will not try to free the buffer on their own.
-    return true;
-  }
   if (IsWasmMemory(buffer_start)) {
     const AllocationData allocation = ReleaseAllocation(buffer_start);
     CHECK(FreePages(allocation.allocation_base, allocation.allocation_length));
@@ -221,6 +218,21 @@ bool WasmMemoryTracker::FreeMemoryIfIsWasmMemory(const void* buffer_start) {
   return false;
 }
 
+void WasmMemoryTracker::AddAllocationStatusSample(AllocationStatus status) {
+  if (allocation_result_) {
+    allocation_result_->AddSample(static_cast<int>(status));
+  }
+}
+
+void WasmMemoryTracker::AddAddressSpaceSample() {
+  if (address_space_usage_mb_) {
+    // Report address space usage in MiB so the full range fits in an int on all
+    // platforms.
+    address_space_usage_mb_->AddSample(
+        static_cast<int>(allocated_address_space_ >> 20));
+  }
+}
+
 Handle<JSArrayBuffer> SetupArrayBuffer(Isolate* isolate, void* backing_store,
                                        size_t size, bool is_external,
                                        SharedFlag shared) {
@@ -237,7 +249,6 @@ Handle<JSArrayBuffer> SetupArrayBuffer(Isolate* isolate, void* backing_store,
 }
 
 MaybeHandle<JSArrayBuffer> NewArrayBuffer(Isolate* isolate, size_t size,
-                                          bool require_guard_regions,
                                           SharedFlag shared) {
   // Check against kMaxInt, since the byte length is stored as int in the
   // JSArrayBuffer. Note that wasm_max_mem_pages can be raised from the command
@@ -253,15 +264,25 @@ MaybeHandle<JSArrayBuffer> NewArrayBuffer(Isolate* isolate, size_t size,
   void* allocation_base = nullptr;
   size_t allocation_length = 0;
 
-  void* memory =
-      (size == 0)
-          ? memory_tracker->GetEmptyBackingStore(
-                &allocation_base, &allocation_length, isolate->heap())
-          : TryAllocateBackingStore(memory_tracker, isolate->heap(), size,
-                                    require_guard_regions, &allocation_base,
-                                    &allocation_length);
-
-  if (size > 0 && memory == nullptr) return {};
+#if V8_TARGET_ARCH_64_BIT
+  bool require_full_guard_regions = true;
+#else
+  bool require_full_guard_regions = false;
+#endif
+  void* memory = TryAllocateBackingStore(memory_tracker, isolate->heap(), size,
+                                         require_full_guard_regions,
+                                         &allocation_base, &allocation_length);
+  if (memory == nullptr && FLAG_wasm_trap_handler_fallback) {
+    // If we failed to allocate with full guard regions, fall back on
+    // mini-guards.
+    require_full_guard_regions = false;
+    memory = TryAllocateBackingStore(memory_tracker, isolate->heap(), size,
+                                     require_full_guard_regions,
+                                     &allocation_base, &allocation_length);
+  }
+  if (memory == nullptr) {
+    return {};
+  }
 
 #if DEBUG
   // Double check the API allocator actually zero-initialized the memory.
diff --git a/deps/v8/src/wasm/wasm-memory.h b/deps/v8/src/wasm/wasm-memory.h
index 1652868bf192e5..2ab24739a8726d 100644
--- a/deps/v8/src/wasm/wasm-memory.h
+++ b/deps/v8/src/wasm/wasm-memory.h
@@ -5,6 +5,7 @@
 #ifndef V8_WASM_WASM_MEMORY_H_
 #define V8_WASM_WASM_MEMORY_H_
 
+#include <atomic>
 #include <unordered_map>
 
 #include "src/base/platform/mutex.h"
@@ -14,6 +15,9 @@
 
 namespace v8 {
 namespace internal {
+
+class Histogram;  // defined in counters.h
+
 namespace wasm {
 
 class WasmMemoryTracker {
@@ -65,25 +69,45 @@ class WasmMemoryTracker {
 
   bool IsWasmMemory(const void* buffer_start);
 
+  // Returns whether the given buffer is a Wasm memory with guard regions large
+  // enough to safely use trap handlers.
+  bool HasFullGuardRegions(const void* buffer_start);
+
   // Returns a pointer to a Wasm buffer's allocation data, or nullptr if the
   // buffer is not tracked.
   const AllocationData* FindAllocationData(const void* buffer_start);
 
-  // Empty WebAssembly memories are all backed by a shared inaccessible
-  // reservation. This method creates this store or returns the existing one if
-  // already created.
-  void* GetEmptyBackingStore(void** allocation_base, size_t* allocation_length,
-                             Heap* heap);
-
-  bool IsEmptyBackingStore(const void* buffer_start) const;
-
   // Checks if a buffer points to a Wasm memory and if so does any necessary
   // work to reclaim the buffer. If this function returns false, the caller must
   // free the buffer manually.
   bool FreeMemoryIfIsWasmMemory(const void* buffer_start);
 
+  void SetAllocationResultHistogram(Histogram* allocation_result) {
+    allocation_result_ = allocation_result;
+  }
+  void SetAddressSpaceUsageHistogram(Histogram* address_space_usage) {
+    address_space_usage_mb_ = address_space_usage;
+  }
+
+  // Allocation results are reported to UMA
+  //
+  // See wasm_memory_allocation_result in counters.h
+  enum class AllocationStatus {
+    kSuccess,  // Succeeded on the first try
+
+    kSuccessAfterRetry,  // Succeeded after garbage collection
+
+    kAddressSpaceLimitReachedFailure,  // Failed because Wasm is at its address
+                                       // space limit
+
+    kOtherFailure  // Failed for an unknown reason
+  };
+
+  void AddAllocationStatusSample(AllocationStatus status);
+
  private:
   AllocationData InternalReleaseAllocation(const void* buffer_start);
+  void AddAddressSpaceSample();
 
   // Clients use a two-part process. First they "reserve" the address space,
   // which signifies an intent to actually allocate it. This determines whether
@@ -105,17 +129,18 @@ class WasmMemoryTracker {
   // buffer, rather than by the start of the allocation.
   std::unordered_map<const void*, AllocationData> allocations_;
 
-  // Empty backing stores still need to be backed by mapped pages when using
-  // trap handlers. Because this could eat up address space quickly, we keep a
-  // shared backing store here.
-  AllocationData empty_backing_store_;
+  // Keep pointers to
+  Histogram* allocation_result_ = nullptr;
+  Histogram* address_space_usage_mb_ = nullptr;  // in MiB
 
   DISALLOW_COPY_AND_ASSIGN(WasmMemoryTracker);
 };
 
+// Attempts to allocate an array buffer with guard regions suitable for trap
+// handling. If address space is not available, it will return a buffer with
+// mini-guards that will require bounds checks.
 MaybeHandle<JSArrayBuffer> NewArrayBuffer(
-    Isolate*, size_t size, bool require_guard_regions,
-    SharedFlag shared = SharedFlag::kNotShared);
+    Isolate*, size_t size, SharedFlag shared = SharedFlag::kNotShared);
 
 Handle<JSArrayBuffer> SetupArrayBuffer(
     Isolate*, void* backing_store, size_t size, bool is_external,
diff --git a/deps/v8/src/wasm/wasm-module-builder.cc b/deps/v8/src/wasm/wasm-module-builder.cc
index 90b1d702cf87a6..a3ddc00ce45ca6 100644
--- a/deps/v8/src/wasm/wasm-module-builder.cc
+++ b/deps/v8/src/wasm/wasm-module-builder.cc
@@ -301,7 +301,7 @@ uint32_t WasmModuleBuilder::AddImport(Vector<const char> name,
 
 uint32_t WasmModuleBuilder::AddGlobalImport(Vector<const char> name,
                                             ValueType type) {
-  global_imports_.push_back({name, WasmOpcodes::ValueTypeCodeFor(type)});
+  global_imports_.push_back({name, ValueTypes::ValueTypeCodeFor(type)});
   return static_cast<uint32_t>(global_imports_.size() - 1);
 }
 
@@ -346,11 +346,11 @@ void WasmModuleBuilder::WriteTo(ZoneBuffer& buffer) const {
       buffer.write_u8(kWasmFunctionTypeCode);
       buffer.write_size(sig->parameter_count());
       for (auto param : sig->parameters()) {
-        buffer.write_u8(WasmOpcodes::ValueTypeCodeFor(param));
+        buffer.write_u8(ValueTypes::ValueTypeCodeFor(param));
       }
       buffer.write_size(sig->return_count());
       for (auto ret : sig->returns()) {
-        buffer.write_u8(WasmOpcodes::ValueTypeCodeFor(ret));
+        buffer.write_u8(ValueTypes::ValueTypeCodeFor(ret));
       }
     }
     FixupSection(buffer, start);
@@ -392,7 +392,7 @@ void WasmModuleBuilder::WriteTo(ZoneBuffer& buffer) const {
   if (indirect_functions_.size() > 0) {
     size_t start = EmitSection(kTableSectionCode, buffer);
     buffer.write_u8(1);  // table count
-    buffer.write_u8(kWasmAnyFunctionTypeCode);
+    buffer.write_u8(kLocalAnyFunc);
     buffer.write_u8(kHasMaximumFlag);
     buffer.write_size(indirect_functions_.size());
     buffer.write_size(indirect_functions_.size());
@@ -423,7 +423,7 @@ void WasmModuleBuilder::WriteTo(ZoneBuffer& buffer) const {
     buffer.write_size(globals_.size());
 
     for (auto global : globals_) {
-      buffer.write_u8(WasmOpcodes::ValueTypeCodeFor(global.type));
+      buffer.write_u8(ValueTypes::ValueTypeCodeFor(global.type));
       buffer.write_u8(global.mutability ? 1 : 0);
       switch (global.init.kind) {
         case WasmInitExpr::kI32Const:
diff --git a/deps/v8/src/wasm/wasm-module-builder.h b/deps/v8/src/wasm/wasm-module-builder.h
index 0beae76513b4e8..19ca123f0e25f2 100644
--- a/deps/v8/src/wasm/wasm-module-builder.h
+++ b/deps/v8/src/wasm/wasm-module-builder.h
@@ -33,19 +33,19 @@ class ZoneBuffer : public ZoneObject {
 
   void write_u16(uint16_t x) {
     EnsureSpace(2);
-    WriteLittleEndianValue<uint16_t>(pos_, x);
+    WriteLittleEndianValue<uint16_t>(reinterpret_cast<Address>(pos_), x);
     pos_ += 2;
   }
 
   void write_u32(uint32_t x) {
     EnsureSpace(4);
-    WriteLittleEndianValue<uint32_t>(pos_, x);
+    WriteLittleEndianValue<uint32_t>(reinterpret_cast<Address>(pos_), x);
     pos_ += 4;
   }
 
   void write_u64(uint64_t x) {
     EnsureSpace(8);
-    WriteLittleEndianValue<uint64_t>(pos_, x);
+    WriteLittleEndianValue<uint64_t>(reinterpret_cast<Address>(pos_), x);
     pos_ += 8;
   }
 
diff --git a/deps/v8/src/wasm/wasm-module.cc b/deps/v8/src/wasm/wasm-module.cc
index d8fa61ad9965fa..bd23345870c7ae 100644
--- a/deps/v8/src/wasm/wasm-module.cc
+++ b/deps/v8/src/wasm/wasm-module.cc
@@ -7,7 +7,6 @@
 
 #include "src/api.h"
 #include "src/assembler-inl.h"
-#include "src/code-stubs.h"
 #include "src/compiler/wasm-compiler.h"
 #include "src/debug/interface-types.h"
 #include "src/frames-inl.h"
@@ -16,10 +15,8 @@
 #include "src/simulator.h"
 #include "src/snapshot/snapshot.h"
 #include "src/v8.h"
-#include "src/wasm/compilation-manager.h"
 #include "src/wasm/module-decoder.h"
 #include "src/wasm/wasm-code-manager.h"
-#include "src/wasm/wasm-code-specialization.h"
 #include "src/wasm/wasm-js.h"
 #include "src/wasm/wasm-module.h"
 #include "src/wasm/wasm-objects-inl.h"
@@ -38,59 +35,52 @@ constexpr const char* WasmException::kRuntimeIdStr;
 // static
 constexpr const char* WasmException::kRuntimeValuesStr;
 
-WireBytesRef WasmModule::LookupName(const ModuleWireBytes* wire_bytes,
-                                    uint32_t function_index) const {
-  if (!names_) {
-    names_.reset(new std::unordered_map<uint32_t, WireBytesRef>());
-    wasm::DecodeFunctionNames(wire_bytes->start(), wire_bytes->end(),
-                              names_.get());
+WireBytesRef WasmModule::LookupFunctionName(const ModuleWireBytes& wire_bytes,
+                                            uint32_t function_index) const {
+  if (!function_names) {
+    function_names.reset(new std::unordered_map<uint32_t, WireBytesRef>());
+    wasm::DecodeFunctionNames(wire_bytes.start(), wire_bytes.end(),
+                              function_names.get());
   }
-  auto it = names_->find(function_index);
-  if (it == names_->end()) return WireBytesRef();
+  auto it = function_names->find(function_index);
+  if (it == function_names->end()) return WireBytesRef();
   return it->second;
 }
 
-WireBytesRef WasmModule::LookupName(SeqOneByteString* wire_bytes,
-                                    uint32_t function_index) const {
-  DisallowHeapAllocation no_gc;
-  uint8_t* chars = wire_bytes->GetChars();
-  ModuleWireBytes module_wire_bytes(chars, chars + wire_bytes->length());
-  return LookupName(&module_wire_bytes, function_index);
-}
-
-void WasmModule::AddNameForTesting(int function_index, WireBytesRef name) {
-  if (!names_) {
-    names_.reset(new std::unordered_map<uint32_t, WireBytesRef>());
+void WasmModule::AddFunctionNameForTesting(int function_index,
+                                           WireBytesRef name) {
+  if (!function_names) {
+    function_names.reset(new std::unordered_map<uint32_t, WireBytesRef>());
   }
-  names_->insert(std::make_pair(function_index, name));
+  function_names->insert(std::make_pair(function_index, name));
 }
 
 // Get a string stored in the module bytes representing a name.
 WasmName ModuleWireBytes::GetName(WireBytesRef ref) const {
   if (ref.is_empty()) return {"<?>", 3};  // no name.
   CHECK(BoundsCheck(ref.offset(), ref.length()));
-  return Vector<const char>::cast(
+  return WasmName::cast(
       module_bytes_.SubVector(ref.offset(), ref.end_offset()));
 }
 
 // Get a string stored in the module bytes representing a function name.
 WasmName ModuleWireBytes::GetName(const WasmFunction* function,
                                   const WasmModule* module) const {
-  return GetName(module->LookupName(this, function->func_index));
+  return GetName(module->LookupFunctionName(*this, function->func_index));
 }
 
 // Get a string stored in the module bytes representing a name.
 WasmName ModuleWireBytes::GetNameOrNull(WireBytesRef ref) const {
   if (!ref.is_set()) return {nullptr, 0};  // no name.
   CHECK(BoundsCheck(ref.offset(), ref.length()));
-  return Vector<const char>::cast(
+  return WasmName::cast(
       module_bytes_.SubVector(ref.offset(), ref.end_offset()));
 }
 
 // Get a string stored in the module bytes representing a function name.
 WasmName ModuleWireBytes::GetNameOrNull(const WasmFunction* function,
                                         const WasmModule* module) const {
-  return GetNameOrNull(module->LookupName(this, function->func_index));
+  return GetNameOrNull(module->LookupFunctionName(*this, function->func_index));
 }
 
 std::ostream& operator<<(std::ostream& os, const WasmFunctionName& name) {
@@ -128,8 +118,6 @@ bool IsWasmCodegenAllowed(Isolate* isolate, Handle<Context> context) {
 
 Handle<JSArray> GetImports(Isolate* isolate,
                            Handle<WasmModuleObject> module_object) {
-  Handle<WasmSharedModuleData> shared(
-      module_object->compiled_module()->shared(), isolate);
   Factory* factory = isolate->factory();
 
   Handle<String> module_string = factory->InternalizeUtf8String("module");
@@ -142,7 +130,7 @@ Handle<JSArray> GetImports(Isolate* isolate,
   Handle<String> global_string = factory->InternalizeUtf8String("global");
 
   // Create the result array.
-  WasmModule* module = shared->module();
+  const WasmModule* module = module_object->module();
   int num_imports = static_cast<int>(module->import_table.size());
   Handle<JSArray> array_object = factory->NewJSArray(PACKED_ELEMENTS, 0, 0);
   Handle<FixedArray> storage = factory->NewFixedArray(num_imports);
@@ -154,7 +142,7 @@ Handle<JSArray> GetImports(Isolate* isolate,
 
   // Populate the result array.
   for (int index = 0; index < num_imports; ++index) {
-    WasmImport& import = module->import_table[index];
+    const WasmImport& import = module->import_table[index];
 
     Handle<JSObject> entry = factory->NewJSObject(object_function);
 
@@ -177,18 +165,18 @@ Handle<JSArray> GetImports(Isolate* isolate,
     }
 
     MaybeHandle<String> import_module =
-        WasmSharedModuleData::ExtractUtf8StringFromModuleBytes(
-            isolate, shared, import.module_name);
+        WasmModuleObject::ExtractUtf8StringFromModuleBytes(
+            isolate, module_object, import.module_name);
 
     MaybeHandle<String> import_name =
-        WasmSharedModuleData::ExtractUtf8StringFromModuleBytes(
-            isolate, shared, import.field_name);
+        WasmModuleObject::ExtractUtf8StringFromModuleBytes(
+            isolate, module_object, import.field_name);
 
-    JSObject::AddProperty(entry, module_string, import_module.ToHandleChecked(),
-                          NONE);
-    JSObject::AddProperty(entry, name_string, import_name.ToHandleChecked(),
-                          NONE);
-    JSObject::AddProperty(entry, kind_string, import_kind, NONE);
+    JSObject::AddProperty(isolate, entry, module_string,
+                          import_module.ToHandleChecked(), NONE);
+    JSObject::AddProperty(isolate, entry, name_string,
+                          import_name.ToHandleChecked(), NONE);
+    JSObject::AddProperty(isolate, entry, kind_string, import_kind, NONE);
 
     storage->set(index, *entry);
   }
@@ -198,8 +186,6 @@ Handle<JSArray> GetImports(Isolate* isolate,
 
 Handle<JSArray> GetExports(Isolate* isolate,
                            Handle<WasmModuleObject> module_object) {
-  Handle<WasmSharedModuleData> shared(
-      module_object->compiled_module()->shared(), isolate);
   Factory* factory = isolate->factory();
 
   Handle<String> name_string = factory->InternalizeUtf8String("name");
@@ -211,7 +197,7 @@ Handle<JSArray> GetExports(Isolate* isolate,
   Handle<String> global_string = factory->InternalizeUtf8String("global");
 
   // Create the result array.
-  WasmModule* module = shared->module();
+  const WasmModule* module = module_object->module();
   int num_exports = static_cast<int>(module->export_table.size());
   Handle<JSArray> array_object = factory->NewJSArray(PACKED_ELEMENTS, 0, 0);
   Handle<FixedArray> storage = factory->NewFixedArray(num_exports);
@@ -223,7 +209,7 @@ Handle<JSArray> GetExports(Isolate* isolate,
 
   // Populate the result array.
   for (int index = 0; index < num_exports; ++index) {
-    WasmExport& exp = module->export_table[index];
+    const WasmExport& exp = module->export_table[index];
 
     Handle<String> export_kind;
     switch (exp.kind) {
@@ -246,12 +232,12 @@ Handle<JSArray> GetExports(Isolate* isolate,
     Handle<JSObject> entry = factory->NewJSObject(object_function);
 
     MaybeHandle<String> export_name =
-        WasmSharedModuleData::ExtractUtf8StringFromModuleBytes(isolate, shared,
-                                                               exp.name);
+        WasmModuleObject::ExtractUtf8StringFromModuleBytes(
+            isolate, module_object, exp.name);
 
-    JSObject::AddProperty(entry, name_string, export_name.ToHandleChecked(),
-                          NONE);
-    JSObject::AddProperty(entry, kind_string, export_kind, NONE);
+    JSObject::AddProperty(isolate, entry, name_string,
+                          export_name.ToHandleChecked(), NONE);
+    JSObject::AddProperty(isolate, entry, kind_string, export_kind, NONE);
 
     storage->set(index, *entry);
   }
@@ -262,27 +248,20 @@ Handle<JSArray> GetExports(Isolate* isolate,
 Handle<JSArray> GetCustomSections(Isolate* isolate,
                                   Handle<WasmModuleObject> module_object,
                                   Handle<String> name, ErrorThrower* thrower) {
-  Handle<WasmSharedModuleData> shared(
-      module_object->compiled_module()->shared(), isolate);
   Factory* factory = isolate->factory();
 
-  std::vector<CustomSectionOffset> custom_sections;
-  {
-    DisallowHeapAllocation no_gc;  // for raw access to string bytes.
-    Handle<SeqOneByteString> module_bytes(shared->module_bytes(), isolate);
-    const byte* start =
-        reinterpret_cast<const byte*>(module_bytes->GetCharsAddress());
-    const byte* end = start + module_bytes->length();
-    custom_sections = DecodeCustomSections(start, end);
-  }
+  Vector<const uint8_t> wire_bytes =
+      module_object->native_module()->wire_bytes();
+  std::vector<CustomSectionOffset> custom_sections =
+      DecodeCustomSections(wire_bytes.start(), wire_bytes.end());
 
   std::vector<Handle<Object>> matching_sections;
 
   // Gather matching sections.
   for (auto& section : custom_sections) {
     MaybeHandle<String> section_name =
-        WasmSharedModuleData::ExtractUtf8StringFromModuleBytes(isolate, shared,
-                                                               section.name);
+        WasmModuleObject::ExtractUtf8StringFromModuleBytes(
+            isolate, module_object, section.name);
 
     if (!name->Equals(*section_name.ToHandleChecked())) continue;
 
@@ -298,11 +277,8 @@ Handle<JSArray> GetCustomSections(Isolate* isolate,
     Handle<JSArrayBuffer> buffer = isolate->factory()->NewJSArrayBuffer();
     constexpr bool is_external = false;
     JSArrayBuffer::Setup(buffer, isolate, is_external, memory, size);
-    DisallowHeapAllocation no_gc;  // for raw access to string bytes.
-    Handle<SeqOneByteString> module_bytes(shared->module_bytes(), isolate);
-    const byte* start =
-        reinterpret_cast<const byte*>(module_bytes->GetCharsAddress());
-    memcpy(memory, start + section.payload.offset(), section.payload.length());
+    memcpy(memory, wire_bytes.start() + section.payload.offset(),
+           section.payload.length());
 
     matching_sections.push_back(buffer);
   }
@@ -321,15 +297,11 @@ Handle<JSArray> GetCustomSections(Isolate* isolate,
 }
 
 Handle<FixedArray> DecodeLocalNames(Isolate* isolate,
-                                    Handle<WasmSharedModuleData> shared) {
-  Handle<SeqOneByteString> wire_bytes(shared->module_bytes(), isolate);
+                                    Handle<WasmModuleObject> module_object) {
+  Vector<const uint8_t> wire_bytes =
+      module_object->native_module()->wire_bytes();
   LocalNames decoded_locals;
-  {
-    DisallowHeapAllocation no_gc;
-    DecodeLocalNames(wire_bytes->GetChars(),
-                     wire_bytes->GetChars() + wire_bytes->length(),
-                     &decoded_locals);
-  }
+  DecodeLocalNames(wire_bytes.start(), wire_bytes.end(), &decoded_locals);
   Handle<FixedArray> locals_names =
       isolate->factory()->NewFixedArray(decoded_locals.max_function_index + 1);
   for (LocalNamesPerFunction& func : decoded_locals.names) {
@@ -338,14 +310,32 @@ Handle<FixedArray> DecodeLocalNames(Isolate* isolate,
     locals_names->set(func.function_index, *func_locals_names);
     for (LocalName& name : func.names) {
       Handle<String> name_str =
-          WasmSharedModuleData::ExtractUtf8StringFromModuleBytes(
-              isolate, shared, name.name)
+          WasmModuleObject::ExtractUtf8StringFromModuleBytes(
+              isolate, module_object, name.name)
               .ToHandleChecked();
       func_locals_names->set(name.local_index, *name_str);
     }
   }
   return locals_names;
 }
+
+namespace {
+template <typename T>
+inline size_t VectorSize(const std::vector<T>& vector) {
+  return sizeof(T) * vector.size();
+}
+}  // namespace
+
+size_t EstimateWasmModuleSize(const WasmModule* module) {
+  size_t estimate =
+      sizeof(WasmModule) + VectorSize(module->signatures) +
+      VectorSize(module->signature_ids) + VectorSize(module->functions) +
+      VectorSize(module->data_segments) + VectorSize(module->tables) +
+      VectorSize(module->import_table) + VectorSize(module->export_table) +
+      VectorSize(module->exceptions) + VectorSize(module->table_inits);
+  // TODO(wasm): include names table and wire bytes in size estimate
+  return estimate;
+}
 }  // namespace wasm
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/src/wasm/wasm-module.h b/deps/v8/src/wasm/wasm-module.h
index 4a44b04915ffff..3020548927f6b6 100644
--- a/deps/v8/src/wasm/wasm-module.h
+++ b/deps/v8/src/wasm/wasm-module.h
@@ -7,36 +7,22 @@
 
 #include <memory>
 
-#include "src/debug/debug-interface.h"
 #include "src/globals.h"
 #include "src/handles.h"
-#include "src/managed.h"
-#include "src/parsing/preparse-data.h"
-
 #include "src/wasm/decoder.h"
 #include "src/wasm/signature-map.h"
 #include "src/wasm/wasm-constants.h"
+#include "src/wasm/wasm-opcodes.h"
 
 namespace v8 {
 namespace internal {
 
-class WasmCompiledModule;
 class WasmDebugInfo;
-class WasmGlobalObject;
-class WasmInstanceObject;
-class WasmMemoryObject;
 class WasmModuleObject;
-class WasmSharedModuleData;
-class WasmTableObject;
-
-namespace compiler {
-class CallDescriptor;
-}
 
 namespace wasm {
+
 class ErrorThrower;
-class NativeModule;
-class TestingModuleBuilder;
 
 // Static representation of a wasm function.
 struct WasmFunction {
@@ -50,12 +36,15 @@ struct WasmFunction {
 
 // Static representation of a wasm global variable.
 struct WasmGlobal {
-  ValueType type;        // type of the global.
-  bool mutability;       // {true} if mutable.
-  WasmInitExpr init;     // the initialization expression of the global.
-  uint32_t offset;       // offset into global memory.
-  bool imported;         // true if imported.
-  bool exported;         // true if exported.
+  ValueType type;     // type of the global.
+  bool mutability;    // {true} if mutable.
+  WasmInitExpr init;  // the initialization expression of the global.
+  union {
+    uint32_t index;   // index of imported mutable global.
+    uint32_t offset;  // offset into global memory (if not imported & mutable).
+  };
+  bool imported;  // true if imported.
+  bool exported;  // true if exported.
 };
 
 // Note: An exception signature only uses the params portion of a
@@ -84,9 +73,9 @@ struct WasmDataSegment {
 };
 
 // Static representation of a wasm indirect call table.
-struct WasmIndirectFunctionTable {
-  MOVE_ONLY_WITH_DEFAULT_CONSTRUCTORS(WasmIndirectFunctionTable);
-
+struct WasmTable {
+  MOVE_ONLY_WITH_DEFAULT_CONSTRUCTORS(WasmTable);
+  ValueType type = kWasmStmt;     // table type.
   uint32_t initial_size = 0;      // initial table size.
   uint32_t maximum_size = 0;      // maximum table size.
   bool has_maximum_size = false;  // true if there is a maximum size.
@@ -125,6 +114,10 @@ struct WasmExport {
 
 enum ModuleOrigin : uint8_t { kWasmOrigin, kAsmJsOrigin };
 
+#define SELECT_WASM_COUNTER(counters, origin, prefix, suffix)           \
+  ((origin) == wasm::kWasmOrigin ? (counters)->prefix##_wasm_##suffix() \
+                                 : (counters)->prefix##_asm_##suffix())
+
 struct ModuleWireBytes;
 
 // Static representation of a module.
@@ -141,44 +134,37 @@ struct V8_EXPORT_PRIVATE WasmModule {
   int start_function_index = -1;   // start function, >= 0 if any
 
   std::vector<WasmGlobal> globals;
-  uint32_t globals_size = 0;
+  // Size of the buffer required for all globals that are not imported and
+  // mutable.
+  uint32_t globals_buffer_size = 0;
+  uint32_t num_imported_mutable_globals = 0;
   uint32_t num_imported_functions = 0;
-  uint32_t num_declared_functions = 0;
+  uint32_t num_declared_functions = 0;  // excluding imported
   uint32_t num_exported_functions = 0;
   WireBytesRef name = {0, 0};
-  // TODO(wasm): Add url here, for spec'ed location information.
   std::vector<FunctionSig*> signatures;  // by signature index
   std::vector<uint32_t> signature_ids;   // by signature index
   std::vector<WasmFunction> functions;
   std::vector<WasmDataSegment> data_segments;
-  std::vector<WasmIndirectFunctionTable> function_tables;
+  std::vector<WasmTable> tables;
   std::vector<WasmImport> import_table;
   std::vector<WasmExport> export_table;
   std::vector<WasmException> exceptions;
   std::vector<WasmTableInit> table_inits;
   SignatureMap signature_map;  // canonicalizing map for signature indexes.
 
-  WasmModule() : WasmModule(nullptr) {}
-  WasmModule(std::unique_ptr<Zone> owned);
-
-  ModuleOrigin origin() const { return origin_; }
-  void set_origin(ModuleOrigin new_value) { origin_ = new_value; }
-  bool is_wasm() const { return origin_ == kWasmOrigin; }
-  bool is_asm_js() const { return origin_ == kAsmJsOrigin; }
+  ModuleOrigin origin = kWasmOrigin;  // origin of the module
+  mutable std::unique_ptr<std::unordered_map<uint32_t, WireBytesRef>>
+      function_names;
 
-  WireBytesRef LookupName(const ModuleWireBytes* wire_bytes,
-                          uint32_t function_index) const;
-  WireBytesRef LookupName(SeqOneByteString* wire_bytes,
-                          uint32_t function_index) const;
-  void AddNameForTesting(int function_index, WireBytesRef name);
+  explicit WasmModule(std::unique_ptr<Zone> owned = nullptr);
 
- private:
-  // TODO(kschimpf) - Encapsulate more fields.
-  ModuleOrigin origin_ = kWasmOrigin;  // origin of the module
-  mutable std::unique_ptr<std::unordered_map<uint32_t, WireBytesRef>> names_;
+  WireBytesRef LookupFunctionName(const ModuleWireBytes& wire_bytes,
+                                  uint32_t function_index) const;
+  void AddFunctionNameForTesting(int function_index, WireBytesRef name);
 };
 
-typedef Managed<WasmModule> WasmModuleWrapper;
+size_t EstimateWasmModuleSize(const WasmModule* module);
 
 // Interface to the storage (wire bytes) of a wasm module.
 // It is illegal for anyone receiving a ModuleWireBytes to store pointers based
@@ -260,7 +246,7 @@ V8_EXPORT_PRIVATE Handle<JSArray> GetCustomSections(
 // Decode local variable names from the names section. Return FixedArray of
 // FixedArray of <undefined|String>. The outer fixed array is indexed by the
 // function index, the inner one by the local index.
-Handle<FixedArray> DecodeLocalNames(Isolate*, Handle<WasmSharedModuleData>);
+Handle<FixedArray> DecodeLocalNames(Isolate*, Handle<WasmModuleObject>);
 
 // TruncatedUserString makes it easy to output names up to a certain length, and
 // output a truncation followed by '...' if they exceed a limit.
diff --git a/deps/v8/src/wasm/wasm-objects-inl.h b/deps/v8/src/wasm/wasm-objects-inl.h
index 8960ac2fc75918..96bb622afce6b6 100644
--- a/deps/v8/src/wasm/wasm-objects-inl.h
+++ b/deps/v8/src/wasm/wasm-objects-inl.h
@@ -5,33 +5,37 @@
 #ifndef V8_WASM_WASM_OBJECTS_INL_H_
 #define V8_WASM_WASM_OBJECTS_INL_H_
 
-#include "src/heap/heap-inl.h"
-#include "src/v8memory.h"
 #include "src/wasm/wasm-objects.h"
 
-namespace v8 {
-namespace internal {
+#include "src/contexts-inl.h"
+#include "src/heap/heap-inl.h"
+#include "src/objects/js-array-inl.h"
+#include "src/objects/managed.h"
+#include "src/v8memory.h"
+#include "src/wasm/wasm-module.h"
 
 // Has to be the last include (doesn't have include guards)
 #include "src/objects/object-macros.h"
 
-CAST_ACCESSOR(WasmCompiledModule)
+namespace v8 {
+namespace internal {
+
 CAST_ACCESSOR(WasmDebugInfo)
+CAST_ACCESSOR(WasmExportedFunctionData)
 CAST_ACCESSOR(WasmGlobalObject)
 CAST_ACCESSOR(WasmInstanceObject)
 CAST_ACCESSOR(WasmMemoryObject)
 CAST_ACCESSOR(WasmModuleObject)
-CAST_ACCESSOR(WasmSharedModuleData)
 CAST_ACCESSOR(WasmTableObject)
 
-#define OPTIONAL_ACCESSORS(holder, name, type, offset)           \
-  bool holder::has_##name() {                                    \
-    return !READ_FIELD(this, offset)->IsUndefined(GetIsolate()); \
-  }                                                              \
+#define OPTIONAL_ACCESSORS(holder, name, type, offset) \
+  bool holder::has_##name() {                          \
+    return !READ_FIELD(this, offset)->IsUndefined();   \
+  }                                                    \
   ACCESSORS(holder, name, type, offset)
 
 #define READ_PRIMITIVE_FIELD(p, type, offset) \
-  (*reinterpret_cast<type const*>(FIELD_ADDR_CONST(p, offset)))
+  (*reinterpret_cast<type const*>(FIELD_ADDR(p, offset)))
 
 #define WRITE_PRIMITIVE_FIELD(p, type, offset, value) \
   (*reinterpret_cast<type*>(FIELD_ADDR(p, offset)) = value)
@@ -45,8 +49,33 @@ CAST_ACCESSOR(WasmTableObject)
   }
 
 // WasmModuleObject
-ACCESSORS(WasmModuleObject, compiled_module, WasmCompiledModule,
-          kCompiledModuleOffset)
+ACCESSORS(WasmModuleObject, managed_native_module, Managed<wasm::NativeModule>,
+          kNativeModuleOffset)
+ACCESSORS(WasmModuleObject, export_wrappers, FixedArray, kExportWrappersOffset)
+ACCESSORS(WasmModuleObject, script, Script, kScriptOffset)
+ACCESSORS(WasmModuleObject, weak_instance_list, WeakArrayList,
+          kWeakInstanceListOffset)
+OPTIONAL_ACCESSORS(WasmModuleObject, asm_js_offset_table, ByteArray,
+                   kAsmJsOffsetTableOffset)
+OPTIONAL_ACCESSORS(WasmModuleObject, breakpoint_infos, FixedArray,
+                   kBreakPointInfosOffset)
+wasm::NativeModule* WasmModuleObject::native_module() const {
+  return managed_native_module()->raw();
+}
+const wasm::WasmModule* WasmModuleObject::module() const {
+  // TODO(clemensh): Remove this helper (inline in callers).
+  return native_module()->module();
+}
+void WasmModuleObject::reset_breakpoint_infos() {
+  WRITE_FIELD(this, kBreakPointInfosOffset,
+              GetReadOnlyRoots().undefined_value());
+}
+bool WasmModuleObject::is_asm_js() {
+  bool asm_js = module()->origin == wasm::kAsmJsOrigin;
+  DCHECK_EQ(asm_js, script()->IsUserJavaScript());
+  DCHECK_EQ(asm_js, has_asm_js_offset_table());
+  return asm_js;
+}
 
 // WasmTableObject
 ACCESSORS(WasmTableObject, functions, FixedArray, kFunctionsOffset)
@@ -67,23 +96,22 @@ BIT_FIELD_ACCESSORS(WasmGlobalObject, flags, type, WasmGlobalObject::TypeBits)
 BIT_FIELD_ACCESSORS(WasmGlobalObject, flags, is_mutable,
                     WasmGlobalObject::IsMutableBit)
 
-// static
-uint32_t WasmGlobalObject::TypeSize(wasm::ValueType type) {
-  return 1U << ElementSizeLog2Of(type);
+int WasmGlobalObject::type_size() const {
+  return wasm::ValueTypes::ElementSizeInBytes(type());
 }
 
-uint32_t WasmGlobalObject::type_size() const { return TypeSize(type()); }
-
 Address WasmGlobalObject::address() const {
   uint32_t buffer_size = 0;
   DCHECK(array_buffer()->byte_length()->ToUint32(&buffer_size));
-  DCHECK(offset() + type_size() <= buffer_size);
+  DCHECK_LE(offset() + type_size(), buffer_size);
   USE(buffer_size);
   return Address(array_buffer()->backing_store()) + offset();
 }
 
 int32_t WasmGlobalObject::GetI32() { return Memory::int32_at(address()); }
 
+int64_t WasmGlobalObject::GetI64() { return Memory::int64_at(address()); }
+
 float WasmGlobalObject::GetF32() { return Memory::float_at(address()); }
 
 double WasmGlobalObject::GetF64() { return Memory::double_at(address()); }
@@ -92,6 +120,10 @@ void WasmGlobalObject::SetI32(int32_t value) {
   Memory::int32_at(address()) = value;
 }
 
+void WasmGlobalObject::SetI64(int64_t value) {
+  Memory::int64_at(address()) = value;
+}
+
 void WasmGlobalObject::SetF32(float value) {
   Memory::float_at(address()) = value;
 }
@@ -106,24 +138,37 @@ PRIMITIVE_ACCESSORS(WasmInstanceObject, memory_size, uint32_t,
                     kMemorySizeOffset)
 PRIMITIVE_ACCESSORS(WasmInstanceObject, memory_mask, uint32_t,
                     kMemoryMaskOffset)
+PRIMITIVE_ACCESSORS(WasmInstanceObject, roots_array_address, Address,
+                    kRootsArrayAddressOffset)
+PRIMITIVE_ACCESSORS(WasmInstanceObject, stack_limit_address, Address,
+                    kStackLimitAddressOffset)
+PRIMITIVE_ACCESSORS(WasmInstanceObject, real_stack_limit_address, Address,
+                    kRealStackLimitAddressOffset)
 PRIMITIVE_ACCESSORS(WasmInstanceObject, imported_function_targets, Address*,
                     kImportedFunctionTargetsOffset)
 PRIMITIVE_ACCESSORS(WasmInstanceObject, globals_start, byte*,
                     kGlobalsStartOffset)
+PRIMITIVE_ACCESSORS(WasmInstanceObject, imported_mutable_globals, Address*,
+                    kImportedMutableGlobalsOffset)
 PRIMITIVE_ACCESSORS(WasmInstanceObject, indirect_function_table_size, uint32_t,
                     kIndirectFunctionTableSizeOffset)
 PRIMITIVE_ACCESSORS(WasmInstanceObject, indirect_function_table_sig_ids,
                     uint32_t*, kIndirectFunctionTableSigIdsOffset)
 PRIMITIVE_ACCESSORS(WasmInstanceObject, indirect_function_table_targets,
                     Address*, kIndirectFunctionTableTargetsOffset)
+PRIMITIVE_ACCESSORS(WasmInstanceObject, jump_table_adjusted_start, Address,
+                    kJumpTableAdjustedStartOffset)
 
-ACCESSORS(WasmInstanceObject, compiled_module, WasmCompiledModule,
-          kCompiledModuleOffset)
+ACCESSORS(WasmInstanceObject, module_object, WasmModuleObject,
+          kModuleObjectOffset)
 ACCESSORS(WasmInstanceObject, exports_object, JSObject, kExportsObjectOffset)
+ACCESSORS(WasmInstanceObject, native_context, Context, kNativeContextOffset)
 OPTIONAL_ACCESSORS(WasmInstanceObject, memory_object, WasmMemoryObject,
                    kMemoryObjectOffset)
-ACCESSORS(WasmInstanceObject, globals_buffer, JSArrayBuffer,
-          kGlobalsBufferOffset)
+OPTIONAL_ACCESSORS(WasmInstanceObject, globals_buffer, JSArrayBuffer,
+                   kGlobalsBufferOffset)
+OPTIONAL_ACCESSORS(WasmInstanceObject, imported_mutable_globals_buffers,
+                   FixedArray, kImportedMutableGlobalsBuffersOffset)
 OPTIONAL_ACCESSORS(WasmInstanceObject, debug_info, WasmDebugInfo,
                    kDebugInfoOffset)
 OPTIONAL_ACCESSORS(WasmInstanceObject, table_object, WasmTableObject,
@@ -134,42 +179,35 @@ ACCESSORS(WasmInstanceObject, imported_function_callables, FixedArray,
           kImportedFunctionCallablesOffset)
 OPTIONAL_ACCESSORS(WasmInstanceObject, indirect_function_table_instances,
                    FixedArray, kIndirectFunctionTableInstancesOffset)
-ACCESSORS(WasmInstanceObject, managed_native_allocations, Foreign,
-          kManagedNativeAllocationsOffset)
-OPTIONAL_ACCESSORS(WasmInstanceObject, managed_indirect_patcher, Foreign,
-                   kManagedIndirectPatcherOffset)
+OPTIONAL_ACCESSORS(WasmInstanceObject, managed_native_allocations, Foreign,
+                   kManagedNativeAllocationsOffset)
+ACCESSORS(WasmInstanceObject, undefined_value, Oddball, kUndefinedValueOffset)
+ACCESSORS(WasmInstanceObject, null_value, Oddball, kNullValueOffset)
+ACCESSORS(WasmInstanceObject, centry_stub, Code, kCEntryStubOffset)
 
 inline bool WasmInstanceObject::has_indirect_function_table() {
   return indirect_function_table_sig_ids() != nullptr;
 }
 
 IndirectFunctionTableEntry::IndirectFunctionTableEntry(
-    WasmInstanceObject* instance, int index)
+    Handle<WasmInstanceObject> instance, int index)
     : instance_(instance), index_(index) {
   DCHECK_GE(index, 0);
   DCHECK_LT(index, instance->indirect_function_table_size());
 }
 
-ImportedFunctionEntry::ImportedFunctionEntry(WasmInstanceObject* instance,
-                                             int index)
+ImportedFunctionEntry::ImportedFunctionEntry(
+    Handle<WasmInstanceObject> instance, int index)
     : instance_(instance), index_(index) {
   DCHECK_GE(index, 0);
   DCHECK_LT(index, instance->module()->num_imported_functions);
 }
 
-// WasmSharedModuleData
-ACCESSORS(WasmSharedModuleData, module_wrapper, Object, kModuleWrapperOffset)
-ACCESSORS(WasmSharedModuleData, module_bytes, SeqOneByteString,
-          kModuleBytesOffset)
-ACCESSORS(WasmSharedModuleData, script, Script, kScriptOffset)
-OPTIONAL_ACCESSORS(WasmSharedModuleData, asm_js_offset_table, ByteArray,
-                   kAsmJsOffsetTableOffset)
-OPTIONAL_ACCESSORS(WasmSharedModuleData, breakpoint_infos, FixedArray,
-                   kBreakPointInfosOffset)
-void WasmSharedModuleData::reset_breakpoint_infos() {
-  DCHECK(IsWasmSharedModuleData());
-  WRITE_FIELD(this, kBreakPointInfosOffset, GetHeap()->undefined_value());
-}
+// WasmExportedFunctionData
+ACCESSORS(WasmExportedFunctionData, wrapper_code, Code, kWrapperCodeOffset)
+ACCESSORS(WasmExportedFunctionData, instance, WasmInstanceObject,
+          kInstanceOffset)
+SMI_ACCESSORS(WasmExportedFunctionData, function_index, kFunctionIndexOffset)
 
 // WasmDebugInfo
 ACCESSORS(WasmDebugInfo, wasm_instance, WasmInstanceObject, kInstanceOffset)
@@ -183,56 +221,6 @@ OPTIONAL_ACCESSORS(WasmDebugInfo, c_wasm_entry_map, Managed<wasm::SignatureMap>,
                    kCWasmEntryMapOffset)
 
 #undef OPTIONAL_ACCESSORS
-
-#define WCM_OBJECT_OR_WEAK(TYPE, NAME, OFFSET, TYPE_CHECK)   \
-  bool WasmCompiledModule::has_##NAME() const {              \
-    Object* value = READ_FIELD(this, OFFSET);                \
-    return TYPE_CHECK;                                       \
-  }                                                          \
-                                                             \
-  void WasmCompiledModule::reset_##NAME() {                  \
-    WRITE_FIELD(this, OFFSET, GetHeap()->undefined_value()); \
-  }                                                          \
-                                                             \
-  ACCESSORS_CHECKED2(WasmCompiledModule, NAME, TYPE, OFFSET, TYPE_CHECK, true)
-
-#define WCM_OBJECT(TYPE, NAME, OFFSET) \
-  WCM_OBJECT_OR_WEAK(TYPE, NAME, OFFSET, value->Is##TYPE())
-
-#define WCM_SMALL_CONST_NUMBER(TYPE, NAME, OFFSET)                  \
-  TYPE WasmCompiledModule::NAME() const {                           \
-    return static_cast<TYPE>(Smi::ToInt(READ_FIELD(this, OFFSET))); \
-  }                                                                 \
-                                                                    \
-  void WasmCompiledModule::set_##NAME(TYPE value) {                 \
-    WRITE_FIELD(this, OFFSET, Smi::FromInt(value));                 \
-  }
-
-#define WCM_WEAK_LINK(TYPE, NAME, OFFSET)                                \
-  WCM_OBJECT_OR_WEAK(WeakCell, weak_##NAME, OFFSET, value->IsWeakCell()) \
-                                                                         \
-  TYPE* WasmCompiledModule::NAME() const {                               \
-    DCHECK(!weak_##NAME()->cleared());                                   \
-    return TYPE::cast(weak_##NAME()->value());                           \
-  }
-
-// WasmCompiledModule
-WCM_OBJECT(WasmSharedModuleData, shared, kSharedOffset)
-WCM_WEAK_LINK(Context, native_context, kNativeContextOffset)
-WCM_OBJECT(FixedArray, export_wrappers, kExportWrappersOffset)
-WCM_OBJECT(WasmCompiledModule, next_instance, kNextInstanceOffset)
-WCM_OBJECT(WasmCompiledModule, prev_instance, kPrevInstanceOffset)
-WCM_WEAK_LINK(WasmInstanceObject, owning_instance, kOwningInstanceOffset)
-WCM_WEAK_LINK(WasmModuleObject, wasm_module, kWasmModuleOffset)
-WCM_OBJECT(Foreign, native_module, kNativeModuleOffset)
-WCM_SMALL_CONST_NUMBER(bool, use_trap_handler, kUseTrapHandlerOffset)
-ACCESSORS(WasmCompiledModule, raw_next_instance, Object, kNextInstanceOffset);
-ACCESSORS(WasmCompiledModule, raw_prev_instance, Object, kPrevInstanceOffset);
-
-#undef WCM_OBJECT_OR_WEAK
-#undef WCM_OBJECT
-#undef WCM_SMALL_CONST_NUMBER
-#undef WCM_WEAK_LINK
 #undef READ_PRIMITIVE_FIELD
 #undef WRITE_PRIMITIVE_FIELD
 #undef PRIMITIVE_ACCESSORS
@@ -241,10 +229,6 @@ uint32_t WasmTableObject::current_length() { return functions()->length(); }
 
 bool WasmMemoryObject::has_maximum_pages() { return maximum_pages() >= 0; }
 
-inline bool WasmCompiledModule::has_instance() const {
-  return !weak_owning_instance()->cleared();
-}
-
 #include "src/objects/object-macros-undef.h"
 
 }  // namespace internal
diff --git a/deps/v8/src/wasm/wasm-objects.cc b/deps/v8/src/wasm/wasm-objects.cc
index df9c20a8c225f9..c941477c77c3b9 100644
--- a/deps/v8/src/wasm/wasm-objects.cc
+++ b/deps/v8/src/wasm/wasm-objects.cc
@@ -7,16 +7,18 @@
 
 #include "src/assembler-inl.h"
 #include "src/base/iterator.h"
+#include "src/code-factory.h"
 #include "src/compiler/wasm-compiler.h"
 #include "src/debug/debug-interface.h"
 #include "src/objects-inl.h"
 #include "src/objects/debug-objects-inl.h"
 #include "src/trap-handler/trap-handler.h"
+#include "src/wasm/jump-table-assembler.h"
 #include "src/wasm/module-compiler.h"
 #include "src/wasm/module-decoder.h"
 #include "src/wasm/wasm-code-manager.h"
-#include "src/wasm/wasm-code-specialization.h"
 #include "src/wasm/wasm-engine.h"
+#include "src/wasm/wasm-limits.h"
 #include "src/wasm/wasm-memory.h"
 #include "src/wasm/wasm-module.h"
 #include "src/wasm/wasm-objects-inl.h"
@@ -60,10 +62,14 @@ class WasmInstanceNativeAllocations {
 
   // Allocates initial native storage for a given instance.
   WasmInstanceNativeAllocations(Handle<WasmInstanceObject> instance,
-                                size_t num_imported_functions) {
+                                size_t num_imported_functions,
+                                size_t num_imported_mutable_globals) {
     SET(instance, imported_function_targets,
         reinterpret_cast<Address*>(
             calloc(num_imported_functions, sizeof(Address))));
+    SET(instance, imported_mutable_globals,
+        reinterpret_cast<Address*>(
+            calloc(num_imported_mutable_globals, sizeof(Address))));
   }
   ~WasmInstanceNativeAllocations() { free(); }
   // Frees natively-allocated storage.
@@ -71,9 +77,11 @@ class WasmInstanceNativeAllocations {
     ::free(indirect_function_table_sig_ids_);
     ::free(indirect_function_table_targets_);
     ::free(imported_function_targets_);
+    ::free(imported_mutable_globals_);
     indirect_function_table_sig_ids_ = nullptr;
     indirect_function_table_targets_ = nullptr;
     imported_function_targets_ = nullptr;
+    imported_mutable_globals_ = nullptr;
   }
   // Resizes the indirect function table.
   void resize_indirect_function_table(Isolate* isolate,
@@ -110,126 +118,41 @@ class WasmInstanceNativeAllocations {
 
     instance->set_indirect_function_table_instances(*new_instances);
     for (uint32_t j = old_size; j < new_size; j++) {
-      IndirectFunctionTableEntry(*instance, static_cast<int>(j)).clear();
+      IndirectFunctionTableEntry(instance, static_cast<int>(j)).clear();
     }
   }
   uint32_t* indirect_function_table_sig_ids_ = nullptr;
   Address* indirect_function_table_targets_ = nullptr;
   Address* imported_function_targets_ = nullptr;
+  Address* imported_mutable_globals_ = nullptr;
 #undef SET
 };
 
+size_t EstimateNativeAllocationsSize(const WasmModule* module) {
+  size_t estimate = sizeof(WasmInstanceNativeAllocations) +
+                    (1 * kPointerSize * module->num_imported_mutable_globals) +
+                    (2 * kPointerSize * module->num_imported_functions);
+  for (auto& table : module->tables) {
+    estimate += 3 * kPointerSize * table.initial_size;
+  }
+  return estimate;
+}
+
 WasmInstanceNativeAllocations* GetNativeAllocations(
     WasmInstanceObject* instance) {
   return reinterpret_cast<Managed<WasmInstanceNativeAllocations>*>(
              instance->managed_native_allocations())
-      ->get();
-}
-
-// An iterator that returns first the module itself, then all modules linked via
-// next, then all linked via prev.
-class CompiledModulesIterator
-    : public v8::base::iterator<std::input_iterator_tag,
-                                Handle<WasmCompiledModule>> {
- public:
-  CompiledModulesIterator(Isolate* isolate,
-                          Handle<WasmCompiledModule> start_module, bool at_end)
-      : isolate_(isolate),
-        start_module_(start_module),
-        current_(
-            at_end ? Handle<WasmCompiledModule>::null()
-                   : Handle<WasmCompiledModule>::New(*start_module, isolate)) {}
-
-  Handle<WasmCompiledModule> operator*() const {
-    DCHECK(!current_.is_null());
-    return current_;
-  }
-
-  void operator++() { Advance(); }
-
-  bool operator!=(const CompiledModulesIterator& other) {
-    DCHECK(start_module_.is_identical_to(other.start_module_));
-    return !current_.is_identical_to(other.current_);
-  }
-
- private:
-  void Advance() {
-    DCHECK(!current_.is_null());
-    if (!is_backwards_) {
-      if (current_->has_next_instance()) {
-        *current_.location() = current_->next_instance();
-        return;
-      }
-      // No more modules in next-links, now try the previous-links.
-      is_backwards_ = true;
-      current_ = start_module_;
-    }
-    if (current_->has_prev_instance()) {
-      *current_.location() = current_->prev_instance();
-      return;
-    }
-    current_ = Handle<WasmCompiledModule>::null();
-  }
-
-  friend class CompiledModuleInstancesIterator;
-  Isolate* isolate_;
-  Handle<WasmCompiledModule> start_module_;
-  Handle<WasmCompiledModule> current_;
-  bool is_backwards_ = false;
-};
-
-// An iterator based on the CompiledModulesIterator, but it returns all live
-// instances, not the WasmCompiledModules itself.
-class CompiledModuleInstancesIterator
-    : public v8::base::iterator<std::input_iterator_tag,
-                                Handle<WasmInstanceObject>> {
- public:
-  CompiledModuleInstancesIterator(Isolate* isolate,
-                                  Handle<WasmCompiledModule> start_module,
-                                  bool at_end)
-      : it(isolate, start_module, at_end) {
-    while (NeedToAdvance()) ++it;
-  }
-
-  Handle<WasmInstanceObject> operator*() {
-    return handle(
-        WasmInstanceObject::cast((*it)->weak_owning_instance()->value()),
-        it.isolate_);
-  }
-
-  void operator++() {
-    do {
-      ++it;
-    } while (NeedToAdvance());
-  }
-
-  bool operator!=(const CompiledModuleInstancesIterator& other) {
-    return it != other.it;
-  }
-
- private:
-  bool NeedToAdvance() {
-    return !it.current_.is_null() && !it.current_->has_instance();
-  }
-  CompiledModulesIterator it;
-};
-
-v8::base::iterator_range<CompiledModuleInstancesIterator>
-iterate_compiled_module_instance_chain(
-    Isolate* isolate, Handle<WasmCompiledModule> compiled_module) {
-  return {CompiledModuleInstancesIterator(isolate, compiled_module, false),
-          CompiledModuleInstancesIterator(isolate, compiled_module, true)};
+      ->raw();
 }
 
 #ifdef DEBUG
-bool IsBreakablePosition(WasmSharedModuleData* shared, int func_index,
+bool IsBreakablePosition(wasm::NativeModule* native_module, int func_index,
                          int offset_in_func) {
-  DisallowHeapAllocation no_gc;
   AccountingAllocator alloc;
   Zone tmp(&alloc, ZONE_NAME);
   wasm::BodyLocalDecls locals(&tmp);
-  const byte* module_start = shared->module_bytes()->GetChars();
-  WasmFunction& func = shared->module()->functions[func_index];
+  const byte* module_start = native_module->wire_bytes().start();
+  const WasmFunction& func = native_module->module()->functions[func_index];
   wasm::BytecodeIterator iterator(module_start + func.code.offset(),
                                   module_start + func.code.end_offset(),
                                   &locals);
@@ -252,1413 +175,1212 @@ enum DispatchTableElements : int {
 
 }  // namespace
 
+// static
 Handle<WasmModuleObject> WasmModuleObject::New(
-    Isolate* isolate, Handle<WasmCompiledModule> compiled_module) {
-  Handle<JSFunction> module_cons(
-      isolate->native_context()->wasm_module_constructor());
-  auto module_object = Handle<WasmModuleObject>::cast(
-      isolate->factory()->NewJSObject(module_cons));
-  module_object->set_compiled_module(*compiled_module);
-  Handle<WeakCell> link_to_module =
-      isolate->factory()->NewWeakCell(module_object);
-  compiled_module->set_weak_wasm_module(*link_to_module);
-
-  compiled_module->LogWasmCodes(isolate);
+    Isolate* isolate, std::shared_ptr<const wasm::WasmModule> shared_module,
+    wasm::ModuleEnv& env, OwnedVector<const uint8_t> wire_bytes,
+    Handle<Script> script, Handle<ByteArray> asm_js_offset_table) {
+  DCHECK_EQ(shared_module.get(), env.module);
+
+  // Create a new {NativeModule} first.
+  size_t native_memory_estimate =
+      isolate->wasm_engine()->code_manager()->EstimateNativeModuleSize(
+          env.module);
+  auto native_module = isolate->wasm_engine()->code_manager()->NewNativeModule(
+      isolate, native_memory_estimate,
+      wasm::NativeModule::kCanAllocateMoreMemory, std::move(shared_module),
+      env);
+  native_module->set_wire_bytes(std::move(wire_bytes));
+  native_module->SetRuntimeStubs(isolate);
+
+  // Delegate to the shared {WasmModuleObject::New} allocator.
+  Handle<WasmModuleObject> module_object =
+      New(isolate, std::move(native_module), script);
+  if (!asm_js_offset_table.is_null()) {
+    module_object->set_asm_js_offset_table(*asm_js_offset_table);
+  }
   return module_object;
 }
 
-void WasmModuleObject::ValidateStateForTesting(
-    Isolate* isolate, Handle<WasmModuleObject> module_obj) {
-  DisallowHeapAllocation no_gc;
-  WasmCompiledModule* compiled_module = module_obj->compiled_module();
-  CHECK(compiled_module->has_weak_wasm_module());
-  CHECK_EQ(compiled_module->weak_wasm_module()->value(), *module_obj);
-  CHECK(!compiled_module->has_prev_instance());
-  CHECK(!compiled_module->has_next_instance());
-  CHECK(!compiled_module->has_instance());
+// static
+Handle<WasmModuleObject> WasmModuleObject::New(
+    Isolate* isolate, std::shared_ptr<wasm::NativeModule> native_module,
+    Handle<Script> script) {
+  int export_wrapper_size =
+      static_cast<int>(native_module->module()->num_exported_functions);
+  Handle<FixedArray> export_wrappers =
+      isolate->factory()->NewFixedArray(export_wrapper_size, TENURED);
+  Handle<WasmModuleObject> module_object = Handle<WasmModuleObject>::cast(
+      isolate->factory()->NewJSObject(isolate->wasm_module_constructor()));
+  module_object->set_export_wrappers(*export_wrappers);
+  if (script->type() == Script::TYPE_WASM) {
+    script->set_wasm_module_object(*module_object);
+  }
+  module_object->set_script(*script);
+  module_object->set_weak_instance_list(
+      ReadOnlyRoots(isolate).empty_weak_array_list());
+
+  // Use the given shared {NativeModule}, but increase its reference count by
+  // allocating a new {Managed<T>} that the {WasmModuleObject} references.
+  size_t native_memory_estimate =
+      isolate->wasm_engine()->code_manager()->EstimateNativeModuleSize(
+          native_module->module());
+  size_t memory_estimate =
+      EstimateWasmModuleSize(native_module->module()) + native_memory_estimate;
+  Handle<Managed<wasm::NativeModule>> managed_native_module =
+      Managed<wasm::NativeModule>::FromSharedPtr(isolate, memory_estimate,
+                                                 std::move(native_module));
+  module_object->set_managed_native_module(*managed_native_module);
+  return module_object;
 }
 
-Handle<WasmTableObject> WasmTableObject::New(Isolate* isolate, uint32_t initial,
-                                             int64_t maximum,
-                                             Handle<FixedArray>* js_functions) {
-  Handle<JSFunction> table_ctor(
-      isolate->native_context()->wasm_table_constructor());
-  auto table_obj = Handle<WasmTableObject>::cast(
-      isolate->factory()->NewJSObject(table_ctor));
+bool WasmModuleObject::SetBreakPoint(Handle<WasmModuleObject> module_object,
+                                     int* position,
+                                     Handle<BreakPoint> break_point) {
+  Isolate* isolate = module_object->GetIsolate();
 
-  *js_functions = isolate->factory()->NewFixedArray(initial);
-  Object* null = isolate->heap()->null_value();
-  for (int i = 0; i < static_cast<int>(initial); ++i) {
-    (*js_functions)->set(i, null);
+  // Find the function for this breakpoint.
+  int func_index = module_object->GetContainingFunction(*position);
+  if (func_index < 0) return false;
+  const WasmFunction& func = module_object->module()->functions[func_index];
+  int offset_in_func = *position - func.code.offset();
+
+  // According to the current design, we should only be called with valid
+  // breakable positions.
+  DCHECK(IsBreakablePosition(module_object->native_module(), func_index,
+                             offset_in_func));
+
+  // Insert new break point into break_positions of module object.
+  WasmModuleObject::AddBreakpoint(module_object, *position, break_point);
+
+  // Iterate over all instances of this module and tell them to set this new
+  // breakpoint. We do this using the weak list of all instances.
+  Handle<WeakArrayList> weak_instance_list(module_object->weak_instance_list(),
+                                           isolate);
+  for (int i = 0; i < weak_instance_list->length(); ++i) {
+    MaybeObject* maybe_instance = weak_instance_list->Get(i);
+    if (maybe_instance->IsWeakHeapObject()) {
+      Handle<WasmInstanceObject> instance(
+          WasmInstanceObject::cast(maybe_instance->ToWeakHeapObject()),
+          isolate);
+      Handle<WasmDebugInfo> debug_info =
+          WasmInstanceObject::GetOrCreateDebugInfo(instance);
+      WasmDebugInfo::SetBreakpoint(debug_info, func_index, offset_in_func);
+    }
   }
-  table_obj->set_functions(**js_functions);
-  DCHECK_EQ(maximum, static_cast<int>(maximum));
-  Handle<Object> max = isolate->factory()->NewNumber(maximum);
-  table_obj->set_maximum_length(*max);
 
-  table_obj->set_dispatch_tables(isolate->heap()->empty_fixed_array());
-  return Handle<WasmTableObject>::cast(table_obj);
+  return true;
 }
 
-void WasmTableObject::AddDispatchTable(Isolate* isolate,
-                                       Handle<WasmTableObject> table_obj,
-                                       Handle<WasmInstanceObject> instance,
-                                       int table_index) {
-  Handle<FixedArray> dispatch_tables(table_obj->dispatch_tables());
-  int old_length = dispatch_tables->length();
-  DCHECK_EQ(0, old_length % kDispatchTableNumElements);
+namespace {
 
-  if (instance.is_null()) return;
-  // TODO(titzer): use weak cells here to avoid leaking instances.
+int GetBreakpointPos(Isolate* isolate, Object* break_point_info_or_undef) {
+  if (break_point_info_or_undef->IsUndefined(isolate)) return kMaxInt;
+  return BreakPointInfo::cast(break_point_info_or_undef)->source_position();
+}
 
-  // Grow the dispatch table and add a new entry at the end.
-  Handle<FixedArray> new_dispatch_tables =
-      isolate->factory()->CopyFixedArrayAndGrow(dispatch_tables,
-                                                kDispatchTableNumElements);
+int FindBreakpointInfoInsertPos(Isolate* isolate,
+                                Handle<FixedArray> breakpoint_infos,
+                                int position) {
+  // Find insert location via binary search, taking care of undefined values on
+  // the right. Position is always greater than zero.
+  DCHECK_LT(0, position);
 
-  new_dispatch_tables->set(old_length + kDispatchTableInstanceOffset,
-                           *instance);
-  new_dispatch_tables->set(old_length + kDispatchTableIndexOffset,
-                           Smi::FromInt(table_index));
+  int left = 0;                            // inclusive
+  int right = breakpoint_infos->length();  // exclusive
+  while (right - left > 1) {
+    int mid = left + (right - left) / 2;
+    Object* mid_obj = breakpoint_infos->get(mid);
+    if (GetBreakpointPos(isolate, mid_obj) <= position) {
+      left = mid;
+    } else {
+      right = mid;
+    }
+  }
 
-  table_obj->set_dispatch_tables(*new_dispatch_tables);
+  int left_pos = GetBreakpointPos(isolate, breakpoint_infos->get(left));
+  return left_pos < position ? left + 1 : left;
 }
 
-void WasmTableObject::Grow(Isolate* isolate, uint32_t count) {
-  if (count == 0) return;  // Degenerate case: nothing to do.
+}  // namespace
 
-  Handle<FixedArray> dispatch_tables(this->dispatch_tables());
-  DCHECK_EQ(0, dispatch_tables->length() % kDispatchTableNumElements);
-  uint32_t old_size = functions()->length();
+void WasmModuleObject::AddBreakpoint(Handle<WasmModuleObject> module_object,
+                                     int position,
+                                     Handle<BreakPoint> break_point) {
+  Isolate* isolate = module_object->GetIsolate();
+  Handle<FixedArray> breakpoint_infos;
+  if (module_object->has_breakpoint_infos()) {
+    breakpoint_infos = handle(module_object->breakpoint_infos(), isolate);
+  } else {
+    breakpoint_infos = isolate->factory()->NewFixedArray(4, TENURED);
+    module_object->set_breakpoint_infos(*breakpoint_infos);
+  }
 
-  // Tables are stored in the instance object, no code patching is
-  // necessary. We simply have to grow the raw tables in each instance
-  // that has imported this table.
+  int insert_pos =
+      FindBreakpointInfoInsertPos(isolate, breakpoint_infos, position);
 
-  // TODO(titzer): replace the dispatch table with a weak list of all
-  // the instances that import a given table.
-  for (int i = 0; i < dispatch_tables->length();
-       i += kDispatchTableNumElements) {
-    Handle<WasmInstanceObject> instance(
-        WasmInstanceObject::cast(dispatch_tables->get(i)), isolate);
-    DCHECK_EQ(old_size, instance->indirect_function_table_size());
-    uint32_t new_size = old_size + count;
-    WasmInstanceObject::EnsureIndirectFunctionTableWithMinimumSize(instance,
-                                                                   new_size);
+  // If a BreakPointInfo object already exists for this position, add the new
+  // breakpoint object and return.
+  if (insert_pos < breakpoint_infos->length() &&
+      GetBreakpointPos(isolate, breakpoint_infos->get(insert_pos)) ==
+          position) {
+    Handle<BreakPointInfo> old_info(
+        BreakPointInfo::cast(breakpoint_infos->get(insert_pos)), isolate);
+    BreakPointInfo::SetBreakPoint(isolate, old_info, break_point);
+    return;
   }
-}
 
-void WasmTableObject::Set(Isolate* isolate, Handle<WasmTableObject> table,
-                          int32_t table_index, Handle<JSFunction> function) {
-  Handle<FixedArray> array(table->functions(), isolate);
-  if (function.is_null()) {
-    ClearDispatchTables(table, table_index);  // Degenerate case of null value.
-    array->set(table_index, isolate->heap()->null_value());
-    return;
+  // Enlarge break positions array if necessary.
+  bool need_realloc = !breakpoint_infos->get(breakpoint_infos->length() - 1)
+                           ->IsUndefined(isolate);
+  Handle<FixedArray> new_breakpoint_infos = breakpoint_infos;
+  if (need_realloc) {
+    new_breakpoint_infos = isolate->factory()->NewFixedArray(
+        2 * breakpoint_infos->length(), TENURED);
+    module_object->set_breakpoint_infos(*new_breakpoint_infos);
+    // Copy over the entries [0, insert_pos).
+    for (int i = 0; i < insert_pos; ++i)
+      new_breakpoint_infos->set(i, breakpoint_infos->get(i));
   }
 
-  // TODO(titzer): Change this to MaybeHandle<WasmExportedFunction>
-  DCHECK(WasmExportedFunction::IsWasmExportedFunction(*function));
-  auto exported_function = Handle<WasmExportedFunction>::cast(function);
-  Handle<WasmInstanceObject> other_instance(exported_function->instance());
-  int func_index = exported_function->function_index();
-  auto* wasm_function = &other_instance->module()->functions[func_index];
-  DCHECK_NOT_NULL(wasm_function);
-  DCHECK_NOT_NULL(wasm_function->sig);
-  wasm::WasmCode* wasm_code = exported_function->GetWasmCode();
-  UpdateDispatchTables(isolate, table, table_index, wasm_function->sig,
-                       handle(exported_function->instance()), wasm_code);
-  array->set(table_index, *function);
-}
+  // Move elements [insert_pos, ...] up by one.
+  for (int i = breakpoint_infos->length() - 1; i >= insert_pos; --i) {
+    Object* entry = breakpoint_infos->get(i);
+    if (entry->IsUndefined(isolate)) continue;
+    new_breakpoint_infos->set(i + 1, entry);
+  }
 
-void WasmTableObject::UpdateDispatchTables(
-    Isolate* isolate, Handle<WasmTableObject> table, int table_index,
-    wasm::FunctionSig* sig, Handle<WasmInstanceObject> from_instance,
-    wasm::WasmCode* wasm_code) {
-  // We simply need to update the IFTs for each instance that imports
-  // this table.
-  DisallowHeapAllocation no_gc;
-  FixedArray* dispatch_tables = table->dispatch_tables();
-  DCHECK_EQ(0, dispatch_tables->length() % kDispatchTableNumElements);
+  // Generate new BreakpointInfo.
+  Handle<BreakPointInfo> breakpoint_info =
+      isolate->factory()->NewBreakPointInfo(position);
+  BreakPointInfo::SetBreakPoint(isolate, breakpoint_info, break_point);
 
-  for (int i = 0; i < dispatch_tables->length();
-       i += kDispatchTableNumElements) {
-    // Note that {SignatureMap::Find} may return {-1} if the signature is
-    // not found; it will simply never match any check.
-    WasmInstanceObject* to_instance = WasmInstanceObject::cast(
-        dispatch_tables->get(i + kDispatchTableInstanceOffset));
-    auto sig_id = to_instance->module()->signature_map.Find(sig);
-    IndirectFunctionTableEntry(to_instance, table_index)
-        .set(sig_id, *from_instance, wasm_code);
-  }
+  // Now insert new position at insert_pos.
+  new_breakpoint_infos->set(insert_pos, *breakpoint_info);
 }
 
-void WasmTableObject::ClearDispatchTables(Handle<WasmTableObject> table,
-                                          int index) {
-  DisallowHeapAllocation no_gc;
-  FixedArray* dispatch_tables = table->dispatch_tables();
-  DCHECK_EQ(0, dispatch_tables->length() % kDispatchTableNumElements);
-  for (int i = 0; i < dispatch_tables->length();
-       i += kDispatchTableNumElements) {
-    WasmInstanceObject* target_instance = WasmInstanceObject::cast(
-        dispatch_tables->get(i + kDispatchTableInstanceOffset));
-    DCHECK_LT(index, target_instance->indirect_function_table_size());
-    IndirectFunctionTableEntry(target_instance, index).clear();
+void WasmModuleObject::SetBreakpointsOnNewInstance(
+    Handle<WasmModuleObject> module_object,
+    Handle<WasmInstanceObject> instance) {
+  if (!module_object->has_breakpoint_infos()) return;
+  Isolate* isolate = module_object->GetIsolate();
+  Handle<WasmDebugInfo> debug_info =
+      WasmInstanceObject::GetOrCreateDebugInfo(instance);
+
+  Handle<FixedArray> breakpoint_infos(module_object->breakpoint_infos(),
+                                      isolate);
+  // If the array exists, it should not be empty.
+  DCHECK_LT(0, breakpoint_infos->length());
+
+  for (int i = 0, e = breakpoint_infos->length(); i < e; ++i) {
+    Handle<Object> obj(breakpoint_infos->get(i), isolate);
+    if (obj->IsUndefined(isolate)) {
+      for (; i < e; ++i) {
+        DCHECK(breakpoint_infos->get(i)->IsUndefined(isolate));
+      }
+      break;
+    }
+    Handle<BreakPointInfo> breakpoint_info = Handle<BreakPointInfo>::cast(obj);
+    int position = breakpoint_info->source_position();
+
+    // Find the function for this breakpoint, and set the breakpoint.
+    int func_index = module_object->GetContainingFunction(position);
+    DCHECK_LE(0, func_index);
+    const WasmFunction& func = module_object->module()->functions[func_index];
+    int offset_in_func = position - func.code.offset();
+    WasmDebugInfo::SetBreakpoint(debug_info, func_index, offset_in_func);
   }
 }
 
 namespace {
-MaybeHandle<JSArrayBuffer> GrowMemoryBuffer(Isolate* isolate,
-                                            Handle<JSArrayBuffer> old_buffer,
-                                            uint32_t pages,
-                                            uint32_t maximum_pages,
-                                            bool use_trap_handler) {
-  if (!old_buffer->is_growable()) return {};
-  Address old_mem_start = nullptr;
-  uint32_t old_size = 0;
-  if (!old_buffer.is_null()) {
-    old_mem_start = static_cast<Address>(old_buffer->backing_store());
-    CHECK(old_buffer->byte_length()->ToUint32(&old_size));
-  }
-  DCHECK_EQ(0, old_size % wasm::kWasmPageSize);
-  uint32_t old_pages = old_size / wasm::kWasmPageSize;
-  DCHECK_GE(std::numeric_limits<uint32_t>::max(),
-            old_size + pages * wasm::kWasmPageSize);
-  if (old_pages > maximum_pages || pages > maximum_pages - old_pages) return {};
-  size_t new_size =
-      static_cast<size_t>(old_pages + pages) * wasm::kWasmPageSize;
-  if (new_size > FLAG_wasm_max_mem_pages * wasm::kWasmPageSize ||
-      new_size > kMaxInt) {
-    return {};
+
+enum AsmJsOffsetTableEntryLayout {
+  kOTEByteOffset,
+  kOTECallPosition,
+  kOTENumberConvPosition,
+  kOTESize
+};
+
+Handle<ByteArray> GetDecodedAsmJsOffsetTable(
+    Handle<WasmModuleObject> module_object, Isolate* isolate) {
+  DCHECK(module_object->is_asm_js());
+  Handle<ByteArray> offset_table(module_object->asm_js_offset_table(), isolate);
+
+  // The last byte in the asm_js_offset_tables ByteArray tells whether it is
+  // still encoded (0) or decoded (1).
+  enum AsmJsTableType : int { Encoded = 0, Decoded = 1 };
+  int table_type = offset_table->get(offset_table->length() - 1);
+  DCHECK(table_type == Encoded || table_type == Decoded);
+  if (table_type == Decoded) return offset_table;
+
+  wasm::AsmJsOffsetsResult asm_offsets;
+  {
+    DisallowHeapAllocation no_gc;
+    byte* bytes_start = offset_table->GetDataStartAddress();
+    byte* bytes_end = reinterpret_cast<byte*>(
+        reinterpret_cast<Address>(bytes_start) + offset_table->length() - 1);
+    asm_offsets = wasm::DecodeAsmJsOffsets(bytes_start, bytes_end);
   }
-  // Reusing the backing store from externalized buffers causes problems with
-  // Blink's array buffers. The connection between the two is lost, which can
-  // lead to Blink not knowing about the other reference to the buffer and
-  // freeing it too early.
-  if (!old_buffer->is_external() && old_size != 0 &&
-      ((new_size < old_buffer->allocation_length()) || old_size == new_size)) {
-    DCHECK_NOT_NULL(old_buffer->backing_store());
-    if (old_size != new_size) {
-      // If adjusting permissions fails, propagate error back to return
-      // failure to grow.
-      DCHECK(!isolate->wasm_engine()->memory_tracker()->IsEmptyBackingStore(
-          old_mem_start));
-      if (!i::SetPermissions(old_mem_start, new_size,
-                             PageAllocator::kReadWrite)) {
-        return {};
-      }
-      reinterpret_cast<v8::Isolate*>(isolate)
-          ->AdjustAmountOfExternalAllocatedMemory(pages * wasm::kWasmPageSize);
-    }
-    // NOTE: We must allocate a new array buffer here because the spec
-    // assumes that ArrayBuffers do not change size.
-    void* backing_store = old_buffer->backing_store();
-    bool is_external = old_buffer->is_external();
-    // Disconnect buffer early so GC won't free it.
-    i::wasm::DetachMemoryBuffer(isolate, old_buffer, false);
-    Handle<JSArrayBuffer> new_buffer =
-        wasm::SetupArrayBuffer(isolate, backing_store, new_size, is_external);
-    return new_buffer;
-  } else {
-    // We couldn't reuse the old backing store, so create a new one and copy the
-    // old contents in.
-    Handle<JSArrayBuffer> new_buffer;
-    if (!wasm::NewArrayBuffer(isolate, new_size, use_trap_handler)
-             .ToHandle(&new_buffer)) {
-      return {};
-    }
-    if (old_size == 0) return new_buffer;
-    Address new_mem_start = static_cast<Address>(new_buffer->backing_store());
-    memcpy(new_mem_start, old_mem_start, old_size);
-    DCHECK(old_buffer.is_null() || !old_buffer->is_shared());
-    constexpr bool free_memory = true;
-    i::wasm::DetachMemoryBuffer(isolate, old_buffer, free_memory);
-    return new_buffer;
+  // Wasm bytes must be valid and must contain asm.js offset table.
+  DCHECK(asm_offsets.ok());
+  DCHECK_GE(kMaxInt, asm_offsets.val.size());
+  int num_functions = static_cast<int>(asm_offsets.val.size());
+  int num_imported_functions =
+      static_cast<int>(module_object->module()->num_imported_functions);
+  DCHECK_EQ(module_object->module()->functions.size(),
+            static_cast<size_t>(num_functions) + num_imported_functions);
+  int num_entries = 0;
+  for (int func = 0; func < num_functions; ++func) {
+    size_t new_size = asm_offsets.val[func].size();
+    DCHECK_LE(new_size, static_cast<size_t>(kMaxInt) - num_entries);
+    num_entries += static_cast<int>(new_size);
   }
-}
+  // One byte to encode that this is a decoded table.
+  DCHECK_GE(kMaxInt,
+            1 + static_cast<uint64_t>(num_entries) * kOTESize * kIntSize);
+  int total_size = 1 + num_entries * kOTESize * kIntSize;
+  Handle<ByteArray> decoded_table =
+      isolate->factory()->NewByteArray(total_size, TENURED);
+  decoded_table->set(total_size - 1, AsmJsTableType::Decoded);
+  module_object->set_asm_js_offset_table(*decoded_table);
 
-// May GC, because SetSpecializationMemInfoFrom may GC
-void SetInstanceMemory(Isolate* isolate, Handle<WasmInstanceObject> instance,
-                       Handle<JSArrayBuffer> buffer) {
-  instance->SetRawMemory(reinterpret_cast<byte*>(buffer->backing_store()),
-                         buffer->byte_length()->Number());
-#if DEBUG
-  // To flush out bugs earlier, in DEBUG mode, check that all pages of the
-  // memory are accessible by reading and writing one byte on each page.
-  byte* mem_start = instance->memory_start();
-  uintptr_t mem_size = instance->memory_size();
-  for (uint32_t offset = 0; offset < mem_size; offset += wasm::kWasmPageSize) {
-    byte val = mem_start[offset];
-    USE(val);
-    mem_start[offset] = val;
+  int idx = 0;
+  const std::vector<WasmFunction>& wasm_funs =
+      module_object->module()->functions;
+  for (int func = 0; func < num_functions; ++func) {
+    std::vector<wasm::AsmJsOffsetEntry>& func_asm_offsets =
+        asm_offsets.val[func];
+    if (func_asm_offsets.empty()) continue;
+    int func_offset = wasm_funs[num_imported_functions + func].code.offset();
+    for (wasm::AsmJsOffsetEntry& e : func_asm_offsets) {
+      // Byte offsets must be strictly monotonously increasing:
+      DCHECK_IMPLIES(idx > 0, func_offset + e.byte_offset >
+                                  decoded_table->get_int(idx - kOTESize));
+      decoded_table->set_int(idx + kOTEByteOffset, func_offset + e.byte_offset);
+      decoded_table->set_int(idx + kOTECallPosition, e.source_position_call);
+      decoded_table->set_int(idx + kOTENumberConvPosition,
+                             e.source_position_number_conversion);
+      idx += kOTESize;
+    }
   }
-#endif
+  DCHECK_EQ(total_size, idx * kIntSize + 1);
+  return decoded_table;
 }
 
 }  // namespace
 
-Handle<WasmMemoryObject> WasmMemoryObject::New(
-    Isolate* isolate, MaybeHandle<JSArrayBuffer> maybe_buffer,
-    int32_t maximum) {
-  // TODO(kschimpf): Do we need to add an argument that defines the
-  // style of memory the user prefers (with/without trap handling), so
-  // that the memory will match the style of the compiled wasm module.
-  // See issue v8:7143
-  Handle<JSFunction> memory_ctor(
-      isolate->native_context()->wasm_memory_constructor());
-  auto memory_obj = Handle<WasmMemoryObject>::cast(
-      isolate->factory()->NewJSObject(memory_ctor, TENURED));
+int WasmModuleObject::GetSourcePosition(Handle<WasmModuleObject> module_object,
+                                        uint32_t func_index,
+                                        uint32_t byte_offset,
+                                        bool is_at_number_conversion) {
+  Isolate* isolate = module_object->GetIsolate();
+  const WasmModule* module = module_object->module();
 
-  Handle<JSArrayBuffer> buffer;
-  if (maybe_buffer.is_null()) {
-    // If no buffer was provided, create a 0-length one.
-    buffer = wasm::SetupArrayBuffer(isolate, nullptr, 0, false);
-  } else {
-    buffer = maybe_buffer.ToHandleChecked();
-    // Paranoid check that the buffer size makes sense.
-    uint32_t mem_size = 0;
-    CHECK(buffer->byte_length()->ToUint32(&mem_size));
+  if (module->origin != wasm::kAsmJsOrigin) {
+    // for non-asm.js modules, we just add the function's start offset
+    // to make a module-relative position.
+    return byte_offset + module_object->GetFunctionOffset(func_index);
   }
-  memory_obj->set_array_buffer(*buffer);
-  memory_obj->set_maximum_pages(maximum);
-
-  return memory_obj;
-}
 
-uint32_t WasmMemoryObject::current_pages() {
-  uint32_t byte_length;
-  CHECK(array_buffer()->byte_length()->ToUint32(&byte_length));
-  return byte_length / wasm::kWasmPageSize;
-}
+  // asm.js modules have an additional offset table that must be searched.
+  Handle<ByteArray> offset_table =
+      GetDecodedAsmJsOffsetTable(module_object, isolate);
 
-void WasmMemoryObject::AddInstance(Isolate* isolate,
-                                   Handle<WasmMemoryObject> memory,
-                                   Handle<WasmInstanceObject> instance) {
-  Handle<FixedArrayOfWeakCells> old_instances =
-      memory->has_instances()
-          ? Handle<FixedArrayOfWeakCells>(memory->instances(), isolate)
-          : Handle<FixedArrayOfWeakCells>::null();
-  Handle<FixedArrayOfWeakCells> new_instances =
-      FixedArrayOfWeakCells::Add(old_instances, instance);
-  memory->set_instances(*new_instances);
-  Handle<JSArrayBuffer> buffer(memory->array_buffer(), isolate);
-  SetInstanceMemory(isolate, instance, buffer);
-}
+  DCHECK_LT(func_index, module->functions.size());
+  uint32_t func_code_offset = module->functions[func_index].code.offset();
+  uint32_t total_offset = func_code_offset + byte_offset;
 
-void WasmMemoryObject::RemoveInstance(Isolate* isolate,
-                                      Handle<WasmMemoryObject> memory,
-                                      Handle<WasmInstanceObject> instance) {
-  if (memory->has_instances()) {
-    memory->instances()->Remove(instance);
+  // Binary search for the total byte offset.
+  int left = 0;                                              // inclusive
+  int right = offset_table->length() / kIntSize / kOTESize;  // exclusive
+  DCHECK_LT(left, right);
+  while (right - left > 1) {
+    int mid = left + (right - left) / 2;
+    int mid_entry = offset_table->get_int(kOTESize * mid);
+    DCHECK_GE(kMaxInt, mid_entry);
+    if (static_cast<uint32_t>(mid_entry) <= total_offset) {
+      left = mid;
+    } else {
+      right = mid;
+    }
   }
+  // There should be an entry for each position that could show up on the stack
+  // trace:
+  DCHECK_EQ(total_offset, offset_table->get_int(kOTESize * left));
+  int idx = is_at_number_conversion ? kOTENumberConvPosition : kOTECallPosition;
+  return offset_table->get_int(kOTESize * left + idx);
 }
 
-// static
-int32_t WasmMemoryObject::Grow(Isolate* isolate,
-                               Handle<WasmMemoryObject> memory_object,
-                               uint32_t pages) {
-  Handle<JSArrayBuffer> old_buffer(memory_object->array_buffer());
-  if (!old_buffer->is_growable()) return -1;
-  uint32_t old_size = 0;
-  CHECK(old_buffer->byte_length()->ToUint32(&old_size));
-  DCHECK_EQ(0, old_size % wasm::kWasmPageSize);
-  Handle<JSArrayBuffer> new_buffer;
+v8::debug::WasmDisassembly WasmModuleObject::DisassembleFunction(
+    int func_index) {
+  DisallowHeapAllocation no_gc;
 
-  uint32_t maximum_pages = FLAG_wasm_max_mem_pages;
-  if (memory_object->has_maximum_pages()) {
-    maximum_pages = Min(FLAG_wasm_max_mem_pages,
-                        static_cast<uint32_t>(memory_object->maximum_pages()));
-  }
-  // TODO(kschimpf): We need to fix this by adding a field to WasmMemoryObject
-  // that defines the style of memory being used.
-  if (!GrowMemoryBuffer(isolate, old_buffer, pages, maximum_pages,
-                        trap_handler::IsTrapHandlerEnabled())
-           .ToHandle(&new_buffer)) {
-    return -1;
-  }
+  if (func_index < 0 ||
+      static_cast<uint32_t>(func_index) >= module()->functions.size())
+    return {};
 
-  if (memory_object->has_instances()) {
-    Handle<FixedArrayOfWeakCells> instances(memory_object->instances(),
-                                            isolate);
-    for (int i = 0; i < instances->Length(); i++) {
-      Object* elem = instances->Get(i);
-      if (!elem->IsWasmInstanceObject()) continue;
-      Handle<WasmInstanceObject> instance(WasmInstanceObject::cast(elem),
-                                          isolate);
-      SetInstanceMemory(isolate, instance, new_buffer);
-    }
-  }
-  memory_object->set_array_buffer(*new_buffer);
-  return old_size / wasm::kWasmPageSize;
+  Vector<const byte> wire_bytes = native_module()->wire_bytes();
+
+  std::ostringstream disassembly_os;
+  v8::debug::WasmDisassembly::OffsetTable offset_table;
+
+  PrintWasmText(module(), wire_bytes, static_cast<uint32_t>(func_index),
+                disassembly_os, &offset_table);
+
+  return {disassembly_os.str(), std::move(offset_table)};
 }
 
-// static
-MaybeHandle<WasmGlobalObject> WasmGlobalObject::New(
-    Isolate* isolate, MaybeHandle<JSArrayBuffer> maybe_buffer,
-    wasm::ValueType type, int32_t offset, bool is_mutable) {
-  Handle<JSFunction> global_ctor(
-      isolate->native_context()->wasm_global_constructor());
-  auto global_obj = Handle<WasmGlobalObject>::cast(
-      isolate->factory()->NewJSObject(global_ctor));
+bool WasmModuleObject::GetPossibleBreakpoints(
+    const v8::debug::Location& start, const v8::debug::Location& end,
+    std::vector<v8::debug::BreakLocation>* locations) {
+  DisallowHeapAllocation no_gc;
 
-  uint32_t type_size = TypeSize(type);
+  const std::vector<WasmFunction>& functions = module()->functions;
+  if (start.GetLineNumber() < 0 || start.GetColumnNumber() < 0 ||
+      (!end.IsEmpty() &&
+       (end.GetLineNumber() < 0 || end.GetColumnNumber() < 0)))
+    return false;
 
-  Handle<JSArrayBuffer> buffer;
-  if (!maybe_buffer.ToHandle(&buffer)) {
-    // If no buffer was provided, create one long enough for the given type.
-    buffer =
-        isolate->factory()->NewJSArrayBuffer(SharedFlag::kNotShared, TENURED);
+  // start_func_index, start_offset and end_func_index is inclusive.
+  // end_offset is exclusive.
+  // start_offset and end_offset are module-relative byte offsets.
+  uint32_t start_func_index = start.GetLineNumber();
+  if (start_func_index >= functions.size()) return false;
+  int start_func_len = functions[start_func_index].code.length();
+  if (start.GetColumnNumber() > start_func_len) return false;
+  uint32_t start_offset =
+      functions[start_func_index].code.offset() + start.GetColumnNumber();
+  uint32_t end_func_index;
+  uint32_t end_offset;
+  if (end.IsEmpty()) {
+    // Default: everything till the end of the Script.
+    end_func_index = static_cast<uint32_t>(functions.size() - 1);
+    end_offset = functions[end_func_index].code.end_offset();
+  } else {
+    // If end is specified: Use it and check for valid input.
+    end_func_index = static_cast<uint32_t>(end.GetLineNumber());
 
-    const bool initialize = true;
-    if (!JSArrayBuffer::SetupAllocatingData(buffer, isolate, type_size,
-                                            initialize)) {
-      return {};
+    // Special case: Stop before the start of the next function. Change to: Stop
+    // at the end of the function before, such that we don't disassemble the
+    // next function also.
+    if (end.GetColumnNumber() == 0 && end_func_index > 0) {
+      --end_func_index;
+      end_offset = functions[end_func_index].code.end_offset();
+    } else {
+      if (end_func_index >= functions.size()) return false;
+      end_offset =
+          functions[end_func_index].code.offset() + end.GetColumnNumber();
+      if (end_offset > functions[end_func_index].code.end_offset())
+        return false;
     }
   }
 
-  // Check that the offset is in bounds.
-  uint32_t buffer_size = 0;
-  CHECK(buffer->byte_length()->ToUint32(&buffer_size));
-  CHECK(offset + type_size <= buffer_size);
+  AccountingAllocator alloc;
+  Zone tmp(&alloc, ZONE_NAME);
+  const byte* module_start = native_module()->wire_bytes().start();
 
-  global_obj->set_array_buffer(*buffer);
-  global_obj->set_flags(0);
-  global_obj->set_type(type);
-  global_obj->set_offset(offset);
-  global_obj->set_is_mutable(is_mutable);
+  for (uint32_t func_idx = start_func_index; func_idx <= end_func_index;
+       ++func_idx) {
+    const WasmFunction& func = functions[func_idx];
+    if (func.code.length() == 0) continue;
 
-  return global_obj;
+    wasm::BodyLocalDecls locals(&tmp);
+    wasm::BytecodeIterator iterator(module_start + func.code.offset(),
+                                    module_start + func.code.end_offset(),
+                                    &locals);
+    DCHECK_LT(0u, locals.encoded_size);
+    for (uint32_t offset : iterator.offsets()) {
+      uint32_t total_offset = func.code.offset() + offset;
+      if (total_offset >= end_offset) {
+        DCHECK_EQ(end_func_index, func_idx);
+        break;
+      }
+      if (total_offset < start_offset) continue;
+      locations->emplace_back(func_idx, offset, debug::kCommonBreakLocation);
+    }
+  }
+  return true;
 }
 
-void IndirectFunctionTableEntry::clear() {
-  instance_->indirect_function_table_sig_ids()[index_] = -1;
-  instance_->indirect_function_table_targets()[index_] = 0;
-  instance_->indirect_function_table_instances()->set(
-      index_, instance_->GetIsolate()->heap()->undefined_value());
-}
+MaybeHandle<FixedArray> WasmModuleObject::CheckBreakPoints(
+    Isolate* isolate, Handle<WasmModuleObject> module_object, int position) {
+  if (!module_object->has_breakpoint_infos()) return {};
 
-void IndirectFunctionTableEntry::set(int sig_id, WasmInstanceObject* instance,
-                                     const wasm::WasmCode* wasm_code) {
-  TRACE_IFT("IFT entry %p[%d] = {sig_id=%d, instance=%p, target=%p}\n",
-            instance_, index_, sig_id, instance,
-            wasm_code->instructions().start());
-  instance_->indirect_function_table_sig_ids()[index_] = sig_id;
-  instance_->indirect_function_table_targets()[index_] =
-      wasm_code->instructions().start();
-  instance_->indirect_function_table_instances()->set(index_, instance);
-}
+  Handle<FixedArray> breakpoint_infos(module_object->breakpoint_infos(),
+                                      isolate);
+  int insert_pos =
+      FindBreakpointInfoInsertPos(isolate, breakpoint_infos, position);
+  if (insert_pos >= breakpoint_infos->length()) return {};
 
-WasmInstanceObject* IndirectFunctionTableEntry::instance() {
-  return WasmInstanceObject::cast(
-      instance_->indirect_function_table_instances()->get(index_));
-}
+  Handle<Object> maybe_breakpoint_info(breakpoint_infos->get(insert_pos),
+                                       isolate);
+  if (maybe_breakpoint_info->IsUndefined(isolate)) return {};
+  Handle<BreakPointInfo> breakpoint_info =
+      Handle<BreakPointInfo>::cast(maybe_breakpoint_info);
+  if (breakpoint_info->source_position() != position) return {};
 
-int IndirectFunctionTableEntry::sig_id() {
-  return instance_->indirect_function_table_sig_ids()[index_];
+  // There is no support for conditional break points. Just assume that every
+  // break point always hits.
+  Handle<Object> break_points(breakpoint_info->break_points(), isolate);
+  if (break_points->IsFixedArray()) {
+    return Handle<FixedArray>::cast(break_points);
+  }
+  Handle<FixedArray> break_points_hit = isolate->factory()->NewFixedArray(1);
+  break_points_hit->set(0, *break_points);
+  return break_points_hit;
 }
 
-Address IndirectFunctionTableEntry::target() {
-  return instance_->indirect_function_table_targets()[index_];
+MaybeHandle<String> WasmModuleObject::ExtractUtf8StringFromModuleBytes(
+    Isolate* isolate, Handle<WasmModuleObject> module_object,
+    wasm::WireBytesRef ref) {
+  // TODO(wasm): cache strings from modules if it's a performance win.
+  Vector<const uint8_t> wire_bytes =
+      module_object->native_module()->wire_bytes();
+  return ExtractUtf8StringFromModuleBytes(isolate, wire_bytes, ref);
 }
 
-void ImportedFunctionEntry::set(JSReceiver* callable,
-                                const wasm::WasmCode* wasm_to_js_wrapper) {
-  TRACE_IFT("Import callable %p[%d] = {callable=%p, target=%p}\n", instance_,
-            index_, callable, wasm_to_js_wrapper->instructions().start());
-  DCHECK_EQ(wasm::WasmCode::kWasmToJsWrapper, wasm_to_js_wrapper->kind());
-  instance_->imported_function_instances()->set(index_, instance_);
-  instance_->imported_function_callables()->set(index_, callable);
-  instance_->imported_function_targets()[index_] =
-      wasm_to_js_wrapper->instructions().start();
+MaybeHandle<String> WasmModuleObject::ExtractUtf8StringFromModuleBytes(
+    Isolate* isolate, Vector<const uint8_t> wire_bytes,
+    wasm::WireBytesRef ref) {
+  Vector<const uint8_t> name_vec = wire_bytes + ref.offset();
+  name_vec.Truncate(ref.length());
+  // UTF8 validation happens at decode time.
+  DCHECK(unibrow::Utf8::ValidateEncoding(name_vec.start(), name_vec.length()));
+  return isolate->factory()->NewStringFromUtf8(
+      Vector<const char>::cast(name_vec));
 }
 
-void ImportedFunctionEntry::set(WasmInstanceObject* instance,
-                                const wasm::WasmCode* wasm_code) {
-  TRACE_IFT("Import WASM %p[%d] = {instance=%p, target=%p}\n", instance_,
-            index_, instance, wasm_code->instructions().start());
-  instance_->imported_function_instances()->set(index_, instance);
-  instance_->imported_function_callables()->set(
-      index_, instance_->GetHeap()->undefined_value());
-  instance_->imported_function_targets()[index_] =
-      wasm_code->instructions().start();
+MaybeHandle<String> WasmModuleObject::GetModuleNameOrNull(
+    Isolate* isolate, Handle<WasmModuleObject> module_object) {
+  const WasmModule* module = module_object->module();
+  if (!module->name.is_set()) return {};
+  return ExtractUtf8StringFromModuleBytes(isolate, module_object, module->name);
 }
 
-WasmInstanceObject* ImportedFunctionEntry::instance() {
-  return WasmInstanceObject::cast(
-      instance_->imported_function_instances()->get(index_));
+MaybeHandle<String> WasmModuleObject::GetFunctionNameOrNull(
+    Isolate* isolate, Handle<WasmModuleObject> module_object,
+    uint32_t func_index) {
+  DCHECK_LT(func_index, module_object->module()->functions.size());
+  wasm::WireBytesRef name = module_object->module()->LookupFunctionName(
+      wasm::ModuleWireBytes(module_object->native_module()->wire_bytes()),
+      func_index);
+  if (!name.is_set()) return {};
+  return ExtractUtf8StringFromModuleBytes(isolate, module_object, name);
 }
 
-JSReceiver* ImportedFunctionEntry::callable() {
-  return JSReceiver::cast(
-      instance_->imported_function_callables()->get(index_));
+Handle<String> WasmModuleObject::GetFunctionName(
+    Isolate* isolate, Handle<WasmModuleObject> module_object,
+    uint32_t func_index) {
+  MaybeHandle<String> name =
+      GetFunctionNameOrNull(isolate, module_object, func_index);
+  if (!name.is_null()) return name.ToHandleChecked();
+  return isolate->factory()->NewStringFromStaticChars("<WASM UNNAMED>");
 }
 
-Address ImportedFunctionEntry::target() {
-  return instance_->imported_function_targets()[index_];
+Vector<const uint8_t> WasmModuleObject::GetRawFunctionName(
+    uint32_t func_index) {
+  DCHECK_GT(module()->functions.size(), func_index);
+  wasm::ModuleWireBytes wire_bytes(native_module()->wire_bytes());
+  wasm::WireBytesRef name_ref =
+      module()->LookupFunctionName(wire_bytes, func_index);
+  wasm::WasmName name = wire_bytes.GetName(name_ref);
+  return Vector<const uint8_t>::cast(name);
 }
 
-bool ImportedFunctionEntry::is_js_receiver_entry() {
-  return instance_->imported_function_callables()->get(index_)->IsJSReceiver();
+int WasmModuleObject::GetFunctionOffset(uint32_t func_index) {
+  const std::vector<WasmFunction>& functions = module()->functions;
+  if (static_cast<uint32_t>(func_index) >= functions.size()) return -1;
+  DCHECK_GE(kMaxInt, functions[func_index].code.offset());
+  return static_cast<int>(functions[func_index].code.offset());
 }
 
-bool WasmInstanceObject::EnsureIndirectFunctionTableWithMinimumSize(
-    Handle<WasmInstanceObject> instance, uint32_t minimum_size) {
-  uint32_t old_size = instance->indirect_function_table_size();
-  if (old_size >= minimum_size) return false;  // Nothing to do.
+int WasmModuleObject::GetContainingFunction(uint32_t byte_offset) {
+  const std::vector<WasmFunction>& functions = module()->functions;
 
-  Isolate* isolate = instance->GetIsolate();
-  HandleScope scope(isolate);
-  auto native_allocations = GetNativeAllocations(*instance);
-  native_allocations->resize_indirect_function_table(isolate, instance,
-                                                     minimum_size);
-  return true;
-}
+  // Binary search for a function containing the given position.
+  int left = 0;                                    // inclusive
+  int right = static_cast<int>(functions.size());  // exclusive
+  if (right == 0) return false;
+  while (right - left > 1) {
+    int mid = left + (right - left) / 2;
+    if (functions[mid].code.offset() <= byte_offset) {
+      left = mid;
+    } else {
+      right = mid;
+    }
+  }
+  // If the found function does not contains the given position, return -1.
+  const WasmFunction& func = functions[left];
+  if (byte_offset < func.code.offset() ||
+      byte_offset >= func.code.end_offset()) {
+    return -1;
+  }
 
-void WasmInstanceObject::SetRawMemory(byte* mem_start, uint32_t mem_size) {
-  DCHECK_LE(mem_size, wasm::kV8MaxWasmMemoryPages * wasm::kWasmPageSize);
-  uint32_t mem_size64 = mem_size;
-  uint32_t mem_mask64 = base::bits::RoundUpToPowerOfTwo32(mem_size) - 1;
-  DCHECK_LE(mem_size, mem_mask64 + 1);
-  set_memory_start(mem_start);
-  set_memory_size(mem_size64);
-  set_memory_mask(mem_mask64);
+  return left;
 }
 
-WasmModuleObject* WasmInstanceObject::module_object() {
-  return compiled_module()->wasm_module();
-}
+bool WasmModuleObject::GetPositionInfo(uint32_t position,
+                                       Script::PositionInfo* info) {
+  int func_index = GetContainingFunction(position);
+  if (func_index < 0) return false;
 
-WasmModule* WasmInstanceObject::module() {
-  return compiled_module()->shared()->module();
-}
+  const WasmFunction& function = module()->functions[func_index];
 
-Handle<WasmDebugInfo> WasmInstanceObject::GetOrCreateDebugInfo(
-    Handle<WasmInstanceObject> instance) {
-  if (instance->has_debug_info()) return handle(instance->debug_info());
-  Handle<WasmDebugInfo> new_info = WasmDebugInfo::New(instance);
-  DCHECK(instance->has_debug_info());
-  return new_info;
+  info->line = func_index;
+  info->column = position - function.code.offset();
+  info->line_start = function.code.offset();
+  info->line_end = function.code.end_offset();
+  return true;
 }
 
-Handle<WasmInstanceObject> WasmInstanceObject::New(
-    Isolate* isolate, Handle<WasmCompiledModule> compiled_module) {
-  Handle<JSFunction> instance_cons(
-      isolate->native_context()->wasm_instance_constructor());
-  Handle<JSObject> instance_object =
-      isolate->factory()->NewJSObject(instance_cons, TENURED);
+Handle<WasmTableObject> WasmTableObject::New(Isolate* isolate, uint32_t initial,
+                                             int64_t maximum,
+                                             Handle<FixedArray>* js_functions) {
+  Handle<JSFunction> table_ctor(
+      isolate->native_context()->wasm_table_constructor(), isolate);
+  auto table_obj = Handle<WasmTableObject>::cast(
+      isolate->factory()->NewJSObject(table_ctor));
 
-  Handle<WasmInstanceObject> instance(
-      reinterpret_cast<WasmInstanceObject*>(*instance_object), isolate);
+  *js_functions = isolate->factory()->NewFixedArray(initial);
+  Object* null = ReadOnlyRoots(isolate).null_value();
+  for (int i = 0; i < static_cast<int>(initial); ++i) {
+    (*js_functions)->set(i, null);
+  }
+  table_obj->set_functions(**js_functions);
+  DCHECK_EQ(maximum, static_cast<int>(maximum));
+  Handle<Object> max = isolate->factory()->NewNumber(maximum);
+  table_obj->set_maximum_length(*max);
 
-  // Initialize the imported function arrays.
-  auto num_imported_functions =
-      compiled_module->shared()->module()->num_imported_functions;
-  auto native_allocations = Managed<WasmInstanceNativeAllocations>::Allocate(
-      isolate, instance, num_imported_functions);
-  instance->set_managed_native_allocations(*native_allocations);
+  table_obj->set_dispatch_tables(ReadOnlyRoots(isolate).empty_fixed_array());
+  return Handle<WasmTableObject>::cast(table_obj);
+}
 
-  Handle<FixedArray> imported_function_instances =
-      isolate->factory()->NewFixedArray(num_imported_functions);
+void WasmTableObject::AddDispatchTable(Isolate* isolate,
+                                       Handle<WasmTableObject> table_obj,
+                                       Handle<WasmInstanceObject> instance,
+                                       int table_index) {
+  Handle<FixedArray> dispatch_tables(table_obj->dispatch_tables(), isolate);
+  int old_length = dispatch_tables->length();
+  DCHECK_EQ(0, old_length % kDispatchTableNumElements);
 
-  instance->set_imported_function_instances(*imported_function_instances);
-  Handle<FixedArray> imported_function_callables =
-      isolate->factory()->NewFixedArray(num_imported_functions);
+  if (instance.is_null()) return;
+  // TODO(titzer): use weak cells here to avoid leaking instances.
 
-  instance->set_imported_function_callables(*imported_function_callables);
+  // Grow the dispatch table and add a new entry at the end.
+  Handle<FixedArray> new_dispatch_tables =
+      isolate->factory()->CopyFixedArrayAndGrow(dispatch_tables,
+                                                kDispatchTableNumElements);
 
-  instance->SetRawMemory(nullptr, 0);
-  instance->set_globals_start(nullptr);
-  instance->set_indirect_function_table_size(0);
-  instance->set_indirect_function_table_sig_ids(nullptr);
-  instance->set_indirect_function_table_targets(nullptr);
-  instance->set_compiled_module(*compiled_module);
+  new_dispatch_tables->set(old_length + kDispatchTableInstanceOffset,
+                           *instance);
+  new_dispatch_tables->set(old_length + kDispatchTableIndexOffset,
+                           Smi::FromInt(table_index));
 
-  return instance;
+  table_obj->set_dispatch_tables(*new_dispatch_tables);
 }
 
-WasmInstanceObject* WasmInstanceObject::GetOwningInstance(
-    const wasm::WasmCode* code) {
-  DisallowHeapAllocation no_gc;
-  Object* weak_link = nullptr;
-  DCHECK(code->kind() == wasm::WasmCode::kFunction ||
-         code->kind() == wasm::WasmCode::kInterpreterStub);
-  weak_link = code->native_module()->compiled_module()->weak_owning_instance();
-  DCHECK(weak_link->IsWeakCell());
-  WeakCell* cell = WeakCell::cast(weak_link);
-  if (cell->cleared()) return nullptr;
-  return WasmInstanceObject::cast(cell->value());
-}
-
-void WasmInstanceObject::ValidateInstancesChainForTesting(
-    Isolate* isolate, Handle<WasmModuleObject> module_obj, int instance_count) {
-  CHECK_GE(instance_count, 0);
-  DisallowHeapAllocation no_gc;
-  WasmCompiledModule* compiled_module = module_obj->compiled_module();
-  CHECK_EQ(JSObject::cast(compiled_module->weak_wasm_module()->value()),
-           *module_obj);
-  Object* prev = nullptr;
-  int found_instances = compiled_module->has_instance() ? 1 : 0;
-  WasmCompiledModule* current_instance = compiled_module;
-  while (current_instance->has_next_instance()) {
-    CHECK((prev == nullptr && !current_instance->has_prev_instance()) ||
-          current_instance->prev_instance() == prev);
-    CHECK_EQ(current_instance->weak_wasm_module()->value(), *module_obj);
-    CHECK(current_instance->weak_owning_instance()
-              ->value()
-              ->IsWasmInstanceObject());
-    prev = current_instance;
-    current_instance =
-        WasmCompiledModule::cast(current_instance->next_instance());
-    ++found_instances;
-    CHECK_LE(found_instances, instance_count);
-  }
-  CHECK_EQ(found_instances, instance_count);
-}
+void WasmTableObject::Grow(Isolate* isolate, uint32_t count) {
+  if (count == 0) return;  // Degenerate case: nothing to do.
 
-void WasmInstanceObject::ValidateOrphanedInstanceForTesting(
-    Isolate* isolate, Handle<WasmInstanceObject> instance) {
-  DisallowHeapAllocation no_gc;
-  WasmCompiledModule* compiled_module = instance->compiled_module();
-  CHECK(compiled_module->has_weak_wasm_module());
-  CHECK(compiled_module->weak_wasm_module()->cleared());
-}
+  Handle<FixedArray> dispatch_tables(this->dispatch_tables(), isolate);
+  DCHECK_EQ(0, dispatch_tables->length() % kDispatchTableNumElements);
+  uint32_t old_size = functions()->length();
 
-namespace {
-void InstanceFinalizer(const v8::WeakCallbackInfo<void>& data) {
-  DisallowHeapAllocation no_gc;
-  JSObject** p = reinterpret_cast<JSObject**>(data.GetParameter());
-  WasmInstanceObject* instance = reinterpret_cast<WasmInstanceObject*>(*p);
-  Isolate* isolate = reinterpret_cast<Isolate*>(data.GetIsolate());
-  // If a link to shared memory instances exists, update the list of memory
-  // instances before the instance is destroyed.
-  WasmCompiledModule* compiled_module = instance->compiled_module();
-  wasm::NativeModule* native_module = compiled_module->GetNativeModule();
-  if (native_module) {
-    TRACE("Finalizing %zu {\n", native_module->instance_id);
-  } else {
-    TRACE("Finalized already cleaned up compiled module\n");
-  }
-  WeakCell* weak_wasm_module = compiled_module->weak_wasm_module();
+  // Tables are stored in the instance object, no code patching is
+  // necessary. We simply have to grow the raw tables in each instance
+  // that has imported this table.
 
-  // Since the order of finalizers is not guaranteed, it can be the case
-  // that {instance->compiled_module()->module()}, which is a
-  // {Managed<WasmModule>} has been collected earlier in this GC cycle.
-  // Weak references to this instance won't be cleared until
-  // the next GC cycle, so we need to manually break some links (such as
-  // the weak references from {WasmMemoryObject::instances}.
-  if (instance->has_memory_object()) {
-    WasmMemoryObject::RemoveInstance(isolate, handle(instance->memory_object()),
-                                     handle(instance));
+  // TODO(titzer): replace the dispatch table with a weak list of all
+  // the instances that import a given table.
+  for (int i = 0; i < dispatch_tables->length();
+       i += kDispatchTableNumElements) {
+    Handle<WasmInstanceObject> instance(
+        WasmInstanceObject::cast(dispatch_tables->get(i)), isolate);
+    DCHECK_EQ(old_size, instance->indirect_function_table_size());
+    uint32_t new_size = old_size + count;
+    WasmInstanceObject::EnsureIndirectFunctionTableWithMinimumSize(instance,
+                                                                   new_size);
   }
+}
 
-  // weak_wasm_module may have been cleared, meaning the module object
-  // was GC-ed. We still want to maintain the links between instances, to
-  // release the WasmCompiledModule corresponding to the WasmModuleInstance
-  // being finalized here.
-  WasmModuleObject* wasm_module = nullptr;
-  if (!weak_wasm_module->cleared()) {
-    wasm_module = WasmModuleObject::cast(weak_wasm_module->value());
-    WasmCompiledModule* current_template = wasm_module->compiled_module();
-
-    DCHECK(!current_template->has_prev_instance());
-    if (current_template == compiled_module) {
-      if (!compiled_module->has_next_instance()) {
-        WasmCompiledModule::Reset(isolate, compiled_module);
-      } else {
-        WasmModuleObject::cast(wasm_module)
-            ->set_compiled_module(compiled_module->next_instance());
-      }
-    }
+void WasmTableObject::Set(Isolate* isolate, Handle<WasmTableObject> table,
+                          int32_t table_index, Handle<JSFunction> function) {
+  Handle<FixedArray> array(table->functions(), isolate);
+  if (function.is_null()) {
+    ClearDispatchTables(isolate, table, table_index);  // Degenerate case.
+    array->set(table_index, ReadOnlyRoots(isolate).null_value());
+    return;
   }
 
-  // Free raw C++ memory associated with the instance.
-  GetNativeAllocations(instance)->free();
+  // TODO(titzer): Change this to MaybeHandle<WasmExportedFunction>
+  DCHECK(WasmExportedFunction::IsWasmExportedFunction(*function));
+  auto exported_function = Handle<WasmExportedFunction>::cast(function);
+  Handle<WasmInstanceObject> other_instance(exported_function->instance(),
+                                            isolate);
+  int func_index = exported_function->function_index();
+  auto* wasm_function = &other_instance->module()->functions[func_index];
+  DCHECK_NOT_NULL(wasm_function);
+  DCHECK_NOT_NULL(wasm_function->sig);
+  Address call_target = exported_function->GetWasmCallTarget();
+  UpdateDispatchTables(isolate, table, table_index, wasm_function->sig,
+                       handle(exported_function->instance(), isolate),
+                       call_target);
+  array->set(table_index, *function);
+}
 
-  compiled_module->RemoveFromChain();
-
-  GlobalHandles::Destroy(reinterpret_cast<Object**>(p));
-  TRACE("}\n");
-}
-
-}  // namespace
-
-void WasmInstanceObject::InstallFinalizer(Isolate* isolate,
-                                          Handle<WasmInstanceObject> instance) {
-  Handle<Object> global_handle = isolate->global_handles()->Create(*instance);
-  GlobalHandles::MakeWeak(global_handle.location(), global_handle.location(),
-                          InstanceFinalizer, v8::WeakCallbackType::kFinalizer);
-}
-
-bool WasmExportedFunction::IsWasmExportedFunction(Object* object) {
-  if (!object->IsJSFunction()) return false;
-  Handle<JSFunction> js_function(JSFunction::cast(object));
-  if (Code::JS_TO_WASM_FUNCTION != js_function->code()->kind()) return false;
-
-#ifdef DEBUG
-  // Any function having code of {JS_TO_WASM_FUNCTION} kind must be an exported
-  // function and hence will have a property holding the instance object.
-  Handle<Symbol> symbol(
-      js_function->GetIsolate()->factory()->wasm_instance_symbol());
-  MaybeHandle<Object> result =
-      JSObject::GetPropertyOrElement(js_function, symbol);
-  DCHECK(result.ToHandleChecked()->IsWasmInstanceObject());
-#endif
-
-  return true;
-}
-
-WasmExportedFunction* WasmExportedFunction::cast(Object* object) {
-  DCHECK(IsWasmExportedFunction(object));
-  return reinterpret_cast<WasmExportedFunction*>(object);
-}
-
-WasmInstanceObject* WasmExportedFunction::instance() {
-  DisallowHeapAllocation no_allocation;
-  Handle<Symbol> symbol(GetIsolate()->factory()->wasm_instance_symbol());
-  MaybeHandle<Object> result =
-      JSObject::GetPropertyOrElement(handle(this), symbol);
-  return WasmInstanceObject::cast(*(result.ToHandleChecked()));
-}
-
-int WasmExportedFunction::function_index() {
-  DisallowHeapAllocation no_allocation;
-  Handle<Symbol> symbol = GetIsolate()->factory()->wasm_function_index_symbol();
-  MaybeHandle<Object> result =
-      JSObject::GetPropertyOrElement(handle(this), symbol);
-  return result.ToHandleChecked()->Number();
-}
+void WasmTableObject::UpdateDispatchTables(
+    Isolate* isolate, Handle<WasmTableObject> table, int table_index,
+    wasm::FunctionSig* sig, Handle<WasmInstanceObject> from_instance,
+    Address call_target) {
+  // We simply need to update the IFTs for each instance that imports
+  // this table.
+  Handle<FixedArray> dispatch_tables(table->dispatch_tables(), isolate);
+  DCHECK_EQ(0, dispatch_tables->length() % kDispatchTableNumElements);
 
-Handle<WasmExportedFunction> WasmExportedFunction::New(
-    Isolate* isolate, Handle<WasmInstanceObject> instance,
-    MaybeHandle<String> maybe_name, int func_index, int arity,
-    Handle<Code> export_wrapper) {
-  DCHECK_EQ(Code::JS_TO_WASM_FUNCTION, export_wrapper->kind());
-  Handle<String> name;
-  if (!maybe_name.ToHandle(&name)) {
-    EmbeddedVector<char, 16> buffer;
-    int length = SNPrintF(buffer, "%d", func_index);
-    name = isolate->factory()
-               ->NewStringFromOneByte(
-                   Vector<uint8_t>::cast(buffer.SubVector(0, length)))
-               .ToHandleChecked();
+  for (int i = 0; i < dispatch_tables->length();
+       i += kDispatchTableNumElements) {
+    Handle<WasmInstanceObject> to_instance(
+        WasmInstanceObject::cast(
+            dispatch_tables->get(i + kDispatchTableInstanceOffset)),
+        isolate);
+    // Note that {SignatureMap::Find} may return {-1} if the signature is
+    // not found; it will simply never match any check.
+    auto sig_id = to_instance->module()->signature_map.Find(sig);
+    IndirectFunctionTableEntry(to_instance, table_index)
+        .set(sig_id, *from_instance, call_target);
   }
-  NewFunctionArgs args = NewFunctionArgs::ForWasm(
-      name, export_wrapper, isolate->sloppy_function_without_prototype_map());
-  Handle<JSFunction> js_function = isolate->factory()->NewFunction(args);
-  // According to the spec, exported functions should not have a [[Construct]]
-  // method.
-  DCHECK(!js_function->IsConstructor());
-  js_function->shared()->set_length(arity);
-  js_function->shared()->set_internal_formal_parameter_count(arity);
-
-  Handle<Symbol> instance_symbol(isolate->factory()->wasm_instance_symbol());
-  JSObject::AddProperty(js_function, instance_symbol, instance, DONT_ENUM);
-
-  Handle<Symbol> function_index_symbol(
-      isolate->factory()->wasm_function_index_symbol());
-  JSObject::AddProperty(js_function, function_index_symbol,
-                        isolate->factory()->NewNumber(func_index), DONT_ENUM);
-
-  return Handle<WasmExportedFunction>::cast(js_function);
 }
 
-wasm::WasmCode* WasmExportedFunction::GetWasmCode() {
-  DisallowHeapAllocation no_gc;
-  Handle<Code> export_wrapper_code = handle(this->code());
-  DCHECK_EQ(export_wrapper_code->kind(), Code::JS_TO_WASM_FUNCTION);
-  int mask = RelocInfo::ModeMask(RelocInfo::JS_TO_WASM_CALL);
-  RelocIterator it(*export_wrapper_code, mask);
-  DCHECK(!it.done());
-  wasm::WasmCode* target =
-      GetIsolate()->wasm_engine()->code_manager()->LookupCode(
-          it.rinfo()->js_to_wasm_address());
-#ifdef DEBUG
-  // There should only be this one call to wasm code.
-  it.next();
-  DCHECK(it.done());
-#endif
-  return target;
-}
-
-WasmModule* WasmSharedModuleData::module() const {
-  // We populate the kModuleWrapper field with a Foreign holding the
-  // address to the address of a WasmModule. This is because we can
-  // handle both cases when the WasmModule's lifetime is managed through
-  // a Managed<WasmModule> object, as well as cases when it's managed
-  // by the embedder. CcTests fall into the latter case.
-  return *(reinterpret_cast<WasmModule**>(
-      Foreign::cast(module_wrapper())->foreign_address()));
-}
-
-Handle<WasmSharedModuleData> WasmSharedModuleData::New(
-    Isolate* isolate, Handle<Foreign> module_wrapper,
-    Handle<SeqOneByteString> module_bytes, Handle<Script> script,
-    Handle<ByteArray> asm_js_offset_table) {
-  Handle<WasmSharedModuleData> data = Handle<WasmSharedModuleData>::cast(
-      isolate->factory()->NewStruct(WASM_SHARED_MODULE_DATA_TYPE, TENURED));
-  data->set_module_wrapper(*module_wrapper);
-  if (!module_bytes.is_null()) {
-    data->set_module_bytes(*module_bytes);
-  }
-  if (!script.is_null()) {
-    data->set_script(*script);
-  }
-  if (!asm_js_offset_table.is_null()) {
-    data->set_asm_js_offset_table(*asm_js_offset_table);
+void WasmTableObject::ClearDispatchTables(Isolate* isolate,
+                                          Handle<WasmTableObject> table,
+                                          int index) {
+  Handle<FixedArray> dispatch_tables(table->dispatch_tables(), isolate);
+  DCHECK_EQ(0, dispatch_tables->length() % kDispatchTableNumElements);
+  for (int i = 0; i < dispatch_tables->length();
+       i += kDispatchTableNumElements) {
+    Handle<WasmInstanceObject> target_instance(
+        WasmInstanceObject::cast(
+            dispatch_tables->get(i + kDispatchTableInstanceOffset)),
+        isolate);
+    DCHECK_LT(index, target_instance->indirect_function_table_size());
+    IndirectFunctionTableEntry(target_instance, index).clear();
   }
-  return data;
-}
-
-bool WasmSharedModuleData::is_asm_js() {
-  bool asm_js = module()->is_asm_js();
-  DCHECK_EQ(asm_js, script()->IsUserJavaScript());
-  DCHECK_EQ(asm_js, has_asm_js_offset_table());
-  return asm_js;
 }
 
 namespace {
-
-int GetBreakpointPos(Isolate* isolate, Object* break_point_info_or_undef) {
-  if (break_point_info_or_undef->IsUndefined(isolate)) return kMaxInt;
-  return BreakPointInfo::cast(break_point_info_or_undef)->source_position();
-}
-
-int FindBreakpointInfoInsertPos(Isolate* isolate,
-                                Handle<FixedArray> breakpoint_infos,
-                                int position) {
-  // Find insert location via binary search, taking care of undefined values on
-  // the right. Position is always greater than zero.
-  DCHECK_LT(0, position);
-
-  int left = 0;                            // inclusive
-  int right = breakpoint_infos->length();  // exclusive
-  while (right - left > 1) {
-    int mid = left + (right - left) / 2;
-    Object* mid_obj = breakpoint_infos->get(mid);
-    if (GetBreakpointPos(isolate, mid_obj) <= position) {
-      left = mid;
-    } else {
-      right = mid;
-    }
-  }
-
-  int left_pos = GetBreakpointPos(isolate, breakpoint_infos->get(left));
-  return left_pos < position ? left + 1 : left;
-}
-
-}  // namespace
-
-void WasmSharedModuleData::AddBreakpoint(Handle<WasmSharedModuleData> shared,
-                                         int position,
-                                         Handle<BreakPoint> break_point) {
-  Isolate* isolate = shared->GetIsolate();
-  Handle<FixedArray> breakpoint_infos;
-  if (shared->has_breakpoint_infos()) {
-    breakpoint_infos = handle(shared->breakpoint_infos(), isolate);
-  } else {
-    breakpoint_infos = isolate->factory()->NewFixedArray(4, TENURED);
-    shared->set_breakpoint_infos(*breakpoint_infos);
-  }
-
-  int insert_pos =
-      FindBreakpointInfoInsertPos(isolate, breakpoint_infos, position);
-
-  // If a BreakPointInfo object already exists for this position, add the new
-  // breakpoint object and return.
-  if (insert_pos < breakpoint_infos->length() &&
-      GetBreakpointPos(isolate, breakpoint_infos->get(insert_pos)) ==
-          position) {
-    Handle<BreakPointInfo> old_info(
-        BreakPointInfo::cast(breakpoint_infos->get(insert_pos)), isolate);
-    BreakPointInfo::SetBreakPoint(old_info, break_point);
-    return;
-  }
-
-  // Enlarge break positions array if necessary.
-  bool need_realloc = !breakpoint_infos->get(breakpoint_infos->length() - 1)
-                           ->IsUndefined(isolate);
-  Handle<FixedArray> new_breakpoint_infos = breakpoint_infos;
-  if (need_realloc) {
-    new_breakpoint_infos = isolate->factory()->NewFixedArray(
-        2 * breakpoint_infos->length(), TENURED);
-    shared->set_breakpoint_infos(*new_breakpoint_infos);
-    // Copy over the entries [0, insert_pos).
-    for (int i = 0; i < insert_pos; ++i)
-      new_breakpoint_infos->set(i, breakpoint_infos->get(i));
-  }
-
-  // Move elements [insert_pos+1, ...] up by one.
-  for (int i = insert_pos + 1; i < breakpoint_infos->length(); ++i) {
-    Object* entry = breakpoint_infos->get(i);
-    if (entry->IsUndefined(isolate)) break;
-    new_breakpoint_infos->set(i + 1, entry);
+MaybeHandle<JSArrayBuffer> GrowMemoryBuffer(Isolate* isolate,
+                                            Handle<JSArrayBuffer> old_buffer,
+                                            uint32_t pages,
+                                            uint32_t maximum_pages) {
+  if (!old_buffer->is_growable()) return {};
+  void* old_mem_start = old_buffer->backing_store();
+  uint32_t old_size = 0;
+  CHECK(old_buffer->byte_length()->ToUint32(&old_size));
+  DCHECK_EQ(0, old_size % wasm::kWasmPageSize);
+  uint32_t old_pages = old_size / wasm::kWasmPageSize;
+  DCHECK_GE(std::numeric_limits<uint32_t>::max(),
+            old_size + pages * wasm::kWasmPageSize);
+  if (old_pages > maximum_pages || pages > maximum_pages - old_pages) return {};
+  size_t new_size =
+      static_cast<size_t>(old_pages + pages) * wasm::kWasmPageSize;
+  if (new_size > FLAG_wasm_max_mem_pages * wasm::kWasmPageSize ||
+      new_size > kMaxInt) {
+    return {};
   }
-
-  // Generate new BreakpointInfo.
-  Handle<BreakPointInfo> breakpoint_info =
-      isolate->factory()->NewBreakPointInfo(position);
-  BreakPointInfo::SetBreakPoint(breakpoint_info, break_point);
-
-  // Now insert new position at insert_pos.
-  new_breakpoint_infos->set(insert_pos, *breakpoint_info);
-}
-
-void WasmSharedModuleData::SetBreakpointsOnNewInstance(
-    Handle<WasmSharedModuleData> shared, Handle<WasmInstanceObject> instance) {
-  if (!shared->has_breakpoint_infos()) return;
-  Isolate* isolate = shared->GetIsolate();
-  Handle<WasmDebugInfo> debug_info =
-      WasmInstanceObject::GetOrCreateDebugInfo(instance);
-
-  Handle<FixedArray> breakpoint_infos(shared->breakpoint_infos(), isolate);
-  // If the array exists, it should not be empty.
-  DCHECK_LT(0, breakpoint_infos->length());
-
-  for (int i = 0, e = breakpoint_infos->length(); i < e; ++i) {
-    Handle<Object> obj(breakpoint_infos->get(i), isolate);
-    if (obj->IsUndefined(isolate)) {
-      for (; i < e; ++i) {
-        DCHECK(breakpoint_infos->get(i)->IsUndefined(isolate));
+  // Reusing the backing store from externalized buffers causes problems with
+  // Blink's array buffers. The connection between the two is lost, which can
+  // lead to Blink not knowing about the other reference to the buffer and
+  // freeing it too early.
+  if (!old_buffer->is_external() &&
+      ((new_size < old_buffer->allocation_length()) || old_size == new_size)) {
+    if (old_size != new_size) {
+      DCHECK_NOT_NULL(old_buffer->backing_store());
+      // If adjusting permissions fails, propagate error back to return
+      // failure to grow.
+      if (!i::SetPermissions(old_mem_start, new_size,
+                             PageAllocator::kReadWrite)) {
+        return {};
       }
-      break;
+      reinterpret_cast<v8::Isolate*>(isolate)
+          ->AdjustAmountOfExternalAllocatedMemory(pages * wasm::kWasmPageSize);
     }
-    Handle<BreakPointInfo> breakpoint_info = Handle<BreakPointInfo>::cast(obj);
-    int position = breakpoint_info->source_position();
-
-    // Find the function for this breakpoint, and set the breakpoint.
-    int func_index = shared->GetContainingFunction(position);
-    DCHECK_LE(0, func_index);
-    WasmFunction& func = shared->module()->functions[func_index];
-    int offset_in_func = position - func.code.offset();
-    WasmDebugInfo::SetBreakpoint(debug_info, func_index, offset_in_func);
+    // NOTE: We must allocate a new array buffer here because the spec
+    // assumes that ArrayBuffers do not change size.
+    void* backing_store = old_buffer->backing_store();
+    bool is_external = old_buffer->is_external();
+    // Disconnect buffer early so GC won't free it.
+    i::wasm::DetachMemoryBuffer(isolate, old_buffer, false);
+    Handle<JSArrayBuffer> new_buffer =
+        wasm::SetupArrayBuffer(isolate, backing_store, new_size, is_external);
+    return new_buffer;
+  } else {
+    // We couldn't reuse the old backing store, so create a new one and copy the
+    // old contents in.
+    Handle<JSArrayBuffer> new_buffer;
+    if (!wasm::NewArrayBuffer(isolate, new_size).ToHandle(&new_buffer)) {
+      return {};
+    }
+    wasm::WasmMemoryTracker* const memory_tracker =
+        isolate->wasm_engine()->memory_tracker();
+    // If the old buffer had full guard regions, we can only safely use the new
+    // buffer if it also has full guard regions. Otherwise, we'd have to
+    // recompile all the instances using this memory to insert bounds checks.
+    if (memory_tracker->HasFullGuardRegions(old_mem_start) &&
+        !memory_tracker->HasFullGuardRegions(new_buffer->backing_store())) {
+      return {};
+    }
+    if (old_size == 0) return new_buffer;
+    memcpy(new_buffer->backing_store(), old_mem_start, old_size);
+    DCHECK(old_buffer.is_null() || !old_buffer->is_shared());
+    constexpr bool free_memory = true;
+    i::wasm::DetachMemoryBuffer(isolate, old_buffer, free_memory);
+    return new_buffer;
   }
 }
 
-namespace {
-
-enum AsmJsOffsetTableEntryLayout {
-  kOTEByteOffset,
-  kOTECallPosition,
-  kOTENumberConvPosition,
-  kOTESize
-};
-
-Handle<ByteArray> GetDecodedAsmJsOffsetTable(
-    Handle<WasmSharedModuleData> shared, Isolate* isolate) {
-  DCHECK(shared->is_asm_js());
-  Handle<ByteArray> offset_table(shared->asm_js_offset_table(), isolate);
-
-  // The last byte in the asm_js_offset_tables ByteArray tells whether it is
-  // still encoded (0) or decoded (1).
-  enum AsmJsTableType : int { Encoded = 0, Decoded = 1 };
-  int table_type = offset_table->get(offset_table->length() - 1);
-  DCHECK(table_type == Encoded || table_type == Decoded);
-  if (table_type == Decoded) return offset_table;
-
-  wasm::AsmJsOffsetsResult asm_offsets;
-  {
-    DisallowHeapAllocation no_gc;
-    const byte* bytes_start = offset_table->GetDataStartAddress();
-    const byte* bytes_end = bytes_start + offset_table->length() - 1;
-    asm_offsets = wasm::DecodeAsmJsOffsets(bytes_start, bytes_end);
-  }
-  // Wasm bytes must be valid and must contain asm.js offset table.
-  DCHECK(asm_offsets.ok());
-  DCHECK_GE(kMaxInt, asm_offsets.val.size());
-  int num_functions = static_cast<int>(asm_offsets.val.size());
-  int num_imported_functions =
-      static_cast<int>(shared->module()->num_imported_functions);
-  DCHECK_EQ(shared->module()->functions.size(),
-            static_cast<size_t>(num_functions) + num_imported_functions);
-  int num_entries = 0;
-  for (int func = 0; func < num_functions; ++func) {
-    size_t new_size = asm_offsets.val[func].size();
-    DCHECK_LE(new_size, static_cast<size_t>(kMaxInt) - num_entries);
-    num_entries += static_cast<int>(new_size);
-  }
-  // One byte to encode that this is a decoded table.
-  DCHECK_GE(kMaxInt,
-            1 + static_cast<uint64_t>(num_entries) * kOTESize * kIntSize);
-  int total_size = 1 + num_entries * kOTESize * kIntSize;
-  Handle<ByteArray> decoded_table =
-      isolate->factory()->NewByteArray(total_size, TENURED);
-  decoded_table->set(total_size - 1, AsmJsTableType::Decoded);
-  shared->set_asm_js_offset_table(*decoded_table);
-
-  int idx = 0;
-  std::vector<WasmFunction>& wasm_funs = shared->module()->functions;
-  for (int func = 0; func < num_functions; ++func) {
-    std::vector<wasm::AsmJsOffsetEntry>& func_asm_offsets =
-        asm_offsets.val[func];
-    if (func_asm_offsets.empty()) continue;
-    int func_offset = wasm_funs[num_imported_functions + func].code.offset();
-    for (wasm::AsmJsOffsetEntry& e : func_asm_offsets) {
-      // Byte offsets must be strictly monotonously increasing:
-      DCHECK_IMPLIES(idx > 0, func_offset + e.byte_offset >
-                                  decoded_table->get_int(idx - kOTESize));
-      decoded_table->set_int(idx + kOTEByteOffset, func_offset + e.byte_offset);
-      decoded_table->set_int(idx + kOTECallPosition, e.source_position_call);
-      decoded_table->set_int(idx + kOTENumberConvPosition,
-                             e.source_position_number_conversion);
-      idx += kOTESize;
-    }
+// May GC, because SetSpecializationMemInfoFrom may GC
+void SetInstanceMemory(Isolate* isolate, Handle<WasmInstanceObject> instance,
+                       Handle<JSArrayBuffer> buffer) {
+  instance->SetRawMemory(reinterpret_cast<byte*>(buffer->backing_store()),
+                         buffer->byte_length()->Number());
+#if DEBUG
+  // To flush out bugs earlier, in DEBUG mode, check that all pages of the
+  // memory are accessible by reading and writing one byte on each page.
+  byte* mem_start = instance->memory_start();
+  uintptr_t mem_size = instance->memory_size();
+  for (uint32_t offset = 0; offset < mem_size; offset += wasm::kWasmPageSize) {
+    byte val = mem_start[offset];
+    USE(val);
+    mem_start[offset] = val;
   }
-  DCHECK_EQ(total_size, idx * kIntSize + 1);
-  return decoded_table;
+#endif
 }
 
 }  // namespace
 
-int WasmSharedModuleData::GetSourcePosition(Handle<WasmSharedModuleData> shared,
-                                            uint32_t func_index,
-                                            uint32_t byte_offset,
-                                            bool is_at_number_conversion) {
-  Isolate* isolate = shared->GetIsolate();
-  const WasmModule* module = shared->module();
+Handle<WasmMemoryObject> WasmMemoryObject::New(
+    Isolate* isolate, MaybeHandle<JSArrayBuffer> maybe_buffer,
+    int32_t maximum) {
+  // TODO(kschimpf): Do we need to add an argument that defines the
+  // style of memory the user prefers (with/without trap handling), so
+  // that the memory will match the style of the compiled wasm module.
+  // See issue v8:7143
+  Handle<JSFunction> memory_ctor(
+      isolate->native_context()->wasm_memory_constructor(), isolate);
+  auto memory_obj = Handle<WasmMemoryObject>::cast(
+      isolate->factory()->NewJSObject(memory_ctor, TENURED));
 
-  if (!module->is_asm_js()) {
-    // for non-asm.js modules, we just add the function's start offset
-    // to make a module-relative position.
-    return byte_offset + shared->GetFunctionOffset(func_index);
+  Handle<JSArrayBuffer> buffer;
+  if (maybe_buffer.is_null()) {
+    // If no buffer was provided, create a 0-length one.
+    buffer = wasm::SetupArrayBuffer(isolate, nullptr, 0, false);
+  } else {
+    buffer = maybe_buffer.ToHandleChecked();
+    // Paranoid check that the buffer size makes sense.
+    uint32_t mem_size = 0;
+    CHECK(buffer->byte_length()->ToUint32(&mem_size));
   }
+  memory_obj->set_array_buffer(*buffer);
+  memory_obj->set_maximum_pages(maximum);
 
-  // asm.js modules have an additional offset table that must be searched.
-  Handle<ByteArray> offset_table = GetDecodedAsmJsOffsetTable(shared, isolate);
-
-  DCHECK_LT(func_index, module->functions.size());
-  uint32_t func_code_offset = module->functions[func_index].code.offset();
-  uint32_t total_offset = func_code_offset + byte_offset;
-
-  // Binary search for the total byte offset.
-  int left = 0;                                              // inclusive
-  int right = offset_table->length() / kIntSize / kOTESize;  // exclusive
-  DCHECK_LT(left, right);
-  while (right - left > 1) {
-    int mid = left + (right - left) / 2;
-    int mid_entry = offset_table->get_int(kOTESize * mid);
-    DCHECK_GE(kMaxInt, mid_entry);
-    if (static_cast<uint32_t>(mid_entry) <= total_offset) {
-      left = mid;
-    } else {
-      right = mid;
-    }
-  }
-  // There should be an entry for each position that could show up on the stack
-  // trace:
-  DCHECK_EQ(total_offset, offset_table->get_int(kOTESize * left));
-  int idx = is_at_number_conversion ? kOTENumberConvPosition : kOTECallPosition;
-  return offset_table->get_int(kOTESize * left + idx);
+  return memory_obj;
 }
 
-v8::debug::WasmDisassembly WasmSharedModuleData::DisassembleFunction(
-    int func_index) {
-  DisallowHeapAllocation no_gc;
-
-  if (func_index < 0 ||
-      static_cast<uint32_t>(func_index) >= module()->functions.size())
-    return {};
-
-  SeqOneByteString* module_bytes_str = module_bytes();
-  Vector<const byte> module_bytes(module_bytes_str->GetChars(),
-                                  module_bytes_str->length());
-
-  std::ostringstream disassembly_os;
-  v8::debug::WasmDisassembly::OffsetTable offset_table;
-
-  PrintWasmText(module(), module_bytes, static_cast<uint32_t>(func_index),
-                disassembly_os, &offset_table);
-
-  return {disassembly_os.str(), std::move(offset_table)};
+uint32_t WasmMemoryObject::current_pages() {
+  uint32_t byte_length;
+  CHECK(array_buffer()->byte_length()->ToUint32(&byte_length));
+  return byte_length / wasm::kWasmPageSize;
 }
 
-bool WasmSharedModuleData::GetPossibleBreakpoints(
-    const v8::debug::Location& start, const v8::debug::Location& end,
-    std::vector<v8::debug::BreakLocation>* locations) {
-  DisallowHeapAllocation no_gc;
-
-  std::vector<WasmFunction>& functions = module()->functions;
-  if (start.GetLineNumber() < 0 || start.GetColumnNumber() < 0 ||
-      (!end.IsEmpty() &&
-       (end.GetLineNumber() < 0 || end.GetColumnNumber() < 0)))
-    return false;
-
-  // start_func_index, start_offset and end_func_index is inclusive.
-  // end_offset is exclusive.
-  // start_offset and end_offset are module-relative byte offsets.
-  uint32_t start_func_index = start.GetLineNumber();
-  if (start_func_index >= functions.size()) return false;
-  int start_func_len = functions[start_func_index].code.length();
-  if (start.GetColumnNumber() > start_func_len) return false;
-  uint32_t start_offset =
-      functions[start_func_index].code.offset() + start.GetColumnNumber();
-  uint32_t end_func_index;
-  uint32_t end_offset;
-  if (end.IsEmpty()) {
-    // Default: everything till the end of the Script.
-    end_func_index = static_cast<uint32_t>(functions.size() - 1);
-    end_offset = functions[end_func_index].code.end_offset();
-  } else {
-    // If end is specified: Use it and check for valid input.
-    end_func_index = static_cast<uint32_t>(end.GetLineNumber());
-
-    // Special case: Stop before the start of the next function. Change to: Stop
-    // at the end of the function before, such that we don't disassemble the
-    // next function also.
-    if (end.GetColumnNumber() == 0 && end_func_index > 0) {
-      --end_func_index;
-      end_offset = functions[end_func_index].code.end_offset();
-    } else {
-      if (end_func_index >= functions.size()) return false;
-      end_offset =
-          functions[end_func_index].code.offset() + end.GetColumnNumber();
-      if (end_offset > functions[end_func_index].code.end_offset())
-        return false;
-    }
-  }
-
-  AccountingAllocator alloc;
-  Zone tmp(&alloc, ZONE_NAME);
-  const byte* module_start = module_bytes()->GetChars();
+bool WasmMemoryObject::has_full_guard_region(Isolate* isolate) {
+  const wasm::WasmMemoryTracker::AllocationData* allocation =
+      isolate->wasm_engine()->memory_tracker()->FindAllocationData(
+          array_buffer()->backing_store());
+  CHECK_NOT_NULL(allocation);
 
-  for (uint32_t func_idx = start_func_index; func_idx <= end_func_index;
-       ++func_idx) {
-    WasmFunction& func = functions[func_idx];
-    if (func.code.length() == 0) continue;
+  Address allocation_base =
+      reinterpret_cast<Address>(allocation->allocation_base);
+  Address buffer_start = reinterpret_cast<Address>(allocation->buffer_start);
 
-    wasm::BodyLocalDecls locals(&tmp);
-    wasm::BytecodeIterator iterator(module_start + func.code.offset(),
-                                    module_start + func.code.end_offset(),
-                                    &locals);
-    DCHECK_LT(0u, locals.encoded_size);
-    for (uint32_t offset : iterator.offsets()) {
-      uint32_t total_offset = func.code.offset() + offset;
-      if (total_offset >= end_offset) {
-        DCHECK_EQ(end_func_index, func_idx);
-        break;
-      }
-      if (total_offset < start_offset) continue;
-      locations->emplace_back(func_idx, offset, debug::kCommonBreakLocation);
-    }
-  }
-  return true;
+  // Return whether the allocation covers every possible Wasm heap index.
+  //
+  // We always have the following relationship:
+  // allocation_base <= buffer_start <= buffer_start + memory_size <=
+  // allocation_base + allocation_length
+  // (in other words, the buffer fits within the allocation)
+  //
+  // The space between buffer_start + memory_size and allocation_base +
+  // allocation_length is the guard region. Here we make sure the guard region
+  // is large enough for any Wasm heap offset.
+  return buffer_start + wasm::kWasmMaxHeapOffset <=
+         allocation_base + allocation->allocation_length;
 }
 
-MaybeHandle<FixedArray> WasmSharedModuleData::CheckBreakPoints(
-    Isolate* isolate, Handle<WasmSharedModuleData> shared, int position) {
-  if (!shared->has_breakpoint_infos()) return {};
-
-  Handle<FixedArray> breakpoint_infos(shared->breakpoint_infos(), isolate);
-  int insert_pos =
-      FindBreakpointInfoInsertPos(isolate, breakpoint_infos, position);
-  if (insert_pos >= breakpoint_infos->length()) return {};
-
-  Handle<Object> maybe_breakpoint_info(breakpoint_infos->get(insert_pos),
-                                       isolate);
-  if (maybe_breakpoint_info->IsUndefined(isolate)) return {};
-  Handle<BreakPointInfo> breakpoint_info =
-      Handle<BreakPointInfo>::cast(maybe_breakpoint_info);
-  if (breakpoint_info->source_position() != position) return {};
+void WasmMemoryObject::AddInstance(Isolate* isolate,
+                                   Handle<WasmMemoryObject> memory,
+                                   Handle<WasmInstanceObject> instance) {
+  Handle<FixedArrayOfWeakCells> old_instances =
+      memory->has_instances()
+          ? Handle<FixedArrayOfWeakCells>(memory->instances(), isolate)
+          : Handle<FixedArrayOfWeakCells>::null();
+  Handle<FixedArrayOfWeakCells> new_instances =
+      FixedArrayOfWeakCells::Add(isolate, old_instances, instance);
+  memory->set_instances(*new_instances);
+  Handle<JSArrayBuffer> buffer(memory->array_buffer(), isolate);
+  SetInstanceMemory(isolate, instance, buffer);
+}
 
-  // There is no support for conditional break points. Just assume that every
-  // break point always hits.
-  Handle<Object> break_points(breakpoint_info->break_points(), isolate);
-  if (break_points->IsFixedArray()) {
-    return Handle<FixedArray>::cast(break_points);
+void WasmMemoryObject::RemoveInstance(Isolate* isolate,
+                                      Handle<WasmMemoryObject> memory,
+                                      Handle<WasmInstanceObject> instance) {
+  if (memory->has_instances()) {
+    memory->instances()->Remove(instance);
   }
-  Handle<FixedArray> break_points_hit = isolate->factory()->NewFixedArray(1);
-  break_points_hit->set(0, *break_points);
-  return break_points_hit;
 }
 
-Handle<WasmCompiledModule> WasmCompiledModule::New(
-    Isolate* isolate, WasmModule* module, Handle<FixedArray> export_wrappers,
-    bool use_trap_handler) {
-  Handle<WasmCompiledModule> compiled_module = Handle<WasmCompiledModule>::cast(
-      isolate->factory()->NewStruct(WASM_COMPILED_MODULE_TYPE, TENURED));
-  Handle<WeakCell> weak_native_context =
-      isolate->factory()->NewWeakCell(isolate->native_context());
-  compiled_module->set_weak_native_context(*weak_native_context);
-  compiled_module->set_use_trap_handler(use_trap_handler);
-  if (!export_wrappers.is_null()) {
-    compiled_module->set_export_wrappers(*export_wrappers);
+// static
+int32_t WasmMemoryObject::Grow(Isolate* isolate,
+                               Handle<WasmMemoryObject> memory_object,
+                               uint32_t pages) {
+  Handle<JSArrayBuffer> old_buffer(memory_object->array_buffer(), isolate);
+  if (!old_buffer->is_growable()) return -1;
+  uint32_t old_size = 0;
+  CHECK(old_buffer->byte_length()->ToUint32(&old_size));
+  DCHECK_EQ(0, old_size % wasm::kWasmPageSize);
+  Handle<JSArrayBuffer> new_buffer;
+
+  uint32_t maximum_pages = FLAG_wasm_max_mem_pages;
+  if (memory_object->has_maximum_pages()) {
+    maximum_pages = Min(FLAG_wasm_max_mem_pages,
+                        static_cast<uint32_t>(memory_object->maximum_pages()));
   }
-  compiled_module->set_weak_owning_instance(isolate->heap()->empty_weak_cell());
-  wasm::NativeModule* native_module = nullptr;
-  {
-    std::unique_ptr<wasm::NativeModule> native_module_ptr =
-        isolate->wasm_engine()->code_manager()->NewNativeModule(*module);
-    native_module = native_module_ptr.release();
-    Handle<Foreign> native_module_wrapper =
-        Managed<wasm::NativeModule>::From(isolate, native_module);
-    compiled_module->set_native_module(*native_module_wrapper);
-    compiled_module->GetNativeModule()->SetCompiledModule(compiled_module);
+  if (!GrowMemoryBuffer(isolate, old_buffer, pages, maximum_pages)
+           .ToHandle(&new_buffer)) {
+    return -1;
   }
 
-  // TODO(mtrofin): copy the rest of the specialization parameters over.
-  // We're currently OK because we're only using defaults.
-  return compiled_module;
+  if (memory_object->has_instances()) {
+    Handle<FixedArrayOfWeakCells> instances(memory_object->instances(),
+                                            isolate);
+    for (int i = 0; i < instances->Length(); i++) {
+      Object* elem = instances->Get(i);
+      if (!elem->IsWasmInstanceObject()) continue;
+      Handle<WasmInstanceObject> instance(WasmInstanceObject::cast(elem),
+                                          isolate);
+      SetInstanceMemory(isolate, instance, new_buffer);
+    }
+  }
+  memory_object->set_array_buffer(*new_buffer);
+  return old_size / wasm::kWasmPageSize;
 }
 
-Handle<WasmCompiledModule> WasmCompiledModule::Clone(
-    Isolate* isolate, Handle<WasmCompiledModule> module) {
-  Handle<FixedArray> code_copy;
-  Handle<WasmCompiledModule> ret = Handle<WasmCompiledModule>::cast(
-      isolate->factory()->NewStruct(WASM_COMPILED_MODULE_TYPE, TENURED));
-  ret->set_shared(module->shared());
-  ret->set_weak_native_context(module->weak_native_context());
-  ret->set_export_wrappers(module->export_wrappers());
-  ret->set_weak_wasm_module(module->weak_wasm_module());
-  ret->set_weak_owning_instance(isolate->heap()->empty_weak_cell());
-  ret->set_native_module(module->native_module());
-  ret->set_use_trap_handler(module->use_trap_handler());
+// static
+MaybeHandle<WasmGlobalObject> WasmGlobalObject::New(
+    Isolate* isolate, MaybeHandle<JSArrayBuffer> maybe_buffer,
+    wasm::ValueType type, int32_t offset, bool is_mutable) {
+  Handle<JSFunction> global_ctor(
+      isolate->native_context()->wasm_global_constructor(), isolate);
+  auto global_obj = Handle<WasmGlobalObject>::cast(
+      isolate->factory()->NewJSObject(global_ctor));
+
+  uint32_t type_size = wasm::ValueTypes::ElementSizeInBytes(type);
+
+  Handle<JSArrayBuffer> buffer;
+  if (!maybe_buffer.ToHandle(&buffer)) {
+    // If no buffer was provided, create one long enough for the given type.
+    buffer =
+        isolate->factory()->NewJSArrayBuffer(SharedFlag::kNotShared, TENURED);
+
+    const bool initialize = true;
+    if (!JSArrayBuffer::SetupAllocatingData(buffer, isolate, type_size,
+                                            initialize)) {
+      return {};
+    }
+  }
 
-  Handle<FixedArray> export_copy = isolate->factory()->CopyFixedArray(
-      handle(module->export_wrappers(), isolate));
-  ret->set_export_wrappers(*export_copy);
+  // Check that the offset is in bounds.
+  uint32_t buffer_size = 0;
+  CHECK(buffer->byte_length()->ToUint32(&buffer_size));
+  CHECK(offset + type_size <= buffer_size);
 
-  std::unique_ptr<wasm::NativeModule> native_module =
-      module->GetNativeModule()->Clone();
-  // construct the wrapper in 2 steps, because its construction may trigger GC,
-  // which would shift the this pointer in set_native_module.
-  Handle<Foreign> native_module_wrapper =
-      Managed<wasm::NativeModule>::From(isolate, native_module.release());
-  ret->set_native_module(*native_module_wrapper);
-  ret->GetNativeModule()->SetCompiledModule(ret);
+  global_obj->set_array_buffer(*buffer);
+  global_obj->set_flags(0);
+  global_obj->set_type(type);
+  global_obj->set_offset(offset);
+  global_obj->set_is_mutable(is_mutable);
 
-  return ret;
+  return global_obj;
 }
 
-wasm::NativeModule* WasmCompiledModule::GetNativeModule() const {
-  if (!has_native_module()) return nullptr;
-  return Managed<wasm::NativeModule>::cast(native_module())->get();
+void IndirectFunctionTableEntry::clear() {
+  instance_->indirect_function_table_sig_ids()[index_] = -1;
+  instance_->indirect_function_table_targets()[index_] = 0;
+  instance_->indirect_function_table_instances()->set(
+      index_, ReadOnlyRoots(instance_->GetIsolate()).undefined_value());
 }
 
-void WasmCompiledModule::Reset(Isolate* isolate,
-                               WasmCompiledModule* compiled_module) {
-  DisallowHeapAllocation no_gc;
-  compiled_module->reset_prev_instance();
-  compiled_module->reset_next_instance();
-  wasm::NativeModule* native_module = compiled_module->GetNativeModule();
-  if (native_module == nullptr) return;
-  native_module->SetExecutable(false);
-
-  TRACE("Resetting %zu\n", native_module->instance_id);
-  if (compiled_module->use_trap_handler()) {
-    native_module->ReleaseProtectedInstructions();
-  }
+void IndirectFunctionTableEntry::set(int sig_id, WasmInstanceObject* instance,
+                                     Address call_target) {
+  TRACE_IFT("IFT entry %p[%d] = {sig_id=%d, instance=%p, target=%" PRIuPTR
+            "}\n",
+            *instance_, index_, sig_id, instance, call_target);
+  instance_->indirect_function_table_sig_ids()[index_] = sig_id;
+  instance_->indirect_function_table_targets()[index_] = call_target;
+  instance_->indirect_function_table_instances()->set(index_, instance);
+}
 
-  // Patch code to update memory references, global references, and function
-  // table references.
-  wasm::CodeSpecialization code_specialization;
-
-  for (uint32_t i = native_module->num_imported_functions(),
-                end = native_module->FunctionCount();
-       i < end; ++i) {
-    wasm::WasmCode* code = native_module->GetCode(i);
-    // Skip lazy compile stubs.
-    if (code == nullptr || code->kind() != wasm::WasmCode::kFunction) continue;
-    bool changed = code_specialization.ApplyToWasmCode(code, SKIP_ICACHE_FLUSH);
-    // TODO(wasm): Check if this is faster than passing FLUSH_ICACHE_IF_NEEDED
-    // above.
-    if (changed) {
-      Assembler::FlushICache(code->instructions().start(),
-                             code->instructions().size());
-    }
-  }
+WasmInstanceObject* IndirectFunctionTableEntry::instance() {
+  return WasmInstanceObject::cast(
+      instance_->indirect_function_table_instances()->get(index_));
 }
 
-MaybeHandle<String> WasmSharedModuleData::ExtractUtf8StringFromModuleBytes(
-    Isolate* isolate, Handle<WasmSharedModuleData> shared,
-    wasm::WireBytesRef ref) {
-  // TODO(wasm): cache strings from modules if it's a performance win.
-  Handle<SeqOneByteString> module_bytes(shared->module_bytes(), isolate);
-  return ExtractUtf8StringFromModuleBytes(isolate, module_bytes, ref);
+int IndirectFunctionTableEntry::sig_id() {
+  return instance_->indirect_function_table_sig_ids()[index_];
 }
 
-MaybeHandle<String> WasmSharedModuleData::ExtractUtf8StringFromModuleBytes(
-    Isolate* isolate, Handle<SeqOneByteString> module_bytes,
-    wasm::WireBytesRef ref) {
-  DCHECK_GE(module_bytes->length(), ref.end_offset());
-  // UTF8 validation happens at decode time.
-  DCHECK(unibrow::Utf8::ValidateEncoding(
-      reinterpret_cast<const byte*>(module_bytes->GetCharsAddress() +
-                                    ref.offset()),
-      ref.length()));
-  DCHECK_GE(kMaxInt, ref.offset());
-  DCHECK_GE(kMaxInt, ref.length());
-  return isolate->factory()->NewStringFromUtf8SubString(
-      module_bytes, static_cast<int>(ref.offset()),
-      static_cast<int>(ref.length()));
-}
-
-void WasmCompiledModule::PrintInstancesChain() {
-#if DEBUG
-  if (!FLAG_trace_wasm_instances) return;
-  for (WasmCompiledModule* current = this; current != nullptr;) {
-    PrintF("->%zu", current->GetNativeModule()->instance_id);
-    if (!current->has_next_instance()) break;
-    current = current->next_instance();
-  }
-  PrintF("\n");
-#endif
+Address IndirectFunctionTableEntry::target() {
+  return instance_->indirect_function_table_targets()[index_];
 }
 
-void WasmCompiledModule::InsertInChain(WasmModuleObject* module) {
-  DisallowHeapAllocation no_gc;
-  WasmCompiledModule* original = module->compiled_module();
-  set_next_instance(original);
-  original->set_prev_instance(this);
-  set_weak_wasm_module(original->weak_wasm_module());
+void ImportedFunctionEntry::set_wasm_to_js(
+    JSReceiver* callable, const wasm::WasmCode* wasm_to_js_wrapper) {
+  TRACE_IFT("Import callable %p[%d] = {callable=%p, target=%p}\n", *instance_,
+            index_, callable, wasm_to_js_wrapper->instructions().start());
+  DCHECK_EQ(wasm::WasmCode::kWasmToJsWrapper, wasm_to_js_wrapper->kind());
+  instance_->imported_function_instances()->set(index_, *instance_);
+  instance_->imported_function_callables()->set(index_, callable);
+  instance_->imported_function_targets()[index_] =
+      wasm_to_js_wrapper->instruction_start();
 }
 
-void WasmCompiledModule::RemoveFromChain() {
-  DisallowHeapAllocation no_gc;
-  Isolate* isolate = GetIsolate();
+void ImportedFunctionEntry::set_wasm_to_wasm(WasmInstanceObject* instance,
+                                             Address call_target) {
+  TRACE_IFT("Import WASM %p[%d] = {instance=%p, target=%" PRIuPTR "}\n",
+            *instance_, index_, instance, call_target);
+  instance_->imported_function_instances()->set(index_, instance);
+  instance_->imported_function_callables()->set(
+      index_, instance_->GetReadOnlyRoots().undefined_value());
+  instance_->imported_function_targets()[index_] = call_target;
+}
 
-  Object* next = raw_next_instance();
-  Object* prev = raw_prev_instance();
+WasmInstanceObject* ImportedFunctionEntry::instance() {
+  return WasmInstanceObject::cast(
+      instance_->imported_function_instances()->get(index_));
+}
 
-  if (!prev->IsUndefined(isolate)) {
-    WasmCompiledModule::cast(prev)->set_raw_next_instance(next);
-  }
-  if (!next->IsUndefined(isolate)) {
-    WasmCompiledModule::cast(next)->set_raw_prev_instance(prev);
-  }
+JSReceiver* ImportedFunctionEntry::callable() {
+  return JSReceiver::cast(
+      instance_->imported_function_callables()->get(index_));
 }
 
-void WasmCompiledModule::ReinitializeAfterDeserialization(
-    Isolate* isolate, Handle<WasmCompiledModule> compiled_module) {
-  // Reset, but don't delete any global handles, because their owning instance
-  // may still be active.
-  WasmCompiledModule::Reset(isolate, *compiled_module);
+Address ImportedFunctionEntry::target() {
+  return instance_->imported_function_targets()[index_];
 }
 
-MaybeHandle<String> WasmSharedModuleData::GetModuleNameOrNull(
-    Isolate* isolate, Handle<WasmSharedModuleData> shared) {
-  WasmModule* module = shared->module();
-  if (!module->name.is_set()) return {};
-  return ExtractUtf8StringFromModuleBytes(isolate, shared, module->name);
+bool ImportedFunctionEntry::is_js_receiver_entry() {
+  return instance_->imported_function_callables()->get(index_)->IsJSReceiver();
 }
 
-MaybeHandle<String> WasmSharedModuleData::GetFunctionNameOrNull(
-    Isolate* isolate, Handle<WasmSharedModuleData> shared,
-    uint32_t func_index) {
-  DCHECK_LT(func_index, shared->module()->functions.size());
-  wasm::WireBytesRef name =
-      shared->module()->LookupName(shared->module_bytes(), func_index);
-  if (!name.is_set()) return {};
-  return ExtractUtf8StringFromModuleBytes(isolate, shared, name);
+bool WasmInstanceObject::EnsureIndirectFunctionTableWithMinimumSize(
+    Handle<WasmInstanceObject> instance, uint32_t minimum_size) {
+  uint32_t old_size = instance->indirect_function_table_size();
+  if (old_size >= minimum_size) return false;  // Nothing to do.
+
+  Isolate* isolate = instance->GetIsolate();
+  HandleScope scope(isolate);
+  auto native_allocations = GetNativeAllocations(*instance);
+  native_allocations->resize_indirect_function_table(isolate, instance,
+                                                     minimum_size);
+  return true;
 }
 
-Handle<String> WasmSharedModuleData::GetFunctionName(
-    Isolate* isolate, Handle<WasmSharedModuleData> shared,
-    uint32_t func_index) {
-  MaybeHandle<String> name = GetFunctionNameOrNull(isolate, shared, func_index);
-  if (!name.is_null()) return name.ToHandleChecked();
-  return isolate->factory()->NewStringFromStaticChars("<WASM UNNAMED>");
+void WasmInstanceObject::SetRawMemory(byte* mem_start, uint32_t mem_size) {
+  DCHECK_LE(mem_size, wasm::kV8MaxWasmMemoryPages * wasm::kWasmPageSize);
+  uint32_t mem_size64 = mem_size;
+  uint32_t mem_mask64 = base::bits::RoundUpToPowerOfTwo32(mem_size) - 1;
+  DCHECK_LE(mem_size, mem_mask64 + 1);
+  set_memory_start(mem_start);
+  set_memory_size(mem_size64);
+  set_memory_mask(mem_mask64);
 }
 
-Vector<const uint8_t> WasmSharedModuleData::GetRawFunctionName(
-    uint32_t func_index) {
-  DCHECK_GT(module()->functions.size(), func_index);
-  SeqOneByteString* bytes = module_bytes();
-  wasm::WireBytesRef name = module()->LookupName(bytes, func_index);
-  DCHECK_GE(bytes->length(), name.end_offset());
-  return Vector<const uint8_t>(bytes->GetCharsAddress() + name.offset(),
-                               name.length());
+const WasmModule* WasmInstanceObject::module() {
+  return module_object()->module();
 }
 
-int WasmSharedModuleData::GetFunctionOffset(uint32_t func_index) {
-  std::vector<WasmFunction>& functions = module()->functions;
-  if (static_cast<uint32_t>(func_index) >= functions.size()) return -1;
-  DCHECK_GE(kMaxInt, functions[func_index].code.offset());
-  return static_cast<int>(functions[func_index].code.offset());
+Handle<WasmDebugInfo> WasmInstanceObject::GetOrCreateDebugInfo(
+    Handle<WasmInstanceObject> instance) {
+  if (instance->has_debug_info()) {
+    return handle(instance->debug_info(), instance->GetIsolate());
+  }
+  Handle<WasmDebugInfo> new_info = WasmDebugInfo::New(instance);
+  DCHECK(instance->has_debug_info());
+  return new_info;
 }
 
-int WasmSharedModuleData::GetContainingFunction(uint32_t byte_offset) {
-  std::vector<WasmFunction>& functions = module()->functions;
+Handle<WasmInstanceObject> WasmInstanceObject::New(
+    Isolate* isolate, Handle<WasmModuleObject> module_object) {
+  Handle<JSFunction> instance_cons(
+      isolate->native_context()->wasm_instance_constructor(), isolate);
+  Handle<JSObject> instance_object =
+      isolate->factory()->NewJSObject(instance_cons, TENURED);
 
-  // Binary search for a function containing the given position.
-  int left = 0;                                    // inclusive
-  int right = static_cast<int>(functions.size());  // exclusive
-  if (right == 0) return false;
-  while (right - left > 1) {
-    int mid = left + (right - left) / 2;
-    if (functions[mid].code.offset() <= byte_offset) {
-      left = mid;
-    } else {
-      right = mid;
-    }
-  }
-  // If the found function does not contains the given position, return -1.
-  WasmFunction& func = functions[left];
-  if (byte_offset < func.code.offset() ||
-      byte_offset >= func.code.end_offset()) {
-    return -1;
-  }
+  Handle<WasmInstanceObject> instance(
+      reinterpret_cast<WasmInstanceObject*>(*instance_object), isolate);
 
-  return left;
-}
+  // Initialize the imported function arrays.
+  auto module = module_object->module();
+  auto num_imported_functions = module->num_imported_functions;
+  auto num_imported_mutable_globals = module->num_imported_mutable_globals;
+  size_t native_allocations_size = EstimateNativeAllocationsSize(module);
+  auto native_allocations = Managed<WasmInstanceNativeAllocations>::Allocate(
+      isolate, native_allocations_size, instance, num_imported_functions,
+      num_imported_mutable_globals);
+  instance->set_managed_native_allocations(*native_allocations);
 
-bool WasmSharedModuleData::GetPositionInfo(uint32_t position,
-                                           Script::PositionInfo* info) {
-  int func_index = GetContainingFunction(position);
-  if (func_index < 0) return false;
+  Handle<FixedArray> imported_function_instances =
+      isolate->factory()->NewFixedArray(num_imported_functions);
+  instance->set_imported_function_instances(*imported_function_instances);
+
+  Handle<FixedArray> imported_function_callables =
+      isolate->factory()->NewFixedArray(num_imported_functions);
+  instance->set_imported_function_callables(*imported_function_callables);
 
-  WasmFunction& function = module()->functions[func_index];
+  Handle<Code> centry_stub = CodeFactory::CEntry(isolate);
+  instance->set_centry_stub(*centry_stub);
 
-  info->line = func_index;
-  info->column = position - function.code.offset();
-  info->line_start = function.code.offset();
-  info->line_end = function.code.end_offset();
-  return true;
+  instance->SetRawMemory(nullptr, 0);
+  instance->set_roots_array_address(
+      reinterpret_cast<Address>(isolate->heap()->roots_array_start()));
+  instance->set_stack_limit_address(
+      isolate->stack_guard()->address_of_jslimit());
+  instance->set_real_stack_limit_address(
+      isolate->stack_guard()->address_of_real_jslimit());
+  instance->set_globals_start(nullptr);
+  instance->set_indirect_function_table_size(0);
+  instance->set_indirect_function_table_sig_ids(nullptr);
+  instance->set_indirect_function_table_targets(nullptr);
+  instance->set_native_context(*isolate->native_context());
+  instance->set_module_object(*module_object);
+  instance->set_undefined_value(ReadOnlyRoots(isolate).undefined_value());
+  instance->set_null_value(ReadOnlyRoots(isolate).null_value());
+  instance->set_jump_table_adjusted_start(
+      module_object->native_module()->jump_table_start() -
+      wasm::JumpTableAssembler::kJumpTableSlotSize *
+          module->num_imported_functions);
+
+  // Insert the new instance into the modules weak list of instances.
+  // TODO(mstarzinger): Allow to reuse holes in the {WeakArrayList} below.
+  Handle<WeakArrayList> weak_instance_list(module_object->weak_instance_list(),
+                                           isolate);
+  weak_instance_list = WeakArrayList::AddToEnd(
+      weak_instance_list, MaybeObjectHandle::Weak(instance));
+  module_object->set_weak_instance_list(*weak_instance_list);
+
+  return instance;
 }
 
-bool WasmCompiledModule::SetBreakPoint(
-    Handle<WasmCompiledModule> compiled_module, int* position,
-    Handle<BreakPoint> break_point) {
-  Isolate* isolate = compiled_module->GetIsolate();
-  Handle<WasmSharedModuleData> shared(compiled_module->shared(), isolate);
+namespace {
+void InstanceFinalizer(const v8::WeakCallbackInfo<void>& data) {
+  DisallowHeapAllocation no_gc;
+  JSObject** p = reinterpret_cast<JSObject**>(data.GetParameter());
+  WasmInstanceObject* instance = reinterpret_cast<WasmInstanceObject*>(*p);
+  Isolate* isolate = reinterpret_cast<Isolate*>(data.GetIsolate());
+  // If a link to shared memory instances exists, update the list of memory
+  // instances before the instance is destroyed.
+  TRACE("Finalizing instance of %p {\n",
+        instance->module_object()->native_module());
 
-  // Find the function for this breakpoint.
-  int func_index = shared->GetContainingFunction(*position);
-  if (func_index < 0) return false;
-  WasmFunction& func = shared->module()->functions[func_index];
-  int offset_in_func = *position - func.code.offset();
+  // Since the order of finalizers is not guaranteed, it can be the case
+  // that {instance->compiled_module()->module()}, which is a
+  // {Managed<WasmModule>} has been collected earlier in this GC cycle.
+  // Weak references to this instance won't be cleared until
+  // the next GC cycle, so we need to manually break some links (such as
+  // the weak references from {WasmMemoryObject::instances}.
+  if (instance->has_memory_object()) {
+    WasmMemoryObject::RemoveInstance(isolate,
+                                     handle(instance->memory_object(), isolate),
+                                     handle(instance, isolate));
+  }
 
-  // According to the current design, we should only be called with valid
-  // breakable positions.
-  DCHECK(IsBreakablePosition(*shared, func_index, offset_in_func));
+  // Free raw C++ memory associated with the instance.
+  GetNativeAllocations(instance)->free();
 
-  // Insert new break point into break_positions of shared module data.
-  WasmSharedModuleData::AddBreakpoint(shared, *position, break_point);
+  GlobalHandles::Destroy(reinterpret_cast<Object**>(p));
+  TRACE("}\n");
+}
 
-  // Iterate over all instances of this module and tell them to set this new
-  // breakpoint.
-  for (Handle<WasmInstanceObject> instance :
-       iterate_compiled_module_instance_chain(isolate, compiled_module)) {
-    Handle<WasmDebugInfo> debug_info =
-        WasmInstanceObject::GetOrCreateDebugInfo(instance);
-    WasmDebugInfo::SetBreakpoint(debug_info, func_index, offset_in_func);
+}  // namespace
+
+void WasmInstanceObject::InstallFinalizer(Isolate* isolate,
+                                          Handle<WasmInstanceObject> instance) {
+  Handle<Object> global_handle = isolate->global_handles()->Create(*instance);
+  GlobalHandles::MakeWeak(global_handle.location(), global_handle.location(),
+                          InstanceFinalizer, v8::WeakCallbackType::kFinalizer);
+}
+
+Address WasmInstanceObject::GetCallTarget(uint32_t func_index) {
+  wasm::NativeModule* native_module = module_object()->native_module();
+  if (func_index < native_module->num_imported_functions()) {
+    return imported_function_targets()[func_index];
   }
+  return native_module->GetCallTargetForFunction(func_index);
+}
 
+bool WasmExportedFunction::IsWasmExportedFunction(Object* object) {
+  if (!object->IsJSFunction()) return false;
+  JSFunction* js_function = JSFunction::cast(object);
+  if (Code::JS_TO_WASM_FUNCTION != js_function->code()->kind()) return false;
+  DCHECK(js_function->shared()->HasWasmExportedFunctionData());
   return true;
 }
 
-void WasmCompiledModule::LogWasmCodes(Isolate* isolate) {
-  if (!wasm::WasmCode::ShouldBeLogged(isolate)) return;
+WasmExportedFunction* WasmExportedFunction::cast(Object* object) {
+  DCHECK(IsWasmExportedFunction(object));
+  return reinterpret_cast<WasmExportedFunction*>(object);
+}
+
+WasmInstanceObject* WasmExportedFunction::instance() {
+  return shared()->wasm_exported_function_data()->instance();
+}
 
-  wasm::NativeModule* native_module = GetNativeModule();
-  if (native_module == nullptr) return;
-  const uint32_t number_of_codes = native_module->FunctionCount();
-  if (has_shared()) {
-    Handle<WasmSharedModuleData> shared_handle(shared(), isolate);
-    for (uint32_t i = 0; i < number_of_codes; i++) {
-      wasm::WasmCode* code = native_module->GetCode(i);
-      if (code == nullptr) continue;
-      code->LogCode(isolate);
-    }
+int WasmExportedFunction::function_index() {
+  return shared()->wasm_exported_function_data()->function_index();
+}
+
+Handle<WasmExportedFunction> WasmExportedFunction::New(
+    Isolate* isolate, Handle<WasmInstanceObject> instance,
+    MaybeHandle<String> maybe_name, int func_index, int arity,
+    Handle<Code> export_wrapper) {
+  DCHECK_EQ(Code::JS_TO_WASM_FUNCTION, export_wrapper->kind());
+  Handle<WasmExportedFunctionData> function_data =
+      Handle<WasmExportedFunctionData>::cast(isolate->factory()->NewStruct(
+          WASM_EXPORTED_FUNCTION_DATA_TYPE, TENURED));
+  function_data->set_wrapper_code(*export_wrapper);
+  function_data->set_instance(*instance);
+  function_data->set_function_index(func_index);
+  Handle<String> name;
+  if (!maybe_name.ToHandle(&name)) {
+    EmbeddedVector<char, 16> buffer;
+    int length = SNPrintF(buffer, "%d", func_index);
+    name = isolate->factory()
+               ->NewStringFromOneByte(
+                   Vector<uint8_t>::cast(buffer.SubVector(0, length)))
+               .ToHandleChecked();
   }
+  NewFunctionArgs args = NewFunctionArgs::ForWasm(
+      name, function_data, isolate->sloppy_function_without_prototype_map());
+  Handle<JSFunction> js_function = isolate->factory()->NewFunction(args);
+  // According to the spec, exported functions should not have a [[Construct]]
+  // method.
+  DCHECK(!js_function->IsConstructor());
+  js_function->shared()->set_length(arity);
+  js_function->shared()->set_internal_formal_parameter_count(arity);
+  return Handle<WasmExportedFunction>::cast(js_function);
+}
+
+Address WasmExportedFunction::GetWasmCallTarget() {
+  return instance()->GetCallTarget(function_index());
 }
 
 #undef TRACE
diff --git a/deps/v8/src/wasm/wasm-objects.h b/deps/v8/src/wasm/wasm-objects.h
index 68b3c74063ac55..3d3f81dcd126ba 100644
--- a/deps/v8/src/wasm/wasm-objects.h
+++ b/deps/v8/src/wasm/wasm-objects.h
@@ -8,15 +8,11 @@
 #include "src/base/bits.h"
 #include "src/debug/debug.h"
 #include "src/debug/interface-types.h"
-#include "src/managed.h"
+#include "src/heap/heap.h"
 #include "src/objects.h"
 #include "src/objects/script.h"
-#include "src/wasm/decoder.h"
-#include "src/wasm/wasm-interpreter.h"
-#include "src/wasm/wasm-limits.h"
-#include "src/wasm/wasm-module.h"
-
-#include "src/heap/heap.h"
+#include "src/signature.h"
+#include "src/wasm/value-type.h"
 
 // Has to be the last include (doesn't have include guards)
 #include "src/objects/object-macros.h"
@@ -25,20 +21,29 @@ namespace v8 {
 namespace internal {
 namespace wasm {
 class InterpretedFrame;
+struct InterpretedFrameDeleter;
 class NativeModule;
+struct ModuleEnv;
 class WasmCode;
 struct WasmModule;
 class SignatureMap;
-using ValueType = MachineRepresentation;
+class WireBytesRef;
+class WasmInterpreter;
 using FunctionSig = Signature<ValueType>;
 }  // namespace wasm
 
-class WasmCompiledModule;
+class BreakPoint;
+class JSArrayBuffer;
+class FixedArrayOfWeakCells;
+class SeqOneByteString;
 class WasmDebugInfo;
 class WasmInstanceObject;
 
+template <class CppType>
+class Managed;
+
 #define DECL_OPTIONAL_ACCESSORS(name, type) \
-  INLINE(bool has_##name());                \
+  V8_INLINE bool has_##name();              \
   DECL_ACCESSORS(name, type)
 
 // An entry in an indirect function table (IFT).
@@ -48,21 +53,17 @@ class WasmInstanceObject;
 // - target   = entrypoint to wasm code for the function, or wasm-to-js wrapper
 class IndirectFunctionTableEntry {
  public:
-  inline IndirectFunctionTableEntry(WasmInstanceObject*, int index);
+  inline IndirectFunctionTableEntry(Handle<WasmInstanceObject>, int index);
 
   void clear();
-  void set(int sig_id, WasmInstanceObject* instance,
-           const wasm::WasmCode* wasm_code);
+  void set(int sig_id, WasmInstanceObject* instance, Address call_target);
 
   WasmInstanceObject* instance();
   int sig_id();
   Address target();
 
  private:
-#ifdef DEBUG
-  DisallowHeapAllocation no_gc;
-#endif
-  WasmInstanceObject* const instance_;
+  Handle<WasmInstanceObject> const instance_;
   int const index_;
 };
 
@@ -76,16 +77,17 @@ class IndirectFunctionTableEntry {
 //      - target   = pointer to wasm-to-js wrapper code entrypoint
 //   - an imported wasm function from another instance, which has fields
 //      - instance = target instance
-//      - target   = entrypoint to wasm code of the function
+//      - target   = entrypoint for the function
 class ImportedFunctionEntry {
  public:
-  inline ImportedFunctionEntry(WasmInstanceObject*, int index);
+  inline ImportedFunctionEntry(Handle<WasmInstanceObject>, int index);
 
   // Initialize this entry as a {JSReceiver} call.
-  void set(JSReceiver* callable, const wasm::WasmCode* wasm_to_js_wrapper);
+  void set_wasm_to_js(JSReceiver* callable,
+                      const wasm::WasmCode* wasm_to_js_wrapper);
   // Initialize this entry as a WASM to WASM call.
-  void set(WasmInstanceObject* target_instance,
-           const wasm::WasmCode* wasm_function);
+  void set_wasm_to_wasm(WasmInstanceObject* target_instance,
+                        Address call_target);
 
   WasmInstanceObject* instance();
   JSReceiver* callable();
@@ -93,10 +95,7 @@ class ImportedFunctionEntry {
   bool is_js_receiver_entry();
 
  private:
-#ifdef DEBUG
-  DisallowHeapAllocation no_gc;
-#endif
-  WasmInstanceObject* const instance_;
+  Handle<WasmInstanceObject> const instance_;
   int const index_;
 };
 
@@ -105,23 +104,134 @@ class WasmModuleObject : public JSObject {
  public:
   DECL_CAST(WasmModuleObject)
 
-  // Shared compiled code between multiple WebAssembly.Module objects.
-  DECL_ACCESSORS(compiled_module, WasmCompiledModule)
+  DECL_ACCESSORS(managed_native_module, Managed<wasm::NativeModule>)
+  DECL_ACCESSORS(export_wrappers, FixedArray)
+  DECL_ACCESSORS(script, Script)
+  DECL_ACCESSORS(weak_instance_list, WeakArrayList)
+  DECL_OPTIONAL_ACCESSORS(asm_js_offset_table, ByteArray)
+  DECL_OPTIONAL_ACCESSORS(breakpoint_infos, FixedArray)
+  inline wasm::NativeModule* native_module() const;
+  inline const wasm::WasmModule* module() const;
+  inline void reset_breakpoint_infos();
+
+  // Dispatched behavior.
+  DECL_PRINTER_WITH_ISOLATE(WasmModuleObject)
+  DECL_VERIFIER(WasmModuleObject)
 
 // Layout description.
-#define WASM_MODULE_OBJECT_FIELDS(V)     \
-  V(kCompiledModuleOffset, kPointerSize) \
+#define WASM_MODULE_OBJECT_FIELDS(V)       \
+  V(kNativeModuleOffset, kPointerSize)     \
+  V(kExportWrappersOffset, kPointerSize)   \
+  V(kScriptOffset, kPointerSize)           \
+  V(kWeakInstanceListOffset, kPointerSize) \
+  V(kAsmJsOffsetTableOffset, kPointerSize) \
+  V(kBreakPointInfosOffset, kPointerSize)  \
   V(kSize, 0)
 
   DEFINE_FIELD_OFFSET_CONSTANTS(JSObject::kHeaderSize,
                                 WASM_MODULE_OBJECT_FIELDS)
 #undef WASM_MODULE_OBJECT_FIELDS
 
+  // Creates a new {WasmModuleObject} with a new {NativeModule} underneath.
   static Handle<WasmModuleObject> New(
-      Isolate* isolate, Handle<WasmCompiledModule> compiled_module);
+      Isolate* isolate, std::shared_ptr<const wasm::WasmModule> module,
+      wasm::ModuleEnv& env, OwnedVector<const uint8_t> wire_bytes,
+      Handle<Script> script, Handle<ByteArray> asm_js_offset_table);
+
+  // Creates a new {WasmModuleObject} for an existing {NativeModule} that is
+  // reference counted and might be shared between multiple Isolates.
+  static Handle<WasmModuleObject> New(
+      Isolate* isolate, std::shared_ptr<wasm::NativeModule> native_module,
+      Handle<Script> script);
+
+  // Set a breakpoint on the given byte position inside the given module.
+  // This will affect all live and future instances of the module.
+  // The passed position might be modified to point to the next breakable
+  // location inside the same function.
+  // If it points outside a function, or behind the last breakable location,
+  // this function returns false and does not set any breakpoint.
+  static bool SetBreakPoint(Handle<WasmModuleObject>, int* position,
+                            Handle<BreakPoint> break_point);
+
+  // Check whether this module was generated from asm.js source.
+  inline bool is_asm_js();
+
+  static void AddBreakpoint(Handle<WasmModuleObject>, int position,
+                            Handle<BreakPoint> break_point);
+
+  static void SetBreakpointsOnNewInstance(Handle<WasmModuleObject>,
+                                          Handle<WasmInstanceObject>);
+
+  // Get the module name, if set. Returns an empty handle otherwise.
+  static MaybeHandle<String> GetModuleNameOrNull(Isolate*,
+                                                 Handle<WasmModuleObject>);
+
+  // Get the function name of the function identified by the given index.
+  // Returns a null handle if the function is unnamed or the name is not a valid
+  // UTF-8 string.
+  static MaybeHandle<String> GetFunctionNameOrNull(Isolate*,
+                                                   Handle<WasmModuleObject>,
+                                                   uint32_t func_index);
+
+  // Get the function name of the function identified by the given index.
+  // Returns "<WASM UNNAMED>" if the function is unnamed or the name is not a
+  // valid UTF-8 string.
+  static Handle<String> GetFunctionName(Isolate*, Handle<WasmModuleObject>,
+                                        uint32_t func_index);
+
+  // Get the raw bytes of the function name of the function identified by the
+  // given index.
+  // Meant to be used for debugging or frame printing.
+  // Does not allocate, hence gc-safe.
+  Vector<const uint8_t> GetRawFunctionName(uint32_t func_index);
+
+  // Return the byte offset of the function identified by the given index.
+  // The offset will be relative to the start of the module bytes.
+  // Returns -1 if the function index is invalid.
+  int GetFunctionOffset(uint32_t func_index);
 
-  static void ValidateStateForTesting(Isolate* isolate,
-                                      Handle<WasmModuleObject> module);
+  // Returns the function containing the given byte offset.
+  // Returns -1 if the byte offset is not contained in any function of this
+  // module.
+  int GetContainingFunction(uint32_t byte_offset);
+
+  // Translate from byte offset in the module to function number and byte offset
+  // within that function, encoded as line and column in the position info.
+  // Returns true if the position is valid inside this module, false otherwise.
+  bool GetPositionInfo(uint32_t position, Script::PositionInfo* info);
+
+  // Get the source position from a given function index and byte offset,
+  // for either asm.js or pure WASM modules.
+  static int GetSourcePosition(Handle<WasmModuleObject>, uint32_t func_index,
+                               uint32_t byte_offset,
+                               bool is_at_number_conversion);
+
+  // Compute the disassembly of a wasm function.
+  // Returns the disassembly string and a list of <byte_offset, line, column>
+  // entries, mapping wasm byte offsets to line and column in the disassembly.
+  // The list is guaranteed to be ordered by the byte_offset.
+  // Returns an empty string and empty vector if the function index is invalid.
+  debug::WasmDisassembly DisassembleFunction(int func_index);
+
+  // Extract a portion of the wire bytes as UTF-8 string.
+  // Returns a null handle if the respective bytes do not form a valid UTF-8
+  // string.
+  static MaybeHandle<String> ExtractUtf8StringFromModuleBytes(
+      Isolate* isolate, Handle<WasmModuleObject>, wasm::WireBytesRef ref);
+  static MaybeHandle<String> ExtractUtf8StringFromModuleBytes(
+      Isolate* isolate, Vector<const uint8_t> wire_byte,
+      wasm::WireBytesRef ref);
+
+  // Get a list of all possible breakpoints within a given range of this module.
+  bool GetPossibleBreakpoints(const debug::Location& start,
+                              const debug::Location& end,
+                              std::vector<debug::BreakLocation>* locations);
+
+  // Return an empty handle if no breakpoint is hit at that location, or a
+  // FixedArray with all hit breakpoint objects.
+  static MaybeHandle<FixedArray> CheckBreakPoints(Isolate*,
+                                                  Handle<WasmModuleObject>,
+                                                  int position);
 };
 
 // Representation of a WebAssembly.Table JavaScript-level object.
@@ -161,9 +271,10 @@ class WasmTableObject : public JSObject {
                                    Handle<WasmTableObject> table,
                                    int table_index, wasm::FunctionSig* sig,
                                    Handle<WasmInstanceObject> from_instance,
-                                   wasm::WasmCode* wasm_code);
+                                   Address call_target);
 
-  static void ClearDispatchTables(Handle<WasmTableObject> table, int index);
+  static void ClearDispatchTables(Isolate* isolate,
+                                  Handle<WasmTableObject> table, int index);
 };
 
 // Representation of a WebAssembly.Memory JavaScript-level object.
@@ -195,6 +306,10 @@ class WasmMemoryObject : public JSObject {
   uint32_t current_pages();
   inline bool has_maximum_pages();
 
+  // Return whether the underlying backing store has guard regions large enough
+  // to be used with trap handlers.
+  bool has_full_guard_region(Isolate* isolate);
+
   V8_EXPORT_PRIVATE static Handle<WasmMemoryObject> New(
       Isolate* isolate, MaybeHandle<JSArrayBuffer> buffer, int32_t maximum);
 
@@ -235,14 +350,15 @@ class WasmGlobalObject : public JSObject {
       Isolate* isolate, MaybeHandle<JSArrayBuffer> buffer, wasm::ValueType type,
       int32_t offset, bool is_mutable);
 
-  static inline uint32_t TypeSize(wasm::ValueType);
-  inline uint32_t type_size() const;
+  inline int type_size() const;
 
   inline int32_t GetI32();
+  inline int64_t GetI64();
   inline float GetF32();
   inline double GetF64();
 
   inline void SetI32(int32_t value);
+  inline void SetI64(int64_t value);
   inline void SetF32(float value);
   inline void SetF64(double value);
 
@@ -253,53 +369,74 @@ class WasmGlobalObject : public JSObject {
   inline Address address() const;
 };
 
-// A WebAssembly.Instance JavaScript-level object.
+// Representation of a WebAssembly.Instance JavaScript-level object.
 class WasmInstanceObject : public JSObject {
  public:
   DECL_CAST(WasmInstanceObject)
 
-  DECL_ACCESSORS(compiled_module, WasmCompiledModule)
+  DECL_ACCESSORS(module_object, WasmModuleObject)
   DECL_ACCESSORS(exports_object, JSObject)
+  DECL_ACCESSORS(native_context, Context)
   DECL_OPTIONAL_ACCESSORS(memory_object, WasmMemoryObject)
   DECL_OPTIONAL_ACCESSORS(globals_buffer, JSArrayBuffer)
+  DECL_OPTIONAL_ACCESSORS(imported_mutable_globals_buffers, FixedArray)
   DECL_OPTIONAL_ACCESSORS(debug_info, WasmDebugInfo)
   DECL_OPTIONAL_ACCESSORS(table_object, WasmTableObject)
   DECL_ACCESSORS(imported_function_instances, FixedArray)
   DECL_ACCESSORS(imported_function_callables, FixedArray)
   DECL_OPTIONAL_ACCESSORS(indirect_function_table_instances, FixedArray)
   DECL_OPTIONAL_ACCESSORS(managed_native_allocations, Foreign)
-  DECL_OPTIONAL_ACCESSORS(managed_indirect_patcher, Foreign)
+  DECL_ACCESSORS(undefined_value, Oddball)
+  DECL_ACCESSORS(null_value, Oddball)
+  DECL_ACCESSORS(centry_stub, Code)
   DECL_PRIMITIVE_ACCESSORS(memory_start, byte*)
   DECL_PRIMITIVE_ACCESSORS(memory_size, uint32_t)
   DECL_PRIMITIVE_ACCESSORS(memory_mask, uint32_t)
+  DECL_PRIMITIVE_ACCESSORS(roots_array_address, Address)
+  DECL_PRIMITIVE_ACCESSORS(stack_limit_address, Address)
+  DECL_PRIMITIVE_ACCESSORS(real_stack_limit_address, Address)
   DECL_PRIMITIVE_ACCESSORS(imported_function_targets, Address*)
   DECL_PRIMITIVE_ACCESSORS(globals_start, byte*)
+  DECL_PRIMITIVE_ACCESSORS(imported_mutable_globals, Address*)
   DECL_PRIMITIVE_ACCESSORS(indirect_function_table_size, uint32_t)
   DECL_PRIMITIVE_ACCESSORS(indirect_function_table_sig_ids, uint32_t*)
   DECL_PRIMITIVE_ACCESSORS(indirect_function_table_targets, Address*)
+  DECL_PRIMITIVE_ACCESSORS(jump_table_adjusted_start, Address)
+
+  // Dispatched behavior.
+  DECL_PRINTER(WasmInstanceObject)
+  DECL_VERIFIER(WasmInstanceObject)
 
 // Layout description.
 #define WASM_INSTANCE_OBJECT_FIELDS(V)                                  \
-  V(kCompiledModuleOffset, kPointerSize)                                \
+  V(kModuleObjectOffset, kPointerSize)                                  \
   V(kExportsObjectOffset, kPointerSize)                                 \
+  V(kNativeContextOffset, kPointerSize)                                 \
   V(kMemoryObjectOffset, kPointerSize)                                  \
   V(kGlobalsBufferOffset, kPointerSize)                                 \
+  V(kImportedMutableGlobalsBuffersOffset, kPointerSize)                 \
   V(kDebugInfoOffset, kPointerSize)                                     \
   V(kTableObjectOffset, kPointerSize)                                   \
-  V(kFunctionTablesOffset, kPointerSize)                                \
   V(kImportedFunctionInstancesOffset, kPointerSize)                     \
   V(kImportedFunctionCallablesOffset, kPointerSize)                     \
   V(kIndirectFunctionTableInstancesOffset, kPointerSize)                \
   V(kManagedNativeAllocationsOffset, kPointerSize)                      \
-  V(kManagedIndirectPatcherOffset, kPointerSize)                        \
+  V(kUndefinedValueOffset, kPointerSize)                                \
+  V(kNullValueOffset, kPointerSize)                                     \
+  V(kCEntryStubOffset, kPointerSize)                                    \
   V(kFirstUntaggedOffset, 0)                             /* marker */   \
   V(kMemoryStartOffset, kPointerSize)                    /* untagged */ \
   V(kMemorySizeOffset, kUInt32Size)                      /* untagged */ \
   V(kMemoryMaskOffset, kUInt32Size)                      /* untagged */ \
+  V(kRootsArrayAddressOffset, kPointerSize)              /* untagged */ \
+  V(kStackLimitAddressOffset, kPointerSize)              /* untagged */ \
+  V(kRealStackLimitAddressOffset, kPointerSize)          /* untagged */ \
   V(kImportedFunctionTargetsOffset, kPointerSize)        /* untagged */ \
   V(kGlobalsStartOffset, kPointerSize)                   /* untagged */ \
+  V(kImportedMutableGlobalsOffset, kPointerSize)         /* untagged */ \
   V(kIndirectFunctionTableSigIdsOffset, kPointerSize)    /* untagged */ \
   V(kIndirectFunctionTableTargetsOffset, kPointerSize)   /* untagged */ \
+  V(kJumpTableAdjustedStartOffset, kPointerSize)         /* untagged */ \
   V(kIndirectFunctionTableSizeOffset, kUInt32Size)       /* untagged */ \
   V(k64BitArchPaddingOffset, kPointerSize - kUInt32Size) /* padding */  \
   V(kSize, 0)
@@ -308,8 +445,7 @@ class WasmInstanceObject : public JSObject {
                                 WASM_INSTANCE_OBJECT_FIELDS)
 #undef WASM_INSTANCE_OBJECT_FIELDS
 
-  WasmModuleObject* module_object();
-  V8_EXPORT_PRIVATE wasm::WasmModule* module();
+  V8_EXPORT_PRIVATE const wasm::WasmModule* module();
 
   static bool EnsureIndirectFunctionTableWithMinimumSize(
       Handle<WasmInstanceObject> instance, uint32_t minimum_size);
@@ -322,23 +458,13 @@ class WasmInstanceObject : public JSObject {
   // If no debug info exists yet, it is created automatically.
   static Handle<WasmDebugInfo> GetOrCreateDebugInfo(Handle<WasmInstanceObject>);
 
-  static Handle<WasmInstanceObject> New(Isolate*, Handle<WasmCompiledModule>);
-
-  // Assumed to be called with a code object associated to a wasm module
-  // instance. Intended to be called from runtime functions. Returns nullptr on
-  // failing to get owning instance.
-  static WasmInstanceObject* GetOwningInstance(const wasm::WasmCode* code);
-
-  static void ValidateInstancesChainForTesting(
-      Isolate* isolate, Handle<WasmModuleObject> module_obj,
-      int instance_count);
-
-  static void ValidateOrphanedInstanceForTesting(
-      Isolate* isolate, Handle<WasmInstanceObject> instance);
+  static Handle<WasmInstanceObject> New(Isolate*, Handle<WasmModuleObject>);
 
   static void InstallFinalizer(Isolate* isolate,
                                Handle<WasmInstanceObject> instance);
 
+  Address GetCallTarget(uint32_t func_index);
+
   // Iterates all fields in the object except the untagged fields.
   class BodyDescriptor;
   // No weak fields.
@@ -360,232 +486,34 @@ class WasmExportedFunction : public JSFunction {
                                           int func_index, int arity,
                                           Handle<Code> export_wrapper);
 
-  wasm::WasmCode* GetWasmCode();
+  Address GetWasmCallTarget();
 };
 
-// Information shared by all WasmCompiledModule objects for the same module.
-class WasmSharedModuleData : public Struct {
+// Information for a WasmExportedFunction which is referenced as the function
+// data of the SharedFunctionInfo underlying the function. For details please
+// see the {SharedFunctionInfo::HasWasmExportedFunctionData} predicate.
+class WasmExportedFunctionData : public Struct {
  public:
-  DECL_ACCESSORS(module_wrapper, Object)
-  wasm::WasmModule* module() const;
-  DECL_ACCESSORS(module_bytes, SeqOneByteString)
-  DECL_ACCESSORS(script, Script)
-  DECL_OPTIONAL_ACCESSORS(asm_js_offset_table, ByteArray)
-  DECL_OPTIONAL_ACCESSORS(breakpoint_infos, FixedArray)
-  inline void reset_breakpoint_infos();
-
-  DECL_CAST(WasmSharedModuleData)
-
-  // Dispatched behavior.
-  DECL_PRINTER(WasmSharedModuleData)
-  DECL_VERIFIER(WasmSharedModuleData)
-
-// Layout description.
-#define WASM_SHARED_MODULE_DATA_FIELDS(V)             \
-  V(kModuleWrapperOffset, kPointerSize)               \
-  V(kModuleBytesOffset, kPointerSize)                 \
-  V(kScriptOffset, kPointerSize)                      \
-  V(kAsmJsOffsetTableOffset, kPointerSize)            \
-  V(kBreakPointInfosOffset, kPointerSize)             \
-  V(kSize, 0)
-
-  DEFINE_FIELD_OFFSET_CONSTANTS(HeapObject::kHeaderSize,
-                                WASM_SHARED_MODULE_DATA_FIELDS)
-#undef WASM_SHARED_MODULE_DATA_FIELDS
-
-  // Check whether this module was generated from asm.js source.
-  bool is_asm_js();
-
-  static void AddBreakpoint(Handle<WasmSharedModuleData>, int position,
-                            Handle<BreakPoint> break_point);
-
-  static void SetBreakpointsOnNewInstance(Handle<WasmSharedModuleData>,
-                                          Handle<WasmInstanceObject>);
-
-  static Handle<WasmSharedModuleData> New(
-      Isolate* isolate, Handle<Foreign> module_wrapper,
-      Handle<SeqOneByteString> module_bytes, Handle<Script> script,
-      Handle<ByteArray> asm_js_offset_table);
+  DECL_ACCESSORS(wrapper_code, Code);
+  DECL_ACCESSORS(instance, WasmInstanceObject)
+  DECL_INT_ACCESSORS(function_index);
 
-  // Get the module name, if set. Returns an empty handle otherwise.
-  static MaybeHandle<String> GetModuleNameOrNull(Isolate*,
-                                                 Handle<WasmSharedModuleData>);
-
-  // Get the function name of the function identified by the given index.
-  // Returns a null handle if the function is unnamed or the name is not a valid
-  // UTF-8 string.
-  static MaybeHandle<String> GetFunctionNameOrNull(Isolate*,
-                                                   Handle<WasmSharedModuleData>,
-                                                   uint32_t func_index);
-
-  // Get the function name of the function identified by the given index.
-  // Returns "<WASM UNNAMED>" if the function is unnamed or the name is not a
-  // valid UTF-8 string.
-  static Handle<String> GetFunctionName(Isolate*, Handle<WasmSharedModuleData>,
-                                        uint32_t func_index);
-
-  // Get the raw bytes of the function name of the function identified by the
-  // given index.
-  // Meant to be used for debugging or frame printing.
-  // Does not allocate, hence gc-safe.
-  Vector<const uint8_t> GetRawFunctionName(uint32_t func_index);
-
-  // Return the byte offset of the function identified by the given index.
-  // The offset will be relative to the start of the module bytes.
-  // Returns -1 if the function index is invalid.
-  int GetFunctionOffset(uint32_t func_index);
-
-  // Returns the function containing the given byte offset.
-  // Returns -1 if the byte offset is not contained in any function of this
-  // module.
-  int GetContainingFunction(uint32_t byte_offset);
-
-  // Translate from byte offset in the module to function number and byte offset
-  // within that function, encoded as line and column in the position info.
-  // Returns true if the position is valid inside this module, false otherwise.
-  bool GetPositionInfo(uint32_t position, Script::PositionInfo* info);
-
-  // Get the source position from a given function index and byte offset,
-  // for either asm.js or pure WASM modules.
-  static int GetSourcePosition(Handle<WasmSharedModuleData>,
-                               uint32_t func_index, uint32_t byte_offset,
-                               bool is_at_number_conversion);
-
-  // Compute the disassembly of a wasm function.
-  // Returns the disassembly string and a list of <byte_offset, line, column>
-  // entries, mapping wasm byte offsets to line and column in the disassembly.
-  // The list is guaranteed to be ordered by the byte_offset.
-  // Returns an empty string and empty vector if the function index is invalid.
-  debug::WasmDisassembly DisassembleFunction(int func_index);
-
-  // Extract a portion of the wire bytes as UTF-8 string.
-  // Returns a null handle if the respective bytes do not form a valid UTF-8
-  // string.
-  static MaybeHandle<String> ExtractUtf8StringFromModuleBytes(
-      Isolate* isolate, Handle<WasmSharedModuleData>, wasm::WireBytesRef ref);
-  static MaybeHandle<String> ExtractUtf8StringFromModuleBytes(
-      Isolate* isolate, Handle<SeqOneByteString> module_bytes,
-      wasm::WireBytesRef ref);
-
-  // Get a list of all possible breakpoints within a given range of this module.
-  bool GetPossibleBreakpoints(const debug::Location& start,
-                              const debug::Location& end,
-                              std::vector<debug::BreakLocation>* locations);
-
-  // Return an empty handle if no breakpoint is hit at that location, or a
-  // FixedArray with all hit breakpoint objects.
-  static MaybeHandle<FixedArray> CheckBreakPoints(Isolate*,
-                                                  Handle<WasmSharedModuleData>,
-                                                  int position);
-};
-
-// This represents the set of wasm compiled functions, together
-// with all the information necessary for re-specializing them.
-class WasmCompiledModule : public Struct {
- public:
-  DECL_CAST(WasmCompiledModule)
+  DECL_CAST(WasmExportedFunctionData)
 
   // Dispatched behavior.
-  DECL_PRINTER(WasmCompiledModule)
-  DECL_VERIFIER(WasmCompiledModule)
+  DECL_PRINTER(WasmExportedFunctionData)
+  DECL_VERIFIER(WasmExportedFunctionData)
 
 // Layout description.
-#define WASM_COMPILED_MODULE_FIELDS(V)          \
-  V(kSharedOffset, kPointerSize)                \
-  V(kNativeContextOffset, kPointerSize)         \
-  V(kExportWrappersOffset, kPointerSize)        \
-  V(kNextInstanceOffset, kPointerSize)          \
-  V(kPrevInstanceOffset, kPointerSize)          \
-  V(kOwningInstanceOffset, kPointerSize)        \
-  V(kWasmModuleOffset, kPointerSize)            \
-  V(kNativeModuleOffset, kPointerSize)          \
-  V(kLazyCompileDataOffset, kPointerSize)       \
-  V(kUseTrapHandlerOffset, kPointerSize)        \
+#define WASM_EXPORTED_FUNCTION_DATA_FIELDS(V)     \
+  V(kWrapperCodeOffset, kPointerSize)             \
+  V(kInstanceOffset, kPointerSize)                \
+  V(kFunctionIndexOffset, kPointerSize) /* Smi */ \
   V(kSize, 0)
 
   DEFINE_FIELD_OFFSET_CONSTANTS(HeapObject::kHeaderSize,
-                                WASM_COMPILED_MODULE_FIELDS)
-#undef WASM_COMPILED_MODULE_FIELDS
-
-#define WCM_OBJECT_OR_WEAK(TYPE, NAME, SETTER_MODIFIER) \
- public:                                                \
-  inline TYPE* NAME() const;                            \
-  inline bool has_##NAME() const;                       \
-  inline void reset_##NAME();                           \
-                                                        \
-  SETTER_MODIFIER:                                      \
-  inline void set_##NAME(TYPE* value,                   \
-                         WriteBarrierMode mode = UPDATE_WRITE_BARRIER);
-
-#define WCM_OBJECT(TYPE, NAME) WCM_OBJECT_OR_WEAK(TYPE, NAME, public)
-
-#define WCM_CONST_OBJECT(TYPE, NAME) WCM_OBJECT_OR_WEAK(TYPE, NAME, private)
-
-#define WCM_SMALL_CONST_NUMBER(TYPE, NAME) \
- public:                                   \
-  inline TYPE NAME() const;                \
-                                           \
- private:                                  \
-  inline void set_##NAME(TYPE value);
-
-#define WCM_WEAK_LINK(TYPE, NAME)                   \
-  WCM_OBJECT_OR_WEAK(WeakCell, weak_##NAME, public) \
-                                                    \
- public:                                            \
-  inline TYPE* NAME() const;
-
-  // Add values here if they are required for creating new instances or
-  // for deserialization, and if they are serializable.
-  // By default, instance values go to WasmInstanceObject, however, if
-  // we embed the generated code with a value, then we track that value here.
-  WCM_OBJECT(WasmSharedModuleData, shared)
-  WCM_WEAK_LINK(Context, native_context)
-  WCM_OBJECT(FixedArray, export_wrappers)
-  WCM_CONST_OBJECT(WasmCompiledModule, next_instance)
-  WCM_CONST_OBJECT(WasmCompiledModule, prev_instance)
-  WCM_WEAK_LINK(WasmInstanceObject, owning_instance)
-  WCM_WEAK_LINK(WasmModuleObject, wasm_module)
-  WCM_OBJECT(Foreign, native_module)
-  // TODO(mstarzinger): Make {use_trap_handler} smaller.
-  WCM_SMALL_CONST_NUMBER(bool, use_trap_handler)
-
- public:
-  static Handle<WasmCompiledModule> New(
-      Isolate* isolate, wasm::WasmModule* module,
-      Handle<FixedArray> export_wrappers,
-      bool use_trap_hander);
-
-  static Handle<WasmCompiledModule> Clone(Isolate* isolate,
-                                          Handle<WasmCompiledModule> module);
-  static void Reset(Isolate* isolate, WasmCompiledModule* module);
-
-  bool has_instance() const;
-
-  wasm::NativeModule* GetNativeModule() const;
-  void InsertInChain(WasmModuleObject*);
-  void RemoveFromChain();
-
-  DECL_ACCESSORS(raw_next_instance, Object);
-  DECL_ACCESSORS(raw_prev_instance, Object);
-
-  void PrintInstancesChain();
-
-  static void ReinitializeAfterDeserialization(Isolate*,
-                                               Handle<WasmCompiledModule>);
-
-  // Set a breakpoint on the given byte position inside the given module.
-  // This will affect all live and future instances of the module.
-  // The passed position might be modified to point to the next breakable
-  // location inside the same function.
-  // If it points outside a function, or behind the last breakable location,
-  // this function returns false and does not set any breakpoint.
-  static bool SetBreakPoint(Handle<WasmCompiledModule>, int* position,
-                            Handle<BreakPoint> break_point);
-
-  void LogWasmCodes(Isolate* isolate);
-
- private:
-  DISALLOW_IMPLICIT_CONSTRUCTORS(WasmCompiledModule);
+                                WASM_EXPORTED_FUNCTION_DATA_FIELDS)
+#undef WASM_EXPORTED_FUNCTION_DATA_FIELDS
 };
 
 class WasmDebugInfo : public Struct {
@@ -644,15 +572,15 @@ class WasmDebugInfo : public Struct {
   // Returns true if exited regularly, false if a trap occurred. In the latter
   // case, a pending exception will have been set on the isolate.
   bool RunInterpreter(Address frame_pointer, int func_index,
-                      uint8_t* arg_buffer);
+                      Address arg_buffer);
 
   // Get the stack of the wasm interpreter as pairs of <function index, byte
   // offset>. The list is ordered bottom-to-top, i.e. caller before callee.
   std::vector<std::pair<uint32_t, int>> GetInterpretedStack(
       Address frame_pointer);
 
-  wasm::WasmInterpreter::FramePtr GetInterpretedFrame(Address frame_pointer,
-                                                      int frame_index);
+  std::unique_ptr<wasm::InterpretedFrame, wasm::InterpretedFrameDeleter>
+  GetInterpretedFrame(Address frame_pointer, int frame_index);
 
   // Unwind the interpreted stack belonging to the passed interpreter entry
   // frame.
@@ -683,16 +611,10 @@ class WasmDebugInfo : public Struct {
 };
 
 #undef DECL_OPTIONAL_ACCESSORS
-#undef WCM_CONST_OBJECT
-#undef WCM_LARGE_NUMBER
-#undef WCM_OBJECT
-#undef WCM_OBJECT_OR_WEAK
-#undef WCM_SMALL_CONST_NUMBER
-#undef WCM_WEAK_LINK
-
-#include "src/objects/object-macros-undef.h"
 
 }  // namespace internal
 }  // namespace v8
 
+#include "src/objects/object-macros-undef.h"
+
 #endif  // V8_WASM_WASM_OBJECTS_H_
diff --git a/deps/v8/src/wasm/wasm-opcodes.cc b/deps/v8/src/wasm/wasm-opcodes.cc
index 6e3b3e4daf3bc9..cd91fd92bb4da1 100644
--- a/deps/v8/src/wasm/wasm-opcodes.cc
+++ b/deps/v8/src/wasm/wasm-opcodes.cc
@@ -360,15 +360,16 @@ bool WasmOpcodes::IsAnyRefOpcode(WasmOpcode opcode) {
       return false;
   }
 }
+
 std::ostream& operator<<(std::ostream& os, const FunctionSig& sig) {
   if (sig.return_count() == 0) os << "v";
   for (auto ret : sig.returns()) {
-    os << WasmOpcodes::ShortNameOf(ret);
+    os << ValueTypes::ShortNameOf(ret);
   }
   os << "_";
   if (sig.parameter_count() == 0) os << "v";
   for (auto param : sig.parameters()) {
-    os << WasmOpcodes::ShortNameOf(param);
+    os << ValueTypes::ShortNameOf(param);
   }
   return os;
 }
@@ -398,7 +399,7 @@ FOREACH_SIGNATURE(DECLARE_SIG)
 #undef DECLARE_SIG
 
 #define DECLARE_SIG_ENTRY(name, ...) &kSig_##name,
-constexpr const FunctionSig* kSimpleExprSigs[] = {
+constexpr const FunctionSig* kCachedSigs[] = {
     nullptr, FOREACH_SIGNATURE(DECLARE_SIG_ENTRY)};
 #undef DECLARE_SIG_ENTRY
 
@@ -407,10 +408,11 @@ constexpr const FunctionSig* kSimpleExprSigs[] = {
 // encapsulate these constexpr functions in functors.
 // TODO(clemensh): Remove this once we require gcc >= 5.0.
 
-struct GetOpcodeSigIndex {
+struct GetShortOpcodeSigIndex {
   constexpr WasmOpcodeSig operator()(byte opcode) const {
 #define CASE(name, opc, sig) opcode == opc ? kSigEnum_##sig:
-    return FOREACH_SIMPLE_OPCODE(CASE) kSigEnum_None;
+    return FOREACH_SIMPLE_OPCODE(CASE) FOREACH_SIMPLE_PROTOTYPE_OPCODE(CASE)
+        kSigEnum_None;
 #undef CASE
   }
 };
@@ -426,7 +428,8 @@ struct GetAsmJsOpcodeSigIndex {
 struct GetSimdOpcodeSigIndex {
   constexpr WasmOpcodeSig operator()(byte opcode) const {
 #define CASE(name, opc, sig) opcode == (opc & 0xFF) ? kSigEnum_##sig:
-    return FOREACH_SIMD_0_OPERAND_OPCODE(CASE) kSigEnum_None;
+    return FOREACH_SIMD_0_OPERAND_OPCODE(CASE) FOREACH_SIMD_MEM_OPCODE(CASE)
+        kSigEnum_None;
 #undef CASE
   }
 };
@@ -447,8 +450,8 @@ struct GetNumericOpcodeSigIndex {
   }
 };
 
-constexpr std::array<WasmOpcodeSig, 256> kSimpleExprSigTable =
-    base::make_array<256>(GetOpcodeSigIndex{});
+constexpr std::array<WasmOpcodeSig, 256> kShortSigTable =
+    base::make_array<256>(GetShortOpcodeSigIndex{});
 constexpr std::array<WasmOpcodeSig, 256> kSimpleAsmjsExprSigTable =
     base::make_array<256>(GetAsmJsOpcodeSigIndex{});
 constexpr std::array<WasmOpcodeSig, 256> kSimdExprSigTable =
@@ -458,30 +461,43 @@ constexpr std::array<WasmOpcodeSig, 256> kAtomicExprSigTable =
 constexpr std::array<WasmOpcodeSig, 256> kNumericExprSigTable =
     base::make_array<256>(GetNumericOpcodeSigIndex{});
 
+// Computes a direct pointer to a cached signature for a simple opcode.
+struct GetSimpleOpcodeSig {
+  constexpr const FunctionSig* operator()(byte opcode) const {
+#define CASE(name, opc, sig) opcode == opc ? &kSig_##sig:
+    return FOREACH_SIMPLE_OPCODE(CASE) nullptr;
+#undef CASE
+  }
+};
+
 }  // namespace
 
+const std::array<const FunctionSig*, 256> kSimpleOpcodeSigs =
+    base::make_array<256>(GetSimpleOpcodeSig{});
+
 FunctionSig* WasmOpcodes::Signature(WasmOpcode opcode) {
   switch (opcode >> 8) {
+    case 0:
+      return const_cast<FunctionSig*>(kCachedSigs[kShortSigTable[opcode]]);
     case kSimdPrefix:
       return const_cast<FunctionSig*>(
-          kSimpleExprSigs[kSimdExprSigTable[opcode & 0xFF]]);
+          kCachedSigs[kSimdExprSigTable[opcode & 0xFF]]);
     case kAtomicPrefix:
       return const_cast<FunctionSig*>(
-          kSimpleExprSigs[kAtomicExprSigTable[opcode & 0xFF]]);
+          kCachedSigs[kAtomicExprSigTable[opcode & 0xFF]]);
     case kNumericPrefix:
       return const_cast<FunctionSig*>(
-          kSimpleExprSigs[kNumericExprSigTable[opcode & 0xFF]]);
+          kCachedSigs[kNumericExprSigTable[opcode & 0xFF]]);
     default:
-      DCHECK_GT(kSimpleExprSigTable.size(), opcode);
-      return const_cast<FunctionSig*>(
-          kSimpleExprSigs[kSimpleExprSigTable[opcode]]);
+      UNREACHABLE();  // invalid prefix.
+      return nullptr;
   }
 }
 
 FunctionSig* WasmOpcodes::AsmjsSignature(WasmOpcode opcode) {
   DCHECK_GT(kSimpleAsmjsExprSigTable.size(), opcode);
   return const_cast<FunctionSig*>(
-      kSimpleExprSigs[kSimpleAsmjsExprSigTable[opcode]]);
+      kCachedSigs[kSimpleAsmjsExprSigTable[opcode]]);
 }
 
 // Define constexpr arrays.
diff --git a/deps/v8/src/wasm/wasm-opcodes.h b/deps/v8/src/wasm/wasm-opcodes.h
index daf3481daf54cb..f074cad11d36e5 100644
--- a/deps/v8/src/wasm/wasm-opcodes.h
+++ b/deps/v8/src/wasm/wasm-opcodes.h
@@ -6,26 +6,17 @@
 #define V8_WASM_WASM_OPCODES_H_
 
 #include "src/globals.h"
-#include "src/machine-type.h"
-#include "src/runtime/runtime.h"
-#include "src/signature.h"
+#include "src/vector.h"
+#include "src/wasm/value-type.h"
 #include "src/wasm/wasm-constants.h"
 
 namespace v8 {
 namespace internal {
-namespace wasm {
 
-// We reuse the internal machine type to represent WebAssembly types.
-// A typedef improves readability without adding a whole new type system.
-using ValueType = MachineRepresentation;
-constexpr ValueType kWasmStmt = MachineRepresentation::kNone;
-constexpr ValueType kWasmI32 = MachineRepresentation::kWord32;
-constexpr ValueType kWasmI64 = MachineRepresentation::kWord64;
-constexpr ValueType kWasmF32 = MachineRepresentation::kFloat32;
-constexpr ValueType kWasmF64 = MachineRepresentation::kFloat64;
-constexpr ValueType kWasmS128 = MachineRepresentation::kSimd128;
-constexpr ValueType kWasmAnyRef = MachineRepresentation::kTaggedPointer;
-constexpr ValueType kWasmVar = MachineRepresentation::kTagged;
+template <typename T>
+class Signature;
+
+namespace wasm {
 
 using FunctionSig = Signature<ValueType>;
 std::ostream& operator<<(std::ostream& os, const FunctionSig& function);
@@ -227,13 +218,15 @@ using WasmName = Vector<const char>;
   V(I32ReinterpretF32, 0xbc, i_f) \
   V(I64ReinterpretF64, 0xbd, l_d) \
   V(F32ReinterpretI32, 0xbe, f_i) \
-  V(F64ReinterpretI64, 0xbf, d_l) \
-  V(I32SExtendI8, 0xc0, i_i)      \
-  V(I32SExtendI16, 0xc1, i_i)     \
-  V(I64SExtendI8, 0xc2, l_l)      \
-  V(I64SExtendI16, 0xc3, l_l)     \
-  V(I64SExtendI32, 0xc4, l_l)     \
-  V(RefIsNull, 0xd1, i_r)         \
+  V(F64ReinterpretI64, 0xbf, d_l)
+
+#define FOREACH_SIMPLE_PROTOTYPE_OPCODE(V) \
+  V(I32SExtendI8, 0xc0, i_i)               \
+  V(I32SExtendI16, 0xc1, i_i)              \
+  V(I64SExtendI8, 0xc2, l_l)               \
+  V(I64SExtendI16, 0xc3, l_l)              \
+  V(I64SExtendI32, 0xc4, l_l)              \
+  V(RefIsNull, 0xd1, i_r)                  \
   V(RefEq, 0xd2, i_rr)
 
 // For compatibility with Asm.js.
@@ -383,25 +376,31 @@ using WasmName = Vector<const char>;
   V(S1x16AnyTrue, 0xfd90, i_s)           \
   V(S1x16AllTrue, 0xfd91, i_s)
 
-#define FOREACH_SIMD_1_OPERAND_OPCODE(V) \
-  V(F32x4ExtractLane, 0xfd01, _)         \
-  V(F32x4ReplaceLane, 0xfd02, _)         \
-  V(I32x4ExtractLane, 0xfd1c, _)         \
-  V(I32x4ReplaceLane, 0xfd1d, _)         \
-  V(I32x4Shl, 0xfd24, _)                 \
-  V(I32x4ShrS, 0xfd25, _)                \
-  V(I32x4ShrU, 0xfd32, _)                \
-  V(I16x8ExtractLane, 0xfd39, _)         \
-  V(I16x8ReplaceLane, 0xfd3a, _)         \
-  V(I16x8Shl, 0xfd43, _)                 \
-  V(I16x8ShrS, 0xfd44, _)                \
-  V(I16x8ShrU, 0xfd52, _)                \
-  V(I8x16ExtractLane, 0xfd58, _)         \
-  V(I8x16ReplaceLane, 0xfd59, _)         \
-  V(I8x16Shl, 0xfd62, _)                 \
-  V(I8x16ShrS, 0xfd63, _)                \
+#define FOREACH_SIMD_1_OPERAND_1_PARAM_OPCODE(V) \
+  V(F32x4ExtractLane, 0xfd01, _)                 \
+  V(I32x4ExtractLane, 0xfd1c, _)                 \
+  V(I32x4Shl, 0xfd24, _)                         \
+  V(I32x4ShrS, 0xfd25, _)                        \
+  V(I32x4ShrU, 0xfd32, _)                        \
+  V(I16x8ExtractLane, 0xfd39, _)                 \
+  V(I16x8Shl, 0xfd43, _)                         \
+  V(I16x8ShrS, 0xfd44, _)                        \
+  V(I16x8ShrU, 0xfd52, _)                        \
+  V(I8x16ExtractLane, 0xfd58, _)                 \
+  V(I8x16Shl, 0xfd62, _)                         \
+  V(I8x16ShrS, 0xfd63, _)                        \
   V(I8x16ShrU, 0xfd71, _)
 
+#define FOREACH_SIMD_1_OPERAND_2_PARAM_OPCODE(V) \
+  V(F32x4ReplaceLane, 0xfd02, _)                 \
+  V(I32x4ReplaceLane, 0xfd1d, _)                 \
+  V(I16x8ReplaceLane, 0xfd3a, _)                 \
+  V(I8x16ReplaceLane, 0xfd59, _)
+
+#define FOREACH_SIMD_1_OPERAND_OPCODE(V)   \
+  FOREACH_SIMD_1_OPERAND_1_PARAM_OPCODE(V) \
+  FOREACH_SIMD_1_OPERAND_2_PARAM_OPCODE(V)
+
 #define FOREACH_SIMD_MASK_OPERAND_OPCODE(V) V(S8x16Shuffle, 0xfd6b, s_ss)
 
 #define FOREACH_SIMD_MEM_OPCODE(V) \
@@ -488,6 +487,7 @@ using WasmName = Vector<const char>;
   FOREACH_CONTROL_OPCODE(V)           \
   FOREACH_MISC_OPCODE(V)              \
   FOREACH_SIMPLE_OPCODE(V)            \
+  FOREACH_SIMPLE_PROTOTYPE_OPCODE(V)  \
   FOREACH_STORE_MEM_OPCODE(V)         \
   FOREACH_LOAD_MEM_OPCODE(V)          \
   FOREACH_MISC_MEM_OPCODE(V)          \
@@ -545,6 +545,7 @@ using WasmName = Vector<const char>;
   V(s_i, kWasmS128, kWasmI32)              \
   V(s_si, kWasmS128, kWasmS128, kWasmI32)  \
   V(i_s, kWasmI32, kWasmS128)              \
+  V(v_is, kWasmStmt, kWasmI32, kWasmS128)  \
   V(s_sss, kWasmS128, kWasmS128, kWasmS128, kWasmS128)
 
 #define FOREACH_PREFIX(V) \
@@ -562,17 +563,6 @@ enum WasmOpcode {
 #undef DECLARE_PREFIX
 };
 
-// The reason for a trap.
-#define FOREACH_WASM_TRAPREASON(V) \
-  V(TrapUnreachable)               \
-  V(TrapMemOutOfBounds)            \
-  V(TrapDivByZero)                 \
-  V(TrapDivUnrepresentable)        \
-  V(TrapRemByZero)                 \
-  V(TrapFloatUnrepresentable)      \
-  V(TrapFuncInvalid)               \
-  V(TrapFuncSigMismatch)
-
 enum TrapReason {
 #define DECLARE_ENUM(name) k##name,
   FOREACH_WASM_TRAPREASON(DECLARE_ENUM)
@@ -580,146 +570,7 @@ enum TrapReason {
 #undef DECLARE_ENUM
 };
 
-// TODO(clemensh): Compute memtype and size from ValueType once we have c++14
-// constexpr support.
-#define FOREACH_LOAD_TYPE(V) \
-  V(I32, , Int32, 2)         \
-  V(I32, 8S, Int8, 0)        \
-  V(I32, 8U, Uint8, 0)       \
-  V(I32, 16S, Int16, 1)      \
-  V(I32, 16U, Uint16, 1)     \
-  V(I64, , Int64, 3)         \
-  V(I64, 8S, Int8, 0)        \
-  V(I64, 8U, Uint8, 0)       \
-  V(I64, 16S, Int16, 1)      \
-  V(I64, 16U, Uint16, 1)     \
-  V(I64, 32S, Int32, 2)      \
-  V(I64, 32U, Uint32, 2)     \
-  V(F32, , Float32, 2)       \
-  V(F64, , Float64, 3)       \
-  V(S128, , Simd128, 4)
-
-class LoadType {
- public:
-  enum LoadTypeValue : uint8_t {
-#define DEF_ENUM(type, suffix, ...) k##type##Load##suffix,
-    FOREACH_LOAD_TYPE(DEF_ENUM)
-#undef DEF_ENUM
-  };
-
-  // Allow implicit convertion of the enum value to this wrapper.
-  constexpr LoadType(LoadTypeValue val)  // NOLINT(runtime/explicit)
-      : val_(val) {}
-
-  constexpr LoadTypeValue value() const { return val_; }
-  constexpr unsigned size_log_2() const { return kLoadSizeLog2[val_]; }
-  constexpr unsigned size() const { return 1 << size_log_2(); }
-  constexpr ValueType value_type() const { return kValueType[val_]; }
-  constexpr MachineType mem_type() const { return kMemType[val_]; }
-
-  static LoadType ForValueType(ValueType type) {
-    switch (type) {
-      case kWasmI32:
-        return kI32Load;
-      case kWasmI64:
-        return kI64Load;
-      case kWasmF32:
-        return kF32Load;
-      case kWasmF64:
-        return kF64Load;
-      default:
-        UNREACHABLE();
-    }
-  }
-
- private:
-  const LoadTypeValue val_;
-
-  static constexpr uint8_t kLoadSizeLog2[] = {
-#define LOAD_SIZE(_, __, ___, size) size,
-      FOREACH_LOAD_TYPE(LOAD_SIZE)
-#undef LOAD_SIZE
-  };
-
-  static constexpr ValueType kValueType[] = {
-#define VALUE_TYPE(type, ...) kWasm##type,
-      FOREACH_LOAD_TYPE(VALUE_TYPE)
-#undef VALUE_TYPE
-  };
-
-  static constexpr MachineType kMemType[] = {
-#define MEMTYPE(_, __, memtype, ___) MachineType::memtype(),
-      FOREACH_LOAD_TYPE(MEMTYPE)
-#undef MEMTYPE
-  };
-};
-
-#define FOREACH_STORE_TYPE(V) \
-  V(I32, , Word32, 2)         \
-  V(I32, 8, Word8, 0)         \
-  V(I32, 16, Word16, 1)       \
-  V(I64, , Word64, 3)         \
-  V(I64, 8, Word8, 0)         \
-  V(I64, 16, Word16, 1)       \
-  V(I64, 32, Word32, 2)       \
-  V(F32, , Float32, 2)        \
-  V(F64, , Float64, 3)        \
-  V(S128, , Simd128, 4)
-
-class StoreType {
- public:
-  enum StoreTypeValue : uint8_t {
-#define DEF_ENUM(type, suffix, ...) k##type##Store##suffix,
-    FOREACH_STORE_TYPE(DEF_ENUM)
-#undef DEF_ENUM
-  };
-
-  // Allow implicit convertion of the enum value to this wrapper.
-  constexpr StoreType(StoreTypeValue val)  // NOLINT(runtime/explicit)
-      : val_(val) {}
-
-  constexpr StoreTypeValue value() const { return val_; }
-  constexpr unsigned size_log_2() const { return kStoreSizeLog2[val_]; }
-  constexpr unsigned size() const { return 1 << size_log_2(); }
-  constexpr ValueType value_type() const { return kValueType[val_]; }
-  constexpr ValueType mem_rep() const { return kMemRep[val_]; }
-
-  static StoreType ForValueType(ValueType type) {
-    switch (type) {
-      case kWasmI32:
-        return kI32Store;
-      case kWasmI64:
-        return kI64Store;
-      case kWasmF32:
-        return kF32Store;
-      case kWasmF64:
-        return kF64Store;
-      default:
-        UNREACHABLE();
-    }
-  }
-
- private:
-  const StoreTypeValue val_;
-
-  static constexpr uint8_t kStoreSizeLog2[] = {
-#define STORE_SIZE(_, __, ___, size) size,
-      FOREACH_STORE_TYPE(STORE_SIZE)
-#undef STORE_SIZE
-  };
-
-  static constexpr ValueType kValueType[] = {
-#define VALUE_TYPE(type, ...) kWasm##type,
-      FOREACH_STORE_TYPE(VALUE_TYPE)
-#undef VALUE_TYPE
-  };
-
-  static constexpr MachineRepresentation kMemRep[] = {
-#define MEMREP(_, __, memrep, ___) MachineRepresentation::k##memrep,
-      FOREACH_STORE_TYPE(MEMREP)
-#undef MEMREP
-  };
-};
+extern const std::array<const FunctionSig*, 256> kSimpleOpcodeSigs;
 
 // A collection of opcode-related static methods.
 class V8_EXPORT_PRIVATE WasmOpcodes {
@@ -737,121 +588,6 @@ class V8_EXPORT_PRIVATE WasmOpcodes {
 
   static int TrapReasonToMessageId(TrapReason reason);
   static const char* TrapReasonMessage(TrapReason reason);
-
-  static byte MemSize(MachineType type) {
-    return MemSize(type.representation());
-  }
-
-  static byte MemSize(ValueType type) { return 1 << ElementSizeLog2Of(type); }
-
-  static ValueTypeCode ValueTypeCodeFor(ValueType type) {
-    switch (type) {
-      case kWasmI32:
-        return kLocalI32;
-      case kWasmI64:
-        return kLocalI64;
-      case kWasmF32:
-        return kLocalF32;
-      case kWasmF64:
-        return kLocalF64;
-      case kWasmS128:
-        return kLocalS128;
-      case kWasmAnyRef:
-        return kLocalAnyRef;
-      case kWasmStmt:
-        return kLocalVoid;
-      default:
-        UNREACHABLE();
-    }
-  }
-
-  static MachineType MachineTypeFor(ValueType type) {
-    switch (type) {
-      case kWasmI32:
-        return MachineType::Int32();
-      case kWasmI64:
-        return MachineType::Int64();
-      case kWasmF32:
-        return MachineType::Float32();
-      case kWasmF64:
-        return MachineType::Float64();
-      case kWasmAnyRef:
-        return MachineType::TaggedPointer();
-      case kWasmS128:
-        return MachineType::Simd128();
-      case kWasmStmt:
-        return MachineType::None();
-      default:
-        UNREACHABLE();
-    }
-  }
-
-  static ValueType ValueTypeFor(MachineType type) {
-    switch (type.representation()) {
-      case MachineRepresentation::kWord8:
-      case MachineRepresentation::kWord16:
-      case MachineRepresentation::kWord32:
-        return kWasmI32;
-      case MachineRepresentation::kWord64:
-        return kWasmI64;
-      case MachineRepresentation::kFloat32:
-        return kWasmF32;
-      case MachineRepresentation::kFloat64:
-        return kWasmF64;
-      case MachineRepresentation::kTaggedPointer:
-        return kWasmAnyRef;
-      case MachineRepresentation::kSimd128:
-        return kWasmS128;
-      default:
-        UNREACHABLE();
-    }
-  }
-
-  static char ShortNameOf(ValueType type) {
-    switch (type) {
-      case kWasmI32:
-        return 'i';
-      case kWasmI64:
-        return 'l';
-      case kWasmF32:
-        return 'f';
-      case kWasmF64:
-        return 'd';
-      case kWasmAnyRef:
-        return 'r';
-      case kWasmS128:
-        return 's';
-      case kWasmStmt:
-        return 'v';
-      case kWasmVar:
-        return '*';
-      default:
-        return '?';
-    }
-  }
-
-  static const char* TypeName(ValueType type) {
-    switch (type) {
-      case kWasmI32:
-        return "i32";
-      case kWasmI64:
-        return "i64";
-      case kWasmF32:
-        return "f32";
-      case kWasmF64:
-        return "f64";
-      case kWasmAnyRef:
-        return "ref";
-      case kWasmS128:
-        return "s128";
-      case kWasmStmt:
-        return "<stmt>";
-      case kWasmVar:
-        return "<var>";
-      default:
-        return "<unknown>";
-    }
-  }
 };
 
 // Representation of an initializer expression.
diff --git a/deps/v8/src/wasm/wasm-serialization.cc b/deps/v8/src/wasm/wasm-serialization.cc
index a069823194607b..3c21a5d223726f 100644
--- a/deps/v8/src/wasm/wasm-serialization.cc
+++ b/deps/v8/src/wasm/wasm-serialization.cc
@@ -5,7 +5,6 @@
 #include "src/wasm/wasm-serialization.h"
 
 #include "src/assembler-inl.h"
-#include "src/code-stubs.h"
 #include "src/external-reference-table.h"
 #include "src/objects-inl.h"
 #include "src/objects.h"
@@ -13,6 +12,7 @@
 #include "src/snapshot/serializer-common.h"
 #include "src/utils.h"
 #include "src/version.h"
+#include "src/wasm/function-compiler.h"
 #include "src/wasm/module-compiler.h"
 #include "src/wasm/module-decoder.h"
 #include "src/wasm/wasm-code-manager.h"
@@ -27,112 +27,138 @@ namespace wasm {
 
 namespace {
 
+// TODO(bbudge) Try to unify the various implementations of readers and writers
+// in WASM, e.g. StreamProcessor and ZoneBuffer, with these.
 class Writer {
  public:
-  explicit Writer(Vector<byte> buffer) : buffer_(buffer) {}
+  explicit Writer(Vector<byte> buffer)
+      : start_(buffer.start()), end_(buffer.end()), pos_(buffer.start()) {}
+
+  size_t bytes_written() const { return pos_ - start_; }
+  byte* current_location() const { return pos_; }
+  size_t current_size() const { return end_ - pos_; }
+  Vector<byte> current_buffer() const {
+    return {current_location(), current_size()};
+  }
+
   template <typename T>
   void Write(const T& value) {
+    DCHECK_GE(current_size(), sizeof(T));
+    WriteUnalignedValue(reinterpret_cast<Address>(current_location()), value);
+    pos_ += sizeof(T);
     if (FLAG_wasm_trace_serialization) {
-      OFStream os(stdout);
-      os << "wrote: " << (size_t)value << " sized: " << sizeof(T) << std::endl;
+      StdoutStream{} << "wrote: " << (size_t)value << " sized: " << sizeof(T)
+                     << std::endl;
     }
-    DCHECK_GE(buffer_.size(), sizeof(T));
-    WriteUnalignedValue(buffer_.start(), value);
-    buffer_ = buffer_ + sizeof(T);
   }
 
-  void WriteVector(const Vector<const byte> data) {
-    DCHECK_GE(buffer_.size(), data.size());
-    if (data.size() > 0) {
-      memcpy(buffer_.start(), data.start(), data.size());
-      buffer_ = buffer_ + data.size();
+  void WriteVector(const Vector<const byte> v) {
+    DCHECK_GE(current_size(), v.size());
+    if (v.size() > 0) {
+      memcpy(current_location(), v.start(), v.size());
+      pos_ += v.size();
     }
     if (FLAG_wasm_trace_serialization) {
-      OFStream os(stdout);
-      os << "wrote vector of " << data.size() << " elements" << std::endl;
+      StdoutStream{} << "wrote vector of " << v.size() << " elements"
+                     << std::endl;
     }
   }
-  Vector<byte> current_buffer() const { return buffer_; }
+
+  void Skip(size_t size) { pos_ += size; }
 
  private:
-  Vector<byte> buffer_;
+  byte* const start_;
+  byte* const end_;
+  byte* pos_;
 };
 
 class Reader {
  public:
-  explicit Reader(Vector<const byte> buffer) : buffer_(buffer) {}
+  explicit Reader(Vector<const byte> buffer)
+      : start_(buffer.start()), end_(buffer.end()), pos_(buffer.start()) {}
+
+  size_t bytes_read() const { return pos_ - start_; }
+  const byte* current_location() const { return pos_; }
+  size_t current_size() const { return end_ - pos_; }
+  Vector<const byte> current_buffer() const {
+    return {current_location(), current_size()};
+  }
 
   template <typename T>
   T Read() {
-    DCHECK_GE(buffer_.size(), sizeof(T));
-    T ret = ReadUnalignedValue<T>(buffer_.start());
-    buffer_ = buffer_ + sizeof(T);
+    DCHECK_GE(current_size(), sizeof(T));
+    T value =
+        ReadUnalignedValue<T>(reinterpret_cast<Address>(current_location()));
+    pos_ += sizeof(T);
     if (FLAG_wasm_trace_serialization) {
-      OFStream os(stdout);
-      os << "read: " << (size_t)ret << " sized: " << sizeof(T) << std::endl;
+      StdoutStream{} << "read: " << (size_t)value << " sized: " << sizeof(T)
+                     << std::endl;
     }
-    return ret;
+    return value;
   }
 
-  Vector<const byte> GetSubvector(size_t size) {
-    Vector<const byte> ret = {buffer_.start(), size};
-    buffer_ = buffer_ + size;
-    return ret;
-  }
-
-  void ReadIntoVector(const Vector<byte> data) {
-    if (data.size() > 0) {
-      DCHECK_GE(buffer_.size(), data.size());
-      memcpy(data.start(), buffer_.start(), data.size());
-      buffer_ = buffer_ + data.size();
+  void ReadVector(Vector<byte> v) {
+    if (v.size() > 0) {
+      DCHECK_GE(current_size(), v.size());
+      memcpy(v.start(), current_location(), v.size());
+      pos_ += v.size();
     }
     if (FLAG_wasm_trace_serialization) {
-      OFStream os(stdout);
-      os << "read vector of " << data.size() << " elements" << std::endl;
+      StdoutStream{} << "read vector of " << v.size() << " elements"
+                     << std::endl;
     }
   }
 
-  Vector<const byte> current_buffer() const { return buffer_; }
+  void Skip(size_t size) { pos_ += size; }
 
  private:
-  Vector<const byte> buffer_;
+  const byte* const start_;
+  const byte* const end_;
+  const byte* pos_;
 };
 
 constexpr size_t kVersionSize = 4 * sizeof(uint32_t);
 
-// Start from 1 so an encoded stub id is not confused with an encoded builtin.
-constexpr int kFirstStubId = 1;
-
-void WriteVersion(Isolate* isolate, Vector<byte> buffer) {
-  DCHECK_GE(buffer.size(), kVersionSize);
-  Writer writer(buffer);
-  writer.Write(SerializedData::ComputeMagicNumber(
+void WriteVersion(Isolate* isolate, Writer* writer) {
+  writer->Write(SerializedData::ComputeMagicNumber(
       isolate->heap()->external_reference_table()));
-  writer.Write(Version::Hash());
-  writer.Write(static_cast<uint32_t>(CpuFeatures::SupportedFeatures()));
-  writer.Write(FlagList::Hash());
+  writer->Write(Version::Hash());
+  writer->Write(static_cast<uint32_t>(CpuFeatures::SupportedFeatures()));
+  writer->Write(FlagList::Hash());
 }
 
-bool IsSupportedVersion(Isolate* isolate, const Vector<const byte> buffer) {
-  if (buffer.size() < kVersionSize) return false;
-  byte version[kVersionSize];
-  WriteVersion(isolate, {version, kVersionSize});
-  if (memcmp(buffer.start(), version, kVersionSize) == 0) return true;
-  return false;
+bool IsSupportedVersion(Isolate* isolate, const Vector<const byte> version) {
+  if (version.size() < kVersionSize) return false;
+  byte current_version[kVersionSize];
+  Writer writer({current_version, kVersionSize});
+  WriteVersion(isolate, &writer);
+  return memcmp(version.start(), current_version, kVersionSize) == 0;
 }
 
-// On Intel, call sites are encoded as a displacement. For linking
-// and for serialization/deserialization, we want to store/retrieve
-// a tag (the function index). On Intel, that means accessing the
-// raw displacement. Everywhere else, that simply means accessing
-// the target address.
+// On Intel, call sites are encoded as a displacement. For linking and for
+// serialization/deserialization, we want to store/retrieve a tag (the function
+// index). On Intel, that means accessing the raw displacement.
+// On ARM64, call sites are encoded as either a literal load or a direct branch.
+// Other platforms simply require accessing the target address.
 void SetWasmCalleeTag(RelocInfo* rinfo, uint32_t tag) {
 #if V8_TARGET_ARCH_X64 || V8_TARGET_ARCH_IA32
   *(reinterpret_cast<uint32_t*>(rinfo->target_address_address())) = tag;
+#elif V8_TARGET_ARCH_ARM64
+  Instruction* instr = reinterpret_cast<Instruction*>(rinfo->pc());
+  if (instr->IsLdrLiteralX()) {
+    Memory::Address_at(rinfo->constant_pool_entry_address()) =
+        static_cast<Address>(tag);
+  } else {
+    DCHECK(instr->IsBranchAndLink() || instr->IsUnconditionalBranch());
+    instr->SetBranchImmTarget(
+        reinterpret_cast<Instruction*>(rinfo->pc() + tag * kInstructionSize));
+  }
 #else
-  Address addr = reinterpret_cast<Address>(tag);
+  Address addr = static_cast<Address>(tag);
   if (rinfo->rmode() == RelocInfo::EXTERNAL_REFERENCE) {
     rinfo->set_target_external_reference(addr, SKIP_ICACHE_FLUSH);
+  } else if (rinfo->rmode() == RelocInfo::WASM_STUB_CALL) {
+    rinfo->set_wasm_stub_call_address(addr, SKIP_ICACHE_FLUSH);
   } else {
     rinfo->set_target_address(addr, SKIP_WRITE_BARRIER, SKIP_ICACHE_FLUSH);
   }
@@ -142,261 +168,176 @@ void SetWasmCalleeTag(RelocInfo* rinfo, uint32_t tag) {
 uint32_t GetWasmCalleeTag(RelocInfo* rinfo) {
 #if V8_TARGET_ARCH_X64 || V8_TARGET_ARCH_IA32
   return *(reinterpret_cast<uint32_t*>(rinfo->target_address_address()));
+#elif V8_TARGET_ARCH_ARM64
+  Instruction* instr = reinterpret_cast<Instruction*>(rinfo->pc());
+  if (instr->IsLdrLiteralX()) {
+    return static_cast<uint32_t>(
+        Memory::Address_at(rinfo->constant_pool_entry_address()));
+  } else {
+    DCHECK(instr->IsBranchAndLink() || instr->IsUnconditionalBranch());
+    return static_cast<uint32_t>(instr->ImmPCOffset() / kInstructionSize);
+  }
 #else
-  Address addr = rinfo->rmode() == RelocInfo::EXTERNAL_REFERENCE
-                     ? rinfo->target_external_reference()
-                     : rinfo->target_address();
-  return static_cast<uint32_t>(reinterpret_cast<size_t>(addr));
+  Address addr;
+  if (rinfo->rmode() == RelocInfo::EXTERNAL_REFERENCE) {
+    addr = rinfo->target_external_reference();
+  } else if (rinfo->rmode() == RelocInfo::WASM_STUB_CALL) {
+    addr = rinfo->wasm_stub_call_address();
+  } else {
+    addr = rinfo->target_address();
+  }
+  return static_cast<uint32_t>(addr);
 #endif
 }
 
-}  // namespace
+constexpr size_t kHeaderSize =
+    sizeof(uint32_t) +  // total wasm function count
+    sizeof(uint32_t);   // imported functions (index of first wasm function)
+
+constexpr size_t kCodeHeaderSize =
+    sizeof(size_t) +         // size of code section
+    sizeof(size_t) +         // offset of constant pool
+    sizeof(size_t) +         // offset of safepoint table
+    sizeof(size_t) +         // offset of handler table
+    sizeof(uint32_t) +       // stack slots
+    sizeof(size_t) +         // code size
+    sizeof(size_t) +         // reloc size
+    sizeof(size_t) +         // source positions size
+    sizeof(size_t) +         // protected instructions size
+    sizeof(WasmCode::Tier);  // tier
 
-enum SerializationSection { Init, Metadata, Stubs, CodeSection, Done };
+}  // namespace
 
 class V8_EXPORT_PRIVATE NativeModuleSerializer {
  public:
-  explicit NativeModuleSerializer(Isolate*, const NativeModule*);
+  NativeModuleSerializer() = delete;
+  NativeModuleSerializer(Isolate*, const NativeModule*);
+
   size_t Measure() const;
-  size_t Write(Vector<byte>);
-  bool IsDone() const { return state_ == Done; }
+  bool Write(Writer* writer);
 
  private:
-  size_t MeasureHeader() const;
-  static size_t GetCodeHeaderSize();
   size_t MeasureCode(const WasmCode*) const;
-  size_t MeasureCopiedStubs() const;
-
-  void BufferHeader();
-  // we buffer all the stubs because they are small
-  void BufferCopiedStubs();
-  void BufferCodeInAllocatedScratch(const WasmCode*);
-  void BufferCurrentWasmCode();
-  size_t DrainBuffer(Vector<byte> dest);
-  uint32_t EncodeBuiltinOrStub(Address);
-
-  Isolate* const isolate_ = nullptr;
-  const NativeModule* const native_module_ = nullptr;
-  SerializationSection state_ = Init;
-  uint32_t index_ = 0;
-  std::vector<byte> scratch_;
-  Vector<byte> remaining_;
-  // wasm and copied stubs reverse lookup
-  std::map<Address, uint32_t> wasm_targets_lookup_;
-  // immovable builtins and runtime entries lookup
-  std::map<Address, uint32_t> reference_table_lookup_;
-  std::map<Address, uint32_t> stub_lookup_;
-  std::map<Address, uint32_t> builtin_lookup_;
-};
+  void WriteHeader(Writer* writer);
+  void WriteCode(const WasmCode*, Writer* writer);
 
-class V8_EXPORT_PRIVATE NativeModuleDeserializer {
- public:
-  explicit NativeModuleDeserializer(Isolate*, NativeModule*);
-  // Currently, we don't support streamed reading, yet albeit the
-  // API suggests that.
-  bool Read(Vector<const byte>);
+  Isolate* const isolate_;
+  const NativeModule* const native_module_;
+  bool write_called_;
 
- private:
-  void ExpectHeader();
-  void Expect(size_t size);
-  bool ReadHeader();
-  bool ReadCode();
-  bool ReadStubs();
-  Address GetTrampolineOrStubFromTag(uint32_t);
-
-  Isolate* const isolate_ = nullptr;
-  NativeModule* const native_module_ = nullptr;
-  std::vector<byte> scratch_;
-  std::vector<Address> stubs_;
-  Vector<const byte> unread_;
-  size_t current_expectation_ = 0;
-  uint32_t index_ = 0;
+  // Reverse lookup tables for embedded addresses.
+  std::map<Address, uint32_t> wasm_stub_targets_lookup_;
+  std::map<Address, uint32_t> reference_table_lookup_;
+
+  DISALLOW_COPY_AND_ASSIGN(NativeModuleSerializer);
 };
 
 NativeModuleSerializer::NativeModuleSerializer(Isolate* isolate,
                                                const NativeModule* module)
-    : isolate_(isolate), native_module_(module) {
+    : isolate_(isolate), native_module_(module), write_called_(false) {
   DCHECK_NOT_NULL(isolate_);
   DCHECK_NOT_NULL(native_module_);
   // TODO(mtrofin): persist the export wrappers. Ideally, we'd only persist
   // the unique ones, i.e. the cache.
+  for (uint32_t i = 0; i < WasmCode::kRuntimeStubCount; ++i) {
+    Address addr =
+        native_module_->runtime_stub(static_cast<WasmCode::RuntimeStubId>(i))
+            ->instruction_start();
+    wasm_stub_targets_lookup_.insert(std::make_pair(addr, i));
+  }
   ExternalReferenceTable* table = isolate_->heap()->external_reference_table();
   for (uint32_t i = 0; i < table->size(); ++i) {
     Address addr = table->address(i);
     reference_table_lookup_.insert(std::make_pair(addr, i));
   }
-  // defer populating the stub_lookup_ to when we buffer the stubs
-  for (auto pair : native_module_->trampolines_) {
-    v8::internal::Code* code = Code::GetCodeFromTargetAddress(pair.first);
-    int builtin_index = code->builtin_index();
-    if (builtin_index >= 0) {
-      uint32_t tag = static_cast<uint32_t>(builtin_index);
-      builtin_lookup_.insert(std::make_pair(pair.second, tag));
-    }
-  }
-  BufferHeader();
-  state_ = Metadata;
-}
-
-size_t NativeModuleSerializer::MeasureHeader() const {
-  return sizeof(uint32_t) +  // total wasm fct count
-         sizeof(uint32_t);  // imported fcts - i.e. index of first wasm function
-}
-
-void NativeModuleSerializer::BufferHeader() {
-  size_t metadata_size = MeasureHeader();
-  scratch_.resize(metadata_size);
-  remaining_ = {scratch_.data(), metadata_size};
-  Writer writer(remaining_);
-  writer.Write(native_module_->FunctionCount());
-  writer.Write(native_module_->num_imported_functions());
-}
-
-size_t NativeModuleSerializer::GetCodeHeaderSize() {
-  return sizeof(size_t) +         // size of this section
-         sizeof(size_t) +         // offset of constant pool
-         sizeof(size_t) +         // offset of safepoint table
-         sizeof(size_t) +         // offset of handler table
-         sizeof(uint32_t) +       // stack slots
-         sizeof(size_t) +         // code size
-         sizeof(size_t) +         // reloc size
-         sizeof(size_t) +         // source positions size
-         sizeof(size_t) +         // protected instructions size
-         sizeof(WasmCode::Tier);  // tier
 }
 
 size_t NativeModuleSerializer::MeasureCode(const WasmCode* code) const {
-  return GetCodeHeaderSize() + code->instructions().size() +  // code
-         code->reloc_info().size() +                          // reloc info
-         code->source_positions().size() +                    // source pos.
-         code->protected_instructions().size() *              // protected inst.
+  if (code == nullptr) return sizeof(size_t);
+  DCHECK_EQ(WasmCode::kFunction, code->kind());
+  return kCodeHeaderSize + code->instructions().size() +
+         code->reloc_info().size() + code->source_positions().size() +
+         code->protected_instructions().size() *
              sizeof(trap_handler::ProtectedInstructionData);
 }
 
 size_t NativeModuleSerializer::Measure() const {
-  size_t ret = MeasureHeader() + MeasureCopiedStubs();
-  for (uint32_t i = native_module_->num_imported_functions(),
-                e = native_module_->FunctionCount();
-       i < e; ++i) {
-    ret += MeasureCode(native_module_->GetCode(i));
+  size_t size = kHeaderSize;
+  for (WasmCode* code : native_module_->code_table()) {
+    size += MeasureCode(code);
   }
-  return ret;
-}
-
-size_t NativeModuleSerializer::DrainBuffer(Vector<byte> dest) {
-  size_t to_write = std::min(dest.size(), remaining_.size());
-  memcpy(dest.start(), remaining_.start(), to_write);
-  DCHECK_GE(remaining_.size(), to_write);
-  remaining_ = remaining_ + to_write;
-  return to_write;
+  return size;
 }
 
-size_t NativeModuleSerializer::MeasureCopiedStubs() const {
-  size_t ret = sizeof(uint32_t) +  // number of stubs
-               native_module_->stubs_.size() * sizeof(uint32_t);  // stub keys
-  for (auto pair : native_module_->trampolines_) {
-    v8::internal::Code* code = Code::GetCodeFromTargetAddress(pair.first);
-    int builtin_index = code->builtin_index();
-    if (builtin_index < 0) ret += sizeof(uint32_t);
-  }
-  return ret;
+void NativeModuleSerializer::WriteHeader(Writer* writer) {
+  writer->Write(native_module_->num_functions());
+  writer->Write(native_module_->num_imported_functions());
 }
 
-void NativeModuleSerializer::BufferCopiedStubs() {
-  // We buffer all the stubs together, because they are very likely
-  // few and small. Each stub is buffered like a WasmCode would,
-  // and in addition prefaced by its stub key. The whole section is prefaced
-  // by the number of stubs.
-  size_t buff_size = MeasureCopiedStubs();
-  scratch_.resize(buff_size);
-  remaining_ = {scratch_.data(), buff_size};
-  Writer writer(remaining_);
-  writer.Write(
-      static_cast<uint32_t>((buff_size - sizeof(uint32_t)) / sizeof(uint32_t)));
-  uint32_t stub_id = kFirstStubId;
-
-  for (auto pair : native_module_->stubs_) {
-    uint32_t key = pair.first;
-    writer.Write(key);
-    stub_lookup_.insert(
-        std::make_pair(pair.second->instructions().start(), stub_id));
-    ++stub_id;
+void NativeModuleSerializer::WriteCode(const WasmCode* code, Writer* writer) {
+  if (code == nullptr) {
+    writer->Write(size_t{0});
+    return;
   }
-
-  for (auto pair : native_module_->trampolines_) {
-    v8::internal::Code* code = Code::GetCodeFromTargetAddress(pair.first);
-    int builtin_index = code->builtin_index();
-    if (builtin_index < 0) {
-      stub_lookup_.insert(std::make_pair(pair.second, stub_id));
-      writer.Write(code->stub_key());
-      ++stub_id;
-    }
+  DCHECK_EQ(WasmCode::kFunction, code->kind());
+  // Write the size of the entire code section, followed by the code header.
+  writer->Write(MeasureCode(code));
+  writer->Write(code->constant_pool_offset());
+  writer->Write(code->safepoint_table_offset());
+  writer->Write(code->handler_table_offset());
+  writer->Write(code->stack_slots());
+  writer->Write(code->instructions().size());
+  writer->Write(code->reloc_info().size());
+  writer->Write(code->source_positions().size());
+  writer->Write(code->protected_instructions().size());
+  writer->Write(code->tier());
+
+  // Get a pointer to the destination buffer, to hold relocated code.
+  byte* serialized_code_start = writer->current_buffer().start();
+  byte* code_start = serialized_code_start;
+  size_t code_size = code->instructions().size();
+  writer->Skip(code_size);
+  // Write the reloc info, source positions, and protected code.
+  writer->WriteVector(code->reloc_info());
+  writer->WriteVector(code->source_positions());
+  writer->WriteVector(Vector<byte>::cast(code->protected_instructions()));
+#if V8_TARGET_ARCH_MIPS || V8_TARGET_ARCH_MIPS64 || V8_TARGET_ARCH_ARM
+  // On platforms that don't support misaligned word stores, copy to an aligned
+  // buffer if necessary so we can relocate the serialized code.
+  std::unique_ptr<byte[]> aligned_buffer;
+  if (!IsAligned(reinterpret_cast<Address>(serialized_code_start),
+                 kInt32Size)) {
+    aligned_buffer.reset(new byte[code_size]);
+    code_start = aligned_buffer.get();
   }
-}
-
-void NativeModuleSerializer::BufferCurrentWasmCode() {
-  const WasmCode* code = native_module_->GetCode(index_);
-  size_t size = MeasureCode(code);
-  scratch_.resize(size);
-  remaining_ = {scratch_.data(), size};
-  BufferCodeInAllocatedScratch(code);
-}
-
-void NativeModuleSerializer::BufferCodeInAllocatedScratch(
-    const WasmCode* code) {
-  // We write the address, the size, and then copy the code as-is, followed
-  // by reloc info, followed by source positions.
-  Writer writer(remaining_);
-  // write the header
-  writer.Write(MeasureCode(code));
-  writer.Write(code->constant_pool_offset());
-  writer.Write(code->safepoint_table_offset());
-  writer.Write(code->handler_table_offset());
-  writer.Write(code->stack_slots());
-  writer.Write(code->instructions().size());
-  writer.Write(code->reloc_info().size());
-  writer.Write(code->source_positions().size());
-  writer.Write(code->protected_instructions().size());
-  writer.Write(code->tier());
-  // next is the code, which we have to reloc.
-  Address serialized_code_start = writer.current_buffer().start();
-  // write the code and everything else
-  writer.WriteVector(code->instructions());
-  writer.WriteVector(code->reloc_info());
-  writer.WriteVector(code->source_positions());
-  writer.WriteVector(
-      {reinterpret_cast<const byte*>(code->protected_instructions().data()),
-       sizeof(trap_handler::ProtectedInstructionData) *
-           code->protected_instructions().size()});
-  // now relocate the code
-  int mask = RelocInfo::ModeMask(RelocInfo::CODE_TARGET) |
-             RelocInfo::ModeMask(RelocInfo::WASM_CALL) |
-             RelocInfo::ModeMask(RelocInfo::RUNTIME_ENTRY) |
-             RelocInfo::ModeMask(RelocInfo::EXTERNAL_REFERENCE);
+#endif
+  memcpy(code_start, code->instructions().start(), code_size);
+  // Relocate the code.
+  int mask = RelocInfo::ModeMask(RelocInfo::WASM_CALL) |
+             RelocInfo::ModeMask(RelocInfo::WASM_STUB_CALL) |
+             RelocInfo::ModeMask(RelocInfo::EXTERNAL_REFERENCE) |
+             RelocInfo::ModeMask(RelocInfo::INTERNAL_REFERENCE) |
+             RelocInfo::ModeMask(RelocInfo::INTERNAL_REFERENCE_ENCODED);
   RelocIterator orig_iter(code->instructions(), code->reloc_info(),
                           code->constant_pool(), mask);
-  for (RelocIterator
-           iter({serialized_code_start, code->instructions().size()},
-                code->reloc_info(),
-                serialized_code_start + code->constant_pool_offset(), mask);
+  for (RelocIterator iter(
+           {code_start, code->instructions().size()}, code->reloc_info(),
+           reinterpret_cast<Address>(code_start) + code->constant_pool_offset(),
+           mask);
        !iter.done(); iter.next(), orig_iter.next()) {
     RelocInfo::Mode mode = orig_iter.rinfo()->rmode();
     switch (mode) {
-      case RelocInfo::CODE_TARGET: {
-        Address orig_target = orig_iter.rinfo()->target_address();
-        uint32_t tag = EncodeBuiltinOrStub(orig_target);
-        SetWasmCalleeTag(iter.rinfo(), tag);
-      } break;
       case RelocInfo::WASM_CALL: {
         Address orig_target = orig_iter.rinfo()->wasm_call_address();
-        uint32_t tag = wasm_targets_lookup_[orig_target];
+        uint32_t tag =
+            native_module_->GetFunctionIndexFromJumpTableSlot(orig_target);
         SetWasmCalleeTag(iter.rinfo(), tag);
       } break;
-      case RelocInfo::RUNTIME_ENTRY: {
-        Address orig_target = orig_iter.rinfo()->target_address();
-        auto ref_iter = reference_table_lookup_.find(orig_target);
-        DCHECK(ref_iter != reference_table_lookup_.end());
-        uint32_t tag = ref_iter->second;
+      case RelocInfo::WASM_STUB_CALL: {
+        Address orig_target = orig_iter.rinfo()->wasm_stub_call_address();
+        auto stub_iter = wasm_stub_targets_lookup_.find(orig_target);
+        DCHECK(stub_iter != wasm_stub_targets_lookup_.end());
+        uint32_t tag = stub_iter->second;
         SetWasmCalleeTag(iter.rinfo(), tag);
       } break;
       case RelocInfo::EXTERNAL_REFERENCE: {
@@ -406,207 +347,153 @@ void NativeModuleSerializer::BufferCodeInAllocatedScratch(
         uint32_t tag = ref_iter->second;
         SetWasmCalleeTag(iter.rinfo(), tag);
       } break;
+      case RelocInfo::INTERNAL_REFERENCE:
+      case RelocInfo::INTERNAL_REFERENCE_ENCODED: {
+        Address orig_target = orig_iter.rinfo()->target_internal_reference();
+        Address offset = orig_target - code->instruction_start();
+        Assembler::deserialization_set_target_internal_reference_at(
+            iter.rinfo()->pc(), offset, mode);
+      } break;
       default:
         UNREACHABLE();
     }
   }
+  // If we copied to an aligned buffer, copy code into serialized buffer.
+  if (code_start != serialized_code_start) {
+    memcpy(serialized_code_start, code_start, code_size);
+  }
 }
 
-uint32_t NativeModuleSerializer::EncodeBuiltinOrStub(Address address) {
-  auto builtin_iter = builtin_lookup_.find(address);
-  uint32_t tag = 0;
-  if (builtin_iter != builtin_lookup_.end()) {
-    uint32_t id = builtin_iter->second;
-    DCHECK_LT(id, std::numeric_limits<uint16_t>::max());
-    tag = id << 16;
-  } else {
-    auto stub_iter = stub_lookup_.find(address);
-    DCHECK(stub_iter != stub_lookup_.end());
-    uint32_t id = stub_iter->second;
-    DCHECK_LT(id, std::numeric_limits<uint16_t>::max());
-    tag = id & 0x0000FFFF;
+bool NativeModuleSerializer::Write(Writer* writer) {
+  DCHECK(!write_called_);
+  write_called_ = true;
+
+  WriteHeader(writer);
+
+  for (WasmCode* code : native_module_->code_table()) {
+    WriteCode(code, writer);
   }
-  return tag;
+  return true;
 }
 
-size_t NativeModuleSerializer::Write(Vector<byte> dest) {
-  Vector<byte> original = dest;
-  while (dest.size() > 0) {
-    switch (state_) {
-      case Metadata: {
-        dest = dest + DrainBuffer(dest);
-        if (remaining_.size() == 0) {
-          BufferCopiedStubs();
-          state_ = Stubs;
-        }
-        break;
-      }
-      case Stubs: {
-        dest = dest + DrainBuffer(dest);
-        if (remaining_.size() == 0) {
-          index_ = native_module_->num_imported_functions();
-          if (index_ < native_module_->FunctionCount()) {
-            BufferCurrentWasmCode();
-            state_ = CodeSection;
-          } else {
-            state_ = Done;
-          }
-        }
-        break;
-      }
-      case CodeSection: {
-        dest = dest + DrainBuffer(dest);
-        if (remaining_.size() == 0) {
-          ++index_;  // Move to next code object.
-          if (index_ < native_module_->FunctionCount()) {
-            BufferCurrentWasmCode();
-          } else {
-            state_ = Done;
-          }
-        }
-        break;
-      }
-      default:
-        UNREACHABLE();
-    }
-  }
-  DCHECK_GE(original.size(), dest.size());
-  return original.size() - dest.size();
+size_t GetSerializedNativeModuleSize(Isolate* isolate,
+                                     NativeModule* native_module) {
+  NativeModuleSerializer serializer(isolate, native_module);
+  return kVersionSize + serializer.Measure();
 }
 
-// static
-std::pair<std::unique_ptr<const byte[]>, size_t> SerializeNativeModule(
-    Isolate* isolate, Handle<WasmCompiledModule> compiled_module) {
-  NativeModule* native_module = compiled_module->GetNativeModule();
+bool SerializeNativeModule(Isolate* isolate, NativeModule* native_module,
+                           Vector<byte> buffer) {
   NativeModuleSerializer serializer(isolate, native_module);
-  size_t version_size = kVersionSize;
-  size_t buff_size = serializer.Measure() + version_size;
-  std::unique_ptr<byte[]> ret(new byte[buff_size]);
-  WriteVersion(isolate, {ret.get(), buff_size});
+  size_t measured_size = kVersionSize + serializer.Measure();
+  if (buffer.size() < measured_size) return false;
 
-  size_t written =
-      serializer.Write({ret.get() + version_size, buff_size - version_size});
-  if (written != buff_size - version_size) return {};
+  Writer writer(buffer);
+  WriteVersion(isolate, &writer);
 
-  return {std::move(ret), buff_size};
+  if (!serializer.Write(&writer)) return false;
+  DCHECK_EQ(measured_size, writer.bytes_written());
+  return true;
 }
 
+class V8_EXPORT_PRIVATE NativeModuleDeserializer {
+ public:
+  NativeModuleDeserializer() = delete;
+  NativeModuleDeserializer(Isolate*, NativeModule*);
+
+  bool Read(Reader* reader);
+
+ private:
+  bool ReadHeader(Reader* reader);
+  bool ReadCode(uint32_t fn_index, Reader* reader);
+
+  Isolate* const isolate_;
+  NativeModule* const native_module_;
+  bool read_called_;
+
+  DISALLOW_COPY_AND_ASSIGN(NativeModuleDeserializer);
+};
+
 NativeModuleDeserializer::NativeModuleDeserializer(Isolate* isolate,
                                                    NativeModule* native_module)
-    : isolate_(isolate), native_module_(native_module) {}
+    : isolate_(isolate), native_module_(native_module), read_called_(false) {}
 
-void NativeModuleDeserializer::Expect(size_t size) {
-  scratch_.resize(size);
-  current_expectation_ = size;
-  unread_ = {scratch_.data(), size};
-}
+bool NativeModuleDeserializer::Read(Reader* reader) {
+  DCHECK(!read_called_);
+  read_called_ = true;
 
-bool NativeModuleDeserializer::Read(Vector<const byte> data) {
-  unread_ = data;
-  if (!ReadHeader()) return false;
-  if (!ReadStubs()) return false;
-  index_ = native_module_->num_imported_functions();
-  for (; index_ < native_module_->FunctionCount(); ++index_) {
-    if (!ReadCode()) return false;
+  if (!ReadHeader(reader)) return false;
+  uint32_t total_fns = native_module_->num_functions();
+  uint32_t first_wasm_fn = native_module_->num_imported_functions();
+  for (uint32_t i = first_wasm_fn; i < total_fns; ++i) {
+    if (!ReadCode(i, reader)) return false;
   }
-  return data.size() - unread_.size();
+  return reader->current_size() == 0;
 }
 
-bool NativeModuleDeserializer::ReadHeader() {
-  size_t start_size = unread_.size();
-  Reader reader(unread_);
-  size_t functions = reader.Read<uint32_t>();
-  size_t imports = reader.Read<uint32_t>();
-  bool ok = functions == native_module_->FunctionCount() &&
-            imports == native_module_->num_imported_functions();
-  if (!ok) return false;
-
-  unread_ = unread_ + (start_size - reader.current_buffer().size());
-  return true;
+bool NativeModuleDeserializer::ReadHeader(Reader* reader) {
+  size_t functions = reader->Read<uint32_t>();
+  size_t imports = reader->Read<uint32_t>();
+  return functions == native_module_->num_functions() &&
+         imports == native_module_->num_imported_functions();
 }
 
-bool NativeModuleDeserializer::ReadStubs() {
-  size_t start_size = unread_.size();
-  Reader reader(unread_);
-  size_t nr_stubs = reader.Read<uint32_t>();
-  stubs_.reserve(nr_stubs);
-  for (size_t i = 0; i < nr_stubs; ++i) {
-    uint32_t key = reader.Read<uint32_t>();
-    v8::internal::Code* stub =
-        *(v8::internal::CodeStub::GetCode(isolate_, key).ToHandleChecked());
-    stubs_.push_back(native_module_->GetLocalAddressFor(handle(stub)));
-  }
-  unread_ = unread_ + (start_size - reader.current_buffer().size());
-  return true;
-}
-
-bool NativeModuleDeserializer::ReadCode() {
-  size_t start_size = unread_.size();
-  Reader reader(unread_);
-  size_t code_section_size = reader.Read<size_t>();
-  USE(code_section_size);
-  size_t constant_pool_offset = reader.Read<size_t>();
-  size_t safepoint_table_offset = reader.Read<size_t>();
-  size_t handler_table_offset = reader.Read<size_t>();
-  uint32_t stack_slot_count = reader.Read<uint32_t>();
-  size_t code_size = reader.Read<size_t>();
-  size_t reloc_size = reader.Read<size_t>();
-  size_t source_position_size = reader.Read<size_t>();
-  size_t protected_instructions_size = reader.Read<size_t>();
-  WasmCode::Tier tier = reader.Read<WasmCode::Tier>();
-
-  std::shared_ptr<ProtectedInstructions> protected_instructions(
-      new ProtectedInstructions(protected_instructions_size));
-  DCHECK_EQ(protected_instructions_size, protected_instructions->size());
-
-  Vector<const byte> code_buffer = reader.GetSubvector(code_size);
-  std::unique_ptr<byte[]> reloc_info;
-  if (reloc_size > 0) {
-    reloc_info.reset(new byte[reloc_size]);
-    reader.ReadIntoVector({reloc_info.get(), reloc_size});
-  }
-  std::unique_ptr<byte[]> source_pos;
-  if (source_position_size > 0) {
-    source_pos.reset(new byte[source_position_size]);
-    reader.ReadIntoVector({source_pos.get(), source_position_size});
-  }
-  WasmCode* ret = native_module_->AddOwnedCode(
-      code_buffer, std::move(reloc_info), reloc_size, std::move(source_pos),
-      source_position_size, Just(index_), WasmCode::kFunction,
-      constant_pool_offset, stack_slot_count, safepoint_table_offset,
-      handler_table_offset, protected_instructions, tier,
-      WasmCode::kNoFlushICache);
-  native_module_->code_table_[index_] = ret;
-
-  // now relocate the code
-  int mask = RelocInfo::ModeMask(RelocInfo::EMBEDDED_OBJECT) |
-             RelocInfo::ModeMask(RelocInfo::CODE_TARGET) |
-             RelocInfo::ModeMask(RelocInfo::RUNTIME_ENTRY) |
-             RelocInfo::ModeMask(RelocInfo::EXTERNAL_REFERENCE);
-  for (RelocIterator iter(ret->instructions(), ret->reloc_info(),
-                          ret->constant_pool(), mask);
+bool NativeModuleDeserializer::ReadCode(uint32_t fn_index, Reader* reader) {
+  size_t code_section_size = reader->Read<size_t>();
+  if (code_section_size == 0) return true;
+  size_t constant_pool_offset = reader->Read<size_t>();
+  size_t safepoint_table_offset = reader->Read<size_t>();
+  size_t handler_table_offset = reader->Read<size_t>();
+  uint32_t stack_slot_count = reader->Read<uint32_t>();
+  size_t code_size = reader->Read<size_t>();
+  size_t reloc_size = reader->Read<size_t>();
+  size_t source_position_size = reader->Read<size_t>();
+  size_t protected_instructions_size = reader->Read<size_t>();
+  WasmCode::Tier tier = reader->Read<WasmCode::Tier>();
+
+  Vector<const byte> code_buffer = {reader->current_location(), code_size};
+  reader->Skip(code_size);
+
+  OwnedVector<byte> reloc_info = OwnedVector<byte>::New(reloc_size);
+  reader->ReadVector(reloc_info.as_vector());
+  OwnedVector<byte> source_pos = OwnedVector<byte>::New(source_position_size);
+  reader->ReadVector(source_pos.as_vector());
+  auto protected_instructions =
+      OwnedVector<trap_handler::ProtectedInstructionData>::New(
+          protected_instructions_size);
+  reader->ReadVector(Vector<byte>::cast(protected_instructions.as_vector()));
+
+  WasmCode* code = native_module_->AddDeserializedCode(
+      fn_index, code_buffer, stack_slot_count, safepoint_table_offset,
+      handler_table_offset, constant_pool_offset,
+      std::move(protected_instructions), std::move(reloc_info),
+      std::move(source_pos), tier);
+
+  // Relocate the code.
+  int mask = RelocInfo::ModeMask(RelocInfo::WASM_CALL) |
+             RelocInfo::ModeMask(RelocInfo::WASM_STUB_CALL) |
+             RelocInfo::ModeMask(RelocInfo::EXTERNAL_REFERENCE) |
+             RelocInfo::ModeMask(RelocInfo::INTERNAL_REFERENCE) |
+             RelocInfo::ModeMask(RelocInfo::INTERNAL_REFERENCE_ENCODED);
+  for (RelocIterator iter(code->instructions(), code->reloc_info(),
+                          code->constant_pool(), mask);
        !iter.done(); iter.next()) {
     RelocInfo::Mode mode = iter.rinfo()->rmode();
     switch (mode) {
-      case RelocInfo::EMBEDDED_OBJECT: {
-        // We only expect {undefined}. We check for that when we add code.
-        iter.rinfo()->set_target_object(isolate_->heap()->undefined_value(),
-                                        SKIP_WRITE_BARRIER, SKIP_ICACHE_FLUSH);
-        break;
-      }
-      case RelocInfo::CODE_TARGET: {
+      case RelocInfo::WASM_CALL: {
         uint32_t tag = GetWasmCalleeTag(iter.rinfo());
-        Address target = GetTrampolineOrStubFromTag(tag);
-        iter.rinfo()->set_target_address(target, SKIP_WRITE_BARRIER,
-                                         SKIP_ICACHE_FLUSH);
+        Address target = native_module_->GetCallTargetForFunction(tag);
+        iter.rinfo()->set_wasm_call_address(target, SKIP_ICACHE_FLUSH);
         break;
       }
-      case RelocInfo::RUNTIME_ENTRY: {
+      case RelocInfo::WASM_STUB_CALL: {
         uint32_t tag = GetWasmCalleeTag(iter.rinfo());
-        Address address =
-            isolate_->heap()->external_reference_table()->address(tag);
-        iter.rinfo()->set_target_runtime_entry(address, SKIP_WRITE_BARRIER,
-                                               SKIP_ICACHE_FLUSH);
+        DCHECK_LT(tag, WasmCode::kRuntimeStubCount);
+        Address target =
+            native_module_
+                ->runtime_stub(static_cast<WasmCode::RuntimeStubId>(tag))
+                ->instruction_start();
+        iter.rinfo()->set_wasm_stub_call_address(target, SKIP_ICACHE_FLUSH);
         break;
       }
       case RelocInfo::EXTERNAL_REFERENCE: {
@@ -616,37 +503,30 @@ bool NativeModuleDeserializer::ReadCode() {
         iter.rinfo()->set_target_external_reference(address, SKIP_ICACHE_FLUSH);
         break;
       }
+      case RelocInfo::INTERNAL_REFERENCE:
+      case RelocInfo::INTERNAL_REFERENCE_ENCODED: {
+        Address offset = iter.rinfo()->target_internal_reference();
+        Address target = code->instruction_start() + offset;
+        Assembler::deserialization_set_target_internal_reference_at(
+            iter.rinfo()->pc(), target, mode);
+        break;
+      }
       default:
         UNREACHABLE();
     }
   }
-  // Flush the i-cache here instead of in AddOwnedCode, to include the changes
-  // made while iterating over the RelocInfo above.
-  Assembler::FlushICache(ret->instructions().start(),
-                         ret->instructions().size());
-
-  if (protected_instructions_size > 0) {
-    reader.ReadIntoVector(
-        {reinterpret_cast<byte*>(protected_instructions->data()),
-         sizeof(trap_handler::ProtectedInstructionData) *
-             protected_instructions->size()});
-  }
-  unread_ = unread_ + (start_size - reader.current_buffer().size());
-  return true;
-}
 
-Address NativeModuleDeserializer::GetTrampolineOrStubFromTag(uint32_t tag) {
-  if ((tag & 0x0000FFFF) == 0) {
-    int builtin_id = static_cast<int>(tag >> 16);
-    v8::internal::Code* builtin = isolate_->builtins()->builtin(builtin_id);
-    return native_module_->GetLocalAddressFor(handle(builtin));
-  } else {
-    DCHECK_EQ(tag & 0xFFFF0000, 0);
-    return stubs_[tag - kFirstStubId];
-  }
+  if (FLAG_print_code || FLAG_print_wasm_code) code->Print();
+  code->Validate();
+
+  // Finally, flush the icache for that code.
+  Assembler::FlushICache(code->instructions().start(),
+                         code->instructions().size());
+
+  return true;
 }
 
-MaybeHandle<WasmCompiledModule> DeserializeNativeModule(
+MaybeHandle<WasmModuleObject> DeserializeNativeModule(
     Isolate* isolate, Vector<const byte> data, Vector<const byte> wire_bytes) {
   if (!IsWasmCodegenAllowed(isolate, isolate->native_context())) {
     return {};
@@ -654,49 +534,46 @@ MaybeHandle<WasmCompiledModule> DeserializeNativeModule(
   if (!IsSupportedVersion(isolate, data)) {
     return {};
   }
-  data = data + kVersionSize;
   ModuleResult decode_result =
       SyncDecodeWasmModule(isolate, wire_bytes.start(), wire_bytes.end(), false,
                            i::wasm::kWasmOrigin);
   if (!decode_result.ok()) return {};
   CHECK_NOT_NULL(decode_result.val);
-  Handle<String> module_bytes =
-      isolate->factory()
-          ->NewStringFromOneByte(
-              {wire_bytes.start(), static_cast<size_t>(wire_bytes.length())},
-              TENURED)
-          .ToHandleChecked();
-  DCHECK(module_bytes->IsSeqOneByteString());
-  // The {module_wrapper} will take ownership of the {WasmModule} object,
-  // and it will be destroyed when the GC reclaims the wrapper object.
-  Handle<WasmModuleWrapper> module_wrapper =
-      WasmModuleWrapper::From(isolate, decode_result.val.release());
+  WasmModule* module = decode_result.val.get();
   Handle<Script> script = CreateWasmScript(isolate, wire_bytes);
-  Handle<WasmSharedModuleData> shared = WasmSharedModuleData::New(
-      isolate, module_wrapper, Handle<SeqOneByteString>::cast(module_bytes),
+
+  // TODO(eholk): We need to properly preserve the flag whether the trap
+  // handler was used or not when serializing.
+  UseTrapHandler use_trap_handler =
+      trap_handler::IsTrapHandlerEnabled() ? kUseTrapHandler : kNoTrapHandler;
+  wasm::ModuleEnv env(module, use_trap_handler,
+                      wasm::RuntimeExceptionSupport::kRuntimeExceptionSupport);
+
+  OwnedVector<uint8_t> wire_bytes_copy = OwnedVector<uint8_t>::Of(wire_bytes);
+
+  Handle<WasmModuleObject> module_object = WasmModuleObject::New(
+      isolate, std::move(decode_result.val), env, std::move(wire_bytes_copy),
       script, Handle<ByteArray>::null());
-  int export_wrappers_size =
-      static_cast<int>(shared->module()->num_exported_functions);
-  Handle<FixedArray> export_wrappers = isolate->factory()->NewFixedArray(
-      static_cast<int>(export_wrappers_size), TENURED);
-
-  Handle<WasmCompiledModule> compiled_module =
-      WasmCompiledModule::New(isolate, shared->module(), export_wrappers,
-                              trap_handler::IsTrapHandlerEnabled());
-  compiled_module->set_shared(*shared);
-  script->set_wasm_compiled_module(*compiled_module);
-  NativeModuleDeserializer deserializer(isolate,
-                                        compiled_module->GetNativeModule());
-  if (!deserializer.Read(data)) return {};
+  NativeModule* native_module = module_object->native_module();
+
+  if (FLAG_wasm_lazy_compilation) {
+    native_module->SetLazyBuiltin(BUILTIN_CODE(isolate, WasmCompileLazy));
+  }
+  NativeModuleDeserializer deserializer(isolate, native_module);
+
+  Reader reader(data + kVersionSize);
+  if (!deserializer.Read(&reader)) return {};
 
   // TODO(6792): Wrappers below might be cloned using {Factory::CopyCode}. This
-  // requires unlocking the code space here. This should be moved into the
-  // allocator eventually.
+  // requires unlocking the code space here. This should eventually be moved
+  // into the allocator.
   CodeSpaceMemoryModificationScope modification_scope(isolate->heap());
-  CompileJsToWasmWrappers(isolate, compiled_module, isolate->counters());
-  WasmCompiledModule::ReinitializeAfterDeserialization(isolate,
-                                                       compiled_module);
-  return compiled_module;
+  CompileJsToWasmWrappers(isolate, module_object);
+
+  // Log the code within the generated module for profiling.
+  native_module->LogWasmCodes(isolate);
+
+  return module_object;
 }
 
 }  // namespace wasm
diff --git a/deps/v8/src/wasm/wasm-serialization.h b/deps/v8/src/wasm/wasm-serialization.h
index 5bb49bfdce6394..352195b2b0b287 100644
--- a/deps/v8/src/wasm/wasm-serialization.h
+++ b/deps/v8/src/wasm/wasm-serialization.h
@@ -11,10 +11,13 @@ namespace v8 {
 namespace internal {
 namespace wasm {
 
-std::pair<std::unique_ptr<const byte[]>, size_t> SerializeNativeModule(
-    Isolate* isolate, Handle<WasmCompiledModule> compiled_module);
+size_t GetSerializedNativeModuleSize(Isolate* isolate,
+                                     NativeModule* native_module);
 
-MaybeHandle<WasmCompiledModule> DeserializeNativeModule(
+bool SerializeNativeModule(Isolate* isolate, NativeModule* native_module,
+                           Vector<byte> buffer);
+
+MaybeHandle<WasmModuleObject> DeserializeNativeModule(
     Isolate* isolate, Vector<const byte> data, Vector<const byte> wire_bytes);
 
 }  // namespace wasm
diff --git a/deps/v8/src/wasm/wasm-text.cc b/deps/v8/src/wasm/wasm-text.cc
index 15ee678f93ff4e..8efccae9ccdf6f 100644
--- a/deps/v8/src/wasm/wasm-text.cc
+++ b/deps/v8/src/wasm/wasm-text.cc
@@ -54,13 +54,12 @@ void PrintWasmText(const WasmModule* module, const ModuleWireBytes& wire_bytes,
   if (fun->sig->parameter_count()) {
     os << " (param";
     for (auto param : fun->sig->parameters())
-      os << ' ' << WasmOpcodes::TypeName(param);
+      os << ' ' << ValueTypes::TypeName(param);
     os << ')';
   }
   if (fun->sig->return_count()) {
     os << " (result";
-    for (auto ret : fun->sig->returns())
-      os << ' ' << WasmOpcodes::TypeName(ret);
+    for (auto ret : fun->sig->returns()) os << ' ' << ValueTypes::TypeName(ret);
     os << ')';
   }
   os << "\n";
@@ -74,7 +73,7 @@ void PrintWasmText(const WasmModule* module, const ModuleWireBytes& wire_bytes,
   if (!decls.type_list.empty()) {
     os << "(local";
     for (const ValueType &v : decls.type_list) {
-      os << ' ' << WasmOpcodes::TypeName(v);
+      os << ' ' << ValueTypes::TypeName(v);
     }
     os << ")\n";
     ++line_nr;
@@ -101,20 +100,20 @@ void PrintWasmText(const WasmModule* module, const ModuleWireBytes& wire_bytes,
       case kExprIf:
       case kExprBlock:
       case kExprTry: {
-        BlockTypeOperand<Decoder::kNoValidate> operand(&i, i.pc());
+        BlockTypeImmediate<Decoder::kNoValidate> imm(&i, i.pc());
         os << WasmOpcodes::OpcodeName(opcode);
-        if (operand.type == kWasmVar) {
-          os << " (type " << operand.sig_index << ")";
-        } else if (operand.out_arity() > 0) {
-          os << " " << WasmOpcodes::TypeName(operand.out_type(0));
+        if (imm.type == kWasmVar) {
+          os << " (type " << imm.sig_index << ")";
+        } else if (imm.out_arity() > 0) {
+          os << " " << ValueTypes::TypeName(imm.out_type(0));
         }
         control_depth++;
         break;
       }
       case kExprBr:
       case kExprBrIf: {
-        BreakDepthOperand<Decoder::kNoValidate> operand(&i, i.pc());
-        os << WasmOpcodes::OpcodeName(opcode) << ' ' << operand.depth;
+        BreakDepthImmediate<Decoder::kNoValidate> imm(&i, i.pc());
+        os << WasmOpcodes::OpcodeName(opcode) << ' ' << imm.depth;
         break;
       }
       case kExprElse:
@@ -125,47 +124,47 @@ void PrintWasmText(const WasmModule* module, const ModuleWireBytes& wire_bytes,
         os << "end";
         break;
       case kExprBrTable: {
-        BranchTableOperand<Decoder::kNoValidate> operand(&i, i.pc());
-        BranchTableIterator<Decoder::kNoValidate> iterator(&i, operand);
+        BranchTableImmediate<Decoder::kNoValidate> imm(&i, i.pc());
+        BranchTableIterator<Decoder::kNoValidate> iterator(&i, imm);
         os << "br_table";
         while (iterator.has_next()) os << ' ' << iterator.next();
         break;
       }
       case kExprCallIndirect: {
-        CallIndirectOperand<Decoder::kNoValidate> operand(&i, i.pc());
-        DCHECK_EQ(0, operand.table_index);
-        os << "call_indirect " << operand.sig_index;
+        CallIndirectImmediate<Decoder::kNoValidate> imm(&i, i.pc());
+        DCHECK_EQ(0, imm.table_index);
+        os << "call_indirect " << imm.sig_index;
         break;
       }
       case kExprCallFunction: {
-        CallFunctionOperand<Decoder::kNoValidate> operand(&i, i.pc());
-        os << "call " << operand.index;
+        CallFunctionImmediate<Decoder::kNoValidate> imm(&i, i.pc());
+        os << "call " << imm.index;
         break;
       }
       case kExprGetLocal:
       case kExprSetLocal:
       case kExprTeeLocal: {
-        LocalIndexOperand<Decoder::kNoValidate> operand(&i, i.pc());
-        os << WasmOpcodes::OpcodeName(opcode) << ' ' << operand.index;
+        LocalIndexImmediate<Decoder::kNoValidate> imm(&i, i.pc());
+        os << WasmOpcodes::OpcodeName(opcode) << ' ' << imm.index;
         break;
       }
       case kExprThrow:
       case kExprCatch: {
-        ExceptionIndexOperand<Decoder::kNoValidate> operand(&i, i.pc());
-        os << WasmOpcodes::OpcodeName(opcode) << ' ' << operand.index;
+        ExceptionIndexImmediate<Decoder::kNoValidate> imm(&i, i.pc());
+        os << WasmOpcodes::OpcodeName(opcode) << ' ' << imm.index;
         break;
       }
       case kExprGetGlobal:
       case kExprSetGlobal: {
-        GlobalIndexOperand<Decoder::kNoValidate> operand(&i, i.pc());
-        os << WasmOpcodes::OpcodeName(opcode) << ' ' << operand.index;
+        GlobalIndexImmediate<Decoder::kNoValidate> imm(&i, i.pc());
+        os << WasmOpcodes::OpcodeName(opcode) << ' ' << imm.index;
         break;
       }
-#define CASE_CONST(type, str, cast_type)                           \
-  case kExpr##type##Const: {                                       \
-    Imm##type##Operand<Decoder::kNoValidate> operand(&i, i.pc());  \
-    os << #str ".const " << static_cast<cast_type>(operand.value); \
-    break;                                                         \
+#define CASE_CONST(type, str, cast_type)                        \
+  case kExpr##type##Const: {                                    \
+    Imm##type##Immediate<Decoder::kNoValidate> imm(&i, i.pc()); \
+    os << #str ".const " << static_cast<cast_type>(imm.value);  \
+    break;                                                      \
   }
         CASE_CONST(I32, i32, int32_t)
         CASE_CONST(I64, i64, int64_t)
@@ -176,10 +175,10 @@ void PrintWasmText(const WasmModule* module, const ModuleWireBytes& wire_bytes,
 #define CASE_OPCODE(opcode, _, __) case kExpr##opcode:
         FOREACH_LOAD_MEM_OPCODE(CASE_OPCODE)
         FOREACH_STORE_MEM_OPCODE(CASE_OPCODE) {
-          MemoryAccessOperand<Decoder::kNoValidate> operand(&i, i.pc(),
-                                                            kMaxUInt32);
-          os << WasmOpcodes::OpcodeName(opcode) << " offset=" << operand.offset
-             << " align=" << (1ULL << operand.alignment);
+          MemoryAccessImmediate<Decoder::kNoValidate> imm(&i, i.pc(),
+                                                          kMaxUInt32);
+          os << WasmOpcodes::OpcodeName(opcode) << " offset=" << imm.offset
+             << " align=" << (1ULL << imm.alignment);
           break;
         }
 
@@ -197,11 +196,11 @@ void PrintWasmText(const WasmModule* module, const ModuleWireBytes& wire_bytes,
         WasmOpcode atomic_opcode = i.prefixed_opcode();
         switch (atomic_opcode) {
           FOREACH_ATOMIC_OPCODE(CASE_OPCODE) {
-            MemoryAccessOperand<Decoder::kNoValidate> operand(&i, i.pc(),
-                                                              kMaxUInt32);
+            MemoryAccessImmediate<Decoder::kNoValidate> imm(&i, i.pc(),
+                                                            kMaxUInt32);
             os << WasmOpcodes::OpcodeName(atomic_opcode)
-               << " offset=" << operand.offset
-               << " align=" << (1ULL << operand.alignment);
+               << " offset=" << imm.offset
+               << " align=" << (1ULL << imm.alignment);
             break;
           }
           default:
diff --git a/deps/v8/src/wasm/wasm-value.h b/deps/v8/src/wasm/wasm-value.h
index 22fd13c219bd66..602135135c1ab6 100644
--- a/deps/v8/src/wasm/wasm-value.h
+++ b/deps/v8/src/wasm/wasm-value.h
@@ -6,6 +6,7 @@
 #define V8_WASM_WASM_VALUE_H_
 
 #include "src/boxed-float.h"
+#include "src/utils.h"
 #include "src/wasm/wasm-opcodes.h"
 #include "src/zone/zone-containers.h"
 
@@ -13,39 +14,73 @@ namespace v8 {
 namespace internal {
 namespace wasm {
 
+#define FOREACH_SIMD_TYPE(V) \
+  V(float, float4, f32x4, 4) \
+  V(int32_t, int4, i32x4, 4) \
+  V(int16_t, int8, i16x8, 8) \
+  V(int8_t, int16, i8x16, 16)
+
+#define DEFINE_SIMD_TYPE(cType, sType, name, kSize) \
+  struct sType {                                    \
+    cType val[kSize];                               \
+  };
+FOREACH_SIMD_TYPE(DEFINE_SIMD_TYPE)
+#undef DEFINE_SIMD_TYPE
+
+class Simd128 {
+ public:
+  Simd128() : val_() {
+    for (size_t i = 0; i < 16; i++) {
+      val_[i] = 0;
+    }
+  }
+#define DEFINE_SIMD_TYPE_SPECIFIC_METHODS(cType, sType, name, size)    \
+  explicit Simd128(sType val) {                                        \
+    WriteUnalignedValue<sType>(reinterpret_cast<Address>(val_), val);  \
+  }                                                                    \
+  sType to_##name() {                                                  \
+    return ReadUnalignedValue<sType>(reinterpret_cast<Address>(val_)); \
+  }
+  FOREACH_SIMD_TYPE(DEFINE_SIMD_TYPE_SPECIFIC_METHODS)
+#undef DEFINE_SIMD_TYPE_SPECIFIC_METHODS
+
+ private:
+  uint8_t val_[16];
+};
+
 // Macro for defining WasmValue methods for different types.
 // Elements:
 // - name (for to_<name>() method)
 // - wasm type
 // - c type
-// - how to get bit pattern from value {v} of type {c type}
-// - how to get value of type {c type} from bit pattern {p}
-#define FOREACH_WASMVAL_TYPE(V)                                                \
-  V(i32, kWasmI32, int32_t, static_cast<uint32_t>(v), static_cast<int32_t>(p)) \
-  V(u32, kWasmI32, uint32_t, v, static_cast<uint32_t>(p))                      \
-  V(i64, kWasmI64, int64_t, static_cast<uint64_t>(v), static_cast<int64_t>(p)) \
-  V(u64, kWasmI64, uint64_t, v, p)                                             \
-  V(f32, kWasmF32, float, bit_cast<uint32_t>(v),                               \
-    bit_cast<float>(static_cast<uint32_t>(p)))                                 \
-  V(f32_boxed, kWasmF32, Float32, v.get_bits(),                                \
-    Float32::FromBits(static_cast<uint32_t>(p)))                               \
-  V(f64, kWasmF64, double, bit_cast<uint64_t>(v), bit_cast<double>(p))         \
-  V(f64_boxed, kWasmF64, Float64, v.get_bits(), Float64::FromBits(p))
+#define FOREACH_WASMVAL_TYPE(V)   \
+  V(i32, kWasmI32, int32_t)       \
+  V(u32, kWasmI32, uint32_t)      \
+  V(i64, kWasmI64, int64_t)       \
+  V(u64, kWasmI64, uint64_t)      \
+  V(f32, kWasmF32, float)         \
+  V(f32_boxed, kWasmF32, Float32) \
+  V(f64, kWasmF64, double)        \
+  V(f64_boxed, kWasmF64, Float64) \
+  V(s128, kWasmS128, Simd128)
 
 // A wasm value with type information.
 class WasmValue {
  public:
-  WasmValue() : type_(kWasmStmt) {}
-
-#define DEFINE_TYPE_SPECIFIC_METHODS(name, localtype, ctype, v_to_p, p_to_v) \
-  explicit WasmValue(ctype v) : type_(localtype), bit_pattern_(v_to_p) {}    \
-  ctype to_##name() const {                                                  \
-    DCHECK_EQ(localtype, type_);                                             \
-    return to_##name##_unchecked();                                          \
-  }                                                                          \
-  ctype to_##name##_unchecked() const {                                      \
-    auto p = bit_pattern_;                                                   \
-    return p_to_v;                                                           \
+  WasmValue() : type_(kWasmStmt), bit_pattern_{} {}
+
+#define DEFINE_TYPE_SPECIFIC_METHODS(name, localtype, ctype)                   \
+  explicit WasmValue(ctype v) : type_(localtype), bit_pattern_{} {             \
+    static_assert(sizeof(ctype) <= sizeof(bit_pattern_),                       \
+                  "size too big for WasmValue");                               \
+    WriteUnalignedValue<ctype>(reinterpret_cast<Address>(bit_pattern_), v);    \
+  }                                                                            \
+  ctype to_##name() const {                                                    \
+    DCHECK_EQ(localtype, type_);                                               \
+    return to_##name##_unchecked();                                            \
+  }                                                                            \
+  ctype to_##name##_unchecked() const {                                        \
+    return ReadUnalignedValue<ctype>(reinterpret_cast<Address>(bit_pattern_)); \
   }
   FOREACH_WASMVAL_TYPE(DEFINE_TYPE_SPECIFIC_METHODS)
 #undef DEFINE_TYPE_SPECIFIC_METHODS
@@ -54,7 +89,8 @@ class WasmValue {
 
   // Checks equality of type and bit pattern (also for float and double values).
   bool operator==(const WasmValue& other) const {
-    return type_ == other.type_ && bit_pattern_ == other.bit_pattern_;
+    return type_ == other.type_ &&
+           !memcmp(bit_pattern_, other.bit_pattern_, 16);
   }
 
   template <typename T>
@@ -65,7 +101,7 @@ class WasmValue {
 
  private:
   ValueType type_;
-  uint64_t bit_pattern_;
+  uint8_t bit_pattern_[16];
 };
 
 #define DECLARE_CAST(name, localtype, ctype, ...) \
diff --git a/deps/v8/src/x64/assembler-x64-inl.h b/deps/v8/src/x64/assembler-x64-inl.h
index 3d3608cea7ac76..559ebedc1dee2c 100644
--- a/deps/v8/src/x64/assembler-x64-inl.h
+++ b/deps/v8/src/x64/assembler-x64-inl.h
@@ -24,51 +24,34 @@ bool CpuFeatures::SupportsWasmSimd128() { return IsSupported(SSE4_1); }
 
 
 void Assembler::emitl(uint32_t x) {
-  Memory::uint32_at(pc_) = x;
+  Memory::uint32_at(reinterpret_cast<Address>(pc_)) = x;
   pc_ += sizeof(uint32_t);
 }
 
-
-void Assembler::emitp(void* x, RelocInfo::Mode rmode) {
-  uintptr_t value = reinterpret_cast<uintptr_t>(x);
-  Memory::uintptr_at(pc_) = value;
+void Assembler::emitp(Address x, RelocInfo::Mode rmode) {
+  Memory::uintptr_at(reinterpret_cast<Address>(pc_)) = x;
   if (!RelocInfo::IsNone(rmode)) {
-    RecordRelocInfo(rmode, value);
+    RecordRelocInfo(rmode, x);
   }
   pc_ += sizeof(uintptr_t);
 }
 
 
 void Assembler::emitq(uint64_t x) {
-  Memory::uint64_at(pc_) = x;
+  Memory::uint64_at(reinterpret_cast<Address>(pc_)) = x;
   pc_ += sizeof(uint64_t);
 }
 
 
 void Assembler::emitw(uint16_t x) {
-  Memory::uint16_at(pc_) = x;
+  Memory::uint16_at(reinterpret_cast<Address>(pc_)) = x;
   pc_ += sizeof(uint16_t);
 }
 
-void Assembler::emit_code_target(Handle<Code> target, RelocInfo::Mode rmode) {
-  DCHECK(RelocInfo::IsCodeTarget(rmode));
-  RecordRelocInfo(rmode);
-  int current = static_cast<int>(code_targets_.size());
-  if (current > 0 && !target.is_null() &&
-      code_targets_.back().address() == target.address()) {
-    // Optimization if we keep jumping to the same code target.
-    emitl(current - 1);
-  } else {
-    code_targets_.push_back(target);
-    emitl(current);
-  }
-}
-
-
 void Assembler::emit_runtime_entry(Address entry, RelocInfo::Mode rmode) {
   DCHECK(RelocInfo::IsRuntimeEntry(rmode));
   RecordRelocInfo(rmode);
-  emitl(static_cast<uint32_t>(entry - isolate_data().code_range_start_));
+  emitl(static_cast<uint32_t>(entry - options().code_range_start));
 }
 
 void Assembler::emit(Immediate x) {
@@ -271,15 +254,20 @@ Address Assembler::target_address_from_return_address(Address pc) {
 void Assembler::deserialization_set_special_target_at(
     Address instruction_payload, Code* code, Address target) {
   set_target_address_at(instruction_payload,
-                        code ? code->constant_pool() : nullptr, target);
+                        code ? code->constant_pool() : kNullAddress, target);
+}
+
+int Assembler::deserialization_special_target_size(
+    Address instruction_payload) {
+  return kSpecialTargetSize;
 }
 
 Handle<Code> Assembler::code_target_object_handle_at(Address pc) {
-  return code_targets_[Memory::int32_at(pc)];
+  return GetCodeTarget(Memory::int32_at(pc));
 }
 
 Address Assembler::runtime_entry_at(Address pc) {
-  return Memory::int32_at(pc) + isolate_data().code_range_start_;
+  return Memory::int32_at(pc) + options().code_range_start;
 }
 
 // -----------------------------------------------------------------------------
@@ -303,9 +291,9 @@ Address RelocInfo::target_address() {
 
 Address RelocInfo::target_address_address() {
   DCHECK(IsCodeTarget(rmode_) || IsRuntimeEntry(rmode_) || IsWasmCall(rmode_) ||
-         IsEmbeddedObject(rmode_) || IsExternalReference(rmode_) ||
-         IsOffHeapTarget(rmode_));
-  return reinterpret_cast<Address>(pc_);
+         IsWasmStubCall(rmode_) || IsEmbeddedObject(rmode_) ||
+         IsExternalReference(rmode_) || IsOffHeapTarget(rmode_));
+  return pc_;
 }
 
 
@@ -336,15 +324,6 @@ Handle<HeapObject> RelocInfo::target_object_handle(Assembler* origin) {
   }
 }
 
-void RelocInfo::set_wasm_code_table_entry(Address target,
-                                          ICacheFlushMode icache_flush_mode) {
-  DCHECK(rmode_ == RelocInfo::WASM_CODE_TABLE_ENTRY);
-  Memory::Address_at(pc_) = target;
-  if (icache_flush_mode != SKIP_ICACHE_FLUSH) {
-    Assembler::FlushICache(pc_, sizeof(Address));
-  }
-}
-
 Address RelocInfo::target_external_reference() {
   DCHECK(rmode_ == RelocInfo::EXTERNAL_REFERENCE);
   return Memory::Address_at(pc_);
@@ -367,10 +346,10 @@ Address RelocInfo::target_internal_reference() {
 
 Address RelocInfo::target_internal_reference_address() {
   DCHECK(rmode_ == INTERNAL_REFERENCE);
-  return reinterpret_cast<Address>(pc_);
+  return pc_;
 }
 
-void RelocInfo::set_target_object(HeapObject* target,
+void RelocInfo::set_target_object(Heap* heap, HeapObject* target,
                                   WriteBarrierMode write_barrier_mode,
                                   ICacheFlushMode icache_flush_mode) {
   DCHECK(IsCodeTarget(rmode_) || rmode_ == EMBEDDED_OBJECT);
@@ -379,9 +358,8 @@ void RelocInfo::set_target_object(HeapObject* target,
     Assembler::FlushICache(pc_, sizeof(Address));
   }
   if (write_barrier_mode == UPDATE_WRITE_BARRIER && host() != nullptr) {
-    host()->GetHeap()->incremental_marking()->RecordWriteIntoCode(host(), this,
-                                                                  target);
-    host()->GetHeap()->RecordWriteIntoCode(host(), this, target);
+    heap->incremental_marking()->RecordWriteIntoCode(host(), this, target);
+    heap->RecordWriteIntoCode(host(), this, target);
   }
 }
 
@@ -408,7 +386,7 @@ Address RelocInfo::target_off_heap_target() {
 void RelocInfo::WipeOut() {
   if (IsEmbeddedObject(rmode_) || IsExternalReference(rmode_) ||
       IsInternalReference(rmode_)) {
-    Memory::Address_at(pc_) = nullptr;
+    Memory::Address_at(pc_) = kNullAddress;
   } else if (IsCodeTarget(rmode_) || IsRuntimeEntry(rmode_)) {
     // Effectively write zero into the relocation.
     Assembler::set_target_address_at(pc_, constant_pool_,
@@ -424,7 +402,7 @@ void RelocInfo::Visit(ObjectVisitor* visitor) {
   if (mode == RelocInfo::EMBEDDED_OBJECT) {
     visitor->VisitEmbeddedPointer(host(), this);
     Assembler::FlushICache(pc_, sizeof(Address));
-  } else if (RelocInfo::IsCodeTarget(mode)) {
+  } else if (RelocInfo::IsCodeTargetMode(mode)) {
     visitor->VisitCodeTarget(host(), this);
   } else if (mode == RelocInfo::EXTERNAL_REFERENCE) {
     visitor->VisitExternalReference(host(), this);
diff --git a/deps/v8/src/x64/assembler-x64.cc b/deps/v8/src/x64/assembler-x64.cc
index 6f1eaab9ed9e7d..029f1826a324ef 100644
--- a/deps/v8/src/x64/assembler-x64.cc
+++ b/deps/v8/src/x64/assembler-x64.cc
@@ -19,6 +19,7 @@
 #include "src/base/bits.h"
 #include "src/base/cpu.h"
 #include "src/code-stubs.h"
+#include "src/deoptimizer.h"
 #include "src/macro-assembler.h"
 #include "src/v8.h"
 
@@ -123,35 +124,23 @@ void CpuFeatures::PrintFeatures() {
 // -----------------------------------------------------------------------------
 // Implementation of RelocInfo
 
-Address RelocInfo::embedded_address() const { return Memory::Address_at(pc_); }
-
-uint32_t RelocInfo::embedded_size() const { return Memory::uint32_at(pc_); }
-
-void RelocInfo::set_embedded_address(Address address,
-                                     ICacheFlushMode icache_flush_mode) {
+void RelocInfo::set_js_to_wasm_address(Address address,
+                                       ICacheFlushMode icache_flush_mode) {
+  DCHECK_EQ(rmode_, JS_TO_WASM_CALL);
   Memory::Address_at(pc_) = address;
   if (icache_flush_mode != SKIP_ICACHE_FLUSH) {
     Assembler::FlushICache(pc_, sizeof(Address));
   }
 }
 
-void RelocInfo::set_embedded_size(uint32_t size,
-                                  ICacheFlushMode icache_flush_mode) {
-  Memory::uint32_at(pc_) = size;
-  if (icache_flush_mode != SKIP_ICACHE_FLUSH) {
-    Assembler::FlushICache(pc_, sizeof(uint32_t));
-  }
-}
-
-void RelocInfo::set_js_to_wasm_address(Address address,
-                                       ICacheFlushMode icache_flush_mode) {
+Address RelocInfo::js_to_wasm_address() const {
   DCHECK_EQ(rmode_, JS_TO_WASM_CALL);
-  set_embedded_address(address, icache_flush_mode);
+  return Memory::Address_at(pc_);
 }
 
-Address RelocInfo::js_to_wasm_address() const {
-  DCHECK_EQ(rmode_, JS_TO_WASM_CALL);
-  return embedded_address();
+uint32_t RelocInfo::wasm_call_tag() const {
+  DCHECK(rmode_ == WASM_CALL || rmode_ == WASM_STUB_CALL);
+  return Memory::uint32_at(pc_);
 }
 
 // -----------------------------------------------------------------------------
@@ -240,7 +229,8 @@ class OperandBuilder {
       // Need 32 bits of displacement, mode 2 or mode 1 with register rbp/r13.
       data_.buf[0] = (modrm & 0x3F) | (is_baseless ? 0x00 : 0x80);
       data_.len = disp_offset + 4;
-      Memory::int32_at(&data_.buf[disp_offset]) = disp_value;
+      Memory::int32_at(reinterpret_cast<Address>(&data_.buf[disp_offset])) =
+          disp_value;
     } else if (disp_value != 0 || (base_reg == 0x05)) {
       // Need 8 bits of displacement.
       data_.buf[0] = (modrm & 0x3F) | 0x40;  // Mode 1.
@@ -346,17 +336,17 @@ bool Operand::AddressUsesRegister(Register reg) const {
 
 void Assembler::AllocateAndInstallRequestedHeapObjects(Isolate* isolate) {
   for (auto& request : heap_object_requests_) {
-    Address pc = buffer_ + request.offset();
+    Address pc = reinterpret_cast<Address>(buffer_) + request.offset();
     switch (request.kind()) {
       case HeapObjectRequest::kHeapNumber: {
-        Handle<HeapNumber> object = isolate->factory()->NewHeapNumber(
-            request.heap_number(), IMMUTABLE, TENURED);
+        Handle<HeapNumber> object =
+            isolate->factory()->NewHeapNumber(request.heap_number(), TENURED);
         Memory::Object_Handle_at(pc) = object;
         break;
       }
       case HeapObjectRequest::kCodeStub: {
         request.code_stub()->set_isolate(isolate);
-        code_targets_[Memory::int32_at(pc)] = request.code_stub()->GetCode();
+        UpdateCodeTarget(Memory::int32_at(pc), request.code_stub()->GetCode());
         break;
       }
     }
@@ -366,8 +356,9 @@ void Assembler::AllocateAndInstallRequestedHeapObjects(Isolate* isolate) {
 // -----------------------------------------------------------------------------
 // Implementation of Assembler.
 
-Assembler::Assembler(IsolateData isolate_data, void* buffer, int buffer_size)
-    : AssemblerBase(isolate_data, buffer, buffer_size) {
+Assembler::Assembler(const AssemblerOptions& options, void* buffer,
+                     int buffer_size)
+    : AssemblerBase(options, buffer, buffer_size) {
 // Clear the buffer in debug mode unless it was provided by the
 // caller in which case we can't be sure it's okay to overwrite
 // existing code in it.
@@ -377,7 +368,7 @@ Assembler::Assembler(IsolateData isolate_data, void* buffer, int buffer_size)
   }
 #endif
 
-  code_targets_.reserve(100);
+  ReserveCodeTargetSpace(100);
   reloc_info_writer.Reposition(buffer_ + buffer_size_, pc_);
 }
 
@@ -438,7 +429,7 @@ void Assembler::CodeTargetAlign() {
 
 
 bool Assembler::IsNop(Address addr) {
-  Address a = addr;
+  byte* a = reinterpret_cast<byte*>(addr);
   while (*a == 0x66) a++;
   if (*a == 0x90) return true;
   if (a[0] == 0xF && a[1] == 0x1F) return true;
@@ -991,20 +982,25 @@ void Assembler::call(CodeStub* stub) {
   // 1110 1000 #32-bit disp.
   emit(0xE8);
   RequestHeapObject(HeapObjectRequest(stub));
-  emit_code_target(Handle<Code>(), RelocInfo::CODE_TARGET);
+  RecordRelocInfo(RelocInfo::CODE_TARGET);
+  int code_target_index = AddCodeTarget(Handle<Code>());
+  emitl(code_target_index);
 }
 
 void Assembler::call(Handle<Code> target, RelocInfo::Mode rmode) {
+  DCHECK(RelocInfo::IsCodeTarget(rmode));
   EnsureSpace ensure_space(this);
   // 1110 1000 #32-bit disp.
   emit(0xE8);
-  emit_code_target(target, rmode);
+  RecordRelocInfo(rmode);
+  int code_target_index = AddCodeTarget(target);
+  emitl(code_target_index);
 }
 
 void Assembler::near_call(Address addr, RelocInfo::Mode rmode) {
   EnsureSpace ensure_space(this);
   emit(0xE8);
-  intptr_t value = reinterpret_cast<intptr_t>(addr);
+  intptr_t value = static_cast<intptr_t>(addr);
   DCHECK(is_int32(value));
   RecordRelocInfo(rmode);
   emitl(static_cast<int32_t>(value));
@@ -1013,7 +1009,7 @@ void Assembler::near_call(Address addr, RelocInfo::Mode rmode) {
 void Assembler::near_jmp(Address addr, RelocInfo::Mode rmode) {
   EnsureSpace ensure_space(this);
   emit(0xE9);
-  intptr_t value = reinterpret_cast<intptr_t>(addr);
+  intptr_t value = static_cast<intptr_t>(addr);
   DCHECK(is_int32(value));
   RecordRelocInfo(rmode);
   emitl(static_cast<int32_t>(value));
@@ -1044,7 +1040,7 @@ void Assembler::call(Address target) {
   EnsureSpace ensure_space(this);
   // 1110 1000 #32-bit disp.
   emit(0xE8);
-  Address source = pc_ + 4;
+  Address source = reinterpret_cast<Address>(pc_) + 4;
   intptr_t displacement = target - source;
   DCHECK(is_int32(displacement));
   emitl(static_cast<int32_t>(displacement));
@@ -1429,12 +1425,21 @@ void Assembler::j(Condition cc, Address entry, RelocInfo::Mode rmode) {
 void Assembler::j(Condition cc,
                   Handle<Code> target,
                   RelocInfo::Mode rmode) {
+  if (cc == always) {
+    jmp(target, rmode);
+    return;
+  } else if (cc == never) {
+    return;
+  }
   EnsureSpace ensure_space(this);
   DCHECK(is_uint4(cc));
   // 0000 1111 1000 tttn #32-bit disp.
   emit(0x0F);
   emit(0x80 | cc);
-  emit_code_target(target, rmode);
+  DCHECK(RelocInfo::IsCodeTarget(rmode));
+  RecordRelocInfo(rmode);
+  int code_target_index = AddCodeTarget(target);
+  emitl(code_target_index);
 }
 
 
@@ -1495,10 +1500,13 @@ void Assembler::jmp(Label* L, Label::Distance distance) {
 
 
 void Assembler::jmp(Handle<Code> target, RelocInfo::Mode rmode) {
+  DCHECK(RelocInfo::IsCodeTarget(rmode));
   EnsureSpace ensure_space(this);
   // 1110 1001 #32-bit disp.
   emit(0xE9);
-  emit_code_target(target, rmode);
+  RecordRelocInfo(rmode);
+  int code_target_index = AddCodeTarget(target);
+  emitl(code_target_index);
 }
 
 
@@ -1525,8 +1533,7 @@ void Assembler::emit_lea(Register dst, Operand src, int size) {
   emit_operand(dst, src);
 }
 
-
-void Assembler::load_rax(void* value, RelocInfo::Mode mode) {
+void Assembler::load_rax(Address value, RelocInfo::Mode mode) {
   EnsureSpace ensure_space(this);
   if (kPointerSize == kInt64Size) {
     emit(0x48);  // REX.W
@@ -1673,8 +1680,7 @@ void Assembler::emit_mov(Operand dst, Immediate value, int size) {
   emit(value);
 }
 
-
-void Assembler::movp(Register dst, void* value, RelocInfo::Mode rmode) {
+void Assembler::movp(Register dst, Address value, RelocInfo::Mode rmode) {
   EnsureSpace ensure_space(this);
   emit_rex(dst, kPointerSize);
   emit(0xB8 | dst.low_bits());
@@ -1686,7 +1692,7 @@ void Assembler::movp_heap_number(Register dst, double value) {
   emit_rex(dst, kPointerSize);
   emit(0xB8 | dst.low_bits());
   RequestHeapObject(HeapObjectRequest(value));
-  emitp(nullptr, RelocInfo::EMBEDDED_OBJECT);
+  emitp(0, RelocInfo::EMBEDDED_OBJECT);
 }
 
 void Assembler::movq(Register dst, int64_t value, RelocInfo::Mode rmode) {
@@ -2178,8 +2184,7 @@ void Assembler::emit_xchg(Register dst, Operand src, int size) {
   emit_operand(dst, src);
 }
 
-
-void Assembler::store_rax(void* dst, RelocInfo::Mode mode) {
+void Assembler::store_rax(Address dst, RelocInfo::Mode mode) {
   EnsureSpace ensure_space(this);
   if (kPointerSize == kInt64Size) {
     emit(0x48);  // REX.W
@@ -4816,7 +4821,8 @@ void Assembler::dq(Label* label) {
   EnsureSpace ensure_space(this);
   if (label->is_bound()) {
     internal_reference_positions_.push_back(pc_offset());
-    emitp(buffer_ + label->pos(), RelocInfo::INTERNAL_REFERENCE);
+    emitp(reinterpret_cast<Address>(buffer_) + label->pos(),
+          RelocInfo::INTERNAL_REFERENCE);
   } else {
     RecordRelocInfo(RelocInfo::INTERNAL_REFERENCE);
     emitl(0);  // Zero for the first 32bit marks it as 64bit absolute address.
@@ -4837,18 +4843,19 @@ void Assembler::dq(Label* label) {
 
 void Assembler::RecordRelocInfo(RelocInfo::Mode rmode, intptr_t data) {
   DCHECK(!RelocInfo::IsNone(rmode));
-  // Don't record external references unless the heap will be serialized.
-  if (rmode == RelocInfo::EXTERNAL_REFERENCE &&
-      !serializer_enabled() && !emit_debug_code()) {
+  if (RelocInfo::IsOnlyForSerializer(rmode) &&
+      !options().record_reloc_info_for_serialization && !emit_debug_code()) {
     return;
   }
-  RelocInfo rinfo(pc_, rmode, data, nullptr);
+  RelocInfo rinfo(reinterpret_cast<Address>(pc_), rmode, data, nullptr);
   reloc_info_writer.Write(&rinfo);
 }
 
 const int RelocInfo::kApplyMask =
-    RelocInfo::kCodeTargetMask | 1 << RelocInfo::RUNTIME_ENTRY |
-    1 << RelocInfo::INTERNAL_REFERENCE | 1 << RelocInfo::WASM_CALL;
+    RelocInfo::ModeMask(RelocInfo::CODE_TARGET) |
+    RelocInfo::ModeMask(RelocInfo::RUNTIME_ENTRY) |
+    RelocInfo::ModeMask(RelocInfo::INTERNAL_REFERENCE) |
+    RelocInfo::ModeMask(RelocInfo::WASM_CALL);
 
 bool RelocInfo::IsCodedSpecially() {
   // The deserializer needs to know whether a pointer is specially coded.  Being
@@ -4862,6 +4869,10 @@ bool RelocInfo::IsInConstantPool() {
   return false;
 }
 
+int RelocInfo::GetDeoptimizationId(Isolate* isolate, DeoptimizeKind kind) {
+  DCHECK(IsRuntimeEntry(rmode_));
+  return Deoptimizer::GetDeoptimizationId(isolate, target_address(), kind);
+}
 
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/src/x64/assembler-x64.h b/deps/v8/src/x64/assembler-x64.h
index 9e00e682e5ff06..aeff5ee06d1f81 100644
--- a/deps/v8/src/x64/assembler-x64.h
+++ b/deps/v8/src/x64/assembler-x64.h
@@ -42,6 +42,7 @@
 #include <vector>
 
 #include "src/assembler.h"
+#include "src/x64/constants-x64.h"
 #include "src/x64/sse-instr.h"
 
 namespace v8 {
@@ -449,9 +450,7 @@ class Assembler : public AssemblerBase {
   // buffer for code generation and assumes its size to be buffer_size. If the
   // buffer is too small, a fatal error occurs. No deallocation of the buffer is
   // done upon destruction of the assembler.
-  Assembler(Isolate* isolate, void* buffer, int buffer_size)
-      : Assembler(IsolateData(isolate), buffer, buffer_size) {}
-  Assembler(IsolateData isolate_data, void* buffer, int buffer_size);
+  Assembler(const AssemblerOptions& options, void* buffer, int buffer_size);
   virtual ~Assembler() {}
 
   // GetCode emits any pending (non-emitted) code and fills the descriptor
@@ -481,6 +480,10 @@ class Assembler : public AssemblerBase {
   inline static void deserialization_set_special_target_at(
       Address instruction_payload, Code* code, Address target);
 
+  // Get the size of the special target encoded at 'instruction_payload'.
+  inline static int deserialization_special_target_size(
+      Address instruction_payload);
+
   // This sets the internal reference at the pc.
   inline static void deserialization_set_target_internal_reference_at(
       Address pc, Address target,
@@ -488,6 +491,7 @@ class Assembler : public AssemblerBase {
 
   inline Handle<Code> code_target_object_handle_at(Address pc);
   inline Address runtime_entry_at(Address pc);
+
   // Number of bytes taken up by the branch target in the code.
   static constexpr int kSpecialTargetSize = 4;  // 32-bit displacement.
   // Distance between the address of the code target in the call instruction
@@ -637,7 +641,7 @@ class Assembler : public AssemblerBase {
   void movl(Operand dst, Label* src);
 
   // Loads a pointer into a register with a relocation mode.
-  void movp(Register dst, void* ptr, RelocInfo::Mode rmode);
+  void movp(Register dst, Address ptr, RelocInfo::Mode rmode);
 
   // Load a heap number into a register.
   // The heap number will not be allocated and embedded into the code right
@@ -674,7 +678,7 @@ class Assembler : public AssemblerBase {
   void repmovsq() { emit_repmovs(kInt64Size); }
 
   // Instruction to load from an immediate 64-bit pointer into RAX.
-  void load_rax(void* ptr, RelocInfo::Mode rmode);
+  void load_rax(Address value, RelocInfo::Mode rmode);
   void load_rax(ExternalReference ext);
 
   // Conditional moves.
@@ -793,7 +797,7 @@ class Assembler : public AssemblerBase {
   // Shifts src:dst right by cl bits, affecting only dst.
   void shrd(Register dst, Register src);
 
-  void store_rax(void* dst, RelocInfo::Mode mode);
+  void store_rax(Address dst, RelocInfo::Mode mode);
   void store_rax(ExternalReference ref);
 
   void subb(Register dst, Immediate src) {
@@ -1910,8 +1914,6 @@ class Assembler : public AssemblerBase {
   byte byte_at(int pos)  { return buffer_[pos]; }
   void set_byte_at(int pos, byte value) { buffer_[pos] = value; }
 
-  Address pc() const { return pc_; }
-
  protected:
   // Call near indirect
   void call(Operand operand);
@@ -1930,10 +1932,9 @@ class Assembler : public AssemblerBase {
 
   void emit(byte x) { *pc_++ = x; }
   inline void emitl(uint32_t x);
-  inline void emitp(void* x, RelocInfo::Mode rmode);
+  inline void emitp(Address x, RelocInfo::Mode rmode);
   inline void emitq(uint64_t x);
   inline void emitw(uint16_t x);
-  inline void emit_code_target(Handle<Code> target, RelocInfo::Mode rmode);
   inline void emit_runtime_entry(Address entry, RelocInfo::Mode rmode);
   inline void emit(Immediate x);
 
@@ -2356,6 +2357,8 @@ class Assembler : public AssemblerBase {
 
   bool is_optimizable_farjmp(int idx);
 
+  void AllocateAndInstallRequestedHeapObjects(Isolate* isolate);
+
   friend class EnsureSpace;
   friend class RegExpMacroAssemblerX64;
 
@@ -2367,21 +2370,6 @@ class Assembler : public AssemblerBase {
   // are already bound.
   std::deque<int> internal_reference_positions_;
 
-  std::vector<Handle<Code>> code_targets_;
-
-  // The following functions help with avoiding allocations of embedded heap
-  // objects during the code assembly phase. {RequestHeapObject} records the
-  // need for a future heap number allocation or code stub generation. After
-  // code assembly, {AllocateAndInstallRequestedHeapObjects} will allocate these
-  // objects and place them where they are expected (determined by the pc offset
-  // associated with each request). That is, for each request, it will patch the
-  // dummy heap object handle that we emitted during code assembly with the
-  // actual heap object handle.
-  void RequestHeapObject(HeapObjectRequest request);
-  void AllocateAndInstallRequestedHeapObjects(Isolate* isolate);
-
-  std::forward_list<HeapObjectRequest> heap_object_requests_;
-
   // Variables for this instance of assembler
   int farjmp_num_ = 0;
   std::deque<int> farjmp_positions_;
diff --git a/deps/v8/src/x64/code-stubs-x64.cc b/deps/v8/src/x64/code-stubs-x64.cc
index fc98006f781a6f..5fe2d13201822e 100644
--- a/deps/v8/src/x64/code-stubs-x64.cc
+++ b/deps/v8/src/x64/code-stubs-x64.cc
@@ -16,6 +16,7 @@
 #include "src/ic/stub-cache.h"
 #include "src/isolate.h"
 #include "src/objects-inl.h"
+#include "src/objects/api-callbacks.h"
 #include "src/objects/regexp-match-info.h"
 #include "src/regexp/jsregexp.h"
 #include "src/regexp/regexp-macro-assembler.h"
@@ -26,404 +27,6 @@ namespace internal {
 
 #define __ ACCESS_MASM(masm)
 
-void ArrayNArgumentsConstructorStub::Generate(MacroAssembler* masm) {
-  __ popq(rcx);
-  __ movq(MemOperand(rsp, rax, times_8, 0), rdi);
-  __ pushq(rdi);
-  __ pushq(rbx);
-  __ pushq(rcx);
-  __ addq(rax, Immediate(3));
-  __ TailCallRuntime(Runtime::kNewArray);
-}
-
-
-void DoubleToIStub::Generate(MacroAssembler* masm) {
-    Register final_result_reg = this->destination();
-
-    Label check_negative, process_64_bits, done;
-
-    // Account for return address and saved regs.
-    const int kArgumentOffset = 3 * kRegisterSize;
-
-    MemOperand mantissa_operand(MemOperand(rsp, kArgumentOffset));
-    MemOperand exponent_operand(
-        MemOperand(rsp, kArgumentOffset + kDoubleSize / 2));
-
-    Register scratch1 = no_reg;
-    Register scratch_candidates[3] = { rbx, rdx, rdi };
-    for (int i = 0; i < 3; i++) {
-      scratch1 = scratch_candidates[i];
-      if (final_result_reg != scratch1) break;
-    }
-
-    // Since we must use rcx for shifts below, use some other register (rax)
-    // to calculate the result if ecx is the requested return register.
-    Register result_reg = final_result_reg == rcx ? rax : final_result_reg;
-    // Save ecx if it isn't the return register and therefore volatile, or if it
-    // is the return register, then save the temp register we use in its stead
-    // for the result.
-    Register save_reg = final_result_reg == rcx ? rax : rcx;
-    __ pushq(scratch1);
-    __ pushq(save_reg);
-
-    __ movl(scratch1, mantissa_operand);
-    __ Movsd(kScratchDoubleReg, mantissa_operand);
-    __ movl(rcx, exponent_operand);
-
-    __ andl(rcx, Immediate(HeapNumber::kExponentMask));
-    __ shrl(rcx, Immediate(HeapNumber::kExponentShift));
-    __ leal(result_reg, MemOperand(rcx, -HeapNumber::kExponentBias));
-    __ cmpl(result_reg, Immediate(HeapNumber::kMantissaBits));
-    __ j(below, &process_64_bits);
-
-    // Result is entirely in lower 32-bits of mantissa
-    int delta = HeapNumber::kExponentBias + Double::kPhysicalSignificandSize;
-    __ subl(rcx, Immediate(delta));
-    __ xorl(result_reg, result_reg);
-    __ cmpl(rcx, Immediate(31));
-    __ j(above, &done);
-    __ shll_cl(scratch1);
-    __ jmp(&check_negative);
-
-    __ bind(&process_64_bits);
-    __ Cvttsd2siq(result_reg, kScratchDoubleReg);
-    __ jmp(&done, Label::kNear);
-
-    // If the double was negative, negate the integer result.
-    __ bind(&check_negative);
-    __ movl(result_reg, scratch1);
-    __ negl(result_reg);
-    __ cmpl(exponent_operand, Immediate(0));
-    __ cmovl(greater, result_reg, scratch1);
-
-    // Restore registers
-    __ bind(&done);
-    if (final_result_reg != result_reg) {
-      DCHECK(final_result_reg == rcx);
-      __ movl(final_result_reg, result_reg);
-    }
-    __ popq(save_reg);
-    __ popq(scratch1);
-    __ ret(0);
-}
-
-void MathPowStub::Generate(MacroAssembler* masm) {
-  const Register exponent = MathPowTaggedDescriptor::exponent();
-  DCHECK(exponent == rdx);
-  const Register scratch = rcx;
-  const XMMRegister double_result = xmm3;
-  const XMMRegister double_base = xmm2;
-  const XMMRegister double_exponent = xmm1;
-  const XMMRegister double_scratch = xmm4;
-
-  Label call_runtime, done, exponent_not_smi, int_exponent;
-
-  // Save 1 in double_result - we need this several times later on.
-  __ movp(scratch, Immediate(1));
-  __ Cvtlsi2sd(double_result, scratch);
-
-  Label fast_power, try_arithmetic_simplification;
-  // Detect integer exponents stored as double.
-  __ DoubleToI(exponent, double_exponent, double_scratch,
-               &try_arithmetic_simplification, &try_arithmetic_simplification);
-  __ jmp(&int_exponent);
-
-  __ bind(&try_arithmetic_simplification);
-  __ Cvttsd2si(exponent, double_exponent);
-  // Skip to runtime if possibly NaN (indicated by the indefinite integer).
-  __ cmpl(exponent, Immediate(0x1));
-  __ j(overflow, &call_runtime);
-
-  // Using FPU instructions to calculate power.
-  Label fast_power_failed;
-  __ bind(&fast_power);
-  __ fnclex();  // Clear flags to catch exceptions later.
-  // Transfer (B)ase and (E)xponent onto the FPU register stack.
-  __ subp(rsp, Immediate(kDoubleSize));
-  __ Movsd(Operand(rsp, 0), double_exponent);
-  __ fld_d(Operand(rsp, 0));  // E
-  __ Movsd(Operand(rsp, 0), double_base);
-  __ fld_d(Operand(rsp, 0));  // B, E
-
-  // Exponent is in st(1) and base is in st(0)
-  // B ^ E = (2^(E * log2(B)) - 1) + 1 = (2^X - 1) + 1 for X = E * log2(B)
-  // FYL2X calculates st(1) * log2(st(0))
-  __ fyl2x();    // X
-  __ fld(0);     // X, X
-  __ frndint();  // rnd(X), X
-  __ fsub(1);    // rnd(X), X-rnd(X)
-  __ fxch(1);    // X - rnd(X), rnd(X)
-  // F2XM1 calculates 2^st(0) - 1 for -1 < st(0) < 1
-  __ f2xm1();   // 2^(X-rnd(X)) - 1, rnd(X)
-  __ fld1();    // 1, 2^(X-rnd(X)) - 1, rnd(X)
-  __ faddp(1);  // 2^(X-rnd(X)), rnd(X)
-  // FSCALE calculates st(0) * 2^st(1)
-  __ fscale();  // 2^X, rnd(X)
-  __ fstp(1);
-  // Bail out to runtime in case of exceptions in the status word.
-  __ fnstsw_ax();
-  __ testb(rax, Immediate(0x5F));  // Check for all but precision exception.
-  __ j(not_zero, &fast_power_failed, Label::kNear);
-  __ fstp_d(Operand(rsp, 0));
-  __ Movsd(double_result, Operand(rsp, 0));
-  __ addp(rsp, Immediate(kDoubleSize));
-  __ jmp(&done);
-
-  __ bind(&fast_power_failed);
-  __ fninit();
-  __ addp(rsp, Immediate(kDoubleSize));
-  __ jmp(&call_runtime);
-
-  // Calculate power with integer exponent.
-  __ bind(&int_exponent);
-  const XMMRegister double_scratch2 = double_exponent;
-  // Back up exponent as we need to check if exponent is negative later.
-  __ movp(scratch, exponent);  // Back up exponent.
-  __ Movsd(double_scratch, double_base);     // Back up base.
-  __ Movsd(double_scratch2, double_result);  // Load double_exponent with 1.
-
-  // Get absolute value of exponent.
-  Label no_neg, while_true, while_false;
-  __ testl(scratch, scratch);
-  __ j(positive, &no_neg, Label::kNear);
-  __ negl(scratch);
-  __ bind(&no_neg);
-
-  __ j(zero, &while_false, Label::kNear);
-  __ shrl(scratch, Immediate(1));
-  // Above condition means CF==0 && ZF==0.  This means that the
-  // bit that has been shifted out is 0 and the result is not 0.
-  __ j(above, &while_true, Label::kNear);
-  __ Movsd(double_result, double_scratch);
-  __ j(zero, &while_false, Label::kNear);
-
-  __ bind(&while_true);
-  __ shrl(scratch, Immediate(1));
-  __ Mulsd(double_scratch, double_scratch);
-  __ j(above, &while_true, Label::kNear);
-  __ Mulsd(double_result, double_scratch);
-  __ j(not_zero, &while_true);
-
-  __ bind(&while_false);
-  // If the exponent is negative, return 1/result.
-  __ testl(exponent, exponent);
-  __ j(greater, &done);
-  __ Divsd(double_scratch2, double_result);
-  __ Movsd(double_result, double_scratch2);
-  // Test whether result is zero.  Bail out to check for subnormal result.
-  // Due to subnormals, x^-y == (1/x)^y does not hold in all cases.
-  __ Xorpd(double_scratch2, double_scratch2);
-  __ Ucomisd(double_scratch2, double_result);
-  // double_exponent aliased as double_scratch2 has already been overwritten
-  // and may not have contained the exponent value in the first place when the
-  // input was a smi.  We reset it with exponent value before bailing out.
-  __ j(not_equal, &done);
-  __ Cvtlsi2sd(double_exponent, exponent);
-
-  // Returning or bailing out.
-  __ bind(&call_runtime);
-  // Move base to the correct argument register.  Exponent is already in xmm1.
-  __ Movsd(xmm0, double_base);
-  DCHECK(double_exponent == xmm1);
-  {
-    AllowExternalCallThatCantCauseGC scope(masm);
-    __ PrepareCallCFunction(2);
-    __ CallCFunction(ExternalReference::power_double_double_function(isolate()),
-                     2);
-  }
-  // Return value is in xmm0.
-  __ Movsd(double_result, xmm0);
-
-  __ bind(&done);
-  __ ret(0);
-}
-
-Movability CEntryStub::NeedsImmovableCode() { return kMovable; }
-
-void CodeStub::GenerateStubsAheadOfTime(Isolate* isolate) {
-  CEntryStub::GenerateAheadOfTime(isolate);
-  // It is important that the store buffer overflow stubs are generated first.
-  CommonArrayConstructorStub::GenerateStubsAheadOfTime(isolate);
-  StoreFastElementStub::GenerateAheadOfTime(isolate);
-}
-
-
-void CodeStub::GenerateFPStubs(Isolate* isolate) {
-}
-
-
-void CEntryStub::GenerateAheadOfTime(Isolate* isolate) {
-  CEntryStub stub(isolate, 1, kDontSaveFPRegs);
-  stub.GetCode();
-  CEntryStub save_doubles(isolate, 1, kSaveFPRegs);
-  save_doubles.GetCode();
-}
-
-
-void CEntryStub::Generate(MacroAssembler* masm) {
-  // rax: number of arguments including receiver
-  // rbx: pointer to C function  (C callee-saved)
-  // rbp: frame pointer of calling JS frame (restored after C call)
-  // rsp: stack pointer  (restored after C call)
-  // rsi: current context (restored)
-  //
-  // If argv_in_register():
-  // r15: pointer to the first argument
-
-  ProfileEntryHookStub::MaybeCallEntryHook(masm);
-
-#ifdef _WIN64
-  // Windows 64-bit ABI passes arguments in rcx, rdx, r8, r9. It requires the
-  // stack to be aligned to 16 bytes. It only allows a single-word to be
-  // returned in register rax. Larger return sizes must be written to an address
-  // passed as a hidden first argument.
-  const Register kCCallArg0 = rcx;
-  const Register kCCallArg1 = rdx;
-  const Register kCCallArg2 = r8;
-  const Register kCCallArg3 = r9;
-  const int kArgExtraStackSpace = 2;
-  const int kMaxRegisterResultSize = 1;
-#else
-  // GCC / Clang passes arguments in rdi, rsi, rdx, rcx, r8, r9. Simple results
-  // are returned in rax, and a struct of two pointers are returned in rax+rdx.
-  // Larger return sizes must be written to an address passed as a hidden first
-  // argument.
-  const Register kCCallArg0 = rdi;
-  const Register kCCallArg1 = rsi;
-  const Register kCCallArg2 = rdx;
-  const Register kCCallArg3 = rcx;
-  const int kArgExtraStackSpace = 0;
-  const int kMaxRegisterResultSize = 2;
-#endif  // _WIN64
-
-  // Enter the exit frame that transitions from JavaScript to C++.
-  int arg_stack_space =
-      kArgExtraStackSpace +
-      (result_size() <= kMaxRegisterResultSize ? 0 : result_size());
-  if (argv_in_register()) {
-    DCHECK(!save_doubles());
-    DCHECK(!is_builtin_exit());
-    __ EnterApiExitFrame(arg_stack_space);
-    // Move argc into r14 (argv is already in r15).
-    __ movp(r14, rax);
-  } else {
-    __ EnterExitFrame(
-        arg_stack_space, save_doubles(),
-        is_builtin_exit() ? StackFrame::BUILTIN_EXIT : StackFrame::EXIT);
-  }
-
-  // rbx: pointer to builtin function  (C callee-saved).
-  // rbp: frame pointer of exit frame  (restored after C call).
-  // rsp: stack pointer (restored after C call).
-  // r14: number of arguments including receiver (C callee-saved).
-  // r15: argv pointer (C callee-saved).
-
-  // Check stack alignment.
-  if (FLAG_debug_code) {
-    __ CheckStackAlignment();
-  }
-
-  // Call C function. The arguments object will be created by stubs declared by
-  // DECLARE_RUNTIME_FUNCTION().
-  if (result_size() <= kMaxRegisterResultSize) {
-    // Pass a pointer to the Arguments object as the first argument.
-    // Return result in single register (rax), or a register pair (rax, rdx).
-    __ movp(kCCallArg0, r14);  // argc.
-    __ movp(kCCallArg1, r15);  // argv.
-    __ Move(kCCallArg2, ExternalReference::isolate_address(isolate()));
-  } else {
-    DCHECK_LE(result_size(), 2);
-    // Pass a pointer to the result location as the first argument.
-    __ leap(kCCallArg0, StackSpaceOperand(kArgExtraStackSpace));
-    // Pass a pointer to the Arguments object as the second argument.
-    __ movp(kCCallArg1, r14);  // argc.
-    __ movp(kCCallArg2, r15);  // argv.
-    __ Move(kCCallArg3, ExternalReference::isolate_address(isolate()));
-  }
-  __ call(rbx);
-
-  if (result_size() > kMaxRegisterResultSize) {
-    // Read result values stored on stack. Result is stored
-    // above the the two Arguments object slots on Win64.
-    DCHECK_LE(result_size(), 2);
-    __ movq(kReturnRegister0, StackSpaceOperand(kArgExtraStackSpace + 0));
-    __ movq(kReturnRegister1, StackSpaceOperand(kArgExtraStackSpace + 1));
-  }
-  // Result is in rax or rdx:rax - do not destroy these registers!
-
-  // Check result for exception sentinel.
-  Label exception_returned;
-  __ CompareRoot(rax, Heap::kExceptionRootIndex);
-  __ j(equal, &exception_returned);
-
-  // Check that there is no pending exception, otherwise we
-  // should have returned the exception sentinel.
-  if (FLAG_debug_code) {
-    Label okay;
-    __ LoadRoot(r14, Heap::kTheHoleValueRootIndex);
-    ExternalReference pending_exception_address(
-        IsolateAddressId::kPendingExceptionAddress, isolate());
-    Operand pending_exception_operand =
-        masm->ExternalOperand(pending_exception_address);
-    __ cmpp(r14, pending_exception_operand);
-    __ j(equal, &okay, Label::kNear);
-    __ int3();
-    __ bind(&okay);
-  }
-
-  // Exit the JavaScript to C++ exit frame.
-  __ LeaveExitFrame(save_doubles(), !argv_in_register());
-  __ ret(0);
-
-  // Handling of exception.
-  __ bind(&exception_returned);
-
-  ExternalReference pending_handler_context_address(
-      IsolateAddressId::kPendingHandlerContextAddress, isolate());
-  ExternalReference pending_handler_entrypoint_address(
-      IsolateAddressId::kPendingHandlerEntrypointAddress, isolate());
-  ExternalReference pending_handler_fp_address(
-      IsolateAddressId::kPendingHandlerFPAddress, isolate());
-  ExternalReference pending_handler_sp_address(
-      IsolateAddressId::kPendingHandlerSPAddress, isolate());
-
-  // Ask the runtime for help to determine the handler. This will set rax to
-  // contain the current pending exception, don't clobber it.
-  ExternalReference find_handler(Runtime::kUnwindAndFindExceptionHandler,
-                                 isolate());
-  {
-    FrameScope scope(masm, StackFrame::MANUAL);
-    __ movp(arg_reg_1, Immediate(0));  // argc.
-    __ movp(arg_reg_2, Immediate(0));  // argv.
-    __ Move(arg_reg_3, ExternalReference::isolate_address(isolate()));
-    __ PrepareCallCFunction(3);
-    __ CallCFunction(find_handler, 3);
-  }
-  // Retrieve the handler context, SP and FP.
-  __ movp(rsi, masm->ExternalOperand(pending_handler_context_address));
-  __ movp(rsp, masm->ExternalOperand(pending_handler_sp_address));
-  __ movp(rbp, masm->ExternalOperand(pending_handler_fp_address));
-
-  // If the handler is a JS frame, restore the context to the frame. Note that
-  // the context will be set to (rsi == 0) for non-JS frames.
-  Label skip;
-  __ testp(rsi, rsi);
-  __ j(zero, &skip, Label::kNear);
-  __ movp(Operand(rbp, StandardFrameConstants::kContextOffset), rsi);
-  __ bind(&skip);
-
-  // Reset the masking register. This is done independent of the underlying
-  // feature flag {FLAG_branch_load_poisoning} to make the snapshot work with
-  // both configurations. It is safe to always do this, because the underlying
-  // register is caller-saved and can be arbitrarily clobbered.
-  __ ResetSpeculationPoisonRegister();
-
-  // Compute the handler entry address and jump to it.
-  __ movp(rdi, masm->ExternalOperand(pending_handler_entrypoint_address));
-  __ jmp(rdi);
-}
-
-
 void JSEntryStub::Generate(MacroAssembler* masm) {
   Label invoke, handler_entry, exit;
   Label not_outermost_js, not_outermost_js_2;
@@ -431,15 +34,15 @@ void JSEntryStub::Generate(MacroAssembler* masm) {
   ProfileEntryHookStub::MaybeCallEntryHook(masm);
 
   {  // NOLINT. Scope block confuses linter.
-    MacroAssembler::NoRootArrayScope uninitialized_root_register(masm);
+    NoRootArrayScope uninitialized_root_register(masm);
     // Set up frame.
     __ pushq(rbp);
     __ movp(rbp, rsp);
 
     // Push the stack frame type.
     __ Push(Immediate(StackFrame::TypeToMarker(type())));  // context slot
-    ExternalReference context_address(IsolateAddressId::kContextAddress,
-                                      isolate());
+    ExternalReference context_address =
+        ExternalReference::Create(IsolateAddressId::kContextAddress, isolate());
     __ Load(kScratchRegister, context_address);
     __ Push(kScratchRegister);  // context
     // Save callee-saved registers (X64/X32/Win64 calling conventions).
@@ -474,14 +77,16 @@ void JSEntryStub::Generate(MacroAssembler* masm) {
   }
 
   // Save copies of the top frame descriptor on the stack.
-  ExternalReference c_entry_fp(IsolateAddressId::kCEntryFPAddress, isolate());
+  ExternalReference c_entry_fp =
+      ExternalReference::Create(IsolateAddressId::kCEntryFPAddress, isolate());
   {
     Operand c_entry_fp_operand = masm->ExternalOperand(c_entry_fp);
     __ Push(c_entry_fp_operand);
   }
 
   // If this is the outermost JS call, set js_entry_sp value.
-  ExternalReference js_entry_sp(IsolateAddressId::kJSEntrySPAddress, isolate());
+  ExternalReference js_entry_sp =
+      ExternalReference::Create(IsolateAddressId::kJSEntrySPAddress, isolate());
   __ Load(rax, js_entry_sp);
   __ testp(rax, rax);
   __ j(not_zero, &not_outermost_js);
@@ -501,7 +106,7 @@ void JSEntryStub::Generate(MacroAssembler* masm) {
   handler_offset_ = handler_entry.pos();
   // Caught exception: Store result (exception) in the pending exception
   // field in the JSEnv and return a failure sentinel.
-  ExternalReference pending_exception(
+  ExternalReference pending_exception = ExternalReference::Create(
       IsolateAddressId::kPendingExceptionAddress, isolate());
   __ Store(pending_exception, rax);
   __ LoadRoot(rax, Heap::kExceptionRootIndex);
@@ -618,305 +223,6 @@ void ProfileEntryHookStub::Generate(MacroAssembler* masm) {
   __ Ret();
 }
 
-
-template<class T>
-static void CreateArrayDispatch(MacroAssembler* masm,
-                                AllocationSiteOverrideMode mode) {
-  if (mode == DISABLE_ALLOCATION_SITES) {
-    T stub(masm->isolate(), GetInitialFastElementsKind(), mode);
-    __ TailCallStub(&stub);
-  } else if (mode == DONT_OVERRIDE) {
-    int last_index =
-        GetSequenceIndexFromFastElementsKind(TERMINAL_FAST_ELEMENTS_KIND);
-    for (int i = 0; i <= last_index; ++i) {
-      Label next;
-      ElementsKind kind = GetFastElementsKindFromSequenceIndex(i);
-      __ cmpl(rdx, Immediate(kind));
-      __ j(not_equal, &next);
-      T stub(masm->isolate(), kind);
-      __ TailCallStub(&stub);
-      __ bind(&next);
-    }
-
-    // If we reached this point there is a problem.
-    __ Abort(AbortReason::kUnexpectedElementsKindInArrayConstructor);
-  } else {
-    UNREACHABLE();
-  }
-}
-
-
-static void CreateArrayDispatchOneArgument(MacroAssembler* masm,
-                                           AllocationSiteOverrideMode mode) {
-  // rbx - allocation site (if mode != DISABLE_ALLOCATION_SITES)
-  // rdx - kind (if mode != DISABLE_ALLOCATION_SITES)
-  // rax - number of arguments
-  // rdi - constructor?
-  // rsp[0] - return address
-  // rsp[8] - last argument
-
-  STATIC_ASSERT(PACKED_SMI_ELEMENTS == 0);
-  STATIC_ASSERT(HOLEY_SMI_ELEMENTS == 1);
-  STATIC_ASSERT(PACKED_ELEMENTS == 2);
-  STATIC_ASSERT(HOLEY_ELEMENTS == 3);
-  STATIC_ASSERT(PACKED_DOUBLE_ELEMENTS == 4);
-  STATIC_ASSERT(HOLEY_DOUBLE_ELEMENTS == 5);
-
-  if (mode == DISABLE_ALLOCATION_SITES) {
-    ElementsKind initial = GetInitialFastElementsKind();
-    ElementsKind holey_initial = GetHoleyElementsKind(initial);
-
-    ArraySingleArgumentConstructorStub stub_holey(masm->isolate(),
-                                                  holey_initial,
-                                                  DISABLE_ALLOCATION_SITES);
-    __ TailCallStub(&stub_holey);
-  } else if (mode == DONT_OVERRIDE) {
-    // is the low bit set? If so, we are holey and that is good.
-    Label normal_sequence;
-    __ testb(rdx, Immediate(1));
-    __ j(not_zero, &normal_sequence);
-
-    // We are going to create a holey array, but our kind is non-holey.
-    // Fix kind and retry (only if we have an allocation site in the slot).
-    __ incl(rdx);
-
-    if (FLAG_debug_code) {
-      Handle<Map> allocation_site_map =
-          masm->isolate()->factory()->allocation_site_map();
-      __ Cmp(FieldOperand(rbx, 0), allocation_site_map);
-      __ Assert(equal, AbortReason::kExpectedAllocationSite);
-    }
-
-    // Save the resulting elements kind in type info. We can't just store r3
-    // in the AllocationSite::transition_info field because elements kind is
-    // restricted to a portion of the field...upper bits need to be left alone.
-    STATIC_ASSERT(AllocationSite::ElementsKindBits::kShift == 0);
-    __ SmiAddConstant(
-        FieldOperand(rbx, AllocationSite::kTransitionInfoOrBoilerplateOffset),
-        Smi::FromInt(kFastElementsKindPackedToHoley));
-
-    __ bind(&normal_sequence);
-    int last_index =
-        GetSequenceIndexFromFastElementsKind(TERMINAL_FAST_ELEMENTS_KIND);
-    for (int i = 0; i <= last_index; ++i) {
-      Label next;
-      ElementsKind kind = GetFastElementsKindFromSequenceIndex(i);
-      __ cmpl(rdx, Immediate(kind));
-      __ j(not_equal, &next);
-      ArraySingleArgumentConstructorStub stub(masm->isolate(), kind);
-      __ TailCallStub(&stub);
-      __ bind(&next);
-    }
-
-    // If we reached this point there is a problem.
-    __ Abort(AbortReason::kUnexpectedElementsKindInArrayConstructor);
-  } else {
-    UNREACHABLE();
-  }
-}
-
-
-template<class T>
-static void ArrayConstructorStubAheadOfTimeHelper(Isolate* isolate) {
-  int to_index =
-      GetSequenceIndexFromFastElementsKind(TERMINAL_FAST_ELEMENTS_KIND);
-  for (int i = 0; i <= to_index; ++i) {
-    ElementsKind kind = GetFastElementsKindFromSequenceIndex(i);
-    T stub(isolate, kind);
-    stub.GetCode();
-    if (AllocationSite::ShouldTrack(kind)) {
-      T stub1(isolate, kind, DISABLE_ALLOCATION_SITES);
-      stub1.GetCode();
-    }
-  }
-}
-
-void CommonArrayConstructorStub::GenerateStubsAheadOfTime(Isolate* isolate) {
-  ArrayConstructorStubAheadOfTimeHelper<ArrayNoArgumentConstructorStub>(
-      isolate);
-  ArrayConstructorStubAheadOfTimeHelper<ArraySingleArgumentConstructorStub>(
-      isolate);
-  ArrayNArgumentsConstructorStub stub(isolate);
-  stub.GetCode();
-
-  ElementsKind kinds[2] = {PACKED_ELEMENTS, HOLEY_ELEMENTS};
-  for (int i = 0; i < 2; i++) {
-    // For internal arrays we only need a few things
-    InternalArrayNoArgumentConstructorStub stubh1(isolate, kinds[i]);
-    stubh1.GetCode();
-    InternalArraySingleArgumentConstructorStub stubh2(isolate, kinds[i]);
-    stubh2.GetCode();
-  }
-}
-
-void ArrayConstructorStub::GenerateDispatchToArrayStub(
-    MacroAssembler* masm, AllocationSiteOverrideMode mode) {
-  Label not_zero_case, not_one_case;
-  __ testp(rax, rax);
-  __ j(not_zero, &not_zero_case);
-  CreateArrayDispatch<ArrayNoArgumentConstructorStub>(masm, mode);
-
-  __ bind(&not_zero_case);
-  __ cmpl(rax, Immediate(1));
-  __ j(greater, &not_one_case);
-  CreateArrayDispatchOneArgument(masm, mode);
-
-  __ bind(&not_one_case);
-  ArrayNArgumentsConstructorStub stub(masm->isolate());
-  __ TailCallStub(&stub);
-}
-
-void ArrayConstructorStub::Generate(MacroAssembler* masm) {
-  // ----------- S t a t e -------------
-  //  -- rax    : argc
-  //  -- rbx    : AllocationSite or undefined
-  //  -- rdi    : constructor
-  //  -- rdx    : new target
-  //  -- rsp[0] : return address
-  //  -- rsp[8] : last argument
-  // -----------------------------------
-  if (FLAG_debug_code) {
-    // The array construct code is only set for the global and natives
-    // builtin Array functions which always have maps.
-
-    // Initial map for the builtin Array function should be a map.
-    __ movp(rcx, FieldOperand(rdi, JSFunction::kPrototypeOrInitialMapOffset));
-    // Will both indicate a nullptr and a Smi.
-    STATIC_ASSERT(kSmiTag == 0);
-    Condition not_smi = NegateCondition(masm->CheckSmi(rcx));
-    __ Check(not_smi, AbortReason::kUnexpectedInitialMapForArrayFunction);
-    __ CmpObjectType(rcx, MAP_TYPE, rcx);
-    __ Check(equal, AbortReason::kUnexpectedInitialMapForArrayFunction);
-
-    // We should either have undefined in rbx or a valid AllocationSite
-    __ AssertUndefinedOrAllocationSite(rbx);
-  }
-
-  // Enter the context of the Array function.
-  __ movp(rsi, FieldOperand(rdi, JSFunction::kContextOffset));
-
-  Label subclassing;
-  __ cmpp(rdi, rdx);
-  __ j(not_equal, &subclassing);
-
-  Label no_info;
-  // If the feedback vector is the undefined value call an array constructor
-  // that doesn't use AllocationSites.
-  __ CompareRoot(rbx, Heap::kUndefinedValueRootIndex);
-  __ j(equal, &no_info);
-
-  // Only look at the lower 16 bits of the transition info.
-  __ movp(rdx, FieldOperand(
-                   rbx, AllocationSite::kTransitionInfoOrBoilerplateOffset));
-  __ SmiToInteger32(rdx, rdx);
-  STATIC_ASSERT(AllocationSite::ElementsKindBits::kShift == 0);
-  __ andp(rdx, Immediate(AllocationSite::ElementsKindBits::kMask));
-  GenerateDispatchToArrayStub(masm, DONT_OVERRIDE);
-
-  __ bind(&no_info);
-  GenerateDispatchToArrayStub(masm, DISABLE_ALLOCATION_SITES);
-
-  // Subclassing
-  __ bind(&subclassing);
-  StackArgumentsAccessor args(rsp, rax);
-  __ movp(args.GetReceiverOperand(), rdi);
-  __ addp(rax, Immediate(3));
-  __ PopReturnAddressTo(rcx);
-  __ Push(rdx);
-  __ Push(rbx);
-  __ PushReturnAddressFrom(rcx);
-  __ JumpToExternalReference(ExternalReference(Runtime::kNewArray, isolate()));
-}
-
-
-void InternalArrayConstructorStub::GenerateCase(
-    MacroAssembler* masm, ElementsKind kind) {
-  Label not_zero_case, not_one_case;
-  Label normal_sequence;
-
-  __ testp(rax, rax);
-  __ j(not_zero, &not_zero_case);
-  InternalArrayNoArgumentConstructorStub stub0(isolate(), kind);
-  __ TailCallStub(&stub0);
-
-  __ bind(&not_zero_case);
-  __ cmpl(rax, Immediate(1));
-  __ j(greater, &not_one_case);
-
-  if (IsFastPackedElementsKind(kind)) {
-    // We might need to create a holey array
-    // look at the first argument
-    StackArgumentsAccessor args(rsp, 1, ARGUMENTS_DONT_CONTAIN_RECEIVER);
-    __ movp(rcx, args.GetArgumentOperand(0));
-    __ testp(rcx, rcx);
-    __ j(zero, &normal_sequence);
-
-    InternalArraySingleArgumentConstructorStub
-        stub1_holey(isolate(), GetHoleyElementsKind(kind));
-    __ TailCallStub(&stub1_holey);
-  }
-
-  __ bind(&normal_sequence);
-  InternalArraySingleArgumentConstructorStub stub1(isolate(), kind);
-  __ TailCallStub(&stub1);
-
-  __ bind(&not_one_case);
-  ArrayNArgumentsConstructorStub stubN(isolate());
-  __ TailCallStub(&stubN);
-}
-
-
-void InternalArrayConstructorStub::Generate(MacroAssembler* masm) {
-  // ----------- S t a t e -------------
-  //  -- rax    : argc
-  //  -- rdi    : constructor
-  //  -- rsp[0] : return address
-  //  -- rsp[8] : last argument
-  // -----------------------------------
-
-  if (FLAG_debug_code) {
-    // The array construct code is only set for the global and natives
-    // builtin Array functions which always have maps.
-
-    // Initial map for the builtin Array function should be a map.
-    __ movp(rcx, FieldOperand(rdi, JSFunction::kPrototypeOrInitialMapOffset));
-    // Will both indicate a nullptr and a Smi.
-    STATIC_ASSERT(kSmiTag == 0);
-    Condition not_smi = NegateCondition(masm->CheckSmi(rcx));
-    __ Check(not_smi, AbortReason::kUnexpectedInitialMapForArrayFunction);
-    __ CmpObjectType(rcx, MAP_TYPE, rcx);
-    __ Check(equal, AbortReason::kUnexpectedInitialMapForArrayFunction);
-  }
-
-  // Figure out the right elements kind
-  __ movp(rcx, FieldOperand(rdi, JSFunction::kPrototypeOrInitialMapOffset));
-
-  // Load the map's "bit field 2" into |result|. We only need the first byte,
-  // but the following masking takes care of that anyway.
-  __ movzxbp(rcx, FieldOperand(rcx, Map::kBitField2Offset));
-  // Retrieve elements_kind from bit field 2.
-  __ DecodeField<Map::ElementsKindBits>(rcx);
-
-  if (FLAG_debug_code) {
-    Label done;
-    __ cmpl(rcx, Immediate(PACKED_ELEMENTS));
-    __ j(equal, &done);
-    __ cmpl(rcx, Immediate(HOLEY_ELEMENTS));
-    __ Assert(
-        equal,
-        AbortReason::kInvalidElementsKindForInternalArrayOrInternalPackedArray);
-    __ bind(&done);
-  }
-
-  Label fast_elements_case;
-  __ cmpl(rcx, Immediate(PACKED_ELEMENTS));
-  __ j(equal, &fast_elements_case);
-  GenerateCase(masm, HOLEY_ELEMENTS);
-
-  __ bind(&fast_elements_case);
-  GenerateCase(masm, PACKED_ELEMENTS);
-}
-
 static int Offset(ExternalReference ref0, ExternalReference ref1) {
   int64_t offset = (ref0.address() - ref1.address());
   // Check that fits into int.
@@ -977,8 +283,7 @@ static void CallApiFunctionAndReturn(MacroAssembler* masm,
     __ PushSafepointRegisters();
     __ PrepareCallCFunction(1);
     __ LoadAddress(arg_reg_1, ExternalReference::isolate_address(isolate));
-    __ CallCFunction(ExternalReference::log_enter_external_function(isolate),
-                     1);
+    __ CallCFunction(ExternalReference::log_enter_external_function(), 1);
     __ PopSafepointRegisters();
   }
 
@@ -1007,8 +312,7 @@ static void CallApiFunctionAndReturn(MacroAssembler* masm,
     __ PushSafepointRegisters();
     __ PrepareCallCFunction(1);
     __ LoadAddress(arg_reg_1, ExternalReference::isolate_address(isolate));
-    __ CallCFunction(ExternalReference::log_leave_external_function(isolate),
-                     1);
+    __ CallCFunction(ExternalReference::log_leave_external_function(), 1);
     __ PopSafepointRegisters();
   }
 
@@ -1088,8 +392,7 @@ static void CallApiFunctionAndReturn(MacroAssembler* masm,
   __ movp(Operand(base_reg, kLimitOffset), prev_limit_reg);
   __ movp(prev_limit_reg, rax);
   __ LoadAddress(arg_reg_1, ExternalReference::isolate_address(isolate));
-  __ LoadAddress(rax,
-                 ExternalReference::delete_handle_scope_extensions(isolate));
+  __ LoadAddress(rax, ExternalReference::delete_handle_scope_extensions());
   __ call(rax);
   __ movp(rax, prev_limit_reg);
   __ jmp(&leave_exit_frame);
@@ -1178,8 +481,7 @@ void CallApiCallbackStub::Generate(MacroAssembler* masm) {
   // v8::InvocationCallback's argument.
   __ leap(arguments_arg, StackSpaceOperand(0));
 
-  ExternalReference thunk_ref =
-      ExternalReference::invoke_function_callback(masm->isolate());
+  ExternalReference thunk_ref = ExternalReference::invoke_function_callback();
 
   // Accessor for FunctionCallbackInfo and first js arg.
   StackArgumentsAccessor args_from_rbp(rbp, FCA::kArgsLength + 1,
@@ -1256,7 +558,7 @@ void CallApiGetterStub::Generate(MacroAssembler* masm) {
   __ leap(accessor_info_arg, info_object);
 
   ExternalReference thunk_ref =
-      ExternalReference::invoke_accessor_getter_callback(isolate());
+      ExternalReference::invoke_accessor_getter_callback();
 
   // It's okay if api_function_address == getter_arg
   // but not accessor_info_arg or name_arg
diff --git a/deps/v8/src/x64/constants-x64.h b/deps/v8/src/x64/constants-x64.h
new file mode 100644
index 00000000000000..1f2b04248cfa0d
--- /dev/null
+++ b/deps/v8/src/x64/constants-x64.h
@@ -0,0 +1,21 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef V8_X64_CONSTANTS_X64_H_
+#define V8_X64_CONSTANTS_X64_H_
+
+#include "src/globals.h"
+
+namespace v8 {
+namespace internal {
+// Actual value of root register is offset from the root array's start
+// to take advantage of negative displacement values.
+// TODO(sigurds): Choose best value.
+constexpr int kRootRegisterBias = 128;
+
+constexpr size_t kMaxPCRelativeCodeRangeInMB = 2048;
+}  // namespace internal
+}  // namespace v8
+
+#endif  // V8_X64_CONSTANTS_X64_H_
diff --git a/deps/v8/src/x64/deoptimizer-x64.cc b/deps/v8/src/x64/deoptimizer-x64.cc
index 8c4d6a20e8680b..481a47c164b1d8 100644
--- a/deps/v8/src/x64/deoptimizer-x64.cc
+++ b/deps/v8/src/x64/deoptimizer-x64.cc
@@ -56,8 +56,9 @@ void Deoptimizer::TableEntryGenerator::Generate() {
   const int kSavedRegistersAreaSize =
       kNumberOfRegisters * kRegisterSize + kDoubleRegsSize + kFloatRegsSize;
 
-  __ Store(ExternalReference(IsolateAddressId::kCEntryFPAddress, isolate()),
-           rbp);
+  __ Store(
+      ExternalReference::Create(IsolateAddressId::kCEntryFPAddress, isolate()),
+      rbp);
 
   // We use this to keep the value of the fifth argument temporarily.
   // Unfortunately we can't store it directly in r8 (used for passing
@@ -100,7 +101,7 @@ void Deoptimizer::TableEntryGenerator::Generate() {
   __ movp(rax, Operand(rbp, JavaScriptFrameConstants::kFunctionOffset));
   __ bind(&context_check);
   __ movp(arg_reg_1, rax);
-  __ Set(arg_reg_2, type());
+  __ Set(arg_reg_2, static_cast<int>(deopt_kind()));
   // Args 3 and 4 are already in the right registers.
 
   // On windows put the arguments on the stack (PrepareCallCFunction
@@ -115,7 +116,7 @@ void Deoptimizer::TableEntryGenerator::Generate() {
 #endif
 
   { AllowExternalCallThatCantCauseGC scope(masm());
-    __ CallCFunction(ExternalReference::new_deoptimizer_function(isolate()), 6);
+    __ CallCFunction(ExternalReference::new_deoptimizer_function(), 6);
   }
   // Preserve deoptimizer object in register rax and get the input
   // frame descriptor pointer.
@@ -173,8 +174,7 @@ void Deoptimizer::TableEntryGenerator::Generate() {
   __ LoadAddress(arg_reg_2, ExternalReference::isolate_address(isolate()));
   {
     AllowExternalCallThatCantCauseGC scope(masm());
-    __ CallCFunction(
-        ExternalReference::compute_output_frames_function(isolate()), 2);
+    __ CallCFunction(ExternalReference::compute_output_frames_function(), 2);
   }
   __ popq(rax);
 
diff --git a/deps/v8/src/x64/disasm-x64.cc b/deps/v8/src/x64/disasm-x64.cc
index 104f46889e3683..216d7c7d76717f 100644
--- a/deps/v8/src/x64/disasm-x64.cc
+++ b/deps/v8/src/x64/disasm-x64.cc
@@ -2567,7 +2567,9 @@ int DisassemblerX64::InstructionDecode(v8::internal::Vector<char> out_buffer,
       case 0x96:
       case 0x97: {
         int reg = (*data & 0x7) | (rex_b() ? 8 : 0);
-        if (reg == 0) {
+        if (group_1_prefix_ == 0xF3 && *data == 0x90) {
+          AppendToBuffer("pause");
+        } else if (reg == 0) {
           AppendToBuffer("nop");  // Common name for xchg rax,rax.
         } else {
           AppendToBuffer("xchg%c rax,%s",
diff --git a/deps/v8/src/x64/frame-constants-x64.h b/deps/v8/src/x64/frame-constants-x64.h
index fc451b663ca204..5658aaebeae351 100644
--- a/deps/v8/src/x64/frame-constants-x64.h
+++ b/deps/v8/src/x64/frame-constants-x64.h
@@ -5,6 +5,9 @@
 #ifndef V8_X64_FRAME_CONSTANTS_X64_H_
 #define V8_X64_FRAME_CONSTANTS_X64_H_
 
+#include "src/base/macros.h"
+#include "src/frame-constants.h"
+
 namespace v8 {
 namespace internal {
 
@@ -40,6 +43,19 @@ class ExitFrameConstants : public TypedFrameConstants {
   static constexpr int kConstantPoolOffset = 0;  // Not used
 };
 
+class WasmCompileLazyFrameConstants : public TypedFrameConstants {
+ public:
+  static constexpr int kNumberOfSavedGpParamRegs = 6;
+  static constexpr int kNumberOfSavedFpParamRegs = 6;
+
+  // FP-relative.
+  static constexpr int kWasmInstanceOffset = TYPED_FRAME_PUSHED_VALUE_OFFSET(0);
+  static constexpr int kFixedFrameSizeFromFp =
+      TypedFrameConstants::kFixedFrameSizeFromFp +
+      kNumberOfSavedGpParamRegs * kPointerSize +
+      kNumberOfSavedFpParamRegs * kSimd128Size;
+};
+
 class JavaScriptFrameConstants : public AllStatic {
  public:
   // FP-relative.
diff --git a/deps/v8/src/x64/interface-descriptors-x64.cc b/deps/v8/src/x64/interface-descriptors-x64.cc
index be32df3164b3b5..30b368b38d2567 100644
--- a/deps/v8/src/x64/interface-descriptors-x64.cc
+++ b/deps/v8/src/x64/interface-descriptors-x64.cc
@@ -33,7 +33,7 @@ void RecordWriteDescriptor::InitializePlatformSpecific(
   data->InitializePlatformSpecific(kParameterCount, default_stub_registers);
 }
 
-const Register FastNewFunctionContextDescriptor::FunctionRegister() {
+const Register FastNewFunctionContextDescriptor::ScopeInfoRegister() {
   return rdi;
 }
 const Register FastNewFunctionContextDescriptor::SlotsRegister() { return rax; }
@@ -58,13 +58,6 @@ const Register StoreTransitionDescriptor::MapRegister() { return r11; }
 const Register ApiGetterDescriptor::HolderRegister() { return rcx; }
 const Register ApiGetterDescriptor::CallbackRegister() { return rbx; }
 
-const Register MathPowTaggedDescriptor::exponent() { return rdx; }
-
-const Register MathPowIntegerDescriptor::exponent() {
-  return MathPowTaggedDescriptor::exponent();
-}
-
-
 const Register GrowArrayElementsDescriptor::ObjectRegister() { return rax; }
 const Register GrowArrayElementsDescriptor::KeyRegister() { return rbx; }
 
@@ -179,24 +172,7 @@ void ConstructStubDescriptor::InitializePlatformSpecific(
   data->InitializePlatformSpecific(arraysize(registers), registers);
 }
 
-
-void ConstructTrampolineDescriptor::InitializePlatformSpecific(
-    CallInterfaceDescriptorData* data) {
-  // rax : number of arguments
-  // rdx : the new target
-  // rdi : the target to call
-  Register registers[] = {rdi, rdx, rax};
-  data->InitializePlatformSpecific(arraysize(registers), registers);
-}
-
-
-void TransitionElementsKindDescriptor::InitializePlatformSpecific(
-    CallInterfaceDescriptorData* data) {
-  Register registers[] = {rax, rbx};
-  data->InitializePlatformSpecific(arraysize(registers), registers);
-}
-
-void AbortJSDescriptor::InitializePlatformSpecific(
+void AbortDescriptor::InitializePlatformSpecific(
     CallInterfaceDescriptorData* data) {
   Register registers[] = {rdx};
   data->InitializePlatformSpecific(arraysize(registers), registers);
@@ -204,44 +180,7 @@ void AbortJSDescriptor::InitializePlatformSpecific(
 
 void AllocateHeapNumberDescriptor::InitializePlatformSpecific(
     CallInterfaceDescriptorData* data) {
-  data->InitializePlatformSpecific(0, nullptr, nullptr);
-}
-
-void ArrayConstructorDescriptor::InitializePlatformSpecific(
-    CallInterfaceDescriptorData* data) {
-  // kTarget, kNewTarget, kActualArgumentsCount, kAllocationSite
-  Register registers[] = {rdi, rdx, rax, rbx};
-  data->InitializePlatformSpecific(arraysize(registers), registers, nullptr);
-}
-
-void ArrayNoArgumentConstructorDescriptor::InitializePlatformSpecific(
-    CallInterfaceDescriptorData* data) {
-  // register state
-  // rax -- number of arguments
-  // rdi -- function
-  // rbx -- allocation site with elements kind
-  Register registers[] = {rdi, rbx, rax};
-  data->InitializePlatformSpecific(arraysize(registers), registers, nullptr);
-}
-
-void ArraySingleArgumentConstructorDescriptor::InitializePlatformSpecific(
-    CallInterfaceDescriptorData* data) {
-  // register state
-  // rax -- number of arguments
-  // rdi -- function
-  // rbx -- allocation site with elements kind
-  Register registers[] = {rdi, rbx, rax};
-  data->InitializePlatformSpecific(arraysize(registers), registers, nullptr);
-}
-
-void ArrayNArgumentsConstructorDescriptor::InitializePlatformSpecific(
-    CallInterfaceDescriptorData* data) {
-  // register state
-  // rax -- number of arguments
-  // rdi -- function
-  // rbx -- allocation site with elements kind
-  Register registers[] = {rdi, rbx, rax};
-  data->InitializePlatformSpecific(arraysize(registers), registers, nullptr);
+  data->InitializePlatformSpecific(0, nullptr);
 }
 
 void CompareDescriptor::InitializePlatformSpecific(
@@ -250,19 +189,12 @@ void CompareDescriptor::InitializePlatformSpecific(
   data->InitializePlatformSpecific(arraysize(registers), registers);
 }
 
-
 void BinaryOpDescriptor::InitializePlatformSpecific(
     CallInterfaceDescriptorData* data) {
   Register registers[] = {rdx, rax};
   data->InitializePlatformSpecific(arraysize(registers), registers);
 }
 
-void StringAddDescriptor::InitializePlatformSpecific(
-    CallInterfaceDescriptorData* data) {
-  Register registers[] = {rdx, rax};
-  data->InitializePlatformSpecific(arraysize(registers), registers);
-}
-
 void ArgumentAdaptorDescriptor::InitializePlatformSpecific(
     CallInterfaceDescriptorData* data) {
   Register registers[] = {
@@ -315,7 +247,9 @@ void InterpreterPushArgsThenConstructDescriptor::InitializePlatformSpecific(
   data->InitializePlatformSpecific(arraysize(registers), registers);
 }
 
-void InterpreterCEntryDescriptor::InitializePlatformSpecific(
+namespace {
+
+void InterpreterCEntryDescriptor_InitializePlatformSpecific(
     CallInterfaceDescriptorData* data) {
   Register registers[] = {
       rax,  // argument count (argc)
@@ -325,6 +259,18 @@ void InterpreterCEntryDescriptor::InitializePlatformSpecific(
   data->InitializePlatformSpecific(arraysize(registers), registers);
 }
 
+}  // namespace
+
+void InterpreterCEntry1Descriptor::InitializePlatformSpecific(
+    CallInterfaceDescriptorData* data) {
+  InterpreterCEntryDescriptor_InitializePlatformSpecific(data);
+}
+
+void InterpreterCEntry2Descriptor::InitializePlatformSpecific(
+    CallInterfaceDescriptorData* data) {
+  InterpreterCEntryDescriptor_InitializePlatformSpecific(data);
+}
+
 void ResumeGeneratorDescriptor::InitializePlatformSpecific(
     CallInterfaceDescriptorData* data) {
   Register registers[] = {
diff --git a/deps/v8/src/x64/macro-assembler-x64.cc b/deps/v8/src/x64/macro-assembler-x64.cc
index b30391fde8d297..2c703e7d50b897 100644
--- a/deps/v8/src/x64/macro-assembler-x64.cc
+++ b/deps/v8/src/x64/macro-assembler-x64.cc
@@ -9,6 +9,7 @@
 #include "src/base/utils/random-number-generator.h"
 #include "src/bootstrapper.h"
 #include "src/callable.h"
+#include "src/code-factory.h"
 #include "src/code-stubs.h"
 #include "src/counters.h"
 #include "src/debug/debug.h"
@@ -18,6 +19,7 @@
 #include "src/instruction-stream.h"
 #include "src/objects-inl.h"
 #include "src/register-configuration.h"
+#include "src/snapshot/snapshot.h"
 #include "src/x64/assembler-x64.h"
 
 #include "src/x64/macro-assembler-x64.h"  // Cannot be the first include.
@@ -61,16 +63,18 @@ StackArgumentsAccessor::StackArgumentsAccessor(
       extra_displacement_to_last_argument_(
           extra_displacement_to_last_argument) {}
 
-MacroAssembler::MacroAssembler(Isolate* isolate, void* buffer, int size,
-                               CodeObjectRequired create_code_object)
-    : TurboAssembler(isolate, buffer, size, create_code_object) {}
-
-TurboAssembler::TurboAssembler(Isolate* isolate, void* buffer, int buffer_size,
-                               CodeObjectRequired create_code_object)
-    : Assembler(isolate, buffer, buffer_size), isolate_(isolate) {
+MacroAssembler::MacroAssembler(Isolate* isolate,
+                               const AssemblerOptions& options, void* buffer,
+                               int size, CodeObjectRequired create_code_object)
+    : TurboAssembler(isolate, options, buffer, size, create_code_object) {
   if (create_code_object == CodeObjectRequired::kYes) {
-    code_object_ =
-        Handle<HeapObject>::New(isolate->heap()->undefined_value(), isolate);
+    // Unlike TurboAssembler, which can be used off the main thread and may not
+    // allocate, macro assembler creates its own copy of the self-reference
+    // marker in order to disambiguate between self-references during nested
+    // code generation (e.g.: codegen of the current object triggers stub
+    // compilation through CodeStub::GetCode()).
+    code_object_ = Handle<HeapObject>::New(
+        *isolate->factory()->NewSelfReferenceMarker(), isolate);
   }
 }
 
@@ -82,26 +86,11 @@ int64_t TurboAssembler::RootRegisterDelta(ExternalReference other) {
        other.address() >= reinterpret_cast<Address>(isolate() + 1))) {
     return kInvalidRootRegisterDelta;
   }
-  Address roots_register_value =
-      kRootRegisterBias +
-      reinterpret_cast<Address>(isolate()->heap()->roots_array_start());
-
-  int64_t delta = kInvalidRootRegisterDelta;  // Bogus initialization.
-  if (kPointerSize == kInt64Size) {
-    delta = other.address() - roots_register_value;
-  } else {
-    // For x32, zero extend the address to 64-bit and calculate the delta.
-    uint64_t o = static_cast<uint32_t>(
-        reinterpret_cast<intptr_t>(other.address()));
-    uint64_t r = static_cast<uint32_t>(
-        reinterpret_cast<intptr_t>(roots_register_value));
-    delta = o - r;
-  }
-  return delta;
+  return RootRegisterOffsetForExternalReference(isolate(), other);
 }
 
 void MacroAssembler::Load(Register destination, ExternalReference source) {
-  if (root_array_available_ && !serializer_enabled()) {
+  if (root_array_available_ && options().enable_root_array_delta_access) {
     int64_t delta = RootRegisterDelta(source);
     if (delta != kInvalidRootRegisterDelta && is_int32(delta)) {
       movp(destination, Operand(kRootRegister, static_cast<int32_t>(delta)));
@@ -109,6 +98,13 @@ void MacroAssembler::Load(Register destination, ExternalReference source) {
     }
   }
   // Safe code.
+  if (FLAG_embedded_builtins) {
+    if (root_array_available_ && options().isolate_independent_code) {
+      IndirectLoadExternalReference(kScratchRegister, source);
+      movp(destination, Operand(kScratchRegister, 0));
+      return;
+    }
+  }
   if (destination == rax) {
     load_rax(source);
   } else {
@@ -119,7 +115,7 @@ void MacroAssembler::Load(Register destination, ExternalReference source) {
 
 
 void MacroAssembler::Store(ExternalReference destination, Register source) {
-  if (root_array_available_ && !serializer_enabled()) {
+  if (root_array_available_ && options().enable_root_array_delta_access) {
     int64_t delta = RootRegisterDelta(destination);
     if (delta != kInvalidRootRegisterDelta && is_int32(delta)) {
       movp(Operand(kRootRegister, static_cast<int32_t>(delta)), source);
@@ -135,9 +131,33 @@ void MacroAssembler::Store(ExternalReference destination, Register source) {
   }
 }
 
+void TurboAssembler::LoadFromConstantsTable(Register destination,
+                                            int constant_index) {
+  DCHECK(isolate()->heap()->RootCanBeTreatedAsConstant(
+      Heap::kBuiltinsConstantsTableRootIndex));
+  LoadRoot(destination, Heap::kBuiltinsConstantsTableRootIndex);
+  movp(destination,
+       FieldOperand(destination,
+                    FixedArray::kHeaderSize + constant_index * kPointerSize));
+}
+
+void TurboAssembler::LoadRootRegisterOffset(Register destination,
+                                            intptr_t offset) {
+  DCHECK(is_int32(offset));
+  if (offset == 0) {
+    Move(destination, kRootRegister);
+  } else {
+    leap(destination, Operand(kRootRegister, static_cast<int32_t>(offset)));
+  }
+}
+
+void TurboAssembler::LoadRootRelative(Register destination, int32_t offset) {
+  movp(destination, Operand(kRootRegister, offset));
+}
+
 void TurboAssembler::LoadAddress(Register destination,
                                  ExternalReference source) {
-  if (root_array_available_ && !serializer_enabled()) {
+  if (root_array_available_ && options().enable_root_array_delta_access) {
     int64_t delta = RootRegisterDelta(source);
     if (delta != kInvalidRootRegisterDelta && is_int32(delta)) {
       leap(destination, Operand(kRootRegister, static_cast<int32_t>(delta)));
@@ -145,12 +165,18 @@ void TurboAssembler::LoadAddress(Register destination,
     }
   }
   // Safe code.
+  if (FLAG_embedded_builtins) {
+    if (root_array_available_ && options().isolate_independent_code) {
+      IndirectLoadExternalReference(destination, source);
+      return;
+    }
+  }
   Move(destination, source);
 }
 
 Operand TurboAssembler::ExternalOperand(ExternalReference target,
                                         Register scratch) {
-  if (root_array_available_ && !serializer_enabled()) {
+  if (root_array_available_ && options().enable_root_array_delta_access) {
     int64_t delta = RootRegisterDelta(target);
     if (delta != kInvalidRootRegisterDelta && is_int32(delta)) {
       return Operand(kRootRegister, static_cast<int32_t>(delta));
@@ -161,7 +187,7 @@ Operand TurboAssembler::ExternalOperand(ExternalReference target,
 }
 
 int TurboAssembler::LoadAddressSize(ExternalReference source) {
-  if (root_array_available_ && !serializer_enabled()) {
+  if (root_array_available_ && options().enable_root_array_delta_access) {
     // This calculation depends on the internals of LoadAddress.
     // It's correctness is ensured by the asserts in the Call
     // instruction below.
@@ -182,34 +208,23 @@ int TurboAssembler::LoadAddressSize(ExternalReference source) {
 
 
 void MacroAssembler::PushAddress(ExternalReference source) {
-  int64_t address = reinterpret_cast<int64_t>(source.address());
-  if (is_int32(address) && !serializer_enabled()) {
-    if (emit_debug_code()) {
-      Move(kScratchRegister, reinterpret_cast<Address>(kZapValue),
-           RelocInfo::NONE);
-    }
-    Push(Immediate(static_cast<int32_t>(address)));
-    return;
-  }
   LoadAddress(kScratchRegister, source);
   Push(kScratchRegister);
 }
 
 void TurboAssembler::LoadRoot(Register destination, Heap::RootListIndex index) {
   DCHECK(root_array_available_);
-  movp(destination, Operand(kRootRegister,
-                            (index << kPointerSizeLog2) - kRootRegisterBias));
+  movp(destination, Operand(kRootRegister, RootRegisterOffset(index)));
 }
 
 void MacroAssembler::PushRoot(Heap::RootListIndex index) {
   DCHECK(root_array_available_);
-  Push(Operand(kRootRegister, (index << kPointerSizeLog2) - kRootRegisterBias));
+  Push(Operand(kRootRegister, RootRegisterOffset(index)));
 }
 
 void TurboAssembler::CompareRoot(Register with, Heap::RootListIndex index) {
   DCHECK(root_array_available_);
-  cmpp(with, Operand(kRootRegister,
-                     (index << kPointerSizeLog2) - kRootRegisterBias));
+  cmpp(with, Operand(kRootRegister, RootRegisterOffset(index)));
 }
 
 void TurboAssembler::CompareRoot(Operand with, Heap::RootListIndex index) {
@@ -254,8 +269,8 @@ void MacroAssembler::RecordWriteField(Register object, int offset,
   // Clobber clobbered input registers when running with the debug-code flag
   // turned on to provoke errors.
   if (emit_debug_code()) {
-    Move(value, reinterpret_cast<Address>(kZapValue), RelocInfo::NONE);
-    Move(dst, reinterpret_cast<Address>(kZapValue), RelocInfo::NONE);
+    Move(value, kZapValue, RelocInfo::NONE);
+    Move(dst, kZapValue, RelocInfo::NONE);
   }
 }
 
@@ -385,8 +400,8 @@ void MacroAssembler::RecordWrite(Register object, Register address,
   // Clobber clobbered registers when running with the debug-code flag
   // turned on to provoke errors.
   if (emit_debug_code()) {
-    Move(address, reinterpret_cast<Address>(kZapValue), RelocInfo::NONE);
-    Move(value, reinterpret_cast<Address>(kZapValue), RelocInfo::NONE);
+    Move(address, kZapValue, RelocInfo::NONE);
+    Move(value, kZapValue, RelocInfo::NONE);
   }
 }
 
@@ -423,16 +438,15 @@ void TurboAssembler::CheckStackAlignment() {
 void TurboAssembler::Abort(AbortReason reason) {
 #ifdef DEBUG
   const char* msg = GetAbortReason(reason);
-  if (msg != nullptr) {
-    RecordComment("Abort message: ");
-    RecordComment(msg);
-  }
+  RecordComment("Abort message: ");
+  RecordComment(msg);
+#endif
 
-  if (FLAG_trap_on_abort) {
+  // Avoid emitting call to builtin if requested.
+  if (trap_on_abort()) {
     int3();
     return;
   }
-#endif
 
   Move(rdx, Smi::FromInt(static_cast<int>(reason)));
 
@@ -467,16 +481,18 @@ bool TurboAssembler::AllowThisStubCall(CodeStub* stub) {
   return has_frame() || !stub->SometimesSetsUpAFrame();
 }
 
-void TurboAssembler::CallRuntimeDelayed(Zone* zone, Runtime::FunctionId fid,
-                                        SaveFPRegsMode save_doubles) {
+void TurboAssembler::CallRuntimeWithCEntry(Runtime::FunctionId fid,
+                                           Register centry) {
   const Runtime::Function* f = Runtime::FunctionForId(fid);
   // TODO(1236192): Most runtime routines don't need the number of
   // arguments passed in because it is constant. At some point we
   // should remove this need and make the runtime routine entry code
   // smarter.
   Set(rax, f->nargs);
-  LoadAddress(rbx, ExternalReference(f, isolate()));
-  CallStubDelayed(new (zone) CEntryStub(nullptr, f->result_size, save_doubles));
+  LoadAddress(rbx, ExternalReference::Create(f));
+  DCHECK(!AreAliased(centry, rax, rbx));
+  addp(rcx, Immediate(Code::kHeaderSize - kHeapObjectTag));
+  Call(centry);
 }
 
 void MacroAssembler::CallRuntime(const Runtime::Function* f,
@@ -492,9 +508,10 @@ void MacroAssembler::CallRuntime(const Runtime::Function* f,
   // should remove this need and make the runtime routine entry code
   // smarter.
   Set(rax, num_arguments);
-  LoadAddress(rbx, ExternalReference(f, isolate()));
-  CEntryStub ces(isolate(), f->result_size, save_doubles);
-  CallStub(&ces);
+  LoadAddress(rbx, ExternalReference::Create(f));
+  Handle<Code> code =
+      CodeFactory::CEntry(isolate(), f->result_size, save_doubles);
+  Call(code, RelocInfo::CODE_TARGET);
 }
 
 void MacroAssembler::TailCallRuntime(Runtime::FunctionId fid) {
@@ -513,16 +530,16 @@ void MacroAssembler::TailCallRuntime(Runtime::FunctionId fid) {
   if (function->nargs >= 0) {
     Set(rax, function->nargs);
   }
-  JumpToExternalReference(ExternalReference(fid, isolate()));
+  JumpToExternalReference(ExternalReference::Create(fid));
 }
 
 void MacroAssembler::JumpToExternalReference(const ExternalReference& ext,
                                              bool builtin_exit_frame) {
   // Set the entry point and jump to the C entry runtime stub.
   LoadAddress(rbx, ext);
-  CEntryStub ces(isolate(), 1, kDontSaveFPRegs, kArgvOnStack,
-                 builtin_exit_frame);
-  jmp(ces.GetCode(), RelocInfo::CODE_TARGET);
+  Handle<Code> code = CodeFactory::CEntry(isolate(), 1, kDontSaveFPRegs,
+                                          kArgvOnStack, builtin_exit_frame);
+  Jump(code, RelocInfo::CODE_TARGET);
 }
 
 static constexpr Register saved_regs[] = {rax, rcx, rdx, rbx, rbp, rsi,
@@ -726,39 +743,76 @@ void TurboAssembler::Cvtqsi2sd(XMMRegister dst, Operand src) {
   }
 }
 
-void TurboAssembler::Cvtqui2ss(XMMRegister dst, Register src, Register tmp) {
-  Label msb_set_src;
-  Label jmp_return;
-  testq(src, src);
-  j(sign, &msb_set_src, Label::kNear);
-  Cvtqsi2ss(dst, src);
-  jmp(&jmp_return, Label::kNear);
-  bind(&msb_set_src);
-  movq(tmp, src);
-  shrq(src, Immediate(1));
-  // Recover the least significant bit to avoid rounding errors.
-  andq(tmp, Immediate(1));
-  orq(src, tmp);
+void TurboAssembler::Cvtlui2ss(XMMRegister dst, Register src) {
+  // Zero-extend the 32 bit value to 64 bit.
+  movl(kScratchRegister, src);
+  Cvtqsi2ss(dst, kScratchRegister);
+}
+
+void TurboAssembler::Cvtlui2ss(XMMRegister dst, Operand src) {
+  // Zero-extend the 32 bit value to 64 bit.
+  movl(kScratchRegister, src);
+  Cvtqsi2ss(dst, kScratchRegister);
+}
+
+void TurboAssembler::Cvtlui2sd(XMMRegister dst, Register src) {
+  // Zero-extend the 32 bit value to 64 bit.
+  movl(kScratchRegister, src);
+  Cvtqsi2sd(dst, kScratchRegister);
+}
+
+void TurboAssembler::Cvtlui2sd(XMMRegister dst, Operand src) {
+  // Zero-extend the 32 bit value to 64 bit.
+  movl(kScratchRegister, src);
+  Cvtqsi2sd(dst, kScratchRegister);
+}
+
+void TurboAssembler::Cvtqui2ss(XMMRegister dst, Register src) {
+  Label done;
   Cvtqsi2ss(dst, src);
+  testq(src, src);
+  j(positive, &done, Label::kNear);
+
+  // Compute {src/2 | (src&1)} (retain the LSB to avoid rounding errors).
+  if (src != kScratchRegister) movq(kScratchRegister, src);
+  shrq(kScratchRegister, Immediate(1));
+  // The LSB is shifted into CF. If it is set, set the LSB in {tmp}.
+  Label msb_not_set;
+  j(not_carry, &msb_not_set, Label::kNear);
+  orq(kScratchRegister, Immediate(1));
+  bind(&msb_not_set);
+  Cvtqsi2ss(dst, kScratchRegister);
   addss(dst, dst);
-  bind(&jmp_return);
+  bind(&done);
 }
 
-void TurboAssembler::Cvtqui2sd(XMMRegister dst, Register src, Register tmp) {
-  Label msb_set_src;
-  Label jmp_return;
-  testq(src, src);
-  j(sign, &msb_set_src, Label::kNear);
-  Cvtqsi2sd(dst, src);
-  jmp(&jmp_return, Label::kNear);
-  bind(&msb_set_src);
-  movq(tmp, src);
-  shrq(src, Immediate(1));
-  andq(tmp, Immediate(1));
-  orq(src, tmp);
+void TurboAssembler::Cvtqui2ss(XMMRegister dst, Operand src) {
+  movq(kScratchRegister, src);
+  Cvtqui2ss(dst, kScratchRegister);
+}
+
+void TurboAssembler::Cvtqui2sd(XMMRegister dst, Register src) {
+  Label done;
   Cvtqsi2sd(dst, src);
+  testq(src, src);
+  j(positive, &done, Label::kNear);
+
+  // Compute {src/2 | (src&1)} (retain the LSB to avoid rounding errors).
+  if (src != kScratchRegister) movq(kScratchRegister, src);
+  shrq(kScratchRegister, Immediate(1));
+  // The LSB is shifted into CF. If it is set, set the LSB in {tmp}.
+  Label msb_not_set;
+  j(not_carry, &msb_not_set, Label::kNear);
+  orq(kScratchRegister, Immediate(1));
+  bind(&msb_not_set);
+  Cvtqsi2sd(dst, kScratchRegister);
   addsd(dst, dst);
-  bind(&jmp_return);
+  bind(&done);
+}
+
+void TurboAssembler::Cvtqui2sd(XMMRegister dst, Operand src) {
+  movq(kScratchRegister, src);
+  Cvtqui2sd(dst, kScratchRegister);
 }
 
 void TurboAssembler::Cvttss2si(Register dst, XMMRegister src) {
@@ -833,6 +887,62 @@ void TurboAssembler::Cvttsd2siq(Register dst, Operand src) {
   }
 }
 
+namespace {
+template <typename OperandOrXMMRegister, bool is_double>
+void ConvertFloatToUint64(TurboAssembler* tasm, Register dst,
+                          OperandOrXMMRegister src, Label* fail) {
+  Label success;
+  // There does not exist a native float-to-uint instruction, so we have to use
+  // a float-to-int, and postprocess the result.
+  if (is_double) {
+    tasm->Cvttsd2siq(dst, src);
+  } else {
+    tasm->Cvttss2siq(dst, src);
+  }
+  // If the result of the conversion is positive, we are already done.
+  tasm->testq(dst, dst);
+  tasm->j(positive, &success);
+  // The result of the first conversion was negative, which means that the
+  // input value was not within the positive int64 range. We subtract 2^63
+  // and convert it again to see if it is within the uint64 range.
+  if (is_double) {
+    tasm->Move(kScratchDoubleReg, -9223372036854775808.0);
+    tasm->addsd(kScratchDoubleReg, src);
+    tasm->Cvttsd2siq(dst, kScratchDoubleReg);
+  } else {
+    tasm->Move(kScratchDoubleReg, -9223372036854775808.0f);
+    tasm->addss(kScratchDoubleReg, src);
+    tasm->Cvttss2siq(dst, kScratchDoubleReg);
+  }
+  tasm->testq(dst, dst);
+  // The only possible negative value here is 0x80000000000000000, which is
+  // used on x64 to indicate an integer overflow.
+  tasm->j(negative, fail ? fail : &success);
+  // The input value is within uint64 range and the second conversion worked
+  // successfully, but we still have to undo the subtraction we did
+  // earlier.
+  tasm->Set(kScratchRegister, 0x8000000000000000);
+  tasm->orq(dst, kScratchRegister);
+  tasm->bind(&success);
+}
+}  // namespace
+
+void TurboAssembler::Cvttsd2uiq(Register dst, Operand src, Label* success) {
+  ConvertFloatToUint64<Operand, true>(this, dst, src, success);
+}
+
+void TurboAssembler::Cvttsd2uiq(Register dst, XMMRegister src, Label* success) {
+  ConvertFloatToUint64<XMMRegister, true>(this, dst, src, success);
+}
+
+void TurboAssembler::Cvttss2uiq(Register dst, Operand src, Label* success) {
+  ConvertFloatToUint64<Operand, false>(this, dst, src, success);
+}
+
+void TurboAssembler::Cvttss2uiq(Register dst, XMMRegister src, Label* success) {
+  ConvertFloatToUint64<XMMRegister, false>(this, dst, src, success);
+}
+
 void MacroAssembler::Load(Register dst, Operand src, Representation r) {
   DCHECK(!r.IsDouble());
   if (r.IsInteger8()) {
@@ -914,52 +1024,47 @@ void TurboAssembler::Move(Register dst, Smi* source) {
   if (value == 0) {
     xorl(dst, dst);
   } else {
-    Move(dst, source, RelocInfo::NONE);
+    Move(dst, reinterpret_cast<Address>(source), RelocInfo::NONE);
   }
 }
 
-void MacroAssembler::Integer32ToSmi(Register dst, Register src) {
+void TurboAssembler::Move(Register dst, ExternalReference ext) {
+  if (FLAG_embedded_builtins) {
+    if (root_array_available_ && options().isolate_independent_code) {
+      IndirectLoadExternalReference(dst, ext);
+      return;
+    }
+  }
+  movp(dst, ext.address(), RelocInfo::EXTERNAL_REFERENCE);
+}
+
+void MacroAssembler::SmiTag(Register dst, Register src) {
   STATIC_ASSERT(kSmiTag == 0);
   if (dst != src) {
-    movl(dst, src);
+    movp(dst, src);
   }
+  DCHECK(SmiValuesAre32Bits() || SmiValuesAre31Bits());
   shlp(dst, Immediate(kSmiShift));
 }
 
-void TurboAssembler::SmiToInteger32(Register dst, Register src) {
+void TurboAssembler::SmiUntag(Register dst, Register src) {
   STATIC_ASSERT(kSmiTag == 0);
   if (dst != src) {
     movp(dst, src);
   }
-
-  if (SmiValuesAre32Bits()) {
-    shrp(dst, Immediate(kSmiShift));
-  } else {
-    DCHECK(SmiValuesAre31Bits());
-    sarl(dst, Immediate(kSmiShift));
-  }
+  DCHECK(SmiValuesAre32Bits() || SmiValuesAre31Bits());
+  sarp(dst, Immediate(kSmiShift));
 }
 
-void TurboAssembler::SmiToInteger32(Register dst, Operand src) {
+void TurboAssembler::SmiUntag(Register dst, Operand src) {
   if (SmiValuesAre32Bits()) {
     movl(dst, Operand(src, kSmiShift / kBitsPerByte));
+    // Sign extend to 64-bit.
+    movsxlq(dst, dst);
   } else {
     DCHECK(SmiValuesAre31Bits());
-    movl(dst, src);
-    sarl(dst, Immediate(kSmiShift));
-  }
-}
-
-
-void MacroAssembler::SmiToInteger64(Register dst, Register src) {
-  STATIC_ASSERT(kSmiTag == 0);
-  if (dst != src) {
     movp(dst, src);
-  }
-  sarp(dst, Immediate(kSmiShift));
-  if (kPointerSize == kInt32Size) {
-    // Sign extend to 64-bit.
-    movsxlq(dst, dst);
+    sarp(dst, Immediate(kSmiShift));
   }
 }
 
@@ -1034,7 +1139,6 @@ void TurboAssembler::JumpIfSmi(Register src, Label* on_smi,
   j(smi, on_smi, near_jump);
 }
 
-
 void MacroAssembler::JumpIfNotSmi(Register src,
                                   Label* on_not_smi,
                                   Label::Distance near_jump) {
@@ -1055,7 +1159,16 @@ void MacroAssembler::SmiAddConstant(Operand dst, Smi* constant) {
            Immediate(constant->value()));
     } else {
       DCHECK(SmiValuesAre31Bits());
-      addp(dst, Immediate(constant));
+      if (kPointerSize == kInt64Size) {
+        // Sign-extend value after addition
+        movl(kScratchRegister, dst);
+        addl(kScratchRegister, Immediate(constant));
+        movsxlq(kScratchRegister, kScratchRegister);
+        movq(dst, kScratchRegister);
+      } else {
+        DCHECK_EQ(kSmiShiftSize, 32);
+        addp(dst, Immediate(constant));
+      }
     }
   }
 }
@@ -1078,18 +1191,21 @@ SmiIndex MacroAssembler::SmiToIndex(Register dst,
     return SmiIndex(dst, times_1);
   } else {
     DCHECK(SmiValuesAre31Bits());
-    DCHECK(shift >= times_1 && shift <= (static_cast<int>(times_8) + 1));
     if (dst != src) {
       movp(dst, src);
     }
     // We have to sign extend the index register to 64-bit as the SMI might
     // be negative.
     movsxlq(dst, dst);
-    if (shift == times_1) {
-      sarq(dst, Immediate(kSmiShift));
-      return SmiIndex(dst, times_1);
+    if (shift < kSmiShift) {
+      sarq(dst, Immediate(kSmiShift - shift));
+    } else if (shift != kSmiShift) {
+      if (shift - kSmiShift <= static_cast<int>(times_8)) {
+        return SmiIndex(dst, static_cast<ScaleFactor>(shift - kSmiShift));
+      }
+      shlq(dst, Immediate(shift - kSmiShift));
     }
-    return SmiIndex(dst, static_cast<ScaleFactor>(shift - 1));
+    return SmiIndex(dst, times_1);
   }
 }
 
@@ -1176,23 +1292,23 @@ void TurboAssembler::Move(XMMRegister dst, uint64_t src) {
 // ----------------------------------------------------------------------------
 
 void MacroAssembler::Absps(XMMRegister dst) {
-  Andps(dst, ExternalOperand(
-                 ExternalReference::address_of_float_abs_constant(isolate())));
+  Andps(dst,
+        ExternalOperand(ExternalReference::address_of_float_abs_constant()));
 }
 
 void MacroAssembler::Negps(XMMRegister dst) {
-  Xorps(dst, ExternalOperand(
-                 ExternalReference::address_of_float_neg_constant(isolate())));
+  Xorps(dst,
+        ExternalOperand(ExternalReference::address_of_float_neg_constant()));
 }
 
 void MacroAssembler::Abspd(XMMRegister dst) {
-  Andps(dst, ExternalOperand(
-                 ExternalReference::address_of_double_abs_constant(isolate())));
+  Andps(dst,
+        ExternalOperand(ExternalReference::address_of_double_abs_constant()));
 }
 
 void MacroAssembler::Negpd(XMMRegister dst) {
-  Xorps(dst, ExternalOperand(
-                 ExternalReference::address_of_double_neg_constant(isolate())));
+  Xorps(dst,
+        ExternalOperand(ExternalReference::address_of_double_neg_constant()));
 }
 
 void MacroAssembler::Cmp(Register dst, Handle<Object> source) {
@@ -1222,7 +1338,13 @@ void TurboAssembler::Push(Handle<HeapObject> source) {
 
 void TurboAssembler::Move(Register result, Handle<HeapObject> object,
                           RelocInfo::Mode rmode) {
-  movp(result, reinterpret_cast<void*>(object.address()), rmode);
+  if (FLAG_embedded_builtins) {
+    if (root_array_available_ && options().isolate_independent_code) {
+      IndirectLoadConstant(result, object);
+      return;
+    }
+  }
+  movp(result, object.address(), rmode);
 }
 
 void TurboAssembler::Move(Operand dst, Handle<HeapObject> object,
@@ -1337,13 +1459,12 @@ void MacroAssembler::PopQuad(Operand dst) {
   }
 }
 
-
-void MacroAssembler::Jump(ExternalReference ext) {
+void TurboAssembler::Jump(ExternalReference ext) {
   LoadAddress(kScratchRegister, ext);
   jmp(kScratchRegister);
 }
 
-void MacroAssembler::Jump(Operand op) {
+void TurboAssembler::Jump(Operand op) {
   if (kPointerSize == kInt64Size) {
     jmp(op);
   } else {
@@ -1352,16 +1473,47 @@ void MacroAssembler::Jump(Operand op) {
   }
 }
 
-
-void MacroAssembler::Jump(Address destination, RelocInfo::Mode rmode) {
+void TurboAssembler::Jump(Address destination, RelocInfo::Mode rmode) {
   Move(kScratchRegister, destination, rmode);
   jmp(kScratchRegister);
 }
 
-
-void MacroAssembler::Jump(Handle<Code> code_object, RelocInfo::Mode rmode) {
-  // TODO(X64): Inline this
-  jmp(code_object, rmode);
+void TurboAssembler::Jump(Handle<Code> code_object, RelocInfo::Mode rmode,
+                          Condition cc) {
+// TODO(X64): Inline this
+if (FLAG_embedded_builtins) {
+  if (root_array_available_ && options().isolate_independent_code &&
+      !Builtins::IsIsolateIndependentBuiltin(*code_object)) {
+    // Calls to embedded targets are initially generated as standard
+    // pc-relative calls below. When creating the embedded blob, call offsets
+    // are patched up to point directly to the off-heap instruction start.
+    // Note: It is safe to dereference code_object above since code generation
+    // for builtins and code stubs happens on the main thread.
+    Label skip;
+    if (cc != always) {
+      if (cc == never) return;
+      j(NegateCondition(cc), &skip, Label::kNear);
+    }
+    IndirectLoadConstant(kScratchRegister, code_object);
+    leap(kScratchRegister, FieldOperand(kScratchRegister, Code::kHeaderSize));
+    jmp(kScratchRegister);
+    bind(&skip);
+    return;
+  } else if (options().inline_offheap_trampolines) {
+    int builtin_index = Builtins::kNoBuiltinId;
+    if (isolate()->builtins()->IsBuiltinHandle(code_object, &builtin_index) &&
+        Builtins::IsIsolateIndependent(builtin_index)) {
+      // Inline the trampoline.
+      CHECK_NE(builtin_index, Builtins::kNoBuiltinId);
+      EmbeddedData d = EmbeddedData::FromBlob();
+      Address entry = d.InstructionStartOfBuiltin(builtin_index);
+      Move(kScratchRegister, entry, RelocInfo::OFF_HEAP_TARGET);
+      jmp(kScratchRegister);
+      return;
+    }
+  }
+}
+j(cc, code_object, rmode);
 }
 
 void MacroAssembler::JumpToInstructionStream(Address entry) {
@@ -1403,6 +1555,32 @@ void TurboAssembler::Call(Address destination, RelocInfo::Mode rmode) {
 }
 
 void TurboAssembler::Call(Handle<Code> code_object, RelocInfo::Mode rmode) {
+  if (FLAG_embedded_builtins) {
+    if (root_array_available_ && options().isolate_independent_code &&
+        !Builtins::IsIsolateIndependentBuiltin(*code_object)) {
+      // Calls to embedded targets are initially generated as standard
+      // pc-relative calls below. When creating the embedded blob, call offsets
+      // are patched up to point directly to the off-heap instruction start.
+      // Note: It is safe to dereference code_object above since code generation
+      // for builtins and code stubs happens on the main thread.
+      IndirectLoadConstant(kScratchRegister, code_object);
+      leap(kScratchRegister, FieldOperand(kScratchRegister, Code::kHeaderSize));
+      call(kScratchRegister);
+      return;
+    } else if (options().inline_offheap_trampolines) {
+      int builtin_index = Builtins::kNoBuiltinId;
+      if (isolate()->builtins()->IsBuiltinHandle(code_object, &builtin_index) &&
+          Builtins::IsIsolateIndependent(builtin_index)) {
+        // Inline the trampoline.
+        CHECK_NE(builtin_index, Builtins::kNoBuiltinId);
+        EmbeddedData d = EmbeddedData::FromBlob();
+        Address entry = d.InstructionStartOfBuiltin(builtin_index);
+        Move(kScratchRegister, entry, RelocInfo::OFF_HEAP_TARGET);
+        call(kScratchRegister);
+        return;
+      }
+    }
+  }
 #ifdef DEBUG
   int end_position = pc_offset() + CallSize(code_object);
 #endif
@@ -1723,8 +1901,8 @@ void MacroAssembler::PushStackHandler() {
   Push(Immediate(0));  // Padding.
 
   // Link the current handler as the next handler.
-  ExternalReference handler_address(IsolateAddressId::kHandlerAddress,
-                                    isolate());
+  ExternalReference handler_address =
+      ExternalReference::Create(IsolateAddressId::kHandlerAddress, isolate());
   Push(ExternalOperand(handler_address));
 
   // Set this new handler as the current one.
@@ -1734,8 +1912,8 @@ void MacroAssembler::PushStackHandler() {
 
 void MacroAssembler::PopStackHandler() {
   STATIC_ASSERT(StackHandlerConstants::kNextOffset == 0);
-  ExternalReference handler_address(IsolateAddressId::kHandlerAddress,
-                                    isolate());
+  ExternalReference handler_address =
+      ExternalReference::Create(IsolateAddressId::kHandlerAddress, isolate());
   Pop(ExternalOperand(handler_address));
   addp(rsp, Immediate(StackHandlerConstants::kSize - kPointerSize));
 }
@@ -1765,10 +1943,6 @@ void MacroAssembler::CmpInstanceType(Register map, InstanceType type) {
   cmpw(FieldOperand(map, Map::kInstanceTypeOffset), Immediate(type));
 }
 
-void TurboAssembler::SlowTruncateToIDelayed(Zone* zone, Register result_reg) {
-  CallStubDelayed(new (zone) DoubleToIStub(nullptr, result_reg));
-}
-
 void MacroAssembler::DoubleToI(Register result_reg, XMMRegister input_reg,
                                XMMRegister scratch, Label* lost_precision,
                                Label* is_nan, Label::Distance dst) {
@@ -1802,17 +1976,6 @@ void MacroAssembler::AssertSmi(Operand object) {
   }
 }
 
-void MacroAssembler::AssertFixedArray(Register object) {
-  if (emit_debug_code()) {
-    testb(object, Immediate(kSmiTagMask));
-    Check(not_equal, AbortReason::kOperandIsASmiAndNotAFixedArray);
-    Push(object);
-    CmpObjectType(object, FIXED_ARRAY_TYPE, object);
-    Pop(object);
-    Check(equal, AbortReason::kOperandIsNotAFixedArray);
-  }
-}
-
 void TurboAssembler::AssertZeroExtended(Register int32_register) {
   if (emit_debug_code()) {
     DCHECK_NE(int32_register, kScratchRegister);
@@ -1904,7 +2067,8 @@ void MacroAssembler::LoadWeakValue(Register in_out, Label* target_if_cleared) {
 void MacroAssembler::IncrementCounter(StatsCounter* counter, int value) {
   DCHECK_GT(value, 0);
   if (FLAG_native_code_counters && counter->Enabled()) {
-    Operand counter_operand = ExternalOperand(ExternalReference(counter));
+    Operand counter_operand =
+        ExternalOperand(ExternalReference::Create(counter));
     if (value == 1) {
       incl(counter_operand);
     } else {
@@ -1917,7 +2081,8 @@ void MacroAssembler::IncrementCounter(StatsCounter* counter, int value) {
 void MacroAssembler::DecrementCounter(StatsCounter* counter, int value) {
   DCHECK_GT(value, 0);
   if (FLAG_native_code_counters && counter->Enabled()) {
-    Operand counter_operand = ExternalOperand(ExternalReference(counter));
+    Operand counter_operand =
+        ExternalOperand(ExternalReference::Create(counter));
     if (value == 1) {
       decl(counter_operand);
     } else {
@@ -1932,8 +2097,12 @@ void MacroAssembler::MaybeDropFrames() {
       ExternalReference::debug_restart_fp_address(isolate());
   Load(rbx, restart_fp);
   testp(rbx, rbx);
-  j(not_zero, BUILTIN_CODE(isolate(), FrameDropperTrampoline),
-    RelocInfo::CODE_TARGET);
+
+  Label dont_drop;
+  j(zero, &dont_drop, Label::kNear);
+  Jump(BUILTIN_CODE(isolate(), FrameDropperTrampoline), RelocInfo::CODE_TARGET);
+
+  bind(&dont_drop);
 }
 
 void TurboAssembler::PrepareForTailCall(const ParameterCount& callee_args_count,
@@ -2006,7 +2175,7 @@ void MacroAssembler::InvokeFunction(Register function, Register new_target,
                                     const ParameterCount& actual,
                                     InvokeFlag flag) {
   movp(rbx, FieldOperand(function, JSFunction::kSharedFunctionInfoOffset));
-  movsxlq(rbx,
+  movzxwq(rbx,
           FieldOperand(rbx, SharedFunctionInfo::kFormalParameterCountOffset));
 
   ParameterCount expected(rbx);
@@ -2136,18 +2305,20 @@ void MacroAssembler::CheckDebugHook(Register fun, Register new_target,
     FrameScope frame(this,
                      has_frame() ? StackFrame::NONE : StackFrame::INTERNAL);
     if (expected.is_reg()) {
-      Integer32ToSmi(expected.reg(), expected.reg());
+      SmiTag(expected.reg(), expected.reg());
       Push(expected.reg());
     }
     if (actual.is_reg()) {
-      Integer32ToSmi(actual.reg(), actual.reg());
+      SmiTag(actual.reg(), actual.reg());
       Push(actual.reg());
+      SmiUntag(actual.reg(), actual.reg());
     }
     if (new_target.is_valid()) {
       Push(new_target);
     }
     Push(fun);
     Push(fun);
+    Push(StackArgumentsAccessor(rbp, actual).GetReceiverOperand());
     CallRuntime(Runtime::kDebugOnFunctionCall);
     Pop(fun);
     if (new_target.is_valid()) {
@@ -2155,11 +2326,11 @@ void MacroAssembler::CheckDebugHook(Register fun, Register new_target,
     }
     if (actual.is_reg()) {
       Pop(actual.reg());
-      SmiToInteger64(actual.reg(), actual.reg());
+      SmiUntag(actual.reg(), actual.reg());
     }
     if (expected.is_reg()) {
       Pop(expected.reg());
-      SmiToInteger64(expected.reg(), expected.reg());
+      SmiUntag(expected.reg(), expected.reg());
     }
   }
   bind(&skip_hook);
@@ -2182,17 +2353,6 @@ void TurboAssembler::EnterFrame(StackFrame::Type type) {
   pushq(rbp);
   movp(rbp, rsp);
   Push(Immediate(StackFrame::TypeToMarker(type)));
-  if (type == StackFrame::INTERNAL) {
-    Move(kScratchRegister, CodeObject(), RelocInfo::EMBEDDED_OBJECT);
-    Push(kScratchRegister);
-    // Check at runtime that this code object was patched correctly.
-    if (emit_debug_code()) {
-      Move(kScratchRegister, isolate()->factory()->undefined_value(),
-           RelocInfo::EMBEDDED_OBJECT);
-      cmpp(Operand(rsp, 0), kScratchRegister);
-      Check(not_equal, AbortReason::kCodeObjectNotProperlyPatched);
-    }
-  }
 }
 
 void TurboAssembler::LeaveFrame(StackFrame::Type type) {
@@ -2248,9 +2408,14 @@ void MacroAssembler::EnterExitFramePrologue(bool save_rax,
     movp(r14, rax);  // Backup rax in callee-save register.
   }
 
-  Store(ExternalReference(IsolateAddressId::kCEntryFPAddress, isolate()), rbp);
-  Store(ExternalReference(IsolateAddressId::kContextAddress, isolate()), rsi);
-  Store(ExternalReference(IsolateAddressId::kCFunctionAddress, isolate()), rbx);
+  Store(
+      ExternalReference::Create(IsolateAddressId::kCEntryFPAddress, isolate()),
+      rbp);
+  Store(ExternalReference::Create(IsolateAddressId::kContextAddress, isolate()),
+        rsi);
+  Store(
+      ExternalReference::Create(IsolateAddressId::kCFunctionAddress, isolate()),
+      rbx);
 }
 
 
@@ -2347,8 +2512,8 @@ void MacroAssembler::LeaveApiExitFrame() {
 
 void MacroAssembler::LeaveExitFrameEpilogue() {
   // Restore current context from top and clear it in debug mode.
-  ExternalReference context_address(IsolateAddressId::kContextAddress,
-                                    isolate());
+  ExternalReference context_address =
+      ExternalReference::Create(IsolateAddressId::kContextAddress, isolate());
   Operand context_operand = ExternalOperand(context_address);
   movp(rsi, context_operand);
 #ifdef DEBUG
@@ -2356,8 +2521,8 @@ void MacroAssembler::LeaveExitFrameEpilogue() {
 #endif
 
   // Clear the top frame.
-  ExternalReference c_entry_fp_address(IsolateAddressId::kCEntryFPAddress,
-                                       isolate());
+  ExternalReference c_entry_fp_address =
+      ExternalReference::Create(IsolateAddressId::kCEntryFPAddress, isolate());
   Operand c_entry_fp_operand = ExternalOperand(c_entry_fp_address);
   movp(c_entry_fp_operand, Immediate(0));
 }
@@ -2484,10 +2649,7 @@ void TurboAssembler::ComputeCodeStartAddress(Register dst) {
   bind(&current);
   int pc = pc_offset();
   // Load effective address to get the address of the current instruction.
-  leaq(dst, Operand(&current));
-  if (pc != 0) {
-    subq(dst, Immediate(pc));
-  }
+  leaq(dst, Operand(&current, -pc));
 }
 
 void TurboAssembler::ResetSpeculationPoisonRegister() {
diff --git a/deps/v8/src/x64/macro-assembler-x64.h b/deps/v8/src/x64/macro-assembler-x64.h
index 564aa8d58d704d..b00201c9f6ac3e 100644
--- a/deps/v8/src/x64/macro-assembler-x64.h
+++ b/deps/v8/src/x64/macro-assembler-x64.h
@@ -8,6 +8,7 @@
 #include "src/bailout-reason.h"
 #include "src/base/flags.h"
 #include "src/globals.h"
+#include "src/turbo-assembler.h"
 #include "src/x64/assembler-x64.h"
 
 namespace v8 {
@@ -25,11 +26,16 @@ constexpr Register kInterpreterAccumulatorRegister = rax;
 constexpr Register kInterpreterBytecodeOffsetRegister = r9;
 constexpr Register kInterpreterBytecodeArrayRegister = r14;
 constexpr Register kInterpreterDispatchTableRegister = r15;
+
 constexpr Register kJavaScriptCallArgCountRegister = rax;
 constexpr Register kJavaScriptCallCodeStartRegister = rcx;
+constexpr Register kJavaScriptCallTargetRegister = kJSFunctionRegister;
 constexpr Register kJavaScriptCallNewTargetRegister = rdx;
+constexpr Register kJavaScriptCallExtraArg1Register = rbx;
+
 constexpr Register kRuntimeCallFunctionRegister = rbx;
 constexpr Register kRuntimeCallArgCountRegister = rax;
+constexpr Register kWasmInstanceRegister = rsi;
 
 // Default scratch register used by MacroAssembler (and other code that needs
 // a spare register). The register isn't callee save, and not used by the
@@ -37,9 +43,7 @@ constexpr Register kRuntimeCallArgCountRegister = rax;
 constexpr Register kScratchRegister = r10;
 constexpr XMMRegister kScratchDoubleReg = xmm15;
 constexpr Register kRootRegister = r13;  // callee save
-// Actual value of root register is offset from the root array's start
-// to take advantage of negitive 8-bit displacement values.
-constexpr int kRootRegisterBias = 128;
+
 constexpr Register kOffHeapTrampolineRegister = kScratchRegister;
 
 // Convenience for platform-independent signatures.
@@ -121,20 +125,13 @@ class StackArgumentsAccessor BASE_EMBEDDED {
   DISALLOW_IMPLICIT_CONSTRUCTORS(StackArgumentsAccessor);
 };
 
-class TurboAssembler : public Assembler {
+class TurboAssembler : public TurboAssemblerBase {
  public:
-  TurboAssembler(Isolate* isolate, void* buffer, int buffer_size,
-                 CodeObjectRequired create_code_object);
-
-  void set_has_frame(bool value) { has_frame_ = value; }
-  bool has_frame() const { return has_frame_; }
-
-  Isolate* isolate() const { return isolate_; }
-
-  Handle<HeapObject> CodeObject() {
-    DCHECK(!code_object_.is_null());
-    return code_object_;
-  }
+  TurboAssembler(Isolate* isolate, const AssemblerOptions& options,
+                 void* buffer, int buffer_size,
+                 CodeObjectRequired create_code_object)
+      : TurboAssemblerBase(isolate, options, buffer, buffer_size,
+                           create_code_object) {}
 
   template <typename Dst, typename... Args>
   struct AvxHelper {
@@ -231,7 +228,7 @@ class TurboAssembler : public Assembler {
   void Set(Operand dst, intptr_t x);
 
   // Operations on roots in the root-array.
-  void LoadRoot(Register destination, Heap::RootListIndex index);
+  void LoadRoot(Register destination, Heap::RootListIndex index) override;
   void LoadRoot(Operand destination, Heap::RootListIndex index) {
     LoadRoot(kScratchRegister, index);
     movp(destination, kScratchRegister);
@@ -286,8 +283,18 @@ class TurboAssembler : public Assembler {
   void Cvtqsi2sd(XMMRegister dst, Operand src);
   void Cvtlsi2ss(XMMRegister dst, Register src);
   void Cvtlsi2ss(XMMRegister dst, Operand src);
-  void Cvtqui2ss(XMMRegister dst, Register src, Register tmp);
-  void Cvtqui2sd(XMMRegister dst, Register src, Register tmp);
+  void Cvtlui2ss(XMMRegister dst, Register src);
+  void Cvtlui2ss(XMMRegister dst, Operand src);
+  void Cvtlui2sd(XMMRegister dst, Register src);
+  void Cvtlui2sd(XMMRegister dst, Operand src);
+  void Cvtqui2ss(XMMRegister dst, Register src);
+  void Cvtqui2ss(XMMRegister dst, Operand src);
+  void Cvtqui2sd(XMMRegister dst, Register src);
+  void Cvtqui2sd(XMMRegister dst, Operand src);
+  void Cvttsd2uiq(Register dst, Operand src, Label* fail = nullptr);
+  void Cvttsd2uiq(Register dst, XMMRegister src, Label* fail = nullptr);
+  void Cvttss2uiq(Register dst, Operand src, Label* fail = nullptr);
+  void Cvttss2uiq(Register dst, XMMRegister src, Label* fail = nullptr);
 
   // cvtsi2sd instruction only writes to the low 64-bit of dst register, which
   // hinders register renaming and makes dependence chains longer. So we use
@@ -316,6 +323,16 @@ class TurboAssembler : public Assembler {
   void JumpIfSmi(Register src, Label* on_smi,
                  Label::Distance near_jump = Label::kFar);
 
+  void JumpIfEqual(Register a, int32_t b, Label* dest) {
+    cmpl(a, Immediate(b));
+    j(equal, dest);
+  }
+
+  void JumpIfLessThan(Register a, int32_t b, Label* dest) {
+    cmpl(a, Immediate(b));
+    j(less, dest);
+  }
+
   void Move(Register dst, Smi* source);
 
   void Move(Operand dst, Smi* source) {
@@ -323,10 +340,7 @@ class TurboAssembler : public Assembler {
     movp(dst, constant);
   }
 
-  void Move(Register dst, ExternalReference ext) {
-    movp(dst, reinterpret_cast<void*>(ext.address()),
-         RelocInfo::EXTERNAL_REFERENCE);
-  }
+  void Move(Register dst, ExternalReference ext);
 
   void Move(XMMRegister dst, uint32_t src);
   void Move(XMMRegister dst, uint64_t src);
@@ -342,22 +356,26 @@ class TurboAssembler : public Assembler {
             RelocInfo::Mode rmode = RelocInfo::EMBEDDED_OBJECT);
 
   // Loads a pointer into a register with a relocation mode.
-  void Move(Register dst, void* ptr, RelocInfo::Mode rmode) {
+  void Move(Register dst, Address ptr, RelocInfo::Mode rmode) {
     // This method must not be used with heap object references. The stored
     // address is not GC safe. Use the handle version instead.
     DCHECK(rmode > RelocInfo::LAST_GCED_ENUM);
     movp(dst, ptr, rmode);
   }
 
-  // Convert smi to 32-bit integer. I.e., not sign extended into
-  // high 32 bits of destination.
-  void SmiToInteger32(Register dst, Register src);
-  void SmiToInteger32(Register dst, Operand src);
+  // Convert smi to word-size sign-extended value.
+  void SmiUntag(Register dst, Register src);
+  void SmiUntag(Register dst, Operand src);
 
   // Loads the address of the external reference into the destination
   // register.
   void LoadAddress(Register destination, ExternalReference source);
 
+  void LoadFromConstantsTable(Register destination,
+                              int constant_index) override;
+  void LoadRootRegisterOffset(Register destination, intptr_t offset) override;
+  void LoadRootRelative(Register destination, int32_t offset) override;
+
   // Operand pointing to an external reference.
   // May emit code to set up the scratch register. The operand is
   // only guaranteed to be correct as long as the scratch register
@@ -367,6 +385,7 @@ class TurboAssembler : public Assembler {
   Operand ExternalOperand(ExternalReference reference,
                           Register scratch = kScratchRegister);
 
+  void Call(Register reg) { call(reg); }
   void Call(Operand op);
   void Call(Handle<Code> code_object, RelocInfo::Mode rmode);
   void Call(Address destination, RelocInfo::Mode rmode);
@@ -376,9 +395,17 @@ class TurboAssembler : public Assembler {
   void RetpolineCall(Register reg);
   void RetpolineCall(Address destination, RelocInfo::Mode rmode);
 
+  void Jump(Address destination, RelocInfo::Mode rmode);
+  void Jump(ExternalReference ext);
+  void Jump(Operand op);
+  void Jump(Handle<Code> code_object, RelocInfo::Mode rmode,
+            Condition cc = always);
+
   void RetpolineJump(Register reg);
 
-  void CallForDeoptimization(Address target, RelocInfo::Mode rmode) {
+  void CallForDeoptimization(Address target, int deopt_id,
+                             RelocInfo::Mode rmode) {
+    USE(deopt_id);
     call(target, rmode);
   }
 
@@ -458,11 +485,9 @@ class TurboAssembler : public Assembler {
   // HeapObjectRequest that will be fulfilled after code assembly.
   void CallStubDelayed(CodeStub* stub);
 
-  void SlowTruncateToIDelayed(Zone* zone, Register result_reg);
-
-  // Call a runtime routine.
-  void CallRuntimeDelayed(Zone* zone, Runtime::FunctionId fid,
-                          SaveFPRegsMode save_doubles = kDontSaveFPRegs);
+  // Call a runtime routine. This expects {centry} to contain a fitting CEntry
+  // builtin for the target runtime function and uses an indirect call.
+  void CallRuntimeWithCEntry(Runtime::FunctionId fid, Register centry);
 
   void InitializeRootRegister() {
     ExternalReference roots_array_start =
@@ -515,43 +540,23 @@ class TurboAssembler : public Assembler {
   int smi_count = 0;
   int heap_object_count = 0;
 
-  bool root_array_available_ = true;
-
   int64_t RootRegisterDelta(ExternalReference other);
 
   // Returns a register holding the smi value. The register MUST NOT be
   // modified. It may be the "smi 1 constant" register.
   Register GetSmiConstant(Smi* value);
-
- private:
-  bool has_frame_ = false;
-  // This handle will be patched with the code object on installation.
-  Handle<HeapObject> code_object_;
-  Isolate* const isolate_;
 };
 
 // MacroAssembler implements a collection of frequently used macros.
 class MacroAssembler : public TurboAssembler {
  public:
+  // TODO(titzer): inline this utility constructor.
   MacroAssembler(Isolate* isolate, void* buffer, int size,
-                 CodeObjectRequired create_code_object);
-
-  // Prevent the use of the RootArray during the lifetime of this
-  // scope object.
-  class NoRootArrayScope BASE_EMBEDDED {
-   public:
-    explicit NoRootArrayScope(MacroAssembler* assembler)
-        : variable_(&assembler->root_array_available_),
-          old_value_(assembler->root_array_available_) {
-      assembler->root_array_available_ = false;
-    }
-    ~NoRootArrayScope() {
-      *variable_ = old_value_;
-    }
-   private:
-    bool* variable_;
-    bool old_value_;
-  };
+                 CodeObjectRequired create_code_object)
+      : MacroAssembler(isolate, AssemblerOptions::Default(isolate), buffer,
+                       size, create_code_object) {}
+  MacroAssembler(Isolate* isolate, const AssemblerOptions& options,
+                 void* buffer, int size, CodeObjectRequired create_code_object);
 
   // Loads and stores the value of an external reference.
   // Special case code for load and store to take advantage of
@@ -677,13 +682,8 @@ class MacroAssembler : public TurboAssembler {
   // ---------------------------------------------------------------------------
   // Conversions between tagged smi values and non-tagged integer values.
 
-  // Tag an integer value. The result must be known to be a valid smi value.
-  // Only uses the low 32 bits of the src register. Sets the N and Z flags
-  // based on the value of the resulting smi.
-  void Integer32ToSmi(Register dst, Register src);
-
-  // Convert smi to 64-bit integer (sign extended if necessary).
-  void SmiToInteger64(Register dst, Register src);
+  // Tag an word-size value. The result must be known to be a valid smi value.
+  void SmiTag(Register dst, Register src);
 
   // Simple comparison of smis.  Both sides must be known smis to use these,
   // otherwise use Cmp.
@@ -762,13 +762,6 @@ class MacroAssembler : public TurboAssembler {
   void Negps(XMMRegister dst);
   void Abspd(XMMRegister dst);
   void Negpd(XMMRegister dst);
-
-  // Control Flow
-  void Jump(Address destination, RelocInfo::Mode rmode);
-  void Jump(ExternalReference ext);
-  void Jump(Operand op);
-  void Jump(Handle<Code> code_object, RelocInfo::Mode rmode);
-
   // Generates a trampoline to jump to the off-heap instruction stream.
   void JumpToInstructionStream(Address entry);
 
@@ -810,9 +803,6 @@ class MacroAssembler : public TurboAssembler {
   void AssertSmi(Register object);
   void AssertSmi(Operand object);
 
-  // Abort execution if argument is not a FixedArray, enabled via --debug-code.
-  void AssertFixedArray(Register object);
-
   // Abort execution if argument is not a Constructor, enabled via --debug-code.
   void AssertConstructor(Register object);
 
diff --git a/deps/v8/src/zone/zone-containers.h b/deps/v8/src/zone/zone-containers.h
index c899bf340d76ec..1988826779292f 100644
--- a/deps/v8/src/zone/zone-containers.h
+++ b/deps/v8/src/zone/zone-containers.h
@@ -129,6 +129,17 @@ class ZoneSet : public std::set<K, Compare, ZoneAllocator<K>> {
                                                ZoneAllocator<K>(zone)) {}
 };
 
+// A wrapper subclass for std::multiset to make it easy to construct one that
+// uses a zone allocator.
+template <typename K, typename Compare = std::less<K>>
+class ZoneMultiset : public std::multiset<K, Compare, ZoneAllocator<K>> {
+ public:
+  // Constructs an empty set.
+  explicit ZoneMultiset(Zone* zone)
+      : std::multiset<K, Compare, ZoneAllocator<K>>(Compare(),
+                                                    ZoneAllocator<K>(zone)) {}
+};
+
 // A wrapper subclass for std::map to make it easy to construct one that uses
 // a zone allocator.
 template <typename K, typename V, typename Compare = std::less<K>>
diff --git a/deps/v8/src/zone/zone-segment.cc b/deps/v8/src/zone/zone-segment.cc
index 1fa49d49ba8b32..b9649d494a430c 100644
--- a/deps/v8/src/zone/zone-segment.cc
+++ b/deps/v8/src/zone/zone-segment.cc
@@ -4,19 +4,23 @@
 
 #include "src/zone/zone-segment.h"
 
+#include "src/msan.h"
+
 namespace v8 {
 namespace internal {
 
 void Segment::ZapContents() {
 #ifdef DEBUG
-  memset(start(), kZapDeadByte, capacity());
+  memset(reinterpret_cast<void*>(start()), kZapDeadByte, capacity());
 #endif
+  MSAN_ALLOCATED_UNINITIALIZED_MEMORY(start(), capacity());
 }
 
 void Segment::ZapHeader() {
 #ifdef DEBUG
   memset(this, kZapDeadByte, sizeof(Segment));
 #endif
+  MSAN_ALLOCATED_UNINITIALIZED_MEMORY(start(), sizeof(Segment));
 }
 
 }  // namespace internal
diff --git a/deps/v8/src/zone/zone-segment.h b/deps/v8/src/zone/zone-segment.h
index e1c3ed00481d40..206edc7d646ae2 100644
--- a/deps/v8/src/zone/zone-segment.h
+++ b/deps/v8/src/zone/zone-segment.h
@@ -46,7 +46,9 @@ class Segment {
 #endif
 
   // Computes the address of the nth byte in this segment.
-  Address address(size_t n) const { return Address(this) + n; }
+  Address address(size_t n) const {
+    return reinterpret_cast<Address>(this) + n;
+  }
 
   Zone* zone_;
   Segment* next_;
diff --git a/deps/v8/src/zone/zone.cc b/deps/v8/src/zone/zone.cc
index c11973250c7a03..295d7815cb4db7 100644
--- a/deps/v8/src/zone/zone.cc
+++ b/deps/v8/src/zone/zone.cc
@@ -6,37 +6,22 @@
 
 #include <cstring>
 
+#include "src/asan.h"
 #include "src/utils.h"
 #include "src/v8.h"
 
-#ifdef V8_USE_ADDRESS_SANITIZER
-#include <sanitizer/asan_interface.h>
-#endif  // V8_USE_ADDRESS_SANITIZER
-
 namespace v8 {
 namespace internal {
 
 namespace {
 
-#if V8_USE_ADDRESS_SANITIZER
-
-const size_t kASanRedzoneBytes = 24;  // Must be a multiple of 8.
-
-#else
+#ifdef V8_USE_ADDRESS_SANITIZER
 
-#define ASAN_POISON_MEMORY_REGION(start, size) \
-  do {                                         \
-    USE(start);                                \
-    USE(size);                                 \
-  } while (false)
+constexpr size_t kASanRedzoneBytes = 24;  // Must be a multiple of 8.
 
-#define ASAN_UNPOISON_MEMORY_REGION(start, size) \
-  do {                                           \
-    USE(start);                                  \
-    USE(size);                                   \
-  } while (false)
+#else  // !V8_USE_ADDRESS_SANITIZER
 
-const size_t kASanRedzoneBytes = 0;
+constexpr size_t kASanRedzoneBytes = 0;
 
 #endif  // V8_USE_ADDRESS_SANITIZER
 
@@ -74,18 +59,17 @@ void* Zone::New(size_t size) {
   Address result = position_;
 
   const size_t size_with_redzone = size + kASanRedzoneBytes;
-  const uintptr_t limit = reinterpret_cast<uintptr_t>(limit_);
-  const uintptr_t position = reinterpret_cast<uintptr_t>(position_);
-  // position_ > limit_ can be true after the alignment correction above.
-  if (limit < position || size_with_redzone > limit - position) {
+  DCHECK(limit_ >= position_);
+  if (size_with_redzone > limit_ - position_) {
     result = NewExpand(size_with_redzone);
   } else {
     position_ += size_with_redzone;
   }
 
   Address redzone_position = result + size;
-  DCHECK(redzone_position + kASanRedzoneBytes == position_);
-  ASAN_POISON_MEMORY_REGION(redzone_position, kASanRedzoneBytes);
+  DCHECK_EQ(redzone_position + kASanRedzoneBytes, position_);
+  ASAN_POISON_MEMORY_REGION(reinterpret_cast<void*>(redzone_position),
+                            kASanRedzoneBytes);
 
   // Check that the result has the proper alignment and return it.
   DCHECK(IsAddressAligned(result, kAlignmentInBytes, 0));
@@ -100,7 +84,8 @@ void Zone::DeleteAll() {
     size_t size = current->size();
 
     // Un-poison the segment content so we can re-use or zap it later.
-    ASAN_UNPOISON_MEMORY_REGION(current->start(), current->capacity());
+    ASAN_UNPOISON_MEMORY_REGION(reinterpret_cast<void*>(current->start()),
+                                current->capacity());
 
     segment_bytes_allocated_ -= size;
     allocator_->ReturnSegment(current);
@@ -130,10 +115,7 @@ Address Zone::NewExpand(size_t size) {
   // Make sure the requested size is already properly aligned and that
   // there isn't enough room in the Zone to satisfy the request.
   DCHECK_EQ(size, RoundDown(size, kAlignmentInBytes));
-  DCHECK(limit_ < position_ ||
-         reinterpret_cast<uintptr_t>(limit_) -
-                 reinterpret_cast<uintptr_t>(position_) <
-             size);
+  DCHECK(limit_ - position_ < size);
 
   // Compute the new segment size. We use a 'high water mark'
   // strategy, where we increase the segment size every time we expand
@@ -148,7 +130,7 @@ Address Zone::NewExpand(size_t size) {
   // Guard against integer overflow.
   if (new_size_no_overhead < size || new_size < kSegmentOverhead) {
     V8::FatalProcessOutOfMemory(nullptr, "Zone");
-    return nullptr;
+    return kNullAddress;
   }
   if (segment_size_ == SegmentSize::kLarge) {
     new_size = kMaximumSegmentSize;
@@ -164,12 +146,12 @@ Address Zone::NewExpand(size_t size) {
   }
   if (new_size > INT_MAX) {
     V8::FatalProcessOutOfMemory(nullptr, "Zone");
-    return nullptr;
+    return kNullAddress;
   }
   Segment* segment = NewSegment(new_size);
   if (segment == nullptr) {
     V8::FatalProcessOutOfMemory(nullptr, "Zone");
-    return nullptr;
+    return kNullAddress;
   }
 
   // Recompute 'top' and 'limit' based on the new segment.
@@ -178,8 +160,7 @@ Address Zone::NewExpand(size_t size) {
   // Check for address overflow.
   // (Should not happen since the segment is guaranteed to accommodate
   // size bytes + header and alignment padding)
-  DCHECK(reinterpret_cast<uintptr_t>(position_) >=
-         reinterpret_cast<uintptr_t>(result));
+  DCHECK(position_ >= result);
   limit_ = segment->end();
   DCHECK(position_ <= limit_);
   return result;
diff --git a/deps/v8/src/zone/zone.h b/deps/v8/src/zone/zone.h
index e15e3d116e744d..6f863f27fd2dcd 100644
--- a/deps/v8/src/zone/zone.h
+++ b/deps/v8/src/zone/zone.h
@@ -172,10 +172,10 @@ class ZoneList final {
     AddAll(other, zone);
   }
 
-  INLINE(~ZoneList()) { DeleteData(data_); }
+  V8_INLINE ~ZoneList() { DeleteData(data_); }
 
   // Please the MSVC compiler.  We should never have to execute this.
-  INLINE(void operator delete(void* p, ZoneAllocationPolicy allocator)) {
+  V8_INLINE void operator delete(void* p, ZoneAllocationPolicy allocator) {
     UNREACHABLE();
   }
 
@@ -197,9 +197,9 @@ class ZoneList final {
   inline iterator begin() const { return &data_[0]; }
   inline iterator end() const { return &data_[length_]; }
 
-  INLINE(bool is_empty() const) { return length_ == 0; }
-  INLINE(int length() const) { return length_; }
-  INLINE(int capacity() const) { return capacity_; }
+  V8_INLINE bool is_empty() const { return length_ == 0; }
+  V8_INLINE int length() const { return length_; }
+  V8_INLINE int capacity() const { return capacity_; }
 
   Vector<T> ToVector() const { return Vector<T>(data_, length_); }
 
@@ -207,7 +207,7 @@ class ZoneList final {
     return Vector<const T>(data_, length_);
   }
 
-  INLINE(void Initialize(int capacity, Zone* zone)) {
+  V8_INLINE void Initialize(int capacity, Zone* zone) {
     DCHECK_GE(capacity, 0);
     data_ = (capacity > 0) ? NewData(capacity, ZoneAllocationPolicy(zone))
                            : nullptr;
@@ -241,15 +241,15 @@ class ZoneList final {
 
   // Removes the last element without deleting it even if T is a
   // pointer type. Returns the removed element.
-  INLINE(T RemoveLast()) { return Remove(length_ - 1); }
+  V8_INLINE T RemoveLast() { return Remove(length_ - 1); }
 
   // Clears the list by freeing the storage memory. If you want to keep the
   // memory, use Rewind(0) instead. Be aware, that even if T is a
   // pointer type, clearing the list doesn't delete the entries.
-  INLINE(void Clear());
+  V8_INLINE void Clear();
 
   // Drops all but the first 'pos' elements from the list.
-  INLINE(void Rewind(int pos));
+  V8_INLINE void Rewind(int pos);
 
   inline bool Contains(const T& elm) const;
 
@@ -271,10 +271,10 @@ class ZoneList final {
   int capacity_;
   int length_;
 
-  INLINE(T* NewData(int n, ZoneAllocationPolicy allocator)) {
+  V8_INLINE T* NewData(int n, ZoneAllocationPolicy allocator) {
     return static_cast<T*>(allocator.New(n * sizeof(T)));
   }
-  INLINE(void DeleteData(T* data)) { ZoneAllocationPolicy::Delete(data); }
+  V8_INLINE void DeleteData(T* data) { ZoneAllocationPolicy::Delete(data); }
 
   // Increase the capacity of a full list, and add an element.
   // List must be full already.
@@ -290,6 +290,11 @@ class ZoneList final {
   DISALLOW_COPY_AND_ASSIGN(ZoneList);
 };
 
+// ZonePtrList is a ZoneList of pointers to ZoneObjects allocated in the same
+// zone as the list object.
+template <typename T>
+using ZonePtrList = ZoneList<T*>;
+
 // A zone splay tree.  The config type parameter encapsulates the
 // different configurations of a concrete splay tree (see splay-tree.h).
 // The tree itself and all its elements are allocated in the Zone.
diff --git a/deps/v8/test/cctest/BUILD.gn b/deps/v8/test/cctest/BUILD.gn
index 51e737f7b920b1..9072d6bed7213f 100644
--- a/deps/v8/test/cctest/BUILD.gn
+++ b/deps/v8/test/cctest/BUILD.gn
@@ -124,6 +124,7 @@ v8_source_set("cctest_sources") {
     "heap/test-mark-compact.cc",
     "heap/test-page-promotion.cc",
     "heap/test-spaces.cc",
+    "heap/test-unmapper.cc",
     "heap/test-weak-references.cc",
     "interpreter/bytecode-expectations-printer.cc",
     "interpreter/bytecode-expectations-printer.h",
@@ -191,6 +192,7 @@ v8_source_set("cctest_sources") {
     "test-heap-profiler.cc",
     "test-identity-map.cc",
     "test-inobject-slack-tracking.cc",
+    "test-inspector.cc",
     "test-intl.cc",
     "test-isolate-independent-builtins.cc",
     "test-liveedit.cc",
@@ -207,6 +209,7 @@ v8_source_set("cctest_sources") {
     "test-random-number-generator.cc",
     "test-regexp.cc",
     "test-representation.cc",
+    "test-roots.cc",
     "test-sampler-api.cc",
     "test-serialize.cc",
     "test-strings.cc",
@@ -228,6 +231,7 @@ v8_source_set("cctest_sources") {
     "test-version.cc",
     "test-weakmaps.cc",
     "test-weaksets.cc",
+    "torque/test-torque.cc",
     "trace-extension.cc",
     "trace-extension.h",
     "types-fuzz.h",
@@ -246,6 +250,8 @@ v8_source_set("cctest_sources") {
     "wasm/test-wasm-breakpoints.cc",
     "wasm/test-wasm-codegen.cc",
     "wasm/test-wasm-interpreter-entry.cc",
+    "wasm/test-wasm-serialization.cc",
+    "wasm/test-wasm-shared-engine.cc",
     "wasm/test-wasm-stack.cc",
     "wasm/test-wasm-trap-position.cc",
     "wasm/wasm-atomics-utils.h",
@@ -375,12 +381,13 @@ v8_source_set("cctest_sources") {
     "../..:v8_libbase",
     "../..:v8_libplatform",
     "../..:wasm_module_runner",
-    "//build/config:exe_and_shlib_deps",
     "//build/win:default_exe_manifest",
   ]
 
   defines = []
-  deps = []
+  deps = [
+    "../..:run_torque",
+  ]
 
   if (is_component_build) {
     # cctest can't be built against a shared library, so we
@@ -393,6 +400,7 @@ v8_source_set("cctest_sources") {
 
   if (v8_enable_i18n_support) {
     defines += [ "V8_INTL_SUPPORT" ]
+    public_deps += [ "//third_party/icu" ]
   } else {
     sources -= [ "test-intl.cc" ]
   }
@@ -470,7 +478,6 @@ v8_executable("generate-bytecode-expectations") {
     "../..:v8",
     "../..:v8_libbase",
     "../..:v8_libplatform",
-    "//build/config:exe_and_shlib_deps",
     "//build/win:default_exe_manifest",
   ]
 }
diff --git a/deps/v8/test/cctest/DEPS b/deps/v8/test/cctest/DEPS
index 3e73aa244ff090..7210fb53170dd2 100644
--- a/deps/v8/test/cctest/DEPS
+++ b/deps/v8/test/cctest/DEPS
@@ -1,3 +1,4 @@
 include_rules = [
   "+src",
+  "+torque-generated"
 ]
diff --git a/deps/v8/test/cctest/assembler-helper-arm.cc b/deps/v8/test/cctest/assembler-helper-arm.cc
index 3ba5f6018ed7f4..cb647062da9c9b 100644
--- a/deps/v8/test/cctest/assembler-helper-arm.cc
+++ b/deps/v8/test/cctest/assembler-helper-arm.cc
@@ -14,7 +14,7 @@ namespace internal {
 
 Handle<Code> AssembleCodeImpl(std::function<void(Assembler&)> assemble) {
   Isolate* isolate = CcTest::i_isolate();
-  Assembler assm(isolate, nullptr, 0);
+  Assembler assm(AssemblerOptions{}, nullptr, 0);
 
   assemble(assm);
   assm.bx(lr);
@@ -24,7 +24,7 @@ Handle<Code> AssembleCodeImpl(std::function<void(Assembler&)> assemble) {
   Handle<Code> code =
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
   if (FLAG_print_code) {
-    code->Print();
+    code->Print(isolate);
   }
   return code;
 }
diff --git a/deps/v8/test/cctest/cctest.h b/deps/v8/test/cctest/cctest.h
index 7503bc9f350a30..c4392b4f5f85b5 100644
--- a/deps/v8/test/cctest/cctest.h
+++ b/deps/v8/test/cctest/cctest.h
@@ -242,7 +242,6 @@ class ApiTestFuzzer: public v8::base::Thread {
   RegisterThreadedTest register_##Name(Test##Name, #Name);           \
   /* */ TEST(Name)
 
-
 class RegisterThreadedTest {
  public:
   explicit RegisterThreadedTest(CcTest::TestFunction* callback,
@@ -680,20 +679,24 @@ class TestPlatform : public v8::Platform {
     return old_platform_->OnCriticalMemoryPressure(length);
   }
 
-  std::shared_ptr<v8::TaskRunner> GetForegroundTaskRunner(
-      v8::Isolate* isolate) override {
-    return old_platform_->GetForegroundTaskRunner(isolate);
+  int NumberOfWorkerThreads() override {
+    return old_platform_->NumberOfWorkerThreads();
   }
 
-  std::shared_ptr<v8::TaskRunner> GetWorkerThreadsTaskRunner(
+  std::shared_ptr<v8::TaskRunner> GetForegroundTaskRunner(
       v8::Isolate* isolate) override {
-    return old_platform_->GetWorkerThreadsTaskRunner(isolate);
+    return old_platform_->GetForegroundTaskRunner(isolate);
   }
 
   void CallOnWorkerThread(std::unique_ptr<v8::Task> task) override {
     old_platform_->CallOnWorkerThread(std::move(task));
   }
 
+  void CallDelayedOnWorkerThread(std::unique_ptr<v8::Task> task,
+                                 double delay_in_seconds) override {
+    old_platform_->CallDelayedOnWorkerThread(std::move(task), delay_in_seconds);
+  }
+
   void CallOnForegroundThread(v8::Isolate* isolate, v8::Task* task) override {
     old_platform_->CallOnForegroundThread(isolate, task);
   }
diff --git a/deps/v8/test/cctest/cctest.status b/deps/v8/test/cctest/cctest.status
index 54e991df13db0c..06b3e719a9cbc0 100644
--- a/deps/v8/test/cctest/cctest.status
+++ b/deps/v8/test/cctest/cctest.status
@@ -73,7 +73,9 @@
   'test-heap/OutOfMemory': [SKIP],
 
   # BUG(5193). The cpu profiler tests are notoriously flaky.
+  'test-profile-generator/RecordStackTraceAtStartProfiling': [SKIP],
   'test-cpu-profiler/CollectCpuProfile': [SKIP],
+  'test-cpu-profiler/CollectCpuProfileCallerLineNumbers': [FAIL, PASS],
   'test-cpu-profiler/CollectCpuProfileSamples': [SKIP],
   'test-cpu-profiler/CollectDeoptEvents': [SKIP],
   'test-cpu-profiler/CpuProfileDeepStack': [SKIP],
@@ -91,6 +93,9 @@
   'test-cpu-profiler/TracingCpuProfiler': [SKIP],
   'test-sampler/LibSamplerCollectSample': [SKIP],
 
+  # BUG(7702). Flaky data race and other test failures.
+  'test-cpu-profiler/MultipleProfilers': [SKIP],
+
   # BUG(7202). The test is flaky.
   'test-cpu-profiler/NativeFrameStackTrace': [SKIP],
 
@@ -120,22 +125,15 @@
   'test-serialize/SnapshotCreatorNoExternalReferencesCustomFail1': [FAIL],
   'test-serialize/SnapshotCreatorNoExternalReferencesCustomFail2': [FAIL],
 
+  # https://crbug.com/v8/7859
+  'test-heap/Regress538257': [SKIP],
+
   ############################################################################
   # Slow tests.
   'test-debug/CallFunctionInDebugger': [PASS, ['mode == debug', SLOW]],
   'test-strings/StringOOM*': [PASS, ['mode == debug', SKIP]],
   'test-serialize/CustomSnapshotDataBlobImmortalImmovableRoots': [PASS, ['mode == debug', SKIP]],
   'test-parsing/ObjectRestNegativeTestSlow': [PASS, ['mode == debug', SKIP]],
-
-  # Temporary for https://crrev.com/c/947969 until https://crrev.com/c/950775
-  # lands. Tests build a new snapshot, in which the constants list doesn't
-  # match what's expected by embedded builtins. This will become irrelevant
-  # once the serialization process changes to pack trampolines into the
-  # snapshot iff explicitly requested.
-  'test-serialize/StartupSerializerOnce': [SKIP],
-  'test-serialize/StartupSerializerTwice': [SKIP],
-  'test-serialize/StartupSerializerOnceRunScript': [SKIP],
-  'test-serialize/StartupSerializerTwiceRunScript': [SKIP],
 }],  # ALWAYS
 
 ##############################################################################
@@ -221,6 +219,9 @@
   # support.
   'test-serialize/CustomSnapshotDataBlobWithWarmup': [SKIP],
   'test-serialize/SnapshotDataBlobWithWarmup': [SKIP],
+
+  # https://crbug.com/v8/7763
+  'test-lockers/ExtensionsRegistration': [SKIP],
 }],  # 'no_snap == True'
 ['no_snap == False', {
   # FunctionEntryHooks require bootstrapping from scratch.
@@ -242,6 +243,7 @@
   # platforms, since this would require bit swapping as a part of atomic
   # operations.
   'test-run-wasm-atomics/*': [SKIP],
+  'test-run-wasm-atomics64/*': [SKIP],
 }],  # 'byteorder == big'
 
 ##############################################################################
@@ -286,6 +288,9 @@
   'test-serialize/StartupSerializerTwice': [SKIP],
   'test-serialize/StartupSerializerOnceRunScript': [SKIP],
   'test-serialize/StartupSerializerTwiceRunScript': [SKIP],
+
+  # crbug.com/v8/7605
+  'test-heap/OutOfMemorySmallObjects': [PASS, ['not simulator_run', SKIP]],
 }],  # 'arch == arm'
 
 ##############################################################################
@@ -300,11 +305,6 @@
   'test-serialize/StartupSerializerTwiceRunScript': [SKIP],
 }],  # 'arch == mipsel or arch == mips'
 
-['(arch == mipsel or arch == mips64el or arch == mips or arch == mips64)', {
-  # Instruction scheduler not supported on MIPS.
-  'test-instruction-scheduler/DeoptInMiddleOfBasicBlock': [SKIP]
-}],  # 'arch == mipsel or arch == mips64el or arch == mips or arch == mips64'
-
 ##############################################################################
 ['arch == mips', {
   # Too slow with TF.
@@ -342,10 +342,6 @@
 ['(arch == mipsel or arch == mips64el or arch == mips or arch == mips64) and not simd_mips', {
   # Skip tests that fail on MIPS architectures which don't support SIMD,
   # because lowering mechanism doesn't work properly
-  'test-run-wasm-simd/RunWasm_I32x4ConvertI16x8_compiled': [SKIP],
-  'test-run-wasm-simd/RunWasm_I16x8ConvertI8x16_compiled': [SKIP],
-  'test-run-wasm-simd/RunWasm_I16x8ConvertI32x4_compiled': [SKIP],
-  'test-run-wasm-simd/RunWasm_I8x16ConvertI16x8_compiled': [SKIP],
   'test-run-wasm-simd/RunWasm_ReductionTest4_compiled': [SKIP],
   'test-run-wasm-simd/RunWasm_ReductionTest8_compiled': [SKIP],
   'test-run-wasm-simd/RunWasm_ReductionTest16_compiled': [SKIP],
@@ -410,13 +406,64 @@
 
 }],  # 'arch == ppc or arch == ppc64 or arch == s390 or arch == s390x'
 
+##############################################################################
+['byteorder == big', {
+
+  # BUG(7827). fix simd globals for big endian
+  'test-run-wasm-simd/RunWasm_SimdI32x4GetGlobal_interpreter': [SKIP],
+  'test-run-wasm-simd/RunWasm_SimdI32x4SetGlobal_interpreter': [SKIP],
+  'test-run-wasm-simd/RunWasm_SimdF32x4GetGlobal_interpreter': [SKIP],
+  'test-run-wasm-simd/RunWasm_SimdF32x4SetGlobal_interpreter': [SKIP],
+  'test-run-wasm-simd/RunWasm_SimdLoadStoreLoad_simd_turbofan': [SKIP],
+  'test-run-wasm-simd/RunWasm_SimdLoadStoreLoad_interpreter': [SKIP],
+  'test-run-wasm-simd/RunWasm_SimdLoadStoreLoad_simd_lowered': [SKIP],
+  'test-run-wasm-simd/RunWasm_I32x4AddHoriz_interpreter': [SKIP],
+  'test-run-wasm-simd/RunWasm_I16x8AddHoriz_interpreter': [SKIP],
+  'test-run-wasm-simd/RunWasm_F32x4AddHoriz_interpreter': [SKIP],
+  'test-run-wasm-simd/RunWasm_S32x4Dup_interpreter': [SKIP],
+  'test-run-wasm-simd/RunWasm_S32x4ZipLeft_interpreter': [SKIP],
+  'test-run-wasm-simd/RunWasm_S32x4ZipRight_interpreter': [SKIP],
+  'test-run-wasm-simd/RunWasm_S32x4UnzipLeft_interpreter': [SKIP],
+  'test-run-wasm-simd/RunWasm_S32x4UnzipRight_interpreter': [SKIP],
+  'test-run-wasm-simd/RunWasm_S32x4TransposeLeft_interpreter': [SKIP],
+  'test-run-wasm-simd/RunWasm_S32x4TransposeRight_interpreter': [SKIP],
+  'test-run-wasm-simd/RunWasm_S32x2Reverse_interpreter': [SKIP],
+  'test-run-wasm-simd/RunWasm_S32x4Irregular_interpreter': [SKIP],
+  'test-run-wasm-simd/RunWasm_S16x8Dup_interpreter': [SKIP],
+  'test-run-wasm-simd/RunWasm_S16x8ZipLeft_interpreter': [SKIP],
+  'test-run-wasm-simd/RunWasm_S16x8ZipRight_interpreter': [SKIP],
+  'test-run-wasm-simd/RunWasm_S16x8UnzipLeft_interpreter': [SKIP],
+  'test-run-wasm-simd/RunWasm_S16x8UnzipRight_interpreter': [SKIP],
+  'test-run-wasm-simd/RunWasm_S16x8TransposeLeft_interpreter': [SKIP],
+  'test-run-wasm-simd/RunWasm_S16x8TransposeRight_interpreter': [SKIP],
+  'test-run-wasm-simd/RunWasm_S16x4Reverse_interpreter': [SKIP],
+  'test-run-wasm-simd/RunWasm_S16x2Reverse_interpreter': [SKIP],
+  'test-run-wasm-simd/RunWasm_S16x8Irregular_interpreter': [SKIP],
+  'test-run-wasm-simd/RunWasm_S8x16Dup_interpreter': [SKIP],
+  'test-run-wasm-simd/RunWasm_S8x16ZipLeft_interpreter': [SKIP],
+  'test-run-wasm-simd/RunWasm_S8x16ZipRight_interpreter': [SKIP],
+  'test-run-wasm-simd/RunWasm_S8x16UnzipLeft_interpreter': [SKIP],
+  'test-run-wasm-simd/RunWasm_S8x16UnzipRight_interpreter': [SKIP],
+  'test-run-wasm-simd/RunWasm_S8x16TransposeLeft_interpreter': [SKIP],
+  'test-run-wasm-simd/RunWasm_S8x16TransposeRight_interpreter': [SKIP],
+  'test-run-wasm-simd/RunWasm_S8x8Reverse_interpreter': [SKIP],
+  'test-run-wasm-simd/RunWasm_S8x4Reverse_interpreter': [SKIP],
+  'test-run-wasm-simd/RunWasm_S8x2Reverse_interpreter': [SKIP],
+  'test-run-wasm-simd/RunWasm_S8x16Irregular_interpreter': [SKIP],
+  'test-run-wasm-simd/RunWasm_S8x16Blend_interpreter': [SKIP],
+  'test-run-wasm-simd/RunWasm_S8x16Concat_interpreter': [SKIP],
+  'test-run-wasm-simd/RunWasm_I16x8ConvertI32x4*': [SKIP],
+  'test-run-wasm-simd/RunWasm_I8x16ConvertI16x8*': [SKIP],
+
+}],  # 'byteorder == big'
+
 ##############################################################################
 ['variant == stress_incremental_marking', {
   'test-heap-profiler/SamplingHeapProfiler': [SKIP],
 }],  # variant == stress_incremental_marking
 
 ##############################################################################
-['variant == wasm_traps', {
+['variant == no_wasm_traps', {
   'test-accessors/*': [SKIP],
   'test-api-interceptors/*': [SKIP],
   'test-api/*': [SKIP],
@@ -438,6 +485,6 @@
   'test-log/*': [SKIP],
   'test-gap-resolver/*': [SKIP],
   'test-dtoa/*': [SKIP],
-}],  # variant == wasm_traps
+}],  # variant == no_wasm_traps
 
 ]
diff --git a/deps/v8/test/cctest/compiler/call-tester.h b/deps/v8/test/cctest/compiler/call-tester.h
index 2907d4d2461ecf..8a0ea70a2a6ce3 100644
--- a/deps/v8/test/cctest/compiler/call-tester.h
+++ b/deps/v8/test/cctest/compiler/call-tester.h
@@ -26,7 +26,7 @@ class CallHelper {
   template <typename... Params>
   R Call(Params... args) {
     CSignature::VerifyParams<Params...>(csig_);
-    byte* entry = Generate();
+    Address entry = Generate();
     auto fn = GeneratedCode<R, Params...>::FromAddress(isolate_, entry);
     return fn.Call(args...);
   }
@@ -34,7 +34,7 @@ class CallHelper {
  protected:
   MachineSignature* csig_;
 
-  virtual byte* Generate() = 0;
+  virtual Address Generate() = 0;
 
  private:
   Isolate* isolate_;
@@ -48,7 +48,7 @@ class CodeRunner : public CallHelper<T> {
       : CallHelper<T>(isolate, csig), code_(code) {}
   virtual ~CodeRunner() {}
 
-  virtual byte* Generate() { return code_->entry(); }
+  Address Generate() override { return code_->entry(); }
 
  private:
   Handle<Code> code_;
diff --git a/deps/v8/test/cctest/compiler/code-assembler-tester.h b/deps/v8/test/cctest/compiler/code-assembler-tester.h
index d32cf3abfc587b..1edb3fdf4b52f1 100644
--- a/deps/v8/test/cctest/compiler/code-assembler-tester.h
+++ b/deps/v8/test/cctest/compiler/code-assembler-tester.h
@@ -22,8 +22,8 @@ class CodeAssemblerTester {
   explicit CodeAssemblerTester(Isolate* isolate, const char* name = "test")
       : zone_(isolate->allocator(), ZONE_NAME),
         scope_(isolate),
-        state_(isolate, &zone_, VoidDescriptor(isolate), Code::STUB, name,
-               PoisoningMitigationLevel::kOff) {}
+        state_(isolate, &zone_, VoidDescriptor{}, Code::STUB, name,
+               PoisoningMitigationLevel::kDontPoison) {}
 
   // Test generating code for a JS function (e.g. builtins).
   CodeAssemblerTester(Isolate* isolate, int parameter_count,
@@ -32,21 +32,21 @@ class CodeAssemblerTester {
       : zone_(isolate->allocator(), ZONE_NAME),
         scope_(isolate),
         state_(isolate, &zone_, parameter_count, kind, name,
-               PoisoningMitigationLevel::kOff) {}
+               PoisoningMitigationLevel::kDontPoison) {}
 
   CodeAssemblerTester(Isolate* isolate, Code::Kind kind,
                       const char* name = "test")
       : zone_(isolate->allocator(), ZONE_NAME),
         scope_(isolate),
-        state_(isolate, &zone_, 0, kind, name, PoisoningMitigationLevel::kOff) {
-  }
+        state_(isolate, &zone_, 0, kind, name,
+               PoisoningMitigationLevel::kDontPoison) {}
 
   CodeAssemblerTester(Isolate* isolate, CallDescriptor* call_descriptor,
                       const char* name = "test")
       : zone_(isolate->allocator(), ZONE_NAME),
         scope_(isolate),
         state_(isolate, &zone_, call_descriptor, Code::STUB, name,
-               PoisoningMitigationLevel::kOff, 0, -1) {}
+               PoisoningMitigationLevel::kDontPoison, 0, -1) {}
 
   CodeAssemblerState* state() { return &state_; }
 
@@ -55,7 +55,10 @@ class CodeAssemblerTester {
     return state_.raw_assembler_.get();
   }
 
-  Handle<Code> GenerateCode() { return CodeAssembler::GenerateCode(&state_); }
+  Handle<Code> GenerateCode() {
+    return CodeAssembler::GenerateCode(
+        &state_, AssemblerOptions::Default(scope_.isolate()));
+  }
 
   Handle<Code> GenerateCodeCloseAndEscape() {
     return scope_.CloseAndEscape(GenerateCode());
diff --git a/deps/v8/test/cctest/compiler/codegen-tester.h b/deps/v8/test/cctest/compiler/codegen-tester.h
index 07a77e09cfe437..c58eb3b4855a86 100644
--- a/deps/v8/test/cctest/compiler/codegen-tester.h
+++ b/deps/v8/test/cctest/compiler/codegen-tester.h
@@ -59,7 +59,7 @@ class RawMachineAssemblerTester : public HandleAndZoneScope,
   }
 
  protected:
-  virtual byte* Generate() {
+  virtual Address Generate() {
     if (code_.is_null()) {
       Schedule* schedule = this->Export();
       auto call_descriptor = this->call_descriptor();
@@ -67,7 +67,8 @@ class RawMachineAssemblerTester : public HandleAndZoneScope,
       OptimizedCompilationInfo info(ArrayVector("testing"), main_zone(),
                                     Code::STUB);
       code_ = Pipeline::GenerateCodeForTesting(
-          &info, main_isolate(), call_descriptor, graph, schedule);
+          &info, main_isolate(), call_descriptor, graph,
+          AssemblerOptions::Default(main_isolate()), schedule);
     }
     return this->code_.ToHandleChecked()->entry();
   }
@@ -95,7 +96,7 @@ class BufferedRawMachineAssemblerTester
     }
   }
 
-  virtual byte* Generate() { return RawMachineAssemblerTester::Generate(); }
+  Address Generate() override { return RawMachineAssemblerTester::Generate(); }
 
   // The BufferedRawMachineAssemblerTester does not pass parameters directly
   // to the constructed IR graph. Instead it passes a pointer to the parameter
@@ -151,7 +152,7 @@ class BufferedRawMachineAssemblerTester<void>
     }
   }
 
-  virtual byte* Generate() { return RawMachineAssemblerTester::Generate(); }
+  Address Generate() override { return RawMachineAssemblerTester::Generate(); }
 
   // The BufferedRawMachineAssemblerTester does not pass parameters directly
   // to the constructed IR graph. Instead it passes a pointer to the parameter
@@ -297,22 +298,22 @@ class Float64BinopTester : public BinopTester<double, USE_RESULT_BUFFER> {
 // and return a pointer value.
 // TODO(titzer): pick word size of pointers based on V8_TARGET.
 template <typename Type>
-class PointerBinopTester : public BinopTester<Type*, USE_RETURN_REGISTER> {
+class PointerBinopTester : public BinopTester<Type, USE_RETURN_REGISTER> {
  public:
   explicit PointerBinopTester(RawMachineAssemblerTester<int32_t>* tester)
-      : BinopTester<Type*, USE_RETURN_REGISTER>(tester,
-                                                MachineType::Pointer()) {}
+      : BinopTester<Type, USE_RETURN_REGISTER>(tester, MachineType::Pointer()) {
+  }
 };
 
 
 // A helper class for testing code sequences that take two tagged parameters and
 // return a tagged value.
 template <typename Type>
-class TaggedBinopTester : public BinopTester<Type*, USE_RETURN_REGISTER> {
+class TaggedBinopTester : public BinopTester<Type, USE_RETURN_REGISTER> {
  public:
   explicit TaggedBinopTester(RawMachineAssemblerTester<int32_t>* tester)
-      : BinopTester<Type*, USE_RETURN_REGISTER>(tester,
-                                                MachineType::AnyTagged()) {}
+      : BinopTester<Type, USE_RETURN_REGISTER>(tester,
+                                               MachineType::AnyTagged()) {}
 };
 
 // A helper class for testing compares. Wraps a machine opcode and provides
diff --git a/deps/v8/test/cctest/compiler/function-tester.cc b/deps/v8/test/cctest/compiler/function-tester.cc
index 25778724289ce8..c3abcf7a151f8a 100644
--- a/deps/v8/test/cctest/compiler/function-tester.cc
+++ b/deps/v8/test/cctest/compiler/function-tester.cc
@@ -133,14 +133,14 @@ Handle<JSFunction> FunctionTester::ForMachineGraph(Graph* graph,
     FunctionTester f(graph, param_count);
     p = *f.function;
   }
-  return Handle<JSFunction>(p);  // allocated in outer handle scope.
+  return Handle<JSFunction>(
+      p, p->GetIsolate());  // allocated in outer handle scope.
 }
 
 Handle<JSFunction> FunctionTester::Compile(Handle<JSFunction> function) {
-  Handle<SharedFunctionInfo> shared(function->shared());
-  Zone zone(function->GetIsolate()->allocator(), ZONE_NAME);
-  OptimizedCompilationInfo info(&zone, function->GetIsolate(), shared,
-                                function);
+  Handle<SharedFunctionInfo> shared(function->shared(), isolate);
+  Zone zone(isolate->allocator(), ZONE_NAME);
+  OptimizedCompilationInfo info(&zone, isolate, shared, function);
 
   if (flags_ & OptimizedCompilationInfo::kInliningEnabled) {
     info.MarkAsInliningEnabled();
@@ -152,9 +152,7 @@ Handle<JSFunction> FunctionTester::Compile(Handle<JSFunction> function) {
   JSFunction::EnsureFeedbackVector(function);
 
   Handle<Code> code =
-      Pipeline::GenerateCodeForTesting(&info, function->GetIsolate());
-  CHECK(!code.is_null());
-  info.dependencies()->Commit(code);
+      Pipeline::GenerateCodeForTesting(&info, isolate).ToHandleChecked();
   info.context()->native_context()->AddOptimizedCode(*code);
   function->set_code(*code);
   return function;
@@ -163,14 +161,15 @@ Handle<JSFunction> FunctionTester::Compile(Handle<JSFunction> function) {
 // Compile the given machine graph instead of the source of the function
 // and replace the JSFunction's code with the result.
 Handle<JSFunction> FunctionTester::CompileGraph(Graph* graph) {
-  Handle<SharedFunctionInfo> shared(function->shared());
-  Zone zone(function->GetIsolate()->allocator(), ZONE_NAME);
-  OptimizedCompilationInfo info(&zone, function->GetIsolate(), shared,
-                                function);
+  Handle<SharedFunctionInfo> shared(function->shared(), isolate);
+  Zone zone(isolate->allocator(), ZONE_NAME);
+  OptimizedCompilationInfo info(&zone, isolate, shared, function);
 
+  auto call_descriptor = Linkage::ComputeIncoming(&zone, &info);
   Handle<Code> code =
-      Pipeline::GenerateCodeForTesting(&info, function->GetIsolate(), graph);
-  CHECK(!code.is_null());
+      Pipeline::GenerateCodeForTesting(&info, isolate, call_descriptor, graph,
+                                       AssemblerOptions::Default(isolate))
+          .ToHandleChecked();
   function->set_code(*code);
   return function;
 }
diff --git a/deps/v8/test/cctest/compiler/graph-builder-tester.h b/deps/v8/test/cctest/compiler/graph-builder-tester.h
index 2edf6c27e65aa8..c16feae34081bb 100644
--- a/deps/v8/test/cctest/compiler/graph-builder-tester.h
+++ b/deps/v8/test/cctest/compiler/graph-builder-tester.h
@@ -164,9 +164,6 @@ class GraphBuilderTester : public HandleAndZoneScope,
   Node* ChangeUint32ToTagged(Node* a) {
     return NewNode(simplified()->ChangeUint32ToTagged(), a);
   }
-  Node* ChangeFloat64ToTagged(Node* a) {
-    return NewNode(simplified()->ChangeFloat64ToTagged(), a);
-  }
   Node* ChangeTaggedToBit(Node* a) {
     return NewNode(simplified()->ChangeTaggedToBit(), a);
   }
@@ -244,18 +241,19 @@ class GraphBuilderTester : public HandleAndZoneScope,
     return result;
   }
 
-  virtual byte* Generate() {
+  Address Generate() override {
     if (code_.is_null()) {
       Zone* zone = graph()->zone();
       auto call_descriptor =
           Linkage::GetSimplifiedCDescriptor(zone, this->csig_);
       OptimizedCompilationInfo info(ArrayVector("testing"), main_zone(),
                                     Code::STUB);
-      code_ = Pipeline::GenerateCodeForTesting(&info, main_isolate(),
-                                               call_descriptor, graph());
+      code_ = Pipeline::GenerateCodeForTesting(
+          &info, main_isolate(), call_descriptor, graph(),
+          AssemblerOptions::Default(main_isolate()));
 #ifdef ENABLE_DISASSEMBLER
       if (!code_.is_null() && FLAG_print_opt_code) {
-        OFStream os(stdout);
+        StdoutStream os;
         code_.ToHandleChecked()->Disassemble("test code", os);
       }
 #endif
diff --git a/deps/v8/test/cctest/compiler/test-code-assembler.cc b/deps/v8/test/cctest/compiler/test-code-assembler.cc
index 32548601ec8ec6..2c28a0638d4616 100644
--- a/deps/v8/test/cctest/compiler/test-code-assembler.cc
+++ b/deps/v8/test/cctest/compiler/test-code-assembler.cc
@@ -87,9 +87,10 @@ TEST(SimpleCallRuntime1Arg) {
   CodeAssembler m(asm_tester.state());
   Node* context = m.HeapConstant(Handle<Context>(isolate->native_context()));
   Node* b = SmiTag(m, m.Int32Constant(0));
-  m.Return(m.CallRuntime(Runtime::kNumberToSmi, context, b));
+  m.Return(m.CallRuntime(Runtime::kIsSmi, context, b));
   FunctionTester ft(asm_tester.GenerateCode());
-  CHECK_EQ(0, ft.CallChecked<Smi>()->value());
+  CHECK(ft.CallChecked<Oddball>().is_identical_to(
+      isolate->factory()->true_value()));
 }
 
 TEST(SimpleTailCallRuntime1Arg) {
@@ -98,9 +99,10 @@ TEST(SimpleTailCallRuntime1Arg) {
   CodeAssembler m(asm_tester.state());
   Node* context = m.HeapConstant(Handle<Context>(isolate->native_context()));
   Node* b = SmiTag(m, m.Int32Constant(0));
-  m.TailCallRuntime(Runtime::kNumberToSmi, context, b);
+  m.TailCallRuntime(Runtime::kIsSmi, context, b);
   FunctionTester ft(asm_tester.GenerateCode());
-  CHECK_EQ(0, ft.CallChecked<Smi>()->value());
+  CHECK(ft.CallChecked<Oddball>().is_identical_to(
+      isolate->factory()->true_value()));
 }
 
 TEST(SimpleCallRuntime2Arg) {
diff --git a/deps/v8/test/cctest/compiler/test-code-generator.cc b/deps/v8/test/cctest/compiler/test-code-generator.cc
index 2fb0b1974db064..cc9ddcd104e25f 100644
--- a/deps/v8/test/cctest/compiler/test-code-generator.cc
+++ b/deps/v8/test/cctest/compiler/test-code-generator.cc
@@ -673,8 +673,18 @@ class TestEnvironment : public HandleAndZoneScope {
     Handle<FixedArray> state_out = main_isolate()->factory()->NewFixedArray(
         static_cast<int>(layout_.size()));
     {
+#ifdef ENABLE_SLOW_DCHECKS
+      // The "setup" and "teardown" functions are relatively big, and with
+      // runtime assertions enabled they get so big that memory during register
+      // allocation becomes a problem. Temporarily disable such assertions.
+      bool old_enable_slow_asserts = FLAG_enable_slow_asserts;
+      FLAG_enable_slow_asserts = false;
+#endif
       Handle<Code> setup =
           BuildSetupFunction(main_isolate(), test_descriptor_, layout_);
+#ifdef ENABLE_SLOW_DCHECKS
+      FLAG_enable_slow_asserts = old_enable_slow_asserts;
+#endif
       // FunctionTester maintains its own HandleScope which means that its
       // return value will be freed along with it. Copy the result into
       // state_out.
@@ -986,7 +996,9 @@ class CodeGeneratorTester {
         environment->main_zone(), &frame_, &linkage_, environment->code(),
         &info_, environment->main_isolate(), base::Optional<OsrHelper>(),
         kNoSourcePosition, nullptr, nullptr,
-        CodeGeneratorPoisoningLevel::kDontPoison);
+        PoisoningMitigationLevel::kDontPoison,
+        AssemblerOptions::Default(environment->main_isolate()),
+        Builtins::kNoBuiltinId);
 
     // Force a frame to be created.
     generator_->frame_access_state()->MarkHasFrame(true);
@@ -1096,7 +1108,7 @@ class CodeGeneratorTester {
     generator_->FinishCode();
     generator_->safepoints()->Emit(generator_->tasm(),
                                    frame_.GetTotalFrameSlotCount());
-    return generator_->FinalizeCode();
+    return generator_->FinalizeCode().ToHandleChecked();
   }
 
   Handle<Code> FinalizeForExecuting() {
@@ -1200,7 +1212,7 @@ TEST(FuzzAssembleMove) {
 
     Handle<Code> test = c.FinalizeForExecuting();
     if (FLAG_print_code) {
-      test->Print();
+      test->Print(env.main_isolate());
     }
 
     Handle<FixedArray> actual = env.Run(test, state_in);
@@ -1226,7 +1238,7 @@ TEST(FuzzAssembleSwap) {
 
     Handle<Code> test = c.FinalizeForExecuting();
     if (FLAG_print_code) {
-      test->Print();
+      test->Print(env.main_isolate());
     }
 
     Handle<FixedArray> actual = env.Run(test, state_in);
@@ -1264,7 +1276,7 @@ TEST(FuzzAssembleMoveAndSwap) {
 
     Handle<Code> test = c.FinalizeForExecuting();
     if (FLAG_print_code) {
-      test->Print();
+      test->Print(env.main_isolate());
     }
 
     Handle<FixedArray> actual = env.Run(test, state_in);
@@ -1345,7 +1357,7 @@ TEST(AssembleTailCallGap) {
                                 CodeGeneratorTester::kRegisterPush);
     Handle<Code> code = c.Finalize();
     if (FLAG_print_code) {
-      code->Print();
+      code->Print(env.main_isolate());
     }
   }
 
@@ -1374,7 +1386,7 @@ TEST(AssembleTailCallGap) {
                                 CodeGeneratorTester::kStackSlotPush);
     Handle<Code> code = c.Finalize();
     if (FLAG_print_code) {
-      code->Print();
+      code->Print(env.main_isolate());
     }
   }
 
@@ -1403,7 +1415,7 @@ TEST(AssembleTailCallGap) {
                                 CodeGeneratorTester::kScalarPush);
     Handle<Code> code = c.Finalize();
     if (FLAG_print_code) {
-      code->Print();
+      code->Print(env.main_isolate());
     }
   }
 }
diff --git a/deps/v8/test/cctest/compiler/test-graph-visualizer.cc b/deps/v8/test/cctest/compiler/test-graph-visualizer.cc
index 942a7e882e376c..2b09a65a97885b 100644
--- a/deps/v8/test/cctest/compiler/test-graph-visualizer.cc
+++ b/deps/v8/test/cctest/compiler/test-graph-visualizer.cc
@@ -8,6 +8,7 @@
 #include "src/compiler/graph.h"
 #include "src/compiler/js-operator.h"
 #include "src/compiler/machine-operator.h"
+#include "src/compiler/node-origin-table.h"
 #include "src/compiler/node.h"
 #include "src/compiler/operator.h"
 #include "src/compiler/schedule.h"
@@ -38,9 +39,9 @@ TEST(NodeWithNullInputReachableFromEnd) {
   phi->ReplaceInput(0, nullptr);
   graph.SetEnd(phi);
 
-  OFStream os(stdout);
   SourcePositionTable table(&graph);
-  os << AsJSON(graph, &table);
+  NodeOriginTable table2(&graph);
+  StdoutStream{} << AsJSON(graph, &table, &table2);
 }
 
 
@@ -57,9 +58,9 @@ TEST(NodeWithNullControlReachableFromEnd) {
   phi->ReplaceInput(1, nullptr);
   graph.SetEnd(phi);
 
-  OFStream os(stdout);
   SourcePositionTable table(&graph);
-  os << AsJSON(graph, &table);
+  NodeOriginTable table2(&graph);
+  StdoutStream{} << AsJSON(graph, &table, &table2);
 }
 
 
@@ -76,9 +77,9 @@ TEST(NodeWithNullInputReachableFromStart) {
   phi->ReplaceInput(0, nullptr);
   graph.SetEnd(start);
 
-  OFStream os(stdout);
   SourcePositionTable table(&graph);
-  os << AsJSON(graph, &table);
+  NodeOriginTable table2(&graph);
+  StdoutStream{} << AsJSON(graph, &table, &table2);
 }
 
 
@@ -93,9 +94,9 @@ TEST(NodeWithNullControlReachableFromStart) {
   merge->ReplaceInput(1, nullptr);
   graph.SetEnd(merge);
 
-  OFStream os(stdout);
   SourcePositionTable table(&graph);
-  os << AsJSON(graph, &table);
+  NodeOriginTable table2(&graph);
+  StdoutStream{} << AsJSON(graph, &table, &table2);
 }
 
 
@@ -120,9 +121,22 @@ TEST(NodeNetworkOfDummiesReachableFromEnd) {
   Node* end = graph.NewNode(&dummy_operator6, 6, end_dependencies);
   graph.SetEnd(end);
 
-  OFStream os(stdout);
   SourcePositionTable table(&graph);
-  os << AsJSON(graph, &table);
+  NodeOriginTable table2(&graph);
+  StdoutStream{} << AsJSON(graph, &table, &table2);
+}
+
+TEST(TestSourceIdAssigner) {
+  Handle<SharedFunctionInfo> shared1;
+  Handle<SharedFunctionInfo> shared2;
+
+  SourceIdAssigner assigner(2);
+  const int source_id1 = assigner.GetIdFor(shared1);
+  const int source_id2 = assigner.GetIdFor(shared2);
+
+  CHECK_EQ(source_id1, source_id2);
+  CHECK_EQ(source_id1, assigner.GetIdAt(0));
+  CHECK_EQ(source_id2, assigner.GetIdAt(1));
 }
 
 }  // namespace compiler
diff --git a/deps/v8/test/cctest/compiler/test-instruction-scheduler.cc b/deps/v8/test/cctest/compiler/test-instruction-scheduler.cc
index 6ff68fbda352aa..468961c0100b1f 100644
--- a/deps/v8/test/cctest/compiler/test-instruction-scheduler.cc
+++ b/deps/v8/test/cctest/compiler/test-instruction-scheduler.cc
@@ -81,7 +81,7 @@ TEST(DeoptInMiddleOfBasicBlock) {
   VectorSlotPair feedback;
   FlagsContinuation cont = FlagsContinuation::ForDeoptimize(
       kEqual, DeoptimizeKind::kEager, DeoptimizeReason::kUnknown, feedback,
-      node, true);
+      node);
   jmp_opcode = cont.Encode(jmp_opcode);
   Instruction* jmp_inst = Instruction::New(zone, jmp_opcode);
   tester.CheckIsDeopt(jmp_inst);
diff --git a/deps/v8/test/cctest/compiler/test-instruction.cc b/deps/v8/test/cctest/compiler/test-instruction.cc
index 0e664aefff745c..1140ef9113ea2c 100644
--- a/deps/v8/test/cctest/compiler/test-instruction.cc
+++ b/deps/v8/test/cctest/compiler/test-instruction.cc
@@ -82,6 +82,11 @@ class InstructionTester : public HandleAndZoneScope {
     return code->AddInstruction(instr);
   }
 
+  int NewNop() {
+    TestInstr* instr = TestInstr::New(zone(), kArchNop);
+    return code->AddInstruction(instr);
+  }
+
   UnallocatedOperand Unallocated(int vreg) {
     return UnallocatedOperand(UnallocatedOperand::REGISTER_OR_SLOT, vreg);
   }
@@ -163,6 +168,7 @@ TEST(InstructionGetBasicBlock) {
   int i8 = R.NewInstr();
   R.code->EndBlock(R.RpoFor(b2));
   R.code->StartBlock(R.RpoFor(b3));
+  R.NewNop();
   R.code->EndBlock(R.RpoFor(b3));
 
   CHECK_EQ(b0, R.GetBasicBlock(i0));
diff --git a/deps/v8/test/cctest/compiler/test-js-constant-cache.cc b/deps/v8/test/cctest/compiler/test-js-constant-cache.cc
index 03c3f5d4fa0f5b..5843c516989101 100644
--- a/deps/v8/test/cctest/compiler/test-js-constant-cache.cc
+++ b/deps/v8/test/cctest/compiler/test-js-constant-cache.cc
@@ -339,17 +339,15 @@ TEST(JSGraph_GetCachedNodes_number) {
 
 TEST(JSGraph_GetCachedNodes_external) {
   JSConstantCacheTester T;
-  Isolate* isolate = T.main_isolate();
-
-  ExternalReference constants[] = {
-      ExternalReference::address_of_min_int(isolate),
-      ExternalReference::address_of_min_int(isolate),
-      ExternalReference::address_of_min_int(isolate),
-      ExternalReference::address_of_one_half(isolate),
-      ExternalReference::address_of_one_half(isolate),
-      ExternalReference::address_of_min_int(isolate),
-      ExternalReference::address_of_the_hole_nan(isolate),
-      ExternalReference::address_of_one_half(isolate)};
+
+  ExternalReference constants[] = {ExternalReference::address_of_min_int(),
+                                   ExternalReference::address_of_min_int(),
+                                   ExternalReference::address_of_min_int(),
+                                   ExternalReference::address_of_one_half(),
+                                   ExternalReference::address_of_one_half(),
+                                   ExternalReference::address_of_min_int(),
+                                   ExternalReference::address_of_the_hole_nan(),
+                                   ExternalReference::address_of_one_half()};
 
   for (size_t i = 0; i < arraysize(constants); i++) {
     size_t count_before = T.graph()->NodeCount();
@@ -368,7 +366,6 @@ TEST(JSGraph_GetCachedNodes_external) {
 
 TEST(JSGraph_GetCachedNodes_together) {
   JSConstantCacheTester T;
-  Isolate* isolate = T.main_isolate();
 
   Node* constants[] = {
       T.TrueConstant(),
@@ -388,7 +385,7 @@ TEST(JSGraph_GetCachedNodes_together) {
       T.Float64Constant(V8_INFINITY),
       T.Constant(0.99),
       T.Constant(1.11),
-      T.ExternalConstant(ExternalReference::address_of_one_half(isolate))};
+      T.ExternalConstant(ExternalReference::address_of_one_half())};
 
   NodeVector nodes(T.main_zone());
   T.GetCachedNodes(&nodes);
diff --git a/deps/v8/test/cctest/compiler/test-js-context-specialization.cc b/deps/v8/test/cctest/compiler/test-js-context-specialization.cc
index 7d5adc4b2f5b63..6560bae0962eaa 100644
--- a/deps/v8/test/cctest/compiler/test-js-context-specialization.cc
+++ b/deps/v8/test/cctest/compiler/test-js-context-specialization.cc
@@ -30,7 +30,9 @@ class ContextSpecializationTester : public HandleAndZoneScope {
         jsgraph_(main_isolate(), graph(), common(), &javascript_, &simplified_,
                  &machine_),
         reducer_(main_zone(), graph()),
-        spec_(&reducer_, jsgraph(), context, MaybeHandle<JSFunction>()) {}
+        js_heap_broker_(main_isolate()),
+        spec_(&reducer_, jsgraph(), &js_heap_broker_, context,
+              MaybeHandle<JSFunction>()) {}
 
   JSContextSpecialization* spec() { return &spec_; }
   Factory* factory() { return main_isolate()->factory(); }
@@ -55,6 +57,7 @@ class ContextSpecializationTester : public HandleAndZoneScope {
   SimplifiedOperatorBuilder simplified_;
   JSGraph jsgraph_;
   GraphReducer reducer_;
+  JSHeapBroker js_heap_broker_;
   JSContextSpecialization spec_;
 };
 
@@ -178,15 +181,15 @@ TEST(ReduceJSLoadContext1) {
 
   Node* start = t.graph()->NewNode(t.common()->Start(0));
   t.graph()->SetStart(start);
-  Node* undefined = t.jsgraph()->Constant(t.factory()->undefined_value());
+  Handle<ScopeInfo> empty(ScopeInfo::Empty(t.main_isolate()), t.main_isolate());
   const i::compiler::Operator* create_function_context =
-      t.javascript()->CreateFunctionContext(42, FUNCTION_SCOPE);
+      t.javascript()->CreateFunctionContext(empty, 42, FUNCTION_SCOPE);
 
   Node* context0 = t.graph()->NewNode(t.common()->Parameter(0), start);
-  Node* context1 = t.graph()->NewNode(create_function_context, undefined,
-                                      context0, start, start);
-  Node* context2 = t.graph()->NewNode(create_function_context, undefined,
-                                      context1, start, start);
+  Node* context1 =
+      t.graph()->NewNode(create_function_context, context0, start, start);
+  Node* context2 =
+      t.graph()->NewNode(create_function_context, context1, start, start);
 
   {
     Node* load = t.graph()->NewNode(
@@ -248,9 +251,9 @@ TEST(ReduceJSLoadContext2) {
 
   Node* start = t.graph()->NewNode(t.common()->Start(0));
   t.graph()->SetStart(start);
-  Node* undefined = t.jsgraph()->Constant(t.factory()->undefined_value());
+  Handle<ScopeInfo> empty(ScopeInfo::Empty(t.main_isolate()), t.main_isolate());
   const i::compiler::Operator* create_function_context =
-      t.javascript()->CreateFunctionContext(42, FUNCTION_SCOPE);
+      t.javascript()->CreateFunctionContext(empty, 42, FUNCTION_SCOPE);
 
   Handle<HeapObject> slot_value0 = t.factory()->InternalizeUtf8String("0");
   Handle<HeapObject> slot_value1 = t.factory()->InternalizeUtf8String("1");
@@ -262,10 +265,10 @@ TEST(ReduceJSLoadContext2) {
   context_object1->set(slot_index, *slot_value1);
 
   Node* context0 = t.jsgraph()->Constant(context_object1);
-  Node* context1 = t.graph()->NewNode(create_function_context, undefined,
-                                      context0, start, start);
-  Node* context2 = t.graph()->NewNode(create_function_context, undefined,
-                                      context1, start, start);
+  Node* context1 =
+      t.graph()->NewNode(create_function_context, context0, start, start);
+  Node* context2 =
+      t.graph()->NewNode(create_function_context, context1, start, start);
 
   {
     Node* load = t.graph()->NewNode(
@@ -339,15 +342,16 @@ TEST(ReduceJSLoadContext3) {
 
   Node* start = t.graph()->NewNode(t.common()->Start(2));
   t.graph()->SetStart(start);
-  Node* undefined = t.jsgraph()->Constant(t.factory()->undefined_value());
+  Handle<ScopeInfo> empty(ScopeInfo::Empty(t.main_isolate()),
+                          handle_zone_scope.main_isolate());
   const i::compiler::Operator* create_function_context =
-      t.javascript()->CreateFunctionContext(42, FUNCTION_SCOPE);
+      t.javascript()->CreateFunctionContext(empty, 42, FUNCTION_SCOPE);
 
   Node* context0 = t.graph()->NewNode(t.common()->Parameter(0), start);
-  Node* context1 = t.graph()->NewNode(create_function_context, undefined,
-                                      context0, start, start);
-  Node* context2 = t.graph()->NewNode(create_function_context, undefined,
-                                      context1, start, start);
+  Node* context1 =
+      t.graph()->NewNode(create_function_context, context0, start, start);
+  Node* context2 =
+      t.graph()->NewNode(create_function_context, context1, start, start);
 
   {
     Node* load = t.graph()->NewNode(
@@ -465,15 +469,15 @@ TEST(ReduceJSStoreContext1) {
 
   Node* start = t.graph()->NewNode(t.common()->Start(0));
   t.graph()->SetStart(start);
-  Node* undefined = t.jsgraph()->Constant(t.factory()->undefined_value());
+  Handle<ScopeInfo> empty(ScopeInfo::Empty(t.main_isolate()), t.main_isolate());
   const i::compiler::Operator* create_function_context =
-      t.javascript()->CreateFunctionContext(42, FUNCTION_SCOPE);
+      t.javascript()->CreateFunctionContext(empty, 42, FUNCTION_SCOPE);
 
   Node* context0 = t.graph()->NewNode(t.common()->Parameter(0), start);
-  Node* context1 = t.graph()->NewNode(create_function_context, undefined,
-                                      context0, start, start);
-  Node* context2 = t.graph()->NewNode(create_function_context, undefined,
-                                      context1, start, start);
+  Node* context1 =
+      t.graph()->NewNode(create_function_context, context0, start, start);
+  Node* context2 =
+      t.graph()->NewNode(create_function_context, context1, start, start);
 
   {
     Node* store =
@@ -509,9 +513,9 @@ TEST(ReduceJSStoreContext2) {
 
   Node* start = t.graph()->NewNode(t.common()->Start(0));
   t.graph()->SetStart(start);
-  Node* undefined = t.jsgraph()->Constant(t.factory()->undefined_value());
+  Handle<ScopeInfo> empty(ScopeInfo::Empty(t.main_isolate()), t.main_isolate());
   const i::compiler::Operator* create_function_context =
-      t.javascript()->CreateFunctionContext(42, FUNCTION_SCOPE);
+      t.javascript()->CreateFunctionContext(empty, 42, FUNCTION_SCOPE);
 
   Handle<HeapObject> slot_value0 = t.factory()->InternalizeUtf8String("0");
   Handle<HeapObject> slot_value1 = t.factory()->InternalizeUtf8String("1");
@@ -523,10 +527,10 @@ TEST(ReduceJSStoreContext2) {
   context_object1->set(slot_index, *slot_value1);
 
   Node* context0 = t.jsgraph()->Constant(context_object1);
-  Node* context1 = t.graph()->NewNode(create_function_context, undefined,
-                                      context0, start, start);
-  Node* context2 = t.graph()->NewNode(create_function_context, undefined,
-                                      context1, start, start);
+  Node* context1 =
+      t.graph()->NewNode(create_function_context, context0, start, start);
+  Node* context2 =
+      t.graph()->NewNode(create_function_context, context1, start, start);
 
   {
     Node* store =
@@ -574,15 +578,16 @@ TEST(ReduceJSStoreContext3) {
 
   Node* start = t.graph()->NewNode(t.common()->Start(2));
   t.graph()->SetStart(start);
-  Node* undefined = t.jsgraph()->Constant(t.factory()->undefined_value());
+  Handle<ScopeInfo> empty(ScopeInfo::Empty(t.main_isolate()),
+                          handle_zone_scope.main_isolate());
   const i::compiler::Operator* create_function_context =
-      t.javascript()->CreateFunctionContext(42, FUNCTION_SCOPE);
+      t.javascript()->CreateFunctionContext(empty, 42, FUNCTION_SCOPE);
 
   Node* context0 = t.graph()->NewNode(t.common()->Parameter(0), start);
-  Node* context1 = t.graph()->NewNode(create_function_context, undefined,
-                                      context0, start, start);
-  Node* context2 = t.graph()->NewNode(create_function_context, undefined,
-                                      context1, start, start);
+  Node* context1 =
+      t.graph()->NewNode(create_function_context, context0, start, start);
+  Node* context2 =
+      t.graph()->NewNode(create_function_context, context1, start, start);
 
   {
     Node* store =
diff --git a/deps/v8/test/cctest/compiler/test-js-typed-lowering.cc b/deps/v8/test/cctest/compiler/test-js-typed-lowering.cc
index addcdd2fb74b7e..3f969f8bfed6fd 100644
--- a/deps/v8/test/cctest/compiler/test-js-typed-lowering.cc
+++ b/deps/v8/test/cctest/compiler/test-js-typed-lowering.cc
@@ -23,6 +23,7 @@ class JSTypedLoweringTester : public HandleAndZoneScope {
  public:
   explicit JSTypedLoweringTester(int num_parameters = 0)
       : isolate(main_isolate()),
+        js_heap_broker(isolate),
         binop(nullptr),
         unop(nullptr),
         javascript(main_zone()),
@@ -30,7 +31,7 @@ class JSTypedLoweringTester : public HandleAndZoneScope {
         simplified(main_zone()),
         common(main_zone()),
         graph(main_zone()),
-        typer(main_isolate(), Typer::kNoFlags, &graph),
+        typer(main_isolate(), &js_heap_broker, Typer::kNoFlags, &graph),
         context_node(nullptr) {
     graph.SetStart(graph.NewNode(common.Start(num_parameters)));
     graph.SetEnd(graph.NewNode(common.End(1), graph.start()));
@@ -38,6 +39,7 @@ class JSTypedLoweringTester : public HandleAndZoneScope {
   }
 
   Isolate* isolate;
+  JSHeapBroker js_heap_broker;
   const Operator* binop;
   const Operator* unop;
   JSOperatorBuilder javascript;
@@ -50,7 +52,7 @@ class JSTypedLoweringTester : public HandleAndZoneScope {
   BinaryOperationHint const binop_hints = BinaryOperationHint::kAny;
   CompareOperationHint const compare_hints = CompareOperationHint::kAny;
 
-  Node* Parameter(Type* t, int32_t index = 0) {
+  Node* Parameter(Type t, int32_t index = 0) {
     Node* n = graph.NewNode(common.Parameter(index), graph.start());
     NodeProperties::SetType(n, t);
     return n;
@@ -86,7 +88,8 @@ class JSTypedLoweringTester : public HandleAndZoneScope {
                     &machine);
     // TODO(titzer): mock the GraphReducer here for better unit testing.
     GraphReducer graph_reducer(main_zone(), &graph);
-    JSTypedLowering reducer(&graph_reducer, &jsgraph, main_zone());
+    JSTypedLowering reducer(&graph_reducer, &jsgraph, &js_heap_broker,
+                            main_zone());
     Reduction reduction = reducer.Reduce(node);
     if (reduction.Changed()) return reduction.replacement();
     return node;
@@ -111,11 +114,11 @@ class JSTypedLoweringTester : public HandleAndZoneScope {
     CHECK_EQ(expected->opcode(), node->op()->opcode());
   }
 
-  Node* ReduceUnop(const Operator* op, Type* input_type) {
+  Node* ReduceUnop(const Operator* op, Type input_type) {
     return reduce(Unop(op, Parameter(input_type)));
   }
 
-  Node* ReduceBinop(const Operator* op, Type* left_type, Type* right_type) {
+  Node* ReduceBinop(const Operator* op, Type left_type, Type right_type) {
     return reduce(Binop(op, Parameter(left_type, 0), Parameter(right_type, 1)));
   }
 
@@ -186,22 +189,20 @@ class JSTypedLoweringTester : public HandleAndZoneScope {
   }
 };
 
-static Type* kStringTypes[] = {Type::InternalizedString(), Type::String()};
+static Type kStringTypes[] = {Type::InternalizedString(), Type::String()};
 
-static Type* kInt32Types[] = {Type::UnsignedSmall(), Type::Negative32(),
-                              Type::Unsigned31(),    Type::SignedSmall(),
-                              Type::Signed32(),      Type::Unsigned32(),
-                              Type::Integral32()};
+static Type kInt32Types[] = {Type::UnsignedSmall(), Type::Negative32(),
+                             Type::Unsigned31(),    Type::SignedSmall(),
+                             Type::Signed32(),      Type::Unsigned32(),
+                             Type::Integral32()};
 
-
-static Type* kNumberTypes[] = {
+static Type kNumberTypes[] = {
     Type::UnsignedSmall(), Type::Negative32(),  Type::Unsigned31(),
     Type::SignedSmall(),   Type::Signed32(),    Type::Unsigned32(),
     Type::Integral32(),    Type::MinusZero(),   Type::NaN(),
     Type::OrderedNumber(), Type::PlainNumber(), Type::Number()};
 
-
-static Type* I32Type(bool is_signed) {
+static Type I32Type(bool is_signed) {
   return is_signed ? Type::Signed32() : Type::Unsigned32();
 }
 
@@ -277,11 +278,11 @@ TEST(NumberBinops) {
 
 
 static void CheckToI32(Node* old_input, Node* new_input, bool is_signed) {
-  Type* old_type = NodeProperties::GetType(old_input);
-  Type* new_type = NodeProperties::GetType(new_input);
-  Type* expected_type = I32Type(is_signed);
-  CHECK(new_type->Is(expected_type));
-  if (old_type->Is(expected_type)) {
+  Type old_type = NodeProperties::GetType(old_input);
+  Type new_type = NodeProperties::GetType(new_input);
+  Type expected_type = I32Type(is_signed);
+  CHECK(new_type.Is(expected_type));
+  if (old_type.Is(expected_type)) {
     CHECK_EQ(old_input, new_input);
   } else if (new_input->opcode() == IrOpcode::kNumberConstant) {
     double v = OpParameter<double>(new_input->op());
@@ -318,7 +319,7 @@ class JSBitwiseShiftTypedLoweringTester : public JSTypedLoweringTester {
 TEST(Int32BitwiseShifts) {
   JSBitwiseShiftTypedLoweringTester R;
 
-  Type* types[] = {
+  Type types[] = {
       Type::SignedSmall(), Type::UnsignedSmall(), Type::Negative32(),
       Type::Unsigned31(),  Type::Unsigned32(),    Type::Signed32(),
       Type::MinusZero(),   Type::NaN(),           Type::Undefined(),
@@ -374,7 +375,7 @@ class JSBitwiseTypedLoweringTester : public JSTypedLoweringTester {
 TEST(Int32BitwiseBinops) {
   JSBitwiseTypedLoweringTester R;
 
-  Type* types[] = {
+  Type types[] = {
       Type::SignedSmall(),   Type::UnsignedSmall(), Type::Unsigned32(),
       Type::Signed32(),      Type::MinusZero(),     Type::NaN(),
       Type::OrderedNumber(), Type::PlainNumber(),   Type::Undefined(),
@@ -425,7 +426,7 @@ TEST(JSToNumber1) {
 TEST(JSToNumber_replacement) {
   JSTypedLoweringTester R;
 
-  Type* types[] = {Type::Null(), Type::Undefined(), Type::Number()};
+  Type types[] = {Type::Null(), Type::Undefined(), Type::Number()};
 
   for (size_t i = 0; i < arraysize(types); i++) {
     Node* n = R.Parameter(types[i]);
@@ -438,7 +439,7 @@ TEST(JSToNumber_replacement) {
     R.CheckEffectInput(c, effect_use);
     Node* r = R.reduce(c);
 
-    if (types[i]->Is(Type::Number())) {
+    if (types[i].Is(Type::Number())) {
       CHECK_EQ(n, r);
     } else {
       CHECK_EQ(IrOpcode::kNumberConstant, r->opcode());
@@ -465,7 +466,7 @@ TEST(JSToNumberOfConstant) {
     // Note that either outcome below is correct. It only depends on whether
     // the types of constants are eagerly computed or only computed by the
     // typing pass.
-    if (NodeProperties::GetType(n)->Is(Type::Number())) {
+    if (NodeProperties::GetType(n).Is(Type::Number())) {
       // If number constants are eagerly typed, then reduction should
       // remove the ToNumber.
       CHECK_EQ(n, r);
@@ -480,11 +481,11 @@ TEST(JSToNumberOfConstant) {
 
 TEST(JSToNumberOfNumberOrOtherPrimitive) {
   JSTypedLoweringTester R;
-  Type* others[] = {Type::Undefined(), Type::Null(), Type::Boolean(),
-                    Type::String()};
+  Type others[] = {Type::Undefined(), Type::Null(), Type::Boolean(),
+                   Type::String()};
 
   for (size_t i = 0; i < arraysize(others); i++) {
-    Type* t = Type::Union(Type::Number(), others[i], R.main_zone());
+    Type t = Type::Union(Type::Number(), others[i], R.main_zone());
     Node* r = R.ReduceUnop(R.javascript.ToNumber(), t);
     CHECK_EQ(IrOpcode::kPlainPrimitiveToNumber, r->opcode());
   }
@@ -536,7 +537,7 @@ TEST(JSToString1) {
 TEST(JSToString_replacement) {
   JSTypedLoweringTester R;
 
-  Type* types[] = {Type::Null(), Type::Undefined(), Type::String()};
+  Type types[] = {Type::Null(), Type::Undefined(), Type::String()};
 
   for (size_t i = 0; i < arraysize(types); i++) {
     Node* n = R.Parameter(types[i]);
@@ -549,7 +550,7 @@ TEST(JSToString_replacement) {
     R.CheckEffectInput(c, effect_use);
     Node* r = R.reduce(c);
 
-    if (types[i]->Is(Type::String())) {
+    if (types[i].Is(Type::String())) {
       CHECK_EQ(n, r);
     } else {
       CHECK_EQ(IrOpcode::kHeapConstant, r->opcode());
@@ -600,7 +601,7 @@ TEST(StringComparison) {
 
 
 static void CheckIsConvertedToNumber(Node* val, Node* converted) {
-  if (NodeProperties::GetType(val)->Is(Type::Number())) {
+  if (NodeProperties::GetType(val).Is(Type::Number())) {
     CHECK_EQ(val, converted);
   } else {
     if (converted->opcode() == IrOpcode::kNumberConstant) return;
@@ -645,8 +646,8 @@ TEST(NumberComparison) {
 TEST(MixedComparison1) {
   JSTypedLoweringTester R;
 
-  Type* types[] = {Type::Number(), Type::String(),
-                   Type::Union(Type::Number(), Type::String(), R.main_zone())};
+  Type types[] = {Type::Number(), Type::String(),
+                  Type::Union(Type::Number(), Type::String(), R.main_zone())};
 
   for (size_t i = 0; i < arraysize(types); i++) {
     Node* p0 = R.Parameter(types[i], 0);
@@ -658,12 +659,12 @@ TEST(MixedComparison1) {
             R.javascript.LessThan(CompareOperationHint::kAny);
         Node* cmp = R.Binop(less_than, p0, p1);
         Node* r = R.reduce(cmp);
-        if (types[i]->Is(Type::String()) && types[j]->Is(Type::String())) {
+        if (types[i].Is(Type::String()) && types[j].Is(Type::String())) {
           R.CheckBinop(R.simplified.StringLessThan(), r);
-        } else if ((types[i]->Is(Type::Number()) &&
-                    types[j]->Is(Type::Number())) ||
-                   (!types[i]->Maybe(Type::String()) ||
-                    !types[j]->Maybe(Type::String()))) {
+        } else if ((types[i].Is(Type::Number()) &&
+                    types[j].Is(Type::Number())) ||
+                   (!types[i].Maybe(Type::String()) ||
+                    !types[j].Maybe(Type::String()))) {
           R.CheckBinop(R.simplified.NumberLessThan(), r);
         } else {
           // No reduction of mixed types.
@@ -741,7 +742,7 @@ TEST(RemoveToNumberEffects) {
 // Helper class for testing the reduction of a single binop.
 class BinopEffectsTester {
  public:
-  BinopEffectsTester(const Operator* op, Type* t0, Type* t1)
+  BinopEffectsTester(const Operator* op, Type t0, Type t1)
       : R(0),
         p0(R.Parameter(t0, 0)),
         p1(R.Parameter(t1, 1)),
@@ -816,10 +817,9 @@ void CheckEqualityReduction(JSTypedLoweringTester* R, bool strict, Node* l,
 TEST(EqualityForNumbers) {
   JSTypedLoweringTester R;
 
-  Type* simple_number_types[] = {Type::UnsignedSmall(), Type::SignedSmall(),
-                                 Type::Signed32(), Type::Unsigned32(),
-                                 Type::Number()};
-
+  Type simple_number_types[] = {Type::UnsignedSmall(), Type::SignedSmall(),
+                                Type::Signed32(), Type::Unsigned32(),
+                                Type::Number()};
 
   for (size_t i = 0; i < arraysize(simple_number_types); ++i) {
     Node* p0 = R.Parameter(simple_number_types[i], 0);
@@ -837,8 +837,8 @@ TEST(EqualityForNumbers) {
 TEST(StrictEqualityForRefEqualTypes) {
   JSTypedLoweringTester R;
 
-  Type* types[] = {Type::Undefined(), Type::Null(), Type::Boolean(),
-                   Type::Object(), Type::Receiver()};
+  Type types[] = {Type::Undefined(), Type::Null(), Type::Boolean(),
+                  Type::Object(), Type::Receiver()};
 
   Node* p0 = R.Parameter(Type::Any());
   for (size_t i = 0; i < arraysize(types); i++) {
@@ -1055,11 +1055,11 @@ TEST(Int32Comparisons) {
 
   for (size_t o = 0; o < arraysize(ops); o++) {
     for (size_t i = 0; i < arraysize(kNumberTypes); i++) {
-      Type* t0 = kNumberTypes[i];
+      Type t0 = kNumberTypes[i];
       Node* p0 = R.Parameter(t0, 0);
 
       for (size_t j = 0; j < arraysize(kNumberTypes); j++) {
-        Type* t1 = kNumberTypes[j];
+        Type t1 = kNumberTypes[j];
         Node* p1 = R.Parameter(t1, 1);
 
         Node* cmp = R.Binop(ops[o].js_op, p0, p1);
diff --git a/deps/v8/test/cctest/compiler/test-jump-threading.cc b/deps/v8/test/cctest/compiler/test-jump-threading.cc
index eace236e36b309..7cb2aa58b9650e 100644
--- a/deps/v8/test/cctest/compiler/test-jump-threading.cc
+++ b/deps/v8/test/cctest/compiler/test-jump-threading.cc
@@ -77,6 +77,10 @@ class TestCode : public HandleAndZoneScope {
   }
   void End() {
     Start();
+    int end = static_cast<int>(sequence_.instructions().size());
+    if (current_->code_start() == end) {  // Empty block.  Insert a nop.
+      sequence_.AddInstruction(Instruction::New(main_zone(), kArchNop));
+    }
     sequence_.EndBlock(current_->rpo_number());
     current_ = nullptr;
     rpo_number_ = RpoNumber::FromInt(rpo_number_.ToInt() + 1);
diff --git a/deps/v8/test/cctest/compiler/test-linkage.cc b/deps/v8/test/cctest/compiler/test-linkage.cc
index e98e95223ef505..39ef66c5eb8f6f 100644
--- a/deps/v8/test/cctest/compiler/test-linkage.cc
+++ b/deps/v8/test/cctest/compiler/test-linkage.cc
@@ -47,7 +47,7 @@ static Handle<JSFunction> Compile(const char* source) {
 TEST(TestLinkageCreate) {
   HandleAndZoneScope handles;
   Handle<JSFunction> function = Compile("a + b");
-  Handle<SharedFunctionInfo> shared(function->shared());
+  Handle<SharedFunctionInfo> shared(function->shared(), handles.main_isolate());
   OptimizedCompilationInfo info(handles.main_zone(), function->GetIsolate(),
                                 shared, function);
   auto call_descriptor = Linkage::ComputeIncoming(info.zone(), &info);
@@ -64,7 +64,8 @@ TEST(TestLinkageJSFunctionIncoming) {
     Handle<JSFunction> function =
         Handle<JSFunction>::cast(v8::Utils::OpenHandle(
             *v8::Local<v8::Function>::Cast(CompileRun(sources[i]))));
-    Handle<SharedFunctionInfo> shared(function->shared());
+    Handle<SharedFunctionInfo> shared(function->shared(),
+                                      handles.main_isolate());
     OptimizedCompilationInfo info(handles.main_zone(), function->GetIsolate(),
                                   shared, function);
     auto call_descriptor = Linkage::ComputeIncoming(info.zone(), &info);
@@ -81,7 +82,7 @@ TEST(TestLinkageJSFunctionIncoming) {
 TEST(TestLinkageJSCall) {
   HandleAndZoneScope handles;
   Handle<JSFunction> function = Compile("a + c");
-  Handle<SharedFunctionInfo> shared(function->shared());
+  Handle<SharedFunctionInfo> shared(function->shared(), handles.main_isolate());
   OptimizedCompilationInfo info(handles.main_zone(), function->GetIsolate(),
                                 shared, function);
 
@@ -108,7 +109,7 @@ TEST(TestLinkageStubCall) {
   Callable callable = Builtins::CallableFor(isolate, Builtins::kToNumber);
   OptimizedCompilationInfo info(ArrayVector("test"), &zone, Code::STUB);
   auto call_descriptor = Linkage::GetStubCallDescriptor(
-      isolate, &zone, callable.descriptor(), 0, CallDescriptor::kNoFlags,
+      &zone, callable.descriptor(), 0, CallDescriptor::kNoFlags,
       Operator::kNoProperties);
   CHECK(call_descriptor);
   CHECK_EQ(0, static_cast<int>(call_descriptor->StackParameterCount()));
diff --git a/deps/v8/test/cctest/compiler/test-loop-analysis.cc b/deps/v8/test/cctest/compiler/test-loop-analysis.cc
index 734fa4bea3083c..531d43038eb09a 100644
--- a/deps/v8/test/cctest/compiler/test-loop-analysis.cc
+++ b/deps/v8/test/cctest/compiler/test-loop-analysis.cc
@@ -125,8 +125,7 @@ class LoopFinderTester : HandleAndZoneScope {
   LoopTree* GetLoopTree() {
     if (loop_tree == nullptr) {
       if (FLAG_trace_turbo_graph) {
-        OFStream os(stdout);
-        os << AsRPO(graph);
+        StdoutStream{} << AsRPO(graph);
       }
       Zone zone(main_isolate()->allocator(), ZONE_NAME);
       loop_tree = LoopFinder::BuildLoopTree(&graph, &zone);
diff --git a/deps/v8/test/cctest/compiler/test-multiple-return.cc b/deps/v8/test/cctest/compiler/test-multiple-return.cc
index 3e30ed2776272d..13496ae82952cb 100644
--- a/deps/v8/test/cctest/compiler/test-multiple-return.cc
+++ b/deps/v8/test/cctest/compiler/test-multiple-return.cc
@@ -16,6 +16,7 @@
 #include "src/machine-type.h"
 #include "src/macro-assembler.h"
 #include "src/objects-inl.h"
+#include "src/wasm/function-compiler.h"
 #include "src/wasm/wasm-engine.h"
 #include "src/wasm/wasm-objects-inl.h"
 #include "src/wasm/wasm-opcodes.h"
@@ -34,18 +35,16 @@ CallDescriptor* CreateCallDescriptor(Zone* zone, int return_count,
   wasm::FunctionSig::Builder builder(zone, return_count, param_count);
 
   for (int i = 0; i < param_count; i++) {
-    builder.AddParam(type.representation());
+    builder.AddParam(wasm::ValueTypes::ValueTypeFor(type));
   }
 
   for (int i = 0; i < return_count; i++) {
-    builder.AddReturn(type.representation());
+    builder.AddReturn(wasm::ValueTypes::ValueTypeFor(type));
   }
   return compiler::GetWasmCallDescriptor(zone, builder.Build());
 }
 
-}  // namespace
-
-Node* Constant(RawMachineAssembler& m, MachineType type, int value) {
+Node* MakeConstant(RawMachineAssembler& m, MachineType type, int value) {
   switch (type.representation()) {
     case MachineRepresentation::kWord32:
       return m.Int32Constant(static_cast<int32_t>(value));
@@ -122,13 +121,16 @@ Node* ToInt32(RawMachineAssembler& m, MachineType type, Node* a) {
 
 std::unique_ptr<wasm::NativeModule> AllocateNativeModule(Isolate* isolate,
                                                          size_t code_size) {
+  std::shared_ptr<wasm::WasmModule> module(new wasm::WasmModule());
+  module->num_declared_functions = 1;
+  wasm::ModuleEnv env(
+      module.get(), wasm::UseTrapHandler::kNoTrapHandler,
+      wasm::RuntimeExceptionSupport::kNoRuntimeExceptionSupport);
   // We have to add the code object to a NativeModule, because the
   // WasmCallDescriptor assumes that code is on the native heap and not
   // within a code object.
-  std::unique_ptr<wasm::NativeModule> module =
-      isolate->wasm_engine()->code_manager()->NewNativeModule(code_size, 1, 0,
-                                                              false);
-  return module;
+  return isolate->wasm_engine()->code_manager()->NewNativeModule(
+      isolate, code_size, false, std::move(module), env);
 }
 
 void TestReturnMultipleValues(MachineType type) {
@@ -158,12 +160,15 @@ void TestReturnMultipleValues(MachineType type) {
     m.Return(count, returns.get());
 
     OptimizedCompilationInfo info(ArrayVector("testing"), handles.main_zone(),
-                                  Code::STUB);
-    Handle<Code> code = Pipeline::GenerateCodeForTesting(
-        &info, handles.main_isolate(), desc, m.graph(), m.Export());
+                                  Code::WASM_FUNCTION);
+    Handle<Code> code =
+        Pipeline::GenerateCodeForTesting(
+            &info, handles.main_isolate(), desc, m.graph(),
+            AssemblerOptions::Default(handles.main_isolate()), m.Export())
+            .ToHandleChecked();
 #ifdef ENABLE_DISASSEMBLER
     if (FLAG_print_code) {
-      OFStream os(stdout);
+      StdoutStream os;
       code->Disassemble("multi_value", os);
     }
 #endif
@@ -188,11 +193,12 @@ void TestReturnMultipleValues(MachineType type) {
                            // WasmContext dummy
                            mt.PointerConstant(nullptr),
                            // Inputs
-                           Constant(mt, type, a), Constant(mt, type, b)};
+                           MakeConstant(mt, type, a),
+                           MakeConstant(mt, type, b)};
 
     Node* ret_multi = mt.AddNode(mt.common()->Call(desc),
                                  arraysize(call_inputs), call_inputs);
-    Node* ret = Constant(mt, type, 0);
+    Node* ret = MakeConstant(mt, type, 0);
     bool sign = false;
     for (int i = 0; i < count; ++i) {
       Node* x = (count == 1)
@@ -205,7 +211,7 @@ void TestReturnMultipleValues(MachineType type) {
 #ifdef ENABLE_DISASSEMBLER
     Handle<Code> code2 = mt.GetCode();
     if (FLAG_print_code) {
-      OFStream os(stdout);
+      StdoutStream os;
       code2->Disassemble("multi_value_call", os);
     }
 #endif
@@ -213,6 +219,8 @@ void TestReturnMultipleValues(MachineType type) {
   }
 }
 
+}  // namespace
+
 #define TEST_MULTI(Type, type) \
   TEST(ReturnMultiple##Type) { TestReturnMultipleValues(type); }
 
@@ -245,15 +253,18 @@ void ReturnLastValue(MachineType type) {
     std::unique_ptr<Node* []> returns(new Node*[return_count]);
 
     for (int i = 0; i < return_count; ++i) {
-      returns[i] = Constant(m, type, i);
+      returns[i] = MakeConstant(m, type, i);
     }
 
     m.Return(return_count, returns.get());
 
     OptimizedCompilationInfo info(ArrayVector("testing"), handles.main_zone(),
-                                  Code::STUB);
-    Handle<Code> code = Pipeline::GenerateCodeForTesting(
-        &info, handles.main_isolate(), desc, m.graph(), m.Export());
+                                  Code::WASM_FUNCTION);
+    Handle<Code> code =
+        Pipeline::GenerateCodeForTesting(
+            &info, handles.main_isolate(), desc, m.graph(),
+            AssemblerOptions::Default(handles.main_isolate()), m.Export())
+            .ToHandleChecked();
 
     std::unique_ptr<wasm::NativeModule> module = AllocateNativeModule(
         handles.main_isolate(), code->raw_instruction_size());
@@ -305,15 +316,18 @@ void ReturnSumOfReturns(MachineType type) {
     std::unique_ptr<Node* []> returns(new Node*[return_count]);
 
     for (int i = 0; i < return_count; ++i) {
-      returns[i] = Constant(m, type, i);
+      returns[i] = MakeConstant(m, type, i);
     }
 
     m.Return(return_count, returns.get());
 
     OptimizedCompilationInfo info(ArrayVector("testing"), handles.main_zone(),
-                                  Code::STUB);
-    Handle<Code> code = Pipeline::GenerateCodeForTesting(
-        &info, handles.main_isolate(), desc, m.graph(), m.Export());
+                                  Code::WASM_FUNCTION);
+    Handle<Code> code =
+        Pipeline::GenerateCodeForTesting(
+            &info, handles.main_isolate(), desc, m.graph(),
+            AssemblerOptions::Default(handles.main_isolate()), m.Export())
+            .ToHandleChecked();
 
     std::unique_ptr<wasm::NativeModule> module = AllocateNativeModule(
         handles.main_isolate(), code->raw_instruction_size());
diff --git a/deps/v8/test/cctest/compiler/test-representation-change.cc b/deps/v8/test/cctest/compiler/test-representation-change.cc
index 4f663ed6587c71..894338b3e2b230 100644
--- a/deps/v8/test/cctest/compiler/test-representation-change.cc
+++ b/deps/v8/test/cctest/compiler/test-representation-change.cc
@@ -89,7 +89,7 @@ class RepresentationChangerTester : public HandleAndZoneScope,
     return n;
   }
 
-  void CheckTypeError(MachineRepresentation from, Type* from_type,
+  void CheckTypeError(MachineRepresentation from, Type from_type,
                       MachineRepresentation to) {
     changer()->testing_type_errors_ = true;
     changer()->type_error_ = false;
@@ -101,7 +101,7 @@ class RepresentationChangerTester : public HandleAndZoneScope,
     CHECK_EQ(n, c);
   }
 
-  void CheckNop(MachineRepresentation from, Type* from_type,
+  void CheckNop(MachineRepresentation from, Type from_type,
                 MachineRepresentation to) {
     Node* n = Parameter(0);
     Node* use = Return(n);
@@ -268,7 +268,7 @@ TEST(ToUint32_constant) {
 }
 
 static void CheckChange(IrOpcode::Value expected, MachineRepresentation from,
-                        Type* from_type, UseInfo use_info) {
+                        Type from_type, UseInfo use_info) {
   RepresentationChangerTester r;
 
   Node* n = r.Parameter();
@@ -282,7 +282,7 @@ static void CheckChange(IrOpcode::Value expected, MachineRepresentation from,
 
   if (expected == IrOpcode::kCheckedFloat64ToInt32) {
     CheckForMinusZeroMode mode =
-        from_type->Maybe(Type::MinusZero())
+        from_type.Maybe(Type::MinusZero())
             ? use_info.minus_zero_check()
             : CheckForMinusZeroMode::kDontCheckForMinusZero;
     CHECK_EQ(mode, CheckMinusZeroParametersOf(c->op()).mode());
@@ -290,13 +290,13 @@ static void CheckChange(IrOpcode::Value expected, MachineRepresentation from,
 }
 
 static void CheckChange(IrOpcode::Value expected, MachineRepresentation from,
-                        Type* from_type, MachineRepresentation to) {
+                        Type from_type, MachineRepresentation to) {
   CheckChange(expected, from, from_type, UseInfo(to, Truncation::None()));
 }
 
 static void CheckTwoChanges(IrOpcode::Value expected2,
                             IrOpcode::Value expected1,
-                            MachineRepresentation from, Type* from_type,
+                            MachineRepresentation from, Type from_type,
                             MachineRepresentation to) {
   RepresentationChangerTester r;
 
@@ -314,7 +314,7 @@ static void CheckTwoChanges(IrOpcode::Value expected2,
 }
 
 static void CheckChange(IrOpcode::Value expected, MachineRepresentation from,
-                        Type* from_type, MachineRepresentation to,
+                        Type from_type, MachineRepresentation to,
                         UseInfo use_info) {
   RepresentationChangerTester r;
 
@@ -441,7 +441,7 @@ TEST(SignednessInWord32) {
                   MachineRepresentation::kWord32);
 }
 
-static void TestMinusZeroCheck(IrOpcode::Value expected, Type* from_type) {
+static void TestMinusZeroCheck(IrOpcode::Value expected, Type from_type) {
   RepresentationChangerTester r;
 
   CheckChange(
diff --git a/deps/v8/test/cctest/compiler/test-run-bytecode-graph-builder.cc b/deps/v8/test/cctest/compiler/test-run-bytecode-graph-builder.cc
index a43d97c63945a8..3e0e019fd22641 100644
--- a/deps/v8/test/cctest/compiler/test-run-bytecode-graph-builder.cc
+++ b/deps/v8/test/cctest/compiler/test-run-bytecode-graph-builder.cc
@@ -117,18 +117,19 @@ class BytecodeGraphTester {
         Handle<JSFunction>::cast(v8::Utils::OpenHandle(*api_function));
     CHECK(function->shared()->HasBytecodeArray());
 
-    Zone zone(function->GetIsolate()->allocator(), ZONE_NAME);
-    Handle<SharedFunctionInfo> shared(function->shared());
-    OptimizedCompilationInfo compilation_info(&zone, function->GetIsolate(),
-                                              shared, function);
+    Zone zone(isolate_->allocator(), ZONE_NAME);
+    Handle<SharedFunctionInfo> shared(function->shared(), isolate_);
+    OptimizedCompilationInfo compilation_info(&zone, isolate_, shared,
+                                              function);
 
     // Compiler relies on canonicalized handles, let's create
     // a canonicalized scope and migrate existing handles there.
     CanonicalHandleScope canonical(isolate_);
-    compilation_info.ReopenHandlesInNewHandleScope();
+    compilation_info.ReopenHandlesInNewHandleScope(isolate_);
 
-    Handle<Code> code = Pipeline::GenerateCodeForTesting(
-        &compilation_info, function->GetIsolate());
+    Handle<Code> code =
+        Pipeline::GenerateCodeForTesting(&compilation_info, isolate_)
+            .ToHandleChecked();
     function->set_code(*code);
 
     return function;
@@ -1336,25 +1337,26 @@ TEST(BytecodeGraphBuilderEvalGlobal) {
   }
 }
 
-bool get_compare_result(Token::Value opcode, Handle<Object> lhs_value,
-                        Handle<Object> rhs_value) {
+bool get_compare_result(Isolate* isolate, Token::Value opcode,
+                        Handle<Object> lhs_value, Handle<Object> rhs_value) {
   switch (opcode) {
     case Token::Value::EQ:
-      return Object::Equals(lhs_value, rhs_value).FromJust();
+      return Object::Equals(isolate, lhs_value, rhs_value).FromJust();
     case Token::Value::NE:
-      return !Object::Equals(lhs_value, rhs_value).FromJust();
+      return !Object::Equals(isolate, lhs_value, rhs_value).FromJust();
     case Token::Value::EQ_STRICT:
       return lhs_value->StrictEquals(*rhs_value);
     case Token::Value::NE_STRICT:
       return !lhs_value->StrictEquals(*rhs_value);
     case Token::Value::LT:
-      return Object::LessThan(lhs_value, rhs_value).FromJust();
+      return Object::LessThan(isolate, lhs_value, rhs_value).FromJust();
     case Token::Value::LTE:
-      return Object::LessThanOrEqual(lhs_value, rhs_value).FromJust();
+      return Object::LessThanOrEqual(isolate, lhs_value, rhs_value).FromJust();
     case Token::Value::GT:
-      return Object::GreaterThan(lhs_value, rhs_value).FromJust();
+      return Object::GreaterThan(isolate, lhs_value, rhs_value).FromJust();
     case Token::Value::GTE:
-      return Object::GreaterThanOrEqual(lhs_value, rhs_value).FromJust();
+      return Object::GreaterThanOrEqual(isolate, lhs_value, rhs_value)
+          .FromJust();
     default:
       UNREACHABLE();
   }
@@ -1410,8 +1412,8 @@ TEST(BytecodeGraphBuilderCompare) {
       for (size_t k = 0; k < arraysize(rhs_values); k++) {
         Handle<Object> return_value =
             callable(lhs_values[j], rhs_values[k]).ToHandleChecked();
-        bool result = get_compare_result(kCompareOperators[i], lhs_values[j],
-                                         rhs_values[k]);
+        bool result = get_compare_result(isolate, kCompareOperators[i],
+                                         lhs_values[j], rhs_values[k]);
         CHECK(return_value->SameValue(*factory->ToBoolean(result)));
       }
     }
@@ -2967,7 +2969,6 @@ TEST(BytecodeGraphBuilderIllegalConstDeclaration) {
 class CountBreakDebugDelegate : public v8::debug::DebugDelegate {
  public:
   void BreakProgramRequested(v8::Local<v8::Context> paused_context,
-                             v8::Local<v8::Object> exec_state,
                              const std::vector<int>&) override {
     debug_break_count++;
   }
diff --git a/deps/v8/test/cctest/compiler/test-run-calls-to-external-references.cc b/deps/v8/test/cctest/compiler/test-run-calls-to-external-references.cc
index efea4ce4cc23b1..df2dc89b26f85f 100644
--- a/deps/v8/test/cctest/compiler/test-run-calls-to-external-references.cc
+++ b/deps/v8/test/cctest/compiler/test-run-calls-to-external-references.cc
@@ -12,241 +12,361 @@ namespace v8 {
 namespace internal {
 namespace compiler {
 
-template <typename P>
-void TestExternalReference(BufferedRawMachineAssemblerTester<int32_t>* m,
-                           ExternalReference ref, void (*comparison)(P*),
-                           P param) {
-  P comparison_param = param;
+template <typename InType, typename OutType, typename Iterable>
+void TestExternalReference_ConvertOp(
+    BufferedRawMachineAssemblerTester<int32_t>* m, ExternalReference ref,
+    void (*wrapper)(Address), Iterable inputs) {
+  constexpr size_t kBufferSize = Max(sizeof(InType), sizeof(OutType));
+  uint8_t buffer[kBufferSize] = {0};
+  Address buffer_addr = reinterpret_cast<Address>(buffer);
 
   Node* function = m->ExternalConstant(ref);
   m->CallCFunction1(MachineType::Pointer(), MachineType::Pointer(), function,
-                    m->PointerConstant(&param));
+                    m->PointerConstant(buffer));
   m->Return(m->Int32Constant(4356));
 
-  m->Call();
-  comparison(&comparison_param);
+  for (InType input : inputs) {
+    WriteUnalignedValue<InType>(buffer_addr, input);
 
-  CHECK_EQ(comparison_param, param);
+    CHECK_EQ(4356, m->Call());
+    OutType output = ReadUnalignedValue<OutType>(buffer_addr);
+
+    WriteUnalignedValue<InType>(buffer_addr, input);
+    wrapper(buffer_addr);
+    OutType expected_output = ReadUnalignedValue<OutType>(buffer_addr);
+
+    CHECK_EQ(expected_output, output);
+  }
 }
 
-template <typename P1, typename P2>
-void TestExternalReference(BufferedRawMachineAssemblerTester<int32_t>* m,
-                           ExternalReference ref, void (*comparison)(P1*, P2*),
-                           P1 param1, P2 param2) {
-  P1 comparison_param1 = param1;
-  P2 comparison_param2 = param2;
+template <typename InType, typename OutType, typename Iterable>
+void TestExternalReference_ConvertOpWithOutputAndReturn(
+    BufferedRawMachineAssemblerTester<int32_t>* m, ExternalReference ref,
+    int32_t (*wrapper)(Address), Iterable inputs) {
+  constexpr size_t kBufferSize = Max(sizeof(InType), sizeof(OutType));
+  uint8_t buffer[kBufferSize] = {0};
+  Address buffer_addr = reinterpret_cast<Address>(buffer);
 
   Node* function = m->ExternalConstant(ref);
-  m->CallCFunction2(MachineType::Pointer(), MachineType::Pointer(),
-                    MachineType::Pointer(), function,
-                    m->PointerConstant(&param1), m->PointerConstant(&param2));
-  m->Return(m->Int32Constant(4356));
+  m->Return(m->CallCFunction1(MachineType::Int32(), MachineType::Pointer(),
+                              function, m->PointerConstant(buffer)));
+
+  for (InType input : inputs) {
+    WriteUnalignedValue<InType>(buffer_addr, input);
+
+    int32_t ret = m->Call();
+    OutType output = ReadUnalignedValue<OutType>(buffer_addr);
+
+    WriteUnalignedValue<InType>(buffer_addr, input);
+    int32_t expected_ret = wrapper(buffer_addr);
+    OutType expected_output = ReadUnalignedValue<OutType>(buffer_addr);
+
+    CHECK_EQ(expected_ret, ret);
+    CHECK_EQ(expected_output, output);
+  }
+}
+
+template <typename InType, typename OutType, typename Iterable>
+void TestExternalReference_ConvertOpWithReturn(
+    BufferedRawMachineAssemblerTester<OutType>* m, ExternalReference ref,
+    OutType (*wrapper)(Address), Iterable inputs) {
+  constexpr size_t kBufferSize = sizeof(InType);
+  uint8_t buffer[kBufferSize] = {0};
+  Address buffer_addr = reinterpret_cast<Address>(buffer);
+
+  Node* function = m->ExternalConstant(ref);
+  m->Return(m->CallCFunction1(MachineType::Int32(), MachineType::Pointer(),
+                              function, m->PointerConstant(buffer)));
+
+  for (InType input : inputs) {
+    WriteUnalignedValue<InType>(buffer_addr, input);
 
-  m->Call();
-  comparison(&comparison_param1, &comparison_param2);
+    OutType ret = m->Call();
 
-  CHECK_EQ(comparison_param1, param1);
-  CHECK_EQ(comparison_param2, param2);
+    WriteUnalignedValue<InType>(buffer_addr, input);
+    OutType expected_ret = wrapper(buffer_addr);
+
+    CHECK_EQ(expected_ret, ret);
+  }
+}
+
+template <typename Type>
+bool isnan(Type value) {
+  return false;
+}
+template <>
+bool isnan<float>(float value) {
+  return std::isnan(value);
+}
+template <>
+bool isnan<double>(double value) {
+  return std::isnan(value);
 }
 
-template <typename R, typename P>
-void TestExternalReference(BufferedRawMachineAssemblerTester<R>* m,
-                           ExternalReference ref, R (*comparison)(P*),
-                           P param) {
-  P comparison_param = param;
+template <typename Type, typename Iterable>
+void TestExternalReference_UnOp(BufferedRawMachineAssemblerTester<int32_t>* m,
+                                ExternalReference ref, void (*wrapper)(Address),
+                                Iterable inputs) {
+  constexpr size_t kBufferSize = sizeof(Type);
+  uint8_t buffer[kBufferSize] = {0};
+  Address buffer_addr = reinterpret_cast<Address>(buffer);
 
   Node* function = m->ExternalConstant(ref);
-  m->Return(m->CallCFunction1(MachineType::Pointer(), MachineType::Pointer(),
-                              function, m->PointerConstant(&param)));
+  m->CallCFunction1(MachineType::Int32(), MachineType::Pointer(), function,
+                    m->PointerConstant(buffer));
+  m->Return(m->Int32Constant(4356));
 
-  CHECK_EQ(comparison(&comparison_param), m->Call());
+  for (Type input : inputs) {
+    WriteUnalignedValue<Type>(buffer_addr, input);
+    CHECK_EQ(4356, m->Call());
+    Type output = ReadUnalignedValue<Type>(buffer_addr);
 
-  CHECK_EQ(comparison_param, param);
+    WriteUnalignedValue<Type>(buffer_addr, input);
+    wrapper(buffer_addr);
+    Type expected_output = ReadUnalignedValue<Type>(buffer_addr);
+
+    if (isnan(expected_output) && isnan(output)) continue;
+    CHECK_EQ(expected_output, output);
+  }
 }
 
-template <typename R, typename P1, typename P2>
-void TestExternalReference(BufferedRawMachineAssemblerTester<R>* m,
-                           ExternalReference ref, R (*comparison)(P1*, P2*),
-                           P1 param1, P2 param2) {
-  P1 comparison_param1 = param1;
-  P2 comparison_param2 = param2;
+template <typename Type, typename Iterable>
+void TestExternalReference_BinOp(BufferedRawMachineAssemblerTester<int32_t>* m,
+                                 ExternalReference ref,
+                                 void (*wrapper)(Address), Iterable inputs) {
+  constexpr size_t kBufferSize = 2 * sizeof(Type);
+  uint8_t buffer[kBufferSize] = {0};
+  Address buffer_addr = reinterpret_cast<Address>(buffer);
 
   Node* function = m->ExternalConstant(ref);
-  m->Return(m->CallCFunction2(
-      MachineType::Pointer(), MachineType::Pointer(), MachineType::Pointer(),
-      function, m->PointerConstant(&param1), m->PointerConstant(&param2)));
+  m->CallCFunction1(MachineType::Int32(), MachineType::Pointer(), function,
+                    m->PointerConstant(buffer));
+  m->Return(m->Int32Constant(4356));
+
+  for (Type input1 : inputs) {
+    for (Type input2 : inputs) {
+      WriteUnalignedValue<Type>(buffer_addr, input1);
+      WriteUnalignedValue<Type>(buffer_addr + sizeof(Type), input2);
+      CHECK_EQ(4356, m->Call());
+      Type output = ReadUnalignedValue<Type>(buffer_addr);
+
+      WriteUnalignedValue<Type>(buffer_addr, input1);
+      WriteUnalignedValue<Type>(buffer_addr + sizeof(Type), input2);
+      wrapper(buffer_addr);
+      Type expected_output = ReadUnalignedValue<Type>(buffer_addr);
+
+      if (isnan(expected_output) && isnan(output)) continue;
+      CHECK_EQ(expected_output, output);
+    }
+  }
+}
 
-  CHECK_EQ(comparison(&comparison_param1, &comparison_param2), m->Call());
+template <typename Type, typename Iterable>
+void TestExternalReference_BinOpWithReturn(
+    BufferedRawMachineAssemblerTester<int32_t>* m, ExternalReference ref,
+    int32_t (*wrapper)(Address), Iterable inputs) {
+  constexpr size_t kBufferSize = 2 * sizeof(Type);
+  uint8_t buffer[kBufferSize] = {0};
+  Address buffer_addr = reinterpret_cast<Address>(buffer);
 
-  CHECK_EQ(comparison_param1, param1);
-  CHECK_EQ(comparison_param2, param2);
+  Node* function = m->ExternalConstant(ref);
+  m->Return(m->CallCFunction1(MachineType::Int32(), MachineType::Pointer(),
+                              function, m->PointerConstant(buffer)));
+
+  for (Type input1 : inputs) {
+    for (Type input2 : inputs) {
+      WriteUnalignedValue<Type>(buffer_addr, input1);
+      WriteUnalignedValue<Type>(buffer_addr + sizeof(Type), input2);
+      int32_t ret = m->Call();
+      Type output = ReadUnalignedValue<Type>(buffer_addr);
+
+      WriteUnalignedValue<Type>(buffer_addr, input1);
+      WriteUnalignedValue<Type>(buffer_addr + sizeof(Type), input2);
+      int32_t expected_ret = wrapper(buffer_addr);
+      Type expected_output = ReadUnalignedValue<Type>(buffer_addr);
+
+      CHECK_EQ(expected_ret, ret);
+      if (isnan(expected_output) && isnan(output)) continue;
+      CHECK_EQ(expected_output, output);
+    }
+  }
 }
 
 TEST(RunCallF32Trunc) {
   BufferedRawMachineAssemblerTester<int32_t> m;
-  ExternalReference ref = ExternalReference::wasm_f32_trunc(m.isolate());
-  TestExternalReference(&m, ref, wasm::f32_trunc_wrapper, 1.25f);
+  ExternalReference ref = ExternalReference::wasm_f32_trunc();
+  TestExternalReference_UnOp<float>(&m, ref, wasm::f32_trunc_wrapper,
+                                    ValueHelper::float32_vector());
 }
 
 TEST(RunCallF32Floor) {
   BufferedRawMachineAssemblerTester<int32_t> m;
-  ExternalReference ref = ExternalReference::wasm_f32_floor(m.isolate());
-  TestExternalReference(&m, ref, wasm::f32_floor_wrapper, 1.25f);
+  ExternalReference ref = ExternalReference::wasm_f32_floor();
+  TestExternalReference_UnOp<float>(&m, ref, wasm::f32_floor_wrapper,
+                                    ValueHelper::float32_vector());
 }
 
 TEST(RunCallF32Ceil) {
   BufferedRawMachineAssemblerTester<int32_t> m;
-  ExternalReference ref = ExternalReference::wasm_f32_ceil(m.isolate());
-  TestExternalReference(&m, ref, wasm::f32_ceil_wrapper, 1.25f);
+  ExternalReference ref = ExternalReference::wasm_f32_ceil();
+  TestExternalReference_UnOp<float>(&m, ref, wasm::f32_ceil_wrapper,
+                                    ValueHelper::float32_vector());
 }
 
 TEST(RunCallF32RoundTiesEven) {
   BufferedRawMachineAssemblerTester<int32_t> m;
-  ExternalReference ref = ExternalReference::wasm_f32_nearest_int(m.isolate());
-  TestExternalReference(&m, ref, wasm::f32_nearest_int_wrapper, 1.25f);
+  ExternalReference ref = ExternalReference::wasm_f32_nearest_int();
+  TestExternalReference_UnOp<float>(&m, ref, wasm::f32_nearest_int_wrapper,
+                                    ValueHelper::float32_vector());
 }
 
 TEST(RunCallF64Trunc) {
   BufferedRawMachineAssemblerTester<int32_t> m;
-  ExternalReference ref = ExternalReference::wasm_f64_trunc(m.isolate());
-  TestExternalReference(&m, ref, wasm::f64_trunc_wrapper, 1.25);
+  ExternalReference ref = ExternalReference::wasm_f64_trunc();
+  TestExternalReference_UnOp<double>(&m, ref, wasm::f64_trunc_wrapper,
+                                     ValueHelper::float64_vector());
 }
 
 TEST(RunCallF64Floor) {
   BufferedRawMachineAssemblerTester<int32_t> m;
-  ExternalReference ref = ExternalReference::wasm_f64_floor(m.isolate());
-  TestExternalReference(&m, ref, wasm::f64_floor_wrapper, 1.25);
+  ExternalReference ref = ExternalReference::wasm_f64_floor();
+  TestExternalReference_UnOp<double>(&m, ref, wasm::f64_floor_wrapper,
+                                     ValueHelper::float64_vector());
 }
 
 TEST(RunCallF64Ceil) {
   BufferedRawMachineAssemblerTester<int32_t> m;
-  ExternalReference ref = ExternalReference::wasm_f64_ceil(m.isolate());
-  TestExternalReference(&m, ref, wasm::f64_ceil_wrapper, 1.25);
+  ExternalReference ref = ExternalReference::wasm_f64_ceil();
+  TestExternalReference_UnOp<double>(&m, ref, wasm::f64_ceil_wrapper,
+                                     ValueHelper::float64_vector());
 }
 
 TEST(RunCallF64RoundTiesEven) {
   BufferedRawMachineAssemblerTester<int32_t> m;
-  ExternalReference ref = ExternalReference::wasm_f64_nearest_int(m.isolate());
-  TestExternalReference(&m, ref, wasm::f64_nearest_int_wrapper, 1.25);
+  ExternalReference ref = ExternalReference::wasm_f64_nearest_int();
+  TestExternalReference_UnOp<double>(&m, ref, wasm::f64_nearest_int_wrapper,
+                                     ValueHelper::float64_vector());
 }
 
 TEST(RunCallInt64ToFloat32) {
   BufferedRawMachineAssemblerTester<int32_t> m;
-  ExternalReference ref = ExternalReference::wasm_int64_to_float32(m.isolate());
-  TestExternalReference(&m, ref, wasm::int64_to_float32_wrapper, int64_t(-2124),
-                        1.25f);
+  ExternalReference ref = ExternalReference::wasm_int64_to_float32();
+  TestExternalReference_ConvertOp<int64_t, float>(
+      &m, ref, wasm::int64_to_float32_wrapper, ValueHelper::int64_vector());
 }
 
 TEST(RunCallUint64ToFloat32) {
   BufferedRawMachineAssemblerTester<int32_t> m;
-  ExternalReference ref =
-      ExternalReference::wasm_uint64_to_float32(m.isolate());
-  TestExternalReference(&m, ref, wasm::uint64_to_float32_wrapper,
-                        uint64_t(2124), 1.25f);
+  ExternalReference ref = ExternalReference::wasm_uint64_to_float32();
+  TestExternalReference_ConvertOp<uint64_t, float>(
+      &m, ref, wasm::uint64_to_float32_wrapper, ValueHelper::uint64_vector());
 }
 
 TEST(RunCallInt64ToFloat64) {
   BufferedRawMachineAssemblerTester<int32_t> m;
-  ExternalReference ref = ExternalReference::wasm_int64_to_float64(m.isolate());
-  TestExternalReference(&m, ref, wasm::int64_to_float64_wrapper, int64_t(2124),
-                        1.25);
+  ExternalReference ref = ExternalReference::wasm_int64_to_float64();
+  TestExternalReference_ConvertOp<int64_t, double>(
+      &m, ref, wasm::int64_to_float64_wrapper, ValueHelper::int64_vector());
 }
 
 TEST(RunCallUint64ToFloat64) {
   BufferedRawMachineAssemblerTester<int32_t> m;
-  ExternalReference ref =
-      ExternalReference::wasm_uint64_to_float64(m.isolate());
-  TestExternalReference(&m, ref, wasm::uint64_to_float64_wrapper,
-                        uint64_t(2124), 1.25);
+  ExternalReference ref = ExternalReference::wasm_uint64_to_float64();
+  TestExternalReference_ConvertOp<uint64_t, double>(
+      &m, ref, wasm::uint64_to_float64_wrapper, ValueHelper::uint64_vector());
 }
 
 TEST(RunCallFloat32ToInt64) {
   BufferedRawMachineAssemblerTester<int32_t> m;
-  ExternalReference ref = ExternalReference::wasm_float32_to_int64(m.isolate());
-  TestExternalReference(&m, ref, wasm::float32_to_int64_wrapper, 1.25f,
-                        int64_t(2124));
+  ExternalReference ref = ExternalReference::wasm_float32_to_int64();
+  TestExternalReference_ConvertOpWithOutputAndReturn<float, int64_t>(
+      &m, ref, wasm::float32_to_int64_wrapper, ValueHelper::float32_vector());
 }
 
 TEST(RunCallFloat32ToUint64) {
   BufferedRawMachineAssemblerTester<int32_t> m;
-  ExternalReference ref =
-      ExternalReference::wasm_float32_to_uint64(m.isolate());
-  TestExternalReference(&m, ref, wasm::float32_to_uint64_wrapper, 1.25f,
-                        uint64_t(2124));
+  ExternalReference ref = ExternalReference::wasm_float32_to_uint64();
+  TestExternalReference_ConvertOpWithOutputAndReturn<float, uint64_t>(
+      &m, ref, wasm::float32_to_uint64_wrapper, ValueHelper::float32_vector());
 }
 
 TEST(RunCallFloat64ToInt64) {
   BufferedRawMachineAssemblerTester<int32_t> m;
-  ExternalReference ref = ExternalReference::wasm_float64_to_int64(m.isolate());
-  TestExternalReference(&m, ref, wasm::float64_to_int64_wrapper, 1.25,
-                        int64_t(2124));
+  ExternalReference ref = ExternalReference::wasm_float64_to_int64();
+  TestExternalReference_ConvertOpWithOutputAndReturn<double, int64_t>(
+      &m, ref, wasm::float64_to_int64_wrapper, ValueHelper::float64_vector());
 }
 
 TEST(RunCallFloat64ToUint64) {
   BufferedRawMachineAssemblerTester<int32_t> m;
-  ExternalReference ref =
-      ExternalReference::wasm_float64_to_uint64(m.isolate());
-  TestExternalReference(&m, ref, wasm::float64_to_uint64_wrapper, 1.25,
-                        uint64_t(2124));
+  ExternalReference ref = ExternalReference::wasm_float64_to_uint64();
+  TestExternalReference_ConvertOpWithOutputAndReturn<double, uint64_t>(
+      &m, ref, wasm::float64_to_uint64_wrapper, ValueHelper::float64_vector());
 }
 
 TEST(RunCallInt64Div) {
   BufferedRawMachineAssemblerTester<int32_t> m;
-  ExternalReference ref = ExternalReference::wasm_int64_div(m.isolate());
-  TestExternalReference(&m, ref, wasm::int64_div_wrapper, int64_t(1774),
-                        int64_t(21));
+  ExternalReference ref = ExternalReference::wasm_int64_div();
+  TestExternalReference_BinOpWithReturn<int64_t>(
+      &m, ref, wasm::int64_div_wrapper, ValueHelper::int64_vector());
 }
 
 TEST(RunCallInt64Mod) {
   BufferedRawMachineAssemblerTester<int32_t> m;
-  ExternalReference ref = ExternalReference::wasm_int64_mod(m.isolate());
-  TestExternalReference(&m, ref, wasm::int64_mod_wrapper, int64_t(1774),
-                        int64_t(21));
+  ExternalReference ref = ExternalReference::wasm_int64_mod();
+  TestExternalReference_BinOpWithReturn<int64_t>(
+      &m, ref, wasm::int64_mod_wrapper, ValueHelper::int64_vector());
 }
 
 TEST(RunCallUint64Div) {
   BufferedRawMachineAssemblerTester<int32_t> m;
-  ExternalReference ref = ExternalReference::wasm_uint64_div(m.isolate());
-  TestExternalReference(&m, ref, wasm::uint64_div_wrapper, uint64_t(1774),
-                        uint64_t(21));
+  ExternalReference ref = ExternalReference::wasm_uint64_div();
+  TestExternalReference_BinOpWithReturn<uint64_t>(
+      &m, ref, wasm::uint64_div_wrapper, ValueHelper::uint64_vector());
 }
 
 TEST(RunCallUint64Mod) {
   BufferedRawMachineAssemblerTester<int32_t> m;
-  ExternalReference ref = ExternalReference::wasm_uint64_mod(m.isolate());
-  TestExternalReference(&m, ref, wasm::uint64_mod_wrapper, uint64_t(1774),
-                        uint64_t(21));
+  ExternalReference ref = ExternalReference::wasm_uint64_mod();
+  TestExternalReference_BinOpWithReturn<uint64_t>(
+      &m, ref, wasm::uint64_mod_wrapper, ValueHelper::uint64_vector());
 }
 
 TEST(RunCallWord32Ctz) {
   BufferedRawMachineAssemblerTester<uint32_t> m;
-  ExternalReference ref = ExternalReference::wasm_word32_ctz(m.isolate());
-  TestExternalReference(&m, ref, wasm::word32_ctz_wrapper, uint32_t(1774));
+  ExternalReference ref = ExternalReference::wasm_word32_ctz();
+  TestExternalReference_ConvertOpWithReturn<int32_t, uint32_t>(
+      &m, ref, wasm::word32_ctz_wrapper, ValueHelper::int32_vector());
 }
 
 TEST(RunCallWord64Ctz) {
   BufferedRawMachineAssemblerTester<uint32_t> m;
-  ExternalReference ref = ExternalReference::wasm_word64_ctz(m.isolate());
-  TestExternalReference(&m, ref, wasm::word64_ctz_wrapper, uint64_t(1774));
+  ExternalReference ref = ExternalReference::wasm_word64_ctz();
+  TestExternalReference_ConvertOpWithReturn<int64_t, uint32_t>(
+      &m, ref, wasm::word64_ctz_wrapper, ValueHelper::int64_vector());
 }
 
 TEST(RunCallWord32Popcnt) {
   BufferedRawMachineAssemblerTester<uint32_t> m;
-  ExternalReference ref = ExternalReference::wasm_word32_popcnt(m.isolate());
-  TestExternalReference(&m, ref, wasm::word32_popcnt_wrapper, uint32_t(1774));
+  ExternalReference ref = ExternalReference::wasm_word32_popcnt();
+  TestExternalReference_ConvertOpWithReturn<uint32_t, uint32_t>(
+      &m, ref, wasm::word32_popcnt_wrapper, ValueHelper::int32_vector());
 }
 
 TEST(RunCallWord64Popcnt) {
   BufferedRawMachineAssemblerTester<uint32_t> m;
-  ExternalReference ref = ExternalReference::wasm_word64_popcnt(m.isolate());
-  TestExternalReference(&m, ref, wasm::word64_popcnt_wrapper, uint64_t(1774));
+  ExternalReference ref = ExternalReference::wasm_word64_popcnt();
+  TestExternalReference_ConvertOpWithReturn<int64_t, uint32_t>(
+      &m, ref, wasm::word64_popcnt_wrapper, ValueHelper::int64_vector());
 }
 
 TEST(RunCallFloat64Pow) {
   BufferedRawMachineAssemblerTester<int32_t> m;
-  ExternalReference ref = ExternalReference::wasm_float64_pow(m.isolate());
-  TestExternalReference(&m, ref, wasm::float64_pow_wrapper, 1.5, 1.5);
+  ExternalReference ref = ExternalReference::wasm_float64_pow();
+  TestExternalReference_BinOp<double>(&m, ref, wasm::float64_pow_wrapper,
+                                      ValueHelper::float64_vector());
 }
+
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/test/cctest/compiler/test-run-jscalls.cc b/deps/v8/test/cctest/compiler/test-run-jscalls.cc
index 371d0f94fa1d94..1b6d4fc49fcc1a 100644
--- a/deps/v8/test/cctest/compiler/test-run-jscalls.cc
+++ b/deps/v8/test/cctest/compiler/test-run-jscalls.cc
@@ -166,7 +166,8 @@ TEST(RuntimeCallInline) {
 
 TEST(EvalCall) {
   FunctionTester T("(function(a,b) { return eval(a); })");
-  Handle<JSObject> g(T.function->context()->global_object()->global_proxy());
+  Handle<JSObject> g(T.function->context()->global_object()->global_proxy(),
+                     T.isolate);
 
   T.CheckCall(T.Val(23), T.Val("17 + 6"), T.undefined());
   T.CheckCall(T.Val("'Y'; a"), T.Val("'Y'; a"), T.Val("b-val"));
@@ -190,7 +191,8 @@ TEST(ReceiverPatching) {
   // patches an undefined receiver to the global receiver. If this starts to
   // fail once we fix the calling protocol, just remove this test.
   FunctionTester T("(function(a) { return this; })");
-  Handle<JSObject> g(T.function->context()->global_object()->global_proxy());
+  Handle<JSObject> g(T.function->context()->global_object()->global_proxy(),
+                     T.isolate);
   T.CheckCall(g, T.undefined());
 }
 
diff --git a/deps/v8/test/cctest/compiler/test-run-load-store.cc b/deps/v8/test/cctest/compiler/test-run-load-store.cc
index 8014d5bffce34b..a9c7ed0587d10d 100644
--- a/deps/v8/test/cctest/compiler/test-run-load-store.cc
+++ b/deps/v8/test/cctest/compiler/test-run-load-store.cc
@@ -109,7 +109,7 @@ void RunLoadStoreFloat32Offset(TestAlignment t) {
       p1 = *j;
       p2 = *j - 5;
       CHECK_EQ(magic, m.Call());
-      CheckDoubleEq(p1, p2);
+      CHECK_DOUBLE_EQ(p1, p2);
     }
   }
 }
@@ -145,7 +145,7 @@ void RunLoadStoreFloat64Offset(TestAlignment t) {
       p1 = *j;
       p2 = *j - 5;
       CHECK_EQ(magic, m.Call());
-      CheckDoubleEq(p1, p2);
+      CHECK_DOUBLE_EQ(p1, p2);
     }
   }
 }
diff --git a/deps/v8/test/cctest/compiler/test-run-machops.cc b/deps/v8/test/cctest/compiler/test-run-machops.cc
index 1af038a66612c9..709c14e88e9923 100644
--- a/deps/v8/test/cctest/compiler/test-run-machops.cc
+++ b/deps/v8/test/cctest/compiler/test-run-machops.cc
@@ -1257,7 +1257,8 @@ TEST(RunInt32AddP) {
   FOR_INT32_INPUTS(i) {
     FOR_INT32_INPUTS(j) {
       // Use uint32_t because signed overflow is UB in C.
-      int expected = static_cast<int32_t>(*i + *j);
+      int expected = static_cast<int32_t>(static_cast<uint32_t>(*i) +
+                                          static_cast<uint32_t>(*j));
       CHECK_EQ(expected, bt.call(*i, *j));
     }
   }
@@ -1721,7 +1722,7 @@ TEST(RunInt32SubP) {
 
   FOR_UINT32_INPUTS(i) {
     FOR_UINT32_INPUTS(j) {
-      uint32_t expected = static_cast<int32_t>(*i - *j);
+      uint32_t expected = *i - *j;
       CHECK_EQ(expected, bt.call(*i, *j));
     }
   }
@@ -3198,6 +3199,54 @@ TEST(RunWord32ShrP) {
   }
 }
 
+TEST(RunWordShiftInBranch) {
+  static const uint32_t constant = 987654321;
+  FOR_UINT32_SHIFTS(shift) {
+    RawMachineAssemblerTester<uint32_t> m(MachineType::Uint32());
+    RawMachineLabel blocka, blockb;
+    m.Branch(m.Word32Equal(m.Word32Shl(m.Parameter(0), m.Int32Constant(shift)),
+                           m.Int32Constant(0)),
+             &blocka, &blockb);
+    m.Bind(&blocka);
+    m.Return(m.Int32Constant(constant));
+    m.Bind(&blockb);
+    m.Return(m.Int32Constant(0 - constant));
+    FOR_UINT32_INPUTS(i) {
+      uint32_t expected = ((*i << shift) == 0) ? constant : 0 - constant;
+      CHECK_EQ(expected, m.Call(*i));
+    }
+  }
+  FOR_UINT32_SHIFTS(shift) {
+    RawMachineAssemblerTester<uint32_t> m(MachineType::Uint32());
+    RawMachineLabel blocka, blockb;
+    m.Branch(m.Word32Equal(m.Word32Shr(m.Parameter(0), m.Int32Constant(shift)),
+                           m.Int32Constant(0)),
+             &blocka, &blockb);
+    m.Bind(&blocka);
+    m.Return(m.Int32Constant(constant));
+    m.Bind(&blockb);
+    m.Return(m.Int32Constant(0 - constant));
+    FOR_UINT32_INPUTS(i) {
+      uint32_t expected = ((*i >> shift) == 0) ? constant : 0 - constant;
+      CHECK_EQ(expected, m.Call(*i));
+    }
+  }
+  FOR_UINT32_SHIFTS(shift) {
+    RawMachineAssemblerTester<int32_t> m(MachineType::Int32());
+    RawMachineLabel blocka, blockb;
+    m.Branch(m.Word32Equal(m.Word32Sar(m.Parameter(0), m.Int32Constant(shift)),
+                           m.Int32Constant(0)),
+             &blocka, &blockb);
+    m.Bind(&blocka);
+    m.Return(m.Int32Constant(constant));
+    m.Bind(&blockb);
+    m.Return(m.Int32Constant(0 - constant));
+    FOR_INT32_INPUTS(i) {
+      int32_t expected = ((*i >> shift) == 0) ? constant : 0 - constant;
+      CHECK_EQ(expected, m.Call(*i));
+    }
+  }
+}
 
 TEST(RunWord32ShrInComparison) {
   {
diff --git a/deps/v8/test/cctest/compiler/test-run-native-calls.cc b/deps/v8/test/cctest/compiler/test-run-native-calls.cc
index 74ac62eca09f54..b23bd500c67151 100644
--- a/deps/v8/test/cctest/compiler/test-run-native-calls.cc
+++ b/deps/v8/test/cctest/compiler/test-run-native-calls.cc
@@ -258,11 +258,12 @@ Handle<Code> CompileGraph(const char* name, CallDescriptor* call_descriptor,
   OptimizedCompilationInfo info(ArrayVector("testing"), graph->zone(),
                                 Code::STUB);
   Handle<Code> code = Pipeline::GenerateCodeForTesting(
-      &info, isolate, call_descriptor, graph, schedule);
-  CHECK(!code.is_null());
+                          &info, isolate, call_descriptor, graph,
+                          AssemblerOptions::Default(isolate), schedule)
+                          .ToHandleChecked();
 #ifdef ENABLE_DISASSEMBLER
   if (FLAG_print_opt_code) {
-    OFStream os(stdout);
+    StdoutStream os;
     code->Disassemble(name, os);
   }
 #endif
diff --git a/deps/v8/test/cctest/compiler/test-run-stubs.cc b/deps/v8/test/cctest/compiler/test-run-stubs.cc
index 4304f552018b46..1751ee0836b17a 100644
--- a/deps/v8/test/cctest/compiler/test-run-stubs.cc
+++ b/deps/v8/test/cctest/compiler/test-run-stubs.cc
@@ -27,9 +27,8 @@ class StubTester {
         info_(ArrayVector("test"), zone, Code::STUB),
         interface_descriptor_(stub->GetCallInterfaceDescriptor()),
         descriptor_(Linkage::GetStubCallDescriptor(
-            isolate, zone, interface_descriptor_,
-            stub->GetStackParameterCount(), CallDescriptor::kNoFlags,
-            Operator::kNoProperties)),
+            zone, interface_descriptor_, stub->GetStackParameterCount(),
+            CallDescriptor::kNoFlags, Operator::kNoProperties)),
         graph_(zone_),
         common_(zone_),
         tester_(InitializeFunctionTester(stub->GetCode()),
@@ -41,20 +40,22 @@ class StubTester {
         interface_descriptor_(
             Builtins::CallableFor(isolate, name).descriptor()),
         descriptor_(Linkage::GetStubCallDescriptor(
-            isolate, zone, interface_descriptor_,
+            zone, interface_descriptor_,
             interface_descriptor_.GetStackParameterCount(),
             CallDescriptor::kNoFlags, Operator::kNoProperties)),
         graph_(zone_),
         common_(zone_),
         tester_(InitializeFunctionTester(
-                    Handle<Code>(isolate->builtins()->builtin(name))),
+                    Handle<Code>(isolate->builtins()->builtin(name), isolate)),
                 GetParameterCountWithContext()) {}
 
   template <typename... Args>
   Handle<Object> Call(Args... args) {
     DCHECK_EQ(interface_descriptor_.GetParameterCount(), sizeof...(args));
     MaybeHandle<Object> result =
-        tester_.Call(args..., Handle<HeapObject>(tester_.function->context()))
+        tester_
+            .Call(args...,
+                  Handle<HeapObject>(tester_.function->context(), ft().isolate))
             .ToHandleChecked();
     return result.ToHandleChecked();
   }
diff --git a/deps/v8/test/cctest/compiler/value-helper.h b/deps/v8/test/cctest/compiler/value-helper.h
index 9350a98a70da6c..e66c1ff4547dfa 100644
--- a/deps/v8/test/cctest/compiler/value-helper.h
+++ b/deps/v8/test/cctest/compiler/value-helper.h
@@ -11,7 +11,6 @@
 #include "src/compiler/common-operator.h"
 #include "src/compiler/node-matchers.h"
 #include "src/compiler/node.h"
-#include "src/heap/heap-inl.h"
 #include "src/isolate.h"
 #include "src/objects.h"
 #include "test/cctest/cctest.h"
@@ -54,14 +53,6 @@ class ValueHelper {
     CHECK_EQ(expected, *HeapConstantOf(node->op()));
   }
 
-  void CheckTrue(Node* node) {
-    CheckHeapConstant(isolate_->heap()->true_value(), node);
-  }
-
-  void CheckFalse(Node* node) {
-    CheckHeapConstant(isolate_->heap()->false_value(), node);
-  }
-
   static constexpr float float32_array[] = {
       -std::numeric_limits<float>::infinity(),
       -2.70497e+38f,
@@ -350,36 +341,34 @@ class ValueHelper {
 
 #define FOR_UINT32_SHIFTS(var) for (uint32_t var = 0; var < 32; var++)
 
-// TODO(bmeurer): Drop this crap once we switch to GTest/Gmock.
-static inline void CheckFloatEq(volatile float x, volatile float y) {
-  if (std::isnan(x)) {
-    CHECK(std::isnan(y));
-  } else {
-    CHECK_EQ(x, y);
-    CHECK_EQ(std::signbit(x), std::signbit(y));
+template <typename type>
+struct FloatCompareWrapper {
+  type value;
+  explicit FloatCompareWrapper(type x) : value(x) {}
+  bool operator==(type other) const {
+    return std::isnan(value)
+               ? std::isnan(other)
+               : value == other && std::signbit(value) == std::signbit(other);
   }
-}
+};
 
-#define CHECK_FLOAT_EQ(lhs, rhs)                      \
-  do {                                                \
-    volatile float tmp = lhs;                         \
-    ::v8::internal::compiler::CheckFloatEq(tmp, rhs); \
-  } while (0)
-
-static inline void CheckDoubleEq(volatile double x, volatile double y) {
-  if (std::isnan(x)) {
-    CHECK(std::isnan(y));
-  } else {
-    CHECK_EQ(x, y);
-    CHECK_EQ(std::signbit(x), std::signbit(y));
-  }
+template <typename type>
+std::ostream& operator<<(std::ostream& out, FloatCompareWrapper<type> wrapper) {
+  return out << wrapper.value;
 }
 
-#define CHECK_DOUBLE_EQ(lhs, rhs)                      \
-  do {                                                 \
-    volatile double tmp = lhs;                         \
-    ::v8::internal::compiler::CheckDoubleEq(tmp, rhs); \
-  } while (0)
+#define CHECK_FLOAT_EQ(lhs, rhs)                                               \
+  do {                                                                         \
+    using FloatWrapper = ::v8::internal::compiler::FloatCompareWrapper<float>; \
+    CHECK_EQ(FloatWrapper(lhs), rhs);                                          \
+  } while (false)
+
+#define CHECK_DOUBLE_EQ(lhs, rhs)                              \
+  do {                                                         \
+    using DoubleWrapper =                                      \
+        ::v8::internal::compiler::FloatCompareWrapper<double>; \
+    CHECK_EQ(DoubleWrapper(lhs), rhs);                         \
+  } while (false)
 
 }  // namespace compiler
 }  // namespace internal
diff --git a/deps/v8/test/cctest/heap/heap-tester.h b/deps/v8/test/cctest/heap/heap-tester.h
index db84b35309bc5e..422560c773a398 100644
--- a/deps/v8/test/cctest/heap/heap-tester.h
+++ b/deps/v8/test/cctest/heap/heap-tester.h
@@ -34,15 +34,16 @@
   V(StressHandles)                                        \
   V(TestMemoryReducerSampleJsCalls)                       \
   V(TestSizeOfObjects)                                    \
-  V(Regress587004)                                        \
+  V(Regress5831)                                          \
   V(Regress538257)                                        \
+  V(Regress587004)                                        \
   V(Regress589413)                                        \
   V(Regress658718)                                        \
   V(Regress670675)                                        \
-  V(Regress5831)                                          \
   V(Regress777177)                                        \
-  V(Regress791582)                                        \
   V(Regress779503)                                        \
+  V(Regress791582)                                        \
+  V(Regress845060)                                        \
   V(RegressMissingWriteBarrierInAllocate)                 \
   V(WriteBarriersInCopyJSObject)
 
@@ -95,6 +96,8 @@ class HeapTester {
   static AllocationResult AllocateMapForTest(v8::internal::Isolate* isolate);
   static AllocationResult AllocateFixedArrayForTest(Heap* heap, int length,
                                                     PretenureFlag pretenure);
+
+  static void UncommitFromSpace(Heap* heap);
 };
 
 }  // namespace heap
diff --git a/deps/v8/test/cctest/heap/heap-utils.cc b/deps/v8/test/cctest/heap/heap-utils.cc
index 6acec3e3877599..5beed7f4cb45dc 100644
--- a/deps/v8/test/cctest/heap/heap-utils.cc
+++ b/deps/v8/test/cctest/heap/heap-utils.cc
@@ -95,7 +95,7 @@ std::vector<Handle<FixedArray>> CreatePadding(Heap* heap, int padding_size,
       }
     }
     handles.push_back(isolate->factory()->NewFixedArray(length, tenure));
-    CHECK((tenure == NOT_TENURED && heap->InNewSpace(*handles.back())) ||
+    CHECK((tenure == NOT_TENURED && Heap::InNewSpace(*handles.back())) ||
           (tenure == TENURED && heap->InOldSpace(*handles.back())));
     free_memory -= allocate_memory;
   }
diff --git a/deps/v8/test/cctest/heap/test-alloc.cc b/deps/v8/test/cctest/heap/test-alloc.cc
index 1f3b560b17b32e..ee1a27d4e8e1fa 100644
--- a/deps/v8/test/cctest/heap/test-alloc.cc
+++ b/deps/v8/test/cctest/heap/test-alloc.cc
@@ -31,6 +31,7 @@
 #include "src/accessors.h"
 #include "src/api.h"
 #include "src/objects-inl.h"
+#include "src/objects/api-callbacks.h"
 #include "src/property.h"
 #include "test/cctest/heap/heap-tester.h"
 #include "test/cctest/heap/heap-utils.h"
@@ -138,16 +139,17 @@ TEST(StressJS) {
   factory->NewJSObject(function);
 
   // Patch the map to have an accessor for "get".
-  Handle<Map> map(function->initial_map());
-  Handle<DescriptorArray> instance_descriptors(map->instance_descriptors());
+  Handle<Map> map(function->initial_map(), isolate);
+  Handle<DescriptorArray> instance_descriptors(map->instance_descriptors(),
+                                               isolate);
   CHECK_EQ(0, instance_descriptors->number_of_descriptors());
 
   PropertyAttributes attrs = NONE;
   Handle<AccessorInfo> foreign = TestAccessorInfo(isolate, attrs);
-  Map::EnsureDescriptorSlack(map, 1);
+  Map::EnsureDescriptorSlack(isolate, map, 1);
 
   Descriptor d = Descriptor::AccessorConstant(
-      Handle<Name>(Name::cast(foreign->name())), foreign, attrs);
+      Handle<Name>(Name::cast(foreign->name()), isolate), foreign, attrs);
   map->AppendDescriptor(&d);
 
   // Add the Foo constructor the global object.
@@ -203,8 +205,8 @@ class Block {
 TEST(CodeRange) {
   const size_t code_range_size = 32*MB;
   CcTest::InitializeVM();
-  CodeRange code_range(reinterpret_cast<Isolate*>(CcTest::isolate()));
-  code_range.SetUp(code_range_size);
+  CodeRange code_range(reinterpret_cast<Isolate*>(CcTest::isolate()),
+                       code_range_size);
   size_t current_allocated = 0;
   size_t total_allocated = 0;
   std::vector<Block> blocks;
@@ -227,7 +229,7 @@ TEST(CodeRange) {
       Address base = code_range.AllocateRawMemory(
           requested, requested - (2 * MemoryAllocator::CodePageGuardSize()),
           &allocated);
-      CHECK_NOT_NULL(base);
+      CHECK_NE(base, kNullAddress);
       blocks.emplace_back(base, static_cast<int>(allocated));
       current_allocated += static_cast<int>(allocated);
       total_allocated += static_cast<int>(allocated);
diff --git a/deps/v8/test/cctest/heap/test-array-buffer-tracker.cc b/deps/v8/test/cctest/heap/test-array-buffer-tracker.cc
index f3907a0bdc55fc..31aff4f67340bd 100644
--- a/deps/v8/test/cctest/heap/test-array-buffer-tracker.cc
+++ b/deps/v8/test/cctest/heap/test-array-buffer-tracker.cc
@@ -224,7 +224,7 @@ TEST(ArrayBuffer_NonLivePromotion) {
     heap::GcAndSweep(heap, NEW_SPACE);
     CHECK(IsTracked(JSArrayBuffer::cast(root->get(0))));
     raw_ab = JSArrayBuffer::cast(root->get(0));
-    root->set(0, heap->undefined_value());
+    root->set(0, ReadOnlyRoots(heap).undefined_value());
     heap::SimulateIncrementalMarking(heap, true);
     // Prohibit page from being released.
     Page::FromAddress(raw_ab->address())->MarkNeverEvacuate();
@@ -261,7 +261,7 @@ TEST(ArrayBuffer_LivePromotion) {
     heap::GcAndSweep(heap, NEW_SPACE);
     CHECK(IsTracked(JSArrayBuffer::cast(root->get(0))));
     raw_ab = JSArrayBuffer::cast(root->get(0));
-    root->set(0, heap->undefined_value());
+    root->set(0, ReadOnlyRoots(heap).undefined_value());
     // Prohibit page from being released.
     Page::FromAddress(raw_ab->address())->MarkNeverEvacuate();
     heap::GcAndSweep(heap, OLD_SPACE);
@@ -338,30 +338,35 @@ UNINITIALIZED_TEST(ArrayBuffer_SemiSpaceCopyMultipleTasks) {
   isolate->Dispose();
 }
 
-TEST(ArrayBuffer_RetainedSizeIncreases) {
+TEST(ArrayBuffer_ExternalBackingStoreSizeIncreases) {
   CcTest::InitializeVM();
   LocalContext env;
   v8::Isolate* isolate = env->GetIsolate();
   Heap* heap = reinterpret_cast<Isolate*>(isolate)->heap();
+  ExternalBackingStoreType type = ExternalBackingStoreType::kArrayBuffer;
 
-  const size_t retained_before = ArrayBufferTracker::RetainedInNewSpace(heap);
+  const size_t backing_store_before =
+      heap->new_space()->ExternalBackingStoreBytes(type);
   {
     const size_t kArraybufferSize = 117;
     v8::HandleScope handle_scope(isolate);
     Local<v8::ArrayBuffer> ab = v8::ArrayBuffer::New(isolate, kArraybufferSize);
     USE(ab);
-    const size_t retained_after = ArrayBufferTracker::RetainedInNewSpace(heap);
-    CHECK_EQ(kArraybufferSize, retained_after - retained_before);
+    const size_t backing_store_after =
+        heap->new_space()->ExternalBackingStoreBytes(type);
+    CHECK_EQ(kArraybufferSize, backing_store_after - backing_store_before);
   }
 }
 
-TEST(ArrayBuffer_RetainedSizeDecreases) {
+TEST(ArrayBuffer_ExternalBackingStoreSizeDecreases) {
   CcTest::InitializeVM();
   LocalContext env;
   v8::Isolate* isolate = env->GetIsolate();
   Heap* heap = reinterpret_cast<Isolate*>(isolate)->heap();
+  ExternalBackingStoreType type = ExternalBackingStoreType::kArrayBuffer;
 
-  const size_t retained_before = ArrayBufferTracker::RetainedInNewSpace(heap);
+  const size_t backing_store_before =
+      heap->new_space()->ExternalBackingStoreBytes(type);
   {
     const size_t kArraybufferSize = 117;
     v8::HandleScope handle_scope(isolate);
@@ -369,8 +374,50 @@ TEST(ArrayBuffer_RetainedSizeDecreases) {
     USE(ab);
   }
   heap::GcAndSweep(heap, OLD_SPACE);
-  const size_t retained_after = ArrayBufferTracker::RetainedInNewSpace(heap);
-  CHECK_EQ(0, retained_after - retained_before);
+  const size_t backing_store_after =
+      heap->new_space()->ExternalBackingStoreBytes(type);
+  CHECK_EQ(0, backing_store_after - backing_store_before);
+}
+
+TEST(ArrayBuffer_ExternalBackingStoreSizeIncreasesMarkCompact) {
+  if (FLAG_never_compact) return;
+  ManualGCScope manual_gc_scope;
+  FLAG_manual_evacuation_candidates_selection = true;
+  CcTest::InitializeVM();
+  LocalContext env;
+  v8::Isolate* isolate = env->GetIsolate();
+  Heap* heap = reinterpret_cast<Isolate*>(isolate)->heap();
+  heap::AbandonCurrentlyFreeMemory(heap->old_space());
+  ExternalBackingStoreType type = ExternalBackingStoreType::kArrayBuffer;
+
+  const size_t backing_store_before =
+      heap->old_space()->ExternalBackingStoreBytes(type);
+
+  const size_t kArraybufferSize = 117;
+  {
+    v8::HandleScope handle_scope(isolate);
+    Local<v8::ArrayBuffer> ab1 =
+        v8::ArrayBuffer::New(isolate, kArraybufferSize);
+    Handle<JSArrayBuffer> buf1 = v8::Utils::OpenHandle(*ab1);
+    CHECK(IsTracked(*buf1));
+    heap::GcAndSweep(heap, NEW_SPACE);
+    heap::GcAndSweep(heap, NEW_SPACE);
+
+    Page* page_before_gc = Page::FromAddress(buf1->address());
+    heap::ForceEvacuationCandidate(page_before_gc);
+    CHECK(IsTracked(*buf1));
+
+    CcTest::CollectAllGarbage();
+
+    const size_t backing_store_after =
+        heap->old_space()->ExternalBackingStoreBytes(type);
+    CHECK_EQ(kArraybufferSize, backing_store_after - backing_store_before);
+  }
+
+  heap::GcAndSweep(heap, OLD_SPACE);
+  const size_t backing_store_after =
+      heap->old_space()->ExternalBackingStoreBytes(type);
+  CHECK_EQ(0, backing_store_after - backing_store_before);
 }
 
 }  // namespace heap
diff --git a/deps/v8/test/cctest/heap/test-compaction.cc b/deps/v8/test/cctest/heap/test-compaction.cc
index 3fe71b4eeeec6f..fec41c738abf0e 100644
--- a/deps/v8/test/cctest/heap/test-compaction.cc
+++ b/deps/v8/test/cctest/heap/test-compaction.cc
@@ -219,8 +219,9 @@ HEAP_TEST(CompactionPartiallyAbortedPageIntraAbortedPointers) {
       // leaving others in place.
       bool in_place = true;
       Handle<FixedArray> current = root_array;
-      while (current->get(0) != heap->undefined_value()) {
-        current = Handle<FixedArray>(FixedArray::cast(current->get(0)));
+      while (current->get(0) != ReadOnlyRoots(heap).undefined_value()) {
+        current =
+            Handle<FixedArray>(FixedArray::cast(current->get(0)), isolate);
         CHECK(current->IsFixedArray());
         if (Page::FromAddress(current->address()) != to_be_aborted_page) {
           in_place = false;
@@ -288,7 +289,7 @@ HEAP_TEST(CompactionPartiallyAbortedPageWithStoreBufferEntries) {
       root_array->set(0, *compaction_page_handles.back());
       Handle<FixedArray> new_space_array =
           isolate->factory()->NewFixedArray(1, NOT_TENURED);
-      CHECK(heap->InNewSpace(*new_space_array));
+      CHECK(Heap::InNewSpace(*new_space_array));
       compaction_page_handles.front()->set(1, *new_space_array);
       CheckAllObjectsOnPage(compaction_page_handles, to_be_aborted_page);
     }
@@ -313,9 +314,10 @@ HEAP_TEST(CompactionPartiallyAbortedPageWithStoreBufferEntries) {
       // leaving others in place.
       bool in_place = true;
       Handle<FixedArray> current = root_array;
-      while (current->get(0) != heap->undefined_value()) {
-        current = Handle<FixedArray>(FixedArray::cast(current->get(0)));
-        CHECK(!heap->InNewSpace(*current));
+      while (current->get(0) != ReadOnlyRoots(heap).undefined_value()) {
+        current =
+            Handle<FixedArray>(FixedArray::cast(current->get(0)), isolate);
+        CHECK(!Heap::InNewSpace(*current));
         CHECK(current->IsFixedArray());
         if (Page::FromAddress(current->address()) != to_be_aborted_page) {
           in_place = false;
diff --git a/deps/v8/test/cctest/heap/test-concurrent-marking.cc b/deps/v8/test/cctest/heap/test-concurrent-marking.cc
index d90d13cac5ec8d..0f10b1b9bde8b5 100644
--- a/deps/v8/test/cctest/heap/test-concurrent-marking.cc
+++ b/deps/v8/test/cctest/heap/test-concurrent-marking.cc
@@ -42,7 +42,7 @@ TEST(ConcurrentMarking) {
   WeakObjects weak_objects;
   ConcurrentMarking* concurrent_marking =
       new ConcurrentMarking(heap, &shared, &bailout, &on_hold, &weak_objects);
-  PublishSegment(&shared, heap->undefined_value());
+  PublishSegment(&shared, ReadOnlyRoots(heap).undefined_value());
   concurrent_marking->ScheduleTasks();
   concurrent_marking->Stop(
       ConcurrentMarking::StopRequest::COMPLETE_TASKS_FOR_TESTING);
@@ -64,11 +64,11 @@ TEST(ConcurrentMarkingReschedule) {
   WeakObjects weak_objects;
   ConcurrentMarking* concurrent_marking =
       new ConcurrentMarking(heap, &shared, &bailout, &on_hold, &weak_objects);
-  PublishSegment(&shared, heap->undefined_value());
+  PublishSegment(&shared, ReadOnlyRoots(heap).undefined_value());
   concurrent_marking->ScheduleTasks();
   concurrent_marking->Stop(
       ConcurrentMarking::StopRequest::COMPLETE_ONGOING_TASKS);
-  PublishSegment(&shared, heap->undefined_value());
+  PublishSegment(&shared, ReadOnlyRoots(heap).undefined_value());
   concurrent_marking->RescheduleTasksIfNeeded();
   concurrent_marking->Stop(
       ConcurrentMarking::StopRequest::COMPLETE_TASKS_FOR_TESTING);
@@ -91,11 +91,11 @@ TEST(ConcurrentMarkingPreemptAndReschedule) {
   ConcurrentMarking* concurrent_marking =
       new ConcurrentMarking(heap, &shared, &bailout, &on_hold, &weak_objects);
   for (int i = 0; i < 5000; i++)
-    PublishSegment(&shared, heap->undefined_value());
+    PublishSegment(&shared, ReadOnlyRoots(heap).undefined_value());
   concurrent_marking->ScheduleTasks();
   concurrent_marking->Stop(ConcurrentMarking::StopRequest::PREEMPT_TASKS);
   for (int i = 0; i < 5000; i++)
-    PublishSegment(&shared, heap->undefined_value());
+    PublishSegment(&shared, ReadOnlyRoots(heap).undefined_value());
   concurrent_marking->RescheduleTasksIfNeeded();
   concurrent_marking->Stop(
       ConcurrentMarking::StopRequest::COMPLETE_TASKS_FOR_TESTING);
@@ -117,6 +117,32 @@ TEST(ConcurrentMarkingMarkedBytes) {
   CHECK_GE(heap->concurrent_marking()->TotalMarkedBytes(), root->Size());
 }
 
+UNINITIALIZED_TEST(ConcurrentMarkingStoppedOnTeardown) {
+  if (!i::FLAG_concurrent_marking) return;
+
+  v8::Isolate::CreateParams create_params;
+  create_params.array_buffer_allocator = CcTest::array_buffer_allocator();
+  v8::Isolate* isolate = v8::Isolate::New(create_params);
+
+  {
+    Isolate* i_isolate = reinterpret_cast<Isolate*>(isolate);
+    Factory* factory = i_isolate->factory();
+
+    v8::Isolate::Scope isolate_scope(isolate);
+    v8::HandleScope handle_scope(isolate);
+    v8::Context::New(isolate)->Enter();
+
+    for (int i = 0; i < 10000; i++) {
+      factory->NewJSWeakMap();
+    }
+
+    Heap* heap = i_isolate->heap();
+    heap::SimulateIncrementalMarking(heap, false);
+  }
+
+  isolate->Dispose();
+}
+
 }  // namespace heap
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/test/cctest/heap/test-embedder-tracing.cc b/deps/v8/test/cctest/heap/test-embedder-tracing.cc
index 82e4e3ddf849cf..f124369172331c 100644
--- a/deps/v8/test/cctest/heap/test-embedder-tracing.cc
+++ b/deps/v8/test/cctest/heap/test-embedder-tracing.cc
@@ -183,7 +183,7 @@ TEST(TracingInEphemerons) {
         ConstructTraceableJSApiObject(context, first_field, nullptr);
     CHECK(!api_object.IsEmpty());
     Handle<JSObject> js_key =
-        handle(JSObject::cast(*v8::Utils::OpenHandle(*key)));
+        handle(JSObject::cast(*v8::Utils::OpenHandle(*key)), i_isolate);
     Handle<JSReceiver> js_api_object = v8::Utils::OpenHandle(*api_object);
     int32_t hash = js_key->GetOrCreateHash(i_isolate)->value();
     JSWeakCollection::Set(weak_map, js_key, js_api_object, hash);
diff --git a/deps/v8/test/cctest/heap/test-heap.cc b/deps/v8/test/cctest/heap/test-heap.cc
index 22beae16989eaa..311eadcc992cde 100644
--- a/deps/v8/test/cctest/heap/test-heap.cc
+++ b/deps/v8/test/cctest/heap/test-heap.cc
@@ -46,6 +46,7 @@
 #include "src/ic/ic.h"
 #include "src/macro-assembler-inl.h"
 #include "src/objects-inl.h"
+#include "src/objects/js-collection-inl.h"
 #include "src/regexp/jsregexp.h"
 #include "src/snapshot/snapshot.h"
 #include "src/transitions.h"
@@ -68,7 +69,7 @@ static void CheckMap(Map* map, int type, int instance_size) {
 #ifdef DEBUG
   CHECK(CcTest::heap()->Contains(map));
 #endif
-  CHECK_EQ(CcTest::heap()->meta_map(), map->map());
+  CHECK_EQ(ReadOnlyRoots(CcTest::heap()).meta_map(), map->map());
   CHECK_EQ(type, map->instance_type());
   CHECK_EQ(instance_size, map->instance_size());
 }
@@ -76,12 +77,12 @@ static void CheckMap(Map* map, int type, int instance_size) {
 
 TEST(HeapMaps) {
   CcTest::InitializeVM();
-  Heap* heap = CcTest::heap();
-  CheckMap(heap->meta_map(), MAP_TYPE, Map::kSize);
-  CheckMap(heap->heap_number_map(), HEAP_NUMBER_TYPE, HeapNumber::kSize);
-  CheckMap(heap->fixed_array_map(), FIXED_ARRAY_TYPE, kVariableSizeSentinel);
-  CheckMap(heap->hash_table_map(), HASH_TABLE_TYPE, kVariableSizeSentinel);
-  CheckMap(heap->string_map(), STRING_TYPE, kVariableSizeSentinel);
+  ReadOnlyRoots roots(CcTest::heap());
+  CheckMap(roots.meta_map(), MAP_TYPE, Map::kSize);
+  CheckMap(roots.heap_number_map(), HEAP_NUMBER_TYPE, HeapNumber::kSize);
+  CheckMap(roots.fixed_array_map(), FIXED_ARRAY_TYPE, kVariableSizeSentinel);
+  CheckMap(roots.hash_table_map(), HASH_TABLE_TYPE, kVariableSizeSentinel);
+  CheckMap(roots.string_map(), STRING_TYPE, kVariableSizeSentinel);
 }
 
 static void VerifyStoredPrototypeMap(Isolate* isolate,
@@ -89,12 +90,14 @@ static void VerifyStoredPrototypeMap(Isolate* isolate,
                                      int stored_ctor_context_index) {
   Handle<Context> context = isolate->native_context();
 
-  Handle<Map> this_map(Map::cast(context->get(stored_map_context_index)));
+  Handle<Map> this_map(Map::cast(context->get(stored_map_context_index)),
+                       isolate);
 
   Handle<JSFunction> fun(
-      JSFunction::cast(context->get(stored_ctor_context_index)));
-  Handle<JSObject> proto(JSObject::cast(fun->initial_map()->prototype()));
-  Handle<Map> that_map(proto->map());
+      JSFunction::cast(context->get(stored_ctor_context_index)), isolate);
+  Handle<JSObject> proto(JSObject::cast(fun->initial_map()->prototype()),
+                         isolate);
+  Handle<Map> that_map(proto->map(), isolate);
 
   CHECK(proto->HasFastProperties());
   CHECK_EQ(*this_map, *that_map);
@@ -178,11 +181,10 @@ HEAP_TEST(TestNewSpaceRefsInCopiedCode) {
   CcTest::InitializeVM();
   Isolate* isolate = CcTest::i_isolate();
   Factory* factory = isolate->factory();
-  Heap* heap = isolate->heap();
   HandleScope sc(isolate);
 
   Handle<HeapNumber> value = factory->NewHeapNumber(1.000123);
-  CHECK(heap->InNewSpace(*value));
+  CHECK(Heap::InNewSpace(*value));
 
   i::byte buffer[i::Assembler::kMinimalBufferSize];
   MacroAssembler masm(isolate, buffer, sizeof(buffer),
@@ -210,7 +212,7 @@ static void CheckFindCodeObject(Isolate* isolate) {
   // Test FindCodeObject
 #define __ assm.
 
-  Assembler assm(isolate, nullptr, 0);
+  Assembler assm(AssemblerOptions{}, nullptr, 0);
 
   __ nop();  // supported on all architectures
 
@@ -308,15 +310,16 @@ TEST(HeapObjects) {
   CHECK_EQ(10, s->length());
 
   Handle<String> object_string = Handle<String>::cast(factory->Object_string());
-  Handle<JSGlobalObject> global(
-      CcTest::i_isolate()->context()->global_object());
+  Handle<JSGlobalObject> global(CcTest::i_isolate()->context()->global_object(),
+                                isolate);
   CHECK(Just(true) == JSReceiver::HasOwnProperty(global, object_string));
 
   // Check ToString for oddballs
-  CheckOddball(isolate, heap->true_value(), "true");
-  CheckOddball(isolate, heap->false_value(), "false");
-  CheckOddball(isolate, heap->null_value(), "null");
-  CheckOddball(isolate, heap->undefined_value(), "undefined");
+  ReadOnlyRoots roots(heap);
+  CheckOddball(isolate, roots.true_value(), "true");
+  CheckOddball(isolate, roots.false_value(), "false");
+  CheckOddball(isolate, roots.null_value(), "null");
+  CheckOddball(isolate, roots.undefined_value(), "undefined");
 
   // Check ToString for Smis
   CheckSmi(isolate, 0, "0");
@@ -348,8 +351,8 @@ TEST(GarbageCollection) {
   // Check GC.
   CcTest::CollectGarbage(NEW_SPACE);
 
-  Handle<JSGlobalObject> global(
-      CcTest::i_isolate()->context()->global_object());
+  Handle<JSGlobalObject> global(CcTest::i_isolate()->context()->global_object(),
+                                isolate);
   Handle<String> name = factory->InternalizeUtf8String("theFunction");
   Handle<String> prop_name = factory->InternalizeUtf8String("theSlot");
   Handle<String> prop_namex = factory->InternalizeUtf8String("theSlotx");
@@ -666,7 +669,6 @@ TEST(WeakGlobalHandlesMark) {
   FLAG_stress_incremental_marking = false;
   CcTest::InitializeVM();
   Isolate* isolate = CcTest::i_isolate();
-  Heap* heap = isolate->heap();
   Factory* factory = isolate->factory();
   GlobalHandles* global_handles = isolate->global_handles();
 
@@ -688,7 +690,7 @@ TEST(WeakGlobalHandlesMark) {
   // Make sure the objects are promoted.
   CcTest::CollectGarbage(OLD_SPACE);
   CcTest::CollectGarbage(NEW_SPACE);
-  CHECK(!heap->InNewSpace(*h1) && !heap->InNewSpace(*h2));
+  CHECK(!Heap::InNewSpace(*h1) && !Heap::InNewSpace(*h2));
 
   std::pair<Handle<Object>*, int> handle_and_id(&h2, 1234);
   GlobalHandles::MakeWeak(
@@ -779,7 +781,8 @@ TEST(BytecodeArray) {
   CHECK_GE(array->address() + array->BytecodeArraySize(),
            array->GetFirstBytecodeAddress() + array->length());
   for (int i = 0; i < kRawBytesSize; i++) {
-    CHECK_EQ(array->GetFirstBytecodeAddress()[i], kRawBytes[i]);
+    CHECK_EQ(Memory::uint8_at(array->GetFirstBytecodeAddress() + i),
+             kRawBytes[i]);
     CHECK_EQ(array->get(i), kRawBytes[i]);
   }
 
@@ -796,7 +799,8 @@ TEST(BytecodeArray) {
   CHECK_EQ(array->frame_size(), kFrameSize);
   for (int i = 0; i < kRawBytesSize; i++) {
     CHECK_EQ(array->get(i), kRawBytes[i]);
-    CHECK_EQ(array->GetFirstBytecodeAddress()[i], kRawBytes[i]);
+    CHECK_EQ(Memory::uint8_at(array->GetFirstBytecodeAddress() + i),
+             kRawBytes[i]);
   }
 
   // Constant pool should have been migrated.
@@ -951,7 +955,8 @@ TEST(ObjectProperties) {
   Factory* factory = isolate->factory();
 
   v8::HandleScope sc(CcTest::isolate());
-  Handle<String> object_string(String::cast(CcTest::heap()->Object_string()));
+  Handle<String> object_string(
+      String::cast(ReadOnlyRoots(CcTest::heap()).Object_string()), isolate);
   Handle<Object> object = Object::GetProperty(
       CcTest::i_isolate()->global_object(), object_string).ToHandleChecked();
   Handle<JSFunction> constructor = Handle<JSFunction>::cast(object);
@@ -1031,7 +1036,7 @@ TEST(JSObjectMaps) {
 
   Handle<String> prop_name = factory->InternalizeUtf8String("theSlot");
   Handle<JSObject> obj = factory->NewJSObject(function);
-  Handle<Map> initial_map(function->initial_map());
+  Handle<Map> initial_map(function->initial_map(), isolate);
 
   // Set a propery
   Handle<Smi> twenty_three(Smi::FromInt(23), isolate);
@@ -1104,7 +1109,8 @@ TEST(JSObjectCopy) {
   Factory* factory = isolate->factory();
 
   v8::HandleScope sc(CcTest::isolate());
-  Handle<String> object_string(String::cast(CcTest::heap()->Object_string()));
+  Handle<String> object_string(
+      String::cast(ReadOnlyRoots(CcTest::heap()).Object_string()), isolate);
   Handle<Object> object = Object::GetProperty(
       CcTest::i_isolate()->global_object(), object_string).ToHandleChecked();
   Handle<JSFunction> constructor = Handle<JSFunction>::cast(object);
@@ -1251,7 +1257,8 @@ TEST(Iteration) {
   delete[] str;
 
   // Add a Map object to look for.
-  objs[next_objs_index++] = Handle<Map>(HeapObject::cast(*objs[0])->map());
+  objs[next_objs_index++] =
+      Handle<Map>(HeapObject::cast(*objs[0])->map(), isolate);
 
   CHECK_EQ(objs_count, next_objs_index);
   CHECK_EQ(objs_count, ObjectsFoundInHeap(CcTest::heap(), objs, objs_count));
@@ -1472,7 +1479,7 @@ TEST(TestInternalWeakLists) {
   for (int i = 0; i < kNumTestContexts; i++) {
     // TODO(dcarney): is there a better way to do this?
     i::Object** unsafe = reinterpret_cast<i::Object**>(*ctx[i]);
-    *unsafe = CcTest::heap()->undefined_value();
+    *unsafe = ReadOnlyRoots(CcTest::heap()).undefined_value();
     ctx[i].Clear();
 
     // Scavenge treats these references as strong.
@@ -1599,7 +1606,7 @@ TEST(TestAlignmentCalculations) {
   int max_double_unaligned_fill = Heap::GetMaximumFillToAlign(kDoubleUnaligned);
   CHECK_EQ(maximum_double_misalignment, max_double_unaligned_fill);
 
-  Address base = static_cast<Address>(nullptr);
+  Address base = kNullAddress;
   int fill = 0;
 
   // Word alignment never requires fill.
@@ -2181,6 +2188,33 @@ HEAP_TEST(GCFlags) {
   CHECK_EQ(Heap::kNoGCFlags, heap->current_gc_flags_);
 }
 
+HEAP_TEST(Regress845060) {
+  // Regression test for crbug.com/845060, where a raw pointer to a string's
+  // data was kept across an allocation. If the allocation causes GC and
+  // moves the string, such raw pointers become invalid.
+  FLAG_allow_natives_syntax = true;
+  FLAG_stress_incremental_marking = false;
+  FLAG_stress_compaction = false;
+  CcTest::InitializeVM();
+  LocalContext context;
+  v8::HandleScope scope(CcTest::isolate());
+  Heap* heap = CcTest::heap();
+
+  // Preparation: create a string in new space.
+  Local<Value> str = CompileRun("var str = (new Array(10000)).join('x'); str");
+  CHECK(Heap::InNewSpace(*v8::Utils::OpenHandle(*str)));
+
+  // Idle incremental marking sets the "kReduceMemoryFootprint" flag, which
+  // causes from_space to be unmapped after scavenging.
+  heap->StartIdleIncrementalMarking(GarbageCollectionReason::kTesting);
+  CHECK(heap->ShouldReduceMemory());
+
+  // Run the test (which allocates results) until the original string was
+  // promoted to old space. Unmapping of from_space causes accesses to any
+  // stale raw pointers to crash.
+  CompileRun("while (%InNewSpace(str)) { str.split(''); }");
+  CHECK(!Heap::InNewSpace(*v8::Utils::OpenHandle(*str)));
+}
 
 TEST(IdleNotificationFinishMarking) {
   if (!FLAG_incremental_marking) return;
@@ -2247,7 +2281,7 @@ TEST(OptimizedAllocationAlwaysInNewSpace) {
   i::Handle<JSReceiver> o =
       v8::Utils::OpenHandle(*v8::Local<v8::Object>::Cast(res));
 
-  CHECK(CcTest::heap()->InNewSpace(*o));
+  CHECK(Heap::InNewSpace(*o));
 }
 
 
@@ -2344,6 +2378,49 @@ TEST(OptimizedPretenuringObjectArrayLiterals) {
   CHECK(CcTest::heap()->InOldSpace(*o));
 }
 
+TEST(OptimizedPretenuringNestedInObjectProperties) {
+  FLAG_allow_natives_syntax = true;
+  FLAG_expose_gc = true;
+  CcTest::InitializeVM();
+  if (!CcTest::i_isolate()->use_optimizer() || FLAG_always_opt) return;
+  if (FLAG_gc_global || FLAG_stress_compaction ||
+      FLAG_stress_incremental_marking) {
+    return;
+  }
+  v8::HandleScope scope(CcTest::isolate());
+
+  // Grow new space until maximum capacity reached.
+  while (!CcTest::heap()->new_space()->IsAtMaximumCapacity()) {
+    CcTest::heap()->new_space()->Grow();
+  }
+
+  // Keep the nested literal alive while its root is freed
+  i::ScopedVector<char> source(1024);
+  i::SNPrintF(source,
+              "let number_elements = %d;"
+              "let elements = new Array(number_elements);"
+              "function f() {"
+              "  for (let i = 0; i < number_elements; i++) {"
+              "     let l =  {a: {c: 2.2, d: {e: 3.3}}, b: 1.1}; "
+              "    elements[i] = l.a;"
+              "  }"
+              "  return elements[number_elements-1];"
+              "};"
+              "f(); gc(); gc();"
+              "f(); f();"
+              "%%OptimizeFunctionOnNextCall(f);"
+              "f();",
+              kPretenureCreationCount);
+
+  v8::Local<v8::Value> res = CompileRun(source.start());
+
+  i::Handle<JSObject> o = Handle<JSObject>::cast(
+      v8::Utils::OpenHandle(*v8::Local<v8::Object>::Cast(res)));
+
+  // Nested literal sites are only pretenured if the top level
+  // literal is pretenured
+  CHECK(Heap::InNewSpace(*o));
+}
 
 TEST(OptimizedPretenuringMixedInObjectProperties) {
   FLAG_allow_natives_syntax = true;
@@ -2414,7 +2491,7 @@ TEST(OptimizedPretenuringDoubleArrayProperties) {
     return;
   v8::HandleScope scope(CcTest::isolate());
 
-  // Grow new space unitl maximum capacity reached.
+  // Grow new space until maximum capacity reached.
   while (!CcTest::heap()->new_space()->IsAtMaximumCapacity()) {
     CcTest::heap()->new_space()->Grow();
   }
@@ -2441,7 +2518,8 @@ TEST(OptimizedPretenuringDoubleArrayProperties) {
       v8::Utils::OpenHandle(*v8::Local<v8::Object>::Cast(res)));
 
   CHECK(CcTest::heap()->InOldSpace(*o));
-  CHECK(CcTest::heap()->InOldSpace(o->property_array()));
+  CHECK_EQ(o->property_array(),
+           ReadOnlyRoots(CcTest::heap()).empty_property_array());
 }
 
 
@@ -2670,13 +2748,12 @@ TEST(OptimizedAllocationArrayLiterals) {
   i::Handle<JSObject> o = Handle<JSObject>::cast(
       v8::Utils::OpenHandle(*v8::Local<v8::Object>::Cast(res)));
 
-  CHECK(CcTest::heap()->InNewSpace(o->elements()));
+  CHECK(Heap::InNewSpace(o->elements()));
 }
 
-
-static int CountMapTransitions(Map* map) {
+static int CountMapTransitions(i::Isolate* isolate, Map* map) {
   DisallowHeapAllocation no_gc;
-  return TransitionsAccessor(map, &no_gc).NumberOfTransitions();
+  return TransitionsAccessor(isolate, map, &no_gc).NumberOfTransitions();
 }
 
 
@@ -2690,8 +2767,10 @@ TEST(Regress1465) {
   FLAG_trace_incremental_marking = true;
   FLAG_retain_maps_for_n_gc = 0;
   CcTest::InitializeVM();
-  v8::HandleScope scope(CcTest::isolate());
-  v8::Local<v8::Context> ctx = CcTest::isolate()->GetCurrentContext();
+  v8::Isolate* isolate = CcTest::isolate();
+  i::Isolate* i_isolate = CcTest::i_isolate();
+  v8::HandleScope scope(isolate);
+  v8::Local<v8::Context> ctx = isolate->GetCurrentContext();
   static const int transitions_count = 256;
 
   CompileRun("function F() {}");
@@ -2710,7 +2789,7 @@ TEST(Regress1465) {
           CcTest::global()->Get(ctx, v8_str("root")).ToLocalChecked()));
 
   // Count number of live transitions before marking.
-  int transitions_before = CountMapTransitions(root->map());
+  int transitions_before = CountMapTransitions(i_isolate, root->map());
   CompileRun("%DebugPrint(root);");
   CHECK_EQ(transitions_count, transitions_before);
 
@@ -2719,7 +2798,7 @@ TEST(Regress1465) {
 
   // Count number of live transitions after marking.  Note that one transition
   // is left, because 'o' still holds an instance of one transition target.
-  int transitions_after = CountMapTransitions(root->map());
+  int transitions_after = CountMapTransitions(i_isolate, root->map());
   CompileRun("%DebugPrint(root);");
   CHECK_EQ(1, transitions_after);
 }
@@ -2766,6 +2845,7 @@ TEST(TransitionArrayShrinksDuringAllocToZero) {
   FLAG_stress_incremental_marking = false;
   FLAG_allow_natives_syntax = true;
   CcTest::InitializeVM();
+  i::Isolate* i_isolate = CcTest::i_isolate();
   v8::HandleScope scope(CcTest::isolate());
   static const int transitions_count = 10;
   CompileRun("function F() { }");
@@ -2774,7 +2854,7 @@ TEST(TransitionArrayShrinksDuringAllocToZero) {
   Handle<JSObject> root = GetByName("root");
 
   // Count number of live transitions before marking.
-  int transitions_before = CountMapTransitions(root->map());
+  int transitions_before = CountMapTransitions(i_isolate, root->map());
   CHECK_EQ(transitions_count, transitions_before);
 
   // Get rid of o
@@ -2786,8 +2866,8 @@ TEST(TransitionArrayShrinksDuringAllocToZero) {
 
   // Count number of live transitions after marking.  Note that one transition
   // is left, because 'o' still holds an instance of one transition target.
-  int transitions_after = CountMapTransitions(
-      Map::cast(root->map()->GetBackPointer()));
+  int transitions_after =
+      CountMapTransitions(i_isolate, Map::cast(root->map()->GetBackPointer()));
   CHECK_EQ(1, transitions_after);
 }
 
@@ -2797,6 +2877,7 @@ TEST(TransitionArrayShrinksDuringAllocToOne) {
   FLAG_stress_incremental_marking = false;
   FLAG_allow_natives_syntax = true;
   CcTest::InitializeVM();
+  i::Isolate* i_isolate = CcTest::i_isolate();
   v8::HandleScope scope(CcTest::isolate());
   static const int transitions_count = 10;
   CompileRun("function F() {}");
@@ -2805,7 +2886,7 @@ TEST(TransitionArrayShrinksDuringAllocToOne) {
   Handle<JSObject> root = GetByName("root");
 
   // Count number of live transitions before marking.
-  int transitions_before = CountMapTransitions(root->map());
+  int transitions_before = CountMapTransitions(i_isolate, root->map());
   CHECK_EQ(transitions_count, transitions_before);
 
   root = GetByName("root");
@@ -2814,8 +2895,8 @@ TEST(TransitionArrayShrinksDuringAllocToOne) {
 
   // Count number of live transitions after marking.  Note that one transition
   // is left, because 'o' still holds an instance of one transition target.
-  int transitions_after = CountMapTransitions(
-      Map::cast(root->map()->GetBackPointer()));
+  int transitions_after =
+      CountMapTransitions(i_isolate, Map::cast(root->map()->GetBackPointer()));
   CHECK_EQ(2, transitions_after);
 }
 
@@ -2825,6 +2906,7 @@ TEST(TransitionArrayShrinksDuringAllocToOnePropertyFound) {
   FLAG_stress_incremental_marking = false;
   FLAG_allow_natives_syntax = true;
   CcTest::InitializeVM();
+  i::Isolate* i_isolate = CcTest::i_isolate();
   v8::HandleScope scope(CcTest::isolate());
   static const int transitions_count = 10;
   CompileRun("function F() {}");
@@ -2833,7 +2915,7 @@ TEST(TransitionArrayShrinksDuringAllocToOnePropertyFound) {
   Handle<JSObject> root = GetByName("root");
 
   // Count number of live transitions before marking.
-  int transitions_before = CountMapTransitions(root->map());
+  int transitions_before = CountMapTransitions(i_isolate, root->map());
   CHECK_EQ(transitions_count, transitions_before);
 
   root = GetByName("root");
@@ -2842,8 +2924,8 @@ TEST(TransitionArrayShrinksDuringAllocToOnePropertyFound) {
 
   // Count number of live transitions after marking.  Note that one transition
   // is left, because 'o' still holds an instance of one transition target.
-  int transitions_after = CountMapTransitions(
-      Map::cast(root->map()->GetBackPointer()));
+  int transitions_after =
+      CountMapTransitions(i_isolate, Map::cast(root->map()->GetBackPointer()));
   CHECK_EQ(1, transitions_after);
 }
 #endif  // DEBUG
@@ -2947,8 +3029,8 @@ TEST(PrintSharedFunctionInfo) {
       v8::Utils::OpenHandle(*v8::Local<v8::Function>::Cast(
           CcTest::global()->Get(ctx, v8_str("g")).ToLocalChecked())));
 
-  OFStream os(stdout);
-  g->shared()->Print(os);
+  StdoutStream os;
+  g->shared()->Print(g->GetIsolate(), os);
   os << std::endl;
 }
 #endif  // OBJECT_PRINT
@@ -2980,29 +3062,28 @@ TEST(IncrementalMarkingPreservesMonomorphicCallIC) {
       v8::Utils::OpenHandle(*v8::Local<v8::Function>::Cast(
           CcTest::global()->Get(ctx, v8_str("f")).ToLocalChecked())));
 
-  Handle<FeedbackVector> feedback_vector(f->feedback_vector());
+  Handle<FeedbackVector> feedback_vector(f->feedback_vector(), f->GetIsolate());
   FeedbackVectorHelper feedback_helper(feedback_vector);
 
   int expected_slots = 2;
   CHECK_EQ(expected_slots, feedback_helper.slot_count());
   int slot1 = 0;
   int slot2 = 1;
-  CHECK(feedback_vector->Get(feedback_helper.slot(slot1))->IsWeakCell());
-  CHECK(feedback_vector->Get(feedback_helper.slot(slot2))->IsWeakCell());
+  CHECK(feedback_vector->Get(feedback_helper.slot(slot1))->IsWeakHeapObject());
+  CHECK(feedback_vector->Get(feedback_helper.slot(slot2))->IsWeakHeapObject());
 
   heap::SimulateIncrementalMarking(CcTest::heap());
   CcTest::CollectAllGarbage();
 
-  CHECK(!WeakCell::cast(feedback_vector->Get(feedback_helper.slot(slot1)))
-             ->cleared());
-  CHECK(!WeakCell::cast(feedback_vector->Get(feedback_helper.slot(slot2)))
-             ->cleared());
+  feedback_vector->Get(feedback_helper.slot(slot1))->IsWeakHeapObject();
+  feedback_vector->Get(feedback_helper.slot(slot2))->IsWeakHeapObject();
 }
 
 
 static void CheckVectorIC(Handle<JSFunction> f, int slot_index,
                           InlineCacheState desired_state) {
-  Handle<FeedbackVector> vector = Handle<FeedbackVector>(f->feedback_vector());
+  Handle<FeedbackVector> vector =
+      Handle<FeedbackVector>(f->feedback_vector(), f->GetIsolate());
   FeedbackVectorHelper helper(vector);
   FeedbackSlot slot = helper.slot(slot_index);
   FeedbackNexus nexus(vector, slot);
@@ -3024,13 +3105,13 @@ TEST(IncrementalMarkingPreservesMonomorphicConstructor) {
       v8::Utils::OpenHandle(*v8::Local<v8::Function>::Cast(
           CcTest::global()->Get(ctx, v8_str("f")).ToLocalChecked())));
 
-  Handle<FeedbackVector> vector(f->feedback_vector());
-  CHECK(vector->Get(FeedbackSlot(0))->IsWeakCell());
+  Handle<FeedbackVector> vector(f->feedback_vector(), f->GetIsolate());
+  CHECK(vector->Get(FeedbackSlot(0))->IsWeakOrClearedHeapObject());
 
   heap::SimulateIncrementalMarking(CcTest::heap());
   CcTest::CollectAllGarbage();
 
-  CHECK(vector->Get(FeedbackSlot(0))->IsWeakCell());
+  CHECK(vector->Get(FeedbackSlot(0))->IsWeakOrClearedHeapObject());
 }
 
 TEST(IncrementalMarkingPreservesMonomorphicIC) {
@@ -3387,9 +3468,9 @@ TEST(DeferredHandles) {
   Heap* heap = isolate->heap();
   v8::HandleScope scope(reinterpret_cast<v8::Isolate*>(isolate));
   HandleScopeData* data = isolate->handle_scope_data();
-  Handle<Object> init(heap->empty_string(), isolate);
+  Handle<Object> init(ReadOnlyRoots(heap).empty_string(), isolate);
   while (data->next < data->limit) {
-    Handle<Object> obj(heap->empty_string(), isolate);
+    Handle<Object> obj(ReadOnlyRoots(heap).empty_string(), isolate);
   }
   // An entire block of handles has been filled.
   // Next handle would require a new block.
@@ -3457,13 +3538,30 @@ TEST(DisableInlineAllocation) {
 static int AllocationSitesCount(Heap* heap) {
   int count = 0;
   for (Object* site = heap->allocation_sites_list();
-       !(site->IsUndefined(heap->isolate()));
-       site = AllocationSite::cast(site)->weak_next()) {
+       site->IsAllocationSite();) {
+    AllocationSite* cur = AllocationSite::cast(site);
+    CHECK(cur->HasWeakNext());
+    site = cur->weak_next();
     count++;
   }
   return count;
 }
 
+static int SlimAllocationSiteCount(Heap* heap) {
+  int count = 0;
+  for (Object* weak_list = heap->allocation_sites_list();
+       weak_list->IsAllocationSite();) {
+    AllocationSite* weak_cur = AllocationSite::cast(weak_list);
+    for (Object* site = weak_cur->nested_site(); site->IsAllocationSite();) {
+      AllocationSite* cur = AllocationSite::cast(site);
+      CHECK(!cur->HasWeakNext());
+      site = cur->nested_site();
+      count++;
+    }
+    weak_list = weak_cur->weak_next();
+  }
+  return count;
+}
 
 TEST(EnsureAllocationSiteDependentCodesProcessed) {
   if (FLAG_always_opt || !FLAG_opt) return;
@@ -3504,7 +3602,7 @@ TEST(EnsureAllocationSiteDependentCodesProcessed) {
 
     int dependency_group_count = 0;
     DependentCode* dependency = site->dependent_code();
-    while (dependency != heap->empty_fixed_array()) {
+    while (dependency != ReadOnlyRoots(heap).empty_fixed_array()) {
       CHECK(dependency->group() ==
                 DependentCode::kAllocationSiteTransitionChangedGroup ||
             dependency->group() ==
@@ -3533,6 +3631,21 @@ TEST(EnsureAllocationSiteDependentCodesProcessed) {
         WeakCell::cast(site->dependent_code()->object_at(0))->cleared());
 }
 
+void CheckNumberOfAllocations(Heap* heap, const char* source,
+                              int expected_full_alloc,
+                              int expected_slim_alloc) {
+  int prev_fat_alloc_count = AllocationSitesCount(heap);
+  int prev_slim_alloc_count = SlimAllocationSiteCount(heap);
+
+  CompileRun(source);
+
+  int fat_alloc_sites = AllocationSitesCount(heap) - prev_fat_alloc_count;
+  int slim_alloc_sites = SlimAllocationSiteCount(heap) - prev_slim_alloc_count;
+
+  CHECK_EQ(expected_full_alloc, fat_alloc_sites);
+  CHECK_EQ(expected_slim_alloc, slim_alloc_sites);
+}
+
 TEST(AllocationSiteCreation) {
   FLAG_always_opt = false;
   CcTest::InitializeVM();
@@ -3540,90 +3653,54 @@ TEST(AllocationSiteCreation) {
   Heap* heap = isolate->heap();
   HandleScope scope(isolate);
 
-  int prev_count = 0;
-  int count = 0;
-
   // Array literals.
-  prev_count = AllocationSitesCount(heap);
-  CompileRun("(function f1() { return []; })()");
-  count = AllocationSitesCount(heap);
-  CHECK_EQ(1, count - prev_count);
-
-  prev_count = count;
-  CompileRun("(function f2() { return [1, 2]; })()");
-  count = AllocationSitesCount(heap);
-  CHECK_EQ(1, count - prev_count);
-
-  prev_count = count;
-  CompileRun("(function f3() { return [[1], [2]]; })()");
-  count = AllocationSitesCount(heap);
-  CHECK_EQ(3, count - prev_count);
-
-  prev_count = count;
-  CompileRun(
-      "(function f4() { "
-      "return [0, [1, 1.1, 1.2, "
-      "], 1.5, [2.1, 2.2], 3];"
-      "})()");
-  count = AllocationSitesCount(heap);
-  CHECK_EQ(3, count - prev_count);
+  CheckNumberOfAllocations(heap, "(function f1() { return []; })()", 1, 0);
+  CheckNumberOfAllocations(heap, "(function f2() { return [1, 2]; })()", 1, 0);
+  CheckNumberOfAllocations(heap, "(function f3() { return [[1], [2]]; })()", 1,
+                           2);
+
+  CheckNumberOfAllocations(heap,
+                           "(function f4() { "
+                           "return [0, [1, 1.1, 1.2, "
+                           "], 1.5, [2.1, 2.2], 3];"
+                           "})()",
+                           1, 2);
 
   // Object literals have lazy AllocationSites
-  prev_count = AllocationSitesCount(heap);
-  CompileRun("function f5() { return {}; }; f5(); ");
-  count = AllocationSitesCount(heap);
-  CHECK_EQ(0, count - prev_count);
+  CheckNumberOfAllocations(heap, "function f5() { return {}; }; f5(); ", 0, 0);
+
   // No AllocationSites are created for the empty object literal.
   for (int i = 0; i < 5; i++) {
-    prev_count = AllocationSitesCount(heap);
-    CompileRun("f5(); ");
-    count = AllocationSitesCount(heap);
-    CHECK_EQ(0, count - prev_count);
-  }
-
-  prev_count = AllocationSitesCount(heap);
-  CompileRun("function f6() { return {a:1}; }; f6(); ");
-  count = AllocationSitesCount(heap);
-  CHECK_EQ(0, count - prev_count);
-  prev_count = AllocationSitesCount(heap);
-  CompileRun("f6(); ");
-  count = AllocationSitesCount(heap);
-  CHECK_EQ(1, count - prev_count);
-
-  prev_count = AllocationSitesCount(heap);
-  CompileRun("function f7() { return {a:1, b:2}; }; f7(); ");
-  count = AllocationSitesCount(heap);
-  CHECK_EQ(0, count - prev_count);
-  prev_count = AllocationSitesCount(heap);
-  CompileRun("f7(); ");
-  count = AllocationSitesCount(heap);
-  CHECK_EQ(1, count - prev_count);
-
-  prev_count = AllocationSitesCount(heap);
-  CompileRun(
-      "function f8() {"
-      "return {a:{}, b:{ a:2, c:{ d:{f:{}}} } }; "
-      "}; f8(); ");
-  count = AllocationSitesCount(heap);
-  CHECK_EQ(0, count - prev_count);
-  prev_count = AllocationSitesCount(heap);
-  CompileRun("f8(); ");
-  count = AllocationSitesCount(heap);
-  CHECK_EQ(6, count - prev_count);
+    CheckNumberOfAllocations(heap, "f5(); ", 0, 0);
+  }
+
+  CheckNumberOfAllocations(heap, "function f6() { return {a:1}; }; f6(); ", 0,
+                           0);
+
+  CheckNumberOfAllocations(heap, "f6(); ", 1, 0);
+
+  CheckNumberOfAllocations(heap, "function f7() { return {a:1, b:2}; }; f7(); ",
+                           0, 0);
+  CheckNumberOfAllocations(heap, "f7(); ", 1, 0);
+
+  // No Allocation sites are created for object subliterals
+  CheckNumberOfAllocations(heap,
+                           "function f8() {"
+                           "return {a:{}, b:{ a:2, c:{ d:{f:{}}} } }; "
+                           "}; f8(); ",
+                           0, 0);
+  CheckNumberOfAllocations(heap, "f8(); ", 1, 0);
 
   // We currently eagerly create allocation sites if there are sub-arrays.
-  prev_count = AllocationSitesCount(heap);
-  CompileRun(
-      "function f9() {"
-      "return {a:[1, 2, 3], b:{ a:2, c:{ d:{f:[]} } }}; "
-      "}; f9(); ");
-  count = AllocationSitesCount(heap);
-  CHECK_EQ(6, count - prev_count);
-  prev_count = AllocationSitesCount(heap);
-  CompileRun("f9(); ");
-  count = AllocationSitesCount(heap);
+  // Allocation sites are created only for array subliterals
+  CheckNumberOfAllocations(heap,
+                           "function f9() {"
+                           "return {a:[1, 2, 3], b:{ a:2, c:{ d:{f:[]} } }}; "
+                           "}; f9(); ",
+                           1, 2);
+
   // No new AllocationSites created on the second invocation.
-  CHECK_EQ(0, count - prev_count);
+  CheckNumberOfAllocations(heap, "f9(); ", 0, 0);
 }
 
 TEST(CellsInOptimizedCodeAreWeak) {
@@ -3658,7 +3735,7 @@ TEST(CellsInOptimizedCodeAreWeak) {
         *v8::Local<v8::Function>::Cast(CcTest::global()
                                            ->Get(context.local(), v8_str("bar"))
                                            .ToLocalChecked())));
-    code = scope.CloseAndEscape(Handle<Code>(bar->code()));
+    code = scope.CloseAndEscape(Handle<Code>(bar->code(), isolate));
   }
 
   // Now make sure that a gc should get rid of the function
@@ -3700,7 +3777,7 @@ TEST(ObjectsInOptimizedCodeAreWeak) {
         *v8::Local<v8::Function>::Cast(CcTest::global()
                                            ->Get(context.local(), v8_str("bar"))
                                            .ToLocalChecked())));
-    code = scope.CloseAndEscape(Handle<Code>(bar->code()));
+    code = scope.CloseAndEscape(Handle<Code>(bar->code(), isolate));
   }
 
   // Now make sure that a gc should get rid of the function
@@ -3716,14 +3793,13 @@ TEST(NewSpaceObjectsInOptimizedCode) {
   FLAG_allow_natives_syntax = true;
   CcTest::InitializeVM();
   Isolate* isolate = CcTest::i_isolate();
-  v8::internal::Heap* heap = CcTest::heap();
 
   if (!isolate->use_optimizer()) return;
-  HandleScope outer_scope(heap->isolate());
+  HandleScope outer_scope(isolate);
   Handle<Code> code;
   {
     LocalContext context;
-    HandleScope scope(heap->isolate());
+    HandleScope scope(isolate);
 
     CompileRun(
         "var foo;"
@@ -3753,15 +3829,15 @@ TEST(NewSpaceObjectsInOptimizedCode) {
                                            ->Get(context.local(), v8_str("foo"))
                                            .ToLocalChecked())));
 
-    CHECK(heap->InNewSpace(*foo));
+    CHECK(Heap::InNewSpace(*foo));
     CcTest::CollectGarbage(NEW_SPACE);
     CcTest::CollectGarbage(NEW_SPACE);
-    CHECK(!heap->InNewSpace(*foo));
+    CHECK(!Heap::InNewSpace(*foo));
 #ifdef VERIFY_HEAP
-    heap->Verify();
+    CcTest::heap()->Verify();
 #endif
     CHECK(!bar->code()->marked_for_deoptimization());
-    code = scope.CloseAndEscape(Handle<Code>(bar->code()));
+    code = scope.CloseAndEscape(Handle<Code>(bar->code(), isolate));
   }
 
   // Now make sure that a gc should get rid of the function
@@ -3821,7 +3897,7 @@ TEST(NextCodeLinkIsWeak) {
     CHECK_EQ(immortal->code()->next_code_link(), mortal->code());
     code_chain_length_before = GetCodeChainLength(immortal->code());
     // Keep the immortal code and let the mortal code die.
-    code = scope.CloseAndEscape(Handle<Code>(immortal->code()));
+    code = scope.CloseAndEscape(Handle<Code>(immortal->code(), isolate));
     CompileRun("mortal = null; immortal = null;");
   }
   CcTest::CollectAllAvailableGarbage();
@@ -3847,8 +3923,8 @@ TEST(NextCodeLinkInCodeDataContainerIsCleared) {
     Handle<JSFunction> mortal2 =
         OptimizeDummyFunction(CcTest::isolate(), "mortal2");
     CHECK_EQ(mortal2->code()->next_code_link(), mortal1->code());
-    code_data_container = scope.CloseAndEscape(
-        Handle<CodeDataContainer>(mortal2->code()->code_data_container()));
+    code_data_container = scope.CloseAndEscape(Handle<CodeDataContainer>(
+        mortal2->code()->code_data_container(), isolate));
     CompileRun("mortal1 = null; mortal2 = null;");
   }
   CcTest::CollectAllAvailableGarbage();
@@ -3864,9 +3940,8 @@ static Handle<Code> DummyOptimizedCode(Isolate* isolate) {
   masm.Push(isolate->factory()->undefined_value());
   masm.Drop(2);
   masm.GetCode(isolate, &desc);
-  Handle<Object> undefined(isolate->heap()->undefined_value(), isolate);
-  Handle<Code> code =
-      isolate->factory()->NewCode(desc, Code::OPTIMIZED_FUNCTION, undefined);
+  Handle<Code> code = isolate->factory()->NewCode(
+      desc, Code::OPTIMIZED_FUNCTION, masm.CodeObject());
   CHECK(code->IsCode());
   return code;
 }
@@ -3953,19 +4028,19 @@ TEST(WeakFunctionInConstructor) {
   Handle<FeedbackVector> feedback_vector =
       Handle<FeedbackVector>(createObj->feedback_vector(), CcTest::i_isolate());
   for (int i = 0; i < 20; i++) {
-    Object* slot_value = feedback_vector->Get(FeedbackSlot(0));
-    CHECK(slot_value->IsWeakCell());
-    if (WeakCell::cast(slot_value)->cleared()) break;
+    MaybeObject* slot_value = feedback_vector->Get(FeedbackSlot(0));
+    CHECK(slot_value->IsWeakOrClearedHeapObject());
+    if (slot_value->IsClearedWeakHeapObject()) break;
     CcTest::CollectAllGarbage();
   }
 
-  Object* slot_value = feedback_vector->Get(FeedbackSlot(0));
-  CHECK(slot_value->IsWeakCell() && WeakCell::cast(slot_value)->cleared());
+  MaybeObject* slot_value = feedback_vector->Get(FeedbackSlot(0));
+  CHECK(slot_value->IsClearedWeakHeapObject());
   CompileRun(
       "function coat() { this.x = 6; }"
       "createObj(coat);");
   slot_value = feedback_vector->Get(FeedbackSlot(0));
-  CHECK(slot_value->IsWeakCell() && !WeakCell::cast(slot_value)->cleared());
+  CHECK(slot_value->IsWeakHeapObject());
 }
 
 
@@ -4444,15 +4519,14 @@ TEST(Regress507979) {
   const int kFixedArrayLen = 10;
   CcTest::InitializeVM();
   Isolate* isolate = CcTest::i_isolate();
-  Heap* heap = isolate->heap();
   HandleScope handle_scope(isolate);
 
   Handle<FixedArray> o1 = isolate->factory()->NewFixedArray(kFixedArrayLen);
   Handle<FixedArray> o2 = isolate->factory()->NewFixedArray(kFixedArrayLen);
-  CHECK(heap->InNewSpace(*o1));
-  CHECK(heap->InNewSpace(*o2));
+  CHECK(Heap::InNewSpace(*o1));
+  CHECK(Heap::InNewSpace(*o2));
 
-  HeapIterator it(heap, i::HeapIterator::kFilterUnreachable);
+  HeapIterator it(isolate->heap(), i::HeapIterator::kFilterUnreachable);
 
   // Replace parts of an object placed before a live object with a filler. This
   // way the filler object shares the mark bits with the following live object.
@@ -4460,7 +4534,7 @@ TEST(Regress507979) {
 
   for (HeapObject* obj = it.next(); obj != nullptr; obj = it.next()) {
     // Let's not optimize the loop away.
-    CHECK_NOT_NULL(obj->address());
+    CHECK_NE(obj->address(), kNullAddress);
   }
 }
 
@@ -4478,8 +4552,9 @@ TEST(Regress388880) {
   Handle<String> name = factory->NewStringFromStaticChars("foo");
   name = factory->InternalizeString(name);
   Handle<Map> map2 =
-      Map::CopyWithField(map1, name, FieldType::Any(isolate), NONE, kMutable,
-                         Representation::Tagged(), OMIT_TRANSITION)
+      Map::CopyWithField(isolate, map1, name, FieldType::Any(isolate), NONE,
+                         PropertyConstness::kMutable, Representation::Tagged(),
+                         OMIT_TRANSITION)
           .ToHandleChecked();
 
   size_t desired_offset = Page::kPageSize - map1->instance_size();
@@ -4537,7 +4612,8 @@ TEST(Regress3631) {
   // Incrementally mark the backing store.
   Handle<JSReceiver> obj =
       v8::Utils::OpenHandle(*v8::Local<v8::Object>::Cast(result));
-  Handle<JSWeakCollection> weak_map(reinterpret_cast<JSWeakCollection*>(*obj));
+  Handle<JSWeakCollection> weak_map(reinterpret_cast<JSWeakCollection*>(*obj),
+                                    isolate);
   HeapObject* weak_map_table = HeapObject::cast(weak_map->table());
   IncrementalMarking::MarkingState* marking_state = marking->marking_state();
   while (!marking_state->IsBlack(weak_map_table) && !marking->IsStopped()) {
@@ -4562,8 +4638,8 @@ TEST(Regress442710) {
   Factory* factory = isolate->factory();
 
   HandleScope sc(isolate);
-  Handle<JSGlobalObject> global(
-      CcTest::i_isolate()->context()->global_object());
+  Handle<JSGlobalObject> global(CcTest::i_isolate()->context()->global_object(),
+                                isolate);
   Handle<JSArray> array = factory->NewJSArray(2);
 
   Handle<String> name = factory->InternalizeUtf8String("testArray");
@@ -4616,17 +4692,18 @@ TEST(Regress3877) {
   CHECK(weak_prototype->cleared());
 }
 
-
-Handle<WeakCell> AddRetainedMap(Isolate* isolate, Heap* heap) {
-    HandleScope inner_scope(isolate);
-    Handle<Map> map = Map::Create(isolate, 1);
-    v8::Local<v8::Value> result =
-        CompileRun("(function () { return {x : 10}; })();");
-    Handle<JSReceiver> proto =
-        v8::Utils::OpenHandle(*v8::Local<v8::Object>::Cast(result));
-    Map::SetPrototype(map, proto);
-    heap->AddRetainedMap(map);
-    return inner_scope.CloseAndEscape(Map::WeakCellForMap(map));
+Handle<WeakFixedArray> AddRetainedMap(Isolate* isolate, Heap* heap) {
+  HandleScope inner_scope(isolate);
+  Handle<Map> map = Map::Create(isolate, 1);
+  v8::Local<v8::Value> result =
+      CompileRun("(function () { return {x : 10}; })();");
+  Handle<JSReceiver> proto =
+      v8::Utils::OpenHandle(*v8::Local<v8::Object>::Cast(result));
+  Map::SetPrototype(isolate, map, proto);
+  heap->AddRetainedMap(map);
+  Handle<WeakFixedArray> array = isolate->factory()->NewWeakFixedArray(1);
+  array->Set(0, HeapObjectReference::Weak(*map));
+  return inner_scope.CloseAndEscape(array);
 }
 
 
@@ -4634,16 +4711,16 @@ void CheckMapRetainingFor(int n) {
   FLAG_retain_maps_for_n_gc = n;
   Isolate* isolate = CcTest::i_isolate();
   Heap* heap = isolate->heap();
-  Handle<WeakCell> weak_cell = AddRetainedMap(isolate, heap);
-  CHECK(!weak_cell->cleared());
+  Handle<WeakFixedArray> array_with_map = AddRetainedMap(isolate, heap);
+  CHECK(array_with_map->Get(0)->IsWeakHeapObject());
   for (int i = 0; i < n; i++) {
     heap::SimulateIncrementalMarking(heap);
     CcTest::CollectGarbage(OLD_SPACE);
   }
-  CHECK(!weak_cell->cleared());
+  CHECK(array_with_map->Get(0)->IsWeakHeapObject());
   heap::SimulateIncrementalMarking(heap);
   CcTest::CollectGarbage(OLD_SPACE);
-  CHECK(weak_cell->cleared());
+  CHECK(array_with_map->Get(0)->IsClearedWeakHeapObject());
 }
 
 
@@ -4671,13 +4748,14 @@ TEST(WritableVsImmortalRoots) {
 TEST(FixedArrayOfWeakCells) {
   CcTest::InitializeVM();
   v8::HandleScope scope(CcTest::isolate());
+  Isolate* isolate = CcTest::i_isolate();
 
-  Handle<HeapNumber> number = CcTest::i_isolate()->factory()->NewHeapNumber(1);
+  Handle<HeapNumber> number = isolate->factory()->NewHeapNumber(1);
   Handle<FixedArrayOfWeakCells> array =
-      FixedArrayOfWeakCells::Add(Handle<Object>(), number);
+      FixedArrayOfWeakCells::Add(isolate, Handle<Object>(), number);
   array->Remove(number);
   array->Compact<FixedArrayOfWeakCells::NullCallback>();
-  FixedArrayOfWeakCells::Add(array, number);
+  FixedArrayOfWeakCells::Add(isolate, array, number);
 }
 
 
@@ -4798,7 +4876,7 @@ void AllocateInSpace(Isolate* isolate, size_t bytes, AllocationSpace space) {
       static_cast<int>((bytes - FixedArray::kHeaderSize) / kPointerSize);
   Handle<FixedArray> array = factory->NewFixedArray(
       elements, space == NEW_SPACE ? NOT_TENURED : TENURED);
-  CHECK((space == NEW_SPACE) == isolate->heap()->InNewSpace(*array));
+  CHECK((space == NEW_SPACE) == Heap::InNewSpace(*array));
   CHECK_EQ(bytes, static_cast<size_t>(array->Size()));
 }
 
@@ -4921,7 +4999,8 @@ static void RemoveCodeAndGC(const v8::FunctionCallbackInfo<v8::Value>& args) {
   Isolate* isolate = CcTest::i_isolate();
   Handle<Object> obj = v8::Utils::OpenHandle(*args[0]);
   Handle<JSFunction> fun = Handle<JSFunction>::cast(obj);
-  fun->shared()->FlushCompiled();  // Bytecode is code too.
+  // Bytecode is code too.
+  SharedFunctionInfo::DiscardCompiled(isolate, handle(fun->shared(), isolate));
   fun->set_code(*BUILTIN_CODE(isolate, CompileLazy));
   CcTest::CollectAllAvailableGarbage();
 }
@@ -5020,7 +5099,8 @@ AllocationResult HeapTester::AllocateByteArrayForTest(Heap* heap, int length,
     if (!allocation.To(&result)) return allocation;
   }
 
-  result->set_map_after_allocation(heap->byte_array_map(), SKIP_WRITE_BARRIER);
+  result->set_map_after_allocation(ReadOnlyRoots(heap).byte_array_map(),
+                                   SKIP_WRITE_BARRIER);
   ByteArray::cast(result)->set_length(length);
   ByteArray::cast(result)->clear_padding();
   return result;
@@ -5041,7 +5121,7 @@ HEAP_TEST(Regress587004) {
   Handle<FixedArray> array = factory->NewFixedArray(N, TENURED);
   CHECK(heap->old_space()->Contains(*array));
   Handle<Object> number = factory->NewHeapNumber(1.0);
-  CHECK(heap->InNewSpace(*number));
+  CHECK(Heap::InNewSpace(*number));
   for (int i = 0; i < N; i++) {
     array->set(i, *number);
   }
@@ -5086,7 +5166,7 @@ HEAP_TEST(Regress589413) {
       byte_array->set(j, 0x31);
     }
     // Add the array in root set.
-    handle(byte_array);
+    handle(byte_array, isolate);
   }
   // Make sure the byte arrays will be promoted on the next GC.
   CcTest::CollectGarbage(NEW_SPACE);
@@ -5102,7 +5182,7 @@ HEAP_TEST(Regress589413) {
       arrays.push_back(array);
       pages.insert(Page::FromAddress(array->address()));
       // Add the array in root set.
-      handle(array);
+      handle(array, isolate);
     }
     // Expand and full one complete page with fixed arrays.
     heap->set_force_oom(false);
@@ -5110,7 +5190,7 @@ HEAP_TEST(Regress589413) {
       arrays.push_back(array);
       pages.insert(Page::FromAddress(array->address()));
       // Add the array in root set.
-      handle(array);
+      handle(array, isolate);
       // Do not expand anymore.
       heap->set_force_oom(true);
     }
@@ -5221,7 +5301,7 @@ TEST(Regress598319) {
         // bar, meaning that we will miss marking it.
         v8::HandleScope scope(CcTest::isolate());
         Handle<JSArray> js_array = isolate->factory()->NewJSArrayWithElements(
-            Handle<FixedArray>(arr.get()));
+            Handle<FixedArray>(arr.get(), isolate));
         js_array->GetElementsAccessor()->Shift(js_array);
       }
       break;
@@ -5384,6 +5464,8 @@ TEST(Regress631969) {
     StaticOneByteResource external_string("12345678901234");
     s3->MakeExternal(&external_string);
     CcTest::CollectGarbage(OLD_SPACE);
+    // This avoids the GC from trying to free stack allocated resources.
+    i::Handle<i::ExternalOneByteString>::cast(s3)->set_resource(nullptr);
   }
 }
 
@@ -5500,7 +5582,7 @@ TEST(ContinuousRightTrimFixedArrayInBlackArea) {
   CcTest::InitializeVM();
   v8::HandleScope scope(CcTest::isolate());
   Heap* heap = CcTest::heap();
-  Isolate* isolate = heap->isolate();
+  Isolate* isolate = CcTest::i_isolate();
   CcTest::CollectAllGarbage();
 
   i::MarkCompactCollector* collector = heap->mark_compact_collector();
@@ -5522,7 +5604,8 @@ TEST(ContinuousRightTrimFixedArrayInBlackArea) {
   isolate->factory()->NewFixedArray(10, TENURED);
 
   // Allocate the fixed array that will be trimmed later.
-  Handle<FixedArray> array = isolate->factory()->NewFixedArray(100, TENURED);
+  Handle<FixedArray> array =
+      CcTest::i_isolate()->factory()->NewFixedArray(100, TENURED);
   Address start_address = array->address();
   Address end_address = start_address + array->Size();
   Page* page = Page::FromAddress(start_address);
@@ -5536,7 +5619,8 @@ TEST(ContinuousRightTrimFixedArrayInBlackArea) {
 
   // Trim it once by one word to make checking for white marking color uniform.
   Address previous = end_address - kPointerSize;
-  heap->RightTrimFixedArray(*array, 1);
+  isolate->heap()->RightTrimFixedArray(*array, 1);
+
   HeapObject* filler = HeapObject::FromAddress(previous);
   CHECK(filler->IsFiller());
   CHECK(marking_state->IsImpossible(filler));
@@ -5545,7 +5629,7 @@ TEST(ContinuousRightTrimFixedArrayInBlackArea) {
   for (int i = 1; i <= 3; i++) {
     for (int j = 0; j < 10; j++) {
       previous -= kPointerSize * i;
-      heap->RightTrimFixedArray(*array, i);
+      isolate->heap()->RightTrimFixedArray(*array, i);
       HeapObject* filler = HeapObject::FromAddress(previous);
       CHECK(filler->IsFiller());
       CHECK(marking_state->IsWhite(filler));
@@ -5574,6 +5658,24 @@ TEST(Regress618958) {
          !heap->incremental_marking()->IsStopped()));
 }
 
+TEST(YoungGenerationLargeObjectAllocation) {
+  FLAG_young_generation_large_objects = true;
+  CcTest::InitializeVM();
+  v8::HandleScope scope(CcTest::isolate());
+  Heap* heap = CcTest::heap();
+  Isolate* isolate = heap->isolate();
+
+  Handle<FixedArray> array = isolate->factory()->NewFixedArray(200000);
+  MemoryChunk* chunk = MemoryChunk::FromAddress(array->address());
+  CHECK(chunk->owner()->identity() == LO_SPACE);
+  CHECK(!chunk->IsFlagSet(MemoryChunk::IN_TO_SPACE));
+
+  Handle<FixedArray> array_small = isolate->factory()->NewFixedArray(20000);
+  chunk = MemoryChunk::FromAddress(array_small->address());
+  CHECK(chunk->owner()->identity() == NEW_LO_SPACE);
+  CHECK(chunk->IsFlagSet(MemoryChunk::IN_TO_SPACE));
+}
+
 TEST(UncommitUnusedLargeObjectMemory) {
   CcTest::InitializeVM();
   v8::HandleScope scope(CcTest::isolate());
@@ -5707,7 +5809,7 @@ HEAP_TEST(Regress670675) {
 
 namespace {
 Handle<Code> GenerateDummyImmovableCode(Isolate* isolate) {
-  Assembler assm(isolate, nullptr, 256);
+  Assembler assm(AssemblerOptions{}, nullptr, 0);
 
   const int kNumberOfNops = 1 << 10;
   for (int i = 0; i < kNumberOfNops; i++) {
@@ -5758,7 +5860,7 @@ HEAP_TEST(Regress5831) {
   // Generate the code.
   Handle<Code> code = GenerateDummyImmovableCode(isolate);
   CHECK_GE(i::kMaxRegularHeapObjectSize, code->Size());
-  CHECK(!heap->code_space()->FirstPage()->Contains(code->address()));
+  CHECK(!heap->code_space()->first_page()->Contains(code->address()));
 
   // Ensure it's not in large object space.
   MemoryChunk* chunk = MemoryChunk::FromAddress(code->address());
@@ -5781,7 +5883,7 @@ TEST(Regress6800) {
       root->set(i, *new_space_array);
     }
     for (int i = 0; i < kRootLength; i++) {
-      root->set(i, CcTest::heap()->undefined_value());
+      root->set(i, ReadOnlyRoots(CcTest::heap()).undefined_value());
     }
   }
   CcTest::CollectGarbage(NEW_SPACE);
@@ -5805,7 +5907,7 @@ TEST(Regress6800LargeObject) {
       root->set(i, *new_space_array);
     }
     for (int i = 0; i < kRootLength; i++) {
-      root->set(i, CcTest::heap()->undefined_value());
+      root->set(i, ReadOnlyRoots(CcTest::heap()).undefined_value());
     }
   }
   CcTest::CollectGarbage(OLD_SPACE);
@@ -5917,7 +6019,7 @@ UNINITIALIZED_TEST(OutOfMemoryIneffectiveGC) {
   heap->CollectAllGarbage(Heap::kNoGCFlags, GarbageCollectionReason::kTesting);
   {
     HandleScope scope(i_isolate);
-    while (heap->PromotedSpaceSizeOfObjects() <
+    while (heap->OldGenerationSizeOfObjects() <
            heap->MaxOldGenerationSize() * 0.9) {
       factory->NewFixedArray(100, TENURED);
     }
@@ -5955,7 +6057,7 @@ HEAP_TEST(Regress779503) {
     // The byte array filled with kHeapObjectTag ensures that we cannot read
     // from the slot again and interpret it as heap value. Doing so will crash.
     Handle<ByteArray> byte_array = isolate->factory()->NewByteArray(kArraySize);
-    CHECK(heap->InNewSpace(*byte_array));
+    CHECK(Heap::InNewSpace(*byte_array));
     for (int i = 0; i < kArraySize; i++) {
       byte_array->set(i, kHeapObjectTag);
     }
@@ -5965,21 +6067,21 @@ HEAP_TEST(Regress779503) {
       // The FixedArray in old space serves as space for slots.
       Handle<FixedArray> fixed_array =
           isolate->factory()->NewFixedArray(kArraySize, TENURED);
-      CHECK(!heap->InNewSpace(*fixed_array));
+      CHECK(!Heap::InNewSpace(*fixed_array));
       for (int i = 0; i < kArraySize; i++) {
         fixed_array->set(i, *byte_array);
       }
     }
     // Delay sweeper tasks to allow the scavenger to sweep the page it is
     // currently scavenging.
-    CcTest::heap()->delay_sweeper_tasks_for_testing_ = true;
+    heap->delay_sweeper_tasks_for_testing_ = true;
     CcTest::CollectGarbage(OLD_SPACE);
-    CHECK(heap->InNewSpace(*byte_array));
+    CHECK(Heap::InNewSpace(*byte_array));
   }
   // Scavenging and sweeping the same page will crash as slots will be
   // overridden.
   CcTest::CollectGarbage(NEW_SPACE);
-  CcTest::heap()->delay_sweeper_tasks_for_testing_ = false;
+  heap->delay_sweeper_tasks_for_testing_ = false;
 }
 
 struct OutOfMemoryState {
@@ -6078,6 +6180,11 @@ UNINITIALIZED_TEST(OutOfMemoryLargeObjects) {
   reinterpret_cast<v8::Isolate*>(isolate)->Dispose();
 }
 
+void HeapTester::UncommitFromSpace(Heap* heap) {
+  heap->UncommitFromSpace();
+  heap->memory_allocator()->unmapper()->EnsureUnmappingCompleted();
+}
+
 }  // namespace heap
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/test/cctest/heap/test-lab.cc b/deps/v8/test/cctest/heap/test-lab.cc
index f8ef6f5250ffe4..42a3eec04c61ae 100644
--- a/deps/v8/test/cctest/heap/test-lab.cc
+++ b/deps/v8/test/cctest/heap/test-lab.cc
@@ -25,7 +25,7 @@ static Address AllocateLabBackingStore(Heap* heap, intptr_t size_in_bytes) {
 static void VerifyIterable(v8::internal::Address base,
                            v8::internal::Address limit,
                            std::vector<intptr_t> expected_size) {
-  CHECK_LE(reinterpret_cast<intptr_t>(base), reinterpret_cast<intptr_t>(limit));
+  CHECK_LE(base, limit);
   HeapObject* object = nullptr;
   size_t counter = 0;
   while (base < limit) {
diff --git a/deps/v8/test/cctest/heap/test-mark-compact.cc b/deps/v8/test/cctest/heap/test-mark-compact.cc
index 7de33a7a1c67f3..0891264669bd51 100644
--- a/deps/v8/test/cctest/heap/test-mark-compact.cc
+++ b/deps/v8/test/cctest/heap/test-mark-compact.cc
@@ -103,7 +103,8 @@ AllocationResult HeapTester::AllocateMapForTest(Isolate* isolate) {
   HeapObject* obj;
   AllocationResult alloc = heap->AllocateRaw(Map::kSize, MAP_SPACE);
   if (!alloc.To(&obj)) return alloc;
-  obj->set_map_after_allocation(heap->meta_map(), SKIP_WRITE_BARRIER);
+  obj->set_map_after_allocation(ReadOnlyRoots(heap).meta_map(),
+                                SKIP_WRITE_BARRIER);
   return isolate->factory()->InitializeMap(Map::cast(obj), JS_OBJECT_TYPE,
                                            JSObject::kHeaderSize,
                                            TERMINAL_FAST_ELEMENTS_KIND, 0);
@@ -121,10 +122,12 @@ AllocationResult HeapTester::AllocateFixedArrayForTest(
     AllocationResult result = heap->AllocateRaw(size, space);
     if (!result.To(&obj)) return result;
   }
-  obj->set_map_after_allocation(heap->fixed_array_map(), SKIP_WRITE_BARRIER);
+  obj->set_map_after_allocation(ReadOnlyRoots(heap).fixed_array_map(),
+                                SKIP_WRITE_BARRIER);
   FixedArray* array = FixedArray::cast(obj);
   array->set_length(length);
-  MemsetPointer(array->data_start(), heap->undefined_value(), length);
+  MemsetPointer(array->data_start(), ReadOnlyRoots(heap).undefined_value(),
+                length);
   return array;
 }
 
@@ -137,7 +140,7 @@ HEAP_TEST(MarkCompactCollector) {
   Factory* factory = isolate->factory();
 
   v8::HandleScope sc(CcTest::isolate());
-  Handle<JSGlobalObject> global(isolate->context()->global_object());
+  Handle<JSGlobalObject> global(isolate->context()->global_object(), isolate);
 
   // call mark-compact when heap is empty
   CcTest::CollectGarbage(OLD_SPACE);
diff --git a/deps/v8/test/cctest/heap/test-page-promotion.cc b/deps/v8/test/cctest/heap/test-page-promotion.cc
index d7f99a7cb27928..97f50203f75098 100644
--- a/deps/v8/test/cctest/heap/test-page-promotion.cc
+++ b/deps/v8/test/cctest/heap/test-page-promotion.cc
@@ -160,6 +160,49 @@ UNINITIALIZED_TEST(PagePromotion_NewToNewJSArrayBuffer) {
   isolate->Dispose();
 }
 
+UNINITIALIZED_TEST(PagePromotion_NewToOldJSArrayBuffer) {
+  if (!i::FLAG_page_promotion) return;
+
+  // Test makes sure JSArrayBuffer backing stores are still tracked after
+  // new-to-old promotion.
+  v8::Isolate* isolate = NewIsolateForPagePromotion();
+  Isolate* i_isolate = reinterpret_cast<Isolate*>(isolate);
+  {
+    v8::Isolate::Scope isolate_scope(isolate);
+    v8::HandleScope handle_scope(isolate);
+    v8::Context::New(isolate)->Enter();
+    Heap* heap = i_isolate->heap();
+
+    // Fill the current page which potentially contains the age mark.
+    heap::FillCurrentPage(heap->new_space());
+    // Allocate a buffer we would like to check against.
+    Handle<JSArrayBuffer> buffer =
+        i_isolate->factory()->NewJSArrayBuffer(SharedFlag::kNotShared);
+    CHECK(JSArrayBuffer::SetupAllocatingData(buffer, i_isolate, 100));
+    std::vector<Handle<FixedArray>> handles;
+    // Simulate a full space, filling the interesting page with live objects.
+    heap::SimulateFullSpace(heap->new_space(), &handles);
+    CHECK_GT(handles.size(), 0u);
+    // First object in handles should be on the same page as the allocated
+    // JSArrayBuffer.
+    Handle<FixedArray> first_object = handles.front();
+    Page* to_be_promoted_page = Page::FromAddress(first_object->address());
+    CHECK(!to_be_promoted_page->Contains(heap->new_space()->age_mark()));
+    CHECK(to_be_promoted_page->Contains(first_object->address()));
+    CHECK(to_be_promoted_page->Contains(buffer->address()));
+    CHECK(heap->new_space()->ToSpaceContainsSlow(first_object->address()));
+    CHECK(heap->new_space()->ToSpaceContainsSlow(buffer->address()));
+    heap::GcAndSweep(heap, OLD_SPACE);
+    heap::GcAndSweep(heap, OLD_SPACE);
+    CHECK(heap->old_space()->ContainsSlow(first_object->address()));
+    CHECK(heap->old_space()->ContainsSlow(buffer->address()));
+    CHECK(to_be_promoted_page->Contains(first_object->address()));
+    CHECK(to_be_promoted_page->Contains(buffer->address()));
+    CHECK(ArrayBufferTracker::IsTracked(*buffer));
+  }
+  isolate->Dispose();
+}
+
 UNINITIALIZED_HEAP_TEST(Regress658718) {
   if (!i::FLAG_page_promotion) return;
 
@@ -190,7 +233,7 @@ UNINITIALIZED_HEAP_TEST(Regress658718) {
     }
     heap->CollectGarbage(NEW_SPACE, i::GarbageCollectionReason::kTesting);
     heap->new_space()->Shrink();
-    heap->memory_allocator()->unmapper()->WaitUntilCompleted();
+    heap->memory_allocator()->unmapper()->EnsureUnmappingCompleted();
     heap->delay_sweeper_tasks_for_testing_ = false;
     heap->mark_compact_collector()->sweeper()->StartSweeperTasks();
     heap->mark_compact_collector()->EnsureSweepingCompleted();
diff --git a/deps/v8/test/cctest/heap/test-spaces.cc b/deps/v8/test/cctest/heap/test-spaces.cc
index d0ed583127d4a4..b930361eb9e332 100644
--- a/deps/v8/test/cctest/heap/test-spaces.cc
+++ b/deps/v8/test/cctest/heap/test-spaces.cc
@@ -84,8 +84,8 @@ static void VerifyMemoryChunk(Isolate* isolate, Heap* heap,
                               CodeRange* code_range, size_t reserve_area_size,
                               size_t commit_area_size, Executability executable,
                               Space* space) {
-  MemoryAllocator* memory_allocator = new MemoryAllocator(isolate);
-  CHECK(memory_allocator->SetUp(heap->MaxReserved(), 0));
+  MemoryAllocator* memory_allocator =
+      new MemoryAllocator(isolate, heap->MaxReserved(), 0);
   {
     TestMemoryAllocatorScope test_allocator_scope(isolate, memory_allocator);
     TestCodeRangeScope test_code_range_scope(isolate, code_range);
@@ -122,15 +122,12 @@ static void VerifyMemoryChunk(Isolate* isolate, Heap* heap,
 TEST(Regress3540) {
   Isolate* isolate = CcTest::i_isolate();
   Heap* heap = isolate->heap();
-  MemoryAllocator* memory_allocator = new MemoryAllocator(isolate);
-  CHECK(memory_allocator->SetUp(heap->MaxReserved(), 0));
+  MemoryAllocator* memory_allocator =
+      new MemoryAllocator(isolate, heap->MaxReserved(), 0);
   TestMemoryAllocatorScope test_allocator_scope(isolate, memory_allocator);
-  CodeRange* code_range = new CodeRange(isolate);
   size_t code_range_size =
       kMinimumCodeRangeSize > 0 ? kMinimumCodeRangeSize : 3 * Page::kPageSize;
-  if (!code_range->SetUp(code_range_size)) {
-    return;
-  }
+  CodeRange* code_range = new CodeRange(isolate, code_range_size);
 
   Address address;
   size_t size;
@@ -138,7 +135,7 @@ TEST(Regress3540) {
   address = code_range->AllocateRawMemory(
       request_size, request_size - (2 * MemoryAllocator::CodePageGuardSize()),
       &size);
-  CHECK_NOT_NULL(address);
+  CHECK_NE(address, kNullAddress);
 
   Address null_address;
   size_t null_size;
@@ -146,7 +143,7 @@ TEST(Regress3540) {
   null_address = code_range->AllocateRawMemory(
       request_size, request_size - (2 * MemoryAllocator::CodePageGuardSize()),
       &null_size);
-  CHECK_NULL(null_address);
+  CHECK_EQ(null_address, kNullAddress);
 
   code_range->FreeRawMemory(address, size);
   delete code_range;
@@ -169,23 +166,13 @@ TEST(MemoryChunk) {
   size_t initial_commit_area_size;
 
   for (int i = 0; i < 100; i++) {
-    initial_commit_area_size = PseudorandomAreaSize();
+    initial_commit_area_size =
+        RoundUp(PseudorandomAreaSize(), CommitPageSize());
 
     // With CodeRange.
-    CodeRange* code_range = new CodeRange(isolate);
     const size_t code_range_size = 32 * MB;
-    if (!code_range->SetUp(code_range_size)) return;
-
-    VerifyMemoryChunk(isolate, heap, code_range, reserve_area_size,
-                      initial_commit_area_size, EXECUTABLE, heap->code_space());
-
-    VerifyMemoryChunk(isolate, heap, code_range, reserve_area_size,
-                      initial_commit_area_size, NOT_EXECUTABLE,
-                      heap->old_space());
-    delete code_range;
+    CodeRange* code_range = new CodeRange(isolate, code_range_size);
 
-    // Without a valid CodeRange, i.e., omitting SetUp.
-    code_range = new CodeRange(isolate);
     VerifyMemoryChunk(isolate, heap, code_range, reserve_area_size,
                       initial_commit_area_size, EXECUTABLE, heap->code_space());
 
@@ -201,23 +188,25 @@ TEST(MemoryAllocator) {
   Isolate* isolate = CcTest::i_isolate();
   Heap* heap = isolate->heap();
 
-  MemoryAllocator* memory_allocator = new MemoryAllocator(isolate);
+  MemoryAllocator* memory_allocator =
+      new MemoryAllocator(isolate, heap->MaxReserved(), 0);
   CHECK_NOT_NULL(memory_allocator);
-  CHECK(memory_allocator->SetUp(heap->MaxReserved(), 0));
   TestMemoryAllocatorScope test_scope(isolate, memory_allocator);
 
   {
     int total_pages = 0;
-    OldSpace faked_space(heap, OLD_SPACE, NOT_EXECUTABLE);
+    OldSpace faked_space(heap);
+    CHECK(!faked_space.first_page());
+    CHECK(!faked_space.last_page());
     Page* first_page = memory_allocator->AllocatePage(
         faked_space.AreaSize(), static_cast<PagedSpace*>(&faked_space),
         NOT_EXECUTABLE);
 
-    first_page->InsertAfter(faked_space.anchor()->prev_page());
-    CHECK(first_page->next_page() == faked_space.anchor());
+    faked_space.memory_chunk_list().PushBack(first_page);
+    CHECK(first_page->next_page() == nullptr);
     total_pages++;
 
-    for (Page* p = first_page; p != faked_space.anchor(); p = p->next_page()) {
+    for (Page* p = first_page; p != nullptr; p = p->next_page()) {
       CHECK(p->owner() == &faked_space);
     }
 
@@ -226,9 +215,9 @@ TEST(MemoryAllocator) {
         faked_space.AreaSize(), static_cast<PagedSpace*>(&faked_space),
         NOT_EXECUTABLE);
     total_pages++;
-    other->InsertAfter(first_page);
+    faked_space.memory_chunk_list().PushBack(other);
     int page_count = 0;
-    for (Page* p = first_page; p != faked_space.anchor(); p = p->next_page()) {
+    for (Page* p = first_page; p != nullptr; p = p->next_page()) {
       CHECK(p->owner() == &faked_space);
       page_count++;
     }
@@ -247,15 +236,13 @@ TEST(MemoryAllocator) {
 TEST(NewSpace) {
   Isolate* isolate = CcTest::i_isolate();
   Heap* heap = isolate->heap();
-  MemoryAllocator* memory_allocator = new MemoryAllocator(isolate);
-  CHECK(memory_allocator->SetUp(heap->MaxReserved(), 0));
+  MemoryAllocator* memory_allocator =
+      new MemoryAllocator(isolate, heap->MaxReserved(), 0);
   TestMemoryAllocatorScope test_scope(isolate, memory_allocator);
 
-  NewSpace new_space(heap);
-
-  CHECK(new_space.SetUp(CcTest::heap()->InitialSemiSpaceSize(),
-                        CcTest::heap()->InitialSemiSpaceSize()));
-  CHECK(new_space.HasBeenSetUp());
+  NewSpace new_space(heap, CcTest::heap()->InitialSemiSpaceSize(),
+                     CcTest::heap()->InitialSemiSpaceSize());
+  CHECK(new_space.MaximumCapacity());
 
   while (new_space.Available() >= kMaxRegularHeapObjectSize) {
     CHECK(new_space.Contains(
@@ -264,7 +251,7 @@ TEST(NewSpace) {
   }
 
   new_space.TearDown();
-  memory_allocator->unmapper()->WaitUntilCompleted();
+  memory_allocator->unmapper()->EnsureUnmappingCompleted();
   memory_allocator->TearDown();
   delete memory_allocator;
 }
@@ -273,15 +260,13 @@ TEST(NewSpace) {
 TEST(OldSpace) {
   Isolate* isolate = CcTest::i_isolate();
   Heap* heap = isolate->heap();
-  MemoryAllocator* memory_allocator = new MemoryAllocator(isolate);
-  CHECK(memory_allocator->SetUp(heap->MaxReserved(), 0));
+  MemoryAllocator* memory_allocator =
+      new MemoryAllocator(isolate, heap->MaxReserved(), 0);
   TestMemoryAllocatorScope test_scope(isolate, memory_allocator);
 
-  OldSpace* s = new OldSpace(heap, OLD_SPACE, NOT_EXECUTABLE);
+  OldSpace* s = new OldSpace(heap);
   CHECK_NOT_NULL(s);
 
-  CHECK(s->SetUp());
-
   while (s->Available() > 0) {
     s->AllocateRawUnaligned(kMaxRegularHeapObjectSize).ToObjectChecked();
   }
@@ -716,7 +701,8 @@ TEST(ShrinkPageToHighWaterMarkOneWordFiller) {
 
   HeapObject* filler =
       HeapObject::FromAddress(array->address() + array->Size());
-  CHECK_EQ(filler->map(), CcTest::heap()->one_pointer_filler_map());
+  CHECK_EQ(filler->map(),
+           ReadOnlyRoots(CcTest::heap()).one_pointer_filler_map());
 
   size_t shrunk = old_space->ShrinkPageToHighWaterMark(page);
   CHECK_EQ(0u, shrunk);
@@ -743,7 +729,8 @@ TEST(ShrinkPageToHighWaterMarkTwoWordFiller) {
 
   HeapObject* filler =
       HeapObject::FromAddress(array->address() + array->Size());
-  CHECK_EQ(filler->map(), CcTest::heap()->two_pointer_filler_map());
+  CHECK_EQ(filler->map(),
+           ReadOnlyRoots(CcTest::heap()).two_pointer_filler_map());
 
   size_t shrunk = old_space->ShrinkPageToHighWaterMark(page);
   CHECK_EQ(0u, shrunk);
diff --git a/deps/v8/test/cctest/heap/test-unmapper.cc b/deps/v8/test/cctest/heap/test-unmapper.cc
new file mode 100644
index 00000000000000..880c54457c81cc
--- /dev/null
+++ b/deps/v8/test/cctest/heap/test-unmapper.cc
@@ -0,0 +1,66 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "src/v8.h"
+
+#include "src/heap/spaces.h"
+#include "test/cctest/cctest.h"
+#include "test/cctest/heap/heap-utils.h"
+
+using v8::IdleTask;
+using v8::Task;
+using v8::Isolate;
+
+namespace v8 {
+namespace internal {
+namespace heap {
+
+class MockPlatformForUnmapper : public TestPlatform {
+ public:
+  MockPlatformForUnmapper()
+      : task_(nullptr), old_platform_(i::V8::GetCurrentPlatform()) {
+    // Now that it's completely constructed, make this the current platform.
+    i::V8::SetPlatformForTesting(this);
+  }
+  virtual ~MockPlatformForUnmapper() {
+    delete task_;
+    i::V8::SetPlatformForTesting(old_platform_);
+    for (auto& task : worker_tasks_) {
+      old_platform_->CallOnWorkerThread(std::move(task));
+    }
+    worker_tasks_.clear();
+  }
+
+  void CallOnForegroundThread(v8::Isolate* isolate, Task* task) override {
+    task_ = task;
+  }
+
+  void CallOnWorkerThread(std::unique_ptr<Task> task) override {
+    worker_tasks_.push_back(std::move(task));
+  }
+
+  bool IdleTasksEnabled(v8::Isolate* isolate) override { return false; }
+
+  int NumberOfWorkerThreads() override {
+    return old_platform_->NumberOfWorkerThreads();
+  }
+
+ private:
+  Task* task_;
+  std::vector<std::unique_ptr<Task>> worker_tasks_;
+  v8::Platform* old_platform_;
+};
+
+TEST(EagerUnmappingInCollectAllAvailableGarbage) {
+  CcTest::InitializeVM();
+  MockPlatformForUnmapper platform;
+  Heap* heap = CcTest::heap();
+  i::heap::SimulateFullSpace(heap->old_space());
+  CcTest::CollectAllAvailableGarbage();
+  CHECK_EQ(0, heap->memory_allocator()->unmapper()->NumberOfChunks());
+}
+
+}  // namespace heap
+}  // namespace internal
+}  // namespace v8
diff --git a/deps/v8/test/cctest/heap/test-weak-references.cc b/deps/v8/test/cctest/heap/test-weak-references.cc
index 7b86657a535dce..4b9da81c745ffb 100644
--- a/deps/v8/test/cctest/heap/test-weak-references.cc
+++ b/deps/v8/test/cctest/heap/test-weak-references.cc
@@ -7,6 +7,7 @@
 #include "src/heap/factory.h"
 #include "src/isolate.h"
 #include "test/cctest/cctest.h"
+#include "test/cctest/heap/heap-tester.h"
 #include "test/cctest/heap/heap-utils.h"
 
 namespace v8 {
@@ -16,6 +17,7 @@ namespace heap {
 Handle<FeedbackVector> CreateFeedbackVectorForTest(
     v8::Isolate* isolate, Factory* factory,
     PretenureFlag pretenure_flag = NOT_TENURED) {
+  i::Isolate* i_isolate = reinterpret_cast<i::Isolate*>(isolate);
   v8::Local<v8::Script> script =
       v8::Script::Compile(isolate->GetCurrentContext(),
                           v8::String::NewFromUtf8(isolate, "function foo() {}",
@@ -24,7 +26,7 @@ Handle<FeedbackVector> CreateFeedbackVectorForTest(
           .ToLocalChecked();
   Handle<Object> obj = v8::Utils::OpenHandle(*script);
   Handle<SharedFunctionInfo> shared_function =
-      Handle<SharedFunctionInfo>(JSFunction::cast(*obj)->shared());
+      Handle<SharedFunctionInfo>(JSFunction::cast(*obj)->shared(), i_isolate);
   Handle<FeedbackVector> fv =
       factory->NewFeedbackVector(shared_function, pretenure_flag);
   return fv;
@@ -34,24 +36,23 @@ TEST(WeakReferencesBasic) {
   CcTest::InitializeVM();
   Isolate* isolate = CcTest::i_isolate();
   Factory* factory = isolate->factory();
-  Heap* heap = isolate->heap();
   HandleScope outer_scope(isolate);
 
   Handle<FeedbackVector> fv =
       CreateFeedbackVectorForTest(CcTest::isolate(), factory);
-  CHECK(heap->InNewSpace(*fv));
+  CHECK(Heap::InNewSpace(*fv));
 
   MaybeObject* code_object = fv->optimized_code_weak_or_smi();
   CHECK(code_object->IsSmi());
   CcTest::CollectAllGarbage();
-  CHECK(heap->InNewSpace(*fv));
+  CHECK(Heap::InNewSpace(*fv));
   CHECK_EQ(code_object, fv->optimized_code_weak_or_smi());
 
   {
     HandleScope inner_scope(isolate);
 
     // Create a new Code.
-    Assembler assm(isolate, nullptr, 0);
+    Assembler assm(AssemblerOptions{}, nullptr, 0);
     assm.nop();  // supported on all architectures
     CodeDesc desc;
     assm.GetCode(isolate, &desc);
@@ -121,7 +122,7 @@ TEST(WeakReferencesOldToNew) {
 
   // Create a new FixedArray which the FeedbackVector will point to.
   Handle<FixedArray> fixed_array = factory->NewFixedArray(1);
-  CHECK(heap->InNewSpace(*fixed_array));
+  CHECK(Heap::InNewSpace(*fixed_array));
   fv->set_optimized_code_weak_or_smi(HeapObjectReference::Weak(*fixed_array));
 
   CcTest::CollectAllGarbage();
@@ -146,7 +147,7 @@ TEST(WeakReferencesOldToNewScavenged) {
 
   // Create a new FixedArray which the FeedbackVector will point to.
   Handle<FixedArray> fixed_array = factory->NewFixedArray(1);
-  CHECK(heap->InNewSpace(*fixed_array));
+  CHECK(Heap::InNewSpace(*fixed_array));
   fv->set_optimized_code_weak_or_smi(HeapObjectReference::Weak(*fixed_array));
 
   CcTest::CollectGarbage(NEW_SPACE);
@@ -189,13 +190,13 @@ TEST(ObjectMovesBeforeClearingWeakField) {
   HandleScope outer_scope(isolate);
   Handle<FeedbackVector> fv =
       CreateFeedbackVectorForTest(CcTest::isolate(), factory);
-  CHECK(heap->InNewSpace(*fv));
+  CHECK(Heap::InNewSpace(*fv));
   FeedbackVector* fv_location = *fv;
   {
     HandleScope inner_scope(isolate);
     // Create a new FixedArray which the FeedbackVector will point to.
     Handle<FixedArray> fixed_array = factory->NewFixedArray(1);
-    CHECK(heap->InNewSpace(*fixed_array));
+    CHECK(Heap::InNewSpace(*fixed_array));
     fv->set_optimized_code_weak_or_smi(HeapObjectReference::Weak(*fixed_array));
     // inner_scope will go out of scope, so when marking the next time,
     // *fixed_array will stay white.
@@ -230,12 +231,12 @@ TEST(ObjectWithWeakFieldDies) {
     HandleScope outer_scope(isolate);
     Handle<FeedbackVector> fv =
         CreateFeedbackVectorForTest(CcTest::isolate(), factory);
-    CHECK(heap->InNewSpace(*fv));
+    CHECK(Heap::InNewSpace(*fv));
     {
       HandleScope inner_scope(isolate);
       // Create a new FixedArray which the FeedbackVector will point to.
       Handle<FixedArray> fixed_array = factory->NewFixedArray(1);
-      CHECK(heap->InNewSpace(*fixed_array));
+      CHECK(Heap::InNewSpace(*fixed_array));
       fv->set_optimized_code_weak_or_smi(
           HeapObjectReference::Weak(*fixed_array));
       // inner_scope will go out of scope, so when marking the next time,
@@ -263,11 +264,11 @@ TEST(ObjectWithWeakReferencePromoted) {
   HandleScope outer_scope(isolate);
   Handle<FeedbackVector> fv =
       CreateFeedbackVectorForTest(CcTest::isolate(), factory);
-  CHECK(heap->InNewSpace(*fv));
+  CHECK(Heap::InNewSpace(*fv));
 
   // Create a new FixedArray which the FeedbackVector will point to.
   Handle<FixedArray> fixed_array = factory->NewFixedArray(1);
-  CHECK(heap->InNewSpace(*fixed_array));
+  CHECK(Heap::InNewSpace(*fixed_array));
   fv->set_optimized_code_weak_or_smi(HeapObjectReference::Weak(*fixed_array));
 
   CcTest::CollectGarbage(NEW_SPACE);
@@ -289,12 +290,12 @@ TEST(ObjectWithClearedWeakReferencePromoted) {
   HandleScope outer_scope(isolate);
   Handle<FeedbackVector> fv =
       CreateFeedbackVectorForTest(CcTest::isolate(), factory);
-  CHECK(heap->InNewSpace(*fv));
+  CHECK(Heap::InNewSpace(*fv));
 
   fv->set_optimized_code_weak_or_smi(HeapObjectReference::ClearedValue());
 
   CcTest::CollectGarbage(NEW_SPACE);
-  CHECK(heap->InNewSpace(*fv));
+  CHECK(Heap::InNewSpace(*fv));
   CHECK(fv->optimized_code_weak_or_smi()->IsClearedWeakHeapObject());
 
   CcTest::CollectGarbage(NEW_SPACE);
@@ -319,21 +320,21 @@ TEST(WeakReferenceWriteBarrier) {
   HandleScope outer_scope(isolate);
   Handle<FeedbackVector> fv =
       CreateFeedbackVectorForTest(CcTest::isolate(), factory);
-  CHECK(heap->InNewSpace(*fv));
+  CHECK(Heap::InNewSpace(*fv));
 
   {
     HandleScope inner_scope(isolate);
 
     // Create a new FixedArray which the FeedbackVector will point to.
     Handle<FixedArray> fixed_array1 = factory->NewFixedArray(1);
-    CHECK(heap->InNewSpace(*fixed_array1));
+    CHECK(Heap::InNewSpace(*fixed_array1));
     fv->set_optimized_code_weak_or_smi(
         HeapObjectReference::Weak(*fixed_array1));
 
     SimulateIncrementalMarking(heap, true);
 
     Handle<FixedArray> fixed_array2 = factory->NewFixedArray(1);
-    CHECK(heap->InNewSpace(*fixed_array2));
+    CHECK(Heap::InNewSpace(*fixed_array2));
     // This write will trigger the write barrier.
     fv->set_optimized_code_weak_or_smi(
         HeapObjectReference::Weak(*fixed_array2));
@@ -370,12 +371,12 @@ TEST(WeakArraysBasic) {
   CHECK(array->IsWeakFixedArray());
   CHECK(!array->IsFixedArray());
   CHECK_EQ(array->length(), length);
-  CHECK(heap->InNewSpace(*array));
+  CHECK(Heap::InNewSpace(*array));
 
   for (int i = 0; i < length; ++i) {
     HeapObject* heap_object;
     CHECK(array->Get(i)->ToStrongHeapObject(&heap_object));
-    CHECK_EQ(heap_object, heap->undefined_value());
+    CHECK_EQ(heap_object, ReadOnlyRoots(heap).undefined_value());
   }
 
   Handle<HeapObject> saved;
@@ -425,6 +426,154 @@ TEST(WeakArraysBasic) {
   CHECK(array->Get(3)->IsClearedWeakHeapObject());
 }
 
+TEST(WeakArrayListBasic) {
+  ManualGCScope manual_gc_scope;
+  CcTest::InitializeVM();
+  Isolate* isolate = CcTest::i_isolate();
+  Factory* factory = isolate->factory();
+  Heap* heap = isolate->heap();
+  HandleScope outer_scope(isolate);
+
+  Handle<WeakArrayList> array(ReadOnlyRoots(heap).empty_weak_array_list(),
+                              isolate);
+  CHECK(array->IsWeakArrayList());
+  CHECK(!array->IsFixedArray());
+  CHECK(!array->IsWeakFixedArray());
+  CHECK_EQ(array->length(), 0);
+
+  Handle<FixedArray> index2 = factory->NewFixedArray(1);
+  index2->set(0, Smi::FromInt(2017));
+
+  Handle<HeapObject> saved;
+  {
+    HandleScope inner_scope(isolate);
+    Handle<FixedArray> index0 = factory->NewFixedArray(1);
+    index0->set(0, Smi::FromInt(2016));
+    Handle<FixedArray> index4 = factory->NewFixedArray(1);
+    index4->set(0, Smi::FromInt(2018));
+    Handle<FixedArray> index6 = factory->NewFixedArray(1);
+    index6->set(0, Smi::FromInt(2019));
+
+    array = WeakArrayList::AddToEnd(array, MaybeObjectHandle::Weak(index0));
+    array = WeakArrayList::AddToEnd(
+        array, MaybeObjectHandle(Smi::FromInt(1), isolate));
+    CHECK_EQ(array->length(), 2);
+
+    array = WeakArrayList::AddToEnd(array, MaybeObjectHandle::Weak(index2));
+    array = WeakArrayList::AddToEnd(
+        array, MaybeObjectHandle(Smi::FromInt(3), isolate));
+    CHECK_EQ(array->length(), 4);
+
+    array = WeakArrayList::AddToEnd(array, MaybeObjectHandle::Weak(index4));
+    array = WeakArrayList::AddToEnd(
+        array, MaybeObjectHandle(Smi::FromInt(5), isolate));
+    CHECK_EQ(array->length(), 6);
+
+    array = WeakArrayList::AddToEnd(array, MaybeObjectHandle::Weak(index6));
+    array = WeakArrayList::AddToEnd(
+        array, MaybeObjectHandle(Smi::FromInt(7), isolate));
+    CHECK_EQ(array->length(), 8);
+
+    CHECK(Heap::InNewSpace(*array));
+
+    CHECK_EQ(array->Get(0), HeapObjectReference::Weak(*index0));
+    CHECK_EQ(Smi::ToInt(array->Get(1)->ToSmi()), 1);
+
+    CHECK_EQ(array->Get(2), HeapObjectReference::Weak(*index2));
+    CHECK_EQ(Smi::ToInt(array->Get(3)->ToSmi()), 3);
+
+    CHECK_EQ(array->Get(4), HeapObjectReference::Weak(*index4));
+    CHECK_EQ(Smi::ToInt(array->Get(5)->ToSmi()), 5);
+
+    CHECK_EQ(array->Get(6), HeapObjectReference::Weak(*index6));
+    array = inner_scope.CloseAndEscape(array);
+  }  // inner_scope goes out of scope.
+
+  // The references are only cleared by the mark-compact (scavenger treats weak
+  // references as strong). Thus we need to GC until the array reaches old
+  // space.
+
+  // TODO(marja): update this when/if we do handle weak references in the new
+  // space.
+  CcTest::CollectGarbage(NEW_SPACE);
+  HeapObject* heap_object;
+  CHECK_EQ(array->length(), 8);
+  CHECK(array->Get(0)->ToWeakHeapObject(&heap_object));
+  CHECK_EQ(Smi::cast(FixedArray::cast(heap_object)->get(0))->value(), 2016);
+  CHECK_EQ(Smi::ToInt(array->Get(1)->ToSmi()), 1);
+
+  CHECK(array->Get(2)->ToWeakHeapObject(&heap_object));
+  CHECK_EQ(Smi::cast(FixedArray::cast(heap_object)->get(0))->value(), 2017);
+  CHECK_EQ(Smi::ToInt(array->Get(3)->ToSmi()), 3);
+
+  CHECK(array->Get(4)->ToWeakHeapObject(&heap_object));
+  CHECK_EQ(Smi::cast(FixedArray::cast(heap_object)->get(0))->value(), 2018);
+  CHECK_EQ(Smi::ToInt(array->Get(5)->ToSmi()), 5);
+
+  CHECK(array->Get(6)->ToWeakHeapObject(&heap_object));
+  CHECK_EQ(Smi::cast(FixedArray::cast(heap_object)->get(0))->value(), 2019);
+  CHECK_EQ(Smi::ToInt(array->Get(7)->ToSmi()), 7);
+
+  CcTest::CollectAllGarbage();
+  CHECK(heap->InOldSpace(*array));
+  CHECK_EQ(array->length(), 8);
+  CHECK(array->Get(0)->IsClearedWeakHeapObject());
+  CHECK_EQ(Smi::ToInt(array->Get(1)->ToSmi()), 1);
+
+  CHECK(array->Get(2)->ToWeakHeapObject(&heap_object));
+  CHECK_EQ(Smi::cast(FixedArray::cast(heap_object)->get(0))->value(), 2017);
+  CHECK_EQ(Smi::ToInt(array->Get(3)->ToSmi()), 3);
+
+  CHECK(array->Get(4)->IsClearedWeakHeapObject());
+  CHECK_EQ(Smi::ToInt(array->Get(5)->ToSmi()), 5);
+
+  CHECK(array->Get(6)->IsClearedWeakHeapObject());
+  CHECK_EQ(Smi::ToInt(array->Get(7)->ToSmi()), 7);
+}
+
+TEST(Regress7768) {
+  i::FLAG_allow_natives_syntax = true;
+  i::FLAG_turbo_inlining = false;
+  if (!FLAG_incremental_marking) {
+    return;
+  }
+  ManualGCScope manual_gc_scope;
+  CcTest::InitializeVM();
+  LocalContext context;
+  Isolate* isolate = CcTest::i_isolate();
+  Heap* heap = isolate->heap();
+  HandleScope outer_scope(isolate);
+  // Create an optimized code which will contain a weak reference to another
+  // function ("f"). The weak reference is the only reference to the function.
+  CompileRun(
+      "function myfunc(f) { f(); } "
+      "(function wrapper() { "
+      "   function f() {}; myfunc(f); myfunc(f); "
+      "   %OptimizeFunctionOnNextCall(myfunc); myfunc(f); "
+      "   %ClearFunctionFeedback(wrapper);"
+      "})(); "
+      "%ClearFunctionFeedback(myfunc);");
+
+  // Do marking steps; this will store the objects pointed by myfunc for later
+  // processing.
+  SimulateIncrementalMarking(heap, true);
+
+  // Deoptimize the code; now the pointers inside it will be replaced with
+  // undefined, and the weak_objects_in_code is the only place pointing to the
+  // function f.
+  CompileRun("%DeoptimizeFunction(myfunc);");
+
+  // The object pointed to by the weak reference won't be scavenged.
+  CcTest::CollectGarbage(NEW_SPACE);
+
+  // Make sure the memory where it's stored is invalidated, so that we'll crash
+  // if we try to access it.
+  HeapTester::UncommitFromSpace(heap);
+
+  // This used to crash when processing the dead weak reference.
+  CcTest::CollectAllGarbage();
+}
+
 }  // namespace heap
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/test/cctest/interpreter/bytecode-expectations-printer.cc b/deps/v8/test/cctest/interpreter/bytecode-expectations-printer.cc
index d8e4ecfc2dd0f7..0998b3dfd909cd 100644
--- a/deps/v8/test/cctest/interpreter/bytecode-expectations-printer.cc
+++ b/deps/v8/test/cctest/interpreter/bytecode-expectations-printer.cc
@@ -10,17 +10,16 @@
 
 #include "include/libplatform/libplatform.h"
 #include "include/v8.h"
-
 #include "src/api.h"
 #include "src/base/logging.h"
-#include "src/objects-inl.h"
-#include "src/runtime/runtime.h"
-
 #include "src/interpreter/bytecode-array-iterator.h"
 #include "src/interpreter/bytecode-generator.h"
 #include "src/interpreter/bytecodes.h"
 #include "src/interpreter/interpreter-intrinsics.h"
 #include "src/interpreter/interpreter.h"
+#include "src/objects-inl.h"
+#include "src/objects/module-inl.h"
+#include "src/runtime/runtime.h"
 #include "src/source-position-table.h"
 
 namespace v8 {
@@ -81,7 +80,8 @@ v8::Local<v8::Module> BytecodeExpectationsPrinter::CompileModule(
 }
 
 void BytecodeExpectationsPrinter::Run(v8::Local<v8::Script> script) const {
-  (void)script->Run(isolate_->GetCurrentContext());
+  MaybeLocal<Value> result = script->Run(isolate_->GetCurrentContext());
+  USE(result);
 }
 
 i::Handle<v8::internal::BytecodeArray>
diff --git a/deps/v8/test/cctest/interpreter/bytecode_expectations/ArrayLiterals.golden b/deps/v8/test/cctest/interpreter/bytecode_expectations/ArrayLiterals.golden
index d97780a4522808..9714926254b757 100644
--- a/deps/v8/test/cctest/interpreter/bytecode_expectations/ArrayLiterals.golden
+++ b/deps/v8/test/cctest/interpreter/bytecode_expectations/ArrayLiterals.golden
@@ -18,7 +18,7 @@ bytecodes: [
   /*   50 S> */ B(Return),
 ]
 constant pool: [
-  TUPLE2_TYPE,
+  ARRAY_BOILERPLATE_DESCRIPTION_TYPE,
 ]
 handlers: [
 ]
@@ -49,7 +49,7 @@ bytecodes: [
   /*   65 S> */ B(Return),
 ]
 constant pool: [
-  TUPLE2_TYPE,
+  ARRAY_BOILERPLATE_DESCRIPTION_TYPE,
 ]
 handlers: [
 ]
@@ -67,7 +67,7 @@ bytecodes: [
   /*   61 S> */ B(Return),
 ]
 constant pool: [
-  TUPLE2_TYPE,
+  ARRAY_BOILERPLATE_DESCRIPTION_TYPE,
 ]
 handlers: [
 ]
@@ -110,9 +110,9 @@ bytecodes: [
   /*   76 S> */ B(Return),
 ]
 constant pool: [
-  TUPLE2_TYPE,
-  TUPLE2_TYPE,
-  TUPLE2_TYPE,
+  ARRAY_BOILERPLATE_DESCRIPTION_TYPE,
+  ARRAY_BOILERPLATE_DESCRIPTION_TYPE,
+  ARRAY_BOILERPLATE_DESCRIPTION_TYPE,
 ]
 handlers: [
 ]
diff --git a/deps/v8/test/cctest/interpreter/bytecode_expectations/AsyncGenerators.golden b/deps/v8/test/cctest/interpreter/bytecode_expectations/AsyncGenerators.golden
index 2b4eb6b2cc5674..d7109321c6d2a5 100644
--- a/deps/v8/test/cctest/interpreter/bytecode_expectations/AsyncGenerators.golden
+++ b/deps/v8/test/cctest/interpreter/bytecode_expectations/AsyncGenerators.golden
@@ -14,7 +14,7 @@ snippet: "
 "
 frame size: 8
 parameter count: 1
-bytecode array length: 192
+bytecode array length: 189
 bytecodes: [
                 B(SwitchOnGeneratorState), R(0), U8(0), U8(2),
                 B(Mov), R(closure), R(1),
@@ -35,7 +35,7 @@ bytecodes: [
                 B(LdaZero),
                 B(Star), R(1),
                 B(Mov), R(5), R(2),
-                B(Jump), U8(98),
+                B(Jump), U8(95),
                 B(LdaUndefined),
                 B(Star), R(6),
                 B(Mov), R(0), R(5),
@@ -46,18 +46,17 @@ bytecodes: [
                 B(InvokeIntrinsic), U8(Runtime::k_GeneratorGetResumeMode), R(0), U8(1),
                 B(Star), R(6),
                 B(LdaZero),
-                B(TestEqualStrictNoFeedback), R(6),
+                B(TestReferenceEqual), R(6),
                 B(JumpIfTrue), U8(5),
                 B(Ldar), R(5),
                 B(ReThrow),
                 B(LdaZero),
                 B(Star), R(1),
                 B(Mov), R(5), R(2),
-                B(Jump), U8(55),
-                B(Jump), U8(39),
+                B(Jump), U8(52),
+                B(Jump), U8(36),
                 B(Star), R(5),
-                B(Ldar), R(closure),
-                B(CreateCatchContext), R(5), U8(4), U8(5),
+                B(CreateCatchContext), R(5), U8(4),
                 B(Star), R(4),
                 B(LdaTheHole),
                 B(SetPendingMessage),
@@ -86,7 +85,7 @@ bytecodes: [
                 B(Ldar), R(3),
                 B(SetPendingMessage),
                 B(Ldar), R(1),
-                B(SwitchOnSmiNoFeedback), U8(6), U8(3), I8(0),
+                B(SwitchOnSmiNoFeedback), U8(5), U8(3), I8(0),
                 B(Jump), U8(22),
                 B(LdaTrue),
                 B(Star), R(6),
@@ -106,14 +105,13 @@ constant pool: [
   Smi [70],
   Smi [15],
   Smi [7],
-  ONE_BYTE_INTERNALIZED_STRING_TYPE [".catch"],
   SCOPE_INFO_TYPE,
   Smi [6],
   Smi [20],
   Smi [23],
 ]
 handlers: [
-  [20, 137, 145],
+  [20, 134, 142],
   [23, 98, 100],
 ]
 
@@ -124,7 +122,7 @@ snippet: "
 "
 frame size: 8
 parameter count: 1
-bytecode array length: 236
+bytecode array length: 233
 bytecodes: [
                 B(SwitchOnGeneratorState), R(0), U8(0), U8(3),
                 B(Mov), R(closure), R(1),
@@ -145,7 +143,7 @@ bytecodes: [
                 B(LdaZero),
                 B(Star), R(1),
                 B(Mov), R(5), R(2),
-                B(Jump), U8(142),
+                B(Jump), U8(139),
   /*   22 S> */ B(LdaSmi), I8(42),
                 B(Star), R(6),
                 B(LdaFalse),
@@ -162,7 +160,7 @@ bytecodes: [
                 B(LdaZero),
                 B(Star), R(1),
                 B(Mov), R(5), R(2),
-                B(Jump), U8(98),
+                B(Jump), U8(95),
                 B(LdaUndefined),
                 B(Star), R(6),
                 B(Mov), R(0), R(5),
@@ -173,18 +171,17 @@ bytecodes: [
                 B(InvokeIntrinsic), U8(Runtime::k_GeneratorGetResumeMode), R(0), U8(1),
                 B(Star), R(6),
                 B(LdaZero),
-                B(TestEqualStrictNoFeedback), R(6),
+                B(TestReferenceEqual), R(6),
                 B(JumpIfTrue), U8(5),
                 B(Ldar), R(5),
                 B(ReThrow),
                 B(LdaZero),
                 B(Star), R(1),
                 B(Mov), R(5), R(2),
-                B(Jump), U8(55),
-                B(Jump), U8(39),
+                B(Jump), U8(52),
+                B(Jump), U8(36),
                 B(Star), R(5),
-                B(Ldar), R(closure),
-                B(CreateCatchContext), R(5), U8(7), U8(8),
+                B(CreateCatchContext), R(5), U8(7),
                 B(Star), R(4),
                 B(LdaTheHole),
                 B(SetPendingMessage),
@@ -213,7 +210,7 @@ bytecodes: [
                 B(Ldar), R(3),
                 B(SetPendingMessage),
                 B(Ldar), R(1),
-                B(SwitchOnSmiNoFeedback), U8(9), U8(3), I8(0),
+                B(SwitchOnSmiNoFeedback), U8(8), U8(3), I8(0),
                 B(Jump), U8(22),
                 B(LdaTrue),
                 B(Star), R(6),
@@ -236,14 +233,13 @@ constant pool: [
   Smi [7],
   Smi [15],
   Smi [7],
-  ONE_BYTE_INTERNALIZED_STRING_TYPE [".catch"],
   SCOPE_INFO_TYPE,
   Smi [6],
   Smi [20],
   Smi [23],
 ]
 handlers: [
-  [20, 181, 189],
+  [20, 178, 186],
   [23, 142, 144],
 ]
 
@@ -254,7 +250,7 @@ snippet: "
 "
 frame size: 22
 parameter count: 1
-bytecode array length: 496
+bytecode array length: 490
 bytecodes: [
                 B(SwitchOnGeneratorState), R(2), U8(0), U8(3),
                 B(Mov), R(closure), R(11),
@@ -275,7 +271,7 @@ bytecodes: [
                 B(LdaZero),
                 B(Star), R(11),
                 B(Mov), R(15), R(12),
-                B(JumpConstant), U8(19),
+                B(JumpConstant), U8(18),
                 B(LdaZero),
                 B(Star), R(7),
                 B(Mov), R(context), R(17),
@@ -320,14 +316,13 @@ bytecodes: [
                 B(LdaZero),
                 B(Star), R(15),
                 B(Mov), R(19), R(16),
-                B(Jump), U8(62),
+                B(Jump), U8(59),
                 B(LdaZero),
                 B(Star), R(7),
                 B(JumpLoop), U8(87), I8(0),
-                B(Jump), U8(40),
+                B(Jump), U8(37),
                 B(Star), R(19),
-                B(Ldar), R(closure),
-                B(CreateCatchContext), R(19), U8(12), U8(13),
+                B(CreateCatchContext), R(19), U8(12),
                 B(Star), R(18),
                 B(LdaTheHole),
                 B(SetPendingMessage),
@@ -355,7 +350,7 @@ bytecodes: [
                 B(LdaZero),
                 B(TestEqualStrict), R(7), U8(14),
                 B(JumpIfTrue), U8(90),
-                B(LdaNamedProperty), R(4), U8(14), U8(15),
+                B(LdaNamedProperty), R(4), U8(13), U8(15),
                 B(Star), R(9),
                 B(TestUndetectable),
                 B(JumpIfFalse), U8(4),
@@ -367,9 +362,9 @@ bytecodes: [
                 B(TestTypeOf), U8(6),
                 B(JumpIfFalse), U8(4),
                 B(Jump), U8(18),
-                B(Wide), B(LdaSmi), I16(147),
+                B(Wide), B(LdaSmi), I16(149),
                 B(Star), R(18),
-                B(LdaConstant), U8(15),
+                B(LdaConstant), U8(14),
                 B(Star), R(19),
                 B(CallRuntime), U16(Runtime::kNewTypeError), R(18), U8(2),
                 B(Throw),
@@ -393,12 +388,12 @@ bytecodes: [
                 B(Ldar), R(17),
                 B(SetPendingMessage),
                 B(Ldar), R(15),
-                B(SwitchOnSmiNoFeedback), U8(16), U8(2), I8(0),
+                B(SwitchOnSmiNoFeedback), U8(15), U8(2), I8(0),
                 B(Jump), U8(13),
                 B(LdaZero),
                 B(Star), R(11),
                 B(Mov), R(16), R(12),
-                B(Jump), U8(101),
+                B(Jump), U8(98),
                 B(Ldar), R(16),
                 B(ReThrow),
                 B(LdaUndefined),
@@ -411,18 +406,17 @@ bytecodes: [
                 B(InvokeIntrinsic), U8(Runtime::k_GeneratorGetResumeMode), R(2), U8(1),
                 B(Star), R(16),
                 B(LdaZero),
-                B(TestEqualStrictNoFeedback), R(16),
+                B(TestReferenceEqual), R(16),
                 B(JumpIfTrue), U8(5),
                 B(Ldar), R(15),
                 B(ReThrow),
                 B(LdaZero),
                 B(Star), R(11),
                 B(Mov), R(15), R(12),
-                B(Jump), U8(55),
-                B(Jump), U8(39),
+                B(Jump), U8(52),
+                B(Jump), U8(36),
                 B(Star), R(15),
-                B(Ldar), R(closure),
-                B(CreateCatchContext), R(15), U8(12), U8(18),
+                B(CreateCatchContext), R(15), U8(17),
                 B(Star), R(14),
                 B(LdaTheHole),
                 B(SetPendingMessage),
@@ -451,7 +445,7 @@ bytecodes: [
                 B(Ldar), R(13),
                 B(SetPendingMessage),
                 B(Ldar), R(11),
-                B(SwitchOnSmiNoFeedback), U8(20), U8(3), I8(0),
+                B(SwitchOnSmiNoFeedback), U8(19), U8(3), I8(0),
                 B(Jump), U8(22),
                 B(LdaTrue),
                 B(Star), R(16),
@@ -469,34 +463,33 @@ bytecodes: [
 constant pool: [
   Smi [30],
   Smi [154],
-  Smi [374],
+  Smi [371],
   Smi [15],
   Smi [7],
-  TUPLE2_TYPE,
+  ARRAY_BOILERPLATE_DESCRIPTION_TYPE,
   SYMBOL_TYPE,
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["next"],
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["done"],
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["value"],
   Smi [15],
   Smi [7],
-  ONE_BYTE_INTERNALIZED_STRING_TYPE [".catch"],
   SCOPE_INFO_TYPE,
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["return"],
   ONE_BYTE_INTERNALIZED_STRING_TYPE [""],
   Smi [6],
   Smi [14],
   SCOPE_INFO_TYPE,
-  Smi [402],
+  Smi [396],
   Smi [6],
   Smi [20],
   Smi [23],
 ]
 handlers: [
-  [20, 441, 449],
-  [23, 402, 404],
-  [61, 225, 233],
+  [20, 435, 443],
+  [23, 399, 401],
+  [61, 222, 230],
   [64, 185, 187],
-  [294, 304, 306],
+  [291, 301, 303],
 ]
 
 ---
@@ -507,7 +500,7 @@ snippet: "
 "
 frame size: 17
 parameter count: 1
-bytecode array length: 482
+bytecode array length: 479
 bytecodes: [
                 B(SwitchOnGeneratorState), R(0), U8(0), U8(5),
                 B(Mov), R(closure), R(1),
@@ -528,7 +521,7 @@ bytecodes: [
                 B(LdaZero),
                 B(Star), R(1),
                 B(Mov), R(5), R(2),
-                B(JumpConstant), U8(19),
+                B(JumpConstant), U8(18),
   /*   49 S> */ B(LdaGlobal), U8(7), U8(0),
                 B(Star), R(12),
   /*   56 E> */ B(CallUndefinedReceiver0), R(12), U8(2),
@@ -565,7 +558,7 @@ bytecodes: [
                 B(LdaZero),
                 B(Star), R(1),
                 B(Mov), R(8), R(2),
-                B(JumpConstant), U8(20),
+                B(JumpConstant), U8(19),
                 B(LdaNamedProperty), R(7), U8(14), U8(20),
                 B(JumpIfUndefined), U8(13),
                 B(JumpIfNull), U8(11),
@@ -587,7 +580,7 @@ bytecodes: [
                 B(InvokeIntrinsic), U8(Runtime::k_GeneratorGetResumeMode), R(0), U8(1),
                 B(Star), R(13),
                 B(LdaZero),
-                B(TestEqualStrictNoFeedback), R(13),
+                B(TestReferenceEqual), R(13),
                 B(JumpIfTrue), U8(5),
                 B(Ldar), R(12),
                 B(ReThrow),
@@ -605,7 +598,7 @@ bytecodes: [
                 B(InvokeIntrinsic), U8(Runtime::k_GeneratorGetResumeMode), R(0), U8(1),
                 B(Star), R(13),
                 B(LdaZero),
-                B(TestEqualStrictNoFeedback), R(13),
+                B(TestReferenceEqual), R(13),
                 B(JumpIfTrue), U8(5),
                 B(Ldar), R(12),
                 B(ReThrow),
@@ -630,12 +623,12 @@ bytecodes: [
                 B(LdaNamedProperty), R(5), U8(16), U8(32),
                 B(Star), R(7),
                 B(LdaSmi), I8(1),
-                B(TestEqualStrictNoFeedback), R(6),
+                B(TestReferenceEqual), R(6),
                 B(JumpIfFalse), U8(10),
                 B(LdaZero),
                 B(Star), R(1),
                 B(Mov), R(7), R(2),
-                B(Jump), U8(98),
+                B(Jump), U8(95),
                 B(LdaUndefined),
                 B(Star), R(6),
                 B(Mov), R(0), R(5),
@@ -646,18 +639,17 @@ bytecodes: [
                 B(InvokeIntrinsic), U8(Runtime::k_GeneratorGetResumeMode), R(0), U8(1),
                 B(Star), R(6),
                 B(LdaZero),
-                B(TestEqualStrictNoFeedback), R(6),
+                B(TestReferenceEqual), R(6),
                 B(JumpIfTrue), U8(5),
                 B(Ldar), R(5),
                 B(ReThrow),
                 B(LdaZero),
                 B(Star), R(1),
                 B(Mov), R(5), R(2),
-                B(Jump), U8(55),
-                B(Jump), U8(39),
+                B(Jump), U8(52),
+                B(Jump), U8(36),
                 B(Star), R(5),
-                B(Ldar), R(closure),
-                B(CreateCatchContext), R(5), U8(17), U8(18),
+                B(CreateCatchContext), R(5), U8(17),
                 B(Star), R(4),
                 B(LdaTheHole),
                 B(SetPendingMessage),
@@ -686,7 +678,7 @@ bytecodes: [
                 B(Ldar), R(3),
                 B(SetPendingMessage),
                 B(Ldar), R(1),
-                B(SwitchOnSmiNoFeedback), U8(21), U8(3), I8(0),
+                B(SwitchOnSmiNoFeedback), U8(20), U8(3), I8(0),
                 B(Jump), U8(22),
                 B(LdaTrue),
                 B(Star), R(6),
@@ -719,16 +711,15 @@ constant pool: [
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["throw"],
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["done"],
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["value"],
-  ONE_BYTE_INTERNALIZED_STRING_TYPE [".catch"],
   SCOPE_INFO_TYPE,
-  Smi [388],
-  Smi [289],
+  Smi [385],
+  Smi [286],
   Smi [6],
   Smi [20],
   Smi [23],
 ]
 handlers: [
-  [20, 427, 435],
+  [20, 424, 432],
   [23, 388, 390],
 ]
 
diff --git a/deps/v8/test/cctest/interpreter/bytecode_expectations/BasicLoops.golden b/deps/v8/test/cctest/interpreter/bytecode_expectations/BasicLoops.golden
index e4185c11786d57..630d103b609bae 100644
--- a/deps/v8/test/cctest/interpreter/bytecode_expectations/BasicLoops.golden
+++ b/deps/v8/test/cctest/interpreter/bytecode_expectations/BasicLoops.golden
@@ -692,15 +692,14 @@ snippet: "
 "
 frame size: 4
 parameter count: 1
-bytecode array length: 52
+bytecode array length: 50
 bytecodes: [
   /*   30 E> */ B(StackCheck),
   /*   42 S> */ B(LdaZero),
                 B(Star), R(1),
   /*   52 S> */ B(Ldar), R(1),
-                B(JumpIfToBooleanFalse), U8(44),
+                B(JumpIfToBooleanFalse), U8(42),
   /*   45 E> */ B(StackCheck),
-                B(Ldar), R(closure),
                 B(CreateBlockContext), U8(0),
                 B(PushContext), R(3),
                 B(LdaTheHole),
@@ -718,7 +717,7 @@ bytecodes: [
                 B(Inc), U8(1),
   /*  127 E> */ B(StaCurrentContextSlot), U8(4),
                 B(PopContext), R(3),
-                B(JumpLoop), U8(43), I8(0),
+                B(JumpLoop), U8(41), I8(0),
                 B(LdaUndefined),
   /*  137 S> */ B(Return),
 ]
diff --git a/deps/v8/test/cctest/interpreter/bytecode_expectations/BreakableBlocks.golden b/deps/v8/test/cctest/interpreter/bytecode_expectations/BreakableBlocks.golden
index cd9416495ebb84..318cc2d651594f 100644
--- a/deps/v8/test/cctest/interpreter/bytecode_expectations/BreakableBlocks.golden
+++ b/deps/v8/test/cctest/interpreter/bytecode_expectations/BreakableBlocks.golden
@@ -101,10 +101,9 @@ snippet: "
 "
 frame size: 3
 parameter count: 1
-bytecode array length: 31
+bytecode array length: 29
 bytecodes: [
   /*   30 E> */ B(StackCheck),
-                B(Ldar), R(closure),
                 B(CreateBlockContext), U8(0),
                 B(PushContext), R(2),
                 B(LdaTheHole),
@@ -114,7 +113,7 @@ bytecodes: [
   /*   53 S> */ B(LdaSmi), I8(10),
   /*   53 E> */ B(StaCurrentContextSlot), U8(4),
                 B(Mov), R(0), R(1),
-                B(Ldar), R(1),
+                B(Ldar), R(0),
   /*   88 S> */ B(Jump), U8(2),
                 B(PopContext), R(2),
                 B(LdaUndefined),
@@ -142,21 +141,20 @@ snippet: "
 "
 frame size: 4
 parameter count: 1
-bytecode array length: 54
+bytecode array length: 53
 bytecodes: [
-                B(CreateFunctionContext), U8(1),
+                B(CreateFunctionContext), U8(0), U8(1),
                 B(PushContext), R(2),
                 B(LdaTheHole),
                 B(StaCurrentContextSlot), U8(4),
   /*   30 E> */ B(StackCheck),
   /*   42 S> */ B(LdaSmi), I8(1),
   /*   42 E> */ B(StaCurrentContextSlot), U8(4),
-                B(Ldar), R(closure),
-                B(CreateBlockContext), U8(0),
+                B(CreateBlockContext), U8(1),
                 B(PushContext), R(3),
                 B(LdaTheHole),
                 B(StaCurrentContextSlot), U8(4),
-                B(CreateClosure), U8(1), U8(0), U8(2),
+                B(CreateClosure), U8(2), U8(0), U8(2),
                 B(Star), R(0),
   /*   76 S> */ B(LdaSmi), I8(2),
   /*   76 E> */ B(StaCurrentContextSlot), U8(4),
@@ -174,6 +172,7 @@ bytecodes: [
   /*  162 S> */ B(Return),
 ]
 constant pool: [
+  SCOPE_INFO_TYPE,
   SCOPE_INFO_TYPE,
   SHARED_FUNCTION_INFO_TYPE,
 ]
diff --git a/deps/v8/test/cctest/interpreter/bytecode_expectations/CallAndSpread.golden b/deps/v8/test/cctest/interpreter/bytecode_expectations/CallAndSpread.golden
index 8606b2acc353d4..779e12c4ec756a 100644
--- a/deps/v8/test/cctest/interpreter/bytecode_expectations/CallAndSpread.golden
+++ b/deps/v8/test/cctest/interpreter/bytecode_expectations/CallAndSpread.golden
@@ -27,7 +27,7 @@ bytecodes: [
 constant pool: [
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["Math"],
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["max"],
-  TUPLE2_TYPE,
+  ARRAY_BOILERPLATE_DESCRIPTION_TYPE,
 ]
 handlers: [
 ]
@@ -56,7 +56,7 @@ bytecodes: [
 constant pool: [
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["Math"],
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["max"],
-  TUPLE2_TYPE,
+  ARRAY_BOILERPLATE_DESCRIPTION_TYPE,
 ]
 handlers: [
 ]
@@ -114,9 +114,9 @@ bytecodes: [
 constant pool: [
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["Math"],
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["max"],
-  TUPLE2_TYPE,
+  ARRAY_BOILERPLATE_DESCRIPTION_TYPE,
   Smi [1],
-  TUPLE2_TYPE,
+  ARRAY_BOILERPLATE_DESCRIPTION_TYPE,
   SYMBOL_TYPE,
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["next"],
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["done"],
diff --git a/deps/v8/test/cctest/interpreter/bytecode_expectations/CallLookupSlot.golden b/deps/v8/test/cctest/interpreter/bytecode_expectations/CallLookupSlot.golden
index f4a4bc4796c509..664aa35ea6c0bb 100644
--- a/deps/v8/test/cctest/interpreter/bytecode_expectations/CallLookupSlot.golden
+++ b/deps/v8/test/cctest/interpreter/bytecode_expectations/CallLookupSlot.golden
@@ -11,9 +11,9 @@ snippet: "
 "
 frame size: 10
 parameter count: 1
-bytecode array length: 74
+bytecode array length: 75
 bytecodes: [
-                B(CreateFunctionContext), U8(3),
+                B(CreateFunctionContext), U8(0), U8(3),
                 B(PushContext), R(1),
                 B(Ldar), R(this),
                 B(StaCurrentContextSlot), U8(4),
@@ -22,11 +22,11 @@ bytecodes: [
                 B(Ldar), R(0),
                 B(StaCurrentContextSlot), U8(5),
   /*   30 E> */ B(StackCheck),
-  /*   34 S> */ B(CreateClosure), U8(0), U8(0), U8(2),
-  /*   36 E> */ B(StaLookupSlot), U8(1), U8(0),
-  /*   52 S> */ B(LdaLookupGlobalSlot), U8(2), U8(1), U8(1),
+  /*   34 S> */ B(CreateClosure), U8(1), U8(0), U8(2),
+  /*   36 E> */ B(StaLookupSlot), U8(2), U8(0),
+  /*   52 S> */ B(LdaLookupGlobalSlot), U8(3), U8(1), U8(1),
                 B(Star), R(2),
-                B(LdaConstant), U8(3),
+                B(LdaConstant), U8(4),
                 B(Star), R(3),
                 B(LdaZero),
                 B(Star), R(7),
@@ -40,12 +40,13 @@ bytecodes: [
                 B(CallRuntime), U16(Runtime::kResolvePossiblyDirectEval), R(4), U8(6),
                 B(Star), R(2),
   /*   52 E> */ B(CallUndefinedReceiver1), R(2), R(3), U8(3),
-  /*   62 S> */ B(LdaLookupGlobalSlot), U8(1), U8(5), U8(1),
+  /*   62 S> */ B(LdaLookupGlobalSlot), U8(2), U8(5), U8(1),
                 B(Star), R(2),
   /*   69 E> */ B(CallUndefinedReceiver0), R(2), U8(7),
   /*   73 S> */ B(Return),
 ]
 constant pool: [
+  SCOPE_INFO_TYPE,
   SHARED_FUNCTION_INFO_TYPE,
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["g"],
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["eval"],
diff --git a/deps/v8/test/cctest/interpreter/bytecode_expectations/ClassAndSuperClass.golden b/deps/v8/test/cctest/interpreter/bytecode_expectations/ClassAndSuperClass.golden
index f1149ac258f622..440936ffad090d 100644
--- a/deps/v8/test/cctest/interpreter/bytecode_expectations/ClassAndSuperClass.golden
+++ b/deps/v8/test/cctest/interpreter/bytecode_expectations/ClassAndSuperClass.golden
@@ -104,7 +104,7 @@ snippet: "
     test = new B().constructor;
   })();
 "
-frame size: 5
+frame size: 6
 parameter count: 1
 bytecode array length: 40
 bytecodes: [
@@ -116,14 +116,14 @@ bytecodes: [
                 B(Star), R(4),
                 B(Ldar), R(0),
   /*  118 E> */ B(Construct), R(3), R(4), U8(1), U8(0),
-                B(Star), R(2),
+                B(Star), R(5),
                 B(Ldar), R(this),
-  /*  118 E> */ B(ThrowSuperAlreadyCalledIfNotHole),
-                B(Mov), R(2), R(this),
+                B(ThrowSuperAlreadyCalledIfNotHole),
+                B(Mov), R(5), R(this),
   /*  128 S> */ B(Ldar), R(this),
                 B(ThrowSuperNotCalledIfHole),
                 B(LdaSmi), I8(2),
-  /*  136 E> */ B(StaNamedProperty), R(2), U8(0), U8(2),
+  /*  136 E> */ B(StaNamedProperty), R(this), U8(0), U8(2),
                 B(Ldar), R(this),
                 B(ThrowSuperNotCalledIfHole),
   /*  141 S> */ B(Return),
@@ -147,7 +147,7 @@ snippet: "
     test = new B().constructor;
   })();
 "
-frame size: 4
+frame size: 5
 parameter count: 1
 bytecode array length: 36
 bytecodes: [
@@ -157,14 +157,14 @@ bytecodes: [
                 B(GetSuperConstructor), R(3),
                 B(Ldar), R(0),
   /*  117 E> */ B(Construct), R(3), R(0), U8(0), U8(0),
-                B(Star), R(2),
+                B(Star), R(4),
                 B(Ldar), R(this),
-  /*  117 E> */ B(ThrowSuperAlreadyCalledIfNotHole),
-                B(Mov), R(2), R(this),
+                B(ThrowSuperAlreadyCalledIfNotHole),
+                B(Mov), R(4), R(this),
   /*  126 S> */ B(Ldar), R(this),
                 B(ThrowSuperNotCalledIfHole),
                 B(LdaSmi), I8(2),
-  /*  134 E> */ B(StaNamedProperty), R(2), U8(0), U8(2),
+  /*  134 E> */ B(StaNamedProperty), R(this), U8(0), U8(2),
                 B(Ldar), R(this),
                 B(ThrowSuperNotCalledIfHole),
   /*  139 S> */ B(Return),
diff --git a/deps/v8/test/cctest/interpreter/bytecode_expectations/ClassDeclarations.golden b/deps/v8/test/cctest/interpreter/bytecode_expectations/ClassDeclarations.golden
index ab03cea4914b5f..737d423fcbef0c 100644
--- a/deps/v8/test/cctest/interpreter/bytecode_expectations/ClassDeclarations.golden
+++ b/deps/v8/test/cctest/interpreter/bytecode_expectations/ClassDeclarations.golden
@@ -88,33 +88,33 @@ snippet: "
 "
 frame size: 11
 parameter count: 1
-bytecode array length: 75
+bytecode array length: 77
 bytecodes: [
-                B(CreateFunctionContext), U8(2),
+                B(CreateFunctionContext), U8(0), U8(2),
                 B(PushContext), R(2),
   /*   30 E> */ B(StackCheck),
-  /*   43 S> */ B(LdaConstant), U8(0),
+  /*   43 S> */ B(LdaConstant), U8(1),
   /*   43 E> */ B(StaCurrentContextSlot), U8(4),
-  /*   57 S> */ B(LdaConstant), U8(1),
+  /*   57 S> */ B(LdaConstant), U8(2),
   /*   57 E> */ B(StaCurrentContextSlot), U8(5),
                 B(LdaTheHole),
                 B(Star), R(6),
-                B(CreateClosure), U8(3), U8(0), U8(2),
+                B(CreateClosure), U8(4), U8(0), U8(2),
                 B(Star), R(3),
-                B(LdaConstant), U8(2),
+                B(LdaConstant), U8(3),
                 B(Star), R(4),
                 B(LdaImmutableCurrentContextSlot), U8(4),
   /*   75 E> */ B(ToName), R(7),
-                B(CreateClosure), U8(4), U8(1), U8(2),
+                B(CreateClosure), U8(5), U8(1), U8(2),
                 B(Star), R(8),
                 B(LdaImmutableCurrentContextSlot), U8(5),
   /*  106 E> */ B(ToName), R(9),
-                B(LdaConstant), U8(5),
-                B(TestEqualStrictNoFeedback), R(9),
+                B(LdaConstant), U8(6),
+                B(TestEqualStrict), R(9), U8(2),
                 B(Mov), R(3), R(5),
                 B(JumpIfFalse), U8(7),
                 B(CallRuntime), U16(Runtime::kThrowStaticPrototypeError), R(0), U8(0),
-                B(CreateClosure), U8(6), U8(2), U8(2),
+                B(CreateClosure), U8(7), U8(3), U8(2),
                 B(Star), R(10),
                 B(CallRuntime), U16(Runtime::kDefineClass), R(4), U8(7),
                 B(Star), R(4),
@@ -124,6 +124,7 @@ bytecodes: [
   /*  129 S> */ B(Return),
 ]
 constant pool: [
+  SCOPE_INFO_TYPE,
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["a"],
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["b"],
   FIXED_ARRAY_TYPE,
@@ -143,18 +144,18 @@ snippet: "
 "
 frame size: 7
 parameter count: 1
-bytecode array length: 45
+bytecode array length: 46
 bytecodes: [
-                B(CreateFunctionContext), U8(1),
+                B(CreateFunctionContext), U8(0), U8(1),
                 B(PushContext), R(2),
   /*   30 E> */ B(StackCheck),
   /*   46 S> */ B(LdaZero),
   /*   46 E> */ B(StaCurrentContextSlot), U8(4),
                 B(LdaTheHole),
                 B(Star), R(6),
-                B(CreateClosure), U8(1), U8(0), U8(2),
+                B(CreateClosure), U8(2), U8(0), U8(2),
                 B(Star), R(3),
-                B(LdaConstant), U8(0),
+                B(LdaConstant), U8(1),
                 B(Star), R(4),
                 B(Mov), R(3), R(5),
                 B(CallRuntime), U16(Runtime::kDefineClass), R(4), U8(3),
@@ -166,6 +167,7 @@ bytecodes: [
   /*  102 S> */ B(Return),
 ]
 constant pool: [
+  SCOPE_INFO_TYPE,
   FIXED_ARRAY_TYPE,
   SHARED_FUNCTION_INFO_TYPE,
 ]
diff --git a/deps/v8/test/cctest/interpreter/bytecode_expectations/CompoundExpressions.golden b/deps/v8/test/cctest/interpreter/bytecode_expectations/CompoundExpressions.golden
index fe645f1ea38e06..311dd164d8f7f3 100644
--- a/deps/v8/test/cctest/interpreter/bytecode_expectations/CompoundExpressions.golden
+++ b/deps/v8/test/cctest/interpreter/bytecode_expectations/CompoundExpressions.golden
@@ -65,7 +65,7 @@ bytecodes: [
   /*   67 S> */ B(Return),
 ]
 constant pool: [
-  BOILERPLATE_DESCRIPTION_TYPE,
+  OBJECT_BOILERPLATE_DESCRIPTION_TYPE,
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["name"],
 ]
 handlers: [
@@ -91,7 +91,7 @@ bytecodes: [
   /*   63 S> */ B(Return),
 ]
 constant pool: [
-  BOILERPLATE_DESCRIPTION_TYPE,
+  OBJECT_BOILERPLATE_DESCRIPTION_TYPE,
 ]
 handlers: [
 ]
@@ -102,14 +102,14 @@ snippet: "
 "
 frame size: 1
 parameter count: 1
-bytecode array length: 22
+bytecode array length: 23
 bytecodes: [
-                B(CreateFunctionContext), U8(1),
+                B(CreateFunctionContext), U8(0), U8(1),
                 B(PushContext), R(0),
   /*   30 E> */ B(StackCheck),
   /*   42 S> */ B(LdaSmi), I8(1),
   /*   42 E> */ B(StaCurrentContextSlot), U8(4),
-  /*   45 S> */ B(CreateClosure), U8(0), U8(0), U8(2),
+  /*   45 S> */ B(CreateClosure), U8(1), U8(0), U8(2),
   /*   75 S> */ B(LdaCurrentContextSlot), U8(4),
                 B(BitwiseOrSmi), I8(24), U8(1),
   /*   77 E> */ B(StaCurrentContextSlot), U8(4),
@@ -117,6 +117,7 @@ bytecodes: [
   /*   84 S> */ B(Return),
 ]
 constant pool: [
+  SCOPE_INFO_TYPE,
   SHARED_FUNCTION_INFO_TYPE,
 ]
 handlers: [
diff --git a/deps/v8/test/cctest/interpreter/bytecode_expectations/ConstVariableContextSlot.golden b/deps/v8/test/cctest/interpreter/bytecode_expectations/ConstVariableContextSlot.golden
index dbbd8732e58755..73e7e0d8e0c956 100644
--- a/deps/v8/test/cctest/interpreter/bytecode_expectations/ConstVariableContextSlot.golden
+++ b/deps/v8/test/cctest/interpreter/bytecode_expectations/ConstVariableContextSlot.golden
@@ -11,13 +11,13 @@ snippet: "
 "
 frame size: 2
 parameter count: 1
-bytecode array length: 20
+bytecode array length: 21
 bytecodes: [
-                B(CreateFunctionContext), U8(1),
+                B(CreateFunctionContext), U8(0), U8(1),
                 B(PushContext), R(1),
                 B(LdaTheHole),
                 B(StaCurrentContextSlot), U8(4),
-                B(CreateClosure), U8(0), U8(0), U8(2),
+                B(CreateClosure), U8(1), U8(0), U8(2),
                 B(Star), R(0),
   /*   30 E> */ B(StackCheck),
   /*   44 S> */ B(LdaSmi), I8(10),
@@ -26,6 +26,7 @@ bytecodes: [
   /*   74 S> */ B(Return),
 ]
 constant pool: [
+  SCOPE_INFO_TYPE,
   SHARED_FUNCTION_INFO_TYPE,
 ]
 handlers: [
@@ -37,13 +38,13 @@ snippet: "
 "
 frame size: 2
 parameter count: 1
-bytecode array length: 21
+bytecode array length: 22
 bytecodes: [
-                B(CreateFunctionContext), U8(1),
+                B(CreateFunctionContext), U8(0), U8(1),
                 B(PushContext), R(1),
                 B(LdaTheHole),
                 B(StaCurrentContextSlot), U8(4),
-                B(CreateClosure), U8(0), U8(0), U8(2),
+                B(CreateClosure), U8(1), U8(0), U8(2),
                 B(Star), R(0),
   /*   30 E> */ B(StackCheck),
   /*   44 S> */ B(LdaSmi), I8(10),
@@ -52,6 +53,7 @@ bytecodes: [
   /*   83 S> */ B(Return),
 ]
 constant pool: [
+  SCOPE_INFO_TYPE,
   SHARED_FUNCTION_INFO_TYPE,
 ]
 handlers: [
@@ -63,25 +65,26 @@ snippet: "
 "
 frame size: 3
 parameter count: 1
-bytecode array length: 31
+bytecode array length: 32
 bytecodes: [
-                B(CreateFunctionContext), U8(1),
+                B(CreateFunctionContext), U8(0), U8(1),
                 B(PushContext), R(1),
                 B(LdaTheHole),
                 B(StaCurrentContextSlot), U8(4),
-                B(CreateClosure), U8(0), U8(0), U8(2),
+                B(CreateClosure), U8(1), U8(0), U8(2),
                 B(Star), R(0),
   /*   30 E> */ B(StackCheck),
   /*   44 S> */ B(LdaSmi), I8(20),
                 B(Star), R(2),
                 B(LdaCurrentContextSlot), U8(4),
-  /*   47 E> */ B(ThrowReferenceErrorIfHole), U8(1),
+  /*   47 E> */ B(ThrowReferenceErrorIfHole), U8(2),
                 B(CallRuntime), U16(Runtime::kThrowConstAssignError), R(0), U8(0),
   /*   44 E> */ B(StaCurrentContextSlot), U8(4),
                 B(LdaUndefined),
   /*   80 S> */ B(Return),
 ]
 constant pool: [
+  SCOPE_INFO_TYPE,
   SHARED_FUNCTION_INFO_TYPE,
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["x"],
 ]
@@ -94,13 +97,13 @@ snippet: "
 "
 frame size: 2
 parameter count: 1
-bytecode array length: 27
+bytecode array length: 28
 bytecodes: [
-                B(CreateFunctionContext), U8(1),
+                B(CreateFunctionContext), U8(0), U8(1),
                 B(PushContext), R(1),
                 B(LdaTheHole),
                 B(StaCurrentContextSlot), U8(4),
-                B(CreateClosure), U8(0), U8(0), U8(2),
+                B(CreateClosure), U8(1), U8(0), U8(2),
                 B(Star), R(0),
   /*   30 E> */ B(StackCheck),
   /*   44 S> */ B(LdaSmi), I8(10),
@@ -111,6 +114,7 @@ bytecodes: [
   /*   82 S> */ B(Return),
 ]
 constant pool: [
+  SCOPE_INFO_TYPE,
   SHARED_FUNCTION_INFO_TYPE,
 ]
 handlers: [
diff --git a/deps/v8/test/cctest/interpreter/bytecode_expectations/ContextParameters.golden b/deps/v8/test/cctest/interpreter/bytecode_expectations/ContextParameters.golden
index 0f665bbc8edbba..6e9969db079ffa 100644
--- a/deps/v8/test/cctest/interpreter/bytecode_expectations/ContextParameters.golden
+++ b/deps/v8/test/cctest/interpreter/bytecode_expectations/ContextParameters.golden
@@ -13,17 +13,18 @@ snippet: "
 "
 frame size: 1
 parameter count: 2
-bytecode array length: 14
+bytecode array length: 15
 bytecodes: [
-                B(CreateFunctionContext), U8(1),
+                B(CreateFunctionContext), U8(0), U8(1),
                 B(PushContext), R(0),
                 B(Ldar), R(arg0),
                 B(StaCurrentContextSlot), U8(4),
   /*   10 E> */ B(StackCheck),
-  /*   19 S> */ B(CreateClosure), U8(0), U8(0), U8(2),
+  /*   19 S> */ B(CreateClosure), U8(1), U8(0), U8(2),
   /*   51 S> */ B(Return),
 ]
 constant pool: [
+  SCOPE_INFO_TYPE,
   SHARED_FUNCTION_INFO_TYPE,
 ]
 handlers: [
@@ -36,19 +37,20 @@ snippet: "
 "
 frame size: 2
 parameter count: 2
-bytecode array length: 18
+bytecode array length: 19
 bytecodes: [
-                B(CreateFunctionContext), U8(1),
+                B(CreateFunctionContext), U8(0), U8(1),
                 B(PushContext), R(1),
                 B(Ldar), R(arg0),
                 B(StaCurrentContextSlot), U8(4),
   /*   10 E> */ B(StackCheck),
-  /*   27 S> */ B(CreateClosure), U8(0), U8(0), U8(2),
+  /*   27 S> */ B(CreateClosure), U8(1), U8(0), U8(2),
                 B(Star), R(0),
   /*   53 S> */ B(LdaCurrentContextSlot), U8(4),
   /*   65 S> */ B(Return),
 ]
 constant pool: [
+  SCOPE_INFO_TYPE,
   SHARED_FUNCTION_INFO_TYPE,
 ]
 handlers: [
@@ -61,19 +63,20 @@ snippet: "
 "
 frame size: 1
 parameter count: 5
-bytecode array length: 18
+bytecode array length: 19
 bytecodes: [
-                B(CreateFunctionContext), U8(2),
+                B(CreateFunctionContext), U8(0), U8(2),
                 B(PushContext), R(0),
                 B(Ldar), R(arg0),
                 B(StaCurrentContextSlot), U8(5),
                 B(Ldar), R(arg2),
                 B(StaCurrentContextSlot), U8(4),
   /*   10 E> */ B(StackCheck),
-  /*   29 S> */ B(CreateClosure), U8(0), U8(0), U8(2),
+  /*   29 S> */ B(CreateClosure), U8(1), U8(0), U8(2),
   /*   60 S> */ B(Return),
 ]
 constant pool: [
+  SCOPE_INFO_TYPE,
   SHARED_FUNCTION_INFO_TYPE,
 ]
 handlers: [
@@ -86,17 +89,18 @@ snippet: "
 "
 frame size: 1
 parameter count: 1
-bytecode array length: 14
+bytecode array length: 15
 bytecodes: [
-                B(CreateFunctionContext), U8(1),
+                B(CreateFunctionContext), U8(0), U8(1),
                 B(PushContext), R(0),
   /*   10 E> */ B(StackCheck),
   /*   26 S> */ B(Ldar), R(this),
   /*   26 E> */ B(StaCurrentContextSlot), U8(4),
-  /*   32 S> */ B(CreateClosure), U8(0), U8(0), U8(2),
+  /*   32 S> */ B(CreateClosure), U8(1), U8(0), U8(2),
   /*   64 S> */ B(Return),
 ]
 constant pool: [
+  SCOPE_INFO_TYPE,
   SHARED_FUNCTION_INFO_TYPE,
 ]
 handlers: [
diff --git a/deps/v8/test/cctest/interpreter/bytecode_expectations/ContextVariables.golden b/deps/v8/test/cctest/interpreter/bytecode_expectations/ContextVariables.golden
index 1664f865c3a37d..3de7ba33674491 100644
--- a/deps/v8/test/cctest/interpreter/bytecode_expectations/ContextVariables.golden
+++ b/deps/v8/test/cctest/interpreter/bytecode_expectations/ContextVariables.golden
@@ -11,15 +11,16 @@ snippet: "
 "
 frame size: 1
 parameter count: 1
-bytecode array length: 10
+bytecode array length: 11
 bytecodes: [
-                B(CreateFunctionContext), U8(1),
+                B(CreateFunctionContext), U8(0), U8(1),
                 B(PushContext), R(0),
   /*   30 E> */ B(StackCheck),
-  /*   41 S> */ B(CreateClosure), U8(0), U8(0), U8(2),
+  /*   41 S> */ B(CreateClosure), U8(1), U8(0), U8(2),
   /*   70 S> */ B(Return),
 ]
 constant pool: [
+  SCOPE_INFO_TYPE,
   SHARED_FUNCTION_INFO_TYPE,
 ]
 handlers: [
@@ -31,17 +32,18 @@ snippet: "
 "
 frame size: 1
 parameter count: 1
-bytecode array length: 14
+bytecode array length: 15
 bytecodes: [
-                B(CreateFunctionContext), U8(1),
+                B(CreateFunctionContext), U8(0), U8(1),
                 B(PushContext), R(0),
   /*   30 E> */ B(StackCheck),
   /*   42 S> */ B(LdaSmi), I8(1),
   /*   42 E> */ B(StaCurrentContextSlot), U8(4),
-  /*   45 S> */ B(CreateClosure), U8(0), U8(0), U8(2),
+  /*   45 S> */ B(CreateClosure), U8(1), U8(0), U8(2),
   /*   74 S> */ B(Return),
 ]
 constant pool: [
+  SCOPE_INFO_TYPE,
   SHARED_FUNCTION_INFO_TYPE,
 ]
 handlers: [
@@ -53,19 +55,20 @@ snippet: "
 "
 frame size: 1
 parameter count: 1
-bytecode array length: 18
+bytecode array length: 19
 bytecodes: [
-                B(CreateFunctionContext), U8(2),
+                B(CreateFunctionContext), U8(0), U8(2),
                 B(PushContext), R(0),
   /*   30 E> */ B(StackCheck),
   /*   42 S> */ B(LdaSmi), I8(1),
   /*   42 E> */ B(StaCurrentContextSlot), U8(4),
   /*   53 S> */ B(LdaSmi), I8(2),
   /*   53 E> */ B(StaCurrentContextSlot), U8(5),
-  /*   56 S> */ B(CreateClosure), U8(0), U8(0), U8(2),
+  /*   56 S> */ B(CreateClosure), U8(1), U8(0), U8(2),
   /*   91 S> */ B(Return),
 ]
 constant pool: [
+  SCOPE_INFO_TYPE,
   SHARED_FUNCTION_INFO_TYPE,
 ]
 handlers: [
@@ -77,18 +80,19 @@ snippet: "
 "
 frame size: 2
 parameter count: 1
-bytecode array length: 17
+bytecode array length: 18
 bytecodes: [
-                B(CreateFunctionContext), U8(1),
+                B(CreateFunctionContext), U8(0), U8(1),
                 B(PushContext), R(0),
   /*   30 E> */ B(StackCheck),
-  /*   41 S> */ B(CreateClosure), U8(0), U8(0), U8(2),
+  /*   41 S> */ B(CreateClosure), U8(1), U8(0), U8(2),
                 B(Star), R(1),
   /*   64 E> */ B(CallUndefinedReceiver0), R(1), U8(1),
   /*   68 S> */ B(LdaCurrentContextSlot), U8(4),
   /*   77 S> */ B(Return),
 ]
 constant pool: [
+  SCOPE_INFO_TYPE,
   SHARED_FUNCTION_INFO_TYPE,
 ]
 handlers: [
@@ -102,26 +106,26 @@ snippet: "
 "
 frame size: 2
 parameter count: 1
-bytecode array length: 30
+bytecode array length: 29
 bytecodes: [
-                B(CreateFunctionContext), U8(1),
+                B(CreateFunctionContext), U8(0), U8(1),
                 B(PushContext), R(0),
                 B(LdaTheHole),
                 B(StaCurrentContextSlot), U8(4),
   /*   30 E> */ B(StackCheck),
   /*   56 S> */ B(LdaSmi), I8(1),
   /*   56 E> */ B(StaCurrentContextSlot), U8(4),
-                B(Ldar), R(closure),
-                B(CreateBlockContext), U8(0),
+                B(CreateBlockContext), U8(1),
                 B(PushContext), R(1),
                 B(LdaTheHole),
                 B(StaCurrentContextSlot), U8(4),
   /*   69 S> */ B(LdaSmi), I8(2),
   /*   69 E> */ B(StaCurrentContextSlot), U8(4),
-  /*   72 S> */ B(CreateClosure), U8(1), U8(0), U8(2),
+  /*   72 S> */ B(CreateClosure), U8(2), U8(0), U8(2),
   /*  101 S> */ B(Return),
 ]
 constant pool: [
+  SCOPE_INFO_TYPE,
   SCOPE_INFO_TYPE,
   SHARED_FUNCTION_INFO_TYPE,
 ]
@@ -131,265 +135,265 @@ handlers: [
 ---
 snippet: "
   'use strict';
-  var a0 = 0;
-  var a1 = 0;
-  var a2 = 0;
-  var a3 = 0;
-  var a4 = 0;
-  var a5 = 0;
-  var a6 = 0;
-  var a7 = 0;
-  var a8 = 0;
-  var a9 = 0;
-  var a10 = 0;
-  var a11 = 0;
-  var a12 = 0;
-  var a13 = 0;
-  var a14 = 0;
-  var a15 = 0;
-  var a16 = 0;
-  var a17 = 0;
-  var a18 = 0;
-  var a19 = 0;
-  var a20 = 0;
-  var a21 = 0;
-  var a22 = 0;
-  var a23 = 0;
-  var a24 = 0;
-  var a25 = 0;
-  var a26 = 0;
-  var a27 = 0;
-  var a28 = 0;
-  var a29 = 0;
-  var a30 = 0;
-  var a31 = 0;
-  var a32 = 0;
-  var a33 = 0;
-  var a34 = 0;
-  var a35 = 0;
-  var a36 = 0;
-  var a37 = 0;
-  var a38 = 0;
-  var a39 = 0;
-  var a40 = 0;
-  var a41 = 0;
-  var a42 = 0;
-  var a43 = 0;
-  var a44 = 0;
-  var a45 = 0;
-  var a46 = 0;
-  var a47 = 0;
-  var a48 = 0;
-  var a49 = 0;
-  var a50 = 0;
-  var a51 = 0;
-  var a52 = 0;
-  var a53 = 0;
-  var a54 = 0;
-  var a55 = 0;
-  var a56 = 0;
-  var a57 = 0;
-  var a58 = 0;
-  var a59 = 0;
-  var a60 = 0;
-  var a61 = 0;
-  var a62 = 0;
-  var a63 = 0;
-  var a64 = 0;
-  var a65 = 0;
-  var a66 = 0;
-  var a67 = 0;
-  var a68 = 0;
-  var a69 = 0;
-  var a70 = 0;
-  var a71 = 0;
-  var a72 = 0;
-  var a73 = 0;
-  var a74 = 0;
-  var a75 = 0;
-  var a76 = 0;
-  var a77 = 0;
-  var a78 = 0;
-  var a79 = 0;
-  var a80 = 0;
-  var a81 = 0;
-  var a82 = 0;
-  var a83 = 0;
-  var a84 = 0;
-  var a85 = 0;
-  var a86 = 0;
-  var a87 = 0;
-  var a88 = 0;
-  var a89 = 0;
-  var a90 = 0;
-  var a91 = 0;
-  var a92 = 0;
-  var a93 = 0;
-  var a94 = 0;
-  var a95 = 0;
-  var a96 = 0;
-  var a97 = 0;
-  var a98 = 0;
-  var a99 = 0;
-  var a100 = 0;
-  var a101 = 0;
-  var a102 = 0;
-  var a103 = 0;
-  var a104 = 0;
-  var a105 = 0;
-  var a106 = 0;
-  var a107 = 0;
-  var a108 = 0;
-  var a109 = 0;
-  var a110 = 0;
-  var a111 = 0;
-  var a112 = 0;
-  var a113 = 0;
-  var a114 = 0;
-  var a115 = 0;
-  var a116 = 0;
-  var a117 = 0;
-  var a118 = 0;
-  var a119 = 0;
-  var a120 = 0;
-  var a121 = 0;
-  var a122 = 0;
-  var a123 = 0;
-  var a124 = 0;
-  var a125 = 0;
-  var a126 = 0;
-  var a127 = 0;
-  var a128 = 0;
-  var a129 = 0;
-  var a130 = 0;
-  var a131 = 0;
-  var a132 = 0;
-  var a133 = 0;
-  var a134 = 0;
-  var a135 = 0;
-  var a136 = 0;
-  var a137 = 0;
-  var a138 = 0;
-  var a139 = 0;
-  var a140 = 0;
-  var a141 = 0;
-  var a142 = 0;
-  var a143 = 0;
-  var a144 = 0;
-  var a145 = 0;
-  var a146 = 0;
-  var a147 = 0;
-  var a148 = 0;
-  var a149 = 0;
-  var a150 = 0;
-  var a151 = 0;
-  var a152 = 0;
-  var a153 = 0;
-  var a154 = 0;
-  var a155 = 0;
-  var a156 = 0;
-  var a157 = 0;
-  var a158 = 0;
-  var a159 = 0;
-  var a160 = 0;
-  var a161 = 0;
-  var a162 = 0;
-  var a163 = 0;
-  var a164 = 0;
-  var a165 = 0;
-  var a166 = 0;
-  var a167 = 0;
-  var a168 = 0;
-  var a169 = 0;
-  var a170 = 0;
-  var a171 = 0;
-  var a172 = 0;
-  var a173 = 0;
-  var a174 = 0;
-  var a175 = 0;
-  var a176 = 0;
-  var a177 = 0;
-  var a178 = 0;
-  var a179 = 0;
-  var a180 = 0;
-  var a181 = 0;
-  var a182 = 0;
-  var a183 = 0;
-  var a184 = 0;
-  var a185 = 0;
-  var a186 = 0;
-  var a187 = 0;
-  var a188 = 0;
-  var a189 = 0;
-  var a190 = 0;
-  var a191 = 0;
-  var a192 = 0;
-  var a193 = 0;
-  var a194 = 0;
-  var a195 = 0;
-  var a196 = 0;
-  var a197 = 0;
-  var a198 = 0;
-  var a199 = 0;
-  var a200 = 0;
-  var a201 = 0;
-  var a202 = 0;
-  var a203 = 0;
-  var a204 = 0;
-  var a205 = 0;
-  var a206 = 0;
-  var a207 = 0;
-  var a208 = 0;
-  var a209 = 0;
-  var a210 = 0;
-  var a211 = 0;
-  var a212 = 0;
-  var a213 = 0;
-  var a214 = 0;
-  var a215 = 0;
-  var a216 = 0;
-  var a217 = 0;
-  var a218 = 0;
-  var a219 = 0;
-  var a220 = 0;
-  var a221 = 0;
-  var a222 = 0;
-  var a223 = 0;
-  var a224 = 0;
-  var a225 = 0;
-  var a226 = 0;
-  var a227 = 0;
-  var a228 = 0;
-  var a229 = 0;
-  var a230 = 0;
-  var a231 = 0;
-  var a232 = 0;
-  var a233 = 0;
-  var a234 = 0;
-  var a235 = 0;
-  var a236 = 0;
-  var a237 = 0;
-  var a238 = 0;
-  var a239 = 0;
-  var a240 = 0;
-  var a241 = 0;
-  var a242 = 0;
-  var a243 = 0;
-  var a244 = 0;
-  var a245 = 0;
-  var a246 = 0;
-  var a247 = 0;
-  var a248 = 0;
-  var a249 = 0;
+  var a896 = 0;
+  var a897 = 0;
+  var a898 = 0;
+  var a899 = 0;
+  var a900 = 0;
+  var a901 = 0;
+  var a902 = 0;
+  var a903 = 0;
+  var a904 = 0;
+  var a905 = 0;
+  var a906 = 0;
+  var a907 = 0;
+  var a908 = 0;
+  var a909 = 0;
+  var a910 = 0;
+  var a911 = 0;
+  var a912 = 0;
+  var a913 = 0;
+  var a914 = 0;
+  var a915 = 0;
+  var a916 = 0;
+  var a917 = 0;
+  var a918 = 0;
+  var a919 = 0;
+  var a920 = 0;
+  var a921 = 0;
+  var a922 = 0;
+  var a923 = 0;
+  var a924 = 0;
+  var a925 = 0;
+  var a926 = 0;
+  var a927 = 0;
+  var a928 = 0;
+  var a929 = 0;
+  var a930 = 0;
+  var a931 = 0;
+  var a932 = 0;
+  var a933 = 0;
+  var a934 = 0;
+  var a935 = 0;
+  var a936 = 0;
+  var a937 = 0;
+  var a938 = 0;
+  var a939 = 0;
+  var a940 = 0;
+  var a941 = 0;
+  var a942 = 0;
+  var a943 = 0;
+  var a944 = 0;
+  var a945 = 0;
+  var a946 = 0;
+  var a947 = 0;
+  var a948 = 0;
+  var a949 = 0;
+  var a950 = 0;
+  var a951 = 0;
+  var a952 = 0;
+  var a953 = 0;
+  var a954 = 0;
+  var a955 = 0;
+  var a956 = 0;
+  var a957 = 0;
+  var a958 = 0;
+  var a959 = 0;
+  var a960 = 0;
+  var a961 = 0;
+  var a962 = 0;
+  var a963 = 0;
+  var a964 = 0;
+  var a965 = 0;
+  var a966 = 0;
+  var a967 = 0;
+  var a968 = 0;
+  var a969 = 0;
+  var a970 = 0;
+  var a971 = 0;
+  var a972 = 0;
+  var a973 = 0;
+  var a974 = 0;
+  var a975 = 0;
+  var a976 = 0;
+  var a977 = 0;
+  var a978 = 0;
+  var a979 = 0;
+  var a980 = 0;
+  var a981 = 0;
+  var a982 = 0;
+  var a983 = 0;
+  var a984 = 0;
+  var a985 = 0;
+  var a986 = 0;
+  var a987 = 0;
+  var a988 = 0;
+  var a989 = 0;
+  var a990 = 0;
+  var a991 = 0;
+  var a992 = 0;
+  var a993 = 0;
+  var a994 = 0;
+  var a995 = 0;
+  var a996 = 0;
+  var a997 = 0;
+  var a998 = 0;
+  var a999 = 0;
+  var a1000 = 0;
+  var a1001 = 0;
+  var a1002 = 0;
+  var a1003 = 0;
+  var a1004 = 0;
+  var a1005 = 0;
+  var a1006 = 0;
+  var a1007 = 0;
+  var a1008 = 0;
+  var a1009 = 0;
+  var a1010 = 0;
+  var a1011 = 0;
+  var a1012 = 0;
+  var a1013 = 0;
+  var a1014 = 0;
+  var a1015 = 0;
+  var a1016 = 0;
+  var a1017 = 0;
+  var a1018 = 0;
+  var a1019 = 0;
+  var a1020 = 0;
+  var a1021 = 0;
+  var a1022 = 0;
+  var a1023 = 0;
+  var a1024 = 0;
+  var a1025 = 0;
+  var a1026 = 0;
+  var a1027 = 0;
+  var a1028 = 0;
+  var a1029 = 0;
+  var a1030 = 0;
+  var a1031 = 0;
+  var a1032 = 0;
+  var a1033 = 0;
+  var a1034 = 0;
+  var a1035 = 0;
+  var a1036 = 0;
+  var a1037 = 0;
+  var a1038 = 0;
+  var a1039 = 0;
+  var a1040 = 0;
+  var a1041 = 0;
+  var a1042 = 0;
+  var a1043 = 0;
+  var a1044 = 0;
+  var a1045 = 0;
+  var a1046 = 0;
+  var a1047 = 0;
+  var a1048 = 0;
+  var a1049 = 0;
+  var a1050 = 0;
+  var a1051 = 0;
+  var a1052 = 0;
+  var a1053 = 0;
+  var a1054 = 0;
+  var a1055 = 0;
+  var a1056 = 0;
+  var a1057 = 0;
+  var a1058 = 0;
+  var a1059 = 0;
+  var a1060 = 0;
+  var a1061 = 0;
+  var a1062 = 0;
+  var a1063 = 0;
+  var a1064 = 0;
+  var a1065 = 0;
+  var a1066 = 0;
+  var a1067 = 0;
+  var a1068 = 0;
+  var a1069 = 0;
+  var a1070 = 0;
+  var a1071 = 0;
+  var a1072 = 0;
+  var a1073 = 0;
+  var a1074 = 0;
+  var a1075 = 0;
+  var a1076 = 0;
+  var a1077 = 0;
+  var a1078 = 0;
+  var a1079 = 0;
+  var a1080 = 0;
+  var a1081 = 0;
+  var a1082 = 0;
+  var a1083 = 0;
+  var a1084 = 0;
+  var a1085 = 0;
+  var a1086 = 0;
+  var a1087 = 0;
+  var a1088 = 0;
+  var a1089 = 0;
+  var a1090 = 0;
+  var a1091 = 0;
+  var a1092 = 0;
+  var a1093 = 0;
+  var a1094 = 0;
+  var a1095 = 0;
+  var a1096 = 0;
+  var a1097 = 0;
+  var a1098 = 0;
+  var a1099 = 0;
+  var a1100 = 0;
+  var a1101 = 0;
+  var a1102 = 0;
+  var a1103 = 0;
+  var a1104 = 0;
+  var a1105 = 0;
+  var a1106 = 0;
+  var a1107 = 0;
+  var a1108 = 0;
+  var a1109 = 0;
+  var a1110 = 0;
+  var a1111 = 0;
+  var a1112 = 0;
+  var a1113 = 0;
+  var a1114 = 0;
+  var a1115 = 0;
+  var a1116 = 0;
+  var a1117 = 0;
+  var a1118 = 0;
+  var a1119 = 0;
+  var a1120 = 0;
+  var a1121 = 0;
+  var a1122 = 0;
+  var a1123 = 0;
+  var a1124 = 0;
+  var a1125 = 0;
+  var a1126 = 0;
+  var a1127 = 0;
+  var a1128 = 0;
+  var a1129 = 0;
+  var a1130 = 0;
+  var a1131 = 0;
+  var a1132 = 0;
+  var a1133 = 0;
+  var a1134 = 0;
+  var a1135 = 0;
+  var a1136 = 0;
+  var a1137 = 0;
+  var a1138 = 0;
+  var a1139 = 0;
+  var a1140 = 0;
+  var a1141 = 0;
+  var a1142 = 0;
+  var a1143 = 0;
+  var a1144 = 0;
+  var a1145 = 0;
   eval();
   var b = 100;
   return b
 "
 frame size: 3
 parameter count: 1
-bytecode array length: 787
+bytecode array length: 788
 bytecodes: [
-                B(CreateFunctionContext), U8(254),
+                B(CreateFunctionContext), U8(0), U8(254),
                 B(PushContext), R(1),
                 B(Ldar), R(this),
                 B(StaCurrentContextSlot), U8(4),
@@ -398,515 +402,516 @@ bytecodes: [
                 B(Ldar), R(0),
                 B(StaCurrentContextSlot), U8(5),
   /*   30 E> */ B(StackCheck),
-  /*   57 S> */ B(LdaZero),
-  /*   57 E> */ B(StaCurrentContextSlot), U8(6),
-  /*   69 S> */ B(LdaZero),
-  /*   69 E> */ B(StaCurrentContextSlot), U8(7),
-  /*   81 S> */ B(LdaZero),
-  /*   81 E> */ B(StaCurrentContextSlot), U8(8),
-  /*   93 S> */ B(LdaZero),
-  /*   93 E> */ B(StaCurrentContextSlot), U8(9),
-  /*  105 S> */ B(LdaZero),
-  /*  105 E> */ B(StaCurrentContextSlot), U8(10),
-  /*  117 S> */ B(LdaZero),
-  /*  117 E> */ B(StaCurrentContextSlot), U8(11),
+  /*   59 S> */ B(LdaZero),
+  /*   59 E> */ B(StaCurrentContextSlot), U8(6),
+  /*   73 S> */ B(LdaZero),
+  /*   73 E> */ B(StaCurrentContextSlot), U8(7),
+  /*   87 S> */ B(LdaZero),
+  /*   87 E> */ B(StaCurrentContextSlot), U8(8),
+  /*  101 S> */ B(LdaZero),
+  /*  101 E> */ B(StaCurrentContextSlot), U8(9),
+  /*  115 S> */ B(LdaZero),
+  /*  115 E> */ B(StaCurrentContextSlot), U8(10),
   /*  129 S> */ B(LdaZero),
-  /*  129 E> */ B(StaCurrentContextSlot), U8(12),
-  /*  141 S> */ B(LdaZero),
-  /*  141 E> */ B(StaCurrentContextSlot), U8(13),
-  /*  153 S> */ B(LdaZero),
-  /*  153 E> */ B(StaCurrentContextSlot), U8(14),
-  /*  165 S> */ B(LdaZero),
-  /*  165 E> */ B(StaCurrentContextSlot), U8(15),
-  /*  178 S> */ B(LdaZero),
-  /*  178 E> */ B(StaCurrentContextSlot), U8(16),
-  /*  191 S> */ B(LdaZero),
-  /*  191 E> */ B(StaCurrentContextSlot), U8(17),
-  /*  204 S> */ B(LdaZero),
-  /*  204 E> */ B(StaCurrentContextSlot), U8(18),
-  /*  217 S> */ B(LdaZero),
-  /*  217 E> */ B(StaCurrentContextSlot), U8(19),
-  /*  230 S> */ B(LdaZero),
-  /*  230 E> */ B(StaCurrentContextSlot), U8(20),
-  /*  243 S> */ B(LdaZero),
-  /*  243 E> */ B(StaCurrentContextSlot), U8(21),
-  /*  256 S> */ B(LdaZero),
-  /*  256 E> */ B(StaCurrentContextSlot), U8(22),
+  /*  129 E> */ B(StaCurrentContextSlot), U8(11),
+  /*  143 S> */ B(LdaZero),
+  /*  143 E> */ B(StaCurrentContextSlot), U8(12),
+  /*  157 S> */ B(LdaZero),
+  /*  157 E> */ B(StaCurrentContextSlot), U8(13),
+  /*  171 S> */ B(LdaZero),
+  /*  171 E> */ B(StaCurrentContextSlot), U8(14),
+  /*  185 S> */ B(LdaZero),
+  /*  185 E> */ B(StaCurrentContextSlot), U8(15),
+  /*  199 S> */ B(LdaZero),
+  /*  199 E> */ B(StaCurrentContextSlot), U8(16),
+  /*  213 S> */ B(LdaZero),
+  /*  213 E> */ B(StaCurrentContextSlot), U8(17),
+  /*  227 S> */ B(LdaZero),
+  /*  227 E> */ B(StaCurrentContextSlot), U8(18),
+  /*  241 S> */ B(LdaZero),
+  /*  241 E> */ B(StaCurrentContextSlot), U8(19),
+  /*  255 S> */ B(LdaZero),
+  /*  255 E> */ B(StaCurrentContextSlot), U8(20),
   /*  269 S> */ B(LdaZero),
-  /*  269 E> */ B(StaCurrentContextSlot), U8(23),
-  /*  282 S> */ B(LdaZero),
-  /*  282 E> */ B(StaCurrentContextSlot), U8(24),
-  /*  295 S> */ B(LdaZero),
-  /*  295 E> */ B(StaCurrentContextSlot), U8(25),
-  /*  308 S> */ B(LdaZero),
-  /*  308 E> */ B(StaCurrentContextSlot), U8(26),
-  /*  321 S> */ B(LdaZero),
-  /*  321 E> */ B(StaCurrentContextSlot), U8(27),
-  /*  334 S> */ B(LdaZero),
-  /*  334 E> */ B(StaCurrentContextSlot), U8(28),
-  /*  347 S> */ B(LdaZero),
-  /*  347 E> */ B(StaCurrentContextSlot), U8(29),
-  /*  360 S> */ B(LdaZero),
-  /*  360 E> */ B(StaCurrentContextSlot), U8(30),
-  /*  373 S> */ B(LdaZero),
-  /*  373 E> */ B(StaCurrentContextSlot), U8(31),
-  /*  386 S> */ B(LdaZero),
-  /*  386 E> */ B(StaCurrentContextSlot), U8(32),
-  /*  399 S> */ B(LdaZero),
-  /*  399 E> */ B(StaCurrentContextSlot), U8(33),
-  /*  412 S> */ B(LdaZero),
-  /*  412 E> */ B(StaCurrentContextSlot), U8(34),
-  /*  425 S> */ B(LdaZero),
-  /*  425 E> */ B(StaCurrentContextSlot), U8(35),
-  /*  438 S> */ B(LdaZero),
-  /*  438 E> */ B(StaCurrentContextSlot), U8(36),
+  /*  269 E> */ B(StaCurrentContextSlot), U8(21),
+  /*  283 S> */ B(LdaZero),
+  /*  283 E> */ B(StaCurrentContextSlot), U8(22),
+  /*  297 S> */ B(LdaZero),
+  /*  297 E> */ B(StaCurrentContextSlot), U8(23),
+  /*  311 S> */ B(LdaZero),
+  /*  311 E> */ B(StaCurrentContextSlot), U8(24),
+  /*  325 S> */ B(LdaZero),
+  /*  325 E> */ B(StaCurrentContextSlot), U8(25),
+  /*  339 S> */ B(LdaZero),
+  /*  339 E> */ B(StaCurrentContextSlot), U8(26),
+  /*  353 S> */ B(LdaZero),
+  /*  353 E> */ B(StaCurrentContextSlot), U8(27),
+  /*  367 S> */ B(LdaZero),
+  /*  367 E> */ B(StaCurrentContextSlot), U8(28),
+  /*  381 S> */ B(LdaZero),
+  /*  381 E> */ B(StaCurrentContextSlot), U8(29),
+  /*  395 S> */ B(LdaZero),
+  /*  395 E> */ B(StaCurrentContextSlot), U8(30),
+  /*  409 S> */ B(LdaZero),
+  /*  409 E> */ B(StaCurrentContextSlot), U8(31),
+  /*  423 S> */ B(LdaZero),
+  /*  423 E> */ B(StaCurrentContextSlot), U8(32),
+  /*  437 S> */ B(LdaZero),
+  /*  437 E> */ B(StaCurrentContextSlot), U8(33),
   /*  451 S> */ B(LdaZero),
-  /*  451 E> */ B(StaCurrentContextSlot), U8(37),
-  /*  464 S> */ B(LdaZero),
-  /*  464 E> */ B(StaCurrentContextSlot), U8(38),
-  /*  477 S> */ B(LdaZero),
-  /*  477 E> */ B(StaCurrentContextSlot), U8(39),
-  /*  490 S> */ B(LdaZero),
-  /*  490 E> */ B(StaCurrentContextSlot), U8(40),
-  /*  503 S> */ B(LdaZero),
-  /*  503 E> */ B(StaCurrentContextSlot), U8(41),
-  /*  516 S> */ B(LdaZero),
-  /*  516 E> */ B(StaCurrentContextSlot), U8(42),
-  /*  529 S> */ B(LdaZero),
-  /*  529 E> */ B(StaCurrentContextSlot), U8(43),
-  /*  542 S> */ B(LdaZero),
-  /*  542 E> */ B(StaCurrentContextSlot), U8(44),
-  /*  555 S> */ B(LdaZero),
-  /*  555 E> */ B(StaCurrentContextSlot), U8(45),
-  /*  568 S> */ B(LdaZero),
-  /*  568 E> */ B(StaCurrentContextSlot), U8(46),
-  /*  581 S> */ B(LdaZero),
-  /*  581 E> */ B(StaCurrentContextSlot), U8(47),
-  /*  594 S> */ B(LdaZero),
-  /*  594 E> */ B(StaCurrentContextSlot), U8(48),
-  /*  607 S> */ B(LdaZero),
-  /*  607 E> */ B(StaCurrentContextSlot), U8(49),
-  /*  620 S> */ B(LdaZero),
-  /*  620 E> */ B(StaCurrentContextSlot), U8(50),
+  /*  451 E> */ B(StaCurrentContextSlot), U8(34),
+  /*  465 S> */ B(LdaZero),
+  /*  465 E> */ B(StaCurrentContextSlot), U8(35),
+  /*  479 S> */ B(LdaZero),
+  /*  479 E> */ B(StaCurrentContextSlot), U8(36),
+  /*  493 S> */ B(LdaZero),
+  /*  493 E> */ B(StaCurrentContextSlot), U8(37),
+  /*  507 S> */ B(LdaZero),
+  /*  507 E> */ B(StaCurrentContextSlot), U8(38),
+  /*  521 S> */ B(LdaZero),
+  /*  521 E> */ B(StaCurrentContextSlot), U8(39),
+  /*  535 S> */ B(LdaZero),
+  /*  535 E> */ B(StaCurrentContextSlot), U8(40),
+  /*  549 S> */ B(LdaZero),
+  /*  549 E> */ B(StaCurrentContextSlot), U8(41),
+  /*  563 S> */ B(LdaZero),
+  /*  563 E> */ B(StaCurrentContextSlot), U8(42),
+  /*  577 S> */ B(LdaZero),
+  /*  577 E> */ B(StaCurrentContextSlot), U8(43),
+  /*  591 S> */ B(LdaZero),
+  /*  591 E> */ B(StaCurrentContextSlot), U8(44),
+  /*  605 S> */ B(LdaZero),
+  /*  605 E> */ B(StaCurrentContextSlot), U8(45),
+  /*  619 S> */ B(LdaZero),
+  /*  619 E> */ B(StaCurrentContextSlot), U8(46),
   /*  633 S> */ B(LdaZero),
-  /*  633 E> */ B(StaCurrentContextSlot), U8(51),
-  /*  646 S> */ B(LdaZero),
-  /*  646 E> */ B(StaCurrentContextSlot), U8(52),
-  /*  659 S> */ B(LdaZero),
-  /*  659 E> */ B(StaCurrentContextSlot), U8(53),
-  /*  672 S> */ B(LdaZero),
-  /*  672 E> */ B(StaCurrentContextSlot), U8(54),
-  /*  685 S> */ B(LdaZero),
-  /*  685 E> */ B(StaCurrentContextSlot), U8(55),
-  /*  698 S> */ B(LdaZero),
-  /*  698 E> */ B(StaCurrentContextSlot), U8(56),
-  /*  711 S> */ B(LdaZero),
-  /*  711 E> */ B(StaCurrentContextSlot), U8(57),
-  /*  724 S> */ B(LdaZero),
-  /*  724 E> */ B(StaCurrentContextSlot), U8(58),
-  /*  737 S> */ B(LdaZero),
-  /*  737 E> */ B(StaCurrentContextSlot), U8(59),
-  /*  750 S> */ B(LdaZero),
-  /*  750 E> */ B(StaCurrentContextSlot), U8(60),
-  /*  763 S> */ B(LdaZero),
-  /*  763 E> */ B(StaCurrentContextSlot), U8(61),
-  /*  776 S> */ B(LdaZero),
-  /*  776 E> */ B(StaCurrentContextSlot), U8(62),
-  /*  789 S> */ B(LdaZero),
-  /*  789 E> */ B(StaCurrentContextSlot), U8(63),
-  /*  802 S> */ B(LdaZero),
-  /*  802 E> */ B(StaCurrentContextSlot), U8(64),
+  /*  633 E> */ B(StaCurrentContextSlot), U8(47),
+  /*  647 S> */ B(LdaZero),
+  /*  647 E> */ B(StaCurrentContextSlot), U8(48),
+  /*  661 S> */ B(LdaZero),
+  /*  661 E> */ B(StaCurrentContextSlot), U8(49),
+  /*  675 S> */ B(LdaZero),
+  /*  675 E> */ B(StaCurrentContextSlot), U8(50),
+  /*  689 S> */ B(LdaZero),
+  /*  689 E> */ B(StaCurrentContextSlot), U8(51),
+  /*  703 S> */ B(LdaZero),
+  /*  703 E> */ B(StaCurrentContextSlot), U8(52),
+  /*  717 S> */ B(LdaZero),
+  /*  717 E> */ B(StaCurrentContextSlot), U8(53),
+  /*  731 S> */ B(LdaZero),
+  /*  731 E> */ B(StaCurrentContextSlot), U8(54),
+  /*  745 S> */ B(LdaZero),
+  /*  745 E> */ B(StaCurrentContextSlot), U8(55),
+  /*  759 S> */ B(LdaZero),
+  /*  759 E> */ B(StaCurrentContextSlot), U8(56),
+  /*  773 S> */ B(LdaZero),
+  /*  773 E> */ B(StaCurrentContextSlot), U8(57),
+  /*  787 S> */ B(LdaZero),
+  /*  787 E> */ B(StaCurrentContextSlot), U8(58),
+  /*  801 S> */ B(LdaZero),
+  /*  801 E> */ B(StaCurrentContextSlot), U8(59),
   /*  815 S> */ B(LdaZero),
-  /*  815 E> */ B(StaCurrentContextSlot), U8(65),
-  /*  828 S> */ B(LdaZero),
-  /*  828 E> */ B(StaCurrentContextSlot), U8(66),
-  /*  841 S> */ B(LdaZero),
-  /*  841 E> */ B(StaCurrentContextSlot), U8(67),
-  /*  854 S> */ B(LdaZero),
-  /*  854 E> */ B(StaCurrentContextSlot), U8(68),
-  /*  867 S> */ B(LdaZero),
-  /*  867 E> */ B(StaCurrentContextSlot), U8(69),
-  /*  880 S> */ B(LdaZero),
-  /*  880 E> */ B(StaCurrentContextSlot), U8(70),
-  /*  893 S> */ B(LdaZero),
-  /*  893 E> */ B(StaCurrentContextSlot), U8(71),
-  /*  906 S> */ B(LdaZero),
-  /*  906 E> */ B(StaCurrentContextSlot), U8(72),
-  /*  919 S> */ B(LdaZero),
-  /*  919 E> */ B(StaCurrentContextSlot), U8(73),
-  /*  932 S> */ B(LdaZero),
-  /*  932 E> */ B(StaCurrentContextSlot), U8(74),
-  /*  945 S> */ B(LdaZero),
-  /*  945 E> */ B(StaCurrentContextSlot), U8(75),
-  /*  958 S> */ B(LdaZero),
-  /*  958 E> */ B(StaCurrentContextSlot), U8(76),
-  /*  971 S> */ B(LdaZero),
-  /*  971 E> */ B(StaCurrentContextSlot), U8(77),
-  /*  984 S> */ B(LdaZero),
-  /*  984 E> */ B(StaCurrentContextSlot), U8(78),
+  /*  815 E> */ B(StaCurrentContextSlot), U8(60),
+  /*  829 S> */ B(LdaZero),
+  /*  829 E> */ B(StaCurrentContextSlot), U8(61),
+  /*  843 S> */ B(LdaZero),
+  /*  843 E> */ B(StaCurrentContextSlot), U8(62),
+  /*  857 S> */ B(LdaZero),
+  /*  857 E> */ B(StaCurrentContextSlot), U8(63),
+  /*  871 S> */ B(LdaZero),
+  /*  871 E> */ B(StaCurrentContextSlot), U8(64),
+  /*  885 S> */ B(LdaZero),
+  /*  885 E> */ B(StaCurrentContextSlot), U8(65),
+  /*  899 S> */ B(LdaZero),
+  /*  899 E> */ B(StaCurrentContextSlot), U8(66),
+  /*  913 S> */ B(LdaZero),
+  /*  913 E> */ B(StaCurrentContextSlot), U8(67),
+  /*  927 S> */ B(LdaZero),
+  /*  927 E> */ B(StaCurrentContextSlot), U8(68),
+  /*  941 S> */ B(LdaZero),
+  /*  941 E> */ B(StaCurrentContextSlot), U8(69),
+  /*  955 S> */ B(LdaZero),
+  /*  955 E> */ B(StaCurrentContextSlot), U8(70),
+  /*  969 S> */ B(LdaZero),
+  /*  969 E> */ B(StaCurrentContextSlot), U8(71),
+  /*  983 S> */ B(LdaZero),
+  /*  983 E> */ B(StaCurrentContextSlot), U8(72),
   /*  997 S> */ B(LdaZero),
-  /*  997 E> */ B(StaCurrentContextSlot), U8(79),
-  /* 1010 S> */ B(LdaZero),
-  /* 1010 E> */ B(StaCurrentContextSlot), U8(80),
-  /* 1023 S> */ B(LdaZero),
-  /* 1023 E> */ B(StaCurrentContextSlot), U8(81),
-  /* 1036 S> */ B(LdaZero),
-  /* 1036 E> */ B(StaCurrentContextSlot), U8(82),
-  /* 1049 S> */ B(LdaZero),
-  /* 1049 E> */ B(StaCurrentContextSlot), U8(83),
-  /* 1062 S> */ B(LdaZero),
-  /* 1062 E> */ B(StaCurrentContextSlot), U8(84),
-  /* 1075 S> */ B(LdaZero),
-  /* 1075 E> */ B(StaCurrentContextSlot), U8(85),
-  /* 1088 S> */ B(LdaZero),
-  /* 1088 E> */ B(StaCurrentContextSlot), U8(86),
-  /* 1101 S> */ B(LdaZero),
-  /* 1101 E> */ B(StaCurrentContextSlot), U8(87),
-  /* 1114 S> */ B(LdaZero),
-  /* 1114 E> */ B(StaCurrentContextSlot), U8(88),
-  /* 1127 S> */ B(LdaZero),
-  /* 1127 E> */ B(StaCurrentContextSlot), U8(89),
-  /* 1140 S> */ B(LdaZero),
-  /* 1140 E> */ B(StaCurrentContextSlot), U8(90),
-  /* 1153 S> */ B(LdaZero),
-  /* 1153 E> */ B(StaCurrentContextSlot), U8(91),
-  /* 1166 S> */ B(LdaZero),
-  /* 1166 E> */ B(StaCurrentContextSlot), U8(92),
+  /*  997 E> */ B(StaCurrentContextSlot), U8(73),
+  /* 1011 S> */ B(LdaZero),
+  /* 1011 E> */ B(StaCurrentContextSlot), U8(74),
+  /* 1025 S> */ B(LdaZero),
+  /* 1025 E> */ B(StaCurrentContextSlot), U8(75),
+  /* 1039 S> */ B(LdaZero),
+  /* 1039 E> */ B(StaCurrentContextSlot), U8(76),
+  /* 1053 S> */ B(LdaZero),
+  /* 1053 E> */ B(StaCurrentContextSlot), U8(77),
+  /* 1067 S> */ B(LdaZero),
+  /* 1067 E> */ B(StaCurrentContextSlot), U8(78),
+  /* 1081 S> */ B(LdaZero),
+  /* 1081 E> */ B(StaCurrentContextSlot), U8(79),
+  /* 1095 S> */ B(LdaZero),
+  /* 1095 E> */ B(StaCurrentContextSlot), U8(80),
+  /* 1109 S> */ B(LdaZero),
+  /* 1109 E> */ B(StaCurrentContextSlot), U8(81),
+  /* 1123 S> */ B(LdaZero),
+  /* 1123 E> */ B(StaCurrentContextSlot), U8(82),
+  /* 1137 S> */ B(LdaZero),
+  /* 1137 E> */ B(StaCurrentContextSlot), U8(83),
+  /* 1151 S> */ B(LdaZero),
+  /* 1151 E> */ B(StaCurrentContextSlot), U8(84),
+  /* 1165 S> */ B(LdaZero),
+  /* 1165 E> */ B(StaCurrentContextSlot), U8(85),
   /* 1179 S> */ B(LdaZero),
-  /* 1179 E> */ B(StaCurrentContextSlot), U8(93),
-  /* 1192 S> */ B(LdaZero),
-  /* 1192 E> */ B(StaCurrentContextSlot), U8(94),
-  /* 1205 S> */ B(LdaZero),
-  /* 1205 E> */ B(StaCurrentContextSlot), U8(95),
-  /* 1218 S> */ B(LdaZero),
-  /* 1218 E> */ B(StaCurrentContextSlot), U8(96),
-  /* 1231 S> */ B(LdaZero),
-  /* 1231 E> */ B(StaCurrentContextSlot), U8(97),
-  /* 1244 S> */ B(LdaZero),
-  /* 1244 E> */ B(StaCurrentContextSlot), U8(98),
-  /* 1257 S> */ B(LdaZero),
-  /* 1257 E> */ B(StaCurrentContextSlot), U8(99),
-  /* 1270 S> */ B(LdaZero),
-  /* 1270 E> */ B(StaCurrentContextSlot), U8(100),
-  /* 1283 S> */ B(LdaZero),
-  /* 1283 E> */ B(StaCurrentContextSlot), U8(101),
-  /* 1296 S> */ B(LdaZero),
-  /* 1296 E> */ B(StaCurrentContextSlot), U8(102),
-  /* 1309 S> */ B(LdaZero),
-  /* 1309 E> */ B(StaCurrentContextSlot), U8(103),
-  /* 1322 S> */ B(LdaZero),
-  /* 1322 E> */ B(StaCurrentContextSlot), U8(104),
-  /* 1335 S> */ B(LdaZero),
-  /* 1335 E> */ B(StaCurrentContextSlot), U8(105),
-  /* 1349 S> */ B(LdaZero),
-  /* 1349 E> */ B(StaCurrentContextSlot), U8(106),
-  /* 1363 S> */ B(LdaZero),
-  /* 1363 E> */ B(StaCurrentContextSlot), U8(107),
-  /* 1377 S> */ B(LdaZero),
-  /* 1377 E> */ B(StaCurrentContextSlot), U8(108),
-  /* 1391 S> */ B(LdaZero),
-  /* 1391 E> */ B(StaCurrentContextSlot), U8(109),
-  /* 1405 S> */ B(LdaZero),
-  /* 1405 E> */ B(StaCurrentContextSlot), U8(110),
-  /* 1419 S> */ B(LdaZero),
-  /* 1419 E> */ B(StaCurrentContextSlot), U8(111),
-  /* 1433 S> */ B(LdaZero),
-  /* 1433 E> */ B(StaCurrentContextSlot), U8(112),
-  /* 1447 S> */ B(LdaZero),
-  /* 1447 E> */ B(StaCurrentContextSlot), U8(113),
-  /* 1461 S> */ B(LdaZero),
-  /* 1461 E> */ B(StaCurrentContextSlot), U8(114),
-  /* 1475 S> */ B(LdaZero),
-  /* 1475 E> */ B(StaCurrentContextSlot), U8(115),
-  /* 1489 S> */ B(LdaZero),
-  /* 1489 E> */ B(StaCurrentContextSlot), U8(116),
-  /* 1503 S> */ B(LdaZero),
-  /* 1503 E> */ B(StaCurrentContextSlot), U8(117),
-  /* 1517 S> */ B(LdaZero),
-  /* 1517 E> */ B(StaCurrentContextSlot), U8(118),
+  /* 1179 E> */ B(StaCurrentContextSlot), U8(86),
+  /* 1193 S> */ B(LdaZero),
+  /* 1193 E> */ B(StaCurrentContextSlot), U8(87),
+  /* 1207 S> */ B(LdaZero),
+  /* 1207 E> */ B(StaCurrentContextSlot), U8(88),
+  /* 1221 S> */ B(LdaZero),
+  /* 1221 E> */ B(StaCurrentContextSlot), U8(89),
+  /* 1235 S> */ B(LdaZero),
+  /* 1235 E> */ B(StaCurrentContextSlot), U8(90),
+  /* 1249 S> */ B(LdaZero),
+  /* 1249 E> */ B(StaCurrentContextSlot), U8(91),
+  /* 1263 S> */ B(LdaZero),
+  /* 1263 E> */ B(StaCurrentContextSlot), U8(92),
+  /* 1277 S> */ B(LdaZero),
+  /* 1277 E> */ B(StaCurrentContextSlot), U8(93),
+  /* 1291 S> */ B(LdaZero),
+  /* 1291 E> */ B(StaCurrentContextSlot), U8(94),
+  /* 1305 S> */ B(LdaZero),
+  /* 1305 E> */ B(StaCurrentContextSlot), U8(95),
+  /* 1319 S> */ B(LdaZero),
+  /* 1319 E> */ B(StaCurrentContextSlot), U8(96),
+  /* 1333 S> */ B(LdaZero),
+  /* 1333 E> */ B(StaCurrentContextSlot), U8(97),
+  /* 1347 S> */ B(LdaZero),
+  /* 1347 E> */ B(StaCurrentContextSlot), U8(98),
+  /* 1361 S> */ B(LdaZero),
+  /* 1361 E> */ B(StaCurrentContextSlot), U8(99),
+  /* 1375 S> */ B(LdaZero),
+  /* 1375 E> */ B(StaCurrentContextSlot), U8(100),
+  /* 1389 S> */ B(LdaZero),
+  /* 1389 E> */ B(StaCurrentContextSlot), U8(101),
+  /* 1403 S> */ B(LdaZero),
+  /* 1403 E> */ B(StaCurrentContextSlot), U8(102),
+  /* 1417 S> */ B(LdaZero),
+  /* 1417 E> */ B(StaCurrentContextSlot), U8(103),
+  /* 1431 S> */ B(LdaZero),
+  /* 1431 E> */ B(StaCurrentContextSlot), U8(104),
+  /* 1445 S> */ B(LdaZero),
+  /* 1445 E> */ B(StaCurrentContextSlot), U8(105),
+  /* 1459 S> */ B(LdaZero),
+  /* 1459 E> */ B(StaCurrentContextSlot), U8(106),
+  /* 1473 S> */ B(LdaZero),
+  /* 1473 E> */ B(StaCurrentContextSlot), U8(107),
+  /* 1487 S> */ B(LdaZero),
+  /* 1487 E> */ B(StaCurrentContextSlot), U8(108),
+  /* 1501 S> */ B(LdaZero),
+  /* 1501 E> */ B(StaCurrentContextSlot), U8(109),
+  /* 1516 S> */ B(LdaZero),
+  /* 1516 E> */ B(StaCurrentContextSlot), U8(110),
   /* 1531 S> */ B(LdaZero),
-  /* 1531 E> */ B(StaCurrentContextSlot), U8(119),
-  /* 1545 S> */ B(LdaZero),
-  /* 1545 E> */ B(StaCurrentContextSlot), U8(120),
-  /* 1559 S> */ B(LdaZero),
-  /* 1559 E> */ B(StaCurrentContextSlot), U8(121),
-  /* 1573 S> */ B(LdaZero),
-  /* 1573 E> */ B(StaCurrentContextSlot), U8(122),
-  /* 1587 S> */ B(LdaZero),
-  /* 1587 E> */ B(StaCurrentContextSlot), U8(123),
-  /* 1601 S> */ B(LdaZero),
-  /* 1601 E> */ B(StaCurrentContextSlot), U8(124),
-  /* 1615 S> */ B(LdaZero),
-  /* 1615 E> */ B(StaCurrentContextSlot), U8(125),
-  /* 1629 S> */ B(LdaZero),
-  /* 1629 E> */ B(StaCurrentContextSlot), U8(126),
-  /* 1643 S> */ B(LdaZero),
-  /* 1643 E> */ B(StaCurrentContextSlot), U8(127),
-  /* 1657 S> */ B(LdaZero),
-  /* 1657 E> */ B(StaCurrentContextSlot), U8(128),
-  /* 1671 S> */ B(LdaZero),
-  /* 1671 E> */ B(StaCurrentContextSlot), U8(129),
-  /* 1685 S> */ B(LdaZero),
-  /* 1685 E> */ B(StaCurrentContextSlot), U8(130),
-  /* 1699 S> */ B(LdaZero),
-  /* 1699 E> */ B(StaCurrentContextSlot), U8(131),
-  /* 1713 S> */ B(LdaZero),
-  /* 1713 E> */ B(StaCurrentContextSlot), U8(132),
-  /* 1727 S> */ B(LdaZero),
-  /* 1727 E> */ B(StaCurrentContextSlot), U8(133),
+  /* 1531 E> */ B(StaCurrentContextSlot), U8(111),
+  /* 1546 S> */ B(LdaZero),
+  /* 1546 E> */ B(StaCurrentContextSlot), U8(112),
+  /* 1561 S> */ B(LdaZero),
+  /* 1561 E> */ B(StaCurrentContextSlot), U8(113),
+  /* 1576 S> */ B(LdaZero),
+  /* 1576 E> */ B(StaCurrentContextSlot), U8(114),
+  /* 1591 S> */ B(LdaZero),
+  /* 1591 E> */ B(StaCurrentContextSlot), U8(115),
+  /* 1606 S> */ B(LdaZero),
+  /* 1606 E> */ B(StaCurrentContextSlot), U8(116),
+  /* 1621 S> */ B(LdaZero),
+  /* 1621 E> */ B(StaCurrentContextSlot), U8(117),
+  /* 1636 S> */ B(LdaZero),
+  /* 1636 E> */ B(StaCurrentContextSlot), U8(118),
+  /* 1651 S> */ B(LdaZero),
+  /* 1651 E> */ B(StaCurrentContextSlot), U8(119),
+  /* 1666 S> */ B(LdaZero),
+  /* 1666 E> */ B(StaCurrentContextSlot), U8(120),
+  /* 1681 S> */ B(LdaZero),
+  /* 1681 E> */ B(StaCurrentContextSlot), U8(121),
+  /* 1696 S> */ B(LdaZero),
+  /* 1696 E> */ B(StaCurrentContextSlot), U8(122),
+  /* 1711 S> */ B(LdaZero),
+  /* 1711 E> */ B(StaCurrentContextSlot), U8(123),
+  /* 1726 S> */ B(LdaZero),
+  /* 1726 E> */ B(StaCurrentContextSlot), U8(124),
   /* 1741 S> */ B(LdaZero),
-  /* 1741 E> */ B(StaCurrentContextSlot), U8(134),
-  /* 1755 S> */ B(LdaZero),
-  /* 1755 E> */ B(StaCurrentContextSlot), U8(135),
-  /* 1769 S> */ B(LdaZero),
-  /* 1769 E> */ B(StaCurrentContextSlot), U8(136),
-  /* 1783 S> */ B(LdaZero),
-  /* 1783 E> */ B(StaCurrentContextSlot), U8(137),
-  /* 1797 S> */ B(LdaZero),
-  /* 1797 E> */ B(StaCurrentContextSlot), U8(138),
-  /* 1811 S> */ B(LdaZero),
-  /* 1811 E> */ B(StaCurrentContextSlot), U8(139),
-  /* 1825 S> */ B(LdaZero),
-  /* 1825 E> */ B(StaCurrentContextSlot), U8(140),
-  /* 1839 S> */ B(LdaZero),
-  /* 1839 E> */ B(StaCurrentContextSlot), U8(141),
-  /* 1853 S> */ B(LdaZero),
-  /* 1853 E> */ B(StaCurrentContextSlot), U8(142),
-  /* 1867 S> */ B(LdaZero),
-  /* 1867 E> */ B(StaCurrentContextSlot), U8(143),
-  /* 1881 S> */ B(LdaZero),
-  /* 1881 E> */ B(StaCurrentContextSlot), U8(144),
-  /* 1895 S> */ B(LdaZero),
-  /* 1895 E> */ B(StaCurrentContextSlot), U8(145),
-  /* 1909 S> */ B(LdaZero),
-  /* 1909 E> */ B(StaCurrentContextSlot), U8(146),
-  /* 1923 S> */ B(LdaZero),
-  /* 1923 E> */ B(StaCurrentContextSlot), U8(147),
-  /* 1937 S> */ B(LdaZero),
-  /* 1937 E> */ B(StaCurrentContextSlot), U8(148),
+  /* 1741 E> */ B(StaCurrentContextSlot), U8(125),
+  /* 1756 S> */ B(LdaZero),
+  /* 1756 E> */ B(StaCurrentContextSlot), U8(126),
+  /* 1771 S> */ B(LdaZero),
+  /* 1771 E> */ B(StaCurrentContextSlot), U8(127),
+  /* 1786 S> */ B(LdaZero),
+  /* 1786 E> */ B(StaCurrentContextSlot), U8(128),
+  /* 1801 S> */ B(LdaZero),
+  /* 1801 E> */ B(StaCurrentContextSlot), U8(129),
+  /* 1816 S> */ B(LdaZero),
+  /* 1816 E> */ B(StaCurrentContextSlot), U8(130),
+  /* 1831 S> */ B(LdaZero),
+  /* 1831 E> */ B(StaCurrentContextSlot), U8(131),
+  /* 1846 S> */ B(LdaZero),
+  /* 1846 E> */ B(StaCurrentContextSlot), U8(132),
+  /* 1861 S> */ B(LdaZero),
+  /* 1861 E> */ B(StaCurrentContextSlot), U8(133),
+  /* 1876 S> */ B(LdaZero),
+  /* 1876 E> */ B(StaCurrentContextSlot), U8(134),
+  /* 1891 S> */ B(LdaZero),
+  /* 1891 E> */ B(StaCurrentContextSlot), U8(135),
+  /* 1906 S> */ B(LdaZero),
+  /* 1906 E> */ B(StaCurrentContextSlot), U8(136),
+  /* 1921 S> */ B(LdaZero),
+  /* 1921 E> */ B(StaCurrentContextSlot), U8(137),
+  /* 1936 S> */ B(LdaZero),
+  /* 1936 E> */ B(StaCurrentContextSlot), U8(138),
   /* 1951 S> */ B(LdaZero),
-  /* 1951 E> */ B(StaCurrentContextSlot), U8(149),
-  /* 1965 S> */ B(LdaZero),
-  /* 1965 E> */ B(StaCurrentContextSlot), U8(150),
-  /* 1979 S> */ B(LdaZero),
-  /* 1979 E> */ B(StaCurrentContextSlot), U8(151),
-  /* 1993 S> */ B(LdaZero),
-  /* 1993 E> */ B(StaCurrentContextSlot), U8(152),
-  /* 2007 S> */ B(LdaZero),
-  /* 2007 E> */ B(StaCurrentContextSlot), U8(153),
-  /* 2021 S> */ B(LdaZero),
-  /* 2021 E> */ B(StaCurrentContextSlot), U8(154),
-  /* 2035 S> */ B(LdaZero),
-  /* 2035 E> */ B(StaCurrentContextSlot), U8(155),
-  /* 2049 S> */ B(LdaZero),
-  /* 2049 E> */ B(StaCurrentContextSlot), U8(156),
-  /* 2063 S> */ B(LdaZero),
-  /* 2063 E> */ B(StaCurrentContextSlot), U8(157),
-  /* 2077 S> */ B(LdaZero),
-  /* 2077 E> */ B(StaCurrentContextSlot), U8(158),
-  /* 2091 S> */ B(LdaZero),
-  /* 2091 E> */ B(StaCurrentContextSlot), U8(159),
-  /* 2105 S> */ B(LdaZero),
-  /* 2105 E> */ B(StaCurrentContextSlot), U8(160),
-  /* 2119 S> */ B(LdaZero),
-  /* 2119 E> */ B(StaCurrentContextSlot), U8(161),
-  /* 2133 S> */ B(LdaZero),
-  /* 2133 E> */ B(StaCurrentContextSlot), U8(162),
-  /* 2147 S> */ B(LdaZero),
-  /* 2147 E> */ B(StaCurrentContextSlot), U8(163),
+  /* 1951 E> */ B(StaCurrentContextSlot), U8(139),
+  /* 1966 S> */ B(LdaZero),
+  /* 1966 E> */ B(StaCurrentContextSlot), U8(140),
+  /* 1981 S> */ B(LdaZero),
+  /* 1981 E> */ B(StaCurrentContextSlot), U8(141),
+  /* 1996 S> */ B(LdaZero),
+  /* 1996 E> */ B(StaCurrentContextSlot), U8(142),
+  /* 2011 S> */ B(LdaZero),
+  /* 2011 E> */ B(StaCurrentContextSlot), U8(143),
+  /* 2026 S> */ B(LdaZero),
+  /* 2026 E> */ B(StaCurrentContextSlot), U8(144),
+  /* 2041 S> */ B(LdaZero),
+  /* 2041 E> */ B(StaCurrentContextSlot), U8(145),
+  /* 2056 S> */ B(LdaZero),
+  /* 2056 E> */ B(StaCurrentContextSlot), U8(146),
+  /* 2071 S> */ B(LdaZero),
+  /* 2071 E> */ B(StaCurrentContextSlot), U8(147),
+  /* 2086 S> */ B(LdaZero),
+  /* 2086 E> */ B(StaCurrentContextSlot), U8(148),
+  /* 2101 S> */ B(LdaZero),
+  /* 2101 E> */ B(StaCurrentContextSlot), U8(149),
+  /* 2116 S> */ B(LdaZero),
+  /* 2116 E> */ B(StaCurrentContextSlot), U8(150),
+  /* 2131 S> */ B(LdaZero),
+  /* 2131 E> */ B(StaCurrentContextSlot), U8(151),
+  /* 2146 S> */ B(LdaZero),
+  /* 2146 E> */ B(StaCurrentContextSlot), U8(152),
   /* 2161 S> */ B(LdaZero),
-  /* 2161 E> */ B(StaCurrentContextSlot), U8(164),
-  /* 2175 S> */ B(LdaZero),
-  /* 2175 E> */ B(StaCurrentContextSlot), U8(165),
-  /* 2189 S> */ B(LdaZero),
-  /* 2189 E> */ B(StaCurrentContextSlot), U8(166),
-  /* 2203 S> */ B(LdaZero),
-  /* 2203 E> */ B(StaCurrentContextSlot), U8(167),
-  /* 2217 S> */ B(LdaZero),
-  /* 2217 E> */ B(StaCurrentContextSlot), U8(168),
-  /* 2231 S> */ B(LdaZero),
-  /* 2231 E> */ B(StaCurrentContextSlot), U8(169),
-  /* 2245 S> */ B(LdaZero),
-  /* 2245 E> */ B(StaCurrentContextSlot), U8(170),
-  /* 2259 S> */ B(LdaZero),
-  /* 2259 E> */ B(StaCurrentContextSlot), U8(171),
-  /* 2273 S> */ B(LdaZero),
-  /* 2273 E> */ B(StaCurrentContextSlot), U8(172),
-  /* 2287 S> */ B(LdaZero),
-  /* 2287 E> */ B(StaCurrentContextSlot), U8(173),
-  /* 2301 S> */ B(LdaZero),
-  /* 2301 E> */ B(StaCurrentContextSlot), U8(174),
-  /* 2315 S> */ B(LdaZero),
-  /* 2315 E> */ B(StaCurrentContextSlot), U8(175),
-  /* 2329 S> */ B(LdaZero),
-  /* 2329 E> */ B(StaCurrentContextSlot), U8(176),
-  /* 2343 S> */ B(LdaZero),
-  /* 2343 E> */ B(StaCurrentContextSlot), U8(177),
-  /* 2357 S> */ B(LdaZero),
-  /* 2357 E> */ B(StaCurrentContextSlot), U8(178),
+  /* 2161 E> */ B(StaCurrentContextSlot), U8(153),
+  /* 2176 S> */ B(LdaZero),
+  /* 2176 E> */ B(StaCurrentContextSlot), U8(154),
+  /* 2191 S> */ B(LdaZero),
+  /* 2191 E> */ B(StaCurrentContextSlot), U8(155),
+  /* 2206 S> */ B(LdaZero),
+  /* 2206 E> */ B(StaCurrentContextSlot), U8(156),
+  /* 2221 S> */ B(LdaZero),
+  /* 2221 E> */ B(StaCurrentContextSlot), U8(157),
+  /* 2236 S> */ B(LdaZero),
+  /* 2236 E> */ B(StaCurrentContextSlot), U8(158),
+  /* 2251 S> */ B(LdaZero),
+  /* 2251 E> */ B(StaCurrentContextSlot), U8(159),
+  /* 2266 S> */ B(LdaZero),
+  /* 2266 E> */ B(StaCurrentContextSlot), U8(160),
+  /* 2281 S> */ B(LdaZero),
+  /* 2281 E> */ B(StaCurrentContextSlot), U8(161),
+  /* 2296 S> */ B(LdaZero),
+  /* 2296 E> */ B(StaCurrentContextSlot), U8(162),
+  /* 2311 S> */ B(LdaZero),
+  /* 2311 E> */ B(StaCurrentContextSlot), U8(163),
+  /* 2326 S> */ B(LdaZero),
+  /* 2326 E> */ B(StaCurrentContextSlot), U8(164),
+  /* 2341 S> */ B(LdaZero),
+  /* 2341 E> */ B(StaCurrentContextSlot), U8(165),
+  /* 2356 S> */ B(LdaZero),
+  /* 2356 E> */ B(StaCurrentContextSlot), U8(166),
   /* 2371 S> */ B(LdaZero),
-  /* 2371 E> */ B(StaCurrentContextSlot), U8(179),
-  /* 2385 S> */ B(LdaZero),
-  /* 2385 E> */ B(StaCurrentContextSlot), U8(180),
-  /* 2399 S> */ B(LdaZero),
-  /* 2399 E> */ B(StaCurrentContextSlot), U8(181),
-  /* 2413 S> */ B(LdaZero),
-  /* 2413 E> */ B(StaCurrentContextSlot), U8(182),
-  /* 2427 S> */ B(LdaZero),
-  /* 2427 E> */ B(StaCurrentContextSlot), U8(183),
-  /* 2441 S> */ B(LdaZero),
-  /* 2441 E> */ B(StaCurrentContextSlot), U8(184),
-  /* 2455 S> */ B(LdaZero),
-  /* 2455 E> */ B(StaCurrentContextSlot), U8(185),
-  /* 2469 S> */ B(LdaZero),
-  /* 2469 E> */ B(StaCurrentContextSlot), U8(186),
-  /* 2483 S> */ B(LdaZero),
-  /* 2483 E> */ B(StaCurrentContextSlot), U8(187),
-  /* 2497 S> */ B(LdaZero),
-  /* 2497 E> */ B(StaCurrentContextSlot), U8(188),
-  /* 2511 S> */ B(LdaZero),
-  /* 2511 E> */ B(StaCurrentContextSlot), U8(189),
-  /* 2525 S> */ B(LdaZero),
-  /* 2525 E> */ B(StaCurrentContextSlot), U8(190),
-  /* 2539 S> */ B(LdaZero),
-  /* 2539 E> */ B(StaCurrentContextSlot), U8(191),
-  /* 2553 S> */ B(LdaZero),
-  /* 2553 E> */ B(StaCurrentContextSlot), U8(192),
-  /* 2567 S> */ B(LdaZero),
-  /* 2567 E> */ B(StaCurrentContextSlot), U8(193),
+  /* 2371 E> */ B(StaCurrentContextSlot), U8(167),
+  /* 2386 S> */ B(LdaZero),
+  /* 2386 E> */ B(StaCurrentContextSlot), U8(168),
+  /* 2401 S> */ B(LdaZero),
+  /* 2401 E> */ B(StaCurrentContextSlot), U8(169),
+  /* 2416 S> */ B(LdaZero),
+  /* 2416 E> */ B(StaCurrentContextSlot), U8(170),
+  /* 2431 S> */ B(LdaZero),
+  /* 2431 E> */ B(StaCurrentContextSlot), U8(171),
+  /* 2446 S> */ B(LdaZero),
+  /* 2446 E> */ B(StaCurrentContextSlot), U8(172),
+  /* 2461 S> */ B(LdaZero),
+  /* 2461 E> */ B(StaCurrentContextSlot), U8(173),
+  /* 2476 S> */ B(LdaZero),
+  /* 2476 E> */ B(StaCurrentContextSlot), U8(174),
+  /* 2491 S> */ B(LdaZero),
+  /* 2491 E> */ B(StaCurrentContextSlot), U8(175),
+  /* 2506 S> */ B(LdaZero),
+  /* 2506 E> */ B(StaCurrentContextSlot), U8(176),
+  /* 2521 S> */ B(LdaZero),
+  /* 2521 E> */ B(StaCurrentContextSlot), U8(177),
+  /* 2536 S> */ B(LdaZero),
+  /* 2536 E> */ B(StaCurrentContextSlot), U8(178),
+  /* 2551 S> */ B(LdaZero),
+  /* 2551 E> */ B(StaCurrentContextSlot), U8(179),
+  /* 2566 S> */ B(LdaZero),
+  /* 2566 E> */ B(StaCurrentContextSlot), U8(180),
   /* 2581 S> */ B(LdaZero),
-  /* 2581 E> */ B(StaCurrentContextSlot), U8(194),
-  /* 2595 S> */ B(LdaZero),
-  /* 2595 E> */ B(StaCurrentContextSlot), U8(195),
-  /* 2609 S> */ B(LdaZero),
-  /* 2609 E> */ B(StaCurrentContextSlot), U8(196),
-  /* 2623 S> */ B(LdaZero),
-  /* 2623 E> */ B(StaCurrentContextSlot), U8(197),
-  /* 2637 S> */ B(LdaZero),
-  /* 2637 E> */ B(StaCurrentContextSlot), U8(198),
-  /* 2651 S> */ B(LdaZero),
-  /* 2651 E> */ B(StaCurrentContextSlot), U8(199),
-  /* 2665 S> */ B(LdaZero),
-  /* 2665 E> */ B(StaCurrentContextSlot), U8(200),
-  /* 2679 S> */ B(LdaZero),
-  /* 2679 E> */ B(StaCurrentContextSlot), U8(201),
-  /* 2693 S> */ B(LdaZero),
-  /* 2693 E> */ B(StaCurrentContextSlot), U8(202),
-  /* 2707 S> */ B(LdaZero),
-  /* 2707 E> */ B(StaCurrentContextSlot), U8(203),
-  /* 2721 S> */ B(LdaZero),
-  /* 2721 E> */ B(StaCurrentContextSlot), U8(204),
-  /* 2735 S> */ B(LdaZero),
-  /* 2735 E> */ B(StaCurrentContextSlot), U8(205),
-  /* 2749 S> */ B(LdaZero),
-  /* 2749 E> */ B(StaCurrentContextSlot), U8(206),
-  /* 2763 S> */ B(LdaZero),
-  /* 2763 E> */ B(StaCurrentContextSlot), U8(207),
-  /* 2777 S> */ B(LdaZero),
-  /* 2777 E> */ B(StaCurrentContextSlot), U8(208),
+  /* 2581 E> */ B(StaCurrentContextSlot), U8(181),
+  /* 2596 S> */ B(LdaZero),
+  /* 2596 E> */ B(StaCurrentContextSlot), U8(182),
+  /* 2611 S> */ B(LdaZero),
+  /* 2611 E> */ B(StaCurrentContextSlot), U8(183),
+  /* 2626 S> */ B(LdaZero),
+  /* 2626 E> */ B(StaCurrentContextSlot), U8(184),
+  /* 2641 S> */ B(LdaZero),
+  /* 2641 E> */ B(StaCurrentContextSlot), U8(185),
+  /* 2656 S> */ B(LdaZero),
+  /* 2656 E> */ B(StaCurrentContextSlot), U8(186),
+  /* 2671 S> */ B(LdaZero),
+  /* 2671 E> */ B(StaCurrentContextSlot), U8(187),
+  /* 2686 S> */ B(LdaZero),
+  /* 2686 E> */ B(StaCurrentContextSlot), U8(188),
+  /* 2701 S> */ B(LdaZero),
+  /* 2701 E> */ B(StaCurrentContextSlot), U8(189),
+  /* 2716 S> */ B(LdaZero),
+  /* 2716 E> */ B(StaCurrentContextSlot), U8(190),
+  /* 2731 S> */ B(LdaZero),
+  /* 2731 E> */ B(StaCurrentContextSlot), U8(191),
+  /* 2746 S> */ B(LdaZero),
+  /* 2746 E> */ B(StaCurrentContextSlot), U8(192),
+  /* 2761 S> */ B(LdaZero),
+  /* 2761 E> */ B(StaCurrentContextSlot), U8(193),
+  /* 2776 S> */ B(LdaZero),
+  /* 2776 E> */ B(StaCurrentContextSlot), U8(194),
   /* 2791 S> */ B(LdaZero),
-  /* 2791 E> */ B(StaCurrentContextSlot), U8(209),
-  /* 2805 S> */ B(LdaZero),
-  /* 2805 E> */ B(StaCurrentContextSlot), U8(210),
-  /* 2819 S> */ B(LdaZero),
-  /* 2819 E> */ B(StaCurrentContextSlot), U8(211),
-  /* 2833 S> */ B(LdaZero),
-  /* 2833 E> */ B(StaCurrentContextSlot), U8(212),
-  /* 2847 S> */ B(LdaZero),
-  /* 2847 E> */ B(StaCurrentContextSlot), U8(213),
-  /* 2861 S> */ B(LdaZero),
-  /* 2861 E> */ B(StaCurrentContextSlot), U8(214),
-  /* 2875 S> */ B(LdaZero),
-  /* 2875 E> */ B(StaCurrentContextSlot), U8(215),
-  /* 2889 S> */ B(LdaZero),
-  /* 2889 E> */ B(StaCurrentContextSlot), U8(216),
-  /* 2903 S> */ B(LdaZero),
-  /* 2903 E> */ B(StaCurrentContextSlot), U8(217),
-  /* 2917 S> */ B(LdaZero),
-  /* 2917 E> */ B(StaCurrentContextSlot), U8(218),
-  /* 2931 S> */ B(LdaZero),
-  /* 2931 E> */ B(StaCurrentContextSlot), U8(219),
-  /* 2945 S> */ B(LdaZero),
-  /* 2945 E> */ B(StaCurrentContextSlot), U8(220),
-  /* 2959 S> */ B(LdaZero),
-  /* 2959 E> */ B(StaCurrentContextSlot), U8(221),
-  /* 2973 S> */ B(LdaZero),
-  /* 2973 E> */ B(StaCurrentContextSlot), U8(222),
-  /* 2987 S> */ B(LdaZero),
-  /* 2987 E> */ B(StaCurrentContextSlot), U8(223),
+  /* 2791 E> */ B(StaCurrentContextSlot), U8(195),
+  /* 2806 S> */ B(LdaZero),
+  /* 2806 E> */ B(StaCurrentContextSlot), U8(196),
+  /* 2821 S> */ B(LdaZero),
+  /* 2821 E> */ B(StaCurrentContextSlot), U8(197),
+  /* 2836 S> */ B(LdaZero),
+  /* 2836 E> */ B(StaCurrentContextSlot), U8(198),
+  /* 2851 S> */ B(LdaZero),
+  /* 2851 E> */ B(StaCurrentContextSlot), U8(199),
+  /* 2866 S> */ B(LdaZero),
+  /* 2866 E> */ B(StaCurrentContextSlot), U8(200),
+  /* 2881 S> */ B(LdaZero),
+  /* 2881 E> */ B(StaCurrentContextSlot), U8(201),
+  /* 2896 S> */ B(LdaZero),
+  /* 2896 E> */ B(StaCurrentContextSlot), U8(202),
+  /* 2911 S> */ B(LdaZero),
+  /* 2911 E> */ B(StaCurrentContextSlot), U8(203),
+  /* 2926 S> */ B(LdaZero),
+  /* 2926 E> */ B(StaCurrentContextSlot), U8(204),
+  /* 2941 S> */ B(LdaZero),
+  /* 2941 E> */ B(StaCurrentContextSlot), U8(205),
+  /* 2956 S> */ B(LdaZero),
+  /* 2956 E> */ B(StaCurrentContextSlot), U8(206),
+  /* 2971 S> */ B(LdaZero),
+  /* 2971 E> */ B(StaCurrentContextSlot), U8(207),
+  /* 2986 S> */ B(LdaZero),
+  /* 2986 E> */ B(StaCurrentContextSlot), U8(208),
   /* 3001 S> */ B(LdaZero),
-  /* 3001 E> */ B(StaCurrentContextSlot), U8(224),
-  /* 3015 S> */ B(LdaZero),
-  /* 3015 E> */ B(StaCurrentContextSlot), U8(225),
-  /* 3029 S> */ B(LdaZero),
-  /* 3029 E> */ B(StaCurrentContextSlot), U8(226),
-  /* 3043 S> */ B(LdaZero),
-  /* 3043 E> */ B(StaCurrentContextSlot), U8(227),
-  /* 3057 S> */ B(LdaZero),
-  /* 3057 E> */ B(StaCurrentContextSlot), U8(228),
-  /* 3071 S> */ B(LdaZero),
-  /* 3071 E> */ B(StaCurrentContextSlot), U8(229),
-  /* 3085 S> */ B(LdaZero),
-  /* 3085 E> */ B(StaCurrentContextSlot), U8(230),
-  /* 3099 S> */ B(LdaZero),
-  /* 3099 E> */ B(StaCurrentContextSlot), U8(231),
-  /* 3113 S> */ B(LdaZero),
-  /* 3113 E> */ B(StaCurrentContextSlot), U8(232),
-  /* 3127 S> */ B(LdaZero),
-  /* 3127 E> */ B(StaCurrentContextSlot), U8(233),
-  /* 3141 S> */ B(LdaZero),
-  /* 3141 E> */ B(StaCurrentContextSlot), U8(234),
-  /* 3155 S> */ B(LdaZero),
-  /* 3155 E> */ B(StaCurrentContextSlot), U8(235),
-  /* 3169 S> */ B(LdaZero),
-  /* 3169 E> */ B(StaCurrentContextSlot), U8(236),
-  /* 3183 S> */ B(LdaZero),
-  /* 3183 E> */ B(StaCurrentContextSlot), U8(237),
-  /* 3197 S> */ B(LdaZero),
-  /* 3197 E> */ B(StaCurrentContextSlot), U8(238),
+  /* 3001 E> */ B(StaCurrentContextSlot), U8(209),
+  /* 3016 S> */ B(LdaZero),
+  /* 3016 E> */ B(StaCurrentContextSlot), U8(210),
+  /* 3031 S> */ B(LdaZero),
+  /* 3031 E> */ B(StaCurrentContextSlot), U8(211),
+  /* 3046 S> */ B(LdaZero),
+  /* 3046 E> */ B(StaCurrentContextSlot), U8(212),
+  /* 3061 S> */ B(LdaZero),
+  /* 3061 E> */ B(StaCurrentContextSlot), U8(213),
+  /* 3076 S> */ B(LdaZero),
+  /* 3076 E> */ B(StaCurrentContextSlot), U8(214),
+  /* 3091 S> */ B(LdaZero),
+  /* 3091 E> */ B(StaCurrentContextSlot), U8(215),
+  /* 3106 S> */ B(LdaZero),
+  /* 3106 E> */ B(StaCurrentContextSlot), U8(216),
+  /* 3121 S> */ B(LdaZero),
+  /* 3121 E> */ B(StaCurrentContextSlot), U8(217),
+  /* 3136 S> */ B(LdaZero),
+  /* 3136 E> */ B(StaCurrentContextSlot), U8(218),
+  /* 3151 S> */ B(LdaZero),
+  /* 3151 E> */ B(StaCurrentContextSlot), U8(219),
+  /* 3166 S> */ B(LdaZero),
+  /* 3166 E> */ B(StaCurrentContextSlot), U8(220),
+  /* 3181 S> */ B(LdaZero),
+  /* 3181 E> */ B(StaCurrentContextSlot), U8(221),
+  /* 3196 S> */ B(LdaZero),
+  /* 3196 E> */ B(StaCurrentContextSlot), U8(222),
   /* 3211 S> */ B(LdaZero),
-  /* 3211 E> */ B(StaCurrentContextSlot), U8(239),
-  /* 3225 S> */ B(LdaZero),
-  /* 3225 E> */ B(StaCurrentContextSlot), U8(240),
-  /* 3239 S> */ B(LdaZero),
-  /* 3239 E> */ B(StaCurrentContextSlot), U8(241),
-  /* 3253 S> */ B(LdaZero),
-  /* 3253 E> */ B(StaCurrentContextSlot), U8(242),
-  /* 3267 S> */ B(LdaZero),
-  /* 3267 E> */ B(StaCurrentContextSlot), U8(243),
-  /* 3281 S> */ B(LdaZero),
-  /* 3281 E> */ B(StaCurrentContextSlot), U8(244),
-  /* 3295 S> */ B(LdaZero),
-  /* 3295 E> */ B(StaCurrentContextSlot), U8(245),
-  /* 3309 S> */ B(LdaZero),
-  /* 3309 E> */ B(StaCurrentContextSlot), U8(246),
-  /* 3323 S> */ B(LdaZero),
-  /* 3323 E> */ B(StaCurrentContextSlot), U8(247),
-  /* 3337 S> */ B(LdaZero),
-  /* 3337 E> */ B(StaCurrentContextSlot), U8(248),
-  /* 3351 S> */ B(LdaZero),
-  /* 3351 E> */ B(StaCurrentContextSlot), U8(249),
-  /* 3365 S> */ B(LdaZero),
-  /* 3365 E> */ B(StaCurrentContextSlot), U8(250),
-  /* 3379 S> */ B(LdaZero),
-  /* 3379 E> */ B(StaCurrentContextSlot), U8(251),
-  /* 3393 S> */ B(LdaZero),
-  /* 3393 E> */ B(StaCurrentContextSlot), U8(252),
-  /* 3407 S> */ B(LdaZero),
-  /* 3407 E> */ B(StaCurrentContextSlot), U8(253),
+  /* 3211 E> */ B(StaCurrentContextSlot), U8(223),
+  /* 3226 S> */ B(LdaZero),
+  /* 3226 E> */ B(StaCurrentContextSlot), U8(224),
+  /* 3241 S> */ B(LdaZero),
+  /* 3241 E> */ B(StaCurrentContextSlot), U8(225),
+  /* 3256 S> */ B(LdaZero),
+  /* 3256 E> */ B(StaCurrentContextSlot), U8(226),
+  /* 3271 S> */ B(LdaZero),
+  /* 3271 E> */ B(StaCurrentContextSlot), U8(227),
+  /* 3286 S> */ B(LdaZero),
+  /* 3286 E> */ B(StaCurrentContextSlot), U8(228),
+  /* 3301 S> */ B(LdaZero),
+  /* 3301 E> */ B(StaCurrentContextSlot), U8(229),
+  /* 3316 S> */ B(LdaZero),
+  /* 3316 E> */ B(StaCurrentContextSlot), U8(230),
+  /* 3331 S> */ B(LdaZero),
+  /* 3331 E> */ B(StaCurrentContextSlot), U8(231),
+  /* 3346 S> */ B(LdaZero),
+  /* 3346 E> */ B(StaCurrentContextSlot), U8(232),
+  /* 3361 S> */ B(LdaZero),
+  /* 3361 E> */ B(StaCurrentContextSlot), U8(233),
+  /* 3376 S> */ B(LdaZero),
+  /* 3376 E> */ B(StaCurrentContextSlot), U8(234),
+  /* 3391 S> */ B(LdaZero),
+  /* 3391 E> */ B(StaCurrentContextSlot), U8(235),
+  /* 3406 S> */ B(LdaZero),
+  /* 3406 E> */ B(StaCurrentContextSlot), U8(236),
   /* 3421 S> */ B(LdaZero),
-  /* 3421 E> */ B(StaCurrentContextSlot), U8(254),
-  /* 3435 S> */ B(LdaZero),
-  /* 3435 E> */ B(StaCurrentContextSlot), U8(255),
-  /* 3438 S> */ B(LdaGlobal), U8(0), U8(0),
+  /* 3421 E> */ B(StaCurrentContextSlot), U8(237),
+  /* 3436 S> */ B(LdaZero),
+  /* 3436 E> */ B(StaCurrentContextSlot), U8(238),
+  /* 3451 S> */ B(LdaZero),
+  /* 3451 E> */ B(StaCurrentContextSlot), U8(239),
+  /* 3466 S> */ B(LdaZero),
+  /* 3466 E> */ B(StaCurrentContextSlot), U8(240),
+  /* 3481 S> */ B(LdaZero),
+  /* 3481 E> */ B(StaCurrentContextSlot), U8(241),
+  /* 3496 S> */ B(LdaZero),
+  /* 3496 E> */ B(StaCurrentContextSlot), U8(242),
+  /* 3511 S> */ B(LdaZero),
+  /* 3511 E> */ B(StaCurrentContextSlot), U8(243),
+  /* 3526 S> */ B(LdaZero),
+  /* 3526 E> */ B(StaCurrentContextSlot), U8(244),
+  /* 3541 S> */ B(LdaZero),
+  /* 3541 E> */ B(StaCurrentContextSlot), U8(245),
+  /* 3556 S> */ B(LdaZero),
+  /* 3556 E> */ B(StaCurrentContextSlot), U8(246),
+  /* 3571 S> */ B(LdaZero),
+  /* 3571 E> */ B(StaCurrentContextSlot), U8(247),
+  /* 3586 S> */ B(LdaZero),
+  /* 3586 E> */ B(StaCurrentContextSlot), U8(248),
+  /* 3601 S> */ B(LdaZero),
+  /* 3601 E> */ B(StaCurrentContextSlot), U8(249),
+  /* 3616 S> */ B(LdaZero),
+  /* 3616 E> */ B(StaCurrentContextSlot), U8(250),
+  /* 3631 S> */ B(LdaZero),
+  /* 3631 E> */ B(StaCurrentContextSlot), U8(251),
+  /* 3646 S> */ B(LdaZero),
+  /* 3646 E> */ B(StaCurrentContextSlot), U8(252),
+  /* 3661 S> */ B(LdaZero),
+  /* 3661 E> */ B(StaCurrentContextSlot), U8(253),
+  /* 3676 S> */ B(LdaZero),
+  /* 3676 E> */ B(StaCurrentContextSlot), U8(254),
+  /* 3691 S> */ B(LdaZero),
+  /* 3691 E> */ B(StaCurrentContextSlot), U8(255),
+  /* 3694 S> */ B(LdaGlobal), U8(1), U8(0),
                 B(Star), R(2),
-  /* 3438 E> */ B(CallUndefinedReceiver0), R(2), U8(2),
-  /* 3454 S> */ B(LdaSmi), I8(100),
-  /* 3454 E> */ B(Wide), B(StaCurrentContextSlot), U16(256),
-  /* 3459 S> */ B(Wide), B(LdaCurrentContextSlot), U16(256),
-  /* 3467 S> */ B(Return),
+  /* 3694 E> */ B(CallUndefinedReceiver0), R(2), U8(2),
+  /* 3710 S> */ B(LdaSmi), I8(100),
+  /* 3710 E> */ B(Wide), B(StaCurrentContextSlot), U16(256),
+  /* 3715 S> */ B(Wide), B(LdaCurrentContextSlot), U16(256),
+  /* 3723 S> */ B(Return),
 ]
 constant pool: [
+  SCOPE_INFO_TYPE,
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["eval"],
 ]
 handlers: [
diff --git a/deps/v8/test/cctest/interpreter/bytecode_expectations/CountOperators.golden b/deps/v8/test/cctest/interpreter/bytecode_expectations/CountOperators.golden
index 70fbf16215b2bd..2c2a3784d420e7 100644
--- a/deps/v8/test/cctest/interpreter/bytecode_expectations/CountOperators.golden
+++ b/deps/v8/test/cctest/interpreter/bytecode_expectations/CountOperators.golden
@@ -112,7 +112,7 @@ bytecodes: [
   /*   69 S> */ B(Return),
 ]
 constant pool: [
-  BOILERPLATE_DESCRIPTION_TYPE,
+  OBJECT_BOILERPLATE_DESCRIPTION_TYPE,
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["val"],
 ]
 handlers: [
@@ -137,7 +137,7 @@ bytecodes: [
   /*   69 S> */ B(Return),
 ]
 constant pool: [
-  BOILERPLATE_DESCRIPTION_TYPE,
+  OBJECT_BOILERPLATE_DESCRIPTION_TYPE,
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["val"],
 ]
 handlers: [
@@ -168,7 +168,7 @@ bytecodes: [
 ]
 constant pool: [
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["var"],
-  BOILERPLATE_DESCRIPTION_TYPE,
+  OBJECT_BOILERPLATE_DESCRIPTION_TYPE,
 ]
 handlers: [
 ]
@@ -196,7 +196,7 @@ bytecodes: [
 ]
 constant pool: [
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["var"],
-  BOILERPLATE_DESCRIPTION_TYPE,
+  OBJECT_BOILERPLATE_DESCRIPTION_TYPE,
 ]
 handlers: [
 ]
@@ -207,14 +207,14 @@ snippet: "
 "
 frame size: 2
 parameter count: 1
-bytecode array length: 22
+bytecode array length: 23
 bytecodes: [
-                B(CreateFunctionContext), U8(1),
+                B(CreateFunctionContext), U8(0), U8(1),
                 B(PushContext), R(1),
   /*   30 E> */ B(StackCheck),
   /*   42 S> */ B(LdaSmi), I8(1),
   /*   42 E> */ B(StaCurrentContextSlot), U8(4),
-  /*   53 S> */ B(CreateClosure), U8(0), U8(0), U8(2),
+  /*   53 S> */ B(CreateClosure), U8(1), U8(0), U8(2),
                 B(Star), R(0),
   /*   78 S> */ B(LdaCurrentContextSlot), U8(4),
                 B(Inc), U8(1),
@@ -222,6 +222,7 @@ bytecodes: [
   /*   89 S> */ B(Return),
 ]
 constant pool: [
+  SCOPE_INFO_TYPE,
   SHARED_FUNCTION_INFO_TYPE,
 ]
 handlers: [
@@ -233,14 +234,14 @@ snippet: "
 "
 frame size: 3
 parameter count: 1
-bytecode array length: 28
+bytecode array length: 29
 bytecodes: [
-                B(CreateFunctionContext), U8(1),
+                B(CreateFunctionContext), U8(0), U8(1),
                 B(PushContext), R(1),
   /*   30 E> */ B(StackCheck),
   /*   42 S> */ B(LdaSmi), I8(1),
   /*   42 E> */ B(StaCurrentContextSlot), U8(4),
-  /*   53 S> */ B(CreateClosure), U8(0), U8(0), U8(2),
+  /*   53 S> */ B(CreateClosure), U8(1), U8(0), U8(2),
                 B(Star), R(0),
   /*   78 S> */ B(LdaCurrentContextSlot), U8(4),
                 B(ToNumeric), U8(1),
@@ -251,6 +252,7 @@ bytecodes: [
   /*   89 S> */ B(Return),
 ]
 constant pool: [
+  SCOPE_INFO_TYPE,
   SHARED_FUNCTION_INFO_TYPE,
 ]
 handlers: [
@@ -281,7 +283,7 @@ bytecodes: [
   /*   83 S> */ B(Return),
 ]
 constant pool: [
-  TUPLE2_TYPE,
+  ARRAY_BOILERPLATE_DESCRIPTION_TYPE,
 ]
 handlers: [
 ]
diff --git a/deps/v8/test/cctest/interpreter/bytecode_expectations/CreateArguments.golden b/deps/v8/test/cctest/interpreter/bytecode_expectations/CreateArguments.golden
index df16a69c6217df..8440089ec954ca 100644
--- a/deps/v8/test/cctest/interpreter/bytecode_expectations/CreateArguments.golden
+++ b/deps/v8/test/cctest/interpreter/bytecode_expectations/CreateArguments.golden
@@ -72,9 +72,9 @@ snippet: "
 "
 frame size: 2
 parameter count: 2
-bytecode array length: 17
+bytecode array length: 18
 bytecodes: [
-                B(CreateFunctionContext), U8(1),
+                B(CreateFunctionContext), U8(0), U8(1),
                 B(PushContext), R(1),
                 B(Ldar), R(arg0),
                 B(StaCurrentContextSlot), U8(4),
@@ -86,6 +86,7 @@ bytecodes: [
   /*   36 S> */ B(Return),
 ]
 constant pool: [
+  SCOPE_INFO_TYPE,
 ]
 handlers: [
 ]
@@ -97,9 +98,9 @@ snippet: "
 "
 frame size: 2
 parameter count: 4
-bytecode array length: 21
+bytecode array length: 22
 bytecodes: [
-                B(CreateFunctionContext), U8(3),
+                B(CreateFunctionContext), U8(0), U8(3),
                 B(PushContext), R(1),
                 B(Ldar), R(arg0),
                 B(StaCurrentContextSlot), U8(6),
@@ -113,6 +114,7 @@ bytecodes: [
   /*   39 S> */ B(Return),
 ]
 constant pool: [
+  SCOPE_INFO_TYPE,
 ]
 handlers: [
 ]
diff --git a/deps/v8/test/cctest/interpreter/bytecode_expectations/DeclareGlobals.golden b/deps/v8/test/cctest/interpreter/bytecode_expectations/DeclareGlobals.golden
index dd4cc41b007dc0..3dafb7f5c2154f 100644
--- a/deps/v8/test/cctest/interpreter/bytecode_expectations/DeclareGlobals.golden
+++ b/deps/v8/test/cctest/interpreter/bytecode_expectations/DeclareGlobals.golden
@@ -24,7 +24,7 @@ bytecodes: [
   /*    8 S> */ B(LdaSmi), I8(1),
   /*    8 E> */ B(StaGlobal), U8(1), U8(2),
                 B(LdaUndefined),
-  /*   10 S> */ B(Return),
+  /*   11 S> */ B(Return),
 ]
 constant pool: [
   FIXED_ARRAY_TYPE,
@@ -49,7 +49,7 @@ bytecodes: [
                 B(CallRuntime), U16(Runtime::kDeclareGlobals), R(0), U8(3),
   /*    0 E> */ B(StackCheck),
                 B(LdaUndefined),
-  /*   15 S> */ B(Return),
+  /*   16 S> */ B(Return),
 ]
 constant pool: [
   FIXED_ARRAY_TYPE,
@@ -78,7 +78,7 @@ bytecodes: [
   /*   11 S> */ B(LdaSmi), I8(2),
   /*   12 E> */ B(StaGlobal), U8(1), U8(2),
                 B(Star), R(0),
-  /*   15 S> */ B(Return),
+  /*   16 S> */ B(Return),
 ]
 constant pool: [
   FIXED_ARRAY_TYPE,
@@ -107,7 +107,7 @@ bytecodes: [
                 B(Star), R(1),
   /*   16 E> */ B(CallUndefinedReceiver0), R(1), U8(3),
                 B(Star), R(0),
-  /*   20 S> */ B(Return),
+  /*   21 S> */ B(Return),
 ]
 constant pool: [
   FIXED_ARRAY_TYPE,
diff --git a/deps/v8/test/cctest/interpreter/bytecode_expectations/Delete.golden b/deps/v8/test/cctest/interpreter/bytecode_expectations/Delete.golden
index 22b33d96c9b3a8..a7e48a2a5c725e 100644
--- a/deps/v8/test/cctest/interpreter/bytecode_expectations/Delete.golden
+++ b/deps/v8/test/cctest/interpreter/bytecode_expectations/Delete.golden
@@ -21,7 +21,7 @@ bytecodes: [
   /*   74 S> */ B(Return),
 ]
 constant pool: [
-  BOILERPLATE_DESCRIPTION_TYPE,
+  OBJECT_BOILERPLATE_DESCRIPTION_TYPE,
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["x"],
 ]
 handlers: [
@@ -43,7 +43,7 @@ bytecodes: [
   /*   88 S> */ B(Return),
 ]
 constant pool: [
-  BOILERPLATE_DESCRIPTION_TYPE,
+  OBJECT_BOILERPLATE_DESCRIPTION_TYPE,
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["x"],
 ]
 handlers: [
@@ -65,7 +65,7 @@ bytecodes: [
   /*   75 S> */ B(Return),
 ]
 constant pool: [
-  BOILERPLATE_DESCRIPTION_TYPE,
+  OBJECT_BOILERPLATE_DESCRIPTION_TYPE,
 ]
 handlers: [
 ]
@@ -98,15 +98,15 @@ snippet: "
 "
 frame size: 2
 parameter count: 1
-bytecode array length: 27
+bytecode array length: 28
 bytecodes: [
-                B(CreateFunctionContext), U8(1),
+                B(CreateFunctionContext), U8(0), U8(1),
                 B(PushContext), R(0),
   /*   30 E> */ B(StackCheck),
-  /*   56 S> */ B(CreateObjectLiteral), U8(0), U8(0), U8(41), R(1),
+  /*   56 S> */ B(CreateObjectLiteral), U8(1), U8(0), U8(41), R(1),
                 B(Ldar), R(1),
   /*   56 E> */ B(StaCurrentContextSlot), U8(4),
-  /*   64 S> */ B(CreateClosure), U8(1), U8(1), U8(2),
+  /*   64 S> */ B(CreateClosure), U8(2), U8(1), U8(2),
   /*   93 S> */ B(LdaImmutableCurrentContextSlot), U8(4),
                 B(Star), R(1),
                 B(LdaSmi), I8(1),
@@ -114,7 +114,8 @@ bytecodes: [
   /*  112 S> */ B(Return),
 ]
 constant pool: [
-  BOILERPLATE_DESCRIPTION_TYPE,
+  SCOPE_INFO_TYPE,
+  OBJECT_BOILERPLATE_DESCRIPTION_TYPE,
   SHARED_FUNCTION_INFO_TYPE,
 ]
 handlers: [
diff --git a/deps/v8/test/cctest/interpreter/bytecode_expectations/Eval.golden b/deps/v8/test/cctest/interpreter/bytecode_expectations/Eval.golden
index eb7b9d1f3cda51..6bd20762ab490f 100644
--- a/deps/v8/test/cctest/interpreter/bytecode_expectations/Eval.golden
+++ b/deps/v8/test/cctest/interpreter/bytecode_expectations/Eval.golden
@@ -11,9 +11,9 @@ snippet: "
 "
 frame size: 10
 parameter count: 1
-bytecode array length: 58
+bytecode array length: 59
 bytecodes: [
-                B(CreateFunctionContext), U8(3),
+                B(CreateFunctionContext), U8(0), U8(3),
                 B(PushContext), R(1),
                 B(Ldar), R(this),
                 B(StaCurrentContextSlot), U8(4),
@@ -22,9 +22,9 @@ bytecodes: [
                 B(Ldar), R(0),
                 B(StaCurrentContextSlot), U8(5),
   /*   30 E> */ B(StackCheck),
-  /*   34 S> */ B(LdaLookupGlobalSlot), U8(0), U8(0), U8(1),
+  /*   34 S> */ B(LdaLookupGlobalSlot), U8(1), U8(0), U8(1),
                 B(Star), R(2),
-                B(LdaConstant), U8(1),
+                B(LdaConstant), U8(2),
                 B(Star), R(3),
                 B(LdaZero),
                 B(Star), R(7),
@@ -41,6 +41,7 @@ bytecodes: [
   /*   52 S> */ B(Return),
 ]
 constant pool: [
+  SCOPE_INFO_TYPE,
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["eval"],
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["1;"],
 ]
diff --git a/deps/v8/test/cctest/interpreter/bytecode_expectations/ForAwaitOf.golden b/deps/v8/test/cctest/interpreter/bytecode_expectations/ForAwaitOf.golden
index 4d36315f027988..e965d7a68901d8 100644
--- a/deps/v8/test/cctest/interpreter/bytecode_expectations/ForAwaitOf.golden
+++ b/deps/v8/test/cctest/interpreter/bytecode_expectations/ForAwaitOf.golden
@@ -60,7 +60,7 @@ bytecodes: [
                 B(InvokeIntrinsic), U8(Runtime::k_GeneratorGetResumeMode), R(2), U8(1),
                 B(Star), R(21),
                 B(LdaZero),
-                B(TestEqualStrictNoFeedback), R(21),
+                B(TestReferenceEqual), R(21),
                 B(JumpIfTrue), U8(5),
                 B(Ldar), R(20),
                 B(ReThrow),
@@ -81,10 +81,9 @@ bytecodes: [
                 B(LdaZero),
                 B(Star), R(7),
                 B(JumpLoop), U8(82), I8(0),
-                B(Jump), U8(40),
+                B(Jump), U8(37),
                 B(Star), R(20),
-                B(Ldar), R(closure),
-                B(CreateCatchContext), R(20), U8(9), U8(10),
+                B(CreateCatchContext), R(20), U8(9),
                 B(Star), R(19),
                 B(LdaTheHole),
                 B(SetPendingMessage),
@@ -112,7 +111,7 @@ bytecodes: [
                 B(LdaZero),
                 B(TestEqualStrict), R(7), U8(18),
                 B(JumpIfTrue), U8(167),
-                B(LdaNamedProperty), R(4), U8(11), U8(19),
+                B(LdaNamedProperty), R(4), U8(10), U8(19),
                 B(Star), R(9),
                 B(TestUndetectable),
                 B(JumpIfFalse), U8(4),
@@ -124,9 +123,9 @@ bytecodes: [
                 B(TestTypeOf), U8(6),
                 B(JumpIfFalse), U8(4),
                 B(Jump), U8(18),
-                B(Wide), B(LdaSmi), I16(147),
+                B(Wide), B(LdaSmi), I16(149),
                 B(Star), R(19),
-                B(LdaConstant), U8(12),
+                B(LdaConstant), U8(11),
                 B(Star), R(20),
                 B(CallRuntime), U16(Runtime::kNewTypeError), R(19), U8(2),
                 B(Throw),
@@ -144,7 +143,7 @@ bytecodes: [
                 B(InvokeIntrinsic), U8(Runtime::k_GeneratorGetResumeMode), R(2), U8(1),
                 B(Star), R(21),
                 B(LdaZero),
-                B(TestEqualStrictNoFeedback), R(21),
+                B(TestReferenceEqual), R(21),
                 B(JumpIfTrue), U8(5),
                 B(Ldar), R(20),
                 B(ReThrow),
@@ -167,7 +166,7 @@ bytecodes: [
                 B(InvokeIntrinsic), U8(Runtime::k_GeneratorGetResumeMode), R(2), U8(1),
                 B(Star), R(20),
                 B(LdaZero),
-                B(TestEqualStrictNoFeedback), R(20),
+                B(TestReferenceEqual), R(20),
                 B(JumpIfTrue), U8(5),
                 B(Ldar), R(19),
                 B(ReThrow),
@@ -179,7 +178,7 @@ bytecodes: [
                 B(Ldar), R(18),
                 B(SetPendingMessage),
                 B(LdaZero),
-                B(TestEqualStrictNoFeedback), R(16),
+                B(TestReferenceEqual), R(16),
                 B(JumpIfFalse), U8(5),
                 B(Ldar), R(17),
                 B(ReThrow),
@@ -190,11 +189,10 @@ bytecodes: [
                 B(LdaZero),
                 B(Star), R(12),
                 B(Mov), R(11), R(13),
-                B(Jump), U8(58),
-                B(Jump), U8(42),
+                B(Jump), U8(55),
+                B(Jump), U8(39),
                 B(Star), R(16),
-                B(Ldar), R(closure),
-                B(CreateCatchContext), R(16), U8(9), U8(13),
+                B(CreateCatchContext), R(16), U8(12),
                 B(Star), R(15),
                 B(LdaTheHole),
                 B(SetPendingMessage),
@@ -221,11 +219,14 @@ bytecodes: [
                 B(LdaTheHole),
                 B(SetPendingMessage),
                 B(Star), R(14),
-                B(CallJSRuntime), U8(%async_function_promise_release), R(11), U8(1),
+                B(LdaTrue),
+                B(Star), R(16),
+                B(Mov), R(11), R(15),
+                B(CallJSRuntime), U8(%async_function_promise_release), R(15), U8(2),
                 B(Ldar), R(14),
                 B(SetPendingMessage),
                 B(Ldar), R(12),
-                B(SwitchOnSmiNoFeedback), U8(14), U8(2), I8(0),
+                B(SwitchOnSmiNoFeedback), U8(13), U8(2), I8(0),
                 B(Jump), U8(8),
                 B(Ldar), R(13),
   /*   57 S> */ B(Return),
@@ -236,15 +237,14 @@ bytecodes: [
 ]
 constant pool: [
   Smi [110],
-  Smi [309],
-  Smi [366],
-  TUPLE2_TYPE,
+  Smi [306],
+  Smi [363],
+  ARRAY_BOILERPLATE_DESCRIPTION_TYPE,
   SYMBOL_TYPE,
   SYMBOL_TYPE,
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["next"],
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["done"],
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["value"],
-  ONE_BYTE_INTERNALIZED_STRING_TYPE [".catch"],
   SCOPE_INFO_TYPE,
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["return"],
   ONE_BYTE_INTERNALIZED_STRING_TYPE [""],
@@ -253,11 +253,11 @@ constant pool: [
   Smi [9],
 ]
 handlers: [
-  [26, 473, 481],
-  [29, 431, 433],
-  [35, 214, 222],
+  [26, 467, 475],
+  [29, 428, 430],
+  [35, 211, 219],
   [38, 174, 176],
-  [282, 331, 333],
+  [279, 328, 330],
 ]
 
 ---
@@ -313,7 +313,7 @@ bytecodes: [
                 B(InvokeIntrinsic), U8(Runtime::k_GeneratorGetResumeMode), R(2), U8(1),
                 B(Star), R(21),
                 B(LdaZero),
-                B(TestEqualStrictNoFeedback), R(21),
+                B(TestReferenceEqual), R(21),
                 B(JumpIfTrue), U8(5),
                 B(Ldar), R(20),
                 B(ReThrow),
@@ -334,11 +334,10 @@ bytecodes: [
   /*   56 S> */ B(LdaZero),
                 B(Star), R(16),
                 B(Mov), R(8), R(17),
-                B(Jump), U8(56),
-                B(Jump), U8(40),
+                B(Jump), U8(53),
+                B(Jump), U8(37),
                 B(Star), R(20),
-                B(Ldar), R(closure),
-                B(CreateCatchContext), R(20), U8(9), U8(10),
+                B(CreateCatchContext), R(20), U8(9),
                 B(Star), R(19),
                 B(LdaTheHole),
                 B(SetPendingMessage),
@@ -366,7 +365,7 @@ bytecodes: [
                 B(LdaZero),
                 B(TestEqualStrict), R(7), U8(18),
                 B(JumpIfTrue), U8(167),
-                B(LdaNamedProperty), R(4), U8(11), U8(19),
+                B(LdaNamedProperty), R(4), U8(10), U8(19),
                 B(Star), R(9),
                 B(TestUndetectable),
                 B(JumpIfFalse), U8(4),
@@ -378,9 +377,9 @@ bytecodes: [
                 B(TestTypeOf), U8(6),
                 B(JumpIfFalse), U8(4),
                 B(Jump), U8(18),
-                B(Wide), B(LdaSmi), I16(147),
+                B(Wide), B(LdaSmi), I16(149),
                 B(Star), R(19),
-                B(LdaConstant), U8(12),
+                B(LdaConstant), U8(11),
                 B(Star), R(20),
                 B(CallRuntime), U16(Runtime::kNewTypeError), R(19), U8(2),
                 B(Throw),
@@ -398,7 +397,7 @@ bytecodes: [
                 B(InvokeIntrinsic), U8(Runtime::k_GeneratorGetResumeMode), R(2), U8(1),
                 B(Star), R(21),
                 B(LdaZero),
-                B(TestEqualStrictNoFeedback), R(21),
+                B(TestReferenceEqual), R(21),
                 B(JumpIfTrue), U8(5),
                 B(Ldar), R(20),
                 B(ReThrow),
@@ -421,7 +420,7 @@ bytecodes: [
                 B(InvokeIntrinsic), U8(Runtime::k_GeneratorGetResumeMode), R(2), U8(1),
                 B(Star), R(20),
                 B(LdaZero),
-                B(TestEqualStrictNoFeedback), R(20),
+                B(TestReferenceEqual), R(20),
                 B(JumpIfTrue), U8(5),
                 B(Ldar), R(19),
                 B(ReThrow),
@@ -433,12 +432,12 @@ bytecodes: [
                 B(Ldar), R(18),
                 B(SetPendingMessage),
                 B(Ldar), R(16),
-                B(SwitchOnSmiNoFeedback), U8(13), U8(2), I8(0),
+                B(SwitchOnSmiNoFeedback), U8(12), U8(2), I8(0),
                 B(Jump), U8(13),
                 B(LdaZero),
                 B(Star), R(12),
                 B(Mov), R(17), R(13),
-                B(Jump), U8(81),
+                B(Jump), U8(78),
                 B(Ldar), R(17),
                 B(ReThrow),
                 B(LdaUndefined),
@@ -448,11 +447,10 @@ bytecodes: [
                 B(LdaSmi), I8(1),
                 B(Star), R(12),
                 B(Mov), R(11), R(13),
-                B(Jump), U8(59),
-                B(Jump), U8(43),
+                B(Jump), U8(56),
+                B(Jump), U8(40),
                 B(Star), R(16),
-                B(Ldar), R(closure),
-                B(CreateCatchContext), R(16), U8(9), U8(15),
+                B(CreateCatchContext), R(16), U8(14),
                 B(Star), R(15),
                 B(LdaTheHole),
                 B(SetPendingMessage),
@@ -479,11 +477,14 @@ bytecodes: [
                 B(LdaTheHole),
                 B(SetPendingMessage),
                 B(Star), R(14),
-                B(CallJSRuntime), U8(%async_function_promise_release), R(11), U8(1),
+                B(LdaTrue),
+                B(Star), R(16),
+                B(Mov), R(11), R(15),
+                B(CallJSRuntime), U8(%async_function_promise_release), R(15), U8(2),
                 B(Ldar), R(14),
                 B(SetPendingMessage),
                 B(Ldar), R(12),
-                B(SwitchOnSmiNoFeedback), U8(16), U8(3), I8(0),
+                B(SwitchOnSmiNoFeedback), U8(15), U8(3), I8(0),
                 B(Jump), U8(21),
                 B(Mov), R(11), R(15),
                 B(Mov), R(13), R(16),
@@ -499,15 +500,14 @@ bytecodes: [
 ]
 constant pool: [
   Smi [110],
-  Smi [312],
-  Smi [369],
-  TUPLE2_TYPE,
+  Smi [309],
+  Smi [366],
+  ARRAY_BOILERPLATE_DESCRIPTION_TYPE,
   SYMBOL_TYPE,
   SYMBOL_TYPE,
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["next"],
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["done"],
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["value"],
-  ONE_BYTE_INTERNALIZED_STRING_TYPE [".catch"],
   SCOPE_INFO_TYPE,
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["return"],
   ONE_BYTE_INTERNALIZED_STRING_TYPE [""],
@@ -519,11 +519,11 @@ constant pool: [
   Smi [22],
 ]
 handlers: [
-  [26, 489, 497],
-  [29, 446, 448],
-  [35, 216, 224],
+  [26, 483, 491],
+  [29, 443, 445],
+  [35, 213, 221],
   [38, 176, 178],
-  [285, 334, 336],
+  [282, 331, 333],
 ]
 
 ---
@@ -582,7 +582,7 @@ bytecodes: [
                 B(InvokeIntrinsic), U8(Runtime::k_GeneratorGetResumeMode), R(2), U8(1),
                 B(Star), R(21),
                 B(LdaZero),
-                B(TestEqualStrictNoFeedback), R(21),
+                B(TestReferenceEqual), R(21),
                 B(JumpIfTrue), U8(5),
                 B(Ldar), R(20),
                 B(ReThrow),
@@ -611,10 +611,9 @@ bytecodes: [
                 B(LdaZero),
                 B(Star), R(7),
                 B(JumpLoop), U8(100), I8(0),
-                B(Jump), U8(40),
+                B(Jump), U8(37),
                 B(Star), R(20),
-                B(Ldar), R(closure),
-                B(CreateCatchContext), R(20), U8(9), U8(10),
+                B(CreateCatchContext), R(20), U8(9),
                 B(Star), R(19),
                 B(LdaTheHole),
                 B(SetPendingMessage),
@@ -642,7 +641,7 @@ bytecodes: [
                 B(LdaZero),
                 B(TestEqualStrict), R(7), U8(20),
                 B(JumpIfTrue), U8(167),
-                B(LdaNamedProperty), R(4), U8(11), U8(21),
+                B(LdaNamedProperty), R(4), U8(10), U8(21),
                 B(Star), R(9),
                 B(TestUndetectable),
                 B(JumpIfFalse), U8(4),
@@ -654,9 +653,9 @@ bytecodes: [
                 B(TestTypeOf), U8(6),
                 B(JumpIfFalse), U8(4),
                 B(Jump), U8(18),
-                B(Wide), B(LdaSmi), I16(147),
+                B(Wide), B(LdaSmi), I16(149),
                 B(Star), R(19),
-                B(LdaConstant), U8(12),
+                B(LdaConstant), U8(11),
                 B(Star), R(20),
                 B(CallRuntime), U16(Runtime::kNewTypeError), R(19), U8(2),
                 B(Throw),
@@ -674,7 +673,7 @@ bytecodes: [
                 B(InvokeIntrinsic), U8(Runtime::k_GeneratorGetResumeMode), R(2), U8(1),
                 B(Star), R(21),
                 B(LdaZero),
-                B(TestEqualStrictNoFeedback), R(21),
+                B(TestReferenceEqual), R(21),
                 B(JumpIfTrue), U8(5),
                 B(Ldar), R(20),
                 B(ReThrow),
@@ -697,7 +696,7 @@ bytecodes: [
                 B(InvokeIntrinsic), U8(Runtime::k_GeneratorGetResumeMode), R(2), U8(1),
                 B(Star), R(20),
                 B(LdaZero),
-                B(TestEqualStrictNoFeedback), R(20),
+                B(TestReferenceEqual), R(20),
                 B(JumpIfTrue), U8(5),
                 B(Ldar), R(19),
                 B(ReThrow),
@@ -709,7 +708,7 @@ bytecodes: [
                 B(Ldar), R(18),
                 B(SetPendingMessage),
                 B(LdaZero),
-                B(TestEqualStrictNoFeedback), R(16),
+                B(TestReferenceEqual), R(16),
                 B(JumpIfFalse), U8(5),
                 B(Ldar), R(17),
                 B(ReThrow),
@@ -720,11 +719,10 @@ bytecodes: [
                 B(LdaZero),
                 B(Star), R(12),
                 B(Mov), R(11), R(13),
-                B(Jump), U8(58),
-                B(Jump), U8(42),
+                B(Jump), U8(55),
+                B(Jump), U8(39),
                 B(Star), R(16),
-                B(Ldar), R(closure),
-                B(CreateCatchContext), R(16), U8(9), U8(13),
+                B(CreateCatchContext), R(16), U8(12),
                 B(Star), R(15),
                 B(LdaTheHole),
                 B(SetPendingMessage),
@@ -751,11 +749,14 @@ bytecodes: [
                 B(LdaTheHole),
                 B(SetPendingMessage),
                 B(Star), R(14),
-                B(CallJSRuntime), U8(%async_function_promise_release), R(11), U8(1),
+                B(LdaTrue),
+                B(Star), R(16),
+                B(Mov), R(11), R(15),
+                B(CallJSRuntime), U8(%async_function_promise_release), R(15), U8(2),
                 B(Ldar), R(14),
                 B(SetPendingMessage),
                 B(Ldar), R(12),
-                B(SwitchOnSmiNoFeedback), U8(14), U8(2), I8(0),
+                B(SwitchOnSmiNoFeedback), U8(13), U8(2), I8(0),
                 B(Jump), U8(8),
                 B(Ldar), R(13),
   /*  114 S> */ B(Return),
@@ -766,15 +767,14 @@ bytecodes: [
 ]
 constant pool: [
   Smi [110],
-  Smi [327],
-  Smi [384],
-  TUPLE2_TYPE,
+  Smi [324],
+  Smi [381],
+  ARRAY_BOILERPLATE_DESCRIPTION_TYPE,
   SYMBOL_TYPE,
   SYMBOL_TYPE,
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["next"],
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["done"],
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["value"],
-  ONE_BYTE_INTERNALIZED_STRING_TYPE [".catch"],
   SCOPE_INFO_TYPE,
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["return"],
   ONE_BYTE_INTERNALIZED_STRING_TYPE [""],
@@ -783,11 +783,11 @@ constant pool: [
   Smi [9],
 ]
 handlers: [
-  [26, 491, 499],
-  [29, 449, 451],
-  [35, 232, 240],
+  [26, 485, 493],
+  [29, 446, 448],
+  [35, 229, 237],
   [38, 192, 194],
-  [300, 349, 351],
+  [297, 346, 348],
 ]
 
 ---
@@ -842,11 +842,10 @@ bytecodes: [
                 B(Star), R(15),
                 B(LdaZero),
                 B(Star), R(14),
-                B(Jump), U8(56),
-                B(Jump), U8(40),
+                B(Jump), U8(53),
+                B(Jump), U8(37),
                 B(Star), R(18),
-                B(Ldar), R(closure),
-                B(CreateCatchContext), R(18), U8(7), U8(8),
+                B(CreateCatchContext), R(18), U8(7),
                 B(Star), R(17),
                 B(LdaTheHole),
                 B(SetPendingMessage),
@@ -874,7 +873,7 @@ bytecodes: [
                 B(LdaZero),
                 B(TestEqualStrict), R(5), U8(19),
                 B(JumpIfTrue), U8(90),
-                B(LdaNamedProperty), R(2), U8(9), U8(20),
+                B(LdaNamedProperty), R(2), U8(8), U8(20),
                 B(Star), R(7),
                 B(TestUndetectable),
                 B(JumpIfFalse), U8(4),
@@ -886,9 +885,9 @@ bytecodes: [
                 B(TestTypeOf), U8(6),
                 B(JumpIfFalse), U8(4),
                 B(Jump), U8(18),
-                B(Wide), B(LdaSmi), I16(147),
+                B(Wide), B(LdaSmi), I16(149),
                 B(Star), R(17),
-                B(LdaConstant), U8(10),
+                B(LdaConstant), U8(9),
                 B(Star), R(18),
                 B(CallRuntime), U16(Runtime::kNewTypeError), R(17), U8(2),
                 B(Throw),
@@ -912,12 +911,12 @@ bytecodes: [
                 B(Ldar), R(16),
                 B(SetPendingMessage),
                 B(Ldar), R(14),
-                B(SwitchOnSmiNoFeedback), U8(11), U8(2), I8(0),
+                B(SwitchOnSmiNoFeedback), U8(10), U8(2), I8(0),
                 B(Jump), U8(13),
                 B(LdaZero),
                 B(Star), R(10),
                 B(Mov), R(15), R(11),
-                B(Jump), U8(81),
+                B(Jump), U8(78),
                 B(Ldar), R(15),
                 B(ReThrow),
                 B(LdaUndefined),
@@ -927,11 +926,10 @@ bytecodes: [
                 B(LdaSmi), I8(1),
                 B(Star), R(10),
                 B(Mov), R(9), R(11),
-                B(Jump), U8(59),
-                B(Jump), U8(43),
+                B(Jump), U8(56),
+                B(Jump), U8(40),
                 B(Star), R(14),
-                B(Ldar), R(closure),
-                B(CreateCatchContext), R(14), U8(7), U8(13),
+                B(CreateCatchContext), R(14), U8(12),
                 B(Star), R(13),
                 B(LdaTheHole),
                 B(SetPendingMessage),
@@ -958,11 +956,14 @@ bytecodes: [
                 B(LdaTheHole),
                 B(SetPendingMessage),
                 B(Star), R(12),
-                B(CallJSRuntime), U8(%async_function_promise_release), R(9), U8(1),
+                B(LdaFalse),
+                B(Star), R(14),
+                B(Mov), R(9), R(13),
+                B(CallJSRuntime), U8(%async_function_promise_release), R(13), U8(2),
                 B(Ldar), R(12),
                 B(SetPendingMessage),
                 B(Ldar), R(10),
-                B(SwitchOnSmiNoFeedback), U8(14), U8(3), I8(0),
+                B(SwitchOnSmiNoFeedback), U8(13), U8(3), I8(0),
                 B(Jump), U8(21),
                 B(Mov), R(9), R(13),
                 B(Mov), R(11), R(14),
@@ -977,14 +978,13 @@ bytecodes: [
   /*   96 S> */ B(Return),
 ]
 constant pool: [
-  BOILERPLATE_DESCRIPTION_TYPE,
-  TUPLE2_TYPE,
+  OBJECT_BOILERPLATE_DESCRIPTION_TYPE,
+  ARRAY_BOILERPLATE_DESCRIPTION_TYPE,
   SYMBOL_TYPE,
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["next"],
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["done"],
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["value"],
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["a"],
-  ONE_BYTE_INTERNALIZED_STRING_TYPE [".catch"],
   SCOPE_INFO_TYPE,
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["return"],
   ONE_BYTE_INTERNALIZED_STRING_TYPE [""],
@@ -996,10 +996,10 @@ constant pool: [
   Smi [22],
 ]
 handlers: [
-  [10, 349, 357],
-  [13, 306, 308],
-  [27, 153, 161],
+  [10, 343, 351],
+  [13, 303, 305],
+  [27, 150, 158],
   [30, 113, 115],
-  [222, 232, 234],
+  [219, 229, 231],
 ]
 
diff --git a/deps/v8/test/cctest/interpreter/bytecode_expectations/ForIn.golden b/deps/v8/test/cctest/interpreter/bytecode_expectations/ForIn.golden
index 6b8f4d7bdae4e5..73b72d4d208156 100644
--- a/deps/v8/test/cctest/interpreter/bytecode_expectations/ForIn.golden
+++ b/deps/v8/test/cctest/interpreter/bytecode_expectations/ForIn.golden
@@ -133,7 +133,7 @@ bytecodes: [
   /*   80 S> */ B(Return),
 ]
 constant pool: [
-  TUPLE2_TYPE,
+  ARRAY_BOILERPLATE_DESCRIPTION_TYPE,
 ]
 handlers: [
 ]
@@ -175,10 +175,10 @@ bytecodes: [
   /*  106 E> */ B(TestEqual), R(6), U8(7),
                 B(JumpIfFalse), U8(4),
   /*  113 S> */ B(Jump), U8(17),
-  /*  130 S> */ B(LdaNamedProperty), R(0), U8(2), U8(8),
+  /*  130 S> */ B(LdaNamedProperty), R(0), U8(2), U8(5),
                 B(Star), R(6),
                 B(LdaSmi), I8(20),
-  /*  136 E> */ B(TestEqual), R(6), U8(10),
+  /*  136 E> */ B(TestEqual), R(6), U8(8),
                 B(JumpIfFalse), U8(4),
   /*  143 S> */ B(Jump), U8(9),
                 B(ForInStep), R(5),
@@ -188,8 +188,8 @@ bytecodes: [
   /*  152 S> */ B(Return),
 ]
 constant pool: [
-  BOILERPLATE_DESCRIPTION_TYPE,
-  TUPLE2_TYPE,
+  OBJECT_BOILERPLATE_DESCRIPTION_TYPE,
+  ARRAY_BOILERPLATE_DESCRIPTION_TYPE,
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["a"],
 ]
 handlers: [
@@ -235,8 +235,8 @@ bytecodes: [
   /*   98 S> */ B(Return),
 ]
 constant pool: [
-  TUPLE2_TYPE,
-  TUPLE2_TYPE,
+  ARRAY_BOILERPLATE_DESCRIPTION_TYPE,
+  ARRAY_BOILERPLATE_DESCRIPTION_TYPE,
 ]
 handlers: [
 ]
diff --git a/deps/v8/test/cctest/interpreter/bytecode_expectations/ForOf.golden b/deps/v8/test/cctest/interpreter/bytecode_expectations/ForOf.golden
index 00f90714d3afce..5c603964c89feb 100644
--- a/deps/v8/test/cctest/interpreter/bytecode_expectations/ForOf.golden
+++ b/deps/v8/test/cctest/interpreter/bytecode_expectations/ForOf.golden
@@ -11,7 +11,7 @@ snippet: "
 "
 frame size: 15
 parameter count: 1
-bytecode array length: 248
+bytecode array length: 245
 bytecodes: [
   /*   30 E> */ B(StackCheck),
                 B(LdaZero),
@@ -46,10 +46,9 @@ bytecodes: [
                 B(LdaZero),
                 B(Star), R(5),
                 B(JumpLoop), U8(44), I8(0),
-                B(Jump), U8(36),
+                B(Jump), U8(33),
                 B(Star), R(13),
-                B(Ldar), R(closure),
-                B(CreateCatchContext), R(13), U8(5), U8(6),
+                B(CreateCatchContext), R(13), U8(5),
                 B(PushContext), R(13),
                 B(Star), R(12),
                 B(LdaSmi), I8(2),
@@ -74,7 +73,7 @@ bytecodes: [
                 B(LdaZero),
                 B(TestEqualStrict), R(5), U8(14),
                 B(JumpIfTrue), U8(90),
-                B(LdaNamedProperty), R(2), U8(7), U8(15),
+                B(LdaNamedProperty), R(2), U8(6), U8(15),
                 B(Star), R(7),
                 B(TestUndetectable),
                 B(JumpIfFalse), U8(4),
@@ -86,9 +85,9 @@ bytecodes: [
                 B(TestTypeOf), U8(6),
                 B(JumpIfFalse), U8(4),
                 B(Jump), U8(18),
-                B(Wide), B(LdaSmi), I16(147),
+                B(Wide), B(LdaSmi), I16(149),
                 B(Star), R(12),
-                B(LdaConstant), U8(8),
+                B(LdaConstant), U8(7),
                 B(Star), R(13),
                 B(CallRuntime), U16(Runtime::kNewTypeError), R(12), U8(2),
                 B(Throw),
@@ -112,7 +111,7 @@ bytecodes: [
                 B(Ldar), R(11),
                 B(SetPendingMessage),
                 B(LdaZero),
-                B(TestEqualStrictNoFeedback), R(9),
+                B(TestReferenceEqual), R(9),
                 B(JumpIfFalse), U8(5),
                 B(Ldar), R(10),
                 B(ReThrow),
@@ -120,20 +119,19 @@ bytecodes: [
   /*   62 S> */ B(Return),
 ]
 constant pool: [
-  TUPLE2_TYPE,
+  ARRAY_BOILERPLATE_DESCRIPTION_TYPE,
   SYMBOL_TYPE,
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["next"],
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["done"],
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["value"],
-  ONE_BYTE_INTERNALIZED_STRING_TYPE [".catch"],
   SCOPE_INFO_TYPE,
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["return"],
   ONE_BYTE_INTERNALIZED_STRING_TYPE [""],
 ]
 handlers: [
-  [7, 124, 132],
+  [7, 121, 129],
   [10, 88, 90],
-  [192, 202, 204],
+  [189, 199, 201],
 ]
 
 ---
@@ -143,7 +141,7 @@ snippet: "
 "
 frame size: 16
 parameter count: 1
-bytecode array length: 258
+bytecode array length: 255
 bytecodes: [
   /*   30 E> */ B(StackCheck),
   /*   42 S> */ B(LdaConstant), U8(0),
@@ -179,11 +177,10 @@ bytecodes: [
   /*   73 S> */ B(LdaZero),
                 B(Star), R(10),
                 B(Mov), R(7), R(11),
-                B(Jump), U8(52),
-                B(Jump), U8(36),
+                B(Jump), U8(49),
+                B(Jump), U8(33),
                 B(Star), R(14),
-                B(Ldar), R(closure),
-                B(CreateCatchContext), R(14), U8(5), U8(6),
+                B(CreateCatchContext), R(14), U8(5),
                 B(PushContext), R(14),
                 B(Star), R(13),
                 B(LdaSmi), I8(2),
@@ -208,7 +205,7 @@ bytecodes: [
                 B(LdaZero),
                 B(TestEqualStrict), R(6), U8(13),
                 B(JumpIfTrue), U8(90),
-                B(LdaNamedProperty), R(3), U8(7), U8(14),
+                B(LdaNamedProperty), R(3), U8(6), U8(14),
                 B(Star), R(8),
                 B(TestUndetectable),
                 B(JumpIfFalse), U8(4),
@@ -220,9 +217,9 @@ bytecodes: [
                 B(TestTypeOf), U8(6),
                 B(JumpIfFalse), U8(4),
                 B(Jump), U8(18),
-                B(Wide), B(LdaSmi), I16(147),
+                B(Wide), B(LdaSmi), I16(149),
                 B(Star), R(13),
-                B(LdaConstant), U8(8),
+                B(LdaConstant), U8(7),
                 B(Star), R(14),
                 B(CallRuntime), U16(Runtime::kNewTypeError), R(13), U8(2),
                 B(Throw),
@@ -246,7 +243,7 @@ bytecodes: [
                 B(Ldar), R(12),
                 B(SetPendingMessage),
                 B(Ldar), R(10),
-                B(SwitchOnSmiNoFeedback), U8(9), U8(2), I8(0),
+                B(SwitchOnSmiNoFeedback), U8(8), U8(2), I8(0),
                 B(Jump), U8(8),
                 B(Ldar), R(11),
   /*   85 S> */ B(Return),
@@ -261,7 +258,6 @@ constant pool: [
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["next"],
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["done"],
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["value"],
-  ONE_BYTE_INTERNALIZED_STRING_TYPE [".catch"],
   SCOPE_INFO_TYPE,
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["return"],
   ONE_BYTE_INTERNALIZED_STRING_TYPE [""],
@@ -269,9 +265,9 @@ constant pool: [
   Smi [9],
 ]
 handlers: [
-  [11, 127, 135],
+  [11, 124, 132],
   [14, 91, 93],
-  [196, 206, 208],
+  [193, 203, 205],
 ]
 
 ---
@@ -283,7 +279,7 @@ snippet: "
 "
 frame size: 15
 parameter count: 1
-bytecode array length: 266
+bytecode array length: 263
 bytecodes: [
   /*   30 E> */ B(StackCheck),
                 B(LdaZero),
@@ -326,10 +322,9 @@ bytecodes: [
                 B(LdaZero),
                 B(Star), R(5),
                 B(JumpLoop), U8(62), I8(0),
-                B(Jump), U8(36),
+                B(Jump), U8(33),
                 B(Star), R(13),
-                B(Ldar), R(closure),
-                B(CreateCatchContext), R(13), U8(5), U8(6),
+                B(CreateCatchContext), R(13), U8(5),
                 B(PushContext), R(13),
                 B(Star), R(12),
                 B(LdaSmi), I8(2),
@@ -354,7 +349,7 @@ bytecodes: [
                 B(LdaZero),
                 B(TestEqualStrict), R(5), U8(16),
                 B(JumpIfTrue), U8(90),
-                B(LdaNamedProperty), R(2), U8(7), U8(17),
+                B(LdaNamedProperty), R(2), U8(6), U8(17),
                 B(Star), R(7),
                 B(TestUndetectable),
                 B(JumpIfFalse), U8(4),
@@ -366,9 +361,9 @@ bytecodes: [
                 B(TestTypeOf), U8(6),
                 B(JumpIfFalse), U8(4),
                 B(Jump), U8(18),
-                B(Wide), B(LdaSmi), I16(147),
+                B(Wide), B(LdaSmi), I16(149),
                 B(Star), R(12),
-                B(LdaConstant), U8(8),
+                B(LdaConstant), U8(7),
                 B(Star), R(13),
                 B(CallRuntime), U16(Runtime::kNewTypeError), R(12), U8(2),
                 B(Throw),
@@ -392,7 +387,7 @@ bytecodes: [
                 B(Ldar), R(11),
                 B(SetPendingMessage),
                 B(LdaZero),
-                B(TestEqualStrictNoFeedback), R(9),
+                B(TestReferenceEqual), R(9),
                 B(JumpIfFalse), U8(5),
                 B(Ldar), R(10),
                 B(ReThrow),
@@ -400,20 +395,19 @@ bytecodes: [
   /*  113 S> */ B(Return),
 ]
 constant pool: [
-  TUPLE2_TYPE,
+  ARRAY_BOILERPLATE_DESCRIPTION_TYPE,
   SYMBOL_TYPE,
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["next"],
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["done"],
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["value"],
-  ONE_BYTE_INTERNALIZED_STRING_TYPE [".catch"],
   SCOPE_INFO_TYPE,
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["return"],
   ONE_BYTE_INTERNALIZED_STRING_TYPE [""],
 ]
 handlers: [
-  [7, 142, 150],
+  [7, 139, 147],
   [10, 106, 108],
-  [210, 220, 222],
+  [207, 217, 219],
 ]
 
 ---
@@ -423,7 +417,7 @@ snippet: "
 "
 frame size: 14
 parameter count: 1
-bytecode array length: 268
+bytecode array length: 265
 bytecodes: [
   /*   30 E> */ B(StackCheck),
   /*   42 S> */ B(CreateObjectLiteral), U8(0), U8(0), U8(41), R(8),
@@ -461,11 +455,10 @@ bytecodes: [
                 B(Star), R(9),
                 B(LdaZero),
                 B(Star), R(8),
-                B(Jump), U8(52),
-                B(Jump), U8(36),
+                B(Jump), U8(49),
+                B(Jump), U8(33),
                 B(Star), R(12),
-                B(Ldar), R(closure),
-                B(CreateCatchContext), R(12), U8(7), U8(8),
+                B(CreateCatchContext), R(12), U8(7),
                 B(PushContext), R(12),
                 B(Star), R(11),
                 B(LdaSmi), I8(2),
@@ -490,7 +483,7 @@ bytecodes: [
                 B(LdaZero),
                 B(TestEqualStrict), R(4), U8(19),
                 B(JumpIfTrue), U8(90),
-                B(LdaNamedProperty), R(1), U8(9), U8(20),
+                B(LdaNamedProperty), R(1), U8(8), U8(20),
                 B(Star), R(6),
                 B(TestUndetectable),
                 B(JumpIfFalse), U8(4),
@@ -502,9 +495,9 @@ bytecodes: [
                 B(TestTypeOf), U8(6),
                 B(JumpIfFalse), U8(4),
                 B(Jump), U8(18),
-                B(Wide), B(LdaSmi), I16(147),
+                B(Wide), B(LdaSmi), I16(149),
                 B(Star), R(11),
-                B(LdaConstant), U8(10),
+                B(LdaConstant), U8(9),
                 B(Star), R(12),
                 B(CallRuntime), U16(Runtime::kNewTypeError), R(11), U8(2),
                 B(Throw),
@@ -528,7 +521,7 @@ bytecodes: [
                 B(Ldar), R(10),
                 B(SetPendingMessage),
                 B(Ldar), R(8),
-                B(SwitchOnSmiNoFeedback), U8(11), U8(2), I8(0),
+                B(SwitchOnSmiNoFeedback), U8(10), U8(2), I8(0),
                 B(Jump), U8(8),
                 B(Ldar), R(9),
   /*  105 S> */ B(Return),
@@ -538,14 +531,13 @@ bytecodes: [
   /*  105 S> */ B(Return),
 ]
 constant pool: [
-  BOILERPLATE_DESCRIPTION_TYPE,
-  TUPLE2_TYPE,
+  OBJECT_BOILERPLATE_DESCRIPTION_TYPE,
+  ARRAY_BOILERPLATE_DESCRIPTION_TYPE,
   SYMBOL_TYPE,
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["next"],
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["done"],
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["value"],
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["a"],
-  ONE_BYTE_INTERNALIZED_STRING_TYPE [".catch"],
   SCOPE_INFO_TYPE,
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["return"],
   ONE_BYTE_INTERNALIZED_STRING_TYPE [""],
@@ -553,8 +545,8 @@ constant pool: [
   Smi [9],
 ]
 handlers: [
-  [15, 137, 145],
+  [15, 134, 142],
   [18, 101, 103],
-  [206, 216, 218],
+  [203, 213, 215],
 ]
 
diff --git a/deps/v8/test/cctest/interpreter/bytecode_expectations/ForOfLoop.golden b/deps/v8/test/cctest/interpreter/bytecode_expectations/ForOfLoop.golden
index f92076e6e65ebe..90fcb9065d5b16 100644
--- a/deps/v8/test/cctest/interpreter/bytecode_expectations/ForOfLoop.golden
+++ b/deps/v8/test/cctest/interpreter/bytecode_expectations/ForOfLoop.golden
@@ -15,7 +15,7 @@ snippet: "
 "
 frame size: 17
 parameter count: 2
-bytecode array length: 248
+bytecode array length: 245
 bytecodes: [
   /*   10 E> */ B(StackCheck),
                 B(LdaZero),
@@ -50,10 +50,9 @@ bytecodes: [
                 B(LdaZero),
                 B(Star), R(7),
                 B(JumpLoop), U8(47), I8(0),
-                B(Jump), U8(36),
+                B(Jump), U8(33),
                 B(Star), R(15),
-                B(Ldar), R(closure),
-  /*   49 E> */ B(CreateCatchContext), R(15), U8(4), U8(5),
+  /*   49 E> */ B(CreateCatchContext), R(15), U8(4),
                 B(PushContext), R(15),
                 B(Star), R(14),
                 B(LdaSmi), I8(2),
@@ -78,7 +77,7 @@ bytecodes: [
                 B(LdaZero),
                 B(TestEqualStrict), R(7), U8(13),
                 B(JumpIfTrue), U8(90),
-                B(LdaNamedProperty), R(4), U8(6), U8(14),
+                B(LdaNamedProperty), R(4), U8(5), U8(14),
                 B(Star), R(9),
                 B(TestUndetectable),
                 B(JumpIfFalse), U8(4),
@@ -90,9 +89,9 @@ bytecodes: [
                 B(TestTypeOf), U8(6),
                 B(JumpIfFalse), U8(4),
                 B(Jump), U8(18),
-                B(Wide), B(LdaSmi), I16(147),
+                B(Wide), B(LdaSmi), I16(149),
                 B(Star), R(14),
-                B(LdaConstant), U8(7),
+                B(LdaConstant), U8(6),
                 B(Star), R(15),
                 B(CallRuntime), U16(Runtime::kNewTypeError), R(14), U8(2),
                 B(Throw),
@@ -116,7 +115,7 @@ bytecodes: [
                 B(Ldar), R(13),
                 B(SetPendingMessage),
                 B(LdaZero),
-                B(TestEqualStrictNoFeedback), R(11),
+                B(TestReferenceEqual), R(11),
                 B(JumpIfFalse), U8(5),
                 B(Ldar), R(12),
                 B(ReThrow),
@@ -128,15 +127,14 @@ constant pool: [
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["next"],
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["done"],
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["value"],
-  ONE_BYTE_INTERNALIZED_STRING_TYPE [".catch"],
   SCOPE_INFO_TYPE,
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["return"],
   ONE_BYTE_INTERNALIZED_STRING_TYPE [""],
 ]
 handlers: [
-  [7, 124, 132],
+  [7, 121, 129],
   [10, 88, 90],
-  [192, 202, 204],
+  [189, 199, 201],
 ]
 
 ---
@@ -148,9 +146,9 @@ snippet: "
 "
 frame size: 24
 parameter count: 2
-bytecode array length: 331
+bytecode array length: 325
 bytecodes: [
-                B(CreateFunctionContext), U8(4),
+                B(CreateFunctionContext), U8(0), U8(4),
                 B(PushContext), R(9),
                 B(Ldar), R(this),
                 B(StaCurrentContextSlot), U8(5),
@@ -161,8 +159,7 @@ bytecodes: [
                 B(Ldar), R(8),
                 B(StaCurrentContextSlot), U8(6),
   /*   10 E> */ B(StackCheck),
-                B(Ldar), R(closure),
-                B(CreateBlockContext), U8(0),
+                B(CreateBlockContext), U8(1),
                 B(PushContext), R(10),
                 B(LdaTheHole),
                 B(StaCurrentContextSlot), U8(4),
@@ -172,13 +169,13 @@ bytecodes: [
                 B(Mov), R(context), R(14),
   /*   34 S> */ B(LdaContextSlot), R(10), U8(4), U8(0),
                 B(Star), R(15),
-                B(LdaNamedProperty), R(15), U8(1), U8(0),
+                B(LdaNamedProperty), R(15), U8(2), U8(0),
                 B(Star), R(16),
                 B(CallProperty0), R(16), R(15), U8(2),
                 B(JumpIfJSReceiver), U8(7),
                 B(CallRuntime), U16(Runtime::kThrowSymbolIteratorInvalid), R(0), U8(0),
                 B(Star), R(1),
-  /*   34 E> */ B(LdaNamedProperty), R(1), U8(2), U8(4),
+  /*   34 E> */ B(LdaNamedProperty), R(1), U8(3), U8(4),
                 B(Star), R(2),
   /*   29 S> */ B(CallProperty0), R(2), R(1), U8(6),
                 B(Star), R(3),
@@ -186,24 +183,23 @@ bytecodes: [
                 B(ToBooleanLogicalNot),
                 B(JumpIfFalse), U8(7),
                 B(CallRuntime), U16(Runtime::kThrowIteratorResultNotAnObject), R(3), U8(1),
-                B(LdaNamedProperty), R(3), U8(3), U8(8),
-                B(JumpIfToBooleanTrue), U8(78),
-                B(LdaNamedProperty), R(3), U8(4), U8(10),
+                B(LdaNamedProperty), R(3), U8(4), U8(8),
+                B(JumpIfToBooleanTrue), U8(76),
+                B(LdaNamedProperty), R(3), U8(5), U8(10),
                 B(Star), R(5),
                 B(LdaSmi), I8(2),
                 B(Star), R(4),
                 B(Mov), R(5), R(0),
   /*   20 E> */ B(StackCheck),
-                B(Ldar), R(closure),
-                B(CreateBlockContext), U8(5),
+                B(CreateBlockContext), U8(6),
                 B(PushContext), R(15),
                 B(LdaTheHole),
                 B(StaCurrentContextSlot), U8(4),
                 B(Ldar), R(5),
                 B(StaCurrentContextSlot), U8(4),
-  /*   41 S> */ B(LdaLookupGlobalSlot), U8(6), U8(12), U8(3),
+  /*   41 S> */ B(LdaLookupGlobalSlot), U8(7), U8(12), U8(3),
                 B(Star), R(16),
-                B(LdaConstant), U8(7),
+                B(LdaConstant), U8(8),
                 B(Star), R(17),
                 B(LdaZero),
                 B(Star), R(21),
@@ -220,11 +216,10 @@ bytecodes: [
                 B(PopContext), R(15),
                 B(LdaZero),
                 B(Star), R(4),
-                B(JumpLoop), U8(97), I8(0),
-                B(Jump), U8(36),
+                B(JumpLoop), U8(95), I8(0),
+                B(Jump), U8(33),
                 B(Star), R(15),
-                B(Ldar), R(closure),
-                B(CreateCatchContext), R(15), U8(8), U8(9),
+                B(CreateCatchContext), R(15), U8(9),
                 B(PushContext), R(15),
                 B(Star), R(14),
                 B(LdaSmi), I8(2),
@@ -261,7 +256,7 @@ bytecodes: [
                 B(TestTypeOf), U8(6),
                 B(JumpIfFalse), U8(4),
                 B(Jump), U8(18),
-                B(Wide), B(LdaSmi), I16(147),
+                B(Wide), B(LdaSmi), I16(149),
                 B(Star), R(14),
                 B(LdaConstant), U8(11),
                 B(Star), R(15),
@@ -287,7 +282,7 @@ bytecodes: [
                 B(Ldar), R(13),
                 B(SetPendingMessage),
                 B(LdaZero),
-                B(TestEqualStrictNoFeedback), R(11),
+                B(TestReferenceEqual), R(11),
                 B(JumpIfFalse), U8(5),
                 B(Ldar), R(12),
                 B(ReThrow),
@@ -296,6 +291,7 @@ bytecodes: [
   /*   54 S> */ B(Return),
 ]
 constant pool: [
+  SCOPE_INFO_TYPE,
   SCOPE_INFO_TYPE,
   SYMBOL_TYPE,
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["next"],
@@ -304,15 +300,14 @@ constant pool: [
   SCOPE_INFO_TYPE,
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["eval"],
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["1"],
-  ONE_BYTE_INTERNALIZED_STRING_TYPE [".catch"],
   SCOPE_INFO_TYPE,
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["return"],
   ONE_BYTE_INTERNALIZED_STRING_TYPE [""],
 ]
 handlers: [
-  [35, 205, 213],
-  [38, 169, 171],
-  [273, 283, 285],
+  [34, 199, 207],
+  [37, 166, 168],
+  [267, 277, 279],
 ]
 
 ---
@@ -324,7 +319,7 @@ snippet: "
 "
 frame size: 15
 parameter count: 2
-bytecode array length: 266
+bytecode array length: 261
 bytecodes: [
   /*   10 E> */ B(StackCheck),
                 B(LdaZero),
@@ -347,14 +342,13 @@ bytecodes: [
                 B(JumpIfFalse), U8(7),
                 B(CallRuntime), U16(Runtime::kThrowIteratorResultNotAnObject), R(4), U8(1),
                 B(LdaNamedProperty), R(4), U8(2), U8(8),
-                B(JumpIfToBooleanTrue), U8(46),
+                B(JumpIfToBooleanTrue), U8(44),
                 B(LdaNamedProperty), R(4), U8(3), U8(10),
                 B(Star), R(6),
                 B(LdaSmi), I8(2),
                 B(Star), R(5),
                 B(Mov), R(6), R(1),
   /*   20 E> */ B(StackCheck),
-                B(Ldar), R(closure),
                 B(CreateBlockContext), U8(4),
                 B(PushContext), R(13),
                 B(LdaTheHole),
@@ -367,11 +361,10 @@ bytecodes: [
                 B(PopContext), R(13),
                 B(LdaZero),
                 B(Star), R(5),
-                B(JumpLoop), U8(65), I8(0),
-                B(Jump), U8(36),
+                B(JumpLoop), U8(63), I8(0),
+                B(Jump), U8(33),
                 B(Star), R(13),
-                B(Ldar), R(closure),
-                B(CreateCatchContext), R(13), U8(6), U8(7),
+                B(CreateCatchContext), R(13), U8(6),
                 B(PushContext), R(13),
                 B(Star), R(12),
                 B(LdaSmi), I8(2),
@@ -396,7 +389,7 @@ bytecodes: [
                 B(LdaZero),
                 B(TestEqualStrict), R(5), U8(16),
                 B(JumpIfTrue), U8(90),
-                B(LdaNamedProperty), R(2), U8(8), U8(17),
+                B(LdaNamedProperty), R(2), U8(7), U8(17),
                 B(Star), R(7),
                 B(TestUndetectable),
                 B(JumpIfFalse), U8(4),
@@ -408,9 +401,9 @@ bytecodes: [
                 B(TestTypeOf), U8(6),
                 B(JumpIfFalse), U8(4),
                 B(Jump), U8(18),
-                B(Wide), B(LdaSmi), I16(147),
+                B(Wide), B(LdaSmi), I16(149),
                 B(Star), R(12),
-                B(LdaConstant), U8(9),
+                B(LdaConstant), U8(8),
                 B(Star), R(13),
                 B(CallRuntime), U16(Runtime::kNewTypeError), R(12), U8(2),
                 B(Throw),
@@ -434,7 +427,7 @@ bytecodes: [
                 B(Ldar), R(11),
                 B(SetPendingMessage),
                 B(LdaZero),
-                B(TestEqualStrictNoFeedback), R(9),
+                B(TestReferenceEqual), R(9),
                 B(JumpIfFalse), U8(5),
                 B(Ldar), R(10),
                 B(ReThrow),
@@ -448,15 +441,14 @@ constant pool: [
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["value"],
   SCOPE_INFO_TYPE,
   SHARED_FUNCTION_INFO_TYPE,
-  ONE_BYTE_INTERNALIZED_STRING_TYPE [".catch"],
   SCOPE_INFO_TYPE,
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["return"],
   ONE_BYTE_INTERNALIZED_STRING_TYPE [""],
 ]
 handlers: [
-  [7, 142, 150],
-  [10, 106, 108],
-  [210, 220, 222],
+  [7, 137, 145],
+  [10, 104, 106],
+  [205, 215, 217],
 ]
 
 ---
@@ -468,7 +460,7 @@ snippet: "
 "
 frame size: 20
 parameter count: 2
-bytecode array length: 286
+bytecode array length: 283
 bytecodes: [
   /*   10 E> */ B(StackCheck),
                 B(LdaZero),
@@ -503,7 +495,7 @@ bytecodes: [
                 B(JumpIfUndefined), U8(6),
                 B(Ldar), R(6),
                 B(JumpIfNotNull), U8(16),
-                B(LdaSmi), I8(77),
+                B(LdaSmi), I8(78),
                 B(Star), R(18),
                 B(LdaConstant), U8(4),
                 B(Star), R(19),
@@ -519,10 +511,9 @@ bytecodes: [
                 B(LdaZero),
                 B(Star), R(10),
                 B(JumpLoop), U8(85), I8(0),
-                B(Jump), U8(36),
+                B(Jump), U8(33),
                 B(Star), R(18),
-                B(Ldar), R(closure),
-  /*   56 E> */ B(CreateCatchContext), R(18), U8(6), U8(7),
+  /*   56 E> */ B(CreateCatchContext), R(18), U8(6),
                 B(PushContext), R(18),
                 B(Star), R(17),
                 B(LdaSmi), I8(2),
@@ -547,7 +538,7 @@ bytecodes: [
                 B(LdaZero),
                 B(TestEqualStrict), R(10), U8(18),
                 B(JumpIfTrue), U8(90),
-                B(LdaNamedProperty), R(7), U8(8), U8(19),
+                B(LdaNamedProperty), R(7), U8(7), U8(19),
                 B(Star), R(12),
                 B(TestUndetectable),
                 B(JumpIfFalse), U8(4),
@@ -559,9 +550,9 @@ bytecodes: [
                 B(TestTypeOf), U8(6),
                 B(JumpIfFalse), U8(4),
                 B(Jump), U8(18),
-                B(Wide), B(LdaSmi), I16(147),
+                B(Wide), B(LdaSmi), I16(149),
                 B(Star), R(17),
-                B(LdaConstant), U8(9),
+                B(LdaConstant), U8(8),
                 B(Star), R(18),
                 B(CallRuntime), U16(Runtime::kNewTypeError), R(17), U8(2),
                 B(Throw),
@@ -585,7 +576,7 @@ bytecodes: [
                 B(Ldar), R(16),
                 B(SetPendingMessage),
                 B(LdaZero),
-                B(TestEqualStrictNoFeedback), R(14),
+                B(TestReferenceEqual), R(14),
                 B(JumpIfFalse), U8(5),
                 B(Ldar), R(15),
                 B(ReThrow),
@@ -599,15 +590,14 @@ constant pool: [
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["value"],
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["x"],
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["y"],
-  ONE_BYTE_INTERNALIZED_STRING_TYPE [".catch"],
   SCOPE_INFO_TYPE,
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["return"],
   ONE_BYTE_INTERNALIZED_STRING_TYPE [""],
 ]
 handlers: [
-  [7, 162, 170],
+  [7, 159, 167],
   [10, 126, 128],
-  [230, 240, 242],
+  [227, 237, 239],
 ]
 
 ---
@@ -617,38 +607,33 @@ snippet: "
   }
   f([1, 2, 3]);
 "
-frame size: 19
+frame size: 18
 parameter count: 2
-bytecode array length: 298
+bytecode array length: 286
 bytecodes: [
                 B(SwitchOnGeneratorState), R(3), U8(0), U8(1),
-                B(CreateFunctionContext), U8(1),
-                B(PushContext), R(12),
-                B(Ldar), R(arg0),
-                B(StaCurrentContextSlot), U8(4),
-                B(Mov), R(closure), R(13),
-                B(Mov), R(this), R(14),
-                B(InvokeIntrinsic), U8(Runtime::k_CreateJSGeneratorObject), R(13), U8(2),
+                B(Mov), R(closure), R(12),
+                B(Mov), R(this), R(13),
+                B(InvokeIntrinsic), U8(Runtime::k_CreateJSGeneratorObject), R(12), U8(2),
                 B(Star), R(3),
   /*   11 E> */ B(StackCheck),
-  /*   11 E> */ B(SuspendGenerator), R(3), R(0), U8(13), U8(0),
-                B(ResumeGenerator), R(3), R(0), U8(13),
-                B(Star), R(13),
+  /*   11 E> */ B(SuspendGenerator), R(3), R(0), U8(12), U8(0),
+                B(ResumeGenerator), R(3), R(0), U8(12),
+                B(Star), R(12),
                 B(InvokeIntrinsic), U8(Runtime::k_GeneratorGetResumeMode), R(3), U8(1),
                 B(SwitchOnSmiNoFeedback), U8(1), U8(2), I8(0),
-                B(Ldar), R(13),
+                B(Ldar), R(12),
   /*   11 E> */ B(Throw),
-                B(Ldar), R(13),
+                B(Ldar), R(12),
   /*   55 S> */ B(Return),
                 B(LdaZero),
                 B(Star), R(8),
+                B(Mov), R(context), R(14),
                 B(Mov), R(context), R(15),
-                B(Mov), R(context), R(16),
-  /*   35 S> */ B(LdaImmutableCurrentContextSlot), U8(4),
+  /*   35 S> */ B(LdaNamedProperty), R(arg0), U8(3), U8(0),
                 B(Star), R(17),
-                B(LdaNamedProperty), R(17), U8(3), U8(0),
-                B(Star), R(18),
-                B(CallProperty0), R(18), R(17), U8(2),
+                B(CallProperty0), R(17), R(arg0), U8(2),
+                B(Mov), R(arg0), R(16),
                 B(JumpIfJSReceiver), U8(7),
                 B(CallRuntime), U16(Runtime::kThrowSymbolIteratorInvalid), R(0), U8(0),
                 B(Star), R(5),
@@ -673,35 +658,34 @@ bytecodes: [
                 B(LdaZero),
                 B(Star), R(8),
                 B(JumpLoop), U8(47), I8(0),
-                B(Jump), U8(36),
-                B(Star), R(17),
-                B(Ldar), R(closure),
-  /*   50 E> */ B(CreateCatchContext), R(17), U8(7), U8(8),
-                B(PushContext), R(17),
+                B(Jump), U8(33),
                 B(Star), R(16),
+  /*   50 E> */ B(CreateCatchContext), R(16), U8(7),
+                B(PushContext), R(16),
+                B(Star), R(15),
                 B(LdaSmi), I8(2),
                 B(TestEqualStrict), R(8), U8(12),
                 B(JumpIfFalse), U8(6),
                 B(LdaSmi), I8(1),
                 B(Star), R(8),
                 B(LdaImmutableCurrentContextSlot), U8(4),
-                B(Star), R(18),
-                B(CallRuntime), U16(Runtime::kReThrow), R(18), U8(1),
-                B(PopContext), R(17),
+                B(Star), R(17),
+                B(CallRuntime), U16(Runtime::kReThrow), R(17), U8(1),
+                B(PopContext), R(16),
                 B(LdaSmi), I8(-1),
-                B(Star), R(14),
                 B(Star), R(13),
+                B(Star), R(12),
                 B(Jump), U8(7),
-                B(Star), R(14),
-                B(LdaZero),
                 B(Star), R(13),
+                B(LdaZero),
+                B(Star), R(12),
                 B(LdaTheHole),
                 B(SetPendingMessage),
-                B(Star), R(15),
+                B(Star), R(14),
                 B(LdaZero),
                 B(TestEqualStrict), R(8), U8(13),
                 B(JumpIfTrue), U8(90),
-                B(LdaNamedProperty), R(5), U8(9), U8(14),
+                B(LdaNamedProperty), R(5), U8(8), U8(14),
                 B(Star), R(10),
                 B(TestUndetectable),
                 B(JumpIfFalse), U8(4),
@@ -713,56 +697,55 @@ bytecodes: [
                 B(TestTypeOf), U8(6),
                 B(JumpIfFalse), U8(4),
                 B(Jump), U8(18),
-                B(Wide), B(LdaSmi), I16(147),
+                B(Wide), B(LdaSmi), I16(149),
+                B(Star), R(15),
+                B(LdaConstant), U8(9),
                 B(Star), R(16),
-                B(LdaConstant), U8(10),
-                B(Star), R(17),
-                B(CallRuntime), U16(Runtime::kNewTypeError), R(16), U8(2),
+                B(CallRuntime), U16(Runtime::kNewTypeError), R(15), U8(2),
                 B(Throw),
-                B(Mov), R(context), R(16),
-                B(Mov), R(10), R(17),
-                B(Mov), R(5), R(18),
-                B(InvokeIntrinsic), U8(Runtime::k_Call), R(17), U8(2),
+                B(Mov), R(context), R(15),
+                B(Mov), R(10), R(16),
+                B(Mov), R(5), R(17),
+                B(InvokeIntrinsic), U8(Runtime::k_Call), R(16), U8(2),
                 B(Jump), U8(6),
                 B(LdaTheHole),
                 B(SetPendingMessage),
-                B(Ldar), R(16),
+                B(Ldar), R(15),
                 B(Jump), U8(27),
-                B(Mov), R(10), R(16),
-                B(Mov), R(5), R(17),
-                B(InvokeIntrinsic), U8(Runtime::k_Call), R(16), U8(2),
+                B(Mov), R(10), R(15),
+                B(Mov), R(5), R(16),
+                B(InvokeIntrinsic), U8(Runtime::k_Call), R(15), U8(2),
                 B(Star), R(11),
                 B(InvokeIntrinsic), U8(Runtime::k_IsJSReceiver), R(11), U8(1),
                 B(JumpIfToBooleanFalse), U8(4),
                 B(Jump), U8(7),
                 B(CallRuntime), U16(Runtime::kThrowIteratorResultNotAnObject), R(11), U8(1),
-                B(Ldar), R(15),
+                B(Ldar), R(14),
                 B(SetPendingMessage),
                 B(LdaZero),
-                B(TestEqualStrictNoFeedback), R(13),
+                B(TestReferenceEqual), R(12),
                 B(JumpIfFalse), U8(5),
-                B(Ldar), R(14),
+                B(Ldar), R(13),
                 B(ReThrow),
                 B(LdaUndefined),
   /*   55 S> */ B(Return),
 ]
 constant pool: [
-  Smi [30],
+  Smi [22],
   Smi [10],
   Smi [7],
   SYMBOL_TYPE,
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["next"],
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["done"],
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["value"],
-  ONE_BYTE_INTERNALIZED_STRING_TYPE [".catch"],
   SCOPE_INFO_TYPE,
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["return"],
   ONE_BYTE_INTERNALIZED_STRING_TYPE [""],
 ]
 handlers: [
-  [56, 174, 182],
-  [59, 138, 140],
-  [242, 252, 254],
+  [48, 162, 170],
+  [51, 129, 131],
+  [230, 240, 242],
 ]
 
 ---
@@ -772,38 +755,33 @@ snippet: "
   }
   f([1, 2, 3]);
 "
-frame size: 18
+frame size: 17
 parameter count: 2
-bytecode array length: 342
+bytecode array length: 330
 bytecodes: [
                 B(SwitchOnGeneratorState), R(2), U8(0), U8(2),
-                B(CreateFunctionContext), U8(1),
-                B(PushContext), R(11),
-                B(Ldar), R(arg0),
-                B(StaCurrentContextSlot), U8(4),
-                B(Mov), R(closure), R(12),
-                B(Mov), R(this), R(13),
-                B(InvokeIntrinsic), U8(Runtime::k_CreateJSGeneratorObject), R(12), U8(2),
+                B(Mov), R(closure), R(11),
+                B(Mov), R(this), R(12),
+                B(InvokeIntrinsic), U8(Runtime::k_CreateJSGeneratorObject), R(11), U8(2),
                 B(Star), R(2),
   /*   11 E> */ B(StackCheck),
-  /*   11 E> */ B(SuspendGenerator), R(2), R(0), U8(12), U8(0),
-                B(ResumeGenerator), R(2), R(0), U8(12),
-                B(Star), R(12),
+  /*   11 E> */ B(SuspendGenerator), R(2), R(0), U8(11), U8(0),
+                B(ResumeGenerator), R(2), R(0), U8(11),
+                B(Star), R(11),
                 B(InvokeIntrinsic), U8(Runtime::k_GeneratorGetResumeMode), R(2), U8(1),
                 B(SwitchOnSmiNoFeedback), U8(2), U8(2), I8(0),
-                B(Ldar), R(12),
+                B(Ldar), R(11),
   /*   11 E> */ B(Throw),
-                B(Ldar), R(12),
+                B(Ldar), R(11),
   /*   49 S> */ B(Return),
                 B(LdaZero),
                 B(Star), R(7),
+                B(Mov), R(context), R(13),
                 B(Mov), R(context), R(14),
-                B(Mov), R(context), R(15),
-  /*   35 S> */ B(LdaImmutableCurrentContextSlot), U8(4),
+  /*   35 S> */ B(LdaNamedProperty), R(arg0), U8(4), U8(0),
                 B(Star), R(16),
-                B(LdaNamedProperty), R(16), U8(4), U8(0),
-                B(Star), R(17),
-                B(CallProperty0), R(17), R(16), U8(2),
+                B(CallProperty0), R(16), R(arg0), U8(2),
+                B(Mov), R(arg0), R(15),
                 B(JumpIfJSReceiver), U8(7),
                 B(CallRuntime), U16(Runtime::kThrowSymbolIteratorInvalid), R(0), U8(0),
                 B(Star), R(4),
@@ -825,52 +803,51 @@ bytecodes: [
   /*   21 E> */ B(StackCheck),
                 B(Mov), R(3), R(0),
   /*   40 S> */ B(LdaFalse),
-                B(Star), R(17),
-                B(Mov), R(0), R(16),
-                B(InvokeIntrinsic), U8(Runtime::k_CreateIterResultObject), R(16), U8(2),
-  /*   40 E> */ B(SuspendGenerator), R(2), R(0), U8(16), U8(1),
-                B(ResumeGenerator), R(2), R(0), U8(16),
                 B(Star), R(16),
+                B(Mov), R(0), R(15),
+                B(InvokeIntrinsic), U8(Runtime::k_CreateIterResultObject), R(15), U8(2),
+  /*   40 E> */ B(SuspendGenerator), R(2), R(0), U8(15), U8(1),
+                B(ResumeGenerator), R(2), R(0), U8(15),
+                B(Star), R(15),
                 B(InvokeIntrinsic), U8(Runtime::k_GeneratorGetResumeMode), R(2), U8(1),
                 B(SwitchOnSmiNoFeedback), U8(8), U8(2), I8(0),
-                B(Ldar), R(16),
+                B(Ldar), R(15),
   /*   40 E> */ B(Throw),
                 B(LdaZero),
-                B(Star), R(12),
-                B(Mov), R(16), R(13),
-                B(Jump), U8(58),
+                B(Star), R(11),
+                B(Mov), R(15), R(12),
+                B(Jump), U8(55),
                 B(LdaZero),
                 B(Star), R(7),
                 B(JumpLoop), U8(84), I8(0),
-                B(Jump), U8(36),
-                B(Star), R(16),
-                B(Ldar), R(closure),
-                B(CreateCatchContext), R(16), U8(10), U8(11),
-                B(PushContext), R(16),
+                B(Jump), U8(33),
                 B(Star), R(15),
+                B(CreateCatchContext), R(15), U8(10),
+                B(PushContext), R(15),
+                B(Star), R(14),
                 B(LdaSmi), I8(2),
                 B(TestEqualStrict), R(7), U8(12),
                 B(JumpIfFalse), U8(6),
                 B(LdaSmi), I8(1),
                 B(Star), R(7),
                 B(LdaImmutableCurrentContextSlot), U8(4),
-                B(Star), R(17),
-                B(CallRuntime), U16(Runtime::kReThrow), R(17), U8(1),
-                B(PopContext), R(16),
+                B(Star), R(16),
+                B(CallRuntime), U16(Runtime::kReThrow), R(16), U8(1),
+                B(PopContext), R(15),
                 B(LdaSmi), I8(-1),
-                B(Star), R(13),
                 B(Star), R(12),
+                B(Star), R(11),
                 B(Jump), U8(8),
-                B(Star), R(13),
-                B(LdaSmi), I8(1),
                 B(Star), R(12),
+                B(LdaSmi), I8(1),
+                B(Star), R(11),
                 B(LdaTheHole),
                 B(SetPendingMessage),
-                B(Star), R(14),
+                B(Star), R(13),
                 B(LdaZero),
                 B(TestEqualStrict), R(7), U8(13),
                 B(JumpIfTrue), U8(90),
-                B(LdaNamedProperty), R(4), U8(12), U8(14),
+                B(LdaNamedProperty), R(4), U8(11), U8(14),
                 B(Star), R(9),
                 B(TestUndetectable),
                 B(JumpIfFalse), U8(4),
@@ -882,44 +859,44 @@ bytecodes: [
                 B(TestTypeOf), U8(6),
                 B(JumpIfFalse), U8(4),
                 B(Jump), U8(18),
-                B(Wide), B(LdaSmi), I16(147),
+                B(Wide), B(LdaSmi), I16(149),
+                B(Star), R(14),
+                B(LdaConstant), U8(12),
                 B(Star), R(15),
-                B(LdaConstant), U8(13),
-                B(Star), R(16),
-                B(CallRuntime), U16(Runtime::kNewTypeError), R(15), U8(2),
+                B(CallRuntime), U16(Runtime::kNewTypeError), R(14), U8(2),
                 B(Throw),
-                B(Mov), R(context), R(15),
-                B(Mov), R(9), R(16),
-                B(Mov), R(4), R(17),
-                B(InvokeIntrinsic), U8(Runtime::k_Call), R(16), U8(2),
+                B(Mov), R(context), R(14),
+                B(Mov), R(9), R(15),
+                B(Mov), R(4), R(16),
+                B(InvokeIntrinsic), U8(Runtime::k_Call), R(15), U8(2),
                 B(Jump), U8(6),
                 B(LdaTheHole),
                 B(SetPendingMessage),
-                B(Ldar), R(15),
+                B(Ldar), R(14),
                 B(Jump), U8(27),
-                B(Mov), R(9), R(15),
-                B(Mov), R(4), R(16),
-                B(InvokeIntrinsic), U8(Runtime::k_Call), R(15), U8(2),
+                B(Mov), R(9), R(14),
+                B(Mov), R(4), R(15),
+                B(InvokeIntrinsic), U8(Runtime::k_Call), R(14), U8(2),
                 B(Star), R(10),
                 B(InvokeIntrinsic), U8(Runtime::k_IsJSReceiver), R(10), U8(1),
                 B(JumpIfToBooleanFalse), U8(4),
                 B(Jump), U8(7),
                 B(CallRuntime), U16(Runtime::kThrowIteratorResultNotAnObject), R(10), U8(1),
-                B(Ldar), R(14),
+                B(Ldar), R(13),
                 B(SetPendingMessage),
-                B(Ldar), R(12),
-                B(SwitchOnSmiNoFeedback), U8(14), U8(2), I8(0),
+                B(Ldar), R(11),
+                B(SwitchOnSmiNoFeedback), U8(13), U8(2), I8(0),
                 B(Jump), U8(8),
-                B(Ldar), R(13),
+                B(Ldar), R(12),
   /*   49 S> */ B(Return),
-                B(Ldar), R(13),
+                B(Ldar), R(12),
                 B(ReThrow),
                 B(LdaUndefined),
   /*   49 S> */ B(Return),
 ]
 constant pool: [
-  Smi [30],
-  Smi [144],
+  Smi [22],
+  Smi [135],
   Smi [10],
   Smi [7],
   SYMBOL_TYPE,
@@ -928,7 +905,6 @@ constant pool: [
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["value"],
   Smi [15],
   Smi [7],
-  ONE_BYTE_INTERNALIZED_STRING_TYPE [".catch"],
   SCOPE_INFO_TYPE,
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["return"],
   ONE_BYTE_INTERNALIZED_STRING_TYPE [""],
@@ -936,9 +912,9 @@ constant pool: [
   Smi [9],
 ]
 handlers: [
-  [56, 211, 219],
-  [59, 175, 177],
-  [280, 290, 292],
+  [48, 199, 207],
+  [51, 166, 168],
+  [268, 278, 280],
 ]
 
 ---
@@ -948,28 +924,23 @@ snippet: "
   }
   f([1, 2, 3]);
 "
-frame size: 24
+frame size: 23
 parameter count: 2
-bytecode array length: 372
+bytecode array length: 363
 bytecodes: [
-                B(CreateFunctionContext), U8(1),
-                B(PushContext), R(13),
-                B(Ldar), R(arg0),
-                B(StaCurrentContextSlot), U8(4),
   /*   16 E> */ B(StackCheck),
                 B(CallJSRuntime), U8(%async_function_promise_create), R(0), U8(0),
                 B(Star), R(12),
+                B(Mov), R(context), R(15),
                 B(Mov), R(context), R(16),
-                B(Mov), R(context), R(17),
                 B(LdaZero),
                 B(Star), R(8),
+                B(Mov), R(context), R(19),
                 B(Mov), R(context), R(20),
-                B(Mov), R(context), R(21),
-  /*   40 S> */ B(LdaImmutableCurrentContextSlot), U8(4),
+  /*   40 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(0),
                 B(Star), R(22),
-                B(LdaNamedProperty), R(22), U8(0), U8(0),
-                B(Star), R(23),
-                B(CallProperty0), R(23), R(22), U8(2),
+                B(CallProperty0), R(22), R(arg0), U8(2),
+                B(Mov), R(arg0), R(21),
                 B(JumpIfJSReceiver), U8(7),
                 B(CallRuntime), U16(Runtime::kThrowSymbolIteratorInvalid), R(0), U8(0),
                 B(Star), R(5),
@@ -994,38 +965,37 @@ bytecodes: [
                 B(LdaZero),
                 B(Star), R(8),
                 B(JumpLoop), U8(47), I8(0),
-                B(Jump), U8(40),
-                B(Star), R(22),
-                B(Ldar), R(closure),
-  /*   55 E> */ B(CreateCatchContext), R(22), U8(4), U8(5),
+                B(Jump), U8(37),
                 B(Star), R(21),
+  /*   55 E> */ B(CreateCatchContext), R(21), U8(4),
+                B(Star), R(20),
                 B(LdaTheHole),
                 B(SetPendingMessage),
-                B(Ldar), R(21),
-                B(PushContext), R(22),
+                B(Ldar), R(20),
+                B(PushContext), R(21),
                 B(LdaSmi), I8(2),
                 B(TestEqualStrict), R(8), U8(12),
                 B(JumpIfFalse), U8(6),
                 B(LdaSmi), I8(1),
                 B(Star), R(8),
                 B(LdaImmutableCurrentContextSlot), U8(4),
-                B(Star), R(23),
-                B(CallRuntime), U16(Runtime::kReThrow), R(23), U8(1),
-                B(PopContext), R(22),
+                B(Star), R(22),
+                B(CallRuntime), U16(Runtime::kReThrow), R(22), U8(1),
+                B(PopContext), R(21),
                 B(LdaSmi), I8(-1),
-                B(Star), R(19),
                 B(Star), R(18),
+                B(Star), R(17),
                 B(Jump), U8(7),
-                B(Star), R(19),
-                B(LdaZero),
                 B(Star), R(18),
+                B(LdaZero),
+                B(Star), R(17),
                 B(LdaTheHole),
                 B(SetPendingMessage),
-                B(Star), R(20),
+                B(Star), R(19),
                 B(LdaZero),
                 B(TestEqualStrict), R(8), U8(13),
                 B(JumpIfTrue), U8(90),
-                B(LdaNamedProperty), R(5), U8(6), U8(14),
+                B(LdaNamedProperty), R(5), U8(5), U8(14),
                 B(Star), R(10),
                 B(TestUndetectable),
                 B(JumpIfFalse), U8(4),
@@ -1037,83 +1007,85 @@ bytecodes: [
                 B(TestTypeOf), U8(6),
                 B(JumpIfFalse), U8(4),
                 B(Jump), U8(18),
-                B(Wide), B(LdaSmi), I16(147),
+                B(Wide), B(LdaSmi), I16(149),
+                B(Star), R(20),
+                B(LdaConstant), U8(6),
                 B(Star), R(21),
-                B(LdaConstant), U8(7),
-                B(Star), R(22),
-                B(CallRuntime), U16(Runtime::kNewTypeError), R(21), U8(2),
+                B(CallRuntime), U16(Runtime::kNewTypeError), R(20), U8(2),
                 B(Throw),
-                B(Mov), R(context), R(21),
-                B(Mov), R(10), R(22),
-                B(Mov), R(5), R(23),
-                B(InvokeIntrinsic), U8(Runtime::k_Call), R(22), U8(2),
+                B(Mov), R(context), R(20),
+                B(Mov), R(10), R(21),
+                B(Mov), R(5), R(22),
+                B(InvokeIntrinsic), U8(Runtime::k_Call), R(21), U8(2),
                 B(Jump), U8(6),
                 B(LdaTheHole),
                 B(SetPendingMessage),
-                B(Ldar), R(21),
+                B(Ldar), R(20),
                 B(Jump), U8(27),
-                B(Mov), R(10), R(21),
-                B(Mov), R(5), R(22),
-                B(InvokeIntrinsic), U8(Runtime::k_Call), R(21), U8(2),
+                B(Mov), R(10), R(20),
+                B(Mov), R(5), R(21),
+                B(InvokeIntrinsic), U8(Runtime::k_Call), R(20), U8(2),
                 B(Star), R(11),
                 B(InvokeIntrinsic), U8(Runtime::k_IsJSReceiver), R(11), U8(1),
                 B(JumpIfToBooleanFalse), U8(4),
                 B(Jump), U8(7),
                 B(CallRuntime), U16(Runtime::kThrowIteratorResultNotAnObject), R(11), U8(1),
-                B(Ldar), R(20),
+                B(Ldar), R(19),
                 B(SetPendingMessage),
                 B(LdaZero),
-                B(TestEqualStrictNoFeedback), R(18),
+                B(TestReferenceEqual), R(17),
                 B(JumpIfFalse), U8(5),
-                B(Ldar), R(19),
+                B(Ldar), R(18),
                 B(ReThrow),
                 B(LdaUndefined),
-                B(Star), R(19),
-                B(Mov), R(12), R(18),
-                B(InvokeIntrinsic), U8(Runtime::k_ResolvePromise), R(18), U8(2),
-                B(LdaZero),
-                B(Star), R(14),
-                B(Mov), R(12), R(15),
-                B(Jump), U8(58),
-                B(Jump), U8(42),
                 B(Star), R(18),
-                B(Ldar), R(closure),
-                B(CreateCatchContext), R(18), U8(4), U8(8),
+                B(Mov), R(12), R(17),
+                B(InvokeIntrinsic), U8(Runtime::k_ResolvePromise), R(17), U8(2),
+                B(LdaZero),
+                B(Star), R(13),
+                B(Mov), R(12), R(14),
+                B(Jump), U8(55),
+                B(Jump), U8(39),
                 B(Star), R(17),
+                B(CreateCatchContext), R(17), U8(7),
+                B(Star), R(16),
                 B(LdaTheHole),
                 B(SetPendingMessage),
-                B(Ldar), R(17),
-                B(PushContext), R(18),
+                B(Ldar), R(16),
+                B(PushContext), R(17),
                 B(LdaImmutableCurrentContextSlot), U8(4),
-                B(Star), R(20),
+                B(Star), R(19),
                 B(LdaFalse),
-                B(Star), R(21),
-                B(Mov), R(12), R(19),
-                B(InvokeIntrinsic), U8(Runtime::k_RejectPromise), R(19), U8(3),
-                B(PopContext), R(18),
+                B(Star), R(20),
+                B(Mov), R(12), R(18),
+                B(InvokeIntrinsic), U8(Runtime::k_RejectPromise), R(18), U8(3),
+                B(PopContext), R(17),
                 B(LdaZero),
-                B(Star), R(14),
-                B(Mov), R(12), R(15),
+                B(Star), R(13),
+                B(Mov), R(12), R(14),
                 B(Jump), U8(16),
                 B(LdaSmi), I8(-1),
-                B(Star), R(15),
                 B(Star), R(14),
+                B(Star), R(13),
                 B(Jump), U8(8),
-                B(Star), R(15),
-                B(LdaSmi), I8(1),
                 B(Star), R(14),
+                B(LdaSmi), I8(1),
+                B(Star), R(13),
                 B(LdaTheHole),
                 B(SetPendingMessage),
-                B(Star), R(16),
-                B(CallJSRuntime), U8(%async_function_promise_release), R(12), U8(1),
-                B(Ldar), R(16),
+                B(Star), R(15),
+                B(LdaFalse),
+                B(Star), R(17),
+                B(Mov), R(12), R(16),
+                B(CallJSRuntime), U8(%async_function_promise_release), R(16), U8(2),
+                B(Ldar), R(15),
                 B(SetPendingMessage),
-                B(Ldar), R(14),
-                B(SwitchOnSmiNoFeedback), U8(9), U8(2), I8(0),
+                B(Ldar), R(13),
+                B(SwitchOnSmiNoFeedback), U8(8), U8(2), I8(0),
                 B(Jump), U8(8),
-                B(Ldar), R(15),
+                B(Ldar), R(14),
   /*   60 S> */ B(Return),
-                B(Ldar), R(15),
+                B(Ldar), R(14),
                 B(ReThrow),
                 B(LdaUndefined),
   /*   60 S> */ B(Return),
@@ -1123,7 +1095,6 @@ constant pool: [
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["next"],
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["done"],
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["value"],
-  ONE_BYTE_INTERNALIZED_STRING_TYPE [".catch"],
   SCOPE_INFO_TYPE,
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["return"],
   ONE_BYTE_INTERNALIZED_STRING_TYPE [""],
@@ -1132,11 +1103,11 @@ constant pool: [
   Smi [9],
 ]
 handlers: [
-  [18, 331, 339],
-  [21, 289, 291],
-  [27, 149, 157],
-  [30, 109, 111],
-  [217, 227, 229],
+  [10, 316, 324],
+  [13, 277, 279],
+  [19, 137, 145],
+  [22, 100, 102],
+  [205, 215, 217],
 ]
 
 ---
@@ -1146,33 +1117,28 @@ snippet: "
   }
   f([1, 2, 3]);
 "
-frame size: 24
+frame size: 23
 parameter count: 2
-bytecode array length: 423
+bytecode array length: 414
 bytecodes: [
                 B(SwitchOnGeneratorState), R(2), U8(0), U8(1),
-                B(CreateFunctionContext), U8(1),
-                B(PushContext), R(12),
-                B(Ldar), R(arg0),
-                B(StaCurrentContextSlot), U8(4),
-                B(Mov), R(closure), R(13),
-                B(Mov), R(this), R(14),
-                B(InvokeIntrinsic), U8(Runtime::k_CreateJSGeneratorObject), R(13), U8(2),
+                B(Mov), R(closure), R(12),
+                B(Mov), R(this), R(13),
+                B(InvokeIntrinsic), U8(Runtime::k_CreateJSGeneratorObject), R(12), U8(2),
                 B(Star), R(2),
   /*   16 E> */ B(StackCheck),
                 B(CallJSRuntime), U8(%async_function_promise_create), R(0), U8(0),
                 B(Star), R(11),
+                B(Mov), R(context), R(14),
                 B(Mov), R(context), R(15),
-                B(Mov), R(context), R(16),
                 B(LdaZero),
                 B(Star), R(7),
+                B(Mov), R(context), R(18),
                 B(Mov), R(context), R(19),
-                B(Mov), R(context), R(20),
-  /*   40 S> */ B(LdaImmutableCurrentContextSlot), U8(4),
+  /*   40 S> */ B(LdaNamedProperty), R(arg0), U8(1), U8(0),
                 B(Star), R(21),
-                B(LdaNamedProperty), R(21), U8(1), U8(0),
-                B(Star), R(22),
-                B(CallProperty0), R(22), R(21), U8(2),
+                B(CallProperty0), R(21), R(arg0), U8(2),
+                B(Mov), R(arg0), R(20),
                 B(JumpIfJSReceiver), U8(7),
                 B(CallRuntime), U16(Runtime::kThrowSymbolIteratorInvalid), R(0), U8(0),
                 B(Star), R(4),
@@ -1193,55 +1159,54 @@ bytecodes: [
                 B(Mov), R(8), R(3),
   /*   26 E> */ B(StackCheck),
                 B(Mov), R(3), R(0),
-  /*   45 S> */ B(Mov), R(2), R(21),
-                B(Mov), R(0), R(22),
-                B(Mov), R(11), R(23),
-                B(CallJSRuntime), U8(%async_function_await_uncaught), R(21), U8(3),
-  /*   45 E> */ B(SuspendGenerator), R(2), R(0), U8(21), U8(0),
-                B(ResumeGenerator), R(2), R(0), U8(21),
-                B(Star), R(21),
+  /*   45 S> */ B(Mov), R(2), R(20),
+                B(Mov), R(0), R(21),
+                B(Mov), R(11), R(22),
+                B(CallJSRuntime), U8(%async_function_await_uncaught), R(20), U8(3),
+  /*   45 E> */ B(SuspendGenerator), R(2), R(0), U8(20), U8(0),
+                B(ResumeGenerator), R(2), R(0), U8(20),
+                B(Star), R(20),
                 B(InvokeIntrinsic), U8(Runtime::k_GeneratorGetResumeMode), R(2), U8(1),
-                B(Star), R(22),
+                B(Star), R(21),
                 B(LdaZero),
-                B(TestEqualStrictNoFeedback), R(22),
+                B(TestReferenceEqual), R(21),
                 B(JumpIfTrue), U8(5),
-                B(Ldar), R(21),
+                B(Ldar), R(20),
                 B(ReThrow),
                 B(LdaZero),
                 B(Star), R(7),
                 B(JumpLoop), U8(82), I8(0),
-                B(Jump), U8(40),
-                B(Star), R(21),
-                B(Ldar), R(closure),
-                B(CreateCatchContext), R(21), U8(5), U8(6),
+                B(Jump), U8(37),
                 B(Star), R(20),
+                B(CreateCatchContext), R(20), U8(5),
+                B(Star), R(19),
                 B(LdaTheHole),
                 B(SetPendingMessage),
-                B(Ldar), R(20),
-                B(PushContext), R(21),
+                B(Ldar), R(19),
+                B(PushContext), R(20),
                 B(LdaSmi), I8(2),
                 B(TestEqualStrict), R(7), U8(12),
                 B(JumpIfFalse), U8(6),
                 B(LdaSmi), I8(1),
                 B(Star), R(7),
                 B(LdaImmutableCurrentContextSlot), U8(4),
-                B(Star), R(22),
-                B(CallRuntime), U16(Runtime::kReThrow), R(22), U8(1),
-                B(PopContext), R(21),
+                B(Star), R(21),
+                B(CallRuntime), U16(Runtime::kReThrow), R(21), U8(1),
+                B(PopContext), R(20),
                 B(LdaSmi), I8(-1),
-                B(Star), R(18),
                 B(Star), R(17),
+                B(Star), R(16),
                 B(Jump), U8(7),
-                B(Star), R(18),
-                B(LdaZero),
                 B(Star), R(17),
+                B(LdaZero),
+                B(Star), R(16),
                 B(LdaTheHole),
                 B(SetPendingMessage),
-                B(Star), R(19),
+                B(Star), R(18),
                 B(LdaZero),
                 B(TestEqualStrict), R(7), U8(13),
                 B(JumpIfTrue), U8(90),
-                B(LdaNamedProperty), R(4), U8(7), U8(14),
+                B(LdaNamedProperty), R(4), U8(6), U8(14),
                 B(Star), R(9),
                 B(TestUndetectable),
                 B(JumpIfFalse), U8(4),
@@ -1253,94 +1218,95 @@ bytecodes: [
                 B(TestTypeOf), U8(6),
                 B(JumpIfFalse), U8(4),
                 B(Jump), U8(18),
-                B(Wide), B(LdaSmi), I16(147),
+                B(Wide), B(LdaSmi), I16(149),
+                B(Star), R(19),
+                B(LdaConstant), U8(7),
                 B(Star), R(20),
-                B(LdaConstant), U8(8),
-                B(Star), R(21),
-                B(CallRuntime), U16(Runtime::kNewTypeError), R(20), U8(2),
+                B(CallRuntime), U16(Runtime::kNewTypeError), R(19), U8(2),
                 B(Throw),
-                B(Mov), R(context), R(20),
-                B(Mov), R(9), R(21),
-                B(Mov), R(4), R(22),
-                B(InvokeIntrinsic), U8(Runtime::k_Call), R(21), U8(2),
+                B(Mov), R(context), R(19),
+                B(Mov), R(9), R(20),
+                B(Mov), R(4), R(21),
+                B(InvokeIntrinsic), U8(Runtime::k_Call), R(20), U8(2),
                 B(Jump), U8(6),
                 B(LdaTheHole),
                 B(SetPendingMessage),
-                B(Ldar), R(20),
+                B(Ldar), R(19),
                 B(Jump), U8(27),
-                B(Mov), R(9), R(20),
-                B(Mov), R(4), R(21),
-                B(InvokeIntrinsic), U8(Runtime::k_Call), R(20), U8(2),
+                B(Mov), R(9), R(19),
+                B(Mov), R(4), R(20),
+                B(InvokeIntrinsic), U8(Runtime::k_Call), R(19), U8(2),
                 B(Star), R(10),
                 B(InvokeIntrinsic), U8(Runtime::k_IsJSReceiver), R(10), U8(1),
                 B(JumpIfToBooleanFalse), U8(4),
                 B(Jump), U8(7),
                 B(CallRuntime), U16(Runtime::kThrowIteratorResultNotAnObject), R(10), U8(1),
-                B(Ldar), R(19),
+                B(Ldar), R(18),
                 B(SetPendingMessage),
                 B(LdaZero),
-                B(TestEqualStrictNoFeedback), R(17),
+                B(TestReferenceEqual), R(16),
                 B(JumpIfFalse), U8(5),
-                B(Ldar), R(18),
+                B(Ldar), R(17),
                 B(ReThrow),
                 B(LdaUndefined),
-                B(Star), R(18),
-                B(Mov), R(11), R(17),
-                B(InvokeIntrinsic), U8(Runtime::k_ResolvePromise), R(17), U8(2),
-                B(LdaZero),
-                B(Star), R(13),
-                B(Mov), R(11), R(14),
-                B(Jump), U8(58),
-                B(Jump), U8(42),
                 B(Star), R(17),
-                B(Ldar), R(closure),
-                B(CreateCatchContext), R(17), U8(5), U8(9),
+                B(Mov), R(11), R(16),
+                B(InvokeIntrinsic), U8(Runtime::k_ResolvePromise), R(16), U8(2),
+                B(LdaZero),
+                B(Star), R(12),
+                B(Mov), R(11), R(13),
+                B(Jump), U8(55),
+                B(Jump), U8(39),
                 B(Star), R(16),
+                B(CreateCatchContext), R(16), U8(8),
+                B(Star), R(15),
                 B(LdaTheHole),
                 B(SetPendingMessage),
-                B(Ldar), R(16),
-                B(PushContext), R(17),
+                B(Ldar), R(15),
+                B(PushContext), R(16),
                 B(LdaImmutableCurrentContextSlot), U8(4),
-                B(Star), R(19),
+                B(Star), R(18),
                 B(LdaFalse),
-                B(Star), R(20),
-                B(Mov), R(11), R(18),
-                B(InvokeIntrinsic), U8(Runtime::k_RejectPromise), R(18), U8(3),
-                B(PopContext), R(17),
+                B(Star), R(19),
+                B(Mov), R(11), R(17),
+                B(InvokeIntrinsic), U8(Runtime::k_RejectPromise), R(17), U8(3),
+                B(PopContext), R(16),
                 B(LdaZero),
-                B(Star), R(13),
-                B(Mov), R(11), R(14),
+                B(Star), R(12),
+                B(Mov), R(11), R(13),
                 B(Jump), U8(16),
                 B(LdaSmi), I8(-1),
-                B(Star), R(14),
                 B(Star), R(13),
+                B(Star), R(12),
                 B(Jump), U8(8),
-                B(Star), R(14),
-                B(LdaSmi), I8(1),
                 B(Star), R(13),
+                B(LdaSmi), I8(1),
+                B(Star), R(12),
                 B(LdaTheHole),
                 B(SetPendingMessage),
-                B(Star), R(15),
-                B(CallJSRuntime), U8(%async_function_promise_release), R(11), U8(1),
-                B(Ldar), R(15),
+                B(Star), R(14),
+                B(LdaTrue),
+                B(Star), R(16),
+                B(Mov), R(11), R(15),
+                B(CallJSRuntime), U8(%async_function_promise_release), R(15), U8(2),
+                B(Ldar), R(14),
                 B(SetPendingMessage),
-                B(Ldar), R(13),
-                B(SwitchOnSmiNoFeedback), U8(10), U8(2), I8(0),
+                B(Ldar), R(12),
+                B(SwitchOnSmiNoFeedback), U8(9), U8(2), I8(0),
                 B(Jump), U8(8),
-                B(Ldar), R(14),
+                B(Ldar), R(13),
   /*   54 S> */ B(Return),
-                B(Ldar), R(14),
+                B(Ldar), R(13),
                 B(ReThrow),
                 B(LdaUndefined),
   /*   54 S> */ B(Return),
 ]
 constant pool: [
-  Smi [134],
+  Smi [125],
   SYMBOL_TYPE,
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["next"],
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["done"],
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["value"],
-  ONE_BYTE_INTERNALIZED_STRING_TYPE [".catch"],
   SCOPE_INFO_TYPE,
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["return"],
   ONE_BYTE_INTERNALIZED_STRING_TYPE [""],
@@ -1349,10 +1315,10 @@ constant pool: [
   Smi [9],
 ]
 handlers: [
-  [34, 382, 390],
-  [37, 340, 342],
-  [43, 200, 208],
-  [46, 160, 162],
-  [268, 278, 280],
+  [26, 367, 375],
+  [29, 328, 330],
+  [35, 188, 196],
+  [38, 151, 153],
+  [256, 266, 268],
 ]
 
diff --git a/deps/v8/test/cctest/interpreter/bytecode_expectations/GenerateTestUndetectable.golden b/deps/v8/test/cctest/interpreter/bytecode_expectations/GenerateTestUndetectable.golden
index ee3e21e1eb3624..d5f7a8f5bf16fd 100644
--- a/deps/v8/test/cctest/interpreter/bytecode_expectations/GenerateTestUndetectable.golden
+++ b/deps/v8/test/cctest/interpreter/bytecode_expectations/GenerateTestUndetectable.golden
@@ -30,7 +30,7 @@ bytecodes: [
   /*  106 S> */ B(Return),
 ]
 constant pool: [
-  BOILERPLATE_DESCRIPTION_TYPE,
+  OBJECT_BOILERPLATE_DESCRIPTION_TYPE,
 ]
 handlers: [
 ]
@@ -60,7 +60,7 @@ bytecodes: [
   /*  111 S> */ B(Return),
 ]
 constant pool: [
-  BOILERPLATE_DESCRIPTION_TYPE,
+  OBJECT_BOILERPLATE_DESCRIPTION_TYPE,
 ]
 handlers: [
 ]
@@ -90,7 +90,7 @@ bytecodes: [
   /*  106 S> */ B(Return),
 ]
 constant pool: [
-  BOILERPLATE_DESCRIPTION_TYPE,
+  OBJECT_BOILERPLATE_DESCRIPTION_TYPE,
 ]
 handlers: [
 ]
@@ -120,7 +120,7 @@ bytecodes: [
   /*  111 S> */ B(Return),
 ]
 constant pool: [
-  BOILERPLATE_DESCRIPTION_TYPE,
+  OBJECT_BOILERPLATE_DESCRIPTION_TYPE,
 ]
 handlers: [
 ]
@@ -149,7 +149,7 @@ bytecodes: [
   /*  107 S> */ B(Return),
 ]
 constant pool: [
-  BOILERPLATE_DESCRIPTION_TYPE,
+  OBJECT_BOILERPLATE_DESCRIPTION_TYPE,
 ]
 handlers: [
 ]
@@ -178,7 +178,7 @@ bytecodes: [
   /*  112 S> */ B(Return),
 ]
 constant pool: [
-  BOILERPLATE_DESCRIPTION_TYPE,
+  OBJECT_BOILERPLATE_DESCRIPTION_TYPE,
 ]
 handlers: [
 ]
@@ -207,7 +207,7 @@ bytecodes: [
   /*  107 S> */ B(Return),
 ]
 constant pool: [
-  BOILERPLATE_DESCRIPTION_TYPE,
+  OBJECT_BOILERPLATE_DESCRIPTION_TYPE,
 ]
 handlers: [
 ]
@@ -236,7 +236,7 @@ bytecodes: [
   /*  112 S> */ B(Return),
 ]
 constant pool: [
-  BOILERPLATE_DESCRIPTION_TYPE,
+  OBJECT_BOILERPLATE_DESCRIPTION_TYPE,
 ]
 handlers: [
 ]
diff --git a/deps/v8/test/cctest/interpreter/bytecode_expectations/Generators.golden b/deps/v8/test/cctest/interpreter/bytecode_expectations/Generators.golden
index 2dc77a7986bd6c..54deec71989a54 100644
--- a/deps/v8/test/cctest/interpreter/bytecode_expectations/Generators.golden
+++ b/deps/v8/test/cctest/interpreter/bytecode_expectations/Generators.golden
@@ -100,7 +100,7 @@ snippet: "
 "
 frame size: 17
 parameter count: 1
-bytecode array length: 336
+bytecode array length: 333
 bytecodes: [
                 B(SwitchOnGeneratorState), R(2), U8(0), U8(2),
                 B(Mov), R(closure), R(11),
@@ -160,14 +160,13 @@ bytecodes: [
                 B(LdaZero),
                 B(Star), R(11),
                 B(Mov), R(15), R(12),
-                B(Jump), U8(58),
+                B(Jump), U8(55),
                 B(LdaZero),
                 B(Star), R(7),
                 B(JumpLoop), U8(84), I8(0),
-                B(Jump), U8(36),
+                B(Jump), U8(33),
                 B(Star), R(15),
-                B(Ldar), R(closure),
-                B(CreateCatchContext), R(15), U8(11), U8(12),
+                B(CreateCatchContext), R(15), U8(11),
                 B(PushContext), R(15),
                 B(Star), R(14),
                 B(LdaSmi), I8(2),
@@ -192,7 +191,7 @@ bytecodes: [
                 B(LdaZero),
                 B(TestEqualStrict), R(7), U8(14),
                 B(JumpIfTrue), U8(90),
-                B(LdaNamedProperty), R(4), U8(13), U8(15),
+                B(LdaNamedProperty), R(4), U8(12), U8(15),
                 B(Star), R(9),
                 B(TestUndetectable),
                 B(JumpIfFalse), U8(4),
@@ -204,9 +203,9 @@ bytecodes: [
                 B(TestTypeOf), U8(6),
                 B(JumpIfFalse), U8(4),
                 B(Jump), U8(18),
-                B(Wide), B(LdaSmi), I16(147),
+                B(Wide), B(LdaSmi), I16(149),
                 B(Star), R(14),
-                B(LdaConstant), U8(14),
+                B(LdaConstant), U8(13),
                 B(Star), R(15),
                 B(CallRuntime), U16(Runtime::kNewTypeError), R(14), U8(2),
                 B(Throw),
@@ -230,7 +229,7 @@ bytecodes: [
                 B(Ldar), R(13),
                 B(SetPendingMessage),
                 B(Ldar), R(11),
-                B(SwitchOnSmiNoFeedback), U8(15), U8(2), I8(0),
+                B(SwitchOnSmiNoFeedback), U8(14), U8(2), I8(0),
                 B(Jump), U8(8),
                 B(Ldar), R(12),
   /*   44 S> */ B(Return),
@@ -244,14 +243,13 @@ constant pool: [
   Smi [138],
   Smi [10],
   Smi [7],
-  TUPLE2_TYPE,
+  ARRAY_BOILERPLATE_DESCRIPTION_TYPE,
   SYMBOL_TYPE,
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["next"],
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["done"],
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["value"],
   Smi [15],
   Smi [7],
-  ONE_BYTE_INTERNALIZED_STRING_TYPE [".catch"],
   SCOPE_INFO_TYPE,
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["return"],
   ONE_BYTE_INTERNALIZED_STRING_TYPE [""],
@@ -259,9 +257,9 @@ constant pool: [
   Smi [9],
 ]
 handlers: [
-  [48, 205, 213],
+  [48, 202, 210],
   [51, 169, 171],
-  [274, 284, 286],
+  [271, 281, 283],
 ]
 
 ---
@@ -348,7 +346,7 @@ bytecodes: [
                 B(LdaNamedProperty), R(1), U8(12), U8(26),
                 B(Star), R(3),
                 B(LdaSmi), I8(1),
-                B(TestEqualStrictNoFeedback), R(2),
+                B(TestReferenceEqual), R(2),
                 B(JumpIfFalse), U8(5),
                 B(Ldar), R(3),
   /*   54 S> */ B(Return),
diff --git a/deps/v8/test/cctest/interpreter/bytecode_expectations/LetVariableContextSlot.golden b/deps/v8/test/cctest/interpreter/bytecode_expectations/LetVariableContextSlot.golden
index dca4ae2b332d3d..62d07cef7e0f0d 100644
--- a/deps/v8/test/cctest/interpreter/bytecode_expectations/LetVariableContextSlot.golden
+++ b/deps/v8/test/cctest/interpreter/bytecode_expectations/LetVariableContextSlot.golden
@@ -11,13 +11,13 @@ snippet: "
 "
 frame size: 2
 parameter count: 1
-bytecode array length: 20
+bytecode array length: 21
 bytecodes: [
-                B(CreateFunctionContext), U8(1),
+                B(CreateFunctionContext), U8(0), U8(1),
                 B(PushContext), R(1),
                 B(LdaTheHole),
                 B(StaCurrentContextSlot), U8(4),
-                B(CreateClosure), U8(0), U8(0), U8(2),
+                B(CreateClosure), U8(1), U8(0), U8(2),
                 B(Star), R(0),
   /*   30 E> */ B(StackCheck),
   /*   42 S> */ B(LdaSmi), I8(10),
@@ -26,6 +26,7 @@ bytecodes: [
   /*   72 S> */ B(Return),
 ]
 constant pool: [
+  SCOPE_INFO_TYPE,
   SHARED_FUNCTION_INFO_TYPE,
 ]
 handlers: [
@@ -37,13 +38,13 @@ snippet: "
 "
 frame size: 2
 parameter count: 1
-bytecode array length: 21
+bytecode array length: 22
 bytecodes: [
-                B(CreateFunctionContext), U8(1),
+                B(CreateFunctionContext), U8(0), U8(1),
                 B(PushContext), R(1),
                 B(LdaTheHole),
                 B(StaCurrentContextSlot), U8(4),
-                B(CreateClosure), U8(0), U8(0), U8(2),
+                B(CreateClosure), U8(1), U8(0), U8(2),
                 B(Star), R(0),
   /*   30 E> */ B(StackCheck),
   /*   42 S> */ B(LdaSmi), I8(10),
@@ -52,6 +53,7 @@ bytecodes: [
   /*   81 S> */ B(Return),
 ]
 constant pool: [
+  SCOPE_INFO_TYPE,
   SHARED_FUNCTION_INFO_TYPE,
 ]
 handlers: [
@@ -63,19 +65,19 @@ snippet: "
 "
 frame size: 3
 parameter count: 1
-bytecode array length: 30
+bytecode array length: 31
 bytecodes: [
-                B(CreateFunctionContext), U8(1),
+                B(CreateFunctionContext), U8(0), U8(1),
                 B(PushContext), R(1),
                 B(LdaTheHole),
                 B(StaCurrentContextSlot), U8(4),
-                B(CreateClosure), U8(0), U8(0), U8(2),
+                B(CreateClosure), U8(1), U8(0), U8(2),
                 B(Star), R(0),
   /*   30 E> */ B(StackCheck),
   /*   42 S> */ B(LdaSmi), I8(20),
                 B(Star), R(2),
                 B(LdaCurrentContextSlot), U8(4),
-  /*   45 E> */ B(ThrowReferenceErrorIfHole), U8(1),
+  /*   45 E> */ B(ThrowReferenceErrorIfHole), U8(2),
                 B(Ldar), R(2),
                 B(StaCurrentContextSlot), U8(4),
   /*   42 E> */ B(StaCurrentContextSlot), U8(4),
@@ -83,6 +85,7 @@ bytecodes: [
   /*   78 S> */ B(Return),
 ]
 constant pool: [
+  SCOPE_INFO_TYPE,
   SHARED_FUNCTION_INFO_TYPE,
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["x"],
 ]
@@ -95,13 +98,13 @@ snippet: "
 "
 frame size: 2
 parameter count: 1
-bytecode array length: 24
+bytecode array length: 25
 bytecodes: [
-                B(CreateFunctionContext), U8(1),
+                B(CreateFunctionContext), U8(0), U8(1),
                 B(PushContext), R(1),
                 B(LdaTheHole),
                 B(StaCurrentContextSlot), U8(4),
-                B(CreateClosure), U8(0), U8(0), U8(2),
+                B(CreateClosure), U8(1), U8(0), U8(2),
                 B(Star), R(0),
   /*   30 E> */ B(StackCheck),
   /*   42 S> */ B(LdaSmi), I8(10),
@@ -112,6 +115,7 @@ bytecodes: [
   /*   80 S> */ B(Return),
 ]
 constant pool: [
+  SCOPE_INFO_TYPE,
   SHARED_FUNCTION_INFO_TYPE,
 ]
 handlers: [
diff --git a/deps/v8/test/cctest/interpreter/bytecode_expectations/LoadGlobal.golden b/deps/v8/test/cctest/interpreter/bytecode_expectations/LoadGlobal.golden
index bc69c3e10ae4b1..c34d6bd73900b4 100644
--- a/deps/v8/test/cctest/interpreter/bytecode_expectations/LoadGlobal.golden
+++ b/deps/v8/test/cctest/interpreter/bytecode_expectations/LoadGlobal.golden
@@ -69,277 +69,407 @@ handlers: [
 ---
 snippet: "
   a = 1;
-  function f(b) {
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
+  function f(c) {
+    var b = {};
+    b.name512;
+    b.name513;
+    b.name514;
+    b.name515;
+    b.name516;
+    b.name517;
+    b.name518;
+    b.name519;
+    b.name520;
+    b.name521;
+    b.name522;
+    b.name523;
+    b.name524;
+    b.name525;
+    b.name526;
+    b.name527;
+    b.name528;
+    b.name529;
+    b.name530;
+    b.name531;
+    b.name532;
+    b.name533;
+    b.name534;
+    b.name535;
+    b.name536;
+    b.name537;
+    b.name538;
+    b.name539;
+    b.name540;
+    b.name541;
+    b.name542;
+    b.name543;
+    b.name544;
+    b.name545;
+    b.name546;
+    b.name547;
+    b.name548;
+    b.name549;
+    b.name550;
+    b.name551;
+    b.name552;
+    b.name553;
+    b.name554;
+    b.name555;
+    b.name556;
+    b.name557;
+    b.name558;
+    b.name559;
+    b.name560;
+    b.name561;
+    b.name562;
+    b.name563;
+    b.name564;
+    b.name565;
+    b.name566;
+    b.name567;
+    b.name568;
+    b.name569;
+    b.name570;
+    b.name571;
+    b.name572;
+    b.name573;
+    b.name574;
+    b.name575;
+    b.name576;
+    b.name577;
+    b.name578;
+    b.name579;
+    b.name580;
+    b.name581;
+    b.name582;
+    b.name583;
+    b.name584;
+    b.name585;
+    b.name586;
+    b.name587;
+    b.name588;
+    b.name589;
+    b.name590;
+    b.name591;
+    b.name592;
+    b.name593;
+    b.name594;
+    b.name595;
+    b.name596;
+    b.name597;
+    b.name598;
+    b.name599;
+    b.name600;
+    b.name601;
+    b.name602;
+    b.name603;
+    b.name604;
+    b.name605;
+    b.name606;
+    b.name607;
+    b.name608;
+    b.name609;
+    b.name610;
+    b.name611;
+    b.name612;
+    b.name613;
+    b.name614;
+    b.name615;
+    b.name616;
+    b.name617;
+    b.name618;
+    b.name619;
+    b.name620;
+    b.name621;
+    b.name622;
+    b.name623;
+    b.name624;
+    b.name625;
+    b.name626;
+    b.name627;
+    b.name628;
+    b.name629;
+    b.name630;
+    b.name631;
+    b.name632;
+    b.name633;
+    b.name634;
+    b.name635;
+    b.name636;
+    b.name637;
+    b.name638;
+    b.name639;
     return a;
   }
   f({name: 1});
 "
-frame size: 0
+frame size: 1
 parameter count: 2
-bytecode array length: 520
+bytecode array length: 523
 bytecodes: [
   /*   17 E> */ B(StackCheck),
-  /*   27 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(0),
-  /*   37 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(2),
-  /*   47 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(4),
-  /*   57 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(6),
-  /*   67 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(8),
-  /*   77 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(10),
-  /*   87 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(12),
-  /*   97 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(14),
-  /*  107 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(16),
-  /*  117 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(18),
-  /*  127 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(20),
-  /*  137 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(22),
-  /*  147 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(24),
-  /*  157 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(26),
-  /*  167 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(28),
-  /*  177 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(30),
-  /*  187 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(32),
-  /*  197 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(34),
-  /*  207 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(36),
-  /*  217 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(38),
-  /*  227 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(40),
-  /*  237 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(42),
-  /*  247 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(44),
-  /*  257 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(46),
-  /*  267 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(48),
-  /*  277 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(50),
-  /*  287 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(52),
-  /*  297 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(54),
-  /*  307 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(56),
-  /*  317 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(58),
-  /*  327 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(60),
-  /*  337 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(62),
-  /*  347 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(64),
-  /*  357 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(66),
-  /*  367 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(68),
-  /*  377 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(70),
-  /*  387 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(72),
-  /*  397 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(74),
-  /*  407 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(76),
-  /*  417 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(78),
-  /*  427 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(80),
-  /*  437 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(82),
-  /*  447 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(84),
-  /*  457 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(86),
-  /*  467 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(88),
-  /*  477 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(90),
-  /*  487 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(92),
-  /*  497 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(94),
-  /*  507 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(96),
-  /*  517 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(98),
-  /*  527 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(100),
-  /*  537 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(102),
-  /*  547 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(104),
-  /*  557 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(106),
-  /*  567 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(108),
-  /*  577 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(110),
-  /*  587 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(112),
-  /*  597 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(114),
-  /*  607 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(116),
-  /*  617 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(118),
-  /*  627 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(120),
-  /*  637 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(122),
-  /*  647 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(124),
-  /*  657 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(126),
-  /*  667 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(128),
-  /*  677 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(130),
-  /*  687 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(132),
-  /*  697 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(134),
-  /*  707 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(136),
-  /*  717 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(138),
-  /*  727 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(140),
-  /*  737 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(142),
-  /*  747 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(144),
-  /*  757 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(146),
-  /*  767 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(148),
-  /*  777 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(150),
-  /*  787 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(152),
-  /*  797 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(154),
-  /*  807 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(156),
-  /*  817 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(158),
-  /*  827 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(160),
-  /*  837 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(162),
-  /*  847 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(164),
-  /*  857 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(166),
-  /*  867 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(168),
-  /*  877 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(170),
-  /*  887 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(172),
-  /*  897 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(174),
-  /*  907 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(176),
-  /*  917 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(178),
-  /*  927 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(180),
-  /*  937 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(182),
-  /*  947 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(184),
-  /*  957 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(186),
-  /*  967 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(188),
-  /*  977 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(190),
-  /*  987 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(192),
-  /*  997 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(194),
-  /* 1007 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(196),
-  /* 1017 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(198),
-  /* 1027 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(200),
-  /* 1037 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(202),
-  /* 1047 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(204),
-  /* 1057 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(206),
-  /* 1067 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(208),
-  /* 1077 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(210),
-  /* 1087 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(212),
-  /* 1097 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(214),
-  /* 1107 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(216),
-  /* 1117 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(218),
-  /* 1127 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(220),
-  /* 1137 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(222),
-  /* 1147 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(224),
-  /* 1157 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(226),
-  /* 1167 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(228),
-  /* 1177 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(230),
-  /* 1187 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(232),
-  /* 1197 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(234),
-  /* 1207 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(236),
-  /* 1217 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(238),
-  /* 1227 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(240),
-  /* 1237 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(242),
-  /* 1247 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(244),
-  /* 1257 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(246),
-  /* 1267 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(248),
-  /* 1277 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(250),
-  /* 1287 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(252),
-  /* 1297 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(254),
-  /* 1305 S> */ B(Wide), B(LdaGlobal), U16(1), U16(256),
-  /* 1314 S> */ B(Return),
+  /*   33 S> */ B(CreateEmptyObjectLiteral),
+                B(Star), R(0),
+  /*   41 S> */ B(LdaNamedProperty), R(0), U8(0), U8(0),
+  /*   54 S> */ B(LdaNamedProperty), R(0), U8(1), U8(2),
+  /*   67 S> */ B(LdaNamedProperty), R(0), U8(2), U8(4),
+  /*   80 S> */ B(LdaNamedProperty), R(0), U8(3), U8(6),
+  /*   93 S> */ B(LdaNamedProperty), R(0), U8(4), U8(8),
+  /*  106 S> */ B(LdaNamedProperty), R(0), U8(5), U8(10),
+  /*  119 S> */ B(LdaNamedProperty), R(0), U8(6), U8(12),
+  /*  132 S> */ B(LdaNamedProperty), R(0), U8(7), U8(14),
+  /*  145 S> */ B(LdaNamedProperty), R(0), U8(8), U8(16),
+  /*  158 S> */ B(LdaNamedProperty), R(0), U8(9), U8(18),
+  /*  171 S> */ B(LdaNamedProperty), R(0), U8(10), U8(20),
+  /*  184 S> */ B(LdaNamedProperty), R(0), U8(11), U8(22),
+  /*  197 S> */ B(LdaNamedProperty), R(0), U8(12), U8(24),
+  /*  210 S> */ B(LdaNamedProperty), R(0), U8(13), U8(26),
+  /*  223 S> */ B(LdaNamedProperty), R(0), U8(14), U8(28),
+  /*  236 S> */ B(LdaNamedProperty), R(0), U8(15), U8(30),
+  /*  249 S> */ B(LdaNamedProperty), R(0), U8(16), U8(32),
+  /*  262 S> */ B(LdaNamedProperty), R(0), U8(17), U8(34),
+  /*  275 S> */ B(LdaNamedProperty), R(0), U8(18), U8(36),
+  /*  288 S> */ B(LdaNamedProperty), R(0), U8(19), U8(38),
+  /*  301 S> */ B(LdaNamedProperty), R(0), U8(20), U8(40),
+  /*  314 S> */ B(LdaNamedProperty), R(0), U8(21), U8(42),
+  /*  327 S> */ B(LdaNamedProperty), R(0), U8(22), U8(44),
+  /*  340 S> */ B(LdaNamedProperty), R(0), U8(23), U8(46),
+  /*  353 S> */ B(LdaNamedProperty), R(0), U8(24), U8(48),
+  /*  366 S> */ B(LdaNamedProperty), R(0), U8(25), U8(50),
+  /*  379 S> */ B(LdaNamedProperty), R(0), U8(26), U8(52),
+  /*  392 S> */ B(LdaNamedProperty), R(0), U8(27), U8(54),
+  /*  405 S> */ B(LdaNamedProperty), R(0), U8(28), U8(56),
+  /*  418 S> */ B(LdaNamedProperty), R(0), U8(29), U8(58),
+  /*  431 S> */ B(LdaNamedProperty), R(0), U8(30), U8(60),
+  /*  444 S> */ B(LdaNamedProperty), R(0), U8(31), U8(62),
+  /*  457 S> */ B(LdaNamedProperty), R(0), U8(32), U8(64),
+  /*  470 S> */ B(LdaNamedProperty), R(0), U8(33), U8(66),
+  /*  483 S> */ B(LdaNamedProperty), R(0), U8(34), U8(68),
+  /*  496 S> */ B(LdaNamedProperty), R(0), U8(35), U8(70),
+  /*  509 S> */ B(LdaNamedProperty), R(0), U8(36), U8(72),
+  /*  522 S> */ B(LdaNamedProperty), R(0), U8(37), U8(74),
+  /*  535 S> */ B(LdaNamedProperty), R(0), U8(38), U8(76),
+  /*  548 S> */ B(LdaNamedProperty), R(0), U8(39), U8(78),
+  /*  561 S> */ B(LdaNamedProperty), R(0), U8(40), U8(80),
+  /*  574 S> */ B(LdaNamedProperty), R(0), U8(41), U8(82),
+  /*  587 S> */ B(LdaNamedProperty), R(0), U8(42), U8(84),
+  /*  600 S> */ B(LdaNamedProperty), R(0), U8(43), U8(86),
+  /*  613 S> */ B(LdaNamedProperty), R(0), U8(44), U8(88),
+  /*  626 S> */ B(LdaNamedProperty), R(0), U8(45), U8(90),
+  /*  639 S> */ B(LdaNamedProperty), R(0), U8(46), U8(92),
+  /*  652 S> */ B(LdaNamedProperty), R(0), U8(47), U8(94),
+  /*  665 S> */ B(LdaNamedProperty), R(0), U8(48), U8(96),
+  /*  678 S> */ B(LdaNamedProperty), R(0), U8(49), U8(98),
+  /*  691 S> */ B(LdaNamedProperty), R(0), U8(50), U8(100),
+  /*  704 S> */ B(LdaNamedProperty), R(0), U8(51), U8(102),
+  /*  717 S> */ B(LdaNamedProperty), R(0), U8(52), U8(104),
+  /*  730 S> */ B(LdaNamedProperty), R(0), U8(53), U8(106),
+  /*  743 S> */ B(LdaNamedProperty), R(0), U8(54), U8(108),
+  /*  756 S> */ B(LdaNamedProperty), R(0), U8(55), U8(110),
+  /*  769 S> */ B(LdaNamedProperty), R(0), U8(56), U8(112),
+  /*  782 S> */ B(LdaNamedProperty), R(0), U8(57), U8(114),
+  /*  795 S> */ B(LdaNamedProperty), R(0), U8(58), U8(116),
+  /*  808 S> */ B(LdaNamedProperty), R(0), U8(59), U8(118),
+  /*  821 S> */ B(LdaNamedProperty), R(0), U8(60), U8(120),
+  /*  834 S> */ B(LdaNamedProperty), R(0), U8(61), U8(122),
+  /*  847 S> */ B(LdaNamedProperty), R(0), U8(62), U8(124),
+  /*  860 S> */ B(LdaNamedProperty), R(0), U8(63), U8(126),
+  /*  873 S> */ B(LdaNamedProperty), R(0), U8(64), U8(128),
+  /*  886 S> */ B(LdaNamedProperty), R(0), U8(65), U8(130),
+  /*  899 S> */ B(LdaNamedProperty), R(0), U8(66), U8(132),
+  /*  912 S> */ B(LdaNamedProperty), R(0), U8(67), U8(134),
+  /*  925 S> */ B(LdaNamedProperty), R(0), U8(68), U8(136),
+  /*  938 S> */ B(LdaNamedProperty), R(0), U8(69), U8(138),
+  /*  951 S> */ B(LdaNamedProperty), R(0), U8(70), U8(140),
+  /*  964 S> */ B(LdaNamedProperty), R(0), U8(71), U8(142),
+  /*  977 S> */ B(LdaNamedProperty), R(0), U8(72), U8(144),
+  /*  990 S> */ B(LdaNamedProperty), R(0), U8(73), U8(146),
+  /* 1003 S> */ B(LdaNamedProperty), R(0), U8(74), U8(148),
+  /* 1016 S> */ B(LdaNamedProperty), R(0), U8(75), U8(150),
+  /* 1029 S> */ B(LdaNamedProperty), R(0), U8(76), U8(152),
+  /* 1042 S> */ B(LdaNamedProperty), R(0), U8(77), U8(154),
+  /* 1055 S> */ B(LdaNamedProperty), R(0), U8(78), U8(156),
+  /* 1068 S> */ B(LdaNamedProperty), R(0), U8(79), U8(158),
+  /* 1081 S> */ B(LdaNamedProperty), R(0), U8(80), U8(160),
+  /* 1094 S> */ B(LdaNamedProperty), R(0), U8(81), U8(162),
+  /* 1107 S> */ B(LdaNamedProperty), R(0), U8(82), U8(164),
+  /* 1120 S> */ B(LdaNamedProperty), R(0), U8(83), U8(166),
+  /* 1133 S> */ B(LdaNamedProperty), R(0), U8(84), U8(168),
+  /* 1146 S> */ B(LdaNamedProperty), R(0), U8(85), U8(170),
+  /* 1159 S> */ B(LdaNamedProperty), R(0), U8(86), U8(172),
+  /* 1172 S> */ B(LdaNamedProperty), R(0), U8(87), U8(174),
+  /* 1185 S> */ B(LdaNamedProperty), R(0), U8(88), U8(176),
+  /* 1198 S> */ B(LdaNamedProperty), R(0), U8(89), U8(178),
+  /* 1211 S> */ B(LdaNamedProperty), R(0), U8(90), U8(180),
+  /* 1224 S> */ B(LdaNamedProperty), R(0), U8(91), U8(182),
+  /* 1237 S> */ B(LdaNamedProperty), R(0), U8(92), U8(184),
+  /* 1250 S> */ B(LdaNamedProperty), R(0), U8(93), U8(186),
+  /* 1263 S> */ B(LdaNamedProperty), R(0), U8(94), U8(188),
+  /* 1276 S> */ B(LdaNamedProperty), R(0), U8(95), U8(190),
+  /* 1289 S> */ B(LdaNamedProperty), R(0), U8(96), U8(192),
+  /* 1302 S> */ B(LdaNamedProperty), R(0), U8(97), U8(194),
+  /* 1315 S> */ B(LdaNamedProperty), R(0), U8(98), U8(196),
+  /* 1328 S> */ B(LdaNamedProperty), R(0), U8(99), U8(198),
+  /* 1341 S> */ B(LdaNamedProperty), R(0), U8(100), U8(200),
+  /* 1354 S> */ B(LdaNamedProperty), R(0), U8(101), U8(202),
+  /* 1367 S> */ B(LdaNamedProperty), R(0), U8(102), U8(204),
+  /* 1380 S> */ B(LdaNamedProperty), R(0), U8(103), U8(206),
+  /* 1393 S> */ B(LdaNamedProperty), R(0), U8(104), U8(208),
+  /* 1406 S> */ B(LdaNamedProperty), R(0), U8(105), U8(210),
+  /* 1419 S> */ B(LdaNamedProperty), R(0), U8(106), U8(212),
+  /* 1432 S> */ B(LdaNamedProperty), R(0), U8(107), U8(214),
+  /* 1445 S> */ B(LdaNamedProperty), R(0), U8(108), U8(216),
+  /* 1458 S> */ B(LdaNamedProperty), R(0), U8(109), U8(218),
+  /* 1471 S> */ B(LdaNamedProperty), R(0), U8(110), U8(220),
+  /* 1484 S> */ B(LdaNamedProperty), R(0), U8(111), U8(222),
+  /* 1497 S> */ B(LdaNamedProperty), R(0), U8(112), U8(224),
+  /* 1510 S> */ B(LdaNamedProperty), R(0), U8(113), U8(226),
+  /* 1523 S> */ B(LdaNamedProperty), R(0), U8(114), U8(228),
+  /* 1536 S> */ B(LdaNamedProperty), R(0), U8(115), U8(230),
+  /* 1549 S> */ B(LdaNamedProperty), R(0), U8(116), U8(232),
+  /* 1562 S> */ B(LdaNamedProperty), R(0), U8(117), U8(234),
+  /* 1575 S> */ B(LdaNamedProperty), R(0), U8(118), U8(236),
+  /* 1588 S> */ B(LdaNamedProperty), R(0), U8(119), U8(238),
+  /* 1601 S> */ B(LdaNamedProperty), R(0), U8(120), U8(240),
+  /* 1614 S> */ B(LdaNamedProperty), R(0), U8(121), U8(242),
+  /* 1627 S> */ B(LdaNamedProperty), R(0), U8(122), U8(244),
+  /* 1640 S> */ B(LdaNamedProperty), R(0), U8(123), U8(246),
+  /* 1653 S> */ B(LdaNamedProperty), R(0), U8(124), U8(248),
+  /* 1666 S> */ B(LdaNamedProperty), R(0), U8(125), U8(250),
+  /* 1679 S> */ B(LdaNamedProperty), R(0), U8(126), U8(252),
+  /* 1692 S> */ B(LdaNamedProperty), R(0), U8(127), U8(254),
+  /* 1703 S> */ B(Wide), B(LdaGlobal), U16(128), U16(256),
+  /* 1712 S> */ B(Return),
 ]
 constant pool: [
-  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name512"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name513"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name514"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name515"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name516"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name517"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name518"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name519"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name520"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name521"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name522"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name523"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name524"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name525"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name526"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name527"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name528"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name529"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name530"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name531"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name532"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name533"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name534"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name535"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name536"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name537"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name538"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name539"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name540"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name541"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name542"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name543"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name544"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name545"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name546"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name547"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name548"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name549"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name550"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name551"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name552"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name553"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name554"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name555"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name556"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name557"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name558"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name559"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name560"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name561"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name562"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name563"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name564"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name565"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name566"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name567"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name568"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name569"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name570"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name571"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name572"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name573"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name574"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name575"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name576"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name577"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name578"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name579"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name580"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name581"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name582"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name583"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name584"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name585"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name586"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name587"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name588"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name589"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name590"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name591"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name592"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name593"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name594"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name595"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name596"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name597"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name598"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name599"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name600"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name601"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name602"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name603"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name604"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name605"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name606"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name607"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name608"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name609"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name610"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name611"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name612"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name613"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name614"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name615"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name616"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name617"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name618"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name619"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name620"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name621"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name622"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name623"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name624"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name625"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name626"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name627"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name628"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name629"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name630"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name631"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name632"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name633"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name634"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name635"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name636"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name637"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name638"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name639"],
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["a"],
 ]
 handlers: [
diff --git a/deps/v8/test/cctest/interpreter/bytecode_expectations/LookupSlot.golden b/deps/v8/test/cctest/interpreter/bytecode_expectations/LookupSlot.golden
index e90b425c59b615..0d2e6ba7b2b6ce 100644
--- a/deps/v8/test/cctest/interpreter/bytecode_expectations/LookupSlot.golden
+++ b/deps/v8/test/cctest/interpreter/bytecode_expectations/LookupSlot.golden
@@ -12,9 +12,9 @@ snippet: "
 "
 frame size: 10
 parameter count: 1
-bytecode array length: 62
+bytecode array length: 63
 bytecodes: [
-                B(CreateFunctionContext), U8(3),
+                B(CreateFunctionContext), U8(0), U8(3),
                 B(PushContext), R(1),
                 B(Ldar), R(this),
                 B(StaCurrentContextSlot), U8(4),
@@ -23,9 +23,9 @@ bytecodes: [
                 B(Ldar), R(0),
                 B(StaCurrentContextSlot), U8(5),
   /*   10 E> */ B(StackCheck),
-  /*   14 S> */ B(LdaLookupGlobalSlot), U8(0), U8(0), U8(1),
+  /*   14 S> */ B(LdaLookupGlobalSlot), U8(1), U8(0), U8(1),
                 B(Star), R(2),
-                B(LdaConstant), U8(1),
+                B(LdaConstant), U8(2),
                 B(Star), R(3),
                 B(LdaZero),
                 B(Star), R(7),
@@ -39,10 +39,11 @@ bytecodes: [
                 B(CallRuntime), U16(Runtime::kResolvePossiblyDirectEval), R(4), U8(6),
                 B(Star), R(2),
   /*   14 E> */ B(CallUndefinedReceiver1), R(2), R(3), U8(2),
-  /*   35 S> */ B(LdaLookupGlobalSlot), U8(2), U8(4), U8(1),
+  /*   35 S> */ B(LdaLookupGlobalSlot), U8(3), U8(4), U8(1),
   /*   44 S> */ B(Return),
 ]
 constant pool: [
+  SCOPE_INFO_TYPE,
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["eval"],
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["var x = 10;"],
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["x"],
@@ -56,9 +57,9 @@ snippet: "
 "
 frame size: 10
 parameter count: 1
-bytecode array length: 63
+bytecode array length: 64
 bytecodes: [
-                B(CreateFunctionContext), U8(3),
+                B(CreateFunctionContext), U8(0), U8(3),
                 B(PushContext), R(1),
                 B(Ldar), R(this),
                 B(StaCurrentContextSlot), U8(4),
@@ -67,9 +68,9 @@ bytecodes: [
                 B(Ldar), R(0),
                 B(StaCurrentContextSlot), U8(5),
   /*   10 E> */ B(StackCheck),
-  /*   14 S> */ B(LdaLookupGlobalSlot), U8(0), U8(0), U8(1),
+  /*   14 S> */ B(LdaLookupGlobalSlot), U8(1), U8(0), U8(1),
                 B(Star), R(2),
-                B(LdaConstant), U8(1),
+                B(LdaConstant), U8(2),
                 B(Star), R(3),
                 B(LdaZero),
                 B(Star), R(7),
@@ -83,11 +84,12 @@ bytecodes: [
                 B(CallRuntime), U16(Runtime::kResolvePossiblyDirectEval), R(4), U8(6),
                 B(Star), R(2),
   /*   14 E> */ B(CallUndefinedReceiver1), R(2), R(3), U8(2),
-  /*   35 S> */ B(LdaLookupGlobalSlotInsideTypeof), U8(2), U8(4), U8(1),
+  /*   35 S> */ B(LdaLookupGlobalSlotInsideTypeof), U8(3), U8(4), U8(1),
                 B(TypeOf),
   /*   51 S> */ B(Return),
 ]
 constant pool: [
+  SCOPE_INFO_TYPE,
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["eval"],
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["var x = 10;"],
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["x"],
@@ -101,9 +103,9 @@ snippet: "
 "
 frame size: 10
 parameter count: 1
-bytecode array length: 63
+bytecode array length: 64
 bytecodes: [
-                B(CreateFunctionContext), U8(3),
+                B(CreateFunctionContext), U8(0), U8(3),
                 B(PushContext), R(1),
                 B(Ldar), R(this),
                 B(StaCurrentContextSlot), U8(4),
@@ -113,10 +115,10 @@ bytecodes: [
                 B(StaCurrentContextSlot), U8(5),
   /*   10 E> */ B(StackCheck),
   /*   14 S> */ B(LdaSmi), I8(20),
-  /*   16 E> */ B(StaLookupSlot), U8(0), U8(0),
-  /*   22 S> */ B(LdaLookupGlobalSlot), U8(1), U8(0), U8(1),
+  /*   16 E> */ B(StaLookupSlot), U8(1), U8(0),
+  /*   22 S> */ B(LdaLookupGlobalSlot), U8(2), U8(0), U8(1),
                 B(Star), R(2),
-                B(LdaConstant), U8(2),
+                B(LdaConstant), U8(3),
                 B(Star), R(3),
                 B(LdaZero),
                 B(Star), R(7),
@@ -133,6 +135,7 @@ bytecodes: [
   /*   38 S> */ B(Return),
 ]
 constant pool: [
+  SCOPE_INFO_TYPE,
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["x"],
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["eval"],
   ONE_BYTE_INTERNALIZED_STRING_TYPE [""],
@@ -151,9 +154,9 @@ snippet: "
 "
 frame size: 10
 parameter count: 1
-bytecode array length: 62
+bytecode array length: 63
 bytecodes: [
-                B(CreateFunctionContext), U8(3),
+                B(CreateFunctionContext), U8(0), U8(3),
                 B(PushContext), R(1),
                 B(Ldar), R(this),
                 B(StaCurrentContextSlot), U8(4),
@@ -162,9 +165,9 @@ bytecodes: [
                 B(Ldar), R(0),
                 B(StaCurrentContextSlot), U8(5),
   /*   38 E> */ B(StackCheck),
-  /*   44 S> */ B(LdaLookupGlobalSlot), U8(0), U8(0), U8(1),
+  /*   44 S> */ B(LdaLookupGlobalSlot), U8(1), U8(0), U8(1),
                 B(Star), R(2),
-                B(LdaConstant), U8(1),
+                B(LdaConstant), U8(2),
                 B(Star), R(3),
                 B(LdaZero),
                 B(Star), R(7),
@@ -178,10 +181,11 @@ bytecodes: [
                 B(CallRuntime), U16(Runtime::kResolvePossiblyDirectEval), R(4), U8(6),
                 B(Star), R(2),
   /*   44 E> */ B(CallUndefinedReceiver1), R(2), R(3), U8(2),
-  /*   66 S> */ B(LdaLookupContextSlot), U8(2), U8(6), U8(1),
+  /*   66 S> */ B(LdaLookupContextSlot), U8(3), U8(6), U8(1),
   /*   75 S> */ B(Return),
 ]
 constant pool: [
+  SCOPE_INFO_TYPE,
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["eval"],
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["var x = 10"],
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["x"],
@@ -200,9 +204,9 @@ snippet: "
 "
 frame size: 10
 parameter count: 1
-bytecode array length: 62
+bytecode array length: 63
 bytecodes: [
-                B(CreateFunctionContext), U8(3),
+                B(CreateFunctionContext), U8(0), U8(3),
                 B(PushContext), R(1),
                 B(Ldar), R(this),
                 B(StaCurrentContextSlot), U8(4),
@@ -211,9 +215,9 @@ bytecodes: [
                 B(Ldar), R(0),
                 B(StaCurrentContextSlot), U8(5),
   /*   34 E> */ B(StackCheck),
-  /*   40 S> */ B(LdaLookupGlobalSlot), U8(0), U8(0), U8(1),
+  /*   40 S> */ B(LdaLookupGlobalSlot), U8(1), U8(0), U8(1),
                 B(Star), R(2),
-                B(LdaConstant), U8(1),
+                B(LdaConstant), U8(2),
                 B(Star), R(3),
                 B(LdaZero),
                 B(Star), R(7),
@@ -227,10 +231,11 @@ bytecodes: [
                 B(CallRuntime), U16(Runtime::kResolvePossiblyDirectEval), R(4), U8(6),
                 B(Star), R(2),
   /*   40 E> */ B(CallUndefinedReceiver1), R(2), R(3), U8(2),
-  /*   62 S> */ B(LdaLookupGlobalSlot), U8(2), U8(4), U8(1),
+  /*   62 S> */ B(LdaLookupGlobalSlot), U8(3), U8(4), U8(1),
   /*   71 S> */ B(Return),
 ]
 constant pool: [
+  SCOPE_INFO_TYPE,
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["eval"],
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["var x = 10"],
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["x"],
diff --git a/deps/v8/test/cctest/interpreter/bytecode_expectations/Modules.golden b/deps/v8/test/cctest/interpreter/bytecode_expectations/Modules.golden
index d6db2f43c30f07..629e4f36d15b96 100644
--- a/deps/v8/test/cctest/interpreter/bytecode_expectations/Modules.golden
+++ b/deps/v8/test/cctest/interpreter/bytecode_expectations/Modules.golden
@@ -17,11 +17,11 @@ bytecode array length: 62
 bytecodes: [
                 B(SwitchOnGeneratorState), R(0), U8(0), U8(1),
                 B(LdaConstant), U8(1),
-                B(Star), R(4),
+                B(Star), R(3),
                 B(Mov), R(arg0), R(2),
-                B(Mov), R(closure), R(3),
-                B(CallRuntime), U16(Runtime::kPushModuleContext), R(2), U8(3),
+                B(CallRuntime), U16(Runtime::kPushModuleContext), R(2), U8(2),
                 B(PushContext), R(2),
+                B(Mov), R(closure), R(3),
                 B(Mov), R(this), R(4),
                 B(InvokeIntrinsic), U8(Runtime::k_CreateJSGeneratorObject), R(3), U8(2),
                 B(Star), R(0),
@@ -34,10 +34,10 @@ bytecodes: [
                 B(Ldar), R(3),
   /*    0 E> */ B(Throw),
                 B(Ldar), R(3),
-  /*   13 S> */ B(Return),
+  /*   14 S> */ B(Return),
                 B(Mov), R(3), R(1),
                 B(Ldar), R(1),
-  /*   13 S> */ B(Return),
+  /*   14 S> */ B(Return),
 ]
 constant pool: [
   Smi [36],
@@ -58,11 +58,11 @@ bytecode array length: 62
 bytecodes: [
                 B(SwitchOnGeneratorState), R(0), U8(0), U8(1),
                 B(LdaConstant), U8(1),
-                B(Star), R(4),
+                B(Star), R(3),
                 B(Mov), R(arg0), R(2),
-                B(Mov), R(closure), R(3),
-                B(CallRuntime), U16(Runtime::kPushModuleContext), R(2), U8(3),
+                B(CallRuntime), U16(Runtime::kPushModuleContext), R(2), U8(2),
                 B(PushContext), R(2),
+                B(Mov), R(closure), R(3),
                 B(Mov), R(this), R(4),
                 B(InvokeIntrinsic), U8(Runtime::k_CreateJSGeneratorObject), R(3), U8(2),
                 B(Star), R(0),
@@ -75,10 +75,10 @@ bytecodes: [
                 B(Ldar), R(3),
   /*    0 E> */ B(Throw),
                 B(Ldar), R(3),
-  /*   24 S> */ B(Return),
+  /*   25 S> */ B(Return),
                 B(Mov), R(3), R(1),
                 B(Ldar), R(1),
-  /*   24 S> */ B(Return),
+  /*   25 S> */ B(Return),
 ]
 constant pool: [
   Smi [36],
@@ -101,11 +101,11 @@ bytecode array length: 92
 bytecodes: [
                 B(SwitchOnGeneratorState), R(1), U8(0), U8(1),
                 B(LdaConstant), U8(1),
-                B(Star), R(5),
+                B(Star), R(4),
                 B(Mov), R(arg0), R(3),
-                B(Mov), R(closure), R(4),
-                B(CallRuntime), U16(Runtime::kPushModuleContext), R(3), U8(3),
+                B(CallRuntime), U16(Runtime::kPushModuleContext), R(3), U8(2),
                 B(PushContext), R(3),
+                B(Mov), R(closure), R(4),
                 B(Mov), R(this), R(5),
                 B(InvokeIntrinsic), U8(Runtime::k_CreateJSGeneratorObject), R(4), U8(2),
                 B(Star), R(1),
@@ -118,7 +118,7 @@ bytecodes: [
                 B(Ldar), R(4),
   /*    0 E> */ B(Throw),
                 B(Ldar), R(4),
-  /*   64 S> */ B(Return),
+  /*   65 S> */ B(Return),
   /*   32 S> */ B(LdaModuleVariable), I8(-1), U8(0),
                 B(ThrowReferenceErrorIfHole), U8(4),
                 B(Star), R(4),
@@ -134,7 +134,7 @@ bytecodes: [
                 B(Star), R(5),
   /*   52 E> */ B(CallUndefinedReceiver1), R(4), R(5), U8(2),
                 B(Star), R(2),
-  /*   64 S> */ B(Return),
+  /*   65 S> */ B(Return),
 ]
 constant pool: [
   Smi [36],
@@ -158,11 +158,11 @@ bytecode array length: 90
 bytecodes: [
                 B(SwitchOnGeneratorState), R(1), U8(0), U8(1),
                 B(LdaConstant), U8(1),
-                B(Star), R(5),
+                B(Star), R(4),
                 B(Mov), R(arg0), R(3),
-                B(Mov), R(closure), R(4),
-                B(CallRuntime), U16(Runtime::kPushModuleContext), R(3), U8(3),
+                B(CallRuntime), U16(Runtime::kPushModuleContext), R(3), U8(2),
                 B(PushContext), R(3),
+                B(Mov), R(closure), R(4),
                 B(Mov), R(this), R(5),
                 B(InvokeIntrinsic), U8(Runtime::k_CreateJSGeneratorObject), R(4), U8(2),
                 B(Star), R(1),
@@ -175,7 +175,7 @@ bytecodes: [
                 B(Ldar), R(4),
   /*    0 E> */ B(Throw),
                 B(Ldar), R(4),
-  /*   49 S> */ B(Return),
+  /*   50 S> */ B(Return),
   /*   17 S> */ B(LdaSmi), I8(42),
   /*   17 E> */ B(StaModuleVariable), I8(1), U8(0),
   /*   21 S> */ B(LdaModuleVariable), I8(1), U8(0),
@@ -190,7 +190,7 @@ bytecodes: [
   /*   42 E> */ B(StaModuleVariable), I8(1), U8(0),
                 B(Mov), R(4), R(2),
                 B(Ldar), R(2),
-  /*   49 S> */ B(Return),
+  /*   50 S> */ B(Return),
 ]
 constant pool: [
   Smi [36],
@@ -213,11 +213,11 @@ bytecode array length: 96
 bytecodes: [
                 B(SwitchOnGeneratorState), R(1), U8(0), U8(1),
                 B(LdaConstant), U8(1),
-                B(Star), R(5),
+                B(Star), R(4),
                 B(Mov), R(arg0), R(3),
-                B(Mov), R(closure), R(4),
-                B(CallRuntime), U16(Runtime::kPushModuleContext), R(3), U8(3),
+                B(CallRuntime), U16(Runtime::kPushModuleContext), R(3), U8(2),
                 B(PushContext), R(3),
+                B(Mov), R(closure), R(4),
                 B(Mov), R(this), R(5),
                 B(InvokeIntrinsic), U8(Runtime::k_CreateJSGeneratorObject), R(4), U8(2),
                 B(Star), R(1),
@@ -233,7 +233,7 @@ bytecodes: [
                 B(Ldar), R(4),
   /*    0 E> */ B(Throw),
                 B(Ldar), R(4),
-  /*   49 S> */ B(Return),
+  /*   50 S> */ B(Return),
   /*   17 S> */ B(LdaSmi), I8(42),
   /*   17 E> */ B(StaModuleVariable), I8(1), U8(0),
   /*   21 S> */ B(LdaModuleVariable), I8(1), U8(0),
@@ -248,7 +248,7 @@ bytecodes: [
   /*   42 E> */ B(StaModuleVariable), I8(1), U8(0),
                 B(Mov), R(4), R(2),
                 B(Ldar), R(2),
-  /*   49 S> */ B(Return),
+  /*   50 S> */ B(Return),
 ]
 constant pool: [
   Smi [42],
@@ -271,11 +271,11 @@ bytecode array length: 100
 bytecodes: [
                 B(SwitchOnGeneratorState), R(1), U8(0), U8(1),
                 B(LdaConstant), U8(1),
-                B(Star), R(5),
+                B(Star), R(4),
                 B(Mov), R(arg0), R(3),
-                B(Mov), R(closure), R(4),
-                B(CallRuntime), U16(Runtime::kPushModuleContext), R(3), U8(3),
+                B(CallRuntime), U16(Runtime::kPushModuleContext), R(3), U8(2),
                 B(PushContext), R(3),
+                B(Mov), R(closure), R(4),
                 B(Mov), R(this), R(5),
                 B(InvokeIntrinsic), U8(Runtime::k_CreateJSGeneratorObject), R(4), U8(2),
                 B(Star), R(1),
@@ -291,7 +291,7 @@ bytecodes: [
                 B(Ldar), R(4),
   /*    0 E> */ B(Throw),
                 B(Ldar), R(4),
-  /*   51 S> */ B(Return),
+  /*   52 S> */ B(Return),
   /*   19 S> */ B(LdaSmi), I8(42),
   /*   19 E> */ B(StaModuleVariable), I8(1), U8(0),
   /*   23 S> */ B(LdaModuleVariable), I8(1), U8(0),
@@ -306,7 +306,7 @@ bytecodes: [
   /*   44 E> */ B(CallRuntime), U16(Runtime::kThrowConstAssignError), R(0), U8(0),
                 B(Mov), R(4), R(2),
                 B(Ldar), R(2),
-  /*   51 S> */ B(Return),
+  /*   52 S> */ B(Return),
 ]
 constant pool: [
   Smi [42],
@@ -327,11 +327,11 @@ bytecode array length: 75
 bytecodes: [
                 B(SwitchOnGeneratorState), R(0), U8(0), U8(1),
                 B(LdaConstant), U8(1),
-                B(Star), R(4),
+                B(Star), R(3),
                 B(Mov), R(arg0), R(2),
-                B(Mov), R(closure), R(3),
-                B(CallRuntime), U16(Runtime::kPushModuleContext), R(2), U8(3),
+                B(CallRuntime), U16(Runtime::kPushModuleContext), R(2), U8(2),
                 B(PushContext), R(2),
+                B(Mov), R(closure), R(3),
                 B(Mov), R(this), R(4),
                 B(InvokeIntrinsic), U8(Runtime::k_CreateJSGeneratorObject), R(3), U8(2),
                 B(Star), R(0),
@@ -347,12 +347,12 @@ bytecodes: [
                 B(Ldar), R(3),
   /*    0 E> */ B(Throw),
                 B(Ldar), R(3),
-  /*   32 S> */ B(Return),
+  /*   33 S> */ B(Return),
                 B(Mov), R(3), R(1),
                 B(CreateClosure), U8(4), U8(0), U8(0),
                 B(StaModuleVariable), I8(1), U8(0),
                 B(Ldar), R(1),
-  /*   32 S> */ B(Return),
+  /*   33 S> */ B(Return),
 ]
 constant pool: [
   Smi [42],
@@ -374,11 +374,11 @@ bytecode array length: 96
 bytecodes: [
                 B(SwitchOnGeneratorState), R(0), U8(0), U8(1),
                 B(LdaConstant), U8(1),
-                B(Star), R(4),
+                B(Star), R(3),
                 B(Mov), R(arg0), R(2),
-                B(Mov), R(closure), R(3),
-                B(CallRuntime), U16(Runtime::kPushModuleContext), R(2), U8(3),
+                B(CallRuntime), U16(Runtime::kPushModuleContext), R(2), U8(2),
                 B(PushContext), R(2),
+                B(Mov), R(closure), R(3),
                 B(Mov), R(this), R(4),
                 B(InvokeIntrinsic), U8(Runtime::k_CreateJSGeneratorObject), R(3), U8(2),
                 B(Star), R(0),
@@ -394,7 +394,7 @@ bytecodes: [
                 B(Ldar), R(3),
   /*    0 E> */ B(Throw),
                 B(Ldar), R(3),
-  /*   26 S> */ B(Return),
+  /*   27 S> */ B(Return),
                 B(Mov), R(3), R(1),
                 B(LdaTheHole),
                 B(Star), R(6),
@@ -408,7 +408,7 @@ bytecodes: [
                 B(Ldar), R(5),
                 B(StaModuleVariable), I8(1), U8(0),
                 B(Ldar), R(1),
-  /*   26 S> */ B(Return),
+  /*   27 S> */ B(Return),
 ]
 constant pool: [
   Smi [42],
@@ -431,11 +431,11 @@ bytecode array length: 62
 bytecodes: [
                 B(SwitchOnGeneratorState), R(0), U8(0), U8(1),
                 B(LdaConstant), U8(1),
-                B(Star), R(4),
+                B(Star), R(3),
                 B(Mov), R(arg0), R(2),
-                B(Mov), R(closure), R(3),
-                B(CallRuntime), U16(Runtime::kPushModuleContext), R(2), U8(3),
+                B(CallRuntime), U16(Runtime::kPushModuleContext), R(2), U8(2),
                 B(PushContext), R(2),
+                B(Mov), R(closure), R(3),
                 B(Mov), R(this), R(4),
                 B(InvokeIntrinsic), U8(Runtime::k_CreateJSGeneratorObject), R(3), U8(2),
                 B(Star), R(0),
@@ -448,10 +448,10 @@ bytecodes: [
                 B(Ldar), R(3),
   /*    0 E> */ B(Throw),
                 B(Ldar), R(3),
-  /*   30 S> */ B(Return),
+  /*   31 S> */ B(Return),
                 B(Mov), R(3), R(1),
                 B(Ldar), R(1),
-  /*   30 S> */ B(Return),
+  /*   31 S> */ B(Return),
 ]
 constant pool: [
   Smi [36],
@@ -472,11 +472,11 @@ bytecode array length: 62
 bytecodes: [
                 B(SwitchOnGeneratorState), R(0), U8(0), U8(1),
                 B(LdaConstant), U8(1),
-                B(Star), R(4),
+                B(Star), R(3),
                 B(Mov), R(arg0), R(2),
-                B(Mov), R(closure), R(3),
-                B(CallRuntime), U16(Runtime::kPushModuleContext), R(2), U8(3),
+                B(CallRuntime), U16(Runtime::kPushModuleContext), R(2), U8(2),
                 B(PushContext), R(2),
+                B(Mov), R(closure), R(3),
                 B(Mov), R(this), R(4),
                 B(InvokeIntrinsic), U8(Runtime::k_CreateJSGeneratorObject), R(3), U8(2),
                 B(Star), R(0),
@@ -489,10 +489,10 @@ bytecodes: [
                 B(Ldar), R(3),
   /*    0 E> */ B(Throw),
                 B(Ldar), R(3),
-  /*   19 S> */ B(Return),
+  /*   20 S> */ B(Return),
                 B(Mov), R(3), R(1),
                 B(Ldar), R(1),
-  /*   19 S> */ B(Return),
+  /*   20 S> */ B(Return),
 ]
 constant pool: [
   Smi [36],
@@ -514,11 +514,11 @@ bytecode array length: 89
 bytecodes: [
                 B(SwitchOnGeneratorState), R(0), U8(0), U8(1),
                 B(LdaConstant), U8(1),
-                B(Star), R(5),
+                B(Star), R(4),
                 B(Mov), R(arg0), R(3),
-                B(Mov), R(closure), R(4),
-                B(CallRuntime), U16(Runtime::kPushModuleContext), R(3), U8(3),
+                B(CallRuntime), U16(Runtime::kPushModuleContext), R(3), U8(2),
                 B(PushContext), R(3),
+                B(Mov), R(closure), R(4),
                 B(Mov), R(this), R(5),
                 B(InvokeIntrinsic), U8(Runtime::k_CreateJSGeneratorObject), R(4), U8(2),
                 B(Star), R(0),
@@ -536,14 +536,14 @@ bytecodes: [
                 B(Ldar), R(4),
   /*    0 E> */ B(Throw),
                 B(Ldar), R(4),
-  /*   45 S> */ B(Return),
+  /*   46 S> */ B(Return),
   /*   31 S> */ B(LdaNamedProperty), R(1), U8(4), U8(0),
                 B(Star), R(4),
   /*   42 E> */ B(LdaNamedProperty), R(1), U8(5), U8(2),
                 B(Star), R(7),
   /*   31 E> */ B(CallProperty2), R(4), R(1), R(1), R(7), U8(4),
                 B(Star), R(2),
-  /*   45 S> */ B(Return),
+  /*   46 S> */ B(Return),
 ]
 constant pool: [
   Smi [48],
diff --git a/deps/v8/test/cctest/interpreter/bytecode_expectations/NewAndSpread.golden b/deps/v8/test/cctest/interpreter/bytecode_expectations/NewAndSpread.golden
index 7cfebf4858bb87..bdfb35c70b4b8e 100644
--- a/deps/v8/test/cctest/interpreter/bytecode_expectations/NewAndSpread.golden
+++ b/deps/v8/test/cctest/interpreter/bytecode_expectations/NewAndSpread.golden
@@ -36,7 +36,7 @@ bytecodes: [
 constant pool: [
   FIXED_ARRAY_TYPE,
   SHARED_FUNCTION_INFO_TYPE,
-  TUPLE2_TYPE,
+  ARRAY_BOILERPLATE_DESCRIPTION_TYPE,
 ]
 handlers: [
 ]
@@ -74,7 +74,7 @@ bytecodes: [
 constant pool: [
   FIXED_ARRAY_TYPE,
   SHARED_FUNCTION_INFO_TYPE,
-  TUPLE2_TYPE,
+  ARRAY_BOILERPLATE_DESCRIPTION_TYPE,
 ]
 handlers: [
 ]
@@ -139,9 +139,9 @@ bytecodes: [
 constant pool: [
   FIXED_ARRAY_TYPE,
   SHARED_FUNCTION_INFO_TYPE,
-  TUPLE2_TYPE,
+  ARRAY_BOILERPLATE_DESCRIPTION_TYPE,
   Smi [1],
-  TUPLE2_TYPE,
+  ARRAY_BOILERPLATE_DESCRIPTION_TYPE,
   SYMBOL_TYPE,
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["next"],
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["done"],
diff --git a/deps/v8/test/cctest/interpreter/bytecode_expectations/ObjectLiterals.golden b/deps/v8/test/cctest/interpreter/bytecode_expectations/ObjectLiterals.golden
index 779788b88e9ed6..fa64ffa2a40c47 100644
--- a/deps/v8/test/cctest/interpreter/bytecode_expectations/ObjectLiterals.golden
+++ b/deps/v8/test/cctest/interpreter/bytecode_expectations/ObjectLiterals.golden
@@ -36,7 +36,7 @@ bytecodes: [
   /*   70 S> */ B(Return),
 ]
 constant pool: [
-  BOILERPLATE_DESCRIPTION_TYPE,
+  OBJECT_BOILERPLATE_DESCRIPTION_TYPE,
 ]
 handlers: [
 ]
@@ -58,7 +58,7 @@ bytecodes: [
   /*   79 S> */ B(Return),
 ]
 constant pool: [
-  BOILERPLATE_DESCRIPTION_TYPE,
+  OBJECT_BOILERPLATE_DESCRIPTION_TYPE,
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["val"],
 ]
 handlers: [
@@ -82,7 +82,7 @@ bytecodes: [
   /*   75 S> */ B(Return),
 ]
 constant pool: [
-  BOILERPLATE_DESCRIPTION_TYPE,
+  OBJECT_BOILERPLATE_DESCRIPTION_TYPE,
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["val"],
 ]
 handlers: [
@@ -104,7 +104,7 @@ bytecodes: [
   /*   66 S> */ B(Return),
 ]
 constant pool: [
-  BOILERPLATE_DESCRIPTION_TYPE,
+  OBJECT_BOILERPLATE_DESCRIPTION_TYPE,
   SHARED_FUNCTION_INFO_TYPE,
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["func"],
 ]
@@ -127,7 +127,7 @@ bytecodes: [
   /*   67 S> */ B(Return),
 ]
 constant pool: [
-  BOILERPLATE_DESCRIPTION_TYPE,
+  OBJECT_BOILERPLATE_DESCRIPTION_TYPE,
   SHARED_FUNCTION_INFO_TYPE,
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["func"],
 ]
@@ -158,7 +158,7 @@ bytecodes: [
   /*   67 S> */ B(Return),
 ]
 constant pool: [
-  BOILERPLATE_DESCRIPTION_TYPE,
+  OBJECT_BOILERPLATE_DESCRIPTION_TYPE,
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["a"],
   SHARED_FUNCTION_INFO_TYPE,
 ]
@@ -189,7 +189,7 @@ bytecodes: [
   /*  101 S> */ B(Return),
 ]
 constant pool: [
-  BOILERPLATE_DESCRIPTION_TYPE,
+  OBJECT_BOILERPLATE_DESCRIPTION_TYPE,
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["a"],
   SHARED_FUNCTION_INFO_TYPE,
   SHARED_FUNCTION_INFO_TYPE,
@@ -221,7 +221,7 @@ bytecodes: [
   /*   73 S> */ B(Return),
 ]
 constant pool: [
-  BOILERPLATE_DESCRIPTION_TYPE,
+  OBJECT_BOILERPLATE_DESCRIPTION_TYPE,
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["b"],
   SHARED_FUNCTION_INFO_TYPE,
 ]
@@ -251,7 +251,7 @@ bytecodes: [
   /*   61 S> */ B(Return),
 ]
 constant pool: [
-  BOILERPLATE_DESCRIPTION_TYPE,
+  OBJECT_BOILERPLATE_DESCRIPTION_TYPE,
 ]
 handlers: [
 ]
@@ -270,7 +270,7 @@ bytecodes: [
   /*   61 S> */ B(Return),
 ]
 constant pool: [
-  BOILERPLATE_DESCRIPTION_TYPE,
+  OBJECT_BOILERPLATE_DESCRIPTION_TYPE,
 ]
 handlers: [
 ]
@@ -295,7 +295,7 @@ bytecodes: [
 ]
 constant pool: [
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["test"],
-  BOILERPLATE_DESCRIPTION_TYPE,
+  OBJECT_BOILERPLATE_DESCRIPTION_TYPE,
 ]
 handlers: [
 ]
@@ -322,7 +322,7 @@ bytecodes: [
 ]
 constant pool: [
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["test"],
-  BOILERPLATE_DESCRIPTION_TYPE,
+  OBJECT_BOILERPLATE_DESCRIPTION_TYPE,
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["val"],
 ]
 handlers: [
@@ -352,7 +352,7 @@ bytecodes: [
 ]
 constant pool: [
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["test"],
-  BOILERPLATE_DESCRIPTION_TYPE,
+  OBJECT_BOILERPLATE_DESCRIPTION_TYPE,
 ]
 handlers: [
 ]
@@ -392,7 +392,7 @@ bytecodes: [
 ]
 constant pool: [
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["name"],
-  BOILERPLATE_DESCRIPTION_TYPE,
+  OBJECT_BOILERPLATE_DESCRIPTION_TYPE,
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["val"],
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["a"],
   SHARED_FUNCTION_INFO_TYPE,
diff --git a/deps/v8/test/cctest/interpreter/bytecode_expectations/PrivateClassFields.golden b/deps/v8/test/cctest/interpreter/bytecode_expectations/PrivateClassFields.golden
index c6c446556b2863..f19a0f0c7334d8 100644
--- a/deps/v8/test/cctest/interpreter/bytecode_expectations/PrivateClassFields.golden
+++ b/deps/v8/test/cctest/interpreter/bytecode_expectations/PrivateClassFields.golden
@@ -25,10 +25,9 @@ snippet: "
 "
 frame size: 9
 parameter count: 1
-bytecode array length: 131
+bytecode array length: 127
 bytecodes: [
   /*   30 E> */ B(StackCheck),
-                B(Ldar), R(closure),
                 B(CreateBlockContext), U8(0),
                 B(PushContext), R(4),
                 B(LdaTheHole),
@@ -50,7 +49,6 @@ bytecodes: [
                 B(StaNamedProperty), R(5), U8(4), U8(2),
                 B(PopContext), R(4),
                 B(Mov), R(1), R(2),
-                B(Ldar), R(closure),
   /*   38 E> */ B(CreateBlockContext), U8(5),
                 B(PushContext), R(4),
                 B(LdaTheHole),
@@ -130,10 +128,9 @@ snippet: "
 "
 frame size: 15
 parameter count: 1
-bytecode array length: 263
+bytecode array length: 257
 bytecodes: [
   /*   30 E> */ B(StackCheck),
-                B(Ldar), R(closure),
                 B(CreateBlockContext), U8(0),
                 B(PushContext), R(6),
                 B(LdaTheHole),
@@ -163,7 +160,6 @@ bytecodes: [
                 B(StaNamedProperty), R(7), U8(6), U8(3),
                 B(PopContext), R(6),
                 B(Mov), R(2), R(3),
-                B(Ldar), R(closure),
   /*   38 E> */ B(CreateBlockContext), U8(7),
                 B(PushContext), R(6),
                 B(LdaTheHole),
@@ -201,7 +197,6 @@ bytecodes: [
                 B(StaNamedProperty), R(7), U8(6), U8(10),
                 B(PopContext), R(6),
                 B(Mov), R(1), R(4),
-                B(Ldar), R(closure),
   /*  140 E> */ B(CreateBlockContext), U8(15),
                 B(PushContext), R(6),
                 B(LdaTheHole),
diff --git a/deps/v8/test/cctest/interpreter/bytecode_expectations/PropertyCall.golden b/deps/v8/test/cctest/interpreter/bytecode_expectations/PropertyCall.golden
index c08ca8886ab507..9d55cd6cb8b784 100644
--- a/deps/v8/test/cctest/interpreter/bytecode_expectations/PropertyCall.golden
+++ b/deps/v8/test/cctest/interpreter/bytecode_expectations/PropertyCall.golden
@@ -75,276 +75,409 @@ handlers: [
 ---
 snippet: "
   function f(a) {
-   a.func;
-   a.func;
-   a.func;
-   a.func;
-   a.func;
-   a.func;
-   a.func;
-   a.func;
-   a.func;
-   a.func;
-   a.func;
-   a.func;
-   a.func;
-   a.func;
-   a.func;
-   a.func;
-   a.func;
-   a.func;
-   a.func;
-   a.func;
-   a.func;
-   a.func;
-   a.func;
-   a.func;
-   a.func;
-   a.func;
-   a.func;
-   a.func;
-   a.func;
-   a.func;
-   a.func;
-   a.func;
-   a.func;
-   a.func;
-   a.func;
-   a.func;
-   a.func;
-   a.func;
-   a.func;
-   a.func;
-   a.func;
-   a.func;
-   a.func;
-   a.func;
-   a.func;
-   a.func;
-   a.func;
-   a.func;
-   a.func;
-   a.func;
-   a.func;
-   a.func;
-   a.func;
-   a.func;
-   a.func;
-   a.func;
-   a.func;
-   a.func;
-   a.func;
-   a.func;
-   a.func;
-   a.func;
-   a.func;
-   a.func;
-   a.func;
-   a.func;
-   a.func;
-   a.func;
-   a.func;
-   a.func;
-   a.func;
-   a.func;
-   a.func;
-   a.func;
-   a.func;
-   a.func;
-   a.func;
-   a.func;
-   a.func;
-   a.func;
-   a.func;
-   a.func;
-   a.func;
-   a.func;
-   a.func;
-   a.func;
-   a.func;
-   a.func;
-   a.func;
-   a.func;
-   a.func;
-   a.func;
-   a.func;
-   a.func;
-   a.func;
-   a.func;
-   a.func;
-   a.func;
-   a.func;
-   a.func;
-   a.func;
-   a.func;
-   a.func;
-   a.func;
-   a.func;
-   a.func;
-   a.func;
-   a.func;
-   a.func;
-   a.func;
-   a.func;
-   a.func;
-   a.func;
-   a.func;
-   a.func;
-   a.func;
-   a.func;
-   a.func;
-   a.func;
-   a.func;
-   a.func;
-   a.func;
-   a.func;
-   a.func;
-   a.func;
-   a.func;
-   a.func;
-   a.func;
-   return a.func(); }
+    var b = {};
+    b.name384;
+    b.name385;
+    b.name386;
+    b.name387;
+    b.name388;
+    b.name389;
+    b.name390;
+    b.name391;
+    b.name392;
+    b.name393;
+    b.name394;
+    b.name395;
+    b.name396;
+    b.name397;
+    b.name398;
+    b.name399;
+    b.name400;
+    b.name401;
+    b.name402;
+    b.name403;
+    b.name404;
+    b.name405;
+    b.name406;
+    b.name407;
+    b.name408;
+    b.name409;
+    b.name410;
+    b.name411;
+    b.name412;
+    b.name413;
+    b.name414;
+    b.name415;
+    b.name416;
+    b.name417;
+    b.name418;
+    b.name419;
+    b.name420;
+    b.name421;
+    b.name422;
+    b.name423;
+    b.name424;
+    b.name425;
+    b.name426;
+    b.name427;
+    b.name428;
+    b.name429;
+    b.name430;
+    b.name431;
+    b.name432;
+    b.name433;
+    b.name434;
+    b.name435;
+    b.name436;
+    b.name437;
+    b.name438;
+    b.name439;
+    b.name440;
+    b.name441;
+    b.name442;
+    b.name443;
+    b.name444;
+    b.name445;
+    b.name446;
+    b.name447;
+    b.name448;
+    b.name449;
+    b.name450;
+    b.name451;
+    b.name452;
+    b.name453;
+    b.name454;
+    b.name455;
+    b.name456;
+    b.name457;
+    b.name458;
+    b.name459;
+    b.name460;
+    b.name461;
+    b.name462;
+    b.name463;
+    b.name464;
+    b.name465;
+    b.name466;
+    b.name467;
+    b.name468;
+    b.name469;
+    b.name470;
+    b.name471;
+    b.name472;
+    b.name473;
+    b.name474;
+    b.name475;
+    b.name476;
+    b.name477;
+    b.name478;
+    b.name479;
+    b.name480;
+    b.name481;
+    b.name482;
+    b.name483;
+    b.name484;
+    b.name485;
+    b.name486;
+    b.name487;
+    b.name488;
+    b.name489;
+    b.name490;
+    b.name491;
+    b.name492;
+    b.name493;
+    b.name494;
+    b.name495;
+    b.name496;
+    b.name497;
+    b.name498;
+    b.name499;
+    b.name500;
+    b.name501;
+    b.name502;
+    b.name503;
+    b.name504;
+    b.name505;
+    b.name506;
+    b.name507;
+    b.name508;
+    b.name509;
+    b.name510;
+    b.name511;
+    a.func;
+    return a.func(); }
   f(new (function Obj() { this.func = function() { return; }})())
 "
-frame size: 1
+frame size: 2
 parameter count: 2
-bytecode array length: 532
+bytecode array length: 543
 bytecodes: [
   /*   10 E> */ B(StackCheck),
-  /*   19 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(0),
-  /*   28 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(2),
-  /*   37 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(4),
-  /*   46 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(6),
-  /*   55 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(8),
-  /*   64 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(10),
-  /*   73 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(12),
-  /*   82 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(14),
-  /*   91 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(16),
-  /*  100 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(18),
-  /*  109 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(20),
-  /*  118 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(22),
-  /*  127 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(24),
-  /*  136 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(26),
-  /*  145 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(28),
-  /*  154 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(30),
-  /*  163 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(32),
-  /*  172 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(34),
-  /*  181 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(36),
-  /*  190 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(38),
-  /*  199 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(40),
-  /*  208 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(42),
-  /*  217 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(44),
-  /*  226 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(46),
-  /*  235 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(48),
-  /*  244 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(50),
-  /*  253 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(52),
-  /*  262 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(54),
-  /*  271 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(56),
-  /*  280 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(58),
-  /*  289 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(60),
-  /*  298 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(62),
-  /*  307 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(64),
-  /*  316 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(66),
-  /*  325 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(68),
-  /*  334 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(70),
-  /*  343 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(72),
-  /*  352 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(74),
-  /*  361 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(76),
-  /*  370 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(78),
-  /*  379 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(80),
-  /*  388 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(82),
-  /*  397 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(84),
-  /*  406 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(86),
-  /*  415 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(88),
-  /*  424 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(90),
-  /*  433 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(92),
-  /*  442 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(94),
-  /*  451 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(96),
-  /*  460 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(98),
-  /*  469 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(100),
-  /*  478 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(102),
-  /*  487 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(104),
-  /*  496 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(106),
-  /*  505 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(108),
-  /*  514 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(110),
-  /*  523 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(112),
-  /*  532 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(114),
-  /*  541 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(116),
-  /*  550 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(118),
-  /*  559 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(120),
-  /*  568 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(122),
-  /*  577 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(124),
-  /*  586 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(126),
-  /*  595 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(128),
-  /*  604 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(130),
-  /*  613 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(132),
-  /*  622 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(134),
-  /*  631 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(136),
-  /*  640 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(138),
-  /*  649 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(140),
-  /*  658 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(142),
-  /*  667 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(144),
-  /*  676 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(146),
-  /*  685 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(148),
-  /*  694 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(150),
-  /*  703 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(152),
-  /*  712 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(154),
-  /*  721 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(156),
-  /*  730 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(158),
-  /*  739 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(160),
-  /*  748 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(162),
-  /*  757 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(164),
-  /*  766 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(166),
-  /*  775 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(168),
-  /*  784 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(170),
-  /*  793 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(172),
-  /*  802 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(174),
-  /*  811 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(176),
-  /*  820 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(178),
-  /*  829 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(180),
-  /*  838 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(182),
-  /*  847 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(184),
-  /*  856 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(186),
-  /*  865 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(188),
-  /*  874 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(190),
-  /*  883 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(192),
-  /*  892 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(194),
-  /*  901 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(196),
-  /*  910 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(198),
-  /*  919 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(200),
-  /*  928 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(202),
-  /*  937 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(204),
-  /*  946 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(206),
-  /*  955 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(208),
-  /*  964 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(210),
-  /*  973 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(212),
-  /*  982 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(214),
-  /*  991 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(216),
-  /* 1000 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(218),
-  /* 1009 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(220),
-  /* 1018 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(222),
-  /* 1027 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(224),
-  /* 1036 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(226),
-  /* 1045 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(228),
-  /* 1054 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(230),
-  /* 1063 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(232),
-  /* 1072 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(234),
-  /* 1081 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(236),
-  /* 1090 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(238),
-  /* 1099 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(240),
-  /* 1108 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(242),
-  /* 1117 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(244),
-  /* 1126 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(246),
-  /* 1135 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(248),
-  /* 1144 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(250),
-  /* 1153 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(252),
-  /* 1162 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(254),
-  /* 1178 S> */ B(Wide), B(LdaNamedProperty), R16(arg0), U16(0), U16(256),
+  /*   26 S> */ B(CreateEmptyObjectLiteral),
                 B(Star), R(0),
-  /* 1178 E> */ B(Wide), B(CallProperty0), R16(0), R16(arg0), U16(258),
-  /* 1185 S> */ B(Return),
+  /*   34 S> */ B(LdaNamedProperty), R(0), U8(0), U8(0),
+  /*   47 S> */ B(LdaNamedProperty), R(0), U8(1), U8(2),
+  /*   60 S> */ B(LdaNamedProperty), R(0), U8(2), U8(4),
+  /*   73 S> */ B(LdaNamedProperty), R(0), U8(3), U8(6),
+  /*   86 S> */ B(LdaNamedProperty), R(0), U8(4), U8(8),
+  /*   99 S> */ B(LdaNamedProperty), R(0), U8(5), U8(10),
+  /*  112 S> */ B(LdaNamedProperty), R(0), U8(6), U8(12),
+  /*  125 S> */ B(LdaNamedProperty), R(0), U8(7), U8(14),
+  /*  138 S> */ B(LdaNamedProperty), R(0), U8(8), U8(16),
+  /*  151 S> */ B(LdaNamedProperty), R(0), U8(9), U8(18),
+  /*  164 S> */ B(LdaNamedProperty), R(0), U8(10), U8(20),
+  /*  177 S> */ B(LdaNamedProperty), R(0), U8(11), U8(22),
+  /*  190 S> */ B(LdaNamedProperty), R(0), U8(12), U8(24),
+  /*  203 S> */ B(LdaNamedProperty), R(0), U8(13), U8(26),
+  /*  216 S> */ B(LdaNamedProperty), R(0), U8(14), U8(28),
+  /*  229 S> */ B(LdaNamedProperty), R(0), U8(15), U8(30),
+  /*  242 S> */ B(LdaNamedProperty), R(0), U8(16), U8(32),
+  /*  255 S> */ B(LdaNamedProperty), R(0), U8(17), U8(34),
+  /*  268 S> */ B(LdaNamedProperty), R(0), U8(18), U8(36),
+  /*  281 S> */ B(LdaNamedProperty), R(0), U8(19), U8(38),
+  /*  294 S> */ B(LdaNamedProperty), R(0), U8(20), U8(40),
+  /*  307 S> */ B(LdaNamedProperty), R(0), U8(21), U8(42),
+  /*  320 S> */ B(LdaNamedProperty), R(0), U8(22), U8(44),
+  /*  333 S> */ B(LdaNamedProperty), R(0), U8(23), U8(46),
+  /*  346 S> */ B(LdaNamedProperty), R(0), U8(24), U8(48),
+  /*  359 S> */ B(LdaNamedProperty), R(0), U8(25), U8(50),
+  /*  372 S> */ B(LdaNamedProperty), R(0), U8(26), U8(52),
+  /*  385 S> */ B(LdaNamedProperty), R(0), U8(27), U8(54),
+  /*  398 S> */ B(LdaNamedProperty), R(0), U8(28), U8(56),
+  /*  411 S> */ B(LdaNamedProperty), R(0), U8(29), U8(58),
+  /*  424 S> */ B(LdaNamedProperty), R(0), U8(30), U8(60),
+  /*  437 S> */ B(LdaNamedProperty), R(0), U8(31), U8(62),
+  /*  450 S> */ B(LdaNamedProperty), R(0), U8(32), U8(64),
+  /*  463 S> */ B(LdaNamedProperty), R(0), U8(33), U8(66),
+  /*  476 S> */ B(LdaNamedProperty), R(0), U8(34), U8(68),
+  /*  489 S> */ B(LdaNamedProperty), R(0), U8(35), U8(70),
+  /*  502 S> */ B(LdaNamedProperty), R(0), U8(36), U8(72),
+  /*  515 S> */ B(LdaNamedProperty), R(0), U8(37), U8(74),
+  /*  528 S> */ B(LdaNamedProperty), R(0), U8(38), U8(76),
+  /*  541 S> */ B(LdaNamedProperty), R(0), U8(39), U8(78),
+  /*  554 S> */ B(LdaNamedProperty), R(0), U8(40), U8(80),
+  /*  567 S> */ B(LdaNamedProperty), R(0), U8(41), U8(82),
+  /*  580 S> */ B(LdaNamedProperty), R(0), U8(42), U8(84),
+  /*  593 S> */ B(LdaNamedProperty), R(0), U8(43), U8(86),
+  /*  606 S> */ B(LdaNamedProperty), R(0), U8(44), U8(88),
+  /*  619 S> */ B(LdaNamedProperty), R(0), U8(45), U8(90),
+  /*  632 S> */ B(LdaNamedProperty), R(0), U8(46), U8(92),
+  /*  645 S> */ B(LdaNamedProperty), R(0), U8(47), U8(94),
+  /*  658 S> */ B(LdaNamedProperty), R(0), U8(48), U8(96),
+  /*  671 S> */ B(LdaNamedProperty), R(0), U8(49), U8(98),
+  /*  684 S> */ B(LdaNamedProperty), R(0), U8(50), U8(100),
+  /*  697 S> */ B(LdaNamedProperty), R(0), U8(51), U8(102),
+  /*  710 S> */ B(LdaNamedProperty), R(0), U8(52), U8(104),
+  /*  723 S> */ B(LdaNamedProperty), R(0), U8(53), U8(106),
+  /*  736 S> */ B(LdaNamedProperty), R(0), U8(54), U8(108),
+  /*  749 S> */ B(LdaNamedProperty), R(0), U8(55), U8(110),
+  /*  762 S> */ B(LdaNamedProperty), R(0), U8(56), U8(112),
+  /*  775 S> */ B(LdaNamedProperty), R(0), U8(57), U8(114),
+  /*  788 S> */ B(LdaNamedProperty), R(0), U8(58), U8(116),
+  /*  801 S> */ B(LdaNamedProperty), R(0), U8(59), U8(118),
+  /*  814 S> */ B(LdaNamedProperty), R(0), U8(60), U8(120),
+  /*  827 S> */ B(LdaNamedProperty), R(0), U8(61), U8(122),
+  /*  840 S> */ B(LdaNamedProperty), R(0), U8(62), U8(124),
+  /*  853 S> */ B(LdaNamedProperty), R(0), U8(63), U8(126),
+  /*  866 S> */ B(LdaNamedProperty), R(0), U8(64), U8(128),
+  /*  879 S> */ B(LdaNamedProperty), R(0), U8(65), U8(130),
+  /*  892 S> */ B(LdaNamedProperty), R(0), U8(66), U8(132),
+  /*  905 S> */ B(LdaNamedProperty), R(0), U8(67), U8(134),
+  /*  918 S> */ B(LdaNamedProperty), R(0), U8(68), U8(136),
+  /*  931 S> */ B(LdaNamedProperty), R(0), U8(69), U8(138),
+  /*  944 S> */ B(LdaNamedProperty), R(0), U8(70), U8(140),
+  /*  957 S> */ B(LdaNamedProperty), R(0), U8(71), U8(142),
+  /*  970 S> */ B(LdaNamedProperty), R(0), U8(72), U8(144),
+  /*  983 S> */ B(LdaNamedProperty), R(0), U8(73), U8(146),
+  /*  996 S> */ B(LdaNamedProperty), R(0), U8(74), U8(148),
+  /* 1009 S> */ B(LdaNamedProperty), R(0), U8(75), U8(150),
+  /* 1022 S> */ B(LdaNamedProperty), R(0), U8(76), U8(152),
+  /* 1035 S> */ B(LdaNamedProperty), R(0), U8(77), U8(154),
+  /* 1048 S> */ B(LdaNamedProperty), R(0), U8(78), U8(156),
+  /* 1061 S> */ B(LdaNamedProperty), R(0), U8(79), U8(158),
+  /* 1074 S> */ B(LdaNamedProperty), R(0), U8(80), U8(160),
+  /* 1087 S> */ B(LdaNamedProperty), R(0), U8(81), U8(162),
+  /* 1100 S> */ B(LdaNamedProperty), R(0), U8(82), U8(164),
+  /* 1113 S> */ B(LdaNamedProperty), R(0), U8(83), U8(166),
+  /* 1126 S> */ B(LdaNamedProperty), R(0), U8(84), U8(168),
+  /* 1139 S> */ B(LdaNamedProperty), R(0), U8(85), U8(170),
+  /* 1152 S> */ B(LdaNamedProperty), R(0), U8(86), U8(172),
+  /* 1165 S> */ B(LdaNamedProperty), R(0), U8(87), U8(174),
+  /* 1178 S> */ B(LdaNamedProperty), R(0), U8(88), U8(176),
+  /* 1191 S> */ B(LdaNamedProperty), R(0), U8(89), U8(178),
+  /* 1204 S> */ B(LdaNamedProperty), R(0), U8(90), U8(180),
+  /* 1217 S> */ B(LdaNamedProperty), R(0), U8(91), U8(182),
+  /* 1230 S> */ B(LdaNamedProperty), R(0), U8(92), U8(184),
+  /* 1243 S> */ B(LdaNamedProperty), R(0), U8(93), U8(186),
+  /* 1256 S> */ B(LdaNamedProperty), R(0), U8(94), U8(188),
+  /* 1269 S> */ B(LdaNamedProperty), R(0), U8(95), U8(190),
+  /* 1282 S> */ B(LdaNamedProperty), R(0), U8(96), U8(192),
+  /* 1295 S> */ B(LdaNamedProperty), R(0), U8(97), U8(194),
+  /* 1308 S> */ B(LdaNamedProperty), R(0), U8(98), U8(196),
+  /* 1321 S> */ B(LdaNamedProperty), R(0), U8(99), U8(198),
+  /* 1334 S> */ B(LdaNamedProperty), R(0), U8(100), U8(200),
+  /* 1347 S> */ B(LdaNamedProperty), R(0), U8(101), U8(202),
+  /* 1360 S> */ B(LdaNamedProperty), R(0), U8(102), U8(204),
+  /* 1373 S> */ B(LdaNamedProperty), R(0), U8(103), U8(206),
+  /* 1386 S> */ B(LdaNamedProperty), R(0), U8(104), U8(208),
+  /* 1399 S> */ B(LdaNamedProperty), R(0), U8(105), U8(210),
+  /* 1412 S> */ B(LdaNamedProperty), R(0), U8(106), U8(212),
+  /* 1425 S> */ B(LdaNamedProperty), R(0), U8(107), U8(214),
+  /* 1438 S> */ B(LdaNamedProperty), R(0), U8(108), U8(216),
+  /* 1451 S> */ B(LdaNamedProperty), R(0), U8(109), U8(218),
+  /* 1464 S> */ B(LdaNamedProperty), R(0), U8(110), U8(220),
+  /* 1477 S> */ B(LdaNamedProperty), R(0), U8(111), U8(222),
+  /* 1490 S> */ B(LdaNamedProperty), R(0), U8(112), U8(224),
+  /* 1503 S> */ B(LdaNamedProperty), R(0), U8(113), U8(226),
+  /* 1516 S> */ B(LdaNamedProperty), R(0), U8(114), U8(228),
+  /* 1529 S> */ B(LdaNamedProperty), R(0), U8(115), U8(230),
+  /* 1542 S> */ B(LdaNamedProperty), R(0), U8(116), U8(232),
+  /* 1555 S> */ B(LdaNamedProperty), R(0), U8(117), U8(234),
+  /* 1568 S> */ B(LdaNamedProperty), R(0), U8(118), U8(236),
+  /* 1581 S> */ B(LdaNamedProperty), R(0), U8(119), U8(238),
+  /* 1594 S> */ B(LdaNamedProperty), R(0), U8(120), U8(240),
+  /* 1607 S> */ B(LdaNamedProperty), R(0), U8(121), U8(242),
+  /* 1620 S> */ B(LdaNamedProperty), R(0), U8(122), U8(244),
+  /* 1633 S> */ B(LdaNamedProperty), R(0), U8(123), U8(246),
+  /* 1646 S> */ B(LdaNamedProperty), R(0), U8(124), U8(248),
+  /* 1659 S> */ B(LdaNamedProperty), R(0), U8(125), U8(250),
+  /* 1672 S> */ B(LdaNamedProperty), R(0), U8(126), U8(252),
+  /* 1685 S> */ B(LdaNamedProperty), R(0), U8(127), U8(254),
+  /* 1698 S> */ B(Wide), B(LdaNamedProperty), R16(arg0), U16(128), U16(256),
+  /* 1715 S> */ B(Wide), B(LdaNamedProperty), R16(arg0), U16(128), U16(256),
+                B(Star), R(1),
+  /* 1715 E> */ B(Wide), B(CallProperty0), R16(1), R16(arg0), U16(258),
+  /* 1722 S> */ B(Return),
 ]
 constant pool: [
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name384"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name385"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name386"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name387"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name388"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name389"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name390"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name391"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name392"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name393"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name394"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name395"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name396"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name397"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name398"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name399"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name400"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name401"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name402"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name403"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name404"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name405"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name406"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name407"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name408"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name409"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name410"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name411"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name412"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name413"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name414"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name415"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name416"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name417"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name418"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name419"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name420"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name421"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name422"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name423"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name424"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name425"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name426"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name427"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name428"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name429"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name430"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name431"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name432"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name433"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name434"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name435"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name436"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name437"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name438"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name439"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name440"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name441"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name442"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name443"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name444"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name445"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name446"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name447"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name448"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name449"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name450"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name451"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name452"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name453"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name454"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name455"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name456"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name457"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name458"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name459"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name460"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name461"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name462"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name463"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name464"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name465"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name466"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name467"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name468"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name469"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name470"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name471"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name472"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name473"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name474"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name475"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name476"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name477"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name478"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name479"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name480"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name481"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name482"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name483"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name484"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name485"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name486"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name487"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name488"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name489"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name490"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name491"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name492"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name493"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name494"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name495"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name496"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name497"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name498"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name499"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name500"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name501"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name502"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name503"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name504"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name505"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name506"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name507"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name508"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name509"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name510"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name511"],
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["func"],
 ]
 handlers: [
diff --git a/deps/v8/test/cctest/interpreter/bytecode_expectations/PropertyLoads.golden b/deps/v8/test/cctest/interpreter/bytecode_expectations/PropertyLoads.golden
index 56e30fa9238dde..4b1a1c03a97919 100644
--- a/deps/v8/test/cctest/interpreter/bytecode_expectations/PropertyLoads.golden
+++ b/deps/v8/test/cctest/interpreter/bytecode_expectations/PropertyLoads.golden
@@ -107,404 +107,406 @@ handlers: [
 ---
 snippet: "
   function f(a) {
-    var b;
-    b = a.name;
-    b = a.name;
-    b = a.name;
-    b = a.name;
-    b = a.name;
-    b = a.name;
-    b = a.name;
-    b = a.name;
-    b = a.name;
-    b = a.name;
-    b = a.name;
-    b = a.name;
-    b = a.name;
-    b = a.name;
-    b = a.name;
-    b = a.name;
-    b = a.name;
-    b = a.name;
-    b = a.name;
-    b = a.name;
-    b = a.name;
-    b = a.name;
-    b = a.name;
-    b = a.name;
-    b = a.name;
-    b = a.name;
-    b = a.name;
-    b = a.name;
-    b = a.name;
-    b = a.name;
-    b = a.name;
-    b = a.name;
-    b = a.name;
-    b = a.name;
-    b = a.name;
-    b = a.name;
-    b = a.name;
-    b = a.name;
-    b = a.name;
-    b = a.name;
-    b = a.name;
-    b = a.name;
-    b = a.name;
-    b = a.name;
-    b = a.name;
-    b = a.name;
-    b = a.name;
-    b = a.name;
-    b = a.name;
-    b = a.name;
-    b = a.name;
-    b = a.name;
-    b = a.name;
-    b = a.name;
-    b = a.name;
-    b = a.name;
-    b = a.name;
-    b = a.name;
-    b = a.name;
-    b = a.name;
-    b = a.name;
-    b = a.name;
-    b = a.name;
-    b = a.name;
-    b = a.name;
-    b = a.name;
-    b = a.name;
-    b = a.name;
-    b = a.name;
-    b = a.name;
-    b = a.name;
-    b = a.name;
-    b = a.name;
-    b = a.name;
-    b = a.name;
-    b = a.name;
-    b = a.name;
-    b = a.name;
-    b = a.name;
-    b = a.name;
-    b = a.name;
-    b = a.name;
-    b = a.name;
-    b = a.name;
-    b = a.name;
-    b = a.name;
-    b = a.name;
-    b = a.name;
-    b = a.name;
-    b = a.name;
-    b = a.name;
-    b = a.name;
-    b = a.name;
-    b = a.name;
-    b = a.name;
-    b = a.name;
-    b = a.name;
-    b = a.name;
-    b = a.name;
-    b = a.name;
-    b = a.name;
-    b = a.name;
-    b = a.name;
-    b = a.name;
-    b = a.name;
-    b = a.name;
-    b = a.name;
-    b = a.name;
-    b = a.name;
-    b = a.name;
-    b = a.name;
-    b = a.name;
-    b = a.name;
-    b = a.name;
-    b = a.name;
-    b = a.name;
-    b = a.name;
-    b = a.name;
-    b = a.name;
-    b = a.name;
-    b = a.name;
-    b = a.name;
-    b = a.name;
-    b = a.name;
-    b = a.name;
-    b = a.name;
-    b = a.name;
-    b = a.name;
+    var b = {};
+    b.name0;
+    b.name1;
+    b.name2;
+    b.name3;
+    b.name4;
+    b.name5;
+    b.name6;
+    b.name7;
+    b.name8;
+    b.name9;
+    b.name10;
+    b.name11;
+    b.name12;
+    b.name13;
+    b.name14;
+    b.name15;
+    b.name16;
+    b.name17;
+    b.name18;
+    b.name19;
+    b.name20;
+    b.name21;
+    b.name22;
+    b.name23;
+    b.name24;
+    b.name25;
+    b.name26;
+    b.name27;
+    b.name28;
+    b.name29;
+    b.name30;
+    b.name31;
+    b.name32;
+    b.name33;
+    b.name34;
+    b.name35;
+    b.name36;
+    b.name37;
+    b.name38;
+    b.name39;
+    b.name40;
+    b.name41;
+    b.name42;
+    b.name43;
+    b.name44;
+    b.name45;
+    b.name46;
+    b.name47;
+    b.name48;
+    b.name49;
+    b.name50;
+    b.name51;
+    b.name52;
+    b.name53;
+    b.name54;
+    b.name55;
+    b.name56;
+    b.name57;
+    b.name58;
+    b.name59;
+    b.name60;
+    b.name61;
+    b.name62;
+    b.name63;
+    b.name64;
+    b.name65;
+    b.name66;
+    b.name67;
+    b.name68;
+    b.name69;
+    b.name70;
+    b.name71;
+    b.name72;
+    b.name73;
+    b.name74;
+    b.name75;
+    b.name76;
+    b.name77;
+    b.name78;
+    b.name79;
+    b.name80;
+    b.name81;
+    b.name82;
+    b.name83;
+    b.name84;
+    b.name85;
+    b.name86;
+    b.name87;
+    b.name88;
+    b.name89;
+    b.name90;
+    b.name91;
+    b.name92;
+    b.name93;
+    b.name94;
+    b.name95;
+    b.name96;
+    b.name97;
+    b.name98;
+    b.name99;
+    b.name100;
+    b.name101;
+    b.name102;
+    b.name103;
+    b.name104;
+    b.name105;
+    b.name106;
+    b.name107;
+    b.name108;
+    b.name109;
+    b.name110;
+    b.name111;
+    b.name112;
+    b.name113;
+    b.name114;
+    b.name115;
+    b.name116;
+    b.name117;
+    b.name118;
+    b.name119;
+    b.name120;
+    b.name121;
+    b.name122;
+    b.name123;
+    b.name124;
+    b.name125;
+    b.name126;
+    b.name127;
     return a.name;
   }
   f({name : \"test\"})
 "
 frame size: 1
 parameter count: 2
-bytecode array length: 778
+bytecode array length: 525
 bytecodes: [
   /*   10 E> */ B(StackCheck),
-  /*   33 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(0),
-                B(Star), R(0),
-  /*   47 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(2),
-                B(Star), R(0),
-  /*   61 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(4),
-                B(Star), R(0),
-  /*   75 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(6),
-                B(Star), R(0),
-  /*   89 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(8),
-                B(Star), R(0),
-  /*  103 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(10),
-                B(Star), R(0),
-  /*  117 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(12),
-                B(Star), R(0),
-  /*  131 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(14),
-                B(Star), R(0),
-  /*  145 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(16),
-                B(Star), R(0),
-  /*  159 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(18),
-                B(Star), R(0),
-  /*  173 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(20),
-                B(Star), R(0),
-  /*  187 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(22),
-                B(Star), R(0),
-  /*  201 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(24),
-                B(Star), R(0),
-  /*  215 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(26),
-                B(Star), R(0),
-  /*  229 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(28),
-                B(Star), R(0),
-  /*  243 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(30),
-                B(Star), R(0),
-  /*  257 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(32),
-                B(Star), R(0),
-  /*  271 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(34),
-                B(Star), R(0),
-  /*  285 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(36),
-                B(Star), R(0),
-  /*  299 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(38),
-                B(Star), R(0),
-  /*  313 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(40),
-                B(Star), R(0),
-  /*  327 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(42),
-                B(Star), R(0),
-  /*  341 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(44),
-                B(Star), R(0),
-  /*  355 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(46),
-                B(Star), R(0),
-  /*  369 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(48),
-                B(Star), R(0),
-  /*  383 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(50),
-                B(Star), R(0),
-  /*  397 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(52),
-                B(Star), R(0),
-  /*  411 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(54),
-                B(Star), R(0),
-  /*  425 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(56),
-                B(Star), R(0),
-  /*  439 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(58),
-                B(Star), R(0),
-  /*  453 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(60),
-                B(Star), R(0),
-  /*  467 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(62),
-                B(Star), R(0),
-  /*  481 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(64),
-                B(Star), R(0),
-  /*  495 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(66),
-                B(Star), R(0),
-  /*  509 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(68),
-                B(Star), R(0),
-  /*  523 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(70),
-                B(Star), R(0),
-  /*  537 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(72),
-                B(Star), R(0),
-  /*  551 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(74),
-                B(Star), R(0),
-  /*  565 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(76),
-                B(Star), R(0),
-  /*  579 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(78),
-                B(Star), R(0),
-  /*  593 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(80),
-                B(Star), R(0),
-  /*  607 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(82),
-                B(Star), R(0),
-  /*  621 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(84),
-                B(Star), R(0),
-  /*  635 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(86),
-                B(Star), R(0),
-  /*  649 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(88),
-                B(Star), R(0),
-  /*  663 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(90),
-                B(Star), R(0),
-  /*  677 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(92),
-                B(Star), R(0),
-  /*  691 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(94),
-                B(Star), R(0),
-  /*  705 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(96),
-                B(Star), R(0),
-  /*  719 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(98),
-                B(Star), R(0),
-  /*  733 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(100),
-                B(Star), R(0),
-  /*  747 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(102),
-                B(Star), R(0),
-  /*  761 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(104),
-                B(Star), R(0),
-  /*  775 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(106),
-                B(Star), R(0),
-  /*  789 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(108),
-                B(Star), R(0),
-  /*  803 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(110),
-                B(Star), R(0),
-  /*  817 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(112),
-                B(Star), R(0),
-  /*  831 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(114),
-                B(Star), R(0),
-  /*  845 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(116),
-                B(Star), R(0),
-  /*  859 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(118),
-                B(Star), R(0),
-  /*  873 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(120),
-                B(Star), R(0),
-  /*  887 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(122),
-                B(Star), R(0),
-  /*  901 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(124),
-                B(Star), R(0),
-  /*  915 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(126),
-                B(Star), R(0),
-  /*  929 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(128),
-                B(Star), R(0),
-  /*  943 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(130),
-                B(Star), R(0),
-  /*  957 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(132),
-                B(Star), R(0),
-  /*  971 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(134),
-                B(Star), R(0),
-  /*  985 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(136),
-                B(Star), R(0),
-  /*  999 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(138),
-                B(Star), R(0),
-  /* 1013 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(140),
-                B(Star), R(0),
-  /* 1027 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(142),
-                B(Star), R(0),
-  /* 1041 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(144),
-                B(Star), R(0),
-  /* 1055 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(146),
-                B(Star), R(0),
-  /* 1069 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(148),
-                B(Star), R(0),
-  /* 1083 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(150),
-                B(Star), R(0),
-  /* 1097 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(152),
-                B(Star), R(0),
-  /* 1111 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(154),
-                B(Star), R(0),
-  /* 1125 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(156),
-                B(Star), R(0),
-  /* 1139 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(158),
-                B(Star), R(0),
-  /* 1153 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(160),
-                B(Star), R(0),
-  /* 1167 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(162),
-                B(Star), R(0),
-  /* 1181 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(164),
-                B(Star), R(0),
-  /* 1195 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(166),
-                B(Star), R(0),
-  /* 1209 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(168),
-                B(Star), R(0),
-  /* 1223 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(170),
-                B(Star), R(0),
-  /* 1237 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(172),
-                B(Star), R(0),
-  /* 1251 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(174),
-                B(Star), R(0),
-  /* 1265 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(176),
-                B(Star), R(0),
-  /* 1279 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(178),
-                B(Star), R(0),
-  /* 1293 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(180),
-                B(Star), R(0),
-  /* 1307 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(182),
-                B(Star), R(0),
-  /* 1321 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(184),
-                B(Star), R(0),
-  /* 1335 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(186),
-                B(Star), R(0),
-  /* 1349 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(188),
-                B(Star), R(0),
-  /* 1363 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(190),
-                B(Star), R(0),
-  /* 1377 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(192),
-                B(Star), R(0),
-  /* 1391 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(194),
-                B(Star), R(0),
-  /* 1405 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(196),
-                B(Star), R(0),
-  /* 1419 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(198),
-                B(Star), R(0),
-  /* 1433 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(200),
-                B(Star), R(0),
-  /* 1447 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(202),
-                B(Star), R(0),
-  /* 1461 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(204),
-                B(Star), R(0),
-  /* 1475 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(206),
-                B(Star), R(0),
-  /* 1489 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(208),
-                B(Star), R(0),
-  /* 1503 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(210),
-                B(Star), R(0),
-  /* 1517 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(212),
-                B(Star), R(0),
-  /* 1531 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(214),
-                B(Star), R(0),
-  /* 1545 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(216),
-                B(Star), R(0),
-  /* 1559 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(218),
-                B(Star), R(0),
-  /* 1573 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(220),
-                B(Star), R(0),
-  /* 1587 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(222),
-                B(Star), R(0),
-  /* 1601 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(224),
-                B(Star), R(0),
-  /* 1615 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(226),
-                B(Star), R(0),
-  /* 1629 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(228),
-                B(Star), R(0),
-  /* 1643 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(230),
-                B(Star), R(0),
-  /* 1657 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(232),
-                B(Star), R(0),
-  /* 1671 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(234),
-                B(Star), R(0),
-  /* 1685 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(236),
-                B(Star), R(0),
-  /* 1699 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(238),
-                B(Star), R(0),
-  /* 1713 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(240),
-                B(Star), R(0),
-  /* 1727 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(242),
-                B(Star), R(0),
-  /* 1741 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(244),
-                B(Star), R(0),
-  /* 1755 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(246),
-                B(Star), R(0),
-  /* 1769 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(248),
-                B(Star), R(0),
-  /* 1783 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(250),
-                B(Star), R(0),
-  /* 1797 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(252),
-                B(Star), R(0),
-  /* 1811 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(254),
-                B(Star), R(0),
-  /* 1828 S> */ B(Wide), B(LdaNamedProperty), R16(arg0), U16(0), U16(256),
-  /* 1833 S> */ B(Return),
+  /*   26 S> */ B(CreateEmptyObjectLiteral),
+                B(Star), R(0),
+  /*   34 S> */ B(LdaNamedProperty), R(0), U8(0), U8(0),
+  /*   45 S> */ B(LdaNamedProperty), R(0), U8(1), U8(2),
+  /*   56 S> */ B(LdaNamedProperty), R(0), U8(2), U8(4),
+  /*   67 S> */ B(LdaNamedProperty), R(0), U8(3), U8(6),
+  /*   78 S> */ B(LdaNamedProperty), R(0), U8(4), U8(8),
+  /*   89 S> */ B(LdaNamedProperty), R(0), U8(5), U8(10),
+  /*  100 S> */ B(LdaNamedProperty), R(0), U8(6), U8(12),
+  /*  111 S> */ B(LdaNamedProperty), R(0), U8(7), U8(14),
+  /*  122 S> */ B(LdaNamedProperty), R(0), U8(8), U8(16),
+  /*  133 S> */ B(LdaNamedProperty), R(0), U8(9), U8(18),
+  /*  144 S> */ B(LdaNamedProperty), R(0), U8(10), U8(20),
+  /*  156 S> */ B(LdaNamedProperty), R(0), U8(11), U8(22),
+  /*  168 S> */ B(LdaNamedProperty), R(0), U8(12), U8(24),
+  /*  180 S> */ B(LdaNamedProperty), R(0), U8(13), U8(26),
+  /*  192 S> */ B(LdaNamedProperty), R(0), U8(14), U8(28),
+  /*  204 S> */ B(LdaNamedProperty), R(0), U8(15), U8(30),
+  /*  216 S> */ B(LdaNamedProperty), R(0), U8(16), U8(32),
+  /*  228 S> */ B(LdaNamedProperty), R(0), U8(17), U8(34),
+  /*  240 S> */ B(LdaNamedProperty), R(0), U8(18), U8(36),
+  /*  252 S> */ B(LdaNamedProperty), R(0), U8(19), U8(38),
+  /*  264 S> */ B(LdaNamedProperty), R(0), U8(20), U8(40),
+  /*  276 S> */ B(LdaNamedProperty), R(0), U8(21), U8(42),
+  /*  288 S> */ B(LdaNamedProperty), R(0), U8(22), U8(44),
+  /*  300 S> */ B(LdaNamedProperty), R(0), U8(23), U8(46),
+  /*  312 S> */ B(LdaNamedProperty), R(0), U8(24), U8(48),
+  /*  324 S> */ B(LdaNamedProperty), R(0), U8(25), U8(50),
+  /*  336 S> */ B(LdaNamedProperty), R(0), U8(26), U8(52),
+  /*  348 S> */ B(LdaNamedProperty), R(0), U8(27), U8(54),
+  /*  360 S> */ B(LdaNamedProperty), R(0), U8(28), U8(56),
+  /*  372 S> */ B(LdaNamedProperty), R(0), U8(29), U8(58),
+  /*  384 S> */ B(LdaNamedProperty), R(0), U8(30), U8(60),
+  /*  396 S> */ B(LdaNamedProperty), R(0), U8(31), U8(62),
+  /*  408 S> */ B(LdaNamedProperty), R(0), U8(32), U8(64),
+  /*  420 S> */ B(LdaNamedProperty), R(0), U8(33), U8(66),
+  /*  432 S> */ B(LdaNamedProperty), R(0), U8(34), U8(68),
+  /*  444 S> */ B(LdaNamedProperty), R(0), U8(35), U8(70),
+  /*  456 S> */ B(LdaNamedProperty), R(0), U8(36), U8(72),
+  /*  468 S> */ B(LdaNamedProperty), R(0), U8(37), U8(74),
+  /*  480 S> */ B(LdaNamedProperty), R(0), U8(38), U8(76),
+  /*  492 S> */ B(LdaNamedProperty), R(0), U8(39), U8(78),
+  /*  504 S> */ B(LdaNamedProperty), R(0), U8(40), U8(80),
+  /*  516 S> */ B(LdaNamedProperty), R(0), U8(41), U8(82),
+  /*  528 S> */ B(LdaNamedProperty), R(0), U8(42), U8(84),
+  /*  540 S> */ B(LdaNamedProperty), R(0), U8(43), U8(86),
+  /*  552 S> */ B(LdaNamedProperty), R(0), U8(44), U8(88),
+  /*  564 S> */ B(LdaNamedProperty), R(0), U8(45), U8(90),
+  /*  576 S> */ B(LdaNamedProperty), R(0), U8(46), U8(92),
+  /*  588 S> */ B(LdaNamedProperty), R(0), U8(47), U8(94),
+  /*  600 S> */ B(LdaNamedProperty), R(0), U8(48), U8(96),
+  /*  612 S> */ B(LdaNamedProperty), R(0), U8(49), U8(98),
+  /*  624 S> */ B(LdaNamedProperty), R(0), U8(50), U8(100),
+  /*  636 S> */ B(LdaNamedProperty), R(0), U8(51), U8(102),
+  /*  648 S> */ B(LdaNamedProperty), R(0), U8(52), U8(104),
+  /*  660 S> */ B(LdaNamedProperty), R(0), U8(53), U8(106),
+  /*  672 S> */ B(LdaNamedProperty), R(0), U8(54), U8(108),
+  /*  684 S> */ B(LdaNamedProperty), R(0), U8(55), U8(110),
+  /*  696 S> */ B(LdaNamedProperty), R(0), U8(56), U8(112),
+  /*  708 S> */ B(LdaNamedProperty), R(0), U8(57), U8(114),
+  /*  720 S> */ B(LdaNamedProperty), R(0), U8(58), U8(116),
+  /*  732 S> */ B(LdaNamedProperty), R(0), U8(59), U8(118),
+  /*  744 S> */ B(LdaNamedProperty), R(0), U8(60), U8(120),
+  /*  756 S> */ B(LdaNamedProperty), R(0), U8(61), U8(122),
+  /*  768 S> */ B(LdaNamedProperty), R(0), U8(62), U8(124),
+  /*  780 S> */ B(LdaNamedProperty), R(0), U8(63), U8(126),
+  /*  792 S> */ B(LdaNamedProperty), R(0), U8(64), U8(128),
+  /*  804 S> */ B(LdaNamedProperty), R(0), U8(65), U8(130),
+  /*  816 S> */ B(LdaNamedProperty), R(0), U8(66), U8(132),
+  /*  828 S> */ B(LdaNamedProperty), R(0), U8(67), U8(134),
+  /*  840 S> */ B(LdaNamedProperty), R(0), U8(68), U8(136),
+  /*  852 S> */ B(LdaNamedProperty), R(0), U8(69), U8(138),
+  /*  864 S> */ B(LdaNamedProperty), R(0), U8(70), U8(140),
+  /*  876 S> */ B(LdaNamedProperty), R(0), U8(71), U8(142),
+  /*  888 S> */ B(LdaNamedProperty), R(0), U8(72), U8(144),
+  /*  900 S> */ B(LdaNamedProperty), R(0), U8(73), U8(146),
+  /*  912 S> */ B(LdaNamedProperty), R(0), U8(74), U8(148),
+  /*  924 S> */ B(LdaNamedProperty), R(0), U8(75), U8(150),
+  /*  936 S> */ B(LdaNamedProperty), R(0), U8(76), U8(152),
+  /*  948 S> */ B(LdaNamedProperty), R(0), U8(77), U8(154),
+  /*  960 S> */ B(LdaNamedProperty), R(0), U8(78), U8(156),
+  /*  972 S> */ B(LdaNamedProperty), R(0), U8(79), U8(158),
+  /*  984 S> */ B(LdaNamedProperty), R(0), U8(80), U8(160),
+  /*  996 S> */ B(LdaNamedProperty), R(0), U8(81), U8(162),
+  /* 1008 S> */ B(LdaNamedProperty), R(0), U8(82), U8(164),
+  /* 1020 S> */ B(LdaNamedProperty), R(0), U8(83), U8(166),
+  /* 1032 S> */ B(LdaNamedProperty), R(0), U8(84), U8(168),
+  /* 1044 S> */ B(LdaNamedProperty), R(0), U8(85), U8(170),
+  /* 1056 S> */ B(LdaNamedProperty), R(0), U8(86), U8(172),
+  /* 1068 S> */ B(LdaNamedProperty), R(0), U8(87), U8(174),
+  /* 1080 S> */ B(LdaNamedProperty), R(0), U8(88), U8(176),
+  /* 1092 S> */ B(LdaNamedProperty), R(0), U8(89), U8(178),
+  /* 1104 S> */ B(LdaNamedProperty), R(0), U8(90), U8(180),
+  /* 1116 S> */ B(LdaNamedProperty), R(0), U8(91), U8(182),
+  /* 1128 S> */ B(LdaNamedProperty), R(0), U8(92), U8(184),
+  /* 1140 S> */ B(LdaNamedProperty), R(0), U8(93), U8(186),
+  /* 1152 S> */ B(LdaNamedProperty), R(0), U8(94), U8(188),
+  /* 1164 S> */ B(LdaNamedProperty), R(0), U8(95), U8(190),
+  /* 1176 S> */ B(LdaNamedProperty), R(0), U8(96), U8(192),
+  /* 1188 S> */ B(LdaNamedProperty), R(0), U8(97), U8(194),
+  /* 1200 S> */ B(LdaNamedProperty), R(0), U8(98), U8(196),
+  /* 1212 S> */ B(LdaNamedProperty), R(0), U8(99), U8(198),
+  /* 1224 S> */ B(LdaNamedProperty), R(0), U8(100), U8(200),
+  /* 1237 S> */ B(LdaNamedProperty), R(0), U8(101), U8(202),
+  /* 1250 S> */ B(LdaNamedProperty), R(0), U8(102), U8(204),
+  /* 1263 S> */ B(LdaNamedProperty), R(0), U8(103), U8(206),
+  /* 1276 S> */ B(LdaNamedProperty), R(0), U8(104), U8(208),
+  /* 1289 S> */ B(LdaNamedProperty), R(0), U8(105), U8(210),
+  /* 1302 S> */ B(LdaNamedProperty), R(0), U8(106), U8(212),
+  /* 1315 S> */ B(LdaNamedProperty), R(0), U8(107), U8(214),
+  /* 1328 S> */ B(LdaNamedProperty), R(0), U8(108), U8(216),
+  /* 1341 S> */ B(LdaNamedProperty), R(0), U8(109), U8(218),
+  /* 1354 S> */ B(LdaNamedProperty), R(0), U8(110), U8(220),
+  /* 1367 S> */ B(LdaNamedProperty), R(0), U8(111), U8(222),
+  /* 1380 S> */ B(LdaNamedProperty), R(0), U8(112), U8(224),
+  /* 1393 S> */ B(LdaNamedProperty), R(0), U8(113), U8(226),
+  /* 1406 S> */ B(LdaNamedProperty), R(0), U8(114), U8(228),
+  /* 1419 S> */ B(LdaNamedProperty), R(0), U8(115), U8(230),
+  /* 1432 S> */ B(LdaNamedProperty), R(0), U8(116), U8(232),
+  /* 1445 S> */ B(LdaNamedProperty), R(0), U8(117), U8(234),
+  /* 1458 S> */ B(LdaNamedProperty), R(0), U8(118), U8(236),
+  /* 1471 S> */ B(LdaNamedProperty), R(0), U8(119), U8(238),
+  /* 1484 S> */ B(LdaNamedProperty), R(0), U8(120), U8(240),
+  /* 1497 S> */ B(LdaNamedProperty), R(0), U8(121), U8(242),
+  /* 1510 S> */ B(LdaNamedProperty), R(0), U8(122), U8(244),
+  /* 1523 S> */ B(LdaNamedProperty), R(0), U8(123), U8(246),
+  /* 1536 S> */ B(LdaNamedProperty), R(0), U8(124), U8(248),
+  /* 1549 S> */ B(LdaNamedProperty), R(0), U8(125), U8(250),
+  /* 1562 S> */ B(LdaNamedProperty), R(0), U8(126), U8(252),
+  /* 1575 S> */ B(LdaNamedProperty), R(0), U8(127), U8(254),
+  /* 1595 S> */ B(Wide), B(LdaNamedProperty), R16(arg0), U16(128), U16(256),
+  /* 1600 S> */ B(Return),
 ]
 constant pool: [
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name0"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name1"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name2"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name3"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name4"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name5"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name6"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name7"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name8"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name9"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name10"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name11"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name12"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name13"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name14"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name15"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name16"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name17"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name18"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name19"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name20"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name21"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name22"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name23"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name24"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name25"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name26"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name27"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name28"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name29"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name30"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name31"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name32"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name33"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name34"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name35"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name36"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name37"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name38"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name39"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name40"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name41"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name42"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name43"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name44"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name45"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name46"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name47"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name48"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name49"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name50"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name51"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name52"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name53"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name54"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name55"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name56"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name57"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name58"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name59"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name60"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name61"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name62"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name63"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name64"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name65"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name66"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name67"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name68"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name69"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name70"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name71"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name72"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name73"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name74"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name75"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name76"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name77"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name78"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name79"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name80"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name81"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name82"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name83"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name84"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name85"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name86"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name87"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name88"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name89"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name90"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name91"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name92"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name93"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name94"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name95"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name96"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name97"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name98"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name99"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name100"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name101"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name102"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name103"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name104"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name105"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name106"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name107"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name108"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name109"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name110"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name111"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name112"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name113"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name114"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name115"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name116"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name117"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name118"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name119"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name120"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name121"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name122"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name123"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name124"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name125"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name126"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name127"],
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["name"],
 ]
 handlers: [
diff --git a/deps/v8/test/cctest/interpreter/bytecode_expectations/PropertyStores.golden b/deps/v8/test/cctest/interpreter/bytecode_expectations/PropertyStores.golden
index 41f2290805d183..2bb062b707b1c4 100644
--- a/deps/v8/test/cctest/interpreter/bytecode_expectations/PropertyStores.golden
+++ b/deps/v8/test/cctest/interpreter/bytecode_expectations/PropertyStores.golden
@@ -163,405 +163,411 @@ handlers: [
 snippet: "
   function f(a) {
     a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
+    var b = {};
+    b.name128;
+    b.name129;
+    b.name130;
+    b.name131;
+    b.name132;
+    b.name133;
+    b.name134;
+    b.name135;
+    b.name136;
+    b.name137;
+    b.name138;
+    b.name139;
+    b.name140;
+    b.name141;
+    b.name142;
+    b.name143;
+    b.name144;
+    b.name145;
+    b.name146;
+    b.name147;
+    b.name148;
+    b.name149;
+    b.name150;
+    b.name151;
+    b.name152;
+    b.name153;
+    b.name154;
+    b.name155;
+    b.name156;
+    b.name157;
+    b.name158;
+    b.name159;
+    b.name160;
+    b.name161;
+    b.name162;
+    b.name163;
+    b.name164;
+    b.name165;
+    b.name166;
+    b.name167;
+    b.name168;
+    b.name169;
+    b.name170;
+    b.name171;
+    b.name172;
+    b.name173;
+    b.name174;
+    b.name175;
+    b.name176;
+    b.name177;
+    b.name178;
+    b.name179;
+    b.name180;
+    b.name181;
+    b.name182;
+    b.name183;
+    b.name184;
+    b.name185;
+    b.name186;
+    b.name187;
+    b.name188;
+    b.name189;
+    b.name190;
+    b.name191;
+    b.name192;
+    b.name193;
+    b.name194;
+    b.name195;
+    b.name196;
+    b.name197;
+    b.name198;
+    b.name199;
+    b.name200;
+    b.name201;
+    b.name202;
+    b.name203;
+    b.name204;
+    b.name205;
+    b.name206;
+    b.name207;
+    b.name208;
+    b.name209;
+    b.name210;
+    b.name211;
+    b.name212;
+    b.name213;
+    b.name214;
+    b.name215;
+    b.name216;
+    b.name217;
+    b.name218;
+    b.name219;
+    b.name220;
+    b.name221;
+    b.name222;
+    b.name223;
+    b.name224;
+    b.name225;
+    b.name226;
+    b.name227;
+    b.name228;
+    b.name229;
+    b.name230;
+    b.name231;
+    b.name232;
+    b.name233;
+    b.name234;
+    b.name235;
+    b.name236;
+    b.name237;
+    b.name238;
+    b.name239;
+    b.name240;
+    b.name241;
+    b.name242;
+    b.name243;
+    b.name244;
+    b.name245;
+    b.name246;
+    b.name247;
+    b.name248;
+    b.name249;
+    b.name250;
+    b.name251;
+    b.name252;
+    b.name253;
+    b.name254;
+    b.name255;
     a.name = 2;
   }
   f({name : \"test\"})
 "
-frame size: 0
+frame size: 1
 parameter count: 2
-bytecode array length: 781
+bytecode array length: 534
 bytecodes: [
   /*   10 E> */ B(StackCheck),
   /*   18 S> */ B(LdaSmi), I8(1),
   /*   25 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(0),
-  /*   32 S> */ B(LdaSmi), I8(1),
-  /*   39 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(2),
-  /*   46 S> */ B(LdaSmi), I8(1),
-  /*   53 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(4),
-  /*   60 S> */ B(LdaSmi), I8(1),
-  /*   67 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(6),
-  /*   74 S> */ B(LdaSmi), I8(1),
-  /*   81 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(8),
-  /*   88 S> */ B(LdaSmi), I8(1),
-  /*   95 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(10),
-  /*  102 S> */ B(LdaSmi), I8(1),
-  /*  109 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(12),
-  /*  116 S> */ B(LdaSmi), I8(1),
-  /*  123 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(14),
-  /*  130 S> */ B(LdaSmi), I8(1),
-  /*  137 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(16),
-  /*  144 S> */ B(LdaSmi), I8(1),
-  /*  151 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(18),
-  /*  158 S> */ B(LdaSmi), I8(1),
-  /*  165 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(20),
-  /*  172 S> */ B(LdaSmi), I8(1),
-  /*  179 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(22),
-  /*  186 S> */ B(LdaSmi), I8(1),
-  /*  193 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(24),
-  /*  200 S> */ B(LdaSmi), I8(1),
-  /*  207 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(26),
-  /*  214 S> */ B(LdaSmi), I8(1),
-  /*  221 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(28),
-  /*  228 S> */ B(LdaSmi), I8(1),
-  /*  235 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(30),
-  /*  242 S> */ B(LdaSmi), I8(1),
-  /*  249 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(32),
-  /*  256 S> */ B(LdaSmi), I8(1),
-  /*  263 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(34),
-  /*  270 S> */ B(LdaSmi), I8(1),
-  /*  277 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(36),
-  /*  284 S> */ B(LdaSmi), I8(1),
-  /*  291 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(38),
-  /*  298 S> */ B(LdaSmi), I8(1),
-  /*  305 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(40),
-  /*  312 S> */ B(LdaSmi), I8(1),
-  /*  319 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(42),
-  /*  326 S> */ B(LdaSmi), I8(1),
-  /*  333 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(44),
-  /*  340 S> */ B(LdaSmi), I8(1),
-  /*  347 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(46),
-  /*  354 S> */ B(LdaSmi), I8(1),
-  /*  361 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(48),
-  /*  368 S> */ B(LdaSmi), I8(1),
-  /*  375 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(50),
-  /*  382 S> */ B(LdaSmi), I8(1),
-  /*  389 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(52),
-  /*  396 S> */ B(LdaSmi), I8(1),
-  /*  403 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(54),
-  /*  410 S> */ B(LdaSmi), I8(1),
-  /*  417 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(56),
-  /*  424 S> */ B(LdaSmi), I8(1),
-  /*  431 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(58),
-  /*  438 S> */ B(LdaSmi), I8(1),
-  /*  445 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(60),
-  /*  452 S> */ B(LdaSmi), I8(1),
-  /*  459 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(62),
-  /*  466 S> */ B(LdaSmi), I8(1),
-  /*  473 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(64),
-  /*  480 S> */ B(LdaSmi), I8(1),
-  /*  487 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(66),
-  /*  494 S> */ B(LdaSmi), I8(1),
-  /*  501 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(68),
-  /*  508 S> */ B(LdaSmi), I8(1),
-  /*  515 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(70),
-  /*  522 S> */ B(LdaSmi), I8(1),
-  /*  529 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(72),
-  /*  536 S> */ B(LdaSmi), I8(1),
-  /*  543 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(74),
-  /*  550 S> */ B(LdaSmi), I8(1),
-  /*  557 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(76),
-  /*  564 S> */ B(LdaSmi), I8(1),
-  /*  571 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(78),
-  /*  578 S> */ B(LdaSmi), I8(1),
-  /*  585 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(80),
-  /*  592 S> */ B(LdaSmi), I8(1),
-  /*  599 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(82),
-  /*  606 S> */ B(LdaSmi), I8(1),
-  /*  613 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(84),
-  /*  620 S> */ B(LdaSmi), I8(1),
-  /*  627 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(86),
-  /*  634 S> */ B(LdaSmi), I8(1),
-  /*  641 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(88),
-  /*  648 S> */ B(LdaSmi), I8(1),
-  /*  655 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(90),
-  /*  662 S> */ B(LdaSmi), I8(1),
-  /*  669 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(92),
-  /*  676 S> */ B(LdaSmi), I8(1),
-  /*  683 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(94),
-  /*  690 S> */ B(LdaSmi), I8(1),
-  /*  697 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(96),
-  /*  704 S> */ B(LdaSmi), I8(1),
-  /*  711 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(98),
-  /*  718 S> */ B(LdaSmi), I8(1),
-  /*  725 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(100),
-  /*  732 S> */ B(LdaSmi), I8(1),
-  /*  739 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(102),
-  /*  746 S> */ B(LdaSmi), I8(1),
-  /*  753 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(104),
-  /*  760 S> */ B(LdaSmi), I8(1),
-  /*  767 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(106),
-  /*  774 S> */ B(LdaSmi), I8(1),
-  /*  781 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(108),
-  /*  788 S> */ B(LdaSmi), I8(1),
-  /*  795 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(110),
-  /*  802 S> */ B(LdaSmi), I8(1),
-  /*  809 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(112),
-  /*  816 S> */ B(LdaSmi), I8(1),
-  /*  823 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(114),
-  /*  830 S> */ B(LdaSmi), I8(1),
-  /*  837 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(116),
-  /*  844 S> */ B(LdaSmi), I8(1),
-  /*  851 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(118),
-  /*  858 S> */ B(LdaSmi), I8(1),
-  /*  865 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(120),
-  /*  872 S> */ B(LdaSmi), I8(1),
-  /*  879 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(122),
-  /*  886 S> */ B(LdaSmi), I8(1),
-  /*  893 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(124),
-  /*  900 S> */ B(LdaSmi), I8(1),
-  /*  907 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(126),
-  /*  914 S> */ B(LdaSmi), I8(1),
-  /*  921 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(128),
-  /*  928 S> */ B(LdaSmi), I8(1),
-  /*  935 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(130),
-  /*  942 S> */ B(LdaSmi), I8(1),
-  /*  949 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(132),
-  /*  956 S> */ B(LdaSmi), I8(1),
-  /*  963 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(134),
-  /*  970 S> */ B(LdaSmi), I8(1),
-  /*  977 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(136),
-  /*  984 S> */ B(LdaSmi), I8(1),
-  /*  991 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(138),
-  /*  998 S> */ B(LdaSmi), I8(1),
-  /* 1005 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(140),
-  /* 1012 S> */ B(LdaSmi), I8(1),
-  /* 1019 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(142),
-  /* 1026 S> */ B(LdaSmi), I8(1),
-  /* 1033 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(144),
-  /* 1040 S> */ B(LdaSmi), I8(1),
-  /* 1047 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(146),
-  /* 1054 S> */ B(LdaSmi), I8(1),
-  /* 1061 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(148),
-  /* 1068 S> */ B(LdaSmi), I8(1),
-  /* 1075 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(150),
-  /* 1082 S> */ B(LdaSmi), I8(1),
-  /* 1089 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(152),
-  /* 1096 S> */ B(LdaSmi), I8(1),
-  /* 1103 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(154),
-  /* 1110 S> */ B(LdaSmi), I8(1),
-  /* 1117 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(156),
-  /* 1124 S> */ B(LdaSmi), I8(1),
-  /* 1131 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(158),
-  /* 1138 S> */ B(LdaSmi), I8(1),
-  /* 1145 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(160),
-  /* 1152 S> */ B(LdaSmi), I8(1),
-  /* 1159 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(162),
-  /* 1166 S> */ B(LdaSmi), I8(1),
-  /* 1173 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(164),
-  /* 1180 S> */ B(LdaSmi), I8(1),
-  /* 1187 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(166),
-  /* 1194 S> */ B(LdaSmi), I8(1),
-  /* 1201 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(168),
-  /* 1208 S> */ B(LdaSmi), I8(1),
-  /* 1215 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(170),
-  /* 1222 S> */ B(LdaSmi), I8(1),
-  /* 1229 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(172),
-  /* 1236 S> */ B(LdaSmi), I8(1),
-  /* 1243 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(174),
-  /* 1250 S> */ B(LdaSmi), I8(1),
-  /* 1257 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(176),
-  /* 1264 S> */ B(LdaSmi), I8(1),
-  /* 1271 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(178),
-  /* 1278 S> */ B(LdaSmi), I8(1),
-  /* 1285 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(180),
-  /* 1292 S> */ B(LdaSmi), I8(1),
-  /* 1299 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(182),
-  /* 1306 S> */ B(LdaSmi), I8(1),
-  /* 1313 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(184),
-  /* 1320 S> */ B(LdaSmi), I8(1),
-  /* 1327 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(186),
-  /* 1334 S> */ B(LdaSmi), I8(1),
-  /* 1341 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(188),
-  /* 1348 S> */ B(LdaSmi), I8(1),
-  /* 1355 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(190),
-  /* 1362 S> */ B(LdaSmi), I8(1),
-  /* 1369 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(192),
-  /* 1376 S> */ B(LdaSmi), I8(1),
-  /* 1383 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(194),
-  /* 1390 S> */ B(LdaSmi), I8(1),
-  /* 1397 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(196),
-  /* 1404 S> */ B(LdaSmi), I8(1),
-  /* 1411 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(198),
-  /* 1418 S> */ B(LdaSmi), I8(1),
-  /* 1425 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(200),
-  /* 1432 S> */ B(LdaSmi), I8(1),
-  /* 1439 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(202),
-  /* 1446 S> */ B(LdaSmi), I8(1),
-  /* 1453 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(204),
-  /* 1460 S> */ B(LdaSmi), I8(1),
-  /* 1467 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(206),
-  /* 1474 S> */ B(LdaSmi), I8(1),
-  /* 1481 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(208),
-  /* 1488 S> */ B(LdaSmi), I8(1),
-  /* 1495 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(210),
-  /* 1502 S> */ B(LdaSmi), I8(1),
-  /* 1509 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(212),
-  /* 1516 S> */ B(LdaSmi), I8(1),
-  /* 1523 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(214),
-  /* 1530 S> */ B(LdaSmi), I8(1),
-  /* 1537 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(216),
-  /* 1544 S> */ B(LdaSmi), I8(1),
-  /* 1551 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(218),
-  /* 1558 S> */ B(LdaSmi), I8(1),
-  /* 1565 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(220),
-  /* 1572 S> */ B(LdaSmi), I8(1),
-  /* 1579 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(222),
-  /* 1586 S> */ B(LdaSmi), I8(1),
-  /* 1593 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(224),
-  /* 1600 S> */ B(LdaSmi), I8(1),
-  /* 1607 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(226),
-  /* 1614 S> */ B(LdaSmi), I8(1),
-  /* 1621 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(228),
-  /* 1628 S> */ B(LdaSmi), I8(1),
-  /* 1635 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(230),
-  /* 1642 S> */ B(LdaSmi), I8(1),
-  /* 1649 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(232),
-  /* 1656 S> */ B(LdaSmi), I8(1),
-  /* 1663 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(234),
-  /* 1670 S> */ B(LdaSmi), I8(1),
-  /* 1677 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(236),
-  /* 1684 S> */ B(LdaSmi), I8(1),
-  /* 1691 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(238),
-  /* 1698 S> */ B(LdaSmi), I8(1),
-  /* 1705 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(240),
-  /* 1712 S> */ B(LdaSmi), I8(1),
-  /* 1719 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(242),
-  /* 1726 S> */ B(LdaSmi), I8(1),
-  /* 1733 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(244),
-  /* 1740 S> */ B(LdaSmi), I8(1),
-  /* 1747 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(246),
-  /* 1754 S> */ B(LdaSmi), I8(1),
-  /* 1761 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(248),
-  /* 1768 S> */ B(LdaSmi), I8(1),
-  /* 1775 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(250),
-  /* 1782 S> */ B(LdaSmi), I8(1),
-  /* 1789 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(252),
-  /* 1796 S> */ B(LdaSmi), I8(1),
-  /* 1803 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(254),
-  /* 1810 S> */ B(LdaSmi), I8(2),
-  /* 1817 E> */ B(Wide), B(StaNamedProperty), R16(arg0), U16(0), U16(256),
+  /*   40 S> */ B(CreateEmptyObjectLiteral),
+                B(Star), R(0),
+  /*   48 S> */ B(LdaNamedProperty), R(0), U8(1), U8(2),
+  /*   61 S> */ B(LdaNamedProperty), R(0), U8(2), U8(4),
+  /*   74 S> */ B(LdaNamedProperty), R(0), U8(3), U8(6),
+  /*   87 S> */ B(LdaNamedProperty), R(0), U8(4), U8(8),
+  /*  100 S> */ B(LdaNamedProperty), R(0), U8(5), U8(10),
+  /*  113 S> */ B(LdaNamedProperty), R(0), U8(6), U8(12),
+  /*  126 S> */ B(LdaNamedProperty), R(0), U8(7), U8(14),
+  /*  139 S> */ B(LdaNamedProperty), R(0), U8(8), U8(16),
+  /*  152 S> */ B(LdaNamedProperty), R(0), U8(9), U8(18),
+  /*  165 S> */ B(LdaNamedProperty), R(0), U8(10), U8(20),
+  /*  178 S> */ B(LdaNamedProperty), R(0), U8(11), U8(22),
+  /*  191 S> */ B(LdaNamedProperty), R(0), U8(12), U8(24),
+  /*  204 S> */ B(LdaNamedProperty), R(0), U8(13), U8(26),
+  /*  217 S> */ B(LdaNamedProperty), R(0), U8(14), U8(28),
+  /*  230 S> */ B(LdaNamedProperty), R(0), U8(15), U8(30),
+  /*  243 S> */ B(LdaNamedProperty), R(0), U8(16), U8(32),
+  /*  256 S> */ B(LdaNamedProperty), R(0), U8(17), U8(34),
+  /*  269 S> */ B(LdaNamedProperty), R(0), U8(18), U8(36),
+  /*  282 S> */ B(LdaNamedProperty), R(0), U8(19), U8(38),
+  /*  295 S> */ B(LdaNamedProperty), R(0), U8(20), U8(40),
+  /*  308 S> */ B(LdaNamedProperty), R(0), U8(21), U8(42),
+  /*  321 S> */ B(LdaNamedProperty), R(0), U8(22), U8(44),
+  /*  334 S> */ B(LdaNamedProperty), R(0), U8(23), U8(46),
+  /*  347 S> */ B(LdaNamedProperty), R(0), U8(24), U8(48),
+  /*  360 S> */ B(LdaNamedProperty), R(0), U8(25), U8(50),
+  /*  373 S> */ B(LdaNamedProperty), R(0), U8(26), U8(52),
+  /*  386 S> */ B(LdaNamedProperty), R(0), U8(27), U8(54),
+  /*  399 S> */ B(LdaNamedProperty), R(0), U8(28), U8(56),
+  /*  412 S> */ B(LdaNamedProperty), R(0), U8(29), U8(58),
+  /*  425 S> */ B(LdaNamedProperty), R(0), U8(30), U8(60),
+  /*  438 S> */ B(LdaNamedProperty), R(0), U8(31), U8(62),
+  /*  451 S> */ B(LdaNamedProperty), R(0), U8(32), U8(64),
+  /*  464 S> */ B(LdaNamedProperty), R(0), U8(33), U8(66),
+  /*  477 S> */ B(LdaNamedProperty), R(0), U8(34), U8(68),
+  /*  490 S> */ B(LdaNamedProperty), R(0), U8(35), U8(70),
+  /*  503 S> */ B(LdaNamedProperty), R(0), U8(36), U8(72),
+  /*  516 S> */ B(LdaNamedProperty), R(0), U8(37), U8(74),
+  /*  529 S> */ B(LdaNamedProperty), R(0), U8(38), U8(76),
+  /*  542 S> */ B(LdaNamedProperty), R(0), U8(39), U8(78),
+  /*  555 S> */ B(LdaNamedProperty), R(0), U8(40), U8(80),
+  /*  568 S> */ B(LdaNamedProperty), R(0), U8(41), U8(82),
+  /*  581 S> */ B(LdaNamedProperty), R(0), U8(42), U8(84),
+  /*  594 S> */ B(LdaNamedProperty), R(0), U8(43), U8(86),
+  /*  607 S> */ B(LdaNamedProperty), R(0), U8(44), U8(88),
+  /*  620 S> */ B(LdaNamedProperty), R(0), U8(45), U8(90),
+  /*  633 S> */ B(LdaNamedProperty), R(0), U8(46), U8(92),
+  /*  646 S> */ B(LdaNamedProperty), R(0), U8(47), U8(94),
+  /*  659 S> */ B(LdaNamedProperty), R(0), U8(48), U8(96),
+  /*  672 S> */ B(LdaNamedProperty), R(0), U8(49), U8(98),
+  /*  685 S> */ B(LdaNamedProperty), R(0), U8(50), U8(100),
+  /*  698 S> */ B(LdaNamedProperty), R(0), U8(51), U8(102),
+  /*  711 S> */ B(LdaNamedProperty), R(0), U8(52), U8(104),
+  /*  724 S> */ B(LdaNamedProperty), R(0), U8(53), U8(106),
+  /*  737 S> */ B(LdaNamedProperty), R(0), U8(54), U8(108),
+  /*  750 S> */ B(LdaNamedProperty), R(0), U8(55), U8(110),
+  /*  763 S> */ B(LdaNamedProperty), R(0), U8(56), U8(112),
+  /*  776 S> */ B(LdaNamedProperty), R(0), U8(57), U8(114),
+  /*  789 S> */ B(LdaNamedProperty), R(0), U8(58), U8(116),
+  /*  802 S> */ B(LdaNamedProperty), R(0), U8(59), U8(118),
+  /*  815 S> */ B(LdaNamedProperty), R(0), U8(60), U8(120),
+  /*  828 S> */ B(LdaNamedProperty), R(0), U8(61), U8(122),
+  /*  841 S> */ B(LdaNamedProperty), R(0), U8(62), U8(124),
+  /*  854 S> */ B(LdaNamedProperty), R(0), U8(63), U8(126),
+  /*  867 S> */ B(LdaNamedProperty), R(0), U8(64), U8(128),
+  /*  880 S> */ B(LdaNamedProperty), R(0), U8(65), U8(130),
+  /*  893 S> */ B(LdaNamedProperty), R(0), U8(66), U8(132),
+  /*  906 S> */ B(LdaNamedProperty), R(0), U8(67), U8(134),
+  /*  919 S> */ B(LdaNamedProperty), R(0), U8(68), U8(136),
+  /*  932 S> */ B(LdaNamedProperty), R(0), U8(69), U8(138),
+  /*  945 S> */ B(LdaNamedProperty), R(0), U8(70), U8(140),
+  /*  958 S> */ B(LdaNamedProperty), R(0), U8(71), U8(142),
+  /*  971 S> */ B(LdaNamedProperty), R(0), U8(72), U8(144),
+  /*  984 S> */ B(LdaNamedProperty), R(0), U8(73), U8(146),
+  /*  997 S> */ B(LdaNamedProperty), R(0), U8(74), U8(148),
+  /* 1010 S> */ B(LdaNamedProperty), R(0), U8(75), U8(150),
+  /* 1023 S> */ B(LdaNamedProperty), R(0), U8(76), U8(152),
+  /* 1036 S> */ B(LdaNamedProperty), R(0), U8(77), U8(154),
+  /* 1049 S> */ B(LdaNamedProperty), R(0), U8(78), U8(156),
+  /* 1062 S> */ B(LdaNamedProperty), R(0), U8(79), U8(158),
+  /* 1075 S> */ B(LdaNamedProperty), R(0), U8(80), U8(160),
+  /* 1088 S> */ B(LdaNamedProperty), R(0), U8(81), U8(162),
+  /* 1101 S> */ B(LdaNamedProperty), R(0), U8(82), U8(164),
+  /* 1114 S> */ B(LdaNamedProperty), R(0), U8(83), U8(166),
+  /* 1127 S> */ B(LdaNamedProperty), R(0), U8(84), U8(168),
+  /* 1140 S> */ B(LdaNamedProperty), R(0), U8(85), U8(170),
+  /* 1153 S> */ B(LdaNamedProperty), R(0), U8(86), U8(172),
+  /* 1166 S> */ B(LdaNamedProperty), R(0), U8(87), U8(174),
+  /* 1179 S> */ B(LdaNamedProperty), R(0), U8(88), U8(176),
+  /* 1192 S> */ B(LdaNamedProperty), R(0), U8(89), U8(178),
+  /* 1205 S> */ B(LdaNamedProperty), R(0), U8(90), U8(180),
+  /* 1218 S> */ B(LdaNamedProperty), R(0), U8(91), U8(182),
+  /* 1231 S> */ B(LdaNamedProperty), R(0), U8(92), U8(184),
+  /* 1244 S> */ B(LdaNamedProperty), R(0), U8(93), U8(186),
+  /* 1257 S> */ B(LdaNamedProperty), R(0), U8(94), U8(188),
+  /* 1270 S> */ B(LdaNamedProperty), R(0), U8(95), U8(190),
+  /* 1283 S> */ B(LdaNamedProperty), R(0), U8(96), U8(192),
+  /* 1296 S> */ B(LdaNamedProperty), R(0), U8(97), U8(194),
+  /* 1309 S> */ B(LdaNamedProperty), R(0), U8(98), U8(196),
+  /* 1322 S> */ B(LdaNamedProperty), R(0), U8(99), U8(198),
+  /* 1335 S> */ B(LdaNamedProperty), R(0), U8(100), U8(200),
+  /* 1348 S> */ B(LdaNamedProperty), R(0), U8(101), U8(202),
+  /* 1361 S> */ B(LdaNamedProperty), R(0), U8(102), U8(204),
+  /* 1374 S> */ B(LdaNamedProperty), R(0), U8(103), U8(206),
+  /* 1387 S> */ B(LdaNamedProperty), R(0), U8(104), U8(208),
+  /* 1400 S> */ B(LdaNamedProperty), R(0), U8(105), U8(210),
+  /* 1413 S> */ B(LdaNamedProperty), R(0), U8(106), U8(212),
+  /* 1426 S> */ B(LdaNamedProperty), R(0), U8(107), U8(214),
+  /* 1439 S> */ B(LdaNamedProperty), R(0), U8(108), U8(216),
+  /* 1452 S> */ B(LdaNamedProperty), R(0), U8(109), U8(218),
+  /* 1465 S> */ B(LdaNamedProperty), R(0), U8(110), U8(220),
+  /* 1478 S> */ B(LdaNamedProperty), R(0), U8(111), U8(222),
+  /* 1491 S> */ B(LdaNamedProperty), R(0), U8(112), U8(224),
+  /* 1504 S> */ B(LdaNamedProperty), R(0), U8(113), U8(226),
+  /* 1517 S> */ B(LdaNamedProperty), R(0), U8(114), U8(228),
+  /* 1530 S> */ B(LdaNamedProperty), R(0), U8(115), U8(230),
+  /* 1543 S> */ B(LdaNamedProperty), R(0), U8(116), U8(232),
+  /* 1556 S> */ B(LdaNamedProperty), R(0), U8(117), U8(234),
+  /* 1569 S> */ B(LdaNamedProperty), R(0), U8(118), U8(236),
+  /* 1582 S> */ B(LdaNamedProperty), R(0), U8(119), U8(238),
+  /* 1595 S> */ B(LdaNamedProperty), R(0), U8(120), U8(240),
+  /* 1608 S> */ B(LdaNamedProperty), R(0), U8(121), U8(242),
+  /* 1621 S> */ B(LdaNamedProperty), R(0), U8(122), U8(244),
+  /* 1634 S> */ B(LdaNamedProperty), R(0), U8(123), U8(246),
+  /* 1647 S> */ B(LdaNamedProperty), R(0), U8(124), U8(248),
+  /* 1660 S> */ B(LdaNamedProperty), R(0), U8(125), U8(250),
+  /* 1673 S> */ B(LdaNamedProperty), R(0), U8(126), U8(252),
+  /* 1686 S> */ B(LdaNamedProperty), R(0), U8(127), U8(254),
+  /* 1699 S> */ B(Wide), B(LdaNamedProperty), R16(0), U16(128), U16(256),
+  /* 1710 S> */ B(LdaSmi), I8(2),
+  /* 1717 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(0),
                 B(LdaUndefined),
-  /* 1822 S> */ B(Return),
+  /* 1722 S> */ B(Return),
 ]
 constant pool: [
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["name"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name128"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name129"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name130"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name131"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name132"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name133"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name134"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name135"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name136"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name137"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name138"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name139"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name140"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name141"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name142"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name143"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name144"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name145"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name146"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name147"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name148"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name149"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name150"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name151"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name152"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name153"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name154"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name155"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name156"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name157"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name158"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name159"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name160"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name161"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name162"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name163"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name164"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name165"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name166"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name167"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name168"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name169"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name170"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name171"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name172"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name173"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name174"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name175"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name176"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name177"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name178"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name179"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name180"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name181"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name182"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name183"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name184"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name185"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name186"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name187"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name188"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name189"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name190"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name191"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name192"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name193"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name194"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name195"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name196"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name197"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name198"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name199"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name200"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name201"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name202"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name203"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name204"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name205"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name206"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name207"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name208"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name209"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name210"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name211"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name212"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name213"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name214"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name215"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name216"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name217"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name218"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name219"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name220"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name221"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name222"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name223"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name224"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name225"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name226"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name227"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name228"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name229"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name230"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name231"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name232"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name233"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name234"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name235"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name236"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name237"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name238"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name239"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name240"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name241"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name242"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name243"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name244"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name245"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name246"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name247"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name248"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name249"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name250"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name251"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name252"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name253"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name254"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name255"],
 ]
 handlers: [
 ]
@@ -571,405 +577,411 @@ snippet: "
   function f(a) {
    'use strict';
     a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
-    a.name = 1;
+    var b = {};
+    b.name256;
+    b.name257;
+    b.name258;
+    b.name259;
+    b.name260;
+    b.name261;
+    b.name262;
+    b.name263;
+    b.name264;
+    b.name265;
+    b.name266;
+    b.name267;
+    b.name268;
+    b.name269;
+    b.name270;
+    b.name271;
+    b.name272;
+    b.name273;
+    b.name274;
+    b.name275;
+    b.name276;
+    b.name277;
+    b.name278;
+    b.name279;
+    b.name280;
+    b.name281;
+    b.name282;
+    b.name283;
+    b.name284;
+    b.name285;
+    b.name286;
+    b.name287;
+    b.name288;
+    b.name289;
+    b.name290;
+    b.name291;
+    b.name292;
+    b.name293;
+    b.name294;
+    b.name295;
+    b.name296;
+    b.name297;
+    b.name298;
+    b.name299;
+    b.name300;
+    b.name301;
+    b.name302;
+    b.name303;
+    b.name304;
+    b.name305;
+    b.name306;
+    b.name307;
+    b.name308;
+    b.name309;
+    b.name310;
+    b.name311;
+    b.name312;
+    b.name313;
+    b.name314;
+    b.name315;
+    b.name316;
+    b.name317;
+    b.name318;
+    b.name319;
+    b.name320;
+    b.name321;
+    b.name322;
+    b.name323;
+    b.name324;
+    b.name325;
+    b.name326;
+    b.name327;
+    b.name328;
+    b.name329;
+    b.name330;
+    b.name331;
+    b.name332;
+    b.name333;
+    b.name334;
+    b.name335;
+    b.name336;
+    b.name337;
+    b.name338;
+    b.name339;
+    b.name340;
+    b.name341;
+    b.name342;
+    b.name343;
+    b.name344;
+    b.name345;
+    b.name346;
+    b.name347;
+    b.name348;
+    b.name349;
+    b.name350;
+    b.name351;
+    b.name352;
+    b.name353;
+    b.name354;
+    b.name355;
+    b.name356;
+    b.name357;
+    b.name358;
+    b.name359;
+    b.name360;
+    b.name361;
+    b.name362;
+    b.name363;
+    b.name364;
+    b.name365;
+    b.name366;
+    b.name367;
+    b.name368;
+    b.name369;
+    b.name370;
+    b.name371;
+    b.name372;
+    b.name373;
+    b.name374;
+    b.name375;
+    b.name376;
+    b.name377;
+    b.name378;
+    b.name379;
+    b.name380;
+    b.name381;
+    b.name382;
+    b.name383;
     a.name = 2;
   }
   f({name : \"test\"})
 "
-frame size: 0
+frame size: 1
 parameter count: 2
-bytecode array length: 781
+bytecode array length: 534
 bytecodes: [
   /*   10 E> */ B(StackCheck),
   /*   33 S> */ B(LdaSmi), I8(1),
   /*   40 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(0),
-  /*   47 S> */ B(LdaSmi), I8(1),
-  /*   54 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(2),
-  /*   61 S> */ B(LdaSmi), I8(1),
-  /*   68 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(4),
-  /*   75 S> */ B(LdaSmi), I8(1),
-  /*   82 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(6),
-  /*   89 S> */ B(LdaSmi), I8(1),
-  /*   96 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(8),
-  /*  103 S> */ B(LdaSmi), I8(1),
-  /*  110 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(10),
-  /*  117 S> */ B(LdaSmi), I8(1),
-  /*  124 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(12),
-  /*  131 S> */ B(LdaSmi), I8(1),
-  /*  138 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(14),
-  /*  145 S> */ B(LdaSmi), I8(1),
-  /*  152 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(16),
-  /*  159 S> */ B(LdaSmi), I8(1),
-  /*  166 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(18),
-  /*  173 S> */ B(LdaSmi), I8(1),
-  /*  180 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(20),
-  /*  187 S> */ B(LdaSmi), I8(1),
-  /*  194 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(22),
-  /*  201 S> */ B(LdaSmi), I8(1),
-  /*  208 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(24),
-  /*  215 S> */ B(LdaSmi), I8(1),
-  /*  222 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(26),
-  /*  229 S> */ B(LdaSmi), I8(1),
-  /*  236 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(28),
-  /*  243 S> */ B(LdaSmi), I8(1),
-  /*  250 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(30),
-  /*  257 S> */ B(LdaSmi), I8(1),
-  /*  264 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(32),
-  /*  271 S> */ B(LdaSmi), I8(1),
-  /*  278 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(34),
-  /*  285 S> */ B(LdaSmi), I8(1),
-  /*  292 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(36),
-  /*  299 S> */ B(LdaSmi), I8(1),
-  /*  306 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(38),
-  /*  313 S> */ B(LdaSmi), I8(1),
-  /*  320 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(40),
-  /*  327 S> */ B(LdaSmi), I8(1),
-  /*  334 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(42),
-  /*  341 S> */ B(LdaSmi), I8(1),
-  /*  348 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(44),
-  /*  355 S> */ B(LdaSmi), I8(1),
-  /*  362 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(46),
-  /*  369 S> */ B(LdaSmi), I8(1),
-  /*  376 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(48),
-  /*  383 S> */ B(LdaSmi), I8(1),
-  /*  390 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(50),
-  /*  397 S> */ B(LdaSmi), I8(1),
-  /*  404 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(52),
-  /*  411 S> */ B(LdaSmi), I8(1),
-  /*  418 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(54),
-  /*  425 S> */ B(LdaSmi), I8(1),
-  /*  432 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(56),
-  /*  439 S> */ B(LdaSmi), I8(1),
-  /*  446 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(58),
-  /*  453 S> */ B(LdaSmi), I8(1),
-  /*  460 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(60),
-  /*  467 S> */ B(LdaSmi), I8(1),
-  /*  474 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(62),
-  /*  481 S> */ B(LdaSmi), I8(1),
-  /*  488 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(64),
-  /*  495 S> */ B(LdaSmi), I8(1),
-  /*  502 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(66),
-  /*  509 S> */ B(LdaSmi), I8(1),
-  /*  516 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(68),
-  /*  523 S> */ B(LdaSmi), I8(1),
-  /*  530 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(70),
-  /*  537 S> */ B(LdaSmi), I8(1),
-  /*  544 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(72),
-  /*  551 S> */ B(LdaSmi), I8(1),
-  /*  558 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(74),
-  /*  565 S> */ B(LdaSmi), I8(1),
-  /*  572 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(76),
-  /*  579 S> */ B(LdaSmi), I8(1),
-  /*  586 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(78),
-  /*  593 S> */ B(LdaSmi), I8(1),
-  /*  600 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(80),
-  /*  607 S> */ B(LdaSmi), I8(1),
-  /*  614 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(82),
-  /*  621 S> */ B(LdaSmi), I8(1),
-  /*  628 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(84),
-  /*  635 S> */ B(LdaSmi), I8(1),
-  /*  642 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(86),
-  /*  649 S> */ B(LdaSmi), I8(1),
-  /*  656 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(88),
-  /*  663 S> */ B(LdaSmi), I8(1),
-  /*  670 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(90),
-  /*  677 S> */ B(LdaSmi), I8(1),
-  /*  684 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(92),
-  /*  691 S> */ B(LdaSmi), I8(1),
-  /*  698 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(94),
-  /*  705 S> */ B(LdaSmi), I8(1),
-  /*  712 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(96),
-  /*  719 S> */ B(LdaSmi), I8(1),
-  /*  726 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(98),
-  /*  733 S> */ B(LdaSmi), I8(1),
-  /*  740 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(100),
-  /*  747 S> */ B(LdaSmi), I8(1),
-  /*  754 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(102),
-  /*  761 S> */ B(LdaSmi), I8(1),
-  /*  768 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(104),
-  /*  775 S> */ B(LdaSmi), I8(1),
-  /*  782 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(106),
-  /*  789 S> */ B(LdaSmi), I8(1),
-  /*  796 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(108),
-  /*  803 S> */ B(LdaSmi), I8(1),
-  /*  810 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(110),
-  /*  817 S> */ B(LdaSmi), I8(1),
-  /*  824 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(112),
-  /*  831 S> */ B(LdaSmi), I8(1),
-  /*  838 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(114),
-  /*  845 S> */ B(LdaSmi), I8(1),
-  /*  852 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(116),
-  /*  859 S> */ B(LdaSmi), I8(1),
-  /*  866 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(118),
-  /*  873 S> */ B(LdaSmi), I8(1),
-  /*  880 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(120),
-  /*  887 S> */ B(LdaSmi), I8(1),
-  /*  894 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(122),
-  /*  901 S> */ B(LdaSmi), I8(1),
-  /*  908 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(124),
-  /*  915 S> */ B(LdaSmi), I8(1),
-  /*  922 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(126),
-  /*  929 S> */ B(LdaSmi), I8(1),
-  /*  936 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(128),
-  /*  943 S> */ B(LdaSmi), I8(1),
-  /*  950 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(130),
-  /*  957 S> */ B(LdaSmi), I8(1),
-  /*  964 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(132),
-  /*  971 S> */ B(LdaSmi), I8(1),
-  /*  978 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(134),
-  /*  985 S> */ B(LdaSmi), I8(1),
-  /*  992 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(136),
-  /*  999 S> */ B(LdaSmi), I8(1),
-  /* 1006 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(138),
-  /* 1013 S> */ B(LdaSmi), I8(1),
-  /* 1020 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(140),
-  /* 1027 S> */ B(LdaSmi), I8(1),
-  /* 1034 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(142),
-  /* 1041 S> */ B(LdaSmi), I8(1),
-  /* 1048 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(144),
-  /* 1055 S> */ B(LdaSmi), I8(1),
-  /* 1062 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(146),
-  /* 1069 S> */ B(LdaSmi), I8(1),
-  /* 1076 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(148),
-  /* 1083 S> */ B(LdaSmi), I8(1),
-  /* 1090 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(150),
-  /* 1097 S> */ B(LdaSmi), I8(1),
-  /* 1104 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(152),
-  /* 1111 S> */ B(LdaSmi), I8(1),
-  /* 1118 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(154),
-  /* 1125 S> */ B(LdaSmi), I8(1),
-  /* 1132 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(156),
-  /* 1139 S> */ B(LdaSmi), I8(1),
-  /* 1146 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(158),
-  /* 1153 S> */ B(LdaSmi), I8(1),
-  /* 1160 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(160),
-  /* 1167 S> */ B(LdaSmi), I8(1),
-  /* 1174 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(162),
-  /* 1181 S> */ B(LdaSmi), I8(1),
-  /* 1188 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(164),
-  /* 1195 S> */ B(LdaSmi), I8(1),
-  /* 1202 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(166),
-  /* 1209 S> */ B(LdaSmi), I8(1),
-  /* 1216 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(168),
-  /* 1223 S> */ B(LdaSmi), I8(1),
-  /* 1230 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(170),
-  /* 1237 S> */ B(LdaSmi), I8(1),
-  /* 1244 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(172),
-  /* 1251 S> */ B(LdaSmi), I8(1),
-  /* 1258 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(174),
-  /* 1265 S> */ B(LdaSmi), I8(1),
-  /* 1272 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(176),
-  /* 1279 S> */ B(LdaSmi), I8(1),
-  /* 1286 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(178),
-  /* 1293 S> */ B(LdaSmi), I8(1),
-  /* 1300 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(180),
-  /* 1307 S> */ B(LdaSmi), I8(1),
-  /* 1314 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(182),
-  /* 1321 S> */ B(LdaSmi), I8(1),
-  /* 1328 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(184),
-  /* 1335 S> */ B(LdaSmi), I8(1),
-  /* 1342 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(186),
-  /* 1349 S> */ B(LdaSmi), I8(1),
-  /* 1356 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(188),
-  /* 1363 S> */ B(LdaSmi), I8(1),
-  /* 1370 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(190),
-  /* 1377 S> */ B(LdaSmi), I8(1),
-  /* 1384 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(192),
-  /* 1391 S> */ B(LdaSmi), I8(1),
-  /* 1398 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(194),
-  /* 1405 S> */ B(LdaSmi), I8(1),
-  /* 1412 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(196),
-  /* 1419 S> */ B(LdaSmi), I8(1),
-  /* 1426 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(198),
-  /* 1433 S> */ B(LdaSmi), I8(1),
-  /* 1440 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(200),
-  /* 1447 S> */ B(LdaSmi), I8(1),
-  /* 1454 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(202),
-  /* 1461 S> */ B(LdaSmi), I8(1),
-  /* 1468 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(204),
-  /* 1475 S> */ B(LdaSmi), I8(1),
-  /* 1482 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(206),
-  /* 1489 S> */ B(LdaSmi), I8(1),
-  /* 1496 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(208),
-  /* 1503 S> */ B(LdaSmi), I8(1),
-  /* 1510 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(210),
-  /* 1517 S> */ B(LdaSmi), I8(1),
-  /* 1524 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(212),
-  /* 1531 S> */ B(LdaSmi), I8(1),
-  /* 1538 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(214),
-  /* 1545 S> */ B(LdaSmi), I8(1),
-  /* 1552 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(216),
-  /* 1559 S> */ B(LdaSmi), I8(1),
-  /* 1566 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(218),
-  /* 1573 S> */ B(LdaSmi), I8(1),
-  /* 1580 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(220),
-  /* 1587 S> */ B(LdaSmi), I8(1),
-  /* 1594 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(222),
-  /* 1601 S> */ B(LdaSmi), I8(1),
-  /* 1608 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(224),
-  /* 1615 S> */ B(LdaSmi), I8(1),
-  /* 1622 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(226),
-  /* 1629 S> */ B(LdaSmi), I8(1),
-  /* 1636 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(228),
-  /* 1643 S> */ B(LdaSmi), I8(1),
-  /* 1650 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(230),
-  /* 1657 S> */ B(LdaSmi), I8(1),
-  /* 1664 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(232),
-  /* 1671 S> */ B(LdaSmi), I8(1),
-  /* 1678 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(234),
-  /* 1685 S> */ B(LdaSmi), I8(1),
-  /* 1692 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(236),
-  /* 1699 S> */ B(LdaSmi), I8(1),
-  /* 1706 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(238),
-  /* 1713 S> */ B(LdaSmi), I8(1),
-  /* 1720 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(240),
-  /* 1727 S> */ B(LdaSmi), I8(1),
-  /* 1734 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(242),
-  /* 1741 S> */ B(LdaSmi), I8(1),
-  /* 1748 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(244),
-  /* 1755 S> */ B(LdaSmi), I8(1),
-  /* 1762 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(246),
-  /* 1769 S> */ B(LdaSmi), I8(1),
-  /* 1776 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(248),
-  /* 1783 S> */ B(LdaSmi), I8(1),
-  /* 1790 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(250),
-  /* 1797 S> */ B(LdaSmi), I8(1),
-  /* 1804 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(252),
-  /* 1811 S> */ B(LdaSmi), I8(1),
-  /* 1818 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(254),
-  /* 1825 S> */ B(LdaSmi), I8(2),
-  /* 1832 E> */ B(Wide), B(StaNamedProperty), R16(arg0), U16(0), U16(256),
+  /*   55 S> */ B(CreateEmptyObjectLiteral),
+                B(Star), R(0),
+  /*   63 S> */ B(LdaNamedProperty), R(0), U8(1), U8(2),
+  /*   76 S> */ B(LdaNamedProperty), R(0), U8(2), U8(4),
+  /*   89 S> */ B(LdaNamedProperty), R(0), U8(3), U8(6),
+  /*  102 S> */ B(LdaNamedProperty), R(0), U8(4), U8(8),
+  /*  115 S> */ B(LdaNamedProperty), R(0), U8(5), U8(10),
+  /*  128 S> */ B(LdaNamedProperty), R(0), U8(6), U8(12),
+  /*  141 S> */ B(LdaNamedProperty), R(0), U8(7), U8(14),
+  /*  154 S> */ B(LdaNamedProperty), R(0), U8(8), U8(16),
+  /*  167 S> */ B(LdaNamedProperty), R(0), U8(9), U8(18),
+  /*  180 S> */ B(LdaNamedProperty), R(0), U8(10), U8(20),
+  /*  193 S> */ B(LdaNamedProperty), R(0), U8(11), U8(22),
+  /*  206 S> */ B(LdaNamedProperty), R(0), U8(12), U8(24),
+  /*  219 S> */ B(LdaNamedProperty), R(0), U8(13), U8(26),
+  /*  232 S> */ B(LdaNamedProperty), R(0), U8(14), U8(28),
+  /*  245 S> */ B(LdaNamedProperty), R(0), U8(15), U8(30),
+  /*  258 S> */ B(LdaNamedProperty), R(0), U8(16), U8(32),
+  /*  271 S> */ B(LdaNamedProperty), R(0), U8(17), U8(34),
+  /*  284 S> */ B(LdaNamedProperty), R(0), U8(18), U8(36),
+  /*  297 S> */ B(LdaNamedProperty), R(0), U8(19), U8(38),
+  /*  310 S> */ B(LdaNamedProperty), R(0), U8(20), U8(40),
+  /*  323 S> */ B(LdaNamedProperty), R(0), U8(21), U8(42),
+  /*  336 S> */ B(LdaNamedProperty), R(0), U8(22), U8(44),
+  /*  349 S> */ B(LdaNamedProperty), R(0), U8(23), U8(46),
+  /*  362 S> */ B(LdaNamedProperty), R(0), U8(24), U8(48),
+  /*  375 S> */ B(LdaNamedProperty), R(0), U8(25), U8(50),
+  /*  388 S> */ B(LdaNamedProperty), R(0), U8(26), U8(52),
+  /*  401 S> */ B(LdaNamedProperty), R(0), U8(27), U8(54),
+  /*  414 S> */ B(LdaNamedProperty), R(0), U8(28), U8(56),
+  /*  427 S> */ B(LdaNamedProperty), R(0), U8(29), U8(58),
+  /*  440 S> */ B(LdaNamedProperty), R(0), U8(30), U8(60),
+  /*  453 S> */ B(LdaNamedProperty), R(0), U8(31), U8(62),
+  /*  466 S> */ B(LdaNamedProperty), R(0), U8(32), U8(64),
+  /*  479 S> */ B(LdaNamedProperty), R(0), U8(33), U8(66),
+  /*  492 S> */ B(LdaNamedProperty), R(0), U8(34), U8(68),
+  /*  505 S> */ B(LdaNamedProperty), R(0), U8(35), U8(70),
+  /*  518 S> */ B(LdaNamedProperty), R(0), U8(36), U8(72),
+  /*  531 S> */ B(LdaNamedProperty), R(0), U8(37), U8(74),
+  /*  544 S> */ B(LdaNamedProperty), R(0), U8(38), U8(76),
+  /*  557 S> */ B(LdaNamedProperty), R(0), U8(39), U8(78),
+  /*  570 S> */ B(LdaNamedProperty), R(0), U8(40), U8(80),
+  /*  583 S> */ B(LdaNamedProperty), R(0), U8(41), U8(82),
+  /*  596 S> */ B(LdaNamedProperty), R(0), U8(42), U8(84),
+  /*  609 S> */ B(LdaNamedProperty), R(0), U8(43), U8(86),
+  /*  622 S> */ B(LdaNamedProperty), R(0), U8(44), U8(88),
+  /*  635 S> */ B(LdaNamedProperty), R(0), U8(45), U8(90),
+  /*  648 S> */ B(LdaNamedProperty), R(0), U8(46), U8(92),
+  /*  661 S> */ B(LdaNamedProperty), R(0), U8(47), U8(94),
+  /*  674 S> */ B(LdaNamedProperty), R(0), U8(48), U8(96),
+  /*  687 S> */ B(LdaNamedProperty), R(0), U8(49), U8(98),
+  /*  700 S> */ B(LdaNamedProperty), R(0), U8(50), U8(100),
+  /*  713 S> */ B(LdaNamedProperty), R(0), U8(51), U8(102),
+  /*  726 S> */ B(LdaNamedProperty), R(0), U8(52), U8(104),
+  /*  739 S> */ B(LdaNamedProperty), R(0), U8(53), U8(106),
+  /*  752 S> */ B(LdaNamedProperty), R(0), U8(54), U8(108),
+  /*  765 S> */ B(LdaNamedProperty), R(0), U8(55), U8(110),
+  /*  778 S> */ B(LdaNamedProperty), R(0), U8(56), U8(112),
+  /*  791 S> */ B(LdaNamedProperty), R(0), U8(57), U8(114),
+  /*  804 S> */ B(LdaNamedProperty), R(0), U8(58), U8(116),
+  /*  817 S> */ B(LdaNamedProperty), R(0), U8(59), U8(118),
+  /*  830 S> */ B(LdaNamedProperty), R(0), U8(60), U8(120),
+  /*  843 S> */ B(LdaNamedProperty), R(0), U8(61), U8(122),
+  /*  856 S> */ B(LdaNamedProperty), R(0), U8(62), U8(124),
+  /*  869 S> */ B(LdaNamedProperty), R(0), U8(63), U8(126),
+  /*  882 S> */ B(LdaNamedProperty), R(0), U8(64), U8(128),
+  /*  895 S> */ B(LdaNamedProperty), R(0), U8(65), U8(130),
+  /*  908 S> */ B(LdaNamedProperty), R(0), U8(66), U8(132),
+  /*  921 S> */ B(LdaNamedProperty), R(0), U8(67), U8(134),
+  /*  934 S> */ B(LdaNamedProperty), R(0), U8(68), U8(136),
+  /*  947 S> */ B(LdaNamedProperty), R(0), U8(69), U8(138),
+  /*  960 S> */ B(LdaNamedProperty), R(0), U8(70), U8(140),
+  /*  973 S> */ B(LdaNamedProperty), R(0), U8(71), U8(142),
+  /*  986 S> */ B(LdaNamedProperty), R(0), U8(72), U8(144),
+  /*  999 S> */ B(LdaNamedProperty), R(0), U8(73), U8(146),
+  /* 1012 S> */ B(LdaNamedProperty), R(0), U8(74), U8(148),
+  /* 1025 S> */ B(LdaNamedProperty), R(0), U8(75), U8(150),
+  /* 1038 S> */ B(LdaNamedProperty), R(0), U8(76), U8(152),
+  /* 1051 S> */ B(LdaNamedProperty), R(0), U8(77), U8(154),
+  /* 1064 S> */ B(LdaNamedProperty), R(0), U8(78), U8(156),
+  /* 1077 S> */ B(LdaNamedProperty), R(0), U8(79), U8(158),
+  /* 1090 S> */ B(LdaNamedProperty), R(0), U8(80), U8(160),
+  /* 1103 S> */ B(LdaNamedProperty), R(0), U8(81), U8(162),
+  /* 1116 S> */ B(LdaNamedProperty), R(0), U8(82), U8(164),
+  /* 1129 S> */ B(LdaNamedProperty), R(0), U8(83), U8(166),
+  /* 1142 S> */ B(LdaNamedProperty), R(0), U8(84), U8(168),
+  /* 1155 S> */ B(LdaNamedProperty), R(0), U8(85), U8(170),
+  /* 1168 S> */ B(LdaNamedProperty), R(0), U8(86), U8(172),
+  /* 1181 S> */ B(LdaNamedProperty), R(0), U8(87), U8(174),
+  /* 1194 S> */ B(LdaNamedProperty), R(0), U8(88), U8(176),
+  /* 1207 S> */ B(LdaNamedProperty), R(0), U8(89), U8(178),
+  /* 1220 S> */ B(LdaNamedProperty), R(0), U8(90), U8(180),
+  /* 1233 S> */ B(LdaNamedProperty), R(0), U8(91), U8(182),
+  /* 1246 S> */ B(LdaNamedProperty), R(0), U8(92), U8(184),
+  /* 1259 S> */ B(LdaNamedProperty), R(0), U8(93), U8(186),
+  /* 1272 S> */ B(LdaNamedProperty), R(0), U8(94), U8(188),
+  /* 1285 S> */ B(LdaNamedProperty), R(0), U8(95), U8(190),
+  /* 1298 S> */ B(LdaNamedProperty), R(0), U8(96), U8(192),
+  /* 1311 S> */ B(LdaNamedProperty), R(0), U8(97), U8(194),
+  /* 1324 S> */ B(LdaNamedProperty), R(0), U8(98), U8(196),
+  /* 1337 S> */ B(LdaNamedProperty), R(0), U8(99), U8(198),
+  /* 1350 S> */ B(LdaNamedProperty), R(0), U8(100), U8(200),
+  /* 1363 S> */ B(LdaNamedProperty), R(0), U8(101), U8(202),
+  /* 1376 S> */ B(LdaNamedProperty), R(0), U8(102), U8(204),
+  /* 1389 S> */ B(LdaNamedProperty), R(0), U8(103), U8(206),
+  /* 1402 S> */ B(LdaNamedProperty), R(0), U8(104), U8(208),
+  /* 1415 S> */ B(LdaNamedProperty), R(0), U8(105), U8(210),
+  /* 1428 S> */ B(LdaNamedProperty), R(0), U8(106), U8(212),
+  /* 1441 S> */ B(LdaNamedProperty), R(0), U8(107), U8(214),
+  /* 1454 S> */ B(LdaNamedProperty), R(0), U8(108), U8(216),
+  /* 1467 S> */ B(LdaNamedProperty), R(0), U8(109), U8(218),
+  /* 1480 S> */ B(LdaNamedProperty), R(0), U8(110), U8(220),
+  /* 1493 S> */ B(LdaNamedProperty), R(0), U8(111), U8(222),
+  /* 1506 S> */ B(LdaNamedProperty), R(0), U8(112), U8(224),
+  /* 1519 S> */ B(LdaNamedProperty), R(0), U8(113), U8(226),
+  /* 1532 S> */ B(LdaNamedProperty), R(0), U8(114), U8(228),
+  /* 1545 S> */ B(LdaNamedProperty), R(0), U8(115), U8(230),
+  /* 1558 S> */ B(LdaNamedProperty), R(0), U8(116), U8(232),
+  /* 1571 S> */ B(LdaNamedProperty), R(0), U8(117), U8(234),
+  /* 1584 S> */ B(LdaNamedProperty), R(0), U8(118), U8(236),
+  /* 1597 S> */ B(LdaNamedProperty), R(0), U8(119), U8(238),
+  /* 1610 S> */ B(LdaNamedProperty), R(0), U8(120), U8(240),
+  /* 1623 S> */ B(LdaNamedProperty), R(0), U8(121), U8(242),
+  /* 1636 S> */ B(LdaNamedProperty), R(0), U8(122), U8(244),
+  /* 1649 S> */ B(LdaNamedProperty), R(0), U8(123), U8(246),
+  /* 1662 S> */ B(LdaNamedProperty), R(0), U8(124), U8(248),
+  /* 1675 S> */ B(LdaNamedProperty), R(0), U8(125), U8(250),
+  /* 1688 S> */ B(LdaNamedProperty), R(0), U8(126), U8(252),
+  /* 1701 S> */ B(LdaNamedProperty), R(0), U8(127), U8(254),
+  /* 1714 S> */ B(Wide), B(LdaNamedProperty), R16(0), U16(128), U16(256),
+  /* 1725 S> */ B(LdaSmi), I8(2),
+  /* 1732 E> */ B(StaNamedProperty), R(arg0), U8(0), U8(0),
                 B(LdaUndefined),
-  /* 1837 S> */ B(Return),
+  /* 1737 S> */ B(Return),
 ]
 constant pool: [
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["name"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name256"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name257"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name258"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name259"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name260"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name261"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name262"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name263"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name264"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name265"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name266"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name267"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name268"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name269"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name270"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name271"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name272"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name273"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name274"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name275"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name276"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name277"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name278"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name279"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name280"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name281"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name282"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name283"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name284"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name285"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name286"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name287"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name288"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name289"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name290"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name291"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name292"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name293"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name294"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name295"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name296"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name297"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name298"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name299"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name300"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name301"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name302"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name303"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name304"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name305"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name306"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name307"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name308"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name309"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name310"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name311"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name312"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name313"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name314"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name315"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name316"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name317"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name318"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name319"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name320"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name321"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name322"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name323"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name324"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name325"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name326"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name327"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name328"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name329"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name330"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name331"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name332"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name333"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name334"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name335"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name336"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name337"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name338"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name339"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name340"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name341"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name342"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name343"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name344"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name345"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name346"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name347"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name348"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name349"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name350"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name351"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name352"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name353"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name354"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name355"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name356"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name357"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name358"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name359"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name360"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name361"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name362"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name363"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name364"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name365"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name366"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name367"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name368"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name369"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name370"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name371"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name372"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name373"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name374"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name375"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name376"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name377"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name378"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name379"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name380"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name381"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name382"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name383"],
 ]
 handlers: [
 ]
diff --git a/deps/v8/test/cctest/interpreter/bytecode_expectations/PublicClassFields.golden b/deps/v8/test/cctest/interpreter/bytecode_expectations/PublicClassFields.golden
index c6dafaec37fdf2..4607d37d4b8852 100644
--- a/deps/v8/test/cctest/interpreter/bytecode_expectations/PublicClassFields.golden
+++ b/deps/v8/test/cctest/interpreter/bytecode_expectations/PublicClassFields.golden
@@ -24,10 +24,9 @@ snippet: "
 "
 frame size: 10
 parameter count: 1
-bytecode array length: 129
+bytecode array length: 125
 bytecodes: [
   /*   30 E> */ B(StackCheck),
-                B(Ldar), R(closure),
                 B(CreateBlockContext), U8(0),
                 B(PushContext), R(4),
                 B(LdaTheHole),
@@ -50,7 +49,6 @@ bytecodes: [
                 B(StaNamedProperty), R(5), U8(5), U8(2),
                 B(PopContext), R(4),
                 B(Mov), R(1), R(2),
-                B(Ldar), R(closure),
   /*   38 E> */ B(CreateBlockContext), U8(6),
                 B(PushContext), R(4),
                 B(LdaTheHole),
@@ -127,10 +125,9 @@ snippet: "
 "
 frame size: 15
 parameter count: 1
-bytecode array length: 244
+bytecode array length: 238
 bytecodes: [
   /*   30 E> */ B(StackCheck),
-                B(Ldar), R(closure),
                 B(CreateBlockContext), U8(0),
                 B(PushContext), R(6),
                 B(LdaTheHole),
@@ -161,7 +158,6 @@ bytecodes: [
                 B(StaNamedProperty), R(7), U8(7), U8(3),
                 B(PopContext), R(6),
                 B(Mov), R(2), R(3),
-                B(Ldar), R(closure),
   /*   38 E> */ B(CreateBlockContext), U8(8),
                 B(PushContext), R(6),
                 B(LdaTheHole),
@@ -194,7 +190,6 @@ bytecodes: [
                 B(StaNamedProperty), R(7), U8(7), U8(9),
                 B(PopContext), R(6),
                 B(Mov), R(1), R(4),
-                B(Ldar), R(closure),
   /*   90 E> */ B(CreateBlockContext), U8(15),
                 B(PushContext), R(6),
                 B(LdaTheHole),
diff --git a/deps/v8/test/cctest/interpreter/bytecode_expectations/StandardForLoop.golden b/deps/v8/test/cctest/interpreter/bytecode_expectations/StandardForLoop.golden
index 7edf446ce33d53..e87ceaf0dee20c 100644
--- a/deps/v8/test/cctest/interpreter/bytecode_expectations/StandardForLoop.golden
+++ b/deps/v8/test/cctest/interpreter/bytecode_expectations/StandardForLoop.golden
@@ -46,9 +46,9 @@ snippet: "
 "
 frame size: 15
 parameter count: 1
-bytecode array length: 168
+bytecode array length: 165
 bytecodes: [
-                B(CreateFunctionContext), U8(3),
+                B(CreateFunctionContext), U8(0), U8(3),
                 B(PushContext), R(4),
                 B(Ldar), R(this),
                 B(StaCurrentContextSlot), U8(4),
@@ -57,8 +57,7 @@ bytecodes: [
                 B(Ldar), R(3),
                 B(StaCurrentContextSlot), U8(5),
   /*   10 E> */ B(StackCheck),
-                B(Ldar), R(closure),
-                B(CreateBlockContext), U8(0),
+                B(CreateBlockContext), U8(1),
                 B(PushContext), R(5),
                 B(LdaTheHole),
                 B(StaCurrentContextSlot), U8(4),
@@ -69,8 +68,7 @@ bytecodes: [
                 B(LdaSmi), I8(1),
                 B(Star), R(1),
   /*   59 E> */ B(StackCheck),
-                B(Ldar), R(closure),
-                B(CreateBlockContext), U8(1),
+                B(CreateBlockContext), U8(2),
                 B(PushContext), R(6),
                 B(LdaTheHole),
                 B(StaCurrentContextSlot), U8(4),
@@ -99,9 +97,9 @@ bytecodes: [
                 B(TestEqual), R(2), U8(3),
                 B(JumpIfFalse), U8(54),
   /*   17 E> */ B(StackCheck),
-  /*   48 S> */ B(LdaLookupGlobalSlot), U8(2), U8(4), U8(3),
+  /*   48 S> */ B(LdaLookupGlobalSlot), U8(3), U8(4), U8(3),
                 B(Star), R(7),
-                B(LdaConstant), U8(3),
+                B(LdaConstant), U8(4),
                 B(Star), R(8),
                 B(LdaZero),
                 B(Star), R(12),
@@ -126,12 +124,13 @@ bytecodes: [
                 B(PopContext), R(6),
                 B(Jump), U8(7),
                 B(PopContext), R(6),
-                B(JumpLoop), U8(125), I8(0),
+                B(JumpLoop), U8(123), I8(0),
                 B(PopContext), R(5),
                 B(LdaUndefined),
   /*   61 S> */ B(Return),
 ]
 constant pool: [
+  SCOPE_INFO_TYPE,
   SCOPE_INFO_TYPE,
   SCOPE_INFO_TYPE,
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["eval"],
@@ -149,7 +148,7 @@ snippet: "
 "
 frame size: 6
 parameter count: 1
-bytecode array length: 108
+bytecode array length: 106
 bytecodes: [
   /*   10 E> */ B(StackCheck),
   /*   30 S> */ B(LdaZero),
@@ -158,7 +157,6 @@ bytecodes: [
                 B(LdaSmi), I8(1),
                 B(Star), R(2),
   /*   78 E> */ B(StackCheck),
-                B(Ldar), R(closure),
                 B(CreateBlockContext), U8(0),
                 B(PushContext), R(4),
                 B(LdaTheHole),
@@ -202,7 +200,7 @@ bytecodes: [
                 B(PopContext), R(4),
                 B(Jump), U8(7),
                 B(PopContext), R(4),
-                B(JumpLoop), U8(93), I8(0),
+                B(JumpLoop), U8(91), I8(0),
                 B(LdaUndefined),
   /*   80 S> */ B(Return),
 ]
@@ -231,7 +229,7 @@ bytecodes: [
                 B(JumpIfUndefined), U8(6),
                 B(Ldar), R(3),
                 B(JumpIfNotNull), U8(16),
-                B(LdaSmi), I8(77),
+                B(LdaSmi), I8(78),
                 B(Star), R(4),
                 B(LdaConstant), U8(1),
                 B(Star), R(5),
@@ -256,7 +254,7 @@ bytecodes: [
   /*   84 S> */ B(Return),
 ]
 constant pool: [
-  BOILERPLATE_DESCRIPTION_TYPE,
+  OBJECT_BOILERPLATE_DESCRIPTION_TYPE,
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["x"],
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["y"],
 ]
@@ -383,7 +381,7 @@ snippet: "
 "
 frame size: 12
 parameter count: 1
-bytecode array length: 137
+bytecode array length: 140
 bytecodes: [
   /*   16 E> */ B(StackCheck),
                 B(CallJSRuntime), U8(%async_function_promise_create), R(0), U8(0),
@@ -408,11 +406,10 @@ bytecodes: [
                 B(LdaZero),
                 B(Star), R(4),
                 B(Mov), R(3), R(5),
-                B(Jump), U8(58),
-                B(Jump), U8(42),
+                B(Jump), U8(55),
+                B(Jump), U8(39),
                 B(Star), R(8),
-                B(Ldar), R(closure),
-                B(CreateCatchContext), R(8), U8(0), U8(1),
+                B(CreateCatchContext), R(8), U8(0),
                 B(Star), R(7),
                 B(LdaTheHole),
                 B(SetPendingMessage),
@@ -439,11 +436,14 @@ bytecodes: [
                 B(LdaTheHole),
                 B(SetPendingMessage),
                 B(Star), R(6),
-                B(CallJSRuntime), U8(%async_function_promise_release), R(3), U8(1),
+                B(LdaFalse),
+                B(Star), R(8),
+                B(Mov), R(3), R(7),
+                B(CallJSRuntime), U8(%async_function_promise_release), R(7), U8(2),
                 B(Ldar), R(6),
                 B(SetPendingMessage),
                 B(Ldar), R(4),
-                B(SwitchOnSmiNoFeedback), U8(2), U8(2), I8(0),
+                B(SwitchOnSmiNoFeedback), U8(1), U8(2), I8(0),
                 B(Jump), U8(8),
                 B(Ldar), R(5),
   /*   67 S> */ B(Return),
@@ -453,13 +453,12 @@ bytecodes: [
   /*   67 S> */ B(Return),
 ]
 constant pool: [
-  ONE_BYTE_INTERNALIZED_STRING_TYPE [".catch"],
   SCOPE_INFO_TYPE,
   Smi [6],
   Smi [9],
 ]
 handlers: [
-  [10, 96, 104],
+  [10, 93, 101],
   [13, 54, 56],
 ]
 
@@ -472,7 +471,7 @@ snippet: "
 "
 frame size: 11
 parameter count: 1
-bytecode array length: 188
+bytecode array length: 191
 bytecodes: [
                 B(SwitchOnGeneratorState), R(1), U8(0), U8(1),
                 B(Mov), R(closure), R(3),
@@ -500,7 +499,7 @@ bytecodes: [
                 B(InvokeIntrinsic), U8(Runtime::k_GeneratorGetResumeMode), R(1), U8(1),
                 B(Star), R(8),
                 B(LdaZero),
-                B(TestEqualStrictNoFeedback), R(8),
+                B(TestReferenceEqual), R(8),
                 B(JumpIfTrue), U8(5),
                 B(Ldar), R(7),
                 B(ReThrow),
@@ -515,11 +514,10 @@ bytecodes: [
                 B(LdaZero),
                 B(Star), R(3),
                 B(Mov), R(2), R(4),
-                B(Jump), U8(58),
-                B(Jump), U8(42),
+                B(Jump), U8(55),
+                B(Jump), U8(39),
                 B(Star), R(7),
-                B(Ldar), R(closure),
-                B(CreateCatchContext), R(7), U8(1), U8(2),
+                B(CreateCatchContext), R(7), U8(1),
                 B(Star), R(6),
                 B(LdaTheHole),
                 B(SetPendingMessage),
@@ -546,11 +544,14 @@ bytecodes: [
                 B(LdaTheHole),
                 B(SetPendingMessage),
                 B(Star), R(5),
-                B(CallJSRuntime), U8(%async_function_promise_release), R(2), U8(1),
+                B(LdaTrue),
+                B(Star), R(7),
+                B(Mov), R(2), R(6),
+                B(CallJSRuntime), U8(%async_function_promise_release), R(6), U8(2),
                 B(Ldar), R(5),
                 B(SetPendingMessage),
                 B(Ldar), R(3),
-                B(SwitchOnSmiNoFeedback), U8(3), U8(2), I8(0),
+                B(SwitchOnSmiNoFeedback), U8(2), U8(2), I8(0),
                 B(Jump), U8(8),
                 B(Ldar), R(4),
   /*   61 S> */ B(Return),
@@ -561,13 +562,12 @@ bytecodes: [
 ]
 constant pool: [
   Smi [58],
-  ONE_BYTE_INTERNALIZED_STRING_TYPE [".catch"],
   SCOPE_INFO_TYPE,
   Smi [6],
   Smi [9],
 ]
 handlers: [
-  [26, 147, 155],
+  [26, 144, 152],
   [29, 105, 107],
 ]
 
diff --git a/deps/v8/test/cctest/interpreter/bytecode_expectations/StaticClassFields.golden b/deps/v8/test/cctest/interpreter/bytecode_expectations/StaticClassFields.golden
index 342af2fe11504b..fcf5e9ae9a8765 100644
--- a/deps/v8/test/cctest/interpreter/bytecode_expectations/StaticClassFields.golden
+++ b/deps/v8/test/cctest/interpreter/bytecode_expectations/StaticClassFields.golden
@@ -29,10 +29,9 @@ snippet: "
 "
 frame size: 11
 parameter count: 1
-bytecode array length: 193
+bytecode array length: 191
 bytecodes: [
   /*   30 E> */ B(StackCheck),
-                B(Ldar), R(closure),
                 B(CreateBlockContext), U8(0),
                 B(PushContext), R(4),
                 B(LdaTheHole),
@@ -51,7 +50,7 @@ bytecodes: [
                 B(LdaConstant), U8(4),
                 B(Star), R(10),
                 B(LdaConstant), U8(5),
-                B(TestEqualStrictNoFeedback), R(10),
+                B(TestEqualStrict), R(10), U8(1),
                 B(Mov), R(5), R(7),
                 B(JumpIfFalse), U8(7),
                 B(CallRuntime), U16(Runtime::kThrowStaticPrototypeError), R(0), U8(0),
@@ -60,15 +59,14 @@ bytecodes: [
                 B(CallRuntime), U16(Runtime::kDefineClass), R(6), U8(5),
                 B(Star), R(6),
                 B(Mov), R(5), R(1),
-                B(CreateClosure), U8(6), U8(1), U8(2),
+                B(CreateClosure), U8(6), U8(2), U8(2),
                 B(Star), R(7),
-                B(StaNamedProperty), R(5), U8(7), U8(2),
-                B(CreateClosure), U8(8), U8(4), U8(2),
+                B(StaNamedProperty), R(5), U8(7), U8(3),
+                B(CreateClosure), U8(8), U8(5), U8(2),
                 B(Star), R(9),
-                B(CallProperty0), R(9), R(1), U8(5),
+                B(CallProperty0), R(9), R(1), U8(6),
                 B(PopContext), R(4),
                 B(Mov), R(1), R(2),
-                B(Ldar), R(closure),
   /*   38 E> */ B(CreateBlockContext), U8(9),
                 B(PushContext), R(4),
                 B(LdaTheHole),
@@ -77,7 +75,7 @@ bytecodes: [
                 B(StaCurrentContextSlot), U8(5),
                 B(LdaTheHole),
                 B(Star), R(8),
-                B(CreateClosure), U8(11), U8(7), U8(2),
+                B(CreateClosure), U8(11), U8(8), U8(2),
                 B(Star), R(5),
                 B(LdaConstant), U8(10),
                 B(Star), R(6),
@@ -87,7 +85,7 @@ bytecodes: [
                 B(LdaConstant), U8(4),
                 B(Star), R(10),
                 B(LdaConstant), U8(5),
-                B(TestEqualStrictNoFeedback), R(10),
+                B(TestEqualStrict), R(10), U8(1),
                 B(Mov), R(5), R(7),
                 B(JumpIfFalse), U8(7),
                 B(CallRuntime), U16(Runtime::kThrowStaticPrototypeError), R(0), U8(0),
@@ -96,18 +94,18 @@ bytecodes: [
                 B(CallRuntime), U16(Runtime::kDefineClass), R(6), U8(5),
                 B(Star), R(6),
                 B(Mov), R(5), R(0),
-                B(CreateClosure), U8(12), U8(8), U8(2),
+                B(CreateClosure), U8(12), U8(9), U8(2),
                 B(Star), R(7),
-                B(StaNamedProperty), R(5), U8(7), U8(9),
-                B(CreateClosure), U8(13), U8(11), U8(2),
+                B(StaNamedProperty), R(5), U8(7), U8(10),
+                B(CreateClosure), U8(13), U8(12), U8(2),
                 B(Star), R(9),
-                B(CallProperty0), R(9), R(0), U8(12),
+                B(CallProperty0), R(9), R(0), U8(13),
                 B(PopContext), R(4),
                 B(Mov), R(0), R(3),
   /*  197 S> */ B(Ldar), R(2),
-  /*  197 E> */ B(Construct), R(2), R(0), U8(0), U8(14),
+  /*  197 E> */ B(Construct), R(2), R(0), U8(0), U8(15),
   /*  206 S> */ B(Ldar), R(0),
-  /*  206 E> */ B(Construct), R(0), R(0), U8(0), U8(16),
+  /*  206 E> */ B(Construct), R(0), R(0), U8(0), U8(17),
                 B(LdaUndefined),
   /*  215 S> */ B(Return),
 ]
@@ -168,10 +166,9 @@ snippet: "
 "
 frame size: 15
 parameter count: 1
-bytecode array length: 346
+bytecode array length: 343
 bytecodes: [
   /*   30 E> */ B(StackCheck),
-                B(Ldar), R(closure),
                 B(CreateBlockContext), U8(0),
                 B(PushContext), R(6),
                 B(LdaTheHole),
@@ -197,7 +194,7 @@ bytecodes: [
                 B(LdaConstant), U8(6),
                 B(Star), R(12),
                 B(LdaConstant), U8(7),
-                B(TestEqualStrictNoFeedback), R(12),
+                B(TestEqualStrict), R(12), U8(2),
                 B(Mov), R(13), R(10),
                 B(Mov), R(7), R(9),
                 B(JumpIfFalse), U8(7),
@@ -207,15 +204,14 @@ bytecodes: [
                 B(CallRuntime), U16(Runtime::kDefineClass), R(8), U8(5),
                 B(Star), R(8),
                 B(Mov), R(7), R(2),
-                B(CreateClosure), U8(8), U8(2), U8(2),
+                B(CreateClosure), U8(8), U8(3), U8(2),
                 B(Star), R(9),
-                B(StaNamedProperty), R(7), U8(9), U8(3),
-                B(CreateClosure), U8(10), U8(5), U8(2),
+                B(StaNamedProperty), R(7), U8(9), U8(4),
+                B(CreateClosure), U8(10), U8(6), U8(2),
                 B(Star), R(11),
-                B(CallProperty0), R(11), R(2), U8(6),
+                B(CallProperty0), R(11), R(2), U8(7),
                 B(PopContext), R(6),
                 B(Mov), R(2), R(3),
-                B(Ldar), R(closure),
   /*   38 E> */ B(CreateBlockContext), U8(11),
                 B(PushContext), R(6),
                 B(LdaTheHole),
@@ -224,14 +220,14 @@ bytecodes: [
                 B(StaCurrentContextSlot), U8(5),
                 B(LdaTheHole),
                 B(Star), R(14),
-                B(CreateClosure), U8(14), U8(8), U8(2),
+                B(CreateClosure), U8(14), U8(9), U8(2),
                 B(Star), R(11),
                 B(LdaConstant), U8(13),
                 B(Star), R(12),
                 B(Mov), R(11), R(13),
                 B(CallRuntime), U16(Runtime::kDefineClass), R(12), U8(3),
                 B(Star), R(12),
-                B(CreateClosure), U8(15), U8(9), U8(2),
+                B(CreateClosure), U8(15), U8(10), U8(2),
                 B(Star), R(7),
                 B(LdaConstant), U8(12),
                 B(Star), R(8),
@@ -241,34 +237,33 @@ bytecodes: [
                 B(LdaConstant), U8(6),
                 B(Star), R(12),
                 B(LdaConstant), U8(7),
-                B(TestEqualStrictNoFeedback), R(12),
+                B(TestEqualStrict), R(12), U8(2),
                 B(Mov), R(7), R(9),
                 B(Mov), R(13), R(10),
                 B(JumpIfFalse), U8(7),
                 B(CallRuntime), U16(Runtime::kThrowStaticPrototypeError), R(0), U8(0),
                 B(Ldar), R(12),
                 B(StaCurrentContextSlot), U8(5),
-                B(CreateClosure), U8(16), U8(10), U8(2),
+                B(CreateClosure), U8(16), U8(11), U8(2),
                 B(Star), R(13),
                 B(CallRuntime), U16(Runtime::kDefineClass), R(8), U8(6),
                 B(Star), R(8),
                 B(Mov), R(7), R(1),
-                B(CreateClosure), U8(17), U8(11), U8(2),
+                B(CreateClosure), U8(17), U8(12), U8(2),
                 B(Star), R(9),
-                B(StaNamedProperty), R(7), U8(9), U8(12),
-                B(CreateClosure), U8(18), U8(14), U8(2),
+                B(StaNamedProperty), R(7), U8(9), U8(13),
+                B(CreateClosure), U8(18), U8(15), U8(2),
                 B(Star), R(11),
-                B(CallProperty0), R(11), R(1), U8(15),
+                B(CallProperty0), R(11), R(1), U8(16),
                 B(PopContext), R(6),
                 B(Mov), R(1), R(4),
-                B(Ldar), R(closure),
   /*  122 E> */ B(CreateBlockContext), U8(19),
                 B(PushContext), R(6),
                 B(LdaTheHole),
                 B(StaCurrentContextSlot), U8(4),
                 B(LdaTheHole),
                 B(StaCurrentContextSlot), U8(5),
-  /*  313 E> */ B(CreateClosure), U8(21), U8(17), U8(2),
+  /*  313 E> */ B(CreateClosure), U8(21), U8(18), U8(2),
                 B(Star), R(7),
                 B(LdaConstant), U8(20),
                 B(Star), R(8),
@@ -278,7 +273,7 @@ bytecodes: [
                 B(LdaConstant), U8(6),
                 B(Star), R(12),
                 B(LdaConstant), U8(7),
-                B(TestEqualStrictNoFeedback), R(12),
+                B(TestEqualStrict), R(12), U8(2),
                 B(Mov), R(1), R(10),
                 B(Mov), R(7), R(9),
                 B(JumpIfFalse), U8(7),
@@ -288,22 +283,22 @@ bytecodes: [
                 B(CallRuntime), U16(Runtime::kDefineClass), R(8), U8(5),
                 B(Star), R(8),
                 B(Mov), R(7), R(0),
-                B(CreateClosure), U8(22), U8(18), U8(2),
+                B(CreateClosure), U8(22), U8(19), U8(2),
                 B(Star), R(9),
-                B(StaNamedProperty), R(7), U8(9), U8(19),
-                B(CreateClosure), U8(23), U8(21), U8(2),
+                B(StaNamedProperty), R(7), U8(9), U8(20),
+                B(CreateClosure), U8(23), U8(22), U8(2),
                 B(Star), R(11),
                 B(Ldar), R(0),
-                B(StaNamedProperty), R(11), U8(24), U8(22),
-                B(CallProperty0), R(11), R(0), U8(24),
+                B(StaNamedProperty), R(11), U8(24), U8(23),
+                B(CallProperty0), R(11), R(0), U8(25),
                 B(PopContext), R(6),
                 B(Mov), R(0), R(5),
   /*  456 S> */ B(Ldar), R(3),
-  /*  456 E> */ B(Construct), R(3), R(0), U8(0), U8(26),
+  /*  456 E> */ B(Construct), R(3), R(0), U8(0), U8(27),
   /*  465 S> */ B(Ldar), R(4),
-  /*  465 E> */ B(Construct), R(4), R(0), U8(0), U8(28),
+  /*  465 E> */ B(Construct), R(4), R(0), U8(0), U8(29),
   /*  474 S> */ B(Ldar), R(0),
-  /*  474 E> */ B(Construct), R(0), R(0), U8(0), U8(30),
+  /*  474 E> */ B(Construct), R(0), R(0), U8(0), U8(31),
                 B(LdaUndefined),
   /*  483 S> */ B(Return),
 ]
diff --git a/deps/v8/test/cctest/interpreter/bytecode_expectations/StoreGlobal.golden b/deps/v8/test/cctest/interpreter/bytecode_expectations/StoreGlobal.golden
index 927b9f33079652..eed4f0467cca44 100644
--- a/deps/v8/test/cctest/interpreter/bytecode_expectations/StoreGlobal.golden
+++ b/deps/v8/test/cctest/interpreter/bytecode_expectations/StoreGlobal.golden
@@ -96,279 +96,409 @@ handlers: [
 ---
 snippet: "
   a = 1;
-  function f(b) {
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
+  function f(c) {
+    var b = {};
+    b.name640;
+    b.name641;
+    b.name642;
+    b.name643;
+    b.name644;
+    b.name645;
+    b.name646;
+    b.name647;
+    b.name648;
+    b.name649;
+    b.name650;
+    b.name651;
+    b.name652;
+    b.name653;
+    b.name654;
+    b.name655;
+    b.name656;
+    b.name657;
+    b.name658;
+    b.name659;
+    b.name660;
+    b.name661;
+    b.name662;
+    b.name663;
+    b.name664;
+    b.name665;
+    b.name666;
+    b.name667;
+    b.name668;
+    b.name669;
+    b.name670;
+    b.name671;
+    b.name672;
+    b.name673;
+    b.name674;
+    b.name675;
+    b.name676;
+    b.name677;
+    b.name678;
+    b.name679;
+    b.name680;
+    b.name681;
+    b.name682;
+    b.name683;
+    b.name684;
+    b.name685;
+    b.name686;
+    b.name687;
+    b.name688;
+    b.name689;
+    b.name690;
+    b.name691;
+    b.name692;
+    b.name693;
+    b.name694;
+    b.name695;
+    b.name696;
+    b.name697;
+    b.name698;
+    b.name699;
+    b.name700;
+    b.name701;
+    b.name702;
+    b.name703;
+    b.name704;
+    b.name705;
+    b.name706;
+    b.name707;
+    b.name708;
+    b.name709;
+    b.name710;
+    b.name711;
+    b.name712;
+    b.name713;
+    b.name714;
+    b.name715;
+    b.name716;
+    b.name717;
+    b.name718;
+    b.name719;
+    b.name720;
+    b.name721;
+    b.name722;
+    b.name723;
+    b.name724;
+    b.name725;
+    b.name726;
+    b.name727;
+    b.name728;
+    b.name729;
+    b.name730;
+    b.name731;
+    b.name732;
+    b.name733;
+    b.name734;
+    b.name735;
+    b.name736;
+    b.name737;
+    b.name738;
+    b.name739;
+    b.name740;
+    b.name741;
+    b.name742;
+    b.name743;
+    b.name744;
+    b.name745;
+    b.name746;
+    b.name747;
+    b.name748;
+    b.name749;
+    b.name750;
+    b.name751;
+    b.name752;
+    b.name753;
+    b.name754;
+    b.name755;
+    b.name756;
+    b.name757;
+    b.name758;
+    b.name759;
+    b.name760;
+    b.name761;
+    b.name762;
+    b.name763;
+    b.name764;
+    b.name765;
+    b.name766;
+    b.name767;
     a = 2;
   }
   f({name: 1});
 "
-frame size: 0
+frame size: 1
 parameter count: 2
-bytecode array length: 523
+bytecode array length: 526
 bytecodes: [
   /*   17 E> */ B(StackCheck),
-  /*   27 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(0),
-  /*   37 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(2),
-  /*   47 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(4),
-  /*   57 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(6),
-  /*   67 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(8),
-  /*   77 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(10),
-  /*   87 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(12),
-  /*   97 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(14),
-  /*  107 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(16),
-  /*  117 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(18),
-  /*  127 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(20),
-  /*  137 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(22),
-  /*  147 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(24),
-  /*  157 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(26),
-  /*  167 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(28),
-  /*  177 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(30),
-  /*  187 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(32),
-  /*  197 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(34),
-  /*  207 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(36),
-  /*  217 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(38),
-  /*  227 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(40),
-  /*  237 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(42),
-  /*  247 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(44),
-  /*  257 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(46),
-  /*  267 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(48),
-  /*  277 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(50),
-  /*  287 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(52),
-  /*  297 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(54),
-  /*  307 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(56),
-  /*  317 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(58),
-  /*  327 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(60),
-  /*  337 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(62),
-  /*  347 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(64),
-  /*  357 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(66),
-  /*  367 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(68),
-  /*  377 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(70),
-  /*  387 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(72),
-  /*  397 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(74),
-  /*  407 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(76),
-  /*  417 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(78),
-  /*  427 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(80),
-  /*  437 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(82),
-  /*  447 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(84),
-  /*  457 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(86),
-  /*  467 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(88),
-  /*  477 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(90),
-  /*  487 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(92),
-  /*  497 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(94),
-  /*  507 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(96),
-  /*  517 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(98),
-  /*  527 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(100),
-  /*  537 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(102),
-  /*  547 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(104),
-  /*  557 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(106),
-  /*  567 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(108),
-  /*  577 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(110),
-  /*  587 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(112),
-  /*  597 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(114),
-  /*  607 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(116),
-  /*  617 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(118),
-  /*  627 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(120),
-  /*  637 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(122),
-  /*  647 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(124),
-  /*  657 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(126),
-  /*  667 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(128),
-  /*  677 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(130),
-  /*  687 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(132),
-  /*  697 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(134),
-  /*  707 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(136),
-  /*  717 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(138),
-  /*  727 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(140),
-  /*  737 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(142),
-  /*  747 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(144),
-  /*  757 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(146),
-  /*  767 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(148),
-  /*  777 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(150),
-  /*  787 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(152),
-  /*  797 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(154),
-  /*  807 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(156),
-  /*  817 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(158),
-  /*  827 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(160),
-  /*  837 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(162),
-  /*  847 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(164),
-  /*  857 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(166),
-  /*  867 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(168),
-  /*  877 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(170),
-  /*  887 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(172),
-  /*  897 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(174),
-  /*  907 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(176),
-  /*  917 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(178),
-  /*  927 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(180),
-  /*  937 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(182),
-  /*  947 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(184),
-  /*  957 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(186),
-  /*  967 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(188),
-  /*  977 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(190),
-  /*  987 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(192),
-  /*  997 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(194),
-  /* 1007 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(196),
-  /* 1017 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(198),
-  /* 1027 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(200),
-  /* 1037 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(202),
-  /* 1047 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(204),
-  /* 1057 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(206),
-  /* 1067 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(208),
-  /* 1077 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(210),
-  /* 1087 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(212),
-  /* 1097 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(214),
-  /* 1107 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(216),
-  /* 1117 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(218),
-  /* 1127 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(220),
-  /* 1137 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(222),
-  /* 1147 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(224),
-  /* 1157 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(226),
-  /* 1167 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(228),
-  /* 1177 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(230),
-  /* 1187 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(232),
-  /* 1197 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(234),
-  /* 1207 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(236),
-  /* 1217 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(238),
-  /* 1227 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(240),
-  /* 1237 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(242),
-  /* 1247 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(244),
-  /* 1257 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(246),
-  /* 1267 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(248),
-  /* 1277 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(250),
-  /* 1287 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(252),
-  /* 1297 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(254),
-  /* 1305 S> */ B(LdaSmi), I8(2),
-  /* 1307 E> */ B(Wide), B(StaGlobal), U16(1), U16(256),
+  /*   33 S> */ B(CreateEmptyObjectLiteral),
+                B(Star), R(0),
+  /*   41 S> */ B(LdaNamedProperty), R(0), U8(0), U8(0),
+  /*   54 S> */ B(LdaNamedProperty), R(0), U8(1), U8(2),
+  /*   67 S> */ B(LdaNamedProperty), R(0), U8(2), U8(4),
+  /*   80 S> */ B(LdaNamedProperty), R(0), U8(3), U8(6),
+  /*   93 S> */ B(LdaNamedProperty), R(0), U8(4), U8(8),
+  /*  106 S> */ B(LdaNamedProperty), R(0), U8(5), U8(10),
+  /*  119 S> */ B(LdaNamedProperty), R(0), U8(6), U8(12),
+  /*  132 S> */ B(LdaNamedProperty), R(0), U8(7), U8(14),
+  /*  145 S> */ B(LdaNamedProperty), R(0), U8(8), U8(16),
+  /*  158 S> */ B(LdaNamedProperty), R(0), U8(9), U8(18),
+  /*  171 S> */ B(LdaNamedProperty), R(0), U8(10), U8(20),
+  /*  184 S> */ B(LdaNamedProperty), R(0), U8(11), U8(22),
+  /*  197 S> */ B(LdaNamedProperty), R(0), U8(12), U8(24),
+  /*  210 S> */ B(LdaNamedProperty), R(0), U8(13), U8(26),
+  /*  223 S> */ B(LdaNamedProperty), R(0), U8(14), U8(28),
+  /*  236 S> */ B(LdaNamedProperty), R(0), U8(15), U8(30),
+  /*  249 S> */ B(LdaNamedProperty), R(0), U8(16), U8(32),
+  /*  262 S> */ B(LdaNamedProperty), R(0), U8(17), U8(34),
+  /*  275 S> */ B(LdaNamedProperty), R(0), U8(18), U8(36),
+  /*  288 S> */ B(LdaNamedProperty), R(0), U8(19), U8(38),
+  /*  301 S> */ B(LdaNamedProperty), R(0), U8(20), U8(40),
+  /*  314 S> */ B(LdaNamedProperty), R(0), U8(21), U8(42),
+  /*  327 S> */ B(LdaNamedProperty), R(0), U8(22), U8(44),
+  /*  340 S> */ B(LdaNamedProperty), R(0), U8(23), U8(46),
+  /*  353 S> */ B(LdaNamedProperty), R(0), U8(24), U8(48),
+  /*  366 S> */ B(LdaNamedProperty), R(0), U8(25), U8(50),
+  /*  379 S> */ B(LdaNamedProperty), R(0), U8(26), U8(52),
+  /*  392 S> */ B(LdaNamedProperty), R(0), U8(27), U8(54),
+  /*  405 S> */ B(LdaNamedProperty), R(0), U8(28), U8(56),
+  /*  418 S> */ B(LdaNamedProperty), R(0), U8(29), U8(58),
+  /*  431 S> */ B(LdaNamedProperty), R(0), U8(30), U8(60),
+  /*  444 S> */ B(LdaNamedProperty), R(0), U8(31), U8(62),
+  /*  457 S> */ B(LdaNamedProperty), R(0), U8(32), U8(64),
+  /*  470 S> */ B(LdaNamedProperty), R(0), U8(33), U8(66),
+  /*  483 S> */ B(LdaNamedProperty), R(0), U8(34), U8(68),
+  /*  496 S> */ B(LdaNamedProperty), R(0), U8(35), U8(70),
+  /*  509 S> */ B(LdaNamedProperty), R(0), U8(36), U8(72),
+  /*  522 S> */ B(LdaNamedProperty), R(0), U8(37), U8(74),
+  /*  535 S> */ B(LdaNamedProperty), R(0), U8(38), U8(76),
+  /*  548 S> */ B(LdaNamedProperty), R(0), U8(39), U8(78),
+  /*  561 S> */ B(LdaNamedProperty), R(0), U8(40), U8(80),
+  /*  574 S> */ B(LdaNamedProperty), R(0), U8(41), U8(82),
+  /*  587 S> */ B(LdaNamedProperty), R(0), U8(42), U8(84),
+  /*  600 S> */ B(LdaNamedProperty), R(0), U8(43), U8(86),
+  /*  613 S> */ B(LdaNamedProperty), R(0), U8(44), U8(88),
+  /*  626 S> */ B(LdaNamedProperty), R(0), U8(45), U8(90),
+  /*  639 S> */ B(LdaNamedProperty), R(0), U8(46), U8(92),
+  /*  652 S> */ B(LdaNamedProperty), R(0), U8(47), U8(94),
+  /*  665 S> */ B(LdaNamedProperty), R(0), U8(48), U8(96),
+  /*  678 S> */ B(LdaNamedProperty), R(0), U8(49), U8(98),
+  /*  691 S> */ B(LdaNamedProperty), R(0), U8(50), U8(100),
+  /*  704 S> */ B(LdaNamedProperty), R(0), U8(51), U8(102),
+  /*  717 S> */ B(LdaNamedProperty), R(0), U8(52), U8(104),
+  /*  730 S> */ B(LdaNamedProperty), R(0), U8(53), U8(106),
+  /*  743 S> */ B(LdaNamedProperty), R(0), U8(54), U8(108),
+  /*  756 S> */ B(LdaNamedProperty), R(0), U8(55), U8(110),
+  /*  769 S> */ B(LdaNamedProperty), R(0), U8(56), U8(112),
+  /*  782 S> */ B(LdaNamedProperty), R(0), U8(57), U8(114),
+  /*  795 S> */ B(LdaNamedProperty), R(0), U8(58), U8(116),
+  /*  808 S> */ B(LdaNamedProperty), R(0), U8(59), U8(118),
+  /*  821 S> */ B(LdaNamedProperty), R(0), U8(60), U8(120),
+  /*  834 S> */ B(LdaNamedProperty), R(0), U8(61), U8(122),
+  /*  847 S> */ B(LdaNamedProperty), R(0), U8(62), U8(124),
+  /*  860 S> */ B(LdaNamedProperty), R(0), U8(63), U8(126),
+  /*  873 S> */ B(LdaNamedProperty), R(0), U8(64), U8(128),
+  /*  886 S> */ B(LdaNamedProperty), R(0), U8(65), U8(130),
+  /*  899 S> */ B(LdaNamedProperty), R(0), U8(66), U8(132),
+  /*  912 S> */ B(LdaNamedProperty), R(0), U8(67), U8(134),
+  /*  925 S> */ B(LdaNamedProperty), R(0), U8(68), U8(136),
+  /*  938 S> */ B(LdaNamedProperty), R(0), U8(69), U8(138),
+  /*  951 S> */ B(LdaNamedProperty), R(0), U8(70), U8(140),
+  /*  964 S> */ B(LdaNamedProperty), R(0), U8(71), U8(142),
+  /*  977 S> */ B(LdaNamedProperty), R(0), U8(72), U8(144),
+  /*  990 S> */ B(LdaNamedProperty), R(0), U8(73), U8(146),
+  /* 1003 S> */ B(LdaNamedProperty), R(0), U8(74), U8(148),
+  /* 1016 S> */ B(LdaNamedProperty), R(0), U8(75), U8(150),
+  /* 1029 S> */ B(LdaNamedProperty), R(0), U8(76), U8(152),
+  /* 1042 S> */ B(LdaNamedProperty), R(0), U8(77), U8(154),
+  /* 1055 S> */ B(LdaNamedProperty), R(0), U8(78), U8(156),
+  /* 1068 S> */ B(LdaNamedProperty), R(0), U8(79), U8(158),
+  /* 1081 S> */ B(LdaNamedProperty), R(0), U8(80), U8(160),
+  /* 1094 S> */ B(LdaNamedProperty), R(0), U8(81), U8(162),
+  /* 1107 S> */ B(LdaNamedProperty), R(0), U8(82), U8(164),
+  /* 1120 S> */ B(LdaNamedProperty), R(0), U8(83), U8(166),
+  /* 1133 S> */ B(LdaNamedProperty), R(0), U8(84), U8(168),
+  /* 1146 S> */ B(LdaNamedProperty), R(0), U8(85), U8(170),
+  /* 1159 S> */ B(LdaNamedProperty), R(0), U8(86), U8(172),
+  /* 1172 S> */ B(LdaNamedProperty), R(0), U8(87), U8(174),
+  /* 1185 S> */ B(LdaNamedProperty), R(0), U8(88), U8(176),
+  /* 1198 S> */ B(LdaNamedProperty), R(0), U8(89), U8(178),
+  /* 1211 S> */ B(LdaNamedProperty), R(0), U8(90), U8(180),
+  /* 1224 S> */ B(LdaNamedProperty), R(0), U8(91), U8(182),
+  /* 1237 S> */ B(LdaNamedProperty), R(0), U8(92), U8(184),
+  /* 1250 S> */ B(LdaNamedProperty), R(0), U8(93), U8(186),
+  /* 1263 S> */ B(LdaNamedProperty), R(0), U8(94), U8(188),
+  /* 1276 S> */ B(LdaNamedProperty), R(0), U8(95), U8(190),
+  /* 1289 S> */ B(LdaNamedProperty), R(0), U8(96), U8(192),
+  /* 1302 S> */ B(LdaNamedProperty), R(0), U8(97), U8(194),
+  /* 1315 S> */ B(LdaNamedProperty), R(0), U8(98), U8(196),
+  /* 1328 S> */ B(LdaNamedProperty), R(0), U8(99), U8(198),
+  /* 1341 S> */ B(LdaNamedProperty), R(0), U8(100), U8(200),
+  /* 1354 S> */ B(LdaNamedProperty), R(0), U8(101), U8(202),
+  /* 1367 S> */ B(LdaNamedProperty), R(0), U8(102), U8(204),
+  /* 1380 S> */ B(LdaNamedProperty), R(0), U8(103), U8(206),
+  /* 1393 S> */ B(LdaNamedProperty), R(0), U8(104), U8(208),
+  /* 1406 S> */ B(LdaNamedProperty), R(0), U8(105), U8(210),
+  /* 1419 S> */ B(LdaNamedProperty), R(0), U8(106), U8(212),
+  /* 1432 S> */ B(LdaNamedProperty), R(0), U8(107), U8(214),
+  /* 1445 S> */ B(LdaNamedProperty), R(0), U8(108), U8(216),
+  /* 1458 S> */ B(LdaNamedProperty), R(0), U8(109), U8(218),
+  /* 1471 S> */ B(LdaNamedProperty), R(0), U8(110), U8(220),
+  /* 1484 S> */ B(LdaNamedProperty), R(0), U8(111), U8(222),
+  /* 1497 S> */ B(LdaNamedProperty), R(0), U8(112), U8(224),
+  /* 1510 S> */ B(LdaNamedProperty), R(0), U8(113), U8(226),
+  /* 1523 S> */ B(LdaNamedProperty), R(0), U8(114), U8(228),
+  /* 1536 S> */ B(LdaNamedProperty), R(0), U8(115), U8(230),
+  /* 1549 S> */ B(LdaNamedProperty), R(0), U8(116), U8(232),
+  /* 1562 S> */ B(LdaNamedProperty), R(0), U8(117), U8(234),
+  /* 1575 S> */ B(LdaNamedProperty), R(0), U8(118), U8(236),
+  /* 1588 S> */ B(LdaNamedProperty), R(0), U8(119), U8(238),
+  /* 1601 S> */ B(LdaNamedProperty), R(0), U8(120), U8(240),
+  /* 1614 S> */ B(LdaNamedProperty), R(0), U8(121), U8(242),
+  /* 1627 S> */ B(LdaNamedProperty), R(0), U8(122), U8(244),
+  /* 1640 S> */ B(LdaNamedProperty), R(0), U8(123), U8(246),
+  /* 1653 S> */ B(LdaNamedProperty), R(0), U8(124), U8(248),
+  /* 1666 S> */ B(LdaNamedProperty), R(0), U8(125), U8(250),
+  /* 1679 S> */ B(LdaNamedProperty), R(0), U8(126), U8(252),
+  /* 1692 S> */ B(LdaNamedProperty), R(0), U8(127), U8(254),
+  /* 1703 S> */ B(LdaSmi), I8(2),
+  /* 1705 E> */ B(Wide), B(StaGlobal), U16(128), U16(256),
                 B(LdaUndefined),
-  /* 1312 S> */ B(Return),
+  /* 1710 S> */ B(Return),
 ]
 constant pool: [
-  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name640"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name641"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name642"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name643"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name644"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name645"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name646"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name647"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name648"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name649"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name650"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name651"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name652"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name653"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name654"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name655"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name656"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name657"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name658"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name659"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name660"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name661"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name662"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name663"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name664"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name665"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name666"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name667"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name668"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name669"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name670"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name671"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name672"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name673"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name674"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name675"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name676"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name677"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name678"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name679"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name680"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name681"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name682"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name683"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name684"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name685"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name686"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name687"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name688"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name689"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name690"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name691"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name692"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name693"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name694"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name695"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name696"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name697"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name698"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name699"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name700"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name701"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name702"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name703"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name704"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name705"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name706"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name707"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name708"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name709"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name710"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name711"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name712"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name713"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name714"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name715"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name716"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name717"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name718"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name719"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name720"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name721"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name722"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name723"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name724"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name725"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name726"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name727"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name728"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name729"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name730"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name731"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name732"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name733"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name734"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name735"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name736"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name737"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name738"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name739"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name740"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name741"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name742"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name743"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name744"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name745"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name746"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name747"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name748"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name749"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name750"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name751"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name752"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name753"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name754"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name755"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name756"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name757"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name758"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name759"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name760"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name761"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name762"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name763"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name764"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name765"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name766"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name767"],
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["a"],
 ]
 handlers: [
@@ -377,280 +507,410 @@ handlers: [
 ---
 snippet: "
   a = 1;
-  function f(b) {
+  function f(c) {
     'use strict';
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
-    b.name;
+    var b = {};
+    b.name768;
+    b.name769;
+    b.name770;
+    b.name771;
+    b.name772;
+    b.name773;
+    b.name774;
+    b.name775;
+    b.name776;
+    b.name777;
+    b.name778;
+    b.name779;
+    b.name780;
+    b.name781;
+    b.name782;
+    b.name783;
+    b.name784;
+    b.name785;
+    b.name786;
+    b.name787;
+    b.name788;
+    b.name789;
+    b.name790;
+    b.name791;
+    b.name792;
+    b.name793;
+    b.name794;
+    b.name795;
+    b.name796;
+    b.name797;
+    b.name798;
+    b.name799;
+    b.name800;
+    b.name801;
+    b.name802;
+    b.name803;
+    b.name804;
+    b.name805;
+    b.name806;
+    b.name807;
+    b.name808;
+    b.name809;
+    b.name810;
+    b.name811;
+    b.name812;
+    b.name813;
+    b.name814;
+    b.name815;
+    b.name816;
+    b.name817;
+    b.name818;
+    b.name819;
+    b.name820;
+    b.name821;
+    b.name822;
+    b.name823;
+    b.name824;
+    b.name825;
+    b.name826;
+    b.name827;
+    b.name828;
+    b.name829;
+    b.name830;
+    b.name831;
+    b.name832;
+    b.name833;
+    b.name834;
+    b.name835;
+    b.name836;
+    b.name837;
+    b.name838;
+    b.name839;
+    b.name840;
+    b.name841;
+    b.name842;
+    b.name843;
+    b.name844;
+    b.name845;
+    b.name846;
+    b.name847;
+    b.name848;
+    b.name849;
+    b.name850;
+    b.name851;
+    b.name852;
+    b.name853;
+    b.name854;
+    b.name855;
+    b.name856;
+    b.name857;
+    b.name858;
+    b.name859;
+    b.name860;
+    b.name861;
+    b.name862;
+    b.name863;
+    b.name864;
+    b.name865;
+    b.name866;
+    b.name867;
+    b.name868;
+    b.name869;
+    b.name870;
+    b.name871;
+    b.name872;
+    b.name873;
+    b.name874;
+    b.name875;
+    b.name876;
+    b.name877;
+    b.name878;
+    b.name879;
+    b.name880;
+    b.name881;
+    b.name882;
+    b.name883;
+    b.name884;
+    b.name885;
+    b.name886;
+    b.name887;
+    b.name888;
+    b.name889;
+    b.name890;
+    b.name891;
+    b.name892;
+    b.name893;
+    b.name894;
+    b.name895;
     a = 2;
   }
   f({name: 1});
 "
-frame size: 0
+frame size: 1
 parameter count: 2
-bytecode array length: 523
+bytecode array length: 526
 bytecodes: [
   /*   17 E> */ B(StackCheck),
-  /*   43 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(0),
-  /*   53 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(2),
-  /*   63 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(4),
-  /*   73 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(6),
-  /*   83 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(8),
-  /*   93 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(10),
-  /*  103 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(12),
-  /*  113 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(14),
-  /*  123 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(16),
-  /*  133 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(18),
-  /*  143 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(20),
-  /*  153 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(22),
-  /*  163 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(24),
-  /*  173 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(26),
-  /*  183 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(28),
-  /*  193 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(30),
-  /*  203 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(32),
-  /*  213 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(34),
-  /*  223 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(36),
-  /*  233 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(38),
-  /*  243 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(40),
-  /*  253 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(42),
-  /*  263 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(44),
-  /*  273 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(46),
-  /*  283 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(48),
-  /*  293 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(50),
-  /*  303 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(52),
-  /*  313 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(54),
-  /*  323 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(56),
-  /*  333 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(58),
-  /*  343 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(60),
-  /*  353 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(62),
-  /*  363 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(64),
-  /*  373 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(66),
-  /*  383 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(68),
-  /*  393 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(70),
-  /*  403 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(72),
-  /*  413 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(74),
-  /*  423 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(76),
-  /*  433 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(78),
-  /*  443 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(80),
-  /*  453 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(82),
-  /*  463 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(84),
-  /*  473 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(86),
-  /*  483 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(88),
-  /*  493 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(90),
-  /*  503 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(92),
-  /*  513 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(94),
-  /*  523 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(96),
-  /*  533 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(98),
-  /*  543 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(100),
-  /*  553 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(102),
-  /*  563 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(104),
-  /*  573 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(106),
-  /*  583 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(108),
-  /*  593 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(110),
-  /*  603 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(112),
-  /*  613 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(114),
-  /*  623 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(116),
-  /*  633 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(118),
-  /*  643 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(120),
-  /*  653 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(122),
-  /*  663 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(124),
-  /*  673 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(126),
-  /*  683 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(128),
-  /*  693 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(130),
-  /*  703 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(132),
-  /*  713 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(134),
-  /*  723 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(136),
-  /*  733 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(138),
-  /*  743 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(140),
-  /*  753 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(142),
-  /*  763 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(144),
-  /*  773 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(146),
-  /*  783 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(148),
-  /*  793 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(150),
-  /*  803 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(152),
-  /*  813 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(154),
-  /*  823 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(156),
-  /*  833 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(158),
-  /*  843 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(160),
-  /*  853 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(162),
-  /*  863 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(164),
-  /*  873 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(166),
-  /*  883 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(168),
-  /*  893 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(170),
-  /*  903 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(172),
-  /*  913 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(174),
-  /*  923 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(176),
-  /*  933 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(178),
-  /*  943 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(180),
-  /*  953 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(182),
-  /*  963 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(184),
-  /*  973 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(186),
-  /*  983 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(188),
-  /*  993 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(190),
-  /* 1003 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(192),
-  /* 1013 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(194),
-  /* 1023 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(196),
-  /* 1033 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(198),
-  /* 1043 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(200),
-  /* 1053 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(202),
-  /* 1063 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(204),
-  /* 1073 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(206),
-  /* 1083 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(208),
-  /* 1093 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(210),
-  /* 1103 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(212),
-  /* 1113 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(214),
-  /* 1123 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(216),
-  /* 1133 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(218),
-  /* 1143 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(220),
-  /* 1153 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(222),
-  /* 1163 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(224),
-  /* 1173 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(226),
-  /* 1183 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(228),
-  /* 1193 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(230),
-  /* 1203 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(232),
-  /* 1213 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(234),
-  /* 1223 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(236),
-  /* 1233 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(238),
-  /* 1243 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(240),
-  /* 1253 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(242),
-  /* 1263 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(244),
-  /* 1273 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(246),
-  /* 1283 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(248),
-  /* 1293 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(250),
-  /* 1303 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(252),
-  /* 1313 S> */ B(LdaNamedProperty), R(arg0), U8(0), U8(254),
-  /* 1321 S> */ B(LdaSmi), I8(2),
-  /* 1323 E> */ B(Wide), B(StaGlobal), U16(1), U16(256),
+  /*   49 S> */ B(CreateEmptyObjectLiteral),
+                B(Star), R(0),
+  /*   57 S> */ B(LdaNamedProperty), R(0), U8(0), U8(0),
+  /*   70 S> */ B(LdaNamedProperty), R(0), U8(1), U8(2),
+  /*   83 S> */ B(LdaNamedProperty), R(0), U8(2), U8(4),
+  /*   96 S> */ B(LdaNamedProperty), R(0), U8(3), U8(6),
+  /*  109 S> */ B(LdaNamedProperty), R(0), U8(4), U8(8),
+  /*  122 S> */ B(LdaNamedProperty), R(0), U8(5), U8(10),
+  /*  135 S> */ B(LdaNamedProperty), R(0), U8(6), U8(12),
+  /*  148 S> */ B(LdaNamedProperty), R(0), U8(7), U8(14),
+  /*  161 S> */ B(LdaNamedProperty), R(0), U8(8), U8(16),
+  /*  174 S> */ B(LdaNamedProperty), R(0), U8(9), U8(18),
+  /*  187 S> */ B(LdaNamedProperty), R(0), U8(10), U8(20),
+  /*  200 S> */ B(LdaNamedProperty), R(0), U8(11), U8(22),
+  /*  213 S> */ B(LdaNamedProperty), R(0), U8(12), U8(24),
+  /*  226 S> */ B(LdaNamedProperty), R(0), U8(13), U8(26),
+  /*  239 S> */ B(LdaNamedProperty), R(0), U8(14), U8(28),
+  /*  252 S> */ B(LdaNamedProperty), R(0), U8(15), U8(30),
+  /*  265 S> */ B(LdaNamedProperty), R(0), U8(16), U8(32),
+  /*  278 S> */ B(LdaNamedProperty), R(0), U8(17), U8(34),
+  /*  291 S> */ B(LdaNamedProperty), R(0), U8(18), U8(36),
+  /*  304 S> */ B(LdaNamedProperty), R(0), U8(19), U8(38),
+  /*  317 S> */ B(LdaNamedProperty), R(0), U8(20), U8(40),
+  /*  330 S> */ B(LdaNamedProperty), R(0), U8(21), U8(42),
+  /*  343 S> */ B(LdaNamedProperty), R(0), U8(22), U8(44),
+  /*  356 S> */ B(LdaNamedProperty), R(0), U8(23), U8(46),
+  /*  369 S> */ B(LdaNamedProperty), R(0), U8(24), U8(48),
+  /*  382 S> */ B(LdaNamedProperty), R(0), U8(25), U8(50),
+  /*  395 S> */ B(LdaNamedProperty), R(0), U8(26), U8(52),
+  /*  408 S> */ B(LdaNamedProperty), R(0), U8(27), U8(54),
+  /*  421 S> */ B(LdaNamedProperty), R(0), U8(28), U8(56),
+  /*  434 S> */ B(LdaNamedProperty), R(0), U8(29), U8(58),
+  /*  447 S> */ B(LdaNamedProperty), R(0), U8(30), U8(60),
+  /*  460 S> */ B(LdaNamedProperty), R(0), U8(31), U8(62),
+  /*  473 S> */ B(LdaNamedProperty), R(0), U8(32), U8(64),
+  /*  486 S> */ B(LdaNamedProperty), R(0), U8(33), U8(66),
+  /*  499 S> */ B(LdaNamedProperty), R(0), U8(34), U8(68),
+  /*  512 S> */ B(LdaNamedProperty), R(0), U8(35), U8(70),
+  /*  525 S> */ B(LdaNamedProperty), R(0), U8(36), U8(72),
+  /*  538 S> */ B(LdaNamedProperty), R(0), U8(37), U8(74),
+  /*  551 S> */ B(LdaNamedProperty), R(0), U8(38), U8(76),
+  /*  564 S> */ B(LdaNamedProperty), R(0), U8(39), U8(78),
+  /*  577 S> */ B(LdaNamedProperty), R(0), U8(40), U8(80),
+  /*  590 S> */ B(LdaNamedProperty), R(0), U8(41), U8(82),
+  /*  603 S> */ B(LdaNamedProperty), R(0), U8(42), U8(84),
+  /*  616 S> */ B(LdaNamedProperty), R(0), U8(43), U8(86),
+  /*  629 S> */ B(LdaNamedProperty), R(0), U8(44), U8(88),
+  /*  642 S> */ B(LdaNamedProperty), R(0), U8(45), U8(90),
+  /*  655 S> */ B(LdaNamedProperty), R(0), U8(46), U8(92),
+  /*  668 S> */ B(LdaNamedProperty), R(0), U8(47), U8(94),
+  /*  681 S> */ B(LdaNamedProperty), R(0), U8(48), U8(96),
+  /*  694 S> */ B(LdaNamedProperty), R(0), U8(49), U8(98),
+  /*  707 S> */ B(LdaNamedProperty), R(0), U8(50), U8(100),
+  /*  720 S> */ B(LdaNamedProperty), R(0), U8(51), U8(102),
+  /*  733 S> */ B(LdaNamedProperty), R(0), U8(52), U8(104),
+  /*  746 S> */ B(LdaNamedProperty), R(0), U8(53), U8(106),
+  /*  759 S> */ B(LdaNamedProperty), R(0), U8(54), U8(108),
+  /*  772 S> */ B(LdaNamedProperty), R(0), U8(55), U8(110),
+  /*  785 S> */ B(LdaNamedProperty), R(0), U8(56), U8(112),
+  /*  798 S> */ B(LdaNamedProperty), R(0), U8(57), U8(114),
+  /*  811 S> */ B(LdaNamedProperty), R(0), U8(58), U8(116),
+  /*  824 S> */ B(LdaNamedProperty), R(0), U8(59), U8(118),
+  /*  837 S> */ B(LdaNamedProperty), R(0), U8(60), U8(120),
+  /*  850 S> */ B(LdaNamedProperty), R(0), U8(61), U8(122),
+  /*  863 S> */ B(LdaNamedProperty), R(0), U8(62), U8(124),
+  /*  876 S> */ B(LdaNamedProperty), R(0), U8(63), U8(126),
+  /*  889 S> */ B(LdaNamedProperty), R(0), U8(64), U8(128),
+  /*  902 S> */ B(LdaNamedProperty), R(0), U8(65), U8(130),
+  /*  915 S> */ B(LdaNamedProperty), R(0), U8(66), U8(132),
+  /*  928 S> */ B(LdaNamedProperty), R(0), U8(67), U8(134),
+  /*  941 S> */ B(LdaNamedProperty), R(0), U8(68), U8(136),
+  /*  954 S> */ B(LdaNamedProperty), R(0), U8(69), U8(138),
+  /*  967 S> */ B(LdaNamedProperty), R(0), U8(70), U8(140),
+  /*  980 S> */ B(LdaNamedProperty), R(0), U8(71), U8(142),
+  /*  993 S> */ B(LdaNamedProperty), R(0), U8(72), U8(144),
+  /* 1006 S> */ B(LdaNamedProperty), R(0), U8(73), U8(146),
+  /* 1019 S> */ B(LdaNamedProperty), R(0), U8(74), U8(148),
+  /* 1032 S> */ B(LdaNamedProperty), R(0), U8(75), U8(150),
+  /* 1045 S> */ B(LdaNamedProperty), R(0), U8(76), U8(152),
+  /* 1058 S> */ B(LdaNamedProperty), R(0), U8(77), U8(154),
+  /* 1071 S> */ B(LdaNamedProperty), R(0), U8(78), U8(156),
+  /* 1084 S> */ B(LdaNamedProperty), R(0), U8(79), U8(158),
+  /* 1097 S> */ B(LdaNamedProperty), R(0), U8(80), U8(160),
+  /* 1110 S> */ B(LdaNamedProperty), R(0), U8(81), U8(162),
+  /* 1123 S> */ B(LdaNamedProperty), R(0), U8(82), U8(164),
+  /* 1136 S> */ B(LdaNamedProperty), R(0), U8(83), U8(166),
+  /* 1149 S> */ B(LdaNamedProperty), R(0), U8(84), U8(168),
+  /* 1162 S> */ B(LdaNamedProperty), R(0), U8(85), U8(170),
+  /* 1175 S> */ B(LdaNamedProperty), R(0), U8(86), U8(172),
+  /* 1188 S> */ B(LdaNamedProperty), R(0), U8(87), U8(174),
+  /* 1201 S> */ B(LdaNamedProperty), R(0), U8(88), U8(176),
+  /* 1214 S> */ B(LdaNamedProperty), R(0), U8(89), U8(178),
+  /* 1227 S> */ B(LdaNamedProperty), R(0), U8(90), U8(180),
+  /* 1240 S> */ B(LdaNamedProperty), R(0), U8(91), U8(182),
+  /* 1253 S> */ B(LdaNamedProperty), R(0), U8(92), U8(184),
+  /* 1266 S> */ B(LdaNamedProperty), R(0), U8(93), U8(186),
+  /* 1279 S> */ B(LdaNamedProperty), R(0), U8(94), U8(188),
+  /* 1292 S> */ B(LdaNamedProperty), R(0), U8(95), U8(190),
+  /* 1305 S> */ B(LdaNamedProperty), R(0), U8(96), U8(192),
+  /* 1318 S> */ B(LdaNamedProperty), R(0), U8(97), U8(194),
+  /* 1331 S> */ B(LdaNamedProperty), R(0), U8(98), U8(196),
+  /* 1344 S> */ B(LdaNamedProperty), R(0), U8(99), U8(198),
+  /* 1357 S> */ B(LdaNamedProperty), R(0), U8(100), U8(200),
+  /* 1370 S> */ B(LdaNamedProperty), R(0), U8(101), U8(202),
+  /* 1383 S> */ B(LdaNamedProperty), R(0), U8(102), U8(204),
+  /* 1396 S> */ B(LdaNamedProperty), R(0), U8(103), U8(206),
+  /* 1409 S> */ B(LdaNamedProperty), R(0), U8(104), U8(208),
+  /* 1422 S> */ B(LdaNamedProperty), R(0), U8(105), U8(210),
+  /* 1435 S> */ B(LdaNamedProperty), R(0), U8(106), U8(212),
+  /* 1448 S> */ B(LdaNamedProperty), R(0), U8(107), U8(214),
+  /* 1461 S> */ B(LdaNamedProperty), R(0), U8(108), U8(216),
+  /* 1474 S> */ B(LdaNamedProperty), R(0), U8(109), U8(218),
+  /* 1487 S> */ B(LdaNamedProperty), R(0), U8(110), U8(220),
+  /* 1500 S> */ B(LdaNamedProperty), R(0), U8(111), U8(222),
+  /* 1513 S> */ B(LdaNamedProperty), R(0), U8(112), U8(224),
+  /* 1526 S> */ B(LdaNamedProperty), R(0), U8(113), U8(226),
+  /* 1539 S> */ B(LdaNamedProperty), R(0), U8(114), U8(228),
+  /* 1552 S> */ B(LdaNamedProperty), R(0), U8(115), U8(230),
+  /* 1565 S> */ B(LdaNamedProperty), R(0), U8(116), U8(232),
+  /* 1578 S> */ B(LdaNamedProperty), R(0), U8(117), U8(234),
+  /* 1591 S> */ B(LdaNamedProperty), R(0), U8(118), U8(236),
+  /* 1604 S> */ B(LdaNamedProperty), R(0), U8(119), U8(238),
+  /* 1617 S> */ B(LdaNamedProperty), R(0), U8(120), U8(240),
+  /* 1630 S> */ B(LdaNamedProperty), R(0), U8(121), U8(242),
+  /* 1643 S> */ B(LdaNamedProperty), R(0), U8(122), U8(244),
+  /* 1656 S> */ B(LdaNamedProperty), R(0), U8(123), U8(246),
+  /* 1669 S> */ B(LdaNamedProperty), R(0), U8(124), U8(248),
+  /* 1682 S> */ B(LdaNamedProperty), R(0), U8(125), U8(250),
+  /* 1695 S> */ B(LdaNamedProperty), R(0), U8(126), U8(252),
+  /* 1708 S> */ B(LdaNamedProperty), R(0), U8(127), U8(254),
+  /* 1719 S> */ B(LdaSmi), I8(2),
+  /* 1721 E> */ B(Wide), B(StaGlobal), U16(128), U16(256),
                 B(LdaUndefined),
-  /* 1328 S> */ B(Return),
+  /* 1726 S> */ B(Return),
 ]
 constant pool: [
-  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name768"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name769"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name770"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name771"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name772"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name773"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name774"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name775"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name776"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name777"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name778"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name779"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name780"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name781"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name782"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name783"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name784"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name785"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name786"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name787"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name788"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name789"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name790"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name791"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name792"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name793"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name794"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name795"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name796"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name797"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name798"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name799"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name800"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name801"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name802"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name803"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name804"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name805"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name806"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name807"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name808"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name809"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name810"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name811"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name812"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name813"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name814"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name815"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name816"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name817"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name818"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name819"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name820"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name821"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name822"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name823"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name824"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name825"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name826"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name827"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name828"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name829"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name830"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name831"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name832"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name833"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name834"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name835"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name836"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name837"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name838"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name839"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name840"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name841"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name842"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name843"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name844"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name845"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name846"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name847"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name848"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name849"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name850"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name851"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name852"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name853"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name854"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name855"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name856"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name857"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name858"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name859"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name860"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name861"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name862"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name863"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name864"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name865"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name866"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name867"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name868"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name869"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name870"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name871"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name872"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name873"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name874"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name875"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name876"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name877"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name878"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name879"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name880"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name881"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name882"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name883"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name884"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name885"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name886"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name887"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name888"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name889"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name890"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name891"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name892"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name893"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name894"],
+  ONE_BYTE_INTERNALIZED_STRING_TYPE ["name895"],
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["a"],
 ]
 handlers: [
diff --git a/deps/v8/test/cctest/interpreter/bytecode_expectations/SuperCallAndSpread.golden b/deps/v8/test/cctest/interpreter/bytecode_expectations/SuperCallAndSpread.golden
index bb5a0da42eb1d4..39e41739e1b3b7 100644
--- a/deps/v8/test/cctest/interpreter/bytecode_expectations/SuperCallAndSpread.golden
+++ b/deps/v8/test/cctest/interpreter/bytecode_expectations/SuperCallAndSpread.golden
@@ -49,7 +49,7 @@ snippet: "
     test = new B(1, 2, 3).constructor;
   })();
 "
-frame size: 8
+frame size: 9
 parameter count: 1
 bytecode array length: 40
 bytecodes: [
@@ -65,10 +65,10 @@ bytecodes: [
                 B(Ldar), R(0),
                 B(Mov), R(2), R(7),
   /*  140 E> */ B(ConstructWithSpread), R(5), R(6), U8(2), U8(0),
-                B(Star), R(4),
+                B(Star), R(8),
                 B(Ldar), R(this),
-  /*  140 E> */ B(ThrowSuperAlreadyCalledIfNotHole),
-                B(Mov), R(4), R(this),
+                B(ThrowSuperAlreadyCalledIfNotHole),
+                B(Mov), R(8), R(this),
                 B(Ldar), R(this),
                 B(ThrowSuperNotCalledIfHole),
   /*  159 S> */ B(Return),
@@ -91,60 +91,66 @@ snippet: "
     test = new B(1, 2, 3).constructor;
   })();
 "
-frame size: 12
+frame size: 13
 parameter count: 1
-bytecode array length: 124
+bytecode array length: 137
 bytecodes: [
                 B(CreateRestParameter),
                 B(Star), R(2),
                 B(Mov), R(closure), R(1),
   /*  128 E> */ B(StackCheck),
                 B(Mov), R(2), R(3),
-  /*  140 S> */ B(CallRuntime), U16(Runtime::k_GetSuperConstructor), R(closure), U8(1),
-                B(Star), R(4),
-                B(CreateArrayLiteral), U8(0), U8(0), U8(37),
-                B(Star), R(5),
-                B(LdaConstant), U8(1),
-  /*  152 S> */ B(Star), R(6),
-                B(LdaNamedProperty), R(2), U8(2), U8(6),
-                B(Star), R(11),
-                B(CallProperty0), R(11), R(2), U8(8),
-                B(Mov), R(2), R(10),
+  /*  140 S> */ B(Ldar), R(closure),
+                B(GetSuperConstructor), R(5),
+                B(CreateEmptyArrayLiteral), U8(0),
+                B(Star), R(6),
+                B(LdaZero),
+                B(Star), R(7),
+                B(LdaSmi), I8(1),
+                B(StaKeyedProperty), R(6), R(7), U8(1),
+                B(LdaConstant), U8(0),
+  /*  152 S> */ B(Star), R(7),
+                B(LdaNamedProperty), R(2), U8(1), U8(8),
+                B(Star), R(12),
+                B(CallProperty0), R(12), R(2), U8(10),
+                B(Mov), R(2), R(11),
+                B(Mov), R(1), R(4),
                 B(JumpIfJSReceiver), U8(7),
                 B(CallRuntime), U16(Runtime::kThrowSymbolIteratorInvalid), R(0), U8(0),
+                B(Star), R(10),
+                B(LdaNamedProperty), R(10), U8(2), U8(12),
                 B(Star), R(9),
-                B(LdaNamedProperty), R(9), U8(3), U8(10),
+                B(CallProperty0), R(9), R(10), U8(14),
                 B(Star), R(8),
-                B(CallProperty0), R(8), R(9), U8(12),
-                B(Star), R(7),
                 B(JumpIfJSReceiver), U8(7),
-                B(CallRuntime), U16(Runtime::kThrowIteratorResultNotAnObject), R(7), U8(1),
-                B(LdaNamedProperty), R(7), U8(4), U8(14),
+                B(CallRuntime), U16(Runtime::kThrowIteratorResultNotAnObject), R(8), U8(1),
+                B(LdaNamedProperty), R(8), U8(3), U8(16),
                 B(JumpIfToBooleanTrue), U8(21),
-                B(LdaNamedProperty), R(7), U8(5), U8(16),
+                B(LdaNamedProperty), R(8), U8(4), U8(18),
+                B(Star), R(8),
+                B(StaInArrayLiteral), R(6), R(7), U8(3),
+                B(Ldar), R(7),
+                B(Inc), U8(5),
                 B(Star), R(7),
-                B(StaInArrayLiteral), R(5), R(6), U8(1),
-                B(Ldar), R(6),
-                B(Inc), U8(3),
-                B(Star), R(6),
                 B(JumpLoop), U8(35), I8(0),
                 B(LdaSmi), I8(1),
-                B(StaInArrayLiteral), R(5), R(6), U8(1),
-                B(Ldar), R(6),
-                B(Inc), U8(3),
-                B(Star), R(6),
-                B(Mov), R(0), R(6),
-  /*  140 E> */ B(CallJSRuntime), U8(%reflect_construct), R(4), U8(3),
-                B(Star), R(4),
+                B(StaInArrayLiteral), R(6), R(7), U8(3),
+                B(Ldar), R(7),
+                B(Inc), U8(5),
+                B(Star), R(7),
+                B(Mov), R(5), R(8),
+                B(Mov), R(6), R(9),
+                B(Mov), R(0), R(10),
+  /*  140 E> */ B(CallJSRuntime), U8(%reflect_construct), R(8), U8(3),
+                B(Star), R(11),
                 B(Ldar), R(this),
-  /*  140 E> */ B(ThrowSuperAlreadyCalledIfNotHole),
-                B(Mov), R(4), R(this),
+                B(ThrowSuperAlreadyCalledIfNotHole),
+                B(Mov), R(11), R(this),
                 B(Ldar), R(this),
                 B(ThrowSuperNotCalledIfHole),
   /*  162 S> */ B(Return),
 ]
 constant pool: [
-  TUPLE2_TYPE,
   Smi [1],
   SYMBOL_TYPE,
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["next"],
diff --git a/deps/v8/test/cctest/interpreter/bytecode_expectations/TopLevelObjectLiterals.golden b/deps/v8/test/cctest/interpreter/bytecode_expectations/TopLevelObjectLiterals.golden
index be78f1b0c9b601..e4fa07d2a0d7e9 100644
--- a/deps/v8/test/cctest/interpreter/bytecode_expectations/TopLevelObjectLiterals.golden
+++ b/deps/v8/test/cctest/interpreter/bytecode_expectations/TopLevelObjectLiterals.golden
@@ -27,11 +27,11 @@ bytecodes: [
                 B(Ldar), R(1),
   /*    8 E> */ B(StaGlobal), U8(4), U8(6),
                 B(LdaUndefined),
-  /*   33 S> */ B(Return),
+  /*   34 S> */ B(Return),
 ]
 constant pool: [
   FIXED_ARRAY_TYPE,
-  BOILERPLATE_DESCRIPTION_TYPE,
+  OBJECT_BOILERPLATE_DESCRIPTION_TYPE,
   SHARED_FUNCTION_INFO_TYPE,
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["func"],
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["a"],
diff --git a/deps/v8/test/cctest/interpreter/bytecode_expectations/TryCatch.golden b/deps/v8/test/cctest/interpreter/bytecode_expectations/TryCatch.golden
index 52c1a919801f97..b078ef048a7ffa 100644
--- a/deps/v8/test/cctest/interpreter/bytecode_expectations/TryCatch.golden
+++ b/deps/v8/test/cctest/interpreter/bytecode_expectations/TryCatch.golden
@@ -11,16 +11,15 @@ snippet: "
 "
 frame size: 2
 parameter count: 1
-bytecode array length: 30
+bytecode array length: 27
 bytecodes: [
   /*   30 E> */ B(StackCheck),
                 B(Mov), R(context), R(0),
   /*   40 S> */ B(LdaSmi), I8(1),
   /*   49 S> */ B(Return),
-                B(Jump), U8(21),
+                B(Jump), U8(18),
                 B(Star), R(1),
-                B(Ldar), R(closure),
-                B(CreateCatchContext), R(1), U8(0), U8(1),
+                B(CreateCatchContext), R(1), U8(0),
                 B(Star), R(0),
                 B(LdaTheHole),
                 B(SetPendingMessage),
@@ -32,7 +31,6 @@ bytecodes: [
   /*   75 S> */ B(Return),
 ]
 constant pool: [
-  ONE_BYTE_INTERNALIZED_STRING_TYPE ["e"],
   SCOPE_INFO_TYPE,
 ]
 handlers: [
@@ -47,16 +45,15 @@ snippet: "
 "
 frame size: 3
 parameter count: 1
-bytecode array length: 61
+bytecode array length: 55
 bytecodes: [
   /*   30 E> */ B(StackCheck),
                 B(Mov), R(context), R(1),
   /*   47 S> */ B(LdaSmi), I8(1),
                 B(Star), R(0),
-                B(Jump), U8(20),
+                B(Jump), U8(17),
                 B(Star), R(2),
-                B(Ldar), R(closure),
-  /*   49 E> */ B(CreateCatchContext), R(2), U8(0), U8(1),
+  /*   49 E> */ B(CreateCatchContext), R(2), U8(0),
                 B(Star), R(1),
                 B(LdaTheHole),
                 B(SetPendingMessage),
@@ -66,10 +63,9 @@ bytecodes: [
                 B(Mov), R(context), R(1),
   /*   75 S> */ B(LdaSmi), I8(2),
                 B(Star), R(0),
-                B(Jump), U8(24),
+                B(Jump), U8(21),
                 B(Star), R(2),
-                B(Ldar), R(closure),
-  /*   77 E> */ B(CreateCatchContext), R(2), U8(2), U8(3),
+  /*   77 E> */ B(CreateCatchContext), R(2), U8(1),
                 B(Star), R(1),
                 B(LdaTheHole),
                 B(SetPendingMessage),
@@ -82,13 +78,11 @@ bytecodes: [
   /*  103 S> */ B(Return),
 ]
 constant pool: [
-  ONE_BYTE_INTERNALIZED_STRING_TYPE ["e1"],
   SCOPE_INFO_TYPE,
-  ONE_BYTE_INTERNALIZED_STRING_TYPE ["e2"],
   SCOPE_INFO_TYPE,
 ]
 handlers: [
   [4, 8, 10],
-  [31, 35, 37],
+  [28, 32, 34],
 ]
 
diff --git a/deps/v8/test/cctest/interpreter/bytecode_expectations/TryFinally.golden b/deps/v8/test/cctest/interpreter/bytecode_expectations/TryFinally.golden
index 3aa7006e382160..22d4e0c154a4f0 100644
--- a/deps/v8/test/cctest/interpreter/bytecode_expectations/TryFinally.golden
+++ b/deps/v8/test/cctest/interpreter/bytecode_expectations/TryFinally.golden
@@ -35,7 +35,7 @@ bytecodes: [
                 B(Ldar), R(3),
   /*   72 E> */ B(SetPendingMessage),
                 B(LdaZero),
-                B(TestEqualStrictNoFeedback), R(1),
+                B(TestReferenceEqual), R(1),
                 B(JumpIfFalse), U8(5),
                 B(Ldar), R(2),
                 B(ReThrow),
@@ -55,7 +55,7 @@ snippet: "
 "
 frame size: 6
 parameter count: 1
-bytecode array length: 73
+bytecode array length: 70
 bytecodes: [
   /*   30 E> */ B(StackCheck),
   /*   42 S> */ B(LdaSmi), I8(1),
@@ -64,10 +64,9 @@ bytecodes: [
                 B(Mov), R(context), R(4),
   /*   51 S> */ B(LdaSmi), I8(2),
                 B(Star), R(0),
-                B(Jump), U8(24),
+                B(Jump), U8(21),
                 B(Star), R(5),
-                B(Ldar), R(closure),
-  /*   53 E> */ B(CreateCatchContext), R(5), U8(0), U8(1),
+  /*   53 E> */ B(CreateCatchContext), R(5), U8(0),
                 B(Star), R(4),
                 B(LdaTheHole),
                 B(SetPendingMessage),
@@ -91,7 +90,7 @@ bytecodes: [
                 B(Ldar), R(3),
   /*   92 E> */ B(SetPendingMessage),
                 B(LdaZero),
-                B(TestEqualStrictNoFeedback), R(1),
+                B(TestReferenceEqual), R(1),
                 B(JumpIfFalse), U8(5),
                 B(Ldar), R(2),
                 B(ReThrow),
@@ -99,11 +98,10 @@ bytecodes: [
   /*   99 S> */ B(Return),
 ]
 constant pool: [
-  ONE_BYTE_INTERNALIZED_STRING_TYPE ["e"],
   SCOPE_INFO_TYPE,
 ]
 handlers: [
-  [8, 39, 47],
+  [8, 36, 44],
   [11, 15, 17],
 ]
 
@@ -115,7 +113,7 @@ snippet: "
 "
 frame size: 7
 parameter count: 1
-bytecode array length: 96
+bytecode array length: 90
 bytecodes: [
   /*   30 E> */ B(StackCheck),
                 B(Mov), R(context), R(3),
@@ -123,10 +121,9 @@ bytecodes: [
                 B(Mov), R(context), R(5),
   /*   55 S> */ B(LdaSmi), I8(1),
                 B(Star), R(0),
-                B(Jump), U8(24),
+                B(Jump), U8(21),
                 B(Star), R(6),
-                B(Ldar), R(closure),
-  /*   57 E> */ B(CreateCatchContext), R(6), U8(0), U8(1),
+  /*   57 E> */ B(CreateCatchContext), R(6), U8(0),
                 B(Star), R(5),
                 B(LdaTheHole),
                 B(SetPendingMessage),
@@ -135,10 +132,9 @@ bytecodes: [
   /*   74 S> */ B(LdaSmi), I8(2),
                 B(Star), R(0),
                 B(PopContext), R(6),
-                B(Jump), U8(24),
+                B(Jump), U8(21),
                 B(Star), R(5),
-                B(Ldar), R(closure),
-  /*   76 E> */ B(CreateCatchContext), R(5), U8(0), U8(2),
+  /*   76 E> */ B(CreateCatchContext), R(5), U8(1),
                 B(Star), R(4),
                 B(LdaTheHole),
                 B(SetPendingMessage),
@@ -162,7 +158,7 @@ bytecodes: [
                 B(Ldar), R(3),
   /*  116 E> */ B(SetPendingMessage),
                 B(LdaZero),
-                B(TestEqualStrictNoFeedback), R(1),
+                B(TestReferenceEqual), R(1),
                 B(JumpIfFalse), U8(5),
                 B(Ldar), R(2),
                 B(ReThrow),
@@ -170,13 +166,12 @@ bytecodes: [
   /*  123 S> */ B(Return),
 ]
 constant pool: [
-  ONE_BYTE_INTERNALIZED_STRING_TYPE ["e"],
   SCOPE_INFO_TYPE,
   SCOPE_INFO_TYPE,
 ]
 handlers: [
-  [4, 62, 70],
-  [7, 38, 40],
+  [4, 56, 64],
+  [7, 35, 37],
   [10, 14, 16],
 ]
 
diff --git a/deps/v8/test/cctest/interpreter/bytecode_expectations/WithStatement.golden b/deps/v8/test/cctest/interpreter/bytecode_expectations/WithStatement.golden
index 80c42cbc14990b..09dfa7dbdbc005 100644
--- a/deps/v8/test/cctest/interpreter/bytecode_expectations/WithStatement.golden
+++ b/deps/v8/test/cctest/interpreter/bytecode_expectations/WithStatement.golden
@@ -11,20 +11,19 @@ snippet: "
 "
 frame size: 1
 parameter count: 1
-bytecode array length: 20
+bytecode array length: 18
 bytecodes: [
   /*   30 E> */ B(StackCheck),
   /*   34 S> */ B(CreateObjectLiteral), U8(0), U8(0), U8(41), R(0),
                 B(Ldar), R(0),
                 B(ToObject), R(0),
-                B(Ldar), R(closure),
                 B(CreateWithContext), R(0), U8(1),
                 B(PushContext), R(0),
   /*   50 S> */ B(LdaLookupSlot), U8(2),
   /*   59 S> */ B(Return),
 ]
 constant pool: [
-  BOILERPLATE_DESCRIPTION_TYPE,
+  OBJECT_BOILERPLATE_DESCRIPTION_TYPE,
   SCOPE_INFO_TYPE,
   ONE_BYTE_INTERNALIZED_STRING_TYPE ["x"],
 ]
diff --git a/deps/v8/test/cctest/interpreter/test-bytecode-generator.cc b/deps/v8/test/cctest/interpreter/test-bytecode-generator.cc
index 093a678c22caa5..561d163a692a7c 100644
--- a/deps/v8/test/cctest/interpreter/test-bytecode-generator.cc
+++ b/deps/v8/test/cctest/interpreter/test-bytecode-generator.cc
@@ -23,6 +23,8 @@ namespace interpreter {
 
 #define UNIQUE_VAR() "var a" STR(__COUNTER__) " = 0;\n"
 
+#define LOAD_UNIQUE_PROPERTY() "  b.name" STR(__COUNTER__) ";\n"
+
 #define REPEAT_2(...) __VA_ARGS__ __VA_ARGS__
 #define REPEAT_4(...) REPEAT_2(__VA_ARGS__) REPEAT_2(__VA_ARGS__)
 #define REPEAT_8(...) REPEAT_4(__VA_ARGS__) REPEAT_4(__VA_ARGS__)
@@ -66,6 +68,21 @@ namespace interpreter {
   UNIQUE_VAR()                   \
   UNIQUE_VAR()
 
+#define REPEAT_2_LOAD_UNIQUE_PROPERTY() \
+  LOAD_UNIQUE_PROPERTY() LOAD_UNIQUE_PROPERTY()
+#define REPEAT_4_LOAD_UNIQUE_PROPERTY() \
+  REPEAT_2_LOAD_UNIQUE_PROPERTY() REPEAT_2_LOAD_UNIQUE_PROPERTY()
+#define REPEAT_8_LOAD_UNIQUE_PROPERTY() \
+  REPEAT_4_LOAD_UNIQUE_PROPERTY() REPEAT_4_LOAD_UNIQUE_PROPERTY()
+#define REPEAT_16_LOAD_UNIQUE_PROPERTY() \
+  REPEAT_8_LOAD_UNIQUE_PROPERTY() REPEAT_8_LOAD_UNIQUE_PROPERTY()
+#define REPEAT_32_LOAD_UNIQUE_PROPERTY() \
+  REPEAT_16_LOAD_UNIQUE_PROPERTY() REPEAT_16_LOAD_UNIQUE_PROPERTY()
+#define REPEAT_64_LOAD_UNIQUE_PROPERTY() \
+  REPEAT_32_LOAD_UNIQUE_PROPERTY() REPEAT_32_LOAD_UNIQUE_PROPERTY()
+#define REPEAT_128_LOAD_UNIQUE_PROPERTY() \
+  REPEAT_64_LOAD_UNIQUE_PROPERTY() REPEAT_64_LOAD_UNIQUE_PROPERTY()
+
 static const char* kGoldenFileDirectory =
     "test/cctest/interpreter/bytecode_expectations/";
 
@@ -375,9 +392,8 @@ TEST(PropertyLoads) {
     "f({\"-124\" : \"test\", name : 123 })",
 
     "function f(a) {\n"
-    "  var b;\n"
-    "  b = a.name;\n"
-    REPEAT_127("  b = a.name;\n")
+    "  var b = {};\n"
+    REPEAT_128_LOAD_UNIQUE_PROPERTY()
     "  return a.name;\n"
     "}\n"
     "f({name : \"test\"})\n",
@@ -425,7 +441,8 @@ TEST(PropertyStores) {
 
     "function f(a) {\n"
     "  a.name = 1;\n"
-    REPEAT_127("  a.name = 1;\n")
+    "  var b = {};\n"
+    REPEAT_128_LOAD_UNIQUE_PROPERTY()
     "  a.name = 2;\n"
     "}\n"
     "f({name : \"test\"})\n",
@@ -433,7 +450,8 @@ TEST(PropertyStores) {
     "function f(a) {\n"
     " 'use strict';\n"
     "  a.name = 1;\n"
-    REPEAT_127("  a.name = 1;\n")
+    "  var b = {};\n"
+    REPEAT_128_LOAD_UNIQUE_PROPERTY()
     "  a.name = 2;\n"
     "}\n"
     "f({name : \"test\"})\n",
@@ -477,9 +495,10 @@ TEST(PropertyCall) {
       "f(" FUNC_ARG ", 1)",
 
       "function f(a) {\n"
-      " a.func;\n"              //
-      REPEAT_127(" a.func;\n")  //
-      " return a.func(); }\n"
+      "  var b = {};\n"
+      REPEAT_128_LOAD_UNIQUE_PROPERTY()
+      "  a.func;\n"              //
+      "  return a.func(); }\n"
       "f(" FUNC_ARG ")",
 
       "function f(a) { return a.func(1).func(2).func(3); }\n"
@@ -510,9 +529,9 @@ TEST(LoadGlobal) {
     "f()",
 
     "a = 1;\n"
-    "function f(b) {\n"
-    "  b.name;\n"
-    REPEAT_127("  b.name;\n")
+    "function f(c) {\n"
+    "  var b = {};\n"
+    REPEAT_128_LOAD_UNIQUE_PROPERTY()
     "  return a;\n"
     "}\n"
     "f({name: 1});\n",
@@ -545,18 +564,18 @@ TEST(StoreGlobal) {
     "f();\n",
 
     "a = 1;\n"
-    "function f(b) {\n"
-    "  b.name;\n"
-    REPEAT_127("  b.name;\n")
+    "function f(c) {\n"
+    "  var b = {};\n"
+    REPEAT_128_LOAD_UNIQUE_PROPERTY()
     "  a = 2;\n"
     "}\n"
     "f({name: 1});\n",
 
     "a = 1;\n"
-    "function f(b) {\n"
+    "function f(c) {\n"
     "  'use strict';\n"
-    "  b.name;\n"
-    REPEAT_127("  b.name;\n")
+    "  var b = {};\n"
+    REPEAT_128_LOAD_UNIQUE_PROPERTY()
     "  a = 2;\n"
     "}\n"
     "f({name: 1});\n",
@@ -2803,6 +2822,14 @@ TEST(TemplateLiterals) {
 #undef REPEAT_64_UNIQUE_VARS
 #undef REPEAT_128_UNIQUE_VARS
 #undef REPEAT_250_UNIQUE_VARS
+#undef LOAD_UNIQUE_PROPERTY
+#undef REPEAT_2_LOAD_UNIQUE_PROPERTY
+#undef REPEAT_4_LOAD_UNIQUE_PROPERTY
+#undef REPEAT_8_LOAD_UNIQUE_PROPERTY
+#undef REPEAT_16_LOAD_UNIQUE_PROPERTY
+#undef REPEAT_32_LOAD_UNIQUE_PROPERTY
+#undef REPEAT_64_LOAD_UNIQUE_PROPERTY
+#undef REPEAT_128_LOAD_UNIQUE_PROPERTY
 #undef FUNC_ARG
 
 }  // namespace interpreter
diff --git a/deps/v8/test/cctest/interpreter/test-interpreter.cc b/deps/v8/test/cctest/interpreter/test-interpreter.cc
index 6508fe6b279802..156927cfec2b02 100644
--- a/deps/v8/test/cctest/interpreter/test-interpreter.cc
+++ b/deps/v8/test/cctest/interpreter/test-interpreter.cc
@@ -420,10 +420,9 @@ TEST(InterpreterBinaryOpsBigInt) {
         auto callable = tester.GetCallable<>();
         Handle<Object> return_value = callable().ToHandleChecked();
         CHECK(return_value->IsBigInt());
-        Object* feedback = callable.vector()->Get(slot);
+        MaybeObject* feedback = callable.vector()->Get(slot);
         CHECK(feedback->IsSmi());
-        CHECK_EQ(BinaryOperationFeedback::kBigInt,
-                 static_cast<Smi*>(feedback)->value());
+        CHECK_EQ(BinaryOperationFeedback::kBigInt, feedback->ToSmi()->value());
       }
     }
   }
@@ -541,10 +540,9 @@ TEST(InterpreterStringAdd) {
     Handle<Object> return_value = callable().ToHandleChecked();
     CHECK(return_value->SameValue(*test_cases[i].expected_value));
 
-    Object* feedback = callable.vector()->Get(slot);
+    MaybeObject* feedback = callable.vector()->Get(slot);
     CHECK(feedback->IsSmi());
-    CHECK_EQ(test_cases[i].expected_feedback,
-             static_cast<Smi*>(feedback)->value());
+    CHECK_EQ(test_cases[i].expected_feedback, feedback->ToSmi()->value());
   }
 }
 
@@ -747,10 +745,10 @@ TEST(InterpreterBinaryOpTypeFeedback) {
     auto callable = tester.GetCallable<>();
 
     Handle<Object> return_val = callable().ToHandleChecked();
-    Object* feedback0 = callable.vector()->Get(slot0);
+    MaybeObject* feedback0 = callable.vector()->Get(slot0);
     CHECK(feedback0->IsSmi());
-    CHECK_EQ(test_case.feedback, static_cast<Smi*>(feedback0)->value());
-    CHECK(Object::Equals(test_case.result, return_val).ToChecked());
+    CHECK_EQ(test_case.feedback, feedback0->ToSmi()->value());
+    CHECK(Object::Equals(isolate, test_case.result, return_val).ToChecked());
   }
 }
 
@@ -853,10 +851,10 @@ TEST(InterpreterBinaryOpSmiTypeFeedback) {
     auto callable = tester.GetCallable<>();
 
     Handle<Object> return_val = callable().ToHandleChecked();
-    Object* feedback0 = callable.vector()->Get(slot0);
+    MaybeObject* feedback0 = callable.vector()->Get(slot0);
     CHECK(feedback0->IsSmi());
-    CHECK_EQ(test_case.feedback, static_cast<Smi*>(feedback0)->value());
-    CHECK(Object::Equals(test_case.result, return_val).ToChecked());
+    CHECK_EQ(test_case.feedback, feedback0->ToSmi()->value());
+    CHECK(Object::Equals(isolate, test_case.result, return_val).ToChecked());
   }
 }
 
@@ -924,30 +922,26 @@ TEST(InterpreterUnaryOpFeedback) {
                  test_case.bigint_feedback_value, test_case.any_feedback_value)
             .ToHandleChecked();
     USE(return_val);
-    Object* feedback0 = callable.vector()->Get(slot0);
+    MaybeObject* feedback0 = callable.vector()->Get(slot0);
     CHECK(feedback0->IsSmi());
     CHECK_EQ(BinaryOperationFeedback::kSignedSmall,
-             static_cast<Smi*>(feedback0)->value());
+             feedback0->ToSmi()->value());
 
-    Object* feedback1 = callable.vector()->Get(slot1);
+    MaybeObject* feedback1 = callable.vector()->Get(slot1);
     CHECK(feedback1->IsSmi());
-    CHECK_EQ(BinaryOperationFeedback::kNumber,
-             static_cast<Smi*>(feedback1)->value());
+    CHECK_EQ(BinaryOperationFeedback::kNumber, feedback1->ToSmi()->value());
 
-    Object* feedback2 = callable.vector()->Get(slot2);
+    MaybeObject* feedback2 = callable.vector()->Get(slot2);
     CHECK(feedback2->IsSmi());
-    CHECK_EQ(BinaryOperationFeedback::kNumber,
-             static_cast<Smi*>(feedback2)->value());
+    CHECK_EQ(BinaryOperationFeedback::kNumber, feedback2->ToSmi()->value());
 
-    Object* feedback3 = callable.vector()->Get(slot3);
+    MaybeObject* feedback3 = callable.vector()->Get(slot3);
     CHECK(feedback3->IsSmi());
-    CHECK_EQ(BinaryOperationFeedback::kBigInt,
-             static_cast<Smi*>(feedback3)->value());
+    CHECK_EQ(BinaryOperationFeedback::kBigInt, feedback3->ToSmi()->value());
 
-    Object* feedback4 = callable.vector()->Get(slot4);
+    MaybeObject* feedback4 = callable.vector()->Get(slot4);
     CHECK(feedback4->IsSmi());
-    CHECK_EQ(BinaryOperationFeedback::kAny,
-             static_cast<Smi*>(feedback4)->value());
+    CHECK_EQ(BinaryOperationFeedback::kAny, feedback4->ToSmi()->value());
   }
 }
 
@@ -990,20 +984,18 @@ TEST(InterpreterBitwiseTypeFeedback) {
     Handle<Object> return_val =
         callable(arg1, arg2, arg3, arg4).ToHandleChecked();
     USE(return_val);
-    Object* feedback0 = callable.vector()->Get(slot0);
+    MaybeObject* feedback0 = callable.vector()->Get(slot0);
     CHECK(feedback0->IsSmi());
     CHECK_EQ(BinaryOperationFeedback::kSignedSmall,
-             static_cast<Smi*>(feedback0)->value());
+             feedback0->ToSmi()->value());
 
-    Object* feedback1 = callable.vector()->Get(slot1);
+    MaybeObject* feedback1 = callable.vector()->Get(slot1);
     CHECK(feedback1->IsSmi());
-    CHECK_EQ(BinaryOperationFeedback::kNumber,
-             static_cast<Smi*>(feedback1)->value());
+    CHECK_EQ(BinaryOperationFeedback::kNumber, feedback1->ToSmi()->value());
 
-    Object* feedback2 = callable.vector()->Get(slot2);
+    MaybeObject* feedback2 = callable.vector()->Get(slot2);
     CHECK(feedback2->IsSmi());
-    CHECK_EQ(BinaryOperationFeedback::kAny,
-             static_cast<Smi*>(feedback2)->value());
+    CHECK_EQ(BinaryOperationFeedback::kAny, feedback2->ToSmi()->value());
   }
 }
 
@@ -1818,12 +1810,12 @@ TEST(InterpreterSmiComparisons) {
         auto callable = tester.GetCallable<>();
         Handle<Object> return_value = callable().ToHandleChecked();
         CHECK(return_value->IsBoolean());
-        CHECK_EQ(return_value->BooleanValue(),
+        CHECK_EQ(return_value->BooleanValue(isolate),
                  CompareC(comparison, inputs[i], inputs[j]));
-        Object* feedback = callable.vector()->Get(slot);
+        MaybeObject* feedback = callable.vector()->Get(slot);
         CHECK(feedback->IsSmi());
         CHECK_EQ(CompareOperationFeedback::kSignedSmall,
-                 static_cast<Smi*>(feedback)->value());
+                 feedback->ToSmi()->value());
       }
     }
   }
@@ -1867,12 +1859,11 @@ TEST(InterpreterHeapNumberComparisons) {
         auto callable = tester.GetCallable<>();
         Handle<Object> return_value = callable().ToHandleChecked();
         CHECK(return_value->IsBoolean());
-        CHECK_EQ(return_value->BooleanValue(),
+        CHECK_EQ(return_value->BooleanValue(isolate),
                  CompareC(comparison, inputs[i], inputs[j]));
-        Object* feedback = callable.vector()->Get(slot);
+        MaybeObject* feedback = callable.vector()->Get(slot);
         CHECK(feedback->IsSmi());
-        CHECK_EQ(CompareOperationFeedback::kNumber,
-                 static_cast<Smi*>(feedback)->value());
+        CHECK_EQ(CompareOperationFeedback::kNumber, feedback->ToSmi()->value());
       }
     }
   }
@@ -1912,10 +1903,9 @@ TEST(InterpreterBigIntComparisons) {
         auto callable = tester.GetCallable<>();
         Handle<Object> return_value = callable().ToHandleChecked();
         CHECK(return_value->IsBoolean());
-        Object* feedback = callable.vector()->Get(slot);
+        MaybeObject* feedback = callable.vector()->Get(slot);
         CHECK(feedback->IsSmi());
-        CHECK_EQ(CompareOperationFeedback::kBigInt,
-                 static_cast<Smi*>(feedback)->value());
+        CHECK_EQ(CompareOperationFeedback::kBigInt, feedback->ToSmi()->value());
       }
     }
   }
@@ -1958,15 +1948,15 @@ TEST(InterpreterStringComparisons) {
         auto callable = tester.GetCallable<>();
         Handle<Object> return_value = callable().ToHandleChecked();
         CHECK(return_value->IsBoolean());
-        CHECK_EQ(return_value->BooleanValue(),
+        CHECK_EQ(return_value->BooleanValue(isolate),
                  CompareC(comparison, inputs[i], inputs[j]));
-        Object* feedback = callable.vector()->Get(slot);
+        MaybeObject* feedback = callable.vector()->Get(slot);
         CHECK(feedback->IsSmi());
         int const expected_feedback =
             Token::IsOrderedRelationalCompareOp(comparison)
                 ? CompareOperationFeedback::kString
                 : CompareOperationFeedback::kInternalizedString;
-        CHECK_EQ(expected_feedback, static_cast<Smi*>(feedback)->value());
+        CHECK_EQ(expected_feedback, feedback->ToSmi()->value());
       }
     }
   }
@@ -2073,13 +2063,13 @@ TEST(InterpreterMixedComparisons) {
             auto callable = tester.GetCallable<>();
             Handle<Object> return_value = callable().ToHandleChecked();
             CHECK(return_value->IsBoolean());
-            CHECK_EQ(return_value->BooleanValue(),
+            CHECK_EQ(return_value->BooleanValue(isolate),
                      CompareC(comparison, lhs, rhs, true));
-            Object* feedback = callable.vector()->Get(slot);
+            MaybeObject* feedback = callable.vector()->Get(slot);
             CHECK(feedback->IsSmi());
             // Comparison with a number and string collects kAny feedback.
             CHECK_EQ(CompareOperationFeedback::kAny,
-                     static_cast<Smi*>(feedback)->value());
+                     feedback->ToSmi()->value());
           }
         }
       }
@@ -2114,7 +2104,7 @@ TEST(InterpreterStrictNotEqual) {
       Handle<Object> return_value =
           callable(lhs_obj, rhs_obj).ToHandleChecked();
       CHECK(return_value->IsBoolean());
-      CHECK_EQ(return_value->BooleanValue(),
+      CHECK_EQ(return_value->BooleanValue(isolate),
                CompareC(Token::Value::NE_STRICT, lhs, rhs, true));
     }
   }
@@ -2131,7 +2121,7 @@ TEST(InterpreterStrictNotEqual) {
       Handle<Object> return_value =
           callable(lhs_obj, rhs_obj).ToHandleChecked();
       CHECK(return_value->IsBoolean());
-      CHECK_EQ(return_value->BooleanValue(),
+      CHECK_EQ(return_value->BooleanValue(isolate),
                CompareC(Token::Value::NE_STRICT, inputs_str[i], inputs_str[j]));
     }
   }
@@ -2152,7 +2142,7 @@ TEST(InterpreterStrictNotEqual) {
       Handle<Object> return_value =
           callable(lhs_obj, rhs_obj).ToHandleChecked();
       CHECK(return_value->IsBoolean());
-      CHECK_EQ(return_value->BooleanValue(),
+      CHECK_EQ(return_value->BooleanValue(isolate),
                CompareC(Token::Value::NE_STRICT, inputs_number[i],
                         inputs_number[j]));
     }
@@ -2206,7 +2196,8 @@ TEST(InterpreterCompareTypeOf) {
     for (size_t i = 0; i < arraysize(inputs); i++) {
       Handle<Object> return_value = callable(inputs[i].first).ToHandleChecked();
       CHECK(return_value->IsBoolean());
-      CHECK_EQ(return_value->BooleanValue(), inputs[i].second == literal_flag);
+      CHECK_EQ(return_value->BooleanValue(isolate),
+               inputs[i].second == literal_flag);
     }
   }
 }
@@ -2246,7 +2237,7 @@ TEST(InterpreterInstanceOf) {
     auto callable = tester.GetCallable<>();
     Handle<Object> return_value = callable().ToHandleChecked();
     CHECK(return_value->IsBoolean());
-    CHECK_EQ(return_value->BooleanValue(), expected_value);
+    CHECK_EQ(return_value->BooleanValue(isolate), expected_value);
   }
 }
 
@@ -2282,7 +2273,7 @@ TEST(InterpreterTestIn) {
     auto callable = tester.GetCallable<>();
     Handle<Object> return_value = callable().ToHandleChecked();
     CHECK(return_value->IsBoolean());
-    CHECK_EQ(return_value->BooleanValue(), expected_value);
+    CHECK_EQ(return_value->BooleanValue(isolate), expected_value);
   }
 }
 
@@ -2305,7 +2296,7 @@ TEST(InterpreterUnaryNot) {
     auto callable = tester.GetCallable<>();
     Handle<Object> return_value = callable().ToHandleChecked();
     CHECK(return_value->IsBoolean());
-    CHECK_EQ(return_value->BooleanValue(), expected_value);
+    CHECK_EQ(return_value->BooleanValue(isolate), expected_value);
   }
 }
 
@@ -2340,7 +2331,7 @@ TEST(InterpreterUnaryNotNonBoolean) {
     auto callable = tester.GetCallable<>();
     Handle<Object> return_value = callable().ToHandleChecked();
     CHECK(return_value->IsBoolean());
-    CHECK_EQ(return_value->BooleanValue(), object_type_tuples[i].second);
+    CHECK_EQ(return_value->BooleanValue(isolate), object_type_tuples[i].second);
   }
 }
 
@@ -2412,7 +2403,7 @@ TEST(InterpreterInvokeIntrinsic) {
 
   Handle<Object> return_val = callable().ToHandleChecked();
   CHECK(return_val->IsBoolean());
-  CHECK_EQ(return_val->BooleanValue(), false);
+  CHECK_EQ(return_val->BooleanValue(isolate), false);
 }
 
 TEST(InterpreterFunctionLiteral) {
diff --git a/deps/v8/test/cctest/interpreter/test-source-positions.cc b/deps/v8/test/cctest/interpreter/test-source-positions.cc
index fa0a1db7807f8c..51dd41c720e2ee 100644
--- a/deps/v8/test/cctest/interpreter/test-source-positions.cc
+++ b/deps/v8/test/cctest/interpreter/test-source-positions.cc
@@ -171,7 +171,7 @@ Handle<BytecodeArray> OptimizedBytecodeSourcePositionTester::MakeBytecode(
           .ToLocalChecked());
   Handle<JSFunction> function =
       Handle<JSFunction>::cast(v8::Utils::OpenHandle(*api_function));
-  return handle(function->shared()->GetBytecodeArray());
+  return handle(function->shared()->GetBytecodeArray(), isolate_);
 }
 
 void OptimizedBytecodeSourcePositionTester::SetOptimizationFlags(
diff --git a/deps/v8/test/cctest/log-eq-of-logging-and-traversal.js b/deps/v8/test/cctest/log-eq-of-logging-and-traversal.js
index cc3c8184d565c7..a3831ad24c0e47 100644
--- a/deps/v8/test/cctest/log-eq-of-logging-and-traversal.js
+++ b/deps/v8/test/cctest/log-eq-of-logging-and-traversal.js
@@ -39,17 +39,17 @@ function parseState(s) {
 function LogProcessor() {
   LogReader.call(this, {
       'code-creation': {
-          parsers: [null, parseInt, parseInt, parseInt, parseInt,
-                    null, 'var-args'],
+          parsers: [parseString, parseInt, parseInt, parseInt, parseInt,
+                    parseString, parseVarArgs],
           processor: this.processCodeCreation },
       'code-move': { parsers: [parseInt, parseInt],
           processor: this.processCodeMove },
-      'code-delete': null,
+      'code-delete': parseString,
       'sfi-move': { parsers: [parseInt, parseInt],
           processor: this.processFunctionMove },
-      'shared-library': null,
-      'profiler': null,
-      'tick': null });
+      'shared-library': parseString,
+      'profiler': parseString,
+      'tick': parseString });
   this.profile = new Profile();
 
 }
diff --git a/deps/v8/test/cctest/parsing/test-parse-decision.cc b/deps/v8/test/cctest/parsing/test-parse-decision.cc
index 26caeb59521416..926d4c24e05c78 100644
--- a/deps/v8/test/cctest/parsing/test-parse-decision.cc
+++ b/deps/v8/test/cctest/parsing/test-parse-decision.cc
@@ -30,9 +30,8 @@ void GetTopLevelFunctionInfo(
   // Get the v8::internal::Script object from the API v8::Script.
   // The API object 'wraps' the compiled top-level function, not the i::Script.
   Handle<JSFunction> toplevel_fn = v8::Utils::OpenHandle(*script);
-  Handle<Script> i_script =
-      handle(Script::cast(toplevel_fn->shared()->script()));
-  SharedFunctionInfo::ScriptIterator iterator(i_script);
+  SharedFunctionInfo::ScriptIterator iterator(
+      toplevel_fn->GetIsolate(), Script::cast(toplevel_fn->shared()->script()));
 
   while (SharedFunctionInfo* shared = iterator.Next()) {
     std::unique_ptr<char[]> name = String::cast(shared->Name())->ToCString();
diff --git a/deps/v8/test/cctest/parsing/test-preparser.cc b/deps/v8/test/cctest/parsing/test-preparser.cc
index 852fc5f68cd180..8d7a430a6e0b61 100644
--- a/deps/v8/test/cctest/parsing/test-preparser.cc
+++ b/deps/v8/test/cctest/parsing/test-preparser.cc
@@ -730,23 +730,25 @@ TEST(PreParserScopeAnalysis) {
       v8::Local<v8::Value> v = CompileRun(program.start());
       i::Handle<i::Object> o = v8::Utils::OpenHandle(*v);
       i::Handle<i::JSFunction> f = i::Handle<i::JSFunction>::cast(o);
-      i::Handle<i::SharedFunctionInfo> shared = i::handle(f->shared());
+      i::Handle<i::SharedFunctionInfo> shared = i::handle(f->shared(), isolate);
 
       if (inners[inner_ix].bailout == Bailout::BAILOUT_IF_OUTER_SLOPPY &&
           !outers[outer_ix].strict_outer) {
-        CHECK(!shared->HasPreParsedScopeData());
+        CHECK(!shared->HasUncompiledDataWithPreParsedScope());
         continue;
       }
 
-      CHECK(shared->HasPreParsedScopeData());
+      CHECK(shared->HasUncompiledDataWithPreParsedScope());
       i::Handle<i::PreParsedScopeData> produced_data_on_heap(
-          i::PreParsedScopeData::cast(shared->preparsed_scope_data()));
+          shared->uncompiled_data_with_pre_parsed_scope()
+              ->pre_parsed_scope_data(),
+          isolate);
 
       // Parse the lazy function using the scope data.
-      i::ParseInfo using_scope_data(shared);
+      i::ParseInfo using_scope_data(isolate, shared);
       using_scope_data.set_lazy_compile();
       using_scope_data.consumed_preparsed_scope_data()->SetData(
-          produced_data_on_heap);
+          isolate, produced_data_on_heap);
       CHECK(i::parsing::ParseFunction(&using_scope_data, shared, isolate));
 
       // Verify that we skipped at least one function inside that scope.
@@ -759,7 +761,7 @@ TEST(PreParserScopeAnalysis) {
       CHECK(i::DeclarationScope::Analyze(&using_scope_data));
 
       // Parse the lazy function again eagerly to produce baseline data.
-      i::ParseInfo not_using_scope_data(shared);
+      i::ParseInfo not_using_scope_data(isolate, shared);
       not_using_scope_data.set_lazy_compile();
       CHECK(i::parsing::ParseFunction(&not_using_scope_data, shared, isolate));
 
@@ -799,7 +801,7 @@ TEST(Regress753896) {
   i::Handle<i::String> source = factory->InternalizeUtf8String(
       "function lazy() { let v = 0; if (true) { var v = 0; } }");
   i::Handle<i::Script> script = factory->NewScript(source);
-  i::ParseInfo info(script);
+  i::ParseInfo info(isolate, script);
 
   // We don't assert that parsing succeeded or that it failed; currently the
   // error is not detected inside lazy functions, but it might be in the future.
diff --git a/deps/v8/test/cctest/parsing/test-scanner-streams.cc b/deps/v8/test/cctest/parsing/test-scanner-streams.cc
index 1581d05a662754..6f9b58daf3d830 100644
--- a/deps/v8/test/cctest/parsing/test-scanner-streams.cc
+++ b/deps/v8/test/cctest/parsing/test-scanner-streams.cc
@@ -28,12 +28,14 @@ class ChunkSource : public v8::ScriptCompiler::ExternalSourceStream {
       chunks += strlen(chunks) + 1;
     } while (chunks_.back().len > 0);
   }
-  ChunkSource(const uint8_t* data, size_t len, bool extra_chunky)
+  ChunkSource(const uint8_t* data, size_t char_size, size_t len,
+              bool extra_chunky)
       : current_(0) {
-    // If extra_chunky, we'll use increasingly large chunk sizes.
-    // If not, we'll have a single chunk of full length.
-    size_t chunk_size = extra_chunky ? 1 : len;
-    for (size_t i = 0; i < len; i += chunk_size, chunk_size++) {
+    // If extra_chunky, we'll use increasingly large chunk sizes.  If not, we'll
+    // have a single chunk of full length. Make sure that chunks are always
+    // aligned to char-size though.
+    size_t chunk_size = extra_chunky ? char_size : len;
+    for (size_t i = 0; i < len; i += chunk_size, chunk_size += char_size) {
       chunks_.push_back({data + i, i::Min(chunk_size, len - i)});
     }
     chunks_.push_back({nullptr, 0});
@@ -315,8 +317,13 @@ void TestCharacterStreams(const char* one_byte_source, unsigned length,
     i::Handle<i::String> uc16_string(
         factory->NewExternalStringFromTwoByte(&resource).ToHandleChecked());
     std::unique_ptr<i::Utf16CharacterStream> uc16_stream(
-        i::ScannerStream::For(uc16_string, start, end));
+        i::ScannerStream::For(isolate, uc16_string, start, end));
     TestCharacterStream(one_byte_source, uc16_stream.get(), length, start, end);
+
+    // This avoids the GC from trying to free a stack allocated resource.
+    if (uc16_string->IsExternalString())
+      i::Handle<i::ExternalTwoByteString>::cast(uc16_string)
+          ->set_resource(nullptr);
   }
 
   // 1-byte external string
@@ -330,15 +337,19 @@ void TestCharacterStreams(const char* one_byte_source, unsigned length,
         factory->NewExternalStringFromOneByte(&one_byte_resource)
             .ToHandleChecked());
     std::unique_ptr<i::Utf16CharacterStream> one_byte_stream(
-        i::ScannerStream::For(ext_one_byte_string, start, end));
+        i::ScannerStream::For(isolate, ext_one_byte_string, start, end));
     TestCharacterStream(one_byte_source, one_byte_stream.get(), length, start,
                         end);
+    // This avoids the GC from trying to free a stack allocated resource.
+    if (ext_one_byte_string->IsExternalString())
+      i::Handle<i::ExternalOneByteString>::cast(ext_one_byte_string)
+          ->set_resource(nullptr);
   }
 
   // 1-byte generic i::String
   {
     std::unique_ptr<i::Utf16CharacterStream> string_stream(
-        i::ScannerStream::For(one_byte_string, start, end));
+        i::ScannerStream::For(isolate, one_byte_string, start, end));
     TestCharacterStream(one_byte_source, string_stream.get(), length, start,
                         end);
   }
@@ -348,7 +359,7 @@ void TestCharacterStreams(const char* one_byte_source, unsigned length,
     i::Handle<i::String> two_byte_string =
         factory->NewStringFromTwoByte(two_byte_vector).ToHandleChecked();
     std::unique_ptr<i::Utf16CharacterStream> two_byte_string_stream(
-        i::ScannerStream::For(two_byte_string, start, end));
+        i::ScannerStream::For(isolate, two_byte_string, start, end));
     TestCharacterStream(one_byte_source, two_byte_string_stream.get(), length,
                         start, end);
   }
@@ -362,7 +373,7 @@ void TestCharacterStreams(const char* one_byte_source, unsigned length,
     const uint8_t* data = one_byte_vector.begin();
     const uint8_t* data_end = one_byte_vector.end();
 
-    ChunkSource single_chunk(data, data_end - data, false);
+    ChunkSource single_chunk(data, 1, data_end - data, false);
     std::unique_ptr<i::Utf16CharacterStream> one_byte_streaming_stream(
         i::ScannerStream::For(&single_chunk,
                               v8::ScriptCompiler::StreamedSource::ONE_BYTE,
@@ -370,7 +381,7 @@ void TestCharacterStreams(const char* one_byte_source, unsigned length,
     TestCharacterStream(one_byte_source, one_byte_streaming_stream.get(),
                         length, start, end);
 
-    ChunkSource many_chunks(data, data_end - data, true);
+    ChunkSource many_chunks(data, 1, data_end - data, true);
     one_byte_streaming_stream.reset(i::ScannerStream::For(
         &many_chunks, v8::ScriptCompiler::StreamedSource::ONE_BYTE, nullptr));
     TestCharacterStream(one_byte_source, one_byte_streaming_stream.get(),
@@ -381,14 +392,14 @@ void TestCharacterStreams(const char* one_byte_source, unsigned length,
   {
     const uint8_t* data = one_byte_vector.begin();
     const uint8_t* data_end = one_byte_vector.end();
-    ChunkSource chunks(data, data_end - data, false);
+    ChunkSource chunks(data, 1, data_end - data, false);
     std::unique_ptr<i::Utf16CharacterStream> utf8_streaming_stream(
         i::ScannerStream::For(&chunks, v8::ScriptCompiler::StreamedSource::UTF8,
                               nullptr));
     TestCharacterStream(one_byte_source, utf8_streaming_stream.get(), length,
                         start, end);
 
-    ChunkSource many_chunks(data, data_end - data, true);
+    ChunkSource many_chunks(data, 1, data_end - data, true);
     utf8_streaming_stream.reset(i::ScannerStream::For(
         &many_chunks, v8::ScriptCompiler::StreamedSource::UTF8, nullptr));
     TestCharacterStream(one_byte_source, utf8_streaming_stream.get(), length,
@@ -401,14 +412,14 @@ void TestCharacterStreams(const char* one_byte_source, unsigned length,
         reinterpret_cast<const uint8_t*>(two_byte_vector.begin());
     const uint8_t* data_end =
         reinterpret_cast<const uint8_t*>(two_byte_vector.end());
-    ChunkSource chunks(data, data_end - data, false);
+    ChunkSource chunks(data, 2, data_end - data, false);
     std::unique_ptr<i::Utf16CharacterStream> two_byte_streaming_stream(
         i::ScannerStream::For(
             &chunks, v8::ScriptCompiler::StreamedSource::TWO_BYTE, nullptr));
     TestCharacterStream(one_byte_source, two_byte_streaming_stream.get(),
                         length, start, end);
 
-    ChunkSource many_chunks(data, data_end - data, true);
+    ChunkSource many_chunks(data, 2, data_end - data, true);
     two_byte_streaming_stream.reset(i::ScannerStream::For(
         &many_chunks, v8::ScriptCompiler::StreamedSource::TWO_BYTE, nullptr));
     TestCharacterStream(one_byte_source, two_byte_streaming_stream.get(),
@@ -450,7 +461,7 @@ TEST(Regress651333) {
     // Read len bytes from bytes, and compare against the expected unicode
     // characters. Expect kBadChar ( == Unicode replacement char == code point
     // 65533) instead of the incorrectly coded Latin1 char.
-    ChunkSource chunks(bytes, len, false);
+    ChunkSource chunks(bytes, 1, len, false);
     std::unique_ptr<i::Utf16CharacterStream> stream(i::ScannerStream::For(
         &chunks, v8::ScriptCompiler::StreamedSource::UTF8, nullptr));
     for (size_t i = 0; i < len; i++) {
diff --git a/deps/v8/test/cctest/scope-test-helper.h b/deps/v8/test/cctest/scope-test-helper.h
index b5b6df41fec35a..8c69307d3ef15e 100644
--- a/deps/v8/test/cctest/scope-test-helper.h
+++ b/deps/v8/test/cctest/scope-test-helper.h
@@ -47,8 +47,9 @@ class ScopeTestHelper {
               scope_local = scope->locals()->begin();
          baseline_local != baseline->locals()->end();
          ++baseline_local, ++scope_local) {
-      if (scope_local->mode() == VAR || scope_local->mode() == LET ||
-          scope_local->mode() == CONST) {
+      if (scope_local->mode() == VariableMode::kVar ||
+          scope_local->mode() == VariableMode::kLet ||
+          scope_local->mode() == VariableMode::kConst) {
         CompareVariables(*baseline_local, *scope_local, precise_maybe_assigned);
       }
     }
diff --git a/deps/v8/test/cctest/test-accessor-assembler.cc b/deps/v8/test/cctest/test-accessor-assembler.cc
index 0afdde390b10d8..963277bd331d71 100644
--- a/deps/v8/test/cctest/test-accessor-assembler.cc
+++ b/deps/v8/test/cctest/test-accessor-assembler.cc
@@ -118,7 +118,6 @@ Handle<Code> CreateCodeOfKind(Code::Kind kind) {
 
 TEST(TryProbeStubCache) {
   typedef CodeStubAssembler::Label Label;
-  typedef CodeStubAssembler::Variable Variable;
   Isolate* isolate(CcTest::InitIsolateOnce());
   const int kNumParams = 3;
   CodeAssemblerTester data(isolate, kNumParams);
@@ -134,14 +133,15 @@ TEST(TryProbeStubCache) {
 
     Label passed(&m), failed(&m);
 
-    Variable var_handler(&m, MachineRepresentation::kTagged);
+    CodeStubAssembler::TVariable<MaybeObject> var_handler(&m);
     Label if_handler(&m), if_miss(&m);
 
     m.TryProbeStubCache(&stub_cache, receiver, name, &if_handler, &var_handler,
                         &if_miss);
     m.BIND(&if_handler);
-    m.Branch(m.WordEqual(expected_handler, var_handler.value()), &passed,
-             &failed);
+    m.Branch(m.WordEqual(expected_handler,
+                         m.BitcastMaybeObjectToWord(var_handler.value())),
+             &passed, &failed);
 
     m.BIND(&if_miss);
     m.Branch(m.WordEqual(expected_handler, m.IntPtrConstant(0)), &passed,
@@ -217,7 +217,7 @@ TEST(TryProbeStubCache) {
     Handle<Name> name = names[index % names.size()];
     Handle<JSObject> receiver = receivers[index % receivers.size()];
     Handle<Code> handler = handlers[index % handlers.size()];
-    stub_cache.Set(*name, receiver->map(), *handler);
+    stub_cache.Set(*name, receiver->map(), MaybeObject::FromObject(*handler));
   }
 
   // Perform some queries.
@@ -227,14 +227,14 @@ TEST(TryProbeStubCache) {
     int index = rand_gen.NextInt();
     Handle<Name> name = names[index % names.size()];
     Handle<JSObject> receiver = receivers[index % receivers.size()];
-    Object* handler = stub_cache.Get(*name, receiver->map());
+    MaybeObject* handler = stub_cache.Get(*name, receiver->map());
     if (handler == nullptr) {
       queried_non_existing = true;
     } else {
       queried_existing = true;
     }
 
-    Handle<Object> expected_handler(handler, isolate);
+    Handle<Object> expected_handler(handler->GetHeapObjectOrSmi(), isolate);
     ft.CheckTrue(receiver, name, expected_handler);
   }
 
@@ -243,14 +243,14 @@ TEST(TryProbeStubCache) {
     int index2 = rand_gen.NextInt();
     Handle<Name> name = names[index1 % names.size()];
     Handle<JSObject> receiver = receivers[index2 % receivers.size()];
-    Object* handler = stub_cache.Get(*name, receiver->map());
+    MaybeObject* handler = stub_cache.Get(*name, receiver->map());
     if (handler == nullptr) {
       queried_non_existing = true;
     } else {
       queried_existing = true;
     }
 
-    Handle<Object> expected_handler(handler, isolate);
+    Handle<Object> expected_handler(handler->GetHeapObjectOrSmi(), isolate);
     ft.CheckTrue(receiver, name, expected_handler);
   }
   // Ensure we performed both kind of queries.
diff --git a/deps/v8/test/cctest/test-accessors.cc b/deps/v8/test/cctest/test-accessors.cc
index 6398c405e47bb9..a998a286426914 100644
--- a/deps/v8/test/cctest/test-accessors.cc
+++ b/deps/v8/test/cctest/test-accessors.cc
@@ -540,8 +540,7 @@ static void StackCheck(Local<String> name,
     CHECK(i != 0 || (frame->type() == i::StackFrame::EXIT));
     i::Code* code = frame->LookupCode();
     CHECK(code->IsCode());
-    i::Address pc = frame->pc();
-    CHECK(code->contains(pc));
+    CHECK(code->contains(frame->pc()));
     iter.Advance();
   }
 }
diff --git a/deps/v8/test/cctest/test-api-accessors.cc b/deps/v8/test/cctest/test-api-accessors.cc
index f15a871b0c37ed..a5703012134ad4 100644
--- a/deps/v8/test/cctest/test-api-accessors.cc
+++ b/deps/v8/test/cctest/test-api-accessors.cc
@@ -231,12 +231,18 @@ TEST(CachedAccessorOnGlobalObject) {
 
 namespace {
 
+// Getter return value should be non-null to trigger lazy property paths.
 static void Getter(v8::Local<v8::Name> name,
-                   const v8::PropertyCallbackInfo<v8::Value>& info) {}
+                   const v8::PropertyCallbackInfo<v8::Value>& info) {
+  info.GetReturnValue().Set(v8_str("return value"));
+}
+
+static void StringGetter(v8::Local<v8::String> name,
+                         const v8::PropertyCallbackInfo<v8::Value>& info) {}
 
 static void Setter(v8::Local<v8::String> name, v8::Local<v8::Value> value,
                    const v8::PropertyCallbackInfo<void>& info) {}
-}
+}  // namespace
 
 // Re-declaration of non-configurable accessors should throw.
 TEST(RedeclareAccessor) {
@@ -352,3 +358,86 @@ TEST(AccessorSetLazyDataPropertyHasNoSideEffect) {
                   ->Int32Value(env.local())
                   .FromJust());
 }
+
+TEST(ObjectTemplateSetAccessorHasNoSideEffect) {
+  LocalContext env;
+  v8::Isolate* isolate = env->GetIsolate();
+  v8::HandleScope scope(isolate);
+
+  v8::Local<v8::ObjectTemplate> templ = v8::ObjectTemplate::New(isolate);
+  templ->SetAccessor(v8_str("foo"), StringGetter);
+  templ->SetAccessor(v8_str("foo2"), StringGetter, 0, v8::Local<v8::Value>(),
+                     v8::AccessControl::DEFAULT, v8::PropertyAttribute::None,
+                     v8::Local<v8::AccessorSignature>(),
+                     v8::SideEffectType::kHasNoSideEffect);
+  v8::Local<v8::Object> obj = templ->NewInstance(env.local()).ToLocalChecked();
+  CHECK(env->Global()->Set(env.local(), v8_str("obj"), obj).FromJust());
+
+  CHECK(v8::debug::EvaluateGlobal(isolate, v8_str("obj.foo"), true).IsEmpty());
+  v8::debug::EvaluateGlobal(isolate, v8_str("obj.foo2"), true).ToLocalChecked();
+
+  // Check that setter is not whitelisted.
+  v8::TryCatch try_catch(isolate);
+  CHECK(v8::debug::EvaluateGlobal(isolate, v8_str("obj.foo2 = 1"), true)
+            .IsEmpty());
+  CHECK(try_catch.HasCaught());
+  CHECK_NE(1, v8::debug::EvaluateGlobal(isolate, v8_str("obj.foo2"), false)
+                  .ToLocalChecked()
+                  ->Int32Value(env.local())
+                  .FromJust());
+}
+
+TEST(ObjectTemplateSetNativePropertyHasNoSideEffect) {
+  LocalContext env;
+  v8::Isolate* isolate = env->GetIsolate();
+  v8::HandleScope scope(isolate);
+
+  v8::Local<v8::ObjectTemplate> templ = v8::ObjectTemplate::New(isolate);
+  templ->SetNativeDataProperty(v8_str("foo"), Getter);
+  templ->SetNativeDataProperty(
+      v8_str("foo2"), Getter, 0, v8::Local<v8::Value>(),
+      v8::PropertyAttribute::None, v8::Local<v8::AccessorSignature>(),
+      v8::AccessControl::DEFAULT, v8::SideEffectType::kHasNoSideEffect);
+  v8::Local<v8::Object> obj = templ->NewInstance(env.local()).ToLocalChecked();
+  CHECK(env->Global()->Set(env.local(), v8_str("obj"), obj).FromJust());
+
+  CHECK(v8::debug::EvaluateGlobal(isolate, v8_str("obj.foo"), true).IsEmpty());
+  v8::debug::EvaluateGlobal(isolate, v8_str("obj.foo2"), true).ToLocalChecked();
+
+  // Check that setter is not whitelisted.
+  v8::TryCatch try_catch(isolate);
+  CHECK(v8::debug::EvaluateGlobal(isolate, v8_str("obj.foo2 = 1"), true)
+            .IsEmpty());
+  CHECK(try_catch.HasCaught());
+  CHECK_NE(1, v8::debug::EvaluateGlobal(isolate, v8_str("obj.foo2"), false)
+                  .ToLocalChecked()
+                  ->Int32Value(env.local())
+                  .FromJust());
+}
+
+TEST(ObjectTemplateSetLazyPropertyHasNoSideEffect) {
+  LocalContext env;
+  v8::Isolate* isolate = env->GetIsolate();
+  v8::HandleScope scope(isolate);
+
+  v8::Local<v8::ObjectTemplate> templ = v8::ObjectTemplate::New(isolate);
+  templ->SetLazyDataProperty(v8_str("foo"), Getter);
+  templ->SetLazyDataProperty(v8_str("foo2"), Getter, v8::Local<v8::Value>(),
+                             v8::PropertyAttribute::None,
+                             v8::SideEffectType::kHasNoSideEffect);
+  v8::Local<v8::Object> obj = templ->NewInstance(env.local()).ToLocalChecked();
+  CHECK(env->Global()->Set(env.local(), v8_str("obj"), obj).FromJust());
+
+  CHECK(v8::debug::EvaluateGlobal(isolate, v8_str("obj.foo"), true).IsEmpty());
+  v8::debug::EvaluateGlobal(isolate, v8_str("obj.foo2"), true).ToLocalChecked();
+
+  // Check that setter is not whitelisted.
+  v8::TryCatch try_catch(isolate);
+  CHECK(v8::debug::EvaluateGlobal(isolate, v8_str("obj.foo2 = 1"), true)
+            .IsEmpty());
+  CHECK(try_catch.HasCaught());
+  CHECK_NE(1, v8::debug::EvaluateGlobal(isolate, v8_str("obj.foo2"), false)
+                  .ToLocalChecked()
+                  ->Int32Value(env.local())
+                  .FromJust());
+}
diff --git a/deps/v8/test/cctest/test-api-interceptors.cc b/deps/v8/test/cctest/test-api-interceptors.cc
index 9a5734a9502070..2c7feb13418873 100644
--- a/deps/v8/test/cctest/test-api-interceptors.cc
+++ b/deps/v8/test/cctest/test-api-interceptors.cc
@@ -1334,7 +1334,8 @@ THREADED_TEST(InterceptorLoadGlobalICGlobalWithInterceptor) {
       v8::Utils::OpenHandle<Object, i::JSReceiver>(context->Global());
   CHECK(global_proxy->IsJSGlobalProxy());
   i::Handle<i::JSGlobalObject> global(
-      i::JSGlobalObject::cast(global_proxy->map()->prototype()));
+      i::JSGlobalObject::cast(global_proxy->map()->prototype()),
+      global_proxy->GetIsolate());
   CHECK(global->map()->has_named_interceptor());
 
   v8::Local<Value> value = CompileRun(
@@ -1397,7 +1398,8 @@ THREADED_TEST(InterceptorLoadICGlobalWithInterceptor) {
       v8::Utils::OpenHandle<Object, i::JSReceiver>(context->Global());
   CHECK(global_proxy->IsJSGlobalProxy());
   i::Handle<i::JSGlobalObject> global(
-      i::JSGlobalObject::cast(global_proxy->map()->prototype()));
+      i::JSGlobalObject::cast(global_proxy->map()->prototype()),
+      global_proxy->GetIsolate());
   CHECK(global->map()->has_named_interceptor());
 
   ExpectInt32(
@@ -2944,7 +2946,8 @@ void SloppyArgsIndexedPropertyEnumerator(
   // Have to populate the handle manually, as it's not Cast-able.
   i::Handle<i::JSReceiver> o =
       v8::Utils::OpenHandle<Object, i::JSReceiver>(result);
-  i::Handle<i::JSArray> array(reinterpret_cast<i::JSArray*>(*o));
+  i::Handle<i::JSArray> array(reinterpret_cast<i::JSArray*>(*o),
+                              o->GetIsolate());
   info.GetReturnValue().Set(v8::Utils::ToLocal(array));
 }
 
diff --git a/deps/v8/test/cctest/test-api.cc b/deps/v8/test/cctest/test-api.cc
index 637dc7d2062f9a..55e5ecdcfe01d9 100644
--- a/deps/v8/test/cctest/test-api.cc
+++ b/deps/v8/test/cctest/test-api.cc
@@ -51,6 +51,8 @@
 #include "src/heap/local-allocator.h"
 #include "src/lookup.h"
 #include "src/objects-inl.h"
+#include "src/objects/hash-table-inl.h"
+#include "src/objects/js-promise-inl.h"
 #include "src/parsing/preparse-data.h"
 #include "src/profiler/cpu-profiler.h"
 #include "src/unicode-inl.h"
@@ -97,7 +99,6 @@ using ::v8::Value;
   }                                                                  \
   THREADED_TEST(Name)
 
-
 void RunWithProfiler(void (*test)()) {
   LocalContext env;
   v8::HandleScope scope(env->GetIsolate());
@@ -786,8 +787,8 @@ THREADED_TEST(NewExternalForVeryLongString) {
   }
 }
 
-
-THREADED_TEST(ScavengeExternalString) {
+TEST(ScavengeExternalString) {
+  ManualGCScope manual_gc_scope;
   i::FLAG_stress_compaction = false;
   i::FLAG_gc_global = false;
   int dispose_count = 0;
@@ -802,7 +803,7 @@ THREADED_TEST(ScavengeExternalString) {
             .ToLocalChecked();
     i::Handle<i::String> istring = v8::Utils::OpenHandle(*string);
     CcTest::CollectGarbage(i::NEW_SPACE);
-    in_new_space = CcTest::heap()->InNewSpace(*istring);
+    in_new_space = i::Heap::InNewSpace(*istring);
     CHECK(in_new_space || CcTest::heap()->old_space()->Contains(*istring));
     CHECK_EQ(0, dispose_count);
   }
@@ -810,8 +811,8 @@ THREADED_TEST(ScavengeExternalString) {
   CHECK_EQ(1, dispose_count);
 }
 
-
-THREADED_TEST(ScavengeExternalOneByteString) {
+TEST(ScavengeExternalOneByteString) {
+  ManualGCScope manual_gc_scope;
   i::FLAG_stress_compaction = false;
   i::FLAG_gc_global = false;
   int dispose_count = 0;
@@ -826,7 +827,7 @@ THREADED_TEST(ScavengeExternalOneByteString) {
             .ToLocalChecked();
     i::Handle<i::String> istring = v8::Utils::OpenHandle(*string);
     CcTest::CollectGarbage(i::NEW_SPACE);
-    in_new_space = CcTest::heap()->InNewSpace(*istring);
+    in_new_space = i::Heap::InNewSpace(*istring);
     CHECK(in_new_space || CcTest::heap()->old_space()->Contains(*istring));
     CHECK_EQ(0, dispose_count);
   }
@@ -1516,9 +1517,6 @@ THREADED_TEST(TinyInteger) {
   int32_t value = 239;
   Local<v8::Integer> value_obj = v8::Integer::New(isolate, value);
   CHECK_EQ(static_cast<int64_t>(value), value_obj->Value());
-
-  value_obj = v8::Integer::New(isolate, value);
-  CHECK_EQ(static_cast<int64_t>(value), value_obj->Value());
 }
 
 
@@ -1535,9 +1533,6 @@ THREADED_TEST(BigSmiInteger) {
 
     Local<v8::Integer> value_obj = v8::Integer::New(isolate, value);
     CHECK_EQ(static_cast<int64_t>(value), value_obj->Value());
-
-    value_obj = v8::Integer::New(isolate, value);
-    CHECK_EQ(static_cast<int64_t>(value), value_obj->Value());
   }
 }
 
@@ -1558,9 +1553,6 @@ THREADED_TEST(BigInteger) {
 
     Local<v8::Integer> value_obj = v8::Integer::New(isolate, value);
     CHECK_EQ(static_cast<int64_t>(value), value_obj->Value());
-
-    value_obj = v8::Integer::New(isolate, value);
-    CHECK_EQ(static_cast<int64_t>(value), value_obj->Value());
   }
 }
 
@@ -1574,9 +1566,6 @@ THREADED_TEST(TinyUnsignedInteger) {
 
   Local<v8::Integer> value_obj = v8::Integer::NewFromUnsigned(isolate, value);
   CHECK_EQ(static_cast<int64_t>(value), value_obj->Value());
-
-  value_obj = v8::Integer::NewFromUnsigned(isolate, value);
-  CHECK_EQ(static_cast<int64_t>(value), value_obj->Value());
 }
 
 
@@ -1591,9 +1580,6 @@ THREADED_TEST(BigUnsignedSmiInteger) {
 
   Local<v8::Integer> value_obj = v8::Integer::NewFromUnsigned(isolate, value);
   CHECK_EQ(static_cast<int64_t>(value), value_obj->Value());
-
-  value_obj = v8::Integer::NewFromUnsigned(isolate, value);
-  CHECK_EQ(static_cast<int64_t>(value), value_obj->Value());
 }
 
 
@@ -1608,9 +1594,6 @@ THREADED_TEST(BigUnsignedInteger) {
 
   Local<v8::Integer> value_obj = v8::Integer::NewFromUnsigned(isolate, value);
   CHECK_EQ(static_cast<int64_t>(value), value_obj->Value());
-
-  value_obj = v8::Integer::NewFromUnsigned(isolate, value);
-  CHECK_EQ(static_cast<int64_t>(value), value_obj->Value());
 }
 
 
@@ -1625,9 +1608,6 @@ THREADED_TEST(OutOfSignedRangeUnsignedInteger) {
 
   Local<v8::Integer> value_obj = v8::Integer::NewFromUnsigned(isolate, value);
   CHECK_EQ(static_cast<int64_t>(value), value_obj->Value());
-
-  value_obj = v8::Integer::NewFromUnsigned(isolate, value);
-  CHECK_EQ(static_cast<int64_t>(value), value_obj->Value());
 }
 
 
@@ -2761,6 +2741,7 @@ THREADED_TEST(InternalFields) {
 TEST(InternalFieldsSubclassing) {
   LocalContext env;
   v8::Isolate* isolate = env->GetIsolate();
+  i::Isolate* i_isolate = reinterpret_cast<i::Isolate*>(isolate);
   v8::HandleScope scope(isolate);
   for (int nof_embedder_fields = 0;
        nof_embedder_fields < i::JSObject::kMaxEmbedderFields;
@@ -2838,9 +2819,9 @@ TEST(InternalFieldsSubclassing) {
       i::Handle<i::JSObject> i_value =
           i::Handle<i::JSObject>::cast(v8::Utils::OpenHandle(*value));
 #ifdef VERIFY_HEAP
-      i_value->HeapObjectVerify();
-      i_value->map()->HeapObjectVerify();
-      i_value->map()->FindRootMap()->HeapObjectVerify();
+      i_value->HeapObjectVerify(i_isolate);
+      i_value->map()->HeapObjectVerify(i_isolate);
+      i_value->map()->FindRootMap(i_isolate)->HeapObjectVerify(i_isolate);
 #endif
       CHECK_EQ(nof_embedder_fields, value->InternalFieldCount());
       if (in_object_only) {
@@ -2850,7 +2831,8 @@ TEST(InternalFieldsSubclassing) {
       }
 
       // Make Sure we get the precise property count.
-      i_value->map()->FindRootMap()->CompleteInobjectSlackTracking();
+      i_value->map()->FindRootMap(i_isolate)->CompleteInobjectSlackTracking(
+          i_isolate);
       // TODO(cbruni): fix accounting to make this condition true.
       // CHECK_EQ(0, i_value->map()->UnusedPropertyFields());
       if (in_object_only) {
@@ -8288,12 +8270,12 @@ static int StrNCmp16(uint16_t* a, uint16_t* b, int n) {
   }
 }
 
-
-int GetUtf8Length(Local<String> str) {
+int GetUtf8Length(v8::Isolate* isolate, Local<String> str) {
   int len = str->Utf8Length();
   if (len < 0) {
+    i::Isolate* i_isolate = reinterpret_cast<i::Isolate*>(isolate);
     i::Handle<i::String> istr(v8::Utils::OpenHandle(*str));
-    i::String::Flatten(istr);
+    i::String::Flatten(i_isolate, istr);
     len = str->Utf8Length();
   }
   return len;
@@ -8459,7 +8441,7 @@ THREADED_TEST(StringWrite) {
   CHECK_EQ(0, charlen);
 
   memset(utf8buf, 0x1, sizeof(utf8buf));
-  len = GetUtf8Length(left_tree);
+  len = GetUtf8Length(context->GetIsolate(), left_tree);
   int utf8_expected =
       (0x80 + (0x800 - 0x80) * 2 + (0xD800 - 0x800) * 3) / kStride;
   CHECK_EQ(utf8_expected, len);
@@ -8473,7 +8455,7 @@ THREADED_TEST(StringWrite) {
   CHECK_EQ(1, utf8buf[utf8_expected]);
 
   memset(utf8buf, 0x1, sizeof(utf8buf));
-  len = GetUtf8Length(right_tree);
+  len = GetUtf8Length(context->GetIsolate(), right_tree);
   CHECK_EQ(utf8_expected, len);
   len = right_tree->WriteUtf8(utf8buf, utf8_expected, &charlen);
   CHECK_EQ(utf8_expected, len);
@@ -8638,7 +8620,7 @@ static void Utf16Helper(
         Local<v8::String>::Cast(a->Get(context.local(), i).ToLocalChecked());
     Local<v8::Number> expected_len = Local<v8::Number>::Cast(
         alens->Get(context.local(), i).ToLocalChecked());
-    int length = GetUtf8Length(string);
+    int length = GetUtf8Length(context->GetIsolate(), string);
     CHECK_EQ(static_cast<int>(expected_len->Value()), length);
   }
 }
@@ -13315,6 +13297,96 @@ TEST(FunctionNewHasNoSideEffect) {
   v8::debug::EvaluateGlobal(isolate, v8_str("new f2()"), true).ToLocalChecked();
 }
 
+// These handlers instantiate a function the embedder considers safe in some
+// cases (e.g. "building object wrappers"), but those functions themselves were
+// not explicitly marked as side-effect-free.
+static void DefaultConstructHandler(
+    const v8::FunctionCallbackInfo<v8::Value>& info) {
+  v8::Local<v8::Context> context = info.GetIsolate()->GetCurrentContext();
+  v8::Context::Scope context_scope(context);
+  v8::MaybeLocal<v8::Object> instance = Function::New(context, EmptyHandler)
+                                            .ToLocalChecked()
+                                            ->NewInstance(context, 0, nullptr);
+  USE(instance);
+}
+
+static void NoSideEffectConstructHandler(
+    const v8::FunctionCallbackInfo<v8::Value>& info) {
+  v8::Local<v8::Context> context = info.GetIsolate()->GetCurrentContext();
+  v8::Context::Scope context_scope(context);
+  v8::MaybeLocal<v8::Object> instance =
+      Function::New(context, EmptyHandler)
+          .ToLocalChecked()
+          ->NewInstanceWithSideEffectType(context, 0, nullptr,
+                                          v8::SideEffectType::kHasNoSideEffect);
+  USE(instance);
+}
+
+static void NoSideEffectAndSideEffectConstructHandler(
+    const v8::FunctionCallbackInfo<v8::Value>& info) {
+  v8::Local<v8::Context> context = info.GetIsolate()->GetCurrentContext();
+  v8::Context::Scope context_scope(context);
+  // Constructs an instance in a side-effect-free way, followed by another with
+  // side effects.
+  v8::MaybeLocal<v8::Object> instance =
+      Function::New(context, EmptyHandler)
+          .ToLocalChecked()
+          ->NewInstanceWithSideEffectType(context, 0, nullptr,
+                                          v8::SideEffectType::kHasNoSideEffect);
+  v8::MaybeLocal<v8::Object> instance2 = Function::New(context, EmptyHandler)
+                                             .ToLocalChecked()
+                                             ->NewInstance(context, 0, nullptr);
+  USE(instance);
+  USE(instance2);
+}
+
+TEST(FunctionNewInstanceHasNoSideEffect) {
+  v8::Isolate* isolate = CcTest::isolate();
+  v8::HandleScope scope(isolate);
+  LocalContext context;
+
+  // A whitelisted function that creates a new object with both side-effect
+  // free/full instantiations. Should throw.
+  Local<Function> func0 =
+      Function::New(context.local(), NoSideEffectAndSideEffectConstructHandler,
+                    Local<Value>(), 0, v8::ConstructorBehavior::kAllow,
+                    v8::SideEffectType::kHasNoSideEffect)
+          .ToLocalChecked();
+  CHECK(context->Global()->Set(context.local(), v8_str("f"), func0).FromJust());
+  CHECK(v8::debug::EvaluateGlobal(isolate, v8_str("f()"), true).IsEmpty());
+
+  // A whitelisted function that creates a new object. Should throw.
+  Local<Function> func =
+      Function::New(context.local(), DefaultConstructHandler, Local<Value>(), 0,
+                    v8::ConstructorBehavior::kAllow,
+                    v8::SideEffectType::kHasNoSideEffect)
+          .ToLocalChecked();
+  CHECK(context->Global()->Set(context.local(), v8_str("f"), func).FromJust());
+  CHECK(v8::debug::EvaluateGlobal(isolate, v8_str("f()"), true).IsEmpty());
+
+  // A whitelisted function that creates a new object with explicit intent to
+  // have no side-effects (e.g. building an "object wrapper"). Should not throw.
+  Local<Function> func2 =
+      Function::New(context.local(), NoSideEffectConstructHandler,
+                    Local<Value>(), 0, v8::ConstructorBehavior::kAllow,
+                    v8::SideEffectType::kHasNoSideEffect)
+          .ToLocalChecked();
+  CHECK(
+      context->Global()->Set(context.local(), v8_str("f2"), func2).FromJust());
+  v8::debug::EvaluateGlobal(isolate, v8_str("f2()"), true).ToLocalChecked();
+
+  // Check that side effect skipping did not leak outside to future evaluations.
+  Local<Function> func3 =
+      Function::New(context.local(), EmptyHandler).ToLocalChecked();
+  CHECK(
+      context->Global()->Set(context.local(), v8_str("f3"), func3).FromJust());
+  CHECK(v8::debug::EvaluateGlobal(isolate, v8_str("f3()"), true).IsEmpty());
+
+  // Check that using side effect free NewInstance works in normal evaluation
+  // (without throwOnSideEffect).
+  v8::debug::EvaluateGlobal(isolate, v8_str("f2()"), false).ToLocalChecked();
+}
+
 TEST(CallHandlerAsFunctionHasNoSideEffectNotSupported) {
   v8::Isolate* isolate = CcTest::isolate();
   v8::HandleScope scope(isolate);
@@ -13334,7 +13406,8 @@ TEST(CallHandlerAsFunctionHasNoSideEffectNotSupported) {
   i::CallHandlerInfo* handler_info =
       i::CallHandlerInfo::cast(cons->instance_call_handler());
   CHECK(!handler_info->IsSideEffectFreeCallHandlerInfo());
-  handler_info->set_map(heap->side_effect_free_call_handler_info_map());
+  handler_info->set_map(
+      i::ReadOnlyRoots(heap).side_effect_free_call_handler_info_map());
   CHECK(v8::debug::EvaluateGlobal(isolate, v8_str("obj()"), true).IsEmpty());
 }
 
@@ -14460,8 +14533,8 @@ void SetFunctionEntryHookTest::OnJitEvent(const v8::JitCodeEvent* event) {
 void SetFunctionEntryHookTest::OnEntryHook(
     uintptr_t function, uintptr_t return_addr_location) {
   // Get the function's code object.
-  i::Code* function_code = i::Code::GetCodeFromTargetAddress(
-      reinterpret_cast<i::Address>(function));
+  i::Code* function_code =
+      i::Code::GetCodeFromTargetAddress(static_cast<i::Address>(function));
   CHECK_NOT_NULL(function_code);
 
   // Then try and look up the caller's code object.
@@ -14470,7 +14543,7 @@ void SetFunctionEntryHookTest::OnEntryHook(
   // Count the invocation.
   SymbolInfo* caller_symbol = FindSymbolForAddr(caller);
   SymbolInfo* function_symbol =
-      FindSymbolForAddr(reinterpret_cast<i::Address>(function));
+      FindSymbolForAddr(static_cast<i::Address>(function));
   ++invocations_[std::make_pair(caller_symbol, function_symbol)];
 
   if (!bar_func_.is_null() && function_code == bar_func_->code()) {
@@ -14613,8 +14686,13 @@ void SetFunctionEntryHookTest::RunTest() {
       CHECK_LE(202, CountInvocations(nullptr, "InterpreterEntryTrampoline"));
     }
 
-    // Verify that we have an entry hook on some specific stubs.
-    CHECK_NE(0, CountInvocations(nullptr, "CEntryStub"));
+    // Verify that we have an entry hook on some specific stubs and builtins.
+    CHECK_NE(0, CountInvocations(
+                    nullptr,
+                    "CEntry_Return1_DontSaveFPRegs_ArgvOnStack_NoBuiltinExit"));
+    CHECK_NE(0, CountInvocations(
+                    nullptr,
+                    "CEntry_Return1_DontSaveFPRegs_ArgvOnStack_BuiltinExit"));
     CHECK_NE(0, CountInvocations(nullptr, "JSEntryStub"));
     CHECK_NE(0, CountInvocations(nullptr, "JSEntryTrampoline"));
   }
@@ -15543,6 +15621,8 @@ class OneByteVectorResource : public v8::String::ExternalOneByteStringResource {
   virtual ~OneByteVectorResource() {}
   virtual size_t length() const { return data_.length(); }
   virtual const char* data() const { return data_.start(); }
+  virtual void Dispose() {}
+
  private:
   i::Vector<const char> data_;
 };
@@ -15555,6 +15635,8 @@ class UC16VectorResource : public v8::String::ExternalStringResource {
   virtual ~UC16VectorResource() {}
   virtual size_t length() const { return data_.length(); }
   virtual const i::uc16* data() const { return data_.start(); }
+  virtual void Dispose() {}
+
  private:
   i::Vector<const i::uc16> data_;
 };
@@ -15564,19 +15646,20 @@ static void MorphAString(i::String* string,
                          OneByteVectorResource* one_byte_resource,
                          UC16VectorResource* uc16_resource) {
   CHECK(i::StringShape(string).IsExternal());
+  i::ReadOnlyRoots roots(CcTest::heap());
   if (string->IsOneByteRepresentation()) {
     // Check old map is not internalized or long.
-    CHECK(string->map() == CcTest::heap()->external_one_byte_string_map());
+    CHECK(string->map() == roots.external_one_byte_string_map());
     // Morph external string to be TwoByte string.
-    string->set_map(CcTest::heap()->external_string_map());
+    string->set_map(roots.external_string_map());
     i::ExternalTwoByteString* morphed =
          i::ExternalTwoByteString::cast(string);
     morphed->set_resource(uc16_resource);
   } else {
     // Check old map is not internalized or long.
-    CHECK(string->map() == CcTest::heap()->external_string_map());
+    CHECK(string->map() == roots.external_string_map());
     // Morph external string to be one-byte string.
-    string->set_map(CcTest::heap()->external_one_byte_string_map());
+    string->set_map(roots.external_one_byte_string_map());
     i::ExternalOneByteString* morphed = i::ExternalOneByteString::cast(string);
     morphed->set_resource(one_byte_resource);
   }
@@ -15597,15 +15680,14 @@ THREADED_TEST(MorphCompositeStringTest) {
     OneByteVectorResource one_byte_resource(
         i::Vector<const char>(c_string, i::StrLength(c_string)));
     UC16VectorResource uc16_resource(
-        i::Vector<const uint16_t>(two_byte_string,
-                                  i::StrLength(c_string)));
+        i::Vector<const uint16_t>(two_byte_string, i::StrLength(c_string)));
 
-    Local<String> lhs(
-        v8::Utils::ToLocal(factory->NewExternalStringFromOneByte(
-                                        &one_byte_resource).ToHandleChecked()));
-    Local<String> rhs(
-        v8::Utils::ToLocal(factory->NewExternalStringFromOneByte(
-                                        &one_byte_resource).ToHandleChecked()));
+    Local<String> lhs(v8::Utils::ToLocal(
+        factory->NewExternalStringFromOneByte(&one_byte_resource)
+            .ToHandleChecked()));
+    Local<String> rhs(v8::Utils::ToLocal(
+        factory->NewExternalStringFromOneByte(&one_byte_resource)
+            .ToHandleChecked()));
 
     CHECK(env->Global()->Set(env.local(), v8_str("lhs"), lhs).FromJust());
     CHECK(env->Global()->Set(env.local(), v8_str("rhs"), rhs).FromJust());
@@ -15618,10 +15700,10 @@ THREADED_TEST(MorphCompositeStringTest) {
     CHECK(lhs->IsOneByte());
     CHECK(rhs->IsOneByte());
 
-    MorphAString(*v8::Utils::OpenHandle(*lhs), &one_byte_resource,
-                 &uc16_resource);
-    MorphAString(*v8::Utils::OpenHandle(*rhs), &one_byte_resource,
-                 &uc16_resource);
+    i::String* ilhs = *v8::Utils::OpenHandle(*lhs);
+    i::String* irhs = *v8::Utils::OpenHandle(*rhs);
+    MorphAString(ilhs, &one_byte_resource, &uc16_resource);
+    MorphAString(irhs, &one_byte_resource, &uc16_resource);
 
     // This should UTF-8 without flattening, since everything is ASCII.
     Local<String> cons =
@@ -15664,6 +15746,16 @@ THREADED_TEST(MorphCompositeStringTest) {
                            ->Get(env.local(), v8_str("slice_on_cons"))
                            .ToLocalChecked())
               .FromJust());
+
+    // This avoids the GC from trying to free a stack allocated resource.
+    if (ilhs->IsExternalOneByteString())
+      i::ExternalOneByteString::cast(ilhs)->set_resource(nullptr);
+    else
+      i::ExternalTwoByteString::cast(ilhs)->set_resource(nullptr);
+    if (irhs->IsExternalOneByteString())
+      i::ExternalOneByteString::cast(irhs)->set_resource(nullptr);
+    else
+      i::ExternalTwoByteString::cast(irhs)->set_resource(nullptr);
   }
   i::DeleteArray(two_byte_string);
 }
@@ -16604,8 +16696,9 @@ static void ObjectWithExternalArrayTestHelper(Local<Context> context,
     CHECK(result->BooleanValue(context).FromJust());
   }
 
-  i::Handle<ExternalArrayClass> array(ExternalArrayClass::cast(
-      i::Handle<i::JSObject>::cast(jsobj)->elements()));
+  i::Handle<ExternalArrayClass> array(
+      ExternalArrayClass::cast(i::Handle<i::JSObject>::cast(jsobj)->elements()),
+      isolate);
   for (int i = 0; i < element_count; i++) {
     array->set(i, static_cast<ElementType>(i));
   }
@@ -16695,7 +16788,7 @@ static void FixedTypedArrayTestHelper(i::ExternalArrayType array_type,
   i::Handle<i::JSTypedArray> jsobj =
       factory->NewJSTypedArray(elements_kind, kElementCount);
   i::Handle<FixedTypedArrayClass> fixed_array(
-      FixedTypedArrayClass::cast(jsobj->elements()));
+      FixedTypedArrayClass::cast(jsobj->elements()), isolate);
   CHECK_EQ(FixedTypedArrayClass::kInstanceType,
            fixed_array->map()->instance_type());
   CHECK_EQ(kElementCount, fixed_array->length());
@@ -17183,31 +17276,31 @@ void AnalyzeStackInNativeCode(const v8::FunctionCallbackInfo<v8::Value>& args) {
     v8::Local<v8::StackTrace> stackTrace = v8::StackTrace::CurrentStackTrace(
         args.GetIsolate(), 5, v8::StackTrace::kOverview);
     CHECK_EQ(3, stackTrace->GetFrameCount());
-    checkStackFrame(origin, "function.name", 2, 24, false, false,
+    checkStackFrame(nullptr, "function.name", 3, 1, true, false,
                     stackTrace->GetFrame(0));
   } else if (testGroup == kDisplayName) {
     v8::Local<v8::StackTrace> stackTrace = v8::StackTrace::CurrentStackTrace(
         args.GetIsolate(), 5, v8::StackTrace::kOverview);
     CHECK_EQ(3, stackTrace->GetFrameCount());
-    checkStackFrame(origin, "function.displayName", 2, 24, false, false,
+    checkStackFrame(nullptr, "function.displayName", 3, 1, true, false,
                     stackTrace->GetFrame(0));
   } else if (testGroup == kFunctionNameAndDisplayName) {
     v8::Local<v8::StackTrace> stackTrace = v8::StackTrace::CurrentStackTrace(
         args.GetIsolate(), 5, v8::StackTrace::kOverview);
     CHECK_EQ(3, stackTrace->GetFrameCount());
-    checkStackFrame(origin, "function.displayName", 2, 24, false, false,
+    checkStackFrame(nullptr, "function.displayName", 3, 1, true, false,
                     stackTrace->GetFrame(0));
   } else if (testGroup == kDisplayNameIsNotString) {
     v8::Local<v8::StackTrace> stackTrace = v8::StackTrace::CurrentStackTrace(
         args.GetIsolate(), 5, v8::StackTrace::kOverview);
     CHECK_EQ(3, stackTrace->GetFrameCount());
-    checkStackFrame(origin, "function.name", 2, 24, false, false,
+    checkStackFrame(nullptr, "function.name", 3, 1, true, false,
                     stackTrace->GetFrame(0));
   } else if (testGroup == kFunctionNameIsNotString) {
     v8::Local<v8::StackTrace> stackTrace = v8::StackTrace::CurrentStackTrace(
         args.GetIsolate(), 5, v8::StackTrace::kOverview);
     CHECK_EQ(3, stackTrace->GetFrameCount());
-    checkStackFrame(origin, "f", 2, 24, false, false, stackTrace->GetFrame(0));
+    checkStackFrame(nullptr, "", 3, 1, true, false, stackTrace->GetFrame(0));
   }
 }
 
@@ -17274,7 +17367,7 @@ TEST(CaptureStackTrace) {
   // Test using function.name and function.displayName in stack trace
   const char* function_name_source =
       "function bar(function_name, display_name, testGroup) {\n"
-      "  var f = function() { AnalyzeStackInNativeCode(testGroup); };\n"
+      "  var f = new Function(`AnalyzeStackInNativeCode(${testGroup});`);\n"
       "  if (function_name) {\n"
       "    Object.defineProperty(f, 'name', { value: function_name });\n"
       "  }\n"
@@ -17413,7 +17506,7 @@ TEST(ErrorLevelWarning) {
   i::Handle<i::SharedFunctionInfo> obj = i::Handle<i::SharedFunctionInfo>::cast(
       v8::Utils::OpenHandle(*lscript->GetUnboundScript()));
   CHECK(obj->script()->IsScript());
-  i::Handle<i::Script> script(i::Script::cast(obj->script()));
+  i::Handle<i::Script> script(i::Script::cast(obj->script()), i_isolate);
 
   int levels[] = {
       v8::Isolate::kMessageLog, v8::Isolate::kMessageInfo,
@@ -17625,6 +17718,8 @@ TEST(RethrowBogusErrorStackTrace) {
 v8::PromiseRejectEvent reject_event = v8::kPromiseRejectWithNoHandler;
 int promise_reject_counter = 0;
 int promise_revoke_counter = 0;
+int promise_reject_after_resolved_counter = 0;
+int promise_resolve_after_resolved_counter = 0;
 int promise_reject_msg_line_number = -1;
 int promise_reject_msg_column_number = -1;
 int promise_reject_line_number = -1;
@@ -17634,40 +17729,56 @@ int promise_reject_frame_count = -1;
 void PromiseRejectCallback(v8::PromiseRejectMessage reject_message) {
   v8::Local<v8::Object> global = CcTest::global();
   v8::Local<v8::Context> context = CcTest::isolate()->GetCurrentContext();
-  CHECK_EQ(v8::Promise::PromiseState::kRejected,
+  CHECK_NE(v8::Promise::PromiseState::kPending,
            reject_message.GetPromise()->State());
-  if (reject_message.GetEvent() == v8::kPromiseRejectWithNoHandler) {
-    promise_reject_counter++;
-    global->Set(context, v8_str("rejected"), reject_message.GetPromise())
-        .FromJust();
-    global->Set(context, v8_str("value"), reject_message.GetValue()).FromJust();
-    v8::Local<v8::Message> message = v8::Exception::CreateMessage(
-        CcTest::isolate(), reject_message.GetValue());
-    v8::Local<v8::StackTrace> stack_trace = message->GetStackTrace();
-
-    promise_reject_msg_line_number = message->GetLineNumber(context).FromJust();
-    promise_reject_msg_column_number =
-        message->GetStartColumn(context).FromJust() + 1;
-
-    if (!stack_trace.IsEmpty()) {
-      promise_reject_frame_count = stack_trace->GetFrameCount();
-      if (promise_reject_frame_count > 0) {
-        CHECK(stack_trace->GetFrame(0)
-                  ->GetScriptName()
-                  ->Equals(context, v8_str("pro"))
-                  .FromJust());
-        promise_reject_line_number = stack_trace->GetFrame(0)->GetLineNumber();
-        promise_reject_column_number = stack_trace->GetFrame(0)->GetColumn();
-      } else {
-        promise_reject_line_number = -1;
-        promise_reject_column_number = -1;
+  switch (reject_message.GetEvent()) {
+    case v8::kPromiseRejectWithNoHandler: {
+      promise_reject_counter++;
+      global->Set(context, v8_str("rejected"), reject_message.GetPromise())
+          .FromJust();
+      global->Set(context, v8_str("value"), reject_message.GetValue())
+          .FromJust();
+      v8::Local<v8::Message> message = v8::Exception::CreateMessage(
+          CcTest::isolate(), reject_message.GetValue());
+      v8::Local<v8::StackTrace> stack_trace = message->GetStackTrace();
+
+      promise_reject_msg_line_number =
+          message->GetLineNumber(context).FromJust();
+      promise_reject_msg_column_number =
+          message->GetStartColumn(context).FromJust() + 1;
+
+      if (!stack_trace.IsEmpty()) {
+        promise_reject_frame_count = stack_trace->GetFrameCount();
+        if (promise_reject_frame_count > 0) {
+          CHECK(stack_trace->GetFrame(0)
+                    ->GetScriptName()
+                    ->Equals(context, v8_str("pro"))
+                    .FromJust());
+          promise_reject_line_number =
+              stack_trace->GetFrame(0)->GetLineNumber();
+          promise_reject_column_number = stack_trace->GetFrame(0)->GetColumn();
+        } else {
+          promise_reject_line_number = -1;
+          promise_reject_column_number = -1;
+        }
       }
+      break;
+    }
+    case v8::kPromiseHandlerAddedAfterReject: {
+      promise_revoke_counter++;
+      global->Set(context, v8_str("revoked"), reject_message.GetPromise())
+          .FromJust();
+      CHECK(reject_message.GetValue().IsEmpty());
+      break;
+    }
+    case v8::kPromiseRejectAfterResolved: {
+      promise_reject_after_resolved_counter++;
+      break;
+    }
+    case v8::kPromiseResolveAfterResolved: {
+      promise_resolve_after_resolved_counter++;
+      break;
     }
-  } else {
-    promise_revoke_counter++;
-    global->Set(context, v8_str("revoked"), reject_message.GetPromise())
-        .FromJust();
-    CHECK(reject_message.GetValue().IsEmpty());
   }
 }
 
@@ -17690,6 +17801,8 @@ v8::Local<v8::Value> RejectValue() {
 void ResetPromiseStates() {
   promise_reject_counter = 0;
   promise_revoke_counter = 0;
+  promise_reject_after_resolved_counter = 0;
+  promise_resolve_after_resolved_counter = 0;
   promise_reject_msg_line_number = -1;
   promise_reject_msg_column_number = -1;
   promise_reject_line_number = -1;
@@ -17915,6 +18028,40 @@ TEST(PromiseRejectCallback) {
   CHECK_EQ(0, promise_revoke_counter);
   CHECK(RejectValue()->Equals(env.local(), v8_str("sss")).FromJust());
 
+  ResetPromiseStates();
+
+  // Swallowed exceptions in the Promise constructor.
+  CompileRun(
+      "var v0 = new Promise(\n"
+      "  function(res, rej) {\n"
+      "    res(1);\n"
+      "    throw new Error();\n"
+      "  }\n"
+      ");\n");
+  CHECK(!GetPromise("v0")->HasHandler());
+  CHECK_EQ(0, promise_reject_counter);
+  CHECK_EQ(0, promise_revoke_counter);
+  CHECK_EQ(1, promise_reject_after_resolved_counter);
+  CHECK_EQ(0, promise_resolve_after_resolved_counter);
+
+  ResetPromiseStates();
+
+  // Duplication resolve.
+  CompileRun(
+      "var r;\n"
+      "var y0 = new Promise(\n"
+      "  function(res, rej) {\n"
+      "    r = res;\n"
+      "    throw new Error();\n"
+      "  }\n"
+      ");\n"
+      "r(1);\n");
+  CHECK(!GetPromise("y0")->HasHandler());
+  CHECK_EQ(1, promise_reject_counter);
+  CHECK_EQ(0, promise_revoke_counter);
+  CHECK_EQ(0, promise_reject_after_resolved_counter);
+  CHECK_EQ(1, promise_resolve_after_resolved_counter);
+
   // Test stack frames.
   env->GetIsolate()->SetCaptureStackTraceForUncaughtExceptions(true);
 
@@ -18715,6 +18862,17 @@ TEST(TestIdleNotification) {
   CHECK_LT(final_size, initial_size + 1);
 }
 
+TEST(TestMemorySavingsMode) {
+  LocalContext context;
+  v8::Isolate* isolate = context->GetIsolate();
+  v8::internal::Isolate* i_isolate =
+      reinterpret_cast<v8::internal::Isolate*>(isolate);
+  CHECK(!i_isolate->IsMemorySavingsModeActive());
+  isolate->EnableMemorySavingsMode();
+  CHECK(i_isolate->IsMemorySavingsModeActive());
+  isolate->DisableMemorySavingsMode();
+  CHECK(!i_isolate->IsMemorySavingsModeActive());
+}
 
 TEST(Regress2333) {
   LocalContext env;
@@ -18810,6 +18968,46 @@ THREADED_TEST(GetHeapStatistics) {
   CHECK_NE(static_cast<int>(heap_statistics.used_heap_size()), 0);
 }
 
+TEST(GetHeapSpaceStatistics) {
+  LocalContext c1;
+  v8::Isolate* isolate = c1->GetIsolate();
+  v8::HandleScope scope(isolate);
+  v8::HeapStatistics heap_statistics;
+
+  // Force allocation in LO_SPACE so that every space has non-zero size.
+  v8::internal::Isolate* i_isolate =
+      reinterpret_cast<v8::internal::Isolate*>(isolate);
+  (void)i_isolate->factory()->TryNewFixedArray(512 * 1024);
+
+  isolate->GetHeapStatistics(&heap_statistics);
+
+  // Ensure that the sum of all the spaces matches the totals from
+  // GetHeapSpaceStatics.
+  size_t total_size = 0u;
+  size_t total_used_size = 0u;
+  size_t total_available_size = 0u;
+  size_t total_physical_size = 0u;
+  for (size_t i = 0; i < isolate->NumberOfHeapSpaces(); ++i) {
+    v8::HeapSpaceStatistics space_statistics;
+    isolate->GetHeapSpaceStatistics(&space_statistics, i);
+    CHECK_NOT_NULL(space_statistics.space_name());
+    if (strcmp(space_statistics.space_name(), "new_large_object_space") == 0) {
+      continue;
+    }
+    CHECK_GT(space_statistics.space_size(), 0u);
+    total_size += space_statistics.space_size();
+    CHECK_GT(space_statistics.space_used_size(), 0u);
+    total_used_size += space_statistics.space_used_size();
+    total_available_size += space_statistics.space_available_size();
+    CHECK_GT(space_statistics.physical_space_size(), 0u);
+    total_physical_size += space_statistics.physical_space_size();
+  }
+  CHECK_EQ(total_size, heap_statistics.total_heap_size());
+  CHECK_EQ(total_used_size, heap_statistics.used_heap_size());
+  CHECK_EQ(total_available_size, heap_statistics.total_available_size());
+  CHECK_EQ(total_physical_size, heap_statistics.total_physical_size());
+}
+
 TEST(NumberOfNativeContexts) {
   static const size_t kNumTestContexts = 10;
   i::Isolate* isolate = CcTest::i_isolate();
@@ -20107,7 +20305,8 @@ THREADED_TEST(TwoByteStringInOneByteCons) {
   int length = string->length();
   CHECK(string->IsOneByteRepresentation());
 
-  i::Handle<i::String> flat_string = i::String::Flatten(string);
+  i::Isolate* i_isolate = reinterpret_cast<i::Isolate*>(context->GetIsolate());
+  i::Handle<i::String> flat_string = i::String::Flatten(i_isolate, string);
 
   CHECK(string->IsOneByteRepresentation());
   CHECK(flat_string->IsOneByteRepresentation());
@@ -20175,6 +20374,8 @@ THREADED_TEST(TwoByteStringInOneByteCons) {
   reresult = CompileRun("str2.charCodeAt(2);");
   CHECK_EQ(static_cast<int32_t>('e'),
            reresult->Int32Value(context.local()).FromJust());
+  // This avoids the GC from trying to free stack allocated resources.
+  i::Handle<i::ExternalTwoByteString>::cast(flat_string)->set_resource(nullptr);
 }
 
 
@@ -20705,7 +20906,7 @@ class InitDefaultIsolateThread : public v8::base::Thread {
     switch (testCase_) {
       case SetResourceConstraints: {
         create_params.constraints.set_max_semi_space_size_in_kb(1024);
-        create_params.constraints.set_max_old_space_size(6);
+        create_params.constraints.set_max_old_space_size(8);
         break;
       }
       default:
@@ -20754,28 +20955,23 @@ static void InitializeTestHelper(InitDefaultIsolateThread::TestCase testCase) {
   CHECK(thread.result());
 }
 
-
-TEST(InitializeDefaultIsolateOnSecondaryThread1) {
+TEST(InitializeDefaultIsolateOnSecondaryThread_ResourceConstraints) {
   InitializeTestHelper(InitDefaultIsolateThread::SetResourceConstraints);
 }
 
-
-TEST(InitializeDefaultIsolateOnSecondaryThread2) {
+TEST(InitializeDefaultIsolateOnSecondaryThread_FatalHandler) {
   InitializeTestHelper(InitDefaultIsolateThread::SetFatalHandler);
 }
 
-
-TEST(InitializeDefaultIsolateOnSecondaryThread3) {
+TEST(InitializeDefaultIsolateOnSecondaryThread_CounterFunction) {
   InitializeTestHelper(InitDefaultIsolateThread::SetCounterFunction);
 }
 
-
-TEST(InitializeDefaultIsolateOnSecondaryThread4) {
+TEST(InitializeDefaultIsolateOnSecondaryThread_CreateHistogramFunction) {
   InitializeTestHelper(InitDefaultIsolateThread::SetCreateHistogramFunction);
 }
 
-
-TEST(InitializeDefaultIsolateOnSecondaryThread5) {
+TEST(InitializeDefaultIsolateOnSecondaryThread_AddHistogramSampleFunction) {
   InitializeTestHelper(InitDefaultIsolateThread::SetAddHistogramSampleFunction);
 }
 
@@ -23958,8 +24154,7 @@ THREADED_TEST(FunctionNew) {
   CHECK(v8::Integer::New(isolate, 17)->Equals(env.local(), result2).FromJust());
 }
 
-
-TEST(EscapeableHandleScope) {
+TEST(EscapableHandleScope) {
   HandleScope outer_scope(CcTest::isolate());
   LocalContext context;
   const int runs = 10;
@@ -23968,7 +24163,12 @@ TEST(EscapeableHandleScope) {
     v8::EscapableHandleScope inner_scope(CcTest::isolate());
     Local<String> value;
     if (i != 0) value = v8_str("escape value");
-    values[i] = inner_scope.Escape(value);
+    if (i < runs / 2) {
+      values[i] = inner_scope.Escape(value);
+    } else {
+      values[i] = inner_scope.EscapeMaybe(v8::MaybeLocal<String>(value))
+                      .ToLocalChecked();
+    }
   }
   for (int i = 0; i < runs; i++) {
     Local<String> expected;
@@ -24861,6 +25061,15 @@ TEST(CaptureStackTraceForStackOverflow) {
   CHECK(try_catch.HasCaught());
 }
 
+namespace {
+bool ValueEqualsString(v8::Isolate* isolate, Local<Value> lhs,
+                       const char* rhs) {
+  CHECK(!lhs.IsEmpty());
+  CHECK(lhs->IsString());
+  String::Utf8Value utf8_lhs(isolate, lhs);
+  return strcmp(rhs, *utf8_lhs) == 0;
+}
+}  // namespace
 
 TEST(ScriptNameAndLineNumber) {
   LocalContext env;
@@ -24869,13 +25078,12 @@ TEST(ScriptNameAndLineNumber) {
   const char* url = "http://www.foo.com/foo.js";
   v8::ScriptOrigin origin(v8_str(url), v8::Integer::New(isolate, 13));
   v8::ScriptCompiler::Source script_source(v8_str("var foo;"), origin);
+
   Local<Script> script =
       v8::ScriptCompiler::Compile(env.local(), &script_source).ToLocalChecked();
-  Local<Value> script_name = script->GetUnboundScript()->GetScriptName();
-  CHECK(!script_name.IsEmpty());
-  CHECK(script_name->IsString());
-  String::Utf8Value utf8_name(env->GetIsolate(), script_name);
-  CHECK_EQ(0, strcmp(url, *utf8_name));
+  CHECK(ValueEqualsString(isolate, script->GetUnboundScript()->GetScriptName(),
+                          url));
+
   int line_number = script->GetUnboundScript()->GetLineNumber(0);
   CHECK_EQ(13, line_number);
 }
@@ -24883,6 +25091,7 @@ TEST(ScriptNameAndLineNumber) {
 TEST(ScriptPositionInfo) {
   LocalContext env;
   v8::Isolate* isolate = env->GetIsolate();
+  i::Isolate* i_isolate = reinterpret_cast<i::Isolate*>(isolate);
   v8::HandleScope scope(isolate);
   const char* url = "http://www.foo.com/foo.js";
   v8::ScriptOrigin origin(v8_str(url), v8::Integer::New(isolate, 13));
@@ -24897,7 +25106,7 @@ TEST(ScriptPositionInfo) {
       v8::Utils::OpenHandle(*script->GetUnboundScript()));
   CHECK(obj->script()->IsScript());
 
-  i::Handle<i::Script> script1(i::Script::cast(obj->script()));
+  i::Handle<i::Script> script1(i::Script::cast(obj->script()), i_isolate);
 
   v8::internal::Script::PositionInfo info;
 
@@ -25710,6 +25919,287 @@ TEST(CodeCache) {
   isolate2->Dispose();
 }
 
+v8::MaybeLocal<Module> UnexpectedModuleResolveCallback(Local<Context> context,
+                                                       Local<String> specifier,
+                                                       Local<Module> referrer) {
+  CHECK_WITH_MSG(false, "Unexpected call to resolve callback");
+}
+
+namespace {
+
+Local<Module> CompileAndInstantiateModule(v8::Isolate* isolate,
+                                          Local<Context> context,
+                                          const char* resource_name,
+                                          const char* source) {
+  Local<String> source_string = v8_str(source);
+  v8::ScriptOrigin script_origin(
+      v8_str(resource_name), Local<v8::Integer>(), Local<v8::Integer>(),
+      Local<v8::Boolean>(), Local<v8::Integer>(), Local<v8::Value>(),
+      Local<v8::Boolean>(), Local<v8::Boolean>(), True(isolate));
+  v8::ScriptCompiler::Source script_compiler_source(source_string,
+                                                    script_origin);
+  Local<Module> module =
+      v8::ScriptCompiler::CompileModule(isolate, &script_compiler_source)
+          .ToLocalChecked();
+  module->InstantiateModule(context, UnexpectedModuleResolveCallback)
+      .ToChecked();
+
+  return module;
+}
+
+Local<Module> CompileAndInstantiateModuleFromCache(
+    v8::Isolate* isolate, Local<Context> context, const char* resource_name,
+    const char* source, v8::ScriptCompiler::CachedData* cache) {
+  Local<String> source_string = v8_str(source);
+  v8::ScriptOrigin script_origin(
+      v8_str(resource_name), Local<v8::Integer>(), Local<v8::Integer>(),
+      Local<v8::Boolean>(), Local<v8::Integer>(), Local<v8::Value>(),
+      Local<v8::Boolean>(), Local<v8::Boolean>(), True(isolate));
+  v8::ScriptCompiler::Source script_compiler_source(source_string,
+                                                    script_origin, cache);
+
+  Local<Module> module =
+      v8::ScriptCompiler::CompileModule(isolate, &script_compiler_source,
+                                        v8::ScriptCompiler::kConsumeCodeCache)
+          .ToLocalChecked();
+  module->InstantiateModule(context, UnexpectedModuleResolveCallback)
+      .ToChecked();
+
+  return module;
+}
+
+}  // namespace
+
+TEST(ModuleCodeCache) {
+  v8::Isolate::CreateParams create_params;
+  create_params.array_buffer_allocator = CcTest::array_buffer_allocator();
+
+  const char* origin = "code cache test";
+  const char* source =
+      "export default 5; export const a = 10; function f() { return 42; } "
+      "(function() { return f(); })();";
+
+  v8::ScriptCompiler::CachedData* cache;
+  {
+    v8::Isolate* isolate = v8::Isolate::New(create_params);
+    {
+      v8::Isolate::Scope iscope(isolate);
+      v8::HandleScope scope(isolate);
+      v8::Local<v8::Context> context = v8::Context::New(isolate);
+      v8::Context::Scope cscope(context);
+
+      Local<Module> module =
+          CompileAndInstantiateModule(isolate, context, origin, source);
+
+      // Fetch the shared function info before evaluation.
+      Local<v8::UnboundModuleScript> unbound_module_script =
+          module->GetUnboundModuleScript();
+
+      // Evaluate for possible lazy compilation.
+      Local<Value> completion_value =
+          module->Evaluate(context).ToLocalChecked();
+      CHECK_EQ(42, completion_value->Int32Value(context).FromJust());
+
+      // Now create the cache. Note that it is freed, obscurely, when
+      // ScriptCompiler::Source goes out of scope below.
+      cache = v8::ScriptCompiler::CreateCodeCache(unbound_module_script);
+    }
+    isolate->Dispose();
+  }
+
+  // Test that the cache is consumed and execution still works.
+  {
+    // Disable --always_opt, otherwise we try to optimize during module
+    // instantiation, violating the DisallowCompilation scope.
+    i::FLAG_always_opt = false;
+    v8::Isolate* isolate = v8::Isolate::New(create_params);
+    {
+      v8::Isolate::Scope iscope(isolate);
+      v8::HandleScope scope(isolate);
+      v8::Local<v8::Context> context = v8::Context::New(isolate);
+      v8::Context::Scope cscope(context);
+
+      Local<Module> module;
+      {
+        i::DisallowCompilation no_compile(
+            reinterpret_cast<i::Isolate*>(isolate));
+        module = CompileAndInstantiateModuleFromCache(isolate, context, origin,
+                                                      source, cache);
+      }
+
+      Local<Value> completion_value =
+          module->Evaluate(context).ToLocalChecked();
+      CHECK_EQ(42, completion_value->Int32Value(context).FromJust());
+    }
+    isolate->Dispose();
+  }
+}
+
+// Tests that the code cache does not confuse the same source code compiled as a
+// script and as a module.
+TEST(CodeCacheModuleScriptMismatch) {
+  v8::Isolate::CreateParams create_params;
+  create_params.array_buffer_allocator = CcTest::array_buffer_allocator();
+
+  const char* origin = "code cache test";
+  const char* source = "42";
+
+  v8::ScriptCompiler::CachedData* cache;
+  {
+    v8::Isolate* isolate = v8::Isolate::New(create_params);
+    {
+      v8::Isolate::Scope iscope(isolate);
+      v8::HandleScope scope(isolate);
+      v8::Local<v8::Context> context = v8::Context::New(isolate);
+      v8::Context::Scope cscope(context);
+
+      Local<Module> module =
+          CompileAndInstantiateModule(isolate, context, origin, source);
+
+      // Fetch the shared function info before evaluation.
+      Local<v8::UnboundModuleScript> unbound_module_script =
+          module->GetUnboundModuleScript();
+
+      // Evaluate for possible lazy compilation.
+      Local<Value> completion_value =
+          module->Evaluate(context).ToLocalChecked();
+      CHECK_EQ(42, completion_value->Int32Value(context).FromJust());
+
+      // Now create the cache. Note that it is freed, obscurely, when
+      // ScriptCompiler::Source goes out of scope below.
+      cache = v8::ScriptCompiler::CreateCodeCache(unbound_module_script);
+    }
+    isolate->Dispose();
+  }
+
+  // Test that the cache is not consumed when source is compiled as a script.
+  {
+    v8::Isolate* isolate = v8::Isolate::New(create_params);
+    {
+      v8::Isolate::Scope iscope(isolate);
+      v8::HandleScope scope(isolate);
+      v8::Local<v8::Context> context = v8::Context::New(isolate);
+      v8::Context::Scope cscope(context);
+
+      v8::ScriptOrigin script_origin(v8_str(origin));
+      v8::ScriptCompiler::Source script_compiler_source(v8_str(source),
+                                                        script_origin, cache);
+
+      v8::Local<v8::Script> script =
+          v8::ScriptCompiler::Compile(context, &script_compiler_source,
+                                      v8::ScriptCompiler::kConsumeCodeCache)
+              .ToLocalChecked();
+
+      CHECK(cache->rejected);
+
+      CHECK_EQ(42, script->Run(context)
+                       .ToLocalChecked()
+                       ->ToInt32(context)
+                       .ToLocalChecked()
+                       ->Int32Value(context)
+                       .FromJust());
+    }
+    isolate->Dispose();
+  }
+}
+
+// Same as above but other way around.
+TEST(CodeCacheScriptModuleMismatch) {
+  v8::Isolate::CreateParams create_params;
+  create_params.array_buffer_allocator = CcTest::array_buffer_allocator();
+
+  const char* origin = "code cache test";
+  const char* source = "42";
+
+  v8::ScriptCompiler::CachedData* cache;
+  {
+    v8::Isolate* isolate = v8::Isolate::New(create_params);
+    {
+      v8::Isolate::Scope iscope(isolate);
+      v8::HandleScope scope(isolate);
+      v8::Local<v8::Context> context = v8::Context::New(isolate);
+      v8::Context::Scope cscope(context);
+      v8::Local<v8::String> source_string = v8_str(source);
+      v8::ScriptOrigin script_origin(v8_str(origin));
+      v8::ScriptCompiler::Source source(source_string, script_origin);
+      v8::ScriptCompiler::CompileOptions option =
+          v8::ScriptCompiler::kNoCompileOptions;
+      v8::Local<v8::Script> script =
+          v8::ScriptCompiler::Compile(context, &source, option)
+              .ToLocalChecked();
+      cache = v8::ScriptCompiler::CreateCodeCache(script->GetUnboundScript());
+    }
+    isolate->Dispose();
+  }
+
+  // Test that the cache is not consumed when source is compiled as a module.
+  {
+    v8::Isolate* isolate = v8::Isolate::New(create_params);
+    {
+      v8::Isolate::Scope iscope(isolate);
+      v8::HandleScope scope(isolate);
+      v8::Local<v8::Context> context = v8::Context::New(isolate);
+      v8::Context::Scope cscope(context);
+
+      v8::ScriptOrigin script_origin(
+          v8_str(origin), Local<v8::Integer>(), Local<v8::Integer>(),
+          Local<v8::Boolean>(), Local<v8::Integer>(), Local<v8::Value>(),
+          Local<v8::Boolean>(), Local<v8::Boolean>(), True(isolate));
+      v8::ScriptCompiler::Source script_compiler_source(v8_str(source),
+                                                        script_origin, cache);
+
+      Local<Module> module = v8::ScriptCompiler::CompileModule(
+                                 isolate, &script_compiler_source,
+                                 v8::ScriptCompiler::kConsumeCodeCache)
+                                 .ToLocalChecked();
+      module->InstantiateModule(context, UnexpectedModuleResolveCallback)
+          .ToChecked();
+
+      CHECK(cache->rejected);
+
+      Local<Value> completion_value =
+          module->Evaluate(context).ToLocalChecked();
+      CHECK_EQ(42, completion_value->Int32Value(context).FromJust());
+    }
+    isolate->Dispose();
+  }
+}
+
+// Tests that compilation can handle a garbled cache.
+TEST(InvalidCodeCacheDataInCompileModule) {
+  v8::V8::Initialize();
+  v8::Isolate* isolate = CcTest::isolate();
+  v8::HandleScope scope(isolate);
+  LocalContext local_context;
+
+  const char* garbage = "garbage garbage garbage garbage garbage garbage";
+  const uint8_t* data = reinterpret_cast<const uint8_t*>(garbage);
+  Local<String> origin = v8_str("origin");
+  int length = 16;
+  v8::ScriptCompiler::CachedData* cached_data =
+      new v8::ScriptCompiler::CachedData(data, length);
+  CHECK(!cached_data->rejected);
+
+  v8::ScriptOrigin script_origin(
+      origin, Local<v8::Integer>(), Local<v8::Integer>(), Local<v8::Boolean>(),
+      Local<v8::Integer>(), Local<v8::Value>(), Local<v8::Boolean>(),
+      Local<v8::Boolean>(), True(isolate));
+  v8::ScriptCompiler::Source source(v8_str("42"), script_origin, cached_data);
+  v8::Local<v8::Context> context = CcTest::isolate()->GetCurrentContext();
+
+  Local<Module> module =
+      v8::ScriptCompiler::CompileModule(isolate, &source,
+                                        v8::ScriptCompiler::kConsumeCodeCache)
+          .ToLocalChecked();
+  module->InstantiateModule(context, UnexpectedModuleResolveCallback)
+      .ToChecked();
+
+  CHECK(cached_data->rejected);
+  CHECK_EQ(42, module->Evaluate(context)
+                   .ToLocalChecked()
+                   ->Int32Value(context)
+                   .FromJust());
+}
 
 void TestInvalidCacheData(v8::ScriptCompiler::CompileOptions option) {
   const char* garbage = "garbage garbage garbage garbage garbage garbage";
@@ -27444,12 +27934,6 @@ void HostInitializeImportMetaObjectCallbackStatic(Local<Context> context,
   meta->CreateDataProperty(context, v8_str("foo"), v8_str("bar")).ToChecked();
 }
 
-v8::MaybeLocal<Module> UnexpectedModuleResolveCallback(Local<Context> context,
-                                                       Local<String> specifier,
-                                                       Local<Module> referrer) {
-  CHECK_WITH_MSG(false, "Unexpected call to resolve callback");
-}
-
 TEST(ImportMeta) {
   i::FLAG_harmony_dynamic_import = true;
   i::FLAG_harmony_import_meta = true;
@@ -27517,6 +28001,35 @@ TEST(GetModuleNamespace) {
             ->StrictEquals(v8::Number::New(isolate, 10)));
 }
 
+TEST(ModuleGetUnboundModuleScript) {
+  LocalContext context;
+  v8::Isolate* isolate = context->GetIsolate();
+  v8::HandleScope scope(isolate);
+
+  Local<String> url = v8_str("www.google.com");
+  Local<String> source_text = v8_str("export default 5; export const a = 10;");
+  v8::ScriptOrigin origin(url, Local<v8::Integer>(), Local<v8::Integer>(),
+                          Local<v8::Boolean>(), Local<v8::Integer>(),
+                          Local<v8::Value>(), Local<v8::Boolean>(),
+                          Local<v8::Boolean>(), True(isolate));
+  v8::ScriptCompiler::Source source(source_text, origin);
+  Local<Module> module =
+      v8::ScriptCompiler::CompileModule(isolate, &source).ToLocalChecked();
+  Local<v8::UnboundModuleScript> sfi_before_instantiation =
+      module->GetUnboundModuleScript();
+  module->InstantiateModule(context.local(), UnexpectedModuleResolveCallback)
+      .ToChecked();
+  Local<v8::UnboundModuleScript> sfi_after_instantiation =
+      module->GetUnboundModuleScript();
+
+  // Check object identity.
+  {
+    i::Handle<i::Object> s1 = v8::Utils::OpenHandle(*sfi_before_instantiation);
+    i::Handle<i::Object> s2 = v8::Utils::OpenHandle(*sfi_after_instantiation);
+    CHECK_EQ(*s1, *s2);
+  }
+}
+
 TEST(GlobalTemplateWithDoubleProperty) {
   v8::Isolate* isolate = CcTest::isolate();
   v8::HandleScope handle_scope(isolate);
@@ -27614,6 +28127,216 @@ TEST(WasmStreamingAbortNoReject) {
   CHECK_EQ(streaming.GetPromise()->State(), v8::Promise::kPending);
 }
 
+enum class AtomicsWaitCallbackAction {
+  Interrupt,
+  StopAndThrowInFirstCall,
+  StopAndThrowInSecondCall,
+  StopFromThreadAndThrow,
+  KeepWaiting
+};
+
+class StopAtomicsWaitThread;
+
+struct AtomicsWaitCallbackInfo {
+  v8::Isolate* isolate;
+  v8::Isolate::AtomicsWaitWakeHandle* wake_handle;
+  std::unique_ptr<StopAtomicsWaitThread> stop_thread;
+  AtomicsWaitCallbackAction action;
+
+  Local<v8::SharedArrayBuffer> expected_sab;
+  v8::Isolate::AtomicsWaitEvent expected_event;
+  double expected_timeout;
+  int32_t expected_value;
+  size_t expected_offset;
+
+  size_t ncalls = 0;
+};
+
+class StopAtomicsWaitThread : public v8::base::Thread {
+ public:
+  explicit StopAtomicsWaitThread(AtomicsWaitCallbackInfo* info)
+      : Thread(Options("StopAtomicsWaitThread")), info_(info) {}
+
+  virtual void Run() {
+    CHECK_NOT_NULL(info_->wake_handle);
+    info_->wake_handle->Wake();
+  }
+
+ private:
+  AtomicsWaitCallbackInfo* info_;
+};
+
+void AtomicsWaitCallbackForTesting(
+    v8::Isolate::AtomicsWaitEvent event, Local<v8::SharedArrayBuffer> sab,
+    size_t offset_in_bytes, int32_t value, double timeout_in_ms,
+    v8::Isolate::AtomicsWaitWakeHandle* wake_handle, void* data) {
+  AtomicsWaitCallbackInfo* info = static_cast<AtomicsWaitCallbackInfo*>(data);
+  info->ncalls++;
+  info->wake_handle = wake_handle;
+  CHECK(sab->StrictEquals(info->expected_sab));
+  CHECK_EQ(timeout_in_ms, info->expected_timeout);
+  CHECK_EQ(value, info->expected_value);
+  CHECK_EQ(offset_in_bytes, info->expected_offset);
+
+  auto ThrowSomething = [&]() {
+    info->isolate->ThrowException(v8::Integer::New(info->isolate, 42));
+  };
+
+  if (event == v8::Isolate::AtomicsWaitEvent::kStartWait) {
+    CHECK_NOT_NULL(wake_handle);
+    switch (info->action) {
+      case AtomicsWaitCallbackAction::Interrupt:
+        info->isolate->TerminateExecution();
+        break;
+      case AtomicsWaitCallbackAction::StopAndThrowInFirstCall:
+        ThrowSomething();
+        V8_FALLTHROUGH;
+      case AtomicsWaitCallbackAction::StopAndThrowInSecondCall:
+        wake_handle->Wake();
+        break;
+      case AtomicsWaitCallbackAction::StopFromThreadAndThrow:
+        info->stop_thread = v8::base::make_unique<StopAtomicsWaitThread>(info);
+        info->stop_thread->Start();
+        break;
+      case AtomicsWaitCallbackAction::KeepWaiting:
+        break;
+    }
+  } else {
+    CHECK_EQ(event, info->expected_event);
+    CHECK_NULL(wake_handle);
+
+    if (info->stop_thread) {
+      info->stop_thread->Join();
+      info->stop_thread.reset();
+    }
+
+    if (info->action == AtomicsWaitCallbackAction::StopAndThrowInSecondCall ||
+        info->action == AtomicsWaitCallbackAction::StopFromThreadAndThrow) {
+      ThrowSomething();
+    }
+  }
+}
+
+TEST(AtomicsWaitCallback) {
+  LocalContext env;
+  v8::Isolate* isolate = env->GetIsolate();
+  v8::HandleScope scope(isolate);
+
+  Local<Value> sab = CompileRun(
+      "sab = new SharedArrayBuffer(12);"
+      "int32arr = new Int32Array(sab, 4);"
+      "sab");
+  CHECK(sab->IsSharedArrayBuffer());
+
+  AtomicsWaitCallbackInfo info;
+  info.isolate = isolate;
+  info.expected_sab = sab.As<v8::SharedArrayBuffer>();
+  isolate->SetAtomicsWaitCallback(AtomicsWaitCallbackForTesting, &info);
+
+  {
+    v8::TryCatch try_catch(isolate);
+    info.expected_offset = 4;
+    info.expected_timeout = std::numeric_limits<double>::infinity();
+    info.expected_value = 0;
+    info.expected_event = v8::Isolate::AtomicsWaitEvent::kTerminatedExecution;
+    info.action = AtomicsWaitCallbackAction::Interrupt;
+    info.ncalls = 0;
+    CompileRun("Atomics.wait(int32arr, 0, 0);");
+    CHECK_EQ(info.ncalls, 2);
+    CHECK(try_catch.HasTerminated());
+  }
+
+  {
+    v8::TryCatch try_catch(isolate);
+    info.expected_offset = 8;
+    info.expected_timeout = std::numeric_limits<double>::infinity();
+    info.expected_value = 1;
+    info.expected_event = v8::Isolate::AtomicsWaitEvent::kNotEqual;
+    info.action = AtomicsWaitCallbackAction::KeepWaiting;
+    info.ncalls = 0;
+    CompileRun("Atomics.wait(int32arr, 1, 1);");  // real value is 0 != 1
+    CHECK_EQ(info.ncalls, 2);
+    CHECK(!try_catch.HasCaught());
+  }
+
+  {
+    v8::TryCatch try_catch(isolate);
+    info.expected_offset = 8;
+    info.expected_timeout = 0.125;
+    info.expected_value = 0;
+    info.expected_event = v8::Isolate::AtomicsWaitEvent::kTimedOut;
+    info.action = AtomicsWaitCallbackAction::KeepWaiting;
+    info.ncalls = 0;
+    CompileRun("Atomics.wait(int32arr, 1, 0, 0.125);");  // timeout
+    CHECK_EQ(info.ncalls, 2);
+    CHECK(!try_catch.HasCaught());
+  }
+
+  {
+    v8::TryCatch try_catch(isolate);
+    info.expected_offset = 8;
+    info.expected_timeout = std::numeric_limits<double>::infinity();
+    info.expected_value = 0;
+    info.expected_event = v8::Isolate::AtomicsWaitEvent::kAPIStopped;
+    info.action = AtomicsWaitCallbackAction::StopAndThrowInFirstCall;
+    info.ncalls = 0;
+    CompileRun("Atomics.wait(int32arr, 1, 0);");
+    CHECK_EQ(info.ncalls, 1);  // Only one extra call
+    CHECK(try_catch.HasCaught());
+    CHECK(try_catch.Exception()->IsInt32());
+    CHECK_EQ(try_catch.Exception().As<v8::Int32>()->Value(), 42);
+  }
+
+  {
+    v8::TryCatch try_catch(isolate);
+    info.expected_offset = 8;
+    info.expected_timeout = std::numeric_limits<double>::infinity();
+    info.expected_value = 0;
+    info.expected_event = v8::Isolate::AtomicsWaitEvent::kAPIStopped;
+    info.action = AtomicsWaitCallbackAction::StopAndThrowInSecondCall;
+    info.ncalls = 0;
+    CompileRun("Atomics.wait(int32arr, 1, 0);");
+    CHECK_EQ(info.ncalls, 2);
+    CHECK(try_catch.HasCaught());
+    CHECK(try_catch.Exception()->IsInt32());
+    CHECK_EQ(try_catch.Exception().As<v8::Int32>()->Value(), 42);
+  }
+
+  {
+    // Same test as before, but with a different `expected_value`.
+    v8::TryCatch try_catch(isolate);
+    info.expected_offset = 8;
+    info.expected_timeout = std::numeric_limits<double>::infinity();
+    info.expected_value = 200;
+    info.expected_event = v8::Isolate::AtomicsWaitEvent::kAPIStopped;
+    info.action = AtomicsWaitCallbackAction::StopAndThrowInSecondCall;
+    info.ncalls = 0;
+    CompileRun(
+        "int32arr[1] = 200;"
+        "Atomics.wait(int32arr, 1, 200);");
+    CHECK_EQ(info.ncalls, 2);
+    CHECK(try_catch.HasCaught());
+    CHECK(try_catch.Exception()->IsInt32());
+    CHECK_EQ(try_catch.Exception().As<v8::Int32>()->Value(), 42);
+  }
+
+  {
+    // Wake the `Atomics.wait()` call from a thread.
+    v8::TryCatch try_catch(isolate);
+    info.expected_offset = 4;
+    info.expected_timeout = std::numeric_limits<double>::infinity();
+    info.expected_value = 0;
+    info.expected_event = v8::Isolate::AtomicsWaitEvent::kAPIStopped;
+    info.action = AtomicsWaitCallbackAction::StopFromThreadAndThrow;
+    info.ncalls = 0;
+    CompileRun("Atomics.wait(int32arr, 0, 0);");
+    CHECK_EQ(info.ncalls, 2);
+    CHECK(try_catch.HasCaught());
+    CHECK(try_catch.Exception()->IsInt32());
+    CHECK_EQ(try_catch.Exception().As<v8::Int32>()->Value(), 42);
+  }
+}
+
 TEST(BigIntAPI) {
   LocalContext env;
   v8::Isolate* isolate = env->GetIsolate();
diff --git a/deps/v8/test/cctest/test-array-list.cc b/deps/v8/test/cctest/test-array-list.cc
index 6b02b179f8ae42..7235001409c76b 100644
--- a/deps/v8/test/cctest/test-array-list.cc
+++ b/deps/v8/test/cctest/test-array-list.cc
@@ -16,7 +16,7 @@ TEST(ArrayList) {
   Isolate* isolate = CcTest::i_isolate();
   HandleScope scope(isolate);
   Handle<ArrayList> array(
-      ArrayList::cast(isolate->heap()->empty_fixed_array()));
+      ArrayList::cast(ReadOnlyRoots(isolate).empty_fixed_array()), isolate);
   CHECK_EQ(0, array->Length());
   array = ArrayList::Add(array, handle(Smi::FromInt(100), isolate));
   CHECK_EQ(1, array->Length());
@@ -29,7 +29,7 @@ TEST(ArrayList) {
   CHECK_EQ(300, Smi::ToInt(array->Get(2)));
   array->Set(2, Smi::FromInt(400));
   CHECK_EQ(400, Smi::ToInt(array->Get(2)));
-  array->Clear(2, isolate->heap()->undefined_value());
+  array->Clear(2, ReadOnlyRoots(isolate).undefined_value());
   array->SetLength(2);
   CHECK_EQ(2, array->Length());
   CHECK_EQ(100, Smi::ToInt(array->Get(0)));
diff --git a/deps/v8/test/cctest/test-assembler-arm.cc b/deps/v8/test/cctest/test-assembler-arm.cc
index 4549b1d577864a..e5edb5472ece7f 100644
--- a/deps/v8/test/cctest/test-assembler-arm.cc
+++ b/deps/v8/test/cctest/test-assembler-arm.cc
@@ -53,7 +53,7 @@ TEST(0) {
   Isolate* isolate = CcTest::i_isolate();
   HandleScope scope(isolate);
 
-  Assembler assm(isolate, nullptr, 0);
+  Assembler assm(AssemblerOptions{}, nullptr, 0);
 
   __ add(r0, r0, Operand(r1));
   __ mov(pc, Operand(lr));
@@ -63,8 +63,8 @@ TEST(0) {
   Handle<Code> code =
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef DEBUG
-  OFStream os(stdout);
-  code->Print(os);
+  StdoutStream os;
+  code->Print(isolate, os);
 #endif
   auto f = GeneratedCode<F_iiiii>::FromCode(*code);
   int res = reinterpret_cast<int>(f.Call(3, 4, 0, 0, 0));
@@ -78,7 +78,7 @@ TEST(1) {
   Isolate* isolate = CcTest::i_isolate();
   HandleScope scope(isolate);
 
-  Assembler assm(isolate, nullptr, 0);
+  Assembler assm(AssemblerOptions{}, nullptr, 0);
   Label L, C;
 
   __ mov(r1, Operand(r0));
@@ -99,8 +99,8 @@ TEST(1) {
   Handle<Code> code =
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef DEBUG
-  OFStream os(stdout);
-  code->Print(os);
+  StdoutStream os;
+  code->Print(isolate, os);
 #endif
   auto f = GeneratedCode<F_iiiii>::FromCode(*code);
   int res = reinterpret_cast<int>(f.Call(100, 0, 0, 0, 0));
@@ -114,7 +114,7 @@ TEST(2) {
   Isolate* isolate = CcTest::i_isolate();
   HandleScope scope(isolate);
 
-  Assembler assm(isolate, nullptr, 0);
+  Assembler assm(AssemblerOptions{}, nullptr, 0);
   Label L, C;
 
   __ mov(r1, Operand(r0));
@@ -144,8 +144,8 @@ TEST(2) {
   Handle<Code> code =
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef DEBUG
-  OFStream os(stdout);
-  code->Print(os);
+  StdoutStream os;
+  code->Print(isolate, os);
 #endif
   auto f = GeneratedCode<F_iiiii>::FromCode(*code);
   int res = reinterpret_cast<int>(f.Call(10, 0, 0, 0, 0));
@@ -166,7 +166,7 @@ TEST(3) {
   } T;
   T t;
 
-  Assembler assm(isolate, nullptr, 0);
+  Assembler assm(AssemblerOptions{}, nullptr, 0);
   Label L, C;
 
   __ mov(ip, Operand(sp));
@@ -191,8 +191,8 @@ TEST(3) {
   Handle<Code> code =
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef DEBUG
-  OFStream os(stdout);
-  code->Print(os);
+  StdoutStream os;
+  code->Print(isolate, os);
 #endif
   auto f = GeneratedCode<F_piiii>::FromCode(*code);
   t.i = 100000;
@@ -235,7 +235,7 @@ TEST(4) {
 
   // Create a function that accepts &t, and loads, manipulates, and stores
   // the doubles and floats.
-  Assembler assm(isolate, nullptr, 0);
+  Assembler assm(AssemblerOptions{}, nullptr, 0);
   Label L, C;
 
   if (CpuFeatures::IsSupported(VFPv3)) {
@@ -322,8 +322,8 @@ TEST(4) {
     Handle<Code> code =
         isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef DEBUG
-    OFStream os(stdout);
-    code->Print(os);
+    StdoutStream os;
+    code->Print(isolate, os);
 #endif
     auto f = GeneratedCode<F_piiii>::FromCode(*code);
     t.a = 1.5;
@@ -367,7 +367,7 @@ TEST(5) {
   Isolate* isolate = CcTest::i_isolate();
   HandleScope scope(isolate);
 
-  Assembler assm(isolate, nullptr, 0);
+  Assembler assm(AssemblerOptions{}, nullptr, 0);
 
   if (CpuFeatures::IsSupported(ARMv7)) {
     CpuFeatureScope scope(&assm, ARMv7);
@@ -384,8 +384,8 @@ TEST(5) {
     Handle<Code> code =
         isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef DEBUG
-    OFStream os(stdout);
-    code->Print(os);
+    StdoutStream os;
+    code->Print(isolate, os);
 #endif
     auto f = GeneratedCode<F_iiiii>::FromCode(*code);
     int res = reinterpret_cast<int>(f.Call(0xAAAAAAAA, 0, 0, 0, 0));
@@ -401,7 +401,7 @@ TEST(6) {
   Isolate* isolate = CcTest::i_isolate();
   HandleScope scope(isolate);
 
-  Assembler assm(isolate, nullptr, 0);
+  Assembler assm(AssemblerOptions{}, nullptr, 0);
 
   __ usat(r1, 8, Operand(r0));           // Sat 0xFFFF to 0-255 = 0xFF.
   __ usat(r2, 12, Operand(r0, ASR, 9));  // Sat (0xFFFF>>9) to 0-4095 = 0x7F.
@@ -415,8 +415,8 @@ TEST(6) {
   Handle<Code> code =
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef DEBUG
-  OFStream os(stdout);
-  code->Print(os);
+  StdoutStream os;
+  code->Print(isolate, os);
 #endif
   auto f = GeneratedCode<F_iiiii>::FromCode(*code);
   int res = reinterpret_cast<int>(f.Call(0xFFFF, 0, 0, 0, 0));
@@ -438,7 +438,7 @@ static void TestRoundingMode(VCVTTypes types,
   Isolate* isolate = CcTest::i_isolate();
   HandleScope scope(isolate);
 
-  Assembler assm(isolate, nullptr, 0);
+  Assembler assm(AssemblerOptions{}, nullptr, 0);
 
   Label wrong_exception;
 
@@ -483,8 +483,8 @@ static void TestRoundingMode(VCVTTypes types,
   Handle<Code> code =
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef DEBUG
-  OFStream os(stdout);
-  code->Print(os);
+  StdoutStream os;
+  code->Print(isolate, os);
 #endif
   auto f = GeneratedCode<F_iiiii>::FromCode(*code);
   int res = reinterpret_cast<int>(f.Call(0, 0, 0, 0, 0));
@@ -636,7 +636,7 @@ TEST(8) {
 
   // Create a function that uses vldm/vstm to move some double and
   // single precision values around in memory.
-  Assembler assm(isolate, nullptr, 0);
+  Assembler assm(AssemblerOptions{}, nullptr, 0);
 
   __ mov(ip, Operand(sp));
   __ stm(db_w, sp, r4.bit() | fp.bit() | lr.bit());
@@ -665,8 +665,8 @@ TEST(8) {
   Handle<Code> code =
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef DEBUG
-  OFStream os(stdout);
-  code->Print(os);
+  StdoutStream os;
+  code->Print(isolate, os);
 #endif
   auto fn = GeneratedCode<F_ppiii>::FromCode(*code);
   d.a = 1.1;
@@ -741,7 +741,7 @@ TEST(9) {
 
   // Create a function that uses vldm/vstm to move some double and
   // single precision values around in memory.
-  Assembler assm(isolate, nullptr, 0);
+  Assembler assm(AssemblerOptions{}, nullptr, 0);
 
   __ mov(ip, Operand(sp));
   __ stm(db_w, sp, r4.bit() | fp.bit() | lr.bit());
@@ -774,8 +774,8 @@ TEST(9) {
   Handle<Code> code =
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef DEBUG
-  OFStream os(stdout);
-  code->Print(os);
+  StdoutStream os;
+  code->Print(isolate, os);
 #endif
   auto fn = GeneratedCode<F_ppiii>::FromCode(*code);
   d.a = 1.1;
@@ -850,7 +850,7 @@ TEST(10) {
 
   // Create a function that uses vldm/vstm to move some double and
   // single precision values around in memory.
-  Assembler assm(isolate, nullptr, 0);
+  Assembler assm(AssemblerOptions{}, nullptr, 0);
 
   __ mov(ip, Operand(sp));
   __ stm(db_w, sp, r4.bit() | fp.bit() | lr.bit());
@@ -879,8 +879,8 @@ TEST(10) {
   Handle<Code> code =
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef DEBUG
-  OFStream os(stdout);
-  code->Print(os);
+  StdoutStream os;
+  code->Print(isolate, os);
 #endif
   auto fn = GeneratedCode<F_ppiii>::FromCode(*code);
   d.a = 1.1;
@@ -940,7 +940,7 @@ TEST(11) {
   i.a = 0xABCD0001;
   i.b = 0xABCD0000;
 
-  Assembler assm(isolate, nullptr, 0);
+  Assembler assm(AssemblerOptions{}, nullptr, 0);
 
   // Test HeapObject untagging.
   __ ldr(r1, MemOperand(r0, offsetof(I, a)));
@@ -973,8 +973,8 @@ TEST(11) {
   Handle<Code> code =
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef DEBUG
-  OFStream os(stdout);
-  code->Print(os);
+  StdoutStream os;
+  code->Print(isolate, os);
 #endif
   auto f = GeneratedCode<F_piiii>::FromCode(*code);
   f.Call(&i, 0, 0, 0, 0);
@@ -992,7 +992,7 @@ TEST(12) {
   Isolate* isolate = CcTest::i_isolate();
   HandleScope scope(isolate);
 
-  Assembler assm(isolate, nullptr, 0);
+  Assembler assm(AssemblerOptions{}, nullptr, 0);
   Label target;
   __ b(eq, &target);
   __ b(ne, &target);
@@ -1028,7 +1028,7 @@ TEST(13) {
 
   // Create a function that accepts &t, and loads, manipulates, and stores
   // the doubles and floats.
-  Assembler assm(isolate, nullptr, 0);
+  Assembler assm(AssemblerOptions{}, nullptr, 0);
   Label L, C;
 
   if (CpuFeatures::IsSupported(VFPv3)) {
@@ -1099,8 +1099,8 @@ TEST(13) {
     Handle<Code> code =
         isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef DEBUG
-    OFStream os(stdout);
-    code->Print(os);
+    StdoutStream os;
+    code->Print(isolate, os);
 #endif
     auto f = GeneratedCode<F_piiii>::FromCode(*code);
     t.a = 1.5;
@@ -1142,7 +1142,7 @@ TEST(14) {
   T t;
 
   // Create a function that makes the four basic operations.
-  Assembler assm(isolate, nullptr, 0);
+  Assembler assm(AssemblerOptions{}, nullptr, 0);
 
   // Ensure FPSCR state (as JSEntryStub does).
   Label fpscr_done;
@@ -1171,8 +1171,8 @@ TEST(14) {
   Handle<Code> code =
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef DEBUG
-  OFStream os(stdout);
-  code->Print(os);
+  StdoutStream os;
+  code->Print(isolate, os);
 #endif
   auto f = GeneratedCode<F_piiii>::FromCode(*code);
   t.left = bit_cast<double>(kHoleNanInt64);
@@ -1321,7 +1321,7 @@ TEST(15) {
 
   // Create a function that accepts &t, and loads, manipulates, and stores
   // the doubles, floats, and SIMD values.
-  Assembler assm(isolate, nullptr, 0);
+  Assembler assm(AssemblerOptions{}, nullptr, 0);
 
   if (CpuFeatures::IsSupported(NEON)) {
     CpuFeatureScope scope(&assm, NEON);
@@ -2051,8 +2051,8 @@ TEST(15) {
     Handle<Code> code =
         isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef DEBUG
-    OFStream os(stdout);
-    code->Print(os);
+    StdoutStream os;
+    code->Print(isolate, os);
 #endif
     auto f = GeneratedCode<F_piiii>::FromCode(*code);
     t.src0 = 0x01020304;
@@ -2296,7 +2296,7 @@ TEST(16) {
 
   // Create a function that accepts &t, and loads, manipulates, and stores
   // the doubles and floats.
-  Assembler assm(isolate, nullptr, 0);
+  Assembler assm(AssemblerOptions{}, nullptr, 0);
 
   __ stm(db_w, sp, r4.bit() | lr.bit());
 
@@ -2327,8 +2327,8 @@ TEST(16) {
   Handle<Code> code =
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef DEBUG
-  OFStream os(stdout);
-  code->Print(os);
+  StdoutStream os;
+  code->Print(isolate, os);
 #endif
   auto f = GeneratedCode<F_piiii>::FromCode(*code);
   t.src0 = 0x01020304;
@@ -2356,7 +2356,7 @@ TEST(17) {
   HandleScope scope(isolate);
 
   // Generate a code segment that will be longer than 2^24 bytes.
-  Assembler assm(isolate, nullptr, 0);
+  Assembler assm(AssemblerOptions{}, nullptr, 0);
   for (size_t i = 0; i < 1 << 23 ; ++i) {  // 2^23
     __ nop();
   }
@@ -2379,7 +2379,7 @@ TEST(sdiv) {
   CcTest::InitializeVM();
   Isolate* isolate = CcTest::i_isolate();
   HandleScope scope(isolate);
-  Assembler assm(isolate, nullptr, 0);
+  Assembler assm(AssemblerOptions{}, nullptr, 0);
 
   struct T {
     int32_t dividend;
@@ -2405,8 +2405,8 @@ TEST(sdiv) {
     Handle<Code> code =
         isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef DEBUG
-    OFStream os(stdout);
-    code->Print(os);
+    StdoutStream os;
+    code->Print(isolate, os);
 #endif
     auto f = GeneratedCode<F_piiii>::FromCode(*code);
     TEST_SDIV(0, kMinInt, 0);
@@ -2439,7 +2439,7 @@ TEST(udiv) {
   CcTest::InitializeVM();
   Isolate* isolate = CcTest::i_isolate();
   HandleScope scope(isolate);
-  Assembler assm(isolate, nullptr, 0);
+  Assembler assm(AssemblerOptions{}, nullptr, 0);
 
   struct T {
     uint32_t dividend;
@@ -2465,8 +2465,8 @@ TEST(udiv) {
     Handle<Code> code =
         isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef DEBUG
-    OFStream os(stdout);
-    code->Print(os);
+    StdoutStream os;
+    code->Print(isolate, os);
 #endif
     auto f = GeneratedCode<F_piiii>::FromCode(*code);
     TEST_UDIV(0u, 0, 0);
@@ -2485,7 +2485,7 @@ TEST(smmla) {
   Isolate* const isolate = CcTest::i_isolate();
   HandleScope scope(isolate);
   RandomNumberGenerator* const rng = isolate->random_number_generator();
-  Assembler assm(isolate, nullptr, 0);
+  Assembler assm(AssemblerOptions{}, nullptr, 0);
   __ smmla(r1, r1, r2, r3);
   __ str(r1, MemOperand(r0));
   __ bx(lr);
@@ -2494,7 +2494,7 @@ TEST(smmla) {
   Handle<Code> code =
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef OBJECT_PRINT
-  code->Print(std::cout);
+  code->Print(isolate, std::cout);
 #endif
   auto f = GeneratedCode<F_piiii>::FromCode(*code);
   for (size_t i = 0; i < 128; ++i) {
@@ -2510,7 +2510,7 @@ TEST(smmul) {
   Isolate* const isolate = CcTest::i_isolate();
   HandleScope scope(isolate);
   RandomNumberGenerator* const rng = isolate->random_number_generator();
-  Assembler assm(isolate, nullptr, 0);
+  Assembler assm(AssemblerOptions{}, nullptr, 0);
   __ smmul(r1, r1, r2);
   __ str(r1, MemOperand(r0));
   __ bx(lr);
@@ -2519,7 +2519,7 @@ TEST(smmul) {
   Handle<Code> code =
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef OBJECT_PRINT
-  code->Print(std::cout);
+  code->Print(isolate, std::cout);
 #endif
   auto f = GeneratedCode<F_piiii>::FromCode(*code);
   for (size_t i = 0; i < 128; ++i) {
@@ -2535,7 +2535,7 @@ TEST(sxtb) {
   Isolate* const isolate = CcTest::i_isolate();
   HandleScope scope(isolate);
   RandomNumberGenerator* const rng = isolate->random_number_generator();
-  Assembler assm(isolate, nullptr, 0);
+  Assembler assm(AssemblerOptions{}, nullptr, 0);
   __ sxtb(r1, r1);
   __ str(r1, MemOperand(r0));
   __ bx(lr);
@@ -2544,7 +2544,7 @@ TEST(sxtb) {
   Handle<Code> code =
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef OBJECT_PRINT
-  code->Print(std::cout);
+  code->Print(isolate, std::cout);
 #endif
   auto f = GeneratedCode<F_piiii>::FromCode(*code);
   for (size_t i = 0; i < 128; ++i) {
@@ -2560,7 +2560,7 @@ TEST(sxtab) {
   Isolate* const isolate = CcTest::i_isolate();
   HandleScope scope(isolate);
   RandomNumberGenerator* const rng = isolate->random_number_generator();
-  Assembler assm(isolate, nullptr, 0);
+  Assembler assm(AssemblerOptions{}, nullptr, 0);
   __ sxtab(r1, r2, r1);
   __ str(r1, MemOperand(r0));
   __ bx(lr);
@@ -2569,7 +2569,7 @@ TEST(sxtab) {
   Handle<Code> code =
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef OBJECT_PRINT
-  code->Print(std::cout);
+  code->Print(isolate, std::cout);
 #endif
   auto f = GeneratedCode<F_piiii>::FromCode(*code);
   for (size_t i = 0; i < 128; ++i) {
@@ -2585,7 +2585,7 @@ TEST(sxth) {
   Isolate* const isolate = CcTest::i_isolate();
   HandleScope scope(isolate);
   RandomNumberGenerator* const rng = isolate->random_number_generator();
-  Assembler assm(isolate, nullptr, 0);
+  Assembler assm(AssemblerOptions{}, nullptr, 0);
   __ sxth(r1, r1);
   __ str(r1, MemOperand(r0));
   __ bx(lr);
@@ -2594,7 +2594,7 @@ TEST(sxth) {
   Handle<Code> code =
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef OBJECT_PRINT
-  code->Print(std::cout);
+  code->Print(isolate, std::cout);
 #endif
   auto f = GeneratedCode<F_piiii>::FromCode(*code);
   for (size_t i = 0; i < 128; ++i) {
@@ -2610,7 +2610,7 @@ TEST(sxtah) {
   Isolate* const isolate = CcTest::i_isolate();
   HandleScope scope(isolate);
   RandomNumberGenerator* const rng = isolate->random_number_generator();
-  Assembler assm(isolate, nullptr, 0);
+  Assembler assm(AssemblerOptions{}, nullptr, 0);
   __ sxtah(r1, r2, r1);
   __ str(r1, MemOperand(r0));
   __ bx(lr);
@@ -2619,7 +2619,7 @@ TEST(sxtah) {
   Handle<Code> code =
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef OBJECT_PRINT
-  code->Print(std::cout);
+  code->Print(isolate, std::cout);
 #endif
   auto f = GeneratedCode<F_piiii>::FromCode(*code);
   for (size_t i = 0; i < 128; ++i) {
@@ -2635,7 +2635,7 @@ TEST(uxtb) {
   Isolate* const isolate = CcTest::i_isolate();
   HandleScope scope(isolate);
   RandomNumberGenerator* const rng = isolate->random_number_generator();
-  Assembler assm(isolate, nullptr, 0);
+  Assembler assm(AssemblerOptions{}, nullptr, 0);
   __ uxtb(r1, r1);
   __ str(r1, MemOperand(r0));
   __ bx(lr);
@@ -2644,7 +2644,7 @@ TEST(uxtb) {
   Handle<Code> code =
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef OBJECT_PRINT
-  code->Print(std::cout);
+  code->Print(isolate, std::cout);
 #endif
   auto f = GeneratedCode<F_piiii>::FromCode(*code);
   for (size_t i = 0; i < 128; ++i) {
@@ -2660,7 +2660,7 @@ TEST(uxtab) {
   Isolate* const isolate = CcTest::i_isolate();
   HandleScope scope(isolate);
   RandomNumberGenerator* const rng = isolate->random_number_generator();
-  Assembler assm(isolate, nullptr, 0);
+  Assembler assm(AssemblerOptions{}, nullptr, 0);
   __ uxtab(r1, r2, r1);
   __ str(r1, MemOperand(r0));
   __ bx(lr);
@@ -2669,7 +2669,7 @@ TEST(uxtab) {
   Handle<Code> code =
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef OBJECT_PRINT
-  code->Print(std::cout);
+  code->Print(isolate, std::cout);
 #endif
   auto f = GeneratedCode<F_piiii>::FromCode(*code);
   for (size_t i = 0; i < 128; ++i) {
@@ -2685,7 +2685,7 @@ TEST(uxth) {
   Isolate* const isolate = CcTest::i_isolate();
   HandleScope scope(isolate);
   RandomNumberGenerator* const rng = isolate->random_number_generator();
-  Assembler assm(isolate, nullptr, 0);
+  Assembler assm(AssemblerOptions{}, nullptr, 0);
   __ uxth(r1, r1);
   __ str(r1, MemOperand(r0));
   __ bx(lr);
@@ -2694,7 +2694,7 @@ TEST(uxth) {
   Handle<Code> code =
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef OBJECT_PRINT
-  code->Print(std::cout);
+  code->Print(isolate, std::cout);
 #endif
   auto f = GeneratedCode<F_piiii>::FromCode(*code);
   for (size_t i = 0; i < 128; ++i) {
@@ -2710,7 +2710,7 @@ TEST(uxtah) {
   Isolate* const isolate = CcTest::i_isolate();
   HandleScope scope(isolate);
   RandomNumberGenerator* const rng = isolate->random_number_generator();
-  Assembler assm(isolate, nullptr, 0);
+  Assembler assm(AssemblerOptions{}, nullptr, 0);
   __ uxtah(r1, r2, r1);
   __ str(r1, MemOperand(r0));
   __ bx(lr);
@@ -2719,7 +2719,7 @@ TEST(uxtah) {
   Handle<Code> code =
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef OBJECT_PRINT
-  code->Print(std::cout);
+  code->Print(isolate, std::cout);
 #endif
   auto f = GeneratedCode<F_piiii>::FromCode(*code);
   for (size_t i = 0; i < 128; ++i) {
@@ -2739,7 +2739,7 @@ TEST(rbit) {
   CcTest::InitializeVM();
   Isolate* const isolate = CcTest::i_isolate();
   HandleScope scope(isolate);
-  Assembler assm(isolate, nullptr, 0);
+  Assembler assm(AssemblerOptions{}, nullptr, 0);
 
   if (CpuFeatures::IsSupported(ARMv7)) {
     CpuFeatureScope scope(&assm, ARMv7);
@@ -2761,7 +2761,7 @@ TEST(rbit) {
         isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 
 #ifdef OBJECT_PRINT
-    code->Print(std::cout);
+    code->Print(isolate, std::cout);
 #endif
 
     auto f = GeneratedCode<F_piiii>::FromCode(*code);
@@ -2782,9 +2782,10 @@ TEST(code_relative_offset) {
   Isolate* isolate = CcTest::i_isolate();
   HandleScope scope(isolate);
   // Initialize a code object that will contain the code.
-  Handle<HeapObject> code_object(isolate->heap()->undefined_value(), isolate);
+  Handle<HeapObject> code_object(ReadOnlyRoots(isolate).self_reference_marker(),
+                                 isolate);
 
-  Assembler assm(isolate, nullptr, 0);
+  Assembler assm(AssemblerOptions{}, nullptr, 0);
 
   Label start, target_away, target_faraway;
 
@@ -2851,7 +2852,7 @@ TEST(msr_mrs) {
   Isolate* isolate = CcTest::i_isolate();
   HandleScope scope(isolate);
 
-  Assembler assm(isolate, nullptr, 0);
+  Assembler assm(AssemblerOptions{}, nullptr, 0);
 
   // Create a helper function:
   //  void TestMsrMrs(uint32_t nzcv,
@@ -2879,8 +2880,8 @@ TEST(msr_mrs) {
   Handle<Code> code =
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef DEBUG
-  OFStream os(stdout);
-  code->Print(os);
+  StdoutStream os;
+  code->Print(isolate, os);
 #endif
   auto f = GeneratedCode<F_ippii>::FromCode(*code);
 
@@ -2933,7 +2934,7 @@ TEST(ARMv8_float32_vrintX) {
 
   // Create a function that accepts &t, and loads, manipulates, and stores
   // the floats.
-  Assembler assm(isolate, nullptr, 0);
+  Assembler assm(AssemblerOptions{}, nullptr, 0);
   Label L, C;
 
 
@@ -2977,8 +2978,8 @@ TEST(ARMv8_float32_vrintX) {
     Handle<Code> code =
         isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef DEBUG
-    OFStream os(stdout);
-    code->Print(os);
+    StdoutStream os;
+    code->Print(isolate, os);
 #endif
     auto f = GeneratedCode<F_piiii>::FromCode(*code);
 
@@ -3035,7 +3036,7 @@ TEST(ARMv8_vrintX) {
 
   // Create a function that accepts &t, and loads, manipulates, and stores
   // the doubles and floats.
-  Assembler assm(isolate, nullptr, 0);
+  Assembler assm(AssemblerOptions{}, nullptr, 0);
   Label L, C;
 
 
@@ -3079,8 +3080,8 @@ TEST(ARMv8_vrintX) {
     Handle<Code> code =
         isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef DEBUG
-    OFStream os(stdout);
-    code->Print(os);
+    StdoutStream os;
+    code->Print(isolate, os);
 #endif
     auto f = GeneratedCode<F_piiii>::FromCode(*code);
 
@@ -3124,7 +3125,7 @@ TEST(ARMv8_vsel) {
   Isolate* isolate = CcTest::i_isolate();
   HandleScope scope(isolate);
 
-  Assembler assm(isolate, nullptr, 0);
+  Assembler assm(AssemblerOptions{}, nullptr, 0);
 
   // Used to indicate whether a condition passed or failed.
   static constexpr float kResultPass = 1.0f;
@@ -3216,8 +3217,8 @@ TEST(ARMv8_vsel) {
     Handle<Code> code =
         isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef DEBUG
-    OFStream os(stdout);
-    code->Print(os);
+    StdoutStream os;
+    code->Print(isolate, os);
 #endif
     auto f = GeneratedCode<F_ippii>::FromCode(*code);
 
@@ -3274,7 +3275,7 @@ TEST(ARMv8_vminmax_f64) {
   Isolate* isolate = CcTest::i_isolate();
   HandleScope scope(isolate);
 
-  Assembler assm(isolate, nullptr, 0);
+  Assembler assm(AssemblerOptions{}, nullptr, 0);
 
   struct Inputs {
     double left_;
@@ -3307,8 +3308,8 @@ TEST(ARMv8_vminmax_f64) {
     Handle<Code> code =
         isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef DEBUG
-    OFStream os(stdout);
-    code->Print(os);
+    StdoutStream os;
+    code->Print(isolate, os);
 #endif
     auto f = GeneratedCode<F_ppiii>::FromCode(*code);
 
@@ -3354,7 +3355,7 @@ TEST(ARMv8_vminmax_f32) {
   Isolate* isolate = CcTest::i_isolate();
   HandleScope scope(isolate);
 
-  Assembler assm(isolate, nullptr, 0);
+  Assembler assm(AssemblerOptions{}, nullptr, 0);
 
   struct Inputs {
     float left_;
@@ -3387,8 +3388,8 @@ TEST(ARMv8_vminmax_f32) {
     Handle<Code> code =
         isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef DEBUG
-    OFStream os(stdout);
-    code->Print(os);
+    StdoutStream os;
+    code->Print(isolate, os);
 #endif
     auto f = GeneratedCode<F_ppiii>::FromCode(*code);
 
@@ -3517,8 +3518,8 @@ static GeneratedCode<F_ppiii> GenerateMacroFloatMinMax(MacroAssembler& assm) {
   Handle<Code> code =
       assm.isolate()->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef DEBUG
-  OFStream os(stdout);
-  code->Print(os);
+  StdoutStream os;
+  code->Print(assm.isolate(), os);
 #endif
   return GeneratedCode<F_ppiii>::FromCode(*code);
 }
@@ -3666,7 +3667,7 @@ TEST(unaligned_loads) {
   } T;
   T t;
 
-  Assembler assm(isolate, nullptr, 0);
+  Assembler assm(AssemblerOptions{}, nullptr, 0);
   __ ldrh(ip, MemOperand(r1, r2));
   __ str(ip, MemOperand(r0, offsetof(T, ldrh)));
   __ ldrsh(ip, MemOperand(r1, r2));
@@ -3680,8 +3681,8 @@ TEST(unaligned_loads) {
   Handle<Code> code =
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef DEBUG
-  OFStream os(stdout);
-  code->Print(os);
+  StdoutStream os;
+  code->Print(isolate, os);
 #endif
   auto f = GeneratedCode<F_ppiii>::FromCode(*code);
 
@@ -3713,7 +3714,7 @@ TEST(unaligned_stores) {
   Isolate* isolate = CcTest::i_isolate();
   HandleScope scope(isolate);
 
-  Assembler assm(isolate, nullptr, 0);
+  Assembler assm(AssemblerOptions{}, nullptr, 0);
   __ strh(r3, MemOperand(r0, r2));
   __ str(r3, MemOperand(r1, r2));
   __ bx(lr);
@@ -3723,8 +3724,8 @@ TEST(unaligned_stores) {
   Handle<Code> code =
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef DEBUG
-  OFStream os(stdout);
-  code->Print(os);
+  StdoutStream os;
+  code->Print(isolate, os);
 #endif
   auto f = GeneratedCode<F_ppiii>::FromCode(*code);
 
@@ -3767,7 +3768,7 @@ TEST(vswp) {
   CcTest::InitializeVM();
   Isolate* isolate = CcTest::i_isolate();
   HandleScope scope(isolate);
-  Assembler assm(isolate, nullptr, 0);
+  Assembler assm(AssemblerOptions{}, nullptr, 0);
 
   typedef struct {
     uint64_t vswp_d0;
@@ -3823,8 +3824,8 @@ TEST(vswp) {
   Handle<Code> code =
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef DEBUG
-  OFStream os(stdout);
-  code->Print(os);
+  StdoutStream os;
+  code->Print(isolate, os);
 #endif
   auto f = GeneratedCode<F_piiii>::FromCode(*code);
   f.Call(&t, 0, 0, 0, 0);
@@ -3849,7 +3850,7 @@ TEST(regress4292_b) {
   Isolate* isolate = CcTest::i_isolate();
   HandleScope scope(isolate);
 
-  Assembler assm(isolate, nullptr, 0);
+  Assembler assm(AssemblerOptions{}, nullptr, 0);
   Label end;
   __ mov(r0, Operand(isolate->factory()->infinity_value()));
   for (int i = 0; i < 1020; ++i) {
@@ -3864,7 +3865,7 @@ TEST(regress4292_bl) {
   Isolate* isolate = CcTest::i_isolate();
   HandleScope scope(isolate);
 
-  Assembler assm(isolate, nullptr, 0);
+  Assembler assm(AssemblerOptions{}, nullptr, 0);
   Label end;
   __ mov(r0, Operand(isolate->factory()->infinity_value()));
   for (int i = 0; i < 1020; ++i) {
@@ -3879,7 +3880,7 @@ TEST(regress4292_blx) {
   Isolate* isolate = CcTest::i_isolate();
   HandleScope scope(isolate);
 
-  Assembler assm(isolate, nullptr, 0);
+  Assembler assm(AssemblerOptions{}, nullptr, 0);
   Label end;
   __ mov(r0, Operand(isolate->factory()->infinity_value()));
   for (int i = 0; i < 1020; ++i) {
@@ -3894,7 +3895,7 @@ TEST(regress4292_CheckConstPool) {
   Isolate* isolate = CcTest::i_isolate();
   HandleScope scope(isolate);
 
-  Assembler assm(isolate, nullptr, 0);
+  Assembler assm(AssemblerOptions{}, nullptr, 0);
   __ mov(r0, Operand(isolate->factory()->infinity_value()));
   __ BlockConstPoolFor(1019);
   for (int i = 0; i < 1019; ++i) __ nop();
@@ -3906,7 +3907,7 @@ TEST(use_scratch_register_scope) {
   Isolate* isolate = CcTest::i_isolate();
   HandleScope scope(isolate);
 
-  Assembler assm(isolate, nullptr, 0);
+  Assembler assm(AssemblerOptions{}, nullptr, 0);
 
   // The assembler should have ip as a scratch by default.
   CHECK_EQ(*assm.GetScratchRegisterList(), ip.bit());
@@ -3928,7 +3929,7 @@ TEST(use_scratch_vfp_register_scope) {
   Isolate* isolate = CcTest::i_isolate();
   HandleScope scope(isolate);
 
-  Assembler assm(isolate, nullptr, 0);
+  Assembler assm(AssemblerOptions{}, nullptr, 0);
 
   VfpRegList orig_scratches = *assm.GetScratchVfpRegisterList();
 
@@ -4024,7 +4025,7 @@ TEST(split_add_immediate) {
   HandleScope scope(isolate);
 
   {
-    Assembler assm(isolate, nullptr, 0);
+    Assembler assm(AssemblerOptions{}, nullptr, 0);
     __ mov(r1, r0);
     // Re-use the destination as a scratch.
     __ add(r0, r1, Operand(0x12345678));
@@ -4035,8 +4036,8 @@ TEST(split_add_immediate) {
     Handle<Code> code =
         isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef DEBUG
-    OFStream os(stdout);
-    code->Print(os);
+    StdoutStream os;
+    code->Print(isolate, os);
 #endif
     auto f = GeneratedCode<F_iiiii>::FromCode(*code);
     uint32_t res = reinterpret_cast<int>(f.Call(0, 0, 0, 0, 0));
@@ -4045,7 +4046,7 @@ TEST(split_add_immediate) {
   }
 
   {
-    Assembler assm(isolate, nullptr, 0);
+    Assembler assm(AssemblerOptions{}, nullptr, 0);
     // Use ip as a scratch.
     __ add(r0, r0, Operand(0x12345678));
     __ blx(lr);
@@ -4055,8 +4056,8 @@ TEST(split_add_immediate) {
     Handle<Code> code =
         isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef DEBUG
-    OFStream os(stdout);
-    code->Print(os);
+    StdoutStream os;
+    code->Print(isolate, os);
 #endif
     auto f = GeneratedCode<F_iiiii>::FromCode(*code);
     uint32_t res = reinterpret_cast<int>(f.Call(0, 0, 0, 0, 0));
@@ -4065,7 +4066,7 @@ TEST(split_add_immediate) {
   }
 
   {
-    Assembler assm(isolate, nullptr, 0);
+    Assembler assm(AssemblerOptions{}, nullptr, 0);
     UseScratchRegisterScope temps(&assm);
     Register reserved = temps.Acquire();
     USE(reserved);
@@ -4078,8 +4079,8 @@ TEST(split_add_immediate) {
     Handle<Code> code =
         isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef DEBUG
-    OFStream os(stdout);
-    code->Print(os);
+    StdoutStream os;
+    code->Print(isolate, os);
 #endif
     auto f = GeneratedCode<F_iiiii>::FromCode(*code);
     uint32_t res = reinterpret_cast<int>(f.Call(0, 0, 0, 0, 0));
diff --git a/deps/v8/test/cctest/test-assembler-arm64.cc b/deps/v8/test/cctest/test-assembler-arm64.cc
index 871024c3e455a3..c9a13c0b1c46c1 100644
--- a/deps/v8/test/cctest/test-assembler-arm64.cc
+++ b/deps/v8/test/cctest/test-assembler-arm64.cc
@@ -6691,7 +6691,7 @@ namespace {
 void LoadLiteral(MacroAssembler* masm, Register reg, uint64_t imm) {
   // Since we do not allow non-relocatable entries in the literal pool, we need
   // to fake a relocation mode that is not NONE here.
-  masm->Ldr(reg, Immediate(imm, RelocInfo::RUNTIME_ENTRY));
+  masm->Ldr(reg, Immediate(imm, RelocInfo::EMBEDDED_OBJECT));
 }
 
 }  // namespace
@@ -15073,6 +15073,7 @@ TEST(call_no_relocation) {
   SETUP();
 
   START();
+  Address buf_addr = reinterpret_cast<Address>(buf);
 
   Label function;
   Label test;
@@ -15088,9 +15089,9 @@ TEST(call_no_relocation) {
   __ Push(lr, xzr);
   {
     Assembler::BlockConstPoolScope scope(&masm);
-    call_start = buf + __ pc_offset();
-    __ Call(buf + function.pos(), RelocInfo::NONE);
-    return_address = buf + __ pc_offset();
+    call_start = buf_addr + __ pc_offset();
+    __ Call(buf_addr + function.pos(), RelocInfo::NONE);
+    return_address = buf_addr + __ pc_offset();
   }
   __ Pop(xzr, lr);
   END();
@@ -15099,13 +15100,6 @@ TEST(call_no_relocation) {
 
   CHECK_EQUAL_64(1, x0);
 
-  // The return_address_from_call_start function doesn't currently encounter any
-  // non-relocatable sequences, so we check it here to make sure it works.
-  // TODO(jbramley): Once Crankshaft is complete, decide if we need to support
-  // non-relocatable calls at all.
-  CHECK(return_address ==
-        Assembler::return_address_from_call_start(call_start));
-
   TEARDOWN();
 }
 
diff --git a/deps/v8/test/cctest/test-assembler-ia32.cc b/deps/v8/test/cctest/test-assembler-ia32.cc
index 6d16ae3d177f3e..3650f1a7462909 100644
--- a/deps/v8/test/cctest/test-assembler-ia32.cc
+++ b/deps/v8/test/cctest/test-assembler-ia32.cc
@@ -54,7 +54,7 @@ TEST(AssemblerIa320) {
   HandleScope scope(isolate);
 
   v8::internal::byte buffer[256];
-  Assembler assm(isolate, buffer, sizeof buffer);
+  Assembler assm(AssemblerOptions{}, buffer, sizeof buffer);
 
   __ mov(eax, Operand(esp, 4));
   __ add(eax, Operand(esp, 8));
@@ -65,8 +65,8 @@ TEST(AssemblerIa320) {
   Handle<Code> code =
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef OBJECT_PRINT
-  OFStream os(stdout);
-  code->Print(os);
+  StdoutStream os;
+  code->Print(isolate, os);
 #endif
   F2 f = FUNCTION_CAST<F2>(code->entry());
   int res = f(3, 4);
@@ -81,7 +81,7 @@ TEST(AssemblerIa321) {
   HandleScope scope(isolate);
 
   v8::internal::byte buffer[256];
-  Assembler assm(isolate, buffer, sizeof buffer);
+  Assembler assm(AssemblerOptions{}, buffer, sizeof buffer);
   Label L, C;
 
   __ mov(edx, Operand(esp, 4));
@@ -102,8 +102,8 @@ TEST(AssemblerIa321) {
   Handle<Code> code =
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef OBJECT_PRINT
-  OFStream os(stdout);
-  code->Print(os);
+  StdoutStream os;
+  code->Print(isolate, os);
 #endif
   F1 f = FUNCTION_CAST<F1>(code->entry());
   int res = f(100);
@@ -118,7 +118,7 @@ TEST(AssemblerIa322) {
   HandleScope scope(isolate);
 
   v8::internal::byte buffer[256];
-  Assembler assm(isolate, buffer, sizeof buffer);
+  Assembler assm(AssemblerOptions{}, buffer, sizeof buffer);
   Label L, C;
 
   __ mov(edx, Operand(esp, 4));
@@ -136,15 +136,15 @@ TEST(AssemblerIa322) {
 
   // some relocated stuff here, not executed
   __ mov(eax, isolate->factory()->true_value());
-  __ jmp(nullptr, RelocInfo::RUNTIME_ENTRY);
+  __ jmp(kNullAddress, RelocInfo::RUNTIME_ENTRY);
 
   CodeDesc desc;
   assm.GetCode(isolate, &desc);
   Handle<Code> code =
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef OBJECT_PRINT
-  OFStream os(stdout);
-  code->Print(os);
+  StdoutStream os;
+  code->Print(isolate, os);
 #endif
   F1 f = FUNCTION_CAST<F1>(code->entry());
   int res = f(10);
@@ -162,7 +162,7 @@ TEST(AssemblerIa323) {
   HandleScope scope(isolate);
 
   v8::internal::byte buffer[256];
-  Assembler assm(isolate, buffer, sizeof buffer);
+  Assembler assm(AssemblerOptions{}, buffer, sizeof buffer);
 
   __ cvttss2si(eax, Operand(esp, 4));
   __ ret(0);
@@ -172,8 +172,8 @@ TEST(AssemblerIa323) {
   Handle<Code> code =
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef OBJECT_PRINT
-  OFStream os(stdout);
-  code->Print(os);
+  StdoutStream os;
+  code->Print(isolate, os);
 #endif
   F3 f = FUNCTION_CAST<F3>(code->entry());
   int res = f(static_cast<float>(-3.1415));
@@ -191,7 +191,7 @@ TEST(AssemblerIa324) {
   HandleScope scope(isolate);
 
   v8::internal::byte buffer[256];
-  Assembler assm(isolate, buffer, sizeof buffer);
+  Assembler assm(AssemblerOptions{}, buffer, sizeof buffer);
 
   __ cvttsd2si(eax, Operand(esp, 4));
   __ ret(0);
@@ -201,8 +201,8 @@ TEST(AssemblerIa324) {
   Handle<Code> code =
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef OBJECT_PRINT
-  OFStream os(stdout);
-  code->Print(os);
+  StdoutStream os;
+  code->Print(isolate, os);
 #endif
   F4 f = FUNCTION_CAST<F4>(code->entry());
   int res = f(2.718281828);
@@ -218,7 +218,7 @@ TEST(AssemblerIa325) {
   HandleScope scope(isolate);
 
   v8::internal::byte buffer[256];
-  Assembler assm(isolate, buffer, sizeof buffer);
+  Assembler assm(AssemblerOptions{}, buffer, sizeof buffer);
 
   __ mov(eax, Operand(reinterpret_cast<intptr_t>(&baz), RelocInfo::NONE));
   __ ret(0);
@@ -241,7 +241,7 @@ TEST(AssemblerIa326) {
   Isolate* isolate = reinterpret_cast<Isolate*>(CcTest::isolate());
   HandleScope scope(isolate);
   v8::internal::byte buffer[256];
-  Assembler assm(isolate, buffer, sizeof buffer);
+  Assembler assm(AssemblerOptions{}, buffer, sizeof buffer);
 
   __ movsd(xmm0, Operand(esp, 1 * kPointerSize));
   __ movsd(xmm1, Operand(esp, 3 * kPointerSize));
@@ -261,8 +261,8 @@ TEST(AssemblerIa326) {
   Handle<Code> code =
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef OBJECT_PRINT
-  OFStream os(stdout);
-  code->Print(os);
+  StdoutStream os;
+  code->Print(isolate, os);
 #endif
   F5 f = FUNCTION_CAST<F5>(code->entry());
   double res = f(2.2, 1.1);
@@ -279,7 +279,7 @@ TEST(AssemblerIa328) {
   Isolate* isolate = reinterpret_cast<Isolate*>(CcTest::isolate());
   HandleScope scope(isolate);
   v8::internal::byte buffer[256];
-  Assembler assm(isolate, buffer, sizeof buffer);
+  Assembler assm(AssemblerOptions{}, buffer, sizeof buffer);
   __ mov(eax, Operand(esp, 4));
   __ cvtsi2sd(xmm0, eax);
   // Copy xmm0 to st(0) using eight bytes of stack.
@@ -293,8 +293,8 @@ TEST(AssemblerIa328) {
   Handle<Code> code =
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef OBJECT_PRINT
-  OFStream os(stdout);
-  code->Print(os);
+  StdoutStream os;
+  code->Print(isolate, os);
 #endif
   F6 f = FUNCTION_CAST<F6>(code->entry());
   double res = f(12);
@@ -308,7 +308,7 @@ TEST(AssemblerIa3210) {
   CcTest::InitializeVM();
   Isolate* isolate = reinterpret_cast<Isolate*>(CcTest::isolate());
   HandleScope scope(isolate);
-  Assembler assm(isolate, nullptr, 0);
+  Assembler assm(AssemblerOptions{}, nullptr, 0);
 
   Label target;
   __ j(equal, &target);
@@ -323,7 +323,7 @@ TEST(AssemblerMultiByteNop) {
   Isolate* isolate = reinterpret_cast<Isolate*>(CcTest::isolate());
   HandleScope scope(isolate);
   v8::internal::byte buffer[1024];
-  Assembler assm(isolate, buffer, sizeof(buffer));
+  Assembler assm(AssemblerOptions{}, buffer, sizeof(buffer));
   __ push(ebx);
   __ push(ecx);
   __ push(edx);
@@ -395,7 +395,7 @@ void DoSSE2(const v8::FunctionCallbackInfo<v8::Value>& args) {
   CHECK_EQ(ELEMENT_COUNT, vec->Length());
 
   v8::internal::byte buffer[256];
-  Assembler assm(isolate, buffer, sizeof buffer);
+  Assembler assm(AssemblerOptions{}, buffer, sizeof buffer);
 
   // Remove return address from the stack for fix stack frame alignment.
   __ pop(ecx);
@@ -490,8 +490,8 @@ TEST(AssemblerIa32Extractps) {
   Handle<Code> code =
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef OBJECT_PRINT
-  OFStream os(stdout);
-  code->Print(os);
+  StdoutStream os;
+  code->Print(isolate, os);
 #endif
 
   F4 f = FUNCTION_CAST<F4>(code->entry());
@@ -530,8 +530,8 @@ TEST(AssemblerIa32SSE) {
   Handle<Code> code =
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef OBJECT_PRINT
-  OFStream os(stdout);
-  code->Print(os);
+  StdoutStream os;
+  code->Print(isolate, os);
 #endif
 
   F8 f = FUNCTION_CAST<F8>(code->entry());
@@ -563,8 +563,8 @@ TEST(AssemblerIa32SSE3) {
   Handle<Code> code =
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef OBJECT_PRINT
-  OFStream os(stdout);
-  code->Print(os);
+  StdoutStream os;
+  code->Print(isolate, os);
 #endif
 
   F8 f = FUNCTION_CAST<F8>(code->entry());
@@ -791,8 +791,8 @@ TEST(AssemblerX64FMA_sd) {
   Handle<Code> code =
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef OBJECT_PRINT
-  OFStream os(stdout);
-  code->Print(os);
+  StdoutStream os;
+  code->Print(isolate, os);
 #endif
 
   F9 f = FUNCTION_CAST<F9>(code->entry());
@@ -1020,8 +1020,8 @@ TEST(AssemblerX64FMA_ss) {
   Handle<Code> code =
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef OBJECT_PRINT
-  OFStream os(stdout);
-  code->Print(os);
+  StdoutStream os;
+  code->Print(isolate, os);
 #endif
 
   F10 f = FUNCTION_CAST<F10>(code->entry());
@@ -1128,8 +1128,8 @@ TEST(AssemblerIa32BMI1) {
   Handle<Code> code =
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef OBJECT_PRINT
-  OFStream os(stdout);
-  code->Print(os);
+  StdoutStream os;
+  code->Print(isolate, os);
 #endif
 
   F0 f = FUNCTION_CAST<F0>(code->entry());
@@ -1176,8 +1176,8 @@ TEST(AssemblerIa32LZCNT) {
   Handle<Code> code =
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef OBJECT_PRINT
-  OFStream os(stdout);
-  code->Print(os);
+  StdoutStream os;
+  code->Print(isolate, os);
 #endif
 
   F0 f = FUNCTION_CAST<F0>(code->entry());
@@ -1224,8 +1224,8 @@ TEST(AssemblerIa32POPCNT) {
   Handle<Code> code =
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef OBJECT_PRINT
-  OFStream os(stdout);
-  code->Print(os);
+  StdoutStream os;
+  code->Print(isolate, os);
 #endif
 
   F0 f = FUNCTION_CAST<F0>(code->entry());
@@ -1370,8 +1370,8 @@ TEST(AssemblerIa32BMI2) {
   Handle<Code> code =
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef OBJECT_PRINT
-  OFStream os(stdout);
-  code->Print(os);
+  StdoutStream os;
+  code->Print(isolate, os);
 #endif
 
   F0 f = FUNCTION_CAST<F0>(code->entry());
@@ -1384,7 +1384,7 @@ TEST(AssemblerIa32JumpTables1) {
   CcTest::InitializeVM();
   Isolate* isolate = reinterpret_cast<Isolate*>(CcTest::isolate());
   HandleScope scope(isolate);
-  Assembler assm(isolate, nullptr, 0);
+  Assembler assm(AssemblerOptions{}, nullptr, 0);
 
   const int kNumCases = 512;
   int values[kNumCases];
@@ -1414,8 +1414,8 @@ TEST(AssemblerIa32JumpTables1) {
   Handle<Code> code =
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef OBJECT_PRINT
-  OFStream os(stdout);
-  code->Print(os);
+  StdoutStream os;
+  code->Print(isolate, os);
 #endif
   F1 f = FUNCTION_CAST<F1>(code->entry());
   for (int i = 0; i < kNumCases; ++i) {
@@ -1431,7 +1431,7 @@ TEST(AssemblerIa32JumpTables2) {
   CcTest::InitializeVM();
   Isolate* isolate = reinterpret_cast<Isolate*>(CcTest::isolate());
   HandleScope scope(isolate);
-  Assembler assm(isolate, nullptr, 0);
+  Assembler assm(AssemblerOptions{}, nullptr, 0);
 
   const int kNumCases = 512;
   int values[kNumCases];
@@ -1462,8 +1462,8 @@ TEST(AssemblerIa32JumpTables2) {
   Handle<Code> code =
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef OBJECT_PRINT
-  OFStream os(stdout);
-  code->Print(os);
+  StdoutStream os;
+  code->Print(isolate, os);
 #endif
   F1 f = FUNCTION_CAST<F1>(code->entry());
   for (int i = 0; i < kNumCases; ++i) {
@@ -1480,7 +1480,7 @@ TEST(Regress621926) {
   CcTest::InitializeVM();
   Isolate* isolate = reinterpret_cast<Isolate*>(CcTest::isolate());
   HandleScope scope(isolate);
-  Assembler assm(isolate, nullptr, 0);
+  Assembler assm(AssemblerOptions{}, nullptr, 0);
 
   uint16_t a = 42;
 
@@ -1506,8 +1506,8 @@ TEST(Regress621926) {
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 
 #ifdef OBJECT_PRINT
-  OFStream os(stdout);
-  code->Print(os);
+  StdoutStream os;
+  code->Print(isolate, os);
 #endif
 
   F0 f = FUNCTION_CAST<F0>(code->entry());
diff --git a/deps/v8/test/cctest/test-assembler-mips.cc b/deps/v8/test/cctest/test-assembler-mips.cc
index 3825d5e8cec693..e3880b533158ca 100644
--- a/deps/v8/test/cctest/test-assembler-mips.cc
+++ b/deps/v8/test/cctest/test-assembler-mips.cc
@@ -543,7 +543,7 @@ TEST(MIPS6) {
   } T;
   T t;
 
-  Assembler assm(isolate, nullptr, 0);
+  Assembler assm(AssemblerOptions{}, nullptr, 0);
   Label L, C;
 
   // Basic word load/store.
@@ -909,7 +909,7 @@ TEST(MIPS11) {
   } T;
   T t;
 
-  Assembler assm(isolate, nullptr, 0);
+  Assembler assm(AssemblerOptions{}, nullptr, 0);
 
   // Test all combinations of LWL and vAddr.
   __ lw(t0, MemOperand(a0, offsetof(T, reg_init)) );
@@ -1334,7 +1334,7 @@ TEST(MIPS15) {
   CcTest::InitializeVM();
   Isolate* isolate = CcTest::i_isolate();
   HandleScope scope(isolate);
-  Assembler assm(isolate, nullptr, 0);
+  Assembler assm(AssemblerOptions{}, nullptr, 0);
 
   Label target;
   __ beq(v0, v1, &target);
@@ -3151,7 +3151,7 @@ TEST(jump_tables1) {
   CcTest::InitializeVM();
   Isolate* isolate = CcTest::i_isolate();
   HandleScope scope(isolate);
-  Assembler assm(isolate, nullptr, 0);
+  Assembler assm(AssemblerOptions{}, nullptr, 0);
 
   const int kNumCases = 512;
   int values[kNumCases];
@@ -3202,7 +3202,7 @@ TEST(jump_tables1) {
   Handle<Code> code =
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef OBJECT_PRINT
-  code->Print(std::cout);
+  code->Print(isolate, std::cout);
 #endif
   auto f = GeneratedCode<F1>::FromCode(*code);
   for (int i = 0; i < kNumCases; ++i) {
@@ -3218,7 +3218,7 @@ TEST(jump_tables2) {
   CcTest::InitializeVM();
   Isolate* isolate = CcTest::i_isolate();
   HandleScope scope(isolate);
-  Assembler assm(isolate, nullptr, 0);
+  Assembler assm(AssemblerOptions{}, nullptr, 0);
 
   const int kNumCases = 512;
   int values[kNumCases];
@@ -3271,7 +3271,7 @@ TEST(jump_tables2) {
   Handle<Code> code =
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef OBJECT_PRINT
-  code->Print(std::cout);
+  code->Print(isolate, std::cout);
 #endif
   auto f = GeneratedCode<F1>::FromCode(*code);
   for (int i = 0; i < kNumCases; ++i) {
@@ -3287,13 +3287,13 @@ TEST(jump_tables3) {
   CcTest::InitializeVM();
   Isolate* isolate = CcTest::i_isolate();
   HandleScope scope(isolate);
-  Assembler assm(isolate, nullptr, 0);
+  Assembler assm(AssemblerOptions{}, nullptr, 0);
 
   const int kNumCases = 256;
   Handle<Object> values[kNumCases];
   for (int i = 0; i < kNumCases; ++i) {
     double value = isolate->random_number_generator()->NextDouble();
-    values[i] = isolate->factory()->NewHeapNumber(value, IMMUTABLE, TENURED);
+    values[i] = isolate->factory()->NewHeapNumber(value, TENURED);
   }
   Label labels[kNumCases];
   Object* obj;
@@ -3347,14 +3347,14 @@ TEST(jump_tables3) {
   Handle<Code> code =
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef OBJECT_PRINT
-  code->Print(std::cout);
+  code->Print(isolate, std::cout);
 #endif
   auto f = GeneratedCode<F1>::FromCode(*code);
   for (int i = 0; i < kNumCases; ++i) {
     Handle<Object> result(f.Call(i, 0, 0, 0, 0), isolate);
 #ifdef OBJECT_PRINT
     ::printf("f(%d) = ", i);
-    result->Print(std::cout);
+    result->Print(isolate, std::cout);
     ::printf("\n");
 #endif
     CHECK(values[i].is_identical_to(result));
@@ -3377,7 +3377,7 @@ TEST(BITSWAP) {
     } T;
     T t;
 
-    Assembler assm(isolate, nullptr, 0);
+    Assembler assm(AssemblerOptions{}, nullptr, 0);
 
     __ lw(a2, MemOperand(a0, offsetof(T, r1)));
     __ nop();
@@ -5013,7 +5013,7 @@ void run_bz_bnz(TestCaseMsaBranch* input, Branch GenerateBranch,
   Handle<Code> code =
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef OBJECT_PRINT
-  code->Print(std::cout);
+  code->Print(isolate, std::cout);
 #endif
   auto f = GeneratedCode<F3>::FromCode(*code);
 
@@ -5830,7 +5830,7 @@ TEST(MSA_fill_copy) {
   Handle<Code> code =
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef OBJECT_PRINT
-  code->Print(std::cout);
+  code->Print(isolate, std::cout);
 #endif
   auto f = GeneratedCode<F3>::FromCode(*code);
 
@@ -5899,7 +5899,7 @@ TEST(MSA_fill_copy_2) {
   Handle<Code> code =
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef OBJECT_PRINT
-  code->Print(std::cout);
+  code->Print(isolate, std::cout);
 #endif
   auto f = GeneratedCode<F4>::FromCode(*code);
 
@@ -5957,7 +5957,7 @@ TEST(MSA_fill_copy_3) {
   Handle<Code> code =
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef OBJECT_PRINT
-  code->Print(std::cout);
+  code->Print(isolate, std::cout);
 #endif
   auto f = GeneratedCode<F4>::FromCode(*code);
 
@@ -6003,7 +6003,7 @@ void run_msa_insert(int32_t rs_value, int n, msa_reg_t* w) {
   Handle<Code> code =
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef OBJECT_PRINT
-  code->Print(std::cout);
+  code->Print(isolate, std::cout);
 #endif
   auto f = GeneratedCode<F3>::FromCode(*code);
 
@@ -6104,7 +6104,7 @@ TEST(MSA_move_v) {
     Handle<Code> code =
         isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef OBJECT_PRINT
-    code->Print(std::cout);
+    code->Print(isolate, std::cout);
 #endif
     auto f = GeneratedCode<F3>::FromCode(*code);
     (f.Call(&t[i].wd_lo, 0, 0, 0, 0));
@@ -6150,7 +6150,7 @@ void run_msa_sldi(OperFunc GenerateOperation,
     Handle<Code> code =
         isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef OBJECT_PRINT
-    code->Print(std::cout);
+    code->Print(isolate, std::cout);
 #endif
     auto f = GeneratedCode<F3>::FromCode(*code);
     (f.Call(&res[0], 0, 0, 0, 0));
@@ -6236,7 +6236,7 @@ void run_msa_ctc_cfc(uint32_t value) {
   Handle<Code> code =
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef OBJECT_PRINT
-  code->Print(std::cout);
+  code->Print(isolate, std::cout);
 #endif
   auto f = GeneratedCode<F3>::FromCode(*code);
 
@@ -6347,7 +6347,7 @@ void run_msa_i8(SecondaryField opcode, uint64_t ws_lo, uint64_t ws_hi,
   Handle<Code> code =
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef OBJECT_PRINT
-  code->Print(std::cout);
+  code->Print(isolate, std::cout);
 #endif
   auto f = GeneratedCode<F3>::FromCode(*code);
 
@@ -6640,7 +6640,7 @@ void run_msa_i5(struct TestCaseMsaI5* input, bool i5_sign_ext,
   Handle<Code> code =
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef OBJECT_PRINT
-  code->Print(std::cout);
+  code->Print(isolate, std::cout);
 #endif
   auto f = GeneratedCode<F3>::FromCode(*code);
 
@@ -7061,7 +7061,7 @@ void run_msa_2r(const struct TestCaseMsa2R* input,
   Handle<Code> code =
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef OBJECT_PRINT
-  code->Print(std::cout);
+  code->Print(isolate, std::cout);
 #endif
   auto f = GeneratedCode<F3>::FromCode(*code);
 
@@ -8112,7 +8112,7 @@ void run_msa_vector(struct TestCaseMsaVector* input,
   Handle<Code> code =
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef OBJECT_PRINT
-  code->Print(std::cout);
+  code->Print(isolate, std::cout);
 #endif
   auto f = GeneratedCode<F3>::FromCode(*code);
 
@@ -8201,7 +8201,7 @@ void run_msa_bit(struct TestCaseMsaBit* input, InstFunc GenerateInstructionFunc,
   Handle<Code> code =
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef OBJECT_PRINT
-  code->Print(std::cout);
+  code->Print(isolate, std::cout);
 #endif
   auto f = GeneratedCode<F3>::FromCode(*code);
 
@@ -8675,7 +8675,7 @@ void run_msa_i10(int32_t input, InstFunc GenerateVectorInstructionFunc,
   Handle<Code> code =
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef OBJECT_PRINT
-  code->Print(std::cout);
+  code->Print(isolate, std::cout);
 #endif
   auto f = GeneratedCode<F3>::FromCode(*code);
 
@@ -8754,7 +8754,7 @@ void run_msa_mi10(InstFunc GenerateVectorInstructionFunc) {
   Handle<Code> code =
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef OBJECT_PRINT
-  code->Print(std::cout);
+  code->Print(isolate, std::cout);
 #endif
   auto f = GeneratedCode<F4>::FromCode(*code);
 
@@ -8834,7 +8834,7 @@ void run_msa_3r(struct TestCaseMsa3R* input, InstFunc GenerateI5InstructionFunc,
   Handle<Code> code =
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef OBJECT_PRINT
-  code->Print(std::cout);
+  code->Print(isolate, std::cout);
 #endif
   auto f = GeneratedCode<F3>::FromCode(*code);
 
@@ -9840,7 +9840,7 @@ void run_msa_3rf(const struct TestCaseMsa3RF* input,
   Handle<Code> code =
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef OBJECT_PRINT
-  code->Print(std::cout);
+  code->Print(isolate, std::cout);
 #endif
   auto f = GeneratedCode<F3>::FromCode(*code);
 
diff --git a/deps/v8/test/cctest/test-assembler-mips64.cc b/deps/v8/test/cctest/test-assembler-mips64.cc
index 42910ee6648cbb..e048636dcb05b9 100644
--- a/deps/v8/test/cctest/test-assembler-mips64.cc
+++ b/deps/v8/test/cctest/test-assembler-mips64.cc
@@ -1363,7 +1363,7 @@ TEST(MIPS15) {
   CcTest::InitializeVM();
   Isolate* isolate = CcTest::i_isolate();
   HandleScope scope(isolate);
-  Assembler assm(isolate, nullptr, 0);
+  Assembler assm(AssemblerOptions{}, nullptr, 0);
 
   Label target;
   __ beq(v0, v1, &target);
@@ -3330,7 +3330,7 @@ TEST(jump_tables1) {
   Handle<Code> code =
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef OBJECT_PRINT
-  code->Print(std::cout);
+  code->Print(isolate, std::cout);
 #endif
   auto f = GeneratedCode<F1>::FromCode(*code);
   for (int i = 0; i < kNumCases; ++i) {
@@ -3400,7 +3400,7 @@ TEST(jump_tables2) {
   Handle<Code> code =
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef OBJECT_PRINT
-  code->Print(std::cout);
+  code->Print(isolate, std::cout);
 #endif
   auto f = GeneratedCode<F1>::FromCode(*code);
   for (int i = 0; i < kNumCases; ++i) {
@@ -3423,7 +3423,7 @@ TEST(jump_tables3) {
   Handle<Object> values[kNumCases];
   for (int i = 0; i < kNumCases; ++i) {
     double value = isolate->random_number_generator()->NextDouble();
-    values[i] = isolate->factory()->NewHeapNumber(value, IMMUTABLE, TENURED);
+    values[i] = isolate->factory()->NewHeapNumber(value, TENURED);
   }
   Label labels[kNumCases];
   Object* obj;
@@ -3480,14 +3480,14 @@ TEST(jump_tables3) {
   Handle<Code> code =
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef OBJECT_PRINT
-  code->Print(std::cout);
+  code->Print(isolate, std::cout);
 #endif
   auto f = GeneratedCode<F1>::FromCode(*code);
   for (int i = 0; i < kNumCases; ++i) {
     Handle<Object> result(f.Call(i, 0, 0, 0, 0), isolate);
 #ifdef OBJECT_PRINT
     ::printf("f(%d) = ", i);
-    result->Print(std::cout);
+    result->Print(isolate, std::cout);
     ::printf("\n");
 #endif
     CHECK(values[i].is_identical_to(result));
@@ -5087,7 +5087,7 @@ uint64_t run_li_macro(uint64_t imm, LiFlags mode, int32_t num_instr = 0) {
   Handle<Code> code =
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef OBJECT_PRINT
-  code->Print(std::cout);
+  code->Print(isolate, std::cout);
 #endif
   auto f = GeneratedCode<F2>::FromCode(*code);
 
@@ -5639,7 +5639,7 @@ void run_bz_bnz(TestCaseMsaBranch* input, Branch GenerateBranch,
   Handle<Code> code =
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef OBJECT_PRINT
-  code->Print(std::cout);
+  code->Print(isolate, std::cout);
 #endif
   auto f = GeneratedCode<F3>::FromCode(*code);
 
@@ -6428,7 +6428,7 @@ uint64_t run_Subu(uint64_t imm, int32_t num_instr) {
   Handle<Code> code =
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef OBJECT_PRINT
-  code->Print(std::cout);
+  code->Print(isolate, std::cout);
 #endif
   auto f = GeneratedCode<F2>::FromCode(*code);
 
@@ -6512,7 +6512,7 @@ uint64_t run_Dsubu(uint64_t imm, int32_t num_instr) {
   Handle<Code> code =
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef OBJECT_PRINT
-  code->Print(std::cout);
+  code->Print(isolate, std::cout);
 #endif
   auto f = GeneratedCode<F2>::FromCode(*code);
 
@@ -6823,7 +6823,7 @@ TEST(MSA_fill_copy) {
   Handle<Code> code =
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef OBJECT_PRINT
-  code->Print(std::cout);
+  code->Print(isolate, std::cout);
 #endif
   auto f = GeneratedCode<F3>::FromCode(*code);
 
@@ -6887,7 +6887,7 @@ TEST(MSA_fill_copy_2) {
   Handle<Code> code =
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef OBJECT_PRINT
-  code->Print(std::cout);
+  code->Print(isolate, std::cout);
 #endif
   auto f = GeneratedCode<F5>::FromCode(*code);
 
@@ -6941,7 +6941,7 @@ TEST(MSA_fill_copy_3) {
   Handle<Code> code =
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef OBJECT_PRINT
-  code->Print(std::cout);
+  code->Print(isolate, std::cout);
 #endif
   auto f = GeneratedCode<F5>::FromCode(*code);
 
@@ -6991,7 +6991,7 @@ void run_msa_insert(int64_t rs_value, int n, msa_reg_t* w) {
   Handle<Code> code =
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef OBJECT_PRINT
-  code->Print(std::cout);
+  code->Print(isolate, std::cout);
 #endif
   auto f = GeneratedCode<F3>::FromCode(*code);
 
@@ -7102,7 +7102,7 @@ void run_msa_ctc_cfc(uint64_t value) {
   Handle<Code> code =
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef OBJECT_PRINT
-  code->Print(std::cout);
+  code->Print(isolate, std::cout);
 #endif
   auto f = GeneratedCode<F3>::FromCode(*code);
 
@@ -7152,7 +7152,7 @@ TEST(MSA_move_v) {
     Handle<Code> code =
         isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef OBJECT_PRINT
-    code->Print(std::cout);
+    code->Print(isolate, std::cout);
 #endif
     auto f = GeneratedCode<F3>::FromCode(*code);
     f.Call(&t[i].wd_lo, 0, 0, 0, 0);
@@ -7198,7 +7198,7 @@ void run_msa_sldi(OperFunc GenerateOperation,
     Handle<Code> code =
         isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef OBJECT_PRINT
-    code->Print(std::cout);
+    code->Print(isolate, std::cout);
 #endif
     auto f = GeneratedCode<F3>::FromCode(*code);
     f.Call(&res[0], 0, 0, 0, 0);
@@ -7359,7 +7359,7 @@ void run_msa_i8(SecondaryField opcode, uint64_t ws_lo, uint64_t ws_hi,
   Handle<Code> code =
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef OBJECT_PRINT
-  code->Print(std::cout);
+  code->Print(isolate, std::cout);
 #endif
   auto f = GeneratedCode<F3>::FromCode(*code);
 
@@ -7564,7 +7564,7 @@ void run_msa_i5(struct TestCaseMsaI5* input, bool i5_sign_ext,
   Handle<Code> code =
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef OBJECT_PRINT
-  code->Print(std::cout);
+  code->Print(isolate, std::cout);
 #endif
   auto f = GeneratedCode<F3>::FromCode(*code);
 
@@ -7991,7 +7991,7 @@ void run_msa_2r(const struct TestCaseMsa2R* input,
   Handle<Code> code =
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef OBJECT_PRINT
-  code->Print(std::cout);
+  code->Print(isolate, std::cout);
 #endif
   auto f = GeneratedCode<F3>::FromCode(*code);
 
@@ -9042,7 +9042,7 @@ void run_msa_vector(struct TestCaseMsaVector* input,
   Handle<Code> code =
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef OBJECT_PRINT
-  code->Print(std::cout);
+  code->Print(isolate, std::cout);
 #endif
   auto f = GeneratedCode<F3>::FromCode(*code);
 
@@ -9131,7 +9131,7 @@ void run_msa_bit(struct TestCaseMsaBit* input, InstFunc GenerateInstructionFunc,
   Handle<Code> code =
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef OBJECT_PRINT
-  code->Print(std::cout);
+  code->Print(isolate, std::cout);
 #endif
   auto f = GeneratedCode<F3>::FromCode(*code);
 
@@ -9605,7 +9605,7 @@ void run_msa_i10(int32_t input, InstFunc GenerateVectorInstructionFunc,
   Handle<Code> code =
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef OBJECT_PRINT
-  code->Print(std::cout);
+  code->Print(isolate, std::cout);
 #endif
   auto f = GeneratedCode<F3>::FromCode(*code);
 
@@ -9684,7 +9684,7 @@ void run_msa_mi10(InstFunc GenerateVectorInstructionFunc) {
   Handle<Code> code =
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef OBJECT_PRINT
-  code->Print(std::cout);
+  code->Print(isolate, std::cout);
 #endif
   auto f = GeneratedCode<F5>::FromCode(*code);
 
@@ -9764,7 +9764,7 @@ void run_msa_3r(struct TestCaseMsa3R* input, InstFunc GenerateI5InstructionFunc,
   Handle<Code> code =
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef OBJECT_PRINT
-  code->Print(std::cout);
+  code->Print(isolate, std::cout);
 #endif
   auto f = GeneratedCode<F3>::FromCode(*code);
 
@@ -10769,7 +10769,7 @@ void run_msa_3rf(const struct TestCaseMsa3RF* input,
   Handle<Code> code =
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef OBJECT_PRINT
-  code->Print(std::cout);
+  code->Print(isolate, std::cout);
 #endif
   auto f = GeneratedCode<F3>::FromCode(*code);
 
diff --git a/deps/v8/test/cctest/test-assembler-ppc.cc b/deps/v8/test/cctest/test-assembler-ppc.cc
index caca6eb692a64f..de8f458b248581 100644
--- a/deps/v8/test/cctest/test-assembler-ppc.cc
+++ b/deps/v8/test/cctest/test-assembler-ppc.cc
@@ -52,7 +52,7 @@ TEST(0) {
   Isolate* isolate = CcTest::i_isolate();
   HandleScope scope(isolate);
 
-  Assembler assm(isolate, nullptr, 0);
+  Assembler assm(AssemblerOptions{}, nullptr, 0);
 
   __ function_descriptor();
 
@@ -64,7 +64,7 @@ TEST(0) {
   Handle<Code> code =
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef DEBUG
-  code->Print();
+  code->Print(isolate);
 #endif
   auto f = GeneratedCode<F_iiiii>::FromCode(*code);
   intptr_t res = reinterpret_cast<intptr_t>(f.Call(3, 4, 0, 0, 0));
@@ -79,7 +79,7 @@ TEST(1) {
   Isolate* isolate = CcTest::i_isolate();
   HandleScope scope(isolate);
 
-  Assembler assm(isolate, nullptr, 0);
+  Assembler assm(AssemblerOptions{}, nullptr, 0);
   Label L, C;
 
   __ function_descriptor();
@@ -102,7 +102,7 @@ TEST(1) {
   Handle<Code> code =
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef DEBUG
-  code->Print();
+  code->Print(isolate);
 #endif
   auto f = GeneratedCode<F_iiiii>::FromCode(*code);
   intptr_t res = reinterpret_cast<intptr_t>(f.Call(100, 0, 0, 0, 0));
@@ -116,7 +116,7 @@ TEST(2) {
   Isolate* isolate = CcTest::i_isolate();
   HandleScope scope(isolate);
 
-  Assembler assm(isolate, nullptr, 0);
+  Assembler assm(AssemblerOptions{}, nullptr, 0);
   Label L, C;
 
   __ function_descriptor();
@@ -152,7 +152,7 @@ TEST(2) {
   Handle<Code> code =
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef DEBUG
-  code->Print();
+  code->Print(isolate);
 #endif
   auto f = GeneratedCode<F_iiiii>::FromCode(*code);
   intptr_t res = reinterpret_cast<intptr_t>(f.Call(10, 0, 0, 0, 0));
@@ -173,7 +173,7 @@ TEST(3) {
   } T;
   T t;
 
-  Assembler assm(CcTest::i_isolate(), nullptr, 0);
+  Assembler assm(AssemblerOptions{}, nullptr, 0);
   Label L, C;
 
   __ function_descriptor();
@@ -224,7 +224,7 @@ TEST(3) {
   Handle<Code> code =
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef DEBUG
-  code->Print();
+  code->Print(isolate);
 #endif
   auto f = GeneratedCode<F_piiii>::FromCode(*code);
   t.i = 100000;
@@ -264,7 +264,7 @@ TEST(4) {
 
   // Create a function that accepts &t, and loads, manipulates, and stores
   // the doubles and floats.
-  Assembler assm(CcTest::i_isolate(), nullptr, 0);
+  Assembler assm(AssemblerOptions{}, nullptr, 0);
   Label L, C;
 
   if (CpuFeatures::IsSupported(VFP3)) {
@@ -339,7 +339,7 @@ TEST(4) {
         Handle<Code>())->ToObjectChecked();
     CHECK(code->IsCode());
 #ifdef DEBUG
-    Code::cast(code)->Print();
+    Code::cast(code)->Print(isolate);
 #endif
     auto f = GeneratedCode<F_piiii>::FromCode(*code);
     t.a = 1.5;
@@ -379,7 +379,7 @@ TEST(5) {
   Isolate* isolate = CcTest::i_isolate();
   HandleScope scope(isolate);
 
-  Assembler assm(isolate, nullptr, 0);
+  Assembler assm(AssemblerOptions{}, nullptr, 0);
 
   if (CpuFeatures::IsSupported(ARMv7)) {
     CpuFeatures::Scope scope(ARMv7);
@@ -399,7 +399,7 @@ TEST(5) {
         Handle<Code>())->ToObjectChecked();
     CHECK(code->IsCode());
 #ifdef DEBUG
-    Code::cast(code)->Print();
+    Code::cast(code)->Print(isolate);
 #endif
     auto f = GeneratedCode<F_iiiii>::FromCode(*code);
     int res = reinterpret_cast<int>(f.Call(0xAAAAAAAA, 0, 0, 0, 0));
@@ -415,7 +415,7 @@ TEST(6) {
   Isolate* isolate = CcTest::i_isolate();
   HandleScope scope(isolate);
 
-  Assembler assm(isolate, nullptr, 0);
+  Assembler assm(AssemblerOptions{}, nullptr, 0);
 
   if (CpuFeatures::IsSupported(ARMv7)) {
     CpuFeatures::Scope scope(ARMv7);
@@ -434,7 +434,7 @@ TEST(6) {
         Handle<Code>())->ToObjectChecked();
     CHECK(code->IsCode());
 #ifdef DEBUG
-    Code::cast(code)->Print();
+    Code::cast(code)->Print(isolate);
 #endif
     auto f = GeneratedCode<F_iiiii>::FromCode(*code);
     int res = reinterpret_cast<int>(f.Call(0xFFFF, 0, 0, 0, 0));
@@ -457,7 +457,7 @@ static void TestRoundingMode(VCVTTypes types,
   Isolate* isolate = CcTest::i_isolate();
   HandleScope scope(isolate);
 
-  Assembler assm(isolate, nullptr, 0);
+  Assembler assm(AssemblerOptions{}, nullptr, 0);
 
   if (CpuFeatures::IsSupported(VFP3)) {
     CpuFeatures::Scope scope(VFP3);
@@ -509,7 +509,7 @@ static void TestRoundingMode(VCVTTypes types,
         Handle<Code>())->ToObjectChecked();
     CHECK(code->IsCode());
 #ifdef DEBUG
-    Code::cast(code)->Print();
+    Code::cast(code)->Print(isolate);
 #endif
     auto f = GeneratedCode<F_iiiii>::FromCode(*code);
     int res = reinterpret_cast<int>(f.Call(0, 0, 0, 0, 0));
@@ -661,7 +661,7 @@ TEST(8) {
 
   // Create a function that uses vldm/vstm to move some double and
   // single precision values around in memory.
-  Assembler assm(isolate, nullptr, 0);
+  Assembler assm(AssemblerOptions{}, nullptr, 0);
 
   if (CpuFeatures::IsSupported(VFP2)) {
     CpuFeatures::Scope scope(VFP2);
@@ -696,7 +696,7 @@ TEST(8) {
         Handle<Code>())->ToObjectChecked();
     CHECK(code->IsCode());
 #ifdef DEBUG
-    Code::cast(code)->Print();
+    Code::cast(code)->Print(isolate);
 #endif
     auto fn = GeneratedCode<F_ppiii>::FromCode(*code);
     d.a = 1.1;
@@ -772,7 +772,7 @@ TEST(9) {
 
   // Create a function that uses vldm/vstm to move some double and
   // single precision values around in memory.
-  Assembler assm(isolate, nullptr, 0);
+  Assembler assm(AssemblerOptions{}, nullptr, 0);
 
   if (CpuFeatures::IsSupported(VFP2)) {
     CpuFeatures::Scope scope(VFP2);
@@ -811,7 +811,7 @@ TEST(9) {
         Handle<Code>())->ToObjectChecked();
     CHECK(code->IsCode());
 #ifdef DEBUG
-    Code::cast(code)->Print();
+    Code::cast(code)->Print(isolate);
 #endif
     auto fn = GeneratedCode<F_ppiii>::FromCode(*code);
     d.a = 1.1;
@@ -887,7 +887,7 @@ TEST(10) {
 
   // Create a function that uses vldm/vstm to move some double and
   // single precision values around in memory.
-  Assembler assm(isolate, nullptr, 0);
+  Assembler assm(AssemblerOptions{}, nullptr, 0);
 
   if (CpuFeatures::IsSupported(VFP2)) {
     CpuFeatures::Scope scope(VFP2);
@@ -922,7 +922,7 @@ TEST(10) {
         Handle<Code>())->ToObjectChecked();
     CHECK(code->IsCode());
 #ifdef DEBUG
-    Code::cast(code)->Print();
+    Code::cast(code)->Print(isolate);
 #endif
     auto fn = GeneratedCode<F_ppiii>::FromCode(*code);
     d.a = 1.1;
@@ -983,7 +983,7 @@ TEST(11) {
   i.a = 0xABCD0001;
   i.b = 0xABCD0000;
 
-  Assembler assm(isolate, nullptr, 0);
+  Assembler assm(AssemblerOptions{}, nullptr, 0);
 
   // Test HeapObject untagging.
   __ ldr(r1, MemOperand(r0, offsetof(I, a)));
@@ -1019,7 +1019,7 @@ TEST(11) {
       Handle<Code>())->ToObjectChecked();
   CHECK(code->IsCode());
 #ifdef DEBUG
-  Code::cast(code)->Print();
+  Code::cast(code)->Print(isolate);
 #endif
   auto f = GeneratedCode<F_piiii>::FromCode(*code);
   f.Call(&i, 0, 0, 0, 0);
@@ -1037,7 +1037,7 @@ TEST(12) {
   Isolate* isolate = CcTest::i_isolate();
   HandleScope scope(isolate);
 
-  Assembler assm(isolate, nullptr, 0);
+  Assembler assm(AssemblerOptions{}, nullptr, 0);
   Label target;
   __ b(eq, &target);
   __ b(ne, &target);
diff --git a/deps/v8/test/cctest/test-assembler-s390.cc b/deps/v8/test/cctest/test-assembler-s390.cc
index 614f681c6d0b10..9d7c933bb9f3fa 100644
--- a/deps/v8/test/cctest/test-assembler-s390.cc
+++ b/deps/v8/test/cctest/test-assembler-s390.cc
@@ -52,7 +52,7 @@ TEST(0) {
   Isolate* isolate = CcTest::i_isolate();
   HandleScope scope(isolate);
 
-  Assembler assm(isolate, nullptr, 0);
+  Assembler assm(AssemblerOptions{}, nullptr, 0);
 
   __ lhi(r1, Operand(3));    // test 4-byte instr
   __ llilf(r2, Operand(4));  // test 6-byte instr
@@ -65,7 +65,7 @@ TEST(0) {
   Handle<Code> code =
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef DEBUG
-  code->Print();
+  code->Print(isolate);
 #endif
   auto f = GeneratedCode<F2>::FromCode(*code);
   intptr_t res = reinterpret_cast<intptr_t>(f.Call(3, 4, 0, 0, 0));
@@ -79,7 +79,7 @@ TEST(1) {
   Isolate* isolate = CcTest::i_isolate();
   HandleScope scope(isolate);
 
-  Assembler assm(isolate, nullptr, 0);
+  Assembler assm(AssemblerOptions{}, nullptr, 0);
   Label L, C;
 
 #if defined(_AIX)
@@ -104,7 +104,7 @@ TEST(1) {
   Handle<Code> code =
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef DEBUG
-  code->Print();
+  code->Print(isolate);
 #endif
   auto f = GeneratedCode<F1>::FromCode(*code);
   intptr_t res = reinterpret_cast<intptr_t>(f.Call(100, 0, 0, 0, 0));
@@ -119,7 +119,7 @@ TEST(2) {
 
   // Create a function that accepts &t, and loads, manipulates, and stores
   // the doubles and floats.
-  Assembler assm(CcTest::i_isolate(), nullptr, 0);
+  Assembler assm(AssemblerOptions{}, nullptr, 0);
   Label L, C;
 
 #if defined(_AIX)
@@ -155,7 +155,7 @@ TEST(2) {
   Handle<Code> code =
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef DEBUG
-  code->Print();
+  code->Print(isolate);
 #endif
   auto f = GeneratedCode<F1>::FromCode(*code);
   intptr_t res = reinterpret_cast<intptr_t>(f.Call(10, 0, 0, 0, 0));
@@ -168,7 +168,7 @@ TEST(3) {
   Isolate* isolate = CcTest::i_isolate();
   HandleScope scope(isolate);
 
-  Assembler assm(isolate, nullptr, 0);
+  Assembler assm(AssemblerOptions{}, nullptr, 0);
 
   __ ar(r14, r13);
   __ sr(r14, r13);
@@ -197,7 +197,7 @@ TEST(3) {
   __ brcl(Condition(14), Operand(-123));
   __ iilf(r13, Operand(123456789));
   __ iihf(r13, Operand(-123456789));
-  __ mvc(MemOperand(r0, 123), MemOperand(r4, 567), 89);
+  __ mvc(MemOperand(r0, 123), MemOperand(r4, 567), Operand(88));
   __ sll(r13, Operand(10));
 
   v8::internal::byte* bufPos = assm.buffer_pos();
@@ -210,7 +210,7 @@ TEST(3) {
   Handle<Code> code =
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef DEBUG
-  code->Print();
+  code->Print(isolate);
 #endif
   USE(code);
   ::exit(0);
@@ -222,7 +222,7 @@ TEST(4) {
   Isolate* isolate = CcTest::i_isolate();
   HandleScope scope(isolate);
 
-  Assembler assm(isolate, nullptr, 0);
+  Assembler assm(AssemblerOptions{}, nullptr, 0);
   Label L2, L3, L4;
 
   __ chi(r2, Operand(10));
@@ -251,7 +251,7 @@ TEST(4) {
   Handle<Code> code = isolate->factory()->NewCode(
       desc, Code::STUB, Handle<Code>());
 #ifdef DEBUG
-  code->Print();
+  code->Print(isolate);
 #endif
   auto f = GeneratedCode<F2>::FromCode(*code);
   intptr_t res = reinterpret_cast<intptr_t>(
@@ -279,7 +279,7 @@ TEST(5) {
   Handle<Code> code = isolate->factory()->NewCode(
       desc, Code::STUB, Handle<Code>());
 #ifdef DEBUG
-  code->Print();
+  code->Print(isolate);
 #endif
   auto f = GeneratedCode<F2>::FromCode(*code);
   intptr_t res =
@@ -313,7 +313,7 @@ TEST(6) {
   Handle<Code> code = isolate->factory()->NewCode(
       desc, Code::STUB, Handle<Code>());
 #ifdef DEBUG
-  code->Print();
+  code->Print(isolate);
 #endif
   auto f = GeneratedCode<F2>::FromCode(*code);
   intptr_t res =
@@ -345,7 +345,7 @@ TEST(7) {
   Handle<Code> code = isolate->factory()->NewCode(
       desc, Code::STUB, Handle<Code>());
 #ifdef DEBUG
-  code->Print();
+  code->Print(isolate);
 #endif
   auto f = GeneratedCode<F2>::FromCode(*code);
   intptr_t res =
@@ -376,7 +376,7 @@ TEST(8) {
   Handle<Code> code = isolate->factory()->NewCode(
       desc, Code::STUB, Handle<Code>());
 #ifdef DEBUG
-  code->Print();
+  code->Print(isolate);
 #endif
   auto f = GeneratedCode<F1>::FromCode(*code);
   intptr_t res =
@@ -403,7 +403,7 @@ TEST(9) {
   Handle<Code> code = isolate->factory()->NewCode(
       desc, Code::STUB, Handle<Code>());
 #ifdef DEBUG
-  code->Print();
+  code->Print(isolate);
 #endif
   auto f = GeneratedCode<F1>::FromCode(*code);
   intptr_t res =
@@ -424,7 +424,7 @@ TEST(10) {
   Isolate* isolate = CcTest::i_isolate();
   HandleScope scope(isolate);
 
-  Assembler assm(isolate, nullptr, 0);
+  Assembler assm(AssemblerOptions{}, nullptr, 0);
 
   Label ok, failed;
 
@@ -488,7 +488,7 @@ TEST(10) {
   Handle<Code> code =
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef DEBUG
-  code->Print();
+  code->Print(isolate);
 #endif
   auto f = GeneratedCode<F2>::FromCode(*code);
   intptr_t res = reinterpret_cast<intptr_t>(f.Call(3, 4, 0, 0, 0));
@@ -496,6 +496,129 @@ TEST(10) {
   CHECK_EQ(0, static_cast<int>(res));
 }
 
+
+// brxh
+TEST(11) {
+  CcTest::InitializeVM();
+  Isolate* isolate = CcTest::i_isolate();
+  HandleScope scope(isolate);
+  Assembler assm(AssemblerOptions{}, nullptr, 0);
+
+  Label ok, failed, continue1, continue2;
+  // r1 - operand; r3 - inc / test val
+  __ lgfi(r1, Operand(1));
+  __ lgfi(r3, Operand(1));
+  __ brxh(r1, r3, &continue1);
+  __ b(&failed);
+
+  __ bind(&continue1);
+  __ lgfi(r1, Operand(-2));
+  __ lgfi(r3, Operand(1));
+  __ brxh(r1, r3, &failed);
+  __ brxh(r1, r3, &failed);
+  __ brxh(r1, r3, &failed);
+  __ brxh(r1, r3, &continue2);
+  __ b(&failed);
+
+  //r1 - operand; r4 - inc; r5 - test val
+  __ bind(&continue2);
+  __ lgfi(r1, Operand(-2));
+  __ lgfi(r4, Operand(1));
+  __ lgfi(r5, Operand(-1));
+  __ brxh(r1, r4, &failed);
+  __ brxh(r1, r4, &ok);
+  __ b(&failed);
+
+  __ bind(&ok);
+  __ lgfi(r2, Operand::Zero());
+  __ b(r14);  // test done.
+
+  __ bind(&failed);
+  __ lgfi(r2, Operand(1));
+  __ b(r14);  // test done.
+
+  CodeDesc desc;
+  assm.GetCode(isolate, &desc);
+  Handle<Code> code = isolate->factory()->NewCode(
+      desc, Code::STUB, Handle<Code>());
+#ifdef DEBUG
+  code->Print(isolate);
+#endif
+  auto f = GeneratedCode<F1>::FromCode(*code);
+  intptr_t res = reinterpret_cast<intptr_t>(f.Call(0, 0, 0, 0, 0));
+  ::printf("f() = %" V8PRIdPTR  "\n", res);
+  CHECK_EQ(0, static_cast<int>(res));
+}
+
+
+// brxhg
+TEST(12) {
+  CcTest::InitializeVM();
+  Isolate* isolate = CcTest::i_isolate();
+  HandleScope scope(isolate);
+  Assembler assm(AssemblerOptions{}, nullptr, 0);
+
+  Label ok, failed, continue1, continue2;
+  // r1 - operand; r3 - inc / test val
+  __ lgfi(r1, Operand(1));
+  __ lgfi(r3, Operand(1));
+  __ brxhg(r1, r3, &continue1);
+  __ b(&failed);
+
+  __ bind(&continue1);
+  __ lgfi(r1, Operand(-2));
+  __ lgfi(r3, Operand(1));
+  __ brxhg(r1, r3, &failed);
+  __ brxhg(r1, r3, &failed);
+  __ brxhg(r1, r3, &failed);
+  __ brxhg(r1, r3, &continue2);
+  __ b(&failed);
+
+  __ lgfi(r1, Operand(1));
+  __ lgfi(r3, Operand(1));
+  __ brxhg(r1, r3, &continue1);
+  __ b(&failed);
+
+  __ bind(&continue1);
+  __ lgfi(r1, Operand(-2));
+  __ lgfi(r3, Operand(1));
+  __ brxhg(r1, r3, &failed);
+  __ brxhg(r1, r3, &failed);
+  __ brxhg(r1, r3, &failed);
+  __ brxhg(r1, r3, &continue2);
+  __ b(&failed);
+
+  //r1 - operand; r4 - inc; r5 - test val
+  __ bind(&continue2);
+  __ lgfi(r1, Operand(-2));
+  __ lgfi(r4, Operand(1));
+  __ lgfi(r5, Operand(-1));
+  __ brxhg(r1, r4, &failed);
+  __ brxhg(r1, r4, &ok);
+  __ b(&failed);
+
+  __ bind(&ok);
+  __ lgfi(r2, Operand::Zero());
+  __ b(r14);  // test done.
+
+  __ bind(&failed);
+  __ lgfi(r2, Operand(1));
+  __ b(r14);  // test done.
+
+  CodeDesc desc;
+  assm.GetCode(isolate, &desc);
+  Handle<Code> code = isolate->factory()->NewCode(
+      desc, Code::STUB, Handle<Code>());
+#ifdef DEBUG
+  code->Print(isolate);
+#endif
+  auto f = GeneratedCode<F1>::FromCode(*code);
+  intptr_t res = reinterpret_cast<intptr_t>(f.Call(0, 0, 0, 0, 0));
+  ::printf("f() = %" V8PRIdPTR  "\n", res);
+  CHECK_EQ(0, static_cast<int>(res));
+}
+
+
 #undef __
 
 }  // namespace internal
diff --git a/deps/v8/test/cctest/test-assembler-x64.cc b/deps/v8/test/cctest/test-assembler-x64.cc
index 60e19d4c6cfdd5..eb7af1bab4340a 100644
--- a/deps/v8/test/cctest/test-assembler-x64.cc
+++ b/deps/v8/test/cctest/test-assembler-x64.cc
@@ -74,7 +74,7 @@ TEST(AssemblerX64ReturnOperation) {
   CcTest::InitializeVM();
   size_t allocated;
   byte* buffer = AllocateAssemblerBuffer(&allocated);
-  Assembler masm(CcTest::i_isolate(), buffer, static_cast<int>(allocated));
+  Assembler masm(AssemblerOptions{}, buffer, static_cast<int>(allocated));
 
   // Assemble a simple function that copies argument 2 and returns it.
   __ movq(rax, arg2);
@@ -85,7 +85,7 @@ TEST(AssemblerX64ReturnOperation) {
   masm.GetCode(CcTest::i_isolate(), &desc);
   MakeAssemblerBufferExecutable(buffer, allocated);
   // Call the function from C++.
-  auto f = GeneratedCode<F2>::FromAddress(CcTest::i_isolate(), buffer);
+  auto f = GeneratedCode<F2>::FromBuffer(CcTest::i_isolate(), buffer);
   int result = f.Call(3, 2);
   CHECK_EQ(2, result);
 }
@@ -95,7 +95,7 @@ TEST(AssemblerX64StackOperations) {
   CcTest::InitializeVM();
   size_t allocated;
   byte* buffer = AllocateAssemblerBuffer(&allocated);
-  Assembler masm(CcTest::i_isolate(), buffer, static_cast<int>(allocated));
+  Assembler masm(AssemblerOptions{}, buffer, static_cast<int>(allocated));
 
   // Assemble a simple function that copies argument 2 and returns it.
   // We compile without stack frame pointers, so the gdb debugger shows
@@ -116,7 +116,7 @@ TEST(AssemblerX64StackOperations) {
   masm.GetCode(CcTest::i_isolate(), &desc);
   MakeAssemblerBufferExecutable(buffer, allocated);
   // Call the function from C++.
-  auto f = GeneratedCode<F2>::FromAddress(CcTest::i_isolate(), buffer);
+  auto f = GeneratedCode<F2>::FromBuffer(CcTest::i_isolate(), buffer);
   int result = f.Call(3, 2);
   CHECK_EQ(2, result);
 }
@@ -126,7 +126,7 @@ TEST(AssemblerX64ArithmeticOperations) {
   CcTest::InitializeVM();
   size_t allocated;
   byte* buffer = AllocateAssemblerBuffer(&allocated);
-  Assembler masm(CcTest::i_isolate(), buffer, static_cast<int>(allocated));
+  Assembler masm(AssemblerOptions{}, buffer, static_cast<int>(allocated));
 
   // Assemble a simple function that adds arguments returning the sum.
   __ movq(rax, arg2);
@@ -137,7 +137,7 @@ TEST(AssemblerX64ArithmeticOperations) {
   masm.GetCode(CcTest::i_isolate(), &desc);
   MakeAssemblerBufferExecutable(buffer, allocated);
   // Call the function from C++.
-  auto f = GeneratedCode<F2>::FromAddress(CcTest::i_isolate(), buffer);
+  auto f = GeneratedCode<F2>::FromBuffer(CcTest::i_isolate(), buffer);
   int result = f.Call(3, 2);
   CHECK_EQ(5, result);
 }
@@ -147,7 +147,7 @@ TEST(AssemblerX64CmpbOperation) {
   CcTest::InitializeVM();
   size_t allocated;
   byte* buffer = AllocateAssemblerBuffer(&allocated);
-  Assembler masm(CcTest::i_isolate(), buffer, static_cast<int>(allocated));
+  Assembler masm(AssemblerOptions{}, buffer, static_cast<int>(allocated));
 
   // Assemble a function that compare argument byte returing 1 if equal else 0.
   // On Windows, it compares rcx with rdx which does not require REX prefix;
@@ -165,7 +165,7 @@ TEST(AssemblerX64CmpbOperation) {
   masm.GetCode(CcTest::i_isolate(), &desc);
   MakeAssemblerBufferExecutable(buffer, allocated);
   // Call the function from C++.
-  auto f = GeneratedCode<F2>::FromAddress(CcTest::i_isolate(), buffer);
+  auto f = GeneratedCode<F2>::FromBuffer(CcTest::i_isolate(), buffer);
   int result = f.Call(0x1002, 0x2002);
   CHECK_EQ(1, result);
   result = f.Call(0x1002, 0x2003);
@@ -176,7 +176,7 @@ TEST(AssemblerX64ImulOperation) {
   CcTest::InitializeVM();
   size_t allocated;
   byte* buffer = AllocateAssemblerBuffer(&allocated);
-  Assembler masm(CcTest::i_isolate(), buffer, static_cast<int>(allocated));
+  Assembler masm(AssemblerOptions{}, buffer, static_cast<int>(allocated));
 
   // Assemble a simple function that multiplies arguments returning the high
   // word.
@@ -189,7 +189,7 @@ TEST(AssemblerX64ImulOperation) {
   masm.GetCode(CcTest::i_isolate(), &desc);
   MakeAssemblerBufferExecutable(buffer, allocated);
   // Call the function from C++.
-  auto f = GeneratedCode<F2>::FromAddress(CcTest::i_isolate(), buffer);
+  auto f = GeneratedCode<F2>::FromBuffer(CcTest::i_isolate(), buffer);
   int result = f.Call(3, 2);
   CHECK_EQ(0, result);
   result = f.Call(0x100000000l, 0x100000000l);
@@ -203,7 +203,7 @@ TEST(AssemblerX64testbwqOperation) {
   v8::HandleScope scope(CcTest::isolate());
   size_t allocated;
   byte* buffer = AllocateAssemblerBuffer(&allocated);
-  Assembler masm(CcTest::i_isolate(), buffer, static_cast<int>(allocated));
+  Assembler masm(AssemblerOptions{}, buffer, static_cast<int>(allocated));
 
   __ pushq(rbx);
   __ pushq(rdi);
@@ -360,7 +360,7 @@ TEST(AssemblerX64testbwqOperation) {
   masm.GetCode(CcTest::i_isolate(), &desc);
   MakeAssemblerBufferExecutable(buffer, allocated);
   // Call the function from C++.
-  auto f = GeneratedCode<F2>::FromAddress(CcTest::i_isolate(), buffer);
+  auto f = GeneratedCode<F2>::FromBuffer(CcTest::i_isolate(), buffer);
   int result = f.Call(0, 0);
   CHECK_EQ(1, result);
 }
@@ -369,7 +369,7 @@ TEST(AssemblerX64XchglOperations) {
   CcTest::InitializeVM();
   size_t allocated;
   byte* buffer = AllocateAssemblerBuffer(&allocated);
-  Assembler masm(CcTest::i_isolate(), buffer, static_cast<int>(allocated));
+  Assembler masm(AssemblerOptions{}, buffer, static_cast<int>(allocated));
 
   __ movq(rax, Operand(arg1, 0));
   __ movq(r11, Operand(arg2, 0));
@@ -384,7 +384,7 @@ TEST(AssemblerX64XchglOperations) {
   // Call the function from C++.
   uint64_t left = V8_2PART_UINT64_C(0x10000000, 20000000);
   uint64_t right = V8_2PART_UINT64_C(0x30000000, 40000000);
-  auto f = GeneratedCode<F4>::FromAddress(CcTest::i_isolate(), buffer);
+  auto f = GeneratedCode<F4>::FromBuffer(CcTest::i_isolate(), buffer);
   uint64_t result = f.Call(&left, &right);
   CHECK_EQ(V8_2PART_UINT64_C(0x00000000, 40000000), left);
   CHECK_EQ(V8_2PART_UINT64_C(0x00000000, 20000000), right);
@@ -396,7 +396,7 @@ TEST(AssemblerX64OrlOperations) {
   CcTest::InitializeVM();
   size_t allocated;
   byte* buffer = AllocateAssemblerBuffer(&allocated);
-  Assembler masm(CcTest::i_isolate(), buffer, static_cast<int>(allocated));
+  Assembler masm(AssemblerOptions{}, buffer, static_cast<int>(allocated));
 
   __ movq(rax, Operand(arg2, 0));
   __ orl(Operand(arg1, 0), rax);
@@ -408,7 +408,7 @@ TEST(AssemblerX64OrlOperations) {
   // Call the function from C++.
   uint64_t left = V8_2PART_UINT64_C(0x10000000, 20000000);
   uint64_t right = V8_2PART_UINT64_C(0x30000000, 40000000);
-  auto f = GeneratedCode<F4>::FromAddress(CcTest::i_isolate(), buffer);
+  auto f = GeneratedCode<F4>::FromBuffer(CcTest::i_isolate(), buffer);
   uint64_t result = f.Call(&left, &right);
   CHECK_EQ(V8_2PART_UINT64_C(0x10000000, 60000000), left);
   USE(result);
@@ -419,7 +419,7 @@ TEST(AssemblerX64RollOperations) {
   CcTest::InitializeVM();
   size_t allocated;
   byte* buffer = AllocateAssemblerBuffer(&allocated);
-  Assembler masm(CcTest::i_isolate(), buffer, static_cast<int>(allocated));
+  Assembler masm(AssemblerOptions{}, buffer, static_cast<int>(allocated));
 
   __ movq(rax, arg1);
   __ roll(rax, Immediate(1));
@@ -430,7 +430,7 @@ TEST(AssemblerX64RollOperations) {
   MakeAssemblerBufferExecutable(buffer, allocated);
   // Call the function from C++.
   uint64_t src = V8_2PART_UINT64_C(0x10000000, C0000000);
-  auto f = GeneratedCode<F5>::FromAddress(CcTest::i_isolate(), buffer);
+  auto f = GeneratedCode<F5>::FromBuffer(CcTest::i_isolate(), buffer);
   uint64_t result = f.Call(src);
   CHECK_EQ(V8_2PART_UINT64_C(0x00000000, 80000001), result);
 }
@@ -440,7 +440,7 @@ TEST(AssemblerX64SublOperations) {
   CcTest::InitializeVM();
   size_t allocated;
   byte* buffer = AllocateAssemblerBuffer(&allocated);
-  Assembler masm(CcTest::i_isolate(), buffer, static_cast<int>(allocated));
+  Assembler masm(AssemblerOptions{}, buffer, static_cast<int>(allocated));
 
   __ movq(rax, Operand(arg2, 0));
   __ subl(Operand(arg1, 0), rax);
@@ -452,7 +452,7 @@ TEST(AssemblerX64SublOperations) {
   // Call the function from C++.
   uint64_t left = V8_2PART_UINT64_C(0x10000000, 20000000);
   uint64_t right = V8_2PART_UINT64_C(0x30000000, 40000000);
-  auto f = GeneratedCode<F4>::FromAddress(CcTest::i_isolate(), buffer);
+  auto f = GeneratedCode<F4>::FromBuffer(CcTest::i_isolate(), buffer);
   uint64_t result = f.Call(&left, &right);
   CHECK_EQ(V8_2PART_UINT64_C(0x10000000, E0000000), left);
   USE(result);
@@ -463,7 +463,7 @@ TEST(AssemblerX64TestlOperations) {
   CcTest::InitializeVM();
   size_t allocated;
   byte* buffer = AllocateAssemblerBuffer(&allocated);
-  Assembler masm(CcTest::i_isolate(), buffer, static_cast<int>(allocated));
+  Assembler masm(AssemblerOptions{}, buffer, static_cast<int>(allocated));
 
   // Set rax with the ZF flag of the testl instruction.
   Label done;
@@ -481,7 +481,7 @@ TEST(AssemblerX64TestlOperations) {
   // Call the function from C++.
   uint64_t left = V8_2PART_UINT64_C(0x10000000, 20000000);
   uint64_t right = V8_2PART_UINT64_C(0x30000000, 00000000);
-  auto f = GeneratedCode<F4>::FromAddress(CcTest::i_isolate(), buffer);
+  auto f = GeneratedCode<F4>::FromBuffer(CcTest::i_isolate(), buffer);
   uint64_t result = f.Call(&left, &right);
   CHECK_EQ(1u, result);
 }
@@ -491,7 +491,7 @@ TEST(AssemblerX64TestwOperations) {
   CcTest::InitializeVM();
   size_t allocated;
   byte* buffer = AllocateAssemblerBuffer(&allocated);
-  Assembler masm(CcTest::i_isolate(), buffer, static_cast<int>(allocated));
+  Assembler masm(AssemblerOptions{}, buffer, static_cast<int>(allocated));
 
   // Set rax with the ZF flag of the testl instruction.
   Label done;
@@ -507,7 +507,7 @@ TEST(AssemblerX64TestwOperations) {
   MakeAssemblerBufferExecutable(buffer, allocated);
   // Call the function from C++.
   uint16_t operand = 0x8000;
-  auto f = GeneratedCode<F>::FromAddress(CcTest::i_isolate(), buffer);
+  auto f = GeneratedCode<F>::FromBuffer(CcTest::i_isolate(), buffer);
   uint16_t result = f.Call(&operand);
   CHECK_EQ(1u, result);
 }
@@ -516,7 +516,7 @@ TEST(AssemblerX64XorlOperations) {
   CcTest::InitializeVM();
   size_t allocated;
   byte* buffer = AllocateAssemblerBuffer(&allocated);
-  Assembler masm(CcTest::i_isolate(), buffer, static_cast<int>(allocated));
+  Assembler masm(AssemblerOptions{}, buffer, static_cast<int>(allocated));
 
   __ movq(rax, Operand(arg2, 0));
   __ xorl(Operand(arg1, 0), rax);
@@ -528,7 +528,7 @@ TEST(AssemblerX64XorlOperations) {
   // Call the function from C++.
   uint64_t left = V8_2PART_UINT64_C(0x10000000, 20000000);
   uint64_t right = V8_2PART_UINT64_C(0x30000000, 60000000);
-  auto f = GeneratedCode<F4>::FromAddress(CcTest::i_isolate(), buffer);
+  auto f = GeneratedCode<F4>::FromBuffer(CcTest::i_isolate(), buffer);
   uint64_t result = f.Call(&left, &right);
   CHECK_EQ(V8_2PART_UINT64_C(0x10000000, 40000000), left);
   USE(result);
@@ -539,7 +539,7 @@ TEST(AssemblerX64MemoryOperands) {
   CcTest::InitializeVM();
   size_t allocated;
   byte* buffer = AllocateAssemblerBuffer(&allocated);
-  Assembler masm(CcTest::i_isolate(), buffer, static_cast<int>(allocated));
+  Assembler masm(AssemblerOptions{}, buffer, static_cast<int>(allocated));
 
   // Assemble a simple function that copies argument 2 and returns it.
   __ pushq(rbp);
@@ -562,7 +562,7 @@ TEST(AssemblerX64MemoryOperands) {
   masm.GetCode(CcTest::i_isolate(), &desc);
   MakeAssemblerBufferExecutable(buffer, allocated);
   // Call the function from C++.
-  auto f = GeneratedCode<F2>::FromAddress(CcTest::i_isolate(), buffer);
+  auto f = GeneratedCode<F2>::FromBuffer(CcTest::i_isolate(), buffer);
   int result = f.Call(3, 2);
   CHECK_EQ(3, result);
 }
@@ -572,7 +572,7 @@ TEST(AssemblerX64ControlFlow) {
   CcTest::InitializeVM();
   size_t allocated;
   byte* buffer = AllocateAssemblerBuffer(&allocated);
-  Assembler masm(CcTest::i_isolate(), buffer, static_cast<int>(allocated));
+  Assembler masm(AssemblerOptions{}, buffer, static_cast<int>(allocated));
 
   // Assemble a simple function that copies argument 1 and returns it.
   __ pushq(rbp);
@@ -590,7 +590,7 @@ TEST(AssemblerX64ControlFlow) {
   masm.GetCode(CcTest::i_isolate(), &desc);
   MakeAssemblerBufferExecutable(buffer, allocated);
   // Call the function from C++.
-  auto f = GeneratedCode<F2>::FromAddress(CcTest::i_isolate(), buffer);
+  auto f = GeneratedCode<F2>::FromBuffer(CcTest::i_isolate(), buffer);
   int result = f.Call(3, 2);
   CHECK_EQ(3, result);
 }
@@ -600,7 +600,7 @@ TEST(AssemblerX64LoopImmediates) {
   CcTest::InitializeVM();
   size_t allocated;
   byte* buffer = AllocateAssemblerBuffer(&allocated);
-  Assembler masm(CcTest::i_isolate(), buffer, static_cast<int>(allocated));
+  Assembler masm(AssemblerOptions{}, buffer, static_cast<int>(allocated));
 
   // Assemble two loops using rax as counter, and verify the ending counts.
   Label Fail;
@@ -640,7 +640,7 @@ TEST(AssemblerX64LoopImmediates) {
   masm.GetCode(CcTest::i_isolate(), &desc);
   MakeAssemblerBufferExecutable(buffer, allocated);
   // Call the function from C++.
-  auto f = GeneratedCode<F0>::FromAddress(CcTest::i_isolate(), buffer);
+  auto f = GeneratedCode<F0>::FromBuffer(CcTest::i_isolate(), buffer);
   int result = f.Call();
   CHECK_EQ(1, result);
 }
@@ -693,7 +693,7 @@ TEST(AssemblerX64LabelChaining) {
   // Test chaining of label usages within instructions (issue 1644).
   CcTest::InitializeVM();
   v8::HandleScope scope(CcTest::isolate());
-  Assembler masm(CcTest::i_isolate(), nullptr, 0);
+  Assembler masm(AssemblerOptions{}, nullptr, 0);
 
   Label target;
   __ j(equal, &target);
@@ -708,7 +708,7 @@ TEST(AssemblerMultiByteNop) {
   v8::HandleScope scope(CcTest::isolate());
   byte buffer[1024];
   Isolate* isolate = CcTest::i_isolate();
-  Assembler masm(isolate, buffer, sizeof(buffer));
+  Assembler masm(AssemblerOptions{}, buffer, sizeof(buffer));
   __ pushq(rbx);
   __ pushq(rcx);
   __ pushq(rdx);
@@ -779,7 +779,7 @@ void DoSSE2(const v8::FunctionCallbackInfo<v8::Value>& args) {
   CHECK_EQ(ELEMENT_COUNT, vec->Length());
 
   Isolate* isolate = CcTest::i_isolate();
-  Assembler masm(isolate, buffer, sizeof(buffer));
+  Assembler masm(AssemblerOptions{}, buffer, sizeof(buffer));
 
   // Remove return address from the stack for fix stack frame alignment.
   __ popq(rcx);
@@ -868,7 +868,7 @@ TEST(AssemblerX64Extractps) {
   v8::HandleScope scope(CcTest::isolate());
   byte buffer[256];
   Isolate* isolate = CcTest::i_isolate();
-  Assembler masm(isolate, buffer, sizeof(buffer));
+  Assembler masm(AssemblerOptions{}, buffer, sizeof(buffer));
   {
     CpuFeatureScope fscope2(&masm, SSE4_1);
     __ extractps(rax, xmm0, 0x1);
@@ -880,8 +880,8 @@ TEST(AssemblerX64Extractps) {
   Handle<Code> code =
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef OBJECT_PRINT
-  OFStream os(stdout);
-  code->Print(os);
+  StdoutStream os;
+  code->Print(isolate, os);
 #endif
 
   auto f = GeneratedCode<F3>::FromCode(*code);
@@ -917,8 +917,8 @@ TEST(AssemblerX64SSE) {
   Handle<Code> code =
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef OBJECT_PRINT
-  OFStream os(stdout);
-  code->Print(os);
+  StdoutStream os;
+  code->Print(isolate, os);
 #endif
 
   auto f = GeneratedCode<F6>::FromCode(*code);
@@ -948,8 +948,8 @@ TEST(AssemblerX64SSE3) {
   Handle<Code> code =
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef OBJECT_PRINT
-  OFStream os(stdout);
-  code->Print(os);
+  StdoutStream os;
+  code->Print(isolate, os);
 #endif
 
   auto f = GeneratedCode<F6>::FromCode(*code);
@@ -1173,8 +1173,8 @@ TEST(AssemblerX64FMA_sd) {
   Handle<Code> code =
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef OBJECT_PRINT
-  OFStream os(stdout);
-  code->Print(os);
+  StdoutStream os;
+  code->Print(isolate, os);
 #endif
 
   auto f = GeneratedCode<F7>::FromCode(*code);
@@ -1399,8 +1399,8 @@ TEST(AssemblerX64FMA_ss) {
   Handle<Code> code =
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef OBJECT_PRINT
-  OFStream os(stdout);
-  code->Print(os);
+  StdoutStream os;
+  code->Print(isolate, os);
 #endif
 
   auto f = GeneratedCode<F8>::FromCode(*code);
@@ -1414,7 +1414,7 @@ TEST(AssemblerX64SSE_ss) {
   Isolate* isolate = reinterpret_cast<Isolate*>(CcTest::isolate());
   HandleScope scope(isolate);
   v8::internal::byte buffer[1024];
-  Assembler masm(isolate, buffer, sizeof(buffer));
+  Assembler masm(AssemblerOptions{}, buffer, sizeof(buffer));
   {
     Label exit;
     // arguments in xmm0, xmm1 and xmm2
@@ -1474,8 +1474,8 @@ TEST(AssemblerX64SSE_ss) {
   Handle<Code> code =
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef OBJECT_PRINT
-  OFStream os(stdout);
-  code->Print(os);
+  StdoutStream os;
+  code->Print(isolate, os);
 #endif
 
   auto f = GeneratedCode<F8>::FromCode(*code);
@@ -1492,7 +1492,7 @@ TEST(AssemblerX64AVX_ss) {
   Isolate* isolate = reinterpret_cast<Isolate*>(CcTest::isolate());
   HandleScope scope(isolate);
   v8::internal::byte buffer[1024];
-  Assembler masm(isolate, buffer, sizeof(buffer));
+  Assembler masm(AssemblerOptions{}, buffer, sizeof(buffer));
   {
     CpuFeatureScope avx_scope(&masm, AVX);
     Label exit;
@@ -1559,8 +1559,8 @@ TEST(AssemblerX64AVX_ss) {
   Handle<Code> code =
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef OBJECT_PRINT
-  OFStream os(stdout);
-  code->Print(os);
+  StdoutStream os;
+  code->Print(isolate, os);
 #endif
 
   auto f = GeneratedCode<F8>::FromCode(*code);
@@ -1577,7 +1577,7 @@ TEST(AssemblerX64AVX_sd) {
   Isolate* isolate = reinterpret_cast<Isolate*>(CcTest::isolate());
   HandleScope scope(isolate);
   v8::internal::byte buffer[1024];
-  Assembler masm(isolate, buffer, sizeof(buffer));
+  Assembler masm(AssemblerOptions{}, buffer, sizeof(buffer));
   {
     CpuFeatureScope avx_scope(&masm, AVX);
     Label exit;
@@ -1798,8 +1798,8 @@ TEST(AssemblerX64AVX_sd) {
   Handle<Code> code =
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef OBJECT_PRINT
-  OFStream os(stdout);
-  code->Print(os);
+  StdoutStream os;
+  code->Print(isolate, os);
 #endif
 
   auto f = GeneratedCode<F7>::FromCode(*code);
@@ -1990,8 +1990,8 @@ TEST(AssemblerX64BMI1) {
   Handle<Code> code =
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef OBJECT_PRINT
-  OFStream os(stdout);
-  code->Print(os);
+  StdoutStream os;
+  code->Print(isolate, os);
 #endif
 
   auto f = GeneratedCode<F0>::FromCode(*code);
@@ -2050,8 +2050,8 @@ TEST(AssemblerX64LZCNT) {
   Handle<Code> code =
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef OBJECT_PRINT
-  OFStream os(stdout);
-  code->Print(os);
+  StdoutStream os;
+  code->Print(isolate, os);
 #endif
 
   auto f = GeneratedCode<F0>::FromCode(*code);
@@ -2110,8 +2110,8 @@ TEST(AssemblerX64POPCNT) {
   Handle<Code> code =
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef OBJECT_PRINT
-  OFStream os(stdout);
-  code->Print(os);
+  StdoutStream os;
+  code->Print(isolate, os);
 #endif
 
   auto f = GeneratedCode<F0>::FromCode(*code);
@@ -2373,8 +2373,8 @@ TEST(AssemblerX64BMI2) {
   Handle<Code> code =
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef OBJECT_PRINT
-  OFStream os(stdout);
-  code->Print(os);
+  StdoutStream os;
+  code->Print(isolate, os);
 #endif
 
   auto f = GeneratedCode<F0>::FromCode(*code);
@@ -2418,7 +2418,7 @@ TEST(AssemblerX64JumpTables1) {
   Handle<Code> code =
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef OBJECT_PRINT
-  code->Print(std::cout);
+  code->Print(isolate, std::cout);
 #endif
 
   auto f = GeneratedCode<F1>::FromCode(*code);
@@ -2467,7 +2467,7 @@ TEST(AssemblerX64JumpTables2) {
   Handle<Code> code =
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef OBJECT_PRINT
-  code->Print(std::cout);
+  code->Print(isolate, std::cout);
 #endif
 
   auto f = GeneratedCode<F1>::FromCode(*code);
@@ -2482,7 +2482,7 @@ TEST(AssemblerX64PslldWithXmm15) {
   CcTest::InitializeVM();
   size_t allocated;
   byte* buffer = AllocateAssemblerBuffer(&allocated);
-  Assembler masm(CcTest::i_isolate(), buffer, static_cast<int>(allocated));
+  Assembler masm(AssemblerOptions{}, buffer, static_cast<int>(allocated));
 
   __ movq(xmm15, arg1);
   __ pslld(xmm15, 1);
@@ -2492,7 +2492,7 @@ TEST(AssemblerX64PslldWithXmm15) {
   CodeDesc desc;
   masm.GetCode(CcTest::i_isolate(), &desc);
   MakeAssemblerBufferExecutable(buffer, allocated);
-  auto f = GeneratedCode<F5>::FromAddress(CcTest::i_isolate(), buffer);
+  auto f = GeneratedCode<F5>::FromBuffer(CcTest::i_isolate(), buffer);
   uint64_t result = f.Call(uint64_t{0x1122334455667788});
   CHECK_EQ(uint64_t{0x22446688AACCEF10}, result);
 }
@@ -2525,8 +2525,8 @@ TEST(AssemblerX64vmovups) {
   Handle<Code> code =
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef OBJECT_PRINT
-  OFStream os(stdout);
-  code->Print(os);
+  StdoutStream os;
+  code->Print(isolate, os);
 #endif
 
   auto f = GeneratedCode<F9>::FromCode(*code);
diff --git a/deps/v8/test/cctest/test-code-layout.cc b/deps/v8/test/cctest/test-code-layout.cc
index 54c90f47af610a..1b7fc4f4810765 100644
--- a/deps/v8/test/cctest/test-code-layout.cc
+++ b/deps/v8/test/cctest/test-code-layout.cc
@@ -36,9 +36,10 @@ TEST(CodeLayoutWithoutUnwindingInfo) {
 
   CHECK(!code->has_unwinding_info());
   CHECK_EQ(code->raw_instruction_size(), buffer_size);
-  CHECK_EQ(0, memcmp(code->raw_instruction_start(), buffer, buffer_size));
-  CHECK_EQ(code->raw_instruction_end() - reinterpret_cast<byte*>(*code),
-           Code::kHeaderSize + buffer_size - kHeapObjectTag);
+  CHECK_EQ(0, memcmp(reinterpret_cast<void*>(code->raw_instruction_start()),
+                     buffer, buffer_size));
+  CHECK_EQ(code->raw_instruction_end() - code->address(),
+           Code::kHeaderSize + buffer_size);
 }
 
 TEST(CodeLayoutWithUnwindingInfo) {
@@ -73,17 +74,17 @@ TEST(CodeLayoutWithUnwindingInfo) {
 
   CHECK(code->has_unwinding_info());
   CHECK_EQ(code->raw_instruction_size(), buffer_size);
-  CHECK_EQ(0, memcmp(code->raw_instruction_start(), buffer, buffer_size));
+  CHECK_EQ(0, memcmp(reinterpret_cast<void*>(code->raw_instruction_start()),
+                     buffer, buffer_size));
   CHECK(IsAligned(code->GetUnwindingInfoSizeOffset(), 8));
   CHECK_EQ(code->unwinding_info_size(), unwinding_info_size);
-  CHECK(
-      IsAligned(reinterpret_cast<uintptr_t>(code->unwinding_info_start()), 8));
-  CHECK_EQ(
-      memcmp(code->unwinding_info_start(), unwinding_info, unwinding_info_size),
-      0);
-  CHECK_EQ(code->unwinding_info_end() - reinterpret_cast<byte*>(*code),
+  CHECK(IsAligned(code->unwinding_info_start(), 8));
+  CHECK_EQ(memcmp(reinterpret_cast<void*>(code->unwinding_info_start()),
+                  unwinding_info, unwinding_info_size),
+           0);
+  CHECK_EQ(code->unwinding_info_end() - code->address(),
            Code::kHeaderSize + RoundUp(buffer_size, kInt64Size) + kInt64Size +
-               unwinding_info_size - kHeapObjectTag);
+               unwinding_info_size);
 }
 
 }  // namespace internal
diff --git a/deps/v8/test/cctest/test-code-stub-assembler.cc b/deps/v8/test/cctest/test-code-stub-assembler.cc
index 12e9fe4bea114f..a89504c3bd9db7 100644
--- a/deps/v8/test/cctest/test-code-stub-assembler.cc
+++ b/deps/v8/test/cctest/test-code-stub-assembler.cc
@@ -15,6 +15,7 @@
 #include "src/debug/debug.h"
 #include "src/isolate.h"
 #include "src/objects-inl.h"
+#include "src/objects/hash-table-inl.h"
 #include "src/objects/promise-inl.h"
 #include "test/cctest/compiler/code-assembler-tester.h"
 #include "test/cctest/compiler/function-tester.h"
@@ -25,8 +26,10 @@ namespace compiler {
 
 namespace {
 
-typedef CodeAssemblerLabel Label;
-typedef CodeAssemblerVariable Variable;
+using Label = CodeAssemblerLabel;
+using Variable = CodeAssemblerVariable;
+template <class T>
+using TVariable = TypedCodeAssemblerVariable<T>;
 
 Handle<String> MakeString(const char* str) {
   Isolate* isolate = CcTest::i_isolate();
@@ -58,7 +61,7 @@ TEST(CallCFunction9) {
 
   {
     Node* const fun_constant = m.ExternalConstant(
-        ExternalReference(reinterpret_cast<Address>(sum9), isolate));
+        ExternalReference::Create(reinterpret_cast<Address>(sum9)));
 
     MachineType type_intptr = MachineType::IntPtr();
 
@@ -87,7 +90,7 @@ TEST(CallCFunction3WithCallerSavedRegisters) {
 
   {
     Node* const fun_constant = m.ExternalConstant(
-        ExternalReference(reinterpret_cast<Address>(sum3), isolate));
+        ExternalReference::Create(reinterpret_cast<Address>(sum3)));
 
     MachineType type_intptr = MachineType::IntPtr();
 
@@ -207,7 +210,7 @@ TEST(ToUint32) {
 }
 
 namespace {
-void IsValidPositiveSmiCase(Isolate* isolate, intptr_t value, bool expected) {
+void IsValidPositiveSmiCase(Isolate* isolate, intptr_t value) {
   const int kNumParams = 0;
   CodeAssemblerTester asm_tester(isolate, kNumParams);
 
@@ -218,6 +221,7 @@ void IsValidPositiveSmiCase(Isolate* isolate, intptr_t value, bool expected) {
   FunctionTester ft(asm_tester.GenerateCode(), kNumParams);
   MaybeHandle<Object> maybe_handle = ft.Call();
 
+  bool expected = i::PlatformSmiTagging::IsValidSmi(value) && (value >= 0);
   if (expected) {
     CHECK(maybe_handle.ToHandleChecked()->IsTrue(isolate));
   } else {
@@ -229,23 +233,23 @@ void IsValidPositiveSmiCase(Isolate* isolate, intptr_t value, bool expected) {
 TEST(IsValidPositiveSmi) {
   Isolate* isolate(CcTest::InitIsolateOnce());
 
-  IsValidPositiveSmiCase(isolate, -1, false);
-  IsValidPositiveSmiCase(isolate, 0, true);
-  IsValidPositiveSmiCase(isolate, 1, true);
+  IsValidPositiveSmiCase(isolate, -1);
+  IsValidPositiveSmiCase(isolate, 0);
+  IsValidPositiveSmiCase(isolate, 1);
+
+  IsValidPositiveSmiCase(isolate, 0x3FFFFFFFU);
+  IsValidPositiveSmiCase(isolate, 0xC0000000U);
+  IsValidPositiveSmiCase(isolate, 0x40000000U);
+  IsValidPositiveSmiCase(isolate, 0xBFFFFFFFU);
 
-#ifdef V8_TARGET_ARCH_32_BIT
-  IsValidPositiveSmiCase(isolate, 0x3FFFFFFFU, true);
-  IsValidPositiveSmiCase(isolate, 0xC0000000U, false);
-  IsValidPositiveSmiCase(isolate, 0x40000000U, false);
-  IsValidPositiveSmiCase(isolate, 0xBFFFFFFFU, false);
-#else
   typedef std::numeric_limits<int32_t> int32_limits;
-  IsValidPositiveSmiCase(isolate, int32_limits::max(), true);
-  IsValidPositiveSmiCase(isolate, int32_limits::min(), false);
+  IsValidPositiveSmiCase(isolate, int32_limits::max());
+  IsValidPositiveSmiCase(isolate, int32_limits::min());
+#ifdef V8_TARGET_ARCH_64_BIT
   IsValidPositiveSmiCase(isolate,
-                         static_cast<intptr_t>(int32_limits::max()) + 1, false);
+                         static_cast<intptr_t>(int32_limits::max()) + 1);
   IsValidPositiveSmiCase(isolate,
-                         static_cast<intptr_t>(int32_limits::min()) - 1, false);
+                         static_cast<intptr_t>(int32_limits::min()) - 1);
 #endif
 }
 
@@ -375,7 +379,7 @@ TEST(ToString) {
   test_cases->set(2, *string_test);
 
   Handle<FixedArray> oddball_test = isolate->factory()->NewFixedArray(2);
-  oddball_test->set(0, isolate->heap()->undefined_value());
+  oddball_test->set(0, ReadOnlyRoots(isolate).undefined_value());
   str = isolate->factory()->InternalizeUtf8String("undefined");
   oddball_test->set(1, *str);
   test_cases->set(3, *oddball_test);
@@ -392,12 +396,13 @@ TEST(ToString) {
   test_cases->set(4, *tostring_test);
 
   for (int i = 0; i < 5; ++i) {
-    Handle<FixedArray> test = handle(FixedArray::cast(test_cases->get(i)));
+    Handle<FixedArray> test =
+        handle(FixedArray::cast(test_cases->get(i)), isolate);
     Handle<Object> obj = handle(test->get(0), isolate);
-    Handle<String> expected = handle(String::cast(test->get(1)));
+    Handle<String> expected = handle(String::cast(test->get(1)), isolate);
     Handle<Object> result = ft.Call(obj).ToHandleChecked();
     CHECK(result->IsString());
-    CHECK(String::Equals(Handle<String>::cast(result), expected));
+    CHECK(String::Equals(isolate, Handle<String>::cast(result), expected));
   }
 }
 
@@ -588,8 +593,8 @@ void TestEntryToIndex() {
   CodeAssemblerTester asm_tester(isolate, kNumParams);
   CodeStubAssembler m(asm_tester.state());
   {
-    Node* entry = m.SmiUntag(m.Parameter(0));
-    Node* result = m.EntryToIndex<Dictionary>(entry);
+    TNode<IntPtrT> entry = m.SmiUntag(m.Parameter(0));
+    TNode<IntPtrT> result = m.EntryToIndex<Dictionary>(entry);
     m.Return(m.SmiTag(result));
   }
 
@@ -621,14 +626,14 @@ void TestNameDictionaryLookup() {
 
   enum Result { kFound, kNotFound };
   {
-    Node* dictionary = m.Parameter(0);
-    Node* unique_name = m.Parameter(1);
-    Node* expected_result = m.Parameter(2);
-    Node* expected_arg = m.Parameter(3);
+    TNode<Dictionary> dictionary = m.CAST(m.Parameter(0));
+    TNode<Name> unique_name = m.CAST(m.Parameter(1));
+    TNode<Smi> expected_result = m.CAST(m.Parameter(2));
+    TNode<Object> expected_arg = m.CAST(m.Parameter(3));
 
     Label passed(&m), failed(&m);
     Label if_found(&m), if_not_found(&m);
-    Variable var_name_index(&m, MachineType::PointerRepresentation());
+    TVariable<IntPtrT> var_name_index(&m);
 
     m.NameDictionaryLookup<Dictionary>(dictionary, unique_name, &if_found,
                                        &var_name_index, &if_not_found);
@@ -636,8 +641,9 @@ void TestNameDictionaryLookup() {
     m.GotoIfNot(
         m.WordEqual(expected_result, m.SmiConstant(Smi::FromInt(kFound))),
         &failed);
-    m.Branch(m.WordEqual(m.SmiUntag(expected_arg), var_name_index.value()),
-             &passed, &failed);
+    m.Branch(
+        m.WordEqual(m.SmiUntag(m.CAST(expected_arg)), var_name_index.value()),
+        &passed, &failed);
 
     m.BIND(&if_not_found);
     m.Branch(
@@ -722,14 +728,14 @@ TEST(NumberDictionaryLookup) {
 
   enum Result { kFound, kNotFound };
   {
-    Node* dictionary = m.Parameter(0);
-    Node* key = m.SmiUntag(m.Parameter(1));
-    Node* expected_result = m.Parameter(2);
-    Node* expected_arg = m.Parameter(3);
+    TNode<NumberDictionary> dictionary = m.CAST(m.Parameter(0));
+    TNode<IntPtrT> key = m.SmiUntag(m.Parameter(1));
+    TNode<Smi> expected_result = m.CAST(m.Parameter(2));
+    TNode<Object> expected_arg = m.CAST(m.Parameter(3));
 
     Label passed(&m), failed(&m);
     Label if_found(&m), if_not_found(&m);
-    Variable var_entry(&m, MachineType::PointerRepresentation());
+    TVariable<IntPtrT> var_entry(&m);
 
     m.NumberDictionaryLookup(dictionary, key, &if_found, &var_entry,
                              &if_not_found);
@@ -737,8 +743,8 @@ TEST(NumberDictionaryLookup) {
     m.GotoIfNot(
         m.WordEqual(expected_result, m.SmiConstant(Smi::FromInt(kFound))),
         &failed);
-    m.Branch(m.WordEqual(m.SmiUntag(expected_arg), var_entry.value()), &passed,
-             &failed);
+    m.Branch(m.WordEqual(m.SmiUntag(m.CAST(expected_arg)), var_entry.value()),
+             &passed, &failed);
 
     m.BIND(&if_not_found);
     m.Branch(
@@ -878,7 +884,8 @@ TEST(TransitionLookup) {
     // 1) there is a "base" attributes transition
     // 2) there are other non-base attributes transitions
     if ((i & 1) == 0) {
-      CHECK(!Map::CopyWithField(root_map, name, any, base_attributes, kMutable,
+      CHECK(!Map::CopyWithField(isolate, root_map, name, any, base_attributes,
+                                PropertyConstness::kMutable,
                                 Representation::Tagged(), INSERT_TRANSITION)
                  .is_null());
     }
@@ -889,7 +896,8 @@ TEST(TransitionLookup) {
         if (attributes == base_attributes) continue;
         // Don't add private symbols with enumerable attributes.
         if (is_private && ((attributes & DONT_ENUM) == 0)) continue;
-        CHECK(!Map::CopyWithField(root_map, name, any, attributes, kMutable,
+        CHECK(!Map::CopyWithField(isolate, root_map, name, any, attributes,
+                                  PropertyConstness::kMutable,
                                   Representation::Tagged(), INSERT_TRANSITION)
                    .is_null());
       }
@@ -898,12 +906,13 @@ TEST(TransitionLookup) {
 
   CHECK(root_map->raw_transitions()->ToStrongHeapObject()->IsTransitionArray());
   Handle<TransitionArray> transitions(
-      TransitionArray::cast(root_map->raw_transitions()->ToStrongHeapObject()));
-  DCHECK(transitions->IsSortedNoDuplicates());
+      TransitionArray::cast(root_map->raw_transitions()->ToStrongHeapObject()),
+      isolate);
+  DCHECK(transitions->IsSortedNoDuplicates(isolate));
 
   // Ensure we didn't overflow transition array and therefore all the
   // combinations of cases are covered.
-  CHECK(TransitionsAccessor(root_map).CanHaveMoreTransitions());
+  CHECK(TransitionsAccessor(isolate, root_map).CanHaveMoreTransitions());
 
   // Now try querying keys.
   bool positive_lookup_tested = false;
@@ -935,7 +944,7 @@ void AddProperties(Handle<JSObject> object, Handle<Name> names[],
   Isolate* isolate = object->GetIsolate();
   for (size_t i = 0; i < count; i++) {
     Handle<Object> value(Smi::FromInt(static_cast<int>(42 + i)), isolate);
-    JSObject::AddProperty(object, names[i], value, NONE);
+    JSObject::AddProperty(isolate, object, names[i], value, NONE);
   }
 }
 
@@ -964,7 +973,7 @@ void AddProperties(Handle<JSObject> object, Handle<Name> names[],
       Handle<Object> setter(pair->setter(), isolate);
       JSObject::DefineAccessor(object, names[i], getter, setter, NONE).Check();
     } else {
-      JSObject::AddProperty(object, names[i], value, NONE);
+      JSObject::AddProperty(isolate, object, names[i], value, NONE);
     }
   }
 }
@@ -1083,7 +1092,7 @@ TEST(TryHasOwnProperty) {
     AddProperties(object, names, arraysize(names));
     JSObject::NormalizeProperties(object, CLEAR_INOBJECT_PROPERTIES, 0, "test");
 
-    JSObject::AddProperty(object, deleted_property_name, object, NONE);
+    JSObject::AddProperty(isolate, object, deleted_property_name, object, NONE);
     CHECK(JSObject::DeleteProperty(object, deleted_property_name,
                                    LanguageMode::kSloppy)
               .FromJust());
@@ -1105,7 +1114,7 @@ TEST(TryHasOwnProperty) {
     Handle<JSObject> object = factory->NewJSGlobalObject(function);
     AddProperties(object, names, arraysize(names));
 
-    JSObject::AddProperty(object, deleted_property_name, object, NONE);
+    JSObject::AddProperty(isolate, object, deleted_property_name, object, NONE);
     CHECK(JSObject::DeleteProperty(object, deleted_property_name,
                                    LanguageMode::kSloppy)
               .FromJust());
@@ -1290,7 +1299,7 @@ TEST(TryGetOwnProperty) {
                   rand_gen.NextInt());
     JSObject::NormalizeProperties(object, CLEAR_INOBJECT_PROPERTIES, 0, "test");
 
-    JSObject::AddProperty(object, deleted_property_name, object, NONE);
+    JSObject::AddProperty(isolate, object, deleted_property_name, object, NONE);
     CHECK(JSObject::DeleteProperty(object, deleted_property_name,
                                    LanguageMode::kSloppy)
               .FromJust());
@@ -1306,7 +1315,7 @@ TEST(TryGetOwnProperty) {
     AddProperties(object, names, arraysize(names), values, arraysize(values),
                   rand_gen.NextInt());
 
-    JSObject::AddProperty(object, deleted_property_name, object, NONE);
+    JSObject::AddProperty(isolate, object, deleted_property_name, object, NONE);
     CHECK(JSObject::DeleteProperty(object, deleted_property_name,
                                    LanguageMode::kSloppy)
               .FromJust());
@@ -1323,7 +1332,7 @@ TEST(TryGetOwnProperty) {
       for (size_t name_index = 0; name_index < arraysize(names); name_index++) {
         Handle<Name> name = names[name_index];
         Handle<Object> expected_value =
-            JSReceiver::GetProperty(object, name).ToHandleChecked();
+            JSReceiver::GetProperty(isolate, object, name).ToHandleChecked();
         Handle<Object> value = ft.Call(object, name).ToHandleChecked();
         CHECK(expected_value->SameValue(*value));
       }
@@ -1345,7 +1354,7 @@ TEST(TryGetOwnProperty) {
            key_index++) {
         Handle<Name> name = non_existing_names[key_index];
         Handle<Object> expected_value =
-            JSReceiver::GetProperty(object, name).ToHandleChecked();
+            JSReceiver::GetProperty(isolate, object, name).ToHandleChecked();
         CHECK(expected_value->IsUndefined(isolate));
         Handle<Object> value = ft.Call(object, name).ToHandleChecked();
         CHECK_EQ(*not_found_symbol, *value);
@@ -1376,7 +1385,7 @@ namespace {
 
 void AddElement(Handle<JSObject> object, uint32_t index, Handle<Object> value,
                 PropertyAttributes attributes = NONE) {
-  JSObject::AddDataElement(object, index, value, attributes).ToHandleChecked();
+  JSObject::AddDataElement(object, index, value, attributes);
 }
 
 }  // namespace
@@ -1999,13 +2008,14 @@ TEST(ArgumentsForEach) {
 
   CodeStubArguments arguments(&m, m.IntPtrConstant(3));
 
-  Variable sum(&m, MachineRepresentation::kTagged);
+  TVariable<Smi> sum(&m);
   CodeAssemblerVariableList list({&sum}, m.zone());
 
-  sum.Bind(m.SmiConstant(0));
+  sum = m.SmiConstant(0);
 
-  arguments.ForEach(
-      list, [&m, &sum](Node* arg) { sum.Bind(m.SmiAdd(sum.value(), arg)); });
+  arguments.ForEach(list, [&m, &sum](Node* arg) {
+    sum = m.SmiAdd(sum.value(), m.CAST(arg));
+  });
 
   arguments.PopAndReturn(sum.value());
 
@@ -2037,7 +2047,7 @@ TEST(IsDebugActive) {
   CHECK(!isolate->debug()->is_active());
   Handle<Object> result =
       ft.Call(isolate->factory()->undefined_value()).ToHandleChecked();
-  CHECK_EQ(isolate->heap()->false_value(), *result);
+  CHECK_EQ(ReadOnlyRoots(isolate).false_value(), *result);
 
   bool* debug_is_active = reinterpret_cast<bool*>(
       ExternalReference::debug_is_active_address(isolate).address());
@@ -2046,7 +2056,7 @@ TEST(IsDebugActive) {
   *debug_is_active = true;
 
   result = ft.Call(isolate->factory()->undefined_value()).ToHandleChecked();
-  CHECK_EQ(isolate->heap()->true_value(), *result);
+  CHECK_EQ(ReadOnlyRoots(isolate).true_value(), *result);
 
   // Reset debug mode.
   *debug_is_active = false;
@@ -2093,13 +2103,14 @@ class AppendJSArrayCodeStubAssembler : public CodeStubAssembler {
     CHECK_EQ(result_size, Handle<Smi>::cast(result)->value());
     CHECK_EQ(result_size, Smi::ToInt(array->length()));
     Object* obj = *JSObject::GetElement(isolate, array, 2).ToHandleChecked();
-    CHECK_EQ(result_size < 3 ? isolate->heap()->undefined_value() : o1, obj);
+    HeapObject* undefined_value = ReadOnlyRoots(isolate).undefined_value();
+    CHECK_EQ(result_size < 3 ? undefined_value : o1, obj);
     obj = *JSObject::GetElement(isolate, array, 3).ToHandleChecked();
-    CHECK_EQ(result_size < 4 ? isolate->heap()->undefined_value() : o2, obj);
+    CHECK_EQ(result_size < 4 ? undefined_value : o2, obj);
     obj = *JSObject::GetElement(isolate, array, 4).ToHandleChecked();
-    CHECK_EQ(result_size < 5 ? isolate->heap()->undefined_value() : o3, obj);
+    CHECK_EQ(result_size < 5 ? undefined_value : o3, obj);
     obj = *JSObject::GetElement(isolate, array, 5).ToHandleChecked();
-    CHECK_EQ(result_size < 6 ? isolate->heap()->undefined_value() : o4, obj);
+    CHECK_EQ(result_size < 6 ? undefined_value : o4, obj);
   }
 
   static void TestAppendJSArray(Isolate* isolate, ElementsKind kind, Object* o1,
@@ -2148,14 +2159,14 @@ TEST(BuildAppendJSArrayFastSmiElementObject) {
   Isolate* isolate(CcTest::InitIsolateOnce());
   AppendJSArrayCodeStubAssembler::TestAppendJSArray(
       isolate, PACKED_SMI_ELEMENTS, Smi::FromInt(3), Smi::FromInt(4),
-      isolate->heap()->undefined_value(), Smi::FromInt(6), 6, 4);
+      ReadOnlyRoots(isolate).undefined_value(), Smi::FromInt(6), 6, 4);
 }
 
 TEST(BuildAppendJSArrayFastSmiElementObjectGrow) {
   Isolate* isolate(CcTest::InitIsolateOnce());
   AppendJSArrayCodeStubAssembler::TestAppendJSArray(
       isolate, PACKED_SMI_ELEMENTS, Smi::FromInt(3), Smi::FromInt(4),
-      isolate->heap()->undefined_value(), Smi::FromInt(6), 2, 4);
+      ReadOnlyRoots(isolate).undefined_value(), Smi::FromInt(6), 2, 4);
 }
 
 TEST(BuildAppendJSArrayFastDoubleElements) {
@@ -2176,7 +2187,7 @@ TEST(BuildAppendJSArrayFastDoubleElementsObject) {
   Isolate* isolate(CcTest::InitIsolateOnce());
   AppendJSArrayCodeStubAssembler::TestAppendJSArray(
       isolate, PACKED_DOUBLE_ELEMENTS, Smi::FromInt(3), Smi::FromInt(4),
-      isolate->heap()->undefined_value(), Smi::FromInt(6), 6, 4);
+      ReadOnlyRoots(isolate).undefined_value(), Smi::FromInt(6), 6, 4);
 }
 
 namespace {
@@ -2200,20 +2211,21 @@ TEST(IsPromiseHookEnabled) {
   CodeAssemblerTester asm_tester(isolate, kNumParams);
   CodeStubAssembler m(asm_tester.state());
 
-  m.Return(m.SelectBooleanConstant(m.IsPromiseHookEnabledOrDebugIsActive()));
+  m.Return(
+      m.SelectBooleanConstant(m.IsPromiseHookEnabledOrHasAsyncEventDelegate()));
 
   FunctionTester ft(asm_tester.GenerateCode(), kNumParams);
   Handle<Object> result =
       ft.Call(isolate->factory()->undefined_value()).ToHandleChecked();
-  CHECK_EQ(isolate->heap()->false_value(), *result);
+  CHECK_EQ(ReadOnlyRoots(isolate).false_value(), *result);
 
   isolate->SetPromiseHook(CustomPromiseHook);
   result = ft.Call(isolate->factory()->undefined_value()).ToHandleChecked();
-  CHECK_EQ(isolate->heap()->true_value(), *result);
+  CHECK_EQ(ReadOnlyRoots(isolate).true_value(), *result);
 
   isolate->SetPromiseHook(nullptr);
   result = ft.Call(isolate->factory()->undefined_value()).ToHandleChecked();
-  CHECK_EQ(isolate->heap()->false_value(), *result);
+  CHECK_EQ(ReadOnlyRoots(isolate).false_value(), *result);
 }
 
 TEST(AllocateAndInitJSPromise) {
@@ -2268,10 +2280,10 @@ TEST(IsSymbol) {
   FunctionTester ft(asm_tester.GenerateCode(), kNumParams);
   Handle<Object> result =
       ft.Call(isolate->factory()->NewSymbol()).ToHandleChecked();
-  CHECK_EQ(isolate->heap()->true_value(), *result);
+  CHECK_EQ(ReadOnlyRoots(isolate).true_value(), *result);
 
   result = ft.Call(isolate->factory()->empty_string()).ToHandleChecked();
-  CHECK_EQ(isolate->heap()->false_value(), *result);
+  CHECK_EQ(ReadOnlyRoots(isolate).false_value(), *result);
 }
 
 TEST(IsPrivateSymbol) {
@@ -2287,13 +2299,13 @@ TEST(IsPrivateSymbol) {
   FunctionTester ft(asm_tester.GenerateCode(), kNumParams);
   Handle<Object> result =
       ft.Call(isolate->factory()->NewSymbol()).ToHandleChecked();
-  CHECK_EQ(isolate->heap()->false_value(), *result);
+  CHECK_EQ(ReadOnlyRoots(isolate).false_value(), *result);
 
   result = ft.Call(isolate->factory()->empty_string()).ToHandleChecked();
-  CHECK_EQ(isolate->heap()->false_value(), *result);
+  CHECK_EQ(ReadOnlyRoots(isolate).false_value(), *result);
 
   result = ft.Call(isolate->factory()->NewPrivateSymbol()).ToHandleChecked();
-  CHECK_EQ(isolate->heap()->true_value(), *result);
+  CHECK_EQ(ReadOnlyRoots(isolate).true_value(), *result);
 }
 
 TEST(PromiseHasHandler) {
@@ -2311,7 +2323,7 @@ TEST(PromiseHasHandler) {
   FunctionTester ft(asm_tester.GenerateCode(), kNumParams);
   Handle<Object> result =
       ft.Call(isolate->factory()->undefined_value()).ToHandleChecked();
-  CHECK_EQ(isolate->heap()->false_value(), *result);
+  CHECK_EQ(ReadOnlyRoots(isolate).false_value(), *result);
 }
 
 TEST(CreatePromiseResolvingFunctionsContext) {
@@ -2334,11 +2346,11 @@ TEST(CreatePromiseResolvingFunctionsContext) {
       ft.Call(isolate->factory()->undefined_value()).ToHandleChecked();
   CHECK(result->IsContext());
   Handle<Context> context_js = Handle<Context>::cast(result);
-  CHECK_EQ(isolate->native_context()->closure(), context_js->closure());
-  CHECK_EQ(isolate->heap()->the_hole_value(), context_js->extension());
+  CHECK_EQ(isolate->native_context()->scope_info(), context_js->scope_info());
+  CHECK_EQ(ReadOnlyRoots(isolate).the_hole_value(), context_js->extension());
   CHECK_EQ(*isolate->native_context(), context_js->native_context());
   CHECK(context_js->get(PromiseBuiltinsAssembler::kPromiseSlot)->IsJSPromise());
-  CHECK_EQ(isolate->heap()->false_value(),
+  CHECK_EQ(ReadOnlyRoots(isolate).false_value(),
            context_js->get(PromiseBuiltinsAssembler::kDebugEventSlot));
 }
 
@@ -2458,8 +2470,9 @@ TEST(AllocateFunctionWithMapAndContext) {
       ft.Call(isolate->factory()->undefined_value()).ToHandleChecked();
   CHECK(result_obj->IsJSFunction());
   Handle<JSFunction> fun = Handle<JSFunction>::cast(result_obj);
-  CHECK_EQ(isolate->heap()->empty_property_array(), fun->property_array());
-  CHECK_EQ(isolate->heap()->empty_fixed_array(), fun->elements());
+  CHECK_EQ(ReadOnlyRoots(isolate).empty_property_array(),
+           fun->property_array());
+  CHECK_EQ(ReadOnlyRoots(isolate).empty_fixed_array(), fun->elements());
   CHECK_EQ(isolate->heap()->many_closures_cell(), fun->feedback_cell());
   CHECK(!fun->has_prototype_slot());
   CHECK_EQ(*isolate->promise_capability_default_resolve_shared_fun(),
@@ -2497,8 +2510,8 @@ TEST(CreatePromiseGetCapabilitiesExecutorContext) {
   Handle<Context> context_js = Handle<Context>::cast(result_obj);
   CHECK_EQ(PromiseBuiltinsAssembler::kCapabilitiesContextLength,
            context_js->length());
-  CHECK_EQ(isolate->native_context()->closure(), context_js->closure());
-  CHECK_EQ(isolate->heap()->the_hole_value(), context_js->extension());
+  CHECK_EQ(isolate->native_context()->scope_info(), context_js->scope_info());
+  CHECK_EQ(ReadOnlyRoots(isolate).the_hole_value(), context_js->extension());
   CHECK_EQ(*isolate->native_context(), context_js->native_context());
   CHECK(context_js->get(PromiseBuiltinsAssembler::kCapabilitySlot)
             ->IsPromiseCapability());
@@ -2540,13 +2553,13 @@ TEST(NewPromiseCapability) {
              JSFunction::cast(result->resolve())->shared());
 
     Handle<JSFunction> callbacks[] = {
-        handle(JSFunction::cast(result->resolve())),
-        handle(JSFunction::cast(result->reject()))};
+        handle(JSFunction::cast(result->resolve()), isolate),
+        handle(JSFunction::cast(result->reject()), isolate)};
 
     for (auto&& callback : callbacks) {
-      Handle<Context> context(Context::cast(callback->context()));
-      CHECK_EQ(isolate->native_context()->closure(), context->closure());
-      CHECK_EQ(isolate->heap()->the_hole_value(), context->extension());
+      Handle<Context> context(Context::cast(callback->context()), isolate);
+      CHECK_EQ(isolate->native_context()->scope_info(), context->scope_info());
+      CHECK_EQ(ReadOnlyRoots(isolate).the_hole_value(), context->extension());
       CHECK_EQ(*isolate->native_context(), context->native_context());
       CHECK_EQ(PromiseBuiltinsAssembler::kPromiseContextLength,
                context->length());
@@ -2587,7 +2600,7 @@ TEST(NewPromiseCapability) {
         Handle<PromiseCapability>::cast(result_obj);
 
     CHECK(result->promise()->IsJSObject());
-    Handle<JSObject> promise(JSObject::cast(result->promise()));
+    Handle<JSObject> promise(JSObject::cast(result->promise()), isolate);
     CHECK_EQ(constructor_fn->prototype_or_initial_map(), promise->map());
     CHECK(result->resolve()->IsJSFunction());
     CHECK(result->reject()->IsJSFunction());
@@ -2807,7 +2820,8 @@ TEST(LoadJSArrayElementsMap) {
         ft.CallChecked<Map>(handle(Smi::FromInt(kind), isolate));
     ElementsKind elements_kind = static_cast<ElementsKind>(kind);
     Handle<Map> result(
-        isolate->native_context()->GetInitialJSArrayMap(elements_kind));
+        isolate->native_context()->GetInitialJSArrayMap(elements_kind),
+        isolate);
     CHECK_EQ(*csa_result, *result);
   }
 }
@@ -2829,8 +2843,8 @@ TEST(AllocateStruct) {
   FunctionTester ft(asm_tester.GenerateCode(), kNumParams);
 
   Handle<Map> maps[] = {
-      handle(isolate->heap()->tuple3_map(), isolate),
-      handle(isolate->heap()->tuple2_map(), isolate),
+      handle(ReadOnlyRoots(isolate).tuple3_map(), isolate),
+      handle(ReadOnlyRoots(isolate).tuple2_map(), isolate),
   };
 
   {
@@ -2912,8 +2926,9 @@ TEST(IsNumberArrayIndex) {
   CodeAssemblerTester asm_tester(isolate, kNumParams);
   {
     CodeStubAssembler m(asm_tester.state());
-    m.Return(m.SmiFromInt32(
-        m.UncheckedCast<Int32T>(m.IsNumberArrayIndex(m.Parameter(0)))));
+    TNode<Number> number = m.CAST(m.Parameter(0));
+    m.Return(
+        m.SmiFromInt32(m.UncheckedCast<Int32T>(m.IsNumberArrayIndex(number))));
   }
 
   FunctionTester ft(asm_tester.GenerateCode(), kNumParams);
@@ -3104,7 +3119,7 @@ TEST(CloneFixedArrayCOW) {
 
   Handle<FixedArray> source(isolate->factory()->NewFixedArrayWithHoles(5));
   source->set(1, Smi::FromInt(1234));
-  source->set_map(isolate->heap()->fixed_cow_array_map());
+  source->set_map(ReadOnlyRoots(isolate).fixed_cow_array_map());
   Handle<Object> result_raw = ft.Call(source).ToHandleChecked();
   FixedArray* result(FixedArray::cast(*result_raw));
   CHECK_EQ(*source, result);
@@ -3126,7 +3141,7 @@ TEST(ExtractFixedArrayCOWForceCopy) {
 
   Handle<FixedArray> source(isolate->factory()->NewFixedArrayWithHoles(5));
   source->set(1, Smi::FromInt(1234));
-  source->set_map(isolate->heap()->fixed_cow_array_map());
+  source->set_map(ReadOnlyRoots(isolate).fixed_cow_array_map());
   Handle<Object> result_raw = ft.Call(source).ToHandleChecked();
   FixedArray* result(FixedArray::cast(*result_raw));
   CHECK_NE(*source, result);
@@ -3301,6 +3316,129 @@ TEST(SingleInputPhiElimination) {
   // single-input phi is properly eliminated.
 }
 
+TEST(SmallOrderedHashMapAllocate) {
+  Isolate* isolate(CcTest::InitIsolateOnce());
+  const int kNumParams = 1;
+  CodeAssemblerTester asm_tester(isolate, kNumParams);
+  {
+    CodeStubAssembler m(asm_tester.state());
+    TNode<Smi> capacity = m.CAST(m.Parameter(0));
+    m.Return(m.AllocateSmallOrderedHashTable<SmallOrderedHashMap>(
+        m.SmiToIntPtr(capacity)));
+  }
+  FunctionTester ft(asm_tester.GenerateCode(), kNumParams);
+
+  Factory* factory = isolate->factory();
+  int capacity = SmallOrderedHashMap::kMinCapacity;
+  while (capacity <= SmallOrderedHashMap::kMaxCapacity) {
+    Handle<SmallOrderedHashMap> expected =
+        factory->NewSmallOrderedHashMap(capacity);
+    Handle<Object> result_raw =
+        ft.Call(Handle<Smi>(Smi::FromInt(capacity), isolate)).ToHandleChecked();
+    Handle<SmallOrderedHashMap> actual = Handle<SmallOrderedHashMap>(
+        SmallOrderedHashMap::cast(*result_raw), isolate);
+    CHECK_EQ(capacity, actual->Capacity());
+    CHECK_EQ(0, actual->NumberOfElements());
+    CHECK_EQ(0, actual->NumberOfDeletedElements());
+    CHECK_EQ(capacity / SmallOrderedHashMap::kLoadFactor,
+             actual->NumberOfBuckets());
+    CHECK(memcmp(*expected, *actual, SmallOrderedHashMap::SizeFor(capacity)));
+#ifdef VERIFY_HEAP
+    actual->SmallOrderedHashTableVerify(isolate);
+#endif
+    capacity = capacity << 1;
+  }
+#ifdef VERIFY_HEAP
+  isolate->heap()->Verify();
+#endif
+}
+
+TEST(SmallOrderedHashSetAllocate) {
+  Isolate* isolate(CcTest::InitIsolateOnce());
+  const int kNumParams = 1;
+  CodeAssemblerTester asm_tester(isolate, kNumParams);
+  {
+    CodeStubAssembler m(asm_tester.state());
+    TNode<Smi> capacity = m.CAST(m.Parameter(0));
+    m.Return(m.AllocateSmallOrderedHashTable<SmallOrderedHashSet>(
+        m.SmiToIntPtr(capacity)));
+  }
+  FunctionTester ft(asm_tester.GenerateCode(), kNumParams);
+
+  int capacity = SmallOrderedHashSet::kMinCapacity;
+  Factory* factory = isolate->factory();
+  while (capacity <= SmallOrderedHashSet::kMaxCapacity) {
+    Handle<SmallOrderedHashSet> expected =
+        factory->NewSmallOrderedHashSet(capacity);
+    Handle<Object> result_raw =
+        ft.Call(Handle<Smi>(Smi::FromInt(capacity), isolate)).ToHandleChecked();
+    Handle<SmallOrderedHashSet> actual = Handle<SmallOrderedHashSet>(
+        SmallOrderedHashSet::cast(*result_raw), isolate);
+    CHECK_EQ(capacity, actual->Capacity());
+    CHECK_EQ(0, actual->NumberOfElements());
+    CHECK_EQ(0, actual->NumberOfDeletedElements());
+    CHECK_EQ(capacity / SmallOrderedHashSet::kLoadFactor,
+             actual->NumberOfBuckets());
+    CHECK(memcmp(*expected, *actual, SmallOrderedHashSet::SizeFor(capacity)));
+#ifdef VERIFY_HEAP
+    actual->SmallOrderedHashTableVerify(isolate);
+#endif
+    capacity = capacity << 1;
+  }
+#ifdef VERIFY_HEAP
+  isolate->heap()->Verify();
+#endif
+}
+
+TEST(IsDoubleElementsKind) {
+  Isolate* isolate(CcTest::InitIsolateOnce());
+  const int kNumParams = 2;
+  CodeAssemblerTester ft_tester(isolate, kNumParams);
+  {
+    CodeStubAssembler m(ft_tester.state());
+    m.Return(m.SmiFromInt32(m.UncheckedCast<Int32T>(
+        m.IsDoubleElementsKind(m.SmiToInt32(m.Parameter(0))))));
+  }
+  FunctionTester ft(ft_tester.GenerateCode(), kNumParams);
+  CHECK_EQ(
+      (*Handle<Smi>::cast(
+           ft.Call(Handle<Smi>(Smi::FromInt(PACKED_DOUBLE_ELEMENTS), isolate))
+               .ToHandleChecked()))
+          ->value(),
+      1);
+  CHECK_EQ(
+      (*Handle<Smi>::cast(
+           ft.Call(Handle<Smi>(Smi::FromInt(HOLEY_DOUBLE_ELEMENTS), isolate))
+               .ToHandleChecked()))
+          ->value(),
+      1);
+  CHECK_EQ((*Handle<Smi>::cast(
+                ft.Call(Handle<Smi>(Smi::FromInt(HOLEY_ELEMENTS), isolate))
+                    .ToHandleChecked()))
+               ->value(),
+           0);
+  CHECK_EQ((*Handle<Smi>::cast(
+                ft.Call(Handle<Smi>(Smi::FromInt(PACKED_ELEMENTS), isolate))
+                    .ToHandleChecked()))
+               ->value(),
+           0);
+  CHECK_EQ((*Handle<Smi>::cast(
+                ft.Call(Handle<Smi>(Smi::FromInt(PACKED_SMI_ELEMENTS), isolate))
+                    .ToHandleChecked()))
+               ->value(),
+           0);
+  CHECK_EQ((*Handle<Smi>::cast(
+                ft.Call(Handle<Smi>(Smi::FromInt(HOLEY_SMI_ELEMENTS), isolate))
+                    .ToHandleChecked()))
+               ->value(),
+           0);
+  CHECK_EQ((*Handle<Smi>::cast(
+                ft.Call(Handle<Smi>(Smi::FromInt(DICTIONARY_ELEMENTS), isolate))
+                    .ToHandleChecked()))
+               ->value(),
+           0);
+}
+
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/test/cctest/test-code-stubs-arm.cc b/deps/v8/test/cctest/test-code-stubs-arm.cc
index ee309f13af89b1..8247afeb49e407 100644
--- a/deps/v8/test/cctest/test-code-stubs-arm.cc
+++ b/deps/v8/test/cctest/test-code-stubs-arm.cc
@@ -52,9 +52,8 @@ ConvertDToIFunc MakeConvertDToIFuncTrampoline(Isolate* isolate,
   MacroAssembler masm(isolate, buffer, static_cast<int>(allocated),
                       v8::internal::CodeObjectRequired::kYes);
 
-  DoubleToIStub stub(isolate, destination_reg);
-
-  byte* start = stub.GetCode()->raw_instruction_start();
+  Handle<Code> code = BUILTIN_CODE(isolate, DoubleToI);
+  Address start = code->InstructionStart();
 
   // Save callee save registers.
   __ Push(r7, r6, r5, r4);
@@ -88,6 +87,7 @@ ConvertDToIFunc MakeConvertDToIFuncTrampoline(Isolate* isolate,
   // Call through to the actual stub
   __ Call(start, RelocInfo::EXTERNAL_REFERENCE);
 
+  __ ldr(destination_reg, MemOperand(sp, 0));
   __ add(sp, sp, Operand(kDoubleSize));
 
   // Make sure no registers have been unexpectedly clobbered
diff --git a/deps/v8/test/cctest/test-code-stubs-arm64.cc b/deps/v8/test/cctest/test-code-stubs-arm64.cc
index d23c914ddd3ec9..43bea1d910883c 100644
--- a/deps/v8/test/cctest/test-code-stubs-arm64.cc
+++ b/deps/v8/test/cctest/test-code-stubs-arm64.cc
@@ -53,9 +53,8 @@ ConvertDToIFunc MakeConvertDToIFuncTrampoline(Isolate* isolate,
   MacroAssembler masm(isolate, buffer, static_cast<int>(allocated),
                       v8::internal::CodeObjectRequired::kYes);
 
-  DoubleToIStub stub(isolate, destination_reg);
-
-  byte* start = stub.GetCode()->raw_instruction_start();
+  Handle<Code> code = BUILTIN_CODE(isolate, DoubleToI);
+  Address start = code->InstructionStart();
 
   __ PushCalleeSavedRegisters();
 
@@ -78,7 +77,8 @@ ConvertDToIFunc MakeConvertDToIFuncTrampoline(Isolate* isolate,
   queue.PushQueued();
 
   // Call through to the actual stub.
-  __ Call(start, RelocInfo::EXTERNAL_REFERENCE);
+  __ IndirectCall(start, RelocInfo::CODE_TARGET);
+  __ Peek(destination_reg, 0);
 
   __ Drop(2, kDoubleSize);
 
diff --git a/deps/v8/test/cctest/test-code-stubs-ia32.cc b/deps/v8/test/cctest/test-code-stubs-ia32.cc
index 11506b589fce25..77a22542453657 100644
--- a/deps/v8/test/cctest/test-code-stubs-ia32.cc
+++ b/deps/v8/test/cctest/test-code-stubs-ia32.cc
@@ -53,8 +53,8 @@ ConvertDToIFunc MakeConvertDToIFuncTrampoline(Isolate* isolate,
   MacroAssembler masm(isolate, buffer, static_cast<int>(allocated),
                       v8::internal::CodeObjectRequired::kYes);
 
-  DoubleToIStub stub(isolate, destination_reg);
-  byte* start = stub.GetCode()->raw_instruction_start();
+  Handle<Code> code = BUILTIN_CODE(isolate, DoubleToI);
+  Address start = code->InstructionStart();
 
   __ push(ebx);
   __ push(ecx);
@@ -81,6 +81,7 @@ ConvertDToIFunc MakeConvertDToIFuncTrampoline(Isolate* isolate,
 
   // Call through to the actual stub
   __ call(start, RelocInfo::EXTERNAL_REFERENCE);
+  __ mov(destination_reg, MemOperand(esp, 0));
 
   __ add(esp, Immediate(kDoubleSize));
 
diff --git a/deps/v8/test/cctest/test-code-stubs-mips.cc b/deps/v8/test/cctest/test-code-stubs-mips.cc
index 5b4fe37bdff49e..f57459ead0053a 100644
--- a/deps/v8/test/cctest/test-code-stubs-mips.cc
+++ b/deps/v8/test/cctest/test-code-stubs-mips.cc
@@ -54,9 +54,8 @@ ConvertDToIFunc MakeConvertDToIFuncTrampoline(Isolate* isolate,
   MacroAssembler masm(isolate, buffer, static_cast<int>(allocated),
                       v8::internal::CodeObjectRequired::kYes);
 
-  DoubleToIStub stub(isolate, destination_reg);
-
-  byte* start = stub.GetCode()->raw_instruction_start();
+  Handle<Code> code = BUILTIN_CODE(isolate, DoubleToI);
+  Address start = code->InstructionStart();
 
   // Save callee save registers.
   __ MultiPush(kCalleeSaved | ra.bit());
@@ -93,6 +92,7 @@ ConvertDToIFunc MakeConvertDToIFuncTrampoline(Isolate* isolate,
 
   // Call through to the actual stub
   __ Call(start, RelocInfo::EXTERNAL_REFERENCE);
+  __ lw(destination_reg, MemOperand(sp, 0));
 
   __ Addu(sp, sp, Operand(kDoubleSize));
 
diff --git a/deps/v8/test/cctest/test-code-stubs-mips64.cc b/deps/v8/test/cctest/test-code-stubs-mips64.cc
index dc72aaba198e0c..6605f8242270bc 100644
--- a/deps/v8/test/cctest/test-code-stubs-mips64.cc
+++ b/deps/v8/test/cctest/test-code-stubs-mips64.cc
@@ -54,9 +54,8 @@ ConvertDToIFunc MakeConvertDToIFuncTrampoline(Isolate* isolate,
   MacroAssembler masm(isolate, buffer, static_cast<int>(allocated),
                       v8::internal::CodeObjectRequired::kYes);
 
-  DoubleToIStub stub(isolate, destination_reg);
-
-  byte* start = stub.GetCode()->raw_instruction_start();
+  Handle<Code> code = BUILTIN_CODE(isolate, DoubleToI);
+  Address start = code->InstructionStart();
 
   // Save callee save registers.
   __ MultiPush(kCalleeSaved | ra.bit());
@@ -92,6 +91,7 @@ ConvertDToIFunc MakeConvertDToIFuncTrampoline(Isolate* isolate,
 
   // Call through to the actual stub
   __ Call(start, RelocInfo::EXTERNAL_REFERENCE);
+  __ Ld(destination_reg, MemOperand(sp, 0));
 
   __ Daddu(sp, sp, Operand(kDoubleSize));
 
diff --git a/deps/v8/test/cctest/test-code-stubs-x64.cc b/deps/v8/test/cctest/test-code-stubs-x64.cc
index 51c04c79e49222..327d45d16c2b4d 100644
--- a/deps/v8/test/cctest/test-code-stubs-x64.cc
+++ b/deps/v8/test/cctest/test-code-stubs-x64.cc
@@ -53,8 +53,8 @@ ConvertDToIFunc MakeConvertDToIFuncTrampoline(Isolate* isolate,
   MacroAssembler masm(isolate, buffer, static_cast<int>(allocated),
                       v8::internal::CodeObjectRequired::kYes);
 
-  DoubleToIStub stub(isolate, destination_reg);
-  byte* start = stub.GetCode()->raw_instruction_start();
+  Handle<Code> code = BUILTIN_CODE(isolate, DoubleToI);
+  Address start = code->InstructionStart();
 
   __ pushq(rbx);
   __ pushq(rcx);
@@ -80,6 +80,7 @@ ConvertDToIFunc MakeConvertDToIFuncTrampoline(Isolate* isolate,
 
   // Call through to the actual stub
   __ Call(start, RelocInfo::EXTERNAL_REFERENCE);
+  __ movl(destination_reg, MemOperand(rsp, 0));
 
   __ addq(rsp, Immediate(kDoubleSize));
 
diff --git a/deps/v8/test/cctest/test-code-stubs.cc b/deps/v8/test/cctest/test-code-stubs.cc
index 6cfccd2a1f1a98..73489a1bd6053f 100644
--- a/deps/v8/test/cctest/test-code-stubs.cc
+++ b/deps/v8/test/cctest/test-code-stubs.cc
@@ -53,9 +53,9 @@ int STDCALL ConvertDToICVersion(double d) {
 #else
 #error Unsupported endianness
 #endif
-  union { double d; uint32_t u[2]; } dbl;
-  dbl.d = d;
-  uint32_t exponent_bits = dbl.u[kExponentIndex];
+  uint32_t u[2];
+  memcpy(u, &d, sizeof(d));
+  uint32_t exponent_bits = u[kExponentIndex];
   int32_t shifted_mask = static_cast<int32_t>(Double::kExponentMask >> 32);
   int32_t exponent = (((exponent_bits & shifted_mask) >>
                        (Double::kPhysicalSignificandSize - 32)) -
@@ -69,7 +69,7 @@ int STDCALL ConvertDToICVersion(double d) {
     static_cast<uint32_t>(Double::kPhysicalSignificandSize);
   if (unsigned_exponent >= max_exponent) {
     if ((exponent - Double::kPhysicalSignificandSize) < 32) {
-      result = dbl.u[kMantissaIndex]
+      result = u[kMantissaIndex]
                << (exponent - Double::kPhysicalSignificandSize);
     }
   } else {
@@ -94,7 +94,7 @@ void RunOneTruncationTestWithTest(ConvertDToICallWrapper callWrapper,
   CHECK_EQ(to, result);
 }
 
-
+DISABLE_CFI_ICALL
 int32_t DefaultCallWrapper(ConvertDToIFunc func,
                            double from) {
   return (*func)(from);
diff --git a/deps/v8/test/cctest/test-compiler.cc b/deps/v8/test/cctest/test-compiler.cc
index 92ee4fa0e482bd..34868cd4c4c6f7 100644
--- a/deps/v8/test/cctest/test-compiler.cc
+++ b/deps/v8/test/cctest/test-compiler.cc
@@ -53,7 +53,7 @@ static void SetGlobalProperty(const char* name, Object* value) {
   Handle<Object> object(value, isolate);
   Handle<String> internalized_name =
       isolate->factory()->InternalizeUtf8String(name);
-  Handle<JSObject> global(isolate->context()->global_object());
+  Handle<JSObject> global(isolate->context()->global_object(), isolate);
   Runtime::SetObjectProperty(isolate, global, internalized_name, object,
                              LanguageMode::kSloppy)
       .Check();
@@ -83,7 +83,7 @@ static double Inc(Isolate* isolate, int x) {
   Handle<JSFunction> fun = Compile(buffer.start());
   if (fun.is_null()) return -1;
 
-  Handle<JSObject> global(isolate->context()->global_object());
+  Handle<JSObject> global(isolate->context()->global_object(), isolate);
   Execution::Call(isolate, fun, global, 0, nullptr).Check();
   return GetGlobalProperty("result")->Number();
 }
@@ -102,7 +102,7 @@ static double Add(Isolate* isolate, int x, int y) {
 
   SetGlobalProperty("x", Smi::FromInt(x));
   SetGlobalProperty("y", Smi::FromInt(y));
-  Handle<JSObject> global(isolate->context()->global_object());
+  Handle<JSObject> global(isolate->context()->global_object(), isolate);
   Execution::Call(isolate, fun, global, 0, nullptr).Check();
   return GetGlobalProperty("result")->Number();
 }
@@ -120,7 +120,7 @@ static double Abs(Isolate* isolate, int x) {
   if (fun.is_null()) return -1;
 
   SetGlobalProperty("x", Smi::FromInt(x));
-  Handle<JSObject> global(isolate->context()->global_object());
+  Handle<JSObject> global(isolate->context()->global_object(), isolate);
   Execution::Call(isolate, fun, global, 0, nullptr).Check();
   return GetGlobalProperty("result")->Number();
 }
@@ -139,7 +139,7 @@ static double Sum(Isolate* isolate, int n) {
   if (fun.is_null()) return -1;
 
   SetGlobalProperty("n", Smi::FromInt(n));
-  Handle<JSObject> global(isolate->context()->global_object());
+  Handle<JSObject> global(isolate->context()->global_object(), isolate);
   Execution::Call(isolate, fun, global, 0, nullptr).Check();
   return GetGlobalProperty("result")->Number();
 }
@@ -159,7 +159,8 @@ TEST(Print) {
   const char* source = "for (n = 0; n < 100; ++n) print(n, 1, 2);";
   Handle<JSFunction> fun = Compile(source);
   if (fun.is_null()) return;
-  Handle<JSObject> global(CcTest::i_isolate()->context()->global_object());
+  Handle<JSObject> global(CcTest::i_isolate()->context()->global_object(),
+                          fun->GetIsolate());
   Execution::Call(CcTest::i_isolate(), fun, global, 0, nullptr).Check();
 }
 
@@ -190,7 +191,8 @@ TEST(Stuff) {
 
   Handle<JSFunction> fun = Compile(source);
   CHECK(!fun.is_null());
-  Handle<JSObject> global(CcTest::i_isolate()->context()->global_object());
+  Handle<JSObject> global(CcTest::i_isolate()->context()->global_object(),
+                          fun->GetIsolate());
   Execution::Call(CcTest::i_isolate(), fun, global, 0, nullptr).Check();
   CHECK_EQ(511.0, GetGlobalProperty("r")->Number());
 }
@@ -204,7 +206,7 @@ TEST(UncaughtThrow) {
   Handle<JSFunction> fun = Compile(source);
   CHECK(!fun.is_null());
   Isolate* isolate = fun->GetIsolate();
-  Handle<JSObject> global(isolate->context()->global_object());
+  Handle<JSObject> global(isolate->context()->global_object(), isolate);
   CHECK(Execution::Call(isolate, fun, global, 0, nullptr).is_null());
   CHECK_EQ(42.0, isolate->pending_exception()->Number());
 }
@@ -230,7 +232,7 @@ TEST(C2JSFrames) {
   Isolate* isolate = fun0->GetIsolate();
 
   // Run the generated code to populate the global object with 'foo'.
-  Handle<JSObject> global(isolate->context()->global_object());
+  Handle<JSObject> global(isolate->context()->global_object(), isolate);
   Execution::Call(isolate, fun0, global, 0, nullptr).Check();
 
   Handle<Object> fun1 =
@@ -257,7 +259,7 @@ TEST(Regression236) {
   v8::HandleScope scope(CcTest::isolate());
 
   Handle<Script> script = factory->NewScript(factory->empty_string());
-  script->set_source(CcTest::heap()->undefined_value());
+  script->set_source(ReadOnlyRoots(CcTest::heap()).undefined_value());
   CHECK_EQ(-1, Script::GetLineNumber(script, 0));
   CHECK_EQ(-1, Script::GetLineNumber(script, 100));
   CHECK_EQ(-1, Script::GetLineNumber(script, -1));
@@ -309,12 +311,15 @@ TEST(FeedbackVectorPreservedAcrossRecompiles) {
           CcTest::global()->Get(context, v8_str("f")).ToLocalChecked())));
 
   // Verify that we gathered feedback.
-  Handle<FeedbackVector> feedback_vector(f->feedback_vector());
+  Handle<FeedbackVector> feedback_vector(f->feedback_vector(), f->GetIsolate());
   CHECK(!feedback_vector->is_empty());
   FeedbackSlot slot_for_a(0);
-  Object* object = feedback_vector->Get(slot_for_a);
-  CHECK(object->IsWeakCell() &&
-        WeakCell::cast(object)->value()->IsJSFunction());
+  MaybeObject* object = feedback_vector->Get(slot_for_a);
+  {
+    HeapObject* heap_object;
+    CHECK(object->ToWeakHeapObject(&heap_object));
+    CHECK(heap_object->IsJSFunction());
+  }
 
   CompileRun("%OptimizeFunctionOnNextCall(f); f(fun1);");
 
@@ -322,8 +327,11 @@ TEST(FeedbackVectorPreservedAcrossRecompiles) {
   // of the full code.
   CHECK(f->IsOptimized());
   object = f->feedback_vector()->Get(slot_for_a);
-  CHECK(object->IsWeakCell() &&
-        WeakCell::cast(object)->value()->IsJSFunction());
+  {
+    HeapObject* heap_object;
+    CHECK(object->ToWeakHeapObject(&heap_object));
+    CHECK(heap_object->IsJSFunction());
+  }
 }
 
 
diff --git a/deps/v8/test/cctest/test-cpu-profiler.cc b/deps/v8/test/cctest/test-cpu-profiler.cc
index b54a67c1313a39..4e7a70c76f28b1 100644
--- a/deps/v8/test/cctest/test-cpu-profiler.cc
+++ b/deps/v8/test/cctest/test-cpu-profiler.cc
@@ -27,6 +27,9 @@
 //
 // Tests of profiles generator and utilities.
 
+#include <limits>
+#include <memory>
+
 #include "src/v8.h"
 
 #include "include/v8-profiler.h"
@@ -83,18 +86,18 @@ TEST(StartStop) {
 
 static void EnqueueTickSampleEvent(ProfilerEventsProcessor* proc,
                                    i::Address frame1,
-                                   i::Address frame2 = nullptr,
-                                   i::Address frame3 = nullptr) {
+                                   i::Address frame2 = kNullAddress,
+                                   i::Address frame3 = kNullAddress) {
   v8::TickSample* sample = proc->StartTickSample();
-  sample->pc = frame1;
-  sample->tos = frame1;
+  sample->pc = reinterpret_cast<void*>(frame1);
+  sample->tos = reinterpret_cast<void*>(frame1);
   sample->frames_count = 0;
-  if (frame2 != nullptr) {
-    sample->stack[0] = frame2;
+  if (frame2 != kNullAddress) {
+    sample->stack[0] = reinterpret_cast<void*>(frame2);
     sample->frames_count = 1;
   }
-  if (frame3 != nullptr) {
-    sample->stack[1] = frame3;
+  if (frame3 != kNullAddress) {
+    sample->stack[1] = reinterpret_cast<void*>(frame3);
     sample->frames_count = 2;
   }
   proc->FinishTickSample();
@@ -161,9 +164,8 @@ TEST(CodeEvents) {
   CpuProfiler profiler(isolate, profiles, generator, processor);
   profiles->StartProfiling("", false);
   processor->Start();
-  ProfilerListener profiler_listener(isolate);
-  isolate->code_event_dispatcher()->AddListener(&profiler_listener);
-  profiler_listener.AddObserver(&profiler);
+  ProfilerListener profiler_listener(isolate, &profiler);
+  isolate->logger()->AddCodeEventListener(&profiler_listener);
 
   // Enqueue code creation events.
   const char* aaa_str = "aaa";
@@ -179,8 +181,7 @@ TEST(CodeEvents) {
   // Enqueue a tick event to enable code events processing.
   EnqueueTickSampleEvent(processor, aaa_code->address());
 
-  profiler_listener.RemoveObserver(&profiler);
-  isolate->code_event_dispatcher()->RemoveListener(&profiler_listener);
+  isolate->logger()->RemoveCodeEventListener(&profiler_listener);
   processor->StopSynchronously();
 
   // Check the state of profile generator.
@@ -223,9 +224,8 @@ TEST(TickEvents) {
   CpuProfiler profiler(isolate, profiles, generator, processor);
   profiles->StartProfiling("", false);
   processor->Start();
-  ProfilerListener profiler_listener(isolate);
-  isolate->code_event_dispatcher()->AddListener(&profiler_listener);
-  profiler_listener.AddObserver(&profiler);
+  ProfilerListener profiler_listener(isolate, &profiler);
+  isolate->logger()->AddCodeEventListener(&profiler_listener);
 
   profiler_listener.CodeCreateEvent(i::Logger::BUILTIN_TAG, frame1_code, "bbb");
   profiler_listener.CodeCreateEvent(i::Logger::STUB_TAG, frame2_code, "ccc");
@@ -240,8 +240,7 @@ TEST(TickEvents) {
                          frame2_code->raw_instruction_end() - 1,
                          frame1_code->raw_instruction_end() - 1);
 
-  profiler_listener.RemoveObserver(&profiler);
-  isolate->code_event_dispatcher()->RemoveListener(&profiler_listener);
+  isolate->logger()->RemoveCodeEventListener(&profiler_listener);
   processor->StopSynchronously();
   CpuProfile* profile = profiles->StopProfiling("");
   CHECK(profile);
@@ -262,8 +261,6 @@ TEST(TickEvents) {
   const std::vector<ProfileNode*>* top_down_ddd_children =
       top_down_stub_children->back()->children();
   CHECK(top_down_ddd_children->empty());
-
-  isolate->code_event_dispatcher()->RemoveListener(&profiler_listener);
 }
 
 // http://crbug/51594
@@ -296,23 +293,19 @@ TEST(Issue1398) {
   CpuProfiler profiler(isolate, profiles, generator, processor);
   profiles->StartProfiling("", false);
   processor->Start();
-  ProfilerListener profiler_listener(isolate);
-  isolate->code_event_dispatcher()->AddListener(&profiler_listener);
-  profiler_listener.AddObserver(&profiler);
+  ProfilerListener profiler_listener(isolate, &profiler);
 
   profiler_listener.CodeCreateEvent(i::Logger::BUILTIN_TAG, code, "bbb");
 
   v8::TickSample* sample = processor->StartTickSample();
-  sample->pc = code->address();
-  sample->tos = 0;
+  sample->pc = reinterpret_cast<void*>(code->address());
+  sample->tos = nullptr;
   sample->frames_count = v8::TickSample::kMaxFramesCount;
   for (unsigned i = 0; i < sample->frames_count; ++i) {
-    sample->stack[i] = code->address();
+    sample->stack[i] = reinterpret_cast<void*>(code->address());
   }
   processor->FinishTickSample();
 
-  profiler_listener.RemoveObserver(&profiler);
-  isolate->code_event_dispatcher()->RemoveListener(&profiler_listener);
   processor->StopSynchronously();
   CpuProfile* profile = profiles->StopProfiling("");
   CHECK(profile);
@@ -435,11 +428,14 @@ class ProfilerHelper {
     profiler_->Dispose();
   }
 
+  typedef v8::CpuProfilingMode ProfilingMode;
+
   v8::CpuProfile* Run(v8::Local<v8::Function> function,
                       v8::Local<v8::Value> argv[], int argc,
                       unsigned min_js_samples = 0,
                       unsigned min_external_samples = 0,
-                      bool collect_samples = false);
+                      bool collect_samples = false,
+                      ProfilingMode mode = ProfilingMode::kLeafNodeLineNumbers);
 
   v8::CpuProfiler* profiler() { return profiler_; }
 
@@ -452,11 +448,11 @@ v8::CpuProfile* ProfilerHelper::Run(v8::Local<v8::Function> function,
                                     v8::Local<v8::Value> argv[], int argc,
                                     unsigned min_js_samples,
                                     unsigned min_external_samples,
-                                    bool collect_samples) {
+                                    bool collect_samples, ProfilingMode mode) {
   v8::Local<v8::String> profile_name = v8_str("my_profile");
 
   profiler_->SetSamplingInterval(100);
-  profiler_->StartProfiling(profile_name, collect_samples);
+  profiler_->StartProfiling(profile_name, mode, collect_samples);
 
   v8::internal::CpuProfiler* iprofiler =
       reinterpret_cast<v8::internal::CpuProfiler*>(profiler_);
@@ -516,7 +512,6 @@ static const v8::CpuProfileNode* GetChild(v8::Local<v8::Context> context,
   return result;
 }
 
-
 static void CheckSimpleBranch(v8::Local<v8::Context> context,
                               const v8::CpuProfileNode* node,
                               const char* names[], int length) {
@@ -526,7 +521,6 @@ static void CheckSimpleBranch(v8::Local<v8::Context> context,
   }
 }
 
-
 static const ProfileNode* GetSimpleBranch(v8::Local<v8::Context> context,
                                           v8::CpuProfile* profile,
                                           const char* names[], int length) {
@@ -537,6 +531,41 @@ static const ProfileNode* GetSimpleBranch(v8::Local<v8::Context> context,
   return reinterpret_cast<const ProfileNode*>(node);
 }
 
+struct NameLinePair {
+  const char* name;
+  int line_number;
+};
+
+static const v8::CpuProfileNode* FindChild(const v8::CpuProfileNode* node,
+                                           NameLinePair pair) {
+  for (int i = 0, count = node->GetChildrenCount(); i < count; ++i) {
+    const v8::CpuProfileNode* child = node->GetChild(i);
+    // The name and line number must match, or if the requested line number was
+    // -1, then match any function of the same name.
+    if (strcmp(child->GetFunctionNameStr(), pair.name) == 0 &&
+        (child->GetLineNumber() == pair.line_number ||
+         pair.line_number == -1)) {
+      return child;
+    }
+  }
+  return nullptr;
+}
+
+static const v8::CpuProfileNode* GetChild(const v8::CpuProfileNode* node,
+                                          NameLinePair pair) {
+  const v8::CpuProfileNode* result = FindChild(node, pair);
+  if (!result) FATAL("Failed to GetChild: %s:%d", pair.name, pair.line_number);
+  return result;
+}
+
+static void CheckBranch(const v8::CpuProfileNode* node, NameLinePair path[],
+                        int length) {
+  for (int i = 0; i < length; i++) {
+    NameLinePair pair = path[i];
+    node = GetChild(node, pair);
+  }
+}
+
 static const char* cpu_profiler_test_source =
     "%NeverOptimizeFunction(loop);\n"
     "%NeverOptimizeFunction(delay);\n"
@@ -617,6 +646,40 @@ TEST(CollectCpuProfile) {
   profile->Delete();
 }
 
+TEST(CollectCpuProfileCallerLineNumbers) {
+  i::FLAG_allow_natives_syntax = true;
+  LocalContext env;
+  v8::HandleScope scope(env->GetIsolate());
+
+  CompileRun(cpu_profiler_test_source);
+  v8::Local<v8::Function> function = GetFunction(env.local(), "start");
+
+  int32_t profiling_interval_ms = 200;
+  v8::Local<v8::Value> args[] = {
+      v8::Integer::New(env->GetIsolate(), profiling_interval_ms)};
+  ProfilerHelper helper(env.local());
+  helper.Run(function, args, arraysize(args), 1000, 0, false,
+             v8::CpuProfilingMode::kCallerLineNumbers);
+  v8::CpuProfile* profile =
+      helper.Run(function, args, arraysize(args), 1000, 0, false,
+                 v8::CpuProfilingMode::kCallerLineNumbers);
+
+  const v8::CpuProfileNode* root = profile->GetTopDownRoot();
+  const v8::CpuProfileNode* start_node = GetChild(root, {"start", 27});
+  const v8::CpuProfileNode* foo_node = GetChild(start_node, {"foo", 30});
+
+  NameLinePair bar_branch[] = {{"bar", 23}, {"delay", 19}, {"loop", 18}};
+  CheckBranch(foo_node, bar_branch, arraysize(bar_branch));
+  NameLinePair baz_branch[] = {{"baz", 25}, {"delay", 20}, {"loop", 18}};
+  CheckBranch(foo_node, baz_branch, arraysize(baz_branch));
+  NameLinePair delay_at22_branch[] = {{"delay", 22}, {"loop", 18}};
+  CheckBranch(foo_node, delay_at22_branch, arraysize(delay_at22_branch));
+  NameLinePair delay_at24_branch[] = {{"delay", 24}, {"loop", 18}};
+  CheckBranch(foo_node, delay_at24_branch, arraysize(delay_at24_branch));
+
+  profile->Delete();
+}
+
 static const char* hot_deopt_no_frame_entry_test_source =
     "%NeverOptimizeFunction(foo);\n"
     "%NeverOptimizeFunction(start);\n"
@@ -1083,9 +1146,7 @@ static void TickLines(bool optimize) {
   CpuProfiler profiler(isolate, profiles, generator, processor);
   profiles->StartProfiling("", false);
   processor->Start();
-  ProfilerListener profiler_listener(isolate);
-  isolate->code_event_dispatcher()->AddListener(&profiler_listener);
-  profiler_listener.AddObserver(&profiler);
+  ProfilerListener profiler_listener(isolate, &profiler);
 
   // Enqueue code creation events.
   i::Handle<i::String> str = factory->NewStringFromAsciiChecked(func_name);
@@ -1097,8 +1158,6 @@ static void TickLines(bool optimize) {
   // Enqueue a tick event to enable code events processing.
   EnqueueTickSampleEvent(processor, code_address);
 
-  profiler_listener.RemoveObserver(&profiler);
-  isolate->code_event_dispatcher()->RemoveListener(&profiler_listener);
   processor->StopSynchronously();
 
   CpuProfile* profile = profiles->StopProfiling("");
@@ -1108,9 +1167,10 @@ static void TickLines(bool optimize) {
   CodeEntry* func_entry = generator->code_map()->FindEntry(code_address);
   CHECK(func_entry);
   CHECK_EQ(0, strcmp(func_name, func_entry->name()));
-  const i::JITLineInfoTable* line_info = func_entry->line_info();
+  const i::SourcePositionTable* line_info = func_entry->line_info();
   CHECK(line_info);
-  CHECK(!line_info->empty());
+  CHECK_NE(v8::CpuProfileNode::kNoLineNumberInfo,
+           line_info->GetSourceLineNumber(100));
 
   // Check the hit source lines using V8 Public APIs.
   const i::ProfileTree* tree = profile->top_down();
@@ -1574,7 +1634,7 @@ TEST(JsNativeJsRuntimeJsSampleMultiple) {
 static const char* inlining_test_source =
     "%NeverOptimizeFunction(action);\n"
     "%NeverOptimizeFunction(start);\n"
-    "level1()\n"
+    "level1();\n"
     "%OptimizeFunctionOnNextCall(level1);\n"
     "%OptimizeFunctionOnNextCall(level2);\n"
     "%OptimizeFunctionOnNextCall(level3);\n"
@@ -2244,7 +2304,6 @@ TEST(TracingCpuProfiler) {
   v8::HandleScope scope(env->GetIsolate());
   {
     tracing_controller->StartTracing(trace_config);
-    auto profiler = v8::TracingCpuProfiler::Create(env->GetIsolate());
     CompileRun("function foo() { } foo();");
     tracing_controller->StopTracing();
     CompileRun("function bar() { } bar();");
@@ -2381,10 +2440,10 @@ TEST(CodeEntriesMemoryLeak) {
     v8::CpuProfile* profile = helper.Run(function, nullptr, 0);
     profile->Delete();
   }
-  ProfilerListener* profiler_listener =
-      CcTest::i_isolate()->logger()->profiler_listener();
 
-  CHECK_GE(10000ul, profiler_listener->entries_count_for_test());
+  i::CpuProfiler* profiler =
+      reinterpret_cast<i::CpuProfiler*>(helper.profiler());
+  CHECK(!profiler->profiler_listener_for_test());
 }
 
 TEST(NativeFrameStackTrace) {
@@ -2434,6 +2493,55 @@ TEST(NativeFrameStackTrace) {
   profile->Delete();
 }
 
+TEST(SourcePositionTable) {
+  i::SourcePositionTable info;
+
+  // Newly created tables should return NoLineNumberInfo for any lookup.
+  int no_info = v8::CpuProfileNode::kNoLineNumberInfo;
+  CHECK_EQ(no_info, info.GetSourceLineNumber(std::numeric_limits<int>::min()));
+  CHECK_EQ(no_info, info.GetSourceLineNumber(0));
+  CHECK_EQ(no_info, info.GetSourceLineNumber(1));
+  CHECK_EQ(no_info, info.GetSourceLineNumber(9));
+  CHECK_EQ(no_info, info.GetSourceLineNumber(10));
+  CHECK_EQ(no_info, info.GetSourceLineNumber(11));
+  CHECK_EQ(no_info, info.GetSourceLineNumber(19));
+  CHECK_EQ(no_info, info.GetSourceLineNumber(20));
+  CHECK_EQ(no_info, info.GetSourceLineNumber(21));
+  CHECK_EQ(no_info, info.GetSourceLineNumber(100));
+  CHECK_EQ(no_info, info.GetSourceLineNumber(std::numeric_limits<int>::max()));
+
+  info.SetPosition(10, 1);
+  info.SetPosition(20, 2);
+
+  // The only valid return values are 1 or 2 - every pc maps to a line number.
+  CHECK_EQ(1, info.GetSourceLineNumber(std::numeric_limits<int>::min()));
+  CHECK_EQ(1, info.GetSourceLineNumber(0));
+  CHECK_EQ(1, info.GetSourceLineNumber(1));
+  CHECK_EQ(1, info.GetSourceLineNumber(9));
+  CHECK_EQ(1, info.GetSourceLineNumber(10));
+  CHECK_EQ(1, info.GetSourceLineNumber(11));
+  CHECK_EQ(1, info.GetSourceLineNumber(19));
+  CHECK_EQ(2, info.GetSourceLineNumber(20));
+  CHECK_EQ(2, info.GetSourceLineNumber(21));
+  CHECK_EQ(2, info.GetSourceLineNumber(100));
+  CHECK_EQ(2, info.GetSourceLineNumber(std::numeric_limits<int>::max()));
+
+  // Test SetPosition behavior.
+  info.SetPosition(25, 3);
+  CHECK_EQ(2, info.GetSourceLineNumber(21));
+  CHECK_EQ(3, info.GetSourceLineNumber(100));
+  CHECK_EQ(3, info.GetSourceLineNumber(std::numeric_limits<int>::max()));
+}
+
+TEST(MultipleProfilers) {
+  std::unique_ptr<CpuProfiler> profiler1(new CpuProfiler(CcTest::i_isolate()));
+  std::unique_ptr<CpuProfiler> profiler2(new CpuProfiler(CcTest::i_isolate()));
+  profiler1->StartProfiling("1");
+  profiler2->StartProfiling("2");
+  profiler1->StopProfiling("1");
+  profiler2->StopProfiling("2");
+}
+
 }  // namespace test_cpu_profiler
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/test/cctest/test-debug.cc b/deps/v8/test/cctest/test-debug.cc
index 247bc5d3d0c075..d3c10822ffe49f 100644
--- a/deps/v8/test/cctest/test-debug.cc
+++ b/deps/v8/test/cctest/test-debug.cc
@@ -26,7 +26,6 @@
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 #include <stdlib.h>
-#include <set>
 
 #include "src/v8.h"
 
@@ -37,88 +36,16 @@
 #include "src/deoptimizer.h"
 #include "src/frames.h"
 #include "src/objects-inl.h"
+#include "src/snapshot/natives.h"
 #include "src/snapshot/snapshot.h"
 #include "src/utils.h"
 #include "test/cctest/cctest.h"
 
-using ::v8::internal::EmbeddedVector;
-using ::v8::internal::Object;
 using ::v8::internal::Handle;
-using ::v8::internal::Heap;
-using ::v8::internal::JSGlobalProxy;
-using ::v8::internal::Code;
-using ::v8::internal::Debug;
-using ::v8::internal::StackFrame;
-using ::v8::internal::StepAction;
+using ::v8::internal::StepNone;  // From StepAction enum
 using ::v8::internal::StepIn;  // From StepAction enum
 using ::v8::internal::StepNext;  // From StepAction enum
 using ::v8::internal::StepOut;  // From StepAction enum
-using ::v8::internal::Vector;
-using ::v8::internal::StrLength;
-
-// Size of temp buffer for formatting small strings.
-#define SMALL_STRING_BUFFER_SIZE 80
-
-// --- H e l p e r   C l a s s e s
-
-
-// Helper class for creating a V8 enviromnent for running tests
-class DebugLocalContext {
- public:
-  inline DebugLocalContext(
-      v8::Isolate* isolate, v8::ExtensionConfiguration* extensions = 0,
-      v8::Local<v8::ObjectTemplate> global_template =
-          v8::Local<v8::ObjectTemplate>(),
-      v8::Local<v8::Value> global_object = v8::Local<v8::Value>())
-      : scope_(isolate),
-        context_(v8::Context::New(isolate, extensions, global_template,
-                                  global_object)) {
-    context_->Enter();
-  }
-  inline DebugLocalContext(
-      v8::ExtensionConfiguration* extensions = 0,
-      v8::Local<v8::ObjectTemplate> global_template =
-          v8::Local<v8::ObjectTemplate>(),
-      v8::Local<v8::Value> global_object = v8::Local<v8::Value>())
-      : scope_(CcTest::isolate()),
-        context_(v8::Context::New(CcTest::isolate(), extensions,
-                                  global_template, global_object)) {
-    context_->Enter();
-  }
-  inline ~DebugLocalContext() {
-    context_->Exit();
-  }
-  inline v8::Local<v8::Context> context() { return context_; }
-  inline v8::Context* operator->() { return *context_; }
-  inline v8::Context* operator*() { return *context_; }
-  inline v8::Isolate* GetIsolate() { return context_->GetIsolate(); }
-  inline bool IsReady() { return !context_.IsEmpty(); }
-  void ExposeDebug() {
-    v8::internal::Isolate* isolate =
-        reinterpret_cast<v8::internal::Isolate*>(context_->GetIsolate());
-    v8::internal::Factory* factory = isolate->factory();
-    // Expose the debug context global object in the global object for testing.
-    CHECK(isolate->debug()->Load());
-    Handle<v8::internal::Context> debug_context =
-        isolate->debug()->debug_context();
-    debug_context->set_security_token(
-        v8::Utils::OpenHandle(*context_)->security_token());
-
-    Handle<JSGlobalProxy> global(Handle<JSGlobalProxy>::cast(
-        v8::Utils::OpenHandle(*context_->Global())));
-    Handle<v8::internal::String> debug_string =
-        factory->InternalizeOneByteString(STATIC_CHAR_VECTOR("debug"));
-    v8::internal::JSObject::SetOwnPropertyIgnoreAttributes(
-        global, debug_string, handle(debug_context->global_proxy()),
-        v8::internal::DONT_ENUM)
-        .Check();
-  }
-
- private:
-  v8::HandleScope scope_;
-  v8::Local<v8::Context> context_;
-};
-
 
 // --- H e l p e r   F u n c t i o n s
 
@@ -136,33 +63,17 @@ static v8::Local<v8::Function> CompileFunction(v8::Isolate* isolate,
 
 
 // Compile and run the supplied source and return the requested function.
-static v8::Local<v8::Function> CompileFunction(DebugLocalContext* env,
+static v8::Local<v8::Function> CompileFunction(LocalContext* env,
                                                const char* source,
                                                const char* function_name) {
-  return CompileFunction(env->GetIsolate(), source, function_name);
-}
-
-static void SetDebugEventListener(
-    v8::Isolate* isolate, v8::Debug::EventCallback that,
-    v8::Local<v8::Value> data = v8::Local<v8::Value>()) {
-  i::Isolate* i_isolate = reinterpret_cast<i::Isolate*>(isolate);
-  i::HandleScope scope(i_isolate);
-  if (that == nullptr) {
-    i_isolate->debug()->SetDebugDelegate(nullptr, false);
-  } else {
-    i::Handle<i::Object> i_data = i_isolate->factory()->undefined_value();
-    if (!data.IsEmpty()) i_data = v8::Utils::OpenHandle(*data);
-    i::NativeDebugDelegate* delegate =
-        new i::NativeDebugDelegate(i_isolate, that, i_data);
-    i_isolate->debug()->SetDebugDelegate(delegate, true);
-  }
+  return CompileFunction((*env)->GetIsolate(), source, function_name);
 }
 
 // Is there any debug info for the function?
 static bool HasBreakInfo(v8::Local<v8::Function> fun) {
   Handle<v8::internal::JSFunction> f =
       Handle<v8::internal::JSFunction>::cast(v8::Utils::OpenHandle(*fun));
-  Handle<v8::internal::SharedFunctionInfo> shared(f->shared());
+  Handle<v8::internal::SharedFunctionInfo> shared(f->shared(), f->GetIsolate());
   return shared->HasBreakInfo();
 }
 
@@ -203,37 +114,12 @@ static void ChangeBreakOnException(bool caught, bool uncaught) {
 }
 
 
-// Change break on exception using the global Debug object.
-static void ChangeBreakOnExceptionFromJS(v8::Isolate* isolate, bool caught,
-                                         bool uncaught) {
-  if (caught) {
-    CompileRunChecked(isolate, "debug.Debug.setBreakOnException()");
-  } else {
-    CompileRunChecked(isolate, "debug.Debug.clearBreakOnException()");
-  }
-  if (uncaught) {
-    CompileRunChecked(isolate, "debug.Debug.setBreakOnUncaughtException()");
-  } else {
-    CompileRunChecked(isolate, "debug.Debug.clearBreakOnUncaughtException()");
-  }
-}
-
-// Change break on exception using the native API call.
-static void ChangeBreakOnExceptionFromAPI(
-    v8::Isolate* isolate, v8::debug::ExceptionBreakState state) {
-  v8::debug::ChangeBreakOnException(isolate, state);
-}
-
 // Prepare to step to next break location.
-static void PrepareStep(StepAction step_action) {
+static void PrepareStep(i::StepAction step_action) {
   v8::internal::Debug* debug = CcTest::i_isolate()->debug();
   debug->PrepareStep(step_action);
 }
 
-
-static void ClearStepping() { CcTest::i_isolate()->debug()->ClearStepping(); }
-
-
 // This function is in namespace v8::internal to be friend with class
 // v8::internal::Debug.
 namespace v8 {
@@ -271,7 +157,6 @@ Handle<FixedArray> GetDebuggedFunctions() {
 void CheckDebuggerUnloaded() {
   // Check that the debugger context is cleared and that there is no debug
   // information stored for the debugger.
-  CHECK(CcTest::i_isolate()->debug()->debug_context().is_null());
   CHECK(!CcTest::i_isolate()->debug()->debug_info_list_);
 
   // Collect garbage to ensure weak handles are cleared.
@@ -299,377 +184,46 @@ static void CheckDebuggerUnloaded() { v8::internal::CheckDebuggerUnloaded(); }
 // --- The different tests uses a number of debug event handlers.
 // ---
 
-
-// Source for the JavaScript function which picks out the function
-// name of a frame.
-const char* frame_function_name_source =
-    "function frame_function_name(exec_state, frame_number) {"
-    "  return exec_state.frame(frame_number).func().name();"
-    "}";
-v8::Local<v8::Function> frame_function_name;
-
-
-// Source for the JavaScript function which pick out the name of the
-// first argument of a frame.
-const char* frame_argument_name_source =
-    "function frame_argument_name(exec_state, frame_number) {"
-    "  return exec_state.frame(frame_number).argumentName(0);"
-    "}";
-v8::Local<v8::Function> frame_argument_name;
-
-
-// Source for the JavaScript function which pick out the value of the
-// first argument of a frame.
-const char* frame_argument_value_source =
-    "function frame_argument_value(exec_state, frame_number) {"
-    "  return exec_state.frame(frame_number).argumentValue(0).value_;"
-    "}";
-v8::Local<v8::Function> frame_argument_value;
-
-
-// Source for the JavaScript function which pick out the name of the
-// first argument of a frame.
-const char* frame_local_name_source =
-    "function frame_local_name(exec_state, frame_number) {"
-    "  return exec_state.frame(frame_number).localName(0);"
-    "}";
-v8::Local<v8::Function> frame_local_name;
-
-
-// Source for the JavaScript function which pick out the value of the
-// first argument of a frame.
-const char* frame_local_value_source =
-    "function frame_local_value(exec_state, frame_number) {"
-    "  return exec_state.frame(frame_number).localValue(0).value_;"
-    "}";
-v8::Local<v8::Function> frame_local_value;
-
-
-// Source for the JavaScript function which picks out the source line for the
-// top frame.
-const char* frame_source_line_source =
-    "function frame_source_line(exec_state) {"
-    "  return exec_state.frame(0).sourceLine();"
-    "}";
-v8::Local<v8::Function> frame_source_line;
-
-
-// Source for the JavaScript function which picks out the source column for the
-// top frame.
-const char* frame_source_column_source =
-    "function frame_source_column(exec_state) {"
-    "  return exec_state.frame(0).sourceColumn();"
-    "}";
-v8::Local<v8::Function> frame_source_column;
-
-
-// Source for the JavaScript function which picks out the script name for the
-// top frame.
-const char* frame_script_name_source =
-    "function frame_script_name(exec_state) {"
-    "  return exec_state.frame(0).func().script().name();"
-    "}";
-v8::Local<v8::Function> frame_script_name;
-
-
-// Source for the JavaScript function which returns the number of frames.
-static const char* frame_count_source =
-    "function frame_count(exec_state) {"
-    "  return exec_state.frameCount();"
-    "}";
-v8::Local<v8::Function> frame_count;
-
-
-// Global variable to store the last function hit - used by some tests.
-char last_function_hit[80];
-
-// Global variable to store the name for last script hit - used by some tests.
-char last_script_name_hit[80];
-
-// Global variables to store the last source position - used by some tests.
-int last_source_line = -1;
-int last_source_column = -1;
-
-// Debug event handler which counts the break points which have been hit.
+// Debug event handler which counts a number of events.
 int break_point_hit_count = 0;
 int break_point_hit_count_deoptimize = 0;
-static void DebugEventBreakPointHitCount(
-    const v8::Debug::EventDetails& event_details) {
-  v8::DebugEvent event = event_details.GetEvent();
-  v8::Local<v8::Object> exec_state = event_details.GetExecutionState();
-  v8::Local<v8::Context> context = CcTest::isolate()->GetCurrentContext();
-  v8::internal::Isolate* isolate = CcTest::i_isolate();
-  Debug* debug = isolate->debug();
-  // When hitting a debug event listener there must be a break set.
-  CHECK_NE(debug->break_id(), 0);
+class DebugEventCounter : public v8::debug::DebugDelegate {
+ public:
+  void BreakProgramRequested(v8::Local<v8::Context>,
+                             const std::vector<v8::debug::BreakpointId>&) {
+    v8::internal::Debug* debug = CcTest::i_isolate()->debug();
+    // When hitting a debug event listener there must be a break set.
+    CHECK_NE(debug->break_id(), 0);
 
-  // Count the number of breaks.
-  if (event == v8::Break) {
     break_point_hit_count++;
-    if (!frame_function_name.IsEmpty()) {
-      // Get the name of the function.
-      const int argc = 2;
-      v8::Local<v8::Value> argv[argc] = {
-          exec_state, v8::Integer::New(CcTest::isolate(), 0)};
-      v8::Local<v8::Value> result =
-          frame_function_name->Call(context, exec_state, argc, argv)
-              .ToLocalChecked();
-      if (result->IsUndefined()) {
-        last_function_hit[0] = '\0';
-      } else {
-        CHECK(result->IsString());
-        v8::Local<v8::String> function_name(result.As<v8::String>());
-        function_name->WriteUtf8(last_function_hit);
-      }
-    }
-
-    if (!frame_source_line.IsEmpty()) {
-      // Get the source line.
-      const int argc = 1;
-      v8::Local<v8::Value> argv[argc] = {exec_state};
-      v8::Local<v8::Value> result =
-          frame_source_line->Call(context, exec_state, argc, argv)
-              .ToLocalChecked();
-      CHECK(result->IsNumber());
-      last_source_line = result->Int32Value(context).FromJust();
-    }
-
-    if (!frame_source_column.IsEmpty()) {
-      // Get the source column.
-      const int argc = 1;
-      v8::Local<v8::Value> argv[argc] = {exec_state};
-      v8::Local<v8::Value> result =
-          frame_source_column->Call(context, exec_state, argc, argv)
-              .ToLocalChecked();
-      CHECK(result->IsNumber());
-      last_source_column = result->Int32Value(context).FromJust();
-    }
-
-    if (!frame_script_name.IsEmpty()) {
-      // Get the script name of the function script.
-      const int argc = 1;
-      v8::Local<v8::Value> argv[argc] = {exec_state};
-      v8::Local<v8::Value> result =
-          frame_script_name->Call(context, exec_state, argc, argv)
-              .ToLocalChecked();
-      if (result->IsUndefined()) {
-        last_script_name_hit[0] = '\0';
-      } else {
-        CHECK(result->IsString());
-        v8::Local<v8::String> script_name(result.As<v8::String>());
-        script_name->WriteUtf8(last_script_name_hit);
-      }
-    }
-
     // Perform a full deoptimization when the specified number of
     // breaks have been hit.
     if (break_point_hit_count == break_point_hit_count_deoptimize) {
-      i::Deoptimizer::DeoptimizeAll(isolate);
-    }
-  }
-}
-
-
-// Debug event handler which counts a number of events and collects the stack
-// height if there is a function compiled for that.
-int exception_hit_count = 0;
-int uncaught_exception_hit_count = 0;
-int last_js_stack_height = -1;
-
-static void DebugEventCounterClear() {
-  break_point_hit_count = 0;
-  exception_hit_count = 0;
-  uncaught_exception_hit_count = 0;
-}
-
-static void DebugEventCounter(
-    const v8::Debug::EventDetails& event_details) {
-  v8::Isolate::AllowJavascriptExecutionScope allow_script(CcTest::isolate());
-  v8::DebugEvent event = event_details.GetEvent();
-  v8::Local<v8::Object> exec_state = event_details.GetExecutionState();
-  v8::Local<v8::Object> event_data = event_details.GetEventData();
-  v8::Local<v8::Context> context = CcTest::isolate()->GetCurrentContext();
-  v8::internal::Debug* debug = CcTest::i_isolate()->debug();
-
-  // When hitting a debug event listener there must be a break set.
-  CHECK_NE(debug->break_id(), 0);
-
-  // Count the number of breaks.
-  if (event == v8::Break) {
-    break_point_hit_count++;
-  } else if (event == v8::Exception) {
-    exception_hit_count++;
-
-    // Check whether the exception was uncaught.
-    v8::Local<v8::String> fun_name = v8_str(CcTest::isolate(), "uncaught");
-    v8::Local<v8::Function> fun = v8::Local<v8::Function>::Cast(
-        event_data->Get(context, fun_name).ToLocalChecked());
-    v8::Local<v8::Value> result =
-        fun->Call(context, event_data, 0, nullptr).ToLocalChecked();
-    if (result->IsTrue()) {
-      uncaught_exception_hit_count++;
+      i::Deoptimizer::DeoptimizeAll(CcTest::i_isolate());
     }
+    if (step_action_ != StepNone) PrepareStep(step_action_);
   }
 
-  // Collect the JavsScript stack height if the function frame_count is
-  // compiled.
-  if (!frame_count.IsEmpty()) {
-    static const int kArgc = 1;
-    v8::Local<v8::Value> argv[kArgc] = {exec_state};
-    // Using exec_state as receiver is just to have a receiver.
-    v8::Local<v8::Value> result =
-        frame_count->Call(context, exec_state, kArgc, argv).ToLocalChecked();
-    last_js_stack_height = result->Int32Value(context).FromJust();
+  void set_step_action(i::StepAction step_action) {
+    step_action_ = step_action;
   }
-}
-
 
-// Debug event handler which evaluates a number of expressions when a break
-// point is hit. Each evaluated expression is compared with an expected value.
-// For this debug event handler to work the following two global varaibles
-// must be initialized.
-//   checks: An array of expressions and expected results
-//   evaluate_check_function: A JavaScript function (see below)
-
-// Structure for holding checks to do.
-struct EvaluateCheck {
-  const char* expr;  // An expression to evaluate when a break point is hit.
-  v8::Local<v8::Value> expected;  // The expected result.
+ private:
+  i::StepAction step_action_ = StepNone;
 };
 
-
-// Array of checks to do.
-struct EvaluateCheck* checks = nullptr;
-// Source for The JavaScript function which can do the evaluation when a break
-// point is hit.
-const char* evaluate_check_source =
-    "function evaluate_check(exec_state, expr, expected) {"
-    "  return exec_state.frame(0).evaluate(expr).value() === expected;"
-    "}";
-v8::Local<v8::Function> evaluate_check_function;
-
-// The actual debug event described by the longer comment above.
-static void DebugEventEvaluate(
-    const v8::Debug::EventDetails& event_details) {
-  v8::DebugEvent event = event_details.GetEvent();
-  v8::Local<v8::Object> exec_state = event_details.GetExecutionState();
-  v8::Isolate* isolate = CcTest::isolate();
-  v8::Local<v8::Context> context = isolate->GetCurrentContext();
-  v8::internal::Debug* debug = CcTest::i_isolate()->debug();
-  // When hitting a debug event listener there must be a break set.
-  CHECK_NE(debug->break_id(), 0);
-
-  if (event == v8::Break) {
-    break_point_hit_count++;
-    for (int i = 0; checks[i].expr != nullptr; i++) {
-      const int argc = 3;
-      v8::Local<v8::String> string = v8_str(isolate, checks[i].expr);
-      v8::Local<v8::Value> argv[argc] = {exec_state, string,
-                                         checks[i].expected};
-      v8::Local<v8::Value> result =
-          evaluate_check_function->Call(context, exec_state, argc, argv)
-              .ToLocalChecked();
-      if (!result->IsTrue()) {
-        v8::String::Utf8Value utf8(isolate, checks[i].expected);
-        V8_Fatal(__FILE__, __LINE__, "%s != %s", checks[i].expr, *utf8);
-      }
-    }
-  }
-}
-
-
-// This debug event listener removes a breakpoint in a function
-i::Handle<i::BreakPoint> debug_event_remove_break_point;
-static void DebugEventRemoveBreakPoint(
-    const v8::Debug::EventDetails& event_details) {
-  v8::DebugEvent event = event_details.GetEvent();
-  v8::Local<v8::Value> data = event_details.GetCallbackData();
-  v8::internal::Debug* debug = CcTest::i_isolate()->debug();
-  // When hitting a debug event listener there must be a break set.
-  CHECK_NE(debug->break_id(), 0);
-
-  if (event == v8::Break) {
-    break_point_hit_count++;
-    CHECK(data->IsFunction());
-    ClearBreakPoint(debug_event_remove_break_point);
-  }
-}
-
-
-// Debug event handler which counts break points hit and performs a step
-// afterwards.
-StepAction step_action = StepIn;  // Step action to perform when stepping.
-static void DebugEventStep(
-    const v8::Debug::EventDetails& event_details) {
-  v8::DebugEvent event = event_details.GetEvent();
-  v8::internal::Debug* debug = CcTest::i_isolate()->debug();
-  // When hitting a debug event listener there must be a break set.
-  CHECK_NE(debug->break_id(), 0);
-
-  if (event == v8::Break) {
-    break_point_hit_count++;
-    PrepareStep(step_action);
-  }
-}
-
-
-// Debug event handler which counts break points hit and performs a step
-// afterwards. For each call the expected function is checked.
-// For this debug event handler to work the following two global varaibles
-// must be initialized.
-//   expected_step_sequence: An array of the expected function call sequence.
-//   frame_function_name: A JavaScript function (see below).
-
-// String containing the expected function call sequence. Note: this only works
-// if functions have name length of one.
-const char* expected_step_sequence = nullptr;
-
-// The actual debug event described by the longer comment above.
-static void DebugEventStepSequence(
-    const v8::Debug::EventDetails& event_details) {
-  v8::DebugEvent event = event_details.GetEvent();
-  v8::Local<v8::Object> exec_state = event_details.GetExecutionState();
-  v8::internal::Debug* debug = CcTest::i_isolate()->debug();
-  // When hitting a debug event listener there must be a break set.
-  CHECK_NE(debug->break_id(), 0);
-
-  if (event == v8::Break || event == v8::Exception) {
-    // Check that the current function is the expected.
-    CHECK(break_point_hit_count <
-          StrLength(expected_step_sequence));
-    const int argc = 2;
-    v8::Local<v8::Value> argv[argc] = {exec_state,
-                                       v8::Integer::New(CcTest::isolate(), 0)};
-    v8::Local<v8::Context> context = CcTest::isolate()->GetCurrentContext();
-    v8::Local<v8::Value> result =
-        frame_function_name->Call(context, exec_state, argc, argv)
-            .ToLocalChecked();
-    CHECK(result->IsString());
-    v8::String::Utf8Value function_name(
-        CcTest::isolate(), result->ToString(context).ToLocalChecked());
-    CHECK_EQ(1, StrLength(*function_name));
-    CHECK_EQ((*function_name)[0],
-              expected_step_sequence[break_point_hit_count]);
-
-    // Perform step.
-    break_point_hit_count++;
-    PrepareStep(step_action);
-  }
-}
-
-
 // Debug event handler which performs a garbage collection.
-static void DebugEventBreakPointCollectGarbage(
-    const v8::Debug::EventDetails& event_details) {
-  v8::DebugEvent event = event_details.GetEvent();
-  v8::internal::Debug* debug = CcTest::i_isolate()->debug();
-  // When hitting a debug event listener there must be a break set.
-  CHECK_NE(debug->break_id(), 0);
+class DebugEventBreakPointCollectGarbage : public v8::debug::DebugDelegate {
+ public:
+  void BreakProgramRequested(v8::Local<v8::Context>,
+                             const std::vector<v8::debug::BreakpointId>&) {
+    v8::internal::Debug* debug = CcTest::i_isolate()->debug();
+    // When hitting a debug event listener there must be a break set.
+    CHECK_NE(debug->break_id(), 0);
 
-  // Perform a garbage collection when break point is hit and continue. Based
-  // on the number of break points hit either scavenge or mark compact
-  // collector is used.
-  if (event == v8::Break) {
+    // Perform a garbage collection when break point is hit and continue. Based
+    // on the number of break points hit either scavenge or mark compact
+    // collector is used.
     break_point_hit_count++;
     if (break_point_hit_count % 2 == 0) {
       // Scavenge.
@@ -679,19 +233,18 @@ static void DebugEventBreakPointCollectGarbage(
       CcTest::CollectAllGarbage();
     }
   }
-}
-
+};
 
 // Debug event handler which re-issues a debug break and calls the garbage
 // collector to have the heap verified.
-static void DebugEventBreak(
-    const v8::Debug::EventDetails& event_details) {
-  v8::DebugEvent event = event_details.GetEvent();
-  v8::internal::Debug* debug = CcTest::i_isolate()->debug();
-  // When hitting a debug event listener there must be a break set.
-  CHECK_NE(debug->break_id(), 0);
+class DebugEventBreak : public v8::debug::DebugDelegate {
+ public:
+  void BreakProgramRequested(v8::Local<v8::Context>,
+                             const std::vector<v8::debug::BreakpointId>&) {
+    v8::internal::Debug* debug = CcTest::i_isolate()->debug();
+    // When hitting a debug event listener there must be a break set.
+    CHECK_NE(debug->break_id(), 0);
 
-  if (event == v8::Break) {
     // Count the number of breaks.
     break_point_hit_count++;
 
@@ -700,31 +253,33 @@ static void DebugEventBreak(
     CcTest::CollectGarbage(v8::internal::NEW_SPACE);
 
     // Set the break flag again to come back here as soon as possible.
-    v8::debug::DebugBreak(CcTest::isolate());
+    v8::debug::SetBreakOnNextFunctionCall(CcTest::isolate());
   }
-}
+};
 
+static void BreakRightNow(v8::Isolate* isolate, void*) {
+  v8::debug::BreakRightNow(isolate);
+}
 
 // Debug event handler which re-issues a debug break until a limit has been
 // reached.
 int max_break_point_hit_count = 0;
 bool terminate_after_max_break_point_hit = false;
-static void DebugEventBreakMax(
-    const v8::Debug::EventDetails& event_details) {
-  v8::DebugEvent event = event_details.GetEvent();
-  v8::Isolate* v8_isolate = CcTest::isolate();
-  v8::internal::Isolate* isolate = CcTest::i_isolate();
-  v8::internal::Debug* debug = isolate->debug();
-  // When hitting a debug event listener there must be a break set.
-  CHECK_NE(debug->break_id(), 0);
-
-  if (event == v8::Break) {
+class DebugEventBreakMax : public v8::debug::DebugDelegate {
+ public:
+  void BreakProgramRequested(v8::Local<v8::Context>,
+                             const std::vector<v8::debug::BreakpointId>&) {
+    v8::Isolate* v8_isolate = CcTest::isolate();
+    v8::internal::Isolate* isolate = CcTest::i_isolate();
+    v8::internal::Debug* debug = isolate->debug();
+    // When hitting a debug event listener there must be a break set.
+    CHECK_NE(debug->break_id(), 0);
     if (break_point_hit_count < max_break_point_hit_count) {
       // Count the number of breaks.
       break_point_hit_count++;
 
       // Set the break flag again to come back here as soon as possible.
-      v8::debug::DebugBreak(v8_isolate);
+      v8_isolate->RequestInterrupt(BreakRightNow, nullptr);
 
     } else if (terminate_after_max_break_point_hit) {
       // Terminate execution after the last break if requested.
@@ -737,31 +292,14 @@ static void DebugEventBreakMax(
       i::Deoptimizer::DeoptimizeAll(isolate);
     }
   }
-}
-
-
-// --- M e s s a g e   C a l l b a c k
-
-
-// Message callback which counts the number of messages.
-int message_callback_count = 0;
-
-static void MessageCallbackCountClear() {
-  message_callback_count = 0;
-}
-
-static void MessageCallbackCount(v8::Local<v8::Message> message,
-                                 v8::Local<v8::Value> data) {
-  message_callback_count++;
-}
-
+};
 
 // --- T h e   A c t u a l   T e s t s
 
 // Test that the debug info in the VM is in sync with the functions being
 // debugged.
 TEST(DebugInfo) {
-  DebugLocalContext env;
+  LocalContext env;
   v8::HandleScope scope(env->GetIsolate());
   // Create a couple of functions for the test.
   v8::Local<v8::Function> foo =
@@ -800,40 +338,42 @@ TEST(DebugInfo) {
 // Test that a break point can be set at an IC store location.
 TEST(BreakPointICStore) {
   break_point_hit_count = 0;
-  DebugLocalContext env;
+  LocalContext env;
   v8::HandleScope scope(env->GetIsolate());
 
-  SetDebugEventListener(env->GetIsolate(), DebugEventBreakPointHitCount);
+  DebugEventCounter delegate;
+  v8::debug::SetDebugDelegate(env->GetIsolate(), &delegate);
   v8::Local<v8::Function> foo =
       CompileFunction(&env, "function foo(){bar=0;}", "foo");
 
   // Run without breakpoints.
-  foo->Call(env.context(), env->Global(), 0, nullptr).ToLocalChecked();
+  foo->Call(env.local(), env->Global(), 0, nullptr).ToLocalChecked();
   CHECK_EQ(0, break_point_hit_count);
 
   // Run with breakpoint
   i::Handle<i::BreakPoint> bp = SetBreakPoint(foo, 0);
-  foo->Call(env.context(), env->Global(), 0, nullptr).ToLocalChecked();
+  foo->Call(env.local(), env->Global(), 0, nullptr).ToLocalChecked();
   CHECK_EQ(1, break_point_hit_count);
-  foo->Call(env.context(), env->Global(), 0, nullptr).ToLocalChecked();
+  foo->Call(env.local(), env->Global(), 0, nullptr).ToLocalChecked();
   CHECK_EQ(2, break_point_hit_count);
 
   // Run without breakpoints.
   ClearBreakPoint(bp);
-  foo->Call(env.context(), env->Global(), 0, nullptr).ToLocalChecked();
+  foo->Call(env.local(), env->Global(), 0, nullptr).ToLocalChecked();
   CHECK_EQ(2, break_point_hit_count);
 
-  SetDebugEventListener(env->GetIsolate(), nullptr);
+  v8::debug::SetDebugDelegate(env->GetIsolate(), nullptr);
   CheckDebuggerUnloaded();
 }
 
 // Test that a break point can be set at an IC store location.
 TEST(BreakPointCondition) {
   break_point_hit_count = 0;
-  DebugLocalContext env;
+  LocalContext env;
   v8::HandleScope scope(env->GetIsolate());
 
-  SetDebugEventListener(env->GetIsolate(), DebugEventBreakPointHitCount);
+  DebugEventCounter delegate;
+  v8::debug::SetDebugDelegate(env->GetIsolate(), &delegate);
   CompileRun("var a = false");
   v8::Local<v8::Function> foo =
       CompileFunction(&env, "function foo() { return 1 }", "foo");
@@ -855,38 +395,39 @@ TEST(BreakPointCondition) {
   CompileRun("foo()");
   CHECK_EQ(1, break_point_hit_count);
 
-  SetDebugEventListener(env->GetIsolate(), nullptr);
+  v8::debug::SetDebugDelegate(env->GetIsolate(), nullptr);
   CheckDebuggerUnloaded();
 }
 
 // Test that a break point can be set at an IC load location.
 TEST(BreakPointICLoad) {
   break_point_hit_count = 0;
-  DebugLocalContext env;
+  LocalContext env;
   v8::HandleScope scope(env->GetIsolate());
-  SetDebugEventListener(env->GetIsolate(), DebugEventBreakPointHitCount);
+  DebugEventCounter delegate;
+  v8::debug::SetDebugDelegate(env->GetIsolate(), &delegate);
 
   CompileRunChecked(env->GetIsolate(), "bar=1");
   v8::Local<v8::Function> foo =
       CompileFunction(&env, "function foo(){var x=bar;}", "foo");
 
   // Run without breakpoints.
-  foo->Call(env.context(), env->Global(), 0, nullptr).ToLocalChecked();
+  foo->Call(env.local(), env->Global(), 0, nullptr).ToLocalChecked();
   CHECK_EQ(0, break_point_hit_count);
 
   // Run with breakpoint.
   i::Handle<i::BreakPoint> bp = SetBreakPoint(foo, 0);
-  foo->Call(env.context(), env->Global(), 0, nullptr).ToLocalChecked();
+  foo->Call(env.local(), env->Global(), 0, nullptr).ToLocalChecked();
   CHECK_EQ(1, break_point_hit_count);
-  foo->Call(env.context(), env->Global(), 0, nullptr).ToLocalChecked();
+  foo->Call(env.local(), env->Global(), 0, nullptr).ToLocalChecked();
   CHECK_EQ(2, break_point_hit_count);
 
   // Run without breakpoints.
   ClearBreakPoint(bp);
-  foo->Call(env.context(), env->Global(), 0, nullptr).ToLocalChecked();
+  foo->Call(env.local(), env->Global(), 0, nullptr).ToLocalChecked();
   CHECK_EQ(2, break_point_hit_count);
 
-  SetDebugEventListener(env->GetIsolate(), nullptr);
+  v8::debug::SetDebugDelegate(env->GetIsolate(), nullptr);
   CheckDebuggerUnloaded();
 }
 
@@ -894,30 +435,31 @@ TEST(BreakPointICLoad) {
 // Test that a break point can be set at an IC call location.
 TEST(BreakPointICCall) {
   break_point_hit_count = 0;
-  DebugLocalContext env;
+  LocalContext env;
   v8::HandleScope scope(env->GetIsolate());
-  SetDebugEventListener(env->GetIsolate(), DebugEventBreakPointHitCount);
+  DebugEventCounter delegate;
+  v8::debug::SetDebugDelegate(env->GetIsolate(), &delegate);
   CompileRunChecked(env->GetIsolate(), "function bar(){}");
   v8::Local<v8::Function> foo =
       CompileFunction(&env, "function foo(){bar();}", "foo");
 
   // Run without breakpoints.
-  foo->Call(env.context(), env->Global(), 0, nullptr).ToLocalChecked();
+  foo->Call(env.local(), env->Global(), 0, nullptr).ToLocalChecked();
   CHECK_EQ(0, break_point_hit_count);
 
   // Run with breakpoint
   i::Handle<i::BreakPoint> bp = SetBreakPoint(foo, 0);
-  foo->Call(env.context(), env->Global(), 0, nullptr).ToLocalChecked();
+  foo->Call(env.local(), env->Global(), 0, nullptr).ToLocalChecked();
   CHECK_EQ(1, break_point_hit_count);
-  foo->Call(env.context(), env->Global(), 0, nullptr).ToLocalChecked();
+  foo->Call(env.local(), env->Global(), 0, nullptr).ToLocalChecked();
   CHECK_EQ(2, break_point_hit_count);
 
   // Run without breakpoints.
   ClearBreakPoint(bp);
-  foo->Call(env.context(), env->Global(), 0, nullptr).ToLocalChecked();
+  foo->Call(env.local(), env->Global(), 0, nullptr).ToLocalChecked();
   CHECK_EQ(2, break_point_hit_count);
 
-  SetDebugEventListener(env->GetIsolate(), nullptr);
+  v8::debug::SetDebugDelegate(env->GetIsolate(), nullptr);
   CheckDebuggerUnloaded();
 }
 
@@ -925,13 +467,14 @@ TEST(BreakPointICCall) {
 // Test that a break point can be set at an IC call location and survive a GC.
 TEST(BreakPointICCallWithGC) {
   break_point_hit_count = 0;
-  DebugLocalContext env;
+  LocalContext env;
   v8::HandleScope scope(env->GetIsolate());
-  SetDebugEventListener(env->GetIsolate(), DebugEventBreakPointCollectGarbage);
+  DebugEventBreakPointCollectGarbage delegate;
+  v8::debug::SetDebugDelegate(env->GetIsolate(), &delegate);
   CompileRunChecked(env->GetIsolate(), "function bar(){return 1;}");
   v8::Local<v8::Function> foo =
       CompileFunction(&env, "function foo(){return bar();}", "foo");
-  v8::Local<v8::Context> context = env.context();
+  v8::Local<v8::Context> context = env.local();
 
   // Run without breakpoints.
   CHECK_EQ(1, foo->Call(context, env->Global(), 0, nullptr)
@@ -958,7 +501,7 @@ TEST(BreakPointICCallWithGC) {
   foo->Call(context, env->Global(), 0, nullptr).ToLocalChecked();
   CHECK_EQ(2, break_point_hit_count);
 
-  SetDebugEventListener(env->GetIsolate(), nullptr);
+  v8::debug::SetDebugDelegate(env->GetIsolate(), nullptr);
   CheckDebuggerUnloaded();
 }
 
@@ -966,13 +509,14 @@ TEST(BreakPointICCallWithGC) {
 // Test that a break point can be set at an IC call location and survive a GC.
 TEST(BreakPointConstructCallWithGC) {
   break_point_hit_count = 0;
-  DebugLocalContext env;
+  LocalContext env;
   v8::HandleScope scope(env->GetIsolate());
-  SetDebugEventListener(env->GetIsolate(), DebugEventBreakPointCollectGarbage);
+  DebugEventBreakPointCollectGarbage delegate;
+  v8::debug::SetDebugDelegate(env->GetIsolate(), &delegate);
   CompileRunChecked(env->GetIsolate(), "function bar(){ this.x = 1;}");
   v8::Local<v8::Function> foo =
       CompileFunction(&env, "function foo(){return new bar(1).x;}", "foo");
-  v8::Local<v8::Context> context = env.context();
+  v8::Local<v8::Context> context = env.local();
 
   // Run without breakpoints.
   CHECK_EQ(1, foo->Call(context, env->Global(), 0, nullptr)
@@ -999,60 +543,17 @@ TEST(BreakPointConstructCallWithGC) {
   foo->Call(context, env->Global(), 0, nullptr).ToLocalChecked();
   CHECK_EQ(2, break_point_hit_count);
 
-  SetDebugEventListener(env->GetIsolate(), nullptr);
+  v8::debug::SetDebugDelegate(env->GetIsolate(), nullptr);
   CheckDebuggerUnloaded();
 }
 
 
-// Test that a break point can be set at a return store location.
-TEST(BreakPointReturn) {
-  break_point_hit_count = 0;
-  DebugLocalContext env;
-  v8::HandleScope scope(env->GetIsolate());
-
-  // Create a functions for checking the source line and column when hitting
-  // a break point.
-  frame_source_line = CompileFunction(&env,
-                                      frame_source_line_source,
-                                      "frame_source_line");
-  frame_source_column = CompileFunction(&env,
-                                        frame_source_column_source,
-                                        "frame_source_column");
-
-  SetDebugEventListener(env->GetIsolate(), DebugEventBreakPointHitCount);
-  v8::Local<v8::Function> foo =
-      CompileFunction(&env, "function foo(){}", "foo");
-  v8::Local<v8::Context> context = env.context();
-
-  // Run without breakpoints.
-  foo->Call(context, env->Global(), 0, nullptr).ToLocalChecked();
-  CHECK_EQ(0, break_point_hit_count);
-
-  // Run with breakpoint
-  i::Handle<i::BreakPoint> bp = SetBreakPoint(foo, 0);
-  foo->Call(context, env->Global(), 0, nullptr).ToLocalChecked();
-  CHECK_EQ(1, break_point_hit_count);
-  CHECK_EQ(0, last_source_line);
-  CHECK_EQ(15, last_source_column);
-  foo->Call(context, env->Global(), 0, nullptr).ToLocalChecked();
-  CHECK_EQ(2, break_point_hit_count);
-  CHECK_EQ(0, last_source_line);
-  CHECK_EQ(15, last_source_column);
-
-  // Run without breakpoints.
-  ClearBreakPoint(bp);
-  foo->Call(context, env->Global(), 0, nullptr).ToLocalChecked();
-  CHECK_EQ(2, break_point_hit_count);
-
-  SetDebugEventListener(env->GetIsolate(), nullptr);
-  CheckDebuggerUnloaded();
-}
-
 TEST(BreakPointBuiltin) {
-  DebugLocalContext env;
+  LocalContext env;
   v8::HandleScope scope(env->GetIsolate());
 
-  SetDebugEventListener(env->GetIsolate(), DebugEventBreakPointHitCount);
+  DebugEventCounter delegate;
+  v8::debug::SetDebugDelegate(env->GetIsolate(), &delegate);
 
   v8::Local<v8::Function> builtin;
   i::Handle<i::BreakPoint> bp;
@@ -1074,15 +575,16 @@ TEST(BreakPointBuiltin) {
   ExpectString("'b'.repeat(10)", "bbbbbbbbbb");
   CHECK_EQ(2, break_point_hit_count);
 
-  SetDebugEventListener(env->GetIsolate(), nullptr);
+  v8::debug::SetDebugDelegate(env->GetIsolate(), nullptr);
   CheckDebuggerUnloaded();
 }
 
 TEST(BreakPointJSBuiltin) {
-  DebugLocalContext env;
+  LocalContext env;
   v8::HandleScope scope(env->GetIsolate());
 
-  SetDebugEventListener(env->GetIsolate(), DebugEventBreakPointHitCount);
+  DebugEventCounter delegate;
+  v8::debug::SetDebugDelegate(env->GetIsolate(), &delegate);
 
   v8::Local<v8::Function> builtin;
   i::Handle<i::BreakPoint> bp;
@@ -1104,15 +606,16 @@ TEST(BreakPointJSBuiltin) {
   CompileRun("[1,2,3].sort()");
   CHECK_EQ(2, break_point_hit_count);
 
-  SetDebugEventListener(env->GetIsolate(), nullptr);
+  v8::debug::SetDebugDelegate(env->GetIsolate(), nullptr);
   CheckDebuggerUnloaded();
 }
 
 TEST(BreakPointBoundBuiltin) {
-  DebugLocalContext env;
+  LocalContext env;
   v8::HandleScope scope(env->GetIsolate());
 
-  SetDebugEventListener(env->GetIsolate(), DebugEventBreakPointHitCount);
+  DebugEventCounter delegate;
+  v8::debug::SetDebugDelegate(env->GetIsolate(), &delegate);
 
   v8::Local<v8::Function> builtin;
   i::Handle<i::BreakPoint> bp;
@@ -1136,15 +639,16 @@ TEST(BreakPointBoundBuiltin) {
   ExpectString("boundrepeat(10)", "aaaaaaaaaa");
   CHECK_EQ(1, break_point_hit_count);
 
-  SetDebugEventListener(env->GetIsolate(), nullptr);
+  v8::debug::SetDebugDelegate(env->GetIsolate(), nullptr);
   CheckDebuggerUnloaded();
 }
 
 TEST(BreakPointConstructorBuiltin) {
-  DebugLocalContext env;
+  LocalContext env;
   v8::HandleScope scope(env->GetIsolate());
 
-  SetDebugEventListener(env->GetIsolate(), DebugEventBreakPointHitCount);
+  DebugEventCounter delegate;
+  v8::debug::SetDebugDelegate(env->GetIsolate(), &delegate);
 
   v8::Local<v8::Function> builtin;
   i::Handle<i::BreakPoint> bp;
@@ -1197,16 +701,17 @@ TEST(BreakPointConstructorBuiltin) {
   CompileRun("new Number()");
   CHECK_EQ(1, break_point_hit_count);
 
-  SetDebugEventListener(env->GetIsolate(), nullptr);
+  v8::debug::SetDebugDelegate(env->GetIsolate(), nullptr);
   CheckDebuggerUnloaded();
 }
 
 TEST(BreakPointInlinedBuiltin) {
   i::FLAG_allow_natives_syntax = true;
-  DebugLocalContext env;
+  LocalContext env;
   v8::HandleScope scope(env->GetIsolate());
 
-  SetDebugEventListener(env->GetIsolate(), DebugEventBreakPointHitCount);
+  DebugEventCounter delegate;
+  v8::debug::SetDebugDelegate(env->GetIsolate(), &delegate);
 
   v8::Local<v8::Function> builtin;
   i::Handle<i::BreakPoint> bp;
@@ -1237,16 +742,17 @@ TEST(BreakPointInlinedBuiltin) {
   CompileRun("test(0.3);");
   CHECK_EQ(3, break_point_hit_count);
 
-  SetDebugEventListener(env->GetIsolate(), nullptr);
+  v8::debug::SetDebugDelegate(env->GetIsolate(), nullptr);
   CheckDebuggerUnloaded();
 }
 
 TEST(BreakPointInlineBoundBuiltin) {
   i::FLAG_allow_natives_syntax = true;
-  DebugLocalContext env;
+  LocalContext env;
   v8::HandleScope scope(env->GetIsolate());
 
-  SetDebugEventListener(env->GetIsolate(), DebugEventBreakPointHitCount);
+  DebugEventCounter delegate;
+  v8::debug::SetDebugDelegate(env->GetIsolate(), &delegate);
 
   v8::Local<v8::Function> builtin;
   i::Handle<i::BreakPoint> bp;
@@ -1281,17 +787,18 @@ TEST(BreakPointInlineBoundBuiltin) {
   CompileRun("test(9);");
   CHECK_EQ(3, break_point_hit_count);
 
-  SetDebugEventListener(env->GetIsolate(), nullptr);
+  v8::debug::SetDebugDelegate(env->GetIsolate(), nullptr);
   CheckDebuggerUnloaded();
 }
 
 TEST(BreakPointInlinedConstructorBuiltin) {
   i::FLAG_allow_natives_syntax = true;
   i::FLAG_experimental_inline_promise_constructor = true;
-  DebugLocalContext env;
+  LocalContext env;
   v8::HandleScope scope(env->GetIsolate());
 
-  SetDebugEventListener(env->GetIsolate(), DebugEventBreakPointHitCount);
+  DebugEventCounter delegate;
+  v8::debug::SetDebugDelegate(env->GetIsolate(), &delegate);
 
   v8::Local<v8::Function> builtin;
   i::Handle<i::BreakPoint> bp;
@@ -1322,17 +829,18 @@ TEST(BreakPointInlinedConstructorBuiltin) {
   CompileRun("test(9);");
   CHECK_EQ(3, break_point_hit_count);
 
-  SetDebugEventListener(env->GetIsolate(), nullptr);
+  v8::debug::SetDebugDelegate(env->GetIsolate(), nullptr);
   CheckDebuggerUnloaded();
 }
 
 TEST(BreakPointBuiltinConcurrentOpt) {
   i::FLAG_allow_natives_syntax = true;
   i::FLAG_block_concurrent_recompilation = true;
-  DebugLocalContext env;
+  LocalContext env;
   v8::HandleScope scope(env->GetIsolate());
 
-  SetDebugEventListener(env->GetIsolate(), DebugEventBreakPointHitCount);
+  DebugEventCounter delegate;
+  v8::debug::SetDebugDelegate(env->GetIsolate(), &delegate);
 
   v8::Local<v8::Function> builtin;
   i::Handle<i::BreakPoint> bp;
@@ -1361,16 +869,17 @@ TEST(BreakPointBuiltinConcurrentOpt) {
   CompileRun("test(0.3);");
   CHECK_EQ(1, break_point_hit_count);
 
-  SetDebugEventListener(env->GetIsolate(), nullptr);
+  v8::debug::SetDebugDelegate(env->GetIsolate(), nullptr);
   CheckDebuggerUnloaded();
 }
 
 TEST(BreakPointBuiltinTFOperator) {
   i::FLAG_allow_natives_syntax = true;
-  DebugLocalContext env;
+  LocalContext env;
   v8::HandleScope scope(env->GetIsolate());
 
-  SetDebugEventListener(env->GetIsolate(), DebugEventBreakPointHitCount);
+  DebugEventCounter delegate;
+  v8::debug::SetDebugDelegate(env->GetIsolate(), &delegate);
 
   v8::Local<v8::Function> builtin;
   i::Handle<i::BreakPoint> bp;
@@ -1401,15 +910,16 @@ TEST(BreakPointBuiltinTFOperator) {
   CompileRun("test('f');");
   CHECK_EQ(3, break_point_hit_count);
 
-  SetDebugEventListener(env->GetIsolate(), nullptr);
+  v8::debug::SetDebugDelegate(env->GetIsolate(), nullptr);
   CheckDebuggerUnloaded();
 }
 
 TEST(BreakPointBuiltinNewContext) {
-  DebugLocalContext env;
+  LocalContext env;
   v8::HandleScope scope(env->GetIsolate());
 
-  SetDebugEventListener(env->GetIsolate(), DebugEventBreakPointHitCount);
+  DebugEventCounter delegate;
+  v8::debug::SetDebugDelegate(env->GetIsolate(), &delegate);
 
   v8::Local<v8::Function> builtin;
   i::Handle<i::BreakPoint> bp;
@@ -1444,7 +954,7 @@ TEST(BreakPointBuiltinNewContext) {
   }
 #endif
 
-  SetDebugEventListener(env->GetIsolate(), nullptr);
+  v8::debug::SetDebugDelegate(env->GetIsolate(), nullptr);
   CheckDebuggerUnloaded();
 }
 
@@ -1453,10 +963,11 @@ void NoOpFunctionCallback(const v8::FunctionCallbackInfo<v8::Value>& args) {
 }
 
 TEST(BreakPointApiFunction) {
-  DebugLocalContext env;
+  LocalContext env;
   v8::HandleScope scope(env->GetIsolate());
 
-  SetDebugEventListener(env->GetIsolate(), DebugEventBreakPointHitCount);
+  DebugEventCounter delegate;
+  v8::debug::SetDebugDelegate(env->GetIsolate(), &delegate);
 
   i::Handle<i::BreakPoint> bp;
 
@@ -1464,9 +975,9 @@ TEST(BreakPointApiFunction) {
       v8::FunctionTemplate::New(env->GetIsolate(), NoOpFunctionCallback);
 
   v8::Local<v8::Function> function =
-      function_template->GetFunction(env.context()).ToLocalChecked();
+      function_template->GetFunction(env.local()).ToLocalChecked();
 
-  env->Global()->Set(env.context(), v8_str("f"), function).ToChecked();
+  env->Global()->Set(env.local(), v8_str("f"), function).ToChecked();
 
   // === Test simple builtin ===
   break_point_hit_count = 0;
@@ -1484,7 +995,7 @@ TEST(BreakPointApiFunction) {
   ExpectInt32("f()", 2);
   CHECK_EQ(2, break_point_hit_count);
 
-  SetDebugEventListener(env->GetIsolate(), nullptr);
+  v8::debug::SetDebugDelegate(env->GetIsolate(), nullptr);
   CheckDebuggerUnloaded();
 }
 
@@ -1497,10 +1008,11 @@ void GetWrapperCallback(const v8::FunctionCallbackInfo<v8::Value>& args) {
 }
 
 TEST(BreakPointApiGetter) {
-  DebugLocalContext env;
+  LocalContext env;
   v8::HandleScope scope(env->GetIsolate());
 
-  SetDebugEventListener(env->GetIsolate(), DebugEventBreakPointHitCount);
+  DebugEventCounter delegate;
+  v8::debug::SetDebugDelegate(env->GetIsolate(), &delegate);
 
   i::Handle<i::BreakPoint> bp;
 
@@ -1510,12 +1022,12 @@ TEST(BreakPointApiGetter) {
       v8::FunctionTemplate::New(env->GetIsolate(), GetWrapperCallback);
 
   v8::Local<v8::Function> function =
-      function_template->GetFunction(env.context()).ToLocalChecked();
+      function_template->GetFunction(env.local()).ToLocalChecked();
   v8::Local<v8::Function> get =
-      get_template->GetFunction(env.context()).ToLocalChecked();
+      get_template->GetFunction(env.local()).ToLocalChecked();
 
-  env->Global()->Set(env.context(), v8_str("f"), function).ToChecked();
-  env->Global()->Set(env.context(), v8_str("get_wrapper"), get).ToChecked();
+  env->Global()->Set(env.local(), v8_str("f"), function).ToChecked();
+  env->Global()->Set(env.local(), v8_str("get_wrapper"), get).ToChecked();
   CompileRun(
       "var o = {};"
       "Object.defineProperty(o, 'f', { get: f, enumerable: true });");
@@ -1536,7 +1048,7 @@ TEST(BreakPointApiGetter) {
   CompileRun("get_wrapper(o, 'f', 2)");
   CHECK_EQ(2, break_point_hit_count);
 
-  SetDebugEventListener(env->GetIsolate(), nullptr);
+  v8::debug::SetDebugDelegate(env->GetIsolate(), nullptr);
   CheckDebuggerUnloaded();
 }
 
@@ -1548,10 +1060,11 @@ void SetWrapperCallback(const v8::FunctionCallbackInfo<v8::Value>& args) {
 }
 
 TEST(BreakPointApiSetter) {
-  DebugLocalContext env;
+  LocalContext env;
   v8::HandleScope scope(env->GetIsolate());
 
-  SetDebugEventListener(env->GetIsolate(), DebugEventBreakPointHitCount);
+  DebugEventCounter delegate;
+  v8::debug::SetDebugDelegate(env->GetIsolate(), &delegate);
 
   i::Handle<i::BreakPoint> bp;
 
@@ -1561,12 +1074,12 @@ TEST(BreakPointApiSetter) {
       v8::FunctionTemplate::New(env->GetIsolate(), SetWrapperCallback);
 
   v8::Local<v8::Function> function =
-      function_template->GetFunction(env.context()).ToLocalChecked();
+      function_template->GetFunction(env.local()).ToLocalChecked();
   v8::Local<v8::Function> set =
-      set_template->GetFunction(env.context()).ToLocalChecked();
+      set_template->GetFunction(env.local()).ToLocalChecked();
 
-  env->Global()->Set(env.context(), v8_str("f"), function).ToChecked();
-  env->Global()->Set(env.context(), v8_str("set_wrapper"), set).ToChecked();
+  env->Global()->Set(env.local(), v8_str("f"), function).ToChecked();
+  env->Global()->Set(env.local(), v8_str("set_wrapper"), set).ToChecked();
 
   CompileRun(
       "var o = {};"
@@ -1608,15 +1121,16 @@ TEST(BreakPointApiSetter) {
   CompileRun("set_wrapper(o, 'f', 2)");
   CHECK_EQ(2, break_point_hit_count);
 
-  SetDebugEventListener(env->GetIsolate(), nullptr);
+  v8::debug::SetDebugDelegate(env->GetIsolate(), nullptr);
   CheckDebuggerUnloaded();
 }
 
 TEST(BreakPointApiAccessor) {
-  DebugLocalContext env;
+  LocalContext env;
   v8::HandleScope scope(env->GetIsolate());
 
-  SetDebugEventListener(env->GetIsolate(), DebugEventBreakPointHitCount);
+  DebugEventCounter delegate;
+  v8::debug::SetDebugDelegate(env->GetIsolate(), &delegate);
 
   i::Handle<i::BreakPoint> bp;
 
@@ -1628,8 +1142,8 @@ TEST(BreakPointApiAccessor) {
   obj_template->SetAccessorProperty(v8_str("f"), accessor_template,
                                     accessor_template);
   v8::Local<v8::Object> obj =
-      obj_template->NewInstance(env.context()).ToLocalChecked();
-  env->Global()->Set(env.context(), v8_str("o"), obj).ToChecked();
+      obj_template->NewInstance(env.local()).ToLocalChecked();
+  env->Global()->Set(env.local(), v8_str("o"), obj).ToChecked();
 
   v8::Local<v8::Function> function =
       CompileRun("Object.getOwnPropertyDescriptor(o, 'f').set")
@@ -1670,16 +1184,17 @@ TEST(BreakPointApiAccessor) {
   CompileRun("o.f");
   CHECK_EQ(42, break_point_hit_count);
 
-  SetDebugEventListener(env->GetIsolate(), nullptr);
+  v8::debug::SetDebugDelegate(env->GetIsolate(), nullptr);
   CheckDebuggerUnloaded();
 }
 
 TEST(BreakPointInlineApiFunction) {
   i::FLAG_allow_natives_syntax = true;
-  DebugLocalContext env;
+  LocalContext env;
   v8::HandleScope scope(env->GetIsolate());
 
-  SetDebugEventListener(env->GetIsolate(), DebugEventBreakPointHitCount);
+  DebugEventCounter delegate;
+  v8::debug::SetDebugDelegate(env->GetIsolate(), &delegate);
 
   i::Handle<i::BreakPoint> bp;
 
@@ -1687,9 +1202,9 @@ TEST(BreakPointInlineApiFunction) {
       v8::FunctionTemplate::New(env->GetIsolate(), NoOpFunctionCallback);
 
   v8::Local<v8::Function> function =
-      function_template->GetFunction(env.context()).ToLocalChecked();
+      function_template->GetFunction(env.local()).ToLocalChecked();
 
-  env->Global()->Set(env.context(), v8_str("f"), function).ToChecked();
+  env->Global()->Set(env.local(), v8_str("f"), function).ToChecked();
   CompileRun("function g() { return 1 +  f(); }");
 
   // === Test simple builtin ===
@@ -1712,7 +1227,7 @@ TEST(BreakPointInlineApiFunction) {
   ExpectInt32("g()", 3);
   CHECK_EQ(3, break_point_hit_count);
 
-  SetDebugEventListener(env->GetIsolate(), nullptr);
+  v8::debug::SetDebugDelegate(env->GetIsolate(), nullptr);
   CheckDebuggerUnloaded();
 }
 
@@ -1720,10 +1235,11 @@ TEST(BreakPointInlineApiFunction) {
 TEST(BreakPointConditionBuiltin) {
   i::FLAG_allow_natives_syntax = true;
   i::FLAG_block_concurrent_recompilation = true;
-  DebugLocalContext env;
+  LocalContext env;
   v8::HandleScope scope(env->GetIsolate());
 
-  SetDebugEventListener(env->GetIsolate(), DebugEventBreakPointHitCount);
+  DebugEventCounter delegate;
+  v8::debug::SetDebugDelegate(env->GetIsolate(), &delegate);
   v8::Local<v8::Function> builtin;
   i::Handle<i::BreakPoint> bp;
 
@@ -1842,17 +1358,18 @@ TEST(BreakPointConditionBuiltin) {
   ExpectString("f('a')", "aaaaaaaaaa");
   CHECK_EQ(1, break_point_hit_count);
 
-  SetDebugEventListener(env->GetIsolate(), nullptr);
+  v8::debug::SetDebugDelegate(env->GetIsolate(), nullptr);
   CheckDebuggerUnloaded();
 }
 
 TEST(BreakPointInlining) {
   i::FLAG_allow_natives_syntax = true;
   break_point_hit_count = 0;
-  DebugLocalContext env;
+  LocalContext env;
   v8::HandleScope scope(env->GetIsolate());
 
-  SetDebugEventListener(env->GetIsolate(), DebugEventBreakPointHitCount);
+  DebugEventCounter delegate;
+  v8::debug::SetDebugDelegate(env->GetIsolate(), &delegate);
 
   break_point_hit_count = 0;
   v8::Local<v8::Function> inlinee =
@@ -1880,7 +1397,7 @@ TEST(BreakPointInlining) {
   CompileRun("test(0.3);");
   CHECK_EQ(3, break_point_hit_count);
 
-  SetDebugEventListener(env->GetIsolate(), nullptr);
+  v8::debug::SetDebugDelegate(env->GetIsolate(), nullptr);
   CheckDebuggerUnloaded();
 }
 
@@ -1899,11 +1416,12 @@ static void CallWithBreakPoints(v8::Local<v8::Context> context,
 // Test GC during break point processing.
 TEST(GCDuringBreakPointProcessing) {
   break_point_hit_count = 0;
-  DebugLocalContext env;
+  LocalContext env;
   v8::HandleScope scope(env->GetIsolate());
-  v8::Local<v8::Context> context = env.context();
+  v8::Local<v8::Context> context = env.local();
 
-  SetDebugEventListener(env->GetIsolate(), DebugEventBreakPointCollectGarbage);
+  DebugEventBreakPointCollectGarbage delegate;
+  v8::debug::SetDebugDelegate(env->GetIsolate(), &delegate);
   v8::Local<v8::Function> foo;
 
   // Test IC store break point with garbage collection.
@@ -1931,7 +1449,7 @@ TEST(GCDuringBreakPointProcessing) {
   SetBreakPoint(foo, 0);
   CallWithBreakPoints(context, env->Global(), foo, 1, 25);
 
-  SetDebugEventListener(env->GetIsolate(), nullptr);
+  v8::debug::SetDebugDelegate(env->GetIsolate(), nullptr);
   CheckDebuggerUnloaded();
 }
 
@@ -1963,11 +1481,12 @@ static void CallAndGC(v8::Local<v8::Context> context,
 // Test that a break point can be set at a return store location.
 TEST(BreakPointSurviveGC) {
   break_point_hit_count = 0;
-  DebugLocalContext env;
+  LocalContext env;
   v8::HandleScope scope(env->GetIsolate());
-  v8::Local<v8::Context> context = env.context();
+  v8::Local<v8::Context> context = env.local();
 
-  SetDebugEventListener(env->GetIsolate(), DebugEventBreakPointHitCount);
+  DebugEventCounter delegate;
+  v8::debug::SetDebugDelegate(env->GetIsolate(), &delegate);
   v8::Local<v8::Function> foo;
 
   // Test IC store break point with garbage collection.
@@ -2012,47 +1531,18 @@ TEST(BreakPointSurviveGC) {
   }
   CallAndGC(context, env->Global(), foo);
 
-  SetDebugEventListener(env->GetIsolate(), nullptr);
-  CheckDebuggerUnloaded();
-}
-
-
-
-// Test that it is possible to remove the last break point for a function
-// inside the break handling of that break point.
-TEST(RemoveBreakPointInBreak) {
-  DebugLocalContext env;
-  v8::HandleScope scope(env->GetIsolate());
-
-  v8::Local<v8::Context> context = env.context();
-  v8::Local<v8::Function> foo =
-      CompileFunction(&env, "function foo(){a=1;}", "foo");
-
-  // Register the debug event listener pasing the function
-  SetDebugEventListener(env->GetIsolate(), DebugEventRemoveBreakPoint, foo);
-
-  debug_event_remove_break_point = SetBreakPoint(foo, 0);
-
-  break_point_hit_count = 0;
-  foo->Call(context, env->Global(), 0, nullptr).ToLocalChecked();
-  CHECK_EQ(1, break_point_hit_count);
-
-  break_point_hit_count = 0;
-  foo->Call(context, env->Global(), 0, nullptr).ToLocalChecked();
-  CHECK_EQ(0, break_point_hit_count);
-
-  SetDebugEventListener(env->GetIsolate(), nullptr);
+  v8::debug::SetDebugDelegate(env->GetIsolate(), nullptr);
   CheckDebuggerUnloaded();
 }
 
-
 // Test that the debugger statement causes a break.
 TEST(DebuggerStatement) {
   break_point_hit_count = 0;
-  DebugLocalContext env;
+  LocalContext env;
   v8::HandleScope scope(env->GetIsolate());
-  SetDebugEventListener(env->GetIsolate(), DebugEventBreakPointHitCount);
-  v8::Local<v8::Context> context = env.context();
+  DebugEventCounter delegate;
+  v8::debug::SetDebugDelegate(env->GetIsolate(), &delegate);
+  v8::Local<v8::Context> context = env.local();
   v8::Script::Compile(context,
                       v8_str(env->GetIsolate(), "function bar(){debugger}"))
       .ToLocalChecked()
@@ -2080,7 +1570,7 @@ TEST(DebuggerStatement) {
   foo->Call(context, env->Global(), 0, nullptr).ToLocalChecked();
   CHECK_EQ(3, break_point_hit_count);
 
-  SetDebugEventListener(env->GetIsolate(), nullptr);
+  v8::debug::SetDebugDelegate(env->GetIsolate(), nullptr);
   CheckDebuggerUnloaded();
 }
 
@@ -2088,10 +1578,11 @@ TEST(DebuggerStatement) {
 // Test setting a breakpoint on the debugger statement.
 TEST(DebuggerStatementBreakpoint) {
     break_point_hit_count = 0;
-    DebugLocalContext env;
+    LocalContext env;
     v8::HandleScope scope(env->GetIsolate());
-    v8::Local<v8::Context> context = env.context();
-    SetDebugEventListener(env->GetIsolate(), DebugEventBreakPointHitCount);
+    v8::Local<v8::Context> context = env.local();
+    DebugEventCounter delegate;
+    v8::debug::SetDebugDelegate(env->GetIsolate(), &delegate);
     v8::Script::Compile(context,
                         v8_str(env->GetIsolate(), "function foo(){debugger;}"))
         .ToLocalChecked()
@@ -2113,166 +1604,21 @@ TEST(DebuggerStatementBreakpoint) {
     CHECK_EQ(2, break_point_hit_count);
 
     ClearBreakPoint(bp);
-    SetDebugEventListener(env->GetIsolate(), nullptr);
+    v8::debug::SetDebugDelegate(env->GetIsolate(), nullptr);
     CheckDebuggerUnloaded();
 }
 
 
-// Test that the evaluation of expressions when a break point is hit generates
-// the correct results.
-TEST(DebugEvaluate) {
-  DebugLocalContext env;
-  v8::Isolate* isolate = env->GetIsolate();
-  v8::HandleScope scope(isolate);
-  env.ExposeDebug();
-
-  // Create a function for checking the evaluation when hitting a break point.
-  evaluate_check_function = CompileFunction(&env,
-                                            evaluate_check_source,
-                                            "evaluate_check");
-  // Register the debug event listener
-  SetDebugEventListener(isolate, DebugEventEvaluate);
-
-  // Different expected vaules of x and a when in a break point (u = undefined,
-  // d = Hello, world!).
-  struct EvaluateCheck checks_uu[] = {{"x", v8::Undefined(isolate)},
-                                      {"a", v8::Undefined(isolate)},
-                                      {nullptr, v8::Local<v8::Value>()}};
-  struct EvaluateCheck checks_hu[] = {
-      {"x", v8_str(env->GetIsolate(), "Hello, world!")},
-      {"a", v8::Undefined(isolate)},
-      {nullptr, v8::Local<v8::Value>()}};
-  struct EvaluateCheck checks_hh[] = {
-      {"x", v8_str(env->GetIsolate(), "Hello, world!")},
-      {"a", v8_str(env->GetIsolate(), "Hello, world!")},
-      {nullptr, v8::Local<v8::Value>()}};
-
-  // Simple test function. The "y=0" is in the function foo to provide a break
-  // location. For "y=0" the "y" is at position 15 in the foo function
-  // therefore setting breakpoint at position 15 will break at "y=0" and
-  // setting it higher will break after.
-  v8::Local<v8::Function> foo = CompileFunction(&env,
-    "function foo(x) {"
-    "  var a;"
-    "  y=0;"  // To ensure break location 1.
-    "  a=x;"
-    "  y=0;"  // To ensure break location 2.
-    "}",
-    "foo");
-  const int foo_break_position_1 = 15;
-  const int foo_break_position_2 = 29;
-
-  v8::Local<v8::Context> context = env.context();
-  // Arguments with one parameter "Hello, world!"
-  v8::Local<v8::Value> argv_foo[1] = {
-      v8_str(env->GetIsolate(), "Hello, world!")};
-
-  // Call foo with breakpoint set before a=x and undefined as parameter.
-  i::Handle<i::BreakPoint> bp = SetBreakPoint(foo, foo_break_position_1);
-  checks = checks_uu;
-  foo->Call(context, env->Global(), 0, nullptr).ToLocalChecked();
-
-  // Call foo with breakpoint set before a=x and parameter "Hello, world!".
-  checks = checks_hu;
-  foo->Call(context, env->Global(), 1, argv_foo).ToLocalChecked();
-
-  // Call foo with breakpoint set after a=x and parameter "Hello, world!".
-  ClearBreakPoint(bp);
-  SetBreakPoint(foo, foo_break_position_2);
-  checks = checks_hh;
-  foo->Call(context, env->Global(), 1, argv_foo).ToLocalChecked();
-
-  // Test that overriding Object.prototype will not interfere into evaluation
-  // on call frame.
-  v8::Local<v8::Function> zoo =
-      CompileFunction(&env,
-                      "x = undefined;"
-                      "function zoo(t) {"
-                      "  var a=x;"
-                      "  Object.prototype.x = 42;"
-                      "  x=t;"
-                      "  y=0;"  // To ensure break location.
-                      "  delete Object.prototype.x;"
-                      "  x=a;"
-                      "}",
-                      "zoo");
-  const int zoo_break_position = 50;
-
-  // Arguments with one parameter "Hello, world!"
-  v8::Local<v8::Value> argv_zoo[1] = {
-      v8_str(env->GetIsolate(), "Hello, world!")};
-
-  // Call zoo with breakpoint set at y=0.
-  DebugEventCounterClear();
-  bp = SetBreakPoint(zoo, zoo_break_position);
-  checks = checks_hu;
-  zoo->Call(context, env->Global(), 1, argv_zoo).ToLocalChecked();
-  CHECK_EQ(1, break_point_hit_count);
-  ClearBreakPoint(bp);
-
-  // Test function with an inner function. The "y=0" is in function barbar
-  // to provide a break location. For "y=0" the "y" is at position 8 in the
-  // barbar function therefore setting breakpoint at position 8 will break at
-  // "y=0" and setting it higher will break after.
-  v8::Local<v8::Function> bar = CompileFunction(&env,
-    "y = 0;"
-    "x = 'Goodbye, world!';"
-    "function bar(x, b) {"
-    "  var a;"
-    "  function barbar() {"
-    "    y=0; /* To ensure break location.*/"
-    "    a=x;"
-    "  };"
-    "  barbar();"
-    "  y=0;a=x;"
-    "}",
-    "bar");
-  const int barbar_break_position = 8;
-
-  // Call bar setting breakpoint before a=x in barbar and undefined as
-  // parameter.
-  checks = checks_uu;
-  v8::Local<v8::Value> argv_bar_1[2] = {
-      v8::Undefined(isolate), v8::Number::New(isolate, barbar_break_position)};
-  bar->Call(context, env->Global(), 2, argv_bar_1).ToLocalChecked();
-
-  // Call bar setting breakpoint before a=x in barbar and parameter
-  // "Hello, world!".
-  checks = checks_hu;
-  v8::Local<v8::Value> argv_bar_2[2] = {
-      v8_str(env->GetIsolate(), "Hello, world!"),
-      v8::Number::New(env->GetIsolate(), barbar_break_position)};
-  bar->Call(context, env->Global(), 2, argv_bar_2).ToLocalChecked();
-
-  // Call bar setting breakpoint after a=x in barbar and parameter
-  // "Hello, world!".
-  checks = checks_hh;
-  v8::Local<v8::Value> argv_bar_3[2] = {
-      v8_str(env->GetIsolate(), "Hello, world!"),
-      v8::Number::New(env->GetIsolate(), barbar_break_position + 1)};
-  bar->Call(context, env->Global(), 2, argv_bar_3).ToLocalChecked();
-
-  SetDebugEventListener(isolate, nullptr);
-  CheckDebuggerUnloaded();
-}
-
-
-int debugEventCount = 0;
-static void CheckDebugEvent(const v8::Debug::EventDetails& eventDetails) {
-  if (eventDetails.GetEvent() == v8::Break) ++debugEventCount;
-}
-
-
 // Test that the conditional breakpoints work event if code generation from
 // strings is prohibited in the debugee context.
 TEST(ConditionalBreakpointWithCodeGenerationDisallowed) {
-  DebugLocalContext env;
+  LocalContext env;
   v8::HandleScope scope(env->GetIsolate());
-  env.ExposeDebug();
 
-  SetDebugEventListener(env->GetIsolate(), CheckDebugEvent);
+  DebugEventCounter delegate;
+  v8::debug::SetDebugDelegate(env->GetIsolate(), &delegate);
 
-  v8::Local<v8::Context> context = env.context();
+  v8::Local<v8::Context> context = env.local();
   v8::Local<v8::Function> foo = CompileFunction(&env,
     "function foo(x) {\n"
     "  var s = 'String value2';\n"
@@ -2283,19 +1629,19 @@ TEST(ConditionalBreakpointWithCodeGenerationDisallowed) {
   // Set conditional breakpoint with condition 'true'.
   SetBreakPoint(foo, 4, "true");
 
-  debugEventCount = 0;
+  break_point_hit_count = 0;
   env->AllowCodeGenerationFromStrings(false);
   foo->Call(context, env->Global(), 0, nullptr).ToLocalChecked();
-  CHECK_EQ(1, debugEventCount);
+  CHECK_EQ(1, break_point_hit_count);
 
-  SetDebugEventListener(env->GetIsolate(), nullptr);
+  v8::debug::SetDebugDelegate(env->GetIsolate(), nullptr);
   CheckDebuggerUnloaded();
 }
 
 
 // Simple test of the stepping mechanism using only store ICs.
 TEST(DebugStepLinear) {
-  DebugLocalContext env;
+  LocalContext env;
   v8::HandleScope scope(env->GetIsolate());
 
   // Create a function for testing stepping.
@@ -2307,23 +1653,25 @@ TEST(DebugStepLinear) {
   CompileRun("a=0; b=0; c=0; foo();");
 
   // Register a debug event listener which steps and counts.
-  SetDebugEventListener(env->GetIsolate(), DebugEventStep);
+  DebugEventCounter run_step;
+  v8::debug::SetDebugDelegate(env->GetIsolate(), &run_step);
 
   SetBreakPoint(foo, 3);
 
-  step_action = StepIn;
+  run_step.set_step_action(StepIn);
   break_point_hit_count = 0;
-  v8::Local<v8::Context> context = env.context();
+  v8::Local<v8::Context> context = env.local();
   foo->Call(context, env->Global(), 0, nullptr).ToLocalChecked();
 
   // With stepping all break locations are hit.
   CHECK_EQ(4, break_point_hit_count);
 
-  SetDebugEventListener(env->GetIsolate(), nullptr);
+  v8::debug::SetDebugDelegate(env->GetIsolate(), nullptr);
   CheckDebuggerUnloaded();
 
   // Register a debug event listener which just counts.
-  SetDebugEventListener(env->GetIsolate(), DebugEventBreakPointHitCount);
+  DebugEventCounter delegate;
+  v8::debug::SetDebugDelegate(env->GetIsolate(), &delegate);
 
   SetBreakPoint(foo, 3);
   break_point_hit_count = 0;
@@ -2332,18 +1680,19 @@ TEST(DebugStepLinear) {
   // Without stepping only active break points are hit.
   CHECK_EQ(1, break_point_hit_count);
 
-  SetDebugEventListener(env->GetIsolate(), nullptr);
+  v8::debug::SetDebugDelegate(env->GetIsolate(), nullptr);
   CheckDebuggerUnloaded();
 }
 
 
 // Test of the stepping mechanism for keyed load in a loop.
 TEST(DebugStepKeyedLoadLoop) {
-  DebugLocalContext env;
+  LocalContext env;
   v8::HandleScope scope(env->GetIsolate());
 
   // Register a debug event listener which steps and counts.
-  SetDebugEventListener(env->GetIsolate(), DebugEventStep);
+  DebugEventCounter run_step;
+  v8::debug::SetDebugDelegate(env->GetIsolate(), &run_step);
 
   // Create a function for testing stepping of keyed load. The statement 'y=1'
   // is there to have more than one breakable statement in the loop, TODO(315).
@@ -2360,7 +1709,7 @@ TEST(DebugStepKeyedLoadLoop) {
       "y=0\n",
       "foo");
 
-  v8::Local<v8::Context> context = env.context();
+  v8::Local<v8::Context> context = env.local();
   // Create array [0,1,2,3,4,5,6,7,8,9]
   v8::Local<v8::Array> a = v8::Array::New(env->GetIsolate(), 10);
   for (int i = 0; i < 10; i++) {
@@ -2376,25 +1725,26 @@ TEST(DebugStepKeyedLoadLoop) {
 
   // Set up break point and step through the function.
   SetBreakPoint(foo, 3);
-  step_action = StepNext;
+  run_step.set_step_action(StepNext);
   break_point_hit_count = 0;
   foo->Call(context, env->Global(), kArgc, args).ToLocalChecked();
 
   // With stepping all break locations are hit.
   CHECK_EQ(44, break_point_hit_count);
 
-  SetDebugEventListener(env->GetIsolate(), nullptr);
+  v8::debug::SetDebugDelegate(env->GetIsolate(), nullptr);
   CheckDebuggerUnloaded();
 }
 
 
 // Test of the stepping mechanism for keyed store in a loop.
 TEST(DebugStepKeyedStoreLoop) {
-  DebugLocalContext env;
+  LocalContext env;
   v8::HandleScope scope(env->GetIsolate());
 
   // Register a debug event listener which steps and counts.
-  SetDebugEventListener(env->GetIsolate(), DebugEventStep);
+  DebugEventCounter run_step;
+  v8::debug::SetDebugDelegate(env->GetIsolate(), &run_step);
 
   // Create a function for testing stepping of keyed store. The statement 'y=1'
   // is there to have more than one breakable statement in the loop, TODO(315).
@@ -2410,7 +1760,7 @@ TEST(DebugStepKeyedStoreLoop) {
       "y=0\n",
       "foo");
 
-  v8::Local<v8::Context> context = env.context();
+  v8::Local<v8::Context> context = env.local();
   // Create array [0,1,2,3,4,5,6,7,8,9]
   v8::Local<v8::Array> a = v8::Array::New(env->GetIsolate(), 10);
   for (int i = 0; i < 10; i++) {
@@ -2426,27 +1776,28 @@ TEST(DebugStepKeyedStoreLoop) {
 
   // Set up break point and step through the function.
   SetBreakPoint(foo, 3);
-  step_action = StepNext;
+  run_step.set_step_action(StepNext);
   break_point_hit_count = 0;
   foo->Call(context, env->Global(), kArgc, args).ToLocalChecked();
 
   // With stepping all break locations are hit.
   CHECK_EQ(44, break_point_hit_count);
 
-  SetDebugEventListener(env->GetIsolate(), nullptr);
+  v8::debug::SetDebugDelegate(env->GetIsolate(), nullptr);
   CheckDebuggerUnloaded();
 }
 
 
 // Test of the stepping mechanism for named load in a loop.
 TEST(DebugStepNamedLoadLoop) {
-  DebugLocalContext env;
+  LocalContext env;
   v8::HandleScope scope(env->GetIsolate());
 
   // Register a debug event listener which steps and counts.
-  SetDebugEventListener(env->GetIsolate(), DebugEventStep);
+  DebugEventCounter run_step;
+  v8::debug::SetDebugDelegate(env->GetIsolate(), &run_step);
 
-  v8::Local<v8::Context> context = env.context();
+  v8::Local<v8::Context> context = env.local();
   // Create a function for testing stepping of named load.
   v8::Local<v8::Function> foo = CompileFunction(
       &env,
@@ -2471,27 +1822,28 @@ TEST(DebugStepNamedLoadLoop) {
 
   // Set up break point and step through the function.
   SetBreakPoint(foo, 4);
-  step_action = StepNext;
+  run_step.set_step_action(StepNext);
   break_point_hit_count = 0;
   foo->Call(context, env->Global(), 0, nullptr).ToLocalChecked();
 
   // With stepping all break locations are hit.
   CHECK_EQ(65, break_point_hit_count);
 
-  SetDebugEventListener(env->GetIsolate(), nullptr);
+  v8::debug::SetDebugDelegate(env->GetIsolate(), nullptr);
   CheckDebuggerUnloaded();
 }
 
 
 static void DoDebugStepNamedStoreLoop(int expected) {
-  DebugLocalContext env;
+  LocalContext env;
   v8::HandleScope scope(env->GetIsolate());
 
   // Register a debug event listener which steps and counts.
-  SetDebugEventListener(env->GetIsolate(), DebugEventStep);
+  DebugEventCounter run_step;
+  v8::debug::SetDebugDelegate(env->GetIsolate(), &run_step);
 
   // Create a function for testing stepping of named store.
-  v8::Local<v8::Context> context = env.context();
+  v8::Local<v8::Context> context = env.local();
   v8::Local<v8::Function> foo = CompileFunction(
       &env,
       "function foo() {\n"
@@ -2507,14 +1859,14 @@ static void DoDebugStepNamedStoreLoop(int expected) {
 
   // Set up break point and step through the function.
   SetBreakPoint(foo, 3);
-  step_action = StepNext;
+  run_step.set_step_action(StepNext);
   break_point_hit_count = 0;
   foo->Call(context, env->Global(), 0, nullptr).ToLocalChecked();
 
   // With stepping all expected break locations are hit.
   CHECK_EQ(expected, break_point_hit_count);
 
-  SetDebugEventListener(env->GetIsolate(), nullptr);
+  v8::debug::SetDebugDelegate(env->GetIsolate(), nullptr);
   CheckDebuggerUnloaded();
 }
 
@@ -2524,13 +1876,14 @@ TEST(DebugStepNamedStoreLoop) { DoDebugStepNamedStoreLoop(34); }
 
 // Test the stepping mechanism with different ICs.
 TEST(DebugStepLinearMixedICs) {
-  DebugLocalContext env;
+  LocalContext env;
   v8::HandleScope scope(env->GetIsolate());
 
   // Register a debug event listener which steps and counts.
-  SetDebugEventListener(env->GetIsolate(), DebugEventStep);
+  DebugEventCounter run_step;
+  v8::debug::SetDebugDelegate(env->GetIsolate(), &run_step);
 
-  v8::Local<v8::Context> context = env.context();
+  v8::Local<v8::Context> context = env.local();
   // Create a function for testing stepping.
   v8::Local<v8::Function> foo = CompileFunction(&env,
       "function bar() {};"
@@ -2545,18 +1898,19 @@ TEST(DebugStepLinearMixedICs) {
 
   SetBreakPoint(foo, 0);
 
-  step_action = StepIn;
+  run_step.set_step_action(StepIn);
   break_point_hit_count = 0;
   foo->Call(context, env->Global(), 0, nullptr).ToLocalChecked();
 
   // With stepping all break locations are hit.
   CHECK_EQ(10, break_point_hit_count);
 
-  SetDebugEventListener(env->GetIsolate(), nullptr);
+  v8::debug::SetDebugDelegate(env->GetIsolate(), nullptr);
   CheckDebuggerUnloaded();
 
   // Register a debug event listener which just counts.
-  SetDebugEventListener(env->GetIsolate(), DebugEventBreakPointHitCount);
+  DebugEventCounter delegate;
+  v8::debug::SetDebugDelegate(env->GetIsolate(), &delegate);
 
   SetBreakPoint(foo, 0);
   break_point_hit_count = 0;
@@ -2565,19 +1919,20 @@ TEST(DebugStepLinearMixedICs) {
   // Without stepping only active break points are hit.
   CHECK_EQ(1, break_point_hit_count);
 
-  SetDebugEventListener(env->GetIsolate(), nullptr);
+  v8::debug::SetDebugDelegate(env->GetIsolate(), nullptr);
   CheckDebuggerUnloaded();
 }
 
 
 TEST(DebugStepDeclarations) {
-  DebugLocalContext env;
+  LocalContext env;
   v8::HandleScope scope(env->GetIsolate());
 
   // Register a debug event listener which steps and counts.
-  SetDebugEventListener(env->GetIsolate(), DebugEventStep);
+  DebugEventCounter run_step;
+  v8::debug::SetDebugDelegate(env->GetIsolate(), &run_step);
 
-  v8::Local<v8::Context> context = env.context();
+  v8::Local<v8::Context> context = env.local();
   // Create a function for testing stepping. Run it to allow it to get
   // optimized.
   const char* src = "function foo() { "
@@ -2593,25 +1948,26 @@ TEST(DebugStepDeclarations) {
   SetBreakPoint(foo, 0);
 
   // Stepping through the declarations.
-  step_action = StepIn;
+  run_step.set_step_action(StepIn);
   break_point_hit_count = 0;
   foo->Call(context, env->Global(), 0, nullptr).ToLocalChecked();
   CHECK_EQ(5, break_point_hit_count);
 
   // Get rid of the debug event listener.
-  SetDebugEventListener(env->GetIsolate(), nullptr);
+  v8::debug::SetDebugDelegate(env->GetIsolate(), nullptr);
   CheckDebuggerUnloaded();
 }
 
 
 TEST(DebugStepLocals) {
-  DebugLocalContext env;
+  LocalContext env;
   v8::HandleScope scope(env->GetIsolate());
 
   // Register a debug event listener which steps and counts.
-  SetDebugEventListener(env->GetIsolate(), DebugEventStep);
+  DebugEventCounter run_step;
+  v8::debug::SetDebugDelegate(env->GetIsolate(), &run_step);
 
-  v8::Local<v8::Context> context = env.context();
+  v8::Local<v8::Context> context = env.local();
   // Create a function for testing stepping. Run it to allow it to get
   // optimized.
   const char* src = "function foo() { "
@@ -2627,26 +1983,27 @@ TEST(DebugStepLocals) {
   SetBreakPoint(foo, 0);
 
   // Stepping through the declarations.
-  step_action = StepIn;
+  run_step.set_step_action(StepIn);
   break_point_hit_count = 0;
   foo->Call(context, env->Global(), 0, nullptr).ToLocalChecked();
   CHECK_EQ(5, break_point_hit_count);
 
   // Get rid of the debug event listener.
-  SetDebugEventListener(env->GetIsolate(), nullptr);
+  v8::debug::SetDebugDelegate(env->GetIsolate(), nullptr);
   CheckDebuggerUnloaded();
 }
 
 
 TEST(DebugStepIf) {
-  DebugLocalContext env;
+  LocalContext env;
   v8::Isolate* isolate = env->GetIsolate();
   v8::HandleScope scope(isolate);
 
   // Register a debug event listener which steps and counts.
-  SetDebugEventListener(env->GetIsolate(), DebugEventStep);
+  DebugEventCounter run_step;
+  v8::debug::SetDebugDelegate(env->GetIsolate(), &run_step);
 
-  v8::Local<v8::Context> context = env.context();
+  v8::Local<v8::Context> context = env.local();
   // Create a function for testing stepping. Run it to allow it to get
   // optimized.
   const int argc = 1;
@@ -2664,34 +2021,35 @@ TEST(DebugStepIf) {
   SetBreakPoint(foo, 0);
 
   // Stepping through the true part.
-  step_action = StepIn;
+  run_step.set_step_action(StepIn);
   break_point_hit_count = 0;
   v8::Local<v8::Value> argv_true[argc] = {v8::True(isolate)};
   foo->Call(context, env->Global(), argc, argv_true).ToLocalChecked();
   CHECK_EQ(4, break_point_hit_count);
 
   // Stepping through the false part.
-  step_action = StepIn;
+  run_step.set_step_action(StepIn);
   break_point_hit_count = 0;
   v8::Local<v8::Value> argv_false[argc] = {v8::False(isolate)};
   foo->Call(context, env->Global(), argc, argv_false).ToLocalChecked();
   CHECK_EQ(5, break_point_hit_count);
 
   // Get rid of the debug event listener.
-  SetDebugEventListener(env->GetIsolate(), nullptr);
+  v8::debug::SetDebugDelegate(env->GetIsolate(), nullptr);
   CheckDebuggerUnloaded();
 }
 
 
 TEST(DebugStepSwitch) {
-  DebugLocalContext env;
+  LocalContext env;
   v8::Isolate* isolate = env->GetIsolate();
   v8::HandleScope scope(isolate);
 
   // Register a debug event listener which steps and counts.
-  SetDebugEventListener(isolate, DebugEventStep);
+  DebugEventCounter run_step;
+  v8::debug::SetDebugDelegate(env->GetIsolate(), &run_step);
 
-  v8::Local<v8::Context> context = env.context();
+  v8::Local<v8::Context> context = env.local();
   // Create a function for testing stepping. Run it to allow it to get
   // optimized.
   const int argc = 1;
@@ -2715,41 +2073,42 @@ TEST(DebugStepSwitch) {
   SetBreakPoint(foo, 0);
 
   // One case with fall-through.
-  step_action = StepIn;
+  run_step.set_step_action(StepIn);
   break_point_hit_count = 0;
   v8::Local<v8::Value> argv_1[argc] = {v8::Number::New(isolate, 1)};
   foo->Call(context, env->Global(), argc, argv_1).ToLocalChecked();
   CHECK_EQ(6, break_point_hit_count);
 
   // Another case.
-  step_action = StepIn;
+  run_step.set_step_action(StepIn);
   break_point_hit_count = 0;
   v8::Local<v8::Value> argv_2[argc] = {v8::Number::New(isolate, 2)};
   foo->Call(context, env->Global(), argc, argv_2).ToLocalChecked();
   CHECK_EQ(5, break_point_hit_count);
 
   // Last case.
-  step_action = StepIn;
+  run_step.set_step_action(StepIn);
   break_point_hit_count = 0;
   v8::Local<v8::Value> argv_3[argc] = {v8::Number::New(isolate, 3)};
   foo->Call(context, env->Global(), argc, argv_3).ToLocalChecked();
   CHECK_EQ(7, break_point_hit_count);
 
   // Get rid of the debug event listener.
-  SetDebugEventListener(isolate, nullptr);
+  v8::debug::SetDebugDelegate(env->GetIsolate(), nullptr);
   CheckDebuggerUnloaded();
 }
 
 
 TEST(DebugStepWhile) {
-  DebugLocalContext env;
+  LocalContext env;
   v8::Isolate* isolate = env->GetIsolate();
   v8::HandleScope scope(isolate);
 
   // Register a debug event listener which steps and counts.
-  SetDebugEventListener(isolate, DebugEventStep);
+  DebugEventCounter run_step;
+  v8::debug::SetDebugDelegate(env->GetIsolate(), &run_step);
 
-  v8::Local<v8::Context> context = env.context();
+  v8::Local<v8::Context> context = env.local();
   // Create a function for testing stepping. Run it to allow it to get
   // optimized.
   const int argc = 1;
@@ -2764,41 +2123,42 @@ TEST(DebugStepWhile) {
   SetBreakPoint(foo, 8);  // "var a = 0;"
 
   // Looping 0 times.  We still should break at the while-condition once.
-  step_action = StepIn;
+  run_step.set_step_action(StepIn);
   break_point_hit_count = 0;
   v8::Local<v8::Value> argv_0[argc] = {v8::Number::New(isolate, 0)};
   foo->Call(context, env->Global(), argc, argv_0).ToLocalChecked();
   CHECK_EQ(3, break_point_hit_count);
 
   // Looping 10 times.
-  step_action = StepIn;
+  run_step.set_step_action(StepIn);
   break_point_hit_count = 0;
   v8::Local<v8::Value> argv_10[argc] = {v8::Number::New(isolate, 10)};
   foo->Call(context, env->Global(), argc, argv_10).ToLocalChecked();
   CHECK_EQ(23, break_point_hit_count);
 
   // Looping 100 times.
-  step_action = StepIn;
+  run_step.set_step_action(StepIn);
   break_point_hit_count = 0;
   v8::Local<v8::Value> argv_100[argc] = {v8::Number::New(isolate, 100)};
   foo->Call(context, env->Global(), argc, argv_100).ToLocalChecked();
   CHECK_EQ(203, break_point_hit_count);
 
   // Get rid of the debug event listener.
-  SetDebugEventListener(isolate, nullptr);
+  v8::debug::SetDebugDelegate(env->GetIsolate(), nullptr);
   CheckDebuggerUnloaded();
 }
 
 
 TEST(DebugStepDoWhile) {
-  DebugLocalContext env;
+  LocalContext env;
   v8::Isolate* isolate = env->GetIsolate();
   v8::HandleScope scope(isolate);
 
   // Register a debug event listener which steps and counts.
-  SetDebugEventListener(isolate, DebugEventStep);
+  DebugEventCounter run_step;
+  v8::debug::SetDebugDelegate(env->GetIsolate(), &run_step);
 
-  v8::Local<v8::Context> context = env.context();
+  v8::Local<v8::Context> context = env.local();
   // Create a function for testing stepping. Run it to allow it to get
   // optimized.
   const int argc = 1;
@@ -2813,41 +2173,42 @@ TEST(DebugStepDoWhile) {
   SetBreakPoint(foo, 8);  // "var a = 0;"
 
   // Looping 0 times.
-  step_action = StepIn;
+  run_step.set_step_action(StepIn);
   break_point_hit_count = 0;
   v8::Local<v8::Value> argv_0[argc] = {v8::Number::New(isolate, 0)};
   foo->Call(context, env->Global(), argc, argv_0).ToLocalChecked();
   CHECK_EQ(4, break_point_hit_count);
 
   // Looping 10 times.
-  step_action = StepIn;
+  run_step.set_step_action(StepIn);
   break_point_hit_count = 0;
   v8::Local<v8::Value> argv_10[argc] = {v8::Number::New(isolate, 10)};
   foo->Call(context, env->Global(), argc, argv_10).ToLocalChecked();
   CHECK_EQ(22, break_point_hit_count);
 
   // Looping 100 times.
-  step_action = StepIn;
+  run_step.set_step_action(StepIn);
   break_point_hit_count = 0;
   v8::Local<v8::Value> argv_100[argc] = {v8::Number::New(isolate, 100)};
   foo->Call(context, env->Global(), argc, argv_100).ToLocalChecked();
   CHECK_EQ(202, break_point_hit_count);
 
   // Get rid of the debug event listener.
-  SetDebugEventListener(isolate, nullptr);
+  v8::debug::SetDebugDelegate(env->GetIsolate(), nullptr);
   CheckDebuggerUnloaded();
 }
 
 
 TEST(DebugStepFor) {
-  DebugLocalContext env;
+  LocalContext env;
   v8::Isolate* isolate = env->GetIsolate();
   v8::HandleScope scope(isolate);
 
   // Register a debug event listener which steps and counts.
-  SetDebugEventListener(isolate, DebugEventStep);
+  DebugEventCounter run_step;
+  v8::debug::SetDebugDelegate(env->GetIsolate(), &run_step);
 
-  v8::Local<v8::Context> context = env.context();
+  v8::Local<v8::Context> context = env.local();
   // Create a function for testing stepping. Run it to allow it to get
   // optimized.
   const int argc = 1;
@@ -2863,41 +2224,42 @@ TEST(DebugStepFor) {
   SetBreakPoint(foo, 8);  // "a = 1;"
 
   // Looping 0 times.
-  step_action = StepIn;
+  run_step.set_step_action(StepIn);
   break_point_hit_count = 0;
   v8::Local<v8::Value> argv_0[argc] = {v8::Number::New(isolate, 0)};
   foo->Call(context, env->Global(), argc, argv_0).ToLocalChecked();
   CHECK_EQ(4, break_point_hit_count);
 
   // Looping 10 times.
-  step_action = StepIn;
+  run_step.set_step_action(StepIn);
   break_point_hit_count = 0;
   v8::Local<v8::Value> argv_10[argc] = {v8::Number::New(isolate, 10)};
   foo->Call(context, env->Global(), argc, argv_10).ToLocalChecked();
   CHECK_EQ(34, break_point_hit_count);
 
   // Looping 100 times.
-  step_action = StepIn;
+  run_step.set_step_action(StepIn);
   break_point_hit_count = 0;
   v8::Local<v8::Value> argv_100[argc] = {v8::Number::New(isolate, 100)};
   foo->Call(context, env->Global(), argc, argv_100).ToLocalChecked();
   CHECK_EQ(304, break_point_hit_count);
 
   // Get rid of the debug event listener.
-  SetDebugEventListener(isolate, nullptr);
+  v8::debug::SetDebugDelegate(env->GetIsolate(), nullptr);
   CheckDebuggerUnloaded();
 }
 
 
 TEST(DebugStepForContinue) {
-  DebugLocalContext env;
+  LocalContext env;
   v8::Isolate* isolate = env->GetIsolate();
   v8::HandleScope scope(isolate);
 
   // Register a debug event listener which steps and counts.
-  SetDebugEventListener(isolate, DebugEventStep);
+  DebugEventCounter run_step;
+  v8::debug::SetDebugDelegate(env->GetIsolate(), &run_step);
 
-  v8::Local<v8::Context> context = env.context();
+  v8::Local<v8::Context> context = env.local();
   // Create a function for testing stepping. Run it to allow it to get
   // optimized.
   const int argc = 1;
@@ -2921,7 +2283,7 @@ TEST(DebugStepForContinue) {
   // Each loop generates 4 or 5 steps depending on whether a is equal.
 
   // Looping 10 times.
-  step_action = StepIn;
+  run_step.set_step_action(StepIn);
   break_point_hit_count = 0;
   v8::Local<v8::Value> argv_10[argc] = {v8::Number::New(isolate, 10)};
   result = foo->Call(context, env->Global(), argc, argv_10).ToLocalChecked();
@@ -2929,7 +2291,7 @@ TEST(DebugStepForContinue) {
   CHECK_EQ(62, break_point_hit_count);
 
   // Looping 100 times.
-  step_action = StepIn;
+  run_step.set_step_action(StepIn);
   break_point_hit_count = 0;
   v8::Local<v8::Value> argv_100[argc] = {v8::Number::New(isolate, 100)};
   result = foo->Call(context, env->Global(), argc, argv_100).ToLocalChecked();
@@ -2937,20 +2299,21 @@ TEST(DebugStepForContinue) {
   CHECK_EQ(557, break_point_hit_count);
 
   // Get rid of the debug event listener.
-  SetDebugEventListener(isolate, nullptr);
+  v8::debug::SetDebugDelegate(env->GetIsolate(), nullptr);
   CheckDebuggerUnloaded();
 }
 
 
 TEST(DebugStepForBreak) {
-  DebugLocalContext env;
+  LocalContext env;
   v8::Isolate* isolate = env->GetIsolate();
   v8::HandleScope scope(isolate);
 
   // Register a debug event listener which steps and counts.
-  SetDebugEventListener(isolate, DebugEventStep);
+  DebugEventCounter run_step;
+  v8::debug::SetDebugDelegate(env->GetIsolate(), &run_step);
 
-  v8::Local<v8::Context> context = env.context();
+  v8::Local<v8::Context> context = env.local();
   // Create a function for testing stepping. Run it to allow it to get
   // optimized.
   const int argc = 1;
@@ -2975,7 +2338,7 @@ TEST(DebugStepForBreak) {
   // which only generates 4.
 
   // Looping 10 times.
-  step_action = StepIn;
+  run_step.set_step_action(StepIn);
   break_point_hit_count = 0;
   v8::Local<v8::Value> argv_10[argc] = {v8::Number::New(isolate, 10)};
   result = foo->Call(context, env->Global(), argc, argv_10).ToLocalChecked();
@@ -2983,7 +2346,7 @@ TEST(DebugStepForBreak) {
   CHECK_EQ(64, break_point_hit_count);
 
   // Looping 100 times.
-  step_action = StepIn;
+  run_step.set_step_action(StepIn);
   break_point_hit_count = 0;
   v8::Local<v8::Value> argv_100[argc] = {v8::Number::New(isolate, 100)};
   result = foo->Call(context, env->Global(), argc, argv_100).ToLocalChecked();
@@ -2991,19 +2354,20 @@ TEST(DebugStepForBreak) {
   CHECK_EQ(604, break_point_hit_count);
 
   // Get rid of the debug event listener.
-  SetDebugEventListener(isolate, nullptr);
+  v8::debug::SetDebugDelegate(env->GetIsolate(), nullptr);
   CheckDebuggerUnloaded();
 }
 
 
 TEST(DebugStepForIn) {
-  DebugLocalContext env;
+  LocalContext env;
   v8::HandleScope scope(env->GetIsolate());
 
   // Register a debug event listener which steps and counts.
-  SetDebugEventListener(env->GetIsolate(), DebugEventStep);
+  DebugEventCounter run_step;
+  v8::debug::SetDebugDelegate(env->GetIsolate(), &run_step);
 
-  v8::Local<v8::Context> context = env.context();
+  v8::Local<v8::Context> context = env.local();
   // Create a function for testing stepping. Run it to allow it to get
   // optimized.
   v8::Local<v8::Function> foo;
@@ -3017,7 +2381,7 @@ TEST(DebugStepForIn) {
   foo = CompileFunction(&env, src_1, "foo");
   SetBreakPoint(foo, 0);  // "var a = ..."
 
-  step_action = StepIn;
+  run_step.set_step_action(StepIn);
   break_point_hit_count = 0;
   foo->Call(context, env->Global(), 0, nullptr).ToLocalChecked();
   CHECK_EQ(8, break_point_hit_count);
@@ -3034,25 +2398,26 @@ TEST(DebugStepForIn) {
   foo = CompileFunction(&env, src_2, "foo");
   SetBreakPoint(foo, 0);  // "var a = ..."
 
-  step_action = StepIn;
+  run_step.set_step_action(StepIn);
   break_point_hit_count = 0;
   foo->Call(context, env->Global(), 0, nullptr).ToLocalChecked();
   CHECK_EQ(10, break_point_hit_count);
 
   // Get rid of the debug event listener.
-  SetDebugEventListener(env->GetIsolate(), nullptr);
+  v8::debug::SetDebugDelegate(env->GetIsolate(), nullptr);
   CheckDebuggerUnloaded();
 }
 
 
 TEST(DebugStepWith) {
-  DebugLocalContext env;
+  LocalContext env;
   v8::HandleScope scope(env->GetIsolate());
 
   // Register a debug event listener which steps and counts.
-  SetDebugEventListener(env->GetIsolate(), DebugEventStep);
+  DebugEventCounter run_step;
+  v8::debug::SetDebugDelegate(env->GetIsolate(), &run_step);
 
-  v8::Local<v8::Context> context = env.context();
+  v8::Local<v8::Context> context = env.local();
   // Create a function for testing stepping. Run it to allow it to get
   // optimized.
   const char* src = "function foo(x) { "
@@ -3069,26 +2434,27 @@ TEST(DebugStepWith) {
   v8::Local<v8::Value> result;
   SetBreakPoint(foo, 8);  // "var a = {};"
 
-  step_action = StepIn;
+  run_step.set_step_action(StepIn);
   break_point_hit_count = 0;
   foo->Call(context, env->Global(), 0, nullptr).ToLocalChecked();
   CHECK_EQ(4, break_point_hit_count);
 
   // Get rid of the debug event listener.
-  SetDebugEventListener(env->GetIsolate(), nullptr);
+  v8::debug::SetDebugDelegate(env->GetIsolate(), nullptr);
   CheckDebuggerUnloaded();
 }
 
 
 TEST(DebugConditional) {
-  DebugLocalContext env;
+  LocalContext env;
   v8::Isolate* isolate = env->GetIsolate();
   v8::HandleScope scope(isolate);
 
   // Register a debug event listener which steps and counts.
-  SetDebugEventListener(isolate, DebugEventStep);
+  DebugEventCounter run_step;
+  v8::debug::SetDebugDelegate(env->GetIsolate(), &run_step);
 
-  v8::Local<v8::Context> context = env.context();
+  v8::Local<v8::Context> context = env.local();
   // Create a function for testing stepping. Run it to allow it to get
   // optimized.
   const char* src =
@@ -3099,12 +2465,12 @@ TEST(DebugConditional) {
   v8::Local<v8::Function> foo = CompileFunction(&env, src, "foo");
   SetBreakPoint(foo, 0);  // "var a;"
 
-  step_action = StepIn;
+  run_step.set_step_action(StepIn);
   break_point_hit_count = 0;
   foo->Call(context, env->Global(), 0, nullptr).ToLocalChecked();
   CHECK_EQ(2, break_point_hit_count);
 
-  step_action = StepIn;
+  run_step.set_step_action(StepIn);
   break_point_hit_count = 0;
   const int argc = 1;
   v8::Local<v8::Value> argv_true[argc] = {v8::True(isolate)};
@@ -3112,179 +2478,37 @@ TEST(DebugConditional) {
   CHECK_EQ(2, break_point_hit_count);
 
   // Get rid of the debug event listener.
-  SetDebugEventListener(isolate, nullptr);
-  CheckDebuggerUnloaded();
-}
-
-
-TEST(StepInOutSimple) {
-  DebugLocalContext env;
-  v8::HandleScope scope(env->GetIsolate());
-
-  // Create a function for checking the function when hitting a break point.
-  frame_function_name = CompileFunction(&env,
-                                        frame_function_name_source,
-                                        "frame_function_name");
-
-  // Register a debug event listener which steps and counts.
-  SetDebugEventListener(env->GetIsolate(), DebugEventStepSequence);
-
-  v8::Local<v8::Context> context = env.context();
-  // Create a function for testing stepping. Run it to allow it to get
-  // optimized.
-  const char* src = "function a() {b();c();}; "
-                    "function b() {c();}; "
-                    "function c() {}; "
-                    "a(); b(); c()";
-  v8::Local<v8::Function> a = CompileFunction(&env, src, "a");
-  SetBreakPoint(a, 0);
-
-  // Step through invocation of a with step in.
-  step_action = StepIn;
-  break_point_hit_count = 0;
-  expected_step_sequence = "abcbaca";
-  a->Call(context, env->Global(), 0, nullptr).ToLocalChecked();
-  CHECK_EQ(StrLength(expected_step_sequence),
-           break_point_hit_count);
-
-  // Step through invocation of a with step next.
-  step_action = StepNext;
-  break_point_hit_count = 0;
-  expected_step_sequence = "aaa";
-  a->Call(context, env->Global(), 0, nullptr).ToLocalChecked();
-  CHECK_EQ(StrLength(expected_step_sequence),
-           break_point_hit_count);
-
-  // Step through invocation of a with step out.
-  step_action = StepOut;
-  break_point_hit_count = 0;
-  expected_step_sequence = "a";
-  a->Call(context, env->Global(), 0, nullptr).ToLocalChecked();
-  CHECK_EQ(StrLength(expected_step_sequence),
-           break_point_hit_count);
-
-  // Get rid of the debug event listener.
-  SetDebugEventListener(env->GetIsolate(), nullptr);
-  CheckDebuggerUnloaded();
-}
-
-
-TEST(StepInOutTree) {
-  DebugLocalContext env;
-  v8::HandleScope scope(env->GetIsolate());
-
-  // Create a function for checking the function when hitting a break point.
-  frame_function_name = CompileFunction(&env,
-                                        frame_function_name_source,
-                                        "frame_function_name");
-
-  // Register a debug event listener which steps and counts.
-  SetDebugEventListener(env->GetIsolate(), DebugEventStepSequence);
-
-  v8::Local<v8::Context> context = env.context();
-  // Create a function for testing stepping. Run it to allow it to get
-  // optimized.
-  const char* src = "function a() {b(c(d()),d());c(d());d()}; "
-                    "function b(x,y) {c();}; "
-                    "function c(x) {}; "
-                    "function d() {}; "
-                    "a(); b(); c(); d()";
-  v8::Local<v8::Function> a = CompileFunction(&env, src, "a");
-  SetBreakPoint(a, 0);
-
-  // Step through invocation of a with step in.
-  step_action = StepIn;
-  break_point_hit_count = 0;
-  expected_step_sequence = "adacadabcbadacada";
-  a->Call(context, env->Global(), 0, nullptr).ToLocalChecked();
-  CHECK_EQ(StrLength(expected_step_sequence),
-           break_point_hit_count);
-
-  // Step through invocation of a with step next.
-  step_action = StepNext;
-  break_point_hit_count = 0;
-  expected_step_sequence = "aaaa";
-  a->Call(context, env->Global(), 0, nullptr).ToLocalChecked();
-  CHECK_EQ(StrLength(expected_step_sequence),
-           break_point_hit_count);
-
-  // Step through invocation of a with step out.
-  step_action = StepOut;
-  break_point_hit_count = 0;
-  expected_step_sequence = "a";
-  a->Call(context, env->Global(), 0, nullptr).ToLocalChecked();
-  CHECK_EQ(StrLength(expected_step_sequence),
-           break_point_hit_count);
-
-  // Get rid of the debug event listener.
-  SetDebugEventListener(env->GetIsolate(), nullptr);
-  CheckDebuggerUnloaded();
-}
-
-
-TEST(StepInOutBranch) {
-  DebugLocalContext env;
-  v8::HandleScope scope(env->GetIsolate());
-
-  // Create a function for checking the function when hitting a break point.
-  frame_function_name = CompileFunction(&env,
-                                        frame_function_name_source,
-                                        "frame_function_name");
-
-  // Register a debug event listener which steps and counts.
-  SetDebugEventListener(env->GetIsolate(), DebugEventStepSequence);
-
-  v8::Local<v8::Context> context = env.context();
-  // Create a function for testing stepping. Run it to allow it to get
-  // optimized.
-  const char* src = "function a() {b(false);c();}; "
-                    "function b(x) {if(x){c();};}; "
-                    "function c() {}; "
-                    "a(); b(); c()";
-  v8::Local<v8::Function> a = CompileFunction(&env, src, "a");
-  SetBreakPoint(a, 0);
-
-  // Step through invocation of a.
-  step_action = StepIn;
-  break_point_hit_count = 0;
-  expected_step_sequence = "abbaca";
-  a->Call(context, env->Global(), 0, nullptr).ToLocalChecked();
-  CHECK_EQ(StrLength(expected_step_sequence),
-           break_point_hit_count);
-
-  // Get rid of the debug event listener.
-  SetDebugEventListener(env->GetIsolate(), nullptr);
+  v8::debug::SetDebugDelegate(env->GetIsolate(), nullptr);
   CheckDebuggerUnloaded();
 }
 
-
 // Test that step in does not step into native functions.
 TEST(DebugStepNatives) {
-  DebugLocalContext env;
+  LocalContext env;
   v8::HandleScope scope(env->GetIsolate());
 
   // Create a function for testing stepping.
-  v8::Local<v8::Function> foo = CompileFunction(
-      &env,
-      "function foo(){debugger;Math.sin(1);}",
-      "foo");
+  v8::Local<v8::Function> foo =
+      CompileFunction(&env, "function foo(){debugger;Math.sin(1);}", "foo");
 
   // Register a debug event listener which steps and counts.
-  SetDebugEventListener(env->GetIsolate(), DebugEventStep);
+  DebugEventCounter run_step;
+  v8::debug::SetDebugDelegate(env->GetIsolate(), &run_step);
 
-  v8::Local<v8::Context> context = env.context();
-  step_action = StepIn;
+  v8::Local<v8::Context> context = env.local();
+  run_step.set_step_action(StepIn);
   break_point_hit_count = 0;
   foo->Call(context, env->Global(), 0, nullptr).ToLocalChecked();
 
   // With stepping all break locations are hit.
   CHECK_EQ(3, break_point_hit_count);
 
-  SetDebugEventListener(env->GetIsolate(), nullptr);
+  v8::debug::SetDebugDelegate(env->GetIsolate(), nullptr);
   CheckDebuggerUnloaded();
 
   // Register a debug event listener which just counts.
-  SetDebugEventListener(env->GetIsolate(), DebugEventBreakPointHitCount);
+  DebugEventCounter delegate;
+  v8::debug::SetDebugDelegate(env->GetIsolate(), &delegate);
 
   break_point_hit_count = 0;
   foo->Call(context, env->Global(), 0, nullptr).ToLocalChecked();
@@ -3292,39 +2516,40 @@ TEST(DebugStepNatives) {
   // Without stepping only active break points are hit.
   CHECK_EQ(1, break_point_hit_count);
 
-  SetDebugEventListener(env->GetIsolate(), nullptr);
+  v8::debug::SetDebugDelegate(env->GetIsolate(), nullptr);
   CheckDebuggerUnloaded();
 }
 
-
 // Test that step in works with function.apply.
 TEST(DebugStepFunctionApply) {
-  DebugLocalContext env;
+  LocalContext env;
   v8::HandleScope scope(env->GetIsolate());
 
   // Create a function for testing stepping.
-  v8::Local<v8::Function> foo = CompileFunction(
-      &env,
-      "function bar(x, y, z) { if (x == 1) { a = y; b = z; } }"
-      "function foo(){ debugger; bar.apply(this, [1,2,3]); }",
-      "foo");
+  v8::Local<v8::Function> foo =
+      CompileFunction(&env,
+                      "function bar(x, y, z) { if (x == 1) { a = y; b = z; } }"
+                      "function foo(){ debugger; bar.apply(this, [1,2,3]); }",
+                      "foo");
 
   // Register a debug event listener which steps and counts.
-  SetDebugEventListener(env->GetIsolate(), DebugEventStep);
+  DebugEventCounter run_step;
+  v8::debug::SetDebugDelegate(env->GetIsolate(), &run_step);
 
-  v8::Local<v8::Context> context = env.context();
-  step_action = StepIn;
+  v8::Local<v8::Context> context = env.local();
+  run_step.set_step_action(StepIn);
   break_point_hit_count = 0;
   foo->Call(context, env->Global(), 0, nullptr).ToLocalChecked();
 
   // With stepping all break locations are hit.
   CHECK_EQ(7, break_point_hit_count);
 
-  SetDebugEventListener(env->GetIsolate(), nullptr);
+  v8::debug::SetDebugDelegate(env->GetIsolate(), nullptr);
   CheckDebuggerUnloaded();
 
   // Register a debug event listener which just counts.
-  SetDebugEventListener(env->GetIsolate(), DebugEventBreakPointHitCount);
+  DebugEventCounter delegate;
+  v8::debug::SetDebugDelegate(env->GetIsolate(), &delegate);
 
   break_point_hit_count = 0;
   foo->Call(context, env->Global(), 0, nullptr).ToLocalChecked();
@@ -3332,18 +2557,18 @@ TEST(DebugStepFunctionApply) {
   // Without stepping only the debugger statement is hit.
   CHECK_EQ(1, break_point_hit_count);
 
-  SetDebugEventListener(env->GetIsolate(), nullptr);
+  v8::debug::SetDebugDelegate(env->GetIsolate(), nullptr);
   CheckDebuggerUnloaded();
 }
 
 
 // Test that step in works with function.call.
 TEST(DebugStepFunctionCall) {
-  DebugLocalContext env;
+  LocalContext env;
   v8::Isolate* isolate = env->GetIsolate();
   v8::HandleScope scope(isolate);
 
-  v8::Local<v8::Context> context = env.context();
+  v8::Local<v8::Context> context = env.local();
   // Create a function for testing stepping.
   v8::Local<v8::Function> foo = CompileFunction(
       &env,
@@ -3358,8 +2583,9 @@ TEST(DebugStepFunctionCall) {
       "foo");
 
   // Register a debug event listener which steps and counts.
-  SetDebugEventListener(isolate, DebugEventStep);
-  step_action = StepIn;
+  DebugEventCounter run_step;
+  v8::debug::SetDebugDelegate(env->GetIsolate(), &run_step);
+  run_step.set_step_action(StepIn);
 
   // Check stepping where the if condition in bar is false.
   break_point_hit_count = 0;
@@ -3373,11 +2599,12 @@ TEST(DebugStepFunctionCall) {
   foo->Call(context, env->Global(), argc, argv).ToLocalChecked();
   CHECK_EQ(8, break_point_hit_count);
 
-  SetDebugEventListener(isolate, nullptr);
+  v8::debug::SetDebugDelegate(env->GetIsolate(), nullptr);
   CheckDebuggerUnloaded();
 
   // Register a debug event listener which just counts.
-  SetDebugEventListener(isolate, DebugEventBreakPointHitCount);
+  DebugEventCounter delegate;
+  v8::debug::SetDebugDelegate(env->GetIsolate(), &delegate);
 
   break_point_hit_count = 0;
   foo->Call(context, env->Global(), 0, nullptr).ToLocalChecked();
@@ -3385,18 +2612,18 @@ TEST(DebugStepFunctionCall) {
   // Without stepping only the debugger statement is hit.
   CHECK_EQ(1, break_point_hit_count);
 
-  SetDebugEventListener(isolate, nullptr);
+  v8::debug::SetDebugDelegate(isolate, nullptr);
   CheckDebuggerUnloaded();
 }
 
 
 // Test that step in works with Function.call.apply.
 TEST(DebugStepFunctionCallApply) {
-  DebugLocalContext env;
+  LocalContext env;
   v8::Isolate* isolate = env->GetIsolate();
   v8::HandleScope scope(isolate);
 
-  v8::Local<v8::Context> context = env.context();
+  v8::Local<v8::Context> context = env.local();
   // Create a function for testing stepping.
   v8::Local<v8::Function> foo =
       CompileFunction(&env,
@@ -3409,18 +2636,20 @@ TEST(DebugStepFunctionCallApply) {
                       "foo");
 
   // Register a debug event listener which steps and counts.
-  SetDebugEventListener(isolate, DebugEventStep);
-  step_action = StepIn;
+  DebugEventCounter run_step;
+  v8::debug::SetDebugDelegate(env->GetIsolate(), &run_step);
+  run_step.set_step_action(StepIn);
 
   break_point_hit_count = 0;
   foo->Call(context, env->Global(), 0, nullptr).ToLocalChecked();
   CHECK_EQ(6, break_point_hit_count);
 
-  SetDebugEventListener(isolate, nullptr);
+  v8::debug::SetDebugDelegate(env->GetIsolate(), nullptr);
   CheckDebuggerUnloaded();
 
   // Register a debug event listener which just counts.
-  SetDebugEventListener(isolate, DebugEventBreakPointHitCount);
+  DebugEventCounter delegate;
+  v8::debug::SetDebugDelegate(env->GetIsolate(), &delegate);
 
   break_point_hit_count = 0;
   foo->Call(context, env->Global(), 0, nullptr).ToLocalChecked();
@@ -3428,22 +2657,22 @@ TEST(DebugStepFunctionCallApply) {
   // Without stepping only the debugger statement is hit.
   CHECK_EQ(1, break_point_hit_count);
 
-  SetDebugEventListener(isolate, nullptr);
+  v8::debug::SetDebugDelegate(isolate, nullptr);
   CheckDebuggerUnloaded();
 }
 
 
 // Tests that breakpoint will be hit if it's set in script.
 TEST(PauseInScript) {
-  DebugLocalContext env;
+  LocalContext env;
   v8::HandleScope scope(env->GetIsolate());
   i::Isolate* isolate = reinterpret_cast<i::Isolate*>(env->GetIsolate());
-  env.ExposeDebug();
 
   // Register a debug event listener which counts.
-  SetDebugEventListener(env->GetIsolate(), DebugEventCounter);
+  DebugEventCounter event_counter;
+  v8::debug::SetDebugDelegate(env->GetIsolate(), &event_counter);
 
-  v8::Local<v8::Context> context = env.context();
+  v8::Local<v8::Context> context = env.local();
   // Create a script that returns a function.
   const char* src = "(function (evt) {})";
   const char* script_name = "StepInHandlerTest";
@@ -3456,7 +2685,8 @@ TEST(PauseInScript) {
 
   // Set breakpoint in the script.
   i::Handle<i::Script> i_script(
-      i::Script::cast(v8::Utils::OpenHandle(*script)->shared()->script()));
+      i::Script::cast(v8::Utils::OpenHandle(*script)->shared()->script()),
+      isolate);
   i::Handle<i::String> condition = isolate->factory()->empty_string();
   int position = 0;
   int id;
@@ -3468,421 +2698,27 @@ TEST(PauseInScript) {
   CHECK(r->IsFunction());
   CHECK_EQ(1, break_point_hit_count);
 
-  // Get rid of the debug event listener.
-  SetDebugEventListener(env->GetIsolate(), nullptr);
-  CheckDebuggerUnloaded();
-}
-
-
-static void DebugEventCounterCheck(int caught, int uncaught, int message) {
-  CHECK_EQ(caught, exception_hit_count);
-  CHECK_EQ(uncaught, uncaught_exception_hit_count);
-  CHECK_EQ(message, message_callback_count);
-}
-
-
-// Test break on exceptions. For each exception break combination the number
-// of debug event exception callbacks and message callbacks are collected. The
-// number of debug event exception callbacks are used to check that the
-// debugger is called correctly and the number of message callbacks is used to
-// check that uncaught exceptions are still returned even if there is a break
-// for them.
-TEST(BreakOnException) {
-  DebugLocalContext env;
-  v8::HandleScope scope(env->GetIsolate());
-  env.ExposeDebug();
-
-  v8::Local<v8::Context> context = env.context();
-  // Create functions for testing break on exception.
-  CompileFunction(&env, "function throws(){throw 1;}", "throws");
-  v8::Local<v8::Function> caught =
-      CompileFunction(&env,
-                      "function caught(){try {throws();} catch(e) {};}",
-                      "caught");
-  v8::Local<v8::Function> notCaught =
-      CompileFunction(&env, "function notCaught(){throws();}", "notCaught");
-  v8::Local<v8::Function> notCaughtFinally = CompileFunction(
-      &env, "function notCaughtFinally(){try{throws();}finally{}}",
-      "notCaughtFinally");
-  // In this edge case, even though this finally does not propagate the
-  // exception, the debugger considers this uncaught, since we want to break
-  // at the first throw for the general case where finally implicitly rethrows.
-  v8::Local<v8::Function> edgeCaseFinally = CompileFunction(
-      &env, "function caughtFinally(){L:try{throws();}finally{break L;}}",
-      "caughtFinally");
-
-  env->GetIsolate()->AddMessageListener(MessageCallbackCount);
-  SetDebugEventListener(env->GetIsolate(), DebugEventCounter);
-
-  // Initial state should be no break on exceptions.
-  DebugEventCounterClear();
-  MessageCallbackCountClear();
-  caught->Call(context, env->Global(), 0, nullptr).ToLocalChecked();
-  DebugEventCounterCheck(0, 0, 0);
-  CHECK(notCaught->Call(context, env->Global(), 0, nullptr).IsEmpty());
-  DebugEventCounterCheck(0, 0, 1);
-  CHECK(notCaughtFinally->Call(context, env->Global(), 0, nullptr).IsEmpty());
-  DebugEventCounterCheck(0, 0, 2);
-  edgeCaseFinally->Call(context, env->Global(), 0, nullptr).ToLocalChecked();
-  DebugEventCounterCheck(0, 0, 2);
-
-  // No break on exception
-  DebugEventCounterClear();
-  MessageCallbackCountClear();
-  ChangeBreakOnException(false, false);
-  caught->Call(context, env->Global(), 0, nullptr).ToLocalChecked();
-  DebugEventCounterCheck(0, 0, 0);
-  CHECK(notCaught->Call(context, env->Global(), 0, nullptr).IsEmpty());
-  DebugEventCounterCheck(0, 0, 1);
-  CHECK(notCaughtFinally->Call(context, env->Global(), 0, nullptr).IsEmpty());
-  DebugEventCounterCheck(0, 0, 2);
-  edgeCaseFinally->Call(context, env->Global(), 0, nullptr).ToLocalChecked();
-  DebugEventCounterCheck(0, 0, 2);
-
-  // Break on uncaught exception
-  DebugEventCounterClear();
-  MessageCallbackCountClear();
-  ChangeBreakOnException(false, true);
-  caught->Call(context, env->Global(), 0, nullptr).ToLocalChecked();
-  DebugEventCounterCheck(0, 0, 0);
-  CHECK(notCaught->Call(context, env->Global(), 0, nullptr).IsEmpty());
-  DebugEventCounterCheck(1, 1, 1);
-  CHECK(notCaughtFinally->Call(context, env->Global(), 0, nullptr).IsEmpty());
-  DebugEventCounterCheck(2, 2, 2);
-  edgeCaseFinally->Call(context, env->Global(), 0, nullptr).ToLocalChecked();
-  DebugEventCounterCheck(3, 3, 2);
-
-  // Break on exception and uncaught exception
-  DebugEventCounterClear();
-  MessageCallbackCountClear();
-  ChangeBreakOnException(true, true);
-  caught->Call(context, env->Global(), 0, nullptr).ToLocalChecked();
-  DebugEventCounterCheck(1, 0, 0);
-  CHECK(notCaught->Call(context, env->Global(), 0, nullptr).IsEmpty());
-  DebugEventCounterCheck(2, 1, 1);
-  CHECK(notCaughtFinally->Call(context, env->Global(), 0, nullptr).IsEmpty());
-  DebugEventCounterCheck(3, 2, 2);
-  edgeCaseFinally->Call(context, env->Global(), 0, nullptr).ToLocalChecked();
-  DebugEventCounterCheck(4, 3, 2);
-
-  // Break on exception
-  DebugEventCounterClear();
-  MessageCallbackCountClear();
-  ChangeBreakOnException(true, false);
-  caught->Call(context, env->Global(), 0, nullptr).ToLocalChecked();
-  DebugEventCounterCheck(1, 0, 0);
-  CHECK(notCaught->Call(context, env->Global(), 0, nullptr).IsEmpty());
-  DebugEventCounterCheck(2, 1, 1);
-  CHECK(notCaughtFinally->Call(context, env->Global(), 0, nullptr).IsEmpty());
-  DebugEventCounterCheck(3, 2, 2);
-  edgeCaseFinally->Call(context, env->Global(), 0, nullptr).ToLocalChecked();
-  DebugEventCounterCheck(4, 3, 2);
-
-  // No break on exception using JavaScript
-  DebugEventCounterClear();
-  MessageCallbackCountClear();
-  ChangeBreakOnExceptionFromJS(env->GetIsolate(), false, false);
-  caught->Call(context, env->Global(), 0, nullptr).ToLocalChecked();
-  DebugEventCounterCheck(0, 0, 0);
-  CHECK(notCaught->Call(context, env->Global(), 0, nullptr).IsEmpty());
-  DebugEventCounterCheck(0, 0, 1);
-  CHECK(notCaughtFinally->Call(context, env->Global(), 0, nullptr).IsEmpty());
-  DebugEventCounterCheck(0, 0, 2);
-  edgeCaseFinally->Call(context, env->Global(), 0, nullptr).ToLocalChecked();
-  DebugEventCounterCheck(0, 0, 2);
-
-  // Break on uncaught exception using JavaScript
-  DebugEventCounterClear();
-  MessageCallbackCountClear();
-  ChangeBreakOnExceptionFromJS(env->GetIsolate(), false, true);
-  caught->Call(context, env->Global(), 0, nullptr).ToLocalChecked();
-  DebugEventCounterCheck(0, 0, 0);
-  CHECK(notCaught->Call(context, env->Global(), 0, nullptr).IsEmpty());
-  DebugEventCounterCheck(1, 1, 1);
-  CHECK(notCaughtFinally->Call(context, env->Global(), 0, nullptr).IsEmpty());
-  DebugEventCounterCheck(2, 2, 2);
-  edgeCaseFinally->Call(context, env->Global(), 0, nullptr).ToLocalChecked();
-  DebugEventCounterCheck(3, 3, 2);
-
-  // Break on exception and uncaught exception using JavaScript
-  DebugEventCounterClear();
-  MessageCallbackCountClear();
-  ChangeBreakOnExceptionFromJS(env->GetIsolate(), true, true);
-  caught->Call(context, env->Global(), 0, nullptr).ToLocalChecked();
-  DebugEventCounterCheck(1, 0, 0);
-  CHECK(notCaught->Call(context, env->Global(), 0, nullptr).IsEmpty());
-  DebugEventCounterCheck(2, 1, 1);
-  CHECK(notCaughtFinally->Call(context, env->Global(), 0, nullptr).IsEmpty());
-  DebugEventCounterCheck(3, 2, 2);
-  edgeCaseFinally->Call(context, env->Global(), 0, nullptr).ToLocalChecked();
-  DebugEventCounterCheck(4, 3, 2);
-
-  // Break on exception using JavaScript
-  DebugEventCounterClear();
-  MessageCallbackCountClear();
-  ChangeBreakOnExceptionFromJS(env->GetIsolate(), true, false);
-  caught->Call(context, env->Global(), 0, nullptr).ToLocalChecked();
-  DebugEventCounterCheck(1, 0, 0);
-  CHECK(notCaught->Call(context, env->Global(), 0, nullptr).IsEmpty());
-  DebugEventCounterCheck(2, 1, 1);
-  CHECK(notCaughtFinally->Call(context, env->Global(), 0, nullptr).IsEmpty());
-  DebugEventCounterCheck(3, 2, 2);
-  edgeCaseFinally->Call(context, env->Global(), 0, nullptr).ToLocalChecked();
-  DebugEventCounterCheck(4, 3, 2);
-
-  // No break on exception using native API
-  DebugEventCounterClear();
-  MessageCallbackCountClear();
-  ChangeBreakOnExceptionFromAPI(env->GetIsolate(),
-                                v8::debug::NoBreakOnException);
-  caught->Call(context, env->Global(), 0, nullptr).ToLocalChecked();
-  DebugEventCounterCheck(0, 0, 0);
-  CHECK(notCaught->Call(context, env->Global(), 0, nullptr).IsEmpty());
-  DebugEventCounterCheck(0, 0, 1);
-  CHECK(notCaughtFinally->Call(context, env->Global(), 0, nullptr).IsEmpty());
-  DebugEventCounterCheck(0, 0, 2);
-  edgeCaseFinally->Call(context, env->Global(), 0, nullptr).ToLocalChecked();
-  DebugEventCounterCheck(0, 0, 2);
-
-  // // Break on uncaught exception using native API
-  DebugEventCounterClear();
-  MessageCallbackCountClear();
-  ChangeBreakOnExceptionFromAPI(env->GetIsolate(),
-                                v8::debug::BreakOnUncaughtException);
-  caught->Call(context, env->Global(), 0, nullptr).ToLocalChecked();
-  DebugEventCounterCheck(0, 0, 0);
-  CHECK(notCaught->Call(context, env->Global(), 0, nullptr).IsEmpty());
-  DebugEventCounterCheck(1, 1, 1);
-  CHECK(notCaughtFinally->Call(context, env->Global(), 0, nullptr).IsEmpty());
-  DebugEventCounterCheck(2, 2, 2);
-  edgeCaseFinally->Call(context, env->Global(), 0, nullptr).ToLocalChecked();
-  DebugEventCounterCheck(3, 3, 2);
-
-  // // Break on exception and uncaught exception using native API
-  DebugEventCounterClear();
-  MessageCallbackCountClear();
-  ChangeBreakOnExceptionFromAPI(env->GetIsolate(),
-                                v8::debug::BreakOnAnyException);
-  caught->Call(context, env->Global(), 0, nullptr).ToLocalChecked();
-  DebugEventCounterCheck(1, 0, 0);
-  CHECK(notCaught->Call(context, env->Global(), 0, nullptr).IsEmpty());
-  DebugEventCounterCheck(2, 1, 1);
-  CHECK(notCaughtFinally->Call(context, env->Global(), 0, nullptr).IsEmpty());
-  DebugEventCounterCheck(3, 2, 2);
-  edgeCaseFinally->Call(context, env->Global(), 0, nullptr).ToLocalChecked();
-  DebugEventCounterCheck(4, 3, 2);
-
-  SetDebugEventListener(env->GetIsolate(), nullptr);
-  CheckDebuggerUnloaded();
-  env->GetIsolate()->RemoveMessageListeners(MessageCallbackCount);
-}
-
-
-static void try_finally_original_message(v8::Local<v8::Message> message,
-                                         v8::Local<v8::Value> data) {
-  v8::Local<v8::Context> context = CcTest::isolate()->GetCurrentContext();
-  CHECK_EQ(2, message->GetLineNumber(context).FromJust());
-  CHECK_EQ(2, message->GetStartColumn(context).FromJust());
-  message_callback_count++;
-}
-
-
-TEST(TryFinallyOriginalMessage) {
-  // Test that the debugger plays nicely with the pending message.
-  message_callback_count = 0;
-  DebugEventCounterClear();
-  DebugLocalContext env;
-  v8::Isolate* isolate = CcTest::isolate();
-  isolate->AddMessageListener(try_finally_original_message);
-  SetDebugEventListener(isolate, DebugEventCounter);
-  ChangeBreakOnException(true, true);
-  v8::HandleScope scope(isolate);
-  CompileRun(
-      "try {\n"
-      "  throw 1;\n"
-      "} finally {\n"
-      "}\n");
-  DebugEventCounterCheck(1, 1, 1);
-  SetDebugEventListener(isolate, nullptr);
-  isolate->RemoveMessageListeners(try_finally_original_message);
-}
-
-
-// Test break on exception from compiler errors. When compiling using
-// v8::Script::Compile there is no JavaScript stack whereas when compiling using
-// eval there are JavaScript frames.
-TEST(BreakOnCompileException) {
-  DebugLocalContext env;
-  v8::HandleScope scope(env->GetIsolate());
-
-  v8::Local<v8::Context> context = env.context();
-  // For this test, we want to break on uncaught exceptions:
-  ChangeBreakOnException(false, true);
-
-  // Create a function for checking the function when hitting a break point.
-  frame_count = CompileFunction(&env, frame_count_source, "frame_count");
-
-  env->GetIsolate()->AddMessageListener(MessageCallbackCount);
-  SetDebugEventListener(env->GetIsolate(), DebugEventCounter);
-
-  DebugEventCounterClear();
-  MessageCallbackCountClear();
-
-  // Check initial state.
-  CHECK_EQ(0, exception_hit_count);
-  CHECK_EQ(0, uncaught_exception_hit_count);
-  CHECK_EQ(0, message_callback_count);
-  CHECK_EQ(-1, last_js_stack_height);
-
-  // Throws SyntaxError: Unexpected end of input
-  CHECK(
-      v8::Script::Compile(context, v8_str(env->GetIsolate(), "+++")).IsEmpty());
-  // Exceptions with no stack are skipped.
-  CHECK_EQ(0, exception_hit_count);
-  CHECK_EQ(0, uncaught_exception_hit_count);
-  CHECK_EQ(1, message_callback_count);
-  CHECK_EQ(0, last_js_stack_height);  // No JavaScript stack.
-
-  // Throws SyntaxError: Unexpected identifier
-  CHECK(
-      v8::Script::Compile(context, v8_str(env->GetIsolate(), "x x")).IsEmpty());
-  // Exceptions with no stack are skipped.
-  CHECK_EQ(0, exception_hit_count);
-  CHECK_EQ(0, uncaught_exception_hit_count);
-  CHECK_EQ(2, message_callback_count);
-  CHECK_EQ(0, last_js_stack_height);  // No JavaScript stack.
-
-  // Throws SyntaxError: Unexpected end of input
-  CHECK(v8::Script::Compile(context, v8_str(env->GetIsolate(), "eval('+++')"))
-            .ToLocalChecked()
-            ->Run(context)
-            .IsEmpty());
-  CHECK_EQ(1, exception_hit_count);
-  CHECK_EQ(1, uncaught_exception_hit_count);
-  CHECK_EQ(3, message_callback_count);
-  CHECK_EQ(1, last_js_stack_height);
-
-  // Throws SyntaxError: Unexpected identifier
-  CHECK(v8::Script::Compile(context, v8_str(env->GetIsolate(), "eval('x x')"))
-            .ToLocalChecked()
-            ->Run(context)
-            .IsEmpty());
-  CHECK_EQ(2, exception_hit_count);
-  CHECK_EQ(2, uncaught_exception_hit_count);
-  CHECK_EQ(4, message_callback_count);
-  CHECK_EQ(1, last_js_stack_height);
-}
-
-
-TEST(StepWithException) {
-  DebugLocalContext env;
-  v8::HandleScope scope(env->GetIsolate());
-
-  // For this test, we want to break on uncaught exceptions:
-  ChangeBreakOnException(false, true);
-
-  // Create a function for checking the function when hitting a break point.
-  frame_function_name = CompileFunction(&env,
-                                        frame_function_name_source,
-                                        "frame_function_name");
-
-  // Register a debug event listener which steps and counts.
-  SetDebugEventListener(env->GetIsolate(), DebugEventStepSequence);
-
-  v8::Local<v8::Context> context = env.context();
-  // Create functions for testing stepping.
-  const char* src = "function a() { n(); }; "
-                    "function b() { c(); }; "
-                    "function c() { n(); }; "
-                    "function d() { x = 1; try { e(); } catch(x) { x = 2; } }; "
-                    "function e() { n(); }; "
-                    "function f() { x = 1; try { g(); } catch(x) { x = 2; } }; "
-                    "function g() { h(); }; "
-                    "function h() { x = 1; throw 1; }; ";
-
-  // Step through invocation of a.
-  ClearStepping();
-  v8::Local<v8::Function> a = CompileFunction(&env, src, "a");
-  SetBreakPoint(a, 0);
-  step_action = StepIn;
-  break_point_hit_count = 0;
-  expected_step_sequence = "aa";
-  CHECK(a->Call(context, env->Global(), 0, nullptr).IsEmpty());
-  CHECK_EQ(StrLength(expected_step_sequence),
-           break_point_hit_count);
-
-  // Step through invocation of b + c.
-  ClearStepping();
-  v8::Local<v8::Function> b = CompileFunction(&env, src, "b");
-  SetBreakPoint(b, 0);
-  step_action = StepIn;
-  break_point_hit_count = 0;
-  expected_step_sequence = "bcc";
-  CHECK(b->Call(context, env->Global(), 0, nullptr).IsEmpty());
-  CHECK_EQ(StrLength(expected_step_sequence),
-           break_point_hit_count);
-
-  // Step through invocation of d + e.
-  ClearStepping();
-  v8::Local<v8::Function> d = CompileFunction(&env, src, "d");
-  SetBreakPoint(d, 0);
-  ChangeBreakOnException(false, true);
-  step_action = StepIn;
-  break_point_hit_count = 0;
-  expected_step_sequence = "ddedd";
-  d->Call(context, env->Global(), 0, nullptr).ToLocalChecked();
-  CHECK_EQ(StrLength(expected_step_sequence),
-           break_point_hit_count);
-
-  // Step through invocation of d + e now with break on caught exceptions.
-  ChangeBreakOnException(true, true);
-  step_action = StepIn;
-  break_point_hit_count = 0;
-  expected_step_sequence = "ddeedd";
-  d->Call(context, env->Global(), 0, nullptr).ToLocalChecked();
-  CHECK_EQ(StrLength(expected_step_sequence),
-           break_point_hit_count);
-
-  // Step through invocation of f + g + h.
-  ClearStepping();
-  v8::Local<v8::Function> f = CompileFunction(&env, src, "f");
-  SetBreakPoint(f, 0);
-  ChangeBreakOnException(false, true);
-  step_action = StepIn;
-  break_point_hit_count = 0;
-  expected_step_sequence = "ffghhff";
-  f->Call(context, env->Global(), 0, nullptr).ToLocalChecked();
-  CHECK_EQ(StrLength(expected_step_sequence),
-           break_point_hit_count);
-
-  // Step through invocation of f + g + h now with break on caught exceptions.
-  ChangeBreakOnException(true, true);
-  step_action = StepIn;
-  break_point_hit_count = 0;
-  expected_step_sequence = "ffghhhff";
-  f->Call(context, env->Global(), 0, nullptr).ToLocalChecked();
-  CHECK_EQ(StrLength(expected_step_sequence),
-           break_point_hit_count);
-
-  // Get rid of the debug event listener.
-  SetDebugEventListener(env->GetIsolate(), nullptr);
+  // Get rid of the debug delegate.
+  v8::debug::SetDebugDelegate(env->GetIsolate(), nullptr);
   CheckDebuggerUnloaded();
 }
 
+int message_callback_count = 0;
 
 TEST(DebugBreak) {
   i::FLAG_stress_compaction = false;
 #ifdef VERIFY_HEAP
   i::FLAG_verify_heap = true;
 #endif
-  DebugLocalContext env;
+  LocalContext env;
   v8::Isolate* isolate = env->GetIsolate();
   v8::HandleScope scope(isolate);
 
   // Register a debug event listener which sets the break flag and counts.
-  SetDebugEventListener(isolate, DebugEventBreak);
+  DebugEventBreak delegate;
+  v8::debug::SetDebugDelegate(isolate, &delegate);
 
-  v8::Local<v8::Context> context = env.context();
+  v8::Local<v8::Context> context = env.local();
   // Create a function for testing stepping.
   const char* src = "function f0() {}"
                     "function f1(x1) {}"
@@ -3905,7 +2741,7 @@ TEST(DebugBreak) {
   f3->Call(context, env->Global(), 0, nullptr).ToLocalChecked();
 
   // Set the debug break flag.
-  v8::debug::DebugBreak(env->GetIsolate());
+  v8::debug::SetBreakOnNextFunctionCall(env->GetIsolate());
 
   // Call all functions with different argument count.
   break_point_hit_count = 0;
@@ -3920,48 +2756,51 @@ TEST(DebugBreak) {
   CHECK_EQ(4 * arraysize(argv), break_point_hit_count);
 
   // Get rid of the debug event listener.
-  SetDebugEventListener(isolate, nullptr);
+  v8::debug::SetDebugDelegate(env->GetIsolate(), nullptr);
   CheckDebuggerUnloaded();
 }
 
-static void DebugScopingListener(const v8::Debug::EventDetails& event_details) {
-  v8::DebugEvent event = event_details.GetEvent();
-  if (event != v8::Exception) return;
-
-  auto stack_traces = v8::debug::StackTraceIterator::Create(CcTest::isolate());
-  v8::debug::Location location = stack_traces->GetSourceLocation();
-  CHECK_EQ(26, location.GetColumnNumber());
-  CHECK_EQ(0, location.GetLineNumber());
-
-  auto scopes = stack_traces->GetScopeIterator();
-  CHECK_EQ(v8::debug::ScopeIterator::ScopeTypeWith, scopes->GetType());
-  CHECK_EQ(20, scopes->GetStartLocation().GetColumnNumber());
-  CHECK_EQ(31, scopes->GetEndLocation().GetColumnNumber());
-
-  scopes->Advance();
-  CHECK_EQ(v8::debug::ScopeIterator::ScopeTypeLocal, scopes->GetType());
-  CHECK_EQ(0, scopes->GetStartLocation().GetColumnNumber());
-  CHECK_EQ(68, scopes->GetEndLocation().GetColumnNumber());
-
-  scopes->Advance();
-  CHECK_EQ(v8::debug::ScopeIterator::ScopeTypeGlobal, scopes->GetType());
-  CHECK(scopes->GetFunction().IsEmpty());
-
-  scopes->Advance();
-  CHECK(scopes->Done());
-}
+class DebugScopingListener : public v8::debug::DebugDelegate {
+ public:
+  void BreakProgramRequested(
+      v8::Local<v8::Context>,
+      const std::vector<v8::debug::BreakpointId>&) override {
+    auto stack_traces =
+        v8::debug::StackTraceIterator::Create(CcTest::isolate());
+    v8::debug::Location location = stack_traces->GetSourceLocation();
+    CHECK_EQ(26, location.GetColumnNumber());
+    CHECK_EQ(0, location.GetLineNumber());
+
+    auto scopes = stack_traces->GetScopeIterator();
+    CHECK_EQ(v8::debug::ScopeIterator::ScopeTypeWith, scopes->GetType());
+    CHECK_EQ(20, scopes->GetStartLocation().GetColumnNumber());
+    CHECK_EQ(31, scopes->GetEndLocation().GetColumnNumber());
+
+    scopes->Advance();
+    CHECK_EQ(v8::debug::ScopeIterator::ScopeTypeLocal, scopes->GetType());
+    CHECK_EQ(0, scopes->GetStartLocation().GetColumnNumber());
+    CHECK_EQ(68, scopes->GetEndLocation().GetColumnNumber());
+
+    scopes->Advance();
+    CHECK_EQ(v8::debug::ScopeIterator::ScopeTypeGlobal, scopes->GetType());
+
+    scopes->Advance();
+    CHECK(scopes->Done());
+  }
+};
 
 TEST(DebugBreakInWrappedScript) {
   i::FLAG_stress_compaction = false;
 #ifdef VERIFY_HEAP
   i::FLAG_verify_heap = true;
 #endif
-  DebugLocalContext env;
+  LocalContext env;
   v8::Isolate* isolate = env->GetIsolate();
   v8::HandleScope scope(isolate);
 
   // Register a debug event listener which sets the break flag and counts.
-  SetDebugEventListener(isolate, DebugScopingListener);
+  DebugScopingListener delegate;
+  v8::debug::SetDebugDelegate(isolate, &delegate);
 
   static const char* source =
       //   0         1         2         3         4         5         6 7
@@ -3975,18 +2814,18 @@ TEST(DebugBreakInWrappedScript) {
     v8::ScriptCompiler::Source script_source(v8_str(source));
     v8::Local<v8::Function> fun =
         v8::ScriptCompiler::CompileFunctionInContext(
-            env.context(), &script_source, 0, nullptr, 0, nullptr)
+            env.local(), &script_source, 0, nullptr, 0, nullptr)
             .ToLocalChecked();
     v8::Local<v8::Value> result =
-        fun->Call(env.context(), env->Global(), 0, nullptr).ToLocalChecked();
+        fun->Call(env.local(), env->Global(), 0, nullptr).ToLocalChecked();
     CHECK(result->IsString());
     CHECK(v8::Local<v8::String>::Cast(result)
-              ->Equals(env.context(), v8_str(expect))
+              ->Equals(env.local(), v8_str(expect))
               .FromJust());
   }
 
   // Get rid of the debug event listener.
-  SetDebugEventListener(isolate, nullptr);
+  v8::debug::SetDebugDelegate(env->GetIsolate(), nullptr);
   CheckDebuggerUnloaded();
 }
 
@@ -3995,16 +2834,17 @@ TEST(DebugBreakWithoutJS) {
 #ifdef VERIFY_HEAP
   i::FLAG_verify_heap = true;
 #endif
-  DebugLocalContext env;
+  LocalContext env;
   v8::Isolate* isolate = env->GetIsolate();
-  v8::Local<v8::Context> context = env.context();
   v8::HandleScope scope(isolate);
+  v8::Local<v8::Context> context = env.local();
 
   // Register a debug event listener which sets the break flag and counts.
-  SetDebugEventListener(isolate, DebugEventBreak);
+  DebugEventBreak delegate;
+  v8::debug::SetDebugDelegate(isolate, &delegate);
 
   // Set the debug break flag.
-  v8::debug::DebugBreak(env->GetIsolate());
+  v8::debug::SetBreakOnNextFunctionCall(env->GetIsolate());
 
   v8::Local<v8::String> json = v8_str("[1]");
   v8::Local<v8::Value> parsed = v8::JSON::Parse(context, json).ToLocalChecked();
@@ -4017,30 +2857,31 @@ TEST(DebugBreakWithoutJS) {
   CHECK_EQ(1, break_point_hit_count);
 
   // Get rid of the debug event listener.
-  SetDebugEventListener(isolate, nullptr);
+  v8::debug::SetDebugDelegate(env->GetIsolate(), nullptr);
   CheckDebuggerUnloaded();
 }
 
 // Test to ensure that JavaScript code keeps running while the debug break
 // through the stack limit flag is set but breaks are disabled.
 TEST(DisableBreak) {
-  DebugLocalContext env;
+  LocalContext env;
   v8::HandleScope scope(env->GetIsolate());
 
   // Register a debug event listener which sets the break flag and counts.
-  SetDebugEventListener(env->GetIsolate(), DebugEventCounter);
+  DebugEventCounter delegate;
+  v8::debug::SetDebugDelegate(env->GetIsolate(), &delegate);
 
-  v8::Local<v8::Context> context = env.context();
+  v8::Local<v8::Context> context = env.local();
   // Create a function for testing stepping.
   const char* src = "function f() {g()};function g(){i=0; while(i<10){i++}}";
   v8::Local<v8::Function> f = CompileFunction(&env, src, "f");
 
   // Set, test and cancel debug break.
-  v8::debug::DebugBreak(env->GetIsolate());
-  v8::debug::CancelDebugBreak(env->GetIsolate());
+  v8::debug::SetBreakOnNextFunctionCall(env->GetIsolate());
+  v8::debug::ClearBreakOnNextFunctionCall(env->GetIsolate());
 
   // Set the debug break flag.
-  v8::debug::DebugBreak(env->GetIsolate());
+  v8::debug::SetBreakOnNextFunctionCall(env->GetIsolate());
 
   // Call all functions with different argument count.
   break_point_hit_count = 0;
@@ -4048,7 +2889,7 @@ TEST(DisableBreak) {
   CHECK_EQ(1, break_point_hit_count);
 
   {
-    v8::debug::DebugBreak(env->GetIsolate());
+    v8::debug::SetBreakOnNextFunctionCall(env->GetIsolate());
     i::Isolate* isolate = reinterpret_cast<i::Isolate*>(env->GetIsolate());
     v8::internal::DisableBreak disable_break(isolate->debug());
     f->Call(context, env->Global(), 0, nullptr).ToLocalChecked();
@@ -4059,16 +2900,18 @@ TEST(DisableBreak) {
   CHECK_EQ(2, break_point_hit_count);
 
   // Get rid of the debug event listener.
-  SetDebugEventListener(env->GetIsolate(), nullptr);
+  v8::debug::SetDebugDelegate(env->GetIsolate(), nullptr);
   CheckDebuggerUnloaded();
 }
 
 TEST(DisableDebuggerStatement) {
-  DebugLocalContext env;
+  LocalContext env;
   v8::HandleScope scope(env->GetIsolate());
 
   // Register a debug event listener which sets the break flag and counts.
-  SetDebugEventListener(env->GetIsolate(), DebugEventCounter);
+  DebugEventCounter delegate;
+  v8::debug::SetDebugDelegate(env->GetIsolate(), &delegate);
+
   CompileRun("debugger;");
   CHECK_EQ(1, break_point_hit_count);
 
@@ -4077,6 +2920,8 @@ TEST(DisableDebuggerStatement) {
   isolate->debug()->set_break_points_active(false);
   CompileRun("debugger;");
   CHECK_EQ(1, break_point_hit_count);
+
+  v8::debug::SetDebugDelegate(env->GetIsolate(), nullptr);
 }
 
 static const char* kSimpleExtensionSource =
@@ -4091,10 +2936,11 @@ TEST(NoBreakWhenBootstrapping) {
   v8::HandleScope scope(isolate);
 
   // Register a debug event listener which sets the break flag and counts.
-  SetDebugEventListener(isolate, DebugEventCounter);
+  DebugEventCounter delegate;
+  v8::debug::SetDebugDelegate(isolate, &delegate);
 
   // Set the debug break flag.
-  v8::debug::DebugBreak(isolate);
+  v8::debug::SetBreakOnNextFunctionCall(isolate);
   break_point_hit_count = 0;
   {
     // Create a context with an extension to make sure that some JavaScript
@@ -4110,861 +2956,98 @@ TEST(NoBreakWhenBootstrapping) {
   CHECK_EQ(0, break_point_hit_count);
 
   // Get rid of the debug event listener.
-  SetDebugEventListener(isolate, nullptr);
+  v8::debug::SetDebugDelegate(isolate, nullptr);
   CheckDebuggerUnloaded();
 }
 
-
-static void NamedEnum(const v8::PropertyCallbackInfo<v8::Array>& info) {
-  v8::Local<v8::Array> result = v8::Array::New(info.GetIsolate(), 3);
-  v8::Local<v8::Context> context = info.GetIsolate()->GetCurrentContext();
-  CHECK(result->Set(context, v8::Integer::New(info.GetIsolate(), 0),
-                    v8_str(info.GetIsolate(), "a"))
-            .FromJust());
-  CHECK(result->Set(context, v8::Integer::New(info.GetIsolate(), 1),
-                    v8_str(info.GetIsolate(), "b"))
-            .FromJust());
-  CHECK(result->Set(context, v8::Integer::New(info.GetIsolate(), 2),
-                    v8_str(info.GetIsolate(), "c"))
-            .FromJust());
-  info.GetReturnValue().Set(result);
+TEST(SetDebugEventListenerOnUninitializedVM) {
+  v8::HandleScope scope(CcTest::isolate());
+  EnableDebugger(CcTest::isolate());
 }
 
+// Test that clearing the debug event listener actually clears all break points
+// and related information.
+TEST(DebuggerUnload) {
+  LocalContext env;
+  v8::HandleScope handle_scope(env->GetIsolate());
+  // Check debugger is unloaded before it is used.
+  CheckDebuggerUnloaded();
 
-static void IndexedEnum(const v8::PropertyCallbackInfo<v8::Array>& info) {
-  v8::Isolate* isolate = info.GetIsolate();
-  v8::Local<v8::Array> result = v8::Array::New(isolate, 2);
-  v8::Local<v8::Context> context = info.GetIsolate()->GetCurrentContext();
-  CHECK(result->Set(context, v8::Integer::New(isolate, 0),
-                    v8::Number::New(isolate, 1))
-            .FromJust());
-  CHECK(result->Set(context, v8::Integer::New(isolate, 1),
-                    v8::Number::New(isolate, 10))
-            .FromJust());
-  info.GetReturnValue().Set(result);
-}
+  // Set a debug event listener.
+  break_point_hit_count = 0;
+  DebugEventCounter delegate;
+  v8::debug::SetDebugDelegate(env->GetIsolate(), &delegate);
+  v8::Local<v8::Context> context = env.local();
+  {
+    v8::HandleScope scope(env->GetIsolate());
+    // Create a couple of functions for the test.
+    v8::Local<v8::Function> foo =
+        CompileFunction(&env, "function foo(){x=1}", "foo");
+    v8::Local<v8::Function> bar =
+        CompileFunction(&env, "function bar(){y=2}", "bar");
 
+    // Set some break points.
+    SetBreakPoint(foo, 0);
+    SetBreakPoint(foo, 4);
+    SetBreakPoint(bar, 0);
+    SetBreakPoint(bar, 4);
 
-static void NamedGetter(v8::Local<v8::Name> name,
-                        const v8::PropertyCallbackInfo<v8::Value>& info) {
-  if (name->IsSymbol()) return;
-  v8::String::Utf8Value n(CcTest::isolate(), v8::Local<v8::String>::Cast(name));
-  if (strcmp(*n, "a") == 0) {
-    info.GetReturnValue().Set(v8_str(info.GetIsolate(), "AA"));
-    return;
-  } else if (strcmp(*n, "b") == 0) {
-    info.GetReturnValue().Set(v8_str(info.GetIsolate(), "BB"));
-    return;
-  } else if (strcmp(*n, "c") == 0) {
-    info.GetReturnValue().Set(v8_str(info.GetIsolate(), "CC"));
-    return;
-  } else {
-    info.GetReturnValue().SetUndefined();
-    return;
+    // Make sure that the break points are there.
+    break_point_hit_count = 0;
+    foo->Call(context, env->Global(), 0, nullptr).ToLocalChecked();
+    CHECK_EQ(2, break_point_hit_count);
+    bar->Call(context, env->Global(), 0, nullptr).ToLocalChecked();
+    CHECK_EQ(4, break_point_hit_count);
   }
+
+  // Remove the debug event listener without clearing breakpoints. Do this
+  // outside a handle scope.
+  v8::debug::SetDebugDelegate(env->GetIsolate(), nullptr);
+  CheckDebuggerUnloaded();
 }
 
+int event_listener_hit_count = 0;
 
-static void IndexedGetter(uint32_t index,
-                          const v8::PropertyCallbackInfo<v8::Value>& info) {
-  info.GetReturnValue().Set(static_cast<double>(index + 1));
-}
+// Test for issue http://code.google.com/p/v8/issues/detail?id=289.
+// Make sure that DebugGetLoadedScripts doesn't return scripts
+// with disposed external source.
+class EmptyExternalStringResource : public v8::String::ExternalStringResource {
+ public:
+  EmptyExternalStringResource() { empty_[0] = 0; }
+  virtual ~EmptyExternalStringResource() {}
+  virtual size_t length() const { return empty_.length(); }
+  virtual const uint16_t* data() const { return empty_.start(); }
 
+ private:
+  ::v8::internal::EmbeddedVector<uint16_t, 1> empty_;
+};
 
-TEST(InterceptorPropertyMirror) {
-  // Create a V8 environment with debug access.
-  DebugLocalContext env;
+TEST(DebugScriptLineEndsAreAscending) {
+  LocalContext env;
   v8::Isolate* isolate = env->GetIsolate();
   v8::HandleScope scope(isolate);
-  env.ExposeDebug();
-
-  v8::Local<v8::Context> context = env.context();
-  // Create object with named interceptor.
-  v8::Local<v8::ObjectTemplate> named = v8::ObjectTemplate::New(isolate);
-  named->SetHandler(v8::NamedPropertyHandlerConfiguration(
-      NamedGetter, nullptr, nullptr, nullptr, NamedEnum));
-  CHECK(env->Global()
-            ->Set(context, v8_str(isolate, "intercepted_named"),
-                  named->NewInstance(context).ToLocalChecked())
-            .FromJust());
 
-  // Create object with indexed interceptor.
-  v8::Local<v8::ObjectTemplate> indexed = v8::ObjectTemplate::New(isolate);
-  indexed->SetHandler(v8::IndexedPropertyHandlerConfiguration(
-      IndexedGetter, nullptr, nullptr, nullptr, IndexedEnum));
-  CHECK(env->Global()
-            ->Set(context, v8_str(isolate, "intercepted_indexed"),
-                  indexed->NewInstance(context).ToLocalChecked())
-            .FromJust());
+  // Compile a test script.
+  v8::Local<v8::String> script = v8_str(isolate,
+                                        "function f() {\n"
+                                        "  debugger;\n"
+                                        "}\n");
 
-  // Create object with both named and indexed interceptor.
-  v8::Local<v8::ObjectTemplate> both = v8::ObjectTemplate::New(isolate);
-  both->SetHandler(v8::NamedPropertyHandlerConfiguration(
-      NamedGetter, nullptr, nullptr, nullptr, NamedEnum));
-  both->SetHandler(v8::IndexedPropertyHandlerConfiguration(
-      IndexedGetter, nullptr, nullptr, nullptr, IndexedEnum));
-  CHECK(env->Global()
-            ->Set(context, v8_str(isolate, "intercepted_both"),
-                  both->NewInstance(context).ToLocalChecked())
-            .FromJust());
+  v8::ScriptOrigin origin1 = v8::ScriptOrigin(v8_str(isolate, "name"));
+  v8::Local<v8::Script> script1 =
+      v8::Script::Compile(env.local(), script, &origin1).ToLocalChecked();
+  USE(script1);
 
-  // Get mirrors for the three objects with interceptor.
-  CompileRun(
-      "var named_mirror = debug.MakeMirror(intercepted_named);"
-      "var indexed_mirror = debug.MakeMirror(intercepted_indexed);"
-      "var both_mirror = debug.MakeMirror(intercepted_both)");
-  CHECK(CompileRun("named_mirror instanceof debug.ObjectMirror")
-            ->BooleanValue(context)
-            .FromJust());
-  CHECK(CompileRun("indexed_mirror instanceof debug.ObjectMirror")
-            ->BooleanValue(context)
-            .FromJust());
-  CHECK(CompileRun("both_mirror instanceof debug.ObjectMirror")
-            ->BooleanValue(context)
-            .FromJust());
-
-  // Get the property names from the interceptors
-  CompileRun(
-      "named_names = named_mirror.propertyNames();"
-      "indexed_names = indexed_mirror.propertyNames();"
-      "both_names = both_mirror.propertyNames()");
-  CHECK_EQ(3, CompileRun("named_names.length")->Int32Value(context).FromJust());
-  CHECK_EQ(2,
-           CompileRun("indexed_names.length")->Int32Value(context).FromJust());
-  CHECK_EQ(5, CompileRun("both_names.length")->Int32Value(context).FromJust());
-
-  // Check the expected number of properties.
-  const char* source;
-  source = "named_mirror.properties().length";
-  CHECK_EQ(3, CompileRun(source)->Int32Value(context).FromJust());
-
-  source = "indexed_mirror.properties().length";
-  CHECK_EQ(2, CompileRun(source)->Int32Value(context).FromJust());
-
-  source = "both_mirror.properties().length";
-  CHECK_EQ(5, CompileRun(source)->Int32Value(context).FromJust());
-
-  // Get the interceptor properties for the object with only named interceptor.
-  CompileRun("var named_values = named_mirror.properties()");
-
-  // Check that the properties are interceptor properties.
-  for (int i = 0; i < 3; i++) {
-    EmbeddedVector<char, SMALL_STRING_BUFFER_SIZE> buffer;
-    SNPrintF(buffer,
-             "named_values[%d] instanceof debug.PropertyMirror", i);
-    CHECK(CompileRun(buffer.start())->BooleanValue(context).FromJust());
-
-    SNPrintF(buffer, "named_values[%d].isNative()", i);
-    CHECK(CompileRun(buffer.start())->BooleanValue(context).FromJust());
-  }
-
-  // Get the interceptor properties for the object with only indexed
-  // interceptor.
-  CompileRun("var indexed_values = indexed_mirror.properties()");
-
-  // Check that the properties are interceptor properties.
-  for (int i = 0; i < 2; i++) {
-    EmbeddedVector<char, SMALL_STRING_BUFFER_SIZE> buffer;
-    SNPrintF(buffer,
-             "indexed_values[%d] instanceof debug.PropertyMirror", i);
-    CHECK(CompileRun(buffer.start())->BooleanValue(context).FromJust());
-  }
-
-  // Get the interceptor properties for the object with both types of
-  // interceptors.
-  CompileRun("var both_values = both_mirror.properties()");
-
-  // Check that the properties are interceptor properties.
-  for (int i = 0; i < 5; i++) {
-    EmbeddedVector<char, SMALL_STRING_BUFFER_SIZE> buffer;
-    SNPrintF(buffer, "both_values[%d] instanceof debug.PropertyMirror", i);
-    CHECK(CompileRun(buffer.start())->BooleanValue(context).FromJust());
-  }
-
-  // Check the property names.
-  source = "both_values[0].name() == '1'";
-  CHECK(CompileRun(source)->BooleanValue(context).FromJust());
-
-  source = "both_values[1].name() == '10'";
-  CHECK(CompileRun(source)->BooleanValue(context).FromJust());
-
-  source = "both_values[2].name() == 'a'";
-  CHECK(CompileRun(source)->BooleanValue(context).FromJust());
-
-  source = "both_values[3].name() == 'b'";
-  CHECK(CompileRun(source)->BooleanValue(context).FromJust());
-
-  source = "both_values[4].name() == 'c'";
-  CHECK(CompileRun(source)->BooleanValue(context).FromJust());
-}
-
-
-TEST(HiddenPrototypePropertyMirror) {
-  // Create a V8 environment with debug access.
-  DebugLocalContext env;
-  v8::Isolate* isolate = env->GetIsolate();
-  v8::HandleScope scope(isolate);
-  env.ExposeDebug();
-
-  v8::Local<v8::FunctionTemplate> t0 = v8::FunctionTemplate::New(isolate);
-  t0->InstanceTemplate()->Set(v8_str(isolate, "x"),
-                              v8::Number::New(isolate, 0));
-  v8::Local<v8::FunctionTemplate> t1 = v8::FunctionTemplate::New(isolate);
-  t1->SetHiddenPrototype(true);
-  t1->InstanceTemplate()->Set(v8_str(isolate, "y"),
-                              v8::Number::New(isolate, 1));
-  v8::Local<v8::FunctionTemplate> t2 = v8::FunctionTemplate::New(isolate);
-  t2->SetHiddenPrototype(true);
-  t2->InstanceTemplate()->Set(v8_str(isolate, "z"),
-                              v8::Number::New(isolate, 2));
-  v8::Local<v8::FunctionTemplate> t3 = v8::FunctionTemplate::New(isolate);
-  t3->InstanceTemplate()->Set(v8_str(isolate, "u"),
-                              v8::Number::New(isolate, 3));
-
-  v8::Local<v8::Context> context = env.context();
-  // Create object and set them on the global object.
-  v8::Local<v8::Object> o0 = t0->GetFunction(context)
-                                 .ToLocalChecked()
-                                 ->NewInstance(context)
-                                 .ToLocalChecked();
-  CHECK(env->Global()->Set(context, v8_str(isolate, "o0"), o0).FromJust());
-  v8::Local<v8::Object> o1 = t1->GetFunction(context)
-                                 .ToLocalChecked()
-                                 ->NewInstance(context)
-                                 .ToLocalChecked();
-  CHECK(env->Global()->Set(context, v8_str(isolate, "o1"), o1).FromJust());
-  v8::Local<v8::Object> o2 = t2->GetFunction(context)
-                                 .ToLocalChecked()
-                                 ->NewInstance(context)
-                                 .ToLocalChecked();
-  CHECK(env->Global()->Set(context, v8_str(isolate, "o2"), o2).FromJust());
-  v8::Local<v8::Object> o3 = t3->GetFunction(context)
-                                 .ToLocalChecked()
-                                 ->NewInstance(context)
-                                 .ToLocalChecked();
-  CHECK(env->Global()->Set(context, v8_str(isolate, "o3"), o3).FromJust());
-
-  // Get mirrors for the four objects.
-  CompileRun(
-      "var o0_mirror = debug.MakeMirror(o0);"
-      "var o1_mirror = debug.MakeMirror(o1);"
-      "var o2_mirror = debug.MakeMirror(o2);"
-      "var o3_mirror = debug.MakeMirror(o3)");
-  CHECK(CompileRun("o0_mirror instanceof debug.ObjectMirror")
-            ->BooleanValue(context)
-            .FromJust());
-  CHECK(CompileRun("o1_mirror instanceof debug.ObjectMirror")
-            ->BooleanValue(context)
-            .FromJust());
-  CHECK(CompileRun("o2_mirror instanceof debug.ObjectMirror")
-            ->BooleanValue(context)
-            .FromJust());
-  CHECK(CompileRun("o3_mirror instanceof debug.ObjectMirror")
-            ->BooleanValue(context)
-            .FromJust());
-
-  // Check that each object has one property.
-  CHECK_EQ(1, CompileRun("o0_mirror.propertyNames().length")
-                  ->Int32Value(context)
-                  .FromJust());
-  CHECK_EQ(1, CompileRun("o1_mirror.propertyNames().length")
-                  ->Int32Value(context)
-                  .FromJust());
-  CHECK_EQ(1, CompileRun("o2_mirror.propertyNames().length")
-                  ->Int32Value(context)
-                  .FromJust());
-  CHECK_EQ(1, CompileRun("o3_mirror.propertyNames().length")
-                  ->Int32Value(context)
-                  .FromJust());
-
-  // Set o1 as prototype for o0. o1 has the hidden prototype flag so all
-  // properties on o1 should be seen on o0.
-  CHECK(o0->Set(context, v8_str(isolate, "__proto__"), o1).FromJust());
-  CHECK_EQ(2, CompileRun("o0_mirror.propertyNames().length")
-                  ->Int32Value(context)
-                  .FromJust());
-  CHECK_EQ(0, CompileRun("o0_mirror.property('x').value().value()")
-                  ->Int32Value(context)
-                  .FromJust());
-  CHECK_EQ(1, CompileRun("o0_mirror.property('y').value().value()")
-                  ->Int32Value(context)
-                  .FromJust());
-
-  // Set o2 as prototype for o0 (it will end up after o1 as o1 has the hidden
-  // prototype flag. o2 also has the hidden prototype flag so all properties
-  // on o2 should be seen on o0 as well as properties on o1.
-  CHECK(o0->Set(context, v8_str(isolate, "__proto__"), o2).FromJust());
-  CHECK_EQ(3, CompileRun("o0_mirror.propertyNames().length")
-                  ->Int32Value(context)
-                  .FromJust());
-  CHECK_EQ(0, CompileRun("o0_mirror.property('x').value().value()")
-                  ->Int32Value(context)
-                  .FromJust());
-  CHECK_EQ(1, CompileRun("o0_mirror.property('y').value().value()")
-                  ->Int32Value(context)
-                  .FromJust());
-  CHECK_EQ(2, CompileRun("o0_mirror.property('z').value().value()")
-                  ->Int32Value(context)
-                  .FromJust());
-
-  // Set o3 as prototype for o0 (it will end up after o1 and o2 as both o1 and
-  // o2 has the hidden prototype flag. o3 does not have the hidden prototype
-  // flag so properties on o3 should not be seen on o0 whereas the properties
-  // from o1 and o2 should still be seen on o0.
-  // Final prototype chain: o0 -> o1 -> o2 -> o3
-  // Hidden prototypes:           ^^    ^^
-  CHECK(o0->Set(context, v8_str(isolate, "__proto__"), o3).FromJust());
-  CHECK_EQ(3, CompileRun("o0_mirror.propertyNames().length")
-                  ->Int32Value(context)
-                  .FromJust());
-  CHECK_EQ(1, CompileRun("o3_mirror.propertyNames().length")
-                  ->Int32Value(context)
-                  .FromJust());
-  CHECK_EQ(0, CompileRun("o0_mirror.property('x').value().value()")
-                  ->Int32Value(context)
-                  .FromJust());
-  CHECK_EQ(1, CompileRun("o0_mirror.property('y').value().value()")
-                  ->Int32Value(context)
-                  .FromJust());
-  CHECK_EQ(2, CompileRun("o0_mirror.property('z').value().value()")
-                  ->Int32Value(context)
-                  .FromJust());
-  CHECK(CompileRun("o0_mirror.property('u').isUndefined()")
-            ->BooleanValue(context)
-            .FromJust());
-
-  // The prototype (__proto__) for o0 should be o3 as o1 and o2 are hidden.
-  CHECK(CompileRun("o0_mirror.protoObject().value() == o3_mirror.value()")
-            ->BooleanValue(context)
-            .FromJust());
-}
-
-
-static void ProtperyXNativeGetter(
-    v8::Local<v8::String> property,
-    const v8::PropertyCallbackInfo<v8::Value>& info) {
-  info.GetReturnValue().Set(10);
-}
-
-
-TEST(NativeGetterPropertyMirror) {
-  // Create a V8 environment with debug access.
-  DebugLocalContext env;
-  v8::Isolate* isolate = env->GetIsolate();
-  v8::HandleScope scope(isolate);
-  env.ExposeDebug();
-
-  v8::Local<v8::Context> context = env.context();
-  v8::Local<v8::String> name = v8_str(isolate, "x");
-  // Create object with named accessor.
-  v8::Local<v8::ObjectTemplate> named = v8::ObjectTemplate::New(isolate);
-  named->SetAccessor(name, &ProtperyXNativeGetter, nullptr,
-                     v8::Local<v8::Value>(), v8::DEFAULT, v8::None);
-
-  // Create object with named property getter.
-  CHECK(env->Global()
-            ->Set(context, v8_str(isolate, "instance"),
-                  named->NewInstance(context).ToLocalChecked())
-            .FromJust());
-  CHECK_EQ(10, CompileRun("instance.x")->Int32Value(context).FromJust());
-
-  // Get mirror for the object with property getter.
-  CompileRun("var instance_mirror = debug.MakeMirror(instance);");
-  CHECK(CompileRun("instance_mirror instanceof debug.ObjectMirror")
-            ->BooleanValue(context)
-            .FromJust());
-
-  CompileRun("var named_names = instance_mirror.propertyNames();");
-  CHECK_EQ(1, CompileRun("named_names.length")->Int32Value(context).FromJust());
-  CHECK(CompileRun("named_names[0] == 'x'")->BooleanValue(context).FromJust());
-  CHECK(CompileRun("instance_mirror.property('x').value().isNumber()")
-            ->BooleanValue(context)
-            .FromJust());
-  CHECK(CompileRun("instance_mirror.property('x').value().value() == 10")
-            ->BooleanValue(context)
-            .FromJust());
-}
-
-
-static void ProtperyXNativeGetterThrowingError(
-    v8::Local<v8::String> property,
-    const v8::PropertyCallbackInfo<v8::Value>& info) {
-  CompileRun("throw new Error('Error message');");
-}
-
-
-TEST(NativeGetterThrowingErrorPropertyMirror) {
-  // Create a V8 environment with debug access.
-  DebugLocalContext env;
-  v8::Isolate* isolate = env->GetIsolate();
-  v8::HandleScope scope(isolate);
-  env.ExposeDebug();
-
-  v8::Local<v8::Context> context = env.context();
-  v8::Local<v8::String> name = v8_str(isolate, "x");
-  // Create object with named accessor.
-  v8::Local<v8::ObjectTemplate> named = v8::ObjectTemplate::New(isolate);
-  named->SetAccessor(name, &ProtperyXNativeGetterThrowingError, nullptr,
-                     v8::Local<v8::Value>(), v8::DEFAULT, v8::None);
-
-  // Create object with named property getter.
-  CHECK(env->Global()
-            ->Set(context, v8_str(isolate, "instance"),
-                  named->NewInstance(context).ToLocalChecked())
-            .FromJust());
-
-  // Get mirror for the object with property getter.
-  CompileRun("var instance_mirror = debug.MakeMirror(instance);");
-  CHECK(CompileRun("instance_mirror instanceof debug.ObjectMirror")
-            ->BooleanValue(context)
-            .FromJust());
-  CompileRun("named_names = instance_mirror.propertyNames();");
-  CHECK_EQ(1, CompileRun("named_names.length")->Int32Value(context).FromJust());
-  CHECK(CompileRun("named_names[0] == 'x'")->BooleanValue(context).FromJust());
-  CHECK(CompileRun("instance_mirror.property('x').value().isError()")
-            ->BooleanValue(context)
-            .FromJust());
-
-  // Check that the message is that passed to the Error constructor.
-  CHECK(
-      CompileRun(
-          "instance_mirror.property('x').value().message() == 'Error message'")
-          ->BooleanValue(context)
-          .FromJust());
-}
-
-
-// Test that hidden properties object is not returned as an unnamed property
-// among regular properties.
-// See http://crbug.com/26491
-TEST(NoHiddenProperties) {
-  // Create a V8 environment with debug access.
-  DebugLocalContext env;
-  v8::Isolate* isolate = env->GetIsolate();
-  v8::HandleScope scope(isolate);
-  env.ExposeDebug();
-
-  v8::Local<v8::Context> context = env.context();
-  // Create an object in the global scope.
-  const char* source = "var obj = {a: 1};";
-  v8::Script::Compile(context, v8_str(isolate, source))
-      .ToLocalChecked()
-      ->Run(context)
-      .ToLocalChecked();
-  v8::Local<v8::Object> obj = v8::Local<v8::Object>::Cast(
-      env->Global()->Get(context, v8_str(isolate, "obj")).ToLocalChecked());
-  // Set a hidden property on the object.
-  obj->SetPrivate(
-         env.context(),
-         v8::Private::New(isolate, v8_str(isolate, "v8::test-debug::a")),
-         v8::Int32::New(isolate, 11))
-      .FromJust();
-
-  // Get mirror for the object with property getter.
-  CompileRun("var obj_mirror = debug.MakeMirror(obj);");
-  CHECK(CompileRun("obj_mirror instanceof debug.ObjectMirror")
-            ->BooleanValue(context)
-            .FromJust());
-  CompileRun("var named_names = obj_mirror.propertyNames();");
-  // There should be exactly one property. But there is also an unnamed
-  // property whose value is hidden properties dictionary. The latter
-  // property should not be in the list of reguar properties.
-  CHECK_EQ(1, CompileRun("named_names.length")->Int32Value(context).FromJust());
-  CHECK(CompileRun("named_names[0] == 'a'")->BooleanValue(context).FromJust());
-  CHECK(CompileRun("obj_mirror.property('a').value().value() == 1")
-            ->BooleanValue(context)
-            .FromJust());
-
-  // Object created by t0 will become hidden prototype of object 'obj'.
-  v8::Local<v8::FunctionTemplate> t0 = v8::FunctionTemplate::New(isolate);
-  t0->InstanceTemplate()->Set(v8_str(isolate, "b"),
-                              v8::Number::New(isolate, 2));
-  t0->SetHiddenPrototype(true);
-  v8::Local<v8::FunctionTemplate> t1 = v8::FunctionTemplate::New(isolate);
-  t1->InstanceTemplate()->Set(v8_str(isolate, "c"),
-                              v8::Number::New(isolate, 3));
-
-  // Create proto objects, add hidden properties to them and set them on
-  // the global object.
-  v8::Local<v8::Object> protoObj = t0->GetFunction(context)
-                                       .ToLocalChecked()
-                                       ->NewInstance(context)
-                                       .ToLocalChecked();
-  protoObj->SetPrivate(
-              env.context(),
-              v8::Private::New(isolate, v8_str(isolate, "v8::test-debug::b")),
-              v8::Int32::New(isolate, 12))
-      .FromJust();
-  CHECK(env->Global()
-            ->Set(context, v8_str(isolate, "protoObj"), protoObj)
-            .FromJust());
-  v8::Local<v8::Object> grandProtoObj = t1->GetFunction(context)
-                                            .ToLocalChecked()
-                                            ->NewInstance(context)
-                                            .ToLocalChecked();
-  grandProtoObj->SetPrivate(env.context(),
-                            v8::Private::New(
-                                isolate, v8_str(isolate, "v8::test-debug::c")),
-                            v8::Int32::New(isolate, 13))
-      .FromJust();
-  CHECK(env->Global()
-            ->Set(context, v8_str(isolate, "grandProtoObj"), grandProtoObj)
-            .FromJust());
-
-  // Setting prototypes: obj->protoObj->grandProtoObj
-  CHECK(protoObj->Set(context, v8_str(isolate, "__proto__"), grandProtoObj)
-            .FromJust());
-  CHECK(obj->Set(context, v8_str(isolate, "__proto__"), protoObj).FromJust());
-
-  // Get mirror for the object with property getter.
-  CompileRun("var obj_mirror = debug.MakeMirror(obj);");
-  CHECK(CompileRun("obj_mirror instanceof debug.ObjectMirror")
-            ->BooleanValue(context)
-            .FromJust());
-  CompileRun("var named_names = obj_mirror.propertyNames();");
-  // There should be exactly two properties - one from the object itself and
-  // another from its hidden prototype.
-  CHECK_EQ(2, CompileRun("named_names.length")->Int32Value(context).FromJust());
-  CHECK(CompileRun("named_names.sort(); named_names[0] == 'a' &&"
-                   "named_names[1] == 'b'")
-            ->BooleanValue(context)
-            .FromJust());
-  CHECK(CompileRun("obj_mirror.property('a').value().value() == 1")
-            ->BooleanValue(context)
-            .FromJust());
-  CHECK(CompileRun("obj_mirror.property('b').value().value() == 2")
-            ->BooleanValue(context)
-            .FromJust());
-}
-
-
-TEST(SetDebugEventListenerOnUninitializedVM) {
-  v8::HandleScope scope(CcTest::isolate());
-  EnableDebugger(CcTest::isolate());
-}
-
-// Source for a JavaScript function which returns the data parameter of a
-// function called in the context of the debugger. If no data parameter is
-// passed it throws an exception.
-static const char* debugger_call_with_data_source =
-    "function debugger_call_with_data(exec_state, data) {"
-    "  if (data) return data;"
-    "  throw 'No data!'"
-    "}";
-v8::Local<v8::Function> debugger_call_with_data;
-
-
-// Source for a JavaScript function which returns the data parameter of a
-// function called in the context of the debugger. If no data parameter is
-// passed it throws an exception.
-static const char* debugger_call_with_closure_source =
-    "var x = 3;"
-    "(function (exec_state) {"
-    "  if (exec_state.y) return x - 1;"
-    "  exec_state.y = x;"
-    "  return exec_state.y"
-    "})";
-v8::Local<v8::Function> debugger_call_with_closure;
-
-// Function to retrieve the number of JavaScript frames by calling a JavaScript
-// in the debugger.
-static void CheckFrameCount(const v8::FunctionCallbackInfo<v8::Value>& args) {
-  v8::Local<v8::Context> context = args.GetIsolate()->GetCurrentContext();
-  CHECK(v8::debug::Call(context, frame_count).ToLocalChecked()->IsNumber());
-  CHECK_EQ(args[0]->Int32Value(context).FromJust(),
-           v8::debug::Call(context, frame_count)
-               .ToLocalChecked()
-               ->Int32Value(context)
-               .FromJust());
-}
-
-
-// Function to retrieve the source line of the top JavaScript frame by calling a
-// JavaScript function in the debugger.
-static void CheckSourceLine(const v8::FunctionCallbackInfo<v8::Value>& args) {
-  v8::Local<v8::Context> context = args.GetIsolate()->GetCurrentContext();
-  CHECK(
-      v8::debug::Call(context, frame_source_line).ToLocalChecked()->IsNumber());
-  CHECK_EQ(args[0]->Int32Value(context).FromJust(),
-           v8::debug::Call(context, frame_source_line)
-               .ToLocalChecked()
-               ->Int32Value(context)
-               .FromJust());
-}
-
-
-// Function to test passing an additional parameter to a JavaScript function
-// called in the debugger. It also tests that functions called in the debugger
-// can throw exceptions.
-static void CheckDataParameter(
-    const v8::FunctionCallbackInfo<v8::Value>& args) {
-  v8::Local<v8::String> data = v8_str(args.GetIsolate(), "Test");
-  v8::Local<v8::Context> context = args.GetIsolate()->GetCurrentContext();
-  CHECK(v8::debug::Call(context, debugger_call_with_data, data)
-            .ToLocalChecked()
-            ->IsString());
-
-  for (int i = 0; i < 3; i++) {
-    v8::TryCatch catcher(args.GetIsolate());
-    CHECK(v8::debug::Call(context, debugger_call_with_data).IsEmpty());
-    CHECK(catcher.HasCaught());
-    CHECK(catcher.Exception()->IsString());
-  }
-}
-
-
-// Function to test using a JavaScript with closure in the debugger.
-static void CheckClosure(const v8::FunctionCallbackInfo<v8::Value>& args) {
-  v8::Local<v8::Context> context = args.GetIsolate()->GetCurrentContext();
-  CHECK(v8::debug::Call(context, debugger_call_with_closure)
-            .ToLocalChecked()
-            ->IsNumber());
-  CHECK_EQ(3, v8::debug::Call(context, debugger_call_with_closure)
-                  .ToLocalChecked()
-                  ->Int32Value(context)
-                  .FromJust());
-}
-
-
-// Test functions called through the debugger.
-TEST(CallFunctionInDebugger) {
-  // Create and enter a context with the functions CheckFrameCount,
-  // CheckSourceLine and CheckDataParameter installed.
-  v8::Isolate* isolate = CcTest::isolate();
-  v8::HandleScope scope(isolate);
-  v8::Local<v8::ObjectTemplate> global_template =
-      v8::ObjectTemplate::New(isolate);
-  global_template->Set(v8_str(isolate, "CheckFrameCount"),
-                       v8::FunctionTemplate::New(isolate, CheckFrameCount));
-  global_template->Set(v8_str(isolate, "CheckSourceLine"),
-                       v8::FunctionTemplate::New(isolate, CheckSourceLine));
-  global_template->Set(v8_str(isolate, "CheckDataParameter"),
-                       v8::FunctionTemplate::New(isolate, CheckDataParameter));
-  global_template->Set(v8_str(isolate, "CheckClosure"),
-                       v8::FunctionTemplate::New(isolate, CheckClosure));
-  v8::Local<v8::Context> context =
-      v8::Context::New(isolate, nullptr, global_template);
-  v8::Context::Scope context_scope(context);
-
-  // Compile a function for checking the number of JavaScript frames.
-  v8::Script::Compile(context, v8_str(isolate, frame_count_source))
-      .ToLocalChecked()
-      ->Run(context)
-      .ToLocalChecked();
-  frame_count = v8::Local<v8::Function>::Cast(
-      context->Global()
-          ->Get(context, v8_str(isolate, "frame_count"))
-          .ToLocalChecked());
-
-  // Compile a function for returning the source line for the top frame.
-  v8::Script::Compile(context, v8_str(isolate, frame_source_line_source))
-      .ToLocalChecked()
-      ->Run(context)
-      .ToLocalChecked();
-  frame_source_line = v8::Local<v8::Function>::Cast(
-      context->Global()
-          ->Get(context, v8_str(isolate, "frame_source_line"))
-          .ToLocalChecked());
-
-  // Compile a function returning the data parameter.
-  v8::Script::Compile(context, v8_str(isolate, debugger_call_with_data_source))
-      .ToLocalChecked()
-      ->Run(context)
-      .ToLocalChecked();
-  debugger_call_with_data = v8::Local<v8::Function>::Cast(
-      context->Global()
-          ->Get(context, v8_str(isolate, "debugger_call_with_data"))
-          .ToLocalChecked());
-
-  // Compile a function capturing closure.
-  debugger_call_with_closure = v8::Local<v8::Function>::Cast(
-      v8::Script::Compile(context,
-                          v8_str(isolate, debugger_call_with_closure_source))
-          .ToLocalChecked()
-          ->Run(context)
-          .ToLocalChecked());
-
-  // Calling a function through the debugger returns 0 frames if there are
-  // no JavaScript frames.
-  CHECK(v8::Integer::New(isolate, 0)
-            ->Equals(context,
-                     v8::debug::Call(context, frame_count).ToLocalChecked())
-            .FromJust());
-
-  // Test that the number of frames can be retrieved.
-  v8::Script::Compile(context, v8_str(isolate, "CheckFrameCount(1)"))
-      .ToLocalChecked()
-      ->Run(context)
-      .ToLocalChecked();
-  v8::Script::Compile(context, v8_str(isolate,
-                                      "function f() {"
-                                      "  CheckFrameCount(2);"
-                                      "}; f()"))
-      .ToLocalChecked()
-      ->Run(context)
-      .ToLocalChecked();
-
-  // Test that the source line can be retrieved.
-  v8::Script::Compile(context, v8_str(isolate, "CheckSourceLine(0)"))
-      .ToLocalChecked()
-      ->Run(context)
-      .ToLocalChecked();
-  v8::Script::Compile(context, v8_str(isolate,
-                                      "function f() {\n"
-                                      "  CheckSourceLine(1)\n"
-                                      "  CheckSourceLine(2)\n"
-                                      "  CheckSourceLine(3)\n"
-                                      "}; f()"))
-      .ToLocalChecked()
-      ->Run(context)
-      .ToLocalChecked();
-
-  // Test that a parameter can be passed to a function called in the debugger.
-  v8::Script::Compile(context, v8_str(isolate, "CheckDataParameter()"))
-      .ToLocalChecked()
-      ->Run(context)
-      .ToLocalChecked();
-
-  // Test that a function with closure can be run in the debugger.
-  v8::Script::Compile(context, v8_str(isolate, "CheckClosure()"))
-      .ToLocalChecked()
-      ->Run(context)
-      .ToLocalChecked();
-
-  // Test that the source line is correct when there is a line offset.
-  v8::ScriptOrigin origin(v8_str(isolate, "test"),
-                          v8::Integer::New(isolate, 7));
-  v8::Script::Compile(context, v8_str(isolate, "CheckSourceLine(7)"), &origin)
-      .ToLocalChecked()
-      ->Run(context)
-      .ToLocalChecked();
-  v8::Script::Compile(context, v8_str(isolate,
-                                      "function f() {\n"
-                                      "  CheckSourceLine(8)\n"
-                                      "  CheckSourceLine(9)\n"
-                                      "  CheckSourceLine(10)\n"
-                                      "}; f()"),
-                      &origin)
-      .ToLocalChecked()
-      ->Run(context)
-      .ToLocalChecked();
-}
-
-
-// Test that clearing the debug event listener actually clears all break points
-// and related information.
-TEST(DebuggerUnload) {
-  DebugLocalContext env;
-
-  // Check debugger is unloaded before it is used.
-  CheckDebuggerUnloaded();
-
-  // Set a debug event listener.
-  break_point_hit_count = 0;
-  SetDebugEventListener(env->GetIsolate(), DebugEventBreakPointHitCount);
-  v8::Local<v8::Context> context = env.context();
-  {
-    v8::HandleScope scope(env->GetIsolate());
-    // Create a couple of functions for the test.
-    v8::Local<v8::Function> foo =
-        CompileFunction(&env, "function foo(){x=1}", "foo");
-    v8::Local<v8::Function> bar =
-        CompileFunction(&env, "function bar(){y=2}", "bar");
-
-    // Set some break points.
-    SetBreakPoint(foo, 0);
-    SetBreakPoint(foo, 4);
-    SetBreakPoint(bar, 0);
-    SetBreakPoint(bar, 4);
-
-    // Make sure that the break points are there.
-    break_point_hit_count = 0;
-    foo->Call(context, env->Global(), 0, nullptr).ToLocalChecked();
-    CHECK_EQ(2, break_point_hit_count);
-    bar->Call(context, env->Global(), 0, nullptr).ToLocalChecked();
-    CHECK_EQ(4, break_point_hit_count);
-  }
-
-  // Remove the debug event listener without clearing breakpoints. Do this
-  // outside a handle scope.
-  SetDebugEventListener(env->GetIsolate(), nullptr);
-  CheckDebuggerUnloaded();
-}
-
-int event_listener_hit_count = 0;
-
-// Debugger event listener which clears itself while active.
-static void EventListenerClearingItself(
-    const v8::Debug::EventDetails& details) {
-  event_listener_hit_count++;
-
-  // Clear debug event listener.
-  SetDebugEventListener(details.GetIsolate(), nullptr);
-}
-
-
-// Test clearing the debug message handler while processing a debug event.
-TEST(DebuggerClearEventListenerWhileActive) {
-  DebugLocalContext env;
-  v8::HandleScope scope(env->GetIsolate());
-
-  // Check debugger is unloaded before it is used.
-  CheckDebuggerUnloaded();
-
-  // Set a debug event listener.
-  SetDebugEventListener(env->GetIsolate(), EventListenerClearingItself);
-
-  // Run code to throw an uncaught exception. This should trigger the listener.
-  CompileRun("throw 1");
-
-  // The event listener should have been called.
-  CHECK_EQ(1, event_listener_hit_count);
-
-  CheckDebuggerUnloaded();
-}
-
-// Test for issue http://code.google.com/p/v8/issues/detail?id=289.
-// Make sure that DebugGetLoadedScripts doesn't return scripts
-// with disposed external source.
-class EmptyExternalStringResource : public v8::String::ExternalStringResource {
- public:
-  EmptyExternalStringResource() { empty_[0] = 0; }
-  virtual ~EmptyExternalStringResource() {}
-  virtual size_t length() const { return empty_.length(); }
-  virtual const uint16_t* data() const { return empty_.start(); }
- private:
-  ::v8::internal::EmbeddedVector<uint16_t, 1> empty_;
-};
-
-TEST(DebugScriptLineEndsAreAscending) {
-  DebugLocalContext env;
-  v8::Isolate* isolate = env->GetIsolate();
-  v8::HandleScope scope(isolate);
-  env.ExposeDebug();
-
-  // Compile a test script.
-  v8::Local<v8::String> script = v8_str(isolate,
-                                        "function f() {\n"
-                                        "  debugger;\n"
-                                        "}\n");
-
-  v8::ScriptOrigin origin1 = v8::ScriptOrigin(v8_str(isolate, "name"));
-  v8::Local<v8::Script> script1 =
-      v8::Script::Compile(env.context(), script, &origin1).ToLocalChecked();
-  USE(script1);
-
-  Handle<v8::internal::FixedArray> instances;
-  {
-    v8::internal::Debug* debug = CcTest::i_isolate()->debug();
-    v8::internal::DebugScope debug_scope(debug);
-    CHECK(!debug_scope.failed());
-    instances = debug->GetLoadedScripts();
-  }
+  Handle<v8::internal::FixedArray> instances;
+  {
+    v8::internal::Debug* debug = CcTest::i_isolate()->debug();
+    instances = debug->GetLoadedScripts();
+  }
 
   CHECK_GT(instances->length(), 0);
   for (int i = 0; i < instances->length(); i++) {
     Handle<v8::internal::Script> script = Handle<v8::internal::Script>(
-        v8::internal::Script::cast(instances->get(i)));
+        v8::internal::Script::cast(instances->get(i)), CcTest::i_isolate());
 
     v8::internal::Script::InitLineEnds(script);
     v8::internal::FixedArray* ends =
@@ -4980,105 +3063,41 @@ TEST(DebugScriptLineEndsAreAscending) {
   }
 }
 
-
-// Test script break points set on lines.
-TEST(ScriptNameAndData) {
-  DebugLocalContext env;
-  v8::HandleScope scope(env->GetIsolate());
-  env.ExposeDebug();
-
-  // Create functions for retrieving script name and data for the function on
-  // the top frame when hitting a break point.
-  frame_script_name = CompileFunction(&env,
-                                      frame_script_name_source,
-                                      "frame_script_name");
-
-  SetDebugEventListener(env->GetIsolate(), DebugEventBreakPointHitCount);
-
-  v8::Local<v8::Context> context = env.context();
-  // Test function source.
-  v8::Local<v8::String> script = v8_str(env->GetIsolate(),
-                                        "function f() {\n"
-                                        "  debugger;\n"
-                                        "}\n");
-
-  v8::ScriptOrigin origin1 =
-      v8::ScriptOrigin(v8_str(env->GetIsolate(), "name"));
-  v8::Local<v8::Script> script1 =
-      v8::Script::Compile(context, script, &origin1).ToLocalChecked();
-  script1->Run(context).ToLocalChecked();
-  v8::Local<v8::Function> f;
-  f = v8::Local<v8::Function>::Cast(
-      env->Global()
-          ->Get(context, v8_str(env->GetIsolate(), "f"))
-          .ToLocalChecked());
-
-  f->Call(context, env->Global(), 0, nullptr).ToLocalChecked();
-  CHECK_EQ(1, break_point_hit_count);
-  CHECK_EQ(0, strcmp("name", last_script_name_hit));
-
-  // Compile the same script again without setting data. As the compilation
-  // cache is disabled when debugging expect the data to be missing.
-  v8::Script::Compile(context, script, &origin1)
-      .ToLocalChecked()
-      ->Run(context)
-      .ToLocalChecked();
-  f = v8::Local<v8::Function>::Cast(
-      env->Global()
-          ->Get(context, v8_str(env->GetIsolate(), "f"))
-          .ToLocalChecked());
-  f->Call(context, env->Global(), 0, nullptr).ToLocalChecked();
-  CHECK_EQ(2, break_point_hit_count);
-  CHECK_EQ(0, strcmp("name", last_script_name_hit));
-
-  v8::Local<v8::String> data_obj_source =
-      v8_str(env->GetIsolate(),
-             "({ a: 'abc',\n"
-             "  b: 123,\n"
-             "  toString: function() { return this.a + ' ' + this.b; }\n"
-             "})\n");
-  v8::Script::Compile(context, data_obj_source)
-      .ToLocalChecked()
-      ->Run(context)
-      .ToLocalChecked();
-  v8::ScriptOrigin origin2 =
-      v8::ScriptOrigin(v8_str(env->GetIsolate(), "new name"));
-  v8::Local<v8::Script> script2 =
-      v8::Script::Compile(context, script, &origin2).ToLocalChecked();
-  script2->Run(context).ToLocalChecked();
-  f = v8::Local<v8::Function>::Cast(
-      env->Global()
-          ->Get(context, v8_str(env->GetIsolate(), "f"))
-          .ToLocalChecked());
-  f->Call(context, env->Global(), 0, nullptr).ToLocalChecked();
-  CHECK_EQ(3, break_point_hit_count);
-  CHECK_EQ(0, strcmp("new name", last_script_name_hit));
-
-  v8::Local<v8::Script> script3 =
-      v8::Script::Compile(context, script, &origin2).ToLocalChecked();
-  script3->Run(context).ToLocalChecked();
-  f = v8::Local<v8::Function>::Cast(
-      env->Global()
-          ->Get(context, v8_str(env->GetIsolate(), "f"))
-          .ToLocalChecked());
-  f->Call(context, env->Global(), 0, nullptr).ToLocalChecked();
-  CHECK_EQ(4, break_point_hit_count);
-}
-
-
 static v8::Local<v8::Context> expected_context;
 static v8::Local<v8::Value> expected_context_data;
 
+class ContextCheckEventListener : public v8::debug::DebugDelegate {
+ public:
+  void BreakProgramRequested(v8::Local<v8::Context> paused_context,
+                             const std::vector<v8::debug::BreakpointId>&
+                                 inspector_break_points_hit) override {
+    CheckContext();
+  }
+  void ScriptCompiled(v8::Local<v8::debug::Script> script, bool is_live_edited,
+                      bool has_compile_error) override {
+    CheckContext();
+  }
+  void ExceptionThrown(v8::Local<v8::Context> paused_context,
+                       v8::Local<v8::Value> exception,
+                       v8::Local<v8::Value> promise,
+                       bool is_uncaught) override {
+    CheckContext();
+  }
+  bool IsFunctionBlackboxed(v8::Local<v8::debug::Script> script,
+                            const v8::debug::Location& start,
+                            const v8::debug::Location& end) override {
+    CheckContext();
+    return false;
+  }
 
-// Check that the expected context is the one generating the debug event.
-static void ContextCheckEventListener(
-    const v8::Debug::EventDetails& event_details) {
-  CHECK(event_details.GetEventContext() == expected_context);
-  CHECK(event_details.GetEventContext()->GetEmbedderData(0)->StrictEquals(
-      expected_context_data));
-  event_listener_hit_count++;
-}
-
+ private:
+  void CheckContext() {
+    v8::Local<v8::Context> context = CcTest::isolate()->GetCurrentContext();
+    CHECK(context == expected_context);
+    CHECK(context->GetEmbedderData(0)->StrictEquals(expected_context_data));
+    event_listener_hit_count++;
+  }
+};
 
 // Test which creates two contexts and sets different embedder data on each.
 // Checks that this data is set correctly and that when the debug event
@@ -5098,7 +3117,8 @@ TEST(ContextData) {
   context_2 =
       v8::Context::New(isolate, nullptr, global_template, global_object);
 
-  SetDebugEventListener(isolate, ContextCheckEventListener);
+  ContextCheckEventListener delegate;
+  v8::debug::SetDebugDelegate(isolate, &delegate);
 
   // Default data value is undefined.
   CHECK_EQ(0, context_1->GetNumberOfEmbedderDataFields());
@@ -5124,7 +3144,6 @@ TEST(ContextData) {
     f->Call(context_1, context_1->Global(), 0, nullptr).ToLocalChecked();
   }
 
-
   // Enter and run function in the second context.
   {
     v8::Context::Scope context_scope(context_2);
@@ -5137,126 +3156,10 @@ TEST(ContextData) {
   // Two times compile event and two times break event.
   CHECK_GT(event_listener_hit_count, 3);
 
-  SetDebugEventListener(isolate, nullptr);
+  v8::debug::SetDebugDelegate(isolate, nullptr);
   CheckDebuggerUnloaded();
 }
 
-// Debug event listener which issues a debug break when it hits a break event.
-static int event_listener_break_hit_count = 0;
-static void DebugBreakEventListener(const v8::Debug::EventDetails& details) {
-  // Schedule a debug break for break events.
-  if (details.GetEvent() == v8::Break) {
-    event_listener_break_hit_count++;
-    if (event_listener_break_hit_count == 1) {
-      v8::debug::DebugBreak(details.GetIsolate());
-    }
-  }
-}
-
-// Test that a debug break can be scheduled while in a event listener.
-TEST(DebugBreakInEventListener) {
-  i::FLAG_turbo_inlining = false;  // Make sure g is not inlined into f.
-  DebugLocalContext env;
-  v8::HandleScope scope(env->GetIsolate());
-
-  SetDebugEventListener(env->GetIsolate(), DebugBreakEventListener);
-
-  v8::Local<v8::Context> context = env.context();
-  // Test functions.
-  const char* script = "function f() { debugger; g(); } function g() { }";
-  CompileRun(script);
-  v8::Local<v8::Function> f = v8::Local<v8::Function>::Cast(
-      env->Global()
-          ->Get(context, v8_str(env->GetIsolate(), "f"))
-          .ToLocalChecked());
-  v8::Local<v8::Function> g = v8::Local<v8::Function>::Cast(
-      env->Global()
-          ->Get(context, v8_str(env->GetIsolate(), "g"))
-          .ToLocalChecked());
-
-  // Call f then g. The debugger statement in f will cause a break which will
-  // cause another break.
-  f->Call(context, env->Global(), 0, nullptr).ToLocalChecked();
-  CHECK_EQ(2, event_listener_break_hit_count);
-  // Calling g will not cause any additional breaks.
-  g->Call(context, env->Global(), 0, nullptr).ToLocalChecked();
-  CHECK_EQ(2, event_listener_break_hit_count);
-}
-
-
-#ifndef V8_INTERPRETED_REGEXP
-// Debug event handler which gets the function on the top frame and schedules a
-// break a number of times.
-static void DebugEventDebugBreak(
-    const v8::Debug::EventDetails& event_details) {
-  v8::DebugEvent event = event_details.GetEvent();
-  v8::Local<v8::Object> exec_state = event_details.GetExecutionState();
-  v8::Local<v8::Context> context = CcTest::isolate()->GetCurrentContext();
-  if (event == v8::Break) {
-    break_point_hit_count++;
-
-    // Get the name of the top frame function.
-    if (!frame_function_name.IsEmpty()) {
-      // Get the name of the function.
-      const int argc = 2;
-      v8::Local<v8::Value> argv[argc] = {
-          exec_state, v8::Integer::New(CcTest::isolate(), 0)};
-      v8::Local<v8::Value> result =
-          frame_function_name->Call(context, exec_state, argc, argv)
-              .ToLocalChecked();
-      if (result->IsUndefined()) {
-        last_function_hit[0] = '\0';
-      } else {
-        CHECK(result->IsString());
-        v8::Local<v8::String> function_name(
-            result->ToString(context).ToLocalChecked());
-        function_name->WriteUtf8(last_function_hit);
-      }
-    }
-
-    // Keep forcing breaks.
-    if (break_point_hit_count < 20) {
-      v8::debug::DebugBreak(CcTest::isolate());
-    }
-  }
-}
-
-
-TEST(RegExpDebugBreak) {
-  // This test only applies to native regexps.
-  DebugLocalContext env;
-  v8::HandleScope scope(env->GetIsolate());
-  v8::Local<v8::Context> context = env.context();
-  // Create a function for checking the function when hitting a break point.
-  frame_function_name = CompileFunction(&env,
-                                        frame_function_name_source,
-                                        "frame_function_name");
-
-  // Test RegExp which matches white spaces and comments at the beginning of a
-  // source line.
-  const char* script =
-    "var sourceLineBeginningSkip = /^(?:[ \\v\\h]*(?:\\/\\*.*?\\*\\/)*)*/;\n"
-    "function f(s) { return s.match(sourceLineBeginningSkip)[0].length; }";
-
-  v8::Local<v8::Function> f = CompileFunction(env->GetIsolate(), script, "f");
-  const int argc = 1;
-  v8::Local<v8::Value> argv[argc] = {
-      v8_str(env->GetIsolate(), "  /* xxx */ a=0;")};
-  v8::Local<v8::Value> result =
-      f->Call(context, env->Global(), argc, argv).ToLocalChecked();
-  CHECK_EQ(12, result->Int32Value(context).FromJust());
-
-  SetDebugEventListener(env->GetIsolate(), DebugEventDebugBreak);
-  v8::debug::DebugBreak(env->GetIsolate());
-  result = f->Call(context, env->Global(), argc, argv).ToLocalChecked();
-
-  // Check that there was only one break event. Matching RegExp should not
-  // cause Break events.
-  CHECK_EQ(1, break_point_hit_count);
-  CHECK_EQ(0, strcmp("f", last_function_hit));
-}
-#endif  // V8_INTERPRETED_REGEXP
-
 // Test which creates a context and sets embedder data on it. Checks that this
 // data is set correctly and that when the debug event listener is called for
 // break event in an eval statement the expected context is the one returned by
@@ -5269,7 +3172,8 @@ TEST(EvalContextData) {
       v8::Local<v8::ObjectTemplate>();
   context_1 = v8::Context::New(CcTest::isolate(), nullptr, global_template);
 
-  SetDebugEventListener(CcTest::isolate(), ContextCheckEventListener);
+  ContextCheckEventListener delegate;
+  v8::debug::SetDebugDelegate(CcTest::isolate(), &delegate);
 
   // Contexts initially do not have embedder data fields.
   CHECK_EQ(0, context_1->GetNumberOfEmbedderDataFields());
@@ -5291,132 +3195,120 @@ TEST(EvalContextData) {
     f->Call(context_1, context_1->Global(), 0, nullptr).ToLocalChecked();
   }
 
-  SetDebugEventListener(CcTest::isolate(), nullptr);
+  v8::debug::SetDebugDelegate(CcTest::isolate(), nullptr);
 
   // One time compile event and one time break event.
   CHECK_GT(event_listener_hit_count, 2);
   CheckDebuggerUnloaded();
 }
 
-
-// Debug event listener which counts the after compile events.
-int after_compile_event_count = 0;
-static void AfterCompileEventListener(const v8::Debug::EventDetails& details) {
-  // Count the number of scripts collected.
-  if (details.GetEvent() == v8::AfterCompile) {
-    after_compile_event_count++;
+// Debug event listener which counts script compiled events.
+class ScriptCompiledDelegate : public v8::debug::DebugDelegate {
+ public:
+  void ScriptCompiled(v8::Local<v8::debug::Script>, bool,
+                      bool has_compile_error) override {
+    if (!has_compile_error) {
+      after_compile_event_count++;
+    } else {
+      compile_error_event_count++;
+    }
   }
-}
 
+  int after_compile_event_count = 0;
+  int compile_error_event_count = 0;
+};
 
 // Tests that after compile event is sent as many times as there are scripts
 // compiled.
 TEST(AfterCompileEventWhenEventListenerIsReset) {
-  DebugLocalContext env;
+  LocalContext env;
   v8::HandleScope scope(env->GetIsolate());
-  v8::Local<v8::Context> context = env.context();
+  v8::Local<v8::Context> context = env.local();
   const char* script = "var a=1";
 
-  SetDebugEventListener(env->GetIsolate(), AfterCompileEventListener);
+  ScriptCompiledDelegate delegate;
+  v8::debug::SetDebugDelegate(env->GetIsolate(), &delegate);
   v8::Script::Compile(context, v8_str(env->GetIsolate(), script))
       .ToLocalChecked()
       ->Run(context)
       .ToLocalChecked();
-  SetDebugEventListener(env->GetIsolate(), nullptr);
+  v8::debug::SetDebugDelegate(env->GetIsolate(), nullptr);
 
-  SetDebugEventListener(env->GetIsolate(), AfterCompileEventListener);
-  v8::debug::DebugBreak(env->GetIsolate());
+  v8::debug::SetDebugDelegate(env->GetIsolate(), &delegate);
+  v8::debug::SetBreakOnNextFunctionCall(env->GetIsolate());
   v8::Script::Compile(context, v8_str(env->GetIsolate(), script))
       .ToLocalChecked()
       ->Run(context)
       .ToLocalChecked();
 
   // Setting listener to nullptr should cause debugger unload.
-  SetDebugEventListener(env->GetIsolate(), nullptr);
+  v8::debug::SetDebugDelegate(env->GetIsolate(), nullptr);
   CheckDebuggerUnloaded();
 
   // Compilation cache should be disabled when debugger is active.
-  CHECK_EQ(2, after_compile_event_count);
-}
-
-
-// Syntax error event handler which counts a number of events.
-int compile_error_event_count = 0;
-
-static void CompileErrorEventCounterClear() {
-  compile_error_event_count = 0;
-}
-
-static void CompileErrorEventCounter(
-    const v8::Debug::EventDetails& event_details) {
-  v8::DebugEvent event = event_details.GetEvent();
-
-  if (event == v8::CompileError) {
-    compile_error_event_count++;
-  }
+  CHECK_EQ(2, delegate.after_compile_event_count);
 }
 
-
 // Tests that syntax error event is sent as many times as there are scripts
 // with syntax error compiled.
 TEST(SyntaxErrorEventOnSyntaxException) {
-  DebugLocalContext env;
+  LocalContext env;
   v8::HandleScope scope(env->GetIsolate());
 
   // For this test, we want to break on uncaught exceptions:
   ChangeBreakOnException(false, true);
 
-  SetDebugEventListener(env->GetIsolate(), CompileErrorEventCounter);
-  v8::Local<v8::Context> context = env.context();
-
-  CompileErrorEventCounterClear();
+  ScriptCompiledDelegate delegate;
+  v8::debug::SetDebugDelegate(env->GetIsolate(), &delegate);
+  v8::Local<v8::Context> context = env.local();
 
   // Check initial state.
-  CHECK_EQ(0, compile_error_event_count);
+  CHECK_EQ(0, delegate.compile_error_event_count);
 
   // Throws SyntaxError: Unexpected end of input
   CHECK(
       v8::Script::Compile(context, v8_str(env->GetIsolate(), "+++")).IsEmpty());
-  CHECK_EQ(1, compile_error_event_count);
+  CHECK_EQ(1, delegate.compile_error_event_count);
 
   CHECK(v8::Script::Compile(context, v8_str(env->GetIsolate(), "/sel\\/: \\"))
             .IsEmpty());
-  CHECK_EQ(2, compile_error_event_count);
+  CHECK_EQ(2, delegate.compile_error_event_count);
 
   v8::Local<v8::Script> script =
       v8::Script::Compile(context,
                           v8_str(env->GetIsolate(), "JSON.parse('1234:')"))
           .ToLocalChecked();
-  CHECK_EQ(2, compile_error_event_count);
+  CHECK_EQ(2, delegate.compile_error_event_count);
   CHECK(script->Run(context).IsEmpty());
-  CHECK_EQ(3, compile_error_event_count);
+  CHECK_EQ(3, delegate.compile_error_event_count);
 
   v8::Script::Compile(context,
                       v8_str(env->GetIsolate(), "new RegExp('/\\/\\\\');"))
       .ToLocalChecked();
-  CHECK_EQ(3, compile_error_event_count);
+  CHECK_EQ(3, delegate.compile_error_event_count);
 
   v8::Script::Compile(context, v8_str(env->GetIsolate(), "throw 1;"))
       .ToLocalChecked();
-  CHECK_EQ(3, compile_error_event_count);
+  CHECK_EQ(3, delegate.compile_error_event_count);
 }
 
 // Tests that break event is sent when event listener is reset.
 TEST(BreakEventWhenEventListenerIsReset) {
-  DebugLocalContext env;
+  LocalContext env;
   v8::HandleScope scope(env->GetIsolate());
-  v8::Local<v8::Context> context = env.context();
+  v8::Local<v8::Context> context = env.local();
   const char* script = "function f() {};";
 
-  SetDebugEventListener(env->GetIsolate(), AfterCompileEventListener);
+  ScriptCompiledDelegate delegate;
+  v8::debug::SetDebugDelegate(env->GetIsolate(), &delegate);
   v8::Script::Compile(context, v8_str(env->GetIsolate(), script))
       .ToLocalChecked()
       ->Run(context)
       .ToLocalChecked();
-  SetDebugEventListener(env->GetIsolate(), nullptr);
+  v8::debug::SetDebugDelegate(env->GetIsolate(), nullptr);
 
-  SetDebugEventListener(env->GetIsolate(), AfterCompileEventListener);
-  v8::debug::DebugBreak(env->GetIsolate());
+  v8::debug::SetDebugDelegate(env->GetIsolate(), &delegate);
+  v8::debug::SetBreakOnNextFunctionCall(env->GetIsolate());
   v8::Local<v8::Function> f = v8::Local<v8::Function>::Cast(
       env->Global()
           ->Get(context, v8_str(env->GetIsolate(), "f"))
@@ -5424,412 +3316,103 @@ TEST(BreakEventWhenEventListenerIsReset) {
   f->Call(context, env->Global(), 0, nullptr).ToLocalChecked();
 
   // Setting event listener to nullptr should cause debugger unload.
-  SetDebugEventListener(env->GetIsolate(), nullptr);
+  v8::debug::SetDebugDelegate(env->GetIsolate(), nullptr);
   CheckDebuggerUnloaded();
 
   // Compilation cache should be disabled when debugger is active.
-  CHECK_EQ(1, after_compile_event_count);
-}
-
-
-static int exception_event_count = 0;
-static void ExceptionEventListener(const v8::Debug::EventDetails& details) {
-  if (details.GetEvent() == v8::Exception) exception_event_count++;
-}
-
-// Tests that exception event is sent when event listener is reset.
-TEST(ExceptionEventWhenEventListenerIsReset) {
-  DebugLocalContext env;
-  v8::HandleScope scope(env->GetIsolate());
-
-  v8::Local<v8::Context> context = env.context();
-  // For this test, we want to break on uncaught exceptions:
-  ChangeBreakOnException(false, true);
-
-  exception_event_count = 0;
-  const char* script = "function f() {throw new Error()};";
-
-  SetDebugEventListener(env->GetIsolate(), AfterCompileEventListener);
-  v8::Script::Compile(context, v8_str(env->GetIsolate(), script))
-      .ToLocalChecked()
-      ->Run(context)
-      .ToLocalChecked();
-  SetDebugEventListener(env->GetIsolate(), nullptr);
-
-  SetDebugEventListener(env->GetIsolate(), ExceptionEventListener);
-  v8::Local<v8::Function> f = v8::Local<v8::Function>::Cast(
-      env->Global()
-          ->Get(context, v8_str(env->GetIsolate(), "f"))
-          .ToLocalChecked());
-  CHECK(f->Call(context, env->Global(), 0, nullptr).IsEmpty());
-
-  // Setting event listener to nullptr should cause debugger unload.
-  SetDebugEventListener(env->GetIsolate(), nullptr);
-  CheckDebuggerUnloaded();
-
-  CHECK_EQ(1, exception_event_count);
-}
-
-
-static void BreakEventListener(const v8::Debug::EventDetails& details) {
-  if (details.GetEvent() == v8::Break) break_point_hit_count++;
-}
-
-
-// Test that if DebugBreak is forced it is ignored when code from
-// debug-delay.js is executed.
-TEST(NoDebugBreakInAfterCompileEventListener) {
-  DebugLocalContext env;
-  v8::HandleScope scope(env->GetIsolate());
-  v8::Local<v8::Context> context = env.context();
-
-  // Register a debug event listener which sets the break flag and counts.
-  SetDebugEventListener(env->GetIsolate(), BreakEventListener);
-
-  // Set the debug break flag.
-  v8::debug::DebugBreak(env->GetIsolate());
-
-  // Create a function for testing stepping.
-  const char* src = "function f() { eval('var x = 10;'); } ";
-  v8::Local<v8::Function> f = CompileFunction(&env, src, "f");
-
-  // There should be only one break event.
-  CHECK_EQ(1, break_point_hit_count);
-
-  // Set the debug break flag again.
-  v8::debug::DebugBreak(env->GetIsolate());
-  f->Call(context, env->Global(), 0, nullptr).ToLocalChecked();
-  // There should be one more break event when the script is evaluated in 'f'.
-  CHECK_EQ(2, break_point_hit_count);
-
-  // Get rid of the debug event listener.
-  SetDebugEventListener(env->GetIsolate(), nullptr);
-  CheckDebuggerUnloaded();
-}
-
-
-// Test that the debug break flag works with function.apply.
-TEST(DebugBreakFunctionApply) {
-  DebugLocalContext env;
-  v8::HandleScope scope(env->GetIsolate());
-  v8::Local<v8::Context> context = env.context();
-
-  // Create a function for testing breaking in apply.
-  v8::Local<v8::Function> foo = CompileFunction(
-      &env,
-      "function baz(x) { }"
-      "function bar(x) { baz(); }"
-      "function foo(){ bar.apply(this, [1]); }",
-      "foo");
-
-  // Register a debug event listener which steps and counts.
-  SetDebugEventListener(env->GetIsolate(), DebugEventBreakMax);
-
-  // Set the debug break flag before calling the code using function.apply.
-  v8::debug::DebugBreak(env->GetIsolate());
-
-  // Limit the number of debug breaks. This is a regression test for issue 493
-  // where this test would enter an infinite loop.
-  break_point_hit_count = 0;
-  max_break_point_hit_count = 10000;  // 10000 => infinite loop.
-  foo->Call(context, env->Global(), 0, nullptr).ToLocalChecked();
-
-  // When keeping the debug break several break will happen.
-  CHECK_GT(break_point_hit_count, 1);
-
-  SetDebugEventListener(env->GetIsolate(), nullptr);
-  CheckDebuggerUnloaded();
-}
-
-
-v8::Local<v8::Context> debugee_context;
-v8::Local<v8::Context> debugger_context;
-
-
-// Property getter that checks that current and calling contexts
-// are both the debugee contexts.
-static void NamedGetterWithCallingContextCheck(
-    v8::Local<v8::String> name,
-    const v8::PropertyCallbackInfo<v8::Value>& info) {
-  CHECK_EQ(0, strcmp(*v8::String::Utf8Value(info.GetIsolate(), name), "a"));
-  v8::Local<v8::Context> current = info.GetIsolate()->GetCurrentContext();
-  CHECK(current == debugee_context);
-  CHECK(current != debugger_context);
-  info.GetReturnValue().Set(1);
-}
-
-
-// Debug event listener that checks if the first argument of a function is
-// an object with property 'a' == 1. If the property has custom accessor
-// this handler will eventually invoke it.
-static void DebugEventGetAtgumentPropertyValue(
-    const v8::Debug::EventDetails& event_details) {
-  v8::DebugEvent event = event_details.GetEvent();
-  v8::Local<v8::Object> exec_state = event_details.GetExecutionState();
-  if (event == v8::Break) {
-    break_point_hit_count++;
-    CHECK(debugger_context == CcTest::isolate()->GetCurrentContext());
-    v8::Local<v8::Function> func = v8::Local<v8::Function>::Cast(CompileRun(
-        "(function(exec_state) {\n"
-        "    return (exec_state.frame(0).argumentValue(0).property('a').\n"
-        "            value().value() == 1);\n"
-        "})"));
-    const int argc = 1;
-    v8::Local<v8::Value> argv[argc] = {exec_state};
-    v8::Local<v8::Value> result =
-        func->Call(debugger_context, exec_state, argc, argv).ToLocalChecked();
-    CHECK(result->IsTrue());
-  }
-}
-
-
-TEST(CallingContextIsNotDebugContext) {
-  v8::internal::Debug* debug = CcTest::i_isolate()->debug();
-  // Create and enter a debugee context.
-  DebugLocalContext env;
-  v8::Isolate* isolate = env->GetIsolate();
-  v8::HandleScope scope(isolate);
-  env.ExposeDebug();
-
-  // Save handles to the debugger and debugee contexts to be used in
-  // NamedGetterWithCallingContextCheck.
-  debugee_context = env.context();
-  debugger_context = v8::Utils::ToLocal(debug->debug_context());
-
-  // Create object with 'a' property accessor.
-  v8::Local<v8::ObjectTemplate> named = v8::ObjectTemplate::New(isolate);
-  named->SetAccessor(v8_str(isolate, "a"), NamedGetterWithCallingContextCheck);
-  CHECK(env->Global()
-            ->Set(debugee_context, v8_str(isolate, "obj"),
-                  named->NewInstance(debugee_context).ToLocalChecked())
-            .FromJust());
-
-  // Register the debug event listener
-  SetDebugEventListener(isolate, DebugEventGetAtgumentPropertyValue);
-
-  // Create a function that invokes debugger.
-  v8::Local<v8::Function> foo = CompileFunction(
-      &env,
-      "function bar(x) { debugger; }"
-      "function foo(){ bar(obj); }",
-      "foo");
-
-  break_point_hit_count = 0;
-  foo->Call(debugee_context, env->Global(), 0, nullptr).ToLocalChecked();
-  CHECK_EQ(1, break_point_hit_count);
-
-  SetDebugEventListener(isolate, nullptr);
-  debugee_context = v8::Local<v8::Context>();
-  debugger_context = v8::Local<v8::Context>();
-  CheckDebuggerUnloaded();
-}
-
-
-static v8::Local<v8::Value> expected_callback_data;
-static void DebugEventContextChecker(const v8::Debug::EventDetails& details) {
-  CHECK(details.GetEventContext() == expected_context);
-  CHECK(expected_callback_data->Equals(details.GetEventContext(),
-                                       details.GetCallbackData())
-            .FromJust());
-}
-
-
-// Check that event details contain context where debug event occurred.
-TEST(DebugEventContext) {
-  v8::Isolate* isolate = CcTest::isolate();
-  v8::HandleScope scope(isolate);
-  expected_context = v8::Context::New(isolate);
-  expected_callback_data = v8::Int32::New(isolate, 2010);
-  SetDebugEventListener(isolate, DebugEventContextChecker,
-                        expected_callback_data);
-  v8::Context::Scope context_scope(expected_context);
-  v8::Script::Compile(expected_context,
-                      v8_str(isolate, "(function(){debugger;})();"))
-      .ToLocalChecked()
-      ->Run(expected_context)
-      .ToLocalChecked();
-  expected_context.Clear();
-  SetDebugEventListener(isolate, nullptr);
-  expected_context_data = v8::Local<v8::Value>();
-  CheckDebuggerUnloaded();
+  CHECK_EQ(1, delegate.after_compile_event_count);
 }
 
+// Tests that script is reported as compiled when bound to context.
+TEST(AfterCompileEventOnBindToContext) {
+  LocalContext env;
+  v8::Isolate* isolate = env->GetIsolate();
+  v8::HandleScope handle_scope(isolate);
+  ScriptCompiledDelegate delegate;
+  v8::debug::SetDebugDelegate(isolate, &delegate);
 
-static bool debug_event_break_deoptimize_done = false;
-
-static void DebugEventBreakDeoptimize(
-    const v8::Debug::EventDetails& event_details) {
-  v8::DebugEvent event = event_details.GetEvent();
-  v8::Local<v8::Object> exec_state = event_details.GetExecutionState();
-  v8::Local<v8::Context> context = CcTest::isolate()->GetCurrentContext();
-  if (event == v8::Break) {
-    if (!frame_function_name.IsEmpty()) {
-      // Get the name of the function.
-      const int argc = 2;
-      v8::Local<v8::Value> argv[argc] = {
-          exec_state, v8::Integer::New(CcTest::isolate(), 0)};
-      v8::Local<v8::Value> result =
-          frame_function_name->Call(context, exec_state, argc, argv)
-              .ToLocalChecked();
-      if (!result->IsUndefined()) {
-        char fn[80];
-        CHECK(result->IsString());
-        v8::Local<v8::String> function_name(
-            result->ToString(context).ToLocalChecked());
-        function_name->WriteUtf8(fn);
-        if (strcmp(fn, "bar") == 0) {
-          i::Deoptimizer::DeoptimizeAll(CcTest::i_isolate());
-          debug_event_break_deoptimize_done = true;
-        }
-      }
-    }
+  const char* source = "var a=1";
+  v8::ScriptCompiler::Source script_source(
+      v8::String::NewFromUtf8(isolate, source, v8::NewStringType::kNormal)
+          .ToLocalChecked());
 
-    v8::debug::DebugBreak(CcTest::isolate());
-  }
+  v8::Local<v8::UnboundScript> unbound =
+      v8::ScriptCompiler::CompileUnboundScript(isolate, &script_source)
+          .ToLocalChecked();
+  CHECK_EQ(delegate.after_compile_event_count, 0);
+
+  unbound->BindToCurrentContext();
+  CHECK_EQ(delegate.after_compile_event_count, 1);
+  v8::debug::SetDebugDelegate(isolate, nullptr);
 }
 
 
-// Test deoptimization when execution is broken using the debug break stack
-// check interrupt.
-TEST(DeoptimizeDuringDebugBreak) {
-  DebugLocalContext env;
+// Test that if DebugBreak is forced it is ignored when code from
+// debug-delay.js is executed.
+TEST(NoDebugBreakInAfterCompileEventListener) {
+  LocalContext env;
   v8::HandleScope scope(env->GetIsolate());
-  env.ExposeDebug();
-  v8::Local<v8::Context> context = env.context();
-
-  // Create a function for checking the function when hitting a break point.
-  frame_function_name = CompileFunction(&env,
-                                        frame_function_name_source,
-                                        "frame_function_name");
-
-  // Set a debug event listener which will keep interrupting execution until
-  // debug break. When inside function bar it will deoptimize all functions.
-  // This tests lazy deoptimization bailout for the stack check, as the first
-  // time in function bar when using debug break and no break points will be at
-  // the initial stack check.
-  SetDebugEventListener(env->GetIsolate(), DebugEventBreakDeoptimize);
-
-  // Compile and run function bar which will optimize it for some flag settings.
-  v8::Local<v8::Function> f = CompileFunction(&env, "function bar(){}", "bar");
-  f->Call(context, v8::Undefined(env->GetIsolate()), 0, nullptr)
-      .ToLocalChecked();
-
-  // Set debug break and call bar again.
-  v8::debug::DebugBreak(env->GetIsolate());
-  f->Call(context, v8::Undefined(env->GetIsolate()), 0, nullptr)
-      .ToLocalChecked();
+  v8::Local<v8::Context> context = env.local();
 
-  CHECK(debug_event_break_deoptimize_done);
+  // Register a debug event listener which sets the break flag and counts.
+  DebugEventCounter delegate;
+  v8::debug::SetDebugDelegate(env->GetIsolate(), &delegate);
 
-  SetDebugEventListener(env->GetIsolate(), nullptr);
-}
+  // Set the debug break flag.
+  v8::debug::SetBreakOnNextFunctionCall(env->GetIsolate());
 
+  // Create a function for testing stepping.
+  const char* src = "function f() { eval('var x = 10;'); } ";
+  v8::Local<v8::Function> f = CompileFunction(&env, src, "f");
 
-static void DebugEventBreakWithOptimizedStack(
-    const v8::Debug::EventDetails& event_details) {
-  v8::Isolate* isolate = event_details.GetEventContext()->GetIsolate();
-  v8::DebugEvent event = event_details.GetEvent();
-  v8::Local<v8::Object> exec_state = event_details.GetExecutionState();
-  v8::Local<v8::Context> context = isolate->GetCurrentContext();
-  if (event == v8::Break) {
-    if (!frame_function_name.IsEmpty()) {
-      for (int i = 0; i < 2; i++) {
-        const int argc = 2;
-        v8::Local<v8::Value> argv[argc] = {exec_state,
-                                           v8::Integer::New(isolate, i)};
-        // Get the name of the function in frame i.
-        v8::Local<v8::Value> result =
-            frame_function_name->Call(context, exec_state, argc, argv)
-                .ToLocalChecked();
-        CHECK(result->IsString());
-        v8::Local<v8::String> function_name(
-            result->ToString(context).ToLocalChecked());
-        CHECK(
-            function_name->Equals(context, v8_str(isolate, "loop")).FromJust());
-        // Get the name of the first argument in frame i.
-        result = frame_argument_name->Call(context, exec_state, argc, argv)
-                     .ToLocalChecked();
-        CHECK(result->IsString());
-        v8::Local<v8::String> argument_name(
-            result->ToString(context).ToLocalChecked());
-        CHECK(argument_name->Equals(context, v8_str(isolate, "count"))
-                  .FromJust());
-        // Get the value of the first argument in frame i. If the
-        // function is optimized the value will be undefined, otherwise
-        // the value will be '1 - i'.
-        //
-        // TODO(3141533): We should be able to get the real value for
-        // optimized frames.
-        result = frame_argument_value->Call(context, exec_state, argc, argv)
-                     .ToLocalChecked();
-        CHECK(result->IsUndefined() ||
-              (result->Int32Value(context).FromJust() == 1 - i));
-        // Get the name of the first local variable.
-        result = frame_local_name->Call(context, exec_state, argc, argv)
-                     .ToLocalChecked();
-        CHECK(result->IsString());
-        v8::Local<v8::String> local_name(
-            result->ToString(context).ToLocalChecked());
-        CHECK(local_name->Equals(context, v8_str(isolate, "local")).FromJust());
-        // Get the value of the first local variable. If the function
-        // is optimized the value will be undefined, otherwise it will
-        // be 42.
-        //
-        // TODO(3141533): We should be able to get the real value for
-        // optimized frames.
-        result = frame_local_value->Call(context, exec_state, argc, argv)
-                     .ToLocalChecked();
-        CHECK(result->IsUndefined() ||
-              (result->Int32Value(context).FromJust() == 42));
-      }
-    }
-  }
-}
+  // There should be only one break event.
+  CHECK_EQ(1, break_point_hit_count);
 
+  // Set the debug break flag again.
+  v8::debug::SetBreakOnNextFunctionCall(env->GetIsolate());
+  f->Call(context, env->Global(), 0, nullptr).ToLocalChecked();
+  // There should be one more break event when the script is evaluated in 'f'.
+  CHECK_EQ(2, break_point_hit_count);
 
-static void ScheduleBreak(const v8::FunctionCallbackInfo<v8::Value>& args) {
-  SetDebugEventListener(args.GetIsolate(), DebugEventBreakWithOptimizedStack);
-  v8::debug::DebugBreak(args.GetIsolate());
+  // Get rid of the debug event listener.
+  v8::debug::SetDebugDelegate(env->GetIsolate(), nullptr);
+  CheckDebuggerUnloaded();
 }
 
 
-TEST(DebugBreakStackInspection) {
-  DebugLocalContext env;
+// Test that the debug break flag works with function.apply.
+TEST(DebugBreakFunctionApply) {
+  LocalContext env;
   v8::HandleScope scope(env->GetIsolate());
-  v8::Local<v8::Context> context = env.context();
-
-  frame_function_name =
-      CompileFunction(&env, frame_function_name_source, "frame_function_name");
-  frame_argument_name =
-      CompileFunction(&env, frame_argument_name_source, "frame_argument_name");
-  frame_argument_value = CompileFunction(&env,
-                                         frame_argument_value_source,
-                                         "frame_argument_value");
-  frame_local_name =
-      CompileFunction(&env, frame_local_name_source, "frame_local_name");
-  frame_local_value =
-      CompileFunction(&env, frame_local_value_source, "frame_local_value");
-
-  v8::Local<v8::FunctionTemplate> schedule_break_template =
-      v8::FunctionTemplate::New(env->GetIsolate(), ScheduleBreak);
-  v8::Local<v8::Function> schedule_break =
-      schedule_break_template->GetFunction(context).ToLocalChecked();
-  CHECK(env->Global()
-            ->Set(context, v8_str("scheduleBreak"), schedule_break)
-            .FromJust());
+  v8::Local<v8::Context> context = env.local();
 
-  const char* src =
-      "function loop(count) {"
-      "  var local = 42;"
-      "  if (count < 1) { scheduleBreak(); loop(count + 1); }"
-      "}"
-      "loop(0);";
-  v8::Script::Compile(context, v8_str(env->GetIsolate(), src))
-      .ToLocalChecked()
-      ->Run(context)
-      .ToLocalChecked();
-}
+  // Create a function for testing breaking in apply.
+  v8::Local<v8::Function> foo = CompileFunction(
+      &env,
+      "function baz(x) { }"
+      "function bar(x) { baz(); }"
+      "function foo(){ bar.apply(this, [1]); }",
+      "foo");
+
+  // Register a debug event listener which steps and counts.
+  DebugEventBreakMax delegate;
+  v8::debug::SetDebugDelegate(env->GetIsolate(), &delegate);
+
+  // Set the debug break flag before calling the code using function.apply.
+  v8::debug::SetBreakOnNextFunctionCall(env->GetIsolate());
+
+  // Limit the number of debug breaks. This is a regression test for issue 493
+  // where this test would enter an infinite loop.
+  break_point_hit_count = 0;
+  max_break_point_hit_count = 10000;  // 10000 => infinite loop.
+  foo->Call(context, env->Global(), 0, nullptr).ToLocalChecked();
+
+  // When keeping the debug break several break will happen.
+  CHECK_GT(break_point_hit_count, 1);
 
+  v8::debug::SetDebugDelegate(env->GetIsolate(), nullptr);
+  CheckDebuggerUnloaded();
+}
 
 // Test that setting the terminate execution flag during debug break processing.
 static void TestDebugBreakInLoop(const char* loop_head,
@@ -5842,7 +3425,7 @@ static void TestDebugBreakInLoop(const char* loop_head,
     // Perform a lazy deoptimization after various numbers of breaks
     // have been hit.
 
-    EmbeddedVector<char, 1024> buffer;
+    i::EmbeddedVector<char, 1024> buffer;
     SNPrintF(buffer, "function f() {%s%s%s}", loop_head, loop_bodies[i],
              loop_tail);
 
@@ -5862,7 +3445,7 @@ static void TestDebugBreakInLoop(const char* loop_head,
       CompileRun(buffer.start());
 
       // Set the debug break to enter the debugger as soon as possible.
-      v8::debug::DebugBreak(CcTest::isolate());
+      v8::debug::SetBreakOnNextFunctionCall(CcTest::isolate());
 
       // Call function with infinite loop.
       CompileRun("f();");
@@ -5891,11 +3474,12 @@ static const char* loop_bodies_2[] = {
 
 void DebugBreakLoop(const char* loop_header, const char** loop_bodies,
                     const char* loop_footer) {
-  DebugLocalContext env;
+  LocalContext env;
   v8::HandleScope scope(env->GetIsolate());
 
   // Register a debug event listener which sets the break flag and counts.
-  SetDebugEventListener(env->GetIsolate(), DebugEventBreakMax);
+  DebugEventBreakMax delegate;
+  v8::debug::SetDebugDelegate(env->GetIsolate(), &delegate);
 
   CompileRun(
       "var a = 1;\n"
@@ -5905,7 +3489,7 @@ void DebugBreakLoop(const char* loop_header, const char** loop_bodies,
   TestDebugBreakInLoop(loop_header, loop_bodies, loop_footer);
 
   // Get rid of the debug event listener.
-  SetDebugEventListener(env->GetIsolate(), nullptr);
+  v8::debug::SetDebugDelegate(env->GetIsolate(), nullptr);
   CheckDebuggerUnloaded();
 }
 
@@ -5965,50 +3549,29 @@ TEST(DebugBreakInForCondition2) {
   DebugBreakLoop("for (;a == 1;) {", loop_bodies_2, "}");
 }
 
-
-v8::Local<v8::Script> inline_script;
-
-static void DebugBreakInlineListener(
-    const v8::Debug::EventDetails& event_details) {
-  v8::DebugEvent event = event_details.GetEvent();
-  v8::Local<v8::Context> context = CcTest::isolate()->GetCurrentContext();
-  if (event != v8::Break) return;
-
-  int expected_frame_count = 4;
-  int expected_line_number[] = {1, 4, 7, 12};
-
-  i::Handle<i::Object> compiled_script = v8::Utils::OpenHandle(*inline_script);
-  i::Handle<i::Script> source_script = i::Handle<i::Script>(i::Script::cast(
-      i::JSFunction::cast(*compiled_script)->shared()->script()));
-
-  int break_id = CcTest::i_isolate()->debug()->break_id();
-  char script[128];
-  i::Vector<char> script_vector(script, sizeof(script));
-  SNPrintF(script_vector, "%%GetFrameCount(%d)", break_id);
-  v8::Local<v8::Value> result = CompileRun(script);
-
-  int frame_count = result->Int32Value(context).FromJust();
-  CHECK_EQ(expected_frame_count, frame_count);
-
-  for (int i = 0; i < frame_count; i++) {
-    // The 6. element in the returned array of GetFrameDetails contains the
-    // source position of that frame.
-    SNPrintF(script_vector, "%%GetFrameDetails(%d, %d)[6]", break_id, i);
-    v8::Local<v8::Value> result = CompileRun(script);
-    CHECK_EQ(expected_line_number[i],
-             i::Script::GetLineNumber(source_script,
-                                      result->Int32Value(context).FromJust()));
+class DebugBreakInlineListener : public v8::debug::DebugDelegate {
+ public:
+  void BreakProgramRequested(v8::Local<v8::Context> paused_context,
+                             const std::vector<v8::debug::BreakpointId>&
+                                 inspector_break_points_hit) override {
+    int expected_frame_count = 4;
+    int expected_line_number[] = {1, 4, 7, 12};
+
+    int frame_count = 0;
+    auto iterator = v8::debug::StackTraceIterator::Create(CcTest::isolate());
+    for (; !iterator->Done(); iterator->Advance(), ++frame_count) {
+      v8::debug::Location loc = iterator->GetSourceLocation();
+      CHECK_EQ(expected_line_number[frame_count], loc.GetLineNumber());
+    }
+    CHECK_EQ(frame_count, expected_frame_count);
   }
-  SetDebugEventListener(CcTest::isolate(), nullptr);
-  CcTest::isolate()->TerminateExecution();
-}
-
+};
 
 TEST(DebugBreakInline) {
   i::FLAG_allow_natives_syntax = true;
-  DebugLocalContext env;
+  LocalContext env;
   v8::HandleScope scope(env->GetIsolate());
-  v8::Local<v8::Context> context = env.context();
+  v8::Local<v8::Context> context = env.local();
   const char* source =
       "function debug(b) {             \n"
       "  if (b) debugger;              \n"
@@ -6023,23 +3586,15 @@ TEST(DebugBreakInline) {
       "g(false);                       \n"
       "%OptimizeFunctionOnNextCall(g); \n"
       "g(true);";
-  SetDebugEventListener(env->GetIsolate(), DebugBreakInlineListener);
-  inline_script =
+  DebugBreakInlineListener delegate;
+  v8::debug::SetDebugDelegate(env->GetIsolate(), &delegate);
+  v8::Local<v8::Script> inline_script =
       v8::Script::Compile(context, v8_str(env->GetIsolate(), source))
           .ToLocalChecked();
   inline_script->Run(context).ToLocalChecked();
+  v8::debug::SetDebugDelegate(env->GetIsolate(), nullptr);
 }
 
-
-static void DebugEventStepNext(
-    const v8::Debug::EventDetails& event_details) {
-  v8::DebugEvent event = event_details.GetEvent();
-  if (event == v8::Break) {
-    PrepareStep(StepNext);
-  }
-}
-
-
 static void RunScriptInANewCFrame(const char* source) {
   v8::TryCatch try_catch(CcTest::isolate());
   CompileRun(source);
@@ -6056,9 +3611,11 @@ TEST(Regress131642) {
   // recursive call.  In an attempt to step out, we crawl the stack using the
   // recorded frame pointer from the first script and fail when not finding it
   // on the stack.
-  DebugLocalContext env;
+  LocalContext env;
   v8::HandleScope scope(env->GetIsolate());
-  SetDebugEventListener(env->GetIsolate(), DebugEventStepNext);
+  DebugEventCounter delegate;
+  delegate.set_step_action(StepNext);
+  v8::debug::SetDebugDelegate(env->GetIsolate(), &delegate);
 
   // We step through the first script.  It exits through an exception.  We run
   // this inside a new frame to record a different FP than the second script
@@ -6070,74 +3627,28 @@ TEST(Regress131642) {
   const char* script_2 = "[0].forEach(function() { });";
   CompileRun(script_2);
 
-  SetDebugEventListener(env->GetIsolate(), nullptr);
-}
-
-
-// Import from test-heap.cc
-namespace v8 {
-namespace internal {
-namespace heap {
-int CountNativeContexts();
-}  // namespace heap
-}  // namespace internal
-}  // namespace v8
-
-static void NopListener(const v8::Debug::EventDetails& event_details) {
-}
-
-
-TEST(DebuggerCreatesContextIffActive) {
-  DebugLocalContext env;
-  v8::HandleScope scope(env->GetIsolate());
-  CHECK_EQ(1, v8::internal::heap::CountNativeContexts());
-
-  SetDebugEventListener(env->GetIsolate(), nullptr);
-  CompileRun("debugger;");
-  CHECK_EQ(1, v8::internal::heap::CountNativeContexts());
-
-  SetDebugEventListener(env->GetIsolate(), NopListener);
-  CompileRun("debugger;");
-  CHECK_EQ(2, v8::internal::heap::CountNativeContexts());
-
-  SetDebugEventListener(env->GetIsolate(), nullptr);
-}
-
-
-TEST(LiveEditEnabled) {
-  v8::internal::FLAG_allow_natives_syntax = true;
-  LocalContext env;
-  v8::HandleScope scope(env->GetIsolate());
-  v8::debug::SetLiveEditEnabled(env->GetIsolate(), true);
-  CompileRun("%LiveEditCompareStrings('', '')");
-}
-
-
-TEST(LiveEditDisabled) {
-  v8::internal::FLAG_allow_natives_syntax = true;
-  LocalContext env;
-  v8::HandleScope scope(env->GetIsolate());
-  v8::debug::SetLiveEditEnabled(env->GetIsolate(), false);
-  CompileRun("%LiveEditCompareStrings('', '')");
-}
-
-
-static void DebugBreakStackTraceListener(
-    const v8::Debug::EventDetails& event_details) {
-  v8::StackTrace::CurrentStackTrace(CcTest::isolate(), 10);
+  v8::debug::SetDebugDelegate(env->GetIsolate(), nullptr);
 }
 
+class DebugBreakStackTraceListener : public v8::debug::DebugDelegate {
+ public:
+  void BreakProgramRequested(v8::Local<v8::Context> paused_context,
+                             const std::vector<v8::debug::BreakpointId>&
+                                 inspector_break_points_hit) override {
+    v8::StackTrace::CurrentStackTrace(CcTest::isolate(), 10);
+  }
+};
 
 static void AddDebugBreak(const v8::FunctionCallbackInfo<v8::Value>& args) {
-  v8::debug::DebugBreak(args.GetIsolate());
+  v8::debug::SetBreakOnNextFunctionCall(args.GetIsolate());
 }
 
-
 TEST(DebugBreakStackTrace) {
-  DebugLocalContext env;
+  LocalContext env;
   v8::HandleScope scope(env->GetIsolate());
-  SetDebugEventListener(env->GetIsolate(), DebugBreakStackTraceListener);
-  v8::Local<v8::Context> context = env.context();
+  DebugBreakStackTraceListener delegate;
+  v8::debug::SetDebugDelegate(env->GetIsolate(), &delegate);
+  v8::Local<v8::Context> context = env.local();
   v8::Local<v8::FunctionTemplate> add_debug_break_template =
       v8::FunctionTemplate::New(env->GetIsolate(), AddDebugBreak);
   v8::Local<v8::Function> add_debug_break =
@@ -6158,18 +3669,23 @@ TEST(DebugBreakStackTrace) {
 
 v8::base::Semaphore terminate_requested_semaphore(0);
 v8::base::Semaphore terminate_fired_semaphore(0);
-bool terminate_already_fired = false;
 
+class DebugBreakTriggerTerminate : public v8::debug::DebugDelegate {
+ public:
+  void BreakProgramRequested(v8::Local<v8::Context> paused_context,
+                             const std::vector<v8::debug::BreakpointId>&
+                                 inspector_break_points_hit) override {
+    if (terminate_already_fired_) return;
+    terminate_requested_semaphore.Signal();
+    // Wait for at most 2 seconds for the terminate request.
+    CHECK(
+        terminate_fired_semaphore.WaitFor(v8::base::TimeDelta::FromSeconds(2)));
+    terminate_already_fired_ = true;
+  }
 
-static void DebugBreakTriggerTerminate(
-    const v8::Debug::EventDetails& event_details) {
-  if (event_details.GetEvent() != v8::Break || terminate_already_fired) return;
-  terminate_requested_semaphore.Signal();
-  // Wait for at most 2 seconds for the terminate request.
-  CHECK(terminate_fired_semaphore.WaitFor(v8::base::TimeDelta::FromSeconds(2)));
-  terminate_already_fired = true;
-}
-
+ private:
+  bool terminate_already_fired_ = false;
+};
 
 class TerminationThread : public v8::base::Thread {
  public:
@@ -6188,25 +3704,28 @@ class TerminationThread : public v8::base::Thread {
 
 
 TEST(DebugBreakOffThreadTerminate) {
-  DebugLocalContext env;
+  LocalContext env;
   v8::Isolate* isolate = env->GetIsolate();
   v8::HandleScope scope(isolate);
-  SetDebugEventListener(isolate, DebugBreakTriggerTerminate);
+  DebugBreakTriggerTerminate delegate;
+  v8::debug::SetDebugDelegate(isolate, &delegate);
   TerminationThread terminator(isolate);
   terminator.Start();
   v8::TryCatch try_catch(env->GetIsolate());
-  v8::debug::DebugBreak(isolate);
+  env->GetIsolate()->RequestInterrupt(BreakRightNow, nullptr);
   CompileRun("while (true);");
   CHECK(try_catch.HasTerminated());
 }
 
-
-static void DebugEventExpectNoException(
-    const v8::Debug::EventDetails& event_details) {
-  v8::DebugEvent event = event_details.GetEvent();
-  CHECK_NE(v8::Exception, event);
-}
-
+class DebugEventExpectNoException : public v8::debug::DebugDelegate {
+ public:
+  void ExceptionThrown(v8::Local<v8::Context> paused_context,
+                       v8::Local<v8::Value> exception,
+                       v8::Local<v8::Value> promise,
+                       bool is_uncaught) override {
+    CHECK(false);
+  }
+};
 
 static void TryCatchWrappedThrowCallback(
     const v8::FunctionCallbackInfo<v8::Value>& args) {
@@ -6215,13 +3734,13 @@ static void TryCatchWrappedThrowCallback(
   CHECK(try_catch.HasCaught());
 }
 
-
 TEST(DebugPromiseInterceptedByTryCatch) {
-  DebugLocalContext env;
+  LocalContext env;
   v8::Isolate* isolate = env->GetIsolate();
   v8::HandleScope scope(isolate);
-  SetDebugEventListener(isolate, &DebugEventExpectNoException);
-  v8::Local<v8::Context> context = env.context();
+  DebugEventExpectNoException delegate;
+  v8::debug::SetDebugDelegate(isolate, &delegate);
+  v8::Local<v8::Context> context = env.local();
   ChangeBreakOnException(false, true);
 
   v8::Local<v8::FunctionTemplate> fun =
@@ -6239,131 +3758,39 @@ TEST(DebugPromiseInterceptedByTryCatch) {
   CHECK(CompileRun("r")->Equals(context, v8_str("resolved")).FromJust());
 }
 
+class NoInterruptsOnDebugEvent : public v8::debug::DebugDelegate {
+ public:
+  void ScriptCompiled(v8::Local<v8::debug::Script> script, bool is_live_edited,
+                      bool has_compile_error) override {
+    ++after_compile_handler_depth_;
+    // Do not allow nested AfterCompile events.
+    CHECK_LE(after_compile_handler_depth_, 1);
+    v8::Isolate* isolate = CcTest::isolate();
+    v8::Isolate::AllowJavascriptExecutionScope allow_script(isolate);
+    isolate->RequestInterrupt(&HandleInterrupt, this);
+    CompileRun("function foo() {}; foo();");
+    --after_compile_handler_depth_;
+  }
 
-static int exception_event_counter = 0;
-
-
-static void DebugEventCountException(
-    const v8::Debug::EventDetails& event_details) {
-  v8::DebugEvent event = event_details.GetEvent();
-  if (event == v8::Exception) exception_event_counter++;
-}
-
-
-static void ThrowCallback(const v8::FunctionCallbackInfo<v8::Value>& args) {
-  CompileRun("throw 'rejection';");
-}
-
-
-TEST(DebugPromiseRejectedByCallback) {
-  DebugLocalContext env;
-  v8::Isolate* isolate = env->GetIsolate();
-  v8::HandleScope scope(isolate);
-  SetDebugEventListener(isolate, &DebugEventCountException);
-  v8::Local<v8::Context> context = env.context();
-  ChangeBreakOnException(false, true);
-  exception_event_counter = 0;
-
-  v8::Local<v8::FunctionTemplate> fun =
-      v8::FunctionTemplate::New(isolate, ThrowCallback);
-  CHECK(env->Global()
-            ->Set(context, v8_str("fun"),
-                  fun->GetFunction(context).ToLocalChecked())
-            .FromJust());
-
-  CompileRun("var p = new Promise(function(res, rej) { fun(); res(); });");
-  CompileRun(
-      "var r;"
-      "p.then(function() { r = 'resolved'; },"
-      "       function(e) { r = 'rejected' + e; });");
-  CHECK(
-      CompileRun("r")->Equals(context, v8_str("rejectedrejection")).FromJust());
-  CHECK_EQ(1, exception_event_counter);
-}
-
-
-static void DebugHarmonyScopingListener(
-    const v8::Debug::EventDetails& event_details) {
-  v8::DebugEvent event = event_details.GetEvent();
-  if (event != v8::Break) return;
-
-  int break_id = CcTest::i_isolate()->debug()->break_id();
-
-  char script[128];
-  i::Vector<char> script_vector(script, sizeof(script));
-  SNPrintF(script_vector, "%%GetFrameCount(%d)", break_id);
-  ExpectInt32(script, 1);
-
-  SNPrintF(script_vector, "var frame = new FrameMirror(%d, 0);", break_id);
-  CompileRun(script);
-  ExpectInt32("frame.evaluate('x').value_", 1);
-  ExpectInt32("frame.evaluate('y').value_", 2);
-
-  CompileRun("var allScopes = frame.allScopes()");
-  ExpectInt32("allScopes.length", 2);
-
-  ExpectBoolean("allScopes[0].scopeType() === ScopeType.Script", true);
-
-  ExpectInt32("allScopes[0].scopeObject().value_.x", 1);
-
-  ExpectInt32("allScopes[0].scopeObject().value_.y", 2);
-
-  CompileRun("allScopes[0].setVariableValue('x', 5);");
-  CompileRun("allScopes[0].setVariableValue('y', 6);");
-  ExpectInt32("frame.evaluate('x + y').value_", 11);
-}
-
-
-TEST(DebugBreakInLexicalScopes) {
-  i::FLAG_allow_natives_syntax = true;
-
-  DebugLocalContext env;
-  v8::Isolate* isolate = env->GetIsolate();
-  v8::HandleScope scope(isolate);
-  SetDebugEventListener(isolate, DebugHarmonyScopingListener);
-
-  CompileRun(
-      "'use strict';            \n"
-      "let x = 1;               \n");
-  ExpectInt32(
-      "'use strict';            \n"
-      "let y = 2;               \n"
-      "debugger;                \n"
-      "x * y",
-      30);
-  ExpectInt32(
-      "x = 1; y = 2; \n"
-      "debugger;"
-      "x * y",
-      30);
-}
-
-static int after_compile_handler_depth = 0;
-static void HandleInterrupt(v8::Isolate* isolate, void* data) {
-  CHECK_EQ(0, after_compile_handler_depth);
-}
+ private:
+  static void HandleInterrupt(v8::Isolate* isolate, void* data) {
+    NoInterruptsOnDebugEvent* d = static_cast<NoInterruptsOnDebugEvent*>(data);
+    CHECK_EQ(0, d->after_compile_handler_depth_);
+  }
 
-static void NoInterruptsOnDebugEvent(
-    const v8::Debug::EventDetails& event_details) {
-  if (event_details.GetEvent() != v8::AfterCompile) return;
-  ++after_compile_handler_depth;
-  // Do not allow nested AfterCompile events.
-  CHECK_LE(after_compile_handler_depth, 1);
-  v8::Isolate* isolate = event_details.GetEventContext()->GetIsolate();
-  v8::Isolate::AllowJavascriptExecutionScope allow_script(isolate);
-  isolate->RequestInterrupt(&HandleInterrupt, nullptr);
-  CompileRun("function foo() {}; foo();");
-  --after_compile_handler_depth;
-}
+  int after_compile_handler_depth_ = 0;
+};
 
 TEST(NoInterruptsInDebugListener) {
-  DebugLocalContext env;
-  SetDebugEventListener(env->GetIsolate(), NoInterruptsOnDebugEvent);
+  LocalContext env;
+  v8::HandleScope handle_scope(env->GetIsolate());
+  NoInterruptsOnDebugEvent delegate;
+  v8::debug::SetDebugDelegate(env->GetIsolate(), &delegate);
   CompileRun("void(0);");
 }
 
 TEST(BreakLocationIterator) {
-  DebugLocalContext env;
+  LocalContext env;
   v8::Isolate* isolate = env->GetIsolate();
   i::Isolate* i_isolate = reinterpret_cast<i::Isolate*>(isolate);
   v8::HandleScope scope(isolate);
@@ -6377,13 +3804,13 @@ TEST(BreakLocationIterator) {
       "f");
   Handle<i::Object> function_obj = v8::Utils::OpenHandle(*result);
   Handle<i::JSFunction> function = Handle<i::JSFunction>::cast(function_obj);
-  Handle<i::SharedFunctionInfo> shared(function->shared());
+  Handle<i::SharedFunctionInfo> shared(function->shared(), i_isolate);
 
   EnableDebugger(isolate);
   CHECK(i_isolate->debug()->EnsureBreakInfo(shared));
   i_isolate->debug()->PrepareFunctionForDebugExecution(shared);
 
-  Handle<i::DebugInfo> debug_info(shared->GetDebugInfo());
+  Handle<i::DebugInfo> debug_info(shared->GetDebugInfo(), i_isolate);
 
   {
     i::BreakIterator iterator(debug_info);
@@ -6408,27 +3835,28 @@ TEST(BreakLocationIterator) {
   DisableDebugger(isolate);
 }
 
-size_t current_action = 0;
-StepAction actions[] = {StepNext, StepNext};
-static void DebugStepOverFunctionWithCaughtExceptionListener(
-    const v8::Debug::EventDetails& event_details) {
-  v8::DebugEvent event = event_details.GetEvent();
-  if (event != v8::Break) return;
-  ++break_point_hit_count;
-  if (current_action >= 2) return;
-  PrepareStep(actions[current_action]);
-}
+class DebugStepOverFunctionWithCaughtExceptionListener
+    : public v8::debug::DebugDelegate {
+ public:
+  void BreakProgramRequested(v8::Local<v8::Context> paused_context,
+                             const std::vector<v8::debug::BreakpointId>&
+                                 inspector_break_points_hit) override {
+    ++break_point_hit_count;
+    if (break_point_hit_count >= 3) return;
+    PrepareStep(StepNext);
+  }
+  int break_point_hit_count = 0;
+};
 
 TEST(DebugStepOverFunctionWithCaughtException) {
   i::FLAG_allow_natives_syntax = true;
 
-  DebugLocalContext env;
+  LocalContext env;
   v8::Isolate* isolate = env->GetIsolate();
   v8::HandleScope scope(isolate);
-  SetDebugEventListener(isolate,
-                        DebugStepOverFunctionWithCaughtExceptionListener);
+  DebugStepOverFunctionWithCaughtExceptionListener delegate;
+  v8::debug::SetDebugDelegate(isolate, &delegate);
 
-  break_point_hit_count = 0;
   CompileRun(
       "function foo() {\n"
       "  try { throw new Error(); } catch (e) {}\n"
@@ -6437,8 +3865,8 @@ TEST(DebugStepOverFunctionWithCaughtException) {
       "foo();\n"
       "foo();\n");
 
-  SetDebugEventListener(env->GetIsolate(), nullptr);
-  CHECK_EQ(4, break_point_hit_count);
+  v8::debug::SetDebugDelegate(env->GetIsolate(), nullptr);
+  CHECK_EQ(3, delegate.break_point_hit_count);
 }
 
 bool near_heap_limit_callback_called = false;
@@ -6623,8 +4051,8 @@ TEST(BuiltinsExceptionPrediction) {
   i::Builtins* builtins = iisolate->builtins();
   bool fail = false;
   for (int i = 0; i < i::Builtins::builtin_count; i++) {
-    Code* builtin = builtins->builtin(i);
-    if (builtin->kind() != Code::BUILTIN) continue;
+    i::Code* builtin = builtins->builtin(i);
+    if (builtin->kind() != i::Code::BUILTIN) continue;
     auto prediction = builtin->GetBuiltinCatchPrediction();
     USE(prediction);
   }
@@ -6671,7 +4099,7 @@ TEST(DebugEvaluateNoSideEffect) {
     while (i::HeapObject* obj = iterator.next()) {
       if (!obj->IsJSFunction()) continue;
       i::JSFunction* fun = i::JSFunction::cast(obj);
-      all_functions.emplace_back(fun);
+      all_functions.emplace_back(fun, isolate);
     }
   }
 
@@ -6680,9 +4108,264 @@ TEST(DebugEvaluateNoSideEffect) {
   for (i::Handle<i::JSFunction> fun : all_functions) {
     bool failed = false;
     isolate->debug()->StartSideEffectCheckMode();
-    failed = !isolate->debug()->PerformSideEffectCheck(fun);
+    failed = !isolate->debug()->PerformSideEffectCheck(
+        fun, v8::Utils::OpenHandle(*env->Global()));
     isolate->debug()->StopSideEffectCheckMode();
     if (failed) isolate->clear_pending_exception();
   }
   DisableDebugger(env->GetIsolate());
 }
+
+namespace {
+i::MaybeHandle<i::Script> FindScript(
+    i::Isolate* isolate, const std::vector<i::Handle<i::Script>>& scripts,
+    const char* name) {
+  Handle<i::String> i_name =
+      isolate->factory()->NewStringFromAsciiChecked(name);
+  for (const auto& script : scripts) {
+    if (!script->name()->IsString()) continue;
+    if (i_name->Equals(i::String::cast(script->name()))) return script;
+  }
+  return i::MaybeHandle<i::Script>();
+}
+}  // anonymous namespace
+
+UNINITIALIZED_TEST(LoadedAtStartupScripts) {
+  i::FLAG_expose_gc = true;
+  i::FLAG_expose_natives_as = "natives";
+
+  v8::Isolate::CreateParams create_params;
+  create_params.array_buffer_allocator = CcTest::array_buffer_allocator();
+  v8::Isolate* isolate = v8::Isolate::New(create_params);
+  i::Isolate* i_isolate = reinterpret_cast<i::Isolate*>(isolate);
+  {
+    v8::Isolate::Scope i_scope(isolate);
+    v8::HandleScope scope(isolate);
+    LocalContext context(isolate);
+
+    std::vector<i::Handle<i::Script>> scripts;
+    CompileWithOrigin(v8_str("function foo(){}"), v8_str("normal.js"));
+    std::unordered_map<int, int> count_by_type;
+    {
+      i::DisallowHeapAllocation no_gc;
+      i::Script::Iterator iterator(i_isolate);
+      i::Script* script;
+      while ((script = iterator.Next()) != nullptr) {
+        if (script->type() == i::Script::TYPE_NATIVE &&
+            script->name()->IsUndefined(i_isolate)) {
+          continue;
+        }
+        ++count_by_type[script->type()];
+        scripts.emplace_back(script, i_isolate);
+      }
+    }
+    CHECK_EQ(count_by_type[i::Script::TYPE_NATIVE],
+             i::Natives::GetBuiltinsCount());
+    CHECK_EQ(count_by_type[i::Script::TYPE_EXTENSION], 2);
+    CHECK_EQ(count_by_type[i::Script::TYPE_NORMAL], 1);
+    CHECK_EQ(count_by_type[i::Script::TYPE_WASM], 0);
+    CHECK_EQ(count_by_type[i::Script::TYPE_INSPECTOR], 0);
+
+    i::Handle<i::Script> native_array_script =
+        FindScript(i_isolate, scripts, "native array.js").ToHandleChecked();
+    CHECK_EQ(native_array_script->type(), i::Script::TYPE_NATIVE);
+
+    i::Handle<i::Script> gc_script =
+        FindScript(i_isolate, scripts, "v8/gc").ToHandleChecked();
+    CHECK_EQ(gc_script->type(), i::Script::TYPE_EXTENSION);
+
+    i::Handle<i::Script> normal_script =
+        FindScript(i_isolate, scripts, "normal.js").ToHandleChecked();
+    CHECK_EQ(normal_script->type(), i::Script::TYPE_NORMAL);
+  }
+  isolate->Dispose();
+}
+
+TEST(SourceInfo) {
+  LocalContext env;
+  v8::HandleScope scope(env->GetIsolate());
+  const char* source =
+      "//\n"
+      "function a() { b(); };\n"
+      "function    b() {\n"
+      "  c(true);\n"
+      "};\n"
+      "  function c(x) {\n"
+      "    if (x) {\n"
+      "      return 1;\n"
+      "    } else {\n"
+      "      return 1;\n"
+      "    }\n"
+      "  };\n"
+      "function d(x) {\n"
+      "  x = 1 ;\n"
+      "  x = 2 ;\n"
+      "  x = 3 ;\n"
+      "  x = 4 ;\n"
+      "  x = 5 ;\n"
+      "  x = 6 ;\n"
+      "  x = 7 ;\n"
+      "  x = 8 ;\n"
+      "  x = 9 ;\n"
+      "  x = 10;\n"
+      "  x = 11;\n"
+      "  x = 12;\n"
+      "  x = 13;\n"
+      "  x = 14;\n"
+      "  x = 15;\n"
+      "}\n";
+  v8::Local<v8::Script> v8_script =
+      v8::Script::Compile(env.local(), v8_str(source)).ToLocalChecked();
+  i::Handle<i::Script> i_script(
+      i::Script::cast(v8::Utils::OpenHandle(*v8_script)->shared()->script()),
+      CcTest::i_isolate());
+  v8::Local<v8::debug::Script> script =
+      v8::ToApiHandle<v8::debug::Script>(i_script);
+
+  // Test that when running through source positions the position, line and
+  // column progresses as expected.
+  v8::debug::Location prev_location = script->GetSourceLocation(0);
+  CHECK_EQ(prev_location.GetLineNumber(), 0);
+  CHECK_EQ(prev_location.GetColumnNumber(), 0);
+  for (int offset = 1; offset < 100; ++offset) {
+    v8::debug::Location location = script->GetSourceLocation(offset);
+    if (prev_location.GetLineNumber() == location.GetLineNumber()) {
+      CHECK_EQ(location.GetColumnNumber(), prev_location.GetColumnNumber() + 1);
+    } else {
+      CHECK_EQ(location.GetLineNumber(), prev_location.GetLineNumber() + 1);
+      CHECK_EQ(location.GetColumnNumber(), 0);
+    }
+    prev_location = location;
+  }
+
+  // Every line of d() is the same length.  Verify we can loop through all
+  // positions and find the right line # for each.
+  // The position of the first line of d(), i.e. "x = 1 ;".
+  const int start_line_d = 13;
+  const int start_code_d =
+      static_cast<int>(strstr(source, "  x = 1 ;") - source);
+  const int num_lines_d = 15;
+  const int line_length_d = 10;
+  int p = start_code_d;
+  for (int line = 0; line < num_lines_d; ++line) {
+    for (int column = 0; column < line_length_d; ++column) {
+      v8::debug::Location location = script->GetSourceLocation(p);
+      CHECK_EQ(location.GetLineNumber(), start_line_d + line);
+      CHECK_EQ(location.GetColumnNumber(), column);
+      ++p;
+    }
+  }
+
+  // Test first positon.
+  CHECK_EQ(script->GetSourceLocation(0).GetLineNumber(), 0);
+  CHECK_EQ(script->GetSourceLocation(0).GetColumnNumber(), 0);
+
+  // Test second positon.
+  CHECK_EQ(script->GetSourceLocation(1).GetLineNumber(), 0);
+  CHECK_EQ(script->GetSourceLocation(1).GetColumnNumber(), 1);
+
+  // Test first positin in function a().
+  const int start_a =
+      static_cast<int>(strstr(source, "function a") - source) + 10;
+  CHECK_EQ(script->GetSourceLocation(start_a).GetLineNumber(), 1);
+  CHECK_EQ(script->GetSourceLocation(start_a).GetColumnNumber(), 10);
+
+  // Test first positin in function b().
+  const int start_b =
+      static_cast<int>(strstr(source, "function    b") - source) + 13;
+  CHECK_EQ(script->GetSourceLocation(start_b).GetLineNumber(), 2);
+  CHECK_EQ(script->GetSourceLocation(start_b).GetColumnNumber(), 13);
+
+  // Test first positin in function c().
+  const int start_c =
+      static_cast<int>(strstr(source, "function c") - source) + 10;
+  CHECK_EQ(script->GetSourceLocation(start_c).GetLineNumber(), 5);
+  CHECK_EQ(script->GetSourceLocation(start_c).GetColumnNumber(), 12);
+
+  // Test first positin in function d().
+  const int start_d =
+      static_cast<int>(strstr(source, "function d") - source) + 10;
+  CHECK_EQ(script->GetSourceLocation(start_d).GetLineNumber(), 12);
+  CHECK_EQ(script->GetSourceLocation(start_d).GetColumnNumber(), 10);
+
+  // Test offsets.
+  CHECK_EQ(script->GetSourceOffset(v8::debug::Location(1, 10)), start_a);
+  CHECK_EQ(script->GetSourceOffset(v8::debug::Location(2, 13)), start_b);
+  CHECK_EQ(script->GetSourceOffset(v8::debug::Location(3, 0)), start_b + 5);
+  CHECK_EQ(script->GetSourceOffset(v8::debug::Location(3, 2)), start_b + 7);
+  CHECK_EQ(script->GetSourceOffset(v8::debug::Location(4, 0)), start_b + 16);
+  CHECK_EQ(script->GetSourceOffset(v8::debug::Location(5, 12)), start_c);
+  CHECK_EQ(script->GetSourceOffset(v8::debug::Location(6, 0)), start_c + 6);
+  CHECK_EQ(script->GetSourceOffset(v8::debug::Location(7, 0)), start_c + 19);
+  CHECK_EQ(script->GetSourceOffset(v8::debug::Location(8, 0)), start_c + 35);
+  CHECK_EQ(script->GetSourceOffset(v8::debug::Location(9, 0)), start_c + 48);
+  CHECK_EQ(script->GetSourceOffset(v8::debug::Location(10, 0)), start_c + 64);
+  CHECK_EQ(script->GetSourceOffset(v8::debug::Location(11, 0)), start_c + 70);
+  CHECK_EQ(script->GetSourceOffset(v8::debug::Location(12, 10)), start_d);
+  CHECK_EQ(script->GetSourceOffset(v8::debug::Location(13, 0)), start_d + 6);
+  for (int i = 1; i <= num_lines_d; ++i) {
+    CHECK_EQ(script->GetSourceOffset(v8::debug::Location(start_line_d + i, 0)),
+             6 + (i * line_length_d) + start_d);
+  }
+  CHECK_EQ(script->GetSourceOffset(v8::debug::Location(start_line_d + 17, 0)),
+           start_d + 158);
+
+  // Make sure invalid inputs work properly.
+  const int last_position = static_cast<int>(strlen(source)) - 1;
+  CHECK_EQ(script->GetSourceLocation(-1).GetLineNumber(), 0);
+  CHECK_EQ(script->GetSourceLocation(last_position + 2).GetLineNumber(),
+           i::kNoSourcePosition);
+
+  // Test last position.
+  CHECK_EQ(script->GetSourceLocation(last_position).GetLineNumber(), 28);
+  CHECK_EQ(script->GetSourceLocation(last_position).GetColumnNumber(), 1);
+  CHECK_EQ(script->GetSourceLocation(last_position + 1).GetLineNumber(), 29);
+  CHECK_EQ(script->GetSourceLocation(last_position + 1).GetColumnNumber(), 0);
+}
+
+namespace {
+class SetBreakpointOnScriptCompiled : public v8::debug::DebugDelegate {
+ public:
+  void ScriptCompiled(v8::Local<v8::debug::Script> script, bool is_live_edited,
+                      bool has_compile_error) override {
+    v8::Local<v8::String> name;
+    if (!script->SourceURL().ToLocal(&name)) return;
+    v8::Local<v8::Context> context = CcTest::isolate()->GetCurrentContext();
+    if (!name->Equals(context, v8_str("test")).FromJust()) return;
+    CHECK(!has_compile_error);
+    v8::debug::Location loc(1, 2);
+    CHECK(script->SetBreakpoint(v8_str(""), &loc, &id_));
+    CHECK_EQ(loc.GetLineNumber(), 1);
+    CHECK_EQ(loc.GetColumnNumber(), 10);
+  }
+
+  void BreakProgramRequested(v8::Local<v8::Context> paused_context,
+                             const std::vector<v8::debug::BreakpointId>&
+                                 inspector_break_points_hit) override {
+    ++break_count_;
+    CHECK_EQ(inspector_break_points_hit[0], id_);
+  }
+
+  int break_count() const { return break_count_; }
+
+ private:
+  int break_count_ = 0;
+  v8::debug::BreakpointId id_;
+};
+}  // anonymous namespace
+
+TEST(Regress517592) {
+  LocalContext env;
+  v8::HandleScope handle_scope(env->GetIsolate());
+  SetBreakpointOnScriptCompiled delegate;
+  v8::debug::SetDebugDelegate(env->GetIsolate(), &delegate);
+  CompileRun(
+      v8_str("eval('var foo = function foo() {\\n' +\n"
+             "'  var a = 1;\\n' +\n"
+             "'}\\n' +\n"
+             "'//@ sourceURL=test')"));
+  CHECK_EQ(delegate.break_count(), 0);
+  CompileRun(v8_str("foo()"));
+  CHECK_EQ(delegate.break_count(), 1);
+  v8::debug::SetDebugDelegate(env->GetIsolate(), nullptr);
+}
diff --git a/deps/v8/test/cctest/test-deoptimization.cc b/deps/v8/test/cctest/test-deoptimization.cc
index 9c9de7326b20ce..f0d62caff8e1dd 100644
--- a/deps/v8/test/cctest/test-deoptimization.cc
+++ b/deps/v8/test/cctest/test-deoptimization.cc
@@ -42,9 +42,7 @@ using ::v8::base::OS;
 using ::v8::internal::Deoptimizer;
 using ::v8::internal::EmbeddedVector;
 using ::v8::internal::Handle;
-using ::v8::internal::Isolate;
 using ::v8::internal::JSFunction;
-using ::v8::internal::Object;
 
 // Size of temp buffer for formatting small strings.
 #define SMALL_STRING_BUFFER_SIZE 80
diff --git a/deps/v8/test/cctest/test-dictionary.cc b/deps/v8/test/cctest/test-dictionary.cc
index 2554159f9198ca..df75285a051b93 100644
--- a/deps/v8/test/cctest/test-dictionary.cc
+++ b/deps/v8/test/cctest/test-dictionary.cc
@@ -37,6 +37,7 @@
 #include "src/heap/spaces.h"
 #include "src/macro-assembler.h"
 #include "src/objects-inl.h"
+#include "src/objects/hash-table-inl.h"
 #include "test/cctest/heap/heap-utils.h"
 
 namespace v8 {
@@ -56,13 +57,14 @@ static void TestHashMap(Handle<HashMap> table) {
   CHECK_EQ(1, table->NumberOfElements());
   CHECK_EQ(table->Lookup(a), *b);
   // When the key does not exist in the map, Lookup returns the hole.
-  CHECK_EQ(table->Lookup(b), CcTest::heap()->the_hole_value());
+  ReadOnlyRoots roots(CcTest::heap());
+  CHECK_EQ(table->Lookup(b), roots.the_hole_value());
 
   // Keys still have to be valid after objects were moved.
   CcTest::CollectGarbage(NEW_SPACE);
   CHECK_EQ(1, table->NumberOfElements());
   CHECK_EQ(table->Lookup(a), *b);
-  CHECK_EQ(table->Lookup(b), CcTest::heap()->the_hole_value());
+  CHECK_EQ(table->Lookup(b), roots.the_hole_value());
 
   // Keys that are overwritten should not change number of elements.
   table = HashMap::Put(table, a, factory->NewJSArray(13));
@@ -74,7 +76,7 @@ static void TestHashMap(Handle<HashMap> table) {
   table = HashMap::Remove(table, a, &was_present);
   CHECK(was_present);
   CHECK_EQ(0, table->NumberOfElements());
-  CHECK_EQ(table->Lookup(a), CcTest::heap()->the_hole_value());
+  CHECK_EQ(table->Lookup(a), roots.the_hole_value());
 
   // Keys should map back to their respective values and also should get
   // an identity hash code generated.
@@ -94,7 +96,7 @@ static void TestHashMap(Handle<HashMap> table) {
     Handle<JSReceiver> key = factory->NewJSArray(7);
     CHECK(key->GetOrCreateIdentityHash(isolate)->IsSmi());
     CHECK_EQ(table->FindEntry(key), HashMap::kNotFound);
-    CHECK_EQ(table->Lookup(key), CcTest::heap()->the_hole_value());
+    CHECK_EQ(table->Lookup(key), roots.the_hole_value());
     CHECK(key->GetIdentityHash(isolate)->IsSmi());
   }
 
@@ -102,9 +104,9 @@ static void TestHashMap(Handle<HashMap> table) {
   // should not get an identity hash code generated.
   for (int i = 0; i < 100; i++) {
     Handle<JSReceiver> key = factory->NewJSArray(7);
-    CHECK_EQ(table->Lookup(key), CcTest::heap()->the_hole_value());
+    CHECK_EQ(table->Lookup(key), roots.the_hole_value());
     Object* identity_hash = key->GetIdentityHash(isolate);
-    CHECK_EQ(CcTest::heap()->undefined_value(), identity_hash);
+    CHECK_EQ(roots.undefined_value(), identity_hash);
   }
 }
 
@@ -174,7 +176,7 @@ static void TestHashSet(Handle<HashSet> table) {
     Handle<JSReceiver> key = factory->NewJSArray(7);
     CHECK(!table->Has(isolate, key));
     Object* identity_hash = key->GetIdentityHash(isolate);
-    CHECK_EQ(CcTest::heap()->undefined_value(), identity_hash);
+    CHECK_EQ(ReadOnlyRoots(CcTest::heap()).undefined_value(), identity_hash);
   }
 }
 
diff --git a/deps/v8/test/cctest/test-disasm-arm.cc b/deps/v8/test/cctest/test-disasm-arm.cc
index 52912b75913079..d1cebe81386d64 100644
--- a/deps/v8/test/cctest/test-disasm-arm.cc
+++ b/deps/v8/test/cctest/test-disasm-arm.cc
@@ -28,6 +28,10 @@
 
 #include <stdlib.h>
 
+// The C++ style guide recommends using <re2> instead of <regex>. However, the
+// former isn't available in V8.
+#include <regex>  // NOLINT(build/c++11)
+
 #include "src/assembler-inl.h"
 #include "src/boxed-float.h"
 #include "src/debug/debug.h"
@@ -43,8 +47,11 @@
 namespace v8 {
 namespace internal {
 
+enum UseRegex { kRawString, kRegexString };
+
 template <typename... S>
-bool DisassembleAndCompare(byte* begin, S... expected_strings) {
+bool DisassembleAndCompare(byte* begin, UseRegex use_regex,
+                           S... expected_strings) {
   disasm::NameConverter converter;
   disasm::Disassembler disasm(converter);
   EmbeddedVector<char, 128> buffer;
@@ -62,14 +69,28 @@ bool DisassembleAndCompare(byte* begin, S... expected_strings) {
   bool test_passed = true;
 
   for (size_t i = 0; i < disassembly.size(); i++) {
-    if (expected_disassembly[i] != disassembly[i]) {
-      fprintf(stderr,
-              "expected: \n"
-              "%s\n"
-              "disassembled: \n"
-              "%s\n\n",
-              expected_disassembly[i].c_str(), disassembly[i].c_str());
-      test_passed = false;
+    if (use_regex == kRawString) {
+      if (expected_disassembly[i] != disassembly[i]) {
+        fprintf(stderr,
+                "expected: \n"
+                "%s\n"
+                "disassembled: \n"
+                "%s\n\n",
+                expected_disassembly[i].c_str(), disassembly[i].c_str());
+        test_passed = false;
+      }
+    } else {
+      DCHECK_EQ(use_regex, kRegexString);
+      if (!std::regex_match(disassembly[i],
+                            std::regex(expected_disassembly[i]))) {
+        fprintf(stderr,
+                "expected (regex): \n"
+                "%s\n"
+                "disassembled: \n"
+                "%s\n\n",
+                expected_disassembly[i].c_str(), disassembly[i].c_str());
+        test_passed = false;
+      }
     }
   }
 
@@ -85,27 +106,32 @@ bool DisassembleAndCompare(byte* begin, S... expected_strings) {
 // Set up V8 to a state where we can at least run the assembler and
 // disassembler. Declare the variables and allocate the data structures used
 // in the rest of the macros.
-#define SET_UP()                                          \
-  CcTest::InitializeVM();                                 \
-  Isolate* isolate = CcTest::i_isolate();                  \
-  HandleScope scope(isolate);                             \
-  byte *buffer = reinterpret_cast<byte*>(malloc(4*1024)); \
-  Assembler assm(isolate, buffer, 4*1024);                \
+#define SET_UP()                                            \
+  CcTest::InitializeVM();                                   \
+  Isolate* isolate = CcTest::i_isolate();                   \
+  HandleScope scope(isolate);                               \
+  byte* buffer = reinterpret_cast<byte*>(malloc(4 * 1024)); \
+  Assembler assm(AssemblerOptions{}, buffer, 4 * 1024);     \
   bool failure = false;
 
-
 // This macro assembles one instruction using the preallocated assembler and
 // disassembles the generated instruction, comparing the output to the expected
 // value. If the comparison fails an error message is printed, but the test
 // continues to run until the end.
-#define COMPARE(asm_, ...)                                                \
-  {                                                                       \
-    int pc_offset = assm.pc_offset();                                     \
-    byte* progcounter = &buffer[pc_offset];                               \
-    assm.asm_;                                                            \
-    if (!DisassembleAndCompare(progcounter, __VA_ARGS__)) failure = true; \
+#define BASE_COMPARE(asm_, use_regex, ...)                             \
+  {                                                                    \
+    int pc_offset = assm.pc_offset();                                  \
+    byte* progcounter = &buffer[pc_offset];                            \
+    assm.asm_;                                                         \
+    if (!DisassembleAndCompare(progcounter, use_regex, __VA_ARGS__)) { \
+      failure = true;                                                  \
+    }                                                                  \
   }
 
+#define COMPARE(asm_, ...) BASE_COMPARE(asm_, kRawString, __VA_ARGS__)
+
+#define COMPARE_REGEX(asm_, ...) BASE_COMPARE(asm_, kRegexString, __VA_ARGS__)
+
 // Force emission of any pending literals into a pool.
 #define EMIT_PENDING_LITERALS() \
   assm.CheckConstPool(true, false)
@@ -1488,7 +1514,9 @@ static void TestLoadLiteral(byte* buffer, Assembler* assm, bool* failure,
   snprintf(expected_string, sizeof(expected_string), expected_string_template,
            abs(offset), offset,
            progcounter + Instruction::kPCReadOffset + offset);
-  if (!DisassembleAndCompare(progcounter, expected_string)) *failure = true;
+  if (!DisassembleAndCompare(progcounter, kRawString, expected_string)) {
+    *failure = true;
+  }
 }
 
 
@@ -1591,17 +1619,31 @@ TEST(LoadStoreExclusive) {
 TEST(SplitAddImmediate) {
   SET_UP();
 
-  // Re-use the destination as a scratch.
-  COMPARE(add(r0, r1, Operand(0x12345678)),
-          "e3050678       movw r0, #22136",
-          "e3410234       movt r0, #4660",
-          "e0810000       add r0, r1, r0");
-
-  // Use ip as a scratch.
-  COMPARE(add(r0, r0, Operand(0x12345678)),
-          "e305c678       movw ip, #22136",
-          "e341c234       movt ip, #4660",
-          "e080000c       add r0, r0, ip");
+  if (CpuFeatures::IsSupported(ARMv7)) {
+    // Re-use the destination as a scratch.
+    COMPARE(add(r0, r1, Operand(0x12345678)),
+            "e3050678       movw r0, #22136",
+            "e3410234       movt r0, #4660",
+            "e0810000       add r0, r1, r0");
+
+    // Use ip as a scratch.
+    COMPARE(add(r0, r0, Operand(0x12345678)),
+            "e305c678       movw ip, #22136",
+            "e341c234       movt ip, #4660",
+            "e080000c       add r0, r0, ip");
+  } else {
+    // Re-use the destination as a scratch.
+    COMPARE_REGEX(add(r0, r1, Operand(0x12345678)),
+                  "e59f0[0-9a-f]{3}       "
+                      "ldr r0, \\[pc, #\\+[0-9]+\\] \\(addr 0x[0-9a-f]{8}\\)",
+                  "e0810000       add r0, r1, r0");
+
+    // Use ip as a scratch.
+    COMPARE_REGEX(add(r0, r0, Operand(0x12345678)),
+                  "e59fc[0-9a-f]{3}       "
+                      "ldr ip, \\[pc, #\\+[0-9]+\\] \\(addr 0x[0-9a-f]{8}\\)",
+                  "e080000c       add r0, r0, ip");
+  }
 
   // If ip is not available, split the operation into multiple additions.
   {
diff --git a/deps/v8/test/cctest/test-disasm-arm64.cc b/deps/v8/test/cctest/test-disasm-arm64.cc
index 3813408a2bb99a..275feaa88eabe0 100644
--- a/deps/v8/test/cctest/test-disasm-arm64.cc
+++ b/deps/v8/test/cctest/test-disasm-arm64.cc
@@ -62,16 +62,16 @@ namespace internal {
   DisassemblingDecoder* disasm = new DisassemblingDecoder();             \
   decoder->AppendVisitor(disasm)
 
-#define SET_UP_ASM()                                         \
-  InitializeVM();                                            \
-  Isolate* isolate = CcTest::i_isolate();                    \
-  HandleScope scope(isolate);                                \
-  byte* buf = static_cast<byte*>(malloc(INSTR_SIZE));        \
-  uint32_t encoding = 0;                                     \
-  Assembler* assm = new Assembler(isolate, buf, INSTR_SIZE); \
-  Decoder<DispatchingDecoderVisitor>* decoder =              \
-      new Decoder<DispatchingDecoderVisitor>();              \
-  DisassemblingDecoder* disasm = new DisassemblingDecoder(); \
+#define SET_UP_ASM()                                                    \
+  InitializeVM();                                                       \
+  Isolate* isolate = CcTest::i_isolate();                               \
+  HandleScope scope(isolate);                                           \
+  byte* buf = static_cast<byte*>(malloc(INSTR_SIZE));                   \
+  uint32_t encoding = 0;                                                \
+  Assembler* assm = new Assembler(AssemblerOptions{}, buf, INSTR_SIZE); \
+  Decoder<DispatchingDecoderVisitor>* decoder =                         \
+      new Decoder<DispatchingDecoderVisitor>();                         \
+  DisassemblingDecoder* disasm = new DisassemblingDecoder();            \
   decoder->AppendVisitor(disasm)
 
 #define COMPARE(ASM, EXP)                                                \
@@ -1872,27 +1872,39 @@ TEST_(system_nop) {
 
 
 TEST_(debug) {
-  SET_UP_ASM();
-
-  CHECK_EQ(kImmExceptionIsDebug, 0xdeb0);
-
-  // All debug codes should produce the same instruction, and the debug code
-  // can be any uint32_t.
-#ifdef USE_SIMULATOR
-  const char* expected_instruction = "hlt #0xdeb0";
-#else
-  const char* expected_instruction = "brk #0x0";
-#endif
-
-  COMPARE(debug("message", 0, BREAK), expected_instruction);
-  COMPARE(debug("message", 1, BREAK), expected_instruction);
-  COMPARE(debug("message", 0xffff, BREAK), expected_instruction);
-  COMPARE(debug("message", 0x10000, BREAK), expected_instruction);
-  COMPARE(debug("message", 0x7fffffff, BREAK), expected_instruction);
-  COMPARE(debug("message", 0x80000000u, BREAK), expected_instruction);
-  COMPARE(debug("message", 0xffffffffu, BREAK), expected_instruction);
-
-  CLEANUP();
+  InitializeVM();
+  Isolate* isolate = CcTest::i_isolate();
+
+  for (int i = 0; i < 2; i++) {
+    // Loop runs with and without the simulator code enabled.
+    HandleScope scope(isolate);
+    byte* buf = static_cast<byte*>(malloc(INSTR_SIZE));
+    uint32_t encoding = 0;
+    AssemblerOptions options;
+    options.enable_simulator_code = (i == 1);
+    Assembler* assm = new Assembler(options, buf, INSTR_SIZE);
+    Decoder<DispatchingDecoderVisitor>* decoder =
+        new Decoder<DispatchingDecoderVisitor>();
+    DisassemblingDecoder* disasm = new DisassemblingDecoder();
+    decoder->AppendVisitor(disasm);
+
+    CHECK_EQ(kImmExceptionIsDebug, 0xdeb0);
+
+    // All debug codes should produce the same instruction, and the debug code
+    // can be any uint32_t.
+    const char* expected_instruction =
+        options.enable_simulator_code ? "hlt #0xdeb0" : "brk #0x0";
+
+    COMPARE(debug("message", 0, BREAK), expected_instruction);
+    COMPARE(debug("message", 1, BREAK), expected_instruction);
+    COMPARE(debug("message", 0xffff, BREAK), expected_instruction);
+    COMPARE(debug("message", 0x10000, BREAK), expected_instruction);
+    COMPARE(debug("message", 0x7fffffff, BREAK), expected_instruction);
+    COMPARE(debug("message", 0x80000000u, BREAK), expected_instruction);
+    COMPARE(debug("message", 0xffffffffu, BREAK), expected_instruction);
+
+    CLEANUP();
+  }
 }
 
 
diff --git a/deps/v8/test/cctest/test-disasm-ia32.cc b/deps/v8/test/cctest/test-disasm-ia32.cc
index df70dcac4a362d..7aa75a5c8a87b3 100644
--- a/deps/v8/test/cctest/test-disasm-ia32.cc
+++ b/deps/v8/test/cctest/test-disasm-ia32.cc
@@ -42,26 +42,6 @@ namespace internal {
 
 #define __ assm.
 
-void Disassemble(FILE* f, byte* begin, byte* end) {
-  disasm::NameConverter converter;
-  disasm::Disassembler d(converter);
-  for (byte* pc = begin; pc < end;) {
-    v8::internal::EmbeddedVector<char, 128> buffer;
-    buffer[0] = '\0';
-    byte* prev_pc = pc;
-    pc += d.InstructionDecodeForTesting(buffer, pc);
-    fprintf(f, "%p", static_cast<void*>(prev_pc));
-    fprintf(f, "    ");
-
-    for (byte* bp = prev_pc; bp < pc; bp++) {
-      fprintf(f, "%02x", *bp);
-    }
-    for (int i = 6 - (pc - prev_pc); i >= 0; i--) {
-      fprintf(f, "  ");
-    }
-    fprintf(f, "  %s\n", buffer.start());
-  }
-}
 static void DummyStaticFunction(Object* result) {
 }
 
@@ -71,7 +51,7 @@ TEST(DisasmIa320) {
   Isolate* isolate = CcTest::i_isolate();
   HandleScope scope(isolate);
   v8::internal::byte buffer[8192];
-  Assembler assm(isolate, buffer, sizeof buffer);
+  Assembler assm(AssemblerOptions{}, buffer, sizeof buffer);
   DummyStaticFunction(nullptr);  // just bloody use it (DELETE; debugging)
   // Short immediate instructions
   __ adc(eax, 12345678);
@@ -516,6 +496,8 @@ TEST(DisasmIa320) {
     __ psrlq(xmm0, 17);
     __ psrlq(xmm0, xmm1);
 
+    __ pshufhw(xmm5, xmm1, 5);
+    __ pshufhw(xmm5, Operand(edx, 4), 5);
     __ pshuflw(xmm5, xmm1, 5);
     __ pshuflw(xmm5, Operand(edx, 4), 5);
     __ pshufd(xmm5, xmm1, 5);
@@ -567,6 +549,8 @@ TEST(DisasmIa320) {
     if (CpuFeatures::IsSupported(SSSE3)) {
       CpuFeatureScope scope(&assm, SSSE3);
       SSSE3_INSTRUCTION_LIST(EMIT_SSE34_INSTR)
+      __ palignr(xmm5, xmm1, 5);
+      __ palignr(xmm5, Operand(edx, 4), 5);
     }
   }
 
@@ -590,6 +574,7 @@ TEST(DisasmIa320) {
       __ extractps(eax, xmm1, 0);
 
       SSE4_INSTRUCTION_LIST(EMIT_SSE34_INSTR)
+      SSE4_RM_INSTRUCTION_LIST(EMIT_SSE34_INSTR)
     }
   }
 #undef EMIT_SSE34_INSTR
@@ -687,12 +672,16 @@ TEST(DisasmIa320) {
       __ vpsraw(xmm0, xmm7, 21);
       __ vpsrad(xmm0, xmm7, 21);
 
+      __ vpshufhw(xmm5, xmm1, 5);
+      __ vpshufhw(xmm5, Operand(edx, 4), 5);
       __ vpshuflw(xmm5, xmm1, 5);
       __ vpshuflw(xmm5, Operand(edx, 4), 5);
       __ vpshufd(xmm5, xmm1, 5);
       __ vpshufd(xmm5, Operand(edx, 4), 5);
       __ vpblendw(xmm5, xmm1, xmm0, 5);
       __ vpblendw(xmm5, xmm1, Operand(edx, 4), 5);
+      __ vpalignr(xmm5, xmm1, xmm0, 5);
+      __ vpalignr(xmm5, xmm1, Operand(edx, 4), 5);
       __ vpextrb(eax, xmm0, 1);
       __ vpextrb(Operand(edx, 4), xmm0, 1);
       __ vpextrw(eax, xmm0, 1);
@@ -734,6 +723,14 @@ TEST(DisasmIa320) {
       SSSE3_INSTRUCTION_LIST(EMIT_SSE34_AVXINSTR)
       SSE4_INSTRUCTION_LIST(EMIT_SSE34_AVXINSTR)
 #undef EMIT_SSE34_AVXINSTR
+
+#define EMIT_SSE4_RM_AVXINSTR(instruction, notUsed1, notUsed2, notUsed3, \
+                              notUsed4)                                  \
+  __ v##instruction(xmm5, xmm1);                                         \
+  __ v##instruction(xmm5, Operand(edx, 4));
+
+      SSE4_RM_INSTRUCTION_LIST(EMIT_SSE4_RM_AVXINSTR)
+#undef EMIT_SSE4_RM_AVXINSTR
     }
   }
 
@@ -890,6 +887,7 @@ TEST(DisasmIa320) {
     __ Nop(i);
   }
 
+  __ pause();
   __ ret(0);
 
   CodeDesc desc;
@@ -898,11 +896,12 @@ TEST(DisasmIa320) {
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
   USE(code);
 #ifdef OBJECT_PRINT
-  OFStream os(stdout);
-  code->Print(os);
-  byte* begin = code->raw_instruction_start();
-  byte* end = begin + code->raw_instruction_size();
-  Disassemble(stdout, begin, end);
+  StdoutStream os;
+  code->Print(isolate, os);
+  Address begin = code->raw_instruction_start();
+  Address end = code->raw_instruction_end();
+  disasm::Disassembler::Disassemble(stdout, reinterpret_cast<byte*>(begin),
+                                    reinterpret_cast<byte*>(end));
 #endif
 }
 
diff --git a/deps/v8/test/cctest/test-disasm-mips.cc b/deps/v8/test/cctest/test-disasm-mips.cc
index e394f9428a090d..100eb426a0363c 100644
--- a/deps/v8/test/cctest/test-disasm-mips.cc
+++ b/deps/v8/test/cctest/test-disasm-mips.cc
@@ -70,15 +70,14 @@ bool DisassembleAndCompare(byte* pc, const char* compare_string) {
 // Set up V8 to a state where we can at least run the assembler and
 // disassembler. Declare the variables and allocate the data structures used
 // in the rest of the macros.
-#define SET_UP()                                          \
-  CcTest::InitializeVM();                                 \
-  Isolate* isolate = CcTest::i_isolate();                  \
-  HandleScope scope(isolate);                             \
-  byte *buffer = reinterpret_cast<byte*>(malloc(4*1024)); \
-  Assembler assm(isolate, buffer, 4*1024);                \
+#define SET_UP()                                            \
+  CcTest::InitializeVM();                                   \
+  Isolate* isolate = CcTest::i_isolate();                   \
+  HandleScope scope(isolate);                               \
+  byte* buffer = reinterpret_cast<byte*>(malloc(4 * 1024)); \
+  Assembler assm(AssemblerOptions{}, buffer, 4 * 1024);     \
   bool failure = false;
 
-
 // This macro assembles one instruction using the preallocated assembler and
 // disassembles the generated instruction, comparing the output to the expected
 // value. If the comparison fails an error message is printed, but the test
diff --git a/deps/v8/test/cctest/test-disasm-mips64.cc b/deps/v8/test/cctest/test-disasm-mips64.cc
index 0a16e860b35deb..29497fd9d695ac 100644
--- a/deps/v8/test/cctest/test-disasm-mips64.cc
+++ b/deps/v8/test/cctest/test-disasm-mips64.cc
@@ -70,15 +70,14 @@ bool DisassembleAndCompare(byte* pc, const char* compare_string) {
 // Set up V8 to a state where we can at least run the assembler and
 // disassembler. Declare the variables and allocate the data structures used
 // in the rest of the macros.
-#define SET_UP()                                          \
-  CcTest::InitializeVM();                                 \
-  Isolate* isolate = CcTest::i_isolate();                  \
-  HandleScope scope(isolate);                             \
-  byte *buffer = reinterpret_cast<byte*>(malloc(4*1024)); \
-  Assembler assm(isolate, buffer, 4*1024);                \
+#define SET_UP()                                            \
+  CcTest::InitializeVM();                                   \
+  Isolate* isolate = CcTest::i_isolate();                   \
+  HandleScope scope(isolate);                               \
+  byte* buffer = reinterpret_cast<byte*>(malloc(4 * 1024)); \
+  Assembler assm(AssemblerOptions{}, buffer, 4 * 1024);     \
   bool failure = false;
 
-
 // This macro assembles one instruction using the preallocated assembler and
 // disassembles the generated instruction, comparing the output to the expected
 // value. If the comparison fails an error message is printed, but the test
diff --git a/deps/v8/test/cctest/test-disasm-ppc.cc b/deps/v8/test/cctest/test-disasm-ppc.cc
index 9650fee7a64fe8..3193fee93125e7 100644
--- a/deps/v8/test/cctest/test-disasm-ppc.cc
+++ b/deps/v8/test/cctest/test-disasm-ppc.cc
@@ -68,10 +68,9 @@ bool DisassembleAndCompare(byte* pc, const char* compare_string) {
   Isolate* isolate = CcTest::i_isolate();                   \
   HandleScope scope(isolate);                               \
   byte* buffer = reinterpret_cast<byte*>(malloc(4 * 1024)); \
-  Assembler assm(isolate, buffer, 4 * 1024);                \
+  Assembler assm(AssemblerOptions{}, buffer, 4 * 1024);     \
   bool failure = false;
 
-
 // This macro assembles one instruction using the preallocated assembler and
 // disassembles the generated instruction, comparing the output to the expected
 // value. If the comparison fails an error message is printed, but the test
diff --git a/deps/v8/test/cctest/test-disasm-s390.cc b/deps/v8/test/cctest/test-disasm-s390.cc
index e4f8c553076a62..c575b9566cb35c 100644
--- a/deps/v8/test/cctest/test-disasm-s390.cc
+++ b/deps/v8/test/cctest/test-disasm-s390.cc
@@ -67,7 +67,7 @@ bool DisassembleAndCompare(byte* pc, const char* compare_string) {
   Isolate* isolate = CcTest::i_isolate();                   \
   HandleScope scope(isolate);                               \
   byte* buffer = reinterpret_cast<byte*>(malloc(4 * 1024)); \
-  Assembler assm(isolate, buffer, 4 * 1024);                \
+  Assembler assm(AssemblerOptions{}, buffer, 4 * 1024);     \
   bool failure = false;
 
 // This macro assembles one instruction using the preallocated assembler and
@@ -187,9 +187,9 @@ TEST(SixBytes) {
   COMPARE(slag(r1, r3, r2), "eb132000000b   slag\tr1,r3,0(r2)");
   COMPARE(srag(r1, r3, r2), "eb132000000a   srag\tr1,r3,0(r2)");
   COMPARE(srag(r1, r3, Operand(2)), "eb130002000a   srag\tr1,r3,2(r0)");
-  COMPARE(risbg(r1, r2, Operand(3), Operand(5), Operand(2), false),
+  COMPARE(risbg(r1, r2, Operand(3), Operand(5), Operand(2)),
           "ec1203050255   risbg\tr1,r2,3,5,2");
-  COMPARE(risbgn(r1, r2, Operand(3), Operand(5), Operand(2), false),
+  COMPARE(risbgn(r1, r2, Operand(3), Operand(5), Operand(2)),
           "ec1203050259   risbgn\tr1,r2,3,5,2");
   COMPARE(stmg(r3, r4, MemOperand(sp, 10)),
           "eb34f00a0024   stmg\tr3,r4,10(sp)");
@@ -290,8 +290,8 @@ TEST(SixBytes) {
   COMPARE(clg(r9, MemOperand(r6, r7, 19)), "e39670130021   clg\tr9,19(r6,r7)");
   COMPARE(bctg(r8, MemOperand(sp, 10)), "e380f00a0046   bctg\tr8,10(sp)");
   COMPARE(icy(r2, MemOperand(r3, 2)), "e32030020073   icy\tr2,2(r3)");
-  COMPARE(mvc(MemOperand(r9, 9), MemOperand(r3, 15), 10),
-          "d2099009300f   mvc\t9(9,r9),15(r3)");
+  COMPARE(mvc(MemOperand(r9, 9), MemOperand(r3, 15), Operand(10)),
+          "d20a9009300f   mvc\t9(10,r9),15(r3)");
   COMPARE(nilf(r0, Operand(8000)), "c00b00001f40   nilf\tr0,8000");
   COMPARE(oilf(r9, Operand(1000)), "c09d000003e8   oilf\tr9,1000");
 
diff --git a/deps/v8/test/cctest/test-disasm-x64.cc b/deps/v8/test/cctest/test-disasm-x64.cc
index 5d5bee849b5e30..61f6ac6b49210b 100644
--- a/deps/v8/test/cctest/test-disasm-x64.cc
+++ b/deps/v8/test/cctest/test-disasm-x64.cc
@@ -47,33 +47,12 @@ namespace internal {
 static void DummyStaticFunction(Object* result) {
 }
 
-void Disassemble(FILE* f, byte* begin, byte* end) {
-  disasm::NameConverter converter;
-  disasm::Disassembler d(converter);
-  for (byte* pc = begin; pc < end;) {
-    v8::internal::EmbeddedVector<char, 128> buffer;
-    buffer[0] = '\0';
-    byte* prev_pc = pc;
-    pc += d.InstructionDecodeForTesting(buffer, pc);
-    fprintf(f, "%p", static_cast<void*>(prev_pc));
-    fprintf(f, "    ");
-
-    for (byte* bp = prev_pc; bp < pc; bp++) {
-      fprintf(f, "%02x", *bp);
-    }
-    for (int i = 6 - static_cast<int>(pc - prev_pc); i >= 0; i--) {
-      fprintf(f, "  ");
-    }
-    fprintf(f, "  %s\n", buffer.start());
-  }
-}
-
 TEST(DisasmX64) {
   CcTest::InitializeVM();
   Isolate* isolate = CcTest::i_isolate();
   HandleScope scope(isolate);
   v8::internal::byte buffer[8192];
-  Assembler assm(isolate, buffer, sizeof buffer);
+  Assembler assm(AssemblerOptions{}, buffer, sizeof buffer);
   DummyStaticFunction(nullptr);  // just bloody use it (DELETE; debugging)
 
   // Short immediate instructions
@@ -976,6 +955,7 @@ TEST(DisasmX64) {
     __ Nop(i);
   }
 
+  __ pause();
   __ ret(0);
 
   CodeDesc desc;
@@ -984,11 +964,12 @@ TEST(DisasmX64) {
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
   USE(code);
 #ifdef OBJECT_PRINT
-  OFStream os(stdout);
-  code->Print(os);
-  byte* begin = code->raw_instruction_start();
-  byte* end = begin + code->raw_instruction_size();
-  Disassemble(stdout, begin, end);
+  StdoutStream os;
+  code->Print(isolate, os);
+  Address begin = code->raw_instruction_start();
+  Address end = code->raw_instruction_end();
+  disasm::Disassembler::Disassemble(stdout, reinterpret_cast<byte*>(begin),
+                                    reinterpret_cast<byte*>(end));
 #endif
 }
 
diff --git a/deps/v8/test/cctest/test-elements-kind.cc b/deps/v8/test/cctest/test-elements-kind.cc
index 33df810c89925b..5237a541738f0d 100644
--- a/deps/v8/test/cctest/test-elements-kind.cc
+++ b/deps/v8/test/cctest/test-elements-kind.cc
@@ -39,25 +39,22 @@ Handle<String> MakeName(const char* str, int suffix) {
   return MakeString(buffer.start());
 }
 
-
 template <typename T, typename M>
-bool EQUALS(Handle<T> left, Handle<M> right) {
+bool EQUALS(Isolate* isolate, Handle<T> left, Handle<M> right) {
   if (*left == *right) return true;
-  return JSObject::Equals(Handle<Object>::cast(left),
+  return JSObject::Equals(isolate, Handle<Object>::cast(left),
                           Handle<Object>::cast(right))
       .FromJust();
 }
 
-
 template <typename T, typename M>
-bool EQUALS(Handle<T> left, M right) {
-  return EQUALS(left, handle(right));
+bool EQUALS(Isolate* isolate, Handle<T> left, M right) {
+  return EQUALS(isolate, left, handle(right, isolate));
 }
 
-
 template <typename T, typename M>
-bool EQUALS(T left, Handle<M> right) {
-  return EQUALS(handle(left, right->GetIsolate()), right);
+bool EQUALS(Isolate* isolate, T left, Handle<M> right) {
+  return EQUALS(isolate, handle(left, isolate), right);
 }
 
 }  // namespace
@@ -80,10 +77,10 @@ TEST(JSObjectAddingProperties) {
   Handle<Object> value(Smi::FromInt(42), isolate);
 
   Handle<JSObject> object = factory->NewJSObject(function);
-  Handle<Map> previous_map(object->map());
+  Handle<Map> previous_map(object->map(), isolate);
   CHECK_EQ(HOLEY_ELEMENTS, previous_map->elements_kind());
-  CHECK(EQUALS(object->property_array(), empty_property_array));
-  CHECK(EQUALS(object->elements(), empty_fixed_array));
+  CHECK(EQUALS(isolate, object->property_array(), empty_property_array));
+  CHECK(EQUALS(isolate, object->elements(), empty_fixed_array));
 
   // for the default constructor function no in-object properties are reserved
   // hence adding a single property will initialize the property-array
@@ -93,7 +90,7 @@ TEST(JSObjectAddingProperties) {
   CHECK_NE(object->map(), *previous_map);
   CHECK_EQ(HOLEY_ELEMENTS, object->map()->elements_kind());
   CHECK_LE(1, object->property_array()->length());
-  CHECK(EQUALS(object->elements(), empty_fixed_array));
+  CHECK(EQUALS(isolate, object->elements(), empty_fixed_array));
 }
 
 
@@ -113,10 +110,10 @@ TEST(JSObjectInObjectAddingProperties) {
   Handle<Object> value(Smi::FromInt(42), isolate);
 
   Handle<JSObject> object = factory->NewJSObject(function);
-  Handle<Map> previous_map(object->map());
+  Handle<Map> previous_map(object->map(), isolate);
   CHECK_EQ(HOLEY_ELEMENTS, previous_map->elements_kind());
-  CHECK(EQUALS(object->property_array(), empty_property_array));
-  CHECK(EQUALS(object->elements(), empty_fixed_array));
+  CHECK(EQUALS(isolate, object->property_array(), empty_property_array));
+  CHECK(EQUALS(isolate, object->elements(), empty_fixed_array));
 
   // we have reserved space for in-object properties, hence adding up to
   // |nof_inobject_properties| will not create a property store
@@ -127,8 +124,8 @@ TEST(JSObjectInObjectAddingProperties) {
   }
   CHECK_NE(object->map(), *previous_map);
   CHECK_EQ(HOLEY_ELEMENTS, object->map()->elements_kind());
-  CHECK(EQUALS(object->property_array(), empty_property_array));
-  CHECK(EQUALS(object->elements(), empty_fixed_array));
+  CHECK(EQUALS(isolate, object->property_array(), empty_property_array));
+  CHECK(EQUALS(isolate, object->elements(), empty_fixed_array));
 
   // adding one more property will not fit in the in-object properties, thus
   // creating a property store
@@ -140,7 +137,7 @@ TEST(JSObjectInObjectAddingProperties) {
   CHECK_EQ(HOLEY_ELEMENTS, object->map()->elements_kind());
   // there must be at least 1 element in the properies store
   CHECK_LE(1, object->property_array()->length());
-  CHECK(EQUALS(object->elements(), empty_fixed_array));
+  CHECK(EQUALS(isolate, object->elements(), empty_fixed_array));
 }
 
 
@@ -158,10 +155,10 @@ TEST(JSObjectAddingElements) {
   Handle<Object> value(Smi::FromInt(42), isolate);
 
   Handle<JSObject> object = factory->NewJSObject(function);
-  Handle<Map> previous_map(object->map());
+  Handle<Map> previous_map(object->map(), isolate);
   CHECK_EQ(HOLEY_ELEMENTS, previous_map->elements_kind());
-  CHECK(EQUALS(object->property_array(), empty_property_array));
-  CHECK(EQUALS(object->elements(), empty_fixed_array));
+  CHECK(EQUALS(isolate, object->property_array(), empty_property_array));
+  CHECK(EQUALS(isolate, object->elements(), empty_fixed_array));
 
   // Adding an indexed element initializes the elements array
   name = MakeString("0");
@@ -170,7 +167,7 @@ TEST(JSObjectAddingElements) {
   // no change in elements_kind => no map transition
   CHECK_EQ(object->map(), *previous_map);
   CHECK_EQ(HOLEY_ELEMENTS, object->map()->elements_kind());
-  CHECK(EQUALS(object->property_array(), empty_property_array));
+  CHECK(EQUALS(isolate, object->property_array(), empty_property_array));
   CHECK_LE(1, object->elements()->length());
 
   // Adding more consecutive elements without a change in the backing store
@@ -183,7 +180,7 @@ TEST(JSObjectAddingElements) {
   // no change in elements_kind => no map transition
   CHECK_EQ(object->map(), *previous_map);
   CHECK_EQ(HOLEY_ELEMENTS, object->map()->elements_kind());
-  CHECK(EQUALS(object->property_array(), empty_property_array));
+  CHECK(EQUALS(isolate, object->property_array(), empty_property_array));
   CHECK_LE(non_dict_backing_store_limit, object->elements()->length());
 
   // Adding an element at an very large index causes a change to
@@ -194,7 +191,7 @@ TEST(JSObjectAddingElements) {
   // change in elements_kind => map transition
   CHECK_NE(object->map(), *previous_map);
   CHECK_EQ(DICTIONARY_ELEMENTS, object->map()->elements_kind());
-  CHECK(EQUALS(object->property_array(), empty_property_array));
+  CHECK(EQUALS(isolate, object->property_array(), empty_property_array));
   CHECK_LE(non_dict_backing_store_limit, object->elements()->length());
 }
 
@@ -211,10 +208,10 @@ TEST(JSArrayAddingProperties) {
 
   Handle<JSArray> array =
       factory->NewJSArray(ElementsKind::PACKED_SMI_ELEMENTS, 0, 0);
-  Handle<Map> previous_map(array->map());
+  Handle<Map> previous_map(array->map(), isolate);
   CHECK_EQ(PACKED_SMI_ELEMENTS, previous_map->elements_kind());
-  CHECK(EQUALS(array->property_array(), empty_property_array));
-  CHECK(EQUALS(array->elements(), empty_fixed_array));
+  CHECK(EQUALS(isolate, array->property_array(), empty_property_array));
+  CHECK(EQUALS(isolate, array->elements(), empty_fixed_array));
   CHECK_EQ(0, Smi::ToInt(array->length()));
 
   // for the default constructor function no in-object properties are reserved
@@ -226,7 +223,7 @@ TEST(JSArrayAddingProperties) {
   CHECK_NE(array->map(), *previous_map);
   CHECK_EQ(PACKED_SMI_ELEMENTS, array->map()->elements_kind());
   CHECK_LE(1, array->property_array()->length());
-  CHECK(EQUALS(array->elements(), empty_fixed_array));
+  CHECK(EQUALS(isolate, array->elements(), empty_fixed_array));
   CHECK_EQ(0, Smi::ToInt(array->length()));
 }
 
@@ -244,10 +241,10 @@ TEST(JSArrayAddingElements) {
 
   Handle<JSArray> array =
       factory->NewJSArray(ElementsKind::PACKED_SMI_ELEMENTS, 0, 0);
-  Handle<Map> previous_map(array->map());
+  Handle<Map> previous_map(array->map(), isolate);
   CHECK_EQ(PACKED_SMI_ELEMENTS, previous_map->elements_kind());
-  CHECK(EQUALS(array->property_array(), empty_property_array));
-  CHECK(EQUALS(array->elements(), empty_fixed_array));
+  CHECK(EQUALS(isolate, array->property_array(), empty_property_array));
+  CHECK(EQUALS(isolate, array->elements(), empty_fixed_array));
   CHECK_EQ(0, Smi::ToInt(array->length()));
 
   // Adding an indexed element initializes the elements array
@@ -257,7 +254,7 @@ TEST(JSArrayAddingElements) {
   // no change in elements_kind => no map transition
   CHECK_EQ(array->map(), *previous_map);
   CHECK_EQ(PACKED_SMI_ELEMENTS, array->map()->elements_kind());
-  CHECK(EQUALS(array->property_array(), empty_property_array));
+  CHECK(EQUALS(isolate, array->property_array(), empty_property_array));
   CHECK_LE(1, array->elements()->length());
   CHECK_EQ(1, Smi::ToInt(array->length()));
 
@@ -271,7 +268,7 @@ TEST(JSArrayAddingElements) {
   // no change in elements_kind => no map transition
   CHECK_EQ(array->map(), *previous_map);
   CHECK_EQ(PACKED_SMI_ELEMENTS, array->map()->elements_kind());
-  CHECK(EQUALS(array->property_array(), empty_property_array));
+  CHECK(EQUALS(isolate, array->property_array(), empty_property_array));
   CHECK_LE(non_dict_backing_store_limit, array->elements()->length());
   CHECK_EQ(non_dict_backing_store_limit, Smi::ToInt(array->length()));
 
@@ -284,7 +281,7 @@ TEST(JSArrayAddingElements) {
   // change in elements_kind => map transition
   CHECK_NE(array->map(), *previous_map);
   CHECK_EQ(DICTIONARY_ELEMENTS, array->map()->elements_kind());
-  CHECK(EQUALS(array->property_array(), empty_property_array));
+  CHECK(EQUALS(isolate, array->property_array(), empty_property_array));
   CHECK_LE(non_dict_backing_store_limit, array->elements()->length());
   CHECK_LE(array->elements()->length(), index);
   CHECK_EQ(index + 1, Smi::ToInt(array->length()));
@@ -304,7 +301,7 @@ TEST(JSArrayAddingElementsGeneralizingiFastSmiElements) {
 
   Handle<JSArray> array =
       factory->NewJSArray(ElementsKind::PACKED_SMI_ELEMENTS, 0, 0);
-  Handle<Map> previous_map(array->map());
+  Handle<Map> previous_map(array->map(), isolate);
   CHECK_EQ(PACKED_SMI_ELEMENTS, previous_map->elements_kind());
   CHECK_EQ(0, Smi::ToInt(array->length()));
 
@@ -324,7 +321,7 @@ TEST(JSArrayAddingElementsGeneralizingiFastSmiElements) {
   CHECK_NE(array->map(), *previous_map);
   CHECK_EQ(HOLEY_SMI_ELEMENTS, array->map()->elements_kind());
   CHECK_EQ(1, Smi::ToInt(array->length()));
-  previous_map = handle(array->map());
+  previous_map = handle(array->map(), isolate);
 
   // add a couple of elements again
   name = MakeString("0");
@@ -347,7 +344,7 @@ TEST(JSArrayAddingElementsGeneralizingiFastSmiElements) {
   CHECK_NE(array->map(), *previous_map);
   CHECK_EQ(HOLEY_ELEMENTS, array->map()->elements_kind());
   CHECK_EQ(2, Smi::ToInt(array->length()));
-  previous_map = handle(array->map());
+  previous_map = handle(array->map(), isolate);
 
   // We don't transition back to FAST_SMI even if we remove the string
   name = MakeString("0");
@@ -377,7 +374,7 @@ TEST(JSArrayAddingElementsGeneralizingFastElements) {
 
   Handle<JSArray> array =
       factory->NewJSArray(ElementsKind::PACKED_ELEMENTS, 0, 0);
-  Handle<Map> previous_map(array->map());
+  Handle<Map> previous_map(array->map(), isolate);
   CHECK_EQ(PACKED_ELEMENTS, previous_map->elements_kind());
   CHECK_EQ(0, Smi::ToInt(array->length()));
 
@@ -397,7 +394,7 @@ TEST(JSArrayAddingElementsGeneralizingFastElements) {
   CHECK_NE(array->map(), *previous_map);
   CHECK_EQ(HOLEY_ELEMENTS, array->map()->elements_kind());
   CHECK_EQ(1, Smi::ToInt(array->length()));
-  previous_map = handle(array->map());
+  previous_map = handle(array->map(), isolate);
 
   // add a couple of elements, elements_kind stays HOLEY
   name = MakeString("0");
@@ -427,7 +424,7 @@ TEST(JSArrayAddingElementsGeneralizingiFastDoubleElements) {
 
   Handle<JSArray> array =
       factory->NewJSArray(ElementsKind::PACKED_SMI_ELEMENTS, 0, 0);
-  Handle<Map> previous_map(array->map());
+  Handle<Map> previous_map(array->map(), isolate);
 
   // `array[0] = value_double` changes |elements_kind| to PACKED_DOUBLE_ELEMENTS
   name = MakeString("0");
@@ -437,7 +434,7 @@ TEST(JSArrayAddingElementsGeneralizingiFastDoubleElements) {
   CHECK_NE(array->map(), *previous_map);
   CHECK_EQ(PACKED_DOUBLE_ELEMENTS, array->map()->elements_kind());
   CHECK_EQ(1, Smi::ToInt(array->length()));
-  previous_map = handle(array->map());
+  previous_map = handle(array->map(), isolate);
 
   // `array[1] = value_smi` doesn't alter the |elements_kind|
   name = MakeString("1");
@@ -454,7 +451,7 @@ TEST(JSArrayAddingElementsGeneralizingiFastDoubleElements) {
   CHECK_NE(array->map(), *previous_map);
   CHECK_EQ(HOLEY_DOUBLE_ELEMENTS, array->map()->elements_kind());
   CHECK_EQ(2, Smi::ToInt(array->length()));
-  previous_map = handle(array->map());
+  previous_map = handle(array->map(), isolate);
 
   // filling the hole `array[0] = value_smi` again doesn't transition back
   name = MakeString("0");
@@ -473,7 +470,7 @@ TEST(JSArrayAddingElementsGeneralizingiFastDoubleElements) {
   CHECK_NE(array->map(), *previous_map);
   CHECK_EQ(HOLEY_ELEMENTS, array->map()->elements_kind());
   CHECK_EQ(2, Smi::ToInt(array->length()));
-  previous_map = handle(array->map());
+  previous_map = handle(array->map(), isolate);
 
   // Adding a double doesn't change the map
   name = MakeString("0");
diff --git a/deps/v8/test/cctest/test-feedback-vector.cc b/deps/v8/test/cctest/test-feedback-vector.cc
index 94596038fbb5bf..44a81dd2942b71 100644
--- a/deps/v8/test/cctest/test-feedback-vector.cc
+++ b/deps/v8/test/cctest/test-feedback-vector.cc
@@ -95,7 +95,8 @@ TEST(VectorStructure) {
     CHECK_EQ(1,
              FeedbackMetadata::GetSlotSize(FeedbackSlotKind::kCreateClosure));
     FeedbackSlot slot = helper.slot(1);
-    FeedbackCell* cell = FeedbackCell::cast(vector->Get(slot));
+    FeedbackCell* cell =
+        FeedbackCell::cast(vector->Get(slot)->ToStrongHeapObject());
     CHECK_EQ(cell->value(), *factory->undefined_value());
   }
 }
@@ -133,7 +134,7 @@ TEST(VectorICMetadata) {
 
   // Meanwhile set some feedback values and type feedback values to
   // verify the data structure remains intact.
-  vector->Set(FeedbackSlot(0), *vector);
+  vector->Set(FeedbackSlot(0), MaybeObject::FromObject(*vector));
 
   // Verify the metadata is correctly set up from the spec.
   for (int i = 0; i < 40; i++) {
@@ -201,8 +202,9 @@ TEST(VectorCallFeedback) {
   FeedbackNexus nexus(feedback_vector, slot);
 
   CHECK_EQ(MONOMORPHIC, nexus.StateFromFeedback());
-  CHECK(nexus.GetFeedback()->IsWeakCell());
-  CHECK(*foo == WeakCell::cast(nexus.GetFeedback())->value());
+  HeapObject* heap_object;
+  CHECK(nexus.GetFeedback()->ToWeakHeapObject(&heap_object));
+  CHECK_EQ(*foo, heap_object);
 
   CcTest::CollectAllGarbage();
   // It should stay monomorphic even after a GC.
@@ -225,9 +227,9 @@ TEST(VectorCallFeedbackForArray) {
   FeedbackNexus nexus(feedback_vector, slot);
 
   CHECK_EQ(MONOMORPHIC, nexus.StateFromFeedback());
-  CHECK(nexus.GetFeedback()->IsWeakCell());
-  CHECK(*isolate->array_function() ==
-        WeakCell::cast(nexus.GetFeedback())->value());
+  HeapObject* heap_object;
+  CHECK(nexus.GetFeedback()->ToWeakHeapObject(&heap_object));
+  CHECK_EQ(*isolate->array_function(), heap_object);
 
   CcTest::CollectAllGarbage();
   // It should stay monomorphic even after a GC.
@@ -282,7 +284,7 @@ TEST(VectorConstructCounts) {
   FeedbackNexus nexus(feedback_vector, slot);
   CHECK_EQ(MONOMORPHIC, nexus.StateFromFeedback());
 
-  CHECK(feedback_vector->Get(slot)->IsWeakCell());
+  CHECK(feedback_vector->Get(slot)->IsWeakHeapObject());
 
   CompileRun("f(Foo); f(Foo);");
   CHECK_EQ(MONOMORPHIC, nexus.StateFromFeedback());
@@ -437,7 +439,7 @@ TEST(VectorLoadICOnSmi) {
   CompileRun("f(34)");
   CHECK_EQ(MONOMORPHIC, nexus.StateFromFeedback());
   // Verify that the monomorphic map is the one we expect.
-  Map* number_map = heap->heap_number_map();
+  Map* number_map = ReadOnlyRoots(heap).heap_number_map();
   CHECK_EQ(number_map, nexus.FindFirstMap());
 
   // Now go polymorphic on o.
@@ -512,7 +514,7 @@ TEST(ReferenceContextAllocatesNoSlots) {
     Handle<JSFunction> f = GetFunction("testprop");
 
     // There should be one LOAD_IC, for the load of a.
-    Handle<FeedbackVector> feedback_vector(f->feedback_vector());
+    Handle<FeedbackVector> feedback_vector(f->feedback_vector(), isolate);
     FeedbackVectorHelper helper(feedback_vector);
     CHECK_EQ(2, helper.slot_count());
     CHECK_SLOT_KIND(helper, 0, FeedbackSlotKind::kLoadGlobalNotInsideTypeof);
@@ -532,7 +534,7 @@ TEST(ReferenceContextAllocatesNoSlots) {
 
     // There should be 1 LOAD_GLOBAL_IC to load x (in both cases), 2 CALL_ICs
     // to call x and a LOAD_IC to load blue.
-    Handle<FeedbackVector> feedback_vector(f->feedback_vector());
+    Handle<FeedbackVector> feedback_vector(f->feedback_vector(), isolate);
     FeedbackVectorHelper helper(feedback_vector);
     CHECK_EQ(5, helper.slot_count());
     CHECK_SLOT_KIND(helper, 0, FeedbackSlotKind::kCall);
@@ -554,7 +556,7 @@ TEST(ReferenceContextAllocatesNoSlots) {
 
     // There should be 1 LOAD_GLOBAL_ICs for the load of a, and one
     // KEYED_LOAD_IC for the load of x[0] in the return statement.
-    Handle<FeedbackVector> feedback_vector(f->feedback_vector());
+    Handle<FeedbackVector> feedback_vector(f->feedback_vector(), isolate);
     FeedbackVectorHelper helper(feedback_vector);
     CHECK_EQ(3, helper.slot_count());
     CHECK_SLOT_KIND(helper, 0, FeedbackSlotKind::kLoadGlobalNotInsideTypeof);
@@ -575,7 +577,7 @@ TEST(ReferenceContextAllocatesNoSlots) {
 
     // There should be 1 LOAD_GLOBAL_ICs for the load of a, and one
     // KEYED_LOAD_IC for the load of x[0] in the return statement.
-    Handle<FeedbackVector> feedback_vector(f->feedback_vector());
+    Handle<FeedbackVector> feedback_vector(f->feedback_vector(), isolate);
     FeedbackVectorHelper helper(feedback_vector);
     CHECK_EQ(3, helper.slot_count());
     CHECK_SLOT_KIND(helper, 0, FeedbackSlotKind::kLoadGlobalNotInsideTypeof);
@@ -596,7 +598,7 @@ TEST(ReferenceContextAllocatesNoSlots) {
 
     // There should be 1 LOAD_GLOBAL_IC for load of a and 2 LOAD_ICs, for load
     // of x.old and x.young.
-    Handle<FeedbackVector> feedback_vector(f->feedback_vector());
+    Handle<FeedbackVector> feedback_vector(f->feedback_vector(), isolate);
     FeedbackVectorHelper helper(feedback_vector);
     CHECK_EQ(7, helper.slot_count());
     CHECK_SLOT_KIND(helper, 0, FeedbackSlotKind::kLoadGlobalNotInsideTypeof);
@@ -627,7 +629,7 @@ TEST(VectorStoreICBasic) {
       "f(a);");
   Handle<JSFunction> f = GetFunction("f");
   // There should be one IC slot.
-  Handle<FeedbackVector> feedback_vector(f->feedback_vector());
+  Handle<FeedbackVector> feedback_vector(f->feedback_vector(), f->GetIsolate());
   FeedbackVectorHelper helper(feedback_vector);
   CHECK_EQ(1, helper.slot_count());
   FeedbackSlot slot(0);
@@ -651,7 +653,7 @@ TEST(StoreOwnIC) {
       "f(3);");
   Handle<JSFunction> f = GetFunction("f");
   // There should be one IC slot.
-  Handle<FeedbackVector> feedback_vector(f->feedback_vector());
+  Handle<FeedbackVector> feedback_vector(f->feedback_vector(), f->GetIsolate());
   FeedbackVectorHelper helper(feedback_vector);
   CHECK_EQ(2, helper.slot_count());
   CHECK_SLOT_KIND(helper, 0, FeedbackSlotKind::kLiteral);
diff --git a/deps/v8/test/cctest/test-field-type-tracking.cc b/deps/v8/test/cctest/test-field-type-tracking.cc
index 8d8cf2e25f1b7a..c6879bb65d3fdf 100644
--- a/deps/v8/test/cctest/test-field-type-tracking.cc
+++ b/deps/v8/test/cctest/test-field-type-tracking.cc
@@ -10,7 +10,7 @@
 #include "src/v8.h"
 
 #include "src/compilation-cache.h"
-#include "src/compilation-dependencies.h"
+#include "src/compiler/compilation-dependencies.h"
 #include "src/execution.h"
 #include "src/field-type.h"
 #include "src/global-handles.h"
@@ -24,6 +24,7 @@
 
 namespace v8 {
 namespace internal {
+namespace compiler {
 namespace test_field_type_tracking {
 
 // TODO(ishell): fix this once TransitionToPrototype stops generalizing
@@ -117,8 +118,8 @@ class Expectations {
       // Maps with transitionable elements kinds must have non in-place
       // generalizable fields.
       if (FLAG_track_constant_fields && FLAG_modify_map_inplace &&
-          constness == kConst) {
-        constness = kMutable;
+          constness == PropertyConstness::kConst) {
+        constness = PropertyConstness::kMutable;
       }
       if (representation.IsHeapObject() && !FieldType::cast(*value)->IsAny()) {
         value = FieldType::Any(isolate_);
@@ -131,7 +132,7 @@ class Expectations {
   }
 
   void Print() const {
-    OFStream os(stdout);
+    StdoutStream os;
     os << "Expectations: #" << number_of_properties_ << "\n";
     for (int i = 0; i < number_of_properties_; i++) {
       os << " " << i << ": ";
@@ -146,7 +147,7 @@ class Expectations {
       }
 
       os << " (";
-      if (constnesses_[i] == kConst) os << "const ";
+      if (constnesses_[i] == PropertyConstness::kConst) os << "const ";
       os << (kinds_[i] == kData ? "data " : "accessor ");
       if (locations_[i] == kField) {
         os << "field"
@@ -183,8 +184,8 @@ class Expectations {
   }
 
   void SetAccessorField(int index, PropertyAttributes attrs) {
-    Init(index, kAccessor, attrs, kConst, kDescriptor, Representation::Tagged(),
-         FieldType::Any(isolate_));
+    Init(index, kAccessor, attrs, PropertyConstness::kConst, kDescriptor,
+         Representation::Tagged(), FieldType::Any(isolate_));
   }
 
   void SetAccessorField(int index) {
@@ -195,11 +196,11 @@ class Expectations {
                        Handle<JSFunction> value) {
     if (FLAG_track_constant_fields) {
       Handle<FieldType> field_type(FieldType::Class(value->map()), isolate_);
-      Init(index, kData, attrs, kConst, kField, Representation::HeapObject(),
-           field_type);
+      Init(index, kData, attrs, PropertyConstness::kConst, kField,
+           Representation::HeapObject(), field_type);
 
     } else {
-      Init(index, kData, attrs, kConst, kDescriptor,
+      Init(index, kData, attrs, PropertyConstness::kConst, kDescriptor,
            Representation::HeapObject(), value);
     }
   }
@@ -210,8 +211,8 @@ class Expectations {
 
   void SetAccessorConstant(int index, PropertyAttributes attrs,
                            Handle<Object> getter, Handle<Object> setter) {
-    Init(index, kAccessor, attrs, kConst, kDescriptor, Representation::Tagged(),
-         getter);
+    Init(index, kAccessor, attrs, PropertyConstness::kConst, kDescriptor,
+         Representation::Tagged(), getter);
     setter_values_[index] = setter;
   }
 
@@ -267,7 +268,6 @@ class Expectations {
     Representation expected_representation = representations_[descriptor];
     if (!details.representation().Equals(expected_representation)) return false;
 
-    Object* value = descriptors->GetValue(descriptor);
     Object* expected_value = *values_[descriptor];
     if (details.location() == kField) {
       if (details.kind() == kData) {
@@ -278,6 +278,7 @@ class Expectations {
         UNREACHABLE();
       }
     } else {
+      Object* value = descriptors->GetStrongValue(descriptor);
       // kDescriptor
       if (details.kind() == kData) {
         CHECK(!FLAG_track_constant_fields);
@@ -305,7 +306,7 @@ class Expectations {
       if (!Check(descriptors, i)) {
         Print();
 #ifdef OBJECT_PRINT
-        descriptors->Print();
+        descriptors->Print(isolate_);
 #endif
         Check(descriptors, i);
         return false;
@@ -324,7 +325,7 @@ class Expectations {
 
   Handle<Map> AsElementsKind(Handle<Map> map, ElementsKind elements_kind) {
     elements_kind_ = elements_kind;
-    map = Map::AsElementsKind(map, elements_kind);
+    map = Map::AsElementsKind(isolate_, map, elements_kind);
     CHECK_EQ(elements_kind_, map->elements_kind());
     return map;
   }
@@ -339,8 +340,8 @@ class Expectations {
                  field_type);
 
     Handle<String> name = MakeName("prop", property_index);
-    return Map::CopyWithField(map, name, field_type, attributes, constness,
-                              representation, INSERT_TRANSITION)
+    return Map::CopyWithField(isolate_, map, name, field_type, attributes,
+                              constness, representation, INSERT_TRANSITION)
         .ToHandleChecked();
   }
 
@@ -351,7 +352,7 @@ class Expectations {
     SetDataConstant(property_index, attributes, value);
 
     Handle<String> name = MakeName("prop", property_index);
-    return Map::CopyWithConstant(map, name, value, attributes,
+    return Map::CopyWithConstant(isolate_, map, name, value, attributes,
                                  INSERT_TRANSITION)
         .ToHandleChecked();
   }
@@ -369,7 +370,7 @@ class Expectations {
 
     Handle<String> name = MakeName("prop", property_index);
     return Map::TransitionToDataProperty(
-        map, name, value, attributes, constness,
+        isolate_, map, name, value, attributes, constness,
         Object::CERTAINLY_NOT_STORE_FROM_KEYED);
   }
 
@@ -382,7 +383,7 @@ class Expectations {
 
     Handle<String> name = MakeName("prop", property_index);
     return Map::TransitionToDataProperty(
-        map, name, value, attributes, kConst,
+        isolate_, map, name, value, attributes, PropertyConstness::kConst,
         Object::CERTAINLY_NOT_STORE_FROM_KEYED);
   }
 
@@ -397,10 +398,10 @@ class Expectations {
                  heap_type);
 
     Handle<String> name = MakeName("prop", property_index);
-    Map* target =
-        TransitionsAccessor(map).SearchTransition(*name, kData, attributes);
+    Map* target = TransitionsAccessor(isolate_, map)
+                      .SearchTransition(*name, kData, attributes);
     CHECK_NOT_NULL(target);
-    return handle(target);
+    return handle(target, isolate_);
   }
 
   Handle<Map> AddAccessorConstant(Handle<Map> map,
@@ -413,7 +414,7 @@ class Expectations {
     Handle<String> name = MakeName("prop", property_index);
 
     Descriptor d = Descriptor::AccessorConstant(name, pair, attributes);
-    return Map::CopyInsertDescriptor(map, &d, INSERT_TRANSITION);
+    return Map::CopyInsertDescriptor(isolate_, map, &d, INSERT_TRANSITION);
   }
 
   Handle<Map> AddAccessorConstant(Handle<Map> map,
@@ -433,13 +434,13 @@ class Expectations {
       Handle<AccessorPair> pair = factory->NewAccessorPair();
       pair->SetComponents(*getter, *factory->null_value());
       Descriptor d = Descriptor::AccessorConstant(name, pair, attributes);
-      map = Map::CopyInsertDescriptor(map, &d, INSERT_TRANSITION);
+      map = Map::CopyInsertDescriptor(isolate_, map, &d, INSERT_TRANSITION);
     }
     if (!setter->IsNull(isolate_)) {
       Handle<AccessorPair> pair = factory->NewAccessorPair();
       pair->SetComponents(*getter, *setter);
       Descriptor d = Descriptor::AccessorConstant(name, pair, attributes);
-      map = Map::CopyInsertDescriptor(map, &d, INSERT_TRANSITION);
+      map = Map::CopyInsertDescriptor(isolate_, map, &d, INSERT_TRANSITION);
     }
     return map;
   }
@@ -477,6 +478,7 @@ TEST(ReconfigureAccessorToNonExistingDataField) {
   CcTest::InitializeVM();
   v8::HandleScope scope(CcTest::isolate());
   Isolate* isolate = CcTest::i_isolate();
+
   Handle<FieldType> any_type = FieldType::Any(isolate);
   Handle<FieldType> none_type = FieldType::None(isolate);
   Handle<AccessorPair> pair = CreateAccessorPair(true, true);
@@ -493,31 +495,32 @@ TEST(ReconfigureAccessorToNonExistingDataField) {
   CHECK(expectations.Check(*map));
 
   Handle<Map> new_map = Map::ReconfigureProperty(
-      map, 0, kData, NONE, Representation::None(), none_type);
+      isolate, map, 0, kData, NONE, Representation::None(), none_type);
   // |map| did not change except marked unstable.
   CHECK(!map->is_deprecated());
   CHECK(!map->is_stable());
   CHECK(expectations.Check(*map));
 
   // Property kind reconfiguration always makes the field mutable.
-  expectations.SetDataField(0, NONE, kMutable, Representation::None(),
-                            none_type);
+  expectations.SetDataField(0, NONE, PropertyConstness::kMutable,
+                            Representation::None(), none_type);
 
   CHECK(!new_map->is_deprecated());
   CHECK(new_map->is_stable());
   CHECK(expectations.Check(*new_map));
 
   Handle<Map> new_map2 = Map::ReconfigureProperty(
-      map, 0, kData, NONE, Representation::None(), none_type);
+      isolate, map, 0, kData, NONE, Representation::None(), none_type);
   CHECK_EQ(*new_map, *new_map2);
 
   Handle<Object> value(Smi::kZero, isolate);
-  Handle<Map> prepared_map =
-      Map::PrepareForDataProperty(new_map, 0, kConst, value);
+  Handle<Map> prepared_map = Map::PrepareForDataProperty(
+      isolate, new_map, 0, PropertyConstness::kConst, value);
   // None to Smi generalization is trivial, map does not change.
   CHECK_EQ(*new_map, *prepared_map);
 
-  expectations.SetDataField(0, NONE, kMutable, Representation::Smi(), any_type);
+  expectations.SetDataField(0, NONE, PropertyConstness::kMutable,
+                            Representation::Smi(), any_type);
   CHECK(prepared_map->is_stable());
   CHECK(expectations.Check(*prepared_map));
 
@@ -529,7 +532,7 @@ TEST(ReconfigureAccessorToNonExistingDataField) {
   FieldIndex index = FieldIndex::ForDescriptor(*prepared_map, 0);
   CHECK(obj->RawFastPropertyAt(index)->IsUninitialized(isolate));
 #ifdef VERIFY_HEAP
-  obj->ObjectVerify();
+  obj->ObjectVerify(isolate);
 #endif
 }
 
@@ -539,9 +542,9 @@ TEST(ReconfigureAccessorToNonExistingDataField) {
 // to a map with a property with None representation.
 TEST(ReconfigureAccessorToNonExistingDataFieldHeavy) {
   CcTest::InitializeVM();
+  v8::HandleScope scope(CcTest::isolate());
   Isolate* isolate = CcTest::i_isolate();
   Factory* factory = isolate->factory();
-  v8::HandleScope scope(CcTest::isolate());
 
   CompileRun(
       "function getter() { return 1; };"
@@ -560,7 +563,8 @@ TEST(ReconfigureAccessorToNonExistingDataFieldHeavy) {
   Handle<JSObject> obj = Handle<JSObject>::cast(obj_value);
 
   CHECK_EQ(1, obj->map()->NumberOfOwnDescriptors());
-  CHECK(obj->map()->instance_descriptors()->GetValue(0)->IsAccessorPair());
+  CHECK(
+      obj->map()->instance_descriptors()->GetStrongValue(0)->IsAccessorPair());
 
   Handle<Object> value(Smi::FromInt(42), isolate);
   JSObject::SetOwnPropertyIgnoreAttributes(obj, foo_str, value, NONE).Check();
@@ -638,7 +642,7 @@ static void TestGeneralizeField(int detach_property_at_index,
 
   if (is_detached_map) {
     detach_point_map = Map::ReconfigureProperty(
-        detach_point_map, detach_property_at_index, kData, NONE,
+        isolate, detach_point_map, detach_property_at_index, kData, NONE,
         Representation::Tagged(), any_type);
     expectations.SetDataField(detach_property_at_index, kDefaultFieldConstness,
                               Representation::Tagged(), any_type);
@@ -648,14 +652,13 @@ static void TestGeneralizeField(int detach_property_at_index,
   }
 
   // Create new maps by generalizing representation of propX field.
-  Handle<Map> field_owner(map->FindFieldOwner(property_index), isolate);
+  Handle<Map> field_owner(map->FindFieldOwner(isolate, property_index),
+                          isolate);
   CompilationDependencies dependencies(isolate, &zone);
-  CHECK(!dependencies.HasAborted());
-
-  dependencies.AssumeFieldOwner(field_owner);
+  dependencies.DependOnFieldType(map, property_index);
 
   Handle<Map> new_map = Map::ReconfigureProperty(
-      map, property_index, kData, NONE, to.representation, to.type);
+      isolate, map, property_index, kData, NONE, to.representation, to.type);
 
   expectations.SetDataField(property_index, expected.constness,
                             expected.representation, expected.type);
@@ -668,21 +671,21 @@ static void TestGeneralizeField(int detach_property_at_index,
     CHECK(map->is_deprecated());
     CHECK_NE(*map, *new_map);
     CHECK_EQ(expected_field_type_dependency && !field_owner->is_deprecated(),
-             dependencies.HasAborted());
+             !dependencies.AreValid());
 
   } else if (expected_deprecation) {
     CHECK(!map->is_stable());
     CHECK(map->is_deprecated());
     CHECK(field_owner->is_deprecated());
     CHECK_NE(*map, *new_map);
-    CHECK(!dependencies.HasAborted());
+    CHECK(dependencies.AreValid());
 
   } else {
     CHECK(!field_owner->is_deprecated());
     CHECK(map->is_stable());  // Map did not change, must be left stable.
     CHECK_EQ(*map, *new_map);
 
-    CHECK_EQ(expected_field_type_dependency, dependencies.HasAborted());
+    CHECK_EQ(expected_field_type_dependency, !dependencies.AreValid());
   }
 
   {
@@ -696,10 +699,8 @@ static void TestGeneralizeField(int detach_property_at_index,
     }
   }
 
-  dependencies.Rollback();  // Properly cleanup compilation info.
-
   // Update all deprecated maps and check that they are now the same.
-  Handle<Map> updated_map = Map::Update(map);
+  Handle<Map> updated_map = Map::Update(isolate, map);
   CHECK_EQ(*new_map, *updated_map);
 }
 
@@ -754,56 +755,65 @@ TEST(GeneralizeSmiFieldToDouble) {
   CcTest::InitializeVM();
   v8::HandleScope scope(CcTest::isolate());
   Isolate* isolate = CcTest::i_isolate();
+
   Handle<FieldType> any_type = FieldType::Any(isolate);
 
-  TestGeneralizeField({kMutable, Representation::Smi(), any_type},
-                      {kMutable, Representation::Double(), any_type},
-                      {kMutable, Representation::Double(), any_type});
+  TestGeneralizeField(
+      {PropertyConstness::kMutable, Representation::Smi(), any_type},
+      {PropertyConstness::kMutable, Representation::Double(), any_type},
+      {PropertyConstness::kMutable, Representation::Double(), any_type});
 }
 
 TEST(GeneralizeSmiFieldToTagged) {
   CcTest::InitializeVM();
   v8::HandleScope scope(CcTest::isolate());
   Isolate* isolate = CcTest::i_isolate();
+
   Handle<FieldType> any_type = FieldType::Any(isolate);
   Handle<FieldType> value_type =
       FieldType::Class(Map::Create(isolate, 0), isolate);
 
-  TestGeneralizeField({kMutable, Representation::Smi(), any_type},
-                      {kMutable, Representation::HeapObject(), value_type},
-                      {kMutable, Representation::Tagged(), any_type});
+  TestGeneralizeField(
+      {PropertyConstness::kMutable, Representation::Smi(), any_type},
+      {PropertyConstness::kMutable, Representation::HeapObject(), value_type},
+      {PropertyConstness::kMutable, Representation::Tagged(), any_type});
 }
 
 TEST(GeneralizeDoubleFieldToTagged) {
   CcTest::InitializeVM();
   v8::HandleScope scope(CcTest::isolate());
   Isolate* isolate = CcTest::i_isolate();
+
   Handle<FieldType> any_type = FieldType::Any(isolate);
   Handle<FieldType> value_type =
       FieldType::Class(Map::Create(isolate, 0), isolate);
 
-  TestGeneralizeField({kMutable, Representation::Double(), any_type},
-                      {kMutable, Representation::HeapObject(), value_type},
-                      {kMutable, Representation::Tagged(), any_type});
+  TestGeneralizeField(
+      {PropertyConstness::kMutable, Representation::Double(), any_type},
+      {PropertyConstness::kMutable, Representation::HeapObject(), value_type},
+      {PropertyConstness::kMutable, Representation::Tagged(), any_type});
 }
 
 TEST(GeneralizeHeapObjectFieldToTagged) {
   CcTest::InitializeVM();
   v8::HandleScope scope(CcTest::isolate());
   Isolate* isolate = CcTest::i_isolate();
+
   Handle<FieldType> any_type = FieldType::Any(isolate);
   Handle<FieldType> value_type =
       FieldType::Class(Map::Create(isolate, 0), isolate);
 
-  TestGeneralizeField({kMutable, Representation::HeapObject(), value_type},
-                      {kMutable, Representation::Smi(), any_type},
-                      {kMutable, Representation::Tagged(), any_type});
+  TestGeneralizeField(
+      {PropertyConstness::kMutable, Representation::HeapObject(), value_type},
+      {PropertyConstness::kMutable, Representation::Smi(), any_type},
+      {PropertyConstness::kMutable, Representation::Tagged(), any_type});
 }
 
 TEST(GeneralizeHeapObjectFieldToHeapObject) {
   CcTest::InitializeVM();
   v8::HandleScope scope(CcTest::isolate());
   Isolate* isolate = CcTest::i_isolate();
+
   Handle<FieldType> any_type = FieldType::Any(isolate);
 
   Handle<FieldType> current_type =
@@ -815,71 +825,80 @@ TEST(GeneralizeHeapObjectFieldToHeapObject) {
   Handle<FieldType> expected_type = any_type;
 
   TestGeneralizeFieldTrivial(
-      {kMutable, Representation::HeapObject(), current_type},
-      {kMutable, Representation::HeapObject(), new_type},
-      {kMutable, Representation::HeapObject(), expected_type});
+      {PropertyConstness::kMutable, Representation::HeapObject(), current_type},
+      {PropertyConstness::kMutable, Representation::HeapObject(), new_type},
+      {PropertyConstness::kMutable, Representation::HeapObject(),
+       expected_type});
   current_type = expected_type;
 
   new_type = FieldType::Class(Map::Create(isolate, 0), isolate);
 
-  TestGeneralizeFieldTrivial({kMutable, Representation::HeapObject(), any_type},
-                             {kMutable, Representation::HeapObject(), new_type},
-                             {kMutable, Representation::HeapObject(), any_type},
-                             false);
+  TestGeneralizeFieldTrivial(
+      {PropertyConstness::kMutable, Representation::HeapObject(), any_type},
+      {PropertyConstness::kMutable, Representation::HeapObject(), new_type},
+      {PropertyConstness::kMutable, Representation::HeapObject(), any_type},
+      false);
 }
 
 TEST(GeneralizeNoneFieldToSmi) {
   CcTest::InitializeVM();
   v8::HandleScope scope(CcTest::isolate());
   Isolate* isolate = CcTest::i_isolate();
+
   Handle<FieldType> none_type = FieldType::None(isolate);
   Handle<FieldType> any_type = FieldType::Any(isolate);
 
   // None -> Smi representation change is trivial.
-  TestGeneralizeFieldTrivial({kMutable, Representation::None(), none_type},
-                             {kMutable, Representation::Smi(), any_type},
-                             {kMutable, Representation::Smi(), any_type});
+  TestGeneralizeFieldTrivial(
+      {PropertyConstness::kMutable, Representation::None(), none_type},
+      {PropertyConstness::kMutable, Representation::Smi(), any_type},
+      {PropertyConstness::kMutable, Representation::Smi(), any_type});
 }
 
 TEST(GeneralizeNoneFieldToDouble) {
   CcTest::InitializeVM();
   v8::HandleScope scope(CcTest::isolate());
   Isolate* isolate = CcTest::i_isolate();
+
   Handle<FieldType> none_type = FieldType::None(isolate);
   Handle<FieldType> any_type = FieldType::Any(isolate);
 
   // None -> Double representation change is NOT trivial.
-  TestGeneralizeField({kMutable, Representation::None(), none_type},
-                      {kMutable, Representation::Double(), any_type},
-                      {kMutable, Representation::Double(), any_type});
+  TestGeneralizeField(
+      {PropertyConstness::kMutable, Representation::None(), none_type},
+      {PropertyConstness::kMutable, Representation::Double(), any_type},
+      {PropertyConstness::kMutable, Representation::Double(), any_type});
 }
 
 TEST(GeneralizeNoneFieldToHeapObject) {
   CcTest::InitializeVM();
   v8::HandleScope scope(CcTest::isolate());
   Isolate* isolate = CcTest::i_isolate();
+
   Handle<FieldType> none_type = FieldType::None(isolate);
   Handle<FieldType> value_type =
       FieldType::Class(Map::Create(isolate, 0), isolate);
 
   // None -> HeapObject representation change is trivial.
   TestGeneralizeFieldTrivial(
-      {kMutable, Representation::None(), none_type},
-      {kMutable, Representation::HeapObject(), value_type},
-      {kMutable, Representation::HeapObject(), value_type});
+      {PropertyConstness::kMutable, Representation::None(), none_type},
+      {PropertyConstness::kMutable, Representation::HeapObject(), value_type},
+      {PropertyConstness::kMutable, Representation::HeapObject(), value_type});
 }
 
 TEST(GeneralizeNoneFieldToTagged) {
   CcTest::InitializeVM();
   v8::HandleScope scope(CcTest::isolate());
   Isolate* isolate = CcTest::i_isolate();
+
   Handle<FieldType> none_type = FieldType::None(isolate);
   Handle<FieldType> any_type = FieldType::Any(isolate);
 
   // None -> HeapObject representation change is trivial.
-  TestGeneralizeFieldTrivial({kMutable, Representation::None(), none_type},
-                             {kMutable, Representation::Tagged(), any_type},
-                             {kMutable, Representation::Tagged(), any_type});
+  TestGeneralizeFieldTrivial(
+      {PropertyConstness::kMutable, Representation::None(), none_type},
+      {PropertyConstness::kMutable, Representation::Tagged(), any_type},
+      {PropertyConstness::kMutable, Representation::Tagged(), any_type});
 }
 
 
@@ -891,6 +910,7 @@ TEST(GeneralizeFieldWithAccessorProperties) {
   CcTest::InitializeVM();
   v8::HandleScope scope(CcTest::isolate());
   Isolate* isolate = CcTest::i_isolate();
+
   Handle<FieldType> any_type = FieldType::Any(isolate);
   Handle<AccessorPair> pair = CreateAccessorPair(true, true);
 
@@ -904,7 +924,7 @@ TEST(GeneralizeFieldWithAccessorProperties) {
     if (i == kAccessorProp) {
       map = expectations.AddAccessorConstant(map, NONE, pair);
     } else {
-      map = expectations.AddDataField(map, NONE, kMutable,
+      map = expectations.AddDataField(map, NONE, PropertyConstness::kMutable,
                                       Representation::Smi(), any_type);
     }
   }
@@ -921,10 +941,11 @@ TEST(GeneralizeFieldWithAccessorProperties) {
       continue;
     }
     Handle<Map> new_map = Map::ReconfigureProperty(
-        map, i, kData, NONE, Representation::Double(), any_type);
+        isolate, map, i, kData, NONE, Representation::Double(), any_type);
     maps[i] = new_map;
 
-    expectations.SetDataField(i, kMutable, Representation::Double(), any_type);
+    expectations.SetDataField(i, PropertyConstness::kMutable,
+                              Representation::Double(), any_type);
 
     CHECK(!map->is_stable());
     CHECK(map->is_deprecated());
@@ -939,10 +960,10 @@ TEST(GeneralizeFieldWithAccessorProperties) {
   CHECK(!active_map->is_deprecated());
 
   // Update all deprecated maps and check that they are now the same.
-  Handle<Map> updated_map = Map::Update(map);
+  Handle<Map> updated_map = Map::Update(isolate, map);
   CHECK_EQ(*active_map, *updated_map);
   for (int i = 0; i < kPropCount; i++) {
-    updated_map = Map::Update(maps[i]);
+    updated_map = Map::Update(isolate, maps[i]);
     CHECK_EQ(*active_map, *updated_map);
   }
 }
@@ -1001,15 +1022,13 @@ static void TestReconfigureDataFieldAttribute_GeneralizeField(
   CHECK(expectations2.Check(*map2));
 
   Zone zone(isolate->allocator(), ZONE_NAME);
-  Handle<Map> field_owner(map->FindFieldOwner(kSplitProp), isolate);
   CompilationDependencies dependencies(isolate, &zone);
-  CHECK(!dependencies.HasAborted());
-  dependencies.AssumeFieldOwner(field_owner);
+  dependencies.DependOnFieldType(map, kSplitProp);
 
   // Reconfigure attributes of property |kSplitProp| of |map2| to NONE, which
   // should generalize representations in |map1|.
   Handle<Map> new_map =
-      Map::ReconfigureExistingProperty(map2, kSplitProp, kData, NONE);
+      Map::ReconfigureExistingProperty(isolate, map2, kSplitProp, kData, NONE);
 
   // |map2| should be left unchanged but marked unstable.
   CHECK(!map2->is_stable());
@@ -1023,15 +1042,14 @@ static void TestReconfigureDataFieldAttribute_GeneralizeField(
                               expected.type);
   }
   CHECK(map->is_deprecated());
-  CHECK(!dependencies.HasAborted());
-  dependencies.Rollback();  // Properly cleanup compilation info.
+  CHECK(dependencies.AreValid());
   CHECK_NE(*map, *new_map);
 
   CHECK(!new_map->is_deprecated());
   CHECK(expectations.Check(*new_map));
 
   // Update deprecated |map|, it should become |new_map|.
-  Handle<Map> updated_map = Map::Update(map);
+  Handle<Map> updated_map = Map::Update(isolate, map);
   CHECK_EQ(*new_map, *updated_map);
 }
 
@@ -1086,15 +1104,13 @@ static void TestReconfigureDataFieldAttribute_GeneralizeFieldTrivial(
   CHECK(expectations2.Check(*map2));
 
   Zone zone(isolate->allocator(), ZONE_NAME);
-  Handle<Map> field_owner(map->FindFieldOwner(kSplitProp), isolate);
   CompilationDependencies dependencies(isolate, &zone);
-  CHECK(!dependencies.HasAborted());
-  dependencies.AssumeFieldOwner(field_owner);
+  dependencies.DependOnFieldType(map, kSplitProp);
 
   // Reconfigure attributes of property |kSplitProp| of |map2| to NONE, which
   // should generalize representations in |map1|.
   Handle<Map> new_map =
-      Map::ReconfigureExistingProperty(map2, kSplitProp, kData, NONE);
+      Map::ReconfigureExistingProperty(isolate, map2, kSplitProp, kData, NONE);
 
   // |map2| should be left unchanged but marked unstable.
   CHECK(!map2->is_stable());
@@ -1112,13 +1128,12 @@ static void TestReconfigureDataFieldAttribute_GeneralizeFieldTrivial(
   }
   CHECK(!map->is_deprecated());
   CHECK_EQ(*map, *new_map);
-  CHECK_EQ(expected_field_type_dependency, dependencies.HasAborted());
-  dependencies.Rollback();  // Properly cleanup compilation info.
+  CHECK_EQ(expected_field_type_dependency, !dependencies.AreValid());
 
   CHECK(!new_map->is_deprecated());
   CHECK(expectations.Check(*new_map));
 
-  Handle<Map> updated_map = Map::Update(map);
+  Handle<Map> updated_map = Map::Update(isolate, map);
   CHECK_EQ(*new_map, *updated_map);
 }
 
@@ -1126,97 +1141,101 @@ TEST(ReconfigureDataFieldAttribute_GeneralizeSmiFieldToDouble) {
   CcTest::InitializeVM();
   v8::HandleScope scope(CcTest::isolate());
   Isolate* isolate = CcTest::i_isolate();
+
   Handle<FieldType> any_type = FieldType::Any(isolate);
 
   if (FLAG_track_constant_fields) {
     TestReconfigureDataFieldAttribute_GeneralizeField(
-        {kConst, Representation::Smi(), any_type},
-        {kConst, Representation::Double(), any_type},
-        {kConst, Representation::Double(), any_type});
+        {PropertyConstness::kConst, Representation::Smi(), any_type},
+        {PropertyConstness::kConst, Representation::Double(), any_type},
+        {PropertyConstness::kConst, Representation::Double(), any_type});
 
     TestReconfigureDataFieldAttribute_GeneralizeField(
-        {kConst, Representation::Smi(), any_type},
-        {kMutable, Representation::Double(), any_type},
-        {kMutable, Representation::Double(), any_type});
+        {PropertyConstness::kConst, Representation::Smi(), any_type},
+        {PropertyConstness::kMutable, Representation::Double(), any_type},
+        {PropertyConstness::kMutable, Representation::Double(), any_type});
 
     TestReconfigureDataFieldAttribute_GeneralizeField(
-        {kMutable, Representation::Smi(), any_type},
-        {kConst, Representation::Double(), any_type},
-        {kMutable, Representation::Double(), any_type});
+        {PropertyConstness::kMutable, Representation::Smi(), any_type},
+        {PropertyConstness::kConst, Representation::Double(), any_type},
+        {PropertyConstness::kMutable, Representation::Double(), any_type});
   }
 
   TestReconfigureDataFieldAttribute_GeneralizeField(
-      {kMutable, Representation::Smi(), any_type},
-      {kMutable, Representation::Double(), any_type},
-      {kMutable, Representation::Double(), any_type});
+      {PropertyConstness::kMutable, Representation::Smi(), any_type},
+      {PropertyConstness::kMutable, Representation::Double(), any_type},
+      {PropertyConstness::kMutable, Representation::Double(), any_type});
 }
 
 TEST(ReconfigureDataFieldAttribute_GeneralizeSmiFieldToTagged) {
   CcTest::InitializeVM();
   v8::HandleScope scope(CcTest::isolate());
   Isolate* isolate = CcTest::i_isolate();
+
   Handle<FieldType> any_type = FieldType::Any(isolate);
   Handle<FieldType> value_type =
       FieldType::Class(Map::Create(isolate, 0), isolate);
 
   if (FLAG_track_constant_fields) {
     TestReconfigureDataFieldAttribute_GeneralizeField(
-        {kConst, Representation::Smi(), any_type},
-        {kConst, Representation::HeapObject(), value_type},
-        {kConst, Representation::Tagged(), any_type});
+        {PropertyConstness::kConst, Representation::Smi(), any_type},
+        {PropertyConstness::kConst, Representation::HeapObject(), value_type},
+        {PropertyConstness::kConst, Representation::Tagged(), any_type});
 
     TestReconfigureDataFieldAttribute_GeneralizeField(
-        {kConst, Representation::Smi(), any_type},
-        {kMutable, Representation::HeapObject(), value_type},
-        {kMutable, Representation::Tagged(), any_type});
+        {PropertyConstness::kConst, Representation::Smi(), any_type},
+        {PropertyConstness::kMutable, Representation::HeapObject(), value_type},
+        {PropertyConstness::kMutable, Representation::Tagged(), any_type});
 
     TestReconfigureDataFieldAttribute_GeneralizeField(
-        {kMutable, Representation::Smi(), any_type},
-        {kConst, Representation::HeapObject(), value_type},
-        {kMutable, Representation::Tagged(), any_type});
+        {PropertyConstness::kMutable, Representation::Smi(), any_type},
+        {PropertyConstness::kConst, Representation::HeapObject(), value_type},
+        {PropertyConstness::kMutable, Representation::Tagged(), any_type});
   }
 
   TestReconfigureDataFieldAttribute_GeneralizeField(
-      {kMutable, Representation::Smi(), any_type},
-      {kMutable, Representation::HeapObject(), value_type},
-      {kMutable, Representation::Tagged(), any_type});
+      {PropertyConstness::kMutable, Representation::Smi(), any_type},
+      {PropertyConstness::kMutable, Representation::HeapObject(), value_type},
+      {PropertyConstness::kMutable, Representation::Tagged(), any_type});
 }
 
 TEST(ReconfigureDataFieldAttribute_GeneralizeDoubleFieldToTagged) {
   CcTest::InitializeVM();
   v8::HandleScope scope(CcTest::isolate());
   Isolate* isolate = CcTest::i_isolate();
+
   Handle<FieldType> any_type = FieldType::Any(isolate);
   Handle<FieldType> value_type =
       FieldType::Class(Map::Create(isolate, 0), isolate);
 
   if (FLAG_track_constant_fields) {
     TestReconfigureDataFieldAttribute_GeneralizeField(
-        {kConst, Representation::Double(), any_type},
-        {kConst, Representation::HeapObject(), value_type},
-        {kConst, Representation::Tagged(), any_type});
+        {PropertyConstness::kConst, Representation::Double(), any_type},
+        {PropertyConstness::kConst, Representation::HeapObject(), value_type},
+        {PropertyConstness::kConst, Representation::Tagged(), any_type});
 
     TestReconfigureDataFieldAttribute_GeneralizeField(
-        {kConst, Representation::Double(), any_type},
-        {kMutable, Representation::HeapObject(), value_type},
-        {kMutable, Representation::Tagged(), any_type});
+        {PropertyConstness::kConst, Representation::Double(), any_type},
+        {PropertyConstness::kMutable, Representation::HeapObject(), value_type},
+        {PropertyConstness::kMutable, Representation::Tagged(), any_type});
 
     TestReconfigureDataFieldAttribute_GeneralizeField(
-        {kMutable, Representation::Double(), any_type},
-        {kConst, Representation::HeapObject(), value_type},
-        {kMutable, Representation::Tagged(), any_type});
+        {PropertyConstness::kMutable, Representation::Double(), any_type},
+        {PropertyConstness::kConst, Representation::HeapObject(), value_type},
+        {PropertyConstness::kMutable, Representation::Tagged(), any_type});
   }
 
   TestReconfigureDataFieldAttribute_GeneralizeField(
-      {kMutable, Representation::Double(), any_type},
-      {kMutable, Representation::HeapObject(), value_type},
-      {kMutable, Representation::Tagged(), any_type});
+      {PropertyConstness::kMutable, Representation::Double(), any_type},
+      {PropertyConstness::kMutable, Representation::HeapObject(), value_type},
+      {PropertyConstness::kMutable, Representation::Tagged(), any_type});
 }
 
 TEST(ReconfigureDataFieldAttribute_GeneralizeHeapObjFieldToHeapObj) {
   CcTest::InitializeVM();
   v8::HandleScope scope(CcTest::isolate());
   Isolate* isolate = CcTest::i_isolate();
+
   Handle<FieldType> any_type = FieldType::Any(isolate);
 
   Handle<FieldType> current_type =
@@ -1230,34 +1249,42 @@ TEST(ReconfigureDataFieldAttribute_GeneralizeHeapObjFieldToHeapObj) {
   // Check generalizations that trigger deopts.
   if (FLAG_track_constant_fields) {
     TestReconfigureDataFieldAttribute_GeneralizeFieldTrivial(
-        {kConst, Representation::HeapObject(), current_type},
-        {kConst, Representation::HeapObject(), new_type},
-        {kConst, Representation::HeapObject(), expected_type});
+        {PropertyConstness::kConst, Representation::HeapObject(), current_type},
+        {PropertyConstness::kConst, Representation::HeapObject(), new_type},
+        {PropertyConstness::kConst, Representation::HeapObject(),
+         expected_type});
 
     if (FLAG_modify_map_inplace) {
-      // kConst to kMutable migration does not create a new map, therefore
-      // trivial generalization.
+      // PropertyConstness::kConst to PropertyConstness::kMutable migration does
+      // not create a new map, therefore trivial generalization.
       TestReconfigureDataFieldAttribute_GeneralizeFieldTrivial(
-          {kConst, Representation::HeapObject(), current_type},
-          {kMutable, Representation::HeapObject(), new_type},
-          {kMutable, Representation::HeapObject(), expected_type});
+          {PropertyConstness::kConst, Representation::HeapObject(),
+           current_type},
+          {PropertyConstness::kMutable, Representation::HeapObject(), new_type},
+          {PropertyConstness::kMutable, Representation::HeapObject(),
+           expected_type});
     } else {
-      // kConst to kMutable migration causes map change, therefore
-      // non-trivial generalization.
+      // PropertyConstness::kConst to PropertyConstness::kMutable migration
+      // causes map change, therefore non-trivial generalization.
       TestReconfigureDataFieldAttribute_GeneralizeField(
-          {kConst, Representation::HeapObject(), current_type},
-          {kMutable, Representation::HeapObject(), new_type},
-          {kMutable, Representation::HeapObject(), expected_type});
+          {PropertyConstness::kConst, Representation::HeapObject(),
+           current_type},
+          {PropertyConstness::kMutable, Representation::HeapObject(), new_type},
+          {PropertyConstness::kMutable, Representation::HeapObject(),
+           expected_type});
     }
     TestReconfigureDataFieldAttribute_GeneralizeFieldTrivial(
-        {kMutable, Representation::HeapObject(), current_type},
-        {kConst, Representation::HeapObject(), new_type},
-        {kMutable, Representation::HeapObject(), expected_type});
+        {PropertyConstness::kMutable, Representation::HeapObject(),
+         current_type},
+        {PropertyConstness::kConst, Representation::HeapObject(), new_type},
+        {PropertyConstness::kMutable, Representation::HeapObject(),
+         expected_type});
   }
   TestReconfigureDataFieldAttribute_GeneralizeFieldTrivial(
-      {kMutable, Representation::HeapObject(), current_type},
-      {kMutable, Representation::HeapObject(), new_type},
-      {kMutable, Representation::HeapObject(), expected_type});
+      {PropertyConstness::kMutable, Representation::HeapObject(), current_type},
+      {PropertyConstness::kMutable, Representation::HeapObject(), new_type},
+      {PropertyConstness::kMutable, Representation::HeapObject(),
+       expected_type});
   current_type = expected_type;
 
   // Check generalizations that do not trigger deopts.
@@ -1265,55 +1292,61 @@ TEST(ReconfigureDataFieldAttribute_GeneralizeHeapObjFieldToHeapObj) {
 
   if (FLAG_track_constant_fields) {
     TestReconfigureDataFieldAttribute_GeneralizeFieldTrivial(
-        {kConst, Representation::HeapObject(), any_type},
-        {kConst, Representation::HeapObject(), new_type},
-        {kConst, Representation::HeapObject(), any_type}, false);
+        {PropertyConstness::kConst, Representation::HeapObject(), any_type},
+        {PropertyConstness::kConst, Representation::HeapObject(), new_type},
+        {PropertyConstness::kConst, Representation::HeapObject(), any_type},
+        false);
 
     if (FLAG_modify_map_inplace) {
-      // kConst to kMutable migration does not create a new map, therefore
-      // trivial generalization.
+      // PropertyConstness::kConst to PropertyConstness::kMutable migration does
+      // not create a new map, therefore trivial generalization.
       TestReconfigureDataFieldAttribute_GeneralizeFieldTrivial(
-          {kConst, Representation::HeapObject(), any_type},
-          {kMutable, Representation::HeapObject(), new_type},
-          {kMutable, Representation::HeapObject(), any_type});
+          {PropertyConstness::kConst, Representation::HeapObject(), any_type},
+          {PropertyConstness::kMutable, Representation::HeapObject(), new_type},
+          {PropertyConstness::kMutable, Representation::HeapObject(),
+           any_type});
     } else {
-      // kConst to kMutable migration causes map change, therefore
-      // non-trivial generalization.
+      // PropertyConstness::kConst to PropertyConstness::kMutable migration
+      // causes map change, therefore non-trivial generalization.
       TestReconfigureDataFieldAttribute_GeneralizeField(
-          {kConst, Representation::HeapObject(), any_type},
-          {kMutable, Representation::HeapObject(), new_type},
-          {kMutable, Representation::HeapObject(), any_type});
+          {PropertyConstness::kConst, Representation::HeapObject(), any_type},
+          {PropertyConstness::kMutable, Representation::HeapObject(), new_type},
+          {PropertyConstness::kMutable, Representation::HeapObject(),
+           any_type});
     }
     TestReconfigureDataFieldAttribute_GeneralizeFieldTrivial(
-        {kMutable, Representation::HeapObject(), any_type},
-        {kConst, Representation::HeapObject(), new_type},
-        {kMutable, Representation::HeapObject(), any_type}, false);
+        {PropertyConstness::kMutable, Representation::HeapObject(), any_type},
+        {PropertyConstness::kConst, Representation::HeapObject(), new_type},
+        {PropertyConstness::kMutable, Representation::HeapObject(), any_type},
+        false);
   }
   TestReconfigureDataFieldAttribute_GeneralizeFieldTrivial(
-      {kMutable, Representation::HeapObject(), any_type},
-      {kMutable, Representation::HeapObject(), new_type},
-      {kMutable, Representation::HeapObject(), any_type}, false);
+      {PropertyConstness::kMutable, Representation::HeapObject(), any_type},
+      {PropertyConstness::kMutable, Representation::HeapObject(), new_type},
+      {PropertyConstness::kMutable, Representation::HeapObject(), any_type},
+      false);
 }
 
 TEST(ReconfigureDataFieldAttribute_GeneralizeHeapObjectFieldToTagged) {
   CcTest::InitializeVM();
   v8::HandleScope scope(CcTest::isolate());
   Isolate* isolate = CcTest::i_isolate();
+
   Handle<FieldType> any_type = FieldType::Any(isolate);
   Handle<FieldType> value_type =
       FieldType::Class(Map::Create(isolate, 0), isolate);
 
   TestReconfigureDataFieldAttribute_GeneralizeField(
-      {kMutable, Representation::HeapObject(), value_type},
-      {kMutable, Representation::Smi(), any_type},
-      {kMutable, Representation::Tagged(), any_type});
+      {PropertyConstness::kMutable, Representation::HeapObject(), value_type},
+      {PropertyConstness::kMutable, Representation::Smi(), any_type},
+      {PropertyConstness::kMutable, Representation::Tagged(), any_type});
 }
 
 
 // Checks that given |map| is deprecated and that it updates to given |new_map|
 // which in turn should match expectations.
 struct CheckDeprecated {
-  void Check(Handle<Map> map, Handle<Map> new_map,
+  void Check(Isolate* isolate, Handle<Map> map, Handle<Map> new_map,
              const Expectations& expectations) {
     CHECK(map->is_deprecated());
     CHECK_NE(*map, *new_map);
@@ -1322,7 +1355,7 @@ struct CheckDeprecated {
     CHECK(expectations.Check(*new_map));
 
     // Update deprecated |map|, it should become |new_map|.
-    Handle<Map> updated_map = Map::Update(map);
+    Handle<Map> updated_map = Map::Update(isolate, map);
     CHECK_EQ(*new_map, *updated_map);
   }
 };
@@ -1331,7 +1364,7 @@ struct CheckDeprecated {
 // Checks that given |map| is NOT deprecated, equals to given |new_map| and
 // matches expectations.
 struct CheckSameMap {
-  void Check(Handle<Map> map, Handle<Map> new_map,
+  void Check(Isolate* isolate, Handle<Map> map, Handle<Map> new_map,
              const Expectations& expectations) {
     // |map| was not reconfigured, therefore it should stay stable.
     CHECK(map->is_stable());
@@ -1342,7 +1375,7 @@ struct CheckSameMap {
     CHECK(expectations.Check(*new_map));
 
     // Update deprecated |map|, it should become |new_map|.
-    Handle<Map> updated_map = Map::Update(map);
+    Handle<Map> updated_map = Map::Update(isolate, map);
     CHECK_EQ(*new_map, *updated_map);
   }
 };
@@ -1351,7 +1384,7 @@ struct CheckSameMap {
 // Checks that given |map| is NOT deprecated and matches expectations.
 // |new_map| is unrelated to |map|.
 struct CheckUnrelated {
-  void Check(Handle<Map> map, Handle<Map> new_map,
+  void Check(Isolate* isolate, Handle<Map> map, Handle<Map> new_map,
              const Expectations& expectations) {
     CHECK(!map->is_deprecated());
     CHECK_NE(*map, *new_map);
@@ -1366,11 +1399,12 @@ struct CheckUnrelated {
 // Checks that given |map| is NOT deprecated, and |new_map| is a result of
 // copy-generalize-all-representations.
 struct CheckCopyGeneralizeAllFields {
-  void Check(Handle<Map> map, Handle<Map> new_map, Expectations& expectations) {
+  void Check(Isolate* isolate, Handle<Map> map, Handle<Map> new_map,
+             Expectations& expectations) {
     CHECK(!map->is_deprecated());
     CHECK_NE(*map, *new_map);
 
-    CHECK(new_map->GetBackPointer()->IsUndefined(map->GetIsolate()));
+    CHECK(new_map->GetBackPointer()->IsUndefined(isolate));
     for (int i = 0; i < kPropCount; i++) {
       expectations.GeneralizeField(i);
     }
@@ -1405,7 +1439,7 @@ static void TestReconfigureProperty_CustomPropertyAfterTargetMap(
   const int kSplitProp = 2;
   CHECK_LT(kSplitProp, kCustomPropIndex);
 
-  const PropertyConstness constness = kMutable;
+  const PropertyConstness constness = PropertyConstness::kMutable;
   const Representation representation = Representation::Smi();
 
   // Create common part of transition tree.
@@ -1460,7 +1494,7 @@ static void TestReconfigureProperty_CustomPropertyAfterTargetMap(
   // Reconfigure attributes of property |kSplitProp| of |map2| to NONE, which
   // should generalize representations in |map1|.
   Handle<Map> new_map =
-      Map::ReconfigureExistingProperty(map2, kSplitProp, kData, NONE);
+      Map::ReconfigureExistingProperty(isolate, map2, kSplitProp, kData, NONE);
 
   // |map2| should be left unchanged but marked unstable.
   CHECK(!map2->is_stable());
@@ -1469,7 +1503,7 @@ static void TestReconfigureProperty_CustomPropertyAfterTargetMap(
   CHECK(expectations2.Check(*map2));
 
   config.UpdateExpectations(kCustomPropIndex, expectations1);
-  checker.Check(map1, new_map, expectations1);
+  checker.Check(isolate, map1, new_map, expectations1);
 }
 
 
@@ -1517,7 +1551,7 @@ TEST(ReconfigureDataFieldAttribute_DataConstantToDataFieldAfterTargetMap) {
       Factory* factory = isolate->factory();
       Handle<String> name = factory->empty_string();
       Handle<Map> sloppy_map =
-          Map::CopyInitialMap(isolate->sloppy_function_map());
+          Map::CopyInitialMap(isolate, isolate->sloppy_function_map());
       Handle<SharedFunctionInfo> info =
           factory->NewSharedFunctionInfoForBuiltin(name, Builtins::kIllegal);
       function_type_ = FieldType::Class(sloppy_map, isolate);
@@ -1538,8 +1572,9 @@ TEST(ReconfigureDataFieldAttribute_DataConstantToDataFieldAfterTargetMap) {
     }
 
     void UpdateExpectations(int property_index, Expectations& expectations) {
-      PropertyConstness expected_constness =
-          FLAG_track_constant_fields ? kConst : kMutable;
+      PropertyConstness expected_constness = FLAG_track_constant_fields
+                                                 ? PropertyConstness::kConst
+                                                 : PropertyConstness::kMutable;
       expectations.SetDataField(property_index, expected_constness,
                                 Representation::HeapObject(), function_type_);
     }
@@ -1748,14 +1783,13 @@ static void TestReconfigureElementsKind_GeneralizeField(
   CHECK(expectations2.Check(*map2));
 
   Zone zone(isolate->allocator(), ZONE_NAME);
-  Handle<Map> field_owner(map->FindFieldOwner(kDiffProp), isolate);
   CompilationDependencies dependencies(isolate, &zone);
-  CHECK(!dependencies.HasAborted());
-  dependencies.AssumeFieldOwner(field_owner);
+  dependencies.DependOnFieldType(map, kDiffProp);
 
   // Reconfigure elements kinds of |map2|, which should generalize
   // representations in |map|.
-  Handle<Map> new_map = Map::ReconfigureElementsKind(map2, PACKED_ELEMENTS);
+  Handle<Map> new_map =
+      Map::ReconfigureElementsKind(isolate, map2, PACKED_ELEMENTS);
 
   // |map2| should be left unchanged but marked unstable.
   CHECK(!map2->is_stable());
@@ -1768,15 +1802,14 @@ static void TestReconfigureElementsKind_GeneralizeField(
                             expected.representation, expected.type);
 
   CHECK(map->is_deprecated());
-  CHECK(!dependencies.HasAborted());
-  dependencies.Rollback();  // Properly cleanup compilation info.
+  CHECK(dependencies.AreValid());
   CHECK_NE(*map, *new_map);
 
   CHECK(!new_map->is_deprecated());
   CHECK(expectations.Check(*new_map));
 
   // Update deprecated |map|, it should become |new_map|.
-  Handle<Map> updated_map = Map::Update(map);
+  Handle<Map> updated_map = Map::Update(isolate, map);
   CHECK_EQ(*new_map, *updated_map);
 
   // Ensure Map::FindElementsKindTransitionedMap() is able to find the
@@ -1784,7 +1817,8 @@ static void TestReconfigureElementsKind_GeneralizeField(
   {
     MapHandles map_list;
     map_list.push_back(updated_map);
-    Map* transitioned_map = map2->FindElementsKindTransitionedMap(map_list);
+    Map* transitioned_map =
+        map2->FindElementsKindTransitionedMap(isolate, map_list);
     CHECK_EQ(*updated_map, transitioned_map);
   }
 }
@@ -1842,14 +1876,13 @@ static void TestReconfigureElementsKind_GeneralizeFieldTrivial(
   CHECK(expectations2.Check(*map2));
 
   Zone zone(isolate->allocator(), ZONE_NAME);
-  Handle<Map> field_owner(map->FindFieldOwner(kDiffProp), isolate);
   CompilationDependencies dependencies(isolate, &zone);
-  CHECK(!dependencies.HasAborted());
-  dependencies.AssumeFieldOwner(field_owner);
+  dependencies.DependOnFieldType(map, kDiffProp);
 
   // Reconfigure elements kinds of |map2|, which should generalize
   // representations in |map|.
-  Handle<Map> new_map = Map::ReconfigureElementsKind(map2, PACKED_ELEMENTS);
+  Handle<Map> new_map =
+      Map::ReconfigureElementsKind(isolate, map2, PACKED_ELEMENTS);
 
   // |map2| should be left unchanged but marked unstable.
   CHECK(!map2->is_stable());
@@ -1865,13 +1898,12 @@ static void TestReconfigureElementsKind_GeneralizeFieldTrivial(
                             expected.representation, expected.type);
   CHECK(!map->is_deprecated());
   CHECK_EQ(*map, *new_map);
-  CHECK(!dependencies.HasAborted());
-  dependencies.Rollback();  // Properly cleanup compilation info.
+  CHECK(dependencies.AreValid());
 
   CHECK(!new_map->is_deprecated());
   CHECK(expectations.Check(*new_map));
 
-  Handle<Map> updated_map = Map::Update(map);
+  Handle<Map> updated_map = Map::Update(isolate, map);
   CHECK_EQ(*new_map, *updated_map);
 
   // Ensure Map::FindElementsKindTransitionedMap() is able to find the
@@ -1879,7 +1911,8 @@ static void TestReconfigureElementsKind_GeneralizeFieldTrivial(
   {
     MapHandles map_list;
     map_list.push_back(updated_map);
-    Map* transitioned_map = map2->FindElementsKindTransitionedMap(map_list);
+    Map* transitioned_map =
+        map2->FindElementsKindTransitionedMap(isolate, map_list);
     CHECK_EQ(*updated_map, transitioned_map);
   }
 }
@@ -1888,94 +1921,98 @@ TEST(ReconfigureElementsKind_GeneralizeSmiFieldToDouble) {
   CcTest::InitializeVM();
   v8::HandleScope scope(CcTest::isolate());
   Isolate* isolate = CcTest::i_isolate();
+
   Handle<FieldType> any_type = FieldType::Any(isolate);
 
   if (FLAG_track_constant_fields) {
     TestReconfigureElementsKind_GeneralizeField(
-        {kConst, Representation::Smi(), any_type},
-        {kConst, Representation::Double(), any_type},
-        {kConst, Representation::Double(), any_type});
+        {PropertyConstness::kConst, Representation::Smi(), any_type},
+        {PropertyConstness::kConst, Representation::Double(), any_type},
+        {PropertyConstness::kConst, Representation::Double(), any_type});
 
     TestReconfigureElementsKind_GeneralizeField(
-        {kConst, Representation::Smi(), any_type},
-        {kMutable, Representation::Double(), any_type},
-        {kMutable, Representation::Double(), any_type});
+        {PropertyConstness::kConst, Representation::Smi(), any_type},
+        {PropertyConstness::kMutable, Representation::Double(), any_type},
+        {PropertyConstness::kMutable, Representation::Double(), any_type});
 
     TestReconfigureElementsKind_GeneralizeField(
-        {kMutable, Representation::Smi(), any_type},
-        {kConst, Representation::Double(), any_type},
-        {kMutable, Representation::Double(), any_type});
+        {PropertyConstness::kMutable, Representation::Smi(), any_type},
+        {PropertyConstness::kConst, Representation::Double(), any_type},
+        {PropertyConstness::kMutable, Representation::Double(), any_type});
   }
   TestReconfigureElementsKind_GeneralizeField(
-      {kMutable, Representation::Smi(), any_type},
-      {kMutable, Representation::Double(), any_type},
-      {kMutable, Representation::Double(), any_type});
+      {PropertyConstness::kMutable, Representation::Smi(), any_type},
+      {PropertyConstness::kMutable, Representation::Double(), any_type},
+      {PropertyConstness::kMutable, Representation::Double(), any_type});
 }
 
 TEST(ReconfigureElementsKind_GeneralizeSmiFieldToTagged) {
   CcTest::InitializeVM();
   v8::HandleScope scope(CcTest::isolate());
   Isolate* isolate = CcTest::i_isolate();
+
   Handle<FieldType> any_type = FieldType::Any(isolate);
   Handle<FieldType> value_type =
       FieldType::Class(Map::Create(isolate, 0), isolate);
 
   if (FLAG_track_constant_fields) {
     TestReconfigureElementsKind_GeneralizeField(
-        {kConst, Representation::Smi(), any_type},
-        {kConst, Representation::HeapObject(), value_type},
-        {kConst, Representation::Tagged(), any_type});
+        {PropertyConstness::kConst, Representation::Smi(), any_type},
+        {PropertyConstness::kConst, Representation::HeapObject(), value_type},
+        {PropertyConstness::kConst, Representation::Tagged(), any_type});
 
     TestReconfigureElementsKind_GeneralizeField(
-        {kConst, Representation::Smi(), any_type},
-        {kMutable, Representation::HeapObject(), value_type},
-        {kMutable, Representation::Tagged(), any_type});
+        {PropertyConstness::kConst, Representation::Smi(), any_type},
+        {PropertyConstness::kMutable, Representation::HeapObject(), value_type},
+        {PropertyConstness::kMutable, Representation::Tagged(), any_type});
 
     TestReconfigureElementsKind_GeneralizeField(
-        {kMutable, Representation::Smi(), any_type},
-        {kConst, Representation::HeapObject(), value_type},
-        {kMutable, Representation::Tagged(), any_type});
+        {PropertyConstness::kMutable, Representation::Smi(), any_type},
+        {PropertyConstness::kConst, Representation::HeapObject(), value_type},
+        {PropertyConstness::kMutable, Representation::Tagged(), any_type});
   }
   TestReconfigureElementsKind_GeneralizeField(
-      {kMutable, Representation::Smi(), any_type},
-      {kMutable, Representation::HeapObject(), value_type},
-      {kMutable, Representation::Tagged(), any_type});
+      {PropertyConstness::kMutable, Representation::Smi(), any_type},
+      {PropertyConstness::kMutable, Representation::HeapObject(), value_type},
+      {PropertyConstness::kMutable, Representation::Tagged(), any_type});
 }
 
 TEST(ReconfigureElementsKind_GeneralizeDoubleFieldToTagged) {
   CcTest::InitializeVM();
   v8::HandleScope scope(CcTest::isolate());
   Isolate* isolate = CcTest::i_isolate();
+
   Handle<FieldType> any_type = FieldType::Any(isolate);
   Handle<FieldType> value_type =
       FieldType::Class(Map::Create(isolate, 0), isolate);
 
   if (FLAG_track_constant_fields) {
     TestReconfigureElementsKind_GeneralizeField(
-        {kConst, Representation::Double(), any_type},
-        {kConst, Representation::HeapObject(), value_type},
-        {kConst, Representation::Tagged(), any_type});
+        {PropertyConstness::kConst, Representation::Double(), any_type},
+        {PropertyConstness::kConst, Representation::HeapObject(), value_type},
+        {PropertyConstness::kConst, Representation::Tagged(), any_type});
 
     TestReconfigureElementsKind_GeneralizeField(
-        {kConst, Representation::Double(), any_type},
-        {kMutable, Representation::HeapObject(), value_type},
-        {kMutable, Representation::Tagged(), any_type});
+        {PropertyConstness::kConst, Representation::Double(), any_type},
+        {PropertyConstness::kMutable, Representation::HeapObject(), value_type},
+        {PropertyConstness::kMutable, Representation::Tagged(), any_type});
 
     TestReconfigureElementsKind_GeneralizeField(
-        {kMutable, Representation::Double(), any_type},
-        {kConst, Representation::HeapObject(), value_type},
-        {kMutable, Representation::Tagged(), any_type});
+        {PropertyConstness::kMutable, Representation::Double(), any_type},
+        {PropertyConstness::kConst, Representation::HeapObject(), value_type},
+        {PropertyConstness::kMutable, Representation::Tagged(), any_type});
   }
   TestReconfigureElementsKind_GeneralizeField(
-      {kMutable, Representation::Double(), any_type},
-      {kMutable, Representation::HeapObject(), value_type},
-      {kMutable, Representation::Tagged(), any_type});
+      {PropertyConstness::kMutable, Representation::Double(), any_type},
+      {PropertyConstness::kMutable, Representation::HeapObject(), value_type},
+      {PropertyConstness::kMutable, Representation::Tagged(), any_type});
 }
 
 TEST(ReconfigureElementsKind_GeneralizeHeapObjFieldToHeapObj) {
   CcTest::InitializeVM();
   v8::HandleScope scope(CcTest::isolate());
   Isolate* isolate = CcTest::i_isolate();
+
   Handle<FieldType> any_type = FieldType::Any(isolate);
 
   Handle<FieldType> current_type =
@@ -1989,33 +2026,41 @@ TEST(ReconfigureElementsKind_GeneralizeHeapObjFieldToHeapObj) {
   // Check generalizations that trigger deopts.
   if (FLAG_track_constant_fields) {
     TestReconfigureElementsKind_GeneralizeFieldTrivial(
-        {kConst, Representation::HeapObject(), current_type},
-        {kConst, Representation::HeapObject(), new_type},
-        {kConst, Representation::HeapObject(), expected_type});
+        {PropertyConstness::kConst, Representation::HeapObject(), current_type},
+        {PropertyConstness::kConst, Representation::HeapObject(), new_type},
+        {PropertyConstness::kConst, Representation::HeapObject(),
+         expected_type});
     if (FLAG_modify_map_inplace) {
-      // kConst to kMutable migration does not create a new map, therefore
-      // trivial generalization.
+      // PropertyConstness::kConst to PropertyConstness::kMutable migration does
+      // not create a new map, therefore trivial generalization.
       TestReconfigureElementsKind_GeneralizeFieldTrivial(
-          {kConst, Representation::HeapObject(), current_type},
-          {kMutable, Representation::HeapObject(), new_type},
-          {kMutable, Representation::HeapObject(), expected_type});
+          {PropertyConstness::kConst, Representation::HeapObject(),
+           current_type},
+          {PropertyConstness::kMutable, Representation::HeapObject(), new_type},
+          {PropertyConstness::kMutable, Representation::HeapObject(),
+           expected_type});
     } else {
-      // kConst to kMutable migration causes map change, therefore
-      // non-trivial generalization.
+      // PropertyConstness::kConst to PropertyConstness::kMutable migration
+      // causes map change, therefore non-trivial generalization.
       TestReconfigureElementsKind_GeneralizeField(
-          {kConst, Representation::HeapObject(), current_type},
-          {kMutable, Representation::HeapObject(), new_type},
-          {kMutable, Representation::HeapObject(), expected_type});
+          {PropertyConstness::kConst, Representation::HeapObject(),
+           current_type},
+          {PropertyConstness::kMutable, Representation::HeapObject(), new_type},
+          {PropertyConstness::kMutable, Representation::HeapObject(),
+           expected_type});
     }
     TestReconfigureElementsKind_GeneralizeFieldTrivial(
-        {kMutable, Representation::HeapObject(), current_type},
-        {kConst, Representation::HeapObject(), new_type},
-        {kMutable, Representation::HeapObject(), expected_type});
+        {PropertyConstness::kMutable, Representation::HeapObject(),
+         current_type},
+        {PropertyConstness::kConst, Representation::HeapObject(), new_type},
+        {PropertyConstness::kMutable, Representation::HeapObject(),
+         expected_type});
   }
   TestReconfigureElementsKind_GeneralizeFieldTrivial(
-      {kMutable, Representation::HeapObject(), current_type},
-      {kMutable, Representation::HeapObject(), new_type},
-      {kMutable, Representation::HeapObject(), expected_type});
+      {PropertyConstness::kMutable, Representation::HeapObject(), current_type},
+      {PropertyConstness::kMutable, Representation::HeapObject(), new_type},
+      {PropertyConstness::kMutable, Representation::HeapObject(),
+       expected_type});
   current_type = expected_type;
 
   // Check generalizations that do not trigger deopts.
@@ -2023,65 +2068,68 @@ TEST(ReconfigureElementsKind_GeneralizeHeapObjFieldToHeapObj) {
 
   if (FLAG_track_constant_fields) {
     TestReconfigureElementsKind_GeneralizeFieldTrivial(
-        {kConst, Representation::HeapObject(), any_type},
-        {kConst, Representation::HeapObject(), new_type},
-        {kConst, Representation::HeapObject(), any_type});
+        {PropertyConstness::kConst, Representation::HeapObject(), any_type},
+        {PropertyConstness::kConst, Representation::HeapObject(), new_type},
+        {PropertyConstness::kConst, Representation::HeapObject(), any_type});
 
     if (FLAG_modify_map_inplace) {
-      // kConst to kMutable migration does not create a new map, therefore
-      // trivial generalization.
+      // PropertyConstness::kConst to PropertyConstness::kMutable migration does
+      // not create a new map, therefore trivial generalization.
       TestReconfigureElementsKind_GeneralizeFieldTrivial(
-          {kConst, Representation::HeapObject(), any_type},
-          {kMutable, Representation::HeapObject(), new_type},
-          {kMutable, Representation::HeapObject(), any_type});
+          {PropertyConstness::kConst, Representation::HeapObject(), any_type},
+          {PropertyConstness::kMutable, Representation::HeapObject(), new_type},
+          {PropertyConstness::kMutable, Representation::HeapObject(),
+           any_type});
     } else {
-      // kConst to kMutable migration causes map change, therefore
-      // non-trivial generalization.
+      // PropertyConstness::kConst to PropertyConstness::kMutable migration
+      // causes map change, therefore non-trivial generalization.
       TestReconfigureElementsKind_GeneralizeField(
-          {kConst, Representation::HeapObject(), any_type},
-          {kMutable, Representation::HeapObject(), new_type},
-          {kMutable, Representation::HeapObject(), any_type});
+          {PropertyConstness::kConst, Representation::HeapObject(), any_type},
+          {PropertyConstness::kMutable, Representation::HeapObject(), new_type},
+          {PropertyConstness::kMutable, Representation::HeapObject(),
+           any_type});
     }
 
     TestReconfigureElementsKind_GeneralizeFieldTrivial(
-        {kMutable, Representation::HeapObject(), any_type},
-        {kConst, Representation::HeapObject(), new_type},
-        {kMutable, Representation::HeapObject(), any_type});
+        {PropertyConstness::kMutable, Representation::HeapObject(), any_type},
+        {PropertyConstness::kConst, Representation::HeapObject(), new_type},
+        {PropertyConstness::kMutable, Representation::HeapObject(), any_type});
   }
   TestReconfigureElementsKind_GeneralizeFieldTrivial(
-      {kMutable, Representation::HeapObject(), any_type},
-      {kMutable, Representation::HeapObject(), new_type},
-      {kMutable, Representation::HeapObject(), any_type});
+      {PropertyConstness::kMutable, Representation::HeapObject(), any_type},
+      {PropertyConstness::kMutable, Representation::HeapObject(), new_type},
+      {PropertyConstness::kMutable, Representation::HeapObject(), any_type});
 }
 
 TEST(ReconfigureElementsKind_GeneralizeHeapObjectFieldToTagged) {
   CcTest::InitializeVM();
   v8::HandleScope scope(CcTest::isolate());
   Isolate* isolate = CcTest::i_isolate();
+
   Handle<FieldType> any_type = FieldType::Any(isolate);
   Handle<FieldType> value_type =
       FieldType::Class(Map::Create(isolate, 0), isolate);
 
   if (FLAG_track_constant_fields) {
     TestReconfigureElementsKind_GeneralizeField(
-        {kConst, Representation::HeapObject(), value_type},
-        {kConst, Representation::Smi(), any_type},
-        {kConst, Representation::Tagged(), any_type});
+        {PropertyConstness::kConst, Representation::HeapObject(), value_type},
+        {PropertyConstness::kConst, Representation::Smi(), any_type},
+        {PropertyConstness::kConst, Representation::Tagged(), any_type});
 
     TestReconfigureElementsKind_GeneralizeField(
-        {kConst, Representation::HeapObject(), value_type},
-        {kMutable, Representation::Smi(), any_type},
-        {kMutable, Representation::Tagged(), any_type});
+        {PropertyConstness::kConst, Representation::HeapObject(), value_type},
+        {PropertyConstness::kMutable, Representation::Smi(), any_type},
+        {PropertyConstness::kMutable, Representation::Tagged(), any_type});
 
     TestReconfigureElementsKind_GeneralizeField(
-        {kMutable, Representation::HeapObject(), value_type},
-        {kConst, Representation::Smi(), any_type},
-        {kMutable, Representation::Tagged(), any_type});
+        {PropertyConstness::kMutable, Representation::HeapObject(), value_type},
+        {PropertyConstness::kConst, Representation::Smi(), any_type},
+        {PropertyConstness::kMutable, Representation::Tagged(), any_type});
   }
   TestReconfigureElementsKind_GeneralizeField(
-      {kMutable, Representation::HeapObject(), value_type},
-      {kMutable, Representation::Smi(), any_type},
-      {kMutable, Representation::Tagged(), any_type});
+      {PropertyConstness::kMutable, Representation::HeapObject(), value_type},
+      {PropertyConstness::kMutable, Representation::Smi(), any_type},
+      {PropertyConstness::kMutable, Representation::Tagged(), any_type});
 }
 
 ////////////////////////////////////////////////////////////////////////////////
@@ -2092,6 +2140,7 @@ TEST(ReconfigurePropertySplitMapTransitionsOverflow) {
   CcTest::InitializeVM();
   v8::HandleScope scope(CcTest::isolate());
   Isolate* isolate = CcTest::i_isolate();
+
   Handle<FieldType> any_type = FieldType::Any(isolate);
 
   Expectations expectations(isolate);
@@ -2100,8 +2149,8 @@ TEST(ReconfigurePropertySplitMapTransitionsOverflow) {
   Handle<Map> initial_map = Map::Create(isolate, 0);
   Handle<Map> map = initial_map;
   for (int i = 0; i < kPropCount; i++) {
-    map = expectations.AddDataField(map, NONE, kMutable, Representation::Smi(),
-                                    any_type);
+    map = expectations.AddDataField(map, NONE, PropertyConstness::kMutable,
+                                    Representation::Smi(), any_type);
   }
   CHECK(!map->is_deprecated());
   CHECK(map->is_stable());
@@ -2117,16 +2166,16 @@ TEST(ReconfigurePropertySplitMapTransitionsOverflow) {
       }
 
       Handle<String> name = MakeName("prop", i);
-      Map* target =
-          TransitionsAccessor(map2).SearchTransition(*name, kData, NONE);
+      Map* target = TransitionsAccessor(isolate, map2)
+                        .SearchTransition(*name, kData, NONE);
       CHECK_NOT_NULL(target);
-      map2 = handle(target);
+      map2 = handle(target, isolate);
     }
 
-    map2 = Map::ReconfigureProperty(map2, kSplitProp, kData, NONE,
+    map2 = Map::ReconfigureProperty(isolate, map2, kSplitProp, kData, NONE,
                                     Representation::Double(), any_type);
-    expectations.SetDataField(kSplitProp, kMutable, Representation::Double(),
-                              any_type);
+    expectations.SetDataField(kSplitProp, PropertyConstness::kMutable,
+                              Representation::Double(), any_type);
 
     CHECK(expectations.Check(*split_map, kSplitProp));
     CHECK(expectations.Check(*map2, kSplitProp + 1));
@@ -2141,21 +2190,23 @@ TEST(ReconfigurePropertySplitMapTransitionsOverflow) {
 
   // Fill in transition tree of |map2| so that it can't have more transitions.
   for (int i = 0; i < TransitionsAccessor::kMaxNumberOfTransitions; i++) {
-    CHECK(TransitionsAccessor(map2).CanHaveMoreTransitions());
+    CHECK(TransitionsAccessor(isolate, map2).CanHaveMoreTransitions());
     Handle<String> name = MakeName("foo", i);
-    Map::CopyWithField(map2, name, any_type, NONE, kMutable,
-                       Representation::Smi(), INSERT_TRANSITION)
+    Map::CopyWithField(isolate, map2, name, any_type, NONE,
+                       PropertyConstness::kMutable, Representation::Smi(),
+                       INSERT_TRANSITION)
         .ToHandleChecked();
   }
-  CHECK(!TransitionsAccessor(map2).CanHaveMoreTransitions());
+  CHECK(!TransitionsAccessor(isolate, map2).CanHaveMoreTransitions());
 
   // Try to update |map|, since there is no place for propX transition at |map2|
   // |map| should become "copy-generalized".
-  Handle<Map> updated_map = Map::Update(map);
+  Handle<Map> updated_map = Map::Update(isolate, map);
   CHECK(updated_map->GetBackPointer()->IsUndefined(isolate));
 
   for (int i = 0; i < kPropCount; i++) {
-    expectations.SetDataField(i, kMutable, Representation::Tagged(), any_type);
+    expectations.SetDataField(i, PropertyConstness::kMutable,
+                              Representation::Tagged(), any_type);
   }
   CHECK(expectations.Check(*updated_map));
 }
@@ -2224,7 +2275,7 @@ static void TestGeneralizeFieldWithSpecialTransition(TestConfig& config,
   // Create new maps by generalizing representation of propX field.
   Handle<Map> maps[kPropCount];
   for (int i = 0; i < kPropCount; i++) {
-    Handle<Map> new_map = Map::ReconfigureProperty(map, i, kData, NONE,
+    Handle<Map> new_map = Map::ReconfigureProperty(isolate, map, i, kData, NONE,
                                                    to.representation, to.type);
     maps[i] = new_map;
 
@@ -2236,12 +2287,12 @@ static void TestGeneralizeFieldWithSpecialTransition(TestConfig& config,
     CHECK(i == 0 || maps[i - 1]->is_deprecated());
     CHECK(expectations.Check(*new_map));
 
-    Handle<Map> new_map2 = Map::Update(map2);
+    Handle<Map> new_map2 = Map::Update(isolate, map2);
     CHECK(!new_map2->is_deprecated());
     CHECK(!new_map2->is_dictionary_map());
 
     Handle<Map> tmp_map;
-    if (Map::TryUpdate(map2).ToHandle(&tmp_map)) {
+    if (Map::TryUpdate(isolate, map2).ToHandle(&tmp_map)) {
       // If Map::TryUpdate() manages to succeed the result must match the result
       // of Map::Update().
       CHECK_EQ(*new_map2, *tmp_map);
@@ -2265,10 +2316,10 @@ static void TestGeneralizeFieldWithSpecialTransition(TestConfig& config,
   CHECK(!active_map->is_deprecated());
 
   // Update all deprecated maps and check that they are now the same.
-  Handle<Map> updated_map = Map::Update(map);
+  Handle<Map> updated_map = Map::Update(isolate, map);
   CHECK_EQ(*active_map, *updated_map);
   for (int i = 0; i < kPropCount; i++) {
-    updated_map = Map::Update(maps[i]);
+    updated_map = Map::Update(isolate, maps[i]);
     CHECK_EQ(*active_map, *updated_map);
   }
 }
@@ -2278,15 +2329,18 @@ TEST(ElementsKindTransitionFromMapOwningDescriptor) {
   CcTest::InitializeVM();
   v8::HandleScope scope(CcTest::isolate());
   Isolate* isolate = CcTest::i_isolate();
+
   Handle<FieldType> any_type = FieldType::Any(isolate);
   Handle<FieldType> value_type =
       FieldType::Class(Map::Create(isolate, 0), isolate);
 
   struct TestConfig {
     Handle<Map> Transition(Handle<Map> map, Expectations& expectations) {
-      Handle<Symbol> frozen_symbol(map->GetHeap()->frozen_symbol());
+      Handle<Symbol> frozen_symbol(map->GetReadOnlyRoots().frozen_symbol(),
+                                   CcTest::i_isolate());
       expectations.SetElementsKind(DICTIONARY_ELEMENTS);
-      return Map::CopyForPreventExtensions(map, NONE, frozen_symbol,
+      return Map::CopyForPreventExtensions(CcTest::i_isolate(), map, NONE,
+                                           frozen_symbol,
                                            "CopyForPreventExtensions");
     }
     // TODO(ishell): remove once IS_PROTO_TRANS_ISSUE_FIXED is removed.
@@ -2295,9 +2349,9 @@ TEST(ElementsKindTransitionFromMapOwningDescriptor) {
   };
   TestConfig config;
   TestGeneralizeFieldWithSpecialTransition(
-      config, {kMutable, Representation::Smi(), any_type},
-      {kMutable, Representation::HeapObject(), value_type},
-      {kMutable, Representation::Tagged(), any_type});
+      config, {PropertyConstness::kMutable, Representation::Smi(), any_type},
+      {PropertyConstness::kMutable, Representation::HeapObject(), value_type},
+      {PropertyConstness::kMutable, Representation::Tagged(), any_type});
 }
 
 
@@ -2305,6 +2359,7 @@ TEST(ElementsKindTransitionFromMapNotOwningDescriptor) {
   CcTest::InitializeVM();
   v8::HandleScope scope(CcTest::isolate());
   Isolate* isolate = CcTest::i_isolate();
+
   Handle<FieldType> any_type = FieldType::Any(isolate);
   Handle<FieldType> value_type =
       FieldType::Class(Map::Create(isolate, 0), isolate);
@@ -2317,14 +2372,16 @@ TEST(ElementsKindTransitionFromMapNotOwningDescriptor) {
       // Add one more transition to |map| in order to prevent descriptors
       // ownership.
       CHECK(map->owns_descriptors());
-      Map::CopyWithField(map, MakeString("foo"), any_type, NONE, kMutable,
-                         Representation::Smi(), INSERT_TRANSITION)
+      Map::CopyWithField(isolate, map, MakeString("foo"), any_type, NONE,
+                         PropertyConstness::kMutable, Representation::Smi(),
+                         INSERT_TRANSITION)
           .ToHandleChecked();
       CHECK(!map->owns_descriptors());
 
-      Handle<Symbol> frozen_symbol(map->GetHeap()->frozen_symbol());
+      Handle<Symbol> frozen_symbol(ReadOnlyRoots(isolate).frozen_symbol(),
+                                   isolate);
       expectations.SetElementsKind(DICTIONARY_ELEMENTS);
-      return Map::CopyForPreventExtensions(map, NONE, frozen_symbol,
+      return Map::CopyForPreventExtensions(isolate, map, NONE, frozen_symbol,
                                            "CopyForPreventExtensions");
     }
     // TODO(ishell): remove once IS_PROTO_TRANS_ISSUE_FIXED is removed.
@@ -2333,9 +2390,9 @@ TEST(ElementsKindTransitionFromMapNotOwningDescriptor) {
   };
   TestConfig config;
   TestGeneralizeFieldWithSpecialTransition(
-      config, {kMutable, Representation::Smi(), any_type},
-      {kMutable, Representation::HeapObject(), value_type},
-      {kMutable, Representation::Tagged(), any_type});
+      config, {PropertyConstness::kMutable, Representation::Smi(), any_type},
+      {PropertyConstness::kMutable, Representation::HeapObject(), value_type},
+      {PropertyConstness::kMutable, Representation::Tagged(), any_type});
 }
 
 
@@ -2358,7 +2415,7 @@ TEST(PrototypeTransitionFromMapOwningDescriptor) {
     }
 
     Handle<Map> Transition(Handle<Map> map, Expectations& expectations) {
-      return Map::TransitionToPrototype(map, prototype_);
+      return Map::TransitionToPrototype(CcTest::i_isolate(), map, prototype_);
     }
     // TODO(ishell): remove once IS_PROTO_TRANS_ISSUE_FIXED is removed.
     bool generalizes_representations() const {
@@ -2368,9 +2425,9 @@ TEST(PrototypeTransitionFromMapOwningDescriptor) {
   };
   TestConfig config;
   TestGeneralizeFieldWithSpecialTransition(
-      config, {kMutable, Representation::Smi(), any_type},
-      {kMutable, Representation::HeapObject(), value_type},
-      {kMutable, Representation::Tagged(), any_type});
+      config, {PropertyConstness::kMutable, Representation::Smi(), any_type},
+      {PropertyConstness::kMutable, Representation::HeapObject(), value_type},
+      {PropertyConstness::kMutable, Representation::Tagged(), any_type});
 }
 
 
@@ -2399,12 +2456,13 @@ TEST(PrototypeTransitionFromMapNotOwningDescriptor) {
       // Add one more transition to |map| in order to prevent descriptors
       // ownership.
       CHECK(map->owns_descriptors());
-      Map::CopyWithField(map, MakeString("foo"), any_type, NONE, kMutable,
-                         Representation::Smi(), INSERT_TRANSITION)
+      Map::CopyWithField(isolate, map, MakeString("foo"), any_type, NONE,
+                         PropertyConstness::kMutable, Representation::Smi(),
+                         INSERT_TRANSITION)
           .ToHandleChecked();
       CHECK(!map->owns_descriptors());
 
-      return Map::TransitionToPrototype(map, prototype_);
+      return Map::TransitionToPrototype(isolate, map, prototype_);
     }
     // TODO(ishell): remove once IS_PROTO_TRANS_ISSUE_FIXED is removed.
     bool generalizes_representations() const {
@@ -2414,9 +2472,9 @@ TEST(PrototypeTransitionFromMapNotOwningDescriptor) {
   };
   TestConfig config;
   TestGeneralizeFieldWithSpecialTransition(
-      config, {kMutable, Representation::Smi(), any_type},
-      {kMutable, Representation::HeapObject(), value_type},
-      {kMutable, Representation::Tagged(), any_type});
+      config, {PropertyConstness::kMutable, Representation::Smi(), any_type},
+      {PropertyConstness::kMutable, Representation::HeapObject(), value_type},
+      {PropertyConstness::kMutable, Representation::Tagged(), any_type});
 }
 
 
@@ -2492,10 +2550,11 @@ struct ReconfigureAsDataPropertyOperator {
         attributes_(attributes),
         heap_type_(heap_type) {}
 
-  Handle<Map> DoTransition(Expectations& expectations, Handle<Map> map) {
-    expectations.SetDataField(descriptor_, kMutable, representation_,
-                              heap_type_);
-    return Map::ReconfigureExistingProperty(map, descriptor_, kData,
+  Handle<Map> DoTransition(Isolate* isolate, Expectations& expectations,
+                           Handle<Map> map) {
+    expectations.SetDataField(descriptor_, PropertyConstness::kMutable,
+                              representation_, heap_type_);
+    return Map::ReconfigureExistingProperty(isolate, map, descriptor_, kData,
                                             attributes_);
   }
 };
@@ -2509,10 +2568,11 @@ struct ReconfigureAsAccessorPropertyOperator {
                                         PropertyAttributes attributes = NONE)
       : descriptor_(descriptor), attributes_(attributes) {}
 
-  Handle<Map> DoTransition(Expectations& expectations, Handle<Map> map) {
+  Handle<Map> DoTransition(Isolate* isolate, Expectations& expectations,
+                           Handle<Map> map) {
     expectations.SetAccessorField(descriptor_);
-    return Map::ReconfigureExistingProperty(map, descriptor_, kAccessor,
-                                            attributes_);
+    return Map::ReconfigureExistingProperty(isolate, map, descriptor_,
+                                            kAccessor, attributes_);
   }
 };
 
@@ -2534,12 +2594,13 @@ struct FieldGeneralizationChecker {
         attributes_(attributes),
         heap_type_(heap_type) {}
 
-  void Check(Expectations& expectations2, Handle<Map> map1, Handle<Map> map2) {
+  void Check(Isolate* isolate, Expectations& expectations2, Handle<Map> map1,
+             Handle<Map> map2) {
     CHECK(!map2->is_deprecated());
 
     CHECK(map1->is_deprecated());
     CHECK_NE(*map1, *map2);
-    Handle<Map> updated_map = Map::Update(map1);
+    Handle<Map> updated_map = Map::Update(isolate, map1);
     CHECK_EQ(*map2, *updated_map);
 
     expectations2.SetDataField(descriptor_, attributes_, constness_,
@@ -2551,7 +2612,8 @@ struct FieldGeneralizationChecker {
 
 // Checks that existing transition was taken as is.
 struct SameMapChecker {
-  void Check(Expectations& expectations, Handle<Map> map1, Handle<Map> map2) {
+  void Check(Isolate* isolate, Expectations& expectations, Handle<Map> map1,
+             Handle<Map> map2) {
     CHECK(!map2->is_deprecated());
     CHECK_EQ(*map1, *map2);
     CHECK(expectations.Check(*map2));
@@ -2562,7 +2624,8 @@ struct SameMapChecker {
 // Checks that both |map1| and |map2| should stays non-deprecated, this is
 // the case when property kind is change.
 struct PropertyKindReconfigurationChecker {
-  void Check(Expectations& expectations, Handle<Map> map1, Handle<Map> map2) {
+  void Check(Isolate* isolate, Expectations& expectations, Handle<Map> map1,
+             Handle<Map> map2) {
     CHECK(!map1->is_deprecated());
     CHECK(!map2->is_deprecated());
     CHECK_NE(*map1, *map2);
@@ -2598,8 +2661,8 @@ static void TestTransitionTo(TransitionOp1& transition_op1,
   Handle<Map> initial_map = Map::Create(isolate, 0);
   Handle<Map> map = initial_map;
   for (int i = 0; i < kPropCount - 1; i++) {
-    map = expectations.AddDataField(map, NONE, kMutable, Representation::Smi(),
-                                    any_type);
+    map = expectations.AddDataField(map, NONE, PropertyConstness::kMutable,
+                                    Representation::Smi(), any_type);
   }
   CHECK(expectations.Check(*map));
 
@@ -2611,7 +2674,7 @@ static void TestTransitionTo(TransitionOp1& transition_op1,
   Handle<Map> map2 = transition_op2.DoTransition(expectations2, map);
 
   // Let the test customization do the check.
-  checker.Check(expectations2, map1, map2);
+  checker.Check(isolate, expectations2, map1, map2);
 }
 
 
@@ -2619,22 +2682,23 @@ TEST(TransitionDataFieldToDataField) {
   CcTest::InitializeVM();
   v8::HandleScope scope(CcTest::isolate());
   Isolate* isolate = CcTest::i_isolate();
+
   Handle<FieldType> any_type = FieldType::Any(isolate);
 
   Handle<Object> value1 = handle(Smi::kZero, isolate);
-  TransitionToDataFieldOperator transition_op1(kMutable, Representation::Smi(),
-                                               any_type, value1);
+  TransitionToDataFieldOperator transition_op1(
+      PropertyConstness::kMutable, Representation::Smi(), any_type, value1);
 
   Handle<Object> value2 = isolate->factory()->NewHeapNumber(0);
   TransitionToDataFieldOperator transition_op2(
-      kMutable, Representation::Double(), any_type, value2);
+      PropertyConstness::kMutable, Representation::Double(), any_type, value2);
 
-  FieldGeneralizationChecker checker(kPropCount - 1, kMutable,
+  FieldGeneralizationChecker checker(kPropCount - 1,
+                                     PropertyConstness::kMutable,
                                      Representation::Double(), any_type);
   TestTransitionTo(transition_op1, transition_op2, checker);
 }
 
-
 TEST(TransitionDataConstantToSameDataConstant) {
   CcTest::InitializeVM();
   v8::HandleScope scope(CcTest::isolate());
@@ -2655,8 +2719,10 @@ TEST(TransitionDataConstantToAnotherDataConstant) {
   v8::HandleScope scope(CcTest::isolate());
   Isolate* isolate = CcTest::i_isolate();
   Factory* factory = isolate->factory();
+
   Handle<String> name = factory->empty_string();
-  Handle<Map> sloppy_map = Map::CopyInitialMap(isolate->sloppy_function_map());
+  Handle<Map> sloppy_map =
+      Map::CopyInitialMap(isolate, isolate->sloppy_function_map());
   Handle<SharedFunctionInfo> info =
       factory->NewSharedFunctionInfoForBuiltin(name, Builtins::kIllegal);
   Handle<FieldType> function_type = FieldType::Class(sloppy_map, isolate);
@@ -2676,7 +2742,8 @@ TEST(TransitionDataConstantToAnotherDataConstant) {
 
   } else {
     FieldGeneralizationChecker checker(
-        kPropCount - 1, kMutable, Representation::HeapObject(), function_type);
+        kPropCount - 1, PropertyConstness::kMutable,
+        Representation::HeapObject(), function_type);
     TestTransitionTo(transition_op1, transition_op2, checker);
   }
 }
@@ -2687,6 +2754,7 @@ TEST(TransitionDataConstantToDataField) {
   v8::HandleScope scope(CcTest::isolate());
   Isolate* isolate = CcTest::i_isolate();
   Factory* factory = isolate->factory();
+
   Handle<FieldType> any_type = FieldType::Any(isolate);
 
   Handle<JSFunction> js_func1 =
@@ -2695,9 +2763,10 @@ TEST(TransitionDataConstantToDataField) {
 
   Handle<Object> value2 = isolate->factory()->NewHeapNumber(0);
   TransitionToDataFieldOperator transition_op2(
-      kMutable, Representation::Double(), any_type, value2);
+      PropertyConstness::kMutable, Representation::Double(), any_type, value2);
 
-  FieldGeneralizationChecker checker(kPropCount - 1, kMutable,
+  FieldGeneralizationChecker checker(kPropCount - 1,
+                                     PropertyConstness::kMutable,
                                      Representation::Tagged(), any_type);
   TestTransitionTo(transition_op1, transition_op2, checker);
 }
@@ -2722,10 +2791,10 @@ TEST(HoleyMutableHeapNumber) {
   v8::HandleScope scope(CcTest::isolate());
   Isolate* isolate = CcTest::i_isolate();
 
-  Handle<HeapNumber> mhn = isolate->factory()->NewMutableHeapNumber();
+  auto mhn = isolate->factory()->NewMutableHeapNumberWithHoleNaN();
   CHECK_EQ(kHoleNanInt64, mhn->value_as_bits());
 
-  mhn = isolate->factory()->NewHeapNumber(0.0, MUTABLE);
+  mhn = isolate->factory()->NewMutableHeapNumber(0.0);
   CHECK_EQ(uint64_t{0}, mhn->value_as_bits());
 
   mhn->set_value_as_bits(kHoleNanInt64);
@@ -2738,13 +2807,14 @@ TEST(HoleyMutableHeapNumber) {
       Object::NewStorageFor(isolate, isolate->factory()->uninitialized_value(),
                             Representation::Double());
   CHECK(obj->IsMutableHeapNumber());
-  CHECK_EQ(kHoleNanInt64, HeapNumber::cast(*obj)->value_as_bits());
+  CHECK_EQ(kHoleNanInt64, MutableHeapNumber::cast(*obj)->value_as_bits());
 
   obj = Object::NewStorageFor(isolate, mhn, Representation::Double());
   CHECK(obj->IsMutableHeapNumber());
-  CHECK_EQ(kHoleNanInt64, HeapNumber::cast(*obj)->value_as_bits());
+  CHECK_EQ(kHoleNanInt64, MutableHeapNumber::cast(*obj)->value_as_bits());
 }
 
 }  // namespace test_field_type_tracking
+}  // namespace compiler
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/test/cctest/test-flags.cc b/deps/v8/test/cctest/test-flags.cc
index cab17ee09a8883..20db9547e96a16 100644
--- a/deps/v8/test/cctest/test-flags.cc
+++ b/deps/v8/test/cctest/test-flags.cc
@@ -42,7 +42,6 @@ TEST(Default) {
   CHECK_EQ(0, strcmp(FLAG_testing_string_flag, "Hello, world!"));
 }
 
-
 static void SetFlagsToDefault() {
   FlagList::ResetAllFlags();
   TestDefault();
diff --git a/deps/v8/test/cctest/test-func-name-inference.cc b/deps/v8/test/cctest/test-func-name-inference.cc
index 783ab3da83bd92..160f68813c179a 100644
--- a/deps/v8/test/cctest/test-func-name-inference.cc
+++ b/deps/v8/test/cctest/test-func-name-inference.cc
@@ -40,41 +40,38 @@ using ::v8::internal::CStrVector;
 using ::v8::internal::Factory;
 using ::v8::internal::Handle;
 using ::v8::internal::Heap;
-using ::v8::internal::Isolate;
 using ::v8::internal::JSFunction;
-using ::v8::internal::Object;
 using ::v8::internal::Runtime;
-using ::v8::internal::Script;
 using ::v8::internal::SharedFunctionInfo;
-using ::v8::internal::String;
 using ::v8::internal::Vector;
 
 
 static void CheckFunctionName(v8::Local<v8::Script> script,
                               const char* func_pos_src,
                               const char* ref_inferred_name) {
-  Isolate* isolate = CcTest::i_isolate();
+  i::Isolate* isolate = CcTest::i_isolate();
 
   // Get script source.
-  Handle<Object> obj = v8::Utils::OpenHandle(*script);
+  Handle<i::Object> obj = v8::Utils::OpenHandle(*script);
   Handle<SharedFunctionInfo> shared_function;
   if (obj->IsSharedFunctionInfo()) {
     shared_function =
-        Handle<SharedFunctionInfo>(SharedFunctionInfo::cast(*obj));
+        Handle<SharedFunctionInfo>(SharedFunctionInfo::cast(*obj), isolate);
   } else {
     shared_function =
-        Handle<SharedFunctionInfo>(JSFunction::cast(*obj)->shared());
+        Handle<SharedFunctionInfo>(JSFunction::cast(*obj)->shared(), isolate);
   }
-  Handle<Script> i_script(Script::cast(shared_function->script()));
+  Handle<i::Script> i_script(i::Script::cast(shared_function->script()),
+                             isolate);
   CHECK(i_script->source()->IsString());
-  Handle<String> script_src(String::cast(i_script->source()));
+  Handle<i::String> script_src(i::String::cast(i_script->source()), isolate);
 
   // Find the position of a given func source substring in the source.
   int func_pos;
   {
     i::DisallowHeapAllocation no_gc;
     Vector<const uint8_t> func_pos_str = i::OneByteVector(func_pos_src);
-    String::FlatContent script_content = script_src->GetFlatContent();
+    i::String::FlatContent script_content = script_src->GetFlatContent();
     func_pos = SearchString(isolate, script_content.ToOneByteVector(),
                             func_pos_str, 0);
   }
diff --git a/deps/v8/test/cctest/test-global-handles.cc b/deps/v8/test/cctest/test-global-handles.cc
index 6f2119be794dd8..89b5ed4c836871 100644
--- a/deps/v8/test/cctest/test-global-handles.cc
+++ b/deps/v8/test/cctest/test-global-handles.cc
@@ -94,8 +94,7 @@ void WeakHandleTest(v8::Isolate* isolate, ConstructFunction construct_function,
   {
     v8::HandleScope scope(isolate);
     v8::Local<v8::Object> tmp = v8::Local<v8::Object>::New(isolate, fp.handle);
-    CHECK(
-        CcTest::i_isolate()->heap()->InNewSpace(*v8::Utils::OpenHandle(*tmp)));
+    CHECK(i::Heap::InNewSpace(*v8::Utils::OpenHandle(*tmp)));
   }
 
   fp.handle.SetWeak(&fp, &ResetHandleAndSetFlag,
@@ -470,8 +469,7 @@ TEST(GCFromWeakCallbacks) {
         v8::HandleScope scope(isolate);
         v8::Local<v8::Object> tmp =
             v8::Local<v8::Object>::New(isolate, fp.handle);
-        CHECK(CcTest::i_isolate()->heap()->InNewSpace(
-            *v8::Utils::OpenHandle(*tmp)));
+        CHECK(i::Heap::InNewSpace(*v8::Utils::OpenHandle(*tmp)));
       }
       fp.flag = false;
       fp.handle.SetWeak(&fp, gc_forcing_callback[inner_gc],
@@ -483,5 +481,34 @@ TEST(GCFromWeakCallbacks) {
   }
 }
 
+namespace {
+
+void SecondPassCallback(const v8::WeakCallbackInfo<FlagAndPersistent>& data) {
+  data.GetParameter()->flag = true;
+}
+
+void FirstPassCallback(const v8::WeakCallbackInfo<FlagAndPersistent>& data) {
+  data.GetParameter()->handle.Reset();
+  data.SetSecondPassCallback(SecondPassCallback);
+}
+
+}  // namespace
+
+TEST(SecondPassPhantomCallbacks) {
+  v8::Isolate* isolate = CcTest::isolate();
+  v8::Locker locker(CcTest::isolate());
+  v8::HandleScope scope(isolate);
+  v8::Local<v8::Context> context = v8::Context::New(isolate);
+  v8::Context::Scope context_scope(context);
+  FlagAndPersistent fp;
+  ConstructJSApiObject(isolate, context, &fp);
+  fp.flag = false;
+  fp.handle.SetWeak(&fp, FirstPassCallback, v8::WeakCallbackType::kParameter);
+  CHECK(!fp.flag);
+  CcTest::CollectGarbage(i::OLD_SPACE);
+  CcTest::CollectGarbage(i::OLD_SPACE);
+  CHECK(fp.flag);
+}
+
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/test/cctest/test-hashcode.cc b/deps/v8/test/cctest/test-hashcode.cc
index 06f1eb1862a111..a433c77ac7cd66 100644
--- a/deps/v8/test/cctest/test-hashcode.cc
+++ b/deps/v8/test/cctest/test-hashcode.cc
@@ -19,9 +19,9 @@ namespace internal {
 int AddToSetAndGetHash(Isolate* isolate, Handle<JSObject> obj,
                        bool has_fast_properties) {
   CHECK_EQ(has_fast_properties, obj->HasFastProperties());
-  CHECK_EQ(isolate->heap()->undefined_value(), obj->GetHash());
+  CHECK_EQ(ReadOnlyRoots(isolate).undefined_value(), obj->GetHash());
   Handle<OrderedHashSet> set = isolate->factory()->NewOrderedHashSet();
-  OrderedHashSet::Add(set, obj);
+  OrderedHashSet::Add(isolate, set, obj);
   CHECK_EQ(has_fast_properties, obj->HasFastProperties());
   return Smi::ToInt(obj->GetHash());
 }
@@ -62,7 +62,8 @@ TEST(AddHashCodeToFastObjectWithInObjectProperties) {
   CompileRun(source);
 
   Handle<JSObject> obj = GetGlobal<JSObject>("x");
-  CHECK_EQ(isolate->heap()->empty_fixed_array(), obj->raw_properties_or_hash());
+  CHECK_EQ(ReadOnlyRoots(isolate).empty_fixed_array(),
+           obj->raw_properties_or_hash());
 
   int hash = AddToSetAndGetHash(isolate, obj, true);
   CHECK_EQ(Smi::FromInt(hash), obj->raw_properties_or_hash());
diff --git a/deps/v8/test/cctest/test-heap-profiler.cc b/deps/v8/test/cctest/test-heap-profiler.cc
index 4372aa3d2e5205..0f02b0dc1c2b12 100644
--- a/deps/v8/test/cctest/test-heap-profiler.cc
+++ b/deps/v8/test/cctest/test-heap-profiler.cc
@@ -343,7 +343,7 @@ TEST(HeapSnapshotCodeObjects) {
 
   CompileRun(
       "function lazy(x) { return x - 1; }\n"
-      "function compiled(x) { return x + 1; }\n"
+      "function compiled(x) { ()=>x; return x + 1; }\n"
       "var anonymous = (function() { return function() { return 0; } })();\n"
       "compiled(1)");
   const v8::HeapSnapshot* snapshot = heap_profiler->TakeHeapSnapshot();
@@ -1541,8 +1541,8 @@ class EmbedderGraphBuilder : public v8::PersistentHandleVisitor {
         graph->AddNode(std::unique_ptr<Group>(new Group("ccc-group")));
   }
 
-  static void BuildEmbedderGraph(v8::Isolate* isolate,
-                                 v8::EmbedderGraph* graph) {
+  static void BuildEmbedderGraph(v8::Isolate* isolate, v8::EmbedderGraph* graph,
+                                 void* data) {
     EmbedderGraphBuilder builder(isolate, graph);
     isolate->VisitHandlesWithClassIds(&builder);
   }
@@ -1604,8 +1604,8 @@ TEST(HeapSnapshotRetainedObjectInfo) {
   v8::HandleScope scope(isolate);
   v8::HeapProfiler* heap_profiler = isolate->GetHeapProfiler();
 
-  heap_profiler->SetBuildEmbedderGraphCallback(
-      EmbedderGraphBuilder::BuildEmbedderGraph);
+  heap_profiler->AddBuildEmbedderGraphCallback(
+      EmbedderGraphBuilder::BuildEmbedderGraph, nullptr);
   v8::Persistent<v8::String> p_AAA(isolate, v8_str("AAA"));
   p_AAA.SetWrapperClassId(1);
   v8::Persistent<v8::String> p_BBB(isolate, v8_str("BBB"));
@@ -2185,31 +2185,6 @@ TEST(SfiAndJsFunctionWeakRefs) {
 }
 
 
-TEST(NoDebugObjectInSnapshot) {
-  LocalContext env;
-  v8::HandleScope scope(env->GetIsolate());
-  v8::HeapProfiler* heap_profiler = env->GetIsolate()->GetHeapProfiler();
-
-  CHECK(CcTest::i_isolate()->debug()->Load());
-  CompileRun("foo = {};");
-  const v8::HeapSnapshot* snapshot = heap_profiler->TakeHeapSnapshot();
-  CHECK(ValidateSnapshot(snapshot));
-  const v8::HeapGraphNode* root = snapshot->GetRoot();
-  int globals_count = 0;
-  for (int i = 0; i < root->GetChildrenCount(); ++i) {
-    const v8::HeapGraphEdge* edge = root->GetChild(i);
-    if (edge->GetType() == v8::HeapGraphEdge::kShortcut) {
-      ++globals_count;
-      const v8::HeapGraphNode* global = edge->GetToNode();
-      const v8::HeapGraphNode* foo = GetProperty(
-          env->GetIsolate(), global, v8::HeapGraphEdge::kProperty, "foo");
-      CHECK(foo);
-    }
-  }
-  CHECK_EQ(1, globals_count);
-}
-
-
 TEST(AllStrongGcRootsHaveNames) {
   LocalContext env;
   v8::HandleScope scope(env->GetIsolate());
@@ -2441,12 +2416,8 @@ TEST(CheckCodeNames) {
   const v8::HeapSnapshot* snapshot = heap_profiler->TakeHeapSnapshot();
   CHECK(ValidateSnapshot(snapshot));
 
-  const char* stub_path[] = {
-    "::(GC roots)",
-    "::(Strong roots)",
-    "code_stubs::",
-    "::(ArraySingleArgumentConstructorStub code)"
-  };
+  const char* stub_path[] = {"::(GC roots)", "::(Strong roots)",
+                             "code_stubs::", "::(StoreFastElementStub code)"};
   const v8::HeapGraphNode* node = GetNodeByPath(
       env->GetIsolate(), snapshot, stub_path, arraysize(stub_path));
   CHECK(node);
@@ -2579,7 +2550,7 @@ TEST(TrackHeapAllocationsWithInlining) {
   const char* names[] = {"", "start", "f_0_0"};
   AllocationTraceNode* node = FindNode(tracker, ArrayVector(names));
   CHECK(node);
-  CHECK_GE(node->allocation_count(), 10u);
+  CHECK_GE(node->allocation_count(), 8u);
   CHECK_GE(node->allocation_size(), 4 * node->allocation_count());
   heap_profiler->StopTrackingHeapObjects();
 }
@@ -2932,7 +2903,8 @@ class EmbedderRootNode : public EmbedderNode {
 // global object.
 v8::Local<v8::Value>* global_object_pointer;
 
-void BuildEmbedderGraph(v8::Isolate* v8_isolate, v8::EmbedderGraph* graph) {
+void BuildEmbedderGraph(v8::Isolate* v8_isolate, v8::EmbedderGraph* graph,
+                        void* data) {
   using Node = v8::EmbedderGraph::Node;
   Node* global_node = graph->V8Node(*global_object_pointer);
   Node* embedder_node_A = graph->AddNode(
@@ -2976,15 +2948,95 @@ TEST(EmbedderGraph) {
   i::Isolate* isolate = reinterpret_cast<i::Isolate*>(env->GetIsolate());
   v8::Local<v8::Value> global_object =
       v8::Utils::ToLocal(i::Handle<i::JSObject>(
-          (isolate->context()->native_context()->global_object())));
+          (isolate->context()->native_context()->global_object()), isolate));
   global_object_pointer = &global_object;
   v8::HeapProfiler* heap_profiler = env->GetIsolate()->GetHeapProfiler();
-  heap_profiler->SetBuildEmbedderGraphCallback(BuildEmbedderGraph);
+  heap_profiler->AddBuildEmbedderGraphCallback(BuildEmbedderGraph, nullptr);
   const v8::HeapSnapshot* snapshot = heap_profiler->TakeHeapSnapshot();
   CHECK(ValidateSnapshot(snapshot));
   CheckEmbedderGraphSnapshot(env->GetIsolate(), snapshot);
 }
 
+struct GraphBuildingContext {
+  int counter = 0;
+};
+
+void CheckEmbedderGraphSnapshotWithContext(
+    v8::Isolate* isolate, const v8::HeapSnapshot* snapshot,
+    const GraphBuildingContext* context) {
+  const v8::HeapGraphNode* global = GetGlobalObject(snapshot);
+  CHECK_GE(context->counter, 1);
+  CHECK_LE(context->counter, 2);
+
+  const v8::HeapGraphNode* embedder_node_A =
+      GetChildByName(global, "EmbedderNodeA");
+  CHECK_EQ(10, GetSize(embedder_node_A));
+
+  const v8::HeapGraphNode* embedder_node_B =
+      GetChildByName(global, "EmbedderNodeB");
+  if (context->counter == 2) {
+    CHECK_NOT_NULL(embedder_node_B);
+    CHECK_EQ(20, GetSize(embedder_node_B));
+  } else {
+    CHECK_NULL(embedder_node_B);
+  }
+}
+
+void BuildEmbedderGraphWithContext(v8::Isolate* v8_isolate,
+                                   v8::EmbedderGraph* graph, void* data) {
+  using Node = v8::EmbedderGraph::Node;
+  GraphBuildingContext* context = static_cast<GraphBuildingContext*>(data);
+  Node* global_node = graph->V8Node(*global_object_pointer);
+
+  CHECK_GE(context->counter, 0);
+  CHECK_LE(context->counter, 1);
+  switch (context->counter++) {
+    case 0: {
+      Node* embedder_node_A = graph->AddNode(
+          std::unique_ptr<Node>(new EmbedderNode("EmbedderNodeA", 10)));
+      graph->AddEdge(global_node, embedder_node_A);
+      break;
+    }
+    case 1: {
+      Node* embedder_node_B = graph->AddNode(
+          std::unique_ptr<Node>(new EmbedderNode("EmbedderNodeB", 20)));
+      graph->AddEdge(global_node, embedder_node_B);
+      break;
+    }
+  }
+}
+
+TEST(EmbedderGraphMultipleCallbacks) {
+  i::FLAG_heap_profiler_use_embedder_graph = true;
+  LocalContext env;
+  v8::HandleScope scope(env->GetIsolate());
+  i::Isolate* isolate = reinterpret_cast<i::Isolate*>(env->GetIsolate());
+  v8::Local<v8::Value> global_object =
+      v8::Utils::ToLocal(i::Handle<i::JSObject>(
+          (isolate->context()->native_context()->global_object()), isolate));
+  global_object_pointer = &global_object;
+  v8::HeapProfiler* heap_profiler = env->GetIsolate()->GetHeapProfiler();
+  GraphBuildingContext context;
+
+  heap_profiler->AddBuildEmbedderGraphCallback(BuildEmbedderGraphWithContext,
+                                               &context);
+  heap_profiler->AddBuildEmbedderGraphCallback(BuildEmbedderGraphWithContext,
+                                               &context);
+  const v8::HeapSnapshot* snapshot = heap_profiler->TakeHeapSnapshot();
+  CHECK_EQ(context.counter, 2);
+  CHECK(ValidateSnapshot(snapshot));
+  CheckEmbedderGraphSnapshotWithContext(env->GetIsolate(), snapshot, &context);
+
+  heap_profiler->RemoveBuildEmbedderGraphCallback(BuildEmbedderGraphWithContext,
+                                                  &context);
+  context.counter = 0;
+
+  snapshot = heap_profiler->TakeHeapSnapshot();
+  CHECK_EQ(context.counter, 1);
+  CHECK(ValidateSnapshot(snapshot));
+  CheckEmbedderGraphSnapshotWithContext(env->GetIsolate(), snapshot, &context);
+}
+
 TEST(StrongHandleAnnotation) {
   LocalContext env;
   v8::HandleScope scope(env->GetIsolate());
@@ -3010,7 +3062,7 @@ TEST(StrongHandleAnnotation) {
 }
 
 void BuildEmbedderGraphWithWrapperNode(v8::Isolate* v8_isolate,
-                                       v8::EmbedderGraph* graph) {
+                                       v8::EmbedderGraph* graph, void* data) {
   using Node = v8::EmbedderGraph::Node;
   Node* global_node = graph->V8Node(*global_object_pointer);
   Node* wrapper_node = graph->AddNode(
@@ -3038,11 +3090,11 @@ TEST(EmbedderGraphWithWrapperNode) {
   i::Isolate* isolate = reinterpret_cast<i::Isolate*>(env->GetIsolate());
   v8::Local<v8::Value> global_object =
       v8::Utils::ToLocal(i::Handle<i::JSObject>(
-          (isolate->context()->native_context()->global_object())));
+          (isolate->context()->native_context()->global_object()), isolate));
   global_object_pointer = &global_object;
   v8::HeapProfiler* heap_profiler = env->GetIsolate()->GetHeapProfiler();
-  heap_profiler->SetBuildEmbedderGraphCallback(
-      BuildEmbedderGraphWithWrapperNode);
+  heap_profiler->AddBuildEmbedderGraphCallback(
+      BuildEmbedderGraphWithWrapperNode, nullptr);
   const v8::HeapSnapshot* snapshot = heap_profiler->TakeHeapSnapshot();
   CHECK(ValidateSnapshot(snapshot));
   const v8::HeapGraphNode* global = GetGlobalObject(snapshot);
@@ -3080,7 +3132,7 @@ class EmbedderNodeWithPrefix : public v8::EmbedderGraph::Node {
 };
 
 void BuildEmbedderGraphWithPrefix(v8::Isolate* v8_isolate,
-                                  v8::EmbedderGraph* graph) {
+                                  v8::EmbedderGraph* graph, void* data) {
   using Node = v8::EmbedderGraph::Node;
   Node* global_node = graph->V8Node(*global_object_pointer);
   Node* node = graph->AddNode(
@@ -3095,10 +3147,11 @@ TEST(EmbedderGraphWithPrefix) {
   i::Isolate* isolate = reinterpret_cast<i::Isolate*>(env->GetIsolate());
   v8::Local<v8::Value> global_object =
       v8::Utils::ToLocal(i::Handle<i::JSObject>(
-          (isolate->context()->native_context()->global_object())));
+          (isolate->context()->native_context()->global_object()), isolate));
   global_object_pointer = &global_object;
   v8::HeapProfiler* heap_profiler = env->GetIsolate()->GetHeapProfiler();
-  heap_profiler->SetBuildEmbedderGraphCallback(BuildEmbedderGraphWithPrefix);
+  heap_profiler->AddBuildEmbedderGraphCallback(BuildEmbedderGraphWithPrefix,
+                                               nullptr);
   const v8::HeapSnapshot* snapshot = heap_profiler->TakeHeapSnapshot();
   CHECK(ValidateSnapshot(snapshot));
   const v8::HeapGraphNode* global = GetGlobalObject(snapshot);
@@ -3106,9 +3159,7 @@ TEST(EmbedderGraphWithPrefix) {
   CHECK(node);
 }
 
-static inline i::Address ToAddress(int n) {
-  return reinterpret_cast<i::Address>(n);
-}
+static inline i::Address ToAddress(int n) { return static_cast<i::Address>(n); }
 
 TEST(AddressToTraceMap) {
   i::AddressToTraceMap map;
@@ -3192,6 +3243,14 @@ static void CheckNoZeroCountNodes(v8::AllocationProfile::Node* node) {
   }
 }
 
+static int NumberOfAllocations(const v8::AllocationProfile::Node* node) {
+  int count = 0;
+  for (auto allocation : node->allocations) {
+    count += allocation.count;
+  }
+  return count;
+}
+
 static const char* simple_sampling_heap_profiler_script =
     "var A = [];\n"
     "function bar(size) { return new Array(size); }\n"
@@ -3233,12 +3292,6 @@ TEST(SamplingHeapProfiler) {
                                               ArrayVector(names));
     CHECK(node_bar);
 
-    // Count the number of allocations we sampled from bar.
-    int count_1024 = 0;
-    for (auto allocation : node_bar->allocations) {
-      count_1024 += allocation.count;
-    }
-
     heap_profiler->StopSamplingHeapProfiler();
   }
 
@@ -3315,15 +3368,17 @@ TEST(SamplingHeapProfilerRateAgnosticEstimates) {
         heap_profiler->GetAllocationProfile());
     CHECK(profile);
 
-    const char* names[] = {"", "foo", "bar"};
+    const char* path_to_foo[] = {"", "foo"};
+    auto node_foo = FindAllocationProfileNode(env->GetIsolate(), *profile,
+                                              ArrayVector(path_to_foo));
+    CHECK(node_foo);
+    const char* path_to_bar[] = {"", "foo", "bar"};
     auto node_bar = FindAllocationProfileNode(env->GetIsolate(), *profile,
-                                              ArrayVector(names));
+                                              ArrayVector(path_to_bar));
     CHECK(node_bar);
 
-    // Count the number of allocations we sampled from bar.
-    for (auto allocation : node_bar->allocations) {
-      count_1024 += allocation.count;
-    }
+    // Function bar can be inlined in foo.
+    count_1024 = NumberOfAllocations(node_foo) + NumberOfAllocations(node_bar);
 
     heap_profiler->StopSamplingHeapProfiler();
   }
@@ -3337,16 +3392,18 @@ TEST(SamplingHeapProfilerRateAgnosticEstimates) {
         heap_profiler->GetAllocationProfile());
     CHECK(profile);
 
-    const char* names[] = {"", "foo", "bar"};
+    const char* path_to_foo[] = {"", "foo"};
+    auto node_foo = FindAllocationProfileNode(env->GetIsolate(), *profile,
+                                              ArrayVector(path_to_foo));
+    CHECK(node_foo);
+    const char* path_to_bar[] = {"", "foo", "bar"};
     auto node_bar = FindAllocationProfileNode(env->GetIsolate(), *profile,
-                                              ArrayVector(names));
+                                              ArrayVector(path_to_bar));
     CHECK(node_bar);
 
-    // Count the number of allocations we sampled from bar.
-    int count_128 = 0;
-    for (auto allocation : node_bar->allocations) {
-      count_128 += allocation.count;
-    }
+    // Function bar can be inlined in foo.
+    int count_128 =
+        NumberOfAllocations(node_foo) + NumberOfAllocations(node_bar);
 
     // We should have similar unsampled counts of allocations. Though
     // we will sample different numbers of objects at different rates,
@@ -3357,7 +3414,7 @@ TEST(SamplingHeapProfilerRateAgnosticEstimates) {
     double max_count = std::max(count_128, count_1024);
     double min_count = std::min(count_128, count_1024);
     double percent_difference = (max_count - min_count) / min_count;
-    CHECK_LT(percent_difference, 0.15);
+    CHECK_LT(percent_difference, 0.1);
 
     heap_profiler->StopSamplingHeapProfiler();
   }
@@ -3586,11 +3643,12 @@ TEST(WeakReference) {
 
   i::Handle<i::Object> obj = v8::Utils::OpenHandle(*script);
   i::Handle<i::SharedFunctionInfo> shared_function =
-      i::Handle<i::SharedFunctionInfo>(i::JSFunction::cast(*obj)->shared());
+      i::Handle<i::SharedFunctionInfo>(i::JSFunction::cast(*obj)->shared(),
+                                       i_isolate);
   i::Handle<i::FeedbackVector> fv = factory->NewFeedbackVector(shared_function);
 
   // Create a Code.
-  i::Assembler assm(i_isolate, nullptr, 0);
+  i::Assembler assm(i::AssemblerOptions{}, nullptr, 0);
   assm.nop();  // supported on all architectures
   i::CodeDesc desc;
   assm.GetCode(i_isolate, &desc);
diff --git a/deps/v8/test/cctest/test-identity-map.cc b/deps/v8/test/cctest/test-identity-map.cc
index 473f1e9517af08..8d388e50338680 100644
--- a/deps/v8/test/cctest/test-identity-map.cc
+++ b/deps/v8/test/cctest/test-identity-map.cc
@@ -98,7 +98,8 @@ class IdentityMapTester : public HandleAndZoneScope {
     }
 
     // Delete {key1}
-    void* deleted_entry_1 = map.Delete(key1);
+    void* deleted_entry_1;
+    CHECK(map.Delete(key1, &deleted_entry_1));
     CHECK_NOT_NULL(deleted_entry_1);
     deleted_entry_1 = val1;
 
@@ -114,7 +115,8 @@ class IdentityMapTester : public HandleAndZoneScope {
     }
 
     // Delete {key2}
-    void* deleted_entry_2 = map.Delete(key2);
+    void* deleted_entry_2;
+    CHECK(map.Delete(key2, &deleted_entry_2));
     CHECK_NOT_NULL(deleted_entry_2);
     deleted_entry_2 = val2;
 
@@ -160,7 +162,8 @@ class IdentityMapTester : public HandleAndZoneScope {
   }
 
   void CheckDelete(Handle<Object> key, void* value) {
-    void* entry = map.Delete(key);
+    void* entry;
+    CHECK(map.Delete(key, &entry));
     CHECK_NOT_NULL(entry);
     CHECK_EQ(value, entry);
   }
@@ -197,14 +200,18 @@ TEST(Find_num_not_found) {
 TEST(Delete_smi_not_found) {
   IdentityMapTester t;
   for (int i = 0; i < 100; i++) {
-    CHECK_NULL(t.map.Delete(t.smi(i)));
+    void* deleted_value = &t;
+    CHECK(!t.map.Delete(t.smi(i), &deleted_value));
+    CHECK_EQ(&t, deleted_value);
   }
 }
 
 TEST(Delete_num_not_found) {
   IdentityMapTester t;
   for (int i = 0; i < 100; i++) {
-    CHECK_NULL(t.map.Delete(t.num(i + 0.2)));
+    void* deleted_value = &t;
+    CHECK(!t.map.Delete(t.num(i + 0.2), &deleted_value));
+    CHECK_EQ(&t, deleted_value);
   }
 }
 
@@ -311,7 +318,8 @@ TEST(Delete_num_1000) {
 
   // Delete every second value in reverse.
   for (int i = 999; i >= 0; i -= 2) {
-    void* entry = t.map.Delete(t.smi(i * kPrime));
+    void* entry;
+    CHECK(t.map.Delete(t.smi(i * kPrime), &entry));
     CHECK_EQ(reinterpret_cast<void*>(i * kPrime), entry);
   }
 
@@ -327,7 +335,8 @@ TEST(Delete_num_1000) {
 
   // Delete the rest.
   for (int i = 0; i < 1000; i += 2) {
-    void* entry = t.map.Delete(t.smi(i * kPrime));
+    void* entry;
+    CHECK(t.map.Delete(t.smi(i * kPrime), &entry));
     CHECK_EQ(reinterpret_cast<void*>(i * kPrime), entry);
   }
 
@@ -706,9 +715,10 @@ TEST(CanonicalHandleScope) {
   CHECK_EQ(next_handle, isolate->handle_scope_data()->next);
 
   // Deduplicate root list items.
-  Handle<String> empty_string(heap->empty_string());
-  Handle<Map> free_space_map(heap->free_space_map());
-  Handle<Symbol> uninitialized_symbol(heap->uninitialized_symbol());
+  Handle<String> empty_string(ReadOnlyRoots(heap).empty_string(), isolate);
+  Handle<Map> free_space_map(ReadOnlyRoots(heap).free_space_map(), isolate);
+  Handle<Symbol> uninitialized_symbol(
+      ReadOnlyRoots(heap).uninitialized_symbol(), isolate);
   CHECK_EQ(isolate->factory()->empty_string().location(),
            empty_string.location());
   CHECK_EQ(isolate->factory()->free_space_map().location(),
@@ -723,13 +733,13 @@ TEST(CanonicalHandleScope) {
   Handle<String> string1 =
       isolate->factory()->NewStringFromAsciiChecked("test");
   next_handle = isolate->handle_scope_data()->next;
-  Handle<HeapNumber> number2(*number1);
-  Handle<String> string2(*string1);
+  Handle<HeapNumber> number2(*number1, isolate);
+  Handle<String> string2(*string1, isolate);
   CHECK_EQ(number1.location(), number2.location());
   CHECK_EQ(string1.location(), string2.location());
   CcTest::CollectAllGarbage();
-  Handle<HeapNumber> number3(*number2);
-  Handle<String> string3(*string2);
+  Handle<HeapNumber> number3(*number2, isolate);
+  Handle<String> string3(*string2, isolate);
   CHECK_EQ(number1.location(), number3.location());
   CHECK_EQ(string1.location(), string3.location());
   // Check that no new handles have been allocated.
@@ -738,23 +748,23 @@ TEST(CanonicalHandleScope) {
   // Inner handle scope do not create canonical handles.
   {
     HandleScope inner(isolate);
-    Handle<HeapNumber> number4(*number1);
-    Handle<String> string4(*string1);
+    Handle<HeapNumber> number4(*number1, isolate);
+    Handle<String> string4(*string1, isolate);
     CHECK_NE(number1.location(), number4.location());
     CHECK_NE(string1.location(), string4.location());
 
     // Nested canonical scope does not conflict with outer canonical scope,
     // but does not canonicalize across scopes.
     CanonicalHandleScope inner_canonical(isolate);
-    Handle<HeapNumber> number5(*number4);
-    Handle<String> string5(*string4);
+    Handle<HeapNumber> number5(*number4, isolate);
+    Handle<String> string5(*string4, isolate);
     CHECK_NE(number4.location(), number5.location());
     CHECK_NE(string4.location(), string5.location());
     CHECK_NE(number1.location(), number5.location());
     CHECK_NE(string1.location(), string5.location());
 
-    Handle<HeapNumber> number6(*number1);
-    Handle<String> string6(*string1);
+    Handle<HeapNumber> number6(*number1, isolate);
+    Handle<String> string6(*string1, isolate);
     CHECK_NE(number4.location(), number6.location());
     CHECK_NE(string4.location(), string6.location());
     CHECK_NE(number1.location(), number6.location());
diff --git a/deps/v8/test/cctest/test-inobject-slack-tracking.cc b/deps/v8/test/cctest/test-inobject-slack-tracking.cc
index ec282746d53831..eb7b30fd3a5941 100644
--- a/deps/v8/test/cctest/test-inobject-slack-tracking.cc
+++ b/deps/v8/test/cctest/test-inobject-slack-tracking.cc
@@ -44,7 +44,7 @@ Handle<T> GetLexical(const char* name) {
 
   Handle<String> str_name = factory->InternalizeUtf8String(name);
   Handle<ScriptContextTable> script_contexts(
-      isolate->native_context()->script_context_table());
+      isolate->native_context()->script_context_table(), isolate);
 
   ScriptContextTable::LookupResult lookup_result;
   if (ScriptContextTable::Lookup(script_contexts, str_name, &lookup_result)) {
@@ -86,7 +86,7 @@ static double GetDoubleFieldValue(JSObject* obj, FieldIndex field_index) {
   } else {
     Object* value = obj->RawFastPropertyAt(field_index);
     CHECK(value->IsMutableHeapNumber());
-    return HeapNumber::cast(value)->value();
+    return MutableHeapNumber::cast(value)->value();
   }
 }
 
@@ -137,7 +137,7 @@ TEST(JSObjectBasic) {
   Handle<JSObject> obj = RunI<JSObject>(new_A_script);
 
   CHECK(func->has_initial_map());
-  Handle<Map> initial_map(func->initial_map());
+  Handle<Map> initial_map(func->initial_map(), func->GetIsolate());
 
   // One instance created.
   CHECK_EQ(Map::kSlackTrackingCounterStart - 1,
@@ -198,7 +198,7 @@ TEST(JSObjectComplex) {
   Handle<JSObject> obj5 = CompileRunI<JSObject>("new A(5);");
 
   CHECK(func->has_initial_map());
-  Handle<Map> initial_map(func->initial_map());
+  Handle<Map> initial_map(func->initial_map(), func->GetIsolate());
 
   // Three instances created.
   CHECK_EQ(Map::kSlackTrackingCounterStart - 3,
@@ -283,7 +283,7 @@ TEST(JSGeneratorObjectBasic) {
   Handle<JSObject> obj = RunI<JSObject>(new_A_script);
 
   CHECK(func->has_initial_map());
-  Handle<Map> initial_map(func->initial_map());
+  Handle<Map> initial_map(func->initial_map(), func->GetIsolate());
 
   // One instance created.
   CHECK_EQ(Map::kSlackTrackingCounterStart - 1,
@@ -359,10 +359,10 @@ TEST(SubclassBasicNoBaseClassInstances) {
   Handle<JSObject> obj = RunI<JSObject>(new_B_script);
 
   CHECK(a_func->has_initial_map());
-  Handle<Map> a_initial_map(a_func->initial_map());
+  Handle<Map> a_initial_map(a_func->initial_map(), a_func->GetIsolate());
 
   CHECK(b_func->has_initial_map());
-  Handle<Map> b_initial_map(b_func->initial_map());
+  Handle<Map> b_initial_map(b_func->initial_map(), a_func->GetIsolate());
 
   // Zero instances of A created.
   CHECK_EQ(Map::kSlackTrackingCounterStart,
@@ -454,10 +454,10 @@ TEST(SubclassBasic) {
   Handle<JSObject> b_obj = RunI<JSObject>(new_B_script);
 
   CHECK(a_func->has_initial_map());
-  Handle<Map> a_initial_map(a_func->initial_map());
+  Handle<Map> a_initial_map(a_func->initial_map(), a_func->GetIsolate());
 
   CHECK(b_func->has_initial_map());
-  Handle<Map> b_initial_map(b_func->initial_map());
+  Handle<Map> b_initial_map(b_func->initial_map(), a_func->GetIsolate());
 
   // One instance of a base class created.
   CHECK_EQ(Map::kSlackTrackingCounterStart - 1,
@@ -577,7 +577,7 @@ static void TestClassHierarchy(const std::vector<int>& hierarchy_desc, int n) {
     Handle<JSObject> obj = RunI<JSObject>(new_script);
 
     CHECK(func->has_initial_map());
-    Handle<Map> initial_map(func->initial_map());
+    Handle<Map> initial_map(func->initial_map(), func->GetIsolate());
 
     // If the object is slow-mode already, bail out.
     if (obj->map()->is_dictionary_map()) continue;
@@ -687,7 +687,7 @@ TEST(InobjectPropetiesCountOverflowInSubclass) {
     Handle<JSObject> obj = RunI<JSObject>(new_script);
 
     CHECK(func->has_initial_map());
-    Handle<Map> initial_map(func->initial_map());
+    Handle<Map> initial_map(func->initial_map(), func->GetIsolate());
 
     // There must be no slack left.
     CHECK_EQ(JSObject::kMaxInstanceSize, obj->map()->instance_size());
@@ -871,7 +871,7 @@ TEST(SlowModeSubclass) {
     Handle<JSObject> obj = RunI<JSObject>(new_script);
 
     CHECK(func->has_initial_map());
-    Handle<Map> initial_map(func->initial_map());
+    Handle<Map> initial_map(func->initial_map(), func->GetIsolate());
 
     // Object should go dictionary mode.
     CHECK_EQ(JSObject::kHeaderSize, obj->map()->instance_size());
@@ -937,7 +937,7 @@ static void TestSubclassBuiltin(const char* subclass_name,
   RunI<JSObject>(new_script);
 
   CHECK(func->has_initial_map());
-  Handle<Map> initial_map(func->initial_map());
+  Handle<Map> initial_map(func->initial_map(), func->GetIsolate());
 
   CHECK_EQ(instance_type, initial_map->instance_type());
 
diff --git a/deps/v8/test/cctest/test-inspector.cc b/deps/v8/test/cctest/test-inspector.cc
new file mode 100644
index 00000000000000..8986c3c4888f51
--- /dev/null
+++ b/deps/v8/test/cctest/test-inspector.cc
@@ -0,0 +1,65 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include <memory>
+
+#include "test/cctest/cctest.h"
+
+#include "include/v8-inspector.h"
+#include "include/v8.h"
+#include "src/inspector/protocol/Runtime.h"
+
+using v8_inspector::StringBuffer;
+using v8_inspector::StringView;
+using v8_inspector::V8ContextInfo;
+using v8_inspector::V8Inspector;
+using v8_inspector::V8InspectorSession;
+
+namespace {
+
+class NoopChannel : public V8Inspector::Channel {
+ public:
+  virtual ~NoopChannel() {}
+  void sendResponse(int callId,
+                    std::unique_ptr<StringBuffer> message) override {}
+  void sendNotification(std::unique_ptr<StringBuffer> message) override {}
+  void flushProtocolNotifications() override {}
+};
+
+void WrapOnInterrupt(v8::Isolate* isolate, void* data) {
+  const char* object_group = "";
+  StringView object_group_view(reinterpret_cast<const uint8_t*>(object_group),
+                               strlen(object_group));
+  reinterpret_cast<V8InspectorSession*>(data)->wrapObject(
+      isolate->GetCurrentContext(), v8::Null(isolate), object_group_view,
+      false);
+}
+
+}  // namespace
+
+TEST(WrapInsideWrapOnInterrupt) {
+  LocalContext env;
+  v8::Isolate* isolate = env->GetIsolate();
+  v8::HandleScope handle_scope(isolate);
+
+  v8_inspector::V8InspectorClient default_client;
+  std::unique_ptr<V8Inspector> inspector =
+      V8Inspector::create(isolate, &default_client);
+  const char* name = "";
+  StringView name_view(reinterpret_cast<const uint8_t*>(name), strlen(name));
+  V8ContextInfo context_info(env.local(), 1, name_view);
+  inspector->contextCreated(context_info);
+
+  NoopChannel channel;
+  const char* state = "{}";
+  StringView state_view(reinterpret_cast<const uint8_t*>(state), strlen(state));
+  std::unique_ptr<V8InspectorSession> session =
+      inspector->connect(1, &channel, state_view);
+
+  const char* object_group = "";
+  StringView object_group_view(reinterpret_cast<const uint8_t*>(object_group),
+                               strlen(object_group));
+  isolate->RequestInterrupt(&WrapOnInterrupt, session.get());
+  session->wrapObject(env.local(), v8::Null(isolate), object_group_view, false);
+}
diff --git a/deps/v8/test/cctest/test-intl.cc b/deps/v8/test/cctest/test-intl.cc
index ae67f95accb1f3..b31977ed97e121 100644
--- a/deps/v8/test/cctest/test-intl.cc
+++ b/deps/v8/test/cctest/test-intl.cc
@@ -5,6 +5,9 @@
 #ifdef V8_INTL_SUPPORT
 
 #include "src/builtins/builtins-intl.h"
+#include "src/lookup.h"
+#include "src/objects-inl.h"
+#include "src/objects/intl-objects.h"
 #include "test/cctest/cctest.h"
 
 namespace v8 {
@@ -15,17 +18,6 @@ namespace internal {
 bool operator==(const NumberFormatSpan& lhs, const NumberFormatSpan& rhs) {
   return memcmp(&lhs, &rhs, sizeof(lhs)) == 0;
 }
-template <typename _CharT, typename _Traits, typename T>
-std::basic_ostream<_CharT, _Traits>& operator<<(
-    std::basic_ostream<_CharT, _Traits>& self, const std::vector<T>& v) {
-  self << "[";
-  for (auto it = v.begin(); it < v.end();) {
-    self << *it;
-    it++;
-    if (it < v.end()) self << ", ";
-  }
-  return self << "]";
-}
 template <typename _CharT, typename _Traits>
 std::basic_ostream<_CharT, _Traits>& operator<<(
     std::basic_ostream<_CharT, _Traits>& self, const NumberFormatSpan& part) {
@@ -113,6 +105,189 @@ TEST(FlattenRegionsToParts) {
       });
 }
 
+TEST(GetStringOption) {
+  LocalContext env;
+  Isolate* isolate = CcTest::i_isolate();
+  v8::Isolate* v8_isolate = env->GetIsolate();
+  v8::HandleScope handle_scope(v8_isolate);
+
+  Handle<JSObject> options = isolate->factory()->NewJSObjectWithNullProto();
+  {
+    // No value found
+    std::unique_ptr<char[]> result = nullptr;
+    Maybe<bool> found =
+        Intl::GetStringOption(isolate, options, "foo",
+                              std::vector<const char*>{}, "service", &result);
+    CHECK(!found.FromJust());
+    CHECK_NULL(result);
+  }
+
+  Handle<String> key = isolate->factory()->NewStringFromAsciiChecked("foo");
+  v8::internal::LookupIterator it(options, key);
+  CHECK(Object::SetProperty(&it, Handle<Smi>(Smi::FromInt(42), isolate),
+                            LanguageMode::kStrict,
+                            AllocationMemento::MAY_BE_STORE_FROM_KEYED)
+            .FromJust());
+
+  {
+    // Value found
+    std::unique_ptr<char[]> result = nullptr;
+    Maybe<bool> found =
+        Intl::GetStringOption(isolate, options, "foo",
+                              std::vector<const char*>{}, "service", &result);
+    CHECK(found.FromJust());
+    CHECK_NOT_NULL(result);
+    CHECK_EQ(0, strcmp("42", result.get()));
+  }
+
+  {
+    // No expected value in values array
+    std::unique_ptr<char[]> result = nullptr;
+    Maybe<bool> found = Intl::GetStringOption(isolate, options, "foo",
+                                              std::vector<const char*>{"bar"},
+                                              "service", &result);
+    CHECK(isolate->has_pending_exception());
+    CHECK(found.IsNothing());
+    CHECK_NULL(result);
+    isolate->clear_pending_exception();
+  }
+
+  {
+    // Expected value in values array
+    std::unique_ptr<char[]> result = nullptr;
+    Maybe<bool> found = Intl::GetStringOption(isolate, options, "foo",
+                                              std::vector<const char*>{"42"},
+                                              "service", &result);
+    CHECK(found.FromJust());
+    CHECK_NOT_NULL(result);
+    CHECK_EQ(0, strcmp("42", result.get()));
+  }
+}
+
+TEST(GetBoolOption) {
+  LocalContext env;
+  Isolate* isolate = CcTest::i_isolate();
+  v8::Isolate* v8_isolate = env->GetIsolate();
+  v8::HandleScope handle_scope(v8_isolate);
+
+  Handle<JSObject> options = isolate->factory()->NewJSObjectWithNullProto();
+  {
+    bool result = false;
+    Maybe<bool> found =
+        Intl::GetBoolOption(isolate, options, "foo", "service", &result);
+    CHECK(!found.FromJust());
+    CHECK(!result);
+  }
+
+  Handle<String> key = isolate->factory()->NewStringFromAsciiChecked("foo");
+  {
+    v8::internal::LookupIterator it(options, key);
+    Handle<Object> false_value =
+        handle(i::ReadOnlyRoots(isolate).false_value(), isolate);
+    Object::SetProperty(options, key, false_value, LanguageMode::kStrict)
+        .Assert();
+    bool result = false;
+    Maybe<bool> found =
+        Intl::GetBoolOption(isolate, options, "foo", "service", &result);
+    CHECK(found.FromJust());
+    CHECK(!result);
+  }
+
+  {
+    v8::internal::LookupIterator it(options, key);
+    Handle<Object> true_value =
+        handle(i::ReadOnlyRoots(isolate).true_value(), isolate);
+    Object::SetProperty(options, key, true_value, LanguageMode::kStrict)
+        .Assert();
+    bool result = false;
+    Maybe<bool> found =
+        Intl::GetBoolOption(isolate, options, "foo", "service", &result);
+    CHECK(found.FromJust());
+    CHECK(result);
+  }
+}
+
+bool ScriptTagWasRemoved(std::string locale, std::string expected) {
+  std::string without_script_tag;
+  bool didShorten = Intl::RemoveLocaleScriptTag(locale, &without_script_tag);
+  return didShorten && expected == without_script_tag;
+}
+
+bool ScriptTagWasNotRemoved(std::string locale) {
+  std::string without_script_tag;
+  bool didShorten = Intl::RemoveLocaleScriptTag(locale, &without_script_tag);
+  return !didShorten && without_script_tag.empty();
+}
+
+TEST(RemoveLocaleScriptTag) {
+  CHECK(ScriptTagWasRemoved("aa_Bbbb_CC", "aa_CC"));
+  CHECK(ScriptTagWasRemoved("aaa_Bbbb_CC", "aaa_CC"));
+
+  CHECK(ScriptTagWasNotRemoved("aa"));
+  CHECK(ScriptTagWasNotRemoved("aaa"));
+  CHECK(ScriptTagWasNotRemoved("aa_CC"));
+  CHECK(ScriptTagWasNotRemoved("aa_Bbb_CC"));
+  CHECK(ScriptTagWasNotRemoved("aa_1bbb_CC"));
+}
+
+TEST(GetAvailableLocales) {
+  std::set<std::string> locales;
+
+  locales = Intl::GetAvailableLocales(IcuService::kBreakIterator);
+  CHECK(locales.count("en-US"));
+  CHECK(!locales.count("abcdefg"));
+
+  locales = Intl::GetAvailableLocales(IcuService::kCollator);
+  CHECK(locales.count("en-US"));
+
+  locales = Intl::GetAvailableLocales(IcuService::kDateFormat);
+  CHECK(locales.count("en-US"));
+
+  locales = Intl::GetAvailableLocales(IcuService::kNumberFormat);
+  CHECK(locales.count("en-US"));
+
+  locales = Intl::GetAvailableLocales(IcuService::kPluralRules);
+  CHECK(locales.count("en-US"));
+}
+
+TEST(IsObjectOfType) {
+  LocalContext env;
+  Isolate* isolate = CcTest::i_isolate();
+  v8::Isolate* v8_isolate = env->GetIsolate();
+  v8::HandleScope handle_scope(v8_isolate);
+
+  Handle<JSObject> obj = isolate->factory()->NewJSObjectWithNullProto();
+  Handle<Symbol> marker = isolate->factory()->intl_initialized_marker_symbol();
+
+  STATIC_ASSERT(Intl::Type::kNumberFormat == 0);
+  Intl::Type types[] = {Intl::Type::kNumberFormat,   Intl::Type::kCollator,
+                        Intl::Type::kDateTimeFormat, Intl::Type::kPluralRules,
+                        Intl::Type::kBreakIterator,  Intl::Type::kLocale};
+
+  for (auto type : types) {
+    Handle<Smi> tag =
+        Handle<Smi>(Smi::FromInt(static_cast<int>(type)), isolate);
+    JSObject::SetProperty(obj, marker, tag, LanguageMode::kStrict).Assert();
+
+    CHECK(Intl::IsObjectOfType(isolate, obj, type));
+  }
+
+  Handle<Object> tag = isolate->factory()->NewStringFromAsciiChecked("foo");
+  JSObject::SetProperty(obj, marker, tag, LanguageMode::kStrict).Assert();
+  CHECK(!Intl::IsObjectOfType(isolate, obj, types[0]));
+
+  CHECK(!Intl::IsObjectOfType(isolate, tag, types[0]));
+  CHECK(!Intl::IsObjectOfType(isolate, Handle<Smi>(Smi::FromInt(0), isolate),
+                              types[0]));
+
+  // Proxy with target as an initialized object should fail.
+  tag = Handle<Smi>(Smi::FromInt(static_cast<int>(types[0])), isolate);
+  JSObject::SetProperty(obj, marker, tag, LanguageMode::kStrict).Assert();
+  Handle<JSReceiver> proxy = isolate->factory()->NewJSProxy(
+      obj, isolate->factory()->NewJSObjectWithNullProto());
+  CHECK(!Intl::IsObjectOfType(isolate, proxy, types[0]));
+}
+
 }  // namespace internal
 }  // namespace v8
 
diff --git a/deps/v8/test/cctest/test-isolate-independent-builtins.cc b/deps/v8/test/cctest/test-isolate-independent-builtins.cc
index 95bd34cea0ad04..c878484976888b 100644
--- a/deps/v8/test/cctest/test-isolate-independent-builtins.cc
+++ b/deps/v8/test/cctest/test-isolate-independent-builtins.cc
@@ -20,94 +20,6 @@ namespace v8 {
 namespace internal {
 namespace test_isolate_independent_builtins {
 
-#ifdef V8_EMBEDDED_BUILTINS
-UNINITIALIZED_TEST(VerifyBuiltinsIsolateIndependence) {
-  v8::Isolate::CreateParams create_params;
-  create_params.array_buffer_allocator = CcTest::array_buffer_allocator();
-  v8::Isolate* v8_isolate = v8::Isolate::New(create_params);
-
-  {
-    v8::Isolate::Scope isolate_scope(v8_isolate);
-    v8::internal::Isolate* isolate =
-        reinterpret_cast<v8::internal::Isolate*>(v8_isolate);
-    HandleScope handle_scope(isolate);
-
-    Snapshot::EnsureAllBuiltinsAreDeserialized(isolate);
-
-    // TODO(jgruber,v8:6666): Investigate CONST_POOL and VENEER_POOL kinds.
-    // CONST_POOL is currently relevant on {arm,arm64,mips,mips64,ppc,s390}.
-    //            Rumors are it will also become relevant on x64. My
-    //            understanding is that we should be fine if we ensure it
-    //            doesn't contain heap constants and we use pc-relative
-    //            addressing.
-    // VENEER_POOL is arm64-only. From what I've seen, jumps are pc-relative
-    //             and stay within the same code object and thus should be
-    //             isolate-independent.
-
-    // Build a white-list of all isolate-independent RelocInfo entry kinds.
-    constexpr int all_real_modes_mask =
-        (1 << (RelocInfo::LAST_REAL_RELOC_MODE + 1)) - 1;
-    constexpr int mode_mask =
-        all_real_modes_mask & ~RelocInfo::ModeMask(RelocInfo::COMMENT) &
-        ~RelocInfo::ModeMask(RelocInfo::INTERNAL_REFERENCE) &
-        ~RelocInfo::ModeMask(RelocInfo::INTERNAL_REFERENCE_ENCODED) &
-        ~RelocInfo::ModeMask(RelocInfo::OFF_HEAP_TARGET) &
-        ~RelocInfo::ModeMask(RelocInfo::CONST_POOL) &
-        ~RelocInfo::ModeMask(RelocInfo::VENEER_POOL);
-    STATIC_ASSERT(RelocInfo::LAST_REAL_RELOC_MODE == RelocInfo::VENEER_POOL);
-    STATIC_ASSERT(RelocInfo::ModeMask(RelocInfo::COMMENT) ==
-                  (1 << RelocInfo::COMMENT));
-    STATIC_ASSERT(
-        mode_mask ==
-        (RelocInfo::ModeMask(RelocInfo::CODE_TARGET) |
-         RelocInfo::ModeMask(RelocInfo::EMBEDDED_OBJECT) |
-         RelocInfo::ModeMask(RelocInfo::WASM_GLOBAL_HANDLE) |
-         RelocInfo::ModeMask(RelocInfo::WASM_CALL) |
-         RelocInfo::ModeMask(RelocInfo::JS_TO_WASM_CALL) |
-         RelocInfo::ModeMask(RelocInfo::RUNTIME_ENTRY) |
-         RelocInfo::ModeMask(RelocInfo::EXTERNAL_REFERENCE)));
-
-    constexpr bool kVerbose = false;
-    bool found_mismatch = false;
-    for (int i = 0; i < Builtins::builtin_count; i++) {
-      Code* code = isolate->builtins()->builtin(i);
-
-      if (kVerbose) {
-        printf("%s %s\n", Builtins::KindNameOf(i),
-               isolate->builtins()->name(i));
-      }
-
-      bool is_isolate_independent = true;
-      for (RelocIterator it(code, mode_mask); !it.done(); it.next()) {
-        is_isolate_independent = false;
-
-#ifdef ENABLE_DISASSEMBLER
-        if (kVerbose) {
-          RelocInfo::Mode mode = it.rinfo()->rmode();
-          printf("  %s\n", RelocInfo::RelocModeName(mode));
-        }
-#endif
-      }
-
-      // Relaxed condition only checks whether the isolate-independent list is
-      // valid, not whether it is complete. This is to avoid constant work
-      // updating the list.
-      bool should_be_isolate_independent = Builtins::IsIsolateIndependent(i);
-      if (should_be_isolate_independent && !is_isolate_independent) {
-        found_mismatch = true;
-        printf("%s %s expected: %d, is: %d\n", Builtins::KindNameOf(i),
-               isolate->builtins()->name(i), should_be_isolate_independent,
-               is_isolate_independent);
-      }
-    }
-
-    CHECK(!found_mismatch);
-  }
-
-  v8_isolate->Dispose();
-}
-#endif  // V8_EMBEDDED_BUILTINS
-
 // V8_CC_MSVC is true for both MSVC and clang on windows. clang can handle
 // __asm__-style inline assembly but MSVC cannot, and thus we need a more
 // precise compiler detection that can distinguish between the two. clang on
@@ -277,7 +189,7 @@ TEST(ByteInText) {
   CcTest::InitializeVM();
   Isolate* isolate = CcTest::i_isolate();
   auto f = GeneratedCode<int(int, int)>::FromAddress(
-      isolate, const_cast<char*>(test_function0_bytes));
+      isolate, reinterpret_cast<Address>(&test_function0_bytes[0]));
   CHECK_EQ(7, f.Call(3, 4));
   CHECK_EQ(11, f.Call(5, 6));
 }
diff --git a/deps/v8/test/cctest/test-liveedit.cc b/deps/v8/test/cctest/test-liveedit.cc
index 809ef81b0ac6ee..05044a4aa5f6e5 100644
--- a/deps/v8/test/cctest/test-liveedit.cc
+++ b/deps/v8/test/cctest/test-liveedit.cc
@@ -29,83 +29,22 @@
 
 #include "src/v8.h"
 
+#include "src/api.h"
 #include "src/debug/liveedit.h"
 #include "src/objects-inl.h"
 #include "test/cctest/cctest.h"
 
 namespace v8 {
 namespace internal {
-
-// Anonymous namespace.
 namespace {
-
-class StringCompareInput : public Comparator::Input {
- public:
-  StringCompareInput(const char* s1, const char* s2) : s1_(s1), s2_(s2) {
-  }
-  int GetLength1() {
-    return StrLength(s1_);
-  }
-  int GetLength2() {
-    return StrLength(s2_);
-  }
-  bool Equals(int index1, int index2) {
-    return s1_[index1] == s2_[index2];
-  }
-
- private:
-  const char* s1_;
-  const char* s2_;
-};
-
-
-class DiffChunkStruct : public ZoneObject {
- public:
-  DiffChunkStruct(int pos1_param, int pos2_param, int len1_param,
-                  int len2_param)
-      : pos1(pos1_param),
-        pos2(pos2_param),
-        len1(len1_param),
-        len2(len2_param),
-        next(nullptr) {}
-  int pos1;
-  int pos2;
-  int len1;
-  int len2;
-  DiffChunkStruct* next;
-};
-
-
-class ListDiffOutputWriter : public Comparator::Output {
- public:
-  explicit ListDiffOutputWriter(DiffChunkStruct** next_chunk_pointer,
-                                Zone* zone)
-      : next_chunk_pointer_(next_chunk_pointer), zone_(zone) {
-    (*next_chunk_pointer_) = nullptr;
-  }
-  void AddChunk(int pos1, int pos2, int len1, int len2) {
-    current_chunk_ = new(zone_) DiffChunkStruct(pos1, pos2, len1, len2);
-    (*next_chunk_pointer_) = current_chunk_;
-    next_chunk_pointer_ = &current_chunk_->next;
-  }
- private:
-  DiffChunkStruct** next_chunk_pointer_;
-  DiffChunkStruct* current_chunk_;
-  Zone* zone_;
-};
-
-
 void CompareStringsOneWay(const char* s1, const char* s2,
-                          int expected_diff_parameter = -1) {
-  StringCompareInput input(s1, s2);
-
-  v8::internal::AccountingAllocator allocator;
-  Zone zone(&allocator, ZONE_NAME);
-
-  DiffChunkStruct* first_chunk;
-  ListDiffOutputWriter writer(&first_chunk, &zone);
-
-  Comparator::CalculateDifference(&input, &writer);
+                          int expected_diff_parameter,
+                          std::vector<SourceChangeRange>* changes) {
+  i::Isolate* isolate = CcTest::i_isolate();
+  i::Handle<i::String> i_s1 = isolate->factory()->NewStringFromAsciiChecked(s1);
+  i::Handle<i::String> i_s2 = isolate->factory()->NewStringFromAsciiChecked(s2);
+  changes->clear();
+  LiveEdit::CompareStrings(isolate, i_s1, i_s2, changes);
 
   int len1 = StrLength(s1);
   int len2 = StrLength(s2);
@@ -114,23 +53,23 @@ void CompareStringsOneWay(const char* s1, const char* s2,
   int pos2 = 0;
 
   int diff_parameter = 0;
-
-  for (DiffChunkStruct* chunk = first_chunk; chunk != nullptr;
-       chunk = chunk->next) {
-    int diff_pos1 = chunk->pos1;
+  for (const auto& diff : *changes) {
+    int diff_pos1 = diff.start_position;
     int similar_part_length = diff_pos1 - pos1;
     int diff_pos2 = pos2 + similar_part_length;
 
-    CHECK_EQ(diff_pos2, chunk->pos2);
+    CHECK_EQ(diff_pos2, diff.new_start_position);
 
     for (int j = 0; j < similar_part_length; j++) {
       CHECK(pos1 + j < len1);
       CHECK(pos2 + j < len2);
       CHECK_EQ(s1[pos1 + j], s2[pos2 + j]);
     }
-    diff_parameter += chunk->len1 + chunk->len2;
-    pos1 = diff_pos1 + chunk->len1;
-    pos2 = diff_pos2 + chunk->len2;
+    int diff_len1 = diff.end_position - diff.start_position;
+    int diff_len2 = diff.new_end_position - diff.new_start_position;
+    diff_parameter += diff_len1 + diff_len2;
+    pos1 = diff_pos1 + diff_len1;
+    pos2 = diff_pos2 + diff_len2;
   }
   {
     // After last chunk.
@@ -149,6 +88,16 @@ void CompareStringsOneWay(const char* s1, const char* s2,
   }
 }
 
+void CompareStringsOneWay(const char* s1, const char* s2,
+                          int expected_diff_parameter = -1) {
+  std::vector<SourceChangeRange> changes;
+  CompareStringsOneWay(s1, s2, expected_diff_parameter, &changes);
+}
+
+void CompareStringsOneWay(const char* s1, const char* s2,
+                          std::vector<SourceChangeRange>* changes) {
+  CompareStringsOneWay(s1, s2, -1, changes);
+}
 
 void CompareStrings(const char* s1, const char* s2,
                     int expected_diff_parameter = -1) {
@@ -156,12 +105,25 @@ void CompareStrings(const char* s1, const char* s2,
   CompareStringsOneWay(s2, s1, expected_diff_parameter);
 }
 
-}  // Anonymous namespace.
-
+void CompareOneWayPlayWithLF(const char* s1, const char* s2) {
+  std::string s1_one_line(s1);
+  std::replace(s1_one_line.begin(), s1_one_line.end(), '\n', ' ');
+  std::string s2_one_line(s2);
+  std::replace(s2_one_line.begin(), s2_one_line.end(), '\n', ' ');
+  CompareStringsOneWay(s1, s2, -1);
+  CompareStringsOneWay(s1_one_line.c_str(), s2, -1);
+  CompareStringsOneWay(s1, s2_one_line.c_str(), -1);
+  CompareStringsOneWay(s1_one_line.c_str(), s2_one_line.c_str(), -1);
+}
 
-// --- T h e   A c t u a l   T e s t s
+void CompareStringsPlayWithLF(const char* s1, const char* s2) {
+  CompareOneWayPlayWithLF(s1, s2);
+  CompareOneWayPlayWithLF(s2, s1);
+}
+}  // anonymous namespace
 
 TEST(LiveEditDiffer) {
+  v8::HandleScope handle_scope(CcTest::isolate());
   CompareStrings("zz1zzz12zz123zzz", "zzzzzzzzzz", 6);
   CompareStrings("zz1zzz12zz123zzz", "zz0zzz0zz0zzz", 9);
   CompareStrings("123456789", "987654321", 16);
@@ -177,7 +139,405 @@ TEST(LiveEditDiffer) {
   CompareStrings("a cat", "a capybara", 7);
   CompareStrings("abbabababababaaabbabababababbabbbbbbbababa",
                  "bbbbabababbbabababbbabababababbabbababa");
+  CompareStringsPlayWithLF("", "");
+  CompareStringsPlayWithLF("a", "b");
+  CompareStringsPlayWithLF(
+      "yesterday\nall\nmy\ntroubles\nseemed\nso\nfar\naway",
+      "yesterday\nall\nmy\ntroubles\nseem\nso\nfar\naway");
+  CompareStringsPlayWithLF(
+      "yesterday\nall\nmy\ntroubles\nseemed\nso\nfar\naway",
+      "\nall\nmy\ntroubles\nseemed\nso\nfar\naway");
+  CompareStringsPlayWithLF(
+      "yesterday\nall\nmy\ntroubles\nseemed\nso\nfar\naway",
+      "all\nmy\ntroubles\nseemed\nso\nfar\naway");
+  CompareStringsPlayWithLF(
+      "yesterday\nall\nmy\ntroubles\nseemed\nso\nfar\naway",
+      "yesterday\nall\nmy\ntroubles\nseemed\nso\nfar\naway\n");
+  CompareStringsPlayWithLF(
+      "yesterday\nall\nmy\ntroubles\nseemed\nso\nfar\naway",
+      "yesterday\nall\nmy\ntroubles\nseemed\nso\n");
+}
+
+TEST(LiveEditTranslatePosition) {
+  v8::HandleScope handle_scope(CcTest::isolate());
+  std::vector<SourceChangeRange> changes;
+  CompareStringsOneWay("a", "a", &changes);
+  CHECK_EQ(LiveEdit::TranslatePosition(changes, 0), 0);
+  CHECK_EQ(LiveEdit::TranslatePosition(changes, 1), 1);
+  CompareStringsOneWay("a", "b", &changes);
+  CHECK_EQ(LiveEdit::TranslatePosition(changes, 0), 0);
+  CHECK_EQ(LiveEdit::TranslatePosition(changes, 1), 1);
+  CompareStringsOneWay("ababa", "aaa", &changes);
+  CHECK_EQ(LiveEdit::TranslatePosition(changes, 0), 0);
+  CHECK_EQ(LiveEdit::TranslatePosition(changes, 1), 1);
+  CHECK_EQ(LiveEdit::TranslatePosition(changes, 2), 1);
+  CHECK_EQ(LiveEdit::TranslatePosition(changes, 3), 2);
+  CHECK_EQ(LiveEdit::TranslatePosition(changes, 4), 2);
+  CHECK_EQ(LiveEdit::TranslatePosition(changes, 5), 3);
+  CompareStringsOneWay("ababa", "acaca", &changes);
+  CHECK_EQ(LiveEdit::TranslatePosition(changes, 0), 0);
+  CHECK_EQ(LiveEdit::TranslatePosition(changes, 1), 1);
+  CHECK_EQ(LiveEdit::TranslatePosition(changes, 2), 2);
+  CHECK_EQ(LiveEdit::TranslatePosition(changes, 3), 3);
+  CHECK_EQ(LiveEdit::TranslatePosition(changes, 4), 4);
+  CHECK_EQ(LiveEdit::TranslatePosition(changes, 5), 5);
+  CompareStringsOneWay("aaa", "ababa", &changes);
+  CHECK_EQ(LiveEdit::TranslatePosition(changes, 0), 0);
+  CHECK_EQ(LiveEdit::TranslatePosition(changes, 1), 2);
+  CHECK_EQ(LiveEdit::TranslatePosition(changes, 2), 4);
+  CHECK_EQ(LiveEdit::TranslatePosition(changes, 3), 5);
+  CompareStringsOneWay("aabbaaaa", "aaaabbaa", &changes);
+  CHECK_EQ(LiveEdit::TranslatePosition(changes, 0), 0);
+  CHECK_EQ(LiveEdit::TranslatePosition(changes, 1), 1);
+  CHECK_EQ(LiveEdit::TranslatePosition(changes, 2), 4);
+  CHECK_EQ(LiveEdit::TranslatePosition(changes, 3), 5);
+  CHECK_EQ(LiveEdit::TranslatePosition(changes, 4), 6);
+  CHECK_EQ(LiveEdit::TranslatePosition(changes, 5), 7);
+  CHECK_EQ(LiveEdit::TranslatePosition(changes, 6), 8);
+  CHECK_EQ(LiveEdit::TranslatePosition(changes, 8), 8);
+}
+
+namespace {
+void PatchFunctions(v8::Local<v8::Context> context, const char* source_a,
+                    const char* source_b,
+                    v8::debug::LiveEditResult* result = nullptr) {
+  v8::Isolate* isolate = context->GetIsolate();
+  i::Isolate* i_isolate = reinterpret_cast<i::Isolate*>(isolate);
+  v8::EscapableHandleScope scope(isolate);
+  v8::Local<v8::Script> script_a =
+      v8::Script::Compile(context, v8_str(isolate, source_a)).ToLocalChecked();
+  script_a->Run(context).ToLocalChecked();
+  i::Handle<i::Script> i_script_a(
+      i::Script::cast(v8::Utils::OpenHandle(*script_a)->shared()->script()),
+      i_isolate);
+
+  if (result) {
+    LiveEdit::PatchScript(
+        i_isolate, i_script_a,
+        i_isolate->factory()->NewStringFromAsciiChecked(source_b), false,
+        result);
+    if (result->status == v8::debug::LiveEditResult::COMPILE_ERROR) {
+      result->message = scope.Escape(result->message);
+    }
+  } else {
+    v8::debug::LiveEditResult result;
+    LiveEdit::PatchScript(
+        i_isolate, i_script_a,
+        i_isolate->factory()->NewStringFromAsciiChecked(source_b), false,
+        &result);
+    CHECK_EQ(result.status, v8::debug::LiveEditResult::OK);
+  }
+}
+}  // anonymous namespace
+
+TEST(LiveEditPatchFunctions) {
+  LocalContext env;
+  v8::HandleScope scope(env->GetIsolate());
+  v8::Local<v8::Context> context = env.local();
+  // Check that function is removed from compilation cache.
+  i::FLAG_allow_natives_syntax = true;
+  PatchFunctions(context, "42;", "%AbortJS('')");
+  PatchFunctions(context, "42;", "239;");
+  i::FLAG_allow_natives_syntax = false;
+
+  // Basic test cases.
+  PatchFunctions(context, "42;", "2;");
+  PatchFunctions(context, "42;", "  42;");
+  PatchFunctions(context, "42;", "42;");
+  // Trivial return value change.
+  PatchFunctions(context, "function foo() { return 1; }",
+                 "function foo() { return 42; }");
+  CHECK_EQ(CompileRunChecked(env->GetIsolate(), "foo()")
+               ->ToInt32(env->GetIsolate())
+               ->Value(),
+           42);
+  // It is expected, we do not reevaluate top level function.
+  PatchFunctions(context, "var a = 1; function foo() { return a; }",
+                 "var a = 3; function foo() { return a; }");
+  CHECK_EQ(CompileRunChecked(env->GetIsolate(), "foo()")
+               ->ToInt32(env->GetIsolate())
+               ->Value(),
+           1);
+  // Throw exception since var b is not defined in original source.
+  PatchFunctions(context, "var a = 1; function foo() { return a; }",
+                 "var b = 4; function foo() { return b; }");
+  {
+    v8::TryCatch try_catch(env->GetIsolate());
+    CompileRun("foo()");
+    CHECK(try_catch.HasCaught());
+  }
+  // But user always can add new variable to function and use it.
+  PatchFunctions(context, "var a = 1; function foo() { return a; }",
+                 "var b = 4; function foo() { var b = 5; return b; }");
+  CHECK_EQ(CompileRunChecked(env->GetIsolate(), "foo()")
+               ->ToInt32(env->GetIsolate())
+               ->Value(),
+           5);
+
+  PatchFunctions(context, "var a = 1; function foo() { return a; }",
+                 "var b = 4; function foo() { var a = 6; return a; }");
+  CHECK_EQ(CompileRunChecked(env->GetIsolate(), "foo()")
+               ->ToInt32(env->GetIsolate())
+               ->Value(),
+           6);
+
+  PatchFunctions(context, "var a = 1; function foo() { return a; }",
+                 "var d = (() => ({a:2}))(); function foo() { return d; }");
+  {
+    v8::TryCatch try_catch(env->GetIsolate());
+    CompileRun("foo()");
+    CHECK(try_catch.HasCaught());
+  }
+
+  PatchFunctions(context, "var a = 1; function foo() { return a; }",
+                 "var b = 1; var a = 2; function foo() { return a; }");
+  CHECK_EQ(CompileRunChecked(env->GetIsolate(), "foo()")
+               ->ToInt32(env->GetIsolate())
+               ->Value(),
+           1);
+
+  PatchFunctions(context, "var a = 1; function foo() { return a; }",
+                 "var b = 1; var a = 2; function foo() { return b; }");
+  {
+    v8::TryCatch try_catch(env->GetIsolate());
+    CompileRun("foo()");
+    CHECK(try_catch.HasCaught());
+  }
+
+  PatchFunctions(context, "function foo() { var a = 1; return a; }",
+                 "function foo() { var b = 1; return b; }");
+  CHECK_EQ(CompileRunChecked(env->GetIsolate(), "foo()")
+               ->ToInt32(env->GetIsolate())
+               ->Value(),
+           1);
+
+  PatchFunctions(context, "var a = 3; function foo() { var a = 1; return a; }",
+                 "function foo() { var b = 1; return a; }");
+  CHECK_EQ(CompileRunChecked(env->GetIsolate(), "foo()")
+               ->ToInt32(env->GetIsolate())
+               ->Value(),
+           3);
+
+  PatchFunctions(context, "var a = 3; var c = 7; function foo() { return a; }",
+                 "var b = 5; var a = 3; function foo() { return b; }");
+  {
+    v8::TryCatch try_catch(env->GetIsolate());
+    CompileRun("foo()");
+    CHECK(try_catch.HasCaught());
+  }
+
+  // Add argument.
+  PatchFunctions(context, "function fooArgs(a1, b1) { return a1 + b1; }",
+                 "function fooArgs(a2, b2, c2) { return a2 + b2 + c2; }");
+  CHECK_EQ(CompileRunChecked(env->GetIsolate(), "fooArgs(1,2,3)")
+               ->ToInt32(env->GetIsolate())
+               ->Value(),
+           6);
+
+  PatchFunctions(context, "function fooArgs(a1, b1) { return a1 + b1; }",
+                 "function fooArgs(a1, b1, c1) { return a1 + b1 + c1; }");
+  CHECK_EQ(CompileRunChecked(env->GetIsolate(), "fooArgs(1,2,3)")
+               ->ToInt32(env->GetIsolate())
+               ->Value(),
+           6);
+
+  i::FLAG_allow_natives_syntax = true;
+  PatchFunctions(context,
+                 "function foo(a, b) { return a + b; }; "
+                 "%OptimizeFunctionOnNextCall(foo); foo(1,2);",
+                 "function foo(a, b) { return a * b; };");
+  CHECK_EQ(CompileRunChecked(env->GetIsolate(), "foo(5,7)")
+               ->ToInt32(env->GetIsolate())
+               ->Value(),
+           35);
+  i::FLAG_allow_natives_syntax = false;
+
+  // Check inner function.
+  PatchFunctions(
+      context,
+      "function foo(a,b) { function op(a,b) { return a + b } return op(a,b); }",
+      "function foo(a,b) { function op(a,b) { return a * b } return op(a,b); "
+      "}");
+  CHECK_EQ(CompileRunChecked(env->GetIsolate(), "foo(8,9)")
+               ->ToInt32(env->GetIsolate())
+               ->Value(),
+           72);
+
+  // Update constructor.
+  PatchFunctions(context,
+                 "class Foo { constructor(a,b) { this.data = a + b; } };",
+                 "class Foo { constructor(a,b) { this.data = a * b; } };");
+  CHECK_EQ(CompileRunChecked(env->GetIsolate(), "new Foo(4,5).data")
+               ->ToInt32(env->GetIsolate())
+               ->Value(),
+           20);
+  // Change inner functions.
+  PatchFunctions(
+      context,
+      "function f(evt) { function f2() {} f2(),f3(); function f3() {} } "
+      "function f4() {}",
+      "function f(evt) { function f2() { return 1; } return f2() + f3(); "
+      "function f3() { return 2; }  } function f4() {}");
+  CHECK_EQ(CompileRunChecked(env->GetIsolate(), "f()")
+               ->ToInt32(env->GetIsolate())
+               ->Value(),
+           3);
+  // Change usage of outer scope.
+  PatchFunctions(context,
+                 "function ChooseAnimal(a, b) {\n "
+                 "  if (a == 7 && b == 7) {\n"
+                 "    return;\n"
+                 "  }\n"
+                 "  return function Chooser() {\n"
+                 "    return 'Cat' + a;\n"
+                 "  };\n"
+                 "}\n"
+                 "var old_closure = ChooseAnimal(2, 3);",
+                 "function ChooseAnimal(a, b) {\n "
+                 "  if (a == 7 && b == 7) {\n"
+                 "    return;\n"
+                 "  }\n"
+                 "  return function Chooser() {\n"
+                 "    return 'Capybara' + b;\n"
+                 "  };\n"
+                 "}\n");
+  CompileRunChecked(env->GetIsolate(), "var new_closure = ChooseAnimal(3, 4);");
+  v8::Local<v8::String> call_result =
+      CompileRunChecked(env->GetIsolate(), "new_closure()").As<v8::String>();
+  v8::String::Utf8Value new_result_utf8(env->GetIsolate(), call_result);
+  CHECK_NOT_NULL(strstr(*new_result_utf8, "Capybara4"));
+  call_result =
+      CompileRunChecked(env->GetIsolate(), "old_closure()").As<v8::String>();
+  v8::String::Utf8Value old_result_utf8(env->GetIsolate(), call_result);
+  CHECK_NOT_NULL(strstr(*old_result_utf8, "Cat2"));
+
+  // Update const literals.
+  PatchFunctions(context, "function foo() { return 'a' + 'b'; }",
+                 "function foo() { return 'c' + 'b'; }");
+  {
+    v8::Local<v8::String> result =
+        CompileRunChecked(env->GetIsolate(), "foo()").As<v8::String>();
+    v8::String::Utf8Value new_result_utf8(env->GetIsolate(), result);
+    CHECK_NOT_NULL(strstr(*new_result_utf8, "cb"));
+  }
+
+  // TODO(kozyatinskiy): should work when we remove (.
+  PatchFunctions(context, "f = () => 2", "f = a => a");
+  CHECK_EQ(CompileRunChecked(env->GetIsolate(), "f(3)")
+               ->ToInt32(env->GetIsolate())
+               ->Value(),
+           2);
+
+  // Replace function with not a function.
+  PatchFunctions(context, "f = () => 2", "f = a == 2");
+  CHECK_EQ(CompileRunChecked(env->GetIsolate(), "f(3)")
+               ->ToInt32(env->GetIsolate())
+               ->Value(),
+           2);
+
+  // TODO(kozyatinskiy): should work when we put function into (...).
+  PatchFunctions(context, "f = a => 2", "f = (a => 5)()");
+  CHECK_EQ(CompileRunChecked(env->GetIsolate(), "f()")
+               ->ToInt32(env->GetIsolate())
+               ->Value(),
+           2);
+
+  PatchFunctions(context,
+                 "f2 = null;\n"
+                 "f = () => {\n"
+                 "  f2 = () => 5;\n"
+                 "  return f2();\n"
+                 "}\n"
+                 "f()\n",
+                 "f2 = null;\n"
+                 "f = () => {\n"
+                 "  for (var a = (() => 7)(), b = 0; a < 10; ++a,++b);\n"
+                 "  return b;\n"
+                 "}\n"
+                 "f()\n");
+  // TODO(kozyatinskiy): ditto.
+  CHECK_EQ(CompileRunChecked(env->GetIsolate(), "f2()")
+               ->ToInt32(env->GetIsolate())
+               ->Value(),
+           5);
+  CHECK_EQ(CompileRunChecked(env->GetIsolate(), "f()")
+               ->ToInt32(env->GetIsolate())
+               ->Value(),
+           3);
 }
 
+TEST(LiveEditCompileError) {
+  LocalContext env;
+  v8::HandleScope scope(env->GetIsolate());
+  v8::Local<v8::Context> context = env.local();
+  debug::LiveEditResult result;
+  PatchFunctions(
+      context,
+      "var something1 = 25; \n"
+      " function ChooseAnimal() { return          'Cat';          } \n"
+      " ChooseAnimal.Helper = function() { return 'Help!'; }\n",
+      "var something1 = 25; \n"
+      " function ChooseAnimal() { return          'Cap' + ) + 'bara';          "
+      "} \n"
+      " ChooseAnimal.Helper = function() { return 'Help!'; }\n",
+      &result);
+  CHECK_EQ(result.status, debug::LiveEditResult::COMPILE_ERROR);
+  CHECK_EQ(result.line_number, 2);
+  CHECK_EQ(result.column_number, 51);
+  v8::String::Utf8Value result_message(env->GetIsolate(), result.message);
+  CHECK_NOT_NULL(
+      strstr(*result_message, "Uncaught SyntaxError: Unexpected token )"));
+
+  {
+    v8::Local<v8::String> result =
+        CompileRunChecked(env->GetIsolate(), "ChooseAnimal()").As<v8::String>();
+    v8::String::Utf8Value new_result_utf8(env->GetIsolate(), result);
+    CHECK_NOT_NULL(strstr(*new_result_utf8, "Cat"));
+  }
+
+  PatchFunctions(context, "function foo() {}",
+                 "function foo() { return a # b; }", &result);
+  CHECK_EQ(result.status, debug::LiveEditResult::COMPILE_ERROR);
+  CHECK_EQ(result.line_number, 1);
+  CHECK_EQ(result.column_number, 26);
+}
+
+TEST(LiveEditFunctionExpression) {
+  const char* original_source =
+      "(function() {\n "
+      "  return 'Cat';\n"
+      "})\n";
+  const char* updated_source =
+      "(function() {\n "
+      "  return 'Capy' + 'bara';\n"
+      "})\n";
+  LocalContext env;
+  v8::HandleScope scope(env->GetIsolate());
+  v8::Local<v8::Context> context = env.local();
+  v8::Isolate* isolate = context->GetIsolate();
+  i::Isolate* i_isolate = reinterpret_cast<i::Isolate*>(isolate);
+  v8::Local<v8::Script> script =
+      v8::Script::Compile(context, v8_str(isolate, original_source))
+          .ToLocalChecked();
+  v8::Local<v8::Function> f =
+      script->Run(context).ToLocalChecked().As<v8::Function>();
+  i::Handle<i::Script> i_script(
+      i::Script::cast(v8::Utils::OpenHandle(*script)->shared()->script()),
+      i_isolate);
+  debug::LiveEditResult result;
+  LiveEdit::PatchScript(
+      i_isolate, i_script,
+      i_isolate->factory()->NewStringFromAsciiChecked(updated_source), false,
+      &result);
+  CHECK_EQ(result.status, debug::LiveEditResult::OK);
+  {
+    v8::Local<v8::String> result =
+        f->Call(context, context->Global(), 0, nullptr)
+            .ToLocalChecked()
+            .As<v8::String>();
+    v8::String::Utf8Value new_result_utf8(env->GetIsolate(), result);
+    CHECK_NOT_NULL(strstr(*new_result_utf8, "Capybara"));
+  }
+}
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/test/cctest/test-log-stack-tracer.cc b/deps/v8/test/cctest/test-log-stack-tracer.cc
index 24d6d9c8ba6d5a..8a09a1768472d1 100644
--- a/deps/v8/test/cctest/test-log-stack-tracer.cc
+++ b/deps/v8/test/cctest/test-log-stack-tracer.cc
@@ -45,9 +45,8 @@ namespace v8 {
 namespace internal {
 
 static bool IsAddressWithinFuncCode(JSFunction* function, void* addr) {
-  Address address = reinterpret_cast<Address>(addr);
   i::AbstractCode* code = function->abstract_code();
-  return code->contains(address);
+  return code->contains(reinterpret_cast<Address>(addr));
 }
 
 static bool IsAddressWithinFuncCode(v8::Local<v8::Context> context,
@@ -80,16 +79,21 @@ static void construct_call(const v8::FunctionCallbackInfo<v8::Value>& args) {
 
   v8::Local<v8::Context> context = args.GetIsolate()->GetCurrentContext();
 #if defined(V8_HOST_ARCH_32_BIT)
-  int32_t low_bits = reinterpret_cast<int32_t>(calling_frame->fp());
+  int32_t low_bits = static_cast<int32_t>(calling_frame->fp());
   args.This()
       ->Set(context, v8_str("low_bits"), v8_num(low_bits >> 1))
       .FromJust();
 #elif defined(V8_HOST_ARCH_64_BIT)
-  uint64_t fp = reinterpret_cast<uint64_t>(calling_frame->fp());
-  int32_t low_bits = static_cast<int32_t>(fp & 0xFFFFFFFF);
-  int32_t high_bits = static_cast<int32_t>(fp >> 32);
-  args.This()->Set(context, v8_str("low_bits"), v8_num(low_bits)).FromJust();
-  args.This()->Set(context, v8_str("high_bits"), v8_num(high_bits)).FromJust();
+  Address fp = calling_frame->fp();
+  uint64_t kSmiValueMask =
+      (static_cast<uintptr_t>(1) << (kSmiValueSize - 1)) - 1;
+  int32_t low_bits = static_cast<int32_t>(fp & kSmiValueMask);
+  fp >>= kSmiValueSize - 1;
+  int32_t high_bits = static_cast<int32_t>(fp & kSmiValueMask);
+  fp >>= kSmiValueSize - 1;
+  CHECK_EQ(fp, 0);  // Ensure all the bits are successfully encoded.
+  args.This()->Set(context, v8_str("low_bits"), v8_int(low_bits)).FromJust();
+  args.This()->Set(context, v8_str("high_bits"), v8_int(high_bits)).FromJust();
 #else
 #error Host architecture is neither 32-bit nor 64-bit.
 #endif
@@ -167,7 +171,7 @@ TEST(CFromJSStackTrace) {
 
   CHECK(sample.has_external_callback);
   CHECK_EQ(FUNCTION_ADDR(i::TraceExtension::Trace),
-           sample.external_callback_entry);
+           reinterpret_cast<Address>(sample.external_callback_entry));
 
   // Stack tracing will start from the first JS function, i.e. "JSFuncDoTrace"
   unsigned base = 0;
@@ -221,7 +225,7 @@ TEST(PureJSStackTrace) {
 
   CHECK(sample.has_external_callback);
   CHECK_EQ(FUNCTION_ADDR(i::TraceExtension::JSTrace),
-           sample.external_callback_entry);
+           reinterpret_cast<Address>(sample.external_callback_entry));
 
   // Stack sampling will start from the caller of JSFuncDoTrace, i.e. "JSTrace"
   unsigned base = 0;
@@ -231,15 +235,14 @@ TEST(PureJSStackTrace) {
       context, "OuterJSTrace", sample.stack[base + 1]));
 }
 
-
-static void CFuncDoTrace(byte dummy_parameter) {
+static void CFuncDoTrace(byte dummy_param) {
   Address fp;
 #if V8_HAS_BUILTIN_FRAME_ADDRESS
   fp = reinterpret_cast<Address>(__builtin_frame_address(0));
 #elif V8_CC_MSVC
   // Approximate a frame pointer address. We compile without base pointers,
   // so we can't trust ebp/rbp.
-  fp = &dummy_parameter - 2 * sizeof(void*);  // NOLINT
+  fp = reinterpret_cast<Address>(&dummy_param) - 2 * sizeof(void*);  // NOLINT
 #else
 #error Unexpected platform.
 #endif
diff --git a/deps/v8/test/cctest/test-log.cc b/deps/v8/test/cctest/test-log.cc
index 072b4b37038fa8..10fdb3d8de2623 100644
--- a/deps/v8/test/cctest/test-log.cc
+++ b/deps/v8/test/cctest/test-log.cc
@@ -126,25 +126,30 @@ class ScopedLoggerInitializer {
 
   v8::Isolate* isolate() { return isolate_; }
 
+  i::Isolate* i_isolate() { return reinterpret_cast<i::Isolate*>(isolate()); }
+
   Logger* logger() { return logger_; }
 
-  void PrintLog(int nofLines = 0) {
-    if (nofLines <= 0) {
+  void PrintLog(int requested_nof_lines = 0, const char* start = nullptr) {
+    if (requested_nof_lines <= 0) {
       printf("%s", log_.start());
       return;
     }
-    // Try to print the last {nofLines} of the log.
-    const char* start = log_.start();
+    // Try to print the last {requested_nof_lines} of the log.
+    if (start == nullptr) start = log_.start();
     const char* current = log_.end();
-    while (current > start && nofLines > 0) {
+    int nof_lines = requested_nof_lines;
+    while (current > start && nof_lines > 0) {
       current--;
-      if (*current == '\n') nofLines--;
+      if (*current == '\n') nof_lines--;
     }
     printf(
         "======================================================\n"
-        "Last log lines:\n...%s\n"
+        "Last %i log lines:\n"
+        "======================================================\n"
+        "...\n%s\n"
         "======================================================\n",
-        current);
+        requested_nof_lines, current);
   }
 
   v8::Local<v8::String> GetLogString() {
@@ -159,12 +164,14 @@ class ScopedLoggerInitializer {
     CHECK(exists);
   }
 
+  const char* GetEndPosition() { return log_.start() + log_.length(); }
+
   const char* FindLine(const char* prefix, const char* suffix = nullptr,
                        const char* start = nullptr) {
     // Make sure that StopLogging() has been called before.
     CHECK(log_.size());
     if (start == nullptr) start = log_.start();
-    const char* end = log_.start() + log_.length();
+    const char* end = GetEndPosition();
     return FindLogLine(start, end, prefix, suffix);
   }
 
@@ -176,7 +183,7 @@ class ScopedLoggerInitializer {
     const char* suffix = pairs[0][1];
     const char* last_position = FindLine(prefix, suffix, start);
     if (last_position == nullptr) {
-      PrintLog(50);
+      PrintLog(100, start);
       V8_Fatal(__FILE__, __LINE__, "Could not find log line: %s ... %s", prefix,
                suffix);
     }
@@ -186,13 +193,13 @@ class ScopedLoggerInitializer {
       suffix = pairs[i][1];
       const char* position = FindLine(prefix, suffix, start);
       if (position == nullptr) {
-        PrintLog(50);
+        PrintLog(100, start);
         V8_Fatal(__FILE__, __LINE__, "Could not find log line: %s ... %s",
                  prefix, suffix);
       }
       // Check that all string positions are in order.
       if (position <= last_position) {
-        PrintLog(50);
+        PrintLog(100, start);
         V8_Fatal(__FILE__, __LINE__,
                  "Log statements not in expected order (prev=%p, current=%p): "
                  "%s ... %s",
@@ -522,7 +529,8 @@ TEST(Issue23768) {
   CHECK(!evil_script.IsEmpty());
   CHECK(!evil_script->Run(env).IsEmpty());
   i::Handle<i::ExternalTwoByteString> i_source(
-      i::ExternalTwoByteString::cast(*v8::Utils::OpenHandle(*source)));
+      i::ExternalTwoByteString::cast(*v8::Utils::OpenHandle(*source)),
+      CcTest::i_isolate());
   // This situation can happen if source was an external string disposed
   // by its owner.
   i_source->set_resource(nullptr);
@@ -570,8 +578,7 @@ TEST(LogCallbacks) {
     ObjMethod1_entry = *FUNCTION_ENTRYPOINT_ADDRESS(ObjMethod1_entry);
 #endif
     i::EmbeddedVector<char, 100> ref_data;
-    i::SNPrintF(ref_data, ",0x%" V8PRIxPTR ",1,method1",
-                reinterpret_cast<intptr_t>(ObjMethod1_entry));
+    i::SNPrintF(ref_data, ",0x%" V8PRIxPTR ",1,method1", ObjMethod1_entry);
     CHECK(logger.FindLine("code-creation,Callback,-2,", ref_data.start()));
   }
   isolate->Dispose();
@@ -617,7 +624,7 @@ TEST(LogAccessorCallbacks) {
 #endif
     EmbeddedVector<char, 100> prop1_getter_record;
     i::SNPrintF(prop1_getter_record, ",0x%" V8PRIxPTR ",1,get prop1",
-                reinterpret_cast<intptr_t>(Prop1Getter_entry));
+                Prop1Getter_entry);
     CHECK(logger.FindLine("code-creation,Callback,-2,",
                           prop1_getter_record.start()));
 
@@ -627,7 +634,7 @@ TEST(LogAccessorCallbacks) {
 #endif
     EmbeddedVector<char, 100> prop1_setter_record;
     i::SNPrintF(prop1_setter_record, ",0x%" V8PRIxPTR ",1,set prop1",
-                reinterpret_cast<intptr_t>(Prop1Setter_entry));
+                Prop1Setter_entry);
     CHECK(logger.FindLine("code-creation,Callback,-2,",
                           prop1_setter_record.start()));
 
@@ -637,7 +644,7 @@ TEST(LogAccessorCallbacks) {
 #endif
     EmbeddedVector<char, 100> prop2_getter_record;
     i::SNPrintF(prop2_getter_record, ",0x%" V8PRIxPTR ",1,get prop2",
-                reinterpret_cast<intptr_t>(Prop2Getter_entry));
+                Prop2Getter_entry);
     CHECK(logger.FindLine("code-creation,Callback,-2,",
                           prop2_getter_record.start()));
   }
@@ -756,7 +763,7 @@ TEST(Issue539892) {
 
   {
     ScopedLoggerInitializer logger(saved_log, saved_prof, isolate);
-    logger.logger()->addCodeEventListener(&code_event_logger);
+    logger.logger()->AddCodeEventListener(&code_event_logger);
 
     // Function with a really large name.
     const char* source_text =
@@ -1000,7 +1007,7 @@ TEST(LogMaps) {
       uintptr_t address = reinterpret_cast<uintptr_t>(obj);
       if (map_addresses.find(address) != map_addresses.end()) continue;
       logger.PrintLog(200);
-      i::Map::cast(obj)->Print();
+      i::Map::cast(obj)->Print(heap->isolate());
       V8_Fatal(__FILE__, __LINE__,
                "Map (%p, #%zu) was not logged during startup with --trace-maps!"
                "\n# Expected Log Line: map_details, ... %p"
@@ -1055,8 +1062,19 @@ TEST(LogFunctionEvents) {
   v8::Isolate::CreateParams create_params;
   create_params.array_buffer_allocator = CcTest::array_buffer_allocator();
   v8::Isolate* isolate = v8::Isolate::New(create_params);
+
   {
     ScopedLoggerInitializer logger(saved_log, saved_prof, isolate);
+
+    // Run some warmup code to help ignoring existing log entries.
+    CompileRun(
+        "function warmUp(a) {"
+        " let b = () => 1;"
+        " return function(c) { return a+b+c; };"
+        "};"
+        "warmUp(1)(2);"
+        "(function warmUpEndMarkerFunction(){})();");
+
     const char* source_text =
         "function lazyNotExecutedFunction() { return 'lazy' };"
         "function lazyFunction() { "
@@ -1072,13 +1090,14 @@ TEST(LogFunctionEvents) {
 
     logger.StopLogging();
 
-    // TODO(cbruni): Extend with first-execution log statements.
-    CHECK_NULL(
-        logger.FindLine("function,compile-lazy,", ",lazyNotExecutedFunction"));
-    // Only consider the log starting from the first preparse statement on.
+    // Ignore all the log entries that happened before warmup
     const char* start =
-        logger.FindLine("function,preparse-", ",lazyNotExecutedFunction");
+        logger.FindLine("function,first-execution", "warmUpEndMarkerFunction");
+    CHECK_NOT_NULL(start);
     const char* pairs[][2] = {
+        // Create a new script
+        {"script,create", nullptr},
+        {"script-details", nullptr},
         // Step 1: parsing top-level script, preparsing functions
         {"function,preparse-", ",lazyNotExecutedFunction"},
         // Missing name for preparsing lazyInnerFunction
@@ -1093,7 +1112,7 @@ TEST(LogFunctionEvents) {
 
         // Step 2: compiling top-level script and eager functions
         // - Compiling script without name.
-        {"function,compile,,", nullptr},
+        {"function,compile,", nullptr},
         {"function,compile,", ",eagerFunction"},
 
         // Step 3: start executing script
diff --git a/deps/v8/test/cctest/test-macro-assembler-arm.cc b/deps/v8/test/cctest/test-macro-assembler-arm.cc
index acef2731b92267..263a07825d1224 100644
--- a/deps/v8/test/cctest/test-macro-assembler-arm.cc
+++ b/deps/v8/test/cctest/test-macro-assembler-arm.cc
@@ -236,8 +236,8 @@ TEST(ExtractLane) {
   Handle<Code> code =
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef DEBUG
-  OFStream os(stdout);
-  code->Print(os);
+  StdoutStream os;
+  code->Print(isolate, os);
 #endif
   auto f = GeneratedCode<F3>::FromCode(*code);
   f.Call(&t, 0, 0, 0, 0);
@@ -368,8 +368,8 @@ TEST(ReplaceLane) {
   Handle<Code> code =
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef DEBUG
-  OFStream os(stdout);
-  code->Print(os);
+  StdoutStream os;
+  code->Print(isolate, os);
 #endif
   auto f = GeneratedCode<F3>::FromCode(*code);
   f.Call(&t, 0, 0, 0, 0);
diff --git a/deps/v8/test/cctest/test-macro-assembler-mips.cc b/deps/v8/test/cctest/test-macro-assembler-mips.cc
index ccaa2142459760..fa92793678173e 100644
--- a/deps/v8/test/cctest/test-macro-assembler-mips.cc
+++ b/deps/v8/test/cctest/test-macro-assembler-mips.cc
@@ -50,65 +50,37 @@ using F4 = Object*(void* p0, void* p1, int p2, int p3, int p4);
 TEST(BYTESWAP) {
   CcTest::InitializeVM();
   Isolate* isolate = CcTest::i_isolate();
-  HandleScope handles(isolate);
+  HandleScope scope(isolate);
 
   struct T {
-    int32_t r1;
-    int32_t r2;
-    int32_t r3;
-    int32_t r4;
-    int32_t r5;
-    int32_t t1;
-    int32_t t2;
-    int32_t t3;
-    int32_t t4;
-    int32_t t5;
-    int32_t p1;
-    int32_t p2;
-    int32_t p3;
-    int32_t p4;
-    int32_t p5;
+    uint32_t s4;
+    uint32_t s2;
+    uint32_t u2;
   };
+
   T t;
+  uint32_t test_values[] = {0x5612FFCD, 0x9D327ACC, 0x781A15C3, 0xFCDE,    0x9F,
+                            0xC81A15C3, 0x80000000, 0xFFFFFFFF, 0x00008000};
 
   MacroAssembler assembler(isolate, nullptr, 0,
                            v8::internal::CodeObjectRequired::kYes);
+
   MacroAssembler* masm = &assembler;
 
-  __ lw(a2, MemOperand(a0, offsetof(T, r1)));
-  __ ByteSwapSigned(a1, a2, 4);
-  __ sw(a2, MemOperand(a0, offsetof(T, p1)));
-  __ sw(a1, MemOperand(a0, offsetof(T, t1)));
-  __ ByteSwapSigned(a2, a2, 4);
-  __ sw(a2, MemOperand(a0, offsetof(T, r1)));
-
-  __ lw(a2, MemOperand(a0, offsetof(T, r2)));
-  __ ByteSwapSigned(a1, a2, 2);
-  __ sw(a2, MemOperand(a0, offsetof(T, p2)));
-  __ sw(a1, MemOperand(a0, offsetof(T, t2)));
-  __ ByteSwapSigned(a2, a2, 2);
-  __ sw(a2, MemOperand(a0, offsetof(T, r2)));
-
-  __ lw(a2, MemOperand(a0, offsetof(T, r3)));
-  __ ByteSwapSigned(a1, a2, 1);
-  __ sw(a2, MemOperand(a0, offsetof(T, p3)));
-  __ sw(a1, MemOperand(a0, offsetof(T, t3)));
-  __ ByteSwapSigned(a2, a2, 1);
-  __ sw(a2, MemOperand(a0, offsetof(T, r3)));
-
-  __ lw(a2, MemOperand(a0, offsetof(T, r4)));
-  __ ByteSwapUnsigned(a1, a2, 1);
-  __ sw(a2, MemOperand(a0, offsetof(T, p4)));
-  __ sw(a1, MemOperand(a0, offsetof(T, t4)));
-  __ ByteSwapUnsigned(a2, a2, 1);
-  __ sw(a2, MemOperand(a0, offsetof(T, r4)));
-
-  __ lw(a2, MemOperand(a0, offsetof(T, r5)));
-  __ ByteSwapUnsigned(a1, a2, 2);
-  __ sw(a2, MemOperand(a0, offsetof(T, p5)));
-  __ sw(a1, MemOperand(a0, offsetof(T, t5)));
-  __ ByteSwapUnsigned(a2, a2, 2);
-  __ sw(a2, MemOperand(a0, offsetof(T, r5)));
+  __ lw(a1, MemOperand(a0, offsetof(T, s4)));
+  __ nop();
+  __ ByteSwapSigned(a1, a1, 4);
+  __ sw(a1, MemOperand(a0, offsetof(T, s4)));
+
+  __ lw(a1, MemOperand(a0, offsetof(T, s2)));
+  __ nop();
+  __ ByteSwapSigned(a1, a1, 2);
+  __ sw(a1, MemOperand(a0, offsetof(T, s2)));
+
+  __ lw(a1, MemOperand(a0, offsetof(T, u2)));
+  __ nop();
+  __ ByteSwapUnsigned(a1, a1, 2);
+  __ sw(a1, MemOperand(a0, offsetof(T, u2)));
 
   __ jr(ra);
   __ nop();
@@ -118,30 +90,21 @@ TEST(BYTESWAP) {
   Handle<Code> code =
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
   auto f = GeneratedCode<F3>::FromCode(*code);
-  t.r1 = 0x781A15C3;
-  t.r2 = 0x2CDE;
-  t.r3 = 0x9F;
-  t.r4 = 0x9F;
-  t.r5 = 0x2CDE;
-  f.Call(&t, 0, 0, 0, 0);
-
-  CHECK_EQ(static_cast<int32_t>(0xC3151A78), t.r1);
-  CHECK_EQ(static_cast<int32_t>(0xDE2C0000), t.r2);
-  CHECK_EQ(static_cast<int32_t>(0x9FFFFFFF), t.r3);
-  CHECK_EQ(static_cast<int32_t>(0x9F000000), t.r4);
-  CHECK_EQ(static_cast<int32_t>(0xDE2C0000), t.r5);
-
-  CHECK_EQ(t.t1, t.r1);
-  CHECK_EQ(t.t2, t.r2);
-  CHECK_EQ(t.t3, t.r3);
-  CHECK_EQ(t.t4, t.r4);
-  CHECK_EQ(t.t5, t.r5);
-
-  CHECK_EQ(static_cast<int32_t>(0x781A15C3), t.p1);
-  CHECK_EQ(static_cast<int32_t>(0x2CDE), t.p2);
-  CHECK_EQ(static_cast<int32_t>(0x9F), t.p3);
-  CHECK_EQ(static_cast<int32_t>(0x9F), t.p4);
-  CHECK_EQ(static_cast<int32_t>(0x2CDE), t.p5);
+
+  for (size_t i = 0; i < arraysize(test_values); i++) {
+    int16_t in_s2 = static_cast<int16_t>(test_values[i]);
+    uint16_t in_u2 = static_cast<uint16_t>(test_values[i]);
+
+    t.s4 = test_values[i];
+    t.s2 = static_cast<uint64_t>(in_s2);
+    t.u2 = static_cast<uint64_t>(in_u2);
+
+    f.Call(&t, 0, 0, 0, 0);
+
+    CHECK_EQ(ByteReverse(test_values[i]), t.s4);
+    CHECK_EQ(ByteReverse<int16_t>(in_s2), static_cast<int16_t>(t.s2));
+    CHECK_EQ(ByteReverse<uint16_t>(in_u2), static_cast<uint16_t>(t.u2));
+  }
 }
 
 static void TestNaN(const char *code) {
@@ -157,7 +120,8 @@ static void TestNaN(const char *code) {
   v8::Local<v8::Object> result =
       v8::Local<v8::Object>::Cast(script->Run(context).ToLocalChecked());
   i::Handle<i::JSReceiver> o = v8::Utils::OpenHandle(*result);
-  i::Handle<i::JSArray> array1(reinterpret_cast<i::JSArray*>(*o));
+  i::Handle<i::JSArray> array1(reinterpret_cast<i::JSArray*>(*o),
+                               o->GetIsolate());
   i::FixedDoubleArray* a = i::FixedDoubleArray::cast(array1->elements());
   double value = a->get_scalar(0);
   CHECK(std::isnan(value) &&
@@ -238,7 +202,7 @@ TEST(jump_tables4) {
   Handle<Code> code =
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef OBJECT_PRINT
-  code->Print(std::cout);
+  code->Print(isolate, std::cout);
 #endif
   auto f = GeneratedCode<F1>::FromCode(*code);
   for (int i = 0; i < kNumCases; ++i) {
@@ -304,7 +268,7 @@ TEST(jump_tables5) {
   Handle<Code> code =
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef OBJECT_PRINT
-  code->Print(std::cout);
+  code->Print(isolate, std::cout);
 #endif
   auto f = GeneratedCode<F1>::FromCode(*code);
   for (int i = 0; i < kNumCases; ++i) {
@@ -394,7 +358,7 @@ TEST(jump_tables6) {
   Handle<Code> code =
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef OBJECT_PRINT
-  code->Print(std::cout);
+  code->Print(isolate, std::cout);
 #endif
   auto f = GeneratedCode<F1>::FromCode(*code);
   for (int i = 0; i < kSwitchTableCases; ++i) {
@@ -1164,8 +1128,8 @@ static GeneratedCode<F4> GenerateMacroFloat32MinMax(MacroAssembler* masm) {
   Handle<Code> code =
       masm->isolate()->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef DEBUG
-  OFStream os(stdout);
-  code->Print(os);
+  StdoutStream os;
+  code->Print(masm->isolate(), os);
 #endif
   return GeneratedCode<F4>::FromCode(*code);
 }
@@ -1306,8 +1270,8 @@ static GeneratedCode<F4> GenerateMacroFloat64MinMax(MacroAssembler* masm) {
   Handle<Code> code =
       masm->isolate()->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef DEBUG
-  OFStream os(stdout);
-  code->Print(os);
+  StdoutStream os;
+  code->Print(masm->isolate(), os);
 #endif
   return GeneratedCode<F4>::FromCode(*code);
 }
diff --git a/deps/v8/test/cctest/test-macro-assembler-mips64.cc b/deps/v8/test/cctest/test-macro-assembler-mips64.cc
index 5cc1d169770678..2bfce03a41151d 100644
--- a/deps/v8/test/cctest/test-macro-assembler-mips64.cc
+++ b/deps/v8/test/cctest/test-macro-assembler-mips64.cc
@@ -55,55 +55,53 @@ TEST(BYTESWAP) {
   HandleScope scope(isolate);
 
   struct T {
-    int64_t r1;
-    int64_t r2;
-    int64_t r3;
-    int64_t r4;
-    int64_t r5;
-    int64_t r6;
-    int64_t r7;
+    uint64_t s8;
+    uint64_t s4;
+    uint64_t s2;
+    uint64_t u4;
+    uint64_t u2;
   };
+
   T t;
+  uint64_t test_values[] = {0x5612FFCD9D327ACC,
+                            0x781A15C3,
+                            0xFCDE,
+                            0x9F,
+                            0xC81A15C3,
+                            0x8000000000000000,
+                            0xFFFFFFFFFFFFFFFF,
+                            0x0000000080000000,
+                            0x0000000000008000};
 
   MacroAssembler assembler(isolate, nullptr, 0,
                            v8::internal::CodeObjectRequired::kYes);
 
   MacroAssembler* masm = &assembler;
 
-  __ Ld(a4, MemOperand(a0, offsetof(T, r1)));
+  __ Ld(a4, MemOperand(a0, offsetof(T, s8)));
   __ nop();
   __ ByteSwapSigned(a4, a4, 8);
-  __ Sd(a4, MemOperand(a0, offsetof(T, r1)));
+  __ Sd(a4, MemOperand(a0, offsetof(T, s8)));
 
-  __ Ld(a4, MemOperand(a0, offsetof(T, r2)));
+  __ Ld(a4, MemOperand(a0, offsetof(T, s4)));
   __ nop();
   __ ByteSwapSigned(a4, a4, 4);
-  __ Sd(a4, MemOperand(a0, offsetof(T, r2)));
+  __ Sd(a4, MemOperand(a0, offsetof(T, s4)));
 
-  __ Ld(a4, MemOperand(a0, offsetof(T, r3)));
+  __ Ld(a4, MemOperand(a0, offsetof(T, s2)));
   __ nop();
   __ ByteSwapSigned(a4, a4, 2);
-  __ Sd(a4, MemOperand(a0, offsetof(T, r3)));
-
-  __ Ld(a4, MemOperand(a0, offsetof(T, r4)));
-  __ nop();
-  __ ByteSwapSigned(a4, a4, 1);
-  __ Sd(a4, MemOperand(a0, offsetof(T, r4)));
+  __ Sd(a4, MemOperand(a0, offsetof(T, s2)));
 
-  __ Ld(a4, MemOperand(a0, offsetof(T, r5)));
+  __ Ld(a4, MemOperand(a0, offsetof(T, u4)));
   __ nop();
-  __ ByteSwapUnsigned(a4, a4, 1);
-  __ Sd(a4, MemOperand(a0, offsetof(T, r5)));
+  __ ByteSwapUnsigned(a4, a4, 4);
+  __ Sd(a4, MemOperand(a0, offsetof(T, u4)));
 
-  __ Ld(a4, MemOperand(a0, offsetof(T, r6)));
+  __ Ld(a4, MemOperand(a0, offsetof(T, u2)));
   __ nop();
   __ ByteSwapUnsigned(a4, a4, 2);
-  __ Sd(a4, MemOperand(a0, offsetof(T, r6)));
-
-  __ Ld(a4, MemOperand(a0, offsetof(T, r7)));
-  __ nop();
-  __ ByteSwapUnsigned(a4, a4, 4);
-  __ Sd(a4, MemOperand(a0, offsetof(T, r7)));
+  __ Sd(a4, MemOperand(a0, offsetof(T, u2)));
 
   __ jr(ra);
   __ nop();
@@ -113,22 +111,27 @@ TEST(BYTESWAP) {
   Handle<Code> code =
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
   auto f = GeneratedCode<F3>::FromCode(*code);
-  t.r1 = 0x5612FFCD9D327ACC;
-  t.r2 = 0x781A15C3;
-  t.r3 = 0xFCDE;
-  t.r4 = 0x9F;
-  t.r5 = 0x9F;
-  t.r6 = 0xFCDE;
-  t.r7 = 0xC81A15C3;
-  f.Call(&t, 0, 0, 0, 0);
-
-  CHECK_EQ(static_cast<int64_t>(0xCC7A329DCDFF1256), t.r1);
-  CHECK_EQ(static_cast<int64_t>(0xC3151A7800000000), t.r2);
-  CHECK_EQ(static_cast<int64_t>(0xDEFCFFFFFFFFFFFF), t.r3);
-  CHECK_EQ(static_cast<int64_t>(0x9FFFFFFFFFFFFFFF), t.r4);
-  CHECK_EQ(static_cast<int64_t>(0x9F00000000000000), t.r5);
-  CHECK_EQ(static_cast<int64_t>(0xDEFC000000000000), t.r6);
-  CHECK_EQ(static_cast<int64_t>(0xC3151AC800000000), t.r7);
+
+  for (size_t i = 0; i < arraysize(test_values); i++) {
+    int32_t in_s4 = static_cast<int32_t>(test_values[i]);
+    int16_t in_s2 = static_cast<int16_t>(test_values[i]);
+    uint32_t in_u4 = static_cast<uint32_t>(test_values[i]);
+    uint16_t in_u2 = static_cast<uint16_t>(test_values[i]);
+
+    t.s8 = test_values[i];
+    t.s4 = static_cast<uint64_t>(in_s4);
+    t.s2 = static_cast<uint64_t>(in_s2);
+    t.u4 = static_cast<uint64_t>(in_u4);
+    t.u2 = static_cast<uint64_t>(in_u2);
+
+    f.Call(&t, 0, 0, 0, 0);
+
+    CHECK_EQ(ByteReverse<uint64_t>(test_values[i]), t.s8);
+    CHECK_EQ(ByteReverse<int32_t>(in_s4), static_cast<int32_t>(t.s4));
+    CHECK_EQ(ByteReverse<int16_t>(in_s2), static_cast<int16_t>(t.s2));
+    CHECK_EQ(ByteReverse<uint32_t>(in_u4), static_cast<uint32_t>(t.u4));
+    CHECK_EQ(ByteReverse<uint16_t>(in_u2), static_cast<uint16_t>(t.u2));
+  }
 }
 
 TEST(LoadConstants) {
@@ -266,7 +269,7 @@ TEST(jump_tables4) {
   Handle<Code> code =
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef OBJECT_PRINT
-  code->Print(std::cout);
+  code->Print(isolate, std::cout);
 #endif
   auto f = GeneratedCode<F1>::FromCode(*code);
   for (int i = 0; i < kNumCases; ++i) {
@@ -339,7 +342,7 @@ TEST(jump_tables5) {
   Handle<Code> code =
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef OBJECT_PRINT
-  code->Print(std::cout);
+  code->Print(isolate, std::cout);
 #endif
   auto f = GeneratedCode<F1>::FromCode(*code);
   for (int i = 0; i < kNumCases; ++i) {
@@ -430,7 +433,7 @@ TEST(jump_tables6) {
   Handle<Code> code =
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef OBJECT_PRINT
-  code->Print(std::cout);
+  code->Print(isolate, std::cout);
 #endif
   auto f = GeneratedCode<F1>::FromCode(*code);
   for (int i = 0; i < kSwitchTableCases; ++i) {
@@ -1483,8 +1486,8 @@ static GeneratedCode<F4> GenerateMacroFloat32MinMax(MacroAssembler* masm) {
   Handle<Code> code =
       masm->isolate()->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef DEBUG
-  OFStream os(stdout);
-  code->Print(os);
+  StdoutStream os;
+  code->Print(masm->isolate(), os);
 #endif
   return GeneratedCode<F4>::FromCode(*code);
 }
@@ -1625,8 +1628,8 @@ static GeneratedCode<F4> GenerateMacroFloat64MinMax(MacroAssembler* masm) {
   Handle<Code> code =
       masm->isolate()->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef DEBUG
-  OFStream os(stdout);
-  code->Print(os);
+  StdoutStream os;
+  code->Print(masm->isolate(), os);
 #endif
   return GeneratedCode<F4>::FromCode(*code);
 }
diff --git a/deps/v8/test/cctest/test-macro-assembler-x64.cc b/deps/v8/test/cctest/test-macro-assembler-x64.cc
index 092d555dbc34c8..54924def87a65c 100644
--- a/deps/v8/test/cctest/test-macro-assembler-x64.cc
+++ b/deps/v8/test/cctest/test-macro-assembler-x64.cc
@@ -130,7 +130,7 @@ TEST(SmiMove) {
   masm->GetCode(isolate, &desc);
   MakeAssemblerBufferExecutable(buffer, allocated);
   // Call the function from C++.
-  auto f = GeneratedCode<F0>::FromAddress(CcTest::i_isolate(), buffer);
+  auto f = GeneratedCode<F0>::FromBuffer(CcTest::i_isolate(), buffer);
   int result = f.Call();
   CHECK_EQ(0, result);
 }
@@ -186,7 +186,8 @@ TEST(SmiCompare) {
   Isolate* isolate = CcTest::i_isolate();
   HandleScope handles(isolate);
   size_t allocated;
-  byte* buffer = AllocateAssemblerBuffer(&allocated);
+  byte* buffer =
+      AllocateAssemblerBuffer(&allocated, 2 * Assembler::kMinimalBufferSize);
   MacroAssembler assembler(isolate, buffer, static_cast<int>(allocated),
                            v8::internal::CodeObjectRequired::kYes);
 
@@ -223,14 +224,12 @@ TEST(SmiCompare) {
   masm->GetCode(isolate, &desc);
   MakeAssemblerBufferExecutable(buffer, allocated);
   // Call the function from C++.
-  auto f = GeneratedCode<F0>::FromAddress(CcTest::i_isolate(), buffer);
+  auto f = GeneratedCode<F0>::FromBuffer(CcTest::i_isolate(), buffer);
   int result = f.Call();
   CHECK_EQ(0, result);
 }
 
-
-
-TEST(Integer32ToSmi) {
+TEST(SmiTag) {
   Isolate* isolate = CcTest::i_isolate();
   HandleScope handles(isolate);
   size_t allocated;
@@ -243,36 +242,36 @@ TEST(Integer32ToSmi) {
   Label exit;
 
   __ movq(rax, Immediate(1));  // Test number.
-  __ movl(rcx, Immediate(0));
-  __ Integer32ToSmi(rcx, rcx);
+  __ movq(rcx, Immediate(0));
+  __ SmiTag(rcx, rcx);
   __ Set(rdx, reinterpret_cast<intptr_t>(Smi::kZero));
   __ cmpq(rcx, rdx);
   __ j(not_equal, &exit);
 
   __ movq(rax, Immediate(2));  // Test number.
-  __ movl(rcx, Immediate(1024));
-  __ Integer32ToSmi(rcx, rcx);
+  __ movq(rcx, Immediate(1024));
+  __ SmiTag(rcx, rcx);
   __ Set(rdx, reinterpret_cast<intptr_t>(Smi::FromInt(1024)));
   __ cmpq(rcx, rdx);
   __ j(not_equal, &exit);
 
   __ movq(rax, Immediate(3));  // Test number.
-  __ movl(rcx, Immediate(-1));
-  __ Integer32ToSmi(rcx, rcx);
+  __ movq(rcx, Immediate(-1));
+  __ SmiTag(rcx, rcx);
   __ Set(rdx, reinterpret_cast<intptr_t>(Smi::FromInt(-1)));
   __ cmpq(rcx, rdx);
   __ j(not_equal, &exit);
 
   __ movq(rax, Immediate(4));  // Test number.
-  __ movl(rcx, Immediate(Smi::kMaxValue));
-  __ Integer32ToSmi(rcx, rcx);
+  __ movq(rcx, Immediate(Smi::kMaxValue));
+  __ SmiTag(rcx, rcx);
   __ Set(rdx, reinterpret_cast<intptr_t>(Smi::FromInt(Smi::kMaxValue)));
   __ cmpq(rcx, rdx);
   __ j(not_equal, &exit);
 
   __ movq(rax, Immediate(5));  // Test number.
-  __ movl(rcx, Immediate(Smi::kMinValue));
-  __ Integer32ToSmi(rcx, rcx);
+  __ movq(rcx, Immediate(Smi::kMinValue));
+  __ SmiTag(rcx, rcx);
   __ Set(rdx, reinterpret_cast<intptr_t>(Smi::FromInt(Smi::kMinValue)));
   __ cmpq(rcx, rdx);
   __ j(not_equal, &exit);
@@ -280,36 +279,36 @@ TEST(Integer32ToSmi) {
   // Different target register.
 
   __ movq(rax, Immediate(6));  // Test number.
-  __ movl(rcx, Immediate(0));
-  __ Integer32ToSmi(r8, rcx);
+  __ movq(rcx, Immediate(0));
+  __ SmiTag(r8, rcx);
   __ Set(rdx, reinterpret_cast<intptr_t>(Smi::kZero));
   __ cmpq(r8, rdx);
   __ j(not_equal, &exit);
 
   __ movq(rax, Immediate(7));  // Test number.
-  __ movl(rcx, Immediate(1024));
-  __ Integer32ToSmi(r8, rcx);
+  __ movq(rcx, Immediate(1024));
+  __ SmiTag(r8, rcx);
   __ Set(rdx, reinterpret_cast<intptr_t>(Smi::FromInt(1024)));
   __ cmpq(r8, rdx);
   __ j(not_equal, &exit);
 
   __ movq(rax, Immediate(8));  // Test number.
-  __ movl(rcx, Immediate(-1));
-  __ Integer32ToSmi(r8, rcx);
+  __ movq(rcx, Immediate(-1));
+  __ SmiTag(r8, rcx);
   __ Set(rdx, reinterpret_cast<intptr_t>(Smi::FromInt(-1)));
   __ cmpq(r8, rdx);
   __ j(not_equal, &exit);
 
   __ movq(rax, Immediate(9));  // Test number.
-  __ movl(rcx, Immediate(Smi::kMaxValue));
-  __ Integer32ToSmi(r8, rcx);
+  __ movq(rcx, Immediate(Smi::kMaxValue));
+  __ SmiTag(r8, rcx);
   __ Set(rdx, reinterpret_cast<intptr_t>(Smi::FromInt(Smi::kMaxValue)));
   __ cmpq(r8, rdx);
   __ j(not_equal, &exit);
 
   __ movq(rax, Immediate(10));  // Test number.
-  __ movl(rcx, Immediate(Smi::kMinValue));
-  __ Integer32ToSmi(r8, rcx);
+  __ movq(rcx, Immediate(Smi::kMinValue));
+  __ SmiTag(r8, rcx);
   __ Set(rdx, reinterpret_cast<intptr_t>(Smi::FromInt(Smi::kMinValue)));
   __ cmpq(r8, rdx);
   __ j(not_equal, &exit);
@@ -324,7 +323,7 @@ TEST(Integer32ToSmi) {
   masm->GetCode(isolate, &desc);
   MakeAssemblerBufferExecutable(buffer, allocated);
   // Call the function from C++.
-  auto f = GeneratedCode<F0>::FromAddress(CcTest::i_isolate(), buffer);
+  auto f = GeneratedCode<F0>::FromBuffer(CcTest::i_isolate(), buffer);
   int result = f.Call();
   CHECK_EQ(0, result);
 }
@@ -347,7 +346,7 @@ TEST(SmiCheck) {
   // CheckSmi
 
   __ movl(rcx, Immediate(0));
-  __ Integer32ToSmi(rcx, rcx);
+  __ SmiTag(rcx, rcx);
   cond = masm->CheckSmi(rcx);
   __ j(NegateCondition(cond), &exit);
 
@@ -358,7 +357,7 @@ TEST(SmiCheck) {
 
   __ incq(rax);
   __ movl(rcx, Immediate(-1));
-  __ Integer32ToSmi(rcx, rcx);
+  __ SmiTag(rcx, rcx);
   cond = masm->CheckSmi(rcx);
   __ j(NegateCondition(cond), &exit);
 
@@ -369,7 +368,7 @@ TEST(SmiCheck) {
 
   __ incq(rax);
   __ movl(rcx, Immediate(Smi::kMaxValue));
-  __ Integer32ToSmi(rcx, rcx);
+  __ SmiTag(rcx, rcx);
   cond = masm->CheckSmi(rcx);
   __ j(NegateCondition(cond), &exit);
 
@@ -380,7 +379,7 @@ TEST(SmiCheck) {
 
   __ incq(rax);
   __ movl(rcx, Immediate(Smi::kMinValue));
-  __ Integer32ToSmi(rcx, rcx);
+  __ SmiTag(rcx, rcx);
   cond = masm->CheckSmi(rcx);
   __ j(NegateCondition(cond), &exit);
 
@@ -400,7 +399,7 @@ TEST(SmiCheck) {
   masm->GetCode(isolate, &desc);
   MakeAssemblerBufferExecutable(buffer, allocated);
   // Call the function from C++.
-  auto f = GeneratedCode<F0>::FromAddress(CcTest::i_isolate(), buffer);
+  auto f = GeneratedCode<F0>::FromBuffer(CcTest::i_isolate(), buffer);
   int result = f.Call();
   CHECK_EQ(0, result);
 }
@@ -455,7 +454,7 @@ TEST(SmiIndex) {
   masm->GetCode(isolate, &desc);
   MakeAssemblerBufferExecutable(buffer, allocated);
   // Call the function from C++.
-  auto f = GeneratedCode<F0>::FromAddress(CcTest::i_isolate(), buffer);
+  auto f = GeneratedCode<F0>::FromBuffer(CcTest::i_isolate(), buffer);
   int result = f.Call();
   CHECK_EQ(0, result);
 }
@@ -807,7 +806,7 @@ TEST(OperandOffset) {
   masm->GetCode(isolate, &desc);
   MakeAssemblerBufferExecutable(buffer, allocated);
   // Call the function from C++.
-  auto f = GeneratedCode<F0>::FromAddress(CcTest::i_isolate(), buffer);
+  auto f = GeneratedCode<F0>::FromBuffer(CcTest::i_isolate(), buffer);
   int result = f.Call();
   CHECK_EQ(0, result);
 }
@@ -955,7 +954,7 @@ TEST(LoadAndStoreWithRepresentation) {
   masm->GetCode(isolate, &desc);
   MakeAssemblerBufferExecutable(buffer, allocated);
   // Call the function from C++.
-  auto f = GeneratedCode<F0>::FromAddress(CcTest::i_isolate(), buffer);
+  auto f = GeneratedCode<F0>::FromBuffer(CcTest::i_isolate(), buffer);
   int result = f.Call();
   CHECK_EQ(0, result);
 }
@@ -1109,7 +1108,7 @@ TEST(SIMDMacros) {
   masm->GetCode(isolate, &desc);
   MakeAssemblerBufferExecutable(buffer, allocated);
   // Call the function from C++.
-  auto f = GeneratedCode<F0>::FromAddress(CcTest::i_isolate(), buffer);
+  auto f = GeneratedCode<F0>::FromBuffer(CcTest::i_isolate(), buffer);
   int result = f.Call();
   CHECK_EQ(0, result);
 }
diff --git a/deps/v8/test/cctest/test-managed.cc b/deps/v8/test/cctest/test-managed.cc
index 81751a14e50d36..f108b6210ced58 100644
--- a/deps/v8/test/cctest/test-managed.cc
+++ b/deps/v8/test/cctest/test-managed.cc
@@ -6,7 +6,7 @@
 #include <stdlib.h>
 #include <string.h>
 
-#include "src/managed.h"
+#include "src/objects/managed.h"
 
 #include "src/objects-inl.h"
 #include "test/cctest/cctest.h"
@@ -14,84 +14,185 @@
 namespace v8 {
 namespace internal {
 
-class DeleteRecorder {
+class DeleteCounter {
  public:
-  explicit DeleteRecorder(bool* deleted) : deleted_(deleted) {
-    *deleted_ = false;
-  }
-  ~DeleteRecorder() { *deleted_ = true; }
-  static void Deleter(Isolate::ManagedObjectFinalizer* finalizer) {
-    delete *reinterpret_cast<DeleteRecorder**>(finalizer);
+  explicit DeleteCounter(int* deleted) : deleted_(deleted) { *deleted_ = 0; }
+  ~DeleteCounter() { (*deleted_)++; }
+  static void Deleter(void* arg) {
+    delete reinterpret_cast<DeleteCounter*>(arg);
   }
 
  private:
-  bool* deleted_;
+  int* deleted_;
 };
 
-TEST(ManagedCollect) {
+TEST(GCCausesDestruction) {
   Isolate* isolate = CcTest::InitIsolateOnce();
-  bool deleted1 = false;
-  bool deleted2 = false;
-  DeleteRecorder* d1 = new DeleteRecorder(&deleted1);
-  DeleteRecorder* d2 = new DeleteRecorder(&deleted2);
-  Isolate::ManagedObjectFinalizer finalizer(d2, DeleteRecorder::Deleter);
-  isolate->RegisterForReleaseAtTeardown(&finalizer);
+  int deleted1 = 0;
+  int deleted2 = 0;
+  DeleteCounter* d1 = new DeleteCounter(&deleted1);
+  DeleteCounter* d2 = new DeleteCounter(&deleted2);
   {
     HandleScope scope(isolate);
-    auto handle = Managed<DeleteRecorder>::From(isolate, d1);
+    auto handle = Managed<DeleteCounter>::FromRawPtr(isolate, 0, d1);
     USE(handle);
   }
 
   CcTest::CollectAllAvailableGarbage();
 
-  CHECK(deleted1);
-  CHECK(!deleted2);
-  isolate->UnregisterFromReleaseAtTeardown(&finalizer);
+  CHECK_EQ(1, deleted1);
+  CHECK_EQ(0, deleted2);
   delete d2;
-  CHECK(deleted2);
+  CHECK_EQ(1, deleted2);
 }
 
-TEST(DisposeCollect) {
+TEST(DisposeCausesDestruction1) {
   v8::Isolate::CreateParams create_params;
   create_params.array_buffer_allocator =
       CcTest::InitIsolateOnce()->array_buffer_allocator();
 
   v8::Isolate* isolate = v8::Isolate::New(create_params);
+  Isolate* i_isolate = reinterpret_cast<i::Isolate*>(isolate);
   isolate->Enter();
+  int deleted1 = 0;
+  DeleteCounter* d1 = new DeleteCounter(&deleted1);
+  {
+    HandleScope scope(i_isolate);
+    auto handle = Managed<DeleteCounter>::FromRawPtr(i_isolate, 0, d1);
+    USE(handle);
+  }
+  isolate->Exit();
+  isolate->Dispose();
+  CHECK_EQ(1, deleted1);
+}
+
+TEST(DisposeCausesDestruction2) {
+  v8::Isolate::CreateParams create_params;
+  create_params.array_buffer_allocator =
+      CcTest::InitIsolateOnce()->array_buffer_allocator();
+
+  v8::Isolate* isolate = v8::Isolate::New(create_params);
   Isolate* i_isolate = reinterpret_cast<i::Isolate*>(isolate);
-  bool deleted1 = false;
-  bool deleted2 = false;
-  DeleteRecorder* d1 = new DeleteRecorder(&deleted1);
-  DeleteRecorder* d2 = new DeleteRecorder(&deleted2);
+  isolate->Enter();
+  int deleted1 = 0;
+  int deleted2 = 0;
+  DeleteCounter* d1 = new DeleteCounter(&deleted1);
+  DeleteCounter* d2 = new DeleteCounter(&deleted2);
   {
     HandleScope scope(i_isolate);
-    auto handle = Managed<DeleteRecorder>::From(i_isolate, d1);
+    auto handle = Managed<DeleteCounter>::FromRawPtr(i_isolate, 0, d1);
     USE(handle);
   }
-  Isolate::ManagedObjectFinalizer finalizer(d2, DeleteRecorder::Deleter);
-  i_isolate->RegisterForReleaseAtTeardown(&finalizer);
+  ManagedPtrDestructor* destructor =
+      new ManagedPtrDestructor(0, d2, DeleteCounter::Deleter);
+  i_isolate->RegisterManagedPtrDestructor(destructor);
 
   isolate->Exit();
   isolate->Dispose();
-  CHECK(deleted1);
-  CHECK(deleted2);
+  CHECK_EQ(1, deleted1);
+  CHECK_EQ(1, deleted2);
 }
 
-TEST(CollectOnGC) {
-  i::Isolate* i_isolate = CcTest::InitIsolateOnce();
+TEST(DisposeWithAnotherSharedPtr) {
+  v8::Isolate::CreateParams create_params;
+  create_params.array_buffer_allocator =
+      CcTest::InitIsolateOnce()->array_buffer_allocator();
 
-  bool deleted = false;
+  v8::Isolate* isolate = v8::Isolate::New(create_params);
+  Isolate* i_isolate = reinterpret_cast<i::Isolate*>(isolate);
+  isolate->Enter();
+  int deleted1 = 0;
+  DeleteCounter* d1 = new DeleteCounter(&deleted1);
   {
-    HandleScope scope(i_isolate);
-    Managed<DeleteRecorder>::Allocate(i_isolate, &deleted);
+    std::shared_ptr<DeleteCounter> shared1(d1);
+    {
+      HandleScope scope(i_isolate);
+      auto handle =
+          Managed<DeleteCounter>::FromSharedPtr(i_isolate, 0, shared1);
+      USE(handle);
+    }
+    isolate->Exit();
+    isolate->Dispose();
+    CHECK_EQ(0, deleted1);
   }
-  // TODO(ulan): It should be possible to trigger a normal gc before the
-  // "critical" one, and the "critical" one should still process pending
-  // second-pass phantom callbacks (crbug.com/v8/7628).
-  // CcTest::CollectAllGarbage();
-  CcTest::CollectAllAvailableGarbage();
+  // Should be deleted after the second shared pointer is destroyed.
+  CHECK_EQ(1, deleted1);
+}
+
+TEST(DisposeAcrossIsolates) {
+  v8::Isolate::CreateParams create_params;
+  create_params.array_buffer_allocator =
+      CcTest::InitIsolateOnce()->array_buffer_allocator();
+
+  int deleted = 0;
+  DeleteCounter* delete_counter = new DeleteCounter(&deleted);
+
+  v8::Isolate* isolate1 = v8::Isolate::New(create_params);
+  Isolate* i_isolate1 = reinterpret_cast<i::Isolate*>(isolate1);
+  isolate1->Enter();
+  {
+    HandleScope scope1(i_isolate1);
+    auto handle1 =
+        Managed<DeleteCounter>::FromRawPtr(i_isolate1, 0, delete_counter);
+
+    v8::Isolate* isolate2 = v8::Isolate::New(create_params);
+    Isolate* i_isolate2 = reinterpret_cast<i::Isolate*>(isolate2);
+    isolate2->Enter();
+    {
+      HandleScope scope(i_isolate2);
+      auto handle2 =
+          Managed<DeleteCounter>::FromSharedPtr(i_isolate2, 0, handle1->get());
+      USE(handle2);
+    }
+    isolate2->Exit();
+    isolate2->Dispose();
+    CHECK_EQ(0, deleted);
+  }
+  // Should be deleted after the first isolate is destroyed.
+  isolate1->Exit();
+  isolate1->Dispose();
+  CHECK_EQ(1, deleted);
+}
+
+TEST(CollectAcrossIsolates) {
+  v8::Isolate::CreateParams create_params;
+  create_params.array_buffer_allocator =
+      CcTest::InitIsolateOnce()->array_buffer_allocator();
+
+  int deleted = 0;
+  DeleteCounter* delete_counter = new DeleteCounter(&deleted);
 
-  CHECK(deleted);
+  v8::Isolate* isolate1 = v8::Isolate::New(create_params);
+  Isolate* i_isolate1 = reinterpret_cast<i::Isolate*>(isolate1);
+  isolate1->Enter();
+  {
+    HandleScope scope1(i_isolate1);
+    auto handle1 =
+        Managed<DeleteCounter>::FromRawPtr(i_isolate1, 0, delete_counter);
+
+    v8::Isolate* isolate2 = v8::Isolate::New(create_params);
+    Isolate* i_isolate2 = reinterpret_cast<i::Isolate*>(isolate2);
+    isolate2->Enter();
+    {
+      HandleScope scope(i_isolate2);
+      auto handle2 =
+          Managed<DeleteCounter>::FromSharedPtr(i_isolate2, 0, handle1->get());
+      USE(handle2);
+    }
+    i_isolate2->heap()->CollectAllAvailableGarbage(
+        i::GarbageCollectionReason::kTesting);
+    CHECK_EQ(0, deleted);
+    isolate2->Exit();
+    isolate2->Dispose();
+    CHECK_EQ(0, deleted);
+  }
+  // Should be deleted after the first isolate is destroyed.
+  i_isolate1->heap()->CollectAllAvailableGarbage(
+      i::GarbageCollectionReason::kTesting);
+  CHECK_EQ(1, deleted);
+  isolate1->Exit();
+  isolate1->Dispose();
+  CHECK_EQ(1, deleted);
 }
 
 }  // namespace internal
diff --git a/deps/v8/test/cctest/test-mementos.cc b/deps/v8/test/cctest/test-mementos.cc
index e7bb141ec322d8..59653ccd731f01 100644
--- a/deps/v8/test/cctest/test-mementos.cc
+++ b/deps/v8/test/cctest/test-mementos.cc
@@ -51,8 +51,8 @@ static void SetUpNewSpaceWithPoisonedMementoAtTop() {
   // site pointer.
   AllocationMemento* memento =
       reinterpret_cast<AllocationMemento*>(new_space->top() + kHeapObjectTag);
-  memento->set_map_after_allocation(heap->allocation_memento_map(),
-                                    SKIP_WRITE_BARRIER);
+  memento->set_map_after_allocation(
+      ReadOnlyRoots(heap).allocation_memento_map(), SKIP_WRITE_BARRIER);
   memento->set_allocation_site(
       reinterpret_cast<AllocationSite*>(kHeapObjectTag), SKIP_WRITE_BARRIER);
 }
diff --git a/deps/v8/test/cctest/test-object.cc b/deps/v8/test/cctest/test-object.cc
index 0a2c066e251612..4a2dccae6ddfdc 100644
--- a/deps/v8/test/cctest/test-object.cc
+++ b/deps/v8/test/cctest/test-object.cc
@@ -181,9 +181,11 @@ TEST(EnumCache) {
   // Creating the EnumCache for {c} will create a new EnumCache on the shared
   // DescriptorArray.
   Handle<EnumCache> previous_enum_cache(
-      a->map()->instance_descriptors()->GetEnumCache());
-  Handle<FixedArray> previous_keys(previous_enum_cache->keys());
-  Handle<FixedArray> previous_indices(previous_enum_cache->indices());
+      a->map()->instance_descriptors()->GetEnumCache(), a->GetIsolate());
+  Handle<FixedArray> previous_keys(previous_enum_cache->keys(),
+                                   a->GetIsolate());
+  Handle<FixedArray> previous_indices(previous_enum_cache->indices(),
+                                      a->GetIsolate());
   CompileRun("var s = 0; for (let key in c) { s += c[key] };");
   {
     CHECK_EQ(a->map()->EnumLength(), 1);
@@ -217,9 +219,9 @@ TEST(EnumCache) {
   // {b} can reuse the existing EnumCache, hence we only need to set the correct
   // EnumLength on the map without modifying the cache itself.
   previous_enum_cache =
-      handle(a->map()->instance_descriptors()->GetEnumCache());
-  previous_keys = handle(previous_enum_cache->keys());
-  previous_indices = handle(previous_enum_cache->indices());
+      handle(a->map()->instance_descriptors()->GetEnumCache(), a->GetIsolate());
+  previous_keys = handle(previous_enum_cache->keys(), a->GetIsolate());
+  previous_indices = handle(previous_enum_cache->indices(), a->GetIsolate());
   CompileRun("var s = 0; for (let key in b) { s += b[key] };");
   {
     CHECK_EQ(a->map()->EnumLength(), 1);
diff --git a/deps/v8/test/cctest/test-orderedhashtable.cc b/deps/v8/test/cctest/test-orderedhashtable.cc
index d4809f45621b67..e680d38287cc0b 100644
--- a/deps/v8/test/cctest/test-orderedhashtable.cc
+++ b/deps/v8/test/cctest/test-orderedhashtable.cc
@@ -5,6 +5,7 @@
 #include "src/v8.h"
 
 #include "src/objects-inl.h"
+#include "src/objects/ordered-hash-table-inl.h"
 #include "test/cctest/cctest.h"
 
 namespace v8 {
@@ -20,9 +21,9 @@ void CopyHashCode(Handle<JSReceiver> from, Handle<JSReceiver> to) {
   to->SetIdentityHash(hash);
 }
 
-void Verify(Handle<HeapObject> obj) {
+void Verify(Isolate* isolate, Handle<HeapObject> obj) {
 #if VERIFY_HEAP
-  obj->ObjectVerify();
+  obj->ObjectVerify(isolate);
 #endif
 }
 
@@ -33,37 +34,37 @@ TEST(SmallOrderedHashSetInsertion) {
   HandleScope scope(isolate);
 
   Handle<SmallOrderedHashSet> set = factory->NewSmallOrderedHashSet();
-  Verify(set);
+  Verify(isolate, set);
   CHECK_EQ(2, set->NumberOfBuckets());
   CHECK_EQ(0, set->NumberOfElements());
 
   // Add a new key.
   Handle<Smi> key1(Smi::FromInt(1), isolate);
   CHECK(!set->HasKey(isolate, key1));
-  set = SmallOrderedHashSet::Add(set, key1);
-  Verify(set);
+  set = SmallOrderedHashSet::Add(isolate, set, key1).ToHandleChecked();
+  Verify(isolate, set);
   CHECK_EQ(2, set->NumberOfBuckets());
   CHECK_EQ(1, set->NumberOfElements());
   CHECK(set->HasKey(isolate, key1));
 
   // Add existing key.
-  set = SmallOrderedHashSet::Add(set, key1);
-  Verify(set);
+  set = SmallOrderedHashSet::Add(isolate, set, key1).ToHandleChecked();
+  Verify(isolate, set);
   CHECK_EQ(2, set->NumberOfBuckets());
   CHECK_EQ(1, set->NumberOfElements());
   CHECK(set->HasKey(isolate, key1));
 
   Handle<String> key2 = factory->NewStringFromAsciiChecked("foo");
   CHECK(!set->HasKey(isolate, key2));
-  set = SmallOrderedHashSet::Add(set, key2);
-  Verify(set);
+  set = SmallOrderedHashSet::Add(isolate, set, key2).ToHandleChecked();
+  Verify(isolate, set);
   CHECK_EQ(2, set->NumberOfBuckets());
   CHECK_EQ(2, set->NumberOfElements());
   CHECK(set->HasKey(isolate, key1));
   CHECK(set->HasKey(isolate, key2));
 
-  set = SmallOrderedHashSet::Add(set, key2);
-  Verify(set);
+  set = SmallOrderedHashSet::Add(isolate, set, key2).ToHandleChecked();
+  Verify(isolate, set);
   CHECK_EQ(2, set->NumberOfBuckets());
   CHECK_EQ(2, set->NumberOfElements());
   CHECK(set->HasKey(isolate, key1));
@@ -71,16 +72,16 @@ TEST(SmallOrderedHashSetInsertion) {
 
   Handle<Symbol> key3 = factory->NewSymbol();
   CHECK(!set->HasKey(isolate, key3));
-  set = SmallOrderedHashSet::Add(set, key3);
-  Verify(set);
+  set = SmallOrderedHashSet::Add(isolate, set, key3).ToHandleChecked();
+  Verify(isolate, set);
   CHECK_EQ(2, set->NumberOfBuckets());
   CHECK_EQ(3, set->NumberOfElements());
   CHECK(set->HasKey(isolate, key1));
   CHECK(set->HasKey(isolate, key2));
   CHECK(set->HasKey(isolate, key3));
 
-  set = SmallOrderedHashSet::Add(set, key3);
-  Verify(set);
+  set = SmallOrderedHashSet::Add(isolate, set, key3).ToHandleChecked();
+  Verify(isolate, set);
   CHECK_EQ(2, set->NumberOfBuckets());
   CHECK_EQ(3, set->NumberOfElements());
   CHECK(set->HasKey(isolate, key1));
@@ -89,8 +90,8 @@ TEST(SmallOrderedHashSetInsertion) {
 
   Handle<Object> key4 = factory->NewHeapNumber(42.0);
   CHECK(!set->HasKey(isolate, key4));
-  set = SmallOrderedHashSet::Add(set, key4);
-  Verify(set);
+  set = SmallOrderedHashSet::Add(isolate, set, key4).ToHandleChecked();
+  Verify(isolate, set);
   CHECK_EQ(2, set->NumberOfBuckets());
   CHECK_EQ(4, set->NumberOfElements());
   CHECK(set->HasKey(isolate, key1));
@@ -98,8 +99,8 @@ TEST(SmallOrderedHashSetInsertion) {
   CHECK(set->HasKey(isolate, key3));
   CHECK(set->HasKey(isolate, key4));
 
-  set = SmallOrderedHashSet::Add(set, key4);
-  Verify(set);
+  set = SmallOrderedHashSet::Add(isolate, set, key4).ToHandleChecked();
+  Verify(isolate, set);
   CHECK_EQ(2, set->NumberOfBuckets());
   CHECK_EQ(4, set->NumberOfElements());
   CHECK(set->HasKey(isolate, key1));
@@ -115,7 +116,7 @@ TEST(SmallOrderedHashMapInsertion) {
   HandleScope scope(isolate);
 
   Handle<SmallOrderedHashMap> map = factory->NewSmallOrderedHashMap();
-  Verify(map);
+  Verify(isolate, map);
   CHECK_EQ(2, map->NumberOfBuckets());
   CHECK_EQ(0, map->NumberOfElements());
 
@@ -123,15 +124,15 @@ TEST(SmallOrderedHashMapInsertion) {
   Handle<Smi> key1(Smi::FromInt(1), isolate);
   Handle<Smi> value1(Smi::FromInt(1), isolate);
   CHECK(!map->HasKey(isolate, key1));
-  map = SmallOrderedHashMap::Add(map, key1, value1);
-  Verify(map);
+  map = SmallOrderedHashMap::Add(isolate, map, key1, value1).ToHandleChecked();
+  Verify(isolate, map);
   CHECK_EQ(2, map->NumberOfBuckets());
   CHECK_EQ(1, map->NumberOfElements());
   CHECK(map->HasKey(isolate, key1));
 
   // Add existing key.
-  map = SmallOrderedHashMap::Add(map, key1, value1);
-  Verify(map);
+  map = SmallOrderedHashMap::Add(isolate, map, key1, value1).ToHandleChecked();
+  Verify(isolate, map);
   CHECK_EQ(2, map->NumberOfBuckets());
   CHECK_EQ(1, map->NumberOfElements());
   CHECK(map->HasKey(isolate, key1));
@@ -139,15 +140,15 @@ TEST(SmallOrderedHashMapInsertion) {
   Handle<String> key2 = factory->NewStringFromAsciiChecked("foo");
   Handle<String> value = factory->NewStringFromAsciiChecked("foo");
   CHECK(!map->HasKey(isolate, key2));
-  map = SmallOrderedHashMap::Add(map, key2, value);
-  Verify(map);
+  map = SmallOrderedHashMap::Add(isolate, map, key2, value).ToHandleChecked();
+  Verify(isolate, map);
   CHECK_EQ(2, map->NumberOfBuckets());
   CHECK_EQ(2, map->NumberOfElements());
   CHECK(map->HasKey(isolate, key1));
   CHECK(map->HasKey(isolate, key2));
 
-  map = SmallOrderedHashMap::Add(map, key2, value);
-  Verify(map);
+  map = SmallOrderedHashMap::Add(isolate, map, key2, value).ToHandleChecked();
+  Verify(isolate, map);
   CHECK_EQ(2, map->NumberOfBuckets());
   CHECK_EQ(2, map->NumberOfElements());
   CHECK(map->HasKey(isolate, key1));
@@ -155,16 +156,16 @@ TEST(SmallOrderedHashMapInsertion) {
 
   Handle<Symbol> key3 = factory->NewSymbol();
   CHECK(!map->HasKey(isolate, key3));
-  map = SmallOrderedHashMap::Add(map, key3, value);
-  Verify(map);
+  map = SmallOrderedHashMap::Add(isolate, map, key3, value).ToHandleChecked();
+  Verify(isolate, map);
   CHECK_EQ(2, map->NumberOfBuckets());
   CHECK_EQ(3, map->NumberOfElements());
   CHECK(map->HasKey(isolate, key1));
   CHECK(map->HasKey(isolate, key2));
   CHECK(map->HasKey(isolate, key3));
 
-  map = SmallOrderedHashMap::Add(map, key3, value);
-  Verify(map);
+  map = SmallOrderedHashMap::Add(isolate, map, key3, value).ToHandleChecked();
+  Verify(isolate, map);
   CHECK_EQ(2, map->NumberOfBuckets());
   CHECK_EQ(3, map->NumberOfElements());
   CHECK(map->HasKey(isolate, key1));
@@ -173,8 +174,8 @@ TEST(SmallOrderedHashMapInsertion) {
 
   Handle<Object> key4 = factory->NewHeapNumber(42.0);
   CHECK(!map->HasKey(isolate, key4));
-  map = SmallOrderedHashMap::Add(map, key4, value);
-  Verify(map);
+  map = SmallOrderedHashMap::Add(isolate, map, key4, value).ToHandleChecked();
+  Verify(isolate, map);
   CHECK_EQ(2, map->NumberOfBuckets());
   CHECK_EQ(4, map->NumberOfElements());
   CHECK(map->HasKey(isolate, key1));
@@ -182,8 +183,8 @@ TEST(SmallOrderedHashMapInsertion) {
   CHECK(map->HasKey(isolate, key3));
   CHECK(map->HasKey(isolate, key4));
 
-  map = SmallOrderedHashMap::Add(map, key4, value);
-  Verify(map);
+  map = SmallOrderedHashMap::Add(isolate, map, key4, value).ToHandleChecked();
+  Verify(isolate, map);
   CHECK_EQ(2, map->NumberOfBuckets());
   CHECK_EQ(4, map->NumberOfElements());
   CHECK(map->HasKey(isolate, key1));
@@ -200,8 +201,8 @@ TEST(SmallOrderedHashSetDuplicateHashCode) {
 
   Handle<SmallOrderedHashSet> set = factory->NewSmallOrderedHashSet();
   Handle<JSObject> key1 = factory->NewJSObjectWithNullProto();
-  set = SmallOrderedHashSet::Add(set, key1);
-  Verify(set);
+  set = SmallOrderedHashSet::Add(isolate, set, key1).ToHandleChecked();
+  Verify(isolate, set);
   CHECK_EQ(2, set->NumberOfBuckets());
   CHECK_EQ(1, set->NumberOfElements());
   CHECK(set->HasKey(isolate, key1));
@@ -209,8 +210,8 @@ TEST(SmallOrderedHashSetDuplicateHashCode) {
   Handle<JSObject> key2 = factory->NewJSObjectWithNullProto();
   CopyHashCode(key1, key2);
 
-  set = SmallOrderedHashSet::Add(set, key2);
-  Verify(set);
+  set = SmallOrderedHashSet::Add(isolate, set, key2).ToHandleChecked();
+  Verify(isolate, set);
   CHECK_EQ(2, set->NumberOfBuckets());
   CHECK_EQ(2, set->NumberOfElements());
   CHECK(set->HasKey(isolate, key1));
@@ -226,8 +227,8 @@ TEST(SmallOrderedHashMapDuplicateHashCode) {
   Handle<SmallOrderedHashMap> map = factory->NewSmallOrderedHashMap();
   Handle<JSObject> value = factory->NewJSObjectWithNullProto();
   Handle<JSObject> key1 = factory->NewJSObjectWithNullProto();
-  map = SmallOrderedHashMap::Add(map, key1, value);
-  Verify(map);
+  map = SmallOrderedHashMap::Add(isolate, map, key1, value).ToHandleChecked();
+  Verify(isolate, map);
   CHECK_EQ(2, map->NumberOfBuckets());
   CHECK_EQ(1, map->NumberOfElements());
   CHECK(map->HasKey(isolate, key1));
@@ -240,8 +241,8 @@ TEST(SmallOrderedHashMapDuplicateHashCode) {
   Object* hash2 = key2->GetHash();
   CHECK_EQ(hash1, hash2);
 
-  map = SmallOrderedHashMap::Add(map, key2, value);
-  Verify(map);
+  map = SmallOrderedHashMap::Add(isolate, map, key2, value).ToHandleChecked();
+  Verify(isolate, map);
   CHECK_EQ(2, map->NumberOfBuckets());
   CHECK_EQ(2, map->NumberOfElements());
   CHECK(map->HasKey(isolate, key1));
@@ -262,109 +263,109 @@ TEST(SmallOrderedHashSetGrow) {
   }
 
   for (size_t i = 0; i < 4; i++) {
-    set = SmallOrderedHashSet::Add(set, keys[i]);
-    Verify(set);
+    set = SmallOrderedHashSet::Add(isolate, set, keys[i]).ToHandleChecked();
+    Verify(isolate, set);
   }
 
   for (size_t i = 0; i < 4; i++) {
     CHECK(set->HasKey(isolate, keys[i]));
-    Verify(set);
+    Verify(isolate, set);
   }
 
   CHECK_EQ(4, set->NumberOfElements());
   CHECK_EQ(2, set->NumberOfBuckets());
   CHECK_EQ(0, set->NumberOfDeletedElements());
-  Verify(set);
+  Verify(isolate, set);
 
   for (size_t i = 4; i < 8; i++) {
-    set = SmallOrderedHashSet::Add(set, keys[i]);
-    Verify(set);
+    set = SmallOrderedHashSet::Add(isolate, set, keys[i]).ToHandleChecked();
+    Verify(isolate, set);
   }
 
   for (size_t i = 0; i < 8; i++) {
     CHECK(set->HasKey(isolate, keys[i]));
-    Verify(set);
+    Verify(isolate, set);
   }
 
   CHECK_EQ(8, set->NumberOfElements());
   CHECK_EQ(4, set->NumberOfBuckets());
   CHECK_EQ(0, set->NumberOfDeletedElements());
-  Verify(set);
+  Verify(isolate, set);
 
   for (size_t i = 8; i < 16; i++) {
-    set = SmallOrderedHashSet::Add(set, keys[i]);
-    Verify(set);
+    set = SmallOrderedHashSet::Add(isolate, set, keys[i]).ToHandleChecked();
+    Verify(isolate, set);
   }
 
   for (size_t i = 0; i < 16; i++) {
     CHECK(set->HasKey(isolate, keys[i]));
-    Verify(set);
+    Verify(isolate, set);
   }
 
   CHECK_EQ(16, set->NumberOfElements());
   CHECK_EQ(8, set->NumberOfBuckets());
   CHECK_EQ(0, set->NumberOfDeletedElements());
-  Verify(set);
+  Verify(isolate, set);
 
   for (size_t i = 16; i < 32; i++) {
-    set = SmallOrderedHashSet::Add(set, keys[i]);
-    Verify(set);
+    set = SmallOrderedHashSet::Add(isolate, set, keys[i]).ToHandleChecked();
+    Verify(isolate, set);
   }
 
   for (size_t i = 0; i < 32; i++) {
     CHECK(set->HasKey(isolate, keys[i]));
-    Verify(set);
+    Verify(isolate, set);
   }
 
   CHECK_EQ(32, set->NumberOfElements());
   CHECK_EQ(16, set->NumberOfBuckets());
   CHECK_EQ(0, set->NumberOfDeletedElements());
-  Verify(set);
+  Verify(isolate, set);
 
   for (size_t i = 32; i < 64; i++) {
-    set = SmallOrderedHashSet::Add(set, keys[i]);
-    Verify(set);
+    set = SmallOrderedHashSet::Add(isolate, set, keys[i]).ToHandleChecked();
+    Verify(isolate, set);
   }
 
   for (size_t i = 0; i < 64; i++) {
     CHECK(set->HasKey(isolate, keys[i]));
-    Verify(set);
+    Verify(isolate, set);
   }
 
   CHECK_EQ(64, set->NumberOfElements());
   CHECK_EQ(32, set->NumberOfBuckets());
   CHECK_EQ(0, set->NumberOfDeletedElements());
-  Verify(set);
+  Verify(isolate, set);
 
   for (size_t i = 64; i < 128; i++) {
-    set = SmallOrderedHashSet::Add(set, keys[i]);
-    Verify(set);
+    set = SmallOrderedHashSet::Add(isolate, set, keys[i]).ToHandleChecked();
+    Verify(isolate, set);
   }
 
   for (size_t i = 0; i < 128; i++) {
     CHECK(set->HasKey(isolate, keys[i]));
-    Verify(set);
+    Verify(isolate, set);
   }
 
   CHECK_EQ(128, set->NumberOfElements());
   CHECK_EQ(64, set->NumberOfBuckets());
   CHECK_EQ(0, set->NumberOfDeletedElements());
-  Verify(set);
+  Verify(isolate, set);
 
   for (size_t i = 128; i < 254; i++) {
-    set = SmallOrderedHashSet::Add(set, keys[i]);
-    Verify(set);
+    set = SmallOrderedHashSet::Add(isolate, set, keys[i]).ToHandleChecked();
+    Verify(isolate, set);
   }
 
   for (size_t i = 0; i < 254; i++) {
     CHECK(set->HasKey(isolate, keys[i]));
-    Verify(set);
+    Verify(isolate, set);
   }
 
   CHECK_EQ(254, set->NumberOfElements());
   CHECK_EQ(127, set->NumberOfBuckets());
   CHECK_EQ(0, set->NumberOfDeletedElements());
-  Verify(set);
+  Verify(isolate, set);
 }
 
 TEST(SmallOrderedHashMapGrow) {
@@ -381,109 +382,116 @@ TEST(SmallOrderedHashMapGrow) {
   }
 
   for (size_t i = 0; i < 4; i++) {
-    map = SmallOrderedHashMap::Add(map, keys[i], keys[i]);
-    Verify(map);
+    map = SmallOrderedHashMap::Add(isolate, map, keys[i], keys[i])
+              .ToHandleChecked();
+    Verify(isolate, map);
   }
 
   for (size_t i = 0; i < 4; i++) {
     CHECK(map->HasKey(isolate, keys[i]));
-    Verify(map);
+    Verify(isolate, map);
   }
 
   CHECK_EQ(4, map->NumberOfElements());
   CHECK_EQ(2, map->NumberOfBuckets());
   CHECK_EQ(0, map->NumberOfDeletedElements());
-  Verify(map);
+  Verify(isolate, map);
 
   for (size_t i = 4; i < 8; i++) {
-    map = SmallOrderedHashMap::Add(map, keys[i], keys[i]);
-    Verify(map);
+    map = SmallOrderedHashMap::Add(isolate, map, keys[i], keys[i])
+              .ToHandleChecked();
+    Verify(isolate, map);
   }
 
   for (size_t i = 0; i < 8; i++) {
     CHECK(map->HasKey(isolate, keys[i]));
-    Verify(map);
+    Verify(isolate, map);
   }
 
   CHECK_EQ(8, map->NumberOfElements());
   CHECK_EQ(4, map->NumberOfBuckets());
   CHECK_EQ(0, map->NumberOfDeletedElements());
-  Verify(map);
+  Verify(isolate, map);
 
   for (size_t i = 8; i < 16; i++) {
-    map = SmallOrderedHashMap::Add(map, keys[i], keys[i]);
-    Verify(map);
+    map = SmallOrderedHashMap::Add(isolate, map, keys[i], keys[i])
+              .ToHandleChecked();
+    Verify(isolate, map);
   }
 
   for (size_t i = 0; i < 16; i++) {
     CHECK(map->HasKey(isolate, keys[i]));
-    Verify(map);
+    Verify(isolate, map);
   }
 
   CHECK_EQ(16, map->NumberOfElements());
   CHECK_EQ(8, map->NumberOfBuckets());
   CHECK_EQ(0, map->NumberOfDeletedElements());
-  Verify(map);
+  Verify(isolate, map);
 
   for (size_t i = 16; i < 32; i++) {
-    map = SmallOrderedHashMap::Add(map, keys[i], keys[i]);
-    Verify(map);
+    map = SmallOrderedHashMap::Add(isolate, map, keys[i], keys[i])
+              .ToHandleChecked();
+    Verify(isolate, map);
   }
 
   for (size_t i = 0; i < 32; i++) {
     CHECK(map->HasKey(isolate, keys[i]));
-    Verify(map);
+    Verify(isolate, map);
   }
 
   CHECK_EQ(32, map->NumberOfElements());
   CHECK_EQ(16, map->NumberOfBuckets());
   CHECK_EQ(0, map->NumberOfDeletedElements());
-  Verify(map);
+  Verify(isolate, map);
 
   for (size_t i = 32; i < 64; i++) {
-    map = SmallOrderedHashMap::Add(map, keys[i], keys[i]);
-    Verify(map);
+    map = SmallOrderedHashMap::Add(isolate, map, keys[i], keys[i])
+              .ToHandleChecked();
+    Verify(isolate, map);
   }
 
   for (size_t i = 0; i < 64; i++) {
     CHECK(map->HasKey(isolate, keys[i]));
-    Verify(map);
+    Verify(isolate, map);
   }
 
   CHECK_EQ(64, map->NumberOfElements());
   CHECK_EQ(32, map->NumberOfBuckets());
   CHECK_EQ(0, map->NumberOfDeletedElements());
-  Verify(map);
+  Verify(isolate, map);
 
   for (size_t i = 64; i < 128; i++) {
-    map = SmallOrderedHashMap::Add(map, keys[i], keys[i]);
-    Verify(map);
+    map = SmallOrderedHashMap::Add(isolate, map, keys[i], keys[i])
+              .ToHandleChecked();
+    Verify(isolate, map);
   }
 
   for (size_t i = 0; i < 128; i++) {
     CHECK(map->HasKey(isolate, keys[i]));
-    Verify(map);
+    Verify(isolate, map);
   }
 
   CHECK_EQ(128, map->NumberOfElements());
   CHECK_EQ(64, map->NumberOfBuckets());
   CHECK_EQ(0, map->NumberOfDeletedElements());
-  Verify(map);
+  Verify(isolate, map);
 
   for (size_t i = 128; i < 254; i++) {
-    map = SmallOrderedHashMap::Add(map, keys[i], keys[i]);
-    Verify(map);
+    map = SmallOrderedHashMap::Add(isolate, map, keys[i], keys[i])
+              .ToHandleChecked();
+    Verify(isolate, map);
   }
 
   for (size_t i = 0; i < 254; i++) {
     CHECK(map->HasKey(isolate, keys[i]));
-    Verify(map);
+    Verify(isolate, map);
   }
 
   CHECK_EQ(254, map->NumberOfElements());
   CHECK_EQ(127, map->NumberOfBuckets());
   CHECK_EQ(0, map->NumberOfDeletedElements());
-  Verify(map);
+  Verify(isolate, map);
 }
 
 TEST(OrderedHashTableInsertion) {
@@ -493,7 +501,7 @@ TEST(OrderedHashTableInsertion) {
   HandleScope scope(isolate);
 
   Handle<OrderedHashMap> map = factory->NewOrderedHashMap();
-  Verify(map);
+  Verify(isolate, map);
   CHECK_EQ(2, map->NumberOfBuckets());
   CHECK_EQ(0, map->NumberOfElements());
 
@@ -501,15 +509,15 @@ TEST(OrderedHashTableInsertion) {
   Handle<Smi> key1(Smi::FromInt(1), isolate);
   Handle<Smi> value1(Smi::FromInt(1), isolate);
   CHECK(!OrderedHashMap::HasKey(isolate, *map, *key1));
-  map = OrderedHashMap::Add(map, key1, value1);
-  Verify(map);
+  map = OrderedHashMap::Add(isolate, map, key1, value1);
+  Verify(isolate, map);
   CHECK_EQ(2, map->NumberOfBuckets());
   CHECK_EQ(1, map->NumberOfElements());
   CHECK(OrderedHashMap::HasKey(isolate, *map, *key1));
 
   // Add existing key.
-  map = OrderedHashMap::Add(map, key1, value1);
-  Verify(map);
+  map = OrderedHashMap::Add(isolate, map, key1, value1);
+  Verify(isolate, map);
   CHECK_EQ(2, map->NumberOfBuckets());
   CHECK_EQ(1, map->NumberOfElements());
   CHECK(OrderedHashMap::HasKey(isolate, *map, *key1));
@@ -517,15 +525,15 @@ TEST(OrderedHashTableInsertion) {
   Handle<String> key2 = factory->NewStringFromAsciiChecked("foo");
   Handle<String> value = factory->NewStringFromAsciiChecked("bar");
   CHECK(!OrderedHashMap::HasKey(isolate, *map, *key2));
-  map = OrderedHashMap::Add(map, key2, value);
-  Verify(map);
+  map = OrderedHashMap::Add(isolate, map, key2, value);
+  Verify(isolate, map);
   CHECK_EQ(2, map->NumberOfBuckets());
   CHECK_EQ(2, map->NumberOfElements());
   CHECK(OrderedHashMap::HasKey(isolate, *map, *key1));
   CHECK(OrderedHashMap::HasKey(isolate, *map, *key2));
 
-  map = OrderedHashMap::Add(map, key2, value);
-  Verify(map);
+  map = OrderedHashMap::Add(isolate, map, key2, value);
+  Verify(isolate, map);
   CHECK_EQ(2, map->NumberOfBuckets());
   CHECK_EQ(2, map->NumberOfElements());
   CHECK(OrderedHashMap::HasKey(isolate, *map, *key1));
@@ -533,16 +541,16 @@ TEST(OrderedHashTableInsertion) {
 
   Handle<Symbol> key3 = factory->NewSymbol();
   CHECK(!OrderedHashMap::HasKey(isolate, *map, *key3));
-  map = OrderedHashMap::Add(map, key3, value);
-  Verify(map);
+  map = OrderedHashMap::Add(isolate, map, key3, value);
+  Verify(isolate, map);
   CHECK_EQ(2, map->NumberOfBuckets());
   CHECK_EQ(3, map->NumberOfElements());
   CHECK(OrderedHashMap::HasKey(isolate, *map, *key1));
   CHECK(OrderedHashMap::HasKey(isolate, *map, *key2));
   CHECK(OrderedHashMap::HasKey(isolate, *map, *key3));
 
-  map = OrderedHashMap::Add(map, key3, value);
-  Verify(map);
+  map = OrderedHashMap::Add(isolate, map, key3, value);
+  Verify(isolate, map);
   CHECK_EQ(2, map->NumberOfBuckets());
   CHECK_EQ(3, map->NumberOfElements());
   CHECK(OrderedHashMap::HasKey(isolate, *map, *key1));
@@ -551,8 +559,8 @@ TEST(OrderedHashTableInsertion) {
 
   Handle<Object> key4 = factory->NewHeapNumber(42.0);
   CHECK(!OrderedHashMap::HasKey(isolate, *map, *key4));
-  map = OrderedHashMap::Add(map, key4, value);
-  Verify(map);
+  map = OrderedHashMap::Add(isolate, map, key4, value);
+  Verify(isolate, map);
   CHECK_EQ(2, map->NumberOfBuckets());
   CHECK_EQ(4, map->NumberOfElements());
   CHECK(OrderedHashMap::HasKey(isolate, *map, *key1));
@@ -560,8 +568,8 @@ TEST(OrderedHashTableInsertion) {
   CHECK(OrderedHashMap::HasKey(isolate, *map, *key3));
   CHECK(OrderedHashMap::HasKey(isolate, *map, *key4));
 
-  map = OrderedHashMap::Add(map, key4, value);
-  Verify(map);
+  map = OrderedHashMap::Add(isolate, map, key4, value);
+  Verify(isolate, map);
   CHECK_EQ(2, map->NumberOfBuckets());
   CHECK_EQ(4, map->NumberOfElements());
   CHECK(OrderedHashMap::HasKey(isolate, *map, *key1));
@@ -579,8 +587,8 @@ TEST(OrderedHashMapDuplicateHashCode) {
   Handle<OrderedHashMap> map = factory->NewOrderedHashMap();
   Handle<JSObject> key1 = factory->NewJSObjectWithNullProto();
   Handle<JSObject> value = factory->NewJSObjectWithNullProto();
-  map = OrderedHashMap::Add(map, key1, value);
-  Verify(map);
+  map = OrderedHashMap::Add(isolate, map, key1, value);
+  Verify(isolate, map);
   CHECK_EQ(2, map->NumberOfBuckets());
   CHECK_EQ(1, map->NumberOfElements());
   CHECK(OrderedHashMap::HasKey(isolate, *map, *key1));
@@ -588,8 +596,8 @@ TEST(OrderedHashMapDuplicateHashCode) {
   Handle<JSObject> key2 = factory->NewJSObjectWithNullProto();
   CopyHashCode(key1, key2);
 
-  map = OrderedHashMap::Add(map, key2, value);
-  Verify(map);
+  map = OrderedHashMap::Add(isolate, map, key2, value);
+  Verify(isolate, map);
   CHECK_EQ(2, map->NumberOfBuckets());
   CHECK_EQ(2, map->NumberOfElements());
   CHECK(OrderedHashMap::HasKey(isolate, *map, *key1));
@@ -605,7 +613,7 @@ TEST(OrderedHashMapDeletion) {
   Handle<String> value = factory->NewStringFromAsciiChecked("bar");
 
   Handle<OrderedHashMap> map = factory->NewOrderedHashMap();
-  Verify(map);
+  Verify(isolate, map);
   CHECK_EQ(2, map->NumberOfBuckets());
   CHECK_EQ(0, map->NumberOfElements());
   CHECK_EQ(0, map->NumberOfDeletedElements());
@@ -613,14 +621,14 @@ TEST(OrderedHashMapDeletion) {
   // Delete from an empty hash table
   Handle<Smi> key1(Smi::FromInt(1), isolate);
   CHECK(!OrderedHashMap::Delete(isolate, *map, *key1));
-  Verify(map);
+  Verify(isolate, map);
   CHECK_EQ(2, map->NumberOfBuckets());
   CHECK_EQ(0, map->NumberOfElements());
   CHECK_EQ(0, map->NumberOfDeletedElements());
   CHECK(!OrderedHashMap::HasKey(isolate, *map, *key1));
 
-  map = OrderedHashMap::Add(map, key1, value1);
-  Verify(map);
+  map = OrderedHashMap::Add(isolate, map, key1, value1);
+  Verify(isolate, map);
   CHECK_EQ(2, map->NumberOfBuckets());
   CHECK_EQ(1, map->NumberOfElements());
   CHECK_EQ(0, map->NumberOfDeletedElements());
@@ -628,14 +636,14 @@ TEST(OrderedHashMapDeletion) {
 
   // Delete single existing key
   CHECK(OrderedHashMap::Delete(isolate, *map, *key1));
-  Verify(map);
+  Verify(isolate, map);
   CHECK_EQ(2, map->NumberOfBuckets());
   CHECK_EQ(0, map->NumberOfElements());
   CHECK_EQ(1, map->NumberOfDeletedElements());
   CHECK(!OrderedHashMap::HasKey(isolate, *map, *key1));
 
-  map = OrderedHashMap::Add(map, key1, value1);
-  Verify(map);
+  map = OrderedHashMap::Add(isolate, map, key1, value1);
+  Verify(isolate, map);
   CHECK_EQ(2, map->NumberOfBuckets());
   CHECK_EQ(1, map->NumberOfElements());
   CHECK_EQ(1, map->NumberOfDeletedElements());
@@ -643,8 +651,8 @@ TEST(OrderedHashMapDeletion) {
 
   Handle<String> key2 = factory->NewStringFromAsciiChecked("foo");
   CHECK(!OrderedHashMap::HasKey(isolate, *map, *key2));
-  map = OrderedHashMap::Add(map, key2, value);
-  Verify(map);
+  map = OrderedHashMap::Add(isolate, map, key2, value);
+  Verify(isolate, map);
   CHECK_EQ(2, map->NumberOfBuckets());
   CHECK_EQ(2, map->NumberOfElements());
   CHECK_EQ(1, map->NumberOfDeletedElements());
@@ -652,8 +660,8 @@ TEST(OrderedHashMapDeletion) {
 
   Handle<Symbol> key3 = factory->NewSymbol();
   CHECK(!OrderedHashMap::HasKey(isolate, *map, *key3));
-  map = OrderedHashMap::Add(map, key3, value);
-  Verify(map);
+  map = OrderedHashMap::Add(isolate, map, key3, value);
+  Verify(isolate, map);
   CHECK_EQ(2, map->NumberOfBuckets());
   CHECK_EQ(3, map->NumberOfElements());
   CHECK_EQ(1, map->NumberOfDeletedElements());
@@ -663,7 +671,7 @@ TEST(OrderedHashMapDeletion) {
 
   // Delete multiple existing keys
   CHECK(OrderedHashMap::Delete(isolate, *map, *key1));
-  Verify(map);
+  Verify(isolate, map);
   CHECK_EQ(2, map->NumberOfBuckets());
   CHECK_EQ(2, map->NumberOfElements());
   CHECK_EQ(2, map->NumberOfDeletedElements());
@@ -672,7 +680,7 @@ TEST(OrderedHashMapDeletion) {
   CHECK(OrderedHashMap::HasKey(isolate, *map, *key3));
 
   CHECK(OrderedHashMap::Delete(isolate, *map, *key2));
-  Verify(map);
+  Verify(isolate, map);
   CHECK_EQ(2, map->NumberOfBuckets());
   CHECK_EQ(1, map->NumberOfElements());
   CHECK_EQ(3, map->NumberOfDeletedElements());
@@ -681,7 +689,7 @@ TEST(OrderedHashMapDeletion) {
   CHECK(OrderedHashMap::HasKey(isolate, *map, *key3));
 
   CHECK(OrderedHashMap::Delete(isolate, *map, *key3));
-  Verify(map);
+  Verify(isolate, map);
   CHECK_EQ(2, map->NumberOfBuckets());
   CHECK_EQ(0, map->NumberOfElements());
   CHECK_EQ(4, map->NumberOfDeletedElements());
@@ -691,7 +699,7 @@ TEST(OrderedHashMapDeletion) {
 
   // Delete non existent key from non new hash table
   CHECK(!OrderedHashMap::Delete(isolate, *map, *key3));
-  Verify(map);
+  Verify(isolate, map);
   CHECK_EQ(2, map->NumberOfBuckets());
   CHECK_EQ(0, map->NumberOfElements());
   CHECK_EQ(4, map->NumberOfDeletedElements());
@@ -700,9 +708,9 @@ TEST(OrderedHashMapDeletion) {
   CHECK(!OrderedHashMap::HasKey(isolate, *map, *key3));
 
   // Delete non existent key from non empty hash table
-  map = OrderedHashMap::Shrink(map);
-  map = OrderedHashMap::Add(map, key1, value);
-  Verify(map);
+  map = OrderedHashMap::Shrink(isolate, map);
+  map = OrderedHashMap::Add(isolate, map, key1, value);
+  Verify(isolate, map);
   CHECK_EQ(2, map->NumberOfBuckets());
   CHECK_EQ(1, map->NumberOfElements());
   CHECK_EQ(0, map->NumberOfDeletedElements());
@@ -710,7 +718,7 @@ TEST(OrderedHashMapDeletion) {
   CHECK(!OrderedHashMap::HasKey(isolate, *map, *key2));
   CHECK(!OrderedHashMap::HasKey(isolate, *map, *key3));
   CHECK(!OrderedHashMap::Delete(isolate, *map, *key2));
-  Verify(map);
+  Verify(isolate, map);
   CHECK_EQ(2, map->NumberOfBuckets());
   CHECK_EQ(1, map->NumberOfElements());
   CHECK_EQ(0, map->NumberOfDeletedElements());
@@ -719,6 +727,128 @@ TEST(OrderedHashMapDeletion) {
   CHECK(!OrderedHashMap::HasKey(isolate, *map, *key3));
 }
 
+TEST(SmallOrderedHashMapDeletion) {
+  LocalContext context;
+  Isolate* isolate = GetIsolateFrom(&context);
+  Factory* factory = isolate->factory();
+  HandleScope scope(isolate);
+  Handle<Smi> value1(Smi::FromInt(1), isolate);
+  Handle<String> value = factory->NewStringFromAsciiChecked("bar");
+
+  Handle<SmallOrderedHashMap> map = factory->NewSmallOrderedHashMap();
+  Verify(isolate, map);
+  CHECK_EQ(2, map->NumberOfBuckets());
+  CHECK_EQ(0, map->NumberOfElements());
+  CHECK_EQ(0, map->NumberOfDeletedElements());
+
+  // Delete from an empty hash table
+  Handle<Smi> key1(Smi::FromInt(1), isolate);
+  CHECK(!SmallOrderedHashMap::Delete(isolate, *map, *key1));
+  Verify(isolate, map);
+  CHECK_EQ(2, map->NumberOfBuckets());
+  CHECK_EQ(0, map->NumberOfElements());
+  CHECK_EQ(0, map->NumberOfDeletedElements());
+  CHECK(!map->HasKey(isolate, key1));
+
+  map = SmallOrderedHashMap::Add(isolate, map, key1, value1).ToHandleChecked();
+  Verify(isolate, map);
+  CHECK_EQ(2, map->NumberOfBuckets());
+  CHECK_EQ(1, map->NumberOfElements());
+  CHECK_EQ(0, map->NumberOfDeletedElements());
+  CHECK(map->HasKey(isolate, key1));
+
+  // Delete single existing key
+  CHECK(SmallOrderedHashMap::Delete(isolate, *map, *key1));
+  Verify(isolate, map);
+  CHECK_EQ(2, map->NumberOfBuckets());
+  CHECK_EQ(0, map->NumberOfElements());
+  CHECK_EQ(1, map->NumberOfDeletedElements());
+  CHECK(!map->HasKey(isolate, key1));
+
+  map = SmallOrderedHashMap::Add(isolate, map, key1, value1).ToHandleChecked();
+  Verify(isolate, map);
+  CHECK_EQ(2, map->NumberOfBuckets());
+  CHECK_EQ(1, map->NumberOfElements());
+  CHECK_EQ(1, map->NumberOfDeletedElements());
+  CHECK(map->HasKey(isolate, key1));
+
+  Handle<String> key2 = factory->NewStringFromAsciiChecked("foo");
+  CHECK(!map->HasKey(isolate, key2));
+  map = SmallOrderedHashMap::Add(isolate, map, key2, value).ToHandleChecked();
+  Verify(isolate, map);
+  CHECK_EQ(2, map->NumberOfBuckets());
+  CHECK_EQ(2, map->NumberOfElements());
+  CHECK_EQ(1, map->NumberOfDeletedElements());
+  CHECK(map->HasKey(isolate, key2));
+
+  Handle<Symbol> key3 = factory->NewSymbol();
+  CHECK(!map->HasKey(isolate, key3));
+  map = SmallOrderedHashMap::Add(isolate, map, key3, value).ToHandleChecked();
+  Verify(isolate, map);
+  CHECK_EQ(2, map->NumberOfBuckets());
+  CHECK_EQ(3, map->NumberOfElements());
+  CHECK_EQ(1, map->NumberOfDeletedElements());
+  CHECK(map->HasKey(isolate, key1));
+  CHECK(map->HasKey(isolate, key2));
+  CHECK(map->HasKey(isolate, key3));
+
+  // Delete multiple existing keys
+  CHECK(SmallOrderedHashMap::Delete(isolate, *map, *key1));
+  Verify(isolate, map);
+  CHECK_EQ(2, map->NumberOfBuckets());
+  CHECK_EQ(2, map->NumberOfElements());
+  CHECK_EQ(2, map->NumberOfDeletedElements());
+  CHECK(!map->HasKey(isolate, key1));
+  CHECK(map->HasKey(isolate, key2));
+  CHECK(map->HasKey(isolate, key3));
+
+  CHECK(SmallOrderedHashMap::Delete(isolate, *map, *key2));
+  Verify(isolate, map);
+  CHECK_EQ(2, map->NumberOfBuckets());
+  CHECK_EQ(1, map->NumberOfElements());
+  CHECK_EQ(3, map->NumberOfDeletedElements());
+  CHECK(!map->HasKey(isolate, key1));
+  CHECK(!map->HasKey(isolate, key2));
+  CHECK(map->HasKey(isolate, key3));
+
+  CHECK(SmallOrderedHashMap::Delete(isolate, *map, *key3));
+  Verify(isolate, map);
+  CHECK_EQ(2, map->NumberOfBuckets());
+  CHECK_EQ(0, map->NumberOfElements());
+  CHECK_EQ(4, map->NumberOfDeletedElements());
+  CHECK(!map->HasKey(isolate, key1));
+  CHECK(!map->HasKey(isolate, key2));
+  CHECK(!map->HasKey(isolate, key3));
+
+  // Delete non existent key from non new hash table
+  CHECK(!SmallOrderedHashMap::Delete(isolate, *map, *key3));
+  Verify(isolate, map);
+  CHECK_EQ(2, map->NumberOfBuckets());
+  CHECK_EQ(0, map->NumberOfElements());
+  CHECK_EQ(4, map->NumberOfDeletedElements());
+  CHECK(!map->HasKey(isolate, key1));
+  CHECK(!map->HasKey(isolate, key2));
+  CHECK(!map->HasKey(isolate, key3));
+
+  // Delete non existent key from non empty hash table
+  map = SmallOrderedHashMap::Add(isolate, map, key1, value).ToHandleChecked();
+  Verify(isolate, map);
+  CHECK_EQ(2, map->NumberOfBuckets());
+  CHECK_EQ(1, map->NumberOfElements());
+  CHECK_EQ(0, map->NumberOfDeletedElements());
+  CHECK(map->HasKey(isolate, key1));
+  CHECK(!map->HasKey(isolate, key2));
+  CHECK(!map->HasKey(isolate, key3));
+  CHECK(!SmallOrderedHashMap::Delete(isolate, *map, *key2));
+  Verify(isolate, map);
+  CHECK_EQ(2, map->NumberOfBuckets());
+  CHECK_EQ(1, map->NumberOfElements());
+  CHECK_EQ(0, map->NumberOfDeletedElements());
+  CHECK(map->HasKey(isolate, key1));
+  CHECK(!map->HasKey(isolate, key2));
+  CHECK(!map->HasKey(isolate, key3));
+}
+
 TEST(OrderedHashMapDuplicateHashCodeDeletion) {
   LocalContext context;
   Isolate* isolate = GetIsolateFrom(&context);
@@ -728,8 +858,8 @@ TEST(OrderedHashMapDuplicateHashCodeDeletion) {
   Handle<OrderedHashMap> map = factory->NewOrderedHashMap();
   Handle<JSObject> key1 = factory->NewJSObjectWithNullProto();
   Handle<JSObject> value = factory->NewJSObjectWithNullProto();
-  map = OrderedHashMap::Add(map, key1, value);
-  Verify(map);
+  map = OrderedHashMap::Add(isolate, map, key1, value);
+  Verify(isolate, map);
   CHECK_EQ(2, map->NumberOfBuckets());
   CHECK_EQ(1, map->NumberOfElements());
   CHECK_EQ(0, map->NumberOfDeletedElements());
@@ -740,7 +870,7 @@ TEST(OrderedHashMapDuplicateHashCodeDeletion) {
 
   // We shouldn't be able to delete the key!
   CHECK(!OrderedHashMap::Delete(isolate, *map, *key2));
-  Verify(map);
+  Verify(isolate, map);
   CHECK_EQ(2, map->NumberOfBuckets());
   CHECK_EQ(1, map->NumberOfElements());
   CHECK_EQ(0, map->NumberOfDeletedElements());
@@ -748,6 +878,35 @@ TEST(OrderedHashMapDuplicateHashCodeDeletion) {
   CHECK(!OrderedHashMap::HasKey(isolate, *map, *key2));
 }
 
+TEST(SmallOrderedHashMapDuplicateHashCodeDeletion) {
+  LocalContext context;
+  Isolate* isolate = GetIsolateFrom(&context);
+  Factory* factory = isolate->factory();
+  HandleScope scope(isolate);
+
+  Handle<SmallOrderedHashMap> map = factory->NewSmallOrderedHashMap();
+  Handle<JSObject> key1 = factory->NewJSObjectWithNullProto();
+  Handle<JSObject> value = factory->NewJSObjectWithNullProto();
+  map = SmallOrderedHashMap::Add(isolate, map, key1, value).ToHandleChecked();
+  Verify(isolate, map);
+  CHECK_EQ(2, map->NumberOfBuckets());
+  CHECK_EQ(1, map->NumberOfElements());
+  CHECK_EQ(0, map->NumberOfDeletedElements());
+  CHECK(map->HasKey(isolate, key1));
+
+  Handle<JSObject> key2 = factory->NewJSObjectWithNullProto();
+  CopyHashCode(key1, key2);
+
+  // We shouldn't be able to delete the key!
+  CHECK(!SmallOrderedHashMap::Delete(isolate, *map, *key2));
+  Verify(isolate, map);
+  CHECK_EQ(2, map->NumberOfBuckets());
+  CHECK_EQ(1, map->NumberOfElements());
+  CHECK_EQ(0, map->NumberOfDeletedElements());
+  CHECK(map->HasKey(isolate, key1));
+  CHECK(!map->HasKey(isolate, key2));
+}
+
 TEST(OrderedHashSetDeletion) {
   LocalContext context;
   Isolate* isolate = GetIsolateFrom(&context);
@@ -755,7 +914,7 @@ TEST(OrderedHashSetDeletion) {
   HandleScope scope(isolate);
 
   Handle<OrderedHashSet> set = factory->NewOrderedHashSet();
-  Verify(set);
+  Verify(isolate, set);
   CHECK_EQ(2, set->NumberOfBuckets());
   CHECK_EQ(0, set->NumberOfElements());
   CHECK_EQ(0, set->NumberOfDeletedElements());
@@ -763,14 +922,14 @@ TEST(OrderedHashSetDeletion) {
   // Delete from an empty hash table
   Handle<Smi> key1(Smi::FromInt(1), isolate);
   CHECK(!OrderedHashSet::Delete(isolate, *set, *key1));
-  Verify(set);
+  Verify(isolate, set);
   CHECK_EQ(2, set->NumberOfBuckets());
   CHECK_EQ(0, set->NumberOfElements());
   CHECK_EQ(0, set->NumberOfDeletedElements());
   CHECK(!OrderedHashSet::HasKey(isolate, *set, *key1));
 
-  set = OrderedHashSet::Add(set, key1);
-  Verify(set);
+  set = OrderedHashSet::Add(isolate, set, key1);
+  Verify(isolate, set);
   CHECK_EQ(2, set->NumberOfBuckets());
   CHECK_EQ(1, set->NumberOfElements());
   CHECK_EQ(0, set->NumberOfDeletedElements());
@@ -778,14 +937,14 @@ TEST(OrderedHashSetDeletion) {
 
   // Delete single existing key
   CHECK(OrderedHashSet::Delete(isolate, *set, *key1));
-  Verify(set);
+  Verify(isolate, set);
   CHECK_EQ(2, set->NumberOfBuckets());
   CHECK_EQ(0, set->NumberOfElements());
   CHECK_EQ(1, set->NumberOfDeletedElements());
   CHECK(!OrderedHashSet::HasKey(isolate, *set, *key1));
 
-  set = OrderedHashSet::Add(set, key1);
-  Verify(set);
+  set = OrderedHashSet::Add(isolate, set, key1);
+  Verify(isolate, set);
   CHECK_EQ(2, set->NumberOfBuckets());
   CHECK_EQ(1, set->NumberOfElements());
   CHECK_EQ(1, set->NumberOfDeletedElements());
@@ -793,8 +952,8 @@ TEST(OrderedHashSetDeletion) {
 
   Handle<String> key2 = factory->NewStringFromAsciiChecked("foo");
   CHECK(!OrderedHashSet::HasKey(isolate, *set, *key2));
-  set = OrderedHashSet::Add(set, key2);
-  Verify(set);
+  set = OrderedHashSet::Add(isolate, set, key2);
+  Verify(isolate, set);
   CHECK_EQ(2, set->NumberOfBuckets());
   CHECK_EQ(2, set->NumberOfElements());
   CHECK_EQ(1, set->NumberOfDeletedElements());
@@ -802,8 +961,8 @@ TEST(OrderedHashSetDeletion) {
 
   Handle<Symbol> key3 = factory->NewSymbol();
   CHECK(!OrderedHashSet::HasKey(isolate, *set, *key3));
-  set = OrderedHashSet::Add(set, key3);
-  Verify(set);
+  set = OrderedHashSet::Add(isolate, set, key3);
+  Verify(isolate, set);
   CHECK_EQ(2, set->NumberOfBuckets());
   CHECK_EQ(3, set->NumberOfElements());
   CHECK_EQ(1, set->NumberOfDeletedElements());
@@ -813,7 +972,7 @@ TEST(OrderedHashSetDeletion) {
 
   // Delete multiple existing keys
   CHECK(OrderedHashSet::Delete(isolate, *set, *key1));
-  Verify(set);
+  Verify(isolate, set);
   CHECK_EQ(2, set->NumberOfBuckets());
   CHECK_EQ(2, set->NumberOfElements());
   CHECK_EQ(2, set->NumberOfDeletedElements());
@@ -822,7 +981,7 @@ TEST(OrderedHashSetDeletion) {
   CHECK(OrderedHashSet::HasKey(isolate, *set, *key3));
 
   CHECK(OrderedHashSet::Delete(isolate, *set, *key2));
-  Verify(set);
+  Verify(isolate, set);
   CHECK_EQ(2, set->NumberOfBuckets());
   CHECK_EQ(1, set->NumberOfElements());
   CHECK_EQ(3, set->NumberOfDeletedElements());
@@ -831,7 +990,7 @@ TEST(OrderedHashSetDeletion) {
   CHECK(OrderedHashSet::HasKey(isolate, *set, *key3));
 
   CHECK(OrderedHashSet::Delete(isolate, *set, *key3));
-  Verify(set);
+  Verify(isolate, set);
   CHECK_EQ(2, set->NumberOfBuckets());
   CHECK_EQ(0, set->NumberOfElements());
   CHECK_EQ(4, set->NumberOfDeletedElements());
@@ -841,7 +1000,7 @@ TEST(OrderedHashSetDeletion) {
 
   // Delete non existent key from non new hash table
   CHECK(!OrderedHashSet::Delete(isolate, *set, *key3));
-  Verify(set);
+  Verify(isolate, set);
   CHECK_EQ(2, set->NumberOfBuckets());
   CHECK_EQ(0, set->NumberOfElements());
   CHECK_EQ(4, set->NumberOfDeletedElements());
@@ -850,9 +1009,9 @@ TEST(OrderedHashSetDeletion) {
   CHECK(!OrderedHashSet::HasKey(isolate, *set, *key3));
 
   // Delete non existent key from non empty hash table
-  set = OrderedHashSet::Shrink(set);
-  set = OrderedHashSet::Add(set, key1);
-  Verify(set);
+  set = OrderedHashSet::Shrink(isolate, set);
+  set = OrderedHashSet::Add(isolate, set, key1);
+  Verify(isolate, set);
   CHECK_EQ(2, set->NumberOfBuckets());
   CHECK_EQ(1, set->NumberOfElements());
   CHECK_EQ(0, set->NumberOfDeletedElements());
@@ -860,7 +1019,7 @@ TEST(OrderedHashSetDeletion) {
   CHECK(!OrderedHashSet::HasKey(isolate, *set, *key2));
   CHECK(!OrderedHashSet::HasKey(isolate, *set, *key3));
   CHECK(!OrderedHashSet::Delete(isolate, *set, *key2));
-  Verify(set);
+  Verify(isolate, set);
   CHECK_EQ(2, set->NumberOfBuckets());
   CHECK_EQ(1, set->NumberOfElements());
   CHECK_EQ(0, set->NumberOfDeletedElements());
@@ -869,6 +1028,126 @@ TEST(OrderedHashSetDeletion) {
   CHECK(!OrderedHashSet::HasKey(isolate, *set, *key3));
 }
 
+TEST(SmallOrderedHashSetDeletion) {
+  LocalContext context;
+  Isolate* isolate = GetIsolateFrom(&context);
+  Factory* factory = isolate->factory();
+  HandleScope scope(isolate);
+
+  Handle<SmallOrderedHashSet> set = factory->NewSmallOrderedHashSet();
+  Verify(isolate, set);
+  CHECK_EQ(2, set->NumberOfBuckets());
+  CHECK_EQ(0, set->NumberOfElements());
+  CHECK_EQ(0, set->NumberOfDeletedElements());
+
+  // Delete from an empty hash table
+  Handle<Smi> key1(Smi::FromInt(1), isolate);
+  CHECK(!SmallOrderedHashSet::Delete(isolate, *set, *key1));
+  Verify(isolate, set);
+  CHECK_EQ(2, set->NumberOfBuckets());
+  CHECK_EQ(0, set->NumberOfElements());
+  CHECK_EQ(0, set->NumberOfDeletedElements());
+  CHECK(!set->HasKey(isolate, key1));
+
+  set = SmallOrderedHashSet::Add(isolate, set, key1).ToHandleChecked();
+  Verify(isolate, set);
+  CHECK_EQ(2, set->NumberOfBuckets());
+  CHECK_EQ(1, set->NumberOfElements());
+  CHECK_EQ(0, set->NumberOfDeletedElements());
+  CHECK(set->HasKey(isolate, key1));
+
+  // Delete single existing key
+  CHECK(SmallOrderedHashSet::Delete(isolate, *set, *key1));
+  Verify(isolate, set);
+  CHECK_EQ(2, set->NumberOfBuckets());
+  CHECK_EQ(0, set->NumberOfElements());
+  CHECK_EQ(1, set->NumberOfDeletedElements());
+  CHECK(!set->HasKey(isolate, key1));
+
+  set = SmallOrderedHashSet::Add(isolate, set, key1).ToHandleChecked();
+  Verify(isolate, set);
+  CHECK_EQ(2, set->NumberOfBuckets());
+  CHECK_EQ(1, set->NumberOfElements());
+  CHECK_EQ(1, set->NumberOfDeletedElements());
+  CHECK(set->HasKey(isolate, key1));
+
+  Handle<String> key2 = factory->NewStringFromAsciiChecked("foo");
+  CHECK(!set->HasKey(isolate, key2));
+  set = SmallOrderedHashSet::Add(isolate, set, key2).ToHandleChecked();
+  Verify(isolate, set);
+  CHECK_EQ(2, set->NumberOfBuckets());
+  CHECK_EQ(2, set->NumberOfElements());
+  CHECK_EQ(1, set->NumberOfDeletedElements());
+  CHECK(set->HasKey(isolate, key2));
+
+  Handle<Symbol> key3 = factory->NewSymbol();
+  CHECK(!set->HasKey(isolate, key3));
+  set = SmallOrderedHashSet::Add(isolate, set, key3).ToHandleChecked();
+  Verify(isolate, set);
+  CHECK_EQ(2, set->NumberOfBuckets());
+  CHECK_EQ(3, set->NumberOfElements());
+  CHECK_EQ(1, set->NumberOfDeletedElements());
+  CHECK(set->HasKey(isolate, key1));
+  CHECK(set->HasKey(isolate, key2));
+  CHECK(set->HasKey(isolate, key3));
+
+  // Delete multiple existing keys
+  CHECK(SmallOrderedHashSet::Delete(isolate, *set, *key1));
+  Verify(isolate, set);
+  CHECK_EQ(2, set->NumberOfBuckets());
+  CHECK_EQ(2, set->NumberOfElements());
+  CHECK_EQ(2, set->NumberOfDeletedElements());
+  CHECK(!set->HasKey(isolate, key1));
+  CHECK(set->HasKey(isolate, key2));
+  CHECK(set->HasKey(isolate, key3));
+
+  CHECK(SmallOrderedHashSet::Delete(isolate, *set, *key2));
+  Verify(isolate, set);
+  CHECK_EQ(2, set->NumberOfBuckets());
+  CHECK_EQ(1, set->NumberOfElements());
+  CHECK_EQ(3, set->NumberOfDeletedElements());
+  CHECK(!set->HasKey(isolate, key1));
+  CHECK(!set->HasKey(isolate, key2));
+  CHECK(set->HasKey(isolate, key3));
+
+  CHECK(SmallOrderedHashSet::Delete(isolate, *set, *key3));
+  Verify(isolate, set);
+  CHECK_EQ(2, set->NumberOfBuckets());
+  CHECK_EQ(0, set->NumberOfElements());
+  CHECK_EQ(4, set->NumberOfDeletedElements());
+  CHECK(!set->HasKey(isolate, key1));
+  CHECK(!set->HasKey(isolate, key2));
+  CHECK(!set->HasKey(isolate, key3));
+
+  // Delete non existent key from non new hash table
+  CHECK(!SmallOrderedHashSet::Delete(isolate, *set, *key3));
+  Verify(isolate, set);
+  CHECK_EQ(2, set->NumberOfBuckets());
+  CHECK_EQ(0, set->NumberOfElements());
+  CHECK_EQ(4, set->NumberOfDeletedElements());
+  CHECK(!set->HasKey(isolate, key1));
+  CHECK(!set->HasKey(isolate, key2));
+  CHECK(!set->HasKey(isolate, key3));
+
+  // Delete non existent key from non empty hash table
+  set = SmallOrderedHashSet::Add(isolate, set, key1).ToHandleChecked();
+  Verify(isolate, set);
+  CHECK_EQ(2, set->NumberOfBuckets());
+  CHECK_EQ(1, set->NumberOfElements());
+  CHECK_EQ(0, set->NumberOfDeletedElements());
+  CHECK(set->HasKey(isolate, key1));
+  CHECK(!set->HasKey(isolate, key2));
+  CHECK(!set->HasKey(isolate, key3));
+  CHECK(!SmallOrderedHashSet::Delete(isolate, *set, *key2));
+  Verify(isolate, set);
+  CHECK_EQ(2, set->NumberOfBuckets());
+  CHECK_EQ(1, set->NumberOfElements());
+  CHECK_EQ(0, set->NumberOfDeletedElements());
+  CHECK(set->HasKey(isolate, key1));
+  CHECK(!set->HasKey(isolate, key2));
+  CHECK(!set->HasKey(isolate, key3));
+}
+
 TEST(OrderedHashSetDuplicateHashCodeDeletion) {
   LocalContext context;
   Isolate* isolate = GetIsolateFrom(&context);
@@ -877,8 +1156,8 @@ TEST(OrderedHashSetDuplicateHashCodeDeletion) {
 
   Handle<OrderedHashSet> set = factory->NewOrderedHashSet();
   Handle<JSObject> key1 = factory->NewJSObjectWithNullProto();
-  set = OrderedHashSet::Add(set, key1);
-  Verify(set);
+  set = OrderedHashSet::Add(isolate, set, key1);
+  Verify(isolate, set);
   CHECK_EQ(2, set->NumberOfBuckets());
   CHECK_EQ(1, set->NumberOfElements());
   CHECK_EQ(0, set->NumberOfDeletedElements());
@@ -889,7 +1168,7 @@ TEST(OrderedHashSetDuplicateHashCodeDeletion) {
 
   // We shouldn't be able to delete the key!
   CHECK(!OrderedHashSet::Delete(isolate, *set, *key2));
-  Verify(set);
+  Verify(isolate, set);
   CHECK_EQ(2, set->NumberOfBuckets());
   CHECK_EQ(1, set->NumberOfElements());
   CHECK_EQ(0, set->NumberOfDeletedElements());
@@ -897,6 +1176,101 @@ TEST(OrderedHashSetDuplicateHashCodeDeletion) {
   CHECK(!OrderedHashSet::HasKey(isolate, *set, *key2));
 }
 
+TEST(SmallOrderedHashSetDuplicateHashCodeDeletion) {
+  LocalContext context;
+  Isolate* isolate = GetIsolateFrom(&context);
+  Factory* factory = isolate->factory();
+  HandleScope scope(isolate);
+
+  Handle<SmallOrderedHashSet> set = factory->NewSmallOrderedHashSet();
+  Handle<JSObject> key1 = factory->NewJSObjectWithNullProto();
+  set = SmallOrderedHashSet::Add(isolate, set, key1).ToHandleChecked();
+  Verify(isolate, set);
+  CHECK_EQ(2, set->NumberOfBuckets());
+  CHECK_EQ(1, set->NumberOfElements());
+  CHECK_EQ(0, set->NumberOfDeletedElements());
+  CHECK(set->HasKey(isolate, key1));
+
+  Handle<JSObject> key2 = factory->NewJSObjectWithNullProto();
+  CopyHashCode(key1, key2);
+
+  // We shouldn't be able to delete the key!
+  CHECK(!SmallOrderedHashSet::Delete(isolate, *set, *key2));
+  Verify(isolate, set);
+  CHECK_EQ(2, set->NumberOfBuckets());
+  CHECK_EQ(1, set->NumberOfElements());
+  CHECK_EQ(0, set->NumberOfDeletedElements());
+  CHECK(set->HasKey(isolate, key1));
+  CHECK(!set->HasKey(isolate, key2));
+}
+
+TEST(OrderedHashSetHandlerInsertion) {
+  LocalContext context;
+  Isolate* isolate = GetIsolateFrom(&context);
+  HandleScope scope(isolate);
+
+  Handle<HeapObject> set = OrderedHashSetHandler::Allocate(isolate, 4);
+  Verify(isolate, set);
+
+  // Add a new key.
+  Handle<Smi> key1(Smi::FromInt(1), isolate);
+  CHECK(!OrderedHashSetHandler::HasKey(isolate, set, key1));
+  set = OrderedHashSetHandler::Add(isolate, set, key1);
+  Verify(isolate, set);
+  CHECK(OrderedHashSetHandler::HasKey(isolate, set, key1));
+
+  // Add existing key.
+  set = OrderedHashSetHandler::Add(isolate, set, key1);
+  Verify(isolate, set);
+  CHECK(OrderedHashSetHandler::HasKey(isolate, set, key1));
+  CHECK(SmallOrderedHashSet::Is(set));
+
+  for (int i = 0; i < 1024; i++) {
+    Handle<Smi> key_i(Smi::FromInt(i), isolate);
+    set = OrderedHashSetHandler::Add(isolate, set, key_i);
+    Verify(isolate, set);
+    for (int j = 0; j <= i; j++) {
+      Handle<Smi> key_j(Smi::FromInt(j), isolate);
+      CHECK(OrderedHashSetHandler::HasKey(isolate, set, key_j));
+    }
+  }
+  CHECK(OrderedHashSet::Is(set));
+}
+
+TEST(OrderedHashMapHandlerInsertion) {
+  LocalContext context;
+  Isolate* isolate = GetIsolateFrom(&context);
+  HandleScope scope(isolate);
+
+  Handle<HeapObject> map = OrderedHashMapHandler::Allocate(isolate, 4);
+  Verify(isolate, map);
+
+  // Add a new key.
+  Handle<Smi> key1(Smi::FromInt(1), isolate);
+  Handle<Smi> value1(Smi::FromInt(1), isolate);
+  CHECK(!OrderedHashMapHandler::HasKey(isolate, map, key1));
+  map = OrderedHashMapHandler::Add(isolate, map, key1, value1);
+  Verify(isolate, map);
+  CHECK(OrderedHashMapHandler::HasKey(isolate, map, key1));
+
+  // Add existing key.
+  map = OrderedHashMapHandler::Add(isolate, map, key1, value1);
+  Verify(isolate, map);
+  CHECK(OrderedHashMapHandler::HasKey(isolate, map, key1));
+  CHECK(SmallOrderedHashMap::Is(map));
+  for (int i = 0; i < 1024; i++) {
+    Handle<Smi> key_i(Smi::FromInt(i), isolate);
+    Handle<Smi> value_i(Smi::FromInt(i), isolate);
+    map = OrderedHashMapHandler::Add(isolate, map, key_i, value_i);
+    Verify(isolate, map);
+    for (int j = 0; j <= i; j++) {
+      Handle<Smi> key_j(Smi::FromInt(j), isolate);
+      CHECK(OrderedHashMapHandler::HasKey(isolate, map, key_j));
+    }
+  }
+  CHECK(OrderedHashMap::Is(map));
+}
+
 }  // namespace test_orderedhashtable
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/test/cctest/test-parsing.cc b/deps/v8/test/cctest/test-parsing.cc
index 725f40e6fbcf48..0e89d769e30304 100644
--- a/deps/v8/test/cctest/test-parsing.cc
+++ b/deps/v8/test/cctest/test-parsing.cc
@@ -641,15 +641,14 @@ TEST(ScopeUsesArgumentsSuperThis) {
           factory->NewStringFromUtf8(i::CStrVector(program.start()))
               .ToHandleChecked();
       i::Handle<i::Script> script = factory->NewScript(source);
-      i::ParseInfo info(script);
+      i::ParseInfo info(isolate, script);
       // The information we're checking is only produced when eager parsing.
       info.set_allow_lazy_parsing(false);
       CHECK(i::parsing::ParseProgram(&info, isolate));
       CHECK(i::Rewriter::Rewrite(&info));
       info.ast_value_factory()->Internalize(isolate);
       CHECK(i::DeclarationScope::Analyze(&info));
-      i::DeclarationScope::AllocateScopeInfos(&info, isolate,
-                                              i::AnalyzeMode::kRegular);
+      i::DeclarationScope::AllocateScopeInfos(&info, isolate);
       CHECK_NOT_NULL(info.literal());
 
       i::DeclarationScope* script_scope = info.literal()->scope();
@@ -708,7 +707,7 @@ static void CheckParsesToNumber(const char* source) {
 
   i::Handle<i::Script> script = factory->NewScript(source_code);
 
-  i::ParseInfo info(script);
+  i::ParseInfo info(isolate, script);
   info.set_allow_lazy_parsing(false);
   info.set_toplevel(true);
 
@@ -1017,7 +1016,7 @@ TEST(ScopePositions) {
         i::CStrVector(program.start())).ToHandleChecked();
     CHECK_EQ(source->length(), kProgramSize);
     i::Handle<i::Script> script = factory->NewScript(source);
-    i::ParseInfo info(script);
+    i::ParseInfo info(isolate, script);
     info.set_language_mode(source_data[i].language_mode);
     i::parsing::ParseProgram(&info, isolate);
     CHECK_NOT_NULL(info.literal());
@@ -1063,7 +1062,7 @@ TEST(DiscardFunctionBody) {
     i::Handle<i::String> source_code =
         factory->NewStringFromUtf8(i::CStrVector(source)).ToHandleChecked();
     i::Handle<i::Script> script = factory->NewScript(source_code);
-    i::ParseInfo info(script);
+    i::ParseInfo info(isolate, script);
     i::parsing::ParseProgram(&info, isolate);
     function = info.literal();
     CHECK_NOT_NULL(function);
@@ -1121,7 +1120,6 @@ enum ParserFlag {
   kAllowHarmonyDynamicImport,
   kAllowHarmonyImportMeta,
   kAllowHarmonyDoExpressions,
-  kAllowHarmonyOptionalCatchBinding,
   kAllowHarmonyNumericSeparator
 };
 
@@ -1139,8 +1137,6 @@ void SetGlobalFlags(i::EnumSet<ParserFlag> flags) {
   i::FLAG_harmony_dynamic_import = flags.Contains(kAllowHarmonyDynamicImport);
   i::FLAG_harmony_import_meta = flags.Contains(kAllowHarmonyImportMeta);
   i::FLAG_harmony_do_expressions = flags.Contains(kAllowHarmonyDoExpressions);
-  i::FLAG_harmony_optional_catch_binding =
-      flags.Contains(kAllowHarmonyOptionalCatchBinding);
   i::FLAG_harmony_numeric_separator =
       flags.Contains(kAllowHarmonyNumericSeparator);
 }
@@ -1159,8 +1155,6 @@ void SetParserFlags(i::PreParser* parser, i::EnumSet<ParserFlag> flags) {
       flags.Contains(kAllowHarmonyImportMeta));
   parser->set_allow_harmony_do_expressions(
       flags.Contains(kAllowHarmonyDoExpressions));
-  parser->set_allow_harmony_optional_catch_binding(
-      flags.Contains(kAllowHarmonyOptionalCatchBinding));
   parser->set_allow_harmony_numeric_separator(
       flags.Contains(kAllowHarmonyNumericSeparator));
 }
@@ -1180,7 +1174,7 @@ void TestParserSyncWithFlags(i::Handle<i::String> source,
   if (test_preparser) {
     i::Scanner scanner(isolate->unicode_cache());
     std::unique_ptr<i::Utf16CharacterStream> stream(
-        i::ScannerStream::For(source));
+        i::ScannerStream::For(isolate, source));
     i::Zone zone(CcTest::i_isolate()->allocator(), ZONE_NAME);
     i::AstValueFactory ast_value_factory(
         &zone, CcTest::i_isolate()->ast_string_constants(),
@@ -1199,7 +1193,7 @@ void TestParserSyncWithFlags(i::Handle<i::String> source,
   i::FunctionLiteral* function;
   {
     i::Handle<i::Script> script = factory->NewScript(source);
-    i::ParseInfo info(script);
+    i::ParseInfo info(isolate, script);
     info.set_allow_lazy_parsing(flags.Contains(kAllowLazy));
     SetGlobalFlags(flags);
     if (is_module) info.set_module();
@@ -1212,7 +1206,7 @@ void TestParserSyncWithFlags(i::Handle<i::String> source,
     // Extract exception from the parser.
     CHECK(isolate->has_pending_exception());
     i::Handle<i::JSObject> exception_handle(
-        i::JSObject::cast(isolate->pending_exception()));
+        i::JSObject::cast(isolate->pending_exception()), isolate);
     i::Handle<i::String> message_string = i::Handle<i::String>::cast(
         i::JSReceiver::GetProperty(isolate, exception_handle, "message")
             .ToHandleChecked());
@@ -1241,7 +1235,7 @@ void TestParserSyncWithFlags(i::Handle<i::String> source,
     if (test_preparser && !ignore_error_msg) {
       i::Handle<i::String> preparser_message =
           pending_error_handler.FormatErrorMessageForTest(CcTest::i_isolate());
-      if (!i::String::Equals(message_string, preparser_message)) {
+      if (!i::String::Equals(isolate, message_string, preparser_message)) {
         FATAL(
             "Expected parser and preparser to produce the same error on:\n"
             "\t%s\n"
@@ -2259,9 +2253,9 @@ TEST(FunctionDeclaresItselfStrict) {
 TEST(ErrorsTryWithoutCatchOrFinally) {
   const char* context_data[][2] = {{"", ""}, {nullptr, nullptr}};
 
-  const char* statement_data[] = {
-      "try { }",           "try { } foo();",         "try { } catch (e) foo();",
-      "try { } catch { }", "try { } finally foo();", nullptr};
+  const char* statement_data[] = {"try { }", "try { } foo();",
+                                  "try { } catch (e) foo();",
+                                  "try { } finally foo();", nullptr};
 
   RunParserSyncTest(context_data, statement_data, kError);
 }
@@ -2299,13 +2293,7 @@ TEST(OptionalCatchBinding) {
   };
   // clang-format on
 
-  // No error with flag
-  static const ParserFlag flags[] = {kAllowHarmonyOptionalCatchBinding};
-  RunParserSyncTest(context_data, statement_data, kSuccess, NULL, 0, flags,
-                    arraysize(flags));
-
-  // Still an error without flag
-  RunParserSyncTest(context_data, statement_data, kError);
+  RunParserSyncTest(context_data, statement_data, kSuccess);
 }
 
 TEST(OptionalCatchBindingInDoExpression) {
@@ -2326,16 +2314,9 @@ TEST(OptionalCatchBindingInDoExpression) {
   };
   // clang-format on
 
-  // No error with flag
-  static const ParserFlag do_and_catch_flags[] = {
-      kAllowHarmonyDoExpressions, kAllowHarmonyOptionalCatchBinding};
+  static const ParserFlag do_and_catch_flags[] = {kAllowHarmonyDoExpressions};
   RunParserSyncTest(context_data, statement_data, kSuccess, NULL, 0,
                     do_and_catch_flags, arraysize(do_and_catch_flags));
-
-  // Still an error without flag
-  static const ParserFlag do_flag[] = {kAllowHarmonyDoExpressions};
-  RunParserSyncTest(context_data, statement_data, kError, NULL, 0, do_flag,
-                    arraysize(do_flag));
 }
 
 TEST(ErrorsRegexpLiteral) {
@@ -2861,7 +2842,7 @@ TEST(SerializationOfMaybeAssignmentFlag) {
   i::DeclarationScope* script_scope =
       new (&zone) i::DeclarationScope(&zone, &avf);
   i::Scope* s = i::Scope::DeserializeScopeChain(
-      &zone, context->scope_info(), script_scope, &avf,
+      isolate, &zone, context->scope_info(), script_scope, &avf,
       i::Scope::DeserializationMode::kIncludingVariables);
   CHECK(s != script_scope);
   CHECK_NOT_NULL(name);
@@ -2910,7 +2891,7 @@ TEST(IfArgumentsArrayAccessedThenParametersMaybeAssigned) {
   i::DeclarationScope* script_scope =
       new (&zone) i::DeclarationScope(&zone, &avf);
   i::Scope* s = i::Scope::DeserializeScopeChain(
-      &zone, context->scope_info(), script_scope, &avf,
+      isolate, &zone, context->scope_info(), script_scope, &avf,
       i::Scope::DeserializationMode::kIncludingVariables);
   CHECK(s != script_scope);
 
@@ -3059,8 +3040,10 @@ TEST(InnerAssignment) {
           v8::Local<v8::Value> v = CompileRun(program.start());
           i::Handle<i::Object> o = v8::Utils::OpenHandle(*v);
           i::Handle<i::JSFunction> f = i::Handle<i::JSFunction>::cast(o);
-          i::Handle<i::SharedFunctionInfo> shared = i::handle(f->shared());
-          info = std::unique_ptr<i::ParseInfo>(new i::ParseInfo(shared));
+          i::Handle<i::SharedFunctionInfo> shared =
+              i::handle(f->shared(), isolate);
+          info =
+              std::unique_ptr<i::ParseInfo>(new i::ParseInfo(isolate, shared));
           CHECK(i::parsing::ParseFunction(info.get(), shared, isolate));
         } else {
           i::Handle<i::String> source =
@@ -3068,7 +3051,8 @@ TEST(InnerAssignment) {
           source->PrintOn(stdout);
           printf("\n");
           i::Handle<i::Script> script = factory->NewScript(source);
-          info = std::unique_ptr<i::ParseInfo>(new i::ParseInfo(script));
+          info =
+              std::unique_ptr<i::ParseInfo>(new i::ParseInfo(isolate, script));
           info->set_allow_lazy_parsing(false);
           CHECK(i::parsing::ParseProgram(info.get(), isolate));
         }
@@ -3172,8 +3156,8 @@ TEST(MaybeAssignedParameters) {
       v8::Local<v8::Value> v = CompileRun(program.start());
       i::Handle<i::Object> o = v8::Utils::OpenHandle(*v);
       i::Handle<i::JSFunction> f = i::Handle<i::JSFunction>::cast(o);
-      i::Handle<i::SharedFunctionInfo> shared = i::handle(f->shared());
-      info = std::unique_ptr<i::ParseInfo>(new i::ParseInfo(shared));
+      i::Handle<i::SharedFunctionInfo> shared = i::handle(f->shared(), isolate);
+      info = std::unique_ptr<i::ParseInfo>(new i::ParseInfo(isolate, shared));
       info->set_allow_lazy_parsing(allow_lazy);
       CHECK(i::parsing::ParseFunction(info.get(), shared, isolate));
       CHECK(i::Compiler::Analyze(info.get()));
@@ -3210,7 +3194,7 @@ static void TestMaybeAssigned(Input input, const char* variable, bool module,
   i::Handle<i::Script> script = factory->NewScript(string);
 
   std::unique_ptr<i::ParseInfo> info;
-  info = std::unique_ptr<i::ParseInfo>(new i::ParseInfo(script));
+  info = std::unique_ptr<i::ParseInfo>(new i::ParseInfo(isolate, script));
   info->set_module(module);
   info->set_allow_lazy_parsing(allow_lazy_parsing);
 
@@ -3628,7 +3612,7 @@ i::Scope* DeserializeFunctionScope(i::Isolate* isolate, i::Zone* zone,
   i::DeclarationScope* script_scope =
       new (zone) i::DeclarationScope(zone, &avf);
   i::Scope* s = i::Scope::DeserializeScopeChain(
-      zone, f->context()->scope_info(), script_scope, &avf,
+      isolate, zone, f->context()->scope_info(), script_scope, &avf,
       i::Scope::DeserializationMode::kIncludingVariables);
   return s;
 }
@@ -3731,24 +3715,9 @@ TEST(LineOrParagraphSeparatorAsLineTerminator) {
 }
 
 TEST(LineOrParagraphSeparatorInStringLiteral) {
-  // Tests that both preparsing and parsing treat U+2028 LINE SEPARATOR and
-  // U+2029 PARAGRAPH SEPARATOR as line terminators within string literals
-  // when the "subsume JSON" flag is disabled.
-  v8::internal::FLAG_harmony_subsume_json = false;
-  const char* context_data[][2] = {
-      {"\"", "\""}, {"'", "'"}, {nullptr, nullptr}};
-  const char* statement_data[] = {"\x31\xE2\x80\xA8\x32",  // 1<U+2028>2
-                                  "\x31\xE2\x80\xA9\x32",  // 1<U+2029>2
-                                  nullptr};
-
-  RunParserSyncTest(context_data, statement_data, kError);
-}
-
-TEST(LineOrParagraphSeparatorInStringLiteralHarmony) {
   // Tests that both preparsing and parsing don't treat U+2028 LINE SEPARATOR
-  // and U+2029 PARAGRAPH SEPARATOR as line terminators within string literals
-  // when the "subsume JSON" flag is enabled.
-  v8::internal::FLAG_harmony_subsume_json = true;
+  // and U+2029 PARAGRAPH SEPARATOR as line terminators within string literals.
+  // https://github.com/tc39/proposal-json-superset
   const char* context_data[][2] = {
       {"\"", "\""}, {"'", "'"}, {nullptr, nullptr}};
   const char* statement_data[] = {"\x31\xE2\x80\xA8\x32",  // 1<U+2028>2
@@ -6221,11 +6190,11 @@ TEST(BasicImportExportParsing) {
     // Show that parsing as a module works
     {
       i::Handle<i::Script> script = factory->NewScript(source);
-      i::ParseInfo info(script);
+      i::ParseInfo info(isolate, script);
       info.set_module();
       if (!i::parsing::ParseProgram(&info, isolate)) {
         i::Handle<i::JSObject> exception_handle(
-            i::JSObject::cast(isolate->pending_exception()));
+            i::JSObject::cast(isolate->pending_exception()), isolate);
         i::Handle<i::String> message_string = i::Handle<i::String>::cast(
             i::JSReceiver::GetProperty(isolate, exception_handle, "message")
                 .ToHandleChecked());
@@ -6244,7 +6213,7 @@ TEST(BasicImportExportParsing) {
     // And that parsing a script does not.
     {
       i::Handle<i::Script> script = factory->NewScript(source);
-      i::ParseInfo info(script);
+      i::ParseInfo info(isolate, script);
       CHECK(!i::parsing::ParseProgram(&info, isolate));
       isolate->clear_pending_exception();
     }
@@ -6334,7 +6303,7 @@ TEST(ImportExportParsingErrors) {
         factory->NewStringFromAsciiChecked(kErrorSources[i]);
 
     i::Handle<i::Script> script = factory->NewScript(source);
-    i::ParseInfo info(script);
+    i::ParseInfo info(isolate, script);
     info.set_module();
     CHECK(!i::parsing::ParseProgram(&info, isolate));
     isolate->clear_pending_exception();
@@ -6370,7 +6339,7 @@ TEST(ModuleTopLevelFunctionDecl) {
         factory->NewStringFromAsciiChecked(kErrorSources[i]);
 
     i::Handle<i::Script> script = factory->NewScript(source);
-    i::ParseInfo info(script);
+    i::ParseInfo info(isolate, script);
     info.set_module();
     CHECK(!i::parsing::ParseProgram(&info, isolate));
     isolate->clear_pending_exception();
@@ -6567,7 +6536,7 @@ TEST(ModuleParsingInternals) {
       "export {foob};";
   i::Handle<i::String> source = factory->NewStringFromAsciiChecked(kSource);
   i::Handle<i::Script> script = factory->NewScript(source);
-  i::ParseInfo info(script);
+  i::ParseInfo info(isolate, script);
   info.set_module();
   CHECK(i::parsing::ParseProgram(&info, isolate));
   CHECK(i::Compiler::Analyze(&info));
@@ -6582,54 +6551,62 @@ TEST(ModuleParsingInternals) {
   CHECK_EQ(13, declarations->LengthForTest());
 
   CHECK(declarations->AtForTest(0)->proxy()->raw_name()->IsOneByteEqualTo("x"));
-  CHECK(declarations->AtForTest(0)->proxy()->var()->mode() == i::LET);
+  CHECK(declarations->AtForTest(0)->proxy()->var()->mode() ==
+        i::VariableMode::kLet);
   CHECK(declarations->AtForTest(0)->proxy()->var()->binding_needs_init());
   CHECK(declarations->AtForTest(0)->proxy()->var()->location() ==
         i::VariableLocation::MODULE);
 
   CHECK(declarations->AtForTest(1)->proxy()->raw_name()->IsOneByteEqualTo("z"));
-  CHECK(declarations->AtForTest(1)->proxy()->var()->mode() == i::CONST);
+  CHECK(declarations->AtForTest(1)->proxy()->var()->mode() ==
+        i::VariableMode::kConst);
   CHECK(declarations->AtForTest(1)->proxy()->var()->binding_needs_init());
   CHECK(declarations->AtForTest(1)->proxy()->var()->location() ==
         i::VariableLocation::MODULE);
 
   CHECK(declarations->AtForTest(2)->proxy()->raw_name()->IsOneByteEqualTo("n"));
-  CHECK(declarations->AtForTest(2)->proxy()->var()->mode() == i::CONST);
+  CHECK(declarations->AtForTest(2)->proxy()->var()->mode() ==
+        i::VariableMode::kConst);
   CHECK(declarations->AtForTest(2)->proxy()->var()->binding_needs_init());
   CHECK(declarations->AtForTest(2)->proxy()->var()->location() ==
         i::VariableLocation::MODULE);
 
   CHECK(
       declarations->AtForTest(3)->proxy()->raw_name()->IsOneByteEqualTo("foo"));
-  CHECK(declarations->AtForTest(3)->proxy()->var()->mode() == i::VAR);
+  CHECK(declarations->AtForTest(3)->proxy()->var()->mode() ==
+        i::VariableMode::kVar);
   CHECK(!declarations->AtForTest(3)->proxy()->var()->binding_needs_init());
   CHECK(declarations->AtForTest(3)->proxy()->var()->location() ==
         i::VariableLocation::MODULE);
 
   CHECK(
       declarations->AtForTest(4)->proxy()->raw_name()->IsOneByteEqualTo("goo"));
-  CHECK(declarations->AtForTest(4)->proxy()->var()->mode() == i::LET);
+  CHECK(declarations->AtForTest(4)->proxy()->var()->mode() ==
+        i::VariableMode::kLet);
   CHECK(!declarations->AtForTest(4)->proxy()->var()->binding_needs_init());
   CHECK(declarations->AtForTest(4)->proxy()->var()->location() ==
         i::VariableLocation::MODULE);
 
   CHECK(
       declarations->AtForTest(5)->proxy()->raw_name()->IsOneByteEqualTo("hoo"));
-  CHECK(declarations->AtForTest(5)->proxy()->var()->mode() == i::LET);
+  CHECK(declarations->AtForTest(5)->proxy()->var()->mode() ==
+        i::VariableMode::kLet);
   CHECK(declarations->AtForTest(5)->proxy()->var()->binding_needs_init());
   CHECK(declarations->AtForTest(5)->proxy()->var()->location() ==
         i::VariableLocation::MODULE);
 
   CHECK(
       declarations->AtForTest(6)->proxy()->raw_name()->IsOneByteEqualTo("joo"));
-  CHECK(declarations->AtForTest(6)->proxy()->var()->mode() == i::CONST);
+  CHECK(declarations->AtForTest(6)->proxy()->var()->mode() ==
+        i::VariableMode::kConst);
   CHECK(declarations->AtForTest(6)->proxy()->var()->binding_needs_init());
   CHECK(declarations->AtForTest(6)->proxy()->var()->location() ==
         i::VariableLocation::MODULE);
 
   CHECK(declarations->AtForTest(7)->proxy()->raw_name()->IsOneByteEqualTo(
       "*default*"));
-  CHECK(declarations->AtForTest(7)->proxy()->var()->mode() == i::CONST);
+  CHECK(declarations->AtForTest(7)->proxy()->var()->mode() ==
+        i::VariableMode::kConst);
   CHECK(declarations->AtForTest(7)->proxy()->var()->binding_needs_init());
   CHECK(declarations->AtForTest(7)->proxy()->var()->location() ==
         i::VariableLocation::MODULE);
@@ -6642,28 +6619,32 @@ TEST(ModuleParsingInternals) {
 
   CHECK(
       declarations->AtForTest(9)->proxy()->raw_name()->IsOneByteEqualTo("mm"));
-  CHECK(declarations->AtForTest(9)->proxy()->var()->mode() == i::CONST);
+  CHECK(declarations->AtForTest(9)->proxy()->var()->mode() ==
+        i::VariableMode::kConst);
   CHECK(declarations->AtForTest(9)->proxy()->var()->binding_needs_init());
   CHECK(declarations->AtForTest(9)->proxy()->var()->location() ==
         i::VariableLocation::MODULE);
 
   CHECK(
       declarations->AtForTest(10)->proxy()->raw_name()->IsOneByteEqualTo("aa"));
-  CHECK(declarations->AtForTest(10)->proxy()->var()->mode() == i::CONST);
+  CHECK(declarations->AtForTest(10)->proxy()->var()->mode() ==
+        i::VariableMode::kConst);
   CHECK(declarations->AtForTest(10)->proxy()->var()->binding_needs_init());
   CHECK(declarations->AtForTest(10)->proxy()->var()->location() ==
         i::VariableLocation::MODULE);
 
   CHECK(declarations->AtForTest(11)->proxy()->raw_name()->IsOneByteEqualTo(
       "loo"));
-  CHECK(declarations->AtForTest(11)->proxy()->var()->mode() == i::CONST);
+  CHECK(declarations->AtForTest(11)->proxy()->var()->mode() ==
+        i::VariableMode::kConst);
   CHECK(!declarations->AtForTest(11)->proxy()->var()->binding_needs_init());
   CHECK(declarations->AtForTest(11)->proxy()->var()->location() !=
         i::VariableLocation::MODULE);
 
   CHECK(declarations->AtForTest(12)->proxy()->raw_name()->IsOneByteEqualTo(
       "foob"));
-  CHECK(declarations->AtForTest(12)->proxy()->var()->mode() == i::CONST);
+  CHECK(declarations->AtForTest(12)->proxy()->var()->mode() ==
+        i::VariableMode::kConst);
   CHECK(!declarations->AtForTest(12)->proxy()->var()->binding_needs_init());
   CHECK(declarations->AtForTest(12)->proxy()->var()->location() ==
         i::VariableLocation::MODULE);
@@ -6816,7 +6797,7 @@ void TestLanguageMode(const char* source,
 
   i::Handle<i::Script> script =
       factory->NewScript(factory->NewStringFromAsciiChecked(source));
-  i::ParseInfo info(script);
+  i::ParseInfo info(isolate, script);
   i::parsing::ParseProgram(&info, isolate);
   CHECK_NOT_NULL(info.literal());
   CHECK_EQ(expected_language_mode, info.literal()->language_mode());
@@ -8712,6 +8693,14 @@ TEST(AsyncAwait) {
 
     "function* g() { var f = async(yield); }",
     "function* g() { var f = async(x = yield); }",
+
+    // v8:7817 assert that `await` is still allowed in the body of an arrow fn
+    // within formal parameters
+    "async(a = a => { var await = 1; return 1; }) => a()",
+    "async(a = await => 1); async(a) => 1",
+    "(async(a = await => 1), async(a) => 1)",
+    "async(a = await => 1, b = async() => 1);",
+
     nullptr
   };
   // clang-format on
@@ -8858,6 +8847,12 @@ TEST(AsyncAwaitErrors) {
     "async(...a = b) => b",
     "async(...a,) => b",
     "async(...a, b) => b",
+
+    // v8:7817 assert that `await` is an invalid identifier in arrow formal
+    // parameters nested within an async arrow function
+    "async(a = await => 1) => a",
+    "async(a = (await) => 1) => a",
+    "async(a = (...await) => 1) => a",
     nullptr
   };
 
@@ -9578,7 +9573,7 @@ TEST(NoPessimisticContextAllocation) {
       printf("\n");
 
       i::Handle<i::Script> script = factory->NewScript(source);
-      i::ParseInfo info(script);
+      i::ParseInfo info(isolate, script);
 
       CHECK(i::parsing::ParseProgram(&info, isolate));
       CHECK(i::Compiler::Analyze(&info));
@@ -10138,14 +10133,13 @@ TEST(LexicalLoopVariable) {
     i::Handle<i::String> source =
         factory->NewStringFromUtf8(i::CStrVector(program)).ToHandleChecked();
     i::Handle<i::Script> script = factory->NewScript(source);
-    i::ParseInfo info(script);
+    i::ParseInfo info(isolate, script);
 
     info.set_allow_lazy_parsing(false);
     CHECK(i::parsing::ParseProgram(&info, isolate));
     CHECK(i::Rewriter::Rewrite(&info));
     CHECK(i::DeclarationScope::Analyze(&info));
-    i::DeclarationScope::AllocateScopeInfos(&info, isolate,
-                                            i::AnalyzeMode::kRegular);
+    i::DeclarationScope::AllocateScopeInfos(&info, isolate);
     CHECK_NOT_NULL(info.literal());
 
     i::DeclarationScope* script_scope = info.literal()->scope();
@@ -10324,7 +10318,7 @@ TEST(PrivateNamesSyntaxError) {
     i::Handle<i::String> source =
         factory->NewStringFromUtf8(i::CStrVector(program)).ToHandleChecked();
     i::Handle<i::Script> script = factory->NewScript(source);
-    i::ParseInfo info(script);
+    i::ParseInfo info(isolate, script);
 
     info.set_allow_lazy_parsing(is_lazy);
     i::FLAG_harmony_private_fields = true;
diff --git a/deps/v8/test/cctest/test-profile-generator.cc b/deps/v8/test/cctest/test-profile-generator.cc
index 9dda53a063f4d2..9b2d7e3ab2fe9d 100644
--- a/deps/v8/test/cctest/test-profile-generator.cc
+++ b/deps/v8/test/cctest/test-profile-generator.cc
@@ -64,6 +64,25 @@ TEST(ProfileNodeFindOrAddChild) {
   CHECK_EQ(childNode3, node->FindOrAddChild(&entry3));
 }
 
+TEST(ProfileNodeFindOrAddChildWithLineNumber) {
+  CcTest::InitializeVM();
+  ProfileTree tree(CcTest::i_isolate());
+  ProfileNode* root = tree.root();
+  CodeEntry a(i::CodeEventListener::FUNCTION_TAG, "a");
+  ProfileNode* a_node = root->FindOrAddChild(&a, -1);
+
+  // a --(22)--> child1
+  //   --(23)--> child1
+
+  CodeEntry child1(i::CodeEventListener::FUNCTION_TAG, "child1");
+  ProfileNode* child1_node = a_node->FindOrAddChild(&child1, 22);
+  CHECK(child1_node);
+  CHECK_EQ(child1_node, a_node->FindOrAddChild(&child1, 22));
+
+  ProfileNode* child2_node = a_node->FindOrAddChild(&child1, 23);
+  CHECK(child2_node);
+  CHECK_NE(child1_node, child2_node);
+}
 
 TEST(ProfileNodeFindOrAddChildForSameFunction) {
   CcTest::InitializeVM();
@@ -172,6 +191,29 @@ TEST(ProfileTreeAddPathFromEnd) {
   CHECK_EQ(1u, node4->self_ticks());
 }
 
+TEST(ProfileTreeAddPathFromEndWithLineNumbers) {
+  CcTest::InitializeVM();
+  CodeEntry a(i::CodeEventListener::FUNCTION_TAG, "a");
+  CodeEntry b(i::CodeEventListener::FUNCTION_TAG, "b");
+  CodeEntry c(i::CodeEventListener::FUNCTION_TAG, "c");
+  ProfileTree tree(CcTest::i_isolate());
+  ProfileTreeTestHelper helper(&tree);
+
+  ProfileStackTrace path = {{&c, 5}, {&b, 3}, {&a, 1}};
+  tree.AddPathFromEnd(path, v8::CpuProfileNode::kNoLineNumberInfo, true,
+                      v8::CpuProfilingMode::kCallerLineNumbers);
+
+  ProfileNode* a_node =
+      tree.root()->FindChild(&a, v8::CpuProfileNode::kNoLineNumberInfo);
+  tree.Print();
+  CHECK(a_node);
+
+  ProfileNode* b_node = a_node->FindChild(&b, 1);
+  CHECK(b_node);
+
+  ProfileNode* c_node = b_node->FindChild(&c, 3);
+  CHECK(c_node);
+}
 
 TEST(ProfileTreeCalculateTotalTicks) {
   CcTest::InitializeVM();
@@ -262,60 +304,56 @@ TEST(ProfileTreeCalculateTotalTicks) {
   CHECK_EQ(4u, node3->self_ticks());
 }
 
+static inline i::Address ToAddress(int n) { return static_cast<i::Address>(n); }
 
-static inline i::Address ToAddress(int n) {
-  return reinterpret_cast<i::Address>(n);
-}
-
+static inline void* ToPointer(int n) { return reinterpret_cast<void*>(n); }
 
 TEST(CodeMapAddCode) {
   CodeMap code_map;
-  CodeEntry entry1(i::CodeEventListener::FUNCTION_TAG, "aaa");
-  CodeEntry entry2(i::CodeEventListener::FUNCTION_TAG, "bbb");
-  CodeEntry entry3(i::CodeEventListener::FUNCTION_TAG, "ccc");
-  CodeEntry entry4(i::CodeEventListener::FUNCTION_TAG, "ddd");
-  code_map.AddCode(ToAddress(0x1500), &entry1, 0x200);
-  code_map.AddCode(ToAddress(0x1700), &entry2, 0x100);
-  code_map.AddCode(ToAddress(0x1900), &entry3, 0x50);
-  code_map.AddCode(ToAddress(0x1950), &entry4, 0x10);
+  CodeEntry* entry1 = new CodeEntry(i::CodeEventListener::FUNCTION_TAG, "aaa");
+  CodeEntry* entry2 = new CodeEntry(i::CodeEventListener::FUNCTION_TAG, "bbb");
+  CodeEntry* entry3 = new CodeEntry(i::CodeEventListener::FUNCTION_TAG, "ccc");
+  CodeEntry* entry4 = new CodeEntry(i::CodeEventListener::FUNCTION_TAG, "ddd");
+  code_map.AddCode(ToAddress(0x1500), entry1, 0x200);
+  code_map.AddCode(ToAddress(0x1700), entry2, 0x100);
+  code_map.AddCode(ToAddress(0x1900), entry3, 0x50);
+  code_map.AddCode(ToAddress(0x1950), entry4, 0x10);
   CHECK(!code_map.FindEntry(0));
   CHECK(!code_map.FindEntry(ToAddress(0x1500 - 1)));
-  CHECK_EQ(&entry1, code_map.FindEntry(ToAddress(0x1500)));
-  CHECK_EQ(&entry1, code_map.FindEntry(ToAddress(0x1500 + 0x100)));
-  CHECK_EQ(&entry1, code_map.FindEntry(ToAddress(0x1500 + 0x200 - 1)));
-  CHECK_EQ(&entry2, code_map.FindEntry(ToAddress(0x1700)));
-  CHECK_EQ(&entry2, code_map.FindEntry(ToAddress(0x1700 + 0x50)));
-  CHECK_EQ(&entry2, code_map.FindEntry(ToAddress(0x1700 + 0x100 - 1)));
+  CHECK_EQ(entry1, code_map.FindEntry(ToAddress(0x1500)));
+  CHECK_EQ(entry1, code_map.FindEntry(ToAddress(0x1500 + 0x100)));
+  CHECK_EQ(entry1, code_map.FindEntry(ToAddress(0x1500 + 0x200 - 1)));
+  CHECK_EQ(entry2, code_map.FindEntry(ToAddress(0x1700)));
+  CHECK_EQ(entry2, code_map.FindEntry(ToAddress(0x1700 + 0x50)));
+  CHECK_EQ(entry2, code_map.FindEntry(ToAddress(0x1700 + 0x100 - 1)));
   CHECK(!code_map.FindEntry(ToAddress(0x1700 + 0x100)));
   CHECK(!code_map.FindEntry(ToAddress(0x1900 - 1)));
-  CHECK_EQ(&entry3, code_map.FindEntry(ToAddress(0x1900)));
-  CHECK_EQ(&entry3, code_map.FindEntry(ToAddress(0x1900 + 0x28)));
-  CHECK_EQ(&entry4, code_map.FindEntry(ToAddress(0x1950)));
-  CHECK_EQ(&entry4, code_map.FindEntry(ToAddress(0x1950 + 0x7)));
-  CHECK_EQ(&entry4, code_map.FindEntry(ToAddress(0x1950 + 0x10 - 1)));
+  CHECK_EQ(entry3, code_map.FindEntry(ToAddress(0x1900)));
+  CHECK_EQ(entry3, code_map.FindEntry(ToAddress(0x1900 + 0x28)));
+  CHECK_EQ(entry4, code_map.FindEntry(ToAddress(0x1950)));
+  CHECK_EQ(entry4, code_map.FindEntry(ToAddress(0x1950 + 0x7)));
+  CHECK_EQ(entry4, code_map.FindEntry(ToAddress(0x1950 + 0x10 - 1)));
   CHECK(!code_map.FindEntry(ToAddress(0x1950 + 0x10)));
   CHECK(!code_map.FindEntry(ToAddress(0xFFFFFFFF)));
 }
 
-
 TEST(CodeMapMoveAndDeleteCode) {
   CodeMap code_map;
-  CodeEntry entry1(i::CodeEventListener::FUNCTION_TAG, "aaa");
-  CodeEntry entry2(i::CodeEventListener::FUNCTION_TAG, "bbb");
-  code_map.AddCode(ToAddress(0x1500), &entry1, 0x200);
-  code_map.AddCode(ToAddress(0x1700), &entry2, 0x100);
-  CHECK_EQ(&entry1, code_map.FindEntry(ToAddress(0x1500)));
-  CHECK_EQ(&entry2, code_map.FindEntry(ToAddress(0x1700)));
+  CodeEntry* entry1 = new CodeEntry(i::CodeEventListener::FUNCTION_TAG, "aaa");
+  CodeEntry* entry2 = new CodeEntry(i::CodeEventListener::FUNCTION_TAG, "bbb");
+  code_map.AddCode(ToAddress(0x1500), entry1, 0x200);
+  code_map.AddCode(ToAddress(0x1700), entry2, 0x100);
+  CHECK_EQ(entry1, code_map.FindEntry(ToAddress(0x1500)));
+  CHECK_EQ(entry2, code_map.FindEntry(ToAddress(0x1700)));
   code_map.MoveCode(ToAddress(0x1500), ToAddress(0x1700));  // Deprecate bbb.
   CHECK(!code_map.FindEntry(ToAddress(0x1500)));
-  CHECK_EQ(&entry1, code_map.FindEntry(ToAddress(0x1700)));
-  CodeEntry entry3(i::CodeEventListener::FUNCTION_TAG, "ccc");
-  code_map.AddCode(ToAddress(0x1750), &entry3, 0x100);
+  CHECK_EQ(entry1, code_map.FindEntry(ToAddress(0x1700)));
+  CodeEntry* entry3 = new CodeEntry(i::CodeEventListener::FUNCTION_TAG, "ccc");
+  code_map.AddCode(ToAddress(0x1750), entry3, 0x100);
   CHECK(!code_map.FindEntry(ToAddress(0x1700)));
-  CHECK_EQ(&entry3, code_map.FindEntry(ToAddress(0x1750)));
+  CHECK_EQ(entry3, code_map.FindEntry(ToAddress(0x1750)));
 }
 
-
 namespace {
 
 class TestSetup {
@@ -355,24 +393,24 @@ TEST(RecordTickSample) {
   //  aaa -> bbb -> ccc  - sample2
   //      -> ccc -> aaa  - sample3
   TickSample sample1;
-  sample1.pc = ToAddress(0x1600);
-  sample1.tos = ToAddress(0x1500);
-  sample1.stack[0] = ToAddress(0x1510);
+  sample1.pc = ToPointer(0x1600);
+  sample1.tos = ToPointer(0x1500);
+  sample1.stack[0] = ToPointer(0x1510);
   sample1.frames_count = 1;
   generator.RecordTickSample(sample1);
   TickSample sample2;
-  sample2.pc = ToAddress(0x1925);
-  sample2.tos = ToAddress(0x1900);
-  sample2.stack[0] = ToAddress(0x1780);
-  sample2.stack[1] = ToAddress(0x10000);  // non-existent.
-  sample2.stack[2] = ToAddress(0x1620);
+  sample2.pc = ToPointer(0x1925);
+  sample2.tos = ToPointer(0x1900);
+  sample2.stack[0] = ToPointer(0x1780);
+  sample2.stack[1] = ToPointer(0x10000);  // non-existent.
+  sample2.stack[2] = ToPointer(0x1620);
   sample2.frames_count = 3;
   generator.RecordTickSample(sample2);
   TickSample sample3;
-  sample3.pc = ToAddress(0x1510);
-  sample3.tos = ToAddress(0x1500);
-  sample3.stack[0] = ToAddress(0x1910);
-  sample3.stack[1] = ToAddress(0x1610);
+  sample3.pc = ToPointer(0x1510);
+  sample3.tos = ToPointer(0x1500);
+  sample3.stack[0] = ToPointer(0x1910);
+  sample3.stack[1] = ToPointer(0x1610);
   sample3.frames_count = 2;
   generator.RecordTickSample(sample3);
 
@@ -393,10 +431,6 @@ TEST(RecordTickSample) {
   ProfileNode* node4 = top_down_test_helper.Walk(entry1, entry3, entry1);
   CHECK(node4);
   CHECK_EQ(entry1, node4->entry());
-
-  delete entry1;
-  delete entry2;
-  delete entry3;
 }
 
 static void CheckNodeIds(const ProfileNode* node, unsigned* expectedId) {
@@ -428,23 +462,23 @@ TEST(SampleIds) {
   //                    -> ccc #6 -> aaa #7 - sample3
   TickSample sample1;
   sample1.timestamp = v8::base::TimeTicks::HighResolutionNow();
-  sample1.pc = ToAddress(0x1600);
-  sample1.stack[0] = ToAddress(0x1510);
+  sample1.pc = ToPointer(0x1600);
+  sample1.stack[0] = ToPointer(0x1510);
   sample1.frames_count = 1;
   generator.RecordTickSample(sample1);
   TickSample sample2;
   sample2.timestamp = v8::base::TimeTicks::HighResolutionNow();
-  sample2.pc = ToAddress(0x1925);
-  sample2.stack[0] = ToAddress(0x1780);
-  sample2.stack[1] = ToAddress(0x10000);  // non-existent.
-  sample2.stack[2] = ToAddress(0x1620);
+  sample2.pc = ToPointer(0x1925);
+  sample2.stack[0] = ToPointer(0x1780);
+  sample2.stack[1] = ToPointer(0x10000);  // non-existent.
+  sample2.stack[2] = ToPointer(0x1620);
   sample2.frames_count = 3;
   generator.RecordTickSample(sample2);
   TickSample sample3;
   sample3.timestamp = v8::base::TimeTicks::HighResolutionNow();
-  sample3.pc = ToAddress(0x1510);
-  sample3.stack[0] = ToAddress(0x1910);
-  sample3.stack[1] = ToAddress(0x1610);
+  sample3.pc = ToPointer(0x1510);
+  sample3.stack[0] = ToPointer(0x1910);
+  sample3.stack[1] = ToPointer(0x1610);
   sample3.frames_count = 2;
   generator.RecordTickSample(sample3);
 
@@ -458,10 +492,6 @@ TEST(SampleIds) {
   for (int i = 0; i < 3; i++) {
     CHECK_EQ(expected_id[i], profile->sample(i)->id());
   }
-
-  delete entry1;
-  delete entry2;
-  delete entry3;
 }
 
 
@@ -479,8 +509,8 @@ TEST(NoSamples) {
   // We are building the following calls tree:
   // (root)#1 -> aaa #2 -> aaa #3 - sample1
   TickSample sample1;
-  sample1.pc = ToAddress(0x1600);
-  sample1.stack[0] = ToAddress(0x1510);
+  sample1.pc = ToPointer(0x1600);
+  sample1.stack[0] = ToPointer(0x1510);
   sample1.frames_count = 1;
   generator.RecordTickSample(sample1);
 
@@ -490,8 +520,6 @@ TEST(NoSamples) {
   CHECK_EQ(3u, nodeId - 1);
 
   CHECK_EQ(0, profile->samples_count());
-
-  delete entry1;
 }
 
 
diff --git a/deps/v8/test/cctest/test-regexp.cc b/deps/v8/test/cctest/test-regexp.cc
index 5b4e42c26dad8e..bcabebf6397340 100644
--- a/deps/v8/test/cctest/test-regexp.cc
+++ b/deps/v8/test/cctest/test-regexp.cc
@@ -432,7 +432,6 @@ TEST(RegExpParser) {
   CHECK_MIN_MAX("a(?=bbb|bb)c", 2, 2);
   CHECK_MIN_MAX("a(?!bbb|bb)c", 2, 2);
 
-  FLAG_harmony_regexp_named_captures = true;
   CheckParseEq("(?<a>x)(?<b>x)(?<c>x)\\k<a>",
                "(: (^ 'x') (^ 'x') (^ 'x') (<- 1))", true);
   CheckParseEq("(?<a>x)(?<b>x)(?<c>x)\\k<b>",
@@ -447,7 +446,6 @@ TEST(RegExpParser) {
 
   CheckParseEq("(?<\\u{03C0}>a)", "(^ 'a')", true);
   CheckParseEq("(?<\\u03C0>a)", "(^ 'a')", true);
-  FLAG_harmony_regexp_named_captures = false;
 }
 
 TEST(ParserRegression) {
@@ -459,14 +457,16 @@ TEST(ParserRegression) {
 
 static void ExpectError(const char* input, const char* expected,
                         bool unicode = false) {
+  Isolate* isolate = CcTest::i_isolate();
+
   v8::HandleScope scope(CcTest::isolate());
-  Zone zone(CcTest::i_isolate()->allocator(), ZONE_NAME);
-  FlatStringReader reader(CcTest::i_isolate(), CStrVector(input));
+  Zone zone(isolate->allocator(), ZONE_NAME);
+  FlatStringReader reader(isolate, CStrVector(input));
   RegExpCompileData result;
   JSRegExp::Flags flags = JSRegExp::kNone;
   if (unicode) flags |= JSRegExp::kUnicode;
-  CHECK(!v8::internal::RegExpParser::ParseRegExp(CcTest::i_isolate(), &zone,
-                                                 &reader, flags, &result));
+  CHECK(!v8::internal::RegExpParser::ParseRegExp(isolate, &zone, &reader, flags,
+                                                 &result));
   CHECK_NULL(result.tree);
   CHECK(!result.error.is_null());
   std::unique_ptr<char[]> str = result.error->ToCString(ALLOW_NULLS);
@@ -501,7 +501,6 @@ TEST(Errors) {
   }
   ExpectError(os.str().c_str(), kTooManyCaptures);
 
-  FLAG_harmony_regexp_named_captures = true;
   const char* kInvalidCaptureName = "Invalid capture group name";
   ExpectError("(?<>.)", kInvalidCaptureName, true);
   ExpectError("(?<1>.)", kInvalidCaptureName, true);
@@ -516,7 +515,6 @@ TEST(Errors) {
   ExpectError("(?<b>)\\k<a>", kInvalidCaptureReferenced, true);
   const char* kInvalidNamedReference = "Invalid named reference";
   ExpectError("\\ka", kInvalidNamedReference, true);
-  FLAG_harmony_regexp_named_captures = false;
 }
 
 
@@ -794,22 +792,14 @@ class ContextInitializer {
   v8::Local<v8::Context> env_;
 };
 
-
-static ArchRegExpMacroAssembler::Result Execute(Code* code,
-                                                String* input,
+static ArchRegExpMacroAssembler::Result Execute(Code* code, String* input,
                                                 int start_offset,
-                                                const byte* input_start,
-                                                const byte* input_end,
+                                                Address input_start,
+                                                Address input_end,
                                                 int* captures) {
   return NativeRegExpMacroAssembler::Execute(
-      code,
-      input,
-      start_offset,
-      input_start,
-      input_end,
-      captures,
-      0,
-      CcTest::i_isolate());
+      code, input, start_offset, reinterpret_cast<byte*>(input_start),
+      reinterpret_cast<byte*>(input_end), captures, 0, CcTest::i_isolate());
 }
 
 
@@ -832,8 +822,7 @@ TEST(MacroAssemblerNativeSuccess) {
   int captures[4] = {42, 37, 87, 117};
   Handle<String> input = factory->NewStringFromStaticChars("foofoo");
   Handle<SeqOneByteString> seq_input = Handle<SeqOneByteString>::cast(input);
-  const byte* start_adr =
-      reinterpret_cast<const byte*>(seq_input->GetCharsAddress());
+  Address start_adr = seq_input->GetCharsAddress();
 
   NativeRegExpMacroAssembler::Result result =
       Execute(*code,
@@ -1989,8 +1978,9 @@ TEST(UncachedExternalString) {
   v8::Local<v8::String> external =
       v8::String::NewExternalOneByte(isolate, new UncachedExternalString())
           .ToLocalChecked();
-  CHECK(v8::Utils::OpenHandle(*external)->map() ==
-        CcTest::i_isolate()->heap()->short_external_one_byte_string_map());
+  CHECK(
+      v8::Utils::OpenHandle(*external)->map() ==
+      ReadOnlyRoots(CcTest::i_isolate()).short_external_one_byte_string_map());
   v8::Local<v8::Object> global = env->Global();
   global->Set(env.local(), v8_str("external"), external).FromJust();
   CompileRun("var re = /y(.)/; re.test('ab');");
diff --git a/deps/v8/test/cctest/test-roots.cc b/deps/v8/test/cctest/test-roots.cc
new file mode 100644
index 00000000000000..e6220be8898b1b
--- /dev/null
+++ b/deps/v8/test/cctest/test-roots.cc
@@ -0,0 +1,121 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "src/heap/heap.h"
+#include "src/roots-inl.h"
+#include "test/cctest/cctest.h"
+
+namespace v8 {
+namespace internal {
+
+namespace {
+AllocationSpace GetSpaceFromObject(Object* object) {
+  DCHECK(object->IsHeapObject());
+  return MemoryChunk::FromHeapObject(HeapObject::cast(object))
+      ->owner()
+      ->identity();
+}
+}  // namespace
+
+#define CHECK_IN_RO_SPACE(name)    \
+  HeapObject* name = roots.name(); \
+  CHECK_EQ(RO_SPACE, GetSpaceFromObject(name));
+
+// The following tests check that all the roots accessible via ReadOnlyRoots are
+// in RO_SPACE.
+TEST(TestStrongReadOnlyRoots) {
+  ReadOnlyRoots roots(CcTest::i_isolate());
+
+#define TEST_ROOT(type, name, camel_name) CHECK_IN_RO_SPACE(name)
+  STRONG_READ_ONLY_ROOT_LIST(TEST_ROOT)
+#undef TEST_ROOT
+}
+
+TEST(TestInternalizedStrings) {
+  ReadOnlyRoots roots(CcTest::i_isolate());
+
+#define TEST_ROOT(name, str) CHECK_IN_RO_SPACE(name)
+  INTERNALIZED_STRING_LIST(TEST_ROOT)
+#undef TEST_ROOT
+}
+
+TEST(TestPrivateSymbols) {
+  ReadOnlyRoots roots(CcTest::i_isolate());
+
+  PRIVATE_SYMBOL_LIST(CHECK_IN_RO_SPACE)
+}
+
+TEST(TestPublicSymbols) {
+  ReadOnlyRoots roots(CcTest::i_isolate());
+
+#define TEST_ROOT(name, description) CHECK_IN_RO_SPACE(name)
+  PUBLIC_SYMBOL_LIST(TEST_ROOT)
+  WELL_KNOWN_SYMBOL_LIST(TEST_ROOT)
+#undef TEST_ROOT
+}
+
+TEST(TestStructMaps) {
+  ReadOnlyRoots roots(CcTest::i_isolate());
+
+#define TEST_ROOT(NAME, Name, name) CHECK_IN_RO_SPACE(name##_map)
+  STRUCT_LIST(TEST_ROOT)
+#undef TEST_ROOT
+}
+
+TEST(TestAllocationSiteMaps) {
+  ReadOnlyRoots roots(CcTest::i_isolate());
+
+#define TEST_ROOT(NAME, Name, Size, name) CHECK_IN_RO_SPACE(name##_map)
+  ALLOCATION_SITE_LIST(TEST_ROOT)
+#undef TEST_ROOT
+}
+
+#undef CHECK_IN_RO_SPACE
+
+namespace {
+bool IsInitiallyMutable(Heap* heap, Object* object) {
+// Entries in this list are in STRONG_MUTABLE_ROOT_LIST, but may initially point
+// to objects that in RO_SPACE.
+#define INITIALLY_READ_ONLY_ROOT_LIST(V) \
+  V(materialized_objects)                \
+  V(retaining_path_targets)              \
+  V(retained_maps)
+
+#define TEST_CAN_BE_READ_ONLY(name) \
+  if (heap->name() == object) return false;
+  INITIALLY_READ_ONLY_ROOT_LIST(TEST_CAN_BE_READ_ONLY)
+#undef TEST_CAN_BE_READ_ONLY
+#undef INITIALLY_READ_ONLY_ROOT_LIST
+  return true;
+}
+}  // namespace
+
+#define CHECK_NOT_IN_RO_SPACE(name)                           \
+  Object* name = heap->name();                                \
+  if (name->IsHeapObject() && IsInitiallyMutable(heap, name)) \
+    CHECK_NE(RO_SPACE, GetSpaceFromObject(name));
+
+// The following tests check that all the roots accessible via public Heap
+// accessors are not in RO_SPACE with the exception of the objects listed in
+// INITIALLY_READ_ONLY_ROOT_LIST.
+TEST(TestHeapRootsNotReadOnly) {
+  Heap* heap = CcTest::i_isolate()->heap();
+
+#define TEST_ROOT(type, name, camel_name) CHECK_NOT_IN_RO_SPACE(name)
+  MUTABLE_ROOT_LIST(TEST_ROOT)
+#undef TEST_ROOT
+}
+
+TEST(TestAccessorInfosNotReadOnly) {
+  Heap* heap = CcTest::i_isolate()->heap();
+
+#define TEST_ROOT(name, AccessorName) CHECK_NOT_IN_RO_SPACE(name##_accessor)
+  ACCESSOR_INFO_LIST(TEST_ROOT)
+#undef TEST_ROOT
+}
+
+#undef CHECK_NOT_IN_RO_SPACE
+
+}  // namespace internal
+}  // namespace v8
diff --git a/deps/v8/test/cctest/test-serialize.cc b/deps/v8/test/cctest/test-serialize.cc
index 695bbbcfcba203..50775d4f9d91c9 100644
--- a/deps/v8/test/cctest/test-serialize.cc
+++ b/deps/v8/test/cctest/test-serialize.cc
@@ -75,32 +75,51 @@ void DisableAlwaysOpt() {
 // TestIsolate is used for testing isolate serialization.
 class TestIsolate : public Isolate {
  public:
-  static v8::Isolate* NewInitialized(bool enable_serializer) {
-    i::Isolate* isolate = new TestIsolate(enable_serializer);
-    isolate->setup_delegate_ = new SetupIsolateDelegateForTests(true);
+  static v8::Isolate* NewInitialized() {
+    const bool kEnableSerializer = true;
+    const bool kGenerateHeap = true;
+    i::Isolate* isolate = new TestIsolate(kEnableSerializer, kGenerateHeap);
     v8::Isolate* v8_isolate = reinterpret_cast<v8::Isolate*>(isolate);
     v8::Isolate::Scope isolate_scope(v8_isolate);
     isolate->Init(nullptr);
+    isolate->heap()->read_only_space()->ClearStringPaddingIfNeeded();
     return v8_isolate;
   }
   // Wraps v8::Isolate::New, but with a TestIsolate under the hood.
   // Allows flexibility to bootstrap with or without snapshot even when
   // the production Isolate class has one or the other behavior baked in.
   static v8::Isolate* New(const v8::Isolate::CreateParams& params) {
-    i::Isolate* isolate = new TestIsolate(false);
-    bool create_heap_objects = params.snapshot_blob == nullptr;
-    isolate->setup_delegate_ =
-        new SetupIsolateDelegateForTests(create_heap_objects);
-    return v8::IsolateNewImpl(isolate, params);
+    const bool kEnableSerializer = false;
+    const bool kGenerateHeap = params.snapshot_blob == nullptr;
+    i::Isolate* isolate = new TestIsolate(kEnableSerializer, kGenerateHeap);
+    v8::Isolate* v8_isolate = reinterpret_cast<v8::Isolate*>(isolate);
+    v8::Isolate::Initialize(v8_isolate, params);
+    return v8_isolate;
   }
-  explicit TestIsolate(bool enable_serializer) : Isolate(enable_serializer) {
+  explicit TestIsolate(bool with_serializer, bool generate_heap) : Isolate() {
+    if (with_serializer) enable_serializer();
     set_array_buffer_allocator(CcTest::array_buffer_allocator());
+    setup_delegate_ = new SetupIsolateDelegateForTests(generate_heap);
+
+    if (FLAG_embedded_builtins) {
+      if (generate_heap || clear_embedded_blob_) {
+        // We're generating the heap, including new builtins. Act as if we don't
+        // have an embedded blob.
+        clear_embedded_blob_ = true;
+        SetEmbeddedBlob(nullptr, 0);
+      }
+    }
   }
-  void SetDeserializeFromSnapshot() {
-    setup_delegate_ = new SetupIsolateDelegateForTests(false);
-  }
+
+ private:
+  // A sticky flag that ensures the embedded blob is remains cleared after it
+  // has been cleared once. E.g.: after creating & serializing a complete heap
+  // snapshot, future isolates also expect the embedded blob to be cleared.
+  static bool clear_embedded_blob_;
 };
 
+bool TestIsolate::clear_embedded_blob_ = false;
+
 static Vector<const byte> WritePayload(const Vector<const byte>& payload) {
   int length = payload.length();
   byte* blob = NewArray<byte>(length);
@@ -120,6 +139,87 @@ struct StartupBlobs {
   }
 };
 
+namespace {
+
+bool RunExtraCode(v8::Isolate* isolate, v8::Local<v8::Context> context,
+                  const char* utf8_source, const char* name) {
+  v8::Context::Scope context_scope(context);
+  v8::TryCatch try_catch(isolate);
+  v8::Local<v8::String> source_string;
+  if (!v8::String::NewFromUtf8(isolate, utf8_source, v8::NewStringType::kNormal)
+           .ToLocal(&source_string)) {
+    return false;
+  }
+  v8::Local<v8::String> resource_name =
+      v8::String::NewFromUtf8(isolate, name, v8::NewStringType::kNormal)
+          .ToLocalChecked();
+  v8::ScriptOrigin origin(resource_name);
+  v8::ScriptCompiler::Source source(source_string, origin);
+  v8::Local<v8::Script> script;
+  if (!v8::ScriptCompiler::Compile(context, &source).ToLocal(&script))
+    return false;
+  if (script->Run(context).IsEmpty()) return false;
+  CHECK(!try_catch.HasCaught());
+  return true;
+}
+
+v8::StartupData CreateSnapshotDataBlob(const char* embedded_source = nullptr) {
+  // Create a new isolate and a new context from scratch, optionally run
+  // a script to embed, and serialize to create a snapshot blob.
+  v8::StartupData result = {nullptr, 0};
+  {
+    v8::SnapshotCreator snapshot_creator;
+    v8::Isolate* isolate = snapshot_creator.GetIsolate();
+    {
+      v8::HandleScope scope(isolate);
+      v8::Local<v8::Context> context = v8::Context::New(isolate);
+      if (embedded_source != nullptr &&
+          !RunExtraCode(isolate, context, embedded_source, "<embedded>")) {
+        return result;
+      }
+      snapshot_creator.SetDefaultContext(context);
+    }
+    result = snapshot_creator.CreateBlob(
+        v8::SnapshotCreator::FunctionCodeHandling::kClear);
+  }
+  return result;
+}
+
+v8::StartupData WarmUpSnapshotDataBlob(v8::StartupData cold_snapshot_blob,
+                                       const char* warmup_source) {
+  CHECK(cold_snapshot_blob.raw_size > 0 && cold_snapshot_blob.data != nullptr);
+  CHECK_NOT_NULL(warmup_source);
+  // Use following steps to create a warmed up snapshot blob from a cold one:
+  //  - Create a new isolate from the cold snapshot.
+  //  - Create a new context to run the warmup script. This will trigger
+  //    compilation of executed functions.
+  //  - Create a new context. This context will be unpolluted.
+  //  - Serialize the isolate and the second context into a new snapshot blob.
+  v8::StartupData result = {nullptr, 0};
+  {
+    v8::SnapshotCreator snapshot_creator(nullptr, &cold_snapshot_blob);
+    v8::Isolate* isolate = snapshot_creator.GetIsolate();
+    {
+      v8::HandleScope scope(isolate);
+      v8::Local<v8::Context> context = v8::Context::New(isolate);
+      if (!RunExtraCode(isolate, context, warmup_source, "<warm-up>")) {
+        return result;
+      }
+    }
+    {
+      v8::HandleScope handle_scope(isolate);
+      isolate->ContextDisposedNotification(false);
+      v8::Local<v8::Context> context = v8::Context::New(isolate);
+      snapshot_creator.SetDefaultContext(context);
+    }
+    result = snapshot_creator.CreateBlob(
+        v8::SnapshotCreator::FunctionCodeHandling::kKeep);
+  }
+  return result;
+}
+
+}  // namespace
+
 static StartupBlobs Serialize(v8::Isolate* isolate) {
   // We have to create one context.  One reason for this is so that the builtins
   // can be loaded from self hosted JS builtins and their addresses can be
@@ -171,10 +271,11 @@ v8::Isolate* InitializeFromBlob(StartupBlobs& blobs) {
     SnapshotData startup_snapshot(blobs.startup);
     BuiltinSnapshotData builtin_snapshot(blobs.builtin);
     StartupDeserializer deserializer(&startup_snapshot, &builtin_snapshot);
-    TestIsolate* isolate = new TestIsolate(false);
+    const bool kEnableSerializer = false;
+    const bool kGenerateHeap = false;
+    TestIsolate* isolate = new TestIsolate(kEnableSerializer, kGenerateHeap);
     v8_isolate = reinterpret_cast<v8::Isolate*>(isolate);
     v8::Isolate::Scope isolate_scope(v8_isolate);
-    isolate->SetDeserializeFromSnapshot();
     isolate->Init(&deserializer);
   }
   return v8_isolate;
@@ -198,10 +299,8 @@ static void SanityCheck(v8::Isolate* v8_isolate) {
   isolate->factory()->InternalizeOneByteString(STATIC_CHAR_VECTOR("Empty"));
 }
 
-UNINITIALIZED_TEST(StartupSerializerOnce) {
-  DisableLazyDeserialization();
-  DisableAlwaysOpt();
-  v8::Isolate* isolate = TestIsolate::NewInitialized(true);
+void TestStartupSerializerOnceImpl() {
+  v8::Isolate* isolate = TestIsolate::NewInitialized();
   StartupBlobs blobs = Serialize(isolate);
   isolate->Dispose();
   isolate = Deserialize(blobs);
@@ -218,6 +317,47 @@ UNINITIALIZED_TEST(StartupSerializerOnce) {
   blobs.Dispose();
 }
 
+UNINITIALIZED_TEST(StartupSerializerOnce) {
+  DisableLazyDeserialization();
+  DisableAlwaysOpt();
+  TestStartupSerializerOnceImpl();
+}
+
+UNINITIALIZED_TEST(StartupSerializerOnce1) {
+  DisableLazyDeserialization();
+  DisableAlwaysOpt();
+  FLAG_serialization_chunk_size = 1;
+  TestStartupSerializerOnceImpl();
+}
+
+UNINITIALIZED_TEST(StartupSerializerOnce32) {
+  DisableLazyDeserialization();
+  DisableAlwaysOpt();
+  FLAG_serialization_chunk_size = 32;
+  TestStartupSerializerOnceImpl();
+}
+
+UNINITIALIZED_TEST(StartupSerializerOnce1K) {
+  DisableLazyDeserialization();
+  DisableAlwaysOpt();
+  FLAG_serialization_chunk_size = 1 * KB;
+  TestStartupSerializerOnceImpl();
+}
+
+UNINITIALIZED_TEST(StartupSerializerOnce4K) {
+  DisableLazyDeserialization();
+  DisableAlwaysOpt();
+  FLAG_serialization_chunk_size = 4 * KB;
+  TestStartupSerializerOnceImpl();
+}
+
+UNINITIALIZED_TEST(StartupSerializerOnce32K) {
+  DisableLazyDeserialization();
+  DisableAlwaysOpt();
+  FLAG_serialization_chunk_size = 32 * KB;
+  TestStartupSerializerOnceImpl();
+}
+
 UNINITIALIZED_TEST(StartupSerializerRootMapDependencies) {
   DisableAlwaysOpt();
   v8::SnapshotCreator snapshot_creator;
@@ -239,8 +379,9 @@ UNINITIALIZED_TEST(StartupSerializerRootMapDependencies) {
     // platforms. So, without special measures we're risking to serialize
     // object, requiring alignment before FreeSpaceMap is fully serialized.
     v8::internal::Handle<Map> map(
-        internal_isolate->heap()->one_byte_internalized_string_map());
-    Map::WeakCellForMap(map);
+        ReadOnlyRoots(internal_isolate).one_byte_internalized_string_map(),
+        internal_isolate);
+    Map::WeakCellForMap(internal_isolate, map);
     // Need to avoid DCHECKs inside SnapshotCreator.
     snapshot_creator.SetDefaultContext(v8::Context::New(isolate));
   }
@@ -269,7 +410,7 @@ UNINITIALIZED_TEST(StartupSerializerRootMapDependencies) {
 UNINITIALIZED_TEST(StartupSerializerTwice) {
   DisableLazyDeserialization();
   DisableAlwaysOpt();
-  v8::Isolate* isolate = TestIsolate::NewInitialized(true);
+  v8::Isolate* isolate = TestIsolate::NewInitialized();
   StartupBlobs blobs1 = Serialize(isolate);
   StartupBlobs blobs2 = Serialize(isolate);
   isolate->Dispose();
@@ -291,7 +432,7 @@ UNINITIALIZED_TEST(StartupSerializerTwice) {
 UNINITIALIZED_TEST(StartupSerializerOnceRunScript) {
   DisableLazyDeserialization();
   DisableAlwaysOpt();
-  v8::Isolate* isolate = TestIsolate::NewInitialized(true);
+  v8::Isolate* isolate = TestIsolate::NewInitialized();
   StartupBlobs blobs = Serialize(isolate);
   isolate->Dispose();
   isolate = Deserialize(blobs);
@@ -317,7 +458,7 @@ UNINITIALIZED_TEST(StartupSerializerOnceRunScript) {
 UNINITIALIZED_TEST(StartupSerializerTwiceRunScript) {
   DisableLazyDeserialization();
   DisableAlwaysOpt();
-  v8::Isolate* isolate = TestIsolate::NewInitialized(true);
+  v8::Isolate* isolate = TestIsolate::NewInitialized();
   StartupBlobs blobs1 = Serialize(isolate);
   StartupBlobs blobs2 = Serialize(isolate);
   isolate->Dispose();
@@ -344,7 +485,7 @@ UNINITIALIZED_TEST(StartupSerializerTwiceRunScript) {
 static void PartiallySerializeContext(Vector<const byte>* startup_blob_out,
                                       Vector<const byte>* builtin_blob_out,
                                       Vector<const byte>* partial_blob_out) {
-  v8::Isolate* v8_isolate = TestIsolate::NewInitialized(true);
+  v8::Isolate* v8_isolate = TestIsolate::NewInitialized();
   Isolate* isolate = reinterpret_cast<Isolate*>(v8_isolate);
   Heap* heap = isolate->heap();
   {
@@ -448,7 +589,7 @@ UNINITIALIZED_TEST(PartialSerializerContext) {
 static void PartiallySerializeCustomContext(
     Vector<const byte>* startup_blob_out, Vector<const byte>* builtin_blob_out,
     Vector<const byte>* partial_blob_out) {
-  v8::Isolate* v8_isolate = TestIsolate::NewInitialized(true);
+  v8::Isolate* v8_isolate = TestIsolate::NewInitialized();
   Isolate* isolate = reinterpret_cast<Isolate*>(v8_isolate);
   {
     v8::Isolate::Scope isolate_scope(v8_isolate);
@@ -622,7 +763,7 @@ TEST(CustomSnapshotDataBlob1) {
   DisableAlwaysOpt();
   const char* source1 = "function f() { return 42; }";
 
-  v8::StartupData data1 = v8::V8::CreateSnapshotDataBlob(source1);
+  v8::StartupData data1 = CreateSnapshotDataBlob(source1);
 
   v8::Isolate::CreateParams params1;
   params1.snapshot_blob = &data1;
@@ -868,7 +1009,7 @@ i::Handle<i::JSArrayBuffer> GetBufferFromTypedArray(
   i::Handle<i::JSArrayBufferView> view = i::Handle<i::JSArrayBufferView>::cast(
       v8::Utils::OpenHandle(*typed_array));
 
-  return i::handle(i::JSArrayBuffer::cast(view->buffer()));
+  return i::handle(i::JSArrayBuffer::cast(view->buffer()), view->GetIsolate());
 }
 
 TEST(CustomSnapshotDataBlobOnOrOffHeapTypedArray) {
@@ -942,7 +1083,7 @@ TEST(CustomSnapshotDataBlob2) {
       "function g() { return 43; }"
       "/./.test('a')";
 
-  v8::StartupData data2 = v8::V8::CreateSnapshotDataBlob(source2);
+  v8::StartupData data2 = CreateSnapshotDataBlob(source2);
 
   v8::Isolate::CreateParams params2;
   params2.snapshot_blob = &data2;
@@ -985,7 +1126,7 @@ TEST(CustomSnapshotDataBlobOutdatedContextWithOverflow) {
 
   const char* source2 = "o.a(42)";
 
-  v8::StartupData data = v8::V8::CreateSnapshotDataBlob(source1);
+  v8::StartupData data = CreateSnapshotDataBlob(source1);
 
   v8::Isolate::CreateParams params;
   params.snapshot_blob = &data;
@@ -1034,7 +1175,7 @@ TEST(CustomSnapshotDataBlobWithLocker) {
 
   const char* source1 = "function f() { return 42; }";
 
-  v8::StartupData data1 = v8::V8::CreateSnapshotDataBlob(source1);
+  v8::StartupData data1 = CreateSnapshotDataBlob(source1);
 
   v8::Isolate::CreateParams params1;
   params1.snapshot_blob = &data1;
@@ -1066,7 +1207,7 @@ TEST(CustomSnapshotDataBlobStackOverflow) {
       "  b = c;"
       "}";
 
-  v8::StartupData data = v8::V8::CreateSnapshotDataBlob(source);
+  v8::StartupData data = CreateSnapshotDataBlob(source);
 
   v8::Isolate::CreateParams params;
   params.snapshot_blob = &data;
@@ -1105,8 +1246,8 @@ TEST(SnapshotDataBlobWithWarmup) {
   DisableAlwaysOpt();
   const char* warmup = "Math.abs(1); Math.random = 1;";
 
-  v8::StartupData cold = v8::V8::CreateSnapshotDataBlob();
-  v8::StartupData warm = v8::V8::WarmUpSnapshotDataBlob(cold, warmup);
+  v8::StartupData cold = CreateSnapshotDataBlob();
+  v8::StartupData warm = WarmUpSnapshotDataBlob(cold, warmup);
   delete[] cold.data;
 
   v8::Isolate::CreateParams params;
@@ -1139,8 +1280,8 @@ TEST(CustomSnapshotDataBlobWithWarmup) {
       "var a = 5";
   const char* warmup = "a = f()";
 
-  v8::StartupData cold = v8::V8::CreateSnapshotDataBlob(source);
-  v8::StartupData warm = v8::V8::WarmUpSnapshotDataBlob(cold, warmup);
+  v8::StartupData cold = CreateSnapshotDataBlob(source);
+  v8::StartupData warm = WarmUpSnapshotDataBlob(cold, warmup);
   delete[] cold.data;
 
   v8::Isolate::CreateParams params;
@@ -1160,7 +1301,7 @@ TEST(CustomSnapshotDataBlobWithWarmup) {
     CHECK(IsCompiled("Math.abs"));
     CHECK(!IsCompiled("g"));
     CHECK(IsCompiled("String.raw"));
-    CHECK(!IsCompiled("Array.prototype.sort"));
+    CHECK(!IsCompiled("Array.prototype.lastIndexOf"));
     CHECK_EQ(5, CompileRun("a")->Int32Value(context).FromJust());
   }
   isolate->Dispose();
@@ -1177,8 +1318,8 @@ TEST(CustomSnapshotDataBlobImmortalImmovableRoots) {
                       STATIC_CHAR_VECTOR("a.push(function() {return 7});"),
                       STATIC_CHAR_VECTOR("\0"), 10000);
 
-  v8::StartupData data = v8::V8::CreateSnapshotDataBlob(
-      reinterpret_cast<const char*>(source.start()));
+  v8::StartupData data =
+      CreateSnapshotDataBlob(reinterpret_cast<const char*>(source.start()));
 
   v8::Isolate::CreateParams params;
   params.snapshot_blob = &data;
@@ -1248,7 +1389,7 @@ static Handle<SharedFunctionInfo> CompileScriptAndProduceCache(
   return sfi;
 }
 
-TEST(CodeSerializerOnePlusOne) {
+void TestCodeSerializerOnePlusOneImpl() {
   LocalContext context;
   Isolate* isolate = CcTest::i_isolate();
   isolate->compilation_cache()->Disable();  // Disable same-isolate code cache.
@@ -1287,7 +1428,7 @@ TEST(CodeSerializerOnePlusOne) {
   Handle<JSFunction> copy_fun =
       isolate->factory()->NewFunctionFromSharedFunctionInfo(
           copy, isolate->native_context());
-  Handle<JSObject> global(isolate->context()->global_object());
+  Handle<JSObject> global(isolate->context()->global_object(), isolate);
   Handle<Object> copy_result =
       Execution::Call(isolate, copy_fun, global, 0, nullptr).ToHandleChecked();
   CHECK_EQ(2, Handle<Smi>::cast(copy_result)->value());
@@ -1297,6 +1438,23 @@ TEST(CodeSerializerOnePlusOne) {
   delete cache;
 }
 
+TEST(CodeSerializerOnePlusOne) { TestCodeSerializerOnePlusOneImpl(); }
+
+TEST(CodeSerializerOnePlusOne1) {
+  FLAG_serialization_chunk_size = 1;
+  TestCodeSerializerOnePlusOneImpl();
+}
+
+TEST(CodeSerializerOnePlusOne32) {
+  FLAG_serialization_chunk_size = 32;
+  TestCodeSerializerOnePlusOneImpl();
+}
+
+TEST(CodeSerializerOnePlusOne4K) {
+  FLAG_serialization_chunk_size = 4 * KB;
+  TestCodeSerializerOnePlusOneImpl();
+}
+
 TEST(CodeSerializerPromotedToCompilationCache) {
   LocalContext context;
   Isolate* isolate = CcTest::i_isolate();
@@ -1345,7 +1503,7 @@ TEST(CodeSerializerInternalizedString) {
   CHECK(!orig_source.is_identical_to(copy_source));
   CHECK(orig_source->Equals(*copy_source));
 
-  Handle<JSObject> global(isolate->context()->global_object());
+  Handle<JSObject> global(isolate->context()->global_object(), isolate);
 
   i::ScriptData* script_data = nullptr;
   Handle<SharedFunctionInfo> orig = CompileScriptAndProduceCache(
@@ -1400,11 +1558,11 @@ TEST(CodeSerializerLargeCodeObject) {
       STATIC_CHAR_VECTOR("var j=1; if (j == 0) {"),
       STATIC_CHAR_VECTOR(
           "for (let i of Object.prototype) for (let k = 0; k < 0; ++k);"),
-      STATIC_CHAR_VECTOR("} j=7; j"), 1100);
+      STATIC_CHAR_VECTOR("} j=7; j"), 1200);
   Handle<String> source_str =
       isolate->factory()->NewStringFromOneByte(source).ToHandleChecked();
 
-  Handle<JSObject> global(isolate->context()->global_object());
+  Handle<JSObject> global(isolate->context()->global_object(), isolate);
   ScriptData* cache = nullptr;
 
   Handle<SharedFunctionInfo> orig = CompileScriptAndProduceCache(
@@ -1470,7 +1628,7 @@ TEST(CodeSerializerLargeCodeObjectWithIncrementalMarking) {
     ec_page = Page::FromAddress(moving_object->address());
   }
 
-  Handle<JSObject> global(isolate->context()->global_object());
+  Handle<JSObject> global(isolate->context()->global_object(), isolate);
   ScriptData* cache = nullptr;
 
   Handle<SharedFunctionInfo> orig = CompileScriptAndProduceCache(
@@ -1533,7 +1691,7 @@ TEST(CodeSerializerLargeStrings) {
                        f->NewStringFromOneByte(source_t).ToHandleChecked())
           .ToHandleChecked();
 
-  Handle<JSObject> global(isolate->context()->global_object());
+  Handle<JSObject> global(isolate->context()->global_object(), isolate);
   ScriptData* cache = nullptr;
 
   Handle<SharedFunctionInfo> orig = CompileScriptAndProduceCache(
@@ -1601,7 +1759,7 @@ TEST(CodeSerializerThreeBigStrings) {
              f->NewConsString(source_a_str, source_b_str).ToHandleChecked(),
              source_c_str).ToHandleChecked();
 
-  Handle<JSObject> global(isolate->context()->global_object());
+  Handle<JSObject> global(isolate->context()->global_object(), isolate);
   ScriptData* cache = nullptr;
 
   Handle<SharedFunctionInfo> orig = CompileScriptAndProduceCache(
@@ -1719,7 +1877,7 @@ TEST(CodeSerializerExternalString) {
                                      ->NewStringFromUtf8(CStrVector(source))
                                      .ToHandleChecked();
 
-  Handle<JSObject> global(isolate->context()->global_object());
+  Handle<JSObject> global(isolate->context()->global_object(), isolate);
   ScriptData* cache = nullptr;
 
   Handle<SharedFunctionInfo> orig = CompileScriptAndProduceCache(
@@ -1743,6 +1901,11 @@ TEST(CodeSerializerExternalString) {
 
   CHECK_EQ(15.0, copy_result->Number());
 
+  // This avoids the GC from trying to free stack allocated resources.
+  i::Handle<i::ExternalOneByteString>::cast(one_byte_string)
+      ->set_resource(nullptr);
+  i::Handle<i::ExternalTwoByteString>::cast(two_byte_string)
+      ->set_resource(nullptr);
   delete cache;
 }
 
@@ -1776,7 +1939,7 @@ TEST(CodeSerializerLargeExternalString) {
              f->NewConsString(f->NewStringFromAsciiChecked(" = 42; "), name)
                  .ToHandleChecked()).ToHandleChecked();
 
-  Handle<JSObject> global(isolate->context()->global_object());
+  Handle<JSObject> global(isolate->context()->global_object(), isolate);
   ScriptData* cache = nullptr;
 
   Handle<SharedFunctionInfo> orig = CompileScriptAndProduceCache(
@@ -1799,6 +1962,8 @@ TEST(CodeSerializerLargeExternalString) {
 
   CHECK_EQ(42.0, copy_result->Number());
 
+  // This avoids the GC from trying to free stack allocated resources.
+  i::Handle<i::ExternalOneByteString>::cast(name)->set_resource(nullptr);
   delete cache;
   string.Dispose();
 }
@@ -1825,7 +1990,7 @@ TEST(CodeSerializerExternalScriptName) {
   CHECK(name->IsExternalOneByteString());
   CHECK(!name->IsInternalizedString());
 
-  Handle<JSObject> global(isolate->context()->global_object());
+  Handle<JSObject> global(isolate->context()->global_object(), isolate);
   ScriptData* cache = nullptr;
 
   Handle<SharedFunctionInfo> orig =
@@ -1848,6 +2013,8 @@ TEST(CodeSerializerExternalScriptName) {
 
   CHECK_EQ(10.0, copy_result->Number());
 
+  // This avoids the GC from trying to free stack allocated resources.
+  i::Handle<i::ExternalOneByteString>::cast(name)->set_resource(nullptr);
   delete cache;
 }
 
@@ -1916,8 +2083,8 @@ v8::ScriptCompiler::CachedData* CompileRunAndProduceCache(
 
 void CheckDeserializedFlag(v8::Local<v8::UnboundScript> script) {
   i::Handle<i::SharedFunctionInfo> sfi = v8::Utils::OpenHandle(*script);
-  i::Handle<i::Script> i_script(Script::cast(sfi->script()));
-  i::SharedFunctionInfo::ScriptIterator iterator(i_script);
+  i::SharedFunctionInfo::ScriptIterator iterator(sfi->GetIsolate(),
+                                                 Script::cast(sfi->script()));
   while (SharedFunctionInfo* next = iterator.Next()) {
     CHECK_EQ(next->is_compiled(), next->deserialized());
   }
@@ -2316,26 +2483,6 @@ static void AccessorForSerialization(
   info.GetReturnValue().Set(v8_num(2017));
 }
 
-class SerializedExtension : public v8::Extension {
- public:
-  SerializedExtension()
-      : v8::Extension("serialized extension",
-                      "native function g();"
-                      "function h() { return 13; };"
-                      "function i() { return 14; };"
-                      "var o = { p: 7 };") {}
-
-  virtual v8::Local<v8::FunctionTemplate> GetNativeFunctionTemplate(
-      v8::Isolate* isolate, v8::Local<v8::String> name) {
-    CHECK(name->Equals(isolate->GetCurrentContext(), v8_str("g")).FromJust());
-    return v8::FunctionTemplate::New(isolate, FunctionCallback);
-  }
-
-  static void FunctionCallback(
-      const v8::FunctionCallbackInfo<v8::Value>& args) {
-    args.GetReturnValue().Set(v8_num(12));
-  }
-};
 
 static SerializerOneByteResource serializable_one_byte_resource("one_byte", 8);
 static SerializerTwoByteResource serializable_two_byte_resource("two_byte", 8);
@@ -2345,7 +2492,6 @@ intptr_t original_external_references[] = {
     reinterpret_cast<intptr_t>(&serialized_static_field),
     reinterpret_cast<intptr_t>(&NamedPropertyGetterForSerialization),
     reinterpret_cast<intptr_t>(&AccessorForSerialization),
-    reinterpret_cast<intptr_t>(&SerializedExtension::FunctionCallback),
     reinterpret_cast<intptr_t>(&serialized_static_field),  // duplicate entry
     reinterpret_cast<intptr_t>(&serializable_one_byte_resource),
     reinterpret_cast<intptr_t>(&serializable_two_byte_resource),
@@ -2356,7 +2502,6 @@ intptr_t replaced_external_references[] = {
     reinterpret_cast<intptr_t>(&serialized_static_field),
     reinterpret_cast<intptr_t>(&NamedPropertyGetterForSerialization),
     reinterpret_cast<intptr_t>(&AccessorForSerialization),
-    reinterpret_cast<intptr_t>(&SerializedExtension::FunctionCallback),
     reinterpret_cast<intptr_t>(&serialized_static_field),
     reinterpret_cast<intptr_t>(&serializable_one_byte_resource),
     reinterpret_cast<intptr_t>(&serializable_two_byte_resource),
@@ -2555,6 +2700,92 @@ TEST(SnapshotCreatorNoExternalReferencesDefault) {
   delete[] blob.data;
 }
 
+v8::StartupData CreateCustomSnapshotWithPreparseDataAndNoOuterScope() {
+  v8::SnapshotCreator creator;
+  v8::Isolate* isolate = creator.GetIsolate();
+  {
+    v8::HandleScope handle_scope(isolate);
+    {
+      v8::Local<v8::Context> context = v8::Context::New(isolate);
+      v8::Context::Scope context_scope(context);
+      CompileRun(
+          "var foo = {\n"
+          "  // This function is not top-level, but also has no outer scope.\n"
+          "  bar: function(){\n"
+          "    // Add an inner function so that the outer one has preparse\n"
+          "    // scope data.\n"
+          "    return function(){}\n"
+          "  }\n"
+          "};\n");
+      creator.SetDefaultContext(context);
+    }
+  }
+  return creator.CreateBlob(v8::SnapshotCreator::FunctionCodeHandling::kClear);
+}
+
+TEST(SnapshotCreatorPreparseDataAndNoOuterScope) {
+  DisableAlwaysOpt();
+  v8::StartupData blob = CreateCustomSnapshotWithPreparseDataAndNoOuterScope();
+
+  // Deserialize with an incomplete list of external references.
+  {
+    v8::Isolate::CreateParams params;
+    params.snapshot_blob = &blob;
+    params.array_buffer_allocator = CcTest::array_buffer_allocator();
+    // Test-appropriate equivalent of v8::Isolate::New.
+    v8::Isolate* isolate = TestIsolate::New(params);
+    {
+      v8::Isolate::Scope isolate_scope(isolate);
+      v8::HandleScope handle_scope(isolate);
+      v8::Local<v8::Context> context = v8::Context::New(isolate);
+      v8::Context::Scope context_scope(context);
+    }
+    isolate->Dispose();
+  }
+  delete[] blob.data;
+}
+
+v8::StartupData CreateCustomSnapshotArrayJoinWithKeep() {
+  v8::SnapshotCreator creator;
+  v8::Isolate* isolate = creator.GetIsolate();
+  {
+    v8::HandleScope handle_scope(isolate);
+    {
+      v8::Local<v8::Context> context = v8::Context::New(isolate);
+      v8::Context::Scope context_scope(context);
+      CompileRun(
+          "[].join('');\n"
+          "function g() { return String([1,2,3]); }\n");
+      ExpectString("g()", "1,2,3");
+      creator.SetDefaultContext(context);
+    }
+  }
+  return creator.CreateBlob(v8::SnapshotCreator::FunctionCodeHandling::kKeep);
+}
+
+TEST(SnapshotCreatorArrayJoinWithKeep) {
+  DisableAlwaysOpt();
+  v8::StartupData blob = CreateCustomSnapshotArrayJoinWithKeep();
+
+  // Deserialize with an incomplete list of external references.
+  {
+    v8::Isolate::CreateParams params;
+    params.snapshot_blob = &blob;
+    params.array_buffer_allocator = CcTest::array_buffer_allocator();
+    // Test-appropriate equivalent of v8::Isolate::New.
+    v8::Isolate* isolate = TestIsolate::New(params);
+    {
+      v8::Isolate::Scope isolate_scope(isolate);
+      v8::HandleScope handle_scope(isolate);
+      v8::Local<v8::Context> context = v8::Context::New(isolate);
+      v8::Context::Scope context_scope(context);
+      ExpectString("g()", "1,2,3");
+    }
+    isolate->Dispose();
+  }
+  delete[] blob.data;
+}
+
 TEST(SnapshotCreatorNoExternalReferencesCustomFail1) {
   DisableAlwaysOpt();
   v8::StartupData blob = CreateSnapshotWithDefaultAndCustom();
@@ -3020,9 +3251,6 @@ TEST(SnapshotCreatorIncludeGlobalProxy) {
   {
     v8::SnapshotCreator creator(original_external_references);
     v8::Isolate* isolate = creator.GetIsolate();
-    v8::RegisterExtension(new SerializedExtension);
-    const char* extension_names[] = {"serialized extension"};
-    v8::ExtensionConfiguration extensions(1, extension_names);
     {
       // Set default context. This context implicitly does *not* serialize
       // the global proxy, and upon deserialization one has to be created
@@ -3037,10 +3265,13 @@ TEST(SnapshotCreatorIncludeGlobalProxy) {
       global_template->SetHandler(v8::NamedPropertyHandlerConfiguration(
           NamedPropertyGetterForSerialization));
       v8::Local<v8::Context> context =
-          v8::Context::New(isolate, &extensions, global_template);
+          v8::Context::New(isolate, nullptr, global_template);
       v8::Context::Scope context_scope(context);
+      CompileRun(
+          "function h() { return 13; };"
+          "function i() { return 14; };"
+          "var o = { p: 7 };");
       ExpectInt32("f()", 42);
-      ExpectInt32("g()", 12);
       ExpectInt32("h()", 13);
       ExpectInt32("o.p", 7);
       ExpectInt32("x", 2016);
@@ -3068,7 +3299,7 @@ TEST(SnapshotCreatorIncludeGlobalProxy) {
           v8::FunctionTemplate::NewWithCache(isolate, SerializedCallback, priv,
                                              v8::Local<v8::Value>()));
       v8::Local<v8::Context> context =
-          v8::Context::New(isolate, &extensions, global_template);
+          v8::Context::New(isolate, nullptr, global_template);
       v8::Context::Scope context_scope(context);
 
       CHECK(context->Global()
@@ -3081,9 +3312,6 @@ TEST(SnapshotCreatorIncludeGlobalProxy) {
                 .FromJust());
 
       ExpectInt32("f()", 42);
-      ExpectInt32("g()", 12);
-      ExpectInt32("h()", 13);
-      ExpectInt32("o.p", 7);
       ExpectInt32("x", 2016);
       ExpectInt32("y", 2017);
       CHECK(v8_str("hidden string")
@@ -3110,12 +3338,14 @@ TEST(SnapshotCreatorIncludeGlobalProxy) {
     v8::Isolate* isolate = TestIsolate::New(params);
     {
       v8::Isolate::Scope isolate_scope(isolate);
-      // We can introduce new extensions, which could override the already
-      // snapshotted extension.
+      // We can introduce new extensions, which could override functions already
+      // in the snapshot.
       v8::Extension* extension = new v8::Extension("new extension",
                                                    "function i() { return 24; }"
                                                    "function j() { return 25; }"
-                                                   "if (o.p == 7) o.p++;");
+                                                   "try {"
+                                                   "  if (o.p == 7) o.p++;"
+                                                   "} catch {}");
       extension->set_auto_enable(true);
       v8::RegisterExtension(extension);
       {
@@ -3126,7 +3356,6 @@ TEST(SnapshotCreatorIncludeGlobalProxy) {
         v8::Local<v8::Context> context = v8::Context::New(isolate);
         v8::Context::Scope context_scope(context);
         ExpectInt32("f()", 42);
-        ExpectInt32("g()", 12);
         ExpectInt32("h()", 13);
         ExpectInt32("i()", 24);
         ExpectInt32("j()", 25);
@@ -3149,11 +3378,8 @@ TEST(SnapshotCreatorIncludeGlobalProxy) {
         {
           v8::Context::Scope context_scope(context);
           ExpectInt32("f()", 42);
-          ExpectInt32("g()", 12);
-          ExpectInt32("h()", 13);
           ExpectInt32("i()", 24);
           ExpectInt32("j()", 25);
-          ExpectInt32("o.p", 8);
           ExpectInt32("x", 2016);
           v8::Local<v8::Private> hidden =
               v8::Private::ForApi(isolate, v8_str("hidden"));
@@ -3181,11 +3407,8 @@ TEST(SnapshotCreatorIncludeGlobalProxy) {
         {
           v8::Context::Scope context_scope(context2);
           ExpectInt32("f()", 42);
-          ExpectInt32("g()", 12);
-          ExpectInt32("h()", 13);
           ExpectInt32("i()", 24);
           ExpectInt32("j()", 25);
-          ExpectInt32("o.p", 8);
           ExpectInt32("x", 2016);
           v8::Local<v8::Private> hidden =
               v8::Private::ForApi(isolate, v8_str("hidden"));
@@ -3325,11 +3548,21 @@ UNINITIALIZED_TEST(ReinitializeHashSeedRehashable) {
   delete[] blob.data;
 }
 
-TEST(SerializationMemoryStats) {
+TEST(SerializationStats) {
   FLAG_profile_deserialization = true;
   FLAG_always_opt = false;
-  v8::StartupData blob = v8::V8::CreateSnapshotDataBlob();
+  v8::StartupData blob = CreateSnapshotDataBlob();
   delete[] blob.data;
+
+  // Track the embedded blob size as well.
+  {
+    int embedded_blob_size = 0;
+    if (FLAG_embedded_builtins) {
+      i::EmbeddedData d = i::EmbeddedData::FromBlob();
+      embedded_blob_size = static_cast<int>(d.size());
+    }
+    PrintF("Embedded blob is %d bytes\n", embedded_blob_size);
+  }
 }
 
 void CheckSFIsAreWeak(WeakFixedArray* sfis, Isolate* isolate) {
@@ -3446,7 +3679,7 @@ TEST(CachedCompileFunctionInContext) {
             env.local(), &script_source, 1, &arg_str, 0, nullptr,
             v8::ScriptCompiler::kEagerCompile)
             .ToLocalChecked();
-    cache = v8::ScriptCompiler::CreateCodeCacheForFunction(fun, source);
+    cache = v8::ScriptCompiler::CreateCodeCacheForFunction(fun);
   }
 
   {
diff --git a/deps/v8/test/cctest/test-strings.cc b/deps/v8/test/cctest/test-strings.cc
index ddbd90ef32feb7..488721d37abf8a 100644
--- a/deps/v8/test/cctest/test-strings.cc
+++ b/deps/v8/test/cctest/test-strings.cc
@@ -291,7 +291,7 @@ ConsStringGenerationData::ConsStringGenerationData(bool long_blocks) {
   rng_.init();
   InitializeBuildingBlocks(
       building_blocks_, kNumberOfBuildingBlocks, long_blocks, &rng_);
-  empty_string_ = CcTest::heap()->empty_string();
+  empty_string_ = ReadOnlyRoots(CcTest::heap()).empty_string();
   Reset();
 }
 
@@ -395,7 +395,8 @@ void VerifyConsString(Handle<String> root, ConsStringGenerationData* data) {
 
 static Handle<String> ConstructRandomString(ConsStringGenerationData* data,
                                             unsigned max_recursion) {
-  Factory* factory = CcTest::i_isolate()->factory();
+  Isolate* isolate = CcTest::i_isolate();
+  Factory* factory = isolate->factory();
   // Compute termination characteristics.
   bool terminate = false;
   bool flat = data->rng_.next(data->empty_leaf_threshold_);
@@ -447,7 +448,7 @@ static Handle<String> ConstructRandomString(ConsStringGenerationData* data,
   // Special work needed for flat string.
   if (flat) {
     data->stats_.empty_leaves_++;
-    String::Flatten(root);
+    String::Flatten(isolate, root);
     CHECK(root->IsConsString() && root->IsFlat());
   }
   return root;
@@ -562,10 +563,11 @@ static void TraverseFirst(Handle<String> s1, Handle<String> s2, int chars) {
 TEST(Traverse) {
   printf("TestTraverse\n");
   CcTest::InitializeVM();
+  Isolate* isolate = CcTest::i_isolate();
   v8::HandleScope scope(CcTest::isolate());
   ConsStringGenerationData data(false);
   Handle<String> flat = ConstructBalanced(&data);
-  String::Flatten(flat);
+  String::Flatten(isolate, flat);
   Handle<String> left_asymmetric = ConstructLeft(&data, DEEP_DEPTH);
   Handle<String> right_asymmetric = ConstructRight(&data, DEEP_DEPTH);
   Handle<String> symmetric = ConstructBalanced(&data);
@@ -585,19 +587,19 @@ TEST(Traverse) {
   printf("6\n");
   TraverseFirst(left_asymmetric, right_deep_asymmetric, 65536);
   printf("7\n");
-  String::Flatten(left_asymmetric);
+  String::Flatten(isolate, left_asymmetric);
   printf("10\n");
   Traverse(flat, left_asymmetric);
   printf("11\n");
-  String::Flatten(right_asymmetric);
+  String::Flatten(isolate, right_asymmetric);
   printf("12\n");
   Traverse(flat, right_asymmetric);
   printf("14\n");
-  String::Flatten(symmetric);
+  String::Flatten(isolate, symmetric);
   printf("15\n");
   Traverse(flat, symmetric);
   printf("16\n");
-  String::Flatten(left_deep_asymmetric);
+  String::Flatten(isolate, left_deep_asymmetric);
   printf("18\n");
 }
 
@@ -633,7 +635,7 @@ TEST(ConsStringWithEmptyFirstFlatten) {
 
   // Make sure Flatten doesn't alloc a new string.
   DisallowHeapAllocation no_alloc;
-  i::Handle<i::String> flat = i::String::Flatten(cons);
+  i::Handle<i::String> flat = i::String::Flatten(isolate, cons);
   CHECK(flat->IsFlat());
   CHECK_EQ(initial_length, flat->length());
 }
@@ -694,7 +696,7 @@ void TestStringCharacterStream(BuildString build, int test_cases) {
     ConsStringStats flat_string_stats;
     AccumulateStats(flat_string, &flat_string_stats);
     // Flatten string.
-    String::Flatten(flat_string);
+    String::Flatten(isolate, flat_string);
     // Build unflattened version of cons string to test.
     Handle<String> cons_string = build(i, &data);
     ConsStringStats cons_string_stats;
@@ -716,10 +718,10 @@ void TestStringCharacterStream(BuildString build, int test_cases) {
 
 static const int kCharacterStreamNonRandomCases = 8;
 
-
-static Handle<String> BuildEdgeCaseConsString(
-    int test_case, ConsStringGenerationData* data) {
-  Factory* factory = CcTest::i_isolate()->factory();
+static Handle<String> BuildEdgeCaseConsString(int test_case,
+                                              ConsStringGenerationData* data) {
+  Isolate* isolate = CcTest::i_isolate();
+  Factory* factory = isolate->factory();
   data->Reset();
   switch (test_case) {
     case 0:
@@ -749,7 +751,7 @@ static Handle<String> BuildEdgeCaseConsString(
         Handle<String> string =
             factory->NewConsString(data->block(0), data->block(1))
                 .ToHandleChecked();
-        String::Flatten(string);
+        String::Flatten(isolate, string);
         return string;
       }
     case 7:
@@ -764,7 +766,7 @@ static Handle<String> BuildEdgeCaseConsString(
         Handle<String> left =
             factory->NewConsString(data->block(0), data->block(1))
                 .ToHandleChecked();
-        String::Flatten(left);
+        String::Flatten(isolate, left);
         return factory->NewConsString(left, data->block(2)).ToHandleChecked();
       }
     case 8:
@@ -781,11 +783,11 @@ static Handle<String> BuildEdgeCaseConsString(
         Handle<String> left =
             factory->NewConsString(data->block(0), data->block(1))
                 .ToHandleChecked();
-        String::Flatten(left);
+        String::Flatten(isolate, left);
         Handle<String> right =
             factory->NewConsString(data->block(2), data->block(2))
                 .ToHandleChecked();
-        String::Flatten(right);
+        String::Flatten(isolate, right);
         return factory->NewConsString(left, right).ToHandleChecked();
       }
   }
@@ -885,7 +887,8 @@ static const int kDeepOneByteDepth = 100000;
 
 TEST(DeepOneByte) {
   CcTest::InitializeVM();
-  Factory* factory = CcTest::i_isolate()->factory();
+  Isolate* isolate = CcTest::i_isolate();
+  Factory* factory = isolate->factory();
   v8::HandleScope scope(CcTest::isolate());
 
   char* foo = NewArray<char>(kDeepOneByteDepth);
@@ -901,7 +904,7 @@ TEST(DeepOneByte) {
   }
   Handle<String> flat_string =
       factory->NewConsString(string, foo_string).ToHandleChecked();
-  String::Flatten(flat_string);
+  String::Flatten(isolate, flat_string);
 
   for (int i = 0; i < 500; i++) {
     TraverseFirst(flat_string, string, kDeepOneByteDepth);
@@ -1202,7 +1205,7 @@ TEST(InternalizeExternal) {
   Factory* factory = isolate->factory();
   // This won't leak; the external string mechanism will call Dispose() on it.
   OneByteVectorResource* resource =
-      new OneByteVectorResource(i::Vector<const char>("prop", 4));
+      new OneByteVectorResource(i::Vector<const char>("prop-1234", 9));
   {
     v8::HandleScope scope(CcTest::isolate());
     v8::Local<v8::String> ext_string =
@@ -1211,13 +1214,15 @@ TEST(InternalizeExternal) {
     Handle<String> string = v8::Utils::OpenHandle(*ext_string);
     CHECK(string->IsExternalString());
     CHECK(!string->IsInternalizedString());
-    CHECK(isolate->heap()->InNewSpace(*string));
+    CHECK(!i::Heap::InNewSpace(*string));
+    CHECK_EQ(
+        isolate->factory()->string_table()->LookupStringIfExists_NoAllocate(
+            *string),
+        Smi::FromInt(ResultSentinel::kNotFound));
     factory->InternalizeName(string);
-    CHECK(string->IsThinString());
-    CcTest::CollectGarbage(i::NEW_SPACE);
-    CcTest::CollectGarbage(i::NEW_SPACE);
+    CHECK(string->IsExternalString());
     CHECK(string->IsInternalizedString());
-    CHECK(!isolate->heap()->InNewSpace(*string));
+    CHECK(!i::Heap::InNewSpace(*string));
   }
   CcTest::CollectGarbage(i::OLD_SPACE);
   CcTest::CollectGarbage(i::OLD_SPACE);
@@ -1239,6 +1244,8 @@ TEST(SliceFromExternal) {
   CHECK_EQ(SlicedString::cast(*slice)->parent(), *string);
   CHECK(SlicedString::cast(*slice)->parent()->IsExternalString());
   CHECK(slice->IsFlat());
+  // This avoids the GC from trying to free stack allocated resources.
+  i::Handle<i::ExternalOneByteString>::cast(string)->set_resource(nullptr);
 }
 
 
@@ -1523,7 +1530,7 @@ TEST(FormatMessage) {
                                      arg0, arg1, arg2).ToHandleChecked();
   Handle<String> expected = isolate->factory()->NewStringFromAsciiChecked(
       "'arg0' returned for property 'arg1' of object 'arg2' is not a function");
-  CHECK(String::Equals(result, expected));
+  CHECK(String::Equals(isolate, result, expected));
 }
 
 TEST(Regress609831) {
@@ -1589,7 +1596,6 @@ TEST(ExternalStringIndexOf) {
     LocalContext context;                                                      \
     v8::HandleScope scope(CcTest::isolate());                                  \
     Factory* factory = CcTest::i_isolate()->factory();                         \
-    Heap* heap = CcTest::i_isolate()->heap();                                  \
     /* Length must be bigger than the buffer size of the Utf8Decoder. */       \
     const char* buf = STRING;                                                  \
     size_t len = strlen(buf);                                                  \
@@ -1598,7 +1604,7 @@ TEST(ExternalStringIndexOf) {
             ->NewStringFromOneByte(Vector<const uint8_t>(                      \
                 reinterpret_cast<const uint8_t*>(buf), len))                   \
             .ToHandleChecked();                                                \
-    CHECK(heap->InNewSpace(*main_string));                                     \
+    CHECK(Heap::InNewSpace(*main_string));                                     \
     /* Next allocation will cause GC. */                                       \
     heap::SimulateFullSpace(CcTest::i_isolate()->heap()->new_space());         \
     /* Offset by two to check substring-ing. */                                \
@@ -1640,6 +1646,21 @@ GC_INSIDE_NEW_STRING_FROM_UTF8_SUB_STRING(
 
 #undef GC_INSIDE_NEW_STRING_FROM_UTF8_SUB_STRING
 
+TEST(HashArrayIndexStrings) {
+  CcTest::InitializeVM();
+  LocalContext context;
+  v8::HandleScope scope(CcTest::isolate());
+  i::Isolate* isolate = CcTest::i_isolate();
+
+  CHECK_EQ(StringHasher::MakeArrayIndexHash(0 /* value */, 1 /* length */) >>
+               Name::kHashShift,
+           isolate->factory()->zero_string()->Hash());
+
+  CHECK_EQ(StringHasher::MakeArrayIndexHash(1 /* value */, 1 /* length */) >>
+               Name::kHashShift,
+           isolate->factory()->one_string()->Hash());
+}
+
 }  // namespace test_strings
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/test/cctest/test-symbols.cc b/deps/v8/test/cctest/test-symbols.cc
index 67218cfdfb74b5..63bc8cb73fd970 100644
--- a/deps/v8/test/cctest/test-symbols.cc
+++ b/deps/v8/test/cctest/test-symbols.cc
@@ -48,7 +48,7 @@ TEST(Create) {
   const int kNumSymbols = 30;
   Handle<Symbol> symbols[kNumSymbols];
 
-  OFStream os(stdout);
+  StdoutStream os;
   for (int i = 0; i < kNumSymbols; ++i) {
     symbols[i] = isolate->factory()->NewSymbol();
     CHECK(symbols[i]->IsName());
@@ -57,10 +57,10 @@ TEST(Create) {
     CHECK_GT(symbols[i]->Hash(), 0u);
     os << Brief(*symbols[i]) << "\n";
 #if OBJECT_PRINT
-    symbols[i]->Print(os);
+    symbols[i]->Print(isolate, os);
 #endif
 #if VERIFY_HEAP
-    symbols[i]->ObjectVerify();
+    symbols[i]->ObjectVerify(isolate);
 #endif
   }
 
diff --git a/deps/v8/test/cctest/test-thread-termination.cc b/deps/v8/test/cctest/test-thread-termination.cc
index ccc9a74bf7c8f7..ddfc2628070aa8 100644
--- a/deps/v8/test/cctest/test-thread-termination.cc
+++ b/deps/v8/test/cctest/test-thread-termination.cc
@@ -506,6 +506,184 @@ TEST(PostponeTerminateException) {
   CHECK_EQ(2, callback_counter);
 }
 
+static void AssertTerminatedCodeRun(v8::Isolate* isolate) {
+  v8::TryCatch try_catch(isolate);
+  CompileRun("for (var i = 0; i < 10000; i++);");
+  CHECK(try_catch.HasTerminated());
+}
+
+static void AssertFinishedCodeRun(v8::Isolate* isolate) {
+  v8::TryCatch try_catch(isolate);
+  CompileRun("for (var i = 0; i < 10000; i++);");
+  CHECK(!try_catch.HasTerminated());
+}
+
+TEST(SafeForTerminateException) {
+  v8::Isolate* isolate = CcTest::isolate();
+  v8::HandleScope scope(isolate);
+  v8::Local<v8::Context> context = v8::Context::New(CcTest::isolate());
+  v8::Context::Scope context_scope(context);
+
+  {  // Checks safe for termination scope.
+    i::PostponeInterruptsScope p1(CcTest::i_isolate(),
+                                  i::StackGuard::TERMINATE_EXECUTION);
+    isolate->TerminateExecution();
+    AssertFinishedCodeRun(isolate);
+    {
+      i::SafeForInterruptsScope p2(CcTest::i_isolate(),
+                                   i::StackGuard::TERMINATE_EXECUTION);
+      AssertTerminatedCodeRun(isolate);
+      AssertFinishedCodeRun(isolate);
+      isolate->TerminateExecution();
+    }
+    AssertFinishedCodeRun(isolate);
+    isolate->CancelTerminateExecution();
+  }
+
+  isolate->TerminateExecution();
+  {  // no scope -> postpone
+    i::PostponeInterruptsScope p1(CcTest::i_isolate(),
+                                  i::StackGuard::TERMINATE_EXECUTION);
+    AssertFinishedCodeRun(isolate);
+    {  // postpone -> postpone
+      i::PostponeInterruptsScope p2(CcTest::i_isolate(),
+                                    i::StackGuard::TERMINATE_EXECUTION);
+      AssertFinishedCodeRun(isolate);
+
+      {  // postpone -> safe
+        i::SafeForInterruptsScope p3(CcTest::i_isolate(),
+                                     i::StackGuard::TERMINATE_EXECUTION);
+        AssertTerminatedCodeRun(isolate);
+        isolate->TerminateExecution();
+
+        {  // safe -> safe
+          i::SafeForInterruptsScope p4(CcTest::i_isolate(),
+                                       i::StackGuard::TERMINATE_EXECUTION);
+          AssertTerminatedCodeRun(isolate);
+          isolate->TerminateExecution();
+
+          {  // safe -> postpone
+            i::PostponeInterruptsScope p5(CcTest::i_isolate(),
+                                          i::StackGuard::TERMINATE_EXECUTION);
+            AssertFinishedCodeRun(isolate);
+          }  // postpone -> safe
+
+          AssertTerminatedCodeRun(isolate);
+          isolate->TerminateExecution();
+        }  // safe -> safe
+
+        AssertTerminatedCodeRun(isolate);
+        isolate->TerminateExecution();
+      }  // safe -> postpone
+
+      AssertFinishedCodeRun(isolate);
+    }  // postpone -> postpone
+
+    AssertFinishedCodeRun(isolate);
+  }  // postpone -> no scope
+  AssertTerminatedCodeRun(isolate);
+
+  isolate->TerminateExecution();
+  {  // no scope -> safe
+    i::SafeForInterruptsScope p1(CcTest::i_isolate(),
+                                 i::StackGuard::TERMINATE_EXECUTION);
+    AssertTerminatedCodeRun(isolate);
+  }  // safe -> no scope
+  AssertFinishedCodeRun(isolate);
+
+  {  // no scope -> postpone
+    i::PostponeInterruptsScope p1(CcTest::i_isolate(),
+                                  i::StackGuard::TERMINATE_EXECUTION);
+    isolate->TerminateExecution();
+    {  // postpone -> safe
+      i::SafeForInterruptsScope p2(CcTest::i_isolate(),
+                                   i::StackGuard::TERMINATE_EXECUTION);
+      AssertTerminatedCodeRun(isolate);
+    }  // safe -> postpone
+  }    // postpone -> no scope
+  AssertFinishedCodeRun(isolate);
+
+  {  // no scope -> postpone
+    i::PostponeInterruptsScope p1(CcTest::i_isolate(),
+                                  i::StackGuard::TERMINATE_EXECUTION);
+    {  // postpone -> safe
+      i::SafeForInterruptsScope p2(CcTest::i_isolate(),
+                                   i::StackGuard::TERMINATE_EXECUTION);
+      {  // safe -> postpone
+        i::PostponeInterruptsScope p3(CcTest::i_isolate(),
+                                      i::StackGuard::TERMINATE_EXECUTION);
+        isolate->TerminateExecution();
+      }  // postpone -> safe
+      AssertTerminatedCodeRun(isolate);
+    }  // safe -> postpone
+  }    // postpone -> no scope
+}
+
+void RequestTermianteAndCallAPI(
+    const v8::FunctionCallbackInfo<v8::Value>& args) {
+  args.GetIsolate()->TerminateExecution();
+  AssertFinishedCodeRun(args.GetIsolate());
+}
+
+UNINITIALIZED_TEST(IsolateSafeForTerminationMode) {
+  v8::Isolate::CreateParams create_params;
+  create_params.only_terminate_in_safe_scope = true;
+  create_params.array_buffer_allocator = CcTest::array_buffer_allocator();
+  v8::Isolate* isolate = v8::Isolate::New(create_params);
+  i::Isolate* i_isolate = reinterpret_cast<i::Isolate*>(isolate);
+  {
+    v8::Isolate::Scope isolate_scope(isolate);
+    v8::HandleScope handle_scope(isolate);
+    v8::Local<v8::ObjectTemplate> global = v8::ObjectTemplate::New(isolate);
+    global->Set(v8_str("terminateAndCallAPI"),
+                v8::FunctionTemplate::New(isolate, RequestTermianteAndCallAPI));
+    v8::Local<v8::Context> context = v8::Context::New(isolate, nullptr, global);
+    v8::Context::Scope context_scope(context);
+
+    // Should postpone termination without safe scope.
+    isolate->TerminateExecution();
+    AssertFinishedCodeRun(isolate);
+    {
+      v8::Isolate::SafeForTerminationScope safe_scope(isolate);
+      AssertTerminatedCodeRun(isolate);
+    }
+    AssertFinishedCodeRun(isolate);
+
+    {
+      isolate->TerminateExecution();
+      AssertFinishedCodeRun(isolate);
+      i::PostponeInterruptsScope p1(i_isolate,
+                                    i::StackGuard::TERMINATE_EXECUTION);
+      {
+        // SafeForTermination overrides postpone.
+        v8::Isolate::SafeForTerminationScope safe_scope(isolate);
+        AssertTerminatedCodeRun(isolate);
+      }
+      AssertFinishedCodeRun(isolate);
+    }
+
+    {
+      v8::Isolate::SafeForTerminationScope safe_scope(isolate);
+      // Request terminate and call API recursively.
+      CompileRun("terminateAndCallAPI()");
+      AssertTerminatedCodeRun(isolate);
+    }
+
+    {
+      i::PostponeInterruptsScope p1(i_isolate,
+                                    i::StackGuard::TERMINATE_EXECUTION);
+      // Request terminate and call API recursively.
+      CompileRun("terminateAndCallAPI()");
+      AssertFinishedCodeRun(isolate);
+    }
+    AssertFinishedCodeRun(isolate);
+    {
+      v8::Isolate::SafeForTerminationScope safe_scope(isolate);
+      AssertTerminatedCodeRun(isolate);
+    }
+  }
+  isolate->Dispose();
+}
 
 TEST(ErrorObjectAfterTermination) {
   v8::Isolate* isolate = CcTest::isolate();
diff --git a/deps/v8/test/cctest/test-trace-event.cc b/deps/v8/test/cctest/test-trace-event.cc
index 471619062a02d3..7b736b907dd9ae 100644
--- a/deps/v8/test/cctest/test-trace-event.cc
+++ b/deps/v8/test/cctest/test-trace-event.cc
@@ -263,7 +263,12 @@ TEST(TestEventWithTimestamp) {
                                       TRACE_EVENT_SCOPE_GLOBAL, 4104, "val", 1);
   TRACE_EVENT_MARK_WITH_TIMESTAMP2("v8-cat", "mark", 13832, "a", 1, "b", 2);
 
-  CHECK_EQ(3, GET_TRACE_OBJECTS_LIST->size());
+  TRACE_EVENT_COPY_NESTABLE_ASYNC_BEGIN_WITH_TIMESTAMP0("v8-cat", "begin", 5,
+                                                        20683);
+  TRACE_EVENT_COPY_NESTABLE_ASYNC_END_WITH_TIMESTAMP0("v8-cat", "end", 5,
+                                                      32832);
+
+  CHECK_EQ(5, GET_TRACE_OBJECTS_LIST->size());
 
   CHECK_EQ(1729, GET_TRACE_OBJECT(0)->timestamp);
   CHECK_EQ(0, GET_TRACE_OBJECT(0)->num_args);
@@ -273,4 +278,7 @@ TEST(TestEventWithTimestamp) {
 
   CHECK_EQ(13832, GET_TRACE_OBJECT(2)->timestamp);
   CHECK_EQ(2, GET_TRACE_OBJECT(2)->num_args);
+
+  CHECK_EQ(20683, GET_TRACE_OBJECT(3)->timestamp);
+  CHECK_EQ(32832, GET_TRACE_OBJECT(4)->timestamp);
 }
diff --git a/deps/v8/test/cctest/test-transitions.cc b/deps/v8/test/cctest/test-transitions.cc
index 0a630c1c9066a2..aa5553bd4a3ab7 100644
--- a/deps/v8/test/cctest/test-transitions.cc
+++ b/deps/v8/test/cctest/test-transitions.cc
@@ -32,24 +32,26 @@ TEST(TransitionArray_SimpleFieldTransitions) {
 
   Handle<Map> map0 = Map::Create(isolate, 0);
   Handle<Map> map1 =
-      Map::CopyWithField(map0, name1, handle(FieldType::Any(), isolate),
-                         attributes, kMutable, Representation::Tagged(),
+      Map::CopyWithField(isolate, map0, name1,
+                         handle(FieldType::Any(), isolate), attributes,
+                         PropertyConstness::kMutable, Representation::Tagged(),
                          OMIT_TRANSITION)
           .ToHandleChecked();
   Handle<Map> map2 =
-      Map::CopyWithField(map0, name2, handle(FieldType::Any(), isolate),
-                         attributes, kMutable, Representation::Tagged(),
+      Map::CopyWithField(isolate, map0, name2,
+                         handle(FieldType::Any(), isolate), attributes,
+                         PropertyConstness::kMutable, Representation::Tagged(),
                          OMIT_TRANSITION)
           .ToHandleChecked();
 
   CHECK(map0->raw_transitions()->IsSmi());
 
   {
-    TestTransitionsAccessor transitions(map0);
+    TestTransitionsAccessor transitions(isolate, map0);
     transitions.Insert(name1, map1, SIMPLE_PROPERTY_TRANSITION);
   }
   {
-    TestTransitionsAccessor transitions(map0);
+    TestTransitionsAccessor transitions(isolate, map0);
     CHECK(transitions.IsWeakRefEncoding());
     CHECK_EQ(*map1, transitions.SearchTransition(*name1, kData, attributes));
     CHECK_EQ(1, transitions.NumberOfTransitions());
@@ -59,7 +61,7 @@ TEST(TransitionArray_SimpleFieldTransitions) {
     transitions.Insert(name2, map2, SIMPLE_PROPERTY_TRANSITION);
   }
   {
-    TestTransitionsAccessor transitions(map0);
+    TestTransitionsAccessor transitions(isolate, map0);
     CHECK(transitions.IsFullTransitionArrayEncoding());
 
     CHECK_EQ(*map1, transitions.SearchTransition(*name1, kData, attributes));
@@ -72,7 +74,7 @@ TEST(TransitionArray_SimpleFieldTransitions) {
             (key == *name2 && target == *map2));
     }
 
-    DCHECK(transitions.IsSortedNoDuplicates());
+    DCHECK(transitions.IsSortedNoDuplicates(isolate));
   }
 }
 
@@ -89,24 +91,26 @@ TEST(TransitionArray_FullFieldTransitions) {
 
   Handle<Map> map0 = Map::Create(isolate, 0);
   Handle<Map> map1 =
-      Map::CopyWithField(map0, name1, handle(FieldType::Any(), isolate),
-                         attributes, kMutable, Representation::Tagged(),
+      Map::CopyWithField(isolate, map0, name1,
+                         handle(FieldType::Any(), isolate), attributes,
+                         PropertyConstness::kMutable, Representation::Tagged(),
                          OMIT_TRANSITION)
           .ToHandleChecked();
   Handle<Map> map2 =
-      Map::CopyWithField(map0, name2, handle(FieldType::Any(), isolate),
-                         attributes, kMutable, Representation::Tagged(),
+      Map::CopyWithField(isolate, map0, name2,
+                         handle(FieldType::Any(), isolate), attributes,
+                         PropertyConstness::kMutable, Representation::Tagged(),
                          OMIT_TRANSITION)
           .ToHandleChecked();
 
   CHECK(map0->raw_transitions()->IsSmi());
 
   {
-    TestTransitionsAccessor transitions(map0);
+    TestTransitionsAccessor transitions(isolate, map0);
     transitions.Insert(name1, map1, PROPERTY_TRANSITION);
   }
   {
-    TestTransitionsAccessor transitions(map0);
+    TestTransitionsAccessor transitions(isolate, map0);
     CHECK(transitions.IsFullTransitionArrayEncoding());
     CHECK_EQ(*map1, transitions.SearchTransition(*name1, kData, attributes));
     CHECK_EQ(1, transitions.NumberOfTransitions());
@@ -116,7 +120,7 @@ TEST(TransitionArray_FullFieldTransitions) {
     transitions.Insert(name2, map2, PROPERTY_TRANSITION);
   }
   {
-    TestTransitionsAccessor transitions(map0);
+    TestTransitionsAccessor transitions(isolate, map0);
     CHECK(transitions.IsFullTransitionArrayEncoding());
 
     CHECK_EQ(*map1, transitions.SearchTransition(*name1, kData, attributes));
@@ -129,7 +133,7 @@ TEST(TransitionArray_FullFieldTransitions) {
             (key == *name2 && target == *map2));
     }
 
-    DCHECK(transitions.IsSortedNoDuplicates());
+    DCHECK(transitions.IsSortedNoDuplicates(isolate));
   }
 }
 
@@ -153,17 +157,18 @@ TEST(TransitionArray_DifferentFieldNames) {
     SNPrintF(buffer, "prop%d", i);
     Handle<String> name = factory->InternalizeUtf8String(buffer.start());
     Handle<Map> map =
-        Map::CopyWithField(map0, name, handle(FieldType::Any(), isolate),
-                           attributes, kMutable, Representation::Tagged(),
-                           OMIT_TRANSITION)
+        Map::CopyWithField(isolate, map0, name,
+                           handle(FieldType::Any(), isolate), attributes,
+                           PropertyConstness::kMutable,
+                           Representation::Tagged(), OMIT_TRANSITION)
             .ToHandleChecked();
     names[i] = name;
     maps[i] = map;
 
-    TransitionsAccessor(map0).Insert(name, map, PROPERTY_TRANSITION);
+    TransitionsAccessor(isolate, map0).Insert(name, map, PROPERTY_TRANSITION);
   }
 
-  TransitionsAccessor transitions(map0);
+  TransitionsAccessor transitions(isolate, map0);
   for (int i = 0; i < PROPS_COUNT; i++) {
     CHECK_EQ(*maps[i],
              transitions.SearchTransition(*names[i], kData, attributes));
@@ -179,7 +184,7 @@ TEST(TransitionArray_DifferentFieldNames) {
     }
   }
 
-  DCHECK(transitions.IsSortedNoDuplicates());
+  DCHECK(transitions.IsSortedNoDuplicates(isolate));
 }
 
 
@@ -202,16 +207,17 @@ TEST(TransitionArray_SameFieldNamesDifferentAttributesSimple) {
     PropertyAttributes attributes = static_cast<PropertyAttributes>(i);
 
     Handle<Map> map =
-        Map::CopyWithField(map0, name, FieldType::Any(isolate), attributes,
-                           kMutable, Representation::Tagged(), OMIT_TRANSITION)
+        Map::CopyWithField(isolate, map0, name, FieldType::Any(isolate),
+                           attributes, PropertyConstness::kMutable,
+                           Representation::Tagged(), OMIT_TRANSITION)
             .ToHandleChecked();
     attr_maps[i] = map;
 
-    TransitionsAccessor(map0).Insert(name, map, PROPERTY_TRANSITION);
+    TransitionsAccessor(isolate, map0).Insert(name, map, PROPERTY_TRANSITION);
   }
 
   // Ensure that transitions for |name| field are valid.
-  TransitionsAccessor transitions(map0);
+  TransitionsAccessor transitions(isolate, map0);
   for (int i = 0; i < ATTRS_COUNT; i++) {
     PropertyAttributes attributes = static_cast<PropertyAttributes>(i);
     CHECK_EQ(*attr_maps[i],
@@ -221,7 +227,7 @@ TEST(TransitionArray_SameFieldNamesDifferentAttributesSimple) {
     CHECK_EQ(*name, transitions.GetKey(i));
   }
 
-  DCHECK(transitions.IsSortedNoDuplicates());
+  DCHECK(transitions.IsSortedNoDuplicates(isolate));
 }
 
 
@@ -244,13 +250,15 @@ TEST(TransitionArray_SameFieldNamesDifferentAttributes) {
     SNPrintF(buffer, "prop%d", i);
     Handle<String> name = factory->InternalizeUtf8String(buffer.start());
     Handle<Map> map =
-        Map::CopyWithField(map0, name, handle(FieldType::Any(), isolate), NONE,
-                           kMutable, Representation::Tagged(), OMIT_TRANSITION)
+        Map::CopyWithField(isolate, map0, name,
+                           handle(FieldType::Any(), isolate), NONE,
+                           PropertyConstness::kMutable,
+                           Representation::Tagged(), OMIT_TRANSITION)
             .ToHandleChecked();
     names[i] = name;
     maps[i] = map;
 
-    TransitionsAccessor(map0).Insert(name, map, PROPERTY_TRANSITION);
+    TransitionsAccessor(isolate, map0).Insert(name, map, PROPERTY_TRANSITION);
   }
 
   const int ATTRS_COUNT = (READ_ONLY | DONT_ENUM | DONT_DELETE) + 1;
@@ -263,17 +271,18 @@ TEST(TransitionArray_SameFieldNamesDifferentAttributes) {
     PropertyAttributes attributes = static_cast<PropertyAttributes>(i);
 
     Handle<Map> map =
-        Map::CopyWithField(map0, name, handle(FieldType::Any(), isolate),
-                           attributes, kMutable, Representation::Tagged(),
-                           OMIT_TRANSITION)
+        Map::CopyWithField(isolate, map0, name,
+                           handle(FieldType::Any(), isolate), attributes,
+                           PropertyConstness::kMutable,
+                           Representation::Tagged(), OMIT_TRANSITION)
             .ToHandleChecked();
     attr_maps[i] = map;
 
-    TransitionsAccessor(map0).Insert(name, map, PROPERTY_TRANSITION);
+    TransitionsAccessor(isolate, map0).Insert(name, map, PROPERTY_TRANSITION);
   }
 
   // Ensure that transitions for |name| field are valid.
-  TransitionsAccessor transitions(map0);
+  TransitionsAccessor transitions(isolate, map0);
   for (int i = 0; i < ATTRS_COUNT; i++) {
     PropertyAttributes attr = static_cast<PropertyAttributes>(i);
     CHECK_EQ(*attr_maps[i], transitions.SearchTransition(*name, kData, attr));
@@ -299,7 +308,7 @@ TEST(TransitionArray_SameFieldNamesDifferentAttributes) {
     }
   }
 
-  DCHECK(transitions.IsSortedNoDuplicates());
+  DCHECK(transitions.IsSortedNoDuplicates(isolate));
 }
 
 }  // namespace internal
diff --git a/deps/v8/test/cctest/test-transitions.h b/deps/v8/test/cctest/test-transitions.h
index 87613a03be6c10..08c5d2cab24553 100644
--- a/deps/v8/test/cctest/test-transitions.h
+++ b/deps/v8/test/cctest/test-transitions.h
@@ -12,10 +12,11 @@ namespace internal {
 
 class TestTransitionsAccessor : public TransitionsAccessor {
  public:
-  TestTransitionsAccessor(Map* map, DisallowHeapAllocation* no_gc)
-      : TransitionsAccessor(map, no_gc) {}
-  explicit TestTransitionsAccessor(Handle<Map> map)
-      : TransitionsAccessor(map) {}
+  TestTransitionsAccessor(Isolate* isolate, Map* map,
+                          DisallowHeapAllocation* no_gc)
+      : TransitionsAccessor(isolate, map, no_gc) {}
+  TestTransitionsAccessor(Isolate* isolate, Handle<Map> map)
+      : TransitionsAccessor(isolate, map) {}
 
   // Expose internals for tests.
   bool IsWeakRefEncoding() { return encoding() == kWeakRef; }
diff --git a/deps/v8/test/cctest/test-types.cc b/deps/v8/test/cctest/test-types.cc
index d691dfb8111983..831593f17bb94d 100644
--- a/deps/v8/test/cctest/test-types.cc
+++ b/deps/v8/test/cctest/test-types.cc
@@ -42,16 +42,16 @@ struct Tests {
         zone(isolate->allocator(), ZONE_NAME),
         T(&zone, isolate, isolate->random_number_generator()) {}
 
-  bool IsBitset(Type* type) { return type->IsBitsetForTesting(); }
-  bool IsUnion(Type* type) { return type->IsUnionForTesting(); }
-  BitsetType::bitset AsBitset(Type* type) { return type->AsBitsetForTesting(); }
-  UnionType* AsUnion(Type* type) { return type->AsUnionForTesting(); }
+  bool IsBitset(Type type) { return type.IsBitset(); }
+  bool IsUnion(Type type) { return type.IsUnionForTesting(); }
+  BitsetType::bitset AsBitset(Type type) { return type.AsBitsetForTesting(); }
+  const UnionType* AsUnion(Type type) { return type.AsUnionForTesting(); }
 
-  bool Equal(Type* type1, Type* type2) {
-    return type1->Equals(type2) &&
+  bool Equal(Type type1, Type type2) {
+    return type1.Equals(type2) &&
            this->IsBitset(type1) == this->IsBitset(type2) &&
            this->IsUnion(type1) == this->IsUnion(type2) &&
-           type1->NumConstants() == type2->NumConstants() &&
+           type1.NumConstants() == type2.NumConstants() &&
            (!this->IsBitset(type1) ||
             this->AsBitset(type1) == this->AsBitset(type2)) &&
            (!this->IsUnion(type1) ||
@@ -59,49 +59,49 @@ struct Tests {
                 this->AsUnion(type2)->LengthForTesting());
   }
 
-  void CheckEqual(Type* type1, Type* type2) { CHECK(Equal(type1, type2)); }
+  void CheckEqual(Type type1, Type type2) { CHECK(Equal(type1, type2)); }
 
-  void CheckSub(Type* type1, Type* type2) {
-    CHECK(type1->Is(type2));
-    CHECK(!type2->Is(type1));
+  void CheckSub(Type type1, Type type2) {
+    CHECK(type1.Is(type2));
+    CHECK(!type2.Is(type1));
     if (this->IsBitset(type1) && this->IsBitset(type2)) {
       CHECK(this->AsBitset(type1) != this->AsBitset(type2));
     }
   }
 
-  void CheckSubOrEqual(Type* type1, Type* type2) {
-    CHECK(type1->Is(type2));
+  void CheckSubOrEqual(Type type1, Type type2) {
+    CHECK(type1.Is(type2));
     if (this->IsBitset(type1) && this->IsBitset(type2)) {
       CHECK((this->AsBitset(type1) | this->AsBitset(type2))
             == this->AsBitset(type2));
     }
   }
 
-  void CheckUnordered(Type* type1, Type* type2) {
-    CHECK(!type1->Is(type2));
-    CHECK(!type2->Is(type1));
+  void CheckUnordered(Type type1, Type type2) {
+    CHECK(!type1.Is(type2));
+    CHECK(!type2.Is(type1));
     if (this->IsBitset(type1) && this->IsBitset(type2)) {
       CHECK(this->AsBitset(type1) != this->AsBitset(type2));
     }
   }
 
-  void CheckOverlap(Type* type1, Type* type2) {
-    CHECK(type1->Maybe(type2));
-    CHECK(type2->Maybe(type1));
+  void CheckOverlap(Type type1, Type type2) {
+    CHECK(type1.Maybe(type2));
+    CHECK(type2.Maybe(type1));
   }
 
-  void CheckDisjoint(Type* type1, Type* type2) {
-    CHECK(!type1->Is(type2));
-    CHECK(!type2->Is(type1));
-    CHECK(!type1->Maybe(type2));
-    CHECK(!type2->Maybe(type1));
+  void CheckDisjoint(Type type1, Type type2) {
+    CHECK(!type1.Is(type2));
+    CHECK(!type2.Is(type1));
+    CHECK(!type1.Maybe(type2));
+    CHECK(!type2.Maybe(type1));
   }
 
   void IsSomeType() {
     for (TypeIterator it = T.types.begin(); it != T.types.end(); ++it) {
-      Type* t = *it;
-      CHECK_EQ(1, this->IsBitset(t) + t->IsHeapConstant() + t->IsRange() +
-                      t->IsOtherNumberConstant() + this->IsUnion(t));
+      Type t = *it;
+      CHECK_EQ(1, this->IsBitset(t) + t.IsHeapConstant() + t.IsRange() +
+                      t.IsOtherNumberConstant() + this->IsUnion(t));
     }
   }
 
@@ -116,9 +116,9 @@ struct Tests {
     // Union(T1, T2) is bitset for bitsets T1,T2
     for (TypeIterator it1 = T.types.begin(); it1 != T.types.end(); ++it1) {
       for (TypeIterator it2 = T.types.begin(); it2 != T.types.end(); ++it2) {
-        Type* type1 = *it1;
-        Type* type2 = *it2;
-        Type* union12 = T.Union(type1, type2);
+        Type type1 = *it1;
+        Type type2 = *it2;
+        Type union12 = T.Union(type1, type2);
         CHECK(!(this->IsBitset(type1) && this->IsBitset(type2)) ||
               this->IsBitset(union12));
       }
@@ -127,21 +127,21 @@ struct Tests {
     // Intersect(T1, T2) is bitset for bitsets T1,T2
     for (TypeIterator it1 = T.types.begin(); it1 != T.types.end(); ++it1) {
       for (TypeIterator it2 = T.types.begin(); it2 != T.types.end(); ++it2) {
-        Type* type1 = *it1;
-        Type* type2 = *it2;
-        Type* intersect12 = T.Intersect(type1, type2);
+        Type type1 = *it1;
+        Type type2 = *it2;
+        Type intersect12 = T.Intersect(type1, type2);
         CHECK(!(this->IsBitset(type1) && this->IsBitset(type2)) ||
               this->IsBitset(intersect12));
       }
     }
 
-    // Union(T1, T2) is bitset if T2 is bitset and T1->Is(T2)
+    // Union(T1, T2) is bitset if T2 is bitset and T1.Is(T2)
     for (TypeIterator it1 = T.types.begin(); it1 != T.types.end(); ++it1) {
       for (TypeIterator it2 = T.types.begin(); it2 != T.types.end(); ++it2) {
-        Type* type1 = *it1;
-        Type* type2 = *it2;
-        Type* union12 = T.Union(type1, type2);
-        CHECK(!(this->IsBitset(type2) && type1->Is(type2)) ||
+        Type type1 = *it1;
+        Type type2 = *it2;
+        Type union12 = T.Union(type1, type2);
+        CHECK(!(this->IsBitset(type2) && type1.Is(type2)) ||
               this->IsBitset(union12));
       }
     }
@@ -149,9 +149,9 @@ struct Tests {
     // Union(T1, T2) is bitwise disjunction for bitsets T1,T2
     for (TypeIterator it1 = T.types.begin(); it1 != T.types.end(); ++it1) {
       for (TypeIterator it2 = T.types.begin(); it2 != T.types.end(); ++it2) {
-        Type* type1 = *it1;
-        Type* type2 = *it2;
-        Type* union12 = T.Union(type1, type2);
+        Type type1 = *it1;
+        Type type2 = *it2;
+        Type union12 = T.Union(type1, type2);
         if (this->IsBitset(type1) && this->IsBitset(type2)) {
           CHECK(
               (this->AsBitset(type1) | this->AsBitset(type2)) ==
@@ -163,10 +163,10 @@ struct Tests {
     // Intersect(T1, T2) is bitwise conjunction for bitsets T1,T2 (modulo None)
     for (TypeIterator it1 = T.types.begin(); it1 != T.types.end(); ++it1) {
       for (TypeIterator it2 = T.types.begin(); it2 != T.types.end(); ++it2) {
-        Type* type1 = *it1;
-        Type* type2 = *it2;
+        Type type1 = *it1;
+        Type type2 = *it2;
         if (this->IsBitset(type1) && this->IsBitset(type2)) {
-          Type* intersect12 = T.Intersect(type1, type2);
+          Type intersect12 = T.Intersect(type1, type2);
           bitset bits = this->AsBitset(type1) & this->AsBitset(type2);
           CHECK(bits == this->AsBitset(intersect12));
         }
@@ -178,24 +178,24 @@ struct Tests {
     // Constructor
     for (ValueIterator vt = T.values.begin(); vt != T.values.end(); ++vt) {
       Handle<i::Object> value = *vt;
-      Type* type = T.NewConstant(value);
-      CHECK(type->IsHeapConstant() || type->IsOtherNumberConstant() ||
-            type->IsRange());
+      Type type = T.NewConstant(value);
+      CHECK(type.IsHeapConstant() || type.IsOtherNumberConstant() ||
+            type.IsRange());
     }
 
     // Value attribute
     for (ValueIterator vt = T.values.begin(); vt != T.values.end(); ++vt) {
       Handle<i::Object> value = *vt;
-      Type* type = T.NewConstant(value);
-      if (type->IsHeapConstant()) {
-        CHECK(value.address() == type->AsHeapConstant()->Value().address());
-      } else if (type->IsOtherNumberConstant()) {
+      Type type = T.NewConstant(value);
+      if (type.IsHeapConstant()) {
+        CHECK(value.address() == type.AsHeapConstant()->Value().address());
+      } else if (type.IsOtherNumberConstant()) {
         CHECK(value->IsHeapNumber());
-        CHECK(value->Number() == type->AsOtherNumberConstant()->Value());
+        CHECK(value->Number() == type.AsOtherNumberConstant()->Value());
       } else {
-        CHECK(type->IsRange());
+        CHECK(type.IsRange());
         double v = value->Number();
-        CHECK(v == type->AsRange()->Min() && v == type->AsRange()->Max());
+        CHECK(v == type.AsRange()->Min() && v == type.AsRange()->Max());
       }
     }
 
@@ -204,16 +204,16 @@ struct Tests {
       for (ValueIterator vt2 = T.values.begin(); vt2 != T.values.end(); ++vt2) {
         Handle<i::Object> value1 = *vt1;
         Handle<i::Object> value2 = *vt2;
-        Type* type1 = T.NewConstant(value1);
-        Type* type2 = T.NewConstant(value2);
-        if (type1->IsOtherNumberConstant() && type2->IsOtherNumberConstant()) {
+        Type type1 = T.NewConstant(value1);
+        Type type2 = T.NewConstant(value2);
+        if (type1.IsOtherNumberConstant() && type2.IsOtherNumberConstant()) {
           CHECK(Equal(type1, type2) ==
-                (type1->AsOtherNumberConstant()->Value() ==
-                 type2->AsOtherNumberConstant()->Value()));
-        } else if (type1->IsRange() && type2->IsRange()) {
+                (type1.AsOtherNumberConstant()->Value() ==
+                 type2.AsOtherNumberConstant()->Value()));
+        } else if (type1.IsRange() && type2.IsRange()) {
           CHECK(Equal(type1, type2) ==
-                ((type1->AsRange()->Min() == type2->AsRange()->Min()) &&
-                 (type1->AsRange()->Max() == type2->AsRange()->Max())));
+                ((type1.AsRange()->Min() == type2.AsRange()->Min()) &&
+                 (type1.AsRange()->Max() == type2.AsRange()->Max())));
         } else {
           CHECK(Equal(type1, type2) == (*value1 == *value2));
         }
@@ -222,62 +222,62 @@ struct Tests {
 
     // Typing of numbers
     Factory* fac = isolate->factory();
-    CHECK(T.NewConstant(fac->NewNumber(0))->Is(T.UnsignedSmall));
-    CHECK(T.NewConstant(fac->NewNumber(1))->Is(T.UnsignedSmall));
-    CHECK(T.NewConstant(fac->NewNumber(0x3FFFFFFF))->Is(T.UnsignedSmall));
-    CHECK(T.NewConstant(fac->NewNumber(-1))->Is(T.Negative31));
-    CHECK(T.NewConstant(fac->NewNumber(-0x3FFFFFFF))->Is(T.Negative31));
-    CHECK(T.NewConstant(fac->NewNumber(-0x40000000))->Is(T.Negative31));
-    CHECK(T.NewConstant(fac->NewNumber(0x40000000))->Is(T.Unsigned31));
-    CHECK(!T.NewConstant(fac->NewNumber(0x40000000))->Is(T.Unsigned30));
-    CHECK(T.NewConstant(fac->NewNumber(0x7FFFFFFF))->Is(T.Unsigned31));
-    CHECK(!T.NewConstant(fac->NewNumber(0x7FFFFFFF))->Is(T.Unsigned30));
-    CHECK(T.NewConstant(fac->NewNumber(-0x40000001))->Is(T.Negative32));
-    CHECK(!T.NewConstant(fac->NewNumber(-0x40000001))->Is(T.Negative31));
-    CHECK(T.NewConstant(fac->NewNumber(-0x7FFFFFFF))->Is(T.Negative32));
-    CHECK(!T.NewConstant(fac->NewNumber(-0x7FFFFFFF - 1))->Is(T.Negative31));
+    CHECK(T.NewConstant(fac->NewNumber(0)).Is(T.UnsignedSmall));
+    CHECK(T.NewConstant(fac->NewNumber(1)).Is(T.UnsignedSmall));
+    CHECK(T.NewConstant(fac->NewNumber(0x3FFFFFFF)).Is(T.UnsignedSmall));
+    CHECK(T.NewConstant(fac->NewNumber(-1)).Is(T.Negative31));
+    CHECK(T.NewConstant(fac->NewNumber(-0x3FFFFFFF)).Is(T.Negative31));
+    CHECK(T.NewConstant(fac->NewNumber(-0x40000000)).Is(T.Negative31));
+    CHECK(T.NewConstant(fac->NewNumber(0x40000000)).Is(T.Unsigned31));
+    CHECK(!T.NewConstant(fac->NewNumber(0x40000000)).Is(T.Unsigned30));
+    CHECK(T.NewConstant(fac->NewNumber(0x7FFFFFFF)).Is(T.Unsigned31));
+    CHECK(!T.NewConstant(fac->NewNumber(0x7FFFFFFF)).Is(T.Unsigned30));
+    CHECK(T.NewConstant(fac->NewNumber(-0x40000001)).Is(T.Negative32));
+    CHECK(!T.NewConstant(fac->NewNumber(-0x40000001)).Is(T.Negative31));
+    CHECK(T.NewConstant(fac->NewNumber(-0x7FFFFFFF)).Is(T.Negative32));
+    CHECK(!T.NewConstant(fac->NewNumber(-0x7FFFFFFF - 1)).Is(T.Negative31));
     if (SmiValuesAre31Bits()) {
-      CHECK(!T.NewConstant(fac->NewNumber(0x40000000))->Is(T.UnsignedSmall));
-      CHECK(!T.NewConstant(fac->NewNumber(0x7FFFFFFF))->Is(T.UnsignedSmall));
-      CHECK(!T.NewConstant(fac->NewNumber(-0x40000001))->Is(T.SignedSmall));
-      CHECK(!T.NewConstant(fac->NewNumber(-0x7FFFFFFF - 1))->Is(T.SignedSmall));
+      CHECK(!T.NewConstant(fac->NewNumber(0x40000000)).Is(T.UnsignedSmall));
+      CHECK(!T.NewConstant(fac->NewNumber(0x7FFFFFFF)).Is(T.UnsignedSmall));
+      CHECK(!T.NewConstant(fac->NewNumber(-0x40000001)).Is(T.SignedSmall));
+      CHECK(!T.NewConstant(fac->NewNumber(-0x7FFFFFFF - 1)).Is(T.SignedSmall));
     } else {
       CHECK(SmiValuesAre32Bits());
-      CHECK(T.NewConstant(fac->NewNumber(0x40000000))->Is(T.UnsignedSmall));
-      CHECK(T.NewConstant(fac->NewNumber(0x7FFFFFFF))->Is(T.UnsignedSmall));
-      CHECK(T.NewConstant(fac->NewNumber(-0x40000001))->Is(T.SignedSmall));
-      CHECK(T.NewConstant(fac->NewNumber(-0x7FFFFFFF - 1))->Is(T.SignedSmall));
-    }
-    CHECK(T.NewConstant(fac->NewNumber(0x80000000u))->Is(T.Unsigned32));
-    CHECK(!T.NewConstant(fac->NewNumber(0x80000000u))->Is(T.Unsigned31));
-    CHECK(T.NewConstant(fac->NewNumber(0xFFFFFFFFu))->Is(T.Unsigned32));
-    CHECK(!T.NewConstant(fac->NewNumber(0xFFFFFFFFu))->Is(T.Unsigned31));
-    CHECK(T.NewConstant(fac->NewNumber(0xFFFFFFFFu + 1.0))->Is(T.PlainNumber));
-    CHECK(!T.NewConstant(fac->NewNumber(0xFFFFFFFFu + 1.0))->Is(T.Integral32));
-    CHECK(T.NewConstant(fac->NewNumber(-0x7FFFFFFF - 2.0))->Is(T.PlainNumber));
-    CHECK(!T.NewConstant(fac->NewNumber(-0x7FFFFFFF - 2.0))->Is(T.Integral32));
-    CHECK(T.NewConstant(fac->NewNumber(0.1))->Is(T.PlainNumber));
-    CHECK(!T.NewConstant(fac->NewNumber(0.1))->Is(T.Integral32));
-    CHECK(T.NewConstant(fac->NewNumber(-10.1))->Is(T.PlainNumber));
-    CHECK(!T.NewConstant(fac->NewNumber(-10.1))->Is(T.Integral32));
-    CHECK(T.NewConstant(fac->NewNumber(10e60))->Is(T.PlainNumber));
-    CHECK(!T.NewConstant(fac->NewNumber(10e60))->Is(T.Integral32));
-    CHECK(T.NewConstant(fac->NewNumber(-1.0 * 0.0))->Is(T.MinusZero));
+      CHECK(T.NewConstant(fac->NewNumber(0x40000000)).Is(T.UnsignedSmall));
+      CHECK(T.NewConstant(fac->NewNumber(0x7FFFFFFF)).Is(T.UnsignedSmall));
+      CHECK(T.NewConstant(fac->NewNumber(-0x40000001)).Is(T.SignedSmall));
+      CHECK(T.NewConstant(fac->NewNumber(-0x7FFFFFFF - 1)).Is(T.SignedSmall));
+    }
+    CHECK(T.NewConstant(fac->NewNumber(0x80000000u)).Is(T.Unsigned32));
+    CHECK(!T.NewConstant(fac->NewNumber(0x80000000u)).Is(T.Unsigned31));
+    CHECK(T.NewConstant(fac->NewNumber(0xFFFFFFFFu)).Is(T.Unsigned32));
+    CHECK(!T.NewConstant(fac->NewNumber(0xFFFFFFFFu)).Is(T.Unsigned31));
+    CHECK(T.NewConstant(fac->NewNumber(0xFFFFFFFFu + 1.0)).Is(T.PlainNumber));
+    CHECK(!T.NewConstant(fac->NewNumber(0xFFFFFFFFu + 1.0)).Is(T.Integral32));
+    CHECK(T.NewConstant(fac->NewNumber(-0x7FFFFFFF - 2.0)).Is(T.PlainNumber));
+    CHECK(!T.NewConstant(fac->NewNumber(-0x7FFFFFFF - 2.0)).Is(T.Integral32));
+    CHECK(T.NewConstant(fac->NewNumber(0.1)).Is(T.PlainNumber));
+    CHECK(!T.NewConstant(fac->NewNumber(0.1)).Is(T.Integral32));
+    CHECK(T.NewConstant(fac->NewNumber(-10.1)).Is(T.PlainNumber));
+    CHECK(!T.NewConstant(fac->NewNumber(-10.1)).Is(T.Integral32));
+    CHECK(T.NewConstant(fac->NewNumber(10e60)).Is(T.PlainNumber));
+    CHECK(!T.NewConstant(fac->NewNumber(10e60)).Is(T.Integral32));
+    CHECK(T.NewConstant(fac->NewNumber(-1.0 * 0.0)).Is(T.MinusZero));
     CHECK(
         T.NewConstant(fac->NewNumber(std::numeric_limits<double>::quiet_NaN()))
-            ->Is(T.NaN));
-    CHECK(T.NewConstant(fac->NewNumber(V8_INFINITY))->Is(T.PlainNumber));
-    CHECK(!T.NewConstant(fac->NewNumber(V8_INFINITY))->Is(T.Integral32));
-    CHECK(T.NewConstant(fac->NewNumber(-V8_INFINITY))->Is(T.PlainNumber));
-    CHECK(!T.NewConstant(fac->NewNumber(-V8_INFINITY))->Is(T.Integral32));
+            .Is(T.NaN));
+    CHECK(T.NewConstant(fac->NewNumber(V8_INFINITY)).Is(T.PlainNumber));
+    CHECK(!T.NewConstant(fac->NewNumber(V8_INFINITY)).Is(T.Integral32));
+    CHECK(T.NewConstant(fac->NewNumber(-V8_INFINITY)).Is(T.PlainNumber));
+    CHECK(!T.NewConstant(fac->NewNumber(-V8_INFINITY)).Is(T.Integral32));
 
     // Typing of Strings
     Handle<String> s1 = fac->NewStringFromAsciiChecked("a");
-    CHECK(T.NewConstant(s1)->Is(T.InternalizedString));
+    CHECK(T.NewConstant(s1).Is(T.InternalizedString));
     const uc16 two_byte[1] = {0x2603};
     Handle<String> s2 =
         fac->NewTwoByteInternalizedString(Vector<const uc16>(two_byte, 1), 1);
-    CHECK(T.NewConstant(s2)->Is(T.InternalizedString));
+    CHECK(T.NewConstant(s2).Is(T.InternalizedString));
   }
 
   void Range() {
@@ -287,8 +287,8 @@ struct Tests {
         double min = (*i)->Number();
         double max = (*j)->Number();
         if (min > max) std::swap(min, max);
-        Type* type = T.Range(min, max);
-        CHECK(type->IsRange());
+        Type type = T.Range(min, max);
+        CHECK(type.IsRange());
       }
     }
 
@@ -298,9 +298,9 @@ struct Tests {
         double min = (*i)->Number();
         double max = (*j)->Number();
         if (min > max) std::swap(min, max);
-        Type* type = T.Range(min, max);
-        CHECK(min == type->AsRange()->Min());
-        CHECK(max == type->AsRange()->Max());
+        Type type = T.Range(min, max);
+        CHECK(min == type.AsRange()->Min());
+        CHECK(max == type.AsRange()->Max());
       }
     }
 
@@ -320,8 +320,8 @@ struct Tests {
             double max2 = (*j2)->Number();
             if (min1 > max1) std::swap(min1, max1);
             if (min2 > max2) std::swap(min2, max2);
-            Type* type1 = T.Range(min1, max1);
-            Type* type2 = T.Range(min2, max2);
+            Type type1 = T.Range(min1, max1);
+            Type type2 = T.Range(min2, max2);
             CHECK(Equal(type1, type2) == (min1 == min2 && max1 == max2));
           }
         }
@@ -329,226 +329,193 @@ struct Tests {
     }
   }
 
-  void Of() {
-    // Constant(V)->Is(Of(V))
-    for (ValueIterator vt = T.values.begin(); vt != T.values.end(); ++vt) {
-      Handle<i::Object> value = *vt;
-      Type* const_type = T.NewConstant(value);
-      Type* of_type = T.Of(value);
-      CHECK(const_type->Is(of_type));
-    }
-
-    // If Of(V)->Is(T), then Constant(V)->Is(T)
-    for (ValueIterator vt = T.values.begin(); vt != T.values.end(); ++vt) {
-      for (TypeIterator it = T.types.begin(); it != T.types.end(); ++it) {
-        Handle<i::Object> value = *vt;
-        Type* type = *it;
-        Type* const_type = T.NewConstant(value);
-        Type* of_type = T.Of(value);
-        CHECK(!of_type->Is(type) || const_type->Is(type));
-      }
-    }
-
-    // If Constant(V)->Is(T), then Of(V)->Is(T) or T->Maybe(Constant(V))
-    for (ValueIterator vt = T.values.begin(); vt != T.values.end(); ++vt) {
-      for (TypeIterator it = T.types.begin(); it != T.types.end(); ++it) {
-        Handle<i::Object> value = *vt;
-        Type* type = *it;
-        Type* const_type = T.NewConstant(value);
-        Type* of_type = T.Of(value);
-        CHECK(!const_type->Is(type) ||
-              of_type->Is(type) || type->Maybe(const_type));
-      }
-    }
-  }
-
   void MinMax() {
-    // If b is regular numeric bitset, then Range(b->Min(), b->Max())->Is(b).
+    // If b is regular numeric bitset, then Range(b.Min(), b.Max()).Is(b).
     // TODO(neis): Need to ignore representation for this to be true.
     /*
     for (TypeIterator it = T.types.begin(); it != T.types.end(); ++it) {
-      Type* type = *it;
-      if (this->IsBitset(type) && type->Is(T.Number) &&
-          !type->Is(T.None) && !type->Is(T.NaN)) {
-        Type* range = T.Range(
-            isolate->factory()->NewNumber(type->Min()),
-            isolate->factory()->NewNumber(type->Max()));
-        CHECK(range->Is(type));
+      Type type = *it;
+      if (this->IsBitset(type) && type.Is(T.Number) &&
+          !type.Is(T.None) && !type.Is(T.NaN)) {
+        Type range = T.Range(
+            isolate->factory()->NewNumber(type.Min()),
+            isolate->factory()->NewNumber(type.Max()));
+        CHECK(range.Is(type));
       }
     }
     */
 
-    // If b is regular numeric bitset, then b->Min() and b->Max() are integers.
+    // If b is regular numeric bitset, then b.Min() and b.Max() are integers.
     for (TypeIterator it = T.types.begin(); it != T.types.end(); ++it) {
-      Type* type = *it;
-      if (this->IsBitset(type) && type->Is(T.Number) && !type->Is(T.NaN)) {
-        CHECK(IsInteger(type->Min()) && IsInteger(type->Max()));
+      Type type = *it;
+      if (this->IsBitset(type) && type.Is(T.Number) && !type.Is(T.NaN)) {
+        CHECK(IsInteger(type.Min()) && IsInteger(type.Max()));
       }
     }
 
-    // If b1 and b2 are regular numeric bitsets with b1->Is(b2), then
-    // b1->Min() >= b2->Min() and b1->Max() <= b2->Max().
+    // If b1 and b2 are regular numeric bitsets with b1.Is(b2), then
+    // b1.Min() >= b2.Min() and b1.Max() <= b2.Max().
     for (TypeIterator it1 = T.types.begin(); it1 != T.types.end(); ++it1) {
       for (TypeIterator it2 = T.types.begin(); it2 != T.types.end(); ++it2) {
-        Type* type1 = *it1;
-        Type* type2 = *it2;
-        if (this->IsBitset(type1) && type1->Is(type2) && type2->Is(T.Number) &&
-            !type1->Is(T.NaN) && !type2->Is(T.NaN)) {
-          CHECK(type1->Min() >= type2->Min());
-          CHECK(type1->Max() <= type2->Max());
+        Type type1 = *it1;
+        Type type2 = *it2;
+        if (this->IsBitset(type1) && type1.Is(type2) && type2.Is(T.Number) &&
+            !type1.Is(T.NaN) && !type2.Is(T.NaN)) {
+          CHECK(type1.Min() >= type2.Min());
+          CHECK(type1.Max() <= type2.Max());
         }
       }
     }
 
-    // Lub(Range(x,y))->Min() <= x and y <= Lub(Range(x,y))->Max()
+    // Lub(Range(x,y)).Min() <= x and y <= Lub(Range(x,y)).Max()
     for (TypeIterator it = T.types.begin(); it != T.types.end(); ++it) {
-      Type* type = *it;
-      if (type->IsRange()) {
-        Type* lub = BitsetType::NewForTesting(BitsetType::Lub(type));
-        CHECK(lub->Min() <= type->Min() && type->Max() <= lub->Max());
+      Type type = *it;
+      if (type.IsRange()) {
+        Type lub = type.BitsetLubForTesting();
+        CHECK(lub.Min() <= type.Min() && type.Max() <= lub.Max());
       }
     }
 
-    // Rangification: If T->Is(Range(-inf,+inf)) and T is inhabited, then
-    // T->Is(Range(T->Min(), T->Max())).
+    // Rangification: If T.Is(Range(-inf,+inf)) and T is inhabited, then
+    // T.Is(Range(T.Min(), T.Max())).
     for (TypeIterator it = T.types.begin(); it != T.types.end(); ++it) {
-      Type* type = *it;
-      CHECK(!type->Is(T.Integer) || type->IsNone() ||
-            type->Is(T.Range(type->Min(), type->Max())));
+      Type type = *it;
+      CHECK(!type.Is(T.Integer) || type.IsNone() ||
+            type.Is(T.Range(type.Min(), type.Max())));
     }
   }
 
   void BitsetGlb() {
-    // Lower: (T->BitsetGlb())->Is(T)
+    // Lower: (T->BitsetGlb()).Is(T)
     for (TypeIterator it = T.types.begin(); it != T.types.end(); ++it) {
-      Type* type = *it;
-      Type* glb = BitsetType::NewForTesting(BitsetType::Glb(type));
-      CHECK(glb->Is(type));
+      Type type = *it;
+      Type glb = type.BitsetGlbForTesting();
+      CHECK(glb.Is(type));
     }
 
-    // Greatest: If T1->IsBitset() and T1->Is(T2), then T1->Is(T2->BitsetGlb())
+    // Greatest: If T1.IsBitset() and T1.Is(T2), then T1.Is(T2->BitsetGlb())
     for (TypeIterator it1 = T.types.begin(); it1 != T.types.end(); ++it1) {
       for (TypeIterator it2 = T.types.begin(); it2 != T.types.end(); ++it2) {
-        Type* type1 = *it1;
-        Type* type2 = *it2;
-        Type* glb2 = BitsetType::NewForTesting(BitsetType::Glb(type2));
-        CHECK(!this->IsBitset(type1) || !type1->Is(type2) || type1->Is(glb2));
+        Type type1 = *it1;
+        Type type2 = *it2;
+        Type glb2 = type2.BitsetGlbForTesting();
+        CHECK(!this->IsBitset(type1) || !type1.Is(type2) || type1.Is(glb2));
       }
     }
 
-    // Monotonicity: T1->Is(T2) implies (T1->BitsetGlb())->Is(T2->BitsetGlb())
+    // Monotonicity: T1.Is(T2) implies (T1->BitsetGlb()).Is(T2->BitsetGlb())
     for (TypeIterator it1 = T.types.begin(); it1 != T.types.end(); ++it1) {
       for (TypeIterator it2 = T.types.begin(); it2 != T.types.end(); ++it2) {
-        Type* type1 = *it1;
-        Type* type2 = *it2;
-        Type* glb1 = BitsetType::NewForTesting(BitsetType::Glb(type1));
-        Type* glb2 = BitsetType::NewForTesting(BitsetType::Glb(type2));
-        CHECK(!type1->Is(type2) || glb1->Is(glb2));
+        Type type1 = *it1;
+        Type type2 = *it2;
+        Type glb1 = type1.BitsetGlbForTesting();
+        Type glb2 = type2.BitsetGlbForTesting();
+        CHECK(!type1.Is(type2) || glb1.Is(glb2));
       }
     }
   }
 
   void BitsetLub() {
-    // Upper: T->Is(T->BitsetLub())
+    // Upper: T.Is(T->BitsetLub())
     for (TypeIterator it = T.types.begin(); it != T.types.end(); ++it) {
-      Type* type = *it;
-      Type* lub = BitsetType::NewForTesting(BitsetType::Lub(type));
-      CHECK(type->Is(lub));
+      Type type = *it;
+      Type lub = type.BitsetLubForTesting();
+      CHECK(type.Is(lub));
     }
 
-    // Least: If T2->IsBitset() and T1->Is(T2), then (T1->BitsetLub())->Is(T2)
+    // Least: If T2.IsBitset() and T1.Is(T2), then (T1->BitsetLub()).Is(T2)
     for (TypeIterator it1 = T.types.begin(); it1 != T.types.end(); ++it1) {
       for (TypeIterator it2 = T.types.begin(); it2 != T.types.end(); ++it2) {
-        Type* type1 = *it1;
-        Type* type2 = *it2;
-        Type* lub1 = BitsetType::NewForTesting(BitsetType::Lub(type1));
-        CHECK(!this->IsBitset(type2) || !type1->Is(type2) || lub1->Is(type2));
+        Type type1 = *it1;
+        Type type2 = *it2;
+        Type lub1 = type1.BitsetLubForTesting();
+        CHECK(!this->IsBitset(type2) || !type1.Is(type2) || lub1.Is(type2));
       }
     }
 
-    // Monotonicity: T1->Is(T2) implies (T1->BitsetLub())->Is(T2->BitsetLub())
+    // Monotonicity: T1.Is(T2) implies (T1->BitsetLub()).Is(T2->BitsetLub())
     for (TypeIterator it1 = T.types.begin(); it1 != T.types.end(); ++it1) {
       for (TypeIterator it2 = T.types.begin(); it2 != T.types.end(); ++it2) {
-        Type* type1 = *it1;
-        Type* type2 = *it2;
-        Type* lub1 = BitsetType::NewForTesting(BitsetType::Lub(type1));
-        Type* lub2 = BitsetType::NewForTesting(BitsetType::Lub(type2));
-        CHECK(!type1->Is(type2) || lub1->Is(lub2));
+        Type type1 = *it1;
+        Type type2 = *it2;
+        Type lub1 = type1.BitsetLubForTesting();
+        Type lub2 = type2.BitsetLubForTesting();
+        CHECK(!type1.Is(type2) || lub1.Is(lub2));
       }
     }
   }
 
   void Is1() {
-    // Least Element (Bottom): None->Is(T)
+    // Least Element (Bottom): None.Is(T)
     for (TypeIterator it = T.types.begin(); it != T.types.end(); ++it) {
-      Type* type = *it;
-      CHECK(T.None->Is(type));
+      Type type = *it;
+      CHECK(T.None.Is(type));
     }
 
-    // Greatest Element (Top): T->Is(Any)
+    // Greatest Element (Top): T.Is(Any)
     for (TypeIterator it = T.types.begin(); it != T.types.end(); ++it) {
-      Type* type = *it;
-      CHECK(type->Is(T.Any));
+      Type type = *it;
+      CHECK(type.Is(T.Any));
     }
 
-    // Bottom Uniqueness: T->Is(None) implies T = None
+    // Bottom Uniqueness: T.Is(None) implies T = None
     for (TypeIterator it = T.types.begin(); it != T.types.end(); ++it) {
-      Type* type = *it;
-      if (type->Is(T.None)) CheckEqual(type, T.None);
+      Type type = *it;
+      if (type.Is(T.None)) CheckEqual(type, T.None);
     }
 
-    // Top Uniqueness: Any->Is(T) implies T = Any
+    // Top Uniqueness: Any.Is(T) implies T = Any
     for (TypeIterator it = T.types.begin(); it != T.types.end(); ++it) {
-      Type* type = *it;
-      if (T.Any->Is(type)) CheckEqual(type, T.Any);
+      Type type = *it;
+      if (T.Any.Is(type)) CheckEqual(type, T.Any);
     }
 
-    // Reflexivity: T->Is(T)
+    // Reflexivity: T.Is(T)
     for (TypeIterator it = T.types.begin(); it != T.types.end(); ++it) {
-      Type* type = *it;
-      CHECK(type->Is(type));
+      Type type = *it;
+      CHECK(type.Is(type));
     }
 
-    // Transitivity: T1->Is(T2) and T2->Is(T3) implies T1->Is(T3)
+    // Transitivity: T1.Is(T2) and T2.Is(T3) implies T1.Is(T3)
     for (TypeIterator it1 = T.types.begin(); it1 != T.types.end(); ++it1) {
       for (TypeIterator it2 = T.types.begin(); it2 != T.types.end(); ++it2) {
         for (TypeIterator it3 = T.types.begin(); it3 != T.types.end(); ++it3) {
-          Type* type1 = *it1;
-          Type* type2 = *it2;
-          Type* type3 = *it3;
-          CHECK(!(type1->Is(type2) && type2->Is(type3)) || type1->Is(type3));
+          Type type1 = *it1;
+          Type type2 = *it2;
+          Type type3 = *it3;
+          CHECK(!(type1.Is(type2) && type2.Is(type3)) || type1.Is(type3));
         }
       }
     }
 
-    // Antisymmetry: T1->Is(T2) and T2->Is(T1) iff T1 = T2
+    // Antisymmetry: T1.Is(T2) and T2.Is(T1) iff T1 = T2
     for (TypeIterator it1 = T.types.begin(); it1 != T.types.end(); ++it1) {
       for (TypeIterator it2 = T.types.begin(); it2 != T.types.end(); ++it2) {
-        Type* type1 = *it1;
-        Type* type2 = *it2;
-        CHECK((type1->Is(type2) && type2->Is(type1)) == Equal(type1, type2));
+        Type type1 = *it1;
+        Type type2 = *it2;
+        CHECK((type1.Is(type2) && type2.Is(type1)) == Equal(type1, type2));
       }
     }
 
     // (In-)Compatibilities.
     for (TypeIterator i = T.types.begin(); i != T.types.end(); ++i) {
       for (TypeIterator j = T.types.begin(); j != T.types.end(); ++j) {
-        Type* type1 = *i;
-        Type* type2 = *j;
-        CHECK(!type1->Is(type2) || this->IsBitset(type2) ||
-              this->IsUnion(type2) || this->IsUnion(type1) ||
-              (type1->IsHeapConstant() && type2->IsHeapConstant()) ||
-              (this->IsBitset(type1) && type2->IsRange()) ||
-              (type1->IsRange() && type2->IsRange()) ||
-              (type1->IsOtherNumberConstant() &&
-               type2->IsOtherNumberConstant()) ||
-              type1->IsNone());
+        Type type1 = *i;
+        Type type2 = *j;
+        CHECK(
+            !type1.Is(type2) || this->IsBitset(type2) || this->IsUnion(type2) ||
+            this->IsUnion(type1) ||
+            (type1.IsHeapConstant() && type2.IsHeapConstant()) ||
+            (this->IsBitset(type1) && type2.IsRange()) ||
+            (type1.IsRange() && type2.IsRange()) ||
+            (type1.IsOtherNumberConstant() && type2.IsOtherNumberConstant()) ||
+            type1.IsNone());
       }
     }
   }
 
   void Is2() {
-    // Range(X1, Y1)->Is(Range(X2, Y2)) iff X1 >= X2 /\ Y1 <= Y2
+    // Range(X1, Y1).Is(Range(X2, Y2)) iff X1 >= X2 /\ Y1 <= Y2
     for (ValueIterator i1 = T.integers.begin();
         i1 != T.integers.end(); ++i1) {
       for (ValueIterator j1 = i1;
@@ -563,46 +530,45 @@ struct Tests {
             double max2 = (*j2)->Number();
             if (min1 > max1) std::swap(min1, max1);
             if (min2 > max2) std::swap(min2, max2);
-            Type* type1 = T.Range(min1, max1);
-            Type* type2 = T.Range(min2, max2);
-            CHECK(type1->Is(type2) == (min1 >= min2 && max1 <= max2));
+            Type type1 = T.Range(min1, max1);
+            Type type2 = T.Range(min2, max2);
+            CHECK(type1.Is(type2) == (min1 >= min2 && max1 <= max2));
           }
         }
       }
     }
 
-    // Constant(V1)->Is(Constant(V2)) iff V1 = V2
+    // Constant(V1).Is(Constant(V2)) iff V1 = V2
     for (ValueIterator vt1 = T.values.begin(); vt1 != T.values.end(); ++vt1) {
       for (ValueIterator vt2 = T.values.begin(); vt2 != T.values.end(); ++vt2) {
         Handle<i::Object> value1 = *vt1;
         Handle<i::Object> value2 = *vt2;
-        Type* const_type1 = T.NewConstant(value1);
-        Type* const_type2 = T.NewConstant(value2);
-        if (const_type1->IsOtherNumberConstant() &&
-            const_type2->IsOtherNumberConstant()) {
-          CHECK(const_type1->Is(const_type2) ==
-                (const_type1->AsOtherNumberConstant()->Value() ==
-                 const_type2->AsOtherNumberConstant()->Value()));
-        } else if (const_type1->IsRange() && const_type2->IsRange()) {
-          CHECK(Equal(const_type1, const_type2) ==
-                ((const_type1->AsRange()->Min() ==
-                  const_type2->AsRange()->Min()) &&
-                 (const_type1->AsRange()->Max() ==
-                  const_type2->AsRange()->Max())));
+        Type const_type1 = T.NewConstant(value1);
+        Type const_type2 = T.NewConstant(value2);
+        if (const_type1.IsOtherNumberConstant() &&
+            const_type2.IsOtherNumberConstant()) {
+          CHECK(const_type1.Is(const_type2) ==
+                (const_type1.AsOtherNumberConstant()->Value() ==
+                 const_type2.AsOtherNumberConstant()->Value()));
+        } else if (const_type1.IsRange() && const_type2.IsRange()) {
+          CHECK(
+              Equal(const_type1, const_type2) ==
+              ((const_type1.AsRange()->Min() == const_type2.AsRange()->Min()) &&
+               (const_type1.AsRange()->Max() == const_type2.AsRange()->Max())));
         } else {
-          CHECK(const_type1->Is(const_type2) == (*value1 == *value2));
+          CHECK(const_type1.Is(const_type2) == (*value1 == *value2));
         }
       }
     }
 
     // Range-specific subtyping
 
-    // Lub(Range(x,y))->Is(T.Union(T.Integral32, T.OtherNumber))
+    // Lub(Range(x,y)).Is(T.Union(T.Integral32, T.OtherNumber))
     for (TypeIterator it = T.types.begin(); it != T.types.end(); ++it) {
-      Type* type = *it;
-      if (type->IsRange()) {
-        Type* lub = BitsetType::NewForTesting(BitsetType::Lub(type));
-        CHECK(lub->Is(T.PlainNumber));
+      Type type = *it;
+      if (type.IsRange()) {
+        Type lub = type.BitsetLubForTesting();
+        CHECK(lub.Is(T.PlainNumber));
       }
     }
 
@@ -658,81 +624,80 @@ struct Tests {
   }
 
   void Maybe() {
-    // T->Maybe(Any) iff T inhabited
+    // T.Maybe(Any) iff T inhabited
     for (TypeIterator it = T.types.begin(); it != T.types.end(); ++it) {
-      Type* type = *it;
-      CHECK(type->Maybe(T.Any) == !type->IsNone());
+      Type type = *it;
+      CHECK(type.Maybe(T.Any) == !type.IsNone());
     }
 
-    // T->Maybe(None) never
+    // T.Maybe(None) never
     for (TypeIterator it = T.types.begin(); it != T.types.end(); ++it) {
-      Type* type = *it;
-      CHECK(!type->Maybe(T.None));
+      Type type = *it;
+      CHECK(!type.Maybe(T.None));
     }
 
-    // Reflexivity upto Inhabitation: T->Maybe(T) iff T inhabited
+    // Reflexivity upto Inhabitation: T.Maybe(T) iff T inhabited
     for (TypeIterator it = T.types.begin(); it != T.types.end(); ++it) {
-      Type* type = *it;
-      CHECK(type->Maybe(type) == !type->IsNone());
+      Type type = *it;
+      CHECK(type.Maybe(type) == !type.IsNone());
     }
 
-    // Symmetry: T1->Maybe(T2) iff T2->Maybe(T1)
+    // Symmetry: T1.Maybe(T2) iff T2.Maybe(T1)
     for (TypeIterator it1 = T.types.begin(); it1 != T.types.end(); ++it1) {
       for (TypeIterator it2 = T.types.begin(); it2 != T.types.end(); ++it2) {
-        Type* type1 = *it1;
-        Type* type2 = *it2;
-        CHECK(type1->Maybe(type2) == type2->Maybe(type1));
+        Type type1 = *it1;
+        Type type2 = *it2;
+        CHECK(type1.Maybe(type2) == type2.Maybe(type1));
       }
     }
 
-    // T1->Maybe(T2) implies T1, T2 inhabited
+    // T1.Maybe(T2) implies T1, T2 inhabited
     for (TypeIterator it1 = T.types.begin(); it1 != T.types.end(); ++it1) {
       for (TypeIterator it2 = T.types.begin(); it2 != T.types.end(); ++it2) {
-        Type* type1 = *it1;
-        Type* type2 = *it2;
-        CHECK(!type1->Maybe(type2) || (!type1->IsNone() && !type2->IsNone()));
+        Type type1 = *it1;
+        Type type2 = *it2;
+        CHECK(!type1.Maybe(type2) || (!type1.IsNone() && !type2.IsNone()));
       }
     }
 
-    // T1->Maybe(T2) implies Intersect(T1, T2) inhabited
+    // T1.Maybe(T2) implies Intersect(T1, T2) inhabited
     for (TypeIterator it1 = T.types.begin(); it1 != T.types.end(); ++it1) {
       for (TypeIterator it2 = T.types.begin(); it2 != T.types.end(); ++it2) {
-        Type* type1 = *it1;
-        Type* type2 = *it2;
-        Type* intersect12 = T.Intersect(type1, type2);
-        CHECK(!type1->Maybe(type2) || !intersect12->IsNone());
+        Type type1 = *it1;
+        Type type2 = *it2;
+        Type intersect12 = T.Intersect(type1, type2);
+        CHECK(!type1.Maybe(type2) || !intersect12.IsNone());
       }
     }
 
-    // T1->Is(T2) and T1 inhabited implies T1->Maybe(T2)
+    // T1.Is(T2) and T1 inhabited implies T1.Maybe(T2)
     for (TypeIterator it1 = T.types.begin(); it1 != T.types.end(); ++it1) {
       for (TypeIterator it2 = T.types.begin(); it2 != T.types.end(); ++it2) {
-        Type* type1 = *it1;
-        Type* type2 = *it2;
-        CHECK(!(type1->Is(type2) && !type1->IsNone()) || type1->Maybe(type2));
+        Type type1 = *it1;
+        Type type2 = *it2;
+        CHECK(!(type1.Is(type2) && !type1.IsNone()) || type1.Maybe(type2));
       }
     }
 
-    // Constant(V1)->Maybe(Constant(V2)) iff V1 = V2
+    // Constant(V1).Maybe(Constant(V2)) iff V1 = V2
     for (ValueIterator vt1 = T.values.begin(); vt1 != T.values.end(); ++vt1) {
       for (ValueIterator vt2 = T.values.begin(); vt2 != T.values.end(); ++vt2) {
         Handle<i::Object> value1 = *vt1;
         Handle<i::Object> value2 = *vt2;
-        Type* const_type1 = T.NewConstant(value1);
-        Type* const_type2 = T.NewConstant(value2);
-        if (const_type1->IsOtherNumberConstant() &&
-            const_type2->IsOtherNumberConstant()) {
-          CHECK(const_type1->Maybe(const_type2) ==
-                (const_type1->AsOtherNumberConstant()->Value() ==
-                 const_type2->AsOtherNumberConstant()->Value()));
-        } else if (const_type1->IsRange() && const_type2->IsRange()) {
-          CHECK(Equal(const_type1, const_type2) ==
-                ((const_type1->AsRange()->Min() ==
-                  const_type2->AsRange()->Min()) &&
-                 (const_type1->AsRange()->Max() ==
-                  const_type2->AsRange()->Max())));
+        Type const_type1 = T.NewConstant(value1);
+        Type const_type2 = T.NewConstant(value2);
+        if (const_type1.IsOtherNumberConstant() &&
+            const_type2.IsOtherNumberConstant()) {
+          CHECK(const_type1.Maybe(const_type2) ==
+                (const_type1.AsOtherNumberConstant()->Value() ==
+                 const_type2.AsOtherNumberConstant()->Value()));
+        } else if (const_type1.IsRange() && const_type2.IsRange()) {
+          CHECK(
+              Equal(const_type1, const_type2) ==
+              ((const_type1.AsRange()->Min() == const_type2.AsRange()->Min()) &&
+               (const_type1.AsRange()->Max() == const_type2.AsRange()->Max())));
         } else {
-          CHECK(const_type1->Maybe(const_type2) == (*value1 == *value2));
+          CHECK(const_type1.Maybe(const_type2) == (*value1 == *value2));
         }
       }
     }
@@ -775,32 +740,32 @@ struct Tests {
   void Union1() {
     // Identity: Union(T, None) = T
     for (TypeIterator it = T.types.begin(); it != T.types.end(); ++it) {
-      Type* type = *it;
-      Type* union_type = T.Union(type, T.None);
+      Type type = *it;
+      Type union_type = T.Union(type, T.None);
       CheckEqual(union_type, type);
     }
 
     // Domination: Union(T, Any) = Any
     for (TypeIterator it = T.types.begin(); it != T.types.end(); ++it) {
-      Type* type = *it;
-      Type* union_type = T.Union(type, T.Any);
+      Type type = *it;
+      Type union_type = T.Union(type, T.Any);
       CheckEqual(union_type, T.Any);
     }
 
     // Idempotence: Union(T, T) = T
     for (TypeIterator it = T.types.begin(); it != T.types.end(); ++it) {
-      Type* type = *it;
-      Type* union_type = T.Union(type, type);
+      Type type = *it;
+      Type union_type = T.Union(type, type);
       CheckEqual(union_type, type);
     }
 
     // Commutativity: Union(T1, T2) = Union(T2, T1)
     for (TypeIterator it1 = T.types.begin(); it1 != T.types.end(); ++it1) {
       for (TypeIterator it2 = T.types.begin(); it2 != T.types.end(); ++it2) {
-        Type* type1 = *it1;
-        Type* type2 = *it2;
-        Type* union12 = T.Union(type1, type2);
-        Type* union21 = T.Union(type2, type1);
+        Type type1 = *it1;
+        Type type2 = *it2;
+        Type union12 = T.Union(type1, type2);
+        Type union21 = T.Union(type2, type1);
         CheckEqual(union12, union21);
       }
     }
@@ -813,41 +778,41 @@ struct Tests {
     for (TypeIterator it1 = T.types.begin(); it1 != T.types.end(); ++it1) {
       for (TypeIterator it2 = T.types.begin(); it2 != T.types.end(); ++it2) {
         for (TypeIterator it3 = T.types.begin(); it3 != T.types.end(); ++it3) {
-          Type* type1 = *it1;
-          Type* type2 = *it2;
-          Type* type3 = *it3;
-          Type* union12 = T.Union(type1, type2);
-          Type* union23 = T.Union(type2, type3);
-          Type* union1_23 = T.Union(type1, union23);
-          Type* union12_3 = T.Union(union12, type3);
+          Type type1 = *it1;
+          Type type2 = *it2;
+          Type type3 = *it3;
+          Type union12 = T.Union(type1, type2);
+          Type union23 = T.Union(type2, type3);
+          Type union1_23 = T.Union(type1, union23);
+          Type union12_3 = T.Union(union12, type3);
           CheckEqual(union1_23, union12_3);
         }
       }
     }
     */
 
-    // Meet: T1->Is(Union(T1, T2)) and T2->Is(Union(T1, T2))
+    // Meet: T1.Is(Union(T1, T2)) and T2.Is(Union(T1, T2))
     for (TypeIterator it1 = T.types.begin(); it1 != T.types.end(); ++it1) {
       for (TypeIterator it2 = T.types.begin(); it2 != T.types.end(); ++it2) {
-        Type* type1 = *it1;
-        Type* type2 = *it2;
-        Type* union12 = T.Union(type1, type2);
-        CHECK(type1->Is(union12));
-        CHECK(type2->Is(union12));
+        Type type1 = *it1;
+        Type type2 = *it2;
+        Type union12 = T.Union(type1, type2);
+        CHECK(type1.Is(union12));
+        CHECK(type2.Is(union12));
       }
     }
 
-    // Upper Boundedness: T1->Is(T2) implies Union(T1, T2) = T2
+    // Upper Boundedness: T1.Is(T2) implies Union(T1, T2) = T2
     for (TypeIterator it1 = T.types.begin(); it1 != T.types.end(); ++it1) {
       for (TypeIterator it2 = T.types.begin(); it2 != T.types.end(); ++it2) {
-        Type* type1 = *it1;
-        Type* type2 = *it2;
-        Type* union12 = T.Union(type1, type2);
-        if (type1->Is(type2)) CheckEqual(union12, type2);
+        Type type1 = *it1;
+        Type type2 = *it2;
+        Type union12 = T.Union(type1, type2);
+        if (type1.Is(type2)) CheckEqual(union12, type2);
       }
     }
 
-    // Monotonicity: T1->Is(T2) implies Union(T1, T3)->Is(Union(T2, T3))
+    // Monotonicity: T1.Is(T2) implies Union(T1, T3).Is(Union(T2, T3))
     // This does NOT hold.  For example:
     // Range(-5,-1) <= Signed32
     // Range(-5,-1) \/ Range(1,5) = Range(-5,5) </= Signed32 \/ Range(1,5)
@@ -855,12 +820,12 @@ struct Tests {
     for (TypeIterator it1 = T.types.begin(); it1 != T.types.end(); ++it1) {
       for (TypeIterator it2 = T.types.begin(); it2 != T.types.end(); ++it2) {
         for (TypeIterator it3 = T.types.begin(); it3 != T.types.end(); ++it3) {
-          Type* type1 = *it1;
-          Type* type2 = *it2;
-          Type* type3 = *it3;
-          Type* union13 = T.Union(type1, type3);
-          Type* union23 = T.Union(type2, type3);
-          CHECK(!type1->Is(type2) || union13->Is(union23));
+          Type type1 = *it1;
+          Type type2 = *it2;
+          Type type3 = *it3;
+          Type union13 = T.Union(type1, type3);
+          Type union23 = T.Union(type2, type3);
+          CHECK(!type1.Is(type2) || union13.Is(union23));
         }
       }
     }
@@ -868,7 +833,7 @@ struct Tests {
   }
 
   void Union2() {
-    // Monotonicity: T1->Is(T3) and T2->Is(T3) implies Union(T1, T2)->Is(T3)
+    // Monotonicity: T1.Is(T3) and T2.Is(T3) implies Union(T1, T2).Is(T3)
     // This does NOT hold.  For example:
     // Range(-2^33, -2^33) <= OtherNumber
     // Range(2^33, 2^33) <= OtherNumber
@@ -877,11 +842,11 @@ struct Tests {
     for (TypeIterator it1 = T.types.begin(); it1 != T.types.end(); ++it1) {
       for (TypeIterator it2 = T.types.begin(); it2 != T.types.end(); ++it2) {
         for (TypeIterator it3 = T.types.begin(); it3 != T.types.end(); ++it3) {
-          Type* type1 = *it1;
-          Type* type2 = *it2;
-          Type* type3 = *it3;
-          Type* union12 = T.Union(type1, type2);
-          CHECK(!(type1->Is(type3) && type2->Is(type3)) || union12->Is(type3));
+          Type type1 = *it1;
+          Type type2 = *it2;
+          Type type3 = *it3;
+          Type union12 = T.Union(type1, type2);
+          CHECK(!(type1.Is(type3) && type2.Is(type3)) || union12.Is(type3));
         }
       }
     }
@@ -889,16 +854,16 @@ struct Tests {
   }
 
   void Union3() {
-    // Monotonicity: T1->Is(T2) or T1->Is(T3) implies T1->Is(Union(T2, T3))
+    // Monotonicity: T1.Is(T2) or T1.Is(T3) implies T1.Is(Union(T2, T3))
     for (TypeIterator it1 = T.types.begin(); it1 != T.types.end(); ++it1) {
       HandleScope scope(isolate);
       for (TypeIterator it2 = T.types.begin(); it2 != T.types.end(); ++it2) {
         for (TypeIterator it3 = it2; it3 != T.types.end(); ++it3) {
-          Type* type1 = *it1;
-          Type* type2 = *it2;
-          Type* type3 = *it3;
-          Type* union23 = T.Union(type2, type3);
-          CHECK(!(type1->Is(type2) || type1->Is(type3)) || type1->Is(union23));
+          Type type1 = *it1;
+          Type type2 = *it2;
+          Type type3 = *it3;
+          Type union23 = T.Union(type2, type3);
+          CHECK(!(type1.Is(type2) || type1.Is(type3)) || type1.Is(union23));
         }
       }
     }
@@ -942,57 +907,56 @@ struct Tests {
   void Intersect() {
     // Identity: Intersect(T, Any) = T
     for (TypeIterator it = T.types.begin(); it != T.types.end(); ++it) {
-      Type* type = *it;
-      Type* intersect_type = T.Intersect(type, T.Any);
+      Type type = *it;
+      Type intersect_type = T.Intersect(type, T.Any);
       CheckEqual(intersect_type, type);
     }
 
     // Domination: Intersect(T, None) = None
     for (TypeIterator it = T.types.begin(); it != T.types.end(); ++it) {
-      Type* type = *it;
-      Type* intersect_type = T.Intersect(type, T.None);
+      Type type = *it;
+      Type intersect_type = T.Intersect(type, T.None);
       CheckEqual(intersect_type, T.None);
     }
 
     // Idempotence: Intersect(T, T) = T
     for (TypeIterator it = T.types.begin(); it != T.types.end(); ++it) {
-      Type* type = *it;
-      Type* intersect_type = T.Intersect(type, type);
+      Type type = *it;
+      Type intersect_type = T.Intersect(type, type);
       CheckEqual(intersect_type, type);
     }
 
     // Commutativity: Intersect(T1, T2) = Intersect(T2, T1)
     for (TypeIterator it1 = T.types.begin(); it1 != T.types.end(); ++it1) {
       for (TypeIterator it2 = T.types.begin(); it2 != T.types.end(); ++it2) {
-        Type* type1 = *it1;
-        Type* type2 = *it2;
-        Type* intersect12 = T.Intersect(type1, type2);
-        Type* intersect21 = T.Intersect(type2, type1);
+        Type type1 = *it1;
+        Type type2 = *it2;
+        Type intersect12 = T.Intersect(type1, type2);
+        Type intersect21 = T.Intersect(type2, type1);
         CheckEqual(intersect12, intersect21);
       }
     }
 
-    // Lower Boundedness: T1->Is(T2) implies Intersect(T1, T2) = T1
+    // Lower Boundedness: T1.Is(T2) implies Intersect(T1, T2) = T1
     for (TypeIterator it1 = T.types.begin(); it1 != T.types.end(); ++it1) {
       for (TypeIterator it2 = T.types.begin(); it2 != T.types.end(); ++it2) {
-        Type* type1 = *it1;
-        Type* type2 = *it2;
-        Type* intersect12 = T.Intersect(type1, type2);
-        if (type1->Is(type2)) CheckEqual(intersect12, type1);
+        Type type1 = *it1;
+        Type type2 = *it2;
+        Type intersect12 = T.Intersect(type1, type2);
+        if (type1.Is(type2)) CheckEqual(intersect12, type1);
       }
     }
 
-    // Monotonicity: T1->Is(T2) and T1->Is(T3) implies T1->Is(Intersect(T2, T3))
+    // Monotonicity: T1.Is(T2) and T1.Is(T3) implies T1.Is(Intersect(T2, T3))
     for (TypeIterator it1 = T.types.begin(); it1 != T.types.end(); ++it1) {
       HandleScope scope(isolate);
       for (TypeIterator it2 = T.types.begin(); it2 != T.types.end(); ++it2) {
         for (TypeIterator it3 = T.types.begin(); it3 != T.types.end(); ++it3) {
-          Type* type1 = *it1;
-          Type* type2 = *it2;
-          Type* type3 = *it3;
-          Type* intersect23 = T.Intersect(type2, type3);
-          CHECK(!(type1->Is(type2) && type1->Is(type3)) ||
-                type1->Is(intersect23));
+          Type type1 = *it1;
+          Type type2 = *it2;
+          Type type3 = *it3;
+          Type intersect23 = T.Intersect(type2, type3);
+          CHECK(!(type1.Is(type2) && type1.Is(type3)) || type1.Is(intersect23));
         }
       }
     }
@@ -1025,14 +989,14 @@ struct Tests {
     for (TypeIterator it1 = T.types.begin(); it1 != T.types.end(); ++it1) {
       for (TypeIterator it2 = T.types.begin(); it2 != T.types.end(); ++it2) {
         for (TypeIterator it3 = T.types.begin(); it3 != T.types.end(); ++it3) {
-          Type* type1 = *it1;
-          Type* type2 = *it2;
-          Type* type3 = *it3;
-          Type* union12 = T.Union(type1, type2);
-          Type* union13 = T.Union(type1, type3);
-          Type* intersect23 = T.Intersect(type2, type3);
-          Type* union1_23 = T.Union(type1, intersect23);
-          Type* intersect12_13 = T.Intersect(union12, union13);
+          Type type1 = *it1;
+          Type type2 = *it2;
+          Type type3 = *it3;
+          Type union12 = T.Union(type1, type2);
+          Type union13 = T.Union(type1, type3);
+          Type intersect23 = T.Intersect(type2, type3);
+          Type union1_23 = T.Union(type1, intersect23);
+          Type intersect12_13 = T.Intersect(union12, union13);
           CHECK(Equal(union1_23, intersect12_13));
         }
       }
@@ -1048,14 +1012,14 @@ struct Tests {
     for (TypeIterator it1 = T.types.begin(); it1 != T.types.end(); ++it1) {
       for (TypeIterator it2 = T.types.begin(); it2 != T.types.end(); ++it2) {
         for (TypeIterator it3 = T.types.begin(); it3 != T.types.end(); ++it3) {
-          Type* type1 = *it1;
-          Type* type2 = *it2;
-          Type* type3 = *it3;
-          Type* intersect12 = T.Intersect(type1, type2);
-          Type* intersect13 = T.Intersect(type1, type3);
-          Type* union23 = T.Union(type2, type3);
-          Type* intersect1_23 = T.Intersect(type1, union23);
-          Type* union12_13 = T.Union(intersect12, intersect13);
+          Type type1 = *it1;
+          Type type2 = *it2;
+          Type type3 = *it3;
+          Type intersect12 = T.Intersect(type1, type2);
+          Type intersect13 = T.Intersect(type1, type3);
+          Type union23 = T.Union(type2, type3);
+          Type intersect1_23 = T.Intersect(type1, union23);
+          Type union12_13 = T.Union(intersect12, intersect13);
           CHECK(Equal(intersect1_23, union12_13));
         }
       }
@@ -1066,11 +1030,11 @@ struct Tests {
   void GetRange() {
     // GetRange(Range(a, b)) = Range(a, b).
     for (TypeIterator it1 = T.types.begin(); it1 != T.types.end(); ++it1) {
-      Type* type1 = *it1;
-      if (type1->IsRange()) {
-        RangeType* range = type1->GetRange()->AsRange();
-        CHECK(type1->Min() == range->Min());
-        CHECK(type1->Max() == range->Max());
+      Type type1 = *it1;
+      if (type1.IsRange()) {
+        const RangeType* range = type1.GetRange().AsRange();
+        CHECK(type1.Min() == range->Min());
+        CHECK(type1.Max() == range->Max());
       }
     }
   }
@@ -1086,8 +1050,6 @@ TEST(ConstantType) { Tests().Constant(); }
 
 TEST(RangeType) { Tests().Range(); }
 
-TEST(Of) { Tests().Of(); }
-
 TEST(MinMax) { Tests().MinMax(); }
 
 TEST(BitsetGlb) { Tests().BitsetGlb(); }
diff --git a/deps/v8/test/cctest/test-unboxed-doubles.cc b/deps/v8/test/cctest/test-unboxed-doubles.cc
index 03f14f5881b9bf..12d16dd08c45d5 100644
--- a/deps/v8/test/cctest/test-unboxed-doubles.cc
+++ b/deps/v8/test/cctest/test-unboxed-doubles.cc
@@ -20,6 +20,7 @@
 #include "src/layout-descriptor.h"
 #include "src/macro-assembler.h"
 #include "src/objects-inl.h"
+#include "src/objects/api-callbacks.h"
 #include "src/property.h"
 #include "test/cctest/cctest.h"
 #include "test/cctest/heap/heap-utils.h"
@@ -74,7 +75,7 @@ static double GetDoubleFieldValue(JSObject* obj, FieldIndex field_index) {
   } else {
     Object* value = obj->RawFastPropertyAt(field_index);
     CHECK(value->IsMutableHeapNumber());
-    return HeapNumber::cast(value)->value();
+    return MutableHeapNumber::cast(value)->value();
   }
 }
 
@@ -85,6 +86,7 @@ void WriteToField(JSObject* object, int descriptor, Object* value) {
 }
 
 const int kNumberOfBits = 32;
+const int kBitsInSmiLayout = SmiValuesAre32Bits() ? 32 : kSmiValueSize - 1;
 
 enum TestPropertyKind {
   PROP_ACCESSOR_INFO,
@@ -143,9 +145,9 @@ TEST(LayoutDescriptorBasicFast) {
 
   CHECK(!layout_desc->IsSlowLayout());
   CHECK(layout_desc->IsFastPointerLayout());
-  CHECK_EQ(kSmiValueSize, layout_desc->capacity());
+  CHECK_EQ(kBitsInSmiLayout, layout_desc->capacity());
 
-  for (int i = 0; i < kSmiValueSize + 13; i++) {
+  for (int i = 0; i < kBitsInSmiLayout + 13; i++) {
     CHECK(layout_desc->IsTagged(i));
   }
   CHECK(layout_desc->IsTagged(-1));
@@ -153,7 +155,7 @@ TEST(LayoutDescriptorBasicFast) {
   CHECK(layout_desc->IsTagged(15635));
   CHECK(layout_desc->IsFastPointerLayout());
 
-  for (int i = 0; i < kSmiValueSize; i++) {
+  for (int i = 0; i < kBitsInSmiLayout; i++) {
     layout_desc = layout_desc->SetTaggedForTesting(i, false);
     CHECK(!layout_desc->IsTagged(i));
     layout_desc = layout_desc->SetTaggedForTesting(i, true);
@@ -177,7 +179,7 @@ TEST(LayoutDescriptorBasicSlow) {
   v8::HandleScope scope(CcTest::isolate());
 
   Handle<LayoutDescriptor> layout_descriptor;
-  const int kPropsCount = kSmiValueSize * 3;
+  const int kPropsCount = kBitsInSmiLayout * 3;
   TestPropertyKind props[kPropsCount];
   for (int i = 0; i < kPropsCount; i++) {
     // All properties tagged.
@@ -192,7 +194,7 @@ TEST(LayoutDescriptorBasicSlow) {
 
     layout_descriptor = LayoutDescriptor::New(map, descriptors, kPropsCount);
     CHECK_EQ(LayoutDescriptor::FastPointerLayout(), *layout_descriptor);
-    CHECK_EQ(kSmiValueSize, layout_descriptor->capacity());
+    CHECK_EQ(kBitsInSmiLayout, layout_descriptor->capacity());
     InitializeVerifiedMapDescriptors(*map, *descriptors, *layout_descriptor);
   }
 
@@ -227,7 +229,7 @@ TEST(LayoutDescriptorBasicSlow) {
     CHECK_NE(LayoutDescriptor::FastPointerLayout(), *layout_descriptor);
     CHECK(layout_descriptor->IsSlowLayout());
     CHECK(!layout_descriptor->IsFastPointerLayout());
-    CHECK_GT(layout_descriptor->capacity(), kSmiValueSize);
+    CHECK_GT(layout_descriptor->capacity(), kBitsInSmiLayout);
 
     CHECK(!layout_descriptor->IsTagged(0));
     CHECK(!layout_descriptor->IsTagged(kPropsCount - 1));
@@ -335,13 +337,13 @@ static void TestLayoutDescriptorQueriesFast(int max_sequence_length) {
 
   {
     int bit_flip_positions[] = {1000};
-    TestLayoutDescriptorQueries(kSmiValueSize, bit_flip_positions,
+    TestLayoutDescriptorQueries(kBitsInSmiLayout, bit_flip_positions,
                                 max_sequence_length);
   }
 
   {
     int bit_flip_positions[] = {0, 1000};
-    TestLayoutDescriptorQueries(kSmiValueSize, bit_flip_positions,
+    TestLayoutDescriptorQueries(kBitsInSmiLayout, bit_flip_positions,
                                 max_sequence_length);
   }
 
@@ -350,20 +352,20 @@ static void TestLayoutDescriptorQueriesFast(int max_sequence_length) {
     for (int i = 0; i <= kNumberOfBits; i++) {
       bit_flip_positions[i] = i;
     }
-    TestLayoutDescriptorQueries(kSmiValueSize, bit_flip_positions,
+    TestLayoutDescriptorQueries(kBitsInSmiLayout, bit_flip_positions,
                                 max_sequence_length);
   }
 
   {
     int bit_flip_positions[] = {3, 7, 8, 10, 15, 21, 30, 1000};
-    TestLayoutDescriptorQueries(kSmiValueSize, bit_flip_positions,
+    TestLayoutDescriptorQueries(kBitsInSmiLayout, bit_flip_positions,
                                 max_sequence_length);
   }
 
   {
     int bit_flip_positions[] = {0,  1,  2,  3,  5,  7,  9,
                                 12, 15, 18, 22, 26, 29, 1000};
-    TestLayoutDescriptorQueries(kSmiValueSize, bit_flip_positions,
+    TestLayoutDescriptorQueries(kBitsInSmiLayout, bit_flip_positions,
                                 max_sequence_length);
   }
 }
@@ -544,7 +546,7 @@ TEST(LayoutDescriptorCreateNewSlow) {
   v8::HandleScope scope(CcTest::isolate());
 
   Handle<LayoutDescriptor> layout_descriptor;
-  const int kPropsCount = kSmiValueSize * 3;
+  const int kPropsCount = kBitsInSmiLayout * 3;
   TestPropertyKind props[kPropsCount];
   for (int i = 0; i < kPropsCount; i++) {
     props[i] = static_cast<TestPropertyKind>(i % PROP_KIND_NUMBER);
@@ -678,7 +680,7 @@ TEST(LayoutDescriptorAppend) {
   v8::HandleScope scope(CcTest::isolate());
 
   Handle<LayoutDescriptor> layout_descriptor;
-  const int kPropsCount = kSmiValueSize * 3;
+  const int kPropsCount = kBitsInSmiLayout * 3;
   TestPropertyKind props[kPropsCount];
   for (int i = 0; i < kPropsCount; i++) {
     props[i] = static_cast<TestPropertyKind>(i % PROP_KIND_NUMBER);
@@ -693,10 +695,10 @@ TEST(LayoutDescriptorAppend) {
   CHECK(!layout_descriptor->IsSlowLayout());
 
   layout_descriptor =
-      TestLayoutDescriptorAppend(isolate, kSmiValueSize, props, kPropsCount);
+      TestLayoutDescriptorAppend(isolate, kBitsInSmiLayout, props, kPropsCount);
   CHECK(!layout_descriptor->IsSlowLayout());
 
-  layout_descriptor = TestLayoutDescriptorAppend(isolate, kSmiValueSize * 2,
+  layout_descriptor = TestLayoutDescriptorAppend(isolate, kBitsInSmiLayout * 2,
                                                  props, kPropsCount);
   CHECK(layout_descriptor->IsSlowLayout());
 
@@ -712,7 +714,7 @@ TEST(LayoutDescriptorAppendAllDoubles) {
   v8::HandleScope scope(CcTest::isolate());
 
   Handle<LayoutDescriptor> layout_descriptor;
-  const int kPropsCount = kSmiValueSize * 3;
+  const int kPropsCount = kBitsInSmiLayout * 3;
   TestPropertyKind props[kPropsCount];
   for (int i = 0; i < kPropsCount; i++) {
     props[i] = PROP_DOUBLE;
@@ -727,14 +729,14 @@ TEST(LayoutDescriptorAppendAllDoubles) {
   CHECK(!layout_descriptor->IsSlowLayout());
 
   layout_descriptor =
-      TestLayoutDescriptorAppend(isolate, kSmiValueSize, props, kPropsCount);
+      TestLayoutDescriptorAppend(isolate, kBitsInSmiLayout, props, kPropsCount);
   CHECK(!layout_descriptor->IsSlowLayout());
 
-  layout_descriptor = TestLayoutDescriptorAppend(isolate, kSmiValueSize + 1,
+  layout_descriptor = TestLayoutDescriptorAppend(isolate, kBitsInSmiLayout + 1,
                                                  props, kPropsCount);
   CHECK(layout_descriptor->IsSlowLayout());
 
-  layout_descriptor = TestLayoutDescriptorAppend(isolate, kSmiValueSize * 2,
+  layout_descriptor = TestLayoutDescriptorAppend(isolate, kBitsInSmiLayout * 2,
                                                  props, kPropsCount);
   CHECK(layout_descriptor->IsSlowLayout());
 
@@ -744,12 +746,12 @@ TEST(LayoutDescriptorAppendAllDoubles) {
 
   {
     // Ensure layout descriptor switches into slow mode at the right moment.
-    layout_descriptor =
-        TestLayoutDescriptorAppend(isolate, kPropsCount, props, kSmiValueSize);
+    layout_descriptor = TestLayoutDescriptorAppend(isolate, kPropsCount, props,
+                                                   kBitsInSmiLayout);
     CHECK(!layout_descriptor->IsSlowLayout());
 
     layout_descriptor = TestLayoutDescriptorAppend(isolate, kPropsCount, props,
-                                                   kSmiValueSize + 1);
+                                                   kBitsInSmiLayout + 1);
     CHECK(layout_descriptor->IsSlowLayout());
   }
 }
@@ -769,7 +771,7 @@ static Handle<LayoutDescriptor> TestLayoutDescriptorAppendIfFastOrUseFull(
   // This method calls LayoutDescriptor::AppendIfFastOrUseFull() internally
   // and does all the required map-descriptors related book keeping.
   Handle<Map> last_map = Map::AddMissingTransitionsForTesting(
-      initial_map, descriptors, full_layout_descriptor);
+      isolate, initial_map, descriptors, full_layout_descriptor);
 
   // Follow back pointers to construct a sequence of maps from |map|
   // to |last_map|.
@@ -829,7 +831,7 @@ TEST(LayoutDescriptorAppendIfFastOrUseFull) {
   v8::HandleScope scope(CcTest::isolate());
 
   Handle<LayoutDescriptor> layout_descriptor;
-  const int kPropsCount = kSmiValueSize * 3;
+  const int kPropsCount = kBitsInSmiLayout * 3;
   TestPropertyKind props[kPropsCount];
   for (int i = 0; i < kPropsCount; i++) {
     props[i] = static_cast<TestPropertyKind>(i % PROP_KIND_NUMBER);
@@ -846,11 +848,11 @@ TEST(LayoutDescriptorAppendIfFastOrUseFull) {
   CHECK(!layout_descriptor->IsSlowLayout());
 
   layout_descriptor = TestLayoutDescriptorAppendIfFastOrUseFull(
-      isolate, kSmiValueSize, descriptors, kPropsCount);
+      isolate, kBitsInSmiLayout, descriptors, kPropsCount);
   CHECK(!layout_descriptor->IsSlowLayout());
 
   layout_descriptor = TestLayoutDescriptorAppendIfFastOrUseFull(
-      isolate, kSmiValueSize * 2, descriptors, kPropsCount);
+      isolate, kBitsInSmiLayout * 2, descriptors, kPropsCount);
   CHECK(layout_descriptor->IsSlowLayout());
 
   layout_descriptor = TestLayoutDescriptorAppendIfFastOrUseFull(
@@ -865,7 +867,7 @@ TEST(LayoutDescriptorAppendIfFastOrUseFullAllDoubles) {
   v8::HandleScope scope(CcTest::isolate());
 
   Handle<LayoutDescriptor> layout_descriptor;
-  const int kPropsCount = kSmiValueSize * 3;
+  const int kPropsCount = kBitsInSmiLayout * 3;
   TestPropertyKind props[kPropsCount];
   for (int i = 0; i < kPropsCount; i++) {
     props[i] = PROP_DOUBLE;
@@ -882,15 +884,15 @@ TEST(LayoutDescriptorAppendIfFastOrUseFullAllDoubles) {
   CHECK(!layout_descriptor->IsSlowLayout());
 
   layout_descriptor = TestLayoutDescriptorAppendIfFastOrUseFull(
-      isolate, kSmiValueSize, descriptors, kPropsCount);
+      isolate, kBitsInSmiLayout, descriptors, kPropsCount);
   CHECK(!layout_descriptor->IsSlowLayout());
 
   layout_descriptor = TestLayoutDescriptorAppendIfFastOrUseFull(
-      isolate, kSmiValueSize + 1, descriptors, kPropsCount);
+      isolate, kBitsInSmiLayout + 1, descriptors, kPropsCount);
   CHECK(layout_descriptor->IsSlowLayout());
 
   layout_descriptor = TestLayoutDescriptorAppendIfFastOrUseFull(
-      isolate, kSmiValueSize * 2, descriptors, kPropsCount);
+      isolate, kBitsInSmiLayout * 2, descriptors, kPropsCount);
   CHECK(layout_descriptor->IsSlowLayout());
 
   layout_descriptor = TestLayoutDescriptorAppendIfFastOrUseFull(
@@ -900,11 +902,11 @@ TEST(LayoutDescriptorAppendIfFastOrUseFullAllDoubles) {
   {
     // Ensure layout descriptor switches into slow mode at the right moment.
     layout_descriptor = TestLayoutDescriptorAppendIfFastOrUseFull(
-        isolate, kPropsCount, descriptors, kSmiValueSize);
+        isolate, kPropsCount, descriptors, kBitsInSmiLayout);
     CHECK(!layout_descriptor->IsSlowLayout());
 
     layout_descriptor = TestLayoutDescriptorAppendIfFastOrUseFull(
-        isolate, kPropsCount, descriptors, kSmiValueSize + 1);
+        isolate, kPropsCount, descriptors, kBitsInSmiLayout + 1);
     CHECK(layout_descriptor->IsSlowLayout());
   }
 }
@@ -921,7 +923,7 @@ TEST(Regress436816) {
   // mid-test states would fail heap verification.
   CcTest::CollectAllGarbage();
 
-  const int kPropsCount = kSmiValueSize * 3;
+  const int kPropsCount = kBitsInSmiLayout * 3;
   TestPropertyKind props[kPropsCount];
   for (int i = 0; i < kPropsCount; i++) {
     props[i] = PROP_DOUBLE;
@@ -936,7 +938,7 @@ TEST(Regress436816) {
 
   Handle<JSObject> object = factory->NewJSObjectFromMap(map, TENURED);
 
-  Address fake_address = reinterpret_cast<Address>(~kHeapObjectTagMask);
+  Address fake_address = static_cast<Address>(~kHeapObjectTagMask);
   HeapObject* fake_object = HeapObject::FromAddress(fake_address);
   CHECK(fake_object->IsHeapObject());
 
@@ -950,7 +952,7 @@ TEST(Regress436816) {
   CHECK(!object->map()->HasFastPointerLayout());
 
   Handle<Map> normalized_map =
-      Map::Normalize(map, KEEP_INOBJECT_PROPERTIES, "testing");
+      Map::Normalize(isolate, map, KEEP_INOBJECT_PROPERTIES, "testing");
   JSObject::MigrateToMap(object, normalized_map);
   CHECK(!object->HasFastProperties());
   CHECK(object->map()->HasFastPointerLayout());
@@ -973,14 +975,15 @@ TEST(DescriptorArrayTrimming) {
   Handle<FieldType> any_type = FieldType::Any(isolate);
   Handle<Map> map = Map::Create(isolate, kFieldCount);
   for (int i = 0; i < kSplitFieldIndex; i++) {
-    map = Map::CopyWithField(map, MakeName("prop", i), any_type, NONE, kMutable,
-                             Representation::Smi(), INSERT_TRANSITION)
+    map = Map::CopyWithField(isolate, map, MakeName("prop", i), any_type, NONE,
+                             PropertyConstness::kMutable, Representation::Smi(),
+                             INSERT_TRANSITION)
               .ToHandleChecked();
   }
-  map =
-      Map::CopyWithField(map, MakeName("dbl", kSplitFieldIndex), any_type, NONE,
-                         kMutable, Representation::Double(), INSERT_TRANSITION)
-          .ToHandleChecked();
+  map = Map::CopyWithField(isolate, map, MakeName("dbl", kSplitFieldIndex),
+                           any_type, NONE, PropertyConstness::kMutable,
+                           Representation::Double(), INSERT_TRANSITION)
+            .ToHandleChecked();
   CHECK(map->layout_descriptor()->IsConsistentWithMap(*map, true));
   CHECK(map->layout_descriptor()->IsSlowLayout());
   CHECK(map->owns_descriptors());
@@ -992,9 +995,9 @@ TEST(DescriptorArrayTrimming) {
 
     Handle<Map> tmp_map = map;
     for (int i = kSplitFieldIndex + 1; i < kFieldCount; i++) {
-      tmp_map = Map::CopyWithField(tmp_map, MakeName("dbl", i), any_type, NONE,
-                                   kMutable, Representation::Double(),
-                                   INSERT_TRANSITION)
+      tmp_map = Map::CopyWithField(isolate, tmp_map, MakeName("dbl", i),
+                                   any_type, NONE, PropertyConstness::kMutable,
+                                   Representation::Double(), INSERT_TRANSITION)
                     .ToHandleChecked();
       CHECK(tmp_map->layout_descriptor()->IsConsistentWithMap(*tmp_map, true));
     }
@@ -1032,16 +1035,16 @@ TEST(DescriptorArrayTrimming) {
 
     Handle<Map> tmp_map = map;
     for (int i = kSplitFieldIndex + 1; i < kFieldCount - 1; i++) {
-      tmp_map = Map::CopyWithField(tmp_map, MakeName("tagged", i), any_type,
-                                   NONE, kMutable, Representation::Tagged(),
-                                   INSERT_TRANSITION)
+      tmp_map = Map::CopyWithField(isolate, tmp_map, MakeName("tagged", i),
+                                   any_type, NONE, PropertyConstness::kMutable,
+                                   Representation::Tagged(), INSERT_TRANSITION)
                     .ToHandleChecked();
       CHECK(tmp_map->layout_descriptor()->IsConsistentWithMap(*tmp_map, true));
     }
-    tmp_map =
-        Map::CopyWithField(tmp_map, MakeString("dbl"), any_type, NONE, kMutable,
-                           Representation::Double(), INSERT_TRANSITION)
-            .ToHandleChecked();
+    tmp_map = Map::CopyWithField(isolate, tmp_map, MakeString("dbl"), any_type,
+                                 NONE, PropertyConstness::kMutable,
+                                 Representation::Double(), INSERT_TRANSITION)
+                  .ToHandleChecked();
     CHECK(tmp_map->layout_descriptor()->IsConsistentWithMap(*tmp_map, true));
     // Check that descriptors are shared.
     CHECK(tmp_map->owns_descriptors());
@@ -1064,7 +1067,8 @@ TEST(DoScavenge) {
 
   Handle<FieldType> any_type = FieldType::Any(isolate);
   Handle<Map> map = Map::Create(isolate, 10);
-  map = Map::CopyWithField(map, MakeName("prop", 0), any_type, NONE, kMutable,
+  map = Map::CopyWithField(isolate, map, MakeName("prop", 0), any_type, NONE,
+                           PropertyConstness::kMutable,
                            Representation::Double(), INSERT_TRANSITION)
             .ToHandleChecked();
 
@@ -1096,7 +1100,7 @@ TEST(DoScavenge) {
   double boom_value = bit_cast<double>(fake_object);
 
   FieldIndex field_index = FieldIndex::ForDescriptor(obj->map(), 0);
-  Handle<HeapNumber> boom_number = factory->NewHeapNumber(boom_value, MUTABLE);
+  auto boom_number = factory->NewMutableHeapNumber(boom_value);
   obj->FastPropertyAtPut(field_index, *boom_number);
 
   // Now |obj| moves to old gen and it has a double field that looks like
@@ -1127,10 +1131,12 @@ TEST(DoScavengeWithIncrementalWriteBarrier) {
 
   Handle<FieldType> any_type = FieldType::Any(isolate);
   Handle<Map> map = Map::Create(isolate, 10);
-  map = Map::CopyWithField(map, MakeName("prop", 0), any_type, NONE, kMutable,
+  map = Map::CopyWithField(isolate, map, MakeName("prop", 0), any_type, NONE,
+                           PropertyConstness::kMutable,
                            Representation::Double(), INSERT_TRANSITION)
             .ToHandleChecked();
-  map = Map::CopyWithField(map, MakeName("prop", 1), any_type, NONE, kMutable,
+  map = Map::CopyWithField(isolate, map, MakeName("prop", 1), any_type, NONE,
+                           PropertyConstness::kMutable,
                            Representation::Tagged(), INSERT_TRANSITION)
             .ToHandleChecked();
 
@@ -1271,7 +1277,7 @@ TEST(LayoutDescriptorHelperMixed) {
   v8::HandleScope scope(CcTest::isolate());
 
   Handle<LayoutDescriptor> layout_descriptor;
-  const int kPropsCount = kSmiValueSize * 3;
+  const int kPropsCount = kBitsInSmiLayout * 3;
   TestPropertyKind props[kPropsCount];
   for (int i = 0; i < kPropsCount; i++) {
     props[i] = static_cast<TestPropertyKind>(i % PROP_KIND_NUMBER);
@@ -1283,9 +1289,10 @@ TEST(LayoutDescriptorHelperMixed) {
 
   TestLayoutDescriptorHelper(isolate, 13, descriptors, kPropsCount);
 
-  TestLayoutDescriptorHelper(isolate, kSmiValueSize, descriptors, kPropsCount);
+  TestLayoutDescriptorHelper(isolate, kBitsInSmiLayout, descriptors,
+                             kPropsCount);
 
-  TestLayoutDescriptorHelper(isolate, kSmiValueSize * 2, descriptors,
+  TestLayoutDescriptorHelper(isolate, kBitsInSmiLayout * 2, descriptors,
                              kPropsCount);
 
   TestLayoutDescriptorHelper(isolate, kPropsCount, descriptors, kPropsCount);
@@ -1298,7 +1305,7 @@ TEST(LayoutDescriptorHelperAllTagged) {
   v8::HandleScope scope(CcTest::isolate());
 
   Handle<LayoutDescriptor> layout_descriptor;
-  const int kPropsCount = kSmiValueSize * 3;
+  const int kPropsCount = kBitsInSmiLayout * 3;
   TestPropertyKind props[kPropsCount];
   for (int i = 0; i < kPropsCount; i++) {
     props[i] = PROP_TAGGED;
@@ -1310,9 +1317,10 @@ TEST(LayoutDescriptorHelperAllTagged) {
 
   TestLayoutDescriptorHelper(isolate, 13, descriptors, kPropsCount);
 
-  TestLayoutDescriptorHelper(isolate, kSmiValueSize, descriptors, kPropsCount);
+  TestLayoutDescriptorHelper(isolate, kBitsInSmiLayout, descriptors,
+                             kPropsCount);
 
-  TestLayoutDescriptorHelper(isolate, kSmiValueSize * 2, descriptors,
+  TestLayoutDescriptorHelper(isolate, kBitsInSmiLayout * 2, descriptors,
                              kPropsCount);
 
   TestLayoutDescriptorHelper(isolate, kPropsCount, descriptors, kPropsCount);
@@ -1325,7 +1333,7 @@ TEST(LayoutDescriptorHelperAllDoubles) {
   v8::HandleScope scope(CcTest::isolate());
 
   Handle<LayoutDescriptor> layout_descriptor;
-  const int kPropsCount = kSmiValueSize * 3;
+  const int kPropsCount = kBitsInSmiLayout * 3;
   TestPropertyKind props[kPropsCount];
   for (int i = 0; i < kPropsCount; i++) {
     props[i] = PROP_DOUBLE;
@@ -1337,9 +1345,10 @@ TEST(LayoutDescriptorHelperAllDoubles) {
 
   TestLayoutDescriptorHelper(isolate, 13, descriptors, kPropsCount);
 
-  TestLayoutDescriptorHelper(isolate, kSmiValueSize, descriptors, kPropsCount);
+  TestLayoutDescriptorHelper(isolate, kBitsInSmiLayout, descriptors,
+                             kPropsCount);
 
-  TestLayoutDescriptorHelper(isolate, kSmiValueSize * 2, descriptors,
+  TestLayoutDescriptorHelper(isolate, kBitsInSmiLayout * 2, descriptors,
                              kPropsCount);
 
   TestLayoutDescriptorHelper(isolate, kPropsCount, descriptors, kPropsCount);
@@ -1357,14 +1366,15 @@ TEST(LayoutDescriptorSharing) {
     Handle<Map> map = Map::Create(isolate, 64);
     for (int i = 0; i < 32; i++) {
       Handle<String> name = MakeName("prop", i);
-      map = Map::CopyWithField(map, name, any_type, NONE, kMutable,
+      map = Map::CopyWithField(isolate, map, name, any_type, NONE,
+                               PropertyConstness::kMutable,
                                Representation::Smi(), INSERT_TRANSITION)
                 .ToHandleChecked();
     }
-    split_map =
-        Map::CopyWithField(map, MakeString("dbl"), any_type, NONE, kMutable,
-                           Representation::Double(), INSERT_TRANSITION)
-            .ToHandleChecked();
+    split_map = Map::CopyWithField(isolate, map, MakeString("dbl"), any_type,
+                                   NONE, PropertyConstness::kMutable,
+                                   Representation::Double(), INSERT_TRANSITION)
+                    .ToHandleChecked();
   }
   Handle<LayoutDescriptor> split_layout_descriptor(
       split_map->layout_descriptor(), isolate);
@@ -1373,8 +1383,9 @@ TEST(LayoutDescriptorSharing) {
   CHECK(split_map->owns_descriptors());
 
   Handle<Map> map1 =
-      Map::CopyWithField(split_map, MakeString("foo"), any_type, NONE, kMutable,
-                         Representation::Double(), INSERT_TRANSITION)
+      Map::CopyWithField(isolate, split_map, MakeString("foo"), any_type, NONE,
+                         PropertyConstness::kMutable, Representation::Double(),
+                         INSERT_TRANSITION)
           .ToHandleChecked();
   CHECK(!split_map->owns_descriptors());
   CHECK_EQ(*split_layout_descriptor, split_map->layout_descriptor());
@@ -1385,8 +1396,9 @@ TEST(LayoutDescriptorSharing) {
   CHECK(map1->layout_descriptor()->IsConsistentWithMap(*map1, true));
 
   Handle<Map> map2 =
-      Map::CopyWithField(split_map, MakeString("bar"), any_type, NONE, kMutable,
-                         Representation::Tagged(), INSERT_TRANSITION)
+      Map::CopyWithField(isolate, split_map, MakeString("bar"), any_type, NONE,
+                         PropertyConstness::kMutable, Representation::Tagged(),
+                         INSERT_TRANSITION)
           .ToHandleChecked();
 
   // Layout descriptors should not be shared with |split_map|.
@@ -1423,7 +1435,7 @@ static void TestWriteBarrier(Handle<Map> map, Handle<Map> new_map,
     obj_value = factory->NewHeapNumber(0.);
   }
 
-  CHECK(heap->InNewSpace(*obj_value));
+  CHECK(Heap::InNewSpace(*obj_value));
 
   {
     FieldIndex index = FieldIndex::ForDescriptor(*map, tagged_descriptor);
@@ -1558,18 +1570,21 @@ static void TestWriteBarrierObjectShiftFieldsRight(
   Handle<JSObject> func = GetObject("func");
 
   Handle<Map> map = Map::Create(isolate, 10);
-  map = Map::CopyWithConstant(map, MakeName("prop", 0), func, NONE,
-                              INSERT_TRANSITION).ToHandleChecked();
-  map = Map::CopyWithField(map, MakeName("prop", 1), any_type, NONE, kMutable,
+  map = Map::CopyWithConstant(isolate, map, MakeName("prop", 0), func, NONE,
+                              INSERT_TRANSITION)
+            .ToHandleChecked();
+  map = Map::CopyWithField(isolate, map, MakeName("prop", 1), any_type, NONE,
+                           PropertyConstness::kMutable,
                            Representation::Double(), INSERT_TRANSITION)
             .ToHandleChecked();
-  map = Map::CopyWithField(map, MakeName("prop", 2), any_type, NONE, kMutable,
+  map = Map::CopyWithField(isolate, map, MakeName("prop", 2), any_type, NONE,
+                           PropertyConstness::kMutable,
                            Representation::Tagged(), INSERT_TRANSITION)
             .ToHandleChecked();
 
   // Shift fields right by turning constant property to a field.
   Handle<Map> new_map = Map::ReconfigureProperty(
-      map, 0, kData, NONE, Representation::Tagged(), any_type);
+      isolate, map, 0, kData, NONE, Representation::Tagged(), any_type);
 
   if (write_barrier_kind == OLD_TO_NEW_WRITE_BARRIER) {
     TestWriteBarrier(map, new_map, 2, 1);
diff --git a/deps/v8/test/cctest/test-weakmaps.cc b/deps/v8/test/cctest/test-weakmaps.cc
index af563ce8a62dfe..08d7bea874201f 100644
--- a/deps/v8/test/cctest/test-weakmaps.cc
+++ b/deps/v8/test/cctest/test-weakmaps.cc
@@ -31,6 +31,8 @@
 #include "src/heap/factory.h"
 #include "src/isolate.h"
 #include "src/objects-inl.h"
+#include "src/objects/hash-table-inl.h"
+#include "src/objects/js-collection-inl.h"
 #include "test/cctest/cctest.h"
 #include "test/cctest/heap/heap-utils.h"
 
@@ -83,14 +85,14 @@ TEST(Weakness) {
     int32_t object_hash = object->GetOrCreateHash(isolate)->value();
     JSWeakCollection::Set(weakmap, object, smi, object_hash);
   }
-  CHECK_EQ(2, ObjectHashTable::cast(weakmap->table())->NumberOfElements());
+  CHECK_EQ(2, EphemeronHashTable::cast(weakmap->table())->NumberOfElements());
 
   // Force a full GC.
   CcTest::CollectAllGarbage(Heap::kAbortIncrementalMarkingMask);
   CHECK_EQ(0, NumberOfWeakCalls);
-  CHECK_EQ(2, ObjectHashTable::cast(weakmap->table())->NumberOfElements());
+  CHECK_EQ(2, EphemeronHashTable::cast(weakmap->table())->NumberOfElements());
   CHECK_EQ(
-      0, ObjectHashTable::cast(weakmap->table())->NumberOfDeletedElements());
+      0, EphemeronHashTable::cast(weakmap->table())->NumberOfDeletedElements());
 
   // Make the global reference to the key weak.
   std::pair<Handle<Object>*, int> handle_and_id(&key, 1234);
@@ -101,9 +103,9 @@ TEST(Weakness) {
 
   CcTest::CollectAllGarbage(Heap::kAbortIncrementalMarkingMask);
   CHECK_EQ(1, NumberOfWeakCalls);
-  CHECK_EQ(0, ObjectHashTable::cast(weakmap->table())->NumberOfElements());
-  CHECK_EQ(2,
-           ObjectHashTable::cast(weakmap->table())->NumberOfDeletedElements());
+  CHECK_EQ(0, EphemeronHashTable::cast(weakmap->table())->NumberOfElements());
+  CHECK_EQ(
+      2, EphemeronHashTable::cast(weakmap->table())->NumberOfDeletedElements());
 }
 
 
@@ -115,7 +117,7 @@ TEST(Shrinking) {
   Handle<JSWeakMap> weakmap = isolate->factory()->NewJSWeakMap();
 
   // Check initial capacity.
-  CHECK_EQ(32, ObjectHashTable::cast(weakmap->table())->Capacity());
+  CHECK_EQ(32, EphemeronHashTable::cast(weakmap->table())->Capacity());
 
   // Fill up weak map to trigger capacity change.
   {
@@ -130,19 +132,20 @@ TEST(Shrinking) {
   }
 
   // Check increased capacity.
-  CHECK_EQ(128, ObjectHashTable::cast(weakmap->table())->Capacity());
+  CHECK_EQ(128, EphemeronHashTable::cast(weakmap->table())->Capacity());
 
   // Force a full GC.
-  CHECK_EQ(32, ObjectHashTable::cast(weakmap->table())->NumberOfElements());
+  CHECK_EQ(32, EphemeronHashTable::cast(weakmap->table())->NumberOfElements());
   CHECK_EQ(
-      0, ObjectHashTable::cast(weakmap->table())->NumberOfDeletedElements());
+      0, EphemeronHashTable::cast(weakmap->table())->NumberOfDeletedElements());
   CcTest::CollectAllGarbage(Heap::kAbortIncrementalMarkingMask);
-  CHECK_EQ(0, ObjectHashTable::cast(weakmap->table())->NumberOfElements());
+  CHECK_EQ(0, EphemeronHashTable::cast(weakmap->table())->NumberOfElements());
   CHECK_EQ(
-      32, ObjectHashTable::cast(weakmap->table())->NumberOfDeletedElements());
+      32,
+      EphemeronHashTable::cast(weakmap->table())->NumberOfDeletedElements());
 
   // Check shrunk capacity.
-  CHECK_EQ(32, ObjectHashTable::cast(weakmap->table())->Capacity());
+  CHECK_EQ(32, EphemeronHashTable::cast(weakmap->table())->Capacity());
 }
 
 
@@ -162,7 +165,7 @@ TEST(Regress2060a) {
   Handle<JSWeakMap> weakmap = isolate->factory()->NewJSWeakMap();
 
   // Start second old-space page so that values land on evacuation candidate.
-  Page* first_page = heap->old_space()->anchor()->next_page();
+  Page* first_page = heap->old_space()->first_page();
   heap::SimulateFullSpace(heap->old_space());
 
   // Fill up weak map with values on an evacuation candidate.
@@ -170,7 +173,7 @@ TEST(Regress2060a) {
     HandleScope scope(isolate);
     for (int i = 0; i < 32; i++) {
       Handle<JSObject> object = factory->NewJSObject(function, TENURED);
-      CHECK(!heap->InNewSpace(*object));
+      CHECK(!Heap::InNewSpace(*object));
       CHECK(!first_page->Contains(object->address()));
       int32_t hash = key->GetOrCreateHash(isolate)->value();
       JSWeakCollection::Set(weakmap, key, object, hash);
@@ -201,14 +204,14 @@ TEST(Regress2060b) {
       factory->NewFunctionForTest(factory->function_string());
 
   // Start second old-space page so that keys land on evacuation candidate.
-  Page* first_page = heap->old_space()->anchor()->next_page();
+  Page* first_page = heap->old_space()->first_page();
   heap::SimulateFullSpace(heap->old_space());
 
   // Fill up weak map with keys on an evacuation candidate.
   Handle<JSObject> keys[32];
   for (int i = 0; i < 32; i++) {
     keys[i] = factory->NewJSObject(function, TENURED);
-    CHECK(!heap->InNewSpace(*keys[i]));
+    CHECK(!Heap::InNewSpace(*keys[i]));
     CHECK(!first_page->Contains(keys[i]->address()));
   }
   Handle<JSWeakMap> weakmap = isolate->factory()->NewJSWeakMap();
diff --git a/deps/v8/test/cctest/test-weaksets.cc b/deps/v8/test/cctest/test-weaksets.cc
index 0a00e2f4644c9d..8a3c1323a3b371 100644
--- a/deps/v8/test/cctest/test-weaksets.cc
+++ b/deps/v8/test/cctest/test-weaksets.cc
@@ -31,6 +31,8 @@
 #include "src/heap/factory.h"
 #include "src/isolate.h"
 #include "src/objects-inl.h"
+#include "src/objects/hash-table-inl.h"
+#include "src/objects/js-collection-inl.h"
 #include "test/cctest/cctest.h"
 #include "test/cctest/heap/heap-utils.h"
 
@@ -47,11 +49,11 @@ static Handle<JSWeakSet> AllocateJSWeakSet(Isolate* isolate) {
   Factory* factory = isolate->factory();
   Handle<Map> map = factory->NewMap(JS_WEAK_SET_TYPE, JSWeakSet::kSize);
   Handle<JSObject> weakset_obj = factory->NewJSObjectFromMap(map);
-  Handle<JSWeakSet> weakset(JSWeakSet::cast(*weakset_obj));
+  Handle<JSWeakSet> weakset(JSWeakSet::cast(*weakset_obj), isolate);
   // Do not leak handles for the hash table, it would make entries strong.
   {
     HandleScope scope(isolate);
-    Handle<ObjectHashTable> table = ObjectHashTable::New(isolate, 1);
+    Handle<EphemeronHashTable> table = EphemeronHashTable::New(isolate, 1);
     weakset->set_table(*table);
   }
   return weakset;
@@ -94,14 +96,14 @@ TEST(WeakSet_Weakness) {
     int32_t hash = key->GetOrCreateHash(isolate)->value();
     JSWeakCollection::Set(weakset, key, smi, hash);
   }
-  CHECK_EQ(1, ObjectHashTable::cast(weakset->table())->NumberOfElements());
+  CHECK_EQ(1, EphemeronHashTable::cast(weakset->table())->NumberOfElements());
 
   // Force a full GC.
   CcTest::CollectAllGarbage(Heap::kAbortIncrementalMarkingMask);
   CHECK_EQ(0, NumberOfWeakCalls);
-  CHECK_EQ(1, ObjectHashTable::cast(weakset->table())->NumberOfElements());
+  CHECK_EQ(1, EphemeronHashTable::cast(weakset->table())->NumberOfElements());
   CHECK_EQ(
-      0, ObjectHashTable::cast(weakset->table())->NumberOfDeletedElements());
+      0, EphemeronHashTable::cast(weakset->table())->NumberOfDeletedElements());
 
   // Make the global reference to the key weak.
   std::pair<Handle<Object>*, int> handle_and_id(&key, 1234);
@@ -112,9 +114,9 @@ TEST(WeakSet_Weakness) {
 
   CcTest::CollectAllGarbage(Heap::kAbortIncrementalMarkingMask);
   CHECK_EQ(1, NumberOfWeakCalls);
-  CHECK_EQ(0, ObjectHashTable::cast(weakset->table())->NumberOfElements());
+  CHECK_EQ(0, EphemeronHashTable::cast(weakset->table())->NumberOfElements());
   CHECK_EQ(
-      1, ObjectHashTable::cast(weakset->table())->NumberOfDeletedElements());
+      1, EphemeronHashTable::cast(weakset->table())->NumberOfDeletedElements());
 }
 
 
@@ -126,7 +128,7 @@ TEST(WeakSet_Shrinking) {
   Handle<JSWeakSet> weakset = AllocateJSWeakSet(isolate);
 
   // Check initial capacity.
-  CHECK_EQ(32, ObjectHashTable::cast(weakset->table())->Capacity());
+  CHECK_EQ(32, EphemeronHashTable::cast(weakset->table())->Capacity());
 
   // Fill up weak set to trigger capacity change.
   {
@@ -141,19 +143,20 @@ TEST(WeakSet_Shrinking) {
   }
 
   // Check increased capacity.
-  CHECK_EQ(128, ObjectHashTable::cast(weakset->table())->Capacity());
+  CHECK_EQ(128, EphemeronHashTable::cast(weakset->table())->Capacity());
 
   // Force a full GC.
-  CHECK_EQ(32, ObjectHashTable::cast(weakset->table())->NumberOfElements());
+  CHECK_EQ(32, EphemeronHashTable::cast(weakset->table())->NumberOfElements());
   CHECK_EQ(
-      0, ObjectHashTable::cast(weakset->table())->NumberOfDeletedElements());
+      0, EphemeronHashTable::cast(weakset->table())->NumberOfDeletedElements());
   CcTest::CollectAllGarbage(Heap::kAbortIncrementalMarkingMask);
-  CHECK_EQ(0, ObjectHashTable::cast(weakset->table())->NumberOfElements());
+  CHECK_EQ(0, EphemeronHashTable::cast(weakset->table())->NumberOfElements());
   CHECK_EQ(
-      32, ObjectHashTable::cast(weakset->table())->NumberOfDeletedElements());
+      32,
+      EphemeronHashTable::cast(weakset->table())->NumberOfDeletedElements());
 
   // Check shrunk capacity.
-  CHECK_EQ(32, ObjectHashTable::cast(weakset->table())->Capacity());
+  CHECK_EQ(32, EphemeronHashTable::cast(weakset->table())->Capacity());
 }
 
 
@@ -173,7 +176,7 @@ TEST(WeakSet_Regress2060a) {
   Handle<JSWeakSet> weakset = AllocateJSWeakSet(isolate);
 
   // Start second old-space page so that values land on evacuation candidate.
-  Page* first_page = heap->old_space()->anchor()->next_page();
+  Page* first_page = heap->old_space()->first_page();
   heap::SimulateFullSpace(heap->old_space());
 
   // Fill up weak set with values on an evacuation candidate.
@@ -181,7 +184,7 @@ TEST(WeakSet_Regress2060a) {
     HandleScope scope(isolate);
     for (int i = 0; i < 32; i++) {
       Handle<JSObject> object = factory->NewJSObject(function, TENURED);
-      CHECK(!heap->InNewSpace(*object));
+      CHECK(!Heap::InNewSpace(*object));
       CHECK(!first_page->Contains(object->address()));
       int32_t hash = key->GetOrCreateHash(isolate)->value();
       JSWeakCollection::Set(weakset, key, object, hash);
@@ -212,14 +215,14 @@ TEST(WeakSet_Regress2060b) {
       factory->NewFunctionForTest(factory->function_string());
 
   // Start second old-space page so that keys land on evacuation candidate.
-  Page* first_page = heap->old_space()->anchor()->next_page();
+  Page* first_page = heap->old_space()->first_page();
   heap::SimulateFullSpace(heap->old_space());
 
   // Fill up weak set with keys on an evacuation candidate.
   Handle<JSObject> keys[32];
   for (int i = 0; i < 32; i++) {
     keys[i] = factory->NewJSObject(function, TENURED);
-    CHECK(!heap->InNewSpace(*keys[i]));
+    CHECK(!Heap::InNewSpace(*keys[i]));
     CHECK(!first_page->Contains(keys[i]->address()));
   }
   Handle<JSWeakSet> weakset = AllocateJSWeakSet(isolate);
diff --git a/deps/v8/test/cctest/torque/test-torque.cc b/deps/v8/test/cctest/torque/test-torque.cc
new file mode 100644
index 00000000000000..eb2e0c48cf5e33
--- /dev/null
+++ b/deps/v8/test/cctest/torque/test-torque.cc
@@ -0,0 +1,205 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include <cmath>
+
+#include "src/api.h"
+#include "src/base/utils/random-number-generator.h"
+#include "src/builtins/builtins-promise-gen.h"
+#include "src/builtins/builtins-string-gen.h"
+#include "src/char-predicates.h"
+#include "src/code-factory.h"
+#include "src/code-stub-assembler.h"
+#include "src/compiler/node.h"
+#include "src/debug/debug.h"
+#include "src/elements-kind.h"
+#include "src/isolate.h"
+#include "src/objects-inl.h"
+#include "src/objects/promise-inl.h"
+#include "test/cctest/compiler/code-assembler-tester.h"
+#include "test/cctest/compiler/function-tester.h"
+#include "torque-generated/builtins-test-from-dsl-gen.h"
+
+namespace v8 {
+namespace internal {
+namespace compiler {
+
+namespace {
+
+typedef CodeAssemblerLabel Label;
+typedef CodeAssemblerVariable Variable;
+
+}  // namespace
+
+TEST(TestConstexpr1) {
+  Isolate* isolate(CcTest::InitIsolateOnce());
+  CodeAssemblerTester asm_tester(isolate, 0);
+  TestBuiltinsFromDSLAssembler m(asm_tester.state());
+  {
+    m.TestConstexpr1();
+    m.Return(m.UndefinedConstant());
+  }
+  FunctionTester ft(asm_tester.GenerateCode(), 0);
+  ft.Call();
+}
+
+TEST(TestConstexprIf) {
+  Isolate* isolate(CcTest::InitIsolateOnce());
+  CodeAssemblerTester asm_tester(isolate, 0);
+  TestBuiltinsFromDSLAssembler m(asm_tester.state());
+  {
+    m.TestConstexprIf();
+    m.Return(m.UndefinedConstant());
+  }
+  FunctionTester ft(asm_tester.GenerateCode(), 0);
+  ft.Call();
+}
+
+TEST(TestConstexprReturn) {
+  Isolate* isolate(CcTest::InitIsolateOnce());
+  CodeAssemblerTester asm_tester(isolate, 0);
+  TestBuiltinsFromDSLAssembler m(asm_tester.state());
+  {
+    m.TestConstexprReturn();
+    m.Return(m.UndefinedConstant());
+  }
+  FunctionTester ft(asm_tester.GenerateCode(), 0);
+  ft.Call();
+}
+
+TEST(TestGotoLabel) {
+  Isolate* isolate(CcTest::InitIsolateOnce());
+  CodeAssemblerTester asm_tester(isolate, 0);
+  TestBuiltinsFromDSLAssembler m(asm_tester.state());
+  { m.Return(m.TestGotoLabel()); }
+  FunctionTester ft(asm_tester.GenerateCode(), 0);
+  ft.CheckCall(ft.true_value());
+}
+
+TEST(TestGotoLabelWithOneParameter) {
+  Isolate* isolate(CcTest::InitIsolateOnce());
+  CodeAssemblerTester asm_tester(isolate, 0);
+  TestBuiltinsFromDSLAssembler m(asm_tester.state());
+  { m.Return(m.TestGotoLabelWithOneParameter()); }
+  FunctionTester ft(asm_tester.GenerateCode(), 0);
+  ft.CheckCall(ft.true_value());
+}
+
+TEST(TestGotoLabelWithTwoParameters) {
+  Isolate* isolate(CcTest::InitIsolateOnce());
+  CodeAssemblerTester asm_tester(isolate, 0);
+  TestBuiltinsFromDSLAssembler m(asm_tester.state());
+  { m.Return(m.TestGotoLabelWithTwoParameters()); }
+  FunctionTester ft(asm_tester.GenerateCode(), 0);
+  ft.CheckCall(ft.true_value());
+}
+
+TEST(TestPartiallyUnusedLabel) {
+  Isolate* isolate(CcTest::InitIsolateOnce());
+  CodeAssemblerTester asm_tester(isolate, 0);
+  TestBuiltinsFromDSLAssembler m(asm_tester.state());
+  { m.Return(m.TestPartiallyUnusedLabel()); }
+  FunctionTester ft(asm_tester.GenerateCode(), 0);
+  ft.CheckCall(ft.true_value());
+}
+
+TEST(TestBuiltinSpecialization) {
+  Isolate* isolate(CcTest::InitIsolateOnce());
+  CodeAssemblerTester asm_tester(isolate, 0);
+  TestBuiltinsFromDSLAssembler m(asm_tester.state());
+  {
+    Node* temp = m.SmiConstant(0);
+    m.TestBuiltinSpecialization(m.UncheckedCast<Context>(temp));
+    m.Return(m.UndefinedConstant());
+  }
+  FunctionTester ft(asm_tester.GenerateCode(), 0);
+  ft.Call();
+}
+
+TEST(TestMacroSpecialization) {
+  Isolate* isolate(CcTest::InitIsolateOnce());
+  CodeAssemblerTester asm_tester(isolate, 0);
+  TestBuiltinsFromDSLAssembler m(asm_tester.state());
+  {
+    m.TestMacroSpecialization();
+    m.Return(m.UndefinedConstant());
+  }
+  FunctionTester ft(asm_tester.GenerateCode(), 0);
+  ft.Call();
+}
+
+TEST(TestFunctionPointers) {
+  Isolate* isolate(CcTest::InitIsolateOnce());
+  const int kNumParams = 0;
+  CodeAssemblerTester asm_tester(isolate, kNumParams);
+  TestBuiltinsFromDSLAssembler m(asm_tester.state());
+  {
+    TNode<Context> context =
+        m.UncheckedCast<Context>(m.Parameter(kNumParams + 2));
+    m.Return(m.TestFunctionPointers(context));
+  }
+  FunctionTester ft(asm_tester.GenerateCode(), kNumParams);
+  ft.CheckCall(ft.true_value());
+}
+
+TEST(TestTernaryOperator) {
+  Isolate* isolate(CcTest::InitIsolateOnce());
+  const int kNumParams = 1;
+  CodeAssemblerTester asm_tester(isolate, kNumParams);
+  TestBuiltinsFromDSLAssembler m(asm_tester.state());
+  {
+    TNode<Smi> arg = m.UncheckedCast<Smi>(m.Parameter(0));
+    m.Return(m.TestTernaryOperator(arg));
+  }
+  FunctionTester ft(asm_tester.GenerateCode(), kNumParams);
+  Handle<Object> result1 =
+      ft.Call(Handle<Smi>(Smi::FromInt(-5), isolate)).ToHandleChecked();
+  CHECK_EQ(-15, Handle<Smi>::cast(result1)->value());
+  Handle<Object> result2 =
+      ft.Call(Handle<Smi>(Smi::FromInt(3), isolate)).ToHandleChecked();
+  CHECK_EQ(103, Handle<Smi>::cast(result2)->value());
+}
+
+TEST(TestFunctionPointerToGeneric) {
+  Isolate* isolate(CcTest::InitIsolateOnce());
+  CodeAssemblerTester asm_tester(isolate, 0);
+  TestBuiltinsFromDSLAssembler m(asm_tester.state());
+  {
+    Node* temp = m.SmiConstant(0);
+    m.TestFunctionPointerToGeneric(m.UncheckedCast<Context>(temp));
+    m.Return(m.UndefinedConstant());
+  }
+  FunctionTester ft(asm_tester.GenerateCode(), 0);
+  ft.Call();
+}
+
+TEST(TestUnsafeCast) {
+  Isolate* isolate(CcTest::InitIsolateOnce());
+  CodeAssemblerTester asm_tester(isolate, 0);
+  TestBuiltinsFromDSLAssembler m(asm_tester.state());
+  {
+    Node* temp = m.SmiConstant(0);
+    Node* n = m.SmiConstant(10);
+    m.Return(m.TestUnsafeCast(m.UncheckedCast<Context>(temp),
+                              m.UncheckedCast<Number>(n)));
+  }
+  FunctionTester ft(asm_tester.GenerateCode(), 0);
+  ft.CheckCall(ft.true_value());
+}
+
+TEST(TestHexLiteral) {
+  Isolate* isolate(CcTest::InitIsolateOnce());
+  CodeAssemblerTester asm_tester(isolate, 0);
+  TestBuiltinsFromDSLAssembler m(asm_tester.state());
+  {
+    m.TestHexLiteral();
+    m.Return(m.UndefinedConstant());
+  }
+  FunctionTester ft(asm_tester.GenerateCode(), 0);
+  ft.Call();
+}
+
+}  // namespace compiler
+}  // namespace internal
+}  // namespace v8
diff --git a/deps/v8/test/cctest/trace-extension.cc b/deps/v8/test/cctest/trace-extension.cc
index 00f99461805987..cb44ebde7a41bf 100644
--- a/deps/v8/test/cctest/trace-extension.cc
+++ b/deps/v8/test/cctest/trace-extension.cc
@@ -78,13 +78,18 @@ Address TraceExtension::GetFP(const v8::FunctionCallbackInfo<v8::Value>& args) {
 #if defined(V8_HOST_ARCH_32_BIT)
   Address fp = *reinterpret_cast<Address*>(*args[0]);
 #elif defined(V8_HOST_ARCH_64_BIT)
-  int64_t low_bits = *reinterpret_cast<uint64_t*>(*args[0]) >> 32;
-  int64_t high_bits = *reinterpret_cast<uint64_t*>(*args[1]);
-  Address fp = reinterpret_cast<Address>(high_bits | low_bits);
+  uint64_t kSmiValueMask =
+      (static_cast<uintptr_t>(1) << (kSmiValueSize - 1)) - 1;
+  uint64_t low_bits =
+      (*reinterpret_cast<Smi**>(*args[0]))->value() & kSmiValueMask;
+  uint64_t high_bits =
+      (*reinterpret_cast<Smi**>(*args[1]))->value() & kSmiValueMask;
+  Address fp =
+      static_cast<Address>((high_bits << (kSmiValueSize - 1)) | low_bits);
 #else
 #error Host architecture is neither 32-bit nor 64-bit.
 #endif
-  printf("Trace: %p\n", static_cast<void*>(fp));
+  printf("Trace: %p\n", reinterpret_cast<void*>(fp));
   return fp;
 }
 
@@ -97,10 +102,10 @@ void TraceExtension::InitTraceEnv(v8::TickSample* sample) {
 
 void TraceExtension::DoTrace(Address fp) {
   RegisterState regs;
-  regs.fp = fp;
+  regs.fp = reinterpret_cast<void*>(fp);
   // sp is only used to define stack high bound
-  regs.sp =
-      reinterpret_cast<Address>(trace_env.sample) - 10240;
+  regs.sp = reinterpret_cast<void*>(
+      reinterpret_cast<Address>(trace_env.sample) - 10240);
   trace_env.sample->Init(CcTest::isolate(), regs,
                          v8::TickSample::kSkipCEntryFrame, true);
 }
@@ -109,8 +114,7 @@ void TraceExtension::DoTrace(Address fp) {
 void TraceExtension::Trace(const v8::FunctionCallbackInfo<v8::Value>& args) {
   i::Isolate* isolate = reinterpret_cast<i::Isolate*>(args.GetIsolate());
   i::VMState<EXTERNAL> state(isolate);
-  Address address = reinterpret_cast<Address>(
-      reinterpret_cast<intptr_t>(&TraceExtension::Trace));
+  Address address = reinterpret_cast<Address>(&TraceExtension::Trace);
   i::ExternalCallbackScope call_scope(isolate, address);
   DoTrace(GetFP(args));
 }
@@ -131,8 +135,7 @@ static void DoTraceHideCEntryFPAddress(Address fp) {
 void TraceExtension::JSTrace(const v8::FunctionCallbackInfo<v8::Value>& args) {
   i::Isolate* isolate = reinterpret_cast<i::Isolate*>(args.GetIsolate());
   i::VMState<EXTERNAL> state(isolate);
-  Address address = reinterpret_cast<Address>(
-      reinterpret_cast<intptr_t>(&TraceExtension::JSTrace));
+  Address address = reinterpret_cast<Address>(&TraceExtension::JSTrace);
   i::ExternalCallbackScope call_scope(isolate, address);
   DoTraceHideCEntryFPAddress(GetFP(args));
 }
diff --git a/deps/v8/test/cctest/types-fuzz.h b/deps/v8/test/cctest/types-fuzz.h
index 007f11fba3a2c2..db264db42c0b0e 100644
--- a/deps/v8/test/cctest/types-fuzz.h
+++ b/deps/v8/test/cctest/types-fuzz.h
@@ -40,7 +40,7 @@ namespace compiler {
 class Types {
  public:
   Types(Zone* zone, Isolate* isolate, v8::base::RandomNumberGenerator* rng)
-      : zone_(zone), rng_(rng) {
+      : zone_(zone), js_heap_broker_(isolate), rng_(rng) {
 #define DECLARE_TYPE(name, value) \
   name = Type::name();            \
   types.push_back(name);
@@ -65,13 +65,14 @@ class Types {
     object2 = isolate->factory()->NewJSObjectFromMap(object_map);
     array = isolate->factory()->NewJSArray(20);
     uninitialized = isolate->factory()->uninitialized_value();
-    SmiConstant = Type::NewConstant(smi, zone);
-    Signed32Constant = Type::NewConstant(signed32, zone);
+    SmiConstant = Type::NewConstant(js_heap_broker(), smi, zone);
+    Signed32Constant = Type::NewConstant(js_heap_broker(), signed32, zone);
 
-    ObjectConstant1 = Type::HeapConstant(object1, zone);
-    ObjectConstant2 = Type::HeapConstant(object2, zone);
-    ArrayConstant = Type::HeapConstant(array, zone);
-    UninitializedConstant = Type::HeapConstant(uninitialized, zone);
+    ObjectConstant1 = Type::HeapConstant(js_heap_broker(), object1, zone);
+    ObjectConstant2 = Type::HeapConstant(js_heap_broker(), object2, zone);
+    ArrayConstant = Type::HeapConstant(js_heap_broker(), array, zone);
+    UninitializedConstant =
+        Type::HeapConstant(js_heap_broker(), uninitialized, zone);
 
     values.push_back(smi);
     values.push_back(boxed_smi);
@@ -84,7 +85,7 @@ class Types {
     values.push_back(float2);
     values.push_back(float3);
     for (ValueVector::iterator it = values.begin(); it != values.end(); ++it) {
-      types.push_back(Type::NewConstant(*it, zone));
+      types.push_back(Type::NewConstant(js_heap_broker(), *it, zone));
     }
 
     integers.push_back(isolate->factory()->NewNumber(-V8_INFINITY));
@@ -118,68 +119,64 @@ class Types {
   Handle<i::JSArray> array;
   Handle<i::Oddball> uninitialized;
 
-#define DECLARE_TYPE(name, value) Type* name;
+#define DECLARE_TYPE(name, value) Type name;
   PROPER_BITSET_TYPE_LIST(DECLARE_TYPE)
-  #undef DECLARE_TYPE
+#undef DECLARE_TYPE
 
-  Type* SignedSmall;
-  Type* UnsignedSmall;
+  Type SignedSmall;
+  Type UnsignedSmall;
 
-  Type* SmiConstant;
-  Type* Signed32Constant;
-  Type* ObjectConstant1;
-  Type* ObjectConstant2;
-  Type* ArrayConstant;
-  Type* UninitializedConstant;
+  Type SmiConstant;
+  Type Signed32Constant;
+  Type ObjectConstant1;
+  Type ObjectConstant2;
+  Type ArrayConstant;
+  Type UninitializedConstant;
 
-  Type* Integer;
+  Type Integer;
 
-  typedef std::vector<Type*> TypeVector;
+  typedef std::vector<Type> TypeVector;
   typedef std::vector<Handle<i::Object> > ValueVector;
 
   TypeVector types;
   ValueVector values;
   ValueVector integers;  // "Integer" values used for range limits.
 
-  Type* Of(Handle<i::Object> value) { return Type::Of(value, zone_); }
-
-  Type* NewConstant(Handle<i::Object> value) {
-    return Type::NewConstant(value, zone_);
+  Type NewConstant(Handle<i::Object> value) {
+    return Type::NewConstant(js_heap_broker(), value, zone_);
   }
 
-  Type* HeapConstant(Handle<i::HeapObject> value) {
-    return Type::HeapConstant(value, zone_);
+  Type HeapConstant(Handle<i::HeapObject> value) {
+    return Type::HeapConstant(js_heap_broker(), value, zone_);
   }
 
-  Type* Range(double min, double max) { return Type::Range(min, max, zone_); }
+  Type Range(double min, double max) { return Type::Range(min, max, zone_); }
 
-  Type* Union(Type* t1, Type* t2) { return Type::Union(t1, t2, zone_); }
+  Type Union(Type t1, Type t2) { return Type::Union(t1, t2, zone_); }
 
-  Type* Intersect(Type* t1, Type* t2) { return Type::Intersect(t1, t2, zone_); }
+  Type Intersect(Type t1, Type t2) { return Type::Intersect(t1, t2, zone_); }
 
-  Type* Random() {
-    return types[rng_->NextInt(static_cast<int>(types.size()))];
-  }
+  Type Random() { return types[rng_->NextInt(static_cast<int>(types.size()))]; }
 
-  Type* Fuzz(int depth = 4) {
+  Type Fuzz(int depth = 4) {
     switch (rng_->NextInt(depth == 0 ? 3 : 20)) {
       case 0: {  // bitset
         #define COUNT_BITSET_TYPES(type, value) + 1
         int n = 0 PROPER_BITSET_TYPE_LIST(COUNT_BITSET_TYPES);
         #undef COUNT_BITSET_TYPES
         // Pick a bunch of named bitsets and return their intersection.
-        Type* result = Type::Any();
+        Type result = Type::Any();
         for (int i = 0, m = 1 + rng_->NextInt(3); i < m; ++i) {
           int j = rng_->NextInt(n);
-#define PICK_BITSET_TYPE(type, value)                         \
-  if (j-- == 0) {                                             \
-    Type* tmp = Type::Intersect(result, Type::type(), zone_); \
-    if (tmp->Is(Type::None()) && i != 0) {                    \
-      break;                                                  \
-    } else {                                                  \
-      result = tmp;                                           \
-      continue;                                               \
-    }                                                         \
+#define PICK_BITSET_TYPE(type, value)                        \
+  if (j-- == 0) {                                            \
+    Type tmp = Type::Intersect(result, Type::type(), zone_); \
+    if (tmp.Is(Type::None()) && i != 0) {                    \
+      break;                                                 \
+    } else {                                                 \
+      result = tmp;                                          \
+      continue;                                              \
+    }                                                        \
   }
           PROPER_BITSET_TYPE_LIST(PICK_BITSET_TYPE)
           #undef PICK_BITSET_TYPE
@@ -188,7 +185,7 @@ class Types {
       }
       case 1: {  // constant
         int i = rng_->NextInt(static_cast<int>(values.size()));
-        return Type::NewConstant(values[i], zone_);
+        return Type::NewConstant(js_heap_broker(), values[i], zone_);
       }
       case 2: {  // range
         int i = rng_->NextInt(static_cast<int>(integers.size()));
@@ -200,9 +197,9 @@ class Types {
       }
       default: {  // union
         int n = rng_->NextInt(10);
-        Type* type = None;
+        Type type = None;
         for (int i = 0; i < n; ++i) {
-          Type* operand = Fuzz(depth - 1);
+          Type operand = Fuzz(depth - 1);
           type = Type::Union(type, operand, zone_);
         }
         return type;
@@ -212,9 +209,11 @@ class Types {
   }
 
   Zone* zone() { return zone_; }
+  const JSHeapBroker* js_heap_broker() const { return &js_heap_broker_; }
 
  private:
   Zone* zone_;
+  JSHeapBroker js_heap_broker_;
   v8::base::RandomNumberGenerator* rng_;
 };
 
diff --git a/deps/v8/test/cctest/wasm/test-c-wasm-entry.cc b/deps/v8/test/cctest/wasm/test-c-wasm-entry.cc
index 455f14eb6accaa..23a0c3369beede 100644
--- a/deps/v8/test/cctest/wasm/test-c-wasm-entry.cc
+++ b/deps/v8/test/cctest/wasm/test-c-wasm-entry.cc
@@ -44,19 +44,19 @@ class CWasmEntryArgTester {
   }
 
   template <typename... Rest>
-  void WriteToBuffer(uint8_t* buf, Rest... rest) {
+  void WriteToBuffer(Address buf, Rest... rest) {
     static_assert(sizeof...(rest) == 0, "this is the base case");
   }
 
   template <typename First, typename... Rest>
-  void WriteToBuffer(uint8_t* buf, First first, Rest... rest) {
+  void WriteToBuffer(Address buf, First first, Rest... rest) {
     WriteUnalignedValue(buf, first);
     WriteToBuffer(buf + sizeof(first), rest...);
   }
 
   void CheckCall(Args... args) {
     std::vector<uint8_t> arg_buffer(sizeof...(args) * 8);
-    WriteToBuffer(arg_buffer.data(), args...);
+    WriteToBuffer(reinterpret_cast<Address>(arg_buffer.data()), args...);
 
     Handle<Object> receiver = isolate_->factory()->undefined_value();
     Handle<Object> buffer_obj(reinterpret_cast<Object*>(arg_buffer.data()),
@@ -64,11 +64,8 @@ class CWasmEntryArgTester {
     CHECK(!buffer_obj->IsHeapObject());
     Handle<Object> call_args[]{
         Handle<Object>::cast(isolate_->factory()->NewForeign(
-            wasm_code_->instructions().start(), TENURED)),
-        handle(
-            wasm_code_->native_module()->compiled_module()->owning_instance(),
-            isolate_),
-        buffer_obj};
+            wasm_code_->instruction_start(), TENURED)),
+        runner_.builder().instance_object(), buffer_obj};
     static_assert(
         arraysize(call_args) == compiler::CWasmEntryParameters::kNumParameters,
         "adapt this test");
@@ -80,7 +77,8 @@ class CWasmEntryArgTester {
     CHECK_EQ(0, Smi::ToInt(*return_obj.ToHandleChecked()));
 
     // Check the result.
-    ReturnType result = ReadUnalignedValue<ReturnType>(arg_buffer.data());
+    ReturnType result = ReadUnalignedValue<ReturnType>(
+        reinterpret_cast<Address>(arg_buffer.data()));
     ReturnType expected = expected_fn_(args...);
     if (std::is_floating_point<ReturnType>::value) {
       CHECK_DOUBLE_EQ(expected, result);
diff --git a/deps/v8/test/cctest/wasm/test-run-wasm-64.cc b/deps/v8/test/cctest/wasm/test-run-wasm-64.cc
index 6b25b7a27619ac..157dd519b1da72 100644
--- a/deps/v8/test/cctest/wasm/test-run-wasm-64.cc
+++ b/deps/v8/test/cctest/wasm/test-run-wasm-64.cc
@@ -1184,7 +1184,7 @@ WASM_EXEC_TEST(LoadStoreI64_sx) {
 
   for (size_t m = 0; m < arraysize(loads); m++) {
     WasmRunner<int64_t> r(execution_mode);
-    byte* memory = r.builder().AddMemoryElems<byte>(16);
+    byte* memory = r.builder().AddMemoryElems<byte>(kWasmPageSize);
 
     byte code[] = {
         kExprI32Const,    8,  // --
@@ -1223,7 +1223,8 @@ WASM_EXEC_TEST(LoadStoreI64_sx) {
 
 WASM_EXEC_TEST(I64ReinterpretF64) {
   WasmRunner<int64_t> r(execution_mode);
-  int64_t* memory = r.builder().AddMemoryElems<int64_t>(8);
+  int64_t* memory =
+      r.builder().AddMemoryElems<int64_t>(kWasmPageSize / sizeof(int64_t));
 
   BUILD(r, WASM_I64_REINTERPRET_F64(
                WASM_LOAD_MEM(MachineType::Float64(), WASM_ZERO)));
@@ -1246,7 +1247,8 @@ WASM_EXEC_TEST(SignallingNanSurvivesI64ReinterpretF64) {
 
 WASM_EXEC_TEST(F64ReinterpretI64) {
   WasmRunner<int64_t, int64_t> r(execution_mode);
-  int64_t* memory = r.builder().AddMemoryElems<int64_t>(8);
+  int64_t* memory =
+      r.builder().AddMemoryElems<int64_t>(kWasmPageSize / sizeof(int64_t));
 
   BUILD(r, WASM_STORE_MEM(MachineType::Float64(), WASM_ZERO,
                           WASM_F64_REINTERPRET_I64(WASM_GET_LOCAL(0))),
@@ -1261,7 +1263,8 @@ WASM_EXEC_TEST(F64ReinterpretI64) {
 
 WASM_EXEC_TEST(LoadMemI64) {
   WasmRunner<int64_t> r(execution_mode);
-  int64_t* memory = r.builder().AddMemoryElems<int64_t>(8);
+  int64_t* memory =
+      r.builder().AddMemoryElems<int64_t>(kWasmPageSize / sizeof(int64_t));
   r.builder().RandomizeMemory(1111);
 
   BUILD(r, WASM_LOAD_MEM(MachineType::Int64(), WASM_ZERO));
@@ -1279,7 +1282,8 @@ WASM_EXEC_TEST(LoadMemI64) {
 WASM_EXEC_TEST(LoadMemI64_alignment) {
   for (byte alignment = 0; alignment <= 3; alignment++) {
     WasmRunner<int64_t> r(execution_mode);
-    int64_t* memory = r.builder().AddMemoryElems<int64_t>(8);
+    int64_t* memory =
+        r.builder().AddMemoryElems<int64_t>(kWasmPageSize / sizeof(int64_t));
     r.builder().RandomizeMemory(1111);
 
     BUILD(r,
@@ -1299,7 +1303,8 @@ WASM_EXEC_TEST(LoadMemI64_alignment) {
 WASM_EXEC_TEST(MemI64_Sum) {
   const int kNumElems = 20;
   WasmRunner<uint64_t, int32_t> r(execution_mode);
-  uint64_t* memory = r.builder().AddMemoryElems<uint64_t>(kNumElems);
+  uint64_t* memory =
+      r.builder().AddMemoryElems<uint64_t>(kWasmPageSize / sizeof(uint64_t));
   const byte kSum = r.AllocateLocal(kWasmI64);
 
   BUILD(r, WASM_WHILE(
@@ -1330,7 +1335,8 @@ WASM_EXEC_TEST(StoreMemI64_alignment) {
 
   for (byte i = 0; i <= 3; i++) {
     WasmRunner<int64_t, int64_t> r(execution_mode);
-    int64_t* memory = r.builder().AddMemoryElems<int64_t>(4);
+    int64_t* memory =
+        r.builder().AddMemoryElems<int64_t>(kWasmPageSize / sizeof(int64_t));
     BUILD(r, WASM_STORE_MEM_ALIGNMENT(MachineType::Int64(), WASM_ZERO, i,
                                       WASM_GET_LOCAL(0)),
           WASM_GET_LOCAL(0));
@@ -1411,7 +1417,7 @@ WASM_EXEC_TEST(StoreMem_offset_oob_i64) {
                                    WASM_LOAD_MEM(machineTypes[m], WASM_ZERO)),
           WASM_ZERO);
 
-    byte memsize = WasmOpcodes::MemSize(machineTypes[m]);
+    byte memsize = ValueTypes::MemSize(machineTypes[m]);
     uint32_t boundary = num_bytes - 8 - memsize;
     CHECK_EQ(0, r.Call(boundary));  // in bounds.
     CHECK_EQ(0, memcmp(&memory[0], &memory[8 + boundary], memsize));
@@ -1431,7 +1437,7 @@ WASM_EXEC_TEST(Store_i64_narrowed) {
     constexpr int kBytes = 24;
     uint8_t expected_memory[kBytes] = {0};
     WasmRunner<int32_t, int32_t, int64_t> r(execution_mode);
-    uint8_t* memory = r.builder().AddMemoryElems<uint8_t>(kBytes);
+    uint8_t* memory = r.builder().AddMemoryElems<uint8_t>(kWasmPageSize);
     constexpr uint64_t kPattern = 0x0123456789abcdef;
 
     BUILD(r, WASM_GET_LOCAL(0),                 // index
@@ -1454,14 +1460,14 @@ WASM_EXEC_TEST(Store_i64_narrowed) {
 
 WASM_EXEC_TEST(UnalignedInt64Load) {
   WasmRunner<uint64_t> r(execution_mode);
-  r.builder().AddMemoryElems<int64_t>(8);
+  r.builder().AddMemoryElems<int64_t>(kWasmPageSize / sizeof(int64_t));
   BUILD(r, WASM_LOAD_MEM_ALIGNMENT(MachineType::Int64(), WASM_ONE, 3));
   r.Call();
 }
 
 WASM_EXEC_TEST(UnalignedInt64Store) {
   WasmRunner<int32_t> r(execution_mode);
-  r.builder().AddMemoryElems<uint64_t>(8);
+  r.builder().AddMemoryElems<uint64_t>(kWasmPageSize / sizeof(int64_t));
   BUILD(r, WASM_SEQ(WASM_STORE_MEM_ALIGNMENT(MachineType::Int64(), WASM_ONE, 3,
                                              WASM_I64V_1(1)),
                     WASM_I32V_1(12)));
@@ -1520,7 +1526,7 @@ static void Run_WasmMixedCall_N(WasmExecutionMode execution_mode, int start) {
     v8::internal::AccountingAllocator allocator;
     Zone zone(&allocator, ZONE_NAME);
     WasmRunner<int32_t> r(execution_mode);
-    r.builder().AddMemory(1024);
+    r.builder().AddMemory(kWasmPageSize);
     MachineType* memtypes = &mixed[start];
     MachineType result = memtypes[which];
 
@@ -1528,9 +1534,9 @@ static void Run_WasmMixedCall_N(WasmExecutionMode execution_mode, int start) {
     // Build the selector function.
     // =========================================================================
     FunctionSig::Builder b(&zone, 1, num_params);
-    b.AddReturn(WasmOpcodes::ValueTypeFor(result));
+    b.AddReturn(ValueTypes::ValueTypeFor(result));
     for (int i = 0; i < num_params; i++) {
-      b.AddParam(WasmOpcodes::ValueTypeFor(memtypes[i]));
+      b.AddParam(ValueTypes::ValueTypeFor(memtypes[i]));
     }
     WasmFunctionCompiler& t = r.NewFunction(b.Build());
     BUILD(t, WASM_GET_LOCAL(which));
@@ -1550,7 +1556,7 @@ static void Run_WasmMixedCall_N(WasmExecutionMode execution_mode, int start) {
     ADD_CODE(code, WASM_CALL_FUNCTION0(t.function_index()));
 
     // Store the result in a local.
-    byte local_index = r.AllocateLocal(WasmOpcodes::ValueTypeFor(result));
+    byte local_index = r.AllocateLocal(ValueTypes::ValueTypeFor(result));
     ADD_CODE(code, kExprSetLocal, local_index);
 
     // Store the result in memory.
@@ -1567,7 +1573,7 @@ static void Run_WasmMixedCall_N(WasmExecutionMode execution_mode, int start) {
       r.builder().RandomizeMemory();
       CHECK_EQ(kExpected, r.Call());
 
-      int size = WasmOpcodes::MemSize(result);
+      int size = ValueTypes::MemSize(result);
       for (int i = 0; i < size; i++) {
         int base = (which + 1) * kElemSize;
         byte expected = r.builder().raw_mem_at<byte>(base + i);
@@ -1585,7 +1591,7 @@ WASM_EXEC_TEST(MixedCall_i64_3) { Run_WasmMixedCall_N(execution_mode, 3); }
 
 WASM_EXEC_TEST(Regress5874) {
   WasmRunner<int32_t> r(execution_mode);
-  r.builder().AddMemoryElems<int64_t>(8);
+  r.builder().AddMemoryElems<int64_t>(kWasmPageSize / sizeof(int64_t));
 
   BUILD(r, kExprI64Const, 0x00,        // --
         kExprI32ConvertI64,            // --
diff --git a/deps/v8/test/cctest/wasm/test-run-wasm-atomics.cc b/deps/v8/test/cctest/wasm/test-run-wasm-atomics.cc
index eac90790452da4..ecc38c00b8130a 100644
--- a/deps/v8/test/cctest/wasm/test-run-wasm-atomics.cc
+++ b/deps/v8/test/cctest/wasm/test-run-wasm-atomics.cc
@@ -14,7 +14,8 @@ void RunU32BinOp(WasmExecutionMode execution_mode, WasmOpcode wasm_op,
                  Uint32BinOp expected_op) {
   EXPERIMENTAL_FLAG_SCOPE(threads);
   WasmRunner<uint32_t, uint32_t> r(execution_mode);
-  uint32_t* memory = r.builder().AddMemoryElems<uint32_t>(8);
+  uint32_t* memory =
+      r.builder().AddMemoryElems<uint32_t>(kWasmPageSize / sizeof(uint32_t));
   r.builder().SetHasSharedMemory();
 
   BUILD(r, WASM_ATOMICS_BINOP(wasm_op, WASM_I32V_1(0), WASM_GET_LOCAL(0),
@@ -55,7 +56,8 @@ void RunU16BinOp(WasmExecutionMode mode, WasmOpcode wasm_op,
   EXPERIMENTAL_FLAG_SCOPE(threads);
   WasmRunner<uint32_t, uint32_t> r(mode);
   r.builder().SetHasSharedMemory();
-  uint16_t* memory = r.builder().AddMemoryElems<uint16_t>(8);
+  uint16_t* memory =
+      r.builder().AddMemoryElems<uint16_t>(kWasmPageSize / sizeof(uint16_t));
 
   BUILD(r, WASM_ATOMICS_BINOP(wasm_op, WASM_I32V_1(0), WASM_GET_LOCAL(0),
                               MachineRepresentation::kWord16));
@@ -95,7 +97,7 @@ void RunU8BinOp(WasmExecutionMode execution_mode, WasmOpcode wasm_op,
   EXPERIMENTAL_FLAG_SCOPE(threads);
   WasmRunner<uint32_t, uint32_t> r(execution_mode);
   r.builder().SetHasSharedMemory();
-  uint8_t* memory = r.builder().AddMemoryElems<uint8_t>(8);
+  uint8_t* memory = r.builder().AddMemoryElems<uint8_t>(kWasmPageSize);
 
   BUILD(r, WASM_ATOMICS_BINOP(wasm_op, WASM_I32V_1(0), WASM_GET_LOCAL(0),
                               MachineRepresentation::kWord8));
@@ -130,11 +132,12 @@ WASM_EXEC_TEST(I32AtomicExchange8U) {
   RunU8BinOp(execution_mode, kExprI32AtomicExchange8U, Exchange);
 }
 
-WASM_COMPILED_EXEC_TEST(I32AtomicCompareExchange) {
+WASM_EXEC_TEST(I32AtomicCompareExchange) {
   EXPERIMENTAL_FLAG_SCOPE(threads);
   WasmRunner<uint32_t, uint32_t, uint32_t> r(execution_mode);
   r.builder().SetHasSharedMemory();
-  uint32_t* memory = r.builder().AddMemoryElems<uint32_t>(8);
+  uint32_t* memory =
+      r.builder().AddMemoryElems<uint32_t>(kWasmPageSize / sizeof(uint32_t));
   BUILD(r, WASM_ATOMICS_TERNARY_OP(
                kExprI32AtomicCompareExchange, WASM_I32V_1(0), WASM_GET_LOCAL(0),
                WASM_GET_LOCAL(1), MachineRepresentation::kWord32));
@@ -150,11 +153,12 @@ WASM_COMPILED_EXEC_TEST(I32AtomicCompareExchange) {
   }
 }
 
-WASM_COMPILED_EXEC_TEST(I32AtomicCompareExchange16U) {
+WASM_EXEC_TEST(I32AtomicCompareExchange16U) {
   EXPERIMENTAL_FLAG_SCOPE(threads);
   WasmRunner<uint32_t, uint32_t, uint32_t> r(execution_mode);
   r.builder().SetHasSharedMemory();
-  uint16_t* memory = r.builder().AddMemoryElems<uint16_t>(8);
+  uint16_t* memory =
+      r.builder().AddMemoryElems<uint16_t>(kWasmPageSize / sizeof(uint16_t));
   BUILD(r, WASM_ATOMICS_TERNARY_OP(kExprI32AtomicCompareExchange16U,
                                    WASM_I32V_1(0), WASM_GET_LOCAL(0),
                                    WASM_GET_LOCAL(1),
@@ -171,11 +175,11 @@ WASM_COMPILED_EXEC_TEST(I32AtomicCompareExchange16U) {
   }
 }
 
-WASM_COMPILED_EXEC_TEST(I32AtomicCompareExchange8U) {
+WASM_EXEC_TEST(I32AtomicCompareExchange8U) {
   EXPERIMENTAL_FLAG_SCOPE(threads);
   WasmRunner<uint32_t, uint32_t, uint32_t> r(execution_mode);
   r.builder().SetHasSharedMemory();
-  uint8_t* memory = r.builder().AddMemoryElems<uint8_t>(8);
+  uint8_t* memory = r.builder().AddMemoryElems<uint8_t>(kWasmPageSize);
   BUILD(r,
         WASM_ATOMICS_TERNARY_OP(kExprI32AtomicCompareExchange8U, WASM_I32V_1(0),
                                 WASM_GET_LOCAL(0), WASM_GET_LOCAL(1),
@@ -196,7 +200,8 @@ WASM_EXEC_TEST(I32AtomicLoad) {
   EXPERIMENTAL_FLAG_SCOPE(threads);
   WasmRunner<uint32_t> r(execution_mode);
   r.builder().SetHasSharedMemory();
-  uint32_t* memory = r.builder().AddMemoryElems<uint32_t>(8);
+  uint32_t* memory =
+      r.builder().AddMemoryElems<uint32_t>(kWasmPageSize / sizeof(uint32_t));
   BUILD(r, WASM_ATOMICS_LOAD_OP(kExprI32AtomicLoad, WASM_ZERO,
                                 MachineRepresentation::kWord32));
 
@@ -211,7 +216,8 @@ WASM_EXEC_TEST(I32AtomicLoad16U) {
   EXPERIMENTAL_FLAG_SCOPE(threads);
   WasmRunner<uint32_t> r(execution_mode);
   r.builder().SetHasSharedMemory();
-  uint16_t* memory = r.builder().AddMemoryElems<uint16_t>(8);
+  uint16_t* memory =
+      r.builder().AddMemoryElems<uint16_t>(kWasmPageSize / sizeof(uint16_t));
   BUILD(r, WASM_ATOMICS_LOAD_OP(kExprI32AtomicLoad16U, WASM_ZERO,
                                 MachineRepresentation::kWord16));
 
@@ -226,7 +232,7 @@ WASM_EXEC_TEST(I32AtomicLoad8U) {
   EXPERIMENTAL_FLAG_SCOPE(threads);
   WasmRunner<uint32_t> r(execution_mode);
   r.builder().SetHasSharedMemory();
-  uint8_t* memory = r.builder().AddMemoryElems<uint8_t>(8);
+  uint8_t* memory = r.builder().AddMemoryElems<uint8_t>(kWasmPageSize);
   BUILD(r, WASM_ATOMICS_LOAD_OP(kExprI32AtomicLoad8U, WASM_ZERO,
                                 MachineRepresentation::kWord8));
 
@@ -241,7 +247,8 @@ WASM_EXEC_TEST(I32AtomicStoreLoad) {
   EXPERIMENTAL_FLAG_SCOPE(threads);
   WasmRunner<uint32_t, uint32_t> r(execution_mode);
   r.builder().SetHasSharedMemory();
-  uint32_t* memory = r.builder().AddMemoryElems<uint32_t>(8);
+  uint32_t* memory =
+      r.builder().AddMemoryElems<uint32_t>(kWasmPageSize / sizeof(uint32_t));
 
   BUILD(r,
         WASM_ATOMICS_STORE_OP(kExprI32AtomicStore, WASM_ZERO, WASM_GET_LOCAL(0),
@@ -260,7 +267,8 @@ WASM_EXEC_TEST(I32AtomicStoreLoad16U) {
   EXPERIMENTAL_FLAG_SCOPE(threads);
   WasmRunner<uint32_t, uint32_t> r(execution_mode);
   r.builder().SetHasSharedMemory();
-  uint16_t* memory = r.builder().AddMemoryElems<uint16_t>(8);
+  uint16_t* memory =
+      r.builder().AddMemoryElems<uint16_t>(kWasmPageSize / sizeof(uint16_t));
 
   BUILD(
       r,
@@ -280,7 +288,7 @@ WASM_EXEC_TEST(I32AtomicStoreLoad8U) {
   EXPERIMENTAL_FLAG_SCOPE(threads);
   WasmRunner<uint32_t, uint32_t> r(execution_mode);
   r.builder().SetHasSharedMemory();
-  uint8_t* memory = r.builder().AddMemoryElems<uint8_t>(8);
+  uint8_t* memory = r.builder().AddMemoryElems<uint8_t>(kWasmPageSize);
 
   BUILD(r,
         WASM_ATOMICS_STORE_OP(kExprI32AtomicStore8U, WASM_ZERO,
diff --git a/deps/v8/test/cctest/wasm/test-run-wasm-atomics64.cc b/deps/v8/test/cctest/wasm/test-run-wasm-atomics64.cc
index c9f24dccc2ddbe..48169db1915166 100644
--- a/deps/v8/test/cctest/wasm/test-run-wasm-atomics64.cc
+++ b/deps/v8/test/cctest/wasm/test-run-wasm-atomics64.cc
@@ -14,7 +14,8 @@ void RunU64BinOp(WasmExecutionMode execution_mode, WasmOpcode wasm_op,
                  Uint64BinOp expected_op) {
   EXPERIMENTAL_FLAG_SCOPE(threads);
   WasmRunner<uint64_t, uint64_t> r(execution_mode);
-  uint64_t* memory = r.builder().AddMemoryElems<uint64_t>(8);
+  uint64_t* memory =
+      r.builder().AddMemoryElems<uint64_t>(kWasmPageSize / sizeof(uint64_t));
   r.builder().SetHasSharedMemory();
 
   BUILD(r, WASM_ATOMICS_BINOP(wasm_op, WASM_I32V_1(0), WASM_GET_LOCAL(0),
@@ -31,32 +32,31 @@ void RunU64BinOp(WasmExecutionMode execution_mode, WasmOpcode wasm_op,
   }
 }
 
-WASM_COMPILED_EXEC_TEST(I64AtomicAdd) {
+WASM_EXEC_TEST(I64AtomicAdd) {
   RunU64BinOp(execution_mode, kExprI64AtomicAdd, Add);
 }
-WASM_COMPILED_EXEC_TEST(I64AtomicSub) {
+WASM_EXEC_TEST(I64AtomicSub) {
   RunU64BinOp(execution_mode, kExprI64AtomicSub, Sub);
 }
-WASM_COMPILED_EXEC_TEST(I64AtomicAnd) {
+WASM_EXEC_TEST(I64AtomicAnd) {
   RunU64BinOp(execution_mode, kExprI64AtomicAnd, And);
 }
-WASM_COMPILED_EXEC_TEST(I64AtomicOr) {
+WASM_EXEC_TEST(I64AtomicOr) {
   RunU64BinOp(execution_mode, kExprI64AtomicOr, Or);
 }
-WASM_COMPILED_EXEC_TEST(I64AtomicXor) {
+WASM_EXEC_TEST(I64AtomicXor) {
   RunU64BinOp(execution_mode, kExprI64AtomicXor, Xor);
 }
-#if V8_TARGET_ARCH_X64
-WASM_COMPILED_EXEC_TEST(I64AtomicExchange) {
+WASM_EXEC_TEST(I64AtomicExchange) {
   RunU64BinOp(execution_mode, kExprI64AtomicExchange, Exchange);
 }
-#endif  // V8_TARGET_ARCH_X64
 
 void RunU32BinOp(WasmExecutionMode execution_mode, WasmOpcode wasm_op,
                  Uint32BinOp expected_op) {
   EXPERIMENTAL_FLAG_SCOPE(threads);
   WasmRunner<uint64_t, uint64_t> r(execution_mode);
-  uint32_t* memory = r.builder().AddMemoryElems<uint32_t>(8);
+  uint32_t* memory =
+      r.builder().AddMemoryElems<uint32_t>(kWasmPageSize / sizeof(uint32_t));
   r.builder().SetHasSharedMemory();
 
   BUILD(r, WASM_ATOMICS_BINOP(wasm_op, WASM_I32V_1(0), WASM_GET_LOCAL(0),
@@ -73,33 +73,32 @@ void RunU32BinOp(WasmExecutionMode execution_mode, WasmOpcode wasm_op,
   }
 }
 
-WASM_COMPILED_EXEC_TEST(I64AtomicAdd32U) {
+WASM_EXEC_TEST(I64AtomicAdd32U) {
   RunU32BinOp(execution_mode, kExprI64AtomicAdd32U, Add);
 }
-WASM_COMPILED_EXEC_TEST(I64AtomicSub32U) {
+WASM_EXEC_TEST(I64AtomicSub32U) {
   RunU32BinOp(execution_mode, kExprI64AtomicSub32U, Sub);
 }
-WASM_COMPILED_EXEC_TEST(I64AtomicAnd32U) {
+WASM_EXEC_TEST(I64AtomicAnd32U) {
   RunU32BinOp(execution_mode, kExprI64AtomicAnd32U, And);
 }
-WASM_COMPILED_EXEC_TEST(I64AtomicOr32U) {
+WASM_EXEC_TEST(I64AtomicOr32U) {
   RunU32BinOp(execution_mode, kExprI64AtomicOr32U, Or);
 }
-WASM_COMPILED_EXEC_TEST(I64AtomicXor32U) {
+WASM_EXEC_TEST(I64AtomicXor32U) {
   RunU32BinOp(execution_mode, kExprI64AtomicXor32U, Xor);
 }
-#if V8_TARGET_ARCH_X64
-WASM_COMPILED_EXEC_TEST(I64AtomicExchange32U) {
+WASM_EXEC_TEST(I64AtomicExchange32U) {
   RunU32BinOp(execution_mode, kExprI64AtomicExchange32U, Exchange);
 }
-#endif  // V8_TARGET_ARCH_X64
 
 void RunU16BinOp(WasmExecutionMode mode, WasmOpcode wasm_op,
                  Uint16BinOp expected_op) {
   EXPERIMENTAL_FLAG_SCOPE(threads);
   WasmRunner<uint64_t, uint64_t> r(mode);
   r.builder().SetHasSharedMemory();
-  uint16_t* memory = r.builder().AddMemoryElems<uint16_t>(8);
+  uint16_t* memory =
+      r.builder().AddMemoryElems<uint16_t>(kWasmPageSize / sizeof(uint16_t));
 
   BUILD(r, WASM_ATOMICS_BINOP(wasm_op, WASM_I32V_1(0), WASM_GET_LOCAL(0),
                               MachineRepresentation::kWord16));
@@ -115,33 +114,31 @@ void RunU16BinOp(WasmExecutionMode mode, WasmOpcode wasm_op,
   }
 }
 
-WASM_COMPILED_EXEC_TEST(I64AtomicAdd16U) {
+WASM_EXEC_TEST(I64AtomicAdd16U) {
   RunU16BinOp(execution_mode, kExprI64AtomicAdd16U, Add);
 }
-WASM_COMPILED_EXEC_TEST(I64AtomicSub16U) {
+WASM_EXEC_TEST(I64AtomicSub16U) {
   RunU16BinOp(execution_mode, kExprI64AtomicSub16U, Sub);
 }
-WASM_COMPILED_EXEC_TEST(I64AtomicAnd16U) {
+WASM_EXEC_TEST(I64AtomicAnd16U) {
   RunU16BinOp(execution_mode, kExprI64AtomicAnd16U, And);
 }
-WASM_COMPILED_EXEC_TEST(I64AtomicOr16U) {
+WASM_EXEC_TEST(I64AtomicOr16U) {
   RunU16BinOp(execution_mode, kExprI64AtomicOr16U, Or);
 }
-WASM_COMPILED_EXEC_TEST(I64AtomicXor16U) {
+WASM_EXEC_TEST(I64AtomicXor16U) {
   RunU16BinOp(execution_mode, kExprI64AtomicXor16U, Xor);
 }
-#if V8_TARGET_ARCH_X64
-WASM_COMPILED_EXEC_TEST(I64AtomicExchange16U) {
+WASM_EXEC_TEST(I64AtomicExchange16U) {
   RunU16BinOp(execution_mode, kExprI64AtomicExchange16U, Exchange);
 }
-#endif  // V8_TARGET_ARCH_X64
 
 void RunU8BinOp(WasmExecutionMode execution_mode, WasmOpcode wasm_op,
                 Uint8BinOp expected_op) {
   EXPERIMENTAL_FLAG_SCOPE(threads);
   WasmRunner<uint64_t, uint64_t> r(execution_mode);
   r.builder().SetHasSharedMemory();
-  uint8_t* memory = r.builder().AddMemoryElems<uint8_t>(8);
+  uint8_t* memory = r.builder().AddMemoryElems<uint8_t>(kWasmPageSize);
 
   BUILD(r, WASM_ATOMICS_BINOP(wasm_op, WASM_I32V_1(0), WASM_GET_LOCAL(0),
                               MachineRepresentation::kWord8));
@@ -157,32 +154,31 @@ void RunU8BinOp(WasmExecutionMode execution_mode, WasmOpcode wasm_op,
   }
 }
 
-WASM_COMPILED_EXEC_TEST(I64AtomicAdd8U) {
+WASM_EXEC_TEST(I64AtomicAdd8U) {
   RunU8BinOp(execution_mode, kExprI64AtomicAdd8U, Add);
 }
-WASM_COMPILED_EXEC_TEST(I64AtomicSub8U) {
+WASM_EXEC_TEST(I64AtomicSub8U) {
   RunU8BinOp(execution_mode, kExprI64AtomicSub8U, Sub);
 }
-WASM_COMPILED_EXEC_TEST(I64AtomicAnd8U) {
+WASM_EXEC_TEST(I64AtomicAnd8U) {
   RunU8BinOp(execution_mode, kExprI64AtomicAnd8U, And);
 }
-WASM_COMPILED_EXEC_TEST(I64AtomicOr8U) {
+WASM_EXEC_TEST(I64AtomicOr8U) {
   RunU8BinOp(execution_mode, kExprI64AtomicOr8U, Or);
 }
-WASM_COMPILED_EXEC_TEST(I64AtomicXor8U) {
+WASM_EXEC_TEST(I64AtomicXor8U) {
   RunU8BinOp(execution_mode, kExprI64AtomicXor8U, Xor);
 }
-
-#if V8_TARGET_ARCH_X64
-WASM_COMPILED_EXEC_TEST(I64AtomicExchange8U) {
+WASM_EXEC_TEST(I64AtomicExchange8U) {
   RunU8BinOp(execution_mode, kExprI64AtomicExchange8U, Exchange);
 }
 
-WASM_COMPILED_EXEC_TEST(I64AtomicCompareExchange) {
+WASM_EXEC_TEST(I64AtomicCompareExchange) {
   EXPERIMENTAL_FLAG_SCOPE(threads);
   WasmRunner<uint64_t, uint64_t, uint64_t> r(execution_mode);
   r.builder().SetHasSharedMemory();
-  uint64_t* memory = r.builder().AddMemoryElems<uint64_t>(8);
+  uint64_t* memory =
+      r.builder().AddMemoryElems<uint64_t>(kWasmPageSize / sizeof(uint64_t));
   BUILD(r, WASM_ATOMICS_TERNARY_OP(
                kExprI64AtomicCompareExchange, WASM_I32V_1(0), WASM_GET_LOCAL(0),
                WASM_GET_LOCAL(1), MachineRepresentation::kWord64));
@@ -198,11 +194,12 @@ WASM_COMPILED_EXEC_TEST(I64AtomicCompareExchange) {
   }
 }
 
-WASM_COMPILED_EXEC_TEST(I64AtomicCompareExchange32U) {
+WASM_EXEC_TEST(I64AtomicCompareExchange32U) {
   EXPERIMENTAL_FLAG_SCOPE(threads);
   WasmRunner<uint64_t, uint64_t, uint64_t> r(execution_mode);
   r.builder().SetHasSharedMemory();
-  uint32_t* memory = r.builder().AddMemoryElems<uint32_t>(8);
+  uint32_t* memory =
+      r.builder().AddMemoryElems<uint32_t>(kWasmPageSize / sizeof(uint32_t));
   BUILD(r, WASM_ATOMICS_TERNARY_OP(kExprI64AtomicCompareExchange32U,
                                    WASM_I32V_1(0), WASM_GET_LOCAL(0),
                                    WASM_GET_LOCAL(1),
@@ -219,11 +216,12 @@ WASM_COMPILED_EXEC_TEST(I64AtomicCompareExchange32U) {
   }
 }
 
-WASM_COMPILED_EXEC_TEST(I64AtomicCompareExchange16U) {
+WASM_EXEC_TEST(I64AtomicCompareExchange16U) {
   EXPERIMENTAL_FLAG_SCOPE(threads);
   WasmRunner<uint64_t, uint64_t, uint64_t> r(execution_mode);
   r.builder().SetHasSharedMemory();
-  uint16_t* memory = r.builder().AddMemoryElems<uint16_t>(8);
+  uint16_t* memory =
+      r.builder().AddMemoryElems<uint16_t>(kWasmPageSize / sizeof(uint16_t));
   BUILD(r, WASM_ATOMICS_TERNARY_OP(kExprI64AtomicCompareExchange16U,
                                    WASM_I32V_1(0), WASM_GET_LOCAL(0),
                                    WASM_GET_LOCAL(1),
@@ -240,11 +238,11 @@ WASM_COMPILED_EXEC_TEST(I64AtomicCompareExchange16U) {
   }
 }
 
-WASM_COMPILED_EXEC_TEST(I32AtomicCompareExchange8U) {
+WASM_EXEC_TEST(I32AtomicCompareExchange8U) {
   EXPERIMENTAL_FLAG_SCOPE(threads);
   WasmRunner<uint64_t, uint64_t, uint64_t> r(execution_mode);
   r.builder().SetHasSharedMemory();
-  uint8_t* memory = r.builder().AddMemoryElems<uint8_t>(8);
+  uint8_t* memory = r.builder().AddMemoryElems<uint8_t>(kWasmPageSize);
   BUILD(r,
         WASM_ATOMICS_TERNARY_OP(kExprI64AtomicCompareExchange8U, WASM_I32V_1(0),
                                 WASM_GET_LOCAL(0), WASM_GET_LOCAL(1),
@@ -260,11 +258,12 @@ WASM_COMPILED_EXEC_TEST(I32AtomicCompareExchange8U) {
   }
 }
 
-WASM_COMPILED_EXEC_TEST(I64AtomicLoad) {
+WASM_EXEC_TEST(I64AtomicLoad) {
   EXPERIMENTAL_FLAG_SCOPE(threads);
   WasmRunner<uint64_t> r(execution_mode);
   r.builder().SetHasSharedMemory();
-  uint64_t* memory = r.builder().AddMemoryElems<uint64_t>(8);
+  uint64_t* memory =
+      r.builder().AddMemoryElems<uint64_t>(kWasmPageSize / sizeof(uint64_t));
   BUILD(r, WASM_ATOMICS_LOAD_OP(kExprI64AtomicLoad, WASM_ZERO,
                                 MachineRepresentation::kWord64));
 
@@ -275,11 +274,12 @@ WASM_COMPILED_EXEC_TEST(I64AtomicLoad) {
   }
 }
 
-WASM_COMPILED_EXEC_TEST(I64AtomicLoad32U) {
+WASM_EXEC_TEST(I64AtomicLoad32U) {
   EXPERIMENTAL_FLAG_SCOPE(threads);
   WasmRunner<uint64_t> r(execution_mode);
   r.builder().SetHasSharedMemory();
-  uint32_t* memory = r.builder().AddMemoryElems<uint32_t>(8);
+  uint32_t* memory =
+      r.builder().AddMemoryElems<uint32_t>(kWasmPageSize / sizeof(uint32_t));
   BUILD(r, WASM_ATOMICS_LOAD_OP(kExprI64AtomicLoad32U, WASM_ZERO,
                                 MachineRepresentation::kWord32));
 
@@ -290,11 +290,12 @@ WASM_COMPILED_EXEC_TEST(I64AtomicLoad32U) {
   }
 }
 
-WASM_COMPILED_EXEC_TEST(I64AtomicLoad16U) {
+WASM_EXEC_TEST(I64AtomicLoad16U) {
   EXPERIMENTAL_FLAG_SCOPE(threads);
   WasmRunner<uint64_t> r(execution_mode);
   r.builder().SetHasSharedMemory();
-  uint16_t* memory = r.builder().AddMemoryElems<uint16_t>(8);
+  uint16_t* memory =
+      r.builder().AddMemoryElems<uint16_t>(kWasmPageSize / sizeof(uint16_t));
   BUILD(r, WASM_ATOMICS_LOAD_OP(kExprI64AtomicLoad16U, WASM_ZERO,
                                 MachineRepresentation::kWord16));
 
@@ -305,11 +306,11 @@ WASM_COMPILED_EXEC_TEST(I64AtomicLoad16U) {
   }
 }
 
-WASM_COMPILED_EXEC_TEST(I64AtomicLoad8U) {
+WASM_EXEC_TEST(I64AtomicLoad8U) {
   EXPERIMENTAL_FLAG_SCOPE(threads);
   WasmRunner<uint64_t> r(execution_mode);
   r.builder().SetHasSharedMemory();
-  uint8_t* memory = r.builder().AddMemoryElems<uint8_t>(8);
+  uint8_t* memory = r.builder().AddMemoryElems<uint8_t>(kWasmPageSize);
   BUILD(r, WASM_ATOMICS_LOAD_OP(kExprI64AtomicLoad8U, WASM_ZERO,
                                 MachineRepresentation::kWord8));
 
@@ -320,11 +321,12 @@ WASM_COMPILED_EXEC_TEST(I64AtomicLoad8U) {
   }
 }
 
-WASM_COMPILED_EXEC_TEST(I64AtomicStoreLoad) {
+WASM_EXEC_TEST(I64AtomicStoreLoad) {
   EXPERIMENTAL_FLAG_SCOPE(threads);
   WasmRunner<uint64_t, uint64_t> r(execution_mode);
   r.builder().SetHasSharedMemory();
-  uint64_t* memory = r.builder().AddMemoryElems<uint64_t>(8);
+  uint64_t* memory =
+      r.builder().AddMemoryElems<uint64_t>(kWasmPageSize / sizeof(uint64_t));
 
   BUILD(r,
         WASM_ATOMICS_STORE_OP(kExprI64AtomicStore, WASM_ZERO, WASM_GET_LOCAL(0),
@@ -339,11 +341,12 @@ WASM_COMPILED_EXEC_TEST(I64AtomicStoreLoad) {
   }
 }
 
-WASM_COMPILED_EXEC_TEST(I64AtomicStoreLoad32U) {
+WASM_EXEC_TEST(I64AtomicStoreLoad32U) {
   EXPERIMENTAL_FLAG_SCOPE(threads);
   WasmRunner<uint64_t, uint64_t> r(execution_mode);
   r.builder().SetHasSharedMemory();
-  uint32_t* memory = r.builder().AddMemoryElems<uint32_t>(8);
+  uint32_t* memory =
+      r.builder().AddMemoryElems<uint32_t>(kWasmPageSize / sizeof(uint32_t));
 
   BUILD(
       r,
@@ -359,11 +362,12 @@ WASM_COMPILED_EXEC_TEST(I64AtomicStoreLoad32U) {
   }
 }
 
-WASM_COMPILED_EXEC_TEST(I64AtomicStoreLoad16U) {
+WASM_EXEC_TEST(I64AtomicStoreLoad16U) {
   EXPERIMENTAL_FLAG_SCOPE(threads);
   WasmRunner<uint64_t, uint64_t> r(execution_mode);
   r.builder().SetHasSharedMemory();
-  uint16_t* memory = r.builder().AddMemoryElems<uint16_t>(8);
+  uint16_t* memory =
+      r.builder().AddMemoryElems<uint16_t>(kWasmPageSize / sizeof(uint16_t));
 
   BUILD(
       r,
@@ -379,11 +383,11 @@ WASM_COMPILED_EXEC_TEST(I64AtomicStoreLoad16U) {
   }
 }
 
-WASM_COMPILED_EXEC_TEST(I64AtomicStoreLoad8U) {
+WASM_EXEC_TEST(I64AtomicStoreLoad8U) {
   EXPERIMENTAL_FLAG_SCOPE(threads);
   WasmRunner<uint64_t, uint64_t> r(execution_mode);
   r.builder().SetHasSharedMemory();
-  uint8_t* memory = r.builder().AddMemoryElems<uint8_t>(8);
+  uint8_t* memory = r.builder().AddMemoryElems<uint8_t>(kWasmPageSize);
 
   BUILD(r,
         WASM_ATOMICS_STORE_OP(kExprI64AtomicStore8U, WASM_ZERO,
@@ -397,7 +401,6 @@ WASM_COMPILED_EXEC_TEST(I64AtomicStoreLoad8U) {
     CHECK_EQ(*i, r.builder().ReadMemory(&memory[0]));
   }
 }
-#endif  // V8_TARGET_ARCH_X64
 
 }  // namespace test_run_wasm_atomics_64
 }  // namespace wasm
diff --git a/deps/v8/test/cctest/wasm/test-run-wasm-module.cc b/deps/v8/test/cctest/wasm/test-run-wasm-module.cc
index a254eaff4f56f1..aab660f96fc8b8 100644
--- a/deps/v8/test/cctest/wasm/test-run-wasm-module.cc
+++ b/deps/v8/test/cctest/wasm/test-run-wasm-module.cc
@@ -26,17 +26,15 @@
 namespace v8 {
 namespace internal {
 namespace wasm {
+namespace test_run_wasm_module {
 
 using testing::CompileAndInstantiateForTesting;
 
 namespace {
-void Cleanup(Isolate* isolate = nullptr) {
+void Cleanup(Isolate* isolate = CcTest::InitIsolateOnce()) {
   // By sending a low memory notifications, we will try hard to collect all
   // garbage and will therefore also invoke all weak callbacks of actually
   // unreachable persistent handles.
-  if (!isolate) {
-    isolate = CcTest::InitIsolateOnce();
-  }
   reinterpret_cast<v8::Isolate*>(isolate)->LowMemoryNotification();
 }
 
@@ -217,292 +215,6 @@ TEST(Run_WasmModule_Global) {
   Cleanup();
 }
 
-// Approximate gtest TEST_F style, in case we adopt gtest.
-class WasmSerializationTest {
- public:
-  WasmSerializationTest() : zone_(&allocator_, ZONE_NAME) {
-    // Don't call here if we move to gtest.
-    SetUp();
-  }
-
-  static void BuildWireBytes(Zone* zone, ZoneBuffer* buffer) {
-    WasmModuleBuilder* builder = new (zone) WasmModuleBuilder(zone);
-    TestSignatures sigs;
-
-    WasmFunctionBuilder* f = builder->AddFunction(sigs.i_i());
-    byte code[] = {WASM_GET_LOCAL(0), kExprI32Const, 1, kExprI32Add};
-    EMIT_CODE_WITH_END(f, code);
-    builder->AddExport(CStrVector(kFunctionName), f);
-
-    builder->WriteTo(*buffer);
-  }
-
-  void ClearSerializedData() {
-    serialized_bytes_.first = nullptr;
-    serialized_bytes_.second = 0;
-  }
-
-  void InvalidateVersion() {
-    uint32_t* slot = reinterpret_cast<uint32_t*>(
-        const_cast<uint8_t*>(serialized_bytes_.first) +
-        SerializedCodeData::kVersionHashOffset);
-    *slot = Version::Hash() + 1;
-  }
-
-  void InvalidateWireBytes() {
-    memset(const_cast<uint8_t*>(wire_bytes_.first), '\0',
-           wire_bytes_.second / 2);
-  }
-
-  void InvalidateLength() {
-    uint32_t* slot = reinterpret_cast<uint32_t*>(
-        const_cast<uint8_t*>(serialized_bytes_.first) +
-        SerializedCodeData::kPayloadLengthOffset);
-    *slot = 0u;
-  }
-
-  v8::MaybeLocal<v8::WasmCompiledModule> Deserialize() {
-    ErrorThrower thrower(current_isolate(), "");
-    v8::MaybeLocal<v8::WasmCompiledModule> deserialized =
-        v8::WasmCompiledModule::DeserializeOrCompile(
-            current_isolate_v8(), serialized_bytes(), wire_bytes());
-    return deserialized;
-  }
-
-  void DeserializeAndRun() {
-    ErrorThrower thrower(current_isolate(), "");
-    v8::Local<v8::WasmCompiledModule> deserialized_module;
-    CHECK(Deserialize().ToLocal(&deserialized_module));
-    Handle<WasmModuleObject> module_object = Handle<WasmModuleObject>::cast(
-        v8::Utils::OpenHandle(*deserialized_module));
-    {
-      DisallowHeapAllocation assume_no_gc;
-      Handle<WasmCompiledModule> compiled_part(module_object->compiled_module(),
-                                               current_isolate());
-      CHECK_EQ(
-          memcmp(compiled_part->shared()->module_bytes()->GetCharsAddress(),
-                 wire_bytes().first, wire_bytes().second),
-          0);
-    }
-    Handle<WasmInstanceObject> instance =
-        current_isolate()
-            ->wasm_engine()
-            ->SyncInstantiate(current_isolate(), &thrower, module_object,
-                              Handle<JSReceiver>::null(),
-                              MaybeHandle<JSArrayBuffer>())
-            .ToHandleChecked();
-    Handle<Object> params[1] = {
-        Handle<Object>(Smi::FromInt(41), current_isolate())};
-    int32_t result = testing::CallWasmFunctionForTesting(
-        current_isolate(), instance, &thrower, kFunctionName, 1, params);
-    CHECK_EQ(42, result);
-  }
-
-  Isolate* current_isolate() {
-    return reinterpret_cast<Isolate*>(current_isolate_v8_);
-  }
-
-  ~WasmSerializationTest() {
-    // Don't call from here if we move to gtest
-    TearDown();
-  }
-
-  v8::Isolate* current_isolate_v8() { return current_isolate_v8_; }
-
- private:
-  static const char* kFunctionName;
-
-  Zone* zone() { return &zone_; }
-  const v8::WasmCompiledModule::CallerOwnedBuffer& wire_bytes() const {
-    return wire_bytes_;
-  }
-
-  const v8::WasmCompiledModule::CallerOwnedBuffer& serialized_bytes() const {
-    return serialized_bytes_;
-  }
-
-  void SetUp() {
-    ZoneBuffer buffer(&zone_);
-    WasmSerializationTest::BuildWireBytes(zone(), &buffer);
-
-    Isolate* serialization_isolate = CcTest::InitIsolateOnce();
-    ErrorThrower thrower(serialization_isolate, "");
-    uint8_t* bytes = nullptr;
-    size_t bytes_size = 0;
-    {
-      HandleScope scope(serialization_isolate);
-      testing::SetupIsolateForWasmModule(serialization_isolate);
-
-      MaybeHandle<WasmModuleObject> module_object =
-          serialization_isolate->wasm_engine()->SyncCompile(
-              serialization_isolate, &thrower,
-              ModuleWireBytes(buffer.begin(), buffer.end()));
-
-      MaybeHandle<WasmCompiledModule> compiled_module(
-          module_object.ToHandleChecked()->compiled_module(),
-          serialization_isolate);
-      CHECK(!compiled_module.is_null());
-      Handle<JSObject> module_obj = WasmModuleObject::New(
-          serialization_isolate, compiled_module.ToHandleChecked());
-      v8::Local<v8::Object> v8_module_obj = v8::Utils::ToLocal(module_obj);
-      CHECK(v8_module_obj->IsWebAssemblyCompiledModule());
-
-      v8::Local<v8::WasmCompiledModule> v8_compiled_module =
-          v8_module_obj.As<v8::WasmCompiledModule>();
-      v8::Local<v8::String> uncompiled_bytes =
-          v8_compiled_module->GetWasmWireBytes();
-      bytes_size = static_cast<size_t>(uncompiled_bytes->Length());
-      bytes = zone()->NewArray<uint8_t>(bytes_size);
-      uncompiled_bytes->WriteOneByte(bytes, 0, uncompiled_bytes->Length(),
-                                     v8::String::NO_NULL_TERMINATION);
-      // keep alive data_ until the end
-      data_ = v8_compiled_module->Serialize();
-    }
-
-    wire_bytes_ = {const_cast<const uint8_t*>(bytes), bytes_size};
-
-    serialized_bytes_ = {data_.first.get(), data_.second};
-
-    v8::Isolate::CreateParams create_params;
-    create_params.array_buffer_allocator =
-        serialization_isolate->array_buffer_allocator();
-
-    current_isolate_v8_ = v8::Isolate::New(create_params);
-    v8::HandleScope new_scope(current_isolate_v8());
-    v8::Local<v8::Context> deserialization_context =
-        v8::Context::New(current_isolate_v8());
-    deserialization_context->Enter();
-    testing::SetupIsolateForWasmModule(current_isolate());
-  }
-
-  void TearDown() {
-    current_isolate_v8()->Dispose();
-    current_isolate_v8_ = nullptr;
-  }
-
-  v8::internal::AccountingAllocator allocator_;
-  Zone zone_;
-  v8::WasmCompiledModule::SerializedModule data_;
-  v8::WasmCompiledModule::CallerOwnedBuffer wire_bytes_;
-  v8::WasmCompiledModule::CallerOwnedBuffer serialized_bytes_;
-  v8::Isolate* current_isolate_v8_;
-};
-
-const char* WasmSerializationTest::kFunctionName = "increment";
-
-TEST(DeserializeValidModule) {
-  WasmSerializationTest test;
-  {
-    HandleScope scope(test.current_isolate());
-    test.DeserializeAndRun();
-  }
-  Cleanup(test.current_isolate());
-  Cleanup();
-}
-
-TEST(DeserializeMismatchingVersion) {
-  WasmSerializationTest test;
-  {
-    HandleScope scope(test.current_isolate());
-    test.InvalidateVersion();
-    test.DeserializeAndRun();
-  }
-  Cleanup(test.current_isolate());
-  Cleanup();
-}
-
-TEST(DeserializeNoSerializedData) {
-  WasmSerializationTest test;
-  {
-    HandleScope scope(test.current_isolate());
-    test.ClearSerializedData();
-    test.DeserializeAndRun();
-  }
-  Cleanup(test.current_isolate());
-  Cleanup();
-}
-
-TEST(DeserializeInvalidLength) {
-  WasmSerializationTest test;
-  {
-    HandleScope scope(test.current_isolate());
-    test.InvalidateLength();
-    test.DeserializeAndRun();
-  }
-  Cleanup(test.current_isolate());
-  Cleanup();
-}
-
-TEST(DeserializeWireBytesAndSerializedDataInvalid) {
-  WasmSerializationTest test;
-  {
-    HandleScope scope(test.current_isolate());
-    test.InvalidateVersion();
-    test.InvalidateWireBytes();
-    test.Deserialize();
-  }
-  Cleanup(test.current_isolate());
-  Cleanup();
-}
-
-bool False(v8::Local<v8::Context> context, v8::Local<v8::String> source) {
-  return false;
-}
-
-TEST(BlockWasmCodeGenAtDeserialization) {
-  WasmSerializationTest test;
-  {
-    HandleScope scope(test.current_isolate());
-    test.current_isolate_v8()->SetAllowCodeGenerationFromStringsCallback(False);
-    v8::MaybeLocal<v8::WasmCompiledModule> nothing = test.Deserialize();
-    CHECK(nothing.IsEmpty());
-  }
-  Cleanup(test.current_isolate());
-  Cleanup();
-}
-
-TEST(TransferrableWasmModules) {
-  v8::internal::AccountingAllocator allocator;
-  Zone zone(&allocator, ZONE_NAME);
-
-  ZoneBuffer buffer(&zone);
-  WasmSerializationTest::BuildWireBytes(&zone, &buffer);
-
-  Isolate* from_isolate = CcTest::InitIsolateOnce();
-  ErrorThrower thrower(from_isolate, "");
-  std::vector<v8::WasmCompiledModule::TransferrableModule> store;
-  {
-    HandleScope scope(from_isolate);
-    testing::SetupIsolateForWasmModule(from_isolate);
-
-    MaybeHandle<WasmModuleObject> module_object =
-        from_isolate->wasm_engine()->SyncCompile(
-            from_isolate, &thrower,
-            ModuleWireBytes(buffer.begin(), buffer.end()));
-    v8::Local<v8::WasmCompiledModule> v8_module =
-        v8::Local<v8::WasmCompiledModule>::Cast(v8::Utils::ToLocal(
-            Handle<JSObject>::cast(module_object.ToHandleChecked())));
-    store.push_back(v8_module->GetTransferrableModule());
-  }
-
-  {
-    v8::Isolate::CreateParams create_params;
-    create_params.array_buffer_allocator =
-        from_isolate->array_buffer_allocator();
-    v8::Isolate* to_isolate = v8::Isolate::New(create_params);
-    {
-      v8::HandleScope new_scope(to_isolate);
-      v8::Local<v8::Context> deserialization_context =
-          v8::Context::New(to_isolate);
-      deserialization_context->Enter();
-      v8::MaybeLocal<v8::WasmCompiledModule> mod =
-          v8::WasmCompiledModule::FromTransferrableModule(to_isolate, store[0]);
-      CHECK(!mod.IsEmpty());
-    }
-    to_isolate->Dispose();
-  }
-}
-
 TEST(MemorySize) {
   {
     // Initial memory size is 16, see wasm-module-builder.cc
@@ -568,7 +280,7 @@ class InterruptThread : public v8::base::Thread {
   static void OnInterrupt(v8::Isolate* isolate, void* data) {
     int32_t* m = reinterpret_cast<int32_t*>(data);
     // Set the interrupt location to 0 to break the loop in {TestInterruptLoop}.
-    int32_t* ptr = &m[interrupt_location_];
+    Address ptr = reinterpret_cast<Address>(&m[interrupt_location_]);
     WriteLittleEndianValue<int32_t>(ptr, interrupt_value_);
   }
 
@@ -577,7 +289,7 @@ class InterruptThread : public v8::base::Thread {
     int32_t val = 0;
     do {
       val = memory_[0];
-      val = ReadLittleEndianValue<int32_t>(&val);
+      val = ReadLittleEndianValue<int32_t>(reinterpret_cast<Address>(&val));
     } while (val != signal_value_);
     isolate_->RequestInterrupt(&OnInterrupt, const_cast<int32_t*>(memory_));
   }
@@ -642,9 +354,10 @@ TEST(TestInterruptLoop) {
     InterruptThread thread(isolate, memory_array);
     thread.Start();
     testing::RunWasmModuleForTesting(isolate, instance, 0, nullptr);
-    int32_t val = memory_array[InterruptThread::interrupt_location_];
+    Address address = reinterpret_cast<Address>(
+        &memory_array[InterruptThread::interrupt_location_]);
     CHECK_EQ(InterruptThread::interrupt_value_,
-             ReadLittleEndianValue<int32_t>(&val));
+             ReadLittleEndianValue<int32_t>(address));
   }
   Cleanup();
 }
@@ -891,7 +604,7 @@ TEST(InitDataAtTheUpperLimit) {
     CompileAndInstantiateForTesting(
         isolate, &thrower, ModuleWireBytes(data, data + arraysize(data)));
     if (thrower.error()) {
-      thrower.Reify()->Print();
+      thrower.Reify()->Print(isolate);
       FATAL("compile or instantiate error");
     }
   }
@@ -1079,24 +792,17 @@ TEST(Run_WasmModule_Buffer_Externalized_GrowMemMemSize) {
   {
     Isolate* isolate = CcTest::InitIsolateOnce();
     HandleScope scope(isolate);
-#if V8_TARGET_ARCH_64_BIT
-    constexpr bool require_guard_regions = true;
-#else
-    constexpr bool require_guard_regions = false;
-#endif
     Handle<JSArrayBuffer> buffer;
-    CHECK(
-        wasm::NewArrayBuffer(isolate, 16 * kWasmPageSize, require_guard_regions)
-            .ToHandle(&buffer));
+    CHECK(wasm::NewArrayBuffer(isolate, 16 * kWasmPageSize).ToHandle(&buffer));
     Handle<WasmMemoryObject> mem_obj =
         WasmMemoryObject::New(isolate, buffer, 100);
     auto const contents = v8::Utils::ToLocal(buffer)->Externalize();
     int32_t result = WasmMemoryObject::Grow(isolate, mem_obj, 0);
     CHECK_EQ(16, result);
     constexpr bool is_wasm_memory = true;
-    const JSArrayBuffer::Allocation allocation{
-        contents.AllocationBase(), contents.AllocationLength(), contents.Data(),
-        contents.AllocationMode(), is_wasm_memory};
+    const JSArrayBuffer::Allocation allocation{contents.AllocationBase(),
+                                               contents.AllocationLength(),
+                                               contents.Data(), is_wasm_memory};
     JSArrayBuffer::FreeBackingStore(isolate, allocation);
   }
   Cleanup();
@@ -1108,21 +814,14 @@ TEST(Run_WasmModule_Buffer_Externalized_Detach) {
     // https://bugs.chromium.org/p/chromium/issues/detail?id=731046
     Isolate* isolate = CcTest::InitIsolateOnce();
     HandleScope scope(isolate);
-#if V8_TARGET_ARCH_64_BIT
-    constexpr bool require_guard_regions = true;
-#else
-    constexpr bool require_guard_regions = false;
-#endif
     Handle<JSArrayBuffer> buffer;
-    CHECK(
-        wasm::NewArrayBuffer(isolate, 16 * kWasmPageSize, require_guard_regions)
-            .ToHandle(&buffer));
+    CHECK(wasm::NewArrayBuffer(isolate, 16 * kWasmPageSize).ToHandle(&buffer));
     auto const contents = v8::Utils::ToLocal(buffer)->Externalize();
     wasm::DetachMemoryBuffer(isolate, buffer, true);
     constexpr bool is_wasm_memory = true;
-    const JSArrayBuffer::Allocation allocation{
-        contents.AllocationBase(), contents.AllocationLength(), contents.Data(),
-        contents.AllocationMode(), is_wasm_memory};
+    const JSArrayBuffer::Allocation allocation{contents.AllocationBase(),
+                                               contents.AllocationLength(),
+                                               contents.Data(), is_wasm_memory};
     JSArrayBuffer::FreeBackingStore(isolate, allocation);
   }
   Cleanup();
@@ -1132,22 +831,16 @@ TEST(Run_WasmModule_Buffer_Externalized_Regression_UseAfterFree) {
   // Regresion test for https://crbug.com/813876
   Isolate* isolate = CcTest::InitIsolateOnce();
   HandleScope scope(isolate);
-#if V8_TARGET_ARCH_64_BIT
-  const bool require_guard_regions = trap_handler::IsTrapHandlerEnabled();
-#else
-  constexpr bool require_guard_regions = false;
-#endif
   Handle<JSArrayBuffer> buffer;
-  CHECK(wasm::NewArrayBuffer(isolate, 16 * kWasmPageSize, require_guard_regions)
-            .ToHandle(&buffer));
+  CHECK(wasm::NewArrayBuffer(isolate, 16 * kWasmPageSize).ToHandle(&buffer));
   Handle<WasmMemoryObject> mem = WasmMemoryObject::New(isolate, buffer, 128);
   auto contents = v8::Utils::ToLocal(buffer)->Externalize();
   WasmMemoryObject::Grow(isolate, mem, 0);
   constexpr bool is_wasm_memory = true;
   JSArrayBuffer::FreeBackingStore(
-      isolate, JSArrayBuffer::Allocation(
-                   contents.AllocationBase(), contents.AllocationLength(),
-                   contents.Data(), contents.AllocationMode(), is_wasm_memory));
+      isolate, JSArrayBuffer::Allocation(contents.AllocationBase(),
+                                         contents.AllocationLength(),
+                                         contents.Data(), is_wasm_memory));
   // Make sure we can write to the buffer without crashing
   uint32_t* int_buffer =
       reinterpret_cast<uint32_t*>(mem->array_buffer()->backing_store());
@@ -1161,9 +854,7 @@ TEST(Run_WasmModule_Reclaim_Memory) {
   Handle<JSArrayBuffer> buffer;
   for (int i = 0; i < 256; ++i) {
     HandleScope scope(isolate);
-    constexpr bool require_guard_regions = true;
-    CHECK(NewArrayBuffer(isolate, kWasmPageSize, require_guard_regions,
-                         SharedFlag::kNotShared)
+    CHECK(NewArrayBuffer(isolate, kWasmPageSize, SharedFlag::kNotShared)
               .ToHandle(&buffer));
   }
 }
@@ -1199,15 +890,14 @@ TEST(AtomicOpDisassembly) {
         isolate->wasm_engine()->SyncCompile(
             isolate, &thrower, ModuleWireBytes(buffer.begin(), buffer.end()));
 
-    Handle<WasmCompiledModule> compiled_module(
-        module_object.ToHandleChecked()->compiled_module(), isolate);
-    compiled_module->shared()->DisassembleFunction(0);
+    module_object.ToHandleChecked()->DisassembleFunction(0);
   }
   Cleanup();
 }
 
 #undef EMIT_CODE_WITH_END
 
+}  // namespace test_run_wasm_module
 }  // namespace wasm
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/test/cctest/wasm/test-run-wasm-sign-extension.cc b/deps/v8/test/cctest/wasm/test-run-wasm-sign-extension.cc
index 8e1b88aaddcd36..17a79bc27f2a24 100644
--- a/deps/v8/test/cctest/wasm/test-run-wasm-sign-extension.cc
+++ b/deps/v8/test/cctest/wasm/test-run-wasm-sign-extension.cc
@@ -10,7 +10,8 @@ namespace v8 {
 namespace internal {
 namespace wasm {
 
-WASM_COMPILED_EXEC_TEST(I32SExtendI8) {
+// TODO(gdeepti): Enable tests to run in the interpreter.
+WASM_EXEC_TEST(I32SExtendI8) {
   EXPERIMENTAL_FLAG_SCOPE(se);
   WasmRunner<int32_t, int32_t> r(execution_mode);
   BUILD(r, WASM_I32_SIGN_EXT_I8(WASM_GET_LOCAL(0)));
@@ -21,7 +22,7 @@ WASM_COMPILED_EXEC_TEST(I32SExtendI8) {
   CHECK_EQ(-0x80, r.Call(0x80));
 }
 
-WASM_COMPILED_EXEC_TEST(I32SExtendI16) {
+WASM_EXEC_TEST(I32SExtendI16) {
   EXPERIMENTAL_FLAG_SCOPE(se);
   WasmRunner<int32_t, int32_t> r(execution_mode);
   BUILD(r, WASM_I32_SIGN_EXT_I16(WASM_GET_LOCAL(0)));
@@ -31,11 +32,8 @@ WASM_COMPILED_EXEC_TEST(I32SExtendI16) {
   CHECK_EQ(0x7afa, r.Call(0x7afa));
   CHECK_EQ(-0x8000, r.Call(0x8000));
 }
-// TODO(gdeepti): Enable tests to run in the interpreter, and on 32 bit
-// platforms after int64 lowering support. Add JS tests once all ops can be run
-// on 32 bit platforms.
-#if V8_TARGET_ARCH_64_BIT
-WASM_COMPILED_EXEC_TEST(I64SExtendI8) {
+
+WASM_EXEC_TEST(I64SExtendI8) {
   EXPERIMENTAL_FLAG_SCOPE(se);
   WasmRunner<int64_t, int64_t> r(execution_mode);
   BUILD(r, WASM_I64_SIGN_EXT_I8(WASM_GET_LOCAL(0)));
@@ -46,7 +44,7 @@ WASM_COMPILED_EXEC_TEST(I64SExtendI8) {
   CHECK_EQ(-0x80, r.Call(0x80));
 }
 
-WASM_COMPILED_EXEC_TEST(I64SExtendI16) {
+WASM_EXEC_TEST(I64SExtendI16) {
   EXPERIMENTAL_FLAG_SCOPE(se);
   WasmRunner<int64_t, int64_t> r(execution_mode);
   BUILD(r, WASM_I64_SIGN_EXT_I16(WASM_GET_LOCAL(0)));
@@ -57,7 +55,7 @@ WASM_COMPILED_EXEC_TEST(I64SExtendI16) {
   CHECK_EQ(-0x8000, r.Call(0x8000));
 }
 
-WASM_COMPILED_EXEC_TEST(I64SExtendI32) {
+WASM_EXEC_TEST(I64SExtendI32) {
   EXPERIMENTAL_FLAG_SCOPE(se);
   WasmRunner<int64_t, int64_t> r(execution_mode);
   BUILD(r, WASM_I64_SIGN_EXT_I32(WASM_GET_LOCAL(0)));
@@ -67,7 +65,6 @@ WASM_COMPILED_EXEC_TEST(I64SExtendI32) {
   CHECK_EQ(0x7fffffff, r.Call(0x7fffffff));
   CHECK_EQ(-0x80000000LL, r.Call(0x80000000));
 }
-#endif  // V8_TARGET_ARCH_64_BIT
 
 }  // namespace wasm
 }  // namespace internal
diff --git a/deps/v8/test/cctest/wasm/test-run-wasm-simd.cc b/deps/v8/test/cctest/wasm/test-run-wasm-simd.cc
index 578ea6044d047c..dc1b95894d3a1f 100644
--- a/deps/v8/test/cctest/wasm/test-run-wasm-simd.cc
+++ b/deps/v8/test/cctest/wasm/test-run-wasm-simd.cc
@@ -31,25 +31,23 @@ typedef int8_t (*Int8BinOp)(int8_t, int8_t);
 typedef int (*Int8CompareOp)(int8_t, int8_t);
 typedef int8_t (*Int8ShiftOp)(int8_t, int);
 
-#define WASM_SIMD_TEST(name)                        \
-  void RunWasm_##name##_Impl(LowerSimd lower_simd); \
-  TEST(RunWasm_##name##_compiled) {                 \
-    EXPERIMENTAL_FLAG_SCOPE(simd);                  \
-    RunWasm_##name##_Impl(kNoLowerSimd);            \
-  }                                                 \
-  TEST(RunWasm_##name##_simd_lowered) {             \
-    EXPERIMENTAL_FLAG_SCOPE(simd);                  \
-    RunWasm_##name##_Impl(kLowerSimd);              \
-  }                                                 \
-  void RunWasm_##name##_Impl(LowerSimd lower_simd)
-
-#define WASM_SIMD_COMPILED_TEST(name)               \
-  void RunWasm_##name##_Impl(LowerSimd lower_simd); \
-  TEST(RunWasm_##name##_compiled) {                 \
-    EXPERIMENTAL_FLAG_SCOPE(simd);                  \
-    RunWasm_##name##_Impl(kNoLowerSimd);            \
-  }                                                 \
-  void RunWasm_##name##_Impl(LowerSimd lower_simd)
+#define WASM_SIMD_TEST(name)                                    \
+  void RunWasm_##name##_Impl(LowerSimd lower_simd,              \
+                             WasmExecutionMode execution_mode); \
+  TEST(RunWasm_##name##_turbofan) {                             \
+    EXPERIMENTAL_FLAG_SCOPE(simd);                              \
+    RunWasm_##name##_Impl(kNoLowerSimd, kExecuteTurbofan);      \
+  }                                                             \
+  TEST(RunWasm_##name##_interpreter) {                          \
+    EXPERIMENTAL_FLAG_SCOPE(simd);                              \
+    RunWasm_##name##_Impl(kNoLowerSimd, kExecuteInterpreter);   \
+  }                                                             \
+  TEST(RunWasm_##name##_simd_lowered) {                         \
+    EXPERIMENTAL_FLAG_SCOPE(simd);                              \
+    RunWasm_##name##_Impl(kLowerSimd, kExecuteTurbofan);        \
+  }                                                             \
+  void RunWasm_##name##_Impl(LowerSimd lower_simd,              \
+                             WasmExecutionMode execution_mode)
 
 // Generic expected value functions.
 template <typename T>
@@ -72,11 +70,6 @@ T Mul(T a, T b) {
   return a * b;
 }
 
-template <typename T>
-T Div(T a, T b) {
-  return a / b;
-}
-
 template <typename T>
 T Minimum(T a, T b) {
   return a <= b ? a : b;
@@ -406,7 +399,7 @@ bool SkipFPValue(float x) {
 bool SkipFPExpectedValue(float x) { return std::isnan(x) || SkipFPValue(x); }
 
 WASM_SIMD_TEST(F32x4Splat) {
-  WasmRunner<int32_t, float> r(kExecuteTurbofan, lower_simd);
+  WasmRunner<int32_t, float> r(execution_mode, lower_simd);
   byte lane_val = 0;
   byte simd = r.AllocateLocal(kWasmS128);
   BUILD(r,
@@ -420,7 +413,7 @@ WASM_SIMD_TEST(F32x4Splat) {
 }
 
 WASM_SIMD_TEST(F32x4ReplaceLane) {
-  WasmRunner<int32_t, float, float> r(kExecuteTurbofan, lower_simd);
+  WasmRunner<int32_t, float, float> r(execution_mode, lower_simd);
   byte old_val = 0;
   byte new_val = 1;
   byte simd = r.AllocateLocal(kWasmS128);
@@ -449,7 +442,7 @@ WASM_SIMD_TEST(F32x4ReplaceLane) {
     V8_TARGET_ARCH_MIPS64 || V8_TARGET_ARCH_IA32
 // Tests both signed and unsigned conversion.
 WASM_SIMD_TEST(F32x4ConvertI32x4) {
-  WasmRunner<int32_t, int32_t, float, float> r(kExecuteTurbofan, lower_simd);
+  WasmRunner<int32_t, int32_t, float, float> r(execution_mode, lower_simd);
   byte a = 0;
   byte expected_signed = 1;
   byte expected_unsigned = 2;
@@ -473,9 +466,10 @@ WASM_SIMD_TEST(F32x4ConvertI32x4) {
 #endif  // V8_TARGET_ARCH_ARM || V8_TARGET_ARCH_ARM64 || V8_TARGET_ARCH_MIPS ||
         // V8_TARGET_ARCH_MIPS64 || V8_TARGET_ARCH_IA32
 
-void RunF32x4UnOpTest(LowerSimd lower_simd, WasmOpcode simd_op,
-                      FloatUnOp expected_op, float error = 0.0f) {
-  WasmRunner<int32_t, float, float, float> r(kExecuteTurbofan, lower_simd);
+void RunF32x4UnOpTest(WasmExecutionMode execution_mode, LowerSimd lower_simd,
+                      WasmOpcode simd_op, FloatUnOp expected_op,
+                      float error = 0.0f) {
+  WasmRunner<int32_t, float, float, float> r(execution_mode, lower_simd);
   byte a = 0;
   byte low = 1;
   byte high = 2;
@@ -495,26 +489,27 @@ void RunF32x4UnOpTest(LowerSimd lower_simd, WasmOpcode simd_op,
 }
 
 WASM_SIMD_TEST(F32x4Abs) {
-  RunF32x4UnOpTest(lower_simd, kExprF32x4Abs, std::abs);
+  RunF32x4UnOpTest(execution_mode, lower_simd, kExprF32x4Abs, std::abs);
 }
 WASM_SIMD_TEST(F32x4Neg) {
-  RunF32x4UnOpTest(lower_simd, kExprF32x4Neg, Negate);
+  RunF32x4UnOpTest(execution_mode, lower_simd, kExprF32x4Neg, Negate);
 }
 
 static const float kApproxError = 0.01f;
 
 WASM_SIMD_TEST(F32x4RecipApprox) {
-  RunF32x4UnOpTest(lower_simd, kExprF32x4RecipApprox, Recip, kApproxError);
+  RunF32x4UnOpTest(execution_mode, lower_simd, kExprF32x4RecipApprox, Recip,
+                   kApproxError);
 }
 
 WASM_SIMD_TEST(F32x4RecipSqrtApprox) {
-  RunF32x4UnOpTest(lower_simd, kExprF32x4RecipSqrtApprox, RecipSqrt,
-                   kApproxError);
+  RunF32x4UnOpTest(execution_mode, lower_simd, kExprF32x4RecipSqrtApprox,
+                   RecipSqrt, kApproxError);
 }
 
-void RunF32x4BinOpTest(LowerSimd lower_simd, WasmOpcode simd_op,
-                       FloatBinOp expected_op) {
-  WasmRunner<int32_t, float, float, float> r(kExecuteTurbofan, lower_simd);
+void RunF32x4BinOpTest(WasmExecutionMode execution_mode, LowerSimd lower_simd,
+                       WasmOpcode simd_op, FloatBinOp expected_op) {
+  WasmRunner<int32_t, float, float, float> r(execution_mode, lower_simd);
   byte a = 0;
   byte b = 1;
   byte expected = 2;
@@ -537,19 +532,26 @@ void RunF32x4BinOpTest(LowerSimd lower_simd, WasmOpcode simd_op,
   }
 }
 
-WASM_SIMD_TEST(F32x4Add) { RunF32x4BinOpTest(lower_simd, kExprF32x4Add, Add); }
-WASM_SIMD_TEST(F32x4Sub) { RunF32x4BinOpTest(lower_simd, kExprF32x4Sub, Sub); }
-WASM_SIMD_TEST(F32x4Mul) { RunF32x4BinOpTest(lower_simd, kExprF32x4Mul, Mul); }
+WASM_SIMD_TEST(F32x4Add) {
+  RunF32x4BinOpTest(execution_mode, lower_simd, kExprF32x4Add, Add);
+}
+WASM_SIMD_TEST(F32x4Sub) {
+  RunF32x4BinOpTest(execution_mode, lower_simd, kExprF32x4Sub, Sub);
+}
+WASM_SIMD_TEST(F32x4Mul) {
+  RunF32x4BinOpTest(execution_mode, lower_simd, kExprF32x4Mul, Mul);
+}
 WASM_SIMD_TEST(F32x4_Min) {
-  RunF32x4BinOpTest(lower_simd, kExprF32x4Min, JSMin);
+  RunF32x4BinOpTest(execution_mode, lower_simd, kExprF32x4Min, JSMin);
 }
 WASM_SIMD_TEST(F32x4_Max) {
-  RunF32x4BinOpTest(lower_simd, kExprF32x4Max, JSMax);
+  RunF32x4BinOpTest(execution_mode, lower_simd, kExprF32x4Max, JSMax);
 }
 
-void RunF32x4CompareOpTest(LowerSimd lower_simd, WasmOpcode simd_op,
+void RunF32x4CompareOpTest(WasmExecutionMode execution_mode,
+                           LowerSimd lower_simd, WasmOpcode simd_op,
                            FloatCompareOp expected_op) {
-  WasmRunner<int32_t, float, float, int32_t> r(kExecuteTurbofan, lower_simd);
+  WasmRunner<int32_t, float, float, int32_t> r(execution_mode, lower_simd);
   byte a = 0;
   byte b = 1;
   byte expected = 2;
@@ -573,27 +575,27 @@ void RunF32x4CompareOpTest(LowerSimd lower_simd, WasmOpcode simd_op,
 }
 
 WASM_SIMD_TEST(F32x4Eq) {
-  RunF32x4CompareOpTest(lower_simd, kExprF32x4Eq, Equal);
+  RunF32x4CompareOpTest(execution_mode, lower_simd, kExprF32x4Eq, Equal);
 }
 
 WASM_SIMD_TEST(F32x4Ne) {
-  RunF32x4CompareOpTest(lower_simd, kExprF32x4Ne, NotEqual);
+  RunF32x4CompareOpTest(execution_mode, lower_simd, kExprF32x4Ne, NotEqual);
 }
 
 WASM_SIMD_TEST(F32x4Gt) {
-  RunF32x4CompareOpTest(lower_simd, kExprF32x4Gt, Greater);
+  RunF32x4CompareOpTest(execution_mode, lower_simd, kExprF32x4Gt, Greater);
 }
 
 WASM_SIMD_TEST(F32x4Ge) {
-  RunF32x4CompareOpTest(lower_simd, kExprF32x4Ge, GreaterEqual);
+  RunF32x4CompareOpTest(execution_mode, lower_simd, kExprF32x4Ge, GreaterEqual);
 }
 
 WASM_SIMD_TEST(F32x4Lt) {
-  RunF32x4CompareOpTest(lower_simd, kExprF32x4Lt, Less);
+  RunF32x4CompareOpTest(execution_mode, lower_simd, kExprF32x4Lt, Less);
 }
 
 WASM_SIMD_TEST(F32x4Le) {
-  RunF32x4CompareOpTest(lower_simd, kExprF32x4Le, LessEqual);
+  RunF32x4CompareOpTest(execution_mode, lower_simd, kExprF32x4Le, LessEqual);
 }
 
 WASM_SIMD_TEST(I32x4Splat) {
@@ -607,7 +609,7 @@ WASM_SIMD_TEST(I32x4Splat) {
   //   return 0
   //
   // return 1
-  WasmRunner<int32_t, int32_t> r(kExecuteTurbofan, lower_simd);
+  WasmRunner<int32_t, int32_t> r(execution_mode, lower_simd);
   byte lane_val = 0;
   byte simd = r.AllocateLocal(kWasmS128);
   BUILD(r,
@@ -618,7 +620,7 @@ WASM_SIMD_TEST(I32x4Splat) {
 }
 
 WASM_SIMD_TEST(I32x4ReplaceLane) {
-  WasmRunner<int32_t, int32_t, int32_t> r(kExecuteTurbofan, lower_simd);
+  WasmRunner<int32_t, int32_t, int32_t> r(execution_mode, lower_simd);
   byte old_val = 0;
   byte new_val = 1;
   byte simd = r.AllocateLocal(kWasmS128);
@@ -644,7 +646,7 @@ WASM_SIMD_TEST(I32x4ReplaceLane) {
 }
 
 WASM_SIMD_TEST(I16x8Splat) {
-  WasmRunner<int32_t, int32_t> r(kExecuteTurbofan, lower_simd);
+  WasmRunner<int32_t, int32_t> r(execution_mode, lower_simd);
   byte lane_val = 0;
   byte simd = r.AllocateLocal(kWasmS128);
   BUILD(r,
@@ -655,7 +657,7 @@ WASM_SIMD_TEST(I16x8Splat) {
 }
 
 WASM_SIMD_TEST(I16x8ReplaceLane) {
-  WasmRunner<int32_t, int32_t, int32_t> r(kExecuteTurbofan, lower_simd);
+  WasmRunner<int32_t, int32_t, int32_t> r(execution_mode, lower_simd);
   byte old_val = 0;
   byte new_val = 1;
   byte simd = r.AllocateLocal(kWasmS128);
@@ -704,7 +706,7 @@ WASM_SIMD_TEST(I16x8ReplaceLane) {
 }
 
 WASM_SIMD_TEST(I8x16Splat) {
-  WasmRunner<int32_t, int32_t> r(kExecuteTurbofan, lower_simd);
+  WasmRunner<int32_t, int32_t> r(execution_mode, lower_simd);
   byte lane_val = 0;
   byte simd = r.AllocateLocal(kWasmS128);
   BUILD(r,
@@ -715,7 +717,7 @@ WASM_SIMD_TEST(I8x16Splat) {
 }
 
 WASM_SIMD_TEST(I8x16ReplaceLane) {
-  WasmRunner<int32_t, int32_t, int32_t> r(kExecuteTurbofan, lower_simd);
+  WasmRunner<int32_t, int32_t, int32_t> r(execution_mode, lower_simd);
   byte old_val = 0;
   byte new_val = 1;
   byte simd = r.AllocateLocal(kWasmS128);
@@ -819,50 +821,24 @@ WASM_SIMD_TEST(I8x16ReplaceLane) {
 }
 
 #if V8_TARGET_ARCH_ARM || V8_TARGET_ARCH_ARM64 || V8_TARGET_ARCH_MIPS || \
-    V8_TARGET_ARCH_MIPS64
-// Determines if conversion from float to int will be valid.
-bool CanRoundToZeroAndConvert(double val, bool unsigned_integer) {
-  const double max_uint = static_cast<double>(0xFFFFFFFFu);
-  const double max_int = static_cast<double>(kMaxInt);
-  const double min_int = static_cast<double>(kMinInt);
-
-  // Check for NaN.
-  if (val != val) {
-    return false;
-  }
-
-  // Round to zero and check for overflow. This code works because 32 bit
-  // integers can be exactly represented by ieee-754 64bit floating-point
-  // values.
-  return unsigned_integer ? (val < (max_uint + 1.0)) && (val > -1)
-                          : (val < (max_int + 1.0)) && (val > (min_int - 1.0));
-}
-
-int ConvertInvalidValue(double val, bool unsigned_integer) {
-  if (val != val) {
-    return 0;
-  } else {
-    if (unsigned_integer) {
-      return (val < 0) ? 0 : 0xFFFFFFFFu;
-    } else {
-      return (val < 0) ? kMinInt : kMaxInt;
-    }
-  }
-}
+    V8_TARGET_ARCH_MIPS64 || V8_TARGET_ARCH_IA32
 
 int32_t ConvertToInt(double val, bool unsigned_integer) {
-  int32_t result =
-      unsigned_integer ? static_cast<uint32_t>(val) : static_cast<int32_t>(val);
-
-  if (!CanRoundToZeroAndConvert(val, unsigned_integer)) {
-    result = ConvertInvalidValue(val, unsigned_integer);
+  if (std::isnan(val)) return 0;
+  if (unsigned_integer) {
+    if (val < 0) return 0;
+    if (val > kMaxUInt32) return kMaxUInt32;
+    return static_cast<uint32_t>(val);
+  } else {
+    if (val < kMinInt) return kMinInt;
+    if (val > kMaxInt) return kMaxInt;
+    return static_cast<int>(val);
   }
-  return result;
 }
 
 // Tests both signed and unsigned conversion.
 WASM_SIMD_TEST(I32x4ConvertF32x4) {
-  WasmRunner<int32_t, float, int32_t, int32_t> r(kExecuteTurbofan, lower_simd);
+  WasmRunner<int32_t, float, int32_t, int32_t> r(execution_mode, lower_simd);
   byte a = 0;
   byte expected_signed = 1;
   byte expected_unsigned = 2;
@@ -886,36 +862,51 @@ WASM_SIMD_TEST(I32x4ConvertF32x4) {
 }
 
 // Tests both signed and unsigned conversion from I16x8 (unpacking).
-WASM_SIMD_COMPILED_TEST(I32x4ConvertI16x8) {
-  WasmRunner<int32_t, int32_t, int32_t, int32_t> r(kExecuteTurbofan,
-                                                   lower_simd);
+WASM_SIMD_TEST(I32x4ConvertI16x8) {
+  WasmRunner<int32_t, int32_t, int32_t, int32_t, int32_t> r(execution_mode,
+                                                            lower_simd);
   byte a = 0;
   byte unpacked_signed = 1;
   byte unpacked_unsigned = 2;
+  byte zero_value = 3;
   byte simd0 = r.AllocateLocal(kWasmS128);
   byte simd1 = r.AllocateLocal(kWasmS128);
   byte simd2 = r.AllocateLocal(kWasmS128);
+  byte simd3 = r.AllocateLocal(kWasmS128);
+  byte simd4 = r.AllocateLocal(kWasmS128);
   BUILD(r, WASM_SET_LOCAL(simd0, WASM_SIMD_I16x8_SPLAT(WASM_GET_LOCAL(a))),
-        WASM_SET_LOCAL(simd1, WASM_SIMD_UNOP(kExprI32x4SConvertI16x8Low,
+        WASM_SET_LOCAL(
+            simd0, WASM_SIMD_I16x8_REPLACE_LANE(0, WASM_GET_LOCAL(simd0),
+                                                WASM_GET_LOCAL(zero_value))),
+        WASM_SET_LOCAL(simd1, WASM_SIMD_UNOP(kExprI32x4SConvertI16x8High,
                                              WASM_GET_LOCAL(simd0))),
         WASM_SIMD_CHECK_SPLAT4(I32x4, simd1, I32, unpacked_signed),
         WASM_SET_LOCAL(simd2, WASM_SIMD_UNOP(kExprI32x4UConvertI16x8High,
                                              WASM_GET_LOCAL(simd0))),
-        WASM_SIMD_CHECK_SPLAT4(I32x4, simd2, I32, unpacked_unsigned), WASM_ONE);
+        WASM_SIMD_CHECK_SPLAT4(I32x4, simd2, I32, unpacked_unsigned),
+        WASM_SET_LOCAL(simd3, WASM_SIMD_UNOP(kExprI32x4SConvertI16x8Low,
+                                             WASM_GET_LOCAL(simd0))),
+        WASM_SIMD_CHECK4(I32x4, simd3, I32, zero_value, unpacked_signed,
+                         unpacked_signed, unpacked_signed),
+        WASM_SET_LOCAL(simd4, WASM_SIMD_UNOP(kExprI32x4UConvertI16x8Low,
+                                             WASM_GET_LOCAL(simd0))),
+        WASM_SIMD_CHECK4(I32x4, simd4, I32, zero_value, unpacked_unsigned,
+                         unpacked_unsigned, unpacked_unsigned),
+        WASM_ONE);
 
   FOR_INT16_INPUTS(i) {
     int32_t unpacked_signed = static_cast<int32_t>(Widen<int16_t>(*i));
     int32_t unpacked_unsigned =
         static_cast<int32_t>(UnsignedWiden<int16_t>(*i));
-    CHECK_EQ(1, r.Call(*i, unpacked_signed, unpacked_unsigned));
+    CHECK_EQ(1, r.Call(*i, unpacked_signed, unpacked_unsigned, 0));
   }
 }
 #endif  // V8_TARGET_ARCH_ARM || V8_TARGET_ARCH_ARM64 || V8_TARGET_ARCH_MIPS ||
-        // V8_TARGET_ARCH_MIPS64
+        // V8_TARGET_ARCH_MIPS64 || V8_TARGET_ARCH_IA32
 
-void RunI32x4UnOpTest(LowerSimd lower_simd, WasmOpcode simd_op,
-                      Int32UnOp expected_op) {
-  WasmRunner<int32_t, int32_t, int32_t> r(kExecuteTurbofan, lower_simd);
+void RunI32x4UnOpTest(WasmExecutionMode execution_mode, LowerSimd lower_simd,
+                      WasmOpcode simd_op, Int32UnOp expected_op) {
+  WasmRunner<int32_t, int32_t, int32_t> r(execution_mode, lower_simd);
   byte a = 0;
   byte expected = 1;
   byte simd = r.AllocateLocal(kWasmS128);
@@ -927,15 +918,16 @@ void RunI32x4UnOpTest(LowerSimd lower_simd, WasmOpcode simd_op,
 }
 
 WASM_SIMD_TEST(I32x4Neg) {
-  RunI32x4UnOpTest(lower_simd, kExprI32x4Neg, Negate);
+  RunI32x4UnOpTest(execution_mode, lower_simd, kExprI32x4Neg, Negate);
 }
 
-WASM_SIMD_TEST(S128Not) { RunI32x4UnOpTest(lower_simd, kExprS128Not, Not); }
+WASM_SIMD_TEST(S128Not) {
+  RunI32x4UnOpTest(execution_mode, lower_simd, kExprS128Not, Not);
+}
 
-void RunI32x4BinOpTest(LowerSimd lower_simd, WasmOpcode simd_op,
-                       Int32BinOp expected_op) {
-  WasmRunner<int32_t, int32_t, int32_t, int32_t> r(kExecuteTurbofan,
-                                                   lower_simd);
+void RunI32x4BinOpTest(WasmExecutionMode execution_mode, LowerSimd lower_simd,
+                       WasmOpcode simd_op, Int32BinOp expected_op) {
+  WasmRunner<int32_t, int32_t, int32_t, int32_t> r(execution_mode, lower_simd);
   byte a = 0;
   byte b = 1;
   byte expected = 2;
@@ -952,38 +944,52 @@ void RunI32x4BinOpTest(LowerSimd lower_simd, WasmOpcode simd_op,
   }
 }
 
-WASM_SIMD_TEST(I32x4Add) { RunI32x4BinOpTest(lower_simd, kExprI32x4Add, Add); }
+WASM_SIMD_TEST(I32x4Add) {
+  RunI32x4BinOpTest(execution_mode, lower_simd, kExprI32x4Add, Add);
+}
 
-WASM_SIMD_TEST(I32x4Sub) { RunI32x4BinOpTest(lower_simd, kExprI32x4Sub, Sub); }
+WASM_SIMD_TEST(I32x4Sub) {
+  RunI32x4BinOpTest(execution_mode, lower_simd, kExprI32x4Sub, Sub);
+}
 
-WASM_SIMD_TEST(I32x4Mul) { RunI32x4BinOpTest(lower_simd, kExprI32x4Mul, Mul); }
+WASM_SIMD_TEST(I32x4Mul) {
+  RunI32x4BinOpTest(execution_mode, lower_simd, kExprI32x4Mul, Mul);
+}
 
 WASM_SIMD_TEST(I32x4MinS) {
-  RunI32x4BinOpTest(lower_simd, kExprI32x4MinS, Minimum);
+  RunI32x4BinOpTest(execution_mode, lower_simd, kExprI32x4MinS, Minimum);
 }
 
 WASM_SIMD_TEST(I32x4MaxS) {
-  RunI32x4BinOpTest(lower_simd, kExprI32x4MaxS, Maximum);
+  RunI32x4BinOpTest(execution_mode, lower_simd, kExprI32x4MaxS, Maximum);
 }
 
 WASM_SIMD_TEST(I32x4MinU) {
-  RunI32x4BinOpTest(lower_simd, kExprI32x4MinU, UnsignedMinimum);
+  RunI32x4BinOpTest(execution_mode, lower_simd, kExprI32x4MinU,
+                    UnsignedMinimum);
 }
-
 WASM_SIMD_TEST(I32x4MaxU) {
-  RunI32x4BinOpTest(lower_simd, kExprI32x4MaxU, UnsignedMaximum);
+  RunI32x4BinOpTest(execution_mode, lower_simd, kExprI32x4MaxU,
+
+                    UnsignedMaximum);
 }
 
-WASM_SIMD_TEST(S128And) { RunI32x4BinOpTest(lower_simd, kExprS128And, And); }
+WASM_SIMD_TEST(S128And) {
+  RunI32x4BinOpTest(execution_mode, lower_simd, kExprS128And, And);
+}
 
-WASM_SIMD_TEST(S128Or) { RunI32x4BinOpTest(lower_simd, kExprS128Or, Or); }
+WASM_SIMD_TEST(S128Or) {
+  RunI32x4BinOpTest(execution_mode, lower_simd, kExprS128Or, Or);
+}
 
-WASM_SIMD_TEST(S128Xor) { RunI32x4BinOpTest(lower_simd, kExprS128Xor, Xor); }
+WASM_SIMD_TEST(S128Xor) {
+  RunI32x4BinOpTest(execution_mode, lower_simd, kExprS128Xor, Xor);
+}
 
-void RunI32x4CompareOpTest(LowerSimd lower_simd, WasmOpcode simd_op,
+void RunI32x4CompareOpTest(WasmExecutionMode execution_mode,
+                           LowerSimd lower_simd, WasmOpcode simd_op,
                            Int32CompareOp expected_op) {
-  WasmRunner<int32_t, int32_t, int32_t, int32_t> r(kExecuteTurbofan,
-                                                   lower_simd);
+  WasmRunner<int32_t, int32_t, int32_t, int32_t> r(execution_mode, lower_simd);
   byte a = 0;
   byte b = 1;
   byte expected = 2;
@@ -1001,103 +1007,131 @@ void RunI32x4CompareOpTest(LowerSimd lower_simd, WasmOpcode simd_op,
 }
 
 WASM_SIMD_TEST(I32x4Eq) {
-  RunI32x4CompareOpTest(lower_simd, kExprI32x4Eq, Equal);
+  RunI32x4CompareOpTest(execution_mode, lower_simd, kExprI32x4Eq, Equal);
 }
 
 WASM_SIMD_TEST(I32x4Ne) {
-  RunI32x4CompareOpTest(lower_simd, kExprI32x4Ne, NotEqual);
+  RunI32x4CompareOpTest(execution_mode, lower_simd, kExprI32x4Ne, NotEqual);
 }
 
 WASM_SIMD_TEST(I32x4LtS) {
-  RunI32x4CompareOpTest(lower_simd, kExprI32x4LtS, Less);
+  RunI32x4CompareOpTest(execution_mode, lower_simd, kExprI32x4LtS, Less);
 }
 
 WASM_SIMD_TEST(I32x4LeS) {
-  RunI32x4CompareOpTest(lower_simd, kExprI32x4LeS, LessEqual);
+  RunI32x4CompareOpTest(execution_mode, lower_simd, kExprI32x4LeS, LessEqual);
 }
 
 WASM_SIMD_TEST(I32x4GtS) {
-  RunI32x4CompareOpTest(lower_simd, kExprI32x4GtS, Greater);
+  RunI32x4CompareOpTest(execution_mode, lower_simd, kExprI32x4GtS, Greater);
 }
 
 WASM_SIMD_TEST(I32x4GeS) {
-  RunI32x4CompareOpTest(lower_simd, kExprI32x4GeS, GreaterEqual);
+  RunI32x4CompareOpTest(execution_mode, lower_simd, kExprI32x4GeS,
+                        GreaterEqual);
 }
 
 WASM_SIMD_TEST(I32x4LtU) {
-  RunI32x4CompareOpTest(lower_simd, kExprI32x4LtU, UnsignedLess);
+  RunI32x4CompareOpTest(execution_mode, lower_simd, kExprI32x4LtU,
+                        UnsignedLess);
 }
 
 WASM_SIMD_TEST(I32x4LeU) {
-  RunI32x4CompareOpTest(lower_simd, kExprI32x4LeU, UnsignedLessEqual);
+  RunI32x4CompareOpTest(execution_mode, lower_simd, kExprI32x4LeU,
+                        UnsignedLessEqual);
 }
 
 WASM_SIMD_TEST(I32x4GtU) {
-  RunI32x4CompareOpTest(lower_simd, kExprI32x4GtU, UnsignedGreater);
+  RunI32x4CompareOpTest(execution_mode, lower_simd, kExprI32x4GtU,
+                        UnsignedGreater);
 }
 
 WASM_SIMD_TEST(I32x4GeU) {
-  RunI32x4CompareOpTest(lower_simd, kExprI32x4GeU, UnsignedGreaterEqual);
-}
-
-void RunI32x4ShiftOpTest(LowerSimd lower_simd, WasmOpcode simd_op,
-                         Int32ShiftOp expected_op, int shift) {
-  WasmRunner<int32_t, int32_t, int32_t> r(kExecuteTurbofan, lower_simd);
-  byte a = 0;
-  byte expected = 1;
-  byte simd = r.AllocateLocal(kWasmS128);
-  BUILD(r, WASM_SET_LOCAL(simd, WASM_SIMD_I32x4_SPLAT(WASM_GET_LOCAL(a))),
-        WASM_SET_LOCAL(
-            simd, WASM_SIMD_SHIFT_OP(simd_op, shift, WASM_GET_LOCAL(simd))),
-        WASM_SIMD_CHECK_SPLAT4(I32x4, simd, I32, expected), WASM_ONE);
-
-  FOR_INT32_INPUTS(i) { CHECK_EQ(1, r.Call(*i, expected_op(*i, shift))); }
+  RunI32x4CompareOpTest(execution_mode, lower_simd, kExprI32x4GeU,
+                        UnsignedGreaterEqual);
+}
+
+void RunI32x4ShiftOpTest(WasmExecutionMode execution_mode, LowerSimd lower_simd,
+                         WasmOpcode simd_op, Int32ShiftOp expected_op) {
+  for (int shift = 1; shift < 32; ++shift) {
+    WasmRunner<int32_t, int32_t, int32_t> r(execution_mode, lower_simd);
+    byte a = 0;
+    byte expected = 1;
+    byte simd = r.AllocateLocal(kWasmS128);
+    BUILD(r, WASM_SET_LOCAL(simd, WASM_SIMD_I32x4_SPLAT(WASM_GET_LOCAL(a))),
+          WASM_SET_LOCAL(
+              simd, WASM_SIMD_SHIFT_OP(simd_op, shift, WASM_GET_LOCAL(simd))),
+          WASM_SIMD_CHECK_SPLAT4(I32x4, simd, I32, expected), WASM_ONE);
+
+    FOR_INT32_INPUTS(i) { CHECK_EQ(1, r.Call(*i, expected_op(*i, shift))); }
+  }
 }
 
 WASM_SIMD_TEST(I32x4Shl) {
-  RunI32x4ShiftOpTest(lower_simd, kExprI32x4Shl, LogicalShiftLeft, 1);
+  RunI32x4ShiftOpTest(execution_mode, lower_simd, kExprI32x4Shl,
+                      LogicalShiftLeft);
 }
 
 WASM_SIMD_TEST(I32x4ShrS) {
-  RunI32x4ShiftOpTest(lower_simd, kExprI32x4ShrS, ArithmeticShiftRight, 1);
+  RunI32x4ShiftOpTest(execution_mode, lower_simd, kExprI32x4ShrS,
+                      ArithmeticShiftRight);
 }
 
 WASM_SIMD_TEST(I32x4ShrU) {
-  RunI32x4ShiftOpTest(lower_simd, kExprI32x4ShrU, LogicalShiftRight, 1);
+  RunI32x4ShiftOpTest(execution_mode, lower_simd, kExprI32x4ShrU,
+                      LogicalShiftRight);
 }
 
 #if V8_TARGET_ARCH_ARM || V8_TARGET_ARCH_ARM64 || V8_TARGET_ARCH_MIPS || \
-    V8_TARGET_ARCH_MIPS64
+    V8_TARGET_ARCH_MIPS64 || V8_TARGET_ARCH_IA32
 // Tests both signed and unsigned conversion from I8x16 (unpacking).
-WASM_SIMD_COMPILED_TEST(I16x8ConvertI8x16) {
-  WasmRunner<int32_t, int32_t, int32_t, int32_t> r(kExecuteTurbofan,
-                                                   lower_simd);
+WASM_SIMD_TEST(I16x8ConvertI8x16) {
+  WasmRunner<int32_t, int32_t, int32_t, int32_t, int32_t> r(execution_mode,
+                                                            lower_simd);
   byte a = 0;
   byte unpacked_signed = 1;
   byte unpacked_unsigned = 2;
+  byte zero_value = 3;
   byte simd0 = r.AllocateLocal(kWasmS128);
   byte simd1 = r.AllocateLocal(kWasmS128);
   byte simd2 = r.AllocateLocal(kWasmS128);
-  BUILD(r, WASM_SET_LOCAL(simd0, WASM_SIMD_I8x16_SPLAT(WASM_GET_LOCAL(a))),
-        WASM_SET_LOCAL(simd1, WASM_SIMD_UNOP(kExprI16x8SConvertI8x16Low,
-                                             WASM_GET_LOCAL(simd0))),
-        WASM_SIMD_CHECK_SPLAT8(I16x8, simd1, I32, unpacked_signed),
-        WASM_SET_LOCAL(simd2, WASM_SIMD_UNOP(kExprI16x8UConvertI8x16High,
-                                             WASM_GET_LOCAL(simd0))),
-        WASM_SIMD_CHECK_SPLAT8(I16x8, simd2, I32, unpacked_unsigned), WASM_ONE);
+  byte simd3 = r.AllocateLocal(kWasmS128);
+  byte simd4 = r.AllocateLocal(kWasmS128);
+  BUILD(
+      r, WASM_SET_LOCAL(simd0, WASM_SIMD_I8x16_SPLAT(WASM_GET_LOCAL(a))),
+      WASM_SET_LOCAL(simd0,
+                     WASM_SIMD_I8x16_REPLACE_LANE(0, WASM_GET_LOCAL(simd0),
+                                                  WASM_GET_LOCAL(zero_value))),
+      WASM_SET_LOCAL(simd1, WASM_SIMD_UNOP(kExprI16x8SConvertI8x16High,
+                                           WASM_GET_LOCAL(simd0))),
+      WASM_SIMD_CHECK_SPLAT8(I16x8, simd1, I32, unpacked_signed),
+      WASM_SET_LOCAL(simd2, WASM_SIMD_UNOP(kExprI16x8UConvertI8x16High,
+                                           WASM_GET_LOCAL(simd0))),
+      WASM_SIMD_CHECK_SPLAT8(I16x8, simd2, I32, unpacked_unsigned),
+      WASM_SET_LOCAL(simd3, WASM_SIMD_UNOP(kExprI16x8SConvertI8x16Low,
+                                           WASM_GET_LOCAL(simd0))),
+      WASM_SIMD_CHECK8(I16x8, simd3, I32, zero_value, unpacked_signed,
+                       unpacked_signed, unpacked_signed, unpacked_signed,
+                       unpacked_signed, unpacked_signed, unpacked_signed),
+      WASM_SET_LOCAL(simd4, WASM_SIMD_UNOP(kExprI16x8UConvertI8x16Low,
+                                           WASM_GET_LOCAL(simd0))),
+      WASM_SIMD_CHECK8(I16x8, simd4, I32, zero_value, unpacked_unsigned,
+                       unpacked_unsigned, unpacked_unsigned, unpacked_unsigned,
+                       unpacked_unsigned, unpacked_unsigned, unpacked_unsigned),
+      WASM_ONE);
 
   FOR_INT8_INPUTS(i) {
     int32_t unpacked_signed = static_cast<int32_t>(Widen<int8_t>(*i));
     int32_t unpacked_unsigned = static_cast<int32_t>(UnsignedWiden<int8_t>(*i));
-    CHECK_EQ(1, r.Call(*i, unpacked_signed, unpacked_unsigned));
+    CHECK_EQ(1, r.Call(*i, unpacked_signed, unpacked_unsigned, 0));
   }
 }
 #endif  // V8_TARGET_ARCH_ARM || V8_TARGET_ARCH_ARM64 || V8_TARGET_ARCH_MIPS ||
-        // V8_TARGET_ARCH_MIPS64
+        // V8_TARGET_ARCH_MIPS64 || V8_TARGET_ARCH_IA32
 
-void RunI16x8UnOpTest(LowerSimd lower_simd, WasmOpcode simd_op,
-                      Int16UnOp expected_op) {
-  WasmRunner<int32_t, int32_t, int32_t> r(kExecuteTurbofan, lower_simd);
+void RunI16x8UnOpTest(WasmExecutionMode execution_mode, LowerSimd lower_simd,
+                      WasmOpcode simd_op, Int16UnOp expected_op) {
+  WasmRunner<int32_t, int32_t, int32_t> r(execution_mode, lower_simd);
   byte a = 0;
   byte expected = 1;
   byte simd = r.AllocateLocal(kWasmS128);
@@ -1109,46 +1143,61 @@ void RunI16x8UnOpTest(LowerSimd lower_simd, WasmOpcode simd_op,
 }
 
 WASM_SIMD_TEST(I16x8Neg) {
-  RunI16x8UnOpTest(lower_simd, kExprI16x8Neg, Negate);
+  RunI16x8UnOpTest(execution_mode, lower_simd, kExprI16x8Neg, Negate);
 }
 
 #if V8_TARGET_ARCH_ARM || V8_TARGET_ARCH_ARM64 || V8_TARGET_ARCH_MIPS || \
-    V8_TARGET_ARCH_MIPS64
+    V8_TARGET_ARCH_MIPS64 || V8_TARGET_ARCH_IA32
 // Tests both signed and unsigned conversion from I32x4 (packing).
-WASM_SIMD_COMPILED_TEST(I16x8ConvertI32x4) {
-  WasmRunner<int32_t, int32_t, int32_t, int32_t> r(kExecuteTurbofan,
-                                                   lower_simd);
+WASM_SIMD_TEST(I16x8ConvertI32x4) {
+  WasmRunner<int32_t, int32_t, int32_t, int32_t, int32_t, int32_t, int32_t> r(
+      execution_mode, lower_simd);
   byte a = 0;
-  byte packed_signed = 1;
-  byte packed_unsigned = 2;
+  byte b = 1;
+  // indices for packed signed params
+  byte ps_a = 2;
+  byte ps_b = 3;
+  // indices for packed unsigned params
+  byte pu_a = 4;
+  byte pu_b = 5;
   byte simd0 = r.AllocateLocal(kWasmS128);
   byte simd1 = r.AllocateLocal(kWasmS128);
   byte simd2 = r.AllocateLocal(kWasmS128);
   BUILD(r, WASM_SET_LOCAL(simd0, WASM_SIMD_I32x4_SPLAT(WASM_GET_LOCAL(a))),
-        WASM_SET_LOCAL(simd1, WASM_SIMD_BINOP(kExprI16x8SConvertI32x4,
+        WASM_SET_LOCAL(simd1, WASM_SIMD_I32x4_SPLAT(WASM_GET_LOCAL(b))),
+        WASM_SET_LOCAL(simd2, WASM_SIMD_BINOP(kExprI16x8SConvertI32x4,
                                               WASM_GET_LOCAL(simd0),
-                                              WASM_GET_LOCAL(simd0))),
-        WASM_SIMD_CHECK_SPLAT8(I16x8, simd1, I32, packed_signed),
+                                              WASM_GET_LOCAL(simd1))),
+        WASM_SIMD_CHECK8(I16x8, simd2, I32, ps_a, ps_a, ps_a, ps_a, ps_b, ps_b,
+                         ps_b, ps_b),
         WASM_SET_LOCAL(simd2, WASM_SIMD_BINOP(kExprI16x8UConvertI32x4,
                                               WASM_GET_LOCAL(simd0),
-                                              WASM_GET_LOCAL(simd0))),
-        WASM_SIMD_CHECK_SPLAT8(I16x8, simd2, I32, packed_unsigned), WASM_ONE);
+                                              WASM_GET_LOCAL(simd1))),
+        WASM_SIMD_CHECK8(I16x8, simd2, I32, pu_a, pu_a, pu_a, pu_a, pu_b, pu_b,
+                         pu_b, pu_b),
+        WASM_ONE);
 
   FOR_INT32_INPUTS(i) {
-    int32_t packed_signed = Narrow<int16_t>(*i);
-    int32_t packed_unsigned = UnsignedNarrow<int16_t>(*i);
-    // Sign-extend here, since ExtractLane sign extends.
-    if (packed_unsigned & 0x8000) packed_unsigned |= 0xFFFF0000;
-    CHECK_EQ(1, r.Call(*i, packed_signed, packed_unsigned));
+    FOR_INT32_INPUTS(j) {
+      // packed signed values
+      int32_t ps_a = Narrow<int16_t>(*i);
+      int32_t ps_b = Narrow<int16_t>(*j);
+      // packed unsigned values
+      int32_t pu_a = UnsignedNarrow<int16_t>(*i);
+      int32_t pu_b = UnsignedNarrow<int16_t>(*j);
+      // Sign-extend here, since ExtractLane sign extends.
+      if (pu_a & 0x8000) pu_a |= 0xFFFF0000;
+      if (pu_b & 0x8000) pu_b |= 0xFFFF0000;
+      CHECK_EQ(1, r.Call(*i, *j, ps_a, ps_b, pu_a, pu_b));
+    }
   }
 }
 #endif  // V8_TARGET_ARCH_ARM || V8_TARGET_ARCH_ARM64 || V8_TARGET_ARCH_MIPS ||
-        // V8_TARGET_ARCH_MIPS64
+        // V8_TARGET_ARCH_MIPS64 || V8_TARGET_ARCH_IA32
 
-void RunI16x8BinOpTest(LowerSimd lower_simd, WasmOpcode simd_op,
-                       Int16BinOp expected_op) {
-  WasmRunner<int32_t, int32_t, int32_t, int32_t> r(kExecuteTurbofan,
-                                                   lower_simd);
+void RunI16x8BinOpTest(WasmExecutionMode execution_mode, LowerSimd lower_simd,
+                       WasmOpcode simd_op, Int16BinOp expected_op) {
+  WasmRunner<int32_t, int32_t, int32_t, int32_t> r(execution_mode, lower_simd);
   byte a = 0;
   byte b = 1;
   byte expected = 2;
@@ -1165,48 +1214,60 @@ void RunI16x8BinOpTest(LowerSimd lower_simd, WasmOpcode simd_op,
   }
 }
 
-WASM_SIMD_TEST(I16x8Add) { RunI16x8BinOpTest(lower_simd, kExprI16x8Add, Add); }
+WASM_SIMD_TEST(I16x8Add) {
+  RunI16x8BinOpTest(execution_mode, lower_simd, kExprI16x8Add, Add);
+}
 
 WASM_SIMD_TEST(I16x8AddSaturateS) {
-  RunI16x8BinOpTest(lower_simd, kExprI16x8AddSaturateS, AddSaturate);
+  RunI16x8BinOpTest(execution_mode, lower_simd, kExprI16x8AddSaturateS,
+                    AddSaturate);
 }
 
-WASM_SIMD_TEST(I16x8Sub) { RunI16x8BinOpTest(lower_simd, kExprI16x8Sub, Sub); }
+WASM_SIMD_TEST(I16x8Sub) {
+  RunI16x8BinOpTest(execution_mode, lower_simd, kExprI16x8Sub, Sub);
+}
 
 WASM_SIMD_TEST(I16x8SubSaturateS) {
-  RunI16x8BinOpTest(lower_simd, kExprI16x8SubSaturateS, SubSaturate);
+  RunI16x8BinOpTest(execution_mode, lower_simd, kExprI16x8SubSaturateS,
+                    SubSaturate);
 }
 
-WASM_SIMD_TEST(I16x8Mul) { RunI16x8BinOpTest(lower_simd, kExprI16x8Mul, Mul); }
+WASM_SIMD_TEST(I16x8Mul) {
+  RunI16x8BinOpTest(execution_mode, lower_simd, kExprI16x8Mul, Mul);
+}
 
 WASM_SIMD_TEST(I16x8MinS) {
-  RunI16x8BinOpTest(lower_simd, kExprI16x8MinS, Minimum);
+  RunI16x8BinOpTest(execution_mode, lower_simd, kExprI16x8MinS, Minimum);
 }
 
 WASM_SIMD_TEST(I16x8MaxS) {
-  RunI16x8BinOpTest(lower_simd, kExprI16x8MaxS, Maximum);
+  RunI16x8BinOpTest(execution_mode, lower_simd, kExprI16x8MaxS, Maximum);
 }
 
 WASM_SIMD_TEST(I16x8AddSaturateU) {
-  RunI16x8BinOpTest(lower_simd, kExprI16x8AddSaturateU, UnsignedAddSaturate);
+  RunI16x8BinOpTest(execution_mode, lower_simd, kExprI16x8AddSaturateU,
+                    UnsignedAddSaturate);
 }
 
 WASM_SIMD_TEST(I16x8SubSaturateU) {
-  RunI16x8BinOpTest(lower_simd, kExprI16x8SubSaturateU, UnsignedSubSaturate);
+  RunI16x8BinOpTest(execution_mode, lower_simd, kExprI16x8SubSaturateU,
+                    UnsignedSubSaturate);
 }
 
 WASM_SIMD_TEST(I16x8MinU) {
-  RunI16x8BinOpTest(lower_simd, kExprI16x8MinU, UnsignedMinimum);
+  RunI16x8BinOpTest(execution_mode, lower_simd, kExprI16x8MinU,
+                    UnsignedMinimum);
 }
 
 WASM_SIMD_TEST(I16x8MaxU) {
-  RunI16x8BinOpTest(lower_simd, kExprI16x8MaxU, UnsignedMaximum);
+  RunI16x8BinOpTest(execution_mode, lower_simd, kExprI16x8MaxU,
+                    UnsignedMaximum);
 }
 
-void RunI16x8CompareOpTest(LowerSimd lower_simd, WasmOpcode simd_op,
+void RunI16x8CompareOpTest(WasmExecutionMode execution_mode,
+                           LowerSimd lower_simd, WasmOpcode simd_op,
                            Int16CompareOp expected_op) {
-  WasmRunner<int32_t, int32_t, int32_t, int32_t> r(kExecuteTurbofan,
-                                                   lower_simd);
+  WasmRunner<int32_t, int32_t, int32_t, int32_t> r(execution_mode, lower_simd);
   byte a = 0;
   byte b = 1;
   byte expected = 2;
@@ -1224,74 +1285,84 @@ void RunI16x8CompareOpTest(LowerSimd lower_simd, WasmOpcode simd_op,
 }
 
 WASM_SIMD_TEST(I16x8Eq) {
-  RunI16x8CompareOpTest(lower_simd, kExprI16x8Eq, Equal);
+  RunI16x8CompareOpTest(execution_mode, lower_simd, kExprI16x8Eq, Equal);
 }
 
 WASM_SIMD_TEST(I16x8Ne) {
-  RunI16x8CompareOpTest(lower_simd, kExprI16x8Ne, NotEqual);
+  RunI16x8CompareOpTest(execution_mode, lower_simd, kExprI16x8Ne, NotEqual);
 }
 
 WASM_SIMD_TEST(I16x8LtS) {
-  RunI16x8CompareOpTest(lower_simd, kExprI16x8LtS, Less);
+  RunI16x8CompareOpTest(execution_mode, lower_simd, kExprI16x8LtS, Less);
 }
 
 WASM_SIMD_TEST(I16x8LeS) {
-  RunI16x8CompareOpTest(lower_simd, kExprI16x8LeS, LessEqual);
+  RunI16x8CompareOpTest(execution_mode, lower_simd, kExprI16x8LeS, LessEqual);
 }
 
 WASM_SIMD_TEST(I16x8GtS) {
-  RunI16x8CompareOpTest(lower_simd, kExprI16x8GtS, Greater);
+  RunI16x8CompareOpTest(execution_mode, lower_simd, kExprI16x8GtS, Greater);
 }
 
 WASM_SIMD_TEST(I16x8GeS) {
-  RunI16x8CompareOpTest(lower_simd, kExprI16x8GeS, GreaterEqual);
+  RunI16x8CompareOpTest(execution_mode, lower_simd, kExprI16x8GeS,
+                        GreaterEqual);
 }
 
 WASM_SIMD_TEST(I16x8GtU) {
-  RunI16x8CompareOpTest(lower_simd, kExprI16x8GtU, UnsignedGreater);
+  RunI16x8CompareOpTest(execution_mode, lower_simd, kExprI16x8GtU,
+                        UnsignedGreater);
 }
 
 WASM_SIMD_TEST(I16x8GeU) {
-  RunI16x8CompareOpTest(lower_simd, kExprI16x8GeU, UnsignedGreaterEqual);
+  RunI16x8CompareOpTest(execution_mode, lower_simd, kExprI16x8GeU,
+                        UnsignedGreaterEqual);
 }
 
 WASM_SIMD_TEST(I16x8LtU) {
-  RunI16x8CompareOpTest(lower_simd, kExprI16x8LtU, UnsignedLess);
+  RunI16x8CompareOpTest(execution_mode, lower_simd, kExprI16x8LtU,
+                        UnsignedLess);
 }
 
 WASM_SIMD_TEST(I16x8LeU) {
-  RunI16x8CompareOpTest(lower_simd, kExprI16x8LeU, UnsignedLessEqual);
-}
-
-void RunI16x8ShiftOpTest(LowerSimd lower_simd, WasmOpcode simd_op,
-                         Int16ShiftOp expected_op, int shift) {
-  WasmRunner<int32_t, int32_t, int32_t> r(kExecuteTurbofan, lower_simd);
-  byte a = 0;
-  byte expected = 1;
-  byte simd = r.AllocateLocal(kWasmS128);
-  BUILD(r, WASM_SET_LOCAL(simd, WASM_SIMD_I16x8_SPLAT(WASM_GET_LOCAL(a))),
-        WASM_SET_LOCAL(
-            simd, WASM_SIMD_SHIFT_OP(simd_op, shift, WASM_GET_LOCAL(simd))),
-        WASM_SIMD_CHECK_SPLAT8(I16x8, simd, I32, expected), WASM_ONE);
-
-  FOR_INT16_INPUTS(i) { CHECK_EQ(1, r.Call(*i, expected_op(*i, shift))); }
+  RunI16x8CompareOpTest(execution_mode, lower_simd, kExprI16x8LeU,
+                        UnsignedLessEqual);
+}
+
+void RunI16x8ShiftOpTest(WasmExecutionMode execution_mode, LowerSimd lower_simd,
+                         WasmOpcode simd_op, Int16ShiftOp expected_op) {
+  for (int shift = 1; shift < 16; ++shift) {
+    WasmRunner<int32_t, int32_t, int32_t> r(execution_mode, lower_simd);
+    byte a = 0;
+    byte expected = 1;
+    byte simd = r.AllocateLocal(kWasmS128);
+    BUILD(r, WASM_SET_LOCAL(simd, WASM_SIMD_I16x8_SPLAT(WASM_GET_LOCAL(a))),
+          WASM_SET_LOCAL(
+              simd, WASM_SIMD_SHIFT_OP(simd_op, shift, WASM_GET_LOCAL(simd))),
+          WASM_SIMD_CHECK_SPLAT8(I16x8, simd, I32, expected), WASM_ONE);
+
+    FOR_INT16_INPUTS(i) { CHECK_EQ(1, r.Call(*i, expected_op(*i, shift))); }
+  }
 }
 
 WASM_SIMD_TEST(I16x8Shl) {
-  RunI16x8ShiftOpTest(lower_simd, kExprI16x8Shl, LogicalShiftLeft, 1);
+  RunI16x8ShiftOpTest(execution_mode, lower_simd, kExprI16x8Shl,
+                      LogicalShiftLeft);
 }
 
 WASM_SIMD_TEST(I16x8ShrS) {
-  RunI16x8ShiftOpTest(lower_simd, kExprI16x8ShrS, ArithmeticShiftRight, 1);
+  RunI16x8ShiftOpTest(execution_mode, lower_simd, kExprI16x8ShrS,
+                      ArithmeticShiftRight);
 }
 
 WASM_SIMD_TEST(I16x8ShrU) {
-  RunI16x8ShiftOpTest(lower_simd, kExprI16x8ShrU, LogicalShiftRight, 1);
+  RunI16x8ShiftOpTest(execution_mode, lower_simd, kExprI16x8ShrU,
+                      LogicalShiftRight);
 }
 
-void RunI8x16UnOpTest(LowerSimd lower_simd, WasmOpcode simd_op,
-                      Int8UnOp expected_op) {
-  WasmRunner<int32_t, int32_t, int32_t> r(kExecuteTurbofan, lower_simd);
+void RunI8x16UnOpTest(WasmExecutionMode execution_mode, LowerSimd lower_simd,
+                      WasmOpcode simd_op, Int8UnOp expected_op) {
+  WasmRunner<int32_t, int32_t, int32_t> r(execution_mode, lower_simd);
   byte a = 0;
   byte expected = 1;
   byte simd = r.AllocateLocal(kWasmS128);
@@ -1303,46 +1374,63 @@ void RunI8x16UnOpTest(LowerSimd lower_simd, WasmOpcode simd_op,
 }
 
 WASM_SIMD_TEST(I8x16Neg) {
-  RunI8x16UnOpTest(lower_simd, kExprI8x16Neg, Negate);
+  RunI8x16UnOpTest(execution_mode, lower_simd, kExprI8x16Neg, Negate);
 }
 
 #if V8_TARGET_ARCH_ARM || V8_TARGET_ARCH_ARM64 || V8_TARGET_ARCH_MIPS || \
-    V8_TARGET_ARCH_MIPS64
+    V8_TARGET_ARCH_MIPS64 || V8_TARGET_ARCH_IA32
 // Tests both signed and unsigned conversion from I16x8 (packing).
-WASM_SIMD_COMPILED_TEST(I8x16ConvertI16x8) {
-  WasmRunner<int32_t, int32_t, int32_t, int32_t> r(kExecuteTurbofan,
-                                                   lower_simd);
+WASM_SIMD_TEST(I8x16ConvertI16x8) {
+  WasmRunner<int32_t, int32_t, int32_t, int32_t, int32_t, int32_t, int32_t> r(
+      execution_mode, lower_simd);
   byte a = 0;
-  byte packed_signed = 1;
-  byte packed_unsigned = 2;
+  byte b = 1;
+  // indices for packed signed params
+  byte ps_a = 2;
+  byte ps_b = 3;
+  // indices for packed unsigned params
+  byte pu_a = 4;
+  byte pu_b = 5;
   byte simd0 = r.AllocateLocal(kWasmS128);
   byte simd1 = r.AllocateLocal(kWasmS128);
   byte simd2 = r.AllocateLocal(kWasmS128);
   BUILD(r, WASM_SET_LOCAL(simd0, WASM_SIMD_I16x8_SPLAT(WASM_GET_LOCAL(a))),
-        WASM_SET_LOCAL(simd1, WASM_SIMD_BINOP(kExprI8x16SConvertI16x8,
+        WASM_SET_LOCAL(simd1, WASM_SIMD_I16x8_SPLAT(WASM_GET_LOCAL(b))),
+        WASM_SET_LOCAL(simd2, WASM_SIMD_BINOP(kExprI8x16SConvertI16x8,
                                               WASM_GET_LOCAL(simd0),
-                                              WASM_GET_LOCAL(simd0))),
-        WASM_SIMD_CHECK_SPLAT16(I8x16, simd1, I32, packed_signed),
+                                              WASM_GET_LOCAL(simd1))),
+        WASM_SIMD_CHECK16(I8x16, simd2, I32, ps_a, ps_a, ps_a, ps_a, ps_a, ps_a,
+                          ps_a, ps_a, ps_b, ps_b, ps_b, ps_b, ps_b, ps_b, ps_b,
+                          ps_b),
         WASM_SET_LOCAL(simd2, WASM_SIMD_BINOP(kExprI8x16UConvertI16x8,
                                               WASM_GET_LOCAL(simd0),
-                                              WASM_GET_LOCAL(simd0))),
-        WASM_SIMD_CHECK_SPLAT16(I8x16, simd2, I32, packed_unsigned), WASM_ONE);
+                                              WASM_GET_LOCAL(simd1))),
+        WASM_SIMD_CHECK16(I8x16, simd2, I32, pu_a, pu_a, pu_a, pu_a, pu_a, pu_a,
+                          pu_a, pu_a, pu_b, pu_b, pu_b, pu_b, pu_b, pu_b, pu_b,
+                          pu_b),
+        WASM_ONE);
 
   FOR_INT16_INPUTS(i) {
-    int32_t packed_signed = Narrow<int8_t>(*i);
-    int32_t packed_unsigned = UnsignedNarrow<int8_t>(*i);
-    // Sign-extend here, since ExtractLane sign extends.
-    if (packed_unsigned & 0x80) packed_unsigned |= 0xFFFFFF00;
-    CHECK_EQ(1, r.Call(*i, packed_signed, packed_unsigned));
+    FOR_INT16_INPUTS(j) {
+      // packed signed values
+      int32_t ps_a = Narrow<int8_t>(*i);
+      int32_t ps_b = Narrow<int8_t>(*j);
+      // packed unsigned values
+      int32_t pu_a = UnsignedNarrow<int8_t>(*i);
+      int32_t pu_b = UnsignedNarrow<int8_t>(*j);
+      // Sign-extend here, since ExtractLane sign extends.
+      if (pu_a & 0x80) pu_a |= 0xFFFFFF00;
+      if (pu_b & 0x80) pu_b |= 0xFFFFFF00;
+      CHECK_EQ(1, r.Call(*i, *j, ps_a, ps_b, pu_a, pu_b));
+    }
   }
 }
 #endif  // V8_TARGET_ARCH_ARM || V8_TARGET_ARCH_ARM64 || V8_TARGET_ARCH_MIPS ||
-        // V8_TARGET_ARCH_MIPS64
+        // V8_TARGET_ARCH_MIPS64 || V8_TARGET_ARCH_IA32
 
-void RunI8x16BinOpTest(LowerSimd lower_simd, WasmOpcode simd_op,
-                       Int8BinOp expected_op) {
-  WasmRunner<int32_t, int32_t, int32_t, int32_t> r(kExecuteTurbofan,
-                                                   lower_simd);
+void RunI8x16BinOpTest(WasmExecutionMode execution_mode, LowerSimd lower_simd,
+                       WasmOpcode simd_op, Int8BinOp expected_op) {
+  WasmRunner<int32_t, int32_t, int32_t, int32_t> r(execution_mode, lower_simd);
   byte a = 0;
   byte b = 1;
   byte expected = 2;
@@ -1359,46 +1447,56 @@ void RunI8x16BinOpTest(LowerSimd lower_simd, WasmOpcode simd_op,
   }
 }
 
-WASM_SIMD_TEST(I8x16Add) { RunI8x16BinOpTest(lower_simd, kExprI8x16Add, Add); }
+WASM_SIMD_TEST(I8x16Add) {
+  RunI8x16BinOpTest(execution_mode, lower_simd, kExprI8x16Add, Add);
+}
 
 WASM_SIMD_TEST(I8x16AddSaturateS) {
-  RunI8x16BinOpTest(lower_simd, kExprI8x16AddSaturateS, AddSaturate);
+  RunI8x16BinOpTest(execution_mode, lower_simd, kExprI8x16AddSaturateS,
+                    AddSaturate);
 }
 
-WASM_SIMD_TEST(I8x16Sub) { RunI8x16BinOpTest(lower_simd, kExprI8x16Sub, Sub); }
+WASM_SIMD_TEST(I8x16Sub) {
+  RunI8x16BinOpTest(execution_mode, lower_simd, kExprI8x16Sub, Sub);
+}
 
 WASM_SIMD_TEST(I8x16SubSaturateS) {
-  RunI8x16BinOpTest(lower_simd, kExprI8x16SubSaturateS, SubSaturate);
+  RunI8x16BinOpTest(execution_mode, lower_simd, kExprI8x16SubSaturateS,
+                    SubSaturate);
 }
 
 WASM_SIMD_TEST(I8x16MinS) {
-  RunI8x16BinOpTest(lower_simd, kExprI8x16MinS, Minimum);
+  RunI8x16BinOpTest(execution_mode, lower_simd, kExprI8x16MinS, Minimum);
 }
 
 WASM_SIMD_TEST(I8x16MaxS) {
-  RunI8x16BinOpTest(lower_simd, kExprI8x16MaxS, Maximum);
+  RunI8x16BinOpTest(execution_mode, lower_simd, kExprI8x16MaxS, Maximum);
 }
 
 WASM_SIMD_TEST(I8x16AddSaturateU) {
-  RunI8x16BinOpTest(lower_simd, kExprI8x16AddSaturateU, UnsignedAddSaturate);
+  RunI8x16BinOpTest(execution_mode, lower_simd, kExprI8x16AddSaturateU,
+                    UnsignedAddSaturate);
 }
 
 WASM_SIMD_TEST(I8x16SubSaturateU) {
-  RunI8x16BinOpTest(lower_simd, kExprI8x16SubSaturateU, UnsignedSubSaturate);
+  RunI8x16BinOpTest(execution_mode, lower_simd, kExprI8x16SubSaturateU,
+                    UnsignedSubSaturate);
 }
 
 WASM_SIMD_TEST(I8x16MinU) {
-  RunI8x16BinOpTest(lower_simd, kExprI8x16MinU, UnsignedMinimum);
+  RunI8x16BinOpTest(execution_mode, lower_simd, kExprI8x16MinU,
+                    UnsignedMinimum);
 }
 
 WASM_SIMD_TEST(I8x16MaxU) {
-  RunI8x16BinOpTest(lower_simd, kExprI8x16MaxU, UnsignedMaximum);
+  RunI8x16BinOpTest(execution_mode, lower_simd, kExprI8x16MaxU,
+                    UnsignedMaximum);
 }
 
-void RunI8x16CompareOpTest(LowerSimd lower_simd, WasmOpcode simd_op,
+void RunI8x16CompareOpTest(WasmExecutionMode execution_mode,
+                           LowerSimd lower_simd, WasmOpcode simd_op,
                            Int8CompareOp expected_op) {
-  WasmRunner<int32_t, int32_t, int32_t, int32_t> r(kExecuteTurbofan,
-                                                   lower_simd);
+  WasmRunner<int32_t, int32_t, int32_t, int32_t> r(execution_mode, lower_simd);
   byte a = 0;
   byte b = 1;
   byte expected = 2;
@@ -1416,77 +1514,89 @@ void RunI8x16CompareOpTest(LowerSimd lower_simd, WasmOpcode simd_op,
 }
 
 WASM_SIMD_TEST(I8x16Eq) {
-  RunI8x16CompareOpTest(lower_simd, kExprI8x16Eq, Equal);
+  RunI8x16CompareOpTest(execution_mode, lower_simd, kExprI8x16Eq, Equal);
 }
 
 WASM_SIMD_TEST(I8x16Ne) {
-  RunI8x16CompareOpTest(lower_simd, kExprI8x16Ne, NotEqual);
+  RunI8x16CompareOpTest(execution_mode, lower_simd, kExprI8x16Ne, NotEqual);
 }
 
 WASM_SIMD_TEST(I8x16GtS) {
-  RunI8x16CompareOpTest(lower_simd, kExprI8x16GtS, Greater);
+  RunI8x16CompareOpTest(execution_mode, lower_simd, kExprI8x16GtS, Greater);
 }
 
 WASM_SIMD_TEST(I8x16GeS) {
-  RunI8x16CompareOpTest(lower_simd, kExprI8x16GeS, GreaterEqual);
+  RunI8x16CompareOpTest(execution_mode, lower_simd, kExprI8x16GeS,
+                        GreaterEqual);
 }
 
 WASM_SIMD_TEST(I8x16LtS) {
-  RunI8x16CompareOpTest(lower_simd, kExprI8x16LtS, Less);
+  RunI8x16CompareOpTest(execution_mode, lower_simd, kExprI8x16LtS, Less);
 }
 
 WASM_SIMD_TEST(I8x16LeS) {
-  RunI8x16CompareOpTest(lower_simd, kExprI8x16LeS, LessEqual);
+  RunI8x16CompareOpTest(execution_mode, lower_simd, kExprI8x16LeS, LessEqual);
 }
 
 WASM_SIMD_TEST(I8x16GtU) {
-  RunI8x16CompareOpTest(lower_simd, kExprI8x16GtU, UnsignedGreater);
+  RunI8x16CompareOpTest(execution_mode, lower_simd, kExprI8x16GtU,
+                        UnsignedGreater);
 }
 
 WASM_SIMD_TEST(I8x16GeU) {
-  RunI8x16CompareOpTest(lower_simd, kExprI8x16GeU, UnsignedGreaterEqual);
+  RunI8x16CompareOpTest(execution_mode, lower_simd, kExprI8x16GeU,
+                        UnsignedGreaterEqual);
 }
 
 WASM_SIMD_TEST(I8x16LtU) {
-  RunI8x16CompareOpTest(lower_simd, kExprI8x16LtU, UnsignedLess);
+  RunI8x16CompareOpTest(execution_mode, lower_simd, kExprI8x16LtU,
+                        UnsignedLess);
 }
 
 WASM_SIMD_TEST(I8x16LeU) {
-  RunI8x16CompareOpTest(lower_simd, kExprI8x16LeU, UnsignedLessEqual);
+  RunI8x16CompareOpTest(execution_mode, lower_simd, kExprI8x16LeU,
+                        UnsignedLessEqual);
 }
 
 #if V8_TARGET_ARCH_ARM || V8_TARGET_ARCH_ARM64 || V8_TARGET_ARCH_MIPS || \
     V8_TARGET_ARCH_MIPS64 || V8_TARGET_ARCH_IA32
-WASM_SIMD_TEST(I8x16Mul) { RunI8x16BinOpTest(lower_simd, kExprI8x16Mul, Mul); }
+WASM_SIMD_TEST(I8x16Mul) {
+  RunI8x16BinOpTest(execution_mode, lower_simd, kExprI8x16Mul, Mul);
+}
 #endif  // V8_TARGET_ARCH_ARM || V8_TARGET_ARCH_ARM64 || V8_TARGET_ARCH_MIPS ||
         // V8_TARGET_ARCH_MIPS64 || V8_TARGET_ARCH_IA32
 
-void RunI8x16ShiftOpTest(LowerSimd lower_simd, WasmOpcode simd_op,
-                         Int8ShiftOp expected_op, int shift) {
-  WasmRunner<int32_t, int32_t, int32_t> r(kExecuteTurbofan, lower_simd);
-  byte a = 0;
-  byte expected = 1;
-  byte simd = r.AllocateLocal(kWasmS128);
-  BUILD(r, WASM_SET_LOCAL(simd, WASM_SIMD_I8x16_SPLAT(WASM_GET_LOCAL(a))),
-        WASM_SET_LOCAL(
-            simd, WASM_SIMD_SHIFT_OP(simd_op, shift, WASM_GET_LOCAL(simd))),
-        WASM_SIMD_CHECK_SPLAT16(I8x16, simd, I32, expected), WASM_ONE);
-
-  FOR_INT8_INPUTS(i) { CHECK_EQ(1, r.Call(*i, expected_op(*i, shift))); }
+void RunI8x16ShiftOpTest(WasmExecutionMode execution_mode, LowerSimd lower_simd,
+                         WasmOpcode simd_op, Int8ShiftOp expected_op) {
+  for (int shift = 1; shift < 8; ++shift) {
+    WasmRunner<int32_t, int32_t, int32_t> r(execution_mode, lower_simd);
+    byte a = 0;
+    byte expected = 1;
+    byte simd = r.AllocateLocal(kWasmS128);
+    BUILD(r, WASM_SET_LOCAL(simd, WASM_SIMD_I8x16_SPLAT(WASM_GET_LOCAL(a))),
+          WASM_SET_LOCAL(
+              simd, WASM_SIMD_SHIFT_OP(simd_op, shift, WASM_GET_LOCAL(simd))),
+          WASM_SIMD_CHECK_SPLAT16(I8x16, simd, I32, expected), WASM_ONE);
+
+    FOR_INT8_INPUTS(i) { CHECK_EQ(1, r.Call(*i, expected_op(*i, shift))); }
+  }
 }
 
 #if V8_TARGET_ARCH_ARM || V8_TARGET_ARCH_ARM64 || V8_TARGET_ARCH_MIPS || \
     V8_TARGET_ARCH_MIPS64 || V8_TARGET_ARCH_IA32
 WASM_SIMD_TEST(I8x16Shl) {
-  RunI8x16ShiftOpTest(lower_simd, kExprI8x16Shl, LogicalShiftLeft, 1);
+  RunI8x16ShiftOpTest(execution_mode, lower_simd, kExprI8x16Shl,
+                      LogicalShiftLeft);
 }
 
 WASM_SIMD_TEST(I8x16ShrS) {
-  RunI8x16ShiftOpTest(lower_simd, kExprI8x16ShrS, ArithmeticShiftRight, 1);
+  RunI8x16ShiftOpTest(execution_mode, lower_simd, kExprI8x16ShrS,
+                      ArithmeticShiftRight);
 }
 
 WASM_SIMD_TEST(I8x16ShrU) {
-  RunI8x16ShiftOpTest(lower_simd, kExprI8x16ShrU, LogicalShiftRight, 1);
+  RunI8x16ShiftOpTest(execution_mode, lower_simd, kExprI8x16ShrU,
+                      LogicalShiftRight);
 }
 #endif  // V8_TARGET_ARCH_ARM || V8_TARGET_ARCH_ARM64 || V8_TARGET_ARCH_MIPS ||
         // V8_TARGET_ARCH_MIPS64 || V8_TARGET_ARCH_IA32
@@ -1496,7 +1606,7 @@ WASM_SIMD_TEST(I8x16ShrU) {
 // vector.
 #define WASM_SIMD_SELECT_TEST(format)                                        \
   WASM_SIMD_TEST(S##format##Select) {                                        \
-    WasmRunner<int32_t, int32_t, int32_t> r(kExecuteTurbofan, lower_simd);   \
+    WasmRunner<int32_t, int32_t, int32_t> r(execution_mode, lower_simd);     \
     byte val1 = 0;                                                           \
     byte val2 = 1;                                                           \
     byte src1 = r.AllocateLocal(kWasmS128);                                  \
@@ -1536,7 +1646,7 @@ WASM_SIMD_SELECT_TEST(8x16)
 // rest 0. The mask is not the result of a comparison op.
 #define WASM_SIMD_NON_CANONICAL_SELECT_TEST(format)                           \
   WASM_SIMD_TEST(S##format##NonCanonicalSelect) {                             \
-    WasmRunner<int32_t, int32_t, int32_t, int32_t> r(kExecuteTurbofan,        \
+    WasmRunner<int32_t, int32_t, int32_t, int32_t> r(execution_mode,          \
                                                      lower_simd);             \
     byte val1 = 0;                                                            \
     byte val2 = 1;                                                            \
@@ -1573,9 +1683,9 @@ WASM_SIMD_NON_CANONICAL_SELECT_TEST(8x16)
 // Test binary ops with two lane test patterns, all lanes distinct.
 template <typename T>
 void RunBinaryLaneOpTest(
-    LowerSimd lower_simd, WasmOpcode simd_op,
+    WasmExecutionMode execution_mode, LowerSimd lower_simd, WasmOpcode simd_op,
     const std::array<T, kSimd128Size / sizeof(T)>& expected) {
-  WasmRunner<int32_t> r(kExecuteTurbofan, lower_simd);
+  WasmRunner<int32_t> r(execution_mode, lower_simd);
   // Set up two test patterns as globals, e.g. [0, 1, 2, 3] and [4, 5, 6, 7].
   T* src0 = r.builder().AddGlobal<T>(kWasmS128);
   T* src1 = r.builder().AddGlobal<T>(kWasmS128);
@@ -1604,306 +1714,266 @@ void RunBinaryLaneOpTest(
 }
 
 WASM_SIMD_TEST(I32x4AddHoriz) {
-  RunBinaryLaneOpTest<int32_t>(lower_simd, kExprI32x4AddHoriz, {{1, 5, 9, 13}});
+  RunBinaryLaneOpTest<int32_t>(execution_mode, lower_simd, kExprI32x4AddHoriz,
+                               {{1, 5, 9, 13}});
 }
 
 WASM_SIMD_TEST(I16x8AddHoriz) {
-  RunBinaryLaneOpTest<int16_t>(lower_simd, kExprI16x8AddHoriz,
+  RunBinaryLaneOpTest<int16_t>(execution_mode, lower_simd, kExprI16x8AddHoriz,
                                {{1, 5, 9, 13, 17, 21, 25, 29}});
 }
 
 WASM_SIMD_TEST(F32x4AddHoriz) {
-  RunBinaryLaneOpTest<float>(lower_simd, kExprF32x4AddHoriz,
+  RunBinaryLaneOpTest<float>(execution_mode, lower_simd, kExprF32x4AddHoriz,
                              {{1.0f, 5.0f, 9.0f, 13.0f}});
 }
 
+// Test shuffle ops.
+template <typename T>
+void RunShuffleOpTest(WasmExecutionMode execution_mode, LowerSimd lower_simd,
+                      WasmOpcode simd_op,
+                      const std::array<T, kSimd128Size / sizeof(T)>& shuffle) {
+  // Test the original shuffle.
+  RunBinaryLaneOpTest<T>(execution_mode, lower_simd, simd_op, shuffle);
+
+  // Test a non-canonical (inputs reversed) version of the shuffle.
+  std::array<T, kSimd128Size / sizeof(T)> other_shuffle(shuffle);
+  for (size_t i = 0; i < shuffle.size(); ++i) other_shuffle[i] ^= kSimd128Size;
+  RunBinaryLaneOpTest<T>(execution_mode, lower_simd, simd_op, other_shuffle);
+
+  // Test the swizzle (one-operand) version of the shuffle.
+  std::array<T, kSimd128Size / sizeof(T)> swizzle(shuffle);
+  for (size_t i = 0; i < shuffle.size(); ++i) swizzle[i] &= (kSimd128Size - 1);
+  RunBinaryLaneOpTest<T>(execution_mode, lower_simd, simd_op, swizzle);
+
+  // Test the non-canonical swizzle (one-operand) version of the shuffle.
+  std::array<T, kSimd128Size / sizeof(T)> other_swizzle(shuffle);
+  for (size_t i = 0; i < shuffle.size(); ++i) other_swizzle[i] |= kSimd128Size;
+  RunBinaryLaneOpTest<T>(execution_mode, lower_simd, simd_op, other_swizzle);
+}
+
 #if V8_TARGET_ARCH_ARM || V8_TARGET_ARCH_ARM64 || V8_TARGET_ARCH_MIPS || \
     V8_TARGET_ARCH_MIPS64 || V8_TARGET_ARCH_IA32
 // Test some regular shuffles that may have special handling on some targets.
-// Test a normal and unary versions (where second operand isn't used).
 WASM_SIMD_TEST(S32x4Dup) {
-  RunBinaryLaneOpTest<int8_t>(
-      lower_simd, kExprS8x16Shuffle,
+  RunShuffleOpTest<int8_t>(
+      execution_mode, lower_simd, kExprS8x16Shuffle,
       {{16, 17, 18, 19, 16, 17, 18, 19, 16, 17, 18, 19, 16, 17, 18, 19}});
-  RunBinaryLaneOpTest<int8_t>(
-      lower_simd, kExprS8x16Shuffle,
-      {{4, 5, 6, 7, 4, 5, 6, 7, 4, 5, 6, 7, 4, 5, 6, 7}});
 }
 
 WASM_SIMD_TEST(S32x4ZipLeft) {
-  RunBinaryLaneOpTest<int8_t>(
-      lower_simd, kExprS8x16Shuffle,
+  RunShuffleOpTest<int8_t>(
+      execution_mode, lower_simd, kExprS8x16Shuffle,
       {{0, 1, 2, 3, 16, 17, 18, 19, 4, 5, 6, 7, 20, 21, 22, 23}});
-  RunBinaryLaneOpTest<int8_t>(
-      lower_simd, kExprS8x16Shuffle,
-      {{0, 1, 2, 3, 0, 1, 2, 3, 4, 5, 6, 7, 4, 5, 6, 7}});
 }
 
 WASM_SIMD_TEST(S32x4ZipRight) {
-  RunBinaryLaneOpTest<int8_t>(
-      lower_simd, kExprS8x16Shuffle,
+  RunShuffleOpTest<int8_t>(
+      execution_mode, lower_simd, kExprS8x16Shuffle,
       {{8, 9, 10, 11, 24, 25, 26, 27, 12, 13, 14, 15, 28, 29, 30, 31}});
-  RunBinaryLaneOpTest<int8_t>(
-      lower_simd, kExprS8x16Shuffle,
-      {{8, 9, 10, 11, 8, 9, 10, 11, 12, 13, 14, 15, 12, 13, 14, 15}});
 }
 
 WASM_SIMD_TEST(S32x4UnzipLeft) {
-  RunBinaryLaneOpTest<int8_t>(
-      lower_simd, kExprS8x16Shuffle,
+  RunShuffleOpTest<int8_t>(
+      execution_mode, lower_simd, kExprS8x16Shuffle,
       {{0, 1, 2, 3, 8, 9, 10, 11, 16, 17, 18, 19, 24, 25, 26, 27}});
-  RunBinaryLaneOpTest<int8_t>(
-      lower_simd, kExprS8x16Shuffle,
-      {{0, 1, 2, 3, 8, 9, 10, 11, 0, 1, 2, 3, 8, 9, 10, 11}});
 }
 
 WASM_SIMD_TEST(S32x4UnzipRight) {
-  RunBinaryLaneOpTest<int8_t>(
-      lower_simd, kExprS8x16Shuffle,
+  RunShuffleOpTest<int8_t>(
+      execution_mode, lower_simd, kExprS8x16Shuffle,
       {{4, 5, 6, 7, 12, 13, 14, 15, 20, 21, 22, 23, 28, 29, 30, 31}});
-  RunBinaryLaneOpTest<int8_t>(
-      lower_simd, kExprS8x16Shuffle,
-      {{4, 5, 6, 7, 12, 13, 14, 15, 4, 5, 6, 7, 12, 13, 14, 15}});
 }
 
 WASM_SIMD_TEST(S32x4TransposeLeft) {
-  RunBinaryLaneOpTest<int8_t>(
-      lower_simd, kExprS8x16Shuffle,
+  RunShuffleOpTest<int8_t>(
+      execution_mode, lower_simd, kExprS8x16Shuffle,
       {{0, 1, 2, 3, 16, 17, 18, 19, 8, 9, 10, 11, 24, 25, 26, 27}});
-  RunBinaryLaneOpTest<int8_t>(
-      lower_simd, kExprS8x16Shuffle,
-      {{0, 1, 2, 3, 0, 1, 2, 3, 8, 9, 10, 11, 8, 9, 10, 11}});
 }
 
 WASM_SIMD_TEST(S32x4TransposeRight) {
-  RunBinaryLaneOpTest<int8_t>(
-      lower_simd, kExprS8x16Shuffle,
+  RunShuffleOpTest<int8_t>(
+      execution_mode, lower_simd, kExprS8x16Shuffle,
       {{4, 5, 6, 7, 20, 21, 22, 23, 12, 13, 14, 15, 28, 29, 30, 31}});
-  RunBinaryLaneOpTest<int8_t>(
-      lower_simd, kExprS8x16Shuffle,
-      {{4, 5, 6, 7, 4, 5, 6, 7, 12, 13, 14, 15, 12, 13, 14, 15}});
 }
 
 // Reverses are only unary.
 WASM_SIMD_TEST(S32x2Reverse) {
-  RunBinaryLaneOpTest<int8_t>(
-      lower_simd, kExprS8x16Shuffle,
+  RunShuffleOpTest<int8_t>(
+      execution_mode, lower_simd, kExprS8x16Shuffle,
       {{4, 5, 6, 7, 0, 1, 2, 3, 12, 13, 14, 15, 8, 9, 10, 11}});
 }
 
 // Test irregular shuffle.
 WASM_SIMD_TEST(S32x4Irregular) {
-  RunBinaryLaneOpTest<int8_t>(
-      lower_simd, kExprS8x16Shuffle,
+  RunShuffleOpTest<int8_t>(
+      execution_mode, lower_simd, kExprS8x16Shuffle,
       {{0, 1, 2, 3, 16, 17, 18, 19, 16, 17, 18, 19, 20, 21, 22, 23}});
-  RunBinaryLaneOpTest<int8_t>(
-      lower_simd, kExprS8x16Shuffle,
-      {{0, 1, 2, 3, 0, 1, 2, 3, 0, 1, 2, 3, 4, 5, 6, 7}});
 }
 
 WASM_SIMD_TEST(S16x8Dup) {
-  RunBinaryLaneOpTest<int8_t>(
-      lower_simd, kExprS8x16Shuffle,
+  RunShuffleOpTest<int8_t>(
+      execution_mode, lower_simd, kExprS8x16Shuffle,
       {{18, 19, 18, 19, 18, 19, 18, 19, 18, 19, 18, 19, 18, 19, 18, 19}});
-  RunBinaryLaneOpTest<int8_t>(
-      lower_simd, kExprS8x16Shuffle,
-      {{6, 7, 6, 7, 6, 7, 6, 7, 6, 7, 6, 7, 6, 7, 6, 7}});
 }
 
 WASM_SIMD_TEST(S16x8ZipLeft) {
-  RunBinaryLaneOpTest<int8_t>(
-      lower_simd, kExprS8x16Shuffle,
+  RunShuffleOpTest<int8_t>(
+      execution_mode, lower_simd, kExprS8x16Shuffle,
       {{0, 1, 16, 17, 2, 3, 18, 19, 4, 5, 20, 21, 6, 7, 22, 23}});
-  RunBinaryLaneOpTest<int8_t>(
-      lower_simd, kExprS8x16Shuffle,
-      {{0, 1, 0, 1, 2, 3, 2, 3, 4, 5, 4, 5, 6, 7, 6, 7}});
 }
 
 WASM_SIMD_TEST(S16x8ZipRight) {
-  RunBinaryLaneOpTest<int8_t>(
-      lower_simd, kExprS8x16Shuffle,
+  RunShuffleOpTest<int8_t>(
+      execution_mode, lower_simd, kExprS8x16Shuffle,
       {{8, 9, 24, 25, 10, 11, 26, 27, 12, 13, 28, 29, 14, 15, 30, 31}});
-  RunBinaryLaneOpTest<int8_t>(
-      lower_simd, kExprS8x16Shuffle,
-      {{8, 9, 8, 9, 10, 11, 10, 11, 12, 13, 12, 13, 14, 15, 14, 15}});
 }
 
 WASM_SIMD_TEST(S16x8UnzipLeft) {
-  RunBinaryLaneOpTest<int8_t>(
-      lower_simd, kExprS8x16Shuffle,
+  RunShuffleOpTest<int8_t>(
+      execution_mode, lower_simd, kExprS8x16Shuffle,
       {{0, 1, 4, 5, 8, 9, 12, 13, 16, 17, 20, 21, 24, 25, 28, 29}});
-  RunBinaryLaneOpTest<int8_t>(
-      lower_simd, kExprS8x16Shuffle,
-      {{0, 1, 4, 5, 8, 9, 12, 13, 0, 1, 4, 5, 8, 9, 12, 13}});
 }
 
 WASM_SIMD_TEST(S16x8UnzipRight) {
-  RunBinaryLaneOpTest<int8_t>(
-      lower_simd, kExprS8x16Shuffle,
+  RunShuffleOpTest<int8_t>(
+      execution_mode, lower_simd, kExprS8x16Shuffle,
       {{2, 3, 6, 7, 10, 11, 14, 15, 18, 19, 22, 23, 26, 27, 30, 31}});
-  RunBinaryLaneOpTest<int8_t>(
-      lower_simd, kExprS8x16Shuffle,
-      {{2, 3, 6, 7, 10, 11, 14, 15, 2, 3, 6, 7, 10, 11, 14, 15}});
 }
 
 WASM_SIMD_TEST(S16x8TransposeLeft) {
-  RunBinaryLaneOpTest<int8_t>(
-      lower_simd, kExprS8x16Shuffle,
+  RunShuffleOpTest<int8_t>(
+      execution_mode, lower_simd, kExprS8x16Shuffle,
       {{0, 1, 16, 17, 4, 5, 20, 21, 8, 9, 24, 25, 12, 13, 28, 29}});
-  RunBinaryLaneOpTest<int8_t>(
-      lower_simd, kExprS8x16Shuffle,
-      {{0, 1, 0, 1, 4, 5, 4, 5, 8, 9, 8, 9, 12, 13, 12, 13}});
 }
 
 WASM_SIMD_TEST(S16x8TransposeRight) {
-  RunBinaryLaneOpTest<int8_t>(
-      lower_simd, kExprS8x16Shuffle,
+  RunShuffleOpTest<int8_t>(
+      execution_mode, lower_simd, kExprS8x16Shuffle,
       {{2, 3, 18, 19, 6, 7, 22, 23, 10, 11, 26, 27, 14, 15, 30, 31}});
-  RunBinaryLaneOpTest<int8_t>(
-      lower_simd, kExprS8x16Shuffle,
-      {{2, 3, 2, 3, 6, 7, 6, 7, 10, 11, 10, 11, 14, 15, 14, 15}});
 }
 
+// TODO(simd) 'Reverse' tests should be 2-operand shuffles, not swizzles.
 WASM_SIMD_TEST(S16x4Reverse) {
-  RunBinaryLaneOpTest<int8_t>(
-      lower_simd, kExprS8x16Shuffle,
+  RunShuffleOpTest<int8_t>(
+      execution_mode, lower_simd, kExprS8x16Shuffle,
       {{6, 7, 4, 5, 2, 3, 0, 1, 14, 15, 12, 13, 10, 11, 8, 9}});
 }
 
 WASM_SIMD_TEST(S16x2Reverse) {
-  RunBinaryLaneOpTest<int8_t>(
-      lower_simd, kExprS8x16Shuffle,
+  RunShuffleOpTest<int8_t>(
+      execution_mode, lower_simd, kExprS8x16Shuffle,
       {{2, 3, 0, 1, 6, 7, 4, 5, 10, 11, 8, 9, 14, 15, 12, 13}});
 }
 
 WASM_SIMD_TEST(S16x8Irregular) {
-  RunBinaryLaneOpTest<int8_t>(
-      lower_simd, kExprS8x16Shuffle,
+  RunShuffleOpTest<int8_t>(
+      execution_mode, lower_simd, kExprS8x16Shuffle,
       {{0, 1, 16, 17, 16, 17, 0, 1, 4, 5, 20, 21, 6, 7, 22, 23}});
-  RunBinaryLaneOpTest<int8_t>(
-      lower_simd, kExprS8x16Shuffle,
-      {{0, 1, 0, 1, 0, 1, 0, 1, 4, 5, 4, 5, 6, 7, 6, 7}});
 }
 
 WASM_SIMD_TEST(S8x16Dup) {
-  RunBinaryLaneOpTest<int8_t>(
-      lower_simd, kExprS8x16Shuffle,
+  RunShuffleOpTest<int8_t>(
+      execution_mode, lower_simd, kExprS8x16Shuffle,
       {{19, 19, 19, 19, 19, 19, 19, 19, 19, 19, 19, 19, 19, 19, 19, 19}});
-  RunBinaryLaneOpTest<int8_t>(
-      lower_simd, kExprS8x16Shuffle,
-      {{7, 7, 7, 7, 7, 7, 7, 7, 7, 7, 7, 7, 7, 7, 7, 7}});
 }
 
 WASM_SIMD_TEST(S8x16ZipLeft) {
-  RunBinaryLaneOpTest<int8_t>(
-      lower_simd, kExprS8x16Shuffle,
+  RunShuffleOpTest<int8_t>(
+      execution_mode, lower_simd, kExprS8x16Shuffle,
       {{0, 16, 1, 17, 2, 18, 3, 19, 4, 20, 5, 21, 6, 22, 7, 23}});
-  RunBinaryLaneOpTest<int8_t>(
-      lower_simd, kExprS8x16Shuffle,
-      {{0, 0, 1, 1, 2, 2, 3, 3, 4, 4, 5, 5, 6, 6, 7, 7}});
 }
 
 WASM_SIMD_TEST(S8x16ZipRight) {
-  RunBinaryLaneOpTest<int8_t>(
-      lower_simd, kExprS8x16Shuffle,
+  RunShuffleOpTest<int8_t>(
+      execution_mode, lower_simd, kExprS8x16Shuffle,
       {{8, 24, 9, 25, 10, 26, 11, 27, 12, 28, 13, 29, 14, 30, 15, 31}});
-  RunBinaryLaneOpTest<int8_t>(
-      lower_simd, kExprS8x16Shuffle,
-      {{8, 8, 9, 9, 10, 10, 11, 11, 12, 12, 13, 13, 14, 14, 15, 15}});
 }
 
 WASM_SIMD_TEST(S8x16UnzipLeft) {
-  RunBinaryLaneOpTest<int8_t>(
-      lower_simd, kExprS8x16Shuffle,
+  RunShuffleOpTest<int8_t>(
+      execution_mode, lower_simd, kExprS8x16Shuffle,
       {{0, 2, 4, 6, 8, 10, 12, 14, 16, 18, 20, 22, 24, 26, 28, 30}});
-  RunBinaryLaneOpTest<int8_t>(
-      lower_simd, kExprS8x16Shuffle,
-      {{0, 2, 4, 6, 8, 10, 12, 14, 0, 2, 4, 6, 8, 10, 12, 14}});
 }
 
 WASM_SIMD_TEST(S8x16UnzipRight) {
-  RunBinaryLaneOpTest<int8_t>(
-      lower_simd, kExprS8x16Shuffle,
+  RunShuffleOpTest<int8_t>(
+      execution_mode, lower_simd, kExprS8x16Shuffle,
       {{1, 3, 5, 7, 9, 11, 13, 15, 17, 19, 21, 23, 25, 27, 29, 31}});
-  RunBinaryLaneOpTest<int8_t>(
-      lower_simd, kExprS8x16Shuffle,
-      {{1, 3, 5, 7, 9, 11, 13, 15, 1, 3, 5, 7, 9, 11, 13, 15}});
 }
 
 WASM_SIMD_TEST(S8x16TransposeLeft) {
-  RunBinaryLaneOpTest<int8_t>(
-      lower_simd, kExprS8x16Shuffle,
+  RunShuffleOpTest<int8_t>(
+      execution_mode, lower_simd, kExprS8x16Shuffle,
       {{0, 16, 2, 18, 4, 20, 6, 22, 8, 24, 10, 26, 12, 28, 14, 30}});
-  RunBinaryLaneOpTest<int8_t>(
-      lower_simd, kExprS8x16Shuffle,
-      {{0, 0, 2, 2, 4, 4, 6, 6, 8, 8, 10, 10, 12, 12, 14, 14}});
 }
 
 WASM_SIMD_TEST(S8x16TransposeRight) {
-  RunBinaryLaneOpTest<int8_t>(
-      lower_simd, kExprS8x16Shuffle,
+  RunShuffleOpTest<int8_t>(
+      execution_mode, lower_simd, kExprS8x16Shuffle,
       {{1, 17, 3, 19, 5, 21, 7, 23, 9, 25, 11, 27, 13, 29, 15, 31}});
-  RunBinaryLaneOpTest<int8_t>(
-      lower_simd, kExprS8x16Shuffle,
-      {{1, 1, 3, 3, 5, 5, 7, 7, 9, 9, 11, 11, 13, 13, 15, 15}});
 }
 
 WASM_SIMD_TEST(S8x8Reverse) {
-  RunBinaryLaneOpTest<int8_t>(
-      lower_simd, kExprS8x16Shuffle,
+  RunShuffleOpTest<int8_t>(
+      execution_mode, lower_simd, kExprS8x16Shuffle,
       {{7, 6, 5, 4, 3, 2, 1, 0, 15, 14, 13, 12, 11, 10, 9, 8}});
 }
 
 WASM_SIMD_TEST(S8x4Reverse) {
-  RunBinaryLaneOpTest<int8_t>(
-      lower_simd, kExprS8x16Shuffle,
+  RunShuffleOpTest<int8_t>(
+      execution_mode, lower_simd, kExprS8x16Shuffle,
       {{3, 2, 1, 0, 7, 6, 5, 4, 11, 10, 9, 8, 15, 14, 13, 12}});
 }
 
 WASM_SIMD_TEST(S8x2Reverse) {
-  RunBinaryLaneOpTest<int8_t>(
-      lower_simd, kExprS8x16Shuffle,
+  RunShuffleOpTest<int8_t>(
+      execution_mode, lower_simd, kExprS8x16Shuffle,
       {{1, 0, 3, 2, 5, 4, 7, 6, 9, 8, 11, 10, 13, 12, 15, 14}});
 }
 
 WASM_SIMD_TEST(S8x16Irregular) {
-  RunBinaryLaneOpTest<int8_t>(
-      lower_simd, kExprS8x16Shuffle,
+  RunShuffleOpTest<int8_t>(
+      execution_mode, lower_simd, kExprS8x16Shuffle,
       {{0, 16, 0, 16, 2, 18, 3, 19, 4, 20, 5, 21, 6, 22, 7, 23}});
-  RunBinaryLaneOpTest<int8_t>(
-      lower_simd, kExprS8x16Shuffle,
-      {{0, 0, 0, 0, 2, 2, 3, 3, 4, 4, 5, 5, 6, 6, 7, 7}});
 }
 
-// Test shuffles that concatenate the two vectors.
+// Test shuffles that blend the two vectors (elements remain in their lanes.)
+WASM_SIMD_TEST(S8x16Blend) {
+  static const int kLanes = 16;
+  std::array<uint8_t, kLanes> expected;
+  for (int bias = 1; bias < kLanes; bias++) {
+    for (int i = 0; i < bias; i++) expected[i] = i;
+    for (int i = bias; i < kLanes; i++) expected[i] = i + kLanes;
+    RunShuffleOpTest(execution_mode, lower_simd, kExprS8x16Shuffle, expected);
+  }
+}
 
+// Test shuffles that concatenate the two vectors.
 WASM_SIMD_TEST(S8x16Concat) {
   static const int kLanes = 16;
   std::array<uint8_t, kLanes> expected;
-  for (int bias = 1; bias < kLanes; bias++) {
+  // n is offset or bias of concatenation.
+  for (int n = 1; n < kLanes; ++n) {
     int i = 0;
-    // last kLanes - bias bytes of first vector.
-    for (int j = bias; j < kLanes; j++) {
+    // last kLanes - n bytes of first vector.
+    for (int j = n; j < kLanes; ++j) {
       expected[i++] = j;
     }
-    // first bias lanes of second vector
-    for (int j = 0; j < bias; j++) {
+    // first n bytes of second vector
+    for (int j = 0; j < n; ++j) {
       expected[i++] = j + kLanes;
     }
-    RunBinaryLaneOpTest(lower_simd, kExprS8x16Shuffle, expected);
+    RunShuffleOpTest(execution_mode, lower_simd, kExprS8x16Shuffle, expected);
   }
 }
-#endif  // V8_TARGET_ARCH_ARM || V8_TARGET_ARCH_ARM64 || V8_TARGET_ARCH_MIPS ||
-        // V8_TARGET_ARCH_MIPS64 || V8_TARGET_ARCH_IA32
 
-#if V8_TARGET_ARCH_ARM || V8_TARGET_ARCH_ARM64 || V8_TARGET_ARCH_MIPS || \
-    V8_TARGET_ARCH_MIPS64
 // Boolean unary operations are 'AllTrue' and 'AnyTrue', which return an integer
 // result. Use relational ops on numeric vectors to create the boolean vector
 // test inputs. Test inputs with all true, all false, one true, and one false.
 #define WASM_SIMD_BOOL_REDUCTION_TEST(format, lanes)                           \
-  WASM_SIMD_COMPILED_TEST(ReductionTest##lanes) {                              \
-    WasmRunner<int32_t> r(kExecuteTurbofan, lower_simd);                       \
+  WASM_SIMD_TEST(ReductionTest##lanes) {                                       \
+    WasmRunner<int32_t> r(execution_mode, lower_simd);                         \
     byte zero = r.AllocateLocal(kWasmS128);                                    \
     byte one_one = r.AllocateLocal(kWasmS128);                                 \
     byte reduced = r.AllocateLocal(kWasmI32);                                  \
@@ -1976,7 +2046,7 @@ WASM_SIMD_BOOL_REDUCTION_TEST(16x8, 8)
 WASM_SIMD_BOOL_REDUCTION_TEST(8x16, 16)
 
 WASM_SIMD_TEST(SimdI32x4ExtractWithF32x4) {
-  WasmRunner<int32_t> r(kExecuteTurbofan, lower_simd);
+  WasmRunner<int32_t> r(execution_mode, lower_simd);
   BUILD(r, WASM_IF_ELSE_I(
                WASM_I32_EQ(WASM_SIMD_I32x4_EXTRACT_LANE(
                                0, WASM_SIMD_F32x4_SPLAT(WASM_F32(30.5))),
@@ -1985,10 +2055,10 @@ WASM_SIMD_TEST(SimdI32x4ExtractWithF32x4) {
   CHECK_EQ(1, r.Call());
 }
 #endif  // V8_TARGET_ARCH_ARM || V8_TARGET_ARCH_ARM64 || V8_TARGET_ARCH_MIPS ||
-        // V8_TARGET_ARCH_MIPS64
+        // V8_TARGET_ARCH_MIPS64 || V8_TARGET_ARCH_IA32
 
 WASM_SIMD_TEST(SimdF32x4ExtractWithI32x4) {
-  WasmRunner<int32_t> r(kExecuteTurbofan, lower_simd);
+  WasmRunner<int32_t> r(execution_mode, lower_simd);
   BUILD(r,
         WASM_IF_ELSE_I(WASM_F32_EQ(WASM_SIMD_F32x4_EXTRACT_LANE(
                                        0, WASM_SIMD_I32x4_SPLAT(WASM_I32V(15))),
@@ -2002,7 +2072,7 @@ WASM_SIMD_TEST(SimdF32x4AddWithI32x4) {
   // representable as a float.
   const int kOne = 0x3F800000;
   const int kTwo = 0x40000000;
-  WasmRunner<int32_t> r(kExecuteTurbofan, lower_simd);
+  WasmRunner<int32_t> r(execution_mode, lower_simd);
   BUILD(r,
         WASM_IF_ELSE_I(
             WASM_F32_EQ(
@@ -2017,7 +2087,7 @@ WASM_SIMD_TEST(SimdF32x4AddWithI32x4) {
 }
 
 WASM_SIMD_TEST(SimdI32x4AddWithF32x4) {
-  WasmRunner<int32_t> r(kExecuteTurbofan, lower_simd);
+  WasmRunner<int32_t> r(execution_mode, lower_simd);
   BUILD(r,
         WASM_IF_ELSE_I(
             WASM_I32_EQ(
@@ -2032,7 +2102,7 @@ WASM_SIMD_TEST(SimdI32x4AddWithF32x4) {
 }
 
 WASM_SIMD_TEST(SimdI32x4Local) {
-  WasmRunner<int32_t> r(kExecuteTurbofan, lower_simd);
+  WasmRunner<int32_t> r(execution_mode, lower_simd);
   r.AllocateLocal(kWasmS128);
   BUILD(r, WASM_SET_LOCAL(0, WASM_SIMD_I32x4_SPLAT(WASM_I32V(31))),
 
@@ -2041,7 +2111,7 @@ WASM_SIMD_TEST(SimdI32x4Local) {
 }
 
 WASM_SIMD_TEST(SimdI32x4SplatFromExtract) {
-  WasmRunner<int32_t> r(kExecuteTurbofan, lower_simd);
+  WasmRunner<int32_t> r(execution_mode, lower_simd);
   r.AllocateLocal(kWasmI32);
   r.AllocateLocal(kWasmS128);
   BUILD(r, WASM_SET_LOCAL(0, WASM_SIMD_I32x4_EXTRACT_LANE(
@@ -2052,7 +2122,7 @@ WASM_SIMD_TEST(SimdI32x4SplatFromExtract) {
 }
 
 WASM_SIMD_TEST(SimdI32x4For) {
-  WasmRunner<int32_t> r(kExecuteTurbofan, lower_simd);
+  WasmRunner<int32_t> r(execution_mode, lower_simd);
   r.AllocateLocal(kWasmI32);
   r.AllocateLocal(kWasmS128);
   BUILD(r,
@@ -2086,7 +2156,7 @@ WASM_SIMD_TEST(SimdI32x4For) {
 }
 
 WASM_SIMD_TEST(SimdF32x4For) {
-  WasmRunner<int32_t> r(kExecuteTurbofan, lower_simd);
+  WasmRunner<int32_t> r(execution_mode, lower_simd);
   r.AllocateLocal(kWasmI32);
   r.AllocateLocal(kWasmS128);
   BUILD(r, WASM_SET_LOCAL(1, WASM_SIMD_F32x4_SPLAT(WASM_F32(21.25))),
@@ -2135,7 +2205,7 @@ const T& GetScalar(T* v, int lane) {
 }
 
 WASM_SIMD_TEST(SimdI32x4GetGlobal) {
-  WasmRunner<int32_t, int32_t> r(kExecuteTurbofan, lower_simd);
+  WasmRunner<int32_t, int32_t> r(execution_mode, lower_simd);
   // Pad the globals with a few unused slots to get a non-zero offset.
   r.builder().AddGlobal<int32_t>(kWasmI32);  // purposefully unused
   r.builder().AddGlobal<int32_t>(kWasmI32);  // purposefully unused
@@ -2163,7 +2233,7 @@ WASM_SIMD_TEST(SimdI32x4GetGlobal) {
 }
 
 WASM_SIMD_TEST(SimdI32x4SetGlobal) {
-  WasmRunner<int32_t, int32_t> r(kExecuteTurbofan, lower_simd);
+  WasmRunner<int32_t, int32_t> r(execution_mode, lower_simd);
   // Pad the globals with a few unused slots to get a non-zero offset.
   r.builder().AddGlobal<int32_t>(kWasmI32);  // purposefully unused
   r.builder().AddGlobal<int32_t>(kWasmI32);  // purposefully unused
@@ -2186,7 +2256,7 @@ WASM_SIMD_TEST(SimdI32x4SetGlobal) {
 }
 
 WASM_SIMD_TEST(SimdF32x4GetGlobal) {
-  WasmRunner<int32_t, int32_t> r(kExecuteTurbofan, lower_simd);
+  WasmRunner<int32_t, int32_t> r(execution_mode, lower_simd);
   float* global = r.builder().AddGlobal<float>(kWasmS128);
   SetVectorByLanes<float>(global, {{0.0, 1.5, 2.25, 3.5}});
   r.AllocateLocal(kWasmI32);
@@ -2209,7 +2279,7 @@ WASM_SIMD_TEST(SimdF32x4GetGlobal) {
 }
 
 WASM_SIMD_TEST(SimdF32x4SetGlobal) {
-  WasmRunner<int32_t, int32_t> r(kExecuteTurbofan, lower_simd);
+  WasmRunner<int32_t, int32_t> r(execution_mode, lower_simd);
   float* global = r.builder().AddGlobal<float>(kWasmS128);
   BUILD(r, WASM_SET_GLOBAL(0, WASM_SIMD_F32x4_SPLAT(WASM_F32(13.5))),
         WASM_SET_GLOBAL(0, WASM_SIMD_F32x4_REPLACE_LANE(1, WASM_GET_GLOBAL(0),
@@ -2226,9 +2296,10 @@ WASM_SIMD_TEST(SimdF32x4SetGlobal) {
   CHECK_EQ(GetScalar(global, 3), 65.0f);
 }
 
-WASM_SIMD_COMPILED_TEST(SimdLoadStoreLoad) {
-  WasmRunner<int32_t> r(kExecuteTurbofan, lower_simd);
-  int32_t* memory = r.builder().AddMemoryElems<int32_t>(8);
+WASM_SIMD_TEST(SimdLoadStoreLoad) {
+  WasmRunner<int32_t> r(execution_mode, lower_simd);
+  int32_t* memory =
+      r.builder().AddMemoryElems<int32_t>(kWasmPageSize / sizeof(int32_t));
   // Load memory, store it, then reload it and extract the first lane. Use a
   // non-zero offset into the memory of 1 lane (4 bytes) to test indexing.
   BUILD(r, WASM_SIMD_STORE_MEM(WASM_I32V(4), WASM_SIMD_LOAD_MEM(WASM_I32V(4))),
@@ -2242,7 +2313,6 @@ WASM_SIMD_COMPILED_TEST(SimdLoadStoreLoad) {
 }
 
 #undef WASM_SIMD_TEST
-#undef WASM_SIMD_COMPILED_TEST
 #undef WASM_SIMD_CHECK_LANE
 #undef WASM_SIMD_CHECK4
 #undef WASM_SIMD_CHECK_SPLAT4
diff --git a/deps/v8/test/cctest/wasm/test-run-wasm.cc b/deps/v8/test/cctest/wasm/test-run-wasm.cc
index 58bdefa1cdc2c4..696b1410b8e0ea 100644
--- a/deps/v8/test/cctest/wasm/test-run-wasm.cc
+++ b/deps/v8/test/cctest/wasm/test-run-wasm.cc
@@ -435,7 +435,7 @@ WASM_EXEC_TEST(Int32DivU_byzero_const) {
 
 WASM_EXEC_TEST(Int32DivS_trap_effect) {
   WasmRunner<int32_t, int32_t, int32_t> r(execution_mode);
-  r.builder().AddMemoryElems<int32_t>(8);
+  r.builder().AddMemory(kWasmPageSize);
 
   BUILD(r, WASM_IF_ELSE_I(
                WASM_GET_LOCAL(0),
@@ -828,7 +828,7 @@ WASM_EXEC_TEST(Br_height) {
 
 WASM_EXEC_TEST(Regression_660262) {
   WasmRunner<int32_t> r(execution_mode);
-  r.builder().AddMemoryElems<int32_t>(8);
+  r.builder().AddMemory(kWasmPageSize);
   BUILD(r, kExprI32Const, 0x00, kExprI32Const, 0x00, kExprI32LoadMem, 0x00,
         0x0F, kExprBrTable, 0x00, 0x80, 0x00);  // entries=0
   r.Call();
@@ -1013,7 +1013,8 @@ WASM_EXEC_TEST(BrTable_loop_target) {
 
 WASM_EXEC_TEST(F32ReinterpretI32) {
   WasmRunner<int32_t> r(execution_mode);
-  int32_t* memory = r.builder().AddMemoryElems<int32_t>(8);
+  int32_t* memory =
+      r.builder().AddMemoryElems<int32_t>(kWasmPageSize / sizeof(int32_t));
 
   BUILD(r, WASM_I32_REINTERPRET_F32(
                WASM_LOAD_MEM(MachineType::Float32(), WASM_ZERO)));
@@ -1027,7 +1028,8 @@ WASM_EXEC_TEST(F32ReinterpretI32) {
 
 WASM_EXEC_TEST(I32ReinterpretF32) {
   WasmRunner<int32_t, int32_t> r(execution_mode);
-  int32_t* memory = r.builder().AddMemoryElems<int32_t>(8);
+  int32_t* memory =
+      r.builder().AddMemoryElems<int32_t>(kWasmPageSize / sizeof(int32_t));
 
   BUILD(r, WASM_STORE_MEM(MachineType::Float32(), WASM_ZERO,
                           WASM_F32_REINTERPRET_I32(WASM_GET_LOCAL(0))),
@@ -1057,7 +1059,7 @@ WASM_EXEC_TEST(SignallingNanSurvivesI32ReinterpretF32) {
 
 WASM_EXEC_TEST(LoadMaxUint32Offset) {
   WasmRunner<int32_t> r(execution_mode);
-  r.builder().AddMemoryElems<int32_t>(kWasmPageSize / sizeof(int32_t));
+  r.builder().AddMemory(kWasmPageSize);
 
   BUILD(r, WASM_LOAD_MEM_OFFSET(MachineType::Int32(),  // type
                                 U32V_5(0xFFFFFFFF),    // offset
@@ -1068,7 +1070,8 @@ WASM_EXEC_TEST(LoadMaxUint32Offset) {
 
 WASM_EXEC_TEST(LoadStoreLoad) {
   WasmRunner<int32_t> r(execution_mode);
-  int32_t* memory = r.builder().AddMemoryElems<int32_t>(8);
+  int32_t* memory =
+      r.builder().AddMemoryElems<int32_t>(kWasmPageSize / sizeof(int32_t));
 
   BUILD(r, WASM_STORE_MEM(MachineType::Int32(), WASM_ZERO,
                           WASM_LOAD_MEM(MachineType::Int32(), WASM_ZERO)),
@@ -1083,28 +1086,28 @@ WASM_EXEC_TEST(LoadStoreLoad) {
 
 WASM_EXEC_TEST(UnalignedFloat32Load) {
   WasmRunner<float> r(execution_mode);
-  r.builder().AddMemoryElems<float>(8);
+  r.builder().AddMemory(kWasmPageSize);
   BUILD(r, WASM_LOAD_MEM_ALIGNMENT(MachineType::Float32(), WASM_ONE, 2));
   r.Call();
 }
 
 WASM_EXEC_TEST(UnalignedFloat64Load) {
   WasmRunner<double> r(execution_mode);
-  r.builder().AddMemoryElems<double>(8);
+  r.builder().AddMemory(kWasmPageSize);
   BUILD(r, WASM_LOAD_MEM_ALIGNMENT(MachineType::Float64(), WASM_ONE, 3));
   r.Call();
 }
 
 WASM_EXEC_TEST(UnalignedInt32Load) {
   WasmRunner<uint32_t> r(execution_mode);
-  r.builder().AddMemoryElems<uint32_t>(8);
+  r.builder().AddMemory(kWasmPageSize);
   BUILD(r, WASM_LOAD_MEM_ALIGNMENT(MachineType::Int32(), WASM_ONE, 2));
   r.Call();
 }
 
 WASM_EXEC_TEST(UnalignedInt32Store) {
   WasmRunner<int32_t> r(execution_mode);
-  r.builder().AddMemoryElems<uint32_t>(8);
+  r.builder().AddMemory(kWasmPageSize);
   BUILD(r, WASM_SEQ(WASM_STORE_MEM_ALIGNMENT(MachineType::Int32(), WASM_ONE, 2,
                                              WASM_I32V_1(1)),
                     WASM_I32V_1(12)));
@@ -1113,7 +1116,7 @@ WASM_EXEC_TEST(UnalignedInt32Store) {
 
 WASM_EXEC_TEST(UnalignedFloat32Store) {
   WasmRunner<int32_t> r(execution_mode);
-  r.builder().AddMemoryElems<float>(8);
+  r.builder().AddMemory(kWasmPageSize);
   BUILD(r, WASM_SEQ(WASM_STORE_MEM_ALIGNMENT(MachineType::Float32(), WASM_ONE,
                                              2, WASM_F32(1.0)),
                     WASM_I32V_1(12)));
@@ -1122,7 +1125,7 @@ WASM_EXEC_TEST(UnalignedFloat32Store) {
 
 WASM_EXEC_TEST(UnalignedFloat64Store) {
   WasmRunner<int32_t> r(execution_mode);
-  r.builder().AddMemoryElems<double>(8);
+  r.builder().AddMemory(kWasmPageSize);
   BUILD(r, WASM_SEQ(WASM_STORE_MEM_ALIGNMENT(MachineType::Float64(), WASM_ONE,
                                              3, WASM_F64(1.0)),
                     WASM_I32V_1(12)));
@@ -1459,7 +1462,8 @@ WASM_EXEC_TEST(IfBreak2) {
 
 WASM_EXEC_TEST(LoadMemI32) {
   WasmRunner<int32_t, int32_t> r(execution_mode);
-  int32_t* memory = r.builder().AddMemoryElems<int32_t>(8);
+  int32_t* memory =
+      r.builder().AddMemoryElems<int32_t>(kWasmPageSize / sizeof(int32_t));
   r.builder().RandomizeMemory(1111);
 
   BUILD(r, WASM_LOAD_MEM(MachineType::Int32(), WASM_ZERO));
@@ -1477,7 +1481,8 @@ WASM_EXEC_TEST(LoadMemI32) {
 WASM_EXEC_TEST(LoadMemI32_alignment) {
   for (byte alignment = 0; alignment <= 2; ++alignment) {
     WasmRunner<int32_t, int32_t> r(execution_mode);
-    int32_t* memory = r.builder().AddMemoryElems<int32_t>(8);
+    int32_t* memory =
+        r.builder().AddMemoryElems<int32_t>(kWasmPageSize / sizeof(int32_t));
     r.builder().RandomizeMemory(1111);
 
     BUILD(r,
@@ -1530,7 +1535,7 @@ WASM_EXEC_TEST(LoadMem_offset_oob) {
 
     constexpr byte offset = 8;
     uint32_t boundary =
-        num_bytes - offset - WasmOpcodes::MemSize(machineTypes[m]);
+        num_bytes - offset - ValueTypes::MemSize(machineTypes[m]);
 
     BUILD(r, WASM_LOAD_MEM_OFFSET(machineTypes[m], offset, WASM_GET_LOCAL(0)),
           WASM_DROP, WASM_ZERO);
@@ -1545,7 +1550,8 @@ WASM_EXEC_TEST(LoadMem_offset_oob) {
 
 WASM_EXEC_TEST(LoadMemI32_offset) {
   WasmRunner<int32_t, int32_t> r(execution_mode);
-  int32_t* memory = r.builder().AddMemoryElems<int32_t>(4);
+  int32_t* memory =
+      r.builder().AddMemoryElems<int32_t>(kWasmPageSize / sizeof(int32_t));
   r.builder().RandomizeMemory(1111);
 
   BUILD(r, WASM_LOAD_MEM_OFFSET(MachineType::Int32(), 4, WASM_GET_LOCAL(0)));
@@ -1619,7 +1625,8 @@ WASM_EXEC_TEST(StoreMemI32_alignment) {
 
   for (byte i = 0; i <= 2; ++i) {
     WasmRunner<int32_t, int32_t> r(execution_mode);
-    int32_t* memory = r.builder().AddMemoryElems<int32_t>(4);
+    int32_t* memory =
+        r.builder().AddMemoryElems<int32_t>(kWasmPageSize / sizeof(int32_t));
     BUILD(r, WASM_STORE_MEM_ALIGNMENT(MachineType::Int32(), WASM_ZERO, i,
                                       WASM_GET_LOCAL(0)),
           WASM_GET_LOCAL(0));
@@ -1633,7 +1640,8 @@ WASM_EXEC_TEST(StoreMemI32_alignment) {
 
 WASM_EXEC_TEST(StoreMemI32_offset) {
   WasmRunner<int32_t, int32_t> r(execution_mode);
-  int32_t* memory = r.builder().AddMemoryElems<int32_t>(4);
+  int32_t* memory =
+      r.builder().AddMemoryElems<int32_t>(kWasmPageSize / sizeof(int32_t));
   const int32_t kWritten = 0xAABBCCDD;
 
   BUILD(r, WASM_STORE_MEM_OFFSET(MachineType::Int32(), 4, WASM_GET_LOCAL(0),
@@ -1673,7 +1681,7 @@ WASM_EXEC_TEST(StoreMem_offset_oob) {
                                    WASM_LOAD_MEM(machineTypes[m], WASM_ZERO)),
           WASM_ZERO);
 
-    byte memsize = WasmOpcodes::MemSize(machineTypes[m]);
+    byte memsize = ValueTypes::MemSize(machineTypes[m]);
     uint32_t boundary = num_bytes - 8 - memsize;
     CHECK_EQ(0, r.Call(boundary));  // in bounds.
     CHECK_EQ(0, memcmp(&memory[0], &memory[8 + boundary], memsize));
@@ -1693,7 +1701,7 @@ WASM_EXEC_TEST(Store_i32_narrowed) {
     constexpr int kBytes = 24;
     uint8_t expected_memory[kBytes] = {0};
     WasmRunner<int32_t, int32_t, int32_t> r(execution_mode);
-    uint8_t* memory = r.builder().AddMemoryElems<uint8_t>(kBytes);
+    uint8_t* memory = r.builder().AddMemoryElems<uint8_t>(kWasmPageSize);
     constexpr uint32_t kPattern = 0x12345678;
 
     BUILD(r, WASM_GET_LOCAL(0),                 // index
@@ -1717,7 +1725,8 @@ WASM_EXEC_TEST(Store_i32_narrowed) {
 WASM_EXEC_TEST(LoadMemI32_P) {
   const int kNumElems = 8;
   WasmRunner<int32_t, int32_t> r(execution_mode);
-  int32_t* memory = r.builder().AddMemoryElems<int32_t>(kNumElems);
+  int32_t* memory =
+      r.builder().AddMemoryElems<int32_t>(kWasmPageSize / sizeof(int32_t));
   r.builder().RandomizeMemory(2222);
 
   BUILD(r, WASM_LOAD_MEM(MachineType::Int32(), WASM_GET_LOCAL(0)));
@@ -1730,7 +1739,8 @@ WASM_EXEC_TEST(LoadMemI32_P) {
 WASM_EXEC_TEST(MemI32_Sum) {
   const int kNumElems = 20;
   WasmRunner<uint32_t, int32_t> r(execution_mode);
-  uint32_t* memory = r.builder().AddMemoryElems<uint32_t>(kNumElems);
+  uint32_t* memory =
+      r.builder().AddMemoryElems<uint32_t>(kWasmPageSize / sizeof(int32_t));
   const byte kSum = r.AllocateLocal(kWasmI32);
 
   BUILD(r, WASM_WHILE(
@@ -1759,7 +1769,7 @@ WASM_EXEC_TEST(MemI32_Sum) {
 WASM_EXEC_TEST(CheckMachIntsZero) {
   const int kNumElems = 55;
   WasmRunner<uint32_t, int32_t> r(execution_mode);
-  r.builder().AddMemoryElems<uint32_t>(kNumElems);
+  r.builder().AddMemoryElems<uint32_t>(kWasmPageSize / sizeof(uint32_t));
 
   BUILD(r,                               // --
         /**/ kExprLoop, kLocalVoid,      // --
@@ -1787,7 +1797,7 @@ WASM_EXEC_TEST(CheckMachIntsZero) {
 WASM_EXEC_TEST(MemF32_Sum) {
   const int kSize = 5;
   WasmRunner<int32_t, int32_t> r(execution_mode);
-  r.builder().AddMemoryElems<float>(kSize);
+  r.builder().AddMemoryElems<float>(kWasmPageSize / sizeof(float));
   float* buffer = r.builder().raw_mem_start<float>();
   r.builder().WriteMemory(&buffer[0], -99.25f);
   r.builder().WriteMemory(&buffer[1], -888.25f);
@@ -1818,7 +1828,8 @@ T GenerateAndRunFold(WasmExecutionMode execution_mode, WasmOpcode binop,
                      T* buffer, uint32_t size, ValueType astType,
                      MachineType memType) {
   WasmRunner<int32_t, int32_t> r(execution_mode);
-  T* memory = r.builder().AddMemoryElems<T>(size);
+  T* memory = r.builder().AddMemoryElems<T>(static_cast<uint32_t>(
+      RoundUp(size * sizeof(T), kWasmPageSize) / sizeof(sizeof(T))));
   for (uint32_t i = 0; i < size; ++i) {
     r.builder().WriteMemory(&memory[i], buffer[i]);
   }
@@ -1857,7 +1868,7 @@ WASM_EXEC_TEST(Build_Wasm_Infinite_Loop) {
 
 WASM_EXEC_TEST(Build_Wasm_Infinite_Loop_effect) {
   WasmRunner<int32_t, int32_t> r(execution_mode);
-  r.builder().AddMemoryElems<int8_t>(16);
+  r.builder().AddMemory(kWasmPageSize);
 
   // Only build the graph and compile, don't run.
   BUILD(r, WASM_LOOP(WASM_LOAD_MEM(MachineType::Int32(), WASM_ZERO), WASM_DROP),
@@ -1908,7 +1919,7 @@ WASM_COMPILED_EXEC_TEST(Build_Wasm_UnreachableIf2) {
 
 WASM_EXEC_TEST(Unreachable_Load) {
   WasmRunner<int32_t, int32_t> r(execution_mode);
-  r.builder().AddMemory(8);
+  r.builder().AddMemory(kWasmPageSize);
   BUILD(r, WASM_BLOCK_I(WASM_BRV(0, WASM_GET_LOCAL(0)),
                         WASM_LOAD_MEM(MachineType::Int8(), WASM_GET_LOCAL(0))));
   CHECK_EQ(11, r.Call(11));
@@ -1951,9 +1962,6 @@ static void TestBuildGraphForSimpleExpression(WasmOpcode opcode) {
   Isolate* isolate = CcTest::InitIsolateOnce();
   Zone zone(isolate->allocator(), ZONE_NAME);
   HandleScope scope(isolate);
-  // TODO(gdeepti): Enable this test for sign extension opcodes when lowering
-  // is enabled.
-  if (WasmOpcodes::IsSignExtensionOpcode(opcode)) return;
   // TODO(ahaas): Enable this test for anyref opcodes when code generation for
   // them is implemented.
   if (WasmOpcodes::IsAnyRefOpcode(opcode)) return;
@@ -1971,8 +1979,7 @@ static void TestBuildGraphForSimpleExpression(WasmOpcode opcode) {
     byte code[] = {WASM_NO_LOCALS, kExprGetLocal, 0, static_cast<byte>(opcode),
                    WASM_END};
     TestBuildingGraph(&zone, &jsgraph, nullptr, sig, nullptr, code,
-                      code + arraysize(code),
-                      compiler::kNoRuntimeExceptionSupport);
+                      code + arraysize(code));
   } else {
     CHECK_EQ(2, sig->parameter_count());
     byte code[] = {WASM_NO_LOCALS,
@@ -1983,8 +1990,7 @@ static void TestBuildGraphForSimpleExpression(WasmOpcode opcode) {
                    static_cast<byte>(opcode),
                    WASM_END};
     TestBuildingGraph(&zone, &jsgraph, nullptr, sig, nullptr, code,
-                      code + arraysize(code),
-                      compiler::kNoRuntimeExceptionSupport);
+                      code + arraysize(code));
   }
 }
 
@@ -2000,7 +2006,7 @@ TEST(Build_Wasm_SimpleExprs) {
 
 WASM_EXEC_TEST(Int32LoadInt8_signext) {
   WasmRunner<int32_t, int32_t> r(execution_mode);
-  const int kNumElems = 16;
+  const int kNumElems = kWasmPageSize;
   int8_t* memory = r.builder().AddMemoryElems<int8_t>(kNumElems);
   r.builder().RandomizeMemory();
   memory[0] = -1;
@@ -2013,7 +2019,7 @@ WASM_EXEC_TEST(Int32LoadInt8_signext) {
 
 WASM_EXEC_TEST(Int32LoadInt8_zeroext) {
   WasmRunner<int32_t, int32_t> r(execution_mode);
-  const int kNumElems = 16;
+  const int kNumElems = kWasmPageSize;
   byte* memory = r.builder().AddMemory(kNumElems);
   r.builder().RandomizeMemory(77);
   memory[0] = 255;
@@ -2026,7 +2032,7 @@ WASM_EXEC_TEST(Int32LoadInt8_zeroext) {
 
 WASM_EXEC_TEST(Int32LoadInt16_signext) {
   WasmRunner<int32_t, int32_t> r(execution_mode);
-  const int kNumBytes = 16;
+  const int kNumBytes = kWasmPageSize;
   byte* memory = r.builder().AddMemory(kNumBytes);
   r.builder().RandomizeMemory(888);
   memory[1] = 200;
@@ -2040,7 +2046,7 @@ WASM_EXEC_TEST(Int32LoadInt16_signext) {
 
 WASM_EXEC_TEST(Int32LoadInt16_zeroext) {
   WasmRunner<int32_t, int32_t> r(execution_mode);
-  const int kNumBytes = 16;
+  const int kNumBytes = kWasmPageSize;
   byte* memory = r.builder().AddMemory(kNumBytes);
   r.builder().RandomizeMemory(9999);
   memory[1] = 204;
@@ -2135,7 +2141,7 @@ WASM_EXEC_TEST(MixedGlobals) {
   WasmRunner<int32_t, int32_t> r(execution_mode);
 
   int32_t* unused = r.builder().AddGlobal<int32_t>();
-  byte* memory = r.builder().AddMemory(32);
+  byte* memory = r.builder().AddMemory(kWasmPageSize);
 
   int32_t* var_int32 = r.builder().AddGlobal<int32_t>();
   uint32_t* var_uint32 = r.builder().AddGlobal<uint32_t>();
@@ -2235,7 +2241,8 @@ WASM_EXEC_TEST(CallVoid) {
   const int32_t kExpected = 414444;
   // Build the target function.
   TestSignatures sigs;
-  int32_t* memory = r.builder().AddMemoryElems<int32_t>(16 / sizeof(int32_t));
+  int32_t* memory =
+      r.builder().AddMemoryElems<int32_t>(kWasmPageSize / sizeof(int32_t));
   r.builder().RandomizeMemory();
   WasmFunctionCompiler& t = r.NewFunction(sigs.v_v());
   BUILD(t, WASM_STORE_MEM(MachineType::Int32(), WASM_I32V_1(kMemOffset),
@@ -2289,7 +2296,8 @@ WASM_EXEC_TEST(Call_Float32Sub) {
 
 WASM_EXEC_TEST(Call_Float64Sub) {
   WasmRunner<int32_t> r(execution_mode);
-  double* memory = r.builder().AddMemoryElems<double>(16);
+  double* memory =
+      r.builder().AddMemoryElems<double>(kWasmPageSize / sizeof(double));
 
   BUILD(r, WASM_STORE_MEM(
                MachineType::Float64(), WASM_ZERO,
@@ -2338,7 +2346,7 @@ static void Run_WasmMixedCall_N(WasmExecutionMode execution_mode, int start) {
     v8::internal::AccountingAllocator allocator;
     Zone zone(&allocator, ZONE_NAME);
     WasmRunner<int32_t> r(execution_mode);
-    r.builder().AddMemory(1024);
+    r.builder().AddMemory(kWasmPageSize);
     MachineType* memtypes = &mixed[start];
     MachineType result = memtypes[which];
 
@@ -2346,9 +2354,9 @@ static void Run_WasmMixedCall_N(WasmExecutionMode execution_mode, int start) {
     // Build the selector function.
     // =========================================================================
     FunctionSig::Builder b(&zone, 1, num_params);
-    b.AddReturn(WasmOpcodes::ValueTypeFor(result));
+    b.AddReturn(ValueTypes::ValueTypeFor(result));
     for (int i = 0; i < num_params; ++i) {
-      b.AddParam(WasmOpcodes::ValueTypeFor(memtypes[i]));
+      b.AddParam(ValueTypes::ValueTypeFor(memtypes[i]));
     }
     WasmFunctionCompiler& t = r.NewFunction(b.Build());
     BUILD(t, WASM_GET_LOCAL(which));
@@ -2368,7 +2376,7 @@ static void Run_WasmMixedCall_N(WasmExecutionMode execution_mode, int start) {
     ADD_CODE(code, WASM_CALL_FUNCTION0(t.function_index()));
 
     // Store the result in a local.
-    byte local_index = r.AllocateLocal(WasmOpcodes::ValueTypeFor(result));
+    byte local_index = r.AllocateLocal(ValueTypes::ValueTypeFor(result));
     ADD_CODE(code, kExprSetLocal, local_index);
 
     // Store the result in memory.
@@ -2385,7 +2393,7 @@ static void Run_WasmMixedCall_N(WasmExecutionMode execution_mode, int start) {
       r.builder().RandomizeMemory();
       CHECK_EQ(kExpected, r.Call());
 
-      int size = WasmOpcodes::MemSize(result);
+      int size = ValueTypes::MemSize(result);
       for (int i = 0; i < size; ++i) {
         int base = (which + 1) * kElemSize;
         byte expected = r.builder().raw_mem_at<byte>(base + i);
@@ -2443,7 +2451,7 @@ WASM_EXEC_TEST(MultiReturnSub) {
 template <typename T>
 void RunMultiReturnSelect(WasmExecutionMode execution_mode, const T* inputs) {
   EXPERIMENTAL_FLAG_SCOPE(mv);
-  ValueType type = WasmOpcodes::ValueTypeFor(MachineTypeForC<T>());
+  ValueType type = ValueTypes::ValueTypeFor(MachineTypeForC<T>());
   ValueType storage[] = {type, type, type, type, type, type};
   const size_t kNumReturns = 2;
   const size_t kNumParams = arraysize(storage) - kNumReturns;
@@ -3165,10 +3173,13 @@ WASM_EXEC_TEST(IfInsideUnreachable) {
 // This test targets binops in Liftoff.
 // Initialize a number of local variables to force them into different
 // registers, then perform a binary operation on two of the locals.
+// Afterwards, write back all locals to memory, to check that their value was
+// not overwritten.
 template <typename ctype>
-void BinOpOnDifferentRegisters(WasmExecutionMode execution_mode, ValueType type,
-                               Vector<const ctype> inputs, WasmOpcode opcode,
-                               std::function<ctype(ctype, ctype)> expect_fn) {
+void BinOpOnDifferentRegisters(
+    WasmExecutionMode execution_mode, ValueType type,
+    Vector<const ctype> inputs, WasmOpcode opcode,
+    std::function<ctype(ctype, ctype, bool*)> expect_fn) {
   static constexpr int kMaxNumLocals = 8;
   for (int num_locals = 1; num_locals < kMaxNumLocals; ++num_locals) {
     // {init_locals_code} is shared by all code generated in the loop below.
@@ -3177,33 +3188,63 @@ void BinOpOnDifferentRegisters(WasmExecutionMode execution_mode, ValueType type,
     for (int i = 0; i < num_locals; ++i) {
       ADD_CODE(
           init_locals_code,
-          WASM_SET_LOCAL(i, WASM_LOAD_MEM(WasmOpcodes::MachineTypeFor(type),
+          WASM_SET_LOCAL(i, WASM_LOAD_MEM(ValueTypes::MachineTypeFor(type),
                                           WASM_I32V_2(sizeof(ctype) * i))));
     }
+    // {write_locals_code} is shared by all code generated in the loop below.
+    std::vector<byte> write_locals_code;
+    // Write locals back into memory, shifted by one element to the right.
+    for (int i = 0; i < num_locals; ++i) {
+      ADD_CODE(write_locals_code,
+               WASM_STORE_MEM(ValueTypes::MachineTypeFor(type),
+                              WASM_I32V_2(sizeof(ctype) * (i + 1)),
+                              WASM_GET_LOCAL(i)));
+    }
     for (int lhs = 0; lhs < num_locals; ++lhs) {
       for (int rhs = 0; rhs < num_locals; ++rhs) {
         WasmRunner<int32_t> r(execution_mode);
-        ctype* memory = r.builder().AddMemoryElems<ctype>(num_locals);
+        ctype* memory =
+            r.builder().AddMemoryElems<ctype>(kWasmPageSize / sizeof(ctype));
         for (int i = 0; i < num_locals; ++i) {
           r.AllocateLocal(type);
         }
         std::vector<byte> code(init_locals_code);
         ADD_CODE(code,
-                 // Store the result of the binary operation at memory 0.
-                 WASM_STORE_MEM(WasmOpcodes::MachineTypeFor(type), WASM_ZERO,
+                 // Store the result of the binary operation at memory[0].
+                 WASM_STORE_MEM(ValueTypes::MachineTypeFor(type), WASM_ZERO,
                                 WASM_BINOP(opcode, WASM_GET_LOCAL(lhs),
                                            WASM_GET_LOCAL(rhs))),
                  // Return 0.
                  WASM_ZERO);
+        code.insert(code.end(), write_locals_code.begin(),
+                    write_locals_code.end());
         r.Build(code.data(), code.data() + code.size());
         for (ctype lhs_value : inputs) {
           for (ctype rhs_value : inputs) {
             if (lhs == rhs) lhs_value = rhs_value;
-            WriteLittleEndianValue<ctype>(&memory[lhs], lhs_value);
-            WriteLittleEndianValue<ctype>(&memory[rhs], rhs_value);
-            int64_t expect = expect_fn(lhs_value, rhs_value);
+            for (int i = 0; i < num_locals; ++i) {
+              ctype value =
+                  i == lhs ? lhs_value
+                           : i == rhs ? rhs_value : static_cast<ctype>(i + 47);
+              WriteLittleEndianValue<ctype>(
+                  reinterpret_cast<Address>(&memory[i]), value);
+            }
+            bool trap = false;
+            int64_t expect = expect_fn(lhs_value, rhs_value, &trap);
+            if (trap) {
+              CHECK_TRAP(r.Call());
+              continue;
+            }
             CHECK_EQ(0, r.Call());
-            CHECK_EQ(expect, ReadLittleEndianValue<ctype>(&memory[0]));
+            CHECK_EQ(expect, ReadLittleEndianValue<ctype>(
+                                 reinterpret_cast<Address>(&memory[0])));
+            for (int i = 0; i < num_locals; ++i) {
+              ctype value =
+                  i == lhs ? lhs_value
+                           : i == rhs ? rhs_value : static_cast<ctype>(i + 47);
+              CHECK_EQ(value, ReadLittleEndianValue<ctype>(
+                                  reinterpret_cast<Address>(&memory[i + 1])));
+            }
           }
         }
       }
@@ -3213,86 +3254,198 @@ void BinOpOnDifferentRegisters(WasmExecutionMode execution_mode, ValueType type,
 
 // Keep this list small, the BinOpOnDifferentRegisters test is running long
 // enough already.
-static constexpr int32_t kSome32BitInputs[] = {0, 1, 31, 0xff112233};
+static constexpr int32_t kSome32BitInputs[] = {0, 1, -1, 31, 0xff112233};
 static constexpr int64_t kSome64BitInputs[] = {
-    0, 1, 31, 63, 0x100000000, 0xff11223344556677};
+    0, 1, -1, 31, 63, 0x100000000, 0xff11223344556677};
 
 WASM_EXEC_TEST(I32AddOnDifferentRegisters) {
   BinOpOnDifferentRegisters<int32_t>(
       execution_mode, kWasmI32, ArrayVector(kSome32BitInputs), kExprI32Add,
-      [](int32_t lhs, int32_t rhs) { return lhs + rhs; });
+      [](int32_t lhs, int32_t rhs, bool* trap) { return lhs + rhs; });
 }
 
 WASM_EXEC_TEST(I32SubOnDifferentRegisters) {
   BinOpOnDifferentRegisters<int32_t>(
       execution_mode, kWasmI32, ArrayVector(kSome32BitInputs), kExprI32Sub,
-      [](int32_t lhs, int32_t rhs) { return lhs - rhs; });
+      [](int32_t lhs, int32_t rhs, bool* trap) { return lhs - rhs; });
 }
 
 WASM_EXEC_TEST(I32MulOnDifferentRegisters) {
   BinOpOnDifferentRegisters<int32_t>(
       execution_mode, kWasmI32, ArrayVector(kSome32BitInputs), kExprI32Mul,
-      [](int32_t lhs, int32_t rhs) { return lhs * rhs; });
+      [](int32_t lhs, int32_t rhs, bool* trap) { return lhs * rhs; });
 }
 
 WASM_EXEC_TEST(I32ShlOnDifferentRegisters) {
   BinOpOnDifferentRegisters<int32_t>(
       execution_mode, kWasmI32, ArrayVector(kSome32BitInputs), kExprI32Shl,
-      [](int32_t lhs, int32_t rhs) { return lhs << (rhs & 31); });
+      [](int32_t lhs, int32_t rhs, bool* trap) { return lhs << (rhs & 31); });
 }
 
 WASM_EXEC_TEST(I32ShrSOnDifferentRegisters) {
   BinOpOnDifferentRegisters<int32_t>(
       execution_mode, kWasmI32, ArrayVector(kSome32BitInputs), kExprI32ShrS,
-      [](int32_t lhs, int32_t rhs) { return lhs >> (rhs & 31); });
+      [](int32_t lhs, int32_t rhs, bool* trap) { return lhs >> (rhs & 31); });
 }
 
 WASM_EXEC_TEST(I32ShrUOnDifferentRegisters) {
   BinOpOnDifferentRegisters<int32_t>(
       execution_mode, kWasmI32, ArrayVector(kSome32BitInputs), kExprI32ShrU,
-      [](int32_t lhs, int32_t rhs) {
+      [](int32_t lhs, int32_t rhs, bool* trap) {
         return static_cast<uint32_t>(lhs) >> (rhs & 31);
       });
 }
 
+WASM_EXEC_TEST(I32DivSOnDifferentRegisters) {
+  BinOpOnDifferentRegisters<int32_t>(
+      execution_mode, kWasmI32, ArrayVector(kSome32BitInputs), kExprI32DivS,
+      [](int32_t lhs, int32_t rhs, bool* trap) {
+        *trap = rhs == 0;
+        return *trap ? 0 : lhs / rhs;
+      });
+}
+
+WASM_EXEC_TEST(I32DivUOnDifferentRegisters) {
+  BinOpOnDifferentRegisters<int32_t>(
+      execution_mode, kWasmI32, ArrayVector(kSome32BitInputs), kExprI32DivU,
+      [](uint32_t lhs, uint32_t rhs, bool* trap) {
+        *trap = rhs == 0;
+        return *trap ? 0 : lhs / rhs;
+      });
+}
+
+WASM_EXEC_TEST(I32RemSOnDifferentRegisters) {
+  BinOpOnDifferentRegisters<int32_t>(
+      execution_mode, kWasmI32, ArrayVector(kSome32BitInputs), kExprI32RemS,
+      [](int32_t lhs, int32_t rhs, bool* trap) {
+        *trap = rhs == 0;
+        return *trap || rhs == -1 ? 0 : lhs % rhs;
+      });
+}
+
+WASM_EXEC_TEST(I32RemUOnDifferentRegisters) {
+  BinOpOnDifferentRegisters<int32_t>(
+      execution_mode, kWasmI32, ArrayVector(kSome32BitInputs), kExprI32RemU,
+      [](uint32_t lhs, uint32_t rhs, bool* trap) {
+        *trap = rhs == 0;
+        return *trap ? 0 : lhs % rhs;
+      });
+}
+
 WASM_EXEC_TEST(I64AddOnDifferentRegisters) {
   BinOpOnDifferentRegisters<int64_t>(
       execution_mode, kWasmI64, ArrayVector(kSome64BitInputs), kExprI64Add,
-      [](int64_t lhs, int64_t rhs) { return lhs + rhs; });
+      [](int64_t lhs, int64_t rhs, bool* trap) { return lhs + rhs; });
 }
 
 WASM_EXEC_TEST(I64SubOnDifferentRegisters) {
   BinOpOnDifferentRegisters<int64_t>(
       execution_mode, kWasmI64, ArrayVector(kSome64BitInputs), kExprI64Sub,
-      [](int64_t lhs, int64_t rhs) { return lhs - rhs; });
+      [](int64_t lhs, int64_t rhs, bool* trap) { return lhs - rhs; });
 }
 
 WASM_EXEC_TEST(I64MulOnDifferentRegisters) {
   BinOpOnDifferentRegisters<int64_t>(
       execution_mode, kWasmI64, ArrayVector(kSome64BitInputs), kExprI64Mul,
-      [](int64_t lhs, int64_t rhs) { return lhs * rhs; });
+      [](int64_t lhs, int64_t rhs, bool* trap) { return lhs * rhs; });
 }
 
 WASM_EXEC_TEST(I64ShlOnDifferentRegisters) {
   BinOpOnDifferentRegisters<int64_t>(
       execution_mode, kWasmI64, ArrayVector(kSome64BitInputs), kExprI64Shl,
-      [](int64_t lhs, int64_t rhs) { return lhs << (rhs & 63); });
+      [](int64_t lhs, int64_t rhs, bool* trap) { return lhs << (rhs & 63); });
 }
 
 WASM_EXEC_TEST(I64ShrSOnDifferentRegisters) {
   BinOpOnDifferentRegisters<int64_t>(
       execution_mode, kWasmI64, ArrayVector(kSome64BitInputs), kExprI64ShrS,
-      [](int64_t lhs, int64_t rhs) { return lhs >> (rhs & 63); });
+      [](int64_t lhs, int64_t rhs, bool* trap) { return lhs >> (rhs & 63); });
 }
 
 WASM_EXEC_TEST(I64ShrUOnDifferentRegisters) {
   BinOpOnDifferentRegisters<int64_t>(
       execution_mode, kWasmI64, ArrayVector(kSome64BitInputs), kExprI64ShrU,
-      [](int64_t lhs, int64_t rhs) {
+      [](int64_t lhs, int64_t rhs, bool* trap) {
         return static_cast<uint64_t>(lhs) >> (rhs & 63);
       });
 }
 
+WASM_EXEC_TEST(I64DivSOnDifferentRegisters) {
+  BinOpOnDifferentRegisters<int64_t>(
+      execution_mode, kWasmI64, ArrayVector(kSome64BitInputs), kExprI64DivS,
+      [](int64_t lhs, int64_t rhs, bool* trap) {
+        *trap = rhs == 0 ||
+                (rhs == -1 && lhs == std::numeric_limits<int64_t>::min());
+        return *trap ? 0 : lhs / rhs;
+      });
+}
+
+WASM_EXEC_TEST(I64DivUOnDifferentRegisters) {
+  BinOpOnDifferentRegisters<int64_t>(
+      execution_mode, kWasmI64, ArrayVector(kSome64BitInputs), kExprI64DivU,
+      [](uint64_t lhs, uint64_t rhs, bool* trap) {
+        *trap = rhs == 0;
+        return *trap ? 0 : lhs / rhs;
+      });
+}
+
+WASM_EXEC_TEST(I64RemSOnDifferentRegisters) {
+  BinOpOnDifferentRegisters<int64_t>(
+      execution_mode, kWasmI64, ArrayVector(kSome64BitInputs), kExprI64RemS,
+      [](int64_t lhs, int64_t rhs, bool* trap) {
+        *trap = rhs == 0;
+        return *trap || rhs == -1 ? 0 : lhs % rhs;
+      });
+}
+
+WASM_EXEC_TEST(I64RemUOnDifferentRegisters) {
+  BinOpOnDifferentRegisters<int64_t>(
+      execution_mode, kWasmI64, ArrayVector(kSome64BitInputs), kExprI64RemU,
+      [](uint64_t lhs, uint64_t rhs, bool* trap) {
+        *trap = rhs == 0;
+        return *trap ? 0 : lhs % rhs;
+      });
+}
+
+TEST(Liftoff_tier_up) {
+  WasmRunner<int32_t, int32_t, int32_t> r(WasmExecutionMode::kExecuteLiftoff);
+
+  WasmFunctionCompiler& add = r.NewFunction<int32_t, int32_t, int32_t>("add");
+  BUILD(add, WASM_I32_ADD(WASM_GET_LOCAL(0), WASM_GET_LOCAL(1)));
+
+  WasmFunctionCompiler& sub = r.NewFunction<int32_t, int32_t, int32_t>("sub");
+  BUILD(sub, WASM_I32_SUB(WASM_GET_LOCAL(0), WASM_GET_LOCAL(1)));
+
+  // Create the main function, which shall call {add}.
+  BUILD(r, WASM_CALL_FUNCTION(add.function_index(), WASM_GET_LOCAL(0),
+                              WASM_GET_LOCAL(1)));
+
+  NativeModule* native_module =
+      r.builder().instance_object()->module_object()->native_module();
+
+  // This test only works if we managed to compile with Liftoff.
+  if (native_module->code(add.function_index())->is_liftoff()) {
+    // First run should execute {add}.
+    CHECK_EQ(18, r.Call(11, 7));
+
+    // Now make a copy of the {sub} function, and add it to the native module at
+    // the index of {add}.
+    CodeDesc desc;
+    memset(&desc, 0, sizeof(CodeDesc));
+    WasmCode* sub_code = native_module->code(sub.function_index());
+    size_t sub_size = sub_code->instructions().size();
+    std::unique_ptr<byte[]> buffer(new byte[sub_code->instructions().size()]);
+    memcpy(buffer.get(), sub_code->instructions().start(), sub_size);
+    desc.buffer = buffer.get();
+    desc.instr_size = static_cast<int>(sub_size);
+    native_module->AddCode(add.function_index(), desc, 0, 0, 0, {},
+                           OwnedVector<byte>(), WasmCode::kOther);
+
+    // Second run should now execute {sub}.
+    CHECK_EQ(4, r.Call(11, 7));
+  }
+}
+
 #undef B1
 #undef B2
 #undef RET
diff --git a/deps/v8/test/cctest/wasm/test-streaming-compilation.cc b/deps/v8/test/cctest/wasm/test-streaming-compilation.cc
index 6716ded40db24c..e9ee63d93c29bc 100644
--- a/deps/v8/test/cctest/wasm/test-streaming-compilation.cc
+++ b/deps/v8/test/cctest/wasm/test-streaming-compilation.cc
@@ -7,7 +7,6 @@
 #include "src/v8.h"
 #include "src/vector.h"
 
-#include "src/wasm/compilation-manager.h"
 #include "src/wasm/module-decoder.h"
 #include "src/wasm/streaming-decoder.h"
 #include "src/wasm/wasm-engine.h"
@@ -35,11 +34,6 @@ class MockPlatform final : public TestPlatform {
     return task_runner_;
   }
 
-  std::shared_ptr<TaskRunner> GetWorkerThreadsTaskRunner(
-      v8::Isolate* isolate) override {
-    return task_runner_;
-  }
-
   void CallOnForegroundThread(v8::Isolate* isolate, Task* task) override {
     task_runner_->PostTask(std::unique_ptr<Task>(task));
   }
@@ -88,25 +82,39 @@ class MockPlatform final : public TestPlatform {
 
 namespace {
 
+enum class CompilationState {
+  kPending,
+  kFinished,
+  kFailed,
+};
+
+class TestResolver : public i::wasm::CompilationResultResolver {
+ public:
+  explicit TestResolver(CompilationState* state) : state_(state) {}
+
+  void OnCompilationSucceeded(i::Handle<i::WasmModuleObject> module) override {
+    *state_ = CompilationState::kFinished;
+  }
+
+  void OnCompilationFailed(i::Handle<i::Object> error_reason) override {
+    *state_ = CompilationState::kFailed;
+  }
+
+ private:
+  CompilationState* state_;
+};
+
 class StreamTester {
  public:
   StreamTester() : zone_(&allocator_, "StreamTester") {
     v8::Isolate* isolate = CcTest::isolate();
     i::Isolate* i_isolate = CcTest::i_isolate();
 
-    // Create the promise for the streaming compilation.
     v8::Local<v8::Context> context = isolate->GetCurrentContext();
-    v8::Local<Promise::Resolver> resolver;
-    CHECK(Promise::Resolver::New(context).ToLocal(&resolver));
-    CHECK(!i_isolate->has_scheduled_exception());
-    promise_ = resolver->GetPromise();
-
-    i::Handle<i::JSPromise> i_promise = v8::Utils::OpenHandle(*promise_);
 
-    stream_ = i_isolate->wasm_engine()
-                  ->compilation_manager()
-                  ->StartStreamingCompilation(
-                      i_isolate, v8::Utils::OpenHandle(*context), i_promise);
+    stream_ = i_isolate->wasm_engine()->StartStreamingCompilation(
+        i_isolate, v8::Utils::OpenHandle(*context),
+        base::make_unique<TestResolver>(&state_));
   }
 
   std::shared_ptr<StreamingDecoder> stream() { return stream_; }
@@ -116,15 +124,11 @@ class StreamTester {
     static_cast<MockPlatform*>(i::V8::GetCurrentPlatform())->ExecuteTasks();
   }
 
-  bool IsPromiseFulfilled() {
-    return promise_->State() == v8::Promise::kFulfilled;
-  }
+  bool IsPromiseFulfilled() { return state_ == CompilationState::kFinished; }
 
-  bool IsPromiseRejected() {
-    return promise_->State() == v8::Promise::kRejected;
-  }
+  bool IsPromiseRejected() { return state_ == CompilationState::kFailed; }
 
-  bool IsPromisePending() { return promise_->State() == v8::Promise::kPending; }
+  bool IsPromisePending() { return state_ == CompilationState::kPending; }
 
   void OnBytesReceived(const uint8_t* start, size_t length) {
     stream_->OnBytesReceived(Vector<const uint8_t>(start, length));
@@ -137,7 +141,7 @@ class StreamTester {
  private:
   AccountingAllocator allocator_;
   Zone zone_;
-  v8::Local<v8::Promise> promise_;
+  CompilationState state_ = CompilationState::kPending;
   std::shared_ptr<StreamingDecoder> stream_;
 };
 }  // namespace
@@ -211,8 +215,7 @@ size_t GetFunctionOffset(i::Isolate* isolate, const uint8_t* buffer,
   ModuleResult result = SyncDecodeWasmModule(isolate, buffer, buffer + size,
                                              false, ModuleOrigin::kWasmOrigin);
   CHECK(result.ok());
-  std::unique_ptr<WasmModule> module = std::move(result.val);
-  const WasmFunction* func = &module->functions[1];
+  const WasmFunction* func = &result.val->functions[1];
   return func->code.offset();
 }
 
diff --git a/deps/v8/test/cctest/wasm/test-wasm-breakpoints.cc b/deps/v8/test/cctest/wasm/test-wasm-breakpoints.cc
index 49e4b6ac44f198..ef0a0e545e381d 100644
--- a/deps/v8/test/cctest/wasm/test-wasm-breakpoints.cc
+++ b/deps/v8/test/cctest/wasm/test-wasm-breakpoints.cc
@@ -22,10 +22,10 @@ namespace wasm {
 namespace {
 
 void CheckLocations(
-    WasmSharedModuleData* shared, debug::Location start, debug::Location end,
+    WasmModuleObject* module_object, debug::Location start, debug::Location end,
     std::initializer_list<debug::Location> expected_locations_init) {
   std::vector<debug::BreakLocation> locations;
-  bool success = shared->GetPossibleBreakpoints(start, end, &locations);
+  bool success = module_object->GetPossibleBreakpoints(start, end, &locations);
   CHECK(success);
 
   printf("got %d locations: ", static_cast<int>(locations.size()));
@@ -45,10 +45,10 @@ void CheckLocations(
   }
 }
 
-void CheckLocationsFail(WasmSharedModuleData* shared, debug::Location start,
+void CheckLocationsFail(WasmModuleObject* module_object, debug::Location start,
                         debug::Location end) {
   std::vector<debug::BreakLocation> locations;
-  bool success = shared->GetPossibleBreakpoints(start, end, &locations);
+  bool success = module_object->GetPossibleBreakpoints(start, end, &locations);
   CHECK(!success);
 }
 
@@ -87,7 +87,6 @@ class BreakHandler : public debug::DebugDelegate {
   std::vector<BreakPoint> expected_breaks_;
 
   void BreakProgramRequested(v8::Local<v8::Context> paused_context,
-                             v8::Local<v8::Object> exec_state,
                              const std::vector<int>&) override {
     printf("Break #%d\n", count_);
     CHECK_GT(expected_breaks_.size(), count_);
@@ -121,13 +120,14 @@ void SetBreakpoint(WasmRunnerBase& runner, int function_index, int byte_offset,
   int code_offset = func_offset + byte_offset;
   if (expected_set_byte_offset == -1) expected_set_byte_offset = byte_offset;
   Handle<WasmInstanceObject> instance = runner.builder().instance_object();
-  Handle<WasmCompiledModule> compiled_module(instance->compiled_module());
+  Handle<WasmModuleObject> module_object(instance->module_object(),
+                                         runner.main_isolate());
   static int break_index = 0;
   Handle<BreakPoint> break_point =
       runner.main_isolate()->factory()->NewBreakPoint(
           break_index++, runner.main_isolate()->factory()->empty_string());
-  CHECK(WasmCompiledModule::SetBreakPoint(compiled_module, &code_offset,
-                                          break_point));
+  CHECK(WasmModuleObject::SetBreakPoint(module_object, &code_offset,
+                                        break_point));
   int set_byte_offset = code_offset - func_offset;
   CHECK_EQ(expected_set_byte_offset, set_byte_offset);
   // Also set breakpoint on the debug info of the instance directly, since the
@@ -192,7 +192,6 @@ class CollectValuesBreakHandler : public debug::DebugDelegate {
   std::vector<BreakpointValues> expected_values_;
 
   void BreakProgramRequested(v8::Local<v8::Context> paused_context,
-                             v8::Local<v8::Object> exec_state,
                              const std::vector<int>&) override {
     printf("Break #%d\n", count_);
     CHECK_GT(expected_values_.size(), count_);
@@ -248,25 +247,25 @@ WASM_COMPILED_EXEC_TEST(WasmCollectPossibleBreakpoints) {
   BUILD(runner, WASM_NOP, WASM_I32_ADD(WASM_ZERO, WASM_ONE));
 
   WasmInstanceObject* instance = *runner.builder().instance_object();
-  WasmSharedModuleData* shared = instance->compiled_module()->shared();
+  WasmModuleObject* module_object = instance->module_object();
 
   std::vector<debug::Location> locations;
   // Check all locations for function 0.
-  CheckLocations(shared, {0, 0}, {1, 0},
+  CheckLocations(module_object, {0, 0}, {1, 0},
                  {{0, 1}, {0, 2}, {0, 4}, {0, 6}, {0, 7}});
   // Check a range ending at an instruction.
-  CheckLocations(shared, {0, 2}, {0, 4}, {{0, 2}});
+  CheckLocations(module_object, {0, 2}, {0, 4}, {{0, 2}});
   // Check a range ending one behind an instruction.
-  CheckLocations(shared, {0, 2}, {0, 5}, {{0, 2}, {0, 4}});
+  CheckLocations(module_object, {0, 2}, {0, 5}, {{0, 2}, {0, 4}});
   // Check a range starting at an instruction.
-  CheckLocations(shared, {0, 7}, {0, 8}, {{0, 7}});
+  CheckLocations(module_object, {0, 7}, {0, 8}, {{0, 7}});
   // Check from an instruction to beginning of next function.
-  CheckLocations(shared, {0, 7}, {1, 0}, {{0, 7}});
+  CheckLocations(module_object, {0, 7}, {1, 0}, {{0, 7}});
   // Check from end of one function (no valid instruction position) to beginning
   // of next function. Must be empty, but not fail.
-  CheckLocations(shared, {0, 8}, {1, 0}, {});
+  CheckLocations(module_object, {0, 8}, {1, 0}, {});
   // Check from one after the end of the function. Must fail.
-  CheckLocationsFail(shared, {0, 9}, {1, 0});
+  CheckLocationsFail(module_object, {0, 9}, {1, 0});
 }
 
 WASM_COMPILED_EXEC_TEST(WasmSimpleBreak) {
@@ -320,7 +319,7 @@ WASM_COMPILED_EXEC_TEST(WasmSimpleStepping) {
 WASM_COMPILED_EXEC_TEST(WasmStepInAndOut) {
   WasmRunner<int, int> runner(execution_mode);
   WasmFunctionCompiler& f2 = runner.NewFunction<void>();
-  f2.AllocateLocal(ValueType::kWord32);
+  f2.AllocateLocal(kWasmI32);
 
   // Call f2 via indirect call, because a direct call requires f2 to exist when
   // we compile main, but we need to compile main first so that the order of
@@ -359,9 +358,9 @@ WASM_COMPILED_EXEC_TEST(WasmStepInAndOut) {
 
 WASM_COMPILED_EXEC_TEST(WasmGetLocalsAndStack) {
   WasmRunner<void, int> runner(execution_mode);
-  runner.AllocateLocal(ValueType::kWord64);
-  runner.AllocateLocal(ValueType::kFloat32);
-  runner.AllocateLocal(ValueType::kFloat64);
+  runner.AllocateLocal(kWasmI64);
+  runner.AllocateLocal(kWasmF32);
+  runner.AllocateLocal(kWasmF64);
 
   BUILD(runner,
         // set [1] to 17
diff --git a/deps/v8/test/cctest/wasm/test-wasm-codegen.cc b/deps/v8/test/cctest/wasm/test-wasm-codegen.cc
index 189ef4687865a0..cbd943ca093d0d 100644
--- a/deps/v8/test/cctest/wasm/test-wasm-codegen.cc
+++ b/deps/v8/test/cctest/wasm/test-wasm-codegen.cc
@@ -58,10 +58,10 @@ void BuildTrivialModule(Zone* zone, ZoneBuffer* buffer) {
 }
 
 bool TestModule(Isolate* isolate,
-                v8::WasmCompiledModule::CallerOwnedBuffer wire_bytes) {
+                v8::WasmCompiledModule::BufferReference wire_bytes) {
   HandleScope scope(isolate);
 
-  v8::WasmCompiledModule::CallerOwnedBuffer serialized_module(nullptr, 0);
+  v8::WasmCompiledModule::BufferReference serialized_module(nullptr, 0);
   MaybeLocal<v8::WasmCompiledModule> module =
       v8::WasmCompiledModule::DeserializeOrCompile(
           reinterpret_cast<v8::Isolate*>(isolate), serialized_module,
@@ -76,8 +76,8 @@ TEST(PropertiesOfCodegenCallbacks) {
   Zone zone(&allocator, ZONE_NAME);
   ZoneBuffer buffer(&zone);
   BuildTrivialModule(&zone, &buffer);
-  v8::WasmCompiledModule::CallerOwnedBuffer wire_bytes = {buffer.begin(),
-                                                          buffer.size()};
+  v8::WasmCompiledModule::BufferReference wire_bytes = {buffer.begin(),
+                                                        buffer.size()};
   Isolate* isolate = CcTest::InitIsolateOnce();
   HandleScope scope(isolate);
   testing::SetupIsolateForWasmModule(isolate);
diff --git a/deps/v8/test/cctest/wasm/test-wasm-serialization.cc b/deps/v8/test/cctest/wasm/test-wasm-serialization.cc
new file mode 100644
index 00000000000000..9475332ad07df2
--- /dev/null
+++ b/deps/v8/test/cctest/wasm/test-wasm-serialization.cc
@@ -0,0 +1,319 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include <stdlib.h>
+#include <string.h>
+
+#include "src/api.h"
+#include "src/objects-inl.h"
+#include "src/snapshot/code-serializer.h"
+#include "src/version.h"
+#include "src/wasm/module-decoder.h"
+#include "src/wasm/wasm-engine.h"
+#include "src/wasm/wasm-memory.h"
+#include "src/wasm/wasm-module-builder.h"
+#include "src/wasm/wasm-module.h"
+#include "src/wasm/wasm-objects-inl.h"
+#include "src/wasm/wasm-opcodes.h"
+
+#include "test/cctest/cctest.h"
+#include "test/common/wasm/flag-utils.h"
+#include "test/common/wasm/test-signatures.h"
+#include "test/common/wasm/wasm-macro-gen.h"
+#include "test/common/wasm/wasm-module-runner.h"
+
+namespace v8 {
+namespace internal {
+namespace wasm {
+namespace test_wasm_serialization {
+
+namespace {
+void Cleanup(Isolate* isolate = CcTest::InitIsolateOnce()) {
+  // By sending a low memory notifications, we will try hard to collect all
+  // garbage and will therefore also invoke all weak callbacks of actually
+  // unreachable persistent handles.
+  reinterpret_cast<v8::Isolate*>(isolate)->LowMemoryNotification();
+}
+
+#define EMIT_CODE_WITH_END(f, code)  \
+  do {                               \
+    f->EmitCode(code, sizeof(code)); \
+    f->Emit(kExprEnd);               \
+  } while (false)
+
+}  // namespace
+
+// Approximate gtest TEST_F style, in case we adopt gtest.
+class WasmSerializationTest {
+ public:
+  WasmSerializationTest() : zone_(&allocator_, ZONE_NAME) {
+    // Don't call here if we move to gtest.
+    SetUp();
+  }
+
+  static void BuildWireBytes(Zone* zone, ZoneBuffer* buffer) {
+    WasmModuleBuilder* builder = new (zone) WasmModuleBuilder(zone);
+    TestSignatures sigs;
+
+    WasmFunctionBuilder* f = builder->AddFunction(sigs.i_i());
+    byte code[] = {WASM_GET_LOCAL(0), kExprI32Const, 1, kExprI32Add};
+    EMIT_CODE_WITH_END(f, code);
+    builder->AddExport(CStrVector(kFunctionName), f);
+
+    builder->WriteTo(*buffer);
+  }
+
+  void ClearSerializedData() { serialized_bytes_ = {nullptr, 0}; }
+
+  void InvalidateVersion() {
+    uint32_t* slot = reinterpret_cast<uint32_t*>(
+        const_cast<uint8_t*>(serialized_bytes_.start) +
+        SerializedCodeData::kVersionHashOffset);
+    *slot = Version::Hash() + 1;
+  }
+
+  void InvalidateWireBytes() {
+    memset(const_cast<uint8_t*>(wire_bytes_.start), 0, wire_bytes_.size / 2);
+  }
+
+  void InvalidateLength() {
+    uint32_t* slot = reinterpret_cast<uint32_t*>(
+        const_cast<uint8_t*>(serialized_bytes_.start) +
+        SerializedCodeData::kPayloadLengthOffset);
+    *slot = 0u;
+  }
+
+  v8::MaybeLocal<v8::WasmCompiledModule> Deserialize() {
+    ErrorThrower thrower(current_isolate(), "");
+    v8::MaybeLocal<v8::WasmCompiledModule> deserialized =
+        v8::WasmCompiledModule::DeserializeOrCompile(
+            current_isolate_v8(), serialized_bytes_, wire_bytes_);
+    return deserialized;
+  }
+
+  void DeserializeAndRun() {
+    ErrorThrower thrower(current_isolate(), "");
+    v8::Local<v8::WasmCompiledModule> deserialized_module;
+    CHECK(Deserialize().ToLocal(&deserialized_module));
+    Handle<WasmModuleObject> module_object = Handle<WasmModuleObject>::cast(
+        v8::Utils::OpenHandle(*deserialized_module));
+    {
+      DisallowHeapAllocation assume_no_gc;
+      Vector<const byte> deserialized_module_wire_bytes =
+          module_object->native_module()->wire_bytes();
+      CHECK_EQ(deserialized_module_wire_bytes.size(), wire_bytes_.size);
+      CHECK_EQ(memcmp(deserialized_module_wire_bytes.start(), wire_bytes_.start,
+                      wire_bytes_.size),
+               0);
+    }
+    Handle<WasmInstanceObject> instance =
+        current_isolate()
+            ->wasm_engine()
+            ->SyncInstantiate(current_isolate(), &thrower, module_object,
+                              Handle<JSReceiver>::null(),
+                              MaybeHandle<JSArrayBuffer>())
+            .ToHandleChecked();
+    Handle<Object> params[1] = {
+        Handle<Object>(Smi::FromInt(41), current_isolate())};
+    int32_t result = testing::CallWasmFunctionForTesting(
+        current_isolate(), instance, &thrower, kFunctionName, 1, params);
+    CHECK_EQ(42, result);
+  }
+
+  Isolate* current_isolate() {
+    return reinterpret_cast<Isolate*>(current_isolate_v8_);
+  }
+
+  ~WasmSerializationTest() {
+    // Don't call from here if we move to gtest
+    TearDown();
+  }
+
+  v8::Isolate* current_isolate_v8() { return current_isolate_v8_; }
+
+ private:
+  static const char* kFunctionName;
+
+  Zone* zone() { return &zone_; }
+
+  void SetUp() {
+    ZoneBuffer buffer(&zone_);
+    WasmSerializationTest::BuildWireBytes(zone(), &buffer);
+
+    Isolate* serialization_isolate = CcTest::InitIsolateOnce();
+    ErrorThrower thrower(serialization_isolate, "");
+    {
+      HandleScope scope(serialization_isolate);
+      testing::SetupIsolateForWasmModule(serialization_isolate);
+
+      MaybeHandle<WasmModuleObject> maybe_module_object =
+          serialization_isolate->wasm_engine()->SyncCompile(
+              serialization_isolate, &thrower,
+              ModuleWireBytes(buffer.begin(), buffer.end()));
+      Handle<WasmModuleObject> module_object =
+          maybe_module_object.ToHandleChecked();
+
+      v8::Local<v8::Object> v8_module_obj =
+          v8::Utils::ToLocal(Handle<JSObject>::cast(module_object));
+      CHECK(v8_module_obj->IsWebAssemblyCompiledModule());
+
+      v8::Local<v8::WasmCompiledModule> v8_compiled_module =
+          v8_module_obj.As<v8::WasmCompiledModule>();
+      v8::WasmCompiledModule::BufferReference uncompiled_bytes =
+          v8_compiled_module->GetWasmWireBytesRef();
+      uint8_t* bytes_copy = zone()->NewArray<uint8_t>(uncompiled_bytes.size);
+      memcpy(bytes_copy, uncompiled_bytes.start, uncompiled_bytes.size);
+      wire_bytes_ = {bytes_copy, uncompiled_bytes.size};
+      // keep alive data_ until the end
+      data_ = v8_compiled_module->Serialize();
+    }
+
+    serialized_bytes_ = {data_.first.get(), data_.second};
+
+    v8::Isolate::CreateParams create_params;
+    create_params.array_buffer_allocator =
+        serialization_isolate->array_buffer_allocator();
+
+    current_isolate_v8_ = v8::Isolate::New(create_params);
+    v8::HandleScope new_scope(current_isolate_v8());
+    v8::Local<v8::Context> deserialization_context =
+        v8::Context::New(current_isolate_v8());
+    deserialization_context->Enter();
+    testing::SetupIsolateForWasmModule(current_isolate());
+  }
+
+  void TearDown() {
+    current_isolate_v8()->Dispose();
+    current_isolate_v8_ = nullptr;
+  }
+
+  v8::internal::AccountingAllocator allocator_;
+  Zone zone_;
+  v8::WasmCompiledModule::SerializedModule data_;
+  v8::WasmCompiledModule::BufferReference wire_bytes_ = {nullptr, 0};
+  v8::WasmCompiledModule::BufferReference serialized_bytes_ = {nullptr, 0};
+  v8::Isolate* current_isolate_v8_;
+};
+
+const char* WasmSerializationTest::kFunctionName = "increment";
+
+TEST(DeserializeValidModule) {
+  WasmSerializationTest test;
+  {
+    HandleScope scope(test.current_isolate());
+    test.DeserializeAndRun();
+  }
+  Cleanup(test.current_isolate());
+  Cleanup();
+}
+
+TEST(DeserializeMismatchingVersion) {
+  WasmSerializationTest test;
+  {
+    HandleScope scope(test.current_isolate());
+    test.InvalidateVersion();
+    test.DeserializeAndRun();
+  }
+  Cleanup(test.current_isolate());
+  Cleanup();
+}
+
+TEST(DeserializeNoSerializedData) {
+  WasmSerializationTest test;
+  {
+    HandleScope scope(test.current_isolate());
+    test.ClearSerializedData();
+    test.DeserializeAndRun();
+  }
+  Cleanup(test.current_isolate());
+  Cleanup();
+}
+
+TEST(DeserializeInvalidLength) {
+  WasmSerializationTest test;
+  {
+    HandleScope scope(test.current_isolate());
+    test.InvalidateLength();
+    test.DeserializeAndRun();
+  }
+  Cleanup(test.current_isolate());
+  Cleanup();
+}
+
+TEST(DeserializeWireBytesAndSerializedDataInvalid) {
+  WasmSerializationTest test;
+  {
+    HandleScope scope(test.current_isolate());
+    test.InvalidateVersion();
+    test.InvalidateWireBytes();
+    test.Deserialize();
+  }
+  Cleanup(test.current_isolate());
+  Cleanup();
+}
+
+bool False(v8::Local<v8::Context> context, v8::Local<v8::String> source) {
+  return false;
+}
+
+TEST(BlockWasmCodeGenAtDeserialization) {
+  WasmSerializationTest test;
+  {
+    HandleScope scope(test.current_isolate());
+    test.current_isolate_v8()->SetAllowCodeGenerationFromStringsCallback(False);
+    v8::MaybeLocal<v8::WasmCompiledModule> nothing = test.Deserialize();
+    CHECK(nothing.IsEmpty());
+  }
+  Cleanup(test.current_isolate());
+  Cleanup();
+}
+
+TEST(TransferrableWasmModules) {
+  v8::internal::AccountingAllocator allocator;
+  Zone zone(&allocator, ZONE_NAME);
+
+  ZoneBuffer buffer(&zone);
+  WasmSerializationTest::BuildWireBytes(&zone, &buffer);
+
+  Isolate* from_isolate = CcTest::InitIsolateOnce();
+  ErrorThrower thrower(from_isolate, "");
+  std::vector<v8::WasmCompiledModule::TransferrableModule> store;
+  {
+    HandleScope scope(from_isolate);
+    testing::SetupIsolateForWasmModule(from_isolate);
+
+    MaybeHandle<WasmModuleObject> module_object =
+        from_isolate->wasm_engine()->SyncCompile(
+            from_isolate, &thrower,
+            ModuleWireBytes(buffer.begin(), buffer.end()));
+    v8::Local<v8::WasmCompiledModule> v8_module =
+        v8::Local<v8::WasmCompiledModule>::Cast(v8::Utils::ToLocal(
+            Handle<JSObject>::cast(module_object.ToHandleChecked())));
+    store.push_back(v8_module->GetTransferrableModule());
+  }
+
+  {
+    v8::Isolate::CreateParams create_params;
+    create_params.array_buffer_allocator =
+        from_isolate->array_buffer_allocator();
+    v8::Isolate* to_isolate = v8::Isolate::New(create_params);
+    {
+      v8::HandleScope new_scope(to_isolate);
+      v8::Local<v8::Context> deserialization_context =
+          v8::Context::New(to_isolate);
+      deserialization_context->Enter();
+      v8::MaybeLocal<v8::WasmCompiledModule> mod =
+          v8::WasmCompiledModule::FromTransferrableModule(to_isolate, store[0]);
+      CHECK(!mod.IsEmpty());
+    }
+    to_isolate->Dispose();
+  }
+}
+
+#undef EMIT_CODE_WITH_END
+
+}  // namespace test_wasm_serialization
+}  // namespace wasm
+}  // namespace internal
+}  // namespace v8
diff --git a/deps/v8/test/cctest/wasm/test-wasm-shared-engine.cc b/deps/v8/test/cctest/wasm/test-wasm-shared-engine.cc
new file mode 100644
index 00000000000000..8d9131ad753124
--- /dev/null
+++ b/deps/v8/test/cctest/wasm/test-wasm-shared-engine.cc
@@ -0,0 +1,198 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include <memory>
+
+#include "src/objects-inl.h"
+#include "src/wasm/wasm-engine.h"
+#include "src/wasm/wasm-module-builder.h"
+#include "src/wasm/wasm-module.h"
+#include "src/wasm/wasm-objects-inl.h"
+
+#include "test/cctest/cctest.h"
+#include "test/common/wasm/test-signatures.h"
+#include "test/common/wasm/wasm-macro-gen.h"
+#include "test/common/wasm/wasm-module-runner.h"
+
+namespace v8 {
+namespace internal {
+namespace wasm {
+namespace test_wasm_shared_engine {
+
+// Helper class representing a WebAssembly engine that is capable of being
+// shared between multiple Isolates, sharing the underlying generated code.
+class SharedEngine {
+ public:
+  explicit SharedEngine(size_t max_committed = kMaxWasmCodeMemory)
+      : wasm_engine_(base::make_unique<WasmEngine>(
+            base::make_unique<WasmCodeManager>(max_committed))) {}
+  ~SharedEngine() {
+    // Ensure no remaining uses exist.
+    CHECK(wasm_engine_.unique());
+  }
+
+  WasmEngine* engine() const { return wasm_engine_.get(); }
+  WasmCodeManager* code_manager() const { return engine()->code_manager(); }
+
+  int NumberOfExportedEngineUses() const {
+    // This class holds one implicit use itself, which we discount.
+    return static_cast<int>(wasm_engine_.use_count()) - 1;
+  }
+
+  std::shared_ptr<WasmEngine> ExportEngineForSharing() { return wasm_engine_; }
+
+ private:
+  std::shared_ptr<WasmEngine> wasm_engine_;
+};
+
+// Helper type definition representing a WebAssembly module shared between
+// multiple Isolates with implicit reference counting.
+using SharedModule = std::shared_ptr<NativeModule>;
+
+// Helper class representing an Isolate based on a given shared WebAssembly
+// engine available at construction time.
+class SharedEngineIsolate {
+ public:
+  explicit SharedEngineIsolate(SharedEngine* engine)
+      : isolate_(v8::Isolate::Allocate()) {
+    isolate()->set_wasm_engine(engine->ExportEngineForSharing());
+    v8::Isolate::CreateParams create_params;
+    create_params.array_buffer_allocator = CcTest::array_buffer_allocator();
+    v8::Isolate::Initialize(isolate_, create_params);
+    v8::HandleScope handle_scope(v8_isolate());
+    v8::Context::New(v8_isolate())->Enter();
+    testing::SetupIsolateForWasmModule(isolate());
+    zone_.reset(new Zone(isolate()->allocator(), ZONE_NAME));
+  }
+  ~SharedEngineIsolate() {
+    zone_.reset();
+    isolate_->Dispose();
+  }
+
+  Zone* zone() const { return zone_.get(); }
+  v8::Isolate* v8_isolate() { return isolate_; }
+  Isolate* isolate() { return reinterpret_cast<Isolate*>(isolate_); }
+
+  Handle<WasmInstanceObject> CompileAndInstantiate(ZoneBuffer* buffer) {
+    ErrorThrower thrower(isolate(), "CompileAndInstantiate");
+    MaybeHandle<WasmInstanceObject> instance =
+        testing::CompileAndInstantiateForTesting(
+            isolate(), &thrower,
+            ModuleWireBytes(buffer->begin(), buffer->end()));
+    return instance.ToHandleChecked();
+  }
+
+  // TODO(mstarzinger): Switch over to a public API for sharing modules via the
+  // {v8::WasmCompiledModule::TransferrableModule} class once it is ready.
+  Handle<WasmInstanceObject> ImportInstance(SharedModule shared_module) {
+    Vector<const byte> wire_bytes = shared_module->wire_bytes();
+    Handle<Script> script = CreateWasmScript(isolate(), wire_bytes);
+    Handle<WasmModuleObject> module_object =
+        WasmModuleObject::New(isolate(), shared_module, script);
+
+    // TODO(6792): Wrappers below might be cloned using {Factory::CopyCode}.
+    // This requires unlocking the code space here. This should eventually be
+    // moved into the allocator.
+    CodeSpaceMemoryModificationScope modification_scope(isolate()->heap());
+    CompileJsToWasmWrappers(isolate(), module_object);
+
+    ErrorThrower thrower(isolate(), "ImportInstance");
+    MaybeHandle<WasmInstanceObject> instance =
+        isolate()->wasm_engine()->SyncInstantiate(isolate(), &thrower,
+                                                  module_object, {}, {});
+    return instance.ToHandleChecked();
+  }
+
+  SharedModule ExportInstance(Handle<WasmInstanceObject> instance) {
+    return instance->module_object()->managed_native_module()->get();
+  }
+
+  int32_t Run(Handle<WasmInstanceObject> instance) {
+    return testing::RunWasmModuleForTesting(isolate(), instance, 0, nullptr);
+  }
+
+ private:
+  v8::Isolate* isolate_;
+  std::unique_ptr<Zone> zone_;
+};
+
+namespace {
+
+ZoneBuffer* BuildReturnConstantModule(Zone* zone, int constant) {
+  TestSignatures sigs;
+  ZoneBuffer* buffer = new (zone) ZoneBuffer(zone);
+  WasmModuleBuilder* builder = new (zone) WasmModuleBuilder(zone);
+  WasmFunctionBuilder* f = builder->AddFunction(sigs.i_v());
+  f->builder()->AddExport(CStrVector("main"), f);
+  byte code[] = {WASM_I32V_2(constant)};
+  f->EmitCode(code, sizeof(code));
+  f->Emit(kExprEnd);
+  builder->WriteTo(*buffer);
+  return buffer;
+}
+
+}  // namespace
+
+TEST(SharedEngineUseCount) {
+  SharedEngine engine;
+  CHECK_EQ(0, engine.NumberOfExportedEngineUses());
+  {
+    SharedEngineIsolate isolate(&engine);
+    CHECK_EQ(1, engine.NumberOfExportedEngineUses());
+  }
+  CHECK_EQ(0, engine.NumberOfExportedEngineUses());
+  {
+    SharedEngineIsolate isolate1(&engine);
+    CHECK_EQ(1, engine.NumberOfExportedEngineUses());
+    SharedEngineIsolate isolate2(&engine);
+    CHECK_EQ(2, engine.NumberOfExportedEngineUses());
+  }
+  CHECK_EQ(0, engine.NumberOfExportedEngineUses());
+}
+
+TEST(SharedEngineRunSeparated) {
+  SharedEngine engine;
+  {
+    SharedEngineIsolate isolate(&engine);
+    HandleScope scope(isolate.isolate());
+    ZoneBuffer* buffer = BuildReturnConstantModule(isolate.zone(), 23);
+    Handle<WasmInstanceObject> instance = isolate.CompileAndInstantiate(buffer);
+    CHECK_EQ(23, isolate.Run(instance));
+  }
+  {
+    SharedEngineIsolate isolate(&engine);
+    HandleScope scope(isolate.isolate());
+    ZoneBuffer* buffer = BuildReturnConstantModule(isolate.zone(), 42);
+    Handle<WasmInstanceObject> instance = isolate.CompileAndInstantiate(buffer);
+    CHECK_EQ(42, isolate.Run(instance));
+  }
+}
+
+TEST(SharedEngineRunImported) {
+  SharedEngine engine;
+  SharedModule module;
+  {
+    SharedEngineIsolate isolate(&engine);
+    HandleScope scope(isolate.isolate());
+    ZoneBuffer* buffer = BuildReturnConstantModule(isolate.zone(), 23);
+    Handle<WasmInstanceObject> instance = isolate.CompileAndInstantiate(buffer);
+    module = isolate.ExportInstance(instance);
+    CHECK_EQ(23, isolate.Run(instance));
+    CHECK_EQ(2, module.use_count());
+  }
+  CHECK_EQ(1, module.use_count());
+  {
+    SharedEngineIsolate isolate(&engine);
+    HandleScope scope(isolate.isolate());
+    Handle<WasmInstanceObject> instance = isolate.ImportInstance(module);
+    CHECK_EQ(23, isolate.Run(instance));
+    CHECK_EQ(2, module.use_count());
+  }
+  CHECK_EQ(1, module.use_count());
+}
+
+}  // namespace test_wasm_shared_engine
+}  // namespace wasm
+}  // namespace internal
+}  // namespace v8
diff --git a/deps/v8/test/cctest/wasm/test-wasm-stack.cc b/deps/v8/test/cctest/wasm/test-wasm-stack.cc
index 15fa21f04d84c6..227b90187a0a86 100644
--- a/deps/v8/test/cctest/wasm/test-wasm-stack.cc
+++ b/deps/v8/test/cctest/wasm/test-wasm-stack.cc
@@ -157,8 +157,7 @@ WASM_EXEC_TEST(CollectDetailedWasmStack_WasmError) {
     int unreachable_pos = 1 << (8 * pos_shift);
     TestSignatures sigs;
     // Create a WasmRunner with stack checks and traps enabled.
-    WasmRunner<int> r(execution_mode, 0, "main",
-                      compiler::kRuntimeExceptionSupport);
+    WasmRunner<int> r(execution_mode, 0, "main", kRuntimeExceptionSupport);
 
     std::vector<byte> code(unreachable_pos + 1, kExprNop);
     code[unreachable_pos] = kExprUnreachable;
diff --git a/deps/v8/test/cctest/wasm/test-wasm-trap-position.cc b/deps/v8/test/cctest/wasm/test-wasm-trap-position.cc
index b56cc6e0380400..6e2b2878ae7620 100644
--- a/deps/v8/test/cctest/wasm/test-wasm-trap-position.cc
+++ b/deps/v8/test/cctest/wasm/test-wasm-trap-position.cc
@@ -46,7 +46,7 @@ void CheckExceptionInfos(v8::internal::Isolate* i_isolate, Handle<Object> exc,
   CHECK(exc->IsJSError());
   v8::Isolate* v8_isolate = reinterpret_cast<v8::Isolate*>(i_isolate);
 
-  exc->Print();
+  exc->Print(i_isolate);
   // Extract stack frame from the exception.
   Local<v8::Value> localExc = Utils::ToLocal(exc);
   v8::Local<v8::StackTrace> stack = v8::Exception::GetStackTrace(localExc);
@@ -69,8 +69,7 @@ void CheckExceptionInfos(v8::internal::Isolate* i_isolate, Handle<Object> exc,
 // Trigger a trap for executing unreachable.
 WASM_EXEC_TEST(Unreachable) {
   // Create a WasmRunner with stack checks and traps enabled.
-  WasmRunner<void> r(execution_mode, 0, "main",
-                     compiler::kRuntimeExceptionSupport);
+  WasmRunner<void> r(execution_mode, 0, "main", kRuntimeExceptionSupport);
   TestSignatures sigs;
 
   BUILD(r, WASM_UNREACHABLE);
@@ -104,8 +103,7 @@ WASM_EXEC_TEST(Unreachable) {
 
 // Trigger a trap for loading from out-of-bounds.
 WASM_EXEC_TEST(IllegalLoad) {
-  WasmRunner<void> r(execution_mode, 0, "main",
-                     compiler::kRuntimeExceptionSupport);
+  WasmRunner<void> r(execution_mode, 0, "main", kRuntimeExceptionSupport);
   TestSignatures sigs;
 
   r.builder().AddMemory(0L);
diff --git a/deps/v8/test/cctest/wasm/wasm-atomics-utils.h b/deps/v8/test/cctest/wasm/wasm-atomics-utils.h
index c65d4c7d53c5e0..1a0dd345b7b835 100644
--- a/deps/v8/test/cctest/wasm/wasm-atomics-utils.h
+++ b/deps/v8/test/cctest/wasm/wasm-atomics-utils.h
@@ -5,7 +5,6 @@
 #ifndef WASM_ATOMICOP_UTILS_H
 #define WASM_ATOMICOP_UTILS_H
 
-#include "src/objects-inl.h"
 #include "test/cctest/cctest.h"
 #include "test/cctest/compiler/value-helper.h"
 #include "test/cctest/wasm/wasm-run-utils.h"
diff --git a/deps/v8/test/cctest/wasm/wasm-run-utils.cc b/deps/v8/test/cctest/wasm/wasm-run-utils.cc
index f2131a3e2a211d..36fcf470499e95 100644
--- a/deps/v8/test/cctest/wasm/wasm-run-utils.cc
+++ b/deps/v8/test/cctest/wasm/wasm-run-utils.cc
@@ -14,26 +14,25 @@ namespace wasm {
 
 TestingModuleBuilder::TestingModuleBuilder(
     Zone* zone, ManuallyImportedJSFunction* maybe_import,
-    WasmExecutionMode mode, compiler::RuntimeExceptionSupport exception_support,
+    WasmExecutionMode mode, RuntimeExceptionSupport exception_support,
     LowerSimd lower_simd)
-    : test_module_ptr_(&test_module_),
+    : test_module_(std::make_shared<WasmModule>()),
+      test_module_ptr_(test_module_.get()),
       isolate_(CcTest::InitIsolateOnce()),
       execution_mode_(mode),
       runtime_exception_support_(exception_support),
       lower_simd_(lower_simd) {
   WasmJs::Install(isolate_, true);
-  test_module_.globals_size = kMaxGlobalsSize;
+  test_module_->globals_buffer_size = kMaxGlobalsSize;
   memset(globals_data_, 0, sizeof(globals_data_));
 
   uint32_t maybe_import_index = 0;
   if (maybe_import) {
     // Manually add an imported function before any other functions.
-    // This must happen before the instance objectis created, since the
+    // This must happen before the instance object is created, since the
     // instance object allocates import entries.
-    maybe_import_index = AddFunction(maybe_import->sig, nullptr);
+    maybe_import_index = AddFunction(maybe_import->sig, nullptr, kImport);
     DCHECK_EQ(0, maybe_import_index);
-    test_module_.num_imported_functions = 1;
-    test_module_.functions[0].imported = true;
   }
 
   instance_object_ = InitInstanceObject();
@@ -41,17 +40,17 @@ TestingModuleBuilder::TestingModuleBuilder(
   if (maybe_import) {
     // Manually compile a wasm to JS wrapper and insert it into the instance.
     CodeSpaceMemoryModificationScope modification_scope(isolate_->heap());
-    Handle<Code> code = compiler::CompileWasmToJSWrapper(
+    MaybeHandle<Code> code = compiler::CompileWasmToJSWrapper(
         isolate_, maybe_import->js_function, maybe_import->sig,
-        maybe_import_index, test_module_.origin(),
-        trap_handler::IsTrapHandlerEnabled());
-    native_module_->ResizeCodeTableForTesting(maybe_import_index + 1,
-                                              kMaxFunctions);
+        maybe_import_index, test_module_->origin,
+        trap_handler::IsTrapHandlerEnabled() ? kUseTrapHandler
+                                             : kNoTrapHandler);
     auto wasm_to_js_wrapper = native_module_->AddCodeCopy(
-        code, wasm::WasmCode::kWasmToJsWrapper, maybe_import_index);
+        code.ToHandleChecked(), wasm::WasmCode::kWasmToJsWrapper,
+        maybe_import_index);
 
-    ImportedFunctionEntry(*instance_object_, maybe_import_index)
-        .set(*maybe_import->js_function, wasm_to_js_wrapper);
+    ImportedFunctionEntry(instance_object_, maybe_import_index)
+        .set_wasm_to_js(*maybe_import->js_function, wasm_to_js_wrapper);
   }
 
   if (mode == kExecuteInterpreter) {
@@ -60,18 +59,16 @@ TestingModuleBuilder::TestingModuleBuilder(
 }
 
 byte* TestingModuleBuilder::AddMemory(uint32_t size) {
-  CHECK(!test_module_.has_memory);
+  CHECK(!test_module_->has_memory);
   CHECK_NULL(mem_start_);
   CHECK_EQ(0, mem_size_);
   DCHECK(!instance_object_->has_memory_object());
-  test_module_.has_memory = true;
-  const bool enable_guard_regions =
-      trap_handler::IsTrapHandlerEnabled() && test_module_.is_wasm();
-  uint32_t alloc_size =
-      enable_guard_regions ? RoundUp(size, CommitPageSize()) : size;
+  DCHECK_IMPLIES(test_module_->origin == kWasmOrigin,
+                 size % kWasmPageSize == 0);
+  test_module_->has_memory = true;
+  uint32_t alloc_size = RoundUp(size, kWasmPageSize);
   Handle<JSArrayBuffer> new_buffer;
-  CHECK(wasm::NewArrayBuffer(isolate_, alloc_size, enable_guard_regions)
-            .ToHandle(&new_buffer));
+  CHECK(wasm::NewArrayBuffer(isolate_, alloc_size).ToHandle(&new_buffer));
   CHECK(!new_buffer.is_null());
   mem_start_ = reinterpret_cast<byte*>(new_buffer->backing_store());
   mem_size_ = size;
@@ -81,7 +78,7 @@ byte* TestingModuleBuilder::AddMemory(uint32_t size) {
   // Create the WasmMemoryObject.
   Handle<WasmMemoryObject> memory_object = WasmMemoryObject::New(
       isolate_, new_buffer,
-      (test_module_.maximum_pages != 0) ? test_module_.maximum_pages : -1);
+      (test_module_->maximum_pages != 0) ? test_module_->maximum_pages : -1);
   instance_object_->set_memory_object(*memory_object);
   WasmMemoryObject::AddInstance(isolate_, memory_object, instance_object_);
   // TODO(wasm): Delete the following two lines when test-run-wasm will use a
@@ -91,24 +88,32 @@ byte* TestingModuleBuilder::AddMemory(uint32_t size) {
   return mem_start_;
 }
 
-uint32_t TestingModuleBuilder::AddFunction(FunctionSig* sig, const char* name) {
-  if (test_module_.functions.size() == 0) {
+uint32_t TestingModuleBuilder::AddFunction(FunctionSig* sig, const char* name,
+                                           FunctionType type) {
+  if (test_module_->functions.size() == 0) {
     // TODO(titzer): Reserving space here to avoid the underlying WasmFunction
     // structs from moving.
-    test_module_.functions.reserve(kMaxFunctions);
+    test_module_->functions.reserve(kMaxFunctions);
   }
-  uint32_t index = static_cast<uint32_t>(test_module_.functions.size());
-  if (native_module_) {
-    native_module_->ResizeCodeTableForTesting(index + 1, kMaxFunctions);
+  uint32_t index = static_cast<uint32_t>(test_module_->functions.size());
+  test_module_->functions.push_back({sig, index, 0, {0, 0}, false, false});
+  if (type == kImport) {
+    DCHECK_EQ(0, test_module_->num_declared_functions);
+    ++test_module_->num_imported_functions;
+    test_module_->functions.back().imported = true;
+  } else {
+    ++test_module_->num_declared_functions;
   }
-  test_module_.functions.push_back({sig, index, 0, {0, 0}, false, false});
+  DCHECK_EQ(test_module_->functions.size(),
+            test_module_->num_imported_functions +
+                test_module_->num_declared_functions);
   if (name) {
     Vector<const byte> name_vec = Vector<const byte>::cast(CStrVector(name));
-    test_module_.AddNameForTesting(
+    test_module_->AddFunctionNameForTesting(
         index, {AddBytes(name_vec), static_cast<uint32_t>(name_vec.length())});
   }
   if (interpreter_) {
-    interpreter_->AddFunctionForTesting(&test_module_.functions.back());
+    interpreter_->AddFunctionForTesting(&test_module_->functions.back());
   }
   DCHECK_LT(index, kMaxFunctions);  // limited for testing.
   return index;
@@ -117,36 +122,33 @@ uint32_t TestingModuleBuilder::AddFunction(FunctionSig* sig, const char* name) {
 Handle<JSFunction> TestingModuleBuilder::WrapCode(uint32_t index) {
   // Wrap the code so it can be called as a JS function.
   Link();
-  wasm::WasmCode* code = native_module_->GetCode(index);
-
-  Handle<WasmCompiledModule> compiled_module(
-      instance_object()->compiled_module(), isolate_);
-  Handle<WeakCell> weak_instance(compiled_module->weak_owning_instance(),
-                                 isolate_);
-  Handle<Code> ret_code = compiler::CompileJSToWasmWrapper(
-      isolate_, &test_module_, weak_instance, code, index,
-      trap_handler::IsTrapHandlerEnabled());
+  FunctionSig* sig = test_module_->functions[index].sig;
+  MaybeHandle<Code> maybe_ret_code = compiler::CompileJSToWasmWrapper(
+      isolate_, native_module_, sig, false,
+      trap_handler::IsTrapHandlerEnabled() ? kUseTrapHandler : kNoTrapHandler);
+  Handle<Code> ret_code = maybe_ret_code.ToHandleChecked();
   Handle<JSFunction> ret = WasmExportedFunction::New(
       isolate_, instance_object(), MaybeHandle<String>(),
-      static_cast<int>(index),
-      static_cast<int>(test_module_.functions[index].sig->parameter_count()),
+      static_cast<int>(index), static_cast<int>(sig->parameter_count()),
       ret_code);
 
   // Add reference to the exported wrapper code.
-  Handle<FixedArray> old_arr(compiled_module->export_wrappers(), isolate_);
+  Handle<WasmModuleObject> module_object(instance_object()->module_object(),
+                                         isolate_);
+  Handle<FixedArray> old_arr(module_object->export_wrappers(), isolate_);
   Handle<FixedArray> new_arr =
       isolate_->factory()->NewFixedArray(old_arr->length() + 1);
   old_arr->CopyTo(0, *new_arr, 0, old_arr->length());
   new_arr->set(old_arr->length(), *ret_code);
-  compiled_module->set_export_wrappers(*new_arr);
+  module_object->set_export_wrappers(*new_arr);
 
   return ret;
 }
 
 void TestingModuleBuilder::AddIndirectFunctionTable(
     const uint16_t* function_indexes, uint32_t table_size) {
-  test_module_.function_tables.emplace_back();
-  WasmIndirectFunctionTable& table = test_module_.function_tables.back();
+  test_module_->tables.emplace_back();
+  WasmTable& table = test_module_->tables.back();
   table.initial_size = table_size;
   table.maximum_size = table_size;
   table.has_maximum_size = true;
@@ -162,79 +164,65 @@ void TestingModuleBuilder::PopulateIndirectFunctionTable() {
   auto instance = instance_object();
   uint32_t num_tables = 1;  // TODO(titzer): multiple tables.
   for (uint32_t i = 0; i < num_tables; i++) {
-    WasmIndirectFunctionTable& table = test_module_.function_tables[i];
+    WasmTable& table = test_module_->tables[i];
     int table_size = static_cast<int>(instance->indirect_function_table_size());
     for (int j = 0; j < table_size; j++) {
-      WasmFunction& function = test_module_.functions[table.values[j]];
-      int sig_id = test_module_.signature_map.Find(function.sig);
-      auto wasm_code = native_module_->GetCode(function.func_index);
-      IndirectFunctionTableEntry(*instance, j)
-          .set(sig_id, *instance, wasm_code);
+      WasmFunction& function = test_module_->functions[table.values[j]];
+      int sig_id = test_module_->signature_map.Find(function.sig);
+      auto target =
+          native_module_->GetCallTargetForFunction(function.func_index);
+      IndirectFunctionTableEntry(instance, j).set(sig_id, *instance, target);
     }
   }
 }
 
 uint32_t TestingModuleBuilder::AddBytes(Vector<const byte> bytes) {
-  Handle<WasmSharedModuleData> shared(
-      instance_object_->compiled_module()->shared(), isolate_);
-  Handle<SeqOneByteString> old_bytes(shared->module_bytes(), isolate_);
-  uint32_t old_size = static_cast<uint32_t>(old_bytes->length());
+  Vector<const uint8_t> old_bytes = native_module_->wire_bytes();
+  uint32_t old_size = static_cast<uint32_t>(old_bytes.size());
   // Avoid placing strings at offset 0, this might be interpreted as "not
   // set", e.g. for function names.
   uint32_t bytes_offset = old_size ? old_size : 1;
-  ScopedVector<byte> new_bytes(bytes_offset + bytes.length());
-  memcpy(new_bytes.start(), old_bytes->GetChars(), old_size);
+  size_t new_size = bytes_offset + bytes.size();
+  OwnedVector<uint8_t> new_bytes = OwnedVector<uint8_t>::New(new_size);
+  memcpy(new_bytes.start(), old_bytes.start(), old_size);
   memcpy(new_bytes.start() + bytes_offset, bytes.start(), bytes.length());
-  Handle<SeqOneByteString> new_bytes_str = Handle<SeqOneByteString>::cast(
-      isolate_->factory()->NewStringFromOneByte(new_bytes).ToHandleChecked());
-  shared->set_module_bytes(*new_bytes_str);
+  native_module_->set_wire_bytes(std::move(new_bytes));
   return bytes_offset;
 }
 
-compiler::ModuleEnv TestingModuleBuilder::CreateModuleEnv() {
-  return {&test_module_, trap_handler::IsTrapHandlerEnabled()};
+ModuleEnv TestingModuleBuilder::CreateModuleEnv() {
+  return {
+      test_module_ptr_,
+      trap_handler::IsTrapHandlerEnabled() ? kUseTrapHandler : kNoTrapHandler,
+      runtime_exception_support_};
 }
 
 const WasmGlobal* TestingModuleBuilder::AddGlobal(ValueType type) {
-  byte size = WasmOpcodes::MemSize(WasmOpcodes::MachineTypeFor(type));
+  byte size = ValueTypes::MemSize(ValueTypes::MachineTypeFor(type));
   global_offset = (global_offset + size - 1) & ~(size - 1);  // align
-  test_module_.globals.push_back(
-      {type, true, WasmInitExpr(), global_offset, false, false});
+  test_module_->globals.push_back(
+      {type, true, WasmInitExpr(), {global_offset}, false, false});
   global_offset += size;
   // limit number of globals.
   CHECK_LT(global_offset, kMaxGlobalsSize);
-  return &test_module_.globals.back();
+  return &test_module_->globals.back();
 }
 
 Handle<WasmInstanceObject> TestingModuleBuilder::InitInstanceObject() {
-  Handle<SeqOneByteString> empty_string = Handle<SeqOneByteString>::cast(
-      isolate_->factory()->NewStringFromOneByte({}).ToHandleChecked());
-  // The lifetime of the wasm module is tied to this object's, and we cannot
-  // rely on the mechanics of Managed<T>.
-  Handle<Foreign> module_wrapper = isolate_->factory()->NewForeign(
-      reinterpret_cast<Address>(&test_module_ptr_));
   Handle<Script> script =
       isolate_->factory()->NewScript(isolate_->factory()->empty_string());
   script->set_type(Script::TYPE_WASM);
-  Handle<WasmSharedModuleData> shared_module_data =
-      WasmSharedModuleData::New(isolate_, module_wrapper, empty_string, script,
-                                Handle<ByteArray>::null());
-  Handle<FixedArray> export_wrappers = isolate_->factory()->NewFixedArray(0);
-  Handle<WasmCompiledModule> compiled_module =
-      WasmCompiledModule::New(isolate_, test_module_ptr_, export_wrappers,
-                              trap_handler::IsTrapHandlerEnabled());
-  compiled_module->set_shared(*shared_module_data);
+  ModuleEnv env = CreateModuleEnv();
+  Handle<WasmModuleObject> module_object = WasmModuleObject::New(
+      isolate_, test_module_, env, {}, script, Handle<ByteArray>::null());
   // This method is called when we initialize TestEnvironment. We don't
   // have a memory yet, so we won't create it here. We'll update the
   // interpreter when we get a memory. We do have globals, though.
-  native_module_ = compiled_module->GetNativeModule();
+  native_module_ = module_object->native_module();
+  native_module_->ReserveCodeTableForTesting(kMaxFunctions);
 
-  DCHECK(compiled_module->IsWasmCompiledModule());
-  script->set_wasm_compiled_module(*compiled_module);
-  auto instance = WasmInstanceObject::New(isolate_, compiled_module);
+  auto instance = WasmInstanceObject::New(isolate_, module_object);
   instance->set_globals_start(globals_data_);
-  Handle<WeakCell> weak_instance = isolate()->factory()->NewWeakCell(instance);
-  compiled_module->set_weak_owning_instance(*weak_instance);
   return instance;
 }
 
@@ -262,24 +250,13 @@ void TestBuildingGraphWithBuilder(compiler::WasmGraphBuilder* builder,
   }
 }
 
-void TestBuildingGraph(
-    Zone* zone, compiler::JSGraph* jsgraph, compiler::ModuleEnv* module,
-    FunctionSig* sig, compiler::SourcePositionTable* source_position_table,
-    const byte* start, const byte* end,
-    compiler::RuntimeExceptionSupport runtime_exception_support) {
-  if (module) {
-    compiler::WasmGraphBuilder builder(
-        module, zone, jsgraph, CEntryStub(jsgraph->isolate(), 1).GetCode(),
-        jsgraph->isolate()->factory()->null_value(), sig, source_position_table,
-        runtime_exception_support);
-    TestBuildingGraphWithBuilder(&builder, zone, sig, start, end);
-  } else {
-    compiler::WasmGraphBuilder builder(
-        nullptr, zone, jsgraph, CEntryStub(jsgraph->isolate(), 1).GetCode(),
-        jsgraph->isolate()->factory()->null_value(), sig, source_position_table,
-        runtime_exception_support);
-    TestBuildingGraphWithBuilder(&builder, zone, sig, start, end);
-  }
+void TestBuildingGraph(Zone* zone, compiler::JSGraph* jsgraph,
+                       ModuleEnv* module, FunctionSig* sig,
+                       compiler::SourcePositionTable* source_position_table,
+                       const byte* start, const byte* end) {
+  compiler::WasmGraphBuilder builder(module, zone, jsgraph, sig,
+                                     source_position_table);
+  TestBuildingGraphWithBuilder(&builder, zone, sig, start, end);
 }
 
 WasmFunctionWrapper::WasmFunctionWrapper(Zone* zone, int num_params)
@@ -307,7 +284,10 @@ void WasmFunctionWrapper::Init(CallDescriptor* call_descriptor,
 
   // Function, context_address, effect, and control.
   Node** parameters = zone()->NewArray<Node*>(param_types.length() + 4);
-  graph()->SetStart(graph()->NewNode(common()->Start(7)));
+  int start_value_output_count =
+      static_cast<int>(signature_->parameter_count()) + 1;
+  graph()->SetStart(
+      graph()->NewNode(common()->Start(start_value_output_count)));
   Node* effect = graph()->start();
   int parameter_count = 0;
 
@@ -352,7 +332,8 @@ void WasmFunctionWrapper::Init(CallDescriptor* call_descriptor,
 }
 
 Handle<Code> WasmFunctionWrapper::GetWrapperCode() {
-  if (code_.is_null()) {
+  Handle<Code> code;
+  if (!code_.ToHandle(&code)) {
     Isolate* isolate = CcTest::InitIsolateOnce();
 
     auto call_descriptor =
@@ -376,19 +357,20 @@ Handle<Code> WasmFunctionWrapper::GetWrapperCode() {
     OptimizedCompilationInfo info(ArrayVector("testing"), graph()->zone(),
                                   Code::C_WASM_ENTRY);
     code_ = compiler::Pipeline::GenerateCodeForTesting(
-        &info, isolate, call_descriptor, graph(), nullptr);
-    CHECK(!code_.is_null());
+        &info, isolate, call_descriptor, graph(),
+        AssemblerOptions::Default(isolate), nullptr);
+    code = code_.ToHandleChecked();
 #ifdef ENABLE_DISASSEMBLER
     if (FLAG_print_opt_code) {
       CodeTracer::Scope tracing_scope(isolate->GetCodeTracer());
       OFStream os(tracing_scope.file());
 
-      code_->Disassemble("wasm wrapper", os);
+      code->Disassemble("wasm wrapper", os);
     }
 #endif
   }
 
-  return code_;
+  return code;
 }
 
 void WasmFunctionCompiler::Build(const byte* start, const byte* end) {
@@ -415,44 +397,39 @@ void WasmFunctionCompiler::Build(const byte* start, const byte* end) {
     interpreter_->SetFunctionCodeForTesting(function_, start, end);
   }
 
-  Handle<WasmCompiledModule> compiled_module(
-      builder_->instance_object()->compiled_module(), isolate());
-  NativeModule* native_module = compiled_module->GetNativeModule();
-  Handle<SeqOneByteString> wire_bytes(compiled_module->shared()->module_bytes(),
-                                      isolate());
+  Vector<const uint8_t> wire_bytes = builder_->instance_object()
+                                         ->module_object()
+                                         ->native_module()
+                                         ->wire_bytes();
 
-  compiler::ModuleEnv module_env = builder_->CreateModuleEnv();
+  ModuleEnv module_env = builder_->CreateModuleEnv();
   ErrorThrower thrower(isolate(), "WasmFunctionCompiler::Build");
   ScopedVector<uint8_t> func_wire_bytes(function_->code.length());
-  memcpy(func_wire_bytes.start(),
-         wire_bytes->GetChars() + function_->code.offset(),
+  memcpy(func_wire_bytes.start(), wire_bytes.start() + function_->code.offset(),
          func_wire_bytes.length());
   WireBytesRef func_name_ref =
-      module_env.module->LookupName(*wire_bytes, function_->func_index);
+      module_env.module->LookupFunctionName(wire_bytes, function_->func_index);
   ScopedVector<char> func_name(func_name_ref.length());
-  memcpy(func_name.start(), wire_bytes->GetChars() + func_name_ref.offset(),
+  memcpy(func_name.start(), wire_bytes.start() + func_name_ref.offset(),
          func_name_ref.length());
 
   FunctionBody func_body{function_->sig, function_->code.offset(),
                          func_wire_bytes.start(), func_wire_bytes.end()};
-  compiler::WasmCompilationUnit::CompilationMode comp_mode =
+  WasmCompilationUnit::CompilationMode comp_mode =
       builder_->execution_mode() == WasmExecutionMode::kExecuteLiftoff
-          ? compiler::WasmCompilationUnit::CompilationMode::kLiftoff
-          : compiler::WasmCompilationUnit::CompilationMode::kTurbofan;
-  compiler::WasmCompilationUnit unit(
-      isolate(), &module_env, native_module, func_body, func_name,
-      function_->func_index, CEntryStub(isolate(), 1).GetCode(), comp_mode,
-      isolate()->counters(), builder_->runtime_exception_support(),
-      builder_->lower_simd());
+          ? WasmCompilationUnit::CompilationMode::kLiftoff
+          : WasmCompilationUnit::CompilationMode::kTurbofan;
+  NativeModule* native_module =
+      builder_->instance_object()->module_object()->native_module();
+  WasmCompilationUnit unit(isolate(), &module_env, native_module, func_body,
+                           func_name, function_->func_index, comp_mode,
+                           isolate()->counters(), builder_->lower_simd());
   unit.ExecuteCompilation();
   wasm::WasmCode* wasm_code = unit.FinishCompilation(&thrower);
   if (wasm::WasmCode::ShouldBeLogged(isolate())) {
     wasm_code->LogCode(isolate());
   }
   CHECK(!thrower.error());
-  if (trap_handler::IsTrapHandlerEnabled()) {
-    native_module->UnpackAndRegisterProtectedInstructions();
-  }
 }
 
 WasmFunctionCompiler::WasmFunctionCompiler(Zone* zone, FunctionSig* sig,
@@ -468,7 +445,7 @@ WasmFunctionCompiler::WasmFunctionCompiler(Zone* zone, FunctionSig* sig,
       source_position_table_(this->graph()),
       interpreter_(builder->interpreter()) {
   // Get a new function from the testing module.
-  int index = builder->AddFunction(sig, name);
+  int index = builder->AddFunction(sig, name, TestingModuleBuilder::kWasm);
   function_ = builder_->GetFunctionAt(index);
 }
 
@@ -485,10 +462,10 @@ FunctionSig* WasmRunnerBase::CreateSig(MachineType return_type,
   // Convert machine types to local types, and check that there are no
   // MachineType::None()'s in the parameters.
   int idx = 0;
-  if (return_count) sig_types[idx++] = WasmOpcodes::ValueTypeFor(return_type);
+  if (return_count) sig_types[idx++] = ValueTypes::ValueTypeFor(return_type);
   for (MachineType param : param_types) {
     CHECK_NE(MachineType::None(), param);
-    sig_types[idx++] = WasmOpcodes::ValueTypeFor(param);
+    sig_types[idx++] = ValueTypes::ValueTypeFor(param);
   }
   return new (&zone_) FunctionSig(return_count, param_count, sig_types);
 }
diff --git a/deps/v8/test/cctest/wasm/wasm-run-utils.h b/deps/v8/test/cctest/wasm/wasm-run-utils.h
index 2e91d155fdd588..c09659733fae2b 100644
--- a/deps/v8/test/cctest/wasm/wasm-run-utils.h
+++ b/deps/v8/test/cctest/wasm/wasm-run-utils.h
@@ -26,7 +26,6 @@
 #include "src/wasm/function-body-decoder.h"
 #include "src/wasm/local-decl-encoder.h"
 #include "src/wasm/wasm-code-manager.h"
-#include "src/wasm/wasm-code-specialization.h"
 #include "src/wasm/wasm-external-refs.h"
 #include "src/wasm/wasm-interpreter.h"
 #include "src/wasm/wasm-js.h"
@@ -87,18 +86,18 @@ struct ManuallyImportedJSFunction {
 
 // A  Wasm module builder. Globals are pre-set, however, memory and code may be
 // progressively added by a test. In turn, we piecemeal update the runtime
-// objects, i.e. {WasmInstanceObject}, {WasmCompiledModule} and, if necessary,
+// objects, i.e. {WasmInstanceObject}, {WasmModuleObject} and, if necessary,
 // the interpreter.
 class TestingModuleBuilder {
  public:
   TestingModuleBuilder(Zone*, ManuallyImportedJSFunction*, WasmExecutionMode,
-                       compiler::RuntimeExceptionSupport, LowerSimd);
+                       RuntimeExceptionSupport, LowerSimd);
 
-  void ChangeOriginToAsmjs() { test_module_.set_origin(kAsmJsOrigin); }
+  void ChangeOriginToAsmjs() { test_module_->origin = kAsmJsOrigin; }
 
   byte* AddMemory(uint32_t size);
 
-  size_t CodeTableLength() const { return native_module_->FunctionCount(); }
+  size_t CodeTableLength() const { return native_module_->num_functions(); }
 
   template <typename T>
   T* AddMemoryElems(uint32_t count) {
@@ -108,18 +107,18 @@ class TestingModuleBuilder {
 
   template <typename T>
   T* AddGlobal(
-      ValueType type = WasmOpcodes::ValueTypeFor(MachineTypeForC<T>())) {
+      ValueType type = ValueTypes::ValueTypeFor(MachineTypeForC<T>())) {
     const WasmGlobal* global = AddGlobal(type);
     return reinterpret_cast<T*>(globals_data_ + global->offset);
   }
 
   byte AddSignature(FunctionSig* sig) {
-    DCHECK_EQ(test_module_.signatures.size(),
-              test_module_.signature_ids.size());
-    test_module_.signatures.push_back(sig);
-    auto canonical_sig_num = test_module_.signature_map.FindOrInsert(sig);
-    test_module_.signature_ids.push_back(canonical_sig_num);
-    size_t size = test_module_.signatures.size();
+    DCHECK_EQ(test_module_->signatures.size(),
+              test_module_->signature_ids.size());
+    test_module_->signatures.push_back(sig);
+    auto canonical_sig_num = test_module_->signature_map.FindOrInsert(sig);
+    test_module_->signature_ids.push_back(canonical_sig_num);
+    size_t size = test_module_->signatures.size();
     CHECK_GT(127, size);
     return static_cast<byte>(size - 1);
   }
@@ -149,12 +148,12 @@ class TestingModuleBuilder {
 
   template <typename T>
   void WriteMemory(T* p, T val) {
-    WriteLittleEndianValue<T>(p, val);
+    WriteLittleEndianValue<T>(reinterpret_cast<Address>(p), val);
   }
 
   template <typename T>
   T ReadMemory(T* p) {
-    return ReadLittleEndianValue<T>(p);
+    return ReadLittleEndianValue<T>(reinterpret_cast<Address>(p));
   }
 
   // Zero-initialize the memory.
@@ -173,15 +172,16 @@ class TestingModuleBuilder {
   }
 
   void SetMaxMemPages(uint32_t maximum_pages) {
-    test_module_.maximum_pages = maximum_pages;
+    test_module_->maximum_pages = maximum_pages;
     if (instance_object()->has_memory_object()) {
       instance_object()->memory_object()->set_maximum_pages(maximum_pages);
     }
   }
 
-  void SetHasSharedMemory() { test_module_.has_shared_memory = true; }
+  void SetHasSharedMemory() { test_module_->has_shared_memory = true; }
 
-  uint32_t AddFunction(FunctionSig* sig, const char* name);
+  enum FunctionType { kImport, kWasm };
+  uint32_t AddFunction(FunctionSig* sig, const char* name, FunctionType type);
 
   Handle<JSFunction> WrapCode(uint32_t index);
 
@@ -193,38 +193,38 @@ class TestingModuleBuilder {
   uint32_t AddBytes(Vector<const byte> bytes);
 
   WasmFunction* GetFunctionAt(int index) {
-    return &test_module_.functions[index];
+    return &test_module_->functions[index];
   }
 
-  WasmInterpreter* interpreter() { return interpreter_; }
-  bool interpret() { return interpreter_ != nullptr; }
-  LowerSimd lower_simd() { return lower_simd_; }
-  Isolate* isolate() { return isolate_; }
-  Handle<WasmInstanceObject> instance_object() { return instance_object_; }
-  wasm::WasmCode* GetFunctionCode(uint32_t index) {
-    return native_module_->GetCode(index);
+  WasmInterpreter* interpreter() const { return interpreter_; }
+  bool interpret() const { return interpreter_ != nullptr; }
+  LowerSimd lower_simd() const { return lower_simd_; }
+  Isolate* isolate() const { return isolate_; }
+  Handle<WasmInstanceObject> instance_object() const {
+    return instance_object_;
+  }
+  wasm::WasmCode* GetFunctionCode(uint32_t index) const {
+    return native_module_->code(index);
+  }
+  Address globals_start() const {
+    return reinterpret_cast<Address>(globals_data_);
   }
-  Address globals_start() { return reinterpret_cast<Address>(globals_data_); }
   void Link() {
-    if (!linked_) {
-      CodeSpecialization code_specialization;
-      code_specialization.RelocateDirectCalls(native_module_);
-      code_specialization.ApplyToWholeModule(native_module_);
-      linked_ = true;
-      native_module_->SetExecutable(true);
-    }
+    if (linked_) return;
+    linked_ = true;
+    native_module_->SetExecutable(true);
   }
 
-  compiler::ModuleEnv CreateModuleEnv();
+  ModuleEnv CreateModuleEnv();
 
   WasmExecutionMode execution_mode() const { return execution_mode_; }
 
-  compiler::RuntimeExceptionSupport runtime_exception_support() const {
+  RuntimeExceptionSupport runtime_exception_support() const {
     return runtime_exception_support_;
   }
 
  private:
-  WasmModule test_module_;
+  std::shared_ptr<WasmModule> test_module_;
   WasmModule* test_module_ptr_;
   Isolate* isolate_;
   uint32_t global_offset = 0;
@@ -236,7 +236,7 @@ class TestingModuleBuilder {
   Handle<WasmInstanceObject> instance_object_;
   NativeModule* native_module_ = nullptr;
   bool linked_ = false;
-  compiler::RuntimeExceptionSupport runtime_exception_support_;
+  RuntimeExceptionSupport runtime_exception_support_;
   LowerSimd lower_simd_;
 
   const WasmGlobal* AddGlobal(ValueType type);
@@ -244,11 +244,10 @@ class TestingModuleBuilder {
   Handle<WasmInstanceObject> InitInstanceObject();
 };
 
-void TestBuildingGraph(
-    Zone* zone, compiler::JSGraph* jsgraph, compiler::ModuleEnv* module,
-    FunctionSig* sig, compiler::SourcePositionTable* source_position_table,
-    const byte* start, const byte* end,
-    compiler::RuntimeExceptionSupport runtime_exception_support);
+void TestBuildingGraph(Zone* zone, compiler::JSGraph* jsgraph,
+                       ModuleEnv* module, FunctionSig* sig,
+                       compiler::SourcePositionTable* source_position_table,
+                       const byte* start, const byte* end);
 
 class WasmFunctionWrapper : private compiler::GraphAndBuilders {
  public:
@@ -267,13 +266,14 @@ class WasmFunctionWrapper : private compiler::GraphAndBuilders {
   }
 
   void SetInnerCode(wasm::WasmCode* code) {
-    intptr_t address = reinterpret_cast<intptr_t>(code->instructions().start());
+    intptr_t address = static_cast<intptr_t>(code->instruction_start());
     compiler::NodeProperties::ChangeOp(
         inner_code_node_,
         kPointerSize == 8
-            ? common()->RelocatableInt64Constant(address, RelocInfo::WASM_CALL)
+            ? common()->RelocatableInt64Constant(address,
+                                                 RelocInfo::JS_TO_WASM_CALL)
             : common()->RelocatableInt32Constant(static_cast<int>(address),
-                                                 RelocInfo::WASM_CALL));
+                                                 RelocInfo::JS_TO_WASM_CALL));
   }
 
   const compiler::Operator* IntPtrConstant(intptr_t value) {
@@ -294,7 +294,7 @@ class WasmFunctionWrapper : private compiler::GraphAndBuilders {
  private:
   Node* inner_code_node_;
   Node* context_address_;
-  Handle<Code> code_;
+  MaybeHandle<Code> code_;
   Signature<MachineType>* signature_;
 };
 
@@ -348,7 +348,7 @@ class WasmRunnerBase : public HandleAndZoneScope {
  public:
   WasmRunnerBase(ManuallyImportedJSFunction* maybe_import,
                  WasmExecutionMode execution_mode, int num_params,
-                 compiler::RuntimeExceptionSupport runtime_exception_support,
+                 RuntimeExceptionSupport runtime_exception_support,
                  LowerSimd lower_simd)
       : zone_(&allocator_, ZONE_NAME),
         builder_(&zone_, maybe_import, execution_mode,
@@ -431,8 +431,8 @@ class WasmRunner : public WasmRunnerBase {
   WasmRunner(WasmExecutionMode execution_mode,
              ManuallyImportedJSFunction* maybe_import = nullptr,
              const char* main_fn_name = "main",
-             compiler::RuntimeExceptionSupport runtime_exception_support =
-                 compiler::kNoRuntimeExceptionSupport,
+             RuntimeExceptionSupport runtime_exception_support =
+                 kNoRuntimeExceptionSupport,
              LowerSimd lower_simd = kNoLowerSimd)
       : WasmRunnerBase(maybe_import, execution_mode, sizeof...(ParamTypes),
                        runtime_exception_support, lower_simd) {
@@ -443,8 +443,8 @@ class WasmRunner : public WasmRunnerBase {
   }
 
   WasmRunner(WasmExecutionMode execution_mode, LowerSimd lower_simd)
-      : WasmRunner(execution_mode, nullptr, "main",
-                   compiler::kNoRuntimeExceptionSupport, lower_simd) {}
+      : WasmRunner(execution_mode, nullptr, "main", kNoRuntimeExceptionSupport,
+                   lower_simd) {}
 
   ReturnType Call(ParamTypes... p) {
     DCHECK(compiled_);
diff --git a/deps/v8/test/common/wasm/wasm-macro-gen.h b/deps/v8/test/common/wasm/wasm-macro-gen.h
index 7c8418fb159e0f..a42c96dd24b2fc 100644
--- a/deps/v8/test/common/wasm/wasm-macro-gen.h
+++ b/deps/v8/test/common/wasm/wasm-macro-gen.h
@@ -75,9 +75,9 @@
 #define WASM_BLOCK_F(...) kExprBlock, kLocalF32, __VA_ARGS__, kExprEnd
 #define WASM_BLOCK_D(...) kExprBlock, kLocalF64, __VA_ARGS__, kExprEnd
 
-#define WASM_BLOCK_T(t, ...)                                       \
-  kExprBlock, static_cast<byte>(WasmOpcodes::ValueTypeCodeFor(t)), \
-      __VA_ARGS__, kExprEnd
+#define WASM_BLOCK_T(t, ...)                                                   \
+  kExprBlock, static_cast<byte>(ValueTypes::ValueTypeCodeFor(t)), __VA_ARGS__, \
+      kExprEnd
 
 #define WASM_BLOCK_X(index, ...)                                  \
   kExprBlock, static_cast<byte>(index), __VA_ARGS__, kExprEnd
@@ -90,17 +90,17 @@
 #define WASM_LOOP_F(...) kExprLoop, kLocalF32, __VA_ARGS__, kExprEnd
 #define WASM_LOOP_D(...) kExprLoop, kLocalF64, __VA_ARGS__, kExprEnd
 
-#define WASM_LOOP_T(t, ...)                                       \
-  kExprLoop, static_cast<byte>(WasmOpcodes::ValueTypeCodeFor(t)), \
-      __VA_ARGS__, kExprEnd
+#define WASM_LOOP_T(t, ...)                                                   \
+  kExprLoop, static_cast<byte>(ValueTypes::ValueTypeCodeFor(t)), __VA_ARGS__, \
+      kExprEnd
 
 #define WASM_LOOP_X(index, ...)                                   \
   kExprLoop, static_cast<byte>(index), __VA_ARGS__, kExprEnd
 
 #define WASM_IF(cond, ...) cond, kExprIf, kLocalVoid, __VA_ARGS__, kExprEnd
 
-#define WASM_IF_T(t, cond, ...)                                       \
-  cond, kExprIf, static_cast<byte>(WasmOpcodes::ValueTypeCodeFor(t)), \
+#define WASM_IF_T(t, cond, ...)                                      \
+  cond, kExprIf, static_cast<byte>(ValueTypes::ValueTypeCodeFor(t)), \
       __VA_ARGS__, kExprEnd
 
 #define WASM_IF_X(index, cond, ...)                                   \
@@ -118,8 +118,8 @@
 #define WASM_IF_ELSE_D(cond, tstmt, fstmt) \
   cond, kExprIf, kLocalF64, tstmt, kExprElse, fstmt, kExprEnd
 
-#define WASM_IF_ELSE_T(t, cond, tstmt, fstmt)                                \
-  cond, kExprIf, static_cast<byte>(WasmOpcodes::ValueTypeCodeFor(t)), tstmt, \
+#define WASM_IF_ELSE_T(t, cond, tstmt, fstmt)                               \
+  cond, kExprIf, static_cast<byte>(ValueTypes::ValueTypeCodeFor(t)), tstmt, \
       kExprElse, fstmt, kExprEnd
 
 #define WASM_IF_ELSE_X(index, cond, tstmt, fstmt)                            \
diff --git a/deps/v8/test/common/wasm/wasm-module-runner.cc b/deps/v8/test/common/wasm/wasm-module-runner.cc
index 02630ebfafe3aa..d091aa5cd28b0a 100644
--- a/deps/v8/test/common/wasm/wasm-module-runner.cc
+++ b/deps/v8/test/common/wasm/wasm-module-runner.cc
@@ -37,7 +37,7 @@ MaybeHandle<WasmInstanceObject> CompileAndInstantiateForTesting(
       isolate, thrower, module.ToHandleChecked(), {}, {});
 }
 
-std::unique_ptr<WasmModule> DecodeWasmModuleForTesting(
+std::shared_ptr<WasmModule> DecodeWasmModuleForTesting(
     Isolate* isolate, ErrorThrower* thrower, const byte* module_start,
     const byte* module_end, ModuleOrigin origin, bool verify_functions) {
   // Decode the module, but don't verify function bodies, since we'll
@@ -74,16 +74,16 @@ bool InterpretWasmModuleForTesting(Isolate* isolate,
   // Fill the parameters up with default values.
   for (size_t i = argc; i < param_count; ++i) {
     switch (signature->GetParam(i)) {
-      case MachineRepresentation::kWord32:
+      case kWasmI32:
         arguments[i] = WasmValue(int32_t{0});
         break;
-      case MachineRepresentation::kWord64:
+      case kWasmI64:
         arguments[i] = WasmValue(int64_t{0});
         break;
-      case MachineRepresentation::kFloat32:
+      case kWasmF32:
         arguments[i] = WasmValue(0.0f);
         break;
-      case MachineRepresentation::kFloat64:
+      case kWasmF64:
         arguments[i] = WasmValue(0.0);
         break;
       default:
@@ -201,7 +201,7 @@ MaybeHandle<WasmExportedFunction> GetExportedFunction(
   Handle<JSObject> exports_object;
   Handle<Name> exports = isolate->factory()->InternalizeUtf8String("exports");
   exports_object = Handle<JSObject>::cast(
-      JSObject::GetProperty(instance, exports).ToHandleChecked());
+      JSObject::GetProperty(isolate, instance, exports).ToHandleChecked());
 
   Handle<Name> main_name = isolate->factory()->NewStringFromAsciiChecked(name);
   PropertyDescriptor desc;
diff --git a/deps/v8/test/common/wasm/wasm-module-runner.h b/deps/v8/test/common/wasm/wasm-module-runner.h
index 7b1c8bb5c03f2f..7aa40bc6f13908 100644
--- a/deps/v8/test/common/wasm/wasm-module-runner.h
+++ b/deps/v8/test/common/wasm/wasm-module-runner.h
@@ -19,11 +19,14 @@ namespace internal {
 template <typename T>
 class Handle;
 
+template <typename T>
+class MaybeHandle;
+
 namespace wasm {
 namespace testing {
 
 // Decodes the given encoded module.
-std::unique_ptr<WasmModule> DecodeWasmModuleForTesting(
+std::shared_ptr<WasmModule> DecodeWasmModuleForTesting(
     Isolate* isolate, ErrorThrower* thrower, const byte* module_start,
     const byte* module_end, ModuleOrigin origin, bool verify_functions = false);
 
diff --git a/deps/v8/test/debugger/debug/debug-break-native.js b/deps/v8/test/debugger/debug/debug-break-native.js
index 10ed405670ffe1..68f9c9d57ab264 100644
--- a/deps/v8/test/debugger/debug/debug-break-native.js
+++ b/deps/v8/test/debugger/debug/debug-break-native.js
@@ -26,7 +26,6 @@ function f(x) {
 }                                  // break
 
 Debug.setBreakPoint(f, 0, 0);      // break
-Debug.scripts();                   // break
 
 new Error("123").stack;            // break
 Math.sin(0);                       // break
diff --git a/deps/v8/test/debugger/debug/debug-break-return.js b/deps/v8/test/debugger/debug/debug-break-return.js
new file mode 100644
index 00000000000000..478162a1b60d7b
--- /dev/null
+++ b/deps/v8/test/debugger/debug/debug-break-return.js
@@ -0,0 +1,40 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+Debug = debug.Debug
+
+function foo(){}
+
+let breakpoint_count = 0;
+let last_source_line = 0;
+let last_source_column = 0;
+function listener(event, exec_state, event_data, data) {
+  if (event == Debug.DebugEvent.Break) {
+    ++breakpoint_count;
+    last_source_line = exec_state.frame(0).sourceLine();
+    last_source_column = exec_state.frame(0).sourceColumn();
+  }
+};
+
+Debug.setListener(listener);
+
+// Run without breakpoints.
+foo();
+assertEquals(breakpoint_count, 0);
+
+// Run with breakpoint.
+const breakpoint = Debug.setBreakPoint(foo, 0);
+foo();
+assertEquals(breakpoint_count, 1);
+assertEquals(last_source_line, 7);
+assertEquals(last_source_column, 15);
+foo();
+assertEquals(breakpoint_count, 2);
+assertEquals(last_source_line, 7);
+assertEquals(last_source_column, 15);
+
+// Run without breakpoints
+Debug.clearBreakPoint(breakpoint);
+foo();
+assertEquals(breakpoint_count, 2);
diff --git a/deps/v8/test/debugger/debug/debug-live-edit-recursion.js b/deps/v8/test/debugger/debug/debug-live-edit-recursion.js
new file mode 100644
index 00000000000000..6328a9b6def5d5
--- /dev/null
+++ b/deps/v8/test/debugger/debug/debug-live-edit-recursion.js
@@ -0,0 +1,40 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+Debug = debug.Debug;
+
+function test(i) {
+  if (i == 3) {
+    return (function* gen() { yield test(i - 1); })().next().value;
+  } else if (i > 1) {
+    return test(i - 1);
+  } else {
+    debugger;
+    return 5;
+  }
+}
+
+let patch = null, exception = null;
+
+Debug.setListener(listener);
+patch = ['return 5', 'return 3'];
+assertEquals(3, test(2)); // no running generator
+patch = ['return 3', 'return -1'];
+assertEquals(3, test(3)); // there is running generator
+assertEquals(exception,
+    'LiveEdit failed: BLOCKED_BY_FUNCTION_BELOW_NON_DROPPABLE_FRAME');
+Debug.setListener(null);
+
+function listener(event) {
+  if (event != Debug.DebugEvent.Break || !patch) return;
+  try {
+    %LiveEditPatchScript(test,
+        Debug.scriptSource(test).replace(patch[0], patch[1]));
+  } catch (e) {
+    exception = e;
+  }
+  patch = null;
+}
diff --git a/deps/v8/test/debugger/debug/debug-liveedit-1.js b/deps/v8/test/debugger/debug/debug-liveedit-1.js
index 950a2faea68898..a3fe1bf910ffc2 100644
--- a/deps/v8/test/debugger/debug/debug-liveedit-1.js
+++ b/deps/v8/test/debugger/debug/debug-liveedit-1.js
@@ -25,6 +25,7 @@
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
+// Flags: --allow-natives-syntax
 
 Debug = debug.Debug
 
@@ -34,13 +35,11 @@ eval("var something1 = 25; "
 
 assertEquals("Cat", ChooseAnimal());
 
-var script = Debug.findScript(ChooseAnimal);
-
 var orig_animal = "Cat";
-var patch_pos = script.source.indexOf(orig_animal);
 var new_animal_patch = "Cap' + 'y' + 'bara";
+var new_source =
+    Debug.scriptSource(ChooseAnimal).replace(orig_animal, new_animal_patch);
 
-var change_log = new Array();
-Debug.LiveEdit.TestApi.ApplySingleChunkPatch(script, patch_pos, orig_animal.length, new_animal_patch, change_log);
+%LiveEditPatchScript(ChooseAnimal, new_source);
 
 assertEquals("Capybara", ChooseAnimal());
diff --git a/deps/v8/test/debugger/debug/debug-liveedit-2.js b/deps/v8/test/debugger/debug/debug-liveedit-2.js
index 408ee5a08bf571..f52ec268ecb292 100644
--- a/deps/v8/test/debugger/debug/debug-liveedit-2.js
+++ b/deps/v8/test/debugger/debug/debug-liveedit-2.js
@@ -25,8 +25,7 @@
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
-// Flags: --noalways-opt
-
+// Flags: --noalways-opt --allow-natives-syntax
 
 Debug = debug.Debug
 
@@ -43,19 +42,12 @@ var old_closure = ChooseAnimal(19);
 
 assertEquals("Cat", old_closure());
 
-var script = Debug.findScript(ChooseAnimal);
-
-var orig_animal = "'Cat'";
-var patch_pos = script.source.indexOf(orig_animal);
-var new_animal_patch = "'Capybara' + p";
-
 // We patch innermost function "Chooser".
 // However, this does not actually patch existing "Chooser" instances,
 // because old value of parameter "p" was not saved.
 // Instead it patches ChooseAnimal.
-var change_log = new Array();
-Debug.LiveEdit.TestApi.ApplySingleChunkPatch(script, patch_pos, orig_animal.length, new_animal_patch, change_log);
-print("Change log: " + JSON.stringify(change_log) + "\n");
+%LiveEditPatchScript(
+    ChooseAnimal, Debug.scriptSource(ChooseAnimal).replace("'Cat'", "'Capybara' + p"));
 
 var new_closure = ChooseAnimal(19);
 // New instance of closure is patched.
diff --git a/deps/v8/test/debugger/debug/debug-liveedit-3.js b/deps/v8/test/debugger/debug/debug-liveedit-3.js
index c075453ff142e7..790137d4e73c1d 100644
--- a/deps/v8/test/debugger/debug/debug-liveedit-3.js
+++ b/deps/v8/test/debugger/debug/debug-liveedit-3.js
@@ -30,6 +30,7 @@
 // hasen't been changed. However actually function became one level more nested
 // and must be recompiled because it uses variable from outer scope.
 
+// Flags: --allow-natives-syntax
 
 Debug = debug.Debug
 
@@ -49,15 +50,11 @@ eval(
 var z6 = Factory(6);
 assertEquals(8, z6());
 
-var script = Debug.findScript(Factory);
+var new_source = Debug.scriptSource(Factory).replace(
+    function_z_text,
+    'function Intermediate() {\nreturn (\n' + function_z_text + ')\n;\n}\n');
 
-var new_source = script.source.replace(function_z_text, "function Intermediate() {\nreturn (\n" + function_z_text + ")\n;\n}\n");
-print("new source: " + new_source);
-
-var change_log = new Array();
-var result = Debug.LiveEdit.SetScriptSource(script, new_source, false, change_log);
-print("Result: " + JSON.stringify(result) + "\n");
-print("Change log: " + JSON.stringify(change_log) + "\n");
+%LiveEditPatchScript(Factory, new_source);
 
 assertEquals(8, z6());
 
diff --git a/deps/v8/test/debugger/debug/debug-liveedit-4.js b/deps/v8/test/debugger/debug/debug-liveedit-4.js
index 0b94ece542001c..eef7f20207a521 100644
--- a/deps/v8/test/debugger/debug/debug-liveedit-4.js
+++ b/deps/v8/test/debugger/debug/debug-liveedit-4.js
@@ -31,6 +31,7 @@
 // hasen't been changed. However actually function became one level more nested
 // and must be recompiled because it uses variable from outer scope.
 
+// Flags: --allow-natives-syntax
 
 Debug = debug.Debug
 
@@ -53,14 +54,10 @@ var res = TestFunction();
 print(res);
 assertEquals('a,c', res);
 
-var script = Debug.findScript(TestFunction);
-var new_source = script.source.replace("2013", "b");
+var new_source = Debug.scriptSource(TestFunction).replace('2013', 'b');
 print("new source: " + new_source);
-var change_log = new Array();
-var result = Debug.LiveEdit.SetScriptSource(script, new_source, false, change_log);
 
-print("Result: " + JSON.stringify(result) + "\n");
-print("Change log: " + JSON.stringify(change_log) + "\n");
+%LiveEditPatchScript(TestFunction, new_source);
 
 var res = TestFunction();
 print(res);
diff --git a/deps/v8/test/debugger/debug/debug-liveedit-check-stack.js b/deps/v8/test/debugger/debug/debug-liveedit-check-stack.js
index e016a5391c3f69..e2e9c6412d1f82 100644
--- a/deps/v8/test/debugger/debug/debug-liveedit-check-stack.js
+++ b/deps/v8/test/debugger/debug/debug-liveedit-check-stack.js
@@ -25,6 +25,7 @@
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
+// Flags: --allow-natives-syntax
 
 Debug = debug.Debug
 
@@ -33,35 +34,26 @@ unique_id = 1;
 function TestBase(name) {
   print("TestBase constructor: " + name);
 
-  this.ChooseAnimal = eval(
-      "/* " + unique_id + "*/\n" +
-      "(function ChooseAnimal(callback) {\n " +
-      "  callback();\n" +
-      "  return 'Cat';\n" +
-      "})\n"
-  );
+  const original_source = '/* ' + unique_id + '*/\n' +
+      '(function ChooseAnimal(callback) {\n ' +
+      '  callback();\n' +
+      '  return \'Cat\';\n' +
+      '})\n';
+  const updated_source = original_source.replace('\'Cat\'', '\'Capybara\'');
+
+  this.ChooseAnimal = eval(original_source);
   // Prevents eval script caching.
   unique_id++;
 
-  var script = Debug.findScript(this.ChooseAnimal);
-
-  var orig_animal = "'Cat'";
-  var patch_pos = script.source.indexOf(orig_animal);
-  var new_animal_patch = "'Capybara'";
+  const func = this.ChooseAnimal;
 
   var got_exception = false;
   var successfully_changed = false;
 
   // Should be called from Debug context.
-  this.ScriptChanger = function() {
+  this.ScriptChanger = () => {
     assertEquals(false, successfully_changed, "applying patch second time");
-    // Runs in debugger context.
-    var change_log = new Array();
-    try {
-      Debug.LiveEdit.TestApi.ApplySingleChunkPatch(script, patch_pos, orig_animal.length, new_animal_patch, change_log);
-    } finally {
-      print("Change log: " + JSON.stringify(change_log) + "\n");
-    }
+    %LiveEditPatchScript(func, updated_source);
     successfully_changed = true;
   };
 }
@@ -74,7 +66,7 @@ function WrapInCatcher(f, holder) {
     try {
       f();
     } catch (e) {
-      if (e instanceof Debug.LiveEdit.Failure) {
+      if (e.startsWith('LiveEdit failed')) {
         holder[0] = e;
       } else {
         throw e;
diff --git a/deps/v8/test/debugger/debug/debug-liveedit-compile-error.js b/deps/v8/test/debugger/debug/debug-liveedit-compile-error.js
index 24068eb1b36cb8..33953a341e3790 100644
--- a/deps/v8/test/debugger/debug/debug-liveedit-compile-error.js
+++ b/deps/v8/test/debugger/debug/debug-liveedit-compile-error.js
@@ -25,6 +25,7 @@
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
+// Flags: --allow-natives-syntax
 
 Debug = debug.Debug
 
@@ -34,23 +35,16 @@ eval("var something1 = 25; \n"
 
 assertEquals("Cat", ChooseAnimal());
 
-var script = Debug.findScript(ChooseAnimal);
+var new_source =
+    Debug.scriptSource(ChooseAnimal).replace('Cat', 'Cap\' + ) + \'bara');
+print('new source: ' + new_source);
 
-var orig_animal = "Cat";
-var patch_pos = script.source.indexOf(orig_animal);
-var new_animal_patch = "Cap' + ) + 'bara";
-
-var change_log = new Array();
 var caught_exception = null;
 try {
-  Debug.LiveEdit.TestApi.ApplySingleChunkPatch(script, patch_pos,
-      orig_animal.length, new_animal_patch, change_log);
+  %LiveEditPatchScript(ChooseAnimal, new_source);
 } catch (e) {
   caught_exception = e;
 }
 
 assertNotNull(caught_exception);
-assertEquals("Unexpected token )",
-    caught_exception.details.syntaxErrorMessage);
-
-assertEquals(2, caught_exception.details.position.start.line);
+assertEquals('LiveEdit failed: COMPILE_ERROR', caught_exception);
diff --git a/deps/v8/test/debugger/debug/debug-liveedit-diff.js b/deps/v8/test/debugger/debug/debug-liveedit-diff.js
deleted file mode 100644
index d049cb022d84f6..00000000000000
--- a/deps/v8/test/debugger/debug/debug-liveedit-diff.js
+++ /dev/null
@@ -1,110 +0,0 @@
-// Copyright 2010 the V8 project authors. All rights reserved.
-// Redistribution and use in source and binary forms, with or without
-// modification, are permitted provided that the following conditions are
-// met:
-//
-//     * Redistributions of source code must retain the above copyright
-//       notice, this list of conditions and the following disclaimer.
-//     * Redistributions in binary form must reproduce the above
-//       copyright notice, this list of conditions and the following
-//       disclaimer in the documentation and/or other materials provided
-//       with the distribution.
-//     * Neither the name of Google Inc. nor the names of its
-//       contributors may be used to endorse or promote products derived
-//       from this software without specific prior written permission.
-//
-// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
-// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
-// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
-// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
-// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
-// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
-// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-
-
-Debug = debug.Debug
-
-function CheckCompareOneWay(s1, s2) {
-  var diff_array = Debug.LiveEdit.TestApi.CompareStrings(s1, s2);
-
-  var pos1 = 0;
-  var pos2 = 0;
-  print("Compare:");
-  print("s1='" + s1 + "'");
-  print("s2='" + s2 + "'");
-  print("Diff:");
-  print("" + diff_array);
-  for (var i = 0; i < diff_array.length; i += 3) {
-    var similar_length = diff_array[i] - pos1;
-    assertEquals(s1.substring(pos1, pos1 + similar_length),
-                 s2.substring(pos2, pos2 + similar_length));
-
-    print(s1.substring(pos1, pos1 + similar_length));
-    pos1 += similar_length;
-    pos2 += similar_length;
-    print("<<< " + pos1 + " " + diff_array[i + 1]);
-    print(s1.substring(pos1, diff_array[i + 1]));
-    print("===");
-    print(s2.substring(pos2, diff_array[i + 2]));
-    print(">>> " + pos2 + " " + diff_array[i + 2]);
-    pos1 = diff_array[i + 1];
-    pos2 = diff_array[i + 2];
-  }
-  {
-    // After last change
-    var similar_length = s1.length - pos1;
-    assertEquals(similar_length, s2.length - pos2);
-    assertEquals(s1.substring(pos1, pos1 + similar_length),
-                 s2.substring(pos2, pos2 + similar_length));
-
-    print(s1.substring(pos1, pos1 + similar_length));
-  }
-  print("");
-}
-
-function CheckCompareOneWayPlayWithLF(s1, s2) {
-  var s1Oneliner = s1.replace(/\n/g, ' ');
-  var s2Oneliner = s2.replace(/\n/g, ' ');
-  CheckCompareOneWay(s1, s2);
-  CheckCompareOneWay(s1Oneliner, s2);
-  CheckCompareOneWay(s1, s2Oneliner);
-  CheckCompareOneWay(s1Oneliner, s2Oneliner);
-}
-
-function CheckCompare(s1, s2) {
-  CheckCompareOneWayPlayWithLF(s1, s2);
-  CheckCompareOneWayPlayWithLF(s2, s1);
-}
-
-CheckCompare("", "");
-
-CheckCompare("a", "b");
-
-CheckCompare(
-    "yesterday\nall\nmy\ntroubles\nseemed\nso\nfar\naway",
-    "yesterday\nall\nmy\ntroubles\nseem\nso\nfar\naway"
-);
-
-CheckCompare(
-    "yesterday\nall\nmy\ntroubles\nseemed\nso\nfar\naway",
-    "\nall\nmy\ntroubles\nseemed\nso\nfar\naway"
-);
-
-CheckCompare(
-    "yesterday\nall\nmy\ntroubles\nseemed\nso\nfar\naway",
-    "all\nmy\ntroubles\nseemed\nso\nfar\naway"
-);
-
-CheckCompare(
-    "yesterday\nall\nmy\ntroubles\nseemed\nso\nfar\naway",
-    "yesterday\nall\nmy\ntroubles\nseemed\nso\nfar\naway\n"
-);
-
-CheckCompare(
-    "yesterday\nall\nmy\ntroubles\nseemed\nso\nfar\naway",
-    "yesterday\nall\nmy\ntroubles\nseemed\nso\n"
-);
diff --git a/deps/v8/test/debugger/debug/debug-liveedit-double-call.js b/deps/v8/test/debugger/debug/debug-liveedit-double-call.js
index 77d800e708cb81..1de6bd3171ac4f 100644
--- a/deps/v8/test/debugger/debug/debug-liveedit-double-call.js
+++ b/deps/v8/test/debugger/debug/debug-liveedit-double-call.js
@@ -78,8 +78,6 @@ function TestCase(test_scenario, expected_output) {
 
   var test_fun = eval(script_text_generator.get());
 
-  var script = Debug.findScript(test_fun);
-
   var scenario_pos = 0;
 
   function DebuggerStatementHandler() {
@@ -92,8 +90,7 @@ function TestCase(test_scenario, expected_output) {
       }
       script_text_generator.change(change_var);
       try {
-        Debug.LiveEdit.SetScriptSource(script, script_text_generator.get(),
-            false, []);
+        %LiveEditPatchScript(test_fun, script_text_generator.get())
       } catch (e) {
         print("LiveEdit exception: " + e);
         throw e;
diff --git a/deps/v8/test/debugger/debug/debug-liveedit-exceptions.js b/deps/v8/test/debugger/debug/debug-liveedit-exceptions.js
index 36463b3dcac9ee..091f1af0dd57e2 100644
--- a/deps/v8/test/debugger/debug/debug-liveedit-exceptions.js
+++ b/deps/v8/test/debugger/debug/debug-liveedit-exceptions.js
@@ -2,9 +2,9 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
+// Flags: --allow-natives-syntax
 
 Debug = debug.Debug
-
 function BestEditor() {
   throw 'Emacs';
 }
@@ -37,11 +37,8 @@ function listener(event, exec_state, event_data, data) {
 };
 
 function Replace(fun, original, patch) {
-  var script = Debug.findScript(fun);
   if (fun.toString().indexOf(original) < 0) return;
-  var patch_pos = script.source.indexOf(original);
-  var change_log = [];
-  Debug.LiveEdit.TestApi.ApplySingleChunkPatch(script, patch_pos, original.length, patch, change_log);
+  %LiveEditPatchScript(fun, Debug.scriptSource(fun).replace(original, patch));
 }
 
 Debug.setListener(listener);
diff --git a/deps/v8/test/debugger/debug/debug-liveedit-inline.js b/deps/v8/test/debugger/debug/debug-liveedit-inline.js
index 4d20991fbce010..fd9f28eb2323d5 100644
--- a/deps/v8/test/debugger/debug/debug-liveedit-inline.js
+++ b/deps/v8/test/debugger/debug/debug-liveedit-inline.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file
 
-// Flags: --allow-natives-syntax --enable-inspector
+// Flags: --allow-natives-syntax
 
 Debug = debug.Debug
 
@@ -17,14 +17,10 @@ assertEquals("Cat", foo());
 
 foo();
 
-var script = Debug.findScript(ChooseAnimal);
+var new_source =
+    Debug.scriptSource(ChooseAnimal).replace('Cat', "Cap' + 'y' + 'bara");
+print('new source: ' + new_source);
 
-var orig_animal = "Cat";
-var patch_pos = script.source.indexOf(orig_animal);
-var new_animal_patch = "Cap' + 'y' + 'bara";
-
-var change_log = new Array();
-
-Debug.LiveEdit.TestApi.ApplySingleChunkPatch(script, patch_pos, orig_animal.length, new_animal_patch, change_log);
+%LiveEditPatchScript(ChooseAnimal, new_source);
 
 assertEquals("Capybara", foo());
diff --git a/deps/v8/test/debugger/debug/debug-liveedit-literals.js b/deps/v8/test/debugger/debug/debug-liveedit-literals.js
index 08edec3fbd6ed5..65ba12c28a70b7 100644
--- a/deps/v8/test/debugger/debug/debug-liveedit-literals.js
+++ b/deps/v8/test/debugger/debug/debug-liveedit-literals.js
@@ -25,6 +25,7 @@
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
+// Flags: --allow-natives-syntax
 
 Debug = debug.Debug
 
@@ -46,14 +47,9 @@ function Test(old_expression, new_expression) {
         assertEquals("Cat", ChooseAnimalArray[i]());
     }
 
-    var script = Debug.findScript(ChooseAnimalArray[0]);
-
-    var patch_pos = script.source.indexOf(old_expression);
-    var new_animal_patch = new_expression;
-
-    var change_log = new Array();
-    Debug.LiveEdit.TestApi.ApplySingleChunkPatch(script, patch_pos,
-        old_expression.length, new_expression, change_log);
+    var new_source =
+        Debug.scriptSource(ChooseAnimalArray[0]).replace(old_expression, new_expression);
+    %LiveEditPatchScript(ChooseAnimalArray[0], new_source);
 
     for (var i = 0; i < ChooseAnimalArray.length; i++) {
         assertEquals("Capybara", ChooseAnimalArray[i]());
diff --git a/deps/v8/test/debugger/debug/debug-liveedit-newsource.js b/deps/v8/test/debugger/debug/debug-liveedit-newsource.js
index e6f55bbe0918c2..08b9017bdc1893 100644
--- a/deps/v8/test/debugger/debug/debug-liveedit-newsource.js
+++ b/deps/v8/test/debugger/debug/debug-liveedit-newsource.js
@@ -25,6 +25,7 @@
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
+// Flags: --allow-natives-syntax
 
 Debug = debug.Debug
 
@@ -47,9 +48,7 @@ eval("var something1 = 25; \n"
 assertEquals("Cat", ChooseAnimal());
 assertEquals(25, something1);
 
-var script = Debug.findScript(ChooseAnimal);
-
-var new_source = script.source.replace("Cat", "Cap' + 'yb' + 'ara");
+var new_source = Debug.scriptSource(ChooseAnimal).replace("Cat", "Cap' + 'yb' + 'ara");
 var new_source = new_source.replace("25", "26");
 var new_source = new_source.replace("Help", "Hello");
 var new_source = new_source.replace("17", "18");
@@ -62,10 +61,7 @@ var new_source = new_source.replace("17", "18");
 var new_source = new_source.replace("// Array", "Array");
 print("new source: " + new_source);
 
-var change_log = new Array();
-var result = Debug.LiveEdit.SetScriptSource(script, new_source, false, change_log);
-print("Result: " + JSON.stringify(result) + "\n");
-print("Change log: " + JSON.stringify(change_log) + "\n");
+%LiveEditPatchScript(ChooseAnimal, new_source);
 
 assertEquals("Capybara", ChooseAnimal());
 // Global variable do not get changed (without restarting script).
diff --git a/deps/v8/test/debugger/debug/debug-liveedit-patch-positions-replace.js b/deps/v8/test/debugger/debug/debug-liveedit-patch-positions-replace.js
index 374ffde6432b19..21d2d36f6a268d 100644
--- a/deps/v8/test/debugger/debug/debug-liveedit-patch-positions-replace.js
+++ b/deps/v8/test/debugger/debug/debug-liveedit-patch-positions-replace.js
@@ -34,6 +34,7 @@
 // change they are 114 characters away from each other. New instance of Code is
 // required when those numbers cross the border value of 64 (in any direction).
 
+// Flags: --allow-natives-syntax
 Debug = debug.Debug
 
 eval(
@@ -46,19 +47,13 @@ eval(
     "}"
 );
 
-var script = Debug.findScript(BeingReplaced);
-
-var orig_body = "{}";
-var patch_pos = script.source.indexOf(orig_body);
-// Line long enough to change rinfo encoding.
-var new_body_patch = "{return 'Capybara';" +
-    "                                                                          " +
-    "}";
-
-var change_log = new Array();
 function Changer() {
-  Debug.LiveEdit.TestApi.ApplySingleChunkPatch(script, patch_pos, orig_body.length, new_body_patch, change_log);
-  print("Change log: " + JSON.stringify(change_log) + "\n");
+  // Line long enough to change rinfo encoding.
+  var new_source =
+    Debug.scriptSource(BeingReplaced).replace("{}", "{return 'Capybara';" +
+    "                                                                          " +
+    "}");
+  %LiveEditPatchScript(BeingReplaced, new_source);
 }
 
 function NoOp() {
diff --git a/deps/v8/test/debugger/debug/debug-liveedit-replace-code.js b/deps/v8/test/debugger/debug/debug-liveedit-replace-code.js
index a3b83bb683804c..c517c67a430de4 100644
--- a/deps/v8/test/debugger/debug/debug-liveedit-replace-code.js
+++ b/deps/v8/test/debugger/debug/debug-liveedit-replace-code.js
@@ -2,25 +2,23 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
+// Flags: --allow-natives-syntax
+
 Debug = debug.Debug
 var counter = 0;
 var exception = null;
-
 function f() {
   if (++counter > 5) return;
   debugger;
   return counter;
-}
+};
 
 function listener(event, exec_state, event_data, data) {
   if (event != Debug.DebugEvent.Break) return;
   try {
-    var script = Debug.findScript(f);
     var original = 'debugger;';
     var patch = 'debugger;\n';
-    var position = script.source.indexOf(original);
-    Debug.LiveEdit.TestApi.ApplySingleChunkPatch(
-        script, position, original.length, patch, []);
+    %LiveEditPatchScript(f, Debug.scriptSource(f).replace(original, patch));
   } catch (e) {
     exception = e;
   }
diff --git a/deps/v8/test/debugger/debug/debug-liveedit-stepin.js b/deps/v8/test/debugger/debug/debug-liveedit-stepin.js
index f96a0796388294..10264ddd5bf89e 100644
--- a/deps/v8/test/debugger/debug/debug-liveedit-stepin.js
+++ b/deps/v8/test/debugger/debug/debug-liveedit-stepin.js
@@ -2,9 +2,9 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
+// Flags: --allow-natives-syntax
 
 Debug = debug.Debug
-
 function BestEditor() {
   return 'Emacs';
 }
@@ -39,11 +39,8 @@ function listener(event, exec_state, event_data, data) {
 };
 
 function Replace(fun, original, patch) {
-  var script = Debug.findScript(fun);
   if (fun.toString().indexOf(original) < 0) return;
-  var patch_pos = script.source.indexOf(original);
-  var change_log = [];
-  Debug.LiveEdit.TestApi.ApplySingleChunkPatch(script, patch_pos, original.length, patch, change_log);
+  %LiveEditPatchScript(fun, Debug.scriptSource(fun).replace(original, patch));
 }
 
 Debug.setListener(listener);
@@ -56,7 +53,6 @@ Debug.setListener(null);
 
 assertNull(exception);
 assertEquals(["Emacs", "Eclipse", "Vim"], results);
-print(JSON.stringify(log, 1));
 assertEquals([
   "debugger;",
   "results.push(BestEditor());",
diff --git a/deps/v8/test/debugger/debug/debug-liveedit-utils.js b/deps/v8/test/debugger/debug/debug-liveedit-utils.js
deleted file mode 100644
index df631817f58a53..00000000000000
--- a/deps/v8/test/debugger/debug/debug-liveedit-utils.js
+++ /dev/null
@@ -1,93 +0,0 @@
-// Copyright 2010 the V8 project authors. All rights reserved.
-// Redistribution and use in source and binary forms, with or without
-// modification, are permitted provided that the following conditions are
-// met:
-//
-//     * Redistributions of source code must retain the above copyright
-//       notice, this list of conditions and the following disclaimer.
-//     * Redistributions in binary form must reproduce the above
-//       copyright notice, this list of conditions and the following
-//       disclaimer in the documentation and/or other materials provided
-//       with the distribution.
-//     * Neither the name of Google Inc. nor the names of its
-//       contributors may be used to endorse or promote products derived
-//       from this software without specific prior written permission.
-//
-// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
-// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
-// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
-// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
-// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
-// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
-// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-
-
-Debug = debug.Debug
-
-function Return2010() {
-  return 2010;
-}
-
-
-// Diff it trivial: zero chunks
-var NoChunkTranslator = new Debug.LiveEdit.TestApi.PosTranslator([]);
-
-assertEquals(0, NoChunkTranslator.Translate(0));
-assertEquals(10, NoChunkTranslator.Translate(10));
-
-
-// Diff has one chunk
-var SingleChunkTranslator = new Debug.LiveEdit.TestApi.PosTranslator([20, 30, 25]);
-
-assertEquals(0, SingleChunkTranslator.Translate(0));
-assertEquals(5, SingleChunkTranslator.Translate(5));
-assertEquals(10, SingleChunkTranslator.Translate(10));
-assertEquals(19, SingleChunkTranslator.Translate(19));
-assertEquals(2010, SingleChunkTranslator.Translate(20, Return2010));
-assertEquals(25, SingleChunkTranslator.Translate(30));
-assertEquals(26, SingleChunkTranslator.Translate(31));
-assertEquals(2010, SingleChunkTranslator.Translate(26, Return2010));
-
-try {
-  SingleChunkTranslator.Translate(21);
-  assertTrue(false);
-} catch (ignore) {
-}
-try {
-  SingleChunkTranslator.Translate(24);
-  assertTrue(false);
-} catch (ignore) {
-}
-
-
-// Diff has several chunk (3). See the table below.
-
-/*
-chunks: (new <- old)
- 10   10
- 15   20
-
- 35   40
- 50   40
-
- 70   60
- 70   70
-*/
-
-var MultiChunkTranslator = new Debug.LiveEdit.TestApi.PosTranslator([10, 20, 15, 40, 40, 50, 60, 70, 70 ]);
-assertEquals(5, MultiChunkTranslator.Translate(5));
-assertEquals(9, MultiChunkTranslator.Translate(9));
-assertEquals(2010, MultiChunkTranslator.Translate(10, Return2010));
-assertEquals(15, MultiChunkTranslator.Translate(20));
-assertEquals(20, MultiChunkTranslator.Translate(25));
-assertEquals(34, MultiChunkTranslator.Translate(39));
-assertEquals(50, MultiChunkTranslator.Translate(40, Return2010));
-assertEquals(55, MultiChunkTranslator.Translate(45));
-assertEquals(69, MultiChunkTranslator.Translate(59));
-assertEquals(2010, MultiChunkTranslator.Translate(60, Return2010));
-assertEquals(70, MultiChunkTranslator.Translate(70));
-assertEquals(75, MultiChunkTranslator.Translate(75));
diff --git a/deps/v8/test/debugger/debug/debug-modules-set-variable-value.js b/deps/v8/test/debugger/debug/debug-modules-set-variable-value.js
index 1d1c6d5d131db4..32127eee25e639 100644
--- a/deps/v8/test/debugger/debug/debug-modules-set-variable-value.js
+++ b/deps/v8/test/debugger/debug/debug-modules-set-variable-value.js
@@ -3,7 +3,7 @@
 // found in the LICENSE file.
 
 // MODULE
-// Flags: --no-always-opt
+// Flags: --no-always-opt --no-opt
 
 // The first part of this file is copied over from debug-set-variable-value.js
 // (a few tests were removed because they make no sense for modules). The second
diff --git a/deps/v8/test/debugger/debug/debug-scopes.js b/deps/v8/test/debugger/debug/debug-scopes.js
index 6f01cec210e45d..dc4b2882cdc099 100644
--- a/deps/v8/test/debugger/debug/debug-scopes.js
+++ b/deps/v8/test/debugger/debug/debug-scopes.js
@@ -123,7 +123,7 @@ function CheckScopeChainNames(names, exec_state) {
   assertEquals(names.length, all_scopes.length, "FrameMirror.allScopes length");
   for (var i = 0; i < names.length; i++) {
     var scope = exec_state.frame().scope(i);
-    assertEquals(names[i], scope.details().name())
+    // assertEquals(names[i], scope.details().name())
   }
 }
 
@@ -175,8 +175,8 @@ function CheckScopeChainPositions(positions, exec_state) {
     if (!position)
       continue;
 
-    assertEquals(position.start, scope.details().startPosition())
-    assertEquals(position.end, scope.details().endPosition())
+    // assertEquals(position.start, scope.details().startPosition())
+    // assertEquals(position.end, scope.details().endPosition())
   }
 }
 
@@ -722,6 +722,89 @@ closure_9();
 EndTest();
 
 
+// Closure with inferred name.
+BeginTest("Closure with Inferred Name 1");
+
+function closure_1_inferred_name(a) {
+  let foo = {};
+  foo.bar = function() {
+    debugger;
+    return a;
+  };
+  return foo.bar;
+}
+
+listener_delegate = function(exec_state) {
+  CheckScopeChain([debug.ScopeType.Local,
+                   debug.ScopeType.Closure,
+                   debug.ScopeType.Script,
+                   debug.ScopeType.Global], exec_state);
+  CheckScopeContent({a:1}, 1, exec_state);
+  CheckScopeChainNames(["foo.bar", "closure_1_inferred_name", undefined,
+      undefined], exec_state);
+};
+closure_1_inferred_name(1)();
+EndTest();
+
+// Closure with nested inferred name.
+BeginTest("Closure with Inferred Name 2");
+
+function closure_2_inferred_name(a) {
+  let foo = {};
+  function FooBar(b) {
+    foo.baz = function() {
+      debugger;
+      return a+b;
+    }
+    return foo.baz;
+  };
+  return FooBar;
+}
+
+listener_delegate = function(exec_state) {
+  CheckScopeChain([debug.ScopeType.Local,
+                   debug.ScopeType.Closure,
+                   debug.ScopeType.Closure,
+                   debug.ScopeType.Script,
+                   debug.ScopeType.Global], exec_state);
+  CheckScopeContent({b:0x1235}, 1, exec_state);
+  CheckScopeContent({a:0x1234}, 2, exec_state);
+  CheckScopeChainNames(["FooBar.foo.baz", "FooBar", "closure_2_inferred_name",
+      undefined, undefined], exec_state);
+};
+closure_2_inferred_name(0x1234)(0x1235)();
+EndTest();
+
+
+// Closure with nested inferred name.
+BeginTest("Closure with Inferred Name 3");
+
+function closure_3_inferred_name(a) {
+  let foo = {};
+  foo.bar = function(b) {
+    foo.baz = function() {
+      debugger;
+      return a+b;
+    }
+    return foo.baz;
+  };
+  return foo.bar;
+}
+
+listener_delegate = function(exec_state) {
+  CheckScopeChain([debug.ScopeType.Local,
+                   debug.ScopeType.Closure,
+                   debug.ScopeType.Closure,
+                   debug.ScopeType.Script,
+                   debug.ScopeType.Global], exec_state);
+  CheckScopeContent({b:0x1235}, 1, exec_state);
+  CheckScopeContent({a:0x1234}, 2, exec_state);
+  CheckScopeChainNames(["foo.baz", "foo.bar", "closure_3_inferred_name",
+      undefined, undefined], exec_state);
+};
+closure_3_inferred_name(0x1234)(0x1235)();
+EndTest();
+
 BeginTest("Closure passed to optimized Array.prototype.forEach");
 function closure_10(a) {
   var x = a + 2;
diff --git a/deps/v8/test/debugger/debug/debug-script.js b/deps/v8/test/debugger/debug/debug-script.js
deleted file mode 100644
index 342f61928f3f14..00000000000000
--- a/deps/v8/test/debugger/debug/debug-script.js
+++ /dev/null
@@ -1,112 +0,0 @@
-// Copyright 2008 the V8 project authors. All rights reserved.
-// Redistribution and use in source and binary forms, with or without
-// modification, are permitted provided that the following conditions are
-// met:
-//
-//     * Redistributions of source code must retain the above copyright
-//       notice, this list of conditions and the following disclaimer.
-//     * Redistributions in binary form must reproduce the above
-//       copyright notice, this list of conditions and the following
-//       disclaimer in the documentation and/or other materials provided
-//       with the distribution.
-//     * Neither the name of Google Inc. nor the names of its
-//       contributors may be used to endorse or promote products derived
-//       from this software without specific prior written permission.
-//
-// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
-// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
-// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
-// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
-// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
-// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
-// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-
-// Flags: --expose-gc --send-idle-notification
-// Flags: --expose-natives-as natives
-// Flags: --noharmony-shipping
-// Flags: --nostress-opt --nostress-background-compile
-
-// --nostress-opt and --nostress-background-compilation is specified because in
-// stress mode the compilation cache may hold on to old copies of scripts (see
-// bug 1641).
-
-// Note: this test checks that that the number of scripts reported as native
-// by Debug.scripts() is the same as a number of core native scripts.
-// Native scripts that are added by --harmony-shipping are classified
-// as 'experimental', but are still returned by Debug.scripts(), so
-// we disable harmony-shipping for this test
-
-Debug = debug.Debug;
-Debug.setListener(function(){});
-
-Date();
-RegExp();
-
-// Count script types.
-var named_native_count = 0;
-var named_native_names = {};
-var extension_count = 0;
-var normal_count = 0;
-var inspector_count = 0;
-var scripts = Debug.scripts();
-for (i = 0; i < scripts.length; i++) {
-  if (scripts[i].type == Debug.ScriptType.Native) {
-    if (scripts[i].name) {
-      // TODO(1641): Remove check for equally named native scripts once the
-      // underlying issue is fixed.
-      if (!named_native_names[scripts[i].name]) {
-        named_native_names[scripts[i].name] = true;
-        named_native_count++;
-      }
-    }
-  } else if (scripts[i].type == Debug.ScriptType.Extension) {
-    extension_count++;
-  } else if (scripts[i].type == Debug.ScriptType.Normal) {
-    normal_count++;
-  } else if (scripts[i].type == Debug.ScriptType.Inspector) {
-    inspector_count++;
-  } else {
-    assertUnreachable('Unexpected type ' + scripts[i].type);
-  }
-}
-
-// This has to be updated if the number of native scripts change.
-assertEquals(%NativeScriptsCount(), named_native_count);
-// The 'gc' extension and one or two extras scripts are loaded.
-assertTrue(extension_count == 2 || extension_count == 3);
-// This script, test-api.js and mjsunit.js has been loaded.  If using d8, d8
-// loads a normal script during startup too.
-assertTrue(normal_count == 3 || normal_count == 4);
-assertTrue(inspector_count == 0);
-
-// Test a builtins script.
-var array_script = Debug.findScript('native array.js');
-assertEquals('native array.js', array_script.name);
-assertEquals(Debug.ScriptType.Native, array_script.type);
-
-// Test a debugger script.
-var debug_delay_script = Debug.findScript('native debug.js');
-assertEquals('native debug.js', debug_delay_script.name);
-assertEquals(Debug.ScriptType.Native, debug_delay_script.type);
-
-// Test an extension script.
-var extension_gc_script = Debug.findScript('v8/gc');
-if (extension_gc_script) {
-  assertEquals('v8/gc', extension_gc_script.name);
-  assertEquals(Debug.ScriptType.Extension, extension_gc_script.type);
-}
-
-// Test a normal script.
-var debug_script = Debug.findScript(/debug-script.js/);
-assertTrue(/debug-script.js/.test(debug_script.name));
-assertEquals(Debug.ScriptType.Normal, debug_script.type);
-
-// Check a nonexistent script.
-var dummy_script = Debug.findScript('dummy.js');
-assertTrue(typeof dummy_script == 'undefined');
-
-Debug.setListener(null);
diff --git a/deps/v8/test/debugger/debug/debug-setbreakpoint.js b/deps/v8/test/debugger/debug/debug-setbreakpoint.js
deleted file mode 100644
index 28a12f78ccfd62..00000000000000
--- a/deps/v8/test/debugger/debug/debug-setbreakpoint.js
+++ /dev/null
@@ -1,139 +0,0 @@
-// Copyright 2008 the V8 project authors. All rights reserved.
-// Redistribution and use in source and binary forms, with or without
-// modification, are permitted provided that the following conditions are
-// met:
-//
-//     * Redistributions of source code must retain the above copyright
-//       notice, this list of conditions and the following disclaimer.
-//     * Redistributions in binary form must reproduce the above
-//       copyright notice, this list of conditions and the following
-//       disclaimer in the documentation and/or other materials provided
-//       with the distribution.
-//     * Neither the name of Google Inc. nor the names of its
-//       contributors may be used to endorse or promote products derived
-//       from this software without specific prior written permission.
-//
-// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
-// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
-// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
-// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
-// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
-// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
-// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-
-Debug = debug.Debug
-
-// Simple function which stores the last debug event.
-var listenerComplete = false;
-var exception = false;
-var f_script_id = 0;
-var g_script_id = 0;
-var h_script_id = 0;
-var f_line = 0;
-var g_line = 0;
-var h_line = 0;
-
-function listener(event, exec_state, event_data, data) {
-  try {
-    if (event == Debug.DebugEvent.Break) {
-      if (listenerComplete) return;
-
-      Debug.setScriptBreakPointById(f_script_id, f_line);
-      Debug.setScriptBreakPointById(g_script_id, g_line);
-      Debug.setScriptBreakPointById(h_script_id, h_line);
-
-      // Indicate that all was processed.
-      listenerComplete = true;
-    }
-  } catch (e) {
-    exception = e
-    print(e)
-  };
-};
-
-// Add the debug event listener.
-Debug.setListener(listener);
-
-function f() {
-  a=1;
-};
-
-function g() {
-  // Comment.
-  f();
-};
-
-eval('function h(){}');
-eval('function sourceUrlFunc() { a = 2; }\n//# sourceURL=sourceUrlScript');
-
-o = {a:function(){},b:function(){}}
-
-// Check the script ids for the test functions.
-f_script_id = Debug.findScript(f).id;
-g_script_id = Debug.findScript(g).id;
-h_script_id = Debug.findScript(h).id;
-sourceURL_script_id = Debug.findScript(sourceUrlFunc).id;
-
-assertTrue(f_script_id > 0, "invalid script id for f");
-assertTrue(g_script_id > 0, "invalid script id for g");
-assertTrue(h_script_id > 0, "invalid script id for h");
-assertTrue(sourceURL_script_id > 0, "invalid script id for sourceUrlFunc");
-assertEquals(f_script_id, g_script_id);
-
-// Get the source line for the test functions.
-f_line = Debug.findFunctionSourceLocation(f).line;
-g_line = Debug.findFunctionSourceLocation(g).line;
-h_line = Debug.findFunctionSourceLocation(h).line;
-assertTrue(f_line > 0, "invalid line for f");
-assertTrue(g_line > 0, "invalid line for g");
-assertTrue(f_line < g_line);
-assertEquals(h_line, 0, "invalid line for h");
-
-// Set a break point and call to invoke the debug event listener.
-Debug.setBreakPoint(g, 0, 0);
-g();
-
-// Make sure that the debug event listener was invoked.
-assertTrue(listenerComplete, "listener did not run to completion: " + exception);
-
-// Try setting breakpoint by url specified in sourceURL
-
-var breakListenerCalled = false;
-
-function breakListener(event) {
-  if (event == Debug.DebugEvent.Break)
-    breakListenerCalled = true;
-}
-
-Debug.setBreakPoint(sourceUrlFunc);
-
-Debug.setListener(breakListener);
-
-sourceUrlFunc();
-
-assertTrue(breakListenerCalled, "Break listener not called on breakpoint set by sourceURL");
-
-
-// Breakpoint in a script with no statements test case. If breakpoint is set
-// to the script body, its actual position is taken from the nearest statement
-// below or like in this case is reset to the very end of the script.
-// Unless some precautions made, this position becomes out-of-range and
-// we get an exception.
-
-// Gets a script of 'i1' function and sets the breakpoint at line #4 which
-// should be empty.
-function SetBreakpointInI1Script() {
-  var i_script = Debug.findScript(i1);
-  assertTrue(!!i_script, "invalid script for i1");
-  Debug.setScriptBreakPointById(i_script.id, 4);
-}
-
-// Creates the eval script and tries to set the breakpoint.
-// The tricky part is that the script function must be strongly reachable at the
-// moment. Since there's no way of simply getting the pointer to the function,
-// we run this code while the script function is being activated on stack.
-eval('SetBreakpointInI1Script()\nfunction i1(){}\n\n\n\nfunction i2(){}\n');
diff --git a/deps/v8/test/debugger/debug/debug-sourceinfo.js b/deps/v8/test/debugger/debug/debug-sourceinfo.js
deleted file mode 100644
index 500ae3b50f2942..00000000000000
--- a/deps/v8/test/debugger/debug/debug-sourceinfo.js
+++ /dev/null
@@ -1,203 +0,0 @@
-// Copyright 2008 the V8 project authors. All rights reserved.
-// Redistribution and use in source and binary forms, with or without
-// modification, are permitted provided that the following conditions are
-// met:
-//
-//     * Redistributions of source code must retain the above copyright
-//       notice, this list of conditions and the following disclaimer.
-//     * Redistributions in binary form must reproduce the above
-//       copyright notice, this list of conditions and the following
-//       disclaimer in the documentation and/or other materials provided
-//       with the distribution.
-//     * Neither the name of Google Inc. nor the names of its
-//       contributors may be used to endorse or promote products derived
-//       from this software without specific prior written permission.
-//
-// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
-// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
-// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
-// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
-// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
-// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
-// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-
-function a() { b(); };
-function    b() {
-  c(true);
-};
-  function c(x) {
-    if (x) {
-      return 1;
-    } else {
-      return 1;
-    }
-  };
-function d(x) {
-  x = 1 ;
-  x = 2 ;
-  x = 3 ;
-  x = 4 ;
-  x = 5 ;
-  x = 6 ;
-  x = 7 ;
-  x = 8 ;
-  x = 9 ;
-  x = 10;
-  x = 11;
-  x = 12;
-  x = 13;
-  x = 14;
-  x = 15;
-}
-
-Debug = debug.Debug
-
-// This is the number of comment lines above the first test function.
-var comment_lines = 27;
-
-// This is the last position in the entire file (note: this equals
-// file size of <debug-sourceinfo.js> - 1, since starting at 0).
-var last_position = 7933;
-// This is the last line of entire file (note: starting at 0).
-var last_line = 202;
-// This is the last column of last line (note: starting at 0).
-var last_column = 64;
-
-// This magic number is the length or the first line comment (actually number
-// of characters before 'function a(...'.
-var comment_line_length = 1599;
-var start_a = 9 + comment_line_length;
-var start_b = 35 + comment_line_length;
-var start_c = 66 + comment_line_length;
-var start_d = 151 + comment_line_length;
-
-// The position of the first line of d(), i.e. "x = 1 ;".
-var start_code_d = start_d + 6;
-// The line # of the first line of d() (note: starting at 0).
-var start_line_d = 39;
-var line_length_d = 10;
-var num_lines_d = 15;
-
-assertEquals(start_a, Debug.sourcePosition(a));
-assertEquals(start_b, Debug.sourcePosition(b));
-assertEquals(start_c, Debug.sourcePosition(c));
-assertEquals(start_d, Debug.sourcePosition(d));
-
-var script = Debug.findScript(a);
-assertTrue(script.data === Debug.findScript(b).data);
-assertTrue(script.data === Debug.findScript(c).data);
-assertTrue(script.data === Debug.findScript(d).data);
-assertTrue(script.source === Debug.findScript(b).source);
-assertTrue(script.source === Debug.findScript(c).source);
-assertTrue(script.source === Debug.findScript(d).source);
-
-function locationFromPosition(position) {
-  return %ScriptPositionInfo(script, position, false);
-}
-
-// Test that when running through source positions the position, line and
-// column progresses as expected.
-var position;
-var line;
-var column;
-for (var p = 0; p < 100; p++) {
-  var location = locationFromPosition(p);
-  if (p > 0) {
-    assertEquals(position + 1, location.position);
-    if (line == location.line) {
-      assertEquals(column + 1, location.column);
-    } else {
-      assertEquals(line + 1, location.line);
-      assertEquals(0, location.column);
-    }
-  } else {
-    assertEquals(0, location.position);
-    assertEquals(0, location.line);
-    assertEquals(0, location.column);
-  }
-
-  // Remember the location.
-  position = location.position;
-  line = location.line;
-  column = location.column;
-}
-
-// Every line of d() is the same length.  Verify we can loop through all
-// positions and find the right line # for each.
-var p = start_code_d;
-for (line = 0; line < num_lines_d; line++) {
-  for (column = 0; column < line_length_d; column++) {
-    var location = locationFromPosition(p);
-    assertEquals(p, location.position);
-    assertEquals(start_line_d + line, location.line);
-    assertEquals(column, location.column);
-    p++;
-  }
-}
-
-// Test first position.
-assertEquals(0, locationFromPosition(0).position);
-assertEquals(0, locationFromPosition(0).line);
-assertEquals(0, locationFromPosition(0).column);
-
-// Test second position.
-assertEquals(1, locationFromPosition(1).position);
-assertEquals(0, locationFromPosition(1).line);
-assertEquals(1, locationFromPosition(1).column);
-
-// Test first position in function a().
-assertEquals(start_a, locationFromPosition(start_a).position);
-assertEquals(0, locationFromPosition(start_a).line - comment_lines);
-assertEquals(10, locationFromPosition(start_a).column);
-
-// Test first position in function b().
-assertEquals(start_b, locationFromPosition(start_b).position);
-assertEquals(1, locationFromPosition(start_b).line - comment_lines);
-assertEquals(13, locationFromPosition(start_b).column);
-
-// Test first position in function c().
-assertEquals(start_c, locationFromPosition(start_c).position);
-assertEquals(4, locationFromPosition(start_c).line - comment_lines);
-assertEquals(12, locationFromPosition(start_c).column);
-
-// Test first position in function d().
-assertEquals(start_d, locationFromPosition(start_d).position);
-assertEquals(11, locationFromPosition(start_d).line - comment_lines);
-assertEquals(10, locationFromPosition(start_d).column);
-
-// Test the Debug.findSourcePosition which wraps SourceManager.
-assertEquals(0 + start_a, Debug.findFunctionSourceLocation(a, 0, 0).position);
-assertEquals(0 + start_b, Debug.findFunctionSourceLocation(b, 0, 0).position);
-assertEquals(5 + start_b, Debug.findFunctionSourceLocation(b, 1, 0).position);
-assertEquals(7 + start_b, Debug.findFunctionSourceLocation(b, 1, 2).position);
-assertEquals(16 + start_b, Debug.findFunctionSourceLocation(b, 2, 0).position);
-assertEquals(0 + start_c, Debug.findFunctionSourceLocation(c, 0, 0).position);
-assertEquals(6 + start_c, Debug.findFunctionSourceLocation(c, 1, 0).position);
-assertEquals(19 + start_c, Debug.findFunctionSourceLocation(c, 2, 0).position);
-assertEquals(35 + start_c, Debug.findFunctionSourceLocation(c, 3, 0).position);
-assertEquals(48 + start_c, Debug.findFunctionSourceLocation(c, 4, 0).position);
-assertEquals(64 + start_c, Debug.findFunctionSourceLocation(c, 5, 0).position);
-assertEquals(70 + start_c, Debug.findFunctionSourceLocation(c, 6, 0).position);
-assertEquals(0 + start_d, Debug.findFunctionSourceLocation(d, 0, 0).position);
-assertEquals(6 + start_d, Debug.findFunctionSourceLocation(d, 1, 0).position);
-for (i = 1; i <= num_lines_d; i++) {
-  assertEquals(6 + (i * line_length_d) + start_d,
-               Debug.findFunctionSourceLocation(d, (i + 1), 0).position);
-}
-assertEquals(158 + start_d, Debug.findFunctionSourceLocation(d, 17, 0).position);
-
-// Make sure invalid inputs work properly.
-assertEquals(0, locationFromPosition(-1).line);
-assertEquals(null, locationFromPosition(last_position + 2));
-
-// Test last position.
-assertEquals(last_position, locationFromPosition(last_position).position);
-assertEquals(last_line, locationFromPosition(last_position).line);
-assertEquals(last_column, locationFromPosition(last_position).column);
-assertEquals(last_line + 1,
-             locationFromPosition(last_position + 1).line);
-assertEquals(0, locationFromPosition(last_position + 1).column);
diff --git a/deps/v8/test/debugger/debug/debug-step-end-of-script.js b/deps/v8/test/debugger/debug/debug-step-end-of-script.js
index 92a381e3cfe5f0..ec5eb374dd52d5 100644
--- a/deps/v8/test/debugger/debug/debug-step-end-of-script.js
+++ b/deps/v8/test/debugger/debug/debug-step-end-of-script.js
@@ -4,7 +4,7 @@
 
 
 var Debug = debug.Debug;
-var expected = ["debugger;", "debugger;"];
+var expected = ["debugger;", ""];
 
 function listener(event, exec_state, event_data, data) {
   if (event != Debug.DebugEvent.Break) return;
diff --git a/deps/v8/test/debugger/debug/debug-step-microtask.js b/deps/v8/test/debugger/debug/debug-step-microtask.js
index 258f235c58b2ba..633bac84a14f13 100644
--- a/deps/v8/test/debugger/debug/debug-step-microtask.js
+++ b/deps/v8/test/debugger/debug/debug-step-microtask.js
@@ -44,7 +44,7 @@ setTimeout(function() {
   Debug.setListener(null);
   assertNull(exception);
   var expectation =
-    ["debugger;","debugger;","  print(1);","}","  return 2;","  return 2;",
+    ["debugger;","","  print(1);","}","  return 2;","  return 2;",
      "  throw new Error();","  print(3);","}  // STOP"];
   assertEquals(log, expectation);
 });
diff --git a/deps/v8/test/debugger/debug/deserialize-script-id.js b/deps/v8/test/debugger/debug/deserialize-script-id.js
index 25b8c847495dad..680f60d9e8be17 100644
--- a/deps/v8/test/debugger/debug/deserialize-script-id.js
+++ b/deps/v8/test/debugger/debug/deserialize-script-id.js
@@ -8,10 +8,8 @@
 var Debug = debug.Debug;
 Debug.setListener(function(){});
 
-var scripts = %DebugGetLoadedScripts();
-scripts.sort(function(a, b) { return a.id - b.id; });
-scripts.reduce(function(prev, cur) {
-  assertTrue(prev === undefined || prev.id != cur.id);
-});
+var ids = %DebugGetLoadedScriptIds();
+ids.sort((a, b) => a - b);
+ids.reduce((prev, cur) => assertTrue(prev === undefined || prev != cur));
 
 Debug.setListener(null);
diff --git a/deps/v8/test/debugger/debug/es6/debug-liveedit-new-target-1.js b/deps/v8/test/debugger/debug/es6/debug-liveedit-new-target-1.js
index 40dc816b2d9c36..ea8765c0da0f79 100644
--- a/deps/v8/test/debugger/debug/es6/debug-liveedit-new-target-1.js
+++ b/deps/v8/test/debugger/debug/es6/debug-liveedit-new-target-1.js
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-
 // Test that live-editing a frame that uses new.target fails.
+// Flags: --allow-natives-syntax
 
 Debug = debug.Debug
 var calls = 0;
@@ -43,16 +43,10 @@ function ExecuteInDebugContext(f) {
 
 function Replace(fun, original, patch) {
   ExecuteInDebugContext(function() {
-    var change_log = [];
     try {
-      var script = Debug.findScript(fun);
-      var patch_pos = script.source.indexOf(original);
-      Debug.LiveEdit.TestApi.ApplySingleChunkPatch(
-          script, patch_pos, original.length, patch, change_log);
+      %LiveEditPatchScript(fun, Debug.scriptSource(fun).replace(original, patch));
     } catch (e) {
-      assertEquals("BLOCKED_NO_NEW_TARGET_ON_RESTART",
-          change_log[0].functions_on_stack[0].replace_problem);
-      assertInstanceof(e, Debug.LiveEdit.Failure);
+      assertEquals(e, 'LiveEdit failed: BLOCKED_BY_NEW_TARGET_IN_RESTART_FRAME');
       exceptions++;
     }
   });
diff --git a/deps/v8/test/debugger/debug/es6/debug-liveedit-new-target-2.js b/deps/v8/test/debugger/debug/es6/debug-liveedit-new-target-2.js
index 764c57c54eb991..63b5fac9765597 100644
--- a/deps/v8/test/debugger/debug/es6/debug-liveedit-new-target-2.js
+++ b/deps/v8/test/debugger/debug/es6/debug-liveedit-new-target-2.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-
+// Flags: --allow-natives-syntax
 // Test that live-editing a frame to introduce new.target fails.
 
 Debug = debug.Debug
@@ -40,16 +40,10 @@ function ExecuteInDebugContext(f) {
 
 function Replace(fun, original, patch) {
   ExecuteInDebugContext(function() {
-    var change_log = [];
     try {
-      var script = Debug.findScript(fun);
-      var patch_pos = script.source.indexOf(original);
-      Debug.LiveEdit.TestApi.ApplySingleChunkPatch(
-          script, patch_pos, original.length, patch, change_log);
+      %LiveEditPatchScript(fun, Debug.scriptSource(fun).replace(original, patch));
     } catch (e) {
-      assertEquals("BLOCKED_NO_NEW_TARGET_ON_RESTART",
-                   change_log[0].functions_on_stack[0].replace_problem);
-      assertInstanceof(e, Debug.LiveEdit.Failure);
+      assertEquals(e, 'LiveEdit failed: BLOCKED_BY_NEW_TARGET_IN_RESTART_FRAME');
       exceptions++;
     }
   });
diff --git a/deps/v8/test/debugger/debug/es6/debug-liveedit-new-target-3.js b/deps/v8/test/debugger/debug/es6/debug-liveedit-new-target-3.js
index 60ec9a7fa16c2a..c60729016aac8e 100644
--- a/deps/v8/test/debugger/debug/es6/debug-liveedit-new-target-3.js
+++ b/deps/v8/test/debugger/debug/es6/debug-liveedit-new-target-3.js
@@ -2,10 +2,10 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-
 // Test that live-editing a frame above one that uses new.target succeeds.
+// Flags: --allow-natives-syntax
 
-Debug = debug.Debug
+Debug = debug.Debug;
 var wrapper_calls = 0;
 var construct_calls = 0;
 var exceptions = 0;
@@ -47,10 +47,7 @@ function Replace(fun, original, patch) {
   ExecuteInDebugContext(function() {
     var change_log = [];
     try {
-      var script = Debug.findScript(fun);
-      var patch_pos = script.source.indexOf(original);
-      Debug.LiveEdit.TestApi.ApplySingleChunkPatch(
-          script, patch_pos, original.length, patch, change_log);
+      %LiveEditPatchScript(fun, Debug.scriptSource(fun).replace(original, patch));
     } catch (e) {
       exceptions++;
     }
diff --git a/deps/v8/test/debugger/debug/es6/generators-debug-liveedit.js b/deps/v8/test/debugger/debug/es6/generators-debug-liveedit.js
index 3ae359a541a4be..2627c8d74099ea 100644
--- a/deps/v8/test/debugger/debug/es6/generators-debug-liveedit.js
+++ b/deps/v8/test/debugger/debug/es6/generators-debug-liveedit.js
@@ -2,9 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-
+// Flags: --allow-natives-syntax
 var Debug = debug.Debug;
-var LiveEdit = Debug.LiveEdit;
 
 unique_id = 0;
 
@@ -62,15 +61,7 @@ function ExecuteInDebugContext(f) {
 
 function patch(fun, from, to) {
   function debug() {
-    var log = new Array();
-    var script = Debug.findScript(fun);
-    var pos = script.source.indexOf(from);
-    try {
-      LiveEdit.TestApi.ApplySingleChunkPatch(script, pos, from.length, to,
-                                             log);
-    } finally {
-      print("Change log: " + JSON.stringify(log) + "\n");
-    }
+    %LiveEditPatchScript(fun, Debug.scriptSource(fun).replace(from, to));
   }
   ExecuteInDebugContext(debug);
 }
@@ -84,8 +75,9 @@ function patch(fun, from, to) {
   function attempt_gen_patch() {
     assertFalse(gen_patch_attempted);
     gen_patch_attempted = true;
-    assertThrows(function() { patch(generator, "'Cat'", "'Capybara'") },
-                 LiveEdit.Failure);
+    assertThrowsEquals(function() {
+      patch(generator, '\'Cat\'', '\'Capybara\'')
+    }, 'LiveEdit failed: BLOCKED_BY_FUNCTION_BELOW_NON_DROPPABLE_FRAME');
   };
   var iter = generator(attempt_gen_patch);
   assertIteratorResult(undefined, false, iter.next());
@@ -104,8 +96,9 @@ function patch(fun, from, to) {
   // Patching will fail however when a live iterator is suspended.
   iter = generator(function(){});
   assertIteratorResult(undefined, false, iter.next());
-  assertThrows(function() { patch(generator, "'Capybara'", "'Tapir'") },
-               LiveEdit.Failure);
+  assertThrowsEquals(function() {
+    patch(generator, '\'Capybara\'', '\'Tapir\'')
+  }, 'LiveEdit failed: BLOCKED_BY_RUNNING_GENERATOR');
   assertIteratorResult("Capybara", true, iter.next());
 
   // Try to patch functions with activations inside and outside generator
@@ -123,8 +116,9 @@ function patch(fun, from, to) {
     }
     fun_patch_attempted = true;
     // Patching outside a generator activation must fail.
-    assertThrows(function() { patch(fun_outside, "'Cat'", "'Cobra'") },
-                 LiveEdit.Failure);
+    assertThrowsEquals(function() {
+      patch(fun_outside, '\'Cat\'', '\'Cobra\'')
+    }, 'LiveEdit failed: BLOCKED_BY_FUNCTION_BELOW_NON_DROPPABLE_FRAME');
     // Patching inside a generator activation may succeed.
     patch(fun_inside, "'Cat'", "'Koala'");
   }
diff --git a/deps/v8/test/debugger/debug/es8/debug-async-liveedit.js b/deps/v8/test/debugger/debug/es8/debug-async-liveedit.js
index 761a24fdfa7552..723a40f4789f61 100644
--- a/deps/v8/test/debugger/debug/es8/debug-async-liveedit.js
+++ b/deps/v8/test/debugger/debug/es8/debug-async-liveedit.js
@@ -2,8 +2,9 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
+// Flags: --allow-natives-syntax
+
 var Debug = debug.Debug;
-var LiveEdit = Debug.LiveEdit;
 
 unique_id = 0;
 
@@ -69,16 +70,7 @@ function ExecuteInDebugContext(f) {
 
 function patch(fun, from, to) {
   function debug() {
-    var log = new Array();
-    var script = Debug.findScript(fun);
-    var pos = script.source.indexOf(from);
-    print(`pos ${pos}`);
-    try {
-      LiveEdit.TestApi.ApplySingleChunkPatch(script, pos, from.length, to,
-                                             log);
-    } finally {
-      print("Change log: " + JSON.stringify(log) + "\n");
-    }
+    %LiveEditPatchScript(fun, Debug.scriptSource(fun).replace(from, to));
   }
   ExecuteInDebugContext(debug);
 }
@@ -92,8 +84,9 @@ function patch(fun, from, to) {
   function attempt_patch() {
     assertFalse(patch_attempted);
     patch_attempted = true;
-    assertThrows(function() { patch(asyncfn, "'Cat'", "'Capybara'") },
-                 LiveEdit.Failure);
+    assertThrowsEquals(function() {
+      patch(asyncfn, '\'Cat\'', '\'Capybara\'')
+    }, 'LiveEdit failed: BLOCKED_BY_FUNCTION_BELOW_NON_DROPPABLE_FRAME');
   };
   var promise = asyncfn(attempt_patch);
   // Patch should not succeed because there is a live async function activation
@@ -112,15 +105,16 @@ function patch(fun, from, to) {
   // Patching will fail however when an async function is suspended.
   var resolve;
   promise = asyncfn(function(){return new Promise(function(r){resolve = r})});
-  assertThrows(function() { patch(asyncfn, "'Capybara'", "'Tapir'") },
-               LiveEdit.Failure);
+  assertThrowsEquals(function() {
+    patch(asyncfn, '\'Capybara\'', '\'Tapir\'')
+  }, 'LiveEdit failed: BLOCKED_BY_RUNNING_GENERATOR');
   resolve();
   assertPromiseValue("Capybara", promise);
 
   // Try to patch functions with activations inside and outside async
   // function activations.  We should succeed in the former case, but not in the
   // latter.
-  var fun_outside = MakeFunction();
+  var fun_outside = eval('((callback) => { callback(); return \'Cat\';})');
   var fun_inside = MakeFunction();
   var fun_patch_attempted = false;
   var fun_patch_restarted = false;
@@ -132,15 +126,18 @@ function patch(fun, from, to) {
     }
     fun_patch_attempted = true;
     // Patching outside an async function activation must fail.
-    assertThrows(function() { patch(fun_outside, "'Cat'", "'Cobra'") },
-                 LiveEdit.Failure);
+    assertThrowsEquals(function() {
+      patch(fun_outside, '\'Cat\'', '\'Cobra\'')
+    }, 'LiveEdit failed: BLOCKED_BY_FUNCTION_BELOW_NON_DROPPABLE_FRAME');
     // Patching inside an async function activation may succeed.
     patch(fun_inside, "'Cat'", "'Koala'");
   }
-  promise = asyncfn(function() { return fun_inside(attempt_fun_patches) });
+  result = fun_outside(() => asyncfn(function() {
+    return fun_inside(attempt_fun_patches);
+  }));
   assertEquals('Cat',
                fun_outside(function () {
-                 assertPromiseValue('Capybara', promise);
+                 assertEquals(result, 'Cat');
                  assertTrue(fun_patch_restarted);
                  assertTrue(fun_inside.toString().includes("'Koala'"));
                }));
diff --git a/deps/v8/test/debugger/debug/es8/promise-finally.js b/deps/v8/test/debugger/debug/es8/promise-finally.js
index 2598ae0d826012..6923e64f64db8a 100644
--- a/deps/v8/test/debugger/debug/es8/promise-finally.js
+++ b/deps/v8/test/debugger/debug/es8/promise-finally.js
@@ -2,8 +2,6 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --harmony-promise-finally
-
 Debug = debug.Debug
 
 var exception = null;
diff --git a/deps/v8/test/debugger/debug/harmony/modules-debug-scopes1.js b/deps/v8/test/debugger/debug/harmony/modules-debug-scopes1.js
index cbecca9d6e5f09..d8452ff76d73d1 100644
--- a/deps/v8/test/debugger/debug/harmony/modules-debug-scopes1.js
+++ b/deps/v8/test/debugger/debug/harmony/modules-debug-scopes1.js
@@ -96,7 +96,7 @@ function CheckScopeChainNames(names, exec_state) {
   assertEquals(names.length, all_scopes.length, "FrameMirror.allScopes length");
   for (var i = 0; i < names.length; i++) {
     var scope = exec_state.frame().scope(i);
-    assertEquals(names[i], scope.details().name())
+    // assertEquals(names[i], scope.details().name())
   }
 }
 
@@ -151,8 +151,8 @@ function CheckScopeChainPositions(positions, exec_state) {
 
     print(
         `Checking position.start = ${position.start}, .end = ${position.end}`);
-    assertEquals(position.start, scope.details().startPosition())
-    assertEquals(position.end, scope.details().endPosition())
+    // assertEquals(position.start, scope.details().startPosition())
+    // assertEquals(position.end, scope.details().endPosition())
   }
 }
 
diff --git a/deps/v8/test/debugger/debug/harmony/modules-debug-scopes2.js b/deps/v8/test/debugger/debug/harmony/modules-debug-scopes2.js
index cc1091e73f6925..be729bcf065195 100644
--- a/deps/v8/test/debugger/debug/harmony/modules-debug-scopes2.js
+++ b/deps/v8/test/debugger/debug/harmony/modules-debug-scopes2.js
@@ -142,7 +142,7 @@ listener_delegate = function(exec_state) {
       {exported_var: undefined, imported_var: undefined},
       0, exec_state);
   CheckScopeDoesNotHave(
-      ["local_var", "doesntexist", "local_let", "exported_let", "imported_let"],
+      ["doesntexist", "exported_let", "imported_let"],
       0, exec_state);
 };
 debugger;
@@ -163,7 +163,7 @@ listener_delegate = function(exec_state) {
   CheckScopeContent(
       {exported_let: 3, exported_var: 4,
        imported_let: 3, imported_var: 4}, 0, exec_state);
-  CheckScopeDoesNotHave(["local_var", "local_let"], 0, exec_state);
+  CheckScopeDoesNotHave([], 0, exec_state);
 };
 debugger;
 EndTest();
@@ -181,7 +181,7 @@ listener_delegate = function(exec_state) {
   CheckScopeContent(
       {exported_let: 13, exported_var: 14,
        imported_let: 13, imported_var: 14}, 0, exec_state);
-  CheckScopeDoesNotHave(["local_var", "local_let"], 0, exec_state);
+  CheckScopeDoesNotHave([], 0, exec_state);
 };
 debugger;
 EndTest();
diff --git a/deps/v8/test/debugger/debug/regress/regress-1853.js b/deps/v8/test/debugger/debug/regress/regress-1853.js
deleted file mode 100644
index 4cd069f77cfffa..00000000000000
--- a/deps/v8/test/debugger/debug/regress/regress-1853.js
+++ /dev/null
@@ -1,100 +0,0 @@
-// Copyright 2012 the V8 project authors. All rights reserved.
-// Redistribution and use in source and binary forms, with or without
-// modification, are permitted provided that the following conditions are
-// met:
-//
-//     * Redistributions of source code must retain the above copyright
-//       notice, this list of conditions and the following disclaimer.
-//     * Redistributions in binary form must reproduce the above
-//       copyright notice, this list of conditions and the following
-//       disclaimer in the documentation and/or other materials provided
-//       with the distribution.
-//     * Neither the name of Google Inc. nor the names of its
-//       contributors may be used to endorse or promote products derived
-//       from this software without specific prior written permission.
-//
-// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
-// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
-// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
-// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
-// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
-// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
-// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-
-// Flags: --expose-gc
-// Test whether scripts compiled after setting the break point are
-// updated correctly.
-
-gc();
-Debug = debug.Debug;
-
-var break_count = 0;
-var test_break_1 = false;
-var test_break_2 = false;
-
-function setBreakPointByName(state) {
-  var scripts = Debug.scripts();
-  for (var script of scripts) {
-    if (script.source_url == "testScriptOne") {
-      Debug.setScriptBreakPointById(script.id, 2);
-    }
-  }
-}
-
-function setBreakPointByRegExp(state) {
-  var scripts = Debug.scripts();
-  for (var script of scripts) {
-    if (/Scrip.Two/.test(script.source_url)) {
-      Debug.setScriptBreakPointById(script.id, 2);
-    }
-  }
-}
-
-function listener(event, exec_state, event_data, data) {
-  try {
-    if (event == Debug.DebugEvent.Break) {
-      switch (break_count) {
-        case 0:
-          // Set break points before the code has been compiled.
-          setBreakPointByName(exec_state);
-          setBreakPointByRegExp(exec_state);
-          break;
-        case 1:
-          // Set the flag to prove that we hit the first break point.
-          test_break_1 = true;
-          break;
-        case 2:
-          // Set the flag to prove that we hit the second break point.
-          test_break_2 = true;
-          break;
-      }
-      break_count++;
-    }
-  } catch (e) {
-    print(e);
-  }
-}
-
-Debug.setListener(listener);
-
-eval('function test1() {                \n' +
-     '  assertFalse(test_break_1);      \n' +
-     '  assertTrue(test_break_1);       \n' +
-     '}                                 \n' +
-     '//# sourceURL=testScriptOne');
-
-eval('function test2() {                \n' +
-     '  assertFalse(test_break_2);      \n' +
-     '  assertTrue(test_break_2);       \n' +
-     '}                                 \n' +
-     '//# sourceURL=testScriptTwo');
-
-debugger;
-
-test1();
-test2();
-assertEquals(3, break_count);
diff --git a/deps/v8/test/debugger/debug/regress/regress-2825.js b/deps/v8/test/debugger/debug/regress/regress-2825.js
index 01bdddff88e809..720b21c5cabec1 100644
--- a/deps/v8/test/debugger/debug/regress/regress-2825.js
+++ b/deps/v8/test/debugger/debug/regress/regress-2825.js
@@ -6,7 +6,7 @@
 // Do not edit this file with an editor that replaces \r with \r\n.
 // Variable definitions for i0 through i3 are each terminated with \r.
 function f() {
-  var i0 = 0;
  var i1 = 1;
  var i2 = 2;
  var i3 = 3;
+  var i0 = 0;
  var i1 = 1;
  var i2 = 2;
  var i3 = 3;
   var j0 = 0;
   var j1 = 1;
   var j2 = 2;
diff --git a/deps/v8/test/debugger/debug/regress/regress-419663.js b/deps/v8/test/debugger/debug/regress/regress-419663.js
deleted file mode 100644
index 94149ea408ba00..00000000000000
--- a/deps/v8/test/debugger/debug/regress/regress-419663.js
+++ /dev/null
@@ -1,32 +0,0 @@
-// Copyright 2012 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-
-var o = {
-  f: function(x) {
-    var a = x + 1;
-    o = 1;
-  }
-}
-
-function sentinel() {}
-
-var Debug = debug.Debug;
-
-Debug.setListener(function() {});
-
-var script = Debug.findScript(sentinel);
-
-// Used in Debug.setScriptBreakPointById.
-var p = Debug.findScriptSourcePosition(script, 8, 0);
-var q = Debug.setBreakPointByScriptIdAndPosition(script.id, p).actual_position;
-
-function assertLocation(p, l, c) {
-  var location = %ScriptPositionInfo(script, p, false);
-  assertEquals(l, location.line);
-  assertEquals(c, location.column);
-}
-
-assertLocation(p, 8, 0);
-assertLocation(q, 8, 4);
diff --git a/deps/v8/test/debugger/debug/regress/regress-5164.js b/deps/v8/test/debugger/debug/regress/regress-5164.js
index 2ac9d7a6243050..1da789043eb206 100644
--- a/deps/v8/test/debugger/debug/regress/regress-5164.js
+++ b/deps/v8/test/debugger/debug/regress/regress-5164.js
@@ -27,17 +27,17 @@ var foo = gen(1, 2);
 
 foo.next()
 assertEquals(2, args.length);
-assertEquals(undefined, args[0]);
-assertEquals(undefined, args[1]);
+assertEquals(1, args[0]);
+assertEquals(2, args[1]);
 
 foo.next()
 assertEquals(2, args.length);
-assertEquals(undefined, args[0]);
-assertEquals(undefined, args[1]);
+assertEquals(1, args[0]);
+assertEquals(2, args[1]);
 
 foo.next()
 assertEquals(2, args.length);
-assertEquals(undefined, args[0]);
-assertEquals(undefined, args[1]);
+assertEquals(1, args[0]);
+assertEquals(2, args[1]);
 
 assertNull(failure);
diff --git a/deps/v8/test/debugger/debug/regress/regress-crbug-424142.js b/deps/v8/test/debugger/debug/regress/regress-crbug-424142.js
deleted file mode 100644
index bda061c79e0f9b..00000000000000
--- a/deps/v8/test/debugger/debug/regress/regress-crbug-424142.js
+++ /dev/null
@@ -1,38 +0,0 @@
-// Copyright 2014 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-
-(function outer() {
-  var C = (function C_() {
-    var y = 1;
-    function CC() {
-      this.x = 0;
-    }
-    CC.prototype.f = function CCf() {
-      this.x += y;
-      return this.x;
-    };
-    return CC;
-  })();
-
-  var c = new C(0);
-})
-
-function sentinel() {}
-
-Debug = debug.Debug;
-Debug.setListener(function(){});
-
-var script = Debug.findScript(sentinel);
-var line = 13;
-var line_start = Debug.findScriptSourcePosition(script, line, 0);
-var line_end = Debug.findScriptSourcePosition(script, line + 1, 0) - 1;
-var actual = Debug.setBreakPointByScriptIdAndPosition(
-                 script.id, line_start).actual_position;
-// Make sure the actual break position is within the line where we set
-// the break point.
-assertTrue(line_start <= actual);
-assertTrue(actual <= line_end);
-
-Debug.setListener(null);
diff --git a/deps/v8/test/debugger/debug/regress/regress-crbug-481896.js b/deps/v8/test/debugger/debug/regress/regress-crbug-481896.js
deleted file mode 100644
index 751b62a7b61bc9..00000000000000
--- a/deps/v8/test/debugger/debug/regress/regress-crbug-481896.js
+++ /dev/null
@@ -1,55 +0,0 @@
-// Copyright 2015 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-// Flags: --expose-gc
-gc();
-function static() {
-  print("> static");  // Break
-}
-
-var Debug = debug.Debug;
-var exception = null;
-var break_count = 0;
-
-function listener(event, exec_state, event_data, data) {
-  if (event != Debug.DebugEvent.Break) return;
-  try {
-    print("breakpoint hit at " + exec_state.frame(0).sourceLineText());
-    assertTrue(exec_state.frame(0).sourceLineText().indexOf("// Break") > 0);
-    break_count++;
-  } catch (e) {
-    exception = e;
-  }
-}
-
-Debug.setListener(listener);
-
-function install() {
-  eval("this.dynamic = function dynamic() { \n" +
-       "  print(\"> dynamic\");  // Break\n" +
-       "}\n" +
-       "//@ sourceURL=dynamicScript");
-}
-
-install();
-
-var scripts = Debug.scripts();
-var dynamic_script;
-var static_script;
-for (var script of scripts) {
-  if (script.source_url == "dynamicScript") dynamic_script = script;
-  if (script.source_url == "staticScript") static_script = script;
-}
-
-Debug.setScriptBreakPointById(dynamic_script.id, 1);
-Debug.setScriptBreakPointById(static_script.id, 6);
-
-dynamic();
-static();
-
-Debug.setListener(null);
-
-assertNull(exception);
-assertEquals(2, break_count);
-
-//@ sourceURL=staticScript
diff --git a/deps/v8/test/debugger/debug/regress/regress-crbug-517592.js b/deps/v8/test/debugger/debug/regress/regress-crbug-517592.js
deleted file mode 100644
index 57e96a2b4653ba..00000000000000
--- a/deps/v8/test/debugger/debug/regress/regress-crbug-517592.js
+++ /dev/null
@@ -1,34 +0,0 @@
-// Copyright 2015 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-var source =
-  "var foo = function foo() {\n" +
-  "  var a = 1;\n" +
-  "}\n" +
-  "//@ sourceURL=test";
-
-Debug = debug.Debug;
-Debug.setListener(listener);
-var exception = null;
-var break_count = 0;
-
-function listener(event, exec_state, event_data, data) {
-  if (event == Debug.DebugEvent.Break) break_count++;
-  if (event != Debug.DebugEvent.AfterCompile) return;
-  try {
-    var name = event_data.script().name();
-    var id = event_data.script().id();
-    assertEquals("test", name);
-    Debug.setScriptBreakPointById(id, 2);
-  } catch (e) {
-    exception = e;
-  }
-}
-
-eval(source);
-
-assertEquals(0, break_count);
-foo();
-assertEquals(1, break_count);
-assertNull(exception);
diff --git a/deps/v8/test/debugger/debug/side-effect/debug-evaluate-no-side-effect-builtins-2.js b/deps/v8/test/debugger/debug/side-effect/debug-evaluate-no-side-effect-builtins-2.js
index cde26a3bc36014..8f68822052abe3 100644
--- a/deps/v8/test/debugger/debug/side-effect/debug-evaluate-no-side-effect-builtins-2.js
+++ b/deps/v8/test/debugger/debug/side-effect/debug-evaluate-no-side-effect-builtins-2.js
@@ -12,6 +12,10 @@ var weak_key = [];
 var weak_map = new WeakMap().set(weak_key, "a").set({}, "b");
 var weak_set = new WeakSet([weak_key, {}]);
 var add = function (a, b) { return a + b; };
+var number_value = 13;
+function get_number() {
+  return typeof(number_value);
+};
 
 function listener(event, exec_state, event_data, data) {
   if (event != Debug.DebugEvent.Break) return;
@@ -67,6 +71,8 @@ function listener(event, exec_state, event_data, data) {
     success("abc", `unescape("abc")`);
     success(true, `isFinite(0)`);
     success(true, `isNaN(0/0)`);
+    success("object", `typeof date`);
+    success("number", `get_number()`);
 
     // Test Map functions.
     success(undefined, `new Map()`);
@@ -79,7 +85,7 @@ function listener(event, exec_state, event_data, data) {
     success(undefined, `map.forEach(()=>1)`);
     success(true, `map.has("c")`);
     success(2, `map.size`);
-    fail(`new Map([[1, 2]])`);
+    success(undefined, `new Map([[1, 2]])`);
     fail(`map.delete("a")`);
     fail(`map.clear()`);
     fail(`map.set("x", "y")`);
@@ -93,7 +99,7 @@ function listener(event, exec_state, event_data, data) {
     success(undefined, `set.forEach(()=>1)`);
     success(true, `set.has(1)`);
     success(2, `set.size`);
-    fail(`new Set([1])`);
+    success(1, `new Set([1]).size`);
     fail(`set.add(2)`);
     fail(`set.delete(1)`);
     fail(`set.clear()`);
diff --git a/deps/v8/test/debugger/debug/side-effect/debug-evaluate-no-side-effect-builtins.js b/deps/v8/test/debugger/debug/side-effect/debug-evaluate-no-side-effect-builtins.js
index cf07968aedca20..9a108be4a416d2 100644
--- a/deps/v8/test/debugger/debug/side-effect/debug-evaluate-no-side-effect-builtins.js
+++ b/deps/v8/test/debugger/debug/side-effect/debug-evaluate-no-side-effect-builtins.js
@@ -68,30 +68,27 @@ function listener(event, exec_state, event_data, data) {
     fail(`Array.from([1, 2, 3])`);
     fail(`Array.of(1, 2, 3)`);
     var function_param = [
-      "forEach", "every", "some", "reduce", "reduceRight", "find", "filter",
-      "map", "findIndex"
+      "flatMap", "forEach", "every", "some", "reduce", "reduceRight", "find",
+      "filter", "map", "findIndex"
     ];
     var fails = ["toString", "join", "toLocaleString", "pop", "push", "reverse",
-      "shift", "unshift", "splice", "sort", "copyWithin"];
+      "shift", "unshift", "splice", "sort", "copyWithin", "fill"];
     for (f of Object.getOwnPropertyNames(Array.prototype)) {
       if (typeof Array.prototype[f] === "function") {
         if (fails.includes(f)) {
           if (function_param.includes(f)) {
-            fail(`[1, 2, 3].${f}(()=>{});`);
+            fail(`array.${f}(()=>{});`);
           } else {
-            fail(`[1, 2, 3].${f}();`);
+            fail(`array.${f}();`);
           }
         } else if (function_param.includes(f)) {
-          exec_state.frame(0).evaluate(`[1, 2, 3].${f}(()=>{});`, true);
+          exec_state.frame(0).evaluate(`array.${f}(()=>{});`, true);
         } else {
-          exec_state.frame(0).evaluate(`[1, 2, 3].${f}();`, true);
+          exec_state.frame(0).evaluate(`array.${f}();`, true);
         }
       }
     }
 
-    success([1,1,1], '[1,2,3].fill(1)');
-    fail(`array.fill(1)`);
-
     // Test ArrayBuffer functions.
     success(3, `array_buffer.byteLength`);
     success(2, `array_buffer.slice(1, 3).byteLength`);
@@ -200,12 +197,11 @@ function listener(event, exec_state, event_data, data) {
     fail("'abcd'.match(/a/)");
     fail("'abcd'.replace(/a/)");
     fail("'abcd'.search(/a/)");
-    fail("'abcd'.split(/a/)");
 
     // Test RegExp functions.
     fail(`/a/.compile()`);
-    fail(`/a/.exec('abc')`);
-    fail(`/a/.test('abc')`);
+    success('a', `/a/.exec('abc')[0]`);
+    success(true, `/a/.test('abc')`);
     fail(`/a/.toString()`);
 
     // Test JSON functions.
diff --git a/deps/v8/test/debugger/debug/side-effect/debug-evaluate-no-side-effect-control.js b/deps/v8/test/debugger/debug/side-effect/debug-evaluate-no-side-effect-control.js
index e19a2775462903..06f41eb6cc0aba 100644
--- a/deps/v8/test/debugger/debug/side-effect/debug-evaluate-no-side-effect-control.js
+++ b/deps/v8/test/debugger/debug/side-effect/debug-evaluate-no-side-effect-control.js
@@ -64,14 +64,16 @@ var successes = [
       }
     })()`
   ],
+  [6,
+   `(function() {  // Iterator.prototype.next performs stores.
+      var sum = 0;
+      for (let i of [1, 2, 3]) sum += i;
+      return sum;
+    })()`
+  ]
 ];
 
 var fails = [
-  `(function() {  // Iterator.prototype.next performs stores.
-     var sum = 0;
-     for (let i of [1, 2, 3]) sum += i;
-     return sum;
-   })()`,
   `(function() {  // Store to scope object.
      with (o) {
        p = 2;
diff --git a/deps/v8/test/debugger/debug/side-effect/debug-evaluate-no-side-effect-ops.js b/deps/v8/test/debugger/debug/side-effect/debug-evaluate-no-side-effect-ops.js
index 6e91412cb48d4e..7f3675d6a57cbd 100644
--- a/deps/v8/test/debugger/debug/side-effect/debug-evaluate-no-side-effect-ops.js
+++ b/deps/v8/test/debugger/debug/side-effect/debug-evaluate-no-side-effect-ops.js
@@ -71,13 +71,13 @@ function listener(event, exec_state, event_data, data) {
     success(NaN, `string * two`);
     success("s2", `string + two`);
     success("s2", `string + two`);
-    fail(`[...array]`);
+    success([1,2,3], `[...array]`);
     success(3, `max(...array)`);
     success({s:1}, `({[string]:1})`);
     fail(`[a, b] = [1, 2]`);
     success(2, `def(2)`);
     success(1, `def()`);
-    fail(`d1(['a'])`);  // Iterator.prototype.next performs stores.
+    success('ab', `d1(['a'])`);
     success("XYz", `d2({x:'X', y:'Y'})`);
   } catch (e) {
     exception = e;
diff --git a/deps/v8/test/debugger/debug/side-effect/debug-evaluate-no-side-effect-regexp.js b/deps/v8/test/debugger/debug/side-effect/debug-evaluate-no-side-effect-regexp.js
new file mode 100644
index 00000000000000..1db5dbddc3cb40
--- /dev/null
+++ b/deps/v8/test/debugger/debug/side-effect/debug-evaluate-no-side-effect-regexp.js
@@ -0,0 +1,28 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+Debug = debug.Debug;
+
+/(\w)(\w)(\w)(\w)(\w)(\w)(\w)(\w)(\w)(\w)/.exec(">>>abcdefghij<<<");
+assertRegExp();
+Debug.evaluateGlobal(`/(\\w)(\\w)(\\w)(\\w)(\\w)(\\w)(\\w)(\\w)(\\w)(\\w)/.exec(">>>hklmnoprst<<<")`, true);
+assertRegExp();
+
+function assertRegExp() {
+  assertEquals("a", RegExp.$1);
+  assertEquals("b", RegExp.$2);
+  assertEquals("c", RegExp.$3);
+  assertEquals("d", RegExp.$4);
+  assertEquals("e", RegExp.$5);
+  assertEquals("f", RegExp.$6);
+  assertEquals("g", RegExp.$7);
+  assertEquals("h", RegExp.$8);
+  assertEquals("i", RegExp.$9);
+
+  assertEquals("abcdefghij", RegExp.lastMatch);
+  assertEquals("j", RegExp.lastParen);
+  assertEquals(">>>", RegExp.leftContext);
+  assertEquals("<<<", RegExp.rightContext);
+  assertEquals(">>>abcdefghij<<<", RegExp.input);
+}
diff --git a/deps/v8/test/debugger/debug/side-effect/debug-evaluate-no-side-effect-runtime-check.js b/deps/v8/test/debugger/debug/side-effect/debug-evaluate-no-side-effect-runtime-check.js
index 0a05af1acd3d51..7450cb220656fb 100644
--- a/deps/v8/test/debugger/debug/side-effect/debug-evaluate-no-side-effect-runtime-check.js
+++ b/deps/v8/test/debugger/debug/side-effect/debug-evaluate-no-side-effect-runtime-check.js
@@ -45,7 +45,7 @@ function return_array_use_spread(a) {
   return [...a];
 }
 
-fail(`return_array_use_spread([1])`);
+success([1], `return_array_use_spread([1])`);
 
 // CallAccessorSetter
 var array = [1,2,3];
@@ -60,6 +60,137 @@ function return_literal_with_data_property(a) {
 
 success({foo: 1}, `return_literal_with_data_property('foo')`);
 
+// Set builtins with temporary objects
+var set = new Set([1,2]);
+fail(`set.add(3).size`);
+success(1, `new Set().add(1).size`);
+
+success(0, `(() => { const s = new Set([1]); s.delete(1); return s.size; })()`);
+fail(`set.delete(1)`);
+
+success(0, `(() => { const s = new Set([1]); s.clear(); return s.size; })()`);
+fail(`set.clear()`);
+
+// new set
+success(3, `(() => {
+  let s = 0;
+  for (const a of new Set([1,2]))
+    s += a;
+  return s;
+})()`);
+// existing set
+success(3, `(() => {
+  let s = 0;
+  for (const a of set)
+    s += a;
+  return s;
+})()`);
+// existing iterator
+var setIterator = set.entries();
+fail(`(() => {
+  let s = 0;
+  for (const a of setIterator)
+    s += a;
+  return s;
+})()`);
+
+// Array builtins with temporary objects
+success([1,1,1], '[1,2,3].fill(1)');
+fail(`array.fill(1)`);
+
+success([1], `(() => { const a = []; a.push(1); return a; })()`);
+fail(`array.push(1)`);
+
+success([1], `(() => { const a = [1,2]; a.pop(); return a; })()`);
+fail(`array.pop()`);
+
+success([3,2,1], `[1,2,3].reverse()`);
+fail(`array.reverse()`);
+
+success([1,2,3], `[2,1,3].sort()`);
+fail(`array.sort()`);
+
+success([2,3], `[1,2,3].splice(1,2)`);
+fail(`array.splice(1,2)`);
+
+success([1,2], `(() => { const a = [2]; a.unshift(1); return a; })()`);
+fail(`array.unshift(1)`);
+success(1, `[1,2].shift()`);
+fail(`array.shift()`);
+
+// new array
+success(6, `(() => {
+  let s = 0;
+  for (const a of [1,2,3])
+    s += a;
+  return s;
+})()`);
+// existing array
+success(6, `(() => {
+  let s = 0;
+  for (const a of array)
+    s += a;
+  return s;
+})()`);
+// existing iterator
+var arrayIterator = array.entries();
+fail(`(() => {
+  let s = 0;
+  for (const a of arrayIterator)
+    s += a;
+  return s;
+})()`);
+
+success(6, `array.reduce((a,b) => a + b, 0)`);
+
+// Map builtins with temporary objects
+var map = new Map([[1,2]]);
+fail(`map.set(3, 4).size`);
+success(1, `new Map().set(1, 2).size`);
+
+success(0, `(() => {
+  const m = new Map([[1, 2]]);
+  m.delete(1);
+  return m.size;
+})()`);
+fail(`map.delete(1)`);
+
+success(0, `(() => {
+  const m = new Map([[1, 2]]);
+  m.clear();
+  return m.size;
+})()`);
+fail(`map.clear()`);
+
+// new set
+success(2, `(() => {
+  let s = 0;
+  for (const [a, b] of new Map([[1,2]]))
+    s += b;
+  return s;
+})()`);
+// existing set
+success(2, `(() => {
+  let s = 0;
+  for (const [a,b] of map)
+    s += b;
+  return s;
+})()`);
+// existing iterator
+var mapIterator = map.entries();
+fail(`(() => {
+  let s = 0;
+  for (const [a,b] of mapIterator)
+    s += a;
+  return s;
+})()`);
+
+// Regexps
+var regExp = /a/;
+success(true, `/a/.test('a')`);
+fail(`/a/.test({toString: () => {map.clear(); return 'a';}})`)
+fail(`regExp.test('a')`);
+
 function success(expectation, source) {
   const result = Debug.evaluateGlobal(source, true).value();
   if (expectation !== undefined) assertEquals(expectation, result);
diff --git a/deps/v8/test/debugger/debug/side-effect/debug-evaluate-no-side-effect.js b/deps/v8/test/debugger/debug/side-effect/debug-evaluate-no-side-effect.js
index d4895b604919bb..fa14b4b862e80a 100644
--- a/deps/v8/test/debugger/debug/side-effect/debug-evaluate-no-side-effect.js
+++ b/deps/v8/test/debugger/debug/side-effect/debug-evaluate-no-side-effect.js
@@ -93,6 +93,7 @@ function listener(event, exec_state, event_data, data) {
     fail("eval('Math.sin(1)')");
     fail("eval('exception = 1')");
     fail("global_eval('1')");
+    success(1, "(() => { var a = 1; return a++; })()")
   } catch (e) {
     exception = e;
     print(e, e.stack);
diff --git a/deps/v8/test/debugger/debugger.status b/deps/v8/test/debugger/debugger.status
index ccbb4f68d04cce..ab4ed473668e79 100644
--- a/deps/v8/test/debugger/debugger.status
+++ b/deps/v8/test/debugger/debugger.status
@@ -41,9 +41,6 @@
 
   # Very slow in stress mode.
   'regress/regress-2318': [SKIP],
-
-  # https://crbug.com/v8/7626
-  'debug/debug-stepout-scope-part*': [PASS, ['tsan', SKIP]],
 }],  # variant == stress
 
 ##############################################################################
@@ -75,9 +72,9 @@
 }],  # 'gc_stress == True'
 
 ##############################################################################
-['variant == wasm_traps', {
+['variant == no_wasm_traps', {
   '*': [SKIP],
-}],  # variant == wasm_traps
+}],  # variant == no_wasm_traps
 
 ##############################################################################
 ['arch == arm and not simulator_run', {
@@ -85,13 +82,25 @@
   'debug/ignition/debug-step-prefix-bytecodes': [SKIP],
 }],  # 'arch == arm and not simulator_run'
 
+##############################################################################
+['arch == arm and mode == debug', {
+  # Tests taking too long
+  'debug/debug-stepout-scope-part1': [SKIP],
+  'debug/debug-stepout-scope-part2': [SKIP],
+  'debug/debug-stepout-scope-part3': [SKIP],
+  'debug/debug-stepout-scope-part4': [SKIP],
+  'debug/debug-stepout-scope-part5': [SKIP],
+  'debug/debug-stepout-scope-part6': [SKIP],
+  'debug/debug-stepout-scope-part7': [SKIP],
+  'debug/debug-stepout-scope-part8': [SKIP],
+}],  # 'arch == arm and mode == debug'
+
 ##############################################################################
 ['arch == s390 or arch == s390x', {
 
   # Stack manipulations in LiveEdit is not implemented for this arch.
   'debug/debug-liveedit-check-stack': [SKIP],
   'debug/debug-liveedit-double-call': [SKIP],
-  'debug/debug-liveedit-stack-padding': [SKIP],
   'debug/debug-liveedit-restart-frame': [SKIP],
 }],  # 'arch == s390 or arch == s390x'
 
diff --git a/deps/v8/test/debugger/regress/regress-crbug-840288.js b/deps/v8/test/debugger/regress/regress-crbug-840288.js
new file mode 100644
index 00000000000000..013fec9f05a2dd
--- /dev/null
+++ b/deps/v8/test/debugger/regress/regress-crbug-840288.js
@@ -0,0 +1,25 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+load("test/mjsunit/wasm/wasm-constants.js");
+load("test/mjsunit/wasm/wasm-module-builder.js");
+
+Debug = debug.Debug
+
+function listener(event, exec_state, event_data, data) {
+  if (event == Debug.DebugEvent.AfterCompile) {
+    // The actual source doesn't matter, just don't crash.
+    assertEquals("func $main\nend\n", event_data.script().source());
+  }
+};
+
+// Add the debug event listener.
+Debug.setListener(listener);
+
+var builder = new WasmModuleBuilder();
+builder.addFunction('main', kSig_v_v).addBody([]).exportFunc();
+var promise = WebAssembly.compile(builder.toBuffer());
+
+// Clear the debug listener only after the event fired.
+promise.then(() => Debug.setListener(null), assertUnreachable);
diff --git a/deps/v8/test/debugger/test-api.js b/deps/v8/test/debugger/test-api.js
index 400052c79efc20..10aa3c1b831f24 100644
--- a/deps/v8/test/debugger/test-api.js
+++ b/deps/v8/test/debugger/test-api.js
@@ -41,14 +41,6 @@ class DebugWrapper {
                         StepIn: 2,
                       };
 
-    // The different types of scripts matching enum ScriptType in objects.h.
-    this.ScriptType = { Native: 0,
-                        Extension: 1,
-                        Normal: 2,
-                        Wasm: 3,
-                        Inspector: 4,
-                      };
-
     // A copy of the scope types from runtime-debug.cc.
     // NOTE: these constants should be backward-compatible, so
     // add new ones to the end of this list.
@@ -134,16 +126,6 @@ class DebugWrapper {
     return this.setBreakPointAtLocation(scriptid, loc, opt_condition);
   }
 
-  setScriptBreakPointById(scriptid, opt_line, opt_column, opt_condition) {
-    const loc = %ScriptLocationFromLine2(scriptid, opt_line, opt_column, 0);
-    return this.setBreakPointAtLocation(scriptid, loc, opt_condition);
-  }
-
-  setBreakPointByScriptIdAndPosition(scriptid, position) {
-    const loc = %ScriptPositionInfo2(scriptid, position, false);
-    return this.setBreakPointAtLocation(scriptid, loc, undefined);
-  }
-
   clearBreakPoint(breakpoint) {
     assertTrue(this.breakpoints.has(breakpoint));
     const breakid = breakpoint.id;
@@ -195,71 +177,12 @@ class DebugWrapper {
            };
   }
 
-  scripts() {
-    // Collect all scripts in the heap.
-    return %DebugGetLoadedScripts();
-  }
-
-  // Returns a Script object. If the parameter is a function the return value
-  // is the script in which the function is defined. If the parameter is a
-  // string the return value is the script for which the script name has that
-  // string value.  If it is a regexp and there is a unique script whose name
-  // matches we return that, otherwise undefined.
-  findScript(func_or_script_name) {
-    if (%IsFunction(func_or_script_name)) {
-      return %FunctionGetScript(func_or_script_name);
-    } else if (%IsRegExp(func_or_script_name)) {
-      var scripts = this.scripts();
-      var last_result = null;
-      var result_count = 0;
-      for (var i in scripts) {
-        var script = scripts[i];
-        if (func_or_script_name.test(script.name)) {
-          last_result = script;
-          result_count++;
-        }
-      }
-      // Return the unique script matching the regexp.  If there are more
-      // than one we don't return a value since there is no good way to
-      // decide which one to return.  Returning a "random" one, say the
-      // first, would introduce nondeterminism (or something close to it)
-      // because the order is the heap iteration order.
-      if (result_count == 1) {
-        return last_result;
-      } else {
-        return undefined;
-      }
-    } else {
-      return %GetScript(func_or_script_name);
-    }
-  }
-
-  // Returns the script source. If the parameter is a function the return value
-  // is the script source for the script in which the function is defined. If the
-  // parameter is a string the return value is the script for which the script
-  // name has that string value.
-  scriptSource(func_or_script_name) {
-    return this.findScript(func_or_script_name).source;
+  // Returns the script source. The return value is the script source for the
+  // script in which the function is defined.
+  scriptSource(func) {
+    return %FunctionGetScriptSource(func);
   };
 
-  sourcePosition(f) {
-    if (!%IsFunction(f)) throw new Error("Not passed a Function");
-    return %FunctionGetScriptSourcePosition(f);
-  };
-
-  // Returns the character position in a script based on a line number and an
-  // optional position within that line.
-  findScriptSourcePosition(script, opt_line, opt_column) {
-    var location = %ScriptLocationFromLine(script, opt_line, opt_column, 0);
-    return location ? location.position : null;
-  };
-
-  findFunctionSourceLocation(func, opt_line, opt_column) {
-    var script = %FunctionGetScript(func);
-    var script_offset = %FunctionGetScriptSourcePosition(func);
-    return %ScriptLocationFromLine(script, opt_line, opt_column, script_offset);
-  }
-
   setBreakPointsActive(enabled) {
     const {msgid, msg} = this.createMessage(
         "Debugger.setBreakpointsActive", { active : enabled });
@@ -284,8 +207,8 @@ class DebugWrapper {
     }
 
     function setScopeVariableValue(name, value) {
-      const res = %SetScopeVariableValue(gen, null, null, index, name, value);
-      if (!res) throw new Error("Failed to set variable value");
+      const res = %SetGeneratorScopeVariableValue(gen, index, name, value);
+      if (!res) throw new Error("Failed to set variable '" + name + "' value");
     }
 
     const scopeObject =
@@ -311,11 +234,6 @@ class DebugWrapper {
     return scopes;
   }
 
-  get LiveEdit() {
-    const debugContext = %GetDebugContext();
-    return debugContext.Debug.LiveEdit;
-  }
-
   // --- Internal methods. -----------------------------------------------------
 
   getNextMessageId() {
@@ -380,13 +298,7 @@ class DebugWrapper {
     const breakid = result.breakpointId;
     assertTrue(breakid !== undefined);
 
-    const actualLoc = %ScriptLocationFromLine2(scriptid,
-        result.actualLocation.lineNumber, result.actualLocation.columnNumber,
-        0);
-
-    const breakpoint = { id : result.breakpointId,
-                         actual_position : actualLoc.position,
-                       }
+    const breakpoint = { id : result.breakpointId }
 
     this.breakpoints.add(breakpoint);
     return breakpoint;
@@ -450,27 +362,6 @@ class DebugWrapper {
            };
   }
 
-  execStateScopeDetails(scope) {
-    var start_position;
-    var end_position
-    const start = scope.startLocation;
-    const end = scope.endLocation;
-    if (start) {
-      start_position = %ScriptLocationFromLine2(
-          parseInt(start.scriptId), start.lineNumber, start.columnNumber, 0)
-          .position;
-    }
-    if (end) {
-      end_position = %ScriptLocationFromLine2(
-          parseInt(end.scriptId), end.lineNumber, end.columnNumber, 0)
-          .position;
-    }
-    return { name : () => scope.name,
-             startPosition : () => start_position,
-             endPosition : () => end_position
-           };
-  }
-
   setVariableValue(frame, scope_index, name, value) {
     const frameid = frame.callFrameId;
     const {msgid, msg} = this.createMessage(
@@ -483,7 +374,7 @@ class DebugWrapper {
     this.sendMessage(msg);
     const reply = this.takeReplyChecked(msgid);
     if (reply.error) {
-      throw new Error("Failed to set variable value");
+      throw new Error("Failed to set variable '" + name + "' value");
     }
   }
 
@@ -496,7 +387,6 @@ class DebugWrapper {
              setVariableValue :
                 (name, value) => this.setVariableValue(frame, scope_index,
                                                        name, value),
-             details : () => this.execStateScopeDetails(scope)
            };
   }
 
diff --git a/deps/v8/test/fuzzer/multi-return.cc b/deps/v8/test/fuzzer/multi-return.cc
index eb5a3ad2e26744..c6636c6eaf03eb 100644
--- a/deps/v8/test/fuzzer/multi-return.cc
+++ b/deps/v8/test/fuzzer/multi-return.cc
@@ -67,7 +67,8 @@ class InputProvider {
 
   int NextInt32(int limit) {
     if (current_ + sizeof(uint32_t) > end_) return 0;
-    int result = ReadLittleEndianValue<int>(current_);
+    int result =
+        ReadLittleEndianValue<int>(reinterpret_cast<Address>(current_));
     current_ += sizeof(uint32_t);
     return result % limit;
   }
@@ -134,14 +135,14 @@ CallDescriptor* CreateRandomCallDescriptor(Zone* zone, size_t return_count,
   wasm::FunctionSig::Builder builder(zone, return_count, param_count);
   for (size_t i = 0; i < param_count; i++) {
     MachineType type = RandomType(input);
-    builder.AddParam(type.representation());
+    builder.AddParam(wasm::ValueTypes::ValueTypeFor(type));
   }
   // Read the end byte of the parameters.
   input->NextInt8(1);
 
   for (size_t i = 0; i < return_count; i++) {
     MachineType type = RandomType(input);
-    builder.AddReturn(type.representation());
+    builder.AddReturn(wasm::ValueTypes::ValueTypeFor(type));
   }
 
   return compiler::GetWasmCallDescriptor(zone, builder.Build());
@@ -149,13 +150,17 @@ CallDescriptor* CreateRandomCallDescriptor(Zone* zone, size_t return_count,
 
 std::unique_ptr<wasm::NativeModule> AllocateNativeModule(i::Isolate* isolate,
                                                          size_t code_size) {
+  std::shared_ptr<wasm::WasmModule> module(new wasm::WasmModule);
+  module->num_declared_functions = 1;
+  wasm::ModuleEnv env(
+      module.get(), wasm::UseTrapHandler::kNoTrapHandler,
+      wasm::RuntimeExceptionSupport::kNoRuntimeExceptionSupport);
+
   // We have to add the code object to a NativeModule, because the
   // WasmCallDescriptor assumes that code is on the native heap and not
   // within a code object.
-  std::unique_ptr<wasm::NativeModule> module =
-      isolate->wasm_engine()->code_manager()->NewNativeModule(code_size, 1, 0,
-                                                              false);
-  return module;
+  return isolate->wasm_engine()->code_manager()->NewNativeModule(
+      isolate, code_size, false, std::move(module), env);
 }
 
 extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
@@ -249,9 +254,12 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
   }
   callee.Return(static_cast<int>(desc->ReturnCount()), returns.get());
 
-  OptimizedCompilationInfo info(ArrayVector("testing"), &zone, Code::STUB);
+  OptimizedCompilationInfo info(ArrayVector("testing"), &zone,
+                                Code::WASM_FUNCTION);
   Handle<Code> code = Pipeline::GenerateCodeForTesting(
-      &info, i_isolate, desc, callee.graph(), callee.Export());
+                          &info, i_isolate, desc, callee.graph(),
+                          AssemblerOptions::Default(i_isolate), callee.Export())
+                          .ToHandleChecked();
 
   std::unique_ptr<wasm::NativeModule> module =
       AllocateNativeModule(i_isolate, code->raw_instruction_size());
@@ -294,8 +302,11 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
   // Call the wrapper.
   OptimizedCompilationInfo wrapper_info(ArrayVector("wrapper"), &zone,
                                         Code::STUB);
-  Handle<Code> wrapper_code = Pipeline::GenerateCodeForTesting(
-      &wrapper_info, i_isolate, wrapper_desc, caller.graph(), caller.Export());
+  Handle<Code> wrapper_code =
+      Pipeline::GenerateCodeForTesting(
+          &wrapper_info, i_isolate, wrapper_desc, caller.graph(),
+          AssemblerOptions::Default(i_isolate), caller.Export())
+          .ToHandleChecked();
   auto fn = GeneratedCode<int32_t>::FromCode(*wrapper_code);
   int result = fn.Call();
 
diff --git a/deps/v8/test/fuzzer/parser.cc b/deps/v8/test/fuzzer/parser.cc
index 9321207c23fdaa..6f18889b2896e8 100644
--- a/deps/v8/test/fuzzer/parser.cc
+++ b/deps/v8/test/fuzzer/parser.cc
@@ -79,7 +79,7 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
 
   v8::internal::Handle<v8::internal::Script> script =
       factory->NewScript(source.ToHandleChecked());
-  v8::internal::ParseInfo info(script);
+  v8::internal::ParseInfo info(i_isolate, script);
   if (!v8::internal::parsing::ParseProgram(&info, i_isolate)) {
     i_isolate->OptionalRescheduleException(true);
   }
diff --git a/deps/v8/test/fuzzer/regexp.cc b/deps/v8/test/fuzzer/regexp.cc
index 5f429fd3da3166..5c6219631d07cb 100644
--- a/deps/v8/test/fuzzer/regexp.cc
+++ b/deps/v8/test/fuzzer/regexp.cc
@@ -18,8 +18,9 @@ void Test(v8::Isolate* isolate, i::Handle<i::JSRegExp> regexp,
           i::Handle<i::String> subject,
           i::Handle<i::RegExpMatchInfo> results_array) {
   v8::TryCatch try_catch(isolate);
-  if (i::RegExpImpl::Exec(regexp, subject, 0, results_array).is_null()) {
-    i::Isolate* i_isolate = reinterpret_cast<i::Isolate*>(isolate);
+  i::Isolate* i_isolate = reinterpret_cast<i::Isolate*>(isolate);
+  if (i::RegExpImpl::Exec(i_isolate, regexp, subject, 0, results_array)
+          .is_null()) {
     i_isolate->OptionalRescheduleException(true);
   }
 }
diff --git a/deps/v8/test/fuzzer/wasm-async.cc b/deps/v8/test/fuzzer/wasm-async.cc
index dece2cf0dd1ab2..5ceb8d8bf8b7ac 100644
--- a/deps/v8/test/fuzzer/wasm-async.cc
+++ b/deps/v8/test/fuzzer/wasm-async.cc
@@ -25,42 +25,24 @@ class WasmModuleObject;
 namespace wasm {
 namespace fuzzer {
 
-#define ASSIGN(type, var, expr)                      \
-  v8::Local<type> var;                               \
-  do {                                               \
-    if (!expr.ToLocal(&var)) {                       \
-      DCHECK(i_isolate->has_scheduled_exception());  \
-      return 0;                                      \
-    } else {                                         \
-      DCHECK(!i_isolate->has_scheduled_exception()); \
-    }                                                \
-  } while (false)
-
-namespace {
-// We need this helper function because we cannot use
-// Handle<WasmModuleObject>::cast here. To use this function we would have to
-// mark it with V8_EXPORT_PRIVATE, which is quite ugly in this case.
-Handle<WasmModuleObject> ToWasmModuleObjectUnchecked(Handle<Object> that) {
-  return handle(reinterpret_cast<WasmModuleObject*>(*that));
-}
-}
-
-void InstantiateCallback(const FunctionCallbackInfo<Value>& args) {
-  DCHECK_GE(args.Length(), 1);
-  v8::Isolate* isolate = args.GetIsolate();
-  MicrotasksScope does_not_run_microtasks(
-      isolate, v8::MicrotasksScope::kDoNotRunMicrotasks);
-
-  v8::HandleScope scope(isolate);
-
-  Local<v8::Value> module = args[0];
+class AsyncFuzzerResolver : public i::wasm::CompilationResultResolver {
+ public:
+  AsyncFuzzerResolver(i::Isolate* isolate, bool* done)
+      : isolate_(isolate), done_(done) {}
+
+  void OnCompilationSucceeded(i::Handle<i::WasmModuleObject> module) override {
+    *done_ = true;
+    InterpretAndExecuteModule(isolate_, module);
+  }
 
-  i::Isolate* i_isolate = reinterpret_cast<i::Isolate*>(isolate);
+  void OnCompilationFailed(i::Handle<i::Object> error_reason) override {
+    *done_ = true;
+  }
 
-  Handle<WasmModuleObject> module_obj =
-      ToWasmModuleObjectUnchecked(Utils::OpenHandle(v8::Object::Cast(*module)));
-  InterpretAndExecuteModule(i_isolate, module_obj);
-}
+ private:
+  i::Isolate* isolate_;
+  bool* done_;
+};
 
 extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
   FlagScope<bool> turn_on_async_compile(
@@ -85,32 +67,19 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
   TryCatch try_catch(isolate);
   testing::SetupIsolateForWasmModule(i_isolate);
 
-  // Get the promise for async compilation.
-  ASSIGN(Promise::Resolver, resolver,
-         Promise::Resolver::New(support->GetContext()));
-  Local<Promise> promise = resolver->GetPromise();
-
-  i_isolate->wasm_engine()->AsyncCompile(i_isolate, Utils::OpenHandle(*promise),
-                                         ModuleWireBytes(data, data + size),
-                                         false);
-
-  ASSIGN(Function, instantiate_impl,
-         Function::New(support->GetContext(), &InstantiateCallback,
-                       Undefined(isolate)));
-
-  ASSIGN(Promise, result,
-         promise->Then(support->GetContext(), instantiate_impl));
+  bool done = false;
+  i_isolate->wasm_engine()->AsyncCompile(
+      i_isolate, base::make_unique<AsyncFuzzerResolver>(i_isolate, &done),
+      ModuleWireBytes(data, data + size), false);
 
   // Wait for the promise to resolve.
-  while (result->State() == Promise::kPending) {
+  while (!done) {
     support->PumpMessageLoop(platform::MessageLoopBehavior::kWaitForWork);
     isolate->RunMicrotasks();
   }
   return 0;
 }
 
-#undef ASSIGN
-
 }  // namespace fuzzer
 }  // namespace wasm
 }  // namespace internal
diff --git a/deps/v8/test/fuzzer/wasm-compile.cc b/deps/v8/test/fuzzer/wasm-compile.cc
index f4b2a912c629a6..c255c693230f7b 100644
--- a/deps/v8/test/fuzzer/wasm-compile.cc
+++ b/deps/v8/test/fuzzer/wasm-compile.cc
@@ -112,7 +112,7 @@ class WasmGenerator {
         : gen_(gen) {
       gen->blocks_.push_back(br_type);
       gen->builder_->EmitWithU8(block_type,
-                                WasmOpcodes::ValueTypeCodeFor(result_type));
+                                ValueTypes::ValueTypeCodeFor(result_type));
     }
 
     ~BlockScope() {
diff --git a/deps/v8/test/fuzzer/wasm-fuzzer-common.cc b/deps/v8/test/fuzzer/wasm-fuzzer-common.cc
index b2e0b4bd2bf512..9285757863dd73 100644
--- a/deps/v8/test/fuzzer/wasm-fuzzer-common.cc
+++ b/deps/v8/test/fuzzer/wasm-fuzzer-common.cc
@@ -10,6 +10,7 @@
 #include "src/wasm/wasm-engine.h"
 #include "src/wasm/wasm-module-builder.h"
 #include "src/wasm/wasm-module.h"
+#include "src/wasm/wasm-objects.h"
 #include "src/zone/accounting-allocator.h"
 #include "src/zone/zone.h"
 #include "test/common/wasm/flag-utils.h"
@@ -58,14 +59,18 @@ int FuzzWasmSection(SectionCode section, const uint8_t* data, size_t size) {
 
   ErrorThrower thrower(i_isolate, "decoder");
 
-  std::unique_ptr<const WasmModule> module(testing::DecodeWasmModuleForTesting(
-      i_isolate, &thrower, buffer.begin(), buffer.end(), kWasmOrigin));
+  testing::DecodeWasmModuleForTesting(i_isolate, &thrower, buffer.begin(),
+                                      buffer.end(), kWasmOrigin);
 
   return 0;
 }
 
 void InterpretAndExecuteModule(i::Isolate* isolate,
                                Handle<WasmModuleObject> module_object) {
+  // We do not instantiate the module if there is a start function, because a
+  // start function can contain an infinite loop which we cannot handle.
+  if (module_object->module()->start_function_index >= 0) return;
+
   ErrorThrower thrower(isolate, "WebAssembly Instantiation");
   MaybeHandle<WasmInstanceObject> maybe_instance;
   Handle<WasmInstanceObject> instance;
@@ -143,6 +148,7 @@ struct PrintName {
 std::ostream& operator<<(std::ostream& os, const PrintName& name) {
   return os.write(name.name.start(), name.name.size());
 }
+}  // namespace
 
 void GenerateTestCase(Isolate* isolate, ModuleWireBytes wire_bytes,
                       bool compiles) {
@@ -154,7 +160,7 @@ void GenerateTestCase(Isolate* isolate, ModuleWireBytes wire_bytes,
   WasmModule* module = module_res.val.get();
   CHECK_NOT_NULL(module);
 
-  OFStream os(stdout);
+  StdoutStream os;
 
   os << "// Copyright 2018 the V8 project authors. All rights reserved.\n"
         "// Use of this source code is governed by a BSD-style license that "
@@ -170,10 +176,15 @@ void GenerateTestCase(Isolate* isolate, ModuleWireBytes wire_bytes,
   if (module->has_memory) {
     os << "  builder.addMemory(" << module->initial_pages;
     if (module->has_maximum_pages) {
-      os << ", " << module->maximum_pages << ");\n";
+      os << ", " << module->maximum_pages;
     } else {
-      os << ");\n";
+      os << ", undefined";
+    }
+    os << ", " << (module->mem_export ? "true" : "false");
+    if (FLAG_experimental_wasm_threads && module->has_shared_memory) {
+      os << ", shared";
     }
+    os << ");\n";
   }
 
   for (WasmGlobal& glob : module->globals) {
@@ -205,7 +216,7 @@ void GenerateTestCase(Isolate* isolate, ModuleWireBytes wire_bytes,
         ValueType type = decls.type_list[pos];
         while (pos + count < locals && decls.type_list[pos + count] == type)
           ++count;
-        os << ".addLocals({" << WasmOpcodes::TypeName(type)
+        os << ".addLocals({" << ValueTypes::TypeName(type)
            << "_count: " << count << "})";
       }
       os << "\n";
@@ -235,7 +246,6 @@ void GenerateTestCase(Isolate* isolate, ModuleWireBytes wire_bytes,
   }
   os << "})();\n";
 }
-}  // namespace
 
 int WasmExecutionFuzzer::FuzzWasmModule(const uint8_t* data, size_t size,
                                         bool require_valid) {
@@ -336,7 +346,11 @@ int WasmExecutionFuzzer::FuzzWasmModule(const uint8_t* data, size_t size,
   // result_turbofan. Therefore we do not check the equality of the results
   // if the execution may have produced a NaN at some point.
   if (!possible_nondeterminism) {
-    CHECK_EQ(expect_exception, i_isolate->has_pending_exception());
+    if (expect_exception != i_isolate->has_pending_exception()) {
+      const char* exception_text[] = {"no exception", "exception"};
+      FATAL("interpreter: %s; turbofan: %s", exception_text[expect_exception],
+            exception_text[i_isolate->has_pending_exception()]);
+    }
 
     if (!expect_exception) CHECK_EQ(result_interpreter, result_turbofan);
   }
@@ -347,6 +361,7 @@ int WasmExecutionFuzzer::FuzzWasmModule(const uint8_t* data, size_t size,
   int32_t result_liftoff;
   {
     FlagScope<bool> liftoff(&FLAG_liftoff, true);
+    FlagScope<bool> no_tier_up(&FLAG_wasm_tier_up, false);
     ErrorThrower compiler_thrower(i_isolate, "Liftoff");
     // Re-compile with Liftoff.
     MaybeHandle<WasmInstanceObject> compiled_instance =
@@ -358,7 +373,11 @@ int WasmExecutionFuzzer::FuzzWasmModule(const uint8_t* data, size_t size,
         "main", num_args, compiler_args.get());
   }
   if (!possible_nondeterminism) {
-    CHECK_EQ(expect_exception, i_isolate->has_pending_exception());
+    if (expect_exception != i_isolate->has_pending_exception()) {
+      const char* exception_text[] = {"no exception", "exception"};
+      FATAL("interpreter: %s; liftoff: %s", exception_text[expect_exception],
+            exception_text[i_isolate->has_pending_exception()]);
+    }
 
     if (!expect_exception) CHECK_EQ(result_interpreter, result_liftoff);
   }
diff --git a/deps/v8/test/fuzzer/wasm-fuzzer-common.h b/deps/v8/test/fuzzer/wasm-fuzzer-common.h
index ac40a5eed57c3c..8971d66e764bed 100644
--- a/deps/v8/test/fuzzer/wasm-fuzzer-common.h
+++ b/deps/v8/test/fuzzer/wasm-fuzzer-common.h
@@ -26,6 +26,9 @@ int FuzzWasmSection(SectionCode section, const uint8_t* data, size_t size);
 void InterpretAndExecuteModule(Isolate* isolate,
                                Handle<WasmModuleObject> module_object);
 
+void GenerateTestCase(Isolate* isolate, ModuleWireBytes wire_bytes,
+                      bool compiles);
+
 class WasmExecutionFuzzer {
  public:
   virtual ~WasmExecutionFuzzer() {}
diff --git a/deps/v8/test/fuzzer/wasm.cc b/deps/v8/test/fuzzer/wasm.cc
index 8bc9dbc971108b..75a6dd98651c8d 100644
--- a/deps/v8/test/fuzzer/wasm.cc
+++ b/deps/v8/test/fuzzer/wasm.cc
@@ -37,14 +37,20 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
   v8::Context::Scope context_scope(support->GetContext());
   v8::TryCatch try_catch(isolate);
   i::wasm::testing::SetupIsolateForWasmModule(i_isolate);
+  i::wasm::ModuleWireBytes wire_bytes(data, data + size);
 
   i::HandleScope scope(i_isolate);
   i::wasm::ErrorThrower thrower(i_isolate, "wasm fuzzer");
-  i::MaybeHandle<i::WasmModuleObject> maybe_object =
-      i_isolate->wasm_engine()->SyncCompile(
-          i_isolate, &thrower, i::wasm::ModuleWireBytes(data, data + size));
   i::Handle<i::WasmModuleObject> module_object;
-  if (maybe_object.ToHandle(&module_object)) {
+  bool compiles = i_isolate->wasm_engine()
+                      ->SyncCompile(i_isolate, &thrower, wire_bytes)
+                      .ToHandle(&module_object);
+
+  if (i::FLAG_wasm_fuzzer_gen_test) {
+    i::wasm::fuzzer::GenerateTestCase(i_isolate, wire_bytes, compiles);
+  }
+
+  if (compiles) {
     i::wasm::fuzzer::InterpretAndExecuteModule(i_isolate, module_object);
   }
   return 0;
diff --git a/deps/v8/test/inspector/BUILD.gn b/deps/v8/test/inspector/BUILD.gn
index 0999e19b89c44f..fc3d51506f388e 100644
--- a/deps/v8/test/inspector/BUILD.gn
+++ b/deps/v8/test/inspector/BUILD.gn
@@ -24,7 +24,6 @@ v8_executable("inspector-test") {
     "../..:v8",
     "../..:v8_libbase",
     "../..:v8_libplatform",
-    "//build/config:exe_and_shlib_deps",
     "//build/win:default_exe_manifest",
   ]
 
diff --git a/deps/v8/test/inspector/PRESUBMIT.py b/deps/v8/test/inspector/PRESUBMIT.py
new file mode 100644
index 00000000000000..9d6c2365eaede2
--- /dev/null
+++ b/deps/v8/test/inspector/PRESUBMIT.py
@@ -0,0 +1,25 @@
+#!/usr/bin/env python
+#
+# Copyright 2018 the V8 project authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+"""
+See http://dev.chromium.org/developers/how-tos/depottools/presubmit-scripts
+for more details about the presubmit API built into gcl.
+"""
+
+
+def PostUploadHook(cl, change, output_api):
+  """git cl upload will call this hook after the issue is created/modified.
+
+  This hook adds extra try bots to the CL description in order to run layout
+  tests in addition to CQ try bots.
+  """
+  return output_api.EnsureCQIncludeTrybotsAreAdded(
+    cl,
+    [
+      'master.tryserver.blink:linux_trusty_blink_rel',
+      'luci.chromium.try:linux_chromium_headless_rel',
+    ],
+    'Automatically added layout test trybots to run tests on CQ.')
diff --git a/deps/v8/test/inspector/debugger/async-for-await-of-promise-stack-expected.txt b/deps/v8/test/inspector/debugger/async-for-await-of-promise-stack-expected.txt
index 0cfa3c4349a6c3..0f8ff54b28e8a0 100644
--- a/deps/v8/test/inspector/debugger/async-for-await-of-promise-stack-expected.txt
+++ b/deps/v8/test/inspector/debugger/async-for-await-of-promise-stack-expected.txt
@@ -1,58 +1,58 @@
 Checks that async chains for for-await-of are correct.
 
 Running test: testBasic
-Debugger (test.js:12:2)
-Basic (test.js:50:4)
+Debugger (test.js:10:2)
+Basic (test.js:48:4)
 -- async function --
-Basic (test.js:48:20)
+Basic (test.js:47:19)
 (anonymous) (testBasic.js:0:0)
 
 
 Running test: testUncaughtReject
-Debugger (test.js:12:2)
--- async function --
-UncaughtReject (test.js:54:29)
+Debugger (test.js:10:2)
+-- Promise.catch --
+UncaughtReject (test.js:58:21)
 (anonymous) (testUncaughtReject.js:0:0)
 
 
 Running test: testUncaughtThrow
-Debugger (test.js:12:2)
--- async function --
-UncaughtThrow (test.js:63:28)
+Debugger (test.js:10:2)
+-- Promise.catch --
+UncaughtThrow (test.js:67:21)
 (anonymous) (testUncaughtThrow.js:0:0)
 
 
 Running test: testCaughtReject
-Debugger (test.js:12:2)
-CaughtReject (test.js:78:4)
+Debugger (test.js:10:2)
+CaughtReject (test.js:76:4)
 -- async function --
-CaughtReject (test.js:72:27)
+CaughtReject (test.js:72:21)
 (anonymous) (testCaughtReject.js:0:0)
 
 
 Running test: testCaughtThrow
-Debugger (test.js:12:2)
-CaughtThrow (test.js:88:4)
+Debugger (test.js:10:2)
+CaughtThrow (test.js:86:4)
 -- async function --
-CaughtThrow (test.js:82:26)
+CaughtThrow (test.js:82:21)
 (anonymous) (testCaughtThrow.js:0:0)
 
 
 Running test: testUncaughtRejectOnBreak
 
 Running test: testUncaughtThrowOnBreak
-Debugger (test.js:12:2)
--- async function --
-UncaughtThrowOnBreak (test.js:101:35)
+Debugger (test.js:10:2)
+-- Promise.catch --
+UncaughtThrowOnBreak (test.js:105:21)
 (anonymous) (testUncaughtThrowOnBreak.js:0:0)
 
 
 Running test: testCaughtRejectOnBreak
 
 Running test: testCaughtThrowOnBreak
-Debugger (test.js:12:2)
-CaughtThrowOnBreak (test.js:126:4)
+Debugger (test.js:10:2)
+CaughtThrowOnBreak (test.js:124:4)
 -- async function --
-CaughtThrowOnBreak (test.js:120:33)
+CaughtThrowOnBreak (test.js:120:21)
 (anonymous) (testCaughtThrowOnBreak.js:0:0)
 
diff --git a/deps/v8/test/inspector/debugger/async-for-await-of-promise-stack.js b/deps/v8/test/inspector/debugger/async-for-await-of-promise-stack.js
index c9df677cbd0831..e45698df70f850 100644
--- a/deps/v8/test/inspector/debugger/async-for-await-of-promise-stack.js
+++ b/deps/v8/test/inspector/debugger/async-for-await-of-promise-stack.js
@@ -4,7 +4,7 @@
 
 let {session, contextGroup, Protocol} = InspectorTest.start('Checks that async chains for for-await-of are correct.');
 
-contextGroup.addScript(`
+contextGroup.addInlineScript(`
 
 function Debugger(value) {
   debugger;
@@ -48,7 +48,7 @@ async function Basic() {
     Debugger();
   }
 }
-// TODO(kozyatinskiy): this stack trace is suspicious.
+
 async function UncaughtReject() {
   async function loop() {
     for await (let x of [Reject(new Error("boop"))]) {
@@ -57,7 +57,7 @@ async function UncaughtReject() {
   }
   return loop().catch(Debugger);
 }
-// TODO(kozyatinskiy): this stack trace is suspicious.
+
 async function UncaughtThrow() {
   async function loop() {
     for await (let x of [Throw(new Error("boop"))]) {
@@ -86,7 +86,7 @@ async function CaughtThrow() {
     Debugger(e);
   }
 }
-// TODO(kozyatinskiy): this stack trace is suspicious.
+
 async function UncaughtRejectOnBreak() {
   async function loop() {
     for await (let x of RejectOnReturn(["0", "1"])) {
@@ -95,7 +95,7 @@ async function UncaughtRejectOnBreak() {
   }
   return loop().catch(Debugger);
 }
-// TODO(kozyatinskiy): this stack trace is suspicious.
+
 async function UncaughtThrowOnBreak() {
   async function loop() {
     for await (let x of ThrowOnReturn(["0", "1"])) {
@@ -104,7 +104,7 @@ async function UncaughtThrowOnBreak() {
   }
   return loop().catch(Debugger);
 }
-// TODO(kozyatinskiy): this stack trace is suspicious.
+
 async function CaughtRejectOnBreak() {
   try {
     for await (let x of RejectOnReturn(["0", "1"])) {
@@ -123,8 +123,7 @@ async function CaughtThrowOnBreak() {
   } catch (e) {
     Debugger(e);
   }
-}
-//# sourceURL=test.js`, 9, 26);
+}`, 'test.js');
 
 session.setupScriptMap();
 Protocol.Debugger.onPaused(message => {
diff --git a/deps/v8/test/inspector/debugger/async-function-step-out-expected.txt b/deps/v8/test/inspector/debugger/async-function-step-out-expected.txt
new file mode 100644
index 00000000000000..5f4092dc2a48fc
--- /dev/null
+++ b/deps/v8/test/inspector/debugger/async-function-step-out-expected.txt
@@ -0,0 +1,209 @@
+stepOut async function
+
+Running test: testTrivial
+Check that we have proper async stack at return
+bar (testTrivial.js:28:8)
+-- async function --
+bar (testTrivial.js:27:22)
+foo (testTrivial.js:23:14)
+-- async function --
+foo (testTrivial.js:22:22)
+test (testTrivial.js:18:14)
+-- async function --
+test (testTrivial.js:17:22)
+(anonymous) (:0:0)
+
+foo (testTrivial.js:24:6)
+-- async function --
+foo (testTrivial.js:22:22)
+test (testTrivial.js:18:14)
+-- async function --
+test (testTrivial.js:17:22)
+(anonymous) (:0:0)
+
+test (testTrivial.js:19:6)
+-- async function --
+test (testTrivial.js:17:22)
+(anonymous) (:0:0)
+
+
+Running test: testStepOutPrecision
+Check that stepOut go to resumed outer generator
+bar (testStepOutPrecision.js:61:8)
+-- async function --
+bar (testStepOutPrecision.js:60:22)
+foo (testStepOutPrecision.js:55:14)
+-- async function --
+foo (testStepOutPrecision.js:54:22)
+test (testStepOutPrecision.js:48:14)
+-- async function --
+test (testStepOutPrecision.js:47:14)
+(anonymous) (:0:0)
+
+foo (testStepOutPrecision.js:56:8)
+-- async function --
+foo (testStepOutPrecision.js:54:22)
+test (testStepOutPrecision.js:48:14)
+-- async function --
+test (testStepOutPrecision.js:47:14)
+(anonymous) (:0:0)
+
+test (testStepOutPrecision.js:49:8)
+-- async function --
+test (testStepOutPrecision.js:47:14)
+(anonymous) (:0:0)
+
+floodWithTimeouts (testStepOutPrecision.js:40:15)
+-- setTimeout --
+floodWithTimeouts (testStepOutPrecision.js:41:10)
+-- setTimeout --
+floodWithTimeouts (testStepOutPrecision.js:41:10)
+-- setTimeout --
+floodWithTimeouts (testStepOutPrecision.js:41:10)
+-- setTimeout --
+floodWithTimeouts (testStepOutPrecision.js:41:10)
+test (testStepOutPrecision.js:46:8)
+(anonymous) (:0:0)
+
+test (testStepOutPrecision.js:50:8)
+-- async function --
+test (testStepOutPrecision.js:47:14)
+(anonymous) (:0:0)
+
+floodWithTimeouts (testStepOutPrecision.js:40:15)
+-- setTimeout --
+floodWithTimeouts (testStepOutPrecision.js:41:10)
+-- setTimeout --
+floodWithTimeouts (testStepOutPrecision.js:41:10)
+-- setTimeout --
+floodWithTimeouts (testStepOutPrecision.js:41:10)
+-- setTimeout --
+floodWithTimeouts (testStepOutPrecision.js:41:10)
+-- setTimeout --
+floodWithTimeouts (testStepOutPrecision.js:41:10)
+test (testStepOutPrecision.js:46:8)
+(anonymous) (:0:0)
+
+
+Running test: testStepIntoAtReturn
+Check that stepInto at return go to resumed outer generator
+bar (testStepIntoAtReturn.js:93:8)
+-- async function --
+bar (testStepIntoAtReturn.js:92:22)
+foo (testStepIntoAtReturn.js:88:14)
+-- async function --
+foo (testStepIntoAtReturn.js:87:22)
+test (testStepIntoAtReturn.js:82:14)
+-- async function --
+test (testStepIntoAtReturn.js:81:14)
+(anonymous) (:0:0)
+
+bar (testStepIntoAtReturn.js:94:6)
+-- async function --
+bar (testStepIntoAtReturn.js:92:22)
+foo (testStepIntoAtReturn.js:88:14)
+-- async function --
+foo (testStepIntoAtReturn.js:87:22)
+test (testStepIntoAtReturn.js:82:14)
+-- async function --
+test (testStepIntoAtReturn.js:81:14)
+(anonymous) (:0:0)
+
+foo (testStepIntoAtReturn.js:89:6)
+-- async function --
+foo (testStepIntoAtReturn.js:87:22)
+test (testStepIntoAtReturn.js:82:14)
+-- async function --
+test (testStepIntoAtReturn.js:81:14)
+(anonymous) (:0:0)
+
+test (testStepIntoAtReturn.js:83:8)
+-- async function --
+test (testStepIntoAtReturn.js:81:14)
+(anonymous) (:0:0)
+
+test (testStepIntoAtReturn.js:84:6)
+-- async function --
+test (testStepIntoAtReturn.js:81:14)
+(anonymous) (:0:0)
+
+floodWithTimeouts (testStepIntoAtReturn.js:74:15)
+-- setTimeout --
+floodWithTimeouts (testStepIntoAtReturn.js:75:10)
+-- setTimeout --
+floodWithTimeouts (testStepIntoAtReturn.js:75:10)
+test (testStepIntoAtReturn.js:80:8)
+(anonymous) (:0:0)
+
+
+Running test: testStepOverAtReturn
+Check that stepOver at return go to resumed outer generator
+bar (testStepIntoAtReturn.js:124:8)
+-- async function --
+bar (testStepIntoAtReturn.js:123:22)
+foo (testStepIntoAtReturn.js:119:14)
+-- async function --
+foo (testStepIntoAtReturn.js:118:22)
+test (testStepIntoAtReturn.js:113:14)
+-- async function --
+test (testStepIntoAtReturn.js:112:14)
+(anonymous) (:0:0)
+
+bar (testStepIntoAtReturn.js:125:6)
+-- async function --
+bar (testStepIntoAtReturn.js:123:22)
+foo (testStepIntoAtReturn.js:119:14)
+-- async function --
+foo (testStepIntoAtReturn.js:118:22)
+test (testStepIntoAtReturn.js:113:14)
+-- async function --
+test (testStepIntoAtReturn.js:112:14)
+(anonymous) (:0:0)
+
+foo (testStepIntoAtReturn.js:120:6)
+-- async function --
+foo (testStepIntoAtReturn.js:118:22)
+test (testStepIntoAtReturn.js:113:14)
+-- async function --
+test (testStepIntoAtReturn.js:112:14)
+(anonymous) (:0:0)
+
+test (testStepIntoAtReturn.js:114:8)
+-- async function --
+test (testStepIntoAtReturn.js:112:14)
+(anonymous) (:0:0)
+
+test (testStepIntoAtReturn.js:115:6)
+-- async function --
+test (testStepIntoAtReturn.js:112:14)
+(anonymous) (:0:0)
+
+floodWithTimeouts (testStepIntoAtReturn.js:105:15)
+-- setTimeout --
+floodWithTimeouts (testStepIntoAtReturn.js:106:10)
+-- setTimeout --
+floodWithTimeouts (testStepIntoAtReturn.js:106:10)
+test (testStepIntoAtReturn.js:111:8)
+(anonymous) (:0:0)
+
+
+Running test: testStepOutFromNotAwaitedCall
+Checks stepOut from not awaited call
+bar (testStepIntoAtReturn.js:158:8)
+-- async function --
+bar (testStepIntoAtReturn.js:157:22)
+foo (testStepIntoAtReturn.js:152:8)
+-- async function --
+foo (testStepIntoAtReturn.js:151:22)
+test (testStepIntoAtReturn.js:144:14)
+-- async function --
+test (testStepIntoAtReturn.js:143:14)
+(anonymous) (:0:0)
+
+floodWithTimeouts (testStepIntoAtReturn.js:136:15)
+-- setTimeout --
+floodWithTimeouts (testStepIntoAtReturn.js:137:10)
+-- setTimeout --
+floodWithTimeouts (testStepIntoAtReturn.js:137:10)
+test (testStepIntoAtReturn.js:142:8)
+(anonymous) (:0:0)
diff --git a/deps/v8/test/inspector/debugger/async-function-step-out-optimized-expected.txt b/deps/v8/test/inspector/debugger/async-function-step-out-optimized-expected.txt
new file mode 100644
index 00000000000000..b669237ac480b9
--- /dev/null
+++ b/deps/v8/test/inspector/debugger/async-function-step-out-optimized-expected.txt
@@ -0,0 +1,215 @@
+stepOut async function
+
+Running test: testTrivial
+Check that we have proper async stack at return
+bar (testTrivial.js:30:8)
+-- async function --
+bar (testTrivial.js:29:22)
+foo (testTrivial.js:25:14)
+-- async function --
+foo (testTrivial.js:24:22)
+test (testTrivial.js:20:14)
+-- async function --
+test (testTrivial.js:19:22)
+(anonymous) (:0:0)
+
+foo (testTrivial.js:26:6)
+-- async function --
+foo (testTrivial.js:24:22)
+test (testTrivial.js:20:14)
+-- async function --
+test (testTrivial.js:19:22)
+(anonymous) (:0:0)
+
+test (testTrivial.js:21:6)
+-- async function --
+test (testTrivial.js:19:22)
+(anonymous) (:0:0)
+
+
+Running test: testStepOutPrecision
+Check that stepOut go to resumed outer generator
+bar (testStepOutPrecision.js:63:8)
+-- async function --
+bar (testStepOutPrecision.js:62:22)
+foo (testStepOutPrecision.js:57:14)
+-- async function --
+foo (testStepOutPrecision.js:56:22)
+test (testStepOutPrecision.js:50:14)
+-- async function --
+test (testStepOutPrecision.js:49:14)
+(anonymous) (:0:0)
+
+foo (testStepOutPrecision.js:58:8)
+-- async function --
+foo (testStepOutPrecision.js:56:22)
+test (testStepOutPrecision.js:50:14)
+-- async function --
+test (testStepOutPrecision.js:49:14)
+(anonymous) (:0:0)
+
+test (testStepOutPrecision.js:51:8)
+-- async function --
+test (testStepOutPrecision.js:49:14)
+(anonymous) (:0:0)
+
+floodWithTimeouts (testStepOutPrecision.js:42:15)
+-- setTimeout --
+floodWithTimeouts (testStepOutPrecision.js:43:10)
+-- setTimeout --
+floodWithTimeouts (testStepOutPrecision.js:43:10)
+-- setTimeout --
+floodWithTimeouts (testStepOutPrecision.js:43:10)
+-- setTimeout --
+floodWithTimeouts (testStepOutPrecision.js:43:10)
+test (testStepOutPrecision.js:48:8)
+(anonymous) (:0:0)
+
+test (testStepOutPrecision.js:52:8)
+-- async function --
+test (testStepOutPrecision.js:49:14)
+(anonymous) (:0:0)
+
+floodWithTimeouts (testStepOutPrecision.js:42:15)
+-- setTimeout --
+floodWithTimeouts (testStepOutPrecision.js:43:10)
+-- setTimeout --
+floodWithTimeouts (testStepOutPrecision.js:43:10)
+-- setTimeout --
+floodWithTimeouts (testStepOutPrecision.js:43:10)
+-- setTimeout --
+floodWithTimeouts (testStepOutPrecision.js:43:10)
+-- setTimeout --
+floodWithTimeouts (testStepOutPrecision.js:43:10)
+test (testStepOutPrecision.js:48:8)
+(anonymous) (:0:0)
+
+
+Running test: testStepIntoAtReturn
+Check that stepInto at return go to resumed outer generator
+bar (testStepIntoAtReturn.js:95:8)
+-- async function --
+bar (testStepIntoAtReturn.js:94:22)
+foo (testStepIntoAtReturn.js:90:14)
+-- async function --
+foo (testStepIntoAtReturn.js:89:22)
+test (testStepIntoAtReturn.js:84:14)
+-- async function --
+test (testStepIntoAtReturn.js:83:14)
+(anonymous) (:0:0)
+
+bar (testStepIntoAtReturn.js:96:6)
+-- async function --
+bar (testStepIntoAtReturn.js:94:22)
+foo (testStepIntoAtReturn.js:90:14)
+-- async function --
+foo (testStepIntoAtReturn.js:89:22)
+test (testStepIntoAtReturn.js:84:14)
+-- async function --
+test (testStepIntoAtReturn.js:83:14)
+(anonymous) (:0:0)
+
+foo (testStepIntoAtReturn.js:91:6)
+-- async function --
+foo (testStepIntoAtReturn.js:89:22)
+test (testStepIntoAtReturn.js:84:14)
+-- async function --
+test (testStepIntoAtReturn.js:83:14)
+(anonymous) (:0:0)
+
+test (testStepIntoAtReturn.js:85:8)
+-- async function --
+test (testStepIntoAtReturn.js:83:14)
+(anonymous) (:0:0)
+
+test (testStepIntoAtReturn.js:86:6)
+-- async function --
+test (testStepIntoAtReturn.js:83:14)
+(anonymous) (:0:0)
+
+floodWithTimeouts (testStepIntoAtReturn.js:76:15)
+-- setTimeout --
+floodWithTimeouts (testStepIntoAtReturn.js:77:10)
+-- setTimeout --
+floodWithTimeouts (testStepIntoAtReturn.js:77:10)
+test (testStepIntoAtReturn.js:82:8)
+(anonymous) (:0:0)
+
+
+Running test: testStepOverAtReturn
+Check that stepOver at return go to resumed outer generator
+bar (testStepIntoAtReturn.js:126:8)
+-- async function --
+bar (testStepIntoAtReturn.js:125:22)
+foo (testStepIntoAtReturn.js:121:14)
+-- async function --
+foo (testStepIntoAtReturn.js:120:22)
+test (testStepIntoAtReturn.js:115:14)
+-- async function --
+test (testStepIntoAtReturn.js:114:14)
+(anonymous) (:0:0)
+
+bar (testStepIntoAtReturn.js:127:6)
+-- async function --
+bar (testStepIntoAtReturn.js:125:22)
+foo (testStepIntoAtReturn.js:121:14)
+-- async function --
+foo (testStepIntoAtReturn.js:120:22)
+test (testStepIntoAtReturn.js:115:14)
+-- async function --
+test (testStepIntoAtReturn.js:114:14)
+(anonymous) (:0:0)
+
+foo (testStepIntoAtReturn.js:122:6)
+-- async function --
+foo (testStepIntoAtReturn.js:120:22)
+test (testStepIntoAtReturn.js:115:14)
+-- async function --
+test (testStepIntoAtReturn.js:114:14)
+(anonymous) (:0:0)
+
+test (testStepIntoAtReturn.js:116:8)
+-- async function --
+test (testStepIntoAtReturn.js:114:14)
+(anonymous) (:0:0)
+
+test (testStepIntoAtReturn.js:117:6)
+-- async function --
+test (testStepIntoAtReturn.js:114:14)
+(anonymous) (:0:0)
+
+floodWithTimeouts (testStepIntoAtReturn.js:107:15)
+-- setTimeout --
+floodWithTimeouts (testStepIntoAtReturn.js:108:10)
+-- setTimeout --
+floodWithTimeouts (testStepIntoAtReturn.js:108:10)
+test (testStepIntoAtReturn.js:113:8)
+(anonymous) (:0:0)
+
+
+Running test: testStepOutFromNotAwaitedCall
+Checks stepOut from not awaited call
+bar (testStepIntoAtReturn.js:160:8)
+-- async function --
+bar (testStepIntoAtReturn.js:159:22)
+foo (testStepIntoAtReturn.js:154:8)
+-- async function --
+foo (testStepIntoAtReturn.js:153:22)
+test (testStepIntoAtReturn.js:146:14)
+-- async function --
+test (testStepIntoAtReturn.js:145:14)
+(anonymous) (:0:0)
+
+test (testStepIntoAtReturn.js:147:8)
+-- async function --
+test (testStepIntoAtReturn.js:145:14)
+(anonymous) (:0:0)
+
+floodWithTimeouts (testStepIntoAtReturn.js:138:15)
+-- setTimeout --
+floodWithTimeouts (testStepIntoAtReturn.js:139:10)
+-- setTimeout --
+floodWithTimeouts (testStepIntoAtReturn.js:139:10)
+test (testStepIntoAtReturn.js:144:8)
+(anonymous) (:0:0)
+
diff --git a/deps/v8/test/inspector/debugger/async-function-step-out-optimized.js b/deps/v8/test/inspector/debugger/async-function-step-out-optimized.js
new file mode 100644
index 00000000000000..80b66c7138c906
--- /dev/null
+++ b/deps/v8/test/inspector/debugger/async-function-step-out-optimized.js
@@ -0,0 +1,187 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --harmony-await-optimization
+
+let {session, contextGroup, Protocol} =
+    InspectorTest.start('stepOut async function');
+
+session.setupScriptMap();
+
+Protocol.Runtime.enable();
+
+InspectorTest.runAsyncTestSuite([
+  async function testTrivial() {
+    InspectorTest.log('Check that we have proper async stack at return');
+    contextGroup.addInlineScript(`
+      async function test() {
+        await Promise.resolve();
+        await foo();
+      }
+
+      async function foo() {
+        await Promise.resolve();
+        await bar();
+      }
+
+      async function bar() {
+        await Promise.resolve();
+        debugger;
+    }`, 'testTrivial.js');
+    await runTestAndStepAction('stepOut');
+  },
+
+  async function testStepOutPrecision() {
+    InspectorTest.log('Check that stepOut go to resumed outer generator');
+    contextGroup.addInlineScript(`
+      function wait() {
+        return new Promise(resolve => setTimeout(resolve, 0));
+      }
+      function floodWithTimeouts(a) {
+        if (!a.stop)
+          setTimeout(floodWithTimeouts.bind(this, a), 0);
+      }
+
+      async function test() {
+        let a = {};
+        floodWithTimeouts(a)
+        await wait();
+        await foo();
+        await wait();
+        a.stop = true;
+      }
+
+      async function foo() {
+        await Promise.resolve();
+        await bar();
+        await wait();
+      }
+
+      async function bar() {
+        await Promise.resolve();
+        debugger;
+        await wait();
+      }`, 'testStepOutPrecision.js');
+    await runTestAndStepAction('stepOut');
+  },
+
+  async function testStepIntoAtReturn() {
+    InspectorTest.log('Check that stepInto at return go to resumed outer generator');
+    contextGroup.addInlineScript(`
+      function wait() {
+        return new Promise(resolve => setTimeout(resolve, 0));
+      }
+      function floodWithTimeouts(a) {
+        if (!a.stop)
+          setTimeout(floodWithTimeouts.bind(this, a), 0);
+      }
+
+      async function test() {
+        let a = {};
+        floodWithTimeouts(a)
+        await wait();
+        await foo();
+        a.stop = true;
+      }
+
+      async function foo() {
+        await Promise.resolve();
+        await bar();
+      }
+
+      async function bar() {
+        await Promise.resolve();
+        debugger;
+      }`, 'testStepIntoAtReturn.js');
+    await runTestAndStepAction('stepInto');
+  },
+
+  async function testStepOverAtReturn() {
+    InspectorTest.log('Check that stepOver at return go to resumed outer generator');
+    contextGroup.addInlineScript(`
+      function wait() {
+        return new Promise(resolve => setTimeout(resolve, 0));
+      }
+      function floodWithTimeouts(a) {
+        if (!a.stop)
+          setTimeout(floodWithTimeouts.bind(this, a), 0);
+      }
+
+      async function test() {
+        let a = {};
+        floodWithTimeouts(a)
+        await wait();
+        await foo();
+        a.stop = true;
+      }
+
+      async function foo() {
+        await Promise.resolve();
+        await bar();
+      }
+
+      async function bar() {
+        await Promise.resolve();
+        debugger;
+      }`, 'testStepIntoAtReturn.js');
+    await runTestAndStepAction('stepOver');
+  },
+
+  async function testStepOutFromNotAwaitedCall() {
+    InspectorTest.log('Checks stepOut from not awaited call');
+    contextGroup.addInlineScript(`
+      function wait() {
+        return new Promise(resolve => setTimeout(resolve, 0));
+      }
+      function floodWithTimeouts(a) {
+        if (!a.stop)
+          setTimeout(floodWithTimeouts.bind(this, a), 0);
+      }
+
+      async function test() {
+        let a = {};
+        floodWithTimeouts(a)
+        await wait();
+        await foo();
+        a.stop = true;
+      }
+
+      async function foo() {
+        let a = {};
+        floodWithTimeouts(a);
+        await Promise.resolve();
+        bar();
+        a.stop = true;
+      }
+
+      async function bar() {
+        await Promise.resolve();
+        debugger;
+      }`, 'testStepIntoAtReturn.js');
+    await runTestAndStepAction('stepOut');
+  }
+
+]);
+
+async function runTestAndStepAction(action) {
+  Protocol.Debugger.enable();
+  Protocol.Debugger.setAsyncCallStackDepth({maxDepth: 128});
+  let finished =
+      Protocol.Runtime.evaluate({expression: 'test()', awaitPromise: true})
+          .then(() => false);
+  while (true) {
+    const r = await Promise.race([finished, waitPauseAndDumpStack()]);
+    if (!r) break;
+    Protocol.Debugger[action]();
+  }
+  await Protocol.Debugger.disable();
+}
+
+async function waitPauseAndDumpStack() {
+  const {params} = await Protocol.Debugger.oncePaused();
+  session.logCallFrames(params.callFrames);
+  session.logAsyncStackTrace(params.asyncStackTrace);
+  InspectorTest.log('');
+  return true;
+}
diff --git a/deps/v8/test/inspector/debugger/async-function-step-out.js b/deps/v8/test/inspector/debugger/async-function-step-out.js
new file mode 100644
index 00000000000000..62294b9c0e1b6e
--- /dev/null
+++ b/deps/v8/test/inspector/debugger/async-function-step-out.js
@@ -0,0 +1,185 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+let {session, contextGroup, Protocol} =
+    InspectorTest.start('stepOut async function');
+
+session.setupScriptMap();
+
+Protocol.Runtime.enable();
+
+InspectorTest.runAsyncTestSuite([
+  async function testTrivial() {
+    InspectorTest.log('Check that we have proper async stack at return');
+    contextGroup.addInlineScript(`
+      async function test() {
+        await Promise.resolve();
+        await foo();
+      }
+
+      async function foo() {
+        await Promise.resolve();
+        await bar();
+      }
+
+      async function bar() {
+        await Promise.resolve();
+        debugger;
+    }`, 'testTrivial.js');
+    await runTestAndStepAction('stepOut');
+  },
+
+  async function testStepOutPrecision() {
+    InspectorTest.log('Check that stepOut go to resumed outer generator');
+    contextGroup.addInlineScript(`
+      function wait() {
+        return new Promise(resolve => setTimeout(resolve, 0));
+      }
+      function floodWithTimeouts(a) {
+        if (!a.stop)
+          setTimeout(floodWithTimeouts.bind(this, a), 0);
+      }
+
+      async function test() {
+        let a = {};
+        floodWithTimeouts(a)
+        await wait();
+        await foo();
+        await wait();
+        a.stop = true;
+      }
+
+      async function foo() {
+        await Promise.resolve();
+        await bar();
+        await wait();
+      }
+
+      async function bar() {
+        await Promise.resolve();
+        debugger;
+        await wait();
+      }`, 'testStepOutPrecision.js');
+    await runTestAndStepAction('stepOut');
+  },
+
+  async function testStepIntoAtReturn() {
+    InspectorTest.log('Check that stepInto at return go to resumed outer generator');
+    contextGroup.addInlineScript(`
+      function wait() {
+        return new Promise(resolve => setTimeout(resolve, 0));
+      }
+      function floodWithTimeouts(a) {
+        if (!a.stop)
+          setTimeout(floodWithTimeouts.bind(this, a), 0);
+      }
+
+      async function test() {
+        let a = {};
+        floodWithTimeouts(a)
+        await wait();
+        await foo();
+        a.stop = true;
+      }
+
+      async function foo() {
+        await Promise.resolve();
+        await bar();
+      }
+
+      async function bar() {
+        await Promise.resolve();
+        debugger;
+      }`, 'testStepIntoAtReturn.js');
+    await runTestAndStepAction('stepInto');
+  },
+
+  async function testStepOverAtReturn() {
+    InspectorTest.log('Check that stepOver at return go to resumed outer generator');
+    contextGroup.addInlineScript(`
+      function wait() {
+        return new Promise(resolve => setTimeout(resolve, 0));
+      }
+      function floodWithTimeouts(a) {
+        if (!a.stop)
+          setTimeout(floodWithTimeouts.bind(this, a), 0);
+      }
+
+      async function test() {
+        let a = {};
+        floodWithTimeouts(a)
+        await wait();
+        await foo();
+        a.stop = true;
+      }
+
+      async function foo() {
+        await Promise.resolve();
+        await bar();
+      }
+
+      async function bar() {
+        await Promise.resolve();
+        debugger;
+      }`, 'testStepIntoAtReturn.js');
+    await runTestAndStepAction('stepOver');
+  },
+
+  async function testStepOutFromNotAwaitedCall() {
+    InspectorTest.log('Checks stepOut from not awaited call');
+    contextGroup.addInlineScript(`
+      function wait() {
+        return new Promise(resolve => setTimeout(resolve, 0));
+      }
+      function floodWithTimeouts(a) {
+        if (!a.stop)
+          setTimeout(floodWithTimeouts.bind(this, a), 0);
+      }
+
+      async function test() {
+        let a = {};
+        floodWithTimeouts(a)
+        await wait();
+        await foo();
+        a.stop = true;
+      }
+
+      async function foo() {
+        let a = {};
+        floodWithTimeouts(a);
+        await Promise.resolve();
+        bar();
+        a.stop = true;
+      }
+
+      async function bar() {
+        await Promise.resolve();
+        debugger;
+      }`, 'testStepIntoAtReturn.js');
+    await runTestAndStepAction('stepOut');
+  }
+
+]);
+
+async function runTestAndStepAction(action) {
+  Protocol.Debugger.enable();
+  Protocol.Debugger.setAsyncCallStackDepth({maxDepth: 128});
+  let finished =
+      Protocol.Runtime.evaluate({expression: 'test()', awaitPromise: true})
+          .then(() => false);
+  while (true) {
+    const r = await Promise.race([finished, waitPauseAndDumpStack()]);
+    if (!r) break;
+    Protocol.Debugger[action]();
+  }
+  await Protocol.Debugger.disable();
+}
+
+async function waitPauseAndDumpStack() {
+  const {params} = await Protocol.Debugger.oncePaused();
+  session.logCallFrames(params.callFrames);
+  session.logAsyncStackTrace(params.asyncStackTrace);
+  InspectorTest.log('');
+  return true;
+}
diff --git a/deps/v8/test/inspector/debugger/async-stack-await-expected.txt b/deps/v8/test/inspector/debugger/async-stack-await-expected.txt
index 64d505129843f3..0bb4de5f2c3561 100644
--- a/deps/v8/test/inspector/debugger/async-stack-await-expected.txt
+++ b/deps/v8/test/inspector/debugger/async-stack-await-expected.txt
@@ -1,20 +1,20 @@
 Checks that async stacks works for async/await
 foo2 (test.js:15:2)
 -- async function --
-foo2 (test.js:13:19)
+foo2 (test.js:14:16)
 test (test.js:24:8)
 (anonymous) (expr.js:0:0)
 
 foo2 (test.js:17:2)
 -- async function --
-foo2 (test.js:13:19)
+foo2 (test.js:14:16)
 test (test.js:24:8)
 (anonymous) (expr.js:0:0)
 
 foo1 (test.js:9:2)
 foo2 (test.js:18:8)
 -- async function --
-foo2 (test.js:13:19)
+foo2 (test.js:14:16)
 test (test.js:24:8)
 (anonymous) (expr.js:0:0)
 
@@ -22,13 +22,13 @@ foo1 (test.js:9:2)
 -- Promise.then --
 foo2 (test.js:19:43)
 -- async function --
-foo2 (test.js:13:19)
+foo2 (test.js:14:16)
 test (test.js:24:8)
 (anonymous) (expr.js:0:0)
 
 foo2 (test.js:20:2)
 -- async function --
-foo2 (test.js:13:19)
+foo2 (test.js:14:16)
 test (test.js:24:8)
 (anonymous) (expr.js:0:0)
 
diff --git a/deps/v8/test/inspector/debugger/async-stack-await.js b/deps/v8/test/inspector/debugger/async-stack-await.js
index 8f4b16280734fd..53ea80accb4d94 100644
--- a/deps/v8/test/inspector/debugger/async-stack-await.js
+++ b/deps/v8/test/inspector/debugger/async-stack-await.js
@@ -4,7 +4,7 @@
 
 let {session, contextGroup, Protocol} = InspectorTest.start('Checks that async stacks works for async/await');
 
-contextGroup.addScript(`
+contextGroup.addInlineScript(`
 async function foo1() {
   debugger;
   return Promise.resolve();
@@ -22,8 +22,7 @@ async function foo2() {
 
 async function test() {
   await foo2();
-}
-//# sourceURL=test.js`, 7, 26);
+}`, 'test.js');
 
 session.setupScriptMap();
 Protocol.Debugger.onPaused(message => {
diff --git a/deps/v8/test/inspector/debugger/break-locations-var-init-optimized-expected.txt b/deps/v8/test/inspector/debugger/break-locations-var-init-optimized-expected.txt
new file mode 100644
index 00000000000000..5ca86ea5798469
--- /dev/null
+++ b/deps/v8/test/inspector/debugger/break-locations-var-init-optimized-expected.txt
@@ -0,0 +1,200 @@
+Tests breakable locations in variable initializations.
+
+Running test: testBreakLocations
+
+Running test: testStepInto
+
+function testFunction() {
+  var obj1 = |_|{a : 1};
+  var arr1 = |_|[1];
+  var promise = |_|Promise.|C|resolve(1).|C|then(x => x |_|* 2|R|).|C|then(x => x |_|/ 2|R|);
+  |_|Promise.|C|resolve(1).|C|then(x => x |_|* 2|R|).|C|then(x => x |_|/ 2|R|);
+  |_|promise = Promise.|C|resolve(1).|C|then(x => x |_|* 2|R|).|C|then(x => x |_|/ 2|R|);
+  var a = |_|1;
+  const x = |_|(a = 20);
+  var y = |_|(a = 100);
+  var z = |_|x + (a = 1) + (a = 2) + (a = 3) + |C|f();
+  function f() {
+    for (let { x, y } = |_|{ x: 0, y: 1 }; y |_|> 0; --|_|y) { let z = |_|x + y; }
+  |R|}
+  var b = obj1.|_|a;
+  |_|(async function asyncF() {
+    let r = |_|await Promise.|C|resolve(42);
+    |_|return r;
+  |R|})|C|();
+  |_|return promise;|R|
+}
+
+(anonymous) (expr.js:0:0)
+
+
+testFunction (test.js:2:13)
+(anonymous) (expr.js:0:0)
+function testFunction() {
+  var obj1 = #{a : 1};
+  var arr1 = [1];
+
+testFunction (test.js:3:13)
+(anonymous) (expr.js:0:0)
+  var obj1 = {a : 1};
+  var arr1 = #[1];
+  var promise = Promise.resolve(1).then(x => x * 2).then(x => x / 2);
+
+testFunction (test.js:4:16)
+(anonymous) (expr.js:0:0)
+  var arr1 = [1];
+  var promise = #Promise.resolve(1).then(x => x * 2).then(x => x / 2);
+  Promise.resolve(1).then(x => x * 2).then(x => x / 2);
+
+testFunction (test.js:5:2)
+(anonymous) (expr.js:0:0)
+  var promise = Promise.resolve(1).then(x => x * 2).then(x => x / 2);
+  #Promise.resolve(1).then(x => x * 2).then(x => x / 2);
+  promise = Promise.resolve(1).then(x => x * 2).then(x => x / 2);
+
+testFunction (test.js:6:2)
+(anonymous) (expr.js:0:0)
+  Promise.resolve(1).then(x => x * 2).then(x => x / 2);
+  #promise = Promise.resolve(1).then(x => x * 2).then(x => x / 2);
+  var a = 1;
+
+testFunction (test.js:7:10)
+(anonymous) (expr.js:0:0)
+  promise = Promise.resolve(1).then(x => x * 2).then(x => x / 2);
+  var a = #1;
+  const x = (a = 20);
+
+testFunction (test.js:8:12)
+(anonymous) (expr.js:0:0)
+  var a = 1;
+  const x = #(a = 20);
+  var y = (a = 100);
+
+testFunction (test.js:9:10)
+(anonymous) (expr.js:0:0)
+  const x = (a = 20);
+  var y = #(a = 100);
+  var z = x + (a = 1) + (a = 2) + (a = 3) + f();
+
+testFunction (test.js:10:10)
+(anonymous) (expr.js:0:0)
+  var y = (a = 100);
+  var z = #x + (a = 1) + (a = 2) + (a = 3) + f();
+  function f() {
+
+f (test.js:12:24)
+testFunction (test.js:10:44)
+(anonymous) (expr.js:0:0)
+  function f() {
+    for (let { x, y } = #{ x: 0, y: 1 }; y > 0; --y) { let z = x + y; }
+  }
+
+f (test.js:12:42)
+testFunction (test.js:10:44)
+(anonymous) (expr.js:0:0)
+  function f() {
+    for (let { x, y } = { x: 0, y: 1 }; y #> 0; --y) { let z = x + y; }
+  }
+
+f (test.js:12:62)
+testFunction (test.js:10:44)
+(anonymous) (expr.js:0:0)
+  function f() {
+    for (let { x, y } = { x: 0, y: 1 }; y > 0; --y) { let z = #x + y; }
+  }
+
+f (test.js:12:49)
+testFunction (test.js:10:44)
+(anonymous) (expr.js:0:0)
+  function f() {
+    for (let { x, y } = { x: 0, y: 1 }; y > 0; --#y) { let z = x + y; }
+  }
+
+f (test.js:12:42)
+testFunction (test.js:10:44)
+(anonymous) (expr.js:0:0)
+  function f() {
+    for (let { x, y } = { x: 0, y: 1 }; y #> 0; --y) { let z = x + y; }
+  }
+
+f (test.js:13:2)
+testFunction (test.js:10:44)
+(anonymous) (expr.js:0:0)
+    for (let { x, y } = { x: 0, y: 1 }; y > 0; --y) { let z = x + y; }
+  #}
+  var b = obj1.a;
+
+testFunction (test.js:14:15)
+(anonymous) (expr.js:0:0)
+  }
+  var b = obj1.#a;
+  (async function asyncF() {
+
+testFunction (test.js:15:2)
+(anonymous) (expr.js:0:0)
+  var b = obj1.a;
+  #(async function asyncF() {
+    let r = await Promise.resolve(42);
+
+asyncF (test.js:16:12)
+testFunction (test.js:18:4)
+(anonymous) (expr.js:0:0)
+  (async function asyncF() {
+    let r = #await Promise.resolve(42);
+    return r;
+
+asyncF (test.js:17:4)
+    let r = await Promise.resolve(42);
+    #return r;
+  })();
+
+asyncF (test.js:18:2)
+    return r;
+  #})();
+  return promise;
+
+Promise.resolve.then.then.x (test.js:4:64)
+  var arr1 = [1];
+  var promise = Promise.resolve(1).then(x => x * 2).then(x => x #/ 2);
+  Promise.resolve(1).then(x => x * 2).then(x => x / 2);
+
+Promise.resolve.then.then.x (test.js:4:67)
+  var arr1 = [1];
+  var promise = Promise.resolve(1).then(x => x * 2).then(x => x / 2#);
+  Promise.resolve(1).then(x => x * 2).then(x => x / 2);
+
+Promise.resolve.then.then.x (test.js:5:50)
+  var promise = Promise.resolve(1).then(x => x * 2).then(x => x / 2);
+  Promise.resolve(1).then(x => x * 2).then(x => x #/ 2);
+  promise = Promise.resolve(1).then(x => x * 2).then(x => x / 2);
+
+Promise.resolve.then.then.x (test.js:5:53)
+  var promise = Promise.resolve(1).then(x => x * 2).then(x => x / 2);
+  Promise.resolve(1).then(x => x * 2).then(x => x / 2#);
+  promise = Promise.resolve(1).then(x => x * 2).then(x => x / 2);
+
+Promise.resolve.then.then.x (test.js:6:60)
+  Promise.resolve(1).then(x => x * 2).then(x => x / 2);
+  promise = Promise.resolve(1).then(x => x * 2).then(x => x #/ 2);
+  var a = 1;
+
+Promise.resolve.then.then.x (test.js:6:63)
+  Promise.resolve(1).then(x => x * 2).then(x => x / 2);
+  promise = Promise.resolve(1).then(x => x * 2).then(x => x / 2#);
+  var a = 1;
+
+
+Running test: testStepIntoAfterBreakpoint
+testFunction (test.js:10:10)
+(anonymous) (expr.js:0:0)
+  var y = (a = 100);
+  var z = #x + (a = 1) + (a = 2) + (a = 3) + f();
+  function f() {
+
+f (test.js:12:24)
+testFunction (test.js:10:44)
+(anonymous) (expr.js:0:0)
+  function f() {
+    for (let { x, y } = #{ x: 0, y: 1 }; y > 0; --y) { let z = x + y; }
+  }
+
diff --git a/deps/v8/test/inspector/debugger/break-locations-var-init-optimized.js b/deps/v8/test/inspector/debugger/break-locations-var-init-optimized.js
new file mode 100644
index 00000000000000..f9850606c43257
--- /dev/null
+++ b/deps/v8/test/inspector/debugger/break-locations-var-init-optimized.js
@@ -0,0 +1,76 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --harmony-await-optimization
+
+let {session, contextGroup, Protocol} =
+  InspectorTest.start('Tests breakable locations in variable initializations.');
+
+let source = `
+function testFunction() {
+  var obj1 = {a : 1};
+  var arr1 = [1];
+  var promise = Promise.resolve(1).then(x => x * 2).then(x => x / 2);
+  Promise.resolve(1).then(x => x * 2).then(x => x / 2);
+  promise = Promise.resolve(1).then(x => x * 2).then(x => x / 2);
+  var a = 1;
+  const x = (a = 20);
+  var y = (a = 100);
+  var z = x + (a = 1) + (a = 2) + (a = 3) + f();
+  function f() {
+    for (let { x, y } = { x: 0, y: 1 }; y > 0; --y) { let z = x + y; }
+  }
+  var b = obj1.a;
+  (async function asyncF() {
+    let r = await Promise.resolve(42);
+    return r;
+  })();
+  return promise;
+}
+//# sourceURL=test.js`;
+
+contextGroup.addScript(source);
+session.setupScriptMap();
+
+InspectorTest.runAsyncTestSuite([
+  async function testBreakLocations() {
+    Protocol.Debugger.enable();
+    let {params:{scriptId}} = await Protocol.Debugger.onceScriptParsed();
+    let {result:{locations}} = await Protocol.Debugger.getPossibleBreakpoints({
+      start: {lineNumber: 0, columnNumber : 0, scriptId}});
+    session.logBreakLocations(locations);
+  },
+
+  async function testStepInto() {
+    Protocol.Debugger.pause();
+    let fin = Protocol.Runtime.evaluate({
+      expression: 'testFunction()//# sourceURL=expr.js', awaitPromise: true}).then(() => false);
+    let result;
+    while (result = await Promise.race([fin, Protocol.Debugger.oncePaused()])) {
+      let {params:{callFrames}} = result;
+      session.logCallFrames(callFrames);
+      session.logSourceLocation(callFrames[0].location);
+      Protocol.Debugger.stepInto();
+    }
+    Protocol.Runtime.evaluate({expression: '42'});
+    await Protocol.Debugger.oncePaused();
+    await Protocol.Debugger.resume();
+  },
+
+  async function testStepIntoAfterBreakpoint() {
+    Protocol.Debugger.setBreakpointByUrl({lineNumber: 10, url: 'test.js'});
+    Protocol.Runtime.evaluate({
+      expression: 'testFunction()//# sourceURL=expr.js'});
+    await awaitPausedAndDump();
+    Protocol.Debugger.stepInto();
+    await awaitPausedAndDump();
+    await Protocol.Debugger.resume();
+
+    async function awaitPausedAndDump() {
+      let {params:{callFrames}} = await Protocol.Debugger.oncePaused();
+      session.logCallFrames(callFrames);
+      session.logSourceLocation(callFrames[0].location);
+    }
+  }
+]);
diff --git a/deps/v8/test/inspector/debugger/break-on-exception-and-step-expected.txt b/deps/v8/test/inspector/debugger/break-on-exception-and-step-expected.txt
new file mode 100644
index 00000000000000..81822abeb27a82
--- /dev/null
+++ b/deps/v8/test/inspector/debugger/break-on-exception-and-step-expected.txt
@@ -0,0 +1,145 @@
+Tests for break on exception and stepping.
+
+Running test: testStepThrougA
+
+function a() { #n(); };
+function b() { c(); };
+
+
+Running test: testStepThrougB
+function a() { n(); };
+function b() { #c(); };
+function c() { n(); };
+
+function b() { c(); };
+function c() { #n(); };
+function d() { x = 1; try { e(); } catch(x) { x = 2; } };
+
+
+Running test: testStepThrougD
+function c() { n(); };
+function d() { #x = 1; try { e(); } catch(x) { x = 2; } };
+function e() { n(); };
+
+function c() { n(); };
+function d() { x = 1; try { #e(); } catch(x) { x = 2; } };
+function e() { n(); };
+
+function d() { x = 1; try { e(); } catch(x) { x = 2; } };
+function e() { #n(); };
+function f() { x = 1; try { g(); } catch(x) { x = 2; } };
+
+function c() { n(); };
+function d() { x = 1; try { e(); } catch(x) { #x = 2; } };
+function e() { n(); };
+
+function c() { n(); };
+function d() { x = 1; try { e(); } catch(x) { x = 2; } #};
+function e() { n(); };
+
+
+Running test: testStepThrougDWithBreakOnAllExceptions
+function c() { n(); };
+function d() { #x = 1; try { e(); } catch(x) { x = 2; } };
+function e() { n(); };
+
+function c() { n(); };
+function d() { x = 1; try { #e(); } catch(x) { x = 2; } };
+function e() { n(); };
+
+function d() { x = 1; try { e(); } catch(x) { x = 2; } };
+function e() { #n(); };
+function f() { x = 1; try { g(); } catch(x) { x = 2; } };
+
+paused on exception:
+{
+    className : ReferenceError
+    description : ReferenceError: n is not defined     at e (<anonymous>:6:16)     at d (<anonymous>:5:29)     at expr.js:1:1
+    objectId : <objectId>
+    subtype : error
+    type : object
+    uncaught : false
+}
+function d() { x = 1; try { e(); } catch(x) { x = 2; } };
+function e() { #n(); };
+function f() { x = 1; try { g(); } catch(x) { x = 2; } };
+
+function c() { n(); };
+function d() { x = 1; try { e(); } catch(x) { #x = 2; } };
+function e() { n(); };
+
+function c() { n(); };
+function d() { x = 1; try { e(); } catch(x) { x = 2; } #};
+function e() { n(); };
+
+
+Running test: testStepThrougF
+function e() { n(); };
+function f() { #x = 1; try { g(); } catch(x) { x = 2; } };
+function g() { h(); };
+
+function e() { n(); };
+function f() { x = 1; try { #g(); } catch(x) { x = 2; } };
+function g() { h(); };
+
+function f() { x = 1; try { g(); } catch(x) { x = 2; } };
+function g() { #h(); };
+function h() { x = 1; throw 1; };
+
+function g() { h(); };
+function h() { #x = 1; throw 1; };
+
+
+function g() { h(); };
+function h() { x = 1; #throw 1; };
+
+
+function e() { n(); };
+function f() { x = 1; try { g(); } catch(x) { #x = 2; } };
+function g() { h(); };
+
+function e() { n(); };
+function f() { x = 1; try { g(); } catch(x) { x = 2; } #};
+function g() { h(); };
+
+
+Running test: testStepThrougFWithBreakOnAllExceptions
+function e() { n(); };
+function f() { #x = 1; try { g(); } catch(x) { x = 2; } };
+function g() { h(); };
+
+function e() { n(); };
+function f() { x = 1; try { #g(); } catch(x) { x = 2; } };
+function g() { h(); };
+
+function f() { x = 1; try { g(); } catch(x) { x = 2; } };
+function g() { #h(); };
+function h() { x = 1; throw 1; };
+
+function g() { h(); };
+function h() { #x = 1; throw 1; };
+
+
+function g() { h(); };
+function h() { x = 1; #throw 1; };
+
+
+paused on exception:
+{
+    description : 1
+    type : number
+    uncaught : false
+    value : 1
+}
+function g() { h(); };
+function h() { x = 1; #throw 1; };
+
+
+function e() { n(); };
+function f() { x = 1; try { g(); } catch(x) { #x = 2; } };
+function g() { h(); };
+
+function e() { n(); };
+function f() { x = 1; try { g(); } catch(x) { x = 2; } #};
+function g() { h(); };
+
diff --git a/deps/v8/test/inspector/debugger/break-on-exception-and-step.js b/deps/v8/test/inspector/debugger/break-on-exception-and-step.js
new file mode 100644
index 00000000000000..de01ade8442057
--- /dev/null
+++ b/deps/v8/test/inspector/debugger/break-on-exception-and-step.js
@@ -0,0 +1,69 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+let {session, contextGroup, Protocol} = InspectorTest.start(
+  'Tests for break on exception and stepping.');
+
+session.setupScriptMap();
+Protocol.Debugger.enable();
+Protocol.Debugger.setBlackboxPatterns({patterns: ['expr\.js']});
+Protocol.Debugger.onPaused(async ({params:{callFrames:[topFrame], data}}) => {
+  if (data) {
+    InspectorTest.log('paused on exception:');
+    InspectorTest.logMessage(data);
+  }
+  await session.logSourceLocation(topFrame.location);
+  Protocol.Debugger.stepInto();
+});
+
+contextGroup.addScript(`
+function a() { n(); };
+function b() { c(); };
+function c() { n(); };
+function d() { x = 1; try { e(); } catch(x) { x = 2; } };
+function e() { n(); };
+function f() { x = 1; try { g(); } catch(x) { x = 2; } };
+function g() { h(); };
+function h() { x = 1; throw 1; };
+`);
+
+InspectorTest.runAsyncTestSuite([
+  async function testStepThrougA() {
+    Protocol.Debugger.pause();
+    await Protocol.Runtime.evaluate({expression: 'a()\n//# sourceURL=expr.js'});
+  },
+
+  async function testStepThrougB() {
+    Protocol.Debugger.pause();
+    await Protocol.Runtime.evaluate({expression: 'b()\n//# sourceURL=expr.js'});
+  },
+
+  async function testStepThrougD() {
+    await Protocol.Debugger.setPauseOnExceptions({state: 'uncaught'});
+    Protocol.Debugger.pause();
+    await Protocol.Runtime.evaluate({expression: 'd()\n//# sourceURL=expr.js'});
+    await Protocol.Debugger.setPauseOnExceptions({state: 'none'});
+  },
+
+  async function testStepThrougDWithBreakOnAllExceptions() {
+    await Protocol.Debugger.setPauseOnExceptions({state: 'all'});
+    Protocol.Debugger.pause();
+    await Protocol.Runtime.evaluate({expression: 'd()\n//# sourceURL=expr.js'});
+    await Protocol.Debugger.setPauseOnExceptions({state: 'none'});
+  },
+
+  async function testStepThrougF() {
+    await Protocol.Debugger.setPauseOnExceptions({state: 'uncaught'});
+    Protocol.Debugger.pause();
+    await Protocol.Runtime.evaluate({expression: 'f()\n//# sourceURL=expr.js'});
+    await Protocol.Debugger.setPauseOnExceptions({state: 'none'});
+  },
+
+  async function testStepThrougFWithBreakOnAllExceptions() {
+    await Protocol.Debugger.setPauseOnExceptions({state: 'all'});
+    Protocol.Debugger.pause();
+    await Protocol.Runtime.evaluate({expression: 'f()\n//# sourceURL=expr.js'});
+    await Protocol.Debugger.setPauseOnExceptions({state: 'none'});
+  }
+]);
diff --git a/deps/v8/test/inspector/debugger/break-on-exception-compiler-errors-expected.txt b/deps/v8/test/inspector/debugger/break-on-exception-compiler-errors-expected.txt
new file mode 100644
index 00000000000000..467da2c2f81f05
--- /dev/null
+++ b/deps/v8/test/inspector/debugger/break-on-exception-compiler-errors-expected.txt
@@ -0,0 +1,91 @@
+Break on exceptions from compiler errors.
+
+Running test: testUnexpectedEndOfInput
+Runs '+++'
+Runtime.evaluate exceptionDetails:
+{
+    columnNumber : 2
+    exception : {
+        className : SyntaxError
+        description : SyntaxError: Unexpected end of input
+        objectId : <objectId>
+        subtype : error
+        type : object
+    }
+    exceptionId : <exceptionId>
+    lineNumber : 0
+    scriptId : <scriptId>
+    text : Uncaught
+}
+
+Running test: testUnexpectedIdentifier
+Runs 'x x'
+Runtime.evaluate exceptionDetails:
+{
+    columnNumber : 2
+    exception : {
+        className : SyntaxError
+        description : SyntaxError: Unexpected identifier
+        objectId : <objectId>
+        subtype : error
+        type : object
+    }
+    exceptionId : <exceptionId>
+    lineNumber : 0
+    scriptId : <scriptId>
+    text : Uncaught
+}
+
+Running test: testEvalUnexpectedEndOfInput
+Runs eval('+++')
+paused on exception:
+{
+    className : SyntaxError
+    description : SyntaxError: Unexpected end of input     at <anonymous>:1:1
+    objectId : <objectId>
+    subtype : error
+    type : object
+    uncaught : false
+}
+Runtime.evaluate exceptionDetails:
+{
+    columnNumber : 2
+    exception : {
+        className : SyntaxError
+        description : SyntaxError: Unexpected end of input     at <anonymous>:1:1
+        objectId : <objectId>
+        subtype : error
+        type : object
+    }
+    exceptionId : <exceptionId>
+    lineNumber : 0
+    scriptId : <scriptId>
+    text : Uncaught
+}
+
+Running test: testEvalUnexpectedIdentifier
+Runs eval('x x')
+paused on exception:
+{
+    className : SyntaxError
+    description : SyntaxError: Unexpected identifier     at <anonymous>:1:1
+    objectId : <objectId>
+    subtype : error
+    type : object
+    uncaught : false
+}
+Runtime.evaluate exceptionDetails:
+{
+    columnNumber : 2
+    exception : {
+        className : SyntaxError
+        description : SyntaxError: Unexpected identifier     at <anonymous>:1:1
+        objectId : <objectId>
+        subtype : error
+        type : object
+    }
+    exceptionId : <exceptionId>
+    lineNumber : 0
+    scriptId : <scriptId>
+    text : Uncaught
+}
diff --git a/deps/v8/test/inspector/debugger/break-on-exception-compiler-errors.js b/deps/v8/test/inspector/debugger/break-on-exception-compiler-errors.js
new file mode 100644
index 00000000000000..2501e58988dc07
--- /dev/null
+++ b/deps/v8/test/inspector/debugger/break-on-exception-compiler-errors.js
@@ -0,0 +1,52 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+let {session, contextGroup, Protocol} = InspectorTest.start(
+  'Break on exceptions from compiler errors.');
+
+Protocol.Debugger.enable();
+Protocol.Debugger.setPauseOnExceptions({state: 'all'});
+Protocol.Debugger.onPaused(({params:{data}}) => {
+  InspectorTest.log('paused on exception:');
+  InspectorTest.logMessage(data);
+  Protocol.Debugger.resume();
+});
+
+InspectorTest.runAsyncTestSuite([
+  async function testUnexpectedEndOfInput() {
+    InspectorTest.log(`Runs '+++'`);
+    let {result:{exceptionDetails}} = await Protocol.Runtime.evaluate({
+      expression: '+++'
+    });
+    InspectorTest.log('Runtime.evaluate exceptionDetails:');
+    InspectorTest.logMessage(exceptionDetails);
+  },
+
+  async function testUnexpectedIdentifier() {
+    InspectorTest.log(`Runs 'x x'`);
+    let {result:{exceptionDetails}} = await Protocol.Runtime.evaluate({
+      expression: 'x x'
+    });
+    InspectorTest.log('Runtime.evaluate exceptionDetails:');
+    InspectorTest.logMessage(exceptionDetails);
+  },
+
+  async function testEvalUnexpectedEndOfInput() {
+    InspectorTest.log(`Runs eval('+++')`);
+    let {result:{exceptionDetails}} = await Protocol.Runtime.evaluate({
+      expression: `eval('+++')`
+    });
+    InspectorTest.log('Runtime.evaluate exceptionDetails:');
+    InspectorTest.logMessage(exceptionDetails);
+  },
+
+  async function testEvalUnexpectedIdentifier() {
+    InspectorTest.log(`Runs eval('x x')`);
+    let {result:{exceptionDetails}} = await Protocol.Runtime.evaluate({
+      expression: `eval('x x')`
+    });
+    InspectorTest.log('Runtime.evaluate exceptionDetails:');
+    InspectorTest.logMessage(exceptionDetails);
+  }
+]);
diff --git a/deps/v8/test/inspector/debugger/break-on-exception-expected.txt b/deps/v8/test/inspector/debugger/break-on-exception-expected.txt
index f4d70f09b9da41..c7f0c5f6410615 100644
--- a/deps/v8/test/inspector/debugger/break-on-exception-expected.txt
+++ b/deps/v8/test/inspector/debugger/break-on-exception-expected.txt
@@ -1,12 +1,158 @@
-Check that inspector correctly change break on exception state.
+Tests for break on exception.
 
-Running test: noBreakOnExceptionAfterEnabled
+Running test: testPauseOnInitialState
 
-Running test: breakOnUncaughtException
-paused in throwUncaughtException
+evaluate 'caught()'..
 
-Running test: breakOnCaughtException
-paused in throwUncaughtException
-paused in throwCaughtException
+evaluate 'uncaught()'..
 
-Running test: noBreakInEvaluateInSilentMode
+evaluate 'uncaughtFinally()'..
+
+evaluate 'caughtFinally()'..
+
+Running test: testPauseOnExceptionOff
+
+evaluate 'caught()'..
+
+evaluate 'uncaught()'..
+
+evaluate 'uncaughtFinally()'..
+
+evaluate 'caughtFinally()'..
+
+Running test: testBreakOnUncaughtException
+
+evaluate 'caught()'..
+
+evaluate 'uncaught()'..
+paused on exception:
+{
+    description : 1
+    type : number
+    uncaught : true
+    value : 1
+}
+
+evaluate 'uncaughtFinally()'..
+paused on exception:
+{
+    description : 1
+    type : number
+    uncaught : true
+    value : 1
+}
+
+evaluate 'caughtFinally()'..
+paused on exception:
+{
+    description : 1
+    type : number
+    uncaught : true
+    value : 1
+}
+
+Running test: testBreakOnAll
+
+evaluate 'caught()'..
+paused on exception:
+{
+    description : 1
+    type : number
+    uncaught : false
+    value : 1
+}
+
+evaluate 'uncaught()'..
+paused on exception:
+{
+    description : 1
+    type : number
+    uncaught : true
+    value : 1
+}
+
+evaluate 'uncaughtFinally()'..
+paused on exception:
+{
+    description : 1
+    type : number
+    uncaught : true
+    value : 1
+}
+
+evaluate 'caughtFinally()'..
+paused on exception:
+{
+    description : 1
+    type : number
+    uncaught : true
+    value : 1
+}
+
+Running test: testTryFinallyOriginalMessage
+
+evaluate '
+      try {
+        throw 1;
+      } finally {
+      }
+    '..
+paused on exception:
+{
+    description : 1
+    type : number
+    uncaught : true
+    value : 1
+}
+
+Running test: testPromiseRejectedByCallback
+
+evaluate '
+      function fun() { eval("throw 'rejection';") }
+      var p = new Promise(function(res, rej) { fun(); res(); });
+      var r;
+      p.then(() => { r = 'resolved'; }, (e) => { r = 'rejected' + e; });
+    '..
+paused on exception:
+{
+    type : string
+    uncaught : true
+    value : rejection
+}
+r = 
+{
+    type : string
+    value : rejectedrejection
+}
+
+Running test: testBreakOnExceptionAfterReconnect
+
+evaluate 'f()'..
+paused on exception:
+{
+    className : Error
+    description : Error     at f (<anonymous>:106:144)     at <anonymous>:137:154
+    objectId : <objectId>
+    subtype : error
+    type : object
+    uncaught : true
+}
+
+reconnect..
+
+evaluate 'f()'..
+paused on exception:
+{
+    className : Error
+    description : Error     at f (<anonymous>:106:144)     at <anonymous>:137:154
+    objectId : <objectId>
+    subtype : error
+    type : object
+    uncaught : true
+}
+
+Running test: testBreakOnExceptionInSilentMode
+evaluate 'caught()'
+evaluate 'uncaught()'
+evaluate 'uncaughtFinally()'
+evaluate 'caughtFinally()'
diff --git a/deps/v8/test/inspector/debugger/break-on-exception.js b/deps/v8/test/inspector/debugger/break-on-exception.js
index 6f47ec86d7ac86..1cd0b533071ae4 100644
--- a/deps/v8/test/inspector/debugger/break-on-exception.js
+++ b/deps/v8/test/inspector/debugger/break-on-exception.js
@@ -1,71 +1,138 @@
-// Copyright 2016 the V8 project authors. All rights reserved.
+// Copyright 2018 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-let {session, contextGroup, Protocol} = InspectorTest.start("Check that inspector correctly change break on exception state.");
+let {session, contextGroup, Protocol} = InspectorTest.start(
+  'Tests for break on exception.');
 
-contextGroup.addScript(`
-function scheduleUncaughtException()
-{
-  setTimeout(throwUncaughtException, 0);
+Protocol.Debugger.enable();
+Protocol.Debugger.onPaused(({params:{data}}) => {
+  InspectorTest.log('paused on exception:');
+  InspectorTest.logMessage(data);
+  Protocol.Debugger.resume();
+});
+
+contextGroup.addInlineScript(`
+function throws() {
+  throw 1;
+}
+function caught() {
+  try {
+    throws();
+  } catch (e) {
+  }
 }
-function throwUncaughtException()
-{
-  throw new Error();
+function uncaught() {
+  throws();
 }
-function throwCaughtException()
-{
-  throw new Error();
-}`);
+function uncaughtFinally() {
+  try {
+    throws();
+  } finally {
+  }
+}
+function caughtFinally() {
+  L: try {
+    throws();
+  } finally {
+    break L;
+  }
+}
+`, 'test.js');
 
-Protocol.Debugger.onPaused(message => {
-  InspectorTest.log("paused in " + message.params.callFrames[0].functionName);
-  Protocol.Debugger.resume();
-});
+InspectorTest.runAsyncTestSuite([
+  async function testPauseOnInitialState() {
+    await evaluate('caught()');
+    await evaluate('uncaught()');
+    await evaluate('uncaughtFinally()');
+    await evaluate('caughtFinally()');
+  },
 
-Protocol.Runtime.enable();
+  async function testPauseOnExceptionOff() {
+    await Protocol.Debugger.setPauseOnExceptions({state: 'none'});
+    await evaluate('caught()');
+    await evaluate('uncaught()');
+    await evaluate('uncaughtFinally()');
+    await evaluate('caughtFinally()');
+    await Protocol.Debugger.setPauseOnExceptions({state: 'none'});
+  },
+
+  async function testBreakOnUncaughtException() {
+    await Protocol.Debugger.setPauseOnExceptions({state: 'uncaught'});
+    await evaluate('caught()');
+    await evaluate('uncaught()');
+    await evaluate('uncaughtFinally()');
+    await evaluate('caughtFinally()');
+    await Protocol.Debugger.setPauseOnExceptions({state: 'none'});
+  },
 
-InspectorTest.runTestSuite([
-  function noBreakOnExceptionAfterEnabled(next)
-  {
-    Protocol.Debugger.enable();
-    Protocol.Debugger.setPauseOnExceptions({ state: "all" });
-    Protocol.Debugger.disable();
-    Protocol.Debugger.enable();
-    Protocol.Runtime.evaluate({ expression: "scheduleUncaughtException()" })
-      .then(() => Protocol.Runtime.evaluate({ expression: "throwCaughtException()" }))
-      .then(() => Protocol.Debugger.disable())
-      .then(next);
+  async function testBreakOnAll() {
+    await Protocol.Debugger.setPauseOnExceptions({state: 'all'});
+    await evaluate('caught()');
+    await evaluate('uncaught()');
+    await evaluate('uncaughtFinally()');
+    await evaluate('caughtFinally()');
+    await Protocol.Debugger.setPauseOnExceptions({state: 'none'});
   },
 
-  function breakOnUncaughtException(next)
-  {
-    Protocol.Debugger.enable();
-    Protocol.Debugger.setPauseOnExceptions({ state: "uncaught" });
-    Protocol.Runtime.evaluate({ expression: "scheduleUncaughtException()" })
-      .then(() => Protocol.Runtime.onceExceptionThrown())
-      .then(() => Protocol.Runtime.evaluate({ expression: "throwCaughtException()" }))
-      .then(() => Protocol.Debugger.disable())
-      .then(next);
+  async function testTryFinallyOriginalMessage() {
+    await Protocol.Debugger.setPauseOnExceptions({state: 'all'});
+    await evaluate(`
+      try {
+        throw 1;
+      } finally {
+      }
+    `);
+    await Protocol.Debugger.setPauseOnExceptions({state: 'none'});
   },
 
-  function breakOnCaughtException(next)
-  {
-    Protocol.Debugger.enable();
-    Protocol.Debugger.setPauseOnExceptions({ state: "all" });
-    Protocol.Runtime.evaluate({ expression: "scheduleUncaughtException()" })
-      .then(() => Protocol.Runtime.onceExceptionThrown())
-      .then(() => Protocol.Runtime.evaluate({ expression: "throwCaughtException()" }))
-      .then(() => Protocol.Debugger.disable())
-      .then(next);
+  async function testPromiseRejectedByCallback() {
+    await Protocol.Debugger.setPauseOnExceptions({state: 'uncaught'});
+    await evaluate(`
+      function fun() { eval("throw 'rejection';") }
+      var p = new Promise(function(res, rej) { fun(); res(); });
+      var r;
+      p.then(() => { r = 'resolved'; }, (e) => { r = 'rejected' + e; });
+    `);
+    InspectorTest.log('r = ');
+    InspectorTest.logMessage((await Protocol.Runtime.evaluate({
+      expression: 'r'
+    })).result.result);
+    await Protocol.Debugger.setPauseOnExceptions({state: 'none'});
   },
 
-  function noBreakInEvaluateInSilentMode(next)
-  {
-    Protocol.Debugger.enable();
-    Protocol.Debugger.setPauseOnExceptions({ state: "all" })
-      .then(() => Protocol.Runtime.evaluate({ expression: "throwCaughtException()", silent: true }))
-      .then(() => Protocol.Debugger.disable())
-      .then(next);
+  async function testBreakOnExceptionAfterReconnect() {
+    contextGroup.addInlineScript('function f() { throw new Error(); }');
+    await Protocol.Debugger.setPauseOnExceptions({state: 'uncaught'});
+    await evaluate('f()');
+    InspectorTest.log('\nreconnect..');
+    session.reconnect();
+    await evaluate('f()');
+    await Protocol.Debugger.setPauseOnExceptions({state: 'none'});
+  },
+
+  async function testBreakOnExceptionInSilentMode(next) {
+    await Protocol.Debugger.setPauseOnExceptions({ state: "all" });
+    InspectorTest.log(`evaluate 'caught()'`);
+    await Protocol.Runtime.evaluate({expression: 'caught()', silent: true});
+    InspectorTest.log(`evaluate 'uncaught()'`);
+    await Protocol.Runtime.evaluate({expression: 'uncaught()', silent: true});
+    InspectorTest.log(`evaluate 'uncaughtFinally()'`);
+    await Protocol.Runtime.evaluate({
+      expression: 'uncaughtFinally()',
+      silent: true
+    });
+    InspectorTest.log(`evaluate 'caughtFinally()'`);
+    await Protocol.Runtime.evaluate({
+      xpression: 'caughtFinally()',
+      silent: true
+    });
+    await Protocol.Debugger.setPauseOnExceptions({state: 'none'});
   }
 ]);
+
+async function evaluate(expression) {
+  InspectorTest.log(`\nevaluate '${expression}'..`);
+  contextGroup.addInlineScript(expression);
+  await InspectorTest.waitForPendingTasks();
+}
diff --git a/deps/v8/test/inspector/debugger/continue-to-location-target-call-frames-expected.txt b/deps/v8/test/inspector/debugger/continue-to-location-target-call-frames-expected.txt
index 1f41dcfc6d979f..a894c0e810266c 100644
--- a/deps/v8/test/inspector/debugger/continue-to-location-target-call-frames-expected.txt
+++ b/deps/v8/test/inspector/debugger/continue-to-location-target-call-frames-expected.txt
@@ -8,7 +8,7 @@ asyncFact (test.js:9:2)
 
 asyncFact (test.js:11:2)
 -- async function --
-asyncFact (test.js:8:24)
+asyncFact (test.js:10:20)
 asyncFact (test.js:10:20)
 asyncFact (test.js:10:20)
 asyncFact (test.js:10:20)
@@ -23,7 +23,7 @@ asyncFact (test.js:9:2)
 
 asyncFact (test.js:11:2)
 -- async function --
-asyncFact (test.js:8:24)
+asyncFact (test.js:10:20)
 (anonymous) (expr.js:0:0)
 
 
diff --git a/deps/v8/test/inspector/debugger/disable-agent-on-pause-expected.txt b/deps/v8/test/inspector/debugger/disable-agent-on-pause-expected.txt
new file mode 100644
index 00000000000000..9e1ecd169958c1
--- /dev/null
+++ b/deps/v8/test/inspector/debugger/disable-agent-on-pause-expected.txt
@@ -0,0 +1,4 @@
+Checks that it is possible to disable agent on pause.
+set breakpoint, call foo, wait for pause..
+disable agent..
+call finished
diff --git a/deps/v8/test/inspector/debugger/disable-agent-on-pause.js b/deps/v8/test/inspector/debugger/disable-agent-on-pause.js
new file mode 100644
index 00000000000000..6b1f33f93a1c36
--- /dev/null
+++ b/deps/v8/test/inspector/debugger/disable-agent-on-pause.js
@@ -0,0 +1,27 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+let {session, contextGroup, Protocol} = InspectorTest.start(
+  'Checks that it is possible to disable agent on pause.');
+
+contextGroup.addScript(`
+function foo() {
+  return 42;
+}`, 0, 0, 'test.js');
+
+(async function test() {
+  Protocol.Debugger.enable();
+  InspectorTest.log('set breakpoint, call foo, wait for pause..');
+  let {result:{breakpointId}} = await Protocol.Debugger.setBreakpointByUrl({
+    lineNumber: 2, url: 'test.js'});
+  const finished = Protocol.Runtime.evaluate({
+    expression: 'foo()//# sourceURL=expr.js'
+  });
+  const {params:{callFrames:[topFrame]}} = await Protocol.Debugger.oncePaused();
+  InspectorTest.log('disable agent..');
+  Protocol.Debugger.disable();
+  await finished;
+  InspectorTest.log('call finished');
+  InspectorTest.completeTest();
+})();
diff --git a/deps/v8/test/inspector/debugger/doesnt-step-into-injected-script-expected.txt b/deps/v8/test/inspector/debugger/doesnt-step-into-injected-script-expected.txt
index 29ac3bfd2b8544..886440405d03b5 100644
--- a/deps/v8/test/inspector/debugger/doesnt-step-into-injected-script-expected.txt
+++ b/deps/v8/test/inspector/debugger/doesnt-step-into-injected-script-expected.txt
@@ -8,8 +8,8 @@ paused at:
 
 
 paused at:
-(function boo() { setTimeout(() => 239, 0); debugger; })()#
-
+(function boo() { setTimeout(() => 239, 0); debugger; })()
+#
 
 paused at:
 (function boo() { setTimeout(() => #239, 0); debugger; })()
diff --git a/deps/v8/test/inspector/debugger/evaluate-on-call-frame-expected.txt b/deps/v8/test/inspector/debugger/evaluate-on-call-frame-expected.txt
new file mode 100644
index 00000000000000..5e5065c115d7b2
--- /dev/null
+++ b/deps/v8/test/inspector/debugger/evaluate-on-call-frame-expected.txt
@@ -0,0 +1,78 @@
+Test for Debugger.evaluateOnCallFrame
+
+Running test: testFoo
+Set breakpoint before a = x.
+foo()
+x = 
+{
+    type : undefined
+}
+a = 
+{
+    type : undefined
+}
+
+foo("Hello, world!")
+x = 
+{
+    type : string
+    value : Hello, world!
+}
+a = 
+{
+    type : undefined
+}
+
+Set breakpoint after a = x.
+foo("Hello, world!")
+x = 
+{
+    type : string
+    value : Hello, world!
+}
+a = 
+{
+    type : string
+    value : Hello, world!
+}
+
+
+Running test: testZoo
+Set breakpoint before y = 0.
+zoo("Hello, world!")
+x = 
+{
+    type : string
+    value : Hello, world!
+}
+a = 
+{
+    type : undefined
+}
+
+
+Running test: testBar
+Set breakpoint before a = x.
+bar(undefined, "Hello, world!")
+x = 
+{
+    type : undefined
+}
+a = 
+{
+    type : undefined
+}
+
+Set breakpoint after a = x.
+bar(undefined, "Hello, world!")
+x = 
+{
+    type : string
+    value : Hello, world!
+}
+a = 
+{
+    type : string
+    value : Hello, world!
+}
+
diff --git a/deps/v8/test/inspector/debugger/evaluate-on-call-frame-in-module-expected.txt b/deps/v8/test/inspector/debugger/evaluate-on-call-frame-in-module-expected.txt
index d2b36e34896ab4..863220ca6ac7dd 100644
--- a/deps/v8/test/inspector/debugger/evaluate-on-call-frame-in-module-expected.txt
+++ b/deps/v8/test/inspector/debugger/evaluate-on-call-frame-in-module-expected.txt
@@ -180,7 +180,8 @@ foo2 =
 module
 [
     [0] : foo2 = function foo2() {   let c2 = 22;   return foo1() + a2 + b2 + c2; }
-    [1] : b3 = 31
+    [1] : a3 = 30
+    [2] : b3 = 31
 ]
 global
 [
@@ -205,6 +206,20 @@ foo2 =
     objectId : <objectId>
     type : function
 }
+a3 = 
+{
+    description : 30
+    type : number
+    value : 30
+}
+Evaluating: ++a3
+updated a3 = 
+{
+    description : 31
+    type : number
+    value : 31
+}
+Evaluating: --a3
 b3 = 
 {
     description : 31
@@ -295,6 +310,12 @@ updated a =
     value : 1
 }
 Evaluating: --a
+module
+[
+    [0] : a = 1
+    [1] : b = 2
+    [2] : bar = function bar() {   let a = 0;   (() => {a; debugger;})(); }
+]
 global
 [
   ...
@@ -310,6 +331,41 @@ Array =
     objectId : <objectId>
     type : function
 }
+a = 
+{
+    description : 1
+    type : number
+    value : 1
+}
+Evaluating: ++a
+updated a = 
+{
+    description : 2
+    type : number
+    value : 2
+}
+Evaluating: --a
+b = 
+{
+    description : 2
+    type : number
+    value : 2
+}
+Evaluating: ++b
+updated b = 
+{
+    description : 3
+    type : number
+    value : 3
+}
+Evaluating: --b
+bar = 
+{
+    className : Function
+    description : function bar() {   let a = 0;   (() => {a; debugger;})(); }
+    objectId : <objectId>
+    type : function
+}
 
 Running test: testDifferentModuleVariables
 (anonymous) (module5:5:0)
@@ -485,6 +541,10 @@ Evaluating: --x
 
 Running test: testLocalVariableToplevel
 (anonymous) (module7:2:0)
+module
+[
+    [0] : x = 5
+]
 global
 [
   ...
@@ -501,3 +561,17 @@ Array =
     objectId : <objectId>
     type : function
 }
+x = 
+{
+    description : 5
+    type : number
+    value : 5
+}
+Evaluating: ++x
+updated x = 
+{
+    description : 6
+    type : number
+    value : 6
+}
+Evaluating: --x
diff --git a/deps/v8/test/inspector/debugger/evaluate-on-call-frame-timeout-expected.txt b/deps/v8/test/inspector/debugger/evaluate-on-call-frame-timeout-expected.txt
new file mode 100644
index 00000000000000..1233761449667b
--- /dev/null
+++ b/deps/v8/test/inspector/debugger/evaluate-on-call-frame-timeout-expected.txt
@@ -0,0 +1,7 @@
+Tests that Debugger.evaluateOnCallFrame's timeout argument
+Run trivial expression:
+Evaluate finished!
+Run expression without interrupts:
+Evaluate finished!
+Run infinite loop:
+Evaluate finished!
diff --git a/deps/v8/test/inspector/debugger/evaluate-on-call-frame-timeout.js b/deps/v8/test/inspector/debugger/evaluate-on-call-frame-timeout.js
new file mode 100644
index 00000000000000..02796f6c064674
--- /dev/null
+++ b/deps/v8/test/inspector/debugger/evaluate-on-call-frame-timeout.js
@@ -0,0 +1,40 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+const {Protocol} = InspectorTest.start(
+    `Tests that Debugger.evaluateOnCallFrame's timeout argument`);
+
+(async function test(){
+  Protocol.Debugger.enable();
+  Protocol.Runtime.evaluate({expression: "debugger;"});
+  const {params:{callFrames:[{callFrameId}]}} = await Protocol.Debugger.oncePaused();
+  {
+    InspectorTest.log('Run trivial expression:');
+    const result = await Protocol.Debugger.evaluateOnCallFrame({
+      callFrameId,
+      expression: 'function foo() {} foo()',
+      timeout: 0
+    });
+    InspectorTest.log('Evaluate finished!');
+  }
+  {
+    InspectorTest.log('Run expression without interrupts:');
+    const result = await Protocol.Debugger.evaluateOnCallFrame({
+      callFrameId,
+      expression: '',
+      timeout: 0
+    });
+    InspectorTest.log('Evaluate finished!');
+  }
+  {
+    InspectorTest.log('Run infinite loop:');
+    const result = await Protocol.Debugger.evaluateOnCallFrame({
+      callFrameId,
+      expression: 'for(;;){}',
+      timeout: 0
+    });
+    InspectorTest.log('Evaluate finished!');
+  }
+  InspectorTest.completeTest();
+})();
diff --git a/deps/v8/test/inspector/debugger/evaluate-on-call-frame.js b/deps/v8/test/inspector/debugger/evaluate-on-call-frame.js
new file mode 100644
index 00000000000000..b048296d6a7150
--- /dev/null
+++ b/deps/v8/test/inspector/debugger/evaluate-on-call-frame.js
@@ -0,0 +1,113 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+const {session, contextGroup, Protocol} =
+    InspectorTest.start(`Test for Debugger.evaluateOnCallFrame`);
+
+Protocol.Debugger.enable();
+InspectorTest.runAsyncTestSuite([
+  async function testFoo() {
+    contextGroup.addInlineScript(`
+      function foo(x) {
+        var a;
+        y = 0;
+        a = x;
+        y = 0;
+      }
+    `, 'foo.js');
+
+    InspectorTest.log('Set breakpoint before a = x.');
+    let {result:{breakpointId}} = await Protocol.Debugger.setBreakpointByUrl({
+      lineNumber: 14,
+      url: 'foo.js'
+    });
+    await evaluateOnDump('foo()', ['x', 'a']);
+    await evaluateOnDump('foo("Hello, world!")', ['x', 'a']);
+
+    await Protocol.Debugger.removeBreakpoint({
+      breakpointId
+    });
+
+    InspectorTest.log('Set breakpoint after a = x.');
+    await Protocol.Debugger.setBreakpointByUrl({
+      lineNumber: 16,
+      url: 'foo.js'
+    });
+    await evaluateOnDump('foo("Hello, world!")', ['x', 'a']);
+  },
+
+  async function testZoo() {
+    contextGroup.addInlineScript(`
+      x = undefined;
+      function zoo(t) {
+        var a = x;
+        Object.prototype.x = 42;
+        x = t;
+        y = 0;
+        delete Object.prototype.x;
+        x = a;
+      }
+    `, 'zoo.js');
+
+    InspectorTest.log('Set breakpoint before y = 0.');
+    await Protocol.Debugger.setBreakpointByUrl({
+      lineNumber: 47,
+      url: 'zoo.js'
+    });
+    await evaluateOnDump('zoo("Hello, world!")', ['x', 'a']);
+  },
+
+  async function testBar() {
+    contextGroup.addInlineScript(`
+      y = 0;
+      x = 'Goodbye, world!';
+      function bar(x, b) {
+        var a;
+        function barbar() {
+          y = 0;
+          x = b;
+          a = x;
+        }
+        barbar();
+        y = 0;
+      }
+    `, 'bar.js');
+
+    InspectorTest.log('Set breakpoint before a = x.');
+    let {result:{breakpointId}} = await Protocol.Debugger.setBreakpointByUrl({
+      lineNumber: 68,
+      url: 'bar.js'
+    });
+    await evaluateOnDump('bar(undefined, "Hello, world!")', ['x', 'a']);
+
+    await Protocol.Debugger.removeBreakpoint({
+      breakpointId
+    });
+    InspectorTest.log('Set breakpoint after a = x.');
+    await Protocol.Debugger.setBreakpointByUrl({
+      lineNumber: 73,
+      url: 'bar.js'
+    });
+    await evaluateOnDump('bar(undefined, "Hello, world!")', ['x', 'a']);
+  }
+]);
+
+async function evaluateOnDump(expression, variables) {
+  InspectorTest.log(expression);
+  Protocol.Runtime.evaluate({
+    expression: `${expression}//# sourceURL=expr.js`
+  });
+  const {params:{callFrames:[{callFrameId}]}} =
+      await Protocol.Debugger.oncePaused();
+  for (const variable of variables) {
+    InspectorTest.log(`${variable} = `);
+    const {result:{result}} = await Protocol.Debugger.evaluateOnCallFrame({
+      callFrameId,
+      expression: variable
+    });
+    InspectorTest.logMessage(result);
+  }
+  await Protocol.Debugger.resume();
+  InspectorTest.log('');
+}
diff --git a/deps/v8/test/inspector/debugger/external-stack-trace.js b/deps/v8/test/inspector/debugger/external-stack-trace.js
index 0b5c084e025a9d..78725937c2ed51 100644
--- a/deps/v8/test/inspector/debugger/external-stack-trace.js
+++ b/deps/v8/test/inspector/debugger/external-stack-trace.js
@@ -52,6 +52,7 @@ InspectorTest.runAsyncTestSuite([
       InspectorTest.log(
           '> Debugger.enable in another context group returns own debugger id');
     }
+    await Protocol2.Debugger.disable();
   },
 
   async function testInstrumentation() {
diff --git a/deps/v8/test/inspector/debugger/for-of-loops-expected.txt b/deps/v8/test/inspector/debugger/for-of-loops-expected.txt
index bc1bc5ad6ad928..74666e9e8e6c64 100644
--- a/deps/v8/test/inspector/debugger/for-of-loops-expected.txt
+++ b/deps/v8/test/inspector/debugger/for-of-loops-expected.txt
@@ -375,7 +375,7 @@ testFunction (test.js:28:0)
   for (let k of iterable) { all.push(k); }
 #}
 
-(anonymous) (expr.js:0:34)
+(anonymous) (expr.js:0:35)
 
 
 
diff --git a/deps/v8/test/inspector/debugger/framework-nested-scheduled-break-expected.txt b/deps/v8/test/inspector/debugger/framework-nested-scheduled-break-expected.txt
index f9901f099b63e1..5e1ef35ef796fe 100644
--- a/deps/v8/test/inspector/debugger/framework-nested-scheduled-break-expected.txt
+++ b/deps/v8/test/inspector/debugger/framework-nested-scheduled-break-expected.txt
@@ -23,7 +23,7 @@ break aux data: {
     }
   ]
 }
-callback (user.js:31:17)
+callback (user.js:32:2)
 doFrameworkWork (framework.js:16:2)
 frameworkCall (framework.js:9:12)
 testFunction (user.js:27:12)
diff --git a/deps/v8/test/inspector/debugger/framework-precise-ranges-expected.txt b/deps/v8/test/inspector/debugger/framework-precise-ranges-expected.txt
index 0e0791d8387f0d..148d8af37e203d 100644
--- a/deps/v8/test/inspector/debugger/framework-precise-ranges-expected.txt
+++ b/deps/v8/test/inspector/debugger/framework-precise-ranges-expected.txt
@@ -13,10 +13,6 @@ Running test: testFooNotBlackboxed
     result : {
     }
 }
-foo (test.js:8:12)
-testFunction (test.js:15:2)
-(anonymous) (expr.js:0:0)
-
 foo (test.js:9:2)
 testFunction (test.js:15:2)
 (anonymous) (expr.js:0:0)
@@ -32,9 +28,6 @@ Running test: testFooBlackboxed
     result : {
     }
 }
-testFunction (test.js:14:21)
-(anonymous) (expr.js:0:0)
-
 testFunction (test.js:15:2)
 (anonymous) (expr.js:0:0)
 
@@ -58,10 +51,6 @@ Running test: testBooPartiallyBlackboxed1
     result : {
     }
 }
-foo (test.js:8:12)
-testFunction (test.js:15:2)
-(anonymous) (expr.js:0:0)
-
 foo (test.js:9:2)
 testFunction (test.js:15:2)
 (anonymous) (expr.js:0:0)
@@ -87,10 +76,6 @@ Running test: testBooPartiallyBlackboxed2
     result : {
     }
 }
-foo (test.js:8:12)
-testFunction (test.js:15:2)
-(anonymous) (expr.js:0:0)
-
 foo (test.js:9:2)
 testFunction (test.js:15:2)
 (anonymous) (expr.js:0:0)
@@ -116,10 +101,6 @@ Running test: testBooPartiallyBlackboxed3
     result : {
     }
 }
-foo (test.js:8:12)
-testFunction (test.js:15:2)
-(anonymous) (expr.js:0:0)
-
 foo (test.js:9:2)
 testFunction (test.js:15:2)
 (anonymous) (expr.js:0:0)
diff --git a/deps/v8/test/inspector/debugger/get-possible-breakpoints-array-literal-expected.txt b/deps/v8/test/inspector/debugger/get-possible-breakpoints-array-literal-expected.txt
index c5d8c2466c0aeb..eadf036d68ee3b 100644
--- a/deps/v8/test/inspector/debugger/get-possible-breakpoints-array-literal-expected.txt
+++ b/deps/v8/test/inspector/debugger/get-possible-breakpoints-array-literal-expected.txt
@@ -14,12 +14,6 @@ Tests possible breakpoints in array literal
                 scriptId : <scriptId>
             }
             [2] : {
-                columnNumber : 7
-                lineNumber : 0
-                scriptId : <scriptId>
-                type : return
-            }
-            [3] : {
                 columnNumber : 8
                 lineNumber : 0
                 scriptId : <scriptId>
diff --git a/deps/v8/test/inspector/debugger/get-possible-breakpoints-expected.txt b/deps/v8/test/inspector/debugger/get-possible-breakpoints-expected.txt
index 972a757a78d97a..87eba6ed85e650 100644
--- a/deps/v8/test/inspector/debugger/get-possible-breakpoints-expected.txt
+++ b/deps/v8/test/inspector/debugger/get-possible-breakpoints-expected.txt
@@ -45,12 +45,12 @@ function boo(){ #return Promise.resolve().then(() => 42); }
 Test end is undefined
 function foo(){ #return Promise.#resolve();# }
 function boo(){ #return Promise.#resolve().#then(() => #42#);# }
-#
 
+#
 Test end.lineNumber > scripts.lineCount()
 function foo(){ #return Promise.#resolve();# }
 function boo(){ #return Promise.#resolve().#then(() => #42#);# }
-#
+
 
 Test one string
 function foo(){ #return Promise.#resolve();# }
@@ -64,7 +64,7 @@ function boo(){ return Promise.resolve().then(() => 42); }
 
 
 Running test: getPossibleBreakpointsInArrow
-function foo() { #return Promise.#resolve().#then(() => #239#).#then(() => #42#).#then(() => #() => #42#)# #}
+function foo() { #return Promise.#resolve().#then(() => #239#).#then(() => #42#).#then(() => #() => #42#)# }#
 
 Running test: arrowFunctionFirstLine
 function foo1() { #Promise.#resolve().#then(() => #42#) #}
@@ -92,7 +92,7 @@ Running test: arrowFunctionOnPause
 #debugger; function foo3() { #Promise.#resolve().#then(() => #42#) #}
 function foo4() { #Promise.#resolve().#then(() => #42#) #};
 #foo3();
-#foo4()#;
+#foo4();#
 paused in 
 debugger; function foo3() { Promise.resolve().then(() => 42) }
 function foo4() { Promise.resolve().then(() => 42) };
@@ -147,7 +147,7 @@ paused in
 debugger; function foo3() { Promise.resolve().then(() => 42) }
 function foo4() { Promise.resolve().then(() => 42) };
 foo3();
-foo4()^;
+foo4();^
 paused in Promise.resolve.then
 debugger; function foo3() { Promise.resolve().then(() => ^42) }
 function foo4() { Promise.resolve().then(() => 42) };
@@ -193,12 +193,12 @@ function boo(){ #return Promise.resolve().then(() => 42); }
 Test end is undefined
 function foo(){ #return Promise.#resolve();# }
 function boo(){ #return Promise.#resolve().#then(() => #42#);# }
-#
 
+#
 Test end.lineNumber > scripts.lineCount()
 function foo(){ #return Promise.#resolve();# }
 function boo(){ #return Promise.#resolve().#then(() => #42#);# }
-#
+
 
 Test one string
 function foo(){ #return Promise.#resolve();# }
@@ -214,58 +214,71 @@ function boo(){ return Promise.resolve().then(() => 42); }
 Running test: withOffset
 function foo5() { #Promise.#resolve().#then(() => #42#) #}
 function foo6() { #Promise.#resolve().#then(() => #42#) #}
+#
 paused in foo5
 function foo5() { ^Promise.resolve().then(() => 42) }
 function foo6() { Promise.resolve().then(() => 42) }
+
 paused in foo5
 function foo5() { Promise.^resolve().then(() => 42) }
 function foo6() { Promise.resolve().then(() => 42) }
+
 paused in foo5
 function foo5() { Promise.resolve().^then(() => 42) }
 function foo6() { Promise.resolve().then(() => 42) }
+
 paused in foo5
 function foo5() { Promise.resolve().then(() => 42) ^}
 function foo6() { Promise.resolve().then(() => 42) }
+
 paused in foo6
 function foo5() { Promise.resolve().then(() => 42) }
 function foo6() { ^Promise.resolve().then(() => 42) }
+
 paused in foo6
 function foo5() { Promise.resolve().then(() => 42) }
 function foo6() { Promise.^resolve().then(() => 42) }
+
 paused in foo6
 function foo5() { Promise.resolve().then(() => 42) }
 function foo6() { Promise.resolve().^then(() => 42) }
+
 paused in foo6
 function foo5() { Promise.resolve().then(() => 42) }
 function foo6() { Promise.resolve().then(() => 42) ^}
+
 paused in Promise.resolve.then
 function foo5() { Promise.resolve().then(() => ^42) }
 function foo6() { Promise.resolve().then(() => 42) }
+
 paused in Promise.resolve.then
 function foo5() { Promise.resolve().then(() => 42^) }
 function foo6() { Promise.resolve().then(() => 42) }
+
 paused in Promise.resolve.then
 function foo5() { Promise.resolve().then(() => 42) }
 function foo6() { Promise.resolve().then(() => ^42) }
+
 paused in Promise.resolve.then
 function foo5() { Promise.resolve().then(() => 42) }
 function foo6() { Promise.resolve().then(() => 42^) }
 
+
 Running test: arrowFunctionReturn
 #() => #239#
-
-function foo() { function boo() { #return 239# }  #}#
-
-#() => { #239 #}#
-
-function foo() { #239 #}#
-
-#() => #23#9#
-#() => { #return 239# #}
+#
+function foo() { function boo() { #return 239# }  #}
+#
+#() => { #239 #}
+#
+function foo() { #239 #}
+#
+#() => #239#
+#() => { #return 239# }#
 
 Running test: argumentsAsCalls
 function foo(){#}
 function boo(){#}
 function main(f1,f2){#}
-#main(#foo(), #boo());#
-
+#main(#foo(), #boo());
+#
diff --git a/deps/v8/test/inspector/debugger/get-possible-breakpoints-lazy-error-expected.txt b/deps/v8/test/inspector/debugger/get-possible-breakpoints-lazy-error-expected.txt
index 41f9328f7d2a18..22ef7aae92e49f 100644
--- a/deps/v8/test/inspector/debugger/get-possible-breakpoints-lazy-error-expected.txt
+++ b/deps/v8/test/inspector/debugger/get-possible-breakpoints-lazy-error-expected.txt
@@ -17,6 +17,24 @@ getPossibleBreakpoints should not crash during lazy compilation (crbug.com/71533
         url : test.js
     }
 }
+{
+    method : Debugger.scriptFailedToParse
+    params : {
+        endColumn : 21
+        endLine : 2
+        executionContextId : <executionContextId>
+        hasSourceURL : true
+        hash : 124cb0278e3aa9f250651d433cdefeb5618c7202
+        isModule : false
+        length : 52
+        scriptId : <scriptId>
+        sourceMapURL : 
+        startColumn : 0
+        startLine : 0
+        url : test.js
+    }
+}
+One script is reported twice
 {
     id : <messageId>
     result : {
diff --git a/deps/v8/test/inspector/debugger/get-possible-breakpoints-master-expected.txt b/deps/v8/test/inspector/debugger/get-possible-breakpoints-master-expected.txt
index 667938678444dd..e0ba91f4e2bbe8 100644
--- a/deps/v8/test/inspector/debugger/get-possible-breakpoints-master-expected.txt
+++ b/deps/v8/test/inspector/debugger/get-possible-breakpoints-master-expected.txt
@@ -267,5 +267,5 @@ function twiceDefined() {
   |_|return a + b;|R|
 }
 
-
+|R|
 
diff --git a/deps/v8/test/inspector/debugger/get-possible-breakpoints.js b/deps/v8/test/inspector/debugger/get-possible-breakpoints.js
index 3232d595743bf1..c3659a02403f00 100644
--- a/deps/v8/test/inspector/debugger/get-possible-breakpoints.js
+++ b/deps/v8/test/inspector/debugger/get-possible-breakpoints.js
@@ -118,7 +118,8 @@ function foo4() { Promise.resolve().then(() => 42) };\nfoo3();\nfoo4();`;
     Protocol.Debugger.onPaused(message => dumpBreakLocationInSourceAndResume(message, source, 3, 18));
 
     var source = `function foo5() { Promise.resolve().then(() => 42) }
-function foo6() { Promise.resolve().then(() => 42) }`;
+function foo6() { Promise.resolve().then(() => 42) }
+`;
     waitForPossibleBreakpoints(source, { lineNumber: 0, columnNumber: 0 }, undefined, { name: 'with-offset.js', line_offset: 3, column_offset: 18 })
       .then(message => dumpAllLocations(message, source, 3, 18))
       .then(setAllBreakpoints)
diff --git a/deps/v8/test/inspector/debugger/pause-expected.txt b/deps/v8/test/inspector/debugger/pause-expected.txt
index 2489191e4870c9..7b04109c6573f8 100644
--- a/deps/v8/test/inspector/debugger/pause-expected.txt
+++ b/deps/v8/test/inspector/debugger/pause-expected.txt
@@ -2,12 +2,12 @@ Checks Debugger.pause
 
 Running test: testPause
 paused at:
-#var a = 42;
+var a = #42;
 
 
 Running test: testSkipFrameworks
 paused at:
-#var a = 239;
+var a = #239;
 
 
 Running test: testSkipOtherContext1
@@ -17,26 +17,26 @@ var a = #1;
 
 Running test: testSkipOtherContext2
 paused at:
-#var a = 239;
+var a = #239;
 
 paused at:
-var a = #239;
+var a = 239;#
 
 
 Running test: testWithNativeBreakpoint
 paused at:
-#var a = 42;
+var a = #42;
 
 paused at:
-#var a = 42;
+var a = #42;
 
 paused at:
-#var a = 42;
+var a = #42;
 
 
 Running test: testResumeAnotherGroup
 paused at:
-#var a = 42;
+var a = #42;
 
 {
     error : {
diff --git a/deps/v8/test/inspector/debugger/pause-inside-blackboxed-optimized-expected.txt b/deps/v8/test/inspector/debugger/pause-inside-blackboxed-optimized-expected.txt
new file mode 100644
index 00000000000000..af9afabce4f684
--- /dev/null
+++ b/deps/v8/test/inspector/debugger/pause-inside-blackboxed-optimized-expected.txt
@@ -0,0 +1,4 @@
+Checks pause inside blackboxed optimized function call.
+bar (test.js:2:4)
+foo (framework.js:2:15)
+(anonymous) (expr.js:1:12)
diff --git a/deps/v8/test/inspector/debugger/pause-inside-blackboxed-optimized.js b/deps/v8/test/inspector/debugger/pause-inside-blackboxed-optimized.js
new file mode 100644
index 00000000000000..5d5d7334b243b6
--- /dev/null
+++ b/deps/v8/test/inspector/debugger/pause-inside-blackboxed-optimized.js
@@ -0,0 +1,38 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+let {session, contextGroup, Protocol} = InspectorTest.start(
+  'Checks pause inside blackboxed optimized function call.');
+
+contextGroup.addScript(`
+  function foo() {
+    return 1 + bar();
+  }
+  //# sourceURL=framework.js
+`);
+
+contextGroup.addScript(`
+  function bar() {
+    return 2;
+  }
+  foo();
+  foo();
+  %OptimizeFunctionOnNextCall(foo);
+  foo();
+  //# sourceURL=test.js
+`);
+
+(async function test(){
+  Protocol.Debugger.enable();
+  Protocol.Debugger.setBlackboxPatterns({patterns: ['framework\.js']});
+  Protocol.Runtime.evaluate({expression: `
+  inspector.callWithScheduledBreak(foo, 'break', '');
+  //# sourceURL=expr.js
+  `});
+  const {params:{callFrames}} = await Protocol.Debugger.oncePaused();
+  session.logCallFrames(callFrames);
+  InspectorTest.completeTest();
+})();
diff --git a/deps/v8/test/inspector/debugger/pause-on-async-call-expected.txt b/deps/v8/test/inspector/debugger/pause-on-async-call-expected.txt
index 709eea895ad6d7..012ab4b0b9a425 100644
--- a/deps/v8/test/inspector/debugger/pause-on-async-call-expected.txt
+++ b/deps/v8/test/inspector/debugger/pause-on-async-call-expected.txt
@@ -37,7 +37,7 @@ asyncCallStackTraceId is set
 
 paused at:
   debugger;
-  Promise.resolve().then(#v => v * 2);
+  Promise.resolve().then(v => v #* 2);
 }
 
 
@@ -61,7 +61,7 @@ asyncCallStackTraceId is set
 
 paused at:
   debugger;
-  p.then(#v => v * 2);
+  p.then(v => v #* 2);
   resolveCallback();
 
 
@@ -85,7 +85,7 @@ asyncCallStackTraceId is set
 
 paused at:
   debugger;
-  Promise.resolve().then(#v => v * 2);
+  Promise.resolve().then(v => v #* 2);
   Promise.resolve().then(v => v * 4);
 
 
@@ -114,7 +114,7 @@ asyncCallStackTraceId is set
 
 paused at:
   Promise.resolve().then(v => v * 2);
-  Promise.resolve().then(#v => v * 4);
+  Promise.resolve().then(v => v #* 4);
 }
 
 
@@ -155,7 +155,7 @@ asyncCallStackTraceId is set
 
 paused at:
   debugger;
-  Promise.resolve().then(#v => v * 4);
+  Promise.resolve().then(v => v #* 4);
 }
 
 
@@ -179,7 +179,7 @@ asyncCallStackTraceId is set
 
 paused at:
   debugger;
-  Promise.all([ Promise.resolve(), Promise.resolve() ]).then(#v => v * 2);
+  Promise.all([ Promise.resolve(), Promise.resolve() ]).then(v => v #* 2);
 }
 
 
@@ -203,7 +203,7 @@ asyncCallStackTraceId is set
 
 paused at:
   debugger;
-  createPromise().then(#v => v * 2);
+  createPromise().then(v => v #* 2);
 }
 
 
@@ -227,7 +227,7 @@ asyncCallStackTraceId is set
 
 paused at:
   debugger;
-  createPromise().then(#v => v * 2);
+  createPromise().then(v => v #* 2);
 }
 
 
@@ -280,7 +280,7 @@ paused at:
 asyncCallStackTraceId is set
 
 paused at:
-
-  function boo#() {
-  }
+  function boo() {
+  #}
+}
 
diff --git a/deps/v8/test/inspector/debugger/pause-on-async-call.js b/deps/v8/test/inspector/debugger/pause-on-async-call.js
index 7245824f66ab99..24e7fc6647f266 100644
--- a/deps/v8/test/inspector/debugger/pause-on-async-call.js
+++ b/deps/v8/test/inspector/debugger/pause-on-async-call.js
@@ -72,6 +72,7 @@ function createPromise() {
 session.setupScriptMap();
 
 Protocol.Debugger.enable();
+Protocol.Debugger.setAsyncCallStackDepth({maxDepth: 128});
 InspectorTest.runAsyncTestSuite([
   async function testScheduleErrors() {
     Protocol.Runtime.evaluate({ expression: 'testNoScheduledTask()' });
diff --git a/deps/v8/test/inspector/debugger/regress-crbug-481896-expected.txt b/deps/v8/test/inspector/debugger/regress-crbug-481896-expected.txt
new file mode 100644
index 00000000000000..d56aac2ac604c7
--- /dev/null
+++ b/deps/v8/test/inspector/debugger/regress-crbug-481896-expected.txt
@@ -0,0 +1,20 @@
+Set breakpoint before function call.
+this.dynamic = function dynamic() { 
+  #console.log("> dynamic");  // Break
+}
+
+function static() {
+  #console.log("> static");  // Break
+}
+
+Paused at:
+this.dynamic = function dynamic() { 
+  #console.log("> dynamic");  // Break
+}
+
+Resume..
+Paused at:
+function static() {
+  #console.log("> static");  // Break
+}
+
diff --git a/deps/v8/test/inspector/debugger/regress-crbug-481896.js b/deps/v8/test/inspector/debugger/regress-crbug-481896.js
new file mode 100644
index 00000000000000..f301254dc2bef1
--- /dev/null
+++ b/deps/v8/test/inspector/debugger/regress-crbug-481896.js
@@ -0,0 +1,57 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+let {session, contextGroup, Protocol} =
+  InspectorTest.start('Set breakpoint before function call.');
+
+contextGroup.addScript(`
+function static() {
+  console.log("> static");  // Break
+}
+
+function install() {
+  eval("this.dynamic = function dynamic() { \\n" +
+       "  console.log(\\"> dynamic\\");  // Break\\n" +
+       "}\\n" +
+       "//# sourceURL=dynamicScript");
+}
+
+install();
+//# sourceURL=staticScript`);
+
+(async function test() {
+  session.setupScriptMap();
+  Protocol.Debugger.enable();
+  await session.logSourceLocation((await Protocol.Debugger.setBreakpointByUrl({
+    url: 'dynamicScript',
+    lineNumber: 1
+  })).result.locations[0]);
+  await session.logSourceLocation((await Protocol.Debugger.setBreakpointByUrl({
+    url: 'staticScript',
+    lineNumber: 2
+  })).result.locations[0]);
+
+  Protocol.Runtime.evaluate({ expression: 'dynamic(); static();' });
+  {
+    const {
+      params:{
+        callFrames:[{location}]
+      }
+    } = await Protocol.Debugger.oncePaused();
+    InspectorTest.log('Paused at:');
+    await session.logSourceLocation(location);
+  }
+  {
+    InspectorTest.log('Resume..');
+    Protocol.Debugger.resume();
+    const {
+      params:{
+        callFrames:[{location}]
+      }
+    } = await Protocol.Debugger.oncePaused();
+    InspectorTest.log('Paused at:');
+    await session.logSourceLocation(location);
+  }
+  InspectorTest.completeTest();
+})();
diff --git a/deps/v8/test/inspector/debugger/regression-1853-expected.txt b/deps/v8/test/inspector/debugger/regression-1853-expected.txt
new file mode 100644
index 00000000000000..5adcfe43321dfe
--- /dev/null
+++ b/deps/v8/test/inspector/debugger/regression-1853-expected.txt
@@ -0,0 +1,22 @@
+Set breakpoint before function call.
+Pause before function calls, set two breakpoints at:
+  var a = 1;                      
+  return a;#                       
+}                                 
+
+  var b = 1;                      
+  return b;#                       
+}                                 
+
+Resume..
+Paused at:
+  var a = 1;                      
+  return a;#                       
+}                                 
+
+Resume..
+Paused at:
+  var b = 1;                      
+  return b;#                       
+}                                 
+
diff --git a/deps/v8/test/inspector/debugger/regression-1853.js b/deps/v8/test/inspector/debugger/regression-1853.js
new file mode 100644
index 00000000000000..c3258f5229973a
--- /dev/null
+++ b/deps/v8/test/inspector/debugger/regression-1853.js
@@ -0,0 +1,59 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+let {session, contextGroup, Protocol} =
+  InspectorTest.start('Set breakpoint before function call.');
+
+contextGroup.addScript(`
+eval('function test1() {                \\n' +
+     '  var a = 1;                      \\n' +
+     '  return a;                       \\n' +
+     '}                                 \\n' +
+     '//# sourceURL=testScriptOne');
+
+eval('function test2() {                \\n' +
+     '  var b = 1;                      \\n' +
+     '  return b;                       \\n' +
+     '}                                 \\n' +
+     '//# sourceURL=testScriptTwo');
+`);
+
+(async function test() {
+  session.setupScriptMap();
+  Protocol.Debugger.enable();
+  Protocol.Runtime.evaluate({ expression: 'debugger; test1(); test2();' });
+  await Protocol.Debugger.oncePaused();
+  InspectorTest.log('Pause before function calls, set two breakpoints at:');
+  await session.logSourceLocation((await Protocol.Debugger.setBreakpointByUrl({
+    url: 'testScriptOne',
+    lineNumber: 2
+  })).result.locations[0]);
+  await session.logSourceLocation((await Protocol.Debugger.setBreakpointByUrl({
+    urlRegex: 'Scrip.Two',
+    lineNumber: 2
+  })).result.locations[0]);
+  {
+    InspectorTest.log('Resume..');
+    Protocol.Debugger.resume();
+    const {
+      params:{
+        callFrames:[{location}]
+      }
+    } = await Protocol.Debugger.oncePaused();
+    InspectorTest.log('Paused at:');
+    await session.logSourceLocation(location);
+  }
+  {
+    InspectorTest.log('Resume..');
+    Protocol.Debugger.resume();
+    const {
+      params:{
+        callFrames:[{location}]
+      }
+    } = await Protocol.Debugger.oncePaused();
+    InspectorTest.log('Paused at:');
+    await session.logSourceLocation(location);
+  }
+  InspectorTest.completeTest();
+})();
diff --git a/deps/v8/test/inspector/debugger/regression-419663-expected.txt b/deps/v8/test/inspector/debugger/regression-419663-expected.txt
new file mode 100644
index 00000000000000..023ff27d7d0e49
--- /dev/null
+++ b/deps/v8/test/inspector/debugger/regression-419663-expected.txt
@@ -0,0 +1,6 @@
+Breakpoint can be set at line o = 1;
+Set breakpoint..
+    var a = x + 1;
+    #o = 1;
+  }
+
diff --git a/deps/v8/test/inspector/debugger/regression-419663.js b/deps/v8/test/inspector/debugger/regression-419663.js
new file mode 100644
index 00000000000000..b09965518f7c38
--- /dev/null
+++ b/deps/v8/test/inspector/debugger/regression-419663.js
@@ -0,0 +1,28 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+let {session, contextGroup, Protocol} =
+  InspectorTest.start('Breakpoint can be set at line o = 1;');
+
+contextGroup.addScript(
+`var o = {
+  f: function(x) {
+    var a = x + 1;
+    o = 1;
+  }
+}`);
+
+(async function test() {
+  session.setupScriptMap();
+  Protocol.Debugger.enable();
+  const {params: {scriptId}} = await Protocol.Debugger.onceScriptParsed();
+  InspectorTest.log('Set breakpoint..');
+  const {result} = await Protocol.Debugger.setBreakpoint({location:{
+    scriptId,
+    lineNumber: 3,
+    columnNumber: 0
+  }});
+  await session.logSourceLocation(result.actualLocation);
+  InspectorTest.completeTest();
+})();
diff --git a/deps/v8/test/inspector/debugger/regression-424142-expected.txt b/deps/v8/test/inspector/debugger/regression-424142-expected.txt
new file mode 100644
index 00000000000000..bc97418f2131b6
--- /dev/null
+++ b/deps/v8/test/inspector/debugger/regression-424142-expected.txt
@@ -0,0 +1,6 @@
+Breakpoint can be set at line return this.x;
+Set breakpoint..
+      this.x += y;
+      return this.#x;
+    };
+
diff --git a/deps/v8/test/inspector/debugger/regression-424142.js b/deps/v8/test/inspector/debugger/regression-424142.js
new file mode 100644
index 00000000000000..d6a6948b455cc0
--- /dev/null
+++ b/deps/v8/test/inspector/debugger/regression-424142.js
@@ -0,0 +1,37 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+let {session, contextGroup, Protocol} =
+  InspectorTest.start('Breakpoint can be set at line return this.x;');
+
+contextGroup.addScript(
+`(function outer() {
+  var C = (function C_() {
+    var y = 1;
+    function CC() {
+      this.x = 0;
+    }
+    CC.prototype.f = function CCf() {
+      this.x += y;
+      return this.x;
+    };
+    return CC;
+  })();
+
+  var c = new C(0);
+})`);
+
+(async function test() {
+  session.setupScriptMap();
+  Protocol.Debugger.enable();
+  const {params: {scriptId}} = await Protocol.Debugger.onceScriptParsed();
+  InspectorTest.log('Set breakpoint..');
+  const {result} = await Protocol.Debugger.setBreakpoint({location:{
+    scriptId,
+    lineNumber: 8,
+    columnNumber: 0
+  }});
+  session.logSourceLocation(result.actualLocation);
+  InspectorTest.completeTest();
+})();
diff --git a/deps/v8/test/inspector/debugger/remove-breakpoint-at-breakpoint-expected.txt b/deps/v8/test/inspector/debugger/remove-breakpoint-at-breakpoint-expected.txt
new file mode 100644
index 00000000000000..f870ceafd28bb4
--- /dev/null
+++ b/deps/v8/test/inspector/debugger/remove-breakpoint-at-breakpoint-expected.txt
@@ -0,0 +1,8 @@
+Checks that it is possbible to remove breakpoint when paused at it.
+set breakpoint, call foo, wait for pause..
+function foo() {
+  #return 42;
+}
+
+remove breakpoint, call foo again..
+call finished without pause
diff --git a/deps/v8/test/inspector/debugger/remove-breakpoint-at-breakpoint.js b/deps/v8/test/inspector/debugger/remove-breakpoint-at-breakpoint.js
new file mode 100644
index 00000000000000..af0d0c72501649
--- /dev/null
+++ b/deps/v8/test/inspector/debugger/remove-breakpoint-at-breakpoint.js
@@ -0,0 +1,28 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+let {session, contextGroup, Protocol} = InspectorTest.start(
+  'Checks that it is possbible to remove breakpoint when paused at it.');
+
+contextGroup.addScript(`
+function foo() {
+  return 42;
+}`, 0, 0, 'test.js');
+
+(async function test() {
+  session.setupScriptMap();
+  Protocol.Debugger.enable();
+  InspectorTest.log('set breakpoint, call foo, wait for pause..');
+  let {result:{breakpointId}} = await Protocol.Debugger.setBreakpointByUrl({
+    lineNumber: 2, url: 'test.js'});
+  Protocol.Runtime.evaluate({expression: 'foo()//# sourceURL=expr.js'});
+  const {params:{callFrames:[topFrame]}} = await Protocol.Debugger.oncePaused();
+  await session.logSourceLocation(topFrame.location);
+  InspectorTest.log('remove breakpoint, call foo again..');
+  Protocol.Debugger.removeBreakpoint({breakpointId});
+  await Protocol.Debugger.resume();
+  await Protocol.Runtime.evaluate({expression: 'foo()'});
+  InspectorTest.log('call finished without pause');
+  InspectorTest.completeTest();
+})();
diff --git a/deps/v8/test/inspector/debugger/return-break-locations-expected.txt b/deps/v8/test/inspector/debugger/return-break-locations-expected.txt
index 4b7d4872a636db..9cf3266a1f4323 100644
--- a/deps/v8/test/inspector/debugger/return-break-locations-expected.txt
+++ b/deps/v8/test/inspector/debugger/return-break-locations-expected.txt
@@ -27,8 +27,8 @@ Running test: testTailCall
         type : return
     }
     [4] : {
-        columnNumber : 1
-        lineNumber : 6
+        columnNumber : 0
+        lineNumber : 7
         scriptId : <scriptId>
         type : return
     }
diff --git a/deps/v8/test/inspector/debugger/schedule-step-into-async-expected.txt b/deps/v8/test/inspector/debugger/schedule-step-into-async-expected.txt
index be3cad1bea642a..dbdc5fb84f8a38 100644
--- a/deps/v8/test/inspector/debugger/schedule-step-into-async-expected.txt
+++ b/deps/v8/test/inspector/debugger/schedule-step-into-async-expected.txt
@@ -44,7 +44,7 @@ paused at:
 }
 paused at:
   debugger;
-  Promise.resolve().then(#v => v * 2);
+  Promise.resolve().then(v => v #* 2);
 }
 
 
@@ -66,7 +66,7 @@ paused at:
 }
 paused at:
   debugger;
-  p.then(#v => v * 2);
+  p.then(v => v #* 2);
   resolveCallback();
 
 
@@ -83,7 +83,7 @@ function testTwoAsyncTasks() {
 }
 paused at:
   debugger;
-  Promise.resolve().then(#v => v * 2);
+  Promise.resolve().then(v => v #* 2);
   Promise.resolve().then(v => v * 4);
 
 
@@ -110,7 +110,7 @@ paused at:
 }
 paused at:
   Promise.resolve().then(v => v * 2);
-  Promise.resolve().then(#v => v * 4);
+  Promise.resolve().then(v => v #* 4);
 }
 
 
@@ -142,7 +142,7 @@ paused at:
 }
 paused at:
   debugger;
-  Promise.resolve().then(#v => v * 4);
+  Promise.resolve().then(v => v #* 4);
 }
 
 
@@ -164,7 +164,7 @@ paused at:
 }
 paused at:
   debugger;
-  Promise.all([ Promise.resolve(), Promise.resolve() ]).then(#v => v * 2);
+  Promise.all([ Promise.resolve(), Promise.resolve() ]).then(v => v #* 2);
 }
 
 
@@ -186,6 +186,6 @@ paused at:
 }
 paused at:
   debugger;
-  createPromise().then(#v => v * 2);
+  createPromise().then(v => v #* 2);
 }
 
diff --git a/deps/v8/test/inspector/debugger/schedule-step-into-async-set-timeout-expected.txt b/deps/v8/test/inspector/debugger/schedule-step-into-async-set-timeout-expected.txt
index 28f3a19613e786..dd7cd64d3c9474 100644
--- a/deps/v8/test/inspector/debugger/schedule-step-into-async-set-timeout-expected.txt
+++ b/deps/v8/test/inspector/debugger/schedule-step-into-async-set-timeout-expected.txt
@@ -5,7 +5,7 @@ paused at:
 debugger; #setTimeout(() => 1, 0);
 
 paused at:
-debugger; setTimeout(#() => 1, 0);
+debugger; setTimeout(() => #1, 0);
 
 
 Running test: testDebuggerStmtBeforeCallback1
@@ -42,5 +42,5 @@ paused at:
 #setTimeout(() => 42, 0)
 
 paused at:
-setTimeout(#() => 42, 0)
+setTimeout(() => #42, 0)
 
diff --git a/deps/v8/test/inspector/debugger/schedule-step-into-async.js b/deps/v8/test/inspector/debugger/schedule-step-into-async.js
index c4dfb73992144e..132fb8c7c1bb9a 100644
--- a/deps/v8/test/inspector/debugger/schedule-step-into-async.js
+++ b/deps/v8/test/inspector/debugger/schedule-step-into-async.js
@@ -58,6 +58,7 @@ function createPromise() {
 session.setupScriptMap();
 
 Protocol.Debugger.enable();
+Protocol.Debugger.setAsyncCallStackDepth({maxDepth: 128});
 InspectorTest.runAsyncTestSuite([
   async function testScheduleErrors() {
     Protocol.Runtime.evaluate({ expression: 'testNoScheduledTask()' });
diff --git a/deps/v8/test/inspector/debugger/set-breakpoint-after-liveedit-expected.txt b/deps/v8/test/inspector/debugger/set-breakpoint-after-liveedit-expected.txt
new file mode 100644
index 00000000000000..cd50a5358a9cbe
--- /dev/null
+++ b/deps/v8/test/inspector/debugger/set-breakpoint-after-liveedit-expected.txt
@@ -0,0 +1,19 @@
+Breakpoint in liveedited script
+Update script source
+{
+    callFrames : [
+    ]
+    stackChanged : false
+}
+Set breakpoint
+{
+    actualLocation : {
+        columnNumber : 0
+        lineNumber : 3
+        scriptId : <scriptId>
+    }
+    breakpointId : <breakpointId>
+}
+Call function foo and dump stack
+foo (:3:0)
+(anonymous) (:0:0)
diff --git a/deps/v8/test/inspector/debugger/set-breakpoint-after-liveedit.js b/deps/v8/test/inspector/debugger/set-breakpoint-after-liveedit.js
new file mode 100644
index 00000000000000..05f065b27f531b
--- /dev/null
+++ b/deps/v8/test/inspector/debugger/set-breakpoint-after-liveedit.js
@@ -0,0 +1,39 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+let {session, contextGroup, Protocol} =
+  InspectorTest.start('Breakpoint in liveedited script');
+
+contextGroup.addScript(
+`function foo() {
+}
+var f = foo;`);
+
+const newSource = `function boo() {
+}
+function foo() {
+}
+f = foo;`;
+
+(async function test() {
+  session.setupScriptMap();
+  Protocol.Debugger.enable();
+  const {params: {scriptId}} = await Protocol.Debugger.onceScriptParsed();
+  InspectorTest.log('Update script source');
+  let {result} = await Protocol.Debugger.setScriptSource(
+      {scriptId, scriptSource: newSource})
+  InspectorTest.logMessage(result);
+  InspectorTest.log('Set breakpoint');
+  ({result} = await Protocol.Debugger.setBreakpoint({location:{
+    scriptId,
+    lineNumber: 3,
+    columnNumber: 0
+  }}));
+  InspectorTest.logMessage(result);
+  InspectorTest.log('Call function foo and dump stack');
+  Protocol.Runtime.evaluate({expression: 'foo()'});
+  const {params:{callFrames}} = await Protocol.Debugger.oncePaused();
+  session.logCallFrames(callFrames);
+  InspectorTest.completeTest();
+})();
diff --git a/deps/v8/test/inspector/debugger/set-breakpoint-at-last-line-expected.txt b/deps/v8/test/inspector/debugger/set-breakpoint-at-last-line-expected.txt
index d8b7d70ab6f74b..4f03307ac75665 100644
--- a/deps/v8/test/inspector/debugger/set-breakpoint-at-last-line-expected.txt
+++ b/deps/v8/test/inspector/debugger/set-breakpoint-at-last-line-expected.txt
@@ -3,8 +3,8 @@ Tests breakpoint at last line.
     breakpointId : <breakpointId>
     locations : [
         [0] : {
-            columnNumber : 12
-            lineNumber : 3
+            columnNumber : 0
+            lineNumber : 4
             scriptId : <scriptId>
         }
     ]
@@ -12,5 +12,10 @@ Tests breakpoint at last line.
 {
     breakpointId : <breakpointId>
     locations : [
+        [0] : {
+            columnNumber : 0
+            lineNumber : 4
+            scriptId : <scriptId>
+        }
     ]
 }
diff --git a/deps/v8/test/inspector/debugger/set-breakpoint-expected.txt b/deps/v8/test/inspector/debugger/set-breakpoint-expected.txt
new file mode 100644
index 00000000000000..9e8bc7dcb0ce17
--- /dev/null
+++ b/deps/v8/test/inspector/debugger/set-breakpoint-expected.txt
@@ -0,0 +1,48 @@
+Check different set breakpoint cases.
+Set breakpoint at function g..
+Breakpoint set at:
+  // Comment.
+  #f();
+}
+
+Call g..
+Breakpoint hit at:
+  // Comment.
+  #f();
+}
+
+hitBreakpoints contains breakpoint: true
+
+Set breakpoint at function f when we on pause..
+Breakpoint set at:
+function f() {
+  #a=1;
+};
+
+Resume..
+Breakpoint hit at:
+function f() {
+  #a=1;
+};
+
+hitBreakpoints contains breakpoint: true
+
+Set breakpoint by url at sourceUrlFunc..
+Breakpoint set at:
+function sourceUrlFunc() { #a = 2; }
+
+Call sourceUrlFunc..
+Breakpoint hit at:
+function sourceUrlFunc() { #a = 2; }
+
+hitBreakpoints contains breakpoint: true
+
+Set breakpoint at empty line by url in top level function..
+Breakpoint resolved at:
+// last line#
+
+Breakpoint hit at:
+// last line#
+
+hitBreakpoints contains breakpoint: true
+
diff --git a/deps/v8/test/inspector/debugger/set-breakpoint-on-function-call-expected.txt b/deps/v8/test/inspector/debugger/set-breakpoint-on-function-call-expected.txt
new file mode 100644
index 00000000000000..4c2f58b91d5cd4
--- /dev/null
+++ b/deps/v8/test/inspector/debugger/set-breakpoint-on-function-call-expected.txt
@@ -0,0 +1,36 @@
+Tests Debugger.setBreakpointOnFunctionCall.
+set breakpoint on function call
+call function
+paused
+hitBreakpoints contains id: true
+remove breakpoint
+{
+    id : <messageId>
+    result : {
+    }
+}
+call function again
+evaluate finished without pause
+set breakpoint on function call
+set breakpoint on same function call
+{
+    error : {
+        code : -32000
+        message : Breakpoint at specified location already exists.
+    }
+    id : <messageId>
+}
+set breakpoint on function call with condition
+call function, condition is false
+evaluate finished without pause
+call function, condition is true
+paused
+hitBreakpoints contains id: true
+remove breakpoint
+{
+    id : <messageId>
+    result : {
+    }
+}
+call function again
+evaluate finished without pause
diff --git a/deps/v8/test/inspector/debugger/set-breakpoint-on-function-call.js b/deps/v8/test/inspector/debugger/set-breakpoint-on-function-call.js
new file mode 100644
index 00000000000000..4e8b2ac2ab5aba
--- /dev/null
+++ b/deps/v8/test/inspector/debugger/set-breakpoint-on-function-call.js
@@ -0,0 +1,66 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+let {session, contextGroup, Protocol} =
+    InspectorTest.start('Tests Debugger.setBreakpointOnFunctionCall.');
+
+(async function test() {
+  Protocol.Debugger.enable();
+  {
+    const {result: {result: {objectId}}} = await Protocol.Runtime.evaluate(
+        {expression: 'function foo(a,b){ return a + b; }; foo'});
+    InspectorTest.log('set breakpoint on function call');
+    const {result: {breakpointId}} =
+        await Protocol.Debugger.setBreakpointOnFunctionCall({objectId});
+    InspectorTest.log('call function');
+    Protocol.Runtime.evaluate({expression: 'foo(1,2)'});
+    const {params: {hitBreakpoints}} = await Protocol.Debugger.oncePaused();
+    InspectorTest.log('paused');
+    InspectorTest.log(
+        `hitBreakpoints contains id: ${hitBreakpoints[0] === breakpointId}`);
+    await Protocol.Debugger.resume();
+    InspectorTest.log('remove breakpoint');
+    const result = await Protocol.Debugger.removeBreakpoint({breakpointId});
+    InspectorTest.logMessage(result);
+    InspectorTest.log('call function again');
+    await Protocol.Runtime.evaluate({expression: 'foo(1,2)'});
+    InspectorTest.log('evaluate finished without pause');
+  }
+  {
+    const {result: {result: {objectId}}} = await Protocol.Runtime.evaluate(
+        {expression: 'function foo(a,b){ return a + b; }; foo'});
+    InspectorTest.log('set breakpoint on function call');
+    const {result: {breakpointId}} =
+        await Protocol.Debugger.setBreakpointOnFunctionCall({objectId});
+    InspectorTest.log('set breakpoint on same function call');
+    InspectorTest.logMessage(
+        await Protocol.Debugger.setBreakpointOnFunctionCall({objectId}));
+    await Protocol.Debugger.removeBreakpoint({breakpointId});
+  }
+  {
+    const {result: {result: {objectId}}} =
+        await Protocol.Runtime.evaluate({expression: 'Array.prototype.push'});
+    InspectorTest.log('set breakpoint on function call with condition');
+    const {result: {breakpointId}} =
+        await Protocol.Debugger.setBreakpointOnFunctionCall(
+            {objectId, condition: 'arguments[0] === 2'});
+    InspectorTest.log('call function, condition is false');
+    await Protocol.Runtime.evaluate({expression: '[].push(0)'});
+    InspectorTest.log('evaluate finished without pause');
+    InspectorTest.log('call function, condition is true');
+    Protocol.Runtime.evaluate({expression: '[].push(2)'});
+    const {params: {hitBreakpoints}} = await Protocol.Debugger.oncePaused();
+    InspectorTest.log('paused');
+    InspectorTest.log(
+        `hitBreakpoints contains id: ${hitBreakpoints[0] === breakpointId}`);
+    await Protocol.Debugger.resume();
+    InspectorTest.log('remove breakpoint');
+    const result = await Protocol.Debugger.removeBreakpoint({breakpointId});
+    InspectorTest.logMessage(result);
+    InspectorTest.log('call function again');
+    Protocol.Runtime.evaluate({expression: '[].push(2)'});
+    InspectorTest.log('evaluate finished without pause');
+  }
+  InspectorTest.completeTest();
+})();
diff --git a/deps/v8/test/inspector/debugger/set-breakpoint.js b/deps/v8/test/inspector/debugger/set-breakpoint.js
new file mode 100644
index 00000000000000..2c641c3062e620
--- /dev/null
+++ b/deps/v8/test/inspector/debugger/set-breakpoint.js
@@ -0,0 +1,124 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+let {session, contextGroup, Protocol} =
+  InspectorTest.start('Check different set breakpoint cases.');
+
+contextGroup.addScript(
+`function f() {
+  a=1;
+};
+
+function g() {
+  // Comment.
+  f();
+}
+
+eval('function h(){}');
+eval('function sourceUrlFunc() { a = 2; }\\n//# sourceURL=sourceUrlScript');`);
+
+(async function test() {
+  session.setupScriptMap();
+  Protocol.Debugger.enable();
+  {
+    InspectorTest.log('Set breakpoint at function g..');
+    const location = await functionLocation('g');
+    const {result} = await Protocol.Debugger.setBreakpoint({location});
+    InspectorTest.log('Breakpoint set at:');
+    await session.logSourceLocation(result.actualLocation);
+    InspectorTest.log('Call g..');
+    Protocol.Runtime.evaluate({expression: 'g()'});
+    const {params:{
+      callFrames:[topFrame],
+      hitBreakpoints
+    }} = await Protocol.Debugger.oncePaused();
+    InspectorTest.log('Breakpoint hit at:');
+    await session.logSourceLocation(topFrame.location);
+    const hitBreakpoint = hitBreakpoints[0] === result.breakpointId;
+    InspectorTest.log(`hitBreakpoints contains breakpoint: ${hitBreakpoint}\n`);
+  }
+
+  {
+    InspectorTest.log('Set breakpoint at function f when we on pause..');
+    const {result} = await Protocol.Debugger.setBreakpoint({
+      location: await functionLocation('f')
+    });
+    InspectorTest.log('Breakpoint set at:');
+    await session.logSourceLocation(result.actualLocation);
+    InspectorTest.log('Resume..');
+    Protocol.Debugger.resume();
+    const {params:{
+      callFrames:[topFrame],
+      hitBreakpoints
+    }} = await Protocol.Debugger.oncePaused();
+    InspectorTest.log('Breakpoint hit at:');
+    await session.logSourceLocation(topFrame.location);
+    const hitBreakpoint = hitBreakpoints[0] === result.breakpointId;
+    InspectorTest.log(`hitBreakpoints contains breakpoint: ${hitBreakpoint}\n`);
+    await Protocol.Debugger.resume();
+  }
+  {
+    InspectorTest.log('Set breakpoint by url at sourceUrlFunc..');
+    const {lineNumber, columnNumber} = await functionLocation('sourceUrlFunc');
+    const {result} = await Protocol.Debugger.setBreakpointByUrl({
+      url: 'sourceUrlScript',
+      lineNumber,
+      columnNumber
+    });
+    InspectorTest.log('Breakpoint set at:');
+    await session.logSourceLocation(result.locations[0]);
+    InspectorTest.log('Call sourceUrlFunc..');
+    Protocol.Runtime.evaluate({expression: 'sourceUrlFunc()'});
+    const {params:{
+      callFrames:[topFrame],
+      hitBreakpoints
+    }} = await Protocol.Debugger.oncePaused();
+    InspectorTest.log('Breakpoint hit at:');
+    await session.logSourceLocation(topFrame.location);
+    const hitBreakpoint = hitBreakpoints[0] === result.breakpointId;
+    InspectorTest.log(`hitBreakpoints contains breakpoint: ${hitBreakpoint}\n`);
+    await Protocol.Debugger.resume();
+  }
+
+  {
+    InspectorTest.log(
+        'Set breakpoint at empty line by url in top level function..');
+    const {result:{breakpointId}} = await Protocol.Debugger.setBreakpointByUrl({
+      url: 'test-script',
+      lineNumber: 4,
+      columnNumber: 0
+    });
+    Protocol.Runtime.evaluate({
+      expression: `//# sourceURL=test-script\nfunction i1(){};\n\n\n\n\nfunction i2(){}\n// last line`
+    });
+    const [{
+      params:{location}
+    }, {
+      params:{
+        callFrames:[topFrame],
+        hitBreakpoints
+      }
+    }] = await Promise.all([
+      Protocol.Debugger.onceBreakpointResolved(),
+      Protocol.Debugger.oncePaused()]);
+    InspectorTest.log('Breakpoint resolved at:');
+    await session.logSourceLocation(location);
+    InspectorTest.log('Breakpoint hit at:');
+    await session.logSourceLocation(topFrame.location);
+    const hitBreakpoint = hitBreakpoints[0] === breakpointId;
+    InspectorTest.log(`hitBreakpoints contains breakpoint: ${hitBreakpoint}\n`);
+  }
+  await Protocol.Debugger.disable();
+  InspectorTest.completeTest();
+})();
+
+async function functionLocation(name) {
+  const {result:{result}} = await Protocol.Runtime.evaluate({expression: name});
+  const {result:{internalProperties}} = await Protocol.Runtime.getProperties({
+    objectId: result.objectId
+  });
+  const {value:{value}} = internalProperties.find(
+      prop => prop.name === '[[FunctionLocation]]');
+  return value;
+}
diff --git a/deps/v8/test/inspector/debugger/set-script-source-2-expected.txt b/deps/v8/test/inspector/debugger/set-script-source-2-expected.txt
index 683381b39ae34d..8b052ce813c00d 100644
--- a/deps/v8/test/inspector/debugger/set-script-source-2-expected.txt
+++ b/deps/v8/test/inspector/debugger/set-script-source-2-expected.txt
@@ -1,38 +1,38 @@
 Tests Debugger.setScriptSource
 
 Running test: addLineAfter
-var x = 1;
+var x = a;
 #debugger;
-return x + 2;
+return x + b;
 
 ---
 Break location after LiveEdit:
-var x = 1;
+var x = a;
 #debugger;
 var x = 3;
 
 stackChanged: true
 Protocol.Debugger.stepInto
-function foo() {
-var x = #1;
+function foo(a,b,c) {
+var x = #a;
 debugger;
 
 
 Running test: addLineBefore
-var x = 1;
+var x = a;
 #debugger;
-return x + 2;
+return x + b;
 
 ---
 Break location after LiveEdit:
-var x = 1;
+var x = a;
 var x = #3;
 debugger;
 
 stackChanged: true
 Protocol.Debugger.stepInto
-function foo() {
-var x = #1;
+function foo(a,b,c) {
+var x = #a;
 var x = 3;
 
 
diff --git a/deps/v8/test/inspector/debugger/set-script-source-2.js b/deps/v8/test/inspector/debugger/set-script-source-2.js
index 053ccee856cdec..335bc4764411a0 100644
--- a/deps/v8/test/inspector/debugger/set-script-source-2.js
+++ b/deps/v8/test/inspector/debugger/set-script-source-2.js
@@ -2,15 +2,17 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
+// Flags: --no-always-opt
+
 let {session, contextGroup, Protocol} =
     InspectorTest.start('Tests Debugger.setScriptSource');
 
 session.setupScriptMap();
 
-function foo() {
-var x = 1;
+function foo(a,b,c) {
+var x = a;
 debugger;
-return x + 2;
+return x + b;
 }
 
 function boo() {
@@ -25,7 +27,7 @@ InspectorTest.runAsyncTestSuite([
     Protocol.Runtime.evaluate({expression: foo.toString()});
     let {params:{scriptId}} = await Protocol.Debugger.onceScriptParsed();
     Protocol.Runtime.evaluate({
-      expression: 'setTimeout(foo, 0)//# sourceURL=test.js'});
+      expression: 'setTimeout(() => foo(1,2,3), 0)//# sourceURL=test.js'});
     let {params:{callFrames}} = await Protocol.Debugger.oncePaused();
     await session.logSourceLocation(callFrames[0].location);
     await replaceInSource(scriptId, 'debugger;', 'debugger;\nvar x = 3;');
diff --git a/deps/v8/test/inspector/debugger/set-script-source-exception-expected.txt b/deps/v8/test/inspector/debugger/set-script-source-exception-expected.txt
index 376c11d0b38218..d74d65471e5c2e 100644
--- a/deps/v8/test/inspector/debugger/set-script-source-exception-expected.txt
+++ b/deps/v8/test/inspector/debugger/set-script-source-exception-expected.txt
@@ -14,10 +14,10 @@ Running test: testSourceWithSyntaxError
     id : <messageId>
     result : {
         exceptionDetails : {
-            columnNumber : 2
+            columnNumber : 11
             exceptionId : <exceptionId>
-            lineNumber : 0
-            text : Invalid or unexpected token
+            lineNumber : 1
+            text : Uncaught SyntaxError: Invalid or unexpected token
         }
     }
 }
diff --git a/deps/v8/test/inspector/debugger/set-script-source-exception.js b/deps/v8/test/inspector/debugger/set-script-source-exception.js
index 627aa7ec1e238b..f907eff60ddbc2 100644
--- a/deps/v8/test/inspector/debugger/set-script-source-exception.js
+++ b/deps/v8/test/inspector/debugger/set-script-source-exception.js
@@ -2,22 +2,25 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-let {session, contextGroup, Protocol} = InspectorTest.start('Check that setScriptSource completes correctly when an exception is thrown.');
+let {session, contextGroup, Protocol} = InspectorTest.start(
+    'Check that setScriptSource completes correctly when an exception is' +
+    ' thrown.');
 
 Protocol.Debugger.enable();
 
-InspectorTest.runTestSuite([
-  function testIncorrectScriptId(next) {
-    Protocol.Debugger.setScriptSource({ scriptId: '-1', scriptSource: '0' })
-      .then(InspectorTest.logMessage)
-      .then(next);
+InspectorTest.runAsyncTestSuite([
+  async function testIncorrectScriptId() {
+    InspectorTest.logMessage(await Protocol.Debugger.setScriptSource(
+        {scriptId: '-1', scriptSource: '0'}));
   },
 
-  function testSourceWithSyntaxError(next) {
-    Protocol.Debugger.onceScriptParsed()
-      .then(message => Protocol.Debugger.setScriptSource({ scriptId: message.params.scriptId, scriptSource: 'a # b' }))
-      .then(InspectorTest.logMessage)
-      .then(next);
+  async function testSourceWithSyntaxError() {
     contextGroup.addScript('function foo() {}');
+    const {params} = await Protocol.Debugger.onceScriptParsed();
+    const msg = await Protocol.Debugger.setScriptSource({
+      scriptId: params.scriptId,
+      scriptSource: 'function foo() {\n  return a # b;\n}'
+    });
+    InspectorTest.logMessage(msg);
   }
 ]);
diff --git a/deps/v8/test/inspector/debugger/set-script-source-expected.txt b/deps/v8/test/inspector/debugger/set-script-source-expected.txt
index e77aafd69079f6..61f47e93fe631c 100644
--- a/deps/v8/test/inspector/debugger/set-script-source-expected.txt
+++ b/deps/v8/test/inspector/debugger/set-script-source-expected.txt
@@ -1,8 +1,19 @@
 Tests Debugger.setScriptSource
-Function evaluate: {"type":"number","value":6,"description":"6"}
-PASS, result value: 6
-Function evaluate: {"type":"number","value":8,"description":"8"}
-PASS, result value: 8
-Has error reported: PASS
-Reported error is a compile error: PASS
-PASS, result value: 1
+TestExpression(2,4) === 6
+Update current script source 'a + b' -> 'a * b'..
+{
+    callFrames : [
+    ]
+    stackChanged : false
+}
+TestExpression(2,4) === 8
+Update current script source 'a * b' -> 'a # b'..
+{
+    exceptionDetails : {
+        columnNumber : 13
+        exceptionId : <exceptionId>
+        lineNumber : 1
+        text : Uncaught SyntaxError: Invalid or unexpected token
+    }
+}
+TestExpression(2,4) === 8
diff --git a/deps/v8/test/inspector/debugger/set-script-source-stack-padding-expected.txt b/deps/v8/test/inspector/debugger/set-script-source-stack-padding-expected.txt
new file mode 100644
index 00000000000000..c0ecafb94dcca8
--- /dev/null
+++ b/deps/v8/test/inspector/debugger/set-script-source-stack-padding-expected.txt
@@ -0,0 +1,15 @@
+Change return string constant at breakpoint
+Set breakpoint inside f() and call function..
+Paused at:
+(function f() {
+   #return 'Cat';
+})
+
+Change Cat to Capybara..
+Paused at:
+(function f() {
+   #return 'Capybara';
+})
+
+Resume and check return value..
+SlimFunction() = Capybara
diff --git a/deps/v8/test/inspector/debugger/set-script-source-stack-padding.js b/deps/v8/test/inspector/debugger/set-script-source-stack-padding.js
new file mode 100644
index 00000000000000..0a11e8977efd8a
--- /dev/null
+++ b/deps/v8/test/inspector/debugger/set-script-source-stack-padding.js
@@ -0,0 +1,54 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+let {session, contextGroup, Protocol} =
+  InspectorTest.start('Change return string constant at breakpoint');
+
+contextGroup.addScript(
+`SlimFunction = eval(
+  '(function f() {\\n ' +
+  '  return \\'Cat\\';\\n' +
+  '})\\n' +
+  '//# sourceURL=eval.js\\n');`);
+
+(async function test() {
+  session.setupScriptMap();
+  let scriptPromise = new Promise(resolve => {
+    Protocol.Debugger.onScriptParsed(({params}) => {
+      if (params.url === 'eval.js') {
+        resolve(params);
+        Protocol.Debugger.onScriptParsed(null);
+      }
+    });
+  });
+  Protocol.Debugger.enable();
+  const script = await scriptPromise;
+
+  InspectorTest.log('Set breakpoint inside f() and call function..');
+  const {result:{actualLocation}} = await Protocol.Debugger.setBreakpoint({
+    location: { scriptId: script.scriptId, lineNumber: 1, columnNumber: 0}});
+  const evalPromise = Protocol.Runtime.evaluate({expression: 'SlimFunction()'});
+  const {params:{callFrames}} = await Protocol.Debugger.oncePaused();
+  InspectorTest.log('Paused at:');
+  await session.logSourceLocation(callFrames[0].location);
+
+  InspectorTest.log('Change Cat to Capybara..');
+  const {result:{scriptSource}} = await Protocol.Debugger.getScriptSource({
+    scriptId: script.scriptId
+  });
+  const {result:{callFrames:[topFrame],stackChanged}} =
+      await Protocol.Debugger.setScriptSource({
+        scriptId: script.scriptId,
+        scriptSource: scriptSource.replace(`'Cat'`, `'Capybara'`)
+      });
+
+  InspectorTest.log('Paused at:');
+  await session.logSourceLocation(topFrame.location, true);
+
+  InspectorTest.log('Resume and check return value..');
+  Protocol.Debugger.resume();
+  InspectorTest.log(
+      `SlimFunction() = ${(await evalPromise).result.result.value}`);
+  InspectorTest.completeTest();
+})();
diff --git a/deps/v8/test/inspector/debugger/set-script-source.js b/deps/v8/test/inspector/debugger/set-script-source.js
index f13a3a39bb32d6..9e6ec5a9c6f68a 100644
--- a/deps/v8/test/inspector/debugger/set-script-source.js
+++ b/deps/v8/test/inspector/debugger/set-script-source.js
@@ -2,153 +2,41 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-let {session, contextGroup, Protocol} = InspectorTest.start('Tests Debugger.setScriptSource');
+const {session, contextGroup, Protocol} =
+    InspectorTest.start('Tests Debugger.setScriptSource');
 
 contextGroup.addScript(
 `function TestExpression(a, b) {
     return a + b;
 }`);
 
-// A general-purpose engine for sending a sequence of protocol commands.
-// The clients provide requests and response handlers, while the engine catches
-// errors and makes sure that once there's nothing to do completeTest() is called.
-// @param step is an object with command, params and callback fields
-function runRequestSeries(step) {
-  processStep(step);
-
-  function processStep(currentStep) {
-    try {
-      processStepOrFail(currentStep);
-    } catch (e) {
-      InspectorTest.log(e.stack);
-      InspectorTest.completeTest();
-    }
-  }
-
-  function processStepOrFail(currentStep) {
-    if (!currentStep) {
-      InspectorTest.completeTest();
-      return;
-    }
-    if (!currentStep.command) {
-      // A simple loopback step.
-      var next = currentStep.callback();
-      processStep(next);
-      return;
-    }
-
-    var innerCallback = function(response) {
-      var next;
-      if ("error" in response) {
-        if (!("errorHandler" in currentStep)) {
-          // Error message is not logged intentionally, it may be platform-specific.
-          InspectorTest.log("Protocol command '" + currentStep.command + "' failed");
-          InspectorTest.completeTest();
-          return;
-        }
-        try {
-          next = currentStep.errorHandler(response.error);
-        } catch (e) {
-          InspectorTest.log(e.stack);
-          InspectorTest.completeTest();
-          return;
-        }
-      } else {
-        try {
-          next = currentStep.callback(response.result);
-        } catch (e) {
-          InspectorTest.log(e.stack);
-          InspectorTest.completeTest();
-          return;
-        }
-      }
-      processStep(next);
-    }
-    var command = currentStep.command.split(".");
-    Protocol[command[0]][command[1]](currentStep.params).then(innerCallback);
-  }
-}
-
-function logEqualsCheck(actual, expected)
-{
-  if (actual === expected) {
-    InspectorTest.log("PASS, result value: " + actual);
-  } else {
-    InspectorTest.log("FAIL, actual value: " + actual + ", expected: " + expected);
-  }
-}
-function logCheck(description, success)
-{
-  InspectorTest.log(description + ": " + (success ? "PASS" : "FAIL"));
-}
-
-var firstStep = { callback: enableDebugger };
-
-runRequestSeries(firstStep);
-
-function enableDebugger() {
-  return { command: "Debugger.enable", params: {}, callback: evalFunction };
-}
-
-function evalFunction(response) {
-  var expression = "TestExpression(2, 4)";
-  return { command: "Runtime.evaluate", params: { expression: expression }, callback: callbackEvalFunction };
-}
-
-function callbackEvalFunction(result) {
-  InspectorTest.log("Function evaluate: " + JSON.stringify(result.result));
-  logEqualsCheck(result.result.value, 6);
-
-  return { command: "Runtime.evaluate", params: { expression: "TestExpression" }, callback: callbackEvalFunctionObject };
-}
-
-function callbackEvalFunctionObject(result) {
-  return { command: "Runtime.getProperties", params: { objectId: result.result.objectId }, callback: callbackFunctionDetails };
-}
-
-function callbackFunctionDetails(result)
-{
-  var scriptId;
-  for (var prop of result.internalProperties) {
-    if (prop.name === "[[FunctionLocation]]")
-      scriptId = prop.value.value.scriptId;
-  }
-  return createScriptManipulationArc(scriptId, null);
-}
-
-// Several steps with scriptId in context.
-function createScriptManipulationArc(scriptId, next) {
-  return { command: "Debugger.getScriptSource", params: { scriptId: scriptId }, callback: callbackGetScriptSource };
-
-  var originalText;
-
-  function callbackGetScriptSource(result) {
-    originalText = result.scriptSource;
-    var patched = originalText.replace("a + b", "a * b");
-
-    return { command: "Debugger.setScriptSource", params: { scriptId: scriptId, scriptSource: patched }, callback: callbackSetScriptSource };
-  }
-
-  function callbackSetScriptSource(result) {
-    var expression = "TestExpression(2, 4)";
-    return { command: "Runtime.evaluate", params: { expression: expression }, callback: callbackEvalFunction2 };
-  }
-
-  function callbackEvalFunction2(result) {
-    InspectorTest.log("Function evaluate: " + JSON.stringify(result.result));
-    logEqualsCheck(result.result.value, 8);
-
-    var patched = originalText.replace("a + b", "a # b");
-
-    return { command: "Debugger.setScriptSource", params: { scriptId: scriptId, scriptSource: patched }, callback: errorCallbackSetScriptSource2 };
-  }
-
-  function errorCallbackSetScriptSource2(result) {
-    var exceptionDetails = result.exceptionDetails;
-    logCheck("Has error reported", !!exceptionDetails);
-    logCheck("Reported error is a compile error", !!exceptionDetails);
-    if (exceptionDetails)
-      logEqualsCheck(exceptionDetails.lineNumber, 1);
-    return next;
-  }
-}
+(async function test() {
+  Protocol.Debugger.enable();
+  const {params: {scriptId}} = await Protocol.Debugger.onceScriptParsed();
+  const {result: {result: {value}}} =
+      await Protocol.Runtime.evaluate({expression: 'TestExpression(2, 4)'});
+  InspectorTest.log(`TestExpression(2,4) === ${value}`);
+  {
+    const {result: {scriptSource}} =
+        await Protocol.Debugger.getScriptSource({scriptId});
+    InspectorTest.log(`Update current script source 'a + b' -> 'a * b'..`);
+    const {result} = await Protocol.Debugger.setScriptSource(
+        {scriptId, scriptSource: scriptSource.replace('a + b', 'a * b')})
+    InspectorTest.logMessage(result);
+    const {result: {result: {value}}} =
+        await Protocol.Runtime.evaluate({expression: 'TestExpression(2, 4)'});
+    InspectorTest.log(`TestExpression(2,4) === ${value}`);
+  }
+  {
+    const {result: {scriptSource}} =
+        await Protocol.Debugger.getScriptSource({scriptId});
+    InspectorTest.log(`Update current script source 'a * b' -> 'a # b'..`);
+    const {result} = await Protocol.Debugger.setScriptSource(
+        {scriptId, scriptSource: scriptSource.replace('a * b', 'a # b')})
+    InspectorTest.logMessage(result);
+    const {result: {result: {value}}} =
+        await Protocol.Runtime.evaluate({expression: 'TestExpression(2, 4)'});
+    InspectorTest.log(`TestExpression(2,4) === ${value}`);
+  }
+  InspectorTest.completeTest();
+})();
diff --git a/deps/v8/test/inspector/debugger/step-into-break-on-async-call-expected.txt b/deps/v8/test/inspector/debugger/step-into-break-on-async-call-expected.txt
index 26975c1c4cfa08..6b5234f13fbfdc 100644
--- a/deps/v8/test/inspector/debugger/step-into-break-on-async-call-expected.txt
+++ b/deps/v8/test/inspector/debugger/step-into-break-on-async-call-expected.txt
@@ -3,11 +3,11 @@ Test for Debugger.stepInto with breakOnAsyncCall.
 Running test: testSetTimeout
 (anonymous) (test.js:0:0)
 asyncCallStackTraceId is set
-setTimeout (test.js:0:11)
+setTimeout (test.js:0:17)
 asyncCallStackTraceId is empty
 
 Running test: testPromiseThen
 (anonymous) (test.js:0:2)
 asyncCallStackTraceId is set
-p.then (test.js:0:7)
+p.then (test.js:0:13)
 asyncCallStackTraceId is empty
diff --git a/deps/v8/test/inspector/debugger/step-into-break-on-async-call.js b/deps/v8/test/inspector/debugger/step-into-break-on-async-call.js
index 6a185c045f2926..d47df9f7ebe874 100644
--- a/deps/v8/test/inspector/debugger/step-into-break-on-async-call.js
+++ b/deps/v8/test/inspector/debugger/step-into-break-on-async-call.js
@@ -9,6 +9,8 @@ InspectorTest.runAsyncTestSuite([
   async function testSetTimeout() {
     Protocol.Debugger.enable();
     Protocol.Debugger.pause();
+    Protocol.Debugger.setAsyncCallStackDepth({maxDepth: 128});
+
     let pausedPromise = Protocol.Debugger.oncePaused();
     Protocol.Runtime.evaluate({
       expression: 'setTimeout(() => 42, 0)//# sourceURL=test.js'
@@ -35,6 +37,8 @@ InspectorTest.runAsyncTestSuite([
 
   async function testPromiseThen() {
     Protocol.Debugger.enable();
+    Protocol.Debugger.setAsyncCallStackDepth({maxDepth: 128});
+
     Protocol.Runtime.evaluate({expression: 'var p = Promise.resolve()'});
     Protocol.Debugger.pause();
     let pausedPromise = Protocol.Debugger.oncePaused();
diff --git a/deps/v8/test/inspector/debugger/step-into-expected.txt b/deps/v8/test/inspector/debugger/step-into-expected.txt
index 30ba7e7329f02f..7e5ebddc5bd163 100644
--- a/deps/v8/test/inspector/debugger/step-into-expected.txt
+++ b/deps/v8/test/inspector/debugger/step-into-expected.txt
@@ -7,7 +7,7 @@ function testEval() {
   eval('// comment only\n');
 
 break at:
-// comment onl#y
+// comment only#
 
 break at:
   eval('// comment only');
@@ -15,8 +15,8 @@ break at:
 }
 
 break at:
-// comment only#
-
+// comment only
+#
 
 break at:
   eval('// comment only\n');
diff --git a/deps/v8/test/inspector/debugger/step-into-external-async-task-expected.txt b/deps/v8/test/inspector/debugger/step-into-external-async-task-expected.txt
index fcc5f9a625b3a3..8bf702b3550e73 100644
--- a/deps/v8/test/inspector/debugger/step-into-external-async-task-expected.txt
+++ b/deps/v8/test/inspector/debugger/step-into-external-async-task-expected.txt
@@ -5,7 +5,7 @@ Run stepInto with breakOnAsyncCall flag
 Call pauseOnAsyncCall
 Trigger external async task on another context group
 Dump stack trace
-boo (target.js:1:18)
+boo (target.js:1:22)
 call (framework.js:3:2)
 (anonymous) (target.js:0:0)
 -- remote-task --
diff --git a/deps/v8/test/inspector/debugger/step-into-external-async-task-same-context-expected.txt b/deps/v8/test/inspector/debugger/step-into-external-async-task-same-context-expected.txt
index e6ab8168107de7..4b2fba9856f05f 100644
--- a/deps/v8/test/inspector/debugger/step-into-external-async-task-same-context-expected.txt
+++ b/deps/v8/test/inspector/debugger/step-into-external-async-task-same-context-expected.txt
@@ -5,7 +5,7 @@ Run stepInto with breakOnAsyncCall flag
 Call pauseOnAsyncCall
 Trigger external async task on another context group
 Dump stack trace
-boo (target.js:1:18)
+boo (target.js:1:22)
 call (framework.js:3:2)
 (anonymous) (target.js:0:0)
 -- remote-task --
diff --git a/deps/v8/test/inspector/debugger/step-into-nested-arrow-expected.txt b/deps/v8/test/inspector/debugger/step-into-nested-arrow-expected.txt
index 5061a96a037b26..746b0af6bc6545 100644
--- a/deps/v8/test/inspector/debugger/step-into-nested-arrow-expected.txt
+++ b/deps/v8/test/inspector/debugger/step-into-nested-arrow-expected.txt
@@ -14,4 +14,4 @@ paused
 (anonymous) (test.js:2:5)
 (anonymous) (:0:6)
 paused
-(anonymous) (:0:8)
+(anonymous) (:0:9)
diff --git a/deps/v8/test/inspector/debugger/step-into-next-script-expected.txt b/deps/v8/test/inspector/debugger/step-into-next-script-expected.txt
index 5fbd13ee993ff5..b0e34cceec3e3c 100644
--- a/deps/v8/test/inspector/debugger/step-into-next-script-expected.txt
+++ b/deps/v8/test/inspector/debugger/step-into-next-script-expected.txt
@@ -4,7 +4,7 @@ Running test: testStepOut
 test (foo.js:12:2)
 (anonymous) (:0:0)
 
-(anonymous) (:0:5)
+(anonymous) (:0:6)
 
 (anonymous) (timeout1.js:0:8)
 
@@ -22,11 +22,11 @@ test (foo.js:12:2)
 test (foo.js:13:0)
 (anonymous) (:0:0)
 
-(anonymous) (:0:5)
+(anonymous) (:0:6)
 
 (anonymous) (timeout1.js:0:8)
 
-(anonymous) (timeout1.js:0:34)
+(anonymous) (timeout1.js:0:35)
 
 foo (timeout2.js:2:2)
 
@@ -34,7 +34,7 @@ foo (timeout2.js:2:12)
 
 (anonymous) (timeout3.js:0:8)
 
-(anonymous) (timeout3.js:0:34)
+(anonymous) (timeout3.js:0:35)
 
 
 Running test: testStepInto
@@ -55,11 +55,11 @@ test (foo.js:12:2)
 test (foo.js:13:0)
 (anonymous) (:0:0)
 
-(anonymous) (:0:5)
+(anonymous) (:0:6)
 
 (anonymous) (timeout1.js:0:8)
 
-(anonymous) (timeout1.js:0:34)
+(anonymous) (timeout1.js:0:35)
 
 foo (timeout2.js:2:2)
 
@@ -67,5 +67,5 @@ foo (timeout2.js:2:12)
 
 (anonymous) (timeout3.js:0:8)
 
-(anonymous) (timeout3.js:0:34)
+(anonymous) (timeout3.js:0:35)
 
diff --git a/deps/v8/test/inspector/debugger/step-into-out-expected.txt b/deps/v8/test/inspector/debugger/step-into-out-expected.txt
new file mode 100644
index 00000000000000..c78417eec08978
--- /dev/null
+++ b/deps/v8/test/inspector/debugger/step-into-out-expected.txt
@@ -0,0 +1,169 @@
+Tests for stepInto out different places.
+
+Running test: testStepInOutBranch
+
+      function a() { #b(false); c(); };
+      function b(x) { if (x) { c(); }};
+
+      function a() { b(false); c(); };
+      function b(x) { #if (x) { c(); }};
+      function c() {};
+
+      function a() { b(false); c(); };
+      function b(x) { if (x) { c(); }#};
+      function c() {};
+
+
+      function a() { b(false); #c(); };
+      function b(x) { if (x) { c(); }};
+
+      function b(x) { if (x) { c(); }};
+      function c() {#};
+      a(); b(); c();
+
+
+      function a() { b(false); c(); #};
+      function b(x) { if (x) { c(); }};
+
+
+Running test: testStepInOutTree
+use stepInto..
+
+      function a() { #b(c(d()), d()); c(d()); d(); };
+      function b(x,y) { c(); };
+
+      function c(x) {};
+      function d() {#};
+      a(); b(); c(); d();
+
+
+      function a() { b(#c(d()), d()); c(d()); d(); };
+      function b(x,y) { c(); };
+
+      function b(x,y) { c(); };
+      function c(x) {#};
+      function d() {};
+
+
+      function a() { b(c(d()), #d()); c(d()); d(); };
+      function b(x,y) { c(); };
+
+      function c(x) {};
+      function d() {#};
+      a(); b(); c(); d();
+
+
+      function a() { #b(c(d()), d()); c(d()); d(); };
+      function b(x,y) { c(); };
+
+      function a() { b(c(d()), d()); c(d()); d(); };
+      function b(x,y) { #c(); };
+      function c(x) {};
+
+      function b(x,y) { c(); };
+      function c(x) {#};
+      function d() {};
+
+      function a() { b(c(d()), d()); c(d()); d(); };
+      function b(x,y) { c(); #};
+      function c(x) {};
+
+
+      function a() { b(c(d()), d()); #c(d()); d(); };
+      function b(x,y) { c(); };
+
+      function c(x) {};
+      function d() {#};
+      a(); b(); c(); d();
+
+
+      function a() { b(c(d()), d()); #c(d()); d(); };
+      function b(x,y) { c(); };
+
+      function b(x,y) { c(); };
+      function c(x) {#};
+      function d() {};
+
+
+      function a() { b(c(d()), d()); c(d()); #d(); };
+      function b(x,y) { c(); };
+
+      function c(x) {};
+      function d() {#};
+      a(); b(); c(); d();
+
+
+      function a() { b(c(d()), d()); c(d()); d(); #};
+      function b(x,y) { c(); };
+
+use stepOver..
+
+      function a() { #b(c(d()), d()); c(d()); d(); };
+      function b(x,y) { c(); };
+
+
+      function a() { b(c(d()), d()); #c(d()); d(); };
+      function b(x,y) { c(); };
+
+
+      function a() { b(c(d()), d()); c(d()); #d(); };
+      function b(x,y) { c(); };
+
+
+      function a() { b(c(d()), d()); c(d()); d(); #};
+      function b(x,y) { c(); };
+
+use stepOut..
+
+      function a() { #b(c(d()), d()); c(d()); d(); };
+      function b(x,y) { c(); };
+
+
+Running test: testStepInOutSimple
+use stepInto..
+
+      function a() { #b(); c(); }
+      function b() { c(); }
+
+      function a() { b(); c(); }
+      function b() { #c(); }
+      function c() {}
+
+      function b() { c(); }
+      function c() {#}
+      a(); b(); c();
+
+      function a() { b(); c(); }
+      function b() { c(); #}
+      function c() {}
+
+
+      function a() { b(); #c(); }
+      function b() { c(); }
+
+      function b() { c(); }
+      function c() {#}
+      a(); b(); c();
+
+
+      function a() { b(); c(); #}
+      function b() { c(); }
+
+use stepOver..
+
+      function a() { #b(); c(); }
+      function b() { c(); }
+
+
+      function a() { b(); #c(); }
+      function b() { c(); }
+
+
+      function a() { b(); c(); #}
+      function b() { c(); }
+
+use stepOut..
+
+      function a() { #b(); c(); }
+      function b() { c(); }
+
diff --git a/deps/v8/test/inspector/debugger/step-into-out.js b/deps/v8/test/inspector/debugger/step-into-out.js
new file mode 100644
index 00000000000000..0394da41a9faf1
--- /dev/null
+++ b/deps/v8/test/inspector/debugger/step-into-out.js
@@ -0,0 +1,89 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+let {session, contextGroup, Protocol} = InspectorTest.start(
+  'Tests for stepInto out different places.');
+
+session.setupScriptMap();
+Protocol.Debugger.enable();
+let stepAction;
+Protocol.Debugger.setBlackboxPatterns({patterns: ['expr\.js']});
+Protocol.Debugger.onPaused(async ({params:{callFrames:[topFrame]}}) => {
+  if (stepAction !== 'resume') {
+    await session.logSourceLocation(topFrame.location);
+  }
+  Protocol.Debugger[stepAction]();
+});
+
+InspectorTest.runAsyncTestSuite([
+  async function testStepInOutBranch() {
+    contextGroup.addScript(`
+      function a() { b(false); c(); };
+      function b(x) { if (x) { c(); }};
+      function c() {};
+      a(); b(); c();`);
+    stepAction = 'stepInto';
+    Protocol.Debugger.pause();
+    await Protocol.Runtime.evaluate({expression: 'a()\n//# sourceURL=expr.js'});
+    stepAction = 'resume';
+    await Protocol.Runtime.evaluate({expression: ''});
+  },
+
+  async function testStepInOutTree() {
+    contextGroup.addScript(`
+      function a() { b(c(d()), d()); c(d()); d(); };
+      function b(x,y) { c(); };
+      function c(x) {};
+      function d() {};
+      a(); b(); c(); d();`);
+    stepAction = 'stepInto';
+    Protocol.Debugger.pause();
+    InspectorTest.log('use stepInto..');
+    await Protocol.Runtime.evaluate({expression: 'a()\n//# sourceURL=expr.js'});
+    stepAction = 'resume';
+    await Protocol.Runtime.evaluate({expression: ''});
+
+    stepAction = 'stepOver';
+    Protocol.Debugger.pause();
+    InspectorTest.log('use stepOver..');
+    await Protocol.Runtime.evaluate({expression: 'a()\n//# sourceURL=expr.js'});
+    stepAction = 'resume';
+    await Protocol.Runtime.evaluate({expression: ''});
+
+    stepAction = 'stepOut';
+    Protocol.Debugger.pause();
+    InspectorTest.log('use stepOut..');
+    await Protocol.Runtime.evaluate({expression: 'a()\n//# sourceURL=expr.js'});
+    stepAction = 'resume';
+    await Protocol.Runtime.evaluate({expression: ''});
+  },
+
+  async function testStepInOutSimple() {
+    contextGroup.addScript(`
+      function a() { b(); c(); }
+      function b() { c(); }
+      function c() {}
+      a(); b(); c();`);
+    stepAction = 'stepInto';
+    Protocol.Debugger.pause();
+    InspectorTest.log('use stepInto..');
+    await Protocol.Runtime.evaluate({expression: 'a()\n//# sourceURL=expr.js'});
+    stepAction = 'resume';
+    await Protocol.Runtime.evaluate({expression: ''});
+
+    stepAction = 'stepOver';
+    Protocol.Debugger.pause();
+    InspectorTest.log('use stepOver..');
+    await Protocol.Runtime.evaluate({expression: 'a()\n//# sourceURL=expr.js'});
+    stepAction = 'resume';
+    await Protocol.Runtime.evaluate({expression: ''});
+
+    stepAction = 'stepOut';
+    Protocol.Debugger.pause();
+    InspectorTest.log('use stepOut..');
+    await Protocol.Runtime.evaluate({expression: 'a()\n//# sourceURL=expr.js'});
+    stepAction = 'resume';
+    await Protocol.Runtime.evaluate({expression: ''});
+  }
+]);
diff --git a/deps/v8/test/inspector/debugger/step-snapshot-expected.txt b/deps/v8/test/inspector/debugger/step-snapshot-expected.txt
index 911ca717c868bb..f75a184252aa2a 100644
--- a/deps/v8/test/inspector/debugger/step-snapshot-expected.txt
+++ b/deps/v8/test/inspector/debugger/step-snapshot-expected.txt
@@ -31,5 +31,5 @@ paused
 #}
 
 paused
-test(#)
+test()#
 
diff --git a/deps/v8/test/inspector/debugger/stepping-tail-call-expected.txt b/deps/v8/test/inspector/debugger/stepping-tail-call-expected.txt
index 95b21b49b63dd1..52dda5b260a0b6 100644
--- a/deps/v8/test/inspector/debugger/stepping-tail-call-expected.txt
+++ b/deps/v8/test/inspector/debugger/stepping-tail-call-expected.txt
@@ -65,10 +65,9 @@ f (:3:27)
 }
 
 Debugger.stepOver called
-(anonymous) (:5:5)
-}
-f(5);#
-
+(anonymous) (:6:0)
+f(5);
+#
 
 Debugger.resume called
 
@@ -107,10 +106,9 @@ f (:3:27)
 }
 
 Debugger.stepOut called
-(anonymous) (:5:5)
-}
-f(5);#
-
+(anonymous) (:6:0)
+f(5);
+#
 
 Debugger.resume called
 
@@ -169,9 +167,8 @@ f (:3:27)
 }
 
 Debugger.stepOut called
-(anonymous) (:5:5)
-}
-f(5);#
-
+(anonymous) (:6:0)
+f(5);
+#
 
 Debugger.resume called
diff --git a/deps/v8/test/inspector/debugger/stepping-with-natives-and-frameworks-expected.txt b/deps/v8/test/inspector/debugger/stepping-with-natives-and-frameworks-expected.txt
index ac26a16c52944a..652024c5f98267 100644
--- a/deps/v8/test/inspector/debugger/stepping-with-natives-and-frameworks-expected.txt
+++ b/deps/v8/test/inspector/debugger/stepping-with-natives-and-frameworks-expected.txt
@@ -8,7 +8,7 @@ Debugger.stepInto called
 [1,2].map(v => #v);
 
 Debugger.stepOut called
-[1,2].map(v => v)#;
+[1,2].map(v => v);#
 
 Debugger.resume called
 
@@ -29,7 +29,7 @@ Debugger.stepOver called
 [1,2].map(v => v#);
 
 Debugger.stepOver called
-[1,2].map(v => v)#;
+[1,2].map(v => v);#
 
 Debugger.resume called
 
@@ -50,7 +50,7 @@ Debugger.stepInto called
 [1,2].map(v => v#);
 
 Debugger.stepInto called
-[1,2].map(v => v)#;
+[1,2].map(v => v);#
 
 Debugger.resume called
 
@@ -71,7 +71,7 @@ Debugger.stepInto called
 callAll(() => 1, () => 2#);
 
 Debugger.stepInto called
-callAll(() => 1, () => 2)#;
+callAll(() => 1, () => 2);#
 
 Debugger.resume called
 
@@ -92,7 +92,7 @@ Debugger.stepOver called
 callAll(() => 1, () => 2#);
 
 Debugger.stepOver called
-callAll(() => 1, () => 2)#;
+callAll(() => 1, () => 2);#
 
 Debugger.resume called
 
@@ -107,7 +107,7 @@ Debugger.stepOut called
 callAll(() => 1, () => #2);
 
 Debugger.stepOut called
-callAll(() => 1, () => 2)#;
+callAll(() => 1, () => 2);#
 
 Debugger.resume called
 
@@ -122,7 +122,7 @@ Debugger.stepOut called
 callAll(() => 1, callAll.bind(null, () => #2));
 
 Debugger.stepOut called
-callAll(() => 1, callAll.bind(null, () => 2))#;
+callAll(() => 1, callAll.bind(null, () => 2));#
 
 Debugger.resume called
 
@@ -134,7 +134,7 @@ Debugger.stepInto called
 foo = () => #1
 
 Debugger.stepOut called
-callAll(foo, callAll.bind(null, foo))#;
+callAll(foo, callAll.bind(null, foo));#
 
 Debugger.resume called
 
@@ -155,7 +155,7 @@ Debugger.stepOver called
 callAll(() => 1, callAll.bind(null, () => 2#));
 
 Debugger.stepOver called
-callAll(() => 1, callAll.bind(null, () => 2))#;
+callAll(() => 1, callAll.bind(null, () => 2));#
 
 Debugger.resume called
 
@@ -176,7 +176,7 @@ Debugger.stepOver called
 callAll(() => 1, callAll.bind(null, () => 2#));
 
 Debugger.stepOver called
-callAll(() => 1, callAll.bind(null, () => 2))#;
+callAll(() => 1, callAll.bind(null, () => 2));#
 
 Debugger.resume called
 
@@ -191,7 +191,7 @@ Debugger.stepOut called
 callAll(callAll.bind(null, () => 1), () => #2);
 
 Debugger.stepOut called
-callAll(callAll.bind(null, () => 1), () => 2)#;
+callAll(callAll.bind(null, () => 1), () => 2);#
 
 Debugger.resume called
 
@@ -203,7 +203,7 @@ Debugger.stepInto called
 foo = () => #1
 
 Debugger.stepOut called
-callAll(callAll.bind(null, foo), foo)#;
+callAll(callAll.bind(null, foo), foo);#
 
 Debugger.resume called
 
@@ -224,7 +224,7 @@ Debugger.stepOver called
 callAll(callAll.bind(null, () => 1), () => 2#);
 
 Debugger.stepOver called
-callAll(callAll.bind(null, () => 1), () => 2)#;
+callAll(callAll.bind(null, () => 1), () => 2);#
 
 Debugger.resume called
 
@@ -245,7 +245,7 @@ Debugger.stepInto called
 callAll(callAll.bind(null, () => 1), () => 2#);
 
 Debugger.stepInto called
-callAll(callAll.bind(null, () => 1), () => 2)#;
+callAll(callAll.bind(null, () => 1), () => 2);#
 
 Debugger.resume called
 
@@ -272,7 +272,7 @@ Debugger.stepOver called
 callAll(foo, foo, () => 2#);
 
 Debugger.stepOver called
-callAll(foo, foo, () => 2)#;
+callAll(foo, foo, () => 2);#
 
 Debugger.resume called
 
@@ -287,7 +287,7 @@ Debugger.stepOut called
 callAll(foo, foo, () => #2);
 
 Debugger.stepOut called
-callAll(foo, foo, () => 2)#;
+callAll(foo, foo, () => 2);#
 
 Debugger.resume called
 
@@ -305,6 +305,6 @@ Debugger.stepOut called
 callAll(foo, foo, () => #2);
 
 Debugger.stepOut called
-callAll(foo, foo, () => 2)#;
+callAll(foo, foo, () => 2);#
 
 Debugger.resume called
diff --git a/deps/v8/test/inspector/debugger/suspended-generator-scopes-expected.txt b/deps/v8/test/inspector/debugger/suspended-generator-scopes-expected.txt
index 57dc2aa6eeed75..537ba3a3757322 100644
--- a/deps/v8/test/inspector/debugger/suspended-generator-scopes-expected.txt
+++ b/deps/v8/test/inspector/debugger/suspended-generator-scopes-expected.txt
@@ -6,11 +6,11 @@ Running test: testScopesPaused
         configurable : true
         enumerable : true
         isOwn : true
-        name : b
+        name : a
         value : {
-            description : 42
+            description : 420
             type : number
-            value : 42
+            value : 420
         }
         writable : true
     }
@@ -18,11 +18,11 @@ Running test: testScopesPaused
         configurable : true
         enumerable : true
         isOwn : true
-        name : a
+        name : b
         value : {
-            description : 420
+            description : 42
             type : number
-            value : 420
+            value : 42
         }
         writable : true
     }
@@ -34,9 +34,11 @@ Running test: testScopesNonPaused
         configurable : true
         enumerable : true
         isOwn : true
-        name : b
+        name : a
         value : {
-            type : undefined
+            description : 430
+            type : number
+            value : 430
         }
         writable : true
     }
@@ -44,11 +46,9 @@ Running test: testScopesNonPaused
         configurable : true
         enumerable : true
         isOwn : true
-        name : a
+        name : b
         value : {
-            description : 430
-            type : number
-            value : 430
+            type : undefined
         }
         writable : true
     }
diff --git a/deps/v8/test/inspector/debugger/terminate-execution-on-pause-expected.txt b/deps/v8/test/inspector/debugger/terminate-execution-on-pause-expected.txt
new file mode 100644
index 00000000000000..d1a3c7b6269b52
--- /dev/null
+++ b/deps/v8/test/inspector/debugger/terminate-execution-on-pause-expected.txt
@@ -0,0 +1,5 @@
+Tests Runtime.terminateExecution on pause
+
+Running test: testTerminateOnDebugger
+
+Running test: testTerminateAtBreakpoint
diff --git a/deps/v8/test/inspector/debugger/terminate-execution-on-pause.js b/deps/v8/test/inspector/debugger/terminate-execution-on-pause.js
new file mode 100644
index 00000000000000..3f1ea39f02acb4
--- /dev/null
+++ b/deps/v8/test/inspector/debugger/terminate-execution-on-pause.js
@@ -0,0 +1,43 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+let {session, contextGroup, Protocol} =
+    InspectorTest.start('Tests Runtime.terminateExecution on pause');
+
+Protocol.Runtime.enable();
+Protocol.Runtime.onConsoleAPICalled(
+    message => InspectorTest.logMessage(message.params.args[0]));
+Protocol.Debugger.enable();
+
+InspectorTest.runAsyncTestSuite([
+  async function testTerminateOnDebugger() {
+    Protocol.Runtime.evaluate({expression: `
+function callback() {
+  debugger;
+  console.log(42);
+  setTimeout(callback, 0);
+}
+callback();
+//# sourceURL=test.js`});
+    await Protocol.Debugger.oncePaused();
+    const terminated = Protocol.Runtime.terminateExecution();
+    Protocol.Debugger.resume();
+    await terminated;
+  },
+
+  async function testTerminateAtBreakpoint() {
+    Protocol.Debugger.setBreakpointByUrl({url: 'test.js', lineNumber: 2});
+    Protocol.Runtime.evaluate({expression: `
+function callback() {
+  console.log(42);
+  setTimeout(callback, 0);
+}
+callback();
+//# sourceURL=test.js`});
+    await Protocol.Debugger.oncePaused();
+    const terminated = Protocol.Runtime.terminateExecution();
+    Protocol.Debugger.resume();
+    await terminated;
+  }
+]);
diff --git a/deps/v8/test/inspector/debugger/wasm-set-breakpoint-expected.txt b/deps/v8/test/inspector/debugger/wasm-set-breakpoint-expected.txt
new file mode 100644
index 00000000000000..4aa2f9721391ef
--- /dev/null
+++ b/deps/v8/test/inspector/debugger/wasm-set-breakpoint-expected.txt
@@ -0,0 +1,62 @@
+Tests stepping through wasm scripts
+Installing code an global variable.
+Calling instantiate function.
+Waiting for two wasm scripts to be parsed.
+Ignoring script with url v8://test/callInstantiate
+Got wasm script: wasm://wasm/wasm-0c10a5fe/wasm-0c10a5fe-0
+Requesting source for wasm://wasm/wasm-0c10a5fe/wasm-0c10a5fe-0...
+Got wasm script: wasm://wasm/wasm-0c10a5fe/wasm-0c10a5fe-1
+Requesting source for wasm://wasm/wasm-0c10a5fe/wasm-0c10a5fe-1...
+func $wasm_A
+  nop
+  nop
+end
+
+func $wasm_B (param i32)
+  loop
+    get_local 0
+    if
+      get_local 0
+      i32.const 1
+      i32.sub
+      set_local 0
+      call 0
+      br 1
+    end
+  end
+end
+
+Setting breakpoint on line 8 (on the setlocal before the call), url wasm://wasm/wasm-0c10a5fe/wasm-0c10a5fe-1
+Setting breakpoint on line 7 (on the setlocal before the call), url wasm://wasm/wasm-0c10a5fe/wasm-0c10a5fe-1
+Setting breakpoint on line 6 (on the setlocal before the call), url wasm://wasm/wasm-0c10a5fe/wasm-0c10a5fe-1
+Setting breakpoint on line 5 (on the setlocal before the call), url wasm://wasm/wasm-0c10a5fe/wasm-0c10a5fe-1
+Setting breakpoint on line 3 (on the setlocal before the call), url wasm://wasm/wasm-0c10a5fe/wasm-0c10a5fe-1
+Setting breakpoint on line 4  (on the setlocal before the call), url wasm://wasm/wasm-0c10a5fe/wasm-0c10a5fe-1
+3
+4
+5
+6
+7
+8
+3
+4
+5
+6
+7
+8
+3
+4
+5
+6
+7
+8
+3
+4
+5
+6
+7
+8
+3
+exports.main returned!
+Finished!
+
diff --git a/deps/v8/test/inspector/debugger/wasm-set-breakpoint.js b/deps/v8/test/inspector/debugger/wasm-set-breakpoint.js
new file mode 100644
index 00000000000000..828fac3c547f22
--- /dev/null
+++ b/deps/v8/test/inspector/debugger/wasm-set-breakpoint.js
@@ -0,0 +1,158 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+let {session, contextGroup, Protocol} = InspectorTest.start('Tests stepping through wasm scripts');
+
+utils.load('test/mjsunit/wasm/wasm-constants.js');
+utils.load('test/mjsunit/wasm/wasm-module-builder.js');
+
+var builder = new WasmModuleBuilder();
+
+var func_a_idx =
+    builder.addFunction('wasm_A', kSig_v_v).addBody([kExprNop, kExprNop]).index;
+
+// wasm_B calls wasm_A <param0> times.
+builder.addFunction('wasm_B', kSig_v_i)
+    .addBody([
+      // clang-format off
+      kExprLoop, kWasmStmt,               // while
+        kExprGetLocal, 0,                 // -
+        kExprIf, kWasmStmt,               // if <param0> != 0
+          kExprGetLocal, 0,               // -
+          kExprI32Const, 1,               // -
+          kExprI32Sub,                    // -
+          kExprSetLocal, 0,               // decrease <param0>
+          kExprCallFunction, func_a_idx,  // -
+          kExprBr, 1,                     // continue
+          kExprEnd,                       // -
+        kExprEnd,                         // break
+      // clang-format on
+    ])
+    .exportAs('main');
+
+var module_bytes = builder.toArray();
+
+function instantiate(bytes) {
+  var buffer = new ArrayBuffer(bytes.length);
+  var view = new Uint8Array(buffer);
+  for (var i = 0; i < bytes.length; ++i) {
+    view[i] = bytes[i] | 0;
+  }
+
+  var module = new WebAssembly.Module(buffer);
+  // Set global variable.
+  instance = new WebAssembly.Instance(module);
+}
+
+var evalWithUrl = (code, url) => Protocol.Runtime.evaluate(
+    {'expression': code + '\n//# sourceURL=v8://test/' + url});
+
+var wasm_B_scriptId;
+var sources = {};
+var urls = {};
+var afterTwoSourcesCallback;
+
+Protocol.Debugger.onPaused((msg) => {
+  var loc = msg.params.callFrames[0].location;
+  InspectorTest.log(loc.lineNumber);
+  Protocol.Debugger.resume();
+});
+Protocol.Debugger.enable()
+    .then(() => InspectorTest.log('Installing code an global variable.'))
+    .then(
+        () => evalWithUrl('var instance;\n' + instantiate.toString(), 'setup'))
+    .then(() => InspectorTest.log('Calling instantiate function.'))
+    .then(
+        () =>
+            (evalWithUrl(
+                 'instantiate(' + JSON.stringify(module_bytes) + ')',
+                 'callInstantiate'),
+             0))
+    .then(waitForTwoWasmScripts)
+    .then(
+        () => InspectorTest.log(
+            'Setting breakpoint on line 8 (on the setlocal before the call), url ' +
+            urls[wasm_B_scriptId]))
+    .then(
+        () => Protocol.Debugger.setBreakpoint(
+            {'location': {'scriptId': wasm_B_scriptId, 'lineNumber': 8}}))
+    .then(
+        () => InspectorTest.log(
+            'Setting breakpoint on line 7 (on the setlocal before the call), url ' +
+            urls[wasm_B_scriptId]))
+    .then(
+        () => Protocol.Debugger.setBreakpoint(
+            {'location': {'scriptId': wasm_B_scriptId, 'lineNumber': 7}}))
+    .then(
+        () => InspectorTest.log(
+            'Setting breakpoint on line 6 (on the setlocal before the call), url ' +
+            urls[wasm_B_scriptId]))
+    .then(
+        () => Protocol.Debugger.setBreakpoint(
+            {'location': {'scriptId': wasm_B_scriptId, 'lineNumber': 6}}))
+    .then(
+        () => InspectorTest.log(
+            'Setting breakpoint on line 5 (on the setlocal before the call), url ' +
+            urls[wasm_B_scriptId]))
+    .then(
+        () => Protocol.Debugger.setBreakpoint(
+            {'location': {'scriptId': wasm_B_scriptId, 'lineNumber': 5}}))
+    .then(
+        () => InspectorTest.log(
+            'Setting breakpoint on line 3 (on the setlocal before the call), url ' +
+            urls[wasm_B_scriptId]))
+    .then(
+        () => Protocol.Debugger.setBreakpoint(
+            {'location': {'scriptId': wasm_B_scriptId, 'lineNumber': 3}}))
+    .then(
+        () => InspectorTest.log(
+            'Setting breakpoint on line 4  (on the setlocal before the call), url ' +
+            urls[wasm_B_scriptId]))
+    .then(
+        () => Protocol.Debugger.setBreakpoint(
+            {'location': {'scriptId': wasm_B_scriptId, 'lineNumber': 4}}))
+    .then(printFailure)
+    .then(() => evalWithUrl('instance.exports.main(4)', 'runWasm'))
+    .then(() => InspectorTest.log('exports.main returned!'))
+    .then(() => InspectorTest.log('Finished!'))
+    .then(InspectorTest.completeTest);
+
+function printFailure(message) {
+  if (!message.result) {
+    InspectorTest.logMessage(message);
+  }
+  return message;
+}
+
+function waitForTwoWasmScripts() {
+  var num = 0;
+  InspectorTest.log('Waiting for two wasm scripts to be parsed.');
+  var promise = new Promise(fulfill => gotBothSources = fulfill);
+  function waitForMore() {
+    if (num == 2) return promise;
+    Protocol.Debugger.onceScriptParsed()
+        .then(handleNewScript)
+        .then(waitForMore);
+  }
+  function handleNewScript(msg) {
+    var url = msg.params.url;
+    if (!url.startsWith('wasm://')) {
+      InspectorTest.log('Ignoring script with url ' + url);
+      return;
+    }
+    num += 1;
+    var scriptId = msg.params.scriptId;
+    urls[scriptId] = url;
+    InspectorTest.log('Got wasm script: ' + url);
+    if (url.substr(-2) == '-1') wasm_B_scriptId = scriptId;
+    InspectorTest.log('Requesting source for ' + url + '...');
+    Protocol.Debugger.getScriptSource({scriptId: scriptId})
+        .then(printFailure)
+        .then(msg => sources[scriptId] = msg.result.scriptSource)
+        .then(InspectorTest.log)
+        .then(() => Object.keys(sources).length == 2 ? gotBothSources() : 0);
+  }
+  waitForMore();
+  return promise;
+}
diff --git a/deps/v8/test/inspector/inspector-test.cc b/deps/v8/test/inspector/inspector-test.cc
index 513699fa6f323e..668a9463d5b9cf 100644
--- a/deps/v8/test/inspector/inspector-test.cc
+++ b/deps/v8/test/inspector/inspector-test.cc
@@ -240,6 +240,7 @@ class ExecuteStringTask : public TaskRunner::Task {
                           expression_utf8_.length());
 
     v8::ScriptCompiler::Source scriptSource(source, origin);
+    v8::Isolate::SafeForTerminationScope allowTermination(data->isolate());
     if (!is_module_) {
       v8::Local<v8::Script> script;
       if (!v8::ScriptCompiler::Compile(context, &scriptSource).ToLocal(&script))
@@ -974,6 +975,50 @@ class InspectorExtension : public IsolateData::SetupGlobalTask {
   }
 };
 
+bool RunExtraCode(v8::Isolate* isolate, v8::Local<v8::Context> context,
+                  const char* utf8_source, const char* name) {
+  v8::Context::Scope context_scope(context);
+  v8::TryCatch try_catch(isolate);
+  v8::Local<v8::String> source_string;
+  if (!v8::String::NewFromUtf8(isolate, utf8_source, v8::NewStringType::kNormal)
+           .ToLocal(&source_string)) {
+    return false;
+  }
+  v8::Local<v8::String> resource_name =
+      v8::String::NewFromUtf8(isolate, name, v8::NewStringType::kNormal)
+          .ToLocalChecked();
+  v8::ScriptOrigin origin(resource_name);
+  v8::ScriptCompiler::Source source(source_string, origin);
+  v8::Local<v8::Script> script;
+  if (!v8::ScriptCompiler::Compile(context, &source).ToLocal(&script))
+    return false;
+  if (script->Run(context).IsEmpty()) return false;
+  CHECK(!try_catch.HasCaught());
+  return true;
+}
+
+v8::StartupData CreateSnapshotDataBlob(const char* embedded_source = nullptr) {
+  // Create a new isolate and a new context from scratch, optionally run
+  // a script to embed, and serialize to create a snapshot blob.
+  v8::StartupData result = {nullptr, 0};
+  {
+    v8::SnapshotCreator snapshot_creator;
+    v8::Isolate* isolate = snapshot_creator.GetIsolate();
+    {
+      v8::HandleScope scope(isolate);
+      v8::Local<v8::Context> context = v8::Context::New(isolate);
+      if (embedded_source != nullptr &&
+          !RunExtraCode(isolate, context, embedded_source, "<embedded>")) {
+        return result;
+      }
+      snapshot_creator.SetDefaultContext(context);
+    }
+    result = snapshot_creator.CreateBlob(
+        v8::SnapshotCreator::FunctionCodeHandling::kClear);
+  }
+  return result;
+}
+
 }  //  namespace
 
 int main(int argc, char* argv[]) {
@@ -991,7 +1036,7 @@ int main(int argc, char* argv[]) {
     if (strcmp(argv[i], "--embed") == 0) {
       argv[i++] = nullptr;
       printf("Embedding script '%s'\n", argv[i]);
-      startup_data = v8::V8::CreateSnapshotDataBlob(argv[i]);
+      startup_data = CreateSnapshotDataBlob(argv[i]);
       argv[i] = nullptr;
     }
   }
diff --git a/deps/v8/test/inspector/inspector.status b/deps/v8/test/inspector/inspector.status
index 0fb349eceae3f0..25ffec6180234b 100644
--- a/deps/v8/test/inspector/inspector.status
+++ b/deps/v8/test/inspector/inspector.status
@@ -12,16 +12,22 @@
   'debugger/update-call-frame-scopes': [PASS, FAIL],
   'debugger/side-effect-free-debug-evaluate': [PASS, FAIL],
   'debugger/evaluate-on-call-frame-in-module': [PASS, FAIL],
-  # Issue 6170. Crash.
-  'cpu-profiler/console-profile': [SKIP],
-  'cpu-profiler/console-profile-end-parameterless-crash': [SKIP],
-  # Issue 6171. Timeout.
-  'debugger/set-blackbox-patterns': [SKIP],
 }],  # variant != default
 
 ##############################################################################
-['variant == wasm_traps', {
+['variant == no_wasm_traps', {
   '*': [SKIP],
-}],  # variant == wasm_traps
+}],  # variant == no_wasm_traps
 
+##############################################################################
+['arch == s390 or arch == s390x', {
+  # Stack manipulations in LiveEdit is not implemented for this arch.
+  'debugger/set-script-source-stack-padding': [SKIP],
+}],  # 'arch == s390 or arch == s390x'
+
+##############################################################################
+[ALWAYS, {
+  # https://crbug.com/v8/7767
+  'debugger/wasm-imports': [SKIP],
+}],  # ALWAYS
 ]
diff --git a/deps/v8/test/inspector/isolate-data.cc b/deps/v8/test/inspector/isolate-data.cc
index a18ef90ca04b98..15eee89a61faa2 100644
--- a/deps/v8/test/inspector/isolate-data.cc
+++ b/deps/v8/test/inspector/isolate-data.cc
@@ -63,6 +63,7 @@ IsolateData::IsolateData(TaskRunner* task_runner,
   params.array_buffer_allocator =
       v8::ArrayBuffer::Allocator::NewDefaultAllocator();
   params.snapshot_blob = startup_data;
+  params.only_terminate_in_safe_scope = true;
   isolate_.reset(v8::Isolate::New(params));
   isolate_->SetMicrotasksPolicy(v8::MicrotasksPolicy::kScoped);
   if (with_inspector) {
diff --git a/deps/v8/test/inspector/protocol-test.js b/deps/v8/test/inspector/protocol-test.js
index 9b7ba0aafe6f37..a9412806727583 100644
--- a/deps/v8/test/inspector/protocol-test.js
+++ b/deps/v8/test/inspector/protocol-test.js
@@ -120,6 +120,12 @@ InspectorTest.ContextGroup = class {
     utils.compileAndRunWithOrigin(this.id, string, url || '', lineOffset || 0, columnOffset || 0, false);
   }
 
+  addInlineScript(string, url) {
+    const match = (new Error().stack).split('\n')[2].match(/([0-9]+):([0-9]+)/);
+    this.addScript(
+        string, match[1] * 1, match[1] * 1 + '.addInlineScript('.length, url);
+  }
+
   addModule(string, url, lineOffset, columnOffset) {
     utils.compileAndRunWithOrigin(this.id, string, url, lineOffset || 0, columnOffset || 0, true);
   }
@@ -213,7 +219,8 @@ InspectorTest.Session = class {
   logCallFrames(callFrames) {
     for (var frame of callFrames) {
       var functionName = frame.functionName || '(anonymous)';
-      var url = frame.url ? frame.url : this._scriptMap.get(frame.location.scriptId).url;
+      var scriptId = frame.location ? frame.location.scriptId : frame.scriptId;
+      var url = frame.url ? frame.url : this._scriptMap.get(scriptId).url;
       var lineNumber = frame.location ? frame.location.lineNumber : frame.lineNumber;
       var columnNumber = frame.location ? frame.location.columnNumber : frame.columnNumber;
       InspectorTest.log(`${functionName} (${url}:${lineNumber}:${columnNumber})`);
diff --git a/deps/v8/test/inspector/runtime/add-binding-expected.txt b/deps/v8/test/inspector/runtime/add-binding-expected.txt
new file mode 100644
index 00000000000000..94d5ed4e0ac7bc
--- /dev/null
+++ b/deps/v8/test/inspector/runtime/add-binding-expected.txt
@@ -0,0 +1,99 @@
+Test for Runtime.addBinding.
+
+Running test: testBasic
+
+Add binding inside session1..
+Call binding..
+binding called in session1
+{
+    method : Runtime.bindingCalled
+    params : {
+        executionContextId : <executionContextId>
+        name : send
+        payload : payload
+    }
+}
+
+Add binding inside session2..
+Call binding..
+binding called in session1
+{
+    method : Runtime.bindingCalled
+    params : {
+        executionContextId : <executionContextId>
+        name : send
+        payload : payload
+    }
+}
+binding called in session2
+{
+    method : Runtime.bindingCalled
+    params : {
+        executionContextId : <executionContextId>
+        name : send
+        payload : payload
+    }
+}
+
+Disable agent inside session1..
+Call binding..
+binding called in session2
+{
+    method : Runtime.bindingCalled
+    params : {
+        executionContextId : <executionContextId>
+        name : send
+        payload : payload
+    }
+}
+
+Disable agent inside session2..
+Call binding..
+
+Enable agent inside session1..
+Call binding..
+
+Running test: testReconnect
+
+Add binding inside session..
+Reconnect..
+binding called in session1
+{
+    method : Runtime.bindingCalled
+    params : {
+        executionContextId : <executionContextId>
+        name : send
+        payload : payload
+    }
+}
+
+Running test: testBindingOverrides
+
+Add send function on global object..
+Add binding inside session..
+Call binding..
+binding called in session1
+{
+    method : Runtime.bindingCalled
+    params : {
+        executionContextId : <executionContextId>
+        name : send
+        payload : payload
+    }
+}
+
+Running test: testRemoveBinding
+
+Add binding inside session..
+Call binding..
+binding called in session1
+{
+    method : Runtime.bindingCalled
+    params : {
+        executionContextId : <executionContextId>
+        name : send
+        payload : payload
+    }
+}
+Remove binding inside session..
+Call binding..
diff --git a/deps/v8/test/inspector/runtime/add-binding.js b/deps/v8/test/inspector/runtime/add-binding.js
new file mode 100644
index 00000000000000..78e8d00be77dba
--- /dev/null
+++ b/deps/v8/test/inspector/runtime/add-binding.js
@@ -0,0 +1,82 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+InspectorTest.log('Test for Runtime.addBinding.');
+
+InspectorTest.runAsyncTestSuite([
+  async function testBasic() {
+    const {contextGroup, sessions: [session1, session2]} = setupSessions(2);
+
+    InspectorTest.log('\nAdd binding inside session1..');
+    session1.Protocol.Runtime.addBinding({name: 'send'});
+    InspectorTest.log('Call binding..');
+    await session1.Protocol.Runtime.evaluate({expression: `send('payload')`});
+
+    InspectorTest.log('\nAdd binding inside session2..');
+    session2.Protocol.Runtime.addBinding({name: 'send'});
+    InspectorTest.log('Call binding..');
+    await session2.Protocol.Runtime.evaluate({expression: `send('payload')`});
+
+    InspectorTest.log('\nDisable agent inside session1..');
+    session1.Protocol.Runtime.disable();
+    InspectorTest.log('Call binding..');
+    await session2.Protocol.Runtime.evaluate({expression: `send('payload')`});
+
+    InspectorTest.log('\nDisable agent inside session2..');
+    session2.Protocol.Runtime.disable();
+    InspectorTest.log('Call binding..');
+    await session2.Protocol.Runtime.evaluate({expression: `send('payload')`});
+
+    InspectorTest.log('\nEnable agent inside session1..');
+    session1.Protocol.Runtime.enable();
+    InspectorTest.log('Call binding..');
+    await session2.Protocol.Runtime.evaluate({expression: `send('payload')`});
+  },
+
+  async function testReconnect() {
+    const {contextGroup, sessions: [session]} = setupSessions(1);
+    InspectorTest.log('\nAdd binding inside session..');
+    await session.Protocol.Runtime.addBinding({name: 'send'});
+    InspectorTest.log('Reconnect..');
+    session.reconnect();
+    await session.Protocol.Runtime.evaluate({expression: `send('payload')`});
+  },
+
+  async function testBindingOverrides() {
+    const {contextGroup, sessions: [session]} = setupSessions(1);
+    InspectorTest.log('\nAdd send function on global object..');
+    session.Protocol.Runtime.evaluate({expression: 'send = () => 42'});
+    InspectorTest.log('Add binding inside session..');
+    session.Protocol.Runtime.addBinding({name: 'send'});
+    InspectorTest.log('Call binding..');
+    await session.Protocol.Runtime.evaluate({expression: `send('payload')`});
+  },
+
+  async function testRemoveBinding() {
+    const {contextGroup, sessions: [session]} = setupSessions(1);
+    InspectorTest.log('\nAdd binding inside session..');
+    session.Protocol.Runtime.addBinding({name: 'send'});
+    InspectorTest.log('Call binding..');
+    await session.Protocol.Runtime.evaluate({expression: `send('payload')`});
+    InspectorTest.log('Remove binding inside session..');
+    session.Protocol.Runtime.removeBinding({name: 'send'});
+    InspectorTest.log('Call binding..');
+    await session.Protocol.Runtime.evaluate({expression: `send('payload')`});
+  }
+]);
+
+function setupSessions(num) {
+  const contextGroup = new InspectorTest.ContextGroup();
+  const sessions = [];
+  for (let i = 0; i < num; ++i) {
+    const session = contextGroup.connect();
+    sessions.push(session);
+    session.Protocol.Runtime.enable();
+    session.Protocol.Runtime.onBindingCalled(msg => {
+      InspectorTest.log(`binding called in session${i + 1}`);
+      InspectorTest.logMessage(msg);
+    });
+  }
+  return {contextGroup, sessions};
+}
diff --git a/deps/v8/test/inspector/runtime/command-line-api-without-side-effects-expected.txt b/deps/v8/test/inspector/runtime/command-line-api-without-side-effects-expected.txt
new file mode 100644
index 00000000000000..6eb4438a4898cf
--- /dev/null
+++ b/deps/v8/test/inspector/runtime/command-line-api-without-side-effects-expected.txt
@@ -0,0 +1,134 @@
+Tests Command Line API evaluations with throwOnSideEffect.
+
+Expression: console.memory
+42
+
+Expression: $_
+43
+
+Expression: $0
+undefined
+
+Expression: $1
+undefined
+
+Expression: $2
+undefined
+
+Expression: $3
+undefined
+
+Expression: $4
+undefined
+
+Method: console.debug
+EvalError: Possible side-effect in debug-evaluate
+function debug() { [native code] }
+
+Method: console.error
+EvalError: Possible side-effect in debug-evaluate
+function error() { [native code] }
+
+Method: console.info
+EvalError: Possible side-effect in debug-evaluate
+function info() { [native code] }
+
+Method: console.log
+EvalError: Possible side-effect in debug-evaluate
+function log() { [native code] }
+
+Method: console.warn
+EvalError: Possible side-effect in debug-evaluate
+function warn() { [native code] }
+
+Method: console.dir
+EvalError: Possible side-effect in debug-evaluate
+function dir() { [native code] }
+
+Method: console.dirxml
+EvalError: Possible side-effect in debug-evaluate
+function dirxml() { [native code] }
+
+Method: console.table
+EvalError: Possible side-effect in debug-evaluate
+function table() { [native code] }
+
+Method: console.trace
+EvalError: Possible side-effect in debug-evaluate
+function trace() { [native code] }
+
+Method: console.group
+EvalError: Possible side-effect in debug-evaluate
+function group() { [native code] }
+
+Method: console.groupEnd
+EvalError: Possible side-effect in debug-evaluate
+function groupEnd() { [native code] }
+
+Method: console.groupCollapsed
+EvalError: Possible side-effect in debug-evaluate
+function groupCollapsed() { [native code] }
+
+Method: console.clear
+EvalError: Possible side-effect in debug-evaluate
+function clear() { [native code] }
+
+Method: console.count
+EvalError: Possible side-effect in debug-evaluate
+function count() { [native code] }
+
+Method: console.assert
+EvalError: Possible side-effect in debug-evaluate
+function assert() { [native code] }
+
+Method: console.profile
+EvalError: Possible side-effect in debug-evaluate
+function profile() { [native code] }
+
+Method: console.profileEnd
+EvalError: Possible side-effect in debug-evaluate
+function profileEnd() { [native code] }
+
+Method: console.time
+EvalError: Possible side-effect in debug-evaluate
+function time() { [native code] }
+
+Method: console.timeEnd
+EvalError: Possible side-effect in debug-evaluate
+function timeEnd() { [native code] }
+
+Method: debug
+EvalError: Possible side-effect in debug-evaluate
+function debug(function, condition) { [Command Line API] }
+
+Method: undebug
+EvalError: Possible side-effect in debug-evaluate
+function undebug(function) { [Command Line API] }
+
+Method: monitor
+EvalError: Possible side-effect in debug-evaluate
+function monitor(function) { [Command Line API] }
+
+Method: unmonitor
+EvalError: Possible side-effect in debug-evaluate
+function unmonitor(function) { [Command Line API] }
+
+Method: keys
+Array(2)
+function keys(object) { [Command Line API] }
+
+Method: values
+Array(2)
+function values(object) { [Command Line API] }
+
+Method: inspect
+EvalError: Possible side-effect in debug-evaluate
+function inspect(object) { [Command Line API] }
+
+Method: copy
+EvalError: Possible side-effect in debug-evaluate
+function copy(value) { [Command Line API] }
+
+Method: queryObjects
+EvalError: Possible side-effect in debug-evaluate
+function queryObjects(constructor) { [Command Line API] }
diff --git a/deps/v8/test/inspector/runtime/command-line-api-without-side-effects.js b/deps/v8/test/inspector/runtime/command-line-api-without-side-effects.js
new file mode 100644
index 00000000000000..7b050234b00203
--- /dev/null
+++ b/deps/v8/test/inspector/runtime/command-line-api-without-side-effects.js
@@ -0,0 +1,83 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+let {session, contextGroup, Protocol} = InspectorTest.start(
+    'Tests Command Line API evaluations with throwOnSideEffect.');
+
+session.setupScriptMap();
+contextGroup.addScript(`
+    function f() {
+    }
+    var obj = {x: 1, y: 2};
+    //# sourceURL=test.js`);
+Protocol.Runtime.enable();
+Protocol.Debugger.enable();
+
+(async function() {
+  utils.setMemoryInfoForTest(42);
+  await testExpression('console.memory');
+  await Protocol.Runtime.evaluate(
+      {expression: '43', objectGroup: 'console', includeCommandLineAPI: true});
+  await testExpression('$_');
+  await testExpression('$0');
+  await testExpression('$1');
+  await testExpression('$2');
+  await testExpression('$3');
+  await testExpression('$4');
+  await testMethod('console.debug');
+  await testMethod('console.error');
+  await testMethod('console.info');
+  await testMethod('console.log');
+  await testMethod('console.warn');
+  await testMethod('console.dir');
+  await testMethod('console.dirxml');
+  await testMethod('console.table');
+  await testMethod('console.trace');
+  await testMethod('console.group');
+  await testMethod('console.groupEnd');
+  await testMethod('console.groupCollapsed');
+  await testMethod('console.clear');
+  await testMethod('console.count');
+  await testMethod('console.assert');
+  await testMethod('console.profile');
+  await testMethod('console.profileEnd');
+  await testMethod('console.time');
+  await testMethod('console.timeEnd');
+  await testMethod('debug', ['f']);
+  await testMethod('undebug', ['f']);
+  await testMethod('monitor');
+  await testMethod('unmonitor');
+  await testMethod('keys', ['obj']);
+  await testMethod('values', ['obj']);
+  await testMethod('inspect');
+  await testMethod('copy', ['1']);
+  await testMethod('queryObjects', ['Array']);
+
+  InspectorTest.completeTest();
+
+  async function testExpression(expression) {
+    InspectorTest.log(`\nExpression: ${expression}`);
+    await evaluateAndPrint(expression);
+  }
+
+  async function testMethod(method, args = []) {
+    InspectorTest.log(`\nMethod: ${method}`);
+    await evaluateAndPrint(`${method}(${args.join(', ')})`);
+    await evaluateAndPrint(`${method}.toString()`);
+  }
+
+  async function evaluateAndPrint(expression) {
+    const result = (await Protocol.Runtime.evaluate({
+                     expression,
+                     throwOnSideEffect: true,
+                     includeCommandLineAPI: true
+                   })).result;
+    if (result.exceptionDetails)
+      InspectorTest.logMessage(result.exceptionDetails.exception.description);
+    else if (result.result)
+      InspectorTest.logMessage(
+          result.result.description || result.result.value ||
+          result.result.type);
+  }
+})();
diff --git a/deps/v8/test/inspector/runtime/console-context-expected.txt b/deps/v8/test/inspector/runtime/console-context-expected.txt
index 941f9c34dac9b4..f2d414bb49e40c 100644
--- a/deps/v8/test/inspector/runtime/console-context-expected.txt
+++ b/deps/v8/test/inspector/runtime/console-context-expected.txt
@@ -24,15 +24,13 @@ console.context() methods:
     [11] : groupEnd
     [12] : clear
     [13] : count
-    [14] : assert
-    [15] : markTimeline
+    [14] : countReset
+    [15] : assert
     [16] : profile
     [17] : profileEnd
-    [18] : timeline
-    [19] : timelineEnd
-    [20] : time
-    [21] : timeEnd
-    [22] : timeStamp
+    [18] : time
+    [19] : timeEnd
+    [20] : timeStamp
 ]
 
 Running test: testDefaultConsoleContext
diff --git a/deps/v8/test/inspector/runtime/console-deprecated-methods-expected.txt b/deps/v8/test/inspector/runtime/console-deprecated-methods-expected.txt
deleted file mode 100644
index 4c1e26518ca404..00000000000000
--- a/deps/v8/test/inspector/runtime/console-deprecated-methods-expected.txt
+++ /dev/null
@@ -1,4 +0,0 @@
-Tests checks that deprecation messages for console.
-'console.timeline' is deprecated. Please use 'console.time' instead.
-'console.timelineEnd' is deprecated. Please use 'console.timeEnd' instead.
-'console.markTimeline' is deprecated. Please use 'console.timeStamp' instead.
diff --git a/deps/v8/test/inspector/runtime/console-deprecated-methods.js b/deps/v8/test/inspector/runtime/console-deprecated-methods.js
deleted file mode 100644
index e8ccd2a2fd2961..00000000000000
--- a/deps/v8/test/inspector/runtime/console-deprecated-methods.js
+++ /dev/null
@@ -1,28 +0,0 @@
-// Copyright 2016 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-let {session, contextGroup, Protocol} = InspectorTest.start("Tests checks that deprecation messages for console.")
-
-Protocol.Runtime.onConsoleAPICalled(messageAdded);
-Protocol.Runtime.enable();
-
-var deprecatedMethods = [
-  "console.timeline(\"42\")",
-  "console.timeline(\"42\")",
-  "console.timeline(\"42\")", // three calls should produce one warning message
-  "console.timelineEnd(\"42\")",
-  "console.markTimeline(\"42\")",
-];
-Protocol.Runtime.evaluate({ expression: deprecatedMethods.join(";") });
-
-var messagesLeft = 3;
-function messageAdded(data)
-{
-  var text = data.params.args[0].value;
-  if (text.indexOf("deprecated") === -1)
-    return;
-  InspectorTest.log(text);
-  if (!--messagesLeft)
-    InspectorTest.completeTest();
-}
diff --git a/deps/v8/test/inspector/runtime/console-methods-expected.txt b/deps/v8/test/inspector/runtime/console-methods-expected.txt
index fea4ca69e0f535..45373f9dc7b3a8 100644
--- a/deps/v8/test/inspector/runtime/console-methods-expected.txt
+++ b/deps/v8/test/inspector/runtime/console-methods-expected.txt
@@ -821,3 +821,131 @@ Checks console methods
         type : count
     }
 }
+{
+    method : Runtime.consoleAPICalled
+    params : {
+        args : [
+            [0] : {
+                type : string
+                value : default: 1
+            }
+        ]
+        executionContextId : <executionContextId>
+        stackTrace : {
+            callFrames : [
+                [0] : {
+                    columnNumber : 10
+                    functionName : testFunction
+                    lineNumber : 35
+                    scriptId : <scriptId>
+                    url : test.js
+                }
+                [1] : {
+                    columnNumber : 0
+                    functionName : 
+                    lineNumber : 0
+                    scriptId : <scriptId>
+                    url : 
+                }
+            ]
+        }
+        timestamp : <timestamp>
+        type : count
+    }
+}
+{
+    method : Runtime.consoleAPICalled
+    params : {
+        args : [
+            [0] : {
+                type : string
+                value : default: 1
+            }
+        ]
+        executionContextId : <executionContextId>
+        stackTrace : {
+            callFrames : [
+                [0] : {
+                    columnNumber : 10
+                    functionName : testFunction
+                    lineNumber : 37
+                    scriptId : <scriptId>
+                    url : test.js
+                }
+                [1] : {
+                    columnNumber : 0
+                    functionName : 
+                    lineNumber : 0
+                    scriptId : <scriptId>
+                    url : 
+                }
+            ]
+        }
+        timestamp : <timestamp>
+        type : count
+    }
+}
+{
+    method : Runtime.consoleAPICalled
+    params : {
+        args : [
+            [0] : {
+                type : string
+                value : default: 1
+            }
+        ]
+        executionContextId : <executionContextId>
+        stackTrace : {
+            callFrames : [
+                [0] : {
+                    columnNumber : 10
+                    functionName : testFunction
+                    lineNumber : 39
+                    scriptId : <scriptId>
+                    url : test.js
+                }
+                [1] : {
+                    columnNumber : 0
+                    functionName : 
+                    lineNumber : 0
+                    scriptId : <scriptId>
+                    url : 
+                }
+            ]
+        }
+        timestamp : <timestamp>
+        type : count
+    }
+}
+{
+    method : Runtime.consoleAPICalled
+    params : {
+        args : [
+            [0] : {
+                type : string
+                value : Count for 'countReset' does not exist
+            }
+        ]
+        executionContextId : <executionContextId>
+        stackTrace : {
+            callFrames : [
+                [0] : {
+                    columnNumber : 10
+                    functionName : testFunction
+                    lineNumber : 40
+                    scriptId : <scriptId>
+                    url : test.js
+                }
+                [1] : {
+                    columnNumber : 0
+                    functionName : 
+                    lineNumber : 0
+                    scriptId : <scriptId>
+                    url : 
+                }
+            ]
+        }
+        timestamp : <timestamp>
+        type : warning
+    }
+}
diff --git a/deps/v8/test/inspector/runtime/console-methods.js b/deps/v8/test/inspector/runtime/console-methods.js
index f2919a6baebf45..b7b0462e1568e0 100644
--- a/deps/v8/test/inspector/runtime/console-methods.js
+++ b/deps/v8/test/inspector/runtime/console-methods.js
@@ -32,6 +32,13 @@ function testFunction() {
   console.count();
   console.count(undefined);
   console.count('default');
+  console.countReset();
+  console.count();
+  console.countReset(undefined);
+  console.count();
+  console.countReset('default');
+  console.count();
+  console.countReset('countReset');
 }
 //# sourceURL=test.js`, 7, 26);
 
diff --git a/deps/v8/test/inspector/runtime/enable-async-stack-expected.txt b/deps/v8/test/inspector/runtime/enable-async-stack-expected.txt
new file mode 100644
index 00000000000000..ab926da61cb12d
--- /dev/null
+++ b/deps/v8/test/inspector/runtime/enable-async-stack-expected.txt
@@ -0,0 +1,31 @@
+Checks that async stack is captured when Runtime.setAsyncCallStackDepth is called with an argument greater than zero.
+{
+    callFrames : [
+        [0] : {
+            columnNumber : 8
+            functionName : 
+            lineNumber : 0
+            scriptId : <scriptId>
+            url : 
+        }
+    ]
+    parent : {
+        callFrames : [
+            [0] : {
+                columnNumber : 2
+                functionName : test
+                lineNumber : 2
+                scriptId : <scriptId>
+                url : test.js
+            }
+            [1] : {
+                columnNumber : 0
+                functionName : 
+                lineNumber : 0
+                scriptId : <scriptId>
+                url : expr.js
+            }
+        ]
+        description : setTimeout
+    }
+}
diff --git a/deps/v8/test/inspector/runtime/enable-async-stack.js b/deps/v8/test/inspector/runtime/enable-async-stack.js
new file mode 100644
index 00000000000000..94900fdee60a49
--- /dev/null
+++ b/deps/v8/test/inspector/runtime/enable-async-stack.js
@@ -0,0 +1,19 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+let {session, contextGroup, Protocol} = InspectorTest.start('Checks that async stack is captured when Runtime.setAsyncCallStackDepth is called with an argument greater than zero.');
+
+Protocol.Runtime.enable();
+Protocol.Runtime.onConsoleAPICalled(
+    message => InspectorTest.logMessage(message.params.stackTrace));
+
+contextGroup.addScript(`
+async function test() {
+  setTimeout('console.log("async")', 0);
+}
+//# sourceURL=test.js`);
+
+Protocol.Runtime.setAsyncCallStackDepth({maxDepth: 10});
+Protocol.Runtime.evaluate({ expression: 'test()//# sourceURL=expr.js'})
+  .then(InspectorTest.completeTest);
diff --git a/deps/v8/test/inspector/runtime/evaluate-timeout-expected.txt b/deps/v8/test/inspector/runtime/evaluate-timeout-expected.txt
new file mode 100644
index 00000000000000..9005ef1c12acf6
--- /dev/null
+++ b/deps/v8/test/inspector/runtime/evaluate-timeout-expected.txt
@@ -0,0 +1,7 @@
+Tests that Runtime.evaluate's timeout argument
+Run trivial expression:
+Evaluate finished!
+Run expression without interrupts:
+Evaluate finished!
+Run infinite loop:
+Evaluate finished!
diff --git a/deps/v8/test/inspector/runtime/evaluate-timeout.js b/deps/v8/test/inspector/runtime/evaluate-timeout.js
new file mode 100644
index 00000000000000..367415c031d82b
--- /dev/null
+++ b/deps/v8/test/inspector/runtime/evaluate-timeout.js
@@ -0,0 +1,34 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+const {Protocol} = InspectorTest.start(
+    `Tests that Runtime.evaluate's timeout argument`);
+
+(async function test(){
+  {
+    InspectorTest.log('Run trivial expression:');
+    const result = await Protocol.Runtime.evaluate({
+      expression: 'function foo() {} foo()',
+      timeout: 0
+    });
+    InspectorTest.log('Evaluate finished!');
+  }
+  {
+    InspectorTest.log('Run expression without interrupts:');
+    const result = await Protocol.Runtime.evaluate({
+      expression: '',
+      timeout: 0
+    });
+    InspectorTest.log('Evaluate finished!');
+  }
+  {
+    InspectorTest.log('Run infinite loop:');
+    const result = await Protocol.Runtime.evaluate({
+      expression: 'for(;;){}',
+      timeout: 0
+    });
+    InspectorTest.log('Evaluate finished!');
+  }
+  InspectorTest.completeTest();
+})();
diff --git a/deps/v8/test/inspector/runtime/evaluate-without-side-effects-expected.txt b/deps/v8/test/inspector/runtime/evaluate-without-side-effects-expected.txt
index 8108f7a9b8d83b..892467a975027e 100644
--- a/deps/v8/test/inspector/runtime/evaluate-without-side-effects-expected.txt
+++ b/deps/v8/test/inspector/runtime/evaluate-without-side-effects-expected.txt
@@ -70,4 +70,4 @@ Test that debug break does not trigger with throwOnSideEffect
             value : 2
         }
     }
-}
\ No newline at end of file
+}
diff --git a/deps/v8/test/inspector/runtime/function-location-expected.txt b/deps/v8/test/inspector/runtime/function-location-expected.txt
new file mode 100644
index 00000000000000..255b4acd21bbc6
--- /dev/null
+++ b/deps/v8/test/inspector/runtime/function-location-expected.txt
@@ -0,0 +1,16 @@
+Check [[FunctionLocation]] internal property
+function a#() { b(); };
+function    b() {
+
+function a() { b(); };
+function    b#() {
+  c(true);
+
+};
+  function c#(x) {
+    if (x) {
+
+  };
+function d#(x) {
+  x = 1 ;
+
diff --git a/deps/v8/test/inspector/runtime/function-location.js b/deps/v8/test/inspector/runtime/function-location.js
new file mode 100644
index 00000000000000..719f13441bc582
--- /dev/null
+++ b/deps/v8/test/inspector/runtime/function-location.js
@@ -0,0 +1,56 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+let {session, contextGroup, Protocol} =
+  InspectorTest.start('Check [[FunctionLocation]] internal property');
+
+contextGroup.addScript(
+`function a() { b(); };
+function    b() {
+  c(true);
+};
+  function c(x) {
+    if (x) {
+      return 1;
+    } else {
+      return 1;
+    }
+  };
+function d(x) {
+  x = 1 ;
+  x = 2 ;
+  x = 3 ;
+  x = 4 ;
+  x = 5 ;
+  x = 6 ;
+  x = 7 ;
+  x = 8 ;
+  x = 9 ;
+  x = 10;
+  x = 11;
+  x = 12;
+  x = 13;
+  x = 14;
+  x = 15;
+}`);
+
+(async function test() {
+  session.setupScriptMap();
+  Protocol.Debugger.enable();
+  await session.logSourceLocation(await functionLocation('a'), true);
+  await session.logSourceLocation(await functionLocation('b'), true);
+  await session.logSourceLocation(await functionLocation('c'), true);
+  await session.logSourceLocation(await functionLocation('d'), true);
+  InspectorTest.completeTest();
+})();
+
+async function functionLocation(name) {
+  const {result:{result}} = await Protocol.Runtime.evaluate({expression: name});
+  const {result:{internalProperties}} = await Protocol.Runtime.getProperties({
+    objectId: result.objectId
+  });
+  const {value:{value}} = internalProperties.find(
+      prop => prop.name === '[[FunctionLocation]]');
+  return value;
+}
diff --git a/deps/v8/test/inspector/runtime/set-max-call-stack-size-expected.txt b/deps/v8/test/inspector/runtime/set-max-call-stack-size-expected.txt
new file mode 100644
index 00000000000000..f628d80e1fe980
--- /dev/null
+++ b/deps/v8/test/inspector/runtime/set-max-call-stack-size-expected.txt
@@ -0,0 +1,97 @@
+Checks Runtime.setMaxCallStackSizeToCapture.
+Test with max size 0.
+{
+    args : [
+        [0] : {
+            type : string
+            value : Nested call.
+        }
+    ]
+    executionContextId : <executionContextId>
+    timestamp : <timestamp>
+    type : log
+}
+Test with max size 1.
+{
+    args : [
+        [0] : {
+            type : string
+            value : Nested call.
+        }
+    ]
+    executionContextId : <executionContextId>
+    stackTrace : {
+        callFrames : [
+            [0] : {
+                columnNumber : 10
+                functionName : bar
+                lineNumber : 2
+                scriptId : <scriptId>
+                url : test.js
+            }
+        ]
+        parent : {
+            callFrames : [
+                [0] : {
+                    columnNumber : 2
+                    functionName : test
+                    lineNumber : 10
+                    scriptId : <scriptId>
+                    url : test.js
+                }
+            ]
+            description : setTimeout
+        }
+    }
+    timestamp : <timestamp>
+    type : log
+}
+Test with max size 2.
+{
+    args : [
+        [0] : {
+            type : string
+            value : Nested call.
+        }
+    ]
+    executionContextId : <executionContextId>
+    stackTrace : {
+        callFrames : [
+            [0] : {
+                columnNumber : 10
+                functionName : bar
+                lineNumber : 2
+                scriptId : <scriptId>
+                url : test.js
+            }
+            [1] : {
+                columnNumber : 2
+                functionName : foo
+                lineNumber : 6
+                scriptId : <scriptId>
+                url : test.js
+            }
+        ]
+        parent : {
+            callFrames : [
+                [0] : {
+                    columnNumber : 2
+                    functionName : test
+                    lineNumber : 10
+                    scriptId : <scriptId>
+                    url : test.js
+                }
+                [1] : {
+                    columnNumber : 0
+                    functionName :
+                    lineNumber : 0
+                    scriptId : <scriptId>
+                    url : expr.js
+                }
+            ]
+            description : setTimeout
+        }
+    }
+    timestamp : <timestamp>
+    type : log
+}
diff --git a/deps/v8/test/inspector/runtime/set-max-call-stack-size.js b/deps/v8/test/inspector/runtime/set-max-call-stack-size.js
new file mode 100644
index 00000000000000..cb76ab698709dd
--- /dev/null
+++ b/deps/v8/test/inspector/runtime/set-max-call-stack-size.js
@@ -0,0 +1,37 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+let {session, contextGroup, Protocol} = InspectorTest.start('Checks Runtime.setMaxCallStackSizeToCapture.');
+
+Protocol.Runtime.enable();
+Protocol.Runtime.onConsoleAPICalled(
+    message => InspectorTest.logMessage(message.params));
+
+contextGroup.addScript(`
+function bar() {
+  console.log("Nested call.");
+}
+
+function foo() {
+  bar();
+}
+
+async function test() {
+  setTimeout(foo, 0);
+}
+//# sourceURL=test.js`);
+
+Protocol.Runtime.setAsyncCallStackDepth({maxDepth: 10});
+(async function test() {
+  await Protocol.Runtime.setMaxCallStackSizeToCapture({size: 0});
+  InspectorTest.log('Test with max size 0.');
+  await Protocol.Runtime.evaluate({ expression: 'test()//# sourceURL=expr.js'});
+  await Protocol.Runtime.setMaxCallStackSizeToCapture({size: 1});
+  InspectorTest.log('Test with max size 1.');
+  await Protocol.Runtime.evaluate({ expression: 'test()//# sourceURL=expr.js'});
+  await Protocol.Runtime.setMaxCallStackSizeToCapture({size: 2});
+  InspectorTest.log('Test with max size 2.');
+  await Protocol.Runtime.evaluate({ expression: 'test()//# sourceURL=expr.js'});
+  InspectorTest.completeTest();
+})();
diff --git a/deps/v8/test/inspector/sessions/debugger-stepping-and-breakpoints-expected.txt b/deps/v8/test/inspector/sessions/debugger-stepping-and-breakpoints-expected.txt
index b81fde9f352b85..de81967eb06164 100644
--- a/deps/v8/test/inspector/sessions/debugger-stepping-and-breakpoints-expected.txt
+++ b/deps/v8/test/inspector/sessions/debugger-stepping-and-breakpoints-expected.txt
@@ -226,3 +226,6 @@ Paused in 2:
   hit breakpoints: 
   location: <anonymous>@1
   data: null
+Activating debugger agent in 1
+Disabling debugger agent in 2
+Disabling debugger agent in 1
diff --git a/deps/v8/test/inspector/sessions/debugger-stepping-and-breakpoints.js b/deps/v8/test/inspector/sessions/debugger-stepping-and-breakpoints.js
index b6ca626d1c6be2..64a60fd1dd10ca 100644
--- a/deps/v8/test/inspector/sessions/debugger-stepping-and-breakpoints.js
+++ b/deps/v8/test/inspector/sessions/debugger-stepping-and-breakpoints.js
@@ -182,6 +182,15 @@ function bar() {
   session2.Protocol.Runtime.evaluate({expression: 'baz();\ndebugger;'});
   await waitForPaused(session2, 2);
 
+  session1.Protocol.Debugger.onResumed(() => InspectorTest.log('session1 is resumed'));
+  session2.Protocol.Debugger.onResumed(() => InspectorTest.log('session2 is resumed'));
+  InspectorTest.log('Activating debugger agent in 1');
+  await session1.Protocol.Debugger.enable();
+  InspectorTest.log('Disabling debugger agent in 2');
+  await session2.Protocol.Debugger.disable();
+  InspectorTest.log('Disabling debugger agent in 1');
+  await session1.Protocol.Debugger.disable();
+
   InspectorTest.completeTest();
 
   function waitForBothPaused() {
diff --git a/deps/v8/test/inspector/type-profiler/type-profile-expected.txt b/deps/v8/test/inspector/type-profiler/type-profile-expected.txt
index 8001d8278e525c..04fa128e8ee0d1 100644
--- a/deps/v8/test/inspector/type-profiler/type-profile-expected.txt
+++ b/deps/v8/test/inspector/type-profiler/type-profile-expected.txt
@@ -5,4 +5,5 @@ function f(/*Object, number, undefined*/a, /*Array, number, null*/b, /*boolean,
 /*string*/};
 f({}, [], true);
 f(3, 2.3, {a: 42});
-f(undefined, null, Symbol('hello'));/*string*/
+f(undefined, null, Symbol('hello'));
+/*string*/
diff --git a/deps/v8/test/inspector/type-profiler/type-profile-with-classes-expected.txt b/deps/v8/test/inspector/type-profiler/type-profile-with-classes-expected.txt
index 3c1cb363d722aa..8c540617f1df69 100644
--- a/deps/v8/test/inspector/type-profiler/type-profile-with-classes-expected.txt
+++ b/deps/v8/test/inspector/type-profiler/type-profile-with-classes-expected.txt
@@ -12,4 +12,5 @@ var f = new Flower();
 f.constructor = {};
 f.constructor.name = "Not a flower.";
 g({}, [], f);
-g(3, 2.3, {a: 42});/*string*/
+g(3, 2.3, {a: 42});
+/*string*/
diff --git a/deps/v8/test/inspector/type-profiler/type-profile-with-to-string-tag-expected.txt b/deps/v8/test/inspector/type-profiler/type-profile-with-to-string-tag-expected.txt
index fdba16517e21aa..16999557266e31 100644
--- a/deps/v8/test/inspector/type-profiler/type-profile-with-to-string-tag-expected.txt
+++ b/deps/v8/test/inspector/type-profiler/type-profile-with-to-string-tag-expected.txt
@@ -13,4 +13,5 @@ var f = new Flower();
 // know about a toStringTag.
 f[Symbol.toStringTag] = 'Dog';
 g({}, [], f);
-g(3, 2.3, {a: 42});/*string*/
+g(3, 2.3, {a: 42});
+/*string*/
diff --git a/deps/v8/test/intl/date-format/month-far-future.js b/deps/v8/test/intl/date-format/month-far-future.js
index 930ac388b31d4c..a41128c7f0ab8c 100644
--- a/deps/v8/test/intl/date-format/month-far-future.js
+++ b/deps/v8/test/intl/date-format/month-far-future.js
@@ -21,10 +21,12 @@ var locales = [
     "th-u-ca-buddhist",
 ];
 
-var hugeNum = 1.7976931348623157e+308;
+// Used to test with 1.7976931348623157e+308, but it does not work
+// any more with TimeClip. Instead, try the largest time value.
+var end_of_time =  8.64e15;
 
 locales.forEach(function(loc) {
   var df = new Intl.DateTimeFormat(loc, {month: "long"});
-  assertFalse(df.format(hugeNum) == '');
+  assertFalse(df.format(end_of_time) == '');
 }
 );
diff --git a/deps/v8/test/intl/general/language_tags_with_preferred_values.js b/deps/v8/test/intl/general/language_tags_with_preferred_values.js
new file mode 100644
index 00000000000000..391db53a9889a2
--- /dev/null
+++ b/deps/v8/test/intl/general/language_tags_with_preferred_values.js
@@ -0,0 +1,29 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+[
+  // Redundant tag with preferred value.
+  ["sgn-de", "gsg"],
+  ["sgn-de-u-co-phonebk", "gsg-u-co-phonebk"],
+
+  // deprecated region tag
+  ["und-Latn-dd", "und-Latn-DE"],
+  ["und-dd-u-co-phonebk", "und-DE-u-co-phonebk"],
+  ["de-dd-u-co-phonebk", "de-DE-u-co-phonebk"],
+  ["de-latn-dd-u-co-phonebk", "de-Latn-DE-u-co-phonebk"],
+  ["fr-ZR", "fr-CD"],
+
+  // Deprecated [23]-letter language tags
+  ["in", "id"],
+  ["in-latn", "id-Latn"],
+  ["in-latn-id", "id-Latn-ID"],
+  ["in-latn-id-u-ca-gregory", "id-Latn-ID-u-ca-gregory"],
+  ["jw", "jv"],
+  ["aam", "aas"],
+  ["aam-u-ca-gregory", "aas-u-ca-gregory"],
+].forEach(function (entry) {
+  const canonicalLocales = Intl.getCanonicalLocales(entry[0]);
+  assertEquals(canonicalLocales.length, 1);
+  assertEquals(canonicalLocales[0], entry[1]);
+})
diff --git a/deps/v8/test/intl/general/supported-locales-of.js b/deps/v8/test/intl/general/supported-locales-of.js
index 016b4e9e5dddae..e16bb6702f87fc 100644
--- a/deps/v8/test/intl/general/supported-locales-of.js
+++ b/deps/v8/test/intl/general/supported-locales-of.js
@@ -28,10 +28,10 @@
 // Tests supportedLocalesOf method.
 
 var undef = Intl.DateTimeFormat.supportedLocalesOf();
-assertEquals(undefined, undef[0]);
+assertEquals([], undef);
 
 var empty = Intl.DateTimeFormat.supportedLocalesOf([]);
-assertEquals(undefined, empty[0]);
+assertEquals([], empty);
 
 var strLocale = Intl.DateTimeFormat.supportedLocalesOf('sr');
 assertEquals('sr', strLocale[0]);
@@ -41,3 +41,41 @@ var multiLocale =
 assertEquals('sr-Thai-RS', multiLocale[0]);
 assertEquals('de', multiLocale[1]);
 assertEquals('zh-CN', multiLocale[2]);
+
+collatorUndef = Intl.Collator.supportedLocalesOf();
+assertEquals([], collatorUndef);
+
+collatorEmpty = Intl.Collator.supportedLocalesOf([]);
+assertEquals([], collatorEmpty);
+
+collatorStrLocale = Intl.Collator.supportedLocalesOf('sr');
+assertEquals('sr', collatorStrLocale[0]);
+
+collatorMultiLocale =
+    Intl.Collator.supportedLocalesOf(['sr-Thai-RS', 'de', 'zh-CN']);
+assertEquals('sr-Thai-RS', collatorMultiLocale[0]);
+assertEquals('de', collatorMultiLocale[1]);
+assertEquals('zh-CN', collatorMultiLocale[2]);
+
+numLocale = Intl.Collator.supportedLocalesOf(1);
+assertEquals([], numLocale);
+
+assertThrows(function() {
+  numLocale = Intl.Collator.supportedLocalesOf([1]);
+}, TypeError);
+
+extensionLocale = Intl.Collator.supportedLocalesOf('id-u-co-pinyin');
+assertEquals('id-u-co-pinyin', extensionLocale[0]);
+
+bestFitLocale =
+    Intl.Collator.supportedLocalesOf('de', {localeMatcher: 'best fit'});
+assertEquals('de', bestFitLocale[0]);
+
+// Need a better test for "lookup" once it differs from "best fit".
+lookupLocale =
+    Intl.Collator.supportedLocalesOf('zh-CN', {localeMatcher: 'lookup'});
+assertEquals('zh-CN', lookupLocale[0]);
+
+assertThrows(function() {
+  Intl.Collator.supportedLocalesOf('id-u-co-pinyin', {localeMatcher: 'xyz'});
+}, RangeError);
diff --git a/deps/v8/test/intl/intl.status b/deps/v8/test/intl/intl.status
index c689c4f67658ce..b0e4340eced87b 100644
--- a/deps/v8/test/intl/intl.status
+++ b/deps/v8/test/intl/intl.status
@@ -31,8 +31,14 @@
   'overrides/caching': [PASS, FAIL],
 }],  # ALWAYS
 
-['variant == wasm_traps', {
+['variant == no_wasm_traps', {
   '*': [SKIP],
-}],  # variant == wasm_traps
+}],  # variant == no_wasm_traps
+
+['system == windows', {
+  # noi18n cannot turn on ICU backend for Date
+  'relative-time-format/default-locale-fr-CA': [SKIP],
+  'relative-time-format/default-locale-pt-BR': [SKIP],
+}],  # system == windows'
 
 ]
diff --git a/deps/v8/test/intl/locale/locale-canonicalization.js b/deps/v8/test/intl/locale/locale-canonicalization.js
new file mode 100644
index 00000000000000..50125372778a92
--- /dev/null
+++ b/deps/v8/test/intl/locale/locale-canonicalization.js
@@ -0,0 +1,24 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --harmony-locale
+
+// Make sure that locale string got canonicalized by the spec,
+// keys are sorted and unique, region upper cased, script title cased and
+// language lower cased.
+
+let locale = new Intl.Locale('sr-cyrl-rs-t-ja-u-ca-islamic-x-whatever', {
+  calendar: 'buddhist',
+  caseFirst: 'true',
+  collation: 'phonebk',
+  hourCycle: 'h23',
+  caseFirst: 'upper',
+  numeric: 'true',
+  numberingSystem: 'roman'
+});
+
+let expected =
+    'sr-Cyrl-RS-t-ja-u-ca-buddhist-co-phonebk-hc-h23-kf-upper-kn-true-nu-roman-x-whatever';
+
+assertEquals(expected, locale.toString());
diff --git a/deps/v8/test/intl/locale/locale-constructor.js b/deps/v8/test/intl/locale/locale-constructor.js
new file mode 100644
index 00000000000000..170cc81c36ef6e
--- /dev/null
+++ b/deps/v8/test/intl/locale/locale-constructor.js
@@ -0,0 +1,176 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --harmony-locale
+
+// Locale constructor can't be called as function.
+assertThrows(() => Intl.Locale('sr'), TypeError);
+
+// Non-string locale.
+assertThrows(() => new Intl.Locale(5), TypeError);
+
+// Invalid locale string.
+assertThrows(() => new Intl.Locale('abcdefghi'), RangeError);
+
+// Options will be force converted into Object.
+assertDoesNotThrow(() => new Intl.Locale('sr', 5));
+
+// ICU problem - locale length is limited.
+// http://bugs.icu-project.org/trac/ticket/13417.
+assertThrows(
+    () => new Intl.Locale(
+        'sr-cyrl-rs-t-ja-u-ca-islamic-cu-rsd-tz-uslax-x-whatever', {
+          calendar: 'buddhist',
+          caseFirst: 'true',
+          collation: 'phonebk',
+          hourCycle: 'h23',
+          caseFirst: 'upper',
+          numeric: 'true',
+          numberingSystem: 'roman',
+        }),
+    RangeError);
+
+// Throws only once during construction.
+// Check for all getters to prevent regression.
+assertThrows(
+    () => new Intl.Locale('en-US', {
+      get calendar() {
+        throw new Error('foo');
+      }
+    }),
+    Error);
+
+assertThrows(
+    () => new Intl.Locale('en-US', {
+      get caseFirst() {
+        throw new Error('foo');
+      }
+    }),
+    Error);
+
+assertThrows(
+    () => new Intl.Locale('en-US', {
+      get collation() {
+        throw new Error('foo');
+      }
+    }),
+    Error);
+
+assertThrows(
+    () => new Intl.Locale('en-US', {
+      get hourCycle() {
+        throw new Error('foo');
+      }
+    }),
+    Error);
+
+assertThrows(
+    () => new Intl.Locale('en-US', {
+      get numeric() {
+        throw new Error('foo');
+      }
+    }),
+    Error);
+
+assertThrows(
+    () => new Intl.Locale('en-US', {
+      get numberingSystem() {
+        throw new Error('foo');
+      }
+    }),
+    Error);
+
+// These don't throw yet, we need to implement language/script/region
+// override logic first.
+assertDoesNotThrow(
+    () => new Intl.Locale('en-US', {
+      get language() {
+        throw new Error('foo');
+      }
+    }),
+    Error);
+
+assertDoesNotThrow(
+    () => new Intl.Locale('en-US', {
+      get script() {
+        throw new Error('foo');
+      }
+    }),
+    Error);
+
+assertDoesNotThrow(
+    () => new Intl.Locale('en-US', {
+      get region() {
+        throw new Error('foo');
+      }
+    }),
+    Error);
+
+// There won't be an override for baseName so we don't expect it to throw.
+assertDoesNotThrow(
+    () => new Intl.Locale('en-US', {
+      get baseName() {
+        throw new Error('foo');
+      }
+    }),
+    Error);
+
+// Preserve the order of getter initialization.
+let getCount = 0;
+let calendar = -1;
+let collation = -1;
+let hourCycle = -1;
+let caseFirst = -1;
+let numeric = -1;
+let numberingSystem = -1;
+
+
+new Intl.Locale('en-US', {
+  get calendar() {
+    calendar = ++getCount;
+  },
+  get collation() {
+    collation = ++getCount;
+  },
+  get hourCycle() {
+    hourCycle = ++getCount;
+  },
+  get caseFirst() {
+    caseFirst = ++getCount;
+  },
+  get numeric() {
+    numeric = ++getCount;
+  },
+  get numberingSystem() {
+    numberingSystem = ++getCount;
+  },
+});
+
+assertEquals(1, calendar);
+assertEquals(2, collation);
+assertEquals(3, hourCycle);
+assertEquals(4, caseFirst);
+assertEquals(5, numeric);
+assertEquals(6, numberingSystem);
+
+// Check getter properties against the spec.
+function checkProperties(property) {
+  let desc = Object.getOwnPropertyDescriptor(Intl.Locale.prototype, property);
+  assertEquals(`get ${property}`, desc.get.name);
+  assertEquals('function', typeof desc.get)
+  assertEquals(undefined, desc.set);
+  assertFalse(desc.enumerable);
+  assertTrue(desc.configurable);
+}
+
+checkProperties('language');
+checkProperties('script');
+checkProperties('region');
+checkProperties('baseName');
+checkProperties('calendar');
+checkProperties('collation');
+checkProperties('hourCycle');
+checkProperties('caseFirst');
+checkProperties('numeric');
+checkProperties('numberingSystem');
diff --git a/deps/v8/test/intl/locale/locale-properties.js b/deps/v8/test/intl/locale/locale-properties.js
new file mode 100644
index 00000000000000..9800e8d6cf6176
--- /dev/null
+++ b/deps/v8/test/intl/locale/locale-properties.js
@@ -0,0 +1,35 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --harmony-locale
+
+// Make sure that locale exposes all required properties. Those not specified
+// should have undefined value.
+
+let locale = new Intl.Locale('sr-cyrl-rs-t-ja-u-ca-islamic-x-whatever', {
+  calendar: 'buddhist',
+  caseFirst: 'true',
+  collation: 'phonebk',
+  hourCycle: 'h23',
+  caseFirst: 'upper',
+  numeric: 'true',
+  numberingSystem: 'roman'
+});
+assertEquals('sr', locale.language);
+assertEquals('Cyrl', locale.script);
+assertEquals('RS', locale.region);
+assertEquals('sr-Cyrl-RS', locale.baseName);
+assertEquals('buddhist', locale.calendar);
+assertEquals('phonebk', locale.collation);
+assertEquals('h23', locale.hourCycle);
+assertEquals('upper', locale.caseFirst);
+assertEquals(true, locale.numeric);
+assertEquals('roman', locale.numberingSystem);
+// Not defined, expected to undefined.
+assertEquals(undefined, locale.currency);
+assertEquals(undefined, locale.timeZone);
+
+// Test property defined in spec, but not specified in locale.
+let missing_property = new Intl.Locale('sr');
+assertEquals(undefined, missing_property.script);
diff --git a/deps/v8/test/intl/relative-time-format/constructor.js b/deps/v8/test/intl/relative-time-format/constructor.js
new file mode 100644
index 00000000000000..91d649891d39ec
--- /dev/null
+++ b/deps/v8/test/intl/relative-time-format/constructor.js
@@ -0,0 +1,103 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --harmony-intl-relative-time-format
+
+// RelativeTimeFormat constructor can't be called as function.
+assertThrows(() => Intl.RelativeTimeFormat('sr'), TypeError);
+
+// Non-string locale.
+//assertThrows(() => new Intl.RelativeTimeFormat(5), TypeError);
+
+// Invalid locale string.
+//assertThrows(() => new Intl.RelativeTimeFormat('abcdefghi'), RangeError);
+
+assertDoesNotThrow(() => new Intl.RelativeTimeFormat('sr', {}));
+
+assertDoesNotThrow(() => new Intl.RelativeTimeFormat([], {}));
+
+assertDoesNotThrow(() => new Intl.RelativeTimeFormat(['fr', 'ar'], {}));
+
+assertDoesNotThrow(() => new Intl.RelativeTimeFormat({0: 'ja', 1:'fr'}, {}));
+
+assertDoesNotThrow(() => new Intl.RelativeTimeFormat({1: 'ja', 2:'fr'}, {}));
+
+assertDoesNotThrow(() => new Intl.RelativeTimeFormat('sr'));
+
+assertDoesNotThrow(() => new Intl.RelativeTimeFormat());
+
+assertDoesNotThrow(
+    () => new Intl.RelativeTimeFormat(
+        'sr', {
+          localeMatcher: 'lookup',
+          style: 'short',
+          numeric: 'always'
+        }));
+
+
+assertDoesNotThrow(
+    () => new Intl.RelativeTimeFormat('sr', {localeMatcher: 'lookup'}));
+
+assertDoesNotThrow(
+    () => new Intl.RelativeTimeFormat('sr', {localeMatcher: 'best fit'}));
+
+assertThrows(
+    () => new Intl.RelativeTimeFormat('sr', {localeMatcher: 'hello'}),
+    RangeError);
+
+assertThrows(
+    () => new Intl.RelativeTimeFormat('sr', {localeMatcher: 'look up'}),
+    RangeError);
+
+assertThrows(
+    () => new Intl.RelativeTimeFormat('sr', {localeMatcher: 'bestfit'}),
+    RangeError);
+
+
+assertDoesNotThrow(
+    () => new Intl.RelativeTimeFormat('sr', {style: 'long'}));
+
+assertDoesNotThrow(
+    () => new Intl.RelativeTimeFormat('sr', {style: 'short'}));
+
+assertDoesNotThrow(
+    () => new Intl.RelativeTimeFormat('sr', {style: 'narrow'}));
+
+assertThrows(
+    () => new Intl.RelativeTimeFormat('sr', {style: 'giant'}),
+    RangeError);
+
+assertDoesNotThrow(
+    () => new Intl.RelativeTimeFormat('sr', {numeric: 'always'}));
+
+assertDoesNotThrow(
+    () => new Intl.RelativeTimeFormat('sr', {numeric: 'auto'}));
+
+assertThrows(
+    () => new Intl.RelativeTimeFormat('sr', {numeric: 'never'}),
+    RangeError);
+
+// Throws only once during construction.
+// Check for all getters to prevent regression.
+// Preserve the order of getter initialization.
+let getCount = 0;
+let localeMatcher = -1;
+let style = -1;
+let numeric = -1;
+
+new Intl.RelativeTimeFormat('en-US', {
+  get localeMatcher() {
+    localeMatcher = ++getCount;
+  },
+  get style() {
+    style = ++getCount;
+  },
+  get numeric() {
+    numeric = ++getCount;
+  }
+});
+
+assertEquals(1, localeMatcher);
+assertEquals(2, style);
+assertEquals(3, numeric);
diff --git a/deps/v8/test/intl/relative-time-format/default-locale-fr-CA.js b/deps/v8/test/intl/relative-time-format/default-locale-fr-CA.js
new file mode 100644
index 00000000000000..32f64ee02d76d6
--- /dev/null
+++ b/deps/v8/test/intl/relative-time-format/default-locale-fr-CA.js
@@ -0,0 +1,14 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --harmony-intl-relative-time-format --harmony-locale
+// Environment Variables: LC_ALL=fr_CA
+assertEquals(
+    'fr-CA',
+    (new Intl.RelativeTimeFormat()).resolvedOptions().locale);
+
+assertEquals(
+    'fr-CA',
+    (new Intl.RelativeTimeFormat([], {style: 'short', numeric: 'auto'}))
+    .resolvedOptions().locale);
diff --git a/deps/v8/test/intl/relative-time-format/default-locale-pt-BR.js b/deps/v8/test/intl/relative-time-format/default-locale-pt-BR.js
new file mode 100644
index 00000000000000..89f7aa14f06fce
--- /dev/null
+++ b/deps/v8/test/intl/relative-time-format/default-locale-pt-BR.js
@@ -0,0 +1,14 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --harmony-intl-relative-time-format --harmony-locale
+// Environment Variables: LC_ALL=pt_BR
+assertEquals(
+    'pt-BR',
+    (new Intl.RelativeTimeFormat()).resolvedOptions().locale);
+
+assertEquals(
+    'pt-BR',
+    (new Intl.RelativeTimeFormat([], {style: 'short', numeric: 'auto'}))
+    .resolvedOptions().locale);
diff --git a/deps/v8/test/intl/relative-time-format/resolved-options.js b/deps/v8/test/intl/relative-time-format/resolved-options.js
new file mode 100644
index 00000000000000..d51a58a9605a11
--- /dev/null
+++ b/deps/v8/test/intl/relative-time-format/resolved-options.js
@@ -0,0 +1,162 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --harmony-intl-relative-time-format
+
+let rtf = new Intl.RelativeTimeFormat();
+// Test 1.4.5 Intl.RelativeTimeFormat.prototype.resolvedOptions ()
+// The default style is 'long'
+assertEquals('long', rtf.resolvedOptions().style);
+
+// The default numeric is 'always'
+assertEquals('always', rtf.resolvedOptions().numeric);
+
+// contains style, numeric and locale key
+assertEquals(3, Object.getOwnPropertyNames(rtf.resolvedOptions()).length);
+
+// contains style, numeric and locale key
+assertEquals(3, Object.getOwnPropertyNames(new Intl.RelativeTimeFormat('en').resolvedOptions()).length);
+
+assertEquals(
+    'short',
+    (new Intl.RelativeTimeFormat(['sr'], {style: 'short'}))
+        .resolvedOptions().style);
+
+assertEquals(
+    'always',
+    (new Intl.RelativeTimeFormat(['sr'], {style: 'short'}))
+        .resolvedOptions().numeric);
+
+assertEquals(
+    'narrow',
+    (new Intl.RelativeTimeFormat(['sr'], {style: 'narrow'}))
+        .resolvedOptions().style);
+
+assertEquals(
+    'always',
+    (new Intl.RelativeTimeFormat(['sr'], {style: 'narrow'}))
+        .resolvedOptions().numeric);
+
+assertEquals(
+    'long',
+    (new Intl.RelativeTimeFormat(['sr'], {style: 'long'}))
+        .resolvedOptions().style);
+
+assertEquals(
+    'always',
+    (new Intl.RelativeTimeFormat(['sr'], {style: 'long'}))
+        .resolvedOptions().numeric);
+
+assertEquals(
+    'auto',
+    (new Intl.RelativeTimeFormat(['sr'], {numeric: 'auto'}))
+        .resolvedOptions().numeric);
+
+assertEquals(
+    'long',
+    (new Intl.RelativeTimeFormat(['sr'], {numeric: 'auto'}))
+        .resolvedOptions().style);
+
+assertEquals(
+    'always',
+    (new Intl.RelativeTimeFormat(['sr'], {numeric: 'always'}))
+        .resolvedOptions().numeric);
+
+assertEquals(
+    'long',
+    (new Intl.RelativeTimeFormat(['sr'], {numeric: 'always'}))
+        .resolvedOptions().style);
+
+assertEquals(
+    'long',
+    (new Intl.RelativeTimeFormat(['sr'], {style: 'long', numeric: 'auto'}))
+        .resolvedOptions().style);
+
+assertEquals(
+    'auto',
+    (new Intl.RelativeTimeFormat(['sr'], {style: 'long', numeric: 'auto'}))
+        .resolvedOptions().numeric);
+
+assertEquals(
+    'long',
+    (new Intl.RelativeTimeFormat(['sr'], {style: 'long', numeric: 'always'}))
+        .resolvedOptions().style);
+
+assertEquals(
+    'always',
+    (new Intl.RelativeTimeFormat(['sr'], {style: 'long', numeric: 'always'}))
+        .resolvedOptions().numeric);
+
+assertEquals(
+    'short',
+    (new Intl.RelativeTimeFormat(['sr'], {style: 'short', numeric: 'auto'}))
+        .resolvedOptions().style);
+
+assertEquals(
+    'auto',
+    (new Intl.RelativeTimeFormat(['sr'], {style: 'short', numeric: 'auto'}))
+        .resolvedOptions().numeric);
+
+assertEquals(
+    'short',
+    (new Intl.RelativeTimeFormat(['sr'], {style: 'short', numeric: 'always'}))
+        .resolvedOptions().style);
+
+assertEquals(
+    'always',
+    (new Intl.RelativeTimeFormat(['sr'], {style: 'short', numeric: 'always'}))
+        .resolvedOptions().numeric);
+
+assertEquals(
+    'narrow',
+    (new Intl.RelativeTimeFormat(['sr'], {style: 'narrow', numeric: 'auto'}))
+        .resolvedOptions().style);
+
+assertEquals(
+    'auto',
+    (new Intl.RelativeTimeFormat(['sr'], {style: 'narrow', numeric: 'auto'}))
+        .resolvedOptions().numeric);
+
+assertEquals(
+    'narrow',
+    (new Intl.RelativeTimeFormat(['sr'], {style: 'narrow', numeric: 'always'}))
+        .resolvedOptions().style);
+
+assertEquals(
+    'always',
+    (new Intl.RelativeTimeFormat(['sr'], {style: 'narrow', numeric: 'always'}))
+        .resolvedOptions().numeric);
+
+assertEquals(
+    'ar',
+    (new Intl.RelativeTimeFormat(['ar'])).resolvedOptions().locale);
+
+assertEquals(
+    'ar',
+    (new Intl.RelativeTimeFormat(['ar', 'en'])).resolvedOptions().locale);
+
+assertEquals(
+    'fr',
+    (new Intl.RelativeTimeFormat(['fr', 'en'])).resolvedOptions().locale);
+
+assertEquals(
+    'ar',
+    (new Intl.RelativeTimeFormat(['xyz', 'ar'])).resolvedOptions().locale);
+
+{
+  var receiver = 1;
+  assertThrows(() =>
+     Intl.RelativeTimeFormat.prototype.resolvedOptions.call(receiver), TypeError);
+
+  receiver = {};
+  assertThrows(() =>
+     Intl.RelativeTimeFormat.prototype.resolvedOptions.call(receiver), TypeError);
+}
+
+// The following is not working yet because it depend on the getAvailableLocales
+// work in another path set.
+// TODO(ftang): uncomment the following once that patchset is checked in.
+//assertEquals(
+//    'ar',
+//    (new Intl.RelativeTimeFormat(['i-default', 'ar'])).resolvedOptions().locale);
diff --git a/deps/v8/test/intl/testcfg.py b/deps/v8/test/intl/testcfg.py
index aa81c934345e13..3d4eed4849eaac 100644
--- a/deps/v8/test/intl/testcfg.py
+++ b/deps/v8/test/intl/testcfg.py
@@ -26,10 +26,13 @@
 # OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 import os
+import re
 
 from testrunner.local import testsuite
 from testrunner.objects import testcase
 
+ENV_PATTERN = re.compile(r"//\s+Environment Variables:(.*)")
+
 class TestSuite(testsuite.TestSuite):
   def ListTests(self):
     tests = []
@@ -58,6 +61,20 @@ def __init__(self, *args, **kwargs):
     super(TestCase, self).__init__(*args, **kwargs)
 
     self._source_flags = self._parse_source_flags()
+    source = self.get_source()
+    self._env = self._parse_source_env(source)
+
+  def _parse_source_env(self, source):
+    env_match = ENV_PATTERN.search(source)
+    env = {}
+    if env_match:
+      for env_pair in env_match.group(1).strip().split():
+        var, value = env_pair.split('=')
+        env[var] = value
+    return env
+
+  def _get_cmd_env(self):
+    return self._env
 
   def _get_files_params(self):
     files = map(lambda f: os.path.join(self.suite.root, f), [
diff --git a/deps/v8/test/js-perf-test/Array/from.js b/deps/v8/test/js-perf-test/Array/from.js
index 2c6bd265bd2fae..06e00a223e6c96 100644
--- a/deps/v8/test/js-perf-test/Array/from.js
+++ b/deps/v8/test/js-perf-test/Array/from.js
@@ -3,151 +3,152 @@
 // found in the LICENSE file.
 (() => {
 
-benchy('MixedFrom', MixedFrom, MixedFromSetup);
-benchy('SmiFrom', SmiFrom, SmiFromSetup);
-benchy('SmallSmiFrom', SmallSmiFrom, SmallSmiFromSetup);
-benchy('SmiNoMapFrom', SmiNoMapFrom, SmiNoMapFromSetup);
-benchy('SmiNoIteratorFrom', SmiNoIteratorFrom, SmiNoIteratorFromSetup);
-benchy('TransplantedFrom', TransplantedFrom, TransplantedFromSetup);
-benchy('DoubleFrom', DoubleFrom, DoubleFromSetup);
-benchy('StringFrom', StringFrom, StringFromSetup);
-benchy('StringNoMapFrom', StringNoMapFrom, StringNoMapFromSetup);
-
-function ArrayLike() {}
-ArrayLike.from = Array.from;
-
-var arg
-var result;
-var func
-
-var smi_array = [
-    1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,
-    1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,
-    1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,
-    1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,
-    1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,
-];
-
-var double_array = [
-    1.5,2.5,3.5,4.5,5.5,6.5,7.5,8.5,9.5,10.5,
-    11.5,12.5,13.5,14.5,15.5,16.5,17.5,18.5,19.5,20.5,
-    1.5,2.5,3.5,4.5,5.5,6.5,7.5,8.5,9.5,10.5,
-    11.5,12.5,13.5,14.5,15.5,16.5,17.5,18.5,19.5,20.5,
-    1.5,2.5,3.5,4.5,5.5,6.5,7.5,8.5,9.5,10.5,
-    11.5,12.5,13.5,14.5,15.5,16.5,17.5,18.5,19.5,20.5,
-    1.5,2.5,3.5,4.5,5.5,6.5,7.5,8.5,9.5,10.5,
-    11.5,12.5,13.5,14.5,15.5,16.5,17.5,18.5,19.5,20.5,
-    1.5,2.5,3.5,4.5,5.5,6.5,7.5,8.5,9.5,10.5,
-    11.5,12.5,13.5,14.5,15.5,16.5,17.5,18.5,19.5,20.5,
-];
-
-var string_array = [
-    "a", "b", "c", "a", "b", "c", "a", "b", "c", "a",
-    "a", "b", "c", "a", "b", "c", "a", "b", "c", "a",
-    "a", "b", "c", "a", "b", "c", "a", "b", "c", "a",
-    "a", "b", "c", "a", "b", "c", "a", "b", "c", "a",
-    "a", "b", "c", "a", "b", "c", "a", "b", "c", "a",
-    "a", "b", "c", "a", "b", "c", "a", "b", "c", "a",
-    "a", "b", "c", "a", "b", "c", "a", "b", "c", "a",
-    "a", "b", "c", "a", "b", "c", "a", "b", "c", "a",
-    "a", "b", "c", "a", "b", "c", "a", "b", "c", "a",
-    "a", "b", "c", "a", "b", "c", "a", "b", "c", "a",
-];
-
-var mixed_array = [
-    1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,
-    1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,
-    1.5,2.5,3.5,4.5,5.5,6.5,7.5,8.5,9.5,10.5,
-    11.5,12.5,13.5,14.5,15.5,16.5,17.5,18.5,19.5,20.5,
-    1.5,2.5,3.5,4.5,5.5,6.5,7.5,8.5,9.5,10.5,
-    11.5,12.5,13.5,14.5,15.5,16.5,17.5,18.5,19.5,20.5,
-    "a", "b", "c", "a", "b", "c", "a", "b", "c", "a",
-    "a", "b", "c", "a", "b", "c", "a", "b", "c", "a",
-]
-
-// Although these functions have the same code, they are separated for
-// clean IC feedback.
-function SmallSmiFrom() {
-  result = Array.from(arg, func);
-}
-
-function SmiNoMapFrom() {
-  result = Array.from(arg);
-}
-
-function SmiFrom() {
-  result = Array.from(arg, func);
-}
-
-function SmiNoIteratorFrom() {
-  result = Array.from(arg, func);
-}
-
-function TransplantedFrom() {
-  result = ArrayLike.from(arg, func);
-}
-
-function DoubleFrom() {
-  result = Array.from(arg, func);
-}
-
-function StringFrom() {
-  result = Array.from(arg, func);
-}
-
-function StringNoMapFrom() {
-  result = Array.from(arg);
-}
-
-function MixedFrom() {
-  result = Array.from(arg, func);
-}
-
-function SmallSmiFromSetup() {
-  func = (v,i) => v + i;
-  arg = [1,2,3];
-}
-
-function SmiNoMapFromSetup() {
-  func = undefined;
-  arg = smi_array;
-}
-
-function SmiFromSetup() {
-  func = (v,i) => v + i;
-  arg = smi_array;
-}
-
-function SmiNoIteratorFromSetup() {
-  func = (v,i) => v + i;
-  array = smi_array;
-  arg = {length: array.length}
-  Object.assign(arg, array);
-}
-
-function TransplantedFromSetup() {
-  func = (v,i) => v + i;
-  arg = smi_array;
-}
-
-function DoubleFromSetup() {
-  func = (v,i) => v + i;
-  arg = double_array;
-}
-
-function StringFromSetup() {
-  func = (v,i) => v + i;
-  arg = string_array;
-}
-
-function StringNoMapFromSetup() {
-  func = undefined;
-  arg = string_array;
-}
-
-function MixedFromSetup() {
-  func = (v,i) => v + i;
-  arg = mixed_array;
-}
+  createSuite('MixedFrom', 1000, MixedFrom, MixedFromSetup);
+  createSuite('SmiFrom', 1000, SmiFrom, SmiFromSetup);
+  createSuite('SmallSmiFrom', 1000, SmallSmiFrom, SmallSmiFromSetup);
+  createSuite('SmiNoMapFrom', 1000, SmiNoMapFrom, SmiNoMapFromSetup);
+  createSuite(
+      'SmiNoIteratorFrom', 1000, SmiNoIteratorFrom, SmiNoIteratorFromSetup);
+  createSuite(
+      'TransplantedFrom', 1000, TransplantedFrom, TransplantedFromSetup);
+  createSuite('DoubleFrom', 1000, DoubleFrom, DoubleFromSetup);
+  createSuite('StringFrom', 1000, StringFrom, StringFromSetup);
+  createSuite('StringNoMapFrom', 1000, StringNoMapFrom, StringNoMapFromSetup);
+
+  function ArrayLike() {}
+  ArrayLike.from = Array.from;
+
+  var arg
+  var result;
+  var func
+
+  var smi_array = [
+    1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20,
+    1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20,
+    1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20,
+    1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20,
+    1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20,
+  ];
+
+  var double_array = [
+    1.5,  2.5,  3.5,  4.5,  5.5,  6.5,  7.5,  8.5,  9.5,  10.5,  //
+    11.5, 12.5, 13.5, 14.5, 15.5, 16.5, 17.5, 18.5, 19.5, 20.5,
+    1.5,  2.5,  3.5,  4.5,  5.5,  6.5,  7.5,  8.5,  9.5,  10.5,  //
+    11.5, 12.5, 13.5, 14.5, 15.5, 16.5, 17.5, 18.5, 19.5, 20.5,
+    1.5,  2.5,  3.5,  4.5,  5.5,  6.5,  7.5,  8.5,  9.5,  10.5,  //
+    11.5, 12.5, 13.5, 14.5, 15.5, 16.5, 17.5, 18.5, 19.5, 20.5,
+    1.5,  2.5,  3.5,  4.5,  5.5,  6.5,  7.5,  8.5,  9.5,  10.5,  //
+    11.5, 12.5, 13.5, 14.5, 15.5, 16.5, 17.5, 18.5, 19.5, 20.5,
+    1.5,  2.5,  3.5,  4.5,  5.5,  6.5,  7.5,  8.5,  9.5,  10.5,  //
+    11.5, 12.5, 13.5, 14.5, 15.5, 16.5, 17.5, 18.5, 19.5, 20.5,
+  ];
+
+  var string_array = [
+    'a', 'b', 'c', 'a', 'b', 'c', 'a', 'b', 'c', 'a', 'a', 'b', 'c', 'a', 'b',
+    'c', 'a', 'b', 'c', 'a', 'a', 'b', 'c', 'a', 'b', 'c', 'a', 'b', 'c', 'a',
+    'a', 'b', 'c', 'a', 'b', 'c', 'a', 'b', 'c', 'a', 'a', 'b', 'c', 'a', 'b',
+    'c', 'a', 'b', 'c', 'a', 'a', 'b', 'c', 'a', 'b', 'c', 'a', 'b', 'c', 'a',
+    'a', 'b', 'c', 'a', 'b', 'c', 'a', 'b', 'c', 'a', 'a', 'b', 'c', 'a', 'b',
+    'c', 'a', 'b', 'c', 'a', 'a', 'b', 'c', 'a', 'b', 'c', 'a', 'b', 'c', 'a',
+    'a', 'b', 'c', 'a', 'b', 'c', 'a', 'b', 'c', 'a',
+  ];
+
+  var mixed_array = [
+    1,    2,    3,    4,    5,    6,    7,    8,    9,    10,
+    11,   12,   13,   14,   15,   16,   17,   18,   19,   20,  //
+    1,    2,    3,    4,    5,    6,    7,    8,    9,    10,
+    11,   12,   13,   14,   15,   16,   17,   18,   19,   20,  //
+    1.5,  2.5,  3.5,  4.5,  5.5,  6.5,  7.5,  8.5,  9.5,  10.5,
+    11.5, 12.5, 13.5, 14.5, 15.5, 16.5, 17.5, 18.5, 19.5, 20.5,  //
+    1.5,  2.5,  3.5,  4.5,  5.5,  6.5,  7.5,  8.5,  9.5,  10.5,
+    11.5, 12.5, 13.5, 14.5, 15.5, 16.5, 17.5, 18.5, 19.5, 20.5,  //
+    'a',  'b',  'c',  'a',  'b',  'c',  'a',  'b',  'c',  'a',
+    'a',  'b',  'c',  'a',  'b',  'c',  'a',  'b',  'c',  'a',
+  ];
+
+  // Although these functions have the same code, they are separated for
+  // clean IC feedback.
+  function SmallSmiFrom() {
+    result = Array.from(arg, func);
+  }
+
+  function SmiNoMapFrom() {
+    result = Array.from(arg);
+  }
+
+  function SmiFrom() {
+    result = Array.from(arg, func);
+  }
+
+  function SmiNoIteratorFrom() {
+    result = Array.from(arg, func);
+  }
+
+  function TransplantedFrom() {
+    result = ArrayLike.from(arg, func);
+  }
+
+  function DoubleFrom() {
+    result = Array.from(arg, func);
+  }
+
+  function StringFrom() {
+    result = Array.from(arg, func);
+  }
+
+  function StringNoMapFrom() {
+    result = Array.from(arg);
+  }
+
+  function MixedFrom() {
+    result = Array.from(arg, func);
+  }
+
+  function SmallSmiFromSetup() {
+    func = (v, i) => v + i;
+    arg = [1, 2, 3];
+  }
+
+  function SmiNoMapFromSetup() {
+    func = undefined;
+    arg = smi_array;
+  }
+
+  function SmiFromSetup() {
+    func = (v, i) => v + i;
+    arg = smi_array;
+  }
+
+  function SmiNoIteratorFromSetup() {
+    func = (v, i) => v + i;
+    array = smi_array;
+    arg = {length: array.length};
+    Object.assign(arg, array);
+  }
+
+  function TransplantedFromSetup() {
+    func = (v, i) => v + i;
+    arg = smi_array;
+  }
+
+  function DoubleFromSetup() {
+    func = (v, i) => v + i;
+    arg = double_array;
+  }
+
+  function StringFromSetup() {
+    func = (v, i) => v + i;
+    arg = string_array;
+  }
+
+  function StringNoMapFromSetup() {
+    func = undefined;
+    arg = string_array;
+  }
+
+  function MixedFromSetup() {
+    func = (v, i) => v + i;
+    arg = mixed_array;
+  }
 
 })();
diff --git a/deps/v8/test/js-perf-test/Array/join.js b/deps/v8/test/js-perf-test/Array/join.js
index ef9d2984218b31..c9928e791d87d0 100644
--- a/deps/v8/test/js-perf-test/Array/join.js
+++ b/deps/v8/test/js-perf-test/Array/join.js
@@ -11,10 +11,10 @@ function make_join() {
   return new Function('result = array.join();');
 }
 
-benchy('SmiJoin', make_join(), SmiJoinSetup);
-benchy('StringJoin', make_join(), StringJoinSetup);
-benchy('SparseSmiJoin', make_join(), SparseSmiJoinSetup);
-benchy('SparseStringJoin', make_join(), SparseStringJoinSetup);
+createSuite('SmiJoin', 1000, make_join(), SmiJoinSetup);
+createSuite('StringJoin', 1000, make_join(), StringJoinSetup);
+createSuite('SparseSmiJoin', 1000, make_join(), SparseSmiJoinSetup);
+createSuite('SparseStringJoin', 1000, make_join(), SparseStringJoinSetup);
 
 function SmiJoinSetup() {
   array = new Array();
diff --git a/deps/v8/test/js-perf-test/Array/of.js b/deps/v8/test/js-perf-test/Array/of.js
index bfd471245c78f0..f876ce6f61ffbf 100644
--- a/deps/v8/test/js-perf-test/Array/of.js
+++ b/deps/v8/test/js-perf-test/Array/of.js
@@ -3,115 +3,119 @@
 // found in the LICENSE file.
 (() => {
 
-benchy('EmptyArrayOf', EmptyArrayOf, EmptyArrayOfSetup);
-benchy('SmallTransplantedArrayOf', SmallTransplantedArrayOf,
-    SmallTransplantedArrayOfSetup);
-benchy('SmallSmiArrayOf', SmallSmiArrayOf, SmallSmiArrayOfSetup);
-benchy('LargeSmiArrayOf', LargeSmiArrayOf, LargeSmiArrayOfSetup);
-benchy('SmallDoubleArrayOf', SmallDoubleArrayOf, SmallDoubleArrayOfSetup);
-benchy('SmallStringArrayOf', SmallStringArrayOf, SmallStringArrayOfSetup);
-benchy('SmallMixedArrayOf', SmallMixedArrayOf, SmallMixedArrayOfSetup);
-
-function ArrayLike() {}
-ArrayLike.of = Array.of;
-
-var arg1, arg2, arg3, arg4, arg5, arg6, arg7, arg8, arg9, arg10
-var arg11, arg12, arg13, arg14, arg15, arg16, arg17, arg18, arg19, arg20
-var result;
-
-function EmptyArrayOf() {
-  result = Array.of();
-}
-
-function BaselineArray() {
-  result = [arg1, arg2, arg3];
-}
-
-function SmallSmiArrayOf() {
-  result = Array.of(arg1, arg2, arg3);
-}
-
-function LargeSmiArrayOf() {
-  result = Array.of(arg1, arg2, arg3, arg4, arg5, arg6, arg7, arg8, arg9, arg10,
-      arg11, arg12, arg13, arg14, arg15, arg16, arg17, arg18, arg19, arg20);
-}
-
-function SmallTransplantedArrayOf() {
-  result = ArrayLike.of(arg1, arg2, arg3);
-}
-
-function SmallDoubleArrayOf() {
-  result = Array.of(arg1, arg2, arg3);
-}
-
-function SmallStringArrayOf() {
-  result = Array.of(arg1, arg2, arg3);
-}
-
-function SmallMixedArrayOf() {
-  result = Array.of(arg1, arg2, arg3);
-}
-
-function EmptyArrayOfSetup() {
-}
-
-function BaselineArraySetup() {
-  arg1 = 1;
-  arg2 = 2;
-  arg3 = 3;
-}
-
-function SmallSmiArrayOfSetup() {
-  arg1 = 1;
-  arg2 = 2;
-  arg3 = 3;
-}
-
-function SmallTransplantedArrayOfSetup() {
-  arg1 = 1;
-  arg2 = 2;
-  arg3 = 3;
-}
-
-function SmallDoubleArrayOfSetup() {
-  arg1 = 1.5;
-  arg2 = 2.5;
-  arg3 = 3.5;
-}
-
-function SmallStringArrayOfSetup() {
-  arg1 = "cat";
-  arg2 = "dog";
-  arg3 = "giraffe";
-}
-
-function SmallMixedArrayOfSetup() {
-  arg1 = 1;
-  arg2 = 2.5;
-  arg3 = "giraffe";
-}
-
-function LargeSmiArrayOfSetup() {
-  arg1 = 1;
-  arg2 = 2;
-  arg3 = 3;
-  arg4 = 4;
-  arg5 = 5;
-  arg6 = 6;
-  arg7 = 7;
-  arg8 = 8;
-  arg9 = 9;
-  arg10 = 10;
-  arg11 = 11;
-  arg12 = 12;
-  arg13 = 13;
-  arg14 = 14;
-  arg15 = 15;
-  arg16 = 16;
-  arg17 = 17;
-  arg18 = 18;
-  arg19 = 19;
-  arg20 = 20;
-}
+  createSuite('EmptyArrayOf', 1000, EmptyArrayOf, EmptyArrayOfSetup);
+  createSuite(
+      'SmallTransplantedArrayOf', 1000, SmallTransplantedArrayOf,
+      SmallTransplantedArrayOfSetup);
+  createSuite('SmallSmiArrayOf', 1000, SmallSmiArrayOf, SmallSmiArrayOfSetup);
+  createSuite('LargeSmiArrayOf', 1000, LargeSmiArrayOf, LargeSmiArrayOfSetup);
+  createSuite(
+      'SmallDoubleArrayOf', 1000, SmallDoubleArrayOf, SmallDoubleArrayOfSetup);
+  createSuite(
+      'SmallStringArrayOf', 1000, SmallStringArrayOf, SmallStringArrayOfSetup);
+  createSuite(
+      'SmallMixedArrayOf', 1000, SmallMixedArrayOf, SmallMixedArrayOfSetup);
+
+  function ArrayLike() {}
+  ArrayLike.of = Array.of;
+
+  var arg1, arg2, arg3, arg4, arg5, arg6, arg7, arg8, arg9, arg10
+  var arg11, arg12, arg13, arg14, arg15, arg16, arg17, arg18, arg19, arg20
+  var result;
+
+  function EmptyArrayOf() {
+    result = Array.of();
+  }
+
+  function BaselineArray() {
+    result = [arg1, arg2, arg3];
+  }
+
+  function SmallSmiArrayOf() {
+    result = Array.of(arg1, arg2, arg3);
+  }
+
+  function LargeSmiArrayOf() {
+    result = Array.of(
+        arg1, arg2, arg3, arg4, arg5, arg6, arg7, arg8, arg9, arg10, arg11,
+        arg12, arg13, arg14, arg15, arg16, arg17, arg18, arg19, arg20);
+  }
+
+  function SmallTransplantedArrayOf() {
+    result = ArrayLike.of(arg1, arg2, arg3);
+  }
+
+  function SmallDoubleArrayOf() {
+    result = Array.of(arg1, arg2, arg3);
+  }
+
+  function SmallStringArrayOf() {
+    result = Array.of(arg1, arg2, arg3);
+  }
+
+  function SmallMixedArrayOf() {
+    result = Array.of(arg1, arg2, arg3);
+  }
+
+  function EmptyArrayOfSetup() {}
+
+  function BaselineArraySetup() {
+    arg1 = 1;
+    arg2 = 2;
+    arg3 = 3;
+  }
+
+  function SmallSmiArrayOfSetup() {
+    arg1 = 1;
+    arg2 = 2;
+    arg3 = 3;
+  }
+
+  function SmallTransplantedArrayOfSetup() {
+    arg1 = 1;
+    arg2 = 2;
+    arg3 = 3;
+  }
+
+  function SmallDoubleArrayOfSetup() {
+    arg1 = 1.5;
+    arg2 = 2.5;
+    arg3 = 3.5;
+  }
+
+  function SmallStringArrayOfSetup() {
+    arg1 = 'cat';
+    arg2 = 'dog';
+    arg3 = 'giraffe';
+  }
+
+  function SmallMixedArrayOfSetup() {
+    arg1 = 1;
+    arg2 = 2.5;
+    arg3 = 'giraffe';
+  }
+
+  function LargeSmiArrayOfSetup() {
+    arg1 = 1;
+    arg2 = 2;
+    arg3 = 3;
+    arg4 = 4;
+    arg5 = 5;
+    arg6 = 6;
+    arg7 = 7;
+    arg8 = 8;
+    arg9 = 9;
+    arg10 = 10;
+    arg11 = 11;
+    arg12 = 12;
+    arg13 = 13;
+    arg14 = 14;
+    arg15 = 15;
+    arg16 = 16;
+    arg17 = 17;
+    arg18 = 18;
+    arg19 = 19;
+    arg20 = 20;
+  }
 
 })();
diff --git a/deps/v8/test/js-perf-test/Array/run.js b/deps/v8/test/js-perf-test/Array/run.js
index 623047678a82e5..52de9c38093442 100644
--- a/deps/v8/test/js-perf-test/Array/run.js
+++ b/deps/v8/test/js-perf-test/Array/run.js
@@ -24,13 +24,6 @@ function mc(name, generic = false) {
   return new Function(`result = array.${name}(func, this_arg);`);
 }
 
-function benchy(name, test, testSetup) {
-  new BenchmarkSuite(name, [1000],
-      [
-        new Benchmark(name, false, false, 0, test, testSetup, ()=>{})
-      ]);
-}
-
 function SmiSetup() {
   array = Array.from({ length: array_size }, (_, i) => i);
 }
@@ -63,7 +56,7 @@ function DefineHigherOrderTests(tests) {
        this_arg = undefined;
        setupFunc();
      };
-     benchy(name, testFunc, setupFuncWrapper);
+     createSuite(name, 1000, testFunc, setupFuncWrapper);
   }
 }
 
@@ -83,6 +76,7 @@ load('from.js');
 load('of.js');
 load('join.js');
 load('to-string.js');
+load('slice.js');
 
 var success = true;
 
diff --git a/deps/v8/test/js-perf-test/Array/slice.js b/deps/v8/test/js-perf-test/Array/slice.js
new file mode 100644
index 00000000000000..c9e60930f31b8e
--- /dev/null
+++ b/deps/v8/test/js-perf-test/Array/slice.js
@@ -0,0 +1,83 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+(() => {
+
+  const A = new Array(1000);
+
+  for (let i = 0; i < A.length; i++) {
+    A[i] = i;
+  }
+
+  function testArraySlice500() {
+    return A.slice(500);
+  }
+
+  function testArraySlice500_999() {
+    return A.slice(500, 999);
+  }
+
+  function testArraySliceN500() {
+    return A.slice(-500);
+  }
+
+  function testArraySlice200_700() {
+    return A.slice(200, 700);
+  }
+
+  function testArraySlice200_N300() {
+    return A.slice(200, -300);
+  }
+
+  function testArraySlice4_1() {
+    return A.slice(200, -300);
+  }
+
+  createSuiteWithWarmup("Array.slice(500)", 1, testArraySlice500);
+  createSuiteWithWarmup("Array.slice(500,999)", 1, testArraySlice500_999);
+  createSuiteWithWarmup("Array.slice(-500)", 1, testArraySliceN500);
+  createSuiteWithWarmup("Array.slice(200,700)", 1, testArraySlice200_700);
+  createSuiteWithWarmup("Array.slice(200,-300)", 1, testArraySlice200_N300);
+  createSuiteWithWarmup("Array.slice(4,1)", 1, testArraySlice4_1);
+
+})();
+
+(() => {
+
+  function assert(condition, message) {
+    if (!condition) {
+      throw Error(message);
+    }
+  }
+
+  const A = new Array(1000);
+
+  for (let i = 0; i < A.length; i++) {
+    A[i] = i;
+  }
+
+  A[100000] = 255;
+  assert(%HasDictionaryElements(A), "A should be in dictionary mode for this test");
+
+  function testArraySlice500_999() {
+    return A.slice(500, 999);
+  }
+
+  function testArraySlice200_700() {
+    return A.slice(200, 700);
+  }
+
+  function testArraySlice200_N300() {
+    return A.slice(200, -300);
+  }
+
+  function testArraySlice4_1() {
+    return A.slice(200, -300);
+  }
+
+  createSuiteWithWarmup("Array.slice(500,999)-dict", 1, testArraySlice500_999);
+  createSuiteWithWarmup("Array.slice(200,700)-dict", 1, testArraySlice200_700);
+  createSuiteWithWarmup("Array.slice(200,-300)-dict", 1, testArraySlice200_N300);
+  createSuiteWithWarmup("Array.slice(4,1)-dict", 1, testArraySlice4_1);
+
+})();
diff --git a/deps/v8/test/js-perf-test/Array/to-string.js b/deps/v8/test/js-perf-test/Array/to-string.js
index 1b6dd36eaa63e1..c97a8c173fe839 100644
--- a/deps/v8/test/js-perf-test/Array/to-string.js
+++ b/deps/v8/test/js-perf-test/Array/to-string.js
@@ -7,10 +7,11 @@ function make_tostring() {
   return new Function("result = array.toString();");
 }
 
-benchy('SmiToString', make_tostring(), SmiToStringSetup);
-benchy('StringToString', make_tostring(), StringToStringSetup);
-benchy('SparseSmiToString', make_tostring(), SparseSmiToStringSetup);
-benchy('SparseStringToString', make_tostring(), SparseStringToStringSetup);
+createSuite('SmiToString', 1000, make_tostring(), SmiToStringSetup);
+createSuite('StringToString', 1000, make_tostring(), StringToStringSetup);
+createSuite('SparseSmiToString', 1000, make_tostring(), SparseSmiToStringSetup);
+createSuite(
+    'SparseStringToString', 1000, make_tostring(), SparseStringToStringSetup);
 
 var array;
 var result;
diff --git a/deps/v8/test/js-perf-test/ArraySort/run.js b/deps/v8/test/js-perf-test/ArraySort/run.js
index 5d94048bb5b46b..95f64d645017cd 100644
--- a/deps/v8/test/js-perf-test/ArraySort/run.js
+++ b/deps/v8/test/js-perf-test/ArraySort/run.js
@@ -3,14 +3,7 @@
 // found in the LICENSE file.
 
 load('../base.js');
-load('sort.js')
-
-function benchy(name, test, testSetup) {
-  new BenchmarkSuite(name, [1000],
-      [
-        new Benchmark(name, false, false, 0, test, testSetup)
-      ]);
-}
+load(arguments[0] + '.js')
 
 function PrintResult(name, result) {
   print(name + '-ArraySort(Score): ' + result);
diff --git a/deps/v8/test/js-perf-test/ArraySort/sort-base.js b/deps/v8/test/js-perf-test/ArraySort/sort-base.js
new file mode 100644
index 00000000000000..a3301752b28aab
--- /dev/null
+++ b/deps/v8/test/js-perf-test/ArraySort/sort-base.js
@@ -0,0 +1,145 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+const kArraySize = 4000;
+let template_array = [];
+
+for (let i = 0; i < kArraySize; ++i) {
+  template_array[i] = Math.floor(Math.random() * kArraySize);
+}
+
+let array_to_sort = [];
+
+function assert(condition, message) {
+  if (!condition) {
+    throw Error(message);
+  }
+}
+
+function AssertPackedSmiElements() {
+  assert(%HasFastPackedElements(array_to_sort) &&
+         %HasSmiElements(array_to_sort),
+         "Element kind is not PACKED_SMI_ELEMENTS");
+}
+
+function AssertPackedDoubleElements() {
+  assert(%HasFastPackedElements(array_to_sort) &&
+         %HasDoubleElements(array_to_sort),
+         "Element kind is not PACKED_DOUBLE_ELEMENTS");
+}
+
+function AssertPackedObjectElements() {
+  assert(%HasFastPackedElements(array_to_sort) &&
+         %HasObjectElements(array_to_sort),
+         "Element kind is not PACKED_ELEMENTS");
+}
+
+function AssertHoleySmiElements() {
+  assert(%HasHoleyElements(array_to_sort) &&
+         %HasSmiElements(array_to_sort),
+         "Element kind is not HOLEY_SMI_ELEMENTS");
+}
+
+function AssertHoleyDoubleElements() {
+  assert(%HasHoleyElements(array_to_sort) &&
+         %HasDoubleElements(array_to_sort),
+         "Element kind is not HOLEY_DOUBLE_ELEMENTS");
+}
+
+function AssertHoleyObjectElements() {
+  assert(%HasHoleyElements(array_to_sort) &&
+         %HasObjectElements(array_to_sort),
+         "Element kind is not HOLEY_ELEMENTS");
+}
+
+function AssertDictionaryElements() {
+  assert(%HasDictionaryElements(array_to_sort),
+         "Element kind is not DICTIONARY_ELEMENTS");
+}
+
+function CreatePackedSmiArray() {
+  array_to_sort = Array.from(template_array);
+  AssertPackedSmiElements();
+}
+
+function CreatePackedDoubleArray() {
+  array_to_sort = Array.from(template_array, (x,_) => x + 0.1);
+  AssertPackedDoubleElements();
+}
+
+function CreatePackedObjectArray() {
+  array_to_sort = Array.from(template_array, (x,_) => `value ${x}`);
+  AssertPackedObjectElements();
+}
+
+function CreateHoleySmiArray() {
+  array_to_sort = Array.from(template_array);
+  delete array_to_sort[0];
+  AssertHoleySmiElements();
+}
+
+function CreateHoleyDoubleArray() {
+  array_to_sort = new Array(kArraySize);
+  for (let i = 0; i < kArraySize; ++i) {
+    array_to_sort[i] = template_array[i] + 0.1;
+  }
+
+  AssertHoleyDoubleElements();
+}
+
+function CreateHoleyObjectArray() {
+  array_to_sort = new Array(kArraySize);
+  for (let i = 0; i < kArraySize; ++i) {
+    array_to_sort[i] = `value ${template_array[i]}`;
+  }
+
+  AssertHoleyObjectElements();
+}
+
+function CreateDictionaryArray() {
+  array_to_sort = Array.from(template_array);
+  array_to_sort[%MaxSmi()] = 42;
+
+  AssertDictionaryElements();
+}
+
+function Sort() {
+  array_to_sort.sort();
+}
+
+function CreateSortFn(comparefns = []) {
+  return () => {
+    for (let cmpfn of comparefns) {
+      array_to_sort.sort(cmpfn);
+    }
+  }
+}
+
+function cmp_smaller(a, b) {
+  if (a < b) return -1;
+  if (b < a) return 1;
+  return 0;
+}
+
+function cmp_greater(a, b) { return cmp_smaller(b, a); }
+
+// The counter is used in some benchmarks to trigger actions during sorting.
+// To keep benchmarks deterministic, the counter needs to be reset for each
+// iteration.
+let counter = 0;
+
+// Sorting benchmarks need to execute setup and tearDown for each iteration.
+// Otherwise the benchmarks would mainly measure sorting already sorted arrays
+// which, depending on the strategy, is either the worst- or best case.
+function createSortSuite(name, reference, run, setup, tearDown = () => {}) {
+  let run_fn = () => {
+    counter = 0;
+
+    setup();
+    run();
+    tearDown();
+  };
+
+  return createSuite(name, reference, run_fn);
+}
diff --git a/deps/v8/test/js-perf-test/ArraySort/sort-cmpfn-kindchange.js b/deps/v8/test/js-perf-test/ArraySort/sort-cmpfn-kindchange.js
new file mode 100644
index 00000000000000..8ff1a0259913ed
--- /dev/null
+++ b/deps/v8/test/js-perf-test/ArraySort/sort-cmpfn-kindchange.js
@@ -0,0 +1,43 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+load('sort-base.js');
+
+// Creates a comparison function, that will call the provided transform function
+// after a set amount of comparisons. The transform function should cause the
+// element kind of the array to change.
+function CreateCompareFn(transformfn) {
+  return (a, b) => {
+    ++counter;
+    if (counter == kArraySize/2) {
+      transformfn();
+    }
+
+    return cmp_smaller(a, b);
+  }
+}
+
+let cmp_packed_smi_to_double = CreateCompareFn(() => array_to_sort.push(0.1));
+let cmp_holey_smi_to_double = CreateCompareFn(() => array_to_sort.push(0.1));
+let cmp_double_to_double = CreateCompareFn(() => array_to_sort.length *= 2);
+
+createSortSuite(
+    'PackedSmiToPackedDouble', 1000, CreateSortFn([cmp_packed_smi_to_double]),
+    CreatePackedSmiArray, AssertPackedDoubleElements);
+createSortSuite(
+    'HoleySmiToHoleyDouble', 1000, CreateSortFn([cmp_holey_smi_to_double]),
+    CreateHoleySmiArray, AssertHoleyDoubleElements);
+createSortSuite(
+    'PackedDoubleToHoleyDouble', 1000, CreateSortFn([cmp_double_to_double]),
+    CreatePackedDoubleArray, AssertHoleyDoubleElements);
+
+let cmp_packed_to_dict = CreateCompareFn(() => array_to_sort[%MaxSmi()] = 42);
+let cmp_holey_to_dict = CreateCompareFn(() => array_to_sort[%MaxSmi()] = 42);
+
+createSortSuite(
+    'PackedElementToDictionary', 1000, CreateSortFn([cmp_packed_to_dict]),
+    CreatePackedObjectArray, AssertDictionaryElements);
+createSortSuite(
+    'HoleyElementToDictionary', 1000, CreateSortFn([cmp_holey_to_dict]),
+    CreateHoleyObjectArray, AssertDictionaryElements);
diff --git a/deps/v8/test/js-perf-test/ArraySort/sort-cmpfn.js b/deps/v8/test/js-perf-test/ArraySort/sort-cmpfn.js
new file mode 100644
index 00000000000000..9675f5ce9e5a53
--- /dev/null
+++ b/deps/v8/test/js-perf-test/ArraySort/sort-cmpfn.js
@@ -0,0 +1,20 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+load('sort-base.js');
+
+// Each benchmark calls sort with multiple different comparison functions
+// to create polyomorphic call sites. Most/all of the
+// other sort benchmarks have monomorphic call sites.
+let sortfn = CreateSortFn([cmp_smaller, cmp_greater]);
+
+createSortSuite('PackedSmi', 1000, sortfn, CreatePackedSmiArray);
+createSortSuite('PackedDouble', 1000, sortfn, CreatePackedDoubleArray);
+createSortSuite('PackedElement', 1000, sortfn, CreatePackedObjectArray);
+
+createSortSuite('HoleySmi', 1000, sortfn, CreateHoleySmiArray);
+createSortSuite('HoleyDouble', 1000, sortfn, CreateHoleyDoubleArray);
+createSortSuite('HoleyElement', 1000, sortfn, CreateHoleyObjectArray);
+
+createSortSuite('Dictionary', 1000, sortfn, CreateDictionaryArray);
diff --git a/deps/v8/test/js-perf-test/ArraySort/sort-lengths.js b/deps/v8/test/js-perf-test/ArraySort/sort-lengths.js
new file mode 100644
index 00000000000000..aa681295c12c1f
--- /dev/null
+++ b/deps/v8/test/js-perf-test/ArraySort/sort-lengths.js
@@ -0,0 +1,40 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+load('sort-base.js');
+
+function SortAsc() {
+  array_to_sort.sort(cmp_smaller);
+}
+
+function Random(length) {
+  for (let i = 0; i < length; ++i) {
+    array_to_sort.push(Math.floor(Math.random()) * length);
+  }
+  AssertPackedSmiElements();
+}
+
+function Sorted(length) {
+  for (let i = 0; i < length; ++i) {
+    array_to_sort.push(i);
+  }
+  AssertPackedSmiElements();
+}
+
+function TearDown() {
+  array_to_sort = [];
+}
+
+function CreateSortSuitesForLength(length) {
+  createSortSuite(
+      'Random' + length, 1000, SortAsc, () => Random(length), TearDown);
+  createSortSuite(
+      'Sorted' + length, 1000, SortAsc, () => Sorted(length), TearDown);
+}
+
+CreateSortSuitesForLength(10);
+CreateSortSuitesForLength(100);
+CreateSortSuitesForLength(1000);
+CreateSortSuitesForLength(10000);
+CreateSortSuitesForLength(100000);
diff --git a/deps/v8/test/js-perf-test/ArraySort/sort-megamorphic.js b/deps/v8/test/js-perf-test/ArraySort/sort-megamorphic.js
new file mode 100644
index 00000000000000..4f710313585505
--- /dev/null
+++ b/deps/v8/test/js-perf-test/ArraySort/sort-megamorphic.js
@@ -0,0 +1,20 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+load('sort-base.js');
+
+function SetupMegamorphic() {
+  CreatePackedSmiArray();
+
+  Array.prototype.sort.call([1.1]);
+  Array.prototype.sort.call(['a']);
+  Array.prototype.sort.call([2,,3]);
+  Array.prototype.sort.call([0.2,,0.1]);
+  Array.prototype.sort.call(['b',,'a']);
+  Array.prototype.sort.call({});
+}
+
+createSortSuite('Base', 1000, Sort, SetupMegamorphic);
+createSortSuite('MultipleCompareFns', 1000,
+    CreateSortFn([cmp_smaller, cmp_greater]), SetupMegamorphic);
diff --git a/deps/v8/test/js-perf-test/ArraySort/sort-presorted.js b/deps/v8/test/js-perf-test/ArraySort/sort-presorted.js
new file mode 100644
index 00000000000000..50786411bbe9c4
--- /dev/null
+++ b/deps/v8/test/js-perf-test/ArraySort/sort-presorted.js
@@ -0,0 +1,108 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+load('sort-base.js');
+
+const kLength = 2e4;
+const kLengthHalf = kLength >>> 1;
+
+function SortAsc() {
+  array_to_sort.sort(cmp_smaller);
+}
+
+function Up(a, length) {
+  for (let i = 0; i < length; ++i) {
+    a.push(i);
+  }
+}
+
+function Down(a, length) {
+  for (let i = 0; i < length; ++i) {
+    a.push(length - i);
+  }
+}
+
+function SawSeq(a, tooth, length) {
+  let count = 0;
+  while (true) {
+    for (let i = 0; i < tooth; ++i) {
+      a.push(i);
+      if (++count >= length) return;
+    }
+  }
+}
+
+function SawSeq2(a, tooth, length) {
+  let count = 0;
+  while (true) {
+    for (let i = 0; i < tooth; ++i) {
+      a.push(i);
+      if (++count >= length) return;
+    }
+    for (let i = 0; i < tooth; ++i) {
+      a.push(tooth - i);
+      if (++count >= length) return;
+    }
+  }
+}
+
+function SawSeq3(a, tooth, length) {
+  let count = 0;
+  while (true) {
+    for (let i = 0; i < tooth; ++i) {
+      a.push(tooth - i);
+      if (++count >= length) return;
+    }
+  }
+}
+
+function Random(a, length) {
+  for (let i = 0; i < length; ++i) {
+    a.push(Math.floor(Math.random() * length));
+  }
+}
+
+function TearDown() {
+  // Sanity check that the array is sorted.
+  let length = array_to_sort.length - 1;
+  for (let i = 0; i < length; ++i) {
+    if (array_to_sort[i] > array_to_sort[i + 1]) {
+      throw "Not sorted correctly: i = " + i;
+    }
+  }
+  array_to_sort = [];
+}
+
+let SetupSaw1000 = () => SawSeq(array_to_sort, 1000, kLength);
+let SetupSaw500 = () => SawSeq(array_to_sort, 500, kLength);
+let SetupSaw200 = () => SawSeq(array_to_sort, 200, kLength);
+let SetupSaw200Sym = () => SawSeq2(array_to_sort, 200, kLength);
+let SetupSaw200Down = () => SawSeq3(array_to_sort, 200, kLength);
+
+function SetupPreSortedHalfs(firstfn, secondfn) {
+  array_to_sort = [];
+  firstfn(array_to_sort, kLengthHalf);
+  secondfn(array_to_sort, kLengthHalf);
+}
+
+let SetupUpDown = () => SetupPreSortedHalfs(Up, Down);
+let SetupUpUp = () => SetupPreSortedHalfs(Up, Up);
+let SetupDownDown = () => SetupPreSortedHalfs(Down, Down);
+let SetupDownUp = () => SetupPreSortedHalfs(Down, Up);
+
+createSortSuite(
+    'Random', 1000, SortAsc, () => Random(array_to_sort, kLength), TearDown);
+createSortSuite(
+    'Up', 1000, SortAsc, () => Up(array_to_sort, kLength), TearDown);
+createSortSuite(
+    'Down', 1000, SortAsc, () => Down(array_to_sort, kLength), TearDown);
+createSortSuite('Saw1000', 1000, SortAsc, SetupSaw1000, TearDown);
+createSortSuite('Saw500', 1000, SortAsc, SetupSaw500, TearDown);
+createSortSuite('Saw200', 1000, SortAsc, SetupSaw200, TearDown);
+createSortSuite('Saw200Symmetric', 1000, SortAsc, SetupSaw200Sym, TearDown);
+createSortSuite('Saw200Down', 1000, SortAsc, SetupSaw200Down, TearDown);
+createSortSuite('UpDown', 1000, SortAsc, SetupUpDown, TearDown);
+createSortSuite('UpUp', 1000, SortAsc, SetupUpUp, TearDown);
+createSortSuite('DownDown', 1000, SortAsc, SetupDownDown, TearDown);
+createSortSuite('DownUp', 1000, SortAsc, SetupDownUp, TearDown);
diff --git a/deps/v8/test/js-perf-test/ArraySort/sort.js b/deps/v8/test/js-perf-test/ArraySort/sort.js
index 06f89e8bf5acda..cc77e5884d320e 100644
--- a/deps/v8/test/js-perf-test/ArraySort/sort.js
+++ b/deps/v8/test/js-perf-test/ArraySort/sort.js
@@ -2,97 +2,14 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-(() => {
+load('sort-base.js');
 
-const size = 10;
-let template_array = [];
+createSortSuite('PackedSmi', 1000, Sort, CreatePackedSmiArray);
+createSortSuite('PackedDouble', 1000, Sort, CreatePackedDoubleArray);
+createSortSuite('PackedElement', 1000, Sort, CreatePackedObjectArray);
 
-for (let i = 0; i < size; ++i) {
-  template_array[i] = Math.floor(Math.random() * size);
-}
+createSortSuite('HoleySmi', 1000, Sort, CreateHoleySmiArray);
+createSortSuite('HoleyDouble', 1000, Sort, CreateHoleyDoubleArray);
+createSortSuite('HoleyElement', 1000, Sort, CreateHoleyObjectArray);
 
-let packed_smi_array = Array.from(template_array);
-let packed_double_array = Array.from(template_array, (x,_) => x + 0.1);
-let packed_object_array = Array.from(template_array, (x,_) => `value ${x}`);
-
-let holey_smi_array = new Array(size);
-let holey_double_array = new Array(size);
-let holey_object_array = new Array(size);
-
-for (let i = 0; i < size; i += 5) {
-  const x = Math.floor(Math.random() * size);
-
-  holey_smi_array[i] = x;
-  holey_double_array[i] = x + 0.1;
-  holey_object_array[i] = `value ${x}`;
-}
-
-let dictionary_array = Array.from(template_array);
-dictionary_array[%MaxSmi()] = 42;
-
-function assert(condition, message) {
-  if (!condition) {
-    throw Error(message);
-  }
-}
-
-assert(%HasFastPackedElements(packed_smi_array) &&
-       %HasSmiElements(packed_smi_array),
-       "Element kind is not PACKED_SMI_ELEMENTS");
-assert(%HasFastPackedElements(packed_double_array) &&
-       %HasDoubleElements(packed_double_array),
-       "Element kind is not PACKED_DOUBLE_ELEMENTS");
-assert(%HasFastPackedElements(packed_object_array) &&
-       %HasObjectElements(packed_object_array),
-       "Element kind is not PACKED_ELEMENTS");
-assert(%HasHoleyElements(holey_smi_array) &&
-       %HasSmiElements(holey_smi_array),
-       "Element kind is not HOLEY_SMI_ELEMENTS");
-assert(%HasHoleyElements(holey_double_array) &&
-       %HasDoubleElements(holey_double_array),
-       "Element kind is not HOLEY_DOUBLE_ELEMENTS");
-assert(%HasHoleyElements(holey_object_array) &&
-       %HasObjectElements(holey_object_array),
-       "Element kind is not HOLEY_ELEMENTS");
-assert(%HasDictionaryElements(dictionary_array),
-       "Element kind is not DICTIONARY_ELEMENTS");
-
-function PackedSmiSort() {
-  packed_smi_array.sort();
-}
-
-function PackedDoubleSort() {
-  packed_double_array.sort();
-}
-
-function PackedElementSort() {
-  packed_object_array.sort();
-}
-
-function HoleySmiSort() {
-  holey_smi_array.sort();
-}
-
-function HoleyDoubleSort() {
-  holey_double_array.sort();
-}
-
-function HoleyElementSort() {
-  holey_object_array.sort();
-}
-
-function DictionarySort() {
-  dictionary_array.sort();
-}
-
-benchy('PackedSmi', PackedSmiSort);
-benchy('PackedDouble', PackedDoubleSort);
-benchy('PackedElement', PackedElementSort);
-
-benchy('HoleySmi', HoleySmiSort);
-benchy('HoleyDouble', HoleyDoubleSort);
-benchy('HoleyElement', HoleyElementSort);
-
-benchy('Dictionary', DictionarySort);
-
-})();
+createSortSuite('Dictionary', 1000, Sort, CreateDictionaryArray);
diff --git a/deps/v8/test/js-perf-test/DataView/dataviewtest.js b/deps/v8/test/js-perf-test/DataView/dataviewtest.js
new file mode 100644
index 00000000000000..e8de3a2a9be44a
--- /dev/null
+++ b/deps/v8/test/js-perf-test/DataView/dataviewtest.js
@@ -0,0 +1,210 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+new BenchmarkSuite('DataViewTest-DataView-BigEndian', [1000], [
+  new Benchmark('DataViewTest-DataView-BigEndian', false, false, 0, doTestDataViewBigEndian),
+]);
+
+new BenchmarkSuite('DataViewTest-DataView-LittleEndian', [1000], [
+  new Benchmark('DataViewTest-DataView-LittleEndian', false, false, 0, doTestDataViewLittleEndian),
+]);
+
+new BenchmarkSuite('DataViewTest-DataView-Floats', [1000], [
+  new Benchmark('DataViewTest-DataView-Floats', false, false, 0, doTestDataViewFloats),
+]);
+
+new BenchmarkSuite('DataViewTest-TypedArray-BigEndian', [1000], [
+  new Benchmark('DataViewTest-TypedArray-BigEndian', false, false, 0, doTestTypedArrayBigEndian),
+]);
+
+new BenchmarkSuite('DataViewTest-TypedArray-LittleEndian', [1000], [
+  new Benchmark('DataViewTest-TypedArray-LittleEndian', false, false, 0, doTestTypedArrayLittleEndian),
+]);
+
+new BenchmarkSuite('DataViewTest-TypedArray-Floats', [1000], [
+  new Benchmark('DataViewTest-TypedArray-Floats', false, false, 0, doTestTypedArrayFloats),
+]);
+
+function doTestDataViewBigEndian() {
+  doIterations(false, true);
+}
+
+function doTestDataViewLittleEndian() {
+  doIterations(true, true);
+}
+
+function doTestTypedArrayBigEndian() {
+  doIterations(false, false);
+}
+
+function doTestTypedArrayLittleEndian() {
+  doIterations(true, false);
+}
+
+function doTestDataViewFloats() {
+  doFloatIterations(true);
+}
+
+function doTestTypedArrayFloats() {
+  doFloatIterations(false);
+}
+
+function doIterations(littleEndian, dataView) {
+  var buffer = makeBuffer(1000, littleEndian);
+  var iterations = 10;
+  if (dataView) {
+    for (var i = 0; i < iterations; i++)
+      doOneIterationDV(buffer, littleEndian);
+  } else {
+    for (var i = 0; i < iterations; i++)
+      doOneIterationJS(buffer, littleEndian);
+  }
+}
+
+function makeBuffer(size, littleEndian) {
+  var buffer = new ArrayBuffer(size * 14);
+  var view = new DataView(buffer);
+  for (var i = 0; i < size; ++i) {
+    view.setInt8(i * 14, i);
+    view.setUint8(i * 14 + 1, i);
+    view.setInt16(i * 14 + 2, i * i, littleEndian);
+    view.setUint16(i * 14 + 4, i * i, littleEndian);
+    view.setInt32(i * 14 + 6, i * i * i, littleEndian);
+    view.setUint32(i * 14 + 10, i * i * i, littleEndian);
+  }
+  return buffer;
+}
+
+function doOneIterationDV(buffer, littleEndian) {
+  var xor = 0;
+  var view = new DataView(buffer);
+  for (var i = 0; i < view.byteLength; i += 14) {
+    xor ^= view.getInt8(i);
+    xor ^= view.getUint8(i + 1);
+    xor ^= view.getInt16(i + 2, littleEndian);
+    xor ^= view.getUint16(i + 4, littleEndian);
+    xor ^= view.getInt32(i + 6, littleEndian);
+    xor ^= view.getUint32(i + 10, littleEndian);
+  }
+}
+
+function doOneIterationJS(buffer, littleEndian) {
+  var xor = 0;
+  var reader;
+  if (littleEndian) {
+    reader = new LittleEndian(buffer);
+  } else {
+    reader = new BigEndian(buffer);
+  }
+  for (var i = 0; i < buffer.byteLength; i += 14) {
+    xor ^= reader.getInt8(i);
+    xor ^= reader.getUint8(i + 1);
+    xor ^= reader.getInt16(i + 2);
+    xor ^= reader.getUint16(i + 4);
+    xor ^= reader.getInt32(i + 6);
+    xor ^= reader.getUint32(i + 10);
+  }
+}
+
+function doFloatIterations(dataView) {
+  var buffer = makeFloatBuffer(1000);
+  var iterations = 10;
+  if (dataView) {
+    for (var i = 0; i < iterations; i++)
+      doOneFloatIterationDV(buffer);
+  } else {
+    for (var i = 0; i < iterations; i++)
+      doOneFloatIterationJS(buffer);
+  }
+}
+
+function makeFloatBuffer(size) {
+  var buffer = new ArrayBuffer(size * 16);
+  var view = new DataView(buffer);
+  for (var i = 0; i < size; i++) {
+    view.setFloat64(i * 16, Math.log10(i + 1));
+    view.setFloat32(i * 16 + 8, Math.sqrt(i));
+    view.setFloat32(i * 16 + 12, Math.cos(i));
+  }
+  return buffer;
+}
+
+function doOneFloatIterationDV(buffer) {
+  var sum = 0;
+  var view = new DataView(buffer);
+  for (var i = 0; i < view.byteLength; i += 16) {
+    sum += view.getFloat64(i);
+    sum += view.getFloat32(i + 8);
+    sum += view.getFloat32(i + 12);
+  }
+}
+
+function doOneFloatIterationJS(buffer) {
+  var sum = 0;
+  var float32array = new Float32Array(buffer);
+  var float64array = new Float64Array(buffer);
+  for (var i = 0; i < buffer.byteLength; i += 16) {
+    sum += float64array[i/8];
+    sum += float32array[i/4 + 2];
+    sum += float32array[i/4 + 3];
+  }
+}
+
+function BigEndian(buffer, opt_byteOffset) {
+  this.uint8View_ = new Uint8Array(buffer, opt_byteOffset || 0);
+  this.int8View_ = new Int8Array(buffer, opt_byteOffset || 0);
+}
+BigEndian.prototype.getInt8 = function(byteOffset) {
+  return this.int8View_[byteOffset];
+};
+BigEndian.prototype.getUint8 = function(byteOffset) {
+  return this.uint8View_[byteOffset];
+};
+BigEndian.prototype.getInt16 = function(byteOffset) {
+  return this.uint8View_[byteOffset + 1] | (this.int8View_[byteOffset] << 8);
+};
+BigEndian.prototype.getUint16 = function(byteOffset) {
+  return this.uint8View_[byteOffset + 1] | (this.uint8View_[byteOffset] << 8);
+};
+BigEndian.prototype.getInt32 = function(byteOffset) {
+  return this.uint8View_[byteOffset + 3] |
+      (this.uint8View_[byteOffset + 2] << 8) |
+      (this.uint8View_[byteOffset + 1] << 16) |
+      (this.int8View_[byteOffset] << 24);
+};
+BigEndian.prototype.getUint32 = function(byteOffset) {
+  return this.uint8View_[byteOffset + 3] +
+      (this.uint8View_[byteOffset + 2] << 8) +
+      (this.uint8View_[byteOffset + 1] << 16) +
+      (this.uint8View_[byteOffset] * (1 << 24));
+};
+
+function LittleEndian(buffer, opt_byteOffset) {
+  this.uint8View_ = new Uint8Array(buffer, opt_byteOffset || 0);
+  this.int8View_ = new Int8Array(buffer, opt_byteOffset || 0);
+}
+LittleEndian.prototype.getInt8 = function(byteOffset) {
+  return this.int8View_[byteOffset];
+};
+LittleEndian.prototype.getUint8 = function(byteOffset) {
+  return this.uint8View_[byteOffset];
+};
+LittleEndian.prototype.getInt16 = function(byteOffset) {
+  return this.uint8View_[byteOffset] | (this.int8View_[byteOffset + 1] << 8);
+};
+LittleEndian.prototype.getUint16 = function(byteOffset) {
+  return this.uint8View_[byteOffset] | (this.uint8View_[byteOffset + 1] << 8);
+};
+LittleEndian.prototype.getInt32 = function(byteOffset) {
+  return this.uint8View_[byteOffset] |
+      (this.uint8View_[byteOffset + 1] << 8) |
+      (this.uint8View_[byteOffset + 2] << 16) |
+      (this.int8View_[byteOffset + 3] << 24);
+};
+LittleEndian.prototype.getUint32 = function(byteOffset) {
+  return this.uint8View_[byteOffset] +
+      (this.uint8View_[byteOffset + 1] << 8) +
+      (this.uint8View_[byteOffset + 2] << 16) +
+      (this.uint8View_[byteOffset + 3] * (1 << 24));
+};
diff --git a/deps/v8/test/js-perf-test/DataView/run.js b/deps/v8/test/js-perf-test/DataView/run.js
new file mode 100644
index 00000000000000..5515166e0654a1
--- /dev/null
+++ b/deps/v8/test/js-perf-test/DataView/run.js
@@ -0,0 +1,24 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+load('../base.js');
+load('dataviewtest.js');
+
+var success = true;
+
+function PrintResult(name, result) {
+  print(`DataView-${name}(Score): ${result}`);
+}
+
+function PrintError(name, error) {
+  PrintResult(name, error);
+  success = false;
+}
+
+
+BenchmarkSuite.config.doWarmup = undefined;
+BenchmarkSuite.config.doDeterministic = undefined;
+
+BenchmarkSuite.RunSuites({ NotifyResult: PrintResult,
+                           NotifyError: PrintError });
diff --git a/deps/v8/test/js-perf-test/Inspector/debugger.js b/deps/v8/test/js-perf-test/Inspector/debugger.js
index c2ec6d993dd46c..8e44aa77109824 100644
--- a/deps/v8/test/js-perf-test/Inspector/debugger.js
+++ b/deps/v8/test/js-perf-test/Inspector/debugger.js
@@ -3,77 +3,73 @@
 // found in the LICENSE file.
 
 (function() {
-  function benchy(name, test, testSetup) {
-    new BenchmarkSuite(name, [10000], [
-      new Benchmark(name, false, false, 0, test, testSetup, TearDown)
-    ]);
-  }
 
-  benchy('Debugger.paused', DebuggerPaused, Setup);
-  benchy('Debugger.getPossibleBreakpoints',
-    DebuggerGetPossibleBreakpoints,
-    SetupGetPossibleBreakpoints);
-  benchy('AsyncStacksInstrumentation',
-    AsyncStacksInstrumentation,
-    SetupAsyncStacksInstrumentation);
+createSuite('Debugger.paused', 10000, DebuggerPaused, Setup, TearDown);
+createSuite(
+    'Debugger.getPossibleBreakpoints', 10000, DebuggerGetPossibleBreakpoints,
+    SetupGetPossibleBreakpoints, TearDown);
+createSuite(
+    'AsyncStacksInstrumentation', 10000, AsyncStacksInstrumentation,
+    SetupAsyncStacksInstrumentation, TearDown);
 
-  function Setup() {
-    SendMessage('Debugger.enable');
-    // Force lazy compilation of inspector related scripts.
-    SendMessage('Runtime.evaluate', {expression: ''});
-  }
+function Setup() {
+  SendMessage('Debugger.enable');
+  // Force lazy compilation of inspector related scripts.
+  SendMessage('Runtime.evaluate', {expression: ''});
+}
 
-  function TearDown() {
-    SendMessage('Debugger.disable');
-  }
+function TearDown() {
+  SendMessage('Debugger.disable');
+}
 
-  function DebuggerPaused() {
-    for (var i = 0; i < 10; ++i) {
-      debugger;
-    }
+function DebuggerPaused() {
+  for (var i = 0; i < 10; ++i) {
+    debugger;
   }
+}
 
-  let scriptId;
-  function SetupGetPossibleBreakpoints() {
-    Setup();
-    let expression = '';
-    for (let i = 0; i < 20; ++i) {
-      expression += `function foo${i}(){
-  if (a) {
-    return true;
-  } else {
-    return false;
-  }
-}\n`;
-    }
-    listener = function(msg) {
-      if (msg.method === "Debugger.scriptParsed") {
-        scriptId = msg.params.scriptId;
-        listener = null;
-      }
+let scriptId;
+function SetupGetPossibleBreakpoints() {
+  Setup();
+  let expression = '';
+  for (let i = 0; i < 20; ++i) {
+    expression += `function foo${i}(){
+        if (a) {
+          return true;
+        } else {
+          return false;
+        }
+      }\n`;
+  };
+  listener = function(msg) {
+    if (msg.method === 'Debugger.scriptParsed') {
+      scriptId = msg.params.scriptId;
+      listener = null;
     }
-    SendMessage('Runtime.evaluate', {expression});
-  }
+  };
+  SendMessage('Runtime.evaluate', {expression});
+}
 
-  function DebuggerGetPossibleBreakpoints() {
-    SendMessage('Debugger.getPossibleBreakpoints', {
-      start: {lineNumber: 0, columnNumber: 0, scriptId: scriptId}
-    });
-  }
+function DebuggerGetPossibleBreakpoints() {
+  SendMessage(
+      'Debugger.getPossibleBreakpoints',
+      {start: {lineNumber: 0, columnNumber: 0, scriptId: scriptId}});
+}
 
-  function SetupAsyncStacksInstrumentation() {
-    Setup();
-    SendMessage('Debugger.setAsyncCallStackDepth', {maxDepth: 1024});
-  }
+function SetupAsyncStacksInstrumentation() {
+  Setup();
+  SendMessage('Debugger.setAsyncCallStackDepth', {maxDepth: 1024});
+}
 
-  function AsyncStacksInstrumentation() {
-    var p = Promise.resolve();
-    var nopCallback = () => undefined;
-    var done = false;
-    for (let i = 0; i < 1000; ++i) {
-      p = p.then(nopCallback);
-    }
-    p = p.then(() => done = true);
-    while (!done) %RunMicrotasks();
+function AsyncStacksInstrumentation() {
+  var p = Promise.resolve();
+  var nopCallback = () => undefined;
+  var done = false;
+  for (let i = 0; i < 1000; ++i) {
+    p = p.then(nopCallback);
   }
+  p = p.then(() => done = true);
+  while (!done) %RunMicrotasks();
+}
+
 })();
diff --git a/deps/v8/test/js-perf-test/JSTests.json b/deps/v8/test/js-perf-test/JSTests.json
index 4d0794c8c8eb73..ce7e102b62a72c 100644
--- a/deps/v8/test/js-perf-test/JSTests.json
+++ b/deps/v8/test/js-perf-test/JSTests.json
@@ -1,4 +1,5 @@
 {
+  "owners": ["jarin@chromium.org", "mvstanston@chromium.org"],
   "name": "JSTests",
   "run_count": 3,
   "run_count_arm": 1,
@@ -237,6 +238,24 @@
             {"name": "StringIndexOfNonConstant"}
           ]
         },
+        {
+          "name": "StringSplit",
+          "main": "run.js",
+          "resources": [ "string-split.js" ],
+          "test_flags": [ "string-split" ],
+          "results_regexp": "^%s\\-Strings\\(Score\\): (.+)$",
+          "run_count": 1,
+          "tests": [
+            {"name": "ShortSubjectEmptySeparator"},
+            {"name": "LongSubjectEmptySeparator"},
+            {"name": "ShortTwoBytesSubjectEmptySeparator"},
+            {"name": "LongTwoBytesSubjectEmptySeparator"},
+            {"name": "ShortSubject"},
+            {"name": "LongSubject"},
+            {"name": "ShortTwoBytesSubject"},
+            {"name": "LongTwoBytesSubject"}
+          ]
+        },
         {
           "name": "StringAt",
           "main": "run.js",
@@ -292,6 +311,20 @@
             {"name": "StringMatchAllBuiltinZeroWidthUnicode"}
           ]
         },
+        {
+          "name": "StringStartsEndsWithComparison",
+          "main": "run.js",
+          "resources": [ "string-startsendswith-comp.js" ],
+          "test_flags": [ "string-startsendswith-comp" ],
+          "results_regexp": "^%s\\-Strings\\(Score\\): (.+)$",
+          "run_count": 1,
+          "tests": [
+            {"name": "startsWith"},
+            {"name": "startsIndex"},
+            {"name": "endsWith"},
+            {"name": "endsIndex"}
+          ]
+        },
         {
           "name": "StringSubstring",
           "main": "run.js",
@@ -446,6 +479,21 @@
         {"name": "Object.hasOwnProperty--NE-el"}
       ]
     },
+    {
+      "name": "DataView",
+      "path": ["DataView"],
+      "main": "run.js",
+      "resources": ["dataviewtest.js"],
+      "results_regexp": "^DataView\\-%s\\(Score\\): (.+)$",
+      "tests": [
+	{"name": "DataViewTest-DataView-BigEndian"},
+	{"name": "DataViewTest-DataView-LittleEndian"},
+	{"name": "DataViewTest-DataView-Floats"},
+	{"name": "DataViewTest-TypedArray-BigEndian"},
+	{"name": "DataViewTest-TypedArray-LittleEndian"},
+	{"name": "DataViewTest-TypedArray-Floats"}
+      ]
+    },
     {
       "name": "TypedArrays",
       "path": ["TypedArrays"],
@@ -520,25 +568,37 @@
         {
           "name": "SortIntTypes",
           "main": "run.js",
-          "resources": ["sort-int.js"],
+          "resources": ["sort.js", "sort-int.js"],
           "test_flags": ["sort-int"]
         },
+        {
+          "name": "SortBigIntTypes",
+          "main": "run.js",
+          "resources": ["sort.js", "sort-bigint.js"],
+          "test_flags": ["sort-bigint"]
+        },
         {
           "name": "SortFloatTypes",
           "main": "run.js",
-          "resources": ["sort-float.js"],
+          "resources": ["sort.js", "sort-float.js"],
           "test_flags": ["sort-float"]
         },
         {
           "name": "SortCustomCompareFnIntTypes",
           "main": "run.js",
-          "resources": ["sort-cmpfn-int.js"],
+          "resources": ["sort.js", "sort-cmpfn-int.js"],
           "test_flags": ["sort-cmpfn-int"]
         },
+        {
+          "name": "SortCustomCompareFnBigIntTypes",
+          "main": "run.js",
+          "resources": ["sort.js", "sort-cmpfn-bigint.js"],
+          "test_flags": ["sort-cmpfn-bigint"]
+        },
         {
           "name": "SortCustomCompareFnFloatTypes",
           "main": "run.js",
-          "resources": ["sort-cmpfn-float.js"],
+          "resources": ["sort.js", "sort-cmpfn-float.js"],
           "test_flags": ["sort-cmpfn-float"]
         },
         {
@@ -556,7 +616,7 @@
       "resources": [
         "filter.js", "map.js", "every.js", "join.js", "some.js",
         "reduce.js", "reduce-right.js", "to-string.js", "find.js",
-        "find-index.js", "from.js", "of.js", "for-each.js"
+        "find-index.js", "from.js", "of.js", "for-each.js", "slice.js"
       ],
       "flags": [
         "--allow-natives-syntax"
@@ -641,18 +701,49 @@
         {"name": "DoubleFrom"},
         {"name": "StringFrom"},
         {"name": "StringNoMapFrom"},
-        {"name": "MixedFrom"}
+        {"name": "MixedFrom"},
+        {"name": "Array.slice(500)"},
+        {"name": "Array.slice(500,999)"},
+        {"name": "Array.slice(-500)"},
+        {"name": "Array.slice(200,700)"},
+        {"name": "Array.slice(200,-300)"},
+        {"name": "Array.slice(4,1)"},
+        {"name": "Array.slice(500,999)-dict"},
+        {"name": "Array.slice(200,700)-dict"},
+        {"name": "Array.slice(200,-300)-dict"},
+        {"name": "Array.slice(4,1)-dict"}
       ]
     },
     {
       "name": "ArraySort",
       "path": ["ArraySort"],
       "main": "run.js",
-      "resources": ["sort.js"],
+      "resources": ["sort-base.js", "sort.js"],
+      "test_flags": ["sort"],
+      "results_regexp": "^%s\\-ArraySort\\(Score\\): (.+)$",
       "flags": [
         "--allow-natives-syntax"
       ],
+      "tests": [
+        {"name": "PackedSmi"},
+        {"name": "PackedDouble"},
+        {"name": "PackedElement"},
+        {"name": "HoleySmi"},
+        {"name": "HoleyDouble"},
+        {"name": "HoleyElement"},
+        {"name": "Dictionary"}
+      ]
+    },
+    {
+      "name": "ArraySortCompareFns",
+      "path": ["ArraySort"],
+      "main": "run.js",
+      "resources": ["sort-base.js", "sort-cmpfn.js"],
+      "test_flags": ["sort-cmpfn"],
       "results_regexp": "^%s\\-ArraySort\\(Score\\): (.+)$",
+      "flags": [
+        "--allow-natives-syntax"
+      ],
       "tests": [
         {"name": "PackedSmi"},
         {"name": "PackedDouble"},
@@ -663,6 +754,87 @@
         {"name": "Dictionary"}
       ]
     },
+    {
+      "name": "ArraySortCompareFnKindChange",
+      "path": ["ArraySort"],
+      "main": "run.js",
+      "resources": ["sort-base.js", "sort-cmpfn-kindchange.js"],
+      "test_flags": ["sort-cmpfn-kindchange"],
+      "results_regexp": "^%s\\-ArraySort\\(Score\\): (.+)$",
+      "flags": [
+        "--allow-natives-syntax"
+      ],
+      "tests": [
+        {"name": "PackedSmiToPackedDouble"},
+        {"name": "HoleySmiToHoleyDouble"},
+        {"name": "PackedDoubleToHoleyDouble"},
+        {"name": "PackedElementToDictionary"},
+        {"name": "HoleyElementToDictionary"}
+      ]
+    },
+    {
+      "name": "ArraySortPreSorted",
+      "path": ["ArraySort"],
+      "main": "run.js",
+      "resources": ["sort-base.js", "sort-presorted.js"],
+      "test_flags": ["sort-presorted"],
+      "results_regexp": "^%s\\-ArraySort\\(Score\\): (.+)$",
+      "flags": [
+        "--allow-natives-syntax"
+      ],
+      "tests": [
+        {"name": "Random"},
+        {"name": "Up"},
+        {"name": "Down"},
+        {"name": "Saw1000"},
+        {"name": "Saw500"},
+        {"name": "Saw200"},
+        {"name": "Saw200Symmetric"},
+        {"name": "Saw200Down"},
+        {"name": "UpDown"},
+        {"name": "UpUp"},
+        {"name": "DownDown"},
+        {"name": "DownUp"}
+      ]
+    },
+    {
+      "name": "ArraySortMegamorphic",
+      "path": ["ArraySort"],
+      "main": "run.js",
+      "resources": ["sort-base.js", "sort-megamorphic.js"],
+      "test_flags": ["sort-megamorphic"],
+      "results_regexp": "^%s\\-ArraySort\\(Score\\): (.+)$",
+      "flags": [
+        "--allow-natives-syntax"
+      ],
+      "tests": [
+        {"name": "Base"},
+        {"name": "MultipleCompareFns"}
+      ]
+    },
+    {
+      "name": "ArraySortDifferentLengths",
+      "path": ["ArraySort"],
+      "main": "run.js",
+      "resources": ["sort-base.js", "sort-lengths.js"],
+      "test_flags": ["sort-lengths"],
+      "results_regexp": "^%s\\-ArraySort\\(Score\\): (.+)$",
+      "flags": [
+        "--allow-natives-syntax"
+      ],
+      "tests": [
+        {"name": "Random10"},
+        {"name": "Sorted10"},
+        {"name": "Random100"},
+        {"name": "Sorted100"},
+        {"name": "Random1000"},
+        {"name": "Sorted1000"},
+        {"name": "Random10000"},
+        {"name": "Sorted10000"},
+        {"name": "Random100000"},
+        {"name": "Sorted100000"}
+      ]
+    },
     {
       "name": "ForLoops",
       "path": ["ForLoops"],
diff --git a/deps/v8/test/js-perf-test/RegExp.json b/deps/v8/test/js-perf-test/RegExp.json
index 0b3a1275a1fe7d..0db1f4e0be42a7 100644
--- a/deps/v8/test/js-perf-test/RegExp.json
+++ b/deps/v8/test/js-perf-test/RegExp.json
@@ -1,4 +1,5 @@
 {
+  "owners": ["jgruber@chromium.org", "yangguo@chromium.org"],
   "name": "RegExp",
   "run_count": 3,
   "run_count_arm": 1,
@@ -25,6 +26,7 @@
         "ctor.js",
         "exec.js",
         "flags.js",
+        "inline_test.js",
         "match.js",
         "replace.js",
         "search.js",
@@ -54,7 +56,8 @@
         {"name": "SlowReplace"},
         {"name": "SlowSearch"},
         {"name": "SlowSplit"},
-        {"name": "SlowTest"}
+        {"name": "SlowTest"},
+        {"name": "InlineTest"}
       ]
     }
   ]
diff --git a/deps/v8/test/js-perf-test/RegExp/RegExpTests.json b/deps/v8/test/js-perf-test/RegExp/RegExpTests.json
index ffb451cda3642f..9d97875aa42bc5 100644
--- a/deps/v8/test/js-perf-test/RegExp/RegExpTests.json
+++ b/deps/v8/test/js-perf-test/RegExp/RegExpTests.json
@@ -25,6 +25,7 @@
         "ctor.js",
         "exec.js",
         "flags.js",
+        "inline_test.js",
         "match.js",
         "replace.js",
         "search.js",
@@ -54,7 +55,8 @@
         {"name": "SlowReplace"},
         {"name": "SlowSearch"},
         {"name": "SlowSplit"},
-        {"name": "SlowTest"}
+        {"name": "SlowTest"},
+        {"name": "InlineTest"}
       ]
     }
   ]
diff --git a/deps/v8/test/js-perf-test/RegExp/inline_test.js b/deps/v8/test/js-perf-test/RegExp/inline_test.js
new file mode 100644
index 00000000000000..09998ad4acb66b
--- /dev/null
+++ b/deps/v8/test/js-perf-test/RegExp/inline_test.js
@@ -0,0 +1,17 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function ConstTest() {
+  /[Cz]/.test("abCdefgzabCdefgzabCdefgzabCdefgzabCdefgzabCdefgzabCdefgzabCdefgz");
+}
+
+const cre = /[Cz]/;
+function GlobalConstTest() {
+  cre.test("abCdefgzabCdefgzabCdefgzabCdefgzabCdefgzabCdefgzabCdefgzabCdefgz");
+}
+
+var benchmarks = [ [ConstTest, () => {}],
+                   [GlobalConstTest, () => {}],
+                 ];
+createBenchmarkSuite("InlineTest");
diff --git a/deps/v8/test/js-perf-test/RegExp/run.js b/deps/v8/test/js-perf-test/RegExp/run.js
index c9ffc5729fb258..0d4097451f6277 100644
--- a/deps/v8/test/js-perf-test/RegExp/run.js
+++ b/deps/v8/test/js-perf-test/RegExp/run.js
@@ -8,6 +8,7 @@ load('../base.js');
 load('ctor.js');
 load('exec.js');
 load('flags.js');
+load('inline_test.js')
 load('match.js');
 load('replace.js');
 load('search.js');
diff --git a/deps/v8/test/js-perf-test/SixSpeed.json b/deps/v8/test/js-perf-test/SixSpeed.json
index 3b9092f47034d2..8856fbe29bc5f5 100644
--- a/deps/v8/test/js-perf-test/SixSpeed.json
+++ b/deps/v8/test/js-perf-test/SixSpeed.json
@@ -1,4 +1,5 @@
 {
+  "owners": ["jarin@chromium.org", "mvstanston@chromium.org"],
   "name": "SixSpeed",
   "run_count": 3,
   "run_count_arm": 1,
diff --git a/deps/v8/test/js-perf-test/Strings/run.js b/deps/v8/test/js-perf-test/Strings/run.js
index 8f3f383240e728..b94f14fb060abb 100644
--- a/deps/v8/test/js-perf-test/Strings/run.js
+++ b/deps/v8/test/js-perf-test/Strings/run.js
@@ -18,7 +18,6 @@ function PrintError(name, error) {
   success = false;
 }
 
-
 BenchmarkSuite.config.doWarmup = undefined;
 BenchmarkSuite.config.doDeterministic = undefined;
 
diff --git a/deps/v8/test/js-perf-test/Strings/string-split.js b/deps/v8/test/js-perf-test/Strings/string-split.js
new file mode 100644
index 00000000000000..432129f39b666c
--- /dev/null
+++ b/deps/v8/test/js-perf-test/Strings/string-split.js
@@ -0,0 +1,81 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+new BenchmarkSuite('ShortSubjectEmptySeparator', [5], [
+  new Benchmark('ShortSubjectEmptySeparator', true, false, 0,
+  ShortSubjectEmptySeparator),
+]);
+
+new BenchmarkSuite('LongSubjectEmptySeparator', [1000], [
+  new Benchmark('LongSubjectEmptySeparator', true, false, 0,
+  LongSubjectEmptySeparator),
+]);
+
+new BenchmarkSuite('ShortTwoBytesSubjectEmptySeparator', [5], [
+  new Benchmark('ShortTwoBytesSubjectEmptySeparator', true, false, 0,
+  ShortTwoBytesSubjectEmptySeparator),
+]);
+
+new BenchmarkSuite('LongTwoBytesSubjectEmptySeparator', [1000], [
+  new Benchmark('LongTwoBytesSubjectEmptySeparator', true, false, 0,
+  LongTwoBytesSubjectEmptySeparator),
+]);
+
+new BenchmarkSuite('ShortSubject', [5], [
+  new Benchmark('ShortSubject', true, false, 0,
+  ShortSubject),
+]);
+
+new BenchmarkSuite('LongSubject', [1000], [
+  new Benchmark('LongSubject', true, false, 0,
+  LongSubject),
+]);
+
+new BenchmarkSuite('ShortTwoBytesSubject', [5], [
+  new Benchmark('ShortTwoBytesSubject', true, false, 0,
+  ShortTwoBytesSubject),
+]);
+
+new BenchmarkSuite('LongTwoBytesSubject', [1000], [
+  new Benchmark('LongTwoBytesSubject', true, false, 0,
+  LongTwoBytesSubject),
+]);
+
+const shortString = "ababaabcdeaaaaaab";
+const shortTwoBytesString = "\u0429\u0428\u0428\u0429\u0429\u0429\u0428\u0429\u0429";
+// Use Array.join to create a flat string
+const longString = new Array(0x500).fill("abcde").join('');
+const longTwoBytesString = new Array(0x500).fill("\u0427\u0428\u0429\u0430").join('');
+
+function ShortSubjectEmptySeparator() {
+  shortString.split('');
+}
+
+function LongSubjectEmptySeparator() {
+  longString.split('');
+}
+
+function ShortTwoBytesSubjectEmptySeparator() {
+  shortTwoBytesString.split('');
+}
+
+function LongTwoBytesSubjectEmptySeparator() {
+  longTwoBytesString.split('');
+}
+
+function ShortSubject() {
+  shortString.split('a');
+}
+
+function LongSubject() {
+  longString.split('a');
+}
+
+function ShortTwoBytesSubject() {
+  shortTwoBytesString.split('\u0428');
+}
+
+function LongTwoBytesSubject() {
+  longTwoBytesString.split('\u0428');
+}
diff --git a/deps/v8/test/js-perf-test/Strings/string-startsendswith-comp.js b/deps/v8/test/js-perf-test/Strings/string-startsendswith-comp.js
new file mode 100644
index 00000000000000..71484d25b18b67
--- /dev/null
+++ b/deps/v8/test/js-perf-test/Strings/string-startsendswith-comp.js
@@ -0,0 +1,47 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function createSuiteWithWarmup( name, count, fn) {
+  new BenchmarkSuite(name, [count], [
+    new Benchmark(name, true, false, 0, fn),
+  ]);
+}
+
+const inputs = [
+  'I\xF1t\xEBrn\xE2ti\xF4n\xE0liz\xE6ti\xF8n\u2603\uD83D\uDCA9\uFFFD',
+  'Lorem ipsum dolor sit amet, consectetur adipiscing elit.',
+  'Integer eu augue suscipit, accumsan ipsum nec, sagittis sem.',
+  'In vitae pellentesque dolor. Curabitur leo nunc, luctus vitae',
+  'risus eget, fermentum hendrerit justo.',
+];
+const first = 'I';
+
+function helper(fn) {
+  let sum = 0;
+  for (const input of inputs) {
+    sum += fn(input);
+  }
+  return sum;
+}
+
+function startsWith(string) {
+  return string.startsWith(first);
+}
+
+function startsIndex(string) {
+  return string[0] === first;
+}
+
+function endsWith(string) {
+  return string.endsWith(first);
+}
+
+function endsIndex(string) {
+  return string[string.length - 1] === first;
+}
+
+createSuiteWithWarmup('startsWith', 1, () => helper(startsWith));
+createSuiteWithWarmup('startsIndex', 1, () => helper(startsIndex));
+createSuiteWithWarmup('endsWith', 1, () => helper(endsWith));
+createSuiteWithWarmup('endsIndex', 1, () => helper(endsIndex));
diff --git a/deps/v8/test/js-perf-test/Strings/string-stringat-comp.js b/deps/v8/test/js-perf-test/Strings/string-stringat-comp.js
index 37c5e1eabd21f0..deb95e1ef82767 100644
--- a/deps/v8/test/js-perf-test/Strings/string-stringat-comp.js
+++ b/deps/v8/test/js-perf-test/Strings/string-stringat-comp.js
@@ -2,12 +2,6 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-function benchy(f, name) {
-  new BenchmarkSuite(name, [1], [
-    new Benchmark(name, true, false, 0, f),
-  ]);
-}
-
 const input = 'äϠ�𝌆 Lorem ipsum test test';
 
 function helper(fn) {
@@ -42,9 +36,9 @@ function stringIndex(str, i) {
   return str[i] === 't';
 }
 
-benchy(() => helper(charCodeAt), "charCodeAt_const");
-benchy(() => helper(charCodeAtBoth), "charCodeAt_both");
-benchy(() => helper(charAt), "charAt_const");
-benchy(() => helper(charAtNever), "charAt_never");
-benchy(() => helper(charAtBoth), "charAt_both");
-benchy(() => helper(stringIndex), "stringIndex_const");
+createSuiteWithWarmup('charCodeAt_const', 1, () => helper(charCodeAt));
+createSuiteWithWarmup('charCodeAt_both', 1, () => helper(charCodeAtBoth));
+createSuiteWithWarmup('charAt_const', 1, () => helper(charAt));
+createSuiteWithWarmup('charAt_never', 1, () => helper(charAtNever));
+createSuiteWithWarmup('charAt_both', 1, () => helper(charAtBoth));
+createSuiteWithWarmup('stringIndex_const', 1, () => helper(stringIndex));
diff --git a/deps/v8/test/js-perf-test/Strings/string-substring.js b/deps/v8/test/js-perf-test/Strings/string-substring.js
index 865c709becd579..cde6fe68385a23 100644
--- a/deps/v8/test/js-perf-test/Strings/string-substring.js
+++ b/deps/v8/test/js-perf-test/Strings/string-substring.js
@@ -2,14 +2,10 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-function benchy (f, name) {
-  new BenchmarkSuite(name, [5], [
-    new Benchmark(name, true, false, 0,
-    f),
-  ]);
-}
-
-const subjects = ['abcde', '123456', 'aqwsde', "nbvveqxu", "f03ks-120-3;jfkm;ajp3f", "sd-93u498thikefnow8y3-0rh1nalksfnwo8y3t19-3r8hoiefnw"];
+const subjects = [
+  'abcde', '123456', 'aqwsde', 'nbvveqxu', 'f03ks-120-3;jfkm;ajp3f',
+  'sd-93u498thikefnow8y3-0rh1nalksfnwo8y3t19-3r8hoiefnw'
+];
 
 // Drop first element.
 
@@ -23,7 +19,7 @@ function StringDropFirstSlice() {
 
   return sum;
 }
-benchy(StringDropFirstSlice, "StringDropFirstSlice");
+createSuiteWithWarmup('StringDropFirstSlice', 5, StringDropFirstSlice);
 
 function StringDropFirstSubstr() {
   var sum = "";
@@ -35,7 +31,7 @@ function StringDropFirstSubstr() {
 
   return sum;
 }
-benchy(StringDropFirstSubstr, "StringDropFirstSubstr");
+createSuiteWithWarmup('StringDropFirstSubstr', 5, StringDropFirstSubstr);
 
 function StringDropFirstSubstring() {
   var sum = "";
@@ -47,8 +43,7 @@ function StringDropFirstSubstring() {
 
   return sum;
 }
-benchy(StringDropFirstSubstring, "StringDropFirstSubstring");
-
+createSuiteWithWarmup('StringDropFirstSubstring', 5, StringDropFirstSubstring);
 
 // Take first element.
 
@@ -62,7 +57,7 @@ function StringTakeFirstSlice() {
 
   return sum;
 }
-benchy(StringTakeFirstSlice, "StringTakeFirstSlice");
+createSuiteWithWarmup('StringTakeFirstSlice', 5, StringTakeFirstSlice);
 
 function StringTakeFirstSubstr() {
   var sum = "";
@@ -74,7 +69,7 @@ function StringTakeFirstSubstr() {
 
   return sum;
 }
-benchy(StringTakeFirstSubstr, "StringTakeFirstSubstr");
+createSuiteWithWarmup('StringTakeFirstSubstr', 5, StringTakeFirstSubstr);
 
 function StringTakeFirstSubstring() {
   var sum = "";
@@ -86,8 +81,7 @@ function StringTakeFirstSubstring() {
 
   return sum;
 }
-benchy(StringTakeFirstSubstring, "StringTakeFirstSubstring");
-
+createSuiteWithWarmup('StringTakeFirstSubstring', 5, StringTakeFirstSubstring);
 
 // Drop last element.
 
@@ -101,7 +95,7 @@ function StringDropLastSlice() {
 
   return sum;
 }
-benchy(StringDropLastSlice, "StringDropLastSlice");
+createSuiteWithWarmup('StringDropLastSlice', 5, StringDropLastSlice);
 
 function StringDropLastSubstr() {
   var sum = "";
@@ -113,7 +107,7 @@ function StringDropLastSubstr() {
 
   return sum;
 }
-benchy(StringDropLastSubstr, "StringDropLastSubstr");
+createSuiteWithWarmup('StringDropLastSubstr', 5, StringDropLastSubstr);
 
 function StringDropLastSubstring() {
   var sum = "";
@@ -125,8 +119,7 @@ function StringDropLastSubstring() {
 
   return sum;
 }
-benchy(StringDropLastSubstring, "StringDropLastSubstring");
-
+createSuiteWithWarmup('StringDropLastSubstring', 5, StringDropLastSubstring);
 
 // Take last element.
 
@@ -140,7 +133,7 @@ function StringTakeLastSlice() {
 
   return sum;
 }
-benchy(StringTakeLastSlice, "StringTakeLastSlice");
+createSuiteWithWarmup('StringTakeLastSlice', 5, StringTakeLastSlice);
 
 function StringTakeLastSubstr() {
   var sum = "";
@@ -152,7 +145,7 @@ function StringTakeLastSubstr() {
 
   return sum;
 }
-benchy(StringTakeLastSubstr, "StringTakeLastSubstr");
+createSuiteWithWarmup('StringTakeLastSubstr', 5, StringTakeLastSubstr);
 
 function StringTakeLastSubstring() {
   var sum = "";
@@ -164,8 +157,7 @@ function StringTakeLastSubstring() {
 
   return sum;
 }
-benchy(StringTakeLastSubstring, "StringTakeLastSubstring");
-
+createSuiteWithWarmup('StringTakeLastSubstring', 5, StringTakeLastSubstring);
 
 // Drop first and last.
 
@@ -179,7 +171,7 @@ function StringDropFirstSlice() {
 
   return sum;
 }
-benchy(StringDropFirstSlice, "StringDropFirstSlice");
+createSuiteWithWarmup('StringDropFirstSlice', 5, StringDropFirstSlice);
 
 function StringDropFirstSubstr() {
   var sum = "";
@@ -191,7 +183,7 @@ function StringDropFirstSubstr() {
 
   return sum;
 }
-benchy(StringDropFirstSubstr, "StringDropFirstSubstr");
+createSuiteWithWarmup('StringDropFirstSubstr', 5, StringDropFirstSubstr);
 
 function StringDropFirstSubstring() {
   var sum = "";
@@ -203,4 +195,4 @@ function StringDropFirstSubstring() {
 
   return sum;
 }
-benchy(StringDropFirstSubstring, "StringDropFirstSubstring");
+createSuiteWithWarmup('StringDropFirstSubstring', 5, StringDropFirstSubstring);
diff --git a/deps/v8/test/js-perf-test/TypedArrays/sort-bigint.js b/deps/v8/test/js-perf-test/TypedArrays/sort-bigint.js
new file mode 100644
index 00000000000000..cec960575a8980
--- /dev/null
+++ b/deps/v8/test/js-perf-test/TypedArrays/sort-bigint.js
@@ -0,0 +1,8 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+load('sort.js');
+
+new BenchmarkSuite('SortBigIntTypes', [1000],
+                   CreateBenchmarks(typedArrayBigIntConstructors));
diff --git a/deps/v8/test/js-perf-test/TypedArrays/sort-cmpfn-bigint.js b/deps/v8/test/js-perf-test/TypedArrays/sort-cmpfn-bigint.js
new file mode 100644
index 00000000000000..a94c6059214ef9
--- /dev/null
+++ b/deps/v8/test/js-perf-test/TypedArrays/sort-cmpfn-bigint.js
@@ -0,0 +1,9 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+load('sort.js');
+
+new BenchmarkSuite('SortCustomCompareFnBigIntTypes', [1000],
+                   CreateBenchmarks(typedArrayBigIntConstructors,
+                                    [cmp_smaller, cmp_greater]));
diff --git a/deps/v8/test/js-perf-test/TypedArrays/sort.js b/deps/v8/test/js-perf-test/TypedArrays/sort.js
index f59c2c0cbb40a6..c2423994cd7167 100644
--- a/deps/v8/test/js-perf-test/TypedArrays/sort.js
+++ b/deps/v8/test/js-perf-test/TypedArrays/sort.js
@@ -17,6 +17,14 @@ let typedArrayFloatConstructors = [
   {name: "Float64", ctor: Float64Array},
 ];
 
+// "ref" builds might not yet have BigInt support, so the benchmark fails
+// gracefully during setup (the constructor will be undefined), instead of
+// a hard fail when this file is loaded.
+let typedArrayBigIntConstructors = [
+  {name: "BigUint64", ctor: this["BigUint64Array"]},
+  {name: "BigInt64", ctor: this["BigInt64Array"]}
+];
+
 function CreateBenchmarks(constructors, comparefns = []) {
   var benchmarks = [];
   for (let constructor of constructors) {
@@ -27,17 +35,22 @@ function CreateBenchmarks(constructors, comparefns = []) {
   return benchmarks;
 }
 
-const size = 3000;
-const initialLargeArray = new Array(size);
-for (let i = 0; i < size; ++i) {
-  initialLargeArray[i] = Math.random() * 3000;
+const kArraySize = 3000;
+const initialLargeArray = new Array(kArraySize);
+for (let i = 0; i < kArraySize; ++i) {
+  initialLargeArray[i] = Math.random() * kArraySize;
 }
 
 let array_to_sort = [];
 
 function CreateSetupFn(constructor) {
   return () => {
-    array_to_sort = new constructor(initialLargeArray);
+    if (constructor == BigUint64Array || constructor == BigInt64Array) {
+      array_to_sort = constructor.from(initialLargeArray,
+                                       x => BigInt(Math.floor(x)));
+    } else {
+      array_to_sort = new constructor(initialLargeArray);
+    }
   }
 }
 
diff --git a/deps/v8/test/js-perf-test/base.js b/deps/v8/test/js-perf-test/base.js
index cef2867f2b037b..61089f039fcc87 100644
--- a/deps/v8/test/js-perf-test/base.js
+++ b/deps/v8/test/js-perf-test/base.js
@@ -54,7 +54,6 @@ BenchmarkResult.prototype.valueOf = function() {
   return this.time;
 }
 
-
 // Suites of benchmarks consist of a name and the set of benchmarks in
 // addition to the reference timing that the final score will be based
 // on. This way, all scores are relative to a reference run and higher
@@ -66,6 +65,15 @@ function BenchmarkSuite(name, reference, benchmarks) {
   BenchmarkSuite.suites.push(this);
 }
 
+function createSuite(name, reference, run, setup, tearDown) {
+  return new BenchmarkSuite(name, [reference], [
+      new Benchmark(name, false, false, 0, run, setup, tearDown)]);
+}
+
+function createSuiteWithWarmup(name, reference, run, setup, tearDown) {
+  return new BenchmarkSuite(name, [reference], [
+      new Benchmark(name, true, false, 0, run, setup, tearDown)]);
+}
 
 // Keep track of all declared benchmark suites.
 BenchmarkSuite.suites = [];
diff --git a/deps/v8/test/memory/Memory.json b/deps/v8/test/memory/Memory.json
index a3c8dbc0d5c1fb..d5f11e9b2cf0b5 100644
--- a/deps/v8/test/memory/Memory.json
+++ b/deps/v8/test/memory/Memory.json
@@ -1,10 +1,11 @@
 {
+  "owners": ["yangguo@chromium.org", "jgruber@chromium.org"],
   "name": "Memory",
   "run_count": 5,
   "units": "bytes",
   "path" : ["."],
   "binary": "cctest",
-  "main": "test-serialize/SerializationMemoryStats",
+  "main": "test-serialize/SerializationStats",
   "tests": [
     {
       "name": "ReservedMemoryIsolate",
@@ -16,7 +17,7 @@
     },
     {
       "name": "SnapshotSizeStartup",
-      "results_regexp": "(\\d+) bytes for startup$"
+      "results_regexp": "(\\d+) bytes in \\d+ chunks for startup$"
     },
     {
       "name": "SnapshotSizeBuiltins",
@@ -24,7 +25,19 @@
     },
     {
       "name": "SnapshotSizeContext",
-      "results_regexp": "(\\d+) bytes for context #0$"
+      "results_regexp": "(\\d+) bytes in \\d+ chunks for context #0$"
+    },
+    {
+      "name": "DeserializationTimeIsolate",
+      "results_regexp": "\\[Deserializing isolate \\(\\d+ bytes\\) took ([\\d.]+) ms\\]"
+    },
+    {
+      "name": "DeserializationTimeContext",
+      "results_regexp": "\\[Deserializing context #0 \\(\\d+ bytes\\) took ([\\d.]+) ms\\]"
+    },
+    {
+      "name": "EmbeddedBuiltinsSize",
+      "results_regexp": "^Embedded blob is (\\d+) bytes$"
     }
   ]
 }
diff --git a/deps/v8/test/message/mjsunit/fail/assert-promise-result-rejects-empty.js b/deps/v8/test/message/mjsunit/fail/assert-promise-result-rejects-empty.js
new file mode 100644
index 00000000000000..1cc171e5799e05
--- /dev/null
+++ b/deps/v8/test/message/mjsunit/fail/assert-promise-result-rejects-empty.js
@@ -0,0 +1,11 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+load("test/mjsunit/mjsunit.js");
+
+let promise = new Promise(function(resolve, reject) {
+  throw new Error("Error in creation");
+});
+
+assertPromiseResult(promise);
diff --git a/deps/v8/test/message/mjsunit/fail/assert-promise-result-rejects-empty.out b/deps/v8/test/message/mjsunit/fail/assert-promise-result-rejects-empty.out
new file mode 100644
index 00000000000000..9c38576f5116c9
--- /dev/null
+++ b/deps/v8/test/message/mjsunit/fail/assert-promise-result-rejects-empty.out
@@ -0,0 +1,12 @@
+test/mjsunit/mjsunit.js:{NUMBER}: Error: Error in creation
+              throw concatenateErrors(stack, e);
+              ^
+Error
+    at assertPromiseResult (test/mjsunit/mjsunit.js:{NUMBER}:{NUMBER})
+    at *%(basename)s:11:1
+
+Error: Error in creation
+    at *%(basename)s:8:9
+    at new Promise (<anonymous>)
+    at *%(basename)s:7:15
+
diff --git a/deps/v8/test/message/mjsunit/fail/assert-promise-result-rejects-with-throw-empty.js b/deps/v8/test/message/mjsunit/fail/assert-promise-result-rejects-with-throw-empty.js
new file mode 100644
index 00000000000000..706b456adf5828
--- /dev/null
+++ b/deps/v8/test/message/mjsunit/fail/assert-promise-result-rejects-with-throw-empty.js
@@ -0,0 +1,14 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+load("test/mjsunit/mjsunit.js");
+
+let reject_handler;
+let promise = new Promise(function(resolve, reject) {
+  reject_handler = reject;
+});
+
+assertPromiseResult(promise);
+
+reject_handler("Reject with callback");
diff --git a/deps/v8/test/message/mjsunit/fail/assert-promise-result-rejects-with-throw-empty.out b/deps/v8/test/message/mjsunit/fail/assert-promise-result-rejects-with-throw-empty.out
new file mode 100644
index 00000000000000..605c3712aa144a
--- /dev/null
+++ b/deps/v8/test/message/mjsunit/fail/assert-promise-result-rejects-with-throw-empty.out
@@ -0,0 +1,10 @@
+test/mjsunit/mjsunit.js:{NUMBER}: Error: Reject with callback
+              throw concatenateErrors(stack, e);
+              ^
+Error
+    at assertPromiseResult (test/mjsunit/mjsunit.js:{NUMBER}:{NUMBER})
+    at *%(basename)s:12:1
+
+Error: Reject with callback
+    at concatenateErrors (test/mjsunit/mjsunit.js:{NUMBER}:{NUMBER})
+    at _ (test/mjsunit/mjsunit.js:{NUMBER}:{NUMBER})
diff --git a/deps/v8/test/message/mjsunit/fail/assert-promise-result-rejects.js b/deps/v8/test/message/mjsunit/fail/assert-promise-result-rejects.js
new file mode 100644
index 00000000000000..e28ecec1231540
--- /dev/null
+++ b/deps/v8/test/message/mjsunit/fail/assert-promise-result-rejects.js
@@ -0,0 +1,11 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+load("test/mjsunit/mjsunit.js");
+
+let obj = {f: 1254};
+
+assertPromiseResult(
+    Promise.reject(obj), (o) => {print(o.f)},
+    _ => {throw new Error('Error in reject handler')});
diff --git a/deps/v8/test/message/mjsunit/fail/assert-promise-result-rejects.out b/deps/v8/test/message/mjsunit/fail/assert-promise-result-rejects.out
new file mode 100644
index 00000000000000..87bbc0311dc161
--- /dev/null
+++ b/deps/v8/test/message/mjsunit/fail/assert-promise-result-rejects.out
@@ -0,0 +1,12 @@
+test/mjsunit/mjsunit.js:{NUMBER}: Error: Error in reject handler
+              throw concatenateErrors(stack, e);
+              ^
+Error
+    at assertPromiseResult (test/mjsunit/mjsunit.js:{NUMBER}:{NUMBER})
+    at *%(basename)s:9:1
+
+Error: Error in reject handler
+    at _ *%(basename)s:11:17)
+    at promise.then.result (test/mjsunit/mjsunit.js:{NUMBER}:{NUMBER})
+
+
diff --git a/deps/v8/test/message/mjsunit/fail/assert-promise-result-resolves.js b/deps/v8/test/message/mjsunit/fail/assert-promise-result-resolves.js
new file mode 100644
index 00000000000000..7337f46e7df68d
--- /dev/null
+++ b/deps/v8/test/message/mjsunit/fail/assert-promise-result-resolves.js
@@ -0,0 +1,11 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+load("test/mjsunit/mjsunit.js");
+
+let obj = {f: 1254};
+
+assertPromiseResult(
+    Promise.resolve(obj), _ => {throw new Error('Error in resolve handler')},
+    (o) => {print(o.f)});
diff --git a/deps/v8/test/message/mjsunit/fail/assert-promise-result-resolves.out b/deps/v8/test/message/mjsunit/fail/assert-promise-result-resolves.out
new file mode 100644
index 00000000000000..2cd2a1cf7c258f
--- /dev/null
+++ b/deps/v8/test/message/mjsunit/fail/assert-promise-result-resolves.out
@@ -0,0 +1,13 @@
+test/mjsunit/mjsunit.js:{NUMBER}: Error: Error in resolve handler
+              throw concatenateErrors(stack, e);
+              ^
+Error
+    at assertPromiseResult (test/mjsunit/mjsunit.js:{NUMBER}:{NUMBER})
+    at *%(basename)s:9:1
+
+Error: Error in resolve handler
+    at _ *%(basename)s:10:39)
+    at promise.then.result (test/mjsunit/mjsunit.js:{NUMBER}:{NUMBER})
+
+
+
diff --git a/deps/v8/test/message/mjsunit/success/assert-promise-result-rejects.js b/deps/v8/test/message/mjsunit/success/assert-promise-result-rejects.js
new file mode 100644
index 00000000000000..98160d5ecbe8c8
--- /dev/null
+++ b/deps/v8/test/message/mjsunit/success/assert-promise-result-rejects.js
@@ -0,0 +1,12 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --no-stress-opt
+
+load("test/mjsunit/mjsunit.js");
+
+let obj = {f: 6254};
+
+assertPromiseResult(
+    Promise.reject(obj), assertUnreachable, (o) => {print(o.f)});
diff --git a/deps/v8/test/message/mjsunit/success/assert-promise-result-rejects.out b/deps/v8/test/message/mjsunit/success/assert-promise-result-rejects.out
new file mode 100644
index 00000000000000..d3346fc5f59ac1
--- /dev/null
+++ b/deps/v8/test/message/mjsunit/success/assert-promise-result-rejects.out
@@ -0,0 +1 @@
+6254
diff --git a/deps/v8/test/message/mjsunit/success/assert-promise-result-resolves-empty.js b/deps/v8/test/message/mjsunit/success/assert-promise-result-resolves-empty.js
new file mode 100644
index 00000000000000..78218d6668f6bd
--- /dev/null
+++ b/deps/v8/test/message/mjsunit/success/assert-promise-result-resolves-empty.js
@@ -0,0 +1,16 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --no-stress-opt
+
+load("test/mjsunit/mjsunit.js");
+
+let resolve_handler;
+let promise = new Promise(function(resolve, reject) {
+  resolve_handler = resolve;
+});
+
+assertPromiseResult(promise);
+
+resolve_handler({f: 3463});
diff --git a/deps/v8/test/message/mjsunit/success/assert-promise-result-resolves-empty.out b/deps/v8/test/message/mjsunit/success/assert-promise-result-resolves-empty.out
new file mode 100644
index 00000000000000..e69de29bb2d1d6
diff --git a/deps/v8/test/message/mjsunit/success/assert-promise-result-resolves.js b/deps/v8/test/message/mjsunit/success/assert-promise-result-resolves.js
new file mode 100644
index 00000000000000..b605a955a7655b
--- /dev/null
+++ b/deps/v8/test/message/mjsunit/success/assert-promise-result-resolves.js
@@ -0,0 +1,11 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --no-stress-opt
+
+load("test/mjsunit/mjsunit.js");
+
+let obj = {f: 1254};
+
+assertPromiseResult(Promise.resolve(obj), (o) => {print(o.f)});
diff --git a/deps/v8/test/message/mjsunit/success/assert-promise-result-resolves.out b/deps/v8/test/message/mjsunit/success/assert-promise-result-resolves.out
new file mode 100644
index 00000000000000..1e590facccb039
--- /dev/null
+++ b/deps/v8/test/message/mjsunit/success/assert-promise-result-resolves.out
@@ -0,0 +1 @@
+1254
diff --git a/deps/v8/test/message/regress/fail/regress-73.js b/deps/v8/test/message/regress/fail/regress-73.js
index 72652d74a9e71c..137b731fc94a46 100644
--- a/deps/v8/test/message/regress/fail/regress-73.js
+++ b/deps/v8/test/message/regress/fail/regress-73.js
@@ -25,9 +25,9 @@
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
-try {
-  throw 'a';
-} catch (e) {
-  throw 'b';
-  print('c');
-}
+try {
+  throw 'a';
+} catch (e) {
+  throw 'b';
+  print('c');
+}
diff --git a/deps/v8/test/message/regress/fail/regress-crbug-842101.js b/deps/v8/test/message/regress/fail/regress-crbug-842101.js
new file mode 100644
index 00000000000000..dad24433a6ffb4
--- /dev/null
+++ b/deps/v8/test/message/regress/fail/regress-crbug-842101.js
@@ -0,0 +1,18 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function set_value(obj, prop) { return obj[prop] = undefined }
+
+var object1 = new Proxy({}, {set: true});
+try { set_value(object1, "bla"); } catch (_) {};
+try { set_value(object1, "0"); } catch (_) {};
+try { set_value(object1, Symbol()); } catch(_) {};
+
+set_value({}, 1073741824)
+
+var target = {};
+var handler = { set() { return 42 } };
+var object2 = new Proxy(target, handler);
+Object.defineProperty(target, 'bla', { value: 0 });
+set_value(object2, 'bla', 0);
diff --git a/deps/v8/test/message/regress/fail/regress-crbug-842101.out b/deps/v8/test/message/regress/fail/regress-crbug-842101.out
new file mode 100644
index 00000000000000..0e02e32966da55
--- /dev/null
+++ b/deps/v8/test/message/regress/fail/regress-crbug-842101.out
@@ -0,0 +1,10 @@
+# Copyright 2018 the V8 project authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+*%(basename)s:5: TypeError: 'set' on proxy: trap returned truish for property 'bla' which exists in the proxy target as a non-configurable and non-writable data property with a different value
+function set_value(obj, prop) { return obj[prop] = undefined }
+                                                 ^
+TypeError: 'set' on proxy: trap returned truish for property 'bla' which exists in the proxy target as a non-configurable and non-writable data property with a different value
+    at set_value (*%(basename)s:5:50)
+    at *%(basename)s:18:1
diff --git a/deps/v8/test/message/wasm-function-name-async.out b/deps/v8/test/message/wasm-function-name-async.out
index 8e8d96ff10114a..b8af10f3a7a86d 100644
--- a/deps/v8/test/message/wasm-function-name-async.out
+++ b/deps/v8/test/message/wasm-function-name-async.out
@@ -1,4 +1,4 @@
 RuntimeError: unreachable
     at main (wasm-function[0]:1)
     at pair (*%(basename)s:16:27)
-    at promise.then.result (test/mjsunit/mjsunit.js:576:15)
+    at promise.then.result (test/mjsunit/mjsunit.js:*)
diff --git a/deps/v8/test/message/wasm-function-name-streaming.out b/deps/v8/test/message/wasm-function-name-streaming.out
index 0daaabd93b6b1c..545abb1343a901 100644
--- a/deps/v8/test/message/wasm-function-name-streaming.out
+++ b/deps/v8/test/message/wasm-function-name-streaming.out
@@ -1,4 +1,4 @@
 RuntimeError: unreachable
     at main (wasm-function[0]:1)
     at pair (test/message/wasm-function-name-async.js:16:27)
-    at promise.then.result (test/mjsunit/mjsunit.js:576:15)
+    at promise.then.result (test/mjsunit/mjsunit.js:*)
diff --git a/deps/v8/test/message/wasm-module-and-function-name-async.out b/deps/v8/test/message/wasm-module-and-function-name-async.out
index de4edf4491511c..a88baa9aeca7c9 100644
--- a/deps/v8/test/message/wasm-module-and-function-name-async.out
+++ b/deps/v8/test/message/wasm-module-and-function-name-async.out
@@ -1,4 +1,4 @@
 RuntimeError: unreachable
     at test-module.main (wasm-function[0]:1)
     at pair (*%(basename)s:17:27)
-    at promise.then.result (test/mjsunit/mjsunit.js:576:15)
+    at promise.then.result (test/mjsunit/mjsunit.js:*)
diff --git a/deps/v8/test/message/wasm-module-and-function-name-streaming.out b/deps/v8/test/message/wasm-module-and-function-name-streaming.out
index 692011d554107b..5dcff0ce9f92b4 100644
--- a/deps/v8/test/message/wasm-module-and-function-name-streaming.out
+++ b/deps/v8/test/message/wasm-module-and-function-name-streaming.out
@@ -1,4 +1,4 @@
 RuntimeError: unreachable
     at test-module.main (wasm-function[0]:1)
     at pair (test/message/wasm-module-and-function-name-async.js:17:27)
-    at promise.then.result (test/mjsunit/mjsunit.js:576:15)
+    at promise.then.result (test/mjsunit/mjsunit.js:*)
diff --git a/deps/v8/test/message/wasm-module-name-async.out b/deps/v8/test/message/wasm-module-name-async.out
index 66e7219ff5fe2e..d1c95136f346fc 100644
--- a/deps/v8/test/message/wasm-module-name-async.out
+++ b/deps/v8/test/message/wasm-module-name-async.out
@@ -1,4 +1,4 @@
 RuntimeError: unreachable
     at test-module (wasm-function[0]:1)
     at pair (*%(basename)s:19:27)
-    at promise.then.result (test/mjsunit/mjsunit.js:576:15)
+    at promise.then.result (test/mjsunit/mjsunit.js:*)
diff --git a/deps/v8/test/message/wasm-module-name-streaming.out b/deps/v8/test/message/wasm-module-name-streaming.out
index b06fba77452d6d..11ef8148961ffa 100644
--- a/deps/v8/test/message/wasm-module-name-streaming.out
+++ b/deps/v8/test/message/wasm-module-name-streaming.out
@@ -1,4 +1,4 @@
 RuntimeError: unreachable
     at test-module (wasm-function[0]:1)
     at pair (test/message/wasm-module-name-async.js:19:27)
-    at promise.then.result (test/mjsunit/mjsunit.js:576:15)
+    at promise.then.result (test/mjsunit/mjsunit.js:*)
diff --git a/deps/v8/test/message/wasm-no-name-async.out b/deps/v8/test/message/wasm-no-name-async.out
index d7d31c513f529a..9eedba58851b7f 100644
--- a/deps/v8/test/message/wasm-no-name-async.out
+++ b/deps/v8/test/message/wasm-no-name-async.out
@@ -1,4 +1,4 @@
 RuntimeError: unreachable
     at wasm-function[0]:1
     at pair (*%(basename)s:18:27)
-    at promise.then.result (test/mjsunit/mjsunit.js:576:15)
+    at promise.then.result (test/mjsunit/mjsunit.js:*)
diff --git a/deps/v8/test/message/wasm-no-name-streaming.out b/deps/v8/test/message/wasm-no-name-streaming.out
index 20bf178e268340..cf6ab3d4a5dc6f 100644
--- a/deps/v8/test/message/wasm-no-name-streaming.out
+++ b/deps/v8/test/message/wasm-no-name-streaming.out
@@ -1,4 +1,4 @@
 RuntimeError: unreachable
     at wasm-function[0]:1
     at pair (test/message/wasm-no-name-async.js:18:27)
-    at promise.then.result (test/mjsunit/mjsunit.js:576:15)
+    at promise.then.result (test/mjsunit/mjsunit.js:*)
diff --git a/deps/v8/test/message/wasm-trace-memory-liftoff.js b/deps/v8/test/message/wasm-trace-memory-liftoff.js
index 00b6421c1be1b0..b56d1d7978e82c 100644
--- a/deps/v8/test/message/wasm-trace-memory-liftoff.js
+++ b/deps/v8/test/message/wasm-trace-memory-liftoff.js
@@ -2,6 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --no-stress-opt --expose-wasm --wasm-trace-memory --liftoff
+// Flags: --no-stress-opt --wasm-trace-memory --liftoff --no-future
+// Flags: --no-wasm-tier-up
 
 load("test/message/wasm-trace-memory.js");
diff --git a/deps/v8/test/message/wasm-trace-memory.js b/deps/v8/test/message/wasm-trace-memory.js
index 1beb76a01b4993..adb1e2b7a759e5 100644
--- a/deps/v8/test/message/wasm-trace-memory.js
+++ b/deps/v8/test/message/wasm-trace-memory.js
@@ -2,7 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --no-stress-opt --expose-wasm --wasm-trace-memory --no-liftoff
+// Flags: --no-stress-opt --wasm-trace-memory --no-liftoff --no-future
+// Flags: --no-wasm-tier-up
 
 load("test/mjsunit/wasm/wasm-constants.js");
 load("test/mjsunit/wasm/wasm-module-builder.js");
diff --git a/deps/v8/test/mjsunit/allocation-site-info.js b/deps/v8/test/mjsunit/allocation-site-info.js
index 7a5f2c70bf7eda..66ebe493690c04 100644
--- a/deps/v8/test/mjsunit/allocation-site-info.js
+++ b/deps/v8/test/mjsunit/allocation-site-info.js
@@ -258,6 +258,12 @@ assertKind(elements_kind.fast, obj);
 obj = newarraycase_list_smiobj(2);
 assertKind(elements_kind.fast, obj);
 
+// Perform a gc because without it the test below can experience an
+// allocation failure at an inconvenient point. Allocation mementos get
+// cleared on gc, and they can't deliver elements kind feedback when that
+// happens.
+gc();
+
 // Case: array constructor calls with out of date feedback.
 // The boilerplate should incorporate all feedback, but the input array
 // should be minimally transitioned based on immediate need.
diff --git a/deps/v8/test/mjsunit/apply.js b/deps/v8/test/mjsunit/apply.js
index c52a23f91f77a6..07639c940eac85 100644
--- a/deps/v8/test/mjsunit/apply.js
+++ b/deps/v8/test/mjsunit/apply.js
@@ -110,6 +110,7 @@ function s() {
 assertEquals("bar42foofishhorse", s.apply("bar", arr), "apply to string");
 
 function al() {
+  print(this);
   assertEquals(Object(345), this);
   return arguments.length + arguments[arguments.length - 1];
 }
diff --git a/deps/v8/test/mjsunit/array-constructor.js b/deps/v8/test/mjsunit/array-constructor.js
index c9707b965435b5..94f444c051cefe 100644
--- a/deps/v8/test/mjsunit/array-constructor.js
+++ b/deps/v8/test/mjsunit/array-constructor.js
@@ -1,29 +1,6 @@
 // Copyright 2008 the V8 project authors. All rights reserved.
-// Redistribution and use in source and binary forms, with or without
-// modification, are permitted provided that the following conditions are
-// met:
-//
-//     * Redistributions of source code must retain the above copyright
-//       notice, this list of conditions and the following disclaimer.
-//     * Redistributions in binary form must reproduce the above
-//       copyright notice, this list of conditions and the following
-//       disclaimer in the documentation and/or other materials provided
-//       with the distribution.
-//     * Neither the name of Google Inc. nor the names of its
-//       contributors may be used to endorse or promote products derived
-//       from this software without specific prior written permission.
-//
-// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
-// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
-// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
-// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
-// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
-// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
-// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
 
 var loop_count = 5
 
@@ -84,26 +61,26 @@ function innerArrayLiteral(n) {
   return a.join();
 }
 
-
-function testConstructOfSizeSize(n) {
-  var str = innerArrayLiteral(n);
-  var a = eval('[' + str + ']');
-  var b = eval('new Array(' + str + ')')
-  var c = eval('Array(' + str + ')')
-  assertEquals(n, a.length);
+function testConstruction(len, elements_str) {
+  var a = eval('[' + elements_str + ']');
+  var b = eval('new Array(' + elements_str + ')')
+  var c = eval('Array(' + elements_str + ')')
+  assertEquals(len, a.length);
   assertArrayEquals(a, b);
   assertArrayEquals(a, c);
 }
 
-
 for (var i = 0; i < loop_count; i++) {
-  // JSObject::kInitialMaxFastElementArray is 10000.
-  for (var j = 1000; j < 12000; j += 1000) {
-    testConstructOfSizeSize(j);
+  const N = 2000;
+  const literal = innerArrayLiteral(N);
+  let str = literal;
+  // JSObject::kInitialMaxFastElementArray is approximately 10000.
+  for (var j = N; j <= 12000; j += N) {
+    testConstruction(j, str);
+    str += ", " + literal;
   }
 }
 
-
 for (var i = 0; i < loop_count; i++) {
   assertArrayEquals(['xxx'], new Array('xxx'));
   assertArrayEquals(['xxx'], Array('xxx'));
diff --git a/deps/v8/test/mjsunit/array-sort.js b/deps/v8/test/mjsunit/array-sort.js
index 0454da8cae9268..8c2c6fca638224 100644
--- a/deps/v8/test/mjsunit/array-sort.js
+++ b/deps/v8/test/mjsunit/array-sort.js
@@ -1,29 +1,6 @@
 // Copyright 2010 the V8 project authors. All rights reserved.
-// Redistribution and use in source and binary forms, with or without
-// modification, are permitted provided that the following conditions are
-// met:
-//
-//     * Redistributions of source code must retain the above copyright
-//       notice, this list of conditions and the following disclaimer.
-//     * Redistributions in binary form must reproduce the above
-//       copyright notice, this list of conditions and the following
-//       disclaimer in the documentation and/or other materials provided
-//       with the distribution.
-//     * Neither the name of Google Inc. nor the names of its
-//       contributors may be used to endorse or promote products derived
-//       from this software without specific prior written permission.
-//
-// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
-// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
-// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
-// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
-// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
-// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
-// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
 
 // Flags: --allow-natives-syntax
 
@@ -75,56 +52,6 @@ function TestNumberSort() {
 
 TestNumberSort();
 
-function TestSmiLexicographicCompare() {
-
-  assertFalse(%_IsSmi(2147483648), 'Update test for >32 bit Smi');
-
-  // Collect a list of interesting Smis.
-  var seen = {};
-  var smis = [];
-  function add(x) {
-    if (x | 0 == x) {
-      x = x | 0;  // Canonicalizes to Smi if 32-bit signed and fits in Smi.
-    }
-    if (%_IsSmi(x) && !seen[x]) {
-      seen[x] = 1;
-      smis.push(x);
-    }
-  }
-  function addSigned(x) {
-    add(x);
-    add(-x);
-  }
-
-  var BIGGER_THAN_ANY_SMI = 10 * 1000 * 1000 * 1000;
-  for (var xb = 1; xb <= BIGGER_THAN_ANY_SMI; xb *= 10) {
-    for (var xf = 0; xf <= 9; xf++) {
-      for (var xo = -1; xo <= 1; xo++) {
-        addSigned(xb * xf + xo);
-      }
-    }
-  }
-
-  for (var yb = 1; yb <= BIGGER_THAN_ANY_SMI; yb *= 2) {
-    for (var yo = -2; yo <= 2; yo++) {
-      addSigned(yb + yo);
-    }
-  }
-
-  for (var i = 0; i < smis.length; i++) {
-    for (var j = 0; j < smis.length; j++) {
-      var x = smis[i];
-      var y = smis[j];
-      var lex = %SmiLexicographicCompare(x, y);
-      var expected = (x == y) ? 0 : ((x + "") < (y + "") ? -1 : 1);
-      assertEquals(lex, expected, x + " < " + y);
-    }
-  }
-}
-
-TestSmiLexicographicCompare();
-
-
 // Test lexicographical string sorting.
 function TestStringSort() {
   var a = [ "cc", "c", "aa", "a", "bb", "b", "ab", "ac" ];
@@ -281,7 +208,7 @@ function TestInheritedElementSort(depth) {
   // expected (inherited) object: [undef1,...undefdepth,hole,1,...,depth,0,hole]
 
   Array.prototype.sort.call(obj, function(a,b) { return (b < a) - (a < b); });
-  // expected result: [0,1,...,depth,undef1,...,undefdepth,undef,hole]
+  // expected result: [0,1,...,depth,undef1,...,undefdepth,hole]
   var name = "SortInherit("+depth+")-";
 
   assertEquals(length, obj.length, name+"length");
@@ -289,11 +216,12 @@ function TestInheritedElementSort(depth) {
     assertTrue(obj.hasOwnProperty(i), name + "hasvalue" + i);
     assertEquals(i, obj[i], name + "value" + i);
   }
-  for (var i = depth + 1; i <= depth * 2 + 1; i++) {
+  for (var i = depth + 1; i < depth * 2 + 1; i++) {
     assertEquals(undefined, obj[i], name + "undefined" + i);
     assertTrue(obj.hasOwnProperty(i), name + "hasundefined" + i);
   }
-  assertTrue(!obj.hasOwnProperty(depth * 2 + 2), name + "hashole");
+  assertFalse(obj.hasOwnProperty(depth * 2 + 1), name + "hashole")
+  assertFalse(obj.hasOwnProperty(depth * 2 + 2), name + "hashole");
 }
 
 TestInheritedElementSort(5);
@@ -321,9 +249,8 @@ function TestSparseInheritedElementSort(scale) {
     assertEquals(i, y[i], name + "value" + i);
   }
   for (var i = 10; i < length; i++) {
-    assertEquals(x.hasOwnProperty(i), y.hasOwnProperty(i),
-                 name + "hasundef" + i);
-    assertEquals(undefined, y[i], name+"undefined"+i);
+    assertFalse(y.hasOwnProperty(i), name + "noundef" + i);
+
     if (x.hasOwnProperty(i)) {
       assertTrue(0 == i % (2 * scale), name + "new_x" + i);
     }
@@ -376,14 +303,14 @@ function TestSpecialCasesInheritedElementSort() {
   assertFalse(sorted.length in x, name + "haspost2");
   assertTrue(x.hasOwnProperty(10), name + "hasundefined10");
   assertEquals(undefined, x[10], name + "undefined10");
-  assertTrue(x.hasOwnProperty(100), name + "hasundefined100");
-  assertEquals(undefined, x[100], name + "undefined100");
-  assertTrue(x.hasOwnProperty(1000), name + "hasundefined1000");
-  assertEquals(undefined, x[1000], name + "undefined1000");
-  assertTrue(x.hasOwnProperty(2000), name + "hasundefined2000");
-  assertEquals(undefined, x[2000], name + "undefined2000");
-  assertTrue(x.hasOwnProperty(8000), name + "hasundefined8000");
-  assertEquals(undefined, x[8000], name + "undefined8000");
+  assertFalse(x.hasOwnProperty(100), name + "hasno100");
+  assertEquals("b2", x[100], "inherits100");
+  assertFalse(x.hasOwnProperty(1000), name + "hasno1000");
+  assertEquals("c2", x[1000], "inherits1000");
+  assertFalse(x.hasOwnProperty(2000), name + "hasno2000");
+  assertEquals(undefined, x[2000], "inherits2000");
+  assertFalse(x.hasOwnProperty(8000), name + "hasno8000");
+  assertEquals("d2", x[8000], "inherits8000");
   assertFalse(x.hasOwnProperty(12000), name + "has12000");
   assertEquals("XX", x[12000], name + "XX12000");
 }
@@ -584,3 +511,209 @@ TestSortOnTypedArray();
 assertThrows(() => {
   Array.prototype.sort.call(undefined);
 }, TypeError);
+
+// This test ensures that RemoveArrayHoles does not shadow indices in the
+// prototype chain. There are multiple code paths, we force both and check that
+// they have the same behavior.
+function TestPrototypeHoles() {
+  function test(forceGenericFallback) {
+    let proto2 = {
+      7: 27,
+    };
+
+    let proto1 = {
+      __proto__: proto2,
+      8: 18,
+      9: 19,
+    };
+
+    let xs = {
+      __proto__: proto1,
+      length: 10,
+      7: 7,
+      8: 8,
+      9: 9,
+    };
+
+    if (forceGenericFallback) {
+      Object.defineProperty(xs, "6", {
+        get: () => this.foo,
+        set: (val) => this.foo = val
+      });
+    }
+    xs[6] = 6;
+
+    Array.prototype.sort.call(xs, (a, b) => a - b);
+
+    assertEquals(10, xs.length);
+    assertEquals(6, xs[0]);
+    assertEquals(7, xs[1]);
+    assertEquals(8, xs[2]);
+    assertEquals(9, xs[3]);
+
+    // Index 7,8,9 will get the prototype values.
+    assertFalse(xs.hasOwnProperty(7));
+    assertEquals(27, xs[7]);
+
+    assertFalse(xs.hasOwnProperty(8));
+    assertEquals(18, xs[8]);
+
+    assertFalse(xs.hasOwnProperty(9));
+    assertEquals(19, xs[9]);
+  }
+
+  test(true);
+  test(false);
+}
+TestPrototypeHoles();
+
+// The following Tests make sure that there is no crash when the element kind
+// or the array length changes. Since comparison functions like this are not
+// consistent, we do not have to make sure that the array is actually sorted
+//
+// The assertions for the element kinds are not there to ensure that a specific
+// action causes a specific element kind change, but rather that we have most
+// of the transitions covered.
+
+function cmp_smaller(a, b) {
+  if (a < b) return -1;
+  if (b < a) return 1;
+  return 0;
+}
+
+function create_cmpfn(transformfn) {
+  let cmp_count = 0;
+  return (a, b) => {
+    ++cmp_count;
+    if (cmp_count == 2) {
+      transformfn();
+    }
+
+    return cmp_smaller(a, b);
+  }
+}
+
+function HasPackedSmi(xs) {
+  return %HasFastPackedElements(xs) && %HasSmiElements(xs);
+}
+
+function HasPackedDouble(xs) {
+  return %HasFastPackedElements(xs) && %HasDoubleElements(xs);
+}
+
+function HasPackedObject(xs) {
+  return %HasFastPackedElements(xs) && %HasObjectElements(xs);
+}
+
+function HasHoleySmi(xs) {
+  return %HasHoleyElements(xs) && %HasSmiElements(xs);
+}
+
+function HasHoleyDouble(xs) {
+  return %HasHoleyElements(xs) && %HasDoubleElements(xs);
+}
+
+function HasHoleyObject(xs) {
+  return %HasHoleyElements(xs) && %HasObjectElements(xs);
+}
+
+function TestSortCmpPackedSmiToPackedDouble() {
+  let xs = [2,1,4];
+
+  assertTrue(HasPackedSmi(xs));
+  xs.sort(create_cmpfn(() => xs[0] += 0.1));
+  assertTrue(HasPackedDouble(xs));
+}
+TestSortCmpPackedSmiToPackedDouble();
+
+function TestSortCmpPackedDoubleToPackedElement() {
+  let xs = [2.1, 1.2, 4.4];
+
+  assertTrue(HasPackedDouble(xs));
+  xs.sort(create_cmpfn(() => xs[0] = 'a'));
+  assertTrue(HasPackedObject(xs));
+}
+TestSortCmpPackedDoubleToPackedElement();
+
+function TestSortCmpPackedElementToDictionary() {
+  let xs = ['a', 'b', 'c'];
+
+  assertTrue(HasPackedObject(xs));
+  xs.sort(create_cmpfn(() => xs[%MaxSmi()] = 'd'));
+  assertTrue(%HasDictionaryElements(xs));
+}
+TestSortCmpPackedElementToDictionary();
+
+function TestSortCmpHoleySmiToHoleyDouble() {
+  let xs = [2, 1, 4];
+  xs[5] = 42;
+
+  assertTrue(HasHoleySmi(xs));
+  xs.sort(create_cmpfn(() => xs[0] += 0.1));
+  assertTrue(HasHoleyDouble(xs));
+}
+TestSortCmpHoleySmiToHoleyDouble();
+
+function TestSortCmpHoleyDoubleToHoleyElement() {
+  let xs = [2.1, 1.2, 4];
+  xs[5] = 42;
+
+  assertTrue(HasHoleyDouble(xs));
+  xs.sort(create_cmpfn(() => xs[0] = 'a'));
+  assertTrue(HasHoleyObject(xs));
+}
+TestSortCmpHoleyDoubleToHoleyElement();
+
+function TestSortCmpHoleyElementToDictionary() {
+  let xs = ['b', 'a', 'd'];
+  xs[5] = '42';
+
+  assertTrue(HasHoleyObject(xs));
+  xs.sort(create_cmpfn(() => xs[%MaxSmi()] = 'e'));
+  assertTrue(%HasDictionaryElements(xs));
+}
+TestSortCmpHoleyElementToDictionary();
+
+function TestSortCmpPackedSmiToHoleySmi() {
+  let xs = [2, 1, 4];
+
+  assertTrue(HasPackedSmi(xs));
+  xs.sort(create_cmpfn(() => xs[10] = 42));
+  assertTrue(HasHoleySmi(xs));
+}
+TestSortCmpPackedSmiToHoleySmi();
+
+function TestSortCmpPackedDoubleToHoleyDouble() {
+  let xs = [2.1, 1.2, 4];
+
+  assertTrue(HasPackedDouble(xs));
+  xs.sort(create_cmpfn(() => xs[10] = 42));
+  assertTrue(HasHoleyDouble(xs));
+}
+TestSortCmpPackedDoubleToHoleyDouble();
+
+function TestSortCmpPackedObjectToHoleyObject() {
+  let xs = ['b', 'a', 'd'];
+
+  assertTrue(HasPackedObject(xs));
+  xs.sort(create_cmpfn(() => xs[10] = '42'));
+  assertTrue(HasHoleyObject(xs));
+}
+TestSortCmpPackedObjectToHoleyObject();
+
+function TestSortCmpPackedChangesLength() {
+  let xs = [2, 1, 4];
+
+  assertTrue(HasPackedSmi(xs));
+  xs.sort(create_cmpfn(() => xs.length *= 2));
+  assertTrue(HasHoleySmi(xs));
+}
+TestSortCmpPackedChangesLength();
+
+function TestSortCmpPackedSetLengthToZero() {
+  let xs = [2, 1, 4, 3];
+
+  assertTrue(HasPackedSmi(xs));
+  xs.sort(create_cmpfn(() => xs.length = 0));
+  assertTrue(HasPackedSmi(xs));
+}
diff --git a/deps/v8/test/mjsunit/async-hooks/api-methods.js b/deps/v8/test/mjsunit/async-hooks/api-methods.js
new file mode 100644
index 00000000000000..c013b7a50a9e80
--- /dev/null
+++ b/deps/v8/test/mjsunit/async-hooks/api-methods.js
@@ -0,0 +1,76 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --expose-async-hooks
+
+// Check for invalid arguments handling
+(function() {
+  assertTrue(async_hooks.hasOwnProperty('createHook'),
+    'Async hooks missing createHook method');
+
+  assertThrows(() => async_hooks.createHook());
+  assertThrows(() => async_hooks.createHook(123));
+  assertThrows(() => async_hooks.createHook('str'));
+})();
+
+// Check for correct API methods
+(function() {
+  assertTrue(async_hooks.hasOwnProperty('executionAsyncId'),
+    'Async hooks missing executionAsyncId method');
+  assertTrue(async_hooks.hasOwnProperty('triggerAsyncId'),
+    'Async hooks missing triggerAsyncId method');
+
+  let ah = async_hooks.createHook({});
+  assertTrue(ah.hasOwnProperty('enable'), 'Async hooks missing enable method');
+  assertTrue(ah.hasOwnProperty('disable'),
+    'Async hooks missing disable method');
+})();
+
+// Check for correct enabling/disabling of async hooks
+(function() {
+  let storedPromise;
+  let ah = async_hooks.createHook({
+    init(asyncId, type, triggerAsyncId, resource) {
+      storedPromise = resource.promise || resource;
+    }
+  });
+  ah.enable();
+
+  let createdPromise = new Promise(function(resolve) {
+    resolve(42);
+  });
+  assertSame(storedPromise, createdPromise,
+    "Async hooks weren't enabled correctly");
+  ah.disable();
+  createdPromise = Promise.resolve(52);
+  assertNotSame(storedPromise, createdPromise,
+    "Async hooks weren't disabled correctly");
+  ah.enable();
+  createdPromise = Promise.resolve(62);
+  assertSame(storedPromise, createdPromise,
+    "Async hooks weren't enabled correctly");
+})();
diff --git a/deps/v8/test/mjsunit/async-hooks/async-await-tree.js b/deps/v8/test/mjsunit/async-hooks/async-await-tree.js
new file mode 100644
index 00000000000000..955355cf31fb8d
--- /dev/null
+++ b/deps/v8/test/mjsunit/async-hooks/async-await-tree.js
@@ -0,0 +1,74 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --expose-async-hooks
+
+// Check for async/await asyncIds relation
+(function() {
+  let asyncIds = [], triggerIds = [];
+  let ah = async_hooks.createHook({
+    init(asyncId, type, triggerAsyncId, resource) {
+      if (type !== 'PROMISE') {
+        return;
+      }
+      asyncIds.push(asyncId);
+      triggerIds.push(triggerAsyncId);
+    },
+  });
+  ah.enable();
+
+  // Simplified version of Node.js util.promisify(setTimeout)
+  function sleep(callback, timeout) {
+    const promise = new Promise(function(resolve, reject) {
+      try {
+        setTimeout((err, ...values) => {
+          if (err) {
+            reject(err);
+          } else {
+            resolve(values[0]);
+          }
+        }, timeout);
+      } catch (err) {
+        reject(err);
+      }
+    });
+    return promise;
+  }
+
+  async function foo() {
+    await sleep(10);
+  }
+
+  foo().then(function() {
+    assertEquals(asyncIds.length, 6);
+    assertEquals(triggerIds.length, 6);
+    assertEquals(triggerIds[2], asyncIds[0]);
+    assertEquals(triggerIds[3], asyncIds[2]);
+    assertEquals(triggerIds[4], asyncIds[0]);
+    assertEquals(triggerIds[5], asyncIds[1]);
+  });
+})();
diff --git a/deps/v8/test/mjsunit/regress/regress-2988.js b/deps/v8/test/mjsunit/async-hooks/chained-promises.js
similarity index 66%
rename from deps/v8/test/mjsunit/regress/regress-2988.js
rename to deps/v8/test/mjsunit/async-hooks/chained-promises.js
index 0311d2b76ded60..8b346530eb1058 100644
--- a/deps/v8/test/mjsunit/regress/regress-2988.js
+++ b/deps/v8/test/mjsunit/async-hooks/chained-promises.js
@@ -1,4 +1,4 @@
-// Copyright 2013 the V8 project authors. All rights reserved.
+// Copyright 2018 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
@@ -25,15 +25,24 @@
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
-// Flags: --allow-natives-syntax --gc-global --throws
+// Flags: --expose-async-hooks
 
-var f = eval("(function f() { throw 'kaboom'; })");
-
-// Prepare that next MessageHandler::MakeMessageObject will result in
-// reclamation of existing script wrapper while weak handle is used.
-%FunctionGetScript(f);
-%SetAllocationTimeout(1000, 2);
-
-// This call throws to the console but the --throws flag passed to this
-// test will make sure we don't count it as an actual failure.
-f();
+// Check for chained promises asyncIds relation
+(function() {
+  let asyncIds = [], triggerIds = [];
+  let ah = async_hooks.createHook({
+    init(asyncId, type, triggerAsyncId, resource) {
+      asyncIds.push(asyncId);
+      triggerIds.push(triggerAsyncId);
+    },
+  });
+  ah.enable();
+  let createdPromise = new Promise(function(resolve) {
+    resolve(42);
+  }).then(function() {
+    assertEquals(asyncIds.length, 2, 'Exactly 2 promises should be inited');
+    assertEquals(triggerIds.length, 2, 'Exactly 2 promises should be inited');
+    assertEquals(triggerIds[1], asyncIds[0],
+      "Parent promise asyncId doesn't correspond to child triggerAsyncId");
+  });
+})();
diff --git a/deps/v8/test/mjsunit/async-hooks/execution-order.js b/deps/v8/test/mjsunit/async-hooks/execution-order.js
new file mode 100644
index 00000000000000..f63ecf0032ded7
--- /dev/null
+++ b/deps/v8/test/mjsunit/async-hooks/execution-order.js
@@ -0,0 +1,65 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --expose-async-hooks
+
+// Check for correct execution of available hooks and asyncIds
+(function() {
+  let inited = false, resolved = false, before = false, after = false;
+  let storedAsyncId;
+  let ah = async_hooks.createHook({
+    init(asyncId, type, triggerAsyncId, resource) {
+      if (type !== 'PROMISE') {
+        return;
+      }
+      inited = true;
+      storedAsyncId = asyncId;
+    },
+    promiseResolve(asyncId) {
+      assertEquals(asyncId, storedAsyncId, 'AsyncId mismatch in resolve hook');
+      resolved = true;
+    },
+    before(asyncId) {
+      assertEquals(asyncId, storedAsyncId, 'AsyncId mismatch in before hook');
+      before = true;
+    },
+    after(asyncId) {
+      assertEquals(asyncId, storedAsyncId, 'AsyncId mismatch in after hook');
+      after = true;
+    },
+  });
+  ah.enable();
+
+  new Promise(function(resolve) {
+    resolve(42);
+  }).then(function() {
+    assertTrue(inited, "Didn't call init hook");
+    assertTrue(resolved, "Didn't call resolve hook");
+    assertTrue(before, "Didn't call before hook before the callback");
+    assertFalse(after, "Called after hook before the callback");
+  });
+})();
diff --git a/deps/v8/test/mjsunit/async-hooks/promises-async-await.js b/deps/v8/test/mjsunit/async-hooks/promises-async-await.js
new file mode 100644
index 00000000000000..2eba6ba6c51a04
--- /dev/null
+++ b/deps/v8/test/mjsunit/async-hooks/promises-async-await.js
@@ -0,0 +1,70 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --expose-async-hooks
+
+// Check for executionAsyncId/triggerAsyncId when chained promises and
+// async/await are combined
+(function() {
+  let p;
+  let outerExecutionAsyncId = -1, outerTriggerAsyncId = -1;
+
+  function inIrrelevantContext(resolve) {
+    resolve(42);
+  }
+
+  function inContext1(foo) {
+    foo();
+  }
+
+  function inContext2(foo) {
+    foo();
+  }
+
+  outerExecutionAsyncId = async_hooks.executionAsyncId();
+  outerTriggerAsyncId = async_hooks.triggerAsyncId();
+
+  inContext1(() => {
+    p = new Promise(resolve => {
+      assertEquals(outerExecutionAsyncId, async_hooks.executionAsyncId());
+      assertEquals(outerTriggerAsyncId, async_hooks.triggerAsyncId());
+      inIrrelevantContext(resolve);
+    }).then(() => {
+      assertNotEquals(outerExecutionAsyncId, async_hooks.executionAsyncId());
+      assertNotEquals(outerTriggerAsyncId, async_hooks.triggerAsyncId());
+    });
+  });
+
+  inContext2(async () => {
+    assertEquals(outerExecutionAsyncId, async_hooks.executionAsyncId());
+    assertEquals(outerTriggerAsyncId, async_hooks.triggerAsyncId());
+    await p;
+    assertNotEquals(outerExecutionAsyncId, async_hooks.executionAsyncId());
+    assertNotEquals(outerTriggerAsyncId, async_hooks.triggerAsyncId());
+  });
+
+})();
diff --git a/deps/v8/test/mjsunit/code-comments.js b/deps/v8/test/mjsunit/code-comments.js
new file mode 100644
index 00000000000000..7c013c1f154e2f
--- /dev/null
+++ b/deps/v8/test/mjsunit/code-comments.js
@@ -0,0 +1,26 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --code-comments --print-code
+
+(function simple_test() {
+  function fib(n) {
+    return n < 2 ? n : fib(n - 1) + fib(n - 2);
+  }
+
+  // Call a number of times to trigger optimization.
+  for (let i = 0; i < 100; ++i) {
+    fib(8);
+  }
+})();
+
+(function test_asm() {
+  function asm() {
+    'use asm';
+    function f() {}
+    return f;
+  }
+
+  var m = asm();
+})();
diff --git a/deps/v8/test/mjsunit/code-coverage-utils.js b/deps/v8/test/mjsunit/code-coverage-utils.js
index 009aa55e202518..57833902220b7f 100644
--- a/deps/v8/test/mjsunit/code-coverage-utils.js
+++ b/deps/v8/test/mjsunit/code-coverage-utils.js
@@ -13,7 +13,7 @@ let gen;
 !function() {
   function GetCoverage(source) {
     for (var script of %DebugCollectCoverage()) {
-      if (script.script.source == source) return script;
+      if (script.script === source) return script;
     }
     return undefined;
   };
diff --git a/deps/v8/test/mjsunit/compiler/alloc-number.js b/deps/v8/test/mjsunit/compiler/alloc-number.js
index 85c39de431fd7e..cd062cafba8aab 100644
--- a/deps/v8/test/mjsunit/compiler/alloc-number.js
+++ b/deps/v8/test/mjsunit/compiler/alloc-number.js
@@ -1,39 +1,20 @@
 // Copyright 2010 the V8 project authors. All rights reserved.
-// Redistribution and use in source and binary forms, with or without
-// modification, are permitted provided that the following conditions are
-// met:
-//
-//     * Redistributions of source code must retain the above copyright
-//       notice, this list of conditions and the following disclaimer.
-//     * Redistributions in binary form must reproduce the above
-//       copyright notice, this list of conditions and the following
-//       disclaimer in the documentation and/or other materials provided
-//       with the distribution.
-//     * Neither the name of Google Inc. nor the names of its
-//       contributors may be used to endorse or promote products derived
-//       from this software without specific prior written permission.
-//
-// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
-// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
-// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
-// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
-// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
-// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
-// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
 
+// Flags: --max-semi-space-size=1 --max-old-space-size=10
+
+// This test is specific to release builds. alloc-number-debug.js
+// has a fast version for debug builds.
 
 // Try to get a GC because of a heap number allocation while we
 // have live values (o) in a register.
 function f(o) {
   var x = 1.5;
   var y = 2.5;
-  for (var i = 1; i < 100000; i+=2) o.val = x + y + i;
+  for (var i = 1; i < 10000; i+=2) o.val = x + y + i;
   return o;
 }
 
 var o = { val: 0 };
-for (var i = 0; i < 100; i++) f(o);
+for (var i = 0; i < 10; i++) f(o);
diff --git a/deps/v8/test/mjsunit/compiler/array-species.js b/deps/v8/test/mjsunit/compiler/array-species.js
new file mode 100644
index 00000000000000..d1e8a1d1803da7
--- /dev/null
+++ b/deps/v8/test/mjsunit/compiler/array-species.js
@@ -0,0 +1,33 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function Foo() {}
+
+function f() {
+  return [42].map(_ => 88);
+}
+
+let y;
+
+y = f();
+assertFalse(y instanceof Foo);
+assertInstanceof(y, Array);
+
+y = f();
+assertFalse(y instanceof Foo);
+assertInstanceof(y, Array);
+
+%OptimizeFunctionOnNextCall(f);
+
+y = f();
+assertFalse(y instanceof Foo);
+assertInstanceof(y, Array);
+
+assertTrue(Reflect.defineProperty(Array, Symbol.species, {value: Foo}));
+
+y = f();
+assertInstanceof(y, Foo);
+assertFalse(y instanceof Array);
diff --git a/deps/v8/test/mjsunit/compiler/constructor-inlining-no-harmony-restrict-constructor-return.js b/deps/v8/test/mjsunit/compiler/constructor-inlining-no-harmony-restrict-constructor-return.js
deleted file mode 100644
index 50d15eb30f8260..00000000000000
--- a/deps/v8/test/mjsunit/compiler/constructor-inlining-no-harmony-restrict-constructor-return.js
+++ /dev/null
@@ -1,12 +0,0 @@
-// Copyright 2017 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-// Flags: --allow-natives-syntax --no-harmony-restrict-constructor-return
-
-this.FLAG_harmony_restrict_constructor_return = false;
-try {
-  load('mjsunit/compiler/constructor-inlining.js');
-} catch(e) {
-  load('test/mjsunit/compiler/constructor-inlining.js');
-}
diff --git a/deps/v8/test/mjsunit/compiler/constructor-inlining.js b/deps/v8/test/mjsunit/compiler/constructor-inlining.js
index 4ad426ff6101a6..05b5762a53f8ac 100644
--- a/deps/v8/test/mjsunit/compiler/constructor-inlining.js
+++ b/deps/v8/test/mjsunit/compiler/constructor-inlining.js
@@ -2,10 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --harmony-restrict-constructor-return --allow-natives-syntax --stress-inline
+// Flags: --allow-natives-syntax --stress-inline
 
-if (this.FLAG_harmony_restrict_constructor_return === undefined)
-  this.FLAG_harmony_restrict_constructor_return = true;
 var counter = 0;
 var deopt_at = -1;
 
@@ -65,17 +63,7 @@ function testConstructorInlining(){
 
   assertEquals(a, new Base(true, a));
   assertEquals(7, new Base(false, 7).x);
-  if (FLAG_harmony_restrict_constructor_return) {
-    // not using assertThrows to ensure proper inlining
-    try {
-      new Base(true, 5);
-      assertTrue(false);
-    } catch (e) {
-      if (!(e instanceof TypeError)) throw e;
-    }
-  } else {
-    assertEquals(5, new Base(true, 5).x);
-  }
+  assertEquals(5, new Base(true, 5).x);
 
   assertEquals(b, new Derived(true, a, b));
   assertEquals(a, new Derived(true, a, undefined));
@@ -87,16 +75,7 @@ function testConstructorInlining(){
   } catch (e) {
     if (!(e instanceof TypeError)) throw e;
   }
-  if (FLAG_harmony_restrict_constructor_return) {
-    try {
-      new Derived(true, 5, a)
-      assertTrue(false);
-    } catch (e) {
-      if (!(e instanceof TypeError)) throw e;
-    }
-  } else {
-    assertEquals(a, new Derived(true, 5, a));
-  }
+  assertEquals(a, new Derived(true, 5, a));
 
   %OptimizeFunctionOnNextCall(Derived);
   assertEquals(b, new DerivedDeoptCreate(true, a, b));
diff --git a/deps/v8/test/mjsunit/compiler/dataview-get.js b/deps/v8/test/mjsunit/compiler/dataview-get.js
new file mode 100644
index 00000000000000..6c64410344e38a
--- /dev/null
+++ b/deps/v8/test/mjsunit/compiler/dataview-get.js
@@ -0,0 +1,173 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --opt --no-always-opt
+
+var buffer = new ArrayBuffer(64);
+var dataview = new DataView(buffer, 8, 24);
+
+var values = [-1, 2, -3, 42];
+
+function readUint8(offset) {
+  return dataview.getUint8(offset);
+}
+
+function readInt8Handled(offset) {
+  try {
+    return dataview.getInt8(offset);
+  } catch (e) {
+    return e;
+  }
+}
+
+function readUint16(offset, little_endian) {
+  return dataview.getUint16(offset, little_endian);
+}
+
+function readInt16Handled(offset, little_endian) {
+  try {
+    return dataview.getInt16(offset, little_endian);
+  } catch (e) {
+    return e;
+  }
+}
+
+function readUint32(offset, little_endian) {
+  return dataview.getUint32(offset, little_endian);
+}
+
+function readInt32Handled(offset, little_endian) {
+  try {
+    return dataview.getInt32(offset, little_endian);
+  } catch (e) {
+    return e;
+  }
+}
+
+function readFloat32(offset, little_endian) {
+  return dataview.getFloat32(offset, little_endian);
+}
+
+function readFloat64(offset, little_endian) {
+  return dataview.getFloat64(offset, little_endian);
+}
+
+function warmup(f) {
+  f(0);
+  f(1);
+  %OptimizeFunctionOnNextCall(f);
+  f(2);
+  f(3);
+}
+
+// TurboFan valid getInt8.
+for (var i = 0; i < values.length; i++) {
+  dataview.setInt8(i, values[i]);
+}
+warmup(readInt8Handled);
+assertOptimized(readInt8Handled);
+assertEquals(values[0], readInt8Handled(0));
+assertEquals(values[1], readInt8Handled(1));
+assertEquals(values[2], readInt8Handled(2));
+assertEquals(values[3], readInt8Handled(3));
+
+// TurboFan valid getUint8.
+dataview.setUint32(4, 0xdeadbeef);
+warmup(readUint8);
+assertOptimized(readUint8);
+assertEquals(0xde, readUint8(4));
+assertEquals(0xad, readUint8(5));
+assertEquals(0xbe, readUint8(6));
+assertEquals(0xef, readUint8(7));
+
+// TurboFan valid getUint16.
+dataview.setUint16(8, 0xabcd);
+warmup(readUint16);
+assertOptimized(readUint16);
+assertEquals(0xabcd, readUint16(8));
+assertEquals(0xcdab, readUint16(8, true));
+
+// TurboFan valid getInt16.
+let b1 = -0x1234;
+dataview.setInt16(10, b1);
+warmup(readInt16Handled);
+assertOptimized(readInt16Handled);
+assertEquals(b1, readInt16Handled(10));
+dataview.setInt16(10, b1, true);
+assertEquals(b1, readInt16Handled(10, true));
+
+// TurboFan valid getUint32.
+dataview.setUint32(12, 0xabcdef12);
+warmup(readUint32);
+assertOptimized(readUint32);
+assertEquals(0xabcdef12, readUint32(12));
+assertEquals(0x12efcdab, readUint32(12, true));
+
+// TurboFan valid getInt32.
+let b2 = -0x12345678;
+dataview.setInt32(16, b2);
+warmup(readInt32Handled);
+assertOptimized(readInt32Handled);
+assertEquals(b2, readInt32Handled(16));
+dataview.setInt32(16, b2, true);
+assertEquals(b2, readInt32Handled(16, true));
+
+// TurboFan valid getFloat32.
+let b3 = Math.fround(Math.E); // Round Math.E to float32.
+dataview.setFloat32(16, b3);
+warmup(readFloat32);
+assertOptimized(readFloat32);
+assertEquals(b3, readFloat32(16));
+dataview.setFloat32(16, b3, true);
+assertEquals(b3, readFloat32(16, true));
+
+// TurboFan valid getFloat64.
+let b4 = Math.PI;
+dataview.setFloat64(16, b4);
+warmup(readFloat64);
+assertOptimized(readFloat64);
+assertEquals(b4, readFloat64(16));
+dataview.setFloat64(16, b4, true);
+assertEquals(b4, readFloat64(16, true));
+
+
+// TurboFan out of bounds read, throw with exception handler.
+assertOptimized(readInt8Handled);
+assertInstanceof(readInt8Handled(24), RangeError);
+assertOptimized(readInt8Handled);
+assertOptimized(readInt16Handled);
+assertInstanceof(readInt16Handled(23), RangeError);
+assertOptimized(readInt16Handled);
+assertOptimized(readInt32Handled);
+assertInstanceof(readInt32Handled(21), RangeError);
+assertOptimized(readInt32Handled);
+
+// Without exception handler.
+assertOptimized(readUint8);
+assertThrows(() => readUint8(24));
+assertOptimized(readUint8);
+assertOptimized(readFloat32);
+assertThrows(() => readFloat32(21));
+assertOptimized(readFloat32);
+assertOptimized(readFloat64);
+assertThrows(() => readFloat64(17));
+assertOptimized(readFloat64);
+
+
+// TurboFan deoptimizations.
+assertOptimized(readInt8Handled);
+assertInstanceof(readInt8Handled(-1), RangeError); // Negative Smi deopts.
+assertUnoptimized(readInt8Handled);
+
+warmup(readInt8Handled);
+assertOptimized(readInt8Handled);
+assertEquals(values[3], readInt8Handled(3.14)); // Non-Smi index deopts.
+assertUnoptimized(readInt8Handled);
+
+// TurboFan neutered buffer.
+warmup(readInt8Handled);
+assertOptimized(readInt8Handled);
+%ArrayBufferNeuter(buffer);
+assertInstanceof(readInt8Handled(0), TypeError);
+assertOptimized(readInt8Handled);
diff --git a/deps/v8/test/mjsunit/compiler/dataview-set.js b/deps/v8/test/mjsunit/compiler/dataview-set.js
new file mode 100644
index 00000000000000..07bcb8d93c6010
--- /dev/null
+++ b/deps/v8/test/mjsunit/compiler/dataview-set.js
@@ -0,0 +1,133 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --opt --no-always-opt
+
+var buffer = new ArrayBuffer(64);
+var dataview = new DataView(buffer, 8, 24);
+
+function writeUint8(offset, value) {
+  dataview.setUint8(offset, value);
+}
+
+function writeInt8Handled(offset, value) {
+  try {
+    dataview.setInt8(offset, value);
+  } catch(e) {
+    return e;
+  }
+}
+
+function writeUint16(offset, value, little_endian) {
+  dataview.setUint16(offset, value, little_endian);
+}
+
+function writeInt16(offset, value, little_endian) {
+  dataview.setInt16(offset, value, little_endian);
+}
+
+function writeUint32(offset, value, little_endian) {
+  dataview.setUint32(offset, value, little_endian);
+}
+
+function writeInt32(offset, value, little_endian) {
+  dataview.setInt32(offset, value, little_endian);
+}
+
+function writeFloat32(offset, value, little_endian) {
+  dataview.setFloat32(offset, value, little_endian);
+}
+
+function writeFloat64(offset, value, little_endian) {
+  dataview.setFloat64(offset, value, little_endian);
+}
+
+function warmup(f) {
+  f(0, 0);
+  f(0, 1);
+  %OptimizeFunctionOnNextCall(f);
+  f(0, 2);
+  f(0, 3);
+}
+
+// TurboFan valid setUint8.
+warmup(writeUint8);
+assertOptimized(writeUint8);
+writeUint8(0, 0xde);
+writeUint8(1, 0xad);
+writeUint8(2, 0xbe);
+writeUint8(3, 0xef);
+assertEquals(0xdeadbeef, dataview.getUint32(0));
+
+// TurboFan valid setInt8.
+warmup(writeInt8Handled);
+assertOptimized(writeInt8Handled);
+writeInt8Handled(0, -34);
+writeInt8Handled(1, -83);
+writeInt8Handled(2, -66);
+writeInt8Handled(3, -17);
+assertEquals(0xdeadbeef, dataview.getUint32(0));
+
+// TurboFan valid setUint16.
+warmup(writeUint16);
+assertOptimized(writeUint16);
+writeUint16(0, 0xdead);
+writeUint16(2, 0xefbe, true);
+assertEquals(0xdeadbeef, dataview.getUint32(0));
+
+// TurboFan valid setInt16.
+warmup(writeInt16);
+assertOptimized(writeInt16);
+writeInt16(0, -8531);
+writeInt16(2, -4162, true);
+assertEquals(0xdeadbeef, dataview.getUint32(0));
+
+// TurboFan valid setUint32.
+warmup(writeUint32);
+assertOptimized(writeUint32);
+writeUint32(0, 0xdeadbeef);
+assertEquals(0xdeadbeef, dataview.getUint32(0));
+writeUint32(0, 0xefbeadde, true);
+assertEquals(0xdeadbeef, dataview.getUint32(0));
+
+// TurboFan valid setInt32.
+warmup(writeInt32);
+assertOptimized(writeInt32);
+writeInt32(0, -559038737);
+assertEquals(0xdeadbeef, dataview.getUint32(0));
+writeInt32(0, -272716322, true);
+assertEquals(0xdeadbeef, dataview.getUint32(0));
+
+// TurboFan valid setFloat32.
+let b3 = Math.fround(Math.E); // Round Math.E to float32.
+warmup(writeFloat32);
+assertOptimized(writeFloat32);
+writeFloat32(4, b3);
+assertEquals(b3, dataview.getFloat32(4));
+writeFloat32(4, b3, true);
+assertEquals(b3, dataview.getFloat32(4, true));
+
+// TurboFan valid setFloat64.
+let b4 = Math.PI;
+warmup(writeFloat64);
+assertOptimized(writeFloat64);
+writeFloat64(8, b4);
+assertEquals(b4, dataview.getFloat64(8));
+writeFloat64(8, b4, true);
+assertEquals(b4, dataview.getFloat64(8, true));
+
+// TurboFan out of bounds read, throw with exception handler.
+assertOptimized(writeInt8Handled);
+assertInstanceof(writeInt8Handled(24, 0), RangeError);
+assertOptimized(writeInt8Handled);
+
+// Without exception handler.
+assertOptimized(writeUint8);
+assertThrows(() => writeUint8(24, 0));
+assertOptimized(writeUint8);
+
+// None of the stores wrote out of bounds.
+var bytes = new Uint8Array(buffer);
+for (var i = 0; i < 8; i++) assertEquals(0, bytes[i]);
+for (var i = 32; i < 64; i++) assertEquals(0, bytes[i]);
diff --git a/deps/v8/test/mjsunit/compiler/object-create.js b/deps/v8/test/mjsunit/compiler/object-create.js
new file mode 100644
index 00000000000000..bd366fe0b0200c
--- /dev/null
+++ b/deps/v8/test/mjsunit/compiler/object-create.js
@@ -0,0 +1,27 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+(function TestWithNullPrototype() {
+  function f() { return Object.create(null); }
+  f();
+  %OptimizeFunctionOnNextCall(f);
+  assertEquals(undefined, f().foo);
+})();
+
+(function TestWithCustomPrototype() {
+  const x = {foo: 42};  // This must be defined here for context specialization.
+  function f() { return Object.create(x); }
+  f();
+  %OptimizeFunctionOnNextCall(f);
+  assertEquals(42, f().foo);
+})();
+
+(function TestWithObjectPrototype() {
+  function f() { return Object.create(Object.prototype); }
+  f();
+  %OptimizeFunctionOnNextCall(f);
+  assertEquals("[object Object]", f().toString());
+})();
diff --git a/deps/v8/test/mjsunit/compiler/osr-nested.js b/deps/v8/test/mjsunit/compiler/osr-nested.js
index 4bdb0828ca2272..28c42c8f73365f 100644
--- a/deps/v8/test/mjsunit/compiler/osr-nested.js
+++ b/deps/v8/test/mjsunit/compiler/osr-nested.js
@@ -25,22 +25,23 @@
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
-// Flags: --use-osr
+// Flags: --use-osr --allow-natives-syntax
 
 function f() {
   var sum = 0;
   for (var i = 0; i < 10; i++) {
-    for (var j = 0; j < 100000; j++) {
+    for (var j = 0; j < 10; j++) {
       var x = i + 2;
       var y = x + 5;
       var z = y + 3;
       sum += z;
+      if (j == 5) %OptimizeOsr();
     }
   }
   return sum;
 }
 
 
-assertEquals(14500000, f());
-assertEquals(14500000, f());
-assertEquals(14500000, f());
+assertEquals(1450, f());
+assertEquals(1450, f());
+assertEquals(1450, f());
diff --git a/deps/v8/test/mjsunit/compiler/osr-one.js b/deps/v8/test/mjsunit/compiler/osr-one.js
index 2c27192d277360..d52a1c80896191 100644
--- a/deps/v8/test/mjsunit/compiler/osr-one.js
+++ b/deps/v8/test/mjsunit/compiler/osr-one.js
@@ -1,40 +1,20 @@
 // Copyright 2013 the V8 project authors. All rights reserved.
-// Redistribution and use in source and binary forms, with or without
-// modification, are permitted provided that the following conditions are
-// met:
-//
-//     * Redistributions of source code must retain the above copyright
-//       notice, this list of conditions and the following disclaimer.
-//     * Redistributions in binary form must reproduce the above
-//       copyright notice, this list of conditions and the following
-//       disclaimer in the documentation and/or other materials provided
-//       with the distribution.
-//     * Neither the name of Google Inc. nor the names of its
-//       contributors may be used to endorse or promote products derived
-//       from this software without specific prior written permission.
-//
-// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
-// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
-// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
-// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
-// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
-// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
-// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
 
-// Flags: --use-osr
+// Flags: --use-osr --allow-natives-syntax
 
 function f(x) {
   var sum = 0;
-  var count = 10000000;
+  var count = 10;
   while (count > 0) {
     sum += x;
     count--;
+    if (count == 5) {
+      %OptimizeOsr();
+    }
   }
   return sum;
 }
 
-assertEquals(50000000, f(5));
+assertEquals(50, f(5));
diff --git a/deps/v8/test/mjsunit/compiler/osr-two.js b/deps/v8/test/mjsunit/compiler/osr-two.js
index 8ac4c2cc128180..36842b4beb99a6 100644
--- a/deps/v8/test/mjsunit/compiler/osr-two.js
+++ b/deps/v8/test/mjsunit/compiler/osr-two.js
@@ -1,44 +1,24 @@
 // Copyright 2013 the V8 project authors. All rights reserved.
-// Redistribution and use in source and binary forms, with or without
-// modification, are permitted provided that the following conditions are
-// met:
-//
-//     * Redistributions of source code must retain the above copyright
-//       notice, this list of conditions and the following disclaimer.
-//     * Redistributions in binary form must reproduce the above
-//       copyright notice, this list of conditions and the following
-//       disclaimer in the documentation and/or other materials provided
-//       with the distribution.
-//     * Neither the name of Google Inc. nor the names of its
-//       contributors may be used to endorse or promote products derived
-//       from this software without specific prior written permission.
-//
-// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
-// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
-// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
-// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
-// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
-// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
-// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
 
-// Flags: --use-osr
+// Flags: --use-osr --allow-natives-syntax
 
 function f(x) {
   var sum = 0;
-  var outer = 100;
+  var outer = 10;
   while (outer > 0) {
-    var inner = 100000;
+    var inner = 10;
     while (inner > 0) {
       sum += x;
       inner--;
+      if (inner == 5) {
+        %OptimizeOsr();
+      }
     }
     outer--;
   }
   return sum;
 }
 
-assertEquals(50000000, f(5));
+assertEquals(500, f(5));
diff --git a/deps/v8/test/mjsunit/compiler/promise-species.js b/deps/v8/test/mjsunit/compiler/promise-species.js
new file mode 100644
index 00000000000000..f029e3aad5b4fd
--- /dev/null
+++ b/deps/v8/test/mjsunit/compiler/promise-species.js
@@ -0,0 +1,29 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+class Foo extends Promise {};
+
+function f() {
+  return new Promise(r => 88).then(x => 88);
+}
+
+let y;
+
+y = f();
+assertFalse(y instanceof Foo);
+
+y = f();
+assertFalse(y instanceof Foo);
+
+%OptimizeFunctionOnNextCall(f);
+
+y = f();
+assertFalse(y instanceof Foo);
+
+assertTrue(Reflect.defineProperty(Promise, Symbol.species, {value: Foo}));
+
+y = f();
+assertInstanceof(y, Foo);
diff --git a/deps/v8/test/mjsunit/compiler/regress-841117.js b/deps/v8/test/mjsunit/compiler/regress-841117.js
new file mode 100644
index 00000000000000..a059922a6e6933
--- /dev/null
+++ b/deps/v8/test/mjsunit/compiler/regress-841117.js
@@ -0,0 +1,11 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var v = 1e9;
+function f() { return Math.floor(v / 10); }
+assertEquals(1e8, f());
+%OptimizeFunctionOnNextCall(f);
+assertEquals(1e8, f());
diff --git a/deps/v8/test/mjsunit/compiler/string-concat-deopt.js b/deps/v8/test/mjsunit/compiler/string-concat-deopt.js
index 1d6ce9997c2065..9043b00488adda 100644
--- a/deps/v8/test/mjsunit/compiler/string-concat-deopt.js
+++ b/deps/v8/test/mjsunit/compiler/string-concat-deopt.js
@@ -44,11 +44,7 @@
   assertEquals("abcde", f("de"));
   assertEquals("abcde", f("de"));
   %OptimizeFunctionOnNextCall(f);
-  var s = "x".repeat((1 << 28) - 16);
-  try {
-    s = "x".repeat((1 << 30) - 1 - 24);
-  } catch (e) {
-  }
+  var s = "x".repeat(%StringMaxLength());
   assertThrows(() => f(s), RangeError);
 })();
 
@@ -93,10 +89,6 @@
   assertEquals("abcde", f("de"));
   assertEquals("abcde", f("de"));
   %OptimizeFunctionOnNextCall(f);
-  var s = "x".repeat((1 << 28) - 16);
-  try {
-    s = "x".repeat((1 << 30) - 1 - 24);
-  } catch (e) {
-  }
+  var s = "x".repeat(%StringMaxLength());
   assertThrows(() => f(s), RangeError);
 })();
diff --git a/deps/v8/test/mjsunit/date.js b/deps/v8/test/mjsunit/date.js
index fc5bcc54b56f9a..d847ce1e44809e 100644
--- a/deps/v8/test/mjsunit/date.js
+++ b/deps/v8/test/mjsunit/date.js
@@ -155,6 +155,11 @@ assertDoesNotThrow("new Date(0x40000000, 0x40000000, 0x40000000," +
 assertDoesNotThrow("new Date(-0x40000001, -0x40000001, -0x40000001," +
                    "-0x40000001, -0x40000001, -0x40000001, -0x40000001)")
 
+// Test that date as double type is treated as integer type in MakeDay
+// so that the hour should't be changed.
+d = new Date(2018, 0);
+assertEquals(Date.parse(new Date(2018, 0, 11)), d.setDate(11.2));
+assertEquals(0, d.getHours());
 
 // Modified test from WebKit
 // LayoutTests/fast/js/script-tests/date-utc-timeclip.js:
diff --git a/deps/v8/test/mjsunit/es6/dataview-length.js b/deps/v8/test/mjsunit/es6/dataview-length.js
new file mode 100644
index 00000000000000..925403924df1df
--- /dev/null
+++ b/deps/v8/test/mjsunit/es6/dataview-length.js
@@ -0,0 +1,7 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+"use strict";
+
+assertEquals(DataView.length, 1);
diff --git a/deps/v8/test/mjsunit/es6/reflect.js b/deps/v8/test/mjsunit/es6/reflect.js
index 9e21717a994a0a..cb8febb69ebdfb 100644
--- a/deps/v8/test/mjsunit/es6/reflect.js
+++ b/deps/v8/test/mjsunit/es6/reflect.js
@@ -2,8 +2,6 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// TODO(neis): Test with proxies.
-
 
 
 ////////////////////////////////////////////////////////////////////////////////
diff --git a/deps/v8/test/mjsunit/es6/regress/regress-7706.js b/deps/v8/test/mjsunit/es6/regress/regress-7706.js
new file mode 100644
index 00000000000000..78ba4c9dee6477
--- /dev/null
+++ b/deps/v8/test/mjsunit/es6/regress/regress-7706.js
@@ -0,0 +1,16 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+class Test extends Number {}
+Test.prototype[Symbol.toStringTag] = "Test";
+
+function toString(o) {
+  %ToFastProperties(o.__proto__);
+  return Object.prototype.toString.call(o);
+}
+
+assertEquals("[object Test]", toString(new Test), "Try #1");
+assertEquals("[object Test]", toString(new Test), "Try #2");
diff --git a/deps/v8/test/mjsunit/es6/typedarray-construct-by-array-like.js b/deps/v8/test/mjsunit/es6/typedarray-construct-by-array-like.js
index 6573f2635d3fe8..3b57f8f644d1db 100644
--- a/deps/v8/test/mjsunit/es6/typedarray-construct-by-array-like.js
+++ b/deps/v8/test/mjsunit/es6/typedarray-construct-by-array-like.js
@@ -208,9 +208,7 @@ tests.push(function TestFromTypedArraySpeciesNeutersBuffer(constr) {
     }
   });
 
-  var a2 = new constr(a1);
-
-  assertArrayEquals([], a2);
+  assertThrows(() => new constr(a1));
 });
 
 tests.push(function TestLengthIsMaxSmi(constr) {
diff --git a/deps/v8/test/mjsunit/es6/typedarray-keyedstore-tonumber.js b/deps/v8/test/mjsunit/es6/typedarray-keyedstore-tonumber.js
new file mode 100644
index 00000000000000..ca4861819df21d
--- /dev/null
+++ b/deps/v8/test/mjsunit/es6/typedarray-keyedstore-tonumber.js
@@ -0,0 +1,69 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+let TypedArrayConstructors = [
+  Float64Array,
+  Float32Array,
+  Uint32Array,
+  Int32Array,
+  Uint16Array,
+  Int16Array,
+  Uint8Array,
+  Uint8ClampedArray,
+  Int8Array,
+];
+
+// Test KeyedStore in uninitialized and monomorphic states.
+for (let C of TypedArrayConstructors) {
+  let keyedSta = function(array) {
+    var didRun = false;
+    array[0] = {
+      valueOf() {
+        didRun = true;
+        return 42;
+      }
+    };
+
+    return { didRun, array };
+  };
+
+  for (var i = 0; i < 3; ++i) {
+    var { didRun, array } = keyedSta(new C(1));
+    assertTrue(didRun);
+    assertEquals(array[0], 42);
+
+    // OOB store
+    // FIXME: Throw a TypeError when storing OOB in a TypedArray.
+    var { didRun } = keyedSta(new C);
+    assertTrue(didRun);
+  }
+}
+
+// Test KeyedStore in polymorphic and megamorphic states.
+do {
+  let keyedSta = function(array) {
+    var didRun = false;
+    array[0] = {
+      valueOf() {
+        didRun = true;
+        return 42;
+      }
+    };
+
+    return { didRun, array };
+  };
+
+  for (var i = 0; i < 3; ++i) {
+    for (var C of TypedArrayConstructors) {
+      var { didRun, array } = keyedSta(new C(1));
+      assertTrue(didRun);
+      assertEquals(array[0], 42);
+
+      // OOB store
+      // FIXME: Throw a TypeError when storing OOB in a TypedArray.
+      var { didRun } = keyedSta(new C);
+      assertTrue(didRun);
+    }
+  }
+} while (false);
diff --git a/deps/v8/test/mjsunit/es6/typedarray-sort.js b/deps/v8/test/mjsunit/es6/typedarray-sort.js
index b69009b22d47d2..e2618ade6b0797 100644
--- a/deps/v8/test/mjsunit/es6/typedarray-sort.js
+++ b/deps/v8/test/mjsunit/es6/typedarray-sort.js
@@ -68,3 +68,59 @@ for (var constructor of typedArrayConstructors) {
   %ArrayBufferNeuter(array.buffer);
   assertThrows(() => array.sort(), TypeError);
 }
+
+// The following creates a test for each typed element kind, where the array
+// to sort consists of some max/min/zero elements.
+//
+// When providing a custom compare function, the torque version of
+// TypedArray.p.sort needs to convert array elements to "Number"/"BigInt"
+// and back. The following test checks the edge cases for that conversion.
+
+let constructorsWithArrays = [
+  {ctor: Uint8Array, array: [255, 254, 4, 3, 2, 1, 0]},
+  {ctor: Int8Array, array: [127, 126, 1, 0, -1, -127, -128]},
+  {ctor: Uint16Array, array: [2 ** 16 - 1, 2 ** 16 - 2, 4, 3, 2, 1, 0]},
+  {
+    ctor: Int16Array,
+    array: [2 ** 15 - 1, 2 ** 15 - 2, 1, 0, -1, -(2 ** 15 - 1), -(2 ** 15)]
+  },
+  {ctor: Uint32Array, array: [2 ** 32 - 1, 2 ** 32 - 2, 4, 3, 2, 1, 0]},
+  {
+    ctor: Int32Array,
+    array: [2 ** 31 - 1, 2 ** 31 - 2, 1, 0, -1, -(2 ** 31 - 1), -(2 ** 31)]
+  },
+  {
+    ctor: Float32Array,
+    array: [2 ** 24, 2 ** 24 - 1, 1, 0,-1, -(2 ** 24 - 1), -(2 ** 24)]
+  },
+  {
+    ctor: Float64Array,
+    array: [2 ** 53, 2 ** 53 - 1, 1, 0, -1, -(2 ** 53 - 1), -(2 ** 53)]
+  },
+  {ctor: Uint8ClampedArray, array: [255, 254, 4, 3, 2, 1, 0]},
+  {
+    ctor: BigUint64Array,
+    array: [2n ** 64n - 1n, 2n ** 64n - 2n, 4n, 3n, 2n, 1n, 0n]
+  },
+  {
+    ctor: BigInt64Array,
+    array: [2n ** 63n - 1n, 2n ** 63n - 2n, 1n, 0n,
+            -1n, -(2n ** 63n - 1n), -(2n ** 63n)]
+  }
+];
+
+// Compare function needs to return a Number in all cases, and not a BigInt.
+// Hence we can not simply return "a - b".
+function cmpfn(a, b) {
+  if (a < b) return -1;
+  if (b < a) return 1;
+  return 0;
+}
+
+for (let constructor of constructorsWithArrays) {
+  let array = new constructor.ctor(constructor.array);
+
+  assertEquals(array.sort(cmpfn), array);
+  assertArrayLikeEquals(array, constructor.array.reverse(), constructor.ctor);
+  assertEquals(array.length, constructor.array.length);
+}
diff --git a/deps/v8/test/debugger/debug/debug-liveedit-stack-padding.js b/deps/v8/test/mjsunit/es8/async-await-interleaved.js
similarity index 55%
rename from deps/v8/test/debugger/debug/debug-liveedit-stack-padding.js
rename to deps/v8/test/mjsunit/es8/async-await-interleaved.js
index d0cc77ac7ac48f..edc5a420acd0e7 100644
--- a/deps/v8/test/debugger/debug/debug-liveedit-stack-padding.js
+++ b/deps/v8/test/mjsunit/es8/async-await-interleaved.js
@@ -1,4 +1,4 @@
-// Copyright 2012 the V8 project authors. All rights reserved.
+// Copyright 2018 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
@@ -25,64 +25,37 @@
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
-
-Debug = debug.Debug;
-Debug.setListener(listener);
-
-SlimFunction = eval(
-    "(function() {\n " +
-    "  return 'Cat';\n" +
-    "})\n"
-);
-
-var script = Debug.findScript(SlimFunction);
-
-Debug.setScriptBreakPointById(script.id, 1, 0);
-
-var orig_animal = "'Cat'";
-var patch_pos = script.source.indexOf(orig_animal);
-var new_animal_patch = "'Capybara'";
-
-debugger_handler = (function() {
-  var already_called = false;
-  return function() {
-    if (already_called) {
-      return;
-    }
-    already_called = true;
-
-    var change_log = new Array();
-    try {
-      Debug.LiveEdit.TestApi.ApplySingleChunkPatch(script, patch_pos,
-          orig_animal.length, new_animal_patch, change_log);
-    } finally {
-      print("Change log: " + JSON.stringify(change_log) + "\n");
+// Check for correct interleaving of Promises and async/await
+(function () {
+  const iterations = 10;
+  let promiseCounter = iterations;
+  let awaitCounter = 0;
+
+  async function check(v) {
+    awaitCounter = v;
+    // The following checks ensure that "await" takes 3 ticks on the
+    // microtask queue. Note: this will change in the future
+    if (awaitCounter === 0) {
+      assertEquals(iterations, promiseCounter);
+    } else if (awaitCounter <= Math.floor(iterations / 3)) {
+      assertEquals(iterations - awaitCounter * 3, promiseCounter);
+    } else {
+      assertEquals(0, promiseCounter);
     }
-  };
-})();
-
-var saved_exception = null;
+  }
 
-function listener(event, exec_state, event_data, data) {
-  if (event == Debug.DebugEvent.Break) {
-    try {
-      debugger_handler();
-    } catch (e) {
-      saved_exception = e;
+  async function f() {
+    for (let i = 0; i < iterations; i++) {
+      await check(i);
     }
-  } else {
-    print("Other: " + event);
+    return 0;
   }
-}
-
 
-var animal = SlimFunction();
-
-if (saved_exception) {
-  print("Exception: " + saved_exception);
-  assertUnreachable();
-}
-
-assertEquals("Capybara", animal);
+  function countdown(v) {
+    promiseCounter = v;
+    if (v > 0) Promise.resolve(v - 1).then(countdown);
+  }
 
-Debug.setListener(null);
+  countdown(iterations);
+  f();
+})();
diff --git a/deps/v8/test/mjsunit/es8/constructor-returning-primitive.js b/deps/v8/test/mjsunit/es8/constructor-returning-primitive.js
deleted file mode 100644
index 1c0e7725be2431..00000000000000
--- a/deps/v8/test/mjsunit/es8/constructor-returning-primitive.js
+++ /dev/null
@@ -1,318 +0,0 @@
-// Copyright 2017 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-// Flags: --harmony-restrict-constructor-return
-
-assertThrows(
-  () => {
-    new class {
-      constructor() {
-        return 1;
-      }
-    }();
-  },
-  TypeError,
-  "Class constructors may only return object or undefined"
-);
-
-assertThrows(
-  () => {
-    new class {
-      constructor() {
-        return 2147483649;
-      }
-    }();
-  },
-  TypeError,
-  "Class constructors may only return object or undefined"
-);
-
-assertThrows(
-  () => {
-    new class {
-      constructor() {
-        return true;
-      }
-    }();
-  },
-  TypeError,
-  "Class constructors may only return object or undefined"
-);
-
-assertThrows(
-  () => {
-    new class {
-      constructor() {
-        return null;
-      }
-    }();
-  },
-  TypeError,
-  "Class constructors may only return object or undefined"
-);
-
-assertThrows(
-  () => {
-    new class {
-      constructor() {
-        return "wat";
-      }
-    }();
-  },
-  TypeError,
-  "Class constructors may only return object or undefined"
-);
-
-assertThrows(
-  () => {
-    new class {
-      constructor() {
-        return Symbol();
-      }
-    }();
-  },
-  TypeError,
-  "Class constructors may only return object or undefined"
-);
-
-assertThrows(
-  () => {
-    new class {
-      constructor() {
-        return 2.2;
-      }
-    }();
-  },
-  TypeError,
-  "Class constructors may only return object or undefined"
-);
-
-assertThrows(
-  () => {
-    new class extends Object {
-      constructor() {
-        return 1;
-      }
-    }();
-  },
-  TypeError,
-  "Class constructors may only return object or undefined"
-);
-
-assertThrows(
-  () => {
-    new class extends Object {
-      constructor() {
-        return 2147483649;
-      }
-    }();
-  },
-  TypeError,
-  "Class constructors may only return object or undefined"
-);
-
-assertThrows(
-  () => {
-    new class extends Object {
-      constructor() {
-        return true;
-      }
-    }();
-  },
-  TypeError,
-  "Class constructors may only return object or undefined"
-);
-
-assertThrows(
-  () => {
-    new class extends Object {
-      constructor() {
-        return null;
-      }
-    }();
-  },
-  TypeError,
-  "Class constructors may only return object or undefined"
-);
-
-assertThrows(
-  () => {
-    new class extends Object {
-      constructor() {
-        return "wat";
-      }
-    }();
-  },
-  TypeError,
-  "Class constructors may only return object or undefined"
-);
-
-assertThrows(
-  () => {
-    new class extends Object {
-      constructor() {
-        return Symbol();
-      }
-    }();
-  },
-  TypeError,
-  "Class constructors may only return object or undefined"
-);
-
-assertThrows(
-  () => {
-    new class extends Object {
-      constructor() {
-        return 2.2;
-      }
-    }();
-  },
-  TypeError,
-  "Class constructors may only return object or undefined"
-);
-
-assertThrows(
-  () => {
-    new class extends Object {
-      constructor() {}
-    }();
-  },
-  ReferenceError,
-  "Must call super constructor in derived class before accessing " +
-    "'this' or returning from derived constructor"
-);
-
-(function() {
-  let ret_val = { x: 1 };
-  let x = new class {
-    constructor() {
-      return ret_val;
-    }
-  }();
-  assertSame(ret_val, x);
-})();
-
-(function() {
-  class Foo {
-    constructor() {}
-  }
-  let x = new Foo();
-  assertTrue(x instanceof Foo);
-})();
-
-(function() {
-  class Foo {
-    constructor() {
-      return undefined;
-    }
-  }
-  let x = new Foo();
-  assertTrue(x instanceof Foo);
-})();
-
-(function() {
-  let ret_val = { x: 1 };
-  let x = new class extends Object {
-    constructor() {
-      return ret_val;
-    }
-  }();
-  assertSame(ret_val, x);
-})();
-
-(function() {
-  class Foo extends Object {
-    constructor() {
-      super();
-      return undefined;
-    }
-  }
-
-  let x = new Foo();
-  assertTrue(x instanceof Foo);
-})();
-
-(function() {
-  class Foo extends Object {
-    constructor() {
-      super();
-    }
-  }
-
-  let x = new Foo();
-  assertTrue(x instanceof Foo);
-})();
-
-(function() {
-  function foo() {
-    return 1;
-  }
-  let x = new foo();
-  assertTrue(x instanceof foo);
-})();
-
-(function() {
-  function foo() {
-    return 2147483649;
-  }
-  let x = new foo();
-  assertTrue(x instanceof foo);
-})();
-
-(function() {
-  function foo() {
-    return true;
-  }
-  let x = new foo();
-  assertTrue(x instanceof foo);
-})();
-
-(function() {
-  function foo() {
-    return undefined;
-  }
-  let x = new foo();
-  assertTrue(x instanceof foo);
-})();
-
-(function() {
-  function foo() {
-    return null;
-  }
-  let x = new foo();
-  assertTrue(x instanceof foo);
-})();
-
-(function() {
-  function foo() {
-    return "wat";
-  }
-  let x = new foo();
-  assertTrue(x instanceof foo);
-})();
-
-(function() {
-  function foo() {
-    return Symbol();
-  }
-  let x = new foo();
-  assertTrue(x instanceof foo);
-})();
-
-(function() {
-  function foo() {
-    return 2.2;
-  }
-  let x = new foo();
-  assertTrue(x instanceof foo);
-})();
-
-(function() {
-  var ret_val = { x: 1 };
-  function foo() {
-    return ret_val;
-  }
-  let x = new foo();
-  assertSame(x, ret_val);
-})();
diff --git a/deps/v8/test/mjsunit/fast-literal.js b/deps/v8/test/mjsunit/fast-literal.js
index 4fd92c4d3ad956..6ff8c9c6f2aafc 100644
--- a/deps/v8/test/mjsunit/fast-literal.js
+++ b/deps/v8/test/mjsunit/fast-literal.js
@@ -25,7 +25,7 @@
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
-// Flags: --allow-natives-syntax --no-inline-new --nouse-allocation-folding
+// Flags: --allow-natives-syntax --no-inline-new
 
 %SetAllocationTimeout(20, 0);
 function f() {
diff --git a/deps/v8/test/mjsunit/generated-transition-stub.js b/deps/v8/test/mjsunit/generated-transition-stub.js
index dadaa3c99e825a..e6d949bbaa79cd 100644
--- a/deps/v8/test/mjsunit/generated-transition-stub.js
+++ b/deps/v8/test/mjsunit/generated-transition-stub.js
@@ -1,36 +1,13 @@
 // Copyright 2013 the V8 project authors. All rights reserved.
-// Redistribution and use in source and binary forms, with or without
-// modification, are permitted provided that the following conditions are
-// met:
-//
-//     * Redistributions of source code must retain the above copyright
-//       notice, this list of conditions and the following disclaimer.
-//     * Redistributions in binary form must reproduce the above
-//       copyright notice, this list of conditions and the following
-//       disclaimer in the documentation and/or other materials provided
-//       with the distribution.
-//     * Neither the name of Google Inc. nor the names of its
-//       contributors may be used to endorse or promote products derived
-//       from this software without specific prior written permission.
-//
-// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
-// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
-// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
-// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
-// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
-// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
-// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
 
 // Flags: --allow-natives-syntax
 
 %NeverOptimizeFunction(test);
 function test() {
 
-  var iteration_count = 1;
+  const iteration_count = 1;
 
   function transition1(a, i, v) {
     a[i] = v;
@@ -40,14 +17,14 @@ function test() {
   // Test PACKED SMI -> PACKED DOUBLE
   //
 
-  var a1 = [0, 1, 2, 3, 4];
+  const a1 = [0, 1, 2, 3, 4];
   transition1(a1, 0, 2.5);
-  var a2 = [0, 1, 2, 3, 4];
+  const a2 = [0, 1, 2, 3, 4];
   transition1(a2, 0, 2.5);
   assertFalse(%HasHoleyElements(a2));
   %OptimizeFunctionOnNextCall(transition1);
 
-  var a3 = [0, 1, 2, 3, 4];
+  const a3 = [0, 1, 2, 3, 4];
   assertTrue(%HasSmiElements(a3));
   transition1(a3, 0, 2.5);
   assertFalse(%HasHoleyElements(a3));
@@ -55,7 +32,7 @@ function test() {
   assertEquals(2.5, a3[0]);
 
   // Test handling of hole.
-  var a4 = [0, 1, 2, 3, 4, 5, 6, 7, 8, 9];
+  const a4 = [0, 1, 2, 3, 4, 5, 6, 7, 8, 9];
   a4.length = 7;
   assertTrue(%HasSmiElements(a4));
   transition1(a4, 0, 2.5);
@@ -65,7 +42,7 @@ function test() {
 
   // Large array should deopt to runtimea
   for (j = 0; j < iteration_count; ++j) {
-    a5 = new Array();
+    const a5 = new Array();
     for (i = 0; i < 0x40000; ++i) {
       a5[i] = 0;
     }
@@ -82,14 +59,14 @@ function test() {
     a[i] = v;
   }
 
-  var b1 = [0, 1, 2, , 4];
+  const b1 = [0, 1, 2, , 4];
   transition2(b1, 0, 2.5);
-  var b2 = [0, 1, 2, , 4];
+  const b2 = [0, 1, 2, , 4];
   transition2(b2, 0, 2.5);
   assertTrue(%HasHoleyElements(b2));
   %OptimizeFunctionOnNextCall(transition2);
 
-  var b3 = [0, 1, 2, , 4];
+  const b3 = [0, 1, 2, , 4];
   assertTrue(%HasSmiElements(b3));
   assertTrue(%HasHoleyElements(b3));
   transition2(b3, 0, 2.5);
@@ -99,7 +76,7 @@ function test() {
 
   // Large array should deopt to runtime
   for (j = 0; j < iteration_count; ++j) {
-    b4 = [0, ,0];
+    const b4 = [0, ,0];
     for (i = 3; i < 0x40000; ++i) {
       b4[i] = 0;
     }
@@ -116,15 +93,15 @@ function test() {
     a[i] = v;
   }
 
-  var c1 = [0, 1, 2, 3.5, 4];
+  const c1 = [0, 1, 2, 3.5, 4];
   transition3(c1, 0, new Object());
-  var c2 = [0, 1, 2, 3.5, 4];
+  const c2 = [0, 1, 2, 3.5, 4];
   transition3(c2, 0, new Object());
   assertTrue(%HasObjectElements(c2));
   assertTrue(!%HasHoleyElements(c2));
   %OptimizeFunctionOnNextCall(transition3);
 
-  var c3 = [0, 1, 2, 3.5, 4];
+  const c3 = [0, 1, 2, 3.5, 4];
   assertTrue(%HasDoubleElements(c3));
   assertTrue(!%HasHoleyElements(c3));
   transition3(c3, 0, new Array());
@@ -136,7 +113,7 @@ function test() {
   // Large array under the deopt threshold should be able to trigger GC without
   // causing crashes.
   for (j = 0; j < iteration_count; ++j) {
-    c4 = [0, 2.5, 0];
+    const c4 = [0, 2.5, 0];
     for (i = 3; i < 0xa000; ++i) {
       c4[i] = 0;
     }
@@ -150,7 +127,7 @@ function test() {
 
   // Large array should deopt to runtime
   for (j = 0; j < iteration_count; ++j) {
-    c5 = [0, 2.5, 0];
+    const c5 = [0, 2.5, 0];
     for (i = 3; i < 0x40000; ++i) {
       c5[i] = 0;
     }
@@ -170,15 +147,15 @@ function test() {
       a[i] = v;
   }
 
-  var d1 = [0, 1, , 3.5, 4];
+  const d1 = [0, 1, , 3.5, 4];
   transition4(d1, 0, new Object());
-  var d2 = [0, 1, , 3.5, 4];
+  const d2 = [0, 1, , 3.5, 4];
   transition4(d2, 0, new Object());
   assertTrue(%HasObjectElements(d2));
   assertTrue(%HasHoleyElements(d2));
   %OptimizeFunctionOnNextCall(transition4);
 
-  var d3 = [0, 1, , 3.5, 4];
+  const d3 = [0, 1, , 3.5, 4];
   assertTrue(%HasDoubleElements(d3));
   assertTrue(%HasHoleyElements(d3));
   transition4(d3, 0, new Array());
@@ -190,7 +167,7 @@ function test() {
   // Large array under the deopt threshold should be able to trigger GC without
   // causing crashes.
   for (j = 0; j < iteration_count; ++j) {
-    d4 = [, 2.5, ,];
+    const d4 = [, 2.5, ,];
     for (i = 3; i < 0xa000; ++i) {
       d4[i] = 0;
     }
@@ -205,7 +182,7 @@ function test() {
 
   // Large array should deopt to runtime
   for (j = 0; j < iteration_count; ++j) {
-    d5 = [, 2.5, ,];
+    const d5 = [, 2.5, ,];
     for (i = 3; i < 0x40000; ++i) {
       d5[i] = 0;
     }
diff --git a/deps/v8/test/mjsunit/harmony/array-flat-species.js b/deps/v8/test/mjsunit/harmony/array-flat-species.js
new file mode 100644
index 00000000000000..d04f8a087566fa
--- /dev/null
+++ b/deps/v8/test/mjsunit/harmony/array-flat-species.js
@@ -0,0 +1,31 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --harmony-array-flat
+
+{
+  class MyArray extends Array {
+    static get [Symbol.species]() {
+      return Array;
+    }
+  }
+
+  const wannabe = new MyArray();
+  const flattened = wannabe.flat(Infinity);
+  assertEquals(false, flattened instanceof MyArray);
+  assertEquals(true, flattened instanceof Array);
+}
+
+{
+  class MyArray extends Array {
+    static get [Symbol.species]() {
+      return this;
+    }
+  }
+
+  const wannabe = new MyArray();
+  const flattened = wannabe.flat(Infinity);
+  assertEquals(true, flattened instanceof MyArray);
+  assertEquals(true, flattened instanceof Array);
+}
diff --git a/deps/v8/test/mjsunit/harmony/array-flat.js b/deps/v8/test/mjsunit/harmony/array-flat.js
new file mode 100644
index 00000000000000..86571e8dce3e95
--- /dev/null
+++ b/deps/v8/test/mjsunit/harmony/array-flat.js
@@ -0,0 +1,65 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --harmony-array-flat
+
+assertEquals(Array.prototype.flat.length, 0);
+assertEquals(Array.prototype.flat.name, 'flat');
+
+{
+  const input = [1, [2], [[3]]];
+
+  assertEquals(input.flat(),          [1, 2, [3]]);
+  assertEquals(input.flat(1),         [1, 2, [3]]);
+  assertEquals(input.flat(true),      [1, 2, [3]]);
+  assertEquals(input.flat(undefined), [1, 2, [3]]);
+
+  assertEquals(input.flat(-Infinity), [1, [2], [[3]]]);
+  assertEquals(input.flat(-1),        [1, [2], [[3]]]);
+  assertEquals(input.flat(-0),        [1, [2], [[3]]]);
+  assertEquals(input.flat(0),         [1, [2], [[3]]]);
+  assertEquals(input.flat(false),     [1, [2], [[3]]]);
+  assertEquals(input.flat(null),      [1, [2], [[3]]]);
+  assertEquals(input.flat(''),        [1, [2], [[3]]]);
+  assertEquals(input.flat('foo'),     [1, [2], [[3]]]);
+  assertEquals(input.flat(/./),       [1, [2], [[3]]]);
+  assertEquals(input.flat([]),        [1, [2], [[3]]]);
+  assertEquals(input.flat({}),        [1, [2], [[3]]]);
+  assertEquals(
+    input.flat(new Proxy({}, {})),    [1, [2], [[3]]]);
+  assertEquals(input.flat((x) => x),  [1, [2], [[3]]]);
+  assertEquals(
+    input.flat(String),               [1, [2], [[3]]]);
+
+  assertEquals(input.flat(2),         [1, 2, 3]);
+  assertEquals(input.flat(Infinity),  [1, 2, 3]);
+
+  assertThrows(() => { input.flat(Symbol()); }, TypeError);
+  assertThrows(() => { input.flat(Object.create(null)); }, TypeError);
+}
+
+{
+  const input = { 0: 'a', 1: 'b', 2: 'c', length: 'wat' };
+  assertEquals(Array.prototype.flat.call(input, Infinity), []);
+}
+
+{
+  let count = 0;
+  const input = {
+    get length() { ++count; return 0; }
+  };
+  const result = Array.prototype.flat.call(input, Infinity);
+  assertEquals(count, 1);
+}
+
+{
+  const descriptor = Object.getOwnPropertyDescriptor(
+    Array.prototype,
+    'flat'
+  );
+  assertEquals(descriptor.value, Array.prototype.flat);
+  assertEquals(descriptor.writable, true);
+  assertEquals(descriptor.enumerable, false);
+  assertEquals(descriptor.configurable, true);
+}
diff --git a/deps/v8/test/mjsunit/harmony/array-flatMap-species.js b/deps/v8/test/mjsunit/harmony/array-flatMap-species.js
new file mode 100644
index 00000000000000..d4159b480177cd
--- /dev/null
+++ b/deps/v8/test/mjsunit/harmony/array-flatMap-species.js
@@ -0,0 +1,31 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --harmony-array-flat
+
+{
+  class MyArray extends Array {
+    static get [Symbol.species]() {
+      return Array;
+    }
+  }
+
+  const wannabe = new MyArray();
+  const result = wannabe.flatMap(x => [x, x]);
+  assertEquals(false, result instanceof MyArray);
+  assertEquals(true, result instanceof Array);
+}
+
+{
+  class MyArray extends Array {
+    static get [Symbol.species]() {
+      return this;
+    }
+  }
+
+  const wannabe = new MyArray();
+  const result = wannabe.flatMap(x => [x, x]);
+  assertEquals(true, result instanceof MyArray);
+  assertEquals(true, result instanceof Array);
+}
diff --git a/deps/v8/test/mjsunit/harmony/array-flatMap.js b/deps/v8/test/mjsunit/harmony/array-flatMap.js
index d129c32e03c0d6..9f0426fe7fe244 100644
--- a/deps/v8/test/mjsunit/harmony/array-flatMap.js
+++ b/deps/v8/test/mjsunit/harmony/array-flatMap.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --harmony-array-flatten --allow-natives-syntax
+// Flags: --harmony-array-flat --allow-natives-syntax
 
 assertEquals(Array.prototype.flatMap.length, 1);
 assertEquals(Array.prototype.flatMap.name, 'flatMap');
@@ -16,78 +16,86 @@ assertEquals(
   [[1, 1], [2, 4], [3, 9], [4, 16]]
 );
 
-const elements = new Set([
-  -Infinity,
-  -1,
-  -0,
-  +0,
-  +1,
-  Infinity,
-  null,
-  undefined,
-  true,
-  false,
-  '',
-  'foo',
-  /./,
-  [],
-  {},
-  Object.create(null),
-  new Proxy({}, {}),
-  Symbol(),
-  x => x ** 2,
-  String
-]);
+{
+  const elements = new Set([
+    -Infinity,
+    -1,
+    -0,
+    +0,
+    +1,
+    Infinity,
+    null,
+    undefined,
+    true,
+    false,
+    '',
+    'foo',
+    /./,
+    [],
+    {},
+    Object.create(null),
+    new Proxy({}, {}),
+    Symbol(),
+    x => x ** 2,
+    String
+  ]);
 
-for (const value of elements) {
+  for (const value of elements) {
+    assertEquals(
+      [value].flatMap((element) => [element, element]),
+      [value, value]
+    );
+  }
+}
+
+{
+  const array = [42];
   assertEquals(
-    [value].flatMap((element) => [element, element]),
-    [value, value]
+    [array].flatMap((element) => [element, element]),
+    [array, array]
   );
 }
 
-const array = [42];
-assertEquals(
-  [array].flatMap((element) => [element, element]),
-  [array, array]
-);
-
-const nonCallables = new Set([
-  -Infinity,
-  -1,
-  -0,
-  +0,
-  +1,
-  Infinity,
-  null,
-  undefined,
-  true,
-  false,
-  '',
-  'foo',
-  /./,
-  [],
-  {},
-  Object.create(null),
-  new Proxy({}, {}),
-  Symbol(),
-]);
-for (const nonCallable of nonCallables) {
-  assertThrows(() => {
-    [].flatMap(nonCallable);
-  }, TypeError);
+{
+  const nonCallables = new Set([
+    -Infinity,
+    -1,
+    -0,
+    +0,
+    +1,
+    Infinity,
+    null,
+    undefined,
+    true,
+    false,
+    '',
+    'foo',
+    /./,
+    [],
+    {},
+    Object.create(null),
+    new Proxy({}, {}),
+    Symbol(),
+  ]);
+  for (const nonCallable of nonCallables) {
+    assertThrows(() => {
+      [].flatMap(nonCallable);
+    }, TypeError);
+  }
 }
 
-const object = {
-  foo: 42,
-  get length() {
-    object.foo = 0;
-  }
-};
-const result = [object].flatMap((element) => [element, element]);
-%HeapObjectVerify(result);
-assertEquals(result, [object, object]);
-assertEquals(result[0].foo, 42);
+{
+  const object = {
+    foo: 42,
+    get length() {
+      object.foo = 0;
+    }
+  };
+  const result = [object].flatMap((element) => [element, element]);
+  %HeapObjectVerify(result);
+  assertEquals(result, [object, object]);
+  assertEquals(result[0].foo, 42);
+}
 
 assertThrows(() => {
   Array.prototype.flatMap.call(null, (element) => element);
@@ -118,3 +126,37 @@ assertEquals(
   ),
   ['a', 'b']
 );
+
+{
+  const result = [1, 2, 3].flatMap(function() {
+    return [this];
+  }, 'abc');
+  assertEquals(true, result[0] == 'abc');
+  assertEquals(true, result[1] == 'abc');
+  assertEquals(true, result[2] == 'abc');
+}
+
+{
+  const input = { 0: 'a', 1: 'b', 2: 'c', length: 'wat' };
+  assertEquals(Array.prototype.flatMap.call(input, x => [x]), []);
+}
+
+{
+  let count = 0;
+  const input = {
+    get length() { ++count; return 0; }
+  };
+  const result = Array.prototype.flatMap.call(input, x => [x]);
+  assertEquals(count, 1);
+}
+
+{
+  const descriptor = Object.getOwnPropertyDescriptor(
+    Array.prototype,
+    'flatMap'
+  );
+  assertEquals(descriptor.value, Array.prototype.flatMap);
+  assertEquals(descriptor.writable, true);
+  assertEquals(descriptor.enumerable, false);
+  assertEquals(descriptor.configurable, true);
+}
diff --git a/deps/v8/test/mjsunit/harmony/array-flatten.js b/deps/v8/test/mjsunit/harmony/array-flatten.js
deleted file mode 100644
index 7ca6218ed89cd8..00000000000000
--- a/deps/v8/test/mjsunit/harmony/array-flatten.js
+++ /dev/null
@@ -1,38 +0,0 @@
-// Copyright 2018 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-// Flags: --harmony-array-flatten
-
-assertEquals(Array.prototype.flatten.length, 0);
-assertEquals(Array.prototype.flatten.name, 'flatten');
-
-const input = [1, [2], [[3]]];
-
-assertEquals(input.flatten(),          [1, 2, [3]]);
-assertEquals(input.flatten(1),         [1, 2, [3]]);
-assertEquals(input.flatten(true),      [1, 2, [3]]);
-assertEquals(input.flatten(undefined), [1, 2, [3]]);
-
-assertEquals(input.flatten(-Infinity), [1, [2], [[3]]]);
-assertEquals(input.flatten(-1),        [1, [2], [[3]]]);
-assertEquals(input.flatten(-0),        [1, [2], [[3]]]);
-assertEquals(input.flatten(0),         [1, [2], [[3]]]);
-assertEquals(input.flatten(false),     [1, [2], [[3]]]);
-assertEquals(input.flatten(null),      [1, [2], [[3]]]);
-assertEquals(input.flatten(''),        [1, [2], [[3]]]);
-assertEquals(input.flatten('foo'),     [1, [2], [[3]]]);
-assertEquals(input.flatten(/./),       [1, [2], [[3]]]);
-assertEquals(input.flatten([]),        [1, [2], [[3]]]);
-assertEquals(input.flatten({}),        [1, [2], [[3]]]);
-assertEquals(
-  input.flatten(new Proxy({}, {})),    [1, [2], [[3]]]);
-assertEquals(input.flatten((x) => x),  [1, [2], [[3]]]);
-assertEquals(
-  input.flatten(String),               [1, [2], [[3]]]);
-
-assertEquals(input.flatten(2),         [1, 2, 3]);
-assertEquals(input.flatten(Infinity),  [1, 2, 3]);
-
-assertThrows(() => { input.flatten(Symbol()); }, TypeError);
-assertThrows(() => { input.flatten(Object.create(null)); }, TypeError);
diff --git a/deps/v8/test/mjsunit/harmony/async-generators-basic.js b/deps/v8/test/mjsunit/harmony/async-generators-basic.js
index 12240e61149bc2..cf21d9a8c82548 100644
--- a/deps/v8/test/mjsunit/harmony/async-generators-basic.js
+++ b/deps/v8/test/mjsunit/harmony/async-generators-basic.js
@@ -103,12 +103,35 @@ function AbortUnreachable() {
 // ----------------------------------------------------------------------------
 // Do not install `AsyncGeneratorFunction` constructor on global object
 assertEquals(undefined, this.AsyncGeneratorFunction);
-let AsyncGeneratorFunction = (async function*() {}).constructor;
+
+// ----------------------------------------------------------------------------
+let AsyncGenerator = Object.getPrototypeOf(async function*() {});
+let AsyncGeneratorPrototype = AsyncGenerator.prototype;
+
+// %AsyncGenerator% and %AsyncGeneratorPrototype% are both ordinary objects
+assertEquals("object", typeof AsyncGenerator);
+assertEquals("object", typeof AsyncGeneratorPrototype);
+
+// %AsyncGenerator% <---> %AsyncGeneratorPrototype% circular reference
+assertEquals(AsyncGenerator, AsyncGeneratorPrototype.constructor);
+assertEquals(AsyncGeneratorPrototype, AsyncGenerator.prototype);
+
+let protoDesc = Object.getOwnPropertyDescriptor(AsyncGenerator, 'prototype');
+assertFalse(protoDesc.enumerable);
+assertFalse(protoDesc.writable);
+assertTrue(protoDesc.configurable);
+
+let ctorDesc =
+    Object.getOwnPropertyDescriptor(AsyncGeneratorPrototype, 'constructor');
+assertFalse(ctorDesc.enumerable);
+assertFalse(ctorDesc.writable);
+assertTrue(ctorDesc.configurable);
 
 // ----------------------------------------------------------------------------
 // The AsyncGeneratorFunction Constructor is the %AsyncGeneratorFunction%
 // intrinsic object and is a subclass of Function.
 // (proposal-async-iteration/#sec-asyncgeneratorfunction-constructor)
+let AsyncGeneratorFunction = AsyncGenerator.constructor;
 assertEquals(Object.getPrototypeOf(AsyncGeneratorFunction), Function);
 assertEquals(Object.getPrototypeOf(AsyncGeneratorFunction.prototype),
              Function.prototype);
diff --git a/deps/v8/test/mjsunit/harmony/bigint/basics.js b/deps/v8/test/mjsunit/harmony/bigint/basics.js
index 99a9403db0f33a..b6318d5324646e 100644
--- a/deps/v8/test/mjsunit/harmony/bigint/basics.js
+++ b/deps/v8/test/mjsunit/harmony/bigint/basics.js
@@ -56,6 +56,10 @@ const six = BigInt(6);
   assertSame(BigInt(42n), 42n);
   assertSame(BigInt(Object(42n)), 42n);
   assertSame(BigInt(2**53 - 1), 9007199254740991n);
+  assertSame(BigInt(2**53), 9007199254740992n);
+  assertSame(BigInt(2**1000), 2n ** 1000n);
+  assertSame(BigInt(3.0755851989071915e29), 307558519890719151276406341632n);
+  assertSame(BigInt(-1e50), -0x446c3b15f992680000000000000000000000000000n);
   assertSame(BigInt(Object(2**53 - 1)), 9007199254740991n);
   assertSame(BigInt([]), 0n);
 }{
@@ -64,8 +68,6 @@ const six = BigInt(6);
   assertThrows(() => BigInt(+Infinity), RangeError);
   assertThrows(() => BigInt(4.00000001), RangeError);
   assertThrows(() => BigInt(Object(4.00000001)), RangeError);
-  assertThrows(() => BigInt(2**53), RangeError);
-  assertThrows(() => BigInt(2**1000), RangeError);
 }
 
 // BigInt.prototype[Symbol.toStringTag]
diff --git a/deps/v8/test/mjsunit/harmony/bigint/comparisons.js b/deps/v8/test/mjsunit/harmony/bigint/comparisons.js
index 38150c74bfde78..73eb24d6875e69 100644
--- a/deps/v8/test/mjsunit/harmony/bigint/comparisons.js
+++ b/deps/v8/test/mjsunit/harmony/bigint/comparisons.js
@@ -429,8 +429,8 @@ const six = BigInt(6);
   assertFalse(%Equal("-0x1", minus_one));
 
   const unsafe = "9007199254740993";  // 2**53 + 1
-  assertTrue(%GreaterThan(eval(unsafe + "n"), unsafe));
-  assertTrue(%LessThan(unsafe, eval(unsafe + "n")));
+  assertFalse(%GreaterThan(eval(unsafe + "n"), unsafe));
+  assertFalse(%LessThan(unsafe, eval(unsafe + "n")));
 
   assertThrows(() => %LessThan(six, Symbol(6)), TypeError);
   assertThrows(() => %LessThan(Symbol(6), six), TypeError);
@@ -509,8 +509,8 @@ const six = BigInt(6);
 
   const unsafe = "9007199254740993";  // 2**53 + 1
   assertFalse(eval(unsafe + "n") < unsafe);
-  assertFalse(eval(unsafe + "n") <= unsafe);
-  assertTrue(unsafe < eval(unsafe + "n"));
+  assertTrue(eval(unsafe + "n") <= unsafe);
+  assertFalse(unsafe < eval(unsafe + "n"));
   assertTrue(unsafe <= eval(unsafe + "n"));
 
   assertThrows(() => six < Symbol(6), TypeError);
diff --git a/deps/v8/test/mjsunit/harmony/bigint/dataview.js b/deps/v8/test/mjsunit/harmony/bigint/dataview.js
index c34a42ac1dae57..5ead64990971f1 100644
--- a/deps/v8/test/mjsunit/harmony/bigint/dataview.js
+++ b/deps/v8/test/mjsunit/harmony/bigint/dataview.js
@@ -68,6 +68,16 @@ assertEquals(0x89, bytes[23]);
 assertEquals(b2, dataview.getBigInt64(8, true));
 assertEquals(0x89abcdef01234568n, dataview.getBigUint64(8, true));
 
+var b3 = -0x8000000000000000n; // The int64_t minimum value.
+dataview.setBigInt64(8, b3);
+assertEquals(b3, dataview.getBigInt64(8));
+assertEquals(-b3, dataview.getBigUint64(8));
+
+var b4 = 0x8000000000000000n;
+dataview.setBigInt64(8, b4);
+assertEquals(-b4, dataview.getBigInt64(8));
+assertEquals(b4, dataview.getBigUint64(8));
+
 assertThrows(() => dataview.setBigInt64(0, 1), TypeError);
 assertThrows(() => dataview.setBigUint64(0, 1), TypeError);
 assertThrows(() => dataview.setInt32(0, 1n), TypeError);
diff --git a/deps/v8/test/mjsunit/harmony/bigintarray-keyedstore-tobigint.js b/deps/v8/test/mjsunit/harmony/bigintarray-keyedstore-tobigint.js
new file mode 100644
index 00000000000000..29b44472c9b0b0
--- /dev/null
+++ b/deps/v8/test/mjsunit/harmony/bigintarray-keyedstore-tobigint.js
@@ -0,0 +1,64 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --harmony-bigint
+
+let TypedArrayConstructors = [
+  BigUint64Array,
+  BigInt64Array,
+];
+
+// Test KeyedStore in uninitialized and monomorphic states.
+for (let C of TypedArrayConstructors) {
+  let keyedSta = function(array) {
+    var didRun = false;
+    array[0] = {
+      valueOf() {
+        didRun = true;
+        return 42n;
+      }
+    };
+
+    return { didRun, array };
+  };
+
+  for (var i = 0; i < 3; ++i) {
+    var { didRun, array } = keyedSta(new C(1));
+    assertTrue(didRun);
+    assertEquals(array[0], 42n);
+
+    // OOB store
+    // FIXME: Throw a TypeError when storing OOB in a TypedArray.
+    var { didRun } = keyedSta(new C);
+    assertTrue(didRun);
+  }
+}
+
+// Test KeyedStore in polymorphic and megamorphic states.
+do {
+  let keyedSta = function(array) {
+    var didRun = false;
+    array[0] = {
+      valueOf() {
+        didRun = true;
+        return 42n;
+      }
+    };
+
+    return { didRun, array };
+  };
+
+  for (var i = 0; i < 3; ++i) {
+    for (var C of TypedArrayConstructors) {
+      var { didRun, array } = keyedSta(new C(1));
+      assertTrue(didRun);
+      assertEquals(array[0], 42n);
+
+      // OOB store
+      // FIXME: Throw a TypeError when storing OOB in a TypedArray.
+      var { didRun } = keyedSta(new C);
+      assertTrue(didRun);
+    }
+  }
+} while (false);
diff --git a/deps/v8/test/mjsunit/harmony/function-tostring.js b/deps/v8/test/mjsunit/harmony/function-tostring.js
index 8fccf0dacd1e24..4a7e93cd3bb7de 100644
--- a/deps/v8/test/mjsunit/harmony/function-tostring.js
+++ b/deps/v8/test/mjsunit/harmony/function-tostring.js
@@ -141,6 +141,30 @@ assertEquals("function () { [native code] }",
 assertEquals("function () { [native code] }",
              new Proxy({ method() { hidden } }.method, {}).toString());
 
+// Assert that we return a NativeFunction for script that has too large an
+// offset between function token position and start position for us to return
+// an exact representation of the source code.
+function testLongFunctionTokenOffset(functionType) {
+  var expected = "function f() { [native code] }";
+  // Spec requires that we return something that will cause eval to throws if we
+  // can't reproduce the function's source code.
+  assertThrows(() => eval(expected), SyntaxError);
+
+  var functionSource = functionType + " ".repeat(65535) + " f(){}";
+
+  // Function declaration
+  eval(functionSource);
+  assertEquals(expected, f.toString());
+
+  // Function expression
+  var f = eval("(" + functionSource + ")");
+  assertEquals(expected, f.toString());
+}
+testLongFunctionTokenOffset("function");
+testLongFunctionTokenOffset("function*");
+testLongFunctionTokenOffset("async function");
+testLongFunctionTokenOffset("async function*");
+
 // Non-callable proxies still throw.
 assertThrows(() => Function.prototype.toString.call(new Proxy({}, {})),
              TypeError);
diff --git a/deps/v8/test/mjsunit/harmony/modules-import-9.js b/deps/v8/test/mjsunit/harmony/modules-import-9.js
index b39c7a519c3536..6794311305c08e 100644
--- a/deps/v8/test/mjsunit/harmony/modules-import-9.js
+++ b/deps/v8/test/mjsunit/harmony/modules-import-9.js
@@ -8,7 +8,7 @@ var ran = false;
 
 async function test() {
   try {
-    let namespace = await import('modules-skip-5.js');
+    let namespace = await import('modules-skip-5.js').then(x => x);
     assertSame(namespace.static_life, namespace.dynamic_life);
     assertSame(namespace.relative_static_life, namespace.dynamic_life);
     ran = true;
diff --git a/deps/v8/test/mjsunit/harmony/optional-catch-binding-breaks.js b/deps/v8/test/mjsunit/harmony/optional-catch-binding-breaks.js
index 82be60cda1f8d9..7ba4ad03ab1a1c 100644
--- a/deps/v8/test/mjsunit/harmony/optional-catch-binding-breaks.js
+++ b/deps/v8/test/mjsunit/harmony/optional-catch-binding-breaks.js
@@ -2,8 +2,6 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --harmony-optional-catch-binding
-
 let state = 'initial';
 x: try {
   throw new Error('caught');
diff --git a/deps/v8/test/mjsunit/harmony/optional-catch-binding.js b/deps/v8/test/mjsunit/harmony/optional-catch-binding.js
index 093288c4e6542c..eaedc82a42e5f8 100644
--- a/deps/v8/test/mjsunit/harmony/optional-catch-binding.js
+++ b/deps/v8/test/mjsunit/harmony/optional-catch-binding.js
@@ -2,8 +2,6 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --harmony-optional-catch-binding
-
 let state = 'initial';
 try {
   throw new Error('caught');
diff --git a/deps/v8/test/mjsunit/harmony/promise-prototype-finally.js b/deps/v8/test/mjsunit/harmony/promise-prototype-finally.js
index 4e91f2e6d1d6f0..3051c91d2b3b9f 100644
--- a/deps/v8/test/mjsunit/harmony/promise-prototype-finally.js
+++ b/deps/v8/test/mjsunit/harmony/promise-prototype-finally.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --harmony-promise-finally --allow-natives-syntax
+// Flags: --allow-natives-syntax
 
 assertThrows(() => Promise.prototype.finally.call(5), TypeError);
 
diff --git a/deps/v8/test/mjsunit/harmony/public-instance-class-fields.js b/deps/v8/test/mjsunit/harmony/public-instance-class-fields.js
index a82a0ac9190288..56c7e201aa9889 100644
--- a/deps/v8/test/mjsunit/harmony/public-instance-class-fields.js
+++ b/deps/v8/test/mjsunit/harmony/public-instance-class-fields.js
@@ -507,7 +507,7 @@ x()();
   }
 
   assertThrows(() => new C1, ReferenceError);
-  assertEquals([1,1], log);
+  assertEquals([1], log);
 
   log = [];
   class C2 extends class {} {
@@ -520,7 +520,7 @@ x()();
   }
 
   assertThrows(() => new C2, ReferenceError);
-  assertEquals([1,1], log);
+  assertEquals([1], log);
 }
 
 {
@@ -696,3 +696,21 @@ x()();
   let x = new X;
   assertEquals(1, x.p);
 }
+
+{
+  let thisInInitializer, thisInConstructor, thisFromArrowFn, arrowFn;
+  let C = class extends class {} {
+    field = (thisInInitializer = this, thisFromArrowFn = arrowFn());
+    constructor() {
+      arrowFn = () => this;
+      super();
+      thisInConstructor = this;
+    }
+  };
+
+  let c = new C();
+
+  assertSame(thisInInitializer, c);
+  assertSame(thisFromArrowFn, c);
+  assertSame(thisInConstructor, c);
+}
diff --git a/deps/v8/test/mjsunit/harmony/regexp-named-captures.js b/deps/v8/test/mjsunit/harmony/regexp-named-captures.js
index aab8393392767b..e1fa60dca42737 100644
--- a/deps/v8/test/mjsunit/harmony/regexp-named-captures.js
+++ b/deps/v8/test/mjsunit/harmony/regexp-named-captures.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --harmony-regexp-named-captures --allow-natives-syntax
+// Flags: --allow-natives-syntax
 
 // Malformed named captures.
 assertThrows("/(?<>a)/u", SyntaxError);  // Empty name.
diff --git a/deps/v8/test/mjsunit/harmony/regexp-property-binary.js b/deps/v8/test/mjsunit/harmony/regexp-property-binary.js
index d0c4dc577bca98..793e6ac5408c94 100644
--- a/deps/v8/test/mjsunit/harmony/regexp-property-binary.js
+++ b/deps/v8/test/mjsunit/harmony/regexp-property-binary.js
@@ -2,8 +2,6 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --harmony-regexp-property
-
 function t(re, s) { assertTrue(re.test(s)); }
 function f(re, s) { assertFalse(re.test(s)); }
 
diff --git a/deps/v8/test/mjsunit/harmony/regexp-property-char-class.js b/deps/v8/test/mjsunit/harmony/regexp-property-char-class.js
index 1de8acb5f2a1d1..7a64a9eb761e6c 100644
--- a/deps/v8/test/mjsunit/harmony/regexp-property-char-class.js
+++ b/deps/v8/test/mjsunit/harmony/regexp-property-char-class.js
@@ -2,8 +2,6 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --harmony-regexp-property
-
 assertThrows("/[\\p]/u");
 assertThrows("/[\\p{garbage}]/u");
 assertThrows("/[\\p{}]/u");
diff --git a/deps/v8/test/mjsunit/harmony/regexp-property-disabled.js b/deps/v8/test/mjsunit/harmony/regexp-property-disabled.js
deleted file mode 100644
index f471ef4d9d7838..00000000000000
--- a/deps/v8/test/mjsunit/harmony/regexp-property-disabled.js
+++ /dev/null
@@ -1,18 +0,0 @@
-// Copyright 2016 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-// Flags: --no-harmony-regexp-property
-
-function test(source, message) {
-  try {
-    eval(source);
-  } catch (e) {
-    assertEquals(message, e.message);
-    return;
-  }
-  assertUnreachable();
-}
-
-test("/\\pL/u", "Invalid regular expression: /\\pL/: Invalid escape");
-test("/[\\p{L}]/u", "Invalid regular expression: /[\\p{L}]/: Invalid escape");
diff --git a/deps/v8/test/mjsunit/harmony/regexp-property-enumerated.js b/deps/v8/test/mjsunit/harmony/regexp-property-enumerated.js
index e1db74c890cf8f..c58d2ae99741ba 100644
--- a/deps/v8/test/mjsunit/harmony/regexp-property-enumerated.js
+++ b/deps/v8/test/mjsunit/harmony/regexp-property-enumerated.js
@@ -2,8 +2,6 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --harmony-regexp-property
-
 assertThrows("/\\p{Bidi_Class=L}+/u");
 assertThrows("/\\p{bc=Left_To_Right}+/u");
 assertThrows("/\\p{bc=AL}+/u");
diff --git a/deps/v8/test/mjsunit/harmony/regexp-property-exact-match.js b/deps/v8/test/mjsunit/harmony/regexp-property-exact-match.js
index 09d129eab2212b..d192f46c922bdd 100644
--- a/deps/v8/test/mjsunit/harmony/regexp-property-exact-match.js
+++ b/deps/v8/test/mjsunit/harmony/regexp-property-exact-match.js
@@ -2,8 +2,6 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --harmony-regexp-property
-
 assertThrows("/\\p{In CJK}/u");
 assertThrows("/\\p{InCJKUnifiedIdeographs}/u");
 assertThrows("/\\p{InCJK}/u");
diff --git a/deps/v8/test/mjsunit/harmony/regexp-property-general-category.js b/deps/v8/test/mjsunit/harmony/regexp-property-general-category.js
index 3d514b03fec1d9..fe39441d714e54 100644
--- a/deps/v8/test/mjsunit/harmony/regexp-property-general-category.js
+++ b/deps/v8/test/mjsunit/harmony/regexp-property-general-category.js
@@ -2,8 +2,6 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --harmony-regexp-property
-
 assertThrows("/\\p/u");
 assertThrows("/\\p{garbage}/u");
 assertThrows("/\\p{}/u");
diff --git a/deps/v8/test/mjsunit/harmony/regexp-property-invalid.js b/deps/v8/test/mjsunit/harmony/regexp-property-invalid.js
index 56c27ba500e709..83c7b2e2091817 100644
--- a/deps/v8/test/mjsunit/harmony/regexp-property-invalid.js
+++ b/deps/v8/test/mjsunit/harmony/regexp-property-invalid.js
@@ -2,8 +2,6 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --harmony-regexp-property
-
 assertThrows("/\p{Block=ASCII}+/u");
 assertThrows("/\p{Block=ASCII}+/u");
 assertThrows("/\p{Block=Basic_Latin}+/u");
diff --git a/deps/v8/test/mjsunit/harmony/regexp-property-lu-ui0.js b/deps/v8/test/mjsunit/harmony/regexp-property-lu-ui0.js
index 27911e7d6f678b..45aeb3f317197f 100644
--- a/deps/v8/test/mjsunit/harmony/regexp-property-lu-ui0.js
+++ b/deps/v8/test/mjsunit/harmony/regexp-property-lu-ui0.js
@@ -2,7 +2,6 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --harmony-regexp-property
 // Files: test/mjsunit/harmony/regexp-property-lu-ui.js
 
 testCodePointRange(0);
diff --git a/deps/v8/test/mjsunit/harmony/regexp-property-lu-ui1.js b/deps/v8/test/mjsunit/harmony/regexp-property-lu-ui1.js
index e0177b835f8474..2cfad37eaa9e62 100644
--- a/deps/v8/test/mjsunit/harmony/regexp-property-lu-ui1.js
+++ b/deps/v8/test/mjsunit/harmony/regexp-property-lu-ui1.js
@@ -2,7 +2,6 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --harmony-regexp-property
 // Files: test/mjsunit/harmony/regexp-property-lu-ui.js
 
 testCodePointRange(1);
diff --git a/deps/v8/test/mjsunit/harmony/regexp-property-lu-ui2.js b/deps/v8/test/mjsunit/harmony/regexp-property-lu-ui2.js
index 7a916b019367db..2d2457540d1c35 100644
--- a/deps/v8/test/mjsunit/harmony/regexp-property-lu-ui2.js
+++ b/deps/v8/test/mjsunit/harmony/regexp-property-lu-ui2.js
@@ -2,7 +2,6 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --harmony-regexp-property
 // Files: test/mjsunit/harmony/regexp-property-lu-ui.js
 
 testCodePointRange(2);
diff --git a/deps/v8/test/mjsunit/harmony/regexp-property-lu-ui3.js b/deps/v8/test/mjsunit/harmony/regexp-property-lu-ui3.js
index 51cf5224a1081c..788ab7dd856004 100644
--- a/deps/v8/test/mjsunit/harmony/regexp-property-lu-ui3.js
+++ b/deps/v8/test/mjsunit/harmony/regexp-property-lu-ui3.js
@@ -2,7 +2,6 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --harmony-regexp-property
 // Files: test/mjsunit/harmony/regexp-property-lu-ui.js
 
 testCodePointRange(3);
diff --git a/deps/v8/test/mjsunit/harmony/regexp-property-lu-ui4.js b/deps/v8/test/mjsunit/harmony/regexp-property-lu-ui4.js
index ab22e7f33da89b..0d5f5d7e1588d9 100644
--- a/deps/v8/test/mjsunit/harmony/regexp-property-lu-ui4.js
+++ b/deps/v8/test/mjsunit/harmony/regexp-property-lu-ui4.js
@@ -2,7 +2,6 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --harmony-regexp-property
 // Files: test/mjsunit/harmony/regexp-property-lu-ui.js
 
 testCodePointRange(4);
diff --git a/deps/v8/test/mjsunit/harmony/regexp-property-lu-ui5.js b/deps/v8/test/mjsunit/harmony/regexp-property-lu-ui5.js
index 668ddbf8f95c56..3d8bb814fb2dd6 100644
--- a/deps/v8/test/mjsunit/harmony/regexp-property-lu-ui5.js
+++ b/deps/v8/test/mjsunit/harmony/regexp-property-lu-ui5.js
@@ -2,7 +2,6 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --harmony-regexp-property
 // Files: test/mjsunit/harmony/regexp-property-lu-ui.js
 
 testCodePointRange(5);
diff --git a/deps/v8/test/mjsunit/harmony/regexp-property-lu-ui6.js b/deps/v8/test/mjsunit/harmony/regexp-property-lu-ui6.js
index 51669e1afa2959..267c3759d14145 100644
--- a/deps/v8/test/mjsunit/harmony/regexp-property-lu-ui6.js
+++ b/deps/v8/test/mjsunit/harmony/regexp-property-lu-ui6.js
@@ -2,7 +2,6 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --harmony-regexp-property
 // Files: test/mjsunit/harmony/regexp-property-lu-ui.js
 
 testCodePointRange(6);
diff --git a/deps/v8/test/mjsunit/harmony/regexp-property-lu-ui7.js b/deps/v8/test/mjsunit/harmony/regexp-property-lu-ui7.js
index 68f3e0f66e17c3..463d1cd75fdf3f 100644
--- a/deps/v8/test/mjsunit/harmony/regexp-property-lu-ui7.js
+++ b/deps/v8/test/mjsunit/harmony/regexp-property-lu-ui7.js
@@ -2,7 +2,6 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --harmony-regexp-property
 // Files: test/mjsunit/harmony/regexp-property-lu-ui.js
 
 testCodePointRange(7);
diff --git a/deps/v8/test/mjsunit/harmony/regexp-property-lu-ui8.js b/deps/v8/test/mjsunit/harmony/regexp-property-lu-ui8.js
index b38abe2d2307c3..f4bba8d1b9ce62 100644
--- a/deps/v8/test/mjsunit/harmony/regexp-property-lu-ui8.js
+++ b/deps/v8/test/mjsunit/harmony/regexp-property-lu-ui8.js
@@ -2,7 +2,6 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --harmony-regexp-property
 // Files: test/mjsunit/harmony/regexp-property-lu-ui.js
 
 testCodePointRange(8);
diff --git a/deps/v8/test/mjsunit/harmony/regexp-property-lu-ui9.js b/deps/v8/test/mjsunit/harmony/regexp-property-lu-ui9.js
index 5c9ca06e16b801..7eb4b318bb6456 100644
--- a/deps/v8/test/mjsunit/harmony/regexp-property-lu-ui9.js
+++ b/deps/v8/test/mjsunit/harmony/regexp-property-lu-ui9.js
@@ -2,7 +2,6 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --harmony-regexp-property
 // Files: test/mjsunit/harmony/regexp-property-lu-ui.js
 
 testCodePointRange(9);
diff --git a/deps/v8/test/mjsunit/harmony/regexp-property-script-extensions.js b/deps/v8/test/mjsunit/harmony/regexp-property-script-extensions.js
index e208c99abbcc9e..db7d3a88744ee7 100644
--- a/deps/v8/test/mjsunit/harmony/regexp-property-script-extensions.js
+++ b/deps/v8/test/mjsunit/harmony/regexp-property-script-extensions.js
@@ -2,8 +2,6 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --harmony-regexp-property
-
 function t(re, s) { assertTrue(re.test(s)); }
 function f(re, s) { assertFalse(re.test(s)); }
 
@@ -25,7 +23,7 @@ t(/\p{Script_Extensions=Cypriot}+/u, "\u{10107}");
 f(/\p{Script=Cypriot}+/u, "\u{10107}");
 f(/\p{scx=Cprt}+/u, "\u3003");
 
-/* Auto-generated from unicode data file using following script
+/* Auto-generated from Unicode data file using following script
 let data = read("ScriptExtensions.txt");
 let map = new Map();
 for (let line of data.split("\n")) {
@@ -45,10 +43,6 @@ for (let line of data.split("\n")) {
 for (let s of map.keys()){
   let codepoints = map.get(s);
   print(`// Script_Extension=${s}`);
-  for (let c of codepoints.values()) {
-    print(`t(/\\p{scx=${s}}/u, "\\u{${c.toString(16)}}");`);
-    print(`f(/\\P{scx=${s}}/u, "\\u{${c.toString(16)}}");`);
-  }
   for (let i = 0; i < 5;) {
     let c = (Math.random() * 0x110000) | 0;
     if (codepoints.has(c)) continue;
@@ -58,2764 +52,360 @@ for (let s of map.keys()){
 }
 */
 
-// Unicode version 9.0.0
+// Unicode version 10.0.0
+// https://unicode.org/Public/10.0.0/ucd/ScriptExtensions.txt
+
+// Script_Extension=Beng
+f(/(?=\P{sc=Beng})\p{scx=Beng}/u, "\u{52ddd}");
+f(/(?=\P{sc=Beng})\p{scx=Beng}/u, "\u{10b77b}");
+f(/(?=\P{sc=Beng})\p{scx=Beng}/u, "\u{74b3}");
+f(/(?=\P{sc=Beng})\p{scx=Beng}/u, "\u{b8edf}");
+f(/(?=\P{sc=Beng})\p{scx=Beng}/u, "\u{7eebe}");
 // Script_Extension=Deva
-t(/\p{scx=Deva}/u, "\u{1cd1}");
-f(/\P{scx=Deva}/u, "\u{1cd1}");
-t(/\p{scx=Deva}/u, "\u{1cd4}");
-f(/\P{scx=Deva}/u, "\u{1cd4}");
-t(/\p{scx=Deva}/u, "\u{1cd5}");
-f(/\P{scx=Deva}/u, "\u{1cd5}");
-t(/\p{scx=Deva}/u, "\u{1cd6}");
-f(/\P{scx=Deva}/u, "\u{1cd6}");
-t(/\p{scx=Deva}/u, "\u{1cd8}");
-f(/\P{scx=Deva}/u, "\u{1cd8}");
-t(/\p{scx=Deva}/u, "\u{1cdb}");
-f(/\P{scx=Deva}/u, "\u{1cdb}");
-t(/\p{scx=Deva}/u, "\u{1cde}");
-f(/\P{scx=Deva}/u, "\u{1cde}");
-t(/\p{scx=Deva}/u, "\u{1cdf}");
-f(/\P{scx=Deva}/u, "\u{1cdf}");
-t(/\p{scx=Deva}/u, "\u{1ce1}");
-f(/\P{scx=Deva}/u, "\u{1ce1}");
-t(/\p{scx=Deva}/u, "\u{1ce2}");
-f(/\P{scx=Deva}/u, "\u{1ce2}");
-t(/\p{scx=Deva}/u, "\u{1ce3}");
-f(/\P{scx=Deva}/u, "\u{1ce3}");
-t(/\p{scx=Deva}/u, "\u{1ce4}");
-f(/\P{scx=Deva}/u, "\u{1ce4}");
-t(/\p{scx=Deva}/u, "\u{1ce5}");
-f(/\P{scx=Deva}/u, "\u{1ce5}");
-t(/\p{scx=Deva}/u, "\u{1ce6}");
-f(/\P{scx=Deva}/u, "\u{1ce6}");
-t(/\p{scx=Deva}/u, "\u{1ce7}");
-f(/\P{scx=Deva}/u, "\u{1ce7}");
-t(/\p{scx=Deva}/u, "\u{1ce8}");
-f(/\P{scx=Deva}/u, "\u{1ce8}");
-t(/\p{scx=Deva}/u, "\u{1ce9}");
-f(/\P{scx=Deva}/u, "\u{1ce9}");
-t(/\p{scx=Deva}/u, "\u{1cea}");
-f(/\P{scx=Deva}/u, "\u{1cea}");
-t(/\p{scx=Deva}/u, "\u{1ceb}");
-f(/\P{scx=Deva}/u, "\u{1ceb}");
-t(/\p{scx=Deva}/u, "\u{1cec}");
-f(/\P{scx=Deva}/u, "\u{1cec}");
-t(/\p{scx=Deva}/u, "\u{1ced}");
-f(/\P{scx=Deva}/u, "\u{1ced}");
-t(/\p{scx=Deva}/u, "\u{1cee}");
-f(/\P{scx=Deva}/u, "\u{1cee}");
-t(/\p{scx=Deva}/u, "\u{1cef}");
-f(/\P{scx=Deva}/u, "\u{1cef}");
-t(/\p{scx=Deva}/u, "\u{1cf0}");
-f(/\P{scx=Deva}/u, "\u{1cf0}");
-t(/\p{scx=Deva}/u, "\u{1cf1}");
-f(/\P{scx=Deva}/u, "\u{1cf1}");
-t(/\p{scx=Deva}/u, "\u{1cf6}");
-f(/\P{scx=Deva}/u, "\u{1cf6}");
-t(/\p{scx=Deva}/u, "\u{a8f1}");
-f(/\P{scx=Deva}/u, "\u{a8f1}");
-t(/\p{scx=Deva}/u, "\u{1cd0}");
-f(/\P{scx=Deva}/u, "\u{1cd0}");
-t(/\p{scx=Deva}/u, "\u{1cd2}");
-f(/\P{scx=Deva}/u, "\u{1cd2}");
-t(/\p{scx=Deva}/u, "\u{1cd3}");
-f(/\P{scx=Deva}/u, "\u{1cd3}");
-t(/\p{scx=Deva}/u, "\u{1cf2}");
-f(/\P{scx=Deva}/u, "\u{1cf2}");
-t(/\p{scx=Deva}/u, "\u{1cf3}");
-f(/\P{scx=Deva}/u, "\u{1cf3}");
-t(/\p{scx=Deva}/u, "\u{1cf4}");
-f(/\P{scx=Deva}/u, "\u{1cf4}");
-t(/\p{scx=Deva}/u, "\u{1cf8}");
-f(/\P{scx=Deva}/u, "\u{1cf8}");
-t(/\p{scx=Deva}/u, "\u{1cf9}");
-f(/\P{scx=Deva}/u, "\u{1cf9}");
-t(/\p{scx=Deva}/u, "\u{1cf5}");
-f(/\P{scx=Deva}/u, "\u{1cf5}");
-t(/\p{scx=Deva}/u, "\u{1cd7}");
-f(/\P{scx=Deva}/u, "\u{1cd7}");
-t(/\p{scx=Deva}/u, "\u{1cd9}");
-f(/\P{scx=Deva}/u, "\u{1cd9}");
-t(/\p{scx=Deva}/u, "\u{1cdc}");
-f(/\P{scx=Deva}/u, "\u{1cdc}");
-t(/\p{scx=Deva}/u, "\u{1cdd}");
-f(/\P{scx=Deva}/u, "\u{1cdd}");
-t(/\p{scx=Deva}/u, "\u{1ce0}");
-f(/\P{scx=Deva}/u, "\u{1ce0}");
-t(/\p{scx=Deva}/u, "\u{a8f3}");
-f(/\P{scx=Deva}/u, "\u{a8f3}");
-t(/\p{scx=Deva}/u, "\u{20f0}");
-f(/\P{scx=Deva}/u, "\u{20f0}");
-t(/\p{scx=Deva}/u, "\u{966}");
-f(/\P{scx=Deva}/u, "\u{966}");
-t(/\p{scx=Deva}/u, "\u{967}");
-f(/\P{scx=Deva}/u, "\u{967}");
-t(/\p{scx=Deva}/u, "\u{968}");
-f(/\P{scx=Deva}/u, "\u{968}");
-t(/\p{scx=Deva}/u, "\u{969}");
-f(/\P{scx=Deva}/u, "\u{969}");
-t(/\p{scx=Deva}/u, "\u{96a}");
-f(/\P{scx=Deva}/u, "\u{96a}");
-t(/\p{scx=Deva}/u, "\u{96b}");
-f(/\P{scx=Deva}/u, "\u{96b}");
-t(/\p{scx=Deva}/u, "\u{96c}");
-f(/\P{scx=Deva}/u, "\u{96c}");
-t(/\p{scx=Deva}/u, "\u{96d}");
-f(/\P{scx=Deva}/u, "\u{96d}");
-t(/\p{scx=Deva}/u, "\u{96e}");
-f(/\P{scx=Deva}/u, "\u{96e}");
-t(/\p{scx=Deva}/u, "\u{96f}");
-f(/\P{scx=Deva}/u, "\u{96f}");
-t(/\p{scx=Deva}/u, "\u{1cda}");
-f(/\P{scx=Deva}/u, "\u{1cda}");
-t(/\p{scx=Deva}/u, "\u{a836}");
-f(/\P{scx=Deva}/u, "\u{a836}");
-t(/\p{scx=Deva}/u, "\u{a837}");
-f(/\P{scx=Deva}/u, "\u{a837}");
-t(/\p{scx=Deva}/u, "\u{a838}");
-f(/\P{scx=Deva}/u, "\u{a838}");
-t(/\p{scx=Deva}/u, "\u{a839}");
-f(/\P{scx=Deva}/u, "\u{a839}");
-t(/\p{scx=Deva}/u, "\u{a830}");
-f(/\P{scx=Deva}/u, "\u{a830}");
-t(/\p{scx=Deva}/u, "\u{a831}");
-f(/\P{scx=Deva}/u, "\u{a831}");
-t(/\p{scx=Deva}/u, "\u{a832}");
-f(/\P{scx=Deva}/u, "\u{a832}");
-t(/\p{scx=Deva}/u, "\u{a833}");
-f(/\P{scx=Deva}/u, "\u{a833}");
-t(/\p{scx=Deva}/u, "\u{a834}");
-f(/\P{scx=Deva}/u, "\u{a834}");
-t(/\p{scx=Deva}/u, "\u{a835}");
-f(/\P{scx=Deva}/u, "\u{a835}");
-t(/\p{scx=Deva}/u, "\u{952}");
-f(/\P{scx=Deva}/u, "\u{952}");
-t(/\p{scx=Deva}/u, "\u{951}");
-f(/\P{scx=Deva}/u, "\u{951}");
-t(/\p{scx=Deva}/u, "\u{964}");
-f(/\P{scx=Deva}/u, "\u{964}");
-t(/\p{scx=Deva}/u, "\u{965}");
-f(/\P{scx=Deva}/u, "\u{965}");
-f(/(?=\P{sc=Deva})\p{scx=Deva}/u, "\u{ce0}");
-f(/(?=\P{sc=Deva})\p{scx=Deva}/u, "\u{98eb0}");
-f(/(?=\P{sc=Deva})\p{scx=Deva}/u, "\u{1b381}");
-f(/(?=\P{sc=Deva})\p{scx=Deva}/u, "\u{558ed}");
-f(/(?=\P{sc=Deva})\p{scx=Deva}/u, "\u{36998}");
+f(/(?=\P{sc=Deva})\p{scx=Deva}/u, "\u{51c7e}");
+f(/(?=\P{sc=Deva})\p{scx=Deva}/u, "\u{bd4e8}");
+f(/(?=\P{sc=Deva})\p{scx=Deva}/u, "\u{a376f}");
+f(/(?=\P{sc=Deva})\p{scx=Deva}/u, "\u{d26}");
+f(/(?=\P{sc=Deva})\p{scx=Deva}/u, "\u{301f2}");
 // Script_Extension=Dupl
-t(/\p{scx=Dupl}/u, "\u{1bca0}");
-f(/\P{scx=Dupl}/u, "\u{1bca0}");
-t(/\p{scx=Dupl}/u, "\u{1bca1}");
-f(/\P{scx=Dupl}/u, "\u{1bca1}");
-t(/\p{scx=Dupl}/u, "\u{1bca2}");
-f(/\P{scx=Dupl}/u, "\u{1bca2}");
-t(/\p{scx=Dupl}/u, "\u{1bca3}");
-f(/\P{scx=Dupl}/u, "\u{1bca3}");
-f(/(?=\P{sc=Dupl})\p{scx=Dupl}/u, "\u{42ba7}");
-f(/(?=\P{sc=Dupl})\p{scx=Dupl}/u, "\u{fa669}");
-f(/(?=\P{sc=Dupl})\p{scx=Dupl}/u, "\u{8a725}");
-f(/(?=\P{sc=Dupl})\p{scx=Dupl}/u, "\u{4d069}");
-f(/(?=\P{sc=Dupl})\p{scx=Dupl}/u, "\u{b3c09}");
+f(/(?=\P{sc=Dupl})\p{scx=Dupl}/u, "\u{d0910}");
+f(/(?=\P{sc=Dupl})\p{scx=Dupl}/u, "\u{4262c}");
+f(/(?=\P{sc=Dupl})\p{scx=Dupl}/u, "\u{fc99b}");
+f(/(?=\P{sc=Dupl})\p{scx=Dupl}/u, "\u{b4a3c}");
+f(/(?=\P{sc=Dupl})\p{scx=Dupl}/u, "\u{27c19}");
 // Script_Extension=Grek
-t(/\p{scx=Grek}/u, "\u{342}");
-f(/\P{scx=Grek}/u, "\u{342}");
-t(/\p{scx=Grek}/u, "\u{345}");
-f(/\P{scx=Grek}/u, "\u{345}");
-t(/\p{scx=Grek}/u, "\u{1dc0}");
-f(/\P{scx=Grek}/u, "\u{1dc0}");
-t(/\p{scx=Grek}/u, "\u{1dc1}");
-f(/\P{scx=Grek}/u, "\u{1dc1}");
-f(/(?=\P{sc=Grek})\p{scx=Grek}/u, "\u{dd38b}");
-f(/(?=\P{sc=Grek})\p{scx=Grek}/u, "\u{121bd}");
-f(/(?=\P{sc=Grek})\p{scx=Grek}/u, "\u{f8499}");
-f(/(?=\P{sc=Grek})\p{scx=Grek}/u, "\u{29b57}");
-f(/(?=\P{sc=Grek})\p{scx=Grek}/u, "\u{6e536}");
+f(/(?=\P{sc=Grek})\p{scx=Grek}/u, "\u{331fb}");
+f(/(?=\P{sc=Grek})\p{scx=Grek}/u, "\u{49feb}");
+f(/(?=\P{sc=Grek})\p{scx=Grek}/u, "\u{9b52c}");
+f(/(?=\P{sc=Grek})\p{scx=Grek}/u, "\u{466fb}");
+f(/(?=\P{sc=Grek})\p{scx=Grek}/u, "\u{ed86b}");
 // Script_Extension=Hani
-t(/\p{scx=Hani}/u, "\u{3006}");
-f(/\P{scx=Hani}/u, "\u{3006}");
-t(/\p{scx=Hani}/u, "\u{303e}");
-f(/\P{scx=Hani}/u, "\u{303e}");
-t(/\p{scx=Hani}/u, "\u{303f}");
-f(/\P{scx=Hani}/u, "\u{303f}");
-t(/\p{scx=Hani}/u, "\u{3190}");
-f(/\P{scx=Hani}/u, "\u{3190}");
-t(/\p{scx=Hani}/u, "\u{3191}");
-f(/\P{scx=Hani}/u, "\u{3191}");
-t(/\p{scx=Hani}/u, "\u{3192}");
-f(/\P{scx=Hani}/u, "\u{3192}");
-t(/\p{scx=Hani}/u, "\u{3193}");
-f(/\P{scx=Hani}/u, "\u{3193}");
-t(/\p{scx=Hani}/u, "\u{3194}");
-f(/\P{scx=Hani}/u, "\u{3194}");
-t(/\p{scx=Hani}/u, "\u{3195}");
-f(/\P{scx=Hani}/u, "\u{3195}");
-t(/\p{scx=Hani}/u, "\u{3196}");
-f(/\P{scx=Hani}/u, "\u{3196}");
-t(/\p{scx=Hani}/u, "\u{3197}");
-f(/\P{scx=Hani}/u, "\u{3197}");
-t(/\p{scx=Hani}/u, "\u{3198}");
-f(/\P{scx=Hani}/u, "\u{3198}");
-t(/\p{scx=Hani}/u, "\u{3199}");
-f(/\P{scx=Hani}/u, "\u{3199}");
-t(/\p{scx=Hani}/u, "\u{319a}");
-f(/\P{scx=Hani}/u, "\u{319a}");
-t(/\p{scx=Hani}/u, "\u{319b}");
-f(/\P{scx=Hani}/u, "\u{319b}");
-t(/\p{scx=Hani}/u, "\u{319c}");
-f(/\P{scx=Hani}/u, "\u{319c}");
-t(/\p{scx=Hani}/u, "\u{319d}");
-f(/\P{scx=Hani}/u, "\u{319d}");
-t(/\p{scx=Hani}/u, "\u{319e}");
-f(/\P{scx=Hani}/u, "\u{319e}");
-t(/\p{scx=Hani}/u, "\u{319f}");
-f(/\P{scx=Hani}/u, "\u{319f}");
-t(/\p{scx=Hani}/u, "\u{31c0}");
-f(/\P{scx=Hani}/u, "\u{31c0}");
-t(/\p{scx=Hani}/u, "\u{31c1}");
-f(/\P{scx=Hani}/u, "\u{31c1}");
-t(/\p{scx=Hani}/u, "\u{31c2}");
-f(/\P{scx=Hani}/u, "\u{31c2}");
-t(/\p{scx=Hani}/u, "\u{31c3}");
-f(/\P{scx=Hani}/u, "\u{31c3}");
-t(/\p{scx=Hani}/u, "\u{31c4}");
-f(/\P{scx=Hani}/u, "\u{31c4}");
-t(/\p{scx=Hani}/u, "\u{31c5}");
-f(/\P{scx=Hani}/u, "\u{31c5}");
-t(/\p{scx=Hani}/u, "\u{31c6}");
-f(/\P{scx=Hani}/u, "\u{31c6}");
-t(/\p{scx=Hani}/u, "\u{31c7}");
-f(/\P{scx=Hani}/u, "\u{31c7}");
-t(/\p{scx=Hani}/u, "\u{31c8}");
-f(/\P{scx=Hani}/u, "\u{31c8}");
-t(/\p{scx=Hani}/u, "\u{31c9}");
-f(/\P{scx=Hani}/u, "\u{31c9}");
-t(/\p{scx=Hani}/u, "\u{31ca}");
-f(/\P{scx=Hani}/u, "\u{31ca}");
-t(/\p{scx=Hani}/u, "\u{31cb}");
-f(/\P{scx=Hani}/u, "\u{31cb}");
-t(/\p{scx=Hani}/u, "\u{31cc}");
-f(/\P{scx=Hani}/u, "\u{31cc}");
-t(/\p{scx=Hani}/u, "\u{31cd}");
-f(/\P{scx=Hani}/u, "\u{31cd}");
-t(/\p{scx=Hani}/u, "\u{31ce}");
-f(/\P{scx=Hani}/u, "\u{31ce}");
-t(/\p{scx=Hani}/u, "\u{31cf}");
-f(/\P{scx=Hani}/u, "\u{31cf}");
-t(/\p{scx=Hani}/u, "\u{31d0}");
-f(/\P{scx=Hani}/u, "\u{31d0}");
-t(/\p{scx=Hani}/u, "\u{31d1}");
-f(/\P{scx=Hani}/u, "\u{31d1}");
-t(/\p{scx=Hani}/u, "\u{31d2}");
-f(/\P{scx=Hani}/u, "\u{31d2}");
-t(/\p{scx=Hani}/u, "\u{31d3}");
-f(/\P{scx=Hani}/u, "\u{31d3}");
-t(/\p{scx=Hani}/u, "\u{31d4}");
-f(/\P{scx=Hani}/u, "\u{31d4}");
-t(/\p{scx=Hani}/u, "\u{31d5}");
-f(/\P{scx=Hani}/u, "\u{31d5}");
-t(/\p{scx=Hani}/u, "\u{31d6}");
-f(/\P{scx=Hani}/u, "\u{31d6}");
-t(/\p{scx=Hani}/u, "\u{31d7}");
-f(/\P{scx=Hani}/u, "\u{31d7}");
-t(/\p{scx=Hani}/u, "\u{31d8}");
-f(/\P{scx=Hani}/u, "\u{31d8}");
-t(/\p{scx=Hani}/u, "\u{31d9}");
-f(/\P{scx=Hani}/u, "\u{31d9}");
-t(/\p{scx=Hani}/u, "\u{31da}");
-f(/\P{scx=Hani}/u, "\u{31da}");
-t(/\p{scx=Hani}/u, "\u{31db}");
-f(/\P{scx=Hani}/u, "\u{31db}");
-t(/\p{scx=Hani}/u, "\u{31dc}");
-f(/\P{scx=Hani}/u, "\u{31dc}");
-t(/\p{scx=Hani}/u, "\u{31dd}");
-f(/\P{scx=Hani}/u, "\u{31dd}");
-t(/\p{scx=Hani}/u, "\u{31de}");
-f(/\P{scx=Hani}/u, "\u{31de}");
-t(/\p{scx=Hani}/u, "\u{31df}");
-f(/\P{scx=Hani}/u, "\u{31df}");
-t(/\p{scx=Hani}/u, "\u{31e0}");
-f(/\P{scx=Hani}/u, "\u{31e0}");
-t(/\p{scx=Hani}/u, "\u{31e1}");
-f(/\P{scx=Hani}/u, "\u{31e1}");
-t(/\p{scx=Hani}/u, "\u{31e2}");
-f(/\P{scx=Hani}/u, "\u{31e2}");
-t(/\p{scx=Hani}/u, "\u{31e3}");
-f(/\P{scx=Hani}/u, "\u{31e3}");
-t(/\p{scx=Hani}/u, "\u{3220}");
-f(/\P{scx=Hani}/u, "\u{3220}");
-t(/\p{scx=Hani}/u, "\u{3221}");
-f(/\P{scx=Hani}/u, "\u{3221}");
-t(/\p{scx=Hani}/u, "\u{3222}");
-f(/\P{scx=Hani}/u, "\u{3222}");
-t(/\p{scx=Hani}/u, "\u{3223}");
-f(/\P{scx=Hani}/u, "\u{3223}");
-t(/\p{scx=Hani}/u, "\u{3224}");
-f(/\P{scx=Hani}/u, "\u{3224}");
-t(/\p{scx=Hani}/u, "\u{3225}");
-f(/\P{scx=Hani}/u, "\u{3225}");
-t(/\p{scx=Hani}/u, "\u{3226}");
-f(/\P{scx=Hani}/u, "\u{3226}");
-t(/\p{scx=Hani}/u, "\u{3227}");
-f(/\P{scx=Hani}/u, "\u{3227}");
-t(/\p{scx=Hani}/u, "\u{3228}");
-f(/\P{scx=Hani}/u, "\u{3228}");
-t(/\p{scx=Hani}/u, "\u{3229}");
-f(/\P{scx=Hani}/u, "\u{3229}");
-t(/\p{scx=Hani}/u, "\u{322a}");
-f(/\P{scx=Hani}/u, "\u{322a}");
-t(/\p{scx=Hani}/u, "\u{322b}");
-f(/\P{scx=Hani}/u, "\u{322b}");
-t(/\p{scx=Hani}/u, "\u{322c}");
-f(/\P{scx=Hani}/u, "\u{322c}");
-t(/\p{scx=Hani}/u, "\u{322d}");
-f(/\P{scx=Hani}/u, "\u{322d}");
-t(/\p{scx=Hani}/u, "\u{322e}");
-f(/\P{scx=Hani}/u, "\u{322e}");
-t(/\p{scx=Hani}/u, "\u{322f}");
-f(/\P{scx=Hani}/u, "\u{322f}");
-t(/\p{scx=Hani}/u, "\u{3230}");
-f(/\P{scx=Hani}/u, "\u{3230}");
-t(/\p{scx=Hani}/u, "\u{3231}");
-f(/\P{scx=Hani}/u, "\u{3231}");
-t(/\p{scx=Hani}/u, "\u{3232}");
-f(/\P{scx=Hani}/u, "\u{3232}");
-t(/\p{scx=Hani}/u, "\u{3233}");
-f(/\P{scx=Hani}/u, "\u{3233}");
-t(/\p{scx=Hani}/u, "\u{3234}");
-f(/\P{scx=Hani}/u, "\u{3234}");
-t(/\p{scx=Hani}/u, "\u{3235}");
-f(/\P{scx=Hani}/u, "\u{3235}");
-t(/\p{scx=Hani}/u, "\u{3236}");
-f(/\P{scx=Hani}/u, "\u{3236}");
-t(/\p{scx=Hani}/u, "\u{3237}");
-f(/\P{scx=Hani}/u, "\u{3237}");
-t(/\p{scx=Hani}/u, "\u{3238}");
-f(/\P{scx=Hani}/u, "\u{3238}");
-t(/\p{scx=Hani}/u, "\u{3239}");
-f(/\P{scx=Hani}/u, "\u{3239}");
-t(/\p{scx=Hani}/u, "\u{323a}");
-f(/\P{scx=Hani}/u, "\u{323a}");
-t(/\p{scx=Hani}/u, "\u{323b}");
-f(/\P{scx=Hani}/u, "\u{323b}");
-t(/\p{scx=Hani}/u, "\u{323c}");
-f(/\P{scx=Hani}/u, "\u{323c}");
-t(/\p{scx=Hani}/u, "\u{323d}");
-f(/\P{scx=Hani}/u, "\u{323d}");
-t(/\p{scx=Hani}/u, "\u{323e}");
-f(/\P{scx=Hani}/u, "\u{323e}");
-t(/\p{scx=Hani}/u, "\u{323f}");
-f(/\P{scx=Hani}/u, "\u{323f}");
-t(/\p{scx=Hani}/u, "\u{3240}");
-f(/\P{scx=Hani}/u, "\u{3240}");
-t(/\p{scx=Hani}/u, "\u{3241}");
-f(/\P{scx=Hani}/u, "\u{3241}");
-t(/\p{scx=Hani}/u, "\u{3242}");
-f(/\P{scx=Hani}/u, "\u{3242}");
-t(/\p{scx=Hani}/u, "\u{3243}");
-f(/\P{scx=Hani}/u, "\u{3243}");
-t(/\p{scx=Hani}/u, "\u{3244}");
-f(/\P{scx=Hani}/u, "\u{3244}");
-t(/\p{scx=Hani}/u, "\u{3245}");
-f(/\P{scx=Hani}/u, "\u{3245}");
-t(/\p{scx=Hani}/u, "\u{3246}");
-f(/\P{scx=Hani}/u, "\u{3246}");
-t(/\p{scx=Hani}/u, "\u{3247}");
-f(/\P{scx=Hani}/u, "\u{3247}");
-t(/\p{scx=Hani}/u, "\u{3280}");
-f(/\P{scx=Hani}/u, "\u{3280}");
-t(/\p{scx=Hani}/u, "\u{3281}");
-f(/\P{scx=Hani}/u, "\u{3281}");
-t(/\p{scx=Hani}/u, "\u{3282}");
-f(/\P{scx=Hani}/u, "\u{3282}");
-t(/\p{scx=Hani}/u, "\u{3283}");
-f(/\P{scx=Hani}/u, "\u{3283}");
-t(/\p{scx=Hani}/u, "\u{3284}");
-f(/\P{scx=Hani}/u, "\u{3284}");
-t(/\p{scx=Hani}/u, "\u{3285}");
-f(/\P{scx=Hani}/u, "\u{3285}");
-t(/\p{scx=Hani}/u, "\u{3286}");
-f(/\P{scx=Hani}/u, "\u{3286}");
-t(/\p{scx=Hani}/u, "\u{3287}");
-f(/\P{scx=Hani}/u, "\u{3287}");
-t(/\p{scx=Hani}/u, "\u{3288}");
-f(/\P{scx=Hani}/u, "\u{3288}");
-t(/\p{scx=Hani}/u, "\u{3289}");
-f(/\P{scx=Hani}/u, "\u{3289}");
-t(/\p{scx=Hani}/u, "\u{328a}");
-f(/\P{scx=Hani}/u, "\u{328a}");
-t(/\p{scx=Hani}/u, "\u{328b}");
-f(/\P{scx=Hani}/u, "\u{328b}");
-t(/\p{scx=Hani}/u, "\u{328c}");
-f(/\P{scx=Hani}/u, "\u{328c}");
-t(/\p{scx=Hani}/u, "\u{328d}");
-f(/\P{scx=Hani}/u, "\u{328d}");
-t(/\p{scx=Hani}/u, "\u{328e}");
-f(/\P{scx=Hani}/u, "\u{328e}");
-t(/\p{scx=Hani}/u, "\u{328f}");
-f(/\P{scx=Hani}/u, "\u{328f}");
-t(/\p{scx=Hani}/u, "\u{3290}");
-f(/\P{scx=Hani}/u, "\u{3290}");
-t(/\p{scx=Hani}/u, "\u{3291}");
-f(/\P{scx=Hani}/u, "\u{3291}");
-t(/\p{scx=Hani}/u, "\u{3292}");
-f(/\P{scx=Hani}/u, "\u{3292}");
-t(/\p{scx=Hani}/u, "\u{3293}");
-f(/\P{scx=Hani}/u, "\u{3293}");
-t(/\p{scx=Hani}/u, "\u{3294}");
-f(/\P{scx=Hani}/u, "\u{3294}");
-t(/\p{scx=Hani}/u, "\u{3295}");
-f(/\P{scx=Hani}/u, "\u{3295}");
-t(/\p{scx=Hani}/u, "\u{3296}");
-f(/\P{scx=Hani}/u, "\u{3296}");
-t(/\p{scx=Hani}/u, "\u{3297}");
-f(/\P{scx=Hani}/u, "\u{3297}");
-t(/\p{scx=Hani}/u, "\u{3298}");
-f(/\P{scx=Hani}/u, "\u{3298}");
-t(/\p{scx=Hani}/u, "\u{3299}");
-f(/\P{scx=Hani}/u, "\u{3299}");
-t(/\p{scx=Hani}/u, "\u{329a}");
-f(/\P{scx=Hani}/u, "\u{329a}");
-t(/\p{scx=Hani}/u, "\u{329b}");
-f(/\P{scx=Hani}/u, "\u{329b}");
-t(/\p{scx=Hani}/u, "\u{329c}");
-f(/\P{scx=Hani}/u, "\u{329c}");
-t(/\p{scx=Hani}/u, "\u{329d}");
-f(/\P{scx=Hani}/u, "\u{329d}");
-t(/\p{scx=Hani}/u, "\u{329e}");
-f(/\P{scx=Hani}/u, "\u{329e}");
-t(/\p{scx=Hani}/u, "\u{329f}");
-f(/\P{scx=Hani}/u, "\u{329f}");
-t(/\p{scx=Hani}/u, "\u{32a0}");
-f(/\P{scx=Hani}/u, "\u{32a0}");
-t(/\p{scx=Hani}/u, "\u{32a1}");
-f(/\P{scx=Hani}/u, "\u{32a1}");
-t(/\p{scx=Hani}/u, "\u{32a2}");
-f(/\P{scx=Hani}/u, "\u{32a2}");
-t(/\p{scx=Hani}/u, "\u{32a3}");
-f(/\P{scx=Hani}/u, "\u{32a3}");
-t(/\p{scx=Hani}/u, "\u{32a4}");
-f(/\P{scx=Hani}/u, "\u{32a4}");
-t(/\p{scx=Hani}/u, "\u{32a5}");
-f(/\P{scx=Hani}/u, "\u{32a5}");
-t(/\p{scx=Hani}/u, "\u{32a6}");
-f(/\P{scx=Hani}/u, "\u{32a6}");
-t(/\p{scx=Hani}/u, "\u{32a7}");
-f(/\P{scx=Hani}/u, "\u{32a7}");
-t(/\p{scx=Hani}/u, "\u{32a8}");
-f(/\P{scx=Hani}/u, "\u{32a8}");
-t(/\p{scx=Hani}/u, "\u{32a9}");
-f(/\P{scx=Hani}/u, "\u{32a9}");
-t(/\p{scx=Hani}/u, "\u{32aa}");
-f(/\P{scx=Hani}/u, "\u{32aa}");
-t(/\p{scx=Hani}/u, "\u{32ab}");
-f(/\P{scx=Hani}/u, "\u{32ab}");
-t(/\p{scx=Hani}/u, "\u{32ac}");
-f(/\P{scx=Hani}/u, "\u{32ac}");
-t(/\p{scx=Hani}/u, "\u{32ad}");
-f(/\P{scx=Hani}/u, "\u{32ad}");
-t(/\p{scx=Hani}/u, "\u{32ae}");
-f(/\P{scx=Hani}/u, "\u{32ae}");
-t(/\p{scx=Hani}/u, "\u{32af}");
-f(/\P{scx=Hani}/u, "\u{32af}");
-t(/\p{scx=Hani}/u, "\u{32b0}");
-f(/\P{scx=Hani}/u, "\u{32b0}");
-t(/\p{scx=Hani}/u, "\u{32c0}");
-f(/\P{scx=Hani}/u, "\u{32c0}");
-t(/\p{scx=Hani}/u, "\u{32c1}");
-f(/\P{scx=Hani}/u, "\u{32c1}");
-t(/\p{scx=Hani}/u, "\u{32c2}");
-f(/\P{scx=Hani}/u, "\u{32c2}");
-t(/\p{scx=Hani}/u, "\u{32c3}");
-f(/\P{scx=Hani}/u, "\u{32c3}");
-t(/\p{scx=Hani}/u, "\u{32c4}");
-f(/\P{scx=Hani}/u, "\u{32c4}");
-t(/\p{scx=Hani}/u, "\u{32c5}");
-f(/\P{scx=Hani}/u, "\u{32c5}");
-t(/\p{scx=Hani}/u, "\u{32c6}");
-f(/\P{scx=Hani}/u, "\u{32c6}");
-t(/\p{scx=Hani}/u, "\u{32c7}");
-f(/\P{scx=Hani}/u, "\u{32c7}");
-t(/\p{scx=Hani}/u, "\u{32c8}");
-f(/\P{scx=Hani}/u, "\u{32c8}");
-t(/\p{scx=Hani}/u, "\u{32c9}");
-f(/\P{scx=Hani}/u, "\u{32c9}");
-t(/\p{scx=Hani}/u, "\u{32ca}");
-f(/\P{scx=Hani}/u, "\u{32ca}");
-t(/\p{scx=Hani}/u, "\u{32cb}");
-f(/\P{scx=Hani}/u, "\u{32cb}");
-t(/\p{scx=Hani}/u, "\u{3358}");
-f(/\P{scx=Hani}/u, "\u{3358}");
-t(/\p{scx=Hani}/u, "\u{3359}");
-f(/\P{scx=Hani}/u, "\u{3359}");
-t(/\p{scx=Hani}/u, "\u{335a}");
-f(/\P{scx=Hani}/u, "\u{335a}");
-t(/\p{scx=Hani}/u, "\u{335b}");
-f(/\P{scx=Hani}/u, "\u{335b}");
-t(/\p{scx=Hani}/u, "\u{335c}");
-f(/\P{scx=Hani}/u, "\u{335c}");
-t(/\p{scx=Hani}/u, "\u{335d}");
-f(/\P{scx=Hani}/u, "\u{335d}");
-t(/\p{scx=Hani}/u, "\u{335e}");
-f(/\P{scx=Hani}/u, "\u{335e}");
-t(/\p{scx=Hani}/u, "\u{335f}");
-f(/\P{scx=Hani}/u, "\u{335f}");
-t(/\p{scx=Hani}/u, "\u{3360}");
-f(/\P{scx=Hani}/u, "\u{3360}");
-t(/\p{scx=Hani}/u, "\u{3361}");
-f(/\P{scx=Hani}/u, "\u{3361}");
-t(/\p{scx=Hani}/u, "\u{3362}");
-f(/\P{scx=Hani}/u, "\u{3362}");
-t(/\p{scx=Hani}/u, "\u{3363}");
-f(/\P{scx=Hani}/u, "\u{3363}");
-t(/\p{scx=Hani}/u, "\u{3364}");
-f(/\P{scx=Hani}/u, "\u{3364}");
-t(/\p{scx=Hani}/u, "\u{3365}");
-f(/\P{scx=Hani}/u, "\u{3365}");
-t(/\p{scx=Hani}/u, "\u{3366}");
-f(/\P{scx=Hani}/u, "\u{3366}");
-t(/\p{scx=Hani}/u, "\u{3367}");
-f(/\P{scx=Hani}/u, "\u{3367}");
-t(/\p{scx=Hani}/u, "\u{3368}");
-f(/\P{scx=Hani}/u, "\u{3368}");
-t(/\p{scx=Hani}/u, "\u{3369}");
-f(/\P{scx=Hani}/u, "\u{3369}");
-t(/\p{scx=Hani}/u, "\u{336a}");
-f(/\P{scx=Hani}/u, "\u{336a}");
-t(/\p{scx=Hani}/u, "\u{336b}");
-f(/\P{scx=Hani}/u, "\u{336b}");
-t(/\p{scx=Hani}/u, "\u{336c}");
-f(/\P{scx=Hani}/u, "\u{336c}");
-t(/\p{scx=Hani}/u, "\u{336d}");
-f(/\P{scx=Hani}/u, "\u{336d}");
-t(/\p{scx=Hani}/u, "\u{336e}");
-f(/\P{scx=Hani}/u, "\u{336e}");
-t(/\p{scx=Hani}/u, "\u{336f}");
-f(/\P{scx=Hani}/u, "\u{336f}");
-t(/\p{scx=Hani}/u, "\u{3370}");
-f(/\P{scx=Hani}/u, "\u{3370}");
-t(/\p{scx=Hani}/u, "\u{337b}");
-f(/\P{scx=Hani}/u, "\u{337b}");
-t(/\p{scx=Hani}/u, "\u{337c}");
-f(/\P{scx=Hani}/u, "\u{337c}");
-t(/\p{scx=Hani}/u, "\u{337d}");
-f(/\P{scx=Hani}/u, "\u{337d}");
-t(/\p{scx=Hani}/u, "\u{337e}");
-f(/\P{scx=Hani}/u, "\u{337e}");
-t(/\p{scx=Hani}/u, "\u{337f}");
-f(/\P{scx=Hani}/u, "\u{337f}");
-t(/\p{scx=Hani}/u, "\u{33e0}");
-f(/\P{scx=Hani}/u, "\u{33e0}");
-t(/\p{scx=Hani}/u, "\u{33e1}");
-f(/\P{scx=Hani}/u, "\u{33e1}");
-t(/\p{scx=Hani}/u, "\u{33e2}");
-f(/\P{scx=Hani}/u, "\u{33e2}");
-t(/\p{scx=Hani}/u, "\u{33e3}");
-f(/\P{scx=Hani}/u, "\u{33e3}");
-t(/\p{scx=Hani}/u, "\u{33e4}");
-f(/\P{scx=Hani}/u, "\u{33e4}");
-t(/\p{scx=Hani}/u, "\u{33e5}");
-f(/\P{scx=Hani}/u, "\u{33e5}");
-t(/\p{scx=Hani}/u, "\u{33e6}");
-f(/\P{scx=Hani}/u, "\u{33e6}");
-t(/\p{scx=Hani}/u, "\u{33e7}");
-f(/\P{scx=Hani}/u, "\u{33e7}");
-t(/\p{scx=Hani}/u, "\u{33e8}");
-f(/\P{scx=Hani}/u, "\u{33e8}");
-t(/\p{scx=Hani}/u, "\u{33e9}");
-f(/\P{scx=Hani}/u, "\u{33e9}");
-t(/\p{scx=Hani}/u, "\u{33ea}");
-f(/\P{scx=Hani}/u, "\u{33ea}");
-t(/\p{scx=Hani}/u, "\u{33eb}");
-f(/\P{scx=Hani}/u, "\u{33eb}");
-t(/\p{scx=Hani}/u, "\u{33ec}");
-f(/\P{scx=Hani}/u, "\u{33ec}");
-t(/\p{scx=Hani}/u, "\u{33ed}");
-f(/\P{scx=Hani}/u, "\u{33ed}");
-t(/\p{scx=Hani}/u, "\u{33ee}");
-f(/\P{scx=Hani}/u, "\u{33ee}");
-t(/\p{scx=Hani}/u, "\u{33ef}");
-f(/\P{scx=Hani}/u, "\u{33ef}");
-t(/\p{scx=Hani}/u, "\u{33f0}");
-f(/\P{scx=Hani}/u, "\u{33f0}");
-t(/\p{scx=Hani}/u, "\u{33f1}");
-f(/\P{scx=Hani}/u, "\u{33f1}");
-t(/\p{scx=Hani}/u, "\u{33f2}");
-f(/\P{scx=Hani}/u, "\u{33f2}");
-t(/\p{scx=Hani}/u, "\u{33f3}");
-f(/\P{scx=Hani}/u, "\u{33f3}");
-t(/\p{scx=Hani}/u, "\u{33f4}");
-f(/\P{scx=Hani}/u, "\u{33f4}");
-t(/\p{scx=Hani}/u, "\u{33f5}");
-f(/\P{scx=Hani}/u, "\u{33f5}");
-t(/\p{scx=Hani}/u, "\u{33f6}");
-f(/\P{scx=Hani}/u, "\u{33f6}");
-t(/\p{scx=Hani}/u, "\u{33f7}");
-f(/\P{scx=Hani}/u, "\u{33f7}");
-t(/\p{scx=Hani}/u, "\u{33f8}");
-f(/\P{scx=Hani}/u, "\u{33f8}");
-t(/\p{scx=Hani}/u, "\u{33f9}");
-f(/\P{scx=Hani}/u, "\u{33f9}");
-t(/\p{scx=Hani}/u, "\u{33fa}");
-f(/\P{scx=Hani}/u, "\u{33fa}");
-t(/\p{scx=Hani}/u, "\u{33fb}");
-f(/\P{scx=Hani}/u, "\u{33fb}");
-t(/\p{scx=Hani}/u, "\u{33fc}");
-f(/\P{scx=Hani}/u, "\u{33fc}");
-t(/\p{scx=Hani}/u, "\u{33fd}");
-f(/\P{scx=Hani}/u, "\u{33fd}");
-t(/\p{scx=Hani}/u, "\u{33fe}");
-f(/\P{scx=Hani}/u, "\u{33fe}");
-t(/\p{scx=Hani}/u, "\u{1d360}");
-f(/\P{scx=Hani}/u, "\u{1d360}");
-t(/\p{scx=Hani}/u, "\u{1d361}");
-f(/\P{scx=Hani}/u, "\u{1d361}");
-t(/\p{scx=Hani}/u, "\u{1d362}");
-f(/\P{scx=Hani}/u, "\u{1d362}");
-t(/\p{scx=Hani}/u, "\u{1d363}");
-f(/\P{scx=Hani}/u, "\u{1d363}");
-t(/\p{scx=Hani}/u, "\u{1d364}");
-f(/\P{scx=Hani}/u, "\u{1d364}");
-t(/\p{scx=Hani}/u, "\u{1d365}");
-f(/\P{scx=Hani}/u, "\u{1d365}");
-t(/\p{scx=Hani}/u, "\u{1d366}");
-f(/\P{scx=Hani}/u, "\u{1d366}");
-t(/\p{scx=Hani}/u, "\u{1d367}");
-f(/\P{scx=Hani}/u, "\u{1d367}");
-t(/\p{scx=Hani}/u, "\u{1d368}");
-f(/\P{scx=Hani}/u, "\u{1d368}");
-t(/\p{scx=Hani}/u, "\u{1d369}");
-f(/\P{scx=Hani}/u, "\u{1d369}");
-t(/\p{scx=Hani}/u, "\u{1d36a}");
-f(/\P{scx=Hani}/u, "\u{1d36a}");
-t(/\p{scx=Hani}/u, "\u{1d36b}");
-f(/\P{scx=Hani}/u, "\u{1d36b}");
-t(/\p{scx=Hani}/u, "\u{1d36c}");
-f(/\P{scx=Hani}/u, "\u{1d36c}");
-t(/\p{scx=Hani}/u, "\u{1d36d}");
-f(/\P{scx=Hani}/u, "\u{1d36d}");
-t(/\p{scx=Hani}/u, "\u{1d36e}");
-f(/\P{scx=Hani}/u, "\u{1d36e}");
-t(/\p{scx=Hani}/u, "\u{1d36f}");
-f(/\P{scx=Hani}/u, "\u{1d36f}");
-t(/\p{scx=Hani}/u, "\u{1d370}");
-f(/\P{scx=Hani}/u, "\u{1d370}");
-t(/\p{scx=Hani}/u, "\u{1d371}");
-f(/\P{scx=Hani}/u, "\u{1d371}");
-t(/\p{scx=Hani}/u, "\u{1f250}");
-f(/\P{scx=Hani}/u, "\u{1f250}");
-t(/\p{scx=Hani}/u, "\u{1f251}");
-f(/\P{scx=Hani}/u, "\u{1f251}");
-t(/\p{scx=Hani}/u, "\u{302a}");
-f(/\P{scx=Hani}/u, "\u{302a}");
-t(/\p{scx=Hani}/u, "\u{302b}");
-f(/\P{scx=Hani}/u, "\u{302b}");
-t(/\p{scx=Hani}/u, "\u{302c}");
-f(/\P{scx=Hani}/u, "\u{302c}");
-t(/\p{scx=Hani}/u, "\u{302d}");
-f(/\P{scx=Hani}/u, "\u{302d}");
-t(/\p{scx=Hani}/u, "\u{303c}");
-f(/\P{scx=Hani}/u, "\u{303c}");
-t(/\p{scx=Hani}/u, "\u{303d}");
-f(/\P{scx=Hani}/u, "\u{303d}");
-t(/\p{scx=Hani}/u, "\u{3003}");
-f(/\P{scx=Hani}/u, "\u{3003}");
-t(/\p{scx=Hani}/u, "\u{3013}");
-f(/\P{scx=Hani}/u, "\u{3013}");
-t(/\p{scx=Hani}/u, "\u{301c}");
-f(/\P{scx=Hani}/u, "\u{301c}");
-t(/\p{scx=Hani}/u, "\u{301d}");
-f(/\P{scx=Hani}/u, "\u{301d}");
-t(/\p{scx=Hani}/u, "\u{301e}");
-f(/\P{scx=Hani}/u, "\u{301e}");
-t(/\p{scx=Hani}/u, "\u{301f}");
-f(/\P{scx=Hani}/u, "\u{301f}");
-t(/\p{scx=Hani}/u, "\u{3030}");
-f(/\P{scx=Hani}/u, "\u{3030}");
-t(/\p{scx=Hani}/u, "\u{3037}");
-f(/\P{scx=Hani}/u, "\u{3037}");
-t(/\p{scx=Hani}/u, "\u{fe45}");
-f(/\P{scx=Hani}/u, "\u{fe45}");
-t(/\p{scx=Hani}/u, "\u{fe46}");
-f(/\P{scx=Hani}/u, "\u{fe46}");
-t(/\p{scx=Hani}/u, "\u{3001}");
-f(/\P{scx=Hani}/u, "\u{3001}");
-t(/\p{scx=Hani}/u, "\u{3002}");
-f(/\P{scx=Hani}/u, "\u{3002}");
-t(/\p{scx=Hani}/u, "\u{3008}");
-f(/\P{scx=Hani}/u, "\u{3008}");
-t(/\p{scx=Hani}/u, "\u{3009}");
-f(/\P{scx=Hani}/u, "\u{3009}");
-t(/\p{scx=Hani}/u, "\u{300a}");
-f(/\P{scx=Hani}/u, "\u{300a}");
-t(/\p{scx=Hani}/u, "\u{300b}");
-f(/\P{scx=Hani}/u, "\u{300b}");
-t(/\p{scx=Hani}/u, "\u{300c}");
-f(/\P{scx=Hani}/u, "\u{300c}");
-t(/\p{scx=Hani}/u, "\u{300d}");
-f(/\P{scx=Hani}/u, "\u{300d}");
-t(/\p{scx=Hani}/u, "\u{300e}");
-f(/\P{scx=Hani}/u, "\u{300e}");
-t(/\p{scx=Hani}/u, "\u{300f}");
-f(/\P{scx=Hani}/u, "\u{300f}");
-t(/\p{scx=Hani}/u, "\u{3010}");
-f(/\P{scx=Hani}/u, "\u{3010}");
-t(/\p{scx=Hani}/u, "\u{3011}");
-f(/\P{scx=Hani}/u, "\u{3011}");
-t(/\p{scx=Hani}/u, "\u{3014}");
-f(/\P{scx=Hani}/u, "\u{3014}");
-t(/\p{scx=Hani}/u, "\u{3015}");
-f(/\P{scx=Hani}/u, "\u{3015}");
-t(/\p{scx=Hani}/u, "\u{3016}");
-f(/\P{scx=Hani}/u, "\u{3016}");
-t(/\p{scx=Hani}/u, "\u{3017}");
-f(/\P{scx=Hani}/u, "\u{3017}");
-t(/\p{scx=Hani}/u, "\u{3018}");
-f(/\P{scx=Hani}/u, "\u{3018}");
-t(/\p{scx=Hani}/u, "\u{3019}");
-f(/\P{scx=Hani}/u, "\u{3019}");
-t(/\p{scx=Hani}/u, "\u{301a}");
-f(/\P{scx=Hani}/u, "\u{301a}");
-t(/\p{scx=Hani}/u, "\u{301b}");
-f(/\P{scx=Hani}/u, "\u{301b}");
-t(/\p{scx=Hani}/u, "\u{30fb}");
-f(/\P{scx=Hani}/u, "\u{30fb}");
-t(/\p{scx=Hani}/u, "\u{ff61}");
-f(/\P{scx=Hani}/u, "\u{ff61}");
-t(/\p{scx=Hani}/u, "\u{ff62}");
-f(/\P{scx=Hani}/u, "\u{ff62}");
-t(/\p{scx=Hani}/u, "\u{ff63}");
-f(/\P{scx=Hani}/u, "\u{ff63}");
-t(/\p{scx=Hani}/u, "\u{ff64}");
-f(/\P{scx=Hani}/u, "\u{ff64}");
-t(/\p{scx=Hani}/u, "\u{ff65}");
-f(/\P{scx=Hani}/u, "\u{ff65}");
-f(/(?=\P{sc=Hani})\p{scx=Hani}/u, "\u{a7c}");
-f(/(?=\P{sc=Hani})\p{scx=Hani}/u, "\u{9c8f4}");
-f(/(?=\P{sc=Hani})\p{scx=Hani}/u, "\u{54f00}");
-f(/(?=\P{sc=Hani})\p{scx=Hani}/u, "\u{6c549}");
-f(/(?=\P{sc=Hani})\p{scx=Hani}/u, "\u{c5c5}");
+f(/(?=\P{sc=Hani})\p{scx=Hani}/u, "\u{10b11f}");
+f(/(?=\P{sc=Hani})\p{scx=Hani}/u, "\u{16e09}");
+f(/(?=\P{sc=Hani})\p{scx=Hani}/u, "\u{8287c}");
+f(/(?=\P{sc=Hani})\p{scx=Hani}/u, "\u{2b7aa}");
+f(/(?=\P{sc=Hani})\p{scx=Hani}/u, "\u{8074a}");
 // Script_Extension=Latn
-t(/\p{scx=Latn}/u, "\u{363}");
-f(/\P{scx=Latn}/u, "\u{363}");
-t(/\p{scx=Latn}/u, "\u{364}");
-f(/\P{scx=Latn}/u, "\u{364}");
-t(/\p{scx=Latn}/u, "\u{365}");
-f(/\P{scx=Latn}/u, "\u{365}");
-t(/\p{scx=Latn}/u, "\u{366}");
-f(/\P{scx=Latn}/u, "\u{366}");
-t(/\p{scx=Latn}/u, "\u{367}");
-f(/\P{scx=Latn}/u, "\u{367}");
-t(/\p{scx=Latn}/u, "\u{368}");
-f(/\P{scx=Latn}/u, "\u{368}");
-t(/\p{scx=Latn}/u, "\u{369}");
-f(/\P{scx=Latn}/u, "\u{369}");
-t(/\p{scx=Latn}/u, "\u{36a}");
-f(/\P{scx=Latn}/u, "\u{36a}");
-t(/\p{scx=Latn}/u, "\u{36b}");
-f(/\P{scx=Latn}/u, "\u{36b}");
-t(/\p{scx=Latn}/u, "\u{36c}");
-f(/\P{scx=Latn}/u, "\u{36c}");
-t(/\p{scx=Latn}/u, "\u{36d}");
-f(/\P{scx=Latn}/u, "\u{36d}");
-t(/\p{scx=Latn}/u, "\u{36e}");
-f(/\P{scx=Latn}/u, "\u{36e}");
-t(/\p{scx=Latn}/u, "\u{36f}");
-f(/\P{scx=Latn}/u, "\u{36f}");
-t(/\p{scx=Latn}/u, "\u{485}");
-f(/\P{scx=Latn}/u, "\u{485}");
-t(/\p{scx=Latn}/u, "\u{486}");
-f(/\P{scx=Latn}/u, "\u{486}");
-t(/\p{scx=Latn}/u, "\u{10fb}");
-f(/\P{scx=Latn}/u, "\u{10fb}");
-t(/\p{scx=Latn}/u, "\u{20f0}");
-f(/\P{scx=Latn}/u, "\u{20f0}");
-t(/\p{scx=Latn}/u, "\u{a92e}");
-f(/\P{scx=Latn}/u, "\u{a92e}");
-t(/\p{scx=Latn}/u, "\u{952}");
-f(/\P{scx=Latn}/u, "\u{952}");
-t(/\p{scx=Latn}/u, "\u{951}");
-f(/\P{scx=Latn}/u, "\u{951}");
-f(/(?=\P{sc=Latn})\p{scx=Latn}/u, "\u{fcf93}");
-f(/(?=\P{sc=Latn})\p{scx=Latn}/u, "\u{f40d2}");
-f(/(?=\P{sc=Latn})\p{scx=Latn}/u, "\u{7f2e4}");
-f(/(?=\P{sc=Latn})\p{scx=Latn}/u, "\u{5ccdd}");
-f(/(?=\P{sc=Latn})\p{scx=Latn}/u, "\u{1010dd}");
+f(/(?=\P{sc=Latn})\p{scx=Latn}/u, "\u{2cc83}");
+f(/(?=\P{sc=Latn})\p{scx=Latn}/u, "\u{10a158}");
+f(/(?=\P{sc=Latn})\p{scx=Latn}/u, "\u{97717}");
+f(/(?=\P{sc=Latn})\p{scx=Latn}/u, "\u{10a2c2}");
+f(/(?=\P{sc=Latn})\p{scx=Latn}/u, "\u{98275}");
 // Script_Extension=Arab
-t(/\p{scx=Arab}/u, "\u{102e0}");
-f(/\P{scx=Arab}/u, "\u{102e0}");
-t(/\p{scx=Arab}/u, "\u{102e1}");
-f(/\P{scx=Arab}/u, "\u{102e1}");
-t(/\p{scx=Arab}/u, "\u{102e2}");
-f(/\P{scx=Arab}/u, "\u{102e2}");
-t(/\p{scx=Arab}/u, "\u{102e3}");
-f(/\P{scx=Arab}/u, "\u{102e3}");
-t(/\p{scx=Arab}/u, "\u{102e4}");
-f(/\P{scx=Arab}/u, "\u{102e4}");
-t(/\p{scx=Arab}/u, "\u{102e5}");
-f(/\P{scx=Arab}/u, "\u{102e5}");
-t(/\p{scx=Arab}/u, "\u{102e6}");
-f(/\P{scx=Arab}/u, "\u{102e6}");
-t(/\p{scx=Arab}/u, "\u{102e7}");
-f(/\P{scx=Arab}/u, "\u{102e7}");
-t(/\p{scx=Arab}/u, "\u{102e8}");
-f(/\P{scx=Arab}/u, "\u{102e8}");
-t(/\p{scx=Arab}/u, "\u{102e9}");
-f(/\P{scx=Arab}/u, "\u{102e9}");
-t(/\p{scx=Arab}/u, "\u{102ea}");
-f(/\P{scx=Arab}/u, "\u{102ea}");
-t(/\p{scx=Arab}/u, "\u{102eb}");
-f(/\P{scx=Arab}/u, "\u{102eb}");
-t(/\p{scx=Arab}/u, "\u{102ec}");
-f(/\P{scx=Arab}/u, "\u{102ec}");
-t(/\p{scx=Arab}/u, "\u{102ed}");
-f(/\P{scx=Arab}/u, "\u{102ed}");
-t(/\p{scx=Arab}/u, "\u{102ee}");
-f(/\P{scx=Arab}/u, "\u{102ee}");
-t(/\p{scx=Arab}/u, "\u{102ef}");
-f(/\P{scx=Arab}/u, "\u{102ef}");
-t(/\p{scx=Arab}/u, "\u{102f0}");
-f(/\P{scx=Arab}/u, "\u{102f0}");
-t(/\p{scx=Arab}/u, "\u{102f1}");
-f(/\P{scx=Arab}/u, "\u{102f1}");
-t(/\p{scx=Arab}/u, "\u{102f2}");
-f(/\P{scx=Arab}/u, "\u{102f2}");
-t(/\p{scx=Arab}/u, "\u{102f3}");
-f(/\P{scx=Arab}/u, "\u{102f3}");
-t(/\p{scx=Arab}/u, "\u{102f4}");
-f(/\P{scx=Arab}/u, "\u{102f4}");
-t(/\p{scx=Arab}/u, "\u{102f5}");
-f(/\P{scx=Arab}/u, "\u{102f5}");
-t(/\p{scx=Arab}/u, "\u{102f6}");
-f(/\P{scx=Arab}/u, "\u{102f6}");
-t(/\p{scx=Arab}/u, "\u{102f7}");
-f(/\P{scx=Arab}/u, "\u{102f7}");
-t(/\p{scx=Arab}/u, "\u{102f8}");
-f(/\P{scx=Arab}/u, "\u{102f8}");
-t(/\p{scx=Arab}/u, "\u{102f9}");
-f(/\P{scx=Arab}/u, "\u{102f9}");
-t(/\p{scx=Arab}/u, "\u{102fa}");
-f(/\P{scx=Arab}/u, "\u{102fa}");
-t(/\p{scx=Arab}/u, "\u{102fb}");
-f(/\P{scx=Arab}/u, "\u{102fb}");
-t(/\p{scx=Arab}/u, "\u{64b}");
-f(/\P{scx=Arab}/u, "\u{64b}");
-t(/\p{scx=Arab}/u, "\u{64c}");
-f(/\P{scx=Arab}/u, "\u{64c}");
-t(/\p{scx=Arab}/u, "\u{64d}");
-f(/\P{scx=Arab}/u, "\u{64d}");
-t(/\p{scx=Arab}/u, "\u{64e}");
-f(/\P{scx=Arab}/u, "\u{64e}");
-t(/\p{scx=Arab}/u, "\u{64f}");
-f(/\P{scx=Arab}/u, "\u{64f}");
-t(/\p{scx=Arab}/u, "\u{650}");
-f(/\P{scx=Arab}/u, "\u{650}");
-t(/\p{scx=Arab}/u, "\u{651}");
-f(/\P{scx=Arab}/u, "\u{651}");
-t(/\p{scx=Arab}/u, "\u{652}");
-f(/\P{scx=Arab}/u, "\u{652}");
-t(/\p{scx=Arab}/u, "\u{653}");
-f(/\P{scx=Arab}/u, "\u{653}");
-t(/\p{scx=Arab}/u, "\u{654}");
-f(/\P{scx=Arab}/u, "\u{654}");
-t(/\p{scx=Arab}/u, "\u{655}");
-f(/\P{scx=Arab}/u, "\u{655}");
-t(/\p{scx=Arab}/u, "\u{670}");
-f(/\P{scx=Arab}/u, "\u{670}");
-t(/\p{scx=Arab}/u, "\u{660}");
-f(/\P{scx=Arab}/u, "\u{660}");
-t(/\p{scx=Arab}/u, "\u{661}");
-f(/\P{scx=Arab}/u, "\u{661}");
-t(/\p{scx=Arab}/u, "\u{662}");
-f(/\P{scx=Arab}/u, "\u{662}");
-t(/\p{scx=Arab}/u, "\u{663}");
-f(/\P{scx=Arab}/u, "\u{663}");
-t(/\p{scx=Arab}/u, "\u{664}");
-f(/\P{scx=Arab}/u, "\u{664}");
-t(/\p{scx=Arab}/u, "\u{665}");
-f(/\P{scx=Arab}/u, "\u{665}");
-t(/\p{scx=Arab}/u, "\u{666}");
-f(/\P{scx=Arab}/u, "\u{666}");
-t(/\p{scx=Arab}/u, "\u{667}");
-f(/\P{scx=Arab}/u, "\u{667}");
-t(/\p{scx=Arab}/u, "\u{668}");
-f(/\P{scx=Arab}/u, "\u{668}");
-t(/\p{scx=Arab}/u, "\u{669}");
-f(/\P{scx=Arab}/u, "\u{669}");
-t(/\p{scx=Arab}/u, "\u{fdf2}");
-f(/\P{scx=Arab}/u, "\u{fdf2}");
-t(/\p{scx=Arab}/u, "\u{fdfd}");
-f(/\P{scx=Arab}/u, "\u{fdfd}");
-t(/\p{scx=Arab}/u, "\u{60c}");
-f(/\P{scx=Arab}/u, "\u{60c}");
-t(/\p{scx=Arab}/u, "\u{61b}");
-f(/\P{scx=Arab}/u, "\u{61b}");
-t(/\p{scx=Arab}/u, "\u{61f}");
-f(/\P{scx=Arab}/u, "\u{61f}");
-t(/\p{scx=Arab}/u, "\u{640}");
-f(/\P{scx=Arab}/u, "\u{640}");
-f(/(?=\P{sc=Arab})\p{scx=Arab}/u, "\u{8901f}");
-f(/(?=\P{sc=Arab})\p{scx=Arab}/u, "\u{91256}");
-f(/(?=\P{sc=Arab})\p{scx=Arab}/u, "\u{71d97}");
-f(/(?=\P{sc=Arab})\p{scx=Arab}/u, "\u{3c94d}");
-f(/(?=\P{sc=Arab})\p{scx=Arab}/u, "\u{f9299}");
+f(/(?=\P{sc=Arab})\p{scx=Arab}/u, "\u{ad4b4}");
+f(/(?=\P{sc=Arab})\p{scx=Arab}/u, "\u{5e088}");
+f(/(?=\P{sc=Arab})\p{scx=Arab}/u, "\u{65bf1}");
+f(/(?=\P{sc=Arab})\p{scx=Arab}/u, "\u{32ca1}");
+f(/(?=\P{sc=Arab})\p{scx=Arab}/u, "\u{19c04}");
 // Script_Extension=Copt
-t(/\p{scx=Copt}/u, "\u{102e0}");
-f(/\P{scx=Copt}/u, "\u{102e0}");
-t(/\p{scx=Copt}/u, "\u{102e1}");
-f(/\P{scx=Copt}/u, "\u{102e1}");
-t(/\p{scx=Copt}/u, "\u{102e2}");
-f(/\P{scx=Copt}/u, "\u{102e2}");
-t(/\p{scx=Copt}/u, "\u{102e3}");
-f(/\P{scx=Copt}/u, "\u{102e3}");
-t(/\p{scx=Copt}/u, "\u{102e4}");
-f(/\P{scx=Copt}/u, "\u{102e4}");
-t(/\p{scx=Copt}/u, "\u{102e5}");
-f(/\P{scx=Copt}/u, "\u{102e5}");
-t(/\p{scx=Copt}/u, "\u{102e6}");
-f(/\P{scx=Copt}/u, "\u{102e6}");
-t(/\p{scx=Copt}/u, "\u{102e7}");
-f(/\P{scx=Copt}/u, "\u{102e7}");
-t(/\p{scx=Copt}/u, "\u{102e8}");
-f(/\P{scx=Copt}/u, "\u{102e8}");
-t(/\p{scx=Copt}/u, "\u{102e9}");
-f(/\P{scx=Copt}/u, "\u{102e9}");
-t(/\p{scx=Copt}/u, "\u{102ea}");
-f(/\P{scx=Copt}/u, "\u{102ea}");
-t(/\p{scx=Copt}/u, "\u{102eb}");
-f(/\P{scx=Copt}/u, "\u{102eb}");
-t(/\p{scx=Copt}/u, "\u{102ec}");
-f(/\P{scx=Copt}/u, "\u{102ec}");
-t(/\p{scx=Copt}/u, "\u{102ed}");
-f(/\P{scx=Copt}/u, "\u{102ed}");
-t(/\p{scx=Copt}/u, "\u{102ee}");
-f(/\P{scx=Copt}/u, "\u{102ee}");
-t(/\p{scx=Copt}/u, "\u{102ef}");
-f(/\P{scx=Copt}/u, "\u{102ef}");
-t(/\p{scx=Copt}/u, "\u{102f0}");
-f(/\P{scx=Copt}/u, "\u{102f0}");
-t(/\p{scx=Copt}/u, "\u{102f1}");
-f(/\P{scx=Copt}/u, "\u{102f1}");
-t(/\p{scx=Copt}/u, "\u{102f2}");
-f(/\P{scx=Copt}/u, "\u{102f2}");
-t(/\p{scx=Copt}/u, "\u{102f3}");
-f(/\P{scx=Copt}/u, "\u{102f3}");
-t(/\p{scx=Copt}/u, "\u{102f4}");
-f(/\P{scx=Copt}/u, "\u{102f4}");
-t(/\p{scx=Copt}/u, "\u{102f5}");
-f(/\P{scx=Copt}/u, "\u{102f5}");
-t(/\p{scx=Copt}/u, "\u{102f6}");
-f(/\P{scx=Copt}/u, "\u{102f6}");
-t(/\p{scx=Copt}/u, "\u{102f7}");
-f(/\P{scx=Copt}/u, "\u{102f7}");
-t(/\p{scx=Copt}/u, "\u{102f8}");
-f(/\P{scx=Copt}/u, "\u{102f8}");
-t(/\p{scx=Copt}/u, "\u{102f9}");
-f(/\P{scx=Copt}/u, "\u{102f9}");
-t(/\p{scx=Copt}/u, "\u{102fa}");
-f(/\P{scx=Copt}/u, "\u{102fa}");
-t(/\p{scx=Copt}/u, "\u{102fb}");
-f(/\P{scx=Copt}/u, "\u{102fb}");
-f(/(?=\P{sc=Copt})\p{scx=Copt}/u, "\u{b543e}");
-f(/(?=\P{sc=Copt})\p{scx=Copt}/u, "\u{10ce3f}");
-f(/(?=\P{sc=Copt})\p{scx=Copt}/u, "\u{ea3a9}");
-f(/(?=\P{sc=Copt})\p{scx=Copt}/u, "\u{83f15}");
-f(/(?=\P{sc=Copt})\p{scx=Copt}/u, "\u{8b9a5}");
+f(/(?=\P{sc=Copt})\p{scx=Copt}/u, "\u{62c6}");
+f(/(?=\P{sc=Copt})\p{scx=Copt}/u, "\u{10f13d}");
+f(/(?=\P{sc=Copt})\p{scx=Copt}/u, "\u{9ebe5}");
+f(/(?=\P{sc=Copt})\p{scx=Copt}/u, "\u{60645}");
+f(/(?=\P{sc=Copt})\p{scx=Copt}/u, "\u{f2fff}");
 // Script_Extension=Syrc
-t(/\p{scx=Syrc}/u, "\u{64b}");
-f(/\P{scx=Syrc}/u, "\u{64b}");
-t(/\p{scx=Syrc}/u, "\u{64c}");
-f(/\P{scx=Syrc}/u, "\u{64c}");
-t(/\p{scx=Syrc}/u, "\u{64d}");
-f(/\P{scx=Syrc}/u, "\u{64d}");
-t(/\p{scx=Syrc}/u, "\u{64e}");
-f(/\P{scx=Syrc}/u, "\u{64e}");
-t(/\p{scx=Syrc}/u, "\u{64f}");
-f(/\P{scx=Syrc}/u, "\u{64f}");
-t(/\p{scx=Syrc}/u, "\u{650}");
-f(/\P{scx=Syrc}/u, "\u{650}");
-t(/\p{scx=Syrc}/u, "\u{651}");
-f(/\P{scx=Syrc}/u, "\u{651}");
-t(/\p{scx=Syrc}/u, "\u{652}");
-f(/\P{scx=Syrc}/u, "\u{652}");
-t(/\p{scx=Syrc}/u, "\u{653}");
-f(/\P{scx=Syrc}/u, "\u{653}");
-t(/\p{scx=Syrc}/u, "\u{654}");
-f(/\P{scx=Syrc}/u, "\u{654}");
-t(/\p{scx=Syrc}/u, "\u{655}");
-f(/\P{scx=Syrc}/u, "\u{655}");
-t(/\p{scx=Syrc}/u, "\u{670}");
-f(/\P{scx=Syrc}/u, "\u{670}");
-t(/\p{scx=Syrc}/u, "\u{60c}");
-f(/\P{scx=Syrc}/u, "\u{60c}");
-t(/\p{scx=Syrc}/u, "\u{61b}");
-f(/\P{scx=Syrc}/u, "\u{61b}");
-t(/\p{scx=Syrc}/u, "\u{61f}");
-f(/\P{scx=Syrc}/u, "\u{61f}");
-t(/\p{scx=Syrc}/u, "\u{640}");
-f(/\P{scx=Syrc}/u, "\u{640}");
-f(/(?=\P{sc=Syrc})\p{scx=Syrc}/u, "\u{dab32}");
-f(/(?=\P{sc=Syrc})\p{scx=Syrc}/u, "\u{6b768}");
-f(/(?=\P{sc=Syrc})\p{scx=Syrc}/u, "\u{877e7}");
-f(/(?=\P{sc=Syrc})\p{scx=Syrc}/u, "\u{66f8b}");
-f(/(?=\P{sc=Syrc})\p{scx=Syrc}/u, "\u{12a45}");
+f(/(?=\P{sc=Syrc})\p{scx=Syrc}/u, "\u{6ff8f}");
+f(/(?=\P{sc=Syrc})\p{scx=Syrc}/u, "\u{f6e6}");
+f(/(?=\P{sc=Syrc})\p{scx=Syrc}/u, "\u{1037ae}");
+f(/(?=\P{sc=Syrc})\p{scx=Syrc}/u, "\u{fdd94}");
+f(/(?=\P{sc=Syrc})\p{scx=Syrc}/u, "\u{218af}");
 // Script_Extension=Thaa
-t(/\p{scx=Thaa}/u, "\u{660}");
-f(/\P{scx=Thaa}/u, "\u{660}");
-t(/\p{scx=Thaa}/u, "\u{661}");
-f(/\P{scx=Thaa}/u, "\u{661}");
-t(/\p{scx=Thaa}/u, "\u{662}");
-f(/\P{scx=Thaa}/u, "\u{662}");
-t(/\p{scx=Thaa}/u, "\u{663}");
-f(/\P{scx=Thaa}/u, "\u{663}");
-t(/\p{scx=Thaa}/u, "\u{664}");
-f(/\P{scx=Thaa}/u, "\u{664}");
-t(/\p{scx=Thaa}/u, "\u{665}");
-f(/\P{scx=Thaa}/u, "\u{665}");
-t(/\p{scx=Thaa}/u, "\u{666}");
-f(/\P{scx=Thaa}/u, "\u{666}");
-t(/\p{scx=Thaa}/u, "\u{667}");
-f(/\P{scx=Thaa}/u, "\u{667}");
-t(/\p{scx=Thaa}/u, "\u{668}");
-f(/\P{scx=Thaa}/u, "\u{668}");
-t(/\p{scx=Thaa}/u, "\u{669}");
-f(/\P{scx=Thaa}/u, "\u{669}");
-t(/\p{scx=Thaa}/u, "\u{fdf2}");
-f(/\P{scx=Thaa}/u, "\u{fdf2}");
-t(/\p{scx=Thaa}/u, "\u{fdfd}");
-f(/\P{scx=Thaa}/u, "\u{fdfd}");
-t(/\p{scx=Thaa}/u, "\u{60c}");
-f(/\P{scx=Thaa}/u, "\u{60c}");
-t(/\p{scx=Thaa}/u, "\u{61b}");
-f(/\P{scx=Thaa}/u, "\u{61b}");
-t(/\p{scx=Thaa}/u, "\u{61f}");
-f(/\P{scx=Thaa}/u, "\u{61f}");
-f(/(?=\P{sc=Thaa})\p{scx=Thaa}/u, "\u{bf3cb}");
-f(/(?=\P{sc=Thaa})\p{scx=Thaa}/u, "\u{33196}");
-f(/(?=\P{sc=Thaa})\p{scx=Thaa}/u, "\u{5bc9e}");
-f(/(?=\P{sc=Thaa})\p{scx=Thaa}/u, "\u{b350c}");
-f(/(?=\P{sc=Thaa})\p{scx=Thaa}/u, "\u{1a475}");
+f(/(?=\P{sc=Thaa})\p{scx=Thaa}/u, "\u{82166}");
+f(/(?=\P{sc=Thaa})\p{scx=Thaa}/u, "\u{dc7e1}");
+f(/(?=\P{sc=Thaa})\p{scx=Thaa}/u, "\u{638e}");
+f(/(?=\P{sc=Thaa})\p{scx=Thaa}/u, "\u{edd2e}");
+f(/(?=\P{sc=Thaa})\p{scx=Thaa}/u, "\u{20737}");
 // Script_Extension=Armn
-t(/\p{scx=Armn}/u, "\u{589}");
-f(/\P{scx=Armn}/u, "\u{589}");
-f(/(?=\P{sc=Armn})\p{scx=Armn}/u, "\u{a4bc3}");
-f(/(?=\P{sc=Armn})\p{scx=Armn}/u, "\u{7e5df}");
-f(/(?=\P{sc=Armn})\p{scx=Armn}/u, "\u{619d5}");
-f(/(?=\P{sc=Armn})\p{scx=Armn}/u, "\u{6299c}");
-f(/(?=\P{sc=Armn})\p{scx=Armn}/u, "\u{ecd52}");
+f(/(?=\P{sc=Armn})\p{scx=Armn}/u, "\u{bbd25}");
+f(/(?=\P{sc=Armn})\p{scx=Armn}/u, "\u{3b15}");
+f(/(?=\P{sc=Armn})\p{scx=Armn}/u, "\u{f0000}");
+f(/(?=\P{sc=Armn})\p{scx=Armn}/u, "\u{13f76}");
+f(/(?=\P{sc=Armn})\p{scx=Armn}/u, "\u{8f861}");
 // Script_Extension=Geor
-t(/\p{scx=Geor}/u, "\u{589}");
-f(/\P{scx=Geor}/u, "\u{589}");
-t(/\p{scx=Geor}/u, "\u{10fb}");
-f(/\P{scx=Geor}/u, "\u{10fb}");
-f(/(?=\P{sc=Geor})\p{scx=Geor}/u, "\u{1b0d2}");
-f(/(?=\P{sc=Geor})\p{scx=Geor}/u, "\u{9e197}");
-f(/(?=\P{sc=Geor})\p{scx=Geor}/u, "\u{413c6}");
-f(/(?=\P{sc=Geor})\p{scx=Geor}/u, "\u{25864}");
-f(/(?=\P{sc=Geor})\p{scx=Geor}/u, "\u{3cec4}");
-// Script_Extension=Beng
-t(/\p{scx=Beng}/u, "\u{a8f1}");
-f(/\P{scx=Beng}/u, "\u{a8f1}");
-t(/\p{scx=Beng}/u, "\u{9e6}");
-f(/\P{scx=Beng}/u, "\u{9e6}");
-t(/\p{scx=Beng}/u, "\u{9e7}");
-f(/\P{scx=Beng}/u, "\u{9e7}");
-t(/\p{scx=Beng}/u, "\u{9e8}");
-f(/\P{scx=Beng}/u, "\u{9e8}");
-t(/\p{scx=Beng}/u, "\u{9e9}");
-f(/\P{scx=Beng}/u, "\u{9e9}");
-t(/\p{scx=Beng}/u, "\u{9ea}");
-f(/\P{scx=Beng}/u, "\u{9ea}");
-t(/\p{scx=Beng}/u, "\u{9eb}");
-f(/\P{scx=Beng}/u, "\u{9eb}");
-t(/\p{scx=Beng}/u, "\u{9ec}");
-f(/\P{scx=Beng}/u, "\u{9ec}");
-t(/\p{scx=Beng}/u, "\u{9ed}");
-f(/\P{scx=Beng}/u, "\u{9ed}");
-t(/\p{scx=Beng}/u, "\u{9ee}");
-f(/\P{scx=Beng}/u, "\u{9ee}");
-t(/\p{scx=Beng}/u, "\u{9ef}");
-f(/\P{scx=Beng}/u, "\u{9ef}");
-t(/\p{scx=Beng}/u, "\u{952}");
-f(/\P{scx=Beng}/u, "\u{952}");
-t(/\p{scx=Beng}/u, "\u{951}");
-f(/\P{scx=Beng}/u, "\u{951}");
-t(/\p{scx=Beng}/u, "\u{964}");
-f(/\P{scx=Beng}/u, "\u{964}");
-t(/\p{scx=Beng}/u, "\u{965}");
-f(/\P{scx=Beng}/u, "\u{965}");
-f(/(?=\P{sc=Beng})\p{scx=Beng}/u, "\u{10b8e0}");
-f(/(?=\P{sc=Beng})\p{scx=Beng}/u, "\u{a1a3d}");
-f(/(?=\P{sc=Beng})\p{scx=Beng}/u, "\u{63024}");
-f(/(?=\P{sc=Beng})\p{scx=Beng}/u, "\u{e1e3a}");
-f(/(?=\P{sc=Beng})\p{scx=Beng}/u, "\u{732a7}");
+f(/(?=\P{sc=Geor})\p{scx=Geor}/u, "\u{a2c35}");
+f(/(?=\P{sc=Geor})\p{scx=Geor}/u, "\u{71c36}");
+f(/(?=\P{sc=Geor})\p{scx=Geor}/u, "\u{103dfc}");
+f(/(?=\P{sc=Geor})\p{scx=Geor}/u, "\u{8df23}");
+f(/(?=\P{sc=Geor})\p{scx=Geor}/u, "\u{9e978}");
 // Script_Extension=Bopo
-t(/\p{scx=Bopo}/u, "\u{302a}");
-f(/\P{scx=Bopo}/u, "\u{302a}");
-t(/\p{scx=Bopo}/u, "\u{302b}");
-f(/\P{scx=Bopo}/u, "\u{302b}");
-t(/\p{scx=Bopo}/u, "\u{302c}");
-f(/\P{scx=Bopo}/u, "\u{302c}");
-t(/\p{scx=Bopo}/u, "\u{302d}");
-f(/\P{scx=Bopo}/u, "\u{302d}");
-t(/\p{scx=Bopo}/u, "\u{3003}");
-f(/\P{scx=Bopo}/u, "\u{3003}");
-t(/\p{scx=Bopo}/u, "\u{3013}");
-f(/\P{scx=Bopo}/u, "\u{3013}");
-t(/\p{scx=Bopo}/u, "\u{301c}");
-f(/\P{scx=Bopo}/u, "\u{301c}");
-t(/\p{scx=Bopo}/u, "\u{301d}");
-f(/\P{scx=Bopo}/u, "\u{301d}");
-t(/\p{scx=Bopo}/u, "\u{301e}");
-f(/\P{scx=Bopo}/u, "\u{301e}");
-t(/\p{scx=Bopo}/u, "\u{301f}");
-f(/\P{scx=Bopo}/u, "\u{301f}");
-t(/\p{scx=Bopo}/u, "\u{3030}");
-f(/\P{scx=Bopo}/u, "\u{3030}");
-t(/\p{scx=Bopo}/u, "\u{3037}");
-f(/\P{scx=Bopo}/u, "\u{3037}");
-t(/\p{scx=Bopo}/u, "\u{fe45}");
-f(/\P{scx=Bopo}/u, "\u{fe45}");
-t(/\p{scx=Bopo}/u, "\u{fe46}");
-f(/\P{scx=Bopo}/u, "\u{fe46}");
-t(/\p{scx=Bopo}/u, "\u{3001}");
-f(/\P{scx=Bopo}/u, "\u{3001}");
-t(/\p{scx=Bopo}/u, "\u{3002}");
-f(/\P{scx=Bopo}/u, "\u{3002}");
-t(/\p{scx=Bopo}/u, "\u{3008}");
-f(/\P{scx=Bopo}/u, "\u{3008}");
-t(/\p{scx=Bopo}/u, "\u{3009}");
-f(/\P{scx=Bopo}/u, "\u{3009}");
-t(/\p{scx=Bopo}/u, "\u{300a}");
-f(/\P{scx=Bopo}/u, "\u{300a}");
-t(/\p{scx=Bopo}/u, "\u{300b}");
-f(/\P{scx=Bopo}/u, "\u{300b}");
-t(/\p{scx=Bopo}/u, "\u{300c}");
-f(/\P{scx=Bopo}/u, "\u{300c}");
-t(/\p{scx=Bopo}/u, "\u{300d}");
-f(/\P{scx=Bopo}/u, "\u{300d}");
-t(/\p{scx=Bopo}/u, "\u{300e}");
-f(/\P{scx=Bopo}/u, "\u{300e}");
-t(/\p{scx=Bopo}/u, "\u{300f}");
-f(/\P{scx=Bopo}/u, "\u{300f}");
-t(/\p{scx=Bopo}/u, "\u{3010}");
-f(/\P{scx=Bopo}/u, "\u{3010}");
-t(/\p{scx=Bopo}/u, "\u{3011}");
-f(/\P{scx=Bopo}/u, "\u{3011}");
-t(/\p{scx=Bopo}/u, "\u{3014}");
-f(/\P{scx=Bopo}/u, "\u{3014}");
-t(/\p{scx=Bopo}/u, "\u{3015}");
-f(/\P{scx=Bopo}/u, "\u{3015}");
-t(/\p{scx=Bopo}/u, "\u{3016}");
-f(/\P{scx=Bopo}/u, "\u{3016}");
-t(/\p{scx=Bopo}/u, "\u{3017}");
-f(/\P{scx=Bopo}/u, "\u{3017}");
-t(/\p{scx=Bopo}/u, "\u{3018}");
-f(/\P{scx=Bopo}/u, "\u{3018}");
-t(/\p{scx=Bopo}/u, "\u{3019}");
-f(/\P{scx=Bopo}/u, "\u{3019}");
-t(/\p{scx=Bopo}/u, "\u{301a}");
-f(/\P{scx=Bopo}/u, "\u{301a}");
-t(/\p{scx=Bopo}/u, "\u{301b}");
-f(/\P{scx=Bopo}/u, "\u{301b}");
-t(/\p{scx=Bopo}/u, "\u{30fb}");
-f(/\P{scx=Bopo}/u, "\u{30fb}");
-t(/\p{scx=Bopo}/u, "\u{ff61}");
-f(/\P{scx=Bopo}/u, "\u{ff61}");
-t(/\p{scx=Bopo}/u, "\u{ff62}");
-f(/\P{scx=Bopo}/u, "\u{ff62}");
-t(/\p{scx=Bopo}/u, "\u{ff63}");
-f(/\P{scx=Bopo}/u, "\u{ff63}");
-t(/\p{scx=Bopo}/u, "\u{ff64}");
-f(/\P{scx=Bopo}/u, "\u{ff64}");
-t(/\p{scx=Bopo}/u, "\u{ff65}");
-f(/\P{scx=Bopo}/u, "\u{ff65}");
-f(/(?=\P{sc=Bopo})\p{scx=Bopo}/u, "\u{d9494}");
-f(/(?=\P{sc=Bopo})\p{scx=Bopo}/u, "\u{c8328}");
-f(/(?=\P{sc=Bopo})\p{scx=Bopo}/u, "\u{fbf6e}");
-f(/(?=\P{sc=Bopo})\p{scx=Bopo}/u, "\u{1b8cc}");
-f(/(?=\P{sc=Bopo})\p{scx=Bopo}/u, "\u{10477}");
+f(/(?=\P{sc=Bopo})\p{scx=Bopo}/u, "\u{10e25d}");
+f(/(?=\P{sc=Bopo})\p{scx=Bopo}/u, "\u{f336d}");
+f(/(?=\P{sc=Bopo})\p{scx=Bopo}/u, "\u{2dd6d}");
+f(/(?=\P{sc=Bopo})\p{scx=Bopo}/u, "\u{544a3}");
+f(/(?=\P{sc=Bopo})\p{scx=Bopo}/u, "\u{3b09c}");
 // Script_Extension=Bugi
-t(/\p{scx=Bugi}/u, "\u{a9cf}");
-f(/\P{scx=Bugi}/u, "\u{a9cf}");
-f(/(?=\P{sc=Bugi})\p{scx=Bugi}/u, "\u{ec046}");
-f(/(?=\P{sc=Bugi})\p{scx=Bugi}/u, "\u{a8402}");
-f(/(?=\P{sc=Bugi})\p{scx=Bugi}/u, "\u{85530}");
-f(/(?=\P{sc=Bugi})\p{scx=Bugi}/u, "\u{86942}");
-f(/(?=\P{sc=Bugi})\p{scx=Bugi}/u, "\u{c6ded}");
+f(/(?=\P{sc=Bugi})\p{scx=Bugi}/u, "\u{95d74}");
+f(/(?=\P{sc=Bugi})\p{scx=Bugi}/u, "\u{7ac62}");
+f(/(?=\P{sc=Bugi})\p{scx=Bugi}/u, "\u{6b7a3}");
+f(/(?=\P{sc=Bugi})\p{scx=Bugi}/u, "\u{d5b12}");
+f(/(?=\P{sc=Bugi})\p{scx=Bugi}/u, "\u{57ab9}");
 // Script_Extension=Java
-t(/\p{scx=Java}/u, "\u{a9cf}");
-f(/\P{scx=Java}/u, "\u{a9cf}");
-f(/(?=\P{sc=Java})\p{scx=Java}/u, "\u{d4343}");
-f(/(?=\P{sc=Java})\p{scx=Java}/u, "\u{6d000}");
-f(/(?=\P{sc=Java})\p{scx=Java}/u, "\u{c72a4}");
-f(/(?=\P{sc=Java})\p{scx=Java}/u, "\u{9ad6f}");
-f(/(?=\P{sc=Java})\p{scx=Java}/u, "\u{fb350}");
+f(/(?=\P{sc=Java})\p{scx=Java}/u, "\u{ea049}");
+f(/(?=\P{sc=Java})\p{scx=Java}/u, "\u{b2073}");
+f(/(?=\P{sc=Java})\p{scx=Java}/u, "\u{ed4f8}");
+f(/(?=\P{sc=Java})\p{scx=Java}/u, "\u{6d30f}");
+f(/(?=\P{sc=Java})\p{scx=Java}/u, "\u{b1dd9}");
 // Script_Extension=Cprt
-t(/\p{scx=Cprt}/u, "\u{10100}");
-f(/\P{scx=Cprt}/u, "\u{10100}");
-t(/\p{scx=Cprt}/u, "\u{10101}");
-f(/\P{scx=Cprt}/u, "\u{10101}");
-t(/\p{scx=Cprt}/u, "\u{10102}");
-f(/\P{scx=Cprt}/u, "\u{10102}");
-t(/\p{scx=Cprt}/u, "\u{10137}");
-f(/\P{scx=Cprt}/u, "\u{10137}");
-t(/\p{scx=Cprt}/u, "\u{10138}");
-f(/\P{scx=Cprt}/u, "\u{10138}");
-t(/\p{scx=Cprt}/u, "\u{10139}");
-f(/\P{scx=Cprt}/u, "\u{10139}");
-t(/\p{scx=Cprt}/u, "\u{1013a}");
-f(/\P{scx=Cprt}/u, "\u{1013a}");
-t(/\p{scx=Cprt}/u, "\u{1013b}");
-f(/\P{scx=Cprt}/u, "\u{1013b}");
-t(/\p{scx=Cprt}/u, "\u{1013c}");
-f(/\P{scx=Cprt}/u, "\u{1013c}");
-t(/\p{scx=Cprt}/u, "\u{1013d}");
-f(/\P{scx=Cprt}/u, "\u{1013d}");
-t(/\p{scx=Cprt}/u, "\u{1013e}");
-f(/\P{scx=Cprt}/u, "\u{1013e}");
-t(/\p{scx=Cprt}/u, "\u{1013f}");
-f(/\P{scx=Cprt}/u, "\u{1013f}");
-t(/\p{scx=Cprt}/u, "\u{10107}");
-f(/\P{scx=Cprt}/u, "\u{10107}");
-t(/\p{scx=Cprt}/u, "\u{10108}");
-f(/\P{scx=Cprt}/u, "\u{10108}");
-t(/\p{scx=Cprt}/u, "\u{10109}");
-f(/\P{scx=Cprt}/u, "\u{10109}");
-t(/\p{scx=Cprt}/u, "\u{1010a}");
-f(/\P{scx=Cprt}/u, "\u{1010a}");
-t(/\p{scx=Cprt}/u, "\u{1010b}");
-f(/\P{scx=Cprt}/u, "\u{1010b}");
-t(/\p{scx=Cprt}/u, "\u{1010c}");
-f(/\P{scx=Cprt}/u, "\u{1010c}");
-t(/\p{scx=Cprt}/u, "\u{1010d}");
-f(/\P{scx=Cprt}/u, "\u{1010d}");
-t(/\p{scx=Cprt}/u, "\u{1010e}");
-f(/\P{scx=Cprt}/u, "\u{1010e}");
-t(/\p{scx=Cprt}/u, "\u{1010f}");
-f(/\P{scx=Cprt}/u, "\u{1010f}");
-t(/\p{scx=Cprt}/u, "\u{10110}");
-f(/\P{scx=Cprt}/u, "\u{10110}");
-t(/\p{scx=Cprt}/u, "\u{10111}");
-f(/\P{scx=Cprt}/u, "\u{10111}");
-t(/\p{scx=Cprt}/u, "\u{10112}");
-f(/\P{scx=Cprt}/u, "\u{10112}");
-t(/\p{scx=Cprt}/u, "\u{10113}");
-f(/\P{scx=Cprt}/u, "\u{10113}");
-t(/\p{scx=Cprt}/u, "\u{10114}");
-f(/\P{scx=Cprt}/u, "\u{10114}");
-t(/\p{scx=Cprt}/u, "\u{10115}");
-f(/\P{scx=Cprt}/u, "\u{10115}");
-t(/\p{scx=Cprt}/u, "\u{10116}");
-f(/\P{scx=Cprt}/u, "\u{10116}");
-t(/\p{scx=Cprt}/u, "\u{10117}");
-f(/\P{scx=Cprt}/u, "\u{10117}");
-t(/\p{scx=Cprt}/u, "\u{10118}");
-f(/\P{scx=Cprt}/u, "\u{10118}");
-t(/\p{scx=Cprt}/u, "\u{10119}");
-f(/\P{scx=Cprt}/u, "\u{10119}");
-t(/\p{scx=Cprt}/u, "\u{1011a}");
-f(/\P{scx=Cprt}/u, "\u{1011a}");
-t(/\p{scx=Cprt}/u, "\u{1011b}");
-f(/\P{scx=Cprt}/u, "\u{1011b}");
-t(/\p{scx=Cprt}/u, "\u{1011c}");
-f(/\P{scx=Cprt}/u, "\u{1011c}");
-t(/\p{scx=Cprt}/u, "\u{1011d}");
-f(/\P{scx=Cprt}/u, "\u{1011d}");
-t(/\p{scx=Cprt}/u, "\u{1011e}");
-f(/\P{scx=Cprt}/u, "\u{1011e}");
-t(/\p{scx=Cprt}/u, "\u{1011f}");
-f(/\P{scx=Cprt}/u, "\u{1011f}");
-t(/\p{scx=Cprt}/u, "\u{10120}");
-f(/\P{scx=Cprt}/u, "\u{10120}");
-t(/\p{scx=Cprt}/u, "\u{10121}");
-f(/\P{scx=Cprt}/u, "\u{10121}");
-t(/\p{scx=Cprt}/u, "\u{10122}");
-f(/\P{scx=Cprt}/u, "\u{10122}");
-t(/\p{scx=Cprt}/u, "\u{10123}");
-f(/\P{scx=Cprt}/u, "\u{10123}");
-t(/\p{scx=Cprt}/u, "\u{10124}");
-f(/\P{scx=Cprt}/u, "\u{10124}");
-t(/\p{scx=Cprt}/u, "\u{10125}");
-f(/\P{scx=Cprt}/u, "\u{10125}");
-t(/\p{scx=Cprt}/u, "\u{10126}");
-f(/\P{scx=Cprt}/u, "\u{10126}");
-t(/\p{scx=Cprt}/u, "\u{10127}");
-f(/\P{scx=Cprt}/u, "\u{10127}");
-t(/\p{scx=Cprt}/u, "\u{10128}");
-f(/\P{scx=Cprt}/u, "\u{10128}");
-t(/\p{scx=Cprt}/u, "\u{10129}");
-f(/\P{scx=Cprt}/u, "\u{10129}");
-t(/\p{scx=Cprt}/u, "\u{1012a}");
-f(/\P{scx=Cprt}/u, "\u{1012a}");
-t(/\p{scx=Cprt}/u, "\u{1012b}");
-f(/\P{scx=Cprt}/u, "\u{1012b}");
-t(/\p{scx=Cprt}/u, "\u{1012c}");
-f(/\P{scx=Cprt}/u, "\u{1012c}");
-t(/\p{scx=Cprt}/u, "\u{1012d}");
-f(/\P{scx=Cprt}/u, "\u{1012d}");
-t(/\p{scx=Cprt}/u, "\u{1012e}");
-f(/\P{scx=Cprt}/u, "\u{1012e}");
-t(/\p{scx=Cprt}/u, "\u{1012f}");
-f(/\P{scx=Cprt}/u, "\u{1012f}");
-t(/\p{scx=Cprt}/u, "\u{10130}");
-f(/\P{scx=Cprt}/u, "\u{10130}");
-t(/\p{scx=Cprt}/u, "\u{10131}");
-f(/\P{scx=Cprt}/u, "\u{10131}");
-t(/\p{scx=Cprt}/u, "\u{10132}");
-f(/\P{scx=Cprt}/u, "\u{10132}");
-t(/\p{scx=Cprt}/u, "\u{10133}");
-f(/\P{scx=Cprt}/u, "\u{10133}");
-f(/(?=\P{sc=Cprt})\p{scx=Cprt}/u, "\u{27a83}");
-f(/(?=\P{sc=Cprt})\p{scx=Cprt}/u, "\u{172f5}");
-f(/(?=\P{sc=Cprt})\p{scx=Cprt}/u, "\u{6ef51}");
-f(/(?=\P{sc=Cprt})\p{scx=Cprt}/u, "\u{7837}");
-f(/(?=\P{sc=Cprt})\p{scx=Cprt}/u, "\u{c5ce1}");
+f(/(?=\P{sc=Cprt})\p{scx=Cprt}/u, "\u{dd4bd}");
+f(/(?=\P{sc=Cprt})\p{scx=Cprt}/u, "\u{20588}");
+f(/(?=\P{sc=Cprt})\p{scx=Cprt}/u, "\u{1f362}");
+f(/(?=\P{sc=Cprt})\p{scx=Cprt}/u, "\u{6b96e}");
+f(/(?=\P{sc=Cprt})\p{scx=Cprt}/u, "\u{3557}");
 // Script_Extension=Linb
-t(/\p{scx=Linb}/u, "\u{10100}");
-f(/\P{scx=Linb}/u, "\u{10100}");
-t(/\p{scx=Linb}/u, "\u{10101}");
-f(/\P{scx=Linb}/u, "\u{10101}");
-t(/\p{scx=Linb}/u, "\u{10102}");
-f(/\P{scx=Linb}/u, "\u{10102}");
-t(/\p{scx=Linb}/u, "\u{10137}");
-f(/\P{scx=Linb}/u, "\u{10137}");
-t(/\p{scx=Linb}/u, "\u{10138}");
-f(/\P{scx=Linb}/u, "\u{10138}");
-t(/\p{scx=Linb}/u, "\u{10139}");
-f(/\P{scx=Linb}/u, "\u{10139}");
-t(/\p{scx=Linb}/u, "\u{1013a}");
-f(/\P{scx=Linb}/u, "\u{1013a}");
-t(/\p{scx=Linb}/u, "\u{1013b}");
-f(/\P{scx=Linb}/u, "\u{1013b}");
-t(/\p{scx=Linb}/u, "\u{1013c}");
-f(/\P{scx=Linb}/u, "\u{1013c}");
-t(/\p{scx=Linb}/u, "\u{1013d}");
-f(/\P{scx=Linb}/u, "\u{1013d}");
-t(/\p{scx=Linb}/u, "\u{1013e}");
-f(/\P{scx=Linb}/u, "\u{1013e}");
-t(/\p{scx=Linb}/u, "\u{1013f}");
-f(/\P{scx=Linb}/u, "\u{1013f}");
-t(/\p{scx=Linb}/u, "\u{10107}");
-f(/\P{scx=Linb}/u, "\u{10107}");
-t(/\p{scx=Linb}/u, "\u{10108}");
-f(/\P{scx=Linb}/u, "\u{10108}");
-t(/\p{scx=Linb}/u, "\u{10109}");
-f(/\P{scx=Linb}/u, "\u{10109}");
-t(/\p{scx=Linb}/u, "\u{1010a}");
-f(/\P{scx=Linb}/u, "\u{1010a}");
-t(/\p{scx=Linb}/u, "\u{1010b}");
-f(/\P{scx=Linb}/u, "\u{1010b}");
-t(/\p{scx=Linb}/u, "\u{1010c}");
-f(/\P{scx=Linb}/u, "\u{1010c}");
-t(/\p{scx=Linb}/u, "\u{1010d}");
-f(/\P{scx=Linb}/u, "\u{1010d}");
-t(/\p{scx=Linb}/u, "\u{1010e}");
-f(/\P{scx=Linb}/u, "\u{1010e}");
-t(/\p{scx=Linb}/u, "\u{1010f}");
-f(/\P{scx=Linb}/u, "\u{1010f}");
-t(/\p{scx=Linb}/u, "\u{10110}");
-f(/\P{scx=Linb}/u, "\u{10110}");
-t(/\p{scx=Linb}/u, "\u{10111}");
-f(/\P{scx=Linb}/u, "\u{10111}");
-t(/\p{scx=Linb}/u, "\u{10112}");
-f(/\P{scx=Linb}/u, "\u{10112}");
-t(/\p{scx=Linb}/u, "\u{10113}");
-f(/\P{scx=Linb}/u, "\u{10113}");
-t(/\p{scx=Linb}/u, "\u{10114}");
-f(/\P{scx=Linb}/u, "\u{10114}");
-t(/\p{scx=Linb}/u, "\u{10115}");
-f(/\P{scx=Linb}/u, "\u{10115}");
-t(/\p{scx=Linb}/u, "\u{10116}");
-f(/\P{scx=Linb}/u, "\u{10116}");
-t(/\p{scx=Linb}/u, "\u{10117}");
-f(/\P{scx=Linb}/u, "\u{10117}");
-t(/\p{scx=Linb}/u, "\u{10118}");
-f(/\P{scx=Linb}/u, "\u{10118}");
-t(/\p{scx=Linb}/u, "\u{10119}");
-f(/\P{scx=Linb}/u, "\u{10119}");
-t(/\p{scx=Linb}/u, "\u{1011a}");
-f(/\P{scx=Linb}/u, "\u{1011a}");
-t(/\p{scx=Linb}/u, "\u{1011b}");
-f(/\P{scx=Linb}/u, "\u{1011b}");
-t(/\p{scx=Linb}/u, "\u{1011c}");
-f(/\P{scx=Linb}/u, "\u{1011c}");
-t(/\p{scx=Linb}/u, "\u{1011d}");
-f(/\P{scx=Linb}/u, "\u{1011d}");
-t(/\p{scx=Linb}/u, "\u{1011e}");
-f(/\P{scx=Linb}/u, "\u{1011e}");
-t(/\p{scx=Linb}/u, "\u{1011f}");
-f(/\P{scx=Linb}/u, "\u{1011f}");
-t(/\p{scx=Linb}/u, "\u{10120}");
-f(/\P{scx=Linb}/u, "\u{10120}");
-t(/\p{scx=Linb}/u, "\u{10121}");
-f(/\P{scx=Linb}/u, "\u{10121}");
-t(/\p{scx=Linb}/u, "\u{10122}");
-f(/\P{scx=Linb}/u, "\u{10122}");
-t(/\p{scx=Linb}/u, "\u{10123}");
-f(/\P{scx=Linb}/u, "\u{10123}");
-t(/\p{scx=Linb}/u, "\u{10124}");
-f(/\P{scx=Linb}/u, "\u{10124}");
-t(/\p{scx=Linb}/u, "\u{10125}");
-f(/\P{scx=Linb}/u, "\u{10125}");
-t(/\p{scx=Linb}/u, "\u{10126}");
-f(/\P{scx=Linb}/u, "\u{10126}");
-t(/\p{scx=Linb}/u, "\u{10127}");
-f(/\P{scx=Linb}/u, "\u{10127}");
-t(/\p{scx=Linb}/u, "\u{10128}");
-f(/\P{scx=Linb}/u, "\u{10128}");
-t(/\p{scx=Linb}/u, "\u{10129}");
-f(/\P{scx=Linb}/u, "\u{10129}");
-t(/\p{scx=Linb}/u, "\u{1012a}");
-f(/\P{scx=Linb}/u, "\u{1012a}");
-t(/\p{scx=Linb}/u, "\u{1012b}");
-f(/\P{scx=Linb}/u, "\u{1012b}");
-t(/\p{scx=Linb}/u, "\u{1012c}");
-f(/\P{scx=Linb}/u, "\u{1012c}");
-t(/\p{scx=Linb}/u, "\u{1012d}");
-f(/\P{scx=Linb}/u, "\u{1012d}");
-t(/\p{scx=Linb}/u, "\u{1012e}");
-f(/\P{scx=Linb}/u, "\u{1012e}");
-t(/\p{scx=Linb}/u, "\u{1012f}");
-f(/\P{scx=Linb}/u, "\u{1012f}");
-t(/\p{scx=Linb}/u, "\u{10130}");
-f(/\P{scx=Linb}/u, "\u{10130}");
-t(/\p{scx=Linb}/u, "\u{10131}");
-f(/\P{scx=Linb}/u, "\u{10131}");
-t(/\p{scx=Linb}/u, "\u{10132}");
-f(/\P{scx=Linb}/u, "\u{10132}");
-t(/\p{scx=Linb}/u, "\u{10133}");
-f(/\P{scx=Linb}/u, "\u{10133}");
-f(/(?=\P{sc=Linb})\p{scx=Linb}/u, "\u{42fd8}");
-f(/(?=\P{sc=Linb})\p{scx=Linb}/u, "\u{5847b}");
-f(/(?=\P{sc=Linb})\p{scx=Linb}/u, "\u{71859}");
-f(/(?=\P{sc=Linb})\p{scx=Linb}/u, "\u{6b485}");
-f(/(?=\P{sc=Linb})\p{scx=Linb}/u, "\u{ba1f}");
+f(/(?=\P{sc=Linb})\p{scx=Linb}/u, "\u{568d4}");
+f(/(?=\P{sc=Linb})\p{scx=Linb}/u, "\u{b2730}");
+f(/(?=\P{sc=Linb})\p{scx=Linb}/u, "\u{783cd}");
+f(/(?=\P{sc=Linb})\p{scx=Linb}/u, "\u{65555}");
+f(/(?=\P{sc=Linb})\p{scx=Linb}/u, "\u{e8671}");
 // Script_Extension=Cyrl
-t(/\p{scx=Cyrl}/u, "\u{484}");
-f(/\P{scx=Cyrl}/u, "\u{484}");
-t(/\p{scx=Cyrl}/u, "\u{487}");
-f(/\P{scx=Cyrl}/u, "\u{487}");
-t(/\p{scx=Cyrl}/u, "\u{2e43}");
-f(/\P{scx=Cyrl}/u, "\u{2e43}");
-t(/\p{scx=Cyrl}/u, "\u{a66f}");
-f(/\P{scx=Cyrl}/u, "\u{a66f}");
-t(/\p{scx=Cyrl}/u, "\u{485}");
-f(/\P{scx=Cyrl}/u, "\u{485}");
-t(/\p{scx=Cyrl}/u, "\u{486}");
-f(/\P{scx=Cyrl}/u, "\u{486}");
-t(/\p{scx=Cyrl}/u, "\u{483}");
-f(/\P{scx=Cyrl}/u, "\u{483}");
-f(/(?=\P{sc=Cyrl})\p{scx=Cyrl}/u, "\u{a7c62}");
-f(/(?=\P{sc=Cyrl})\p{scx=Cyrl}/u, "\u{d4e8}");
-f(/(?=\P{sc=Cyrl})\p{scx=Cyrl}/u, "\u{95699}");
-f(/(?=\P{sc=Cyrl})\p{scx=Cyrl}/u, "\u{2175f}");
-f(/(?=\P{sc=Cyrl})\p{scx=Cyrl}/u, "\u{10000c}");
+f(/(?=\P{sc=Cyrl})\p{scx=Cyrl}/u, "\u{85d00}");
+f(/(?=\P{sc=Cyrl})\p{scx=Cyrl}/u, "\u{3bf7f}");
+f(/(?=\P{sc=Cyrl})\p{scx=Cyrl}/u, "\u{e18a0}");
+f(/(?=\P{sc=Cyrl})\p{scx=Cyrl}/u, "\u{b87b}");
+f(/(?=\P{sc=Cyrl})\p{scx=Cyrl}/u, "\u{79fa1}");
 // Script_Extension=Glag
-t(/\p{scx=Glag}/u, "\u{484}");
-f(/\P{scx=Glag}/u, "\u{484}");
-t(/\p{scx=Glag}/u, "\u{487}");
-f(/\P{scx=Glag}/u, "\u{487}");
-t(/\p{scx=Glag}/u, "\u{2e43}");
-f(/\P{scx=Glag}/u, "\u{2e43}");
-t(/\p{scx=Glag}/u, "\u{a66f}");
-f(/\P{scx=Glag}/u, "\u{a66f}");
-f(/(?=\P{sc=Glag})\p{scx=Glag}/u, "\u{bcabd}");
-f(/(?=\P{sc=Glag})\p{scx=Glag}/u, "\u{d05c1}");
-f(/(?=\P{sc=Glag})\p{scx=Glag}/u, "\u{b9e24}");
-f(/(?=\P{sc=Glag})\p{scx=Glag}/u, "\u{22e2e}");
-f(/(?=\P{sc=Glag})\p{scx=Glag}/u, "\u{d3d37}");
+f(/(?=\P{sc=Glag})\p{scx=Glag}/u, "\u{b13fe}");
+f(/(?=\P{sc=Glag})\p{scx=Glag}/u, "\u{a3bfd}");
+f(/(?=\P{sc=Glag})\p{scx=Glag}/u, "\u{a8c1d}");
+f(/(?=\P{sc=Glag})\p{scx=Glag}/u, "\u{d5d35}");
+f(/(?=\P{sc=Glag})\p{scx=Glag}/u, "\u{549bc}");
 // Script_Extension=Perm
-t(/\p{scx=Perm}/u, "\u{483}");
-f(/\P{scx=Perm}/u, "\u{483}");
-f(/(?=\P{sc=Perm})\p{scx=Perm}/u, "\u{10d33d}");
-f(/(?=\P{sc=Perm})\p{scx=Perm}/u, "\u{4c279}");
-f(/(?=\P{sc=Perm})\p{scx=Perm}/u, "\u{73666}");
-f(/(?=\P{sc=Perm})\p{scx=Perm}/u, "\u{2e79d}");
-f(/(?=\P{sc=Perm})\p{scx=Perm}/u, "\u{680f8}");
+f(/(?=\P{sc=Perm})\p{scx=Perm}/u, "\u{9702f}");
+f(/(?=\P{sc=Perm})\p{scx=Perm}/u, "\u{482b5}");
+f(/(?=\P{sc=Perm})\p{scx=Perm}/u, "\u{4e9ff}");
+f(/(?=\P{sc=Perm})\p{scx=Perm}/u, "\u{43858}");
+f(/(?=\P{sc=Perm})\p{scx=Perm}/u, "\u{f21da}");
 // Script_Extension=Gran
-t(/\p{scx=Gran}/u, "\u{1cd0}");
-f(/\P{scx=Gran}/u, "\u{1cd0}");
-t(/\p{scx=Gran}/u, "\u{1cd2}");
-f(/\P{scx=Gran}/u, "\u{1cd2}");
-t(/\p{scx=Gran}/u, "\u{1cd3}");
-f(/\P{scx=Gran}/u, "\u{1cd3}");
-t(/\p{scx=Gran}/u, "\u{1cf2}");
-f(/\P{scx=Gran}/u, "\u{1cf2}");
-t(/\p{scx=Gran}/u, "\u{1cf3}");
-f(/\P{scx=Gran}/u, "\u{1cf3}");
-t(/\p{scx=Gran}/u, "\u{1cf4}");
-f(/\P{scx=Gran}/u, "\u{1cf4}");
-t(/\p{scx=Gran}/u, "\u{1cf8}");
-f(/\P{scx=Gran}/u, "\u{1cf8}");
-t(/\p{scx=Gran}/u, "\u{1cf9}");
-f(/\P{scx=Gran}/u, "\u{1cf9}");
-t(/\p{scx=Gran}/u, "\u{baa}");
-f(/\P{scx=Gran}/u, "\u{baa}");
-t(/\p{scx=Gran}/u, "\u{bb5}");
-f(/\P{scx=Gran}/u, "\u{bb5}");
-t(/\p{scx=Gran}/u, "\u{be6}");
-f(/\P{scx=Gran}/u, "\u{be6}");
-t(/\p{scx=Gran}/u, "\u{be7}");
-f(/\P{scx=Gran}/u, "\u{be7}");
-t(/\p{scx=Gran}/u, "\u{be8}");
-f(/\P{scx=Gran}/u, "\u{be8}");
-t(/\p{scx=Gran}/u, "\u{be9}");
-f(/\P{scx=Gran}/u, "\u{be9}");
-t(/\p{scx=Gran}/u, "\u{bea}");
-f(/\P{scx=Gran}/u, "\u{bea}");
-t(/\p{scx=Gran}/u, "\u{beb}");
-f(/\P{scx=Gran}/u, "\u{beb}");
-t(/\p{scx=Gran}/u, "\u{bec}");
-f(/\P{scx=Gran}/u, "\u{bec}");
-t(/\p{scx=Gran}/u, "\u{bed}");
-f(/\P{scx=Gran}/u, "\u{bed}");
-t(/\p{scx=Gran}/u, "\u{bee}");
-f(/\P{scx=Gran}/u, "\u{bee}");
-t(/\p{scx=Gran}/u, "\u{bef}");
-f(/\P{scx=Gran}/u, "\u{bef}");
-t(/\p{scx=Gran}/u, "\u{bf0}");
-f(/\P{scx=Gran}/u, "\u{bf0}");
-t(/\p{scx=Gran}/u, "\u{bf1}");
-f(/\P{scx=Gran}/u, "\u{bf1}");
-t(/\p{scx=Gran}/u, "\u{bf2}");
-f(/\P{scx=Gran}/u, "\u{bf2}");
-t(/\p{scx=Gran}/u, "\u{11303}");
-f(/\P{scx=Gran}/u, "\u{11303}");
-t(/\p{scx=Gran}/u, "\u{1133c}");
-f(/\P{scx=Gran}/u, "\u{1133c}");
-t(/\p{scx=Gran}/u, "\u{20f0}");
-f(/\P{scx=Gran}/u, "\u{20f0}");
-t(/\p{scx=Gran}/u, "\u{952}");
-f(/\P{scx=Gran}/u, "\u{952}");
-t(/\p{scx=Gran}/u, "\u{951}");
-f(/\P{scx=Gran}/u, "\u{951}");
-t(/\p{scx=Gran}/u, "\u{964}");
-f(/\P{scx=Gran}/u, "\u{964}");
-t(/\p{scx=Gran}/u, "\u{965}");
-f(/\P{scx=Gran}/u, "\u{965}");
-f(/(?=\P{sc=Gran})\p{scx=Gran}/u, "\u{bb28a}");
-f(/(?=\P{sc=Gran})\p{scx=Gran}/u, "\u{ede3d}");
-f(/(?=\P{sc=Gran})\p{scx=Gran}/u, "\u{5a3a1}");
-f(/(?=\P{sc=Gran})\p{scx=Gran}/u, "\u{a9d70}");
-f(/(?=\P{sc=Gran})\p{scx=Gran}/u, "\u{d1d5e}");
+f(/(?=\P{sc=Gran})\p{scx=Gran}/u, "\u{3a8d}");
+f(/(?=\P{sc=Gran})\p{scx=Gran}/u, "\u{5f951}");
+f(/(?=\P{sc=Gran})\p{scx=Gran}/u, "\u{1007a2}");
+f(/(?=\P{sc=Gran})\p{scx=Gran}/u, "\u{c25ae}");
+f(/(?=\P{sc=Gran})\p{scx=Gran}/u, "\u{25a9e}");
 // Script_Extension=Knda
-t(/\p{scx=Knda}/u, "\u{1cf5}");
-f(/\P{scx=Knda}/u, "\u{1cf5}");
-t(/\p{scx=Knda}/u, "\u{1cda}");
-f(/\P{scx=Knda}/u, "\u{1cda}");
-t(/\p{scx=Knda}/u, "\u{a830}");
-f(/\P{scx=Knda}/u, "\u{a830}");
-t(/\p{scx=Knda}/u, "\u{a831}");
-f(/\P{scx=Knda}/u, "\u{a831}");
-t(/\p{scx=Knda}/u, "\u{a832}");
-f(/\P{scx=Knda}/u, "\u{a832}");
-t(/\p{scx=Knda}/u, "\u{a833}");
-f(/\P{scx=Knda}/u, "\u{a833}");
-t(/\p{scx=Knda}/u, "\u{a834}");
-f(/\P{scx=Knda}/u, "\u{a834}");
-t(/\p{scx=Knda}/u, "\u{a835}");
-f(/\P{scx=Knda}/u, "\u{a835}");
-t(/\p{scx=Knda}/u, "\u{952}");
-f(/\P{scx=Knda}/u, "\u{952}");
-t(/\p{scx=Knda}/u, "\u{951}");
-f(/\P{scx=Knda}/u, "\u{951}");
-t(/\p{scx=Knda}/u, "\u{964}");
-f(/\P{scx=Knda}/u, "\u{964}");
-t(/\p{scx=Knda}/u, "\u{965}");
-f(/\P{scx=Knda}/u, "\u{965}");
-f(/(?=\P{sc=Knda})\p{scx=Knda}/u, "\u{1571e}");
-f(/(?=\P{sc=Knda})\p{scx=Knda}/u, "\u{8e880}");
-f(/(?=\P{sc=Knda})\p{scx=Knda}/u, "\u{5995d}");
-f(/(?=\P{sc=Knda})\p{scx=Knda}/u, "\u{8516e}");
-f(/(?=\P{sc=Knda})\p{scx=Knda}/u, "\u{108a91}");
+f(/(?=\P{sc=Knda})\p{scx=Knda}/u, "\u{4a07}");
+f(/(?=\P{sc=Knda})\p{scx=Knda}/u, "\u{e128d}");
+f(/(?=\P{sc=Knda})\p{scx=Knda}/u, "\u{f2880}");
+f(/(?=\P{sc=Knda})\p{scx=Knda}/u, "\u{7643b}");
+f(/(?=\P{sc=Knda})\p{scx=Knda}/u, "\u{105a3b}");
 // Script_Extension=Shrd
-t(/\p{scx=Shrd}/u, "\u{1cd7}");
-f(/\P{scx=Shrd}/u, "\u{1cd7}");
-t(/\p{scx=Shrd}/u, "\u{1cd9}");
-f(/\P{scx=Shrd}/u, "\u{1cd9}");
-t(/\p{scx=Shrd}/u, "\u{1cdc}");
-f(/\P{scx=Shrd}/u, "\u{1cdc}");
-t(/\p{scx=Shrd}/u, "\u{1cdd}");
-f(/\P{scx=Shrd}/u, "\u{1cdd}");
-t(/\p{scx=Shrd}/u, "\u{1ce0}");
-f(/\P{scx=Shrd}/u, "\u{1ce0}");
-t(/\p{scx=Shrd}/u, "\u{951}");
-f(/\P{scx=Shrd}/u, "\u{951}");
-f(/(?=\P{sc=Shrd})\p{scx=Shrd}/u, "\u{5c32b}");
-f(/(?=\P{sc=Shrd})\p{scx=Shrd}/u, "\u{10fe3a}");
-f(/(?=\P{sc=Shrd})\p{scx=Shrd}/u, "\u{4e2d9}");
-f(/(?=\P{sc=Shrd})\p{scx=Shrd}/u, "\u{ea40}");
-f(/(?=\P{sc=Shrd})\p{scx=Shrd}/u, "\u{cc847}");
+f(/(?=\P{sc=Shrd})\p{scx=Shrd}/u, "\u{22e84}");
+f(/(?=\P{sc=Shrd})\p{scx=Shrd}/u, "\u{aee2}");
+f(/(?=\P{sc=Shrd})\p{scx=Shrd}/u, "\u{cf578}");
+f(/(?=\P{sc=Shrd})\p{scx=Shrd}/u, "\u{a7369}");
+f(/(?=\P{sc=Shrd})\p{scx=Shrd}/u, "\u{cd94d}");
 // Script_Extension=Taml
-t(/\p{scx=Taml}/u, "\u{a8f3}");
-f(/\P{scx=Taml}/u, "\u{a8f3}");
-t(/\p{scx=Taml}/u, "\u{baa}");
-f(/\P{scx=Taml}/u, "\u{baa}");
-t(/\p{scx=Taml}/u, "\u{bb5}");
-f(/\P{scx=Taml}/u, "\u{bb5}");
-t(/\p{scx=Taml}/u, "\u{be6}");
-f(/\P{scx=Taml}/u, "\u{be6}");
-t(/\p{scx=Taml}/u, "\u{be7}");
-f(/\P{scx=Taml}/u, "\u{be7}");
-t(/\p{scx=Taml}/u, "\u{be8}");
-f(/\P{scx=Taml}/u, "\u{be8}");
-t(/\p{scx=Taml}/u, "\u{be9}");
-f(/\P{scx=Taml}/u, "\u{be9}");
-t(/\p{scx=Taml}/u, "\u{bea}");
-f(/\P{scx=Taml}/u, "\u{bea}");
-t(/\p{scx=Taml}/u, "\u{beb}");
-f(/\P{scx=Taml}/u, "\u{beb}");
-t(/\p{scx=Taml}/u, "\u{bec}");
-f(/\P{scx=Taml}/u, "\u{bec}");
-t(/\p{scx=Taml}/u, "\u{bed}");
-f(/\P{scx=Taml}/u, "\u{bed}");
-t(/\p{scx=Taml}/u, "\u{bee}");
-f(/\P{scx=Taml}/u, "\u{bee}");
-t(/\p{scx=Taml}/u, "\u{bef}");
-f(/\P{scx=Taml}/u, "\u{bef}");
-t(/\p{scx=Taml}/u, "\u{bf0}");
-f(/\P{scx=Taml}/u, "\u{bf0}");
-t(/\p{scx=Taml}/u, "\u{bf1}");
-f(/\P{scx=Taml}/u, "\u{bf1}");
-t(/\p{scx=Taml}/u, "\u{bf2}");
-f(/\P{scx=Taml}/u, "\u{bf2}");
-t(/\p{scx=Taml}/u, "\u{11303}");
-f(/\P{scx=Taml}/u, "\u{11303}");
-t(/\p{scx=Taml}/u, "\u{1133c}");
-f(/\P{scx=Taml}/u, "\u{1133c}");
-t(/\p{scx=Taml}/u, "\u{1cda}");
-f(/\P{scx=Taml}/u, "\u{1cda}");
-t(/\p{scx=Taml}/u, "\u{952}");
-f(/\P{scx=Taml}/u, "\u{952}");
-t(/\p{scx=Taml}/u, "\u{951}");
-f(/\P{scx=Taml}/u, "\u{951}");
-t(/\p{scx=Taml}/u, "\u{964}");
-f(/\P{scx=Taml}/u, "\u{964}");
-t(/\p{scx=Taml}/u, "\u{965}");
-f(/\P{scx=Taml}/u, "\u{965}");
-f(/(?=\P{sc=Taml})\p{scx=Taml}/u, "\u{cd2c8}");
-f(/(?=\P{sc=Taml})\p{scx=Taml}/u, "\u{3b11}");
-f(/(?=\P{sc=Taml})\p{scx=Taml}/u, "\u{4c056}");
-f(/(?=\P{sc=Taml})\p{scx=Taml}/u, "\u{f32f7}");
-f(/(?=\P{sc=Taml})\p{scx=Taml}/u, "\u{b753f}");
+f(/(?=\P{sc=Taml})\p{scx=Taml}/u, "\u{47bf9}");
+f(/(?=\P{sc=Taml})\p{scx=Taml}/u, "\u{1064eb}");
+f(/(?=\P{sc=Taml})\p{scx=Taml}/u, "\u{33b58}");
+f(/(?=\P{sc=Taml})\p{scx=Taml}/u, "\u{28884}");
+f(/(?=\P{sc=Taml})\p{scx=Taml}/u, "\u{4bee2}");
 // Script_Extension=Gujr
-t(/\p{scx=Gujr}/u, "\u{ae6}");
-f(/\P{scx=Gujr}/u, "\u{ae6}");
-t(/\p{scx=Gujr}/u, "\u{ae7}");
-f(/\P{scx=Gujr}/u, "\u{ae7}");
-t(/\p{scx=Gujr}/u, "\u{ae8}");
-f(/\P{scx=Gujr}/u, "\u{ae8}");
-t(/\p{scx=Gujr}/u, "\u{ae9}");
-f(/\P{scx=Gujr}/u, "\u{ae9}");
-t(/\p{scx=Gujr}/u, "\u{aea}");
-f(/\P{scx=Gujr}/u, "\u{aea}");
-t(/\p{scx=Gujr}/u, "\u{aeb}");
-f(/\P{scx=Gujr}/u, "\u{aeb}");
-t(/\p{scx=Gujr}/u, "\u{aec}");
-f(/\P{scx=Gujr}/u, "\u{aec}");
-t(/\p{scx=Gujr}/u, "\u{aed}");
-f(/\P{scx=Gujr}/u, "\u{aed}");
-t(/\p{scx=Gujr}/u, "\u{aee}");
-f(/\P{scx=Gujr}/u, "\u{aee}");
-t(/\p{scx=Gujr}/u, "\u{aef}");
-f(/\P{scx=Gujr}/u, "\u{aef}");
-t(/\p{scx=Gujr}/u, "\u{a836}");
-f(/\P{scx=Gujr}/u, "\u{a836}");
-t(/\p{scx=Gujr}/u, "\u{a837}");
-f(/\P{scx=Gujr}/u, "\u{a837}");
-t(/\p{scx=Gujr}/u, "\u{a838}");
-f(/\P{scx=Gujr}/u, "\u{a838}");
-t(/\p{scx=Gujr}/u, "\u{a839}");
-f(/\P{scx=Gujr}/u, "\u{a839}");
-t(/\p{scx=Gujr}/u, "\u{a830}");
-f(/\P{scx=Gujr}/u, "\u{a830}");
-t(/\p{scx=Gujr}/u, "\u{a831}");
-f(/\P{scx=Gujr}/u, "\u{a831}");
-t(/\p{scx=Gujr}/u, "\u{a832}");
-f(/\P{scx=Gujr}/u, "\u{a832}");
-t(/\p{scx=Gujr}/u, "\u{a833}");
-f(/\P{scx=Gujr}/u, "\u{a833}");
-t(/\p{scx=Gujr}/u, "\u{a834}");
-f(/\P{scx=Gujr}/u, "\u{a834}");
-t(/\p{scx=Gujr}/u, "\u{a835}");
-f(/\P{scx=Gujr}/u, "\u{a835}");
-t(/\p{scx=Gujr}/u, "\u{952}");
-f(/\P{scx=Gujr}/u, "\u{952}");
-t(/\p{scx=Gujr}/u, "\u{951}");
-f(/\P{scx=Gujr}/u, "\u{951}");
-t(/\p{scx=Gujr}/u, "\u{964}");
-f(/\P{scx=Gujr}/u, "\u{964}");
-t(/\p{scx=Gujr}/u, "\u{965}");
-f(/\P{scx=Gujr}/u, "\u{965}");
-f(/(?=\P{sc=Gujr})\p{scx=Gujr}/u, "\u{6e146}");
-f(/(?=\P{sc=Gujr})\p{scx=Gujr}/u, "\u{6c1e2}");
-f(/(?=\P{sc=Gujr})\p{scx=Gujr}/u, "\u{122b2}");
-f(/(?=\P{sc=Gujr})\p{scx=Gujr}/u, "\u{1084c8}");
-f(/(?=\P{sc=Gujr})\p{scx=Gujr}/u, "\u{e13be}");
+f(/(?=\P{sc=Gujr})\p{scx=Gujr}/u, "\u{82ad7}");
+f(/(?=\P{sc=Gujr})\p{scx=Gujr}/u, "\u{ab492}");
+f(/(?=\P{sc=Gujr})\p{scx=Gujr}/u, "\u{a27c8}");
+f(/(?=\P{sc=Gujr})\p{scx=Gujr}/u, "\u{66750}");
+f(/(?=\P{sc=Gujr})\p{scx=Gujr}/u, "\u{3bc29}");
 // Script_Extension=Khoj
-t(/\p{scx=Khoj}/u, "\u{ae6}");
-f(/\P{scx=Khoj}/u, "\u{ae6}");
-t(/\p{scx=Khoj}/u, "\u{ae7}");
-f(/\P{scx=Khoj}/u, "\u{ae7}");
-t(/\p{scx=Khoj}/u, "\u{ae8}");
-f(/\P{scx=Khoj}/u, "\u{ae8}");
-t(/\p{scx=Khoj}/u, "\u{ae9}");
-f(/\P{scx=Khoj}/u, "\u{ae9}");
-t(/\p{scx=Khoj}/u, "\u{aea}");
-f(/\P{scx=Khoj}/u, "\u{aea}");
-t(/\p{scx=Khoj}/u, "\u{aeb}");
-f(/\P{scx=Khoj}/u, "\u{aeb}");
-t(/\p{scx=Khoj}/u, "\u{aec}");
-f(/\P{scx=Khoj}/u, "\u{aec}");
-t(/\p{scx=Khoj}/u, "\u{aed}");
-f(/\P{scx=Khoj}/u, "\u{aed}");
-t(/\p{scx=Khoj}/u, "\u{aee}");
-f(/\P{scx=Khoj}/u, "\u{aee}");
-t(/\p{scx=Khoj}/u, "\u{aef}");
-f(/\P{scx=Khoj}/u, "\u{aef}");
-f(/(?=\P{sc=Khoj})\p{scx=Khoj}/u, "\u{54d2e}");
-f(/(?=\P{sc=Khoj})\p{scx=Khoj}/u, "\u{7f810}");
-f(/(?=\P{sc=Khoj})\p{scx=Khoj}/u, "\u{1b6a5}");
-f(/(?=\P{sc=Khoj})\p{scx=Khoj}/u, "\u{25b08}");
-f(/(?=\P{sc=Khoj})\p{scx=Khoj}/u, "\u{3f5a4}");
+f(/(?=\P{sc=Khoj})\p{scx=Khoj}/u, "\u{e72d5}");
+f(/(?=\P{sc=Khoj})\p{scx=Khoj}/u, "\u{ce3f5}");
+f(/(?=\P{sc=Khoj})\p{scx=Khoj}/u, "\u{ec31b}");
+f(/(?=\P{sc=Khoj})\p{scx=Khoj}/u, "\u{57e80}");
+f(/(?=\P{sc=Khoj})\p{scx=Khoj}/u, "\u{60009}");
 // Script_Extension=Guru
-t(/\p{scx=Guru}/u, "\u{a66}");
-f(/\P{scx=Guru}/u, "\u{a66}");
-t(/\p{scx=Guru}/u, "\u{a67}");
-f(/\P{scx=Guru}/u, "\u{a67}");
-t(/\p{scx=Guru}/u, "\u{a68}");
-f(/\P{scx=Guru}/u, "\u{a68}");
-t(/\p{scx=Guru}/u, "\u{a69}");
-f(/\P{scx=Guru}/u, "\u{a69}");
-t(/\p{scx=Guru}/u, "\u{a6a}");
-f(/\P{scx=Guru}/u, "\u{a6a}");
-t(/\p{scx=Guru}/u, "\u{a6b}");
-f(/\P{scx=Guru}/u, "\u{a6b}");
-t(/\p{scx=Guru}/u, "\u{a6c}");
-f(/\P{scx=Guru}/u, "\u{a6c}");
-t(/\p{scx=Guru}/u, "\u{a6d}");
-f(/\P{scx=Guru}/u, "\u{a6d}");
-t(/\p{scx=Guru}/u, "\u{a6e}");
-f(/\P{scx=Guru}/u, "\u{a6e}");
-t(/\p{scx=Guru}/u, "\u{a6f}");
-f(/\P{scx=Guru}/u, "\u{a6f}");
-t(/\p{scx=Guru}/u, "\u{a836}");
-f(/\P{scx=Guru}/u, "\u{a836}");
-t(/\p{scx=Guru}/u, "\u{a837}");
-f(/\P{scx=Guru}/u, "\u{a837}");
-t(/\p{scx=Guru}/u, "\u{a838}");
-f(/\P{scx=Guru}/u, "\u{a838}");
-t(/\p{scx=Guru}/u, "\u{a839}");
-f(/\P{scx=Guru}/u, "\u{a839}");
-t(/\p{scx=Guru}/u, "\u{a830}");
-f(/\P{scx=Guru}/u, "\u{a830}");
-t(/\p{scx=Guru}/u, "\u{a831}");
-f(/\P{scx=Guru}/u, "\u{a831}");
-t(/\p{scx=Guru}/u, "\u{a832}");
-f(/\P{scx=Guru}/u, "\u{a832}");
-t(/\p{scx=Guru}/u, "\u{a833}");
-f(/\P{scx=Guru}/u, "\u{a833}");
-t(/\p{scx=Guru}/u, "\u{a834}");
-f(/\P{scx=Guru}/u, "\u{a834}");
-t(/\p{scx=Guru}/u, "\u{a835}");
-f(/\P{scx=Guru}/u, "\u{a835}");
-t(/\p{scx=Guru}/u, "\u{952}");
-f(/\P{scx=Guru}/u, "\u{952}");
-t(/\p{scx=Guru}/u, "\u{951}");
-f(/\P{scx=Guru}/u, "\u{951}");
-t(/\p{scx=Guru}/u, "\u{964}");
-f(/\P{scx=Guru}/u, "\u{964}");
-t(/\p{scx=Guru}/u, "\u{965}");
-f(/\P{scx=Guru}/u, "\u{965}");
-f(/(?=\P{sc=Guru})\p{scx=Guru}/u, "\u{c01ee}");
-f(/(?=\P{sc=Guru})\p{scx=Guru}/u, "\u{8b95a}");
-f(/(?=\P{sc=Guru})\p{scx=Guru}/u, "\u{bf5a}");
-f(/(?=\P{sc=Guru})\p{scx=Guru}/u, "\u{171c5}");
-f(/(?=\P{sc=Guru})\p{scx=Guru}/u, "\u{89de9}");
+f(/(?=\P{sc=Guru})\p{scx=Guru}/u, "\u{7ffed}");
+f(/(?=\P{sc=Guru})\p{scx=Guru}/u, "\u{82048}");
+f(/(?=\P{sc=Guru})\p{scx=Guru}/u, "\u{502a7}");
+f(/(?=\P{sc=Guru})\p{scx=Guru}/u, "\u{7b0e6}");
+f(/(?=\P{sc=Guru})\p{scx=Guru}/u, "\u{9416e}");
 // Script_Extension=Mult
-t(/\p{scx=Mult}/u, "\u{a66}");
-f(/\P{scx=Mult}/u, "\u{a66}");
-t(/\p{scx=Mult}/u, "\u{a67}");
-f(/\P{scx=Mult}/u, "\u{a67}");
-t(/\p{scx=Mult}/u, "\u{a68}");
-f(/\P{scx=Mult}/u, "\u{a68}");
-t(/\p{scx=Mult}/u, "\u{a69}");
-f(/\P{scx=Mult}/u, "\u{a69}");
-t(/\p{scx=Mult}/u, "\u{a6a}");
-f(/\P{scx=Mult}/u, "\u{a6a}");
-t(/\p{scx=Mult}/u, "\u{a6b}");
-f(/\P{scx=Mult}/u, "\u{a6b}");
-t(/\p{scx=Mult}/u, "\u{a6c}");
-f(/\P{scx=Mult}/u, "\u{a6c}");
-t(/\p{scx=Mult}/u, "\u{a6d}");
-f(/\P{scx=Mult}/u, "\u{a6d}");
-t(/\p{scx=Mult}/u, "\u{a6e}");
-f(/\P{scx=Mult}/u, "\u{a6e}");
-t(/\p{scx=Mult}/u, "\u{a6f}");
-f(/\P{scx=Mult}/u, "\u{a6f}");
-f(/(?=\P{sc=Mult})\p{scx=Mult}/u, "\u{cb98f}");
-f(/(?=\P{sc=Mult})\p{scx=Mult}/u, "\u{d30de}");
-f(/(?=\P{sc=Mult})\p{scx=Mult}/u, "\u{5d609}");
-f(/(?=\P{sc=Mult})\p{scx=Mult}/u, "\u{935d8}");
-f(/(?=\P{sc=Mult})\p{scx=Mult}/u, "\u{72f8e}");
+f(/(?=\P{sc=Mult})\p{scx=Mult}/u, "\u{4f15d}");
+f(/(?=\P{sc=Mult})\p{scx=Mult}/u, "\u{cd3cd}");
+f(/(?=\P{sc=Mult})\p{scx=Mult}/u, "\u{7f24d}");
+f(/(?=\P{sc=Mult})\p{scx=Mult}/u, "\u{4e181}");
+f(/(?=\P{sc=Mult})\p{scx=Mult}/u, "\u{2a651}");
 // Script_Extension=Hira
-t(/\p{scx=Hira}/u, "\u{3031}");
-f(/\P{scx=Hira}/u, "\u{3031}");
-t(/\p{scx=Hira}/u, "\u{3032}");
-f(/\P{scx=Hira}/u, "\u{3032}");
-t(/\p{scx=Hira}/u, "\u{3033}");
-f(/\P{scx=Hira}/u, "\u{3033}");
-t(/\p{scx=Hira}/u, "\u{3034}");
-f(/\P{scx=Hira}/u, "\u{3034}");
-t(/\p{scx=Hira}/u, "\u{3035}");
-f(/\P{scx=Hira}/u, "\u{3035}");
-t(/\p{scx=Hira}/u, "\u{3099}");
-f(/\P{scx=Hira}/u, "\u{3099}");
-t(/\p{scx=Hira}/u, "\u{309a}");
-f(/\P{scx=Hira}/u, "\u{309a}");
-t(/\p{scx=Hira}/u, "\u{309b}");
-f(/\P{scx=Hira}/u, "\u{309b}");
-t(/\p{scx=Hira}/u, "\u{309c}");
-f(/\P{scx=Hira}/u, "\u{309c}");
-t(/\p{scx=Hira}/u, "\u{30a0}");
-f(/\P{scx=Hira}/u, "\u{30a0}");
-t(/\p{scx=Hira}/u, "\u{30fc}");
-f(/\P{scx=Hira}/u, "\u{30fc}");
-t(/\p{scx=Hira}/u, "\u{ff70}");
-f(/\P{scx=Hira}/u, "\u{ff70}");
-t(/\p{scx=Hira}/u, "\u{ff9e}");
-f(/\P{scx=Hira}/u, "\u{ff9e}");
-t(/\p{scx=Hira}/u, "\u{ff9f}");
-f(/\P{scx=Hira}/u, "\u{ff9f}");
-t(/\p{scx=Hira}/u, "\u{303c}");
-f(/\P{scx=Hira}/u, "\u{303c}");
-t(/\p{scx=Hira}/u, "\u{303d}");
-f(/\P{scx=Hira}/u, "\u{303d}");
-t(/\p{scx=Hira}/u, "\u{3003}");
-f(/\P{scx=Hira}/u, "\u{3003}");
-t(/\p{scx=Hira}/u, "\u{3013}");
-f(/\P{scx=Hira}/u, "\u{3013}");
-t(/\p{scx=Hira}/u, "\u{301c}");
-f(/\P{scx=Hira}/u, "\u{301c}");
-t(/\p{scx=Hira}/u, "\u{301d}");
-f(/\P{scx=Hira}/u, "\u{301d}");
-t(/\p{scx=Hira}/u, "\u{301e}");
-f(/\P{scx=Hira}/u, "\u{301e}");
-t(/\p{scx=Hira}/u, "\u{301f}");
-f(/\P{scx=Hira}/u, "\u{301f}");
-t(/\p{scx=Hira}/u, "\u{3030}");
-f(/\P{scx=Hira}/u, "\u{3030}");
-t(/\p{scx=Hira}/u, "\u{3037}");
-f(/\P{scx=Hira}/u, "\u{3037}");
-t(/\p{scx=Hira}/u, "\u{fe45}");
-f(/\P{scx=Hira}/u, "\u{fe45}");
-t(/\p{scx=Hira}/u, "\u{fe46}");
-f(/\P{scx=Hira}/u, "\u{fe46}");
-t(/\p{scx=Hira}/u, "\u{3001}");
-f(/\P{scx=Hira}/u, "\u{3001}");
-t(/\p{scx=Hira}/u, "\u{3002}");
-f(/\P{scx=Hira}/u, "\u{3002}");
-t(/\p{scx=Hira}/u, "\u{3008}");
-f(/\P{scx=Hira}/u, "\u{3008}");
-t(/\p{scx=Hira}/u, "\u{3009}");
-f(/\P{scx=Hira}/u, "\u{3009}");
-t(/\p{scx=Hira}/u, "\u{300a}");
-f(/\P{scx=Hira}/u, "\u{300a}");
-t(/\p{scx=Hira}/u, "\u{300b}");
-f(/\P{scx=Hira}/u, "\u{300b}");
-t(/\p{scx=Hira}/u, "\u{300c}");
-f(/\P{scx=Hira}/u, "\u{300c}");
-t(/\p{scx=Hira}/u, "\u{300d}");
-f(/\P{scx=Hira}/u, "\u{300d}");
-t(/\p{scx=Hira}/u, "\u{300e}");
-f(/\P{scx=Hira}/u, "\u{300e}");
-t(/\p{scx=Hira}/u, "\u{300f}");
-f(/\P{scx=Hira}/u, "\u{300f}");
-t(/\p{scx=Hira}/u, "\u{3010}");
-f(/\P{scx=Hira}/u, "\u{3010}");
-t(/\p{scx=Hira}/u, "\u{3011}");
-f(/\P{scx=Hira}/u, "\u{3011}");
-t(/\p{scx=Hira}/u, "\u{3014}");
-f(/\P{scx=Hira}/u, "\u{3014}");
-t(/\p{scx=Hira}/u, "\u{3015}");
-f(/\P{scx=Hira}/u, "\u{3015}");
-t(/\p{scx=Hira}/u, "\u{3016}");
-f(/\P{scx=Hira}/u, "\u{3016}");
-t(/\p{scx=Hira}/u, "\u{3017}");
-f(/\P{scx=Hira}/u, "\u{3017}");
-t(/\p{scx=Hira}/u, "\u{3018}");
-f(/\P{scx=Hira}/u, "\u{3018}");
-t(/\p{scx=Hira}/u, "\u{3019}");
-f(/\P{scx=Hira}/u, "\u{3019}");
-t(/\p{scx=Hira}/u, "\u{301a}");
-f(/\P{scx=Hira}/u, "\u{301a}");
-t(/\p{scx=Hira}/u, "\u{301b}");
-f(/\P{scx=Hira}/u, "\u{301b}");
-t(/\p{scx=Hira}/u, "\u{30fb}");
-f(/\P{scx=Hira}/u, "\u{30fb}");
-t(/\p{scx=Hira}/u, "\u{ff61}");
-f(/\P{scx=Hira}/u, "\u{ff61}");
-t(/\p{scx=Hira}/u, "\u{ff62}");
-f(/\P{scx=Hira}/u, "\u{ff62}");
-t(/\p{scx=Hira}/u, "\u{ff63}");
-f(/\P{scx=Hira}/u, "\u{ff63}");
-t(/\p{scx=Hira}/u, "\u{ff64}");
-f(/\P{scx=Hira}/u, "\u{ff64}");
-t(/\p{scx=Hira}/u, "\u{ff65}");
-f(/\P{scx=Hira}/u, "\u{ff65}");
-f(/(?=\P{sc=Hira})\p{scx=Hira}/u, "\u{e76fe}");
-f(/(?=\P{sc=Hira})\p{scx=Hira}/u, "\u{53a36}");
-f(/(?=\P{sc=Hira})\p{scx=Hira}/u, "\u{acd83}");
-f(/(?=\P{sc=Hira})\p{scx=Hira}/u, "\u{b4cab}");
-f(/(?=\P{sc=Hira})\p{scx=Hira}/u, "\u{e9807}");
+f(/(?=\P{sc=Hira})\p{scx=Hira}/u, "\u{22465}");
+f(/(?=\P{sc=Hira})\p{scx=Hira}/u, "\u{c5418}");
+f(/(?=\P{sc=Hira})\p{scx=Hira}/u, "\u{977b5}");
+f(/(?=\P{sc=Hira})\p{scx=Hira}/u, "\u{f2219}");
+f(/(?=\P{sc=Hira})\p{scx=Hira}/u, "\u{2be9a}");
 // Script_Extension=Kana
-t(/\p{scx=Kana}/u, "\u{3031}");
-f(/\P{scx=Kana}/u, "\u{3031}");
-t(/\p{scx=Kana}/u, "\u{3032}");
-f(/\P{scx=Kana}/u, "\u{3032}");
-t(/\p{scx=Kana}/u, "\u{3033}");
-f(/\P{scx=Kana}/u, "\u{3033}");
-t(/\p{scx=Kana}/u, "\u{3034}");
-f(/\P{scx=Kana}/u, "\u{3034}");
-t(/\p{scx=Kana}/u, "\u{3035}");
-f(/\P{scx=Kana}/u, "\u{3035}");
-t(/\p{scx=Kana}/u, "\u{3099}");
-f(/\P{scx=Kana}/u, "\u{3099}");
-t(/\p{scx=Kana}/u, "\u{309a}");
-f(/\P{scx=Kana}/u, "\u{309a}");
-t(/\p{scx=Kana}/u, "\u{309b}");
-f(/\P{scx=Kana}/u, "\u{309b}");
-t(/\p{scx=Kana}/u, "\u{309c}");
-f(/\P{scx=Kana}/u, "\u{309c}");
-t(/\p{scx=Kana}/u, "\u{30a0}");
-f(/\P{scx=Kana}/u, "\u{30a0}");
-t(/\p{scx=Kana}/u, "\u{30fc}");
-f(/\P{scx=Kana}/u, "\u{30fc}");
-t(/\p{scx=Kana}/u, "\u{ff70}");
-f(/\P{scx=Kana}/u, "\u{ff70}");
-t(/\p{scx=Kana}/u, "\u{ff9e}");
-f(/\P{scx=Kana}/u, "\u{ff9e}");
-t(/\p{scx=Kana}/u, "\u{ff9f}");
-f(/\P{scx=Kana}/u, "\u{ff9f}");
-t(/\p{scx=Kana}/u, "\u{303c}");
-f(/\P{scx=Kana}/u, "\u{303c}");
-t(/\p{scx=Kana}/u, "\u{303d}");
-f(/\P{scx=Kana}/u, "\u{303d}");
-t(/\p{scx=Kana}/u, "\u{3003}");
-f(/\P{scx=Kana}/u, "\u{3003}");
-t(/\p{scx=Kana}/u, "\u{3013}");
-f(/\P{scx=Kana}/u, "\u{3013}");
-t(/\p{scx=Kana}/u, "\u{301c}");
-f(/\P{scx=Kana}/u, "\u{301c}");
-t(/\p{scx=Kana}/u, "\u{301d}");
-f(/\P{scx=Kana}/u, "\u{301d}");
-t(/\p{scx=Kana}/u, "\u{301e}");
-f(/\P{scx=Kana}/u, "\u{301e}");
-t(/\p{scx=Kana}/u, "\u{301f}");
-f(/\P{scx=Kana}/u, "\u{301f}");
-t(/\p{scx=Kana}/u, "\u{3030}");
-f(/\P{scx=Kana}/u, "\u{3030}");
-t(/\p{scx=Kana}/u, "\u{3037}");
-f(/\P{scx=Kana}/u, "\u{3037}");
-t(/\p{scx=Kana}/u, "\u{fe45}");
-f(/\P{scx=Kana}/u, "\u{fe45}");
-t(/\p{scx=Kana}/u, "\u{fe46}");
-f(/\P{scx=Kana}/u, "\u{fe46}");
-t(/\p{scx=Kana}/u, "\u{3001}");
-f(/\P{scx=Kana}/u, "\u{3001}");
-t(/\p{scx=Kana}/u, "\u{3002}");
-f(/\P{scx=Kana}/u, "\u{3002}");
-t(/\p{scx=Kana}/u, "\u{3008}");
-f(/\P{scx=Kana}/u, "\u{3008}");
-t(/\p{scx=Kana}/u, "\u{3009}");
-f(/\P{scx=Kana}/u, "\u{3009}");
-t(/\p{scx=Kana}/u, "\u{300a}");
-f(/\P{scx=Kana}/u, "\u{300a}");
-t(/\p{scx=Kana}/u, "\u{300b}");
-f(/\P{scx=Kana}/u, "\u{300b}");
-t(/\p{scx=Kana}/u, "\u{300c}");
-f(/\P{scx=Kana}/u, "\u{300c}");
-t(/\p{scx=Kana}/u, "\u{300d}");
-f(/\P{scx=Kana}/u, "\u{300d}");
-t(/\p{scx=Kana}/u, "\u{300e}");
-f(/\P{scx=Kana}/u, "\u{300e}");
-t(/\p{scx=Kana}/u, "\u{300f}");
-f(/\P{scx=Kana}/u, "\u{300f}");
-t(/\p{scx=Kana}/u, "\u{3010}");
-f(/\P{scx=Kana}/u, "\u{3010}");
-t(/\p{scx=Kana}/u, "\u{3011}");
-f(/\P{scx=Kana}/u, "\u{3011}");
-t(/\p{scx=Kana}/u, "\u{3014}");
-f(/\P{scx=Kana}/u, "\u{3014}");
-t(/\p{scx=Kana}/u, "\u{3015}");
-f(/\P{scx=Kana}/u, "\u{3015}");
-t(/\p{scx=Kana}/u, "\u{3016}");
-f(/\P{scx=Kana}/u, "\u{3016}");
-t(/\p{scx=Kana}/u, "\u{3017}");
-f(/\P{scx=Kana}/u, "\u{3017}");
-t(/\p{scx=Kana}/u, "\u{3018}");
-f(/\P{scx=Kana}/u, "\u{3018}");
-t(/\p{scx=Kana}/u, "\u{3019}");
-f(/\P{scx=Kana}/u, "\u{3019}");
-t(/\p{scx=Kana}/u, "\u{301a}");
-f(/\P{scx=Kana}/u, "\u{301a}");
-t(/\p{scx=Kana}/u, "\u{301b}");
-f(/\P{scx=Kana}/u, "\u{301b}");
-t(/\p{scx=Kana}/u, "\u{30fb}");
-f(/\P{scx=Kana}/u, "\u{30fb}");
-t(/\p{scx=Kana}/u, "\u{ff61}");
-f(/\P{scx=Kana}/u, "\u{ff61}");
-t(/\p{scx=Kana}/u, "\u{ff62}");
-f(/\P{scx=Kana}/u, "\u{ff62}");
-t(/\p{scx=Kana}/u, "\u{ff63}");
-f(/\P{scx=Kana}/u, "\u{ff63}");
-t(/\p{scx=Kana}/u, "\u{ff64}");
-f(/\P{scx=Kana}/u, "\u{ff64}");
-t(/\p{scx=Kana}/u, "\u{ff65}");
-f(/\P{scx=Kana}/u, "\u{ff65}");
-f(/(?=\P{sc=Kana})\p{scx=Kana}/u, "\u{62d2b}");
-f(/(?=\P{sc=Kana})\p{scx=Kana}/u, "\u{7fb02}");
-f(/(?=\P{sc=Kana})\p{scx=Kana}/u, "\u{272ad}");
-f(/(?=\P{sc=Kana})\p{scx=Kana}/u, "\u{d8eae}");
-f(/(?=\P{sc=Kana})\p{scx=Kana}/u, "\u{5ff06}");
+f(/(?=\P{sc=Kana})\p{scx=Kana}/u, "\u{a2db4}");
+f(/(?=\P{sc=Kana})\p{scx=Kana}/u, "\u{bc311}");
+f(/(?=\P{sc=Kana})\p{scx=Kana}/u, "\u{447b8}");
+f(/(?=\P{sc=Kana})\p{scx=Kana}/u, "\u{e4667}");
+f(/(?=\P{sc=Kana})\p{scx=Kana}/u, "\u{b5aac}");
 // Script_Extension=Mong
-t(/\p{scx=Mong}/u, "\u{1802}");
-f(/\P{scx=Mong}/u, "\u{1802}");
-t(/\p{scx=Mong}/u, "\u{1803}");
-f(/\P{scx=Mong}/u, "\u{1803}");
-t(/\p{scx=Mong}/u, "\u{1805}");
-f(/\P{scx=Mong}/u, "\u{1805}");
-f(/(?=\P{sc=Mong})\p{scx=Mong}/u, "\u{9b814}");
-f(/(?=\P{sc=Mong})\p{scx=Mong}/u, "\u{2dce3}");
-f(/(?=\P{sc=Mong})\p{scx=Mong}/u, "\u{2f969}");
-f(/(?=\P{sc=Mong})\p{scx=Mong}/u, "\u{10f87c}");
-f(/(?=\P{sc=Mong})\p{scx=Mong}/u, "\u{57d}");
+f(/(?=\P{sc=Mong})\p{scx=Mong}/u, "\u{7a208}");
+f(/(?=\P{sc=Mong})\p{scx=Mong}/u, "\u{da800}");
+f(/(?=\P{sc=Mong})\p{scx=Mong}/u, "\u{fbafa}");
+f(/(?=\P{sc=Mong})\p{scx=Mong}/u, "\u{b8421}");
+f(/(?=\P{sc=Mong})\p{scx=Mong}/u, "\u{10a54e}");
 // Script_Extension=Phag
-t(/\p{scx=Phag}/u, "\u{1802}");
-f(/\P{scx=Phag}/u, "\u{1802}");
-t(/\p{scx=Phag}/u, "\u{1803}");
-f(/\P{scx=Phag}/u, "\u{1803}");
-t(/\p{scx=Phag}/u, "\u{1805}");
-f(/\P{scx=Phag}/u, "\u{1805}");
-f(/(?=\P{sc=Phag})\p{scx=Phag}/u, "\u{aa326}");
-f(/(?=\P{sc=Phag})\p{scx=Phag}/u, "\u{ba8f3}");
-f(/(?=\P{sc=Phag})\p{scx=Phag}/u, "\u{2cc5d}");
-f(/(?=\P{sc=Phag})\p{scx=Phag}/u, "\u{f8f43}");
-f(/(?=\P{sc=Phag})\p{scx=Phag}/u, "\u{effbb}");
+f(/(?=\P{sc=Phag})\p{scx=Phag}/u, "\u{1580d}");
+f(/(?=\P{sc=Phag})\p{scx=Phag}/u, "\u{828b0}");
+f(/(?=\P{sc=Phag})\p{scx=Phag}/u, "\u{b60db}");
+f(/(?=\P{sc=Phag})\p{scx=Phag}/u, "\u{53ce1}");
+f(/(?=\P{sc=Phag})\p{scx=Phag}/u, "\u{a6e2b}");
 // Script_Extension=Cakm
-t(/\p{scx=Cakm}/u, "\u{9e6}");
-f(/\P{scx=Cakm}/u, "\u{9e6}");
-t(/\p{scx=Cakm}/u, "\u{9e7}");
-f(/\P{scx=Cakm}/u, "\u{9e7}");
-t(/\p{scx=Cakm}/u, "\u{9e8}");
-f(/\P{scx=Cakm}/u, "\u{9e8}");
-t(/\p{scx=Cakm}/u, "\u{9e9}");
-f(/\P{scx=Cakm}/u, "\u{9e9}");
-t(/\p{scx=Cakm}/u, "\u{9ea}");
-f(/\P{scx=Cakm}/u, "\u{9ea}");
-t(/\p{scx=Cakm}/u, "\u{9eb}");
-f(/\P{scx=Cakm}/u, "\u{9eb}");
-t(/\p{scx=Cakm}/u, "\u{9ec}");
-f(/\P{scx=Cakm}/u, "\u{9ec}");
-t(/\p{scx=Cakm}/u, "\u{9ed}");
-f(/\P{scx=Cakm}/u, "\u{9ed}");
-t(/\p{scx=Cakm}/u, "\u{9ee}");
-f(/\P{scx=Cakm}/u, "\u{9ee}");
-t(/\p{scx=Cakm}/u, "\u{9ef}");
-f(/\P{scx=Cakm}/u, "\u{9ef}");
-t(/\p{scx=Cakm}/u, "\u{1040}");
-f(/\P{scx=Cakm}/u, "\u{1040}");
-t(/\p{scx=Cakm}/u, "\u{1041}");
-f(/\P{scx=Cakm}/u, "\u{1041}");
-t(/\p{scx=Cakm}/u, "\u{1042}");
-f(/\P{scx=Cakm}/u, "\u{1042}");
-t(/\p{scx=Cakm}/u, "\u{1043}");
-f(/\P{scx=Cakm}/u, "\u{1043}");
-t(/\p{scx=Cakm}/u, "\u{1044}");
-f(/\P{scx=Cakm}/u, "\u{1044}");
-t(/\p{scx=Cakm}/u, "\u{1045}");
-f(/\P{scx=Cakm}/u, "\u{1045}");
-t(/\p{scx=Cakm}/u, "\u{1046}");
-f(/\P{scx=Cakm}/u, "\u{1046}");
-t(/\p{scx=Cakm}/u, "\u{1047}");
-f(/\P{scx=Cakm}/u, "\u{1047}");
-t(/\p{scx=Cakm}/u, "\u{1048}");
-f(/\P{scx=Cakm}/u, "\u{1048}");
-t(/\p{scx=Cakm}/u, "\u{1049}");
-f(/\P{scx=Cakm}/u, "\u{1049}");
-f(/(?=\P{sc=Cakm})\p{scx=Cakm}/u, "\u{f475a}");
-f(/(?=\P{sc=Cakm})\p{scx=Cakm}/u, "\u{7c476}");
-f(/(?=\P{sc=Cakm})\p{scx=Cakm}/u, "\u{10d135}");
-f(/(?=\P{sc=Cakm})\p{scx=Cakm}/u, "\u{9365b}");
-f(/(?=\P{sc=Cakm})\p{scx=Cakm}/u, "\u{363e5}");
+f(/(?=\P{sc=Cakm})\p{scx=Cakm}/u, "\u{a8dc9}");
+f(/(?=\P{sc=Cakm})\p{scx=Cakm}/u, "\u{6c8fb}");
+f(/(?=\P{sc=Cakm})\p{scx=Cakm}/u, "\u{d9a31}");
+f(/(?=\P{sc=Cakm})\p{scx=Cakm}/u, "\u{f643f}");
+f(/(?=\P{sc=Cakm})\p{scx=Cakm}/u, "\u{aaf87}");
 // Script_Extension=Sylo
-t(/\p{scx=Sylo}/u, "\u{9e6}");
-f(/\P{scx=Sylo}/u, "\u{9e6}");
-t(/\p{scx=Sylo}/u, "\u{9e7}");
-f(/\P{scx=Sylo}/u, "\u{9e7}");
-t(/\p{scx=Sylo}/u, "\u{9e8}");
-f(/\P{scx=Sylo}/u, "\u{9e8}");
-t(/\p{scx=Sylo}/u, "\u{9e9}");
-f(/\P{scx=Sylo}/u, "\u{9e9}");
-t(/\p{scx=Sylo}/u, "\u{9ea}");
-f(/\P{scx=Sylo}/u, "\u{9ea}");
-t(/\p{scx=Sylo}/u, "\u{9eb}");
-f(/\P{scx=Sylo}/u, "\u{9eb}");
-t(/\p{scx=Sylo}/u, "\u{9ec}");
-f(/\P{scx=Sylo}/u, "\u{9ec}");
-t(/\p{scx=Sylo}/u, "\u{9ed}");
-f(/\P{scx=Sylo}/u, "\u{9ed}");
-t(/\p{scx=Sylo}/u, "\u{9ee}");
-f(/\P{scx=Sylo}/u, "\u{9ee}");
-t(/\p{scx=Sylo}/u, "\u{9ef}");
-f(/\P{scx=Sylo}/u, "\u{9ef}");
-t(/\p{scx=Sylo}/u, "\u{964}");
-f(/\P{scx=Sylo}/u, "\u{964}");
-t(/\p{scx=Sylo}/u, "\u{965}");
-f(/\P{scx=Sylo}/u, "\u{965}");
-f(/(?=\P{sc=Sylo})\p{scx=Sylo}/u, "\u{b299f}");
-f(/(?=\P{sc=Sylo})\p{scx=Sylo}/u, "\u{10375e}");
-f(/(?=\P{sc=Sylo})\p{scx=Sylo}/u, "\u{ffbda}");
-f(/(?=\P{sc=Sylo})\p{scx=Sylo}/u, "\u{19058}");
-f(/(?=\P{sc=Sylo})\p{scx=Sylo}/u, "\u{461b8}");
+f(/(?=\P{sc=Sylo})\p{scx=Sylo}/u, "\u{7be3f}");
+f(/(?=\P{sc=Sylo})\p{scx=Sylo}/u, "\u{1a96}");
+f(/(?=\P{sc=Sylo})\p{scx=Sylo}/u, "\u{df39d}");
+f(/(?=\P{sc=Sylo})\p{scx=Sylo}/u, "\u{b2f9b}");
+f(/(?=\P{sc=Sylo})\p{scx=Sylo}/u, "\u{d41b6}");
 // Script_Extension=Mymr
-t(/\p{scx=Mymr}/u, "\u{1040}");
-f(/\P{scx=Mymr}/u, "\u{1040}");
-t(/\p{scx=Mymr}/u, "\u{1041}");
-f(/\P{scx=Mymr}/u, "\u{1041}");
-t(/\p{scx=Mymr}/u, "\u{1042}");
-f(/\P{scx=Mymr}/u, "\u{1042}");
-t(/\p{scx=Mymr}/u, "\u{1043}");
-f(/\P{scx=Mymr}/u, "\u{1043}");
-t(/\p{scx=Mymr}/u, "\u{1044}");
-f(/\P{scx=Mymr}/u, "\u{1044}");
-t(/\p{scx=Mymr}/u, "\u{1045}");
-f(/\P{scx=Mymr}/u, "\u{1045}");
-t(/\p{scx=Mymr}/u, "\u{1046}");
-f(/\P{scx=Mymr}/u, "\u{1046}");
-t(/\p{scx=Mymr}/u, "\u{1047}");
-f(/\P{scx=Mymr}/u, "\u{1047}");
-t(/\p{scx=Mymr}/u, "\u{1048}");
-f(/\P{scx=Mymr}/u, "\u{1048}");
-t(/\p{scx=Mymr}/u, "\u{1049}");
-f(/\P{scx=Mymr}/u, "\u{1049}");
-t(/\p{scx=Mymr}/u, "\u{a92e}");
-f(/\P{scx=Mymr}/u, "\u{a92e}");
-f(/(?=\P{sc=Mymr})\p{scx=Mymr}/u, "\u{103b42}");
-f(/(?=\P{sc=Mymr})\p{scx=Mymr}/u, "\u{71346}");
-f(/(?=\P{sc=Mymr})\p{scx=Mymr}/u, "\u{25259}");
-f(/(?=\P{sc=Mymr})\p{scx=Mymr}/u, "\u{469c5}");
-f(/(?=\P{sc=Mymr})\p{scx=Mymr}/u, "\u{faf0c}");
+f(/(?=\P{sc=Mymr})\p{scx=Mymr}/u, "\u{83733}");
+f(/(?=\P{sc=Mymr})\p{scx=Mymr}/u, "\u{65653}");
+f(/(?=\P{sc=Mymr})\p{scx=Mymr}/u, "\u{f05d8}");
+f(/(?=\P{sc=Mymr})\p{scx=Mymr}/u, "\u{d48a5}");
+f(/(?=\P{sc=Mymr})\p{scx=Mymr}/u, "\u{d028d}");
 // Script_Extension=Tale
-t(/\p{scx=Tale}/u, "\u{1040}");
-f(/\P{scx=Tale}/u, "\u{1040}");
-t(/\p{scx=Tale}/u, "\u{1041}");
-f(/\P{scx=Tale}/u, "\u{1041}");
-t(/\p{scx=Tale}/u, "\u{1042}");
-f(/\P{scx=Tale}/u, "\u{1042}");
-t(/\p{scx=Tale}/u, "\u{1043}");
-f(/\P{scx=Tale}/u, "\u{1043}");
-t(/\p{scx=Tale}/u, "\u{1044}");
-f(/\P{scx=Tale}/u, "\u{1044}");
-t(/\p{scx=Tale}/u, "\u{1045}");
-f(/\P{scx=Tale}/u, "\u{1045}");
-t(/\p{scx=Tale}/u, "\u{1046}");
-f(/\P{scx=Tale}/u, "\u{1046}");
-t(/\p{scx=Tale}/u, "\u{1047}");
-f(/\P{scx=Tale}/u, "\u{1047}");
-t(/\p{scx=Tale}/u, "\u{1048}");
-f(/\P{scx=Tale}/u, "\u{1048}");
-t(/\p{scx=Tale}/u, "\u{1049}");
-f(/\P{scx=Tale}/u, "\u{1049}");
-f(/(?=\P{sc=Tale})\p{scx=Tale}/u, "\u{1416e}");
-f(/(?=\P{sc=Tale})\p{scx=Tale}/u, "\u{ccc0}");
-f(/(?=\P{sc=Tale})\p{scx=Tale}/u, "\u{2a52f}");
-f(/(?=\P{sc=Tale})\p{scx=Tale}/u, "\u{47a2b}");
-f(/(?=\P{sc=Tale})\p{scx=Tale}/u, "\u{7752b}");
+f(/(?=\P{sc=Tale})\p{scx=Tale}/u, "\u{b15b8}");
+f(/(?=\P{sc=Tale})\p{scx=Tale}/u, "\u{d13dd}");
+f(/(?=\P{sc=Tale})\p{scx=Tale}/u, "\u{107e0d}");
+f(/(?=\P{sc=Tale})\p{scx=Tale}/u, "\u{72fa9}");
+f(/(?=\P{sc=Tale})\p{scx=Tale}/u, "\u{4ffc3}");
 // Script_Extension=Lina
-t(/\p{scx=Lina}/u, "\u{10107}");
-f(/\P{scx=Lina}/u, "\u{10107}");
-t(/\p{scx=Lina}/u, "\u{10108}");
-f(/\P{scx=Lina}/u, "\u{10108}");
-t(/\p{scx=Lina}/u, "\u{10109}");
-f(/\P{scx=Lina}/u, "\u{10109}");
-t(/\p{scx=Lina}/u, "\u{1010a}");
-f(/\P{scx=Lina}/u, "\u{1010a}");
-t(/\p{scx=Lina}/u, "\u{1010b}");
-f(/\P{scx=Lina}/u, "\u{1010b}");
-t(/\p{scx=Lina}/u, "\u{1010c}");
-f(/\P{scx=Lina}/u, "\u{1010c}");
-t(/\p{scx=Lina}/u, "\u{1010d}");
-f(/\P{scx=Lina}/u, "\u{1010d}");
-t(/\p{scx=Lina}/u, "\u{1010e}");
-f(/\P{scx=Lina}/u, "\u{1010e}");
-t(/\p{scx=Lina}/u, "\u{1010f}");
-f(/\P{scx=Lina}/u, "\u{1010f}");
-t(/\p{scx=Lina}/u, "\u{10110}");
-f(/\P{scx=Lina}/u, "\u{10110}");
-t(/\p{scx=Lina}/u, "\u{10111}");
-f(/\P{scx=Lina}/u, "\u{10111}");
-t(/\p{scx=Lina}/u, "\u{10112}");
-f(/\P{scx=Lina}/u, "\u{10112}");
-t(/\p{scx=Lina}/u, "\u{10113}");
-f(/\P{scx=Lina}/u, "\u{10113}");
-t(/\p{scx=Lina}/u, "\u{10114}");
-f(/\P{scx=Lina}/u, "\u{10114}");
-t(/\p{scx=Lina}/u, "\u{10115}");
-f(/\P{scx=Lina}/u, "\u{10115}");
-t(/\p{scx=Lina}/u, "\u{10116}");
-f(/\P{scx=Lina}/u, "\u{10116}");
-t(/\p{scx=Lina}/u, "\u{10117}");
-f(/\P{scx=Lina}/u, "\u{10117}");
-t(/\p{scx=Lina}/u, "\u{10118}");
-f(/\P{scx=Lina}/u, "\u{10118}");
-t(/\p{scx=Lina}/u, "\u{10119}");
-f(/\P{scx=Lina}/u, "\u{10119}");
-t(/\p{scx=Lina}/u, "\u{1011a}");
-f(/\P{scx=Lina}/u, "\u{1011a}");
-t(/\p{scx=Lina}/u, "\u{1011b}");
-f(/\P{scx=Lina}/u, "\u{1011b}");
-t(/\p{scx=Lina}/u, "\u{1011c}");
-f(/\P{scx=Lina}/u, "\u{1011c}");
-t(/\p{scx=Lina}/u, "\u{1011d}");
-f(/\P{scx=Lina}/u, "\u{1011d}");
-t(/\p{scx=Lina}/u, "\u{1011e}");
-f(/\P{scx=Lina}/u, "\u{1011e}");
-t(/\p{scx=Lina}/u, "\u{1011f}");
-f(/\P{scx=Lina}/u, "\u{1011f}");
-t(/\p{scx=Lina}/u, "\u{10120}");
-f(/\P{scx=Lina}/u, "\u{10120}");
-t(/\p{scx=Lina}/u, "\u{10121}");
-f(/\P{scx=Lina}/u, "\u{10121}");
-t(/\p{scx=Lina}/u, "\u{10122}");
-f(/\P{scx=Lina}/u, "\u{10122}");
-t(/\p{scx=Lina}/u, "\u{10123}");
-f(/\P{scx=Lina}/u, "\u{10123}");
-t(/\p{scx=Lina}/u, "\u{10124}");
-f(/\P{scx=Lina}/u, "\u{10124}");
-t(/\p{scx=Lina}/u, "\u{10125}");
-f(/\P{scx=Lina}/u, "\u{10125}");
-t(/\p{scx=Lina}/u, "\u{10126}");
-f(/\P{scx=Lina}/u, "\u{10126}");
-t(/\p{scx=Lina}/u, "\u{10127}");
-f(/\P{scx=Lina}/u, "\u{10127}");
-t(/\p{scx=Lina}/u, "\u{10128}");
-f(/\P{scx=Lina}/u, "\u{10128}");
-t(/\p{scx=Lina}/u, "\u{10129}");
-f(/\P{scx=Lina}/u, "\u{10129}");
-t(/\p{scx=Lina}/u, "\u{1012a}");
-f(/\P{scx=Lina}/u, "\u{1012a}");
-t(/\p{scx=Lina}/u, "\u{1012b}");
-f(/\P{scx=Lina}/u, "\u{1012b}");
-t(/\p{scx=Lina}/u, "\u{1012c}");
-f(/\P{scx=Lina}/u, "\u{1012c}");
-t(/\p{scx=Lina}/u, "\u{1012d}");
-f(/\P{scx=Lina}/u, "\u{1012d}");
-t(/\p{scx=Lina}/u, "\u{1012e}");
-f(/\P{scx=Lina}/u, "\u{1012e}");
-t(/\p{scx=Lina}/u, "\u{1012f}");
-f(/\P{scx=Lina}/u, "\u{1012f}");
-t(/\p{scx=Lina}/u, "\u{10130}");
-f(/\P{scx=Lina}/u, "\u{10130}");
-t(/\p{scx=Lina}/u, "\u{10131}");
-f(/\P{scx=Lina}/u, "\u{10131}");
-t(/\p{scx=Lina}/u, "\u{10132}");
-f(/\P{scx=Lina}/u, "\u{10132}");
-t(/\p{scx=Lina}/u, "\u{10133}");
-f(/\P{scx=Lina}/u, "\u{10133}");
-f(/(?=\P{sc=Lina})\p{scx=Lina}/u, "\u{901a6}");
-f(/(?=\P{sc=Lina})\p{scx=Lina}/u, "\u{4be73}");
-f(/(?=\P{sc=Lina})\p{scx=Lina}/u, "\u{c7b70}");
-f(/(?=\P{sc=Lina})\p{scx=Lina}/u, "\u{97401}");
-f(/(?=\P{sc=Lina})\p{scx=Lina}/u, "\u{48165}");
+f(/(?=\P{sc=Lina})\p{scx=Lina}/u, "\u{34b7}");
+f(/(?=\P{sc=Lina})\p{scx=Lina}/u, "\u{89cc7}");
+f(/(?=\P{sc=Lina})\p{scx=Lina}/u, "\u{b27b9}");
+f(/(?=\P{sc=Lina})\p{scx=Lina}/u, "\u{19122}");
+f(/(?=\P{sc=Lina})\p{scx=Lina}/u, "\u{7f93b}");
 // Script_Extension=Kthi
-t(/\p{scx=Kthi}/u, "\u{966}");
-f(/\P{scx=Kthi}/u, "\u{966}");
-t(/\p{scx=Kthi}/u, "\u{967}");
-f(/\P{scx=Kthi}/u, "\u{967}");
-t(/\p{scx=Kthi}/u, "\u{968}");
-f(/\P{scx=Kthi}/u, "\u{968}");
-t(/\p{scx=Kthi}/u, "\u{969}");
-f(/\P{scx=Kthi}/u, "\u{969}");
-t(/\p{scx=Kthi}/u, "\u{96a}");
-f(/\P{scx=Kthi}/u, "\u{96a}");
-t(/\p{scx=Kthi}/u, "\u{96b}");
-f(/\P{scx=Kthi}/u, "\u{96b}");
-t(/\p{scx=Kthi}/u, "\u{96c}");
-f(/\P{scx=Kthi}/u, "\u{96c}");
-t(/\p{scx=Kthi}/u, "\u{96d}");
-f(/\P{scx=Kthi}/u, "\u{96d}");
-t(/\p{scx=Kthi}/u, "\u{96e}");
-f(/\P{scx=Kthi}/u, "\u{96e}");
-t(/\p{scx=Kthi}/u, "\u{96f}");
-f(/\P{scx=Kthi}/u, "\u{96f}");
-t(/\p{scx=Kthi}/u, "\u{a836}");
-f(/\P{scx=Kthi}/u, "\u{a836}");
-t(/\p{scx=Kthi}/u, "\u{a837}");
-f(/\P{scx=Kthi}/u, "\u{a837}");
-t(/\p{scx=Kthi}/u, "\u{a838}");
-f(/\P{scx=Kthi}/u, "\u{a838}");
-t(/\p{scx=Kthi}/u, "\u{a839}");
-f(/\P{scx=Kthi}/u, "\u{a839}");
-t(/\p{scx=Kthi}/u, "\u{a830}");
-f(/\P{scx=Kthi}/u, "\u{a830}");
-t(/\p{scx=Kthi}/u, "\u{a831}");
-f(/\P{scx=Kthi}/u, "\u{a831}");
-t(/\p{scx=Kthi}/u, "\u{a832}");
-f(/\P{scx=Kthi}/u, "\u{a832}");
-t(/\p{scx=Kthi}/u, "\u{a833}");
-f(/\P{scx=Kthi}/u, "\u{a833}");
-t(/\p{scx=Kthi}/u, "\u{a834}");
-f(/\P{scx=Kthi}/u, "\u{a834}");
-t(/\p{scx=Kthi}/u, "\u{a835}");
-f(/\P{scx=Kthi}/u, "\u{a835}");
-f(/(?=\P{sc=Kthi})\p{scx=Kthi}/u, "\u{13d9b}");
-f(/(?=\P{sc=Kthi})\p{scx=Kthi}/u, "\u{24ff4}");
-f(/(?=\P{sc=Kthi})\p{scx=Kthi}/u, "\u{4c2c6}");
-f(/(?=\P{sc=Kthi})\p{scx=Kthi}/u, "\u{dfa34}");
-f(/(?=\P{sc=Kthi})\p{scx=Kthi}/u, "\u{cfd5e}");
+f(/(?=\P{sc=Kthi})\p{scx=Kthi}/u, "\u{8a452}");
+f(/(?=\P{sc=Kthi})\p{scx=Kthi}/u, "\u{39395}");
+f(/(?=\P{sc=Kthi})\p{scx=Kthi}/u, "\u{28802}");
+f(/(?=\P{sc=Kthi})\p{scx=Kthi}/u, "\u{de82b}");
+f(/(?=\P{sc=Kthi})\p{scx=Kthi}/u, "\u{1019cc}");
 // Script_Extension=Mahj
-t(/\p{scx=Mahj}/u, "\u{966}");
-f(/\P{scx=Mahj}/u, "\u{966}");
-t(/\p{scx=Mahj}/u, "\u{967}");
-f(/\P{scx=Mahj}/u, "\u{967}");
-t(/\p{scx=Mahj}/u, "\u{968}");
-f(/\P{scx=Mahj}/u, "\u{968}");
-t(/\p{scx=Mahj}/u, "\u{969}");
-f(/\P{scx=Mahj}/u, "\u{969}");
-t(/\p{scx=Mahj}/u, "\u{96a}");
-f(/\P{scx=Mahj}/u, "\u{96a}");
-t(/\p{scx=Mahj}/u, "\u{96b}");
-f(/\P{scx=Mahj}/u, "\u{96b}");
-t(/\p{scx=Mahj}/u, "\u{96c}");
-f(/\P{scx=Mahj}/u, "\u{96c}");
-t(/\p{scx=Mahj}/u, "\u{96d}");
-f(/\P{scx=Mahj}/u, "\u{96d}");
-t(/\p{scx=Mahj}/u, "\u{96e}");
-f(/\P{scx=Mahj}/u, "\u{96e}");
-t(/\p{scx=Mahj}/u, "\u{96f}");
-f(/\P{scx=Mahj}/u, "\u{96f}");
-t(/\p{scx=Mahj}/u, "\u{a836}");
-f(/\P{scx=Mahj}/u, "\u{a836}");
-t(/\p{scx=Mahj}/u, "\u{a837}");
-f(/\P{scx=Mahj}/u, "\u{a837}");
-t(/\p{scx=Mahj}/u, "\u{a838}");
-f(/\P{scx=Mahj}/u, "\u{a838}");
-t(/\p{scx=Mahj}/u, "\u{a839}");
-f(/\P{scx=Mahj}/u, "\u{a839}");
-t(/\p{scx=Mahj}/u, "\u{a830}");
-f(/\P{scx=Mahj}/u, "\u{a830}");
-t(/\p{scx=Mahj}/u, "\u{a831}");
-f(/\P{scx=Mahj}/u, "\u{a831}");
-t(/\p{scx=Mahj}/u, "\u{a832}");
-f(/\P{scx=Mahj}/u, "\u{a832}");
-t(/\p{scx=Mahj}/u, "\u{a833}");
-f(/\P{scx=Mahj}/u, "\u{a833}");
-t(/\p{scx=Mahj}/u, "\u{a834}");
-f(/\P{scx=Mahj}/u, "\u{a834}");
-t(/\p{scx=Mahj}/u, "\u{a835}");
-f(/\P{scx=Mahj}/u, "\u{a835}");
-t(/\p{scx=Mahj}/u, "\u{964}");
-f(/\P{scx=Mahj}/u, "\u{964}");
-t(/\p{scx=Mahj}/u, "\u{965}");
-f(/\P{scx=Mahj}/u, "\u{965}");
-f(/(?=\P{sc=Mahj})\p{scx=Mahj}/u, "\u{101f2b}");
-f(/(?=\P{sc=Mahj})\p{scx=Mahj}/u, "\u{15a19}");
-f(/(?=\P{sc=Mahj})\p{scx=Mahj}/u, "\u{de10b}");
-f(/(?=\P{sc=Mahj})\p{scx=Mahj}/u, "\u{240fd}");
-f(/(?=\P{sc=Mahj})\p{scx=Mahj}/u, "\u{e5eef}");
+f(/(?=\P{sc=Mahj})\p{scx=Mahj}/u, "\u{64a2d}");
+f(/(?=\P{sc=Mahj})\p{scx=Mahj}/u, "\u{7fe13}");
+f(/(?=\P{sc=Mahj})\p{scx=Mahj}/u, "\u{5da4a}");
+f(/(?=\P{sc=Mahj})\p{scx=Mahj}/u, "\u{fc2cf}");
+f(/(?=\P{sc=Mahj})\p{scx=Mahj}/u, "\u{53629}");
 // Script_Extension=Kali
-t(/\p{scx=Kali}/u, "\u{a92e}");
-f(/\P{scx=Kali}/u, "\u{a92e}");
-f(/(?=\P{sc=Kali})\p{scx=Kali}/u, "\u{59dbb}");
-f(/(?=\P{sc=Kali})\p{scx=Kali}/u, "\u{ac769}");
-f(/(?=\P{sc=Kali})\p{scx=Kali}/u, "\u{9255e}");
-f(/(?=\P{sc=Kali})\p{scx=Kali}/u, "\u{a0523}");
-f(/(?=\P{sc=Kali})\p{scx=Kali}/u, "\u{cca65}");
+f(/(?=\P{sc=Kali})\p{scx=Kali}/u, "\u{5cf1d}");
+f(/(?=\P{sc=Kali})\p{scx=Kali}/u, "\u{104c01}");
+f(/(?=\P{sc=Kali})\p{scx=Kali}/u, "\u{ef11a}");
+f(/(?=\P{sc=Kali})\p{scx=Kali}/u, "\u{92a12}");
+f(/(?=\P{sc=Kali})\p{scx=Kali}/u, "\u{e4e79}");
 // Script_Extension=Buhd
-t(/\p{scx=Buhd}/u, "\u{1735}");
-f(/\P{scx=Buhd}/u, "\u{1735}");
-t(/\p{scx=Buhd}/u, "\u{1736}");
-f(/\P{scx=Buhd}/u, "\u{1736}");
-f(/(?=\P{sc=Buhd})\p{scx=Buhd}/u, "\u{102987}");
-f(/(?=\P{sc=Buhd})\p{scx=Buhd}/u, "\u{92d8}");
-f(/(?=\P{sc=Buhd})\p{scx=Buhd}/u, "\u{85acd}");
-f(/(?=\P{sc=Buhd})\p{scx=Buhd}/u, "\u{91eee}");
-f(/(?=\P{sc=Buhd})\p{scx=Buhd}/u, "\u{99bf7}");
+f(/(?=\P{sc=Buhd})\p{scx=Buhd}/u, "\u{ab261}");
+f(/(?=\P{sc=Buhd})\p{scx=Buhd}/u, "\u{ca43a}");
+f(/(?=\P{sc=Buhd})\p{scx=Buhd}/u, "\u{7dc01}");
+f(/(?=\P{sc=Buhd})\p{scx=Buhd}/u, "\u{1e9f}");
+f(/(?=\P{sc=Buhd})\p{scx=Buhd}/u, "\u{12dd2}");
 // Script_Extension=Hano
-t(/\p{scx=Hano}/u, "\u{1735}");
-f(/\P{scx=Hano}/u, "\u{1735}");
-t(/\p{scx=Hano}/u, "\u{1736}");
-f(/\P{scx=Hano}/u, "\u{1736}");
-f(/(?=\P{sc=Hano})\p{scx=Hano}/u, "\u{7b94b}");
-f(/(?=\P{sc=Hano})\p{scx=Hano}/u, "\u{10a944}");
-f(/(?=\P{sc=Hano})\p{scx=Hano}/u, "\u{2cec}");
-f(/(?=\P{sc=Hano})\p{scx=Hano}/u, "\u{64635}");
-f(/(?=\P{sc=Hano})\p{scx=Hano}/u, "\u{25bea}");
+f(/(?=\P{sc=Hano})\p{scx=Hano}/u, "\u{3ec65}");
+f(/(?=\P{sc=Hano})\p{scx=Hano}/u, "\u{eff3d}");
+f(/(?=\P{sc=Hano})\p{scx=Hano}/u, "\u{a7239}");
+f(/(?=\P{sc=Hano})\p{scx=Hano}/u, "\u{4e718}");
+f(/(?=\P{sc=Hano})\p{scx=Hano}/u, "\u{ed8e6}");
 // Script_Extension=Tagb
-t(/\p{scx=Tagb}/u, "\u{1735}");
-f(/\P{scx=Tagb}/u, "\u{1735}");
-t(/\p{scx=Tagb}/u, "\u{1736}");
-f(/\P{scx=Tagb}/u, "\u{1736}");
-f(/(?=\P{sc=Tagb})\p{scx=Tagb}/u, "\u{950fe}");
-f(/(?=\P{sc=Tagb})\p{scx=Tagb}/u, "\u{e85b7}");
-f(/(?=\P{sc=Tagb})\p{scx=Tagb}/u, "\u{aead9}");
-f(/(?=\P{sc=Tagb})\p{scx=Tagb}/u, "\u{37473}");
-f(/(?=\P{sc=Tagb})\p{scx=Tagb}/u, "\u{a421a}");
+f(/(?=\P{sc=Tagb})\p{scx=Tagb}/u, "\u{23a92}");
+f(/(?=\P{sc=Tagb})\p{scx=Tagb}/u, "\u{103d41}");
+f(/(?=\P{sc=Tagb})\p{scx=Tagb}/u, "\u{60057}");
+f(/(?=\P{sc=Tagb})\p{scx=Tagb}/u, "\u{192de}");
+f(/(?=\P{sc=Tagb})\p{scx=Tagb}/u, "\u{b1caf}");
 // Script_Extension=Tglg
-t(/\p{scx=Tglg}/u, "\u{1735}");
-f(/\P{scx=Tglg}/u, "\u{1735}");
-t(/\p{scx=Tglg}/u, "\u{1736}");
-f(/\P{scx=Tglg}/u, "\u{1736}");
-f(/(?=\P{sc=Tglg})\p{scx=Tglg}/u, "\u{c560d}");
-f(/(?=\P{sc=Tglg})\p{scx=Tglg}/u, "\u{23ff2}");
-f(/(?=\P{sc=Tglg})\p{scx=Tglg}/u, "\u{b1557}");
-f(/(?=\P{sc=Tglg})\p{scx=Tglg}/u, "\u{f0d06}");
-f(/(?=\P{sc=Tglg})\p{scx=Tglg}/u, "\u{9982b}");
+f(/(?=\P{sc=Tglg})\p{scx=Tglg}/u, "\u{42efc}");
+f(/(?=\P{sc=Tglg})\p{scx=Tglg}/u, "\u{90987}");
+f(/(?=\P{sc=Tglg})\p{scx=Tglg}/u, "\u{ba103}");
+f(/(?=\P{sc=Tglg})\p{scx=Tglg}/u, "\u{91eeb}");
+f(/(?=\P{sc=Tglg})\p{scx=Tglg}/u, "\u{dbf0e}");
 // Script_Extension=Hang
-t(/\p{scx=Hang}/u, "\u{3003}");
-f(/\P{scx=Hang}/u, "\u{3003}");
-t(/\p{scx=Hang}/u, "\u{3013}");
-f(/\P{scx=Hang}/u, "\u{3013}");
-t(/\p{scx=Hang}/u, "\u{301c}");
-f(/\P{scx=Hang}/u, "\u{301c}");
-t(/\p{scx=Hang}/u, "\u{301d}");
-f(/\P{scx=Hang}/u, "\u{301d}");
-t(/\p{scx=Hang}/u, "\u{301e}");
-f(/\P{scx=Hang}/u, "\u{301e}");
-t(/\p{scx=Hang}/u, "\u{301f}");
-f(/\P{scx=Hang}/u, "\u{301f}");
-t(/\p{scx=Hang}/u, "\u{3030}");
-f(/\P{scx=Hang}/u, "\u{3030}");
-t(/\p{scx=Hang}/u, "\u{3037}");
-f(/\P{scx=Hang}/u, "\u{3037}");
-t(/\p{scx=Hang}/u, "\u{fe45}");
-f(/\P{scx=Hang}/u, "\u{fe45}");
-t(/\p{scx=Hang}/u, "\u{fe46}");
-f(/\P{scx=Hang}/u, "\u{fe46}");
-t(/\p{scx=Hang}/u, "\u{3001}");
-f(/\P{scx=Hang}/u, "\u{3001}");
-t(/\p{scx=Hang}/u, "\u{3002}");
-f(/\P{scx=Hang}/u, "\u{3002}");
-t(/\p{scx=Hang}/u, "\u{3008}");
-f(/\P{scx=Hang}/u, "\u{3008}");
-t(/\p{scx=Hang}/u, "\u{3009}");
-f(/\P{scx=Hang}/u, "\u{3009}");
-t(/\p{scx=Hang}/u, "\u{300a}");
-f(/\P{scx=Hang}/u, "\u{300a}");
-t(/\p{scx=Hang}/u, "\u{300b}");
-f(/\P{scx=Hang}/u, "\u{300b}");
-t(/\p{scx=Hang}/u, "\u{300c}");
-f(/\P{scx=Hang}/u, "\u{300c}");
-t(/\p{scx=Hang}/u, "\u{300d}");
-f(/\P{scx=Hang}/u, "\u{300d}");
-t(/\p{scx=Hang}/u, "\u{300e}");
-f(/\P{scx=Hang}/u, "\u{300e}");
-t(/\p{scx=Hang}/u, "\u{300f}");
-f(/\P{scx=Hang}/u, "\u{300f}");
-t(/\p{scx=Hang}/u, "\u{3010}");
-f(/\P{scx=Hang}/u, "\u{3010}");
-t(/\p{scx=Hang}/u, "\u{3011}");
-f(/\P{scx=Hang}/u, "\u{3011}");
-t(/\p{scx=Hang}/u, "\u{3014}");
-f(/\P{scx=Hang}/u, "\u{3014}");
-t(/\p{scx=Hang}/u, "\u{3015}");
-f(/\P{scx=Hang}/u, "\u{3015}");
-t(/\p{scx=Hang}/u, "\u{3016}");
-f(/\P{scx=Hang}/u, "\u{3016}");
-t(/\p{scx=Hang}/u, "\u{3017}");
-f(/\P{scx=Hang}/u, "\u{3017}");
-t(/\p{scx=Hang}/u, "\u{3018}");
-f(/\P{scx=Hang}/u, "\u{3018}");
-t(/\p{scx=Hang}/u, "\u{3019}");
-f(/\P{scx=Hang}/u, "\u{3019}");
-t(/\p{scx=Hang}/u, "\u{301a}");
-f(/\P{scx=Hang}/u, "\u{301a}");
-t(/\p{scx=Hang}/u, "\u{301b}");
-f(/\P{scx=Hang}/u, "\u{301b}");
-t(/\p{scx=Hang}/u, "\u{30fb}");
-f(/\P{scx=Hang}/u, "\u{30fb}");
-t(/\p{scx=Hang}/u, "\u{ff61}");
-f(/\P{scx=Hang}/u, "\u{ff61}");
-t(/\p{scx=Hang}/u, "\u{ff62}");
-f(/\P{scx=Hang}/u, "\u{ff62}");
-t(/\p{scx=Hang}/u, "\u{ff63}");
-f(/\P{scx=Hang}/u, "\u{ff63}");
-t(/\p{scx=Hang}/u, "\u{ff64}");
-f(/\P{scx=Hang}/u, "\u{ff64}");
-t(/\p{scx=Hang}/u, "\u{ff65}");
-f(/\P{scx=Hang}/u, "\u{ff65}");
-f(/(?=\P{sc=Hang})\p{scx=Hang}/u, "\u{97df3}");
-f(/(?=\P{sc=Hang})\p{scx=Hang}/u, "\u{e74b9}");
-f(/(?=\P{sc=Hang})\p{scx=Hang}/u, "\u{a68b2}");
-f(/(?=\P{sc=Hang})\p{scx=Hang}/u, "\u{82b9f}");
-f(/(?=\P{sc=Hang})\p{scx=Hang}/u, "\u{60ae0}");
+f(/(?=\P{sc=Hang})\p{scx=Hang}/u, "\u{7aa}");
+f(/(?=\P{sc=Hang})\p{scx=Hang}/u, "\u{12138}");
+f(/(?=\P{sc=Hang})\p{scx=Hang}/u, "\u{478c1}");
+f(/(?=\P{sc=Hang})\p{scx=Hang}/u, "\u{ec529}");
+f(/(?=\P{sc=Hang})\p{scx=Hang}/u, "\u{bb438}");
 // Script_Extension=Mlym
-t(/\p{scx=Mlym}/u, "\u{1cda}");
-f(/\P{scx=Mlym}/u, "\u{1cda}");
-t(/\p{scx=Mlym}/u, "\u{952}");
-f(/\P{scx=Mlym}/u, "\u{952}");
-t(/\p{scx=Mlym}/u, "\u{951}");
-f(/\P{scx=Mlym}/u, "\u{951}");
-t(/\p{scx=Mlym}/u, "\u{964}");
-f(/\P{scx=Mlym}/u, "\u{964}");
-t(/\p{scx=Mlym}/u, "\u{965}");
-f(/\P{scx=Mlym}/u, "\u{965}");
-f(/(?=\P{sc=Mlym})\p{scx=Mlym}/u, "\u{8ac6a}");
-f(/(?=\P{sc=Mlym})\p{scx=Mlym}/u, "\u{2b695}");
-f(/(?=\P{sc=Mlym})\p{scx=Mlym}/u, "\u{56e47}");
-f(/(?=\P{sc=Mlym})\p{scx=Mlym}/u, "\u{c86ba}");
-f(/(?=\P{sc=Mlym})\p{scx=Mlym}/u, "\u{b74e9}");
+f(/(?=\P{sc=Mlym})\p{scx=Mlym}/u, "\u{e6470}");
+f(/(?=\P{sc=Mlym})\p{scx=Mlym}/u, "\u{a9ffc}");
+f(/(?=\P{sc=Mlym})\p{scx=Mlym}/u, "\u{b220c}");
+f(/(?=\P{sc=Mlym})\p{scx=Mlym}/u, "\u{3676b}");
+f(/(?=\P{sc=Mlym})\p{scx=Mlym}/u, "\u{78657}");
 // Script_Extension=Telu
-t(/\p{scx=Telu}/u, "\u{1cda}");
-f(/\P{scx=Telu}/u, "\u{1cda}");
-t(/\p{scx=Telu}/u, "\u{952}");
-f(/\P{scx=Telu}/u, "\u{952}");
-t(/\p{scx=Telu}/u, "\u{951}");
-f(/\P{scx=Telu}/u, "\u{951}");
-t(/\p{scx=Telu}/u, "\u{964}");
-f(/\P{scx=Telu}/u, "\u{964}");
-t(/\p{scx=Telu}/u, "\u{965}");
-f(/\P{scx=Telu}/u, "\u{965}");
-f(/(?=\P{sc=Telu})\p{scx=Telu}/u, "\u{d8bfa}");
-f(/(?=\P{sc=Telu})\p{scx=Telu}/u, "\u{d2cc3}");
-f(/(?=\P{sc=Telu})\p{scx=Telu}/u, "\u{54006}");
-f(/(?=\P{sc=Telu})\p{scx=Telu}/u, "\u{104bf0}");
-f(/(?=\P{sc=Telu})\p{scx=Telu}/u, "\u{2a98d}");
+f(/(?=\P{sc=Telu})\p{scx=Telu}/u, "\u{d1aa}");
+f(/(?=\P{sc=Telu})\p{scx=Telu}/u, "\u{81dfa}");
+f(/(?=\P{sc=Telu})\p{scx=Telu}/u, "\u{3ccad}");
+f(/(?=\P{sc=Telu})\p{scx=Telu}/u, "\u{c694a}");
+f(/(?=\P{sc=Telu})\p{scx=Telu}/u, "\u{d4da6}");
 // Script_Extension=Adlm
-t(/\p{scx=Adlm}/u, "\u{640}");
-f(/\P{scx=Adlm}/u, "\u{640}");
-f(/(?=\P{sc=Adlm})\p{scx=Adlm}/u, "\u{17d17}");
-f(/(?=\P{sc=Adlm})\p{scx=Adlm}/u, "\u{90cdc}");
-f(/(?=\P{sc=Adlm})\p{scx=Adlm}/u, "\u{8a2ee}");
-f(/(?=\P{sc=Adlm})\p{scx=Adlm}/u, "\u{b1106}");
-f(/(?=\P{sc=Adlm})\p{scx=Adlm}/u, "\u{49e11}");
+f(/(?=\P{sc=Adlm})\p{scx=Adlm}/u, "\u{79f20}");
+f(/(?=\P{sc=Adlm})\p{scx=Adlm}/u, "\u{1013cc}");
+f(/(?=\P{sc=Adlm})\p{scx=Adlm}/u, "\u{37748}");
+f(/(?=\P{sc=Adlm})\p{scx=Adlm}/u, "\u{63b26}");
+f(/(?=\P{sc=Adlm})\p{scx=Adlm}/u, "\u{8a04f}");
 // Script_Extension=Mand
-t(/\p{scx=Mand}/u, "\u{640}");
-f(/\P{scx=Mand}/u, "\u{640}");
-f(/(?=\P{sc=Mand})\p{scx=Mand}/u, "\u{103f01}");
-f(/(?=\P{sc=Mand})\p{scx=Mand}/u, "\u{d921a}");
-f(/(?=\P{sc=Mand})\p{scx=Mand}/u, "\u{dc97e}");
-f(/(?=\P{sc=Mand})\p{scx=Mand}/u, "\u{f1404}");
-f(/(?=\P{sc=Mand})\p{scx=Mand}/u, "\u{5f57c}");
+f(/(?=\P{sc=Mand})\p{scx=Mand}/u, "\u{4e6a8}");
+f(/(?=\P{sc=Mand})\p{scx=Mand}/u, "\u{4d1bc}");
+f(/(?=\P{sc=Mand})\p{scx=Mand}/u, "\u{e67d0}");
+f(/(?=\P{sc=Mand})\p{scx=Mand}/u, "\u{72336}");
+f(/(?=\P{sc=Mand})\p{scx=Mand}/u, "\u{bdf70}");
 // Script_Extension=Mani
-t(/\p{scx=Mani}/u, "\u{640}");
-f(/\P{scx=Mani}/u, "\u{640}");
-f(/(?=\P{sc=Mani})\p{scx=Mani}/u, "\u{4785e}");
-f(/(?=\P{sc=Mani})\p{scx=Mani}/u, "\u{8a387}");
-f(/(?=\P{sc=Mani})\p{scx=Mani}/u, "\u{10553f}");
-f(/(?=\P{sc=Mani})\p{scx=Mani}/u, "\u{46537}");
-f(/(?=\P{sc=Mani})\p{scx=Mani}/u, "\u{301ef}");
+f(/(?=\P{sc=Mani})\p{scx=Mani}/u, "\u{e67bb}");
+f(/(?=\P{sc=Mani})\p{scx=Mani}/u, "\u{9c604}");
+f(/(?=\P{sc=Mani})\p{scx=Mani}/u, "\u{43609}");
+f(/(?=\P{sc=Mani})\p{scx=Mani}/u, "\u{8d39}");
+f(/(?=\P{sc=Mani})\p{scx=Mani}/u, "\u{5a0d6}");
 // Script_Extension=Phlp
-t(/\p{scx=Phlp}/u, "\u{640}");
-f(/\P{scx=Phlp}/u, "\u{640}");
-f(/(?=\P{sc=Phlp})\p{scx=Phlp}/u, "\u{b669d}");
-f(/(?=\P{sc=Phlp})\p{scx=Phlp}/u, "\u{e819a}");
-f(/(?=\P{sc=Phlp})\p{scx=Phlp}/u, "\u{5a57a}");
-f(/(?=\P{sc=Phlp})\p{scx=Phlp}/u, "\u{d6899}");
-f(/(?=\P{sc=Phlp})\p{scx=Phlp}/u, "\u{3215f}");
+f(/(?=\P{sc=Phlp})\p{scx=Phlp}/u, "\u{aee68}");
+f(/(?=\P{sc=Phlp})\p{scx=Phlp}/u, "\u{d60ec}");
+f(/(?=\P{sc=Phlp})\p{scx=Phlp}/u, "\u{407c7}");
+f(/(?=\P{sc=Phlp})\p{scx=Phlp}/u, "\u{2c40e}");
+f(/(?=\P{sc=Phlp})\p{scx=Phlp}/u, "\u{5cf39}");
 // Script_Extension=Yiii
-t(/\p{scx=Yiii}/u, "\u{3001}");
-f(/\P{scx=Yiii}/u, "\u{3001}");
-t(/\p{scx=Yiii}/u, "\u{3002}");
-f(/\P{scx=Yiii}/u, "\u{3002}");
-t(/\p{scx=Yiii}/u, "\u{3008}");
-f(/\P{scx=Yiii}/u, "\u{3008}");
-t(/\p{scx=Yiii}/u, "\u{3009}");
-f(/\P{scx=Yiii}/u, "\u{3009}");
-t(/\p{scx=Yiii}/u, "\u{300a}");
-f(/\P{scx=Yiii}/u, "\u{300a}");
-t(/\p{scx=Yiii}/u, "\u{300b}");
-f(/\P{scx=Yiii}/u, "\u{300b}");
-t(/\p{scx=Yiii}/u, "\u{300c}");
-f(/\P{scx=Yiii}/u, "\u{300c}");
-t(/\p{scx=Yiii}/u, "\u{300d}");
-f(/\P{scx=Yiii}/u, "\u{300d}");
-t(/\p{scx=Yiii}/u, "\u{300e}");
-f(/\P{scx=Yiii}/u, "\u{300e}");
-t(/\p{scx=Yiii}/u, "\u{300f}");
-f(/\P{scx=Yiii}/u, "\u{300f}");
-t(/\p{scx=Yiii}/u, "\u{3010}");
-f(/\P{scx=Yiii}/u, "\u{3010}");
-t(/\p{scx=Yiii}/u, "\u{3011}");
-f(/\P{scx=Yiii}/u, "\u{3011}");
-t(/\p{scx=Yiii}/u, "\u{3014}");
-f(/\P{scx=Yiii}/u, "\u{3014}");
-t(/\p{scx=Yiii}/u, "\u{3015}");
-f(/\P{scx=Yiii}/u, "\u{3015}");
-t(/\p{scx=Yiii}/u, "\u{3016}");
-f(/\P{scx=Yiii}/u, "\u{3016}");
-t(/\p{scx=Yiii}/u, "\u{3017}");
-f(/\P{scx=Yiii}/u, "\u{3017}");
-t(/\p{scx=Yiii}/u, "\u{3018}");
-f(/\P{scx=Yiii}/u, "\u{3018}");
-t(/\p{scx=Yiii}/u, "\u{3019}");
-f(/\P{scx=Yiii}/u, "\u{3019}");
-t(/\p{scx=Yiii}/u, "\u{301a}");
-f(/\P{scx=Yiii}/u, "\u{301a}");
-t(/\p{scx=Yiii}/u, "\u{301b}");
-f(/\P{scx=Yiii}/u, "\u{301b}");
-t(/\p{scx=Yiii}/u, "\u{30fb}");
-f(/\P{scx=Yiii}/u, "\u{30fb}");
-t(/\p{scx=Yiii}/u, "\u{ff61}");
-f(/\P{scx=Yiii}/u, "\u{ff61}");
-t(/\p{scx=Yiii}/u, "\u{ff62}");
-f(/\P{scx=Yiii}/u, "\u{ff62}");
-t(/\p{scx=Yiii}/u, "\u{ff63}");
-f(/\P{scx=Yiii}/u, "\u{ff63}");
-t(/\p{scx=Yiii}/u, "\u{ff64}");
-f(/\P{scx=Yiii}/u, "\u{ff64}");
-t(/\p{scx=Yiii}/u, "\u{ff65}");
-f(/\P{scx=Yiii}/u, "\u{ff65}");
-f(/(?=\P{sc=Yiii})\p{scx=Yiii}/u, "\u{2f309}");
-f(/(?=\P{sc=Yiii})\p{scx=Yiii}/u, "\u{b5b22}");
-f(/(?=\P{sc=Yiii})\p{scx=Yiii}/u, "\u{d51ae}");
-f(/(?=\P{sc=Yiii})\p{scx=Yiii}/u, "\u{77b48}");
-f(/(?=\P{sc=Yiii})\p{scx=Yiii}/u, "\u{12f5}");
+f(/(?=\P{sc=Yiii})\p{scx=Yiii}/u, "\u{d2efb}");
+f(/(?=\P{sc=Yiii})\p{scx=Yiii}/u, "\u{83b57}");
+f(/(?=\P{sc=Yiii})\p{scx=Yiii}/u, "\u{c8c5f}");
+f(/(?=\P{sc=Yiii})\p{scx=Yiii}/u, "\u{10e9de}");
+f(/(?=\P{sc=Yiii})\p{scx=Yiii}/u, "\u{2d5ba}");
 // Script_Extension=Modi
-t(/\p{scx=Modi}/u, "\u{a836}");
-f(/\P{scx=Modi}/u, "\u{a836}");
-t(/\p{scx=Modi}/u, "\u{a837}");
-f(/\P{scx=Modi}/u, "\u{a837}");
-t(/\p{scx=Modi}/u, "\u{a838}");
-f(/\P{scx=Modi}/u, "\u{a838}");
-t(/\p{scx=Modi}/u, "\u{a839}");
-f(/\P{scx=Modi}/u, "\u{a839}");
-t(/\p{scx=Modi}/u, "\u{a830}");
-f(/\P{scx=Modi}/u, "\u{a830}");
-t(/\p{scx=Modi}/u, "\u{a831}");
-f(/\P{scx=Modi}/u, "\u{a831}");
-t(/\p{scx=Modi}/u, "\u{a832}");
-f(/\P{scx=Modi}/u, "\u{a832}");
-t(/\p{scx=Modi}/u, "\u{a833}");
-f(/\P{scx=Modi}/u, "\u{a833}");
-t(/\p{scx=Modi}/u, "\u{a834}");
-f(/\P{scx=Modi}/u, "\u{a834}");
-t(/\p{scx=Modi}/u, "\u{a835}");
-f(/\P{scx=Modi}/u, "\u{a835}");
-f(/(?=\P{sc=Modi})\p{scx=Modi}/u, "\u{e64ef}");
-f(/(?=\P{sc=Modi})\p{scx=Modi}/u, "\u{ff1a8}");
-f(/(?=\P{sc=Modi})\p{scx=Modi}/u, "\u{103374}");
-f(/(?=\P{sc=Modi})\p{scx=Modi}/u, "\u{721f6}");
-f(/(?=\P{sc=Modi})\p{scx=Modi}/u, "\u{65c4f}");
+f(/(?=\P{sc=Modi})\p{scx=Modi}/u, "\u{4d486}");
+f(/(?=\P{sc=Modi})\p{scx=Modi}/u, "\u{7d0d5}");
+f(/(?=\P{sc=Modi})\p{scx=Modi}/u, "\u{4c4d6}");
+f(/(?=\P{sc=Modi})\p{scx=Modi}/u, "\u{a47e9}");
+f(/(?=\P{sc=Modi})\p{scx=Modi}/u, "\u{1f8a1}");
 // Script_Extension=Sind
-t(/\p{scx=Sind}/u, "\u{a836}");
-f(/\P{scx=Sind}/u, "\u{a836}");
-t(/\p{scx=Sind}/u, "\u{a837}");
-f(/\P{scx=Sind}/u, "\u{a837}");
-t(/\p{scx=Sind}/u, "\u{a838}");
-f(/\P{scx=Sind}/u, "\u{a838}");
-t(/\p{scx=Sind}/u, "\u{a839}");
-f(/\P{scx=Sind}/u, "\u{a839}");
-t(/\p{scx=Sind}/u, "\u{a830}");
-f(/\P{scx=Sind}/u, "\u{a830}");
-t(/\p{scx=Sind}/u, "\u{a831}");
-f(/\P{scx=Sind}/u, "\u{a831}");
-t(/\p{scx=Sind}/u, "\u{a832}");
-f(/\P{scx=Sind}/u, "\u{a832}");
-t(/\p{scx=Sind}/u, "\u{a833}");
-f(/\P{scx=Sind}/u, "\u{a833}");
-t(/\p{scx=Sind}/u, "\u{a834}");
-f(/\P{scx=Sind}/u, "\u{a834}");
-t(/\p{scx=Sind}/u, "\u{a835}");
-f(/\P{scx=Sind}/u, "\u{a835}");
-t(/\p{scx=Sind}/u, "\u{964}");
-f(/\P{scx=Sind}/u, "\u{964}");
-t(/\p{scx=Sind}/u, "\u{965}");
-f(/\P{scx=Sind}/u, "\u{965}");
-f(/(?=\P{sc=Sind})\p{scx=Sind}/u, "\u{63856}");
-f(/(?=\P{sc=Sind})\p{scx=Sind}/u, "\u{10fce1}");
-f(/(?=\P{sc=Sind})\p{scx=Sind}/u, "\u{e9acf}");
-f(/(?=\P{sc=Sind})\p{scx=Sind}/u, "\u{3127f}");
-f(/(?=\P{sc=Sind})\p{scx=Sind}/u, "\u{c7ceb}");
+f(/(?=\P{sc=Sind})\p{scx=Sind}/u, "\u{a8c86}");
+f(/(?=\P{sc=Sind})\p{scx=Sind}/u, "\u{507cc}");
+f(/(?=\P{sc=Sind})\p{scx=Sind}/u, "\u{e9d11}");
+f(/(?=\P{sc=Sind})\p{scx=Sind}/u, "\u{5b3b8}");
+f(/(?=\P{sc=Sind})\p{scx=Sind}/u, "\u{9c93e}");
 // Script_Extension=Takr
-t(/\p{scx=Takr}/u, "\u{a836}");
-f(/\P{scx=Takr}/u, "\u{a836}");
-t(/\p{scx=Takr}/u, "\u{a837}");
-f(/\P{scx=Takr}/u, "\u{a837}");
-t(/\p{scx=Takr}/u, "\u{a838}");
-f(/\P{scx=Takr}/u, "\u{a838}");
-t(/\p{scx=Takr}/u, "\u{a839}");
-f(/\P{scx=Takr}/u, "\u{a839}");
-t(/\p{scx=Takr}/u, "\u{a830}");
-f(/\P{scx=Takr}/u, "\u{a830}");
-t(/\p{scx=Takr}/u, "\u{a831}");
-f(/\P{scx=Takr}/u, "\u{a831}");
-t(/\p{scx=Takr}/u, "\u{a832}");
-f(/\P{scx=Takr}/u, "\u{a832}");
-t(/\p{scx=Takr}/u, "\u{a833}");
-f(/\P{scx=Takr}/u, "\u{a833}");
-t(/\p{scx=Takr}/u, "\u{a834}");
-f(/\P{scx=Takr}/u, "\u{a834}");
-t(/\p{scx=Takr}/u, "\u{a835}");
-f(/\P{scx=Takr}/u, "\u{a835}");
-t(/\p{scx=Takr}/u, "\u{964}");
-f(/\P{scx=Takr}/u, "\u{964}");
-t(/\p{scx=Takr}/u, "\u{965}");
-f(/\P{scx=Takr}/u, "\u{965}");
-f(/(?=\P{sc=Takr})\p{scx=Takr}/u, "\u{ec200}");
-f(/(?=\P{sc=Takr})\p{scx=Takr}/u, "\u{10602d}");
-f(/(?=\P{sc=Takr})\p{scx=Takr}/u, "\u{6143c}");
-f(/(?=\P{sc=Takr})\p{scx=Takr}/u, "\u{cc552}");
-f(/(?=\P{sc=Takr})\p{scx=Takr}/u, "\u{d1b37}");
+f(/(?=\P{sc=Takr})\p{scx=Takr}/u, "\u{d18cf}");
+f(/(?=\P{sc=Takr})\p{scx=Takr}/u, "\u{b09e7}");
+f(/(?=\P{sc=Takr})\p{scx=Takr}/u, "\u{b134e}");
+f(/(?=\P{sc=Takr})\p{scx=Takr}/u, "\u{5f1d5}");
+f(/(?=\P{sc=Takr})\p{scx=Takr}/u, "\u{bca99}");
 // Script_Extension=Tirh
-t(/\p{scx=Tirh}/u, "\u{a836}");
-f(/\P{scx=Tirh}/u, "\u{a836}");
-t(/\p{scx=Tirh}/u, "\u{a837}");
-f(/\P{scx=Tirh}/u, "\u{a837}");
-t(/\p{scx=Tirh}/u, "\u{a838}");
-f(/\P{scx=Tirh}/u, "\u{a838}");
-t(/\p{scx=Tirh}/u, "\u{a839}");
-f(/\P{scx=Tirh}/u, "\u{a839}");
-t(/\p{scx=Tirh}/u, "\u{a830}");
-f(/\P{scx=Tirh}/u, "\u{a830}");
-t(/\p{scx=Tirh}/u, "\u{a831}");
-f(/\P{scx=Tirh}/u, "\u{a831}");
-t(/\p{scx=Tirh}/u, "\u{a832}");
-f(/\P{scx=Tirh}/u, "\u{a832}");
-t(/\p{scx=Tirh}/u, "\u{a833}");
-f(/\P{scx=Tirh}/u, "\u{a833}");
-t(/\p{scx=Tirh}/u, "\u{a834}");
-f(/\P{scx=Tirh}/u, "\u{a834}");
-t(/\p{scx=Tirh}/u, "\u{a835}");
-f(/\P{scx=Tirh}/u, "\u{a835}");
-t(/\p{scx=Tirh}/u, "\u{964}");
-f(/\P{scx=Tirh}/u, "\u{964}");
-t(/\p{scx=Tirh}/u, "\u{965}");
-f(/\P{scx=Tirh}/u, "\u{965}");
-f(/(?=\P{sc=Tirh})\p{scx=Tirh}/u, "\u{d8409}");
-f(/(?=\P{sc=Tirh})\p{scx=Tirh}/u, "\u{4406c}");
-f(/(?=\P{sc=Tirh})\p{scx=Tirh}/u, "\u{aef3d}");
-f(/(?=\P{sc=Tirh})\p{scx=Tirh}/u, "\u{46186}");
-f(/(?=\P{sc=Tirh})\p{scx=Tirh}/u, "\u{b1229}");
+f(/(?=\P{sc=Tirh})\p{scx=Tirh}/u, "\u{8366f}");
+f(/(?=\P{sc=Tirh})\p{scx=Tirh}/u, "\u{a17ba}");
+f(/(?=\P{sc=Tirh})\p{scx=Tirh}/u, "\u{100f3b}");
+f(/(?=\P{sc=Tirh})\p{scx=Tirh}/u, "\u{f23d9}");
+f(/(?=\P{sc=Tirh})\p{scx=Tirh}/u, "\u{56a64}");
 // Script_Extension=Orya
-t(/\p{scx=Orya}/u, "\u{952}");
-f(/\P{scx=Orya}/u, "\u{952}");
-t(/\p{scx=Orya}/u, "\u{951}");
-f(/\P{scx=Orya}/u, "\u{951}");
-t(/\p{scx=Orya}/u, "\u{964}");
-f(/\P{scx=Orya}/u, "\u{964}");
-t(/\p{scx=Orya}/u, "\u{965}");
-f(/\P{scx=Orya}/u, "\u{965}");
-f(/(?=\P{sc=Orya})\p{scx=Orya}/u, "\u{38982}");
-f(/(?=\P{sc=Orya})\p{scx=Orya}/u, "\u{a6422}");
-f(/(?=\P{sc=Orya})\p{scx=Orya}/u, "\u{b40c4}");
-f(/(?=\P{sc=Orya})\p{scx=Orya}/u, "\u{50b36}");
-f(/(?=\P{sc=Orya})\p{scx=Orya}/u, "\u{8033b}");
+f(/(?=\P{sc=Orya})\p{scx=Orya}/u, "\u{30394}");
+f(/(?=\P{sc=Orya})\p{scx=Orya}/u, "\u{2f022}");
+f(/(?=\P{sc=Orya})\p{scx=Orya}/u, "\u{af689}");
+f(/(?=\P{sc=Orya})\p{scx=Orya}/u, "\u{5ad58}");
+f(/(?=\P{sc=Orya})\p{scx=Orya}/u, "\u{24a87}");
 // Script_Extension=Sinh
-t(/\p{scx=Sinh}/u, "\u{964}");
-f(/\P{scx=Sinh}/u, "\u{964}");
-t(/\p{scx=Sinh}/u, "\u{965}");
-f(/\P{scx=Sinh}/u, "\u{965}");
-f(/(?=\P{sc=Sinh})\p{scx=Sinh}/u, "\u{10a8c2}");
-f(/(?=\P{sc=Sinh})\p{scx=Sinh}/u, "\u{109c02}");
-f(/(?=\P{sc=Sinh})\p{scx=Sinh}/u, "\u{eb3fd}");
-f(/(?=\P{sc=Sinh})\p{scx=Sinh}/u, "\u{a884}");
-f(/(?=\P{sc=Sinh})\p{scx=Sinh}/u, "\u{89f0f}");
+f(/(?=\P{sc=Sinh})\p{scx=Sinh}/u, "\u{7451c}");
+f(/(?=\P{sc=Sinh})\p{scx=Sinh}/u, "\u{2d340}");
+f(/(?=\P{sc=Sinh})\p{scx=Sinh}/u, "\u{847bb}");
+f(/(?=\P{sc=Sinh})\p{scx=Sinh}/u, "\u{e8785}");
+f(/(?=\P{sc=Sinh})\p{scx=Sinh}/u, "\u{bf9ed}");
 // Script_Extension=Limb
-t(/\p{scx=Limb}/u, "\u{965}");
-f(/\P{scx=Limb}/u, "\u{965}");
-f(/(?=\P{sc=Limb})\p{scx=Limb}/u, "\u{9c91e}");
-f(/(?=\P{sc=Limb})\p{scx=Limb}/u, "\u{e0433}");
-f(/(?=\P{sc=Limb})\p{scx=Limb}/u, "\u{10d7c7}");
-f(/(?=\P{sc=Limb})\p{scx=Limb}/u, "\u{f3980}");
-f(/(?=\P{sc=Limb})\p{scx=Limb}/u, "\u{d5094}");
+f(/(?=\P{sc=Limb})\p{scx=Limb}/u, "\u{5f22f}");
+f(/(?=\P{sc=Limb})\p{scx=Limb}/u, "\u{d729e}");
+f(/(?=\P{sc=Limb})\p{scx=Limb}/u, "\u{84288}");
+f(/(?=\P{sc=Limb})\p{scx=Limb}/u, "\u{320ef}");
+f(/(?=\P{sc=Limb})\p{scx=Limb}/u, "\u{260ac}");
diff --git a/deps/v8/test/mjsunit/harmony/regexp-property-scripts.js b/deps/v8/test/mjsunit/harmony/regexp-property-scripts.js
index 565a59ab0a0600..af0d443d0c0b07 100644
--- a/deps/v8/test/mjsunit/harmony/regexp-property-scripts.js
+++ b/deps/v8/test/mjsunit/harmony/regexp-property-scripts.js
@@ -2,8 +2,6 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --harmony-regexp-property
-
 function t(re, s) { assertTrue(re.test(s)); }
 function f(re, s) { assertFalse(re.test(s)); }
 
diff --git a/deps/v8/test/mjsunit/harmony/regexp-property-special.js b/deps/v8/test/mjsunit/harmony/regexp-property-special.js
index 58a7f6b6c3e018..07263c65140ada 100644
--- a/deps/v8/test/mjsunit/harmony/regexp-property-special.js
+++ b/deps/v8/test/mjsunit/harmony/regexp-property-special.js
@@ -2,8 +2,6 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --harmony-regexp-property
-
 function t(re, s) { assertTrue(re.test(s)); }
 function f(re, s) { assertFalse(re.test(s)); }
 
diff --git a/deps/v8/test/mjsunit/harmony/symbol-description.js b/deps/v8/test/mjsunit/harmony/symbol-description.js
new file mode 100644
index 00000000000000..ccba44c978295a
--- /dev/null
+++ b/deps/v8/test/mjsunit/harmony/symbol-description.js
@@ -0,0 +1,53 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --harmony-symbol-description
+
+{
+  let desc = Object.getOwnPropertyDescriptor(Symbol.prototype, 'description');
+  assertEquals(desc.set, undefined);
+  assertEquals(desc.writable, undefined);
+  assertFalse(desc.enumerable);
+  assertTrue(desc.configurable);
+}
+
+{
+  const empty = Symbol();
+  assertEquals(empty.description, undefined);
+
+  const symbol = Symbol('test');
+  assertEquals(symbol.description, 'test');
+  assertFalse(symbol.hasOwnProperty('description'));
+}
+
+{
+  const empty = Object(Symbol());
+  assertEquals(empty.description, undefined);
+
+  const symbol = Object(Symbol('test'));
+  assertEquals(symbol.description, 'test');
+  assertFalse(symbol.hasOwnProperty('description'));
+}
+
+{
+  assertThrows(function() {
+    const proxy = new Proxy({}, {});
+    Symbol.prototype.description.call(proxy);
+  }, TypeError);
+
+  assertThrows(function() {
+    const smi = 123;
+    Symbol.prototype.description.call(smi);
+  }, TypeError);
+
+  assertThrows(function() {
+    const str = 'string';
+    Symbol.prototype.description.call(string);
+  }, TypeError);
+
+  assertThrows(function() {
+    const obj = { prop: 'test' };
+    Symbol.prototype.description.call(obj);
+  }, TypeError);
+}
diff --git a/deps/v8/test/mjsunit/ignition/throw-if-hole.js b/deps/v8/test/mjsunit/ignition/throw-if-hole.js
index ea3f6df605b1ed..ee7e4c88729b66 100644
--- a/deps/v8/test/mjsunit/ignition/throw-if-hole.js
+++ b/deps/v8/test/mjsunit/ignition/throw-if-hole.js
@@ -16,5 +16,5 @@ f(0);
 f(0);
 assertOptimized(f);
 // Check that hole checks are handled correctly in optimized code.
-assertThrowsEquals(() => {f(1)}, ReferenceError());
+assertThrows(() => {f(1)}, ReferenceError);
 assertOptimized(f);
diff --git a/deps/v8/test/mjsunit/ignition/throw-if-not-hole.js b/deps/v8/test/mjsunit/ignition/throw-if-not-hole.js
index 672e42ddf59528..c14972a859cd89 100644
--- a/deps/v8/test/mjsunit/ignition/throw-if-not-hole.js
+++ b/deps/v8/test/mjsunit/ignition/throw-if-not-hole.js
@@ -18,11 +18,11 @@ class B extends A {
 
 test = new B(0);
 test = new B(0);
-assertThrowsEquals(() => {new B(1)}, ReferenceError());
-assertThrowsEquals(() => {new B(1)}, ReferenceError());
+assertThrows(() => {new B(1)}, ReferenceError);
+assertThrows(() => {new B(1)}, ReferenceError);
 %OptimizeFunctionOnNextCall(B);
 test = new B(0);
 assertOptimized(B);
 // Check that hole checks are handled correctly in optimized code.
-assertThrowsEquals(() => {new B(1)}, ReferenceError());
+assertThrows(() => {new B(1)}, ReferenceError);
 assertOptimized(B);
diff --git a/deps/v8/test/mjsunit/ignition/throw-super-not-called.js b/deps/v8/test/mjsunit/ignition/throw-super-not-called.js
index c95509e6ce8670..ec60de85998c4a 100644
--- a/deps/v8/test/mjsunit/ignition/throw-super-not-called.js
+++ b/deps/v8/test/mjsunit/ignition/throw-super-not-called.js
@@ -21,5 +21,5 @@ test = new B(1);
 test = new B(1);
 assertOptimized(B);
 // Check that hole checks are handled correctly in optimized code.
-assertThrowsEquals(() => {new B(0)}, ReferenceError());
+assertThrows(() => {new B(0)}, ReferenceError);
 assertOptimized(B);
diff --git a/deps/v8/test/mjsunit/harmony/intl-numberformat-formattoparts.js b/deps/v8/test/mjsunit/intl-numberformat-formattoparts.js
similarity index 99%
rename from deps/v8/test/mjsunit/harmony/intl-numberformat-formattoparts.js
rename to deps/v8/test/mjsunit/intl-numberformat-formattoparts.js
index 3ffe6ced68a858..30ae3447088fc4 100644
--- a/deps/v8/test/mjsunit/harmony/intl-numberformat-formattoparts.js
+++ b/deps/v8/test/mjsunit/intl-numberformat-formattoparts.js
@@ -2,8 +2,6 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --harmony-number-format-to-parts
-
 // Adapted from Gecko's js/src/tests/Intl/NumberFormat/formatToParts.js,
 // which was dedicated to the public domain.
 
@@ -212,7 +210,6 @@ if (this.Intl) {
                Integer("٥٣٢"),
                Decimal("٫"),
                Fraction("٠٠"),
-               Literal("\xA0"),
                PercentSign("٪\u{061C}")]);
 
   // Decimals.
diff --git a/deps/v8/test/mjsunit/harmony/intl-pluralrules-select.js b/deps/v8/test/mjsunit/intl-pluralrules-select.js
similarity index 97%
rename from deps/v8/test/mjsunit/harmony/intl-pluralrules-select.js
rename to deps/v8/test/mjsunit/intl-pluralrules-select.js
index cced9b1335c717..6e2420211b7f4a 100644
--- a/deps/v8/test/mjsunit/harmony/intl-pluralrules-select.js
+++ b/deps/v8/test/mjsunit/intl-pluralrules-select.js
@@ -2,8 +2,6 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --harmony-plural-rules
-
 if (this.Intl) {
   var pr;
   var suffixes;
diff --git a/deps/v8/test/mjsunit/lexicographic-compare.js b/deps/v8/test/mjsunit/lexicographic-compare.js
new file mode 100644
index 00000000000000..b87dd1c1ef62c8
--- /dev/null
+++ b/deps/v8/test/mjsunit/lexicographic-compare.js
@@ -0,0 +1,62 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+(function () {
+
+  assertFalse(%IsSmi(2147483648), 'Update test for >32 bit Smi');
+
+  // Collect a list of interesting Smis.
+  const seen = {};
+  const smis = [];
+  function add(x) {
+    if (x | 0 == x) {
+      x = x | 0;  // Canonicalizes to Smi if 32-bit signed and fits in Smi.
+    }
+    if (%_IsSmi(x) && !seen[x]) {
+      seen[x] = 1;
+      smis.push(x);
+    }
+  }
+  function addSigned(x) {
+    add(x);
+    add(-x);
+  }
+
+  var BIGGER_THAN_ANY_SMI = 10 * 1000 * 1000 * 1000;
+  for (var xb = 1; xb <= BIGGER_THAN_ANY_SMI; xb *= 10) {
+    for (var xf = 0; xf <= 9; xf++) {
+      for (var xo = -1; xo <= 1; xo++) {
+        addSigned(xb * xf + xo);
+      }
+    }
+  }
+
+  console.log("A")
+
+  for (var yb = 1; yb <= BIGGER_THAN_ANY_SMI; yb *= 2) {
+    for (var yo = -2; yo <= 2; yo++) {
+      addSigned(yb + yo);
+    }
+  }
+
+  function test(x,y) {
+    const lex = %SmiLexicographicCompare(x, y);
+    const expected = (x == y) ? 0 : (("" + x) < ("" + y) ? -1 : 1);
+    return lex == expected;
+  }
+
+  console.log(smis.length);
+
+  for (var i = 0; i < smis.length; i++) {
+    for (var j = 0; j < smis.length; j++) {
+      const x = smis[i];
+      const y = smis[j];
+      assertTrue(test(x, y), x + " < " + y);;
+    }
+  }
+
+  console.log("C")
+})();
diff --git a/deps/v8/test/mjsunit/linecontinuation.js b/deps/v8/test/mjsunit/linecontinuation.js
new file mode 100644
index 00000000000000..a8f2f61dcac64c
--- /dev/null
+++ b/deps/v8/test/mjsunit/linecontinuation.js
@@ -0,0 +1,40 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// https://tc39.github.io/ecma262/#sec-literals-string-literals
+//
+// LineContinuation ::
+//   \ LineTerminatorSequence
+//
+// LineTerminatorSequence ::
+//   <LF>
+//   <CR>[lookahead ≠ <LF>]
+//   <LS>
+//   <PS>
+//   <CR><LF>
+
+// LineTerminatorSequence :: <LF>
+assertEquals('', eval('"\\\n"'));
+assertEquals('', eval("'\\\n'"));
+assertEquals('', eval('`\\\n`'));
+
+// LineTerminatorSequence :: <CR>[lookahead ≠ <LF>]
+assertEquals('', eval('"\\\r"'));
+assertEquals('', eval("'\\\r'"));
+assertEquals('', eval('`\\\r`'));
+
+// LineTerminatorSequence :: <LS>
+assertEquals('', eval('"\\\u2028"'));
+assertEquals('', eval("'\\\u2028'"));
+assertEquals('', eval('`\\\u2028`'));
+
+// LineTerminatorSequence :: <PS>
+assertEquals('', eval('"\\\u2029"'));
+assertEquals('', eval("'\\\u2029'"));
+assertEquals('', eval('`\\\u2029`'));
+
+// LineTerminatorSequence :: <CR><LF>
+assertEquals('', eval('"\\\r\n"'));
+assertEquals('', eval("'\\\r\n'"));
+assertEquals('', eval('`\\\r\n`'));
diff --git a/deps/v8/test/mjsunit/messages.js b/deps/v8/test/mjsunit/messages.js
index 39d7b02e2d6a3c..1dd9a058797ae5 100644
--- a/deps/v8/test/mjsunit/messages.js
+++ b/deps/v8/test/mjsunit/messages.js
@@ -44,19 +44,18 @@ test(function() {
 }, "Function.prototype.apply was called on 1, which is a number " +
    "and not a function", TypeError);
 
-// kArrayFunctionsOnFrozen
 test(function() {
   var a = [1, 2];
   Object.freeze(a);
   a.splice(1, 1, [1]);
-}, "Cannot modify frozen array elements", TypeError);
+}, "Cannot assign to read only property '1' of object '[object Array]'",
+   TypeError);
 
-// kArrayFunctionsOnSealed
 test(function() {
   var a = [1];
   Object.seal(a);
   a.shift();
-}, "Cannot add/remove sealed array elements", TypeError);
+}, "Cannot delete property '0' of [object Array]", TypeError);
 
 // kCalledNonCallable
 test(function() {
@@ -291,6 +290,20 @@ test(function() {
   new Map([1]);
 }, "Iterator value 1 is not an entry object", TypeError);
 
+test(function() {
+  let holeyDoubleArray = [, 123.123];
+  assertTrue(%HasDoubleElements(holeyDoubleArray));
+  assertTrue(%HasHoleyElements(holeyDoubleArray));
+  new Map(holeyDoubleArray);
+}, "Iterator value undefined is not an entry object", TypeError);
+
+test(function() {
+  let holeyDoubleArray = [, 123.123];
+  assertTrue(%HasDoubleElements(holeyDoubleArray));
+  assertTrue(%HasHoleyElements(holeyDoubleArray));
+  new WeakMap(holeyDoubleArray);
+}, "Iterator value undefined is not an entry object", TypeError);
+
 // kNotConstructor
 test(function() {
   new Symbol();
diff --git a/deps/v8/test/mjsunit/mjsunit.js b/deps/v8/test/mjsunit/mjsunit.js
index e51f2a99108f46..60f2219db16aae 100644
--- a/deps/v8/test/mjsunit/mjsunit.js
+++ b/deps/v8/test/mjsunit/mjsunit.js
@@ -135,7 +135,15 @@ var assertContains;
 // Assert that a string matches a given regex.
 var assertMatches;
 
-// Assert the result of a promise.
+// Assert that a promise resolves or rejects.
+// Parameters:
+// {promise} - the promise
+// {success} - optional - a callback which is called with the result of the
+//             resolving promise.
+//  {fail} -   optional - a callback which is called with the result of the
+//             rejecting promise. If the promise is rejected but no {fail}
+//             callback is set, the error is propagated out of the promise
+//             chain.
 var assertPromiseResult;
 
 var promiseTestChain;
@@ -270,7 +278,7 @@ var prettyPrinted;
           case "Object":
             break;
           default:
-            return objectClass + "()";
+            return objectClass + "(" + String(value) + ")";
         }
         // [[Class]] is "Object".
         var name = value.constructor.name;
@@ -498,7 +506,7 @@ var prettyPrinted;
     try {
       fun();
     } catch(e) {
-      assertEquals(val, e);
+      assertSame(val, e);
       return;
     }
     failWithMessage("Did not throw exception");
@@ -555,35 +563,47 @@ var prettyPrinted;
     }
   };
 
+  function concatenateErrors(stack, exception) {
+    // If the exception does not contain a stack trace, wrap it in a new Error.
+    if (!exception.stack) exception = new Error(exception);
+
+    // If the exception already provides a special stack trace, we do not modify
+    // it.
+    if (typeof exception.stack !== 'string') {
+      return exception;
+    }
+    exception.stack = stack + '\n\n' + exception.stack;
+    return exception;
+  }
+
   assertPromiseResult = function(promise, success, fail) {
-    // Use --allow-natives-syntax to use this function. Note that this function
-    // overwrites {failWithMessage} permanently with %AbortJS.
-
-    // We have to patch mjsunit because normal assertion failures just throw
-    // exceptions which are swallowed in a then clause.
-    // We use eval here to avoid parsing issues with the natives syntax.
-    if (!success) success = () => {};
-
-    failWithMessage = (msg) => eval("%AbortJS(msg)");
-    if (!fail) {
-      fail = result => failWithMessage("assertPromiseResult failed: " + result);
-    }
-
-    var test_promise =
-        promise.then(
-          result => {
-            try {
-              success(result);
-            } catch (e) {
-              failWithMessage(String(e));
-            }
-          },
-          result => {
+    const stack = (new Error()).stack;
+
+    var test_promise = promise.then(
+        result => {
+          try {
+            if (--promiseTestCount == 0) testRunner.notifyDone();
+            if (success) success(result);
+          } catch (e) {
+            // Use setTimeout to throw the error again to get out of the promise
+            // chain.
+            setTimeout(_ => {
+              throw concatenateErrors(stack, e);
+            }, 0);
+          }
+        },
+        result => {
+          try {
+            if (--promiseTestCount == 0) testRunner.notifyDone();
+            if (!fail) throw result;
             fail(result);
+          } catch (e) {
+            // Use setTimeout to throw the error again to get out of the promise
+            // chain.
+            setTimeout(_ => {
+              throw concatenateErrors(stack, e);
+            }, 0);
           }
-        )
-        .then((x)=> {
-          if (--promiseTestCount == 0) testRunner.notifyDone();
         });
 
     if (!promiseTestChain) promiseTestChain = Promise.resolve();
diff --git a/deps/v8/test/mjsunit/mjsunit.status b/deps/v8/test/mjsunit/mjsunit.status
index 05f8285dd9b078..63e73d1a4e29d3 100644
--- a/deps/v8/test/mjsunit/mjsunit.status
+++ b/deps/v8/test/mjsunit/mjsunit.status
@@ -55,6 +55,8 @@
   # Issue 5495: enable the test when the constant field tracking in enabled.
   'const-field-tracking': [SKIP],
 
+  # Issue 7872: flaky OOM
+  'regress/wasm/regress-827806': [SKIP],
   ##############################################################################
   # Too slow in debug mode with --stress-opt mode.
   'regress/regress-create-exception': [PASS, ['mode == debug', SKIP]],
@@ -87,7 +89,7 @@
   'array-constructor': [PASS, SLOW, ['arch == arm and simulator == True', SKIP]],
 
   # Very slow test
-  'regress/regress-crbug-808192' : [PASS, SLOW, NO_VARIANTS, ['arch == arm or arch == arm64 or arch == android_arm or arch == android_arm64 or arch == mipsel or arch == mips64el or arch == mips64 or arch == mips or arch == s390 or arch == s390x or arch == ppc or arch == ppc64', SKIP]],
+  'regress/regress-crbug-808192' : [PASS, SLOW, NO_VARIANTS, ['mode == debug or arch == arm or arch == arm64 or arch == android_arm or arch == android_arm64 or arch == mipsel or arch == mips64el or arch == mips64 or arch == mips or arch == s390 or arch == s390x or arch == ppc or arch == ppc64', SKIP]],
 
   # Very slow on ARM and MIPS, contains no architecture dependent code.
   'unicode-case-overoptimization': [PASS, NO_VARIANTS, ['arch == arm or arch == arm64 or arch == android_arm or arch == android_arm64 or arch == mipsel or arch == mips64el or arch == mips64 or arch == mips', SKIP]],
@@ -120,10 +122,11 @@
   'tools/dumpcpp': [PASS, NO_VARIANTS, ['arch == android_arm or arch == android_arm64 or arch == android_ia32', SKIP]],
 
   ##############################################################################
-  # This test generates a file in the test directory, so we cannot run several
-  # variants of the test simultaneously. Additionally the test should not be
-  # affected by variants.
+  # These tests generate files in the test directory, so we cannot run several
+  # variants of them simultaneously. Additionally they should not be affected by
+  # variants.
   'd8/enable-tracing': [PASS, NO_VARIANTS],
+  'tools/compiler-trace-flags': [PASS, NO_VARIANTS],
 
   ##############################################################################
   # Long running test that reproduces memory leak and should be run manually.
@@ -152,8 +155,6 @@
   'asm/sqlite3/*': [PASS, SLOW, NO_VARIANTS],
 
   # Slow tests.
-  'compiler/osr-one': [PASS, SLOW],
-  'compiler/osr-two': [PASS, SLOW],
   'copy-on-write-assert': [PASS, SLOW],
   'es6/typedarray-construct-offset-not-smi': [PASS, SLOW],
   'harmony/regexp-property-script-extensions': [PASS, SLOW],
@@ -163,6 +164,7 @@
   'regress/regress-605470': [PASS, SLOW],
   'regress/regress-655573': [PASS, SLOW],
   'regress/regress-1200351': [PASS, SLOW],
+  'wasm/asm-wasm-f32': [PASS, SLOW],
   'wasm/embenchen/*': [PASS, SLOW],
   'wasm/grow-memory': [PASS, SLOW],
   'wasm/unreachable-validation': [PASS, SLOW],
@@ -198,11 +200,23 @@
   #                  which makes the test useless.
   'big-object-literal': [PASS, ['mode == debug', SKIP]],
 
+  # Runs out of stack space in debug builds.
+  'big-array-literal': [PASS, ['mode == debug', SKIP]],
+
   # BUG(v8:6306).
   'wasm/huge-memory': [SKIP],
 
   # Allocates a huge string and then flattens it, very slow in debug mode.
   'regress/regress-752764': [PASS, ['mode == debug', SLOW]],
+
+  # https://crbug.com/v8/7682
+  'regress/regress-v8-7682': [FAIL],
+
+  # https://crbug.com/v8/7697
+  'array-literal-feedback': [PASS, FAIL],
+
+  # https://crbug.com/v8/7775
+  'allocation-site-info': [SKIP],
 }],  # ALWAYS
 
 ['novfp3 == True', {
@@ -236,7 +250,6 @@
   'osr-elements-kind': [SKIP],
   'regress/regress-crbug-137689': [SKIP],
   'regress/regress-trap-allocation-memento': [SKIP],
-  'regress/regress-165637': [SKIP],
   'regress/regress-2249': [SKIP],
   'regress/regress-4121': [SKIP],
   'compare-known-objects-slow': [SKIP],
@@ -257,6 +270,7 @@
 
   # TODO(mstarzinger): Takes too long with TF.
   'array-sort': [PASS, NO_VARIANTS],
+  'lexicographic-compare': [PASS, NO_VARIANTS],
   'regress/regress-91008': [PASS, NO_VARIANTS],
   'regress/regress-transcendental': [PASS, ['arch == arm64', NO_VARIANTS]],
   'compiler/osr-regress-max-locals': [PASS, NO_VARIANTS],
@@ -276,8 +290,6 @@
   # Slow tests.
   'array-constructor': [PASS, SLOW],
   'json': [PASS, SLOW],
-  'regress/regress-446389': [PASS, SLOW],
-  'regress/regress-inline-getter-near-stack-limit': [PASS, SLOW],
 
   # BUG(v8:4779): Crashes flakily with stress mode on arm64.
   'array-splice': [PASS, SLOW, ['arch == arm64', NO_VARIANTS]],
@@ -288,6 +300,15 @@
   # BUG(chromium:773631): Crashes flakily.
   'wasm/streaming-trap-location': [SKIP],
 
+  # BUG(v8:7880): Slow tests.
+  'regress/regress-707066': [SKIP],
+  'regress/regress-446389': [SKIP],
+  'regress/regress-458987': [SKIP],
+  'es6/regress/regress-crbug-465671': [SKIP],
+  'regress/regress-inline-getter-near-stack-limit': [SKIP],
+  'es6/regress/regress-crbug-465671-null': [SKIP],
+  'regress/regress-148378': [SKIP],
+  'regress/regress-crbug-762472': [SKIP],
 }],  # 'gc_stress == True'
 
 ##############################################################################
@@ -345,11 +366,11 @@
   'compiler/osr-with-args': [PASS, SLOW],
   'generated-transition-stub': [PASS, SLOW],
   'json2': [PASS, SLOW],
+  'lexicographic-compare': [PASS, SLOW],
   'math-floor-of-div-nosudiv': [PASS, SLOW],
   'math-floor-of-div': [PASS, SLOW],
   'messages': [PASS, SLOW],
   'packed-elements': [PASS, SLOW],
-  'regress/regress-2185-2': [PASS, SLOW],
   'regress/regress-2185': [PASS, SLOW],
   'regress/regress-2790': [PASS, SLOW],
   'regress/regress-331444': [PASS, SLOW],
@@ -372,6 +393,7 @@
 
   # Pass but take too long with the simulator in debug mode.
   'array-sort': [PASS, SLOW],
+  'lexicographic-compare': [PASS, SLOW],
   'packed-elements': [SKIP],
   'regexp-global': [SKIP],
   'math-floor-of-div': [PASS, SLOW],
@@ -380,8 +402,6 @@
   'unicodelctest-no-optimization': [PASS, SLOW],
   # Issue 3219:
   'getters-on-elements': [PASS, ['gc_stress == True', FAIL]],
-  # Expects to finish in a certain time, but sometimes doesn't.
-  'regress/regress-165637': [SKIP],
 }],  # 'arch == arm64 and mode == debug and simulator_run'
 
 ##############################################################################
@@ -422,10 +442,6 @@
 
   # Too slow.
   'harmony/regexp-property-lu-ui': [SKIP],
-  'regress/regress-165637': [SKIP],
-
-  # Flaky with baseline?
-  'regress/regress-2185-2': [SKIP],
 
   # https://bugs.chromium.org/p/v8/issues/detail?id=7102
   # Flaky due to huge string allocation.
@@ -486,8 +502,8 @@
   # Slow tests.
   'array-sort': [PASS, SLOW],
   'compiler/osr-with-args': [PASS, SLOW],
+  'lexicographic-compare': [PASS, SLOW],
   'packed-elements': [PASS, SLOW],
-  'regress/regress-2185-2': [PASS, SLOW],
   'regress/regress-2790': [PASS, SLOW],
   'regress/regress-91008': [PASS, SLOW],
   'regress/regress-json-stringify-gc': [PASS, SLOW],
@@ -632,7 +648,6 @@
 
   # Skip tests that are not suitable for deoptimization fuzzing.
   'never-optimize': [SKIP],
-  'regress/regress-2185-2': [SKIP],
   'readonly': [SKIP],
   'array-feedback': [SKIP],
   'deopt-recursive-eager-once': [SKIP],
@@ -675,7 +690,9 @@
   'elements-transition-hoisting': [PASS, FAIL],
   'es6/collections-constructor-custom-iterator': [PASS, FAIL],
   'keyed-load-with-symbol-key': [PASS, FAIL],
+  'object-seal': [PASS, FAIL],
   'regress/regress-3709': [PASS, FAIL],
+  'regress/regress-7510': [PASS, FAIL],
   'regress/regress-trap-allocation-memento': [PASS, FAIL],
   'regress/regress-unlink-closures-on-deopt': [PASS, FAIL],
   'shared-function-tier-up-turbo': [PASS, FAIL],
@@ -714,7 +731,7 @@
 }],  # 'predictable == True'
 
 ##############################################################################
-['arch == ppc and simulator_run or arch == ppc64 and simulator_run', {
+['simulator_run and (arch == ppc or arch == ppc64 or arch == s390 or arch == s390x)', {
 
   # take too long with the simulator.
   'regress/regress-1132': [SKIP],
@@ -723,7 +740,7 @@
   'regress/regress-91008': [PASS, SLOW],
   'harmony/regexp-property-lu-ui': [PASS, SLOW],
   'whitespaces': [PASS, SLOW],
-}],  # 'arch == ppc and simulator_run'
+}],  # 'simulator_run and (arch == ppc or arch == ppc64 or arch == s390 or arch == s390x)'
 
 ##############################################################################
 ['arch == ppc64', {
@@ -736,9 +753,6 @@
 ##############################################################################
 ['arch == ppc64 or arch == ppc or arch == s390 or arch == s390x', {
 
-  # TODO(ppc/s390): implement atomic operations
-  'wasm/atomics': [SKIP],
-  'wasm/shared-memory': [SKIP],
   # TODO(ppc/s390): fix constant pool issue and implement tagging for reloc
   'wasm/compiled-module-serialization': [SKIP],
   'regress/wasm/regress-808980': [SKIP],
@@ -753,15 +767,17 @@
   'ignition/regress-599001-verifyheap': [SKIP],
   'unicode-test': [SKIP],
 
-  # Slow tests.
-  'regress/regress-2185-2': [SKIP],
+  # Flaky crash on Odroid devices: https://crbug.com/v8/7678
+  'regress/regress-336820': [PASS, ['arch == arm and not simulator_run', SKIP]],
 }],  # variant == stress
 
 ##############################################################################
-['variant == nooptimization', {
-  # Slow tests.
-  'regress/regress-2185-2': [SKIP],
-}],  # variant == nooptimization
+['variant == nooptimization and (arch == arm or arch == arm64) and simulator_run', {
+  # Slow tests: https://crbug.com/v8/7783
+  'lexicographic-compare': [SKIP],
+  'regress/regress-2185': [SKIP],
+  'wasm/grow-memory': [SKIP],
+}],  # variant == nooptimization and (arch == arm or arch == arm64) and simulator_run
 
 ##############################################################################
 ['gcov_coverage', {
@@ -773,7 +789,7 @@
 }],  # 'gcov_coverage'
 
 ##############################################################################
-['variant == wasm_traps', {
+['variant == no_wasm_traps', {
   # Skip stuff uninteresting for wasm traps
   'bugs/*': [SKIP],
   'compiler/*': [SKIP],
@@ -789,7 +805,7 @@
   'math-*': [SKIP],
   'unicode-test': [SKIP],
   'whitespaces': [SKIP],
-}],  # variant == wasm_traps
+}],  # variant == no_wasm_traps
 
 ##############################################################################
 ['no_harness', {
@@ -811,13 +827,6 @@
   'wasm/liftoff': [SKIP],
 }], # arch != x64 and arch != ia32
 
-##############################################################################
-['variant == liftoff', {
-  # In the liftoff variant, liftoff compilation happens even though the test
-  # does not explicitly enable it.
-  'wasm/default-liftoff-setting': [SKIP],
-}], # variant == liftoff
-
 ##############################################################################
 ['variant == slow_path and gc_stress', {
   # Slow tests.
@@ -825,4 +834,11 @@
   'string-replace-gc': [SKIP],
 }],  # variant == slow_path
 
+##############################################################################
+['arch == x64', {
+  # TODO: Flaky test: crbug.com/v8/7899
+  'wasm/asm-wasm-i32': [SKIP],
+  'wasm/asm-wasm-f64': [SKIP],
+}], # arch == x64
+
 ]
diff --git a/deps/v8/test/mjsunit/object-keys.js b/deps/v8/test/mjsunit/object-keys.js
index 29eb85d6aa7bac..d20556c9057786 100644
--- a/deps/v8/test/mjsunit/object-keys.js
+++ b/deps/v8/test/mjsunit/object-keys.js
@@ -32,3 +32,61 @@
   k.shift();
   assertEquals(0, k.length);
 })();
+
+// Ensure we invoke all steps on proxies.
+(function ObjectKeysProxy() {
+  let log = [];
+  let result = Object.keys(new Proxy({}, {
+    ownKeys(target) {
+      log.push('ownKeys');
+      return ['a', 'b', 'c'];
+    },
+    getOwnPropertyDescriptor(target, key) {
+      log.push('getOwnPropertyDescriptor-' + key);
+      if (key === 'b') return {enumerable: false, configurable: true};
+      return {enumerable: true, configurable: true};
+    }
+  }));
+  assertEquals(['a', 'c'], result);
+  assertEquals(
+      [
+        'ownKeys', 'getOwnPropertyDescriptor-a', 'getOwnPropertyDescriptor-b',
+        'getOwnPropertyDescriptor-c'
+      ],
+      log);
+
+  // Test normal target.
+  log = [];
+  let target = {a: 1, b: 1, c: 1};
+  let handler = {
+    getOwnPropertyDescriptor(target, key) {
+      log.push('getOwnPropertyDescriptor-' + key);
+      if (key === 'b') return {enumerable: false, configurable: true};
+      return {enumerable: true, configurable: true};
+    }
+  };
+  result = Object.keys(new Proxy(target, handler));
+  assertEquals(['a', 'c'], result);
+  assertEquals(
+      [
+        'getOwnPropertyDescriptor-a', 'getOwnPropertyDescriptor-b',
+        'getOwnPropertyDescriptor-c'
+      ],
+      log);
+
+  // Test trap invocation with non-enumerable target properties.
+  log = [];
+  target = Object.create(Object.prototype, {
+    a: {enumerable: true, configurable: true},
+    b: {enumerable: false, configurable: true},
+    c: {enumerable: true, configurable: true}
+  });
+  result = Object.keys(new Proxy(target, handler));
+  assertEquals(['a', 'c'], result);
+  assertEquals(
+      [
+        'getOwnPropertyDescriptor-a', 'getOwnPropertyDescriptor-b',
+        'getOwnPropertyDescriptor-c'
+      ],
+      log);
+})();
diff --git a/deps/v8/test/mjsunit/proto-elements-add-during-foreach.js b/deps/v8/test/mjsunit/proto-elements-add-during-foreach.js
index 8ee4ebc37c2219..83b800011bb6e8 100644
--- a/deps/v8/test/mjsunit/proto-elements-add-during-foreach.js
+++ b/deps/v8/test/mjsunit/proto-elements-add-during-foreach.js
@@ -2,9 +2,37 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-var a = [0,1,2,,,,7];
-var proto = {}
-a.__proto__ = proto;
-var visits = 0;
-Array.prototype.forEach.call(a, (v,i,o) => { ++visits; proto[4] = 4; });
-assertEquals(5, visits);
+(()=>{
+  var a = [0,1,2,,,,7];
+  var proto = {}
+  a.__proto__ = proto;
+  var visits = 0;
+  Array.prototype.forEach.call(a, (v,i,o) => { ++visits; proto[4] = 4; });
+  assertEquals(5, visits);
+})();
+
+// We have a fast path for arrays with the initial array prototype.
+// If elements are inserted into the initial array prototype as we traverse
+// a holey array, we should gracefully exit the fast path.
+(()=>{
+  let a = [1, 2, 3,,,, 7];
+  function poison(v, i) {
+    if (i === 2) {
+      [].__proto__[4] = 3;
+    }
+    return v*v;
+  }
+  a.forEach(poison);
+})();
+
+// Same, but for a double array.
+(()=>{
+  let a = [1, 2.5, 3,,,, 7];
+  function poison(v, i) {
+    if (i === 2) {
+      [].__proto__[4] = 3;
+    }
+    return v*v;
+  }
+  a.forEach(poison);
+})();
diff --git a/deps/v8/test/mjsunit/regexp-modifiers-autogenerated-i18n.js b/deps/v8/test/mjsunit/regexp-modifiers-autogenerated-i18n.js
index 18e086c3393d16..aace7113a26b03 100644
--- a/deps/v8/test/mjsunit/regexp-modifiers-autogenerated-i18n.js
+++ b/deps/v8/test/mjsunit/regexp-modifiers-autogenerated-i18n.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --regexp-mode-modifiers --harmony-regexp-property
+// Flags: --regexp-mode-modifiers
 
 // These regexps are just grepped out of the other tests we already have
 // and the syntax changed from out-of-line i flag to inline i flag.
diff --git a/deps/v8/test/mjsunit/regexp-modifiers-autogenerated.js b/deps/v8/test/mjsunit/regexp-modifiers-autogenerated.js
index e74ea8b3841f75..82d1341b2a17de 100644
--- a/deps/v8/test/mjsunit/regexp-modifiers-autogenerated.js
+++ b/deps/v8/test/mjsunit/regexp-modifiers-autogenerated.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --regexp-mode-modifiers --harmony-regexp-property
+// Flags: --regexp-mode-modifiers
 
 // These regexps are just grepped out of the other tests we already have
 // and the syntax changed from out-of-line i flag to inline i flag.
diff --git a/deps/v8/test/mjsunit/regress/regress-165637.js b/deps/v8/test/mjsunit/regress/regress-165637.js
index 6e287263561b75..2a7fc4421fca0b 100644
--- a/deps/v8/test/mjsunit/regress/regress-165637.js
+++ b/deps/v8/test/mjsunit/regress/regress-165637.js
@@ -1,53 +1,6 @@
 // Copyright 2012 the V8 project authors. All rights reserved.
-// Redistribution and use in source and binary forms, with or without
-// modification, are permitted provided that the following conditions are
-// met:
-//
-//     * Redistributions of source code must retain the above copyright
-//       notice, this list of conditions and the following disclaimer.
-//     * Redistributions in binary form must reproduce the above
-//       copyright notice, this list of conditions and the following
-//       disclaimer in the documentation and/or other materials provided
-//       with the distribution.
-//     * Neither the name of Google Inc. nor the names of its
-//       contributors may be used to endorse or promote products derived
-//       from this software without specific prior written permission.
-//
-// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
-// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
-// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
-// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
-// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
-// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
-// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-
-// Flags: --allow-natives-syntax
-
-// Should not take a very long time (n^2 algorithms are bad)
-
-function do_slices() {
-  var data = new Array(1024 * 12); // 12kB
-
-  for (var i = 0; i < data.length; i++) {
-    data[i] = 255;
-  }
-
-  var start = Date.now();
-
-  for (i = 0; i < 20000; i++) {
-    data.slice(4, 1);
-  }
-
-  return Date.now() - start;
-}
-
-// Should never take more than 3 seconds (if the bug is fixed, the test takes
-// considerably less time than 3 seconds).
-assertTrue(do_slices() < (3 * 1000));
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
 
 // Make sure that packed and unpacked array slices are still properly handled
 var holey_array = [1, 2, 3, 4, 5,,,,,,];
diff --git a/deps/v8/test/mjsunit/regress/regress-2185-2.js b/deps/v8/test/mjsunit/regress/regress-2185-2.js
deleted file mode 100644
index b1eedb9335a8e1..00000000000000
--- a/deps/v8/test/mjsunit/regress/regress-2185-2.js
+++ /dev/null
@@ -1,145 +0,0 @@
-// Copyright 2012 the V8 project authors. All rights reserved.
-// Redistribution and use in source and binary forms, with or without
-// modification, are permitted provided that the following conditions are
-// met:
-//
-//     * Redistributions of source code must retain the above copyright
-//       notice, this list of conditions and the following disclaimer.
-//     * Redistributions in binary form must reproduce the above
-//       copyright notice, this list of conditions and the following
-//       disclaimer in the documentation and/or other materials provided
-//       with the distribution.
-//     * Neither the name of Google Inc. nor the names of its
-//       contributors may be used to endorse or promote products derived
-//       from this software without specific prior written permission.
-//
-// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
-// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
-// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
-// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
-// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
-// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
-// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-
-// These tests used to time out before this was fixed.
-
-var LEN = 2e4;
-
-function short() {
-  var sum = 0;
-  for (var i = 0; i < 1000; i++) {
-    var a = [1, 4, 34, 23, 6, 123, 3, 2, 11, 515, 4, 33, 22, 2, 2, 1, 0, 123,
-            23, 42, 43, 1002, 44, 43, 101, 23, 55, 11, 101, 102, 45, 11, 404,
-            31415, 34, 53, 453, 45, 34, 5, 2, 35, 5, 345, 36, 45, 345, 3, 45,
-            3, 5, 5, 2, 2342344, 2234, 23, 2718, 1500, 2, 19, 22, 43, 41, 0,
-            -1, 33, 45, 78];
-    a.sort(function(a, b) { return a - b; });
-    sum += a[0];
-  }
-  return sum;
-}
-
-function short_bench(name, array) {
-  var start = new Date();
-  short();
-  var end = new Date();
-  var ms = end - start;
-  print("Short " + Math.floor(ms) + "ms");
-}
-
-function sawseq(a, tooth) {
-  var count = 0;
-  while (true) {
-    for (var i = 0; i < tooth; i++) {
-      a.push(i);
-      if (++count >= LEN) return a;
-    }
-  }
-}
-
-function sawseq2(a, tooth) {
-  var count = 0;
-  while (true) {
-    for (var i = 0; i < tooth; i++) {
-      a.push(i);
-      if (++count >= LEN) return a;
-    }
-    for (var i = 0; i < tooth; i++) {
-      a.push(tooth - i);
-      if (++count >= LEN) return a;
-    }
-  }
-}
-
-function sawseq3(a, tooth) {
-  var count = 0;
-  while (true) {
-    for (var i = 0; i < tooth; i++) {
-      a.push(tooth - i);
-      if (++count >= LEN) return a;
-    }
-  }
-}
-
-function up(a) {
-  for (var i = 0; i < LEN; i++) {
-    a.push(i);
-  }
-  return a;
-}
-
-function down(a) {
-  for (var i = 0; i < LEN; i++) {
-    a.push(LEN - i);
-  }
-  return a;
-}
-
-function ran(a) {
-  for (var i = 0; i < LEN; i++) {
-    a.push(Math.floor(Math.random() * LEN));
-  }
-  return a;
-}
-
-var random = ran([]);
-var asc = up([]);
-var desc = down([]);
-var asc_desc = down(up([]));
-var desc_asc = up(down([]));
-var asc_asc = up(up([]));
-var desc_desc = down(down([]));
-var saw1 = sawseq([], 1000);
-var saw2 = sawseq([], 500);
-var saw3 = sawseq([], 200);
-var saw4 = sawseq2([], 200);
-var saw5 = sawseq3([], 200);
-
-function bench(name, array) {
-  var start = new Date();
-  array.sort(function(a, b) { return a - b; });
-  var end = new Date();
-  for (var i = 0; i < array.length - 1; i++) {
-    if (array[i] > array[i + 1]) throw name + " " + i;
-  }
-  var ms = end - start;
-  print(name + " " + Math.floor(ms) + "ms");
-}
-
-short_bench();
-bench("random", random);
-bench("up", asc);
-bench("down", desc);
-bench("saw 1000", saw1);
-bench("saw 500", saw2);
-bench("saw 200", saw3);
-bench("saw 200 symmetric", saw4);
-bench("saw 200 down", saw4);
-bench("up, down", asc_desc);
-bench("up, up", asc_asc);
-bench("down, down", desc_desc);
-bench("down, up", desc_asc);
diff --git a/deps/v8/test/mjsunit/regress/regress-298269.js b/deps/v8/test/mjsunit/regress/regress-298269.js
index f6604dfcb63f5e..46f525edb81b4f 100644
--- a/deps/v8/test/mjsunit/regress/regress-298269.js
+++ b/deps/v8/test/mjsunit/regress/regress-298269.js
@@ -1,36 +1,16 @@
 // Copyright 2013 the V8 project authors. All rights reserved.
-// Redistribution and use in source and binary forms, with or without
-// modification, are permitted provided that the following conditions are
-// met:
-//
-//     * Redistributions of source code must retain the above copyright
-//       notice, this list of conditions and the following disclaimer.
-//     * Redistributions in binary form must reproduce the above
-//       copyright notice, this list of conditions and the following
-//       disclaimer in the documentation and/or other materials provided
-//       with the distribution.
-//     * Neither the name of Google Inc. nor the names of its
-//       contributors may be used to endorse or promote products derived
-//       from this software without specific prior written permission.
-//
-// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
-// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
-// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
-// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
-// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
-// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
-// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
 
-function Cb(a) {
+// Flags: --allow-natives-syntax
+
+function Cb(a, trigger) {
   var f, g;
   for(f = a.length; f--;) {
     g = a.charCodeAt(f);
     // This will fail after OSR if Runtime_StringCharCodeAt is modified
     // to iterates optimized frames and visit safepoint pointers.
+    if (g == "C".charCodeAt(0)) %OptimizeOsr();
   }
   return g;
 }
@@ -40,6 +20,5 @@ var s2 = "long string to make cons string 2";
 Cb(s1 + s2);
 Cb(s1);
 var s3 = "string for triggering osr in Cb";
-for (var i = 0; i < 16; i++) s3 = s3 + s3;
-Cb(s3);
+Cb(s3 + s3);
 Cb(s1 + s2);
diff --git a/deps/v8/test/mjsunit/regress/regress-373283.js b/deps/v8/test/mjsunit/regress/regress-373283.js
deleted file mode 100644
index 20cee4d808ed68..00000000000000
--- a/deps/v8/test/mjsunit/regress/regress-373283.js
+++ /dev/null
@@ -1,18 +0,0 @@
-// Copyright 2014 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-// Flags:  --allow-natives-syntax --deopt-every-n-times=1
-
-function __f_0() {
-  var x = [];
-  x[21] = 1;
-  x[21] + 0;
-}
-
-for (var i = 0; i < 3; i++) __f_0();
-%OptimizeFunctionOnNextCall(__f_0);
-for (var i = 0; i < 10; i++) __f_0();
-%OptimizeFunctionOnNextCall(__f_0);
-__f_0();
-%GetScript("foo");
diff --git a/deps/v8/test/mjsunit/regress/regress-484544.js b/deps/v8/test/mjsunit/regress/regress-484544.js
index 709a890376bfea..f8ba1d631a8f2d 100644
--- a/deps/v8/test/mjsunit/regress/regress-484544.js
+++ b/deps/v8/test/mjsunit/regress/regress-484544.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 //
-// Flags: --nouse-allocation-folding  --stress-compaction --predictable
+// Flags: --stress-compaction --predictable
 
 function f() {
   return [[], [], [[], [], []]];
diff --git a/deps/v8/test/mjsunit/regress/regress-705934.js b/deps/v8/test/mjsunit/regress/regress-705934.js
index 7dfc5bd65fb963..cd8ecc766f4716 100644
--- a/deps/v8/test/mjsunit/regress/regress-705934.js
+++ b/deps/v8/test/mjsunit/regress/regress-705934.js
@@ -2,12 +2,12 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --harmony-regexp-named-captures --stack-size=100
+// Flags: --stack-size=100
 
 function call_replace_close_to_stack_overflow() {
   try {
     call_replace_close_to_stack_overflow();
-  } catch(e) {
+  } catch {
     "b".replace(/(b)/g);
   }
 }
diff --git a/deps/v8/test/mjsunit/regress/regress-707410.js b/deps/v8/test/mjsunit/regress/regress-707410.js
index 4bacf8c6707135..a6a0aa52bbf06c 100644
--- a/deps/v8/test/mjsunit/regress/regress-707410.js
+++ b/deps/v8/test/mjsunit/regress/regress-707410.js
@@ -6,5 +6,4 @@
 
 var a = new Uint8Array(1024*1024);
 %ArrayBufferNeuter(a.buffer);
-var b = new Uint8Array(a);
-assertEquals(0, b.length);
+assertThrows(() => new Uint8Array(a));
diff --git a/deps/v8/test/mjsunit/regress/regress-747075.js b/deps/v8/test/mjsunit/regress/regress-747075.js
index 3b5116acd0d9e6..28165079353c1f 100644
--- a/deps/v8/test/mjsunit/regress/regress-747075.js
+++ b/deps/v8/test/mjsunit/regress/regress-747075.js
@@ -2,13 +2,20 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
+// Flags: --allow-natives-syntax
+
 r = [
   14, 14, 14, 14, 14, 14, 14, 14, 14, 14, 14, 14, 14, 14, 14, 14, 14, 14,
   14, 14, 14, 14, 14, 14, 14, 14, 14, 14, 14, 14, 14, 14, 14, 14, 14, 14
 ];
 
 
-for (i = -1; i < 100000; i++) {
+function f() {
   r2 = r.map(function(y) {return y/64} );
   assertTrue(r2[0] < 1);
 }
+
+for (let i = 0; i < 1000; ++i) f();
+for (let i = 0; i < 1000; ++i) f();
+%OptimizeFunctionOnNextCall(f);
+for (let i = 0; i < 1000; ++i) f();
diff --git a/deps/v8/test/mjsunit/regress/regress-7642.js b/deps/v8/test/mjsunit/regress/regress-7642.js
new file mode 100644
index 00000000000000..fa9f023e8ba6b4
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-7642.js
@@ -0,0 +1,58 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --harmony-public-fields
+
+const a = [2];
+const b = [4];
+
+let log;
+
+class C {
+  constructor(...args) {
+    log = args;
+  }
+}
+
+class D extends C {
+  field = 42;
+  constructor() { super(1) };
+}
+assertEquals(42, (new D).field);
+assertEquals([1], log);
+
+class E extends C {
+  field = 42;
+  constructor() { super(...a) };
+}
+assertEquals(42, (new E).field);
+assertEquals([2], log);
+
+class F extends C {
+  field = 42;
+  constructor() { super(1, ...a) };
+}
+assertEquals(42, (new F).field);
+assertEquals([1, 2], log);
+
+class G extends C {
+  field = 42;
+  constructor() { super(1, ...a, 3) };
+}
+assertEquals(42, (new G).field);
+assertEquals([1, 2, 3], log);
+
+class H extends C {
+  field = 42;
+  constructor() { super(1, ...a, 3, ...b) };
+}
+assertEquals(42, (new H).field);
+assertEquals([1, 2, 3, 4], log);
+
+class I extends C {
+  field = 42;
+  constructor() { super(1, ...a, 3, ...b, 5) };
+}
+assertEquals(42, (new I).field);
+assertEquals([1, 2, 3, 4, 5], log);
diff --git a/deps/v8/test/mjsunit/regress/regress-7652.js b/deps/v8/test/mjsunit/regress/regress-7652.js
new file mode 100644
index 00000000000000..c83df25f8d9764
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-7652.js
@@ -0,0 +1,26 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+const splice = Array.prototype.splice;
+const unshift = Array.prototype.unshift;
+
+{
+  let a = {length: 2**53 - 1};
+  assertThrows(() => unshift.call(a, 42), TypeError);
+  assertEquals(unshift.call(a), 2**53 - 1);
+}
+
+{
+  let a = {length: 2**53 - 1};
+  assertThrows(() => splice.call(a, 0, 0, 42), TypeError);
+  assertEquals(splice.call(a, 0, 1, 42).length, 1);
+  assertEquals(a[0], 42);
+}
+
+{
+  let a = {length: 2**53 - 1, [Symbol.isConcatSpreadable]: true};
+  assertThrows(() => [42].concat(a), TypeError);
+  assertThrows(() => [, ].concat(a), TypeError);
+  assertThrows(() => [].concat(42, a), TypeError);
+}
diff --git a/deps/v8/test/mjsunit/regress/regress-7677.js b/deps/v8/test/mjsunit/regress/regress-7677.js
new file mode 100644
index 00000000000000..0c951de6f75b14
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-7677.js
@@ -0,0 +1,63 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+"use strict";
+
+// Generate a frozen or sealed array-like object.
+function arraylike(freeze) {
+  let x;
+  const obj = {length: 42};
+  Object.defineProperty(obj, 5, {get() {return x}, set(y) {x = y}});
+  return freeze ? Object.freeze(obj) : Object.seal(obj);
+}
+
+// Array.prototype.fill
+{
+  const sealed = arraylike(false);
+  Array.prototype.fill.call(sealed, "foo", 5, 6);
+  assertEquals("foo", sealed[5]);
+  assertThrows(() => Array.prototype.fill.call(sealed, "foo"), TypeError);
+}{
+  const frozen = arraylike(true);
+  Array.prototype.fill.call(frozen, "foo", 5, 6);
+  assertEquals("foo", frozen[5]);
+  assertThrows(() => Array.prototype.fill.call(frozen, "foo"), TypeError);
+}
+
+// Array.prototype.shift
+{
+  const sealed = Object.seal({length: 0});
+  assertEquals(undefined, Array.prototype.shift.call(sealed));
+}{
+  const sealed = Object.seal({length: 42});
+  assertEquals(undefined, Array.prototype.shift.call(sealed));
+}{
+  let x;
+  let obj = {length: 42, [1]: "foo"};
+  Object.defineProperty(obj, 0, {get() {return x}, set(y) {x = y}});
+  const sealed = Object.seal(obj);
+  assertThrows(() => Array.prototype.shift.call(sealed), TypeError);
+  assertEquals("foo", sealed[0]);
+}{
+  const frozen = Object.freeze({length: 0});
+  assertThrows(() => Array.prototype.shift.call(frozen), TypeError);
+}
+
+// Array.prototype.splice
+{
+  const sealed = arraylike(false);
+  assertEquals([undefined], Array.prototype.splice.call(sealed, 5, 1, "foo"));
+  assertEquals("foo", sealed[5]);
+  assertThrows(() => Array.prototype.splice.call(sealed, 5, 0, "bar"),
+      TypeError);
+  assertEquals("foo", sealed[5]);
+}{
+  const frozen = arraylike(true);
+  assertThrows(() => Array.prototype.splice.call(frozen, 5, 1, "foo"),
+      TypeError);
+  assertEquals("foo", frozen[5]);
+  assertThrows(() => Array.prototype.splice.call(frozen, 5, 0, "bar"),
+      TypeError);
+  assertEquals("foo", frozen[5]);
+}
diff --git a/deps/v8/test/mjsunit/regress/regress-7716.js b/deps/v8/test/mjsunit/regress/regress-7716.js
new file mode 100644
index 00000000000000..ac891ceec537e8
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-7716.js
@@ -0,0 +1,51 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+
+// Deeply nested target.
+
+let proxy = new Proxy(function(){}, {});
+for (let i = 0; i < 100000; i++) {
+  proxy = new Proxy(proxy, {});
+}
+
+// We get a stack overflow in all cases except for Reflect.apply, which here
+// happens to run in constant space: Call jumps into CallProxy and CallProxy
+// jumps into the next Call.
+assertDoesNotThrow(() => Reflect.apply(proxy, {}, []));
+assertThrows(() => Reflect.construct(proxy, []), RangeError);
+assertThrows(() => Reflect.defineProperty(proxy, "x", {}), RangeError);
+assertThrows(() => Reflect.deleteProperty(proxy, "x"), RangeError);
+assertThrows(() => Reflect.get(proxy, "x"), RangeError);
+assertThrows(() => Reflect.getOwnPropertyDescriptor(proxy, "x"), RangeError);
+assertThrows(() => Reflect.getPrototypeOf(proxy), RangeError);
+assertThrows(() => Reflect.has(proxy, "x"), RangeError);
+assertThrows(() => Reflect.isExtensible(proxy), RangeError);
+assertThrows(() => Reflect.ownKeys(proxy), RangeError);
+assertThrows(() => Reflect.preventExtensions(proxy), RangeError);
+assertThrows(() => Reflect.setPrototypeOf(proxy, {}), RangeError);
+assertThrows(() => Reflect.set(proxy, "x", {}), RangeError);
+
+
+// Recursive handler.
+
+function run(trap, ...args) {
+  let handler = {};
+  const proxy = new Proxy(function(){}, handler);
+  handler[trap] = (target, ...args) => Reflect[trap](proxy, ...args);
+  return Reflect[trap](proxy, ...args);
+}
+
+assertThrows(() => run("apply", {}, []), RangeError);
+assertThrows(() => run("construct", []), RangeError);
+assertThrows(() => run("defineProperty", "x", {}), RangeError);
+assertThrows(() => run("deleteProperty", "x"), RangeError);
+assertThrows(() => run("get", "x"), RangeError);
+assertThrows(() => run("getOwnPropertyDescriptor", "x"), RangeError);
+assertThrows(() => run("has", "x"), RangeError);
+assertThrows(() => run("isExtensible"), RangeError);
+assertThrows(() => run("ownKeys"), RangeError);
+assertThrows(() => run("preventExtensions"), RangeError);
+assertThrows(() => run("setPrototypeOf", {}), RangeError);
+assertThrows(() => run("set", "x", {}), RangeError);
diff --git a/deps/v8/test/mjsunit/regress/regress-7791.js b/deps/v8/test/mjsunit/regress/regress-7791.js
new file mode 100644
index 00000000000000..9b4d2c4f1a5b8a
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-7791.js
@@ -0,0 +1,120 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+"use strict";
+
+
+// Data property last.
+
+{
+  const o = {
+    get foo() { return 666 },
+    foo: 42,
+  };
+  assertEquals(42, Object.getOwnPropertyDescriptor(o, 'foo').value);
+}
+
+{
+  const o = {
+    set foo(_) { },
+    foo: 42,
+  };
+  assertEquals(42, Object.getOwnPropertyDescriptor(o, 'foo').value);
+}
+
+{
+  const o = {
+    get foo() { return 666 },
+    set foo(_) { },
+    foo: 42,
+  };
+  assertEquals(42, Object.getOwnPropertyDescriptor(o, 'foo').value);
+}
+
+{
+  const o = {
+    get foo() { return 666 },
+    set ['foo'.slice()](_) { },
+    foo: 42,
+  };
+  assertEquals(42, Object.getOwnPropertyDescriptor(o, 'foo').value);
+}
+
+{
+  const o = {
+    get ['foo'.slice()]() { return 666 },
+    set ['foo'.slice()](_) { },
+    foo: 42,
+  };
+  assertEquals(42, Object.getOwnPropertyDescriptor(o, 'foo').value);
+}
+
+
+// Data property first.
+
+{
+  const o = {
+    foo: 666,
+    get foo() { return 42 },
+  };
+  assertEquals(42, Object.getOwnPropertyDescriptor(o, 'foo').get());
+}
+
+{
+  const o = {
+    foo: 666,
+    set foo(_) { },
+  };
+  assertEquals(undefined, Object.getOwnPropertyDescriptor(o, 'foo').get);
+  assertEquals(undefined, Object.getOwnPropertyDescriptor(o, 'foo').value);
+}
+
+{
+  const o = {
+    foo: 666,
+    get foo() { return 42 },
+    set foo(_) { },
+  };
+  assertEquals(42, Object.getOwnPropertyDescriptor(o, 'foo').get());
+}
+
+{
+  const o = {
+    foo: 666,
+    get ['foo'.slice()]() { return 42 },
+    set foo(_) { },
+  };
+  assertEquals(42, Object.getOwnPropertyDescriptor(o, 'foo').get());
+}
+
+{
+  const o = {
+    foo: 666,
+    get ['foo'.slice()]() { return 42 },
+    set ['foo'](_) { },
+  };
+  assertEquals(42, Object.getOwnPropertyDescriptor(o, 'foo').get());
+}
+
+
+// Data property in the middle.
+
+{
+  const o = {
+    get foo() { return 42 },
+    foo: 666,
+    set foo(_) { },
+  };
+  assertEquals(undefined, Object.getOwnPropertyDescriptor(o, 'foo').get);
+  assertEquals(undefined, Object.getOwnPropertyDescriptor(o, 'foo').set());
+}
+
+{
+  const o = {
+    set foo(_) { },
+    foo: 666,
+    get foo() { return 42 },
+  };
+  assertEquals(42, Object.getOwnPropertyDescriptor(o, 'foo').get());
+}
diff --git a/deps/v8/test/mjsunit/regress/regress-7893.js b/deps/v8/test/mjsunit/regress/regress-7893.js
new file mode 100644
index 00000000000000..5ed008e7cf9120
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-7893.js
@@ -0,0 +1,18 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --validate-asm --allow-natives-syntax
+
+function Module(stdlib, imports, buffer) {
+  "use asm";
+  function f() {
+    var bar = 0;
+    return 0x1e+bar|0;
+  }
+  return f;
+}
+var f = Module(this);
+assertTrue(%IsWasmCode(f));
+assertTrue(%IsAsmWasmCode(Module));
+assertEquals(0x1e, f());
diff --git a/deps/v8/test/mjsunit/regress/regress-793588.js b/deps/v8/test/mjsunit/regress/regress-793588.js
index 6ad7a76e2a72db..ea30d127753d26 100644
--- a/deps/v8/test/mjsunit/regress/regress-793588.js
+++ b/deps/v8/test/mjsunit/regress/regress-793588.js
@@ -2,8 +2,6 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --harmony-regexp-property
-
 assertNull(/a\P{Any}a/u.exec("a\u{d83d}a"));
 assertEquals(["a\u{d83d}a"], /a\p{Any}a/u.exec("a\u{d83d}a"));
 assertEquals(["a\u{d83d}a"], /(?:a\P{Any}a|a\p{Any}a)/u.exec("a\u{d83d}a"));
diff --git a/deps/v8/test/mjsunit/regress/regress-793793.js b/deps/v8/test/mjsunit/regress/regress-793793.js
index e89c5e5f343a3d..f7f57c7104a7a8 100644
--- a/deps/v8/test/mjsunit/regress/regress-793793.js
+++ b/deps/v8/test/mjsunit/regress/regress-793793.js
@@ -2,6 +2,4 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --harmony-regexp-property
-
 assertThrows(() => new RegExp("\\1(\\P{P\0[}()/", "u"), SyntaxError);
diff --git a/deps/v8/test/mjsunit/regress/regress-800651.js b/deps/v8/test/mjsunit/regress/regress-800651.js
index 420cc7c294f1e9..c6410f702eefbd 100644
--- a/deps/v8/test/mjsunit/regress/regress-800651.js
+++ b/deps/v8/test/mjsunit/regress/regress-800651.js
@@ -15,13 +15,17 @@ async function f() {
 }
 f();
 
-async function g() {
+async function importUndefined() {
   try {
-    let namespace = await import({ get toString() { return undefined; }});
+    await import({ get toString() { return undefined; }})
   } catch(e) {
     log(2);
   }
 }
+
+function g() {
+  let namespace = Promise.resolve().then(importUndefined);
+}
 g();
   %RunMicrotasks();
 assertEquals(list, [1,2]);
diff --git a/deps/v8/test/mjsunit/regress/regress-829889.js b/deps/v8/test/mjsunit/regress/regress-829889.js
deleted file mode 100644
index 4ddc3d789800b6..00000000000000
--- a/deps/v8/test/mjsunit/regress/regress-829889.js
+++ /dev/null
@@ -1,17 +0,0 @@
-// Copyright 2018 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-// Flags: --harmony-restrict-constructor-return --always-opt
-
-class Base {
-  constructor(x) {
-    return x;
-  }
-}
-class Derived extends Base {
-  constructor(use, x) {
-    super(use, x);
-  }
-}
-assertThrows(() => new Derived(true, 5), TypeError);
diff --git a/deps/v8/test/mjsunit/regress/regress-838766.js b/deps/v8/test/mjsunit/regress/regress-838766.js
new file mode 100644
index 00000000000000..1626ee24283c93
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-838766.js
@@ -0,0 +1,14 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+//
+// Flags: --allow-natives-syntax
+
+function foo(x) {
+  x = x | 2147483648;
+  return Number.parseInt(x + 65535, 8);
+}
+assertEquals(-72161, foo());
+assertEquals(-72161, foo());
+%OptimizeFunctionOnNextCall(foo);
+assertEquals(-72161, foo());
diff --git a/deps/v8/test/mjsunit/regress/regress-840106.js b/deps/v8/test/mjsunit/regress/regress-840106.js
new file mode 100644
index 00000000000000..b49464dce5223a
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-840106.js
@@ -0,0 +1,17 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var buffer = new ArrayBuffer(1024 * 1024);
+buffer.constructor = {
+  [Symbol.species]: new Proxy(function() {}, {
+    get: _ => {
+      %ArrayBufferNeuter(buffer);
+    }
+  })
+};
+var array1 = new Uint8Array(buffer, 0, 1024);
+assertThrows(() => new Uint8Array(array1));
+assertThrows(() => new Int8Array(array1));
diff --git a/deps/v8/test/mjsunit/regress/regress-842078.js b/deps/v8/test/mjsunit/regress/regress-842078.js
new file mode 100644
index 00000000000000..9ce6aecfd6e43e
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-842078.js
@@ -0,0 +1,14 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-externalize-string
+
+// Attempt to externalize a string that's in RO_SPACE, which is not allowed as
+// the string's map would need to be writable.
+assertThrows(() => {
+  externalizeString("1", false)
+});
+assertThrows(() => {
+  externalizeString("1", true)
+});
diff --git a/deps/v8/test/mjsunit/regress/regress-843062-1.js b/deps/v8/test/mjsunit/regress/regress-843062-1.js
new file mode 100644
index 00000000000000..60ea65abf5e793
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-843062-1.js
@@ -0,0 +1,18 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var sparse_array = [];
+
+sparse_array[100] = 3;
+sparse_array[200] = undefined;
+sparse_array[300] = 4;
+sparse_array[400] = 5;
+sparse_array[500] = 6;
+sparse_array[600] = 5;
+sparse_array[700] = 4;
+sparse_array[800] = undefined;
+sparse_array[900] = 3
+sparse_array[41999] = "filler";
+
+sparse_array.lastIndexOf(3, 99);
diff --git a/deps/v8/test/mjsunit/regress/regress-843062-2.js b/deps/v8/test/mjsunit/regress/regress-843062-2.js
new file mode 100644
index 00000000000000..30170d5a254b58
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-843062-2.js
@@ -0,0 +1,8 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+class C {
+  [1]() { return 'B'; }
+}
+Object.keys(C.prototype);
diff --git a/deps/v8/test/mjsunit/regress/regress-843062-3.js b/deps/v8/test/mjsunit/regress/regress-843062-3.js
new file mode 100644
index 00000000000000..e9ff907b4a5416
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-843062-3.js
@@ -0,0 +1,10 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function bar(len) { return new Array(len); }
+bar(0);
+%OptimizeFunctionOnNextCall(bar);
+bar(0);
diff --git a/deps/v8/test/mjsunit/regress/regress-849663.js b/deps/v8/test/mjsunit/regress/regress-849663.js
new file mode 100644
index 00000000000000..8e8304feb4afaa
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-849663.js
@@ -0,0 +1,7 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+const v1 = 0xFFFFFFFF;
+const v3 = new Float64Array();
+new Date(v3, v3, 0xFFFFFFFF,);
diff --git a/deps/v8/test/mjsunit/regress/regress-852258.js b/deps/v8/test/mjsunit/regress/regress-852258.js
new file mode 100644
index 00000000000000..0cf1a45c711560
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-852258.js
@@ -0,0 +1,11 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+try {
+  let ta0 = new Int16Array(0x24924925);
+  let ta2 = ta0.slice(1);
+  let ta1 = ta0.slice(0x24924924);
+} catch (e) {
+  // Allocation failed, that's fine.
+}
diff --git a/deps/v8/test/mjsunit/regress/regress-854066-2.js b/deps/v8/test/mjsunit/regress/regress-854066-2.js
new file mode 100644
index 00000000000000..d37126b0f6e402
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-854066-2.js
@@ -0,0 +1,14 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+oobArray = [];
+delete oobArray.__proto__[Symbol.iterator];
+for (let i = 0; i < 1e5; ++i) {
+  oobArray[i] = 1.1;
+}
+floatArray = new Float64Array(oobArray.length);
+Float64Array.from.call(function(length) {
+  oobArray.length = 0;
+  return floatArray;
+}, oobArray);
diff --git a/deps/v8/test/mjsunit/regress/regress-854066.js b/deps/v8/test/mjsunit/regress/regress-854066.js
new file mode 100644
index 00000000000000..418084b2a74b2b
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-854066.js
@@ -0,0 +1,13 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+oobArray = [];
+for (let i = 0; i < 1e5; ++i) {
+  oobArray[i] = 1.1;
+}
+floatArray = new Float64Array(oobArray.length);
+Float64Array.from.call(function(length) {
+  oobArray.length = 0;
+  return floatArray;
+}, oobArray);
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-217858.js b/deps/v8/test/mjsunit/regress/regress-crbug-217858.js
index d6d6e9feedb92b..26414c2b5a5d16 100644
--- a/deps/v8/test/mjsunit/regress/regress-crbug-217858.js
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-217858.js
@@ -1,37 +1,15 @@
 // Copyright 2013 the V8 project authors. All rights reserved.
-// Redistribution and use in source and binary forms, with or without
-// modification, are permitted provided that the following conditions are
-// met:
-//
-//     * Redistributions of source code must retain the above copyright
-//       notice, this list of conditions and the following disclaimer.
-//     * Redistributions in binary form must reproduce the above
-//       copyright notice, this list of conditions and the following
-//       disclaimer in the documentation and/or other materials provided
-//       with the distribution.
-//     * Neither the name of Google Inc. nor the names of its
-//       contributors may be used to endorse or promote products derived
-//       from this software without specific prior written permission.
-//
-// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
-// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
-// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
-// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
-// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
-// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
-// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
 
-// Flags: --noanalyze-environment-liveness
+// Flags: --noanalyze-environment-liveness --allow-natives-syntax
 
 var r = /r/;
 function f() {
   r[r] = function() {};
 }
 
-for (var i = 0; i < 300000; i++) {
+for (var i = 0; i < 300; i++) {
   f();
+  if (i == 150) %OptimizeOsr();
 }
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-347903.js b/deps/v8/test/mjsunit/regress/regress-crbug-347903.js
index b5174da0d07ee1..62572da095c134 100644
--- a/deps/v8/test/mjsunit/regress/regress-crbug-347903.js
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-347903.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --allow-natives-syntax --use-allocation-folding --verify-heap
+// Flags: --allow-natives-syntax --verify-heap
 
 function f() {
   var a = new Array(84632);
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-410033.js b/deps/v8/test/mjsunit/regress/regress-crbug-410033.js
deleted file mode 100644
index 63693e64f73241..00000000000000
--- a/deps/v8/test/mjsunit/regress/regress-crbug-410033.js
+++ /dev/null
@@ -1,7 +0,0 @@
-// Copyright 2014 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-// Flags: --allow-natives-syntax --expose-gc
-
-%GetScript('v8/gc');
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-469480.js b/deps/v8/test/mjsunit/regress/regress-crbug-469480.js
deleted file mode 100644
index 8bb0c523ae3011..00000000000000
--- a/deps/v8/test/mjsunit/regress/regress-crbug-469480.js
+++ /dev/null
@@ -1,13 +0,0 @@
-// Copyright 2015 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-// Flags: --allow-natives-syntax --stress-compaction --verify-heap
-// Flags: --stack-size=100
-
-// Load the debug context to fill up code space.
-%GetDebugContext();
-%GetDebugContext();
-
-// Recurse and run regexp code.
-assertThrows(function f() { f(/./.test("a")); }, RangeError);
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-491062.js b/deps/v8/test/mjsunit/regress/regress-crbug-491062.js
index d2cd7579bc9491..41136548bca369 100644
--- a/deps/v8/test/mjsunit/regress/regress-crbug-491062.js
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-491062.js
@@ -15,7 +15,7 @@ function f() {
   }
   if (count < 100) {
     count++;
-    %DebugGetLoadedScripts();
+    %DebugGetLoadedScriptIds();
   }
 }
 f();
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-505007-1.js b/deps/v8/test/mjsunit/regress/regress-crbug-505007-1.js
deleted file mode 100644
index 910f4a672055b3..00000000000000
--- a/deps/v8/test/mjsunit/regress/regress-crbug-505007-1.js
+++ /dev/null
@@ -1,18 +0,0 @@
-// Copyright 2015 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-// Flags: --stack-size=100 --allow-natives-syntax
-
-var count = 0;
-function f() {
-  try {
-    f();
-  } catch(e) {
-    if (count < 100) {
-      count++;
-      %GetDebugContext();
-    }
-  }
-}
-f();
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-506443.js b/deps/v8/test/mjsunit/regress/regress-crbug-506443.js
deleted file mode 100644
index 490edf0d4c8647..00000000000000
--- a/deps/v8/test/mjsunit/regress/regress-crbug-506443.js
+++ /dev/null
@@ -1,89 +0,0 @@
-// Copyright 2015 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-// Flags: --allow-natives-syntax --opt --no-always-opt
-
-assertSame = function assertSame() {
-  if (found === expected) {
-    if (1 / expected) return;
-  } else if ((expected !== expected) && (found !== found)) {
-    return;
-  };
-};
-assertEquals = function assertEquals() {
-  if (expected) {;
-  }
-};
-assertArrayEquals = function assertArrayEquals() {
-  var start = "";
-  if (name_opt) {
-    start = name_opt + " - ";
-  };
-  if (expected.length == found.length) {
-    for (var i = 0; i < expected.length; ++i) {;
-    }
-  }
-};
-assertPropertiesEqual = function assertPropertiesEqual() {
-  if (found) {;
-  }
-};
-assertToStringEquals = function assertToStringEquals() {
-  if (found) {;
-  }
-};
-assertTrue = function assertTrue() {;
-};
-assertFalse = function assertFalse() {;
-};
-assertUnreachable = function assertUnreachable() {
-  var message = "Fail" + "ure: unreachable";
-  if (name_opt) {
-    message += " - " + name_opt;
-  }
-};
-OptimizationStatus = function() {}
-assertUnoptimized = function assertUnoptimized() {;
-}
-assertOptimized = function assertOptimized() {;
-}
-triggerAssertFalse = function() {}
-var __v_2 = {};
-var __v_3 = {};
-var __v_4 = {};
-var __v_5 = {};
-var __v_6 = 1073741823;
-var __v_7 = {};
-var __v_8 = {};
-var __v_9 = {};
-var __v_10 = {};
-var __v_11 = 2147483648;
-var __v_12 = 1073741823;
-var __v_13 = {};
-var __v_14 = {};
-var __v_15 = -2147483648;
-var __v_16 = {};
-var __v_17 = {};
-var __v_19 = {};
-var __v_20 = {};
-var __v_21 = {};
-var __v_22 = {};
-var __v_23 = {};
-var __v_24 = {};
-try {
-  (function() {
-    var Debug = %GetDebugContext().Debug;
-
-    function __f_0() {}
-    for (var __v_0 = 0; __v_0 < 3; __v_0++) {
-      var __v_2 = function() {
-        a = 1;
-      }
-      Debug.setListener(__f_0);
-      if (__v_0 < 2) Debug.setBreakPoint(__v_2);
-    }
-  })();
-} catch (e) {
-  print();
-}
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-582703.js b/deps/v8/test/mjsunit/regress/regress-crbug-582703.js
deleted file mode 100644
index 792266f54cd9d1..00000000000000
--- a/deps/v8/test/mjsunit/regress/regress-crbug-582703.js
+++ /dev/null
@@ -1,8 +0,0 @@
-// Copyright 2016 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-// Flags: --allow-natives-syntax
-
-%FunctionGetScript({});
-%FunctionGetSourceCode({});
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-724153.js b/deps/v8/test/mjsunit/regress/regress-crbug-724153.js
index 541a4937e0c90c..e167bec2f5af83 100644
--- a/deps/v8/test/mjsunit/regress/regress-crbug-724153.js
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-724153.js
@@ -6,7 +6,7 @@
 
 (function TestParameterLimit() {
   var src = '(function f(a,';
-  for (var i = 0; i < 65535 - 2; i++) {
+  for (var i = 0; i < 65534 - 2; i++) {
     src += 'b' + i + ',';
   }
   src += 'c) { return a + c })';
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-743154.js b/deps/v8/test/mjsunit/regress/regress-crbug-743154.js
index a5bb2aa0ae3f24..cf9adea0bfb4dd 100644
--- a/deps/v8/test/mjsunit/regress/regress-crbug-743154.js
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-743154.js
@@ -17,6 +17,8 @@ assertEquals(0, v[1073741824]);
 Array.prototype.sort.call(v);
 
 assertEquals(['0', '1073741824', 'length'], Object.keys(v));
+assertTrue(v.hasOwnProperty(0));
 assertEquals(1.5, v[0]);
+assertFalse(v.hasOwnProperty(1));
 assertEquals(1.5, v[1]);
 assertEquals(0, v[1073741824]);
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-779344.js b/deps/v8/test/mjsunit/regress/regress-crbug-779344.js
index 5198a67be51cf0..9211071653c609 100644
--- a/deps/v8/test/mjsunit/regress/regress-crbug-779344.js
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-779344.js
@@ -5,6 +5,4 @@
 var o = {};
 var proxy = new Proxy(() => {}, o);
 o.apply = proxy;
-assertThrows(
-  () => Function.prototype.call.call(proxy)
-);
+assertThrows(proxy);
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-7907.js b/deps/v8/test/mjsunit/regress/regress-crbug-7907.js
new file mode 100644
index 00000000000000..fafa659af83a72
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-7907.js
@@ -0,0 +1,9 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+let arr = new Array(10);
+Object.defineProperty(arr, 0, {value: 10, writable: false});
+Object.defineProperty(arr, 9, {value: 1, writable: false});
+
+assertThrows(() => arr.sort(), TypeError);
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-823130.js b/deps/v8/test/mjsunit/regress/regress-crbug-823130.js
new file mode 100644
index 00000000000000..42174f1acf7723
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-823130.js
@@ -0,0 +1,40 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-gc
+
+var __v_1 = new Array();
+var __v_2 = 0x30;
+var __v_4 = "abc";
+var __v_3 = "def";
+
+function __f_2(b) {
+  [...b];
+}
+__f_2([1]);
+__f_2([3.3]);
+__f_2([{}]);
+
+var vars = [__v_1, __v_2, __v_3, __v_4];
+
+for (var j = 0; j < vars.length && j < 7; j++) {
+  for (var k = j; k < vars.length && k < 7 + j; k++) {
+    var v1 = vars[j];
+    var e1, e2;
+    try {
+      __f_2(v1);
+      __f_2();
+    } catch (e) {
+      e1 = "" + e;
+    }
+    gc();
+    try {
+      __f_2(v1);
+      __f_2();
+    } catch (e) {
+      e2 = "" + e;
+    }
+    assertEquals(e1, e2);
+  }
+}
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-840220.js b/deps/v8/test/mjsunit/regress/regress-crbug-840220.js
new file mode 100644
index 00000000000000..8245635463d519
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-840220.js
@@ -0,0 +1,12 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var boundFunction = (function(){}).bind();
+
+var instance = new Uint8Array()
+instance.constructor = {
+  [Symbol.species]: boundFunction
+};
+
+assertThrows(() => instance.map(each => each * 2), TypeError);
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-841592.js b/deps/v8/test/mjsunit/regress/regress-crbug-841592.js
new file mode 100644
index 00000000000000..bc64fd977c9d28
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-841592.js
@@ -0,0 +1,21 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// a has packed SMI elements
+a = [];
+
+// a has dictionary elements
+a.length = 0xFFFFFFF;
+
+// a has dictionary elements and the backing array is
+// empty_slow_element_dictionary (length 0)
+a.length = 0;
+
+// a has dictionary elements and the backing array is
+// empty_slow_element_dictionary (length 0xFFFFFFF)
+a.length = 0xFFFFFFF;
+
+// This will crash if V8 attempts to remove 0 elements from
+// empty_slow_element_dictionary as it is in RO_SPACE.
+a.length = 1;
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-848165.js b/deps/v8/test/mjsunit/regress/regress-crbug-848165.js
new file mode 100644
index 00000000000000..670e70fe689939
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-848165.js
@@ -0,0 +1,9 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+class cls0 {
+  static get length(){ return 42; };
+  static get [1](){ return 21; };
+};
+Object.defineProperty(cls0, "length", {value:'1'});
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-849024.js b/deps/v8/test/mjsunit/regress/regress-crbug-849024.js
new file mode 100644
index 00000000000000..a1df5777df8bfa
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-849024.js
@@ -0,0 +1,43 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-gc
+
+this.__proto__ = new Proxy({}, {});
+
+function test1() {
+  eval("bla");
+}
+
+assertThrows(test1, ReferenceError);
+assertThrows(test1, ReferenceError);
+assertThrows(test1, ReferenceError);
+
+function test2() {
+  gc();
+  eval("bla");
+}
+
+assertThrows(test2, ReferenceError);
+assertThrows(test2, ReferenceError);
+assertThrows(test2, ReferenceError);
+
+function foo() {
+  try {
+    eval("bla");
+  } catch(e) {
+    return;
+  }
+  throw 1337;
+}
+
+function test3() {
+  gc();
+  foo();
+  foo();
+}
+
+assertDoesNotThrow(test3);
+assertDoesNotThrow(test3);
+assertDoesNotThrow(test3);
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-850005.js b/deps/v8/test/mjsunit/regress/regress-crbug-850005.js
new file mode 100644
index 00000000000000..d80d4663d108eb
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-850005.js
@@ -0,0 +1,11 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+let args = [3.34, ];
+function f(a, b, c) {};
+f(...args);
+args = args.splice();
+f(...args);
+args = [];
+f(...args);
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-851393.js b/deps/v8/test/mjsunit/regress/regress-crbug-851393.js
new file mode 100644
index 00000000000000..82060b5841db02
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-851393.js
@@ -0,0 +1,7 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var proxy = new Proxy({}, {});
+
+Object.assign(proxy, { b: "boom", 060: "ah", o: "ouch" });
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-852592.js b/deps/v8/test/mjsunit/regress/regress-crbug-852592.js
new file mode 100644
index 00000000000000..356c51c72ef36b
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-852592.js
@@ -0,0 +1,25 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+const kArraySize = 1024;
+
+let array = [];
+for (let i = 1; i < kArraySize; ++i) {
+  array[i] = i + 0.1;
+}
+
+assertEquals(array.length, kArraySize);
+
+let executed = false;
+compareFn = _ => {
+  if (!executed) {
+    executed = true;
+
+    array.length = 1; // shrink
+    array.length = 0; // replace
+    array.length = kArraySize; // restore the original length
+  }
+}
+
+array.sort(compareFn);
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-854299.js b/deps/v8/test/mjsunit/regress/regress-crbug-854299.js
new file mode 100644
index 00000000000000..3aa296ae5ac942
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-854299.js
@@ -0,0 +1,27 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-gc
+
+let rand = n => Math.floor(Math.random() * n);
+
+for (let i = 0; i < 1000; ++i) {
+  array = [];
+  let len = rand(30);
+  for(let i = 0; i < len; ++i) {
+    array[i] = [i + 0.1];
+  }
+
+  let counter = 0;
+  array.sort((a, b) => {
+    a = a || [0];
+    b = b || [0];
+
+    if (counter++ == rand(30)) {
+      array.length = 1;
+      gc();
+    }
+    return a[0] - b[0];
+  });
+}
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-856095.js b/deps/v8/test/mjsunit/regress/regress-crbug-856095.js
new file mode 100644
index 00000000000000..ae55ec65cb0abb
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-856095.js
@@ -0,0 +1,14 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function f(a, b, c) { }
+function a() {
+    let o1;
+    o1 = new Array();
+    f(...o1);
+    o1[1000] = Infinity;
+}
+
+a();
+a();
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-859809.js b/deps/v8/test/mjsunit/regress/regress-crbug-859809.js
new file mode 100644
index 00000000000000..af5dd7a904a292
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-859809.js
@@ -0,0 +1,21 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-gc
+
+let xs = [];
+const kSize = 200;
+for (let i = 0; i < kSize; ++i) {
+  xs.push(i);
+}
+
+let counter = 0;
+xs.sort((a, b) => {
+  if (counter++ % 10 == 0) {
+    xs.shift();
+    gc();
+  }
+
+  return a - b;
+});
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-860788.js b/deps/v8/test/mjsunit/regress/regress-crbug-860788.js
new file mode 100644
index 00000000000000..55d243eac62654
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-860788.js
@@ -0,0 +1,30 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-async-hooks
+
+try {
+Object.prototype.__defineGetter__(0, function(){});
+assertThrows("x");
+} catch(e) { print("Caught: " + e); }
+
+try {
+(function() {
+  let asyncIds = [], triggerIds = [];
+  let ah = async_hooks.createHook({
+    init(asyncId, type, triggerAsyncId, resource) {
+      if (type !== 'PROMISE') { return; }
+      assertThrows("asyncIds.push(asyncId);");
+      assertThrows("triggerIds.push(triggerAsyncId)");
+    },
+  });
+  ah.enable();
+  async function foo() {}
+  foo();
+})();
+} catch(e) { print("Caught: " + e); }
+try {
+  var obj = {prop: 7};
+  assertThrows("nonexistant(obj)");
+} catch(e) { print("Caught: " + e); }
diff --git a/deps/v8/test/mjsunit/regress/regress-deep-proto.js b/deps/v8/test/mjsunit/regress/regress-deep-proto.js
index 5d2758cdd618a2..6b1387447d4b76 100644
--- a/deps/v8/test/mjsunit/regress/regress-deep-proto.js
+++ b/deps/v8/test/mjsunit/regress/regress-deep-proto.js
@@ -25,6 +25,8 @@
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
+// Flags: --allow-natives-syntax
+
 function poly(x) {
   return x.foo;
 }
@@ -38,8 +40,12 @@ three.__proto__.__proto__.__proto__ = {};
 three.__proto__.__proto__.__proto__.__proto__ = {};
 three.__proto__.__proto__.__proto__.__proto__.__proto__ = {};
 
-for (var i = 0; i < 1e6; i++) {
-  poly(one);
-  poly(two);
-  poly(three);
-}
+poly(one);
+poly(two);
+poly(three);
+
+%OptimizeFunctionOnNextCall(poly);
+
+poly(one);
+poly(two);
+poly(three);
diff --git a/deps/v8/test/mjsunit/regress/regress-v8-7682.js b/deps/v8/test/mjsunit/regress/regress-v8-7682.js
new file mode 100644
index 00000000000000..4f9b2e7d600e88
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-v8-7682.js
@@ -0,0 +1,22 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+const impl = Symbol();
+class MyArrayLike {
+  constructor() {
+    this[impl] = [2, 1];
+    Object.freeze(this);
+  }
+  get 0() { return this[impl][0]; }
+  set 0(value) { this[impl][0] = value; }
+  get 1() { return this[impl][1]; }
+  set 1(value) { this[impl][1] = value; }
+  get length() { return 2; }
+}
+
+const xs = new MyArrayLike();
+Array.prototype.sort.call(xs);
+
+assertEquals(1, xs[0]);
+assertEquals(2, xs[1]);
diff --git a/deps/v8/test/mjsunit/regress/regress-v8-7725.js b/deps/v8/test/mjsunit/regress/regress-v8-7725.js
new file mode 100644
index 00000000000000..6bda4a4555db25
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-v8-7725.js
@@ -0,0 +1,11 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var proxy = new Proxy({}, {});
+
+Object.assign(proxy, { b: "boom", a: "ah", o: "ouch" });
+assertEquals(["b", "a", "o"], Object.getOwnPropertyNames(proxy));
+assertEquals("boom", proxy.b);
+assertEquals("ah", proxy.a);
+assertEquals("ouch", proxy.o);
diff --git a/deps/v8/test/mjsunit/regress/wasm/regress-7785.js b/deps/v8/test/mjsunit/regress/wasm/regress-7785.js
new file mode 100644
index 00000000000000..12d7e6b5dac384
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-7785.js
@@ -0,0 +1,44 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --experimental-wasm-anyref
+
+load("test/mjsunit/wasm/wasm-constants.js");
+load("test/mjsunit/wasm/wasm-module-builder.js");
+
+(function testAnyRefNull() {
+  const builder = new WasmModuleBuilder();
+  builder.addFunction('main', kSig_r_v)
+      .addBody([kExprRefNull])
+      .exportFunc();
+
+  var wire_bytes = builder.toBuffer();
+  var module = new WebAssembly.Module(wire_bytes);
+  var buffer = %SerializeWasmModule(module);
+  module = %DeserializeWasmModule(buffer, wire_bytes);
+  var instance = new WebAssembly.Instance(module);
+
+  assertEquals(null, instance.exports.main());
+})();
+
+(function testAnyRefIsNull() {
+  const builder = new WasmModuleBuilder();
+  builder.addFunction('main', kSig_i_r)
+      .addBody([kExprGetLocal, 0, kExprRefIsNull])
+      .exportFunc();
+
+  var wire_bytes = builder.toBuffer();
+  var module = new WebAssembly.Module(wire_bytes);
+  var buffer = %SerializeWasmModule(module);
+  module = %DeserializeWasmModule(buffer, wire_bytes);
+  var instance = new WebAssembly.Instance(module);
+
+  assertEquals(0, instance.exports.main({'hello' : 'world'}));
+  assertEquals(0, instance.exports.main(1234));
+  assertEquals(0, instance.exports.main(0));
+  assertEquals(0, instance.exports.main(123.4));
+  assertEquals(0, instance.exports.main(undefined));
+  assertEquals(1, instance.exports.main(null));
+  assertEquals(0, instance.exports.main(print));
+})();
diff --git a/deps/v8/test/mjsunit/regress/wasm/regress-7914.js b/deps/v8/test/mjsunit/regress/wasm/regress-7914.js
new file mode 100644
index 00000000000000..731005a872adaf
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-7914.js
@@ -0,0 +1,18 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+load('test/mjsunit/wasm/wasm-constants.js');
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+const builder = new WasmModuleBuilder();
+builder.addMemory(16, 32, false);
+builder.addFunction('main', kSig_i_v)
+    .addBody([
+      ...wasmI32Const(10000),  // i32.const 10000
+      kExprGrowMemory, 0,      // grow_memory --> -1
+      kExprI32Popcnt,          // i32.popcnt  --> 32
+    ])
+    .exportFunc();
+const instance = builder.instantiate();
+assertEquals(32, instance.exports.main());
diff --git a/deps/v8/test/mjsunit/regress/wasm/regress-799952.js b/deps/v8/test/mjsunit/regress/wasm/regress-799952.js
new file mode 100644
index 00000000000000..17371343e44f16
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-799952.js
@@ -0,0 +1,23 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var sentinel = {};
+Object.defineProperty(Promise, Symbol.species, {
+  value: function(f) {
+    f(function() {}, function() {})
+    return sentinel;
+  }
+});
+
+// According to the WebAssembly JavaScript API spec, WebAssembly.instantiate is
+// using the initial value of the Promise constructor. Specifically it ignores
+// the Promise species constructor installed above.
+var promise = WebAssembly.instantiate(new ArrayBuffer());
+assertInstanceof(promise, Promise);
+assertNotSame(promise, sentinel);
+
+// All further uses of the returned Promise, like using Promise.prototype.then,
+// will respect the Promise species constructor installed above however.
+var monkey = promise.then(r => { print(r) }, e => { print(e) });
+assertSame(monkey, sentinel);
diff --git a/deps/v8/test/mjsunit/regress/wasm/regress-834624.js b/deps/v8/test/mjsunit/regress/wasm/regress-834624.js
new file mode 100644
index 00000000000000..9161f098e0e6cd
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-834624.js
@@ -0,0 +1,30 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --wasm-interpret-all
+
+load("test/mjsunit/wasm/wasm-constants.js");
+load("test/mjsunit/wasm/wasm-module-builder.js");
+
+let instance;
+(function DoTest() {
+  function call_main() {
+    instance.exports.main();
+  }
+  let module = new WasmModuleBuilder();
+  module.addImport('mod', 'func', kSig_v_i);
+  module.addFunction('main', kSig_v_i)
+    .addBody([kExprGetLocal, 0, kExprCallFunction, 0])
+    .exportFunc();
+  instance = module.instantiate({
+    mod: {
+      func: call_main
+    }
+  });
+  try {
+    instance.exports.main();
+  } catch (e) {
+    // ignore
+  }
+})();
diff --git a/deps/v8/test/mjsunit/regress/wasm/regress-834693.js b/deps/v8/test/mjsunit/regress/wasm/regress-834693.js
new file mode 100644
index 00000000000000..a4073e968caadb
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-834693.js
@@ -0,0 +1,20 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// flags: --wasm-lazy-compilation
+
+load("test/mjsunit/wasm/wasm-constants.js");
+load("test/mjsunit/wasm/wasm-module-builder.js");
+
+var module = new WasmModuleBuilder();
+module.addMemory();
+module.addFunction("main", kSig_v_v)
+  .addBody([
+    kExprI32Const, 20,
+    kExprI32Const, 29,
+    kExprGrowMemory, kMemoryZero,
+    kExprI32StoreMem, 0, 0xFF, 0xFF, 0x7A])
+  .exportAs("main");
+var instance = module.instantiate();
+assertTraps(kTrapMemOutOfBounds, instance.exports.main);
diff --git a/deps/v8/test/mjsunit/regress/wasm/regress-837417.js b/deps/v8/test/mjsunit/regress/wasm/regress-837417.js
index 572139fac55825..9dcc299ecf8e12 100644
--- a/deps/v8/test/mjsunit/regress/wasm/regress-837417.js
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-837417.js
@@ -8,16 +8,11 @@ load('test/mjsunit/wasm/wasm-module-builder.js');
 const builder = new WasmModuleBuilder();
 builder.addMemory(16, 32);
 builder.addFunction("test", kSig_i_v).addBody([
-  kExprI32Const, 12,         // i32.const 0
+  kExprI32Const, 12,         // i32.const 12
 ]);
 
-WebAssembly.Module.prototype.then = resolve => resolve(
-    String.fromCharCode(null, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41));
+WebAssembly.Module.prototype.then = resolve => {
+  assertUnreachable();
+};
 
-// WebAssembly.instantiate should not actually throw a TypeError in this case.
-// However, this is a workaround for
-assertPromiseResult(
-    WebAssembly.instantiate(builder.toBuffer()), assertUnreachable,
-    exception => {
-      assertInstanceof(exception, TypeError);
-    });
+WebAssembly.instantiate(builder.toBuffer());
diff --git a/deps/v8/test/mjsunit/regress/wasm/regress-840757.js b/deps/v8/test/mjsunit/regress/wasm/regress-840757.js
new file mode 100644
index 00000000000000..088740133663dd
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-840757.js
@@ -0,0 +1,21 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+load('test/mjsunit/wasm/wasm-constants.js');
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+// Also enable predictable mode. Otherwise, concurrent recompilation will be
+// enabled, and the code generator will not try to print the InliningStack
+// (see CodeGenerator::AssembleSourcePosition).
+// These preconditions make this test quite fragile, but it's the only way
+// currently to reproduce the crash.
+// Flags: --code-comments --predictable --print-wasm-code
+
+const builder = new WasmModuleBuilder();
+// Add a call instruction, because the segfault happens when processing source
+// positions.
+builder.addFunction('foo', kSig_v_v).addBody([]);
+builder.addFunction('test', kSig_v_v).addBody([kExprCallFunction, 0]);
+
+builder.instantiate();
diff --git a/deps/v8/test/mjsunit/regress/wasm/regress-842501.js b/deps/v8/test/mjsunit/regress/wasm/regress-842501.js
new file mode 100644
index 00000000000000..83f5c9d4b864b3
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-842501.js
@@ -0,0 +1,35 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --no-wasm-trap-handler
+
+load('test/mjsunit/wasm/wasm-constants.js');
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+(function() {
+  const builder = new WasmModuleBuilder();
+  builder.addMemory(16, 32);
+  // Generate function 1 (out of 1).
+  sig1 = makeSig([kWasmI32, kWasmI32, kWasmI32], [kWasmI32]);
+  builder.addFunction(undefined, sig1)
+    .addBodyWithEnd([
+      // signature: i_iii
+      // body:
+      kExprI32Const, 0xe1, 0xc8, 0xd5, 0x01,
+      kExprI32Const, 0xe2, 0xe4, 0x00,
+      kExprI32Sub,
+      kExprF32Const, 0x00, 0x00, 0x00, 0x00,
+      kExprF32Const, 0xc9, 0xc9, 0xc9, 0x00,
+      kExprF32Eq,
+      kExprI32LoadMem, 0x01, 0xef, 0xec, 0x95, 0x93, 0x07,
+      kExprI32Add,
+      kExprIf, kWasmStmt,   // @30
+      kExprEnd,             // @32
+      kExprI32Const, 0xc9, 0x93, 0xdf, 0xcc, 0x7c,
+      kExprEnd,             // @39
+    ]);
+  builder.addExport('main', 0);
+  const instance = builder.instantiate();
+  assertTraps(kTrapMemOutOfBounds, _ => instance.exports.main(1, 2, 3));
+})();
diff --git a/deps/v8/test/mjsunit/regress/wasm/regress-843563.js b/deps/v8/test/mjsunit/regress/wasm/regress-843563.js
new file mode 100644
index 00000000000000..8c18cfa7a92a55
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-843563.js
@@ -0,0 +1,20 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+load('test/mjsunit/wasm/wasm-constants.js');
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+const builder = new WasmModuleBuilder();
+sig1 = makeSig([kWasmI32, kWasmI32, kWasmI32], [kWasmI32]);
+const imp_idx = builder.addImport('q', 'imp', kSig_i_i);
+builder.addExport('exp', imp_idx);
+const module = builder.toModule();
+
+function bad(a, b, c, d, e, f, g, h) {
+    print(JSON.stringify([a, b, c, d, e, f, g, h]));
+}
+const instance1 = new WebAssembly.Instance(module, {q: {imp: bad}});
+const instance2 = new WebAssembly.Instance(module, {q: {imp: i => i}});
+
+print(instance1.exports.exp(5));
diff --git a/deps/v8/test/mjsunit/regress/wasm/regress-853453.js b/deps/v8/test/mjsunit/regress/wasm/regress-853453.js
new file mode 100644
index 00000000000000..fcf5f678850f19
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-853453.js
@@ -0,0 +1,18 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --experimental-wasm-threads
+
+assertThrows(() => new WebAssembly.Module(
+    new Uint8Array([
+      0x00, 0x61, 0x73, 0x6d,     // wasm magic
+      0x01, 0x00, 0x00, 0x00,     // wasm version
+      0x04,                       // section code
+      0x04,                       // section length
+      /* Section: Table */
+      0x01,                       // table count
+      0x70,                       // table type
+      0x03,                       // resizable limits flags
+      0x00])),
+    WebAssembly.CompileError);
diff --git a/deps/v8/test/mjsunit/regress/wasm/regress-854011.js b/deps/v8/test/mjsunit/regress/wasm/regress-854011.js
new file mode 100644
index 00000000000000..11863368f318e0
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-854011.js
@@ -0,0 +1,47 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+load('test/mjsunit/wasm/wasm-constants.js');
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+const builder = new WasmModuleBuilder();
+builder.addFunction('main', kSig_d_d)
+    .addBody([
+      // Call with param 0 (converted to i64), to fill the stack with non-zero
+      // values.
+      kExprGetLocal, 0, kExprI64SConvertF64,  // arg 0
+      kExprGetLocal, 0, kExprI64SConvertF64,  // arg 1
+      kExprGetLocal, 0, kExprI64SConvertF64,  // arg 2
+      kExprGetLocal, 0, kExprI64SConvertF64,  // arg 3
+      kExprGetLocal, 0, kExprI64SConvertF64,  // arg 4
+      kExprGetLocal, 0, kExprI64SConvertF64,  // arg 5
+      kExprGetLocal, 0, kExprI64SConvertF64,  // arg 6
+      kExprGetLocal, 0, kExprI64SConvertF64,  // arg 7
+      kExprCallFunction, 1,                   // call #1
+      // Now call with 0 constants.
+      // The bug was that they were written out as i32 values, thus the upper 32
+      // bit were the previous values on that stack memory.
+      kExprI64Const, 0,      // i64.const 0  [0]
+      kExprI64Const, 0,      // i64.const 0  [1]
+      kExprI64Const, 0,      // i64.const 0  [2]
+      kExprI64Const, 0,      // i64.const 0  [3]
+      kExprI64Const, 0,      // i64.const 0  [4]
+      kExprI64Const, 0,      // i64.const 0  [5]
+      kExprI64Const, 0,      // i64.const 0  [6]
+      kExprI64Const, 0,      // i64.const 0  [7]
+      kExprCallFunction, 1,  // call #1
+      // Return the sum of the two returned values.
+      kExprF64Add
+    ])
+    .exportFunc();
+builder.addFunction(undefined, makeSig(new Array(8).fill(kWasmI64), [kWasmF64]))
+    .addBody([
+      kExprGetLocal, 7,     // get_local 7 (last parameter)
+      kExprF64SConvertI64,  // f64.convert_s/i64
+    ]);
+const instance = builder.instantiate();
+const big_num_1 = 2 ** 48;
+const big_num_2 = 2 ** 56 / 3;
+assertEquals(big_num_1, instance.exports.main(big_num_1));
+assertEquals(big_num_2, instance.exports.main(big_num_2));
diff --git a/deps/v8/test/mjsunit/regress/wasm/regress-854050.js b/deps/v8/test/mjsunit/regress/wasm/regress-854050.js
new file mode 100644
index 00000000000000..e2146ca3654c37
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-854050.js
@@ -0,0 +1,28 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+load('test/mjsunit/wasm/wasm-constants.js');
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+const builder = new WasmModuleBuilder();
+builder.addFunction(undefined, makeSig([kWasmI32, kWasmF32], []))
+    .addLocals({i32_count: 7})
+    .addBody([
+      kExprGetLocal,    0,          // get_local
+      kExprI32Const,    0,          // i32.const 0
+      kExprIf,          kWasmStmt,  // if
+      kExprUnreachable,             // unreachable
+      kExprEnd,                     // end if
+      kExprGetLocal,    4,          // get_local
+      kExprTeeLocal,    8,          // tee_local
+      kExprBrIf,        0,          // br_if depth=0
+      kExprTeeLocal,    7,          // tee_local
+      kExprTeeLocal,    0,          // tee_local
+      kExprTeeLocal,    2,          // tee_local
+      kExprTeeLocal,    8,          // tee_local
+      kExprDrop,                    // drop
+      kExprLoop,        kWasmStmt,  // loop
+      kExprEnd,                     // end loop
+    ]);
+builder.instantiate();
diff --git a/deps/v8/test/mjsunit/stack-traces-2.js b/deps/v8/test/mjsunit/stack-traces-2.js
index 45dfe3a1ea4943..ca78ed3858fa01 100644
--- a/deps/v8/test/mjsunit/stack-traces-2.js
+++ b/deps/v8/test/mjsunit/stack-traces-2.js
@@ -57,25 +57,8 @@ function testTraceNativeConversion(nativeFunc) {
   }
 }
 
-
-function testNotOmittedBuiltin(throwing, included) {
-  try {
-    throwing();
-    assertUnreachable(included);
-  } catch (e) {
-    assertTrue(e.stack.indexOf(included) >= 0, included);
-  }
-}
-
-
 testTraceNativeConversion(String);  // Does ToString on argument.
 testTraceNativeConversion(RegExp);  // Does ToString on argument.
 
 testTraceNativeConstructor(String);  // Does ToString on argument.
 testTraceNativeConstructor(RegExp);  // Does ToString on argument.
-
-// QuickSort has builtins object as receiver, and is non-native
-// builtin. Should not be omitted with the --builtins-in-stack-traces flag.
-testNotOmittedBuiltin(function(){ [thrower, 2].sort(function (a,b) {
-                                                     (b < a) - (a < b); });
-                      }, "QuickSort");
diff --git a/deps/v8/test/mjsunit/string-split.js b/deps/v8/test/mjsunit/string-split.js
index 8068838ea10b6a..9ee74464acd5d1 100644
--- a/deps/v8/test/mjsunit/string-split.js
+++ b/deps/v8/test/mjsunit/string-split.js
@@ -25,6 +25,8 @@
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
+// Flags: --allow-natives-syntax
+
 expected = ["A", undefined, "B", "bold", "/", "B", "and", undefined, "CODE", "coded", "/", "CODE", ""];
 result = "A<B>bold</B>and<CODE>coded</CODE>".split(/<(\/)?([^<>]+)>/);
 assertArrayEquals(expected, result);
@@ -134,6 +136,11 @@ assertEquals(["a", "b", "c"], "abc".split("", numberObj(3)));
 assertEquals(["a", "b", "c"], "abc".split("", 4));
 assertEquals(["a", "b", "c"], "abc".split("", numberObj(4)));
 
+// Check if split works also for sliced strings.
+let sliced_string = %ConstructSlicedString("abcdefghijklmnopqrstuvwxyz", 13);
+assertEquals("nopqrstuvwxyz".split(""), sliced_string.split(""));
+// Invoke twice for caching
+assertEquals("nopqrstuvwxyz".split(""), sliced_string.split(""));
 
 var all_ascii_codes = [];
 for (var i = 0; i < 128; i++) all_ascii_codes[i] = i;
@@ -174,3 +181,5 @@ assertArrayEquals(["a", "b"], "a,b,c,d,e,f".split(/,/, -4294967294));
 assertArrayEquals(["a", "b", "c"], "a,b,c,d,e,f".split(/,/, -4294967293));
 assertArrayEquals(["a", "b", "c", "d"], "a,b,c,d,e,f".split(/,/, -4294967292));
 assertArrayEquals(["a", "b", "c", "d", "e", "f"], "a,b,c,d,e,f".split(/,/, -1));
+assertArrayEquals(["a", "b", "c"], "abc".split("", 0xffffffff));
+assertArrayEquals(["\u0427", "\u0427"], "\u0427\u0427".split("", 0xffffffff));
diff --git a/deps/v8/test/mjsunit/tools/compiler-trace-flags.js b/deps/v8/test/mjsunit/tools/compiler-trace-flags.js
new file mode 100644
index 00000000000000..491aad8c1ebd24
--- /dev/null
+++ b/deps/v8/test/mjsunit/tools/compiler-trace-flags.js
@@ -0,0 +1,36 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --trace-turbo --trace-turbo-graph
+// Flags: --trace-turbo-cfg-file=test/mjsunit/tools/turbo.cfg
+// Flags: --trace-turbo-path=test/mjsunit/tools
+
+load('test/mjsunit/wasm/wasm-constants.js');
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+// The idea behind this test is to make sure we do not crash when using the
+// --trace-turbo flag given different sort of inputs, JS or WASM.
+
+(function testOptimizedJS() {
+  function add(a, b) {
+    return a + b;
+  }
+
+  add(21, 21);
+  %OptimizeFunctionOnNextCall(add);
+  add(20, 22);
+})();
+
+(function testWASM() {
+  let builder = new WasmModuleBuilder();
+
+  builder.addFunction("add", kSig_i_ii)
+    .addBody([kExprGetLocal, 0,
+              kExprGetLocal, 1,
+              kExprI32Add])
+    .exportFunc();
+
+  let instance = builder.instantiate();
+  instance.exports.add(21, 21);
+})();
diff --git a/deps/v8/test/mjsunit/tools/profviz-test.default b/deps/v8/test/mjsunit/tools/profviz-test.default
index 040afb42174a02..0c33e11abdb6a5 100644
--- a/deps/v8/test/mjsunit/tools/profviz-test.default
+++ b/deps/v8/test/mjsunit/tools/profviz-test.default
@@ -1435,8 +1435,8 @@
   "46.74 0.08499999999999375",
   "57.64849999999997 0.08249999999999602",
   "58.316999999999965 0.08099999999999596",
-  "23.506 0.08050000000000068",
   "46.37200000000001 0.08050000000000068",
+  "23.506 0.08050000000000068",
   "42.70600000000002 0.07900000000000063",
   "129.4124999999999 0.07800000000000296",
   "20.5975 0.07750000000000057",
@@ -1450,16 +1450,16 @@
   "44.917000000000016 0.07200000000000273",
   "25.591500000000003 0.07199999999999918",
   "50.62049999999999 0.07150000000000034",
-  "46.621 0.07099999999999795",
   "88.82299999999992 0.07099999999999795",
+  "46.621 0.07099999999999795",
   "78.23049999999994 0.0660000000000025",
   "46.060500000000005 0.0659999999999954",
   "50.43099999999999 0.06400000000000006",
   "129.48849999999987 0.06349999999997635",
   "45.55900000000001 0.06150000000000233",
   "19.152 0.06050000000000111",
-  "50.20799999999999 0.060499999999997556",
   "57.33299999999997 0.060499999999997556",
+  "50.20799999999999 0.060499999999997556",
   "68.76649999999995 0.06049999999999045",
   "23.5775 0.059499999999999886",
   "47.135000000000005 0.05850000000000222",
@@ -1468,8 +1468,8 @@
   "21.2695 0.057500000000000995",
   "50.14149999999999 0.05749999999999744",
   "91.96649999999993 0.056500000000013983",
-  "57.934999999999974 0.05649999999999977",
   "83.63999999999993 0.05649999999999977",
+  "57.934999999999974 0.05649999999999977",
   "132.92249999999987 0.05649999999997135",
   "67.59199999999996 0.056000000000011596",
   "99.92199999999991 0.055499999999995",
@@ -1490,9 +1490,9 @@
   "75.46799999999995 0.04950000000000898",
   "45.76150000000001 0.049500000000001876",
   "94.6054999999999 0.04949999999998056",
-  "45.97850000000001 0.048500000000004206",
-  "115.4124999999999 0.048500000000004206",
   "118.19199999999991 0.048500000000004206",
+  "115.4124999999999 0.048500000000004206",
+  "45.97850000000001 0.048500000000004206",
   "49.780499999999996 0.0484999999999971",
   "42.795000000000016 0.04800000000000182",
   "126.59899999999989 0.04749999999999943",
@@ -1512,23 +1512,23 @@
   "52.15399999999998 0.0379999999999967",
   "42.88200000000001 0.0379999999999967",
   "24.430500000000002 0.03750000000000142",
-  "23.907 0.036499999999996646",
   "60.08349999999996 0.036499999999996646",
+  "23.907 0.036499999999996646",
   "50.32899999999999 0.036000000000001364",
   "42.31450000000002 0.034000000000006025",
   "45.02900000000001 0.032999999999994145",
   "23.189 0.031500000000001194",
   "21.49 0.03049999999999997",
-  "42.83300000000001 0.030000000000001137",
   "58.12149999999997 0.030000000000001137",
   "45.41750000000002 0.030000000000001137",
+  "42.83300000000001 0.030000000000001137",
   "140.89599999999987 0.028999999999996362",
   "2.4490000000000003 0.028500000000000636",
   "52.31499999999998 0.027999999999998693",
   "45.17200000000002 0.027999999999998693",
-  "43.632500000000014 0.027000000000001023",
-  "49.8685 0.027000000000001023",
   "51.30249999999999 0.027000000000001023",
+  "49.8685 0.027000000000001023",
+  "43.632500000000014 0.027000000000001023",
   "21.175 0.026499999999998636",
   "44.82200000000002 0.026000000000003354",
   "22.528 0.02599999999999625",
diff --git a/deps/v8/test/mjsunit/wasm/async-compile.js b/deps/v8/test/mjsunit/wasm/async-compile.js
index fe7b1aa886610b..e7f87c30e9e418 100644
--- a/deps/v8/test/mjsunit/wasm/async-compile.js
+++ b/deps/v8/test/mjsunit/wasm/async-compile.js
@@ -11,12 +11,12 @@ function assertCompiles(buffer) {
   return assertPromiseResult(
       WebAssembly.compile(buffer),
       module => assertTrue(module instanceof WebAssembly.Module),
-      ex => assertUnreachable);
+      ex => assertUnreachable());
 }
 
 function assertCompileError(buffer) {
   return assertPromiseResult(
-      WebAssembly.compile(buffer), module => assertUnreachable,
+      WebAssembly.compile(buffer), module => assertUnreachable(),
       ex => assertTrue(ex instanceof WebAssembly.CompileError));
 }
 
diff --git a/deps/v8/test/mjsunit/wasm/compiled-module-management.js b/deps/v8/test/mjsunit/wasm/compiled-module-management.js
index 98eb27048537de..19446403aba6fc 100644
--- a/deps/v8/test/mjsunit/wasm/compiled-module-management.js
+++ b/deps/v8/test/mjsunit/wasm/compiled-module-management.js
@@ -27,23 +27,21 @@ var instance4;
     ]).exportFunc();
 
   module = new WebAssembly.Module(builder.toBuffer());
-  print("Initial module");
-  %ValidateWasmModuleState(module);
 
   print("Initial instances=0");
-  %ValidateWasmInstancesChain(module, 0);
+  assertEquals(0, %WasmGetNumberOfInstances(module));
   instance1 = new WebAssembly.Instance(module, {"": {getValue: () => 1}});
 
   print("Initial instances=1");
-  %ValidateWasmInstancesChain(module, 1);
+  assertEquals(1, %WasmGetNumberOfInstances(module));
   instance2 = new WebAssembly.Instance(module, {"": {getValue: () => 2}});
 
   print("Initial instances=2");
-  %ValidateWasmInstancesChain(module, 2);
+  assertEquals(2, %WasmGetNumberOfInstances(module));
   instance3 = new WebAssembly.Instance(module, {"": {getValue: () => 3}});
 
   print("Initial instances=3");
-  %ValidateWasmInstancesChain(module, 3);
+  assertEquals(3, %WasmGetNumberOfInstances(module));
 })();
 
 (function CompiledModuleInstancesClear1() {
@@ -51,30 +49,33 @@ var instance4;
   instance1 = null;
 })();
 
+// Note that two GC's are required because weak slots clearing is deferred.
+gc();
 gc();
 print("After gc instances=2");
-%ValidateWasmInstancesChain(module, 2);
+assertEquals(2, %WasmGetNumberOfInstances(module));
 
 (function CompiledModuleInstancesClear3() {
   assertEquals(3, instance3.exports.f());
   instance3 = null;
 })();
 
+// Note that two GC's are required because weak slots clearing is deferred.
+gc();
 gc();
 print("After gc instances=1");
-%ValidateWasmInstancesChain(module, 1);
+assertEquals(1, %WasmGetNumberOfInstances(module));
 
 (function CompiledModuleInstancesClear2() {
   assertEquals(2, instance2.exports.f());
   instance2 = null;
 })();
 
-// Note that two GC's are required because weak cells are not cleared
-// in the same cycle that the instance finalizer is run.
+// Note that two GC's are required because weak slots clearing is deferred.
 gc();
 gc();
-print("After gc module state");
-%ValidateWasmModuleState(module);
+print("After gc instances=0");
+assertEquals(0, %WasmGetNumberOfInstances(module));
 
 (function CompiledModuleInstancesInitialize4AndClearModule() {
   instance4 = new WebAssembly.Instance(module, {"": {getValue: () => 4}});
@@ -82,7 +83,6 @@ print("After gc module state");
   module = null;
 })();
 
+// Note that two GC's are required because weak slots clearing is deferred.
 gc();
-// the first GC will clear the module, the second the instance.
 gc();
-%ValidateWasmOrphanedInstance(instance4);
diff --git a/deps/v8/test/mjsunit/wasm/compiled-module-serialization.js b/deps/v8/test/mjsunit/wasm/compiled-module-serialization.js
index d254c9e62051b9..a5d1bc54144072 100644
--- a/deps/v8/test/mjsunit/wasm/compiled-module-serialization.js
+++ b/deps/v8/test/mjsunit/wasm/compiled-module-serialization.js
@@ -8,6 +8,7 @@ load("test/mjsunit/wasm/wasm-constants.js");
 load("test/mjsunit/wasm/wasm-module-builder.js");
 
 (function SerializeAndDeserializeModule() {
+  print(arguments.callee.name);
   var builder = new WasmModuleBuilder();
   builder.addImportedMemory("", "memory", 1);
   var kSig_v_i = makeSig([kWasmI32], []);
@@ -75,6 +76,7 @@ load("test/mjsunit/wasm/wasm-module-builder.js");
 })();
 
 (function DeserializeInvalidObject() {
+  print(arguments.callee.name);
   var invalid_buffer = new ArrayBuffer(10);
 
   module = %DeserializeWasmModule(invalid_buffer, invalid_buffer);
@@ -82,6 +84,7 @@ load("test/mjsunit/wasm/wasm-module-builder.js");
 })();
 
 (function RelationBetweenModuleAndClone() {
+  print(arguments.callee.name);
   let builder = new WasmModuleBuilder();
   builder.addFunction("main", kSig_i_v)
     .addBody([kExprI32Const, 42])
@@ -99,6 +102,7 @@ load("test/mjsunit/wasm/wasm-module-builder.js");
 })();
 
 (function SerializeWrappersWithSameSignature() {
+  print(arguments.callee.name);
   let builder = new WasmModuleBuilder();
   builder.addFunction("main", kSig_i_v)
     .addBody([kExprI32Const, 42])
@@ -119,6 +123,7 @@ load("test/mjsunit/wasm/wasm-module-builder.js");
 })();
 
 (function SerializeAfterInstantiation() {
+  print(arguments.callee.name);
   let builder = new WasmModuleBuilder();
   builder.addFunction("main", kSig_i_v)
     .addBody([kExprI32Const, 42])
@@ -141,6 +146,7 @@ load("test/mjsunit/wasm/wasm-module-builder.js");
 
 
 (function SerializeAfterInstantiationWithMemory() {
+  print(arguments.callee.name);
   let builder = new WasmModuleBuilder();
   builder.addImportedMemory("", "memory", 1);
   builder.addFunction("main", kSig_i_v)
@@ -164,6 +170,7 @@ load("test/mjsunit/wasm/wasm-module-builder.js");
 })();
 
 (function GlobalsArePrivateBetweenClones() {
+  print(arguments.callee.name);
   var builder = new WasmModuleBuilder();
   builder.addGlobal(kWasmI32, true);
   builder.addFunction("read", kSig_i_v)
@@ -191,6 +198,7 @@ load("test/mjsunit/wasm/wasm-module-builder.js");
 })();
 
 (function SharedTableTest() {
+  print(arguments.callee.name);
   let kTableSize = 3;
   var sig_index1;
 
@@ -261,5 +269,138 @@ load("test/mjsunit/wasm/wasm-module-builder.js");
   assertThrows(() => i2.exports.main(2));
   assertThrows(() => i1.exports.main(3));
   assertThrows(() => i2.exports.main(3));
+})();
+
+(function StackOverflowAfterSerialization() {
+  print(arguments.callee.name);
+  const builder = new WasmModuleBuilder();
+  var fun = builder.addFunction('main', kSig_v_v);
+  fun.addBody([kExprCallFunction, fun.index]);
+  fun.exportFunc();
+
+  var wire_bytes = builder.toBuffer();
+  var module = new WebAssembly.Module(wire_bytes);
+  var buffer = %SerializeWasmModule(module);
+  module = %DeserializeWasmModule(buffer, wire_bytes);
+  var instance = new WebAssembly.Instance(module);
+
+  assertThrows(instance.exports.main, RangeError);
+})();
 
+(function TrapAfterDeserialization() {
+  print(arguments.callee.name);
+  function GenerateSerializedModule() {
+    const builder = new WasmModuleBuilder();
+    builder.addMemory(1, 1);
+    builder.addFunction('main', kSig_i_i)
+        .addBody([kExprGetLocal, 0, kExprI32LoadMem, 0, 0])
+        .exportFunc();
+    const wire_bytes = builder.toBuffer();
+    const module = new WebAssembly.Module(wire_bytes);
+    const buffer = %SerializeWasmModule(module);
+    return [wire_bytes, buffer];
+  }
+  const [wire_bytes, buffer] = GenerateSerializedModule();
+  module = %DeserializeWasmModule(buffer, wire_bytes);
+  const instance = new WebAssembly.Instance(module);
+
+  assertEquals(0, instance.exports.main(0));
+  assertEquals(0, instance.exports.main(kPageSize - 4));
+  assertTraps(
+      kTrapMemOutOfBounds, _ => instance.exports.main(kPageSize - 3));
+})();
+
+(function DirectCallAfterSerialization() {
+  print(arguments.callee.name);
+  const builder = new WasmModuleBuilder();
+  var fun1 = builder.addFunction('fun1', kSig_i_v)
+      .addBody([kExprI32Const, 23]);
+  var fun2 = builder.addFunction('fun2', kSig_i_v)
+      .addBody([kExprI32Const, 42]);
+  builder.addFunction('main', kSig_i_v)
+      .addBody([kExprCallFunction, fun1.index,
+                kExprCallFunction, fun2.index,
+                kExprI32Add])
+      .exportFunc();
+
+  var wire_bytes = builder.toBuffer();
+  var module = new WebAssembly.Module(wire_bytes);
+  var buffer = %SerializeWasmModule(module);
+  module = %DeserializeWasmModule(buffer, wire_bytes);
+  var instance = new WebAssembly.Instance(module);
+
+  assertEquals(65, instance.exports.main());
+})();
+
+(function ImportCallAfterSerialization() {
+  print(arguments.callee.name);
+  const builder = new WasmModuleBuilder();
+  var fun_import = builder.addImport("", "my_import", kSig_i_v);
+  var fun = builder.addFunction('fun', kSig_i_v)
+      .addBody([kExprI32Const, 23]);
+  builder.addFunction('main', kSig_i_v)
+      .addBody([kExprCallFunction, fun.index,
+                kExprCallFunction, fun_import,
+                kExprI32Add])
+      .exportFunc();
+
+  var wire_bytes = builder.toBuffer();
+  var module = new WebAssembly.Module(wire_bytes);
+  var buffer = %SerializeWasmModule(module);
+  module = %DeserializeWasmModule(buffer, wire_bytes);
+  var instance = new WebAssembly.Instance(module, {"": {my_import: () => 42 }});
+
+  assertEquals(65, instance.exports.main());
+})();
+
+(function BranchTableAfterSerialization() {
+  print(arguments.callee.name);
+  const builder = new WasmModuleBuilder();
+  builder.addFunction('main', kSig_i_i)
+      .addBody([kExprBlock, kWasmStmt,
+                  kExprBlock, kWasmStmt,
+                    kExprBlock, kWasmStmt,
+                      kExprBlock, kWasmStmt,
+                        kExprBlock, kWasmStmt,
+                          kExprBlock, kWasmStmt,
+                            kExprBlock, kWasmStmt,
+                              kExprGetLocal, 0,
+                              kExprBrTable, 6, 0, 1, 2, 3, 4, 5, 6,
+                            kExprEnd,
+                            kExprI32Const, 3,
+                            kExprReturn,
+                          kExprEnd,
+                          kExprI32Const, 7,
+                          kExprReturn,
+                        kExprEnd,
+                        kExprI32Const, 9,
+                        kExprReturn,
+                      kExprEnd,
+                      kExprI32Const, 11,
+                      kExprReturn,
+                    kExprEnd,
+                    kExprI32Const, 23,
+                    kExprReturn,
+                  kExprEnd,
+                  kExprI32Const, 35,
+                  kExprReturn,
+                kExprEnd,
+                kExprI32Const, 42,
+                kExprReturn])
+      .exportFunc();
+
+  var wire_bytes = builder.toBuffer();
+  var module = new WebAssembly.Module(wire_bytes);
+  var buffer = %SerializeWasmModule(module);
+  module = %DeserializeWasmModule(buffer, wire_bytes);
+  var instance = new WebAssembly.Instance(module);
+
+  assertEquals(3, instance.exports.main(0));
+  assertEquals(7, instance.exports.main(1));
+  assertEquals(9, instance.exports.main(2));
+  assertEquals(11, instance.exports.main(3));
+  assertEquals(23, instance.exports.main(4));
+  assertEquals(35, instance.exports.main(5));
+  assertEquals(42, instance.exports.main(6));
+  assertEquals(42, instance.exports.main(9));
 })();
diff --git a/deps/v8/test/mjsunit/wasm/default-liftoff-setting.js b/deps/v8/test/mjsunit/wasm/default-liftoff-setting.js
deleted file mode 100644
index 9ae6e928af17a4..00000000000000
--- a/deps/v8/test/mjsunit/wasm/default-liftoff-setting.js
+++ /dev/null
@@ -1,21 +0,0 @@
-// Copyright 2017 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-// Flags: --allow-natives-syntax
-
-// This test makes sure that by default, we do not compile with liftoff.
-
-load('test/mjsunit/wasm/wasm-constants.js');
-load('test/mjsunit/wasm/wasm-module-builder.js');
-
-const builder = new WasmModuleBuilder();
-builder.addFunction('i32_add', kSig_i_ii)
-    .addBody([kExprGetLocal, 0, kExprGetLocal, 1, kExprI32Add])
-    .exportFunc();
-
-const instance = builder.instantiate();
-
-assertFalse(
-    %IsLiftoffFunction(instance.exports.i32_add),
-    'liftoff compilation should be off by default');
diff --git a/deps/v8/test/mjsunit/wasm/export-global.js b/deps/v8/test/mjsunit/wasm/export-global.js
index 43c788c02e8136..1bce050c2f18e5 100644
--- a/deps/v8/test/mjsunit/wasm/export-global.js
+++ b/deps/v8/test/mjsunit/wasm/export-global.js
@@ -5,40 +5,6 @@
 load("test/mjsunit/wasm/wasm-constants.js");
 load("test/mjsunit/wasm/wasm-module-builder.js");
 
-(function exportImmutableGlobal() {
-  var builder = new WasmModuleBuilder();
-  let globals = [
-    [kWasmI32, 'i32_noinit'],              // -
-    [kWasmI32, 'i32', 4711],               // -
-    [kWasmF32, 'f32_noinit'],              // -
-    [kWasmF32, 'f32', Math.fround(3.14)],  // -
-    [kWasmF64, 'f64_noinit'],              // -
-    [kWasmF64, 'f64', 1 / 7]               // -
-  ];
-  for (let g of globals) {
-    let global_builder = builder.addGlobal(g[0], false).exportAs(g[1]);
-    if (g[2]) global_builder.init = g[2];
-  }
-  var module = builder.instantiate();
-
-  for (let g of globals) {
-    assertEquals("number", typeof module.exports[g[1]], g[1]);
-    assertEquals(g[2] || 0, module.exports[g[1]], g[1]);
-  }
-})();
-
-(function cannotExportMutableGlobal() {
-  var builder = new WasmModuleBuilder();
-  builder.addGlobal(kWasmI32, true).exportAs('g');
-  assertThrows(() => builder.instantiate(), WebAssembly.CompileError);
-})();
-
-(function cannotExportI64Global() {
-  var builder = new WasmModuleBuilder();
-  builder.addGlobal(kWasmI64, false).exportAs('g');
-  assertThrows(() => builder.instantiate(), WebAssembly.LinkError);
-})();
-
 (function duplicateGlobalExportName() {
   var builder = new WasmModuleBuilder();
   builder.addGlobal(kWasmI64, false).exportAs('g');
diff --git a/deps/v8/test/mjsunit/wasm/export-mutable-global.js b/deps/v8/test/mjsunit/wasm/export-mutable-global.js
new file mode 100644
index 00000000000000..25dca3f211f091
--- /dev/null
+++ b/deps/v8/test/mjsunit/wasm/export-mutable-global.js
@@ -0,0 +1,101 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --experimental-wasm-mut-global
+
+load("test/mjsunit/wasm/wasm-constants.js");
+load("test/mjsunit/wasm/wasm-module-builder.js");
+
+(function exportImmutableGlobal() {
+  var builder = new WasmModuleBuilder();
+  let globals = [
+    [kWasmI32, 'i32_noinit'],
+    [kWasmI32, 'i32', 4711],
+    [kWasmF32, 'f32_noinit'],
+    [kWasmF32, 'f32', Math.fround(3.14)],
+    [kWasmF64, 'f64_noinit'],
+    [kWasmF64, 'f64', 1 / 7]
+  ];
+  for (let [type, name, value] of globals) {
+    let global_builder = builder.addGlobal(type, false).exportAs(name);
+    if (value) global_builder.init = value;
+  }
+  var instance = builder.instantiate();
+
+  for (let [type, name, value] of globals) {
+    let obj = instance.exports[name];
+    assertEquals("object", typeof obj, name);
+    assertTrue(obj instanceof WebAssembly.Global, name);
+    assertEquals(value || 0, obj.value, name);
+    assertThrows(() => obj.value = 0);
+  }
+})();
+
+(function canExportI64Global() {
+  var builder = new WasmModuleBuilder();
+  builder.addGlobal(kWasmI64, false).exportAs('g');
+  builder.instantiate();
+})();
+
+(function canExportAndImportI64() {
+  var builder = new WasmModuleBuilder();
+  builder.addGlobal(kWasmI64, false).exportAs('g');
+  let g = builder.instantiate().exports.g;
+
+  builder = new WasmModuleBuilder();
+  builder.addImportedGlobal("mod", "g", kWasmI64);
+  builder.instantiate({mod: {g: g}});
+})();
+
+(function exportMutableGlobal() {
+  var builder = new WasmModuleBuilder();
+  let globals = [
+    [kWasmI32, 'i32_noinit'],              // -
+    [kWasmI32, 'i32', 4711],               // -
+    [kWasmF32, 'f32_noinit'],              // -
+    [kWasmF32, 'f32', Math.fround(3.14)],  // -
+    [kWasmF64, 'f64_noinit'],              // -
+    [kWasmF64, 'f64', 1 / 7]               // -
+  ];
+  for (let [index, [type, name, value]] of globals.entries()) {
+    let global_builder = builder.addGlobal(type, true).exportAs(name);
+    if (value) global_builder.init = value;
+    builder.addFunction("get " + name, makeSig([], [type]))
+      .addBody([kExprGetGlobal, index])
+      .exportFunc();
+    builder.addFunction("set " + name, makeSig([type], []))
+      .addBody([kExprGetLocal, 0, kExprSetGlobal, index])
+      .exportFunc();
+  }
+  var instance = builder.instantiate();
+
+  for (let [type, name, value] of globals) {
+    let obj = instance.exports[name];
+
+    assertEquals(value || 0, obj.value, name);
+
+    // Changing the exported global should change the instance's global.
+    obj.value = 1001;
+    assertEquals(1001, instance.exports['get ' + name](), name);
+
+    // Changing the instance's global should change the exported global.
+    instance.exports['set ' + name](112358);
+    assertEquals(112358, obj.value, name);
+  }
+})();
+
+(function exportImportedMutableGlobal() {
+  let builder = new WasmModuleBuilder();
+  builder.addGlobal(kWasmI32, true).exportAs('g1');
+  let g1 = builder.instantiate().exports.g1;
+
+  builder = new WasmModuleBuilder();
+  builder.addImportedGlobal("mod", "g1", kWasmI32, true);
+  builder.addExportOfKind('g2', kExternalGlobal, 0);
+  let g2 = builder.instantiate({mod: {g1: g1}}).exports.g2;
+
+  g1.value = 123;
+
+  assertEquals(g1.value, g2.value);
+})();
diff --git a/deps/v8/test/mjsunit/wasm/globals.js b/deps/v8/test/mjsunit/wasm/globals.js
index 21f73ebe7ebf0a..7b2ffee7efc608 100644
--- a/deps/v8/test/mjsunit/wasm/globals.js
+++ b/deps/v8/test/mjsunit/wasm/globals.js
@@ -102,7 +102,7 @@ function TestExported(type, val, expected) {
   builder.addGlobal(kWasmI32);  // pad
 
   var instance = builder.instantiate();
-  assertEquals(expected, instance.exports.foo);
+  assertEquals(expected, instance.exports.foo.value);
 }
 
 TestExported(kWasmI32, 455.5, 455);
@@ -118,7 +118,9 @@ TestExported(kWasmF64, 87347.66666, 87347.66666);
   g.init = 1234;
   builder.addGlobal(kWasmI32);  // pad
 
-  assertThrows(()=> {builder.instantiate()}, WebAssembly.LinkError);
+  var instance = builder.instantiate();
+  assertTrue(instance.exports.foo instanceof WebAssembly.Global);
+  assertThrows(() => {instance.exports.foo.value}, TypeError);
 })();
 
 function TestImportedExported(type, val, expected) {
@@ -133,7 +135,7 @@ function TestImportedExported(type, val, expected) {
   builder.addGlobal(kWasmI32);  // pad
 
   var instance = builder.instantiate({ttt: {foo: val}});
-  assertEquals(expected, instance.exports.bar);
+  assertEquals(expected, instance.exports.bar.value);
 }
 
 TestImportedExported(kWasmI32, 415.5, 415);
diff --git a/deps/v8/test/mjsunit/wasm/import-function.js b/deps/v8/test/mjsunit/wasm/import-function.js
index 2c89e45c3e67a0..9ed234b768a4e2 100644
--- a/deps/v8/test/mjsunit/wasm/import-function.js
+++ b/deps/v8/test/mjsunit/wasm/import-function.js
@@ -294,8 +294,94 @@ function testImportName(name) {
   assertEquals(42, main());
 }
 
-testImportName("bla");
-testImportName("0");
-testImportName("  a @#$2 324 ");
-// TODO(bradnelson): This should succeed.
-// testImportName("");
+testImportName('bla');
+testImportName('0');
+testImportName('  a @#$2 324 ');
+testImportName('');
+
+(function testExportedImportsOnDifferentInstances() {
+  print(arguments.callee.name);
+  const exp = (function() {
+    const builder = new WasmModuleBuilder();
+    builder.addFunction('f11', kSig_i_v)
+        .addBody([kExprI32Const, 11])
+        .exportFunc();
+    builder.addFunction('f17', kSig_i_v)
+        .addBody([kExprI32Const, 17])
+        .exportFunc();
+    return builder.instantiate().exports;
+  })();
+
+  const builder = new WasmModuleBuilder();
+  const imp_index = builder.addImport('q', 'imp', kSig_i_v);
+  builder.addExport('exp', imp_index);
+
+  const module = builder.toModule();
+  const instance0 = new WebAssembly.Instance(module, {q: {imp: exp.f11}});
+  const instance1 = new WebAssembly.Instance(module, {q: {imp: exp.f17}});
+  const instance2 = new WebAssembly.Instance(module, {q: {imp: _ => 21}});
+  const instance3 = new WebAssembly.Instance(module, {q: {imp: _ => 27}});
+
+  assertEquals(11, instance0.exports.exp());
+  assertEquals(17, instance1.exports.exp());
+  assertEquals(21, instance2.exports.exp());
+  assertEquals(27, instance3.exports.exp());
+})();
+
+(function testImportedStartFunctionOnDifferentInstances() {
+  print(arguments.callee.name);
+  var global = 0;
+  const set_global = n => global = n;
+  const exp = (function() {
+    const builder = new WasmModuleBuilder();
+    const imp_index = builder.addImport('q', 'imp', kSig_v_i);
+    builder.addFunction('f11', kSig_v_v)
+        .addBody([kExprI32Const, 11, kExprCallFunction, imp_index])
+        .exportFunc();
+    builder.addFunction('f17', kSig_v_v)
+        .addBody([kExprI32Const, 17, kExprCallFunction, imp_index])
+        .exportFunc();
+    return builder.instantiate({q: {imp: set_global}}).exports;
+  })();
+
+  const builder = new WasmModuleBuilder();
+  const imp_index = builder.addImport('q', 'imp', kSig_v_v);
+  builder.addStart(imp_index);
+
+  const module = builder.toModule();
+
+  assertEquals(0, global);
+  new WebAssembly.Instance(module, {q: {imp: exp.f11}});
+  assertEquals(11, global);
+  new WebAssembly.Instance(module, {q: {imp: exp.f17}});
+  assertEquals(17, global);
+  new WebAssembly.Instance(module, {q: {imp: _ => set_global(21)}});
+  assertEquals(21, global);
+  new WebAssembly.Instance(module, {q: {imp: _ => set_global(27)}});
+  assertEquals(27, global);
+})();
+
+(function testImportedStartFunctionUsesRightInstance() {
+  print(arguments.callee.name);
+  var global = 0;
+  const set_global = n => global = n;
+  const exp = (function() {
+    const builder = new WasmModuleBuilder();
+    builder.addMemory(1, 1);
+    builder.exportMemoryAs('mem');
+    const imp_index = builder.addImport('q', 'imp', kSig_v_i);
+    builder.addFunction('f', kSig_v_v)
+        .addBody([kExprI32Const, 0, kExprI32Const, 11, kExprI32StoreMem8, 0, 0])
+        .exportFunc();
+    return builder.instantiate({q: {imp: set_global}}).exports;
+  })();
+
+  const builder = new WasmModuleBuilder();
+  const imp_index = builder.addImport('q', 'imp', kSig_v_v);
+  builder.addStart(imp_index);
+  const module = builder.toModule();
+
+  assertEquals(0, new Uint8Array(exp.mem.buffer)[0], 'memory initially 0');
+  new WebAssembly.Instance(module, {q: {imp: exp.f}});
+  assertEquals(11, new Uint8Array(exp.mem.buffer)[0], 'memory changed to 11');
+})();
diff --git a/deps/v8/test/mjsunit/wasm/import-mutable-global.js b/deps/v8/test/mjsunit/wasm/import-mutable-global.js
new file mode 100644
index 00000000000000..4985d992113270
--- /dev/null
+++ b/deps/v8/test/mjsunit/wasm/import-mutable-global.js
@@ -0,0 +1,201 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --experimental-wasm-mut-global --expose-gc
+
+load("test/mjsunit/wasm/wasm-constants.js");
+load("test/mjsunit/wasm/wasm-module-builder.js");
+
+(function TestBasic() {
+  let global = new WebAssembly.Global({value: 'i32'}, 1);
+  let builder = new WasmModuleBuilder();
+  builder.addImportedGlobal("mod", "g", kWasmI32);
+  builder.addFunction("main", kSig_i_v)
+    .addBody([kExprGetGlobal, 0])
+    .exportAs("main");
+
+  let main = builder.instantiate({mod: {g: global}}).exports.main;
+  assertEquals(1, main());
+})();
+
+(function TestTypeMismatch() {
+  let global = new WebAssembly.Global({value: 'f32'}, 1);
+  let builder = new WasmModuleBuilder();
+  builder.addImportedGlobal("mod", "g", kWasmI32);
+
+  assertThrows(() => builder.instantiate({mod: {g: global}}));
+})();
+
+(function TestMutableMismatch() {
+  let global = new WebAssembly.Global({value: 'f64'}, 1);
+  let builder = new WasmModuleBuilder();
+  builder.addImportedGlobal("mod", "g", kWasmF64, true);
+
+  assertThrows(() => builder.instantiate({mod: {g: global}}));
+
+  global = new WebAssembly.Global({value: 'i32', mutable: true}, 1);
+  builder = new WasmModuleBuilder();
+  builder.addImportedGlobal("mod", "g", kWasmI32);
+
+  assertThrows(() => builder.instantiate({mod: {g: global}}));
+})();
+
+(function TestImportMutableAsNumber() {
+  let builder = new WasmModuleBuilder();
+  builder.addImportedGlobal("mod", "g", kWasmF32, true);
+  assertThrows(() => builder.instantiate({mod: {g: 1234}}));
+})();
+
+(function TestImportI64AsNumber() {
+  let builder = new WasmModuleBuilder();
+  builder.addImportedGlobal("mod", "g", kWasmI64);
+  assertThrows(() => builder.instantiate({mod: {g: 1234}}));
+})();
+
+function addGlobalGetterAndSetter(builder, index, name, type) {
+  builder.addFunction('get' + name, makeSig([], [type]))
+      .addBody([kExprGetGlobal, index])
+      .exportFunc();
+  builder.addFunction('set' + name, makeSig([type], []))
+      .addBody([kExprGetLocal, 0, kExprSetGlobal, index])
+      .exportFunc();
+}
+
+(function TestImportMutableGlobal() {
+  const globalDesc = [
+    {name: 'i32', type: kWasmI32},
+    {name: 'f32', type: kWasmF32},
+    {name: 'f64', type: kWasmF64},
+  ];
+
+  let globals = {};
+  let builder = new WasmModuleBuilder();
+
+  for (let [index, {name, type}] of globalDesc.entries()) {
+    globals[name] = new WebAssembly.Global({value: name, mutable: true});
+    builder.addImportedGlobal("mod", name, type, true);
+    addGlobalGetterAndSetter(builder, index, name, type);
+  }
+
+  let inst = builder.instantiate(
+      {mod: {i32: globals.i32, f32: globals.f32, f64: globals.f64}});
+
+  for (let type of ['i32', 'f32', 'f64']) {
+    let global = globals[type];
+    let get = inst.exports['get' + type];
+    let set = inst.exports['set' + type];
+
+    assertEquals(get(), global.value, type);
+    set(1234567);
+    assertEquals(1234567, global.value, type);
+    global.value = 7654321;
+    assertEquals(7654321, get(), type);
+  }
+})();
+
+(function TestImportExportedMutableGlobal() {
+  const globalDesc = [
+    {name: 'i32', type: kWasmI32},
+    {name: 'f32', type: kWasmF32},
+    {name: 'f64', type: kWasmF64},
+  ];
+
+  let builder1 = new WasmModuleBuilder();
+  let builder2 = new WasmModuleBuilder();
+  for (let [index, {name, type}] of globalDesc.entries()) {
+    builder1.addGlobal(type, true).exportAs(name);
+    addGlobalGetterAndSetter(builder1, index, name, type);
+
+    builder2.addImportedGlobal("mod", name, type, true);
+    addGlobalGetterAndSetter(builder2, index, name, type);
+  }
+  let inst1 = builder1.instantiate();
+  let inst2 = builder2.instantiate({
+    mod: {
+      i32: inst1.exports.i32,
+      f32: inst1.exports.f32,
+      f64: inst1.exports.f64
+    }
+  });
+
+  for (let type of ['i32', 'f32', 'f64']) {
+    let get1 = inst1.exports['get' + type];
+    let get2 = inst2.exports['get' + type];
+    let set1 = inst1.exports['set' + type];
+    let set2 = inst2.exports['set' + type];
+
+    assertEquals(get1(), get2(), type);
+    set1(1234567);
+    assertEquals(1234567, get2(), type);
+    set2(7654321);
+    assertEquals(7654321, get1(), type);
+  }
+})();
+
+(function TestImportExportedMutableGlobalI64() {
+  function addGettersAndSetters(builder) {
+    const index = 0;
+    builder.addFunction('geti64_hi', makeSig([], [kWasmI32]))
+      .addBody([
+        kExprGetGlobal, index,
+        kExprI64Const, 32, kExprI64ShrU,
+        kExprI32ConvertI64])
+      .exportFunc();
+    builder.addFunction('geti64_lo', makeSig([], [kWasmI32]))
+      .addBody([kExprGetGlobal, index, kExprI32ConvertI64])
+      .exportFunc();
+    builder.addFunction("seti64", makeSig([kWasmI32, kWasmI32], []))
+      .addBody([
+        kExprGetLocal, 1, kExprI64UConvertI32,
+        kExprGetLocal, 0, kExprI64UConvertI32,
+        kExprI64Const, 32, kExprI64Shl,
+        kExprI64Ior,
+        kExprSetGlobal, index])
+      .exportFunc();
+  };
+
+  let builder = new WasmModuleBuilder();
+  builder.addGlobal(kWasmI64, true).exportAs('i64');
+  addGettersAndSetters(builder);
+  let inst1 = builder.instantiate();
+
+  builder = new WasmModuleBuilder();
+  builder.addImportedGlobal("mod", 'i64', kWasmI64, true);
+  addGettersAndSetters(builder);
+  let inst2 = builder.instantiate({ mod: { i64: inst1.exports.i64 } });
+
+  assertEquals(inst1.exports.geti64_lo(), inst2.exports.geti64_lo());
+  assertEquals(inst1.exports.geti64_hi(), inst2.exports.geti64_hi());
+  inst1.exports.seti64(13579, 24680);
+  assertEquals(13579, inst2.exports.geti64_hi());
+  assertEquals(24680, inst2.exports.geti64_lo());
+  inst2.exports.seti64(97531, 86420);
+  assertEquals(97531, inst1.exports.geti64_hi());
+  assertEquals(86420, inst1.exports.geti64_lo());
+})();
+
+(function TestImportMutableAcrossGc() {
+  let builder = new WasmModuleBuilder();
+  builder.addGlobal(kWasmI32, true).exportAs('i32');
+  let inst1 = builder.instantiate();
+
+  builder = new WasmModuleBuilder();
+  builder.addImportedGlobal("mod", 'i32', kWasmI32, true);
+  addGlobalGetterAndSetter(builder, 0, 'i32', kWasmI32);
+  let inst2 = builder.instantiate({ mod: { i32: inst1.exports.i32 } });
+
+  delete inst1;
+  gc();
+
+  inst2.exports.seti32(0x789abcde);
+  assertEquals(0x789abcde, inst2.exports.geti32());
+})();
+
+(function TestImportedAndNonImportedMutableGlobal() {
+  let global = new WebAssembly.Global({value: 'i32', mutable: true}, 1);
+  let builder = new WasmModuleBuilder();
+  builder.addGlobal(kWasmI32, true).exportAs('i32');
+  builder.addImportedGlobal("mod", "g", kWasmI32, true);
+  builder.instantiate({mod: {g: global}});
+})();
diff --git a/deps/v8/test/mjsunit/wasm/indirect-tables.js b/deps/v8/test/mjsunit/wasm/indirect-tables.js
index 664e28788a4bdb..247d67a41dc3f6 100644
--- a/deps/v8/test/mjsunit/wasm/indirect-tables.js
+++ b/deps/v8/test/mjsunit/wasm/indirect-tables.js
@@ -708,44 +708,6 @@ function js_div(a, b) { return (a / b) | 0; }
 })();
 
 
-// Remove this test when v8:7232 is addressed comprehensively.
-(function TablesAreImmutableInWasmCallstacks() {
-  print(arguments.callee.name);
-
-  let table = new WebAssembly.Table({initial:2, element:'anyfunc'});
-
-  let builder = new WasmModuleBuilder();
-  builder.addImport('', 'mutator', kSig_v_v);
-  builder.addFunction('main', kSig_v_v)
-    .addBody([
-      kExprCallFunction, 0
-    ]).exportAs('main');
-
-  let module = new WebAssembly.Module(builder.toBuffer());
-  let instance = new WebAssembly.Instance(module, {
-    '': {
-      'mutator': () => {table.set(0, null);}
-    }
-  });
-
-  table.set(0, instance.exports.main);
-
-  try {
-    instance.exports.main();
-    assertUnreached();
-  } catch (e) {
-    assertTrue(e instanceof RangeError);
-  }
-  try {
-    instance.exports.main();
-    assertUnreached();
-  } catch (e) {
-    assertTrue(e instanceof RangeError);
-  }
-  table.set(0, null);
-  assertEquals(null, table.get(0));
-})();
-
 (function ImportedWasmFunctionPutIntoTable() {
   print(arguments.callee.name);
 
diff --git a/deps/v8/test/mjsunit/wasm/interpreter.js b/deps/v8/test/mjsunit/wasm/interpreter.js
index a57498b9a8ba12..0bf3f8610b9571 100644
--- a/deps/v8/test/mjsunit/wasm/interpreter.js
+++ b/deps/v8/test/mjsunit/wasm/interpreter.js
@@ -318,6 +318,31 @@ function checkStack(stack, expected_lines) {
   }
 })();
 
+(function testImportExportedFunction() {
+  // See https://crbug.com/860392.
+  print(arguments.callee.name);
+  let instance0 = (() => {
+    let builder = new WasmModuleBuilder();
+    builder.addFunction('f11', kSig_i_v).addBody(wasmI32Const(11)).exportFunc();
+    builder.addFunction('f17', kSig_i_v).addBody(wasmI32Const(17)).exportFunc();
+    return builder.instantiate();
+  })();
+
+  let builder = new WasmModuleBuilder();
+  let sig_i_v = builder.addType(kSig_i_v);
+  let f11_imp = builder.addImport('q', 'f11', sig_i_v);
+  let f17_imp = builder.addImport('q', 'f17', sig_i_v);
+  let add = builder.addFunction('add', sig_i_v).addBody([
+    kExprCallFunction, f11_imp,  // call f11
+    kExprCallFunction, f17_imp,  // call f17
+    kExprI32Add                  // i32.add
+  ]).exportFunc();
+  let instance = builder.instantiate(
+      {q: {f11: instance0.exports.f11, f17: instance0.exports.f17}});
+
+  assertEquals(28, instance.exports.add());
+})();
+
 (function testInfiniteRecursion() {
   print(arguments.callee.name);
   var builder = new WasmModuleBuilder();
diff --git a/deps/v8/test/mjsunit/wasm/liftoff.js b/deps/v8/test/mjsunit/wasm/liftoff.js
index c57cbfc0904eab..8570d3d5231e69 100644
--- a/deps/v8/test/mjsunit/wasm/liftoff.js
+++ b/deps/v8/test/mjsunit/wasm/liftoff.js
@@ -3,6 +3,7 @@
 // found in the LICENSE file.
 
 // Flags: --allow-natives-syntax --liftoff --wasm-async-compilation
+// Flags: --no-future --no-wasm-tier-up
 
 load('test/mjsunit/wasm/wasm-constants.js');
 load('test/mjsunit/wasm/wasm-module-builder.js');
diff --git a/deps/v8/test/mjsunit/wasm/module-memory.js b/deps/v8/test/mjsunit/wasm/module-memory.js
index e9d2bb954d7d45..de05dd46576dab 100644
--- a/deps/v8/test/mjsunit/wasm/module-memory.js
+++ b/deps/v8/test/mjsunit/wasm/module-memory.js
@@ -174,22 +174,28 @@ function testOOBThrows() {
 testOOBThrows();
 
 function testAddressSpaceLimit() {
-  // 1TiB, see wasm-memory.h
-  const kMaxAddressSpace = 1 * 1024 * 1024 * 1024 * 1024;
+  // 1TiB + 4 GiB, see wasm-memory.h
+  const kMaxAddressSpace = 1 * 1024 * 1024 * 1024 * 1024
+                         + 4 * 1024 * 1024 * 1024;
   const kAddressSpacePerMemory = 8 * 1024 * 1024 * 1024;
 
+  let last_memory;
   try {
     let memories = [];
     let address_space = 0;
     while (address_space <= kMaxAddressSpace + 1) {
-      memories.push(new WebAssembly.Memory({initial: 1}));
+      last_memory = new WebAssembly.Memory({initial: 1})
+      memories.push(last_memory);
       address_space += kAddressSpacePerMemory;
     }
   } catch (e) {
     assertTrue(e instanceof RangeError);
     return;
   }
-  failWithMessage("allocated too much memory");
+  // If we get here it's because our fallback behavior is working. We may not
+  // be using the fallback, in which case we would have thrown a RangeError in
+  // the previous block.
+  assertTrue(!%WasmMemoryHasFullGuardRegion(last_memory));
 }
 
 if(%IsWasmTrapHandlerEnabled()) {
diff --git a/deps/v8/test/mjsunit/wasm/mutable-globals.js b/deps/v8/test/mjsunit/wasm/mutable-globals.js
index 0ed8b9d3ad0e40..7a94520a21277a 100644
--- a/deps/v8/test/mjsunit/wasm/mutable-globals.js
+++ b/deps/v8/test/mjsunit/wasm/mutable-globals.js
@@ -21,11 +21,11 @@ function assertGlobalIsValid(global) {
   assertThrows(() => new WebAssembly.Global(""), TypeError);
 
   assertThrows(() => new WebAssembly.Global({}), TypeError);
-  assertThrows(() => new WebAssembly.Global({type: 'foo'}), TypeError);
-  assertThrows(() => new WebAssembly.Global({type: 'i64'}), TypeError);
+  assertThrows(() => new WebAssembly.Global({value: 'foo'}), TypeError);
+  assertThrows(() => new WebAssembly.Global({value: 'i64'}), TypeError);
 
   for (let type of ['i32', 'f32', 'f64']) {
-    assertGlobalIsValid(new WebAssembly.Global({type}));
+    assertGlobalIsValid(new WebAssembly.Global({value: type}));
   }
 })();
 
@@ -214,28 +214,35 @@ const f64_values = [
   NaN
 ];
 
-function GlobalI32(value) {
-  return new WebAssembly.Global({type: 'i32', value});
+function GlobalI32(value, mutable = false) {
+  return new WebAssembly.Global({value: 'i32', mutable}, value);
 }
 
-function GlobalF32(value) {
-  return new WebAssembly.Global({type: 'f32', value});
+function GlobalI64(mutable = false) {
+  let builder = new WasmModuleBuilder();
+  builder.addGlobal(kWasm64, mutable).exportAs('i64');
+  let module = new WebAssembly.Module(builder.toBuffer());
+  let instance = new WebAssembly.Instance(module);
+  return instance.exports.i64;
 }
 
-function GlobalF64(value) {
-  return new WebAssembly.Global({type: 'f64', value});
+function GlobalF32(value, mutable = false) {
+  return new WebAssembly.Global({value: 'f32', mutable}, value);
+}
+
+function GlobalF64(value, mutable = false) {
+  return new WebAssembly.Global({value: 'f64', mutable}, value);
 }
 
 (function TestDefaultValue() {
   assertSame(0, GlobalI32().value);
-  // TODO(binji): The spec currently requires the default value to be NaN, but
-  // I think we should change this to 0. See
-  // https://github.com/WebAssembly/mutable-global/issues/6
-  assertSame(NaN, GlobalF32().value);
-  assertSame(NaN, GlobalF64().value);
+  assertSame(0, GlobalF32().value);
+  assertSame(0, GlobalF64().value);
 })();
 
 (function TestValueOf() {
+  assertTrue(WebAssembly.Global.prototype.valueOf instanceof Function);
+  assertSame(0, WebAssembly.Global.prototype.valueOf.length);
 
   for (let u32_value of u32_values) {
     let i32_value = u32_value | 0;
@@ -244,6 +251,8 @@ function GlobalF64(value) {
     assertSame(i32_value, GlobalI32(i32_value).valueOf());
   }
 
+  assertThrows(() => GlobalI64().valueOf());
+
   for (let f32_value of f32_values) {
     assertSame(Math.fround(f32_value), GlobalF32(f32_value).valueOf());
   }
@@ -251,10 +260,14 @@ function GlobalF64(value) {
   for (let f64_value of f64_values) {
     assertSame(f64_value, GlobalF64(f64_value).valueOf());
   }
-
 })();
 
 (function TestGetValue() {
+  let getter =
+      Object.getOwnPropertyDescriptor(WebAssembly.Global.prototype, 'value')
+          .get;
+  assertTrue(getter instanceof Function);
+  assertSame(0, getter.length);
 
   for (let u32_value of u32_values) {
     let i32_value = u32_value | 0;
@@ -262,6 +275,8 @@ function GlobalF64(value) {
     assertSame(i32_value, GlobalI32(i32_value).value);
   }
 
+  assertThrows(() => GlobalI64().value);
+
   for (let f32_value of f32_values) {
     assertSame(Math.fround(f32_value), GlobalF32(f32_value).value);
   }
@@ -269,15 +284,26 @@ function GlobalF64(value) {
   for (let f64_value of f64_values) {
     assertSame(f64_value, GlobalF64(f64_value).value);
   }
+})();
 
+(function TestSetValueImmutable() {
+  assertThrows(() => GlobalI32().value = 0);
+  assertThrows(() => GlobalI64().value = 0);
+  assertThrows(() => GlobalF32().value = 0);
+  assertThrows(() => GlobalF64().value = 0);
 })();
 
 (function TestSetValue() {
+  let setter =
+      Object.getOwnPropertyDescriptor(WebAssembly.Global.prototype, 'value')
+          .set;
+  assertTrue(setter instanceof Function);
+  assertSame(1, setter.length);
 
   for (let u32_value of u32_values) {
     let i32_value = u32_value | 0;
 
-    let global = GlobalI32();
+    let global = GlobalI32(0, true);
     global.value = u32_value;
     assertSame(i32_value, global.value);
 
@@ -285,16 +311,17 @@ function GlobalF64(value) {
     assertSame(i32_value, global.value);
   }
 
+  assertThrows(() => GlobalI64(true).value = 0);
+
   for (let f32_value of f32_values) {
-    let global = GlobalF32();
+    let global = GlobalF32(0, true);
     global.value = f32_value;
     assertSame(Math.fround(f32_value), global.value);
   }
 
   for (let f64_value of f64_values) {
-    let global = GlobalF64();
+    let global = GlobalF64(0, true);
     global.value = f64_value;
     assertSame(f64_value, global.value);
   }
-
 })();
diff --git a/deps/v8/test/mjsunit/wasm/print-code.js b/deps/v8/test/mjsunit/wasm/print-code.js
new file mode 100644
index 00000000000000..2d35a27559cea4
--- /dev/null
+++ b/deps/v8/test/mjsunit/wasm/print-code.js
@@ -0,0 +1,32 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --print-wasm-code
+
+// Just test that printing the code of the following wasm modules does not
+// crash.
+
+load('test/mjsunit/wasm/wasm-constants.js');
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+(function print_deserialized_code() {
+  // https://crbug.com/849656
+  print(arguments.callee.name);
+  var builder = new WasmModuleBuilder();
+  builder.addImport('', 'imp', kSig_i_v);
+
+  builder.addFunction('main', kSig_i_v)
+      .addBody([
+        kExprCallFunction,
+        0,
+      ])
+      .exportFunc();
+
+  var wire_bytes = builder.toBuffer();
+  var module = new WebAssembly.Module(wire_bytes);
+  print('serializing');
+  var buff = %SerializeWasmModule(module);
+  print('deserializing');
+  module = %DeserializeWasmModule(buff, wire_bytes);
+})();
diff --git a/deps/v8/test/mjsunit/wasm/serialize-lazy-module.js b/deps/v8/test/mjsunit/wasm/serialize-lazy-module.js
new file mode 100644
index 00000000000000..98998c6f437ac9
--- /dev/null
+++ b/deps/v8/test/mjsunit/wasm/serialize-lazy-module.js
@@ -0,0 +1,68 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --wasm-lazy-compilation --allow-natives-syntax --expose-gc
+
+load('test/mjsunit/wasm/wasm-constants.js');
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+(function SerializeUncompiledModule() {
+  print(arguments.callee.name);
+  const [wire_bytes, i1, buff] = (function GenerateInstance() {
+    const builder = new WasmModuleBuilder();
+
+    // Add 20 functions.
+    for (let i = 0; i < 20; ++i) {
+      builder.addFunction('f' + i, kSig_i_i)
+          .addBody([kExprI32Const, i])
+          .exportFunc();
+    }
+
+    const wire_bytes = builder.toBuffer();
+    const module = new WebAssembly.Module(wire_bytes);
+    const buff = %SerializeWasmModule(module);
+    return [wire_bytes, new WebAssembly.Instance(module), buff];
+  })();
+
+  gc();
+  const module = %DeserializeWasmModule(buff, wire_bytes);
+
+  const i2 = new WebAssembly.Instance(module);
+
+  assertEquals(13, i2.exports.f13());
+  assertEquals(11, i1.exports.f11());
+})();
+
+(function SerializePartlyCompiledModule() {
+  print(arguments.callee.name);
+  const [wire_bytes, i1, buff] = (function GenerateInstance() {
+    const builder = new WasmModuleBuilder();
+
+    // Add 20 functions.
+    for (let i = 0; i < 20; ++i) {
+      builder.addFunction('f' + i, kSig_i_i)
+          .addBody([kExprI32Const, i])
+          .exportFunc();
+    }
+
+    const wire_bytes = builder.toBuffer();
+    const module = new WebAssembly.Module(wire_bytes);
+    const buff = %SerializeWasmModule(module);
+    const i1 = new WebAssembly.Instance(module);
+
+    assertEquals(2, i1.exports.f2());
+    assertEquals(11, i1.exports.f11());
+
+    return [wire_bytes, i1, buff];
+  })();
+
+  gc();
+  const module = %DeserializeWasmModule(buff, wire_bytes);
+
+  const i2 = new WebAssembly.Instance(module);
+
+  assertEquals(13, i2.exports.f13());
+  assertEquals(11, i1.exports.f11());
+  assertEquals(9, i1.exports.f9());
+})();
diff --git a/deps/v8/test/mjsunit/wasm/start-function.js b/deps/v8/test/mjsunit/wasm/start-function.js
index d6ec34124e4a14..b47dac57670c7b 100644
--- a/deps/v8/test/mjsunit/wasm/start-function.js
+++ b/deps/v8/test/mjsunit/wasm/start-function.js
@@ -126,15 +126,23 @@ assertThrows(() => {instantiate(kSig_i_v, [kExprI32Const, 0]);});
 (function testStartFunctionThrowsExplicitly() {
   print('testStartFunctionThrowsExplicitly');
   let error = new Error('my explicit error');
-  function throw_fn() {
-    throw error;
-  }
+  var ffi = {
+    foo: {
+      throw_fn: function() {
+        throw error;
+      }
+    }
+  };
   let builder = new WasmModuleBuilder();
-  builder.addImport('foo', 'bar', kSig_v_v);
+  builder.addImport('foo', 'throw_fn', kSig_v_v);
   let func = builder.addFunction('', kSig_v_v).addBody([kExprCallFunction, 0]);
   builder.addStart(func.index);
 
   assertThrowsEquals(() => builder.instantiate(ffi), error);
+  assertPromiseResult(builder.asyncInstantiate(ffi), assertUnreachable,
+    e => assertSame(e, error));
+  assertPromiseResult(WebAssembly.instantiate(builder.toModule(), ffi),
+    assertUnreachable, e => assertSame(e, error));
 })();
 
 (function testStartFunctionThrowsImplicitly() {
@@ -145,4 +153,9 @@ assertThrows(() => {instantiate(kSig_i_v, [kExprI32Const, 0]);});
 
   assertThrows(
       () => builder.instantiate(), WebAssembly.RuntimeError, /unreachable/);
+  assertPromiseResult(builder.asyncInstantiate(), assertUnreachable,
+    e => assertInstanceof(e, WebAssembly.RuntimeError));
+  assertPromiseResult(WebAssembly.instantiate(builder.toModule()),
+    assertUnreachable,
+    e => assertInstanceof(e, WebAssembly.RuntimeError));
 })();
diff --git a/deps/v8/test/mjsunit/wasm/trap-handler-fallback.js b/deps/v8/test/mjsunit/wasm/trap-handler-fallback.js
new file mode 100644
index 00000000000000..26296696c543ec
--- /dev/null
+++ b/deps/v8/test/mjsunit/wasm/trap-handler-fallback.js
@@ -0,0 +1,202 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --wasm-trap-handler-fallback
+
+load("test/mjsunit/wasm/wasm-constants.js");
+load("test/mjsunit/wasm/wasm-module-builder.js");
+
+// Make sure we can get at least one guard region if the trap handler is enabled.
+(function CanGetGuardRegionTest() {
+  print("CanGetGuardRegionTest()");
+  const memory = new WebAssembly.Memory({initial: 1});
+  if (%IsWasmTrapHandlerEnabled()) {
+    assertTrue(%WasmMemoryHasFullGuardRegion(memory));
+  }
+})();
+
+// This test verifies that when we have too many outstanding memories to get
+// another fast memory, we fall back on bounds checking rather than failing.
+(function TrapHandlerFallbackTest() {
+  print("TrapHandlerFallbackTest()");
+  let builder = new WasmModuleBuilder();
+  builder.addImportedMemory("mod", "imported_mem", 1);
+  builder.addFunction("load", kSig_i_i)
+    .addBody([kExprGetLocal, 0, kExprI32LoadMem, 0, 0])
+    .exportFunc();
+  let memory;
+  let instance;
+  let instances = [];
+  let fallback_occurred = false;
+  // Create 135 instances. V8 limits wasm to slightly more than 1 TiB of address
+  // space per isolate (see kAddressSpaceLimit in wasm-memory.cc), which allows
+  // up to 128 fast memories. As long as we create more than that, we should
+  // trigger the fallback behavior.
+  for (var i = 0; i < 135; i++) {
+    memory = new WebAssembly.Memory({initial: 1});
+    instance = builder.instantiate({mod: {imported_mem: memory}});
+    instances.push(instance);
+
+    assertTraps(kTrapMemOutOfBounds, () => instance.exports.load(1 << 20));
+
+    fallback_occurred = fallback_occurred || !%WasmMemoryHasFullGuardRegion(memory);
+    if (fallback_occurred) {
+      break;
+    }
+  }
+  assertTrue(fallback_occurred);
+})();
+
+(function TrapHandlerFallbackTestZeroInitialMemory() {
+  print("TrapHandlerFallbackTestZeroInitialMemory()");
+  let builder = new WasmModuleBuilder();
+  builder.addImportedMemory("mod", "imported_mem", 0);
+  builder.addFunction("load", kSig_i_i)
+    .addBody([kExprGetLocal, 0, kExprI32LoadMem, 0, 0])
+    .exportFunc();
+  let memory;
+  let instance;
+  let instances = [];
+  let fallback_occurred = false;
+  // Create 135 instances. V8 limits wasm to slightly more than 1 TiB of address
+  // space per isolate (see kAddressSpaceLimit in wasm-memory.cc), which allows
+  // up to 128 fast memories. As long as we create more than that, we should
+  // trigger the fallback behavior.
+  for (var i = 0; i < 135; i++) {
+    memory = new WebAssembly.Memory({initial: 1});
+    instance = builder.instantiate({mod: {imported_mem: memory}});
+    instances.push(instance);
+
+    assertTraps(kTrapMemOutOfBounds, () => instance.exports.load(1 << 20));
+
+    fallback_occurred = fallback_occurred || !%WasmMemoryHasFullGuardRegion(memory);
+    if (fallback_occurred) {
+      break;
+    }
+  }
+  assertTrue(fallback_occurred);
+})();
+
+(function TrapHandlerFallbackTestGrowFromZero() {
+  print("TrapHandlerFallbackTestGrowFromZero()");
+  // Create a zero-length memory to make sure the empty backing store is created.
+  const zero_memory = new WebAssembly.Memory({initial: 0});
+
+  // Create enough memories to overflow the address space limit
+  let memories = []
+  for (var i = 0; i < 135; i++) {
+    memories.push(new WebAssembly.Memory({initial: 1}));
+  }
+
+  // Create a memory for the module. We'll grow this later.
+  let memory = new WebAssembly.Memory({initial: 0});
+
+  let builder = new WasmModuleBuilder();
+  builder.addImportedMemory("mod", "imported_mem", 0);
+  builder.addFunction("load", kSig_i_i)
+    .addBody([kExprGetLocal, 0, kExprI32LoadMem, 0, 0])
+    .exportFunc();
+
+  instance = builder.instantiate({mod: {imported_mem: memory}});
+
+  assertTraps(kTrapMemOutOfBounds, () => instance.exports.load(1 << 20));
+
+  try {
+    memory.grow(1);
+  } catch(e) {
+    if (typeof e == typeof new RangeError) {
+      return;
+    }
+    throw e;
+  }
+
+  assertTraps(kTrapMemOutOfBounds, () => instance.exports.load(1 << 20));
+})();
+
+// Like TrapHandlerFallbackTest, but allows the module to be reused, so we only
+// have to recompile once.
+(function TrapHandlerFallbackTestReuseModule() {
+  print("TrapHandlerFallbackTestReuseModule()");
+  let builder = new WasmModuleBuilder();
+  builder.addImportedMemory("mod", "imported_mem", 1);
+  builder.addFunction("load", kSig_i_i)
+    .addBody([kExprGetLocal, 0, kExprI32LoadMem, 0, 0])
+    .exportFunc();
+  let memory;
+  let instance;
+  let instances = [];
+  let fallback_occurred = false;
+  // Create 135 instances. V8 limits wasm to slightly more than 1 TiB of address
+  // space per isolate (see kAddressSpaceLimit in wasm-memory.cc), which allows
+  // up to 128 fast memories. As long as we create more than that, we should
+  // trigger the fallback behavior.
+  const module = builder.toModule();
+  for (var i = 0; i < 135; i++) {
+    memory = new WebAssembly.Memory({initial: 1});
+    instance = new WebAssembly.Instance(module, {mod: {imported_mem: memory}});
+    instances.push(instance);
+
+    assertTraps(kTrapMemOutOfBounds, () => instance.exports.load(1 << 20));
+
+    fallback_occurred = fallback_occurred || !%WasmMemoryHasFullGuardRegion(memory);
+    if (fallback_occurred) {
+      break;
+    }
+  }
+  assertTrue(fallback_occurred);
+})();
+
+// Make sure that a bounds checked instance still works when calling an
+// imported unchecked function.
+(function CallIndirectImportTest() {
+  print("CallIndirectImportTest()");
+  // Create an unchecked instance that calls a function through an indirect
+  // table.
+  const instance_a = (() => {
+    const builder = new WasmModuleBuilder();
+    builder.addMemory(1, 1, false);
+    builder.addFunction("read_mem", kSig_i_i)
+      .addBody([
+        kExprGetLocal, 0,
+        kExprI32LoadMem, 0, 0
+      ]).exportAs("read_mem");
+    return builder.instantiate();
+  })();
+
+  // Create new memories until we get one that is unguarded
+  let memories = [];
+  let memory;
+  for (var i = 0; i < 135; i++) {
+    memory = new WebAssembly.Memory({initial: 1});
+    memories.push(memory);
+    if (!%WasmMemoryHasFullGuardRegion(memory)) {
+      break;
+    }
+  }
+  assertFalse(%WasmMemoryHasFullGuardRegion(memory));
+
+  // create a module that imports a function through a table
+  const instance_b = (() => {
+    const builder = new WasmModuleBuilder();
+    builder.addFunction("main", kSig_i_i)
+      .addBody([
+        kExprGetLocal, 0,
+        kExprI32Const, 0,
+        kExprCallIndirect, 0, kTableZero
+      ]).exportAs("main");
+    builder.addImportedTable("env", "table", 1, 1);
+    const module = new WebAssembly.Module(builder.toBuffer());
+    const table = new WebAssembly.Table({
+      element: "anyfunc",
+      initial: 1, maximum: 1
+    });
+    // Hook the new instance's export into the old instance's table.
+    table.set(0, instance_a.exports.read_mem);
+    return new WebAssembly.Instance(module, {'env': { 'table': table }});
+  })();
+
+  // Make sure we get an out of bounds still.
+  assertTraps(kTrapMemOutOfBounds, () => instance_b.exports.main(100000));
+
+})();
diff --git a/deps/v8/test/mjsunit/wasm/wasm-module-builder.js b/deps/v8/test/mjsunit/wasm/wasm-module-builder.js
index b9a85e7831c275..98a3c6d4e092de 100644
--- a/deps/v8/test/mjsunit/wasm/wasm-module-builder.js
+++ b/deps/v8/test/mjsunit/wasm/wasm-module-builder.js
@@ -249,9 +249,9 @@ class WasmModuleBuilder {
     return this.num_imported_funcs++;
   }
 
-  addImportedGlobal(module = "", name, type) {
+  addImportedGlobal(module = "", name, type, mutable = false) {
     let o = {module: module, name: name, kind: kExternalGlobal, type: type,
-             mutable: false}
+             mutable: mutable};
     this.imports.push(o);
     return this.num_imported_globals++;
   }
diff --git a/deps/v8/test/mjsunit/wasm/worker-memory.js b/deps/v8/test/mjsunit/wasm/worker-memory.js
index 6d96e7ba363cdb..e2a8cf8857b629 100644
--- a/deps/v8/test/mjsunit/wasm/worker-memory.js
+++ b/deps/v8/test/mjsunit/wasm/worker-memory.js
@@ -67,3 +67,19 @@ let workerHelpers =
   assertEquals("OK", worker.getMessage());
   worker.terminate();
 })();
+
+(function TestTwoWorkers() {
+  let workerScript = workerHelpers +
+    `onmessage = function(memory) {
+       assertIsWasmMemory(memory, 65536);
+       postMessage("OK");
+     };`;
+
+  let workers = [new Worker(workerScript), new Worker(workerScript)];
+  let memory = new WebAssembly.Memory({initial: 1, maximum: 2, shared: true});
+  for (let worker of workers) {
+    worker.postMessage(memory);
+    assertEquals("OK", worker.getMessage());
+    worker.terminate();
+  }
+})();
diff --git a/deps/v8/test/mjsunit/wasm/worker-module.js b/deps/v8/test/mjsunit/wasm/worker-module.js
new file mode 100644
index 00000000000000..d63a8679c548b1
--- /dev/null
+++ b/deps/v8/test/mjsunit/wasm/worker-module.js
@@ -0,0 +1,34 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --no-wasm-disable-structured-cloning
+
+load("test/mjsunit/wasm/wasm-constants.js");
+load("test/mjsunit/wasm/wasm-module-builder.js");
+
+function TestCloneModule() {
+  let builder = new WasmModuleBuilder();
+  builder.addFunction("add", kSig_i_ii)
+    .addBody([kExprGetLocal, 0, kExprGetLocal, 1, kExprI32Add])
+    .exportFunc();
+
+  let module = builder.toModule();
+
+  let workerScript = `
+    onmessage = function(module) {
+      try {
+        let instance = new WebAssembly.Instance(module);
+        let result = instance.exports.add(40, 2);
+        postMessage(result);
+      } catch(e) {
+        postMessage('ERROR: ' + e);
+      }
+    }
+  `;
+
+  let worker = new Worker(workerScript);
+  worker.postMessage(module);
+  assertEquals(42, worker.getMessage());
+  worker.terminate();
+}
diff --git a/deps/v8/test/mkgrokdump/BUILD.gn b/deps/v8/test/mkgrokdump/BUILD.gn
index e35ce57d8441da..eae9f265786321 100644
--- a/deps/v8/test/mkgrokdump/BUILD.gn
+++ b/deps/v8/test/mkgrokdump/BUILD.gn
@@ -21,7 +21,6 @@ v8_executable("mkgrokdump") {
     "../..:v8",
     "../..:v8_libbase",
     "../..:v8_libplatform",
-    "//build/config:exe_and_shlib_deps",
     "//build/win:default_exe_manifest",
   ]
 
diff --git a/deps/v8/test/mkgrokdump/mkgrokdump.cc b/deps/v8/test/mkgrokdump/mkgrokdump.cc
index dcf90559b6ce43..d610bf228ab252 100644
--- a/deps/v8/test/mkgrokdump/mkgrokdump.cc
+++ b/deps/v8/test/mkgrokdump/mkgrokdump.cc
@@ -28,10 +28,7 @@ static const char* kHeader =
 // Non-snapshot builds allocate objects to different places.
 // Debug builds emit debug code, affecting code object sizes.
 // Embedded builtins cause objects to be allocated in different locations.
-// TODO(jgruber,v8:6666): Change the V8_EMBEDDED_BUILTINS condition when it
-// becomes the default.
-#if !defined(V8_EMBEDDED_BUILTINS) && defined(V8_USE_SNAPSHOT) && \
-    !defined(DEBUG)
+#if defined(V8_EMBEDDED_BUILTINS) && defined(V8_USE_SNAPSHOT) && !defined(DEBUG)
 static const char* kBuild = "shipping";
 #else
 static const char* kBuild = "non-shipping";
@@ -44,28 +41,37 @@ class MockArrayBufferAllocator : public v8::ArrayBuffer::Allocator {
   void Free(void* p, size_t) override {}
 };
 
+#define RO_ROOT_LIST_CASE(type, name, camel_name) \
+  if (n == NULL && o == roots.name()) n = #camel_name;
 #define ROOT_LIST_CASE(type, name, camel_name) \
   if (n == NULL && o == space->heap()->name()) n = #camel_name;
 #define STRUCT_LIST_CASE(upper_name, camel_name, name) \
-  if (n == NULL && o == space->heap()->name##_map()) n = #camel_name "Map";
+  if (n == NULL && o == roots.name##_map()) n = #camel_name "Map";
+#define ALLOCATION_SITE_LIST_CASE(upper_name, camel_name, size, name) \
+  if (n == NULL && o == roots.name##_map()) n = #camel_name "Map";
 static void DumpMaps(i::PagedSpace* space) {
   i::HeapObjectIterator it(space);
+  i::ReadOnlyRoots roots(space->heap());
   for (i::Object* o = it.Next(); o != NULL; o = it.Next()) {
     if (!o->IsMap()) continue;
     i::Map* m = i::Map::cast(o);
     const char* n = NULL;
     intptr_t p = reinterpret_cast<intptr_t>(m) & 0x7FFFF;
     int t = m->instance_type();
-    ROOT_LIST(ROOT_LIST_CASE)
+    STRONG_READ_ONLY_ROOT_LIST(RO_ROOT_LIST_CASE)
+    MUTABLE_ROOT_LIST(ROOT_LIST_CASE)
     STRUCT_LIST(STRUCT_LIST_CASE)
+    ALLOCATION_SITE_LIST(ALLOCATION_SITE_LIST_CASE)
     if (n == NULL) continue;
-    const char* sname = AllocationSpaceName(space->identity());
+    const char* sname = space->name();
     i::PrintF("  (\"%s\", 0x%05" V8PRIxPTR "): (%d, \"%s\"),\n", sname, p, t,
               n);
   }
 }
+#undef ALLOCATION_SITE_LIST_CASE
 #undef STRUCT_LIST_CASE
 #undef ROOT_LIST_CASE
+#undef RO_ROOT_LIST_CASE
 
 static int DumpHeapConstants(const char* argv0) {
   // Start up V8.
@@ -80,6 +86,7 @@ static int DumpHeapConstants(const char* argv0) {
   {
     Isolate::Scope scope(isolate);
     i::Heap* heap = reinterpret_cast<i::Isolate*>(isolate)->heap();
+    i::ReadOnlyRoots roots(heap);
     i::PrintF("%s", kHeader);
 #define DUMP_TYPE(T) i::PrintF("  %d: \"%s\",\n", i::T, #T);
     i::PrintF("INSTANCE_TYPES = {\n");
@@ -96,6 +103,11 @@ static int DumpHeapConstants(const char* argv0) {
 
     // Dump the KNOWN_OBJECTS table to the console.
     i::PrintF("\n# List of known V8 objects.\n");
+#define RO_ROOT_LIST_CASE(type, name, camel_name) \
+  if (n == NULL && o == roots.name()) {           \
+    n = #camel_name;                              \
+    i = i::Heap::k##camel_name##RootIndex;        \
+  }
 #define ROOT_LIST_CASE(type, name, camel_name) \
   if (n == NULL && o == heap->name()) {        \
     n = #camel_name;                           \
@@ -108,14 +120,15 @@ static int DumpHeapConstants(const char* argv0) {
       // Code objects are generally platform-dependent.
       if (s->identity() == i::CODE_SPACE || s->identity() == i::MAP_SPACE)
         continue;
-      const char* sname = AllocationSpaceName(s->identity());
+      const char* sname = s->name();
       for (i::Object* o = it.Next(); o != NULL; o = it.Next()) {
         // Skip maps in RO_SPACE since they will be reported elsewhere.
         if (o->IsMap()) continue;
         const char* n = NULL;
         i::Heap::RootListIndex i = i::Heap::kStrongRootListLength;
         intptr_t p = reinterpret_cast<intptr_t>(o) & 0x7FFFF;
-        ROOT_LIST(ROOT_LIST_CASE)
+        STRONG_READ_ONLY_ROOT_LIST(RO_ROOT_LIST_CASE)
+        MUTABLE_ROOT_LIST(ROOT_LIST_CASE)
         if (n == NULL) continue;
         if (!i::Heap::RootIsImmortalImmovable(i)) continue;
         i::PrintF("  (\"%s\", 0x%05" V8PRIxPTR "): \"%s\",\n", sname, p, n);
@@ -123,6 +136,7 @@ static int DumpHeapConstants(const char* argv0) {
     }
     i::PrintF("}\n");
 #undef ROOT_LIST_CASE
+#undef RO_ROOT_LIST_CASE
 
     // Dump frame markers
     i::PrintF("\n# List of known V8 Frame Markers.\n");
diff --git a/deps/v8/test/mozilla/mozilla.status b/deps/v8/test/mozilla/mozilla.status
index cec5df904ffae8..84d17f3fdb2cbb 100644
--- a/deps/v8/test/mozilla/mozilla.status
+++ b/deps/v8/test/mozilla/mozilla.status
@@ -1014,8 +1014,8 @@
   'ecma_3/RegExp/regress-85721': [SKIP],
 }],  # tsan
 
-['variant == wasm_traps', {
+['variant == no_wasm_traps', {
   '*': [SKIP],
-}],  # variant == wasm_traps
+}],  # variant == no_wasm_traps
 
 ]
diff --git a/deps/v8/test/test262/harness-agent.js b/deps/v8/test/test262/harness-agent.js
index 2fc862026cad9a..83f688cf07b1cb 100644
--- a/deps/v8/test/test262/harness-agent.js
+++ b/deps/v8/test/test262/harness-agent.js
@@ -62,7 +62,11 @@ function workerScript(script) {
 
         sleep(s) { Atomics.wait(i32a, ${SLEEP_LOC}, 0, s); },
 
-        leaving() {}
+        leaving() {},
+
+        monotonicNow() {
+          return performance.now();
+        }
       }
     };`;
 }
@@ -103,7 +107,11 @@ var agent = {
     return pendingReports.shift() || null;
   },
 
-  sleep(s) { Atomics.wait(i32a, SLEEP_LOC, 0, s); }
+  sleep(s) { Atomics.wait(i32a, SLEEP_LOC, 0, s); },
+
+  monotonicNow() {
+    return performance.now();
+  }
 };
 return agent;
 
diff --git a/deps/v8/test/test262/test262.status b/deps/v8/test/test262/test262.status
index f58a192459513a..ecc23f43e7d5df 100644
--- a/deps/v8/test/test262/test262.status
+++ b/deps/v8/test/test262/test262.status
@@ -85,40 +85,36 @@
   'language/statements/variable/binding-resolution': [FAIL],
 
   # https://bugs.chromium.org/p/v8/issues/detail?id=4895
-  'built-ins/TypedArrays/ctors/typedarray-arg/typedarray-arg-detached-when-species-retrieved-different-type': [FAIL],
-  'built-ins/TypedArrays/ctors-bigint/typedarray-arg/typedarray-arg-detached-when-species-retrieved-different-type': [FAIL],
-  'built-ins/TypedArrays/ctors/typedarray-arg/typedarray-arg-detached-when-species-retrieved-same-type': [FAIL],
-  'built-ins/TypedArrays/ctors-bigint/typedarray-arg/typedarray-arg-detached-when-species-retrieved-same-type': [FAIL],
-  'built-ins/TypedArrays/internals/DefineOwnProperty/detached-buffer': [FAIL],
-  'built-ins/TypedArrays/internals/DefineOwnProperty/BigInt/detached-buffer': [FAIL],
-  'built-ins/TypedArrays/internals/DefineOwnProperty/detached-buffer-realm': [FAIL],
-  'built-ins/TypedArrays/internals/DefineOwnProperty/BigInt/detached-buffer-realm': [FAIL],
-  'built-ins/TypedArrays/internals/DefineOwnProperty/tonumber-value-detached-buffer': [FAIL],
-  'built-ins/TypedArrays/internals/DefineOwnProperty/BigInt/tonumber-value-detached-buffer': [FAIL],
-  'built-ins/TypedArrays/internals/Get/detached-buffer': [FAIL],
-  'built-ins/TypedArrays/internals/Get/BigInt/detached-buffer': [FAIL],
-  'built-ins/TypedArrays/internals/Get/detached-buffer-realm': [FAIL],
-  'built-ins/TypedArrays/internals/Get/BigInt/detached-buffer-realm': [FAIL],
-  'built-ins/TypedArrays/internals/Get/infinity-detached-buffer': [FAIL],
-  'built-ins/TypedArrays/internals/Get/BigInt/infinity-detached-buffer': [FAIL],
-  'built-ins/TypedArrays/internals/GetOwnProperty/detached-buffer': [FAIL],
-  'built-ins/TypedArrays/internals/GetOwnProperty/BigInt/detached-buffer': [FAIL],
-  'built-ins/TypedArrays/internals/GetOwnProperty/detached-buffer-realm': [FAIL],
-  'built-ins/TypedArrays/internals/GetOwnProperty/BigInt/detached-buffer-realm': [FAIL],
-  'built-ins/TypedArrays/internals/GetOwnProperty/enumerate-detached-buffer': [FAIL],
-  'built-ins/TypedArrays/internals/GetOwnProperty/BigInt/enumerate-detached-buffer': [FAIL],
-  'built-ins/TypedArrays/internals/HasProperty/detached-buffer': [FAIL],
-  'built-ins/TypedArrays/internals/HasProperty/BigInt/detached-buffer': [FAIL],
-  'built-ins/TypedArrays/internals/HasProperty/detached-buffer-realm': [FAIL],
-  'built-ins/TypedArrays/internals/HasProperty/BigInt/detached-buffer-realm': [FAIL],
-  'built-ins/TypedArrays/internals/HasProperty/infinity-with-detached-buffer': [FAIL],
-  'built-ins/TypedArrays/internals/HasProperty/BigInt/infinity-with-detached-buffer': [FAIL],
-  'built-ins/TypedArrays/internals/Set/detached-buffer': [FAIL],
-  'built-ins/TypedArrays/internals/Set/BigInt/detached-buffer': [FAIL],
-  'built-ins/TypedArrays/internals/Set/detached-buffer-realm': [FAIL],
-  'built-ins/TypedArrays/internals/Set/BigInt/detached-buffer-realm': [FAIL],
-  'built-ins/TypedArrays/internals/Set/tonumber-value-detached-buffer': [FAIL],
-  'built-ins/TypedArrays/internals/Set/BigInt/tonumber-value-detached-buffer': [FAIL],
+  'built-ins/TypedArrayConstructors/internals/DefineOwnProperty/detached-buffer': [FAIL],
+  'built-ins/TypedArrayConstructors/internals/DefineOwnProperty/BigInt/detached-buffer': [FAIL],
+  'built-ins/TypedArrayConstructors/internals/DefineOwnProperty/detached-buffer-realm': [FAIL],
+  'built-ins/TypedArrayConstructors/internals/DefineOwnProperty/BigInt/detached-buffer-realm': [FAIL],
+  'built-ins/TypedArrayConstructors/internals/DefineOwnProperty/tonumber-value-detached-buffer': [FAIL],
+  'built-ins/TypedArrayConstructors/internals/DefineOwnProperty/BigInt/tonumber-value-detached-buffer': [FAIL],
+  'built-ins/TypedArrayConstructors/internals/Get/detached-buffer': [FAIL],
+  'built-ins/TypedArrayConstructors/internals/Get/BigInt/detached-buffer': [FAIL],
+  'built-ins/TypedArrayConstructors/internals/Get/detached-buffer-realm': [FAIL],
+  'built-ins/TypedArrayConstructors/internals/Get/BigInt/detached-buffer-realm': [FAIL],
+  'built-ins/TypedArrayConstructors/internals/Get/infinity-detached-buffer': [FAIL],
+  'built-ins/TypedArrayConstructors/internals/Get/BigInt/infinity-detached-buffer': [FAIL],
+  'built-ins/TypedArrayConstructors/internals/GetOwnProperty/detached-buffer': [FAIL],
+  'built-ins/TypedArrayConstructors/internals/GetOwnProperty/BigInt/detached-buffer': [FAIL],
+  'built-ins/TypedArrayConstructors/internals/GetOwnProperty/detached-buffer-realm': [FAIL],
+  'built-ins/TypedArrayConstructors/internals/GetOwnProperty/BigInt/detached-buffer-realm': [FAIL],
+  'built-ins/TypedArrayConstructors/internals/GetOwnProperty/enumerate-detached-buffer': [FAIL],
+  'built-ins/TypedArrayConstructors/internals/GetOwnProperty/BigInt/enumerate-detached-buffer': [FAIL],
+  'built-ins/TypedArrayConstructors/internals/HasProperty/detached-buffer': [FAIL],
+  'built-ins/TypedArrayConstructors/internals/HasProperty/BigInt/detached-buffer': [FAIL],
+  'built-ins/TypedArrayConstructors/internals/HasProperty/detached-buffer-realm': [FAIL],
+  'built-ins/TypedArrayConstructors/internals/HasProperty/BigInt/detached-buffer-realm': [FAIL],
+  'built-ins/TypedArrayConstructors/internals/HasProperty/infinity-with-detached-buffer': [FAIL],
+  'built-ins/TypedArrayConstructors/internals/HasProperty/BigInt/infinity-with-detached-buffer': [FAIL],
+  'built-ins/TypedArrayConstructors/internals/Set/detached-buffer': [FAIL],
+  'built-ins/TypedArrayConstructors/internals/Set/BigInt/detached-buffer': [FAIL],
+  'built-ins/TypedArrayConstructors/internals/Set/detached-buffer-realm': [FAIL],
+  'built-ins/TypedArrayConstructors/internals/Set/BigInt/detached-buffer-realm': [FAIL],
+  'built-ins/TypedArrayConstructors/internals/Set/tonumber-value-detached-buffer': [FAIL],
+  'built-ins/TypedArrayConstructors/internals/Set/BigInt/tonumber-value-detached-buffer': [FAIL],
   # Some TypedArray methods throw due to the same bug, from Get
   'built-ins/TypedArray/prototype/every/callbackfn-detachbuffer': [FAIL],
   'built-ins/TypedArray/prototype/every/BigInt/callbackfn-detachbuffer': [FAIL],
@@ -136,8 +132,6 @@
   'built-ins/TypedArray/prototype/reduceRight/BigInt/callbackfn-detachbuffer': [FAIL],
   'built-ins/TypedArray/prototype/some/callbackfn-detachbuffer': [FAIL],
   'built-ins/TypedArray/prototype/some/BigInt/callbackfn-detachbuffer': [FAIL],
-  'built-ins/TypedArray/prototype/sort/detached-buffer-comparefn': [FAIL],
-  'built-ins/TypedArray/prototype/sort/BigInt/detached-buffer-comparefn': [FAIL],
   # DataView functions should also throw on detached buffers
   'built-ins/ArrayBuffer/prototype/byteLength/detached-buffer': [FAIL],
   'built-ins/DataView/detached-buffer': [FAIL],
@@ -197,6 +191,10 @@
   'language/literals/regexp/invalid-braced-quantifier-exact': [FAIL],
   'language/literals/regexp/invalid-braced-quantifier-lower': [FAIL],
   'language/literals/regexp/invalid-braced-quantifier-range': [FAIL],
+  'language/literals/regexp/invalid-optional-lookbehind': [FAIL],
+  'language/literals/regexp/invalid-optional-negative-lookbehind': [FAIL],
+  'language/literals/regexp/invalid-range-lookbehind': [FAIL],
+  'language/literals/regexp/invalid-range-negative-lookbehind': [FAIL],
   'language/literals/regexp/u-dec-esc': [FAIL],
   'language/literals/regexp/u-invalid-class-escape': [FAIL],
   'language/literals/regexp/u-invalid-extended-pattern-char': [FAIL],
@@ -207,11 +205,24 @@
   'language/literals/regexp/u-invalid-non-empty-class-ranges-no-dash-ab': [FAIL],
   'language/literals/regexp/u-invalid-non-empty-class-ranges-no-dash-b': [FAIL],
   'language/literals/regexp/u-invalid-oob-decimal-escape': [FAIL],
-  'language/literals/regexp/u-invalid-quantifiable-assertion': [FAIL],
+  'language/literals/regexp/u-invalid-optional-lookahead': [FAIL],
+  'language/literals/regexp/u-invalid-optional-lookbehind': [FAIL],
+  'language/literals/regexp/u-invalid-optional-negative-lookahead': [FAIL],
+  'language/literals/regexp/u-invalid-optional-negative-lookbehind': [FAIL],
+  'language/literals/regexp/u-invalid-range-lookahead': [FAIL],
+  'language/literals/regexp/u-invalid-range-lookbehind': [FAIL],
+  'language/literals/regexp/u-invalid-range-negative-lookahead': [FAIL],
+  'language/literals/regexp/u-invalid-range-negative-lookbehind': [FAIL],
   'language/literals/regexp/u-unicode-esc-bounds': [FAIL],
   'language/literals/regexp/u-unicode-esc-non-hex': [FAIL],
   'language/literals/regexp/unicode-escape-nls-err': [FAIL],
 
+  # https://bugs.chromium.org/p/v8/issues/detail?id=7828
+  'language/statements/try/early-catch-function': [FAIL],
+
+  # https://bugs.chromium.org/p/v8/issues/detail?id=7829
+  'language/block-scope/syntax/redeclaration/function-declaration-attempt-to-redeclare-with-var-declaration-nested-in-function': [FAIL],
+
   # https://bugs.chromium.org/p/v8/issues/detail?id=4628
   'language/eval-code/direct/non-definable-function-with-function': [FAIL],
   'language/eval-code/direct/non-definable-function-with-variable': [FAIL],
@@ -224,29 +235,7 @@
   'built-ins/Function/prototype/toString/*': ['--harmony-function-tostring'],
 
   # https://bugs.chromium.org/p/v8/issues/detail?id=5116
-  'built-ins/Object/internals/DefineOwnProperty/nan-equivalence': [PASS, FAIL],
   'built-ins/TypedArray/prototype/fill/fill-values-conversion-operations-consistent-nan': [PASS, FAIL],
-  'built-ins/TypedArrays/internals/DefineOwnProperty/conversion-operation-consistent-nan': [PASS, FAIL],
-  'built-ins/TypedArrays/internals/Set/conversion-operation-consistent-nan': [PASS, FAIL],
-
-  # https://bugs.chromium.org/p/v8/issues/detail?id=4451
-  # https://github.com/tc39/ecma262/issues/753
-  'annexB/language/eval-code/direct/global-block-decl-eval-global-existing-global-init': [FAIL],
-  'annexB/language/eval-code/direct/global-if-decl-else-decl-a-eval-global-existing-global-init': [FAIL],
-  'annexB/language/eval-code/direct/global-if-decl-else-decl-b-eval-global-existing-global-init': [FAIL],
-  'annexB/language/eval-code/direct/global-if-decl-else-stmt-eval-global-existing-global-init': [FAIL],
-  'annexB/language/eval-code/direct/global-if-decl-no-else-eval-global-existing-global-init': [FAIL],
-  'annexB/language/eval-code/direct/global-if-stmt-else-decl-eval-global-existing-global-init': [FAIL],
-  'annexB/language/eval-code/direct/global-switch-case-eval-global-existing-global-init': [FAIL],
-  'annexB/language/eval-code/direct/global-switch-dflt-eval-global-existing-global-init': [FAIL],
-  'annexB/language/eval-code/indirect/global-block-decl-eval-global-existing-global-init': [FAIL],
-  'annexB/language/eval-code/indirect/global-if-decl-else-decl-a-eval-global-existing-global-init': [FAIL],
-  'annexB/language/eval-code/indirect/global-if-decl-else-decl-b-eval-global-existing-global-init': [FAIL],
-  'annexB/language/eval-code/indirect/global-if-decl-else-stmt-eval-global-existing-global-init': [FAIL],
-  'annexB/language/eval-code/indirect/global-if-decl-no-else-eval-global-existing-global-init': [FAIL],
-  'annexB/language/eval-code/indirect/global-if-stmt-else-decl-eval-global-existing-global-init': [FAIL],
-  'annexB/language/eval-code/indirect/global-switch-case-eval-global-existing-global-init': [FAIL],
-  'annexB/language/eval-code/indirect/global-switch-dflt-eval-global-existing-global-init': [FAIL],
 
   # https://bugs.chromium.org/p/v8/issues/detail?id=5135
   'annexB/language/eval-code/direct/func-block-decl-eval-func-block-scoping': [FAIL],
@@ -303,18 +292,13 @@
   'language/expressions/arrow-function/dflt-params-duplicates': [FAIL],
   'language/expressions/async-arrow-function/dflt-params-duplicates': [FAIL],
 
-  # https://bugs.chromium.org/p/v8/issues/detail?id=5244
-  'intl402/NumberFormat/prototype/formatToParts/*': ['--harmony-number-format-to-parts'],
-
   # https://bugs.chromium.org/p/v8/issues/detail?id=5327
-  'built-ins/TypedArrays/internals/Set/key-is-minus-zero': [FAIL],
-  'built-ins/TypedArrays/internals/Set/BigInt/key-is-minus-zero': [FAIL],
-  'built-ins/TypedArrays/internals/Set/key-is-not-integer': [FAIL],
-  'built-ins/TypedArrays/internals/Set/BigInt/key-is-not-integer': [FAIL],
-  'built-ins/TypedArrays/internals/Set/key-is-out-of-bounds': [FAIL],
-  'built-ins/TypedArrays/internals/Set/BigInt/key-is-out-of-bounds': [FAIL],
-  'built-ins/TypedArrays/internals/Set/tonumber-value-throws': [FAIL],
-  'built-ins/TypedArrays/internals/Set/BigInt/tonumber-value-throws': [FAIL],
+  'built-ins/TypedArrayConstructors/internals/Set/key-is-minus-zero': [FAIL],
+  'built-ins/TypedArrayConstructors/internals/Set/BigInt/key-is-minus-zero': [FAIL],
+  'built-ins/TypedArrayConstructors/internals/Set/key-is-not-integer': [FAIL],
+  'built-ins/TypedArrayConstructors/internals/Set/BigInt/key-is-not-integer': [FAIL],
+  'built-ins/TypedArrayConstructors/internals/Set/key-is-out-of-bounds': [FAIL],
+  'built-ins/TypedArrayConstructors/internals/Set/BigInt/key-is-out-of-bounds': [FAIL],
 
   # https://bugs.chromium.org/p/v8/issues/detail?id=5329
   'built-ins/RegExp/prototype/source/value-line-terminator': [FAIL],
@@ -340,9 +324,6 @@
   'language/expressions/object/method-definition/name-param-redecl': [FAIL],
   'language/statements/async-function/early-errors-declaration-formals-body-duplicate': [FAIL],
 
-  # https://bugs.chromium.org/p/v8/issues/detail?id=5601
-  'intl402/PluralRules/*': ['--harmony-plural-rules'],
-
   # SharedArrayBuffer tests that require flags
   'built-ins/SharedArrayBuffer/*': ['--harmony-sharedarraybuffer'],
   'built-ins/Atomics/*': ['--harmony-sharedarraybuffer'],
@@ -389,7 +370,6 @@
   'built-ins/TypedArray/prototype/set/typedarray-arg-set-values-diff-buffer-other-type-sab': ['--harmony-sharedarraybuffer'],
   'built-ins/TypedArray/prototype/set/typedarray-arg-set-values-diff-buffer-same-type-sab': ['--harmony-sharedarraybuffer'],
   'built-ins/TypedArray/prototype/set/typedarray-arg-set-values-same-buffer-same-type-sab': ['--harmony-sharedarraybuffer'],
-  'built-ins/TypedArrays/internals/Get/indexed-value-sab': ['--harmony-sharedarraybuffer'],
 
   # 64-bit Atomics are not implemented yet.
   'built-ins/Atomics/wake/bad-range': ['--noharmony-bigint'],
@@ -408,14 +388,130 @@
   'built-ins/Object/internals/DefineOwnProperty/consistent-value-function-caller': [FAIL_SLOPPY],
   'built-ins/Object/internals/DefineOwnProperty/consistent-value-function-arguments': [FAIL_SLOPPY],
 
+  # ICU < 62 doesn't support Unicode v11.
+  # TODO(mathias): Re-enable these after we've updated to ICU 62.
+  # https://bugs.chromium.org/p/v8/issues/detail?id=7825
+  'built-ins/RegExp/property-escapes/generated/Alphabetic': [SKIP],
+  'built-ins/RegExp/property-escapes/generated/Assigned': [SKIP],
+  'built-ins/RegExp/property-escapes/generated/Bidi_Mirrored': [SKIP],
+  'built-ins/RegExp/property-escapes/generated/Cased': [SKIP],
+  'built-ins/RegExp/property-escapes/generated/Case_Ignorable': [SKIP],
+  'built-ins/RegExp/property-escapes/generated/Changes_When_Casefolded': [SKIP],
+  'built-ins/RegExp/property-escapes/generated/Changes_When_Casemapped': [SKIP],
+  'built-ins/RegExp/property-escapes/generated/Changes_When_Lowercased': [SKIP],
+  'built-ins/RegExp/property-escapes/generated/Changes_When_NFKC_Casefolded': [SKIP],
+  'built-ins/RegExp/property-escapes/generated/Changes_When_Titlecased': [SKIP],
+  'built-ins/RegExp/property-escapes/generated/Changes_When_Uppercased': [SKIP],
+  'built-ins/RegExp/property-escapes/generated/Diacritic': [SKIP],
+  'built-ins/RegExp/property-escapes/generated/Emoji': [SKIP],
+  'built-ins/RegExp/property-escapes/generated/Emoji_Component': [SKIP],
+  'built-ins/RegExp/property-escapes/generated/Emoji_Modifier_Base': [SKIP],
+  'built-ins/RegExp/property-escapes/generated/Emoji_Presentation': [SKIP],
+  'built-ins/RegExp/property-escapes/generated/Extended_Pictographic': [SKIP],
+  'built-ins/RegExp/property-escapes/generated/General_Category_-_Cased_Letter': [SKIP],
+  'built-ins/RegExp/property-escapes/generated/General_Category_-_Currency_Symbol': [SKIP],
+  'built-ins/RegExp/property-escapes/generated/General_Category_-_Decimal_Number': [SKIP],
+  'built-ins/RegExp/property-escapes/generated/General_Category_-_Format': [SKIP],
+  'built-ins/RegExp/property-escapes/generated/General_Category_-_Letter': [SKIP],
+  'built-ins/RegExp/property-escapes/generated/General_Category_-_Lowercase_Letter': [SKIP],
+  'built-ins/RegExp/property-escapes/generated/General_Category_-_Mark': [SKIP],
+  'built-ins/RegExp/property-escapes/generated/General_Category_-_Nonspacing_Mark': [SKIP],
+  'built-ins/RegExp/property-escapes/generated/General_Category_-_Number': [SKIP],
+  'built-ins/RegExp/property-escapes/generated/General_Category_-_Other': [SKIP],
+  'built-ins/RegExp/property-escapes/generated/General_Category_-_Other_Letter': [SKIP],
+  'built-ins/RegExp/property-escapes/generated/General_Category_-_Other_Number': [SKIP],
+  'built-ins/RegExp/property-escapes/generated/General_Category_-_Other_Punctuation': [SKIP],
+  'built-ins/RegExp/property-escapes/generated/General_Category_-_Other_Symbol': [SKIP],
+  'built-ins/RegExp/property-escapes/generated/General_Category_-_Punctuation': [SKIP],
+  'built-ins/RegExp/property-escapes/generated/General_Category_-_Spacing_Mark': [SKIP],
+  'built-ins/RegExp/property-escapes/generated/General_Category_-_Symbol': [SKIP],
+  'built-ins/RegExp/property-escapes/generated/General_Category_-_Unassigned': [SKIP],
+  'built-ins/RegExp/property-escapes/generated/General_Category_-_Uppercase_Letter': [SKIP],
+  'built-ins/RegExp/property-escapes/generated/Grapheme_Base': [SKIP],
+  'built-ins/RegExp/property-escapes/generated/Grapheme_Extend': [SKIP],
+  'built-ins/RegExp/property-escapes/generated/ID_Continue': [SKIP],
+  'built-ins/RegExp/property-escapes/generated/Ideographic': [SKIP],
+  'built-ins/RegExp/property-escapes/generated/ID_Start': [SKIP],
+  'built-ins/RegExp/property-escapes/generated/Lowercase': [SKIP],
+  'built-ins/RegExp/property-escapes/generated/Script_-_Ahom': [SKIP],
+  'built-ins/RegExp/property-escapes/generated/Script_-_Arabic': [SKIP],
+  'built-ins/RegExp/property-escapes/generated/Script_-_Armenian': [SKIP],
+  'built-ins/RegExp/property-escapes/generated/Script_-_Bengali': [SKIP],
+  'built-ins/RegExp/property-escapes/generated/Script_-_Bopomofo': [SKIP],
+  'built-ins/RegExp/property-escapes/generated/Script_-_Chakma': [SKIP],
+  'built-ins/RegExp/property-escapes/generated/Script_-_Common': [SKIP],
+  'built-ins/RegExp/property-escapes/generated/Script_-_Devanagari': [SKIP],
+  'built-ins/RegExp/property-escapes/generated/Script_-_Dogra': [SKIP],
+  'built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Ahom': [SKIP],
+  'built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Arabic': [SKIP],
+  'built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Armenian': [SKIP],
+  'built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Bengali': [SKIP],
+  'built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Bopomofo': [SKIP],
+  'built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Chakma': [SKIP],
+  'built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Common': [SKIP],
+  'built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Devanagari': [SKIP],
+  'built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Dogra': [SKIP],
+  'built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Georgian': [SKIP],
+  'built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Grantha': [SKIP],
+  'built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Gunjala_Gondi': [SKIP],
+  'built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Gurmukhi': [SKIP],
+  'built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Han': [SKIP],
+  'built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Hanifi_Rohingya': [SKIP],
+  'built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Hebrew': [SKIP],
+  'built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Kaithi': [SKIP],
+  'built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Kannada': [SKIP],
+  'built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Kharoshthi': [SKIP],
+  'built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Khojki': [SKIP],
+  'built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Latin': [SKIP],
+  'built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Makasar': [SKIP],
+  'built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Malayalam': [SKIP],
+  'built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Medefaidrin': [SKIP],
+  'built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Mongolian': [SKIP],
+  'built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Newa': [SKIP],
+  'built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Nko': [SKIP],
+  'built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Old_Sogdian': [SKIP],
+  'built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Oriya': [SKIP],
+  'built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Sogdian': [SKIP],
+  'built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Soyombo': [SKIP],
+  'built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Tamil': [SKIP],
+  'built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Tangut': [SKIP],
+  'built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Telugu': [SKIP],
+  'built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Tirhuta': [SKIP],
+  'built-ins/RegExp/property-escapes/generated/Script_-_Georgian': [SKIP],
+  'built-ins/RegExp/property-escapes/generated/Script_-_Gunjala_Gondi': [SKIP],
+  'built-ins/RegExp/property-escapes/generated/Script_-_Gurmukhi': [SKIP],
+  'built-ins/RegExp/property-escapes/generated/Script_-_Han': [SKIP],
+  'built-ins/RegExp/property-escapes/generated/Script_-_Hanifi_Rohingya': [SKIP],
+  'built-ins/RegExp/property-escapes/generated/Script_-_Hebrew': [SKIP],
+  'built-ins/RegExp/property-escapes/generated/Script_-_Inherited': [SKIP],
+  'built-ins/RegExp/property-escapes/generated/Script_-_Kaithi': [SKIP],
+  'built-ins/RegExp/property-escapes/generated/Script_-_Kannada': [SKIP],
+  'built-ins/RegExp/property-escapes/generated/Script_-_Kharoshthi': [SKIP],
+  'built-ins/RegExp/property-escapes/generated/Script_-_Latin': [SKIP],
+  'built-ins/RegExp/property-escapes/generated/Script_-_Makasar': [SKIP],
+  'built-ins/RegExp/property-escapes/generated/Script_-_Medefaidrin': [SKIP],
+  'built-ins/RegExp/property-escapes/generated/Script_-_Mongolian': [SKIP],
+  'built-ins/RegExp/property-escapes/generated/Script_-_Newa': [SKIP],
+  'built-ins/RegExp/property-escapes/generated/Script_-_Nko': [SKIP],
+  'built-ins/RegExp/property-escapes/generated/Script_-_Old_Sogdian': [SKIP],
+  'built-ins/RegExp/property-escapes/generated/Script_-_Sogdian': [SKIP],
+  'built-ins/RegExp/property-escapes/generated/Script_-_Soyombo': [SKIP],
+  'built-ins/RegExp/property-escapes/generated/Script_-_Tangut': [SKIP],
+  'built-ins/RegExp/property-escapes/generated/Script_-_Telugu': [SKIP],
+  'built-ins/RegExp/property-escapes/generated/Sentence_Terminal': [SKIP],
+  'built-ins/RegExp/property-escapes/generated/Terminal_Punctuation': [SKIP],
+  'built-ins/RegExp/property-escapes/generated/Unified_Ideograph': [SKIP],
+  'built-ins/RegExp/property-escapes/generated/Uppercase': [SKIP],
+  'built-ins/RegExp/property-escapes/generated/XID_Continue': [SKIP],
+  'built-ins/RegExp/property-escapes/generated/XID_Start': [SKIP],
+
+  # https://bugs.chromium.org/p/v8/issues/detail?id=7874
+  'built-ins/Reflect/ownKeys/return-on-corresponding-order-large-index': [FAIL],
+
   # https://bugs.chromium.org/p/v8/issues/detail?id=6776
   'built-ins/Proxy/ownKeys/return-duplicate-entries-throws': [FAIL],
   'built-ins/Proxy/ownKeys/return-duplicate-symbol-entries-throws': [FAIL],
 
-  # https://github.com/tc39/test262/issues/1467
-  'built-ins/BigInt/prototype/Symbol.toStringTag': [FAIL],
-  'built-ins/TypedArrays/ctors-bigint/typedarray-arg/typedarray-arg-other-ctor-returns-new-typedarray': [FAIL],
-
   # https://bugs.chromium.org/p/v8/issues/detail?id=7184
   'annexB/language/expressions/yield/star-iterable-return-emulates-undefined-throws-when-called': [FAIL],
   'annexB/language/statements/for-await-of/iterator-close-return-emulates-undefined-throws-when-called': [FAIL],
@@ -433,25 +529,13 @@
   'language/expressions/call/eval-spread-empty-leading': [FAIL],
   'language/expressions/call/eval-spread-empty-trailing': [FAIL],
 
-  # https://bugs.chromium.org/p/v8/issues/detail?id=7471
-  'intl402/DateTimeFormat/prototype/format/time-clip-near-time-boundaries': [FAIL],
-  'intl402/DateTimeFormat/prototype/format/time-clip-to-integer': [FAIL],
-  'intl402/DateTimeFormat/prototype/formatToParts/time-clip-near-time-boundaries': [FAIL],
-  'intl402/DateTimeFormat/prototype/formatToParts/time-clip-to-integer': [FAIL],
-
   # https://bugs.chromium.org/p/v8/issues/detail?id=7472
   'intl402/NumberFormat/currency-digits': [FAIL],
 
-  # https://bugs.chromium.org/p/v8/issues/detail?id=7473
-  'intl402/language-tags-canonicalized': [FAIL],
-
   # https://bugs.chromium.org/p/v8/issues/detail?id=7474
   'intl402/NumberFormat/prototype/format/format-fraction-digits': [FAIL],
   'intl402/NumberFormat/prototype/format/format-significant-digits': [FAIL],
 
-  # https://bugs.chromium.org/p/v8/issues/detail?id=7475
-  'built-ins/Date/UTC/non-integer-values': [FAIL],
-
   # https://bugs.chromium.org/p/v8/issues/detail?id=7480
   'intl402/Collator/unicode-ext-seq-in-private-tag': [FAIL],
   'intl402/Collator/unicode-ext-seq-with-attribute': [FAIL],
@@ -466,22 +550,91 @@
   # https://bugs.chromium.org/p/v8/issues/detail?id=7483
   'annexB/built-ins/Function/createdynfn-html-close-comment-params': [FAIL],
 
-  # https://bugs.chromium.org/p/v8/issues/detail?id=5012
+  # https://bugs.chromium.org/p/v8/issues/detail?id=7669
   'intl402/Intl/getCanonicalLocales/canonicalized-tags': [FAIL],
   'intl402/Intl/getCanonicalLocales/preferred-grandfathered': [FAIL],
-  'intl402/Intl/getCanonicalLocales/preferred-variant': [FAIL],
-
-  # https://bugs.chromium.org/p/v8/issues/detail?id=7513
-  'built-ins/TypedArrays/ctors/buffer-arg/buffer-arg-bufferbyteoffset-throws-from-modulo-element-size': [FAIL],
-  'built-ins/TypedArrays/ctors/buffer-arg/buffer-arg-byteoffset-throws-from-modulo-element-size': [FAIL],
 
-  # https://bugs.chromium.org/p/v8/issues/detail?id=7512
-  'built-ins/TypedArrays/ctors/typedarray-arg/typedarray-arg-other-ctor-buffer-ctor-custom-species-proto-from-ctor-realm': [FAIL],
-  'built-ins/TypedArrays/ctors/typedarray-arg/typedarray-arg-same-ctor-buffer-ctor-species-custom-proto-from-ctor-realm': [FAIL],
-  'built-ins/TypedArrays/ctors-bigint/typedarray-arg/typedarray-arg-other-ctor-buffer-ctor-custom-species-proto-from-ctor-realm': [FAIL],
-  'built-ins/TypedArrays/ctors-bigint/typedarray-arg/typedarray-arg-same-ctor-buffer-ctor-species-custom-proto-from-ctor-realm': [FAIL],
-
-######################## NEEDS INVESTIGATION ###########################
+  # Tests assume that the sort order of "same elements" (comparator returns 0)
+  # is deterministic.
+  # https://crbug.com/v8/7808
+  'intl402/String/prototype/localeCompare/returns-same-results-as-Collator': [SKIP],
+  'intl402/Collator/prototype/compare/bound-to-collator-instance': [SKIP],
+  'intl402/Collator/ignore-invalid-unicode-ext-values': [SKIP],
+
+  # https://bugs.chromium.org/p/v8/issues/detail?id=7684
+  'intl402/Locale/constructor-getter-order': [FAIL],
+  'intl402/Locale/constructor-locale-object': [FAIL],
+  'intl402/Locale/constructor-non-iana-canon': [FAIL],
+  'intl402/Locale/constructor-options-casefirst-invalid': [FAIL],
+  'intl402/Locale/constructor-options-hourcycle-invalid': [FAIL],
+  'intl402/Locale/constructor-options-language-grandfathered': [FAIL],
+  'intl402/Locale/constructor-options-language-invalid': [FAIL],
+  'intl402/Locale/constructor-options-language-valid': [FAIL],
+  'intl402/Locale/constructor-options-numeric-valid': [FAIL],
+  'intl402/Locale/constructor-options-region-invalid': [FAIL],
+  'intl402/Locale/constructor-options-region-valid': [FAIL],
+  'intl402/Locale/constructor-options-script-invalid': [FAIL],
+  'intl402/Locale/constructor-options-script-valid': [FAIL],
+  'intl402/Locale/constructor-parse-twice': [FAIL],
+  'intl402/Locale/constructor-tag': [FAIL],
+  'intl402/Locale/constructor-unicode-ext-invalid': [FAIL],
+  'intl402/Locale/constructor-unicode-ext-valid': [FAIL],
+  'intl402/Locale/extensions-grandfathered': [FAIL],
+  'intl402/Locale/extensions-private': [FAIL],
+  'intl402/Locale/getters': [FAIL],
+  'intl402/Locale/getters-grandfathered': [FAIL],
+  'intl402/Locale/getters-privateuse': [FAIL],
+  'intl402/Locale/invalid-tag-throws': [FAIL],
+  'intl402/Locale/likely-subtags': [FAIL],
+  'intl402/Locale/likely-subtags-grandfathered': [FAIL],
+  'intl402/Locale/prototype/maximize/length': [FAIL],
+  'intl402/Locale/prototype/maximize/name': [FAIL],
+  'intl402/Locale/prototype/maximize/prop-desc': [FAIL],
+  'intl402/Locale/prototype/minimize/length': [FAIL],
+  'intl402/Locale/prototype/minimize/name': [FAIL],
+  'intl402/Locale/prototype/minimize/prop-desc': [FAIL],
+  'intl402/Locale/prototype/toStringTag/toStringTag': [FAIL],
+  'intl402/Locale/prototype/toStringTag/toString': [FAIL],
+
+  # https://bugs.chromium.org/p/v8/issues/detail?id=7869
+  'intl402/RelativeTimeFormat/constructor/constructor/options-order': [FAIL],
+  'intl402/RelativeTimeFormat/constructor/supportedLocalesOf/branding': [FAIL],
+  'intl402/RelativeTimeFormat/constructor/supportedLocalesOf/length': [FAIL],
+  'intl402/RelativeTimeFormat/constructor/supportedLocalesOf/name': [FAIL],
+  'intl402/RelativeTimeFormat/constructor/supportedLocalesOf/prop-desc': [FAIL],
+  'intl402/RelativeTimeFormat/prototype/format/length': [FAIL],
+  'intl402/RelativeTimeFormat/prototype/format/name': [FAIL],
+  'intl402/RelativeTimeFormat/prototype/format/prop-desc': [FAIL],
+  'intl402/RelativeTimeFormat/prototype/formatToParts/length': [FAIL],
+  'intl402/RelativeTimeFormat/prototype/formatToParts/name': [FAIL],
+  'intl402/RelativeTimeFormat/prototype/formatToParts/prop-desc': [FAIL],
+
+  # https://bugs.chromium.org/p/v8/issues/detail?id=7813
+  'built-ins/Array/prototype/lastIndexOf/calls-only-has-on-prototype-after-length-zeroed': [FAIL],
+
+  # https://bugs.chromium.org/p/v8/issues/detail?id=7814
+  'built-ins/Array/prototype/splice/property-traps-order-with-species': [FAIL],
+
+  # https://bugs.chromium.org/p/v8/issues/detail?id=6705
+  'built-ins/Object/assign/strings-and-symbol-order': [FAIL],
+
+  # https://bugs.chromium.org/p/v8/issues/detail?id=7781
+  'built-ins/Date/parse/time-value-maximum-range': [FAIL],
+
+  # https://bugs.chromium.org/p/v8/issues/detail?id=7830
+  'intl402/PluralRules/prototype/resolvedOptions/pluralCategories': [FAIL],
+
+  # https://bugs.chromium.org/p/v8/issues/detail?id=7831
+  'language/statements/generators/generator-created-after-decl-inst': [FAIL],
+  'language/expressions/generators/generator-created-after-decl-inst': [FAIL],
+  'language/expressions/async-generator/generator-created-after-decl-inst': [FAIL],
+  'language/statements/async-generator/generator-created-after-decl-inst': [FAIL],
+
+  # https://bugs.chromium.org/p/v8/issues/detail?id=7832
+  'intl402/Array/prototype/toLocaleString/calls-toLocaleString-number-elements': [FAIL],
+  'intl402/TypedArray/prototype/toLocaleString/calls-toLocaleString-number-elements': [FAIL],
+
+  ######################## NEEDS INVESTIGATION ###########################
 
   # These test failures are specific to the intl402 suite and need investigation
   # to be either marked as bugs with issues filed for them or as deliberate
@@ -489,20 +642,20 @@
   # Some of these are related to v8:4361 in being visible side effects from Intl.
   'intl402/DateTimeFormat/prototype/resolvedOptions/hourCycle': [FAIL],
 
-  ##################### DELIBERATE INCOMPATIBILITIES #####################
+  # https://bugs.chromium.org/p/v8/issues/detail?id=7833
+  'built-ins/Atomics/wait/cannot-suspend-throws': [SKIP],
+  'built-ins/Atomics/wait/undefined-index-defaults-to-zero': [SKIP],
+  'built-ins/Atomics/wait/waiterlist-order-of-operations-is-fifo': [SKIP],
+  'built-ins/Atomics/wake/count-defaults-to-infinity-missing': [SKIP],
+  'built-ins/Atomics/wake/count-defaults-to-infinity-undefined': [SKIP],
+  'built-ins/Atomics/wake/undefined-index-defaults-to-zero': [SKIP],
 
-  # We do not expose Array.prototype.values due to webcompat issues.
-  # Most recent incompatibility: https://crbug.com/615873
-  # https://code.google.com/p/v8/issues/detail?id=4247
-  'built-ins/Array/prototype/Symbol.iterator': [FAIL],
-  'built-ins/Array/prototype/values/returns-iterator': [FAIL],
-  'built-ins/Array/prototype/values/returns-iterator-from-object': [FAIL],
-  'built-ins/Array/prototype/values/prop-desc': [FAIL],
-  'built-ins/Array/prototype/values/name': [FAIL],
-  'built-ins/Array/prototype/values/length': [FAIL],
-  'built-ins/Array/prototype/values/iteration': [FAIL],
-  'built-ins/Array/prototype/values/iteration-mutable': [FAIL],
-  'built-ins/Array/prototype/Symbol.unscopables/value': [FAIL],
+  # Flaky failure
+  # https://bugs.chromium.org/p/v8/issues/detail?id=7876
+  'built-ins/Atomics/wait/waiterlist-block-indexedposition-wake': [SKIP],
+  'built-ins/Atomics/wake/wake-in-order': [SKIP],
+
+  ##################### DELIBERATE INCOMPATIBILITIES #####################
 
   # https://github.com/tc39/ecma262/pull/889
   'annexB/language/function-code/block-decl-func-skip-arguments': [FAIL],
@@ -527,6 +680,9 @@
   # https://bugs.chromium.org/p/v8/issues/detail?id=6543
   'language/statements/labeled/value-await-non-module-escaped': [FAIL],
   'language/statements/labeled/value-yield-non-strict-escaped': [FAIL],
+  'language/expressions/async-arrow-function/escaped-async-line-terminator': [FAIL],
+  'language/expressions/class/class-name-ident-await-escaped': [FAIL],
+  'language/statements/class/class-name-ident-await-escaped': [FAIL],
 
   ############################ INVALID TESTS #############################
 
@@ -534,10 +690,6 @@
   # Test262 Bug: https://bugs.ecmascript.org/show_bug.cgi?id=596
   'built-ins/Array/prototype/sort/bug_596_1': [PASS, FAIL_OK],
 
-  # https://bugs.chromium.org/p/v8/issues/detail?id=7418
-  'language/line-terminators/S7.3_A2.3': [FAIL],
-  'language/line-terminators/S7.3_A2.4': [FAIL],
-
   # https://github.com/tc39/test262/pull/688#pullrequestreview-14025354
   'built-ins/Function/internals/Construct/derived-this-uninitialized-realm': [FAIL],
 
@@ -550,11 +702,6 @@
   'harness/detachArrayBuffer': [SKIP],
   'harness/detachArrayBuffer-host-detachArrayBuffer': [SKIP],
 
-  # https://github.com/tc39/test262/pull/1371
-  'language/expressions/bitwise-and/bigint-non-primitive': ['--harmony-bigint'],
-  'language/expressions/bitwise-or/bigint-non-primitive': ['--harmony-bigint'],
-  'language/expressions/bitwise-xor/bigint-non-primitive': ['--harmony-bigint'],
-
   ############################ SKIPPED TESTS #############################
 
   # These tests take a looong time to run.
@@ -575,12 +722,18 @@
   'built-ins/Array/prototype/slice/S15.4.4.10_A3_T1': [SKIP],
   'built-ins/Array/prototype/slice/S15.4.4.10_A3_T2': [SKIP],
 
+  # https://bugs.chromium.org/p/v8/issues/detail?id=7187
+  'built-ins/Function/prototype/toString/line-terminator-normalisation-CR': [SKIP],
+
   ############################ SLOW TESTS #############################
 
   'annexB/built-ins/RegExp/RegExp-leading-escape-BMP': [PASS, SLOW],
   'annexB/built-ins/RegExp/RegExp-trailing-escape-BMP': [PASS, SLOW],
   'language/comments/S7.4_A5': [PASS, SLOW],
   'language/comments/S7.4_A6': [PASS, SLOW],
+
+  # https://crbug.com/v8/7841
+  'built-ins/Atomics/wake/wake-rewake-noop': [SKIP],
 }],  # ALWAYS
 
 ['no_i18n == True', {
@@ -656,13 +809,18 @@
   'built-ins/SharedArrayBuffer/length-is-too-large-throws': [SKIP],
 }],  # asan == True or msan == True or tsan == True
 
-['variant == wasm_traps', {
+['variant == no_wasm_traps', {
   '*': [SKIP],
-}],  # variant == wasm_traps
+}],  # variant == no_wasm_traps
 
 ['variant != default or arch == arm or arch == arm64 or arch == mipsel or arch == mips or arch == mips64 or arch == mips64el', {
   # These tests take a long time to run
   'built-ins/RegExp/property-escapes/generated/*': [SKIP],
 }],  # variant != default or arch == arm or arch == arm64
 
+['system == windows', {
+  # https://crbug.com/856119
+  'intl402/DateTimeFormat/prototype/resolvedOptions/basic': [SKIP],
+}],  # system == windows
+
 ]
diff --git a/deps/v8/test/test262/testcfg.py b/deps/v8/test/test262/testcfg.py
index edea2e8d95c303..e944b3ebecbd56 100644
--- a/deps/v8/test/test262/testcfg.py
+++ b/deps/v8/test/test262/testcfg.py
@@ -43,17 +43,16 @@
 # TODO(littledan): move the flag mapping into the status file
 FEATURE_FLAGS = {
   'BigInt': '--harmony-bigint',
-  'regexp-named-groups': '--harmony-regexp-named-captures',
-  'regexp-unicode-property-escapes': '--harmony-regexp-property',
-  'Promise.prototype.finally': '--harmony-promise-finally',
   'class-fields-public': '--harmony-public-fields',
-  'optional-catch-binding': '--harmony-optional-catch-binding',
   'class-fields-private': '--harmony-private-fields',
-  'Array.prototype.flatten': '--harmony-array-flatten',
-  'Array.prototype.flatMap': '--harmony-array-flatten',
+  'Array.prototype.flat': '--harmony-array-flat',
+  'Array.prototype.flatMap': '--harmony-array-flat',
   'String.prototype.matchAll': '--harmony-string-matchall',
   'Symbol.matchAll': '--harmony-string-matchall',
   'numeric-separator-literal': '--harmony-numeric-separator',
+  'Intl.Locale': '--harmony-locale',
+  'Intl.RelativeTimeFormat': '--harmony-intl-relative-time-format',
+  'Symbol.prototype.description': '--harmony-symbol-description',
 }
 
 SKIPPED_FEATURES = set([])
diff --git a/deps/v8/test/torque/test-torque.tq b/deps/v8/test/torque/test-torque.tq
new file mode 100644
index 00000000000000..b4512f90421e8e
--- /dev/null
+++ b/deps/v8/test/torque/test-torque.tq
@@ -0,0 +1,231 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+module test {
+  macro ElementsKindTestHelper1(kind: constexpr ElementsKind): bool {
+    if constexpr ((kind == UINT8_ELEMENTS) || (kind == UINT16_ELEMENTS)) {
+      return true;
+    }
+    else {
+      return false;
+    }
+  }
+
+  macro ElementsKindTestHelper2(kind: constexpr ElementsKind): bool {
+    return ((kind == UINT8_ELEMENTS) || (kind == UINT16_ELEMENTS));
+  }
+
+  macro ElementsKindTestHelper3(kind: constexpr ElementsKind): constexpr bool {
+    return ((kind == UINT8_ELEMENTS) || (kind == UINT16_ELEMENTS));
+  }
+
+  macro LabelTestHelper1(): never
+  labels Label1 {
+    goto Label1;
+  }
+
+  macro LabelTestHelper2(): never
+  labels Label2(Smi) {
+    goto Label2(42);
+  }
+
+  macro LabelTestHelper3(): never
+  labels Label3(String, Smi) {
+    goto Label3('foo', 7);
+  }
+
+  macro TestConstexpr1() {
+    check(from_constexpr<bool>(IsFastElementsKind(PACKED_SMI_ELEMENTS)));
+  }
+
+  macro TestConstexprIf() {
+    check(ElementsKindTestHelper1(UINT8_ELEMENTS));
+    check(ElementsKindTestHelper1(UINT16_ELEMENTS));
+    check(!ElementsKindTestHelper1(UINT32_ELEMENTS));
+  }
+
+  macro TestConstexprReturn() {
+    check(from_constexpr<bool>(ElementsKindTestHelper3(UINT8_ELEMENTS)));
+    check(from_constexpr<bool>(ElementsKindTestHelper3(UINT16_ELEMENTS)));
+    check(!from_constexpr<bool>(ElementsKindTestHelper3(UINT32_ELEMENTS)));
+    check(from_constexpr<bool>(!ElementsKindTestHelper3(UINT32_ELEMENTS)));
+  }
+
+  macro TestGotoLabel(): Boolean {
+    try {
+      LabelTestHelper1() otherwise Label1;
+    }
+    label Label1 {
+      return True;
+    }
+  }
+
+  macro TestGotoLabelWithOneParameter(): Boolean {
+    try {
+      LabelTestHelper2() otherwise Label2;
+    }
+    label Label2(smi: Smi) {
+      check(smi == 42);
+      return True;
+    }
+  }
+
+  macro TestGotoLabelWithTwoParameters(): Boolean {
+    try {
+      LabelTestHelper3() otherwise Label3;
+    }
+    label Label3(str: String, smi: Smi) {
+      check(str == 'foo');
+      check(smi == 7);
+      return True;
+    }
+  }
+
+  builtin GenericBuiltinTest<T: type>(c: Context, param: T): Object {
+    return Null;
+  }
+
+  GenericBuiltinTest<Object>(c: Context, param: Object): Object {
+    return param;
+  }
+
+  macro TestBuiltinSpecialization(c: Context) {
+    check(GenericBuiltinTest<Smi>(c, 0) == Null);
+    check(GenericBuiltinTest<Smi>(c, 1) == Null);
+    check(GenericBuiltinTest<Object>(c, Undefined) == Undefined);
+    check(GenericBuiltinTest<Object>(c, Undefined) == Undefined);
+  }
+
+  macro LabelTestHelper4(flag: constexpr bool): never labels Label4, Label5 {
+    if constexpr (flag) goto Label4;
+    else
+      goto Label5;
+  }
+
+  macro CallLabelTestHelper4(flag: constexpr bool): bool {
+    try {
+      LabelTestHelper4(flag) otherwise Label4, Label5;
+    }
+    label Label4 {
+      return true;
+    }
+    label Label5 {
+      return false;
+    }
+  }
+
+  macro TestPartiallyUnusedLabel(): Boolean {
+    let r1: bool = CallLabelTestHelper4(true);
+    let r2: bool = CallLabelTestHelper4(false);
+
+    if (r1 && !r2)
+      return True;
+    else
+      return False;
+  }
+
+  macro GenericMacroTest<T: type>(param: T): Object {
+    return Undefined;
+  }
+
+  GenericMacroTest<Object>(param2: Object): Object {
+    return param2;
+  }
+
+  macro GenericMacroTestWithLabels<T: type>(param: T): Object labels X {
+    return Undefined;
+  }
+
+  GenericMacroTestWithLabels<Object>(param2: Object): Object labels Y {
+    return param2;
+  }
+
+  macro TestMacroSpecialization() {
+    try {
+      check(GenericMacroTest<Smi>(0) == Undefined);
+      check(GenericMacroTest<Smi>(1) == Undefined);
+      check(GenericMacroTest<Object>(Null) == Null);
+      check(GenericMacroTest<Object>(False) == False);
+      check(GenericMacroTest<Object>(True) == True);
+      check(GenericMacroTestWithLabels<Smi>(0) otherwise Fail == Undefined);
+      check(GenericMacroTestWithLabels<Smi>(0) otherwise Fail == Undefined);
+      check(GenericMacroTestWithLabels<Object>(Null) otherwise Fail == Null);
+      check(GenericMacroTestWithLabels<Object>(False) otherwise Fail == False);
+    }
+    label Fail {
+      unreachable;
+    }
+  }
+
+  builtin TestHelperPlus1(context : Context, x : Smi) : Smi {
+    return x + 1;
+  }
+  builtin TestHelperPlus2(context : Context, x : Smi) : Smi {
+    return x + 2;
+  }
+
+  macro TestFunctionPointers(context : Context) : Boolean {
+    let fptr : builtin(Context, Smi) => Smi = TestHelperPlus1;
+    check(fptr(context, 42) == 43);
+    fptr = TestHelperPlus2;
+    check(fptr(context, 42) == 44);
+    return True;
+  }
+
+  macro TestVariableRedeclaration(context : Context) : Boolean {
+    let var1 : int31 = from_constexpr<bool>(42 == 0) ? 0 : 1;
+    let var2 : int31 = from_constexpr<bool>(42 == 0) ? 1 : 0;
+    return True;
+  }
+
+  macro TestTernaryOperator(x : Smi) : Smi {
+    let b : bool = x < 0 ? true : false;
+    return b ? x - 10 : x + 100;
+  }
+
+  macro TestFunctionPointerToGeneric(c: Context) {
+    let fptr1: builtin(Context, Smi) => Object = GenericBuiltinTest<Smi>;
+    let fptr2: builtin(Context, Object) => Object = GenericBuiltinTest<Object>;
+
+    check(fptr1(c, 0) == Null);
+    check(fptr1(c, 1) == Null);
+    check(fptr2(c, Undefined) == Undefined);
+    check(fptr2(c, Undefined) == Undefined);
+  }
+
+  type SmiToSmi = builtin(Smi) => Smi;
+  macro TestTypeAlias(x : SmiToSmi) : Code {
+    return x;
+  }
+
+  macro TestUnsafeCast(c: Context, n: Number): Boolean {
+    if (TaggedIsSmi(n)) {
+      let m: Smi = unsafe_cast<Smi>(n);
+
+      check(TestHelperPlus1(c, m) == 11);
+      return True;
+    }
+    return False;
+  }
+
+  macro TestHexLiteral() {
+    check(convert<intptr>(0xffff) + 1 == 0x10000);
+    check(convert<intptr>(-0xffff) == -65535);
+  }
+
+  macro TestLargeIntegerLiterals(c: Context) {
+    let x: int32 = 0x40000000;
+    let y: int32 = 0x7fffffff;
+  }
+
+  macro TestMultilineAssert() {
+    let someVeryLongVariableNameThatWillCauseLineBreaks: Smi = 5;
+    check(someVeryLongVariableNameThatWillCauseLineBreaks > 0
+           && someVeryLongVariableNameThatWillCauseLineBreaks < 10);
+  }
+
+  macro TestNewlineInString() {
+    Print('Hello, World!\n');
+  }
+}
diff --git a/deps/v8/test/unittests/BUILD.gn b/deps/v8/test/unittests/BUILD.gn
index 08669793c2d951..a6cf82f1634689 100644
--- a/deps/v8/test/unittests/BUILD.gn
+++ b/deps/v8/test/unittests/BUILD.gn
@@ -17,7 +17,6 @@ v8_executable("unittests") {
     "../..:v8_for_testing",
     "../..:v8_libbase",
     "../..:v8_libplatform",
-    "//build/config:exe_and_shlib_deps",
     "//build/win:default_exe_manifest",
     "//testing/gmock",
     "//testing/gtest",
@@ -63,6 +62,7 @@ v8_source_set("unittests_sources") {
     "base/functional-unittest.cc",
     "base/ieee754-unittest.cc",
     "base/iterator-unittest.cc",
+    "base/list-unittest.cc",
     "base/logging-unittest.cc",
     "base/macros-unittest.cc",
     "base/ostreams-unittest.cc",
@@ -91,6 +91,7 @@ v8_source_set("unittests_sources") {
     "compiler/common-operator-reducer-unittest.cc",
     "compiler/common-operator-unittest.cc",
     "compiler/compiler-test-utils.h",
+    "compiler/constant-folding-reducer-unittest.cc",
     "compiler/control-equivalence-unittest.cc",
     "compiler/control-flow-optimizer-unittest.cc",
     "compiler/dead-code-elimination-unittest.cc",
@@ -107,7 +108,6 @@ v8_source_set("unittests_sources") {
     "compiler/instruction-sequence-unittest.h",
     "compiler/instruction-unittest.cc",
     "compiler/int64-lowering-unittest.cc",
-    "compiler/js-builtin-reducer-unittest.cc",
     "compiler/js-call-reducer-unittest.cc",
     "compiler/js-create-lowering-unittest.cc",
     "compiler/js-intrinsic-lowering-unittest.cc",
@@ -150,6 +150,7 @@ v8_source_set("unittests_sources") {
     "heap/embedder-tracing-unittest.cc",
     "heap/gc-idle-time-handler-unittest.cc",
     "heap/gc-tracer-unittest.cc",
+    "heap/heap-controller-unittest.cc",
     "heap/heap-unittest.cc",
     "heap/item-parallel-job-unittest.cc",
     "heap/marking-unittest.cc",
@@ -185,6 +186,7 @@ v8_source_set("unittests_sources") {
     "register-configuration-unittest.cc",
     "run-all-unittests.cc",
     "source-position-table-unittest.cc",
+    "strings-storage-unittest.cc",
     "test-helpers.cc",
     "test-helpers.h",
     "test-utils.cc",
@@ -246,7 +248,6 @@ v8_source_set("unittests_sources") {
     "../..:v8_for_testing",
     "../..:v8_libbase",
     "../..:v8_libplatform",
-    "//build/config:exe_and_shlib_deps",
     "//build/win:default_exe_manifest",
     "//testing/gmock",
     "//testing/gtest",
diff --git a/deps/v8/test/unittests/allocation-unittest.cc b/deps/v8/test/unittests/allocation-unittest.cc
index 68cd8a77e0f844..3e43cdd4ea709f 100644
--- a/deps/v8/test/unittests/allocation-unittest.cc
+++ b/deps/v8/test/unittests/allocation-unittest.cc
@@ -110,6 +110,7 @@ sigjmp_buf MemoryAllocationPermissionsTest::continuation_;
 
 TEST_F(MemoryAllocationPermissionsTest, DoTest) {
   TestPermissions(PageAllocator::Permission::kNoAccess, false, false);
+  TestPermissions(PageAllocator::Permission::kRead, true, false);
   TestPermissions(PageAllocator::Permission::kReadWrite, true, true);
   TestPermissions(PageAllocator::Permission::kReadWriteExecute, true, true);
   TestPermissions(PageAllocator::Permission::kReadExecute, true, false);
diff --git a/deps/v8/test/unittests/base/list-unittest.cc b/deps/v8/test/unittests/base/list-unittest.cc
new file mode 100644
index 00000000000000..39394e27435555
--- /dev/null
+++ b/deps/v8/test/unittests/base/list-unittest.cc
@@ -0,0 +1,92 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "src/base/list.h"
+#include "testing/gtest-support.h"
+
+namespace v8 {
+namespace base {
+
+class TestChunk {
+ public:
+  base::ListNode<TestChunk>& list_node() { return list_node_; }
+  base::ListNode<TestChunk> list_node_;
+};
+
+TEST(List, InsertAtTailAndRemove) {
+  List<TestChunk> list;
+  EXPECT_TRUE(list.Empty());
+  TestChunk t1;
+  list.PushBack(&t1);
+  EXPECT_FALSE(list.Empty());
+  EXPECT_TRUE(list.Contains(&t1));
+  list.Remove(&t1);
+  EXPECT_TRUE(list.Empty());
+}
+
+TEST(List, InsertAtHeadAndRemove) {
+  List<TestChunk> list;
+  EXPECT_TRUE(list.Empty());
+  TestChunk t1;
+  list.PushFront(&t1);
+  EXPECT_FALSE(list.Empty());
+  list.Remove(&t1);
+  EXPECT_TRUE(list.Empty());
+}
+
+TEST(List, InsertMultipleAtTailAndRemoveFromTail) {
+  List<TestChunk> list;
+  EXPECT_TRUE(list.Empty());
+  const int kSize = 10;
+  TestChunk chunks[kSize];
+  for (int i = 0; i < kSize; i++) {
+    list.PushBack(&chunks[i]);
+    EXPECT_EQ(list.back(), &chunks[i]);
+  }
+  for (int i = kSize - 1; i > 0; i--) {
+    list.Remove(&chunks[i]);
+    EXPECT_EQ(list.back(), &chunks[i - 1]);
+  }
+
+  list.Remove(&chunks[0]);
+  EXPECT_TRUE(list.Empty());
+}
+
+TEST(List, InsertMultipleAtHeadAndRemoveFromHead) {
+  List<TestChunk> list;
+  EXPECT_TRUE(list.Empty());
+  const int kSize = 10;
+  TestChunk chunks[kSize];
+  for (int i = 0; i < kSize; i++) {
+    list.PushFront(&chunks[i]);
+    EXPECT_EQ(list.front(), &chunks[i]);
+  }
+  for (int i = kSize - 1; i > 0; i--) {
+    list.Remove(&chunks[i]);
+    EXPECT_EQ(list.front(), &chunks[i - 1]);
+  }
+
+  list.Remove(&chunks[0]);
+  EXPECT_TRUE(list.Empty());
+}
+
+TEST(List, InsertMultipleAtTailAndRemoveFromMiddle) {
+  List<TestChunk> list;
+  EXPECT_TRUE(list.Empty());
+  const int kSize = 10;
+  TestChunk chunks[kSize];
+  for (int i = 0; i < kSize; i++) {
+    list.PushBack(&chunks[i]);
+    EXPECT_EQ(list.back(), &chunks[i]);
+  }
+  int i, j;
+  for (i = kSize / 2 - 1, j = kSize / 2; i >= 0; i--, j++) {
+    list.Remove(&chunks[i]);
+    list.Remove(&chunks[j]);
+  }
+  EXPECT_TRUE(list.Empty());
+}
+
+}  // namespace base
+}  // namespace v8
diff --git a/deps/v8/test/unittests/base/platform/time-unittest.cc b/deps/v8/test/unittests/base/platform/time-unittest.cc
index 19420d5dc6bbcb..d357a8aa62abd7 100644
--- a/deps/v8/test/unittests/base/platform/time-unittest.cc
+++ b/deps/v8/test/unittests/base/platform/time-unittest.cc
@@ -392,6 +392,15 @@ TEST(ThreadTicks, MAYBE_ThreadNow) {
     // Make sure that ThreadNow value is non-zero.
     EXPECT_GT(begin_thread, ThreadTicks());
     int iterations_count = 0;
+
+    // Some systems have low resolution thread timers, this code makes sure
+    // that thread time has progressed by at least one tick.
+    // Limit waiting to 10ms to prevent infinite loops.
+    while (ThreadTicks::Now() == begin_thread &&
+           ((TimeTicks::Now() - begin).InMicroseconds() < 10000)) {
+    }
+    EXPECT_GT(ThreadTicks::Now(), begin_thread);
+
     do {
       // Sleep for 10 milliseconds to get the thread de-scheduled.
       OS::Sleep(base::TimeDelta::FromMilliseconds(10));
diff --git a/deps/v8/test/unittests/code-stub-assembler-unittest.cc b/deps/v8/test/unittests/code-stub-assembler-unittest.cc
index d39649a35587ac..dab7e3e3a66c18 100644
--- a/deps/v8/test/unittests/code-stub-assembler-unittest.cc
+++ b/deps/v8/test/unittests/code-stub-assembler-unittest.cc
@@ -30,9 +30,9 @@ namespace internal {
 
 CodeStubAssemblerTestState::CodeStubAssemblerTestState(
     CodeStubAssemblerTest* test)
-    : compiler::CodeAssemblerState(test->isolate(), test->zone(),
-                                   VoidDescriptor(test->isolate()), Code::STUB,
-                                   "test", PoisoningMitigationLevel::kOn) {}
+    : compiler::CodeAssemblerState(
+          test->isolate(), test->zone(), VoidDescriptor{}, Code::STUB, "test",
+          PoisoningMitigationLevel::kPoisonCriticalOnly) {}
 
 TARGET_TEST_F(CodeStubAssemblerTest, SmiTag) {
   CodeStubAssemblerTestState state(this);
diff --git a/deps/v8/test/unittests/compiler-dispatcher/compiler-dispatcher-unittest.cc b/deps/v8/test/unittests/compiler-dispatcher/compiler-dispatcher-unittest.cc
index 31a5044e146e15..c523906027a3ed 100644
--- a/deps/v8/test/unittests/compiler-dispatcher/compiler-dispatcher-unittest.cc
+++ b/deps/v8/test/unittests/compiler-dispatcher/compiler-dispatcher-unittest.cc
@@ -102,14 +102,7 @@ class MockPlatform : public v8::Platform {
 
   std::shared_ptr<TaskRunner> GetForegroundTaskRunner(
       v8::Isolate* isolate) override {
-    constexpr bool is_foreground_task_runner = true;
-    return std::make_shared<MockTaskRunner>(this, is_foreground_task_runner);
-  }
-
-  std::shared_ptr<TaskRunner> GetWorkerThreadsTaskRunner(
-      v8::Isolate* isolate) override {
-    constexpr bool is_foreground_task_runner = false;
-    return std::make_shared<MockTaskRunner>(this, is_foreground_task_runner);
+    return std::make_shared<MockForegroundTaskRunner>(this);
   }
 
   void CallOnWorkerThread(std::unique_ptr<Task> task) override {
@@ -117,6 +110,11 @@ class MockPlatform : public v8::Platform {
     worker_tasks_.push_back(std::move(task));
   }
 
+  void CallDelayedOnWorkerThread(std::unique_ptr<Task> task,
+                                 double delay_in_seconds) override {
+    UNREACHABLE();
+  }
+
   void CallOnForegroundThread(v8::Isolate* isolate, Task* task) override {
     base::LockGuard<base::Mutex> lock(&mutex_);
     foreground_tasks_.push_back(std::unique_ptr<Task>(task));
@@ -259,19 +257,14 @@ class MockPlatform : public v8::Platform {
     DISALLOW_COPY_AND_ASSIGN(TaskWrapper);
   };
 
-  class MockTaskRunner final : public TaskRunner {
+  class MockForegroundTaskRunner final : public TaskRunner {
    public:
-    MockTaskRunner(MockPlatform* platform, bool is_foreground_task_runner)
-        : platform_(platform),
-          is_foreground_task_runner_(is_foreground_task_runner) {}
+    explicit MockForegroundTaskRunner(MockPlatform* platform)
+        : platform_(platform) {}
 
     void PostTask(std::unique_ptr<v8::Task> task) override {
       base::LockGuard<base::Mutex> lock(&platform_->mutex_);
-      if (is_foreground_task_runner_) {
-        platform_->foreground_tasks_.push_back(std::move(task));
-      } else {
-        platform_->worker_tasks_.push_back(std::move(task));
-      }
+      platform_->foreground_tasks_.push_back(std::move(task));
     }
 
     void PostDelayedTask(std::unique_ptr<Task> task,
@@ -286,14 +279,10 @@ class MockPlatform : public v8::Platform {
       platform_->idle_task_ = task.release();
     }
 
-    bool IdleTasksEnabled() override {
-      // Idle tasks are enabled only in the foreground task runner.
-      return is_foreground_task_runner_;
-    };
+    bool IdleTasksEnabled() override { return true; };
 
    private:
     MockPlatform* platform_;
-    bool is_foreground_task_runner_;
   };
 
   double time_;
diff --git a/deps/v8/test/unittests/compiler-dispatcher/optimizing-compile-dispatcher-unittest.cc b/deps/v8/test/unittests/compiler-dispatcher/optimizing-compile-dispatcher-unittest.cc
index 145bf78fb6b7d8..95052c9b7553ca 100644
--- a/deps/v8/test/unittests/compiler-dispatcher/optimizing-compile-dispatcher-unittest.cc
+++ b/deps/v8/test/unittests/compiler-dispatcher/optimizing-compile-dispatcher-unittest.cc
@@ -29,9 +29,9 @@ class BlockingCompilationJob : public OptimizedCompilationJob {
       : OptimizedCompilationJob(isolate->stack_guard()->real_climit(), &info_,
                                 "BlockingCompilationJob",
                                 State::kReadyToExecute),
-        shared_(function->shared()),
+        shared_(function->shared(), isolate),
         zone_(isolate->allocator(), ZONE_NAME),
-        info_(&zone_, function->GetIsolate(), shared_, function),
+        info_(&zone_, isolate, shared_, function),
         blocking_(false),
         semaphore_(0) {}
   ~BlockingCompilationJob() override = default;
diff --git a/deps/v8/test/unittests/compiler-dispatcher/unoptimized-compile-job-unittest.cc b/deps/v8/test/unittests/compiler-dispatcher/unoptimized-compile-job-unittest.cc
index 6344d3806e0b42..f7fb335ac62b53 100644
--- a/deps/v8/test/unittests/compiler-dispatcher/unoptimized-compile-job-unittest.cc
+++ b/deps/v8/test/unittests/compiler-dispatcher/unoptimized-compile-job-unittest.cc
@@ -88,9 +88,9 @@ TEST_F(UnoptimizedCompileJobTest, StateTransitions) {
 }
 
 TEST_F(UnoptimizedCompileJobTest, SyntaxError) {
-  test::ScriptResource script("^^^", strlen("^^^"));
+  test::ScriptResource* script = new test::ScriptResource("^^^", strlen("^^^"));
   std::unique_ptr<UnoptimizedCompileJob> job(new UnoptimizedCompileJob(
-      isolate(), tracer(), test::CreateSharedFunctionInfo(isolate(), &script),
+      isolate(), tracer(), test::CreateSharedFunctionInfo(isolate(), script),
       FLAG_stack_size));
 
   job->PrepareOnMainThread(isolate());
@@ -120,7 +120,8 @@ TEST_F(UnoptimizedCompileJobTest, CompileAndRun) {
       "g();";
   Handle<JSFunction> f = RunJS<JSFunction>(script);
   std::unique_ptr<UnoptimizedCompileJob> job(new UnoptimizedCompileJob(
-      isolate(), tracer(), handle(f->shared()), FLAG_stack_size));
+      isolate(), tracer(), handle(f->shared(), f->GetIsolate()),
+      FLAG_stack_size));
 
   job->PrepareOnMainThread(isolate());
   ASSERT_FALSE(job->IsFailed());
@@ -147,9 +148,10 @@ TEST_F(UnoptimizedCompileJobTest, CompileFailureToAnalyse) {
     raw_script += "'x' + 'x' - ";
   }
   raw_script += " 'x'; }";
-  test::ScriptResource script(raw_script.c_str(), strlen(raw_script.c_str()));
+  test::ScriptResource* script =
+      new test::ScriptResource(raw_script.c_str(), strlen(raw_script.c_str()));
   std::unique_ptr<UnoptimizedCompileJob> job(new UnoptimizedCompileJob(
-      isolate(), tracer(), test::CreateSharedFunctionInfo(isolate(), &script),
+      isolate(), tracer(), test::CreateSharedFunctionInfo(isolate(), script),
       100));
 
   job->PrepareOnMainThread(isolate());
@@ -173,9 +175,10 @@ TEST_F(UnoptimizedCompileJobTest, CompileFailureToFinalize) {
     raw_script += "'x' + 'x' - ";
   }
   raw_script += " 'x'; }";
-  test::ScriptResource script(raw_script.c_str(), strlen(raw_script.c_str()));
+  test::ScriptResource* script =
+      new test::ScriptResource(raw_script.c_str(), strlen(raw_script.c_str()));
   std::unique_ptr<UnoptimizedCompileJob> job(new UnoptimizedCompileJob(
-      isolate(), tracer(), test::CreateSharedFunctionInfo(isolate(), &script),
+      isolate(), tracer(), test::CreateSharedFunctionInfo(isolate(), script),
       50));
 
   job->PrepareOnMainThread(isolate());
@@ -218,9 +221,10 @@ TEST_F(UnoptimizedCompileJobTest, CompileOnBackgroundThread) {
       "  var d = { foo: 100, bar : bar() }\n"
       "  return bar;"
       "}";
-  test::ScriptResource script(raw_script, strlen(raw_script));
+  test::ScriptResource* script =
+      new test::ScriptResource(raw_script, strlen(raw_script));
   std::unique_ptr<UnoptimizedCompileJob> job(new UnoptimizedCompileJob(
-      isolate(), tracer(), test::CreateSharedFunctionInfo(isolate(), &script),
+      isolate(), tracer(), test::CreateSharedFunctionInfo(isolate(), script),
       100));
 
   job->PrepareOnMainThread(isolate());
@@ -249,7 +253,8 @@ TEST_F(UnoptimizedCompileJobTest, LazyInnerFunctions) {
   Handle<JSFunction> f = RunJS<JSFunction>(script);
 
   std::unique_ptr<UnoptimizedCompileJob> job(new UnoptimizedCompileJob(
-      isolate(), tracer(), handle(f->shared()), FLAG_stack_size));
+      isolate(), tracer(), handle(f->shared(), f->GetIsolate()),
+      FLAG_stack_size));
 
   job->PrepareOnMainThread(isolate());
   ASSERT_FALSE(job->IsFailed());
diff --git a/deps/v8/test/unittests/compiler/arm/instruction-selector-arm-unittest.cc b/deps/v8/test/unittests/compiler/arm/instruction-selector-arm-unittest.cc
index becc1d840507e6..70e04043c4b7ae 100644
--- a/deps/v8/test/unittests/compiler/arm/instruction-selector-arm-unittest.cc
+++ b/deps/v8/test/unittests/compiler/arm/instruction-selector-arm-unittest.cc
@@ -3266,6 +3266,54 @@ TEST_F(InstructionSelectorTest, SpeculationFence) {
   EXPECT_EQ(kArmDsbIsb, s[0]->arch_opcode());
 }
 
+TEST_F(InstructionSelectorTest, StackCheck0) {
+  StreamBuilder m(this, MachineType::Int32(), MachineType::Pointer());
+  Node* const sp = m.LoadStackPointer();
+  Node* const stack_limit = m.Load(MachineType::Int32(), m.Parameter(0));
+  Node* const interrupt = m.UintPtrLessThan(sp, stack_limit);
+
+  RawMachineLabel if_true, if_false;
+  m.Branch(interrupt, &if_true, &if_false);
+
+  m.Bind(&if_true);
+  m.Return(m.Int32Constant(1));
+
+  m.Bind(&if_false);
+  m.Return(m.Int32Constant(0));
+
+  Stream s = m.Build();
+
+  ASSERT_EQ(2U, s.size());
+  EXPECT_EQ(kArmLdr, s[0]->arch_opcode());
+  EXPECT_EQ(kArmCmp, s[1]->arch_opcode());
+  EXPECT_EQ(4U, s[1]->InputCount());
+  EXPECT_EQ(0U, s[1]->OutputCount());
+}
+
+TEST_F(InstructionSelectorTest, StackCheck1) {
+  StreamBuilder m(this, MachineType::Int32(), MachineType::Pointer());
+  Node* const sp = m.LoadStackPointer();
+  Node* const stack_limit = m.Load(MachineType::Int32(), m.Parameter(0));
+  Node* const sp_within_limit = m.UintPtrLessThan(stack_limit, sp);
+
+  RawMachineLabel if_true, if_false;
+  m.Branch(sp_within_limit, &if_true, &if_false);
+
+  m.Bind(&if_true);
+  m.Return(m.Int32Constant(1));
+
+  m.Bind(&if_false);
+  m.Return(m.Int32Constant(0));
+
+  Stream s = m.Build();
+
+  ASSERT_EQ(2U, s.size());
+  EXPECT_EQ(kArmLdr, s[0]->arch_opcode());
+  EXPECT_EQ(kArmCmp, s[1]->arch_opcode());
+  EXPECT_EQ(4U, s[1]->InputCount());
+  EXPECT_EQ(0U, s[1]->OutputCount());
+}
+
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/test/unittests/compiler/arm64/instruction-selector-arm64-unittest.cc b/deps/v8/test/unittests/compiler/arm64/instruction-selector-arm64-unittest.cc
index f8b0a478e2104f..be876c7cb385f0 100644
--- a/deps/v8/test/unittests/compiler/arm64/instruction-selector-arm64-unittest.cc
+++ b/deps/v8/test/unittests/compiler/arm64/instruction-selector-arm64-unittest.cc
@@ -4426,6 +4426,95 @@ TEST_F(InstructionSelectorTest, SpeculationFence) {
   EXPECT_EQ(kArm64DsbIsb, s[0]->arch_opcode());
 }
 
+TEST_F(InstructionSelectorTest, StackCheck0) {
+  StreamBuilder m(this, MachineType::Int32(), MachineType::Pointer());
+  Node* const sp = m.LoadStackPointer();
+  Node* const stack_limit = m.Load(MachineType::Int64(), m.Parameter(0));
+  Node* const interrupt = m.UintPtrLessThan(sp, stack_limit);
+
+  RawMachineLabel if_true, if_false;
+  m.Branch(interrupt, &if_true, &if_false);
+
+  m.Bind(&if_true);
+  m.Return(m.Int32Constant(1));
+
+  m.Bind(&if_false);
+  m.Return(m.Int32Constant(0));
+
+  Stream s = m.Build();
+
+  ASSERT_EQ(2U, s.size());
+  EXPECT_EQ(kArm64Ldr, s[0]->arch_opcode());
+  EXPECT_EQ(kArm64Cmp, s[1]->arch_opcode());
+  EXPECT_EQ(4U, s[1]->InputCount());
+  EXPECT_EQ(0U, s[1]->OutputCount());
+}
+
+TEST_F(InstructionSelectorTest, StackCheck1) {
+  StreamBuilder m(this, MachineType::Int32(), MachineType::Pointer());
+  Node* const sp = m.LoadStackPointer();
+  Node* const stack_limit = m.Load(MachineType::Int64(), m.Parameter(0));
+  Node* const sp_within_limit = m.UintPtrLessThan(stack_limit, sp);
+
+  RawMachineLabel if_true, if_false;
+  m.Branch(sp_within_limit, &if_true, &if_false);
+
+  m.Bind(&if_true);
+  m.Return(m.Int32Constant(1));
+
+  m.Bind(&if_false);
+  m.Return(m.Int32Constant(0));
+
+  Stream s = m.Build();
+
+  ASSERT_EQ(2U, s.size());
+  EXPECT_EQ(kArm64Ldr, s[0]->arch_opcode());
+  EXPECT_EQ(kArm64Cmp, s[1]->arch_opcode());
+  EXPECT_EQ(4U, s[1]->InputCount());
+  EXPECT_EQ(0U, s[1]->OutputCount());
+}
+
+TEST_F(InstructionSelectorTest, ExternalReferenceLoad1) {
+  // Test offsets we can use kMode_Root for.
+  const int64_t kOffsets[] = {0, 1, 4, INT32_MIN, INT32_MAX};
+  TRACED_FOREACH(int64_t, offset, kOffsets) {
+    StreamBuilder m(this, MachineType::Int64());
+    ExternalReference reference = bit_cast<ExternalReference>(
+        reinterpret_cast<intptr_t>(isolate()->heap()->roots_array_start()) +
+        offset + kRootRegisterBias);
+    Node* const value =
+        m.Load(MachineType::Int64(), m.ExternalConstant(reference));
+    m.Return(value);
+
+    Stream s = m.Build();
+
+    ASSERT_EQ(1U, s.size());
+    EXPECT_EQ(kArm64Ldr, s[0]->arch_opcode());
+    EXPECT_EQ(kMode_Root, s[0]->addressing_mode());
+    EXPECT_EQ(1U, s[0]->InputCount());
+    EXPECT_EQ(s.ToInt64(s[0]->InputAt(0)), offset);
+    EXPECT_EQ(1U, s[0]->OutputCount());
+  }
+}
+
+TEST_F(InstructionSelectorTest, ExternalReferenceLoad2) {
+  // Offset too large, we cannot use kMode_Root.
+  StreamBuilder m(this, MachineType::Int64());
+  int64_t offset = 0x100000000;
+  ExternalReference reference = bit_cast<ExternalReference>(
+      reinterpret_cast<intptr_t>(isolate()->heap()->roots_array_start()) +
+      offset + kRootRegisterBias);
+  Node* const value =
+      m.Load(MachineType::Int64(), m.ExternalConstant(reference));
+  m.Return(value);
+
+  Stream s = m.Build();
+
+  ASSERT_EQ(1U, s.size());
+  EXPECT_EQ(kArm64Ldr, s[0]->arch_opcode());
+  EXPECT_NE(kMode_Root, s[0]->addressing_mode());
+}
+
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/test/unittests/compiler/code-assembler-unittest.cc b/deps/v8/test/unittests/compiler/code-assembler-unittest.cc
index 9cf955e86e5b4b..8a28ef389abf41 100644
--- a/deps/v8/test/unittests/compiler/code-assembler-unittest.cc
+++ b/deps/v8/test/unittests/compiler/code-assembler-unittest.cc
@@ -19,9 +19,9 @@ namespace internal {
 namespace compiler {
 
 CodeAssemblerTestState::CodeAssemblerTestState(CodeAssemblerTest* test)
-    : CodeAssemblerState(test->isolate(), test->zone(),
-                         VoidDescriptor(test->isolate()), Code::STUB, "test",
-                         PoisoningMitigationLevel::kOn) {}
+    : CodeAssemblerState(test->isolate(), test->zone(), VoidDescriptor{},
+                         Code::STUB, "test",
+                         PoisoningMitigationLevel::kPoisonCriticalOnly) {}
 
 TARGET_TEST_F(CodeAssemblerTest, IntPtrAdd) {
   CodeAssemblerTestState state(this);
diff --git a/deps/v8/test/unittests/compiler/common-operator-reducer-unittest.cc b/deps/v8/test/unittests/compiler/common-operator-reducer-unittest.cc
index 3cae7e60d76ade..086fa2ec7df15d 100644
--- a/deps/v8/test/unittests/compiler/common-operator-reducer-unittest.cc
+++ b/deps/v8/test/unittests/compiler/common-operator-reducer-unittest.cc
@@ -29,9 +29,11 @@ class CommonOperatorReducerTest : public GraphTest {
   Reduction Reduce(
       AdvancedReducer::Editor* editor, Node* node,
       MachineOperatorBuilder::Flags flags = MachineOperatorBuilder::kNoFlags) {
+    JSHeapBroker broker(isolate());
     MachineOperatorBuilder machine(zone(), MachineType::PointerRepresentation(),
                                    flags);
-    CommonOperatorReducer reducer(editor, graph(), common(), &machine, zone());
+    CommonOperatorReducer reducer(editor, graph(), &broker, common(), &machine,
+                                  zone());
     return reducer.Reduce(node);
   }
 
diff --git a/deps/v8/test/unittests/compiler/constant-folding-reducer-unittest.cc b/deps/v8/test/unittests/compiler/constant-folding-reducer-unittest.cc
new file mode 100644
index 00000000000000..6780bf8500c687
--- /dev/null
+++ b/deps/v8/test/unittests/compiler/constant-folding-reducer-unittest.cc
@@ -0,0 +1,234 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "src/compiler/constant-folding-reducer.h"
+#include "src/code-factory.h"
+#include "src/compiler/access-builder.h"
+#include "src/compiler/compilation-dependencies.h"
+#include "src/compiler/js-graph.h"
+#include "src/compiler/js-operator.h"
+#include "src/compiler/machine-operator.h"
+#include "src/compiler/node-properties.h"
+#include "src/compiler/operator-properties.h"
+#include "src/isolate-inl.h"
+#include "test/unittests/compiler/compiler-test-utils.h"
+#include "test/unittests/compiler/graph-unittest.h"
+#include "test/unittests/compiler/node-test-utils.h"
+#include "testing/gmock-support.h"
+
+using testing::IsNaN;
+
+namespace v8 {
+namespace internal {
+namespace compiler {
+namespace constant_folding_reducer_unittest {
+
+namespace {
+
+const double kFloat64Values[] = {
+    -V8_INFINITY,  -4.23878e+275, -5.82632e+265, -6.60355e+220,
+    -6.26172e+212, -2.56222e+211, -4.82408e+201, -1.84106e+157,
+    -1.63662e+127, -1.55772e+100, -1.67813e+72,  -2.3382e+55,
+    -3.179e+30,    -1.441e+09,    -1.0647e+09,   -7.99361e+08,
+    -5.77375e+08,  -2.20984e+08,  -32757,        -13171,
+    -9970,         -3984,         -107,          -105,
+    -92,           -77,           -61,           -0.000208163,
+    -1.86685e-06,  -1.17296e-10,  -9.26358e-11,  -5.08004e-60,
+    -1.74753e-65,  -1.06561e-71,  -5.67879e-79,  -5.78459e-130,
+    -2.90989e-171, -7.15489e-243, -3.76242e-252, -1.05639e-263,
+    -4.40497e-267, -2.19666e-273, -4.9998e-276,  -5.59821e-278,
+    -2.03855e-282, -5.99335e-283, -7.17554e-284, -3.11744e-309,
+    -0.0,          0.0,           2.22507e-308,  1.30127e-270,
+    7.62898e-260,  4.00313e-249,  3.16829e-233,  1.85244e-228,
+    2.03544e-129,  1.35126e-110,  1.01182e-106,  5.26333e-94,
+    1.35292e-90,   2.85394e-83,   1.78323e-77,   5.4967e-57,
+    1.03207e-25,   4.57401e-25,   1.58738e-05,   2,
+    125,           2310,          9636,          14802,
+    17168,         28945,         29305,         4.81336e+07,
+    1.41207e+08,   4.65962e+08,   1.40499e+09,   2.12648e+09,
+    8.80006e+30,   1.4446e+45,    1.12164e+54,   2.48188e+89,
+    6.71121e+102,  3.074e+112,    4.9699e+152,   5.58383e+166,
+    4.30654e+172,  7.08824e+185,  9.6586e+214,   2.028e+223,
+    6.63277e+243,  1.56192e+261,  1.23202e+269,  5.72883e+289,
+    8.5798e+290,   1.40256e+294,  1.79769e+308,  V8_INFINITY};
+
+const double kIntegerValues[] = {-V8_INFINITY, INT_MIN, -1000.0,  -42.0,
+                                 -1.0,         0.0,     1.0,      42.0,
+                                 1000.0,       INT_MAX, UINT_MAX, V8_INFINITY};
+
+}  // namespace
+
+class ConstantFoldingReducerTest : public TypedGraphTest {
+ public:
+  ConstantFoldingReducerTest()
+      : TypedGraphTest(3),
+        js_heap_broker_(isolate()),
+        simplified_(zone()),
+        deps_(isolate(), zone()) {}
+  ~ConstantFoldingReducerTest() override {}
+
+ protected:
+  Reduction Reduce(Node* node) {
+    MachineOperatorBuilder machine(zone());
+    JSOperatorBuilder javascript(zone());
+    JSGraph jsgraph(isolate(), graph(), common(), &javascript, simplified(),
+                    &machine);
+    // TODO(titzer): mock the GraphReducer here for better unit testing.
+    GraphReducer graph_reducer(zone(), graph());
+    ConstantFoldingReducer reducer(&graph_reducer, &jsgraph, js_heap_broker());
+    return reducer.Reduce(node);
+  }
+
+  SimplifiedOperatorBuilder* simplified() { return &simplified_; }
+  const JSHeapBroker* js_heap_broker() const { return &js_heap_broker_; }
+
+ private:
+  JSHeapBroker js_heap_broker_;
+  SimplifiedOperatorBuilder simplified_;
+  CompilationDependencies deps_;
+};
+
+TEST_F(ConstantFoldingReducerTest, ParameterWithMinusZero) {
+  {
+    Reduction r = Reduce(Parameter(Type::NewConstant(
+        js_heap_broker(), factory()->minus_zero_value(), zone())));
+    ASSERT_TRUE(r.Changed());
+    EXPECT_THAT(r.replacement(), IsNumberConstant(-0.0));
+  }
+  {
+    Reduction r = Reduce(Parameter(Type::MinusZero()));
+    ASSERT_TRUE(r.Changed());
+    EXPECT_THAT(r.replacement(), IsNumberConstant(-0.0));
+  }
+  {
+    Reduction r = Reduce(Parameter(Type::Union(
+        Type::MinusZero(),
+        Type::NewConstant(js_heap_broker(), factory()->NewNumber(0), zone()),
+        zone())));
+    EXPECT_FALSE(r.Changed());
+  }
+}
+
+TEST_F(ConstantFoldingReducerTest, ParameterWithNull) {
+  Handle<HeapObject> null = factory()->null_value();
+  {
+    Reduction r =
+        Reduce(Parameter(Type::NewConstant(js_heap_broker(), null, zone())));
+    ASSERT_TRUE(r.Changed());
+    EXPECT_THAT(r.replacement(), IsHeapConstant(null));
+  }
+  {
+    Reduction r = Reduce(Parameter(Type::Null()));
+    ASSERT_TRUE(r.Changed());
+    EXPECT_THAT(r.replacement(), IsHeapConstant(null));
+  }
+}
+
+TEST_F(ConstantFoldingReducerTest, ParameterWithNaN) {
+  const double kNaNs[] = {-std::numeric_limits<double>::quiet_NaN(),
+                          std::numeric_limits<double>::quiet_NaN(),
+                          std::numeric_limits<double>::signaling_NaN()};
+  TRACED_FOREACH(double, nan, kNaNs) {
+    Handle<Object> constant = factory()->NewNumber(nan);
+    Reduction r = Reduce(
+        Parameter(Type::NewConstant(js_heap_broker(), constant, zone())));
+    ASSERT_TRUE(r.Changed());
+    EXPECT_THAT(r.replacement(), IsNumberConstant(IsNaN()));
+  }
+  {
+    Reduction r = Reduce(Parameter(
+        Type::NewConstant(js_heap_broker(), factory()->nan_value(), zone())));
+    ASSERT_TRUE(r.Changed());
+    EXPECT_THAT(r.replacement(), IsNumberConstant(IsNaN()));
+  }
+  {
+    Reduction r = Reduce(Parameter(Type::NaN()));
+    ASSERT_TRUE(r.Changed());
+    EXPECT_THAT(r.replacement(), IsNumberConstant(IsNaN()));
+  }
+}
+
+TEST_F(ConstantFoldingReducerTest, ParameterWithPlainNumber) {
+  TRACED_FOREACH(double, value, kFloat64Values) {
+    Handle<Object> constant = factory()->NewNumber(value);
+    Reduction r = Reduce(
+        Parameter(Type::NewConstant(js_heap_broker(), constant, zone())));
+    ASSERT_TRUE(r.Changed());
+    EXPECT_THAT(r.replacement(), IsNumberConstant(value));
+  }
+  TRACED_FOREACH(double, value, kIntegerValues) {
+    Reduction r = Reduce(Parameter(Type::Range(value, value, zone())));
+    ASSERT_TRUE(r.Changed());
+    EXPECT_THAT(r.replacement(), IsNumberConstant(value));
+  }
+}
+
+TEST_F(ConstantFoldingReducerTest, ParameterWithUndefined) {
+  Handle<HeapObject> undefined = factory()->undefined_value();
+  {
+    Reduction r = Reduce(Parameter(Type::Undefined()));
+    ASSERT_TRUE(r.Changed());
+    EXPECT_THAT(r.replacement(), IsHeapConstant(undefined));
+  }
+  {
+    Reduction r = Reduce(
+        Parameter(Type::NewConstant(js_heap_broker(), undefined, zone())));
+    ASSERT_TRUE(r.Changed());
+    EXPECT_THAT(r.replacement(), IsHeapConstant(undefined));
+  }
+}
+
+// -----------------------------------------------------------------------------
+// ToBoolean
+
+TEST_F(ConstantFoldingReducerTest, ToBooleanWithFalsish) {
+  Node* input = Parameter(
+      Type::Union(
+          Type::MinusZero(),
+          Type::Union(
+              Type::NaN(),
+              Type::Union(
+                  Type::Null(),
+                  Type::Union(
+                      Type::Undefined(),
+                      Type::Union(
+                          Type::Undetectable(),
+                          Type::Union(Type::NewConstant(
+                                          js_heap_broker(),
+                                          factory()->false_value(), zone()),
+                                      Type::Range(0.0, 0.0, zone()), zone()),
+                          zone()),
+                      zone()),
+                  zone()),
+              zone()),
+          zone()),
+      0);
+  Reduction r = Reduce(graph()->NewNode(simplified()->ToBoolean(), input));
+  ASSERT_TRUE(r.Changed());
+  EXPECT_THAT(r.replacement(), IsFalseConstant());
+}
+
+TEST_F(ConstantFoldingReducerTest, ToBooleanWithTruish) {
+  Node* input = Parameter(
+      Type::Union(
+          Type::NewConstant(js_heap_broker(), factory()->true_value(), zone()),
+          Type::Union(Type::DetectableReceiver(), Type::Symbol(), zone()),
+          zone()),
+      0);
+  Reduction r = Reduce(graph()->NewNode(simplified()->ToBoolean(), input));
+  ASSERT_TRUE(r.Changed());
+  EXPECT_THAT(r.replacement(), IsTrueConstant());
+}
+
+TEST_F(ConstantFoldingReducerTest, ToBooleanWithNonZeroPlainNumber) {
+  Node* input = Parameter(Type::Range(1, V8_INFINITY, zone()), 0);
+  Reduction r = Reduce(graph()->NewNode(simplified()->ToBoolean(), input));
+  ASSERT_TRUE(r.Changed());
+  EXPECT_THAT(r.replacement(), IsTrueConstant());
+}
+
+}  // namespace constant_folding_reducer_unittest
+}  // namespace compiler
+}  // namespace internal
+}  // namespace v8
diff --git a/deps/v8/test/unittests/compiler/control-equivalence-unittest.cc b/deps/v8/test/unittests/compiler/control-equivalence-unittest.cc
index 093b46abdbcd87..368c297a382309 100644
--- a/deps/v8/test/unittests/compiler/control-equivalence-unittest.cc
+++ b/deps/v8/test/unittests/compiler/control-equivalence-unittest.cc
@@ -6,6 +6,7 @@
 #include "src/bit-vector.h"
 #include "src/compiler/compiler-source-position-table.h"
 #include "src/compiler/graph-visualizer.h"
+#include "src/compiler/node-origin-table.h"
 #include "src/compiler/node-properties.h"
 #include "src/zone/zone-containers.h"
 #include "test/unittests/compiler/graph-unittest.h"
@@ -30,9 +31,9 @@ class ControlEquivalenceTest : public GraphTest {
   void ComputeEquivalence(Node* node) {
     graph()->SetEnd(graph()->NewNode(common()->End(1), node));
     if (FLAG_trace_turbo) {
-      OFStream os(stdout);
       SourcePositionTable table(graph());
-      os << AsJSON(*graph(), &table);
+      NodeOriginTable table2(graph());
+      StdoutStream{} << AsJSON(*graph(), &table, &table2);
     }
     ControlEquivalence equivalence(zone(), graph());
     equivalence.Run(node);
diff --git a/deps/v8/test/unittests/compiler/effect-control-linearizer-unittest.cc b/deps/v8/test/unittests/compiler/effect-control-linearizer-unittest.cc
index 5c6de21900ab8f..4c1af5b673b249 100644
--- a/deps/v8/test/unittests/compiler/effect-control-linearizer-unittest.cc
+++ b/deps/v8/test/unittests/compiler/effect-control-linearizer-unittest.cc
@@ -7,6 +7,7 @@
 #include "src/compiler/compiler-source-position-table.h"
 #include "src/compiler/js-graph.h"
 #include "src/compiler/linkage.h"
+#include "src/compiler/node-origin-table.h"
 #include "src/compiler/node-properties.h"
 #include "src/compiler/schedule.h"
 #include "src/compiler/simplified-operator.h"
@@ -32,11 +33,13 @@ class EffectControlLinearizerTest : public GraphTest {
         jsgraph_(isolate(), graph(), common(), &javascript_, &simplified_,
                  &machine_) {
     source_positions_ = new (zone()) SourcePositionTable(graph());
+    node_origins_ = new (zone()) NodeOriginTable(graph());
   }
 
   JSGraph* jsgraph() { return &jsgraph_; }
   SimplifiedOperatorBuilder* simplified() { return &simplified_; }
   SourcePositionTable* source_positions() { return source_positions_; }
+  NodeOriginTable* node_origins() { return node_origins_; }
 
  private:
   MachineOperatorBuilder machine_;
@@ -44,6 +47,7 @@ class EffectControlLinearizerTest : public GraphTest {
   SimplifiedOperatorBuilder simplified_;
   JSGraph jsgraph_;
   SourcePositionTable* source_positions_;
+  NodeOriginTable* node_origins_;
 };
 
 namespace {
@@ -82,7 +86,7 @@ TEST_F(EffectControlLinearizerTest, SimpleLoad) {
 
   // Run the state effect introducer.
   EffectControlLinearizer introducer(
-      jsgraph(), &schedule, zone(), source_positions(),
+      jsgraph(), &schedule, zone(), source_positions(), node_origins(),
       EffectControlLinearizer::kDoNotMaskArrayIndex);
   introducer.Run();
 
@@ -145,7 +149,7 @@ TEST_F(EffectControlLinearizerTest, DiamondLoad) {
 
   // Run the state effect introducer.
   EffectControlLinearizer introducer(
-      jsgraph(), &schedule, zone(), source_positions(),
+      jsgraph(), &schedule, zone(), source_positions(), node_origins(),
       EffectControlLinearizer::kDoNotMaskArrayIndex);
   introducer.Run();
 
@@ -213,7 +217,7 @@ TEST_F(EffectControlLinearizerTest, LoopLoad) {
 
   // Run the state effect introducer.
   EffectControlLinearizer introducer(
-      jsgraph(), &schedule, zone(), source_positions(),
+      jsgraph(), &schedule, zone(), source_positions(), node_origins(),
       EffectControlLinearizer::kDoNotMaskArrayIndex);
   introducer.Run();
 
@@ -277,7 +281,7 @@ TEST_F(EffectControlLinearizerTest, CloneBranch) {
   schedule.AddNode(mblock, graph()->end());
 
   EffectControlLinearizer introducer(
-      jsgraph(), &schedule, zone(), source_positions(),
+      jsgraph(), &schedule, zone(), source_positions(), node_origins(),
       EffectControlLinearizer::kDoNotMaskArrayIndex);
   introducer.Run();
 
diff --git a/deps/v8/test/unittests/compiler/graph-unittest.cc b/deps/v8/test/unittests/compiler/graph-unittest.cc
index 0bdd223d1bb57d..a731a8f1cba401 100644
--- a/deps/v8/test/unittests/compiler/graph-unittest.cc
+++ b/deps/v8/test/unittests/compiler/graph-unittest.cc
@@ -18,7 +18,9 @@ GraphTest::GraphTest(int num_parameters)
       TestWithIsolateAndZone(),
       common_(zone()),
       graph_(zone()),
-      source_positions_(&graph_) {
+      js_heap_broker_(isolate()),
+      source_positions_(&graph_),
+      node_origins_(&graph_) {
   graph()->SetStart(graph()->NewNode(common()->Start(num_parameters)));
   graph()->SetEnd(graph()->NewNode(common()->End(1), graph()->start()));
 }
@@ -59,7 +61,7 @@ Node* GraphTest::NumberConstant(volatile double value) {
 
 Node* GraphTest::HeapConstant(const Handle<HeapObject>& value) {
   Node* node = graph()->NewNode(common()->HeapConstant(value));
-  Type* type = Type::NewConstant(value, zone());
+  Type type = Type::NewConstant(js_heap_broker(), value, zone());
   NodeProperties::SetType(node, type);
   return node;
 }
@@ -109,12 +111,12 @@ Matcher<Node*> GraphTest::IsUndefinedConstant() {
 }
 
 TypedGraphTest::TypedGraphTest(int num_parameters)
-    : GraphTest(num_parameters), typer_(isolate(), Typer::kNoFlags, graph()) {}
+    : GraphTest(num_parameters),
+      typer_(isolate(), js_heap_broker(), Typer::kNoFlags, graph()) {}
 
 TypedGraphTest::~TypedGraphTest() {}
 
-
-Node* TypedGraphTest::Parameter(Type* type, int32_t index) {
+Node* TypedGraphTest::Parameter(Type type, int32_t index) {
   Node* node = GraphTest::Parameter(index);
   NodeProperties::SetType(node, type);
   return node;
diff --git a/deps/v8/test/unittests/compiler/graph-unittest.h b/deps/v8/test/unittests/compiler/graph-unittest.h
index 9d4a15ad276c55..1a9c83bb8af722 100644
--- a/deps/v8/test/unittests/compiler/graph-unittest.h
+++ b/deps/v8/test/unittests/compiler/graph-unittest.h
@@ -8,6 +8,7 @@
 #include "src/compiler/common-operator.h"
 #include "src/compiler/compiler-source-position-table.h"
 #include "src/compiler/graph.h"
+#include "src/compiler/node-origin-table.h"
 #include "src/compiler/typer.h"
 #include "test/unittests/test-utils.h"
 #include "testing/gmock/include/gmock/gmock.h"
@@ -60,11 +61,15 @@ class GraphTest : public virtual TestWithNativeContext,
   CommonOperatorBuilder* common() { return &common_; }
   Graph* graph() { return &graph_; }
   SourcePositionTable* source_positions() { return &source_positions_; }
+  NodeOriginTable* node_origins() { return &node_origins_; }
+  const JSHeapBroker* js_heap_broker() { return &js_heap_broker_; }
 
  private:
   CommonOperatorBuilder common_;
   Graph graph_;
+  JSHeapBroker js_heap_broker_;
   SourcePositionTable source_positions_;
+  NodeOriginTable node_origins_;
 };
 
 
@@ -75,7 +80,7 @@ class TypedGraphTest : public GraphTest {
 
  protected:
   Node* Parameter(int32_t index = 0) { return GraphTest::Parameter(index); }
-  Node* Parameter(Type* type, int32_t index = 0);
+  Node* Parameter(Type type, int32_t index = 0);
 
   Typer* typer() { return &typer_; }
 
diff --git a/deps/v8/test/unittests/compiler/ia32/instruction-selector-ia32-unittest.cc b/deps/v8/test/unittests/compiler/ia32/instruction-selector-ia32-unittest.cc
index ecf76e6146fe48..5b808eab256152 100644
--- a/deps/v8/test/unittests/compiler/ia32/instruction-selector-ia32-unittest.cc
+++ b/deps/v8/test/unittests/compiler/ia32/instruction-selector-ia32-unittest.cc
@@ -853,6 +853,58 @@ TEST_F(InstructionSelectorTest, SpeculationFence) {
   EXPECT_EQ(kLFence, s[0]->arch_opcode());
 }
 
+TEST_F(InstructionSelectorTest, StackCheck0) {
+  ExternalReference js_stack_limit =
+      ExternalReference::Create(isolate()->stack_guard()->address_of_jslimit());
+  StreamBuilder m(this, MachineType::Int32());
+  Node* const sp = m.LoadStackPointer();
+  Node* const stack_limit =
+      m.Load(MachineType::Pointer(), m.ExternalConstant(js_stack_limit));
+  Node* const interrupt = m.UintPtrLessThan(sp, stack_limit);
+
+  RawMachineLabel if_true, if_false;
+  m.Branch(interrupt, &if_true, &if_false);
+
+  m.Bind(&if_true);
+  m.Return(m.Int32Constant(1));
+
+  m.Bind(&if_false);
+  m.Return(m.Int32Constant(0));
+
+  Stream s = m.Build();
+
+  ASSERT_EQ(1U, s.size());
+  EXPECT_EQ(kIA32Cmp, s[0]->arch_opcode());
+  EXPECT_EQ(4U, s[0]->InputCount());
+  EXPECT_EQ(0U, s[0]->OutputCount());
+}
+
+TEST_F(InstructionSelectorTest, StackCheck1) {
+  ExternalReference js_stack_limit =
+      ExternalReference::Create(isolate()->stack_guard()->address_of_jslimit());
+  StreamBuilder m(this, MachineType::Int32());
+  Node* const sp = m.LoadStackPointer();
+  Node* const stack_limit =
+      m.Load(MachineType::Pointer(), m.ExternalConstant(js_stack_limit));
+  Node* const sp_within_limit = m.UintPtrLessThan(stack_limit, sp);
+
+  RawMachineLabel if_true, if_false;
+  m.Branch(sp_within_limit, &if_true, &if_false);
+
+  m.Bind(&if_true);
+  m.Return(m.Int32Constant(1));
+
+  m.Bind(&if_false);
+  m.Return(m.Int32Constant(0));
+
+  Stream s = m.Build();
+
+  ASSERT_EQ(1U, s.size());
+  EXPECT_EQ(kIA32StackCheck, s[0]->arch_opcode());
+  EXPECT_EQ(2U, s[0]->InputCount());
+  EXPECT_EQ(0U, s[0]->OutputCount());
+}
+
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/test/unittests/compiler/instruction-selector-unittest.cc b/deps/v8/test/unittests/compiler/instruction-selector-unittest.cc
index 947bcdf4e4b697..ed4a1c648a6776 100644
--- a/deps/v8/test/unittests/compiler/instruction-selector-unittest.cc
+++ b/deps/v8/test/unittests/compiler/instruction-selector-unittest.cc
@@ -29,9 +29,9 @@ InstructionSelectorTest::Stream InstructionSelectorTest::StreamBuilder::Build(
     InstructionSelector::SourcePositionMode source_position_mode) {
   Schedule* schedule = Export();
   if (FLAG_trace_turbo) {
-    OFStream out(stdout);
-    out << "=== Schedule before instruction selection ===" << std::endl
-        << *schedule;
+    StdoutStream{} << "=== Schedule before instruction selection ==="
+                   << std::endl
+                   << *schedule;
   }
   size_t const node_count = graph()->NodeCount();
   EXPECT_NE(0u, node_count);
@@ -41,20 +41,20 @@ InstructionSelectorTest::Stream InstructionSelectorTest::StreamBuilder::Build(
   InstructionSequence sequence(test_->isolate(), test_->zone(),
                                instruction_blocks);
   SourcePositionTable source_position_table(graph());
-  InstructionSelector selector(test_->zone(), node_count, &linkage, &sequence,
-                               schedule, &source_position_table, nullptr,
-                               InstructionSelector::kEnableSwitchJumpTable,
-                               source_position_mode, features,
-                               InstructionSelector::kDisableScheduling,
-                               InstructionSelector::kDisableSerialization,
-                               PoisoningMitigationLevel::kOn);
+  InstructionSelector selector(
+      test_->zone(), node_count, &linkage, &sequence, schedule,
+      &source_position_table, nullptr,
+      InstructionSelector::kEnableSwitchJumpTable, source_position_mode,
+      features, InstructionSelector::kDisableScheduling,
+      InstructionSelector::kEnableRootsRelativeAddressing,
+      PoisoningMitigationLevel::kPoisonAll);
   selector.SelectInstructions();
   if (FLAG_trace_turbo) {
-    OFStream out(stdout);
     PrintableInstructionSequence printable = {RegisterConfiguration::Default(),
                                               &sequence};
-    out << "=== Code sequence after instruction selection ===" << std::endl
-        << printable;
+    StdoutStream{} << "=== Code sequence after instruction selection ==="
+                   << std::endl
+                   << printable;
   }
   Stream s;
   s.virtual_registers_ = selector.GetVirtualRegistersForTesting();
@@ -422,8 +422,8 @@ TARGET_TEST_F(InstructionSelectorTest, CallStubWithDeopt) {
 
   Callable callable = Builtins::CallableFor(isolate(), Builtins::kToObject);
   auto call_descriptor = Linkage::GetStubCallDescriptor(
-      isolate(), zone(), callable.descriptor(), 1,
-      CallDescriptor::kNeedsFrameState, Operator::kNoProperties);
+      zone(), callable.descriptor(), 1, CallDescriptor::kNeedsFrameState,
+      Operator::kNoProperties);
 
   // Build frame state for the state before the call.
   Node* parameters = m.AddNode(
@@ -517,8 +517,8 @@ TARGET_TEST_F(InstructionSelectorTest, CallStubWithDeoptRecursiveFrameState) {
 
   Callable callable = Builtins::CallableFor(isolate(), Builtins::kToObject);
   auto call_descriptor = Linkage::GetStubCallDescriptor(
-      isolate(), zone(), callable.descriptor(), 1,
-      CallDescriptor::kNeedsFrameState, Operator::kNoProperties);
+      zone(), callable.descriptor(), 1, CallDescriptor::kNeedsFrameState,
+      Operator::kNoProperties);
 
   // Build frame state for the state before the call.
   Node* parameters = m.AddNode(
@@ -618,6 +618,252 @@ TARGET_TEST_F(InstructionSelectorTest, CallStubWithDeoptRecursiveFrameState) {
   EXPECT_EQ(index, s.size());
 }
 
+// Helper to make calls to private InstructionSelector shuffle functions.
+class InstructionSelectorShuffleTest : public ::testing::Test {
+ public:
+  using Shuffle = std::array<uint8_t, kSimd128Size>;
+
+  struct TestShuffle {
+    Shuffle non_canonical;
+    Shuffle canonical;
+    bool needs_swap;
+    bool is_swizzle;
+  };
+
+  // Call testing members in InstructionSelector.
+  static void CanonicalizeShuffle(bool inputs_equal, Shuffle* shuffle,
+                                  bool* needs_swap, bool* is_swizzle) {
+    InstructionSelector::CanonicalizeShuffleForTesting(
+        inputs_equal, &(*shuffle)[0], needs_swap, is_swizzle);
+  }
+
+  static bool TryMatchIdentity(const Shuffle& shuffle) {
+    return InstructionSelector::TryMatchIdentityForTesting(&shuffle[0]);
+  }
+  template <int LANES>
+  static bool TryMatchDup(const Shuffle& shuffle, int* index) {
+    return InstructionSelector::TryMatchDupForTesting<LANES>(&shuffle[0],
+                                                             index);
+  }
+  static bool TryMatch32x4Shuffle(const Shuffle& shuffle,
+                                  uint8_t* shuffle32x4) {
+    return InstructionSelector::TryMatch32x4ShuffleForTesting(&shuffle[0],
+                                                              shuffle32x4);
+  }
+  static bool TryMatch16x8Shuffle(const Shuffle& shuffle,
+                                  uint8_t* shuffle16x8) {
+    return InstructionSelector::TryMatch16x8ShuffleForTesting(&shuffle[0],
+                                                              shuffle16x8);
+  }
+  static bool TryMatchConcat(const Shuffle& shuffle, uint8_t* offset) {
+    return InstructionSelector::TryMatchConcatForTesting(&shuffle[0], offset);
+  }
+  static bool TryMatchBlend(const Shuffle& shuffle) {
+    return InstructionSelector::TryMatchBlendForTesting(&shuffle[0]);
+  }
+};
+
+bool operator==(const InstructionSelectorShuffleTest::Shuffle& a,
+                const InstructionSelectorShuffleTest::Shuffle& b) {
+  for (int i = 0; i < kSimd128Size; ++i) {
+    if (a[i] != b[i]) return false;
+  }
+  return true;
+}
+
+TEST_F(InstructionSelectorShuffleTest, CanonicalizeShuffle) {
+  const bool kInputsEqual = true;
+  const bool kNeedsSwap = true;
+  const bool kIsSwizzle = true;
+
+  bool needs_swap;
+  bool is_swizzle;
+
+  // Test canonicalization driven by input shuffle.
+  TestShuffle test_shuffles[] = {
+      // Identity is canonical.
+      {{{0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15}},
+       {{0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15}},
+       !kNeedsSwap,
+       kIsSwizzle},
+      // Non-canonical identity requires a swap.
+      {{{16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31}},
+       {{0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15}},
+       kNeedsSwap,
+       kIsSwizzle},
+      // General shuffle, canonical is unchanged.
+      {{{0, 16, 1, 17, 2, 18, 3, 19, 4, 20, 5, 21, 6, 22, 7, 23}},
+       {{0, 16, 1, 17, 2, 18, 3, 19, 4, 20, 5, 21, 6, 22, 7, 23}},
+       !kNeedsSwap,
+       !kIsSwizzle},
+      // Non-canonical shuffle requires a swap.
+      {{{16, 0, 17, 1, 18, 2, 19, 3, 20, 4, 21, 5, 22, 6, 23, 7}},
+       {{0, 16, 1, 17, 2, 18, 3, 19, 4, 20, 5, 21, 6, 22, 7, 23}},
+       kNeedsSwap,
+       !kIsSwizzle},
+  };
+  for (size_t i = 0; i < arraysize(test_shuffles); ++i) {
+    Shuffle shuffle = test_shuffles[i].non_canonical;
+    CanonicalizeShuffle(!kInputsEqual, &shuffle, &needs_swap, &is_swizzle);
+    EXPECT_EQ(shuffle, test_shuffles[i].canonical);
+    EXPECT_EQ(needs_swap, test_shuffles[i].needs_swap);
+    EXPECT_EQ(is_swizzle, test_shuffles[i].is_swizzle);
+  }
+
+  // Test canonicalization when inputs are equal (explicit swizzle).
+  TestShuffle test_swizzles[] = {
+      // Identity is canonical.
+      {{{0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15}},
+       {{0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15}},
+       !kNeedsSwap,
+       kIsSwizzle},
+      // Non-canonical identity requires a swap.
+      {{{16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31}},
+       {{0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15}},
+       !kNeedsSwap,
+       kIsSwizzle},
+      // Canonicalized to swizzle.
+      {{{0, 16, 1, 17, 2, 18, 3, 19, 4, 20, 5, 21, 6, 22, 7, 23}},
+       {{0, 0, 1, 1, 2, 2, 3, 3, 4, 4, 5, 5, 6, 6, 7, 7}},
+       !kNeedsSwap,
+       kIsSwizzle},
+      // Canonicalized to swizzle.
+      {{{16, 0, 17, 1, 18, 2, 19, 3, 20, 4, 21, 5, 22, 6, 23, 7}},
+       {{0, 0, 1, 1, 2, 2, 3, 3, 4, 4, 5, 5, 6, 6, 7, 7}},
+       !kNeedsSwap,
+       kIsSwizzle},
+  };
+  for (size_t i = 0; i < arraysize(test_swizzles); ++i) {
+    Shuffle shuffle = test_swizzles[i].non_canonical;
+    CanonicalizeShuffle(kInputsEqual, &shuffle, &needs_swap, &is_swizzle);
+    EXPECT_EQ(shuffle, test_swizzles[i].canonical);
+    EXPECT_EQ(needs_swap, test_swizzles[i].needs_swap);
+    EXPECT_EQ(is_swizzle, test_swizzles[i].is_swizzle);
+  }
+}
+
+TEST_F(InstructionSelectorShuffleTest, TryMatchIdentity) {
+  // Match shuffle that returns first source operand.
+  EXPECT_TRUE(TryMatchIdentity(
+      {{0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15}}));
+  // The non-canonicalized identity shuffle doesn't match.
+  EXPECT_FALSE(TryMatchIdentity(
+      {{16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31}}));
+  // Even one lane out of place is not an identity shuffle.
+  EXPECT_FALSE(TryMatchIdentity(
+      {{0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 31}}));
+}
+
+TEST_F(InstructionSelectorShuffleTest, TryMatchDup) {
+  int index;
+  // All lanes from the same 32 bit source lane.
+  EXPECT_TRUE(TryMatchDup<4>({{4, 5, 6, 7, 4, 5, 6, 7, 4, 5, 6, 7, 4, 5, 6, 7}},
+                             &index));
+  EXPECT_EQ(1, index);
+  // It shouldn't match for other vector shapes.
+  EXPECT_FALSE(TryMatchDup<8>(
+      {{4, 5, 6, 7, 4, 5, 6, 7, 4, 5, 6, 7, 4, 5, 6, 7}}, &index));
+  EXPECT_FALSE(TryMatchDup<16>(
+      {{4, 5, 6, 7, 4, 5, 6, 7, 4, 5, 6, 7, 4, 5, 6, 7}}, &index));
+  // All lanes from the same 16 bit source lane.
+  EXPECT_TRUE(TryMatchDup<8>(
+      {{16, 17, 16, 17, 16, 17, 16, 17, 16, 17, 16, 17, 16, 17, 16, 17}},
+      &index));
+  EXPECT_EQ(8, index);
+  // It shouldn't match for other vector shapes.
+  EXPECT_FALSE(TryMatchDup<4>(
+      {{16, 17, 16, 17, 16, 17, 16, 17, 16, 17, 16, 17, 16, 17, 16, 17}},
+      &index));
+  EXPECT_FALSE(TryMatchDup<16>(
+      {{16, 17, 16, 17, 16, 17, 16, 17, 16, 17, 16, 17, 16, 17, 16, 17}},
+      &index));
+  // All lanes from the same 8 bit source lane.
+  EXPECT_TRUE(TryMatchDup<16>(
+      {{7, 7, 7, 7, 7, 7, 7, 7, 7, 7, 7, 7, 7, 7, 7, 7}}, &index));
+  EXPECT_EQ(7, index);
+  // It shouldn't match for other vector shapes.
+  EXPECT_FALSE(TryMatchDup<4>(
+      {{7, 7, 7, 7, 7, 7, 7, 7, 7, 7, 7, 7, 7, 7, 7, 7}}, &index));
+  EXPECT_FALSE(TryMatchDup<8>(
+      {{7, 7, 7, 7, 7, 7, 7, 7, 7, 7, 7, 7, 7, 7, 7, 7}}, &index));
+}
+
+TEST_F(InstructionSelectorShuffleTest, TryMatchConcat) {
+  uint8_t offset;
+  // Ascending indices, jump at end to same input (concatenating swizzle).
+  EXPECT_TRUE(TryMatchConcat(
+      {{3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 0, 1, 2}}, &offset));
+  EXPECT_EQ(3, offset);
+  // Ascending indices, jump at end to other input (concatenating shuffle).
+  EXPECT_TRUE(TryMatchConcat(
+      {{4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19}}, &offset));
+  EXPECT_EQ(4, offset);
+
+  // Shuffles that should not match:
+  // Ascending indices, but jump isn't at end/beginning.
+  EXPECT_FALSE(TryMatchConcat(
+      {{3, 4, 5, 6, 7, 8, 9, 10, 11, 0, 1, 2, 3, 4, 5, 6}}, &offset));
+  // Ascending indices, but multiple jumps.
+  EXPECT_FALSE(TryMatchConcat(
+      {{0, 1, 2, 3, 0, 1, 2, 3, 0, 1, 2, 3, 0, 1, 2, 3}}, &offset));
+}
+
+TEST_F(InstructionSelectorShuffleTest, TryMatch32x4Shuffle) {
+  uint8_t shuffle32x4[4];
+  // Match if each group of 4 bytes is from the same 32 bit lane.
+  EXPECT_TRUE(TryMatch32x4Shuffle(
+      {{12, 13, 14, 15, 8, 9, 10, 11, 4, 5, 6, 7, 16, 17, 18, 19}},
+      shuffle32x4));
+  EXPECT_EQ(3, shuffle32x4[0]);
+  EXPECT_EQ(2, shuffle32x4[1]);
+  EXPECT_EQ(1, shuffle32x4[2]);
+  EXPECT_EQ(4, shuffle32x4[3]);
+  // Bytes must be in order in the 32 bit lane.
+  EXPECT_FALSE(TryMatch32x4Shuffle(
+      {{12, 13, 14, 14, 8, 9, 10, 11, 4, 5, 6, 7, 16, 17, 18, 19}},
+      shuffle32x4));
+  // Each group must start with the first byte in the 32 bit lane.
+  EXPECT_FALSE(TryMatch32x4Shuffle(
+      {{13, 14, 15, 12, 8, 9, 10, 11, 4, 5, 6, 7, 16, 17, 18, 19}},
+      shuffle32x4));
+}
+
+TEST_F(InstructionSelectorShuffleTest, TryMatch16x8Shuffle) {
+  uint8_t shuffle16x8[8];
+  // Match if each group of 2 bytes is from the same 16 bit lane.
+  EXPECT_TRUE(TryMatch16x8Shuffle(
+      {{12, 13, 30, 31, 8, 9, 26, 27, 4, 5, 22, 23, 16, 17, 2, 3}},
+      shuffle16x8));
+  EXPECT_EQ(6, shuffle16x8[0]);
+  EXPECT_EQ(15, shuffle16x8[1]);
+  EXPECT_EQ(4, shuffle16x8[2]);
+  EXPECT_EQ(13, shuffle16x8[3]);
+  EXPECT_EQ(2, shuffle16x8[4]);
+  EXPECT_EQ(11, shuffle16x8[5]);
+  EXPECT_EQ(8, shuffle16x8[6]);
+  EXPECT_EQ(1, shuffle16x8[7]);
+  // Bytes must be in order in the 16 bit lane.
+  EXPECT_FALSE(TryMatch16x8Shuffle(
+      {{12, 13, 30, 30, 8, 9, 26, 27, 4, 5, 22, 23, 16, 17, 2, 3}},
+      shuffle16x8));
+  // Each group must start with the first byte in the 16 bit lane.
+  EXPECT_FALSE(TryMatch16x8Shuffle(
+      {{12, 13, 31, 30, 8, 9, 26, 27, 4, 5, 22, 23, 16, 17, 2, 3}},
+      shuffle16x8));
+}
+
+TEST_F(InstructionSelectorShuffleTest, TryMatchBlend) {
+  // Match if each byte remains in place.
+  EXPECT_TRUE(TryMatchBlend(
+      {{0, 17, 2, 19, 4, 21, 6, 23, 8, 25, 10, 27, 12, 29, 14, 31}}));
+  // Identity is a blend.
+  EXPECT_TRUE(
+      TryMatchBlend({{0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15}}));
+  // Even one lane out of place is not a blend.
+  EXPECT_FALSE(TryMatchBlend(
+      {{1, 17, 2, 19, 4, 21, 6, 23, 8, 25, 10, 27, 12, 29, 14, 31}}));
+}
+
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/test/unittests/compiler/instruction-selector-unittest.h b/deps/v8/test/unittests/compiler/instruction-selector-unittest.h
index cc6a4f633d0188..19f85ff1ffa379 100644
--- a/deps/v8/test/unittests/compiler/instruction-selector-unittest.h
+++ b/deps/v8/test/unittests/compiler/instruction-selector-unittest.h
@@ -163,7 +163,7 @@ class InstructionSelectorTest : public TestWithContext,
           Operator::kNoProperties,       // properties
           kCalleeSaveRegisters,          // callee-saved registers
           kCalleeSaveFPRegisters,        // callee-saved fp regs
-          CallDescriptor::kNoFlags,      // flags
+          CallDescriptor::kCanUseRoots,  // flags
           "iselect-test-call");
     }
   };
diff --git a/deps/v8/test/unittests/compiler/instruction-sequence-unittest.cc b/deps/v8/test/unittests/compiler/instruction-sequence-unittest.cc
index 17d1572e9881cb..2dd910aafbcc31 100644
--- a/deps/v8/test/unittests/compiler/instruction-sequence-unittest.cc
+++ b/deps/v8/test/unittests/compiler/instruction-sequence-unittest.cc
@@ -159,6 +159,10 @@ Instruction* InstructionSequenceTest::EndBlock(BlockCompletion completion) {
   }
   completions_.push_back(completion);
   CHECK_NOT_NULL(current_block_);
+  int end = static_cast<int>(sequence()->instructions().size());
+  if (current_block_->code_start() == end) {  // Empty block.  Insert a nop.
+    sequence()->AddInstruction(Instruction::New(zone(), kArchNop));
+  }
   sequence()->EndBlock(current_block_->rpo_number());
   current_block_ = nullptr;
   return result;
@@ -507,6 +511,7 @@ void InstructionSequenceTest::WireBlocks() {
   CHECK(loop_blocks_.empty());
   // Wire in end block to look like a scheduler produced cfg.
   auto end_block = NewBlock();
+  Emit(kArchNop);
   current_block_ = nullptr;
   sequence()->EndBlock(end_block->rpo_number());
   size_t offset = 0;
diff --git a/deps/v8/test/unittests/compiler/int64-lowering-unittest.cc b/deps/v8/test/unittests/compiler/int64-lowering-unittest.cc
index 0d949f7c0d6093..5897187ae47174 100644
--- a/deps/v8/test/unittests/compiler/int64-lowering-unittest.cc
+++ b/deps/v8/test/unittests/compiler/int64-lowering-unittest.cc
@@ -6,16 +6,13 @@
 #include "src/compiler/common-operator.h"
 #include "src/compiler/linkage.h"
 #include "src/compiler/machine-operator.h"
+#include "src/compiler/node-properties.h"
 #include "src/compiler/node.h"
 #include "src/compiler/wasm-compiler.h"
-
-#include "src/compiler/node-properties.h"
-
 #include "src/objects-inl.h"
 #include "src/signature.h"
-
+#include "src/wasm/value-type.h"
 #include "src/wasm/wasm-module.h"
-
 #include "test/unittests/compiler/graph-unittest.h"
 #include "test/unittests/compiler/node-test-utils.h"
 #include "testing/gmock-support.h"
@@ -334,8 +331,8 @@ TEST_F(Int64LoweringTest, CallI64Return) {
   int32_t function = 0x9999;
   Node* context_address = Int32Constant(0);
 
-  Signature<MachineRepresentation>::Builder sig_builder(zone(), 1, 0);
-  sig_builder.AddReturn(MachineRepresentation::kWord64);
+  wasm::FunctionSig::Builder sig_builder(zone(), 1, 0);
+  sig_builder.AddReturn(wasm::kWasmI64);
 
   auto call_descriptor =
       compiler::GetWasmCallDescriptor(zone(), sig_builder.Build());
@@ -364,11 +361,11 @@ TEST_F(Int64LoweringTest, CallI64Parameter) {
   int32_t function = 0x9999;
   Node* context_address = Int32Constant(0);
 
-  Signature<MachineRepresentation>::Builder sig_builder(zone(), 1, 3);
-  sig_builder.AddReturn(MachineRepresentation::kWord32);
-  sig_builder.AddParam(MachineRepresentation::kWord64);
-  sig_builder.AddParam(MachineRepresentation::kWord32);
-  sig_builder.AddParam(MachineRepresentation::kWord64);
+  wasm::FunctionSig::Builder sig_builder(zone(), 1, 3);
+  sig_builder.AddReturn(wasm::kWasmI32);
+  sig_builder.AddParam(wasm::kWasmI64);
+  sig_builder.AddParam(wasm::kWasmI32);
+  sig_builder.AddParam(wasm::kWasmI64);
 
   auto call_descriptor =
       compiler::GetWasmCallDescriptor(zone(), sig_builder.Build());
diff --git a/deps/v8/test/unittests/compiler/js-builtin-reducer-unittest.cc b/deps/v8/test/unittests/compiler/js-builtin-reducer-unittest.cc
deleted file mode 100644
index a110b87a3355d8..00000000000000
--- a/deps/v8/test/unittests/compiler/js-builtin-reducer-unittest.cc
+++ /dev/null
@@ -1,242 +0,0 @@
-// Copyright 2014 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "src/compiler/js-builtin-reducer.h"
-#include "src/compiler/js-graph.h"
-#include "src/compiler/node-properties.h"
-#include "src/compiler/simplified-operator.h"
-#include "src/compiler/typer.h"
-#include "src/isolate-inl.h"
-#include "test/unittests/compiler/graph-unittest.h"
-#include "test/unittests/compiler/node-test-utils.h"
-#include "testing/gmock-support.h"
-
-using testing::BitEq;
-using testing::Capture;
-
-namespace v8 {
-namespace internal {
-namespace compiler {
-
-class JSBuiltinReducerTest : public TypedGraphTest {
- public:
-  JSBuiltinReducerTest() : javascript_(zone()) {}
-
- protected:
-  Reduction Reduce(Node* node, MachineOperatorBuilder::Flags flags =
-                                   MachineOperatorBuilder::Flag::kNoFlags) {
-    MachineOperatorBuilder machine(zone(), MachineType::PointerRepresentation(),
-                                   flags);
-    SimplifiedOperatorBuilder simplified(zone());
-    JSGraph jsgraph(isolate(), graph(), common(), javascript(), &simplified,
-                    &machine);
-    // TODO(titzer): mock the GraphReducer here for better unit testing.
-    GraphReducer graph_reducer(zone(), graph());
-
-    JSBuiltinReducer reducer(&graph_reducer, &jsgraph, nullptr,
-                             native_context());
-    return reducer.Reduce(node);
-  }
-
-  Node* GlobalFunction(const char* name) {
-    Handle<JSFunction> f = Handle<JSFunction>::cast(
-        Object::GetProperty(
-            isolate()->global_object(),
-            isolate()->factory()->NewStringFromAsciiChecked(name))
-            .ToHandleChecked());
-    return HeapConstant(f);
-  }
-
-  Node* MathFunction(const char* name) {
-    Handle<Object> m =
-        JSObject::GetProperty(isolate()->global_object(),
-                              isolate()->factory()->NewStringFromAsciiChecked(
-                                  "Math")).ToHandleChecked();
-    Handle<JSFunction> f = Handle<JSFunction>::cast(
-        Object::GetProperty(
-            m, isolate()->factory()->NewStringFromAsciiChecked(name))
-            .ToHandleChecked());
-    return HeapConstant(f);
-  }
-
-  Node* NumberFunction(const char* name) {
-    Handle<Object> m =
-        JSObject::GetProperty(
-            isolate()->global_object(),
-            isolate()->factory()->NewStringFromAsciiChecked("Number"))
-            .ToHandleChecked();
-    Handle<JSFunction> f = Handle<JSFunction>::cast(
-        Object::GetProperty(
-            m, isolate()->factory()->NewStringFromAsciiChecked(name))
-            .ToHandleChecked());
-    return HeapConstant(f);
-  }
-
-  Node* StringFunction(const char* name) {
-    Handle<Object> m =
-        JSObject::GetProperty(
-            isolate()->global_object(),
-            isolate()->factory()->NewStringFromAsciiChecked("String"))
-            .ToHandleChecked();
-    Handle<JSFunction> f = Handle<JSFunction>::cast(
-        Object::GetProperty(
-            m, isolate()->factory()->NewStringFromAsciiChecked(name))
-            .ToHandleChecked());
-    return HeapConstant(f);
-  }
-
-  JSOperatorBuilder* javascript() { return &javascript_; }
-
- private:
-  JSOperatorBuilder javascript_;
-};
-
-
-namespace {
-
-Type* const kIntegral32Types[] = {Type::UnsignedSmall(), Type::Negative32(),
-                                  Type::Unsigned31(),    Type::SignedSmall(),
-                                  Type::Signed32(),      Type::Unsigned32(),
-                                  Type::Integral32()};
-
-
-Type* const kNumberTypes[] = {
-    Type::UnsignedSmall(), Type::Negative32(),  Type::Unsigned31(),
-    Type::SignedSmall(),   Type::Signed32(),    Type::Unsigned32(),
-    Type::Integral32(),    Type::MinusZero(),   Type::NaN(),
-    Type::OrderedNumber(), Type::PlainNumber(), Type::Number()};
-
-}  // namespace
-
-
-// -----------------------------------------------------------------------------
-// isFinite
-
-TEST_F(JSBuiltinReducerTest, GlobalIsFiniteWithNumber) {
-  Node* function = GlobalFunction("isFinite");
-
-  Node* effect = graph()->start();
-  Node* control = graph()->start();
-  Node* context = UndefinedConstant();
-  Node* frame_state = graph()->start();
-  TRACED_FOREACH(Type*, t0, kNumberTypes) {
-    Node* p0 = Parameter(t0, 0);
-    Node* call =
-        graph()->NewNode(javascript()->Call(3), function, UndefinedConstant(),
-                         p0, context, frame_state, effect, control);
-    Reduction r = Reduce(call);
-
-    ASSERT_TRUE(r.Changed());
-    EXPECT_THAT(r.replacement(), IsNumberEqual(IsNumberSubtract(p0, p0),
-                                               IsNumberSubtract(p0, p0)));
-  }
-}
-
-TEST_F(JSBuiltinReducerTest, GlobalIsFiniteWithPlainPrimitive) {
-  Node* function = GlobalFunction("isFinite");
-
-  Node* effect = graph()->start();
-  Node* control = graph()->start();
-  Node* context = UndefinedConstant();
-  Node* frame_state = graph()->start();
-  Node* p0 = Parameter(Type::PlainPrimitive(), 0);
-  Node* call =
-      graph()->NewNode(javascript()->Call(3), function, UndefinedConstant(), p0,
-                       context, frame_state, effect, control);
-  Reduction r = Reduce(call);
-
-  ASSERT_TRUE(r.Changed());
-  EXPECT_THAT(r.replacement(),
-              IsNumberEqual(IsNumberSubtract(IsPlainPrimitiveToNumber(p0),
-                                             IsPlainPrimitiveToNumber(p0)),
-                            IsNumberSubtract(IsPlainPrimitiveToNumber(p0),
-                                             IsPlainPrimitiveToNumber(p0))));
-}
-
-// -----------------------------------------------------------------------------
-// isNaN
-
-TEST_F(JSBuiltinReducerTest, GlobalIsNaNWithNumber) {
-  Node* function = GlobalFunction("isNaN");
-
-  Node* effect = graph()->start();
-  Node* control = graph()->start();
-  Node* context = UndefinedConstant();
-  Node* frame_state = graph()->start();
-  TRACED_FOREACH(Type*, t0, kNumberTypes) {
-    Node* p0 = Parameter(t0, 0);
-    Node* call =
-        graph()->NewNode(javascript()->Call(3), function, UndefinedConstant(),
-                         p0, context, frame_state, effect, control);
-    Reduction r = Reduce(call);
-
-    ASSERT_TRUE(r.Changed());
-    EXPECT_THAT(r.replacement(), IsBooleanNot(IsNumberEqual(p0, p0)));
-  }
-}
-
-TEST_F(JSBuiltinReducerTest, GlobalIsNaNWithPlainPrimitive) {
-  Node* function = GlobalFunction("isNaN");
-
-  Node* effect = graph()->start();
-  Node* control = graph()->start();
-  Node* context = UndefinedConstant();
-  Node* frame_state = graph()->start();
-  Node* p0 = Parameter(Type::PlainPrimitive(), 0);
-  Node* call =
-      graph()->NewNode(javascript()->Call(3), function, UndefinedConstant(), p0,
-                       context, frame_state, effect, control);
-  Reduction r = Reduce(call);
-
-  ASSERT_TRUE(r.Changed());
-  EXPECT_THAT(r.replacement(),
-              IsBooleanNot(IsNumberEqual(IsPlainPrimitiveToNumber(p0),
-                                         IsPlainPrimitiveToNumber(p0))));
-}
-
-// -----------------------------------------------------------------------------
-// Number.parseInt
-
-TEST_F(JSBuiltinReducerTest, NumberParseIntWithIntegral32) {
-  Node* function = NumberFunction("parseInt");
-
-  Node* effect = graph()->start();
-  Node* control = graph()->start();
-  Node* context = UndefinedConstant();
-  Node* frame_state = graph()->start();
-  TRACED_FOREACH(Type*, t0, kIntegral32Types) {
-    Node* p0 = Parameter(t0, 0);
-    Node* call =
-        graph()->NewNode(javascript()->Call(3), function, UndefinedConstant(),
-                         p0, context, frame_state, effect, control);
-    Reduction r = Reduce(call);
-
-    ASSERT_TRUE(r.Changed());
-    EXPECT_EQ(p0, r.replacement());
-  }
-}
-
-TEST_F(JSBuiltinReducerTest, NumberParseIntWithIntegral32AndUndefined) {
-  Node* function = NumberFunction("parseInt");
-
-  Node* effect = graph()->start();
-  Node* control = graph()->start();
-  Node* context = UndefinedConstant();
-  Node* frame_state = graph()->start();
-  TRACED_FOREACH(Type*, t0, kIntegral32Types) {
-    Node* p0 = Parameter(t0, 0);
-    Node* p1 = Parameter(Type::Undefined(), 1);
-    Node* call =
-        graph()->NewNode(javascript()->Call(4), function, UndefinedConstant(),
-                         p0, p1, context, frame_state, effect, control);
-    Reduction r = Reduce(call);
-
-    ASSERT_TRUE(r.Changed());
-    EXPECT_EQ(p0, r.replacement());
-  }
-}
-
-}  // namespace compiler
-}  // namespace internal
-}  // namespace v8
diff --git a/deps/v8/test/unittests/compiler/js-call-reducer-unittest.cc b/deps/v8/test/unittests/compiler/js-call-reducer-unittest.cc
index 9b0010796d7db6..606bca59b11f7d 100644
--- a/deps/v8/test/unittests/compiler/js-call-reducer-unittest.cc
+++ b/deps/v8/test/unittests/compiler/js-call-reducer-unittest.cc
@@ -4,7 +4,7 @@
 
 #include <cctype>
 
-#include "src/compilation-dependencies.h"
+#include "src/compiler/compilation-dependencies.h"
 #include "src/compiler/js-call-reducer.h"
 #include "src/compiler/js-graph.h"
 #include "src/compiler/simplified-operator.h"
@@ -21,7 +21,10 @@ namespace compiler {
 class JSCallReducerTest : public TypedGraphTest {
  public:
   JSCallReducerTest()
-      : TypedGraphTest(3), javascript_(zone()), deps_(isolate(), zone()) {}
+      : TypedGraphTest(3),
+        javascript_(zone()),
+        deps_(isolate(), zone()),
+        js_heap_broker(isolate()) {}
   ~JSCallReducerTest() override {}
 
  protected:
@@ -33,8 +36,8 @@ class JSCallReducerTest : public TypedGraphTest {
     // TODO(titzer): mock the GraphReducer here for better unit testing.
     GraphReducer graph_reducer(zone(), graph());
 
-    JSCallReducer reducer(&graph_reducer, &jsgraph, JSCallReducer::kNoFlags,
-                          native_context(), &deps_);
+    JSCallReducer reducer(&graph_reducer, &jsgraph, &js_heap_broker,
+                          JSCallReducer::kNoFlags, native_context(), &deps_);
     return reducer.Reduce(node);
   }
 
@@ -54,10 +57,19 @@ class JSCallReducerTest : public TypedGraphTest {
     i::FLAG_lazy_handler_deserialization = old_flag_lazy_handler_;
   }
 
+  Node* GlobalFunction(const char* name) {
+    Handle<JSFunction> f = Handle<JSFunction>::cast(
+        Object::GetProperty(
+            isolate()->global_object(),
+            isolate()->factory()->NewStringFromAsciiChecked(name))
+            .ToHandleChecked());
+    return HeapConstant(f);
+  }
+
   Node* MathFunction(const std::string& name) {
     Handle<Object> m =
         JSObject::GetProperty(
-            isolate()->global_object(),
+            isolate(), isolate()->global_object(),
             isolate()->factory()->NewStringFromAsciiChecked("Math"))
             .ToHandleChecked();
     Handle<JSFunction> f = Handle<JSFunction>::cast(
@@ -70,7 +82,7 @@ class JSCallReducerTest : public TypedGraphTest {
   Node* StringFunction(const char* name) {
     Handle<Object> m =
         JSObject::GetProperty(
-            isolate()->global_object(),
+            isolate(), isolate()->global_object(),
             isolate()->factory()->NewStringFromAsciiChecked("String"))
             .ToHandleChecked();
     Handle<JSFunction> f = Handle<JSFunction>::cast(
@@ -83,7 +95,7 @@ class JSCallReducerTest : public TypedGraphTest {
   Node* NumberFunction(const char* name) {
     Handle<Object> m =
         JSObject::GetProperty(
-            isolate()->global_object(),
+            isolate(), isolate()->global_object(),
             isolate()->factory()->NewStringFromAsciiChecked("Number"))
             .ToHandleChecked();
     Handle<JSFunction> f = Handle<JSFunction>::cast(
@@ -120,13 +132,15 @@ class JSCallReducerTest : public TypedGraphTest {
  private:
   JSOperatorBuilder javascript_;
   CompilationDependencies deps_;
+  JSHeapBroker js_heap_broker;
 
   static bool old_flag_lazy_;
   static bool old_flag_lazy_handler_;
 };
 
 TEST_F(JSCallReducerTest, PromiseConstructorNoArgs) {
-  Node* promise = HeapConstant(handle(native_context()->promise_function()));
+  Node* promise =
+      HeapConstant(handle(native_context()->promise_function(), isolate()));
   Node* effect = graph()->start();
   Node* control = graph()->start();
   Node* context = UndefinedConstant();
@@ -142,8 +156,10 @@ TEST_F(JSCallReducerTest, PromiseConstructorNoArgs) {
 }
 
 TEST_F(JSCallReducerTest, PromiseConstructorSubclass) {
-  Node* promise = HeapConstant(handle(native_context()->promise_function()));
-  Node* new_target = HeapConstant(handle(native_context()->array_function()));
+  Node* promise =
+      HeapConstant(handle(native_context()->promise_function(), isolate()));
+  Node* new_target =
+      HeapConstant(handle(native_context()->array_function(), isolate()));
   Node* effect = graph()->start();
   Node* control = graph()->start();
   Node* context = UndefinedConstant();
@@ -160,7 +176,8 @@ TEST_F(JSCallReducerTest, PromiseConstructorSubclass) {
 }
 
 TEST_F(JSCallReducerTest, PromiseConstructorBasic) {
-  Node* promise = HeapConstant(handle(native_context()->promise_function()));
+  Node* promise =
+      HeapConstant(handle(native_context()->promise_function(), isolate()));
   Node* effect = graph()->start();
   Node* control = graph()->start();
   Node* context = UndefinedConstant();
@@ -183,7 +200,8 @@ TEST_F(JSCallReducerTest, PromiseConstructorBasic) {
 // Exactly the same as PromiseConstructorBasic which expects a reduction,
 // except that we invalidate the protector cell.
 TEST_F(JSCallReducerTest, PromiseConstructorWithHook) {
-  Node* promise = HeapConstant(handle(native_context()->promise_function()));
+  Node* promise =
+      HeapConstant(handle(native_context()->promise_function(), isolate()));
   Node* effect = graph()->start();
   Node* control = graph()->start();
   Node* context = UndefinedConstant();
@@ -535,6 +553,64 @@ TEST_F(JSCallReducerTest, NumberIsSafeIntegerWithIntegral32) {
   EXPECT_THAT(r.replacement(), IsObjectIsSafeInteger(p0));
 }
 
+// -----------------------------------------------------------------------------
+// isFinite
+
+TEST_F(JSCallReducerTest, GlobalIsFiniteWithNumber) {
+  Node* function = GlobalFunction("isFinite");
+
+  Node* effect = graph()->start();
+  Node* control = graph()->start();
+  Node* context = UndefinedConstant();
+  Node* frame_state = graph()->start();
+  Node* p0 = Parameter(Type::Any(), 0);
+  Node* call = graph()->NewNode(Call(3), function, UndefinedConstant(), p0,
+                                context, frame_state, effect, control);
+  Reduction r = Reduce(call);
+
+  ASSERT_TRUE(r.Changed());
+  EXPECT_THAT(r.replacement(), IsNumberIsFinite(IsSpeculativeToNumber(p0)));
+}
+
+// -----------------------------------------------------------------------------
+// isNaN
+
+TEST_F(JSCallReducerTest, GlobalIsNaN) {
+  Node* function = GlobalFunction("isNaN");
+
+  Node* effect = graph()->start();
+  Node* control = graph()->start();
+  Node* context = UndefinedConstant();
+  Node* frame_state = graph()->start();
+  Node* p0 = Parameter(Type::Any(), 0);
+  Node* call = graph()->NewNode(Call(3), function, UndefinedConstant(), p0,
+                                context, frame_state, effect, control);
+  Reduction r = Reduce(call);
+
+  ASSERT_TRUE(r.Changed());
+  EXPECT_THAT(r.replacement(), IsNumberIsNaN(IsSpeculativeToNumber(p0)));
+}
+
+// -----------------------------------------------------------------------------
+// Number.parseInt
+
+TEST_F(JSCallReducerTest, NumberParseInt) {
+  Node* function = NumberFunction("parseInt");
+
+  Node* effect = graph()->start();
+  Node* control = graph()->start();
+  Node* context = UndefinedConstant();
+  Node* frame_state = graph()->start();
+  Node* p0 = Parameter(Type::Any(), 0);
+  Node* p1 = Parameter(Type::Any(), 1);
+  Node* call = graph()->NewNode(Call(4), function, UndefinedConstant(), p0, p1,
+                                context, frame_state, effect, control);
+  Reduction r = Reduce(call);
+
+  ASSERT_TRUE(r.Changed());
+  EXPECT_THAT(r.replacement(), IsJSParseInt(p0, p1));
+}
+
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/test/unittests/compiler/js-create-lowering-unittest.cc b/deps/v8/test/unittests/compiler/js-create-lowering-unittest.cc
index e185c647955c24..2db241aaa9ed0f 100644
--- a/deps/v8/test/unittests/compiler/js-create-lowering-unittest.cc
+++ b/deps/v8/test/unittests/compiler/js-create-lowering-unittest.cc
@@ -4,8 +4,8 @@
 
 #include "src/compiler/js-create-lowering.h"
 #include "src/code-factory.h"
-#include "src/compilation-dependencies.h"
 #include "src/compiler/access-builder.h"
+#include "src/compiler/compilation-dependencies.h"
 #include "src/compiler/js-graph.h"
 #include "src/compiler/js-operator.h"
 #include "src/compiler/machine-operator.h"
@@ -13,6 +13,7 @@
 #include "src/compiler/operator-properties.h"
 #include "src/feedback-vector.h"
 #include "src/isolate-inl.h"
+#include "src/objects/arguments.h"
 #include "test/unittests/compiler/compiler-test-utils.h"
 #include "test/unittests/compiler/graph-unittest.h"
 #include "test/unittests/compiler/node-test-utils.h"
@@ -29,7 +30,10 @@ namespace compiler {
 class JSCreateLoweringTest : public TypedGraphTest {
  public:
   JSCreateLoweringTest()
-      : TypedGraphTest(3), javascript_(zone()), deps_(isolate(), zone()) {}
+      : TypedGraphTest(3),
+        javascript_(zone()),
+        deps_(isolate(), zone()),
+        handle_scope_(isolate()) {}
   ~JSCreateLoweringTest() override {}
 
  protected:
@@ -40,8 +44,8 @@ class JSCreateLoweringTest : public TypedGraphTest {
                     &machine);
     // TODO(titzer): mock the GraphReducer here for better unit testing.
     GraphReducer graph_reducer(zone(), graph());
-    JSCreateLowering reducer(&graph_reducer, &deps_, &jsgraph, native_context(),
-                             zone());
+    JSCreateLowering reducer(&graph_reducer, &deps_, &jsgraph, js_heap_broker(),
+                             native_context(), zone());
     return reducer.Reduce(node);
   }
 
@@ -62,6 +66,7 @@ class JSCreateLoweringTest : public TypedGraphTest {
  private:
   JSOperatorBuilder javascript_;
   CompilationDependencies deps_;
+  CanonicalHandleScope handle_scope_;
 };
 
 // -----------------------------------------------------------------------------
@@ -69,7 +74,8 @@ class JSCreateLoweringTest : public TypedGraphTest {
 
 TEST_F(JSCreateLoweringTest, JSCreate) {
   Handle<JSFunction> function = isolate()->object_function();
-  Node* const target = Parameter(Type::HeapConstant(function, graph()->zone()));
+  Node* const target = Parameter(
+      Type::HeapConstant(js_heap_broker(), function, graph()->zone()));
   Node* const context = Parameter(Type::Any());
   Node* const effect = graph()->start();
   Node* const control = graph()->start();
@@ -92,7 +98,8 @@ TEST_F(JSCreateLoweringTest, JSCreateArgumentsInlinedMapped) {
   Node* const closure = Parameter(Type::Any());
   Node* const context = UndefinedConstant();
   Node* const effect = graph()->start();
-  Handle<SharedFunctionInfo> shared(isolate()->script_function()->shared());
+  Handle<SharedFunctionInfo> shared(isolate()->regexp_function()->shared(),
+                                    isolate());
   Node* const frame_state_outer = FrameState(shared, graph()->start());
   Node* const frame_state_inner = FrameState(shared, frame_state_outer);
   Reduction r = Reduce(graph()->NewNode(
@@ -110,7 +117,8 @@ TEST_F(JSCreateLoweringTest, JSCreateArgumentsInlinedUnmapped) {
   Node* const closure = Parameter(Type::Any());
   Node* const context = UndefinedConstant();
   Node* const effect = graph()->start();
-  Handle<SharedFunctionInfo> shared(isolate()->script_function()->shared());
+  Handle<SharedFunctionInfo> shared(isolate()->regexp_function()->shared(),
+                                    isolate());
   Node* const frame_state_outer = FrameState(shared, graph()->start());
   Node* const frame_state_inner = FrameState(shared, frame_state_outer);
   Reduction r = Reduce(graph()->NewNode(
@@ -128,7 +136,8 @@ TEST_F(JSCreateLoweringTest, JSCreateArgumentsInlinedRestArray) {
   Node* const closure = Parameter(Type::Any());
   Node* const context = UndefinedConstant();
   Node* const effect = graph()->start();
-  Handle<SharedFunctionInfo> shared(isolate()->script_function()->shared());
+  Handle<SharedFunctionInfo> shared(isolate()->regexp_function()->shared(),
+                                    isolate());
   Node* const frame_state_outer = FrameState(shared, graph()->start());
   Node* const frame_state_inner = FrameState(shared, frame_state_outer);
   Reduction r = Reduce(graph()->NewNode(
@@ -144,13 +153,13 @@ TEST_F(JSCreateLoweringTest, JSCreateArgumentsInlinedRestArray) {
 // JSCreateFunctionContext
 
 TEST_F(JSCreateLoweringTest, JSCreateFunctionContextViaInlinedAllocation) {
-  Node* const closure = Parameter(Type::Any());
   Node* const context = Parameter(Type::Any());
   Node* const effect = graph()->start();
   Node* const control = graph()->start();
-  Reduction const r = Reduce(
-      graph()->NewNode(javascript()->CreateFunctionContext(8, FUNCTION_SCOPE),
-                       closure, context, effect, control));
+  Reduction const r = Reduce(graph()->NewNode(
+      javascript()->CreateFunctionContext(
+          handle(ScopeInfo::Empty(isolate()), isolate()), 8, FUNCTION_SCOPE),
+      context, effect, control));
   ASSERT_TRUE(r.Changed());
   EXPECT_THAT(r.replacement(),
               IsFinishRegion(IsAllocate(IsNumberConstant(Context::SizeFor(
@@ -165,13 +174,12 @@ TEST_F(JSCreateLoweringTest, JSCreateFunctionContextViaInlinedAllocation) {
 TEST_F(JSCreateLoweringTest, JSCreateWithContext) {
   Handle<ScopeInfo> scope_info(factory()->NewScopeInfo(1));
   Node* const object = Parameter(Type::Receiver());
-  Node* const closure = Parameter(Type::Function());
   Node* const context = Parameter(Type::Any());
   Node* const effect = graph()->start();
   Node* const control = graph()->start();
   Reduction r =
       Reduce(graph()->NewNode(javascript()->CreateWithContext(scope_info),
-                              object, closure, context, effect, control));
+                              object, context, effect, control));
   ASSERT_TRUE(r.Changed());
   EXPECT_THAT(r.replacement(),
               IsFinishRegion(IsAllocate(IsNumberConstant(Context::SizeFor(
@@ -184,16 +192,14 @@ TEST_F(JSCreateLoweringTest, JSCreateWithContext) {
 // JSCreateCatchContext
 
 TEST_F(JSCreateLoweringTest, JSCreateCatchContext) {
-  Handle<String> name = factory()->length_string();
   Handle<ScopeInfo> scope_info(factory()->NewScopeInfo(1));
   Node* const exception = Parameter(Type::Receiver());
-  Node* const closure = Parameter(Type::Function());
   Node* const context = Parameter(Type::Any());
   Node* const effect = graph()->start();
   Node* const control = graph()->start();
-  Reduction r = Reduce(
-      graph()->NewNode(javascript()->CreateCatchContext(name, scope_info),
-                       exception, closure, context, effect, control));
+  Reduction r =
+      Reduce(graph()->NewNode(javascript()->CreateCatchContext(scope_info),
+                              exception, context, effect, control));
   ASSERT_TRUE(r.Changed());
   EXPECT_THAT(r.replacement(),
               IsFinishRegion(IsAllocate(IsNumberConstant(Context::SizeFor(
diff --git a/deps/v8/test/unittests/compiler/js-typed-lowering-unittest.cc b/deps/v8/test/unittests/compiler/js-typed-lowering-unittest.cc
index b07dbfd0dc748d..9ce837cd8c5b93 100644
--- a/deps/v8/test/unittests/compiler/js-typed-lowering-unittest.cc
+++ b/deps/v8/test/unittests/compiler/js-typed-lowering-unittest.cc
@@ -29,8 +29,8 @@ namespace {
 
 const size_t kIndices[] = {0, 1, 42, 100, 1024};
 
-Type* const kJSTypes[] = {Type::Undefined(), Type::Null(),   Type::Boolean(),
-                          Type::Number(),    Type::String(), Type::Object()};
+Type const kJSTypes[] = {Type::Undefined(), Type::Null(),   Type::Boolean(),
+                         Type::Number(),    Type::String(), Type::Object()};
 
 }  // namespace
 
@@ -48,7 +48,7 @@ class JSTypedLoweringTest : public TypedGraphTest {
                     &machine);
     // TODO(titzer): mock the GraphReducer here for better unit testing.
     GraphReducer graph_reducer(zone(), graph());
-    JSTypedLowering reducer(&graph_reducer, &jsgraph, zone());
+    JSTypedLowering reducer(&graph_reducer, &jsgraph, js_heap_broker(), zone());
     return reducer.Reduce(node);
   }
 
@@ -175,7 +175,7 @@ TEST_F(JSTypedLoweringTest, JSStrictEqualWithTheHole) {
   Node* const context = UndefinedConstant();
   Node* const effect = graph()->start();
   Node* const control = graph()->start();
-  TRACED_FOREACH(Type*, type, kJSTypes) {
+  TRACED_FOREACH(Type, type, kJSTypes) {
     Node* const lhs = Parameter(type);
     Reduction r = Reduce(
         graph()->NewNode(javascript()->StrictEqual(CompareOperationHint::kAny),
@@ -341,7 +341,7 @@ TEST_F(JSTypedLoweringTest, JSStoreContext) {
   Node* const effect = graph()->start();
   Node* const control = graph()->start();
   TRACED_FOREACH(size_t, index, kIndices) {
-    TRACED_FOREACH(Type*, type, kJSTypes) {
+    TRACED_FOREACH(Type, type, kJSTypes) {
       Node* const value = Parameter(type);
 
       Reduction const r1 =
diff --git a/deps/v8/test/unittests/compiler/loop-peeling-unittest.cc b/deps/v8/test/unittests/compiler/loop-peeling-unittest.cc
index ef129fa7f32d10..d39336dfa54a39 100644
--- a/deps/v8/test/unittests/compiler/loop-peeling-unittest.cc
+++ b/deps/v8/test/unittests/compiler/loop-peeling-unittest.cc
@@ -63,8 +63,7 @@ class LoopPeelingTest : public GraphTest {
 
   LoopTree* GetLoopTree() {
     if (FLAG_trace_turbo_graph) {
-      OFStream os(stdout);
-      os << AsRPO(*graph());
+      StdoutStream{} << AsRPO(*graph());
     }
     Zone zone(isolate()->allocator(), ZONE_NAME);
     return LoopFinder::BuildLoopTree(graph(), &zone);
@@ -74,7 +73,8 @@ class LoopPeelingTest : public GraphTest {
   PeeledIteration* PeelOne() {
     LoopTree* loop_tree = GetLoopTree();
     LoopTree::Loop* loop = loop_tree->outer_loops()[0];
-    LoopPeeler peeler(graph(), common(), loop_tree, zone(), source_positions());
+    LoopPeeler peeler(graph(), common(), loop_tree, zone(), source_positions(),
+                      node_origins());
     EXPECT_TRUE(peeler.CanPeel(loop));
     return Peel(peeler, loop);
   }
@@ -83,8 +83,7 @@ class LoopPeelingTest : public GraphTest {
     EXPECT_TRUE(peeler.CanPeel(loop));
     PeeledIteration* peeled = peeler.Peel(loop);
     if (FLAG_trace_turbo_graph) {
-      OFStream os(stdout);
-      os << AsRPO(*graph());
+      StdoutStream{} << AsRPO(*graph());
     }
     return peeled;
   }
@@ -250,7 +249,8 @@ TEST_F(LoopPeelingTest, SimpleNestedLoopWithCounter_peel_inner) {
   EXPECT_NE(nullptr, loop);
   EXPECT_EQ(1u, loop->depth());
 
-  LoopPeeler peeler(graph(), common(), loop_tree, zone(), source_positions());
+  LoopPeeler peeler(graph(), common(), loop_tree, zone(), source_positions(),
+                    node_origins());
   PeeledIteration* peeled = Peel(peeler, loop);
 
   ExpectNotPeeled(outer.loop, peeled);
@@ -290,7 +290,8 @@ TEST_F(LoopPeelingTest, SimpleInnerCounter_peel_inner) {
   EXPECT_NE(nullptr, loop);
   EXPECT_EQ(1u, loop->depth());
 
-  LoopPeeler peeler(graph(), common(), loop_tree, zone(), source_positions());
+  LoopPeeler peeler(graph(), common(), loop_tree, zone(), source_positions(),
+                    node_origins());
   PeeledIteration* peeled = Peel(peeler, loop);
 
   ExpectNotPeeled(outer.loop, peeled);
@@ -519,7 +520,8 @@ TEST_F(LoopPeelingTest, SimpleLoopWithUnmarkedExit) {
   {
     LoopTree* loop_tree = GetLoopTree();
     LoopTree::Loop* loop = loop_tree->outer_loops()[0];
-    LoopPeeler peeler(graph(), common(), loop_tree, zone(), source_positions());
+    LoopPeeler peeler(graph(), common(), loop_tree, zone(), source_positions(),
+                      node_origins());
     EXPECT_FALSE(peeler.CanPeel(loop));
   }
 }
diff --git a/deps/v8/test/unittests/compiler/machine-operator-reducer-unittest.cc b/deps/v8/test/unittests/compiler/machine-operator-reducer-unittest.cc
index 444845232791f4..f47e7804265d85 100644
--- a/deps/v8/test/unittests/compiler/machine-operator-reducer-unittest.cc
+++ b/deps/v8/test/unittests/compiler/machine-operator-reducer-unittest.cc
@@ -522,8 +522,7 @@ TEST_F(MachineOperatorReducerTest, RoundFloat64ToInt32WithConstant) {
     Reduction reduction = Reduce(
         graph()->NewNode(machine()->RoundFloat64ToInt32(), Float64Constant(x)));
     ASSERT_TRUE(reduction.Changed());
-    EXPECT_THAT(reduction.replacement(),
-                IsInt32Constant(static_cast<int32_t>(x)));
+    EXPECT_THAT(reduction.replacement(), IsInt32Constant(DoubleToInt32(x)));
   }
 }
 
diff --git a/deps/v8/test/unittests/compiler/node-test-utils.cc b/deps/v8/test/unittests/compiler/node-test-utils.cc
index 1695902639e26f..56f18931b4e15a 100644
--- a/deps/v8/test/unittests/compiler/node-test-utils.cc
+++ b/deps/v8/test/unittests/compiler/node-test-utils.cc
@@ -819,7 +819,7 @@ class IsSpeculativeBinopMatcher final : public TestNodeMatcher {
 
  private:
   const Matcher<NumberOperationHint> hint_matcher_;
-  const Matcher<Type*> type_matcher_;
+  const Matcher<Type> type_matcher_;
   const Matcher<Node*> lhs_matcher_;
   const Matcher<Node*> rhs_matcher_;
   const Matcher<Node*> effect_matcher_;
@@ -2115,6 +2115,7 @@ IS_BINOP_MATCHER(Int64Add)
 IS_BINOP_MATCHER(Int64Sub)
 IS_BINOP_MATCHER(Int64Mul)
 IS_BINOP_MATCHER(JSAdd)
+IS_BINOP_MATCHER(JSParseInt)
 IS_BINOP_MATCHER(Float32Equal)
 IS_BINOP_MATCHER(Float32LessThan)
 IS_BINOP_MATCHER(Float32LessThanOrEqual)
@@ -2186,9 +2187,11 @@ IS_UNOP_MATCHER(NumberToInt32)
 IS_UNOP_MATCHER(NumberToUint32)
 IS_UNOP_MATCHER(PlainPrimitiveToNumber)
 IS_UNOP_MATCHER(ObjectIsFiniteNumber)
+IS_UNOP_MATCHER(NumberIsFinite)
 IS_UNOP_MATCHER(ObjectIsInteger)
 IS_UNOP_MATCHER(ObjectIsSafeInteger)
 IS_UNOP_MATCHER(ObjectIsNaN)
+IS_UNOP_MATCHER(NumberIsNaN)
 IS_UNOP_MATCHER(ObjectIsReceiver)
 IS_UNOP_MATCHER(ObjectIsSmi)
 IS_UNOP_MATCHER(ObjectIsUndetectable)
@@ -2199,7 +2202,7 @@ IS_UNOP_MATCHER(Word32Ctz)
 IS_UNOP_MATCHER(Word32Popcnt)
 IS_UNOP_MATCHER(Word32ReverseBytes)
 IS_UNOP_MATCHER(SpeculativeToNumber)
-IS_UNOP_MATCHER(PoisonOnSpeculationTagged)
+IS_UNOP_MATCHER(TaggedPoisonOnSpeculation)
 #undef IS_UNOP_MATCHER
 
 // Special-case Bitcast operators which are disabled when ENABLE_VERIFY_CSA is
diff --git a/deps/v8/test/unittests/compiler/node-test-utils.h b/deps/v8/test/unittests/compiler/node-test-utils.h
index baec34cd337d2a..30ac330f7f5568 100644
--- a/deps/v8/test/unittests/compiler/node-test-utils.h
+++ b/deps/v8/test/unittests/compiler/node-test-utils.h
@@ -312,9 +312,11 @@ Matcher<Node*> IsStoreElement(const Matcher<ElementAccess>& access_matcher,
                               const Matcher<Node*>& control_matcher);
 
 Matcher<Node*> IsObjectIsFiniteNumber(const Matcher<Node*>& value_matcher);
+Matcher<Node*> IsNumberIsFinite(const Matcher<Node*>& value_matcher);
 Matcher<Node*> IsObjectIsInteger(const Matcher<Node*>& value_matcher);
 Matcher<Node*> IsObjectIsSafeInteger(const Matcher<Node*>& value_matcher);
 Matcher<Node*> IsObjectIsNaN(const Matcher<Node*>& value_matcher);
+Matcher<Node*> IsNumberIsNaN(const Matcher<Node*>& value_matcher);
 Matcher<Node*> IsObjectIsReceiver(const Matcher<Node*>& value_matcher);
 Matcher<Node*> IsObjectIsSmi(const Matcher<Node*>& value_matcher);
 Matcher<Node*> IsObjectIsUndetectable(const Matcher<Node*>& value_matcher);
@@ -406,6 +408,8 @@ Matcher<Node*> IsInt64Mul(const Matcher<Node*>& lhs_matcher,
                           const Matcher<Node*>& rhs_matcher);
 Matcher<Node*> IsJSAdd(const Matcher<Node*>& lhs_matcher,
                        const Matcher<Node*>& rhs_matcher);
+Matcher<Node*> IsJSParseInt(const Matcher<Node*>& lhs_matcher,
+                            const Matcher<Node*>& rhs_matcher);
 Matcher<Node*> IsBitcastTaggedToWord(const Matcher<Node*>& input_matcher);
 Matcher<Node*> IsBitcastWordToTagged(const Matcher<Node*>& input_matcher);
 Matcher<Node*> IsBitcastWordToTaggedSigned(const Matcher<Node*>& input_matcher);
diff --git a/deps/v8/test/unittests/compiler/regalloc/move-optimizer-unittest.cc b/deps/v8/test/unittests/compiler/regalloc/move-optimizer-unittest.cc
index 8b3e93fdcecf3f..71767a964e2889 100644
--- a/deps/v8/test/unittests/compiler/regalloc/move-optimizer-unittest.cc
+++ b/deps/v8/test/unittests/compiler/regalloc/move-optimizer-unittest.cc
@@ -54,18 +54,18 @@ class MoveOptimizerTest : public InstructionSequenceTest {
   void Optimize() {
     WireBlocks();
     if (FLAG_trace_turbo) {
-      OFStream os(stdout);
       PrintableInstructionSequence printable = {config(), sequence()};
-      os << "----- Instruction sequence before move optimization -----\n"
-         << printable;
+      StdoutStream{}
+          << "----- Instruction sequence before move optimization -----\n"
+          << printable;
     }
     MoveOptimizer move_optimizer(zone(), sequence());
     move_optimizer.Run();
     if (FLAG_trace_turbo) {
-      OFStream os(stdout);
       PrintableInstructionSequence printable = {config(), sequence()};
-      os << "----- Instruction sequence after move optimization -----\n"
-         << printable;
+      StdoutStream{}
+          << "----- Instruction sequence after move optimization -----\n"
+          << printable;
     }
   }
 
diff --git a/deps/v8/test/unittests/compiler/scheduler-unittest.cc b/deps/v8/test/unittests/compiler/scheduler-unittest.cc
index 92c17b73cc4b7d..e1537385449974 100644
--- a/deps/v8/test/unittests/compiler/scheduler-unittest.cc
+++ b/deps/v8/test/unittests/compiler/scheduler-unittest.cc
@@ -9,6 +9,7 @@
 #include "src/compiler/graph-visualizer.h"
 #include "src/compiler/graph.h"
 #include "src/compiler/js-operator.h"
+#include "src/compiler/node-origin-table.h"
 #include "src/compiler/node.h"
 #include "src/compiler/opcodes.h"
 #include "src/compiler/operator.h"
@@ -32,17 +33,16 @@ class SchedulerTest : public TestWithIsolateAndZone {
 
   Schedule* ComputeAndVerifySchedule(size_t expected) {
     if (FLAG_trace_turbo) {
-      OFStream os(stdout);
       SourcePositionTable table(graph());
-      os << AsJSON(*graph(), &table);
+      NodeOriginTable table2(graph());
+      StdoutStream{} << AsJSON(*graph(), &table, &table2);
     }
 
     Schedule* schedule =
         Scheduler::ComputeSchedule(zone(), graph(), Scheduler::kSplitNodes);
 
     if (FLAG_trace_turbo_scheduler) {
-      OFStream os(stdout);
-      os << *schedule << std::endl;
+      StdoutStream{} << *schedule << std::endl;
     }
     ScheduleVerifier::Run(schedule);
     EXPECT_EQ(expected, GetScheduledNodeCount(schedule));
diff --git a/deps/v8/test/unittests/compiler/simplified-lowering-unittest.cc b/deps/v8/test/unittests/compiler/simplified-lowering-unittest.cc
index 5f5afe54efd0aa..51e954f799ca60 100644
--- a/deps/v8/test/unittests/compiler/simplified-lowering-unittest.cc
+++ b/deps/v8/test/unittests/compiler/simplified-lowering-unittest.cc
@@ -42,11 +42,13 @@ class SimplifiedLoweringTest : public GraphTest {
     {
       // Simplified lowering needs to run w/o the typer decorator so make sure
       // the object is not live at the same time.
-      Typer typer(isolate(), Typer::kNoFlags, graph());
+      Typer typer(isolate(), js_heap_broker(), Typer::kNoFlags, graph());
       typer.Run();
     }
 
-    SimplifiedLowering lowering(jsgraph(), zone(), source_positions());
+    SimplifiedLowering lowering(jsgraph(), js_heap_broker(), zone(),
+                                source_positions(), node_origins(),
+                                PoisoningMitigationLevel::kDontPoison);
     lowering.LowerAllNodes();
   }
 
diff --git a/deps/v8/test/unittests/compiler/simplified-operator-reducer-unittest.cc b/deps/v8/test/unittests/compiler/simplified-operator-reducer-unittest.cc
index 5dd7d84fbde239..f0e463265efe78 100644
--- a/deps/v8/test/unittests/compiler/simplified-operator-reducer-unittest.cc
+++ b/deps/v8/test/unittests/compiler/simplified-operator-reducer-unittest.cc
@@ -29,12 +29,14 @@ class SimplifiedOperatorReducerTest : public GraphTest {
 
  protected:
   Reduction Reduce(Node* node) {
+    JSHeapBroker js_heap_broker(isolate());
     MachineOperatorBuilder machine(zone());
     JSOperatorBuilder javascript(zone());
     JSGraph jsgraph(isolate(), graph(), common(), &javascript, simplified(),
                     &machine);
     GraphReducer graph_reducer(zone(), graph());
-    SimplifiedOperatorReducer reducer(&graph_reducer, &jsgraph);
+    SimplifiedOperatorReducer reducer(&graph_reducer, &jsgraph,
+                                      &js_heap_broker);
     return reducer.Reduce(node);
   }
 
diff --git a/deps/v8/test/unittests/compiler/typed-optimization-unittest.cc b/deps/v8/test/unittests/compiler/typed-optimization-unittest.cc
index 4106b2b7a7728c..86600aeffe1e40 100644
--- a/deps/v8/test/unittests/compiler/typed-optimization-unittest.cc
+++ b/deps/v8/test/unittests/compiler/typed-optimization-unittest.cc
@@ -4,8 +4,8 @@
 
 #include "src/compiler/typed-optimization.h"
 #include "src/code-factory.h"
-#include "src/compilation-dependencies.h"
 #include "src/compiler/access-builder.h"
+#include "src/compiler/compilation-dependencies.h"
 #include "src/compiler/js-graph.h"
 #include "src/compiler/js-operator.h"
 #include "src/compiler/machine-operator.h"
@@ -24,41 +24,6 @@ namespace internal {
 namespace compiler {
 namespace typed_optimization_unittest {
 
-namespace {
-
-const double kFloat64Values[] = {
-    -V8_INFINITY,  -4.23878e+275, -5.82632e+265, -6.60355e+220,
-    -6.26172e+212, -2.56222e+211, -4.82408e+201, -1.84106e+157,
-    -1.63662e+127, -1.55772e+100, -1.67813e+72,  -2.3382e+55,
-    -3.179e+30,    -1.441e+09,    -1.0647e+09,   -7.99361e+08,
-    -5.77375e+08,  -2.20984e+08,  -32757,        -13171,
-    -9970,         -3984,         -107,          -105,
-    -92,           -77,           -61,           -0.000208163,
-    -1.86685e-06,  -1.17296e-10,  -9.26358e-11,  -5.08004e-60,
-    -1.74753e-65,  -1.06561e-71,  -5.67879e-79,  -5.78459e-130,
-    -2.90989e-171, -7.15489e-243, -3.76242e-252, -1.05639e-263,
-    -4.40497e-267, -2.19666e-273, -4.9998e-276,  -5.59821e-278,
-    -2.03855e-282, -5.99335e-283, -7.17554e-284, -3.11744e-309,
-    -0.0,          0.0,           2.22507e-308,  1.30127e-270,
-    7.62898e-260,  4.00313e-249,  3.16829e-233,  1.85244e-228,
-    2.03544e-129,  1.35126e-110,  1.01182e-106,  5.26333e-94,
-    1.35292e-90,   2.85394e-83,   1.78323e-77,   5.4967e-57,
-    1.03207e-25,   4.57401e-25,   1.58738e-05,   2,
-    125,           2310,          9636,          14802,
-    17168,         28945,         29305,         4.81336e+07,
-    1.41207e+08,   4.65962e+08,   1.40499e+09,   2.12648e+09,
-    8.80006e+30,   1.4446e+45,    1.12164e+54,   2.48188e+89,
-    6.71121e+102,  3.074e+112,    4.9699e+152,   5.58383e+166,
-    4.30654e+172,  7.08824e+185,  9.6586e+214,   2.028e+223,
-    6.63277e+243,  1.56192e+261,  1.23202e+269,  5.72883e+289,
-    8.5798e+290,   1.40256e+294,  1.79769e+308,  V8_INFINITY};
-
-const double kIntegerValues[] = {-V8_INFINITY, INT_MIN, -1000.0,  -42.0,
-                                 -1.0,         0.0,     1.0,      42.0,
-                                 1000.0,       INT_MAX, UINT_MAX, V8_INFINITY};
-
-}  // namespace
-
 class TypedOptimizationTest : public TypedGraphTest {
  public:
   TypedOptimizationTest()
@@ -73,7 +38,8 @@ class TypedOptimizationTest : public TypedGraphTest {
                     &machine);
     // TODO(titzer): mock the GraphReducer here for better unit testing.
     GraphReducer graph_reducer(zone(), graph());
-    TypedOptimization reducer(&graph_reducer, &deps_, &jsgraph);
+    TypedOptimization reducer(&graph_reducer, &deps_, &jsgraph,
+                              js_heap_broker());
     return reducer.Reduce(node);
   }
 
@@ -84,139 +50,9 @@ class TypedOptimizationTest : public TypedGraphTest {
   CompilationDependencies deps_;
 };
 
-TEST_F(TypedOptimizationTest, ParameterWithMinusZero) {
-  {
-    Reduction r = Reduce(
-        Parameter(Type::NewConstant(factory()->minus_zero_value(), zone())));
-    ASSERT_TRUE(r.Changed());
-    EXPECT_THAT(r.replacement(), IsNumberConstant(-0.0));
-  }
-  {
-    Reduction r = Reduce(Parameter(Type::MinusZero()));
-    ASSERT_TRUE(r.Changed());
-    EXPECT_THAT(r.replacement(), IsNumberConstant(-0.0));
-  }
-  {
-    Reduction r = Reduce(Parameter(Type::Union(
-        Type::MinusZero(), Type::NewConstant(factory()->NewNumber(0), zone()),
-        zone())));
-    EXPECT_FALSE(r.Changed());
-  }
-}
-
-TEST_F(TypedOptimizationTest, ParameterWithNull) {
-  Handle<HeapObject> null = factory()->null_value();
-  {
-    Reduction r = Reduce(Parameter(Type::NewConstant(null, zone())));
-    ASSERT_TRUE(r.Changed());
-    EXPECT_THAT(r.replacement(), IsHeapConstant(null));
-  }
-  {
-    Reduction r = Reduce(Parameter(Type::Null()));
-    ASSERT_TRUE(r.Changed());
-    EXPECT_THAT(r.replacement(), IsHeapConstant(null));
-  }
-}
-
-TEST_F(TypedOptimizationTest, ParameterWithNaN) {
-  const double kNaNs[] = {-std::numeric_limits<double>::quiet_NaN(),
-                          std::numeric_limits<double>::quiet_NaN(),
-                          std::numeric_limits<double>::signaling_NaN()};
-  TRACED_FOREACH(double, nan, kNaNs) {
-    Handle<Object> constant = factory()->NewNumber(nan);
-    Reduction r = Reduce(Parameter(Type::NewConstant(constant, zone())));
-    ASSERT_TRUE(r.Changed());
-    EXPECT_THAT(r.replacement(), IsNumberConstant(IsNaN()));
-  }
-  {
-    Reduction r =
-        Reduce(Parameter(Type::NewConstant(factory()->nan_value(), zone())));
-    ASSERT_TRUE(r.Changed());
-    EXPECT_THAT(r.replacement(), IsNumberConstant(IsNaN()));
-  }
-  {
-    Reduction r = Reduce(Parameter(Type::NaN()));
-    ASSERT_TRUE(r.Changed());
-    EXPECT_THAT(r.replacement(), IsNumberConstant(IsNaN()));
-  }
-}
-
-TEST_F(TypedOptimizationTest, ParameterWithPlainNumber) {
-  TRACED_FOREACH(double, value, kFloat64Values) {
-    Handle<Object> constant = factory()->NewNumber(value);
-    Reduction r = Reduce(Parameter(Type::NewConstant(constant, zone())));
-    ASSERT_TRUE(r.Changed());
-    EXPECT_THAT(r.replacement(), IsNumberConstant(value));
-  }
-  TRACED_FOREACH(double, value, kIntegerValues) {
-    Reduction r = Reduce(Parameter(Type::Range(value, value, zone())));
-    ASSERT_TRUE(r.Changed());
-    EXPECT_THAT(r.replacement(), IsNumberConstant(value));
-  }
-}
-
-TEST_F(TypedOptimizationTest, ParameterWithUndefined) {
-  Handle<HeapObject> undefined = factory()->undefined_value();
-  {
-    Reduction r = Reduce(Parameter(Type::Undefined()));
-    ASSERT_TRUE(r.Changed());
-    EXPECT_THAT(r.replacement(), IsHeapConstant(undefined));
-  }
-  {
-    Reduction r = Reduce(Parameter(Type::NewConstant(undefined, zone())));
-    ASSERT_TRUE(r.Changed());
-    EXPECT_THAT(r.replacement(), IsHeapConstant(undefined));
-  }
-}
-
 // -----------------------------------------------------------------------------
 // ToBoolean
 
-TEST_F(TypedOptimizationTest, ToBooleanWithFalsish) {
-  Node* input = Parameter(
-      Type::Union(
-          Type::MinusZero(),
-          Type::Union(
-              Type::NaN(),
-              Type::Union(
-                  Type::Null(),
-                  Type::Union(
-                      Type::Undefined(),
-                      Type::Union(
-                          Type::Undetectable(),
-                          Type::Union(Type::NewConstant(
-                                          factory()->false_value(), zone()),
-                                      Type::Range(0.0, 0.0, zone()), zone()),
-                          zone()),
-                      zone()),
-                  zone()),
-              zone()),
-          zone()),
-      0);
-  Reduction r = Reduce(graph()->NewNode(simplified()->ToBoolean(), input));
-  ASSERT_TRUE(r.Changed());
-  EXPECT_THAT(r.replacement(), IsFalseConstant());
-}
-
-TEST_F(TypedOptimizationTest, ToBooleanWithTruish) {
-  Node* input = Parameter(
-      Type::Union(
-          Type::NewConstant(factory()->true_value(), zone()),
-          Type::Union(Type::DetectableReceiver(), Type::Symbol(), zone()),
-          zone()),
-      0);
-  Reduction r = Reduce(graph()->NewNode(simplified()->ToBoolean(), input));
-  ASSERT_TRUE(r.Changed());
-  EXPECT_THAT(r.replacement(), IsTrueConstant());
-}
-
-TEST_F(TypedOptimizationTest, ToBooleanWithNonZeroPlainNumber) {
-  Node* input = Parameter(Type::Range(1, V8_INFINITY, zone()), 0);
-  Reduction r = Reduce(graph()->NewNode(simplified()->ToBoolean(), input));
-  ASSERT_TRUE(r.Changed());
-  EXPECT_THAT(r.replacement(), IsTrueConstant());
-}
-
 TEST_F(TypedOptimizationTest, ToBooleanWithBoolean) {
   Node* input = Parameter(Type::Boolean(), 0);
   Reduction r = Reduce(graph()->NewNode(simplified()->ToBoolean(), input));
diff --git a/deps/v8/test/unittests/compiler/typer-unittest.cc b/deps/v8/test/unittests/compiler/typer-unittest.cc
index fcfbfdb64662c3..d1283a8ad1f07b 100644
--- a/deps/v8/test/unittests/compiler/typer-unittest.cc
+++ b/deps/v8/test/unittests/compiler/typer-unittest.cc
@@ -22,7 +22,8 @@ class TyperTest : public TypedGraphTest {
  public:
   TyperTest()
       : TypedGraphTest(3),
-        operation_typer_(isolate(), zone()),
+        js_heap_broker_(isolate()),
+        operation_typer_(isolate(), &js_heap_broker_, zone()),
         types_(zone(), isolate(), random_number_generator()),
         javascript_(zone()),
         simplified_(zone()) {
@@ -55,6 +56,7 @@ class TyperTest : public TypedGraphTest {
 
   const int kRepetitions = 50;
 
+  JSHeapBroker js_heap_broker_;
   OperationTyper operation_typer_;
   Types types_;
   JSOperatorBuilder javascript_;
@@ -65,7 +67,7 @@ class TyperTest : public TypedGraphTest {
   std::vector<double> integers;
   std::vector<double> int32s;
 
-  Type* TypeUnaryOp(const Operator* op, Type* type0) {
+  Type TypeUnaryOp(const Operator* op, Type type0) {
     Node* p0 = Parameter(0);
     NodeProperties::SetType(p0, type0);
     std::vector<Node*> inputs;
@@ -87,7 +89,7 @@ class TyperTest : public TypedGraphTest {
     return NodeProperties::GetType(n);
   }
 
-  Type* TypeBinaryOp(const Operator* op, Type* lhs, Type* rhs) {
+  Type TypeBinaryOp(const Operator* op, Type lhs, Type rhs) {
     Node* p0 = Parameter(0);
     Node* p1 = Parameter(1);
     NodeProperties::SetType(p0, lhs);
@@ -112,14 +114,14 @@ class TyperTest : public TypedGraphTest {
     return NodeProperties::GetType(n);
   }
 
-  Type* RandomRange(bool int32 = false) {
+  Type RandomRange(bool int32 = false) {
     std::vector<double>& numbers = int32 ? int32s : integers;
     double i = numbers[rng_->NextInt(static_cast<int>(numbers.size()))];
     double j = numbers[rng_->NextInt(static_cast<int>(numbers.size()))];
     return NewRange(i, j);
   }
 
-  Type* NewRange(double i, double j) {
+  Type NewRange(double i, double j) {
     if (i > j) std::swap(i, j);
     return Type::Range(i, j, zone());
   }
@@ -145,15 +147,15 @@ class TyperTest : public TypedGraphTest {
     return result;
   }
 
-  double RandomInt(RangeType* range) {
+  double RandomInt(const RangeType* range) {
     return RandomInt(range->Min(), range->Max());
   }
 
-  Type* RandomSubtype(Type* type) {
-    Type* subtype;
+  Type RandomSubtype(Type type) {
+    Type subtype;
     do {
       subtype = types_.Fuzz();
-    } while (!subtype->Is(type));
+    } while (!subtype.Is(type));
     return subtype;
   }
 
@@ -166,16 +168,17 @@ class TyperTest : public TypedGraphTest {
     for (int width = 0; width < max_width; width++) {
       for (int lmin = min_min; lmin <= max_min; lmin++) {
         for (int rmin = min_min; rmin <= max_min; rmin++) {
-          Type* r1 = NewRange(lmin, lmin + width);
-          Type* r2 = NewRange(rmin, rmin + width);
-          Type* expected_type = TypeBinaryOp(op, r1, r2);
+          Type r1 = NewRange(lmin, lmin + width);
+          Type r2 = NewRange(rmin, rmin + width);
+          Type expected_type = TypeBinaryOp(op, r1, r2);
 
           for (int x1 = lmin; x1 < lmin + width; x1++) {
             for (int x2 = rmin; x2 < rmin + width; x2++) {
               double result_value = opfun(x1, x2);
-              Type* result_type = Type::NewConstant(
+              Type result_type = Type::NewConstant(
+                  &js_heap_broker_,
                   isolate()->factory()->NewNumber(result_value), zone());
-              EXPECT_TRUE(result_type->Is(expected_type));
+              EXPECT_TRUE(result_type.Is(expected_type));
             }
           }
         }
@@ -187,45 +190,50 @@ class TyperTest : public TypedGraphTest {
   void TestBinaryArithOp(const Operator* op, BinaryFunction opfun) {
     TestBinaryArithOpCloseToZero(op, opfun, 8);
     for (int i = 0; i < 100; ++i) {
-      Type* r1 = RandomRange();
-      Type* r2 = RandomRange();
-      Type* expected_type = TypeBinaryOp(op, r1, r2);
+      Type r1 = RandomRange();
+      Type r2 = RandomRange();
+      Type expected_type = TypeBinaryOp(op, r1, r2);
       for (int i = 0; i < 10; i++) {
-        double x1 = RandomInt(r1->AsRange());
-        double x2 = RandomInt(r2->AsRange());
+        double x1 = RandomInt(r1.AsRange());
+        double x2 = RandomInt(r2.AsRange());
         double result_value = opfun(x1, x2);
-        Type* result_type = Type::NewConstant(
-            isolate()->factory()->NewNumber(result_value), zone());
-        EXPECT_TRUE(result_type->Is(expected_type));
+        Type result_type = Type::NewConstant(
+            &js_heap_broker_, isolate()->factory()->NewNumber(result_value),
+            zone());
+        EXPECT_TRUE(result_type.Is(expected_type));
       }
     }
     // Test extreme cases.
     double x1 = +1e-308;
     double x2 = -1e-308;
-    Type* r1 = Type::NewConstant(isolate()->factory()->NewNumber(x1), zone());
-    Type* r2 = Type::NewConstant(isolate()->factory()->NewNumber(x2), zone());
-    Type* expected_type = TypeBinaryOp(op, r1, r2);
+    Type r1 = Type::NewConstant(&js_heap_broker_,
+                                isolate()->factory()->NewNumber(x1), zone());
+    Type r2 = Type::NewConstant(&js_heap_broker_,
+                                isolate()->factory()->NewNumber(x2), zone());
+    Type expected_type = TypeBinaryOp(op, r1, r2);
     double result_value = opfun(x1, x2);
-    Type* result_type = Type::NewConstant(
-        isolate()->factory()->NewNumber(result_value), zone());
-    EXPECT_TRUE(result_type->Is(expected_type));
+    Type result_type = Type::NewConstant(
+        &js_heap_broker_, isolate()->factory()->NewNumber(result_value),
+        zone());
+    EXPECT_TRUE(result_type.Is(expected_type));
   }
 
   template <class BinaryFunction>
   void TestBinaryCompareOp(const Operator* op, BinaryFunction opfun) {
     for (int i = 0; i < 100; ++i) {
-      Type* r1 = RandomRange();
-      Type* r2 = RandomRange();
-      Type* expected_type = TypeBinaryOp(op, r1, r2);
+      Type r1 = RandomRange();
+      Type r2 = RandomRange();
+      Type expected_type = TypeBinaryOp(op, r1, r2);
       for (int i = 0; i < 10; i++) {
-        double x1 = RandomInt(r1->AsRange());
-        double x2 = RandomInt(r2->AsRange());
+        double x1 = RandomInt(r1.AsRange());
+        double x2 = RandomInt(r2.AsRange());
         bool result_value = opfun(x1, x2);
-        Type* result_type = Type::NewConstant(
+        Type result_type = Type::NewConstant(
+            &js_heap_broker_,
             result_value ? isolate()->factory()->true_value()
                          : isolate()->factory()->false_value(),
             zone());
-        EXPECT_TRUE(result_type->Is(expected_type));
+        EXPECT_TRUE(result_type.Is(expected_type));
       }
     }
   }
@@ -233,59 +241,60 @@ class TyperTest : public TypedGraphTest {
   template <class BinaryFunction>
   void TestBinaryBitOp(const Operator* op, BinaryFunction opfun) {
     for (int i = 0; i < 100; ++i) {
-      Type* r1 = RandomRange(true);
-      Type* r2 = RandomRange(true);
-      Type* expected_type = TypeBinaryOp(op, r1, r2);
+      Type r1 = RandomRange(true);
+      Type r2 = RandomRange(true);
+      Type expected_type = TypeBinaryOp(op, r1, r2);
       for (int i = 0; i < 10; i++) {
-        int32_t x1 = static_cast<int32_t>(RandomInt(r1->AsRange()));
-        int32_t x2 = static_cast<int32_t>(RandomInt(r2->AsRange()));
+        int32_t x1 = static_cast<int32_t>(RandomInt(r1.AsRange()));
+        int32_t x2 = static_cast<int32_t>(RandomInt(r2.AsRange()));
         double result_value = opfun(x1, x2);
-        Type* result_type = Type::NewConstant(
-            isolate()->factory()->NewNumber(result_value), zone());
-        EXPECT_TRUE(result_type->Is(expected_type));
+        Type result_type = Type::NewConstant(
+            &js_heap_broker_, isolate()->factory()->NewNumber(result_value),
+            zone());
+        EXPECT_TRUE(result_type.Is(expected_type));
       }
     }
   }
 
-  typedef std::function<Type*(Type*)> UnaryTyper;
-  typedef std::function<Type*(Type*, Type*)> BinaryTyper;
+  typedef std::function<Type(Type)> UnaryTyper;
+  typedef std::function<Type(Type, Type)> BinaryTyper;
 
-  void TestUnaryMonotonicity(UnaryTyper typer, Type* upper1 = Type::Any()) {
-    Type* type1 = Type::Intersect(types_.Fuzz(), upper1, zone());
-    DCHECK(type1->Is(upper1));
-    Type* type = typer(type1);
+  void TestUnaryMonotonicity(UnaryTyper typer, Type upper1 = Type::Any()) {
+    Type type1 = Type::Intersect(types_.Fuzz(), upper1, zone());
+    DCHECK(type1.Is(upper1));
+    Type type = typer(type1);
 
-    Type* subtype1 = RandomSubtype(type1);
-    Type* subtype = typer(subtype1);
+    Type subtype1 = RandomSubtype(type1);
+    Type subtype = typer(subtype1);
 
-    EXPECT_TRUE(subtype->Is(type));
+    EXPECT_TRUE(subtype.Is(type));
   }
 
-  void TestBinaryMonotonicity(BinaryTyper typer, Type* upper1 = Type::Any(),
-                              Type* upper2 = Type::Any()) {
-    Type* type1 = Type::Intersect(types_.Fuzz(), upper1, zone());
-    DCHECK(type1->Is(upper1));
-    Type* type2 = Type::Intersect(types_.Fuzz(), upper2, zone());
-    DCHECK(type2->Is(upper2));
-    Type* type = typer(type1, type2);
+  void TestBinaryMonotonicity(BinaryTyper typer, Type upper1 = Type::Any(),
+                              Type upper2 = Type::Any()) {
+    Type type1 = Type::Intersect(types_.Fuzz(), upper1, zone());
+    DCHECK(type1.Is(upper1));
+    Type type2 = Type::Intersect(types_.Fuzz(), upper2, zone());
+    DCHECK(type2.Is(upper2));
+    Type type = typer(type1, type2);
 
-    Type* subtype1 = RandomSubtype(type1);
-    Type* subtype2 = RandomSubtype(type2);
-    Type* subtype = typer(subtype1, subtype2);
+    Type subtype1 = RandomSubtype(type1);
+    Type subtype2 = RandomSubtype(type2);
+    Type subtype = typer(subtype1, subtype2);
 
-    EXPECT_TRUE(subtype->Is(type));
+    EXPECT_TRUE(subtype.Is(type));
   }
 
-  void TestUnaryMonotonicity(const Operator* op, Type* upper1 = Type::Any()) {
-    UnaryTyper typer = [&](Type* type1) { return TypeUnaryOp(op, type1); };
+  void TestUnaryMonotonicity(const Operator* op, Type upper1 = Type::Any()) {
+    UnaryTyper typer = [&](Type type1) { return TypeUnaryOp(op, type1); };
     for (int i = 0; i < kRepetitions; ++i) {
       TestUnaryMonotonicity(typer, upper1);
     }
   }
 
-  void TestBinaryMonotonicity(const Operator* op, Type* upper1 = Type::Any(),
-                              Type* upper2 = Type::Any()) {
-    BinaryTyper typer = [&](Type* type1, Type* type2) {
+  void TestBinaryMonotonicity(const Operator* op, Type upper1 = Type::Any(),
+                              Type upper2 = Type::Any()) {
+    BinaryTyper typer = [&](Type type1, Type type2) {
       return TypeBinaryOp(op, type1, type2);
     };
     for (int i = 0; i < kRepetitions; ++i) {
@@ -541,7 +550,7 @@ SIMPLIFIED_SPECULATIVE_NUMBER_BINOP_LIST(TEST_MONOTONICITY)
 // SIMPLIFIED UNOPs with Number input restriction
 #define TEST_MONOTONICITY(name)                      \
   TEST_F(TyperTest, Monotonicity_Operation_##name) { \
-    UnaryTyper typer = [&](Type* type1) {            \
+    UnaryTyper typer = [&](Type type1) {             \
       return operation_typer_.name(type1);           \
     };                                               \
     for (int i = 0; i < kRepetitions; ++i) {         \
@@ -554,7 +563,7 @@ SIMPLIFIED_NUMBER_UNOP_LIST(TEST_MONOTONICITY)
 // SIMPLIFIED BINOPs with Number input restriction
 #define TEST_MONOTONICITY(name)                                      \
   TEST_F(TyperTest, Monotonicity_Operation_##name) {                 \
-    BinaryTyper typer = [&](Type* type1, Type* type2) {              \
+    BinaryTyper typer = [&](Type type1, Type type2) {                \
       return operation_typer_.name(type1, type2);                    \
     };                                                               \
     for (int i = 0; i < kRepetitions; ++i) {                         \
@@ -565,14 +574,14 @@ SIMPLIFIED_NUMBER_BINOP_LIST(TEST_MONOTONICITY)
 #undef TEST_MONOTONICITY
 
 // SIMPLIFIED BINOPs without input restriction
-#define TEST_MONOTONICITY(name)                         \
-  TEST_F(TyperTest, Monotonicity_Operation_##name) {    \
-    BinaryTyper typer = [&](Type* type1, Type* type2) { \
-      return operation_typer_.name(type1, type2);       \
-    };                                                  \
-    for (int i = 0; i < kRepetitions; ++i) {            \
-      TestBinaryMonotonicity(typer);                    \
-    }                                                   \
+#define TEST_MONOTONICITY(name)                       \
+  TEST_F(TyperTest, Monotonicity_Operation_##name) {  \
+    BinaryTyper typer = [&](Type type1, Type type2) { \
+      return operation_typer_.name(type1, type2);     \
+    };                                                \
+    for (int i = 0; i < kRepetitions; ++i) {          \
+      TestBinaryMonotonicity(typer);                  \
+    }                                                 \
   }
 SIMPLIFIED_SPECULATIVE_NUMBER_BINOP_LIST(TEST_MONOTONICITY)
 #undef TEST_MONOTONICITY
diff --git a/deps/v8/test/unittests/compiler/x64/instruction-selector-x64-unittest.cc b/deps/v8/test/unittests/compiler/x64/instruction-selector-x64-unittest.cc
index 4871704d664767..fb7caa4bf9b81e 100644
--- a/deps/v8/test/unittests/compiler/x64/instruction-selector-x64-unittest.cc
+++ b/deps/v8/test/unittests/compiler/x64/instruction-selector-x64-unittest.cc
@@ -1631,6 +1631,58 @@ TEST_F(InstructionSelectorTest, SpeculationFence) {
   EXPECT_EQ(kLFence, s[0]->arch_opcode());
 }
 
+TEST_F(InstructionSelectorTest, StackCheck0) {
+  ExternalReference js_stack_limit =
+      ExternalReference::Create(isolate()->stack_guard()->address_of_jslimit());
+  StreamBuilder m(this, MachineType::Int32());
+  Node* const sp = m.LoadStackPointer();
+  Node* const stack_limit =
+      m.Load(MachineType::Pointer(), m.ExternalConstant(js_stack_limit));
+  Node* const interrupt = m.UintPtrLessThan(sp, stack_limit);
+
+  RawMachineLabel if_true, if_false;
+  m.Branch(interrupt, &if_true, &if_false);
+
+  m.Bind(&if_true);
+  m.Return(m.Int32Constant(1));
+
+  m.Bind(&if_false);
+  m.Return(m.Int32Constant(0));
+
+  Stream s = m.Build();
+
+  ASSERT_EQ(1U, s.size());
+  EXPECT_EQ(kX64Cmp, s[0]->arch_opcode());
+  EXPECT_EQ(4U, s[0]->InputCount());
+  EXPECT_EQ(0U, s[0]->OutputCount());
+}
+
+TEST_F(InstructionSelectorTest, StackCheck1) {
+  ExternalReference js_stack_limit =
+      ExternalReference::Create(isolate()->stack_guard()->address_of_jslimit());
+  StreamBuilder m(this, MachineType::Int32());
+  Node* const sp = m.LoadStackPointer();
+  Node* const stack_limit =
+      m.Load(MachineType::Pointer(), m.ExternalConstant(js_stack_limit));
+  Node* const sp_within_limit = m.UintPtrLessThan(stack_limit, sp);
+
+  RawMachineLabel if_true, if_false;
+  m.Branch(sp_within_limit, &if_true, &if_false);
+
+  m.Bind(&if_true);
+  m.Return(m.Int32Constant(1));
+
+  m.Bind(&if_false);
+  m.Return(m.Int32Constant(0));
+
+  Stream s = m.Build();
+
+  ASSERT_EQ(1U, s.size());
+  EXPECT_EQ(kX64StackCheck, s[0]->arch_opcode());
+  EXPECT_EQ(2U, s[0]->InputCount());
+  EXPECT_EQ(0U, s[0]->OutputCount());
+}
+
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/test/unittests/heap/embedder-tracing-unittest.cc b/deps/v8/test/unittests/heap/embedder-tracing-unittest.cc
index e6a6f2e250b117..2aa711258747a7 100644
--- a/deps/v8/test/unittests/heap/embedder-tracing-unittest.cc
+++ b/deps/v8/test/unittests/heap/embedder-tracing-unittest.cc
@@ -30,7 +30,7 @@ class MockEmbedderHeapTracer : public EmbedderHeapTracer {
   MOCK_METHOD0(TraceEpilogue, void());
   MOCK_METHOD0(AbortTracing, void());
   MOCK_METHOD0(EnterFinalPause, void());
-  MOCK_METHOD0(NumberOfWrappersToTrace, size_t());
+  MOCK_METHOD0(IsTracingDone, bool());
   MOCK_METHOD1(RegisterV8References,
                void(const std::vector<std::pair<void*, void*> >&));
   MOCK_METHOD2(AdvanceTracing,
@@ -100,12 +100,12 @@ TEST(LocalEmbedderHeapTracer, EnterFinalPauseForwards) {
   local_tracer.EnterFinalPause();
 }
 
-TEST(LocalEmbedderHeapTracer, NumberOfWrappersToTraceIncludesRemote) {
+TEST(LocalEmbedderHeapTracer, IsRemoteTracingDoneIncludesRemote) {
   LocalEmbedderHeapTracer local_tracer;
   StrictMock<MockEmbedderHeapTracer> remote_tracer;
   local_tracer.SetRemoteTracer(&remote_tracer);
-  EXPECT_CALL(remote_tracer, NumberOfWrappersToTrace());
-  local_tracer.NumberOfWrappersToTrace();
+  EXPECT_CALL(remote_tracer, IsTracingDone());
+  local_tracer.IsRemoteTracingDone();
 }
 
 TEST(LocalEmbedderHeapTracer, NumberOfCachedWrappersToTraceExcludesRemote) {
@@ -124,8 +124,8 @@ TEST(LocalEmbedderHeapTracer, RegisterWrappersWithRemoteTracer) {
   EXPECT_CALL(remote_tracer, RegisterV8References(_));
   local_tracer.RegisterWrappersWithRemoteTracer();
   EXPECT_EQ(0u, local_tracer.NumberOfCachedWrappersToTrace());
-  EXPECT_CALL(remote_tracer, NumberOfWrappersToTrace()).WillOnce(Return(1));
-  EXPECT_EQ(1u, local_tracer.NumberOfWrappersToTrace());
+  EXPECT_CALL(remote_tracer, IsTracingDone()).WillOnce(Return(false));
+  EXPECT_FALSE(local_tracer.IsRemoteTracingDone());
 }
 
 TEST(LocalEmbedderHeapTracer, TraceFinishes) {
diff --git a/deps/v8/test/unittests/heap/gc-tracer-unittest.cc b/deps/v8/test/unittests/heap/gc-tracer-unittest.cc
index 0f1a841e2d35c4..4ac80ab6fe65c7 100644
--- a/deps/v8/test/unittests/heap/gc-tracer-unittest.cc
+++ b/deps/v8/test/unittests/heap/gc-tracer-unittest.cc
@@ -451,5 +451,64 @@ TEST_F(GCTracerTest, MultithreadedBackgroundScope) {
   EXPECT_LE(0, tracer->current_.scopes[GCTracer::Scope::MC_BACKGROUND_MARKING]);
 }
 
+class GcHistogram {
+ public:
+  static void* CreateHistogram(const char* name, int min, int max,
+                               size_t buckets) {
+    histograms_[name] = std::unique_ptr<GcHistogram>(new GcHistogram());
+    return histograms_[name].get();
+  }
+
+  static void AddHistogramSample(void* histogram, int sample) {
+    if (histograms_.empty()) return;
+    static_cast<GcHistogram*>(histogram)->samples_.push_back(sample);
+  }
+
+  static GcHistogram* Get(const char* name) { return histograms_[name].get(); }
+
+  static void CleanUp() { histograms_.clear(); }
+
+  int Total() {
+    int result = 0;
+    for (int i : samples_) {
+      result += i;
+    }
+    return result;
+  }
+
+  int Count() { return static_cast<int>(samples_.size()); }
+
+ private:
+  std::vector<int> samples_;
+  static std::map<std::string, std::unique_ptr<GcHistogram>> histograms_;
+};
+
+std::map<std::string, std::unique_ptr<GcHistogram>> GcHistogram::histograms_ =
+    std::map<std::string, std::unique_ptr<GcHistogram>>();
+
+TEST_F(GCTracerTest, RecordMarkCompactHistograms) {
+  if (FLAG_stress_incremental_marking) return;
+  isolate()->SetCreateHistogramFunction(&GcHistogram::CreateHistogram);
+  isolate()->SetAddHistogramSampleFunction(&GcHistogram::AddHistogramSample);
+  GCTracer* tracer = i_isolate()->heap()->tracer();
+  tracer->ResetForTesting();
+  tracer->current_.scopes[GCTracer::Scope::MC_CLEAR] = 1;
+  tracer->current_.scopes[GCTracer::Scope::MC_EPILOGUE] = 2;
+  tracer->current_.scopes[GCTracer::Scope::MC_EVACUATE] = 3;
+  tracer->current_.scopes[GCTracer::Scope::MC_FINISH] = 4;
+  tracer->current_.scopes[GCTracer::Scope::MC_MARK] = 5;
+  tracer->current_.scopes[GCTracer::Scope::MC_PROLOGUE] = 6;
+  tracer->current_.scopes[GCTracer::Scope::MC_SWEEP] = 7;
+  tracer->RecordMarkCompactHistograms(i_isolate()->counters()->gc_finalize());
+  EXPECT_EQ(1, GcHistogram::Get("V8.GCFinalizeMC.Clear")->Total());
+  EXPECT_EQ(2, GcHistogram::Get("V8.GCFinalizeMC.Epilogue")->Total());
+  EXPECT_EQ(3, GcHistogram::Get("V8.GCFinalizeMC.Evacuate")->Total());
+  EXPECT_EQ(4, GcHistogram::Get("V8.GCFinalizeMC.Finish")->Total());
+  EXPECT_EQ(5, GcHistogram::Get("V8.GCFinalizeMC.Mark")->Total());
+  EXPECT_EQ(6, GcHistogram::Get("V8.GCFinalizeMC.Prologue")->Total());
+  EXPECT_EQ(7, GcHistogram::Get("V8.GCFinalizeMC.Sweep")->Total());
+  GcHistogram::CleanUp();
+}
+
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/test/unittests/heap/heap-controller-unittest.cc b/deps/v8/test/unittests/heap/heap-controller-unittest.cc
new file mode 100644
index 00000000000000..dc75820f64e5e7
--- /dev/null
+++ b/deps/v8/test/unittests/heap/heap-controller-unittest.cc
@@ -0,0 +1,118 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include <cmath>
+#include <iostream>
+#include <limits>
+
+#include "src/objects-inl.h"
+#include "src/objects.h"
+
+#include "src/handles-inl.h"
+#include "src/handles.h"
+
+#include "src/heap/heap-controller.h"
+#include "test/unittests/test-utils.h"
+#include "testing/gtest/include/gtest/gtest.h"
+
+namespace v8 {
+namespace internal {
+
+typedef TestWithIsolate HeapControllerTest;
+
+double Round(double x) {
+  // Round to three digits.
+  return floor(x * 1000 + 0.5) / 1000;
+}
+
+void CheckEqualRounded(double expected, double actual) {
+  expected = Round(expected);
+  actual = Round(actual);
+  EXPECT_DOUBLE_EQ(expected, actual);
+}
+
+TEST(HeapController, HeapGrowingFactor) {
+  CheckEqualRounded(HeapController::kMaxHeapGrowingFactor,
+                    HeapController::HeapGrowingFactor(34, 1, 4.0));
+  CheckEqualRounded(3.553, HeapController::HeapGrowingFactor(45, 1, 4.0));
+  CheckEqualRounded(2.830, HeapController::HeapGrowingFactor(50, 1, 4.0));
+  CheckEqualRounded(1.478, HeapController::HeapGrowingFactor(100, 1, 4.0));
+  CheckEqualRounded(1.193, HeapController::HeapGrowingFactor(200, 1, 4.0));
+  CheckEqualRounded(1.121, HeapController::HeapGrowingFactor(300, 1, 4.0));
+  CheckEqualRounded(HeapController::HeapGrowingFactor(300, 1, 4.0),
+                    HeapController::HeapGrowingFactor(600, 2, 4.0));
+  CheckEqualRounded(HeapController::kMinHeapGrowingFactor,
+                    HeapController::HeapGrowingFactor(400, 1, 4.0));
+}
+
+TEST(HeapController, MaxHeapGrowingFactor) {
+  CheckEqualRounded(1.3, HeapController::MaxHeapGrowingFactor(
+                             HeapController::kMinOldGenerationSize * MB));
+  CheckEqualRounded(1.600, HeapController::MaxHeapGrowingFactor(
+                               HeapController::kMaxOldGenerationSize / 2 * MB));
+  CheckEqualRounded(1.999, HeapController::MaxHeapGrowingFactor(
+                               (HeapController::kMaxOldGenerationSize -
+                                Heap::kPointerMultiplier) *
+                               MB));
+  CheckEqualRounded(
+      4.0,
+      HeapController::MaxHeapGrowingFactor(
+          static_cast<size_t>(HeapController::kMaxOldGenerationSize) * MB));
+}
+
+TEST_F(HeapControllerTest, OldGenerationAllocationLimit) {
+  Heap* heap = i_isolate()->heap();
+  size_t old_gen_size = 128 * MB;
+  size_t max_old_generation_size = 512 * MB;
+  double gc_speed = 100;
+  double mutator_speed = 1;
+  size_t new_space_capacity = 16 * MB;
+
+  double max_factor =
+      HeapController::MaxHeapGrowingFactor(max_old_generation_size);
+  double factor =
+      HeapController::HeapGrowingFactor(gc_speed, mutator_speed, max_factor);
+
+  EXPECT_EQ(static_cast<size_t>(old_gen_size * factor + new_space_capacity),
+            heap->heap_controller()->CalculateOldGenerationAllocationLimit(
+                old_gen_size, max_old_generation_size, gc_speed, mutator_speed,
+                new_space_capacity, Heap::HeapGrowingMode::kDefault));
+
+  factor = Min(factor, HeapController::kConservativeHeapGrowingFactor);
+  EXPECT_EQ(static_cast<size_t>(old_gen_size * factor + new_space_capacity),
+            heap->heap_controller()->CalculateOldGenerationAllocationLimit(
+                old_gen_size, max_old_generation_size, gc_speed, mutator_speed,
+                new_space_capacity, Heap::HeapGrowingMode::kSlow));
+
+  factor = Min(factor, HeapController::kConservativeHeapGrowingFactor);
+  EXPECT_EQ(static_cast<size_t>(old_gen_size * factor + new_space_capacity),
+            heap->heap_controller()->CalculateOldGenerationAllocationLimit(
+                old_gen_size, max_old_generation_size, gc_speed, mutator_speed,
+                new_space_capacity, Heap::HeapGrowingMode::kConservative));
+
+  factor = HeapController::kMinHeapGrowingFactor;
+  EXPECT_EQ(static_cast<size_t>(old_gen_size * factor + new_space_capacity),
+            heap->heap_controller()->CalculateOldGenerationAllocationLimit(
+                old_gen_size, max_old_generation_size, gc_speed, mutator_speed,
+                new_space_capacity, Heap::HeapGrowingMode::kMinimal));
+}
+
+TEST(HeapController, MaxOldGenerationSize) {
+  uint64_t configurations[][2] = {
+      {0, HeapController::kMinOldGenerationSize},
+      {512, HeapController::kMinOldGenerationSize},
+      {1 * GB, 256 * Heap::kPointerMultiplier},
+      {2 * static_cast<uint64_t>(GB), 512 * Heap::kPointerMultiplier},
+      {4 * static_cast<uint64_t>(GB), HeapController::kMaxOldGenerationSize},
+      {8 * static_cast<uint64_t>(GB), HeapController::kMaxOldGenerationSize}};
+
+  for (auto configuration : configurations) {
+    ASSERT_EQ(configuration[1],
+              static_cast<uint64_t>(
+                  Heap::ComputeMaxOldGenerationSize(configuration[0])));
+  }
+}
+
+}  // namespace internal
+}  // namespace v8
diff --git a/deps/v8/test/unittests/heap/heap-unittest.cc b/deps/v8/test/unittests/heap/heap-unittest.cc
index c63aa2b7240746..3f08278d133351 100644
--- a/deps/v8/test/unittests/heap/heap-unittest.cc
+++ b/deps/v8/test/unittests/heap/heap-unittest.cc
@@ -21,47 +21,6 @@ namespace internal {
 
 typedef TestWithIsolate HeapTest;
 
-double Round(double x) {
-  // Round to three digits.
-  return floor(x * 1000 + 0.5) / 1000;
-}
-
-
-void CheckEqualRounded(double expected, double actual) {
-  expected = Round(expected);
-  actual = Round(actual);
-  EXPECT_DOUBLE_EQ(expected, actual);
-}
-
-
-TEST(Heap, HeapGrowingFactor) {
-  CheckEqualRounded(Heap::kMaxHeapGrowingFactor,
-                    Heap::HeapGrowingFactor(34, 1, 4.0));
-  CheckEqualRounded(3.553, Heap::HeapGrowingFactor(45, 1, 4.0));
-  CheckEqualRounded(2.830, Heap::HeapGrowingFactor(50, 1, 4.0));
-  CheckEqualRounded(1.478, Heap::HeapGrowingFactor(100, 1, 4.0));
-  CheckEqualRounded(1.193, Heap::HeapGrowingFactor(200, 1, 4.0));
-  CheckEqualRounded(1.121, Heap::HeapGrowingFactor(300, 1, 4.0));
-  CheckEqualRounded(Heap::HeapGrowingFactor(300, 1, 4.0),
-                    Heap::HeapGrowingFactor(600, 2, 4.0));
-  CheckEqualRounded(Heap::kMinHeapGrowingFactor,
-                    Heap::HeapGrowingFactor(400, 1, 4.0));
-}
-
-TEST(Heap, MaxHeapGrowingFactor) {
-  CheckEqualRounded(
-      1.3, Heap::MaxHeapGrowingFactor(Heap::kMinOldGenerationSize * MB));
-  CheckEqualRounded(
-      1.600, Heap::MaxHeapGrowingFactor(Heap::kMaxOldGenerationSize / 2 * MB));
-  CheckEqualRounded(
-      1.999,
-      Heap::MaxHeapGrowingFactor(
-          (Heap::kMaxOldGenerationSize - Heap::kPointerMultiplier) * MB));
-  CheckEqualRounded(4.0,
-                    Heap::MaxHeapGrowingFactor(
-                        static_cast<size_t>(Heap::kMaxOldGenerationSize) * MB));
-}
-
 TEST(Heap, SemiSpaceSize) {
   const size_t KB = static_cast<size_t>(i::KB);
   const size_t MB = static_cast<size_t>(i::MB);
@@ -73,22 +32,6 @@ TEST(Heap, SemiSpaceSize) {
   ASSERT_EQ(8u * pm * MB, i::Heap::ComputeMaxSemiSpaceSize(4095u * MB) * KB);
 }
 
-TEST(Heap, OldGenerationSize) {
-  uint64_t configurations[][2] = {
-      {0, i::Heap::kMinOldGenerationSize},
-      {512, i::Heap::kMinOldGenerationSize},
-      {1 * i::GB, 256 * i::Heap::kPointerMultiplier},
-      {2 * static_cast<uint64_t>(i::GB), 512 * i::Heap::kPointerMultiplier},
-      {4 * static_cast<uint64_t>(i::GB), i::Heap::kMaxOldGenerationSize},
-      {8 * static_cast<uint64_t>(i::GB), i::Heap::kMaxOldGenerationSize}};
-
-  for (auto configuration : configurations) {
-    ASSERT_EQ(configuration[1],
-              static_cast<uint64_t>(
-                  i::Heap::ComputeMaxOldGenerationSize(configuration[0])));
-  }
-}
-
 TEST_F(HeapTest, ASLR) {
 #if V8_TARGET_ARCH_X64
 #if V8_OS_MACOSX
diff --git a/deps/v8/test/unittests/heap/slot-set-unittest.cc b/deps/v8/test/unittests/heap/slot-set-unittest.cc
index f89feffe332cc3..aff6f02130311d 100644
--- a/deps/v8/test/unittests/heap/slot-set-unittest.cc
+++ b/deps/v8/test/unittests/heap/slot-set-unittest.cc
@@ -55,8 +55,7 @@ TEST(SlotSet, Iterate) {
 
   set.Iterate(
       [](Address slot_address) {
-        uintptr_t intaddr = reinterpret_cast<uintptr_t>(slot_address);
-        if (intaddr % 3 == 0) {
+        if (slot_address % 3 == 0) {
           return KEEP_SLOT;
         } else {
           return REMOVE_SLOT;
@@ -165,11 +164,9 @@ TEST(TypedSlotSet, Iterate) {
   }
   int iterated = 0;
   set.Iterate(
-      [&iterated](SlotType type, Address host_addr,
-                  Address addr) {
-        uint32_t i = static_cast<uint32_t>(reinterpret_cast<uintptr_t>(addr));
-        uint32_t j =
-            static_cast<uint32_t>(reinterpret_cast<uintptr_t>(host_addr));
+      [&iterated](SlotType type, Address host_addr, Address addr) {
+        uint32_t i = static_cast<uint32_t>(addr);
+        uint32_t j = static_cast<uint32_t>(host_addr);
         EXPECT_EQ(i % CLEARED_SLOT, static_cast<uint32_t>(type));
         EXPECT_EQ(0u, i % kDelta);
         EXPECT_EQ(0u, j % kHostDelta);
@@ -181,7 +178,7 @@ TEST(TypedSlotSet, Iterate) {
   iterated = 0;
   set.Iterate(
       [&iterated](SlotType type, Address host_addr, Address addr) {
-        uint32_t i = static_cast<uint32_t>(reinterpret_cast<uintptr_t>(addr));
+        uint32_t i = static_cast<uint32_t>(addr);
         EXPECT_EQ(0u, i % 2);
         ++iterated;
         return KEEP_SLOT;
@@ -212,8 +209,7 @@ TEST(TypedSlotSet, RemoveInvalidSlots) {
     uint32_t end = it->second;
     set.Iterate(
         [start, end](SlotType slot_type, Address host_addr, Address slot_addr) {
-          CHECK(reinterpret_cast<uintptr_t>(host_addr) < start ||
-                reinterpret_cast<uintptr_t>(host_addr) >= end);
+          CHECK(host_addr < start || host_addr >= end);
           return KEEP_SLOT;
         },
         TypedSlotSet::KEEP_EMPTY_CHUNKS);
diff --git a/deps/v8/test/unittests/heap/spaces-unittest.cc b/deps/v8/test/unittests/heap/spaces-unittest.cc
index 9b4b2675e3f66b..2d499df4f34a47 100644
--- a/deps/v8/test/unittests/heap/spaces-unittest.cc
+++ b/deps/v8/test/unittests/heap/spaces-unittest.cc
@@ -20,7 +20,6 @@ TEST_F(SpacesTest, CompactionSpaceMerge) {
   CompactionSpace* compaction_space =
       new CompactionSpace(heap, OLD_SPACE, NOT_EXECUTABLE);
   EXPECT_TRUE(compaction_space != NULL);
-  EXPECT_TRUE(compaction_space->SetUp());
 
   for (Page* p : *old_space) {
     // Unlink free lists from the main space to avoid reusing the memory for
diff --git a/deps/v8/test/unittests/heap/unmapper-unittest.cc b/deps/v8/test/unittests/heap/unmapper-unittest.cc
index 4e49b7c4ecc2c0..e28e50e3b732e7 100644
--- a/deps/v8/test/unittests/heap/unmapper-unittest.cc
+++ b/deps/v8/test/unittests/heap/unmapper-unittest.cc
@@ -54,7 +54,7 @@ TEST_F(SequentialUnmapperTest, UnmapOnTeardownAfterAlreadyFreeingPooled) {
                                 Executability::NOT_EXECUTABLE);
   EXPECT_NE(nullptr, page);
   const int page_size = getpagesize();
-  void* start_address = static_cast<void*>(page->address());
+  void* start_address = reinterpret_cast<void*>(page->address());
   EXPECT_EQ(0, msync(start_address, page_size, MS_SYNC));
   allocator()->Free<MemoryAllocator::kPooledAndQueue>(page);
   EXPECT_EQ(0, msync(start_address, page_size, MS_SYNC));
@@ -72,7 +72,7 @@ TEST_F(SequentialUnmapperTest, UnmapOnTeardown) {
                                 Executability::NOT_EXECUTABLE);
   EXPECT_NE(nullptr, page);
   const int page_size = getpagesize();
-  void* start_address = static_cast<void*>(page->address());
+  void* start_address = reinterpret_cast<void*>(page->address());
   EXPECT_EQ(0, msync(start_address, page_size, MS_SYNC));
   allocator()->Free<MemoryAllocator::kPooledAndQueue>(page);
   EXPECT_EQ(0, msync(start_address, page_size, MS_SYNC));
diff --git a/deps/v8/test/unittests/heap/worklist-unittest.cc b/deps/v8/test/unittests/heap/worklist-unittest.cc
index 49423dbe77d727..b7e12314248ee9 100644
--- a/deps/v8/test/unittests/heap/worklist-unittest.cc
+++ b/deps/v8/test/unittests/heap/worklist-unittest.cc
@@ -111,7 +111,7 @@ TEST(WorkListTest, CreateEmpty) {
   TestWorklist worklist;
   TestWorklist::View worklist_view(&worklist, 0);
   EXPECT_TRUE(worklist_view.IsLocalEmpty());
-  EXPECT_TRUE(worklist.IsGlobalEmpty());
+  EXPECT_TRUE(worklist.IsEmpty());
 }
 
 TEST(WorkListTest, LocalPushPop) {
@@ -147,14 +147,14 @@ TEST(WorkListTest, LocalPushStaysPrivate) {
   TestWorklist::View worklist_view2(&worklist, 1);
   SomeObject dummy;
   SomeObject* retrieved = nullptr;
-  EXPECT_TRUE(worklist.IsGlobalEmpty());
+  EXPECT_TRUE(worklist.IsEmpty());
   EXPECT_TRUE(worklist_view1.Push(&dummy));
-  EXPECT_FALSE(worklist.IsGlobalEmpty());
+  EXPECT_FALSE(worklist.IsEmpty());
   EXPECT_FALSE(worklist_view2.Pop(&retrieved));
   EXPECT_EQ(nullptr, retrieved);
   EXPECT_TRUE(worklist_view1.Pop(&retrieved));
   EXPECT_EQ(&dummy, retrieved);
-  EXPECT_TRUE(worklist.IsGlobalEmpty());
+  EXPECT_TRUE(worklist.IsEmpty());
 }
 
 TEST(WorkListTest, GlobalUpdateNull) {
@@ -167,7 +167,7 @@ TEST(WorkListTest, GlobalUpdateNull) {
   }
   EXPECT_TRUE(worklist_view.Push(object));
   worklist.Update([](SomeObject* object, SomeObject** out) { return false; });
-  EXPECT_TRUE(worklist.IsGlobalEmpty());
+  EXPECT_TRUE(worklist.IsEmpty());
 }
 
 TEST(WorkListTest, GlobalUpdate) {
@@ -236,7 +236,7 @@ TEST(WorkListTest, Clear) {
   }
   EXPECT_TRUE(worklist_view.Push(object));
   worklist.Clear();
-  EXPECT_TRUE(worklist.IsGlobalEmpty());
+  EXPECT_TRUE(worklist.IsEmpty());
 }
 
 TEST(WorkListTest, SingleSegmentSteal) {
@@ -258,7 +258,7 @@ TEST(WorkListTest, SingleSegmentSteal) {
     EXPECT_EQ(&dummy, retrieved);
     EXPECT_FALSE(worklist_view1.Pop(&retrieved));
   }
-  EXPECT_TRUE(worklist.IsGlobalEmpty());
+  EXPECT_TRUE(worklist.IsEmpty());
 }
 
 TEST(WorkListTest, MultipleSegmentsStolen) {
@@ -298,7 +298,7 @@ TEST(WorkListTest, MultipleSegmentsStolen) {
     EXPECT_EQ(expect_bag3, retrieved);
     EXPECT_FALSE(worklist_view1.Pop(&retrieved));
   }
-  EXPECT_TRUE(worklist.IsGlobalEmpty());
+  EXPECT_TRUE(worklist.IsEmpty());
 }
 
 TEST(WorkListTest, MergeGlobalPool) {
@@ -317,14 +317,14 @@ TEST(WorkListTest, MergeGlobalPool) {
   TestWorklist worklist2;
   TestWorklist::View worklist_view2(&worklist2, 0);
   worklist2.MergeGlobalPool(&worklist1);
-  EXPECT_FALSE(worklist2.IsGlobalEmpty());
+  EXPECT_FALSE(worklist2.IsEmpty());
   for (size_t i = 0; i < TestWorklist::kSegmentCapacity; i++) {
     EXPECT_TRUE(worklist_view2.Pop(&retrieved));
     EXPECT_EQ(&dummy, retrieved);
     EXPECT_FALSE(worklist_view1.Pop(&retrieved));
   }
-  EXPECT_TRUE(worklist1.IsGlobalEmpty());
-  EXPECT_TRUE(worklist2.IsGlobalEmpty());
+  EXPECT_TRUE(worklist1.IsEmpty());
+  EXPECT_TRUE(worklist2.IsEmpty());
 }
 
 }  // namespace internal
diff --git a/deps/v8/test/unittests/interpreter/bytecode-array-builder-unittest.cc b/deps/v8/test/unittests/interpreter/bytecode-array-builder-unittest.cc
index e6348f47855f7a..1ae636ecebba0b 100644
--- a/deps/v8/test/unittests/interpreter/bytecode-array-builder-unittest.cc
+++ b/deps/v8/test/unittests/interpreter/bytecode-array-builder-unittest.cc
@@ -168,9 +168,9 @@ TEST_F(BytecodeArrayBuilderTest, AllBytecodesGenerated) {
 
   // Emit create context operation.
   builder.CreateBlockContext(&scope);
-  builder.CreateCatchContext(reg, name, &scope);
-  builder.CreateFunctionContext(1);
-  builder.CreateEvalContext(1);
+  builder.CreateCatchContext(reg, &scope);
+  builder.CreateFunctionContext(&scope, 1);
+  builder.CreateEvalContext(&scope, 1);
   builder.CreateWithContext(reg, &scope);
 
   // Emit literal creation operations.
@@ -193,7 +193,7 @@ TEST_F(BytecodeArrayBuilderTest, AllBytecodesGenerated) {
       .CallUndefinedReceiver(reg, pair, 1)
       .CallRuntime(Runtime::kIsArray, reg)
       .CallRuntimeForPair(Runtime::kLoadLookupSlotForCall, reg_list, pair)
-      .CallJSRuntime(Context::OBJECT_IS_FROZEN, reg_list)
+      .CallJSRuntime(Context::OBJECT_CREATE, reg_list)
       .CallWithSpread(reg, reg_list, 1);
 
   // Emit binary operator invocations.
@@ -249,7 +249,6 @@ TEST_F(BytecodeArrayBuilderTest, AllBytecodesGenerated) {
   // Emit test operator invocations.
   builder.CompareOperation(Token::Value::EQ, reg, 1)
       .CompareOperation(Token::Value::EQ_STRICT, reg, 2)
-      .CompareOperation(Token::Value::EQ_STRICT, reg)
       .CompareOperation(Token::Value::LT, reg, 3)
       .CompareOperation(Token::Value::GT, reg, 4)
       .CompareOperation(Token::Value::LTE, reg, 5)
@@ -257,6 +256,7 @@ TEST_F(BytecodeArrayBuilderTest, AllBytecodesGenerated) {
       .CompareTypeOf(TestTypeOfFlags::LiteralFlag::kNumber)
       .CompareOperation(Token::Value::INSTANCEOF, reg, 7)
       .CompareOperation(Token::Value::IN, reg)
+      .CompareReference(reg)
       .CompareUndetectable()
       .CompareUndefined()
       .CompareNull();
@@ -630,7 +630,7 @@ TEST_F(BytecodeArrayBuilderTest, ForwardJumps) {
   iterator.Advance();
 
   CHECK_EQ(iterator.current_bytecode(), Bytecode::kJumpConstant);
-  CHECK_EQ(*iterator.GetConstantForIndexOperand(0),
+  CHECK_EQ(iterator.GetConstantForIndexOperand(0),
            Smi::FromInt(kFarJumpDistance));
   iterator.Advance();
 
@@ -638,7 +638,7 @@ TEST_F(BytecodeArrayBuilderTest, ForwardJumps) {
   iterator.Advance();
 
   CHECK_EQ(iterator.current_bytecode(), Bytecode::kJumpIfTrueConstant);
-  CHECK_EQ(*iterator.GetConstantForIndexOperand(0),
+  CHECK_EQ(iterator.GetConstantForIndexOperand(0),
            Smi::FromInt(kFarJumpDistance - 5));
   iterator.Advance();
 
@@ -646,7 +646,7 @@ TEST_F(BytecodeArrayBuilderTest, ForwardJumps) {
   iterator.Advance();
 
   CHECK_EQ(iterator.current_bytecode(), Bytecode::kJumpIfFalseConstant);
-  CHECK_EQ(*iterator.GetConstantForIndexOperand(0),
+  CHECK_EQ(iterator.GetConstantForIndexOperand(0),
            Smi::FromInt(kFarJumpDistance - 10));
   iterator.Advance();
 
@@ -654,7 +654,7 @@ TEST_F(BytecodeArrayBuilderTest, ForwardJumps) {
   iterator.Advance();
 
   CHECK_EQ(iterator.current_bytecode(), Bytecode::kJumpIfToBooleanTrueConstant);
-  CHECK_EQ(*iterator.GetConstantForIndexOperand(0),
+  CHECK_EQ(iterator.GetConstantForIndexOperand(0),
            Smi::FromInt(kFarJumpDistance - 15));
   iterator.Advance();
 
@@ -663,7 +663,7 @@ TEST_F(BytecodeArrayBuilderTest, ForwardJumps) {
 
   CHECK_EQ(iterator.current_bytecode(),
            Bytecode::kJumpIfToBooleanFalseConstant);
-  CHECK_EQ(*iterator.GetConstantForIndexOperand(0),
+  CHECK_EQ(iterator.GetConstantForIndexOperand(0),
            Smi::FromInt(kFarJumpDistance - 20));
   iterator.Advance();
 }
diff --git a/deps/v8/test/unittests/interpreter/interpreter-assembler-unittest.cc b/deps/v8/test/unittests/interpreter/interpreter-assembler-unittest.cc
index cb4875063cf500..d5f84952c33515 100644
--- a/deps/v8/test/unittests/interpreter/interpreter-assembler-unittest.cc
+++ b/deps/v8/test/unittests/interpreter/interpreter-assembler-unittest.cc
@@ -25,10 +25,9 @@ namespace interpreter_assembler_unittest {
 InterpreterAssemblerTestState::InterpreterAssemblerTestState(
     InterpreterAssemblerTest* test, Bytecode bytecode)
     : compiler::CodeAssemblerState(
-          test->isolate(), test->zone(),
-          InterpreterDispatchDescriptor(test->isolate()),
+          test->isolate(), test->zone(), InterpreterDispatchDescriptor{},
           Code::BYTECODE_HANDLER, Bytecodes::ToString(bytecode),
-          PoisoningMitigationLevel::kOn, Bytecodes::ReturnCount(bytecode)) {}
+          PoisoningMitigationLevel::kPoisonCriticalOnly) {}
 
 const interpreter::Bytecode kBytecodes[] = {
 #define DEFINE_BYTECODE(Name, ...) interpreter::Bytecode::k##Name,
@@ -53,8 +52,10 @@ Matcher<Node*> InterpreterAssemblerTest::InterpreterAssemblerForTest::IsLoad(
     const Matcher<c::LoadRepresentation>& rep_matcher,
     const Matcher<Node*>& base_matcher, const Matcher<Node*>& index_matcher,
     LoadSensitivity needs_poisoning) {
-  if (poisoning_enabled() == PoisoningMitigationLevel::kOn &&
-      needs_poisoning == LoadSensitivity::kNeedsPoisoning) {
+  CHECK_NE(LoadSensitivity::kUnsafe, needs_poisoning);
+  CHECK_NE(PoisoningMitigationLevel::kPoisonAll, poisoning_level());
+  if (poisoning_level() == PoisoningMitigationLevel::kPoisonCriticalOnly &&
+      needs_poisoning == LoadSensitivity::kCritical) {
     return ::i::compiler::IsPoisonedLoad(rep_matcher, base_matcher,
                                          index_matcher, _, _);
   }
@@ -293,7 +294,7 @@ InterpreterAssemblerTest::InterpreterAssemblerForTest::IsLoadRegisterOperand(
   return IsLoad(
       MachineType::AnyTagged(), c::IsLoadParentFramePointer(),
       c::IsWordShl(reg_operand, c::IsIntPtrConstant(kPointerSizeLog2)),
-      LoadSensitivity::kNeedsPoisoning);
+      LoadSensitivity::kCritical);
 }
 
 TARGET_TEST_F(InterpreterAssemblerTest, Jump) {
@@ -354,45 +355,43 @@ TARGET_TEST_F(InterpreterAssemblerTest, BytecodeOperand) {
           case interpreter::OperandType::kRegCount:
             EXPECT_THAT(m.BytecodeOperandCount(i),
                         m.IsUnsignedOperand(offset, operand_size,
-                                            LoadSensitivity::kNeedsPoisoning));
+                                            LoadSensitivity::kCritical));
             break;
           case interpreter::OperandType::kFlag8:
             EXPECT_THAT(m.BytecodeOperandFlag(i),
                         m.IsUnsignedOperand(offset, operand_size,
-                                            LoadSensitivity::kNeedsPoisoning));
+                                            LoadSensitivity::kCritical));
             break;
           case interpreter::OperandType::kIdx:
-            EXPECT_THAT(
-                m.BytecodeOperandIdx(i),
-                c::IsChangeUint32ToWord(m.IsUnsignedOperand(
-                    offset, operand_size, LoadSensitivity::kNeedsPoisoning)));
+            EXPECT_THAT(m.BytecodeOperandIdx(i),
+                        c::IsChangeUint32ToWord(m.IsUnsignedOperand(
+                            offset, operand_size, LoadSensitivity::kCritical)));
             break;
           case interpreter::OperandType::kNativeContextIndex:
-            EXPECT_THAT(
-                m.BytecodeOperandNativeContextIndex(i),
-                c::IsChangeUint32ToWord(m.IsUnsignedOperand(
-                    offset, operand_size, LoadSensitivity::kNeedsPoisoning)));
+            EXPECT_THAT(m.BytecodeOperandNativeContextIndex(i),
+                        c::IsChangeUint32ToWord(m.IsUnsignedOperand(
+                            offset, operand_size, LoadSensitivity::kCritical)));
             break;
           case interpreter::OperandType::kUImm:
             EXPECT_THAT(m.BytecodeOperandUImm(i),
                         m.IsUnsignedOperand(offset, operand_size,
-                                            LoadSensitivity::kNeedsPoisoning));
+                                            LoadSensitivity::kCritical));
             break;
           case interpreter::OperandType::kImm: {
             EXPECT_THAT(m.BytecodeOperandImm(i),
                         m.IsSignedOperand(offset, operand_size,
-                                          LoadSensitivity::kNeedsPoisoning));
+                                          LoadSensitivity::kCritical));
             break;
           }
           case interpreter::OperandType::kRuntimeId:
             EXPECT_THAT(m.BytecodeOperandRuntimeId(i),
                         m.IsUnsignedOperand(offset, operand_size,
-                                            LoadSensitivity::kNeedsPoisoning));
+                                            LoadSensitivity::kCritical));
             break;
           case interpreter::OperandType::kIntrinsicId:
             EXPECT_THAT(m.BytecodeOperandIntrinsicId(i),
                         m.IsUnsignedOperand(offset, operand_size,
-                                            LoadSensitivity::kNeedsPoisoning));
+                                            LoadSensitivity::kCritical));
             break;
           case interpreter::OperandType::kRegList:
           case interpreter::OperandType::kReg:
@@ -442,7 +441,7 @@ TARGET_TEST_F(InterpreterAssemblerTest, LoadConstantPoolEntry) {
           m.IsLoad(MachineType::AnyTagged(), constant_pool_matcher,
                    c::IsIntPtrConstant(FixedArray::OffsetOfElementAt(2) -
                                        kHeapObjectTag),
-                   LoadSensitivity::kNeedsPoisoning));
+                   LoadSensitivity::kCritical));
     }
     {
       Node* index = m.Parameter(2);
@@ -459,7 +458,7 @@ TARGET_TEST_F(InterpreterAssemblerTest, LoadConstantPoolEntry) {
               c::IsIntPtrAdd(
                   c::IsIntPtrConstant(FixedArray::kHeaderSize - kHeapObjectTag),
                   c::IsWordShl(index, c::IsIntPtrConstant(kPointerSizeLog2))),
-              LoadSensitivity::kNeedsPoisoning));
+              LoadSensitivity::kCritical));
     }
   }
 }
diff --git a/deps/v8/test/unittests/libplatform/default-platform-unittest.cc b/deps/v8/test/unittests/libplatform/default-platform-unittest.cc
index 6417e56482e19e..031eb9efbde32b 100644
--- a/deps/v8/test/unittests/libplatform/default-platform-unittest.cc
+++ b/deps/v8/test/unittests/libplatform/default-platform-unittest.cc
@@ -258,48 +258,32 @@ class TestBackgroundTask : public Task {
 }  // namespace
 
 TEST(DefaultPlatformTest, RunBackgroundTask) {
-  int dummy;
-  Isolate* isolate = reinterpret_cast<Isolate*>(&dummy);
-
   DefaultPlatform platform;
   platform.SetThreadPoolSize(1);
-  std::shared_ptr<TaskRunner> taskrunner =
-      platform.GetWorkerThreadsTaskRunner(isolate);
 
   base::Semaphore sem(0);
   bool task_executed = false;
   StrictMock<TestBackgroundTask>* task =
       new StrictMock<TestBackgroundTask>(&sem, &task_executed);
   EXPECT_CALL(*task, Die());
-  taskrunner->PostTask(std::unique_ptr<Task>(task));
+  platform.CallOnWorkerThread(std::unique_ptr<Task>(task));
   EXPECT_TRUE(sem.WaitFor(base::TimeDelta::FromSeconds(1)));
   EXPECT_TRUE(task_executed);
 }
 
-TEST(DefaultPlatformTest, NoIdleTasksInBackground) {
-  int dummy;
-  Isolate* isolate = reinterpret_cast<Isolate*>(&dummy);
-  DefaultPlatform platform;
-  platform.SetThreadPoolSize(1);
-  std::shared_ptr<TaskRunner> taskrunner =
-      platform.GetWorkerThreadsTaskRunner(isolate);
-  EXPECT_FALSE(taskrunner->IdleTasksEnabled());
-}
-
-TEST(DefaultPlatformTest, PostTaskAfterPlatformTermination) {
+TEST(DefaultPlatformTest, PostForegroundTaskAfterPlatformTermination) {
   std::shared_ptr<TaskRunner> foreground_taskrunner;
-  std::shared_ptr<TaskRunner> background_taskrunner;
   {
+    DefaultPlatformWithMockTime platform;
+
     int dummy;
     Isolate* isolate = reinterpret_cast<Isolate*>(&dummy);
 
-    DefaultPlatformWithMockTime platform;
     platform.SetThreadPoolSize(1);
     foreground_taskrunner = platform.GetForegroundTaskRunner(isolate);
-    background_taskrunner = platform.GetWorkerThreadsTaskRunner(isolate);
   }
-  // It should still be possible to post tasks, even when the platform does not
-  // exist anymore.
+  // It should still be possible to post foreground tasks, even when the
+  // platform does not exist anymore.
   StrictMock<MockTask>* task1 = new StrictMock<MockTask>;
   EXPECT_CALL(*task1, Die());
   foreground_taskrunner->PostTask(std::unique_ptr<Task>(task1));
@@ -311,10 +295,6 @@ TEST(DefaultPlatformTest, PostTaskAfterPlatformTermination) {
   StrictMock<MockIdleTask>* task3 = new StrictMock<MockIdleTask>;
   EXPECT_CALL(*task3, Die());
   foreground_taskrunner->PostIdleTask(std::unique_ptr<IdleTask>(task3));
-
-  StrictMock<MockTask>* task4 = new StrictMock<MockTask>;
-  EXPECT_CALL(*task4, Die());
-  background_taskrunner->PostTask(std::unique_ptr<Task>(task4));
 }
 
 }  // namespace default_platform_unittest
diff --git a/deps/v8/test/unittests/object-unittest.cc b/deps/v8/test/unittests/object-unittest.cc
index c88e04a89b5f78..6856053d2f1805 100644
--- a/deps/v8/test/unittests/object-unittest.cc
+++ b/deps/v8/test/unittests/object-unittest.cc
@@ -6,8 +6,10 @@
 #include <iostream>
 #include <limits>
 
+#include "src/compiler.h"
 #include "src/objects-inl.h"
 #include "src/objects.h"
+#include "src/objects/hash-table-inl.h"
 #include "test/unittests/test-utils.h"
 
 #include "testing/gtest/include/gtest/gtest.h"
@@ -149,5 +151,23 @@ TEST_F(ObjectWithIsolate, DictionaryGrowth) {
   CHECK_EQ(64, dict->Capacity());
 }
 
+TEST_F(TestWithNativeContext, EmptyFunctionScopeInfo) {
+  // Check that the empty_function has a properly set up ScopeInfo.
+  Handle<JSFunction> function = RunJS<JSFunction>("(function(){})");
+
+  Handle<ScopeInfo> scope_info(function->shared()->scope_info(),
+                               function->GetIsolate());
+  Handle<ScopeInfo> empty_function_scope_info(
+      isolate()->empty_function()->shared()->scope_info(),
+      function->GetIsolate());
+
+  EXPECT_EQ(scope_info->length(), empty_function_scope_info->length());
+  EXPECT_EQ(scope_info->Flags(), empty_function_scope_info->Flags());
+  EXPECT_EQ(scope_info->ParameterCount(),
+            empty_function_scope_info->ParameterCount());
+  EXPECT_EQ(scope_info->ContextLocalCount(),
+            empty_function_scope_info->ContextLocalCount());
+}
+
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/test/unittests/parser/preparser-unittest.cc b/deps/v8/test/unittests/parser/preparser-unittest.cc
index 37dda73822c3e7..a9f77b4b7aae30 100644
--- a/deps/v8/test/unittests/parser/preparser-unittest.cc
+++ b/deps/v8/test/unittests/parser/preparser-unittest.cc
@@ -24,7 +24,8 @@ TEST_F(PreParserTest, LazyFunctionLength) {
 
   Handle<JSFunction> lazy_function = RunJS<JSFunction>(script_source);
 
-  Handle<SharedFunctionInfo> shared(lazy_function->shared());
+  Handle<SharedFunctionInfo> shared(lazy_function->shared(),
+                                    lazy_function->GetIsolate());
   CHECK_EQ(shared->length(), SharedFunctionInfo::kInvalidLength);
 
   Handle<Smi> length = RunJS<Smi>("lazy.length");
diff --git a/deps/v8/test/unittests/strings-storage-unittest.cc b/deps/v8/test/unittests/strings-storage-unittest.cc
new file mode 100644
index 00000000000000..dad8356ad43657
--- /dev/null
+++ b/deps/v8/test/unittests/strings-storage-unittest.cc
@@ -0,0 +1,112 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "src/profiler/strings-storage.h"
+
+#include <cstdio>
+
+#include "test/unittests/test-utils.h"
+#include "testing/gtest/include/gtest/gtest.h"
+
+namespace v8 {
+namespace internal {
+
+typedef TestWithIsolate StringsStorageWithIsolate;
+
+bool StringEq(const char* left, const char* right) {
+  return strcmp(left, right) == 0;
+}
+
+TEST_F(StringsStorageWithIsolate, GetNameFromString) {
+  StringsStorage storage(isolate()->heap()->HashSeed());
+
+  // One char strings are canonical on the v8 heap so use a 2 char string here.
+  Handle<String> str = isolate()->factory()->NewStringFromAsciiChecked("xy");
+  const char* stored_str = storage.GetName(*str);
+  CHECK(StringEq("xy", stored_str));
+
+  // The storage should de-duplicate the underlying char arrays and return the
+  // exact same pointer for equivalent input strings.
+  const char* stored_str_twice = storage.GetName(*str);
+  CHECK_EQ(stored_str, stored_str_twice);
+
+  // Even if the input string was a different one on the v8 heap, if the char
+  // array is the same, it should be de-duplicated.
+  Handle<String> str2 = isolate()->factory()->NewStringFromAsciiChecked("xy");
+  CHECK_NE(*str, *str2);
+  const char* stored_str_thrice = storage.GetName(*str2);
+  CHECK_EQ(stored_str_twice, stored_str_thrice);
+}
+
+TEST_F(StringsStorageWithIsolate, GetNameFromSymbol) {
+  StringsStorage storage(isolate()->heap()->HashSeed());
+
+  Handle<Symbol> symbol = isolate()->factory()->NewSymbol();
+  const char* stored_symbol = storage.GetName(*symbol);
+  CHECK(StringEq("<symbol>", stored_symbol));
+
+  Handle<Symbol> symbol2 = isolate()->factory()->NewSymbol();
+  CHECK_NE(*symbol, *symbol2);
+  const char* stored_symbol2 = storage.GetName(*symbol2);
+  CHECK_EQ(stored_symbol, stored_symbol2);
+}
+
+TEST_F(StringsStorageWithIsolate, GetConsName) {
+  StringsStorage storage(isolate()->heap()->HashSeed());
+
+  Handle<String> str = isolate()->factory()->NewStringFromAsciiChecked("xy");
+
+  const char* empty_prefix_str = storage.GetConsName("", *str);
+  CHECK(StringEq("xy", empty_prefix_str));
+
+  const char* get_str = storage.GetConsName("get ", *str);
+  CHECK(StringEq("get xy", get_str));
+}
+
+TEST_F(StringsStorageWithIsolate, GetNameFromInt) {
+  StringsStorage storage(isolate()->heap()->HashSeed());
+
+  const char* stored_str = storage.GetName(0);
+  CHECK(StringEq("0", stored_str));
+
+  stored_str = storage.GetName(2147483647);
+  CHECK(StringEq("2147483647", stored_str));
+
+  stored_str = storage.GetName(std::numeric_limits<int>::min());
+  char str_negative_int[12];
+  snprintf(str_negative_int, sizeof(str_negative_int), "%d",
+           std::numeric_limits<int>::min());
+  CHECK(StringEq(str_negative_int, stored_str));
+}
+
+TEST_F(StringsStorageWithIsolate, Format) {
+  StringsStorage storage(isolate()->heap()->HashSeed());
+
+  const char* xy = "xy";
+  const char* stored_str = storage.GetFormatted("%s", xy);
+  CHECK(StringEq("xy", stored_str));
+  // Check that the string is copied.
+  CHECK_NE(xy, stored_str);
+
+  const char* formatted_str = storage.GetFormatted("%s / %s", xy, xy);
+  CHECK(StringEq("xy / xy", formatted_str));
+
+  // A different format specifier that results in the same string should share
+  // the string in storage.
+  const char* formatted_str2 = storage.GetFormatted("%s", "xy / xy");
+  CHECK_EQ(formatted_str, formatted_str2);
+}
+
+TEST_F(StringsStorageWithIsolate, FormatAndGetShareStorage) {
+  StringsStorage storage(isolate()->heap()->HashSeed());
+
+  Handle<String> str = isolate()->factory()->NewStringFromAsciiChecked("xy");
+  const char* stored_str = storage.GetName(*str);
+
+  const char* formatted_str = storage.GetFormatted("%s", "xy");
+  CHECK_EQ(stored_str, formatted_str);
+}
+
+}  // namespace internal
+}  // namespace v8
diff --git a/deps/v8/test/unittests/test-helpers.cc b/deps/v8/test/unittests/test-helpers.cc
index a40b0359effec3..1fdb6363abc847 100644
--- a/deps/v8/test/unittests/test-helpers.cc
+++ b/deps/v8/test/unittests/test-helpers.cc
@@ -38,7 +38,10 @@ Handle<SharedFunctionInfo> CreateSharedFunctionInfo(
       isolate->factory()->NewSharedFunctionInfoForBuiltin(
           isolate->factory()->NewStringFromAsciiChecked("f"),
           Builtins::kCompileLazy);
-  shared->set_raw_end_position(source->length());
+  // Ensure that the function can be compiled lazily.
+  shared->set_uncompiled_data(
+      *isolate->factory()->NewUncompiledDataWithoutPreParsedScope(
+          0, source->length()));
   // Make sure we have an outer scope info, even though it's empty
   shared->set_raw_outer_scope_info_or_feedback_metadata(
       ScopeInfo::Empty(isolate));
diff --git a/deps/v8/test/unittests/unittests.status b/deps/v8/test/unittests/unittests.status
index 51f3462fe9429d..d44d4b4e3331a3 100644
--- a/deps/v8/test/unittests/unittests.status
+++ b/deps/v8/test/unittests/unittests.status
@@ -9,6 +9,8 @@
   'LiveRangeUnitTest*': [SKIP],
   'LoggingDeathTest*': [SKIP],
   'LoggingTest.CompareClassTypes': [SKIP],
+  'LoggingTest.CompareWithDifferentSignedness': [SKIP],
+  'LoggingTest.CompareWithReferenceType': [SKIP],
   'RandomNumberGenerator.NextSampleInvalidParam': [SKIP],
   'RandomNumberGenerator.NextSampleSlowInvalidParam1': [SKIP],
   'RandomNumberGenerator.NextSampleSlowInvalidParam2': [SKIP],
diff --git a/deps/v8/test/unittests/utils-unittest.cc b/deps/v8/test/unittests/utils-unittest.cc
index 65088d873b2bd4..0a37e84ab5520d 100644
--- a/deps/v8/test/unittests/utils-unittest.cc
+++ b/deps/v8/test/unittests/utils-unittest.cc
@@ -109,5 +109,28 @@ TYPED_TEST(UtilsTest, SaturateAdd) {
   }
 }
 
+TYPED_TEST(UtilsTest, PassesFilterTest) {
+  EXPECT_TRUE(PassesFilter(CStrVector("abcdefg"), CStrVector("abcdefg")));
+  EXPECT_TRUE(PassesFilter(CStrVector("abcdefg"), CStrVector("abcdefg*")));
+  EXPECT_TRUE(PassesFilter(CStrVector("abcdefg"), CStrVector("abc*")));
+  EXPECT_TRUE(PassesFilter(CStrVector("abcdefg"), CStrVector("*")));
+  EXPECT_TRUE(PassesFilter(CStrVector("abcdefg"), CStrVector("-~")));
+  EXPECT_TRUE(PassesFilter(CStrVector("abcdefg"), CStrVector("-abcdefgh")));
+  EXPECT_TRUE(PassesFilter(CStrVector("abdefg"), CStrVector("-")));
+  EXPECT_FALSE(PassesFilter(CStrVector("abcdefg"), CStrVector("-abcdefg")));
+  EXPECT_FALSE(PassesFilter(CStrVector("abcdefg"), CStrVector("-abcdefg*")));
+  EXPECT_FALSE(PassesFilter(CStrVector("abcdefg"), CStrVector("-abc*")));
+  EXPECT_FALSE(PassesFilter(CStrVector("abcdefg"), CStrVector("-*")));
+  EXPECT_FALSE(PassesFilter(CStrVector("abcdefg"), CStrVector("~")));
+  EXPECT_FALSE(PassesFilter(CStrVector("abcdefg"), CStrVector("")));
+  EXPECT_FALSE(PassesFilter(CStrVector("abcdefg"), CStrVector("abcdefgh")));
+
+  EXPECT_TRUE(PassesFilter(CStrVector(""), CStrVector("")));
+  EXPECT_TRUE(PassesFilter(CStrVector(""), CStrVector("*")));
+  EXPECT_FALSE(PassesFilter(CStrVector(""), CStrVector("-")));
+  EXPECT_FALSE(PassesFilter(CStrVector(""), CStrVector("-*")));
+  EXPECT_FALSE(PassesFilter(CStrVector(""), CStrVector("a")));
+}
+
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/test/unittests/wasm/function-body-decoder-unittest.cc b/deps/v8/test/unittests/wasm/function-body-decoder-unittest.cc
index 147c42caac6443..1d480a9d094626 100644
--- a/deps/v8/test/unittests/wasm/function-body-decoder-unittest.cc
+++ b/deps/v8/test/unittests/wasm/function-body-decoder-unittest.cc
@@ -205,10 +205,11 @@ constexpr size_t kMaxByteSizedLeb128 = 127;
 class TestModuleBuilder {
  public:
   explicit TestModuleBuilder(ModuleOrigin origin = kWasmOrigin) {
-    mod.set_origin(origin);
+    mod.origin = origin;
   }
   byte AddGlobal(ValueType type, bool mutability = true) {
-    mod.globals.push_back({type, mutability, WasmInitExpr(), 0, false, false});
+    mod.globals.push_back(
+        {type, mutability, WasmInitExpr(), {0}, false, false});
     CHECK_LE(mod.globals.size(), kMaxByteSizedLeb128);
     return static_cast<byte>(mod.globals.size() - 1);
   }
@@ -244,7 +245,7 @@ class TestModuleBuilder {
     mod.maximum_pages = 100;
   }
 
-  void InitializeFunctionTable() { mod.function_tables.emplace_back(); }
+  void InitializeTable() { mod.tables.emplace_back(); }
 
   WasmModule* module() { return &mod; }
 
@@ -306,7 +307,7 @@ TEST_F(FunctionBodyDecoderTest, Int64Const) {
 
 TEST_F(FunctionBodyDecoderTest, Float32Const) {
   byte code[] = {kExprF32Const, 0, 0, 0, 0};
-  float* ptr = reinterpret_cast<float*>(code + 1);
+  Address ptr = reinterpret_cast<Address>(code + 1);
   for (int i = 0; i < 30; i++) {
     WriteLittleEndianValue<float>(ptr, i * -7.75f);
     EXPECT_VERIFIES_C(f_ff, code);
@@ -315,7 +316,7 @@ TEST_F(FunctionBodyDecoderTest, Float32Const) {
 
 TEST_F(FunctionBodyDecoderTest, Float64Const) {
   byte code[] = {kExprF64Const, 0, 0, 0, 0, 0, 0, 0, 0};
-  double* ptr = reinterpret_cast<double*>(code + 1);
+  Address ptr = reinterpret_cast<Address>(code + 1);
   for (int i = 0; i < 30; i++) {
     WriteLittleEndianValue<double>(ptr, i * 33.45);
     EXPECT_VERIFIES_C(d_dd, code);
@@ -1387,7 +1388,7 @@ TEST_F(FunctionBodyDecoderTest, AllLoadMemCombinations) {
       MachineType mem_type = machineTypes[j];
       byte code[] = {WASM_LOAD_MEM(mem_type, WASM_ZERO)};
       FunctionSig sig(1, 0, &local_type);
-      if (local_type == WasmOpcodes::ValueTypeFor(mem_type)) {
+      if (local_type == ValueTypes::ValueTypeFor(mem_type)) {
         EXPECT_VERIFIES_SC(&sig, code);
       } else {
         EXPECT_FAILURE_SC(&sig, code);
@@ -1406,7 +1407,7 @@ TEST_F(FunctionBodyDecoderTest, AllStoreMemCombinations) {
       MachineType mem_type = machineTypes[j];
       byte code[] = {WASM_STORE_MEM(mem_type, WASM_ZERO, WASM_GET_LOCAL(0))};
       FunctionSig sig(0, 1, &local_type);
-      if (local_type == WasmOpcodes::ValueTypeFor(mem_type)) {
+      if (local_type == ValueTypes::ValueTypeFor(mem_type)) {
         EXPECT_VERIFIES_SC(&sig, code);
       } else {
         EXPECT_FAILURE_SC(&sig, code);
@@ -1521,7 +1522,7 @@ TEST_F(FunctionBodyDecoderTest, MultiReturnType) {
 TEST_F(FunctionBodyDecoderTest, SimpleIndirectCalls) {
   FunctionSig* sig = sigs.i_i();
   TestModuleBuilder builder;
-  builder.InitializeFunctionTable();
+  builder.InitializeTable();
   module = builder.module();
 
   byte f0 = builder.AddSignature(sigs.i_v());
@@ -1537,7 +1538,7 @@ TEST_F(FunctionBodyDecoderTest, SimpleIndirectCalls) {
 TEST_F(FunctionBodyDecoderTest, IndirectCallsOutOfBounds) {
   FunctionSig* sig = sigs.i_i();
   TestModuleBuilder builder;
-  builder.InitializeFunctionTable();
+  builder.InitializeTable();
   module = builder.module();
 
   EXPECT_FAILURE_S(sig, WASM_CALL_INDIRECT0(0, WASM_ZERO));
@@ -1554,7 +1555,7 @@ TEST_F(FunctionBodyDecoderTest, IndirectCallsOutOfBounds) {
 TEST_F(FunctionBodyDecoderTest, IndirectCallsWithMismatchedSigs3) {
   FunctionSig* sig = sigs.i_i();
   TestModuleBuilder builder;
-  builder.InitializeFunctionTable();
+  builder.InitializeTable();
   module = builder.module();
 
   byte f0 = builder.AddFunction(sigs.i_f());
@@ -1592,7 +1593,7 @@ TEST_F(FunctionBodyDecoderTest, IndirectCallsWithoutTableCrash) {
 TEST_F(FunctionBodyDecoderTest, IncompleteIndirectCall) {
   FunctionSig* sig = sigs.i_i();
   TestModuleBuilder builder;
-  builder.InitializeFunctionTable();
+  builder.InitializeTable();
   module = builder.module();
 
   static byte code[] = {kExprCallIndirect};
@@ -1603,7 +1604,7 @@ TEST_F(FunctionBodyDecoderTest, IncompleteStore) {
   FunctionSig* sig = sigs.i_i();
   TestModuleBuilder builder;
   builder.InitializeMemory();
-  builder.InitializeFunctionTable();
+  builder.InitializeTable();
   module = builder.module();
 
   static byte code[] = {kExprI32StoreMem};
@@ -1615,7 +1616,7 @@ TEST_F(FunctionBodyDecoderTest, IncompleteS8x16Shuffle) {
   FunctionSig* sig = sigs.i_i();
   TestModuleBuilder builder;
   builder.InitializeMemory();
-  builder.InitializeFunctionTable();
+  builder.InitializeTable();
   module = builder.module();
 
   static byte code[] = {kSimdPrefix,
@@ -2691,14 +2692,14 @@ class BranchTableIteratorTest : public TestWithZone {
   BranchTableIteratorTest() : TestWithZone() {}
   void CheckBrTableSize(const byte* start, const byte* end) {
     Decoder decoder(start, end);
-    BranchTableOperand<Decoder::kValidate> operand(&decoder, start);
+    BranchTableImmediate<Decoder::kValidate> operand(&decoder, start);
     BranchTableIterator<Decoder::kValidate> iterator(&decoder, operand);
     EXPECT_EQ(end - start - 1u, iterator.length());
     EXPECT_TRUE(decoder.ok());
   }
   void CheckBrTableError(const byte* start, const byte* end) {
     Decoder decoder(start, end);
-    BranchTableOperand<Decoder::kValidate> operand(&decoder, start);
+    BranchTableImmediate<Decoder::kValidate> operand(&decoder, start);
     BranchTableIterator<Decoder::kValidate> iterator(&decoder, operand);
     iterator.length();
     EXPECT_FALSE(decoder.ok());
@@ -3027,8 +3028,8 @@ TEST_F(LocalDeclDecoderTest, OneLocal) {
   EXPERIMENTAL_FLAG_SCOPE(anyref);
   for (size_t i = 0; i < arraysize(kValueTypes); i++) {
     ValueType type = kValueTypes[i];
-    const byte data[] = {
-        1, 1, static_cast<byte>(WasmOpcodes::ValueTypeCodeFor(type))};
+    const byte data[] = {1, 1,
+                         static_cast<byte>(ValueTypes::ValueTypeCodeFor(type))};
     BodyLocalDecls decls(zone());
     bool result = DecodeLocalDecls(&decls, data, data + sizeof(data));
     EXPECT_TRUE(result);
@@ -3043,8 +3044,8 @@ TEST_F(LocalDeclDecoderTest, FiveLocals) {
   EXPERIMENTAL_FLAG_SCOPE(anyref);
   for (size_t i = 0; i < arraysize(kValueTypes); i++) {
     ValueType type = kValueTypes[i];
-    const byte data[] = {
-        1, 5, static_cast<byte>(WasmOpcodes::ValueTypeCodeFor(type))};
+    const byte data[] = {1, 5,
+                         static_cast<byte>(ValueTypes::ValueTypeCodeFor(type))};
     BodyLocalDecls decls(zone());
     bool result = DecodeLocalDecls(&decls, data, data + sizeof(data));
     EXPECT_TRUE(result);
diff --git a/deps/v8/test/unittests/wasm/module-decoder-unittest.cc b/deps/v8/test/unittests/wasm/module-decoder-unittest.cc
index 79ae8e578bf2a0..a6ad2ce0c82904 100644
--- a/deps/v8/test/unittests/wasm/module-decoder-unittest.cc
+++ b/deps/v8/test/unittests/wasm/module-decoder-unittest.cc
@@ -135,11 +135,14 @@ static size_t SizeOfVarInt(size_t value) {
 struct ValueTypePair {
   uint8_t code;
   ValueType type;
-} kValueTypes[] = {{kLocalI32, kWasmI32},
-                   {kLocalI64, kWasmI64},
-                   {kLocalF32, kWasmF32},
-                   {kLocalF64, kWasmF64},
-                   {kLocalAnyRef, kWasmAnyRef}};
+} kValueTypes[] = {
+    {kLocalI32, kWasmI32},          // --
+    {kLocalI64, kWasmI64},          // --
+    {kLocalF32, kWasmF32},          // --
+    {kLocalF64, kWasmF64},          // --
+    {kLocalAnyFunc, kWasmAnyFunc},  // --
+    {kLocalAnyRef, kWasmAnyRef}     // --
+};
 
 class WasmModuleVerifyTest : public TestWithIsolateAndZone {
  public:
@@ -346,7 +349,7 @@ TEST_F(WasmModuleVerifyTest, ExportMutableGlobal) {
         kExternalGlobal,            // global
         0,                          // global index
     };
-    EXPECT_FAILURE(data);
+    EXPECT_VERIFIES(data);
   }
 }
 
@@ -462,7 +465,7 @@ TEST_F(WasmModuleVerifyTest, OneI32Exception) {
 
   const WasmException& e0 = result.val->exceptions.front();
   EXPECT_EQ(1u, e0.sig->parameter_count());
-  EXPECT_EQ(MachineRepresentation::kWord32, e0.sig->GetParam(0));
+  EXPECT_EQ(kWasmI32, e0.sig->GetParam(0));
 }
 
 TEST_F(WasmModuleVerifyTest, TwoExceptions) {
@@ -479,10 +482,10 @@ TEST_F(WasmModuleVerifyTest, TwoExceptions) {
   EXPECT_EQ(2u, result.val->exceptions.size());
   const WasmException& e0 = result.val->exceptions.front();
   EXPECT_EQ(2u, e0.sig->parameter_count());
-  EXPECT_EQ(MachineRepresentation::kFloat32, e0.sig->GetParam(0));
-  EXPECT_EQ(MachineRepresentation::kWord64, e0.sig->GetParam(1));
+  EXPECT_EQ(kWasmF32, e0.sig->GetParam(0));
+  EXPECT_EQ(kWasmI64, e0.sig->GetParam(1));
   const WasmException& e1 = result.val->exceptions.back();
-  EXPECT_EQ(MachineRepresentation::kWord32, e1.sig->GetParam(0));
+  EXPECT_EQ(kWasmI32, e1.sig->GetParam(0));
 }
 
 TEST_F(WasmModuleVerifyTest, Exception_invalid_type) {
@@ -794,22 +797,22 @@ TEST_F(WasmModuleVerifyTest, OneIndirectFunction) {
       // funcs ---------------------------------------------------------------
       ONE_EMPTY_FUNCTION,
       // table declaration ---------------------------------------------------
-      SECTION(Table, 4), ENTRY_COUNT(1), kWasmAnyFunctionTypeCode, 0, 1};
+      SECTION(Table, 4), ENTRY_COUNT(1), kLocalAnyFunc, 0, 1};
 
   ModuleResult result = DecodeModule(data, data + sizeof(data));
   EXPECT_OK(result);
   if (result.ok()) {
     EXPECT_EQ(1u, result.val->signatures.size());
     EXPECT_EQ(1u, result.val->functions.size());
-    EXPECT_EQ(1u, result.val->function_tables.size());
-    EXPECT_EQ(1u, result.val->function_tables[0].initial_size);
+    EXPECT_EQ(1u, result.val->tables.size());
+    EXPECT_EQ(1u, result.val->tables[0].initial_size);
   }
 }
 
 TEST_F(WasmModuleVerifyTest, ElementSectionWithInternalTable) {
   static const byte data[] = {
       // table ---------------------------------------------------------------
-      SECTION(Table, 4), ENTRY_COUNT(1), kWasmAnyFunctionTypeCode, 0, 1,
+      SECTION(Table, 4), ENTRY_COUNT(1), kLocalAnyFunc, 0, 1,
       // elements ------------------------------------------------------------
       SECTION(Element, 1),
       0  // entry count
@@ -822,14 +825,14 @@ TEST_F(WasmModuleVerifyTest, ElementSectionWithImportedTable) {
   static const byte data[] = {
       // imports -------------------------------------------------------------
       SECTION(Import, 9), ENTRY_COUNT(1),
-      NAME_LENGTH(1),            // --
-      'm',                       // module name
-      NAME_LENGTH(1),            // --
-      't',                       // table name
-      kExternalTable,            // import kind
-      kWasmAnyFunctionTypeCode,  // elem_type
-      0,                         // no maximum field
-      1,                         // initial size
+      NAME_LENGTH(1),  // --
+      'm',             // module name
+      NAME_LENGTH(1),  // --
+      't',             // table name
+      kExternalTable,  // import kind
+      kLocalAnyFunc,   // elem_type
+      0,               // no maximum field
+      1,               // initial size
       // elements ------------------------------------------------------------
       SECTION(Element, 1),
       0  // entry count
@@ -860,7 +863,7 @@ TEST_F(WasmModuleVerifyTest, Regression_735887) {
       // funcs ---------------------------------------------------------------
       ONE_EMPTY_FUNCTION,
       // table declaration ---------------------------------------------------
-      SECTION(Table, 4), ENTRY_COUNT(1), kWasmAnyFunctionTypeCode, 0, 1,
+      SECTION(Table, 4), ENTRY_COUNT(1), kLocalAnyFunc, 0, 1,
       // elements ------------------------------------------------------------
       SECTION(Element, 7),
       1,  // entry count
@@ -879,7 +882,7 @@ TEST_F(WasmModuleVerifyTest, OneIndirectFunction_one_entry) {
       // funcs ---------------------------------------------------------------
       ONE_EMPTY_FUNCTION,
       // table declaration ---------------------------------------------------
-      SECTION(Table, 4), ENTRY_COUNT(1), kWasmAnyFunctionTypeCode, 0, 1,
+      SECTION(Table, 4), ENTRY_COUNT(1), kLocalAnyFunc, 0, 1,
       // elements ------------------------------------------------------------
       SECTION(Element, 7),
       1,  // entry count
@@ -892,8 +895,8 @@ TEST_F(WasmModuleVerifyTest, OneIndirectFunction_one_entry) {
   if (result.ok()) {
     EXPECT_EQ(1u, result.val->signatures.size());
     EXPECT_EQ(1u, result.val->functions.size());
-    EXPECT_EQ(1u, result.val->function_tables.size());
-    EXPECT_EQ(1u, result.val->function_tables[0].initial_size);
+    EXPECT_EQ(1u, result.val->tables.size());
+    EXPECT_EQ(1u, result.val->tables[0].initial_size);
   }
 }
 
@@ -907,7 +910,7 @@ TEST_F(WasmModuleVerifyTest, MultipleIndirectFunctions) {
       // funcs ------------------------------------------------------
       FOUR_EMPTY_FUNCTIONS,
       // table declaration -------------------------------------------
-      SECTION(Table, 4), ENTRY_COUNT(1), kWasmAnyFunctionTypeCode, 0, 8,
+      SECTION(Table, 4), ENTRY_COUNT(1), kLocalAnyFunc, 0, 8,
       // table elements ----------------------------------------------
       SECTION(Element, 14),
       1,  // entry count
@@ -928,8 +931,8 @@ TEST_F(WasmModuleVerifyTest, MultipleIndirectFunctions) {
   if (result.ok()) {
     EXPECT_EQ(2u, result.val->signatures.size());
     EXPECT_EQ(4u, result.val->functions.size());
-    EXPECT_EQ(1u, result.val->function_tables.size());
-    EXPECT_EQ(8u, result.val->function_tables[0].initial_size);
+    EXPECT_EQ(1u, result.val->tables.size());
+    EXPECT_EQ(8u, result.val->tables[0].initial_size);
   }
 }
 
@@ -957,6 +960,45 @@ TEST_F(WasmModuleVerifyTest, IndirectFunctionInvalidIndex) {
   EXPECT_FAILURE(data);
 }
 
+TEST_F(WasmModuleVerifyTest, MultipleTablesWithoutFlag) {
+  static const byte data[] = {
+      SECTION(Table, 7),  // table section
+      ENTRY_COUNT(2),     // 2 tables
+      kLocalAnyFunc,      // table 1: type
+      0,                  // table 1: no maximum
+      10,                 // table 1: minimum size
+      kLocalAnyFunc,      // table 2: type
+      0,                  // table 2: no maximum
+      10,                 // table 2: minimum size
+  };
+  EXPECT_FAILURE(data);
+}
+
+TEST_F(WasmModuleVerifyTest, MultipleTablesWithFlag) {
+  FlagScope<bool> flag_scope(&FLAG_experimental_wasm_anyref, true);
+  static const byte data[] = {
+      SECTION(Table, 7),  // table section
+      ENTRY_COUNT(2),     // 2 tables
+      kLocalAnyFunc,      // table 1: type
+      0,                  // table 1: no maximum
+      10,                 // table 1: minimum size
+      kLocalAnyRef,       // table 2: type
+      0,                  // table 2: no maximum
+      11,                 // table 2: minimum size
+  };
+
+  ModuleResult result = DecodeModule(data, data + sizeof(data));
+  EXPECT_OK(result);
+
+  EXPECT_EQ(2u, result.val->tables.size());
+
+  EXPECT_EQ(10u, result.val->tables[0].initial_size);
+  EXPECT_EQ(kWasmAnyFunc, result.val->tables[0].type);
+
+  EXPECT_EQ(11u, result.val->tables[1].initial_size);
+  EXPECT_EQ(kWasmAnyRef, result.val->tables[1].type);
+}
+
 class WasmSignatureDecodeTest : public TestWithZone {
  public:
   WasmSignatureDecodeTest()
@@ -1086,13 +1128,15 @@ TEST_F(WasmSignatureDecodeTest, Fail_off_end) {
 TEST_F(WasmSignatureDecodeTest, Fail_anyref_without_flag) {
   // Disable AnyRef support and check that decoding fails.
   FlagScope<bool> flag_scope(&FLAG_experimental_wasm_anyref, false);
-  byte kInvalidType = kLocalAnyRef;
-  for (size_t i = 0; i < SIZEOF_SIG_ENTRY_x_xx; i++) {
-    byte data[] = {SIG_ENTRY_x_xx(kLocalI32, kLocalI32, kLocalI32)};
-    data[i] = kInvalidType;
-    FunctionSig* sig =
-        DecodeWasmSignatureForTesting(zone(), data, data + sizeof(data));
-    EXPECT_EQ(nullptr, sig);
+  byte ref_types[] = {kLocalAnyFunc, kLocalAnyRef};
+  for (byte invalid_type : ref_types) {
+    for (size_t i = 0; i < SIZEOF_SIG_ENTRY_x_xx; i++) {
+      byte data[] = {SIG_ENTRY_x_xx(kLocalI32, kLocalI32, kLocalI32)};
+      data[i] = invalid_type;
+      FunctionSig* sig =
+          DecodeWasmSignatureForTesting(zone(), data, data + sizeof(data));
+      EXPECT_EQ(nullptr, sig);
+    }
   }
 }
 
@@ -1309,7 +1353,7 @@ TEST_F(WasmModuleVerifyTest, ImportTable_mutable_global) {
         kLocalI32,           // type
         1,                   // mutability
     };
-    EXPECT_FAILURE(data);
+    EXPECT_VERIFIES(data);
   }
 }
 
diff --git a/deps/v8/test/unittests/wasm/streaming-decoder-unittest.cc b/deps/v8/test/unittests/wasm/streaming-decoder-unittest.cc
index 86556513323328..4159117c2697da 100644
--- a/deps/v8/test/unittests/wasm/streaming-decoder-unittest.cc
+++ b/deps/v8/test/unittests/wasm/streaming-decoder-unittest.cc
@@ -57,10 +57,8 @@ class MockStreamingProcessor : public StreamingProcessor {
   void OnFinishedChunk() override {}
 
   // Finish the processing of the stream.
-  void OnFinishedStream(std::unique_ptr<uint8_t[]> bytes,
-                        size_t length) override {
+  void OnFinishedStream(OwnedVector<uint8_t> bytes) override {
     received_bytes_ = std::move(bytes);
-    length_ = length;
   }
 
   // Report an error detected in the StreamingDecoder.
@@ -71,16 +69,15 @@ class MockStreamingProcessor : public StreamingProcessor {
   size_t num_sections() const { return num_sections_; }
   size_t num_functions() const { return num_functions_; }
   bool ok() const { return ok_; }
-  Vector<const uint8_t> received_bytes() {
-    return Vector<const uint8_t>(received_bytes_.get(), length_);
+  Vector<const uint8_t> received_bytes() const {
+    return received_bytes_.as_vector();
   }
 
  private:
   size_t num_sections_ = 0;
   size_t num_functions_ = 0;
   bool ok_ = true;
-  std::unique_ptr<uint8_t[]> received_bytes_;
-  size_t length_;
+  OwnedVector<uint8_t> received_bytes_;
 };
 
 class WasmStreamingDecoderTest : public ::testing::Test {
diff --git a/deps/v8/test/unittests/wasm/wasm-code-manager-unittest.cc b/deps/v8/test/unittests/wasm/wasm-code-manager-unittest.cc
index 6292d32947efb5..c05a13c431ebfe 100644
--- a/deps/v8/test/unittests/wasm/wasm-code-manager-unittest.cc
+++ b/deps/v8/test/unittests/wasm/wasm-code-manager-unittest.cc
@@ -5,6 +5,8 @@
 #include "test/unittests/test-utils.h"
 #include "testing/gmock/include/gmock/gmock.h"
 
+#include "src/wasm/function-compiler.h"
+#include "src/wasm/jump-table-assembler.h"
 #include "src/wasm/wasm-code-manager.h"
 
 namespace v8 {
@@ -14,9 +16,11 @@ namespace wasm_heap_unittest {
 
 class DisjointAllocationPoolTest : public ::testing::Test {
  public:
-  Address A(size_t n) { return reinterpret_cast<Address>(n); }
+  Address A(size_t n) { return static_cast<Address>(n); }
   void CheckLooksLike(const DisjointAllocationPool& mem,
                       std::vector<std::pair<size_t, size_t>> expectation);
+  void CheckLooksLike(AddressRange range,
+                      std::pair<size_t, size_t> expectation);
   DisjointAllocationPool Make(std::vector<std::pair<size_t, size_t>> model);
 };
 
@@ -27,157 +31,145 @@ void DisjointAllocationPoolTest::CheckLooksLike(
   CHECK_EQ(ranges.size(), expectation.size());
   auto iter = expectation.begin();
   for (auto it = ranges.begin(), e = ranges.end(); it != e; ++it, ++iter) {
-    CHECK_EQ(it->first, A(iter->first));
-    CHECK_EQ(it->second, A(iter->second));
+    CheckLooksLike(*it, *iter);
   }
 }
 
+void DisjointAllocationPoolTest::CheckLooksLike(
+    AddressRange range, std::pair<size_t, size_t> expectation) {
+  CHECK_EQ(range.start, A(expectation.first));
+  CHECK_EQ(range.end, A(expectation.second));
+}
+
 DisjointAllocationPool DisjointAllocationPoolTest::Make(
     std::vector<std::pair<size_t, size_t>> model) {
   DisjointAllocationPool ret;
   for (auto& pair : model) {
-    ret.Merge(DisjointAllocationPool(A(pair.first), A(pair.second)));
+    ret.Merge({A(pair.first), A(pair.second)});
   }
   return ret;
 }
 
-TEST_F(DisjointAllocationPoolTest, Construct) {
+TEST_F(DisjointAllocationPoolTest, ConstructEmpty) {
   DisjointAllocationPool a;
   CHECK(a.IsEmpty());
-  CHECK_EQ(a.ranges().size(), 0);
-  DisjointAllocationPool b = Make({{1, 5}});
-  CHECK(!b.IsEmpty());
-  CHECK_EQ(b.ranges().size(), 1);
-  a.Merge(std::move(b));
+  CheckLooksLike(a, {});
+  a.Merge({1, 5});
   CheckLooksLike(a, {{1, 5}});
-  DisjointAllocationPool c;
-  a.Merge(std::move(c));
+}
+
+TEST_F(DisjointAllocationPoolTest, ConstructWithRange) {
+  DisjointAllocationPool a({1, 5});
+  CHECK(!a.IsEmpty());
   CheckLooksLike(a, {{1, 5}});
-  DisjointAllocationPool e, f;
-  e.Merge(std::move(f));
-  CHECK(e.IsEmpty());
 }
 
 TEST_F(DisjointAllocationPoolTest, SimpleExtract) {
   DisjointAllocationPool a = Make({{1, 5}});
-  DisjointAllocationPool b = a.AllocatePool(2);
+  AddressRange b = a.Allocate(2);
   CheckLooksLike(a, {{3, 5}});
-  CheckLooksLike(b, {{1, 3}});
-  a.Merge(std::move(b));
+  CheckLooksLike(b, {1, 3});
+  a.Merge(b);
   CheckLooksLike(a, {{1, 5}});
   CHECK_EQ(a.ranges().size(), 1);
-  CHECK_EQ(a.ranges().front().first, A(1));
-  CHECK_EQ(a.ranges().front().second, A(5));
+  CHECK_EQ(a.ranges().front().start, A(1));
+  CHECK_EQ(a.ranges().front().end, A(5));
 }
 
 TEST_F(DisjointAllocationPoolTest, ExtractAll) {
-  DisjointAllocationPool a(A(1), A(5));
-  DisjointAllocationPool b = a.AllocatePool(4);
-  CheckLooksLike(b, {{1, 5}});
+  DisjointAllocationPool a({A(1), A(5)});
+  AddressRange b = a.Allocate(4);
+  CheckLooksLike(b, {1, 5});
   CHECK(a.IsEmpty());
-  a.Merge(std::move(b));
+  a.Merge(b);
   CheckLooksLike(a, {{1, 5}});
 }
 
-TEST_F(DisjointAllocationPoolTest, ExtractAccross) {
-  DisjointAllocationPool a = Make({{1, 5}, {10, 20}});
-  DisjointAllocationPool b = a.AllocatePool(5);
-  CheckLooksLike(a, {{11, 20}});
-  CheckLooksLike(b, {{1, 5}, {10, 11}});
-  a.Merge(std::move(b));
-  CheckLooksLike(a, {{1, 5}, {10, 20}});
-}
-
-TEST_F(DisjointAllocationPoolTest, ReassembleOutOfOrder) {
-  DisjointAllocationPool a = Make({{1, 5}, {10, 15}});
-  DisjointAllocationPool b = Make({{7, 8}, {20, 22}});
-  a.Merge(std::move(b));
-  CheckLooksLike(a, {{1, 5}, {7, 8}, {10, 15}, {20, 22}});
-
-  DisjointAllocationPool c = Make({{1, 5}, {10, 15}});
-  DisjointAllocationPool d = Make({{7, 8}, {20, 22}});
-  d.Merge(std::move(c));
-  CheckLooksLike(d, {{1, 5}, {7, 8}, {10, 15}, {20, 22}});
-}
-
 TEST_F(DisjointAllocationPoolTest, FailToExtract) {
   DisjointAllocationPool a = Make({{1, 5}});
-  DisjointAllocationPool b = a.AllocatePool(5);
+  AddressRange b = a.Allocate(5);
   CheckLooksLike(a, {{1, 5}});
-  CHECK(b.IsEmpty());
+  CHECK(b.is_empty());
 }
 
 TEST_F(DisjointAllocationPoolTest, FailToExtractExact) {
   DisjointAllocationPool a = Make({{1, 5}, {10, 14}});
-  DisjointAllocationPool b = a.Allocate(5);
+  AddressRange b = a.Allocate(5);
   CheckLooksLike(a, {{1, 5}, {10, 14}});
-  CHECK(b.IsEmpty());
+  CHECK(b.is_empty());
 }
 
 TEST_F(DisjointAllocationPoolTest, ExtractExact) {
   DisjointAllocationPool a = Make({{1, 5}, {10, 15}});
-  DisjointAllocationPool b = a.Allocate(5);
+  AddressRange b = a.Allocate(5);
   CheckLooksLike(a, {{1, 5}});
-  CheckLooksLike(b, {{10, 15}});
+  CheckLooksLike(b, {10, 15});
 }
 
 TEST_F(DisjointAllocationPoolTest, Merging) {
   DisjointAllocationPool a = Make({{10, 15}, {20, 25}});
-  a.Merge(Make({{15, 20}}));
+  a.Merge({15, 20});
   CheckLooksLike(a, {{10, 25}});
 }
 
 TEST_F(DisjointAllocationPoolTest, MergingMore) {
   DisjointAllocationPool a = Make({{10, 15}, {20, 25}, {30, 35}});
-  a.Merge(Make({{15, 20}, {25, 30}}));
+  a.Merge({15, 20});
+  a.Merge({25, 30});
   CheckLooksLike(a, {{10, 35}});
 }
 
 TEST_F(DisjointAllocationPoolTest, MergingSkip) {
   DisjointAllocationPool a = Make({{10, 15}, {20, 25}, {30, 35}});
-  a.Merge(Make({{25, 30}}));
+  a.Merge({25, 30});
   CheckLooksLike(a, {{10, 15}, {20, 35}});
 }
 
 TEST_F(DisjointAllocationPoolTest, MergingSkipLargerSrc) {
   DisjointAllocationPool a = Make({{10, 15}, {20, 25}, {30, 35}});
-  a.Merge(Make({{25, 30}, {35, 40}}));
+  a.Merge({25, 30});
+  a.Merge({35, 40});
   CheckLooksLike(a, {{10, 15}, {20, 40}});
 }
 
 TEST_F(DisjointAllocationPoolTest, MergingSkipLargerSrcWithGap) {
   DisjointAllocationPool a = Make({{10, 15}, {20, 25}, {30, 35}});
-  a.Merge(Make({{25, 30}, {36, 40}}));
+  a.Merge({25, 30});
+  a.Merge({36, 40});
   CheckLooksLike(a, {{10, 15}, {20, 35}, {36, 40}});
 }
 
 enum ModuleStyle : int { Fixed = 0, Growable = 1 };
 
+std::string PrintWasmCodeManageTestParam(
+    ::testing::TestParamInfo<ModuleStyle> info) {
+  switch (info.param) {
+    case Fixed:
+      return "Fixed";
+    case Growable:
+      return "Growable";
+  }
+  UNREACHABLE();
+}
+
 class WasmCodeManagerTest : public TestWithContext,
                             public ::testing::WithParamInterface<ModuleStyle> {
  public:
-  using NativeModulePtr = std::unique_ptr<NativeModule>;
-
-  // We pretend all our modules have 10 functions and no imports, just so
-  // we can size up the code_table.
-  NativeModulePtr AllocFixedModule(WasmCodeManager* manager, size_t size) {
-    return manager->NewNativeModule(size, 10, 0, false);
-  }
+  static constexpr uint32_t kNumFunctions = 10;
+  static constexpr uint32_t kJumpTableSize = RoundUp<kCodeAlignment>(
+      kNumFunctions * JumpTableAssembler::kJumpTableSlotSize);
 
-  NativeModulePtr AllocGrowableModule(WasmCodeManager* manager, size_t size) {
-    return manager->NewNativeModule(size, 10, 0, true);
-  }
+  using NativeModulePtr = std::unique_ptr<NativeModule>;
 
   NativeModulePtr AllocModule(WasmCodeManager* manager, size_t size,
                               ModuleStyle style) {
-    switch (style) {
-      case Fixed:
-        return AllocFixedModule(manager, size);
-      case Growable:
-        return AllocGrowableModule(manager, size);
-      default:
-        UNREACHABLE();
-    }
+    std::shared_ptr<WasmModule> module(new WasmModule);
+    module->num_declared_functions = kNumFunctions;
+    bool can_request_more = style == Growable;
+    wasm::ModuleEnv env(module.get(), UseTrapHandler::kNoTrapHandler,
+                        RuntimeExceptionSupport::kNoRuntimeExceptionSupport);
+    return manager->NewNativeModule(i_isolate(), size, can_request_more,
+                                    std::move(module), env);
   }
 
   WasmCode* AddCode(NativeModule* native_module, uint32_t index, size_t size) {
@@ -186,48 +178,44 @@ class WasmCodeManagerTest : public TestWithContext,
     std::unique_ptr<byte[]> exec_buff(new byte[size]);
     desc.buffer = exec_buff.get();
     desc.instr_size = static_cast<int>(size);
-    Handle<ByteArray> source_pos = i_isolate()->factory()->empty_byte_array();
-    return native_module->AddCode(desc, 0, index, 0, 0, {}, source_pos,
+    return native_module->AddCode(index, desc, 0, 0, 0, {}, OwnedVector<byte>(),
                                   WasmCode::kOther);
   }
 
   size_t page() const { return AllocatePageSize(); }
-  v8::Isolate* v8_isolate() const {
-    return reinterpret_cast<v8::Isolate*>(isolate());
-  }
 };
 
 INSTANTIATE_TEST_CASE_P(Parameterized, WasmCodeManagerTest,
-                        ::testing::Values(Fixed, Growable));
+                        ::testing::Values(Fixed, Growable),
+                        PrintWasmCodeManageTestParam);
 
 TEST_P(WasmCodeManagerTest, EmptyCase) {
-  WasmCodeManager manager(v8_isolate(), 0 * page());
-  CHECK_EQ(0, manager.remaining_uncommitted());
+  WasmCodeManager manager(0 * page());
+  CHECK_EQ(0, manager.remaining_uncommitted_code_space());
 
-  NativeModulePtr native_module = AllocModule(&manager, 1 * page(), GetParam());
-  CHECK(native_module);
-  ASSERT_DEATH_IF_SUPPORTED(AddCode(native_module.get(), 0, 10),
+  ASSERT_DEATH_IF_SUPPORTED(AllocModule(&manager, 1 * page(), GetParam()),
                             "OOM in NativeModule::AddOwnedCode");
 }
 
 TEST_P(WasmCodeManagerTest, AllocateAndGoOverLimit) {
-  WasmCodeManager manager(v8_isolate(), 1 * page());
-  CHECK_EQ(1 * page(), manager.remaining_uncommitted());
+  WasmCodeManager manager(1 * page());
+  CHECK_EQ(1 * page(), manager.remaining_uncommitted_code_space());
   NativeModulePtr native_module = AllocModule(&manager, 1 * page(), GetParam());
   CHECK(native_module);
-  CHECK_EQ(1 * page(), manager.remaining_uncommitted());
+  CHECK_EQ(0, manager.remaining_uncommitted_code_space());
   uint32_t index = 0;
   WasmCode* code = AddCode(native_module.get(), index++, 1 * kCodeAlignment);
   CHECK_NOT_NULL(code);
-  CHECK_EQ(0, manager.remaining_uncommitted());
+  CHECK_EQ(0, manager.remaining_uncommitted_code_space());
 
   code = AddCode(native_module.get(), index++, 3 * kCodeAlignment);
   CHECK_NOT_NULL(code);
-  CHECK_EQ(0, manager.remaining_uncommitted());
+  CHECK_EQ(0, manager.remaining_uncommitted_code_space());
 
-  code = AddCode(native_module.get(), index++, page() - 4 * kCodeAlignment);
+  code = AddCode(native_module.get(), index++,
+                 page() - 4 * kCodeAlignment - kJumpTableSize);
   CHECK_NOT_NULL(code);
-  CHECK_EQ(0, manager.remaining_uncommitted());
+  CHECK_EQ(0, manager.remaining_uncommitted_code_space());
 
   ASSERT_DEATH_IF_SUPPORTED(
       AddCode(native_module.get(), index++, 1 * kCodeAlignment),
@@ -235,59 +223,66 @@ TEST_P(WasmCodeManagerTest, AllocateAndGoOverLimit) {
 }
 
 TEST_P(WasmCodeManagerTest, TotalLimitIrrespectiveOfModuleCount) {
-  WasmCodeManager manager(v8_isolate(), 1 * page());
-  NativeModulePtr nm1 = AllocModule(&manager, 1 * page(), GetParam());
-  NativeModulePtr nm2 = AllocModule(&manager, 1 * page(), GetParam());
+  WasmCodeManager manager(3 * page());
+  NativeModulePtr nm1 = AllocModule(&manager, 2 * page(), GetParam());
+  NativeModulePtr nm2 = AllocModule(&manager, 2 * page(), GetParam());
   CHECK(nm1);
   CHECK(nm2);
-  WasmCode* code = AddCode(nm1.get(), 0, 1 * page());
+  WasmCode* code = AddCode(nm1.get(), 0, 2 * page() - kJumpTableSize);
   CHECK_NOT_NULL(code);
-  ASSERT_DEATH_IF_SUPPORTED(AddCode(nm2.get(), 0, 1 * page()),
+  ASSERT_DEATH_IF_SUPPORTED(AddCode(nm2.get(), 0, 2 * page() - kJumpTableSize),
                             "OOM in NativeModule::AddOwnedCode");
 }
 
 TEST_P(WasmCodeManagerTest, DifferentHeapsApplyLimitsIndependently) {
-  WasmCodeManager manager1(v8_isolate(), 1 * page());
-  WasmCodeManager manager2(v8_isolate(), 2 * page());
+  WasmCodeManager manager1(1 * page());
+  WasmCodeManager manager2(2 * page());
   NativeModulePtr nm1 = AllocModule(&manager1, 1 * page(), GetParam());
   NativeModulePtr nm2 = AllocModule(&manager2, 1 * page(), GetParam());
   CHECK(nm1);
   CHECK(nm2);
-  WasmCode* code = AddCode(nm1.get(), 0, 1 * page());
+  WasmCode* code = AddCode(nm1.get(), 0, 1 * page() - kJumpTableSize);
   CHECK_NOT_NULL(code);
-  CHECK_EQ(0, manager1.remaining_uncommitted());
-  code = AddCode(nm2.get(), 0, 1 * page());
+  CHECK_EQ(0, manager1.remaining_uncommitted_code_space());
+  code = AddCode(nm2.get(), 0, 1 * page() - kJumpTableSize);
   CHECK_NOT_NULL(code);
 }
 
 TEST_P(WasmCodeManagerTest, GrowingVsFixedModule) {
-  WasmCodeManager manager(v8_isolate(), 3 * page());
+  WasmCodeManager manager(3 * page());
   NativeModulePtr nm = AllocModule(&manager, 1 * page(), GetParam());
+  size_t module_size = GetParam() == Fixed ? kMaxWasmCodeMemory : 1 * page();
+  size_t remaining_space_in_module = module_size - kJumpTableSize;
   if (GetParam() == Fixed) {
-    ASSERT_DEATH_IF_SUPPORTED(AddCode(nm.get(), 0, 1 * page() + kCodeAlignment),
-                              "OOM in NativeModule::AddOwnedCode");
+    // Requesting more than the remaining space fails because the module cannot
+    // grow.
+    ASSERT_DEATH_IF_SUPPORTED(
+        AddCode(nm.get(), 0, remaining_space_in_module + kCodeAlignment),
+        "OOM in NativeModule::AddOwnedCode");
   } else {
-    CHECK_NOT_NULL(AddCode(nm.get(), 0, 1 * page() + kCodeAlignment));
-    CHECK_EQ(manager.remaining_uncommitted(), 1 * page());
+    // The module grows by one page. One page remains uncommitted.
+    CHECK_NOT_NULL(
+        AddCode(nm.get(), 0, remaining_space_in_module + kCodeAlignment));
+    CHECK_EQ(manager.remaining_uncommitted_code_space(), 1 * page());
   }
 }
 
 TEST_P(WasmCodeManagerTest, CommitIncrements) {
-  WasmCodeManager manager(v8_isolate(), 10 * page());
+  WasmCodeManager manager(10 * page());
   NativeModulePtr nm = AllocModule(&manager, 3 * page(), GetParam());
   WasmCode* code = AddCode(nm.get(), 0, kCodeAlignment);
   CHECK_NOT_NULL(code);
-  CHECK_EQ(manager.remaining_uncommitted(), 9 * page());
+  CHECK_EQ(manager.remaining_uncommitted_code_space(), 9 * page());
   code = AddCode(nm.get(), 1, 2 * page());
   CHECK_NOT_NULL(code);
-  CHECK_EQ(manager.remaining_uncommitted(), 7 * page());
-  code = AddCode(nm.get(), 2, page() - kCodeAlignment);
+  CHECK_EQ(manager.remaining_uncommitted_code_space(), 7 * page());
+  code = AddCode(nm.get(), 2, page() - kCodeAlignment - kJumpTableSize);
   CHECK_NOT_NULL(code);
-  CHECK_EQ(manager.remaining_uncommitted(), 7 * page());
+  CHECK_EQ(manager.remaining_uncommitted_code_space(), 7 * page());
 }
 
 TEST_P(WasmCodeManagerTest, Lookup) {
-  WasmCodeManager manager(v8_isolate(), 2 * page());
+  WasmCodeManager manager(2 * page());
 
   NativeModulePtr nm1 = AllocModule(&manager, 1 * page(), GetParam());
   NativeModulePtr nm2 = AllocModule(&manager, 1 * page(), GetParam());
@@ -307,27 +302,27 @@ TEST_P(WasmCodeManagerTest, Lookup) {
   // find any WasmCode* associated with that ptr.
   WasmCode* not_found = manager.LookupCode(reinterpret_cast<Address>(&manager));
   CHECK_NULL(not_found);
-  WasmCode* found = manager.LookupCode(code1_0->instructions().start());
+  WasmCode* found = manager.LookupCode(code1_0->instruction_start());
   CHECK_EQ(found, code1_0);
-  found = manager.LookupCode(code2_1->instructions().start() +
+  found = manager.LookupCode(code2_1->instruction_start() +
                              (code2_1->instructions().size() / 2));
   CHECK_EQ(found, code2_1);
-  found = manager.LookupCode(code2_1->instructions().start() +
+  found = manager.LookupCode(code2_1->instruction_start() +
                              code2_1->instructions().size() - 1);
   CHECK_EQ(found, code2_1);
-  found = manager.LookupCode(code2_1->instructions().start() +
+  found = manager.LookupCode(code2_1->instruction_start() +
                              code2_1->instructions().size());
   CHECK_NULL(found);
   Address mid_code1_1 =
-      code1_1->instructions().start() + (code1_1->instructions().size() / 2);
+      code1_1->instruction_start() + (code1_1->instructions().size() / 2);
   CHECK_EQ(code1_1, manager.LookupCode(mid_code1_1));
   nm1.reset();
   CHECK_NULL(manager.LookupCode(mid_code1_1));
 }
 
 TEST_P(WasmCodeManagerTest, MultiManagerLookup) {
-  WasmCodeManager manager1(v8_isolate(), 2 * page());
-  WasmCodeManager manager2(v8_isolate(), 2 * page());
+  WasmCodeManager manager1(2 * page());
+  WasmCodeManager manager2(2 * page());
 
   NativeModulePtr nm1 = AllocModule(&manager1, 1 * page(), GetParam());
   NativeModulePtr nm2 = AllocModule(&manager2, 1 * page(), GetParam());
@@ -344,12 +339,12 @@ TEST_P(WasmCodeManagerTest, MultiManagerLookup) {
   CHECK_EQ(0, code2_0->index());
   CHECK_EQ(1, code2_1->index());
 
-  CHECK_EQ(code1_0, manager1.LookupCode(code1_0->instructions().start()));
-  CHECK_NULL(manager2.LookupCode(code1_0->instructions().start()));
+  CHECK_EQ(code1_0, manager1.LookupCode(code1_0->instruction_start()));
+  CHECK_NULL(manager2.LookupCode(code1_0->instruction_start()));
 }
 
 TEST_P(WasmCodeManagerTest, LookupWorksAfterRewrite) {
-  WasmCodeManager manager(v8_isolate(), 2 * page());
+  WasmCodeManager manager(2 * page());
 
   NativeModulePtr nm1 = AllocModule(&manager, 1 * page(), GetParam());
 
@@ -357,11 +352,11 @@ TEST_P(WasmCodeManagerTest, LookupWorksAfterRewrite) {
   WasmCode* code1 = AddCode(nm1.get(), 1, kCodeAlignment);
   CHECK_EQ(0, code0->index());
   CHECK_EQ(1, code1->index());
-  CHECK_EQ(code1, manager.LookupCode(code1->instructions().start()));
+  CHECK_EQ(code1, manager.LookupCode(code1->instruction_start()));
   WasmCode* code1_1 = AddCode(nm1.get(), 1, kCodeAlignment);
   CHECK_EQ(1, code1_1->index());
-  CHECK_EQ(code1, manager.LookupCode(code1->instructions().start()));
-  CHECK_EQ(code1_1, manager.LookupCode(code1_1->instructions().start()));
+  CHECK_EQ(code1, manager.LookupCode(code1->instruction_start()));
+  CHECK_EQ(code1_1, manager.LookupCode(code1_1->instruction_start()));
 }
 
 }  // namespace wasm_heap_unittest
diff --git a/deps/v8/test/wasm-spec-tests/tests.tar.gz.sha1 b/deps/v8/test/wasm-spec-tests/tests.tar.gz.sha1
index 43d7bf01ee479e..4bc2a4dba90184 100644
--- a/deps/v8/test/wasm-spec-tests/tests.tar.gz.sha1
+++ b/deps/v8/test/wasm-spec-tests/tests.tar.gz.sha1
@@ -1 +1 @@
-7f228226bee9e163f4dcc18ab3219240eeb004cb
\ No newline at end of file
+9c9ffb1170cc729f41c661299aa2dbfbac6a118a
\ No newline at end of file
diff --git a/deps/v8/test/webkit/webkit.status b/deps/v8/test/webkit/webkit.status
index 7cd69d53e0ae58..5f2489546f8c12 100644
--- a/deps/v8/test/webkit/webkit.status
+++ b/deps/v8/test/webkit/webkit.status
@@ -35,6 +35,9 @@
   'dfg-inline-arguments-reset-changetype': [PASS, FAIL],
   # Irregexp interpreter overflows stack. We should just not crash.
   'fast/js/regexp-stack-overflow': [PASS, FAIL],
+
+  # Slow tests.
+  'dfg-double-vote-fuzz': [PASS, SLOW],
 }],  # ALWAYS
 ['system == windows', {
   # Exceeds call stack on windows after MSVS2017 switch.
@@ -112,6 +115,12 @@
   'fast/js/excessive-comma-usage': [SKIP],
 }],  # arch == arm64 and msan
 
+##############################################################################
+['(variant == nooptimization or variant == stress) and (arch == arm or arch == arm64) and simulator_run', {
+  # Slow tests: https://crbug.com/v8/7783
+  'dfg-double-vote-fuzz': [SKIP],
+}],  # (variant == nooptimization or variant == stress) and (arch == arm or arch == arm64) and simulator_run
+
 ##############################################################################
 ['gcov_coverage', {
   # Tests taking too long or getting too large call stacks.
@@ -120,14 +129,14 @@
 }],  # 'gcov_coverage'
 
 ##############################################################################
-['variant == wasm_traps', {
+['variant == no_wasm_traps', {
   '*': [SKIP],
-}],  # variant == wasm_traps
+}],  # variant == no_wasm_traps
 
 ##############################################################################
 ['no_i18n == True', {
   'fast/js/string-capitalization': [FAIL],
-}],  # variant == wasm_traps
+}],  # variant == no_wasm_traps
 
 ##############################################################################
 ]
diff --git a/deps/v8/third_party/antlr4/BUILD.gn b/deps/v8/third_party/antlr4/BUILD.gn
new file mode 100644
index 00000000000000..bd58a1804d1558
--- /dev/null
+++ b/deps/v8/third_party/antlr4/BUILD.gn
@@ -0,0 +1,339 @@
+# Copyright 2018 The Chromium Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+config("antlr-compatibility") {
+  if (!is_clang && !is_win) {
+    cflags = [
+      # Avoid warnings in generated Antlr code
+      "-Wno-unused-but-set-variable",
+    ]
+  }
+}
+
+source_set("antlr4") {
+  defines = [ "ANTLR4CPP_STATIC" ]
+
+  include_dirs = [ "runtime/Cpp/runtime/src" ]
+
+  sources = [
+    "runtime/Cpp/runtime/src/ANTLRErrorListener.cpp",
+    "runtime/Cpp/runtime/src/ANTLRErrorListener.h",
+    "runtime/Cpp/runtime/src/ANTLRErrorStrategy.cpp",
+    "runtime/Cpp/runtime/src/ANTLRErrorStrategy.h",
+    "runtime/Cpp/runtime/src/ANTLRFileStream.cpp",
+    "runtime/Cpp/runtime/src/ANTLRFileStream.h",
+    "runtime/Cpp/runtime/src/ANTLRInputStream.cpp",
+    "runtime/Cpp/runtime/src/ANTLRInputStream.h",
+    "runtime/Cpp/runtime/src/BailErrorStrategy.cpp",
+    "runtime/Cpp/runtime/src/BailErrorStrategy.h",
+    "runtime/Cpp/runtime/src/BaseErrorListener.cpp",
+    "runtime/Cpp/runtime/src/BaseErrorListener.h",
+    "runtime/Cpp/runtime/src/BufferedTokenStream.cpp",
+    "runtime/Cpp/runtime/src/BufferedTokenStream.h",
+    "runtime/Cpp/runtime/src/CharStream.cpp",
+    "runtime/Cpp/runtime/src/CharStream.h",
+    "runtime/Cpp/runtime/src/CommonToken.cpp",
+    "runtime/Cpp/runtime/src/CommonToken.h",
+    "runtime/Cpp/runtime/src/CommonTokenFactory.cpp",
+    "runtime/Cpp/runtime/src/CommonTokenFactory.h",
+    "runtime/Cpp/runtime/src/CommonTokenStream.cpp",
+    "runtime/Cpp/runtime/src/CommonTokenStream.h",
+    "runtime/Cpp/runtime/src/ConsoleErrorListener.cpp",
+    "runtime/Cpp/runtime/src/ConsoleErrorListener.h",
+    "runtime/Cpp/runtime/src/DefaultErrorStrategy.cpp",
+    "runtime/Cpp/runtime/src/DefaultErrorStrategy.h",
+    "runtime/Cpp/runtime/src/DiagnosticErrorListener.cpp",
+    "runtime/Cpp/runtime/src/DiagnosticErrorListener.h",
+    "runtime/Cpp/runtime/src/Exceptions.cpp",
+    "runtime/Cpp/runtime/src/Exceptions.h",
+    "runtime/Cpp/runtime/src/FailedPredicateException.cpp",
+    "runtime/Cpp/runtime/src/FailedPredicateException.h",
+    "runtime/Cpp/runtime/src/InputMismatchException.cpp",
+    "runtime/Cpp/runtime/src/InputMismatchException.h",
+    "runtime/Cpp/runtime/src/IntStream.cpp",
+    "runtime/Cpp/runtime/src/IntStream.h",
+    "runtime/Cpp/runtime/src/InterpreterRuleContext.cpp",
+    "runtime/Cpp/runtime/src/InterpreterRuleContext.h",
+    "runtime/Cpp/runtime/src/Lexer.cpp",
+    "runtime/Cpp/runtime/src/Lexer.h",
+    "runtime/Cpp/runtime/src/LexerInterpreter.cpp",
+    "runtime/Cpp/runtime/src/LexerInterpreter.h",
+    "runtime/Cpp/runtime/src/LexerNoViableAltException.cpp",
+    "runtime/Cpp/runtime/src/LexerNoViableAltException.h",
+    "runtime/Cpp/runtime/src/ListTokenSource.cpp",
+    "runtime/Cpp/runtime/src/ListTokenSource.h",
+    "runtime/Cpp/runtime/src/NoViableAltException.cpp",
+    "runtime/Cpp/runtime/src/NoViableAltException.h",
+    "runtime/Cpp/runtime/src/Parser.cpp",
+    "runtime/Cpp/runtime/src/Parser.h",
+    "runtime/Cpp/runtime/src/ParserInterpreter.cpp",
+    "runtime/Cpp/runtime/src/ParserInterpreter.h",
+    "runtime/Cpp/runtime/src/ParserRuleContext.cpp",
+    "runtime/Cpp/runtime/src/ParserRuleContext.h",
+    "runtime/Cpp/runtime/src/ProxyErrorListener.cpp",
+    "runtime/Cpp/runtime/src/ProxyErrorListener.h",
+    "runtime/Cpp/runtime/src/RecognitionException.cpp",
+    "runtime/Cpp/runtime/src/RecognitionException.h",
+    "runtime/Cpp/runtime/src/Recognizer.cpp",
+    "runtime/Cpp/runtime/src/Recognizer.h",
+    "runtime/Cpp/runtime/src/RuleContext.cpp",
+    "runtime/Cpp/runtime/src/RuleContext.h",
+    "runtime/Cpp/runtime/src/RuleContextWithAltNum.cpp",
+    "runtime/Cpp/runtime/src/RuleContextWithAltNum.h",
+    "runtime/Cpp/runtime/src/RuntimeMetaData.cpp",
+    "runtime/Cpp/runtime/src/RuntimeMetaData.h",
+    "runtime/Cpp/runtime/src/Token.cpp",
+    "runtime/Cpp/runtime/src/Token.h",
+    "runtime/Cpp/runtime/src/TokenFactory.h",
+    "runtime/Cpp/runtime/src/TokenSource.cpp",
+    "runtime/Cpp/runtime/src/TokenSource.h",
+    "runtime/Cpp/runtime/src/TokenStream.cpp",
+    "runtime/Cpp/runtime/src/TokenStream.h",
+    "runtime/Cpp/runtime/src/TokenStreamRewriter.cpp",
+    "runtime/Cpp/runtime/src/TokenStreamRewriter.h",
+    "runtime/Cpp/runtime/src/UnbufferedCharStream.cpp",
+    "runtime/Cpp/runtime/src/UnbufferedCharStream.h",
+    "runtime/Cpp/runtime/src/UnbufferedTokenStream.cpp",
+    "runtime/Cpp/runtime/src/UnbufferedTokenStream.h",
+    "runtime/Cpp/runtime/src/Vocabulary.cpp",
+    "runtime/Cpp/runtime/src/Vocabulary.h",
+    "runtime/Cpp/runtime/src/WritableToken.cpp",
+    "runtime/Cpp/runtime/src/WritableToken.h",
+    "runtime/Cpp/runtime/src/antlr4-common.h",
+    "runtime/Cpp/runtime/src/antlr4-runtime.h",
+    "runtime/Cpp/runtime/src/atn/ATN.cpp",
+    "runtime/Cpp/runtime/src/atn/ATN.h",
+    "runtime/Cpp/runtime/src/atn/ATNConfig.cpp",
+    "runtime/Cpp/runtime/src/atn/ATNConfig.h",
+    "runtime/Cpp/runtime/src/atn/ATNConfigSet.cpp",
+    "runtime/Cpp/runtime/src/atn/ATNConfigSet.h",
+    "runtime/Cpp/runtime/src/atn/ATNDeserializationOptions.cpp",
+    "runtime/Cpp/runtime/src/atn/ATNDeserializationOptions.h",
+    "runtime/Cpp/runtime/src/atn/ATNDeserializer.cpp",
+    "runtime/Cpp/runtime/src/atn/ATNDeserializer.h",
+    "runtime/Cpp/runtime/src/atn/ATNSerializer.cpp",
+    "runtime/Cpp/runtime/src/atn/ATNSerializer.h",
+    "runtime/Cpp/runtime/src/atn/ATNSimulator.cpp",
+    "runtime/Cpp/runtime/src/atn/ATNSimulator.h",
+    "runtime/Cpp/runtime/src/atn/ATNState.cpp",
+    "runtime/Cpp/runtime/src/atn/ATNState.h",
+    "runtime/Cpp/runtime/src/atn/ATNType.h",
+    "runtime/Cpp/runtime/src/atn/AbstractPredicateTransition.cpp",
+    "runtime/Cpp/runtime/src/atn/AbstractPredicateTransition.h",
+    "runtime/Cpp/runtime/src/atn/ActionTransition.cpp",
+    "runtime/Cpp/runtime/src/atn/ActionTransition.h",
+    "runtime/Cpp/runtime/src/atn/AmbiguityInfo.cpp",
+    "runtime/Cpp/runtime/src/atn/AmbiguityInfo.h",
+    "runtime/Cpp/runtime/src/atn/ArrayPredictionContext.cpp",
+    "runtime/Cpp/runtime/src/atn/ArrayPredictionContext.h",
+    "runtime/Cpp/runtime/src/atn/AtomTransition.cpp",
+    "runtime/Cpp/runtime/src/atn/AtomTransition.h",
+    "runtime/Cpp/runtime/src/atn/BasicBlockStartState.cpp",
+    "runtime/Cpp/runtime/src/atn/BasicBlockStartState.h",
+    "runtime/Cpp/runtime/src/atn/BasicState.cpp",
+    "runtime/Cpp/runtime/src/atn/BasicState.h",
+    "runtime/Cpp/runtime/src/atn/BlockEndState.cpp",
+    "runtime/Cpp/runtime/src/atn/BlockEndState.h",
+    "runtime/Cpp/runtime/src/atn/BlockStartState.cpp",
+    "runtime/Cpp/runtime/src/atn/BlockStartState.h",
+    "runtime/Cpp/runtime/src/atn/ContextSensitivityInfo.cpp",
+    "runtime/Cpp/runtime/src/atn/ContextSensitivityInfo.h",
+    "runtime/Cpp/runtime/src/atn/DecisionEventInfo.cpp",
+    "runtime/Cpp/runtime/src/atn/DecisionEventInfo.h",
+    "runtime/Cpp/runtime/src/atn/DecisionInfo.cpp",
+    "runtime/Cpp/runtime/src/atn/DecisionInfo.h",
+    "runtime/Cpp/runtime/src/atn/DecisionState.cpp",
+    "runtime/Cpp/runtime/src/atn/DecisionState.h",
+    "runtime/Cpp/runtime/src/atn/EmptyPredictionContext.cpp",
+    "runtime/Cpp/runtime/src/atn/EmptyPredictionContext.h",
+    "runtime/Cpp/runtime/src/atn/EpsilonTransition.cpp",
+    "runtime/Cpp/runtime/src/atn/EpsilonTransition.h",
+    "runtime/Cpp/runtime/src/atn/ErrorInfo.cpp",
+    "runtime/Cpp/runtime/src/atn/ErrorInfo.h",
+    "runtime/Cpp/runtime/src/atn/LL1Analyzer.cpp",
+    "runtime/Cpp/runtime/src/atn/LL1Analyzer.h",
+    "runtime/Cpp/runtime/src/atn/LexerATNConfig.cpp",
+    "runtime/Cpp/runtime/src/atn/LexerATNConfig.h",
+    "runtime/Cpp/runtime/src/atn/LexerATNSimulator.cpp",
+    "runtime/Cpp/runtime/src/atn/LexerATNSimulator.h",
+    "runtime/Cpp/runtime/src/atn/LexerAction.cpp",
+    "runtime/Cpp/runtime/src/atn/LexerAction.h",
+    "runtime/Cpp/runtime/src/atn/LexerActionExecutor.cpp",
+    "runtime/Cpp/runtime/src/atn/LexerActionExecutor.h",
+    "runtime/Cpp/runtime/src/atn/LexerActionType.h",
+    "runtime/Cpp/runtime/src/atn/LexerChannelAction.cpp",
+    "runtime/Cpp/runtime/src/atn/LexerChannelAction.h",
+    "runtime/Cpp/runtime/src/atn/LexerCustomAction.cpp",
+    "runtime/Cpp/runtime/src/atn/LexerCustomAction.h",
+    "runtime/Cpp/runtime/src/atn/LexerIndexedCustomAction.cpp",
+    "runtime/Cpp/runtime/src/atn/LexerIndexedCustomAction.h",
+    "runtime/Cpp/runtime/src/atn/LexerModeAction.cpp",
+    "runtime/Cpp/runtime/src/atn/LexerModeAction.h",
+    "runtime/Cpp/runtime/src/atn/LexerMoreAction.cpp",
+    "runtime/Cpp/runtime/src/atn/LexerMoreAction.h",
+    "runtime/Cpp/runtime/src/atn/LexerPopModeAction.cpp",
+    "runtime/Cpp/runtime/src/atn/LexerPopModeAction.h",
+    "runtime/Cpp/runtime/src/atn/LexerPushModeAction.cpp",
+    "runtime/Cpp/runtime/src/atn/LexerPushModeAction.h",
+    "runtime/Cpp/runtime/src/atn/LexerSkipAction.cpp",
+    "runtime/Cpp/runtime/src/atn/LexerSkipAction.h",
+    "runtime/Cpp/runtime/src/atn/LexerTypeAction.cpp",
+    "runtime/Cpp/runtime/src/atn/LexerTypeAction.h",
+    "runtime/Cpp/runtime/src/atn/LookaheadEventInfo.cpp",
+    "runtime/Cpp/runtime/src/atn/LookaheadEventInfo.h",
+    "runtime/Cpp/runtime/src/atn/LoopEndState.cpp",
+    "runtime/Cpp/runtime/src/atn/LoopEndState.h",
+    "runtime/Cpp/runtime/src/atn/NotSetTransition.cpp",
+    "runtime/Cpp/runtime/src/atn/NotSetTransition.h",
+    "runtime/Cpp/runtime/src/atn/OrderedATNConfigSet.cpp",
+    "runtime/Cpp/runtime/src/atn/OrderedATNConfigSet.h",
+    "runtime/Cpp/runtime/src/atn/ParseInfo.cpp",
+    "runtime/Cpp/runtime/src/atn/ParseInfo.h",
+    "runtime/Cpp/runtime/src/atn/ParserATNSimulator.cpp",
+    "runtime/Cpp/runtime/src/atn/ParserATNSimulator.h",
+    "runtime/Cpp/runtime/src/atn/PlusBlockStartState.cpp",
+    "runtime/Cpp/runtime/src/atn/PlusBlockStartState.h",
+    "runtime/Cpp/runtime/src/atn/PlusLoopbackState.cpp",
+    "runtime/Cpp/runtime/src/atn/PlusLoopbackState.h",
+    "runtime/Cpp/runtime/src/atn/PrecedencePredicateTransition.cpp",
+    "runtime/Cpp/runtime/src/atn/PrecedencePredicateTransition.h",
+    "runtime/Cpp/runtime/src/atn/PredicateEvalInfo.cpp",
+    "runtime/Cpp/runtime/src/atn/PredicateEvalInfo.h",
+    "runtime/Cpp/runtime/src/atn/PredicateTransition.cpp",
+    "runtime/Cpp/runtime/src/atn/PredicateTransition.h",
+    "runtime/Cpp/runtime/src/atn/PredictionContext.cpp",
+    "runtime/Cpp/runtime/src/atn/PredictionContext.h",
+    "runtime/Cpp/runtime/src/atn/PredictionMode.cpp",
+    "runtime/Cpp/runtime/src/atn/PredictionMode.h",
+    "runtime/Cpp/runtime/src/atn/ProfilingATNSimulator.cpp",
+    "runtime/Cpp/runtime/src/atn/ProfilingATNSimulator.h",
+    "runtime/Cpp/runtime/src/atn/RangeTransition.cpp",
+    "runtime/Cpp/runtime/src/atn/RangeTransition.h",
+    "runtime/Cpp/runtime/src/atn/RuleStartState.cpp",
+    "runtime/Cpp/runtime/src/atn/RuleStartState.h",
+    "runtime/Cpp/runtime/src/atn/RuleStopState.cpp",
+    "runtime/Cpp/runtime/src/atn/RuleStopState.h",
+    "runtime/Cpp/runtime/src/atn/RuleTransition.cpp",
+    "runtime/Cpp/runtime/src/atn/RuleTransition.h",
+    "runtime/Cpp/runtime/src/atn/SemanticContext.cpp",
+    "runtime/Cpp/runtime/src/atn/SemanticContext.h",
+    "runtime/Cpp/runtime/src/atn/SetTransition.cpp",
+    "runtime/Cpp/runtime/src/atn/SetTransition.h",
+    "runtime/Cpp/runtime/src/atn/SingletonPredictionContext.cpp",
+    "runtime/Cpp/runtime/src/atn/SingletonPredictionContext.h",
+    "runtime/Cpp/runtime/src/atn/StarBlockStartState.cpp",
+    "runtime/Cpp/runtime/src/atn/StarBlockStartState.h",
+    "runtime/Cpp/runtime/src/atn/StarLoopEntryState.cpp",
+    "runtime/Cpp/runtime/src/atn/StarLoopEntryState.h",
+    "runtime/Cpp/runtime/src/atn/StarLoopbackState.cpp",
+    "runtime/Cpp/runtime/src/atn/StarLoopbackState.h",
+    "runtime/Cpp/runtime/src/atn/TokensStartState.cpp",
+    "runtime/Cpp/runtime/src/atn/TokensStartState.h",
+    "runtime/Cpp/runtime/src/atn/Transition.cpp",
+    "runtime/Cpp/runtime/src/atn/Transition.h",
+    "runtime/Cpp/runtime/src/atn/WildcardTransition.cpp",
+    "runtime/Cpp/runtime/src/atn/WildcardTransition.h",
+    "runtime/Cpp/runtime/src/dfa/DFA.cpp",
+    "runtime/Cpp/runtime/src/dfa/DFA.h",
+    "runtime/Cpp/runtime/src/dfa/DFASerializer.cpp",
+    "runtime/Cpp/runtime/src/dfa/DFASerializer.h",
+    "runtime/Cpp/runtime/src/dfa/DFAState.cpp",
+    "runtime/Cpp/runtime/src/dfa/DFAState.h",
+    "runtime/Cpp/runtime/src/dfa/LexerDFASerializer.cpp",
+    "runtime/Cpp/runtime/src/dfa/LexerDFASerializer.h",
+    "runtime/Cpp/runtime/src/misc/InterpreterDataReader.cpp",
+    "runtime/Cpp/runtime/src/misc/InterpreterDataReader.h",
+    "runtime/Cpp/runtime/src/misc/Interval.cpp",
+    "runtime/Cpp/runtime/src/misc/Interval.h",
+    "runtime/Cpp/runtime/src/misc/IntervalSet.cpp",
+    "runtime/Cpp/runtime/src/misc/IntervalSet.h",
+    "runtime/Cpp/runtime/src/misc/MurmurHash.cpp",
+    "runtime/Cpp/runtime/src/misc/MurmurHash.h",
+    "runtime/Cpp/runtime/src/misc/Predicate.cpp",
+    "runtime/Cpp/runtime/src/misc/Predicate.h",
+    "runtime/Cpp/runtime/src/support/Any.cpp",
+    "runtime/Cpp/runtime/src/support/Any.h",
+    "runtime/Cpp/runtime/src/support/Arrays.cpp",
+    "runtime/Cpp/runtime/src/support/Arrays.h",
+    "runtime/Cpp/runtime/src/support/BitSet.h",
+    "runtime/Cpp/runtime/src/support/CPPUtils.cpp",
+    "runtime/Cpp/runtime/src/support/CPPUtils.h",
+    "runtime/Cpp/runtime/src/support/Declarations.h",
+    "runtime/Cpp/runtime/src/support/StringUtils.cpp",
+    "runtime/Cpp/runtime/src/support/StringUtils.h",
+    "runtime/Cpp/runtime/src/support/guid.cpp",
+    "runtime/Cpp/runtime/src/support/guid.h",
+    "runtime/Cpp/runtime/src/tree/AbstractParseTreeVisitor.h",
+    "runtime/Cpp/runtime/src/tree/ErrorNode.cpp",
+    "runtime/Cpp/runtime/src/tree/ErrorNode.h",
+    "runtime/Cpp/runtime/src/tree/ErrorNodeImpl.cpp",
+    "runtime/Cpp/runtime/src/tree/ErrorNodeImpl.h",
+    "runtime/Cpp/runtime/src/tree/IterativeParseTreeWalker.cpp",
+    "runtime/Cpp/runtime/src/tree/IterativeParseTreeWalker.h",
+    "runtime/Cpp/runtime/src/tree/ParseTree.cpp",
+    "runtime/Cpp/runtime/src/tree/ParseTree.h",
+    "runtime/Cpp/runtime/src/tree/ParseTreeListener.cpp",
+    "runtime/Cpp/runtime/src/tree/ParseTreeListener.h",
+    "runtime/Cpp/runtime/src/tree/ParseTreeProperty.h",
+    "runtime/Cpp/runtime/src/tree/ParseTreeVisitor.cpp",
+    "runtime/Cpp/runtime/src/tree/ParseTreeVisitor.h",
+    "runtime/Cpp/runtime/src/tree/ParseTreeWalker.cpp",
+    "runtime/Cpp/runtime/src/tree/ParseTreeWalker.h",
+    "runtime/Cpp/runtime/src/tree/TerminalNode.cpp",
+    "runtime/Cpp/runtime/src/tree/TerminalNode.h",
+    "runtime/Cpp/runtime/src/tree/TerminalNodeImpl.cpp",
+    "runtime/Cpp/runtime/src/tree/TerminalNodeImpl.h",
+    "runtime/Cpp/runtime/src/tree/Trees.cpp",
+    "runtime/Cpp/runtime/src/tree/Trees.h",
+    "runtime/Cpp/runtime/src/tree/pattern/Chunk.cpp",
+    "runtime/Cpp/runtime/src/tree/pattern/Chunk.h",
+    "runtime/Cpp/runtime/src/tree/pattern/ParseTreeMatch.cpp",
+    "runtime/Cpp/runtime/src/tree/pattern/ParseTreeMatch.h",
+    "runtime/Cpp/runtime/src/tree/pattern/ParseTreePattern.cpp",
+    "runtime/Cpp/runtime/src/tree/pattern/ParseTreePattern.h",
+    "runtime/Cpp/runtime/src/tree/pattern/ParseTreePatternMatcher.cpp",
+    "runtime/Cpp/runtime/src/tree/pattern/ParseTreePatternMatcher.h",
+    "runtime/Cpp/runtime/src/tree/pattern/RuleTagToken.cpp",
+    "runtime/Cpp/runtime/src/tree/pattern/RuleTagToken.h",
+    "runtime/Cpp/runtime/src/tree/pattern/TagChunk.cpp",
+    "runtime/Cpp/runtime/src/tree/pattern/TagChunk.h",
+    "runtime/Cpp/runtime/src/tree/pattern/TextChunk.cpp",
+    "runtime/Cpp/runtime/src/tree/pattern/TextChunk.h",
+    "runtime/Cpp/runtime/src/tree/pattern/TokenTagToken.cpp",
+    "runtime/Cpp/runtime/src/tree/pattern/TokenTagToken.h",
+    "runtime/Cpp/runtime/src/tree/xpath/XPath.cpp",
+    "runtime/Cpp/runtime/src/tree/xpath/XPath.h",
+    "runtime/Cpp/runtime/src/tree/xpath/XPathElement.cpp",
+    "runtime/Cpp/runtime/src/tree/xpath/XPathElement.h",
+    "runtime/Cpp/runtime/src/tree/xpath/XPathLexer.cpp",
+    "runtime/Cpp/runtime/src/tree/xpath/XPathLexer.h",
+    "runtime/Cpp/runtime/src/tree/xpath/XPathLexerErrorListener.cpp",
+    "runtime/Cpp/runtime/src/tree/xpath/XPathLexerErrorListener.h",
+    "runtime/Cpp/runtime/src/tree/xpath/XPathRuleAnywhereElement.cpp",
+    "runtime/Cpp/runtime/src/tree/xpath/XPathRuleAnywhereElement.h",
+    "runtime/Cpp/runtime/src/tree/xpath/XPathRuleElement.cpp",
+    "runtime/Cpp/runtime/src/tree/xpath/XPathRuleElement.h",
+    "runtime/Cpp/runtime/src/tree/xpath/XPathTokenAnywhereElement.cpp",
+    "runtime/Cpp/runtime/src/tree/xpath/XPathTokenAnywhereElement.h",
+    "runtime/Cpp/runtime/src/tree/xpath/XPathTokenElement.cpp",
+    "runtime/Cpp/runtime/src/tree/xpath/XPathTokenElement.h",
+    "runtime/Cpp/runtime/src/tree/xpath/XPathWildcardAnywhereElement.cpp",
+    "runtime/Cpp/runtime/src/tree/xpath/XPathWildcardAnywhereElement.h",
+    "runtime/Cpp/runtime/src/tree/xpath/XPathWildcardElement.cpp",
+    "runtime/Cpp/runtime/src/tree/xpath/XPathWildcardElement.h",
+  ]
+
+  configs -= [
+    "//build/config/compiler:chromium_code",
+    "//build/config/compiler:no_rtti",
+    "//build/config/compiler:no_exceptions",
+  ]
+
+  configs += [
+    "//build/config/compiler:no_chromium_code",
+    "//build/config/compiler:rtti",
+    "//build/config/compiler:exceptions",
+    ":antlr-compatibility",
+  ]
+}
diff --git a/deps/v8/third_party/antlr4/runtime/Cpp/runtime/src/atn/ATNSimulator.cpp b/deps/v8/third_party/antlr4/runtime/Cpp/runtime/src/atn/ATNSimulator.cpp
index 159d8f176dced0..540ec95ebfeef8 100644
--- a/deps/v8/third_party/antlr4/runtime/Cpp/runtime/src/atn/ATNSimulator.cpp
+++ b/deps/v8/third_party/antlr4/runtime/Cpp/runtime/src/atn/ATNSimulator.cpp
@@ -15,7 +15,8 @@ using namespace antlr4;
 using namespace antlr4::dfa;
 using namespace antlr4::atn;
 
-const Ref<DFAState> ATNSimulator::ERROR = std::make_shared<DFAState>(INT32_MAX);
+const Ref<DFAState> ATNSimulator::ERROR_STATE =
+    std::make_shared<DFAState>(INT32_MAX);
 antlrcpp::SingleWriteMultipleReadLock ATNSimulator::_stateLock;
 antlrcpp::SingleWriteMultipleReadLock ATNSimulator::_edgeLock;
 
diff --git a/deps/v8/third_party/antlr4/runtime/Cpp/runtime/src/atn/ATNSimulator.h b/deps/v8/third_party/antlr4/runtime/Cpp/runtime/src/atn/ATNSimulator.h
index 9214e962c30202..a43ed7f691043a 100644
--- a/deps/v8/third_party/antlr4/runtime/Cpp/runtime/src/atn/ATNSimulator.h
+++ b/deps/v8/third_party/antlr4/runtime/Cpp/runtime/src/atn/ATNSimulator.h
@@ -16,7 +16,7 @@ namespace atn {
 class ANTLR4CPP_PUBLIC ATNSimulator {
  public:
   /// Must distinguish between missing edge and edge we know leads nowhere.
-  static const Ref<dfa::DFAState> ERROR;
+  static const Ref<dfa::DFAState> ERROR_STATE;
   const ATN& atn;
 
   ATNSimulator(const ATN& atn, PredictionContextCache& sharedContextCache);
diff --git a/deps/v8/third_party/antlr4/runtime/Cpp/runtime/src/atn/LexerATNSimulator.cpp b/deps/v8/third_party/antlr4/runtime/Cpp/runtime/src/atn/LexerATNSimulator.cpp
index 375caad17f62bc..409a8dfed7f54b 100644
--- a/deps/v8/third_party/antlr4/runtime/Cpp/runtime/src/atn/LexerATNSimulator.cpp
+++ b/deps/v8/third_party/antlr4/runtime/Cpp/runtime/src/atn/LexerATNSimulator.cpp
@@ -155,7 +155,7 @@ size_t LexerATNSimulator::execATN(CharStream* input, dfa::DFAState* ds0) {
       target = computeTargetState(input, s, t);
     }
 
-    if (target == ERROR.get()) {
+    if (target == ERROR_STATE.get()) {
       break;
     }
 
@@ -217,11 +217,11 @@ dfa::DFAState* LexerATNSimulator::computeTargetState(CharStream* input,
       // we got nowhere on t, don't throw out this knowledge; it'd
       // cause a failover from DFA later.
       delete reach;
-      addDFAEdge(s, t, ERROR.get());
+      addDFAEdge(s, t, ERROR_STATE.get());
     }
 
     // stop when we can't match any more char
-    return ERROR.get();
+    return ERROR_STATE.get();
   }
 
   // Add an edge from s to target DFA found/created for reach
diff --git a/deps/v8/third_party/antlr4/runtime/Cpp/runtime/src/atn/ParserATNSimulator.cpp b/deps/v8/third_party/antlr4/runtime/Cpp/runtime/src/atn/ParserATNSimulator.cpp
index 03ddd7d4bcf10b..aac9affe2ff17b 100644
--- a/deps/v8/third_party/antlr4/runtime/Cpp/runtime/src/atn/ParserATNSimulator.cpp
+++ b/deps/v8/third_party/antlr4/runtime/Cpp/runtime/src/atn/ParserATNSimulator.cpp
@@ -183,7 +183,7 @@ size_t ParserATNSimulator::execATN(dfa::DFA& dfa, dfa::DFAState* s0,
       D = computeTargetState(dfa, previousD, t);
     }
 
-    if (D == ERROR.get()) {
+    if (D == ERROR_STATE.get()) {
       // if any configs in previous dipped into outer context, that
       // means that input up to t actually finished entry rule
       // at least for SLL decision. Full LL doesn't dip into outer
@@ -299,8 +299,8 @@ dfa::DFAState* ParserATNSimulator::computeTargetState(dfa::DFA& dfa,
   std::unique_ptr<ATNConfigSet> reach =
       computeReachSet(previousD->configs.get(), t, false);
   if (reach == nullptr) {
-    addDFAEdge(dfa, previousD, t, ERROR.get());
-    return ERROR.get();
+    addDFAEdge(dfa, previousD, t, ERROR_STATE.get());
+    return ERROR_STATE.get();
   }
 
   // create new target state; we'll add to DFA after it's complete
@@ -1409,7 +1409,7 @@ dfa::DFAState* ParserATNSimulator::addDFAEdge(dfa::DFA& dfa,
 
 dfa::DFAState* ParserATNSimulator::addDFAState(dfa::DFA& dfa,
                                                dfa::DFAState* D) {
-  if (D == ERROR.get()) {
+  if (D == ERROR_STATE.get()) {
     return D;
   }
 
diff --git a/deps/v8/third_party/antlr4/runtime/Cpp/runtime/src/atn/ProfilingATNSimulator.cpp b/deps/v8/third_party/antlr4/runtime/Cpp/runtime/src/atn/ProfilingATNSimulator.cpp
index 6739643345ca93..fc74dcf879a73e 100644
--- a/deps/v8/third_party/antlr4/runtime/Cpp/runtime/src/atn/ProfilingATNSimulator.cpp
+++ b/deps/v8/third_party/antlr4/runtime/Cpp/runtime/src/atn/ProfilingATNSimulator.cpp
@@ -90,7 +90,7 @@ DFAState* ProfilingATNSimulator::getExistingTargetState(DFAState* previousD,
   if (existingTargetState != nullptr) {
     _decisions[_currentDecision]
         .SLL_DFATransitions++;  // count only if we transition over a DFA state
-    if (existingTargetState == ERROR.get()) {
+    if (existingTargetState == ERROR_STATE.get()) {
       _decisions[_currentDecision].errors.push_back(
           ErrorInfo(_currentDecision, previousD->configs.get(), _input,
                     _startIndex, _sllStopIndex, false));
diff --git a/deps/v8/third_party/eu-strip/README.v8 b/deps/v8/third_party/eu-strip/README.v8
new file mode 100644
index 00000000000000..e84974d92b9cec
--- /dev/null
+++ b/deps/v8/third_party/eu-strip/README.v8
@@ -0,0 +1,24 @@
+Name: eu-strip
+URL: https://sourceware.org/elfutils/
+Version: 0.158
+Security Critical: no
+License: LGPL 3
+License File: NOT_SHIPPED
+
+Description:
+
+Patched eu-strip from elfutils.
+
+Build instructions (on Trusty; note that this will build the
+Ubuntu-patched version of elfutils):
+$ mkdir elfutils
+$ cd elfutils
+$ apt-get source elfutils
+$ cd elfutils-0.158
+[ Edit libelf/elf_end.c and remove the free() on line 164. ]
+$ ./configure
+$ make
+$ gcc -std=gnu99 -Wall -Wshadow -Wunused -Wextra -fgnu89-inline
+  -Wformat=2 -Werror -g -O2 -Wl,-rpath-link,libelf:libdw -o eu-strip
+  src/strip.o libebl/libebl.a libelf/libelf.a lib/libeu.a -ldl
+$ eu-strip ./eu-strip  # Keep the binary small, please.
diff --git a/deps/v8/third_party/eu-strip/bin/eu-strip b/deps/v8/third_party/eu-strip/bin/eu-strip
new file mode 100755
index 0000000000000000000000000000000000000000..994e2263b9185f77169c6c8545869d3c84cf0a8a
GIT binary patch
literal 105120
zcmce<33yaR);`{y1saInh#8EE+GxO_hzTMlLY!{Wf!ol*$R;BoK_CR#V$uy!KoYwf
zxL#Z1t}{9xGmbONr!%6TtRq?2f;-}dq5>{>uMtI2Kos(S->Q2%9VFj;^E|)jkB_-k
zr>ah!I(6#QsZ&cYEeZ@vaylLMza+<X4#v7%;1MAC*WoCAuq}_rk>}{@@Hj4T^mKGW
zu2lSQ=kr)0`<s)5MEtYAE*W(s<C}v2E3EX2BoAVYd-wrn`Op5^we!pR+WvX0p!{Yn
zlsWCM!{HX`gp$@stxS*9P8D$byE|P(9sSOdU%MR1W4X+GWx33IWjXu1Pl6rx*KQx%
z#{ciJ+ILTq2QkJy{5X8#Z`+r7`L8qnXSgFenTP-E{Pwrxi{NyIOGin9N=JD`KKuI;
z8-aiJ*DiMh%2`P=!@v1!vB@#os;?tD7oRB+*<XuIjw|QPx@FM7E9XqVV$Q62q3SED
z^9EfpXkh=U`TYloHW5Gb4j(m6Ac*rHG18oY|0z36H-7(<_Q%v`%a`RYIebIcla8cy
z%N8;1xA>npM7x}BS50ktSHdJm9FFV@?&<k*{e3NE<EEy6IC#UC`QPidm?2mDf8PO7
z_x2zWdjf==4xZdW{)rvHKLobZ;YkDBEoy52=YB*_m;d4p=((x`cxeal4?Cc9a|iHA
z9pD+>LH_^gfd1kR^1s|c{;N93e@+MV{JjG_JvzWMwgdRg4)7=)<iEWGdggSHKf8nc
zT{?h!I>58219)Wzc=Qh7*=VmD|DXD=UkCVK>;N7Cg44-uRR{2Yb$}<o13DcYz_U8Q
zGoyogf9?SORR?(ftAqTTI)IPsfX>G{$Y0e#y~8`e)3XD3r~~{Db&&rW<agu$Q~#xR
zkbiau@asE(FYBOPBT=FI)JhT0>mdJJq@7N#Uh5$LLx7*<INwqFz*JF-JzxJpz!irl
z$J-9x#mZlPO8))Gb(TYMsHf!r%*tPJN`43Cz3Fr0JU7KZws^|)8I?0;&Z-K|s2p2d
zIA{L68Dpp3GG~Tk%9NRN=g*r`6`WcboHE5RWyFFhqpf^}bEZ~R&8TvS;-@V<ea^Hw
z^Q&e!rq8LmeJ=jaub4596;ETmgMhm#STU{Q_9@fKXFIBbl?Xb@rj^f~KiyF^BRFUN
zw5cGVELa(uH*IPVSf<UK5e&|#4z|Gt4HQVGPMb{}Q_7~!n&Sw~!%RNgF|~4L#gvN5
z`7<l0&YiMgMrGA3G^2d}{MnAm8B^x~xnt@r^DBd>clxY(j=3}DPAjhjGByb<6`1DE
z20P|fkhI|ZIgYt=r&frJq!Y9e$K0yh=S^dVIcOP>fNmg}QCT@}{uDMKh+0J%pg}TQ
zi}bQ;@G~fgFRQ4WH7{6Zv0(cAP_RAaw}fU+nL2%X<&3H-fd}R1%BrVKX~QxtczeZ+
zDYvjnpeLKB3}DMZh+}SO9tj7t=Oxr-6X6I2XU#<?R?e6=b?yvVH%iT~blg@&_DD8P
ztwb-DO`8{-L+WMc%$_xGCP|t*f58k#1(-VBQL(Uc7CP#dS@Wi|pQg{BJC(c*R!*HZ
zgG`zRE=-w10k8y0q~9{NN>*NVd)2i0^U54$l{02Ih6nsZ3#Sa|KcN5B@$gmgQ0~BZ
zuq|{=9ClUzffx@-u*~Ftw9({$De+J;>~<S^`Y%g$0+!D4d~KojC2agqF38*2;lf|1
z^}iUti19y%gZ88w|A)?-)rHpepI8L{oT%vzd~JL7>{+wUZ~)IgkWSb`_df#jv6Ew+
z70(dqsgBK7{2UQaalB^5CH`cApXGz+vc4q8dr0TMWA{xJU)rR-L`eRz^$^!Iv{CJU
zw!R_UYXkAM^$OvI3GmE1iJ$8SX9C=v0JlgHso4o|+RXO9oCLVNMqpZA0-SZ*|2zqB
z)@}b&6X3RvWm-uB91M#8n~(tS8izU@r3vtE3Gng+IBjM7Uqu2O9UA{vodCC%CL*mS
z0j|VzI~*$#;I@n~xh?@7Un&CrSOPq8K3bUoKRW^cssuRKH1@yM3Gm<8Kz!FHz<VUX
z8x!E?B*1qhz%vuzI}_mNCct+mz|Tv7?@NH6p8z)!;E9W;LkaK;67nBQfM1vZcii75
zw-+VAT?ue^0z5qd-YWr~nE<~y0q#zKUy=aNPJm}6z;hDdy%XSh3GhA%a8CmK(ge7g
z0H+OY|0_v=_qBoePDp@XmH;nJfM1>fFHeB?OMq7-z^_PvS0}*xC%|hG;8!NVS0uo5
z65w?S@Z1FWV+rs93GkH(@T(Hws}kUxJM4d}6W~|dKz!FHz-gP>{~8nEc{UK=9SQLK
z1o+Mb__Yb}-3jm^3GjUh@PY)mkpRCg0j`F>cBy*mlZ$&f)M#Tc)#wJTtA@9_w#ZDa
zS3iKH*4_`{uX2$GA;!y@XzpvpzutE<P8DwM6!E(lr|LEvMf?uNsj|)0B3{WjRkgWN
z#BXJsD%z|Q@mm<@v}4wY_)UycRhtzeKALf=XtPwrM=(y+Y?g@lP{yf}O^=9Q%Q#iB
znIqx@7^ez0-6DP&<5az7x`<!QI90Cc5b^UEr>Zp%odlqFcgCq=&3z)?m2s+8bEk+W
zF;10gHj4Q1MTk?CnyW?pd&a3k&6Ohl72{N$W}S$C$~aY~StH^fGEP-#R*3j6#;GFB
zQW1ZJajHhMM8r2UPL*hSM0_LTRE1`ah`+!%RiNn>@&9I=s?SUp@jo+8m1jCc{P&Dg
z)tQG*u>B7(?q+<Sh~LdPRhzj}#P4F9D$Q&Z@jDo&Dl=D$cqQXhVdhE^zm;*SF0)R=
zZ(*D&%d8Rcn;566GAl%UG~-lJW~qpeV4SMSED`acj8i3<9udEmajGISN5ls(P8DRj
zMf@_xsd~(G5x<ymsvOfH;^#3=Rbw9dMf5-8R59j05%0=4Rg1Y(#FH4ON--Nn{P-P+
zQ<a#jMf`ilsY1+^BK{TQR2^oWh=0oXAjWG%{6og6Ld*&g-^DmphgmA(uP{!PVU~#a
zX2z*1Ob_B-eME_0AFZmhUakX7b-tyBH>^O&5xmGht1^$k+{W<Y0i}*m*W5-me0zyQ
zdAKpW&$(r_b4&DP@AFP2(hI}adt;H->>cmb-t&(0Yd>mlc*pv+U&f6IXm6{vU+)GQ
zzkY|?_-MSt5k7XVwoQq=O--U#rK|d)%s|YSHAIaCvPyi~abw{d$gMRi>pY#x!pB-e
zDLPWMMr3rWvl<1R$%U$_S4=RT1-?k5cSVyD2?JmF#F@(SI}q?{Ukz=|dUxODUdMJ{
zmdD{;PZiYCzpR-tM3KkQa*>QNPL0!|sBHkM5LGXP_Vc6%^7mD`0)6)d@*ArPHc}bY
zUvP=nk=q*3#%5*vv_O_Sp!u>gjn{u}ZOuKRYMXOga~q9T2uMI@4xKsBip=8Z!B97U
zc&W>wMBW8SYHV><MQ-B;DkL>FHp_GP88!A&)=EZ!yF#0jRSlXJllp)b$*RHk`L4(W
z$^yymqR0{L*{oFnHb=6a#mCOK8sR|fMS&=w{Y89>^_i{!>kGPyonM=eB8#dggR9vA
z?fZasl8te*F`3F*HPvW(4e8NF(w@myxI-htZ?+mEZge;#3s(0b3sh~J@!s*)R#hMA
zLBmy0>{6RkvigBR-VKq9@pt{%(9gL?8b}=2VnFT!`Nx9iZrIt+>)4oq#QHqsZt&ob
z@fC2P8yEIw|4l#!pJRHKr{(-IpOfFS<tHs5VyVV6Ke1}76~_bGk+ufxe6_6slJ<Kc
zEvM3c-oK$eyB+QQ1nq}{JtggZ<Ft<=?frqPDEDQxb}I$mw_?Y{$=*rc$=;j2Q??+s
z#e1VyYxR!zYezUpUgr>bXWW?FJ>C+3EN}rj_)~vu;Du`64}DszQ43j8A^u=+D9w2L
z7}%1R5;~*h9RM9myQ<pmV7jUqE!|Y-mO%bzl`jEuQ$mH~RPBTqe&MfGjJ+IHJ76qX
z#6BN~{}&;?UDZn5hPIfnMcHb!HF!P-WS%jzn%$*p&Blp{m0v4K$E>eTocy1)p}1We
z6sryAT5ag0D!!ID{f(;j@l6xaqBfqD)saO%j6*|Uh@>0eh`uUVx}cY%o&(tUSoD5D
zSsd`11k8v7{sln&T1a67Z3ZI^80w$NLiBFHj1xy&TV-eqLexTO=)c^T(G%J?4Q@ES
zjEx{V+8CNwQ*aTGI)WK$xS%&fmLT=@I)Zly(KfCe<8WZKq~)8z(a6<V<R23AI`g+J
zEzaFT`$(PkvR@zan&I<cPjU-1LRw69=D&_Xm$vjXZ8vzF&Mw>{)zu+j*$_fqp^YsK
z4O>9A(G3M#cFVeVqwd^RV**GQO2-~x%hBfCgMRI;n^o;oHT?OZlCl2g#!@s`ZEiZ$
zi=XD5=X)GRJxcyi)?c{@-Hd<AMUM3|(dKdL6<o(d&dyY|FBT?E-m;#_Gys2?+`y#P
zeab~Ogso@H&fjz_8TqLMn!ft2>fEWmbu5I!8<|m!?m}V6oGkyTRlcU6DaiJn1!?`l
zxDylT<n5{d1ju=Ki{Mwdpm7@6eqo%1jByQ*)q*<hi`Jc!%|$2zy3H#29phb3m9v4p
zyYWH%sdu7sOkCQ}#!mF4WZaJ4f^ioeX>Hx`XR?KQYp<2nSQXFrH>82VM}Ndf)b=9R
zhIN2Uv@)7Yk+Dqti?cA?I)983ITMxMIk2|Xfp2iUa_=Lcp|&-Nv3bfpRM)kw+*u3V
znA^BLwYdt-orvc8FoCs>2~J#^8*Uw@MD`(HxOH@BKtl$U%Ldx8s`mEbzberK2(sk;
zc1h$b3r-8S&J11{Zk--HcRloyW8#*wI_8>X=K_AlZ%T-VTPuRyFu}K0g<iGu4@pR8
z{_KP}1d>tAUjL06BsaH9F1__b;@p=E(OTa_P+|4su}YK+mdP^5QKsdUvO3_~Dd5*h
z_&&m4XcI{Ztr0VgF&{OEe%Ov#<j;u2D-b<=^>Sdc_{bjrReZikXNSf6i(==!(XSna
z=`v2}<1woCDl8Tn2->FAn8AHoG=k4`RZr=ijRvV&(GH-G?h0tJl}J#v*gjaoO5_Ff
zkgC0J>^>~W^lRIV*AWcF%AI0@J)ky6cOWNlU<5`DD>yP1xcVYBy#J8e_cfXW2!DCV
zc#1L?t9EX8TpQ57QngQv=h=F_;Dy_IVKB7@d+868tlY->p};5dW3teqBw2|(?{+w9
z3M!D7RW({wDbXP?UTO-)5w1k9L`2mum>@9jQ6fd60eg*e*npVY2eoo!*rWwOnigBd
zCWoKq=a8yDDWck5<1ne)(0_vX2R2}|xQv?t6hyr!h*}Gx)L5t{fZ6Tr*$79`OVO2r
zc{hu+HI2x~<g6VIN3>B{(VO6K!AliF=5!Yntmu^7UG+4XjGohxu0_{d#m<<8sJ@9&
zaR1F)MIB0H?;wIjO=aQgbeODvK;eM?G&3seD)Iu_mxgzqmHYWqatCiip*-?&x5dZc
z6gBo_DI&Q?EIp=bACl~YvQ<jt8mtKQHOvnV5_>YRqd}1ikpNOeO02?ZQKf1kFD%|X
zHUH4U=h5V*`J%}j>iQ<~&u((xX*30aR|u1FUO5qNqF|xPACUp9XTd3rP$EwN6WeNK
zHg1?}WgU4+)?nyY?VZ*^dr#OL{^87cdnGMswxOT~((*nMRsCUhwAFNF-H1Gu&6n*~
z^S@j84>h)Cht-Xpw#(k<x(6i)R`a8j4JCXx78`0Ttx;{-pQ6U@cRLZSJ?`*yawyB@
zQJ`bhN%dSK7>AA{ripQezT1h~0kyjk#bD!@1MwC53C2!c1yTo#u2G_wh-y+A!7Y|l
zoA#xs$r4wr!li0?Ms6jtvw1G8p6xExZ3$LmJwf7UDD)%;x<1BbtPCQbRyZM^H^!8B
zM(3+)c+muh5?KY+qmRjHE-WRH>fndjer?QjReMhfb7R}$Wm))+bZ4;Bk;3$(5KQhu
zH*%w3TKIT(CGsYg_~GMcDUkyR)WYg%ov%cGkFctbNk6hZDR{YFRS`X+M6M;m*uW!d
z(}5J9K0UXzDEfKm%$frynhU`Xq-kTYL|Y@65N<?|2?kNv8|8ojgo#RYJzJv-YW><4
zYq*Fe=%S^<JW-JnKJHxD$NV7$?q>vp6RkpOxEbg-iJ_5yTv@gg8Pr&c;C)TOQ*(N8
z+Bus*-RDeK-!jzjAtzR%kw$b9O9j{3*;VI`GBKYvdrH{|-BUs9<q@Q#SJ0Kt9jacU
zLWwJp5S%@#-d!J{mjuIKIl~8>T1ile+ya)tW~n!CMgYhn#KVDSxQ3#DP+iokN^}Fb
zE9a@%n5SVcG#>;bv@PD3*m&by#B^BOABr_$%eSqq%~6hL{sWV!K#5t>i<S^66@033
z5h~I}-e_ZWPb4v~OnT>QAQfuC_<*&AH*qRLI|?3{-OCZ|1+}grfR2+>)LtX$8``l@
z%u4hq=pveKQkNQ!5`$j6W4d}(nwa8z+CC+^98L-~He>fhdkHgni~g{i#O1%GEPuNb
z2M$M5oz;M%+#}ngD+CqI(Z}MzgOW92$(m<Dx2lT?6B;7-2zgSJ`?>KBsDl`Y0RgUG
zTeC@EQleYH8nm317|*pZlT-(GN2Uq|P$0(t^1WzSar8*g<=3w>YDMl%q(t(pg8e2Z
z2g6q?G)$D|Rsf^+L?$J&7y;u_nHZUmNCUgc7^gDZ1^sXB1;@lz*`jo5eSe5*inV>5
zD76n{gN#mSjqH8%a^L`;u<lP75K5#kuu2<0O~|R;cDq^nOGzuxa^t111YhKIk+LgM
z4e6c|%Cw^DdB($u*@im(`P-~<TJ=}69u&moSB>t$qHEJWz+@|O&<Z$eAhl<aU)mO9
z7I5h~0c}6m_8;apT4Fpv2uZ<JvwAtq2JqC9*V?8Wun^0S1mgvRm>p?c35+InPn*3Z
z*lA&O47V*v$x2p!k7$T3AAW7O#nBfbH|7{1MP~`zPniIu%cl9zInEtEW$hU?@HFC^
zdON<Vu0qwWS;<1N68Le%$TIF`ZmE#W&0L;pZyJ42E6p@D+~`I(Q5wK}7#{l$A<Fth
zwC~oqeP+(Y+MynrLuiB}jmRvm5HkeB_p}4tbRxyC?P>OwLgk{|lR`A10k=ngU=@i1
zvMe(NUJ-ECVZMkzZT)8%72$$E&FlqpdMPv-RJYJ*K3#?KemU4#4Of>qg46X0Iq2@7
zI}pp-<8S&rWmK$RuOht&c^ZT8K`ntNFT!&rdI_eClwh~;@h+H6Jn5cbUwy(r7VVW-
z)T=Kkh0-{~D!CCQVZTd#uZFj`&E?-K%ZkP9Iq-;I+rfDSb6l=oSc+xzb$Vf1_*hCX
zHGHf~sJFgopql@_5?;%Gh-E<2e~LM1(peyJPq4E!0fvuZ79$gYA$-iKM31pY!v!nL
z$bfE`G}(|bAP2oI2g(qz<Vz^|H}xBHz#utnAR+n$Vh)|H=6{cg0VN#D1C1`heSNr~
zs~hM76NZBc*XY9s!W`HESy#dtl0r-#p91eIK7BMW?INZ_%|qK`Y9227*PH+{!5=y*
ztJ4FzOKti#Ne#C;m1S39@OyPH*dk{mpFY-EDzpJ{_Ll1<OttyPlt^chH=`EpK{Gy0
z(Z`-u3I(~h*_SJ-1yjresL8TJ{rWgLtNoKbkbl^(jVn<e*z9_k5@vSCA31LQdJ*z9
zDv_;rz9QtacwzR5=M&wP6zmc{)=h~%0WjFDg57lxPuq^Mb(V8SKrh9#TFzOuw~zoy
zvp?1o44AD#2`Z6gOpvxXMaWU#4Sz7L>S~5DZ*p5F${`A!kh@Eb#XD5hhl8J<boJ<A
zLH_w52@{WbFZ+`I6+OldQ}bU@!t{r#u@@Xp#A{EUWR7Kz@$XtsN_d|#Bw2}Q%t8$X
zXyiiSJF<*22#qC899$p(Hb<!?RgmM(0c~ap=ReSsyUS1UmsADv4=Kx{AR!Qoipeq-
zD+P@{dRV{VLg4r7P$fD49X5rObtRo>ghYMlX1hYG<@Ugi4RN+SR<lW{2qpR&1u<Ok
z6rCagU8oQxawqNH@Fuq0*-nczqnnDgk6JFZ?H9Ef>}TdCh?iuQ7UQ4+YebidsnB?O
zh9J^5?IKrU!w0ODqbuWOF$$8!Y^_(8V#38Jyo00gCDFMfTt&GDu~cNkRec1!l(BLd
z%tWw42Hgl&%V0KwH8Kc0DYile^AM~P!O<R7d-yR1V`~IX80&A(lxvI0*qVw9Vmp)D
zlGNv*Y@z#Uq8g)U;nN7(f|*_vw3?KHCdCc>qR2sE9O?s9?J8BTgtcFV>7x?u;BG}F
z8c~(0>Z8$uF>WRLcM?X8t3>{Zx*+Hf_N!EFLP<dT*0}r|O7~ZAOw*rw@N;rRR;neN
zArvjv%T==lZe_o|1oNnI_k6)>PC9<ANTt$_4{E(H(<~(y*ZXEhTj{{*N?Sv{xUIC=
z1x3QuX-P`-T1;fBJ{UEpv#dsaC6}j`Ic5!S-Ir8uE3AM%CrOOv=m6jmbGk9$x7KV9
z?$*n#0i*s?;MOMndPCr9At&}U-?laII`|{eeTH3VVWA|To8J+-OThP*=VU8Ja8=UQ
zihyn{+N7!tI2);?ild(^(a{)6va$uIsVu3Z%KCtI^S7;3xgLisKj<{&H}CJD?SnzA
z*^2Jn@Bz0!c%n*ff0SGb|85J5iSDT7`n;_nHt+3KXt)}BIC?RLyrkiUf?qT2x{hdg
znQd4E8XyB_Dba)AgjonwdSzPpWM?IkNAWm$R#}}AxdK7R+)89t)-AXWOLZl3u7Hhj
zc{fpmW1RlK8|lr_>8J^Q9-tLt-t3IZinY&dD?PS``}UUgWV|*38KdY^OA}tv2XV{Q
zpl!EpEFHTg7{Q}4l4%H9o(Q4p;E6~t)6{f)yW`tkACaM{8PHl7<!YurB1c&_`Z`U`
zDbq@>GyaI$sJd_K&054vVbzQ=L-&MO;-XeASL_aJ#>9c<IE)H<GsL=)h93$t7Z#e>
zoR2GSOZQ7xlVt9zFc?{0S#~jU3Nt}WoW<J5Ef?8il`HdnxiXRqbY<DoC}YzAJI-08
z2eV+b90|S(R<1|YUhMak24a;?W9<}fxcaiHZFKgOZh1WP>T0n%>X(UT%tB`HP|gKC
zVU#2|IZD<1ol0~vvSA|$*0)%F<?b@B7LFV_wQAuSPzH}E9IfUM^rf1QrPIUJpr}}D
z!H$>`>A|TeTu?s=lbm1MhAGWnWCqWuDR`V<B{B!KjEwmXqAF3%MmhxR|B7`cI)JN3
z%wFaEG(F7^Ju&<mf5+y!#Q{~)5^pu;4?Rjk5*npNYXHy+OPdSRFlu0>7pCLGF9^WK
zYhjN30Ih&}tgqYp=CK=%F*hSoE3`R`-WMcx!01C~kV8*apk`P%#*xV=tj7dpT2uwp
zT4@6f^Qiedl;}f;5Rj@HMMd6UV>d?50;*^uoYN@FOiJViRA%uI`!iNqqr3D9vYY+-
zc+7jYxF=%fvQ``G%uX~qBGp(H2{8q90%{;10@^=VE}*R;y{N+@KATGLv4xZt7DiVz
z4;s<#63X>p*(Fl07rbS;1_HXos7s8x#Hb65O5_Jvm16mnKpD1ON5(R+H25?n5bJlA
zSD##p#lV>mv~f2HiBjRn^Xf&@wdf(V+9oTY|Ha9*I8v}g=%Pd}faRbp`^`CUuyJXU
zgi-|%<M~RoGlGGbP%p-xKWS}^pf!i#bBn^cz8PPy9x8>;d_5ZtpLy#|XsGm_>9R_=
z&D-~xUQuf7MmD(}ixbnb^Kg9PPMpy}uhFi7gp9RQwnL%xU<xc0;qVr^!mBTESvGdp
z(X6z|uMbOyWqtHJk&dlC=Yn&+dfG!+Kf0841ILtU14pXi&Cn{FLtk2`{QBf{3tfol
ze0phyPup*-y8#650#fWi10yT51{hN52z~?^{INUJE#COGVd=(XG0_QAC=k2N85q3A
z5)ew9viw4fW=rPGVT4>%Lpg%42m^v%j5eL1MEAfqVWz|Bg7uc|{QvXsfIw(lvIr~4
zE<|WK-rF0B`oD<Va0ta96r09#AJ$61QgO~#^}-zCZ?Sra;;I$qh!qmV;3dpiSlP;r
zF(D^^0#Z0<JxcUZge*U<au>nqWouE|gd;U>9OqW`8}dLN$BP>CrMId_KU90|R5h>L
z>SQ%`o6GoklAM4ZKxKAgB%NSNEW=)&hVMvo1yf+EW~<4SK=7nM3yqt9SXBz&hPEZZ
z{3B*oy>Or{a<V}K&C%4!a+$ZdGwYGY^I39D0RNW~;h_k-e%lwHEcvB-RaH;-YZ+NE
zqFsK>F<@m00AsVDL`pIlfNYk4ERTS?(a3Dwi?L;|Gfi|Du+!u~<x~+u>cmQs%f#W=
zqjva_Z97$Jrr5wnKYR^-=Nn#qSUIQZ7>0;9d}msBB|3|v1sw-A(a_h2IE`M@<>b;1
z3&dC-*qaJI0DNlGH%S&wj2E;^E<E$MD|e+5w?1qR>-n5|1NC5u{0)Mq)U#n4c_rsd
ztqEv%VZjJO1IcTIk)MEAYgToy@N8r0f7hRZs~$6<!|3xVNnJ)QWHp+LVrvh?=KJlS
zZ@5?((@V1K0+bGDPv?PqUZDy7+DBetpKOno0*F1y7V|k^6#mDu@JWo3=_pg2e>8ZF
zRf|s-YuJEh;#d}U1KTSnI5t${_}`^S8kiidV*c2T&Qr*%*~B`Lp_YvprVUvgJlCtN
zElO!LQX-APGh#zArHL$>cc5Q;U)67qud9cr`;Y!0*3|}d=&#n*+#4-gg~~arK`|Pz
zlCaO!sf@cD{UOWBy7%nC7tTOjwzV3#Krg!hv|=>whwI7bf`x=0T>~P$wZ~dd0@d<|
z5%Fo8i*g%_^G}All;wY~L<XU?WnOJuC#z?{BEcW&@KE)|=_*gMeGIyY?>;%DiOQrX
z_+v}SBT=vFZ2GtS8QzXRt>zxm&3R=pn!6FLY84w5n9Np;!DJT1c7fEb*eQ&qVR?()
zGAETyi6hjY$J{7RKEN6L7W$z$CA?p$`6(G22bP~nb#8_h!P=lF@av-o2GHtgI>PY=
z$JqwF<}C6#z8>n6`|GvH3-5s7)2#)07})&wJ9dMdoP~ew);UG+7Db=<61LaSIp(l0
zPD!sUhbgN>7mM_Avk%k7vS~yqXiQi(#nm`QGb~l?vgu=_i>w~~s_J)OwVu@Gn|qQy
zuUDi5q$A0X<<7EmP>EODER;}7cQIbP`oOwC{u@g8=K~}R+h?3B>FUfs?$gHRR)jvr
zHdj(`BzBavF+p<~7Pf8t=>(JU)Wz)sZv)Zk_~VDDnQy|l^B!?HL(erAqJe-6j4zef
zU-@fnzK*cfk=wPv)<Bst7N4f9tD~~nsVG|%FY7r?+1GY;(265aWM&tds1(|xn0b7I
zg>q4%FCt=ofj<Gg_d6xMtWza7$ql1L0^t_p?YFF532P(G+Cz8(Qe}G3`Eoa7w>&5^
z425VhZ5H|thebljCL65x|24DD>4@kgGHWb$>_FLoQz_dIiZBZq`KPBWiIiOt@1(O&
zQ}2HX45x9AJVR!EB(}upm{~~kKS88V(ZbRbFb;>2WD{3i@#`iI?5L`zS=DW#DtLZi
z-z>nnT1?aq&V6bWR>hFjO5|#6U0@G0+z3~w+$z?CxusggFYr-^4!{Hwn;WwFzNe{v
z&CU+QVj@NAdzf$18FC+}k<O6vY&b(cK{1(dS3F@g<igm7gwrknsQ*R@WBw=xNln3Q
z5s9uvahMW2p!Mo8oE%1kEXC0jC2}b!z}DUvWJHctn58(O1R)Ys+%?E7MQbQd-(i=m
z<xTqKwi<=_V#5yy1@#<mVp{T;hH~arpV?h;LBE8q$U~EW;qS7f*#5NT^Ide0<X+3=
z2_+18gj!zH*YKc^wcEQ0IYC%-W@~F}O~JjzXe&%%k_}27N`$9r(T??OM{EtRC>X1T
z17vwUZ<Dh$O{)z~6sSk*VJ1L#!n=7k3>>&fX#2`jIqOQ`8yN%NNC|u+W4h}l8QK{5
zMoQot8I!4(<RHIW8<QiK5L%(z_(u_IUsKN7rFp}B(W5*Yqw1sFYVxS;df4GGk$f&m
zfZ7X-|1sGDg)tAs%e2C4Q9l>CYQaggN?AS=!w}%>>~^7lGSDXW58q*_$5u4kVEndN
z0HX?8W;G!oSs|J!j{YDY&aW$L8=Lke)f5y5aP;onU078d-4*`S)n&8MZ6Xj-M2PTa
zL?|VpeE4o}xXc!X%Y`UV3O;@vRLbpaxd$w_D=lGYMNiihd^J+Y<Aqr7)GSKD*(06<
z%spbCW6FKGOk0!1*<3oe%QUgcUZ%w^25_Sbq-@A0%bKI~vLWO!UZjQ&A9Dp~N!c7P
zW%GJc1C8{z*Wy$`TbdKWN-13T_DvKnA&wTQ8Ep+gkG1W)4nY&leS0Z>tJx#5HMATy
zTnj2TlI=!cNlGUrdK+ZTHmLL%MZhYf2VHLCsW*h&YUk_&!ePjY-DQakc2$|SiEWel
zaR7INoA@zi9nE5nK)_Lkb9lEP6TUIJ2#x2cwYlPo9*vi^c(?(|)}l|7xj^4r$YoAM
z%?<d!)wl~xjnBa=G0@C!ks<d8`@L)=1xTJofK49b7C@5W83ibX&LgymFdg++4cVge
zG?NQ%LSyjtupfjy213VNXHt%3g=ZyJXgSEAd=-UHH|gJxVQhYA2##{F%42KMJnsJd
z>MRr46VN_6)yE=CZcFPKXR}EO%i*mUI93N>V?qs!g|X9^gdqeG(y>E^UE1rp8#)35
znoH=G7cmF|m!c}YcW*zmrM5*%pBxUxTd&Zu!}Wff_?&<wN(nPB`~)3b)z79Ud4#B+
z-H!TsR&sv;3+U<;SMWaUrnnu!6#>26<qdy<J&HTfVNg)=aFvbW25?$*$0Vcz*eFnK
zHy+R8l@Od}lwiw2a@BYax`1|+!?q71*bGLmMpvN}_Joz_LX1kiFgw2NPdq4ugBH6&
zST&YF;gw_cyq;Crvv4c}dw)ZD7K2%aszAD$>3X4?4wkCC@S>D1XrL0IZCRANrwF2t
zi8iEaVqFeDt{QuIC*;H@cL;aGU4X+2(83kA#{>dqDcLR9Quj9*ZleaQjWmYNDb7C;
z#4&AL8NdaOFAe>1EERE(${*h5EYANi^cQROA5flKlvk{s0Her}VqDXJ#)r(zb{osV
zd9w#;23engJZ|6FBnhn1M{JVvEFVtpE*e<EUtv@94TL!YSA2}l1rqjc@XUbriq)#`
z(JB%};;_aH{Sg$+&NJtrmm2VYtMMKBEj}Qv@v&qFh&tW)cm~SH+(@H8T=3{HDA-f2
z0U`YG$iXTyzs4UqecBS=9IZxkIc_kTYOG*$v>YKgFCp4upRqYQ2LQ+gb5$Tnjbxnr
zHfNdO9a8w$%Srv6W)f;2`RapM+mWwhFC$Ga_^zlI&Z{EDJbRDb<`b9vy3LwEbvmn%
zI$=93N^5Sznao4rG<sCd_7BU!^oh8=^Y&w)I)Aqk`4*;|WN_VSDkD9oWw6G|eit`i
z$DXF_zU>{9-HiFuydYjSGqG$nHSH1XIZB#-x%k%%SkV#QH;H!}j4O0U9a@gwz<9Dx
zok3{Lx(`lG#MExSM5vxx?X%YwJ3s_v9gE-SK6GoYu;|Vb)#CiqHg=xSWFOl0+0~Ro
zp6Il;8WhxA|7gNigIrn~#dI^Z-&C-ACoG)USn{`XJ^Hk1+*gny_J7=0$fFe6$32ao
zX>t9Z_Z1$)sd6~qSAcoOpM<R@{8I7Vh|_K7L}-+^XLH}(wq1TB#-TLWlVO7xSAciI
z3Hnniy`iZ}^au2r?GnEa!bX?)KESvNd<0)OmD(KQ-xRVj;yCI5<`8d2Hfo<{V{!=!
zSf;HD*evaaHB+HX5gws;IoH{4J~^w~${V}d9$`d8sQ+nGDbdSdbIIz9_2T&X6rA>_
zf67+-C^+3x$<k>nO=h|$SHU{MEQ1LE9(Jfh7W2oJ*t#6ftYSSEK0wXu^2faCBVuWX
z&}e}iMX;M%!U9Ks@W*_e;F;K$jB^0##ub=eB}z1snRAcOE#^D~x5+k+1fy{a1Xt`M
z&^u_&UvdY}r<V_8VPehSri5=6v%gRnP|w_p_@DdGd>S|XF!04(OD#@g$Q*8^bVmxA
zzT!f<`~63cfTxlr89P<@P%r_y1KMShNTKTKwlfw!VtxzWTIU6I(K^uFWEDBs@~R}-
zJ_uB-hlC52j@m>nlPi|yBbSHfCve#x8wFk_vY4CFDB#tGr4;Fd1S?0x20jm@Nzm?W
zo8apE9N40xe$CaW;OecL|Ib`?QG{ZNT%CNc#k=<~9t2m}3Uc+qVOGjZNFi4TT<|Nd
z*6B&$X~1_Ho<3&&0o2L0@dv;l$KW?y8~?q@9-QyS6Fy`@9TH&Pu<a0!T0I@-$j$;s
zEkGRsp>KU!c1xW^{93&H7M3rGBOVza^&;UKB-ms883-X9x@ngC(R3eRrE*i|6XOgI
zIV2`mwAmW!#+O4aUWC9vy@WO*Z4_)qdi9Klw32?t7gP+=p=rLsSzljN4L!z5z_=aO
zOM-U<x{Tmc1^`S-9$UMDJ*21Jd|fXX%yR2gOarN70bwunB##7TLPws_C|3KH@({Cu
zKm7SG{#Y=}<qvO#H^ka=k%ytA`3Lt&v&Sv8v{spI%zA~^$r^5J5wkAt1EA@GN<GGU
zM&hiOI76nrL8-^?WU@G*hg$|e*MkBa>a%uwi?ts)Zm>hiHtIuN0q4^qs6~%S2oy-v
z!MgOJnV2UTl%zym5{fZu5fe=Z#9WURne6ZCc(<NIWnPLYTF%nru`due&C+4<m;=AH
z3yp~v5<+%4O4zdSUtlKnJqe_V-72^*yf8QqW#DO6ON~Fm#ek*8n?xqzyQUf&2-h{d
zs+KcBAC|2iUEsl9i?pc!i9tYPm5OUE4TE;0@4kBk+Tiu*Kbm&jp=>hU5UP7{Krnb2
zc7oknBNd=?r&SWF5d33i!;7&?ypuqXZB74|nT57Urg*V|5NC>IufD#CwVcLwTZf@!
zc7@$1NbLqvrHxIK&C<ZVbV=>V(^K2$f2a0Av=vtA2%FNU%sb#wm6SdTxBaP<UeXbz
zPm|Kp5ACuOPgC~GmpW+Wb1a*MvQnO&i0hB<sXx+LWn2{`4ME-$C+vC-<1odkG%oF^
zo+j2qt4_9W-D%1ec2w5HXfSJpMJOIRFn;$hl4WfSx8GB17Q0oP2F!6d4#qt|$fUIk
zs5P56!^UmD@G#GW!$h{e5fw?bT!#^3bO%8+QJX2IINsbWH(^k-LD97KXv7wjSq&A3
zHBvzP40qJ>z#}Cxs+EhjpX9j@C)Q4{7UR-zdO-7Mn;Z7qocPB%)NdEuo1bt`!3AR%
zZpQ&==Bf7-ZbpyLKwbv#k6<Mt#w_57_e8cV{3ARX@OBEHrMSkDg_5=^YrE}XmO_`v
zKDh)~;3)VdFTqh@QL+li;3AN|0_%MLJAyl(p9bX_KxsUTA`<VbINSide@Vnk?+sd5
zavHpgfmb>pPJ{Y|y*Abmu*TbLjb*23^J&KN=P)$Q>)yA^=AWkQwhiRhY0CbdWs^|W
zI?o{QpC&#D;MIP?71XzJ-#rgr2URO>3}{8`v6D%?h})%i05uMl;(ZKbK7-<RDK}?v
zkF)@n^!Lkqq&_b1F~b(^FeXsI<yBHu4*}g*SmJv(!31;|lhDYP%i8W|VCy(IoAzM1
zAFJEz)wUU#aOgu3Mt7kAj%`6*`QT{y^JPL^VbL4Bi3NsUBMQLaHfCN)<3Bm{f*<y?
zs*l?Nmma))ppgZ&t>}_2%`J~}Kddc>o%|I>1Cq^!t?+u)f#CJng`l0Xq|vwz4JIX<
zK?zZPvR=j`i1VtFPdk=yTS*idi7eLDj<dvl4ta?K%vrL-JczoaSOqgI0kDp)qFIIm
zMR6?(guz99n!cQibwb<G)$ZV=5TW{6(i_{fjxw;tIG10b5e@-iLSRGcbF@U}<^>!G
z?}IY8+@UwVSesBr47mS60n<gEw7b8|OUsZUypK@(^#n*rONC`;V;|&d__kH;+jEbE
z4<s3ffst2naq^k>2GrO?S&iTt?&BloFj6c|rXW^Ra4m{Df>pR@mxcSN5njf1gmBTw
zmzBdP3kJub&u<3NH3exRcZ|=M<fwQyK_Gk(^|7n|2YFernop}hPa}o^T%icy#3A~@
zm*qB#(J*-r3irVWf^Kc^xkqw$9eppnJ;}&JZpbnncV|EpdAcF8ALSupO60!~kc_Mo
zjFd-G4IdfEJ$dVnnNdYKfXIx5*pjYKP!274g86E<l65}KkgsRpCccGovFypCYlv)%
zaXr55MWDsKD0JF|ln_~39C$mm{9`EJQV;2`Dfsd#u+*nVvUaoOcxVDGHv`%MZErv+
z+TpF;N8<=5C1=BC!k`n6Rl&Elg~dWk5qe&PLKsIi1;1zbR3wck{g0nz>F(gC6zo6X
zmcgl-?NZSmN;D+<l&4zm1sR~MO|Gv+A4>+8g2CqRF=X1*MV%T;{YjJ<o{iv18N{8N
z)MTg^RT~b!c&bYVRRqtFK@Wo6Wv~Q6K5~t`6A<KkzX+Bh*h>a+=sdNL3|1g`xeQh#
z$h{v`TV5j=nmRznR>;^u8LN}AK{EE3jEVDw+VYh$Chos#%U8+R5SeqejEQBkwtT&e
z@mde+Ym~9OWNe3wO_#BqGB!-c3>o7A2b7Z?pL#830K^W-v`I4Un2e2*F$dWgOZCW@
zTvetHm9cc0=995Z8MEqh%a|(DvSsW%Ss!od0jJfzJQ=%_Ih&Vz5aYk*<uwS&)xz?9
z0HDAkiA<FR3i#2MSK}k!tH^EK(oP@!r}6bLFCAOj1nNI6|L^kSPUk})G5+2Ik1-Qq
z--r2k<^R)k?O2yX;R6-DmxJrQPIfsYxRdbS#9;}D)AOI=|NlEbcRE@V_}A=2ycKE>
zmmHJC-%kANZFb0yC&l`5ssh-PW_{DGZw9|@{P#Db|DpIA{mqamibDJOP1KZ7zjtgP
z)_dlKz3}D?C%xDO&s@NV2QkIq#?7}z@$;N@g6FE?EiSx?6oN*_*8HTl`X){miduqv
ztXLRX?+0&$tShfUy7AzlSNq;_?Y)5qb4ajXgXcDN98L@sX>a*8F{8nsm%9H|j2h8&
z&T*M`V~ijFiHQNPB&v_e4v+V@ZSQg3_G<6I(mPzgii4{5YoVRAO(m#KOrg`;KRBX2
z96*XOay2kpC*5|6vDqAm71V+YJSaZ*IGC=i+lq}DWNztGhc~~zhINLC#>hoU@TP!{
z25iD)`@<(kDiL0t!Ez+@9{fNk;?3_I!ZE+p3?Rf|>9qlU`c79%dVIVf>8GAB>BE9f
z+%22o!kGi&fMXBkL5s<B{RR~mC%WVMA-3%hUOPI)yJ8&9eTr}@!siO~v8PK>YI{))
zbWPg3lmI`TKyj-Z`NJABZkaQMHv^DkBl-$hQ!r)4Jcz3svaTQPAMPJ@B^`YN(7*qc
zS$OoBfN}wtF{cc#Q_raq4_(D72$Os<7CeV@Ae6Ue2c8m#QTwG)1(5B6Sc)XLWY((M
z)8vUime#CJyTKLEdx4K?Z0K)nLlWhFM!AhafojUEd9(1y7H*29&>*grJ*7lAB`NFH
zu=_T!ulb$}j<q7%x)W8x-i}@EdjsCQBDPU$KK$3v1YELZd!x+d*PdL7V(?eGl}J8A
z;Z4-Q@Mn#{N7V(D0nKQ4hhK>XnArXTe;o<iP2rS<tQxqUXpXWH{zIpV%8ZMSL5BWj
z-A@;!w9iP2AQ1gt7R2GKZxQY<9i^RRh{rf(4;Sn{4+7EjX|jJ>@SHTi7D`8Z-yzKT
zJsw@4V1zO$5aw4W;MHz4uST1(*DG1SIIFX|-jW5!#>pTLoyZP1p8v<MI`N+XS)CXi
z49$h+QCN!gtj^|H#2P!}UmWAHtNUZ#R$~Qu_-veob{kdCisUC`vLchOX7a5}9*bl{
z!Jkv~69(|lP#GoY_k{84%Ti(E=VYM{^zY?7Kg0csy#W3U3r)o%VQT!b1sK-httIhy
zi(2*@e|sjrK2+AdFIULot~%C3+DYuZl1ncD5#rHSk`TPK^+Ae+s{f0<2q>P9IK(Dt
zdncL;|2vKkZ#>0y5!YYx2|88#kywNtU6jev-Ego8w!HBXxaQYWvT$e;`_Z@!xdi+#
z%r;WUY4kUI=PtjK>DakITYt-q>i~iII~I0p8OkVv3-SZncD3&ts`j0lJThC2zKq*d
z*?6@?ch%%OLOAe)lhyEbV;^Cnn<oULRj63JgoZvFEjwiflr8$~R(v+noG}{EE+k(i
zlZVOVyO=zH$t#(Rbx?LMhhvQPbLjjAY+N`DO|T`k5@0oKV8wjQwIHXy6iGtu8YYXO
zDd$D@teB7;JX?+ZW)dtw_;mAt70oZnnYabjelF^}`c1fZLDgVZOC&~Ll#lC6IZcU2
zbeFoo*ie_24DucQqUskJAFpCvdqRiAWTAaKakBXeKy7`57X$Gym0vqyy%mW00^)`)
z+7(JuwWG$Izf<RyLZSbHRS|#vrC2XYFUI|jqaS#~`#a-;RIeO=eo>}!*W*aMJ~q&W
zI~id!$*)~ltd+U^&BM|`v;*Hv>+80@+5A>tMql?yby}0!cf0ERq@|0szMR&itnI;T
z|6$YVT`{&(&h1|pJNFlE_w~6F3hp2_wsQQ=qI9^iGr{E?F7xn$W&mprOq5g=nf}-?
zfK#$s214!v`XZzZ%u-{Ea*FeR324Xt$}qfi_?6S>izcEw#;LK{K()n9hyAD)Ri7;8
zE!<ZMp~Az(&KYjXZ+I&Xr|p&tG4bxAq!;=$2l{d^l!8AtIj7})`@VesCracTvMv9Y
zN+0h#qB|YMeSaZ7zjiZbuOgy{fa2!DFic>Sc@L6?xmk0|y%K+5@H9+>bVoyiA<BC~
z2aEg8NDm}WN3&U66hp_%AQ}s6MY<V)m<xH(&)DA^PCG0N;bMeG`{;M*V~_IiHr2UJ
zRh~1|*pfrWCqi5rgSTKu08e@1uwM9JCYG0~hMN>cu43#H`n9>4=5M%26M7r`N2O4?
zU{|2;AvM`zzWFw?fM0fcyR>yk%iSa1BQDl{G5;j8Mko#r`<XPn>?%bu9nWnn%*GM&
zZ~WT9K=OQW<y&Krq*K+BgLmSI($Fltd6=a-jpjlZk+9cs@FX2?J=(YExSuUXSG3jM
z59dRo!S3`bVA4Ne@V2g$o#Z(%5c0Q$veDV%wM4$KNfQq?!gfwYxW1iS%v>$Y4gF~p
zi=9Ci2Gst=u+T7A-@s?%IMin>{wp|@V4vd(MK)~ExQ<ly&eR1-hdJUKPz>wUt3N_5
zz;X<qjnjx_5V6R4lDZQ}JbWP$^qjiBQFXcU(~dHO)W5HQmzY9|A}@z#<nB2#)Rh$K
zt`Efltj@u%aCZEQe8CYPOcGMC>7PLLRiI|W8AuCg@8MCvM>pgBhTJ`Qn}hEbMH)q+
z(5uLH5*`@wcA(7m@RpV}cv4fvP7@9T@pg_;4jGIzYFk22sCeepC93YCJk-RE{D&G{
zO~Hs>i9NX`ZetW@H0T5LT(gmTDI##Ch?kP|beNsNEF959wskmWC{k2l7S`9dMzW|x
zDcWsbg%Fq}<q7P{!kZWi`{=2UU);;loVpi(+2H2Xs1-tUJq|tf4n((<G{Dq!7=Oi|
z+{T;mzM-=AMyIm2b7WU=1~$%|I}uMpWP%+@Mr5QNNkQZ~MAX>zsUmAC09S~9A{1{T
z5PFujz4ibqIFx&+>6^^lLy=vf{c(C>&c|hgbWO*jfWM$Y)0^cN<+z54=Mk%oaO>sD
z(B|oy%)%v3Je|vpDBc#FCeuO}snakA4t&>rjTdWzlf6<Lj)k)^G3H>Q62`0RxLFfE
ze)&RA7_VK;QKvPlwL`WsugE9>`al6tYq!_r;d(iCO5|IoEN))$6h}SeQhIbW<PguF
zio|pzZg2qEMsAbVR}4a84gMH6B7t<(4iR**t_6?EoL9wju3}E&Z)+Unly57(X}Pzt
z`@vc4HOz@LH|XNd)D~x@w7A=fU^aH#ImPeX7RYZ|F#7sf)|De;{rc<31)m#s3<7=e
z7UDO?kADG0aA(4S6?#p~EyfFff`c<JMTl_l4KxVzz|LRI1F*eYKJzQScUwLde30|2
zcWkk?6=c23fmqGON;_k&Jhw3b&mEmYxTiG4sVqO#3D)=8qEx^3Moew3`3azp0jfFf
z^kU}HepDXXjBJq$;RT4`F_g8CT78_Gk1xBGb(3?-nqGC4!KGZHyn+$vQP%CD%@et)
zGklV}{Q2)FcfErW0lX^JcPD*xv6MgX90=}WDtB$<Vk^4Guk8)>@P>ct;#D4M#y1H=
z6>jq)Wo@f})=}6i(wgD3)R^%DSt&l=$gAD%LWdch{tWi<Y3GbAKJSdnF36=soM=L`
zClf^DGlZkir>Q-CS_!muMRq_d#i=NKJTC1qs8b}ahvkK=6<zUB){aZTbHX)Cc*MB~
zMB;96uxrhdR7AH!Vz4-Y?x<UVtg5y`eDq>y_7!!6=*7?}E5s65FGkO;SSg`y1Xsym
zHiGN|<jp~lO++vc_Lz!jBcighy$C7m>WHhX=@sx<1OfSd8-zi<?g{36MH63DuUm<z
zs=T6VGNjjuiUmNDP$#Mv0EYBB(m({_yRPmfM6D_rM3rzD*boK*X>5Zq2*~C(2!nuZ
zZG$if$o4h}gP8Gg12(pL2f~n#VE?#&QnkA$pyR~*F4|qC3~Dc|;HP%8;8^|#p*^Zr
zQHm>SS>;%R3=t2$;Vn>hQFv>0!ibS}$+&D=Y=_ulJ4tY9Y!;UIQgDw#WFWScSRdOW
zi<`hr`#Mo#!=tdQv-Lg9is6XH>E-C)nwX;kBgC(LYkmWL8c$CUqWjs3|5rjJWT?av
zBPloUNml=dawEltLa-9$^}4?h3u63A31W=$qt`uarHSu4Ax)OJP@K@sFW_TA7zE_S
zHVA`&tZjoZ2nhStDrE`c#x@9pr-+LZ`B`>>kJ9mfkQejScz*QL5bWq>v!hM|%ExPg
zM1^C=O~tkB4faxO;2+>qQTx7+vm4M_N0qzQ5$t@6C!ZmHDy%45cth8kbAZUQ$9?+U
zW04iln1#AF-^Cy%SEzct3~32)xG7uB--{PkQApJ`3Td|`{qAxU@Zkz=asJi?m-uvl
zMzQv3ao^3w`L8U@D0Utyb{YZgt{P;*ry3t?aD;D9=^l!pV5T2OX2T0nW$~;=GIOZ*
zl7m#3(*VPKHZr!D?X5<GZ_E}A{usI7yZQtEf5o5wnsOI)qUwBKGF_`qZ0a>;Ergrn
z%BPFQ;j(G_cH&tkyPeG*HU9%8ay?4ey=1p@Bik9!hi9^#?qY3!ao?uE;OpK0dn1>k
zk;{EBa782UNNnUivXNzgHMl^(;e#6oPKNhrbi>xW`u9lS#U0~vnXm~7Mk}CLr6`d;
zpiwa60umb=;Sr2TM}*^dSU+d*s(|x*zwY~uo0D}W2b`);%E}D7ROMA}u4b-B)p*BZ
z%R<c$&YJ%O{($o<zdor4iXgq^lM%7N05`4AOrQ3?xE#`cax>~c8dvk}r?ub%XvdjA
zM?#n2D`(hcm8=2R75d^AFMhgIS#}HJq;?3X?F(wXpf<xMHrN$2WTvu%ankM8Z*-eu
z;2y(*?KikDI;m5J=@ZdFkBt9~#;=bE8gbP)aq12J0W{tU-))`u#$wt_ML7B<o}>Oj
zS|xarnydcsPn}^fxfc8mC&YS)t3maD9>VudU|*vzXpHNWzVOe=f~y6K>YuUFKYN_%
zp^LCmD@wtiajE!I+$n50xu3dB%vX@hdKV;1`a$-igs|dw10}2k7fb_$+DwCro~l-k
zS$RT^rouvS2efJ|NVjGtOd)j%`0lsyt+4RH8u$T0fh4?*=uvlj^zBe<<rVha+`bl!
zOFrCs99Gy6ND<AkC|4Pn;#>i3NLG>d9nPDG{Z>50b-?J1P7tpgl+_7omj>hwKcKxd
zgv@JD*3w6`5B=6}n$Tna%ea8HZH#y!oSaH96C+v2Kz(jw%zKO*)64#h7+mb0^&SKQ
zSj=X^qp_WLKOjWuE!mjjsDEMaD);^ssQk|6K>p&abY+=}82mN`;0(l#1}!|M()^_7
z5aRzOj<V(j`W`n9lBc|&w$6Cr5n=xZ-^5Bmzef-gcQGo_Kf)lxPBm#x=$^8=Vk~Ya
z;-)fA7(I?G#d=;bpFu4I2mE1hA#y9BT9a4Xp=xib;&(!f8>xCBOpgZgmpFp=;Vd6d
zwEpQap)!`DXret&)F!G8|Lh7*4gcJ2Bh5<~t3#aUz8r2!%Eh51vq;;=1Az@_0$ao1
zeu*@~>mbCB-U#?OygV`V9ewB8cAov%MO6dpYr|@u$Lu1y%;VSqavfsxrsZksSu_Gq
z^?|Jm0|}zo=}`;!JP_7ithEU+cuOJ9<*;-sa#Sp`@eeZUGM@$^!GDVG<8QQZ&Tbon
z#$6zu1MsiR9%e@_z>x?mTMB?;C>j%Gw&*+(yf%_0X7#oAWUWCCW$lYuVoqPX)0XGq
zBHLSbG!Icv%}L02e}wuuHx5KGAz`Xgv{M}nQBjtkjU=A$5Z0>JFUzZaP^=xo3kA9O
zag;BOE{7rgAD{~p81m!8l9^MjG0EoRB;hGzGR~WJd_i7&T$*=LGT^asYbT`=35ezf
z6kjl_#QX`V@d1}^>^p?a7;x$4NF*4~KZNDyiUKS@m!cEvS3_|%yo*1^?s&q2c*09e
zXh6a#{&;&mNB0yR^X003PQoDdWlaz}eo7=6Vu%^Ef({=wd3cULrVdf_o0R3eZjVRz
zl5m{-TCTMm_209ur%+e45${VxpQ5o#f1Vbm`a;mPJ<M}6g#3b!w`PgsN<0z<P$2fy
z=YVWT$DfTj6$M2g9)TQ3NvE{%{nhQBR=}rKqg;*~2k?O(!Smfb&>lRG9y%d&`fwMY
zpH0W_8TE8fGvpo-PhJ@-K$>;w1m$|MT+iV7c&?}?HI1@vI2<0bTn}8M^<`z)1+Paz
zElhQca+k8)#iHEB|EAnIqTD^Q+?6Z`H#z9U5fE8Vrchn!c0FG{$a?Bz{(R=o3HC((
z9MLWi7;o5lg1}7CE^KH169v(-$54`*Z$ez5X@(N*fzH8nQ{G;mDfKg)-kM*)$G?mE
ze!<Uiye~snhR)l_j;KEeLdH4s%?IR=U5-vLJ|!1*$Iv6bQYY5JRLOV*r__NbQV|5r
zPP;joq-t<sxe~5rrsTp>UcfPNS-G`td-yPFaBNiYN35SPa%)~Xn?m3Q$wH^?+8z-A
zM`*v90toX-!hVFL3IC}iOkDC-V__jel%6t8XINDC2F6TToh;YMYS791MT4SO3JoC2
zsT-~w^Sk0f1FuA>w!-(Lu$X@W`qB!0cvc|x9G58ALWb`iy`KiZZ_D}gGtwV3((l}k
zsci5<KO8dGjEv2>+JUJxZQ~FW5k46_<@Sv+m2BZ$^s3RPPR>OiG|)d8e!bQB;cF<J
zJTx}+wWt^9hOpgA<RR#By5l3riKfZcZoCrB-5x$bP?`2%ywM*ZGwyI2Pv3{SnhQ&r
z-auZnjyl%y4pm7R>TfvH0^d&XCV;(sqRG*sig^K!_95uRoP~|W&I5RxD#z~KYr(@r
zF~Nn=X5(of#9Z@Re{47&iQadzI5s_H2wwTbW8<M0X+>gFOJ9WD3;0F_Ta4s`f*V7W
z=p=MTfC(*+ahg02_%Zawg-|d1Nl)f9HgZHP=pKT74>oT*stagUr2%bGIpW~@buF*~
z_-i0oXaAxsn~UaPhpwJNp~4RMg8aaYyvH0PQfz_*KD<rRG{mR`8~pjrO7tc40+F};
z3H>X6T1mR%Fx>|$^r2bkLM8eqAl3_e#!8Nbk0&p@J-jH>89X~&I0Od@`6ETJ@#Og*
z43TO_(2MOqXwnBcP=&3feT%muhG3>P{&hr97JNlKyTYH5;zJfT28VuYR?DN5Gi|RH
z%t|wczzB{u;-$j0;4`_6Ee{F%G)Y;u2%Ku5o5}d^uY{Sg5CF6$aw8LPJ;7nzFB5JC
zpw0deuJuek^`5j|JoXofa>Pb=X(zP9a^D9Q$-<ko-K|;MvN4G8dpU91YJik^mB>y8
zK(h9U*rD4Y#;hf;Oka(3eQ3{^dNll#bHTe|BMCP3g4Zc$4QWU-j+kHq5ac%6e5=oc
zEH;1`hjIJ8f<sm{vAP`qw)ete-qp&pumPEkByL3J$S?mgO0h<fJfgF_aqx<jHrH?|
zN~XozB-#_b-vVhLusuAP+q@ZE!;LaC?MJDP@Ut?QhR`kCAb9j1aduR=R+Z>0Xujbi
zD6fkJqKPJ#hiPaj)-nW$aUP%UUB-6?+9~Yo$C<qw&>J5EhU_Z<2;b4On-X~#A+uSO
zu0aOtm=E_)u~Tr1s!u^+Pw;n?$Iv8Ix2A?MFhKS~;>6g*xyU4lUSWm7tFIVZ=R;Fe
z6B*dx5?#<HADASO;}fQ!Yp|bgXW6h8;;?ZLO4UDrP{Wh>V~j$p+sd+k6ZU7NsDVx;
zasoY}4<7=|XF`BsHVlUz_zFNToSTplB{CP0Vtt7V)^_k>ta#Nx{#PNF`4qr(`07LP
zn}bH^2RZo<O&4W;0x{vAl9lL51n?GLIam?u(K3j1p#4VO-4vvQ!QQIYawN>YuTk~c
zIYB&~I@qXUA~MaEnL>N~u_z^tQ!ut;w|ezC@UhSOcs*bN=V!!oBgW;C!b3Ik_ojeE
z9lYom&J|=6g}!J7x3iU&UZS7*s|)8qRUH|gR};_|<^;bnoXAG~XkwERUX2!F2HMcG
zSkz-n58bF>jh&U^%}>daZ3+yYjx9ed*}gQkYHZ7%;1axACVt2juOpXI22zc`BZ+S%
z3r_z9NXf%HIBnjC6tCcW=uTX9x0xM%5b}f)C3t<E2+D~dyhO#OcTow-J3=MQYVxu-
z+GQBSk-<#Efbi<$7GtOVChw7=>YCu)z%jvG3^=>RuMJmCK12aSD{oazX!<Ho2#dpS
zjV>r{s}cLBGqy0{&<ZjH%5?(AT4T#c;4jHC-bX^qA2yt%#L@n*Z=l5Oq{MwhTJ=zl
zQK%!&O5<5(eY{Nu$&zkx1VJ0uuqiwr7~fn1ep<V&!A{|&naRQA!&~a~;qHVCly^C_
zW<tV31HvaW7ZxFlb_8OJU56U+zZ1U`xD$KODL=Ze!>$xYNZWZjxgXa9_f<rbT{ayJ
z)E>r3+>dDww_<Vsu2nyN4HWrFr97Dpt6ar=hE*WIc$+4?)Qy>^hl&>kRc*X0n1>K%
z5<W}H$7sf5m5c`kwefCz;gJ}hjW4Xr@j2M5#}2_T{C`Lgj-xo~x|&&rqCAy@FJHA$
zwNaV6+EW{!p_gPK;?`9+3L^)Qjmk!@fe2rQ?;w2p;hTqVe|)dS7x_E`5FS#d4ZAL0
zk=-9H%Nuyc)%gB1^1@tzzHdk&V7~;+0HCeQM1P70{iT24)cy>gbOyVbJ)q8Hy18co
zg7F@=`%{Tr4oxEYnJq%#A9xy^BDi`)aJ7f3fq&z{Q9g<cUUGKU!AlK1)xk?_=imz#
zfDJl$iIXq*f|n(E;p>CW^+0TiL!1DC{!zd;qFM0gjn7o%@#*~WZe_VRACW&kTUpL=
ztLljqDC@@Kv7r)l%XoB4Nq2pGhK8O2Jr+4yNl#J(qCgAwq>ynSGG^mD2;a-_&BM1J
zzSrX0A7AtcduRN0_zo~tvR?E>87_03RxV}F3>V2}FXnfHP-Bn;qyx~#YoYge`(oNR
z)?(8wR1(kGNY3v@NEi_HRu=^HnG=)<6(JuWk6h1m{6K`VPK7)*<!@W8mW6+64W8HV
z8`j#m-=fmZC5~lp(f`TGPE5>i{En9y#3YQp{=x7uRc*EWO0krKz=3mjUvyIYZu7@d
zu!E1D?kXM@(MF)dRdo0Wbhrw9c<mY@k1sl0MTd_-hkMZBLvt`{02dpnpg_`1pNOQ}
z18(ogH<#v>39He^K5s{1zcvb$Xm2KyN+o<Af@0ok`XZIY;l(}Oh2P20x(a$KU3vwm
ztxVS|aLnlrP*9nvS7hj(p4tfP1mj)PUy)|nV}dWs7L)O?vA0?V$|J&}@KHaS&mi2U
ze?<Nx7*Fl;UkLJ$wMJ$|xrQF>k^cJxcox7?QZA5y3GsYXRKc$1yLWQ=hjQj%kkTeI
z_&w88<R$2lvhsa95!r;=goxbpD-kIYB65xtktg@I6A|e1cHIBxjcxMrhLn%y)5r&&
zN4G?TucSjZG?ib-2V}&02_0Yb0%SyoY~bu3UQ-teAw04gR@YXyPzG&sx&aKt@E_q)
zmUm$j@<+fi#RoeOf=c*NhM*E!WC$u@zYOIl%eh_`t(WJiI6!PcyG9DyNie*9Q@4zd
zH&u!9n3pAJ?;r@d#hqzLTEO{*II}p^r4^;n$iks1d@{8n+*cp!#_=h9vbCZNoPog!
zHAHf>qMl|Z+G5SGa@=)Vc#6FI4z-w7tX0U<U#m_@zXlk@&lgF3a^Pb`eaJ4Q=zT;X
zZCA5AX6wQ+ww*gfF0Z-^bGJZ^6;|W?rjRR|a_LxN!o<Wm&Amp748I5S7Q@s-J3ua%
z775%f=7xsf!nzm^&epF+NZPY^*0xt@9*3pLaDuHh*b|Nc4C~<V@X1a%rE{`#@Lai^
zxfD3j=jrR&$+A8*{98w`dvjqHK|-~rGr?gjS}Ir(`n=_J(O5bci~}FRIgdcg`?mct
zfukTaUaf7WQOYxt)_B%&Y!W9AK~9zqM^^s!s;_Y*3!mSpvyKRp67~p8{%g`jyXCN0
z2K<(Ohn;m)a``p^Y%$wLBj_XIDqb)guj-F*9fu<l#0q(l8-QF*q_e(M%<PA^KrrG7
zfuwX)lK)1?5I-%zU**xe;{EJCYHVn_)lc|o)dsdGNsT>P$AO>}ZYE#QKP4Lsb_p%e
z`q$VcAL5VEvNW+v>PR2XlP#}7E~{KS`rGdRNka~YNKi{4_BU3Vy9ehEOZD`@B`L~X
zp8}vSso?U28=6je0A5>Cq0VZRd~8lP4x)B3h0~uI#`VG2gmfI+(Z^NrP`f^^R3DLo
z1E2V{cu_=usB0b2inmX-IuS%3=w_&pqSEjZx3fMQ>A}=`4?YdR=`ik=Rlu#s{P;~m
z{8hDQR^ZbtmUFcTiJxF8!qYg_EQ7qO@lm2zK)AyC69`*=2rSxYVz=3&+FN{wRg#Ad
zAs9HZNiK})qEbk3o^wGV<}F-DJt!87@}VAcEU?=0hF^LQy)W+&ir*#>>sMpYhaB0v
zTVn7Jw5-@L)PsJz9#qu-z<zThYFu?Eyw@UOLOj9Ag!7Ql)@A5VB_iG@6sLIcLh&2O
zjt*w~@$4C_wB_Ur<dNp@HjxNL95;Po*dqF$8ou%M0k8%~>Z(gm*Lvu@r!dN;t7+Q!
z6k$h?f^7`!G=?)^MC-7)q%o{}vb6F25P{COjcMXU*974pcm#b0%qsjguF#+4T$%KN
zH3k#%&0E%%FSy&hSTMc@ZRB_mdM#1^h;cdZG`zW0@a8+gn?w^5<{_y64~$s-G2n>X
zvCvqspSNOAQ*~MThrO^4xdQslE@9L9^WRpM*9*w_bbtOXW%=_WG74u0@VkhA5s_gy
z46##L{wN}<ekU%?zOO95TSP|TLM^f_K}7GNrR(EyFlz!%XqBYltW~;C^T6s&5oT_t
zKE9t;?Z)0JEMIXSG|um`Xd55p^M{h>_r5PClAJca%KjNt)0RK@j>&X65lxl__-izB
zUf}^aDu4L|HkGm(yN|jgcvee@_3M5d<Ay$dIXD*QB~k*=j4e8TCE(BkpQVt+S}isy
zH=R0F4062chjpEh<-sNHs<8mC1WL-{crqN%Z`kvi)Zg3RYnw!*@_rEzyKfS(hN^T=
z27Ys7;j;}rfzgPGf-T$h!fJR!uZkPWGmvN-%6r?Y57o9P)_kf@%%Q&lu9w10oLZ{H
zqexBg>O%FuQuV3YcQcp3$;oCpS$7Vrx>!_Y-UvY3@W%eVJRvRjpK8D6uny?!_-VHd
zRgIZLj&wX6?}kI@5-2($)|X-B9MG#X1A4g|Kd=C;Tb|<$|KbYH=jnu75lmGg|G?e{
zLf!F0oeMI(*z1Frug)90C+h-yG3Olbq6}+NAJbE!rO-j)V`t-4D^%du@oQrc=sOV}
z85>*R@DIi+cX=;VS)6=lcEEW|cxN@yJ*)|*w6S3M8>qKyJJ+tQC>Cj}&8rM+j8~@>
zme{^|RhwPTS2OUFYn^I^;&!l|+QbS=wQGfA$%$ZAHTHG}T4&Mj;m%I&Rx&MNb4S`e
zB>zgJ`><HRt5z9g5jbUj01<|KlAB5EQ&Cch&PLbJNW`hdqsD{ZB7L3OeIs`y%4&b=
zQx{BwCEeqNG`vO)nzS(`;#pG5&I=z?l*sGA89sK77i(c9au+gTGY2pJJRttZlQDYQ
zHsKM8zN|##A$i>3<~=NNcptw%fbw#j{rI-^bDt*Hkfc)|M%xP3P=*rW@{kUq)@m{P
z(j|vA8QkQuBb3NYWDp&s9ph%U+d4%6+g0Sm9SS%BYtS%E#XL_i9r<yd08c|I%Z?L@
zd~VUZK6u_(NJMyTN8HF5i2d%bu%(m1GX;;|&Y>pH)~+Tk*~a(<^!BC%(d4mNI6m~Q
z68Yo=a_Ngy<2<CHyH!zpvydDH8@l6<aRRTew#=g5u=}CgH|&R!?i*Z4FRMM?2UjlW
z?=1@-@9{j|a{U*=xG!Iwf&;BhI8zl%K|ZndF8UvDsw+|cY?_$^0?O))i8W{*gd)1*
z7n{ZZK#Hxuu>m6PSQu9=68VB3nVVVAPS4#XtJ)mioM!R`B{|_2fo`#)G5Ls?(F1L4
zxQGqv7f;|ZM!({FUp^vn9ut*#;$=v*<Q4Xtc>rgNq@EE-6FhKU%=4|nh~vx`R8{>s
zihXzqJz?X~jkHZitKp>{2j1o%d}ns(d=)=Ja7GJ{eEN`#Uu(ET)t5qfwT8Zz7o1kS
zMeS*i967Jb7+gR(xGI7E(1%k&o@E3;83H?Peqh0Yny}`MU!lRzHRBf_gJT2wv<X<0
z1@Sylk?PZDm-zIMyQVtT87i|Csuo@a+EpzXN)&rn(=eUQh9x)=3q~kay|5f#w_Z3_
zD?|koJuQy|1|erUi<BT4(up6))^M2&C=!dcyiT|9$02Kkh?;_aZ)`lCPcl`$tMxxC
zS@|@)8I|!sAeQm~_Q(9r9l0+LZOz!$SOmwVE()2GsKO~##+036y4=NKN^vws0bow0
zMvwD@_P05n0xI}@sy_~FXU8cK+_J#nYpB7;AuR^WaIsz<qbVSm&Yx#xZx$!m#0!E}
zvo>?i9O=PcPA&3tmc3BFy5>7Kn0gbqv{S1D=Wc)zHpXMEyR;8@k{$OWZbGi+;du}l
zWInD9N5(}ca;#++*MqWs^WGGaksyDxb)-*hw3XI?DFo;LteCw%yGX3h+~Jd{p}yMA
z@V+y;4bS824s-^~^`;0)zIGOcTRsh+ObIC>_tBk~i2N;YG-ML}7jKY|mc}}3wv_h|
zaS3`QQlm%kLJ0TG9QfVQlNblWZ@>fchoJbe76#}cP7(4qYQ*~!kQS~}@PZwl8$-$P
zA~$~E<SVKjFk&x`yaH(4j7=vvg>YF82F_DNcA{%AEqo#w=a!WySuXZGk7DJpAWd%L
zDa)S&OZ6(Oe^F)ztHt@2bg`E4ai3Dh1G;5Z97Rf$3oB6Nf&_^9JUkd7ljNMh6yJyd
zX!7x=An|+Lm(wJ{TjY2x?>6h2xr$R(wOdyrU&83ELDUgG*;R=gqo9fn#iw6~z=U_S
zwqW4Obj(b%c5zV_(4S4`3W5)TnLnb0kXz$0NJG<2o~NZgmQ>P5h(=@|-R=NhCHjZ9
z23(9FcD9AZ(`Mkb(f?_NMZY;%po{<&`Q8(R@<CHHIi4A3D3E4+JHRgD5=E%L@S{qc
zY=T{|@>0UwTf{y(59#fy5Il{Dy~VRxeD!N=^vkX0yP{P!fH|b>KEjmdMj&l9Ie|3v
zW`4eqOeUGD+Vb1=DUnoUW}VA^X{+;Qt4{s^QG=*+2ymD;x0N?^*qNf+g#V@vS}vy@
zJwmZ`N}%WeqwY=MqpYsS@5us05;9T2Qbirxs6hb(A|?WwA(`YEm_THy)GdT8B$~}+
zlHeXq0!$yGsaxr<wbEK!+FDCp3b<fcWO0pvid&_YpUxOmsuXY||L?i?d1fXHYTvf+
z`~K$xInQ&SyPkW_x#ymH@40dTc#fH!$`-cq+U3340Vhp-sYWU&BW;|2vQo@sBn-VI
z!;l(K*5gsxZr9%l1vSCzuF-gzN7S;8&^(%9UFsSNNKn`muln8AN4er#RMJo3XT&QT
zw1V$mfstNntM;Xd1ZAjC2|hucgp?mfhZ0R8h4B%K=9aAZ7<Y>=)z1W#K=ipm;$!>W
z!4AiiSm#n>2rx!F))!f>(hXMW21loBSv;J*Yl*}*Zb6UH_v?(8SJniP`F=Sc14U$R
z@egARDq{y;RH=A2o6C$1Yam;|cRSnmQo5I|cJrZZq{9@u%0yr(0aXVU#$FiP=z2O$
z2%_fMFglS|^KBk;7jn4IpK8bebHg<0-iFuR2XTFbI<iC<o@%8alBSS{!^|B;+5W`9
zm7^pGLRV-qSRWho5<=eBK8k(1v<=ReeQa*?F6BN+_6bx_-*CGdxz@EcwOkmEw!35%
zDs!hlDKLMyyJdN5E#VyMeKOTW9_&79RhcNw5YnZg+EEllh0m*eIZVv1WR7C)HskQW
z&J?v}2z~3V*d!tW8%P|t-26er0+R@5>v%z2dp3P3s|niB#TJ#pDIMGou1&eDh^DeT
zJ;#~T$pUA*y3lMQ^91LTYpGGo;p6;iBKMt3L+X{KdznRWAzs7js{1X6^?#<S=7{(1
zaX4_en8<}msV#cat!8M>)+<TvZMkU~drUuZwkpNHU37vs@HU5)Mmn+ECGrX@ZQQgJ
z_hip-=hBZUiHRsW&vt*25qMVZlb0jk+*ky8<tdy_bK#O7W7ZaD+kM1$quyqC0-fH>
zPM>pHXUqHX4Sz6V{%IWAZJhRuG5M;Ie(ngpYNUG|iFM|2S1}RZ-f*8xhDQ*JBaxOH
z;}cjDPVvWsli@L4IhluZoY{wYad`qgIKXJz=xiG=rDb+Hm!_#=^HZs1ip0mC)jwo>
zx}Kg99F6q0Y>F`*fsMY*H=Ii@5lm>~W4>9vTlG_bn7+WyP#KIZDNqj~MIp74yD^v9
zB>96;;=nR<H^xOa=LqcyKeXK<5`#GIV{%gc(FE@c?1tvG{@9X<*xxMqw_Iyrp7hLx
zZ3K<2>j>1#yXT9Oa2UoCMNxdy;hF4l`4c@jg0T8E2NbvG4C(O%wz?0!<34SxCzD-_
zc+5br^aO59!F3n7)M$2RR&jseHueDos)j4gScm&!zEY_6IXzz;)ADmVB=jhi5qeY3
zr8g4dTq3(z#Km;07-L!v4>m`fa~I*QcS^Hm{_kx26_1RyJ`ND1%OSY593iOSCHqCj
z;cAhiaZG^Hd@xVCv+Zx_!eLr$^OIH)4SOi&LoT5M1Wf&0?s;q#Q_fW88#U&L8LG@v
z`4$?@AEb>r;^RA|9*Mkmgog9i9Ptbxq0dQSj@TiOAFIdT%Hv)h700N(#E7or%BISs
z=y}2sUMD<^6za6&gr_U*!|xW^9r}&R=tarsXLh8mj+;HcTrD?48Pr$_2j#&*q|le7
zo19IqZ}7n6o6%ro=t<hHYGD&qUm5CLdInJtk%G*G;O0w(Z$<P9@^G5X7V@4@98oMi
zS#%tU$}VasDmeU8@|Syhd65)pPUWvQBo1qoe)@eX6MS(qu?8fxr@trPACm9ZIDY{t
zz3i_RtGcdJK^0F@o6tLaTbJd=N_!n&*YCmx@^k{P!FKF7TD1E)s_aX3sW!{ycFsQy
zOS=PEmE|&GwqXDgL%lb!DfEPm)h$_rtdT4<>N7zW0~Xr><Jb=PWoEX^e++XQ!FdK!
zRgGmMc0-}gH8aLx@Wa*+m@_UsU^xH82+T;461tr1HIwbwB$@^}KYf}sbrY}1y^v3p
z#dum4n4f0#X+k)xWwG*Va2RcxYh(;-unfIOfNsC6py~F%4-$gyi>&t3W7pDIPp3**
zmr$0C*1wbV=`$tN9ToaQIKyYd87d#aQ^+u)a+F2vU&=jGw7wC`0^I=m#tbqLR(*tl
zLUo4B$NdTD8?i0<eYB0;mbQ^|6m5f4gJZ&}w61YXZ(ZZ8zPbjRzPGT#qI8WZ;k0NP
z4>MZA1QV5}@i!T{TW+)zjcImW`!b2GXbj#MMrgF$wG|EVRCW9XTG2S@5jEpBgnuvg
zGcxD9WEwu-6($-b{}KJ;saUj@Au5V__cr=PxVyZUj&U*`aKb8vF_}DR>U>vAyV5W4
z;-u6IBeE52B&!p&?i;m>kw~ATX%`cZrd>eK?3_w>D^ZW<PaK@0V0a=5#tKGE=aOYK
zNED2-iSJzcsd_`dsO6(vxZ9>LQxukHS)9Un{}2^6N8EZF_M{HswM4v5W%O1vipeA_
z+FO6jn-Nws@Oj%$&+sy=_0}^AZ9U@xB#PEE^!ANDdWLypA1&jL-k1Yu8Q#-2`z9|$
z%kTvjMrj$oxP?l~_@!tWr;@d$W#Hgrq(2^PA&$DxEqs}WeP|kjJ_9|&5Je*$grL#*
z&^2yN<ym8NyZ<;zCRfjh3lV2q4P7O)_08&rC?=wAT+&b7c&a_3ZWwX7uKvo#bu!MO
zY#iemK-Gvy2t(-`vIV)HzVYX<zOi+^d>&BW5cML{lP-PiNw@mAx4w~|dE-b+-^dT#
z2tB_JR<&M%wVcE*XR9y^8Mt(?BFFrgFO|-b@AQ0W=^PJIA*FA~bk@1#XCzYk#wzuI
zzOi&U;jIB$9(YzCed(`jbiY5KuJKodZ<rw4Y6N*VW{8PRG!5~Wt~3pE#FMIsGbDhK
z0)69t6)-}VnG8UI3SGn`P-z}h)mOP)ks9r{hps-F#cslF%|f&cC3wP`1?DrYTKt($
z=7?@HtYvJIN6|9O5s%4Zhn-d{93nhJnT))>)eSi#qtuNZJlN{SA839rdDmBxI+va-
zQ34<9q5bZ8mi)D}jhiSY^aX#$_t7&R{D4%w^$hWVAF3v9M9(ODl2`*0nAS6L<-4V4
zOqLe4KNV3kLKU`}@hYFzH4mU>oUs5Tu`4v*k7p}P?@A-kTE?Isp*(VCgc)pD$JlHm
zQgjT3#xzEFZqXg0RS6cg-#v_H=fg(koHTsGY-9C%4%<{REKOt3B=U5wnR5Yoil&i$
zL3q$`{z)wV?W1Bsg%qMSjq)cz$Q5BtL;RnIW`<RY!2F4-3d6!7EsLi>=6h`=LyeN5
zS41OFZI7rJmx_vYR$)&MgBl9PQhHD;7zZDZ;IlidVC;zsjbztH!Fcn^Xa%FgFmXf7
zV)#0l%NnK((oD%yGV@aECMrH|I?rqzp4l|K?)0X!4fED!A-aP`<}LED7B=b0a{gqC
zGkc4*KSKpE&fwQY&4;{!&lJot2Q&Nik1^V3rf`SV_|EY9%0|w(cG3aU4;!~^PzJZm
z&br{N_M{Dl+<VT3XEyu3xNgs59O_A+P-FBFW5bcS(6lRPNC(Gxzna6o3|9ZW=5_pM
zmsRFV^{iBW;EkKjR+rC=z;ot#e|yt~Bt}=}a0e@pIJ{y){6_Gv<e^k(otA6q+T%}U
zkpvZUgMW<IgaAHkOl3_#1}o>ZBj$N4$Oua3yaqXiej#<R=6&i62l|@w&mu0y{>k37
zIZrrJsB+7`G_RR%-1514bLPGwZdzobKxO|bOUk$t6N5J6tqd%pN#kW|pAU~hnH!A2
zCc~NgI%kQxN3otR>ruZaE@y~*nV&XZIjg<oJQg3voX>=uJl}{MAnKs2?S&_0jpDxZ
z%k;w2PPLB@14+Zh-k7(I(J0srtq7Br&1q4yQTh@8<lVcK`2g?v%<qiRpP1*}`36Xc
zc`10`<$^v5WnzLKu92as5QH}L&4CgW0d@bLRh?J6@6>przy4QjXx_jPS)~y-+smX=
z19!_xuz86;YE{>>O_nnAj6lP3d=z3z>@o8)j_F#(T>5gQKTf^7&Ec5HTnQyK$IM@j
zmjh?pETxeS;S6FLF6t$f*q6A0`*^iI7q@$Ad+wYRy|ZBsD}%B<ca95)V3~uBzaY(=
z!;aW=s?+lB5r&od4tL-OemuiGW3)GL>gZ7L*PImM9D-+=v+WcL^qP(HWn~GwL~e#V
zF?TVQY}<<tVVJ{?p^~VLQWLLvWm>*@hU^0|2ff}(xE5N>mhx8^F}s;6`C|5<MhY@O
ziukF&8f^^kjS^xg?&9H8lx+4%fCOLr6xsVHF;oHVd8e>HcN~+b{f2mE&q;M!{vA!U
zj27h`biWa^$+;$%Bbt9v19!|@APNb~Y_xQ>^G_SSG4C+hG*)<HHWRWkn1Q6rS@y?5
z72~PJ01g9K_cm+Cu-(qq(?u&V8*lKL-<Nx&Z>LV~gRQBU7ah&cwq}4A%bkX;sY=?k
zC*8posMQRRSe&~2g<kUnuQ`)Lj}wQo|G~NBAT9UCu|+0EzB^l95KOe}%Q8&(bS@2R
zd3V3@bvtmGdj_Vtyn(w^c`Vj@*$9$v;ySH8iLE9tId2tu<s7yyWrGB@oJEkA1K&y#
zdf7|yEE=O6^lC{_UxaA`uNi@P&B6OFCADmWnAglEFs1Ar5yLOea)WdDhR-E$pfy$W
z8*e}kWvENWx#WqAuq`T#(#g%;V_*)bf!{%8o`HCjmf7NIW&y8FP;O*;C`5aP^)wqM
zM$splC58WapLxGj){Xffo|BeEswYtAacSg@%T4pf4OZ47N?N5|8nUv}eTgNvVqSuA
zaNfUGc;`1t>pkD{`CdyCI7)-h!JA=_{8d7aIN~s3J~J}6X;1X-mPHvy@>wobr`+GC
z7Ai8z_p-CeOU|QUhTY1xRGBc4mob__ccXLZ0huyLo+f#=Pt2sl>(68H&wsqzY=VOt
zGZG&WLsiRrG5+&??ekU!kNaF|qidpaYLCy98gW2HI4&bmVNUoiP0%IzN?p68x>9kf
z+?vmqbtyU6G3r6m`u|~keR@?kgX}YGJ257E);11jr<~s@1>%nWJ~d=}R=KgV43|xA
z<R&~RcC-7Xc1J?8Q5Bz<skb=fJn9vS<CW0C?9K_sQO-48nXfgT#fs*d!(O(8c;hZK
z&ztj#%Q1SV3_w>%xwdR*oNq23m1BC4V@%*@3C2hPb*&&34qpcaj}YD6QnvWWIv1r|
z+v--L7O<rv<KRZxK7)2~gNjfXbM9PZD>wEE{YbvZ^L(?EUeSE1MJcKd?qMiUj{1uU
zy_o=b5*qWsoAF)3w~Alc*8Fw*nP)2riU7Q!jTxveqQS*U9*!n!&WG*79B*@_)SLsL
zZumrGg&dOSqDyDn9O{gy6p4upRtxdS;Edo&^J$qFnRk2Jr?8nv$yMi?+HrDV#rY>C
zC%thTvWR)r8#hTANYEI9e%5vH*|?2eF{9M37*j;|7htQ8M_;K=cRQUOIu?Sn^2ZC`
zT5(coaZ~1D=aQe$@#cAfoh}rT!yGXS-a!eHICLXlG?BT(M3yc@wtyJ=Lw5MX0{M^^
z{*V>^@JG@8#_>U~G{^rL2jQM&Af+cXkv~v<f-<dpO^aQvRr%fw%N{F8ADRtiE1g(K
z>83QDP}5Y;h+~$>jN~i3ZYPDSkRo;a1G_m5^CC&6oFiEFd^OtijCia~nEVI+(5}OF
z`X+i&bJjL#!qud=D}Ftg;h6#)p_(w3J`N{XJ&gnxkU(Q;U-(10d^j!q;lA*Pk@6vd
z4>sZE1U$<vygX`+GBzbo>3TekggrZj6+&}qaPT&$OgTIVFY=+E(3?s{vGtP`5Wf+4
zYMCr9n)C59Y)(-WBsZRj_mQm}i3&Wng3pP0eiRu)B5rM44WKxOs4GtbkrMCSpwyMN
z1a$1DBmr`=t%El&SJs+sQUW`XQ2gBMCz3)oiMFjGuzQqN`+moO&o(4{aGdL0`YT@0
z{ic$Y#6eN>1wLcHkt~GX14cyiYuFm>zF2E~uWPmJ$%p8Iwz(vbUVyHJBXoOA70js;
zD%6K5sQWbP?%LAUL`nw>^P+l~k4cTWer~NQ|4{JuGn7(f<s-gHS$ScT3oB$LC`nPe
zkusVq5jjJNNOo|_8k(ulDEh+##Ft%JroubB2;?Ze`G79zkJ4cC=2Y*7z3d`y>yTOm
z+ExMrPyL*~-REk2-6xt^%$EGj1I{HMlRY?=xN^s%j*eFt@jj)HjKg)w0Yyrq^IcQr
z<s1D;Fb^`Z73l|v-b}pU9R(V(?3B4%0>ocan@9yYls=D-R*!0&#k4F~e1xql^O^b0
z*Hw|Wm~%$q)@=}4TnbvBK?vU;Mw2ks&eOj^MrNCYJC|N0>W`)pvwa0Y94Sf@$Ioq9
zl2f)T&{iN3+jdKO9nmoHm(>P#o|-S8TA$(*<hm*beVPD2msqM&^(#{UY5u=*iXvB(
ztI@l}0|gqSN{;#{x$GxzsgbWe^%)|v@R^f(imh;3#kOBgD$6BV%ilrwJKmVLf*=2b
zN(b&Om&Abw763w>WFX_|!Dbmx8Ng=IO0!LxCu7ntm71V91LPGr{DTj2EL*P7erhpM
z=q#xbJA;}@ZJ0k%<5YWmv%y%^9?v;T)Tg7JztQ8Bl~a!SfFOi>yQOvs=297q+{bKY
zXbPxj8Z8y3HzYz%Kt*SbTvt%SaCTv|td)ugNlEq4iV@YM)O8g>!iEmf(M}}XydDjW
zDn2FDV-Y$#&ltIMNXz0Zh~YU@it%rT^+Ps)qKiGIlC%%U6ZLC1x|^TUT-kb#s2_s1
zGn5{p(B^AblE`Rp@1z(dAC8!dQ-gEp3yCVr&5-^wJ_>)5w^Y`=IOCX&iT6mKw7iP|
z`;Z6o?iGANi$<f6^7G?v8YvfQDaLcQt%kIyUCQ`3nH|8YD~ZC#RRS!k6?vxkb3(X1
zno+M7ijCQ1WZo;$olEY~Sd}dD+sB*=rP1iS<(tKn>Z%`O^c%qkXOX?y^0Beu5sDN3
z4j%Gp)_jgc62Pw96la^d48~No^=1zC<5ujk&YMY{xgW1-_@wwHsRRX2h-4I>6md7D
zaNTJ}zS)R+i%gQ!Ynn8d-76ReeXWHIBjFBKT%txFHPRU7YOOalH<P0}`rAHbYtM+)
zH!=RTk`R5&M$NqiWN5_Qn*~rL&i<V*oVTA!N4i_~(gXKO7Mk%;PQ2VS-ku7Xt3E~!
z#<72w-KTByB^zthI9nrk2gt+$Y<}iG=aTgru@Y-$`^2+-F~M*b*<w$eLXBoq75Bf*
zBrglMj}lM1Blxo!8n-WkTM6)GzUypTsT5^ZmzD(?M?$~m-P!gd{xViEL2r)!?ziON
zU1~64XnDVZp~czyAd%MXN9TC_bZV(p2sOT^(J}V?$i`PzM#zoc>s%w!NQgJ^(&*QE
z(>lBMgwU^IgRJzF)G;#hg<^PB_*Vmr^t(9=>Q`drm<@@yE7JcPi2sC+3jGP~N!xh>
zZzyVNeOPt;Q-T8T<O{h^t-VcC(^gKz|6sap2J!ut;b>XJUhm6PymRw+&FtY8A6bJc
z1G`%9wYV7{3YIL@!%OeB`2xbkvb)&S2h~=GT!@si4xc&o7C+?m5Y0m+2$hAA`jaqH
zm0q`#Dr#&W2`hX`VS8LY2n#56k2~ft)=JBK?SB-|Gh)N_<ez^CT9`#tYfzS<SoZrY
zhddBL_;~S;wHlx@WAiBEB9g%{Yv=cjxLfj&>oCMN6xzUpR&!6r@pn`wT}~<bm4bUz
zq3nSR$rZ08d?j?V>IBvQV);6Xs4L&6Dc})0QTfa=oH;u~??XQMW?72&mM<OfXQSG#
z^a3rC89kTqjfN()iY-?+n2$+MGmhDtU%5ksfY4BK(N$mg0Ixrj3bo%Wi0Xb?#<hX$
ztA@z%%)F6x6SRf(TnwG805!SlPHQ^z>uszZYXuR|?SI_9n)O^C`|7)S|AKw>mMyM<
z?5j5!LLiu3zqNfegN!2f)eA{)*(sFGb<_W^?5pWsI@^+umVNccTrC~{J^Sjp&wvE%
zs~6D)N3*Yf`m6t@ef3^ZQCp^dRqJqMIoo!kM~CeaqEw3)|K9dh_rGRe#m<_Joi!bp
z0nGRsOX~$EhApi!i5Sq*`nl3~Ml7Pb2pwez)s|MdTEfU2G)X=<vj>e+@K5u!t+lJ4
zt#zeRu?MoX{u6}QwpQD2imlaFdr^UHJF8WJu&p(2ej2(j5``tXDQZzEVr<oxR!puD
zW9!)i8e2z%$3JX~m=$r?i-?Z0x89Gyj<UDj#j9;~k*RS9?^uuq8*$iMv9&fSTWce>
z)+rMVF=t#r`@C_D*jhhPw$@`60dNlw%N7w^>jb1Xx)SRoW^IbN69A4BUjjfE&;?8b
zVzk1gVW5uw6?Y-iGHh#4FB|McY_Pa89*smZ0$6LL^eqz9asokK)0)7?;X%W)z{)Xo
zFY<)4wFUNM4{2=+tRF3sfe~F!SzuqzfqVK|V7HS4J=D(vdzQ5x6}G?LM`lJ#U;FE+
zN`Lxh`zwktrasvtAU4=<ZGYVc9fu7%!TmI#w>ihMX?`pFYre`$7E8tcI!wJq?5`*A
z{;%0zKS7iDkJw*3I6KnU{_2@VxAe2W-b|5LAy)||Iitn)RWZIYSfii!w!c<ZIvg3!
zwszGj%Oq$pxfSl;)_9gNdK)JGH1oXIIX;H5&Ir7ONj3P6TM>hn7cAfq-Mn$R7-jtQ
zvsnAY_zFFV{k1**6)9M8(ddoAdTOjpv5#jEYMEkhjyA;>!J!dTY)ieoMVVq-CAR_W
zvHwG;vd6wIb%1x92?*O@#Rq&GcG+*R#ZHGCqkT(EhZ_yJaki4SXg1L{+ELhOSvj?A
zw3d{xIreDw*=$&JAp7j~(vxh@5kEJ5ZL}8{ad^J5jI@0Wv^y`7zUXV99W4CT`^q(C
zpj|Eo+BXz=C~Ld$n;2<jBY^Omh%_}_JMaCc=y7eK-A@t9LMz*U*C{e|hjm|Np<Pc5
z{h^PA_JQz+tZ)itp<T`gOaJ>Bx~gTNJ-0_n8o)xkEZ0q6MlY#EEVQSEEwr@7y1Y+O
zo2I|f&niW_XT)jOpgYT6WL?uf_S!El6g+BsZ5EWH5~02dk@t*vfdNq2Yi~p4*6Abm
z+B6nMf=`g%ZiYDUvhB4C!Z?fAYg6Fl;Ezb4bBfq&w@FUdgg->=wTtD$d_H*1CsUiL
zUQS<o?c-U58XMk+%x_$6*=l_>Hu&yTOCRlJoL$Ap#sUzQS8al|47C_(Ct60@hHbK^
zrN31cpCCrqGCRCnDLN)5%ZO$69^U#}W~F}pEVEC_@Tn}b7de+c#>>$xvtQD7(HXJK
zUOYwXik4;edq1`3I#3w0c>v4o*;J?xH=v}|E<*N&EwhU#yuW4kpDEFn*}3Esw#;6I
zQYF)0Yt_1S2*o?s)FV8z5uW><OS8x^Vwio9=on_LX`f}bQhrXARd#xN{QpvY2lK(f
zVxeUXS}c>wlxmr0EK7oIq!mlAZKVBxq8OdUX7eu_X@3QM*xGp5Nc-Uh8ppkiw9Ai>
zJ@$>&e55q79`rZT&e2s_E3>}#;m=5$<N^*Rwq6Vkao4*d_S!#*s<8I9zh}rlu4l09
zwdX2jQe{7Yy%w~fDYa#gzq9Q{$-$oP_qNzR!l!79EpDe2En5~_k=896SyuheT52EY
zZ>g2-W@Q~=J8d4Vi`Z#@r}QE{5s$LdUTGOrjNS%XHHc|b)xR~4S-Jl|wcV=wuG!Bk
zT|9v8_E-caow8Vcj<VejR^iHQB=%de*xEK+?t1KHynP6LWc-_A2l!gMtyuY#-BxR5
z3XMlIW_+<<+ihP_82=`_t?=SE*lq8Jz`m{B_AG1vQJK(dl)YAOw^jziZ?M;XnF&(+
z+H3R9*Ie4$UYo0FN?F(jve*7&(l^*^#S3a*d#!S{Z+B{xy*5kuySKeos5Az1?RNGj
zhO~p{tO%DXODzUlVc;l(?RV))ZLs~R%2D^F`G7$*ZMTgw)QXTq2CU*+w`HuAD~N4l
z?UNb-^ZESE#@hQcB8UweYd<<qBes{Zwq2=Bs$$Am`(xgnZB6{eSj%j`D*AgrV{L4a
zXxgnmCDOWD(c~k>S~a*|Pp?GTwXxIAKq)px@9#~}qJ(RKCpOwMEF10J<QirEJA{&A
z?-SGufnQ^%{TwAB^fWqDZ#(Vd1S2N~w$nZ|5$)}GIx6_<AJYe|*iS9{?00$_XGP$L
zhS3n)I=d$<uGQjS@5V)}v-#RO`*7$Cgoelg?6bcsgr3&ZQnAlo9mZoH`|P=NoknoP
zKC2Y86Xk=b2wGF>Z=Vg7k$;}pXa7X=tbsauTxL)fQ|;f#=v$a-AC~Nf(G$v4`vebK
z->vKD)mJlmn`)=<DyG^WfqrGG6@}Ht+0jk4CtIf4b@XFMEbq!xyAQ<oGu3`iSO4ox
zwW4pc;;2lu-ys)W^)<JX`(2W|ZK{o0k5c|yovoX|aLdgJiO#mC6eF{nko!8!=4BF&
zUn%ZSef$r<*FW)Pb7)ZtE>SmpfJ?QF><&?BzGD<0WZu}wf2bX!#j$vsO2FX&_7m>s
z4Y>Kg4QpqV|5x@qrUX7QHU!D1t8tEGu;IOUBkp{2aDa;$bCZ_2;{n5#xd*X@FS#t>
z9&F~a?bDrrwK_USi*IlW@C)rkVB>AdML>u42=u6ayOsTP?6GB~k`r&zUbY#x+wF}s
zR%*psF}32pVJ6hqN9twZ0w)lQNt@EeO<7l;_G}2o=`?v_G*tN5k7vp(>O3^C!TFcY
z4WR^M!{1zTN-Qb^+ulX}AJX-Y)iqwJ>wlnKwdRg+{jL5Q(!0MRT@=-rKo@>N2I?<e
zzv0qfUEj99?0nGsHqu{K8&w`1I0Q2@jN+_>z^l%`?AY)T=*grznVajL$JQpaAOsNA
zUaP;3(=D|6D_*}v`s<N!f5~x8!<@zZ_m(hmW=W5^g&>2tl<IUY;d}wUJPsQ8;WOD5
zt!c^#(04ybXbH$-SJ-WrR0cUUbS)x_T@4$WuHmpSF0DJg8-gzHEeL=fN7EHkWphgt
z-Zd_v90>M<IA7+DMwTyx=-nIkB+#`vF`eknpXAWf)8e~Vi2PG~j1xBLPCRG1>O@n!
zSvgI;g{~uitTf2v6dh1OK!5&>Lj*#v^!Kqmaq~!;?Bk5|vj2*&<Ij)CUspB4pU0~G
z!SsjPAAB*qS&-sxS=J9X&7`Hk6D|B~axP^(mw@RB`GIG>8$JL>pDP?)<-X-Jg{2}k
zA*4J`q-M31bz@V(z;#nJ1WJVt-5cIzm+SCGE}-1*iFui7cH{)Os>p~B7zv>g3Q*&m
zjZYW32jBUT;8XeE(<psW2Z*gkWBe%{FhQd<2PDYmko}ln{U?i`F}At0ayK+Ij~SxM
zKXg6wAn3vNCwG+igO0J|pUreGI=+@KzT#)`HbNb>Nd15(woBvKU4m{(NOHElCP8c;
z@KA*f!B`&~ewVzg!UlVbUp6OpK+%x+*U4XzzT!ZxMXO%lnb98a<vymPOJDzdcOX4V
z1Peak8(|u6=EnMY-VJ|?_r*EM!)?X{Vz}VTE%H~O2w-mLbt?(%Hr+}D1EC&wO2aBU
zQ}J*3OD(^q1r)L0sXJn#eruz-mfOBo8ms!lSIn`);Slv4jjR)S1X(^<+}SEN7I*u!
z7-I#q(O6@0Zi?mdl|vlu{@5?QQ9_`&AC=`Gp6wy(F)7UyB+b?s8i@X7PkUTWV6Zz{
zMnvCv?=ydx5MhKHRi3a;=Ef$!pfZQ6Fw|JKyV3A&co%Gb$Bgj=E{%5wV%>q+2no=+
zY+4d<5O5e69bD!POiS)=)9Zd%LK~8~M<G=ayvPqrc6_>2(2291Qz$d|zxJC;-d?lb
zlpd-apZm*{BjHTeU^0xUvM~?Y=O3!5x|t*nQ#s|sv%o&)s&c~9%o;-!aZjZ9fP`bh
z2^+TNm`k^jirV>~2qzfT{et^q?LcK7HNaEKrJLXvf1>jBlNb^coWj+ni#17{W5<f@
z50LmC72gB?@HMI~rq^Cvv1<BH6_;uFWYWHA46{}FrqL&8q_)OZ_?1a#=cZmIJ+mab
zKB0TU{I6q0%GZAOTK3^BzQ;dXRfIw95?*(3ON8<o|4;vk&Nb66R9N)S4Rm6a*J9m}
z%Q)6do1nflyl3GB71Mu_nKiQe6_Nj{yzU)V`*p3lEsseq>-Ev7l=<v&>;9Qxo-gi_
zA;zK2*U1IAGSK0?MQ^iV!{eHCl)09}Y0ftJf^EeRPg-)81_!P}I@?0Bp_qIS#c7h!
zV9CfoS~AI!BxF*jGs$W|RS9R1*04$WE2cNnSw^6ciyAYHxTZ8SXM9>n7NjCy&TKqY
ze@Px0+RGPxg@?CI;Xd?+gq%uQ!Sk&Ux%ec4dPQfpf0@X+CThzi3oS>I{KumyFv^8J
ziE;c{q#`~Se)~Mx=CC<F$82H;c}=RpaRaGWPT)P;t*<)0BQjLqS**O%Fw`i=OUe&Q
zFpHHqSxgIT@E7L<7LT;<Eam`JPN0@s+{($4V+C8?8SsZ=t6N=DoD=w^6pq+KI;*2V
zZq^y(5L1AI`_ux})M&p&xP`|BoTLr7T_G8Ov@U*jE4uji!}J)KI_WnqN5uc^yuizx
zycKs=3?w-?*Y~M0;$>f;bNZo)FKBmx9Lilz{=Uh`Zg$!$H=*rrPH@IF6}Eg9<G;Wc
z*l5|oCt(}Mf!Pb<z%0j{M|K{B)Ew@}z(tz6ibvgB65bDNn34h)asJoIBv=KC>}1_r
zkuOg(+&O|}Ekb_QWhkm2wFWbja7KXNMLPLuVb9<s9sXl=evP&TzF<9*2AVSy+=1;a
zpB+Ebj8|>*-^|{S6v4oL?;(ci{ptkrZv~l|*(uIj+jwffqzC_6O{HA>?oa2IRGC>f
zzyp)*cFMKT>e939l)wxID14fz+gXGkt*Fw#cSspro`%gt$M1eo$<N#r&TfVAq1)Sd
zYrpoYc3nw0?Y%E5zDwGhtHYPl-lO-Yw`Ie3d-bWXa=1@req#0MWzwgU{^dSZ{SxWV
zx1~StJu|95p9}ZrJ^1k+s6WNOH|_glRQpuB%XIkNU)!HSF8lbm`%@;g|4M&8iQ(a!
z`|~%={o1SAbsOOW^=G3Fr$4=cE~W)2u7~PV$9JMB`LiuNCv7pD5MvUH@trZuK^pe4
zXQ@M-$$3@co#Z{VTh90Swj5RweOoz_8&okr_%u8pQtAq0kG(!G)6JHxY?j`F+n#Mk
zAa6fPBN@me=|6~Rc$;D({qz5I`u{e5{@eK*>v|bE{$}Izys%v^nf~A~+Ln>37iR?x
zbLM{iNY~8NeLG8c&5lnu{kQA;e|!F19m`#}G8tl@b^Ek0A?XyZNggu3)2nX5mBZoq
zSQ;GfZ3!|F!CRScNIV?Igr%$Dt+wrRoa#2R9P^R{PumV(dtr*ver1Y3o76)Z>%Hw+
zhu!V7ac;xHa-27?!8`h8ImpR4(6RwT1aW4;gbWvRlesW!8<T#0HN7*X;cfKyIH|<+
z_N3!yv`;*~F;(h7#h9*5Z=ce}nt-Fj#2?+Wf#EP|Cl;*34If`7yqraye~=KmieX;3
zGnzlwz3{yLDI;2#zPQY=nfx54kk@d?Yq)cJVAeipOW=NU<^h2RATWW4&6!^c6m-Qj
zJf}8C>iLwWhuA3jl%?d8nY4riNlR_v^s!V^=6`Z#P|2r}N<NvsC6cpmDOqdb^kHB5
zf(z&!{zkjLBA&9SZx+3l*J<W%7RVxK?lvu?w(;1dAG>(mtsi&uxJN(kF>`~GCTQmF
z6Uc-l7ls;8*8NyxGa8>5VvKcnrh4y?e-=)uAG4SUJ~OCahTv<PIrDje&%>!y3UNJ)
zO3kEF@<^p-QYm@d!(&iCejS7VvR{4v>-hh_pMJQma)&?F?jNBaIB`pY^!;Ho_e+7A
zuK&(`W60lsDgJ*O|Nrg$2N-`;`^VV$68Vq>zLJEF2bKqKM#+PJ6@Ny5`WhttRT5o(
z8s(=+`Mb@TZwY)0#u2#3oVi!vUbshK(44tX;J1@w_v`*v<;}Ir6Z&B9!4{X$1+rqV
zz`cEC1|mbk_nWx~1Rg*~64;xb9wGn#djD<sK-E9rs=wCXR0Aw=hj>G>h<HP?ge4t|
z8;8p_Y)dGk(ma1|J%6qQ{Nug!!&vDLn;x8N1VN05TjH%GUy}TY^~}i=#)n??a1{N<
zXX87p-l+a#>1E%tynTQVm*suvTr=~dvJKm*<gAYnkVjK{o`|A9!S~BS8IDfZ>axeS
zFD2#btdjEVF{xYnKRh0dQsa?xjZa!5W%}}HjvkXjf)FL&2jG`@!A}JL;RX#T&JXC&
z12hf%tEPefnc!bN|L5^9=1A(7YvWtGPpS6<(l3bra#`M&fUlP2ebujLHw-xb{5SC(
zy6n5ya3b>!>^83$fzON$9}Z?(FYbX8xTDkAD%O9cXR%%zcuC!d9CVQsV++S%Y4D~j
zO`~ou?91MPI%dD`Ftc}o3->OJQd(PZGcadsZNbgJoUPf%9W=9r>D~Lu;DD7G{g{2w
zdOpar#ZzwjG~41S_vbu+X~ltAvMpwDLtP(oAalCd&1{2#+#lOT`&8T3KQnXRX8C6v
zdQUZ!rf>L=?xekc9-zJHBct0pF{-_PrM>q1Uul~(V~?3Fvdz7h1`4Ekq7S+E{cFvv
zr<pIpE!WV@dYY-8X=XjmRL@p3m3dG%Gg?1YR|(Lka{|w)CboQ@*pwZ*mDXv#HAcUZ
zgTW>9mAY$WwQKY%-puFSfoC`m7I=yEZ#j(ZJwY|wX!$A;wRsGx^5{m~A>n@=y*`K4
zTeovtP9QHH<B!Og1pi=jumrbs#<}@VFC^g-)6IWhdsz~Nwa-eT!1`9*E4}Y)^56?e
z+!j`2qMJ7dpTuH|ciwshuWj3>bCz;?`>0c#ZS#0{uHn$&j0D{c9$vF!t>;)XThA@>
z6Fh<K`7y6kQ%}5^og^?x>B-)9mM|q}S%+)eKC?aE$rgiTXR9nU=9mRZ`7tl&m?>`O
zvz|ao4i{9!m$^4Qn^5NAHXeD!%5S~W)`A2TuK)vIL6Uw<l1FAR4fo*do2z^}L6TS8
z*2Ep9zE%~v`G*=(&4ljxdfxGG)WOV3@&tC!5;-V46h1ILNmN2=q;_cEi~ZJ;TbEs7
z&vRxZfUwY8>Qk1(Jy+Zzw(XcV$Jr`dhvl#|9#KG?_*Yh4awc7JhQ3cmbxC&0Kux53
zgix$c@w^VUo(G%RqAYq66rwybUGya3#xQ0N_AFm}7UxAMPS(fUw)@(XhH#g|U_aN=
z&X4y5-f%mg^WhNDWZmtD<WFxM>tWeiFu$30VjI<%-+UCzOSQgjox0B{!ymTp4^@gP
z@8Wn5y8*zn)I$*MRftZ(`w--rqI^1S5ktA6JMm7%SjW8rNi;BYGI1lqSL~H~z0rS>
zTDq8O=DAovI&o{B3v6TTWHAUHkGih`8?it5^l&}~e_5rBU4K>OVD)-MFH-zS2V3_%
z%GENgcE}y;%{<BasXuZ2K|<QBbWxdqU47WwHE?}m?fM)$aD6_nRMq_V>ciPseQ&Cu
z$=N2WiV9V%FC9ka%W-cO{aN+t^q;ISX75k1FxmY#yZ!Bti<wsWtH?UI6+dp*8F+ao
zh_~2=YW~JI{4ns3@$B=6%R0Cv{!`-*4HI~XZ5V}bp9W{kba6^M&5-Q@%)hq`adhtk
zZ?dkvH5TpfNcV2x<E>(6r+2r;cW;z;mbqmOTnD#&gu=&{71%XM)$$PuXB`P)r0m&p
zt5lC&(~k!LS${cKCDT2-nhTA{XB5#i1>C0t5(%)|Ythr!;fo7&z7}87)BW(3CAIm#
z0ACkH;j0<@O)q@a=zwT^iT}Hv@ReP%j%XI*8SPE~agdSGd+|y$=M6S<a%Dh<oDnt`
z89~pxvdgvMIiFdXnxPzs90FnDP6}s2mv8~qhjRTWTcnyUmTg(1HyD{OH0646W+-<@
z9S@VLQ*2+5$jd=Rck>OYgJOK`6Jr|A%?~uq_fn}4o!x`}>|dfg|5p_(L|r1Z;38G<
zPF|tI5C_aq(moD8k_?oC&3W^kt#Z81eao!Hw+K{u`>$p<-}vq31T-1$Z{5fYr_<$p
zF;Kh5tlKMauUQuq7&Pnl3EXGa?H9P;tUDm^fLV7~;9;}wOMzc{Ghb*}9hxl_8Z8xy
zr9#|K@ff0TU2Ps4FNL7j7x47-0{#SJhuKSNyUS^bx+^P95^k5*n@GlqlvGv$M`4e5
zw%*4lY1f-1Q|;O!P4hn`&1&YGI&PJdn&83t_Ne^0Li~>7B(OUbBOwk5|3(b9sroWM
zY%FI7!P#mxk%w{ekf8h*ifjD@+%V#na1;&&B)KctE?Cstf5r2tt6{YyNDF$PAuhyH
zVd_q-hT+}o^qn0;rTR~QrM45I_B7OJgmVItCP^U~UNdh#OJtd!a7zqfc!!faD+T}C
z1I8ZHkSVya*ED1bZUjw3rr^dt(-2dlvEMYrlxQ3<4KXDehfPBae#V#G56Qm8?&bR8
zt=2{Cg)(oRAG{ttz`HeXJ_vAx(x_H%|3NYyoTSE{k&HG_ey2ZXQ|LXmGwSh+g?Vf7
ze*!s<@4U3vaDl#H-*;!=*An6L&HQs6{G$dF;U97EYL*(oLGSeCAJNmi@Q;flZRz<}
zf0ZH3Gg~tce(#!C^Uh~9gL}klvf>^&3BqBsXzqdY8s>9MYkr8qNnGUmmuc=PDWjKu
zD8%XlF~NEAI-OTJXR(;h1rbKT1MA$+=UeilIp_M`oP%+)GebCFn_<>rlzh<$)MAvZ
zW9}o5%zf&Z`^e)S9+~^dV~|It-|`4UJuk_zY1SRqL5GExei6!%>M36OODWZpd#l%V
z48TcikFh!FHi^eYMLqhylbhw$FC^xPFw!q*khJm+2tzZHG}OPIMmEbQ^NKWhDL)Qs
zSIp6ik3J)Y+V1^v<5geBM_jwsi;sj~2I8ZyhV<p56Kp=($apF8Lvs?2W1MYbBDcBe
zOq!**iKSwjn~s;J+T0`tV}m|1w4oSa8ro0{Fb!=e2Eb>^h5&%Y^dn3rc4mV<G3XO4
z%EsaDpR0Yr_0lQFQIX(jRFGp&^MfO4gt675S!|GEvGDry!2Gpk0RGxhJRpDJbkyGC
z!pxkFuX~|#tp%xT3t43Ur+C+FON6P^2<2>DO7)aplt36q*3pZYV!bZx(e`1(4P4s?
zqm$K72|1X(xS2ilJbBPzwq~nVl;s4bjma_1ZDfQ(>rXb!7TIL9HER?hWSMO!z9|bV
zKC5L$M$GsgxduGwR85GU=5<(uWvCIfi5|p$n=wXa(7G>;ig*JbdgW&Bz(>J?1n{VC
zZFjaFkYaB6>WJF;ls&&O&wNBGgLmDLrYRdZg!AV}m0Bd62WqA2_&6o?1j_MPnr*b0
z%FlgSpkPe*Fr}|aXj!0qjGF7dKmK6Q94x(<Z5ZZ=lyqjvfdbVcE(E(}hT{6D=7@eQ
z`@)%vwq{X^eI?#iwCXHl@}QT_;Y-`Esf)T5J@5f1`EY|Mo7Yn*hCD-ZGr8a)`1g1z
zca9NiBP22<(3?!Q6!8(o-@e5!vcF_}Pe|^_(hA{yL_@(bCE&Z18oW&hTqgl1NWhIc
zKwVg`CJmK3KrXCbH^E?3UPZL^zm-vWw~We_gX|BoLq&gBBOm7Qf%b>5Dzp?$dJ5cY
zdK?0^$=*y&k0<q|NA%8-(exN1VQ+f;9U+<?+j#0jj~N5f;}~kG=`n)`=y6gMJ>I-P
z@DtU6WkQeC!4XZ5j4aTj%r_Ndw8x8f%t6Y1a@<9oJ$Ntp7_C>N`HZtwWMDLD`UWD+
z`842Yq&cQHX=ZdE7wLbCK2a?3Kl3s4*&P?A&x~=3K2;03W%TRmlf7ZR=yMYEd1!1e
z`m|b#&LhWm@mCjkpNnpT*HWU8s$2@x5u6-r(P<U0WgVJ6&nWyF`g~ldFCHWXd#+UU
zDQ*-seSV|^u95&npKt2`@k*-4<>z&PLBP7ld(-CvUW3n59sMCfpIP$Z5k3fg&Q&|n
zAjlYhqMCeLb}vrPdIJa0>>EaOzaNe7%ea5xP5&-~yZRdb!C>O>jV?~(l0l}1aejP%
zzh`h+-veN?dnftxv9|kzNP5}Clo+KGvH9>6DI}$v9U#mP4O8bo%FLdEZnfX!$X$EA
z5!_6M*0+Ye>hfb5+~B1DaDGv~s~JXa*|(N53^r_2m*HGBD6dftw97i!i`ViML&HL0
z&UTb69M}f7h$1jDm_nWLZ<=njd_fF3Un!`WE(9V{8`d~Nm>g|)n=`rZ4l2?&cyaSm
zyf?79`waHeD0N(})8hECxC~peQPl`7d`5faRL9Kr)Qo7y;GY`|3`2wmtV4L~r7kJp
z?})mQcBg3HDe4;IHraCJzGY@cv#LcSGk`<+fpNhQ65DOwG*VD&c(>-J@fjT8#5{N#
zWQL26&?i8PPH-OL3Vft?83u2U5v_FbWO1`!;0;`v9zu<Q%IH^VrFV30ZTCYuo!m1k
zW1QxX!I$eIyH}t}X>H-t%Y>^w4tBEzQ);8n4JbC*%_qdTFc>PvYoT$f5KRxZedtW~
zm@bogw=Cu|R+pUUX-HG<m_)oqjSouPSsPSuRvCA{ty$|D{q|C?{R}eyJ!H*)BP#qU
zKC=m>;Y~jqW%|y7Z9Jj92aoJjYWo{%+H0&;Q;V{)!QRYgnznGF{Eu?1n!7dM51#I@
zh(xsN0%z+-Y9N^B*y_0fQeYTBKMC-}c{vw~eL9DBoGpXn_%a$V*Uvkbel7{n?YUW?
z8UM?%&Q`HUx|?s}{@G$BEVl+bpo#oIC?ACdba@J9v=0w(B!Me3v!GOc4^B%b8%m#1
zT)+mDkk>qwW;)wOfbw<CUdF>Ns<VC@66NXLB33S^yCgjq?J=#-4{Tz_(r|%nrPTdn
zE|oh!nfedis-DP)V~H}Q-jc@kZWOjv3d_$7aWxO$%)!oW?m!&oa)H_0^q#;~H_m6>
z?CCUrkfa`xxW-;Ra69~P^)TH0!ASKm(wsTUx!oO@G0L3Dbdd)atfn4t*UiDpp1=;d
zo_PtnX^*w(Iw!Dvgj7;pA+IpzY#YmG-QMzWd-qFwD^a<mz04S3I9P3zv$eqL7--oi
z%qJX3FM06%s2=1GK?&SRZ1ML3QrM?L#ik(}Y+cHEpW^fQG{wX+?M@IzM9RJ!o-V|v
z2ERi`hGz@$sSUrE=xM>OFBH%F%=lFQCN=9;K1{!)0M#rX`Ek_qOZXicU}6YEF-Zx~
zYu@(Zor-VWCVPT5r77g^cAMF6si(JiViAW9*~1gdI6Up;DX5-;Jnd6Y`*>o_im&^5
zVyT*^13a-<%@g+kX0!c)CyXIG8}14<Q4={-I1g-V!SEplo6st>e`PE11!(LW1WA*8
zfvv$8Kd0eaJq5H#SVKVQI*BdYuvP2_t=QdNYBmB!^lU_Zyxsoz2u!N!Q}*fx*L=~_
z!!5JNqak;YkqCdMTpyexreW(I;r2(=C-VuBGM9z+l0@i0rEk*dxlbdUeu$Oc=#%b2
zE1jLMN`Jmxe&C(U)TXM)_$l!sZ$dxne4j9IA9)x1&GPQ{ABZ5e<=rj%?LR5+l3(g2
z@90+f#VL7*8)Q)!McSQDx2Pe}l6FdvnZ2dmox&mvB4KHFN|dxaPM&*7J6Vg-(yq#q
zcE5sFENM4Bzhb){*gXZ)+vg5*L@;X0Jxk`bbY_W7DlGRfruD3IP46%FN<JGv?oH_4
z`Ze+{3&zTdmUq}x`pG*(3p{q|d69U$rRc{L9!Kg&3{gLD=|>k{d6e8sGiQ!bQV!jD
zW;!!+Z(v3`j~V(AS4zbcX34(!Joc4+IfPlVZ#0j(%@NtR0?{9=<$mR8xpyTv7cpna
zJ&c1$G1X_i<X%emq$qqV{iZBR{>7+VBJwW<k)-4wt>@Ylk$>#w?=AmC4A@r3DEW7A
zK=~JIlZGY#KCtEAcMuNTT_b}Q`n@lPg$M>%k$+iAN_8TyHmj%2UNd`};bi}0_BI}|
zn8+iZ^wkPJkN8JYEBHK$gzP65`HbmA67A;^lZiZH#@g9%Td2^Ig0sN8mV)nNB@W%u
zOA78H$d-cJ{@Gs&mh_T>zp-LlQjqvjQZQhDe1!HY`SV*_{zT;0H_5+UmK;;*7wPoh
zM*jWWO4m#NooSc<?c`tZ5FIT-dXUoXjP~;`Ih*72I52T=$-`B&Ry+i4R66ST&frfE
z9qE1EG<as;^xug}e^%f0KkS!&Yv1&*ofRqng9Cla|88`8+aB!ZzUlEF%1uYiIb84&
zdNqmzv>rI3Dqdok@s`J<*3?zRpe3hLE|=7B^N3op@U=gfx{^kBf4?t(iJ?HQ2K&f}
z*%_3RGJ$6vcStD#PQ84Tg9zRwO|Yg6&lxh#-tnoPF}!M+!&3vpQ`PC80P=UaDjv7;
zNvb{!#m+WyrzO)P@{F1u$^4H6o-B2hw<oYiZlG{HPE^L`kAg8EMvBDA3O5-OIQ~uU
zEy>aP^33)rXG@J)S2!3HLv?=OGs!_LiFOXmSA3(%KJbi>LHl9q>&x8Va2_wB>}2^e
zKe%}<$(clKA(hgeD3?@$m|!Zs8j?A`wa%$O1cynm+?^Y|lQ~XHMv}o^k7J}_p<f8o
zoI*z4mp=?P5YGr~n%<t1M*ZLR9(vn*8mlGUjU&2uC_SO&Mn_V^R-zKv^z^_8a8P3l
z0sfcNQM2INlxp1y9-n$>RBC7mrAB&F&R2YL=rtqr)q3u@8FpV9_6faC9XLFJomE?6
zHhe4xv(KG!3vn7g2pm4t6{RkSJiEj#>v!J3LAk=}757|U`{~VvF82Mjj}<t_H~N1e
z!VO=sFJ)gsaO^**V%vxQQ*8Z6_Xysj-95wKVpmg)k=fnwLBwR_zLHaGQTwGn#ZIJj
z6q$8_yuQB}N30`#-1ze{9Ho_I4gQMCdPlv#uA<hJc6$A2*Xi{`9TU>WPjFmPSK;@U
zR=XBnOW3%fj(L@J6~*PQoVwE5+R{45*fLj5t-qqC+Erg$T3k_9QCi~iH&qmuI>zQ6
z^-ImszKkobsj4ci_B$39mAL9kD{G32ByY#`hHBS@@h&QKzOLlBVn>N<>QvVm{;JxN
zB7c#iUcJ?+=i;L3>KZ>~Q0+5MuRqff9pIVfb1f_?zPhx!#8FXMSyoe5MU~4cDob_T
zaf_-O3QI~CHY}>FsJ_}UuD%?s_=^@g>Wiygr%iRGr8U-6l(^0soj%%8UtUsISW#V8
zb6Ih<|B7)HC5v4by3!r>*H)GEjaptr<i3H8rFH$nB+tI_n#!emP4q-X^&(Zx3+N1o
z4lb@M1xZ%86&4-Uj#gPyAC6@qq~2fTcU4r^Hu$3upmP=Eg`=O-P+xbBbVlVl_2or%
zrTV$lQ8ccm!S9&W;FlcgODju@rME6{5K4$6*X#4xUp0}`U!c2hY!PlH6}633sCLXQ
zt*U7(brI}R0gI$;@VKzXCd;w)I`?`<ZCz=7X<cLKSUS73-l51uXA_B2r}7(XlarOb
zO<vSh)s(bStewm;$CEwRJ8Px`!mg^Qudiq<b(H)4we=UAa}M-y9pq9puCBDCyvQ#(
zVM3Q*c1`WIbrp-s{jRiZ;TzX%=*cMZk8ydci^mO}TV7G`;$K-^X{oEerp(_20w+_0
zQkTD6LK^CdOI?tmtC)<W*~K;0CG>Pnb^SP(Yi@aIU8$s>Icq2>>x!!V*G_f`d6zaq
z-jXigGdtUG&z$R?=Jk2!{?J8Gu6OQC&zw1~+*z|-ZdZYO_FQlFJfC~Et6<*jf?0Ds
z@Udg;>@XKL)YjJ2`RiRZ)s@$}`XNa-({XzJ1upN*xt`fG-9DFR_H42~y+nk?SmcGG
zM;+0ktwp6m5(>?(^3tM`(mI!PIPHU(pyrC|lG4SJ!iulRxYSi$+7zKhm8<o=q|`6H
zQcaYGs)giMQ)cH+#o&erGs1^gj1x)Fmyc8hHGMBCtuC$8e50vVl^WFy)!x#&I<VP?
z&$zMNYLSYrze1F?MXGsrb|h57Cn`1F-3KH3HM*U!fJnVaRB1?by}mZTC=A<aB6v|k
z>Zo|>6Hi_deue&PYfDA8j?d8DYm1YbDp*{RYk6t$)%6WkiWU{~(zha3wdn4LN5oZ$
zA_J&j#I9Y>Xk3?7R9DoOODsX5j$z9z=&Go=xU|0BRa9N#s;Vhr(9y$$O9X<@g~Geg
ztCgmqzSK3AL8s2eaMe@}-zeErD+LtQ6_*R6t9s^&oYi$#JXTj)T(hXU;=0lj_+{)s
zlEy{eC9b9le>we5_V}k1CaQr>qXesTY7_DNHLwL7trED-99wgyYQ&ji%g%HZR2Cr!
zbj65jkx@mpzXo<jka`yT>xzo~N@{4iRbrD90wx^I;ek6!T-8NYr79ht>iwWx@Ivd0
z>J~Mq5!M#Dy(zNZl_s)9+ARZdNok3!>Z_l~ISbvTCFfXO;IF7EWfZBZt*33OYP#N}
zm|a?5Q)$U`$g;7bs4{9uuXimh^*5E$6`EwMYS5Chfm?{wbkz!qN@$U*$V#Th?KCB~
z=$+C=#G|4^&)mY<9-pGG`Z1yj2(P20AV_ul7<%hP4vj(Ll$O+k8oQyhODl^OQ$QJ#
zsIH;1RJE)eT7xv|D@D-LzYFVX&>&nQ3Zx447LKC9@guX;>#Zja3|-&wy>Gg6`oy>2
zFS5dIxbwTZy!}UkZyY83Xz}0e6W@LhS>ZNR+yMhRG_DHKDjk;z<&GOS?h1v8-hXl`
z>Whoef2>iS0kWpbRkQFaM54wiYl#2OZ+oh{SMoQl_Zlno-9Fz_&gvcCP7F({U*GuY
zM~R<%l=$<H65op654_)}euu30zO*JYyMcZ&r|b4C8t5Zo!>sRpKO^dT{o;GQ^?#Yu
zC+KML&$7xBBhWy<=05nzwBpwe6q&Hqec~HdeA$jQ&~Hzl_*dBNKT7;c`@5A{tMxwH
zdcV_pKN|jjW_=f{+CaY*XS)Xq{?=i?vFmqAmP&KcMHivZE;_x$QM#~F)OTx^!&C`{
zxuMcO_Chr%^qIrh-%60<{U#n$8mh0Zu4$^i&@oQy>EoCbm0B-_^>xKE(uZHmB>#H*
zwFq5xQRKC@VPUV&(J6}-F03nUv=c@bQC3Hm_6I6xKcXYqk5xszYSFJ$QDDNAvR)RI
zEM(p$3aD;ZA(_;L8`4x-bak(~mNirt_X?0~dIdBV)#-PnUSY+#8IxpEU06{xX`*^4
zs;n(9QcsIBCKXzNwY9}62xx^c2`^o=SOwOXOE(r4)m7<Nl*{7A%*b=(sWGFrvY}qZ
zu0J<3U45vks3n9N$U|wRemr-AhLbX`)(;uhLq*0Ul2Kayx##QjqRQ6m+BMeJo|mpe
z?UJNrnO2g<4EadfvbqWSp{`sCB7}L3Du=<pxTa1&(+WqqvN#l$XB3`mWvm}*F*%oK
z=$aE|ms?y@SyEPE<uECuycn~DYFw4ZX>D<>dao|7ZO{)Tb>r0os!3hA?5fi7bW4@|
zp`3dEc&l`@*lVv+VYMaoI;XP5lk8ZT8oMgR`6`yGf&Q!>by4z|u3M%a&(ozeTHWa%
zuRE`?NCy;yU=`!4qQ+7vUOh`AYm59E5!YFDsj8}2>?m)jF1l95DQ_sM)=#x$p{b*&
zu}-J2JC{D7swIu%?FTEQG2=WPQg!YG9l5G{e7fBM@;t#pN3F(%NRTiQfW^Wh-J-=9
zgX%TjiwG`<bO-)LiJ$=^Olzp9L@TXE-K(i8sz<>>C9A0(SLJVH3R+h?Zc$CmqRLX4
zjw-{?*z`$bCybvvKI4K385f*){@C>MHRT}{m{B6->Khi;kG-%GwQLGXUP)=KdU4d3
zj=fN{YIOZRqEA;#C#xwdt7m3GjC9uxH@I}5PIg)P6*2)j^YZjFB}F~c0d(m!J~p7L
zRAEA>yB3LCeD!DwMiCzCN}J$1%Vo#2%tf|(>5yr@RFW*~k;(oVKZ^0$%xWtu367vj
zF{G-uN}}r$HTYZKX*;u}qDpF|d03%?`IFxvrmS%o4aAT$PSJ&$V}UC9Rn;$IqI_9p
zQN6!Vg<nDS?Mm~J0#%)@czSw9rN@qUUF3?Sa$Vs1y3~>O^nDUKB_-MS{nGpW80+;r
z7F3<UvrTtiD_oYy<R|uQ`Q595;|~_JZJ_F|5yC=NxNMS>-!N;Omfafi%d=p)1+TZ@
zJr-PT!DlS^rUkn#_=N>!x2yclv7lkWS_`&X@O}$EX2ItzD3_JU?_&!NkJIntEa<gh
zwFR%Y;2$k`*n-FRQOv4qbjLZYF}}~6OpwI%YJZg>&rwm`2&I*{7I-Sl&U9%-KO88u
zqpUL8q@^ZZVq~?_*q=qwfMC^htZ$ss>SE^e)r-V}C|POd3TL5ad!$Er*7|Ge!r>|#
z$<QGaGOOllq6bfhW66{jDdVtM-6}%q3*k6rRYi-KeUu`ZWR|II1D3TX9LWxr>Nq0R
zu_u>elPd}*c7SK4YPgCTiz+H*&S{&x#1bMl3+9?K_fgqd77H=pmg;ZJtJN19j|)Lw
z-L<Y_Sg<}^C3_aHl^Q#0U-VkB!l`VGlrAnUZqQ~q%Ty<mWNncX+jw2Q-_Zy6u96Bh
ze=c!Y*f@v260=<2co<T#1QnMLh<2;BbW25TL#0@6L=4(y4Ts?79I?BHGqGD{w^vs;
z+#pF1rdWm9Fh$uZ7GTp7QalrbMU9KPQJ(aeO4>Jjh<#DDGMDuI!XgEoAQ?FtWCfx$
zZM4cpcO0XdbnaMXm{7e371TGdZlYdndxaSKlrdC7>&03n#$SICq-R%mQC&>~x?F8t
z%_3A`+mfm>u#HN@j&vZ_4rQWeWK~mX-o;ENN{}kMUUwwR5%7nrceY_PY7TLnHbwgO
z!l90vVJkI$EG)$^&-hVQv{<n-!{tqBY4TX;AMIjAq^hX4u&AVjNkx6H(UwtTv}3_g
z$2qRvKgT(9ewaULVkFpcPUKldb!08cQUb5Qg0&W0Wx<YbfJaN`TB`Gvjw)2$A|q0D
z>0*rg4isQ|c<hB&!%#9(gMh*rh3?r33lc{Ur`09aU`h=uE9(6cHEMxKGzoN96cJ3X
z@=d>hJv+H-*}#9S;lmMceNM2TJ?>e<LHN7N`kvG$J}Z^#XXlgB=iScNhO+rye)hW^
z--dSnc7CIDbcdbJ4!6_W?XchNe6p-`c026vww-yT^}TO=JAeDT{cfkXp<N&Q-Ok5`
z-?klge4!4kw?%bg7}s+n`!!4z$SOVwCFm}f)j*r7_+~vf>1ccq%@o-&j>mBXR#X?)
zsTD+NdjHS$g`#%ZIqPW$>m`!$*ZdN#Z$p66X2JLIR+x<&JB|cPf7$;fzWf*6OLoEA
zzY*4h;MmFkWBD)rK%LK>P^bl>NOFy*s8*gkLE2eAPWVBP!%t&NcxnLdiJ%hh(J#V1
z@+%YzW3SQ*o9aXj?}NEX6Z;hzNk3^~RBfZuhw~M|Kr2cr$6hES#JG}iC54Db*M&?J
zR5s!HfJfEF19gm64Jj<FtXN1D)e4Fla_TP|&*WhI6*dr|GPlrU<jlT;`2qq`{Y09|
z{6gnf@Gs|A&?mpNVwP-KuXa(Fu@^=Q=(BZ@Op^W5D476FafRd4QS_Wpdnq$|$H3u|
zApGT9m0*=hH&#?NR4K%$mZz!m$|{Q%)w|A60ynoX$2)uO4;4Do9cg)Bq;OVQ*=Se4
z-k8E%ii%2gRfdAdUXj#jMXa=5(PXN2^jz)!D6Ym>0E(ET^~zJopihu0MkrM#RkbX*
zE2UKTYj1j01CIV+{q6l7Rkc=sh@uCm^;^-`1Wjh&NMGdlt>~*)e*X>n5+g#GilXRl
z(!~E9eJT8g`TZ#P4}Xu~zgH(ky|}*0Qg5AyH0(O8VagFJ{7Vh@e5PTu4Xt<`Ryv0j
z?y|xcSm_+r_tl?R`F^TlR*c&rKO3&@(cw09Snn<?pVeRJ?<)^#Xy?1Y%HM8B)<3N8
z7EHI=S74<tu<Eh;pH@8Uy>q{QcUj?CRylh<*WsN9tnXI5l~(?C{cUL1--dQOR$BRF
zS#W`sU#*3YW-DKW4^o>UxmHA0vEww?ct`Zl<}WLTE$qWlZ2IW)U1!TMYh|lsTzJ&B
z$1|jvJ)ZT8P^u(TX<;o3&wg7%q<!1rA&T94Rplt7T%;ns>%l1aFW2K}Y){VciG>oW
zhsL`aD(uCEUfMqs1Nd82sJDF2cl&&^vOPJYMN_uxS5X3<E<5iE$zr^GNTVxVXPm)6
z)4)1+t-nqt8^XYaQY3=~$W$}6nzF(|d*GbIr_mw@M~_xkJxiL0yW3G&gWfM0^r3|R
zH|q%+k6O=u_0z@>=6dBt4J_%GM4EEcr+d<eG>s`r{^;?GkNN3$H&+e0{lHbV=RHsy
zy8rHyUrbo`X7aDszIE*>p;z`Sdws`G&i4J~n5S;|^G!p>u6_T<CqLa$lCtLHPh6|7
zGOk(o>0jOJTW{R;#);i~->$m&v0VqYw(V^B!HUY`J6By@a@}VOzuLFG^hdKUj~V`Y
z<>2Dtsm{;;IV_=lo2z>Al_?dzz3v6L@LKe%m-og^$=ek_<Eyq|JFb3g=mVdxdhEQ)
z6%S8)b^8-<W_|YLgMY8wJ)z<9cRVi*d-bg!PJQ_g52n9<#s!YQUfg`~YuipJ>U#RI
z1CO5e{mqa3;HP&#{*v>7r`G;rZERY?vO$Fpzn-)uHI(@0r8m@^bF8m?{vS>*+Awu&
z*<U)`Z#53S=FONVT{~8smGa8Rfwn(ibLwM%8T`QBr|&y=*V^E(whvi6@iRPbtUBhN
zkt>q__QbHOZXP?eD&Z%UB|nb2y!gEX7hiq#!lKGiyVFbCW;zyr^5NZsE3bbb=A;b=
z5^lX@v-6)@USC~W5L$EG2W!`xH!NHC<vS<8z0f=MjS-*Tuyc8-Z`T*|iyqE@@#4oW
z@H?Ko|K0Q_cDWyTXZmY*@19z<`Q=}Kap2XRSA{CFzkI!VV(zj<f9zVj;EnpR@j3r{
za@@IvzM;S0e#5Z0r(83r;P>v>GgDF$*DrA;Z9o07@=G3Rt8pE(t8CqUdy8I7{_L+;
zuGs$i=<luQTK(v%*S3CV>LWkAW!R(RCSU&4nm<-P-sx&t`{7?6dHR2n-u+A5|Lpj)
zKQr%@5B}7&<K7Wxycyqe!dvynB^Lj^b#lpF7hY90Y}KV#U6=S$^4@!Uj=A&9ha5xy
z{EHzs=G^JrzvKRdrRAT*oN{F2;EF3QS$OEVMWxNxOsf3u`-88pZait%kv(Vc3|xBM
z8!69Ee|u5QJL^9C?Bn&fWv^fJomXyKy&!o1tFPX4=gYs`ym5EN>`&gA^^ZkQyu9d=
zCx7$y;KweSG3jCBjkAaC_MJ5JPY0*RO<HhWynEBf3*MRc&Z1Qx-&Q^T+VvH=%O5Fv
z?!=a|Cs*#MIepT*<+JZ@N_svnFY$?WC&Yg5oHGW^TR-{nXVMa%diah@A3Zz%sz)yW
zZO>~P$G_C|nE8v>$DI7oUoTs|vE*lGd{Vsc=l5ULF!au<*xwC4=I0kp;`)<CL+Xyd
z#4+gB=}+H1{JOR8K6Lh<ug^H?FG)YUZO0wM*1z(<Yd(JKhST18GjZ3BolB;@yXzl^
zA9=gHy5)^iUpQg?Etj3K?%>~=R@XG;tr_{=r3uSwuX6T0J9%)~<%u!J_WYvs_KJrV
z9^Tn=b&=<#$`cm9J9OnoJBGbBw<Uh&#z*2Zi_Tc|+e0TT=*rKl@V?2C>h!B#e(0@B
zUwyqS@tv&wlXss#=b<Nm_slPz`0LFtJ)9Tnc`SX@Cr>@~qm7S0n||jbbAEIGqp5=?
zbv=IP;MZOleaT<vKE3Gm?~l8#?2)z8i#EreRDQ)>XV;u{{`$m6e|cNdrjy<obZPs?
zv14OSikmE#=e~+`NO|T+PXZIbF7Cxh2PSh_dl&G+=a2Nbm<0X-SPqPR;Yd$26Z%?U
z)-evp?_NC8vzt6tzQkr^;=8(tC;7a5q^E=U1xY<Uoxl#9&+G@LaI@!P(xn{Ffoz})
zxC)pK>;z^3cLNK6`+*C93G79z1-gLEzzkpqumHFcSPonbYzB4$R{*<!tATrf+kpFl
zdw`DNJw1nkDZmsawJu;9FbkLkEC9|2E&$d7Yk|vv&A^qw4&YkgN?;doH82S51j<CX
z3pf(E2bd1r4>V+g%&E);zyjc6U@fo%*bH0+>;moqW}QI&fGH<ZuVKUk766-p<-iVL
zGq4M|61e&#>H$n21-^i_z>&$6cPjCLdw{Ef`+?hlE*Iqhvw(+z1;7+0=mn=yPhbad
z0Wjrz)DxHv?2zxkRr3CQ$^&)*T`Ayc40r<W=M?5{;L7pTo5_CHB+>&{pHKO~+Dyth
zj(jfwzrc<u<Of_0>;!fJcLNKi(%%>#7F-DafXzSyxDvPkn36?*0A15)2QUkG7`T8#
zQCS!p_5jO)1s>=C*ahqa*5;BwumiXsm}QXv2-11U7q|z9IUPWk4?F?W3&0}=jRIgg
zaR0^R2Tb8W&T4rF2Ic!4>WlGXH3#$xfUZLF2R1Jvzmen%Tm{VHz-%Y53wRi~ACFST
zcd1VucmnRZfq1~I8;J*83ET}#zX`mZNI5rCPhk2o@&$I>K|Emdozw%Ebr<nY;``n3
zhroM?4{ZJk_yVp5t_1D@t_7z26#M}f{15#IKkor%08@TOJA}W1<-iW$HVMC%dJFso
z^*)()0v7-s_kkDSeqa}{YbE$N1%CJ?{Q-3Siv9*J0M-Im0+#{z09OLD?x#Ky4(tN%
z2L^!!zlNVUDY_as5}1P5f^?wcH{=Ig0IUUe0+#^`eoKD9J;1fVtX1R(TnP*U9ls+#
z7kB}V1TFxk13Q5R(Di%T1FQuu2Cf8lNcbP<7hp566SxPs8<_PV{Vd_Ygwv=u&;=~`
zBX|UM0t<kShrlCn0kB!Zfh&Mrz}3Lje<DBN%GK2Gd!+v}>4AG5CY`)LN_^mI;96iO
zuuHxJgTSoEDF6G!1G<2<zzpEZzknxT*BaU*@NxPPnDPYu4oqK9`%{SzG=Po`)Cah7
z6Zkouc$*0aE&!GTR|A&;YqwBeU>ESPgg;BXGiX1s7MT7V^#v{ft_5}icLP^*+BEG<
z;sFbQ>0Q(dxB$2UxDvP)xCgi!=z5v_fdxCsKMgtrE&w`q(H{c&!N%$rbKPu5%;J=o
zlahucbi@ovk#I=Wv3={2p0jim^>^U-4u>>f;yczK>FJCECa2^kkDTsIY)WW$Ty)~(
zv(8Ng)4IGI;ED}LdM=az>nCY1=YIiX=QR@MPEKiwjV(!LypvxE|8L;`YQEne!$XdI
zZycJOkele|Z%*Po{$?jmS0Vaue!q}<LOhAFmjiNoMV)S!<0I?6{GUYq(xn~w$tkzT
zdXh)p7UxNJwa4crr!60plbpU}usb=UWytj8j@Y<=#3pCtY)VddZ%Iy@_I$Ey+6&1e
zr@fe*GVLXbA&ZIB_XNDBRPpSX);m8>@BDI-vto_p3^$pP7g>=L86_vAl2lwHOeUX8
zBp>jzBsM2`WJ_FL@&eL~B*2}VFosXRCSC@*$F&#O@v?^vo_2ej_qO=<LCXi{v<!(m
zamY|Q+MVc-_`8U|EUu?#LTpt0oZI7Wi}$n-^5_Jf7@a`y6HmMqgL--zBtF$^kENQ+
z<J`%vCGk1QX)S~DlAGh=CdUj-PRmJlx$P$8Bwj;EZm$rvzhEx;q|vTS>LK|pmv$|Q
z%T9K+kY9T2dqY(k8VDk&v;2e(my@nzNKcQw2fz;hHQ|eo;T*OESU-s`_fgjl5Wb7>
z@&Us45x!u6@OUzwPxxRvbD-iE!V3n7Kap@_fN&q-Sp$TZ5S}qW_zi@o4-kGA;c0~T
zt<Qsmy9giBr=FV$A2~oiZxNm{K==W|69x!RiYMa%!cz%9oX{WtQwZNr__2NJGuMg_
zy2C%gXQdUN;=?})ZzVi9K>j}`e9r*kj}pFnfbi!D?;0R{FX7t;2>+7s&H=)Q4{|ux
z4iG+u@YMr^=McVXfbh!+UrBi1e)JQ*g7CaB7A*QFT<YH!pT8zt+8dqEMAANK#h)(u
zC_Y1MEQy0hTjGm{DhZO4oG?8Rj)m9qlt>hOA0VCJyI9iAOHPSJT8i9Aq5z@a4bnkM
z9wBE8ksG#{sg4z?F%6bYCCU`y?@8+E`616*zKiH`4^@IIH^SE?#2bkx0#xhpPwH_4
z;VFH>W!$)n@C3pqNNhDOEI`2fXh(vQZ;$dljqiKpdqlpdcE{eO8*WP$$!{<5cN4!!
z;(OING?NUK<dJs7!%!K?Jw21;yK1+R!{k?-Jd*OIT#=Jwh*v<oWkT4Ld%MWV+u{)G
z?eTr&eqM4x+{p;c4CGxO$)BeXlS39akY7hiPtPu%CBNGwzjn!QxyaomgBUhi2Inz^
z+&olegG3GwAUYc*r#6#M+Oa)7bZhu0_<f6T7vXBWpPkH1MAO*;!ZQd*RS*9peiCDI
z7U4<ZP`zI)m2ioFNWvrdrZytaYaumPwjwc*o};^6)$4K@>yPWvdO>Y+N<Mg$a{Pp+
z5nd<xSw9J1PIw35Of|wk3I8?WD+rfo`zQVOB;hLw-zkCg)77d|Z{qLt#5w%+P#5X9
zy~LY;d{58MB%bQG$oL=Ww;UP&={M0Pj@oT1zlqGjSCQZC<g4?G(809u_^<NINnRZj
z_f;%8_E!O<dP)y!CBNWFxVNyz%V_<iPkvIr-wv4Dw8Yp;2mGLWMDVbWa#Bw2>G`Gb
zcZ7bG9@Ga9-sH~M*hdG<FI)An<TnMIK`nFTu|jx}{1iW^dedf0ugXha858%eFhqYm
zs0=5P#d7j1IK8LmRh}*RqxGTmD$Ud|Vs7Gf;b&=?=$M;HcbIhR1b>Quk$5f0!Svd2
zTq6<faim8vbADnq&)JrkimeMr%880JPc_pae45JR{4;xc?%=t%e26u|8O=zX5zZ$&
zF(({u={JI}O7dAvK8;6{9}#@zAU~1@CL5ih@WPYiw`X)u4^#c{Pr`Q*9wa=PU&au=
zkMRA3D>(?i&~P}VfWL<IH&=}jl9}+=s3hdUS&Tb^SK`NN28%6MDI}JbCppARJG*~9
zE+;&l@MwOPeEo!H5ME^GiyoOUBQbWh$~Tw4?!>vo`#JHN$Mp0JweYn(mVULyH<60-
zqxHz##MlPjk=#&#5=5~b(eGXw&rfi2K*}H2yI#`IN!W_A2zMQ&JUZB=$5QgoPK>>l
zcP2%;JZrp@_Tiw%F*4nfZ@DtwTsCx5azb9>W&Abdow0;?H;8SDc(ptWUA4sKCA&%)
zKIsOJNH7_BEP*QdK1lr4#IKk5(jU`6mF_@`%5?j75ienUPtV;FFZKo{_@&+Z2=5>~
znqH<59?!tMg7Dv1@~5BvFG~BT==w-}+7GAG{^=T@(vBR`C!E{UbCRUbPj)FfF%n~a
zR4*s7MEzZ0QI^E_6aO&ruao$8yQTM}z0-tuQnHg1bcanO%CCuUoY&KHUN}BOb1b}_
zf_jrDq$>&Ci45wJP~pNyy0=JIfXyv2o|mtePt%h-W8$U^ET2@*3jW4m;}ct5^tf3<
zcn;ws3IB<OzuRPfX^rCy{?<4iOFadH;SoGH5mhM?LZ{~>GL}X{z;dsCeUNerCim_?
z!Ov#G=M%n%XQ2z`*-aqblL$)Tt8D(dMY73Xo54jd`akVmeQZ|M9e(?kK~1qX0|gyp
zm0;H?bX7jY&5t6bg#x91@S%24v>-Ud$~r`469#tRDik54*}ARE5Z%@pHWhWUtx?wz
zC6OhhW5y4hNa})1XI$eP<L-IReSWv6x3?;Z{@0WAeeUo1J?G<|d+zzVZ|{2&@lx1h
zT&#GDU8L~-D*-nOGlpXLuhDqn&rjTWP2>EeJm*kG<{(rZCp!N5&0q^@#$OH6S$I_t
z)O_T4>DJ$6IgJ^aS;^O7YIf%Fgf4M92L%ieQ)cv;YF(Y3IiE55dZKz|`37OaT~HPT
z^ZF~F>z6e@K>0HIEnjDH`DXQBzKV}2AKTq-l&`ZQ2yVo&1@imB7vZf-i;M)aJsbwV
z7W_8yxWBZoP>Q>_XCSS}4!cU+Ih65!8H&B;Lx^{t+Og&#J@eb1@o6R|`oBmV&DCG=
zKCeQ0EtMEInS(0_))Q_YVlEdH*tXa*Slbq^KWu<L7w>GJjqyCxm!3Je($*gvhon!L
zI_&56Ltk`D-+DO=el7TTy_^8w2L5#GWh^?(ku{%Qz0@JSPNesGzxDEBuX@=Hebenh
zupp`z)T3W7|Lv(4juVHWKX4cJVsY%oiEyCjWCbHV$#8r>30>n_?BSB&cycWS<=N~z
zG+Ktbv1n`sclS-N%o8%-+0b=C=hg{KkIS}_?DQgl-Eh>^L3iMuASh=$qi!7p7%#SZ
zI!IE@Oz++xxCqA<$UlLPEIb?Vd8T_1d>;4$OZQ<USeBjUVvlQ9299^{Lsx)j33I5!
zejxhGCJxY;g4E_@J&%du#`GK#>@`EcCu4{0ZXzZ$Q@)G6YZB=@b8;(kvRJO!;9J1w
zlV9LyH{YlM|1|h&^66_L{W|a|Jj3wElM+xn!QZp@RIrkIH*O`ZS6qL|{Y7+4xG}L{
z#ElvaF1-I<MLKQB_fDRtyZ_w07>ji5uyWesMong-`yU0#T^|G=lIVB5bp2pyPBm&Z
zVVPw0%=)N8dTmG#%grcE#8Dmir@_BY)|CtU7M!o=rI$qoo7HQQ?)tS>#H-#A1pkcU
zxpn%?aK@n%nx2gXU^KaR@s1(h$nPcQcUzQSS>OCdjX?Pk?{xCxd0&rsYd7Lq1IwvE
zekIcbKgmcS`Ay(E6ZmHExtsdxp8!7vd_4Vw;MXVc$G{%|Um45yB>2?*ebX5}67#JD
zejND57|;8z1pE>3Z!vw$(Ro8{#~tIQzB6%0fp+H)T}wUsG3pfD`GfBSKhH=Y`DXA%
z-w%QfG5!hgk0$U3!RKx6o6a%t%fZL<Jqdnqf`0h9n4g0GYAoMz;B&Y1<x9X9fRC5I
z3Vdw>UkCna@MW>|8^CuZq`w<{)&oIsUrfKB>4SIkH~Cm^hnYV3czI5MPyL|p^&W(0
zr8B@^8cTl^_*(F{#`uZg4}iZR#?J<y+kj_dF}?=;a`5r=*MV;Ye@#rk6Z{eI@$_54
z=RMeapNsA91@I%mzs7W2e=;lFH^@u>+4?!^PC$1Ex?_>9jJoU5fBeaG6X6?<XTVKc
zgWwVB&=2-m4{;{7-A#6*<q-SZ*@&0BEeIMkuGDkAx-m2Jn;FleuWjcI0kfW~%W(Y%
zeQhK5VW~$x4OstSee3qsGRrW@)Y6hus!@=%Lce#r<~tZSmtb6*rE!hd{UH2Z@MD`N
z3gnN0?*xzGJ_=0lr1UqEO-OGPL`4tvO>ZLj0`T$lW=n75FQ3lYM1uLP#7FUtp7GiD
z&xXGN{>q&}@SfJ+{`@nxpHz~wJ_9S7gaJqs4W9R_%oNY|F9D=#!u?0)^FH_j@Mrhl
z2aD}nY5(pM<WquY{2$=E1Aaa=$fpW?-VcM|L7k7^j<8nZbG4%MFJtR!>?^d#C`_SN
zfx`2%sJUtN9qu2#fP7{&2f>d|GoOyr$cOEF+-Qt1Kf(JQaU8Z+l*jgCqShL2Otb2%
zpl^fT^>di^Y)pSUnn%&U4*srw{Jc)h@aN$>6z(<nJ@XN_Um0r;WjS3La}(Di;dZ6F
ze@-C1#+D$s4r#N!-;DNIo*k}tncq-+CxYMA_-oWI+`Oy5c7gSLLi^LcJo}p}q*uK=
z2rg%SZdkklIhMKw`Sk3$Zc0hrCg|2C=x{=~f2KJd>#G&IM(7wPOb<oKn(GwwAB4XJ
z{{GJI1pG(gfA>>5zsvK`9v=Pp^Q(cbDM1%MzXs^`Lf7B<wZh*9zZ*wz{W!0;b%i^B
z_>X>s{{;N}&P!5!cm2;tdxL*$)c+*y>rdlzf|)s8Q`5goY;fTMnEg)`(o6j+2qpk5
zl;EHad;$2SBwf3X&F`^aQ9l@88`wBxPEPU4q&;&tKiZFUDv=J0I}iqHV4wyDYG9xS
z25MlS1_o+ipauqN;IpiOLtiX*$?p|fUXK+`b%#$1pB26+{F|^-_<?ZH#bLb93r7nt
z5>6IQ6;=ut30Dd471j%P2zLvg6t)Yk+=j1+?+}_j2m&sfGW7SB{BH=&rjGjnoRd>~
zLjF#n+5E~(eq)cWTmJWiX5*`CsVnhk>1A9J*3<u_Gn-}OnuB>#dxmtM6Gk?CXG=rf
zF!|3Cn$3LwC>_%rE&q8!vzf+)__J_<{O1eJX88(C1iVcCuL#X%z4*^{jGvUCW8M}_
zcU6K8kNu)>o&0l!X7jq?F+min<X<Q>n>sxTa$4h;NVil-9Us?Os1?6bXtuQ})2)@i
zPG~mM<DZ2M@_$EYHZ`n63lGR&FEpFFAtnOukbj%dZ0h{|#Af-Mgl4n7@aqH?9+Cg&
zLbF*mJf4n%UAM=i`>l}a`Pc3D;-3+k&GPyCknQq6Cp4S7u~Dw6)XVa}Bs8143q0Ks
z`40=trY_&py(#}|LbG{&zwGJWk^gO>*}N9qW3%vY`Tr#}o9T@=5%53qpA@Dhg#82S
zuP{M3ME-0~=RfDL^oGel!qXKcr1u5+zvSsI_H-AD&lj4_duXDkvvxi~x=X$ECV9H6
z#a}5joAol;)0N9#Dm0rq|2f39@>dAW=JlQ8rFWD33xsA<cbTWFk-u7KHqZBKp6*Wh
zZx^l+GQF>Ry8Fc6D>R$;k=s|4c8mP?3(cnP3NO7K@^2HG&3v!&bj|WN3C*VNYESpD
z{67<#&GtOa)BQ&NUklCV^(gUl)()PO?inH5^YjE=oBS_$y3z#QOY*<$>B<sx9rC~8
z>1KGkx5d9HG@Iu!)6=~x|2smnS%2l8u3P^1gl03nS)T5c{2vO<W_sMav@m31c>iY#
z&F1x(V<O-%`OgxX&30Ph>GI?sB{ZAmo9pQc<R2?Eo8|MLJCB!tg78uy+o}H?aH{w#
zgl1EBt(WgC`OAc6vwUtJT-xj8pDQ$*<-6WXuS))fLbIv!pQkRBe~Hj+>gIdtt&;yX
zq1n_e@N{>{|1F`})GhRM>*Zf3G@IAge_q-k|7M}t)Vb$<O0!A+okFuYx4KCh!cXP@
zk<e_mmnu(Z<J6<lwF-Ive#6r}CH`@t+0-rabkE8E2cg+KkEifwb3o2f8RB?PNW1s3
z@vw4Ov1873pLl*YCcIzHmA!ex5_g10qb~6L7|shJ)hIuoH!zqVzpr)&?L+BeLNo_k
zenx2Xycn`FiyhkB@b5YSJ;qJpD+w-ej_wDxXBQg7^4WQB<_&?sxjzHzg<(VpsRL&g
zyCdV5%eHb?OJ{RD%l}jmp3jk?Vf;Y0<=Z8@Tz)0<nZwAf;rYiis@HYhCEO$2Cu|pX
z2#*W9g@cEO=Xs7WUpQG<Dx5D|CR`(|7w!`75$+SV3p<3zh26rzXDfeUzHqXzR5)L_
zOt?l^FWe>EBitu!7j_7b3%iAb&r$xueBoqasc^n<nQ)D;UbsuRN4QVeF6<B<7j_E=
zk5K-?d|~P|L-F{jF2?%NVS2~Lg?37Of5~Og;eP%qRk->N_gdSYAF(T}xf{PzumV4x
zfH(XubuS3NneSmAzoI6E7ewJL{_gh{oD;t%Hok7jt>J6L`TKRLLcD2w1=7BI6@IiO
z<n1-l_+2#oI2t@*)-;iOst_-1TDrQnmv-^$RN-y6;KTA;jF&KlsqzONZpLek3+vox
z_!e`Qa_vgK&-{+MLOXzluVHmX!p|hE#_REs*@`+H_g6cgoZkW|>(cs(+H^52e9uLM
z^_z~whpTrpfSiM}ud?_J>0(&n{{|ED_~8YPkA4^f!;jyZE_Uu#B{<euJs<J-oFjFk
zZ?pWZKR+bG)&%NyqyFDg<QT`k+~Qk*pQR4GS_1)r=WhM5^}COQqtxQt__16aw2c>#
zxDc<urC`}tTYT%E%ZG;g%^^hNlj#h%!_U6oZ0rAzD1M{jv;5Rp`9-Hz<A8N)@ol`}
zds-N(-Dl7EXz}g*55n)qxAE(M;@fz~`e%{i@!P?%PE^g&cweba0vpF6aUp*F{{q&J
zU#sz<R`J`SfjEqx8$!zPSS)^#`mv%Bq41LI-dD`xDH%5>^z*m*NzIrro{iI{kC&fq
zpGvF$^<$<w>3YRKdXdEpF|W6odKk7Jzq%rfUtK{K|8rm!>#W{;Qluu~&ySxsFN~iz
zFN{BEj3Nr``Wf4X19F)<u}zw9ZQ7vtCKSfczZ-lG<I8XJxy_0n&o6HO1M$xC;@f<$
z@e{^xL0p#9@^4c4n?7Oub+Py@ir=F6d{2@e@_YlwoX7GKS^hR(8o4#BzoQ{U_lKRo
zwZk_M*DwDE+m?XA_uICG5l!z%e3)(60nU$~(tI`57{>1k!J_wxPj|2Q4=o9`4}}q{
qqL|@9Ud(<LHp^n?U#<96ieDMi+j$%9Uwh+-7C#*pBXY&e)c*mnsxZ|6

literal 0
HcmV?d00001

diff --git a/deps/v8/third_party/googletest/BUILD.gn b/deps/v8/third_party/googletest/BUILD.gn
index 8271959ad00a72..1c761a7620064a 100644
--- a/deps/v8/third_party/googletest/BUILD.gn
+++ b/deps/v8/third_party/googletest/BUILD.gn
@@ -15,8 +15,11 @@ config("gtest_config") {
     # and other systems, we tell gtest to always use its internal engine.
     "GTEST_HAS_POSIX_RE=0",
 
+    # Enables C++11 features.
     "GTEST_LANG_CXX11=1",
-    "GTEST_HAS_STD_TUPLE=1",
+
+    # Prevents gtest from including both <tr1/tuple> and <tuple>.
+    "GTEST_HAS_TR1_TUPLE=0",
   ]
 
   # Gtest headers need to be able to find themselves.
@@ -86,6 +89,12 @@ source_set("gtest") {
 
   configs -= [ "//build/config/compiler:chromium_code" ]
   configs += [ "//build/config/compiler:no_chromium_code" ]
+
+  deps = []
+
+  if (is_fuchsia) {
+    deps += [ "//third_party/fuchsia-sdk:fdio" ]
+  }
 }
 
 # Do NOT depend on this directly. Use //testing/gtest:gtest_main instead.
diff --git a/deps/v8/third_party/googletest/src/googletest/include/gtest/gtest_prod.h b/deps/v8/third_party/googletest/src/googletest/include/gtest/gtest_prod.h
index d9ea685f6d3e63..89314f40585cdf 100644
--- a/deps/v8/third_party/googletest/src/googletest/include/gtest/gtest_prod.h
+++ b/deps/v8/third_party/googletest/src/googletest/include/gtest/gtest_prod.h
@@ -29,7 +29,7 @@
 //
 // Author: wan@google.com (Zhanyong Wan)
 //
-// Google C++ Testing Framework definitions useful in production code.
+// Google C++ Testing and Mocking Framework definitions useful in production code.
 
 #ifndef GTEST_INCLUDE_GTEST_GTEST_PROD_H_
 #define GTEST_INCLUDE_GTEST_GTEST_PROD_H_
diff --git a/deps/v8/third_party/jinja2/LICENSE b/deps/v8/third_party/jinja2/LICENSE
index 10145a264342b7..31bf900e58e30f 100644
--- a/deps/v8/third_party/jinja2/LICENSE
+++ b/deps/v8/third_party/jinja2/LICENSE
@@ -1,31 +1,31 @@
-Copyright (c) 2009 by the Jinja Team, see AUTHORS for more details.
-
-Some rights reserved.
-
-Redistribution and use in source and binary forms, with or without
-modification, are permitted provided that the following conditions are
-met:
-
-    * Redistributions of source code must retain the above copyright
-      notice, this list of conditions and the following disclaimer.
-
-    * Redistributions in binary form must reproduce the above
-      copyright notice, this list of conditions and the following
-      disclaimer in the documentation and/or other materials provided
-      with the distribution.
-
-    * The names of the contributors may not be used to endorse or
-      promote products derived from this software without specific
-      prior written permission.
-
-THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
-"AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
-LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
-A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
-OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
-SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
-LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+Copyright (c) 2009 by the Jinja Team, see AUTHORS for more details.
+
+Some rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are
+met:
+
+    * Redistributions of source code must retain the above copyright
+      notice, this list of conditions and the following disclaimer.
+
+    * Redistributions in binary form must reproduce the above
+      copyright notice, this list of conditions and the following
+      disclaimer in the documentation and/or other materials provided
+      with the distribution.
+
+    * The names of the contributors may not be used to endorse or
+      promote products derived from this software without specific
+      prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+"AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
diff --git a/deps/v8/tools/avg.py b/deps/v8/tools/avg.py
new file mode 100755
index 00000000000000..b9ceb0d9072fee
--- /dev/null
+++ b/deps/v8/tools/avg.py
@@ -0,0 +1,210 @@
+#!/usr/bin/env python3
+# Copyright 2018 the V8 project authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can
+# be found in the LICENSE file.
+"""
+This script averages numbers output from another script. It is useful
+to average over a benchmark that outputs one or more results of the form
+  <key> <number> <unit>
+key and unit are optional, but only one number per line is processed.
+
+For example, if
+  $ bch --allow-natives-syntax toNumber.js
+outputs
+  Number('undefined'):  155763
+  (+'undefined'):  193050 Kps
+  23736 Kps
+then
+  $ avg.py 10 bch --allow-natives-syntax toNumber.js
+will output
+  [10/10] (+'undefined')         : avg 192,240.40 stddev   6,486.24 (185,529.00 - 206,186.00)
+  [10/10] Number('undefined')    : avg 156,990.10 stddev  16,327.56 (144,718.00 - 202,840.00) Kps
+  [10/10] [default]              : avg  22,885.80 stddev   1,941.80 ( 17,584.00 -  24,266.00) Kps
+"""
+
+import argparse
+import subprocess
+import re
+import numpy
+import time
+import sys
+import signal
+
+parser = argparse.ArgumentParser(
+    description="A script that averages numbers from another script's output",
+    epilog="Example:\n\tavg.py 10 bash -c \"echo A: 100; echo B 120; sleep .1\""
+)
+parser.add_argument(
+    'repetitions',
+    type=int,
+    help="number of times the command should be repeated")
+parser.add_argument(
+    'command',
+    nargs=argparse.REMAINDER,
+    help="command to run (no quotes needed)")
+parser.add_argument(
+    '--echo',
+    '-e',
+    action='store_true',
+    default=False,
+    help="set this flag to echo the command's output")
+
+args = vars(parser.parse_args())
+
+if (len(args['command']) == 0):
+  print("No command provided.")
+  exit(1)
+
+
+class FieldWidth:
+
+  def __init__(self, key=0, average=0, stddev=0, min=0, max=0):
+    self.w = dict(key=key, average=average, stddev=stddev, min=min, max=max)
+
+  def max_with(self, w2):
+    self.w = {k: max(v, w2.w[k]) for k, v in self.w.items()}
+
+  def __getattr__(self, key):
+    return self.w[key]
+
+
+def fmtS(string, width=0):
+  return "{0:<{1}}".format(string, width)
+
+
+def fmtN(num, width=0):
+  return "{0:>{1},.2f}".format(num, width)
+
+
+class Measurement:
+
+  def __init__(self, key, unit):
+    self.key = key
+    self.unit = unit
+    self.values = []
+    self.average = 0
+    self.count = 0
+    self.M2 = 0
+    self.min = float("inf")
+    self.max = -float("inf")
+
+  def addValue(self, value):
+    try:
+      num_value = float(value)
+      self.values.append(num_value)
+      self.min = min(self.min, num_value)
+      self.max = max(self.max, num_value)
+      self.count = self.count + 1
+      delta = num_value - self.average
+      self.average = self.average + delta / self.count
+      delta2 = num_value - self.average
+      self.M2 = self.M2 + delta * delta2
+    except ValueError:
+      print("Ignoring non-numeric value", value)
+
+  def status(self, w):
+    return "{}: avg {} stddev {} ({} - {}) {}".format(
+        fmtS(self.key, w.key), fmtN(self.average, w.average),
+        fmtN(self.stddev(), w.stddev), fmtN(self.min, w.min),
+        fmtN(self.max, w.max), fmtS(self.unit_string()))
+
+  def unit_string(self):
+    if self.unit == None:
+      return ""
+    return self.unit
+
+  def variance(self):
+    if self.count < 2:
+      return float('NaN')
+    return self.M2 / (self.count - 1)
+
+  def stddev(self):
+    return numpy.sqrt(self.variance())
+
+  def size(self):
+    return len(self.values)
+
+  def widths(self):
+    return FieldWidth(
+        key=len(fmtS(self.key)),
+        average=len(fmtN(self.average)),
+        stddev=len(fmtN(self.stddev())),
+        min=len(fmtN(self.min)),
+        max=len(fmtN(self.max)))
+
+
+rep_string = str(args['repetitions'])
+
+
+class Measurements:
+
+  def __init__(self):
+    self.all = {}
+    self.default_key = '[default]'
+    self.max_widths = FieldWidth()
+
+  def record(self, key, value, unit):
+    if (key == None):
+      key = self.default_key
+    if key not in self.all:
+      self.all[key] = Measurement(key, unit)
+    self.all[key].addValue(value)
+    self.max_widths.max_with(self.all[key].widths())
+
+  def any(self):
+    if len(self.all) >= 1:
+      return next(iter(self.all.values()))
+    else:
+      return None
+
+  def format_status(self):
+    m = self.any()
+    if m == None:
+      return ""
+    return m.status(self.max_widths)
+
+  def format_num(self, m):
+    return "[{0:>{1}}/{2}]".format(m.size(), len(rep_string), rep_string)
+
+  def print_status(self):
+    if len(self.all) == 0:
+      print("No results found. Check format?")
+      return
+    print(self.format_num(self.any()), self.format_status(), sep=" ", end="")
+
+  def print_results(self):
+    for key in self.all:
+      m = self.all[key]
+      print(self.format_num(m), m.status(self.max_widths), sep=" ")
+
+
+measurements = Measurements()
+
+
+def signal_handler(signal, frame):
+  print("", end="\r")
+  measurements.print_status()
+  print()
+  measurements.print_results()
+  sys.exit(0)
+
+
+signal.signal(signal.SIGINT, signal_handler)
+
+for x in range(0, args['repetitions']):
+  proc = subprocess.Popen(args['command'], stdout=subprocess.PIPE)
+  for line in proc.stdout:
+    if args['echo']:
+      print(line.decode(), end="")
+    for m in re.finditer(
+        r'\A((?P<key>.*[^\s\d:]+)[:]?)?\s*(?P<value>[0-9]+(.[0-9]+)?)\ ?(?P<unit>[^\d\W]\w*)?\s*\Z',
+        line.decode()):
+      measurements.record(m.group('key'), m.group('value'), m.group('unit'))
+  proc.wait()
+  if proc.returncode != 0:
+    print("Child exited with status %d" % proc.returncode)
+    break
+  measurements.print_status()
+  print("", end="\r")
+
+measurements.print_results()
diff --git a/deps/v8/tools/clusterfuzz/v8_foozzie.py b/deps/v8/tools/clusterfuzz/v8_foozzie.py
index 442915ce968758..28685845bba953 100755
--- a/deps/v8/tools/clusterfuzz/v8_foozzie.py
+++ b/deps/v8/tools/clusterfuzz/v8_foozzie.py
@@ -58,6 +58,7 @@
   ],
   liftoff=[
     '--liftoff',
+    '--no-wasm-tier-up',
     '--suppress-asm-messages',
   ],
   slow_path=[
diff --git a/deps/v8/tools/codemap.js b/deps/v8/tools/codemap.js
index df6770f9a88087..4c185b0464511a 100644
--- a/deps/v8/tools/codemap.js
+++ b/deps/v8/tools/codemap.js
@@ -178,6 +178,15 @@ CodeMap.prototype.findInTree_ = function(tree, addr) {
   return node && this.isAddressBelongsTo_(addr, node) ? node : null;
 };
 
+/**
+ * Embedded builtins are located in the shared library but should be attributed
+ * according to the dynamically generated code-create events.
+ *
+ * @private
+ */
+CodeMap.prototype.isIsolateIndependentBuiltin_ = function(entry) {
+  return entry.type == "CPP" && /v8_\w*embedded_blob_/.test(entry.name);
+};
 
 /**
  * Finds a code entry that contains the specified address. Both static and
@@ -196,7 +205,10 @@ CodeMap.prototype.findAddress = function(addr) {
       result = this.findInTree_(this.libraries_, addr);
       if (!result) return null;
     }
-    return { entry : result.value, offset : addr - result.key };
+    if (!this.isIsolateIndependentBuiltin_(result.value)) {
+      // Embedded builtins are handled in the following dynamic section.
+      return { entry : result.value, offset : addr - result.key };
+    }
   }
   var min = this.dynamics_.findMin();
   var max = this.dynamics_.findMax();
diff --git a/deps/v8/tools/collect_deprecation_stats.sh b/deps/v8/tools/collect_deprecation_stats.sh
new file mode 100755
index 00000000000000..aa3f41308cf8cf
--- /dev/null
+++ b/deps/v8/tools/collect_deprecation_stats.sh
@@ -0,0 +1,35 @@
+#!/bin/bash
+
+# Collect the number of [[deprecated]] calls detected when compiling V8.
+# Requires "v8_deprecate_get_isolate = true" to be useful.
+
+set -e
+
+if [ -z "$1" ]; then
+  (>&2 echo "Usage: collect_deprecation_stats.sh [<outdir>|<log>]")
+  exit 1
+fi
+
+if [ -d "$1" ]; then
+  OUTDIR=$1
+  FULL_LOG=/tmp/get_isolate_deprecation.log
+  gn clean "$OUTDIR"
+  autoninja -C "$OUTDIR" > $FULL_LOG
+else
+  FULL_LOG=$1
+fi
+
+FILTERED_LOG=/tmp/filtered_isolate_deprecation.log
+UNIQUE_WARNINGS_LOG=/tmp/unique_warnings.log
+
+grep "warning:" "$FULL_LOG" | sed $'
+s|^\.\./\.\./||;
+s/: warning: \'/: /;
+
+# strip everything after deprecated function name (including template param).
+s/\(<.*>\)\\?\'.*//' > $FILTERED_LOG
+
+sort -u $FILTERED_LOG > $UNIQUE_WARNINGS_LOG
+
+echo "Total deprecated calls: $(wc -l < $UNIQUE_WARNINGS_LOG)"
+cut -f2 -d' ' $UNIQUE_WARNINGS_LOG | sort | uniq -c
diff --git a/deps/v8/tools/dev/gm.py b/deps/v8/tools/dev/gm.py
index 6dfd46bf7ba169..178ffdb964717d 100755
--- a/deps/v8/tools/dev/gm.py
+++ b/deps/v8/tools/dev/gm.py
@@ -119,6 +119,7 @@ def DetectGoma():
 use_goma = {GOMA}
 goma_dir = \"{GOMA_DIR}\"
 v8_enable_backtrace = true
+v8_enable_fast_mksnapshot = true
 v8_enable_slow_dchecks = true
 v8_optimized_debug = false
 """.replace("{GOMA}", USE_GOMA).replace("{GOMA_DIR}", str(GOMADIR))
@@ -131,6 +132,7 @@ def DetectGoma():
 use_goma = {GOMA}
 goma_dir = \"{GOMA_DIR}\"
 v8_enable_backtrace = true
+v8_enable_fast_mksnapshot = true
 v8_enable_verify_heap = true
 v8_optimized_debug = true
 """.replace("{GOMA}", USE_GOMA).replace("{GOMA_DIR}", str(GOMADIR))
@@ -246,7 +248,7 @@ def Build(self):
 
     return_code, output = _CallWithOutput("autoninja -C %s %s" %
                                           (path, targets))
-    if return_code != 0 and "FAILED: gen/snapshot.cc" in output:
+    if return_code != 0 and "FAILED: snapshot_blob.bin" in output:
       csa_trap = re.compile("Specify option( --csa-trap-on-node=[^ ]*)")
       match = csa_trap.search(output)
       extra_opt = match.group(1) if match else ""
diff --git a/deps/v8/tools/dumpcpp.js b/deps/v8/tools/dumpcpp.js
index ca5ff675f325c5..58cb74cc6a5b0e 100644
--- a/deps/v8/tools/dumpcpp.js
+++ b/deps/v8/tools/dumpcpp.js
@@ -4,7 +4,7 @@
 
 function CppProcessor(cppEntriesProvider, timedRange, pairwiseTimedRange) {
   LogReader.call(this, {
-      'shared-library': { parsers: [null, parseInt, parseInt, parseInt],
+      'shared-library': { parsers: [parseString, parseInt, parseInt, parseInt],
           processor: this.processSharedLibrary }
   }, timedRange, pairwiseTimedRange);
 
diff --git a/deps/v8/tools/gcmole/BUILD.gn b/deps/v8/tools/gcmole/BUILD.gn
index 65f11223bab6f2..99b5c0aea72c6e 100644
--- a/deps/v8/tools/gcmole/BUILD.gn
+++ b/deps/v8/tools/gcmole/BUILD.gn
@@ -23,6 +23,12 @@ group("v8_run_gcmole") {
     "../../testing/gtest/include/gtest/gtest_prod.h",
     "../../third_party/googletest/src/googletest/include/gtest/gtest_prod.h",
     "../../third_party/icu/source/",
+    "$target_gen_dir/../../",
+    "$target_gen_dir/../../torque-generated/",
+  ]
+
+  deps = [
+    "../../:run_torque",
   ]
 
   if (v8_gcmole) {
diff --git a/deps/v8/tools/gcmole/gcmole.lua b/deps/v8/tools/gcmole/gcmole.lua
index d832041361f31d..ae17fdc5f6ec7c 100644
--- a/deps/v8/tools/gcmole/gcmole.lua
+++ b/deps/v8/tools/gcmole/gcmole.lua
@@ -112,6 +112,7 @@ local function MakeClangCommandLine(
       .. " -DV8_INTL_SUPPORT"
       .. " -I./"
       .. " -Iinclude/"
+      .. " -Iout/Release/gen"
       .. " -Ithird_party/icu/source/common"
       .. " -Ithird_party/icu/source/i18n"
       .. " " .. arch_options
diff --git a/deps/v8/tools/gcmole/run-gcmole.py b/deps/v8/tools/gcmole/run-gcmole.py
index 88799e3d6c28b5..cb4c74e31c171c 100755
--- a/deps/v8/tools/gcmole/run-gcmole.py
+++ b/deps/v8/tools/gcmole/run-gcmole.py
@@ -4,6 +4,7 @@
 # found in the LICENSE file.
 
 import os
+import os.path
 import signal
 import subprocess
 import sys
@@ -17,6 +18,11 @@
 
 assert len(sys.argv) == 2
 
+if not os.path.isfile("out/Release/gen/torque-generated/builtin-definitions-from-dsl.h"):
+  print "Expected generated headers in out/Release/gen."
+  print "Either build v8 in out/Release or change gcmole.lua:115"
+  sys.exit(-1)
+
 proc = subprocess.Popen(
     [LUA, DRIVER, sys.argv[1]],
     env={'CLANG_BIN': CLANG_BIN, 'CLANG_PLUGINS': CLANG_PLUGINS},
diff --git a/deps/v8/tools/gdbinit b/deps/v8/tools/gdbinit
index fa9f434fb37664..ced0a8209680db 100644
--- a/deps/v8/tools/gdbinit
+++ b/deps/v8/tools/gdbinit
@@ -29,34 +29,6 @@ Print a v8 Code object from an internal code address
 Usage: jco pc
 end
 
-# Print FeedbackVector
-define jfv
-call _v8_internal_Print_FeedbackVector((void*)($arg0))
-end
-document jfv
-Print a v8 FeedbackVector object
-Usage: jfv tagged_ptr
-end
-
-# Print FeedbackMetadata
-define jfm
-call _v8_internal_Print_FeedbackMetadata((void*)($arg0))
-end
-document jfm
-Print a v8 FeedbackMetadata object
-Usage: jfm tagged_ptr
-end
-
-
-# Print DescriptorArray.
-define jda
-call _v8_internal_Print_DescriptorArray((void*)($arg0))
-end
-document jda
-Print a v8 DescriptorArray object
-Usage: jda tagged_ptr
-end
-
 # Print LayoutDescriptor.
 define jld
 call _v8_internal_Print_LayoutDescriptor((void*)($arg0))
@@ -66,15 +38,6 @@ Print a v8 LayoutDescriptor object
 Usage: jld tagged_ptr
 end
 
-# Print TransitionArray.
-define jta
-call _v8_internal_Print_TransitionArray((void*)($arg0))
-end
-document jta
-Print a v8 TransitionArray object
-Usage: jta tagged_ptr
-end
-
 # Print TransitionTree.
 define jtt
 call _v8_internal_Print_TransitionTree((void*)($arg0))
diff --git a/deps/v8/tools/gen-postmortem-metadata.py b/deps/v8/tools/gen-postmortem-metadata.py
index c89635253ba581..8ccd4a4b566e62 100644
--- a/deps/v8/tools/gen-postmortem-metadata.py
+++ b/deps/v8/tools/gen-postmortem-metadata.py
@@ -184,25 +184,18 @@
 
     { 'name': 'scopeinfo_idx_nparams',
         'value': 'ScopeInfo::kParameterCount' },
-    { 'name': 'scopeinfo_idx_nstacklocals',
-        'value': 'ScopeInfo::kStackLocalCount' },
     { 'name': 'scopeinfo_idx_ncontextlocals',
         'value': 'ScopeInfo::kContextLocalCount' },
     { 'name': 'scopeinfo_idx_first_vars',
         'value': 'ScopeInfo::kVariablePartIndex' },
 
-    { 'name': 'sharedfunctioninfo_start_position_mask',
-        'value': 'SharedFunctionInfo::StartPositionBits::kMask' },
-    { 'name': 'sharedfunctioninfo_start_position_shift',
-        'value': 'SharedFunctionInfo::StartPositionBits::kShift' },
-
     { 'name': 'jsarray_buffer_was_neutered_mask',
         'value': 'JSArrayBuffer::WasNeutered::kMask' },
     { 'name': 'jsarray_buffer_was_neutered_shift',
         'value': 'JSArrayBuffer::WasNeutered::kShift' },
 
-    { 'name': 'context_idx_closure',
-        'value': 'Context::CLOSURE_INDEX' },
+    { 'name': 'context_idx_scope_info',
+        'value': 'Context::SCOPE_INFO_INDEX' },
     { 'name': 'context_idx_native',
         'value': 'Context::NATIVE_CONTEXT_INDEX' },
     { 'name': 'context_idx_prev',
@@ -265,12 +258,12 @@
     'ExternalString, resource, Object, kResourceOffset',
     'SeqOneByteString, chars, char, kHeaderSize',
     'SeqTwoByteString, chars, char, kHeaderSize',
-    'SharedFunctionInfo, function_token_position, int, kFunctionTokenPositionOffset',
-    'SharedFunctionInfo, start_position_and_type, int, kStartPositionAndTypeOffset',
-    'SharedFunctionInfo, end_position, int, kEndPositionOffset',
-    'SharedFunctionInfo, internal_formal_parameter_count, int, kFormalParameterCountOffset',
+    'UncompiledData, start_position, int32_t, kStartPositionOffset',
+    'UncompiledData, end_position, int32_t, kEndPositionOffset',
+    'SharedFunctionInfo, raw_function_token_offset, int16_t, kFunctionTokenOffsetOffset',
+    'SharedFunctionInfo, internal_formal_parameter_count, uint16_t, kFormalParameterCountOffset',
     'SharedFunctionInfo, flags, int, kFlagsOffset',
-    'SharedFunctionInfo, length, int, kLengthOffset',
+    'SharedFunctionInfo, length, uint16_t, kLengthOffset',
     'SlicedString, parent, String, kParentOffset',
     'Code, instruction_start, uintptr_t, kHeaderSize',
     'Code, instruction_size, int, kInstructionSizeOffset',
@@ -306,6 +299,8 @@
 #include "src/frames.h"
 #include "src/frames-inl.h" /* for architecture-specific frame constants */
 #include "src/contexts.h"
+#include "src/objects.h"
+#include "src/objects/js-regexp-string-iterator.h"
 
 using namespace v8::internal;
 
diff --git a/deps/v8/tools/grokdump.py b/deps/v8/tools/grokdump.py
index 0246a18bfede3d..75e80fef903ce4 100755
--- a/deps/v8/tools/grokdump.py
+++ b/deps/v8/tools/grokdump.py
@@ -1732,7 +1732,7 @@ class V8Heap(object):
     "ODDBALL_TYPE": Oddball,
     "FIXED_ARRAY_TYPE": FixedArray,
     "HASH_TABLE_TYPE": FixedArray,
-    "BOILERPLATE_DESCRIPTION_TYPE": FixedArray,
+    "OBJECT_BOILERPLATE_DESCRIPTION_TYPE": FixedArray,
     "SCOPE_INFO_TYPE": FixedArray,
     "JS_FUNCTION_TYPE": JSFunction,
     "SHARED_FUNCTION_INFO_TYPE": SharedFunctionInfo,
@@ -3323,7 +3323,7 @@ def output_disasm_pc(self, f):
 class InspectionWebServer(BaseHTTPServer.HTTPServer):
   def __init__(self, port_number, switches, minidump_name):
     BaseHTTPServer.HTTPServer.__init__(
-        self, ('', port_number), InspectionWebHandler)
+        self, ('localhost', port_number), InspectionWebHandler)
     splitpath = os.path.split(minidump_name)
     self.dumppath = splitpath[0]
     self.dumpfilename = splitpath[1]
diff --git a/deps/v8/tools/heap-stats/categories.js b/deps/v8/tools/heap-stats/categories.js
index 27abb24daa3a08..fd3e5f14976f0d 100644
--- a/deps/v8/tools/heap-stats/categories.js
+++ b/deps/v8/tools/heap-stats/categories.js
@@ -92,7 +92,8 @@ const CATEGORIES = new Map([
       'ACCESSOR_PAIR_TYPE',
       'ALLOCATION_MEMENTO_TYPE',
       'ALLOCATION_SITE_TYPE',
-      'BOILERPLATE_DESCRIPTION_TYPE',
+      'ARRAY_BOILERPLATE_DESCRIPTION_TYPE',
+      'ARRAY_BOILERPLATE_DESCRIPTION_ELEMENTS_TYPE',
       'BOILERPLATE_ELEMENTS_TYPE',
       'BOILERPLATE_PROPERTY_ARRAY_TYPE',
       'BOILERPLATE_PROPERTY_DICTIONARY_TYPE',
@@ -113,6 +114,7 @@ const CATEGORIES = new Map([
       'JS_SPECIAL_API_OBJECT_TYPE',
       'MAP_TYPE',
       'NUMBER_STRING_CACHE_TYPE',
+      'OBJECT_BOILERPLATE_DESCRIPTION_TYPE',
       'OBJECT_TEMPLATE_INFO_TYPE',
       'OBJECT_TO_CODE_TYPE',
       'ODDBALL_TYPE',
@@ -165,10 +167,12 @@ const CATEGORIES = new Map([
       'LOAD_HANDLER_TYPE',
       'NOSCRIPT_SHARED_FUNCTION_INFOS_TYPE',
       'OPTIMIZED_CODE_LITERALS_TYPE',
+      'RELOC_INFO_TYPE',
       'SCRIPT_SOURCE_EXTERNAL_TYPE',
       'SCRIPT_SOURCE_NON_EXTERNAL_TYPE',
       'SCRIPT_TYPE',
       'SHARED_FUNCTION_INFO_TYPE',
+      'SOURCE_POSITION_TABLE_TYPE',
       'STORE_HANDLER_TYPE',
       'UNCOMPILED_JS_FUNCTION_TYPE',
       'UNCOMPILED_SHARED_FUNCTION_INFO_TYPE',
diff --git a/deps/v8/tools/heap-stats/details-selection.html b/deps/v8/tools/heap-stats/details-selection.html
index 67a27ae284cbc0..04b274a8d17ca1 100644
--- a/deps/v8/tools/heap-stats/details-selection.html
+++ b/deps/v8/tools/heap-stats/details-selection.html
@@ -100,18 +100,20 @@ <h2>Data selection</h2>
       </select>
     </li>
     <li>
-      <label for="dataset-select">
-        Data set
+      <label for="data-view-select">
+        Data view
       </label>
-      <select id="dataset-select">
+      <select id="data-view-select">
         <option>No data</option>
       </select>
     </li>
     <li>
-      <input type="checkbox" id="merge-categories" checked=checked />
-      <label for="merge-categories">
-        Merge categories
+      <label for="dataset-select">
+        Data set
       </label>
+      <select id="dataset-select">
+        <option>No data</option>
+      </select>
     </li>
     <li>
       <label for="gc-select">
diff --git a/deps/v8/tools/heap-stats/details-selection.js b/deps/v8/tools/heap-stats/details-selection.js
index 5e9ffc5f94e84a..1e9cc83cff304d 100644
--- a/deps/v8/tools/heap-stats/details-selection.js
+++ b/deps/v8/tools/heap-stats/details-selection.js
@@ -8,6 +8,10 @@ const details_selection_template =
     document.currentScript.ownerDocument.querySelector(
         '#details-selection-template');
 
+const VIEW_BY_INSTANCE_TYPE = 'by-instance-type';
+const VIEW_BY_INSTANCE_CATEGORY = 'by-instance-category';
+const VIEW_BY_FIELD_TYPE = 'by-field-type';
+
 class DetailsSelection extends HTMLElement {
   constructor() {
     super();
@@ -15,14 +19,14 @@ class DetailsSelection extends HTMLElement {
     shadowRoot.appendChild(details_selection_template.content.cloneNode(true));
     this.isolateSelect.addEventListener(
         'change', e => this.handleIsolateChange(e));
+    this.dataViewSelect.addEventListener(
+        'change', e => this.notifySelectionChanged(e));
     this.datasetSelect.addEventListener(
         'change', e => this.notifySelectionChanged(e));
     this.gcSelect.addEventListener(
-        'change', e => this.notifySelectionChanged(e));
+      'change', e => this.notifySelectionChanged(e));
     this.$('#csv-export-btn')
         .addEventListener('click', e => this.exportCurrentSelection(e));
-    this.$('#merge-categories')
-        .addEventListener('change', e => this.notifySelectionChanged(e));
     this.$('#category-filter-btn')
         .addEventListener('click', e => this.filterCurrentSelection(e));
     this.$('#category-auto-filter-btn')
@@ -62,6 +66,10 @@ class DetailsSelection extends HTMLElement {
     return this.shadowRoot.querySelectorAll(query);
   }
 
+  get dataViewSelect() {
+    return this.$('#data-view-select');
+  }
+
   get datasetSelect() {
     return this.$('#dataset-select');
   }
@@ -128,6 +136,7 @@ class DetailsSelection extends HTMLElement {
   resetUI(resetIsolateSelect) {
     if (resetIsolateSelect) removeAllChildren(this.isolateSelect);
 
+    removeAllChildren(this.dataViewSelect);
     removeAllChildren(this.datasetSelect);
     removeAllChildren(this.gcSelect);
     this.clearCategories();
@@ -148,6 +157,13 @@ class DetailsSelection extends HTMLElement {
       return;
     }
     this.resetUI(false);
+    this.populateSelect(
+        '#data-view-select', [
+          [VIEW_BY_INSTANCE_TYPE, 'Selected instance types'],
+          [VIEW_BY_INSTANCE_CATEGORY, 'Selected type categories'],
+          [VIEW_BY_FIELD_TYPE, 'Field type statistics']
+        ],
+        (key, label) => label, VIEW_BY_INSTANCE_TYPE);
     this.populateSelect(
         '#dataset-select', this.selectedIsolate.data_sets.entries(), null,
         'live');
@@ -168,14 +184,19 @@ class DetailsSelection extends HTMLElement {
   notifySelectionChanged(e) {
     if (!this.selection.isolate) return;
 
+    this.selection.data_view = this.dataViewSelect.value;
     this.selection.categories = {};
-    for (let category of CATEGORIES.keys()) {
-      const selected = this.selectedInCategory(category);
-      if (selected.length > 0) this.selection.categories[category] = selected;
+    if (this.selection.data_view === VIEW_BY_FIELD_TYPE) {
+      this.$('#categories').style.display = 'none';
+    } else {
+      for (let category of CATEGORIES.keys()) {
+        const selected = this.selectedInCategory(category);
+        if (selected.length > 0) this.selection.categories[category] = selected;
+      }
+      this.$('#categories').style.display = 'block';
     }
     this.selection.category_names = CATEGORY_NAMES;
     this.selection.data_set = this.datasetSelect.value;
-    this.selection.merge_categories = this.$('#merge-categories').checked;
     this.selection.gc = this.gcSelect.value;
     this.setButtonState(false);
     this.updatePercentagesInCategory();
diff --git a/deps/v8/tools/heap-stats/global-timeline.js b/deps/v8/tools/heap-stats/global-timeline.js
index a32cf59135aed8..3830b7ca33ba58 100644
--- a/deps/v8/tools/heap-stats/global-timeline.js
+++ b/deps/v8/tools/heap-stats/global-timeline.js
@@ -57,6 +57,57 @@ class GlobalTimeline extends HTMLElement {
     }
   }
 
+  getFieldData() {
+    const labels = [
+      {type: 'number', label: 'Time'},
+      {type: 'number', label: 'Ptr compression benefit'},
+      {type: 'string', role: 'tooltip'},
+      {type: 'number', label: 'Embedder fields'},
+      {type: 'number', label: 'Tagged fields'},
+      {type: 'number', label: 'Other raw fields'},
+      {type: 'number', label: 'Unboxed doubles'}
+    ];
+    const chart_data = [labels];
+    const isolate_data = this.data[this.selection.isolate];
+    let sum_total = 0;
+    let sum_ptr_compr_benefit_perc = 0;
+    let count = 0;
+    Object.keys(isolate_data.gcs).forEach(gc_key => {
+      const gc_data = isolate_data.gcs[gc_key];
+      const data_set = gc_data[this.selection.data_set].field_data;
+      const data = [];
+      data.push(gc_data.time * kMillis2Seconds);
+      const total = data_set.tagged_fields +
+                    data_set.embedder_fields +
+                    data_set.other_raw_fields +
+                    data_set.unboxed_double_fields;
+      const ptr_compr_benefit = data_set.tagged_fields / 2;
+      const ptr_compr_benefit_perc = ptr_compr_benefit / total * 100;
+      sum_total += total;
+      sum_ptr_compr_benefit_perc += ptr_compr_benefit_perc;
+      count++;
+      const tooltip = "Ptr compression benefit: " +
+                      (ptr_compr_benefit / KB).toFixed(2) + "KB " +
+                      " (" + ptr_compr_benefit_perc.toFixed(2) + "%)";
+      data.push(ptr_compr_benefit / KB);
+      data.push(tooltip);
+      data.push(data_set.embedder_fields / KB);
+      data.push(data_set.tagged_fields / KB);
+      data.push(data_set.other_raw_fields / KB);
+      data.push(data_set.unboxed_double_fields / KB);
+      chart_data.push(data);
+    });
+    const avg_ptr_compr_benefit_perc =
+        count ? sum_ptr_compr_benefit_perc / count : 0;
+    console.log("==================================================");
+    console.log("= Average ptr compression benefit is " +
+                avg_ptr_compr_benefit_perc.toFixed(2) + "%");
+    console.log("= Average V8 heap size " +
+                (sum_total / count / KB).toFixed(2) + " KB");
+    console.log("==================================================");
+    return chart_data;
+  }
+
   getCategoryData() {
     const categories = Object.keys(this.selection.categories)
                            .map(k => this.selection.category_names.get(k));
@@ -102,14 +153,19 @@ class GlobalTimeline extends HTMLElement {
     return chart_data;
   }
 
-  drawChart() {
-    console.assert(this.data, 'invalid data');
-    console.assert(this.selection, 'invalid selection');
+  getChartData() {
+    switch (this.selection.data_view) {
+      case VIEW_BY_FIELD_TYPE:
+        return this.getFieldData();
+      case VIEW_BY_INSTANCE_CATEGORY:
+        return this.getCategoryData();
+      case VIEW_BY_INSTANCE_TYPE:
+      default:
+        return this.getInstanceTypeData();
+    }
+  }
 
-    const chart_data = (this.selection.merge_categories) ?
-        this.getCategoryData() :
-        this.getInstanceTypeData();
-    const data = google.visualization.arrayToDataTable(chart_data);
+  getChartOptions() {
     const options = {
       isStacked: true,
       hAxis: {
@@ -126,6 +182,27 @@ class GlobalTimeline extends HTMLElement {
       pointSize: 5,
       explorer: {},
     };
+    switch (this.selection.data_view) {
+      case VIEW_BY_FIELD_TYPE:
+        // Overlay pointer compression benefit on top of the graph
+        return Object.assign(options, {
+          series: {0: {type: 'line', lineDashStyle: [13, 13]}},
+        });
+      case VIEW_BY_INSTANCE_CATEGORY:
+      case VIEW_BY_INSTANCE_TYPE:
+      default:
+        return options;
+    }
+  }
+
+  drawChart() {
+    console.assert(this.data, 'invalid data');
+    console.assert(this.selection, 'invalid selection');
+
+    const chart_data = this.getChartData();
+
+    const data = google.visualization.arrayToDataTable(chart_data);
+    const options = this.getChartOptions();
     const chart = new google.visualization.AreaChart(this.$('#chart'));
     this.show();
     chart.draw(data, google.charts.Line.convertOptions(options));
diff --git a/deps/v8/tools/heap-stats/histogram-viewer.js b/deps/v8/tools/heap-stats/histogram-viewer.js
index d252f4cb1b7a15..240c6cbc7e318d 100644
--- a/deps/v8/tools/heap-stats/histogram-viewer.js
+++ b/deps/v8/tools/heap-stats/histogram-viewer.js
@@ -38,7 +38,10 @@ class HistogramViewer extends HTMLElement {
   }
 
   isValid() {
-    return this.data && this.selection;
+    return this.data && this.selection &&
+           (this.selection.data_view === VIEW_BY_INSTANCE_CATEGORY ||
+            this.selection.data_view === VIEW_BY_INSTANCE_TYPE);
+    ;
   }
 
   hide() {
@@ -49,11 +52,21 @@ class HistogramViewer extends HTMLElement {
     this.$('#container').style.display = 'block';
   }
 
+  getOverallValue() {
+    switch (this.selection.data_view) {
+      case VIEW_BY_FIELD_TYPE:
+        return NaN;
+      case VIEW_BY_INSTANCE_CATEGORY:
+        return this.getPropertyForCategory('overall');
+      case VIEW_BY_INSTANCE_TYPE:
+      default:
+        return this.getPropertyForInstanceTypes('overall');
+    }
+  }
+
   stateChanged() {
     if (this.isValid()) {
-      const overall_bytes = (this.selection.merge_categories) ?
-          this.getPropertyForCategory('overall') :
-          this.getPropertyForInstanceTypes('overall');
+      const overall_bytes = this.getOverallValue();
       this.$('#overall').innerHTML = `Overall: ${overall_bytes / KB} KB`;
       this.drawChart();
     } else {
@@ -143,10 +156,20 @@ class HistogramViewer extends HTMLElement {
     return [labels, ...data];
   }
 
+  getChartData() {
+    switch (this.selection.data_view) {
+      case VIEW_BY_FIELD_TYPE:
+        return this.getFieldData();
+      case VIEW_BY_INSTANCE_CATEGORY:
+        return this.getCategoryData();
+      case VIEW_BY_INSTANCE_TYPE:
+      default:
+        return this.getInstanceTypeData();
+    }
+  }
+
   drawChart() {
-    const chart_data = (this.selection.merge_categories) ?
-        this.getCategoryData() :
-        this.getInstanceTypeData();
+    const chart_data = this.getChartData();
     const data = google.visualization.arrayToDataTable(chart_data);
     const options = {
       legend: {position: 'top', maxLines: '1'},
diff --git a/deps/v8/tools/heap-stats/trace-file-reader.js b/deps/v8/tools/heap-stats/trace-file-reader.js
index 4ad1269835b095..03684978de70bb 100644
--- a/deps/v8/tools/heap-stats/trace-file-reader.js
+++ b/deps/v8/tools/heap-stats/trace-file-reader.js
@@ -126,6 +126,16 @@ class TraceFileReader extends HTMLElement {
     }
   }
 
+  addFieldTypeData(data, isolate, gc_id, data_set, tagged_fields,
+                   embedder_fields, unboxed_double_fields, other_raw_fields) {
+    data[isolate].gcs[gc_id][data_set].field_data = {
+      tagged_fields,
+      embedder_fields,
+      unboxed_double_fields,
+      other_raw_fields
+    };
+  }
+
   addInstanceTypeData(data, isolate, gc_id, data_set, instance_type, entry) {
     data[isolate].gcs[gc_id][data_set].instance_type_data[instance_type] = {
       overall: entry.overall,
@@ -194,6 +204,13 @@ class TraceFileReader extends HTMLElement {
                 const time = entry.time;
                 const gc_id = entry.id;
                 data[isolate].gcs[gc_id].time = time;
+
+                const field_data = entry.field_data;
+                this.addFieldTypeData(data, isolate, gc_id, data_set,
+                  field_data.tagged_fields, field_data.embedder_fields,
+                  field_data.unboxed_double_fields,
+                  field_data.other_raw_fields);
+
                 data[isolate].gcs[gc_id][data_set].bucket_sizes =
                     entry.bucket_sizes;
                 for (let [instance_type, value] of Object.entries(
@@ -251,6 +268,12 @@ class TraceFileReader extends HTMLElement {
         data[entry.isolate].gcs[entry.id].time = entry.time;
         if ('zone' in entry)
           data[entry.isolate].gcs[entry.id].malloced = entry.zone;
+      } else if (entry.type === 'field_data') {
+        this.createOrUpdateEntryIfNeeded(data, entry);
+        this.createDatasetIfNeeded(data, entry, entry.key);
+        this.addFieldTypeData(data, entry.isolate, entry.id, entry.key,
+          entry.tagged_fields, entry.embedder_fields,
+          entry.unboxed_double_fields, entry.other_raw_fields);
       } else if (entry.type === 'instance_type_data') {
         if (entry.id in data[entry.isolate].gcs) {
           this.createOrUpdateEntryIfNeeded(data, entry);
diff --git a/deps/v8/tools/ic-processor.js b/deps/v8/tools/ic-processor.js
index 9a78d16943f019..14f875bfdc3efd 100644
--- a/deps/v8/tools/ic-processor.js
+++ b/deps/v8/tools/ic-processor.js
@@ -32,11 +32,12 @@ function parseState(s) {
 
 
 function IcProcessor() {
-  var propertyICParser = [parseInt, parseInt, parseInt, null, null, parseInt,
-                          null, null, null];
+  var propertyICParser = [parseInt, parseInt, parseInt, parseString,
+      parseString, parseInt, parseString, parseString, parseString];
   LogReader.call(this, {
       'code-creation': {
-          parsers: [null, parseInt, parseInt, parseInt, parseInt, null, 'var-args'],
+          parsers: [parseString, parseInt, parseInt, parseInt, parseInt,
+              parseString, parseVarArgs],
           processor: this.processCodeCreation },
       'code-move': { parsers: [parseInt, parseInt],
           processor: this.processCodeMove },
diff --git a/deps/v8/tools/lldb_commands.py b/deps/v8/tools/lldb_commands.py
index d8946ee485a237..46e5e8b0fb78b6 100644
--- a/deps/v8/tools/lldb_commands.py
+++ b/deps/v8/tools/lldb_commands.py
@@ -2,24 +2,66 @@
 # Use of this source code is governed by a BSD-style license that can be
 # found in the LICENSE file.
 
+# Load this file by adding this to your ~/.lldbinit:
+# command script import <this_dir>/lldb_commands.py
+
 import lldb
 import re
 
+#####################
+# Helper functions. #
+#####################
+def current_thread(debugger):
+  return debugger.GetSelectedTarget().GetProcess().GetSelectedThread()
+
+def current_frame(debugger):
+  return current_thread(debugger).GetSelectedFrame()
+
+def no_arg_cmd(debugger, cmd):
+  current_frame(debugger).EvaluateExpression(cmd)
+  print("")
+
+def ptr_arg_cmd(debugger, name, param, cmd):
+  if not param:
+    print("'{}' requires an argument".format(name))
+    return
+  param = '(void*)({})'.format(param)
+  no_arg_cmd(debugger, cmd.format(param))
+
+#####################
+# lldb commands.    #
+#####################
+def job(debugger, param, *args):
+  """Print a v8 heap object"""
+  ptr_arg_cmd(debugger, 'job', param, "_v8_internal_Print_Object({})")
+
+def jlh(debugger, param, *args):
+  """Print v8::Local handle value"""
+  ptr_arg_cmd(debugger, 'jlh', param,
+              "_v8_internal_Print_Object(*(v8::internal::Object**)(*{}))")
+
+def jco(debugger, param, *args):
+  """Print the code object at the given pc (default: current pc)"""
+  if not param:
+    param = str(current_frame(debugger).FindRegister("pc").value)
+  ptr_arg_cmd(debugger, 'jco', param, "_v8_internal_Print_Code({})")
+
+def jld(debugger, param, *args):
+  """Print a v8 LayoutDescriptor object"""
+  ptr_arg_cmd(debugger, 'jld', param,
+              "_v8_internal_Print_LayoutDescriptor({})")
+
+def jtt(debugger, param, *args):
+  """Print the transition tree of a v8 Map"""
+  ptr_arg_cmd(debugger, 'jtt', param, "_v8_internal_Print_TransitionTree({})")
+
 def jst(debugger, *args):
   """Print the current JavaScript stack trace"""
-  target = debugger.GetSelectedTarget()
-  process = target.GetProcess()
-  thread = process.GetSelectedThread()
-  frame = thread.GetSelectedFrame()
-  frame.EvaluateExpression("_v8_internal_Print_StackTrace();")
-  print("")
+  no_arg_cmd(debugger, "_v8_internal_Print_StackTrace()")
 
 def jss(debugger, *args):
   """Skip the jitted stack on x64 to where we entered JS last"""
-  target = debugger.GetSelectedTarget()
-  process = target.GetProcess()
-  thread = process.GetSelectedThread()
-  frame = thread.GetSelectedFrame()
+  frame = current_frame(debugger)
   js_entry_sp = frame.EvaluateExpression(
       "v8::internal::Isolate::Current()->thread_local_top()->js_entry_sp_;") \
        .GetValue()
@@ -36,10 +78,7 @@ def bta(debugger, *args):
   func_name_re = re.compile("([^(<]+)(?:\(.+\))?")
   assert_re = re.compile(
       "^v8::internal::Per\w+AssertType::(\w+)_ASSERT, (false|true)>")
-  target = debugger.GetSelectedTarget()
-  process = target.GetProcess()
-  thread = process.GetSelectedThread()
-  frame = thread.GetSelectedFrame()
+  thread = current_thread(debugger)
   for frame in thread:
     functionSignature = frame.GetDisplayFunctionName()
     if functionSignature is None:
@@ -66,7 +105,8 @@ def bta(debugger, *args):
       print("%s -> %s %s (%s)\033[0m" % (
           color, prefix, match.group(2), match.group(1)))
 
-def __lldb_init_module (debugger, dict):
-  debugger.HandleCommand('command script add -f lldb_commands.jst jst')
-  debugger.HandleCommand('command script add -f lldb_commands.jss jss')
-  debugger.HandleCommand('command script add -f lldb_commands.bta bta')
+def __lldb_init_module(debugger, dict):
+  debugger.HandleCommand('settings set target.x86-disassembly-flavor intel')
+  for cmd in ('job', 'jlh', 'jco', 'jld', 'jtt', 'jst', 'jss', 'bta'):
+    debugger.HandleCommand(
+      'command script add -f lldb_commands.{} {}'.format(cmd, cmd))
diff --git a/deps/v8/tools/lldbinit b/deps/v8/tools/lldbinit
deleted file mode 100755
index be828dc630d19b..00000000000000
--- a/deps/v8/tools/lldbinit
+++ /dev/null
@@ -1,31 +0,0 @@
-# Copyright 2017 the V8 project authors. All rights reserved.
-# Use of this source code is governed by a BSD-style license that can be
-# found in the LICENSE file.
-
-# Print HeapObjects.
-command regex -h 'Print a v8 JavaScript object' job 's/(.+)/expr -- '_v8_internal_Print_Object((void*)(%1))/'
-
-# Print v8::Local handle value.
-command regex -h 'Print content of a v8::Local handle' jlh 's/(.+)/expr -- '_v8_internal_Print_Object(*(v8::internal::Object**)(*%1))/'
-
-# Print Code objects containing given PC.
-command regex -h 'Print a v8 Code object from an internal code address' jco 's/(.+)/expr -- '_v8_internal_Print_Code((void*)(*%1))/'
-
-# Print FeedbackVector
-command regex -h 'Print a v8 FeedbackVector object' jfv 's/(.+)/expr -- '_v8_internal_Print_FeedbackVector((void*)(%1))/'
-
-# Print FeedbackMetadata
-command regex -h 'Print a v8 FeedbackMetadata object' jfm 's/(.+)/expr -- '_v8_internal_Print_FeedbackMetadata((void*)(%1))/'
-
-# Print DescriptorArray.
-command regex -h 'Print a v8 DescriptorArray object' jda 's/(.+)/expr -- '_v8_internal_Print_DescriptorArray((void*)(%1))/'
-
-# Print LayoutDescriptor.
-command regex -h 'Print a v8 LayoutDescriptor object' jld 's/(.+)/expr -- '_v8_internal_Print_LayoutDescriptor((void*)(%1))/'
-
-# Print TransitionArray.
-command regex -h 'Print a v8 TransitionArray object' jta 's/(.+)/expr -- '_v8_internal_Print_TransitionArray((void*)(%1))/'
-
-command regex -h 'Print the transition tree of a v8 Map' jtt 's/(.+)/expr -- '_v8_internal_Print_TransitionTree((void*)(%1))/'
-
-command script import ~/lldb_commands.py
diff --git a/deps/v8/tools/logreader.js b/deps/v8/tools/logreader.js
index d9dfd17a86b4c1..ebdc55a618be3f 100644
--- a/deps/v8/tools/logreader.js
+++ b/deps/v8/tools/logreader.js
@@ -112,7 +112,7 @@ LogReader.prototype.processLogChunk = function(chunk) {
  */
 LogReader.prototype.processLogLine = function(line) {
   if (!this.timedRange_) {
-    this.processLog_([line]);
+    this.processLogLine_(line);
     return;
   }
   if (line.startsWith("current-time")) {
@@ -130,7 +130,7 @@ LogReader.prototype.processLogLine = function(line) {
     if (this.hasSeenTimerMarker_) {
       this.logLinesSinceLastTimerMarker_.push(line);
     } else if (!line.startsWith("tick")) {
-      this.processLog_([line]);
+      this.processLogLine_(line);
     }
   }
 };
@@ -175,6 +175,9 @@ LogReader.prototype.skipDispatch = function(dispatch) {
   return false;
 };
 
+// Parses dummy variable for readability;
+const parseString = 'parse-string';
+const parseVarArgs = 'parse-var-args';
 
 /**
  * Does a dispatch of a log record.
@@ -185,9 +188,8 @@ LogReader.prototype.skipDispatch = function(dispatch) {
 LogReader.prototype.dispatchLogRow_ = function(fields) {
   // Obtain the dispatch.
   var command = fields[0];
-  if (!(command in this.dispatchTable_)) return;
-
   var dispatch = this.dispatchTable_[command];
+  if (dispatch === undefined) return;
 
   if (dispatch === null || this.skipDispatch(dispatch)) {
     return;
@@ -197,14 +199,16 @@ LogReader.prototype.dispatchLogRow_ = function(fields) {
   var parsedFields = [];
   for (var i = 0; i < dispatch.parsers.length; ++i) {
     var parser = dispatch.parsers[i];
-    if (parser === null) {
+    if (parser === parseString) {
       parsedFields.push(fields[1 + i]);
     } else if (typeof parser == 'function') {
       parsedFields.push(parser(fields[1 + i]));
-    } else {
+    } else if (parser === parseVarArgs) {
       // var-args
       parsedFields.push(fields.slice(1 + i));
       break;
+    } else {
+      throw new Error("Invalid log field parser: " + parser);
     }
   }
 
@@ -220,11 +224,19 @@ LogReader.prototype.dispatchLogRow_ = function(fields) {
  * @private
  */
 LogReader.prototype.processLog_ = function(lines) {
-  for (var i = 0, n = lines.length; i < n; ++i, ++this.lineNum_) {
-    var line = lines[i];
-    if (!line) {
-      continue;
-    }
+  for (var i = 0, n = lines.length; i < n; ++i) {
+    this.processLogLine_(lines[i]);
+  }
+}
+
+/**
+ * Processes a single log line.
+ *
+ * @param {String} a log line
+ * @private
+ */
+LogReader.prototype.processLogLine_ = function(line) {
+  if (line.length > 0) {
     try {
       var fields = this.csvParser_.parseLine(line);
       this.dispatchLogRow_(fields);
@@ -232,4 +244,5 @@ LogReader.prototype.processLog_ = function(lines) {
       this.printError('line ' + (this.lineNum_ + 1) + ': ' + (e.message || e));
     }
   }
+  this.lineNum_++;
 };
diff --git a/deps/v8/tools/map-processor.js b/deps/v8/tools/map-processor.js
index 5b0e46909cc3e7..d7385cb6e9b61e 100644
--- a/deps/v8/tools/map-processor.js
+++ b/deps/v8/tools/map-processor.js
@@ -8,7 +8,8 @@ class MapProcessor extends LogReader {
     super();
     this.dispatchTable_ = {
       'code-creation': {
-        parsers: [null, parseInt, parseInt, parseInt, parseInt, null, 'var-args'],
+        parsers: [parseString, parseInt, parseInt, parseInt, parseInt,
+          parseString, parseVarArgs],
         processor: this.processCodeCreation
       },
       'code-move': {
@@ -24,17 +25,17 @@ class MapProcessor extends LogReader {
         processor: this.processFunctionMove
       },
       'map-create': {
-        parsers: [parseInt, parseInt, null],
+        parsers: [parseInt, parseInt, parseString],
         processor: this.processMapCreate
       },
       'map': {
-        parsers: [null, parseInt, parseInt, parseInt, parseInt, parseInt,
-          null, null, null
+        parsers: [parseString, parseInt, parseInt, parseInt, parseInt, parseInt,
+          parseString, parseString, parseString
         ],
         processor: this.processMap
       },
       'map-details': {
-        parsers: [parseInt, parseInt, null],
+        parsers: [parseInt, parseInt, parseString],
         processor: this.processMapDetails
       }
     };
diff --git a/deps/v8/tools/node/build_gn.py b/deps/v8/tools/node/build_gn.py
index e95c3491e74802..83071adbfe5143 100755
--- a/deps/v8/tools/node/build_gn.py
+++ b/deps/v8/tools/node/build_gn.py
@@ -25,15 +25,20 @@
 import node_common
 
 GN_ARGS = [
-  "v8_monolithic = true",
-  "is_component_build = false",
-  "v8_use_external_startup_data = false",
-  "use_custom_libcxx = false",
-  "use_sysroot = false",
+  "v8_monolithic=true",
+  "is_component_build=false",
+  "v8_use_external_startup_data=false",
+  "use_custom_libcxx=false",
 ]
 
 BUILD_TARGET = "v8_monolith"
 
+def FindTargetOs(flags):
+  for flag in flags:
+    if flag.startswith("target_os="):
+      return flag[len("target_os="):].strip('"')
+  raise Exception('No target_os was set.')
+
 def FindGn(options):
   if options.host_os == "linux":
     os_path = "linux64"
@@ -46,57 +51,93 @@ def FindGn(options):
   return os.path.join(options.v8_path, "buildtools", os_path, "gn")
 
 def GenerateBuildFiles(options):
-  print "Setting GN args."
   gn = FindGn(options)
-  gn_args = []
-  gn_args.extend(GN_ARGS)
+  gn_args = list(GN_ARGS)
+  target_os = FindTargetOs(options.flag)
+  if target_os != "win":
+    gn_args.append("use_sysroot=false")
+
   for flag in options.flag:
     flag = flag.replace("=1", "=true")
     flag = flag.replace("=0", "=false")
     flag = flag.replace("target_cpu=ia32", "target_cpu=\"x86\"")
     gn_args.append(flag)
-  if options.mode == "DEBUG":
-    gn_args.append("is_debug = true")
+  if options.mode == "Debug":
+    gn_args.append("is_debug=true")
   else:
-    gn_args.append("is_debug = false")
+    gn_args.append("is_debug=false")
+
+  flattened_args = ' '.join(gn_args)
+  if options.extra_gn_args:
+    flattened_args += ' ' + options.extra_gn_args
 
-  if not os.path.isdir(options.build_path):
-    os.makedirs(options.build_path)
-  with open(os.path.join(options.build_path, "args.gn"), "w") as args_file:
-    args_file.write("\n".join(gn_args))
-  subprocess.check_call([gn, "gen", "-C", options.build_path],
-                        cwd=options.v8_path)
+  args = [gn, "gen", options.build_path, "-q", "--args=" + flattened_args]
+  subprocess.check_call(args)
 
 def Build(options):
-  print "Building."
   depot_tools = node_common.EnsureDepotTools(options.v8_path, False)
   ninja = os.path.join(depot_tools, "ninja")
-  subprocess.check_call([ninja, "-v", "-C", options.build_path, BUILD_TARGET],
-                        cwd=options.v8_path)
+  if sys.platform == 'win32':
+    # Required because there is an extension-less file called "ninja".
+    ninja += ".exe"
+  args = [ninja, "-C", options.build_path, BUILD_TARGET]
+  if options.max_load:
+    args += ["-l" + options.max_load]
+  if options.max_jobs:
+    args += ["-j" + options.max_jobs]
+  else:
+    with open(os.path.join(options.build_path, "args.gn")) as f:
+      if "use_goma = true" in f.read():
+        args += ["-j500"]
+  subprocess.check_call(args)
 
 def ParseOptions(args):
   parser = argparse.ArgumentParser(
       description="Build %s with GN" % BUILD_TARGET)
   parser.add_argument("--mode", help="Build mode (Release/Debug)")
-  parser.add_argument("--v8_path", help="Path to V8")
-  parser.add_argument("--build_path", help="Path to build result")
+  parser.add_argument("--v8_path", help="Path to V8", required=True)
+  parser.add_argument("--build_path", help="Path to build result",
+                      required=True)
   parser.add_argument("--flag", help="Translate GYP flag to GN",
                       action="append")
   parser.add_argument("--host_os", help="Current operating system")
+  parser.add_argument("--bundled-win-toolchain",
+                      help="Value for DEPOT_TOOLS_WIN_TOOLCHAIN")
+  parser.add_argument("--bundled-win-toolchain-root",
+                      help="Value for DEPOT_TOOLS_WIN_TOOLCHAIN_ROOT")
+  parser.add_argument("--depot-tools", help="Absolute path to depot_tools")
+  parser.add_argument("--extra-gn-args", help="Additional GN args")
+  parser.add_argument("--build", help="Run ninja as opposed to gn gen.",
+                      action="store_true")
+  parser.add_argument("--max-jobs", help="ninja's -j parameter")
+  parser.add_argument("--max-load", help="ninja's -l parameter")
   options = parser.parse_args(args)
 
-  assert options.host_os
-  assert options.mode == "Debug" or options.mode == "Release"
+  options.build_path = os.path.abspath(options.build_path)
 
-  assert options.v8_path
-  options.v8_path = os.path.abspath(options.v8_path)
-  assert os.path.isdir(options.v8_path)
+  if not options.build:
+    assert options.host_os
+    assert options.mode == "Debug" or options.mode == "Release"
+
+    options.v8_path = os.path.abspath(options.v8_path)
+    assert os.path.isdir(options.v8_path)
 
-  assert options.build_path
-  options.build_path = os.path.abspath(options.build_path)
   return options
 
+
 if __name__ == "__main__":
   options = ParseOptions(sys.argv[1:])
-  GenerateBuildFiles(options)
-  Build(options)
+  # Build can result in running gn gen, so need to set environment variables
+  # for build as well as generate.
+  if options.bundled_win_toolchain:
+    os.environ['DEPOT_TOOLS_WIN_TOOLCHAIN'] = options.bundled_win_toolchain
+  if options.bundled_win_toolchain_root:
+    os.environ['DEPOT_TOOLS_WIN_TOOLCHAIN_ROOT'] = (
+        options.bundled_win_toolchain_root)
+  if options.depot_tools:
+    os.environ['PATH'] = (
+        options.depot_tools + os.path.pathsep + os.environ['PATH'])
+  if not options.build:
+    GenerateBuildFiles(options)
+  else:
+    Build(options)
diff --git a/deps/v8/tools/node/fetch_deps.py b/deps/v8/tools/node/fetch_deps.py
index 945dbb7677f4f3..26b9d6a72f6eec 100755
--- a/deps/v8/tools/node/fetch_deps.py
+++ b/deps/v8/tools/node/fetch_deps.py
@@ -43,18 +43,21 @@
 ]
 
 def EnsureGit(v8_path):
+  def git(args):
+    # shell=True needed on Windows to resolve git.bat.
+    return subprocess.check_output(
+        "git " + args, cwd=v8_path, shell=True).strip()
+
   expected_git_dir = os.path.join(v8_path, ".git")
-  actual_git_dir = subprocess.check_output(
-      ["git", "rev-parse", "--absolute-git-dir"], cwd=v8_path).strip()
+  actual_git_dir = git("rev-parse --absolute-git-dir")
   if expected_git_dir == actual_git_dir:
     print "V8 is tracked stand-alone by git."
     return False
   print "Initializing temporary git repository in v8."
-  subprocess.check_call(["git", "init"], cwd=v8_path)
-  subprocess.check_call(["git", "config", "user.name", "\"Ada Lovelace\""], cwd=v8_path)
-  subprocess.check_call(["git", "config", "user.email", "\"ada@lovela.ce\""], cwd=v8_path)
-  subprocess.check_call(["git", "commit", "--allow-empty", "-m", "init"],
-                        cwd=v8_path)
+  git("init")
+  git("config user.name \"Ada Lovelace\"")
+  git("config user.email ada@lovela.ce")
+  git("commit --allow-empty -m init")
   return True
 
 def FetchDeps(v8_path):
@@ -86,8 +89,8 @@ def FetchDeps(v8_path):
         os.path.join(v8_path, os.pardir, ".gclient_entries"))
     if os.path.isfile(gclient_entries):
       os.remove(gclient_entries)
-  # Enable building with GN for configure script.
-  return True
+
+  return depot_tools
 
 
 if __name__ == "__main__":
diff --git a/deps/v8/tools/node/node_common.py b/deps/v8/tools/node/node_common.py
index 72fbd9641aa44b..de2e98d9096461 100755
--- a/deps/v8/tools/node/node_common.py
+++ b/deps/v8/tools/node/node_common.py
@@ -4,6 +4,7 @@
 # found in the LICENSE file.
 
 import os
+import pipes
 import shutil
 import stat
 import subprocess
@@ -22,7 +23,10 @@ def _Get(v8_path):
       pass
     if fetch_if_not_exist:
       print "Checking out depot_tools."
-      subprocess.check_call(["git", "clone", DEPOT_TOOLS_URL, depot_tools])
+      # shell=True needed on Windows to resolve git.bat.
+      subprocess.check_call("git clone {} {}".format(
+          pipes.quote(DEPOT_TOOLS_URL),
+          pipes.quote(depot_tools)), shell=True)
       return depot_tools
     return None
   depot_tools = _Get(v8_path)
diff --git a/deps/v8/tools/parse-processor b/deps/v8/tools/parse-processor
index 588f120b4ee7cb..85a82d5479db4b 100755
--- a/deps/v8/tools/parse-processor
+++ b/deps/v8/tools/parse-processor
@@ -33,7 +33,8 @@ if [ ! -x "$d8_exec" ]; then
 fi
 
 # nm spits out 'no symbols found' messages to stderr.
-cat $log_file | $d8_exec --trace-maps --allow-natives-syntax --trace-deopt $tools_path/splaytree.js $tools_path/codemap.js \
+cat $log_file | $d8_exec --allow-natives-syntax \
+  $tools_path/splaytree.js $tools_path/codemap.js \
   $tools_path/csvparser.js $tools_path/consarray.js \
   $tools_path/profile.js $tools_path/profile_view.js \
   $tools_path/logreader.js $tools_path/arguments.js \
diff --git a/deps/v8/tools/parse-processor.html b/deps/v8/tools/parse-processor.html
index e41fffbd5f9563..c7418183cdd44c 100644
--- a/deps/v8/tools/parse-processor.html
+++ b/deps/v8/tools/parse-processor.html
@@ -62,10 +62,39 @@
     overflow-y: scroll;
   }
 
-
   .funktion {
   }
 
+  .script-size {
+    display: inline-block;
+    background-color: #505050;
+    border-radius: 3px;
+    padding: 3px;
+    margin: 2px;
+    white-space: nowrap;
+    overflow: hidden;
+    min-width: 2em;
+    text-decoration: none;
+    color: white;
+  }
+  .script-size.eval {
+    background-color: #ee6300fc;
+
+  }
+  .script-size.background {
+    background-color: #008aff;
+  }
+
+  .script-id {
+    display: inline;
+    padding-right: 2px;
+    margin-right: 2px;
+    border-right: 1px grey dotted;
+  }
+  .script-url {
+    display: inline;
+    text-overflow: ellipis;
+  }
 </style>
 <script src="./splaytree.js" type="text/javascript"></script>
 <script src="./codemap.js" type="text/javascript"></script>
@@ -149,19 +178,20 @@
 }
 
 function delay(t) {
-  return new Promise(resolve = > setTimeout(resolve, t));
+  return new Promise(resolve => setTimeout(resolve, t));
 }
 
 function renderParseResults(parseProcessor) {
   let result = $('#result');
   // clear out all existing result pages;
   result.innerHTML = '';
-  const start = parseProcessor.firstEvent;
-  const end = parseProcessor.lastEvent;
+  const start = parseProcessor.firstEventTimestamp;
+  const end = parseProcessor.lastEventTimestamp;
   renderScript(result, parseProcessor.totalScript, start, end);
   // Build up the graphs lazily to keep the page responsive.
   parseProcessor.scripts.forEach(
       script => renderScript(result, script, start, end));
+  renderScriptSizes(parseProcessor);
   // Install an intersection observer to lazily load the graphs when the script
   // div becomes visible for the first time.
   var io = new IntersectionObserver((entries, observer) => {
@@ -198,7 +228,31 @@
   summary.appendChild(text(script.summary));
   scriptDiv.appendChild(summary);
   result.appendChild(scriptDiv);
-  return scriptDiv;
+}
+
+function renderScriptSizes(parseProcessor) {
+  let scriptsDiv = $('#scripts');
+  parseProcessor.scripts.forEach(
+    script => {
+      let scriptDiv = a('#script'+script.id, '', 'script-size');
+      let scriptId = div('script-id');
+      scriptId.innerText = script.id;
+      scriptDiv.appendChild(scriptId);
+      let scriptUrl = div('script-url');
+      if (script.isEval) {
+        scriptUrl.innerText = "eval";
+        scriptDiv.classList.add('eval');
+      } else {
+        scriptUrl.innerText = script.file.split("/").pop();
+      }
+      if (script.isBackgroundCompiled ) {
+        scriptDiv.classList.add('background');
+      }
+      scriptDiv.appendChild(scriptUrl);
+      scriptDiv.style.width = script.bytesTotal * 0.001;
+      scriptsDiv.appendChild(scriptDiv);
+  
+    });
 }
 
 const kMaxTime = 120 * kSecondsToMillis;
@@ -206,13 +260,13 @@
 const kTimeIncrement = 1;
 const kSelectionTimespan = 2;
 const series = [
-//    ['firstParseEvent', 'Any Parse Event'],
+    ['firstParseEvent', 'Any Parse Event'],
+    ['execution', 'First Execution'],
     ['parse', 'Parsing'],
-//    ['preparse', 'Preparsing'],
-//    ['resolution', 'Preparsing with Var. Resolution'],
+    ['preparse', 'Preparsing'],
+    ['resolution', 'Preparsing with Var. Resolution'],
     ['lazyCompile', 'Lazy Compilation'],
     ['compile', 'Eager Compilation'],
-    ['execution', 'First Execution'],
 ];
 const metricNames = series.map(each => each[0]);
 
@@ -223,18 +277,21 @@
 
   console.time(timerLabel);
   let data = new google.visualization.DataTable();
-  data.addColumn('number', 'Time');
+  data.addColumn('number', 'Duration');
   // The series are interleave bytes processed, time spent and thus have two
-  // different vAxes.
+  // different vAxes. 
   let seriesOptions = [];
+  let colors = ['#4D4D4D', '#5DA5DA', '#FAA43A', '#60BD68', '#F17CB0',
+      '#B2912F', '#B276B2', '#DECF3F', '#F15854'];
   series.forEach(each => {
     let description = each[1];
+    let color = colors.shift();
     // Add the bytes column.
     data.addColumn('number', description + ' Bytes');
-    seriesOptions.push({targetAxisIndex: 0});
+    seriesOptions.push({targetAxisIndex: 0, color: color});
     // Add the time column.
-    data.addColumn('number', description + ' Time');
-    seriesOptions.push({targetAxisIndex: 1, lineDashStyle: [3, 2]});
+    data.addColumn('number', description + ' Duration');
+    seriesOptions.push({targetAxisIndex: 1, color: color, lineDashStyle: [3, 2]});
   });
   // The first entry contains the total.
   seriesOptions[0].type = 'area';
@@ -257,7 +314,7 @@
     },
     vAxes: {
       0: {title: 'Bytes Touched', format: 'short'},
-      1: {title: 'Time', format: '#,###ms'}
+      1: {title: 'Duration', format: '#,###ms'}
     },
     height: 400,
     width: 1000,
@@ -275,6 +332,7 @@
   google.visualization.events.addListener(chart, 'select',
       () => selectGraphPointHandler(chart, data, script, parentNode));
   chart.draw(data, options);
+  // Add event listeners 
   console.timeEnd(timerLabel);
 }
 
@@ -311,8 +369,6 @@
   container.appendChild(listNode);
   return container;
 }
-
-
 </script>
 </head>
 
@@ -326,10 +382,14 @@ <h2>Usage</h2>
   <h2>Data</h2>
   <form name="fileForm">
     <p>
-      <input id="uploadInput" type="file" name="files" onchange="loadFile();"> trace entries: <span id="count">0</span>
+      <input id="uploadInput" type="file" name="files" onchange="loadFile();" accept=".log"> trace entries: <span id="count">0</span>
     </p>
   </form>
 
+
+  <h2>Scripts</h2>
+  <div id="scripts"></div>
+
   <h2>Result</h2>
   <div id="result"></div>
 </body>
diff --git a/deps/v8/tools/parse-processor.js b/deps/v8/tools/parse-processor.js
index 30b593a15626cb..a561015f531a19 100644
--- a/deps/v8/tools/parse-processor.js
+++ b/deps/v8/tools/parse-processor.js
@@ -22,13 +22,13 @@ function readFile(fileName) {
 // confusion between the decimal and thousands separator is big (alternating
 // between comma "," vs dot "."). The Swiss formatting uses "'" as a thousands
 // separator, dropping most of that confusion.
-var numberFormat = new Intl.NumberFormat('de-CH', {
+const numberFormat = new Intl.NumberFormat('de-CH', {
   maximumFractionDigits: 2,
   minimumFractionDigits: 2,
 });
 
 function formatNumber(value) {
-  return formatNumber(value);
+  return numberFormat.format(value);
 }
 
 function BYTES(bytes, total) {
@@ -64,34 +64,67 @@ function timestampMin(list) {
 
 
 // ===========================================================================
-class Script {
-  constructor(file, id) {
-    this.file = file;
-    this.isNative = false;
-    this.id = id;
+const kNoTimeMetrics = {
+  __proto__: null,
+  executionDuration: 0,
+  firstEventTimestamp: 0,
+  firstParseEventTimestamp: 0,
+  lastParseEventTimestamp: 0,
+  lastEventTimestamp: 0
+};
+
+class CompilationUnit {
+  constructor() {
+    // Lazily computed properties.
+    this.firstEventTimestamp = -1;
+    this.firstParseEventTimestamp = -1;
+    this.lastParseEventTimestamp = -1;
+    this.lastEventTimestamp = -1;
+
+    this.preparseTimestamp = -1;
+    this.parseTimestamp = -1;
+    this.parse2Timestamp = -1;
+    this.resolutionTimestamp = -1;
+    this.lazyCompileTimestamp = -1;
+    this.compileTimestamp = -1;
+    this.executionTimestamp = -1;
+
+    this.preparseDuration = -0.0;
+    this.parseDuration = -0.0;
+    this.parse2Duration = -0.0;
+    this.resolutionDuration = -0.0;
+    this.scopeResolutionDuration = -0.0;
+    this.lazyCompileDuration = -0.0;
+    this.compileDuration = -0.0;
+
+    this.ownBytes = -1;
+  }
+}
+
+// ===========================================================================
+class Script extends CompilationUnit {
+  constructor(id) {
+    super();
     if (id === void 0 || id <= 0) {
-      throw new Error(`Invalid id=${id} for script with file='${file}'`);
+      throw new Error(`Invalid id=${id} for script`);
     }
+    this.file = '';
+    this.id = id;
+
+    this.isNative = false;
     this.isEval = false;
+    this.isBackgroundCompiled = false;
+    this.isDeserialized = false;
+
     this.funktions = [];
     this.metrics = new Map();
     this.maxNestingLevel = 0;
 
-    this.firstEvent = -1;
-    this.firstParseEvent = -1;
-    this.lastParseEvent = -1;
-    this.executionTimestamp = -1;
-    this.compileTimestamp = -1;
-    this.lastEvent = -1;
-
-    this.compileTime = -0.0;
-
     this.width = 0;
-    this.bytesTotal = 0;
-    this.ownBytes = -1;
+    this.bytesTotal = -1;
     this.finalized = false;
     this.summary = '';
-    this.setFile(file);
+    this.source = '';
   }
 
   setFile(name) {
@@ -104,7 +137,9 @@ class Script {
   }
 
   funktionAtPosition(start) {
-    if (start === 0) throw "position 0 is reserved for the script";
+    if (!this.isEval && start === 0) {
+      throw 'position 0 is reserved for the script';
+    }
     if (this.finalized) throw 'Finalized script has no source position!';
     return this.funktions[start];
   }
@@ -150,18 +185,42 @@ class Script {
         }
         parent = fn;
       }
-      this.firstParseEvent = this.firstParseEvent === -1 ?
-        fn.getFirstParseEvent() :
-        Math.min(this.firstParseEvent, fn.getFirstParseEvent());
-      this.lastParseEvent =
-        Math.max(this.lastParseEvent, fn.getLastParseEvent());
-      fn.getFirstEvent();
-      if (Number.isNaN(this.lastEvent)) throw "Invalid lastEvent";
-      this.lastEvent = Math.max(this.lastEvent, fn.getLastEvent());
-      if (Number.isNaN(this.lastEvent)) throw "Invalid lastEvent";
+      this.firstParseEventTimestamp = this.firstParseEventTimestamp === -1 ?
+          fn.getFirstParseEventTimestamp() :
+          Math.min(
+              this.firstParseEventTimestamp, fn.getFirstParseEventTimestamp());
+      this.lastParseEventTimestamp = Math.max(
+          this.lastParseEventTimestamp, fn.getLastParseEventTimestamp());
+      fn.getFirstEventTimestamp();
+      if (Number.isNaN(this.lastEventTimestamp)) {
+        throw 'Invalid lastEventTimestamp';
+      }
+      this.lastEventTimestamp =
+          Math.max(this.lastEventTimestamp, fn.getLastEventTimestamp());
+      if (Number.isNaN(this.lastEventTimestamp)) {
+        throw 'Invalid lastEventTimestamp';
+      }
     });
     this.maxNestingLevel = maxNesting;
-    this.getFirstEvent();
+    this.getFirstEventTimestamp();
+
+    // Initialize sizes.
+    if (!this.ownBytes === -1) throw 'Invalid state';
+    if (this.funktions.length == 0) {
+      this.bytesTotal = this.ownBytes = 0;
+      return;
+    }
+    let toplevelFunktionBytes = this.funktions.reduce(
+        (bytes, each) => bytes + (each.isToplevel() ? each.getBytes() : 0), 0);
+    if (this.isDeserialized || this.isEval || this.isBackgroundCompiled) {
+      if (this.getBytes() === -1) {
+        this.bytesTotal = toplevelFunktionBytes;
+      }
+    }
+    this.ownBytes = this.bytesTotal - toplevelFunktionBytes;
+    if (this.ownBytes < 0) {
+      console.error(this, 'Own bytes must be positive');
+    }
   }
 
   print() {
@@ -180,22 +239,16 @@ class Script {
   }
 
   getOwnBytes() {
-    if (this.ownBytes === -1) {
-      this.ownBytes = this.funktions.reduce(
-        (bytes, each) => bytes - each.parent == null ? each.getBytes() : 0,
-        this.getBytes());
-      if (this.ownBytes < 0) throw "Own bytes must be positive";
-    }
     return this.ownBytes;
   }
 
   // Also see Funktion.prototype.getMetricBytes
   getMetricBytes(name) {
     if (name == 'lazyCompileTimestamp') return this.getOwnBytes();
-    return this.getBytes();
+    return this.getOwnBytes();
   }
 
-  getMetricTime(name) {
+  getMetricDuration(name) {
     return this[name];
   }
 
@@ -235,55 +288,58 @@ class Script {
     };
 
     log("  - file:         " + this.file);
+    log('  - details:      ' +
+        'isEval=' + this.isEval + ' deserialized=' + this.isDeserialized +
+        ' streamed=' + this.isBackgroundCompiled);
     info("scripts", this.getScripts());
     info("functions", all);
     info("toplevel fn", all.filter(each => each.isToplevel()));
-    info("preparsed", all.filter(each => each.preparseTime > 0));
-
+    info('preparsed', all.filter(each => each.preparseDuration > 0));
 
-    info("fully parsed", all.filter(each => each.parseTime > 0));
-    // info("fn parsed", all.filter(each => each.parse2Time > 0));
-    // info("resolved", all.filter(each => each.resolutionTime > 0));
+    info('fully parsed', all.filter(each => each.parseDuration > 0));
+    // info("fn parsed", all.filter(each => each.parse2Duration > 0));
+    // info("resolved", all.filter(each => each.resolutionDuration > 0));
     info("executed", all.filter(each => each.executionTimestamp > 0));
     info("forEval", all.filter(each => each.fromEval));
     info("lazy compiled", all.filter(each => each.lazyCompileTimestamp > 0));
     info("eager compiled", all.filter(each => each.compileTimestamp > 0));
 
-    let parsingCost = new ExecutionCost('parse', all,
-      each => each.parseTime);
+    let parsingCost =
+        new ExecutionCost('parse', all, each => each.parseDuration);
     parsingCost.setMetrics(this.metrics);
-    log(parsingCost.toString())
+    log(parsingCost.toString());
 
-    let preParsingCost = new ExecutionCost('preparse', all,
-      each => each.preparseTime);
+    let preParsingCost =
+        new ExecutionCost('preparse', all, each => each.preparseDuration);
     preParsingCost.setMetrics(this.metrics);
-    log(preParsingCost.toString())
+    log(preParsingCost.toString());
 
-    let resolutionCost = new ExecutionCost('resolution', all,
-      each => each.resolutionTime);
+    let resolutionCost =
+        new ExecutionCost('resolution', all, each => each.resolutionDuration);
     resolutionCost.setMetrics(this.metrics);
-    log(resolutionCost.toString())
+    log(resolutionCost.toString());
 
     let nesting = new NestingDistribution(all);
     nesting.setMetrics(this.metrics);
-    log(nesting.toString())
+    log(nesting.toString());
 
     if (printSummary) console.log(this.summary);
   }
 
   getAccumulatedTimeMetrics(metrics, start, end, delta, incremental = false) {
     // Returns an array of the following format:
-    // [ [start, acc(metric0, start, start), acc(metric1, ...), ...],
-    //   [start+delta, acc(metric0, start, start+delta), ...],
+    // [ [start,         acc(metric0, start, start), acc(metric1, ...), ...],
+    //   [start+delta,   acc(metric0, start, start+delta), ...],
     //   [start+delta*2, acc(metric0, start, start+delta*2), ...],
     //   ...
     // ]
+    if (end <= start) throw 'Invalid ranges [' + start + ',' + end + ']';
     const timespan = end - start;
     const kSteps = Math.ceil(timespan / delta);
     // To reduce the time spent iterating over the funktions of this script
     // we iterate once over all funktions and add the metric changes to each
     // timepoint:
-    // [ [0, 300, ...], [1, 15, ...], [2, 100, ...], [3, 0, ...] ... ]
+    // [ [0, 300, ...], [1,  15, ...], [2, 100, ...], [3,   0, ...] ... ]
     // In a second step we accumulate all values:
     // [ [0, 300, ...], [1, 315, ...], [2, 415, ...], [3, 415, ...] ... ]
     //
@@ -293,7 +349,7 @@ class Script {
     const metricProperties = ["time"];
     metrics.forEach(each => {
       metricProperties.push(each + 'Timestamp');
-      metricProperties.push(each + 'Time');
+      metricProperties.push(each + 'Duration');
     });
     // Create a packed {rowTemplate} which is copied later-on.
     let indexToTime = (t) => (start + t * delta) / kSecondsToMillis;
@@ -305,12 +361,14 @@ class Script {
     // Create the real metric's property name on the Funktion object.
     // Add the increments of each Funktion's metric to the result.
     this.forEach(funktionOrScript => {
-      // Iterate over the Funktion's metric names, position 0 is the time.
+      // Iterate over the Funktion's metric names, skipping position 0 which
+      // is the time.
       for (let i = 1; i < metricProperties.length; i += 2) {
-        let property = metricProperties[i];
-        let timestamp = funktionOrScript[property];
+        let timestampPropertyName = metricProperties[i];
+        let timestamp = funktionOrScript[timestampPropertyName];
         if (timestamp === void 0) continue;
-        if (timestamp < 0 || end < timestamp) continue;
+        if (timestamp < start || end < timestamp) continue;
+        timestamp -= start;
         let index = Math.floor(timestamp / delta);
         let row = rows[index];
         if (row === null) {
@@ -320,9 +378,9 @@ class Script {
           row[0] = indexToTime(index);
         }
         // Add the metric value.
-        row[i] += funktionOrScript.getMetricBytes(property);
-        let timeMetricName = metricProperties[i + 1];
-        row[i + 1] += funktionOrScript.getMetricTime(timeMetricName);
+        row[i] += funktionOrScript.getMetricBytes(timestampPropertyName);
+        let durationPropertyName = metricProperties[i + 1];
+        row[i + 1] += funktionOrScript.getMetricDuration(durationPropertyName);
       }
     });
     // Create a packed array again with only the valid entries.
@@ -375,12 +433,12 @@ class Script {
     return result;
   }
 
-  getFirstEvent() {
-    if (this.firstEvent === -1) {
+  getFirstEventTimestamp() {
+    if (this.firstEventTimestamp === -1) {
       // TODO(cbruni): add support for network request timestanp
-      this.firstEvent = this.firstParseEvent;
+      this.firstEventTimestamp = this.firstParseEventTimestamp;
     }
-    return this.firstEvent;
+    return this.firstEventTimestamp;
   }
 }
 
@@ -491,67 +549,41 @@ class ExecutionCost {
 }
 
 // ===========================================================================
-const kNoTimeMetrics = {
-  __proto__: null,
-  executionTime: 0,
-  firstEventTimestamp: 0,
-  firstParseEventTimestamp: 0,
-  lastParseTimestamp: 0,
-  lastEventTimestamp: 0
-};
 
-class Funktion {
+class Funktion extends CompilationUnit {
   constructor(name, start, end, script) {
+    super();
     if (start < 0) throw "invalid start position: " + start;
-    if (end <= 0) throw "invalid end position: " + end;
-    if (end <= start) throw "invalid start end positions";
+    if (script.isEval) {
+      if (end < start) throw 'invalid start end positions';
+    } else {
+      if (end <= 0) throw 'invalid end position: ' + end;
+      if (end <= start) throw 'invalid start end positions';
+    }
 
     this.name = name;
     this.start = start;
     this.end = end;
-    this.ownBytes = -1;
     this.script = script;
     this.parent = null;
     this.fromEval = false;
     this.nested = [];
     this.nestingLevel = 0;
 
-    this.preparseTimestamp = -1;
-    this.parseTimestamp = -1;
-    this.parse2Timestamp = -1;
-    this.resolutionTimestamp = -1;
-    this.lazyCompileTimestamp = -1;
-    this.compileTimestamp = -1;
-    this.executionTimestamp = -1;
-
-    this.preparseTime = -0.0;
-    this.parseTime = -0.0;
-    this.parse2Time = -0.0;
-    this.resolutionTime = -0.0;
-    this.scopeResolutionTime = -0.0;
-    this.lazyCompileTime = -0.0;
-    this.compileTime = -0.0;
-
-    // Lazily computed properties.
-    this.firstEventTimestamp = -1;
-    this.firstParseEventTimestamp = -1;
-    this.lastParseTimestamp = -1;
-    this.lastEventTimestamp = -1;
-
     if (script) this.script.addFunktion(this);
   }
 
   getMetricBytes(name) {
     if (name == 'lazyCompileTimestamp') return this.getOwnBytes();
-    return this.getBytes();
+    return this.getOwnBytes();
   }
 
-  getMetricTime(name) {
+  getMetricDuration(name) {
     if (name in kNoTimeMetrics) return 0;
     return this[name];
   }
 
-  getFirstEvent() {
+  getFirstEventTimestamp() {
     if (this.firstEventTimestamp === -1) {
       this.firstEventTimestamp = timestampMin(
         [this.parseTimestamp, this.preparseTimestamp,
@@ -564,7 +596,7 @@ class Funktion {
     return this.firstEventTimestamp;
   }
 
-  getFirstParseEvent() {
+  getFirstParseEventTimestamp() {
     if (this.firstParseEventTimestamp === -1) {
       this.firstParseEventTimestamp = timestampMin(
         [this.parseTimestamp, this.preparseTimestamp,
@@ -577,23 +609,23 @@ class Funktion {
     return this.firstParseEventTimestamp;
   }
 
-  getLastParseEvent() {
-    if (this.lastParseTimestamp === -1) {
-      this.lastParseTimestamp = Math.max(
-        this.preparseTimestamp + this.preparseTime,
-        this.parseTimestamp + this.parseTime,
-        this.resolutionTimestamp + this.resolutionTime);
-      if (!(this.lastParseTimestamp > 0)) {
-        this.lastParseTimestamp = 0;
+  getLastParseEventTimestamp() {
+    if (this.lastParseEventTimestamp === -1) {
+      this.lastParseEventTimestamp = Math.max(
+          this.preparseTimestamp + this.preparseDuration,
+          this.parseTimestamp + this.parseDuration,
+          this.resolutionTimestamp + this.resolutionDuration);
+      if (!(this.lastParseEventTimestamp > 0)) {
+        this.lastParseEventTimestamp = 0;
       }
     }
-    return this.lastParseTimestamp;
+    return this.lastParseEventTimestamp;
   }
 
-  getLastEvent() {
+  getLastEventTimestamp() {
     if (this.lastEventTimestamp === -1) {
-      this.lastEventTimestamp = Math.max(
-        this.getLastParseEvent(), this.executionTimestamp);
+      this.lastEventTimestamp =
+          Math.max(this.getLastParseEventTimestamp(), this.executionTimestamp);
       if (!(this.lastEventTimestamp > 0)) {
         this.lastEventTimestamp = 0;
       }
@@ -687,25 +719,58 @@ function startOf(timestamp, time) {
 class ParseProcessor extends LogReader {
   constructor() {
     super();
-    let config = (processor) => {
-      // {script file},{script id},{start position},{end position},
-      // {time},{timestamp},{function name}
-      return {
-        parsers: [null, parseInt, parseInt, parseInt, parseFloat, parseInt, null],
-        processor: processor
-      }
-    };
-
     this.dispatchTable_ = {
-      'parse-full': config(this.processFull),
-      'parse-function': config(this.processFunction),
-      'parse-script': config(this.processScript),
-      'parse-eval': config(this.processEval),
-      'preparse-no-resolution': config(this.processPreparseNoResolution),
-      'preparse-resolution': config(this.processPreparseResolution),
-      'first-execution': config(this.processFirstExecution),
-      'compile-lazy': config(this.processCompileLazy),
-      'compile': config(this.processCompile)
+      // Avoid accidental leaking of __proto__ properties and force this object
+      // to be in dictionary-mode.
+      __proto__: null,
+      // "function",{event type},
+      // {script id},{start position},{end position},{time},{timestamp},
+      // {function name}
+      'function': {
+        parsers: [
+          parseString, parseInt, parseInt, parseInt, parseFloat, parseInt,
+          parseString
+        ],
+        processor: this.processFunctionEvent
+      },
+      // "compilation-cache", "hit"|"put", {type}, {start position},
+      // {end position}
+      'compilation-cache': {
+        parsers: [parseString, parseString, parseInt, parseInt],
+        processor: this.processCompilationCacheEvent
+      },
+      'script': {
+        parsers: [parseString, parseInt],
+        processor: this.processScriptEvent
+      },
+      // "script-details", {script_id}, {file}, {line}, {column}, {size}
+      'script-details': {
+        parsers: [parseInt, parseString, parseInt, parseInt, parseInt],
+        processor: this.processScriptDetails
+      },
+      'script-source': {
+        parsers: [parseInt, parseString, parseString],
+        processor: this.processScriptSource
+      },
+    };
+    this.functionEventDispatchTable_ = {
+      // Avoid accidental leaking of __proto__ properties and force this object
+      // to be in dictionary-mode.
+      __proto__: null,
+      'full-parse': this.processFull.bind(this),
+      'parse-function': this.processParseFunction.bind(this),
+      // TODO(cbruni): make sure arrow functions emit a normal parse-function
+      // event.
+      'parse': this.processParseFunction.bind(this),
+      'parse-script': this.processScript.bind(this),
+      'parse-eval': this.processEval.bind(this),
+      'preparse-no-resolution': this.processPreparseNoResolution.bind(this),
+      'preparse-resolution': this.processPreparseResolution.bind(this),
+      'first-execution': this.processFirstExecution.bind(this),
+      'compile-lazy': this.processCompileLazy.bind(this),
+      'compile': this.processCompile.bind(this),
+      'compile-eval': this.processCompileEval.bind(this),
+      'optimize-lazy': this.processOptimizeLazy.bind(this)
     };
 
     this.idToScript = new Map();
@@ -713,9 +778,9 @@ class ParseProcessor extends LogReader {
     this.nameToFunction = new Map();
     this.scripts = [];
     this.totalScript = new TotalScript();
-    this.firstEvent = -1;
-    this.lastParseEvent = -1;
-    this.lastEvent = -1;
+    this.firstEventTimestamp = -1;
+    this.lastParseEventTimestamp = -1;
+    this.lastEventTimestamp = -1;
   }
 
   print() {
@@ -755,54 +820,60 @@ class ParseProcessor extends LogReader {
     this.scripts = Array.from(this.idToScript.values())
       .filter(each => !each.isNative);
 
-    this.scripts.forEach(script => script.finalize());
-    this.scripts.forEach(script => script.calculateMetrics(false));
+    this.scripts.forEach(script => {
+      script.finalize();
+      script.calculateMetrics(false)
+    });
 
-    this.firstEvent =
-      timestampMin(this.scripts.map(each => each.firstEvent));
-    this.lastParseEvent = this.scripts.reduce(
-      (max, script) => Math.max(max, script.lastParseEvent), -1);
-    this.lastEvent = this.scripts.reduce(
-      (max, script) => Math.max(max, script.lastEvent), -1);
+    this.firstEventTimestamp =
+        timestampMin(this.scripts.map(each => each.firstEventTimestamp));
+    this.lastParseEventTimestamp = this.scripts.reduce(
+        (max, script) => Math.max(max, script.lastParseEventTimestamp), -1);
+    this.lastEventTimestamp = this.scripts.reduce(
+        (max, script) => Math.max(max, script.lastEventTimestamp), -1);
 
     this.scripts.forEach(script => this.totalScript.addAllFunktions(script));
     this.totalScript.calculateMetrics(true);
-    const series = [
-      ['firstParseEvent', 'Any Parse Event'],
-      ['parse', 'Parsing'],
-      ['preparse', 'Preparsing'],
-      ['resolution', 'Preparsing with Var. Resolution'],
-      ['lazyCompile', 'Lazy Compilation'],
-      ['compile', 'Eager Compilation'],
-      ['execution', 'First Execution'],
-    ];
-    let metrics = series.map(each => each[0]);
-    this.totalScript.getAccumulatedTimeMetrics(metrics, 0, this.lastEvent, 10);
-  };
+    const series = {
+      firstParseEvent: 'Any Parse Event',
+      parse: 'Parsing',
+      preparse: 'Preparsing',
+      resolution: 'Preparsing with Var. Resolution',
+      lazyCompile: 'Lazy Compilation',
+      compile: 'Eager Compilation',
+      execution: 'First Execution',
+    };
+    let metrics = Object.keys(series);
+    this.totalScript.getAccumulatedTimeMetrics(
+        metrics, 0, this.lastEventTimestamp, 10);
+  }
+
+  processFunctionEvent(
+      eventName, scriptId, startPosition, endPosition, duration, timestamp,
+      functionName) {
+    let handlerFn = this.functionEventDispatchTable_[eventName];
+    if (handlerFn === undefined) {
+      console.error('Couldn\'t find handler for function event:' + eventName);
+    }
+    handlerFn(
+        scriptId, startPosition, endPosition, duration, timestamp,
+        functionName);
+  }
 
   addEntry(entry) {
     this.entries.push(entry);
   }
 
-  lookupScript(file, id) {
-    // During preparsing we only have the temporary ranges and no script yet.
-    let script;
-    if (this.idToScript.has(id)) {
-      script = this.idToScript.get(id);
-    } else {
-      script = new Script(file, id);
-      this.idToScript.set(id, script);
-    }
-    if (file.length > 0 && script.file.length === 0) {
-      script.setFile(file);
-      this.fileToScript.set(file, script);
-    }
-    return script;
+  lookupScript(id) {
+    return this.idToScript.get(id);
   }
 
-  lookupFunktion(file, scriptId,
-    startPosition, endPosition, time, timestamp, functionName) {
-    let script = this.lookupScript(file, scriptId);
+  getOrCreateFunction(
+      scriptId, startPosition, endPosition, duration, timestamp, functionName) {
+    if (scriptId == -1) {
+      return this.lookupFunktionByRange(startPosition, endPosition);
+    }
+    let script = this.lookupScript(scriptId);
     let funktion = script.funktionAtPosition(startPosition);
     if (funktion === void 0) {
       funktion = new Funktion(functionName, startPosition, endPosition, script);
@@ -810,60 +881,108 @@ class ParseProcessor extends LogReader {
     return funktion;
   }
 
-  processEval(file, scriptId, startPosition,
-    endPosition, time, timestamp, functionName) {
-    let script = this.lookupScript(file, scriptId);
+  // Iterates over all functions and tries to find matching ones.
+  lookupFunktionsByRange(start, end) {
+    let results = [];
+    this.idToScript.forEach(script => {
+      script.forEach(funktion => {
+        if (funktion.startPostion == start && funktion.endPosition == end) {
+          results.push(funktion);
+        }
+      });
+    });
+    return results;
+  }
+  lookupFunktionByRange(start, end) {
+    let results = this.lookupFunktionsByRange(start, end);
+    if (results.length != 1) throw "Could not find unique function by range";
+    return results[0];
+  }
+
+  processScriptEvent(eventName, scriptId) {
+    if (['create', 'reserve-id', 'deserialize'].includes(eventName)) {
+      if (this.idToScript.has(scriptId)) return;
+      let script = new Script(scriptId);
+      this.idToScript.set(scriptId, script);
+      if (eventName == 'deserialize') script.isDeserialized = true;
+      return;
+    } else if (eventName === 'background-compile') {
+      this.idToScript.get(scriptId).isBackgroundCompiled = true;
+      return;
+    }
+    console.error('Unhandled script event: ' + eventName);
+  }
+
+  processScriptDetails(scriptId, file, startLine, startColumn, size) {
+    let script = this.lookupScript(scriptId);
+    script.setFile(file);
+  }
+
+  processScriptSource(scriptId, url, source) {
+    let script = this.lookupScript(scriptId);
+    script.source = source;
+  }
+
+  processEval(
+      scriptId, startPosition, endPosition, duration, timestamp, functionName) {
+    let script = this.lookupScript(scriptId);
     script.isEval = true;
   }
 
-  processFull(file, scriptId, startPosition,
-    endPosition, time, timestamp, functionName) {
-    let funktion = this.lookupFunktion(...arguments);
+  processFull(
+      scriptId, startPosition, endPosition, duration, timestamp, functionName) {
+    if (startPosition == 0) {
+      // This should only happen for eval.
+      let script = this.lookupScript(scriptId);
+      script.isEval = true;
+      return;
+    }
+    let funktion = this.getOrCreateFunction(...arguments);
     // TODO(cbruni): this should never happen, emit differen event from the
     // parser.
     if (funktion.parseTimestamp > 0) return;
-    funktion.parseTimestamp = startOf(timestamp, time);
-    funktion.parseTime = time;
+    funktion.parseTimestamp = startOf(timestamp, duration);
+    funktion.parseDuration = duration;
   }
 
-  processFunction(file, scriptId, startPosition,
-    endPosition, time, timestamp, functionName) {
-    let funktion = this.lookupFunktion(...arguments);
-    funktion.parseTimestamp = startOf(timestamp, time);
-    funktion.parseTime = time;
+  processParseFunction(
+      scriptId, startPosition, endPosition, duration, timestamp, functionName) {
+    let funktion = this.getOrCreateFunction(...arguments);
+    funktion.parseTimestamp = startOf(timestamp, duration);
+    funktion.parseDuration = duration;
   }
 
-  processScript(file, scriptId, startPosition,
-    endPosition, time, timestamp, functionName) {
-    // TODO timestamp and time
-    let script = this.lookupScript(file, scriptId);
-    let ts = startOf(timestamp, time);
+  processScript(
+      scriptId, startPosition, endPosition, duration, timestamp, functionName) {
+    // TODO timestamp and duration
+    let script = this.lookupScript(scriptId);
+    let ts = startOf(timestamp, duration);
     script.parseTimestamp = ts;
     script.firstEventTimestamp = ts;
     script.firstParseEventTimestamp = ts;
-    script.parseTime = time;
+    script.parseDuration = duration;
   }
 
-  processPreparseResolution(file, scriptId,
-    startPosition, endPosition, time, timestamp, functionName) {
-    let funktion = this.lookupFunktion(...arguments);
+  processPreparseResolution(
+      scriptId, startPosition, endPosition, duration, timestamp, functionName) {
+    let funktion = this.getOrCreateFunction(...arguments);
     // TODO(cbruni): this should never happen, emit different event from the
     // parser.
     if (funktion.resolutionTimestamp > 0) return;
-    funktion.resolutionTimestamp = startOf(timestamp, time);
-    funktion.resolutionTime = time;
+    funktion.resolutionTimestamp = startOf(timestamp, duration);
+    funktion.resolutionDuration = duration;
   }
 
-  processPreparseNoResolution(file, scriptId,
-    startPosition, endPosition, time, timestamp, functionName) {
-    let funktion = this.lookupFunktion(...arguments);
-    funktion.preparseTimestamp = startOf(timestamp, time);
-    funktion.preparseTime = time;
+  processPreparseNoResolution(
+      scriptId, startPosition, endPosition, duration, timestamp, functionName) {
+    let funktion = this.getOrCreateFunction(...arguments);
+    funktion.preparseTimestamp = startOf(timestamp, duration);
+    funktion.preparseDuration = duration;
   }
 
-  processFirstExecution(file, scriptId,
-    startPosition, endPosition, time, timestamp, functionName) {
-    let script = this.lookupScript(file, scriptId);
+  processFirstExecution(
+      scriptId, startPosition, endPosition, duration, timestamp, functionName) {
+    let script = this.lookupScript(scriptId);
     if (startPosition === 0) {
       // undefined = eval fn execution
       if (script) {
@@ -879,28 +998,43 @@ class ParseProcessor extends LogReader {
     }
   }
 
-  processCompileLazy(file, scriptId,
-    startPosition, endPosition, time, timestamp, functionName) {
-    let funktion = this.lookupFunktion(...arguments);
-    funktion.lazyCompileTimestamp = startOf(timestamp, time);
-    funktion.lazyCompileTime = time;
-    script.firstPar
+  processCompileLazy(
+      scriptId, startPosition, endPosition, duration, timestamp, functionName) {
+    let funktion = this.getOrCreateFunction(...arguments);
+    funktion.lazyCompileTimestamp = startOf(timestamp, duration);
+    funktion.lazyCompileDuration = duration;
   }
 
-  processCompile(file, scriptId,
-    startPosition, endPosition, time, timestamp, functionName) {
-
-    let script = this.lookupScript(file, scriptId);
+  processCompile(
+      scriptId, startPosition, endPosition, duration, timestamp, functionName) {
+    let script = this.lookupScript(scriptId);
     if (startPosition === 0) {
-      script.compileTimestamp = startOf(timestamp, time);
-      script.compileTime = time;
+      script.compileTimestamp = startOf(timestamp, duration);
+      script.compileDuration = duration;
       script.bytesTotal = endPosition;
     } else {
       let funktion = script.funktionAtPosition(startPosition);
-      funktion.compileTimestamp = startOf(timestamp, time);
-      funktion.compileTime = time;
+      if (funktion === undefined) {
+        // This should not happen since any funktion has to be parsed first.
+        console.log("processCompile funktion not found", ...arguments);
+      }
+      funktion.compileTimestamp = startOf(timestamp, duration);
+      funktion.compileDuration = duration;
     }
   }
+
+  processCompileEval(
+      scriptId, startPosition, endPosition, duration, timestamp, functionName) {
+  }
+
+  processOptimizeLazy(
+      scriptId, startPosition, endPosition, duration, timestamp, functionName) {
+  }
+
+  processCompilationCacheEvent(eventType, cacheType, startPosition,
+      endPosition) {
+  }
+
 }
 
 
diff --git a/deps/v8/tools/parser-shell.cc b/deps/v8/tools/parser-shell.cc
deleted file mode 100644
index bcee2b82582f1b..00000000000000
--- a/deps/v8/tools/parser-shell.cc
+++ /dev/null
@@ -1,162 +0,0 @@
-// Copyright 2014 the V8 project authors. All rights reserved.
-// Redistribution and use in source and binary forms, with or without
-// modification, are permitted provided that the following conditions are
-// met:
-//
-//     * Redistributions of source code must retain the above copyright
-//       notice, this list of conditions and the following disclaimer.
-//     * Redistributions in binary form must reproduce the above
-//       copyright notice, this list of conditions and the following
-//       disclaimer in the documentation and/or other materials provided
-//       with the distribution.
-//     * Neither the name of Google Inc. nor the names of its
-//       contributors may be used to endorse or promote products derived
-//       from this software without specific prior written permission.
-//
-// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
-// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
-// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
-// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
-// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
-// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
-// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-
-#include <assert.h>
-#include <string.h>
-#include <stdio.h>
-#include <stdlib.h>
-#include <string>
-#include <vector>
-#include "src/v8.h"
-
-#include "include/libplatform/libplatform.h"
-#include "src/api.h"
-#include "src/compiler.h"
-#include "src/objects-inl.h"
-#include "src/parsing/parse-info.h"
-#include "src/parsing/parsing.h"
-#include "src/parsing/preparse-data.h"
-#include "src/parsing/preparser.h"
-#include "src/parsing/scanner-character-streams.h"
-#include "tools/shell-utils.h"
-
-using namespace v8::internal;
-
-class StringResource8 : public v8::String::ExternalOneByteStringResource {
- public:
-  StringResource8(const char* data, int length)
-      : data_(data), length_(length) { }
-  virtual size_t length() const { return length_; }
-  virtual const char* data() const { return data_; }
-
- private:
-  const char* data_;
-  int length_;
-};
-
-v8::base::TimeDelta RunBaselineParser(const char* fname, Encoding encoding,
-                                      int repeat, v8::Isolate* isolate,
-                                      v8::Local<v8::Context> context) {
-  int length = 0;
-  const byte* source = ReadFileAndRepeat(fname, &length, repeat);
-  v8::Local<v8::String> source_handle;
-  switch (encoding) {
-    case UTF8: {
-      source_handle = v8::String::NewFromUtf8(
-                          isolate, reinterpret_cast<const char*>(source),
-                          v8::NewStringType::kNormal).ToLocalChecked();
-      break;
-    }
-    case UTF16: {
-      source_handle =
-          v8::String::NewFromTwoByte(
-              isolate, reinterpret_cast<const uint16_t*>(source),
-              v8::NewStringType::kNormal, length / 2).ToLocalChecked();
-      break;
-    }
-    case LATIN1: {
-      StringResource8* string_resource =
-          new StringResource8(reinterpret_cast<const char*>(source), length);
-      source_handle = v8::String::NewExternalOneByte(isolate, string_resource)
-                          .ToLocalChecked();
-      break;
-    }
-  }
-  v8::base::TimeDelta parse_time1;
-  Handle<Script> script =
-      reinterpret_cast<i::Isolate*>(isolate)->factory()->NewScript(
-          v8::Utils::OpenHandle(*source_handle));
-  ParseInfo info(script);
-  v8::base::ElapsedTimer timer;
-  timer.Start();
-  bool success =
-      parsing::ParseProgram(&info, reinterpret_cast<i::Isolate*>(isolate));
-  parse_time1 = timer.Elapsed();
-  if (!success) {
-    fprintf(stderr, "Parsing failed\n");
-    return v8::base::TimeDelta();
-  }
-  return parse_time1;
-}
-
-
-int main(int argc, char* argv[]) {
-  v8::V8::SetFlagsFromCommandLine(&argc, argv, true);
-  v8::V8::InitializeICUDefaultLocation(argv[0]);
-  std::unique_ptr<v8::Platform> platform = v8::platform::NewDefaultPlatform();
-  v8::V8::InitializePlatform(platform.get());
-  v8::V8::Initialize();
-  v8::V8::InitializeExternalStartupData(argv[0]);
-
-  Encoding encoding = LATIN1;
-  std::vector<std::string> fnames;
-  std::string benchmark;
-  int repeat = 1;
-  for (int i = 0; i < argc; ++i) {
-    if (strcmp(argv[i], "--latin1") == 0) {
-      encoding = LATIN1;
-    } else if (strcmp(argv[i], "--utf8") == 0) {
-      encoding = UTF8;
-    } else if (strcmp(argv[i], "--utf16") == 0) {
-      encoding = UTF16;
-    } else if (strncmp(argv[i], "--benchmark=", 12) == 0) {
-      benchmark = std::string(argv[i]).substr(12);
-    } else if (strncmp(argv[i], "--repeat=", 9) == 0) {
-      std::string repeat_str = std::string(argv[i]).substr(9);
-      repeat = atoi(repeat_str.c_str());
-    } else if (i > 0 && argv[i][0] != '-') {
-      fnames.push_back(std::string(argv[i]));
-    }
-  }
-  v8::Isolate::CreateParams create_params;
-  create_params.array_buffer_allocator =
-      v8::ArrayBuffer::Allocator::NewDefaultAllocator();
-  v8::Isolate* isolate = v8::Isolate::New(create_params);
-  {
-    v8::Isolate::Scope isolate_scope(isolate);
-    v8::HandleScope handle_scope(isolate);
-    v8::Local<v8::ObjectTemplate> global = v8::ObjectTemplate::New(isolate);
-    v8::Local<v8::Context> context = v8::Context::New(isolate, NULL, global);
-    DCHECK(!context.IsEmpty());
-    {
-      v8::Context::Scope scope(context);
-      double first_parse_total = 0;
-      for (size_t i = 0; i < fnames.size(); i++) {
-        v8::base::TimeDelta time = RunBaselineParser(
-            fnames[i].c_str(), encoding, repeat, isolate, context);
-        first_parse_total += time.InMillisecondsF();
-      }
-      if (benchmark.empty()) benchmark = "Baseline";
-      printf("%s(ParseRunTime): %.f ms\n", benchmark.c_str(),
-             first_parse_total);
-    }
-  }
-  v8::V8::Dispose();
-  v8::V8::ShutdownPlatform();
-  delete create_params.array_buffer_allocator;
-  return 0;
-}
diff --git a/deps/v8/tools/presubmit.py b/deps/v8/tools/presubmit.py
index 29469be7589dc5..13b4abd86cf45b 100755
--- a/deps/v8/tools/presubmit.py
+++ b/deps/v8/tools/presubmit.py
@@ -283,7 +283,7 @@ class SourceProcessor(SourceFileProcessor):
   Check that all files include a copyright notice and no trailing whitespaces.
   """
 
-  RELEVANT_EXTENSIONS = ['.js', '.cc', '.h', '.py', '.c', '.status']
+  RELEVANT_EXTENSIONS = ['.js', '.cc', '.h', '.py', '.c', '.status', '.tq', '.g4']
 
   def __init__(self):
     self.runtime_function_call_pattern = self.CreateRuntimeFunctionCallMatcher()
@@ -297,7 +297,7 @@ def CreateRuntimeFunctionCallMatcher(self):
         m = pattern.match(line)
         if m:
           runtime_functions.append(m.group(1))
-    if len(runtime_functions) < 500:
+    if len(runtime_functions) < 450:
       print ("Runtime functions list is suspiciously short. "
              "Consider updating the presubmit script.")
       sys.exit(1)
diff --git a/deps/v8/tools/profviz/composer.js b/deps/v8/tools/profviz/composer.js
index ce625addca8f3b..411a7248ebd8f9 100644
--- a/deps/v8/tools/profviz/composer.js
+++ b/deps/v8/tools/profviz/composer.js
@@ -176,7 +176,9 @@ function PlotScriptComposer(kResX, kResY, error_output) {
   }
 
   function MergeRanges(ranges) {
-    ranges.sort(function(a, b) { return a.start - b.start; });
+    ranges.sort(function(a, b) {
+      return (a.start == b.start) ? a.end - b.end : a.start - b.start;
+    });
     var result = [];
     var j = 0;
     for (var i = 0; i < ranges.length; i = j) {
@@ -306,13 +308,14 @@ function PlotScriptComposer(kResX, kResY, error_output) {
     };
     // Collect data from log.
     var logreader = new LogReader(
-      { 'timer-event-start': { parsers: [null, parseTimeStamp],
+      { 'timer-event-start': { parsers: [parseString, parseTimeStamp],
                                processor: processTimerEventStart },
-        'timer-event-end':   { parsers: [null, parseTimeStamp],
+        'timer-event-end':   { parsers: [parseString, parseTimeStamp],
                                processor: processTimerEventEnd },
-        'shared-library': { parsers: [null, parseInt, parseInt],
+        'shared-library': { parsers: [parseString, parseInt, parseInt],
                             processor: processSharedLibrary },
-        'code-creation':  { parsers: [null, parseInt, parseInt, parseInt, null],
+        'code-creation':  { parsers: [parseString, parseInt, parseInt,
+                                parseInt, parseString],
                             processor: processCodeCreateEvent },
         'code-move':      { parsers: [parseInt, parseInt],
                             processor: processCodeMoveEvent },
@@ -322,8 +325,8 @@ function PlotScriptComposer(kResX, kResY, error_output) {
                             processor: processCodeDeoptEvent },
         'current-time':   { parsers: [parseTimeStamp],
                             processor: processCurrentTimeEvent },
-        'tick':           { parsers: [parseInt, parseTimeStamp,
-                                      null, null, parseInt, 'var-args'],
+        'tick':           { parsers: [parseInt, parseTimeStamp, parseString,
+                                parseString, parseInt, parseVarArgs],
                             processor: processTickEvent }
       });
 
@@ -516,8 +519,13 @@ function PlotScriptComposer(kResX, kResY, error_output) {
     // Label the longest pauses.
     execution_pauses =
         RestrictRangesTo(execution_pauses, range_start, range_end);
-    execution_pauses.sort(
-        function(a, b) { return b.duration() - a.duration(); });
+    execution_pauses.sort(function(a, b) {
+      if (a.duration() == b.duration() && b.end == a.end)
+        return b.start - a.start;
+
+      return (a.duration() == b.duration())
+          ? b.end - a.end : b.duration() - a.duration();
+    });
 
     var max_pause_time = execution_pauses.length > 0
         ? execution_pauses[0].duration() : 0;
diff --git a/deps/v8/tools/release/auto_roll.py b/deps/v8/tools/release/auto_roll.py
index ea83bfcd36dc8e..83c3d343aa1e61 100755
--- a/deps/v8/tools/release/auto_roll.py
+++ b/deps/v8/tools/release/auto_roll.py
@@ -20,7 +20,7 @@
 https://v8-roll.appspot.com/
 This only works with a Google account.
 
-CQ_INCLUDE_TRYBOTS=master.tryserver.blink:linux_trusty_blink_rel;luci.chromium.try:linux_optional_gpu_tests_rel;luci.chromium.try:mac_optional_gpu_tests_rel;master.tryserver.chromium.win:win_optional_gpu_tests_rel;luci.chromium.try:android_optional_gpu_tests_rel""")
+CQ_INCLUDE_TRYBOTS=master.tryserver.blink:linux_trusty_blink_rel;luci.chromium.try:linux_optional_gpu_tests_rel;luci.chromium.try:mac_optional_gpu_tests_rel;luci.chromium.try:win_optional_gpu_tests_rel;luci.chromium.try:android_optional_gpu_tests_rel""")
 
 class Preparation(Step):
   MESSAGE = "Preparation."
diff --git a/deps/v8/tools/release/common_includes.py b/deps/v8/tools/release/common_includes.py
index 5dd60df45965cd..0f12d910da45b2 100644
--- a/deps/v8/tools/release/common_includes.py
+++ b/deps/v8/tools/release/common_includes.py
@@ -57,6 +57,13 @@
 V8_BASE = os.path.dirname(
     os.path.dirname(os.path.dirname(os.path.abspath(__file__))))
 
+# Add our copy of depot_tools to the PATH as many scripts use tools from there,
+# e.g. git-cl, fetch, git-new-branch etc, and we can not depend on depot_tools
+# being in the PATH on the LUCI bots.
+path_to_depot_tools = os.path.join(V8_BASE, 'third_party', 'depot_tools')
+new_path = path_to_depot_tools + os.pathsep + os.environ.get('PATH')
+os.environ['PATH'] = new_path
+
 
 def TextToFile(text, file_name):
   with open(file_name, "w") as f:
@@ -760,16 +767,24 @@ class UploadStep(Step):
   MESSAGE = "Upload for code review."
 
   def RunStep(self):
+    reviewer = None
     if self._options.reviewer:
       print "Using account %s for review." % self._options.reviewer
       reviewer = self._options.reviewer
-    else:
+
+    tbr_reviewer = None
+    if self._options.tbr_reviewer:
+      print "Using account %s for TBR review." % self._options.tbr_reviewer
+      tbr_reviewer = self._options.tbr_reviewer
+
+    if not reviewer and not tbr_reviewer:
       print "Please enter the email address of a V8 reviewer for your patch: ",
       self.DieNoManualMode("A reviewer must be specified in forced mode.")
       reviewer = self.ReadLine()
+
     self.GitUpload(reviewer, self._options.author, self._options.force_upload,
                    bypass_hooks=self._options.bypass_upload_hooks,
-                   cc=self._options.cc)
+                   cc=self._options.cc, tbr_reviewer=tbr_reviewer)
 
 
 def MakeStep(step_class=Step, number=0, state=None, config=None,
@@ -822,6 +837,8 @@ def MakeOptions(self, args=None):
                         help="File to write results summary to.")
     parser.add_argument("-r", "--reviewer", default="",
                         help="The account name to be used for reviews.")
+    parser.add_argument("--tbr-reviewer", "--tbr", default="",
+                        help="The account name to be used for TBR reviews.")
     parser.add_argument("-s", "--step",
         help="Specify the step where to start work. Default: 0.",
         default=0, type=int)
@@ -866,6 +883,11 @@ def RunSteps(self, step_classes, args=None):
     if not options:
       return 1
 
+    # Ensure temp dir exists for state files.
+    state_dir = os.path.dirname(self._config["PERSISTFILE_BASENAME"])
+    if not os.path.exists(state_dir):
+      os.makedirs(state_dir)
+
     state_file = "%s-state.json" % self._config["PERSISTFILE_BASENAME"]
     if options.step == 0 and os.path.exists(state_file):
       os.remove(state_file)
diff --git a/deps/v8/tools/release/git_recipes.py b/deps/v8/tools/release/git_recipes.py
index 9dedae8a939d12..9deaee891b0f8a 100644
--- a/deps/v8/tools/release/git_recipes.py
+++ b/deps/v8/tools/release/git_recipes.py
@@ -207,12 +207,14 @@ def GitApplyPatch(self, patch_file, reverse=False, **kwargs):
 
   def GitUpload(self, reviewer="", author="", force=False, cq=False,
                 cq_dry_run=False, bypass_hooks=False, cc="", private=False,
-                **kwargs):
+                tbr_reviewer="", **kwargs):
     args = ["cl upload --send-mail"]
     if author:
       args += ["--email", Quoted(author)]
     if reviewer:
       args += ["-r", Quoted(reviewer)]
+    if tbr_reviewer:
+      args += ["--tbrs", Quoted(tbr_reviewer)]
     if force:
       args.append("-f")
     if cq:
diff --git a/deps/v8/tools/release/releases.py b/deps/v8/tools/release/releases.py
deleted file mode 100755
index 7b659ccb80693f..00000000000000
--- a/deps/v8/tools/release/releases.py
+++ /dev/null
@@ -1,576 +0,0 @@
-#!/usr/bin/env python
-# Copyright 2014 the V8 project authors. All rights reserved.
-# Use of this source code is governed by a BSD-style license that can be
-# found in the LICENSE file.
-
-# This script retrieves the history of all V8 branches and
-# their corresponding Chromium revisions.
-
-# Requires a chromium checkout with branch heads:
-# gclient sync --with_branch_heads
-# gclient fetch
-
-import argparse
-import csv
-import itertools
-import json
-import os
-import re
-import sys
-
-from common_includes import *
-
-CONFIG = {
-  "BRANCHNAME": "retrieve-v8-releases",
-  "PERSISTFILE_BASENAME": "/tmp/v8-releases-tempfile",
-}
-
-# Expression for retrieving the bleeding edge revision from a commit message.
-PUSH_MSG_SVN_RE = re.compile(r".* \(based on bleeding_edge revision r(\d+)\)$")
-PUSH_MSG_GIT_RE = re.compile(r".* \(based on ([a-fA-F0-9]+)\)$")
-
-# Expression for retrieving the merged patches from a merge commit message
-# (old and new format).
-MERGE_MESSAGE_RE = re.compile(r"^.*[M|m]erged (.+)(\)| into).*$", re.M)
-
-CHERRY_PICK_TITLE_GIT_RE = re.compile(r"^.* \(cherry\-pick\)\.?$")
-
-# New git message for cherry-picked CLs. One message per line.
-MERGE_MESSAGE_GIT_RE = re.compile(r"^Merged ([a-fA-F0-9]+)\.?$")
-
-# Expression for retrieving reverted patches from a commit message (old and
-# new format).
-ROLLBACK_MESSAGE_RE = re.compile(r"^.*[R|r]ollback of (.+)(\)| in).*$", re.M)
-
-# New git message for reverted CLs. One message per line.
-ROLLBACK_MESSAGE_GIT_RE = re.compile(r"^Rollback of ([a-fA-F0-9]+)\.?$")
-
-# Expression for retrieving the code review link.
-REVIEW_LINK_RE = re.compile(r"^Review URL: (.+)$", re.M)
-
-# Expression with three versions (historical) for extracting the v8 revision
-# from the chromium DEPS file.
-DEPS_RE = re.compile(r"""^\s*(?:["']v8_revision["']: ["']"""
-                     """|\(Var\("googlecode_url"\) % "v8"\) \+ "\/trunk@"""
-                     """|"http\:\/\/v8\.googlecode\.com\/svn\/trunk@)"""
-                     """([^"']+)["'].*$""", re.M)
-
-# Expression to pick tag and revision for bleeding edge tags. To be used with
-# output of 'svn log'.
-BLEEDING_EDGE_TAGS_RE = re.compile(
-    r"A \/tags\/([^\s]+) \(from \/branches\/bleeding_edge\:(\d+)\)")
-
-OMAHA_PROXY_URL = "http://omahaproxy.appspot.com/"
-
-def SortBranches(branches):
-  """Sort branches with version number names."""
-  return sorted(branches, key=SortingKey, reverse=True)
-
-
-def FilterDuplicatesAndReverse(cr_releases):
-  """Returns the chromium releases in reverse order filtered by v8 revision
-  duplicates.
-
-  cr_releases is a list of [cr_rev, v8_hsh] reverse-sorted by cr_rev.
-  """
-  last = ""
-  result = []
-  for release in reversed(cr_releases):
-    if last == release[1]:
-      continue
-    last = release[1]
-    result.append(release)
-  return result
-
-
-def BuildRevisionRanges(cr_releases):
-  """Returns a mapping of v8 revision -> chromium ranges.
-  The ranges are comma-separated, each range has the form R1:R2. The newest
-  entry is the only one of the form R1, as there is no end range.
-
-  cr_releases is a list of [cr_rev, v8_hsh] reverse-sorted by cr_rev.
-  cr_rev either refers to a chromium commit position or a chromium branch
-  number.
-  """
-  range_lists = {}
-  cr_releases = FilterDuplicatesAndReverse(cr_releases)
-
-  # Visit pairs of cr releases from oldest to newest.
-  for cr_from, cr_to in itertools.izip(
-      cr_releases, itertools.islice(cr_releases, 1, None)):
-
-    # Assume the chromium revisions are all different.
-    assert cr_from[0] != cr_to[0]
-
-    ran = "%s:%d" % (cr_from[0], int(cr_to[0]) - 1)
-
-    # Collect the ranges in lists per revision.
-    range_lists.setdefault(cr_from[1], []).append(ran)
-
-  # Add the newest revision.
-  if cr_releases:
-    range_lists.setdefault(cr_releases[-1][1], []).append(cr_releases[-1][0])
-
-  # Stringify and comma-separate the range lists.
-  return dict((hsh, ", ".join(ran)) for hsh, ran in range_lists.iteritems())
-
-
-def MatchSafe(match):
-  if match:
-    return match.group(1)
-  else:
-    return ""
-
-
-class Preparation(Step):
-  MESSAGE = "Preparation."
-
-  def RunStep(self):
-    self.CommonPrepare()
-    self.PrepareBranch()
-
-
-class RetrieveV8Releases(Step):
-  MESSAGE = "Retrieve all V8 releases."
-
-  def ExceedsMax(self, releases):
-    return (self._options.max_releases > 0
-            and len(releases) > self._options.max_releases)
-
-  def GetMasterHashFromPush(self, title):
-    return MatchSafe(PUSH_MSG_GIT_RE.match(title))
-
-  def GetMergedPatches(self, body):
-    patches = MatchSafe(MERGE_MESSAGE_RE.search(body))
-    if not patches:
-      patches = MatchSafe(ROLLBACK_MESSAGE_RE.search(body))
-      if patches:
-        # Indicate reverted patches with a "-".
-        patches = "-%s" % patches
-    return patches
-
-  def GetMergedPatchesGit(self, body):
-    patches = []
-    for line in body.splitlines():
-      patch = MatchSafe(MERGE_MESSAGE_GIT_RE.match(line))
-      if patch:
-        patches.append(patch)
-      patch = MatchSafe(ROLLBACK_MESSAGE_GIT_RE.match(line))
-      if patch:
-        patches.append("-%s" % patch)
-    return ", ".join(patches)
-
-
-  def GetReleaseDict(
-      self, git_hash, master_position, master_hash, branch, version,
-      patches, cl_body):
-    revision = self.GetCommitPositionNumber(git_hash)
-    return {
-      # The cr commit position number on the branch.
-      "revision": revision,
-      # The git revision on the branch.
-      "revision_git": git_hash,
-      # The cr commit position number on master.
-      "master_position": master_position,
-      # The same for git.
-      "master_hash": master_hash,
-      # The branch name.
-      "branch": branch,
-      # The version for displaying in the form 3.26.3 or 3.26.3.12.
-      "version": version,
-      # The date of the commit.
-      "date": self.GitLog(n=1, format="%ci", git_hash=git_hash),
-      # Merged patches if available in the form 'r1234, r2345'.
-      "patches_merged": patches,
-      # Default for easier output formatting.
-      "chromium_revision": "",
-      # Default for easier output formatting.
-      "chromium_branch": "",
-      # Link to the CL on code review. Candiates pushes are not uploaded,
-      # so this field will be populated below with the recent roll CL link.
-      "review_link": MatchSafe(REVIEW_LINK_RE.search(cl_body)),
-      # Link to the commit message on google code.
-      "revision_link": ("https://code.google.com/p/v8/source/detail?r=%s"
-                        % revision),
-    }
-
-  def GetRelease(self, git_hash, branch):
-    self.ReadAndPersistVersion()
-    base_version = [self["major"], self["minor"], self["build"]]
-    version = ".".join(base_version)
-    body = self.GitLog(n=1, format="%B", git_hash=git_hash)
-
-    patches = ""
-    if self["patch"] != "0":
-      version += ".%s" % self["patch"]
-      if CHERRY_PICK_TITLE_GIT_RE.match(body.splitlines()[0]):
-        patches = self.GetMergedPatchesGit(body)
-      else:
-        patches = self.GetMergedPatches(body)
-
-    if SortingKey("4.2.69") <= SortingKey(version):
-      master_hash = self.GetLatestReleaseBase(version=version)
-    else:
-      # Legacy: Before version 4.2.69, the master revision was determined
-      # by commit message.
-      title = self.GitLog(n=1, format="%s", git_hash=git_hash)
-      master_hash = self.GetMasterHashFromPush(title)
-    master_position = ""
-    if master_hash:
-      master_position = self.GetCommitPositionNumber(master_hash)
-    return self.GetReleaseDict(
-        git_hash, master_position, master_hash, branch, version,
-        patches, body), self["patch"]
-
-  def GetReleasesFromBranch(self, branch):
-    self.GitReset(self.vc.RemoteBranch(branch))
-    if branch == self.vc.MasterBranch():
-      return self.GetReleasesFromMaster()
-
-    releases = []
-    try:
-      for git_hash in self.GitLog(format="%H").splitlines():
-        if VERSION_FILE not in self.GitChangedFiles(git_hash):
-          continue
-        if self.ExceedsMax(releases):
-          break  # pragma: no cover
-        if not self.GitCheckoutFileSafe(VERSION_FILE, git_hash):
-          break  # pragma: no cover
-
-        release, patch_level = self.GetRelease(git_hash, branch)
-        releases.append(release)
-
-        # Follow branches only until their creation point.
-        # TODO(machenbach): This omits patches if the version file wasn't
-        # manipulated correctly. Find a better way to detect the point where
-        # the parent of the branch head leads to the trunk branch.
-        if branch != self.vc.CandidateBranch() and patch_level == "0":
-          break
-
-    # Allow Ctrl-C interrupt.
-    except (KeyboardInterrupt, SystemExit):  # pragma: no cover
-      pass
-
-    # Clean up checked-out version file.
-    self.GitCheckoutFileSafe(VERSION_FILE, "HEAD")
-    return releases
-
-  def GetReleaseFromRevision(self, revision):
-    releases = []
-    try:
-      if (VERSION_FILE not in self.GitChangedFiles(revision) or
-          not self.GitCheckoutFileSafe(VERSION_FILE, revision)):
-        print "Skipping revision %s" % revision
-        return []  # pragma: no cover
-
-      branches = map(
-          str.strip,
-          self.Git("branch -r --contains %s" % revision).strip().splitlines(),
-      )
-      branch = ""
-      for b in branches:
-        if b.startswith("origin/"):
-          branch = b.split("origin/")[1]
-          break
-        if b.startswith("branch-heads/"):
-          branch = b.split("branch-heads/")[1]
-          break
-      else:
-        print "Could not determine branch for %s" % revision
-
-      release, _ = self.GetRelease(revision, branch)
-      releases.append(release)
-
-    # Allow Ctrl-C interrupt.
-    except (KeyboardInterrupt, SystemExit):  # pragma: no cover
-      pass
-
-    # Clean up checked-out version file.
-    self.GitCheckoutFileSafe(VERSION_FILE, "HEAD")
-    return releases
-
-
-  def RunStep(self):
-    self.GitCreateBranch(self._config["BRANCHNAME"])
-    releases = []
-    if self._options.branch == 'recent':
-      # List every release from the last 7 days.
-      revisions = self.GetRecentReleases(max_age=7 * DAY_IN_SECONDS)
-      for revision in revisions:
-        releases += self.GetReleaseFromRevision(revision)
-    elif self._options.branch == 'all':  # pragma: no cover
-      # Retrieve the full release history.
-      for branch in self.vc.GetBranches():
-        releases += self.GetReleasesFromBranch(branch)
-      releases += self.GetReleasesFromBranch(self.vc.CandidateBranch())
-      releases += self.GetReleasesFromBranch(self.vc.MasterBranch())
-    else:  # pragma: no cover
-      # Retrieve history for a specified branch.
-      assert self._options.branch in (self.vc.GetBranches() +
-          [self.vc.CandidateBranch(), self.vc.MasterBranch()])
-      releases += self.GetReleasesFromBranch(self._options.branch)
-
-    self["releases"] = sorted(releases,
-                              key=lambda r: SortingKey(r["version"]),
-                              reverse=True)
-
-
-class UpdateChromiumCheckout(Step):
-  MESSAGE = "Update the chromium checkout."
-
-  def RunStep(self):
-    cwd = self._options.chromium
-    self.GitFetchOrigin("+refs/heads/*:refs/remotes/origin/*",
-                        "+refs/branch-heads/*:refs/remotes/branch-heads/*",
-                        cwd=cwd)
-    # Update v8 checkout in chromium.
-    self.GitFetchOrigin(cwd=os.path.join(cwd, "v8"))
-
-
-def ConvertToCommitNumber(step, revision):
-  # Simple check for git hashes.
-  if revision.isdigit() and len(revision) < 8:
-    return revision
-  return step.GetCommitPositionNumber(
-      revision, cwd=os.path.join(step._options.chromium, "v8"))
-
-
-class RetrieveChromiumV8Releases(Step):
-  MESSAGE = "Retrieve V8 releases from Chromium DEPS."
-
-  def RunStep(self):
-    cwd = self._options.chromium
-
-    # All v8 revisions we are interested in.
-    releases_dict = dict((r["revision_git"], r) for r in self["releases"])
-
-    cr_releases = []
-    count_past_last_v8 = 0
-    try:
-      for git_hash in self.GitLog(
-          format="%H", grep="V8", branch="origin/master",
-          path="DEPS", cwd=cwd).splitlines():
-        deps = self.GitShowFile(git_hash, "DEPS", cwd=cwd)
-        match = DEPS_RE.search(deps)
-        if match:
-          cr_rev = self.GetCommitPositionNumber(git_hash, cwd=cwd)
-          if cr_rev:
-            v8_hsh = match.group(1)
-            cr_releases.append([cr_rev, v8_hsh])
-
-          if count_past_last_v8:
-            count_past_last_v8 += 1  # pragma: no cover
-
-          if count_past_last_v8 > 20:
-            break  # pragma: no cover
-
-          # Stop as soon as we find a v8 revision that we didn't fetch in the
-          # v8-revision-retrieval part above (i.e. a revision that's too old).
-          # Just iterate a few more times in case there were reverts.
-          if v8_hsh not in releases_dict:
-            count_past_last_v8 += 1  # pragma: no cover
-
-    # Allow Ctrl-C interrupt.
-    except (KeyboardInterrupt, SystemExit):  # pragma: no cover
-      pass
-
-    # Add the chromium ranges to the v8 candidates and master releases.
-    all_ranges = BuildRevisionRanges(cr_releases)
-
-    for hsh, ranges in all_ranges.iteritems():
-      releases_dict.get(hsh, {})["chromium_revision"] = ranges
-
-
-# TODO(machenbach): Unify common code with method above.
-class RetrieveChromiumBranches(Step):
-  MESSAGE = "Retrieve Chromium branch information."
-
-  def RunStep(self):
-    cwd = self._options.chromium
-
-    # All v8 revisions we are interested in.
-    releases_dict = dict((r["revision_git"], r) for r in self["releases"])
-
-    # Filter out irrelevant branches.
-    branches = filter(lambda r: re.match(r"branch-heads/\d+", r),
-                      self.GitRemotes(cwd=cwd))
-
-    # Transform into pure branch numbers.
-    branches = map(lambda r: int(re.match(r"branch-heads/(\d+)", r).group(1)),
-                   branches)
-
-    branches = sorted(branches, reverse=True)
-
-    cr_branches = []
-    count_past_last_v8 = 0
-    try:
-      for branch in branches:
-        deps = self.GitShowFile(
-            "refs/branch-heads/%d" % branch, "DEPS", cwd=cwd)
-        match = DEPS_RE.search(deps)
-        if match:
-          v8_hsh = match.group(1)
-          cr_branches.append([str(branch), v8_hsh])
-
-          if count_past_last_v8:
-            count_past_last_v8 += 1  # pragma: no cover
-
-          if count_past_last_v8 > 20:
-            break  # pragma: no cover
-
-          # Stop as soon as we find a v8 revision that we didn't fetch in the
-          # v8-revision-retrieval part above (i.e. a revision that's too old).
-          # Just iterate a few more times in case there were reverts.
-          if v8_hsh not in releases_dict:
-            count_past_last_v8 += 1  # pragma: no cover
-
-    # Allow Ctrl-C interrupt.
-    except (KeyboardInterrupt, SystemExit):  # pragma: no cover
-      pass
-
-    # Add the chromium branches to the v8 candidate releases.
-    all_ranges = BuildRevisionRanges(cr_branches)
-    for revision, ranges in all_ranges.iteritems():
-      releases_dict.get(revision, {})["chromium_branch"] = ranges
-
-
-class RetrieveInformationOnChromeReleases(Step):
-  MESSAGE = 'Retrieves relevant information on the latest Chrome releases'
-
-  def Run(self):
-
-    params = None
-    result_raw = self.ReadURL(
-                             OMAHA_PROXY_URL + "all.json",
-                             params,
-                             wait_plan=[5, 20]
-                             )
-    recent_releases = json.loads(result_raw)
-
-    canaries = []
-
-    for current_os in recent_releases:
-      for current_version in current_os["versions"]:
-        if current_version["channel"] != "canary":
-          continue
-
-        current_candidate = self._CreateCandidate(current_version)
-        canaries.append(current_candidate)
-
-    chrome_releases = {"canaries": canaries}
-    self["chrome_releases"] = chrome_releases
-
-  def _GetGitHashForV8Version(self, v8_version):
-    if v8_version == "N/A":
-      return ""
-
-    real_v8_version = v8_version
-    if v8_version.split(".")[3]== "0":
-      real_v8_version = v8_version[:-2]
-
-    try:
-      return self.GitGetHashOfTag(real_v8_version)
-    except GitFailedException:
-      return ""
-
-  def _CreateCandidate(self, current_version):
-    params = None
-    url_to_call = (OMAHA_PROXY_URL + "v8.json?version="
-                   + current_version["previous_version"])
-    result_raw = self.ReadURL(
-                         url_to_call,
-                         params,
-                         wait_plan=[5, 20]
-                         )
-    previous_v8_version = json.loads(result_raw)["v8_version"]
-    v8_previous_version_hash = self._GetGitHashForV8Version(previous_v8_version)
-
-    current_v8_version = current_version["v8_version"]
-    v8_version_hash = self._GetGitHashForV8Version(current_v8_version)
-
-    current_candidate = {
-                        "chrome_version": current_version["version"],
-                        "os": current_version["os"],
-                        "release_date": current_version["current_reldate"],
-                        "v8_version": current_v8_version,
-                        "v8_version_hash": v8_version_hash,
-                        "v8_previous_version": previous_v8_version,
-                        "v8_previous_version_hash": v8_previous_version_hash,
-                       }
-    return current_candidate
-
-
-class CleanUp(Step):
-  MESSAGE = "Clean up."
-
-  def RunStep(self):
-    self.CommonCleanup()
-
-
-class WriteOutput(Step):
-  MESSAGE = "Print output."
-
-  def Run(self):
-
-    output = {
-              "releases": self["releases"],
-              "chrome_releases": self["chrome_releases"],
-              }
-
-    if self._options.csv:
-      with open(self._options.csv, "w") as f:
-        writer = csv.DictWriter(f,
-                                ["version", "branch", "revision",
-                                 "chromium_revision", "patches_merged"],
-                                restval="",
-                                extrasaction="ignore")
-        for release in self["releases"]:
-          writer.writerow(release)
-    if self._options.json:
-      with open(self._options.json, "w") as f:
-        f.write(json.dumps(output))
-    if not self._options.csv and not self._options.json:
-      print output  # pragma: no cover
-
-
-class Releases(ScriptsBase):
-  def _PrepareOptions(self, parser):
-    parser.add_argument("-b", "--branch", default="recent",
-                        help=("The branch to analyze. If 'all' is specified, "
-                              "analyze all branches. If 'recent' (default) "
-                              "is specified, track beta, stable and "
-                              "candidates."))
-    parser.add_argument("-c", "--chromium",
-                        help=("The path to your Chromium src/ "
-                              "directory to automate the V8 roll."))
-    parser.add_argument("--csv", help="Path to a CSV file for export.")
-    parser.add_argument("-m", "--max-releases", type=int, default=0,
-                        help="The maximum number of releases to track.")
-    parser.add_argument("--json", help="Path to a JSON file for export.")
-
-  def _ProcessOptions(self, options):  # pragma: no cover
-    options.force_readline_defaults = True
-    return True
-
-  def _Config(self):
-    return {
-      "BRANCHNAME": "retrieve-v8-releases",
-      "PERSISTFILE_BASENAME": "/tmp/v8-releases-tempfile",
-    }
-
-  def _Steps(self):
-
-    return [
-      Preparation,
-      RetrieveV8Releases,
-      UpdateChromiumCheckout,
-      RetrieveChromiumV8Releases,
-      RetrieveChromiumBranches,
-      RetrieveInformationOnChromeReleases,
-      CleanUp,
-      WriteOutput,
-    ]
-
-
-if __name__ == "__main__":  # pragma: no cover
-  sys.exit(Releases().Run())
diff --git a/deps/v8/tools/release/test_scripts.py b/deps/v8/tools/release/test_scripts.py
index 25aa803daf23ae..565b2b7c8f63b9 100755
--- a/deps/v8/tools/release/test_scripts.py
+++ b/deps/v8/tools/release/test_scripts.py
@@ -43,8 +43,6 @@
 from merge_to_branch import MergeToBranch
 import push_to_candidates
 from push_to_candidates import *
-import releases
-from releases import Releases
 from auto_tag import AutoTag
 import roll_merge
 from roll_merge import RollMerge
@@ -97,38 +95,6 @@ def testNormalizeVersionTags(self):
                 ]
     self.assertEquals(expected, NormalizeVersionTags(input))
 
-  def testSortBranches(self):
-    S = releases.SortBranches
-    self.assertEquals(["3.1", "2.25"], S(["2.25", "3.1"])[0:2])
-    self.assertEquals(["3.0", "2.25"], S(["2.25", "3.0", "2.24"])[0:2])
-    self.assertEquals(["3.11", "3.2"], S(["3.11", "3.2", "2.24"])[0:2])
-
-  def testFilterDuplicatesAndReverse(self):
-    F = releases.FilterDuplicatesAndReverse
-    self.assertEquals([], F([]))
-    self.assertEquals([["100", "10"]], F([["100", "10"]]))
-    self.assertEquals([["99", "9"], ["100", "10"]],
-                      F([["100", "10"], ["99", "9"]]))
-    self.assertEquals([["98", "9"], ["100", "10"]],
-                      F([["100", "10"], ["99", "9"], ["98", "9"]]))
-    self.assertEquals([["98", "9"], ["99", "10"]],
-                      F([["100", "10"], ["99", "10"], ["98", "9"]]))
-
-  def testBuildRevisionRanges(self):
-    B = releases.BuildRevisionRanges
-    self.assertEquals({}, B([]))
-    self.assertEquals({"10": "100"}, B([["100", "10"]]))
-    self.assertEquals({"10": "100", "9": "99:99"},
-                      B([["100", "10"], ["99", "9"]]))
-    self.assertEquals({"10": "100", "9": "97:99"},
-                      B([["100", "10"], ["98", "9"], ["97", "9"]]))
-    self.assertEquals({"10": "100", "9": "99:99", "3": "91:98"},
-                      B([["100", "10"], ["99", "9"], ["91", "3"]]))
-    self.assertEquals({"13": "101", "12": "100:100", "9": "94:97",
-                       "3": "91:93, 98:99"},
-                      B([["101", "13"], ["100", "12"], ["98", "3"],
-                         ["94", "9"], ["91", "3"]]))
-
   def testMakeComment(self):
     self.assertEquals("#   Line 1\n#   Line 2\n#",
                       MakeComment("    Line 1\n    Line 2\n"))
@@ -1037,7 +1003,7 @@ def CheckVersionCommit():
 https://v8-roll.appspot.com/
 This only works with a Google account.
 
-CQ_INCLUDE_TRYBOTS=master.tryserver.blink:linux_trusty_blink_rel;luci.chromium.try:linux_optional_gpu_tests_rel;luci.chromium.try:mac_optional_gpu_tests_rel;master.tryserver.chromium.win:win_optional_gpu_tests_rel;luci.chromium.try:android_optional_gpu_tests_rel
+CQ_INCLUDE_TRYBOTS=master.tryserver.blink:linux_trusty_blink_rel;luci.chromium.try:linux_optional_gpu_tests_rel;luci.chromium.try:mac_optional_gpu_tests_rel;luci.chromium.try:win_optional_gpu_tests_rel;luci.chromium.try:android_optional_gpu_tests_rel
 
 TBR=reviewer@chromium.org"""
 
@@ -1308,251 +1274,6 @@ def VerifyLand():
     args += ["-s", "4"]
     RollMerge(TEST_CONFIG, self).Run(args)
 
-  def testReleases(self):
-    c_hash1_commit_log = """Update V8 to Version 4.2.71.
-
-Cr-Commit-Position: refs/heads/master@{#5678}
-"""
-    c_hash2_commit_log = """Revert something.
-
-BUG=12345
-
-Reason:
-> Some reason.
-> Cr-Commit-Position: refs/heads/master@{#12345}
-> git-svn-id: svn://svn.chromium.org/chrome/trunk/src@12345 003-1c4
-
-Review URL: https://codereview.chromium.org/12345
-
-Cr-Commit-Position: refs/heads/master@{#4567}
-git-svn-id: svn://svn.chromium.org/chrome/trunk/src@4567 0039-1c4b
-
-"""
-    c_hash3_commit_log = """Simple.
-
-git-svn-id: svn://svn.chromium.org/chrome/trunk/src@3456 0039-1c4b
-
-"""
-    c_hash_234_commit_log = """Version 3.3.1.1 (cherry-pick).
-
-Merged abc12.
-
-Review URL: fake.com
-
-Cr-Commit-Position: refs/heads/candidates@{#234}
-"""
-    c_hash_123_commit_log = """Version 3.3.1.0
-
-git-svn-id: googlecode@123 0039-1c4b
-"""
-    c_hash_345_commit_log = """Version 3.4.0.
-
-Cr-Commit-Position: refs/heads/candidates@{#345}
-"""
-    c_hash_456_commit_log = """Version 4.2.71.
-
-Cr-Commit-Position: refs/heads/4.2.71@{#1}
-"""
-    c_deps = "Line\n   \"v8_revision\": \"%s\",\n  line\n"
-
-    json_output = self.MakeEmptyTempFile()
-    csv_output = self.MakeEmptyTempFile()
-    self.WriteFakeVersionFile()
-
-    TEST_CONFIG["CHROMIUM"] = self.MakeEmptyTempDirectory()
-    chrome_dir = TEST_CONFIG["CHROMIUM"]
-    chrome_v8_dir = os.path.join(chrome_dir, "v8")
-    os.makedirs(chrome_v8_dir)
-
-    def ResetVersion(major, minor, build, patch=0):
-      return lambda: self.WriteFakeVersionFile(major=major,
-                                               minor=minor,
-                                               build=build,
-                                               patch=patch)
-
-    self.Expect([
-      Cmd("git status -s -uno", ""),
-      Cmd("git checkout -f origin/master", ""),
-      Cmd("git fetch", ""),
-      Cmd("git branch", "  branch1\n* branch2\n"),
-      Cmd("git new-branch %s" % TEST_CONFIG["BRANCHNAME"], ""),
-      Cmd("git fetch origin +refs/tags/*:refs/tags/*", ""),
-      Cmd("git rev-list --max-age=395200 --tags",
-          "bad_tag\nhash_234\nhash_123\nhash_345\nhash_456\n"),
-      Cmd("git describe --tags bad_tag", "3.23.42-1-deadbeef"),
-      Cmd("git describe --tags hash_234", "3.3.1.1"),
-      Cmd("git describe --tags hash_123", "3.21.2"),
-      Cmd("git describe --tags hash_345", "3.22.3"),
-      Cmd("git describe --tags hash_456", "4.2.71"),
-      Cmd("git diff --name-only hash_234 hash_234^", VERSION_FILE),
-      Cmd("git checkout -f hash_234 -- %s" % VERSION_FILE, "",
-          cb=ResetVersion(3, 3, 1, 1)),
-      Cmd("git branch -r --contains hash_234", "  branch-heads/3.3\n"),
-      Cmd("git log -1 --format=%B hash_234", c_hash_234_commit_log),
-      Cmd("git log -1 --format=%s hash_234", ""),
-      Cmd("git log -1 --format=%B hash_234", c_hash_234_commit_log),
-      Cmd("git log -1 --format=%ci hash_234", "18:15"),
-      Cmd("git checkout -f HEAD -- %s" % VERSION_FILE, "",
-          cb=ResetVersion(3, 22, 5)),
-      Cmd("git diff --name-only hash_123 hash_123^", VERSION_FILE),
-      Cmd("git checkout -f hash_123 -- %s" % VERSION_FILE, "",
-          cb=ResetVersion(3, 21, 2)),
-      Cmd("git branch -r --contains hash_123", "  branch-heads/3.21\n"),
-      Cmd("git log -1 --format=%B hash_123", c_hash_123_commit_log),
-      Cmd("git log -1 --format=%s hash_123", ""),
-      Cmd("git log -1 --format=%B hash_123", c_hash_123_commit_log),
-      Cmd("git log -1 --format=%ci hash_123", "03:15"),
-      Cmd("git checkout -f HEAD -- %s" % VERSION_FILE, "",
-          cb=ResetVersion(3, 22, 5)),
-      Cmd("git diff --name-only hash_345 hash_345^", VERSION_FILE),
-      Cmd("git checkout -f hash_345 -- %s" % VERSION_FILE, "",
-          cb=ResetVersion(3, 22, 3)),
-      Cmd("git branch -r --contains hash_345", "  origin/candidates\n"),
-      Cmd("git log -1 --format=%B hash_345", c_hash_345_commit_log),
-      Cmd("git log -1 --format=%s hash_345", ""),
-      Cmd("git log -1 --format=%B hash_345", c_hash_345_commit_log),
-      Cmd("git log -1 --format=%ci hash_345", ""),
-      Cmd("git checkout -f HEAD -- %s" % VERSION_FILE, "",
-          cb=ResetVersion(3, 22, 5)),
-      Cmd("git diff --name-only hash_456 hash_456^", VERSION_FILE),
-      Cmd("git checkout -f hash_456 -- %s" % VERSION_FILE, "",
-          cb=ResetVersion(4, 2, 71)),
-      Cmd("git branch -r --contains hash_456", "  origin/4.2.71\n"),
-      Cmd("git log -1 --format=%B hash_456", c_hash_456_commit_log),
-      Cmd("git log -1 --format=%H 4.2.71", "hash_456"),
-      Cmd("git log -1 --format=%s hash_456", "Version 4.2.71"),
-      Cmd("git log -1 --format=%H hash_456^", "master_456"),
-      Cmd("git log -1 --format=%B master_456",
-          "Cr-Commit-Position: refs/heads/master@{#456}"),
-      Cmd("git log -1 --format=%B hash_456", c_hash_456_commit_log),
-      Cmd("git log -1 --format=%ci hash_456", "02:15"),
-      Cmd("git checkout -f HEAD -- %s" % VERSION_FILE, "",
-          cb=ResetVersion(3, 22, 5)),
-      Cmd("git fetch origin +refs/heads/*:refs/remotes/origin/* "
-          "+refs/branch-heads/*:refs/remotes/branch-heads/*", "",
-          cwd=chrome_dir),
-      Cmd("git fetch origin", "", cwd=chrome_v8_dir),
-      Cmd("git log --format=%H --grep=\"V8\" origin/master -- DEPS",
-          "c_hash1\nc_hash2\nc_hash3\n",
-          cwd=chrome_dir),
-      Cmd("git show c_hash1:DEPS", c_deps % "hash_456", cwd=chrome_dir),
-      Cmd("git log -1 --format=%B c_hash1", c_hash1_commit_log,
-          cwd=chrome_dir),
-      Cmd("git show c_hash2:DEPS", c_deps % "hash_345", cwd=chrome_dir),
-      Cmd("git log -1 --format=%B c_hash2", c_hash2_commit_log,
-          cwd=chrome_dir),
-      Cmd("git show c_hash3:DEPS", c_deps % "deadbeef", cwd=chrome_dir),
-      Cmd("git log -1 --format=%B c_hash3", c_hash3_commit_log,
-          cwd=chrome_dir),
-      Cmd("git branch -r", " weird/123\n  branch-heads/7\n", cwd=chrome_dir),
-      Cmd("git show refs/branch-heads/7:DEPS", c_deps % "hash_345",
-          cwd=chrome_dir),
-      URL("http://omahaproxy.appspot.com/all.json", """[{
-        "os": "win",
-        "versions": [{
-          "version": "2.2.2.2",
-          "v8_version": "22.2.2.2",
-          "current_reldate": "04/09/15",
-          "os": "win",
-          "channel": "canary",
-          "previous_version": "1.1.1.0"
-          }]
-        }]"""),
-      URL("http://omahaproxy.appspot.com/v8.json?version=1.1.1.0", """{
-        "chromium_version": "1.1.1.0",
-        "v8_version": "11.1.1.0"
-        }"""),
-      Cmd("git rev-list -1 11.1.1", "v8_previous_version_hash"),
-      Cmd("git rev-list -1 22.2.2.2", "v8_version_hash"),
-      Cmd("git checkout -f origin/master", ""),
-      Cmd("git branch -D %s" % TEST_CONFIG["BRANCHNAME"], "")
-    ])
-
-    args = ["-c", TEST_CONFIG["CHROMIUM"],
-            "--json", json_output,
-            "--csv", csv_output,
-            "--max-releases", "1"]
-    Releases(TEST_CONFIG, self).Run(args)
-
-    # Check expected output.
-    csv = ("4.2.71,4.2.71,1,5678,\r\n"
-           "3.22.3,candidates,345,4567:5677,\r\n"
-           "3.21.2,3.21,123,,\r\n"
-           "3.3.1.1,3.3,234,,abc12\r\n")
-    self.assertEquals(csv, FileToText(csv_output))
-
-    expected_json = {"chrome_releases":{
-                                        "canaries": [
-                                                     {
-                           "chrome_version": "2.2.2.2",
-                           "os": "win",
-                           "release_date": "04/09/15",
-                           "v8_version": "22.2.2.2",
-                           "v8_version_hash": "v8_version_hash",
-                           "v8_previous_version": "11.1.1.0",
-                           "v8_previous_version_hash": "v8_previous_version_hash"
-                           }]},
-                     "releases":[
-      {
-        "revision": "1",
-        "revision_git": "hash_456",
-        "master_position": "456",
-        "master_hash": "master_456",
-        "patches_merged": "",
-        "version": "4.2.71",
-        "chromium_revision": "5678",
-        "branch": "4.2.71",
-        "review_link": "",
-        "date": "02:15",
-        "chromium_branch": "",
-        # FIXME(machenbach): Fix revisions link for git.
-        "revision_link": "https://code.google.com/p/v8/source/detail?r=1",
-      },
-      {
-        "revision": "345",
-        "revision_git": "hash_345",
-        "master_position": "",
-        "master_hash": "",
-        "patches_merged": "",
-        "version": "3.22.3",
-        "chromium_revision": "4567:5677",
-        "branch": "candidates",
-        "review_link": "",
-        "date": "",
-        "chromium_branch": "7",
-        "revision_link": "https://code.google.com/p/v8/source/detail?r=345",
-      },
-      {
-        "revision": "123",
-        "revision_git": "hash_123",
-        "patches_merged": "",
-        "master_position": "",
-        "master_hash": "",
-        "version": "3.21.2",
-        "chromium_revision": "",
-        "branch": "3.21",
-        "review_link": "",
-        "date": "03:15",
-        "chromium_branch": "",
-        "revision_link": "https://code.google.com/p/v8/source/detail?r=123",
-      },
-      {
-        "revision": "234",
-        "revision_git": "hash_234",
-        "patches_merged": "abc12",
-        "master_position": "",
-        "master_hash": "",
-        "version": "3.3.1.1",
-        "chromium_revision": "",
-        "branch": "3.3",
-        "review_link": "fake.com",
-        "date": "18:15",
-        "chromium_branch": "",
-        "revision_link": "https://code.google.com/p/v8/source/detail?r=234",
-      },],
-    }
-    self.assertEquals(expected_json, json.loads(FileToText(json_output)))
-
   def testMergeToBranch(self):
     TEST_CONFIG["ALREADY_MERGING_SENTINEL_FILE"] = self.MakeEmptyTempFile()
     TextToFile("", os.path.join(TEST_CONFIG["DEFAULT_CWD"], ".git"))
@@ -1678,250 +1399,5 @@ def VerifyLand():
     args += ["-s", "4"]
     MergeToBranch(TEST_CONFIG, self).Run(args)
 
-  def testReleases(self):
-    c_hash1_commit_log = """Update V8 to Version 4.2.71.
-
-Cr-Commit-Position: refs/heads/master@{#5678}
-"""
-    c_hash2_commit_log = """Revert something.
-
-BUG=12345
-
-Reason:
-> Some reason.
-> Cr-Commit-Position: refs/heads/master@{#12345}
-> git-svn-id: svn://svn.chromium.org/chrome/trunk/src@12345 003-1c4
-
-Review URL: https://codereview.chromium.org/12345
-
-Cr-Commit-Position: refs/heads/master@{#4567}
-git-svn-id: svn://svn.chromium.org/chrome/trunk/src@4567 0039-1c4b
-
-"""
-    c_hash3_commit_log = """Simple.
-
-git-svn-id: svn://svn.chromium.org/chrome/trunk/src@3456 0039-1c4b
-
-"""
-    c_hash_234_commit_log = """Version 3.3.1.1 (cherry-pick).
-
-Merged abc12.
-
-Review URL: fake.com
-
-Cr-Commit-Position: refs/heads/candidates@{#234}
-"""
-    c_hash_123_commit_log = """Version 3.3.1.0
-
-git-svn-id: googlecode@123 0039-1c4b
-"""
-    c_hash_345_commit_log = """Version 3.4.0.
-
-Cr-Commit-Position: refs/heads/candidates@{#345}
-"""
-    c_hash_456_commit_log = """Version 4.2.71.
-
-Cr-Commit-Position: refs/heads/4.2.71@{#1}
-"""
-    c_deps = "Line\n   \"v8_revision\": \"%s\",\n  line\n"
-
-    json_output = self.MakeEmptyTempFile()
-    csv_output = self.MakeEmptyTempFile()
-    self.WriteFakeVersionFile()
-
-    TEST_CONFIG["CHROMIUM"] = self.MakeEmptyTempDirectory()
-    chrome_dir = TEST_CONFIG["CHROMIUM"]
-    chrome_v8_dir = os.path.join(chrome_dir, "v8")
-    os.makedirs(chrome_v8_dir)
-
-    def ResetVersion(major, minor, build, patch=0):
-      return lambda: self.WriteFakeVersionFile(major=major,
-                                               minor=minor,
-                                               build=build,
-                                               patch=patch)
-
-    self.Expect([
-      Cmd("git status -s -uno", ""),
-      Cmd("git checkout -f origin/master", ""),
-      Cmd("git fetch", ""),
-      Cmd("git branch", "  branch1\n* branch2\n"),
-      Cmd("git new-branch %s" % TEST_CONFIG["BRANCHNAME"], ""),
-      Cmd("git fetch origin +refs/tags/*:refs/tags/*", ""),
-      Cmd("git rev-list --max-age=395200 --tags",
-          "bad_tag\nhash_234\nhash_123\nhash_345\nhash_456\n"),
-      Cmd("git describe --tags bad_tag", "3.23.42-1-deadbeef"),
-      Cmd("git describe --tags hash_234", "3.3.1.1"),
-      Cmd("git describe --tags hash_123", "3.21.2"),
-      Cmd("git describe --tags hash_345", "3.22.3"),
-      Cmd("git describe --tags hash_456", "4.2.71"),
-      Cmd("git diff --name-only hash_234 hash_234^", VERSION_FILE),
-      Cmd("git checkout -f hash_234 -- %s" % VERSION_FILE, "",
-          cb=ResetVersion(3, 3, 1, 1)),
-      Cmd("git branch -r --contains hash_234", "  branch-heads/3.3\n"),
-      Cmd("git log -1 --format=%B hash_234", c_hash_234_commit_log),
-      Cmd("git log -1 --format=%s hash_234", ""),
-      Cmd("git log -1 --format=%B hash_234", c_hash_234_commit_log),
-      Cmd("git log -1 --format=%ci hash_234", "18:15"),
-      Cmd("git checkout -f HEAD -- %s" % VERSION_FILE, "",
-          cb=ResetVersion(3, 22, 5)),
-      Cmd("git diff --name-only hash_123 hash_123^", VERSION_FILE),
-      Cmd("git checkout -f hash_123 -- %s" % VERSION_FILE, "",
-          cb=ResetVersion(3, 21, 2)),
-      Cmd("git branch -r --contains hash_123", "  branch-heads/3.21\n"),
-      Cmd("git log -1 --format=%B hash_123", c_hash_123_commit_log),
-      Cmd("git log -1 --format=%s hash_123", ""),
-      Cmd("git log -1 --format=%B hash_123", c_hash_123_commit_log),
-      Cmd("git log -1 --format=%ci hash_123", "03:15"),
-      Cmd("git checkout -f HEAD -- %s" % VERSION_FILE, "",
-          cb=ResetVersion(3, 22, 5)),
-      Cmd("git diff --name-only hash_345 hash_345^", VERSION_FILE),
-      Cmd("git checkout -f hash_345 -- %s" % VERSION_FILE, "",
-          cb=ResetVersion(3, 22, 3)),
-      Cmd("git branch -r --contains hash_345", "  origin/candidates\n"),
-      Cmd("git log -1 --format=%B hash_345", c_hash_345_commit_log),
-      Cmd("git log -1 --format=%s hash_345", ""),
-      Cmd("git log -1 --format=%B hash_345", c_hash_345_commit_log),
-      Cmd("git log -1 --format=%ci hash_345", ""),
-      Cmd("git checkout -f HEAD -- %s" % VERSION_FILE, "",
-          cb=ResetVersion(3, 22, 5)),
-      Cmd("git diff --name-only hash_456 hash_456^", VERSION_FILE),
-      Cmd("git checkout -f hash_456 -- %s" % VERSION_FILE, "",
-          cb=ResetVersion(4, 2, 71)),
-      Cmd("git branch -r --contains hash_456", "  origin/4.2.71\n"),
-      Cmd("git log -1 --format=%B hash_456", c_hash_456_commit_log),
-      Cmd("git log -1 --format=%H 4.2.71", "hash_456"),
-      Cmd("git log -1 --format=%s hash_456", "Version 4.2.71"),
-      Cmd("git log -1 --format=%H hash_456^", "master_456"),
-      Cmd("git log -1 --format=%B master_456",
-          "Cr-Commit-Position: refs/heads/master@{#456}"),
-      Cmd("git log -1 --format=%B hash_456", c_hash_456_commit_log),
-      Cmd("git log -1 --format=%ci hash_456", "02:15"),
-      Cmd("git checkout -f HEAD -- %s" % VERSION_FILE, "",
-          cb=ResetVersion(3, 22, 5)),
-      Cmd("git fetch origin +refs/heads/*:refs/remotes/origin/* "
-          "+refs/branch-heads/*:refs/remotes/branch-heads/*", "",
-          cwd=chrome_dir),
-      Cmd("git fetch origin", "", cwd=chrome_v8_dir),
-      Cmd("git log --format=%H --grep=\"V8\" origin/master -- DEPS",
-          "c_hash1\nc_hash2\nc_hash3\n",
-          cwd=chrome_dir),
-      Cmd("git show c_hash1:DEPS", c_deps % "hash_456", cwd=chrome_dir),
-      Cmd("git log -1 --format=%B c_hash1", c_hash1_commit_log,
-          cwd=chrome_dir),
-      Cmd("git show c_hash2:DEPS", c_deps % "hash_345", cwd=chrome_dir),
-      Cmd("git log -1 --format=%B c_hash2", c_hash2_commit_log,
-          cwd=chrome_dir),
-      Cmd("git show c_hash3:DEPS", c_deps % "deadbeef", cwd=chrome_dir),
-      Cmd("git log -1 --format=%B c_hash3", c_hash3_commit_log,
-          cwd=chrome_dir),
-      Cmd("git branch -r", " weird/123\n  branch-heads/7\n", cwd=chrome_dir),
-      Cmd("git show refs/branch-heads/7:DEPS", c_deps % "hash_345",
-          cwd=chrome_dir),
-      URL("http://omahaproxy.appspot.com/all.json", """[{
-        "os": "win",
-        "versions": [{
-          "version": "2.2.2.2",
-          "v8_version": "22.2.2.2",
-          "current_reldate": "04/09/15",
-          "os": "win",
-          "channel": "canary",
-          "previous_version": "1.1.1.0"
-          }]
-        }]"""),
-      URL("http://omahaproxy.appspot.com/v8.json?version=1.1.1.0", """{
-        "chromium_version": "1.1.1.0",
-        "v8_version": "11.1.1.0"
-        }"""),
-      Cmd("git rev-list -1 11.1.1", "v8_previous_version_hash"),
-      Cmd("git rev-list -1 22.2.2.2", "v8_version_hash"),
-      Cmd("git checkout -f origin/master", ""),
-      Cmd("git branch -D %s" % TEST_CONFIG["BRANCHNAME"], "")
-    ])
-
-    args = ["-c", TEST_CONFIG["CHROMIUM"],
-            "--json", json_output,
-            "--csv", csv_output,
-            "--max-releases", "1"]
-    Releases(TEST_CONFIG, self).Run(args)
-
-    # Check expected output.
-    csv = ("4.2.71,4.2.71,1,5678,\r\n"
-           "3.22.3,candidates,345,4567:5677,\r\n"
-           "3.21.2,3.21,123,,\r\n"
-           "3.3.1.1,3.3,234,,abc12\r\n")
-    self.assertEquals(csv, FileToText(csv_output))
-
-    expected_json = {"chrome_releases":{
-                                        "canaries": [
-                                                     {
-                           "chrome_version": "2.2.2.2",
-                           "os": "win",
-                           "release_date": "04/09/15",
-                           "v8_version": "22.2.2.2",
-                           "v8_version_hash": "v8_version_hash",
-                           "v8_previous_version": "11.1.1.0",
-                           "v8_previous_version_hash": "v8_previous_version_hash"
-                           }]},
-                     "releases":[
-      {
-        "revision": "1",
-        "revision_git": "hash_456",
-        "master_position": "456",
-        "master_hash": "master_456",
-        "patches_merged": "",
-        "version": "4.2.71",
-        "chromium_revision": "5678",
-        "branch": "4.2.71",
-        "review_link": "",
-        "date": "02:15",
-        "chromium_branch": "",
-        # FIXME(machenbach): Fix revisions link for git.
-        "revision_link": "https://code.google.com/p/v8/source/detail?r=1",
-      },
-      {
-        "revision": "345",
-        "revision_git": "hash_345",
-        "master_position": "",
-        "master_hash": "",
-        "patches_merged": "",
-        "version": "3.22.3",
-        "chromium_revision": "4567:5677",
-        "branch": "candidates",
-        "review_link": "",
-        "date": "",
-        "chromium_branch": "7",
-        "revision_link": "https://code.google.com/p/v8/source/detail?r=345",
-      },
-      {
-        "revision": "123",
-        "revision_git": "hash_123",
-        "patches_merged": "",
-        "master_position": "",
-        "master_hash": "",
-        "version": "3.21.2",
-        "chromium_revision": "",
-        "branch": "3.21",
-        "review_link": "",
-        "date": "03:15",
-        "chromium_branch": "",
-        "revision_link": "https://code.google.com/p/v8/source/detail?r=123",
-      },
-      {
-        "revision": "234",
-        "revision_git": "hash_234",
-        "patches_merged": "abc12",
-        "master_position": "",
-        "master_hash": "",
-        "version": "3.3.1.1",
-        "chromium_revision": "",
-        "branch": "3.3",
-        "review_link": "fake.com",
-        "date": "18:15",
-        "chromium_branch": "",
-        "revision_link": "https://code.google.com/p/v8/source/detail?r=234",
-      },],
-    }
-    self.assertEquals(expected_json, json.loads(FileToText(json_output)))
-
 if __name__ == '__main__':
   unittest.main()
diff --git a/deps/v8/tools/run-tests.py.vpython b/deps/v8/tools/run-tests.py.vpython
new file mode 100644
index 00000000000000..6a12277f6b77b8
--- /dev/null
+++ b/deps/v8/tools/run-tests.py.vpython
@@ -0,0 +1,32 @@
+# This is a vpython "spec" file.
+#
+# It describes patterns for python wheel dependencies of the python scripts in
+# the chromium repo, particularly for dependencies that have compiled components
+# (since pure-python dependencies can be easily vendored into third_party).
+#
+# When vpython is invoked, it finds this file and builds a python VirtualEnv,
+# containing all of the dependencies described in this file, fetching them from
+# CIPD (the "Chrome Infrastructure Package Deployer" service). Unlike `pip`,
+# this never requires the end-user machine to have a working python extension
+# compilation environment. All of these packages are built using:
+#   https://chromium.googlesource.com/infra/infra/+/master/infra/tools/dockerbuild/
+#
+# All python scripts in the repo share this same spec, to avoid dependency
+# fragmentation.
+#
+# If you have depot_tools installed in your $PATH, you can invoke python scripts
+# in this repo by running them as you normally would run them, except
+# substituting `vpython` instead of `python` on the command line, e.g.:
+#   vpython path/to/script.py some --arguments
+#
+# Read more about `vpython` and how to modify this file here:
+#   https://chromium.googlesource.com/infra/infra/+/master/doc/users/vpython.md
+
+python_version: "2.7"
+
+# Used by:
+#   test/test262
+wheel: <
+  name: "infra/python/wheels/pyyaml/${vpython_platform}"
+  version: "version:3.12"
+>
diff --git a/deps/v8/tools/run_perf.py b/deps/v8/tools/run_perf.py
index 2bd4372453d367..e0a9fc3b59022c 100755
--- a/deps/v8/tools/run_perf.py
+++ b/deps/v8/tools/run_perf.py
@@ -11,6 +11,7 @@
 The suite json format is expected to be:
 {
   "path": <relative path chunks to perf resources and main file>,
+  "owners": [<list of email addresses of benchmark owners (required)>],
   "name": <optional suite name, file name is default>,
   "archs": [<architecture name for which this suite is run>, ...],
   "binary": <name of binary to run, default "d8">,
@@ -55,6 +56,7 @@
 Full example (suite with one runner):
 {
   "path": ["."],
+  "owner": ["username@chromium.org"],
   "flags": ["--expose-gc"],
   "test_flags": ["5"],
   "archs": ["ia32", "x64"],
@@ -74,6 +76,7 @@
 Full example (suite with several runners):
 {
   "path": ["."],
+  "owner": ["username@chromium.org", "otherowner@google.com"],
   "flags": ["--expose-gc"],
   "archs": ["ia32", "x64"],
   "run_count": 5,
@@ -389,6 +392,7 @@ def __init__(self, binary = "d8"):
     self.stddev_regexp = None
     self.units = "score"
     self.total = False
+    self.owners = []
 
 
 class GraphConfig(Node):
@@ -401,6 +405,7 @@ def __init__(self, suite, parent, arch):
     self._suite = suite
 
     assert isinstance(suite.get("path", []), list)
+    assert isinstance(suite.get("owners", []), list)
     assert isinstance(suite["name"], basestring)
     assert isinstance(suite.get("flags", []), list)
     assert isinstance(suite.get("test_flags", []), list)
@@ -411,6 +416,7 @@ def __init__(self, suite, parent, arch):
     self.graphs = parent.graphs[:] + [suite["name"]]
     self.flags = parent.flags[:] + suite.get("flags", [])
     self.test_flags = parent.test_flags[:] + suite.get("test_flags", [])
+    self.owners = parent.owners[:] + suite.get("owners", [])
 
     # Values independent of parent node.
     self.resources = suite.get("resources", [])
@@ -451,6 +457,7 @@ class TraceConfig(GraphConfig):
   def __init__(self, suite, parent, arch):
     super(TraceConfig, self).__init__(suite, parent, arch)
     assert self.results_regexp
+    assert self.owners
 
   def CreateMeasurement(self, perform_measurement):
     if not perform_measurement:
diff --git a/deps/v8/tools/testrunner/base_runner.py b/deps/v8/tools/testrunner/base_runner.py
index cfea1527d4af37..d7d2373f2d5df8 100644
--- a/deps/v8/tools/testrunner/base_runner.py
+++ b/deps/v8/tools/testrunner/base_runner.py
@@ -280,6 +280,8 @@ def _add_parser_default_options(self, parser):
                       " and buildbot builds): %s" % MODES.keys())
     parser.add_option("--shell-dir", help="DEPRECATED! Executables from build "
                       "directory will be used")
+    parser.add_option("--test-root", help="Root directory of the test suites",
+                      default=os.path.join(self.basedir, 'test'))
     parser.add_option("--total-timeout-sec", default=0, type="int",
                       help="How long should fuzzer run")
     parser.add_option("--swarming", default=False, action="store_true",
@@ -560,12 +562,12 @@ def expand_test_group(name):
     return reduce(list.__add__, map(expand_test_group, args), [])
 
   def _get_suites(self, args, options):
-    names = self._args_to_suite_names(args)
+    names = self._args_to_suite_names(args, options.test_root)
     return self._load_suites(names, options)
 
-  def _args_to_suite_names(self, args):
+  def _args_to_suite_names(self, args, test_root):
     # Use default tests if no test configuration was provided at the cmd line.
-    all_names = set(utils.GetSuitePaths(os.path.join(self.basedir, 'test')))
+    all_names = set(utils.GetSuitePaths(test_root))
     args_names = OrderedDict([(arg.split('/')[0], None) for arg in args]) # set
     return [name for name in args_names if name in all_names]
 
@@ -578,7 +580,7 @@ def load_suite(name):
       if options.verbose:
         print '>>> Loading test suite: %s' % name
       return testsuite.TestSuite.LoadTestSuite(
-          os.path.join(self.basedir, 'test', name),
+          os.path.join(options.test_root, name),
           test_config)
     return map(load_suite, names)
 
diff --git a/deps/v8/tools/testrunner/local/variants.py b/deps/v8/tools/testrunner/local/variants.py
index 1c29f1d1955ecf..80710ff05521e4 100644
--- a/deps/v8/tools/testrunner/local/variants.py
+++ b/deps/v8/tools/testrunner/local/variants.py
@@ -7,9 +7,10 @@
   "code_serializer": [["--cache=code"]],
   "default": [[]],
   "future": [["--future"]],
+  "gc_stats": [["--gc_stats=1"]],
   # Alias of exhaustive variants, but triggering new test framework features.
   "infra_staging": [[]],
-  "liftoff": [["--liftoff"]],
+  "no_liftoff": [["--no-wasm-tier-up"]],
   "minor_mc": [["--minor-mc"]],
   # No optimization means disable all optimizations. OptimizeFunctionOnNextCall
   # would not force optimization too. It turns into a Nop. Please see
@@ -22,7 +23,7 @@
   # Trigger stress sampling allocation profiler with sample interval = 2^14
   "stress_sampling": [["--stress-sampling-allocation-profiler=16384"]],
   "trusted": [["--no-untrusted-code-mitigations"]],
-  "wasm_traps": [["--wasm-trap-handler", "--invoke-weak-callbacks"]],
+  "no_wasm_traps": [["--no-wasm-trap-handler"]],
 }
 
 SLOW_VARIANTS = set([
diff --git a/deps/v8/tools/testrunner/num_fuzzer.py b/deps/v8/tools/testrunner/num_fuzzer.py
index 77effc1847119b..b55dd2102d3555 100755
--- a/deps/v8/tools/testrunner/num_fuzzer.py
+++ b/deps/v8/tools/testrunner/num_fuzzer.py
@@ -81,6 +81,10 @@ def _add_parser_options(self, parser):
     parser.add_option("--combine-min", default=2, type="int",
                       help="Minimum number of tests to combine")
 
+    # Miscellaneous
+    parser.add_option("--variants", default='default',
+                      help="Comma-separated list of testing variants")
+
     return parser
 
 
@@ -97,6 +101,10 @@ def _process_options(self, options):
                options.min_group_size, options.max_group_size)
         raise base_runner.TestRunnerError()
 
+    if options.variants != 'default':
+      print ('Only default testing variant is supported with numfuzz')
+      raise base_runner.TestRunnerError()
+
     return True
 
   def _get_default_suite_names(self):
diff --git a/deps/v8/tools/testrunner/objects/testcase.py b/deps/v8/tools/testrunner/objects/testcase.py
index 775ddfeb07b809..39d4fbd2a77f55 100644
--- a/deps/v8/tools/testrunner/objects/testcase.py
+++ b/deps/v8/tools/testrunner/objects/testcase.py
@@ -153,9 +153,10 @@ def _get_cmd_params(self):
       - random seed
       - extra flags (from command line)
       - user flags (variant/fuzzer flags)
-      - statusfile flags
       - mode flags (based on chosen mode)
       - source flags (from source code) [empty by default]
+      - test-suite flags
+      - statusfile flags
 
     The best way to modify how parameters are created is to only override
     methods for getting partial parameters.
@@ -165,10 +166,10 @@ def _get_cmd_params(self):
         self._get_random_seed_flags() +
         self._get_extra_flags() +
         self._get_variant_flags() +
-        self._get_statusfile_flags() +
         self._get_mode_flags() +
         self._get_source_flags() +
-        self._get_suite_flags()
+        self._get_suite_flags() +
+        self._get_statusfile_flags()
     )
 
   def _get_cmd_env(self):
diff --git a/deps/v8/tools/testrunner/standard_runner.py b/deps/v8/tools/testrunner/standard_runner.py
index bea00476f4e63a..bd5df9b4823f88 100755
--- a/deps/v8/tools/testrunner/standard_runner.py
+++ b/deps/v8/tools/testrunner/standard_runner.py
@@ -33,7 +33,6 @@
   "stress",
   "stress_background_compile",
   "stress_incremental_marking",
-  "wasm_traps",
 ]
 
 VARIANT_ALIASES = {
@@ -44,7 +43,7 @@
   # Shortcut for the two above ("more" first - it has the longer running tests).
   "exhaustive": MORE_VARIANTS + VARIANTS,
   # Additional variants, run on a subset of bots.
-  "extra": ["future", "liftoff", "trusted"],
+  "extra": ["future", "no_liftoff", "no_wasm_traps", "trusted"],
 }
 
 GC_STRESS_FLAGS = ["--gc-interval=500", "--stress-compaction",
@@ -166,6 +165,11 @@ def _process_options(self, options):
         options.extra_flags.append("--invoke-weak-callbacks")
         options.extra_flags.append("--omit-quit")
 
+      if self.build_config.no_snap:
+        # Speed up slow nosnap runs. Allocation verification is covered by
+        # running mksnapshot on other builders.
+        options.extra_flags.append("--no-turbo-verify-allocation")
+
       if options.novfp3:
         options.extra_flags.append("--noenable-vfp3")
 
@@ -266,6 +270,7 @@ def _get_statusfile_variables(self, options):
 
       variables.update({
         'gc_stress': options.gc_stress or options.random_gc_stress,
+        'gc_fuzzer': options.random_gc_stress,
         'novfp3': options.novfp3,
         'simulator_run': simulator_run,
       })
diff --git a/deps/v8/tools/tickprocessor.js b/deps/v8/tools/tickprocessor.js
index 057d32865978ea..b5efa3f69c1131 100644
--- a/deps/v8/tools/tickprocessor.js
+++ b/deps/v8/tools/tickprocessor.js
@@ -102,42 +102,43 @@ function TickProcessor(
     preprocessJson) {
   this.preprocessJson = preprocessJson;
   LogReader.call(this, {
-      'shared-library': { parsers: [null, parseInt, parseInt, parseInt],
+      'shared-library': { parsers: [parseString, parseInt, parseInt, parseInt],
           processor: this.processSharedLibrary },
       'code-creation': {
-          parsers: [null, parseInt, parseInt, parseInt, parseInt,
-                    null, 'var-args'],
+          parsers: [parseString, parseInt, parseInt, parseInt, parseInt,
+                    parseString, parseVarArgs],
           processor: this.processCodeCreation },
       'code-deopt': {
           parsers: [parseInt, parseInt, parseInt, parseInt, parseInt,
-                    null, null, null],
+                    parseString, parseString, parseString],
           processor: this.processCodeDeopt },
       'code-move': { parsers: [parseInt, parseInt, ],
           processor: this.processCodeMove },
       'code-delete': { parsers: [parseInt],
           processor: this.processCodeDelete },
       'code-source-info': {
-          parsers: [parseInt, parseInt, parseInt, parseInt, null, null, null],
+          parsers: [parseInt, parseInt, parseInt, parseInt, parseString,
+                    parseString, parseString],
           processor: this.processCodeSourceInfo },
-      'script': {
-          parsers: [parseInt, null, null],
-          processor: this.processCodeScript },
+      'script-source': {
+          parsers: [parseInt, parseString, parseString],
+          processor: this.processScriptSource },
       'sfi-move': { parsers: [parseInt, parseInt],
           processor: this.processFunctionMove },
       'active-runtime-timer': {
-        parsers: [null],
+        parsers: [parseString],
         processor: this.processRuntimeTimerEvent },
       'tick': {
           parsers: [parseInt, parseInt, parseInt,
-                    parseInt, parseInt, 'var-args'],
+                    parseInt, parseInt, parseVarArgs],
           processor: this.processTick },
-      'heap-sample-begin': { parsers: [null, null, parseInt],
+      'heap-sample-begin': { parsers: [parseString, parseString, parseInt],
           processor: this.processHeapSampleBegin },
-      'heap-sample-end': { parsers: [null, null],
+      'heap-sample-end': { parsers: [parseString, parseString],
           processor: this.processHeapSampleEnd },
-      'timer-event-start' : { parsers: [null, null, null],
+      'timer-event-start' : { parsers: [parseString, parseString, parseString],
                               processor: this.advanceDistortion },
-      'timer-event-end' : { parsers: [null, null, null],
+      'timer-event-end' : { parsers: [parseString, parseString, parseString],
                             processor: this.advanceDistortion },
       // Ignored events.
       'profiler': null,
@@ -332,7 +333,7 @@ TickProcessor.prototype.processCodeSourceInfo = function(
     endPos, sourcePositions, inliningPositions, inlinedFunctions);
 };
 
-TickProcessor.prototype.processCodeScript = function(script, url, source) {
+TickProcessor.prototype.processScriptSource = function(script, url, source) {
   this.profile_.addScriptSource(script, url, source);
 };
 
diff --git a/deps/v8/tools/torque/format-torque.py b/deps/v8/tools/torque/format-torque.py
new file mode 100755
index 00000000000000..3470d2f3c3a387
--- /dev/null
+++ b/deps/v8/tools/torque/format-torque.py
@@ -0,0 +1,36 @@
+#!/usr/bin/env python
+# Copyright 2014 the V8 project authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+"""This program either generates the parser files for Torque, generating
+the source and header files directly in V8's src directory."""
+
+import subprocess
+import sys
+import re
+from subprocess import Popen, PIPE
+
+if len(sys.argv) < 2 or len(sys.argv) > 3:
+  print "invalid number of arguments"
+  sys.exit(-1)
+
+use_stdout = True
+if len(sys.argv) == 3 and sys.argv[1] == '-i':
+  use_stdout = False
+
+filename = sys.argv[len(sys.argv) - 1]
+
+with open(filename, 'r') as content_file:
+  content = content_file.read()
+p = Popen(['clang-format', '-assume-filename=.ts'], stdin=PIPE, stdout=PIPE, stderr=PIPE)
+output, err = p.communicate(content)
+rc = p.returncode
+if (rc <> 0):
+  sys.exit(rc);
+if use_stdout:
+  print output
+else:
+  output_file = open(filename, 'w')
+  output_file.write(output);
+  output_file.close()
diff --git a/deps/v8/tools/torque/make-torque-parser.py b/deps/v8/tools/torque/make-torque-parser.py
new file mode 100755
index 00000000000000..8151d151e1d6e1
--- /dev/null
+++ b/deps/v8/tools/torque/make-torque-parser.py
@@ -0,0 +1,71 @@
+#!/usr/bin/env python
+# Copyright 2014 the V8 project authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+"""This program either generates the parser files for Torque, generating
+the source and header files directly in V8's src directory."""
+
+import subprocess
+import sys
+import os
+import ntpath
+import re
+
+cwd = os.getcwd()
+tools = ntpath.dirname(sys.argv[0]);
+grammar = tools + '/../../src/torque/Torque.g4'
+basename = ntpath.basename(grammar)
+dirname = ntpath.dirname(grammar)
+os.chdir(dirname)
+cargs = ['java', '-Xmx500M', 'org.antlr.v4.Tool', '-visitor', basename]
+result = subprocess.call(cargs)
+os.chdir(cwd)
+
+def fix_file(filename):
+  is_header = re.search(r'\.h', filename) <> None;
+  header_macro = filename.upper();
+  header_macro = re.sub('\.', '_', header_macro);
+  header_macro = "V8_TORQUE_" + header_macro + '_';
+
+  copyright = '// Copyright 2018 the V8 project authors. All rights reserved.\n'
+  copyright += '// Use of this source code is governed by a BSD-style license that can be\n'
+  copyright += '// found in the LICENSE file.\n'
+  file_path = tools + '/../../src/torque/' + filename;
+  temp_file_path = file_path + '.tmp'
+  output_file = open(temp_file_path, 'w')
+  output_file.write(copyright);
+  if is_header:
+    output_file.write('#ifndef ' + header_macro + '\n');
+    output_file.write('#define ' + header_macro + '\n');
+
+  with open(file_path) as f:
+    content = f.readlines()
+  for x in content:
+    x = re.sub(';;', ';', x)
+    x = re.sub('antlr4-runtime\.h', './antlr4-runtime.h', x)
+    x = re.sub('  TorqueParser.antlr4', '  explicit TorqueParser(antlr4', x)
+    x = re.sub('  TorqueLexer.antlr4', '  explicit TorqueLexer(antlr4', x)
+    if not re.search('= 0', x):
+      x = re.sub('virtual', '', x)
+    output_file.write(x)
+
+  if is_header:
+    output_file.write('#endif  // ' + header_macro + '\n');
+  output_file.close();
+
+  subprocess.call(['rm', file_path])
+  subprocess.call(['mv', temp_file_path, file_path])
+
+fix_file('TorqueBaseListener.h');
+fix_file('TorqueBaseListener.cpp');
+fix_file('TorqueBaseVisitor.h');
+fix_file('TorqueBaseVisitor.cpp');
+fix_file('TorqueLexer.h');
+fix_file('TorqueLexer.cpp');
+fix_file('TorqueParser.h');
+fix_file('TorqueParser.cpp');
+fix_file('TorqueListener.h');
+fix_file('TorqueListener.cpp');
+fix_file('TorqueVisitor.h');
+fix_file('TorqueVisitor.cpp');
diff --git a/deps/v8/tools/torque/vscode-torque/README.md b/deps/v8/tools/torque/vscode-torque/README.md
new file mode 100644
index 00000000000000..1d01daa3b9cbb0
--- /dev/null
+++ b/deps/v8/tools/torque/vscode-torque/README.md
@@ -0,0 +1,14 @@
+# Torque syntax support
+
+This extensions adds rudimentary syntax highlighting support for the WIP
+Torque language used in V8.
+
+## Installation
+
+Since the extension is not published to the marketplace, the easiest way to
+install the extension is to symlink the extension to your local extension
+directory:
+
+```
+ln -s $V8/tools/torque/vscode-torque $HOME/.vscode/extensions/vscode-torque
+```
\ No newline at end of file
diff --git a/deps/v8/tools/torque/vscode-torque/language-configuration.json b/deps/v8/tools/torque/vscode-torque/language-configuration.json
new file mode 100644
index 00000000000000..d43e282cc7d8b6
--- /dev/null
+++ b/deps/v8/tools/torque/vscode-torque/language-configuration.json
@@ -0,0 +1,25 @@
+{
+    "comments": {
+        "lineComment": "//",
+        "blockComment": [ "/*", "*/" ]
+    },
+    "brackets": [
+        ["{", "}"],
+        ["[", "]"],
+        ["(", ")"]
+    ],
+    "autoClosingPairs": [
+        ["{", "}"],
+        ["[", "]"],
+        ["(", ")"],
+        ["\"", "\""],
+        ["'", "'"]
+    ],
+    "surroundingPairs": [
+        ["{", "}"],
+        ["[", "]"],
+        ["(", ")"],
+        ["\"", "\""],
+        ["'", "'"]
+    ]
+}
\ No newline at end of file
diff --git a/deps/v8/tools/torque/vscode-torque/package.json b/deps/v8/tools/torque/vscode-torque/package.json
new file mode 100644
index 00000000000000..ac79161ae33fda
--- /dev/null
+++ b/deps/v8/tools/torque/vscode-torque/package.json
@@ -0,0 +1,26 @@
+{
+    "name": "vscode-torque",
+    "displayName": "Torque syntax support",
+    "description": "Basic Torque syntax highlighting support",
+    "version": "0.0.1",
+    "publisher": "szuend",
+    "engines": {
+        "vscode": "^1.22.0"
+    },
+    "categories": [
+        "Languages"
+    ],
+    "contributes": {
+        "languages": [{
+            "id": "torque",
+            "aliases": ["Torque", "torque"],
+            "extensions": [".tq"],
+            "configuration": "./language-configuration.json"
+        }],
+        "grammars": [{
+            "language": "torque",
+            "scopeName": "source.torque",
+            "path": "./syntaxes/torque.tmLanguage.json"
+        }]
+    }
+}
\ No newline at end of file
diff --git a/deps/v8/tools/torque/vscode-torque/syntaxes/torque.tmLanguage.json b/deps/v8/tools/torque/vscode-torque/syntaxes/torque.tmLanguage.json
new file mode 100644
index 00000000000000..ece8527c2de4a7
--- /dev/null
+++ b/deps/v8/tools/torque/vscode-torque/syntaxes/torque.tmLanguage.json
@@ -0,0 +1,88 @@
+{
+	"$schema": "https://raw.githubusercontent.com/martinring/tmlanguage/master/tmlanguage.json",
+	"name": "Torque",
+	"patterns": [
+		{
+			"include": "#keywords"
+		},
+		{
+			"include": "#strings"
+		},
+		{
+			"name": "comment.line.double-slash.torque",
+			"begin": "//",
+			"end": "$"
+		},
+		{
+			"name": "comment.block.torque",
+			"begin": "/\\*",
+			"end": "\\*/"
+		},
+		{
+			"name": "string.quoted.single.torque",
+			"begin": "'",
+			"end": "'",
+			"patterns": [
+				{
+					"name": "constant.character.escape.torque",
+					"match": "\\\\."
+				}]
+		},
+		{
+			"name": "support.function.torque",
+			"match": "\\b(min|max|assert|check|debug|unreachable)\\b"
+		},
+    {
+      "name": "support.variable.torque",
+      "match": "\\b(true|True|false|False|Undefined|Hole|Null)\\b"
+    },
+    {
+      "begin": "<(?=[A-Za-z][0-9A-Za-z_]*>)",
+      "end": ">",
+      "patterns": [
+        {
+          "name": "support.type.torque",
+          "match": "([A-Za-z][0-9A-Za-z_]*)"
+        }
+      ]
+    },
+    {
+      "begin": ":(\\s*)?",
+      "end": "(?=[^0-9A-Za-z_])",
+      "patterns": [
+        {
+          "name": "support.type.torque",
+          "match": "([A-Za-z][0-9A-Za-z_]*)"
+        }
+      ]
+    }
+	],
+	"repository": {
+		"keywords": {
+			"patterns": [{
+				"name": "keyword.control.torque",
+				"match": "\\b(if|else|while|for|return|continue|break|goto|otherwise|try|catch)\\b"
+			},
+			{
+				"name": "keyword.other.torque",
+				"match": "\\b(constexpr|module|macro|builtin|runtime|javascript|implicit|deferred|cast|convert|label|labels|tail|isnt|is|let|generates|type|extends|extern|const)\\b"
+			},
+			{
+				"name": "keyword.operator.torque",
+				"match": "\\b(=|\\*=)\\b"
+			}]
+		},
+		"strings": {
+			"name": "string.quoted.double.torque",
+			"begin": "\"",
+			"end": "\"",
+			"patterns": [
+				{
+					"name": "constant.character.escape.torque",
+					"match": "\\\\."
+				}
+			]
+		}
+	},
+	"scopeName": "source.torque"
+}
\ No newline at end of file
diff --git a/deps/v8/tools/try_perf.py b/deps/v8/tools/try_perf.py
index b77ccafa63e504..483dfe71994f41 100755
--- a/deps/v8/tools/try_perf.py
+++ b/deps/v8/tools/try_perf.py
@@ -52,6 +52,7 @@
   'sunspider',
   'unity',
   'wasm',
+  'web-tooling-benchmark',
 ]
 
 V8_BASE = os.path.abspath(os.path.dirname(os.path.dirname(__file__)))
diff --git a/deps/v8/tools/turbolizer/README.md b/deps/v8/tools/turbolizer/README.md
index d4010d83888cfc..01d5099c3e9aad 100644
--- a/deps/v8/tools/turbolizer/README.md
+++ b/deps/v8/tools/turbolizer/README.md
@@ -8,8 +8,13 @@ source code, Turbofan IR graphs, scheduled IR nodes and generated assembly code.
 Turbolizer consumes .json files that are generated per-function by d8 by passing
 the '--trace-turbo' command-line flag.
 
-Host the turbolizer locally by starting a web server that serves the contents of
-the turbolizer directory, e.g.:
+Turbolizer is build using npm:
+
+  npm i
+  npm run-script build
+
+Afterwards, turbolizer can be hosted locally by starting a web server that serve
+the contents of the turbolizer directory, e.g.:
 
     cd src/tools/turbolizer
     python -m SimpleHTTPServer 8000
@@ -60,3 +65,11 @@ script command must be piped to a file for uploading to turbolizer.
 There are many options that can be added to the first command, for example '-e'
 can be used to specify the counting of specific events (default: cycles), as
 well as '--cpu' to specify which CPU to sample.
+
+Turbolizer build process
+------------------------
+
+Turbolizer is currently migrating to TypeScript. The typescript sources reside in
+tools/turbolizer/src, and the typescript compiler will put the JavaScript output
+into tools/turbolizer/build/. The index.html file is set up to load the JavaScript
+from that directory.
diff --git a/deps/v8/tools/turbolizer/code-view.js b/deps/v8/tools/turbolizer/code-view.js
deleted file mode 100644
index 7f9728a83a70b9..00000000000000
--- a/deps/v8/tools/turbolizer/code-view.js
+++ /dev/null
@@ -1,170 +0,0 @@
-// Copyright 2015 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-"use strict";
-
-class CodeView extends View {
-  constructor(divID, PR, sourceText, sourcePosition, broker) {
-    super(divID, broker, null, false);
-    let view = this;
-    view.PR = PR;
-    view.mouseDown = false;
-    view.broker = broker;
-    view.allSpans = [];
-
-    var selectionHandler = {
-      clear: function() { broker.clear(selectionHandler); },
-      select: function(items, selected) {
-        var handler = this;
-        var broker = view.broker;
-        for (let span of items) {
-          if (selected) {
-            span.classList.add("selected");
-          } else {
-            span.classList.remove("selected");
-          }
-        }
-        var locations = [];
-        for (var span of items) {
-          locations.push({pos_start: span.start, pos_end: span.end});
-        }
-        broker.clear(selectionHandler);
-        broker.select(selectionHandler, locations, selected);
-      },
-      selectionDifference: function(span1, inclusive1, span2, inclusive2) {
-        var pos1 = span1.start;
-        var pos2 = span2.start;
-        var result = [];
-        var lineListDiv = view.divNode.firstChild.firstChild.childNodes;
-        for (var i = 0; i < lineListDiv.length; i++) {
-          var currentLineElement = lineListDiv[i];
-          var spans = currentLineElement.childNodes;
-          for (var j = 0; j < spans.length; ++j) {
-            var currentSpan = spans[j];
-            if (currentSpan.start > pos1 ||
-                (inclusive1 && currentSpan.start == pos1)) {
-              if (currentSpan.start < pos2 ||
-                  (inclusive2 && currentSpan.start == pos2)) {
-                result.push(currentSpan);
-              }
-            }
-          }
-        }
-        return result;
-      },
-      brokeredSelect: function(locations, selected) {
-        let firstSelect = view.selection.isEmpty();
-        for (let location of locations) {
-          let start = location.pos_start;
-          let end = location.pos_end;
-          if (start && end) {
-            let lower = 0;
-            let upper = view.allSpans.length;
-            if (upper > 0) {
-              while ((upper - lower) > 1) {
-                var middle = Math.floor((upper + lower) / 2);
-                var lineStart = view.allSpans[middle].start;
-                if (lineStart < start) {
-                  lower = middle;
-                } else if (lineStart > start) {
-                  upper = middle;
-                } else {
-                  lower = middle;
-                  break;
-                }
-              }
-              var currentSpan = view.allSpans[lower];
-              var currentLineElement = currentSpan.parentNode;
-              if ((currentSpan.start <= start && start < currentSpan.end) ||
-                  (currentSpan.start <= end && end < currentSpan.end)) {
-                if (firstSelect) {
-                  makeContainerPosVisible(
-                      view.divNode, currentLineElement.offsetTop);
-                  firstSelect = false;
-                }
-                view.selection.select(currentSpan, selected);
-              }
-            }
-          }
-        }
-      },
-      brokeredClear: function() { view.selection.clear(); },
-    };
-    view.selection = new Selection(selectionHandler);
-    broker.addSelectionHandler(selectionHandler);
-
-    view.handleSpanMouseDown = function(e) {
-      e.stopPropagation();
-      if (!e.shiftKey) {
-        view.selection.clear();
-      }
-      view.selection.select(this, true);
-      view.mouseDown = true;
-    }
-
-    view.handleSpanMouseMove = function(e) {
-      if (view.mouseDown) {
-        view.selection.extendTo(this);
-      }
-    }
-
-    view.handleCodeMouseDown = function(e) { view.selection.clear(); }
-
-    document.addEventListener('mouseup', function(e) {
-      view.mouseDown = false;
-    }, false);
-
-    view.initializeCode(sourceText, sourcePosition);
-  }
-
-  initializeContent(data, rememberedSelection) { this.data = data; }
-
-  initializeCode(sourceText, sourcePosition) {
-    var view = this;
-    var codePre = document.createElement("pre");
-    codePre.classList.add("prettyprint");
-    view.divNode.innerHTML = "";
-    view.divNode.appendChild(codePre);
-    if (sourceText != "") {
-      codePre.classList.add("linenums");
-      codePre.textContent = sourceText;
-      try {
-        // Wrap in try to work when offline.
-        view.PR.prettyPrint();
-      } catch (e) {
-      }
-
-      view.divNode.onmousedown = this.handleCodeMouseDown;
-
-      var base = sourcePosition;
-      var current = 0;
-      var lineListDiv = view.divNode.firstChild.firstChild.childNodes;
-      for (let i = 0; i < lineListDiv.length; i++) {
-        var currentLineElement = lineListDiv[i];
-        currentLineElement.id = "li" + i;
-        var pos = base + current;
-        currentLineElement.pos = pos;
-        var spans = currentLineElement.childNodes;
-        for (let j = 0; j < spans.length; ++j) {
-          var currentSpan = spans[j];
-          if (currentSpan.nodeType == 1) {
-            currentSpan.start = pos;
-            currentSpan.end = pos + currentSpan.textContent.length;
-            currentSpan.onmousedown = this.handleSpanMouseDown;
-            currentSpan.onmousemove = this.handleSpanMouseMove;
-            view.allSpans.push(currentSpan);
-          }
-          current += currentSpan.textContent.length;
-          pos = base + current;
-        }
-        while ((current < sourceText.length) &&
-               (sourceText[current] == '\n' || sourceText[current] == '\r')) {
-          ++current;
-        }
-      }
-    }
-  }
-
-  deleteContent() {}
-}
diff --git a/deps/v8/tools/turbolizer/constants.js b/deps/v8/tools/turbolizer/constants.js
deleted file mode 100644
index da92c45abc9033..00000000000000
--- a/deps/v8/tools/turbolizer/constants.js
+++ /dev/null
@@ -1,30 +0,0 @@
-// Copyright 2014 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-var MAX_RANK_SENTINEL = 0;
-var GRAPH_MARGIN = 250;
-var WIDTH = 'width';
-var HEIGHT = 'height';
-var VISIBILITY = 'visibility';
-var SOURCE_PANE_ID = 'left';
-var SOURCE_COLLAPSE_ID = 'source-shrink';
-var SOURCE_EXPAND_ID = 'source-expand';
-var INTERMEDIATE_PANE_ID = 'middle';
-var EMPTY_PANE_ID = 'empty';
-var GRAPH_PANE_ID = 'graph';
-var SCHEDULE_PANE_ID = 'schedule';
-var GENERATED_PANE_ID = 'right';
-var DISASSEMBLY_PANE_ID = 'disassembly';
-var DISASSEMBLY_COLLAPSE_ID = 'disassembly-shrink';
-var DISASSEMBLY_EXPAND_ID = 'disassembly-expand';
-var COLLAPSE_PANE_BUTTON_VISIBLE = 'button-input';
-var COLLAPSE_PANE_BUTTON_INVISIBLE = 'button-input-invisible';
-var UNICODE_BLOCK = '&#9611;';
-var PROF_COLS = [
-  { perc:   0, col: { r: 255, g: 255, b: 255 } },
-  { perc: 0.5, col: { r: 255, g: 255, b: 128 } },
-  { perc:   5, col: { r: 255, g: 128, b:   0 } },
-  { perc:  15, col: { r: 255, g:   0, b:   0 } },
-  { perc: 100, col: { r:   0, g:   0, b:   0 } }
-];
diff --git a/deps/v8/tools/turbolizer/deploy.sh b/deps/v8/tools/turbolizer/deploy.sh
new file mode 100755
index 00000000000000..db76dca490899a
--- /dev/null
+++ b/deps/v8/tools/turbolizer/deploy.sh
@@ -0,0 +1,18 @@
+#!/bin/bash
+
+DEST=$1
+
+if [ ! -d "$DEST" ]; then
+  echo -e "Destination \"$DEST\" is not a directory. Run\n\tnpm deploy -- [destination-directory]"
+  exit 1
+fi
+
+echo "Deploying..."
+
+cp *.jpg $DEST/
+cp *.png $DEST/
+cp *.css $DEST/
+cp index.html $DEST/
+cp -R build $DEST/
+
+echo "Deployed to $DEST/."
diff --git a/deps/v8/tools/turbolizer/edge.js b/deps/v8/tools/turbolizer/edge.js
deleted file mode 100644
index c0f63a0204ffc0..00000000000000
--- a/deps/v8/tools/turbolizer/edge.js
+++ /dev/null
@@ -1,79 +0,0 @@
-// Copyright 2014 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-var MINIMUM_EDGE_SEPARATION = 20;
-
-function isEdgeInitiallyVisible(target, index, source, type) {
-  return type == "control" && (target.cfg || source.cfg);
-}
-
-var Edge = function(target, index, source, type) {
-  this.target = target;
-  this.source = source;
-  this.index = index;
-  this.type = type;
-  this.backEdgeNumber = 0;
-  this.visible = isEdgeInitiallyVisible(target, index, source, type);
-};
-
-Edge.prototype.stringID = function() {
-  return this.source.id + "," + this.index +  "," + this.target.id;
-};
-
-Edge.prototype.isVisible = function() {
-  return this.visible && this.source.visible && this.target.visible;
-};
-
-Edge.prototype.getInputHorizontalPosition = function(graph) {
-  if (this.backEdgeNumber > 0) {
-    return graph.maxGraphNodeX + this.backEdgeNumber * MINIMUM_EDGE_SEPARATION;
-  }
-  var source = this.source;
-  var target = this.target;
-  var index = this.index;
-  var input_x = target.x + target.getInputX(index);
-  var inputApproach = target.getInputApproach(this.index);
-  var outputApproach = source.getOutputApproach(graph);
-  if (inputApproach > outputApproach) {
-    return input_x;
-  } else {
-    var inputOffset = MINIMUM_EDGE_SEPARATION * (index + 1);
-    return (target.x < source.x)
-      ? (target.x + target.getTotalNodeWidth() + inputOffset)
-      : (target.x - inputOffset)
-  }
-}
-
-Edge.prototype.generatePath = function(graph) {
-  var target = this.target;
-  var source = this.source;
-  var input_x = target.x + target.getInputX(this.index);
-  var arrowheadHeight = 7;
-  var input_y = target.y - 2 * DEFAULT_NODE_BUBBLE_RADIUS - arrowheadHeight;
-  var output_x = source.x + source.getOutputX();
-  var output_y = source.y + graph.getNodeHeight(source) + DEFAULT_NODE_BUBBLE_RADIUS;
-  var inputApproach = target.getInputApproach(this.index);
-  var outputApproach = source.getOutputApproach(graph);
-  var horizontalPos = this.getInputHorizontalPosition(graph);
-
-  var result = "M" + output_x + "," + output_y +
-    "L" + output_x + "," + outputApproach +
-    "L" + horizontalPos + "," + outputApproach;
-
-  if (horizontalPos != input_x) {
-    result += "L" + horizontalPos + "," + inputApproach;
-  } else {
-    if (inputApproach < outputApproach) {
-      inputApproach = outputApproach;
-    }
-  }
-
-  result += "L" + input_x + "," + inputApproach +
-    "L" + input_x + "," + input_y;
-  return result;
-}
-
-Edge.prototype.isBackEdge = function() {
-  return this.target.hasBackEdges() && (this.target.rank < this.source.rank);
-}
diff --git a/deps/v8/tools/turbolizer/empty-view.js b/deps/v8/tools/turbolizer/empty-view.js
deleted file mode 100644
index 66caf59d8f66a7..00000000000000
--- a/deps/v8/tools/turbolizer/empty-view.js
+++ /dev/null
@@ -1,19 +0,0 @@
-// Copyright 2015 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-"use strict";
-
-class EmptyView extends View {
-  constructor(id, broker) {
-    super(id, broker);
-    this.svg = this.divElement.append("svg").attr('version','1.1').attr("width", "100%");
-  }
-
-  initializeContent(data, rememberedSelection) {
-    this.svg.attr("height", document.documentElement.clientHeight + "px");
-  }
-
-  deleteContent() {
-  }
-}
diff --git a/deps/v8/tools/turbolizer/graph-view.js b/deps/v8/tools/turbolizer/graph-view.js
deleted file mode 100644
index cdbc40c8f03947..00000000000000
--- a/deps/v8/tools/turbolizer/graph-view.js
+++ /dev/null
@@ -1,1063 +0,0 @@
-// Copyright 2015 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-"use strict";
-
-class GraphView extends View {
-  constructor (d3, id, nodes, edges, broker) {
-    super(id, broker);
-    var graph = this;
-
-    var svg = this.divElement.append("svg").attr('version','1.1').attr("width", "100%");
-    graph.svg = svg;
-
-    graph.nodes = nodes || [];
-    graph.edges = edges || [];
-
-    graph.minGraphX = 0;
-    graph.maxGraphX = 1;
-    graph.minGraphY = 0;
-    graph.maxGraphY = 1;
-
-    graph.state = {
-      selection: null,
-      mouseDownNode: null,
-      justDragged: false,
-      justScaleTransGraph: false,
-      lastKeyDown: -1,
-      showTypes: false
-    };
-
-    var selectionHandler = {
-      clear: function() {
-        broker.clear(selectionHandler);
-      },
-      select: function(items, selected) {
-        var locations = [];
-        for (var d of items) {
-          if (selected) {
-            d.classList.add("selected");
-          } else {
-            d.classList.remove("selected");
-          }
-          var data = d.__data__;
-          locations.push({ pos_start: data.pos, pos_end: data.pos + 1, node_id: data.id});
-        }
-        broker.select(selectionHandler, locations, selected);
-      },
-      selectionDifference: function(span1, inclusive1, span2, inclusive2) {
-        // Should not be called
-      },
-      brokeredSelect: function(locations, selected) {
-        var test = [].entries().next();
-        var selection = graph.nodes
-          .filter(function(n) {
-            var pos = n.pos;
-            for (var location of locations) {
-              var start = location.pos_start;
-              var end = location.pos_end;
-              var id = location.node_id;
-              if (end != undefined) {
-                if (pos >= start && pos < end) {
-                  return true;
-                }
-              } else if (start != undefined) {
-                if (pos === start) {
-                  return true;
-                }
-              } else {
-                if (n.id === id) {
-                  return true;
-                }
-              }
-            }
-            return false;
-          });
-        var newlySelected = new Set();
-        selection.forEach(function(n) {
-          newlySelected.add(n);
-          if (!n.visible) {
-            n.visible = true;
-          }
-        });
-        graph.updateGraphVisibility();
-        graph.visibleNodes.each(function(n) {
-          if (newlySelected.has(n)) {
-            graph.state.selection.select(this, selected);
-          }
-        });
-        graph.updateGraphVisibility();
-        graph.viewSelection();
-      },
-      brokeredClear: function() {
-        graph.state.selection.clear();
-      }
-    };
-    broker.addSelectionHandler(selectionHandler);
-
-    graph.state.selection = new Selection(selectionHandler);
-
-    var defs = svg.append('svg:defs');
-    defs.append('svg:marker')
-      .attr('id', 'end-arrow')
-      .attr('viewBox', '0 -4 8 8')
-      .attr('refX', 2)
-      .attr('markerWidth', 2.5)
-      .attr('markerHeight', 2.5)
-      .attr('orient', 'auto')
-      .append('svg:path')
-      .attr('d', 'M0,-4L8,0L0,4');
-
-    this.graphElement = svg.append("g");
-    graph.visibleEdges = this.graphElement.append("g").selectAll("g");
-    graph.visibleNodes = this.graphElement.append("g").selectAll("g");
-
-    graph.drag = d3.behavior.drag()
-      .origin(function(d){
-        return {x: d.x, y: d.y};
-      })
-      .on("drag", function(args){
-        graph.state.justDragged = true;
-        graph.dragmove.call(graph, args);
-      })
-
-    d3.select("#upload").on("click", partial(this.uploadAction, graph));
-    d3.select("#layout").on("click", partial(this.layoutAction, graph));
-    d3.select("#show-all").on("click", partial(this.showAllAction, graph));
-    d3.select("#hide-dead").on("click", partial(this.hideDeadAction, graph));
-    d3.select("#hide-unselected").on("click", partial(this.hideUnselectedAction, graph));
-    d3.select("#hide-selected").on("click", partial(this.hideSelectedAction, graph));
-    d3.select("#zoom-selection").on("click", partial(this.zoomSelectionAction, graph));
-    d3.select("#toggle-types").on("click", partial(this.toggleTypesAction, graph));
-    d3.select("#search-input").on("keydown", partial(this.searchInputAction, graph));
-
-    // listen for key events
-    d3.select(window).on("keydown", function(e){
-      graph.svgKeyDown.call(graph);
-    })
-      .on("keyup", function(){
-        graph.svgKeyUp.call(graph);
-      });
-    svg.on("mousedown", function(d){graph.svgMouseDown.call(graph, d);});
-    svg.on("mouseup", function(d){graph.svgMouseUp.call(graph, d);});
-
-    graph.dragSvg = d3.behavior.zoom()
-      .on("zoom", function(){
-        if (d3.event.sourceEvent.shiftKey){
-          return false;
-        } else{
-          graph.zoomed.call(graph);
-        }
-        return true;
-      })
-      .on("zoomstart", function(){
-        if (!d3.event.sourceEvent.shiftKey) d3.select('body').style("cursor", "move");
-      })
-      .on("zoomend", function(){
-        d3.select('body').style("cursor", "auto");
-      });
-
-    svg.call(graph.dragSvg).on("dblclick.zoom", null);
-  }
-
-  static get selectedClass() {
-    return "selected";
-  }
-  static get rectClass() {
-    return "nodeStyle";
-  }
-  static get activeEditId() {
-    return "active-editing";
-  }
-  static get nodeRadius() {
-    return 50;
-  }
-
-  getNodeHeight(d) {
-    if (this.state.showTypes) {
-      return d.normalheight + d.labelbbox.height;
-    } else {
-      return d.normalheight;
-    }
-  }
-
-  getEdgeFrontier(nodes, inEdges, edgeFilter) {
-    let frontier = new Set();
-    nodes.forEach(function(element) {
-      var edges = inEdges ? element.__data__.inputs : element.__data__.outputs;
-      var edgeNumber = 0;
-      edges.forEach(function(edge) {
-        if (edgeFilter == undefined || edgeFilter(edge, edgeNumber)) {
-          frontier.add(edge);
-        }
-        ++edgeNumber;
-      });
-    });
-    return frontier;
-  }
-
-  getNodeFrontier(nodes, inEdges, edgeFilter) {
-    let graph = this;
-    var frontier = new Set();
-    var newState = true;
-    var edgeFrontier = graph.getEdgeFrontier(nodes, inEdges, edgeFilter);
-    // Control key toggles edges rather than just turning them on
-    if (d3.event.ctrlKey) {
-      edgeFrontier.forEach(function(edge) {
-        if (edge.visible) {
-          newState = false;
-        }
-      });
-    }
-    edgeFrontier.forEach(function(edge) {
-      edge.visible = newState;
-      if (newState) {
-        var node = inEdges ? edge.source : edge.target;
-        node.visible = true;
-        frontier.add(node);
-      }
-    });
-    graph.updateGraphVisibility();
-    if (newState) {
-      return graph.visibleNodes.filter(function(n) {
-        return frontier.has(n);
-      });
-    } else {
-      return undefined;
-    }
-  }
-
-  dragmove(d) {
-    var graph = this;
-    d.x += d3.event.dx;
-    d.y += d3.event.dy;
-    graph.updateGraphVisibility();
-  }
-
-  initializeContent(data, rememberedSelection) {
-    this.createGraph(data, rememberedSelection);
-    if (rememberedSelection != null) {
-      this.attachSelection(rememberedSelection);
-      this.connectVisibleSelectedNodes();
-      this.viewSelection();
-    }
-    this.updateGraphVisibility();
-  }
-
-  deleteContent() {
-    if (this.visibleNodes) {
-      this.nodes = [];
-      this.edges = [];
-      this.nodeMap = [];
-      this.updateGraphVisibility();
-    }
-  };
-
-  measureText(text) {
-    var textMeasure = document.getElementById('text-measure');
-    textMeasure.textContent = text;
-    return {
-      width: textMeasure.getBBox().width,
-      height: textMeasure.getBBox().height,
-    };
-  }
-
-  createGraph(data, initiallyVisibileIds) {
-    var g = this;
-    g.nodes = data.nodes;
-    g.nodeMap = [];
-    g.nodes.forEach(function(n, i){
-      n.__proto__ = Node;
-      n.visible = false;
-      n.x = 0;
-      n.y = 0;
-      n.rank = MAX_RANK_SENTINEL;
-      n.inputs = [];
-      n.outputs = [];
-      n.rpo = -1;
-      n.outputApproach = MINIMUM_NODE_OUTPUT_APPROACH;
-      n.cfg = n.control;
-      g.nodeMap[n.id] = n;
-      n.displayLabel = n.getDisplayLabel();
-      n.labelbbox = g.measureText(n.displayLabel);
-      n.typebbox = g.measureText(n.getDisplayType());
-      var innerwidth = Math.max(n.labelbbox.width, n.typebbox.width);
-      n.width = Math.alignUp(innerwidth + NODE_INPUT_WIDTH * 2,
-                             NODE_INPUT_WIDTH);
-      var innerheight = Math.max(n.labelbbox.height, n.typebbox.height);
-      n.normalheight = innerheight + 20;
-    });
-    g.edges = [];
-    data.edges.forEach(function(e, i){
-      var t = g.nodeMap[e.target];
-      var s = g.nodeMap[e.source];
-      var newEdge = new Edge(t, e.index, s, e.type);
-      t.inputs.push(newEdge);
-      s.outputs.push(newEdge);
-      g.edges.push(newEdge);
-      if (e.type == 'control') {
-        s.cfg = true;
-      }
-    });
-    g.nodes.forEach(function(n, i) {
-      n.visible = isNodeInitiallyVisible(n);
-      if (initiallyVisibileIds != undefined) {
-        if (initiallyVisibileIds.has(n.id)) {
-          n.visible = true;
-        }
-      }
-    });
-    g.fitGraphViewToWindow();
-    g.updateGraphVisibility();
-    g.layoutGraph();
-    g.updateGraphVisibility();
-    g.viewWholeGraph();
-  }
-
-  connectVisibleSelectedNodes() {
-    var graph = this;
-    graph.state.selection.selection.forEach(function(element) {
-      var edgeNumber = 0;
-      element.__data__.inputs.forEach(function(edge) {
-        if (edge.source.visible && edge.target.visible) {
-          edge.visible = true;
-        }
-      });
-      element.__data__.outputs.forEach(function(edge) {
-        if (edge.source.visible && edge.target.visible) {
-          edge.visible = true;
-        }
-      });
-    });
-  }
-
-  updateInputAndOutputBubbles() {
-    var g = this;
-    var s = g.visibleBubbles;
-    s.classed("filledBubbleStyle", function(c) {
-      var components = this.id.split(',');
-      if (components[0] == "ib") {
-        var edge = g.nodeMap[components[3]].inputs[components[2]];
-        return edge.isVisible();
-      } else {
-        return g.nodeMap[components[1]].areAnyOutputsVisible() == 2;
-      }
-    }).classed("halfFilledBubbleStyle", function(c) {
-      var components = this.id.split(',');
-      if (components[0] == "ib") {
-        var edge = g.nodeMap[components[3]].inputs[components[2]];
-        return false;
-      } else {
-        return g.nodeMap[components[1]].areAnyOutputsVisible() == 1;
-      }
-    }).classed("bubbleStyle", function(c) {
-      var components = this.id.split(',');
-      if (components[0] == "ib") {
-        var edge = g.nodeMap[components[3]].inputs[components[2]];
-        return !edge.isVisible();
-      } else {
-        return g.nodeMap[components[1]].areAnyOutputsVisible() == 0;
-      }
-    });
-    s.each(function(c) {
-      var components = this.id.split(',');
-      if (components[0] == "ob") {
-        var from = g.nodeMap[components[1]];
-        var x = from.getOutputX();
-        var y = g.getNodeHeight(from) + DEFAULT_NODE_BUBBLE_RADIUS;
-        var transform = "translate(" + x + "," + y + ")";
-        this.setAttribute('transform', transform);
-      }
-    });
-  }
-
-  attachSelection(s) {
-    var graph = this;
-    if (s.size != 0) {
-      this.visibleNodes.each(function(n) {
-        if (s.has(this.__data__.id)) {
-          graph.state.selection.select(this, true);
-        }
-      });
-    }
-  }
-
-  detachSelection() {
-    var selection = this.state.selection.detachSelection();
-    var s = new Set();
-    for (var i of selection) {
-      s.add(i.__data__.id);
-    };
-    return s;
-  }
-
-  pathMouseDown(path, d) {
-    d3.event.stopPropagation();
-    this.state.selection.clear();
-    this.state.selection.add(path);
-  };
-
-  nodeMouseDown(node, d) {
-    d3.event.stopPropagation();
-    this.state.mouseDownNode = d;
-  }
-
-  nodeMouseUp(d3node, d) {
-    var graph = this,
-    state = graph.state,
-    consts = graph.consts;
-
-    var mouseDownNode = state.mouseDownNode;
-
-    if (!mouseDownNode) return;
-
-    if (state.justDragged) {
-      // dragged, not clicked
-      redetermineGraphBoundingBox(graph);
-      state.justDragged = false;
-    } else{
-      // clicked, not dragged
-      var extend = d3.event.shiftKey;
-      var selection = graph.state.selection;
-      if (!extend) {
-        selection.clear();
-      }
-      selection.select(d3node[0][0], true);
-    }
-  }
-
-  selectSourcePositions(start, end, selected) {
-    var graph = this;
-    var map = [];
-    var sel = graph.nodes.filter(function(n) {
-      var pos = (n.pos === undefined)
-        ? -1
-        : n.getFunctionRelativeSourcePosition(graph);
-      if (pos >= start && pos < end) {
-        map[n.id] = true;
-        n.visible = true;
-      }
-    });
-    graph.updateGraphVisibility();
-    graph.visibleNodes.filter(function(n) { return map[n.id]; })
-      .each(function(n) {
-        var selection = graph.state.selection;
-        selection.select(d3.select(this), selected);
-      });
-  }
-
-  selectAllNodes(inEdges, filter) {
-    var graph = this;
-    if (!d3.event.shiftKey) {
-      graph.state.selection.clear();
-    }
-    graph.state.selection.select(graph.visibleNodes[0], true);
-    graph.updateGraphVisibility();
-  }
-
-  uploadAction(graph) {
-    document.getElementById("hidden-file-upload").click();
-  }
-
-  layoutAction(graph) {
-    graph.updateGraphVisibility();
-    graph.layoutGraph();
-    graph.updateGraphVisibility();
-    graph.viewWholeGraph();
-  }
-
-  showAllAction(graph) {
-    graph.nodes.filter(function(n) { n.visible = true; })
-    graph.edges.filter(function(e) { e.visible = true; })
-    graph.updateGraphVisibility();
-    graph.viewWholeGraph();
-  }
-
-  hideDeadAction(graph) {
-    graph.nodes.filter(function(n) { if (!n.isLive()) n.visible = false; })
-    graph.updateGraphVisibility();
-  }
-
-  hideUnselectedAction(graph) {
-    var unselected = graph.visibleNodes.filter(function(n) {
-      return !this.classList.contains("selected");
-    });
-    unselected.each(function(n) {
-      n.visible = false;
-    });
-    graph.updateGraphVisibility();
-  }
-
-  hideSelectedAction(graph) {
-    var selected = graph.visibleNodes.filter(function(n) {
-      return this.classList.contains("selected");
-    });
-    selected.each(function(n) {
-      n.visible = false;
-    });
-    graph.state.selection.clear();
-    graph.updateGraphVisibility();
-  }
-
-  zoomSelectionAction(graph) {
-    graph.viewSelection();
-  }
-
-  toggleTypesAction(graph) {
-    graph.toggleTypes();
-  }
-
-  searchInputAction(graph) {
-    if (d3.event.keyCode == 13) {
-      graph.state.selection.clear();
-      var query = this.value;
-      window.sessionStorage.setItem("lastSearch", query);
-
-      var reg = new RegExp(query);
-      var filterFunction = function(n) {
-        return (reg.exec(n.getDisplayLabel()) != null ||
-                (graph.state.showTypes && reg.exec(n.getDisplayType())) ||
-                reg.exec(n.opcode) != null);
-      };
-      if (d3.event.ctrlKey) {
-        graph.nodes.forEach(function(n, i) {
-          if (filterFunction(n)) {
-            n.visible = true;
-          }
-        });
-        graph.updateGraphVisibility();
-      }
-      var selected = graph.visibleNodes.each(function(n) {
-        if (filterFunction(n)) {
-          graph.state.selection.select(this, true);
-        }
-      });
-      graph.connectVisibleSelectedNodes();
-      graph.updateGraphVisibility();
-      this.blur();
-      graph.viewSelection();
-    }
-    d3.event.stopPropagation();
-  }
-
-  svgMouseDown() {
-    this.state.graphMouseDown = true;
-  }
-
-  svgMouseUp() {
-    var graph = this,
-    state = graph.state;
-    if (state.justScaleTransGraph) {
-      // Dragged
-      state.justScaleTransGraph = false;
-    } else {
-      // Clicked
-      if (state.mouseDownNode == null) {
-        graph.state.selection.clear();
-      }
-    }
-    state.mouseDownNode = null;
-    state.graphMouseDown = false;
-  }
-
-  svgKeyDown() {
-    var state = this.state;
-    var graph = this;
-
-    // Don't handle key press repetition
-    if(state.lastKeyDown !== -1) return;
-
-    var showSelectionFrontierNodes = function(inEdges, filter, select) {
-      var frontier = graph.getNodeFrontier(state.selection.selection, inEdges, filter);
-      if (frontier != undefined) {
-        if (select) {
-          if (!d3.event.shiftKey) {
-            state.selection.clear();
-          }
-          state.selection.select(frontier[0], true);
-        }
-        graph.updateGraphVisibility();
-      }
-      allowRepetition = false;
-    }
-
-    var allowRepetition = true;
-    var eventHandled = true; // unless the below switch defaults
-    switch(d3.event.keyCode) {
-    case 49:
-    case 50:
-    case 51:
-    case 52:
-    case 53:
-    case 54:
-    case 55:
-    case 56:
-    case 57:
-      // '1'-'9'
-      showSelectionFrontierNodes(true,
-          (edge, index) => { return index == (d3.event.keyCode - 49); },
-          false);
-      break;
-    case 97:
-    case 98:
-    case 99:
-    case 100:
-    case 101:
-    case 102:
-    case 103:
-    case 104:
-    case 105:
-      // 'numpad 1'-'numpad 9'
-      showSelectionFrontierNodes(true,
-          (edge, index) => { return index == (d3.event.keyCode - 97); },
-          false);
-      break;
-    case 67:
-      // 'c'
-      showSelectionFrontierNodes(true,
-          (edge, index) => { return edge.type == 'control'; },
-          false);
-      break;
-    case 69:
-      // 'e'
-      showSelectionFrontierNodes(true,
-          (edge, index) => { return edge.type == 'effect'; },
-          false);
-      break;
-    case 79:
-      // 'o'
-      showSelectionFrontierNodes(false, undefined, false);
-      break;
-    case 73:
-      // 'i'
-      showSelectionFrontierNodes(true, undefined, false);
-      break;
-    case 65:
-      // 'a'
-      graph.selectAllNodes();
-      allowRepetition = false;
-      break;
-    case 38:
-    case 40: {
-      showSelectionFrontierNodes(d3.event.keyCode == 38, undefined, true);
-      break;
-    }
-    case 82:
-      // 'r'
-      if (!d3.event.ctrlKey) {
-        this.layoutAction(this);
-      } else {
-        eventHandled = false;
-      }
-      break;
-    case 191:
-      // '/'
-      document.getElementById("search-input").focus();
-      document.getElementById("search-input").select();
-      break;
-    default:
-      eventHandled = false;
-      break;
-    }
-    if (eventHandled) {
-      d3.event.preventDefault();
-    }
-    if (!allowRepetition) {
-      state.lastKeyDown = d3.event.keyCode;
-    }
-  }
-
-  svgKeyUp() {
-    this.state.lastKeyDown = -1
-  };
-
-  layoutEdges() {
-    var graph = this;
-    graph.maxGraphX = graph.maxGraphNodeX;
-    this.visibleEdges.attr("d", function(edge){
-      return edge.generatePath(graph);
-    });
-  }
-
-  layoutGraph() {
-    layoutNodeGraph(this);
-  }
-
-  // call to propagate changes to graph
-  updateGraphVisibility() {
-
-    var graph = this,
-    state = graph.state;
-
-    var filteredEdges = graph.edges.filter(function(e) { return e.isVisible(); });
-    var visibleEdges = graph.visibleEdges.data(filteredEdges, function(edge) {
-      return edge.stringID();
-    });
-
-    // add new paths
-    visibleEdges.enter()
-      .append('path')
-      .style('marker-end','url(#end-arrow)')
-      .classed('hidden', function(e) {
-        return !e.isVisible();
-      })
-      .attr("id", function(edge){ return "e," + edge.stringID(); })
-      .on("mousedown", function(d){
-        graph.pathMouseDown.call(graph, d3.select(this), d);
-      })
-      .attr("adjacentToHover", "false");
-
-    // Set the correct styles on all of the paths
-    visibleEdges.classed('value', function(e) {
-      return e.type == 'value' || e.type == 'context';
-    }).classed('control', function(e) {
-      return e.type == 'control';
-    }).classed('effect', function(e) {
-      return e.type == 'effect';
-    }).classed('frame-state', function(e) {
-      return e.type == 'frame-state';
-    }).attr('stroke-dasharray', function(e) {
-      if (e.type == 'frame-state') return "10,10";
-      return (e.type == 'effect') ? "5,5" : "";
-    });
-
-    // remove old links
-    visibleEdges.exit().remove();
-
-    graph.visibleEdges = visibleEdges;
-
-    // update existing nodes
-    var filteredNodes = graph.nodes.filter(function(n) { return n.visible; });
-    graph.visibleNodes = graph.visibleNodes.data(filteredNodes, function(d) {
-      return d.id;
-    });
-    graph.visibleNodes.attr("transform", function(n){
-      return "translate(" + n.x + "," + n.y + ")";
-    }).select('rect').
-      attr(HEIGHT, function(d) { return graph.getNodeHeight(d); });
-
-    // add new nodes
-    var newGs = graph.visibleNodes.enter()
-      .append("g");
-
-    newGs.classed("turbonode", function(n) { return true; })
-      .classed("control", function(n) { return n.isControl(); })
-      .classed("live", function(n) { return n.isLive(); })
-      .classed("dead", function(n) { return !n.isLive(); })
-      .classed("javascript", function(n) { return n.isJavaScript(); })
-      .classed("input", function(n) { return n.isInput(); })
-      .classed("simplified", function(n) { return n.isSimplified(); })
-      .classed("machine", function(n) { return n.isMachine(); })
-      .attr("transform", function(d){ return "translate(" + d.x + "," + d.y + ")";})
-      .on("mousedown", function(d){
-        graph.nodeMouseDown.call(graph, d3.select(this), d);
-      })
-      .on("mouseup", function(d){
-        graph.nodeMouseUp.call(graph, d3.select(this), d);
-      })
-      .on('mouseover', function(d){
-        var nodeSelection = d3.select(this);
-        let node = graph.nodeMap[d.id];
-        let adjInputEdges = graph.visibleEdges.filter(e => { return e.target === node; });
-        let adjOutputEdges = graph.visibleEdges.filter(e => { return e.source === node; });
-        adjInputEdges.attr('relToHover', "input");
-        adjOutputEdges.attr('relToHover', "output");
-        let adjInputNodes = adjInputEdges.data().map(e => e.source);
-        graph.visibleNodes.data(adjInputNodes, function(d) {
-          return d.id;
-        }).attr('relToHover', "input");
-        let adjOutputNodes = adjOutputEdges.data().map(e => e.target);
-        graph.visibleNodes.data(adjOutputNodes, function(d) {
-          return d.id;
-        }).attr('relToHover', "output");
-        graph.updateGraphVisibility();
-      })
-      .on('mouseout', function(d){
-        var nodeSelection = d3.select(this);
-        let node = graph.nodeMap[d.id];
-        let adjEdges = graph.visibleEdges.filter(e => { return e.target === node  || e.source === node; });
-        adjEdges.attr('relToHover', "none");
-        let adjNodes = adjEdges.data().map(e => e.target).concat(adjEdges.data().map(e => e.source));
-        let nodes = graph.visibleNodes.data(adjNodes, function(d) {
-          return d.id;
-        }).attr('relToHover', "none");
-        graph.updateGraphVisibility();
-      })
-      .call(graph.drag);
-
-    newGs.append("rect")
-      .attr("rx", 10)
-      .attr("ry", 10)
-      .attr(WIDTH, function(d) {
-        return d.getTotalNodeWidth();
-      })
-      .attr(HEIGHT, function(d) {
-        return graph.getNodeHeight(d);
-      })
-
-    function appendInputAndOutputBubbles(g, d) {
-      for (var i = 0; i < d.inputs.length; ++i) {
-        var x = d.getInputX(i);
-        var y = -DEFAULT_NODE_BUBBLE_RADIUS;
-        var s = g.append('circle')
-          .classed("filledBubbleStyle", function(c) {
-            return d.inputs[i].isVisible();
-          } )
-          .classed("bubbleStyle", function(c) {
-            return !d.inputs[i].isVisible();
-          } )
-          .attr("id", "ib," + d.inputs[i].stringID())
-          .attr("r", DEFAULT_NODE_BUBBLE_RADIUS)
-          .attr("transform", function(d) {
-            return "translate(" + x + "," + y + ")";
-          })
-          .on("mousedown", function(d){
-            var components = this.id.split(',');
-            var node = graph.nodeMap[components[3]];
-            var edge = node.inputs[components[2]];
-            var visible = !edge.isVisible();
-            node.setInputVisibility(components[2], visible);
-            d3.event.stopPropagation();
-            graph.updateGraphVisibility();
-          });
-      }
-      if (d.outputs.length != 0) {
-        var x = d.getOutputX();
-        var y = graph.getNodeHeight(d) + DEFAULT_NODE_BUBBLE_RADIUS;
-        var s = g.append('circle')
-          .classed("filledBubbleStyle", function(c) {
-            return d.areAnyOutputsVisible() == 2;
-          } )
-          .classed("halFilledBubbleStyle", function(c) {
-            return d.areAnyOutputsVisible() == 1;
-          } )
-          .classed("bubbleStyle", function(c) {
-            return d.areAnyOutputsVisible() == 0;
-          } )
-          .attr("id", "ob," + d.id)
-          .attr("r", DEFAULT_NODE_BUBBLE_RADIUS)
-          .attr("transform", function(d) {
-            return "translate(" + x + "," + y + ")";
-          })
-          .on("mousedown", function(d) {
-            d.setOutputVisibility(d.areAnyOutputsVisible() == 0);
-            d3.event.stopPropagation();
-            graph.updateGraphVisibility();
-          });
-      }
-    }
-
-    newGs.each(function(d){
-      appendInputAndOutputBubbles(d3.select(this), d);
-    });
-
-    newGs.each(function(d){
-      d3.select(this).append("text")
-        .classed("label", true)
-        .attr("text-anchor","right")
-        .attr("dx", 5)
-        .attr("dy", 5)
-        .append('tspan')
-        .text(function(l) {
-          return d.getDisplayLabel();
-        })
-        .append("title")
-        .text(function(l) {
-          return d.getTitle();
-        })
-      if (d.type != undefined) {
-        d3.select(this).append("text")
-          .classed("label", true)
-          .classed("type", true)
-          .attr("text-anchor","right")
-          .attr("dx", 5)
-          .attr("dy", d.labelbbox.height + 5)
-          .append('tspan')
-          .text(function(l) {
-            return d.getDisplayType();
-          })
-          .append("title")
-          .text(function(l) {
-            return d.getType();
-          })
-      }
-    });
-
-    graph.visibleNodes.select('.type').each(function (d) {
-      this.setAttribute('visibility', graph.state.showTypes ? 'visible' : 'hidden');
-    });
-
-    // remove old nodes
-    graph.visibleNodes.exit().remove();
-
-    graph.visibleBubbles = d3.selectAll('circle');
-
-    graph.updateInputAndOutputBubbles();
-
-    graph.layoutEdges();
-
-    graph.svg.style.height = '100%';
-  }
-
-  getVisibleTranslation(translate, scale) {
-    var graph = this;
-    var height = (graph.maxGraphY - graph.minGraphY + 2 * GRAPH_MARGIN) * scale;
-    var width = (graph.maxGraphX - graph.minGraphX + 2 * GRAPH_MARGIN) * scale;
-
-    var dimensions = this.getSvgViewDimensions();
-
-    var baseY = translate[1];
-    var minY = (graph.minGraphY - GRAPH_MARGIN) * scale;
-    var maxY = (graph.maxGraphY + GRAPH_MARGIN) * scale;
-
-    var adjustY = 0;
-    var adjustYCandidate = 0;
-    if ((maxY + baseY) < dimensions[1]) {
-      adjustYCandidate = dimensions[1] - (maxY + baseY);
-      if ((minY + baseY + adjustYCandidate) > 0) {
-        adjustY = (dimensions[1] / 2) - (maxY - (height / 2)) - baseY;
-      } else {
-        adjustY = adjustYCandidate;
-      }
-    } else if (-baseY < minY) {
-      adjustYCandidate = -(baseY + minY);
-      if ((maxY + baseY + adjustYCandidate) < dimensions[1]) {
-        adjustY = (dimensions[1] / 2) - (maxY - (height / 2)) - baseY;
-      } else {
-        adjustY = adjustYCandidate;
-      }
-    }
-    translate[1] += adjustY;
-
-    var baseX = translate[0];
-    var minX = (graph.minGraphX - GRAPH_MARGIN) * scale;
-    var maxX = (graph.maxGraphX + GRAPH_MARGIN) * scale;
-
-    var adjustX = 0;
-    var adjustXCandidate = 0;
-    if ((maxX + baseX) < dimensions[0]) {
-      adjustXCandidate = dimensions[0] - (maxX + baseX);
-      if ((minX + baseX + adjustXCandidate) > 0) {
-        adjustX = (dimensions[0] / 2) - (maxX - (width / 2)) - baseX;
-      } else {
-        adjustX = adjustXCandidate;
-      }
-    } else if (-baseX < minX) {
-      adjustXCandidate = -(baseX + minX);
-      if ((maxX + baseX + adjustXCandidate) < dimensions[0]) {
-        adjustX = (dimensions[0] / 2) - (maxX - (width / 2)) - baseX;
-      } else {
-        adjustX = adjustXCandidate;
-      }
-    }
-    translate[0] += adjustX;
-    return translate;
-  }
-
-  translateClipped(translate, scale, transition) {
-    var graph = this;
-    var graphNode = this.graphElement[0][0];
-    var translate = this.getVisibleTranslation(translate, scale);
-    if (transition) {
-      graphNode.classList.add('visible-transition');
-      clearTimeout(graph.transitionTimout);
-      graph.transitionTimout = setTimeout(function(){
-        graphNode.classList.remove('visible-transition');
-      }, 1000);
-    }
-    var translateString = "translate(" + translate[0] + "px," + translate[1] + "px) scale(" + scale + ")";
-    graphNode.style.transform = translateString;
-    graph.dragSvg.translate(translate);
-    graph.dragSvg.scale(scale);
-  }
-
-  zoomed(){
-    this.state.justScaleTransGraph = true;
-    var scale =  this.dragSvg.scale();
-    this.translateClipped(d3.event.translate, scale);
-  }
-
-
-  getSvgViewDimensions() {
-    var canvasWidth = this.parentNode.clientWidth;
-    var documentElement = document.documentElement;
-    var canvasHeight = documentElement.clientHeight;
-    return [canvasWidth, canvasHeight];
-  }
-
-
-  minScale() {
-    var graph = this;
-    var dimensions = this.getSvgViewDimensions();
-    var width = graph.maxGraphX - graph.minGraphX;
-    var height = graph.maxGraphY - graph.minGraphY;
-    var minScale = dimensions[0] / (width + GRAPH_MARGIN * 2);
-    var minScaleYCandidate = dimensions[1] / (height + GRAPH_MARGIN * 2);
-    if (minScaleYCandidate < minScale) {
-      minScale = minScaleYCandidate;
-    }
-    this.dragSvg.scaleExtent([minScale, 1.5]);
-    return minScale;
-  }
-
-  fitGraphViewToWindow() {
-    this.svg.attr("height", document.documentElement.clientHeight + "px");
-    this.translateClipped(this.dragSvg.translate(), this.dragSvg.scale());
-  }
-
-  toggleTypes() {
-    var graph = this;
-    graph.state.showTypes = !graph.state.showTypes;
-    var element = document.getElementById('toggle-types');
-    if (graph.state.showTypes) {
-      element.classList.add('button-input-toggled');
-    } else {
-      element.classList.remove('button-input-toggled');
-    }
-    graph.updateGraphVisibility();
-  }
-
-  viewSelection() {
-    var graph = this;
-    var minX, maxX, minY, maxY;
-    var hasSelection = false;
-    graph.visibleNodes.each(function(n) {
-      if (this.classList.contains("selected")) {
-        hasSelection = true;
-        minX = minX ? Math.min(minX, n.x) : n.x;
-        maxX = maxX ? Math.max(maxX, n.x + n.getTotalNodeWidth()) :
-          n.x + n.getTotalNodeWidth();
-        minY = minY ? Math.min(minY, n.y) : n.y;
-        maxY = maxY ? Math.max(maxY, n.y + graph.getNodeHeight(n)) :
-          n.y + graph.getNodeHeight(n);
-      }
-    });
-    if (hasSelection) {
-      graph.viewGraphRegion(minX - NODE_INPUT_WIDTH, minY - 60,
-                            maxX + NODE_INPUT_WIDTH, maxY + 60,
-                            true);
-    }
-  }
-
-  viewGraphRegion(minX, minY, maxX, maxY, transition) {
-    var graph = this;
-    var dimensions = this.getSvgViewDimensions();
-    var width = maxX - minX;
-    var height = maxY - minY;
-    var scale = Math.min(dimensions[0] / width, dimensions[1] / height);
-    scale = Math.min(1.5, scale);
-    scale = Math.max(graph.minScale(), scale);
-    var translation = [-minX*scale, -minY*scale];
-    translation = graph.getVisibleTranslation(translation, scale);
-    graph.translateClipped(translation, scale, transition);
-  }
-
-  viewWholeGraph() {
-    var graph = this;
-    var minScale = graph.minScale();
-    var translation = [0, 0];
-    translation = graph.getVisibleTranslation(translation, minScale);
-    graph.translateClipped(translation, minScale);
-  }
-}
diff --git a/deps/v8/tools/turbolizer/index.html b/deps/v8/tools/turbolizer/index.html
index 2167d21a141410..47375cbbb02703 100644
--- a/deps/v8/tools/turbolizer/index.html
+++ b/deps/v8/tools/turbolizer/index.html
@@ -3,13 +3,11 @@
   <head>
     <title>Turbolizer</title>
     <link rel="stylesheet" href="turbo-visualizer.css" />
+    <link rel="stylesheet" href="prettify.css" />
+    <link rel="icon" type="image/png" href="turbolizer.png">
   </head>
   <body>
-    <div id="left" class="viewpane">
-      <div id='source-text'>
-        <pre id='source-text-pre'\>
-      </div>
-    </div>
+    <div id="left" class="viewpane scrollable"></div>
     <div class="resizer-left"></div>
     <div id="middle" class="viewpane">
       <div id="graph-toolbox-anchor">
@@ -18,7 +16,7 @@
                  alt="layout graph" class="button-input">
           <input id="show-all" type="image" title="show all nodes" src="expand-all.jpg"
                  alt="show all nodes" class="button-input">
-          <input id="hide-dead" type="image" title="only live nodes" src="live.png"
+          <input id="toggle-hide-dead" type="image" title="show only live nodes" src="live.png"
                  alt="only live nodes" class="button-input">
           <input id="hide-unselected" type="image" title="hide unselected nodes"
                  src="hide-unselected.png" alt="hide unselected nodes" class="button-input">
@@ -36,33 +34,17 @@
           </select>
         </span>
       </div>
-
       <div id="load-file">
-        <input type="file" id="hidden-file-upload">
+        <input id="upload-helper" type="file">
         <input id="upload" type="image" title="load graph" class="button-input"
                src="upload-icon.png" alt="upload graph">
       </div>
-      <div id="empty" width="100%" height="100%"></div>
-      <div id="graph" width="100%" height="100%"></div>
-      <div id="schedule" width="100%">
-        <pre id="schedule-text-pre" class='prettyprint prettyprinted'>
-          <ul id="schedule-list" class='nolinenums noindent'>
-          </ul>
-        </pre>
-      </div>
       <div id='text-placeholder' width="0px" height="0px" style="position: absolute; top:100000px;" ><svg><text text-anchor="right">
           <tspan white-space="inherit" id="text-measure"/>
       </text></svg></div>
     </div>
     <div class="resizer-right"></div>
-    <div id="right" class="viewpane">
-      <div id='disassembly'>
-        <pre id='disassembly-text-pre' class='prettyprint prettyprinted'>
-          <ul id='disassembly-list' class='nolinenums noindent'>
-          </ul>
-        </pre>
-      </div>
-    </div>
+    <div id="right" class="viewpane scrollable"></div>
     <div id="source-collapse" class="collapse-pane">
       <input id="source-expand" type="image" title="show source"
              src="right-arrow.png" class="button-input invisible">
@@ -76,24 +58,7 @@
              src="right-arrow.png" class="button-input">
     </div>
     <script src="https://cdn.rawgit.com/google/code-prettify/master/loader/run_prettify.js"></script>
-    <script src="http://d3js.org/d3.v3.min.js" charset="utf-8"></script>
-    <script src="https://cdn.jsdelivr.net/filesaver.js/0.1/FileSaver.min.js"></script>
-    <script src="monkey.js"></script>
-    <script src="util.js"></script>
-    <script src="lang-disassembly.js"></script>
-    <script src="node.js"></script>
-    <script src="edge.js"></script>
-    <script src="selection.js"></script>
-    <script src="selection-broker.js"></script>
-    <script src="constants.js"></script>
-    <script src="view.js"></script>
-    <script src="text-view.js"></script>
-    <script src="empty-view.js"></script>
-    <script src="code-view.js"></script>
-    <script src="graph-layout.js"></script>
-    <script src="graph-view.js"></script>
-    <script src="schedule-view.js"></script>
-    <script src="disassembly-view.js"></script>
-    <script src="turbo-visualizer.js"></script>
+    <script src="https://d3js.org/d3.v5.js" charset="utf-8"></script>
+    <script src="build/turbolizer.js"></script>
   </body>
 </html>
diff --git a/deps/v8/tools/turbolizer/lang-disassembly.js b/deps/v8/tools/turbolizer/lang-disassembly.js
deleted file mode 100644
index 590f9fd804f6a8..00000000000000
--- a/deps/v8/tools/turbolizer/lang-disassembly.js
+++ /dev/null
@@ -1,14 +0,0 @@
-// Copyright 2015 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-PR.registerLangHandler(
-    PR.createSimpleLexer(
-      [
-        [PR.PR_STRING,        /^(?:\'(?:[^\\\'\r\n]|\\.)*(?:\'|$))/, null, '\''],
-        [PR.PR_PLAIN,         /^\s+/, null, ' \r\n\t\xA0']
-      ],
-      [ // fallthroughStylePatterns
-        [PR.PR_COMMENT,       /;; debug: position \d+/, null],
-      ]),
-    ['disassembly']);
diff --git a/deps/v8/tools/turbolizer/package-lock.json b/deps/v8/tools/turbolizer/package-lock.json
new file mode 100644
index 00000000000000..05a5daf031de72
--- /dev/null
+++ b/deps/v8/tools/turbolizer/package-lock.json
@@ -0,0 +1,613 @@
+{
+  "name": "turbolizer",
+  "version": "0.1.0",
+  "lockfileVersion": 1,
+  "requires": true,
+  "dependencies": {
+    "@types/commander": {
+      "version": "2.12.2",
+      "resolved": "https://registry.npmjs.org/@types/commander/-/commander-2.12.2.tgz",
+      "integrity": "sha512-0QEFiR8ljcHp9bAbWxecjVRuAMr16ivPiGOw6KFQBVrVd0RQIcM3xKdRisH2EDWgVWujiYtHwhSkSUoAAGzH7Q==",
+      "dev": true,
+      "requires": {
+        "commander": "*"
+      }
+    },
+    "@types/d3": {
+      "version": "5.0.0",
+      "resolved": "https://registry.npmjs.org/@types/d3/-/d3-5.0.0.tgz",
+      "integrity": "sha512-BVfPw7ha+UgsG24v6ymerMY4+pJgQ/6p+hJA4loCeaaqV9snGS/G6ReVaQEn8Himn67dWn/Je9WhRbnDO7MzLw==",
+      "requires": {
+        "@types/d3-array": "*",
+        "@types/d3-axis": "*",
+        "@types/d3-brush": "*",
+        "@types/d3-chord": "*",
+        "@types/d3-collection": "*",
+        "@types/d3-color": "*",
+        "@types/d3-contour": "*",
+        "@types/d3-dispatch": "*",
+        "@types/d3-drag": "*",
+        "@types/d3-dsv": "*",
+        "@types/d3-ease": "*",
+        "@types/d3-fetch": "*",
+        "@types/d3-force": "*",
+        "@types/d3-format": "*",
+        "@types/d3-geo": "*",
+        "@types/d3-hierarchy": "*",
+        "@types/d3-interpolate": "*",
+        "@types/d3-path": "*",
+        "@types/d3-polygon": "*",
+        "@types/d3-quadtree": "*",
+        "@types/d3-random": "*",
+        "@types/d3-scale": "*",
+        "@types/d3-scale-chromatic": "*",
+        "@types/d3-selection": "*",
+        "@types/d3-shape": "*",
+        "@types/d3-time": "*",
+        "@types/d3-time-format": "*",
+        "@types/d3-timer": "*",
+        "@types/d3-transition": "*",
+        "@types/d3-voronoi": "*",
+        "@types/d3-zoom": "*"
+      }
+    },
+    "@types/d3-array": {
+      "version": "1.2.1",
+      "resolved": "https://registry.npmjs.org/@types/d3-array/-/d3-array-1.2.1.tgz",
+      "integrity": "sha512-YBaAfimGdWE4nDuoGVKsH89/dkz2hWZ0i8qC+xxqmqi+XJ/aXiRF0jPtzXmN7VdkpVjy1xuDmM5/m1FNuB6VWA=="
+    },
+    "@types/d3-axis": {
+      "version": "1.0.10",
+      "resolved": "https://registry.npmjs.org/@types/d3-axis/-/d3-axis-1.0.10.tgz",
+      "integrity": "sha512-5YF0wfdQMPKw01VAAupLIlg/T4pn5M3/vL9u0KZjiemnVnnKBEWE24na4X1iW+TfZiYJ8j+BgK2KFYnAAT54Ug==",
+      "requires": {
+        "@types/d3-selection": "*"
+      }
+    },
+    "@types/d3-brush": {
+      "version": "1.0.8",
+      "resolved": "https://registry.npmjs.org/@types/d3-brush/-/d3-brush-1.0.8.tgz",
+      "integrity": "sha512-9Thv09jvolu9T1BE3fHmIeYSgbwSpdxtF6/A5HZEDjSTfgtA0mtaXRk5AiWOo0KjuLsI+/7ggD3ZGN5Ye8KXPQ==",
+      "requires": {
+        "@types/d3-selection": "*"
+      }
+    },
+    "@types/d3-chord": {
+      "version": "1.0.7",
+      "resolved": "https://registry.npmjs.org/@types/d3-chord/-/d3-chord-1.0.7.tgz",
+      "integrity": "sha512-WbCN7SxhZMpQQw46oSjAovAmvl3IdjhLuQ4r7AXCzNKyxtXXBWuihSPZ4bVwFQF3+S2z37i9d4hfUBatcSJpog=="
+    },
+    "@types/d3-collection": {
+      "version": "1.0.7",
+      "resolved": "https://registry.npmjs.org/@types/d3-collection/-/d3-collection-1.0.7.tgz",
+      "integrity": "sha512-vR3BT0GwHc5y93Jv6bxn3zoxP/vGu+GdXu/r1ApjbP9dLk9I2g6NiV7iP/QMQSuFZd0It0n/qWrfXHxCWwHIkg=="
+    },
+    "@types/d3-color": {
+      "version": "1.2.1",
+      "resolved": "https://registry.npmjs.org/@types/d3-color/-/d3-color-1.2.1.tgz",
+      "integrity": "sha512-xwb1tqvYNWllbHuhMFhiXk63Imf+QNq/dJdmbXmr2wQVnwGenCuj3/0IWJ9hdIFQIqzvhT7T37cvx93jtAsDbQ=="
+    },
+    "@types/d3-contour": {
+      "version": "1.2.1",
+      "resolved": "https://registry.npmjs.org/@types/d3-contour/-/d3-contour-1.2.1.tgz",
+      "integrity": "sha512-p8iC4KeVFyT3qRTGQRj0Jf5QDdPsDUevBEnma7gEsY1yDolVSLanG2eFAiLV+xj8/5DK7oU7Ey8z0drs3pbsug==",
+      "requires": {
+        "@types/d3-array": "*",
+        "@types/geojson": "*"
+      }
+    },
+    "@types/d3-dispatch": {
+      "version": "1.0.6",
+      "resolved": "https://registry.npmjs.org/@types/d3-dispatch/-/d3-dispatch-1.0.6.tgz",
+      "integrity": "sha512-xyWJQMr832vqhu6fD/YqX+MSFBWnkxasNhcStvlhqygXxj0cKqPft0wuGoH5TIq5ADXgP83qeNVa4R7bEYN3uA=="
+    },
+    "@types/d3-drag": {
+      "version": "1.2.1",
+      "resolved": "https://registry.npmjs.org/@types/d3-drag/-/d3-drag-1.2.1.tgz",
+      "integrity": "sha512-J9liJ4NNeV0oN40MzPiqwWjqNi3YHCRtHNfNMZ1d3uL9yh1+vDuo346LBEr8yyBm30WHvrHssAkExVZrGCswtA==",
+      "requires": {
+        "@types/d3-selection": "*"
+      }
+    },
+    "@types/d3-dsv": {
+      "version": "1.0.33",
+      "resolved": "https://registry.npmjs.org/@types/d3-dsv/-/d3-dsv-1.0.33.tgz",
+      "integrity": "sha512-jx5YvaVC3Wfh6LobaiWTeU1NkvL2wPmmpmajk618bD+xVz98yNWzmZMvmlPHGK0HXbMeHmW/6oVX48V9AH1bRQ=="
+    },
+    "@types/d3-ease": {
+      "version": "1.0.7",
+      "resolved": "https://registry.npmjs.org/@types/d3-ease/-/d3-ease-1.0.7.tgz",
+      "integrity": "sha1-k6MBhovp4VBh89RDQ7GrP4rLbwk="
+    },
+    "@types/d3-fetch": {
+      "version": "1.1.2",
+      "resolved": "https://registry.npmjs.org/@types/d3-fetch/-/d3-fetch-1.1.2.tgz",
+      "integrity": "sha512-w6ANZv/mUh+6IV3drT22zgPWMRobzuGXhzOZC8JPD+ygce0/Vx6vTci3m3dizkocnQQCOwNbrWWWPYqpWiKzRQ==",
+      "requires": {
+        "@types/d3-dsv": "*"
+      }
+    },
+    "@types/d3-force": {
+      "version": "1.1.1",
+      "resolved": "https://registry.npmjs.org/@types/d3-force/-/d3-force-1.1.1.tgz",
+      "integrity": "sha512-ePkELuaFWY4yOuf+Bvx5Xd+ihFiYG4bdnW0BlvigovIm8Sob2t76e9RGO6lybQbv6AlW9Icn9HuZ9fmdzEoJyg=="
+    },
+    "@types/d3-format": {
+      "version": "1.3.0",
+      "resolved": "https://registry.npmjs.org/@types/d3-format/-/d3-format-1.3.0.tgz",
+      "integrity": "sha512-ZiY4j3iJvAdOwzwW24WjlZbUNvqOsnPAMfPBmdXqxj3uKJbrzBlRrdGl5uC89pZpFs9Dc92E81KcwG2uEgkIZA=="
+    },
+    "@types/d3-geo": {
+      "version": "1.10.3",
+      "resolved": "https://registry.npmjs.org/@types/d3-geo/-/d3-geo-1.10.3.tgz",
+      "integrity": "sha512-hfdaxM2L0wA9mDZrrSf2o+DyhEpnJYCiAN+lHFtpfZOVCQrYBA5g33sGRpUbAvjSMyO5jkHbftMWPEhuCMChSg==",
+      "requires": {
+        "@types/geojson": "*"
+      }
+    },
+    "@types/d3-hierarchy": {
+      "version": "1.1.2",
+      "resolved": "https://registry.npmjs.org/@types/d3-hierarchy/-/d3-hierarchy-1.1.2.tgz",
+      "integrity": "sha512-L+Ht4doqlCIH8jYN2AC1mYIOj13OxlRhdWNWXv2pc3o5A9i3YmQ0kz6A7w8c+Ujylfusi/FO+zVlVnQoOHc2Qw=="
+    },
+    "@types/d3-interpolate": {
+      "version": "1.2.0",
+      "resolved": "https://registry.npmjs.org/@types/d3-interpolate/-/d3-interpolate-1.2.0.tgz",
+      "integrity": "sha512-qM9KlUrqbwIhBRtw9OtAEbkis1AxsOJEun2uxaX/vEsBp3vyNBmhPz9boXXEqic9ZRi7fCpUNRwyZvxa0PioIw==",
+      "requires": {
+        "@types/d3-color": "*"
+      }
+    },
+    "@types/d3-path": {
+      "version": "1.0.7",
+      "resolved": "https://registry.npmjs.org/@types/d3-path/-/d3-path-1.0.7.tgz",
+      "integrity": "sha512-U8dFRG+8WhkLJr2sxZ9Cw/5WeRgBnNqMxGdA1+Z0+ZG6tK0s75OQ4OXnxeyfKuh6E4wQPY8OAKr1+iNDx01BEQ=="
+    },
+    "@types/d3-polygon": {
+      "version": "1.0.6",
+      "resolved": "https://registry.npmjs.org/@types/d3-polygon/-/d3-polygon-1.0.6.tgz",
+      "integrity": "sha512-E6Kyodn9JThgLq20nxSbEce9ow5/ePgm9PX2EO6W1INIL4DayM7cFaiG10DStuamjYAd0X4rntW2q+GRjiIktw=="
+    },
+    "@types/d3-quadtree": {
+      "version": "1.0.5",
+      "resolved": "https://registry.npmjs.org/@types/d3-quadtree/-/d3-quadtree-1.0.5.tgz",
+      "integrity": "sha1-HOHmWerkUw3wyxJ/KX8XQaNnqC4="
+    },
+    "@types/d3-random": {
+      "version": "1.1.1",
+      "resolved": "https://registry.npmjs.org/@types/d3-random/-/d3-random-1.1.1.tgz",
+      "integrity": "sha512-jUPeBq1XKK9/5XasTvy5QAUwFeMsjma2yt/nP02yC2Tijovx7i/W5776U/HZugxc5SSmtpx4Z3g9KFVon0QrjQ=="
+    },
+    "@types/d3-scale": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/@types/d3-scale/-/d3-scale-2.0.1.tgz",
+      "integrity": "sha512-D5ZWv8ToLvqacE7XkdMNHMiiVDULdDxT7FMMGU0YJC3/nVzBmApjyTyxracUWOQyY3KK7YhZ05on8pOcNi0dfQ==",
+      "requires": {
+        "@types/d3-time": "*"
+      }
+    },
+    "@types/d3-scale-chromatic": {
+      "version": "1.2.0",
+      "resolved": "https://registry.npmjs.org/@types/d3-scale-chromatic/-/d3-scale-chromatic-1.2.0.tgz",
+      "integrity": "sha512-bhS2SVzUzRtrxp1REhGCfHmj8pyDv9oDmsonYiPvBl8KCxPJTxnfXBF39PzAJrYnRKM41TR0kQzsJvL+NmcDtg=="
+    },
+    "@types/d3-selection": {
+      "version": "1.3.1",
+      "resolved": "https://registry.npmjs.org/@types/d3-selection/-/d3-selection-1.3.1.tgz",
+      "integrity": "sha512-G+eO+2G1iW3GNrROxhoU+ar+bIJbQq1QkxcfhwjQ19xA20n3T31j5pSJqAOWvPSoFTz4Ets/DQgYhmgT4jepDg=="
+    },
+    "@types/d3-shape": {
+      "version": "1.2.3",
+      "resolved": "https://registry.npmjs.org/@types/d3-shape/-/d3-shape-1.2.3.tgz",
+      "integrity": "sha512-iP9TcX0EVi+LlX+jK9ceS+yhEz5abTitF+JaO2ugpRE/J+bccaYLe/0/3LETMmdaEkYarIyboZW8OF67Mpnj1w==",
+      "requires": {
+        "@types/d3-path": "*"
+      }
+    },
+    "@types/d3-time": {
+      "version": "1.0.8",
+      "resolved": "https://registry.npmjs.org/@types/d3-time/-/d3-time-1.0.8.tgz",
+      "integrity": "sha512-/UCphyyw97YAq4zKsuXH33R3UNB4jDSza0fLvMubWr/ONh9IePi1NbgFP222blhiCe724ebJs8U87+aDuAq/jA=="
+    },
+    "@types/d3-time-format": {
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/@types/d3-time-format/-/d3-time-format-2.1.0.tgz",
+      "integrity": "sha512-/myT3I7EwlukNOX2xVdMzb8FRgNzRMpsZddwst9Ld/VFe6LyJyRp0s32l/V9XoUzk+Gqu56F/oGk6507+8BxrA=="
+    },
+    "@types/d3-timer": {
+      "version": "1.0.7",
+      "resolved": "https://registry.npmjs.org/@types/d3-timer/-/d3-timer-1.0.7.tgz",
+      "integrity": "sha512-830pT+aYZrgbA91AuynP3KldfB1A1s60d0gKiV+L7JcSKSJapUzUffAm8VZod7RQOxF5SzoItV6cvrTzjbmrJQ=="
+    },
+    "@types/d3-transition": {
+      "version": "1.1.1",
+      "resolved": "https://registry.npmjs.org/@types/d3-transition/-/d3-transition-1.1.1.tgz",
+      "integrity": "sha512-GHTghl0YYB8gGgbyKxVLHyAp9Na0HqsX2U7M0u0lGw4IdfEaslooykweZ8fDHW13T+KZeZAuzhbmqBZVFO+6kg==",
+      "requires": {
+        "@types/d3-selection": "*"
+      }
+    },
+    "@types/d3-voronoi": {
+      "version": "1.1.7",
+      "resolved": "https://registry.npmjs.org/@types/d3-voronoi/-/d3-voronoi-1.1.7.tgz",
+      "integrity": "sha512-/dHFLK5jhXTb/W4XEQcFydVk8qlIAo85G3r7+N2fkBFw190l0R1GQ8C1VPeXBb2GfSU5GbT2hjlnE7i7UY5Gvg=="
+    },
+    "@types/d3-zoom": {
+      "version": "1.7.1",
+      "resolved": "https://registry.npmjs.org/@types/d3-zoom/-/d3-zoom-1.7.1.tgz",
+      "integrity": "sha512-Ofjwz6Pt53tRef9TAwwayN+JThNVYC/vFOepa/H4KtwjhsqkmEseHvc2jpJM7vye5PQ5XHtTSOpdY4Y/6xZWEg==",
+      "requires": {
+        "@types/d3-interpolate": "*",
+        "@types/d3-selection": "*"
+      }
+    },
+    "@types/geojson": {
+      "version": "7946.0.3",
+      "resolved": "https://registry.npmjs.org/@types/geojson/-/geojson-7946.0.3.tgz",
+      "integrity": "sha512-BYHiG1vQJ7T93uswzuXZ0OBPWqj5tsAPtaMDQADV8sn2InllXarwg9llr6uaW22q1QCwBZ81gVajOpYWzjesug=="
+    },
+    "@types/semver": {
+      "version": "5.5.0",
+      "resolved": "https://registry.npmjs.org/@types/semver/-/semver-5.5.0.tgz",
+      "integrity": "sha512-41qEJgBH/TWgo5NFSvBCJ1qkoi3Q6ONSF2avrHq1LVEZfYpdHmj0y9SuTK+u9ZhG1sYQKBL1AWXKyLWP4RaUoQ==",
+      "dev": true
+    },
+    "commander": {
+      "version": "2.15.1",
+      "resolved": "https://registry.npmjs.org/commander/-/commander-2.15.1.tgz",
+      "integrity": "sha512-VlfT9F3V0v+jr4yxPc5gg9s62/fIVWsd2Bk2iD435um1NlGMYdVCq+MjcXnhYq2icNOizHr1kK+5TI6H0Hy0ag=="
+    },
+    "commandpost": {
+      "version": "1.3.0",
+      "resolved": "https://registry.npmjs.org/commandpost/-/commandpost-1.3.0.tgz",
+      "integrity": "sha512-T62tyrmYTkaRDbV2z1k2yXTyxk0cFptXYwo1cUbnfHtp7ThLgQ9/90jG1Ym5WLZgFhvOTaHA5VSARWJ9URpLDw==",
+      "dev": true
+    },
+    "d3": {
+      "version": "5.4.0",
+      "resolved": "https://registry.npmjs.org/d3/-/d3-5.4.0.tgz",
+      "integrity": "sha1-CQGZqFadHeI9BKP/B/4TYJX+p04=",
+      "requires": {
+        "d3-array": "1",
+        "d3-axis": "1",
+        "d3-brush": "1",
+        "d3-chord": "1",
+        "d3-collection": "1",
+        "d3-color": "1",
+        "d3-contour": "1",
+        "d3-dispatch": "1",
+        "d3-drag": "1",
+        "d3-dsv": "1",
+        "d3-ease": "1",
+        "d3-fetch": "1",
+        "d3-force": "1",
+        "d3-format": "1",
+        "d3-geo": "1",
+        "d3-hierarchy": "1",
+        "d3-interpolate": "1",
+        "d3-path": "1",
+        "d3-polygon": "1",
+        "d3-quadtree": "1",
+        "d3-random": "1",
+        "d3-scale": "2",
+        "d3-scale-chromatic": "1",
+        "d3-selection": "1",
+        "d3-shape": "1",
+        "d3-time": "1",
+        "d3-time-format": "2",
+        "d3-timer": "1",
+        "d3-transition": "1",
+        "d3-voronoi": "1",
+        "d3-zoom": "1"
+      }
+    },
+    "d3-array": {
+      "version": "1.2.1",
+      "resolved": "https://registry.npmjs.org/d3-array/-/d3-array-1.2.1.tgz",
+      "integrity": "sha512-CyINJQ0SOUHojDdFDH4JEM0552vCR1utGyLHegJHyYH0JyCpSeTPxi4OBqHMA2jJZq4NH782LtaJWBImqI/HBw=="
+    },
+    "d3-axis": {
+      "version": "1.0.8",
+      "resolved": "https://registry.npmjs.org/d3-axis/-/d3-axis-1.0.8.tgz",
+      "integrity": "sha1-MacFoLU15ldZ3hQXOjGTMTfxjvo="
+    },
+    "d3-brush": {
+      "version": "1.0.4",
+      "resolved": "https://registry.npmjs.org/d3-brush/-/d3-brush-1.0.4.tgz",
+      "integrity": "sha1-AMLyOAGfJPbAoZSibUGhUw/+e8Q=",
+      "requires": {
+        "d3-dispatch": "1",
+        "d3-drag": "1",
+        "d3-interpolate": "1",
+        "d3-selection": "1",
+        "d3-transition": "1"
+      }
+    },
+    "d3-chord": {
+      "version": "1.0.4",
+      "resolved": "https://registry.npmjs.org/d3-chord/-/d3-chord-1.0.4.tgz",
+      "integrity": "sha1-fexPC6iG9xP+ERxF92NBT290yiw=",
+      "requires": {
+        "d3-array": "1",
+        "d3-path": "1"
+      }
+    },
+    "d3-collection": {
+      "version": "1.0.4",
+      "resolved": "https://registry.npmjs.org/d3-collection/-/d3-collection-1.0.4.tgz",
+      "integrity": "sha1-NC39EoN8kJdPM/HMCnha6lcNzcI="
+    },
+    "d3-color": {
+      "version": "1.2.0",
+      "resolved": "https://registry.npmjs.org/d3-color/-/d3-color-1.2.0.tgz",
+      "integrity": "sha512-dmL9Zr/v39aSSMnLOTd58in2RbregCg4UtGyUArvEKTTN6S3HKEy+ziBWVYo9PTzRyVW+pUBHUtRKz0HYX+SQg=="
+    },
+    "d3-contour": {
+      "version": "1.2.0",
+      "resolved": "https://registry.npmjs.org/d3-contour/-/d3-contour-1.2.0.tgz",
+      "integrity": "sha512-nDzZ2KDnrgTrhMjV8TH0RNrljk6uPNAGkG/v/1SKNVvJa2JU8szjh7o2ZYTX8yufA2oCI5HyeMqbzwiB+oDoIA==",
+      "requires": {
+        "d3-array": "^1.1.1"
+      }
+    },
+    "d3-dispatch": {
+      "version": "1.0.3",
+      "resolved": "https://registry.npmjs.org/d3-dispatch/-/d3-dispatch-1.0.3.tgz",
+      "integrity": "sha1-RuFJHqqbWMNY/OW+TovtYm54cfg="
+    },
+    "d3-drag": {
+      "version": "1.2.1",
+      "resolved": "https://registry.npmjs.org/d3-drag/-/d3-drag-1.2.1.tgz",
+      "integrity": "sha512-Cg8/K2rTtzxzrb0fmnYOUeZHvwa4PHzwXOLZZPwtEs2SKLLKLXeYwZKBB+DlOxUvFmarOnmt//cU4+3US2lyyQ==",
+      "requires": {
+        "d3-dispatch": "1",
+        "d3-selection": "1"
+      }
+    },
+    "d3-dsv": {
+      "version": "1.0.8",
+      "resolved": "https://registry.npmjs.org/d3-dsv/-/d3-dsv-1.0.8.tgz",
+      "integrity": "sha512-IVCJpQ+YGe3qu6odkPQI0KPqfxkhbP/oM1XhhE/DFiYmcXKfCRub4KXyiuehV1d4drjWVXHUWx4gHqhdZb6n/A==",
+      "requires": {
+        "commander": "2",
+        "iconv-lite": "0.4",
+        "rw": "1"
+      }
+    },
+    "d3-ease": {
+      "version": "1.0.3",
+      "resolved": "https://registry.npmjs.org/d3-ease/-/d3-ease-1.0.3.tgz",
+      "integrity": "sha1-aL+8NJM4o4DETYrMT7wzBKotjA4="
+    },
+    "d3-fetch": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/d3-fetch/-/d3-fetch-1.1.0.tgz",
+      "integrity": "sha512-j+V4vtT6dceQbcKYLtpTueB8Zvc+wb9I93WaFtEQIYNADXl0c1ZJMN3qQo0CssiTsAqK8pePwc7f4qiW+b0WOg==",
+      "requires": {
+        "d3-dsv": "1"
+      }
+    },
+    "d3-force": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/d3-force/-/d3-force-1.1.0.tgz",
+      "integrity": "sha512-2HVQz3/VCQs0QeRNZTYb7GxoUCeb6bOzMp/cGcLa87awY9ZsPvXOGeZm0iaGBjXic6I1ysKwMn+g+5jSAdzwcg==",
+      "requires": {
+        "d3-collection": "1",
+        "d3-dispatch": "1",
+        "d3-quadtree": "1",
+        "d3-timer": "1"
+      }
+    },
+    "d3-format": {
+      "version": "1.3.0",
+      "resolved": "https://registry.npmjs.org/d3-format/-/d3-format-1.3.0.tgz",
+      "integrity": "sha512-ycfLEIzHVZC3rOvuBOKVyQXSiUyCDjeAPIj9n/wugrr+s5AcTQC2Bz6aKkubG7rQaQF0SGW/OV4UEJB9nfioFg=="
+    },
+    "d3-geo": {
+      "version": "1.10.0",
+      "resolved": "https://registry.npmjs.org/d3-geo/-/d3-geo-1.10.0.tgz",
+      "integrity": "sha512-VK/buVGgexthTTqGRNXQ/LSo3EbOFu4p2Pjud5drSIaEnOaF2moc8A3P7WEljEO1JEBEwbpAJjFWMuJiUtoBcw==",
+      "requires": {
+        "d3-array": "1"
+      }
+    },
+    "d3-hierarchy": {
+      "version": "1.1.6",
+      "resolved": "https://registry.npmjs.org/d3-hierarchy/-/d3-hierarchy-1.1.6.tgz",
+      "integrity": "sha512-nn4bhBnwWnMSoZgkBXD7vRyZ0xVUsNMQRKytWYHhP1I4qHw+qzApCTgSQTZqMdf4XXZbTMqA59hFusga+THA/g=="
+    },
+    "d3-interpolate": {
+      "version": "1.2.0",
+      "resolved": "https://registry.npmjs.org/d3-interpolate/-/d3-interpolate-1.2.0.tgz",
+      "integrity": "sha512-zLvTk8CREPFfc/2XglPQriAsXkzoRDAyBzndtKJWrZmHw7kmOWHNS11e40kPTd/oGk8P5mFJW5uBbcFQ+ybxyA==",
+      "requires": {
+        "d3-color": "1"
+      }
+    },
+    "d3-path": {
+      "version": "1.0.5",
+      "resolved": "https://registry.npmjs.org/d3-path/-/d3-path-1.0.5.tgz",
+      "integrity": "sha1-JB6xhJvZ6egCHA0KeZ+KDo5EF2Q="
+    },
+    "d3-polygon": {
+      "version": "1.0.3",
+      "resolved": "https://registry.npmjs.org/d3-polygon/-/d3-polygon-1.0.3.tgz",
+      "integrity": "sha1-FoiOkCZGCTPysXllKtN4Ik04LGI="
+    },
+    "d3-quadtree": {
+      "version": "1.0.3",
+      "resolved": "https://registry.npmjs.org/d3-quadtree/-/d3-quadtree-1.0.3.tgz",
+      "integrity": "sha1-rHmH4+I/6AWpkPKOG1DTj8uCJDg="
+    },
+    "d3-random": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/d3-random/-/d3-random-1.1.0.tgz",
+      "integrity": "sha1-ZkLlBsb6OmSFldKyRpeIqNElKdM="
+    },
+    "d3-scale": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/d3-scale/-/d3-scale-2.0.0.tgz",
+      "integrity": "sha512-Sa2Ny6CoJT7x6dozxPnvUQT61epGWsgppFvnNl8eJEzfJBG0iDBBTJAtz2JKem7Mb+NevnaZiDiIDHsuWkv6vg==",
+      "requires": {
+        "d3-array": "^1.2.0",
+        "d3-collection": "1",
+        "d3-format": "1",
+        "d3-interpolate": "1",
+        "d3-time": "1",
+        "d3-time-format": "2"
+      }
+    },
+    "d3-scale-chromatic": {
+      "version": "1.3.0",
+      "resolved": "https://registry.npmjs.org/d3-scale-chromatic/-/d3-scale-chromatic-1.3.0.tgz",
+      "integrity": "sha512-YwMbiaW2bStWvQFByK8hA6hk7ToWflspIo2TRukCqERd8isiafEMBXmwfh8c7/0Z94mVvIzIveRLVC6RAjhgeA==",
+      "requires": {
+        "d3-color": "1",
+        "d3-interpolate": "1"
+      }
+    },
+    "d3-selection": {
+      "version": "1.3.0",
+      "resolved": "https://registry.npmjs.org/d3-selection/-/d3-selection-1.3.0.tgz",
+      "integrity": "sha512-qgpUOg9tl5CirdqESUAu0t9MU/t3O9klYfGfyKsXEmhyxyzLpzpeh08gaxBUTQw1uXIOkr/30Ut2YRjSSxlmHA=="
+    },
+    "d3-shape": {
+      "version": "1.2.0",
+      "resolved": "https://registry.npmjs.org/d3-shape/-/d3-shape-1.2.0.tgz",
+      "integrity": "sha1-RdAVOPBkuv0F6j1tLLdI/YxB93c=",
+      "requires": {
+        "d3-path": "1"
+      }
+    },
+    "d3-time": {
+      "version": "1.0.8",
+      "resolved": "https://registry.npmjs.org/d3-time/-/d3-time-1.0.8.tgz",
+      "integrity": "sha512-YRZkNhphZh3KcnBfitvF3c6E0JOFGikHZ4YqD+Lzv83ZHn1/u6yGenRU1m+KAk9J1GnZMnKcrtfvSktlA1DXNQ=="
+    },
+    "d3-time-format": {
+      "version": "2.1.1",
+      "resolved": "https://registry.npmjs.org/d3-time-format/-/d3-time-format-2.1.1.tgz",
+      "integrity": "sha512-8kAkymq2WMfzW7e+s/IUNAtN/y3gZXGRrdGfo6R8NKPAA85UBTxZg5E61bR6nLwjPjj4d3zywSQe1CkYLPFyrw==",
+      "requires": {
+        "d3-time": "1"
+      }
+    },
+    "d3-timer": {
+      "version": "1.0.7",
+      "resolved": "https://registry.npmjs.org/d3-timer/-/d3-timer-1.0.7.tgz",
+      "integrity": "sha512-vMZXR88XujmG/L5oB96NNKH5lCWwiLM/S2HyyAQLcjWJCloK5shxta4CwOFYLZoY3AWX73v8Lgv4cCAdWtRmOA=="
+    },
+    "d3-transition": {
+      "version": "1.1.1",
+      "resolved": "https://registry.npmjs.org/d3-transition/-/d3-transition-1.1.1.tgz",
+      "integrity": "sha512-xeg8oggyQ+y5eb4J13iDgKIjUcEfIOZs2BqV/eEmXm2twx80wTzJ4tB4vaZ5BKfz7XsI/DFmQL5me6O27/5ykQ==",
+      "requires": {
+        "d3-color": "1",
+        "d3-dispatch": "1",
+        "d3-ease": "1",
+        "d3-interpolate": "1",
+        "d3-selection": "^1.1.0",
+        "d3-timer": "1"
+      }
+    },
+    "d3-voronoi": {
+      "version": "1.1.2",
+      "resolved": "https://registry.npmjs.org/d3-voronoi/-/d3-voronoi-1.1.2.tgz",
+      "integrity": "sha1-Fodmfo8TotFYyAwUgMWinLDYlzw="
+    },
+    "d3-zoom": {
+      "version": "1.7.1",
+      "resolved": "https://registry.npmjs.org/d3-zoom/-/d3-zoom-1.7.1.tgz",
+      "integrity": "sha512-sZHQ55DGq5BZBFGnRshUT8tm2sfhPHFnOlmPbbwTkAoPeVdRTkB4Xsf9GCY0TSHrTD8PeJPZGmP/TpGicwJDJQ==",
+      "requires": {
+        "d3-dispatch": "1",
+        "d3-drag": "1",
+        "d3-interpolate": "1",
+        "d3-selection": "1",
+        "d3-transition": "1"
+      }
+    },
+    "editorconfig": {
+      "version": "0.15.0",
+      "resolved": "https://registry.npmjs.org/editorconfig/-/editorconfig-0.15.0.tgz",
+      "integrity": "sha512-j7JBoj/bpNzvoTQylfRZSc85MlLNKWQiq5y6gwKhmqD2h1eZ+tH4AXbkhEJD468gjDna/XMx2YtSkCxBRX9OGg==",
+      "dev": true,
+      "requires": {
+        "@types/commander": "^2.11.0",
+        "@types/semver": "^5.4.0",
+        "commander": "^2.11.0",
+        "lru-cache": "^4.1.1",
+        "semver": "^5.4.1",
+        "sigmund": "^1.0.1"
+      }
+    },
+    "iconv-lite": {
+      "version": "0.4.23",
+      "resolved": "https://registry.npmjs.org/iconv-lite/-/iconv-lite-0.4.23.tgz",
+      "integrity": "sha512-neyTUVFtahjf0mB3dZT77u+8O0QB89jFdnBkd5P1JgYPbPaia3gXXOVL2fq8VyU2gMMD7SaN7QukTB/pmXYvDA==",
+      "requires": {
+        "safer-buffer": ">= 2.1.2 < 3"
+      }
+    },
+    "lru-cache": {
+      "version": "4.1.3",
+      "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-4.1.3.tgz",
+      "integrity": "sha512-fFEhvcgzuIoJVUF8fYr5KR0YqxD238zgObTps31YdADwPPAp82a4M8TrckkWyx7ekNlf9aBcVn81cFwwXngrJA==",
+      "dev": true,
+      "requires": {
+        "pseudomap": "^1.0.2",
+        "yallist": "^2.1.2"
+      }
+    },
+    "pseudomap": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/pseudomap/-/pseudomap-1.0.2.tgz",
+      "integrity": "sha1-8FKijacOYYkX7wqKw0wa5aaChrM=",
+      "dev": true
+    },
+    "rw": {
+      "version": "1.3.3",
+      "resolved": "https://registry.npmjs.org/rw/-/rw-1.3.3.tgz",
+      "integrity": "sha1-P4Yt+pGrdmsUiF700BEkv9oHT7Q="
+    },
+    "safer-buffer": {
+      "version": "2.1.2",
+      "resolved": "https://registry.npmjs.org/safer-buffer/-/safer-buffer-2.1.2.tgz",
+      "integrity": "sha512-YZo3K82SD7Riyi0E1EQPojLz7kpepnSQI9IyPbHHg1XXXevb5dJI7tpyN2ADxGcQbHG7vcyRHk0cbwqcQriUtg=="
+    },
+    "semver": {
+      "version": "5.5.0",
+      "resolved": "https://registry.npmjs.org/semver/-/semver-5.5.0.tgz",
+      "integrity": "sha512-4SJ3dm0WAwWy/NVeioZh5AntkdJoWKxHxcmyP622fOkgHa4z3R0TdBJICINyaSDE6uNwVc8gZr+ZinwZAH4xIA==",
+      "dev": true
+    },
+    "sigmund": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/sigmund/-/sigmund-1.0.1.tgz",
+      "integrity": "sha1-P/IfGYytIXX587eBhT/ZTQ0ZtZA=",
+      "dev": true
+    },
+    "typescript": {
+      "version": "2.9.1",
+      "resolved": "https://registry.npmjs.org/typescript/-/typescript-2.9.1.tgz",
+      "integrity": "sha512-h6pM2f/GDchCFlldnriOhs1QHuwbnmj6/v7499eMHqPeW4V2G0elua2eIc2nu8v2NdHV0Gm+tzX83Hr6nUFjQA==",
+      "dev": true
+    },
+    "typescript-formatter": {
+      "version": "7.2.2",
+      "resolved": "https://registry.npmjs.org/typescript-formatter/-/typescript-formatter-7.2.2.tgz",
+      "integrity": "sha512-V7vfI9XArVhriOTYHPzMU2WUnm5IMdu9X/CPxs8mIMGxmTBFpDABlbkBka64PZJ9/xgQeRpK8KzzAG4MPzxBDQ==",
+      "dev": true,
+      "requires": {
+        "commandpost": "^1.0.0",
+        "editorconfig": "^0.15.0"
+      }
+    },
+    "yallist": {
+      "version": "2.1.2",
+      "resolved": "https://registry.npmjs.org/yallist/-/yallist-2.1.2.tgz",
+      "integrity": "sha1-HBH5IY8HYImkfdUS+TxmmaaoHVI=",
+      "dev": true
+    }
+  }
+}
diff --git a/deps/v8/tools/turbolizer/package.json b/deps/v8/tools/turbolizer/package.json
new file mode 100644
index 00000000000000..5c77b303130e5e
--- /dev/null
+++ b/deps/v8/tools/turbolizer/package.json
@@ -0,0 +1,26 @@
+{
+  "name": "turbolizer",
+  "version": "0.1.0",
+  "description": "Visualization tool for V8 TurboFan IR graphs",
+  "main": "index.html",
+  "scripts": {
+    "build": "tsc",
+    "watch": "tsc --watch",
+    "deploy": "./deploy.sh",
+    "format": "tsfmt -r"
+  },
+  "author": "The V8 team",
+  "license": "MIT",
+  "dependencies": {
+    "@types/d3": "^5.0.0",
+    "d3": "^5.4.0"
+  },
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/v8/v8.git"
+  },
+  "devDependencies": {
+    "typescript": "^2.9.1",
+    "typescript-formatter": "^7.2.2"
+  }
+}
diff --git a/deps/v8/tools/turbolizer/schedule-view.js b/deps/v8/tools/turbolizer/schedule-view.js
deleted file mode 100644
index ef4789211d3c48..00000000000000
--- a/deps/v8/tools/turbolizer/schedule-view.js
+++ /dev/null
@@ -1,128 +0,0 @@
-// Copyright 2015 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-"use strict";
-
-class ScheduleView extends TextView {
-  constructor(id, broker) {
-    super(id, broker, null, false);
-    let view = this;
-    let BLOCK_STYLE = {
-      css: 'tag'
-    };
-    const BLOCK_HEADER_STYLE = {
-      css: 'com',
-      block_id: -1,
-      location: function(text) {
-        let matches = /\d+/.exec(text);
-        if (!matches) return undefined;
-        BLOCK_HEADER_STYLE.block_id = Number(matches[0]);
-        return {
-          block_id: BLOCK_HEADER_STYLE.block_id
-        };
-      },
-    };
-    const BLOCK_LINK_STYLE = {
-      css: 'tag',
-      link: function(text) {
-        let id = Number(text.substr(1));
-        view.select(function(location) { return location.block_id == id; }, true, true);
-      }
-    };
-    const ID_STYLE = {
-      css: 'tag',
-      location: function(text) {
-        let matches = /\d+/.exec(text);
-        return {
-          node_id: Number(matches[0]),
-          block_id: BLOCK_HEADER_STYLE.block_id
-        };
-      },
-    };
-    const ID_LINK_STYLE = {
-      css: 'tag',
-      link: function(text) {
-        let id = Number(text);
-        view.select(function(location) { return location.node_id == id; }, true, true);
-      }
-    };
-    const NODE_STYLE = { css: 'kwd' };
-    const GOTO_STYLE = { css: 'kwd',
-      goto_id: -2,
-      location: function(text) {
-        return {
-          node_id: GOTO_STYLE.goto_id--,
-          block_id: BLOCK_HEADER_STYLE.block_id
-        };
-      }
-    }
-    const ARROW_STYLE = { css: 'kwd' };
-    let patterns = [
-      [
-        [/^--- BLOCK B\d+/, BLOCK_HEADER_STYLE, 1],
-        [/^\s+\d+: /, ID_STYLE, 2],
-        [/^\s+Goto/, GOTO_STYLE, 6],
-        [/^.*/, null, -1]
-      ],
-      [
-        [/^ +/, null],
-        [/^\(deferred\)/, BLOCK_HEADER_STYLE],
-        [/^B\d+/, BLOCK_LINK_STYLE],
-        [/^<-/, ARROW_STYLE],
-        [/^->/, ARROW_STYLE],
-        [/^,/, null],
-        [/^---/, BLOCK_HEADER_STYLE, -1]
-      ],
-      // Parse opcode including []
-      [
-        [/^[A-Za-z0-9_]+(\[.*\])?$/, NODE_STYLE, -1],
-        [/^[A-Za-z0-9_]+(\[(\[.*?\]|.)*?\])?/, NODE_STYLE, 3]
-      ],
-      // Parse optional parameters
-      [
-        [/^ /, null, 4],
-        [/^\(/, null],
-        [/^\d+/, ID_LINK_STYLE],
-        [/^, /, null],
-        [/^\)$/, null, -1],
-        [/^\)/, null, 4],
-      ],
-      [
-        [/^ -> /, ARROW_STYLE, 5],
-        [/^.*/, null, -1]
-      ],
-      [
-        [/^B\d+$/, BLOCK_LINK_STYLE, -1],
-        [/^B\d+/, BLOCK_LINK_STYLE],
-        [/^, /, null]
-      ],
-      [
-        [/^ -> /, ARROW_STYLE],
-        [/^B\d+$/, BLOCK_LINK_STYLE, -1]
-      ]
-    ];
-    this.setPatterns(patterns);
-  }
-
-  initializeContent(data, rememberedSelection) {
-    super.initializeContent(data, rememberedSelection);
-    var graph = this;
-    var locations = [];
-    for (var id of rememberedSelection) {
-      locations.push({ node_id : id });
-    }
-    this.selectLocations(locations, true, true);
-  }
-
-  detachSelection() {
-    var selection = this.selection.detachSelection();
-    var s = new Set();
-    for (var i of selection) {
-      if (i.location.node_id != undefined && i.location.node_id > 0) {
-        s.add(i.location.node_id);
-      }
-    };
-    return s;
-  }
-}
diff --git a/deps/v8/tools/turbolizer/selection-broker.js b/deps/v8/tools/turbolizer/selection-broker.js
deleted file mode 100644
index 822cf1ce1f62fd..00000000000000
--- a/deps/v8/tools/turbolizer/selection-broker.js
+++ /dev/null
@@ -1,99 +0,0 @@
-// Copyright 2015 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-var SelectionBroker = function() {
-  this.brokers = [];
-  this.dispatching = false;
-  this.lastDispatchingHandler = null;
-  this.nodePositionMap = [];
-  this.sortedPositionList = [];
-  this.positionNodeMap = [];
-};
-
-SelectionBroker.prototype.addSelectionHandler = function(handler) {
-  this.brokers.push(handler);
-}
-
-SelectionBroker.prototype.setNodePositionMap = function(map) {
-  let broker = this;
-  if (!map) return;
-  broker.nodePositionMap = map;
-  broker.positionNodeMap = [];
-  broker.sortedPositionList = [];
-  let next = 0;
-  for (let i in broker.nodePositionMap) {
-    broker.sortedPositionList[next] = Number(broker.nodePositionMap[i]);
-    broker.positionNodeMap[next++] = i;
-  }
-  broker.sortedPositionList = sortUnique(broker.sortedPositionList,
-                                       function(a,b) { return a - b; });
-  this.positionNodeMap.sort(function(a,b) {
-    let result = broker.nodePositionMap[a] - broker.nodePositionMap[b];
-    if (result != 0) return result;
-    return a - b;
-  });
-}
-
-SelectionBroker.prototype.select = function(from, locations, selected) {
-  let broker = this;
-  if (!broker.dispatching) {
-    broker.lastDispatchingHandler = from;
-    try {
-      broker.dispatching = true;
-      let enrichLocations = function(locations) {
-        result = [];
-        for (let location of locations) {
-          let newLocation = {};
-          if (location.pos_start != undefined) {
-            newLocation.pos_start = location.pos_start;
-          }
-          if (location.pos_end != undefined) {
-            newLocation.pos_end = location.pos_end;
-          }
-          if (location.node_id != undefined) {
-            newLocation.node_id = location.node_id;
-          }
-          if (location.block_id != undefined) {
-            newLocation.block_id = location.block_id;
-          }
-          if (newLocation.pos_start == undefined &&
-              newLocation.pos_end == undefined &&
-              newLocation.node_id != undefined) {
-            if (broker.nodePositionMap && broker.nodePositionMap[location.node_id]) {
-              newLocation.pos_start = broker.nodePositionMap[location.node_id];
-              newLocation.pos_end = location.pos_start + 1;
-            }
-          }
-          result.push(newLocation);
-        }
-        return result;
-      }
-      locations = enrichLocations(locations);
-      for (var b of this.brokers) {
-        if (b != from) {
-          b.brokeredSelect(locations, selected);
-        }
-      }
-    }
-    finally {
-      broker.dispatching = false;
-    }
-  }
-}
-
-SelectionBroker.prototype.clear = function(from) {
-  this.lastDispatchingHandler = null;
-  if (!this.dispatching) {
-    try {
-      this.dispatching = true;
-      this.brokers.forEach(function(b) {
-        if (b != from) {
-          b.brokeredClear();
-        }
-      });
-    } finally {
-      this.dispatching = false;
-    }
-  }
-}
diff --git a/deps/v8/tools/turbolizer/selection.js b/deps/v8/tools/turbolizer/selection.js
deleted file mode 100644
index 26f1bde1972606..00000000000000
--- a/deps/v8/tools/turbolizer/selection.js
+++ /dev/null
@@ -1,108 +0,0 @@
-// Copyright 2015 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-var Selection = function(handler) {
-  this.handler = handler;
-  this.selectionBase = null;
-  this.lastSelection = null;
-  this.selection = new Set();
-}
-
-
-Selection.prototype.isEmpty = function() {
-  return this.selection.size == 0;
-}
-
-
-Selection.prototype.clear = function() {
-  var handler = this.handler;
-  this.selectionBase = null;
-  this.lastSelection = null;
-  handler.select(this.selection, false);
-  handler.clear();
-  this.selection = new Set();
-}
-
-
-count = 0;
-
-Selection.prototype.select = function(s, isSelected) {
-  var handler = this.handler;
-  if (!(Symbol.iterator in Object(s))) { s = [s]; }
-  if (isSelected) {
-    let first = true;
-    for (let i of s) {
-      if (first) {
-        this.selectionBase = i;
-        this.lastSelection = i;
-        first = false;
-      }
-      this.selection.add(i);
-    }
-    handler.select(this.selection, true);
-  } else {
-    let unselectSet = new Set();
-    for (let i of s) {
-      if (this.selection.has(i)) {
-        unselectSet.add(i);
-        this.selection.delete(i);
-      }
-    }
-    handler.select(unselectSet, false);
-  }
-}
-
-
-Selection.prototype.extendTo = function(pos) {
-  if (pos == this.lastSelection || this.lastSelection === null) return;
-
-  var handler = this.handler;
-  var pos_diff = handler.selectionDifference(pos, true, this.lastSelection, false);
-  var unselect_diff = [];
-  if (pos_diff.length == 0) {
-    pos_diff = handler.selectionDifference(this.selectionBase, false, pos, true);
-    if (pos_diff.length != 0) {
-      unselect_diff = handler.selectionDifference(this.lastSelection, true, this.selectionBase, false);
-      this.selection = new Set();
-      this.selection.add(this.selectionBase);
-      for (var d of pos_diff) {
-        this.selection.add(d);
-      }
-    } else {
-      unselect_diff = handler.selectionDifference(this.lastSelection, true, pos, false);
-      for (var d of unselect_diff) {
-        this.selection.delete(d);
-      }
-    }
-  } else {
-    unselect_diff = handler.selectionDifference(this.selectionBase, false, this.lastSelection, true);
-    if (unselect_diff != 0) {
-      pos_diff = handler.selectionDifference(pos, true, this.selectionBase, false);
-      if (pos_diff.length == 0) {
-        unselect_diff = handler.selectionDifference(pos, false, this.lastSelection, true);
-      }
-      for (var d of unselect_diff) {
-        this.selection.delete(d);
-      }
-    }
-    if (pos_diff.length != 0) {
-      for (var d of pos_diff) {
-        this.selection.add(d);
-      }
-    }
-  }
-  handler.select(unselect_diff, false);
-  handler.select(pos_diff, true);
-  this.lastSelection = pos;
-}
-
-
-Selection.prototype.detachSelection = function() {
-  var result = new Set();
-  for (var i of this.selection) {
-    result.add(i);
-  }
-  this.clear();
-  return result;
-}
diff --git a/deps/v8/tools/turbolizer/src/code-view.ts b/deps/v8/tools/turbolizer/src/code-view.ts
new file mode 100644
index 00000000000000..4bd66412e80cd4
--- /dev/null
+++ b/deps/v8/tools/turbolizer/src/code-view.ts
@@ -0,0 +1,267 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+"use strict";
+
+enum CodeMode {
+  MAIN_SOURCE = "main function",
+  INLINED_SOURCE = "inlined function"
+};
+
+class CodeView extends View {
+  broker: SelectionBroker;
+  source: Source;
+  sourceResolver: SourceResolver;
+  codeMode: CodeMode;
+  sourcePositionToHtmlElement: Map<string, HTMLElement>;
+  showAdditionalInliningPosition: boolean;
+  selectionHandler: SelectionHandler;
+  selection: MySelection;
+
+  createViewElement() {
+    const sourceContainer = document.createElement("div");
+    sourceContainer.classList.add("source-container");
+    return sourceContainer;
+  }
+
+  constructor(parentId, broker, sourceResolver, sourceFunction, codeMode: CodeMode) {
+    super(parentId);
+    let view = this;
+    view.broker = broker;
+    view.source = null;
+    view.sourceResolver = sourceResolver;
+    view.source = sourceFunction;
+    view.codeMode = codeMode;
+    this.sourcePositionToHtmlElement = new Map();
+    this.showAdditionalInliningPosition = false;
+
+    const selectionHandler = {
+      clear: function () {
+        view.selection.clear();
+        view.updateSelection();
+        broker.broadcastClear(this)
+      },
+      select: function (sourcePositions, selected) {
+        const locations = [];
+        for (var sourcePosition of sourcePositions) {
+          locations.push(sourcePosition);
+          sourceResolver.addInliningPositions(sourcePosition, locations);
+        }
+        if (locations.length == 0) return;
+        view.selection.select(locations, selected);
+        view.updateSelection();
+        broker.broadcastSourcePositionSelect(this, locations, selected);
+      },
+      brokeredSourcePositionSelect: function (locations, selected) {
+        const firstSelect = view.selection.isEmpty();
+        for (const location of locations) {
+          const translated = sourceResolver.translateToSourceId(view.source.sourceId, location);
+          if (!translated) continue;
+          view.selection.select(translated, selected);
+        }
+        view.updateSelection(firstSelect);
+      },
+      brokeredClear: function () {
+        view.selection.clear();
+        view.updateSelection();
+      },
+    };
+    view.selection = new MySelection(sourcePositionToStringKey);
+    broker.addSourcePositionHandler(selectionHandler);
+    this.selectionHandler = selectionHandler;
+    this.initializeCode();
+  }
+
+  addHtmlElementToSourcePosition(sourcePosition, element) {
+    const key = sourcePositionToStringKey(sourcePosition);
+    if (this.sourcePositionToHtmlElement.has(key)) {
+      console.log("Warning: duplicate source position", sourcePosition);
+    }
+    this.sourcePositionToHtmlElement.set(key, element);
+  }
+
+  getHtmlElementForSourcePosition(sourcePosition) {
+    const key = sourcePositionToStringKey(sourcePosition);
+    return this.sourcePositionToHtmlElement.get(key);
+  }
+
+  updateSelection(scrollIntoView: boolean = false): void {
+    const mkVisible = new ViewElements(this.divNode.parentNode as HTMLElement);
+    for (const [sp, el] of this.sourcePositionToHtmlElement.entries()) {
+      const isSelected = this.selection.isKeySelected(sp);
+      mkVisible.consider(el, isSelected);
+      el.classList.toggle("selected", isSelected);
+    }
+    mkVisible.apply(scrollIntoView);
+  }
+
+  initializeContent(data, rememberedSelection) {
+  }
+
+  getCodeHtmlElementName() {
+    return `source-pre-${this.source.sourceId}`;
+  }
+
+  getCodeHeaderHtmlElementName() {
+    return `source-pre-${this.source.sourceId}-header`;
+  }
+
+  getHtmlCodeLines(): NodeListOf<HTMLElement> {
+    const ordereList = this.divNode.querySelector(`#${this.getCodeHtmlElementName()} ol`);
+    return ordereList.childNodes as NodeListOf<HTMLElement>;
+  }
+
+  onSelectLine(lineNumber: number, doClear: boolean) {
+    const key = anyToString(lineNumber);
+    if (doClear) {
+      this.selectionHandler.clear();
+    }
+    const positions = this.sourceResolver.linetoSourcePositions(lineNumber - 1);
+    if (positions !== undefined) {
+      this.selectionHandler.select(positions, undefined);
+    }
+  }
+
+  onSelectSourcePosition(sourcePosition, doClear) {
+    if (doClear) {
+      this.selectionHandler.clear();
+    }
+    this.selectionHandler.select([sourcePosition], undefined);
+  }
+
+  initializeCode() {
+    var view = this;
+    const source = this.source;
+    const sourceText = source.sourceText;
+    if (!sourceText) return;
+    const sourceContainer = view.divNode;
+    if (this.codeMode == CodeMode.MAIN_SOURCE) {
+      sourceContainer.classList.add("main-source");
+    } else {
+      sourceContainer.classList.add("inlined-source");
+    }
+    var codeHeader = document.createElement("div");
+    codeHeader.setAttribute("id", this.getCodeHeaderHtmlElementName());
+    codeHeader.classList.add("code-header");
+    var codeFileFunction = document.createElement("div");
+    codeFileFunction.classList.add("code-file-function");
+    codeFileFunction.innerHTML = `${source.sourceName}:${source.functionName}`;
+    codeHeader.appendChild(codeFileFunction);
+    var codeModeDiv = document.createElement("div");
+    codeModeDiv.classList.add("code-mode");
+    codeModeDiv.innerHTML = `${this.codeMode}`;
+    codeHeader.appendChild(codeModeDiv);
+    const clearDiv = document.createElement("div");
+    clearDiv.style.clear = "both";
+    codeHeader.appendChild(clearDiv);
+    sourceContainer.appendChild(codeHeader);
+    var codePre = document.createElement("pre");
+    codePre.setAttribute("id", this.getCodeHtmlElementName());
+    codePre.classList.add("prettyprint");
+    sourceContainer.appendChild(codePre);
+
+    codeHeader.onclick = function myFunction() {
+      if (codePre.style.display === "none") {
+        codePre.style.display = "block";
+      } else {
+        codePre.style.display = "none";
+      }
+    }
+    if (sourceText != "") {
+      codePre.classList.add("linenums");
+      codePre.textContent = sourceText;
+      try {
+        // Wrap in try to work when offline.
+        PR.prettyPrint(undefined, sourceContainer);
+      } catch (e) {
+        console.log(e);
+      }
+
+      view.divNode.onclick = function (e) {
+        view.selectionHandler.clear();
+      }
+
+      const base: number = source.startPosition;
+      let current = 0;
+      const lineListDiv = this.getHtmlCodeLines();
+      let newlineAdjust = 0;
+      for (let i = 0; i < lineListDiv.length; i++) {
+        // Line numbers are not zero-based.
+        const lineNumber = i + 1;
+        const currentLineElement = lineListDiv[i];
+        currentLineElement.id = "li" + i;
+        currentLineElement.dataset.lineNumber = "" + lineNumber;
+        const spans = currentLineElement.childNodes;
+        for (let j = 0; j < spans.length; ++j) {
+          const currentSpan = spans[j];
+          const pos = base + current;
+          const end = pos + currentSpan.textContent.length;
+          current += currentSpan.textContent.length;
+          this.insertSourcePositions(currentSpan, lineNumber, pos, end, newlineAdjust);
+          newlineAdjust = 0;
+        }
+
+        this.insertLineNumber(currentLineElement, lineNumber);
+
+        while ((current < sourceText.length) &&
+          (sourceText[current] == '\n' || sourceText[current] == '\r')) {
+          ++current;
+          ++newlineAdjust;
+        }
+      }
+    }
+  }
+
+  insertSourcePositions(currentSpan, lineNumber, pos, end, adjust) {
+    const view = this;
+    const sps = this.sourceResolver.sourcePositionsInRange(this.source.sourceId, pos - adjust, end);
+    for (const sourcePosition of sps) {
+      this.sourceResolver.addAnyPositionToLine(lineNumber, sourcePosition);
+      const textnode = currentSpan.tagName == 'SPAN' ? currentSpan.firstChild : currentSpan;
+      const replacementNode = textnode.splitText(Math.max(0, sourcePosition.scriptOffset - pos));
+      const span = document.createElement('span');
+      span.setAttribute("scriptOffset", sourcePosition.scriptOffset);
+      span.classList.add("source-position")
+      const marker = document.createElement('span');
+      marker.classList.add("marker")
+      span.appendChild(marker);
+      const inlining = this.sourceResolver.getInliningForPosition(sourcePosition);
+      if (inlining != undefined && view.showAdditionalInliningPosition) {
+        const sourceName = this.sourceResolver.getSourceName(inlining.sourceId);
+        const inliningMarker = document.createElement('span');
+        inliningMarker.classList.add("inlining-marker")
+        inliningMarker.setAttribute("data-descr", `${sourceName} was inlined here`)
+        span.appendChild(inliningMarker);
+      }
+      span.onclick = function (e) {
+        e.stopPropagation();
+        view.onSelectSourcePosition(sourcePosition, !e.shiftKey)
+      };
+      view.addHtmlElementToSourcePosition(sourcePosition, span);
+      textnode.parentNode.insertBefore(span, replacementNode);
+    }
+  }
+
+  insertLineNumber(lineElement, lineNumber) {
+    const view = this;
+    const lineNumberElement = document.createElement("div");
+    lineNumberElement.classList.add("line-number");
+    lineNumberElement.dataset.lineNumber = lineNumber;
+    lineNumberElement.innerText = lineNumber;
+    lineNumberElement.onclick = function (e) {
+      e.stopPropagation();
+      view.onSelectLine(lineNumber, !e.shiftKey);
+    }
+    lineElement.insertBefore(lineNumberElement, lineElement.firstChild)
+    // Don't add lines to source positions of not in backwardsCompatibility mode.
+    if (this.source.backwardsCompatibility === true) {
+      for (const sourcePosition of this.sourceResolver.linetoSourcePositions(lineNumber - 1)) {
+        view.addHtmlElementToSourcePosition(sourcePosition, lineElement);
+      }
+    }
+  }
+
+  deleteContent() { }
+  detachSelection() { return null; }
+}
diff --git a/deps/v8/tools/turbolizer/src/constants.ts b/deps/v8/tools/turbolizer/src/constants.ts
new file mode 100644
index 00000000000000..369c97749f5b4b
--- /dev/null
+++ b/deps/v8/tools/turbolizer/src/constants.ts
@@ -0,0 +1,29 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+const MAX_RANK_SENTINEL = 0;
+const GRAPH_MARGIN = 250;
+const WIDTH = 'width';
+const HEIGHT = 'height';
+const VISIBILITY = 'visibility';
+const SOURCE_PANE_ID = 'left';
+const SOURCE_COLLAPSE_ID = 'source-shrink';
+const SOURCE_EXPAND_ID = 'source-expand';
+const INTERMEDIATE_PANE_ID = 'middle';
+const GRAPH_PANE_ID = 'graph';
+const SCHEDULE_PANE_ID = 'schedule';
+const GENERATED_PANE_ID = 'right';
+const DISASSEMBLY_PANE_ID = 'disassembly';
+const DISASSEMBLY_COLLAPSE_ID = 'disassembly-shrink';
+const DISASSEMBLY_EXPAND_ID = 'disassembly-expand';
+const COLLAPSE_PANE_BUTTON_VISIBLE = 'button-input';
+const COLLAPSE_PANE_BUTTON_INVISIBLE = 'button-input-invisible';
+const UNICODE_BLOCK = '&#9611;';
+const PROF_COLS = [
+  { perc: 0, col: { r: 255, g: 255, b: 255 } },
+  { perc: 0.5, col: { r: 255, g: 255, b: 128 } },
+  { perc: 5, col: { r: 255, g: 128, b: 0 } },
+  { perc: 15, col: { r: 255, g: 0, b: 0 } },
+  { perc: 100, col: { r: 0, g: 0, b: 0 } }
+];
diff --git a/deps/v8/tools/turbolizer/disassembly-view.js b/deps/v8/tools/turbolizer/src/disassembly-view.ts
similarity index 65%
rename from deps/v8/tools/turbolizer/disassembly-view.js
rename to deps/v8/tools/turbolizer/src/disassembly-view.ts
index ecee04988cc820..8bc2e02ac55d4f 100644
--- a/deps/v8/tools/turbolizer/disassembly-view.js
+++ b/deps/v8/tools/turbolizer/src/disassembly-view.ts
@@ -5,22 +5,54 @@
 "use strict";
 
 class DisassemblyView extends TextView {
-  constructor(id, broker) {
-    super(id, broker, null, false);
+  SOURCE_POSITION_HEADER_REGEX: any;
+  addr_event_counts: any;
+  total_event_counts: any;
+  max_event_counts: any;
+  pos_lines: Array<any>;
+
+  createViewElement() {
+    const pane = document.createElement('div');
+    pane.setAttribute('id', "disassembly");
+    pane.innerHTML =
+      `<pre id='disassembly-text-pre' class='prettyprint prettyprinted'>
+       <ul id='disassembly-list' class='nolinenums noindent'>
+       </ul>
+     </pre>`;
+    return pane;
+  }
 
+  constructor(parentId, broker: SelectionBroker) {
+    super(parentId, broker, null);
     let view = this;
+    const sourceResolver = broker.sourceResolver;
     let ADDRESS_STYLE = {
       css: 'tag',
-      location: function(text) {
-        ADDRESS_STYLE.last_address = text;
+      linkHandler: function (text, fragment) {
+        const matches = text.match(/0x[0-9a-f]{8,16}\s*(?<offset>[0-9a-f]+)/);
+        const offset = Number.parseInt(matches.groups["offset"], 16);
+        if (!Number.isNaN(offset)) {
+          const [nodes, blockId] = sourceResolver.nodesForPCOffset(offset)
+          console.log("nodes for", offset, offset.toString(16), " are ", nodes);
+          if (nodes.length > 0) {
+            for (const nodeId of nodes) {
+              view.addHtmlElementForNodeId(nodeId, fragment);
+            }
+            return (e) => {
+              console.log(offset, nodes);
+              e.stopPropagation();
+              if (!e.shiftKey) {
+                view.selectionHandler.clear();
+              }
+              view.selectionHandler.select(nodes, true);
+            };
+          }
+        }
         return undefined;
       }
     };
     let ADDRESS_LINK_STYLE = {
-      css: 'tag',
-      link: function(text) {
-        view.select(function(location) { return location.address == text; }, true, true);
-      }
+      css: 'tag'
     };
     let UNCLASSIFIED_STYLE = {
       css: 'com'
@@ -33,60 +65,45 @@ class DisassemblyView extends TextView {
     };
     let POSITION_STYLE = {
       css: 'com',
-      location: function(text) {
-        view.pos_start = Number(text);
-      }
     };
     let OPCODE_STYLE = {
       css: 'kwd',
-      location: function(text) {
-        if (BLOCK_HEADER_STYLE.block_id != undefined) {
-          return {
-            address: ADDRESS_STYLE.last_address,
-            block_id: BLOCK_HEADER_STYLE.block_id
-          };
-        } else {
-          return {
-            address: ADDRESS_STYLE.last_address
-          };
-        }
-      }
     };
     const BLOCK_HEADER_STYLE = {
-      css: 'com',
-      block_id: -1,
-      location: function(text) {
+      css: ['com', 'block'],
+      block_id: null,
+      blockId: function (text) {
         let matches = /\d+/.exec(text);
         if (!matches) return undefined;
         BLOCK_HEADER_STYLE.block_id = Number(matches[0]);
-        return {
-          block_id: BLOCK_HEADER_STYLE.block_id
-        };
+        return BLOCK_HEADER_STYLE.block_id;
       },
-    };
-    const SOURCE_POSITION_HEADER_STYLE = {
-      css: 'com',
-      location: function(text) {
-        let matches = /(\d+):(\d+)/.exec(text);
+      linkHandler: function (text) {
+        let matches = /\d+/.exec(text);
         if (!matches) return undefined;
-        let li = Number(matches[1]);
-        if (view.pos_lines === null) return undefined;
-        let pos = view.pos_lines[li-1] + Number(matches[2]);
-        return {
-          pos_start: pos,
-          pos_end: pos + 1
+        const blockId = matches[0];
+        return function (e) {
+          e.stopPropagation();
+          if (!e.shiftKey) {
+            view.selectionHandler.clear();
+          }
+          view.blockSelectionHandler.select([blockId], true);
         };
-      },
+      }
     };
-    view.SOURCE_POSITION_HEADER_REGEX = /^(\s*-- .+:)(\d+:\d+)( --)/;
+    const SOURCE_POSITION_HEADER_STYLE = {
+      css: 'com'
+    };
+    view.SOURCE_POSITION_HEADER_REGEX = /^\s*--[^<]*<.*(not inlined|inlined\((\d+)\)):(\d+)>\s*--/;
     let patterns = [
       [
-        [/^0x[0-9a-f]{8,16}/, ADDRESS_STYLE, 1],
+        [/^0x[0-9a-f]{8,16}\s*[0-9a-f]+\ /, ADDRESS_STYLE, 1],
         [view.SOURCE_POSITION_HEADER_REGEX, SOURCE_POSITION_HEADER_STYLE, -1],
         [/^\s+-- B\d+ start.*/, BLOCK_HEADER_STYLE, -1],
         [/^.*/, UNCLASSIFIED_STYLE, -1]
       ],
       [
+        [/^\s+[0-9a-f]+\s+/, NUMBER_STYLE, 2],
         [/^\s+[0-9a-f]+\s+[0-9a-f]+\s+/, NUMBER_STYLE, 2],
         [/^.*/, null, -1]
       ],
@@ -119,44 +136,8 @@ class DisassemblyView extends TextView {
     view.setPatterns(patterns);
   }
 
-  lineLocation(li) {
-    let view = this;
-    let result = undefined;
-    for (let i = 0; i < li.children.length; ++i) {
-      let fragment = li.children[i];
-      let location = fragment.location;
-      if (location != null) {
-        if (location.block_id != undefined) {
-          if (result === undefined) result = {};
-          result.block_id = location.block_id;
-        }
-        if (location.address != undefined) {
-          if (result === undefined) result = {};
-          result.address = location.address;
-        }
-        if (location.pos_start != undefined && location.pos_end != undefined) {
-          if (result === undefined) result = {};
-          result.pos_start = location.pos_start;
-          result.pos_end = location.pos_end;
-        }
-        else if (view.pos_start != -1) {
-          if (result === undefined) result = {};
-          result.pos_start = view.pos_start;
-          result.pos_end = result.pos_start + 1;
-        }
-      }
-    }
-    return result;
-  }
-
-  initializeContent(data, rememberedSelection) {
-    this.data = data;
-    super.initializeContent(data, rememberedSelection);
-  }
-
   initializeCode(sourceText, sourcePosition) {
     let view = this;
-    view.pos_start = -1;
     view.addr_event_counts = null;
     view.total_event_counts = null;
     view.max_event_counts = null;
@@ -164,13 +145,13 @@ class DisassemblyView extends TextView {
     // Comment lines for line 0 include sourcePosition already, only need to
     // add sourcePosition for lines > 0.
     view.pos_lines[0] = sourcePosition;
-    if (sourceText != "") {
+    if (sourceText && sourceText != "") {
       let base = sourcePosition;
       let current = 0;
       let source_lines = sourceText.split("\n");
       for (let i = 1; i < source_lines.length; i++) {
         // Add 1 for newline character that is split off.
-        current += source_lines[i-1].length + 1;
+        current += source_lines[i - 1].length + 1;
         view.pos_lines[i] = base + current;
       }
     }
@@ -209,16 +190,6 @@ class DisassemblyView extends TextView {
 
   processLine(line) {
     let view = this;
-    let func = function(match, p1, p2, p3) {
-      let nums = p2.split(":");
-      let li = Number(nums[0]);
-      let pos = Number(nums[1]);
-      if(li === 0)
-        pos -= view.pos_lines[0];
-      li++;
-      return p1 + li + ":" + pos + p3;
-    };
-    line = line.replace(view.SOURCE_POSITION_HEADER_REGEX, func);
     let fragments = super.processLine(line);
 
     // Add profiling data per instruction if available.
@@ -230,7 +201,7 @@ class DisassemblyView extends TextView {
           let count = view.addr_event_counts[event][matches[1]];
           let str = " ";
           let css_cls = "prof";
-          if(count !== undefined) {
+          if (count !== undefined) {
             let perc = count / view.total_event_counts[event] * 100;
 
             let col = { r: 255, g: 255, b: 255 };
@@ -270,4 +241,6 @@ class DisassemblyView extends TextView {
     }
     return fragments;
   }
+
+  detachSelection() { return null; }
 }
diff --git a/deps/v8/tools/turbolizer/src/edge.ts b/deps/v8/tools/turbolizer/src/edge.ts
new file mode 100644
index 00000000000000..a7c65df59cbee1
--- /dev/null
+++ b/deps/v8/tools/turbolizer/src/edge.ts
@@ -0,0 +1,92 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var MINIMUM_EDGE_SEPARATION = 20;
+
+function isEdgeInitiallyVisible(target, index, source, type) {
+  return type == "control" && (target.cfg || source.cfg);
+}
+
+class Edge {
+  target: GNode;
+  source: GNode;
+  index: number;
+  type: String;
+  backEdgeNumber: number;
+  visible: boolean;
+
+  constructor(target: GNode, index: number, source: GNode, type: string) {
+    this.target = target;
+    this.source = source;
+    this.index = index;
+    this.type = type;
+    this.backEdgeNumber = 0;
+    this.visible = isEdgeInitiallyVisible(target, index, source, type);
+  }
+
+
+  stringID() {
+    return this.source.id + "," + this.index + "," + this.target.id;
+  };
+
+  isVisible() {
+    return this.visible && this.source.visible && this.target.visible;
+  };
+
+  getInputHorizontalPosition(graph) {
+    if (this.backEdgeNumber > 0) {
+      return graph.maxGraphNodeX + this.backEdgeNumber * MINIMUM_EDGE_SEPARATION;
+    }
+    var source = this.source;
+    var target = this.target;
+    var index = this.index;
+    var input_x = target.x + target.getInputX(index);
+    var inputApproach = target.getInputApproach(this.index);
+    var outputApproach = source.getOutputApproach(graph);
+    if (inputApproach > outputApproach) {
+      return input_x;
+    } else {
+      var inputOffset = MINIMUM_EDGE_SEPARATION * (index + 1);
+      return (target.x < source.x)
+        ? (target.x + target.getTotalNodeWidth() + inputOffset)
+        : (target.x - inputOffset)
+    }
+  }
+
+  generatePath(graph) {
+    var target = this.target;
+    var source = this.source;
+    var input_x = target.x + target.getInputX(this.index);
+    var arrowheadHeight = 7;
+    var input_y = target.y - 2 * DEFAULT_NODE_BUBBLE_RADIUS - arrowheadHeight;
+    var output_x = source.x + source.getOutputX();
+    var output_y = source.y + graph.getNodeHeight(source) + DEFAULT_NODE_BUBBLE_RADIUS;
+    var inputApproach = target.getInputApproach(this.index);
+    var outputApproach = source.getOutputApproach(graph);
+    var horizontalPos = this.getInputHorizontalPosition(graph);
+
+    var result = "M" + output_x + "," + output_y +
+      "L" + output_x + "," + outputApproach +
+      "L" + horizontalPos + "," + outputApproach;
+
+    if (horizontalPos != input_x) {
+      result += "L" + horizontalPos + "," + inputApproach;
+    } else {
+      if (inputApproach < outputApproach) {
+        inputApproach = outputApproach;
+      }
+    }
+
+    result += "L" + input_x + "," + inputApproach +
+      "L" + input_x + "," + input_y;
+    return result;
+  }
+
+  isBackEdge() {
+    return this.target.hasBackEdges() && (this.target.rank < this.source.rank);
+  }
+
+}
+
+const edgeToStr = (e: Edge) => e.stringID();
diff --git a/deps/v8/tools/turbolizer/graph-layout.js b/deps/v8/tools/turbolizer/src/graph-layout.ts
similarity index 88%
rename from deps/v8/tools/turbolizer/graph-layout.js
rename to deps/v8/tools/turbolizer/src/graph-layout.ts
index e9b44b4d2cdf26..14915409f16ae8 100644
--- a/deps/v8/tools/turbolizer/graph-layout.js
+++ b/deps/v8/tools/turbolizer/src/graph-layout.ts
@@ -6,7 +6,7 @@ var DEFAULT_NODE_ROW_SEPARATION = 130
 
 var traceLayout = false;
 
-function newGraphOccupation(graph){
+function newGraphOccupation(graph) {
   var isSlotFilled = [];
   var maxSlot = 0;
   var minSlot = 0;
@@ -42,7 +42,7 @@ function newGraphOccupation(graph){
 
   function findSpace(pos, width, direction) {
     var widthSlots = Math.floor((width + NODE_INPUT_WIDTH - 1) /
-                                NODE_INPUT_WIDTH);
+      NODE_INPUT_WIDTH);
     var currentSlot = positionToSlot(pos + width / 2);
     var currentScanSlot = currentSlot;
     var widthSlotsRemainingLeft = widthSlots;
@@ -53,14 +53,14 @@ function newGraphOccupation(graph){
       currentScanSlot = currentSlot + (mod ? -1 : 1) * (slotsChecked >> 1);
       if (!isSlotFilled[slotToIndex(currentScanSlot)]) {
         if (mod) {
-          if (direction <= 0) --widthSlotsRemainingLeft
+          if (direction <= 0)--widthSlotsRemainingLeft
         } else {
-          if (direction >= 0) --widthSlotsRemainingRight
+          if (direction >= 0)--widthSlotsRemainingRight
         }
         if (widthSlotsRemainingLeft == 0 ||
-            widthSlotsRemainingRight == 0 ||
-            (widthSlotsRemainingLeft + widthSlotsRemainingRight) == widthSlots &&
-            (widthSlots == slotsChecked)) {
+          widthSlotsRemainingRight == 0 ||
+          (widthSlotsRemainingLeft + widthSlotsRemainingRight) == widthSlots &&
+          (widthSlots == slotsChecked)) {
           if (mod) {
             return [currentScanSlot, widthSlots];
           } else {
@@ -79,7 +79,7 @@ function newGraphOccupation(graph){
 
   function setIndexRange(from, to, value) {
     if (to < from) {
-      throw("illegal slot range");
+      throw ("illegal slot range");
     }
     while (from <= to) {
       if (from > maxSlot) {
@@ -127,7 +127,7 @@ function newGraphOccupation(graph){
   }
 
   var occupation = {
-    occupyNodeInputs: function(node) {
+    occupyNodeInputs: function (node) {
       for (var i = 0; i < node.inputs.length; ++i) {
         if (node.inputs[i].isVisible()) {
           var edge = node.inputs[i];
@@ -138,14 +138,14 @@ function newGraphOccupation(graph){
               console.log("Occupying input " + i + " of " + node.id + " at " + horizontalPos);
             }
             occupyPositionRangeWithMargin(horizontalPos,
-                                          horizontalPos,
-                                          NODE_INPUT_WIDTH / 2);
+              horizontalPos,
+              NODE_INPUT_WIDTH / 2);
           }
         }
       }
     },
-    occupyNode: function(node) {
-      var getPlacementHint = function(n) {
+    occupyNode: function (node) {
+      var getPlacementHint = function (n) {
         var pos = 0;
         var direction = -1;
         var outputEdges = 0;
@@ -201,28 +201,28 @@ function newGraphOccupation(graph){
         return slotToLeftPosition(firstSlot + slotWidth / 2) - (width / 2);
       }
     },
-    clearOccupiedNodes: function() {
-      nodeOccupation.forEach(function(o) {
+    clearOccupiedNodes: function () {
+      nodeOccupation.forEach(function (o) {
         clearSlotRange(o[0], o[1]);
       });
       nodeOccupation = [];
     },
-    clearNodeOutputs: function(source) {
-      source.outputs.forEach(function(edge) {
+    clearNodeOutputs: function (source) {
+      source.outputs.forEach(function (edge) {
         if (edge.isVisible()) {
           var target = edge.target;
           for (var i = 0; i < target.inputs.length; ++i) {
             if (target.inputs[i].source === source) {
               var horizontalPos = edge.getInputHorizontalPosition(graph);
               clearPositionRangeWithMargin(horizontalPos,
-                                           horizontalPos,
-                                           NODE_INPUT_WIDTH / 2);
+                horizontalPos,
+                NODE_INPUT_WIDTH / 2);
             }
           }
         }
       });
     },
-    print: function() {
+    print: function () {
       var s = "";
       for (var currentSlot = -40; currentSlot < 40; ++currentSlot) {
         if (currentSlot != 0) {
@@ -251,11 +251,11 @@ function layoutNodeGraph(graph) {
   // basis for bottom-up DFS to determine rank and node placement.
   var endNodesHasNoOutputs = [];
   var startNodesHasNoInputs = [];
-  graph.nodes.forEach(function(n, i){
+  graph.nodes.forEach(function (n, i) {
     endNodesHasNoOutputs[n.id] = true;
     startNodesHasNoInputs[n.id] = true;
   });
-  graph.edges.forEach(function(e, i){
+  graph.edges.forEach(function (e, i) {
     endNodesHasNoOutputs[e.source.id] = false;
     startNodesHasNoInputs[e.target.id] = false;
   });
@@ -265,7 +265,7 @@ function layoutNodeGraph(graph) {
   var startNodes = [];
   var visited = [];
   var rank = [];
-  graph.nodes.forEach(function(n, i){
+  graph.nodes.forEach(function (n, i) {
     if (endNodesHasNoOutputs[n.id]) {
       endNodes.push(n);
     }
@@ -323,7 +323,7 @@ function layoutNodeGraph(graph) {
     }
   }
 
-   visited = [];
+  visited = [];
   function dfsFindRankLate(n) {
     if (visited[n.id]) return;
     visited[n.id] = true;
@@ -335,7 +335,7 @@ function layoutNodeGraph(graph) {
       dfsFindRankLate(output);
       var outputRank = output.rank;
       if (output.visible && (firstInput || outputRank <= newRank) &&
-          (outputRank > originalRank)) {
+        (outputRank > originalRank)) {
         newRank = outputRank - 1;
       }
       firstInput = false;
@@ -364,15 +364,15 @@ function layoutNodeGraph(graph) {
   }
   startNodes.forEach(dfsRankOrder);
 
-  endNodes.forEach(function(n) {
+  endNodes.forEach(function (n) {
     n.rank = maxRank + 1;
   });
 
   var rankSets = [];
   // Collect sets for each rank.
-  graph.nodes.forEach(function(n, i){
+  graph.nodes.forEach(function (n, i) {
     n.y = n.rank * (DEFAULT_NODE_ROW_SEPARATION + graph.getNodeHeight(n) +
-                    2 * DEFAULT_NODE_BUBBLE_RADIUS);
+      2 * DEFAULT_NODE_BUBBLE_RADIUS);
     if (n.visible) {
       if (rankSets[n.rank] === undefined) {
         rankSets[n.rank] = [n];
@@ -388,7 +388,7 @@ function layoutNodeGraph(graph) {
   var occupation = newGraphOccupation(graph);
   var rankCount = 0;
 
-  rankSets.reverse().forEach(function(rankSet) {
+  rankSets.reverse().forEach(function (rankSet) {
 
     for (var i = 0; i < rankSet.length; ++i) {
       occupation.clearNodeOutputs(rankSet[i]);
@@ -400,7 +400,7 @@ function layoutNodeGraph(graph) {
     }
 
     var placedCount = 0;
-    rankSet = rankSet.sort(function(a,b) {
+    rankSet = rankSet.sort(function (a, b) {
       return a.visitOrderWithinRank < b.visitOrderWithinRank;
     });
     for (var i = 0; i < rankSet.length; ++i) {
@@ -447,7 +447,7 @@ function layoutNodeGraph(graph) {
   });
 
   graph.maxBackEdgeNumber = 0;
-  graph.visibleEdges.each(function (e) {
+  graph.visibleEdges.selectAll("path").each(function (e) {
     if (e.isBackEdge()) {
       e.backEdgeNumber = ++graph.maxBackEdgeNumber;
     } else {
@@ -456,7 +456,6 @@ function layoutNodeGraph(graph) {
   });
 
   redetermineGraphBoundingBox(graph);
-
 }
 
 function redetermineGraphBoundingBox(graph) {
@@ -490,4 +489,15 @@ function redetermineGraphBoundingBox(graph) {
   graph.maxGraphX = graph.maxGraphNodeX +
     graph.maxBackEdgeNumber * MINIMUM_EDGE_SEPARATION;
 
+  const width = (graph.maxGraphX - graph.minGraphX);
+  const height = graph.maxGraphY - graph.minGraphY;
+  graph.width = width;
+  graph.height = height;
+
+  const extent = [
+    [graph.minGraphX - width / 2, graph.minGraphY - height / 2],
+    [graph.maxGraphX + width / 2, graph.maxGraphY + height / 2]
+  ];
+  graph.panZoom.translateExtent(extent);
+  graph.minScale();
 }
diff --git a/deps/v8/tools/turbolizer/src/graph-view.ts b/deps/v8/tools/turbolizer/src/graph-view.ts
new file mode 100644
index 00000000000000..0dc033e0a73a9b
--- /dev/null
+++ b/deps/v8/tools/turbolizer/src/graph-view.ts
@@ -0,0 +1,943 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+"use strict";
+
+function nodeToStringKey(n) {
+  return "" + n.id;
+}
+
+interface GraphState {
+  showTypes: boolean;
+  selection: MySelection;
+  mouseDownNode: any;
+  justDragged: boolean,
+  justScaleTransGraph: boolean,
+  lastKeyDown: number,
+  hideDead: boolean
+}
+
+class GraphView extends View implements PhaseView {
+  divElement: d3.Selection<any, any, any, any>;
+  svg: d3.Selection<any, any, any, any>;
+  showPhaseByName: (string) => void;
+  state: GraphState;
+  nodes: Array<GNode>;
+  edges: Array<any>;
+  selectionHandler: NodeSelectionHandler;
+  graphElement: d3.Selection<any, any, any, any>;
+  visibleNodes: d3.Selection<any, GNode, any, any>;
+  visibleEdges: d3.Selection<any, Edge, any, any>;
+  minGraphX: number;
+  maxGraphX: number;
+  minGraphY: number;
+  maxGraphY: number;
+  width: number;
+  height: number;
+  maxGraphNodeX: number;
+  drag: d3.DragBehavior<any, GNode, GNode>;
+  panZoom: d3.ZoomBehavior<SVGElement, any>;
+  nodeMap: Array<any>;
+  visibleBubbles: d3.Selection<any, any, any, any>;
+  transitionTimout: number;
+
+  createViewElement() {
+    const pane = document.createElement('div');
+    pane.setAttribute('id', "graph");
+    return pane;
+  }
+
+  constructor(id, broker, showPhaseByName: (string) => void) {
+    super(id);
+    var graph = this;
+    this.showPhaseByName = showPhaseByName;
+    this.divElement = d3.select(this.divNode);
+    const svg = this.divElement.append("svg").attr('version', '1.1')
+      .attr("width", "100%")
+      .attr("height", "100%");
+    svg.on("click", function (d) {
+      graph.selectionHandler.clear();
+    });
+    graph.svg = svg;
+
+    graph.nodes = [];
+    graph.edges = [];
+
+    graph.minGraphX = 0;
+    graph.maxGraphX = 1;
+    graph.minGraphY = 0;
+    graph.maxGraphY = 1;
+
+    graph.state = {
+      selection: null,
+      mouseDownNode: null,
+      justDragged: false,
+      justScaleTransGraph: false,
+      lastKeyDown: -1,
+      showTypes: false,
+      hideDead: false
+    };
+
+    this.selectionHandler = {
+      clear: function () {
+        graph.state.selection.clear();
+        broker.broadcastClear(this);
+        graph.updateGraphVisibility();
+      },
+      select: function (nodes, selected) {
+        let locations = [];
+        for (const node of nodes) {
+          if (node.sourcePosition) {
+            locations.push(node.sourcePosition);
+          }
+          if (node.origin && node.origin.bytecodePosition) {
+            locations.push({ bytecodePosition: node.origin.bytecodePosition });
+          }
+        }
+        graph.state.selection.select(nodes, selected);
+        broker.broadcastSourcePositionSelect(this, locations, selected);
+        graph.updateGraphVisibility();
+      },
+      brokeredNodeSelect: function (locations, selected) {
+        let selection = graph.nodes
+          .filter(function (n) {
+            return locations.has(nodeToStringKey(n))
+              && (!graph.state.hideDead || n.isLive());
+          });
+        graph.state.selection.select(selection, selected);
+        // Update edge visibility based on selection.
+        graph.nodes.forEach((n) => {
+          if (graph.state.selection.isSelected(n)) n.visible = true;
+        });
+        graph.edges.forEach(function (e) {
+          e.visible = e.visible ||
+            (graph.state.selection.isSelected(e.source) && graph.state.selection.isSelected(e.target));
+        });
+        graph.updateGraphVisibility();
+      },
+      brokeredClear: function () {
+        graph.state.selection.clear();
+        graph.updateGraphVisibility();
+      }
+    };
+    broker.addNodeHandler(this.selectionHandler);
+
+    graph.state.selection = new MySelection(nodeToStringKey);
+
+    const defs = svg.append('svg:defs');
+    defs.append('svg:marker')
+      .attr('id', 'end-arrow')
+      .attr('viewBox', '0 -4 8 8')
+      .attr('refX', 2)
+      .attr('markerWidth', 2.5)
+      .attr('markerHeight', 2.5)
+      .attr('orient', 'auto')
+      .append('svg:path')
+      .attr('d', 'M0,-4L8,0L0,4');
+
+    this.graphElement = svg.append("g");
+    graph.visibleEdges = this.graphElement.append("g");
+    graph.visibleNodes = this.graphElement.append("g");
+
+    graph.drag = d3.drag<any, GNode, GNode>()
+      .on("drag", function (d) {
+        d.x += d3.event.dx;
+        d.y += d3.event.dy;
+        graph.updateGraphVisibility();
+      });
+
+
+    d3.select("#layout").on("click", partial(this.layoutAction, graph));
+    d3.select("#show-all").on("click", partial(this.showAllAction, graph));
+    d3.select("#toggle-hide-dead").on("click", partial(this.toggleHideDead, graph));
+    d3.select("#hide-unselected").on("click", partial(this.hideUnselectedAction, graph));
+    d3.select("#hide-selected").on("click", partial(this.hideSelectedAction, graph));
+    d3.select("#zoom-selection").on("click", partial(this.zoomSelectionAction, graph));
+    d3.select("#toggle-types").on("click", partial(this.toggleTypesAction, graph));
+
+    // listen for key events
+    d3.select(window).on("keydown", function (e) {
+      graph.svgKeyDown.call(graph);
+    }).on("keyup", function () {
+      graph.svgKeyUp.call(graph);
+    });
+
+    function zoomed() {
+      if (d3.event.shiftKey) return false;
+      graph.graphElement.attr("transform", d3.event.transform);
+    }
+
+    const zoomSvg = d3.zoom<SVGElement, any>()
+      .scaleExtent([0.2, 40])
+      .on("zoom", zoomed)
+      .on("start", function () {
+        if (d3.event.shiftKey) return;
+        d3.select('body').style("cursor", "move");
+      })
+      .on("end", function () {
+        d3.select('body').style("cursor", "auto");
+      });
+
+    svg.call(zoomSvg).on("dblclick.zoom", null);
+
+    graph.panZoom = zoomSvg;
+
+  }
+
+
+  static get selectedClass() {
+    return "selected";
+  }
+  static get rectClass() {
+    return "nodeStyle";
+  }
+  static get activeEditId() {
+    return "active-editing";
+  }
+  static get nodeRadius() {
+    return 50;
+  }
+
+  getNodeHeight(d): number {
+    if (this.state.showTypes) {
+      return d.normalheight + d.labelbbox.height;
+    } else {
+      return d.normalheight;
+    }
+  }
+
+  getEdgeFrontier(nodes, inEdges, edgeFilter) {
+    let frontier = new Set();
+    for (const n of nodes) {
+      var edges = inEdges ? n.inputs : n.outputs;
+      var edgeNumber = 0;
+      edges.forEach(function (edge) {
+        if (edgeFilter == undefined || edgeFilter(edge, edgeNumber)) {
+          frontier.add(edge);
+        }
+        ++edgeNumber;
+      });
+    }
+    return frontier;
+  }
+
+  getNodeFrontier(nodes, inEdges, edgeFilter) {
+    let graph = this;
+    var frontier = new Set();
+    var newState = true;
+    var edgeFrontier = graph.getEdgeFrontier(nodes, inEdges, edgeFilter);
+    // Control key toggles edges rather than just turning them on
+    if (d3.event.ctrlKey) {
+      edgeFrontier.forEach(function (edge) {
+        if (edge.visible) {
+          newState = false;
+        }
+      });
+    }
+    edgeFrontier.forEach(function (edge) {
+      edge.visible = newState;
+      if (newState) {
+        var node = inEdges ? edge.source : edge.target;
+        node.visible = true;
+        frontier.add(node);
+      }
+    });
+    graph.updateGraphVisibility();
+    if (newState) {
+      return frontier;
+    } else {
+      return undefined;
+    }
+  }
+
+  initializeContent(data, rememberedSelection) {
+    this.createGraph(data, rememberedSelection);
+    if (rememberedSelection != null) {
+      this.attachSelection(rememberedSelection);
+      this.connectVisibleSelectedNodes();
+      this.viewSelection();
+    } else {
+      this.viewWholeGraph();
+    }
+  }
+
+  deleteContent() {
+    if (this.visibleNodes) {
+      this.nodes = [];
+      this.edges = [];
+      this.nodeMap = [];
+      this.updateGraphVisibility();
+    }
+  };
+
+  measureText(text) {
+    const textMeasure = document.getElementById('text-measure');
+    textMeasure.textContent = text;
+    return {
+      width: textMeasure.getBBox().width,
+      height: textMeasure.getBBox().height,
+    };
+  }
+
+  createGraph(data, rememberedSelection) {
+    var g = this;
+    g.nodes = [];
+    g.nodeMap = [];
+    data.nodes.forEach(function (n, i) {
+      n.__proto__ = GNode.prototype;
+      n.visible = false;
+      n.x = 0;
+      n.y = 0;
+      if (typeof n.pos === "number") {
+        // Backwards compatibility.
+        n.sourcePosition = { scriptOffset: n.pos, inliningId: -1 };
+      }
+      n.rank = MAX_RANK_SENTINEL;
+      n.inputs = [];
+      n.outputs = [];
+      n.rpo = -1;
+      n.outputApproach = MINIMUM_NODE_OUTPUT_APPROACH;
+      n.cfg = n.control;
+      g.nodeMap[n.id] = n;
+      n.displayLabel = n.getDisplayLabel();
+      n.labelbbox = g.measureText(n.displayLabel);
+      n.typebbox = g.measureText(n.getDisplayType());
+      var innerwidth = Math.max(n.labelbbox.width, n.typebbox.width);
+      n.width = MoreMath.alignUp(innerwidth + NODE_INPUT_WIDTH * 2,
+        NODE_INPUT_WIDTH);
+      var innerheight = Math.max(n.labelbbox.height, n.typebbox.height);
+      n.normalheight = innerheight + 20;
+      g.nodes.push(n);
+    });
+    g.edges = [];
+    data.edges.forEach(function (e, i) {
+      var t = g.nodeMap[e.target];
+      var s = g.nodeMap[e.source];
+      var newEdge = new Edge(t, e.index, s, e.type);
+      t.inputs.push(newEdge);
+      s.outputs.push(newEdge);
+      g.edges.push(newEdge);
+      if (e.type == 'control') {
+        s.cfg = true;
+      }
+    });
+    g.nodes.forEach(function (n, i) {
+      n.visible = isNodeInitiallyVisible(n) && (!g.state.hideDead || n.isLive());
+      if (rememberedSelection != undefined) {
+        if (rememberedSelection.has(nodeToStringKey(n))) {
+          n.visible = true;
+        }
+      }
+    });
+    g.updateGraphVisibility();
+    g.layoutGraph();
+    g.updateGraphVisibility();
+    g.viewWholeGraph();
+  }
+
+  connectVisibleSelectedNodes() {
+    var graph = this;
+    for (const n of graph.state.selection) {
+      n.inputs.forEach(function (edge) {
+        if (edge.source.visible && edge.target.visible) {
+          edge.visible = true;
+        }
+      });
+      n.outputs.forEach(function (edge) {
+        if (edge.source.visible && edge.target.visible) {
+          edge.visible = true;
+        }
+      });
+    }
+  }
+
+  updateInputAndOutputBubbles() {
+    var g = this;
+    var s = g.visibleBubbles;
+    s.classed("filledBubbleStyle", function (c) {
+      var components = this.id.split(',');
+      if (components[0] == "ib") {
+        var edge = g.nodeMap[components[3]].inputs[components[2]];
+        return edge.isVisible();
+      } else {
+        return g.nodeMap[components[1]].areAnyOutputsVisible() == 2;
+      }
+    }).classed("halfFilledBubbleStyle", function (c) {
+      var components = this.id.split(',');
+      if (components[0] == "ib") {
+        var edge = g.nodeMap[components[3]].inputs[components[2]];
+        return false;
+      } else {
+        return g.nodeMap[components[1]].areAnyOutputsVisible() == 1;
+      }
+    }).classed("bubbleStyle", function (c) {
+      var components = this.id.split(',');
+      if (components[0] == "ib") {
+        var edge = g.nodeMap[components[3]].inputs[components[2]];
+        return !edge.isVisible();
+      } else {
+        return g.nodeMap[components[1]].areAnyOutputsVisible() == 0;
+      }
+    });
+    s.each(function (c) {
+      var components = this.id.split(',');
+      if (components[0] == "ob") {
+        var from = g.nodeMap[components[1]];
+        var x = from.getOutputX();
+        var y = g.getNodeHeight(from) + DEFAULT_NODE_BUBBLE_RADIUS;
+        var transform = "translate(" + x + "," + y + ")";
+        this.setAttribute('transform', transform);
+      }
+    });
+  }
+
+  attachSelection(s) {
+    const graph = this;
+    if (!(s instanceof Set)) return;
+    graph.selectionHandler.clear();
+    const selected = graph.nodes.filter((n) =>
+      s.has(graph.state.selection.stringKey(n)) && (!graph.state.hideDead || n.isLive()));
+    graph.selectionHandler.select(selected, true);
+  }
+
+  detachSelection() {
+    return this.state.selection.detachSelection();
+  }
+
+  selectAllNodes() {
+    var graph = this;
+    if (!d3.event.shiftKey) {
+      graph.state.selection.clear();
+    }
+    const allVisibleNodes = graph.nodes.filter((n) => n.visible);
+    graph.state.selection.select(allVisibleNodes, true);
+    graph.updateGraphVisibility();
+  }
+
+  layoutAction(graph) {
+    graph.updateGraphVisibility();
+    graph.layoutGraph();
+    graph.updateGraphVisibility();
+    graph.viewWholeGraph();
+  }
+
+  showAllAction(graph) {
+    graph.nodes.forEach(function (n) {
+      n.visible = !graph.state.hideDead || n.isLive();
+    });
+    graph.edges.forEach(function (e) {
+      e.visible = !graph.state.hideDead || (e.source.isLive() && e.target.isLive());
+    });
+    graph.updateGraphVisibility();
+    graph.viewWholeGraph();
+  }
+
+  toggleHideDead(graph) {
+    graph.state.hideDead = !graph.state.hideDead;
+    if (graph.state.hideDead) graph.hideDead();
+    var element = document.getElementById('toggle-hide-dead');
+    element.classList.toggle('button-input-toggled', graph.state.hideDead);
+  }
+
+  hideDead() {
+    const graph = this;
+    graph.nodes.filter(function (n) {
+      if (!n.isLive()) {
+        n.visible = false;
+        graph.state.selection.select([n], false);
+      }
+    })
+    graph.updateGraphVisibility();
+  }
+
+  hideUnselectedAction(graph) {
+    graph.nodes.forEach(function (n) {
+      if (!graph.state.selection.isSelected(n)) {
+        n.visible = false;
+      }
+    });
+    graph.updateGraphVisibility();
+  }
+
+  hideSelectedAction(graph) {
+    graph.nodes.forEach(function (n) {
+      if (graph.state.selection.isSelected(n)) {
+        n.visible = false;
+      }
+    });
+    graph.selectionHandler.clear();
+  }
+
+  zoomSelectionAction(graph) {
+    graph.viewSelection();
+  }
+
+  toggleTypesAction(graph) {
+    graph.toggleTypes();
+  }
+
+  searchInputAction(searchBar, e: KeyboardEvent) {
+    const graph = this;
+    if (e.keyCode == 13) {
+      graph.selectionHandler.clear();
+      var query = searchBar.value;
+      window.sessionStorage.setItem("lastSearch", query);
+      if (query.length == 0) return;
+
+      var reg = new RegExp(query);
+      var filterFunction = function (n) {
+        return (reg.exec(n.getDisplayLabel()) != null ||
+          (graph.state.showTypes && reg.exec(n.getDisplayType())) ||
+          (reg.exec(n.getTitle())) ||
+          reg.exec(n.opcode) != null);
+      };
+
+      const selection = graph.nodes.filter(
+        function (n, i) {
+          if ((e.ctrlKey || n.visible) && filterFunction(n)) {
+            if (e.ctrlKey) n.visible = true;
+            return true;
+          }
+          return false;
+        });
+
+      graph.selectionHandler.select(selection, true);
+      graph.connectVisibleSelectedNodes();
+      graph.updateGraphVisibility();
+      searchBar.blur();
+      graph.viewSelection();
+    }
+    e.stopPropagation();
+  }
+
+  svgKeyDown() {
+    var state = this.state;
+    var graph = this;
+
+    // Don't handle key press repetition
+    if (state.lastKeyDown !== -1) return;
+
+    var showSelectionFrontierNodes = function (inEdges, filter, select) {
+      var frontier = graph.getNodeFrontier(state.selection, inEdges, filter);
+      if (frontier != undefined && frontier.size) {
+        if (select) {
+          if (!d3.event.shiftKey) {
+            state.selection.clear();
+          }
+          state.selection.select(frontier, true);
+        }
+        graph.updateGraphVisibility();
+      }
+      allowRepetition = false;
+    }
+
+    var allowRepetition = true;
+    var eventHandled = true; // unless the below switch defaults
+    switch (d3.event.keyCode) {
+      case 49:
+      case 50:
+      case 51:
+      case 52:
+      case 53:
+      case 54:
+      case 55:
+      case 56:
+      case 57:
+        // '1'-'9'
+        showSelectionFrontierNodes(true,
+          (edge, index) => { return index == (d3.event.keyCode - 49); },
+          false);
+        break;
+      case 97:
+      case 98:
+      case 99:
+      case 100:
+      case 101:
+      case 102:
+      case 103:
+      case 104:
+      case 105:
+        // 'numpad 1'-'numpad 9'
+        showSelectionFrontierNodes(true,
+          (edge, index) => { return index == (d3.event.keyCode - 97); },
+          false);
+        break;
+      case 67:
+        // 'c'
+        showSelectionFrontierNodes(d3.event.altKey,
+          (edge, index) => { return edge.type == 'control'; },
+          true);
+        break;
+      case 69:
+        // 'e'
+        showSelectionFrontierNodes(d3.event.altKey,
+          (edge, index) => { return edge.type == 'effect'; },
+          true);
+        break;
+      case 79:
+        // 'o'
+        showSelectionFrontierNodes(false, undefined, false);
+        break;
+      case 73:
+        // 'i'
+        showSelectionFrontierNodes(true, undefined, false);
+        break;
+      case 65:
+        // 'a'
+        graph.selectAllNodes();
+        allowRepetition = false;
+        break;
+      case 38:
+      case 40: {
+        showSelectionFrontierNodes(d3.event.keyCode == 38, undefined, true);
+        break;
+      }
+      case 82:
+        // 'r'
+        if (!d3.event.ctrlKey) {
+          this.layoutAction(this);
+        } else {
+          eventHandled = false;
+        }
+        break;
+      case 83:
+        // 's'
+        graph.selectOrigins();
+        break;
+      case 191:
+        // '/'
+        document.getElementById("search-input").focus();
+        break;
+      default:
+        eventHandled = false;
+        break;
+    }
+    if (eventHandled) {
+      d3.event.preventDefault();
+    }
+    if (!allowRepetition) {
+      state.lastKeyDown = d3.event.keyCode;
+    }
+  }
+
+  svgKeyUp() {
+    this.state.lastKeyDown = -1
+  };
+
+  layoutGraph() {
+    layoutNodeGraph(this);
+  }
+
+  selectOrigins() {
+    const state = this.state;
+    const origins = [];
+    let phase = null;
+    for (const n of state.selection) {
+      if (n.origin) {
+        const node = this.nodeMap[n.origin.nodeId];
+        origins.push(node);
+        phase = n.origin.phase;
+      }
+    }
+    if (origins.length) {
+      state.selection.clear();
+      state.selection.select(origins, true);
+      if (phase) {
+        this.showPhaseByName(phase);
+      }
+    }
+  }
+
+  // call to propagate changes to graph
+  updateGraphVisibility() {
+    let graph = this;
+    let state = graph.state;
+
+    var filteredEdges = graph.edges.filter(function (e) {
+      return e.isVisible();
+    });
+    const selEdges = graph.visibleEdges.selectAll<SVGPathElement, Edge>("path").data(filteredEdges, edgeToStr);
+
+    // remove old links
+    selEdges.exit().remove();
+
+    // add new paths
+    selEdges.enter()
+      .append('path')
+      .style('marker-end', 'url(#end-arrow)')
+      .classed('hidden', function (e) {
+        return !e.isVisible();
+      })
+      .attr("id", function (edge) { return "e," + edge.stringID(); })
+      .on("click", function (edge) {
+        d3.event.stopPropagation();
+        if (!d3.event.shiftKey) {
+          graph.selectionHandler.clear();
+        }
+        graph.selectionHandler.select([edge.source, edge.target], true);
+      })
+      .attr("adjacentToHover", "false");
+
+    // Set the correct styles on all of the paths
+    selEdges.classed('value', function (e) {
+      return e.type == 'value' || e.type == 'context';
+    }).classed('control', function (e) {
+      return e.type == 'control';
+    }).classed('effect', function (e) {
+      return e.type == 'effect';
+    }).classed('frame-state', function (e) {
+      return e.type == 'frame-state';
+    }).attr('stroke-dasharray', function (e) {
+      if (e.type == 'frame-state') return "10,10";
+      return (e.type == 'effect') ? "5,5" : "";
+    });
+
+    // select existing nodes
+    const filteredNodes = graph.nodes.filter(n => n.visible);
+    const allNodes = graph.visibleNodes.selectAll<SVGGElement, GNode>("g");
+    const selNodes = allNodes.data(filteredNodes, nodeToStr);
+
+    // remove old nodes
+    selNodes.exit().remove();
+
+    // add new nodes
+    var newGs = selNodes.enter()
+      .append("g");
+
+    newGs.classed("turbonode", function (n) { return true; })
+      .classed("control", function (n) { return n.isControl(); })
+      .classed("live", function (n) { return n.isLive(); })
+      .classed("dead", function (n) { return !n.isLive(); })
+      .classed("javascript", function (n) { return n.isJavaScript(); })
+      .classed("input", function (n) { return n.isInput(); })
+      .classed("simplified", function (n) { return n.isSimplified(); })
+      .classed("machine", function (n) { return n.isMachine(); })
+      .on('mouseenter', function (node) {
+        const visibleEdges = graph.visibleEdges.selectAll<SVGPathElement, Edge>('path');
+        const adjInputEdges = visibleEdges.filter(e => { return e.target === node; });
+        const adjOutputEdges = visibleEdges.filter(e => { return e.source === node; });
+        adjInputEdges.attr('relToHover', "input");
+        adjOutputEdges.attr('relToHover', "output");
+        const adjInputNodes = adjInputEdges.data().map(e => e.source);
+        const visibleNodes = graph.visibleNodes.selectAll<SVGGElement, GNode>("g");
+        const input = visibleNodes.data<GNode>(adjInputNodes, nodeToStr)
+          .attr('relToHover', "input");
+        const adjOutputNodes = adjOutputEdges.data().map(e => e.target);
+        const output = visibleNodes.data<GNode>(adjOutputNodes, nodeToStr)
+          .attr('relToHover', "output");
+        graph.updateGraphVisibility();
+      })
+      .on('mouseleave', function (node) {
+        const visibleEdges = graph.visibleEdges.selectAll<SVGPathElement, Edge>('path');
+        const adjEdges = visibleEdges.filter(e => { return e.target === node || e.source === node; });
+        adjEdges.attr('relToHover', "none");
+        const adjNodes = adjEdges.data().map(e => e.target).concat(adjEdges.data().map(e => e.source));
+        const visibleNodes = graph.visibleNodes.selectAll<SVGPathElement, GNode>("g");
+        const nodes = visibleNodes.data(adjNodes, nodeToStr)
+          .attr('relToHover', "none");
+        graph.updateGraphVisibility();
+      })
+      .on("click", (d) => {
+        if (!d3.event.shiftKey) graph.selectionHandler.clear();
+        graph.selectionHandler.select([d], undefined);
+        d3.event.stopPropagation();
+      })
+      .call(graph.drag)
+
+    newGs.append("rect")
+      .attr("rx", 10)
+      .attr("ry", 10)
+      .attr(WIDTH, function (d) {
+        return d.getTotalNodeWidth();
+      })
+      .attr(HEIGHT, function (d) {
+        return graph.getNodeHeight(d);
+      })
+
+    function appendInputAndOutputBubbles(g, d) {
+      for (var i = 0; i < d.inputs.length; ++i) {
+        var x = d.getInputX(i);
+        var y = -DEFAULT_NODE_BUBBLE_RADIUS;
+        var s = g.append('circle')
+          .classed("filledBubbleStyle", function (c) {
+            return d.inputs[i].isVisible();
+          })
+          .classed("bubbleStyle", function (c) {
+            return !d.inputs[i].isVisible();
+          })
+          .attr("id", "ib," + d.inputs[i].stringID())
+          .attr("r", DEFAULT_NODE_BUBBLE_RADIUS)
+          .attr("transform", function (d) {
+            return "translate(" + x + "," + y + ")";
+          })
+          .on("click", function (d) {
+            var components = this.id.split(',');
+            var node = graph.nodeMap[components[3]];
+            var edge = node.inputs[components[2]];
+            var visible = !edge.isVisible();
+            node.setInputVisibility(components[2], visible);
+            d3.event.stopPropagation();
+            graph.updateGraphVisibility();
+          });
+      }
+      if (d.outputs.length != 0) {
+        var x = d.getOutputX();
+        var y = graph.getNodeHeight(d) + DEFAULT_NODE_BUBBLE_RADIUS;
+        var s = g.append('circle')
+          .classed("filledBubbleStyle", function (c) {
+            return d.areAnyOutputsVisible() == 2;
+          })
+          .classed("halFilledBubbleStyle", function (c) {
+            return d.areAnyOutputsVisible() == 1;
+          })
+          .classed("bubbleStyle", function (c) {
+            return d.areAnyOutputsVisible() == 0;
+          })
+          .attr("id", "ob," + d.id)
+          .attr("r", DEFAULT_NODE_BUBBLE_RADIUS)
+          .attr("transform", function (d) {
+            return "translate(" + x + "," + y + ")";
+          })
+          .on("click", function (d) {
+            d.setOutputVisibility(d.areAnyOutputsVisible() == 0);
+            d3.event.stopPropagation();
+            graph.updateGraphVisibility();
+          });
+      }
+    }
+
+    newGs.each(function (d) {
+      appendInputAndOutputBubbles(d3.select(this), d);
+    });
+
+    newGs.each(function (d) {
+      d3.select(this).append("text")
+        .classed("label", true)
+        .attr("text-anchor", "right")
+        .attr("dx", 5)
+        .attr("dy", 5)
+        .append('tspan')
+        .text(function (l) {
+          return d.getDisplayLabel();
+        })
+        .append("title")
+        .text(function (l) {
+          return d.getTitle();
+        })
+      if (d.type != undefined) {
+        d3.select(this).append("text")
+          .classed("label", true)
+          .classed("type", true)
+          .attr("text-anchor", "right")
+          .attr("dx", 5)
+          .attr("dy", d.labelbbox.height + 5)
+          .append('tspan')
+          .text(function (l) {
+            return d.getDisplayType();
+          })
+          .append("title")
+          .text(function (l) {
+            return d.getType();
+          })
+      }
+    });
+
+    const newAndOldNodes = newGs.merge(selNodes);
+
+    newAndOldNodes.select<SVGTextElement>('.type').each(function (d) {
+      this.setAttribute('visibility', graph.state.showTypes ? 'visible' : 'hidden');
+    });
+
+    newAndOldNodes
+      .classed("selected", function (n) {
+        if (state.selection.isSelected(n)) return true;
+        return false;
+      })
+      .attr("transform", function (d) { return "translate(" + d.x + "," + d.y + ")"; })
+      .select('rect')
+      .attr(HEIGHT, function (d) { return graph.getNodeHeight(d); });
+
+    graph.visibleBubbles = d3.selectAll('circle');
+
+    graph.updateInputAndOutputBubbles();
+
+    graph.maxGraphX = graph.maxGraphNodeX;
+    selEdges.attr("d", function (edge) {
+      return edge.generatePath(graph);
+    });
+  }
+
+  getSvgViewDimensions() {
+    return [this.container.clientWidth, this.container.clientHeight];
+  }
+
+  getSvgExtent(): [[number, number], [number, number]] {
+    return [[0, 0], [this.container.clientWidth, this.container.clientHeight]];
+  }
+
+  minScale() {
+    const graph = this;
+    const dimensions = this.getSvgViewDimensions();
+    const minXScale = dimensions[0] / (2 * graph.width);
+    const minYScale = dimensions[1] / (2 * graph.height);
+    const minScale = Math.min(minXScale, minYScale);
+    this.panZoom.scaleExtent([minScale, 40]);
+    return minScale;
+  }
+
+  onresize() {
+    const trans = d3.zoomTransform(this.svg.node());
+    const ctrans = this.panZoom.constrain()(trans, this.getSvgExtent(), this.panZoom.translateExtent())
+    this.panZoom.transform(this.svg, ctrans)
+  }
+
+  toggleTypes() {
+    var graph = this;
+    graph.state.showTypes = !graph.state.showTypes;
+    var element = document.getElementById('toggle-types');
+    element.classList.toggle('button-input-toggled', graph.state.showTypes);
+    graph.updateGraphVisibility();
+  }
+
+  viewSelection() {
+    var graph = this;
+    var minX, maxX, minY, maxY;
+    var hasSelection = false;
+    graph.visibleNodes.selectAll<SVGGElement, GNode>("g").each(function (n) {
+      if (graph.state.selection.isSelected(n)) {
+        hasSelection = true;
+        minX = minX ? Math.min(minX, n.x) : n.x;
+        maxX = maxX ? Math.max(maxX, n.x + n.getTotalNodeWidth()) :
+          n.x + n.getTotalNodeWidth();
+        minY = minY ? Math.min(minY, n.y) : n.y;
+        maxY = maxY ? Math.max(maxY, n.y + graph.getNodeHeight(n)) :
+          n.y + graph.getNodeHeight(n);
+      }
+    });
+    if (hasSelection) {
+      graph.viewGraphRegion(minX - NODE_INPUT_WIDTH, minY - 60,
+        maxX + NODE_INPUT_WIDTH, maxY + 60,
+        true);
+    }
+  }
+
+  viewGraphRegion(minX, minY, maxX, maxY, transition) {
+    const [width, height] = this.getSvgViewDimensions();
+    const dx = maxX - minX;
+    const dy = maxY - minY;
+    const x = (minX + maxX) / 2;
+    const y = (minY + maxY) / 2;
+    const scale = Math.min(width / (1.1 * dx), height / (1.1 * dy));
+    const transform = d3.zoomIdentity.translate(1500, 100).scale(0.75);
+    this.svg
+      .transition().duration(300).call(this.panZoom.translateTo, x, y)
+      .transition().duration(300).call(this.panZoom.scaleTo, scale)
+      .transition().duration(300).call(this.panZoom.translateTo, x, y);
+  }
+
+  viewWholeGraph() {
+    this.panZoom.scaleTo(this.svg, 0);
+    this.panZoom.translateTo(this.svg, this.minGraphX + this.width / 2, this.minGraphY + this.height / 2)
+  }
+}
diff --git a/deps/v8/tools/turbolizer/src/graphmultiview.ts b/deps/v8/tools/turbolizer/src/graphmultiview.ts
new file mode 100644
index 00000000000000..226fc38e030c4a
--- /dev/null
+++ b/deps/v8/tools/turbolizer/src/graphmultiview.ts
@@ -0,0 +1,105 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+"use strict";
+
+class GraphMultiView extends View {
+  sourceResolver: SourceResolver;
+  selectionBroker: SelectionBroker;
+  graph: GraphView;
+  schedule: ScheduleView;
+  selectMenu: HTMLSelectElement;
+  currentPhaseView: View & PhaseView;
+
+  createViewElement() {
+    const pane = document.createElement('div');
+    pane.setAttribute('id', "multiview");
+    return pane;
+  }
+
+  constructor(id, selectionBroker, sourceResolver) {
+    super(id);
+    const view = this;
+    view.sourceResolver = sourceResolver;
+    view.selectionBroker = selectionBroker;
+    const searchInput = document.getElementById("search-input") as HTMLInputElement;
+    searchInput.addEventListener("keyup", e => {
+      if (!view.currentPhaseView) return;
+      view.currentPhaseView.searchInputAction(searchInput, e)
+    });
+    searchInput.setAttribute("value", window.sessionStorage.getItem("lastSearch") || "");
+    this.graph = new GraphView(id, selectionBroker,
+      (phaseName) => view.displayPhaseByName(phaseName));
+    this.schedule = new ScheduleView(id, selectionBroker);
+    this.selectMenu = (<HTMLSelectElement>document.getElementById('display-selector'));
+  }
+
+  initializeSelect() {
+    const view = this;
+    view.selectMenu.innerHTML = '';
+    view.sourceResolver.forEachPhase((phase) => {
+      const optionElement = document.createElement("option");
+      optionElement.text = phase.name;
+      view.selectMenu.add(optionElement);
+    });
+    this.selectMenu.onchange = function (this: HTMLSelectElement) {
+      window.sessionStorage.setItem("lastSelectedPhase", this.selectedIndex.toString());
+      view.displayPhase(view.sourceResolver.getPhase(this.selectedIndex));
+    }
+  }
+
+  show(data, rememberedSelection) {
+    super.show(data, rememberedSelection);
+    this.initializeSelect();
+    const lastPhaseIndex = +window.sessionStorage.getItem("lastSelectedPhase");
+    const initialPhaseIndex = this.sourceResolver.repairPhaseId(lastPhaseIndex);
+    this.selectMenu.selectedIndex = initialPhaseIndex;
+    this.displayPhase(this.sourceResolver.getPhase(initialPhaseIndex));
+  }
+
+  initializeContent() { }
+
+  displayPhase(phase) {
+    if (phase.type == 'graph') {
+      this.displayPhaseView(this.graph, phase.data);
+    } else if (phase.type == 'schedule') {
+      this.displayPhaseView(this.schedule, phase);
+    }
+  }
+
+  displayPhaseView(view, data) {
+    const rememberedSelection = this.hideCurrentPhase();
+    view.show(data, rememberedSelection);
+    document.getElementById("middle").classList.toggle("scrollable", view.isScrollable());
+    this.currentPhaseView = view;
+  }
+
+  displayPhaseByName(phaseName) {
+    const phaseId = this.sourceResolver.getPhaseIdByName(phaseName);
+    this.selectMenu.selectedIndex = phaseId - 1;
+    this.displayPhase(this.sourceResolver.getPhase(phaseId));
+  }
+
+  hideCurrentPhase() {
+    let rememberedSelection = null;
+    if (this.currentPhaseView != null) {
+      rememberedSelection = this.currentPhaseView.detachSelection();
+      this.currentPhaseView.hide();
+      this.currentPhaseView = null;
+    }
+    return rememberedSelection;
+  }
+
+  onresize() {
+    if (this.currentPhaseView) this.currentPhaseView.onresize();
+  }
+
+  deleteContent() {
+    this.hideCurrentPhase();
+  }
+
+  detachSelection() {
+    return null;
+  }
+}
diff --git a/deps/v8/tools/turbolizer/src/lang-disassembly.ts b/deps/v8/tools/turbolizer/src/lang-disassembly.ts
new file mode 100644
index 00000000000000..9312627abd25ed
--- /dev/null
+++ b/deps/v8/tools/turbolizer/src/lang-disassembly.ts
@@ -0,0 +1,14 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+PR.registerLangHandler(
+  PR.createSimpleLexer(
+    [
+      [PR.PR_STRING, /^(?:\'(?:[^\\\'\r\n]|\\.)*(?:\'|$))/, null, '\''],
+      [PR.PR_PLAIN, /^\s+/, null, ' \r\n\t\xA0']
+    ],
+    [ // fallthroughStylePatterns
+      [PR.PR_COMMENT, /;; debug: position \d+/, null],
+    ]),
+  ['disassembly']);
diff --git a/deps/v8/tools/turbolizer/monkey.js b/deps/v8/tools/turbolizer/src/monkey.ts
similarity index 57%
rename from deps/v8/tools/turbolizer/monkey.js
rename to deps/v8/tools/turbolizer/src/monkey.ts
index 29eaaebb36ee5d..3e38aefcc5091a 100644
--- a/deps/v8/tools/turbolizer/monkey.js
+++ b/deps/v8/tools/turbolizer/src/monkey.ts
@@ -2,6 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-Math.alignUp = function(raw, multiple) {
-  return Math.floor((raw + multiple - 1) / multiple) * multiple;
-}
+const MoreMath = {
+  alignUp: (raw, multiple) => {
+    return Math.floor((raw + multiple - 1) / multiple) * multiple;
+  }
+};
diff --git a/deps/v8/tools/turbolizer/node.js b/deps/v8/tools/turbolizer/src/node.ts
similarity index 60%
rename from deps/v8/tools/turbolizer/node.js
rename to deps/v8/tools/turbolizer/src/node.ts
index b718cdc4dfee34..533c51763b3002 100644
--- a/deps/v8/tools/turbolizer/node.js
+++ b/deps/v8/tools/turbolizer/src/node.ts
@@ -2,30 +2,60 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-var TYPE_HEIGHT = 25;
-var DEFAULT_NODE_BUBBLE_RADIUS = 12;
-var NODE_INPUT_WIDTH = 50;
-var MINIMUM_NODE_INPUT_APPROACH = 15 + 2 * DEFAULT_NODE_BUBBLE_RADIUS;
-var MINIMUM_NODE_OUTPUT_APPROACH = 15;
+const TYPE_HEIGHT = 25;
+const DEFAULT_NODE_BUBBLE_RADIUS = 12;
+const NODE_INPUT_WIDTH = 50;
+const MINIMUM_NODE_INPUT_APPROACH = 15 + 2 * DEFAULT_NODE_BUBBLE_RADIUS;
+const MINIMUM_NODE_OUTPUT_APPROACH = 15;
 
 function isNodeInitiallyVisible(node) {
   return node.cfg;
 }
 
-var Node = {
-  isControl: function() {
+function formatOrigin(origin) {
+  if (origin.nodeId) {
+    return `#${origin.nodeId} in phase ${origin.phase}/${origin.reducer}`;
+  }
+  if (origin.bytecodePosition) {
+    return `Bytecode line ${origin.bytecodePosition} in phase ${origin.phase}/${origin.reducer}`;
+  }
+  return "unknown origin";
+}
+
+class GNode {
+  control: boolean;
+  opcode: string;
+  live: boolean;
+  inputs: Array<any>;
+  width: number;
+  properties: string;
+  title: string;
+  label: string;
+  origin: NodeOrigin;
+  outputs: Array<any>;
+  outputApproach: number;
+  type: string;
+  id: number;
+  x: number;
+  y: number;
+  visible: boolean;
+  rank: number;
+  opinfo: string;
+  labelbbox: { width: number, height: number };
+
+  isControl() {
     return this.control;
-  },
-  isInput: function() {
+  }
+  isInput() {
     return this.opcode == 'Parameter' || this.opcode.endsWith('Constant');
-  },
-  isLive: function() {
+  }
+  isLive() {
     return this.live !== false;
-  },
-  isJavaScript: function() {
+  }
+  isJavaScript() {
     return this.opcode.startsWith('JS');
-  },
-  isSimplified: function() {
+  }
+  isSimplified() {
     if (this.isJavaScript()) return false;
     return this.opcode.endsWith('Phi') ||
       this.opcode.startsWith('Boolean') ||
@@ -39,16 +69,16 @@ var Node = {
       (this.opcode == 'AnyToBoolean') ||
       (this.opcode.startsWith('Load') && this.opcode.length > 4) ||
       (this.opcode.startsWith('Store') && this.opcode.length > 5);
-  },
-  isMachine: function() {
+  }
+  isMachine() {
     return !(this.isControl() || this.isInput() ||
-             this.isJavaScript() || this.isSimplified());
-  },
-  getTotalNodeWidth: function() {
+      this.isJavaScript() || this.isSimplified());
+  }
+  getTotalNodeWidth() {
     var inputWidth = this.inputs.length * NODE_INPUT_WIDTH;
     return Math.max(inputWidth, this.width);
-  },
-  getTitle: function() {
+  }
+  getTitle() {
     var propsString;
     if (this.properties === undefined) {
       propsString = "";
@@ -57,30 +87,34 @@ var Node = {
     } else {
       propsString = "[" + this.properties + "]";
     }
-    return this.title + "\n" + propsString + "\n" + this.opinfo;
-  },
-  getDisplayLabel: function() {
+    let title = this.title + "\n" + propsString + "\n" + this.opinfo;
+    if (this.origin) {
+      title += `\nOrigin: ${formatOrigin(this.origin)}`;
+    }
+    return title;
+  }
+  getDisplayLabel() {
     var result = this.id + ":" + this.label;
     if (result.length > 40) {
       return this.id + ":" + this.opcode;
-    } else  {
+    } else {
       return result;
     }
-  },
-  getType: function() {
+  }
+  getType() {
     return this.type;
-  },
-  getDisplayType: function() {
+  }
+  getDisplayType() {
     var type_string = this.type;
     if (type_string == undefined) return "";
     if (type_string.length > 24) {
       type_string = type_string.substr(0, 25) + "...";
     }
     return type_string;
-  },
-  deepestInputRank: function() {
+  }
+  deepestInputRank() {
     var deepestRank = 0;
-    this.inputs.forEach(function(e) {
+    this.inputs.forEach(function (e) {
       if (e.isVisible() && !e.isBackEdge()) {
         if (e.source.rank > deepestRank) {
           deepestRank = e.source.rank;
@@ -88,17 +122,17 @@ var Node = {
       }
     });
     return deepestRank;
-  },
-  areAnyOutputsVisible: function() {
+  }
+  areAnyOutputsVisible() {
     var visibleCount = 0;
-    this.outputs.forEach(function(e) { if (e.isVisible()) ++visibleCount; });
+    this.outputs.forEach(function (e) { if (e.isVisible())++visibleCount; });
     if (this.outputs.length == visibleCount) return 2;
     if (visibleCount != 0) return 1;
     return 0;
-  },
-  setOutputVisibility: function(v) {
+  }
+  setOutputVisibility(v) {
     var result = false;
-    this.outputs.forEach(function(e) {
+    this.outputs.forEach(function (e) {
       e.visible = v;
       if (v) {
         if (!e.target.visible) {
@@ -108,8 +142,8 @@ var Node = {
       }
     });
     return result;
-  },
-  setInputVisibility: function(i, v) {
+  }
+  setInputVisibility(i, v) {
     var edge = this.inputs[i];
     edge.visible = v;
     if (v) {
@@ -119,29 +153,28 @@ var Node = {
       }
     }
     return false;
-  },
-  getInputApproach: function(index) {
+  }
+  getInputApproach(index) {
     return this.y - MINIMUM_NODE_INPUT_APPROACH -
       (index % 4) * MINIMUM_EDGE_SEPARATION - DEFAULT_NODE_BUBBLE_RADIUS
-  },
-  getOutputApproach: function(graph, index) {
+  }
+  getOutputApproach(graph) {
     return this.y + this.outputApproach + graph.getNodeHeight(this) +
       + DEFAULT_NODE_BUBBLE_RADIUS;
-  },
-  getInputX: function(index) {
+  }
+  getInputX(index) {
     var result = this.getTotalNodeWidth() - (NODE_INPUT_WIDTH / 2) +
-        (index - this.inputs.length + 1) * NODE_INPUT_WIDTH;
+      (index - this.inputs.length + 1) * NODE_INPUT_WIDTH;
     return result;
-  },
-  getOutputX: function() {
+  }
+  getOutputX() {
     return this.getTotalNodeWidth() - (NODE_INPUT_WIDTH / 2);
-  },
-  getFunctionRelativeSourcePosition: function(graph) {
-    return this.pos - graph.sourcePosition;
-  },
-  hasBackEdges: function() {
+  }
+  hasBackEdges() {
     return (this.opcode == "Loop") ||
       ((this.opcode == "Phi" || this.opcode == "EffectPhi") &&
-       this.inputs[this.inputs.length - 1].source.opcode == "Loop");
+        this.inputs[this.inputs.length - 1].source.opcode == "Loop");
   }
 };
+
+const nodeToStr = (n: GNode) => "N" + n.id;
diff --git a/deps/v8/tools/turbolizer/src/schedule-view.ts b/deps/v8/tools/turbolizer/src/schedule-view.ts
new file mode 100644
index 00000000000000..ec8e1914ac2c42
--- /dev/null
+++ b/deps/v8/tools/turbolizer/src/schedule-view.ts
@@ -0,0 +1,191 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+"use strict";
+
+class ScheduleView extends TextView implements PhaseView {
+  schedule: Schedule;
+  sourceResolver: SourceResolver;
+
+  createViewElement() {
+    const pane = document.createElement('div');
+    pane.setAttribute('id', "schedule");
+    return pane;
+  }
+
+  constructor(parentId, broker) {
+    super(parentId, broker, null);
+    this.sourceResolver = broker.sourceResolver;
+  }
+
+  attachSelection(s) {
+    const view = this;
+    if (!(s instanceof Set)) return;
+    view.selectionHandler.clear();
+    view.blockSelectionHandler.clear();
+    const selected = new Array();
+    for (const key of s) selected.push(key);
+    view.selectionHandler.select(selected, true);
+  }
+
+  detachSelection() {
+    this.blockSelection.clear();
+    return this.selection.detachSelection();
+  }
+
+  initializeContent(data, rememberedSelection) {
+    this.divNode.innerHTML = '';
+    this.schedule = data.schedule
+    this.addBlocks(data.schedule.blocks);
+    this.attachSelection(rememberedSelection);
+  }
+
+  createElementFromString(htmlString) {
+    var div = document.createElement('div');
+    div.innerHTML = htmlString.trim();
+    return div.firstChild;
+  }
+
+  elementForBlock(block) {
+    const view = this;
+    function createElement(tag: string, cls: string | Array<string>, content?: string) {
+      const el = document.createElement(tag);
+      if (isIterable(cls)) {
+        for (const c of cls) el.classList.add(c);
+      } else {
+        el.classList.add(cls);
+      }
+      if (content != undefined) el.innerHTML = content;
+      return el;
+    }
+
+    function mkNodeLinkHandler(nodeId) {
+      return function (e) {
+        e.stopPropagation();
+        if (!e.shiftKey) {
+          view.selectionHandler.clear();
+        }
+        view.selectionHandler.select([nodeId], true);
+      };
+    }
+
+    function getMarker(start, end) {
+      if (start != end) {
+        return ["&#8857;", `This node generated instructions in range [${start},${end}). ` +
+                           `This is currently unreliable for constants.`];
+      }
+      if (start != -1) {
+        return ["&#183;", `The instruction selector did not generate instructions ` +
+                          `for this node, but processed the node at instruction ${start}. ` +
+                          `This usually means that this node was folded into another node; ` +
+                          `the highlighted machine code is a guess.`];
+      }
+      return ["", `This not is not in the final schedule.`]
+    }
+
+    function createElementForNode(node) {
+      const nodeEl = createElement("div", "node");
+
+      const [start, end] = view.sourceResolver.getInstruction(node.id);
+      const [marker, tooltip] = getMarker(start, end);
+      const instrMarker = createElement("div", ["instr-marker", "com"], marker);
+      instrMarker.setAttribute("title", tooltip);
+      instrMarker.onclick = mkNodeLinkHandler(node.id);
+      nodeEl.appendChild(instrMarker);
+
+
+      const node_id = createElement("div", ["node-id", "tag", "clickable"], node.id);
+      node_id.onclick = mkNodeLinkHandler(node.id);
+      view.addHtmlElementForNodeId(node.id, node_id);
+      nodeEl.appendChild(node_id);
+      const node_label = createElement("div", "node-label", node.label);
+      nodeEl.appendChild(node_label);
+      if (node.inputs.length > 0) {
+        const node_parameters = createElement("div", ["parameter-list", "comma-sep-list"]);
+        for (const param of node.inputs) {
+          const paramEl = createElement("div", ["parameter", "tag", "clickable"], param);
+          node_parameters.appendChild(paramEl);
+          paramEl.onclick = mkNodeLinkHandler(param);
+          view.addHtmlElementForNodeId(param, paramEl);
+        }
+        nodeEl.appendChild(node_parameters);
+      }
+
+      return nodeEl;
+    }
+
+    function mkBlockLinkHandler(blockId) {
+      return function (e) {
+        e.stopPropagation();
+        if (!e.shiftKey) {
+          view.blockSelectionHandler.clear();
+        }
+        view.blockSelectionHandler.select(["" + blockId], true);
+      };
+    }
+
+    const schedule_block = createElement("div", "schedule-block");
+
+    const [start, end] = view.sourceResolver.getInstructionRangeForBlock(block.id);
+    const instrMarker = createElement("div", ["instr-marker", "com"], "&#8857;");
+    instrMarker.setAttribute("title", `Instructions range for this block is [${start}, ${end})`)
+    instrMarker.onclick = mkBlockLinkHandler(block.id);
+    schedule_block.appendChild(instrMarker);
+
+    const block_id = createElement("div", ["block-id", "com", "clickable"], block.id);
+    block_id.onclick = mkBlockLinkHandler(block.id);
+    schedule_block.appendChild(block_id);
+    const block_pred = createElement("div", ["predecessor-list", "block-list", "comma-sep-list"]);
+    for (const pred of block.pred) {
+      const predEl = createElement("div", ["block-id", "com", "clickable"], pred);
+      predEl.onclick = mkBlockLinkHandler(pred);
+      block_pred.appendChild(predEl);
+    }
+    if (block.pred.length) schedule_block.appendChild(block_pred);
+    const nodes = createElement("div", "nodes");
+    for (const node of block.nodes) {
+      nodes.appendChild(createElementForNode(node));
+    }
+    schedule_block.appendChild(nodes);
+    const block_succ = createElement("div", ["successor-list", "block-list", "comma-sep-list"]);
+    for (const succ of block.succ) {
+      const succEl = createElement("div", ["block-id", "com", "clickable"], succ);
+      succEl.onclick = mkBlockLinkHandler(succ);
+      block_succ.appendChild(succEl);
+    }
+    if (block.succ.length) schedule_block.appendChild(block_succ);
+    this.addHtmlElementForBlockId(block.id, schedule_block);
+    return schedule_block;
+  }
+
+  addBlocks(blocks) {
+    for (const block of blocks) {
+      const blockEl = this.elementForBlock(block);
+      this.divNode.appendChild(blockEl);
+    }
+  }
+
+  lineString(node) {
+    return `${node.id}: ${node.label}(${node.inputs.join(", ")})`
+  }
+
+  searchInputAction(searchBar, e) {
+    e.stopPropagation();
+    this.selectionHandler.clear();
+    const query = searchBar.value;
+    if (query.length == 0) return;
+    const select = [];
+    window.sessionStorage.setItem("lastSearch", query);
+    const reg = new RegExp(query);
+    for (const node of this.schedule.nodes) {
+      if (node === undefined) continue;
+      if (reg.exec(this.lineString(node)) != null) {
+        select.push(node.id)
+      }
+    }
+    this.selectionHandler.select(select, true);
+  }
+
+  onresize() { }
+}
diff --git a/deps/v8/tools/turbolizer/src/selection-broker.ts b/deps/v8/tools/turbolizer/src/selection-broker.ts
new file mode 100644
index 00000000000000..973e945da4c508
--- /dev/null
+++ b/deps/v8/tools/turbolizer/src/selection-broker.ts
@@ -0,0 +1,77 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+class SelectionBroker {
+  sourceResolver: SourceResolver;
+  sourcePositionHandlers: Array<SelectionHandler>;
+  nodeHandlers: Array<NodeSelectionHandler>;
+  blockHandlers: Array<BlockSelectionHandler>;
+
+  constructor(sourceResolver) {
+    this.sourcePositionHandlers = [];
+    this.nodeHandlers = [];
+    this.blockHandlers = [];
+    this.sourceResolver = sourceResolver;
+  };
+
+  addSourcePositionHandler(handler) {
+    this.sourcePositionHandlers.push(handler);
+  }
+
+  addNodeHandler(handler) {
+    this.nodeHandlers.push(handler);
+  }
+
+  addBlockHandler(handler) {
+    this.blockHandlers.push(handler);
+  }
+
+  broadcastSourcePositionSelect(from, sourcePositions, selected) {
+    let broker = this;
+    sourcePositions = sourcePositions.filter((l) => {
+      if (!sourcePositionValid(l)) {
+        console.log("Warning: invalid source position");
+        return false;
+      }
+      return true;
+    });
+    for (const b of this.sourcePositionHandlers) {
+      if (b != from) b.brokeredSourcePositionSelect(sourcePositions, selected);
+    }
+    const nodes = this.sourceResolver.sourcePositionsToNodeIds(sourcePositions);
+    for (const b of this.nodeHandlers) {
+      if (b != from) b.brokeredNodeSelect(nodes, selected);
+    }
+  }
+
+  broadcastNodeSelect(from, nodes, selected) {
+    let broker = this;
+    for (const b of this.nodeHandlers) {
+      if (b != from) b.brokeredNodeSelect(nodes, selected);
+    }
+    const sourcePositions = this.sourceResolver.nodeIdsToSourcePositions(nodes);
+    for (const b of this.sourcePositionHandlers) {
+      if (b != from) b.brokeredSourcePositionSelect(sourcePositions, selected);
+    }
+  }
+
+  broadcastBlockSelect(from, blocks, selected) {
+    let broker = this;
+    for (var b of this.blockHandlers) {
+      if (b != from) b.brokeredBlockSelect(blocks, selected);
+    }
+  }
+
+  broadcastClear(from) {
+    this.sourcePositionHandlers.forEach(function (b) {
+      if (b != from) b.brokeredClear();
+    });
+    this.nodeHandlers.forEach(function (b) {
+      if (b != from) b.brokeredClear();
+    });
+    this.blockHandlers.forEach(function (b) {
+      if (b != from) b.brokeredClear();
+    });
+  }
+}
diff --git a/deps/v8/tools/turbolizer/src/selection-handler.ts b/deps/v8/tools/turbolizer/src/selection-handler.ts
new file mode 100644
index 00000000000000..bf0719c8a6626c
--- /dev/null
+++ b/deps/v8/tools/turbolizer/src/selection-handler.ts
@@ -0,0 +1,24 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+interface SelectionHandler {
+  clear(): void;
+  select(nodeIds: any, selected: any): void;
+  brokeredClear(): void;
+  brokeredSourcePositionSelect(sourcePositions: any, selected: any): void;
+};
+
+interface NodeSelectionHandler {
+  clear(): void;
+  select(nodeIds: any, selected: any): void;
+  brokeredClear(): void;
+  brokeredNodeSelect(nodeIds: any, selected: any): void;
+};
+
+interface BlockSelectionHandler {
+  clear(): void;
+  select(nodeIds: any, selected: any): void;
+  brokeredClear(): void;
+  brokeredBlockSelect(blockIds: any, selected: any): void;
+};
diff --git a/deps/v8/tools/turbolizer/src/selection.ts b/deps/v8/tools/turbolizer/src/selection.ts
new file mode 100644
index 00000000000000..54b685e9d68b7d
--- /dev/null
+++ b/deps/v8/tools/turbolizer/src/selection.ts
@@ -0,0 +1,63 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+class MySelection {
+  selection: any;
+  stringKey: (o: any) => string;
+
+  constructor(stringKeyFnc) {
+    this.selection = new Map();
+    this.stringKey = stringKeyFnc;
+  }
+
+  isEmpty(): boolean {
+    return this.selection.size == 0;
+  }
+
+  clear(): void {
+    this.selection = new Map();
+  }
+
+  select(s, isSelected) {
+    if (!isIterable(s)) { s = [s]; }
+    for (const i of s) {
+      if (!i) continue;
+      if (isSelected == undefined) {
+        isSelected = !this.selection.has(this.stringKey(i));
+      }
+      if (isSelected) {
+        this.selection.set(this.stringKey(i), i);
+      } else {
+        this.selection.delete(this.stringKey(i));
+      }
+    }
+  }
+
+  isSelected(i): boolean {
+    return this.selection.has(this.stringKey(i));
+  }
+
+  isKeySelected(key: string): boolean {
+    return this.selection.has(key);
+  }
+
+  selectedKeys() {
+    var result = new Set();
+    for (var i of this.selection.keys()) {
+      result.add(i);
+    }
+    return result;
+  }
+
+  detachSelection() {
+    var result = new Set();
+    for (var i of this.selection.keys()) {
+      result.add(i);
+    }
+    this.clear();
+    return result;
+  }
+
+  [Symbol.iterator]() { return this.selection.values() }
+}
diff --git a/deps/v8/tools/turbolizer/src/source-resolver.ts b/deps/v8/tools/turbolizer/src/source-resolver.ts
new file mode 100644
index 00000000000000..ba7e55d588611b
--- /dev/null
+++ b/deps/v8/tools/turbolizer/src/source-resolver.ts
@@ -0,0 +1,526 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function sourcePositionLe(a, b) {
+  if (a.inliningId == b.inliningId) {
+    return a.scriptOffset - b.scriptOffset;
+  }
+  return a.inliningId - b.inliningId;
+}
+
+function sourcePositionEq(a, b) {
+  return a.inliningId == b.inliningId &&
+    a.scriptOffset == b.scriptOffset;
+}
+
+function sourcePositionToStringKey(sourcePosition): string {
+  if (!sourcePosition) return "undefined";
+  if (sourcePosition.inliningId && sourcePosition.scriptOffset)
+    return "SP:" + sourcePosition.inliningId + ":" + sourcePosition.scriptOffset;
+  if (sourcePosition.bytecodePosition)
+    return "BCP:" + sourcePosition.bytecodePosition;
+  return "undefined";
+}
+
+function sourcePositionValid(l) {
+  return (typeof l.scriptOffset !== undefined
+    && typeof l.inliningId !== undefined) || typeof l.bytecodePosition != undefined;
+}
+
+interface SourcePosition {
+  scriptOffset: number;
+  inliningId: number;
+}
+
+interface TurboFanOrigin {
+  phase: string;
+  reducer: string;
+}
+
+interface NodeOrigin {
+  nodeId: number;
+}
+
+interface BytecodePosition {
+  bytecodePosition: number;
+}
+
+type Origin = NodeOrigin | BytecodePosition;
+type TurboFanNodeOrigin = NodeOrigin & TurboFanOrigin;
+type TurboFanBytecodeOrigin = BytecodePosition & TurboFanOrigin;
+
+type AnyPosition = SourcePosition | BytecodePosition;
+
+interface Source {
+  sourcePositions: Array<SourcePosition>;
+  sourceName: string;
+  functionName: string;
+  sourceText: string;
+  sourceId: number;
+  startPosition?: number;
+}
+interface Inlining {
+  inliningPosition: SourcePosition;
+  sourceId: number;
+}
+interface Phase {
+  type: string;
+  name: string;
+  data: any;
+}
+
+interface Schedule {
+  nodes: Array<any>;
+}
+
+class SourceResolver {
+  nodePositionMap: Array<AnyPosition>;
+  sources: Array<Source>;
+  inlinings: Array<Inlining>;
+  inliningsMap: Map<string, Inlining>;
+  positionToNodes: Map<string, Array<string>>;
+  phases: Array<Phase>;
+  phaseNames: Map<string, number>;
+  disassemblyPhase: Phase;
+  lineToSourcePositions: Map<string, Array<AnyPosition>>;
+  nodeIdToInstructionRange: Array<[number, number]>;
+  blockIdToInstructionRange: Array<[number, number]>;
+  instructionToPCOffset: Array<number>;
+  pcOffsetToInstructions: Map<number, Array<number>>;
+
+
+  constructor() {
+    // Maps node ids to source positions.
+    this.nodePositionMap = [];
+    // Maps source ids to source objects.
+    this.sources = [];
+    // Maps inlining ids to inlining objects.
+    this.inlinings = [];
+    // Maps source position keys to inlinings.
+    this.inliningsMap = new Map();
+    // Maps source position keys to node ids.
+    this.positionToNodes = new Map();
+    // Maps phase ids to phases.
+    this.phases = [];
+    // Maps phase names to phaseIds.
+    this.phaseNames = new Map();
+    // The disassembly phase is stored separately.
+    this.disassemblyPhase = undefined;
+    // Maps line numbers to source positions
+    this.lineToSourcePositions = new Map();
+    // Maps node ids to instruction ranges.
+    this.nodeIdToInstructionRange = [];
+    // Maps block ids to instruction ranges.
+    this.blockIdToInstructionRange = [];
+    // Maps instruction numbers to PC offsets.
+    this.instructionToPCOffset = [];
+    // Maps PC offsets to instructions.
+    this.pcOffsetToInstructions = new Map();
+  }
+
+  setSources(sources, mainBackup) {
+    if (sources) {
+      for (let [sourceId, source] of Object.entries(sources)) {
+        this.sources[sourceId] = source;
+        this.sources[sourceId].sourcePositions = [];
+      }
+    }
+    // This is a fallback if the JSON is incomplete (e.g. due to compiler crash).
+    if (!this.sources[-1]) {
+      this.sources[-1] = mainBackup;
+      this.sources[-1].sourcePositions = [];
+    }
+  }
+
+  setInlinings(inlinings) {
+    if (inlinings) {
+      for (const [inliningId, inlining] of Object.entries<Inlining>(inlinings)) {
+        this.inlinings[inliningId] = inlining;
+        this.inliningsMap.set(sourcePositionToStringKey(inlining.inliningPosition), inlining);
+      }
+    }
+    // This is a default entry for the script itself that helps
+    // keep other code more uniform.
+    this.inlinings[-1] = { sourceId: -1, inliningPosition: null };
+  }
+
+  setNodePositionMap(map) {
+    if (!map) return;
+    if (typeof map[0] != 'object') {
+      const alternativeMap = {};
+      for (const [nodeId, scriptOffset] of Object.entries<number>(map)) {
+        alternativeMap[nodeId] = { scriptOffset: scriptOffset, inliningId: -1 };
+      }
+      map = alternativeMap;
+    };
+
+    for (const [nodeId, sourcePosition] of Object.entries<SourcePosition>(map)) {
+      if (sourcePosition == undefined) {
+        console.log("Warning: undefined source position ", sourcePosition, " for nodeId ", nodeId);
+      }
+      const inliningId = sourcePosition.inliningId;
+      const inlining = this.inlinings[inliningId];
+      if (inlining) {
+        const sourceId = inlining.sourceId;
+        this.sources[sourceId].sourcePositions.push(sourcePosition);
+      }
+      this.nodePositionMap[nodeId] = sourcePosition;
+      let key = sourcePositionToStringKey(sourcePosition);
+      if (!this.positionToNodes.has(key)) {
+        this.positionToNodes.set(key, []);
+      }
+      this.positionToNodes.get(key).push(nodeId);
+    }
+    for (const [sourceId, source] of Object.entries(this.sources)) {
+      source.sourcePositions = sortUnique(source.sourcePositions,
+        sourcePositionLe, sourcePositionEq);
+    }
+  }
+
+  sourcePositionsToNodeIds(sourcePositions) {
+    const nodeIds = new Set();
+    for (const sp of sourcePositions) {
+      let key = sourcePositionToStringKey(sp);
+      let nodeIdsForPosition = this.positionToNodes.get(key);
+      if (!nodeIdsForPosition) continue;
+      for (const nodeId of nodeIdsForPosition) {
+        nodeIds.add(nodeId);
+      }
+    }
+    return nodeIds;
+  }
+
+  nodeIdsToSourcePositions(nodeIds): Array<AnyPosition> {
+    const sourcePositions = new Map();
+    for (const nodeId of nodeIds) {
+      let sp = this.nodePositionMap[nodeId];
+      let key = sourcePositionToStringKey(sp);
+      sourcePositions.set(key, sp);
+    }
+    const sourcePositionArray = [];
+    for (const sp of sourcePositions.values()) {
+      sourcePositionArray.push(sp);
+    }
+    return sourcePositionArray;
+  }
+
+  forEachSource(f) {
+    this.sources.forEach(f);
+  }
+
+  translateToSourceId(sourceId, location) {
+    for (const position of this.getInlineStack(location)) {
+      let inlining = this.inlinings[position.inliningId];
+      if (!inlining) continue;
+      if (inlining.sourceId == sourceId) {
+        return position;
+      }
+    }
+    return location;
+  }
+
+  addInliningPositions(sourcePosition, locations) {
+    let inlining = this.inliningsMap.get(sourcePositionToStringKey(sourcePosition));
+    if (!inlining) return;
+    let sourceId = inlining.sourceId
+    const source = this.sources[sourceId];
+    for (const sp of source.sourcePositions) {
+      locations.push(sp);
+      this.addInliningPositions(sp, locations);
+    }
+  }
+
+  getInliningForPosition(sourcePosition) {
+    return this.inliningsMap.get(sourcePositionToStringKey(sourcePosition));
+  }
+
+  getSource(sourceId) {
+    return this.sources[sourceId];
+  }
+
+  getSourceName(sourceId) {
+    const source = this.sources[sourceId];
+    return `${source.sourceName}:${source.functionName}`;
+  }
+
+  sourcePositionFor(sourceId, scriptOffset) {
+    if (!this.sources[sourceId]) {
+      return null;
+    }
+    const list = this.sources[sourceId].sourcePositions;
+    for (let i = 0; i < list.length; i++) {
+      const sourcePosition = list[i]
+      const position = sourcePosition.scriptOffset;
+      const nextPosition = list[Math.min(i + 1, list.length - 1)].scriptOffset;
+      if ((position <= scriptOffset && scriptOffset < nextPosition)) {
+        return sourcePosition;
+      }
+    }
+    return null;
+  }
+
+  sourcePositionsInRange(sourceId, start, end) {
+    if (!this.sources[sourceId]) return [];
+    const res = [];
+    const list = this.sources[sourceId].sourcePositions;
+    for (let i = 0; i < list.length; i++) {
+      const sourcePosition = list[i]
+      if (start <= sourcePosition.scriptOffset && sourcePosition.scriptOffset < end) {
+        res.push(sourcePosition);
+      }
+    }
+    return res;
+  }
+
+  getInlineStack(sourcePosition) {
+    if (!sourcePosition) {
+      return [];
+    }
+    let inliningStack = [];
+    let cur = sourcePosition;
+    while (cur && cur.inliningId != -1) {
+      inliningStack.push(cur);
+      let inlining = this.inlinings[cur.inliningId];
+      if (!inlining) {
+        break;
+      }
+      cur = inlining.inliningPosition;
+    }
+    if (cur && cur.inliningId == -1) {
+      inliningStack.push(cur);
+    }
+    return inliningStack;
+  }
+
+  recordOrigins(phase) {
+    if (phase.type != "graph") return;
+    for (const node of phase.data.nodes) {
+      if (node.origin != undefined &&
+        node.origin.bytecodePosition != undefined) {
+        const position = { bytecodePosition: node.origin.bytecodePosition };
+        this.nodePositionMap[node.id] = position;
+        let key = sourcePositionToStringKey(position);
+        if (!this.positionToNodes.has(key)) {
+          this.positionToNodes.set(key, []);
+        }
+        const A = this.positionToNodes.get(key);
+        if (!A.includes(node.id)) A.push("" + node.id);
+      }
+    }
+  }
+
+  readNodeIdToInstructionRange(nodeIdToInstructionRange) {
+    for (const [nodeId, range] of Object.entries<[number, number]>(nodeIdToInstructionRange)) {
+      this.nodeIdToInstructionRange[nodeId] = range;
+    }
+  }
+
+  readBlockIdToInstructionRange(blockIdToInstructionRange) {
+    for (const [blockId, range] of Object.entries<[number, number]>(blockIdToInstructionRange)) {
+      this.blockIdToInstructionRange[blockId] = range;
+    }
+  }
+
+  getInstruction(nodeId):[number, number] {
+    const X = this.nodeIdToInstructionRange[nodeId];
+    if (X === undefined) return [-1, -1];
+    return X;
+  }
+
+  getInstructionRangeForBlock(blockId):[number, number] {
+    const X = this.blockIdToInstructionRange[blockId];
+    if (X === undefined) return [-1, -1];
+    return X;
+  }
+
+  readInstructionOffsetToPCOffset(instructionToPCOffset) {
+    for (const [instruction, offset] of Object.entries<number>(instructionToPCOffset)) {
+      this.instructionToPCOffset[instruction] = offset;
+      if (!this.pcOffsetToInstructions.has(offset)) {
+        this.pcOffsetToInstructions.set(offset, []);
+      }
+      this.pcOffsetToInstructions.get(offset).push(instruction);
+    }
+    console.log(this.pcOffsetToInstructions);
+  }
+
+  hasPCOffsets() {
+    return this.pcOffsetToInstructions.size > 0;
+  }
+
+
+  nodesForPCOffset(offset): [Array<String>, Array<String>] {
+    const keys = Array.from(this.pcOffsetToInstructions.keys()).sort((a, b) => b - a);
+    if (keys.length === 0) return [[],[]];
+    for (const key of keys) {
+      if (key <= offset) {
+        const instrs = this.pcOffsetToInstructions.get(key);
+        const nodes = [];
+        const blocks = [];
+        for (const instr of instrs) {
+          for (const [nodeId, range] of this.nodeIdToInstructionRange.entries()) {
+            if (!range) continue;
+            const [start, end] = range;
+            if (start == end && instr == start) {
+              nodes.push("" + nodeId);
+            }
+            if (start <= instr && instr < end) {
+              nodes.push("" + nodeId);
+            }
+          }
+        }
+        return [nodes, blocks];
+      }
+    }
+    return [[],[]];
+  }
+
+  parsePhases(phases) {
+    for (const [phaseId, phase] of Object.entries<Phase>(phases)) {
+      if (phase.type == 'disassembly') {
+        this.disassemblyPhase = phase;
+      } else if (phase.type == 'schedule') {
+        this.phases.push(this.parseSchedule(phase))
+        this.phaseNames.set(phase.name, this.phases.length);
+      } else if (phase.type == 'instructions') {
+        if (phase.nodeIdToInstructionRange) {
+          this.readNodeIdToInstructionRange(phase.nodeIdToInstructionRange);
+        }
+        if (phase.blockIdtoInstructionRange) {
+          this.readBlockIdToInstructionRange(phase.blockIdtoInstructionRange);
+        }
+        if (phase.instructionOffsetToPCOffset) {
+          this.readInstructionOffsetToPCOffset(phase.instructionOffsetToPCOffset);
+        }
+      } else {
+        this.phases.push(phase);
+        this.recordOrigins(phase);
+        this.phaseNames.set(phase.name, this.phases.length);
+      }
+    }
+  }
+
+  repairPhaseId(anyPhaseId) {
+    return Math.max(0, Math.min(anyPhaseId, this.phases.length - 1))
+  }
+
+  getPhase(phaseId) {
+    return this.phases[phaseId];
+  }
+
+  getPhaseIdByName(phaseName) {
+    return this.phaseNames.get(phaseName);
+  }
+
+  forEachPhase(f) {
+    this.phases.forEach(f);
+  }
+
+  addAnyPositionToLine(lineNumber: number | String, sourcePosition: AnyPosition) {
+    const lineNumberString = anyToString(lineNumber);
+    if (!this.lineToSourcePositions.has(lineNumberString)) {
+      this.lineToSourcePositions.set(lineNumberString, []);
+    }
+    const A = this.lineToSourcePositions.get(lineNumberString);
+    if (!A.includes(sourcePosition)) A.push(sourcePosition);
+  }
+
+  setSourceLineToBytecodePosition(sourceLineToBytecodePosition: Array<number> | undefined) {
+    if (!sourceLineToBytecodePosition) return;
+    sourceLineToBytecodePosition.forEach((pos, i) => {
+      this.addAnyPositionToLine(i, { bytecodePosition: pos });
+    });
+  }
+
+  linetoSourcePositions(lineNumber: number | String) {
+    const positions = this.lineToSourcePositions.get(anyToString(lineNumber));
+    if (positions === undefined) return [];
+    return positions;
+  }
+
+  parseSchedule(phase) {
+    function createNode(state, match) {
+      let inputs = [];
+      if (match.groups.args) {
+        const nodeIdsString = match.groups.args.replace(/\s/g, '');
+        const nodeIdStrings = nodeIdsString.split(',');
+        inputs = nodeIdStrings.map((n) => Number.parseInt(n, 10));
+      }
+      const node = {
+        id: Number.parseInt(match.groups.id, 10),
+        label: match.groups.label,
+        inputs: inputs
+      };
+      if (match.groups.blocks) {
+        const nodeIdsString = match.groups.blocks.replace(/\s/g, '').replace(/B/g, '');
+        const nodeIdStrings = nodeIdsString.split(',');
+        const successors = nodeIdStrings.map((n) => Number.parseInt(n, 10));
+        state.currentBlock.succ = successors;
+      }
+      state.nodes[node.id] = node;
+      state.currentBlock.nodes.push(node);
+    }
+    function createBlock(state, match) {
+      let predecessors = [];
+      if (match.groups.in) {
+        const blockIdsString = match.groups.in.replace(/\s/g, '').replace(/B/g, '');
+        const blockIdStrings = blockIdsString.split(',');
+        predecessors = blockIdStrings.map((n) => Number.parseInt(n, 10));
+      }
+      const block = {
+        id: Number.parseInt(match.groups.id, 10),
+        isDeferred: match.groups.deferred != undefined,
+        pred: predecessors.sort(),
+        succ: [],
+        nodes: []
+      };
+      state.blocks[block.id] = block;
+      state.currentBlock = block;
+    }
+    function setGotoSuccessor(state, match) {
+      state.currentBlock.succ = [Number.parseInt(match.groups.successor.replace(/\s/g, ''), 10)];
+    }
+    const rules = [
+      {
+        lineRegexps:
+          [/^\s*(?<id>\d+):\ (?<label>.*)\((?<args>.*)\)$/,
+            /^\s*(?<id>\d+):\ (?<label>.*)\((?<args>.*)\)\ ->\ (?<blocks>.*)$/,
+            /^\s*(?<id>\d+):\ (?<label>.*)$/
+          ],
+        process: createNode
+      },
+      {
+        lineRegexps:
+          [/^\s*---\s*BLOCK\ B(?<id>\d+)\s*(?<deferred>\(deferred\))?(\ <-\ )?(?<in>[^-]*)?\ ---$/
+          ],
+        process: createBlock
+      },
+      {
+        lineRegexps:
+          [/^\s*Goto\s*->\s*B(?<successor>\d+)\s*$/
+          ],
+        process: setGotoSuccessor
+      }
+    ];
+
+    const lines = phase.data.split(/[\n]/);
+    const state = { currentBlock: undefined, blocks: [], nodes: [] };
+
+    nextLine:
+    for (const line of lines) {
+      for (const rule of rules) {
+        for (const lineRegexp of rule.lineRegexps) {
+          const match = line.match(lineRegexp);
+          if (match) {
+            rule.process(state, match);
+            continue nextLine;
+          }
+        }
+      }
+      console.log("Warning: unmatched schedule line \"" + line + "\"");
+    }
+    phase.schedule = state;
+    return phase;
+  }
+}
diff --git a/deps/v8/tools/turbolizer/src/text-view.ts b/deps/v8/tools/turbolizer/src/text-view.ts
new file mode 100644
index 00000000000000..d4d2840871bb31
--- /dev/null
+++ b/deps/v8/tools/turbolizer/src/text-view.ts
@@ -0,0 +1,279 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+"use strict";
+
+function anyToString(x: any): string {
+  return "" + x;
+}
+
+abstract class TextView extends View {
+  selectionHandler: NodeSelectionHandler;
+  blockSelectionHandler: BlockSelectionHandler;
+  nodeSelectionHandler: NodeSelectionHandler;
+  selection: MySelection;
+  blockSelection: MySelection;
+  textListNode: HTMLUListElement;
+  nodeIdToHtmlElementsMap: Map<string, Array<HTMLElement>>;
+  blockIdToHtmlElementsMap: Map<string, Array<HTMLElement>>;
+  blockIdtoNodeIds: Map<string, Array<string>>;
+  nodeIdToBlockId: Array<string>;
+  patterns: any;
+
+  constructor(id, broker, patterns) {
+    super(id);
+    let view = this;
+    view.textListNode = view.divNode.getElementsByTagName('ul')[0];
+    view.patterns = patterns;
+    view.nodeIdToHtmlElementsMap = new Map();
+    view.blockIdToHtmlElementsMap = new Map();
+    view.blockIdtoNodeIds = new Map();
+    view.nodeIdToBlockId = [];
+    view.selection = new MySelection(anyToString);
+    view.blockSelection = new MySelection(anyToString);
+    const selectionHandler = {
+      clear: function () {
+        view.selection.clear();
+        view.updateSelection();
+        broker.broadcastClear(selectionHandler);
+      },
+      select: function (nodeIds, selected) {
+        view.selection.select(nodeIds, selected);
+        view.updateSelection();
+        broker.broadcastNodeSelect(selectionHandler, view.selection.selectedKeys(), selected);
+      },
+      brokeredNodeSelect: function (nodeIds, selected) {
+        const firstSelect = view.blockSelection.isEmpty();
+        view.selection.select(nodeIds, selected);
+        view.updateSelection(firstSelect);
+      },
+      brokeredClear: function () {
+        view.selection.clear();
+        view.updateSelection();
+      }
+    };
+    this.selectionHandler = selectionHandler;
+    broker.addNodeHandler(selectionHandler);
+    view.divNode.onmouseup = function (e) {
+      if (!e.shiftKey) {
+        view.selectionHandler.clear();
+      }
+    }
+    const blockSelectionHandler = {
+      clear: function () {
+        view.blockSelection.clear();
+        view.updateSelection();
+        broker.broadcastClear(blockSelectionHandler);
+      },
+      select: function (blockIds, selected) {
+        view.blockSelection.select(blockIds, selected);
+        view.updateSelection();
+        broker.broadcastBlockSelect(blockSelectionHandler, blockIds, selected);
+      },
+      brokeredBlockSelect: function (blockIds, selected) {
+        const firstSelect = view.blockSelection.isEmpty();
+        view.blockSelection.select(blockIds, selected);
+        view.updateSelection(firstSelect);
+      },
+      brokeredClear: function () {
+        view.blockSelection.clear();
+        view.updateSelection();
+      }
+    };
+    this.blockSelectionHandler = blockSelectionHandler;
+    broker.addBlockHandler(blockSelectionHandler);
+  }
+
+  addHtmlElementForNodeId(anyNodeId: any, htmlElement: HTMLElement) {
+    const nodeId = anyToString(anyNodeId);
+    if (!this.nodeIdToHtmlElementsMap.has(nodeId)) {
+      this.nodeIdToHtmlElementsMap.set(nodeId, []);
+    }
+    this.nodeIdToHtmlElementsMap.get(nodeId).push(htmlElement);
+  }
+
+  addHtmlElementForBlockId(anyBlockId, htmlElement) {
+    const blockId = anyToString(anyBlockId);
+    if (!this.blockIdToHtmlElementsMap.has(blockId)) {
+      this.blockIdToHtmlElementsMap.set(blockId, []);
+    }
+    this.blockIdToHtmlElementsMap.get(blockId).push(htmlElement);
+  }
+
+  addNodeIdToBlockId(anyNodeId, anyBlockId) {
+    const blockId = anyToString(anyBlockId);
+    if (!this.blockIdtoNodeIds.has(blockId)) {
+      this.blockIdtoNodeIds.set(blockId, []);
+    }
+    this.blockIdtoNodeIds.get(blockId).push(anyToString(anyNodeId));
+    this.nodeIdToBlockId[anyNodeId] = blockId;
+  }
+
+  blockIdsForNodeIds(nodeIds) {
+    const blockIds = [];
+    for (const nodeId of nodeIds) {
+      const blockId = this.nodeIdToBlockId[nodeId];
+      if (blockId == undefined) continue;
+      blockIds.push(blockId);
+    }
+    return blockIds;
+  }
+
+  updateSelection(scrollIntoView: boolean = false) {
+    if (this.divNode.parentNode == null) return;
+    const mkVisible = new ViewElements(this.divNode.parentNode as HTMLElement);
+    const view = this;
+    for (const [blockId, elements] of this.blockIdToHtmlElementsMap.entries()) {
+      const isSelected = view.blockSelection.isSelected(blockId);
+      for (const element of elements) {
+        mkVisible.consider(element, isSelected);
+        element.classList.toggle("selected", isSelected);
+      }
+    }
+    for (const key of this.nodeIdToHtmlElementsMap.keys()) {
+      for (const element of this.nodeIdToHtmlElementsMap.get(key)) {
+        element.classList.toggle("selected", false);
+      }
+    }
+    for (const nodeId of view.selection.selectedKeys()) {
+      const elements = this.nodeIdToHtmlElementsMap.get(nodeId);
+      if (!elements) continue;
+      for (const element of elements) {
+        mkVisible.consider(element, true);
+        element.classList.toggle("selected", true);
+      }
+    }
+    mkVisible.apply(scrollIntoView);
+  }
+
+  setPatterns(patterns) {
+    let view = this;
+    view.patterns = patterns;
+  }
+
+  clearText() {
+    let view = this;
+    while (view.textListNode.firstChild) {
+      view.textListNode.removeChild(view.textListNode.firstChild);
+    }
+  }
+
+  createFragment(text, style) {
+    let view = this;
+    let fragment = document.createElement("SPAN");
+
+    if (style.blockId != undefined) {
+      const blockId = style.blockId(text);
+      if (blockId != undefined) {
+        fragment.blockId = blockId;
+        this.addHtmlElementForBlockId(blockId, fragment);
+      }
+    }
+
+    if (typeof style.link == 'function') {
+      fragment.classList.add('linkable-text');
+      fragment.onmouseup = function (e) {
+        e.stopPropagation();
+        style.link(text)
+      };
+    }
+
+    if (typeof style.nodeId == 'function') {
+      const nodeId = style.nodeId(text);
+      if (nodeId != undefined) {
+        fragment.nodeId = nodeId;
+        this.addHtmlElementForNodeId(nodeId, fragment);
+      }
+    }
+
+    if (typeof style.assignBlockId === 'function') {
+      fragment.blockId = style.assignBlockId();
+      this.addNodeIdToBlockId(fragment.nodeId, fragment.blockId);
+    }
+
+    if (typeof style.linkHandler == 'function') {
+      const handler = style.linkHandler(text, fragment)
+      if (handler !== undefined) {
+        fragment.classList.add('linkable-text');
+        fragment.onmouseup = handler;
+      }
+    }
+
+    if (style.css != undefined) {
+      const css = isIterable(style.css) ? style.css : [style.css];
+      for (const cls of css) {
+        fragment.classList.add(cls);
+      }
+    }
+    fragment.innerHTML = text;
+    return fragment;
+  }
+
+  processLine(line) {
+    let view = this;
+    let result = [];
+    let patternSet = 0;
+    while (true) {
+      let beforeLine = line;
+      for (let pattern of view.patterns[patternSet]) {
+        let matches = line.match(pattern[0]);
+        if (matches != null) {
+          if (matches[0] != '') {
+            let style = pattern[1] != null ? pattern[1] : {};
+            let text = matches[0];
+            if (text != '') {
+              let fragment = view.createFragment(matches[0], style);
+              result.push(fragment);
+            }
+            line = line.substr(matches[0].length);
+          }
+          let nextPatternSet = patternSet;
+          if (pattern.length > 2) {
+            nextPatternSet = pattern[2];
+          }
+          if (line == "") {
+            if (nextPatternSet != -1) {
+              throw ("illegal parsing state in text-view in patternSet" + patternSet);
+            }
+            return result;
+          }
+          patternSet = nextPatternSet;
+          break;
+        }
+      }
+      if (beforeLine == line) {
+        throw ("input not consumed in text-view in patternSet" + patternSet);
+      }
+    }
+  }
+
+  processText(text) {
+    let view = this;
+    let textLines = text.split(/[\n]/);
+    let lineNo = 0;
+    for (let line of textLines) {
+      let li = document.createElement("LI");
+      li.className = "nolinenums";
+      li.dataset.lineNo = "" + lineNo++;
+      let fragments = view.processLine(line);
+      for (let fragment of fragments) {
+        li.appendChild(fragment);
+      }
+      view.textListNode.appendChild(li);
+    }
+  }
+
+  initializeContent(data, rememberedSelection) {
+    let view = this;
+    view.clearText();
+    view.processText(data);
+  }
+
+  deleteContent() {
+  }
+
+  isScrollable() {
+    return true;
+  }
+}
diff --git a/deps/v8/tools/turbolizer/src/turbo-visualizer.ts b/deps/v8/tools/turbolizer/src/turbo-visualizer.ts
new file mode 100644
index 00000000000000..9d41042300b9ae
--- /dev/null
+++ b/deps/v8/tools/turbolizer/src/turbo-visualizer.ts
@@ -0,0 +1,294 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+class Snapper {
+  resizer: Resizer;
+  sourceExpand: HTMLElement;
+  sourceCollapse: HTMLElement;
+  disassemblyExpand: HTMLElement;
+  disassemblyCollapse: HTMLElement;
+
+  constructor(resizer: Resizer) {
+    const snapper = this;
+    snapper.resizer = resizer;
+    snapper.sourceExpand = document.getElementById(SOURCE_EXPAND_ID);
+    snapper.sourceCollapse = document.getElementById(SOURCE_COLLAPSE_ID);
+    snapper.disassemblyExpand = document.getElementById(DISASSEMBLY_EXPAND_ID);
+    snapper.disassemblyCollapse = document.getElementById(DISASSEMBLY_COLLAPSE_ID);
+
+    document.getElementById("source-collapse").addEventListener("click", function () {
+      resizer.snapper.toggleSourceExpanded();
+    });
+    document.getElementById("disassembly-collapse").addEventListener("click", function () {
+      resizer.snapper.toggleDisassemblyExpanded();
+    });
+  }
+
+  getLastExpandedState(type, default_state) {
+    var state = window.sessionStorage.getItem("expandedState-" + type);
+    if (state === null) return default_state;
+    return state === 'true';
+  }
+
+  setLastExpandedState(type, state) {
+    window.sessionStorage.setItem("expandedState-" + type, state);
+  }
+
+  toggleSourceExpanded(): void {
+    this.setSourceExpanded(!this.sourceExpand.classList.contains("invisible"));
+  }
+
+  sourceExpandUpdate(newState: boolean) {
+    this.setLastExpandedState("source", newState);
+    this.sourceExpand.classList.toggle("invisible", newState);
+    this.sourceCollapse.classList.toggle("invisible", !newState);
+  }
+
+  setSourceExpanded(newState) {
+    if (this.sourceExpand.classList.contains("invisible") === newState) return;
+    this.sourceExpandUpdate(newState);
+    let resizer = this.resizer;
+    if (newState) {
+      resizer.sep_left = resizer.sep_left_snap;
+      resizer.sep_left_snap = 0;
+    } else {
+      resizer.sep_left_snap = resizer.sep_left;
+      resizer.sep_left = 0;
+    }
+    resizer.updatePanes();
+  }
+
+  toggleDisassemblyExpanded() {
+    this.setDisassemblyExpanded(!this.disassemblyExpand.classList.contains("invisible"));
+  }
+
+  disassemblyExpandUpdate(newState) {
+    this.setLastExpandedState("disassembly", newState);
+    this.disassemblyExpand.classList.toggle("invisible", newState);
+    this.disassemblyCollapse.classList.toggle("invisible", !newState);
+  }
+
+  setDisassemblyExpanded(newState) {
+    if (this.disassemblyExpand.classList.contains("invisible") === newState) return;
+    this.disassemblyExpandUpdate(newState);
+    let resizer = this.resizer;
+    if (newState) {
+      resizer.sep_right = resizer.sep_right_snap;
+      resizer.sep_right_snap = resizer.client_width;
+    } else {
+      resizer.sep_right_snap = resizer.sep_right;
+      resizer.sep_right = resizer.client_width;
+    }
+    resizer.updatePanes();
+  }
+
+  panesUpated() {
+    this.sourceExpandUpdate(this.resizer.sep_left > this.resizer.dead_width);
+    this.disassemblyExpandUpdate(this.resizer.sep_right <
+      (this.resizer.client_width - this.resizer.dead_width));
+  }
+}
+
+class Resizer {
+  snapper: Snapper;
+  dead_width: number;
+  client_width: number;
+  left: HTMLElement;
+  right: HTMLElement;
+  middle: HTMLElement;
+  sep_left: number;
+  sep_right: number;
+  sep_left_snap: number;
+  sep_right_snap: number;
+  sep_width_offset: number;
+  panes_updated_callback: () => void;
+  resizer_right: d3.Selection<HTMLDivElement, any, any, any>;
+  resizer_left: d3.Selection<HTMLDivElement, any, any, any>;
+
+  constructor(panes_updated_callback: () => void, dead_width: number) {
+    let resizer = this;
+    resizer.snapper = new Snapper(resizer)
+    resizer.panes_updated_callback = panes_updated_callback;
+    resizer.dead_width = dead_width
+    resizer.client_width = document.body.getBoundingClientRect().width;
+    resizer.left = document.getElementById(SOURCE_PANE_ID);
+    resizer.middle = document.getElementById(INTERMEDIATE_PANE_ID);
+    resizer.right = document.getElementById(GENERATED_PANE_ID);
+    resizer.resizer_left = d3.select('.resizer-left');
+    resizer.resizer_right = d3.select('.resizer-right');
+    resizer.sep_left = resizer.client_width / 3;
+    resizer.sep_right = resizer.client_width / 3 * 2;
+    resizer.sep_left_snap = 0;
+    resizer.sep_right_snap = 0;
+    // Offset to prevent resizers from sliding slightly over one another.
+    resizer.sep_width_offset = 7;
+
+    let dragResizeLeft = d3.drag()
+      .on('drag', function () {
+        let x = d3.mouse(this.parentElement)[0];
+        resizer.sep_left = Math.min(Math.max(0, x), resizer.sep_right - resizer.sep_width_offset);
+        resizer.updatePanes();
+      })
+      .on('start', function () {
+        resizer.resizer_left.classed("dragged", true);
+        let x = d3.mouse(this.parentElement)[0];
+        if (x > dead_width) {
+          resizer.sep_left_snap = resizer.sep_left;
+        }
+      })
+      .on('end', function () {
+        resizer.resizer_left.classed("dragged", false);
+      });
+    resizer.resizer_left.call(dragResizeLeft);
+
+    let dragResizeRight = d3.drag()
+      .on('drag', function () {
+        let x = d3.mouse(this.parentElement)[0];
+        resizer.sep_right = Math.max(resizer.sep_left + resizer.sep_width_offset, Math.min(x, resizer.client_width));
+        resizer.updatePanes();
+      })
+      .on('start', function () {
+        resizer.resizer_right.classed("dragged", true);
+        let x = d3.mouse(this.parentElement)[0];
+        if (x < (resizer.client_width - dead_width)) {
+          resizer.sep_right_snap = resizer.sep_right;
+        }
+      })
+      .on('end', function () {
+        resizer.resizer_right.classed("dragged", false);
+      });;
+    resizer.resizer_right.call(dragResizeRight);
+    window.onresize = function () {
+      resizer.updateWidths();
+      resizer.updatePanes();
+    };
+  }
+
+  updatePanes() {
+    let left_snapped = this.sep_left === 0;
+    let right_snapped = this.sep_right >= this.client_width - 1;
+    this.resizer_left.classed("snapped", left_snapped);
+    this.resizer_right.classed("snapped", right_snapped);
+    this.left.style.width = this.sep_left + 'px';
+    this.middle.style.width = (this.sep_right - this.sep_left) + 'px';
+    this.right.style.width = (this.client_width - this.sep_right) + 'px';
+    this.resizer_left.style('left', this.sep_left + 'px');
+    this.resizer_right.style('right', (this.client_width - this.sep_right - 1) + 'px');
+
+    this.snapper.panesUpated();
+    this.panes_updated_callback();
+  }
+
+  updateWidths() {
+    this.client_width = document.body.getBoundingClientRect().width;
+    this.sep_right = Math.min(this.sep_right, this.client_width);
+    this.sep_left = Math.min(Math.max(0, this.sep_left), this.sep_right);
+  }
+}
+
+window.onload = function () {
+  "use strict";
+  var svg = null;
+  var multiview = null;
+  var disassemblyView = null;
+  var sourceViews = [];
+  var selectionBroker = null;
+  var sourceResolver = null;
+  let resizer = new Resizer(panesUpdatedCallback, 100);
+
+  function panesUpdatedCallback() {
+    if (multiview) multiview.onresize();
+  }
+
+  function loadFile(txtRes) {
+    // If the JSON isn't properly terminated, assume compiler crashed and
+    // add best-guess empty termination
+    if (txtRes[txtRes.length - 2] == ',') {
+      txtRes += '{"name":"disassembly","type":"disassembly","data":""}]}';
+    }
+    try {
+      sourceViews.forEach((sv) => sv.hide());
+      if (multiview) multiview.hide();
+      multiview = null;
+      if (disassemblyView) disassemblyView.hide();
+      sourceViews = [];
+      sourceResolver = new SourceResolver();
+      selectionBroker = new SelectionBroker(sourceResolver);
+
+      const jsonObj = JSON.parse(txtRes);
+
+      let fnc = jsonObj.function;
+      // Backwards compatibility.
+      if (typeof fnc == 'string') {
+        fnc = {
+          functionName: fnc,
+          sourceId: -1,
+          startPosition: jsonObj.sourcePosition,
+          endPosition: jsonObj.sourcePosition + jsonObj.source.length,
+          sourceText: jsonObj.source,
+          backwardsCompatibility: true
+        };
+      }
+
+      sourceResolver.setInlinings(jsonObj.inlinings);
+      sourceResolver.setSourceLineToBytecodePosition(jsonObj.sourceLineToBytecodePosition);
+      sourceResolver.setSources(jsonObj.sources, fnc)
+      sourceResolver.setNodePositionMap(jsonObj.nodePositions);
+      sourceResolver.parsePhases(jsonObj.phases);
+
+      let sourceView = new CodeView(SOURCE_PANE_ID, selectionBroker, sourceResolver, fnc, CodeMode.MAIN_SOURCE);
+      sourceView.show(null, null);
+      sourceViews.push(sourceView);
+
+      sourceResolver.forEachSource((source) => {
+        let sourceView = new CodeView(SOURCE_PANE_ID, selectionBroker, sourceResolver, source, CodeMode.INLINED_SOURCE);
+        sourceView.show(null, null);
+        sourceViews.push(sourceView);
+      });
+
+      disassemblyView = new DisassemblyView(GENERATED_PANE_ID, selectionBroker);
+      disassemblyView.initializeCode(fnc.sourceText);
+      if (sourceResolver.disassemblyPhase) {
+        disassemblyView.initializePerfProfile(jsonObj.eventCounts);
+        disassemblyView.show(sourceResolver.disassemblyPhase.data, null);
+      }
+
+      multiview = new GraphMultiView(INTERMEDIATE_PANE_ID, selectionBroker, sourceResolver);
+      multiview.show(jsonObj);
+    } catch (err) {
+      if (window.confirm("Error: Exception during load of TurboFan JSON file:\n" +
+        "error: " + err.message + "\nDo you want to clear session storage?")) {
+        window.sessionStorage.clear();
+      }
+      return;
+    }
+  }
+
+  function initializeUploadHandlers() {
+    // The <input> form #upload-helper with type file can't be a picture.
+    // We hence keep it hidden, and forward the click from the picture
+    // button #upload.
+    d3.select("#upload").on("click",
+      () => document.getElementById("upload-helper").click());
+    d3.select("#upload-helper").on("change", function (this: HTMLInputElement) {
+      var uploadFile = this.files && this.files[0];
+      var filereader = new FileReader();
+      filereader.onload = function (e) {
+        var txtRes = e.target.result;
+        loadFile(txtRes);
+      };
+      if (uploadFile)
+        filereader.readAsText(uploadFile);
+    });
+  }
+
+  initializeUploadHandlers();
+
+
+  resizer.snapper.setSourceExpanded(resizer.snapper.getLastExpandedState("source", true));
+  resizer.snapper.setDisassemblyExpanded(resizer.snapper.getLastExpandedState("disassembly", false));
+
+  resizer.updatePanes();
+
+};
diff --git a/deps/v8/tools/turbolizer/src/util.ts b/deps/v8/tools/turbolizer/src/util.ts
new file mode 100644
index 00000000000000..1b390d371c13a6
--- /dev/null
+++ b/deps/v8/tools/turbolizer/src/util.ts
@@ -0,0 +1,110 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+"use strict";
+
+function computeScrollTop(container, element) {
+  const height = container.offsetHeight;
+  const margin = Math.floor(height / 4);
+  const pos = element.offsetTop;
+  const currentScrollTop = container.scrollTop;
+  if (pos < currentScrollTop + margin) {
+    return Math.max(0, pos - margin);
+  } else if (pos > (currentScrollTop + 3 * margin)) {
+    return Math.max(0, pos - 3 * margin);
+  }
+  return pos;
+}
+
+class ViewElements {
+  container: HTMLElement;
+  scrollTop: number;
+
+  constructor(container: HTMLElement) {
+    this.container = container;
+    this.scrollTop = undefined;
+  }
+
+  consider(element, doConsider) {
+    if (!doConsider) return;
+    const newScrollTop = computeScrollTop(this.container, element);
+    if (isNaN(newScrollTop)) {
+      console.log("NOO")
+    }
+    if (this.scrollTop === undefined) {
+      this.scrollTop = newScrollTop;
+    } else {
+      this.scrollTop = Math.min(this.scrollTop, newScrollTop);
+    }
+  }
+
+  apply(doApply) {
+    if (!doApply || this.scrollTop === undefined) return;
+    this.container.scrollTop = this.scrollTop;
+  }
+}
+
+
+function lowerBound(a, value, compare, lookup) {
+  let first = 0;
+  let count = a.length;
+  while (count > 0) {
+    let step = Math.floor(count / 2);
+    let middle = first + step;
+    let middle_value = (lookup === undefined) ? a[middle] : lookup(a, middle);
+    let result = (compare === undefined) ? (middle_value < value) : compare(middle_value, value);
+    if (result) {
+      first = middle + 1;
+      count -= step + 1;
+    } else {
+      count = step;
+    }
+  }
+  return first;
+}
+
+
+function upperBound(a, value, compare, lookup) {
+  let first = 0;
+  let count = a.length;
+  while (count > 0) {
+    let step = Math.floor(count / 2);
+    let middle = first + step;
+    let middle_value = (lookup === undefined) ? a[middle] : lookup(a, middle);
+    let result = (compare === undefined) ? (value < middle_value) : compare(value, middle_value);
+    if (!result) {
+      first = middle + 1;
+      count -= step + 1;
+    } else {
+      count = step;
+    }
+  }
+  return first;
+}
+
+
+function sortUnique<T>(arr: Array<T>, f: (a: T, b: T) => number, equal: (a: T, b: T) => boolean) {
+  if (arr.length == 0) return arr;
+  arr = arr.sort(f);
+  let ret = [arr[0]];
+  for (var i = 1; i < arr.length; i++) {
+    if (!equal(arr[i - 1], arr[i])) {
+      ret.push(arr[i]);
+    }
+  }
+  return ret;
+}
+
+// Partial application without binding the receiver
+function partial(f, ...arguments1) {
+  return function (...arguments2) {
+    var arguments2 = Array.from(arguments);
+    f.apply(this, [...arguments1, ...arguments2]);
+  }
+}
+
+function isIterable(obj: any): obj is Iterable<any> {
+  return obj != null && obj != undefined
+    && typeof obj != 'string' && typeof obj[Symbol.iterator] === 'function';
+}
diff --git a/deps/v8/tools/turbolizer/src/view.ts b/deps/v8/tools/turbolizer/src/view.ts
new file mode 100644
index 00000000000000..6da1ce17ae02c2
--- /dev/null
+++ b/deps/v8/tools/turbolizer/src/view.ts
@@ -0,0 +1,38 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+"use strict";
+
+abstract class View {
+  container: HTMLElement;
+  divNode: HTMLElement;
+  abstract initializeContent(data: any, rememberedSelection: Selection): void;
+  abstract createViewElement(): HTMLElement;
+  abstract deleteContent(): void;
+  abstract detachSelection(): Set<string>;
+
+  constructor(id) {
+    this.container = document.getElementById(id);
+    this.divNode = this.createViewElement();
+  }
+
+  isScrollable(): boolean {
+    return false;
+  }
+
+  show(data, rememberedSelection): void {
+    this.container.appendChild(this.divNode);
+    this.initializeContent(data, rememberedSelection);
+  }
+
+  hide(): void {
+    this.deleteContent();
+    this.container.removeChild(this.divNode);
+  }
+}
+
+interface PhaseView {
+  onresize();
+  searchInputAction(searchInput: HTMLInputElement, e: Event);
+}
diff --git a/deps/v8/tools/turbolizer/text-view.js b/deps/v8/tools/turbolizer/text-view.js
deleted file mode 100644
index 6822500dde6daf..00000000000000
--- a/deps/v8/tools/turbolizer/text-view.js
+++ /dev/null
@@ -1,296 +0,0 @@
-// Copyright 2015 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-"use strict";
-
-class TextView extends View {
-  constructor(id, broker, patterns, allowSpanSelection) {
-    super(id, broker);
-    let view = this;
-    view.hide();
-    view.textListNode = view.divNode.getElementsByTagName('ul')[0];
-    view.fillerSvgElement = view.divElement.append("svg").attr('version','1.1').attr("width", "0");
-    view.patterns = patterns;
-    view.allowSpanSelection = allowSpanSelection;
-    view.nodeToLineMap = [];
-    var selectionHandler = {
-      clear: function() {
-        broker.clear(selectionHandler);
-      },
-      select: function(items, selected) {
-        for (let i of items) {
-          if (selected) {
-            i.classList.add("selected");
-          } else {
-            i.classList.remove("selected");
-          }
-        }
-        broker.clear(selectionHandler);
-        broker.select(selectionHandler, view.getLocations(items), selected);
-      },
-      selectionDifference: function(span1, inclusive1, span2, inclusive2) {
-        return null;
-      },
-      brokeredSelect: function(locations, selected) {
-        view.selectLocations(locations, selected, true);
-      },
-      brokeredClear: function() {
-        view.selection.clear();
-      }
-    };
-    view.selection = new Selection(selectionHandler);
-    broker.addSelectionHandler(selectionHandler);
-  }
-
-  setPatterns(patterns) {
-    let view = this;
-    view.patterns = patterns;
-  }
-
-  clearText() {
-    let view = this;
-    while (view.textListNode.firstChild) {
-      view.textListNode.removeChild(view.textListNode.firstChild);
-    }
-  }
-
-  sameLocation(l1, l2) {
-    let view = this;
-    if (l1.block_id != undefined && l2.block_id != undefined &&
-      l1.block_id == l2.block_id && l1.node_id === undefined) {
-      return true;
-    }
-
-    if (l1.address != undefined && l1.address == l2.address) {
-      return true;
-    }
-
-    let node1 = l1.node_id;
-    let node2 = l2.node_id;
-
-    if (node1 === undefined || node2 == undefined) {
-      if (l1.pos_start === undefined || l2.pos_start == undefined) {
-        return false;
-      }
-      if (l1.pos_start == -1 || l2.pos_start == -1) {
-        return false;
-      }
-      if (l1.pos_start < l2.pos_start) {
-        return l1.pos_end > l2.pos_start;
-      } {
-        return l1.pos_start < l2.pos_end;
-      }
-    }
-
-    return l1.node_id == l2.node_id;
-  }
-
-  selectLocations(locations, selected, makeVisible) {
-    let view = this;
-    let s = new Set();
-    for (let l of locations) {
-      for (let i = 0; i < view.textListNode.children.length; ++i) {
-        let child = view.textListNode.children[i];
-        if (child.location != undefined && view.sameLocation(l, child.location)) {
-          s.add(child);
-        }
-      }
-    }
-    view.selectCommon(s, selected, makeVisible);
-  }
-
-  getLocations(items) {
-    let result = [];
-    let lastObject = null;
-    for (let i of items) {
-      if (i.location) {
-        result.push(i.location);
-      }
-    }
-    return result;
-  }
-
-  createFragment(text, style) {
-    let view = this;
-    let span = document.createElement("SPAN");
-    span.onmousedown = function(e) {
-      view.mouseDownSpan(span, e);
-    }
-    if (style != undefined) {
-      span.classList.add(style);
-    }
-    span.innerHTML = text;
-    return span;
-  }
-
-  appendFragment(li, fragment) {
-    li.appendChild(fragment);
-  }
-
-  processLine(line) {
-    let view = this;
-    let result = [];
-    let patternSet = 0;
-    while (true) {
-      let beforeLine = line;
-      for (let pattern of view.patterns[patternSet]) {
-        let matches = line.match(pattern[0]);
-        if (matches != null) {
-          if (matches[0] != '') {
-            let style = pattern[1] != null ? pattern[1] : {};
-            let text = matches[0];
-            if (text != '') {
-              let fragment = view.createFragment(matches[0], style.css);
-              if (style.link) {
-                fragment.classList.add('linkable-text');
-                fragment.link = style.link;
-              }
-              result.push(fragment);
-              if (style.location != undefined) {
-                let location = style.location(text);
-                if (location != undefined) {
-                  fragment.location = location;
-                }
-              }
-            }
-            line = line.substr(matches[0].length);
-          }
-          let nextPatternSet = patternSet;
-          if (pattern.length > 2) {
-            nextPatternSet = pattern[2];
-          }
-          if (line == "") {
-            if (nextPatternSet != -1) {
-              throw("illegal parsing state in text-view in patternSet" + patternSet);
-            }
-            return result;
-          }
-          patternSet = nextPatternSet;
-          break;
-        }
-      }
-      if (beforeLine == line) {
-        throw("input not consumed in text-view in patternSet" + patternSet);
-      }
-    }
-  }
-
-  select(s, selected, makeVisible) {
-    let view = this;
-    view.selection.clear();
-    view.selectCommon(s, selected, makeVisible);
-  }
-
-  selectCommon(s, selected, makeVisible) {
-    let view = this;
-    let firstSelect = makeVisible && view.selection.isEmpty();
-    if ((typeof s) === 'function') {
-      for (let i = 0; i < view.textListNode.children.length; ++i) {
-        let child = view.textListNode.children[i];
-        if (child.location && s(child.location)) {
-          if (firstSelect) {
-            makeContainerPosVisible(view.parentNode, child.offsetTop);
-            firstSelect = false;
-          }
-          view.selection.select(child, selected);
-        }
-      }
-    } else if (typeof s[Symbol.iterator] === 'function') {
-      if (firstSelect) {
-        for (let i of s) {
-          makeContainerPosVisible(view.parentNode, i.offsetTop);
-          break;
-        }
-      }
-      view.selection.select(s, selected);
-    } else {
-      if (firstSelect) {
-        makeContainerPosVisible(view.parentNode, s.offsetTop);
-      }
-      view.selection.select(s, selected);
-    }
-  }
-
-  mouseDownLine(li, e) {
-    let view = this;
-    e.stopPropagation();
-    if (!e.shiftKey) {
-      view.selection.clear();
-    }
-    if (li.location != undefined) {
-      view.selectLocations([li.location], true, false);
-    }
-  }
-
-  mouseDownSpan(span, e) {
-    let view = this;
-    if (view.allowSpanSelection) {
-      e.stopPropagation();
-      if (!e.shiftKey) {
-        view.selection.clear();
-      }
-      select(li, true);
-    } else if (span.link) {
-      span.link(span.textContent);
-      e.stopPropagation();
-    }
-  }
-
-  processText(text) {
-    let view = this;
-    let textLines = text.split(/[\n]/);
-    let lineNo = 0;
-    for (let line of textLines) {
-      let li = document.createElement("LI");
-      li.onmousedown = function(e) {
-        view.mouseDownLine(li, e);
-      }
-      li.className = "nolinenums";
-      li.lineNo = lineNo++;
-      let fragments = view.processLine(line);
-      for (let fragment of fragments) {
-        view.appendFragment(li, fragment);
-      }
-      let lineLocation = view.lineLocation(li);
-      if (lineLocation != undefined) {
-        li.location = lineLocation;
-      }
-      view.textListNode.appendChild(li);
-    }
-  }
-
-  initializeContent(data, rememberedSelection) {
-    let view = this;
-    view.selection.clear();
-    view.clearText();
-    view.processText(data);
-    var fillerSize = document.documentElement.clientHeight -
-        view.textListNode.clientHeight;
-    if (fillerSize < 0) {
-      fillerSize = 0;
-    }
-    view.fillerSvgElement.attr("height", fillerSize);
-  }
-
-  deleteContent() {
-  }
-
-  isScrollable() {
-    return true;
-  }
-
-  detachSelection() {
-    return null;
-  }
-
-  lineLocation(li) {
-    let view = this;
-    for (let i = 0; i < li.children.length; ++i) {
-      let fragment = li.children[i];
-      if (fragment.location != undefined && !view.allowSpanSelection) {
-        return fragment.location;
-      }
-    }
-  }
-}
diff --git a/deps/v8/tools/turbolizer/tsconfig.json b/deps/v8/tools/turbolizer/tsconfig.json
new file mode 100644
index 00000000000000..0547457e5f06f7
--- /dev/null
+++ b/deps/v8/tools/turbolizer/tsconfig.json
@@ -0,0 +1,29 @@
+{
+    "compilerOptions": {
+        "outFile": "build/turbolizer.js",
+        "allowJs": true,
+        "target": "es2017",
+        "sourceMap": true
+    },
+    "files": [
+        "src/monkey.ts",
+        "src/util.ts",
+        "src/lang-disassembly.ts",
+        "src/node.ts",
+        "src/edge.ts",
+        "src/source-resolver.ts",
+        "src/selection.ts",
+        "src/selection-broker.ts",
+        "src/selection-handler.ts",
+        "src/constants.ts",
+        "src/view.ts",
+        "src/text-view.ts",
+        "src/code-view.ts",
+        "src/graph-layout.ts",
+        "src/graph-view.ts",
+        "src/schedule-view.ts",
+        "src/disassembly-view.ts",
+        "src/graphmultiview.ts",
+        "src/turbo-visualizer.ts"
+    ]
+}
\ No newline at end of file
diff --git a/deps/v8/tools/turbolizer/tsfmt.json b/deps/v8/tools/turbolizer/tsfmt.json
new file mode 100644
index 00000000000000..2ff95b819d4cc4
--- /dev/null
+++ b/deps/v8/tools/turbolizer/tsfmt.json
@@ -0,0 +1,16 @@
+{
+  "tabSize": 2,
+  "indentSize": 2,
+  "convertTabsToSpaces": true,
+  "insertSpaceAfterCommaDelimiter": true,
+  "insertSpaceAfterSemicolonInForStatements": true,
+  "insertSpaceBeforeAndAfterBinaryOperators": true,
+  "insertSpaceAfterKeywordsInControlFlowStatements": true,
+  "insertSpaceAfterFunctionKeywordForAnonymousFunctions": true,
+  "insertSpaceAfterOpeningAndBeforeClosingNonemptyParenthesis": false,
+  "insertSpaceAfterOpeningAndBeforeClosingNonemptyBrackets": false,
+  "insertSpaceAfterOpeningAndBeforeClosingTemplateStringBraces": false,
+  "insertSpaceBeforeFunctionParenthesis": false,
+  "placeOpenBraceOnNewLineForFunctions": false,
+  "placeOpenBraceOnNewLineForControlBlocks": false
+}
\ No newline at end of file
diff --git a/deps/v8/tools/turbolizer/turbo-visualizer.css b/deps/v8/tools/turbolizer/turbo-visualizer.css
index 95fcba7928905e..fcc68ee371f525 100644
--- a/deps/v8/tools/turbolizer/turbo-visualizer.css
+++ b/deps/v8/tools/turbolizer/turbo-visualizer.css
@@ -45,29 +45,87 @@
     display: none;
 }
 
-
 .selected {
     background-color: #FFFF33;
 }
 
+.selected.block,
+.selected.block-id,
+.selected.schedule-block {
+    background-color: #AAFFAA;
+}
+
+ol.linenums {
+  -webkit-padding-start: 8px;
+}
+
+.line-number {
+    display:inline-block;
+    min-width: 3ex;
+    text-align: right;
+    color: #444444;
+    margin-right: 0.5ex;
+    padding-right: 0.5ex;
+    background: #EEEEEE;
+    /* font-size: 80%; */
+    user-select: none;
+    height: 120%;
+}
+
+.line-number:hover {
+    background-color: #CCCCCC;
+}
+
+.prettyprint ol.linenums > li.selected {
+    background-color: #FFFF33 !important;
+}
+
+li.selected .line-number {
+    background-color: #FFFF33;
+}
+
 .prettyprint ol.linenums > li {
     list-style-type: decimal;
-    !important
+    display: block;
+}
+
+.source-container {
+    border-bottom: 2px solid #AAAAAA;
+}
+
+.code-header {
+    background-color: #CCCCCC;
+    padding-left: 1em;
+    padding-right: 1em;
+    padding-top: 1ex;
+    padding-bottom: 1ex;
+    font-family: monospace;
+    user-select: none;
+}
+
+.main-source .code-header {
+    border-top: 2px solid #AAAAAA;
+    font-weight: bold;
+}
+
+.code-header .code-file-function {
+    font-family: monospace;
+    float: left;
+    user-select: text;
 }
 
+.code-header .code-mode {
+    float: right;
+    font-family: sans-serif;
+    font-size:  small;
+}
 
-body {
+html, body {
     margin: 0;
     padding: 0;
-    height: 100vh;
-    width: 100vw;
-    overflow:hidden;
-    -webkit-touch-callout: none;
-    -webkit-user-select: none;
-    -khtml-user-select: none;
-    -moz-user-select: none;
-    -ms-user-select: none;
-    user-select: none;
+    /*height: 99vh;
+    width: 99vw;*/
+    overflow: hidden;
 }
 
 p {
@@ -95,7 +153,7 @@ g.unsorted rect {
 }
 
 div.scrollable {
-    overflow-y: _croll; overflow-x: hidden;
+    overflow-y: auto; overflow-x: hidden;
 }
 
 g.turbonode[relToHover="input"] rect {
@@ -243,10 +301,13 @@ span.linkable-text:hover {
 
 #left {
     float: left;
+    user-select: none;
 }
 
 #middle {
-    float:left; background-color: #F8F8F8;
+    float:left;
+    background-color: #F8F8F8;
+    user-select: none;
 }
 
 #right {
@@ -267,6 +328,11 @@ span.linkable-text:hover {
     left: 0;
 }
 
+#graph {
+    width: 100%;
+    height: 100%;
+}
+
 #graph-toolbox-anchor {
     height: 0px;
 }
@@ -308,7 +374,7 @@ span.linkable-text:hover {
     padding: 0.5em;
 }
 
-#hidden-file-upload {
+#upload-helper {
     display: none;
 }
 
@@ -363,4 +429,176 @@ text {
 
 .resizer-right.dragged {
     background: orange;
+}
+
+.source-position {
+  /* border-left: 1px solid #FF3333; */
+  width: 0;
+  display: inline-block;
+}
+
+.source-position .inlining-marker {
+    content: "";
+    position: relative;
+    display: inline-block;
+    top: -0.5ex;
+    margin-left: -4px;
+    margin-right: -4px;
+    border-width: 5px;
+    border-style: solid;
+    border-color: #555 transparent transparent transparent;
+}
+
+.source-position .marker {
+    content: "";
+    display: inline-block;
+    position: relative;
+    bottom: -1ex;
+    width: 0px;
+    margin-left: -4px;
+    margin-right: -4px;
+    border-width: 5px;
+    border-style: solid;
+    border-color: transparent transparent #555 transparent;
+}
+
+.source-position.selected .marker {
+    border-color: transparent transparent #F00 transparent;
+}
+
+.source-position .inlining-marker:hover {
+    border-color: transparent transparent #AA5 transparent;
+}
+
+.source-position .inlining-marker[data-descr]:hover::after {
+    content: attr(data-descr);
+    position: absolute;
+    font-size: 10px;
+    z-index: 1;
+    background-color: #555;
+    color: #fff;
+    text-align: center;
+    border-radius: 6px;
+    padding: 6px;
+    top: 6px;
+    left: 50%;
+    margin-left: -80px;
+}
+
+#schedule {
+    font-family: monospace;
+    margin-top: 50px;
+}
+
+.schedule-block {
+    margin: 5px;
+    background-color: white;
+    padding-left: 5px;
+}
+
+.schedule-block .block-id {
+    display: inline-block;
+    font-size:large;
+    text-decoration: underline;
+    padding-left: 1ex;
+}
+
+.schedule-block .block-id:hover {
+    font-weight: bold;
+}
+
+.schedule-block > .block-id::before {
+    content: "Block B";
+}
+
+.schedule-block .block-list {
+    display: inline-block;
+}
+
+.schedule-block .block-list * {
+    display: inline-block;
+}
+
+.schedule-block .block-list .block-id {
+    padding-left: 1ex;
+}
+
+.schedule-block .block-list .block-id:before {
+    content: "B";
+}
+
+.schedule-block .predecessor-list::before {
+    display: inline-block;
+    content: "  \2B05  ";
+    padding-left: 1ex;
+    padding-right: 1ex;
+}
+
+.schedule-block .successor-list::before {
+    display: inline-block;
+    content: "  \2B95  ";
+    padding-left: 1ex;
+    padding-right: 1ex;
+}
+
+.schedule-block .nodes .node * {
+    display:inline-block;
+}
+
+.schedule-block .nodes .node .node-id {
+    padding-right: 1ex;
+    min-width: 5ex;
+    text-align: right;
+}
+
+.schedule-block .nodes .node .node-id:after {
+    content: ":";
+}
+
+.schedule-block .nodes .node .node-label {
+    user-select: text;
+}
+
+.schedule-block .nodes .node .parameter-list:before {
+    content: "(";
+}
+
+.schedule-block .nodes .node .parameter-list:after {
+    content: ")";
+}
+
+.schedule-block .instr-marker {
+    padding-right: .5ex;
+    padding-left: .5ex;
+    min-width: 1ex;
+    background: #EEEEEE;
+    /* display: none; */
+}
+
+.schedule-block > .instr-marker {
+    display: inline;
+}
+
+.clickable:hover {
+    text-decoration: underline;
+}
+
+.clickable:hover {
+    font-weight: bold;
+}
+
+.comma-sep-list > * {
+    padding-right: 1ex;
+}
+
+.comma-sep-list > *:after {
+    content: ",";
+}
+
+.comma-sep-list > *:last-child:after {
+    content: "";
+}
+
+.comma-sep-list > *:last-child {
+    padding-right: 0ex;
 }
\ No newline at end of file
diff --git a/deps/v8/tools/turbolizer/turbo-visualizer.js b/deps/v8/tools/turbolizer/turbo-visualizer.js
deleted file mode 100644
index 0c720b22a44ec2..00000000000000
--- a/deps/v8/tools/turbolizer/turbo-visualizer.js
+++ /dev/null
@@ -1,320 +0,0 @@
-// Copyright 2017 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-class Snapper {
-
-  constructor(resizer) {
-    let snapper = this;
-    snapper.resizer = resizer;
-    snapper.sourceExpand = d3.select("#" + SOURCE_EXPAND_ID);
-    snapper.sourceCollapse = d3.select("#" + SOURCE_COLLAPSE_ID);
-    snapper.disassemblyExpand = d3.select("#" + DISASSEMBLY_EXPAND_ID);
-    snapper.disassemblyCollapse = d3.select("#" + DISASSEMBLY_COLLAPSE_ID);
-
-    d3.select("#source-collapse").on("click", function(){
-      resizer.snapper.toggleSourceExpanded();
-    });
-    d3.select("#disassembly-collapse").on("click", function(){
-      resizer.snapper.toggleDisassemblyExpanded();
-    });
-  }
-
-  getLastExpandedState(type, default_state) {
-    var state = window.sessionStorage.getItem("expandedState-"+type);
-    if (state === null) return default_state;
-    return state === 'true';
-  }
-
-  setLastExpandedState(type, state) {
-    window.sessionStorage.setItem("expandedState-"+type, state);
-  }
-
-  toggleSourceExpanded() {
-    this.setSourceExpanded(!this.sourceExpand.classed("invisible"));
-  }
-
-  sourceExpandUpdate(newState) {
-    this.setLastExpandedState("source", newState);
-    this.sourceExpand.classed("invisible", newState);
-    this.sourceCollapse.classed("invisible", !newState);
-  }
-
-  setSourceExpanded(newState) {
-    if (this.sourceExpand.classed("invisible") === newState) return;
-    this.sourceExpandUpdate(newState);
-    let resizer = this.resizer;
-    if (newState) {
-      resizer.sep_left = resizer.sep_left_snap;
-      resizer.sep_left_snap = 0;
-    } else {
-      resizer.sep_left_snap = resizer.sep_left;
-      resizer.sep_left = 0;
-    }
-    resizer.updatePanes();
-  }
-
-  toggleDisassemblyExpanded() {
-    this.setDisassemblyExpanded(!this.disassemblyExpand.classed("invisible"));
-  }
-
-  disassemblyExpandUpdate(newState) {
-    this.setLastExpandedState("disassembly", newState);
-    this.disassemblyExpand.classed("invisible", newState);
-    this.disassemblyCollapse.classed("invisible", !newState);
-  }
-
-  setDisassemblyExpanded(newState) {
-    if (this.disassemblyExpand.classed("invisible") === newState) return;
-    this.disassemblyExpandUpdate(newState);
-    let resizer = this.resizer;
-    if (newState) {
-      resizer.sep_right = resizer.sep_right_snap;
-      resizer.sep_right_snap = resizer.client_width;
-    } else {
-      resizer.sep_right_snap = resizer.sep_right;
-      resizer.sep_right = resizer.client_width;
-    }
-    resizer.updatePanes();
-  }
-
-  panesUpated() {
-    this.sourceExpandUpdate(this.resizer.sep_left > this.resizer.dead_width);
-    this.disassemblyExpandUpdate(this.resizer.sep_right <
-      (this.resizer.client_width - this.resizer.dead_width));
-  }
-}
-
-class Resizer {
-  constructor(panes_updated_callback, dead_width) {
-    let resizer = this;
-    resizer.snapper = new Snapper(resizer)
-    resizer.panes_updated_callback = panes_updated_callback;
-    resizer.dead_width = dead_width
-    resizer.client_width = d3.select("body").node().getBoundingClientRect().width;
-    resizer.left = d3.select("#" + SOURCE_PANE_ID);
-    resizer.middle = d3.select("#" + INTERMEDIATE_PANE_ID);
-    resizer.right = d3.select("#" + GENERATED_PANE_ID);
-    resizer.resizer_left = d3.select('.resizer-left');
-    resizer.resizer_right = d3.select('.resizer-right');
-    resizer.sep_left = resizer.client_width/3;
-    resizer.sep_right = resizer.client_width/3*2;
-    resizer.sep_left_snap = 0;
-    resizer.sep_right_snap = 0;
-    // Offset to prevent resizers from sliding slightly over one another.
-    resizer.sep_width_offset = 7;
-
-    let dragResizeLeft = d3.behavior.drag()
-      .on('drag', function() {
-        let x = d3.mouse(this.parentElement)[0];
-        resizer.sep_left = Math.min(Math.max(0,x), resizer.sep_right-resizer.sep_width_offset);
-        resizer.updatePanes();
-      })
-      .on('dragstart', function() {
-        resizer.resizer_left.classed("dragged", true);
-        let x = d3.mouse(this.parentElement)[0];
-        if (x > dead_width) {
-          resizer.sep_left_snap = resizer.sep_left;
-        }
-      })
-      .on('dragend', function() {
-        resizer.resizer_left.classed("dragged", false);
-      });
-    resizer.resizer_left.call(dragResizeLeft);
-
-    let dragResizeRight = d3.behavior.drag()
-      .on('drag', function() {
-        let x = d3.mouse(this.parentElement)[0];
-        resizer.sep_right = Math.max(resizer.sep_left+resizer.sep_width_offset, Math.min(x, resizer.client_width));
-        resizer.updatePanes();
-      })
-      .on('dragstart', function() {
-        resizer.resizer_right.classed("dragged", true);
-        let x = d3.mouse(this.parentElement)[0];
-        if (x < (resizer.client_width-dead_width)) {
-          resizer.sep_right_snap = resizer.sep_right;
-        }
-      })
-      .on('dragend', function() {
-        resizer.resizer_right.classed("dragged", false);
-      });;
-    resizer.resizer_right.call(dragResizeRight);
-    window.onresize = function(){
-      resizer.updateWidths();
-      /*fitPanesToParents();*/
-      resizer.updatePanes();
-    };
-  }
-
-  updatePanes() {
-    let left_snapped = this.sep_left === 0;
-    let right_snapped = this.sep_right >= this.client_width - 1;
-    this.resizer_left.classed("snapped", left_snapped);
-    this.resizer_right.classed("snapped", right_snapped);
-    this.left.style('width', this.sep_left + 'px');
-    this.middle.style('width', (this.sep_right-this.sep_left) + 'px');
-    this.right.style('width', (this.client_width - this.sep_right) + 'px');
-    this.resizer_left.style('left', this.sep_left + 'px');
-    this.resizer_right.style('right', (this.client_width - this.sep_right - 1) + 'px');
-
-    this.snapper.panesUpated();
-    this.panes_updated_callback();
-  }
-
-  updateWidths() {
-    this.client_width = d3.select("body").node().getBoundingClientRect().width;
-    this.sep_right = Math.min(this.sep_right, this.client_width);
-    this.sep_left = Math.min(Math.max(0, this.sep_left), this.sep_right);
-  }
-}
-
-document.onload = (function(d3){
-  "use strict";
-  var jsonObj;
-  var svg  = null;
-  var graph = null;
-  var schedule = null;
-  var empty = null;
-  var currentPhaseView = null;
-  var disassemblyView = null;
-  var sourceView = null;
-  var selectionBroker = null;
-  let resizer = new Resizer(panesUpdatedCallback, 100);
-
-  function panesUpdatedCallback() {
-    graph.fitGraphViewToWindow();
-  }
-
-  function hideCurrentPhase() {
-    var rememberedSelection = null;
-    if (currentPhaseView != null) {
-      rememberedSelection = currentPhaseView.detachSelection();
-      currentPhaseView.hide();
-      currentPhaseView = null;
-    }
-    return rememberedSelection;
-  }
-
-  function displayPhaseView(view, data) {
-    var rememberedSelection = hideCurrentPhase();
-    view.show(data, rememberedSelection);
-    d3.select("#middle").classed("scrollable", view.isScrollable());
-    currentPhaseView = view;
-  }
-
-  function displayPhase(phase) {
-    if (phase.type == 'graph') {
-      displayPhaseView(graph, phase.data);
-    } else if (phase.type == 'schedule') {
-      displayPhaseView(schedule, phase.data);
-    } else {
-      displayPhaseView(empty, null);
-    }
-  }
-
-  function fitPanesToParents() {
-    d3.select("#left").classed("scrollable", false)
-    d3.select("#right").classed("scrollable", false);
-
-    graph.fitGraphViewToWindow();
-
-    d3.select("#left").classed("scrollable", true);
-    d3.select("#right").classed("scrollable", true);
-  }
-
-  selectionBroker = new SelectionBroker();
-
-  function initializeHandlers(g) {
-    d3.select("#hidden-file-upload").on("change", function() {
-      if (window.File && window.FileReader && window.FileList) {
-        var uploadFile = this.files[0];
-        var filereader = new window.FileReader();
-        var consts = Node.consts;
-        filereader.onload = function(){
-          var txtRes = filereader.result;
-          // If the JSON isn't properly terminated, assume compiler crashed and
-          // add best-guess empty termination
-          if (txtRes[txtRes.length-2] == ',') {
-            txtRes += '{"name":"disassembly","type":"disassembly","data":""}]}';
-          }
-          try{
-            jsonObj = JSON.parse(txtRes);
-
-            hideCurrentPhase();
-
-            selectionBroker.setNodePositionMap(jsonObj.nodePositions);
-
-            sourceView.initializeCode(jsonObj.source, jsonObj.sourcePosition);
-            disassemblyView.initializeCode(jsonObj.source);
-
-            var selectMenu = document.getElementById('display-selector');
-            var disassemblyPhase = null;
-            selectMenu.innerHTML = '';
-            for (var i = 0; i < jsonObj.phases.length; ++i) {
-              var optionElement = document.createElement("option");
-              optionElement.text = jsonObj.phases[i].name;
-              if (optionElement.text == 'disassembly') {
-                disassemblyPhase = jsonObj.phases[i];
-              } else {
-                selectMenu.add(optionElement, null);
-              }
-            }
-
-            disassemblyView.initializePerfProfile(jsonObj.eventCounts);
-            disassemblyView.show(disassemblyPhase.data, null);
-
-            var initialPhaseIndex = +window.sessionStorage.getItem("lastSelectedPhase");
-            if (!(initialPhaseIndex in jsonObj.phases)) {
-              initialPhaseIndex = 0;
-            }
-
-            // We wish to show the remembered phase {lastSelectedPhase}, but
-            // this will crash if the first view we switch to is a
-            // ScheduleView. So we first switch to the first phase, which
-            // should never be a ScheduleView.
-            displayPhase(jsonObj.phases[0]);
-            displayPhase(jsonObj.phases[initialPhaseIndex]);
-            selectMenu.selectedIndex = initialPhaseIndex;
-
-            selectMenu.onchange = function(item) {
-              window.sessionStorage.setItem("lastSelectedPhase", selectMenu.selectedIndex);
-              displayPhase(jsonObj.phases[selectMenu.selectedIndex]);
-            }
-
-            fitPanesToParents();
-
-            d3.select("#search-input").attr("value", window.sessionStorage.getItem("lastSearch") || "");
-
-          }
-          catch(err) {
-            window.console.log("caught exception, clearing session storage just in case");
-            window.sessionStorage.clear(); // just in case
-            window.console.log("showing error");
-            window.alert("Invalid TurboFan JSON file\n" +
-                         "error: " + err.message);
-            return;
-          }
-        };
-        filereader.readAsText(uploadFile);
-      } else {
-        alert("Can't load graph");
-      }
-    });
-  }
-
-  sourceView = new CodeView(SOURCE_PANE_ID, PR, "", 0, selectionBroker);
-  disassemblyView = new DisassemblyView(DISASSEMBLY_PANE_ID, selectionBroker);
-  graph = new GraphView(d3, GRAPH_PANE_ID, [], [], selectionBroker);
-  schedule = new ScheduleView(SCHEDULE_PANE_ID, selectionBroker);
-  empty = new EmptyView(EMPTY_PANE_ID, selectionBroker);
-
-  initializeHandlers(graph);
-
-  resizer.snapper.setSourceExpanded(resizer.snapper.getLastExpandedState("source", true));
-  resizer.snapper.setDisassemblyExpanded(resizer.snapper.getLastExpandedState("disassembly", false));
-
-  displayPhaseView(empty, null);
-  fitPanesToParents();
-  resizer.updatePanes();
-
-})(window.d3);
diff --git a/deps/v8/tools/turbolizer/turbolizer.png b/deps/v8/tools/turbolizer/turbolizer.png
new file mode 100644
index 0000000000000000000000000000000000000000..1af1a49b95330ee8d045b11c0f666d5f0c24a8e8
GIT binary patch
literal 79281
zcmV*JKxV&*P)<h;3K|Lk000e1NJLTq00Arj00Arr1^@s6d3}y`00006VoOIv0RI60
z0RN!9r;`8x010qNS#tmY4#WTe4#WYKD-Ig~000McNliru;spl~4g^Q1?FRq=03B&m
zSad^gZEa<4bN~PV002XBWnpw>WFU8GbZ8()Nlj2>E@cM*03ZNKL_t(|+U%WocpTNa
z|39;RwYysNE?LczY`NQV@0eyfn39-WNQe9&3CRsfNOD6Ogb+yR&42+@Y;0qLd+)ZI
zC0o7su9dXC&dl$Rb%9`VZ9=#v-tY75qtVQnGjrz5dFT6n&wI`hJRXls2qFB3L#0x&
zWy==4ZYMr*0%o&;=88_fu`G#eepti4%}bH}64hlL_}lt;bbo+pnHrYoiEJd3KvNIj
zzS7KJUvHqv7r{GEOyZeWYq|g1<9PSAVy^o}0X~a^y`_EJvNV&r!cN*uMy|+@puM4=
zLq+}6p6J0F8OehDDEulPJ>~thJ7kuAJ()M28{zhABN#U?jf8ORd6h{9kR>+m-i#?V
z4`)~``6I{aikZRuM8l_2|LKEG%ovkQVq_w(Z`z77I*DIjH<iaWR`JK17Xq-ow1k|z
zamWL;^eIx9krD-hKv!cC2g&9}Z9A`8)46|qBu5W_h<(iUToDB;*RJA<Wp|PU{Q3RW
z{QTD25rCI=Y~y=ZT!qu)Wp70_*A+~rs=EbAGB7?RmW^d6Sd=%0aDA}MvLx}!Uk_4p
zVvsw3bp?CgEG9NJoQ2npp>caTs?e((!leXRP%?dN6epU7$(fbG!Ad8u{bdpr$NOk+
zAHn7baM|2!mIZo=Pmd(R=)$tIi}Cp}nA4(|Fy6+}sp;4TJrqoe1t2dsicRaPnRn%A
z!sP%TY-nWB;#4Ykwz93uicTSsm>K~RB*$s!clpU3lR|!C7$wbKCS}I4&Co}`OUA4{
z|0e18dD&Z4NiSh!8I6>5)>9nNapf4pInCS61(T`nZ70?Yd80B=>GX(1GCe`T`l?25
z&d)-v*OQ>t;*CnBxT+pW$in2aaH88mT8<i}GMqF~4M0RhESlgZN%2XXHnSNC31_aF
z5*-78QlTI=+ysD8t4ESGfIwWh36)auvHKJlQ!t9}JvfIqUpzr-ZVXWoItE(?&`iih
z2r;Y>E+vNLcDuRlw%d?p89@+`We|iQU6GLi0YLy+{)cTrK!7vneaal1-hV2e(|H5u
z%rAKS+}FDx1N=Gjkb^gRrYvXf2@pP>_t}SYHtomKe4OnG|I79Te_Z5G<}L`J2))W7
zTv9mI=&Gs)@tyq_1n6iQqOsK;Y#u_ef%pc7X&aKxG`fb`Ap$^mi-ofCetL)er?M5!
z<a2sk5YFa*IzIw_s;VsnKE4l`_C^a`{qE0IoED1}WRZrRZhG9lf12LucH#+02nc8H
zbI5AJ;t7^x$Tm!E|8Ov^%Z}YIBOow1GQ??WBLK1#puVSzHmmE*zOx+Z+}r1ifi5fM
zl|u*u^mdF;eqw-*E(Z>u6f#&LTv|{FGFv~W#}F>?{Ie%GUO57YG&foZ2uiw|I;d`O
zQ-8Fc9Y+Rm*0u4M=PPLJ@o;iO5#{y6ytKBHn7A+o%bF?fm+=hScy+}|h62!fvXd2W
z)BsSvw}Dk_o3Qkb@bU}C>97WP?uimKVKUoyc2Rk_fj8GQ5b$_u>-Di?djoby;DXB2
z+FHkbYd0f_B7#cI#$D^_^?x?6di29}w2U|jc!pVVxENU+<mCg$dGlx~$POOeuz|Hz
zO@PRXE$i6c=L63$zk2r_8YSrOZQ-ROrHFzOgTYK;@irRlU!0RBOEQNKb)a(%@W^wu
zY}(a9O0to-aCrLJijcty;Sz%+VG~8xyxoc+;KbY7%6IPBi83jg7{SHn?LBCET6k=i
zh-4eVZub$MXyU_-O~`(cFoTl)hkDQ$^i<h2T$iU|-MU(C{aPOGP8)lxoqXr^OzKNI
zDHFrF^M+Jh0R?w{YdmY8*h9BU%ZG0_<M-N8L`E<+L(hpiJM(77U{DDtRp;L%{az=f
z)&Oym8-+^4=ol0BKp0W#bEkiQ%UZJXCZH7H7jLfR*4YKn*G!|Vp|YVKSuk?-lqvjl
z?i3ok+KA97vA8@OYUyBdl$M?$2k+DmaK~sZZys;O(pAl#Za?ux;R~!FnZDLRR=!n7
z?zm`r8V7mry($_;R4hqyh748+mm0-V5TOtlJHdogW1!EeU}ixAmfBu+S31efi^Abi
z;B9H8tjUd9DbU$y!Q+>hc>OpIeOS%hIq^99t;D8<17Of8*t(?|uSNw92b*?vpo<K{
z-PzBcgFO@-Xy%!xOK2U27}-nK#0d084X^yIkhfPiAo<<=@SB@ycd1dU&cE^dWCe+O
z6>Y;qv|4)k&TDUzm^m6rI#=od#Ed2|+(nneLt2!P9Tj!R(P>0`EF`6*ApmZl51%L@
z`F!{gXdJK*uG7)waL{RUA=<k5+mU8Qg$wjZ1|~-;=&<^}&?+(~L~!4arcrmW5w}7`
zYN{DqYcEF}5h2k%gi8beD7yRoB7#DJEXk-<0-_|JYUna5m4ZM(LJ$O$3h?=5lqv-(
z1^E0DDwPsJkdb6iDg-1^LX>2bDkYLAA<KL$kJF-i@TX9KB!N;XAc_(Q0!oE|&nKc(
zDNw5}oJ05mB5I`qpD3af1e8kUXKF{1EFqvkl0`%rG)g7@KmZg9)CvWnB%x3!PU%z<
zlAu5-fGCOxN+q%+p6aMjAj!e9s#Qw9NRB0n5=x~4zh69~f(Zf$3LzBM5W=MiwOSe6
zPzD=>QYoNRe)_oN@!>;_=~Oz6=5!+A^r<M63KXYyD?Vm$)ar8^pVQY-D9&C`r~CX(
zQKJgxqgDOyc_;+MsbVWReRcK6&QmJR-m{=koJpfRbJJ(<`D_kfER?6h9M06y$B+H`
z*S~%^^!kSIpYI7OXlQ6a6h%y86mPy?$$(@eCq;ioJ6XH3oCC-ENFEh~Ngr%9w&OMI
zutYF6QH8y=hu=SX9NnmR`i?iSazz=<su(7v>(2W=O14z8dS@$|hzOFRHD~s3c=-rN
zTfOAxM50t&0AF$UbJN?qxnoimFYVq(?SPfBDG8sc^{n2%1$B5LG5S;2_K)z`M_Z|~
zOH50O=C^CtGBzU%qx!57+gDM{2StZC>5pVuT=>7Wo@7a8{mN3-f6#y;Hj-`co#04O
zA8wb2Bh9`L!wTWjf`G`r$`KYV$YIZi<velN$l}@Ibc@kkeOVH}d$s~w{~!-PP(*xw
zGWQlJc>aZ5v|pFYxREAqyLSf9uBhdeKTf8(!O7zJW_GSC=V*nMo4-AiBkPVc;)1)r
zKZzHgE+H<?$m|(0Y~0jLczifLgCgI!b`%XYoiy+6=V+(Q50@pds>sXon^hMUhb4<_
zuJ0qpH$-z+7d}ORaE<OWdCx#cITbD~(-8Pz=UR?<BKYmqi}?AC*Yn5C2SLbZMph0o
zGR<vOJbR#!xQyBSVr~JQZB5J`ll&#rkc_O+^4;ZTo><q;s8|C(_|{mIN(HMP+Zz(y
zL%8%z7Cw=HEaDV3+%U_)@1AaA=F}(xv2py@ZP^T#G~-N7Xa4k9WS^fazc!VC#mVBY
zPp4{E9fDQ`UJt`&6R`^DwRm~x;RVDCUJU86JowNohU)s6aKkw6{eP1gw)(mD##~04
zdhvR__+$yu=fOe*Gsnj;GUUQ8X_4J7?Dq2)ux(B!R=0y@i-oq~Vd68Vk~CCK;o!OA
z8bqEw)<TlrOQ*xh&PFSbU$+FKO2LkjVwTOE8gzjr8Ldi9M`sH&C(a=T2e=2Q(dLk;
z{Bml@HfZOAO+8GU5Wz^Fm4gS{>Fsmi&>KQ7VF;I&OBe`<+<a95Yu49u<2T0BF|6Rn
z-ycgy?I8QM*U{JqS1q4Ryt|Kji@?<J(VQsjqhM|t>G3Ld9v<TUd-9R|BC!!VVxsj#
zhpTw?^=if~$UtWqX7%O{uDT_c-Xo3dEFNM?UN}W%gXB&~;kL_T`EW-UH+*dpzV1Hy
z+)5_T$!2Pln+~^@g2}Px?GkF#8pfq0qfx53e(DtJs!Qk#%jBBT3Fi>O70k{VO`K6r
zoGFsUqhoogu$t-d8deln(&X?le^e4XPZYAV-NBu6W^knXB%{)E36n*pW~E}*sK1QQ
z2?~vhD{mf$t*#TLUd_phAuP54^Oxp?dI>|gH1LnTg#RfxJ@n;Y83OZ_`tXEa<q$3@
zhfokemUw$rCDwn4S30n{mXCII^6}k{$|iQ!oOaVBHojkrOM>EEb-eV-Nsc!-FYE@K
z4&HvZ2KPVEgvR0~4ipb^q3l5*z}Bi31YlQr2}gRZ|1^EiU@t?SkGqTkwv-&BZpe--
zi|nX4iPJBB;vA3L&O1ks(&znhEO5oqHeOv-hYS?&Z(+rXlN>nOO_wzgGFTy8Y6eT@
z?UhwrzBH95etU?$hkEfiom5s0l0PdQvouV3m5qZNPq2DR2fh&p@4Qh)VXciLEB2v?
z4&#r{H&C!7mq}(H7LAU9)_$IRqL^L}l<#lk$!E(60DIO~@Z!oEdOIvU@t31iwA%UA
z|CF%kvP3qlYod5ZB~QOniLbMRhc`MIZtufx^IuSTPSjNK=Usbf?r1`lm_=vNMw&dI
zkyvu_$d*m?+T08dw(-QSgLpkovQyG|b^j3rK}mbxAU2-|m&?uzJ9kn$;$h42QfB1j
zqDB1o+bdb3w#CMk6X1d0pWs-XoxATI$NX6_y!1qI$Y6zVi9wQ(^(xAWti+pSQdL9T
zuzU|G`7uN){WNrn2#s|-cT7g%ap83M$eWSI!5yunPD(|z+G%ba1|*IRX}Nrql5IO$
z_~B0rPz>0p8iJqPH;Klh?Tm~{;hww4Ff{CA$<>*B^x|Q>vEft}4WUzeuy{2jN2{pn
z@G&g~%4@9z&K;(HPS_n*_H+#p?swu*>2Zw=ViN-lIsE6OF27#+4oNAa81eh~?fbj<
z>5_S9bY`MeKIZ1;0Kw^C!Zccn$`245m%z&XM;LKBsBJFe<<iD4rHY&u2k)<GV)mjG
zTmugF?Q5gYu4HPwKV+~%xU?WEl;lP#DJp3}m72hYLoS~C;{*<EsN<36Pf}k$gefnL
zXiFE3eO}aRfvxY95zuQ$&5mOGre<!vBa4AfD`{!Ld8c9{)jaa>eg+g89ButP@%S+!
zvZJZkRK?3Lmr+$Uz@bAO47fE+jq-5lWEW8>QS92<#PRY0d`2@7Lj$-aCHk=Q7q$&y
zChlLf2)$avn7AnF8f&Ny#4#!6+<823+j3?nnlY#}EY39Xi_QCyT<u)*?Aw(0_k%36
zt@IGT+j)%aQJEaAt{@{hiHz7tiW=KUh>HAD>PTzS^X-QgQ~iDsJr)<oj`gr@%}GWw
zvqGYK2$u%_V?}qF3!X#ktBerC3LymeOtITPWTo9Aey(%B98K=D;gY|EXY+s0Z9;Ka
zAzT_?=F>xSB#}U$mZw&f(CpALH81?sY?=XH{>x!jZ)+iIOd@835(EKTNevsijZDkX
z(pOf`y+1jEm=uqtq=rBKW<PcMWai}Rk)$BiktO*Q>k*JnZG&)TM$gT!9O0D@>QRJ8
zl98wj9v1}o*m)NMaiopR$5->ff@w&yd}i{&&%)#D-asFnPJ%&;jDX-D<R@>fW^bRH
zC0R+__5AZp8<US&t3H#TLhy6z?|;weIg3dAH&Yy0l6d}4dsw-$0%v$6?>>8keTRE+
zI$eBNWD6Or5H2x;74Xt&i)Gf-bUKUc=<T<&b$1)O=qRq9A4gO32+3gq?tkzw2TKPi
zNKx^|&R!Z?97I_ANt}_%`VTw#=>yXk9`<wh*E86%s)Xa!BN(DgY+QYkwl+IPy^^=q
z)ngrSqYynj^>hh`3%jXv>bQBqD24_{=qhjG@fEd<9vi`nj~>Ays>n_cN2xqNqZROb
z+0!;iV7QNK$7k^P{vw=C2MN(}XwG3+4woImX-s5Xd_1eRen5jqW^`gY*G?HrWqThp
zGt<zkb)>|`QeRuhBRlr7so6$`UPcwLk(fJ)q<?p`yDZaCH$+~hjsd>`l@#FGYcrWR
zD;?XuvXDy{!X*Yl0j>bqV+;)Xb%go-4EEd6Xau^%Fs4n6VyI<+_^D(0-Os0?S3}b1
zc<}g`am#eZMnQUB6alLPA=X3~VE2eze?tyB(GTG!Zn{1L*Ps(qRw7qkmCXL579RNd
zY*cm!{$U5B#+VS@PChJC^1bD`cwHWvJH6a^^{5M)56kWI(a_mMVP_jh+PaX9NnANT
z57jwcH$O+(hbU{Tq;$Ye>!6JrCyz(3lz4r|UY5@(2pYkFh+3sY^!r%8=o;=V7)@PI
zJNsHY*j>~0<y4VM$+#&A^tTS7&}+!Zh``{nb5e>5iS8j>8aOSwdpsU)z3E0?e7S;U
zcTJ$R)xos<2%2m9DKG26tugZTWm!}ouBE6)#cgvU`RHIj`P0(KkC%A)?H2C(_ILtL
z9}b6~#3Uouek<>;Yv$JPPR3f<!H(lL?)g?e$9LCLF(`1|f>^fi>me&AmMPh4UU|2b
zyT3n?=EDt~>=n5DvNXcHc2;fg<F2pep;ccPk2q4_$n2bK>KiNB-{;{Qv!|i^47+D{
z+mHo4ddbeKr44*%Y9`MdK7kw-$xmia=ADDP>5!xN`GQHjedquwqsFr!HHPl47WBy(
z{M-8pWto<yVN$cBXgt<J`*47Y>Jd`2qgisrsF1-5;nFf#|FJ`JK4UeX|2Wq^^eTsN
zNqK~Vfb4Md*T;|1Zj(OI^gnpLl$Tc3;r&>r;PAn6UfJ&eK=OHb{>fr`9TI!i9_OK7
z?q_G2?SiiF>>l9pCyTNC!`K|J%gWClJb>FPU08W=^US{E2!cRU&0&7JX)o5#SjS>t
z=|28v+b#yZ0aoqY$m9D9@rlw`s{TUrVTEvM87w5;dcTpm^HX@^uZNg1CxzHp6)K~d
zMc0gG)23?bst2ej>p>eG&U}N+(OoqpD$)o)d4i0Bd>;OLH81{p3ZlD&*i<7`MJ<#!
zxLCL}m%1ZO47%W|tJ2xMy&08WN5SMsjvnj9923U2&8^&ULps|xH84I!$%&2tS6-1y
z;f6}o(GeG<VSz+pO*5NMmT~{WDXctF!IZgIp#6+24m5PKY~kfZYgLqWS^3V=ITtor
z;Fm%fWe)DBrOzf3n;wVH>ErT+;q2XIrKQCZVpt(uYLF4tDn@6=V${eKWJuimixcGK
zn2CrpF?w7I*5Vr0A9rCLa^v@j6fDZ3?szW+cTC6D*oE8X1$;C}Mkd85D6bgg_T~8)
zJZ?r5YHqtVm+q6jgilE3x@$6MsqM$%4zPbq4IYDmyv%6yDh~$^_0icnLPLw2E3Qdr
z`ouU?%JVlMgCoPNKY0SHwVx)J$ke0+X60t0`;4Bv2XDFspLLjnUETcgj$0_Isb$3L
zyXb1j>XNwm);zYaI!R}r2MEyG>0|V$u#mwD;ZieKO6HC>@cfI%NS&F@%Iz)=t)0V;
z4R!qK&qvw3sfp}sCsPpNCZJZL4cD`CRSD))GdiWji5dsr|9&0=U2eu^8v)2nGxC?;
zAD~B}#nUy!lYcEFZc-xU>#KPAm2!q%pwTGMhevYLcm+?tUPgL;Do&4x!Kgx`Rv@E5
zr@gS|7!wiAW4C{ug;_adg(=Z$b^mmh_4oGfVr@+$nFbYq`*0ieP8SB%#ph(%`bYTP
z&v!HZ_NkbC4pyzKMQapj=x~Na_Yf`(ghcnRN`Yibi`p4CZ4}ybSl<xC3L%7l0#8RD
z<?a6-w`u3@j(<6i(<bUariV}vm^$O!#tK41b3(X8a5~amk^&4gDOtOzmg0Ih(MA>K
zFd2)@&(=4O^VFM_<c&|FuXPBU50p)<ynM_{-Y5fI2Tt(h$|h=TY79fY{OOl_=!#1t
z$K<1-(TXlyPjCA$Jv~k$qV+V?SQxf?Q7WLL(}vqGv+m_0wjb%lqf)WvwUdmU6pL9e
z@{@aaa-d?E8PgKcoM#-C(=p7C-hGF1i^!B%6@T7wkR2z>nUtGP*txP0-8{7B9g>sN
zd34nq?CG>HH$9RE-h7Ykt-~xyl=#)Ay=-q8;)>A;)O2^@lGUu+`vI?%)-!YL7{dO|
zc2Sljp8xZH4(@HBs8hkFcgpDKa^m%Pc>BZl5W@=L5`!es<&qhlm4c?P54~@Qo4#`x
zohgiE-<-^{r5U&?8u`T&CwTmCrP!PSj0PpE-)}&xSD{o(?AzJSxH+TAnKzod=b700
zQ5`~<7LV0U;fX%Nj2hZ2dZ`=sVl=3c-7eO>U&G7K6jB!mW9+Cne8a;C8U@aN2PL~J
zab~7sl4QJrz<C!%t26TBE3YQb-pH0_8{<<VnI3PVcF=v!^ec8B<jR8SgbBfgCW8D-
zL{JFmv>F6KiBb?aT31g=*#TZTQp8WzZReIbmvMWBfvpV#UrH5e)e4##tW2B~i$)>f
zcKZk)mB3_0sFyH=OOI-ylVIlDNbG78MMsBNw$Maf;|LWUUNlPZ1SF=+$>FKL%q22X
z%gC??wOT>uys>=umUI?eo{D?WPGUwRDnO}HVAO!uFXQnk2-nIe)CvYiWXw95)tfrG
z|G#Gt6Q)4#b~9yO3<!F>!)`>q8e>L0>P{;;6C=<lE}%&Y0<k7DLcoJLOijR)hRb0k
zEmD7u#D0`2C997f<9Jsq{i-AuCr8p_=^$#<6inU`ROWPkaoKDZ<mC}<j^fTai+O(8
z<%kLmF*<=kr}s;#qL@+9JoC~LcD+|gOm-}H-#vj$wUZ(eL!$e|@6rosG@8(Z_!t6#
z0HSzd)AgPa-8~*|yY*HM>~E)FPAY>I52^8bEWLI*I;{9rItnJo(AUyO)3AbR*#;^b
zZ6u{f5pR$<SZra=++_To0Dhl@DO`is>7lS>fT{CR@%9W;+3I2boJ2b7`suL4<h*by
zYDS1pGLaUiV*jxL=FUr@r^Q0wke>-t5^(hm(dAGvHv9Y+Diy^5r7ew^qEZ<XWuUI3
z8QGXXUS!y3KReNfENHNg^w8vlg49HsI-3y<v5bxgqp-1wiCH;l5h-nM!W^B1);mm_
zTgm*4q%Wm@hb%54qQkJX4PkMLbaXk1j59KBTy)4_UHl%5#B<L*PkVa@mwH9XvP^_I
zoaM{EPEJk^feUb-{!@DiFExZB-7jKhWwlzFG;ti0M)#AE8hR#z0G(ZM`DK6Q%~e~N
zGiUbadak`q7PcN}CwE!~`RNACCN*A<m%W=B>G8q!*N;KxbKz3zP#!Pm`MzX+c1r^8
zo_^l`pp%)`jzMm1XZzkBCfr=Wb(8e8wmV1~WhP*E(?1d*J<Wu5(1Fz}kPxGxtIJ7Z
zdIZhKnmJnU;EL<A`NKnp`O9PTh=@?L{>=&;1|xS|pM^$!e#*Aj>ta>mF=TZ#cNXOE
zQE53ILCYP}r*N)GlHc943A-VYTPIJXsqqB0ZVk6j&PT1dxRfEc!^6OkkL0v)JT5<m
zFeNUxjOg-&4A#X8wOY+nPd`t=*a6l&4HrNr{?jEWHtzPY@{PBdJ9o|n&$KDX5_^k!
z@p=S`w^ZTGi=chb&FrfuFk@;oe|xnG%eZjX9CR>cw3dkibhQrf?nhp-`x?lcI+nk`
zQpa0=o=i=>gBfED?A%mERB|**jfP`K+8H-Gf^I3muJRG)=9w5#gHjC}-YBJ_J3y*g
z&56<uTtjwFRP_@XAI|iNkvzS=6aO`t=WVbgNy6jvVsi|kQ|ZYts(7iWmfNRKIcIu{
z%?`>4l>R|}vGEYs&6z<!lu=(y_DYu7wXK0s+2L&8(@kWQmSxwQ+3`U?Cwe>~(fwj(
zSe>0c<YXw2B=Gq|Kc62wUPw)V;i10I7keZ?KvM9n?@k~PkeNJ2&%2uj$xPB<NQvW)
z<>TlsYN4!ZfTngg0+2r`5le@ax%VufyQGl_qY}JsyisQ2bOJ*|9x}$nV^oT$4N5Y{
z#Ng<2kep*CeRLEjk2dq(>N+ZFEqFvF-~9GCWWR_p-b_wh7(;ds31d^4IUyR!cm7`{
zz23<GTXHpXb$#sW4=^pifNx|Qsk5DXK=Ti-znvxN$<&Vwkd~6iG?S7x(SOms`%0BS
zYIZE0)xFqVe*7*!L!yowr|Cls>tc6-K29Js8tCkR-eE{ghLkAq`2YEezbZ9&Y*1Pa
z12)iTAv+Vsq`}9BkqH85H9>>$FS8&eXqDjdU3{w%%P3enFOe;q>sWNlcuLyr?0SDb
z<t06|^*9jy5=*`|lkdhgqfdw=JVt~)eN3O9g6#GYksQZQ7H45|1(-iA27rPY$sF2V
z&$P=%lW0(}XICo=mZa0XqlNu_cH%SQSezm;(B~mLNy+A2txTVtg}cv9akGuN<D*!&
zp&pf9gZ2Ve&GGrY9H^<J*O0@t1`k`y8yL~0F)RGsJmgU233>wpOY+Ba?_>|nemw>1
zi?2h+Wp%Ojg9dK8cLq}LAVsBi^2eI7ITaz%{bGeytL2;Dx`!CW3jXk85m|u89)`y@
zfL8>y4u1SI_|vW6_$NlDq8RS{4Rj2iT|z*ufopDocYh6@Qz1J}EBx+lc<M*s_5W+e
zs;3tIybWIXDR}-3LE_bo@aU>*S-*Zg(s{1q7ZTmSB9LWjtNTdHjw9?GV=F^0;a9?V
z!8=dE@7BT}eh&>h;Gt#km*2zlM?kGSx9cN%VEK>0kOm*U32g_U=0o`JWw7C0xbx{?
z-hu+&dkx+=2<Mt@L=gV>rKC<D5A(uh--EJVP+o*@mmmlPJR<GwBMkh*#8G|Sb~?N5
zc>QO;;m*1?_SXlkuITa7P(RFwOTub#(A;35d+5T%Mcbf*whk-afXJ$M>p#K$+S{y1
z7eF5*Nu*=QLg&b-Ik^HJDtj%TnZ9eVk4~$NfE1w9Vxg{Y0KX(%Y!yUae!@A86@+>T
zzY_2bz^_)pmAAnUt_=$Czx;3X8plxp03ZNKL_t(2JPJ=g2e%b~4$$d>Kie<}YN$T~
z9RVo*6XYd;C_#h~e*1H%EQ58g!SC;a>?kmY2VG9B8KhzG20*C-qYk>d!4ZIzM9>Q0
z^qe)MdUcTDjSNFnOz?#YHw5!ihXbCAtUVyHX;T9#or0#O1`?7YxNdO-C%aT=`+9kP
zeG3o%axO=<)DxZ_$6VbI&#Y_5b7vl5Rh3wh(<$9O$b-w`*zjs8Q}0=by{(<2$1N<p
zaXbx&8|fboaQz))_~^ZAbVe-`Cqz<qVt|PFaLNvKkeeSxO_PS*>rNsn0$hH14$g`i
zUfS#AcfXvD;XG$;aJg(ew)rC_<<I3iQ^MI=R?h3kn^^Px<>yTQ*qS#;%b&-+v!^oR
zu(PqUhX1!@2@%?h=*uF@?B7;Px5dM#iJ5ptoGhMa<iK7#J>A10hV@m@v1;pK$OB8}
zfh>X~K|ldFE`aV%XzK%Hc>IqbWJ8}31R26jfCTk@K_e&2!E-$Uc;;zn-T_$=@X+_+
zyDxyF3WQ8pu`kH9N)AEVOh{b}W3B+xc)0I52%KV5ue}JSo8Y~dAax;_XTXeQP}2*=
zAAvBQ3t|jkR)g?}GA@@AjnB(1^R-OBrHGjmBAIkqF86<DJhq}*)|R<Abg&(V!^e^v
z^QkWCVcd*S?D(LXnyMj8u|^b`i7ZIhaJ;;qTfaG(h=2#DR>ShU#?gJei=^49+<Z$8
zQAQ<${ciSsSjCV^i_Zy?*MlZ8itA=2(o|i~JH-m-j0@*NIz7X}%sh7c*Kk#B<Ad6E
z;xosRsQqjz{M+T<qaaF8Nq0Y^6BEdYiNK^)Uv%%h%P(`|9pl*kMkyWLPLO@Hw>xNQ
z8VoV4uLAl8!7oE*@>vmHk{}}$+%B*=fEdWgf;m$`BZ3%!qyo5YDlESn7B7TF1(25k
zV@E?)BKUmZ^}_P+fmH>o>S6USA!iJ9Rl(x>;LdNre_aL&8MbVICtrZY)8WeTpiqI-
z1&?ll2fq&^0r<f}xaL04Wx*5oUVN((%L*k~u?D<q8BvwUM|<tO{QF!=$_E%3abq2H
zFg`1hYu#?<&5kF^+DrTXPVz>Xh|Edk_8a}!qhhfSx|ldF8i3>^1IPBZk~<**!R6=3
zp$@XMA}KxEN14q<Ypb1ki_<CEClh8=5}T$+Z_*R1>Y%W0nAG@4CTH6zD(z?1QW@iU
zmPHf;)O5CEh|M53E{d-1W;_B6`9z{LpVkRl`g$4k1sH2I;TUcuE;<wCMfkouhF$F2
z)<DkOER1+LQDi}54&&Ne@<Rses{qd_w<^qV)?mqiISdfN9|&qzS6>fTTmx!P@VE>-
z`xIQY1)g~aezPxlZg@Bp%!W4}0h0t-V`2O#P<Fx9^Mmf-iCTEzJ8=J95Mu<T5-yts
zFK&ePkzntiAb`sTkF132GK2SF6v3#4usFDOHrU-4nZc4|3Kpa>JnUiCEFFHIgifo#
z?-TKO0?0xl;U+cdc|P0$FpbLQ7uh0Oy$X~tVP-lJ5n5zPX5MrI0CSh*Vzv1QkI=Dn
zX(kT0L}Y}Po3GU36=A}}1e`8ES$9uHrx6&o`H6_oGU1U$`1}$^la_H45?Oj}HY(Nm
zJ3T6unw*3r#-wIqP%9Z5HGz4#W6-J3ZHC6CjUrnXFza<lfiM=vsV~a+-4L!JXF?ho
zX+}hE08c<>>=Y#)w?AaCz6wyDdjA3<r)Fyl{_mGQDR?WDXVXG3$Wj{yx84SK-U(I<
zY~2TIx54&pFu5K|-UGAnN#+&^z=T;aW)igbKt(xJH9%n*xcFG8#i_q@^TBUFWhCXZ
zy^+#I+5a4TSb=~90%vCVRBM#DojwABfDCB#8Z?0D@*t_TXio)m$^i)(aM?UKyb>m}
z9)nInWTY-w2U<0e+TfLR1`Rq+e<V)rltco42>}?f`ALWmj{6%Pa3Ly{L`P~bh?PpR
zjN9WOOr>YY=|mD#=+x&nL}5BTs(>F+23Zzyctj%gI-G7NsI(YV3I^>?!i`2WpE1|F
z-|xlhlZi3taJZcK1vQcSFEBJh5Lj~cSVkOv6oAVcz~vT^!_?>unvjO|RY0T}l)%u?
z*|;W!06qPn)PeCFV_h{GSi1&R?+S)NI9;F)gPX61H7~;JKZSv2*je)Fa}`P$Y=p~~
z!@RrTkvE{O7p}P$3}@|Ba6`qJM){S{1Ql>}Pb;nM7FNC2KwYx~km>2N($X}-vBQlt
zcl+q9?4YR9imjxY-@Q;v_pqPFeU)t5(ZcH8{kUu{_OB^pSEG-B)5XS(4cJ8JZR%&k
z<`w`Nk9V+TcPBQBgY|1`8E{LidF=#^ZG#*u>*Ei<J;;$GU4Vy29x2D^30%;4QMcQ{
zrs`S-ogM}UyZET78=L!|2hu&Wbt65FVIKQ%7h6wO<8pQL!hvF5JyZhtXzy?5(cQt9
zV#mpo*d>ttZZ?%2r_E|-!^vuDtB<gyrh&C}U6h<WOoQ!<8-^iEGTS!RP<OnU6>C~q
zv$mezUMEhggO}f|4;ieB9Ws!S23j=~R|i?sX*N|@4pC-^jXJl%`fxQo@)lTKXY^+L
z{-Db@Gyl{}e~$NCuZ0JG0i7Zo-3Z%WgunkB?w$`$f<pdR6@nzvIqYWh#x8t)gY=$k
z<i8)>jnil*Ej+;1Z5;^RZ9KZ!g|%l8hf_q*Dp~tM6GLqlVv<a3*xW{3S~Pv4o@>VG
zSoeN4v*sjY>#(z}Xqc;K$I*16hy8sju9_Z&GoavxTSl|y$$eDVWOjYfj&*p1fnF!3
zC=JK!2MO~!c<I#&yuR~)xJsoG`*1gpZ`y{a3#YHMhNpM#<Fmr(cJJRrd`2EVzlLye
zfP<aAsP(b*cU95l5kb(=*4cz2ES&0^qr}BT@zDEQ*i%)><m?<|j~(l94@EwK&Rz?(
zO;zk@?kCEi`a<9M?v_D5`luOmjGm5$0e0<brq{1$wrMD2u)YcwD=`NaWWf6Oq1_5$
zI%unc*ABqUd5~%jChcs8-ABNu3`VT~>^^9%fZx6X)$QQ&1og1yM)>hFppArrv8N22
z0^APpNT8IVZ4iuxAiLA+KqbSIe>>$Ci2qE~2Bi>;uJ?);U!*&N0<{P?-I{@2QlT|z
zQR@vTtu~sR8m_uJgZ>T&gAHwzHMoK<c0k1C@G<?)>6GoLV*J=hyd!oZQq8CUl>+J-
ztq58rYS~A1s{@5fiC%J1*WsdgZ#|DaR!H+e0Ie^;HMeFWp+;{|G1zXy=TLCd_a~AP
zrzPM!|7mlSDh*dmoX(<Hkw%Y(o2SiUqRC6gIdwxHMK%o`tu-_awop8*XKF+keSOuq
zB6ATPLr6Xc8JQF4Zg0Tv_wm|+V~o$tK%;<$-aeEnEs{Ql1tzfjy`-e&a#^yT`T^$`
zT18RGQGEBVF|^n8A(#v-STG8c-_FhsZ79<HV#UWJ-T(9xk^VNAdox%KkeduOwO|+x
zMJvIi09k@(pM>AM3-vV+?+miD_uhhgo(gJN(WYRe@X!#r6tHFmTs1BjpS5=r-27We
zOM_oM2uZzg-5(({8*)>ix(cH5!FK|tejT3q7QFRZFw9}F4pgT!EWH-)xD__kLS!nO
zTn{FJFLY|0e<jl0<MD9I4a?}WIM5q)c-;ZwV>DQ8eq8PVvMduDXJBZ+iBhK~LIZ6B
zKFkq1VoVCUdfi0C8qf+d9-oBKpvGzUV6*#)j5FdIapMoj#KeU$*zZE26wqjtNRo`#
zD`M0M*xVA4(P3D+Z7B6>V$2%)EFM&9C2_G~obOVBk|Z%`x8W5b!ED6ha3IMFk|I8P
zPA#wBi$bBoVzVL&DiY0M^bFfTsUgXrrpx9;snHXsS25^tq0#EmD<nqTUW|GJ0lyok
z*H28inPH~`WSOY&2sB?H^|6k42#?S)&}BnZDnJH}T7lZ24T<hw1xOMY<DhgWytE3c
zyW#p9;J%wdIu&1q01GdNKc|4vd$yPG&TqrgtKi-3P}3TWp&B<H?!F$v1UNkp-hwOO
z?;}vu1d%#ea4QsM!HSQ9jP17nfjbt$(F4$Q%IBCd2Of(6h3Bk6a{J)bmtgcu(B=TQ
z1g49q?_8E;6dHlVL{o5wDJW2zBb1mU&Zdh$bzBxjQd6{OPAzbnoNPLi#(1hX&S27E
zFa?!7UCdcQF+Ra?&U-MPx=u`j3Einh1XGePyvI(VP!RXAn@;$60Y2+Ps1Az%36W=Y
zgyg8x+Y<5S2-K&BD8!r1XY<yaQYtkjA`GXmXFlgOMA45&1cT=D^+K8>g4c>m{<Pr@
zF|4lu!}`OIMLgbMZ=gmU)UhNnID3Ko2~7i3%3yqz{0~C2Ms-&Il0@(YJ~^<OQ+X>D
zL7gig2J_RXgO)FFDttnz3bHhRASlkO6`vk^czPhULIAgiFMQ&`f0bb^oOT)ek9U(i
zHl0~xjAwlBy;~ZwBQR%P2GOUito?W``_!3SH(rCg&%#^l+L?1hK8mhxipvIwDHzMr
zDTedD_xi#X%DO$wnwP=qRki%=$CCh=HE*0iml(;_i_^|~^=F^Y&E|?qlo~Tv<|gq`
zWj)AhmQ5Z1ndj^+KgO8c$&{2A;tGr9)^VfQbi4u~Jdvw2)a-8&Se%>iiE|2TPtxk}
zaoMD4#GIx$0T=7aYCs`y#h6Uimp76W9m(anS$ue4Cu1ki!|Z5hU6YlYr%Ys^qk=-K
zn!Bb?;9%)Nden)0ZG0BnOAlcU8^vv7)6NL3`?uE7((Pf|lF_u3w&9hPWM-NeLLbtw
zzEX0Q9Gqdn?FkwQ`BPuE;PHRlFH2|7J9Do5X|2q6DosE<o1fbg6z2V>I)cQ&*=<QY
z_dsb`4r*wwe}l35mnAGDb`<uLlO0d-hEo3W*HSuaTli@IAQQ90*tNY8OaBNz`@t3-
zd+sDIn};VJ-oXoNTiE|zF|)7D;)U0088bZ{l~-h3zJUXqD|z@gd#UR3@%pocJo<+t
z4BEW>@wW$g_L<|HDDB{}KOf@dx2kw^#~^uWkyMnnQMtQ{U;p_ib$d^8#2ty?aN%~I
z|HyN{-$zMHGXb@p`u1+}va*SFHc~!(?p`~0e+^sOt@wtU*w(AY?6cDuP?8!Z@m6sq
zNM2sqwvGq36k;1`<Kg$-WW~u&I(pk_vB|`!VB_Jv{AtT3_S7{pVn`v)-^;VRkCBob
zho!%hqK0Z-I#y1<!^NXp4ly}a%b~u0o;p-djCX*Fk#@GU`f0B%qsQM(olQsS(Vb^T
zaLKaFz=)q4E(>SH$_6?{B$h49Wy+K!I(D868LSX4LBk&q85;58msNc08Z%$}X%&|*
zh((`~%st;6%TQq*t@=1(%_@8@FE@W@CeAJ!3zto1>zk$6Tp~z5hRorlX`#K_#c%$w
zh(y7QAtRPw{$@6V6}?QmeFFF0KLw>i!KBHFbe6Z{ktK#lyodn_;$ryeU1PCC$1uj(
z#Yg+PxR3w=z23y1mfcS0vG=hU;yGSZ!<L3lROg&QRN|3+waiL2&@IO@%Q(cks(So>
zKl!;+SdbD0g20XQu14A4fJ0JKFnSal%d1(o@LHBd_3_ZYD!L>Czgl`Nlj6*Dv{g|w
z<VPpSID8)5ejj5;k7Z%zC}t-{AxaW1j|VZ}N0eloJ|AA6gje$84T$*t5>CGlQIbAU
z?&0oX9{p=IS6`FLK=UAPy;VU&hXY-BC=Tl)*RJG?a>j%IbCx7<!847XC6WrRoSR5P
z-2n5hA45r}nsu+trLMGx4ey=cP??RKt0(hcvoz?<dcrdjaMX1$c1i-;$S}gA%{+8p
z9@b$$^QOcBFufp=S6(Q?V+tc#9bm=lRiqW95UA?po%ibr_$3@Jkx6s1`1Umk)U}K-
zX=Vlsr$q4Ku6D9B;>bz~<Eo`Ogd5La_Xz}iymxpX;du+06{AN-fVs1ll5bX=lUv?*
z<zf<ykwojm$V!N2;lwGVtNg6kcaZRiC<KLp?(TYKPMd?$=fN&&xO#L7rFAFRI%MJp
z({osyYUbtr2N=Y_m`EL_h&Yzdok4$h5AjJ^7=gUBQ2_jW={zciyv$BY=Ki@kjA&z+
z6r0A<^e{5VOd>5Tkz7-N8MBw19gZXjOq`v;qt7kHSJz4U=t%7L099qZWG%`MX;>F4
z)M_=4KmH_});`F#6*4}5=$V|x#$9lv<$j)h=C9{%xI*(`{bwN5OL&nY5D0M3J>O-^
zmQ7sst^K4WU3$+zrxSu~>hv@5%Q&4-*_y_?tH1U6Sk|d=FS~cOGV8MRPpo8o@>n}g
zjh>lPV$Z~nxm&xbQN}SPRRzc#+26^u`KdIQb<o)BCvRdB*~u3W>+f~5>u^8w7mwoO
z16r)z7TWA8Cghqgs5pZ|eU$Y(xjZkEn$|`{QzGM{Kcf>sbaSw|hnZQKs1-6hDk@ko
zZUS9hO-P1#vLlT&cei0znVAq{;9z|d({uCCee4;HjPz4x39u+DiMGyW22@c@ONiij
zLk&?0nWUT49H^;dVs;*8b$~<lZA{P3M&Y+p*6*YsHQ~I<RbJA|q-mc{8)8@&wd*6`
z^?GS&XrQB`^K-jFUqxuOS{{A$QS$T05*-~)Y3Xt1&!5MfIdhmWVIq3{g$)Qg&9J;)
zH+aXf;Ob;vdZCs@S7b4#Ae@?N8<A0AG*!1^NFIgU-a@Mo#X|i64{r5w|9A579xA0P
zE|uyonTNia&XISE87Y{;T%(QG-fL$052j%$Yhhcdoge;S0)?BaIXS4{rX_K_^>#fs
z+&!7qPZjdbA5Gxkp&@R+I*zAauH~-(%HZb@RddCav0T0+>%84Um(#|Y%6e|h&&6i#
z=a|cYSigrkOTJE;_S5Nq^TrCUn!g0SUPn`PA?w=$ym{Lc9^TtY7=9kQVmvDfTUb^w
zg`U=89NKVRDIVsPn<nwh-oq@IIF&<9Z7dBRV*5xGUPCk!ofUM+CRC|YP;?Yx8L={E
z`eh9Fb<<T>%&3X;i7=VjzH0+xvc@rI%4E`X|9tFWM_n%;9JBGmyK*Qw(!%iyD_{HO
zcy_L-2r;aSS{#;TG#U-#$B$>?#EF-bp+0!<AhTx8#Aq}kNfNVX&q5SMrca;#`4*oz
zD-7aS3w*e)lUQ8<gRPremlyKP%4>)i9AN*kVQ!r6=aGX-ZYywL_j^emlfaJ6&0IIy
zL{Grai4(&>289+44`i!&>*WUSxvzlXE*pjI0e*b%Sn3KpXg0_3{c9p=Y8>I~caP((
zzwgB!8OQeZ?Zjv4xc}R``0G12qHS*?kYuFv=l}~BXPkFYoIXG8y=^?(Tun-L0a{-R
zghkUa;wCNrA6I`4&?-jL(Nu{#V=A{ST7>pQAL_6;0@j1LqqA{!*K@RMfRdhJ{%2k$
z>yH$ZmsY@*@)P{mq9u52gJ^vt6iG&^np&8e=f$EjaiF%Js|*zk3t=4Y8zQr%j1heT
zMT0U~1NAh@*))61WDd1ZZJ$iq|MIO#%}t=|r5Yfct%Wvz^MiPvd#!;v3rB@S_pbsZ
zNg@ykTv9)a#e!b1KNDvqiXuLr50B?xoWfM0AW1LamtFWGBPnSJaPM8&)EsE#wU0W3
zE@(sqn$9*V+T5sB0>yh8@d*OCv(wqNp_Z$brZL<-LQ+~Vh%~~e<dqjnv8vQ~`-XV!
z)hdk1W;zR-S-qy7<Aoi(`%V>|HYHhF4^F|4(ip+Kf(V{{rII024B?$U=;QThRp-wk
zOnNQR#&ASgB0a`Li%X#1VrNW@{+#O1!dN%8J}v2b4Q`(ghu06@VS0TEdWJ0M5_3pX
z2k^__v=1SuH8k|~6KB-(=E426yCERSbT_qf?X0P^4mxS>vvAkUJdX8warpw=nIFYL
zD}*aG+>&c%_aNj&L^CtmNu}4wMAP|wY!pfbAQNd)fmVgLZ-jT>sSde>AzYlOtgPgv
zmtG<{IT-+-&xg@y<beks_*@JtB)Wg46kLA#%Oak5^wSIFh8R`|7bT`noytu&-Gtq4
zr=g*N*w|RU``z!N_>xyC7VRzu?EgHP{$Kv$UnG=4l6(v~z5nO8+|^>`XAjLh=P~84
zfBox+L(L<Eiw&YEl9`!FR8$mgZEZaC&_if6pMRn_g+f6?Lj$5DqOux!Ze=N5ej^hy
zPxq)vy#CZNHXrOHeRMo#LvU!0t+bjggAq(jQ8QfI%8!0_6jeqdeTCIL`PdQaGzrWc
ztv~Pk*!OM;D>gQuj)-DZ{3&HzfY<)Clf8{zri_b5r94jtDf)PQ?=H4hw=q3CiNAcf
znev`tre>smCKGva^J>iT>8$+VT|Q_TU}0uFzj<dB`}%w=N>i}C-p-hW;F!c$)~}@5
zm`7v9Zr&)ZWK32b$BK9SfA-Ehx{m7F|DTz;{i^p~Ey*gDE4DE%;6}0OF(i~g0!bhQ
zNZwniFE4p1Bq5ESgkp+AGvI~`xOdC4Y+1I|d+)l^)$R9A`TZfe00P?yB;<$oTC+5|
zbLN~mZJ)ird!K#y$-#D36eRHL^_$pUUB}Fv91NdQSPo6qc<1F~tbMx@H7bHN&mUp;
zflk~mH`~iS<DmOEeSS&PH1v8sdcFRi1KQ6aK~p%~<mS3%lR2>EB+oa55*MQ<I3<PK
zZ_DBL&z9rr>fz4smJ*v2%l9rb@YWj#>8ea-rrgGz4^QQVSF3sD4>M@%R=DPxaJIa8
zjG8W)t5!^A|GF|%(ZF>#X7S43D@cwHX4>RXR=-n+CEUt@OX4e6X4Bl<$(p^T)QAy$
zYmu4tjRw9x#e7lWc={bqY<?ffQBfSLYbHE0jA(NZvIb*qN35+q!mu>~ljfsSwK6$6
zlt93aF)Rh0>_yX5wiNH?z1l?nc;z(o20cC%qRbXDqQVeVg{8AE<L|YH=<aACJu{b#
zKqp0QHkPDBd|JJZH8Pm5%?M?~(SAZ>!np0$Y$Bp8y#0q=<0|1eebGn&k4#vk#E@)a
zN|KIuw|9}AW?{%2#_}ae43xKF%*)}PuVkY`Vfw-xv|%svzcL%8t&gxcE1JuVD=e5$
zU|?A0+YikoT=Qd$kL11wCNtbRNZPzC?)d6Ns_R{R{ae!rbldPb-2_J(P&JV~hwS{|
zfkGlvL(nums@H?_BK8tWXhg+lknO2vSBI0Blu1O{D=8ZYjEM`qb*cl`a2FLlo%Fdh
zG{27ldmjU;gv0Gb0p=9UK=0_IzPp90z9Dwk)N#f1c`OYZ;HjgnfJQ*o2s0Vz4~Y2O
z!&r=;Zp>Mq+fTPmCDaUFPk_NeFRno+ZBppCN;poRZ|dvoqoSgMg$oz{Q+{ZtRYF--
zxb3D(dGX~+?zn#%0|5iyxhJ2V`hNCrtEG8R;@Uf>lHl#)P_2&{Q)6ka>1X!k=_H0}
ztl8eje?O2<z^@V?Wg#rgNJ5O6=U*si%AyRyop%1dp`B$n<uH7_iOoeemduG_+s+OO
zFHPsG*T(be+fCeb`y_5!mcWzGoFug%gSkmw+T2EFOpd<bcvxnW8Fzm>Woi=tJ%0)f
zRVDNV<#0`A^jIyx{JdQ9<6=mOOeR0rOLM@;6?s!p2OEh`%Ox)|jH9(RESa-_nQ0kZ
zk`zaNY6i8nC2SqA^0Ng6>^xpZKyzY^n?Q`Cg*J0K%QIs?&E*86#lW=rnHUEKkc<+$
zc6ZQaSGeJpoN+7RIDNjUqN0Mg-g=8)|N7S`it-QV^Z&h-a5N^`|L-)e5{}asOCb~l
z2n2ZMsiXAyKlp6R8z=btn#K=A4zM4o;H{&cGiuc<&z4~iz`hM9dE~c;*<bFssPdJ;
zA)fxraU9C0Q=hu#8lK#H1oa}BRZ~j^Z<bY|0>`V5bEM0LrYgLBxQJoD{BP}}fZau-
zZEVZzxJo!qUnrGOQ34!2BCzPHWS;x;F%(h4qz};4?xkRIEVkAT+=_|P-L;f9`$&^q
z{N>$FLL)46tUrX5o63u8I{DVu^AS6`5hkXhwRQ6PTlFO7#Zj@hj!nBd$)6m}j<ppW
zIx$FGn8<6dSE85<JpJTJR(yE^yLNUEt@E<#okr5L!`Zi{oZ@;Hxmn>z7pN0D97C+G
zY~;F$=@<<<)*UJ4WUrmPgxE19k($O+tUggsUUE1;TD^zF@F226-8^2@L2X+rOY(C#
zQrkdkd@R8R!@sA)HI031N_k>UI~nO=*y_7jv$2V|^l)~pDIb@x#_0=2nu=!D;dV+y
zSvB$_UEKPOgG|VaAS^^eF$Cd1RmDps0c58KuP4Bi`57GB-$vfje7s$K^maP{nd43~
za}z}N9qiy+4@|>ochcgMxbGX2XgSh`HZhsIzLG;%hl8}N2)4d<6km7<0f$Ctu)@!O
zRmKDNO(8l&rF|G`D|&FdFC29D$_f^PNNwd|Hq`YK5*$Hi-C=4!=1hp{?m-NyOj&0K
z;Z_Tps^GTwV~C1J42(#T3E`1g^#4ZZ0YRW}N<7PMpT^`g9j|WbBxiz^<HenbR?|4c
z8mBK9zY-*-B^Y>PbtxfvDZKo?lZ`89vhD3E{`Zk$cJFQ>er_(Afqr^i3I>yo^)D17
zg<A*@H?Vtm7hk<Qo8C4DnQ0?FT!}G8{_iKd=n@P#8hZKdBL|7hi>2hPlRW+OF`C+(
zw71#us1_Ec1X#7clF;NtzP3DqhyL#{T}?KQo#<!K;lC({%<v!!e&;Y7T87975~%Cz
zWyl{u_?S$p+gj;$I0y)4^nM$q9X%Kmr=e>(gf1opG?n*D_w&=OhySg86do7M{#A!L
zQs-xCs-DBg`iP0Q(B5tz2i?c%^G)NR`=`XHxj0Pz^NQh*OIYJHPM<*jo&jpQ<nvDM
z&pUmX`KYS<0Kh;$zd@wq001BWNkl<Z%7$Y{8J3j`O8>8>gZtaZUU<fb<T!niNDu{z
z->+qJQ7bXI6S(V|1gsVjMN@h8sUwtjdU^PJml1B%(3y=W)h%ooNaDe3qv<QI;8!oT
zGv_Na$n|%za%DMr-?*CZEwVB&EE61R!sqf4P&C5AOxTCK2%?DDEaCCU7)*LLy->vQ
z{s8lr7O-ea2zHM~c$g8d(~D0Pi3l@tp-%luz{?X`Hqk8y@yN|r;dD6>1d(8~g|T+`
zytQ>TdxnhMcliS1Odf{(Izn__?tg9-y69}4x^WTvir;6QD}!GYNc?Q`b|y?+MtENd
z`}<`6_vRIB+P8(q?mlk1;wsh`9YoU<?wUP?Cl6GR5gW;ZNR1b&2DrL#G7&?Syjbty
z;cJ#sR`f0h9KrnIOUsEgesa7oMOFw2A8|(YxC40Iek6;D5Q{V}VU5!ljA5w?bwdjC
zE}Mwh)J*m9Mjrl25nXnHuiZC|xznQY)HZYP!+ZGA&ky2oD|9vY^7IRp*ljKfXT|W|
z`UYlSGl`i?a(UpYFxI|tg0k{{dU`!<*jP(#%^<Bc{cPOVPIKcBwoV&QK3>f4e|M0h
zP78}>rV|(%;K|<{q^8M^ikC-zSxiH#14X@XdClf@A_j*uFIG=UQ!8(rs;9ZHpTL+|
zC~Rocu_7aqCbyT~fnGZ7E|9%gf+7et>QOuc47dfNtQJCIGP!HkWc(g4vva4gJUyBt
zjV%~0;aoSTkX76FQ<#&()f3`)Y-cIA%$`V!S>(x*PQE=Y6IZ~?izoVcaC$NowgGna
zShzkx;+W(7^$U3Y{PD5l0C)$7`SC;BXc<z*Rl;%l0+J{qcoe434x?YO(AD4|Ge%=z
z&`Z5tA|=7haKDqROLKYhcb5@t)ghS-h?>fzYo>DjrI8fQip6Jh5S$o-0q`ptQzk`$
ztl*c7OfLu{;0@q61u-Qrg!S9H_`y%-60G`R&`II!NMzZ-aJQ3;NwF9t1Gat_xp|Qn
z?Bxz%)Jeoe#S<a-(`5HCteKdS9D_C{)02o51~5gX5-F)<Bqfs_9S!ylbTK*Tyu%C*
z4RWxvllP7uX29npD=wPDjV+`mq%bikz{x%rZox!~*T#gDB>L14B=-=PBuCP(PeKg1
znHCPNs0=KqObU@1FvpV|6hgdi2)7}I3D)y7EK`t~goqKhifx-4dFbiun3OQ`|F|F4
zIDM|^v)G#R<=YmpaYG|_+*^n~GL&nVWup$eXgJl0Q?Rn=+FT|W?d&giF|jZXz0c2_
z`Kg2%6t)!&aqpKi31|YTaaJrAJ?UwoY~9{Q{_I3jO$ytJZOp$S6|2q0!74Y`FHL0c
zzD_P#kjZV=C$VX3C(Cb|z|!l|*}ATd=%fg4x;lZ)J37gpaN&MfMxz;n&rXLagD(}N
zlgbd=oBNm;A2a6W=PL`dDQ)j%LDmEeqK-(bnc#>Nq5|DyPRJ)KK8dB1@>!TW5tC<-
z4R!te&((9OX{zRwKavM#P9)7FbI=jYJ+mhh;%vtrmcy5(71Gmml8o#bTsOUt;}zx1
zFPO~YX_KgI>107>28(i1=~E2Mh>bcgK<2Ow^Zvm;u3nNtz^71K)`cM~n1~SFxRr36
zKHoHMCH&%%&+WtR6Nw4`DAqNu5{}as3&Row+<gunf2^3w4le;&J&W<ID&=phDslQW
zWS@*r0o$HqJicXcWFpyzdGb#sH1q}7xBdh_`QdK19CH8~PG<lWkORt@hzowNjLR*f
zDk@H=9~J1X>EO>#9HnDWMwJzg9O<H_yo=S(m+;2MW@Pok>*Ddcd2ZKMe!6ZgwfzoW
z+P$5(D(XM+oubMzI^8}FmL1}`qEZx1W$l6Otf^=r;B8{%feK^|x_WB)>AH0s?e);m
zR?nZd?WEhMp$@h1rRQIze85d-{UPptb2GhO<<sjRO=Itt8lHc?jP?N^YgU!<+ut5$
z%l2jtRoKTF);N8^7#1q)-ftl-J)BK1mazN%dfwYoO?k7I1q)O0_4d<R)6KK1YIuKJ
z6MjXY;%GB(ZSA1=)grQHCGg0TmCV0kGM8irlam$1;azncIM7CCpO5!9*K_o62mQTH
z)^2X%R9O#weJ(1>d)d69ipO7VCOs*L!+UFZ{^{eKs_Db+hs7(V5a=Di<+|{Fd}fn{
zZ!WwNuS+2@GMKMjv4onE9rS$+)9YxhU~gwHa=^=m<F)kI?F9Tb4mS5u(%6hBh%|RM
z^Z4!(G{sAlITWh_YP-6Kl>6Ay*iS`c1DP39NDY$MURlqjlcp1<7e7UQrP0ytCOgu{
z>+9O6ZFe(gP69J7iKlf>#W=$nr_VP@l7vpD`xK8j(+CI>%a&&$p)o60$1k63AUDlQ
zSW+ZQuF0YIa1A?84$;-^K~+^|%uS`Ox}SOX&S#*!8A($?_R(t!Au~jvsd<<MS7i{S
z1dz>oE?<<!K!c6A!Wd@HNu;{8jpCy{94TtUqcgGWnoRWWA&&POSUN8WquGe3xrN}=
z1VV!^&eN#A@(_8muf!_AJ3BV9^xC_L9&=XvxPSF7T6#J-+E!05QOt-6rnj#dW86f7
zRWFJlGI>HiL+v#rBoy-9t0wWQjR)~*0@qB*qqd`)te8lWV-g8A8p(+aCp|t6gY@Zo
zZ3Ty!i7-G^atPK?E7PaP5ff&hxyv`su*T`a)Tq;uKhGCa{d77>lK$y*27`ge9(#;O
z9(e@4UjHevD~ZKZ!+HMs5(<~*vaU#`X#G6)Z*StS&y})cXDbD_%wl<-fyg)ume_DA
zc2tp85Dh*b{Vp93-k*zYz|ZvjkwZ`O^CEcVnG$SzBL=63msXx2erf_uyPH`3Ru!Vv
zN=|k-X_@idInT<ot4=au{xq(gD6?s28^L-nKl)7#gEl8#zj{&iIpH*O_k<AodRsW=
z(NSN2f?;{AdK-E7`w#MyD;G02J%@R50#$Y|(J@&>`#La%N1?+&MeQ+?@@CS}R?Y9$
zALQP}Gf51#@>Y2(SLdc67=lP1JvT8lESgCDr#{+<O$g?SJLh7kuE(HLc=gpv*1c2B
z+&gBBgYM&WehLHvJo@OP`2BvCFJI2wxpVRR{bP#rk38}Se!rikOP8`}(IR|4-$$6A
zAPD^Om%qg4^RaN@Law^%s*j|Dk;7DPxZwsiZQ8`{-Mg7LZ{C>cE`-KG_y0d=T*4Zs
zPb5`U`R;eW%a4EjV;+6<QJR{XC@n1=lUaS|JKy1lKl~w&KKdwqeSPfTzkkg9zWwcQ
z^MfD!fZzZA_c$C5wr<_}(Sa$7%$PBQO`A5M*XvobWC`onum7iGyPtmD<CXD$$ivd-
zlks|G&UIt*G<HzjFv6TQMaAt35KuJafP&i<z#F)@^<MTXc)T*QGV)$ew~L-07k+O5
zukYf(YfaPe1p>HyUKCBk8wlW&KN$n_1^lR*hS%@M6OaK7Z@`aNRsao;--l08QB?)E
z-;aE{G2Gp3Z|*0c$an(*G{74O;2FLDG|A_cak~QqWDT!pq)!3?1z$iN_rn^ePnJra
zeDX<t_OqX%*XxmGnT(7Kii(OTC@46CD@l^X%9Shm!4H0b$z(#7Wim4}DJdx-H#heT
zlMzLc)vH(Yzyl9pwOWy7ne6OrjvqfxR#w&-byE-oHg4R=3opFz0S0BW*|_n>8_%n5
zj=3_QiH9ZAS|f4zSO*76`tW-c;v+R0I(?klS<N4wJ4xQ;c*+j8(Bn`E?(O7{oBK&h
zu+X`?ly{5m?5*~ZZu0QNFZba{O(EPfL{V`!K{27!9q*v3dXTu}5Dx5Wp|i`0UeY*m
zvX?=p%(_)&R5lLMWmm8__Okm}FR{TIkN)Zq4TBof3!^UB4@;H<l(shV{a02oF>@l%
zZr{wQfdH4LC43Ag805$6-X$YClwWMvO{=Y+?4)Sc?0S#K%eq(|<Kwa7D&8$`A;-|c
zch((Zc5VT-{&q?$k8ohnz}CaNIMOvpepC?8>@T6RzMRmwOrng^r!wX=Rpq6pi)m}<
zV8anF2e;P%0;(eO>KnD=64p3<GAW9J#bP;g0`qB=ZmiYbYPFt8r)e6xF-|f5a5_a%
zKKA&obMZ1k5YRO3p9kMnmBE09)e?fyVP|@JfO#tpk(Cz0;x83)@9h(D9;@N;HEq25
zdL_fo0Qpnn*}biW#PkSiE4nBt>LNKeo~S9Q+%(0)zP&9>xil5M$3ydgk6CjPX+PeH
z92dkTGvcu7R7#3Fd1qBA?V_15qXo&<&P%%-%$pUDp}U7;as(-%0<McVghH=3FgsFD
z#?)n)on2%V%%)K5;FNuAN$rnYi@0^pbPR?dg5*Jt)Hl+l>bc|c#VkyYM6`r6(A&xW
zx_Z(xXY<ISJpQn^jLNPKrllmI>P-Cb+Ur>qGR*Tw>PU_WB_leFw!z^~SE~2=SiQQL
ztCpt{81_(H+>X-_#AJ)(vzM@>Q45c(D5x5!nl^s@hg^!Ll9-st+iTX4k&%JV@8{I1
zQ^dr^5g8SAHm#}>8yCl#wQEUBOT!-sP*Yor(P$zeA>o{USBZ>_WZk-Tq^7142*@-x
zHRAPpNz2GURZr)q5fc~7yBjys*Vl&z7z{=p_|5~&ntdsvC|oq-I`>?{2xB4>3qxq^
z(dcP$amA&<49j}jx;+f_4ige$KnafId*8|<$m?YDNjI@!1}<NkL28tqkjxk+glISv
zf$a29+8X;2Bnh3_NK@kwp(X)ikb#pmF5-eTw(RWWhFd1mSvP=HCopS4JRVukaF?6d
z7(LebP==bFL`0j&$&SEixNvD@?U9q*Jbxx3s*g^uhTyUhlQ4lu<A)a&nV!Kxc2-v*
zT9dea<|IUekxRqP9Pf2d+|<tENs}pv2}Lu8F*PcPKF1JE9v%6iI-Jfy+J#7R!*mP`
z_FxW;WmvNi;q4<MqkxD{?O;Oa9rW`*znIC3Po5xlLL^^aF_AFE#jbA4XA8Qkn#S6<
zR?}WmgrKS8;>v%dTBxV4t`@7+iqT}GueXo%v~(n$G-f)p#e&&vrl+TejP&%6NLf0a
zj{5p~j7B5YAS+#6U1X$Ze8dVUNjlovTB)h6MHB?gW;4^LO-In{NSZyLFW-9WMR~rT
z0o}b`ZdtK{ni?DFS>ZSxG7+JAoOUlZn+HYGlb#a9aNjV!Zh^EIBOSdS!lJB%7&Ype
zoJ`0HM+qn>vWCg5L-qw|Xm*g69f3ULrhULq&V(=qyN4O@LTa3u_AWOeVJ0F&L~0tG
zOvnyLak^>kmq|$qMs~Uw@Q5VETP`ZJ%b>?gxOpV9LAR}sfMg{()bjBXvnqq2!#325
ztPdvMs;92IkI3*y!i_o_dwWTai9_}{XtsOEjgP_S^U~{b5n>6(<+9@yjATZHU>h31
zDOyMgF@LIK&gJxD2{PauaN+c+*am%ALrf$lT0c96B?tl)C(3Ag_76-?j{DCD8Z=Iy
zdlCeJs)1pwEAHWvnKLh*VU1b|Wm!eii63ANilPDn(m8%bnyR8AB8_UNimW2)L^MT3
z)kY*Y@nV1#O+!|+Gi9Ha6#r3Uf;_5POQLuIj7~#VHFTpNEGr5+Ng7el1p)E2+6{<;
zfTF61AIewLG!$(l4^>ss1OaI@tuUI0tg55mbGAH9(@-@o7@t!V?F0RAW+D5mR6?Cj
z$APU|NVRukG8oWCq`mQL{Q9RZRnw6DUVO31q-16P1E9Nt<cr|Q@lNX6{RCO`1PAFD
z8gx;5u$?0(x(SO7C(v)BV;F?8Q#`W6&-C12Y*j6+-q^;VU_$Nb<?UBa(iIXzPK3sh
zqdi0<1mo(lQ&w#!DItiihJI?>+=N*LjvnhFG%ke0o2xk4ID|{q5ux+5dP563Nn^Ns
zn0^l<@vttiPX2(8{k7HnefJL1GYV+!Y+_h55NRG86Wm?0kD{(2LW6^8X{+H!8+LGI
zeljcf7IC7-&h+GXDr-vF(5aDW7-oIxF&exUawANXG&Nx`TG(GzK}Az7vLT3FRW;PM
zH)GMkhN>1iZT$p>yV%;)gI9t6whA^kbQ2m9PRa58>}?xhLP8v-^Kf|Qkc$^zt>u#G
zF|^bT(AergG#Uspf5!2!{9Z587#}B!A_htP*cDVSNf;yv=^t2ibkf*)>m&)2UWZw)
z!>E%GKOt|uBw;?CR+9cj(H8{_x(l!KhwJm<*F;gop!@8<eWWj?e`$nDK@gDx|JYGf
zf~Ih?VTe;FhG{EnrmCox-~4tzJ&KvUG$V)ix8ZGT<M(R@XsYhU?NxC)-MqQ3k>=t?
zl5?YY>GcM(r==nVSy?p6!n<oLh>o!^(C%W>-fl8u4K!Ev@?MpP%vb{sug0V)(Y*7_
z0d~~5s5v%3Z%Ye5{KYAf6D7QU1<7LJ)bS3S&I<?K4SFLB^D^jAB1p49N?ZyRrCVtp
z(^XC3)$)F9?KK=9aFQGo!Q#9^EXEL;T5GAdy8wl{_7?j50&NYaXz=UVu>TMTtI7!p
z3B^8aqqVP#HcjU5yAEM@^)cji@zk!PXs!;LZG${@s20iAOqFerza6T^Xm6pYr;FE5
z^)cL8Ny*Up)%c(=3mwfv0HkC^Qulrtt?rQ#ru(cX;fFOrQ4lDuEN6$^z%MV$!8017
zRS*QcUN^-}ZR~1j$D>Ki%1Gt%%p{^sI+P1gDJ4zjrG2GTIwXF3?JO7_)O|yPymhpk
zJ<Xli0~$#Y5nMkdmqnRLgy@B{em9y*Lw66am7L;O=KwxIVq$z8x6a6CMtmd&VKmmY
z05*pMoiT_Iz3?e$y8>oqm<QG!;o2EfSdbj~2@_7GWx&RUvP$+fbzu*vq{qf_`^-tq
zPK?ATj#%-IRafywRR`a@W(f&;<ulR9B}w8)c`55#+&p~6Y@&?+0VjD10;&x6-dDii
zUpPT}s+kuy^>d#|#TOF6mv7If^Hdv+)gIz3F%)D7#Ki~W=&>>9;dwmuoBbpw#-q7h
z7~;bSlECLvP<1*?1~3^x(HoFG9%7<(sCqr6yK5<{cQe%QMhY`>_qPftIZ%TTV#aE+
z5TZKy&99E(w-{NpDC454bEvqOn-(pmzo(7A9y!HOUne=U0OLn`iy+CzqUm$!(KO5^
z6J~=EY*ondQwjDB(N%wx_dA``HI=e_K@3;LMesteA5D=_6@h4r86h}<TjK*fZ_@})
zETGU;iEUU<X5oCCb*1zeHD=DfoQl>?V$3jk(hNEk1JM>JOwS?OaAEU74UF)G(oJPF
zq~vmIlK!(*2}Mz){AdZ$gWZ@%&DMIop4Rq8?tN<;HF5|KPEW(9jOgI1Z<ues`YwMt
z*2t8U1j2M0&+jQ>ZEZJ;3nmgOogW6%X);gmKFG#K2M=FS2#QKqcN^C}`wk~v0*fc6
zGBqKJfZM@iyNfC6a&lc^HhNS9G&YqS<@UFB;x~q}Bqx=;=rEc)TKV&y5(YIh^E2WR
z(dg)I=dM-jNt`g5oL~v{Q<y|n+0NJ3>?J29jZ5Of#%@zh<;6Yw`SzOKbjW&^=4LWI
zA&TC<cK*2Q2pxVMSER?GlSGQjPw_-?B{$ERL$pr$Oy<5`(s7{lFi)TCV8!%8!VUi#
zhUN14@g--GmNW69RYF--xOT}*>YE0cHa882PtODQWYOE<qPy3Hroz-k+2kji$;pc%
zAtfBY+t19|@kE(LFk4x6bt<AT0+0s>8HkRy(A(uCGC7=39oU9^WERE}=y&7xDkNn@
zl9v}rc1|pdW<}82?P1c)ObU}Eyoe;Hgp-yP#icW2NlFMF6TA6X^+_~yX?!S%dXl4K
zC`d{oB{CA@7z)gc#Bka@FfAb#qh3##*-U6e9AScw2}vpBrcY#fel{~RGsuaFp|j7%
zH8ZA?92QKUV;HkFj1;R#yIbOhnbVM51NhC6+%$a>ojpAy#wKyyq)cjh?Gz>?vM?uw
zM!U@Hq<E$$gyPVJF+Dcy6SbSuv|&>d*Ib=W=b%DistM6(#9|cxburx~5%wJ`=I-@H
z$Uu@PoZ&#CAh7mG8T&fyta{*H=0_P&fxGjQnY(f`f81ZeQ%eg_74-tj5z&vTga%2+
z%X{{s#bj{go7cc7z$pp>OH&W?%`HcH{=`JSHzg5=+rvwTOPMzLQr=rJ6X)pZx8_B&
z`Q00<d8*_%w@%I^Kf=PGW0;0vKYCH%)3zpjd}j)rY^>pt{pDOYcQMagnTKz575div
znQYwsKHuI|#G-;sZb%MC5CuR)_zbNb8X$@SI#ERU4>=}X(=;p*W@bbrj{J}?Vo^)Y
zFpzpqy2;beI$vHH6Mp7?*6hSH_h#$JLL8GAMoi+!A`_k)eKwD2abtc%+-N~j1!ten
zj0*mT>XVx=l841&CC6d~Vm>x)bW{@2QD^^8ju;WcW=%K;3)Gp(jTo(KPVVTBVN44i
zT||S-q{oijPDx8U^V;0Z^fUMKGe<MP!sR2|EeVcICE)@`Rq>7*mVb512$P+a_(7rM
zUo}u(-?N*a9%|yQxwEKmuBGV%->4w#49v-&%;H1~9`A@AKOrT7M4d$2zyN*(R8?VT
zMGfYN1g=O9Kf7(<6D&$?gAOv{voYyJ0<wxS>N|8*VJ=rU4-$+#630l@7;q{qOpZq<
z2#5lx8h8R44=uTjV}VnMXvp4S-m7Ux1NKx@5G1ECD?SWWl__azqqL)!KDVD>i<POV
zNz6};IfL&QB!Qz1%^Yay!sb;-i;3o{{0YRFKH3dBLEw0E3l#%S=44MGGt9*EI}Z>Z
zpT%FUF2L&xoCCfFxMu!BzTDxUp~sGt5^?64!{y}dQ<YTP+{8wNvp9DG*&#*(s&+;V
z-&5O6S=Ru9&cNi9M6Sq8<g~CPh$4QEgRRxgRP+oY>5WWFPhm;s*uzf=_;|m%2}N(=
z>YNnxpEE`#2m;Q2H{}fjL?lI%ooG7qtm1eV9t0*%j3LN8vgkR>8z_>JS(0nOZ+Eh<
zxSxqLk`Qb*8k!vhXC^W=-E_g_ch&dOWDAf!A%^&fv#uN`54GU4TA4N}@`5dCsv=X~
z(T?2{;F1aHoNQ@F76j&`r;eF^$kxfpL75q;$@KR&(XE)dBq^H1HMNMA2xg_kvb&;!
znK`-moHpwE2N)DWNDy31%*et3)ONPfH|!=YDwH~ZFqbD-@w@F5cMcG0wh(WYXc~5r
z5D`VF>fms<n^_sD3=gzY=h87hGx<C?t-!3sA1^uo%T&T3i<P@(PviQWM0S=}(j$d&
z-;`8*ii(CnUQ!~<a*{X=C<%f<PfsUL9I0kXb{^Md#^Cn(`Nj)tsg%OFD>niEhZvTm
zDQrAhO_N*VJM#-bR=_vJ%EKpVaH?cPMUWg~MG`<34J^%_z_hqfG!1kDoM>rceOVPl
znx2WVQN&mb2!N`$azjBT(H0Ya&mhkouB6@RK@vn_!Xqh+31;Q?oqYGb5`sg*h%)Oq
zR#VMi4xJz(F@x!m77PYGD>rTAzW0tI7_G#cb-Y$o!fPj6xpsOXkvRDM{tD(!%wc+b
zI5o|6-15p6h)Q8aP9o+&Kli<Nf;$#m%ADAckH}4$Ca@qcn>mSLC<s)ww6LwIhy6A6
zG`j)>NeZtYKF-^xnpietG9jXdU-t9RtMBmCu_m(OqY1bM`Q47gH2HK~l^KU1iimC-
z%m4NcYihg5jE%%@>*KLqMYIax+>{kVS#1@&yS;p6#w4OG5`W&Xkzeks<*V~%kQ(&a
z9C!ZDsDz5_r?$yVaFCI`?^SW^gq^H-nFAGm;sh5@zF5wr$uYd}=OQXQ{bcG~eE-P`
zB&&)3y`@<4Q+Vl}HokOKBHQ1tB;~R++KcOX{mp73C&aV+os;a`)lSaj7@mFNC>519
zj5?LI>uPB1bhB+&7io!B>YE3t+gr=}Lw#h2dHMaDJp}Ada`U1vUEnqsx7)$tu0foQ
zhpF<1;_x{cY^#Q-EMiO_)d?S6yPjcHV`f@7KYn`~25T_W;`F?Hq>-kcKIUg<aG<J&
z#Ml_Z&1TvgPEf5+Ww`YiYmb!Tw?<RZ+Df$E!S>od_S9EX-BOR@anT!+LVx`+vNF<n
zbH{Fa1rzTb*hgYy2#vDH-*+4!6gO&A3i0QuUwv6SFTYkvze8ouhU2{aZX50%J1?wh
z{MSiX=`pb*J}1i9r`rmGfKfWFzzE0zFTdGQOh6yZgL4Z|R28Gaz$^FPip~^_TRuN7
zqo@j3&YI7i-7eObm9n9v1j%4#Np2=9Cg(6UK8kRYeq<Yo-oUS~TTJKbt*qR&o4@YZ
zO;|`6*A!%NOJOz>B15o9U=E4r=ZmJX{M8*ieC;xpM2k4QPF5YQ<ELNw3J>SU;8iuG
zs~2$3U!UX66ZPDe8%s-bH9tSn#BG-^<k3ZwK!a}-CbQ_}t*k7q=MPh@qZ3P@y{nO%
zU)jpi`3w2mk^<bahP{6X4VVya=Hr~aNBmv*fO@ug+6*3DREU5^aZV{WzrCMLwOu?o
zIgw3!x3RrX<j9Y{L9$5#QR2bb)m-}A7FJBpV`;33UvAk;y;oq(x9?y^gb_*5NZ+uT
zXAkYC^0NHX5FDbQ@|O+kc&5tEn(y4kj0h9*=h630(@+$Z{(%6Z0{2`S%&e~-=ftk%
z$Vwy+>GTX0S5ss&F{5)BcbLizch8`!qMhrO<?@TCkJ3&Q=mcCbkxYt^c&)+C!#}zV
zSGNNxE|iDv&Y=2G3zM$TWnoqb9gV$&1RFWIx1K<B6oUhP41$d(*7kAJvIMFcZOCRl
zPJ00PB0Ts-QKYf8n(iTiD^g{=iWi+uhsz%Tq>rjv&4WC#crk~X>uGcvxK8lX;d0a7
zhZg1b001BWNkl<Z+l)18M7;~MSP=!#>vin6>G<L72sRGK@{2`T-23tY=4VIa(&=%y
zhM6_#GHwlP;pMU(>e>&GXfmObtUSEzDo*tcan!3}Qaud%JUC<>qT<2kKY#yJHV$#`
zw`XGTxH)9?&|0LS4Rn({Ip<%;ur72fg(!+h0XP4%W;1J>ojiBf&E#7&yvhi^lNB3{
zHoDd0g3SMV1HZlHI_~Q1rM#z~lkMFUHMMZhiE=XH6M6LJtGFc6graGLM#QrIzS}t7
z+C^n=KgU};*>(IluOBL5{-jC#dD&%z8^Ay6VI7baWJN$H8F=}=uaX-diK58#3=PxJ
zH-KA}81~9YBJ8Sb1te~tH3?ZBi3kvzkix1vZy+)>3`HB+k9D-Bl4stnC%<4ie_EK2
zE1)2V65<*B?c%JD*G<kPAO}zp$d8Xk6kx#R#-vkt@o*i})AOlmZKLK4lb6U3k$9!7
znI%`Ga;VEjZuTVRM4NH=0tkY@U6;>e{&XKP!U)b62>AKkhRtlNYv=K=eU<5v=JTrS
z|2BRlNX*EKpuBOAtl4R7Kk8=nlhY_I?V+u82)j#W;hZdPQG19>k09LYqI-KQlk%bn
zN{nFk%p`7{n#ORymsyiX0HNH85v*NZ#oVP62$BP=Uth=NS0q!hy_v1eHVmjFq=bP2
z2{8uxy$Wgh+5GoCLHI0YrY(r4rKucUd?Z1p3lA_Qh!Q#RiKGNO$cT-iyv>Q<7(ro_
zY0R<k<7;M6)Y!_UdAU3=!$G%SBUCamIeh|}H0mus*v-aD6L(KaVM<mepkdZ&ynf&$
zcPzRL#omr>V2EWi3Mp!<=Y6}v)bw;BJU&dCMs-saHG@u)qLaAqvV4jLVey0nq6*t+
z^jlaKCY{#+m7g8SwoNr8XG9VaW?@3AMywFbp^A>r-$ANQ#}HpzwU!fhm6dm|U|w7>
z-gA5!K74N5`CxAW@GFoW8$)_*49g4iK+|YwuI0MF@8I`45A({3D=>|?9TU(*3X&5k
zNKRzMv_d3FVCUie-247XR%d7OKtbY1RxUx%q4y7S+g~?vpu>i$fhLFq8w5fu04m*1
z4+vHggCw+3cZ+~3GAS_@1Od%I!mzegH4$eu(%9KXyVFmSWn?dAP{auE+hX^BY@Jo@
ztQYg?!^VS+dNeICI>3c9>Z7DMY4*WTbp>};SA0|=whiNxWt@ILh0&2`w!vtchSd^8
zfh7q2=+P{GpNHa(0R&)gZ4=8=Ci8j4;5AJnYjPZ!lVV5rB#uakng&y+#GElCd?hUc
zO&eJxf1W>r_aVTIw-z9dw&SeGAONOamdO-VLlgxPmSvB;CkotjbIzGOR82#en~WfU
zI+}LUgfLWX<o?e4rUSx7881vG3)fG(<cw!}eoVwC<}q*T94^zek%fQmf)P)BLE!$&
z&jR)LEV=ruVJd5+ev78fK2wIKMV`5znw)gzewL;ojE>CdqZ*SyA_b%6WzIZX-uWoA
zAfEKRxY3RFFgYLm?ItQD`STO4L6Rf}Y~9?kay1=<@b>+8vNSRD6Rl}gEloVN_c+dT
z_^yTqqJSuhxVxK}`o~w;+B$G%0tusyIVFE8U(X7r)i#7H0OjS!$bbB8T<Y0Vhy+1E
zRbknJB`gSsqwThjHn<?-wD+>?x%Id#Q9OF%)oi%$HtK)=Aa`X)k3w<+W=R49xC7@}
zGzFS_`)ISf(MC&MF?TLS_uq(M@8!`$l^Ap)Xex?1mZeb=?^iaV(@SHt2YhGc%gq1#
zKCJrlVIUfssK*F=dBNpW{m=bWpL13G_*-mUaS0w-MJI|3d;K4%w;b?M*)xD+)Jloo
z%!~Kl!4sEfv+mFlj`TW^KCc{Wv>w$}1NhJWiy%OIla0n!=cuopfG7(12Zm@H($1u7
zs2xNGx|#<#ak7t|!N3_+o^#&&z`Zc?To3>`KvlI3d2}$IPAj{;)Hd3=Si!V^$VStk
z3jmvafSNwrC!q8J>U#Un_%v3ww<BxNKh#H`+mEKnRClz~I_y3(R{(~bc4~S@4&v~5
z9MtsL0T>wSr*+r^Kx=Oo13no+fV!@(Q6WR2zNZga8!^VTTtrld_SWGK^o=n&hWl?y
z_?$2-LBMJ2;+B^;;tx+_<GnXBGs=u2jCg<R&+%Nh7z~(oB7!JVT3gLy`;O4;l+lR-
zvZ^uc@nQ`L!J?={#K)s|Ie7YDIg-JEK@yQf0i7fvdWYEC?IF@)#iSF6j*G)<@8M^A
zYY4HJ(2FB!4SGF+p-xH$AtyTI0|QDFMD#j|6Sd_y4Wazy#w++zVJ4GeBQS|FM_YT*
z(9kr2N%0Y&c_?b_M<)t^fJJrl%~v<@hoTz9(HTA=G6XEq{PEgL*>Y$<D{BWaO9Ha2
z@YVS<sjol9?@QVUH5-sd_ihE5O&mFXn5~^|Zkv%!-~!w~0$8~s)xxg2b}R-R21!IO
zN$7<D-&px7e=6%FI@n5bu$9u98XTeyfe{b;<5j1)?Ui+$910*HU^N;DH|SY5?+TVD
z8Tsa0yYTCbpGzrA6g1vnUxz73<FC)0ptO7lP-(2U;nzgk>)WVm@={w=$M&K=T-D7y
z`j=DGcl$WGp@ic#HlAD4K}3{=-eV0M>Cx~G4)fy5lh|ZvKH1L7RaF3-*i*-A?=&#b
zJ;d{WE2Vu{<}ZIfiq53+-nMr912$H@UIX~~&F_vA5^lUGHyMZ1&c3#8s*Y`8TYVQ>
zS_X(T>OR&l@bPtT(>^>*Rev8F4{qbv+YX_6TKQX14X+$Hg2o_4js3(}%{ZI`ys&3K
z!wT5l9)?<v^4!T5-YIWH?K;X^$18cK$xeOwKHe)mLea2}{l^dS_OAD7mPPi~)bZwf
zYpEC*qO5O-C*NJm!I~Pn{pa`O?`rJh-96m^RF!q``fFAA6oqwfSN?k#mZtFm;8;*)
zp4?qbv(wMSm@r;He2m}kJj|bV74xTEhk4^f6RIHK3;4O?Z!7uUzFLf;z|y=dL`~*r
z8@98jp^ZOp+e1;0i?7ZsK$c~Ef|Vz3oK00-IeCx1!ZU}<*<0Vr+a+bpfATeIJpy-M
zHiHmRBRV{mZ%#>L{r(-ydg^UnE30K+eGAX;K0y8--@qCb%Pm>)D4K>@uSX}q`{h;C
z*<7SY$AI6?o7J7zTpoJugZ%fZ)f~2~IJ_P-VBwTPriPh#WW)O$?i!@e;o$$?-9@uU
z<@zbPh@+fP)j-o!=H=(JBsrX4zrBG<r;4U&%$k_b^_j6e_3k=uer+cQTDm#j*3SRF
zxrSTcJ;t=0JnozjGh#i}&M2%OX?p-~K;hvluVApVo*UmfK)ch!!0-^?e{BtiY$CVj
z#^J@lcQ4DwHQ2$!>krZCa8ujX%Kz>>PIz=0^Adwm8F3TQGz|nD4=tXHFxbYoHkKet
zpTlr#s)}8fdF!<nECCnZ=4QTe|2Cxf2%<#~o8Iq2-_^vUI~5fB5Dtf*;J6^(-B6F}
zm$6uN?AhOmG004%!@#u@4XjyH&6jSSh^Kv+-IXrxS&>fd(RNDZ5N^LN8MiEP$JZzE
z_8)iAp)>OCYYpht0q*|JF=kGW;Ka5QyjM2B(|;+$<-TwyU$a3^TW1sRwtF$D!_>A^
z^VoY^=pU0O$doxO)Kwm(#-VWa>{)zy+Efgd1f0E<*i;b#10C(<{ATY7tOg@rnv%#v
zYxa^B8_$5lO<GtGinE)&UIRtt)#zN!w5vuomA9gHm(mlE*wXC8QCm!xUtwFT3%RqL
z3R^$NY<h+|t0=RdpCQL*MALSv6Hs|;XCJp+AHs`oba3OBvi=PimLQN78-u71Mj4$w
zzJQER&~Zsh0!{5LG<*n9pO`FhV_`Z10zpP2R-J^ZsU)Rl^Wu#zo+>Kmfz?ffhlKLL
z(nUNxIS%irlrekKbY3$C^F~<>uN^#s&FjZ%GBG(NjsL!W3Rh)B;Tr|EzrSn=6A~)e
zRN2U5+xOy<RU)iGTr*<^cg`#%Bh-kZYNRJ5@};~~HW%-w-{a$@Yo_qXLOU<)+07e!
zCBn@n7Umc5*GVeRmUhw;fMCJQYxmsDpLQSNyRWY&plKvV#qiYaH*-yr1)s;m^u&1L
zt;P{tKyT(Z%jWX!O(ncv*~qu1Wg_WK{Q1`9%q%&@rm7|$TwRS{g`|i`9$s=ech1Pe
zsviMlqC&&CBqbh;sGh~zBm<YECXgI#LQ_>@<I;HJ_NDyw;7M-$TNNrIIf)6pa@QrK
znIvRYWqQGMR$<^TMdjS^{7EE9$Nap>e1FkQ@cW4hi)2QU0pqBIn3tN)e_fW(miAUo
z_GghFZvLE!SR$b!6if-BzS&K`TjY}IvDj*RDC=;On-_t@1K!3aj)x~QIZL3kVSvyC
zGgGdc#OfdH<+8a2IQ#5Gr-Y11{YH_kTbr1EX)?H6Y}wU8eoi>vica<%@?z^8q^`q5
z=OCno_{f+RiC~aO3TfxnH|zNNS2LKA?jk%${}GJ#6Wu$!enf+b0;^27Pa-KU8L6)c
zn@1t$Bd~yuf*=?As7w+K5`J066Hvg}%77sjgWZPURhXQc!_KB5>Kn^><y1YLu4uLw
zZ)dm5%D2q|jgpl(&k*6cS#-EP#Cp5AGB=S%%}l7r&f*jc_OL|4C6W1wCVGsqOb!X7
zAk>S;l0c4CxWH}_0gb3I0|Xf`IQ#kWgWEp4@G?4`jyL}H47rWR2@kS<$lYMX_eyt;
z$xBhyk2Ti|f^f!}P96<oajx^3tSBhj>5bE4huKh76<O2HfUJ@zeyjtVqN*sWb_UDP
ziQ-4BbE>Km7zI!Dqv11TRXqbN>ZQ}aY3R=RCQZ`_jMh~W#SgTBtf+{h@Ikyt843NN
z`_Ko-s*0+f4F#hAkTi2T5T5j*_86;-bL;!zZ#p-Ptd3wgI#D{)9;&8}h7I{(9c5KR
z`cOHa7WEE08J=@B3$DB2qQ>J$JS-2lthfcgUqO^aG*v^d6OfgW_5#rBMFIg8K@`vl
z;0tI-Isv^T;P<OY`jPRVsvt=MilU+@8alm%DyySzG7^D+at1ga88ahoqNpR`Wi&-a
zML@3;kpl`E0tUlH#i}7N8W>YANh4zg4ZTh`<{VHI1zFS3OC$X^68c5JCo6z}Q4;Yf
z3Zft)35+^fgCvapm86kyJDP@G(h*Qbj7NG&!aw?+P5{5Eq7x+qM&^iK(xIs`vL;~E
zNf%VF2mfn7PyKm5vaF)h3CQwDSe}22m2j*G4$=h%71D`gM`F-j0LM05#P^*~n-N9v
z1N*g3N16CAqt$;1eHH`(!^gxV*NquvLj3r45cx!-gg6HBJyw1fQs0kDBMKj7=3~|S
z^J69)`C~X8)pPVab-E9J@9F2N*G~XFrqSnybDSPeccUbUXYR#w4iz<gOytlrzlvv{
z>ka=%OmqRgbavz$&ch5ON&0|y*6D>wCqSFsL0UvGvI^EwrYVk{$vNenE!%kR{h2u`
zot-0+jti|}d2uV>c<7SRei6^~k4`s!YR)))!AKAUT2FQH^fN_lE*|^<CtLGM8PC3S
zf-c+H&^3;ewQQ{#@pg2ybn(+4?d4FNhod{H`0Y=&^U5CkMU{W-y>cG^YYC-wu7A2N
za=^>$2lw*mruP`S$ajDB<|<x4UP(ZOuEBOX>|O%CZuZspj946pyZO!=n*b<lDCc);
z*HPyNP<ZHX&(f=EJiBuzPwd=-%WdP4%{y6LR?g9?QvS4UJ1-wQ`40yLD43N>VcOVG
z!e=aDX$a$UWSl-v3=4%lr-rzEem1+_E#r^-gIGK_gbq29s}{!di>FR8eCYtc_^)DO
z@)EiK5|L;Ax`Vdsa>%naaLawOdFq8~p8xe!8fu+fF+Y^;Ysxru($3A_n9ZSgN*Qv)
z-QSwRU!OcmbW9MJ&5B~f=0-weL+I>NxN~_54K=MCdZm>*#moZ_%wW&U`{@jd<%joA
z!hC^SbG$wu=CA~E?T4xFbFulrHljnqxOLtYM2?|OoG9DHb2Tph>)OTi4BDAuGNBi}
ztlF^`cX$pn<KlRA$9rt3$>VP~E+8X##F@0Jy^Cw7XYkzaqg<b?Cq2@@vBoBXVp5nQ
zck<J9JO3Yh=N(>0arOVt?%v+id#{!(H`#K-y-|#5rUwE^US2{vN!}FTmjnVK5K;)C
zgkFuo7%;f^USvzQY{|B|WcA)|zjw>;4;cpsL4<(>6P@Q-KazEJW_M=i%sJmVg{$UF
zr@5w*<Z1J{Exw7pje&F0hBQ@U&D$qfxHyr!epy07xQ9J;B3CVlp{k<qi`B49W($fs
zlFNOBKJR@{L#NlBv&bT#5L6XBs)4I!So!s%HB2uEM~;f-mg_U=DyqSmkjl)0D6~M3
zi*KAnu*=PYuTAFIrjrN;9r%6phS-S~p{?7`J@?Ha20ym6D1LtTbh;}#7=Ps$zWcp=
z`UYe!y*!)V>NW!Y00C76pPMZwRK9k31_q;tUFACNy>r5_g%u29Of8*_GzSElTTT&^
zHI?r!m`A8?XfSwXQ8^D^e;FAT1HZfVb{d+h>Gp}-IBN<w<>#Sj8jGhdz|eDQP=h-S
zDl2HXJuU)rkfuP8*6uD^`<x5}W!zp5HiM3yfQDZVVl=?=EjyVoD*fDMM-+&Swet4|
z_p#*md?sI*&gi^k)W%j)7L5Dif}d4YMKl;WwrwL>5uv9skdbTT`fQh85;@e-OX9*M
z#6(9A`+NLwKCGn|Pv)(6D!Kfou{89G{P_0KG?sU<V`C-N?HU)~G?5r@J2gE5lg37H
z^hi4eGm=S-)v;w?4?p-$9%@h_D%3<|gqaA3j^|%G!I(K|7`u9Sb8QnBUp<P}ebsC^
z)I)xbokK^u$sU);wF{$oe{(aJTsM)6#v56;yPXLWlbJKdz{{%}$sZSmZkYI=QLm%3
zyNzxsnj5E1Kxr-Ky^03Lr6diRC1d8O44&DshlH3&R`1!3IWm#SiE*fkg27<HZj{(n
zTE+#FXAo@&u&1h=<8G15vf^1&)y@B1Jd+7=vDkGIQ^pq%Xs)1HAJ0z~Ol40=5lLy|
z7#*rnD~B^JKKz_zM_i~xVW)wc=11dKH0(ArV+&%CnmWGNsyU)4vSs^rcCCB^+3VrF
zNt!f5|8bIZI%=w`krfr4UXR!9B0W7FYeXaqZ@8KHvt|(p1cu$-NU8cS68PcY2K{`Y
z7?!H4ESf)`i!Z!zWL8J$Q&D?+JNMszKMqF-27`gVzFwwHo5l?{+<+p>pGsK$Gw6<{
zvi$XvEWR<1kPm?(yVg}OV6d`yVd5FA#C5!e15y$Ta}0pW`zxzhv~(25w^wkaK0v{o
z4DvHA!+!v`i`Q2-a@F;@m<4$4*+VS4ZUSwkr_iFJnJ~)nsYJ!$suT1WV_29R%I4Bi
z(o;s0;V=%zs-~*FmGtP?GpB`v`R0yuK~5f4y~M`igXkhsh}N9sre&hjREn!ka4KM7
z>6r8n8`%IHt}G=dEsHh9CCnN(kvPlepI+z-FQlqz8j7NfTqD=8FI839xpOD|eSPTl
zIs^esCKEl~-Q?%zf5uYvL5>`RMN5)-^!G&wMgy^t0_Bzcq~}EAY;C5;Z>DB{Is0pZ
zq-y>AX+;yUi6Jzs+J`qjhGpwJ`1<wP$kmPXCMDwN@8ap_Pmne-ftr2Qy#9Uzlc&bA
z^W9Q57WR-BA@cXXAH|*&#@`+;;@X?D*tDsMj?!wLey@|um!zWv6b==(ke?qj?04$w
z>*ZLV7w_@SxZ)-e)mh5Q9tX4Hht6KA`1*N#>rNt~<1u)f`G4#7a?#j4c9-nqSieec
zR5;s9%SefjBhXvRz1t2mIw^&L)=J(its^%j4Xf3Gp=lpmywT`-D_K@j$>^8}Uf8~q
zh5--TiVK-~!CZ=tA15y{{!?pSnx=8Gw1e<y3tP7~5^GU-{Hdd$lW<9f5x0gB`jVQ2
zl7z?OIa97)6h#7oz**(%&r$71GfNa5=q1*!k|=g_<xSg2$crLO7oeg+L9D9a@%<qA
zJh)u}Momd(_vSj1#wVf-xTvk_1yl}n8(EYpv0-B!Km6%r#Et>Vy5T23m_YUZ26~bb
zxZ@kS^z;U}a7hNMpW1^j(n0BgZbU7>{OiUue`X4C;RZ7EVlnGK-Md+gMvQ6@j~1k5
zKqezH6x}BX^WQF8#w{0JM5aUG$8T;TCNhMcmSSG1bW>SZjS3`2L}Aj2L_{XBc;aL(
zAC-hxvU1PD9PV3NNW4+ym_LlU4mWQ!8M$-*Y}V}C&BYfkB1#`1H7c5-ljZ0PrgJhA
z1wo*>d4S_<i#R2lc=FX+e)6+vOdn%o<(pL_0&9f6gqVn?v1rjET3TA@>gqzT*Hcnb
z!h!`0FdB`Yt!+^vJ4~YJNIhawEbr~}^4M?3v3FG^4?bB&RaFnRoMghgo2Y8{qt^?p
zUtWT2GLV!N!N%1!TyuQ}olX5Dr3^-JM1|@3{e8RWlnl5|b?~Q03JJ}Oplt04o_V%}
zva(Kg?`ojaV_;I4k9}pWIO3uJ8TaY*9jl(+%Zn>(aQTKGOK8&T>FsJ^XMY%%Buf1K
z;4!uo@1-X&G%S7jglvAZavdjng8cq#*OO*55gMIEsIQp;!H9^)hT=Wkzx5DE0-its
z(CF)H=QnR}VQO{)cP@XE6TJhtFk|RG!IQgokr5liYg>0w);WMI`>Abjqt_oe=V}54
z85X|&WGA;>98FF%Jp8AF9BCCPFm!#fp!*1o&}Si|(a2+uJ;vI#YkB6GXGl&?K4<J|
z1a$xM0_mTGvwfuA=E&5H(3h3`em`^O%wf``NhBsFp0ltT?gAZ(f;|H?bSvj{?{MhY
z!BaGL_`Y;wF8~eAb!@I{qt7`&@DqZvzbK7oD5rui9CRO{5&A6D-ri1GSsC-^&mVT0
z?V;!l=&mZr?MD9kToJWyGm}QyPcKlJXa2C4H#gLgksC*dRYDL128vGbUW=WAG$ZXt
zs`$=N_Ms%i(p_|d2Y$7a3UfR&Mw!vH!K|boJmZId{va=|APB5|ZXeISQ;FyZBRyW^
zg=O_zdSNn;{$dSVt9(qIFnm8OpU=ggH>~BAeMgu#I+OcWzDrSa57RPJK2{TX<eirZ
zk4xwA*I!~~O$Q4zWBBn4&$GGN%f;z-e*M-8wswllPYdCdV-4ImK8qctB}7HUVU|>$
z+qRL{cI_o4HJjH~zr^x(6PKh#e{S=wsVYzYZaXi%bPSIpoaImKWyhXY+%6CA7Y%&*
zQY4Si2z{ZNgQjq_Ey!hy$8mVaN#65!QQz)k_C<Nz_U-XJ_3BByr<%FpCuPK>M)31_
zCiZM8qrW<o*_KYOyk#_RzgfZSk4~Y!L*Sar!g+655l+lZpOencb;k(}vopCMnpK+{
z$V{{|D$UHxua~2@80lAyEM1gLOH(VQL4gyM1NiD{+0f<Sj#;)d86$>6o`6hZOahrg
zDUa+pPFh+Dk%%~h5H>_=_<cwA5SEyW4H>UKgwc^9D2f|LcoGIl1${U-Po2mUrTr+b
zZca2caIh(bepesw?cYeN5<{XjoSWyyu%WDhJ1?Eb_xE@{_c;oUad1(xiRKP3VR2zB
zT9iy`ZVd9{+eS>n5&CbFSR#02GIOkS1x?uGARVnvOeTS5#lqAH;q=sX5Ho2s_x^k$
zW<4Zi$AB-uv}>l26RMJu6OP>Pf+#x{!0A!Aa%nauH3$v|ORr4B)8)pV8OJ4;B(k%x
zn;-vTI=TTT!9Eu$Id<G`k+IWL$jOSplopO%)S>wOc)jxQ7q-pLrDMi$syo2AI2&Ox
znS{9Ns2UimjUam)dN^8hg2T=AH2F-#8%5f?oA6np33vw30&e1BQ|Rn$L$XCNHYJTI
ziID^ZBTL6+(AYbGQ_~Ud?Zsjb10{&6ef~(7Ac^FRi>0ff7tyFAB_#xl&&e@0e8eOi
zp)WUec6M_7`0>xpB$Q=^uiY?{S6)8JH@`O#pV7+KZy1fUxtHSIwX}JSTzdUDQq&H%
z9dk1wKaT#k0cOlgBg&%i&gM>jbXyJqStBvpg57Q)CDF#R*DD!6H<dWW!<!pgxp+w?
zN=*}+4h?X{f;iT1YGl&v3~s$Dfn{&ibHlA;Fo+Q1FcBLQ#*`$P_MnLgdEvtk2+>qF
zmlTsSejbZ6lW46yMqg+y3sb^|V3wGXGm2T6X{1M{GC5MFE@)&<PCiCwJt>)ENwL85
zyNmeNg$s!^O4y7hqO4}DqQX1nUHtme*(8b{Hgp)dy&#oWiYkfJ`H6{$!D0A(j5PtU
zIZULEjwe?1VlYdr-*}4Vez@_*?2%K#5&Ck|@#Du?v0?=eJn+Do%01^oU&>R$&+#bk
z-*c+>p<ez&$A}{);RyYAS%iWBZZCg)<N%EW>RF5N-4}~_`n3xDACil`drEk2r)!WS
z=;O)16w&Th*|zd9ci+8>%|`}4RsZgmP9FL5A-a8o3;v!v*HP2rJxBSWu(5a_uawpe
zOLlk%T6t{y9tHv`{-B4uSG<Kw(b!nHjrG+{plPf+u#2)DFBR2Cxo6cXo-3)Qtm+tl
z*t{1RfvUO_{AK515MW2q9$r0K18BUuZ4)~iyFqdB*9{w~8}Ot0y7}9d9rOiMIy>rk
zzVPU<>s7w`V(HKu&&Ve{LjP3)3zb(^R5NRCA}{@M4^w9(5gn~Vv^tn~X%=hOo}}VL
zCuK)k(MLF#W7XKV<s@-Z3ihKVq!#3H?_W;v)c>1^>MbH7(Z=zE^&F{mGjGW#D)!aT
z>4HlZr?GW?4U*Z&l>Bh^9cU#i+RFOX^;~sTDx20+kQ*JO-f1ExHh=Xk001BWNkl<Z
zQpe8s%W0BzT(cw{<1o`CclPz+Hb-Eq*ubWUTM)Xd>Gt@!e99CoLrAb6zP^SlrcB^a
zTN`3m1p!?+HnoFIbpsgNt5_J}q<jEYtX#$Gx8KNj)c_lm5OPuzsjhjKXOAYK^ma2X
z#KUji+d^neG@0(>Jh<vODOqEvt14#0jt=HdnZmy63Z6c^k7*Mpv8%a-)f=`jH6wvi
zR{&i>qP`CK|0340tGSn^)0@eTja9UEddRyVi*f0e5e;jEzT6~95;~pkGvQbNY}TlH
z9T{m+*bEv4X$p7zqJ-S+5JIEvWQ<Orzvv`yANDZN<0TkSm^?Rw^5Rw|Uq2aVO*5VW
z9}uKcwUQqtQgW=58*a|S>h;nq=(+y7QM4Rw#XdfP%a^26U(t!jud;LPNqjadS*hU&
zN{|V&GZ;5I3Y$S@-_dT0i(2vdh7Y=j+a1_s4;_j`YgadIE-zKpB{X=3es8yAXKYkB
zURmRUvE#WQEeSmR7(!#PiYl_-MQmIuHet};?e#hr-^`6dr#G=++$dT)I|;FclAD}J
zS8pH5v9aVvh11mMW^76fu~suJUMNV6MlXqU1|%jYM&VOrf`(AWMmiW6#_L5UgwfyF
z3rc|U4v`yg&ScxV+7Xj*gueX3YU|dmtY5$WoC2PQUbYf5vMfCH_x&VJ&E(|`9(KQV
z0h`{f;DO)oXYJY=GB3@iAjFHT6EQl>Y<lewjzkA0Nu}htliP34rL);XZpNSwS9-FI
zhws}(t7ydE)We@1IY9LII7;3=&ePA7(Bl~_bYZlIa^)D2zr9#Oa$Yh3Hme>~nSPIk
z&89n3oqKrNqK3!qq*hGfq9h|hO~Yg~q7#PZ{{Hw-{(Pu{(V-4hO~5EgV2?%Vsi6-E
zbL@DUk8dS!!VG+_9<q{>5z$z^ZwGg8JjzAmvoZO*_`}9y{NkF$R39tkwW<LgTsoiU
z*Kg*OV&TDy#`3FmyNR-e@ymI++`H`<lcJ)zG26hab#A6Obi<q{0VD(A!Crp<>-|i>
zD0A>FMnLzk9_jUZy1KfMB#DTK2>gEk$MQLyPJ+Q8k&%&~$mepo@caElMMZrgpV#Zf
z?RFC#9sP-Xe!m~5)A@;fMx&8m{_>YR{P4qQn)b1L!=W#8XwH`*4Cc#34dpGoSLosg
zw`PxESpN;eYQ>5b)YsSJ@p!OWt^DwZKm16R1B1c9TW`I^-o1MX4Gl%pH14|Vt|9qW
zty;yVO`C{~jm711@!Q}2c1XT;>(;Sq)hd#blIZH{;-QBg`iN#^Fc{dlaU*ZM@dg<g
z88kLF^5~<FeuPi2*Rx~C4xV`833NIgmtTH4Z@&5FXV2E~DaqH^PPrD&gk=2}CZ+!U
z!b)Syi5eD;&OGx!hw2+CNDigET_!g!>_7SqCuYU+-Rz-9WyBBbD?~b-j$ONU5eNjh
z{r20LH*X%IDALu{MSOhx85~HGB=+swM{jR0KmYm9nKy49;o;%b*4C1glys&&Q4~3N
z@E|QME!=a@J<Odum$bArN=iydOH2EQu^|W?IdX*h`g(r->t8cx&K$;%AJ5L6JITt*
zI*YHYtc>dFYVN)FUgpf1!_1j8S+iyhxw*N6CwQmn)TvX<nl%eWQO@{K`Tc(8&6{^l
zWAi~9sw&f2Bk|Via*8UwMB4R)ST%Z_LDs%f%->!qW7ODqI!^WA3<`)fbv#=bAUDNA
z%dVsR@r7#2od(QZZT#-8Z8SwCkz)^1UE7b*VWz#IkJdI1A>n4KD|+bb_alkW)a1nN
zhpy@-zJBd`uK%C0{PE`-*;v#;a<Ym0f3|~NrM*loh{G_<G&8EI(A?8aLr*_~?BY*b
zcC+bN2@^);VHu){zbt=&&CT6Jg;{ud;|_9?lZdbysc3BA)#8&Z%CPbBzAC~(Lx{4P
z{zK}fMnhE>HO(H}J_WziOH)HXiYDNc#SskatA_b(*|LSJuf7_;-;dw#XYAOq96EFe
z-G}PNNs`3&?c2HOrkl?2rKhJ;QBiRgpD2p#-Mg1tZ@u*lUtC-qZEbC52^UcmDJm-B
zmRoK)!xs_~g3sqW3oI7|fn&#xal;KaoZ&MXjTj6DWLZ9ouduN2tUe@3;^4u9c)i}w
zHb|;UvqvL4GZ903J4Rm@OK;nU!DivwZ%$<CC24p{tNFzvNBP5_ix_arSj+-%tf<0Z
z)S)-R_D!c4J2Q(>v$FW+YzOOBm!lc<c>BB@IMRm6tfQf{jgwtoEM`55$HU4uPw>R!
zhsnrKWA1o6;Nzqm%9v<7o#i#S(vz^O8h&~Bpu331(Yk7$T>U1iYMhKq3TH};o${`s
z$H-zdAj=ApD4~;d)YesTysntH>-#Y2^&kjXEf!wfwD~{w4Xdg~Nnth1R=4v0vLkHT
z-GRv>v+n&0US3gqehRF?YPuuWKVJZ$p`o<3wIPZkf*{b;)I?HJ66)!S*&pzQgoM!A
z+Iohsv$K=v=;)8|+3j|knwpTL!C>INzCP@B`&sh<V6j-v;&Z#*=ybY|JfFp4p{1qe
z3|}A+K$hh*zkk3NA0Llif3_Kxl$3<Q@EOzYiXuh@rp*dxKxgC7fnKhfZKblhkFur!
zMm_jsm5DR5dF&4}2@5sS-{(iC7fGKzn%kD9GJ9bn-YzF`siEiqNhjbiiv)rizMx2`
z83esZ_kci{MPtR9CVud<X+-J<b6*7%2x214)lYgs6cNes=o<UU9v_O~Q<%J615QM1
zIG3k~Vl@f`Z7FzM{UnE(hcp9^bc=kWAdhB`AHUayUosGGw_#LO6hPAiR5?IUF#Jc?
zw>{iURE(7{tAyLH;t&H!(Xk|X+Rrc0T@VChRprp(Be*@Dvv%MS8YEekdH(qqxbC`Z
zQB{@g+qbi5(S<l1j<Z5O6h+~==bq!T%PzxgHnV;Ec4p6>O+-ZGKk=zN_uR8AUc4B)
z-OkRPJ1HnAAU;0fEIw6LdG^_7x#*&c2n!2i*REaU<>ir{p8iiesLJ!tKhJ^%3y6w}
zV%M%+q^GBoo16QQce(Gr`zYMK3lPv*EIjbQ15BSfl_>=UNWx%SpBi-c`MB=dYuT~A
zfvK~S=<M>59BZbl%}L{_K7x8PQzk~zUfV`>kI3X~8>LkP#HWQ5YgO4**v-t@2?TvI
zfq;s`VZiV9vHws9lV>O6Yw4w|-pibs@idjU)8G`Cm}BSI$v)x|9q0odPM-3UkP=E(
zw7~u{7t^N1;B4)o$)zJN>r>=(*Ho%nTL>bO9vjc8rdm{6EV<!B=a`qhee7xMW@c6z
zr`lR@X*$No$I{T+Krd#-$2usgZ6qNsg*c1;Kl1@=(BJ3A6_C&i3RY3!;0YJ=X2%og
zcb#7XD-a0q>~HR7j#0*H&@pnnIW#G<d`6fns`?R4<-<Zt(=<duL{Sv<hN1aXML|_H
zL`g)J<&V{J)YJLcMM**q${36v$ETvG3X&ut2ZI=m#v$iYRaF9k0K)0b%4jqZkY(QP
z@bJ9{A0foy`1As6B!S=g4SSp~pt~eV9659l-R^ayM};Gyp@WfYh)XYu=tTj&C}5Dp
zPv8?UoaX(Pe3FP>81&s47N2hTeA3792?8da4x>(Ynoq+Z3dCyxnoJ=ir)PX>&|Og!
zBF(X^c(($d-b{!^htVJs@cG&NZaKS4I!R8CM00x>2#Waj9p=vmMW*IhaW{AH+)EWm
z(V?^ySM%ZvW%P$eF)BvlRD%m^h>?KPM@xs7&=4a7U2Z!1f|v~gjg3xB4il{>8~Mv)
zCzw4yiK2}sS--!7^i&&b-YBEE#!YT^7}9Wku{4d&fj$Og0i)_=Md3k?cJwkjK6YrV
zM+?%>>m<Z%<h}j7*x%aExcG41-MgC;PL(XPpC@+j;jQvcX2)B3Y0n-4=4iaVjjSv_
zMnrTx<<(_uI#EM>bQGHp7g5~ONot6R*A5iZ?v)8q`gpmh49Q?6&TcuUwJryOJoDUf
z3JPNA>Tu)n22oTI=Ya40!LTGrqPn7j`0&ur(d&7H&QH=%J?EB(Nzhcb6}Ax!h#Xvd
zoWiXYyzoLX)jcq^Ad>o%ZFJW*^XTgh9Ngc4Pll$t4&HeG6s2p9k})Zkzdlnz!NOdU
z6YNaMwX$W+Njf{-w6%I!yXh3}ZZ|FUy{y{PL7?A5Uw;5Wf)y{9l9ZQ(zM~TrnWx_G
zz}-ARS$#i?uN#LjFo4fL`~YuNQwgYWpl~Bqik%y0%%Zxq2-n9fkH4?qKx0ogWo?zb
zS=Ns|=%l`>gbi&0HXPWG-X6>KxoM2a$e^P95dD&w$JcG6tgaG+S?19V`#9d-iDdBb
z=<01W`}`=L4t}?G2co1<-`c=$Hyk8F@N=M{5#?N$six7|<^jK-Jv%FS`0rJ0d%J`u
zS2mpgr-X{CBCF~rnulk2&S3ymRV6qCR-&pZ0Y$+tD+Cl3b%@3lRYg|*=~9R0{W6T<
zd35Y@?wghXvMTbe+r}Zw8WVHPEPKC`jCdoq#AvR+X)G-V>o|O(liH@i)3&?`adb8I
zGxLtQv=&zrVwJ$}#UCC*j9H+&+eiB77;KV)&Z;9bFB(_7i^NeOq-RG^y1$k;S5#1X
zyz9&}C}^PSx$5dH^g122g(op3#Nn_G-!;<f^RV*39`@E$(;v`yan0K-zTy@_hg8rM
zc2+l1TwjM<NZ_tnacrt>Bh;uPB|3qu=m-GzwhVA(N*JnSV#&BnL`jFi7QywSl0XnJ
zg(h&*s5mrKV$&utH`;=T%EU>t$g)a^n!=(PvkB3i`!}vL8VI=jXsU)a#)8pkBrxE{
z8g4s(9Y=!!FUt-bVM}c*9!(@aC5am*jU_kCbUGqjK(7UOW&aV@S2f~NMJA=D@SPbG
zh%ku5!oLJfW#xebyix6C<^Nuc<PV|=0%dizyl}9LgH4?b1Qo(<cBZDM@V_%AksD$l
zs0~(rd1UoEio5-12?M=OM{;BY3v#l!Bs&5A!-B$O5V?Q(YFbPY+<(aoY~t`fG*N&f
zjcw$_MProCpM6h5Wbw>6)~qRK?$R+Ftaq|?<!p`|YUNa`6FI1I;f>R{EvgoCY$%Q>
z6?ID+lV>HMc>>sDqxkX7nGCpPW=)C&pkQhOyEjxad0`f@7LhF*Yngjt8Z{eh+1BbL
zDm99E2`U|JK3W?(v1i6m-5BJ@*GEuT(a)0E(fsjECzIxd5(uip_QTTY^i0mkCOh1Y
z$<vM;kwkx6HJ*^sSUwWTB=OtJ=ThkuNDVR2K49jGg7Jh$XECvEH)8G>&{R^RBC#0s
zWMqwJ!;z!><g)pM1v+^5cmsDWnN8!Va^5L-a`)0p*i(9pVnVs^%89&La+t)3WPW!=
z8Y_#-n3kG~^cl{?yg?PgY#=2uoSCXdTtH>_zSi>xbT=3by!za;WS8wGAu60-JpVE)
z+BF_rJc~Geko(qb$7_z{^;@qX$s%Fa!7rDs<n@|9etPj7QVlW>ZP<YlnahE1FU0Sc
zhb6H7v}PSo9CcFpyIaxuWO_PIalupXla!Rf52oi3XE9LM*2bed3h5Rc?D+Am#Oq}g
zRpT2^K101Rfg5w;PABo#@CAIlUvh%BppJ*Gxs<E3V*jJ#YBh;`?GJya)*8>--?*Gm
z>0b*_Nz!q!csF<KYiHB{EFsMJ@7?!023!nWa0zoRzj6e0{|cJ>#XG8~*Fv~@-am@U
zD*Y}FG-&6ah9!t1{Y{lDulMl$ZP&9XF$_%**^yu+=}+%c*wRT-W-Jx;b-Y>G&bP0)
zhMyE9;FVRfLQP!q!aANhF^M~}90XJiog{*$eQcf{;mki^)a!U@`%bLU$*lj@B^U((
zRnwTBmc+D#FfMw29rx}i<)w@B@Tv-$rjn78#xE93z^kaIH4~BFE}TUEgD<kIq=qXq
zW08cxQ!q&o@CRiSG>keOBA}c$eMCVVJjzES5L8ZwvS^6HV1Walte_Jm43hAXcacO9
zRaNjSDki-iLDSB(3#a|5{_&bfqKKersHe@vpsHcg>(EY{-jXDu1cUe#6}==O3Bp<J
zeW|}6K|uDYw01c$JFG;0C>Xb+)kzS6$Ve+j{orW0D^5`?#4$VDfZ_{K-{dATAq2te
zrKi`AG2B61*zlK;yWc}otDo$gF#6gD7?1_xBh9q6d+^B`=_wARb5KoWIY@`gg)a~w
zAu<Nz$0%tXecd?hq4f6k5D*O{huUfE>OwGBiMRMDZdRF+8ufvm!?Ht-EFGIjhs#Y^
zNCXc37p+YTq>V`+#v{|`mT~uZP!X`%^^8i9&O?(>)eszUymQ-CWJTKvsw$EsqSxzA
z|5-x-N?Y3SYi4fEPr?%jpaP@fqDc=i@lJ6W-^rPYpsD=v{j~(6vbbkj7J+|}TucxI
z`n^F+1|5<hBA}sa8mgj@7MH+%OXd<57I{`lqz|yJfUKUu5;Q|NOVS;@)jNQuY3Otk
zr<xmi;y@{t-A-gpASxt;Z_J#+ocItlQKI<x5#Da_FfH23vXW||qvLt#;%T%r*YcOW
zr8K(y7!3xdW@ho@S>q5D84b`28t)Yq^JZB+eSVq9kWjukvw%5?;V47BucoqW_kLXA
z=@f`v{P{oyE(J1T<GK67sYDt?)*d*(Q$_XoT>-wc{C%#PF_Y^vBR{be)RzbSQdzsE
z645A9TiZ`uLKsWtg;Lrqp>J#Dsdwx7`CT*FzrGSjYBV#9J^byRMtnDq!g9Qfj<{4x
zwsi4-OQU)FnIb0LF&Afj1N)EkF!zcvRPC#wqc6zi*X6SM&6AjH2F8sIr{q`%w#aa1
zPO$OUd$#h}+t={G?~0i)IfA_WXz;46-`>CvzCRg<MH;4%3b4E41XZ0buDM_uUfIus
z@2=)=-~Qi^k(RAIw0SSzTR5M`*K8&`HHBNJWbpK^Lx_4C_g<9F%iH!+I$;XerdxTp
z_#oT6!-?1TA$dDlX`H}MCnkKc`jx7(=Is-VO4sw=Q9Yr8hbu43z-$s&{>stw4|Lbi
zFq<umkB`El6H!%_>ZW=wdU_2pk+IB5ib2yf+IssSB#Knspr!yIna!k{^z?LgF`x~;
z`l0Gt3S0Y5Ybu{ifuPLIGxBL|s^#M6*RZ~(75{0#Jt!Kuc48h2)1rnJ1RutK6c;<{
z2S^FGBM1VGtxa70@_X!Q_i^cjJeKCA(cDtcEzho`UY5{{BJEurEI(Mn-J1^5;q%ey
z_TcMnWYLT3=$EW~tzaxuqO3f-WjnX5I)q*~_|d<zV<$gYvkz-nG&dLIBDuS`^@VrX
z**Y*}(5<FvoNQ_1_3c~u#;Sv4B_=X8E`-%Z#a#aSZY%~J;dVQTHUomBBO@xDNRyuP
z2C~;Qyo!d`D`5!uSvt$e)N2ZvIxdX-g*p7-wlNGGEa$Dm9(L_)z~u_C;EK^4FKlD<
zloYnCI>Cvu9vsm&q>MP`rWq(M>EN1MClDh0a2fP`?dxM`KHN;)^hB;&noWdFq_f?_
z)-~l=Lu{nP7y&>1dNYDc!G%a(UIc0JHtd$+r_qr_5lvC4sXE9BkB&G`0~z@j@o~-s
z_irrXrfFk9RWZvhj(7BdCeYc_f=ko^0(0}HQ(s=p(b`HD7EHk+3IzOa-mYk6RHXIa
zGDV(lC%=2Bl<U5hg|oSr<;#y#-!G688aThRHJA(r9$5A=%j-S#d41fvU<ToO0S)N)
z2C!PKeE4WkLr0iNBG~7{D}xb@zx~fQ&?EzX<zFv3RaMB!n#dDN6rMhKl5fAd5`e7u
zIOb%eaB*HX)8j+%$^S6_TH0HA<&bnn`|$caY$z$CBB0~X`PoQ<Ky7<Fj>r_&-ElPz
zWDrCy8<oV|$KPUOT|YT_;b(TApIyF~?@dTW)!>bd@1wUkc=(D%WZQM<#Bs!1j2!m{
z=#d4Cu1@aVd7R(ecpd*YAqkJH^6eRuxck**+_~l;rFUG&P-QSBLEu!Ehj)K^8yAEb
zP&AD+n~uA-pWwJ}5wpgOLF;d0dtWENxNsJBoiOawxBqc@B}$}6T9Az(OL45;Ho)KS
z&8DcNlm31meVs1GX2f!-$H$zRF@*QEa%yK2xyd%dvlF=Csv!MgQ8>FijLRE5Sxbns
zQn<68>@l$jo*?`8Hj<teO7VdXN}OJ5>-w3!Fb!!_9ld=noJce{1*XMogk^@37-pya
zSPgL#(mqw@2B*h^Ta%cPo`g+;Wyibt;U!Z(P9I~=sC0Ih*Dxtlk2NZT{AfD^UN<>e
z;}L>ER6$R3TQ&BmWYS|JD6elI%wfS|(YSH?cuG5ZAUX64*MT!9CiDK?Gx+NxB_xlH
zW77C&%<eu;#HOF$0?Qu^a>r#?aXTXI9j93G(k23$#_wj1IxV0+y1NReL8%Y^7Gbjv
z&HJ$%w94X1lbD@1hCZ*4<4w)1KVHrAyASa4{=@v@>Z`b8bQC^WLli}7>Z`b?q54b*
zW|N6=NlCoCbTTvILII7bqsOs2FP|_`rN`-}tgVBc<u!N#zbyX)TQb|292-Wz&yOfd
zT#%hca91^7dtn7vj?d=uyllR;a2^3!L6Bf?`AKBagr}>O$98xAW86$OdYh}Mk}oDt
zQic%BD%SW^W`-LW@DIkn#W);*LVo}hokBoW2eGrDj9EN?J|j(qDRWck>G3gjnvq~Y
z#blHS_+@-P8BK^G#9<(1lpn7wU{B8Cu1p!DSq~D7nUX?Sm<dhQm_2py+nKp&6n*^x
zLc&Zez9b!|S0y~m$kK~U_+%J6E*h6x=IgiRBWMagd0;+9oy7m#IfZ_gOh|~4U_=&)
z#!nXx<FMITkTVLEQJ4*oy<ia^@2aU|c3vJcN9O_}Qxg;MDiC5aa>uk-G|7NoFY?Vf
zA()IN45EM|+{Xo@^%z9x_XU`0wS3|8BZvZX=BJ?{@tyDI6I3+3eg(Zj;-+zi^HX4n
zr$J&x)3BKa(_n<BkLI4qC%Lb<f`?}1;4mBTczkCi8xm0H_9^J~MyxtO{-~e|DhfJD
z8gi#o6`6Lo51ZMH&1l48G?Ek^#%1~A_<e5&S3dg=&ureom08yjDuArW%)4Md?_ZIR
z_q5ifod&Y~vdjlci6Z;?`?kG2d!!PdDq=Sph_ILkpY1~$qF$2Dn0l(J5ScWZl{W<W
z_0}W2xN|>`ZQf0ESQPgxp3BmlM4I{sK=twB{=<COd0G+#qO2zRy&xEeHoPrH^I3g=
zaJ$M^gH%-=^eZwBj;Fz>!{-g6o}MG4#fTA5JU%qN@eBwrs2UpJar*H1HLMO3R+C70
z_~3Uane?3g5tG%x2T58&LI(Q@`Ud;8nk6(@KI7G5Fr7>6o`A*pk2EkA!@q7rQ4|De
z5P#K9*A%pvENA8&1|ty!LBMVr45D`Xe1uso2!Pw?!LLe$Ta0*p9s+`%5aZ_?cNh%F
z^bQ1xjx-S*@S`e&iiV<|ho^*+BvEv-l=m84{9yJJB2OQOsH#e&-3oyo5Cr1FLZPpM
zW>q4DK>%9y`DpM236GD&A*lHN2~a;&eu5_s*7DHJR}p(UueGXaAnDK{pbfM$|Eaay
zanVA4RFHwDX(+0SqN;>O#B+UiIDaa4)8h#eY8`woS&?!217`%*P(c1m+qUty(mo!)
z?g}!)>_pkDDBgZ9e&UTG&Mf~SdGsQT%N)&yoYB;E^-|x}$FhBe{Ak5m(!Tq3!YyVn
zhw<LGuOZrEICH0>DrgAkq#(-2!kAypXaYfm1KUp_+6BtD`k6K*j_fomt<3|px43EU
z=p!dT6H{+HEjY;RuHpV-3qSit2JT~(>}wJ*#6>YLLty)R<(TIeaA}&#x~(nDU6P5X
zu9LzFH&-l9rTTCqReb_8CWNwWdlS<y8iml^$76pw%6*S5<oQ1zB&i^doKaEqRJJ2W
zgfeAZ1j8>&sBoyd9Iq*wImw}HD?N@qGKI;Xkbv)R>)+?vxeIt@^B&R?;<z+_Jc_%E
zgPndZ&Prn0?%iB7Yc`Qa1KUm<XX@y2Y&*1@ep4(rO&&`{TRW}IRTyKkY3TD16=)+r
ze;$eE&nFRqrfO_iTS-W$$eIBgIQyA6F_!2E9j~tJJRd#X1?;Mi*Y=lith4XT<QhbU
z*NZC{o0f>CL2g_uX2H$!V=d@U9}}N!?WDo!<BD-PXCnPSIMN4jdtB_QtEZ^7AMtc%
zh=$&N%;90!R25rnBI8XmFYP-*t4}`b!wR^2c(=NTa9ap5w&ADe5CnmPb&X6LJC-X(
zC6O5sLWogMZCf+l3Lon(U^3|Ve=ohnj3?iw*)Nh99?tBXEPge6Gz5cmxID}loekbz
zwzl+R5J3<?6a`+{vVok3mJ`(L&N<tqD4d@nO;8mYyFILXzXg9=7cEDt`M;lU!)*&8
zB}8GvhDL<eQ~Z97hrX6BTy6yn0&l%rLr;AtkqLHIt*Iv_C6W%+%%x*Yyz|xxrd<$6
ze}j_^hkCeZdK5KBTiMwzapB}}+(D5gOS4%1*L_5%L}8b`X!t4W6ewI<M~l-*WNI`G
zmF+m4!B2BwPHtKbuHzfn*#*<`CeV0nBh|j4`M2#_Lv&g;fuJ6{+{vz{cC31ZzicX`
zAR!tAk)-e_G(q6#i33DNgmd@Gb;vps3*$8I-gK0SscHE8JLqtF2@KTJ>{qGm?D<@e
z)mrMhSi7bcdxVL`s!q0Ut)pEwGu_s6{%Kf>A~SYe0ZR{6^8Gi~bJv2&MCeuC+IN8c
zemif>9)qH3<R&L`eQrE|Sot=%XA^Hwcxu}|;!<<DeQY#=U=TqNxb3ND@Fy3r;_^vM
z&rB!9dYHT3e3z<8*|fAZvF21i_gr@ofuKx46Zq@Rmz5EQIRF4407*naRB`P~Ynbuy
z^ISSUo2)P!E{~fH$1CX4O#JEUd4!89eg$MjMf?|Fw5DlHO-th8q9UG+w~}ntQQy+S
zOGV`XG&!A!LL90#7$WpRYXMo~f9FkS`STn2#rxa2c61WRexBG|NLpedW25XCj3NAV
zQVPFbzLLgyGnf=@qoSdXzZBMU=M`6AQxr5wKvtBq!ka$uz51{;`yiZ1(*#rvq8wJd
zy(f5P-(jX@WivlH>|dUaemNwTfKG+0uS;k1=2KW4MkJ#d-GGxikC96jr_<5kq_e7v
zBaS%oGC)vNJgy*9zBi2rf3=gm(dh*GoP;EW4CccUp{izp)MN(+ElBw(Hx9jsMRQZt
z?4|N(BV~0S+FE@$eLiX$T(tOA>^?uUu1Y7&@8Q??7o*q=ELxN~>{s#n+&sB;3r&rU
zOigHF=l(K!+S<t((kD8={ysgzz)7ME0*87n%*`~@A-mA)^t3qLL|V->bhe^zjv_4J
zW!bI+jLpbH7igo_6TpVRyF1rXZXe6dQ3lp(nPhot2>YC|t?-0!7A#0&^`Q<#yOp_f
zQ*g*GRyG>XPfz#g&=3LvAMYMM##^OzxK)Aisj1vPeH`fy^Po8+2&h3n8;_Rp(vd1W
zs>rO-Iovj7G!X`AFr~I2@Z`o#1S2x}>Ev`2prfagr*<4<PfIVM_E5eyEuSS>@knR%
zJAqzjKWj=)vbCz2CYKkR$;|ZZOs*T3MMjtfMb*$Wjpw%QK#0!byW^8S(Z|d0_ww4l
zV&1Q8LeiVaPfOujlQLOde2f88B)^_JmZH)lEU$BN=bXtznWQsVUR6sI&+a=)S!X|@
z&cvM2qqucqHqmB1s-~eRGP_Td^XlPBn%sV(!@{{~>I4?0#UKe_)C)Ylemk9pP`)=a
zAB&){>d;|IWd{$=&c!Pag7OuOr+BWYk{@2Sm=t}GV9?KBHtb+SeJ2a1UckN6GKY22
z`gzc2@pSk3d@Q~EYTCM8SZrqe-XO72M*8}Lc)T*IrV$fkrMtt8WYQC6)TnPC1k|G(
z5=|{0!lG>$1Pxz6!EQ6)9`Moc3=$S?!_(&>C~HK;Sm|tcBT6DhgNUMO_<bs2Av&5G
z-9#sapt(IbWr5fT6Kx$nL<wS|t;2R4RaJ#vkB4BuhtU#(A_tL!KEgsGKGt#6AM_)N
zI=cG%Py`)up&|4S^x_lr#5-&>cXy%cOvKxabh_La3}yt`hdU6&VGpI>)sJ4%5n{2@
z=XRlL0&!s>pR1|X-|NE>W}>61A4L=a0fSydZ#|C%77Y5K=p}IwfLB!lLo66k6fvCU
zk(G}IGV3J?H1#Z}N4-u$CkSZTAP7H{S@z++H3k#i4X5poT~LyQ{xmW!t17|MUgQEA
z0Yya=MRbBdP*Kh@#RLTOIuYr#ADOHuAL&mN2A@?F1~s~W4%XJ4?k9M9{B+_V?}x`z
z6a;jVNKpPq|9VM6CyFSlGUV8Q83op-4b9OM1sU-Stnk$)m7oIpGqIr>K3T=2lfE=h
zcwW0Td;oa=tJ5IgC-4N7j~?p>Wrg79(DzVne;mn*f~<V}{i>=G7}Da`2*}F6z&cd?
zvigaApY{7t*(tP-_7hZ;PxX#p4vSErtG<_AM_P!_Nnu*9?aWB-*ielVkqc&|5@8=)
zq^@IC?9`{TWQ+lCdk?R@+rR~vjYeu|p{S&bh=N=$$sfK$WqnyA?``hl2S3iIbXz$m
zT@nlDq!AhN?^%jFjuw)WJ%OXg4$-3z<=XLCynEmPQb-b4WLwx>5A(A>h;Q}t#Ez3(
zlNV0Wsa7V9okFVh3x>Tlja?fnsc-QzaX}XK#SQp1k@R#sJ(x#|P>j%j7YV3rJkU-?
zdNc=D74yg+i)pN=W6iEE#-^Luw7!b&jy`_=y><NI$zyo>ef;s>O+2--o}F(TWZL3%
zo_e92oXM$(9+}a(R(7u~<KAEG;COR@7auR=q5JpIJ>chod-w48-wt!MxRF0Ryq70l
ztR!_z67Gs7RAe4|yPH_OKvP#Y5B_L9zj~wyk8k)JKrrZI*{-ep@YUtCxSag<y*1qb
z?rQozW^eL#o@DK*Ui^L+8*92Sr~&-`PO6<ERSgZG`FVEz+x%pGA?>Y|-2K{X9P9TI
z>#%X?<Uw|{4t(MBqiGr)JpnG8=is>)t7zy^xccf*<mboJu&H!JV2#lENZMyB<|ixk
z^!kxC9p73K!VNz@&Z5~-Ske;t&NuVuDXgT{6itLpBH;0}^tNfZoBNr2O+M>hDq_H`
zfEu7D)Io{~PPKUW)%|mc6Z}}yqWI;nE}*ltje_gO^8Fu7L??=j8y`!<v4%nO8VwNv
zRgvj;$^@$G+1hO)DMXL^Q<&DO25}KFBx!9dFR3FeB8;&y7Mgl}Lz;UJZm(cQvYk$s
z3)$VrvDQv}fdKWLO>_hXU0tr4eF;)$4b^Qe{OGbv(JLxOYXm==J002Y{kP0+Z%Z$~
z`@?Y-FG;4eu8WsnIYwoJ3$sIie$^%P`+amC*g<S)$Vfi-|5go25by?Nl$?B$($a^0
z-v=p@Wm#eVv~lb&YGLw%462(Ie)K<CoT}<$&yG5(ngh&QGMX@X0Ksl!OuC&th3$-+
z6h}_Fg%edCZn`BGgRJ1N8HtUtV3bteUR6s*K_YT<H=FmgG2`NNYIoOCe6pV~yF^EC
zfP|zFjH-t{#|E$_M{q$BRP`#%UNo9ClOM0qOhI16ut9f44sxQo8JpG4)Y189&Mtg<
z2h-CM(GStY=!7`@!2ppVQCNf^qS400)Kmrr`iKmVCO<x$Ek{bp%^A<Mlz6t6R}vK#
zgWzgrZCx*Ob4L+n`r=JjMUc4lJCiuEtqN0^8IMQB=M9oHDfRp+LJ<rG`P={dCA0K?
zA}l6GG9`bdZ8ua!B@hfEod)(TW;0!GFY9{z{P+)l!C|uvySb5kSYHh~uRwQ$!N89m
z`Xh%+j?&=uj?CUym_$L~(MSIZfZbuIrKN={ueg$_mrUk26Y~-IbY;Fiq@n?^ZEHQ#
z7NnjPdv~m`5s$&l)cnXZ7N@tqm2zDa`H4C}WB;xuCe2Qw?noomZ8D?A$B`L7{3^-4
zt-YLV2y(&HXgcaUX>v+T92-teSu;Xt80m?__i6I`eKa_|WJQL78l?EtDH38*i2axn
zU5d}i?#2#gW@gaZ-iTLkCp%*3U}i;8I9ON5l*~*5UMGdk{mjiwq`$9|BRw*6)8jbR
zTt}A_#-!L#j#QTu7L!J*UC-|FO2%i5!Xf(DS<}R{j7%iiMM;O7f~0dySg9&(c=yEl
zC9pJ2LlOig=TATogppztUtzPau&|KvqjNBsOlX?MsI*j6znA>6gXvM!a~6aeE0>*M
z_9Y4Y<-tPcUYNm*f)Gxg>?bNEoZ1toI96#!YpADA2xqRTgD2NF^TXRl<J(hAdsGsC
zda0hfzL7%r@<UX5l89;R<%KtD_}X_1=s8l)`r-k8^xbhBSbKtF-6B^lh~~A|D_MNg
zMB<G))<3tG@l%(e2qIfn9%Jm-xp@5=#oOvgza?+j?-B_3Szo-9ts$ehV_Gg^XEm?&
z+xWi;LkopFUwMPu7hl4`mKGvqnSFI9$(%l&`o;=2w*>h1lu<mtWg7((=V0wGNA~%-
zb9FD5CqshJ&mZ@DaR^Q>v~~0J-WCFu2*$a0v%JcIl$4KHvYSnP{fwG2pPl6=Iaacp
zx$_pYueF<<+uvhU#u%cb!bvuLawJGkOAoKCsN=RfC((PdlZu88aKvDC^`5_=`-rgm
zYEyfAJ9@qT%shWkbvh9E|LmQ2m{rx)|3By4HtkODeFmlg1H;fe0-|DKON=!pmY8Tv
zjH$kFs=mgA#Ka`_XhcDcfFg*YcV_4?%rH#vz2DyNDZfANh!9bV#OTlaeV%zZ+`I4T
z`@7fr?zPtTeX<=Z3Vxly`nS7?50MDB^l;PHw-P-%o*2c&?gM6YolX3CFKFF%>^3i{
zg^6t0&_ZNF1ft^Sc*Ou9aA-)+)uXknTi?L9ADD#HYvW*tkB9CXOT(c~S|Stq&NuR~
zyWzGwi+KB){Y1tYi82I|$WyZ7h|mSL3yagxU7#|nq7adg&tgqIE89JcNr*vGKU)8q
znI6sCmDLzTJ-KNago*+p9-c32<ld=8$g+=lW5@EuhRt})gPib$V(w|hVIAb8V5F&~
zi7?5=K{<lzrdA?--3)1s>}l>tZ#sdEQ1%T-cw3Is=ZBKC6xJR)NsPfwohuTrsg)Z0
zxt@>8&YfL+_gk6#?=Q-!FRRC2Sit2o<I##jaF#HL&*orMR8&M$QxgV*0j*YxBuT`?
z#1Ik^^2v5Cill}L$buVRbTr4BWxoCOQPh{V@#=<dG#XGNqtJD=aiYzQPAhP1cQal=
zpkQ_m+t=1{)shU%y%tili~vMOXn6VW<=C`3eEnu#d9|AGv?#idwDQ(l4U`}1;Gb_)
z(`S}wZ|P&pzCOwu?bIJ?X8qPK+Rc7;tSaa2O&z#=%7ri%Z5?&2Zm~1g2&<~<C_7n>
z?IVH+>jtcZiYit~;poYOtS+y{qKd?8?7V!e2HD=rv%5=aGTTT@%f`}C!?>bij1iHv
z)i<$dY6&jCOn+-TUz#zQ_F*?|{U*LKy?{dle%yYE+s4GQ-!717(9<w5K%`cs)1hN-
zf}3iukz%88PVF*6ukzvxHH@8<gvYBTFDu{(re#NczC`yRzBth7bd;5qv2^KDLPA1F
zOG{(v(xqs%7pGzbMfd+tw9Vix2;#E{zu(WidGomT+G{B&DB$U*pGK$Ced^~SJ6sIf
z{{v}9mq5~xWf`m6bIDFgQGA%3-qVjjr`ZuCtRR9oA4rmf$Kzr4?Ads|-b<oe3W7kx
z!FK-dv7P*L$KdJRl~@0EkjMXYfR2F=bTa#iMmARmI<dK~o$uVeiOrP`%HFNuhj*{#
zZ=1{)bo|Pl)qM5Z^+<xip0^Hj|ATu#aq;MH%J{~8JFwc$zr2jo<={|fHvlH{0DsxK
znfqS;JMACCVSnGanntUGCs(fEXY04)^E>#(Ys>ic*25t6v$v`5wAOB(-Bb1H$^nYX
zD}O2FM-Oab)8S#3KC+v~9^22RjrBaguIuxiOBlo##0?NH-MA_sbD+h=wO^V*>BbYh
z*ce4xijJ`KOm4e1pFjM)3TN*C-+1U4Nd?LLaE^{uZ<NtjlgSi+CwKf{5-+_`$MQc;
zp|e-!>LoF3Tv<+CkB=o^n@H)}3S?2wbzjY6`HE`NQ;bZW5XGuBjcB7{`PEN~nZ33J
zCounO)2ON6g<A~cH;>NYop)+5gq?qv6a<xhH5HT|F5{LPzR3@-Sj59?c9QiGGGAlE
z5iFr8gs5J+<!~k@MB?{bF+^vgmE5SR!iGb;*wmQL&nCz7W_b;LY8EFOD_OR;jOhz*
z=jPo1bWL}auvjB^-5Sl>!-GU8Msxek`NYJ9@zxVNgBDg0Uo;5dmWYhiV37<=%G9!U
zb1$Q^!?1=$bIlbQ3|Doa8(Y9#w~R)k$V|Ds5Y^^k{%zCowf7U17>??6;fyg71q|E#
zJn+zTV(?)|jpP3BO~lr2CVOrkcYI?E^({{B`gRGv?tTD#UWNCaTUiQ}{k64qVizI^
z(Vl<Kk*X+UXO7{XF)>sRdDyV+U9MWN=%egaR#kQ3w)axq-@~9&M)rCzSqB-CMXW9-
zGBB%XDq8y>7KfcX=FG$=NmzU;cTX$eKuh<h@`SuDAKe2IG2tQ}mye+#H%_yIPHp7p
zD>WyGFP>#}`0!!k;^N57&HcptdOtPiwi{-$Y<Ue|zkd>gK0V+2);Ri_hA7?IK&x59
zHQy*9&E3oX1}{@4CDB?p$c)RfNsESewhi#(?-t?nDWt@Q5)&OlYC;GvzEsV`MY+V-
zt-SVbCtvzX0k-3<Y&c-z@|p2$+u6<JIXSp``l%cc(1eFFbfSr)ohqq$ak#pz6wS#Y
z;sRtkK@b`4Z{dh9g*%H<Y4+$?oR#pA>d(BfV;Gy9NM>9HV~rl#{2?qDTY_S4AvLRz
zvGLIysjuVmS@S4PPh)#s12b}R$qW~%v`Ea!&L%x7^glhEpbynEW&UXN!$WBFT6XQ}
zqSvZ${fz~|S;8PbyU=JfJoC&m<mczJXwjliw6Fi)X9-n4Sw8q@?KmGf@C3U>5ML;V
zP!PcH=h<hDGWc&Xs2ks`<n?!2IK9HK^+*kG9rK)WtCqi5iPaB#-#x+amL8()r2T@9
z-(B0q%gY-8Xgb==>h<jx9kuUp*x23Ne#$aA7o6r^o-aLsTZYQ|3U;-0oe`=kOLkt^
zx{YSL7f^X~_YU5v?*`mFx_$#k`)vr4nV-D<9!*vs{-HX4v2hP>S>c_sT^#PS0bc&G
za~C}>31kP$N)O=htJp2Qtg5KxqN-@iW>&B54iZ)nUqr%ES+SyytFOu7=|@Z1zN?Gg
zo?%YZ3^VJ>JmN$vRVU4CTwTe^f3@Rx``GwaCA*KCDSKfT@ddFw^0zwXT{nUG*&5WC
za5`$cdG^_IdK@YTw>R+oOI3Jel}&G-Wcfeq>FYG{!gI$cJ8mK_JCU~CHQ0f;>?GO_
zH=zQX-l*X9waxgY^Y78Bs&c%sf@gOh!shj`YJVyJJa&?gs;KqzRcjfalE|^%ZepSm
zY3pqRVE@S@ynLh@jW&#%rsVOf^?UJI+j+00k7&JyiW5g^c0i~`VN=;&hSYGhvXdva
z>_lgbWzT^f_)>~!tliK5{qrsI@(S5oSIr|UULz?sin885{%6&@crAU@yS(STuGZ=v
zo`3cz4ZU6t?`&e(>-BiNKGyy7M3At8_<})IP(!sitOD`jDq~}v+<ebIMvsjnIzoe_
z4aZki%PWT^WTzXC+t0*#xg6cw!I;a(;^`e`pvMl#lsiJ1n<lcSteg8Dn1sRVpxvY4
z{(HyMcBliTFoSR2RzPpJolym`Y<{znkWf9bMlBj3CO(3wa2*<abUOqZYX)$+&OfX{
zMIkj~9JeM~`N#22qN3yJZ9G7O^X%<ojnP<~4kSfGMq)CNdOZR**45g$XX-dWgCK^I
z9S-`aR2CLZU|~)&V^TAjGj0mw;-i_Hlg0G0Q^<~uVR3FI^NYvhmsD~h{Dg-@(C84z
z(0WldTH4$?Mu*9myl!loIMVbIJ)U#2FlMWd(U}5IK2brnS<Btmrc!^T18;s#kg$UI
zg7KB0p(It$%D0YV9Gl7VEe_s&c^X^as^wR|JH+nY9VE{gLym8dUb}?epk>|5hY(}J
zh>bO{b7v2C+?mfnr;XgKKxyQ(L<5ifd?&qv9((fuzkhrmabuG>y7~mqJadeeP6r+B
zR(y&`T}3PFO8eP;+(h}-D&BmrliJ1sjvgPxWc6H7HlZL0R8$}4H-~$fof1kze?Mlg
z58)$rk{BwpqoJ8ly`CM1w({b>at4%0a<sktX8R$0Lrwhp-A&l_k$`flRJNij$V$L&
zlTY7P6#NogRh-95JND7)5&6~p(LA=RoG3#C56#Tt|4Qqb7?;R(nG&zHxtSJu?)vau
zZD!iqY-nS`2z8iw?xk8XijryGS{)SKgZS(sD7s%lqUOTH@^iKSZ;9_g3oD2qJ_f%2
zVe0#&b9U~FVvtW$yZg8QD~iJUV@I)l!~!NCA|tPviUHe4e}9RwudM6rgIF*QD~Qi3
z{u6OnvLfT`)bYY=$Eg_*8JiV`R-+;-63hQ`fMxGAkUuU3!SBb9i04E-D;sr89vw!{
z!D@c|$T3XeF?ed5c=UgF(j1w=%p5Idix-Vvi_77|<&rRjXs}wmczrUW01l@QSrutG
zP{%DdZ{zlR$FuCWdsw-(mAt}Omi}-HTPrQhnx2AQd;WHW!|lf9_v3S!c;sK(*?6Lg
zIYr|*Tg9ojwyffrV~u1cB%@I*oa}QmEh~!q|Nb&tI_)gUi{+;)ma}6(U}B_~pR8Vo
zJ~o%E2rZueYF=*k($ajCm8JWLic8^{EnC=LeUkJ@9lzYLm)e0r^tLu0-C2$#>KSa>
z$FFx*l9iUurX8z!`e+Mt3i1d$$Mq?ajKe9Dm>7n`?#1cwA?UPdHA0ZEg7|_FmfuUi
zJCSh(X_#wT&}sZU@nStiCFxu?D+!y$LyX_SLysTl;L(1jWop=3@1^$S5E&XLzPKp1
z?;hfZ4^3vkEb*;db6Ed+IVO)lNQj;-n;MZNP@G=29O*}=fJXB0+zS=#DjVR|J0~(&
z(Z=|z3z#)88+pi1is)d2If`tp%!Emagc{B-J;&>Du&Vq7f~wGEa*+@hO0Le2H6)$P
z4@IEL{BCyxcZ^A7Kp%<TIl$p=2lH}b*xl4igfW&m;X_o4d2}~ckR9s7n4C+u$xeTN
zBZJmqYTTiuhU%C(CXLs2RWNmYA(Nstym+92Tjq>M>vglDqMIMgDxk-!@b-~<zCSaM
z8lS-Snqj_@rDrgD6r;jEUdQsfy!_9v4|2nGIlQ`}7C~~bztY8oG0{PnFo-W43nI8>
zCeMgwNDiaF)lPPtiplDw$*LhMEfm|JoxB-i_}kLi7{fGZ!wd+D!uT(haLx2sCQMJl
zYqArb7KH)u$|@zr2_VV%v<9XX$Kdz)@rN0iR20d&t-bv0m$QlR24c4Segy-t?ytMh
z6^$lsS_V>!g{=GtG{X6JNkLU{C|YJ@rxIsSafhYhunm(OdA4YD4N1Z<A@P~SiVC?I
z85ATYg0&klF&~Z7gb<fTGByZLAUPqPv58R}YHTOW5KeA%1X`^YI|ed5CPrnXGpIzO
zaaov}9?Os}4bktSBnF&uxrCxn6e%+tnoLH7kz}nImp-1+;pg^+Ln1;+i!%TUHou0+
zW5Y4q<e*C!#23%Pk|dd1Zkx~gwJqH7tqEvjqqz3V`6w1AO;tTOgm4yJGltOy3#C;K
z#uTTZ_4t@QKa*&^%$EIT?!6@!zbcTK98Or6j@;}hHgD-*+>A7`3=*3UnwYmRi?HEg
z%4%F(e?=O*_w+Dx(P*5#L)gNj5Vhd->F91Zk&vFmRZ~Log+!8<Z9H#%NTV|_Dh$@u
zb}(<kc-;NXMCMMXIOgox&sUDm=U8Vy^Yccd7q!HOhhmJ)B+l2z=)7@c#-!kNS^3J$
z8KlM}a;&wD?_9BflyCzzHkCyMc}$KLD78iKt(nCb?Oj-63b=9d1o~Pl$<3d_b(1G>
z?Bq%26&161QW4edJzO>_mqi8H49YqtC&j;CR{x{jT$7zG`vzFDIGZs^0{`0Q<nG%?
zAwY1JFo@4Cg0qC5Vf+WD2|Z3PR<A%(?1z=Opi3CUXBvVa1k!0P;r`r%cK-6@A!>WP
zNRo0&<5{=7oEKKq;P9zPJ_(-!rrpQ*>&8IME3ehYQ-3;4%b=e<>ni#A!@JmY%m%19
zoqiNR_RBb3fmubrSHk6%P-NxQ_Z?O3JpQ|50PKDH1ke1V3WranW`7eey-|Nbk?s&E
z;^*}GKvmd&Y(FpTKmM^3kOylk>2dkkUvYpJ50v9mRAgDg<(E(tnZNJYj>+Q#R9rqE
ziVEd*l{~R!4<?_&j^hV;YR^GDg39JYrM!ByhD%!BP*vHxsh*c!s-)ZGW6g>Re*gP}
zY~0qyff{SjB@E)T3%y>?V~;&XL_`ELX3Y3R1^iBl?vjtHIz7p$M)qy0$K&$R*gS|w
z7tVw{BjtzNiHp*+W<wW!gHBRJ533GZ@Ol+2yUQ_78O`6{Z0EuIi?MeMGiFXUjr$v^
zYq1j+9l^exEe!O#Fh*$Eu)Pzv-HX8>Qdd93(W8S*pP$R_<%gMcZ6UEqF&J^+?i=QN
zzpvw}D>BK=G@kcDs*2=e!-*<P4m$%T6We<%jEM>%D<$Quh3<MfYIwJ`hjA&%tk_kC
zq%$xrC!M#;N---sM#aa_*waU5QWECDb`EuPQPyE%abYeetI8NK=JBO5qwu%vW@ER^
zpdt|M?!sb7CCg~IM0}-Ex~q+}7>PYK5<`7f=FCZ>xFnhKcPoPyRuJcBmFRT3bJkP8
zkak+F_Ppw|Z``<%Lx&Ds!XkbulAvM9lF?{UnNg_a(Z4n`COe$yv{)7`$!FkT1KUqn
z=<9PMD+*KQX46qO#GHHPGJLWPQBgql(jQ`Ebd*3#n~eoaMiC+V@Q3JFaCtVv%_fp3
zBr<DuI`zjpIa)rzp?#eQKxl{-5r|f;?5gxLrZ9rkl2ND@7mf=^&2f2LIK)uqj~PRV
zDsfp!F&Xj@<^5;NfAMnPsvWcs^l-GZi9sQr$*~bw)FJ9DdM?k)1Rydr482ZEZQ}_J
zbq(Q@74(L1zPorjl^s3wcT`awGn=nuhLfIIz^vpbys~^r-?xb9P+~MH2^mp@M}{$R
zViF0_dfNNFK?^I0bGT1#H+%Q)W$V_hoIH7w@bGZr;^IEs9lTyjOH0|hbt{#Xm4t?d
zl9-tIA*;yi^|F8eezt7cLS<zodcB^cq@)kElVzE;YuB=C*Dm~iKNBZTBr`Mf;ucTk
zbkSX5-uMFETwBAKIr$u_bn?t&<Jh~an~mFAX=<==`Ryery+cH&M>8f>&#HG@DW0Cj
z*klbm_M5on?(yh7enLVtq@_flcs#tfu94J<>6q*LDBIt|^eaZOZ(Tk0%@&L?VMIn6
z&}y{AMo4VlGeBBV98dlH011V0WR6WktZ$)L)ia|c3GI0n@zd*cbauB;+SJ1Myh09F
zRnhE*tBdkJv{b!{mfL1er#Lm9+=O&oLv3_P8fK3wLLRPTM~{Q4X-RB8c7Ve}K5m#?
zM9=UrnaSz&cGk1}Xbaa&9?!btRmO(Py8r+n07*naR2W4sX(>6>*B<AjUEqd^g_o{$
zu?oXOF6P}(OwD^0$a)PYP7Kl6W})!%!l39L#79G`)$-hP&vDgNSCN~Wi`(sH`}XY=
z78a6|lXC_ctXQ#vS+i!5pP!G%<6-yi-K3|dQ&?Dd1_7>Fvxafw#xZW(IJ{mjd-m)h
zCMJfGl9Dspz468y+<*W5r`&{yhzK@r+(=1D$wj$_LDBvH4+LGpAU+Zni-m-Q1afk6
zkR%D6PRH1>W3k)MtO4b8I*E*oWYnlpNRotBtEITO7?a8LA?r%7*OQl*ha^d8G#aK&
zo5sMvz!~i%Nn+o=eW%Dv6h+)_H#>Ih_{0MI`#<-1qz?()KCg_|E1yxb$=%w`q2@s0
zELBl(yCfu8Me@tIU4Fb5Dw0bwE@!~)^LZpZ9tlPH^q#3t@}sCKUcV2IUjkG-J|7-Q
zKDF(Y6%<9r?e`<ADt<}A<M;oYxUS;y`|<ewmpseJ=aq1~1NYfGa*rfQ!RJ?ki%?vM
zdvvjD;(cCWG#csY=|QX2B8noSDB|&W5JmBfCAUOTWN>g0y<U%^D5u)JuW6m$&StZn
zT7F&>MTUlk5JeHaUVqAR(rUHD#>Rf=e3Fuq&}cLl?H0aISX<WC(QS5N^J$p?{Xhc0
zJU)Tx#o@FML;HbdR_*QMXa75w&Xc`_CC4z@+Rw7GAq=<Vq8zWHY$y!3F@{?wX?gK)
z$C!Bk<;;n8a<ak3gqb<?)bwC>$jq3R!J)k!=tFem<V4WYY9lP#NNSjuhrY9$SGL~F
zp{-5S4!D>*FB?a<6>n$=Gp8h@JMX&gDiy8GSUrBmWM<Re--F$&FmFuW**mt+%rD;A
z$h}uy&GYZ9BR(yQA6{0(uioB?XiVbqS;;(kyoVu|$oI!<d3Z+~f4uEhcI;h4h1<x|
zuU<`SM=K_$leDNv-l*v%)zi+L`Cp~bsJSHXoT?}+f9?>Gk<jE%K<*!4=B#uwGs5`S
zmf)&6=dFLZTrNsWOF#Ki>7TRfHk-}-;0Hfo{`~nk91h-l?>%n3@kZL)+s|k>G&ID6
z4?f8J`SbC3Jgix>hMRA`nRV;dok9A&y}f+@``>55f(7_|K3;$Qb?&(14%V(+dq%tD
z<YdCa!f?CYD2hU2Vj@PPk(!zsii(Qxdc7BSQHp{|Q87kD;cf4sBrA$}H&wEK<5lFP
zO~9BQjibDtzpS^C5#7U27lbf&Vj4TQv~laSSenY(==OVf`0LY2C>i3b6T?{jY7LiN
zUyRn}qIJm4;>)t>s_4O=7{ScZ(Rgh(4j=5MZ_v*lmd<73=rFv%{A&y8{OdlFGGpnl
zXl40s3&rE&i87vFVRxs~My<uewPW)L)xeIPZjLq8l9821Uf74*|9Q&+Zkja(Jt|>>
zM8DI6pn}t5BRnPzO;{ABp<|SGyLs}uZ}M9;oF~hw_~XJaG5*9}o;gs5tFIbk2*_eQ
zE~k}tN#JVTrFGO4uaCFi>fvWEPT{?$+Btf(oA|s*6o=V^gmo_HbUHR{*uY)iyn)ns
z8Bz1ax_*rYL;-ehc?wYkolfNUkG%cib|Q!(?AiJ>q5yim$nPInd-ir3DBb>Spq)X(
z(nmLbm@EY-%+UiX0s^Yq&+mV8GeahrIsX=xEqm$W7FHES;&fVa#z(T%>S6146F<Kv
zg=1AF6h*;o^^hDH&b-+%-2K%wv~`Vi9~>e#R!_>LT<%j19I=Ms9C9!^KNbNn8uj#d
znu&>v!0S>N=&}$J6H0frgJGk<);+!4cGm<}zjz#vD&tWFyuhoEY$fu_sl?m6c&|Bx
zYZfM7P%NfFr^Dy<Fl05+W3rKvQ$V=4?;~7HKRF38tT|H7{G#!=!?U;|GloIy02!mF
zpmhwP2~Xw6i{_G4Glbje!jC|-L4(8RL)Pet)#=I0Eo5#^8UurUoRo6O_cYUCc95E4
zyi~pn>0?rP>!;Ir?6=2B9hbuOOLEY79qb9s2#W6K9>tvG7mQ=sWBpt?H+ZZ5t8O`9
zb--7@uji+~UdI)S7oPWTPl@gx4>x`7Yt+>alUopr-R>tYN{_?pVR+butkIF1WyCsY
zWxy$rlVqT)-$QglI8g?b`eq0D1u@8e8A(zJ4b>uf{WP`O$SH`!Z*kH!=%+A08dI;0
zVK-!_hSJ&NBswM(jqIam*iT%1C@zx+hfg7AbTrNZJ8n@+MoKuMc>c8Ib~|XZxEP%j
zPoLR@R;wpIGV(*Sgr_t#MFK&K+i79I3%PO8444K`3`UZ}3^euklbMu)-)*PO>SAn4
z5`&guOn#BVgc#gz2dx$dIf;o_EJL^j1G%wLm$uJ2e1t{lu@5<LdKHGvUcw_oNKcOl
z64trU-Q7*mgei3IHY19cWQFk{K8eMvh5z{zOuKR=H+}8;3n#3RSwdM>5H;c%7L6jS
zr~+tCCk#bJMnE&-^~kb{s1Z;V6-7}IH6j<lFQ}@DqJTytpeQP;%6SKhUJ{K+RRcnv
zs-gfIK|oOzKtL2gQ9=B-i49d%QB)O;`032ioqk^e+v=%|hoDP%-ty)LqOHLIT20_X
zpAUS}hlSk`L%^N-s5bv@I)sOE))!w@L6X385z?6;f}nD7E0uhfEiK`b{8pg;crW!`
zRx}ZjOd1zUN@56Bvy&4?dg-zGn6n_CP?rUh5Ke4U4S#Nm<7c;J;A-yVy#rQqr)HC(
zSlGU~jr1=~;kvOpj#La&G$jS^fQ^Q357Q<m($_LXk5iy9C!DIPVG1Xu;cV~a`Ij2`
z%@gxEu%Vt-hs?r7qlv~tr(K|MROAJ@g${>>>OmV*ax&@c?ZmB%W=#A?yJxTM-pazM
zv)H`<09s=lw@%9CmC|xF;R)PTV&sq8I=FZ7Y!X5=)OU5FH^!kj207Z)Oh(~MW+jFF
zXZx9=vhl4doRUIRW-0@Xy~HGhlbszwRhusu)^MSuCHUdtUqit{m~<1ovKvBmrxBV6
z9t%A93&>vxQ*MEmw}bX$<QAV9uDA_y7C_czr~NI28Mnf3{~6GJE`)b9TJV{m%lzM6
zNA5F6cB)KelZBcp8y&~nsM+7Z(xqke$svr(3FXkfE<Bx`{Ne3kT55Z7c@=DS7c1Ac
z(t4noj4|;nd!vbh$ysQP;Vdc&XZ<@h#Kwm()a_)$o?fyObhOtEu&LTjZoCe=TVdRU
zc;0;e2&wt0gxRgQfSFepGA3EX)!)ajo@%0{t{<!8{3G4{UMDM0G?5n@&dKIxs$3du
zt^296oP8fhkM2Z{PDGMKtixR#?HfSUh0)T{K$FD*h=k}g{BGT5`b=H4JN#%QiTH?c
z_SV**4GH^HdRce7nYt6b4B92ynoV?eS`nh6$Z>WD3F|^eb=3}&7Qu@BaMcx1oC4o_
z2=06V3?qr<)_$0GGps!lXj2da5B&swzWn2CVCd}w8!&$g%qkiA8xKA^JiZjJ{@n-1
zI3LTZ?jR&y4y~?FW|92=_#hPtzIESt+<t-FtWYW%eI$me_@ZLC_4cv!RQ1tP*G+Y+
z3sDqEO*LX0ax&}Nb7?NCBRw?~)#*f+5>13Q5YvTTPlz52A)p%c_+1i-Nm^8cj^le9
zdHU&c8rtkgfYss01vHe_^4?J&`3YL;8wWVq;D8ILHtLsTLiJkwf)4O=<m5pP*$pHb
z&bALPFIM(Z+jNo>Jq;Xp#<DOen%>?jl#~(-ZVQSi5D{)9L~-Nsxd1K3@K8j31b@74
z4)0aeeJYPAE<Kj(FHgf}@empx#dX)^lNqJ3vx%Tfcp=)!ZytwcC+uAdQ&R$#OVLvJ
zpBLb}*F#A%yz@FVc%We&WJL#N#Fjh_cfAO|ycP69zy%C7faC|i{Jtp+nd9M&r@-s_
zz*Ure0mAy-YS{L5SeOa&$Sjav5BiZO==XznWMI{3puab;9ToyQ4S3~%o9g$1e444I
z*9Y82k3T?cp?dK718%PXxILiLgCc=KU?0N29q;pHC5v2hWj58#Ca(W_G1ehBD__c@
zt<}z;*@GerOu1<)zZlbxK02IOqsqjScCx4Cf>&Y6Wrf^Sl!QlBxN2?+0P`;&MMsZ?
z*zqY8=f%*|ZD;I+WbBm#boV$IGbM|>5*3@phhxab{F^7BnA~)mHC%f|8qVlwo_M$z
zIWz?01%wEMg&Ucknm~`)%&4?nZZsItYeb?AnzLNDffw(&4ZGWhMjJwgJ_3)%Kx%Rl
zH@ezT^;zgNM)G4FOd7S2jCdnvcNc?BHzAUPR!ayEOwaoi#uI^QGt<e)i9tBniLW4q
zo?a&rp&Gt%|KuQHo&RVCKm0i?x)q8Oz~c?LU8(T_i^lE@bm|+w1ygT;gb;9f0^g0!
z0vsbQr2v8r{&zXdTL71hJ6&u9*#mCxnU>wuA`n+YLl<101u`Hguxb^o*$c7;mV62B
zygaav!FE`&HSqfvUjpkjFf#}K`W!5|6~@K{NK27n^;=+#gl}I7&OZ3{8n}KjEMEab
zz+*p#oo_?h6iAie&;JCI53c?)+;c@>AD=72QdPoZLzxzv7Wg17;O1nH(vy8!yNOfM
zPHitqiaE7CW9A2+heiZU-lX&xlF|chV#X$(`o3gx@>$Pe$u*Gxq~4H!>a%f^QZJ@^
zGdlHy^O=yI_Hi;P0LIY3u}emOKt40_3QlcbHg4<(=b!U_(Znb+lhQsl3pg_;a4#p!
z$oSCLL6`8nUv!9!f_WvN`k}cEwrvksJ`1jZnRx+m+ZYKGMxJv=2khPh_x}aHb|)A{
ztSi9|e|Z)5)|{zJX*8e-gYc2RFaubJVcpJvbu)8pz`9braQi**qnE%K3kl)y`(MMA
zKLfWEu+ZB21N&@lfj%p^ov`#}s5Zm<lTxY#tJc7aJ0L_4(h&Ud?{MpnU}p`~HiFd+
zulxfZ`W1Zj5%6h2>w_OX4BvYeK4*M|AP6{z-5fsBMdQD%>RD6KM|ovG4)+IvOpcSy
zY^x2-c=)Uic5ZK@%Pi5|JV@Ej7Ao2<EP!>ebC^vV+fad~lYJbm=*Q(%s5#a_Rh{Lc
zuBo}EjFWbSqxC1LF@O9@r8VtMSbcs@G}W`ewF~4S-ag(M7?gbjlr;xl9GAz*{@QBV
z96kmugOt_QVUeJzw~GS}4Y*{5W38<mYHdT3Jd`%HaI$X@w_}*yjV*NBoY*aW?5J<S
z=9B2^ZDmh$Ckjy8R?mUXeo$qOHPy4Ptq;HC<w#R4btV_XRuc#7Yv}XHwDt9HsIeZa
zU*>pgOVGl)P|}hVkOtw(J7L%Xx+wVhEfArCbEJ)|1}vRh?|>R7=%e7V#erEsMFBYp
zD%L|()CVJ<pn>}RP`L2@spY`u7Blo);Ezv0No=6q>c7MGekgqz#$*I$1A01O#&xjr
zdbn>6{Ni@F{xSINqcAfS`uiY+56J42OQ;)hE7cE%ulxz{{7(YzYhq%cjZ+KTo`q4#
zfqneXgYb4K*uM$Up`RndLSe&>cGA)!*!a(KbP+~wy(W%hoq9%TTs-w^JwN{GOxC_y
zK}>!s*QL7n)62UVx?>y(P1S_XDdBI+8hGNtJT|SWWm<6-<$D^~b#Ra`-#Lw{%_r$K
zN!;<BiL7}3I1$ky%$Sxy>Hcma5)-)nh73x7S<2k2vx(CB`Tf&1eE)|tNQ^hKaa$+j
z3!~5bS|p#F6$cJcequj&-ZO_7cONTT;ut$Q<?K?awUvJytKq?gF}!lHiYcSBC`nD^
zwQU<|u+HG&8FBn$%Qp6opUKzat@QXpc=f%#Tt7-rc!<cKw;f_sluDk_$6q&fl9-%G
zy04EXt7{lNYBZgVwXE(L;IfHD>}%`bWaS}djxS<QZz$V$9bj5!0(A)*Rvc+1Om&cV
z;}V(%E$nPOLB{2Uv|1Immu=vt;tVvQdY;;}o7{vj#v~YcY4cX}u}MJ->!J_~&HKT$
z7rr(QzVS_1U4EvxEs9XK7l!u0twnId?NB{5LKqszN`>g~f78iAAT0^f5<u}meJd2t
zffGC6{>uYysX-6RR>7q40Sl?I4I10Qp#&_jRoemt^nNIVqF#9H*qo^lZv<ob2O99C
z36K^KvJ9#QrcVUBi%&Ii_fm~IvaB#X>_=2o?*6io%kC)W@)_}DOv>TGdyB9fs$<`f
zp1v+CE~l3p?wmqT-7wRy9K+gWN9pWxf=<Ah6w8D-4RuXc9(;H<Nva1iDT?p^a4LNj
zJrrGA$ldo$AUa%2M7V*<vSvUeDojKLVn?U*<NJ#U(?e{c5yJ(V55rCm*%?{fI4%pH
z0*Mh}A2TDY^2pW`d}TrwE}tKr$HKAhK_mpGPMArwYY?ZX;hI^CakN)q@_O+JdOS`W
zUcVQw-hkO=Lr`U0T0O&72O3cVt%h!k3!UIa6$E-+GJ2l_pRCaDRtZ(yIJ_=wk`__+
zFzj&S5;SQ19_)%lWph2EAqtP%g;my~cpdotJ{;(9+bw8S6^p9DZnK~hgK=0FCcNuF
zRKWw_12F<#`3r2F4sX5(R~7|A90WBGcO?>Nv-G!c@P@!l;r5?{{VZ0yDnrgB*zpqh
zT>-al>F?n2^{{z1+`D*$2>sA(1?OS-+5`V)EomX^0-xyFUht^1gz<!joE9ghf?o5f
zuLXK(_)5?)c}xs7?N&xl%Vz6Q7c2i(LV0;Vot;)}4nGTKj^-w1fYjVrVnQACZ0}(F
z*m#U-vCNv0PEv6ewjmGGiW2}RD2Qe4>RM(k9!-Sb&%5t7F>ii4C%3n;wcUhPl}XQz
zL6xAVV-T~(KufEI-pYRZ?0yzp8OQP6jWl(;@%R-&&Qo}g4hzNC)j_9Q$9w_y^gHml
z+p$Z@7(bLit#b2>NmTc?6CRep=&Vr~!opC+5EMr*hO~6T1U>EDm1K_^M?rQ1ja9YW
zIDZZ~nqjIsd$@DKOw4^vScWa!vv>}bZEe`(P=2&{2HV^ENs5Z&$Md4uKkR2*N<0(h
zjOBnu<nqy}#EtKu%^$&}<ShCU+cD|Jlc~a(>`_?UGEvE+i5jTp@|g?BiI%A9?&A8(
z7NFQVu-NQ;W#M9~+na-gb>1CYhIiLPqYOX0J}|3>0@@hJ4hNe%;8JZ^2hMo-%JdH`
z8$pDmc<3DtY=0CK8DtkY-2o=~^<!|n0)F-zSTGgxqe0a{qzKclgn#_>%xT{D1CgB{
z6J&aN5UB$A<g@CY=P}#%d3Ebm@+YP+dVDg1Mu1a+-zpO)CXU=kf!lK8P*o6xWF9FB
zL|P-j^*0rrN}ZVz7XiTJ*`p{?0uk_OU(OHwP89g+R|-ZZT7*Ef_UwRg{rKOmKonto
zR@ABEWn5Xvv@0$w>fK-n;mV>3s6`VH1sFYRF;|ZqkF&_t<1#WBmk|)MC#IwXQ~*KX
zmtVa)up*5h@X*zZ5fBgrxNT1INYr}*<8lfS1pzgo_|)&lB*dQDzAG^m0TDrf{2T>A
z6cI?GNL3L9fl<>hI~7HL<J<+Oes}xqS%I??1a6!$HxSVd<Y$Zu98Zlo6_Gz7IWFiD
zp0{<Sfw$g<-~1sE+oaP5+_RQraLfsXxq*;?J=@^HC%_{FEFQfc2792Q36{(Wgae?0
z&2jFq0GAhDd<tUyaKpnO>jGgAH_V5<2f^eHghzyg1Oi%b{02O+2@IMKEGJP6MCFSD
zgb2{w0ihv*^YYrEq3sJ6SUS>~>+6T{pGMAtAkfohrnS>?ieyAlz&~uE%c7oY*V<%8
z0{YrbRGl1Tz~To1#1W!-|963bDzGgGjQlI$wz_C-w<8DwgPj(d+wFivb*=rPQgj4C
zz;5cH!|KB9QxHcw{71f19v5C&#qGAyVGb-kKWrIf(CtH!UG&*J2m)B`W=?eX&}MaD
zaoDKp>cXjjfS>Y?E*yTD0n;Gu7Uu}zh^Ow6D1MOg^g)`BaB5o+KG+ujZCe0_dTmtK
z1|}c|x@}Zf4bj!(!0A_mgmvBmrwD&|7(^G`{5^PkJ1lz*uKX^9B*PDH2FVNGc>u&t
zxbi-DdndfI0<O6qqKn}ti@_s<I0!RtgcrA+!%|TpJOzGnFLWJ)pS~Q>kRJF6gbl!w
zZ^QD<@ZM&){#&rK9ll%=u$m%9f|CF8G;FDa=tvlw4^KV@|Mx1q@;ZF^+tBO(Vm(Ju
zP}%ZsBl<9v7oI!8@oEd8(9&$eD+_cqbW+>qq48iN+Yb)nsB7a7&sEXf=cVf1BOI+6
z=B0PKiH;4S_ec{5`&2w;JFhIO!X!a^RX59C3j|nJ?rGwUHO-j%t-SR2<FuP(JZ>Ma
zKCurs;PR<-wGPtS+QVOde}rB8doM7JO66!{9k1`$#Qv^fRvjtjy}Is?ZNK#0cj$MS
z_~kphINaQV)85A457x1~><CDM{P|y-IcaheqSs?|ck^;(4^^#=goGLi5fru`*ui7l
z4^ZA*$G^HgbT=O0gz3_iTv8R4vb`N>>;o))zMl14J4j3nBQ_kKe(q$Du+A5X0?A{b
zel_UL@W8L&;pZT8Dl}{eg!8B><P^fT7eMNR`+gp1lQRQ$J_F&}4}3AZ^R)az5#nMY
z&Uki#{N8UsNjB`+0ySL_l>|Fphjamc`Y7D<8|ac@!!jsJ3y|8Zg|M&ycJG9jcS1xY
zJpULJ$HNm(!_S@#qys&41H?uITtz_x(Xjzb@pKn5CKjT?&vXY3A&?mTIgFxL6s&%U
zx87(Y)aSt6+Qzr<--;$VmIRH9e{JbS*W1d{?J|<ZirwxbA}NA*-)%<r`U#KFv1@M+
zA;vIj?FOzb)U#$yEnm5*0C$&-oz)KRzA>AIW8IYdjof}sI!?dH9d{M6@~``dO^G2=
zkdT0^XoYp_+X;yZ!DJV)585!>&Oc0I*kYzz7SZEGz>hArkd)yg92z=1fvnlQhTOvO
zxI9`i^cG6H`p||YVehYDSQe30$j`{)skLh{7{b}tY~ud8`RGvi+qzYh4*Hpsk;+vw
zuVP+a291r!+1P3(#i+l84@jl2ZHVQs*ONCkmY$|TR<Ew1$)e@*6h~0Qx}bMmg2X)7
zw+;r)pw&aHF%S)YYIQpq#!Q9do1lLfbOwlv1ebec#!dk>6>JsY@dVsLeM}&FUX{V_
z{xAv1p>TLpz;$!F0{cnNgFS0ua2WhRavXTQAdP5JJ{@dY0|UbWa&dVfB@as1!{88v
zL_nApR1q{P*qmS(1;hIT=k-3BI_$7+Q{dX)4``Kqu;><OyaOEW&shZvQ6y4?36rB~
zXmK*^)-b6g33KBBmE9hSisG<4!PC;p@t8D<^91@@O+=-HF!8zxtoqp=X3Z|bF=!(p
zGZ2IsW)Ru7wUx;;G7y|jHtp_aY+f|p>R$F7@G{(OqOsde=a7$qK?_Gtnz*9dM(;5*
z<HyJ0u(|NLoOE<MnWH&>8$zqqVz-(wyCuR@0n>0BHEw}v`m^mr!WW%`*VM^CWGEFw
zBIB||Or}=MhGcYB69}m^b$1dHZbX)xn8M>p6~Gi3%c4<9)DM`M79rvCNmzz0M8+nQ
z>FuP=;vym8(&ZUOCr9(W8}fMl?Pk0h9XUBMI6M0}Xp0J#mpK>SFE7)z+Z;$h4&JT*
zu9m2U|NS#ez2YLv%Xr+}^tGGtdSyh7h^i>)bt00iB9G)O>GdK$pNt@i=tOY)6tr3q
zy;i{MmC@=ohyuupidG{cOA3;#qSI@TB^gx(olb+_CkON`Q9xA#Wm9xI0gp#UZ_uJh
z3hK!5JZ>3LE1=hFE<jUM@yiObBBRylkVn!E^jhsl?&JMZGJZ({K|rt7;PXqUf=Gx~
zz%z2)291cMs%S+KNtTfm1-({>pejfR=mbtJ@1@gdFQ~-MIpr5AaKC+C33cR3L=gm0
z3|d%0e8Dg>;22Kj+i6A!P2lvB{f3dCD8=hT5p?KBD&iSJK4_#J5y>@L5zWZQqV9t{
zKE2`W<!QshMoMp-_I*gGmfjvaNhuL$*5mqk$sL_WgCcp6HF^wMfwn;tY4HgkS-?*m
znWi?JR;~5)?U2)~Gwq0}uhnSKYDUgg5E&XCB+M8~l>W3ErugZ!I7o|)LGrpV`5@VN
zaaNahB=}E%T40(g$#iwwgBsR3-)~g~l}kE;1o6r6ei*{V{Z^o}s*h)%JIKbvmNS^_
zofQ?lw7imD(+9=N9F>i1t_{pg*xP&g_0RWmpvleA?X@iZ<#tx=v0c#dYY#N?gYWG^
z5n#*8N}gYKg6=^dNM=e84S%S3-ua;U<Zf!baO`L)Z9>?2Ss^Pnt>;g>_Ty7jUf8&n
zBi#cZ*1UGS%ho<0`)iKz)W6>1rRrX=wX?F>j@CWI@3!t@<&hHr?AgDaeoZJM@YbH4
z2nNHYedbyX)!R-4Ev$3;)6vmrwIUt80y$|aO7NEa*U>wuBO)UF;$D1Yc2${~KR1t^
z>yPuNy%Ah7H<C_Y99LeJ!XwX|z&1UZM}KsPq;YB7KSku(=eE&#T>)cFP2BjMnLPbc
z9WVX1gyseZ3+6_${hbQ-Ra*J#y))SVb~$Dz+;!hXo`32n35gNRnjXjc4XuR6$Me$%
z#*zMd9S&ge6`B0_@#9$L+u8hLIR}O#xc<wT81(07M|eCAp4qvZ+J@uYoxPYfM^BLC
z31#w(=@`$_v)|gfk{u>J-@jrOm1c#Rd3qc^AB#$6VfMI@WIs>7`!+&+0S`<bg~?&T
z=~ei~*vYiEG%_PUh4p*i;ZU!Eh4Fa|IXo0+Mq;-Qv+QscbB#Gf#R$AvQAbL_6cV$N
zFDhiFVs8`g?e1mj!hDpTJ`Nu4V!>Sti4F;tmpLcm;^O$$J>TTEho0otYep)K2Jxv_
zQ98Zm3|G$QmucyM>W*gje?R~LAOJ~3K~%9!nOuCadj_A3PnK{gdTyE%!4IBnX8H0w
zBm};Bb3Vhznz5&4bHk)46kk6}Zl8?5t)GQopT^2HwV(?Jp9fQ<kwg)ChrIma(fOFW
zY((TF@a^kHQ@g*N;_HjJz9fddyIQ&W%Xz%>S~V~ZSqiMLXV*pYt=sePc}4EJe;jd#
zHRnxM05-RelEU$f6Z_GH>6o9H&cr#>F@A(Eyt>-NkFU7`N%G-vIO!ZV;{=3}^2f4b
zAtt_%d*_vK<m5qy-7>>nJ&+VZwLYKQb&xzdhtA|t6z4|pWNtohzPpUJjJsKsnaYyl
zLK1+vITb9-O1@~Hy`|U94<4RNxa?t*&BfJAQYk$&z-6I9!a66sUN4V7{#&lO<{Gwa
z*@WNk58jkd0ZxaLl`B``^Z8I!6=Q^vd+)uM3G>of`ogV*hlgL3Tc{%PwJ&G!!irk1
z|7J0*?KW1uynvRPevX&-;1ELi<{dM+XVVE92fWOjnuca`FO%kGq6yJ5=+yAYg9TWf
z5(}m!0dU!6Sv>XU!`$}WsT4%^^S5U!x&MJ;y4O_kVpSiDro>QoY?!%A@~J!0f+Z@N
zBS-rgs_v%CqvejTry?r?xtSNH&?H1fLT4*|`b>&-5R#oo_{R|SGq*3{jq+x`GG{io
zPsygrsUtbWz?(IPsrE)QIcqMt5zQ<+-oV`@(@BhsqSKH<x7Eyjv&RJVI%5J8bUOTQ
z2QTj1Pi*#V#)pGDZw&7{fm8BFBK$9MK)GUJCa=A4h?2#H7)3wrHUo1?q9_?16PzVH
zUuZO%FWf?^|4lsk<dgjJm%ltkN;;j6x88b-E3drrqShn~E>(Y_#QxdLfC!52=LuPs
z@p`?%zfa-M>2y+FUVg?3&wjt3va+&IY~c!m0II^ue^z7rH$k#=Q#~7Ybf2M9I;vaP
zQTKizroww`>TxS@bY}zqSXM<vlk0+x-`~>DyZ`Dqb&SsDL2Rx-C`4oZ(5Y&&7eg@M
zXGeX<$F}Pm?#JR+>FI4^XLIKnnHFAqKhN(iWp!2Khsdg`u@;L8$aem+V=tW!KdQBZ
zXUmS^RH3J>l9eYK0XTGgAEliE5r4;#QmTd>fXd3UQcRM9)nVq1L&s2o=I&NjmRFx~
zAtw*D^Xfkv0613K#<FEqlpgG*$0`L0D~Qh?v|23%1qEj$@oKeNCQh7q(X)de5SGdt
zuhy{Wsto@8$Ub)O>&NSMak6@lvD31MRLoS=*x0wel2seK@R{wr@#=97*W20u@*ao@
z<+sl_F=b&s<0Cu_XblXt5Ax)nkI?6V%DqiI`E&&muxsr}o`0p5zRqF(^oIi+Z*~$9
zAIXum$8iF<EIjf1eRP>6Ob!2!z4H!lt2+PqM_ZO;Ti$!bD|YtYWHJ+G*eOtUp)G~d
zmeB%blv2w2m6jO@gjEO$Av<yQAdVd;-g{5kmTm2=tNZ)Ip<yJD1WH2D_j&GPJ+jWZ
z(z*A1@B4nw`@W}{XJ4+y?K_#@7hrG2L0;Kkfdtr9SinE`7JLJ%IeBu!dMuVU{<ygo
z^I#7qkC)2Ea$Y`Ajw&>cJE!JS*l7WLyuW)po11&_SbKSD-FljRuy)s03VUogofaNn
zyN*_;pMGNx_pjQFT@29BUdLlw_ajQARMa2hrTwKyWO6nXY$Ly>oq#OBvaOpaF<1~p
zFE4M~LA&`V>5F23+9oUKj25})@iGc(to;0jk(@OxidUX54iZ)nXC{8}i(hcnRac?Y
z>4=Su<(_-)Ve#U{-<hxo1Q0`H94s&qrwfoI>F1Iq+esQ3LxjvrZL1GyV;%o20GZo?
z!|o+#N(y`OTSy+AgkZJP)G!DHC>T(4Zn}(3TbjA+caxF!S*aL+d+!=cV?jHEDT&;9
zQywO>kMl0dV$JJCXv0E?)X2~Rzy9Su@+QPF(ALA<kJXYGtH9wuaTBZGWTK?sPL9~l
zJH?e0dsOJWRvdw2+hBiQ{sGA;>2%m(N|KKHE(12Hm3NA}`Q@}R0PLx4<Hi}IXl$z{
zGjlu(QX=@Mq=I4LN*at#E*PH4-0`y+9vjVtS!pbsHkGv4c+MY|%B5q6lbt%81zE$G
zogB^RoQYgCDvwcmHD^zn&()Jg6D^T*;motRecD*$5+w^JOy%yg#((LX+6HWV_+b+>
z<|SkAv$1V^3kIu<$??H$zJfSIq1Wqq?X}mq<BmJH^2#fD<dH}4dcS*;ttgd|qnB~G
ztQBc;JZlSF{Nu4P>|ayQQ?FLi)NDeVlS1S`Ck;Iw6mkihKP<zqQjnSx#g=tVTya$<
z{hbz4(}pDO7`=k0AKQabro_=^<oRcd&}T(awV|4&OG~M!=wtV;HcXBH4OQ)|-r3ET
zLq;Bc_H0JQD^P`p^UQOziHlI7I*EY4&=56lyM=v5FH^H}xO?VAWD*(L<IL(`Exv{+
zu{w0>2oe+)+Wk`E<&nh8j6Aig2*d!bRwwBiB|2>s`Gq@KRoBUqS#!w@(-0G`!Q=Dc
zJmQwSeO_EgJanhW!{^GP!{hmntNHnBpWwsk@g8aC!{ze>A}+5NxBtsEj?|$c-1f(L
zRDWDV&!CIq;y$*ntY9!LBPhBDab}~etc?8peD1&h{x4}-r{ZP?MfX!A`6D|oe^HA6
zq9}j7*Z&O!Evz8UX!!m9@9qYk$fP{Z`@TUd9fQItwLS4h0yVX^@AUm$E(Zhd@3tTj
z2)Hm<oX61pj@Go|Yp;&~I!IVS1o0gqkxD4v*~Ei?%4g}??k`L<f!F`OkNY3lMYF;4
zpCosCRTG=ah9+@eX#>|^yN;Cw7WS+@%xzbG$TRB(k#ICAUKEf28lYrb1!teN0_TyL
z{g=B})6(0|(q+x3OthjX($m*X$$;%!>GRo7-l4{9<<YlZ<5w#;;_+I!Yw64UcHLg^
z8QE3e^(D(n6h+?MwuZYtTtS=nzkhwiK!BJ2vV&jVyoQf=_3`lUxAMp%ds)A(mS^8@
z2?mY^@e?B~QJ}QP%f*Yva%g8YpSt_$FnXAI?g(!E#TZ_Grv_Jh7gyg~Nql+~f0(Cc
z&(;de4H3-N7`g1m5v*KM#|JM=p|uaLxG0jf?-yec)l8q8$({{Wghl9>IysKj`E6t+
zhcP@Ogm*ruMO26J_@5@Sa7`NkTR%KR_N*-AG6_xP?fm_DFSp)4j!2#2gno;|Y31)5
zHZW+mFlWka>ISQ5IBewXd6$r_`+7=7LFs3NC*`8Uk3$~L$e3^h!A@9YDoUA%h)8jL
zIeVHL`StiHUMZ|b49(=W5yOy$*swZWp#1M|k))3c<AU@M+Iw8+6ZD*SUK(k+vH1SE
zBWPg-@sl&L!096+M?=3)O=!S}q035$T0*y=VcLW!2Aleboj8I={xE?MxkyTGJh;6~
zyJ9jqp#f5JBJo@7h%sSk0IO5rvdeP`3HU%C#ubY*aP~V0%T8qBqGa|K4RFtW(~+45
z0q}YRR0!;?c2k(&OkJk~QK4g0PB?*+2*h&x{A8qM^Tbt`ktp{Q7oWqlXc+^pW4W+C
z_O|v@(Ok{pu2#C-YT^}AdI!33YohTwEck)pDH-6j;`jMjGItTTPs}7Ya|AQOY<yJR
z^8;NXDOn?88SFG8QOQY84kN^AqcRYQ?4gGqdNg<!2XUstU@*|q(!#7+v%Zs-C6!8P
zXlTIi7g%!jS-i8nh8ur10hdzC4cCsq)@7o2ZxcOE6^pJJLt3Dh9pw(jO-R6GurgzA
zIx*S+tF{`s=eAtDev#x@4WXe*(vo$&_kJzo=A{!aIQVFjf%7lQLTKz{OOcgJ79_Aa
zzk{jsGqHE}(Bf6$l_<ICx?E<?NFXIiPkg9AAVkBMyvP%-;;K=HfYZdL1_RTF=iwWu
z#}Jamx#>~I__U0fxw*{B97aY=I+LP&wD{G`$sLEv)=FyTD6%8MsqbuO;mp~LPEKV{
zWig8I1k61R?6QRMz|7qLK3M_UFcldilZcnNP^o2X+R{dsRpi=hh6h&(gE+Hs=+Ggy
zZ{N-X4?GZDB@80y5(aUGdvFrTaki~G_5N_UdG?tDblAT5tQPt7?L)l&ULBq<@S<s7
zDR1tv4}HSt;pG>K>2n0wvGOo~{No<Bm7H8XtoDjFUU;#B&z-iC&zkA8{4fdiyASW?
z&zrZ=ZFd2%wzw3>Ddc6IP6S2wAkN&IQ!XbzKcCgBSM$d|{_#6mSVvus0Pn15VD`Ke
z-g;&)(`Tj-7pDMCD03I)uyJEGbyY^HN({)O!kD8K`D|Ma3DPulWu>G~8p)qusNt1|
zCJ=BJ6P2u^`d}-EYVFLwD3|*EP4wDC7B0$Q$EGGEY86u_MDp2w1G<=S=AV^}`Gs{j
z8I7a1o%NfWxh6G+J?m<5tJPd_apsq*etr}DJ}=v=Dj0Nlm^NZ0rOgcp0-Q5p65+>~
z*}LjGxN5<9#AxKK*t?U09vkyU<(*j<T@=}uUq`puM|@5a(!oL6yX}k|nZWK6W6;71
z;>?9iCZoH%o3gSpq|)!}Ruu^-<P1xTB2+0dF<s#H`%1{m2}d8RWms+^*5Vpg9(G|f
zx$t=fCe6*H=8%C&S53y&)P>XP0({g9TE@pnDJe5@?e(M3xLgcM6kKz4F5P7YbYqja
z<f05(>y5bm0d{SuLm`t9u2T?-mz#fg2%FVQQ&ByyZs@~lcHumU)EtxD#=-VB{60H7
zYwBsWTJd;nn2r;Vb>C%+ahL|EXgkD?fe<dpPCFwjGMJqLS6-dR+E)%zKOkqx_1SD$
zQH2l@+(<QuGnlOQ?AgQS&709^G(7s~qu+~bC?aD<mWEeeJ3!LZEZ*MiVDHB>*s{8g
zC;nQ%h7HYREE><mFb7_#6ji92{C5u$niNKeJU~gMjoWU|!`S5@H*=^|-mp|He|vN{
zJyI3!&Ox60`vGFdCQ!1nlGk1@VZa_hCIww+2=(Qy?5?t~so2KG4VQ8Ik}UG(jNqa?
z8TNn_%}H#g8llsX6dr-u2Xk|>3HSoIL>b}AV~0h2xNAErtLur58N)b9C#!3k|Fg-%
znFMQ}nMdy1#?0#{qjwGP)WZeLT$Dp`epOI(58}*3d3ibW=FP+B^C6W=@p`>H`Q(%Q
z_P4)1W%n{Dy8j3uiWC>NGkS8`7x(Bu95A!7At<^BaRx#nk+5&yJ_JGdk1MEDD%rn(
z|M!vreKK%&_EOgV-xtLNzrg$NmgDjWr{0Oj#J{#~$K?A_UwkG`N#&~>4oM=zSu{-_
z6x~nfq?E~I-|Gt4|I*mx<>jGND!)WfIXO9KG#Ug!IOUiusT6jvucffYh$<$Ii)P1>
zmZZY$6xse!89S;i{O-Q92w3bW^;*IjyZETVNzCFzY{iu<+i53tdJeNAZ7hAIj8VTh
zkL$)rX*ak?%816?W5(qUFf2QgmWDxO3K`K+D*6XpsI(z?x((d*n**%aw*;-z!Grg0
z<+}UMLt$)Xz^6g2Jn>BfL@_|ezyMB<pUk8LmaSdO@cCDwKhCUnJI&M%xX4Y8V8xal
zlsE<cdhtSDS@$ucMowpLikgR4ZN{t5;`ies`PZI8Ler)*Mcu=m`c}qFxtJ?5BmV2x
z-)?r%HQ+|4Q6a~V!|5X`LC?ykw+9L9bWKQ66j{FfUHS(Gg9CC51cU&gp%EB*3`itW
zWHK3UkHA}Ry~AafU5s9@$M5%_LdOBR93r_nDRkAgBXi2Q{I*t>zp;R;Zk~XCTQkne
zMjrm4hs0<V4=e~lt%84l)WD^=GE^D~JGQj(tCy#dTjk{DIbp0`UQFKfESx4M1&4Z=
zJRy<x${wmL0#k;CBRHL`_^<|xQ_A0-oWZ=YRVaX0-mK-yt8$S`L4gF7;^Z72v(3UQ
z+qWQb*_g55I+QXc8foCT6%$_Gu#tre7UB2Hx#9eU2)p(m0WO?67qd^m+uMjXbpnI6
zhv`jBV$8T{Y}i{y-bg)jCy!-)MJ-okPXDi8`-X#^bVh|SNd_;!S%yk2B`i6fD4i-u
zSf_)moK7dX!?Q?=9w0F;=#?K2lk#McCjkOTBmx~ZFLH1%JpOnB`T5%!HZ1*=Oe~dG
zWZJAq-f9@+aG{AyW@%|?GNV?@Q7a|5odL$r%;8VBrs6zMfwkE~xLQKyoRQobW8jkp
zDXxAS@##Y@ic}^cTqDKn7jgNdL~11rIHU~P0z`$v+aGmu_aCP5@?Z7>;1$3pdhrVZ
zmMyE{>|eyOFf){Rql}X=xTO*)Q}V`feoh)vWhk4fG$cgmj;r%TD+DY71(^ytZ+-ec
zV`g27S}w!u_2BXaP$s96-r0dMGKtujcpMfh5lI>7LPcU7gQTS7{xEYyCL=u~oJ6gJ
zl$-=^T#|`LkaF;&fuQLALqnxfam%fD;O>2mcb^482#(3gK%s!g{t0f~pLy)jKc28_
zcyz0JH&<PGB|CStF?Dt-{rzrI<3s2-*l2Gv<5Q@aIx&WxrXCsxrA*1uQr=)CX;>8T
zx&XTl^fP--GCsE-uU8-}OohkpX8*xHrp!sj-EE@0#l^g{66vVvrOgHt^TH^rHj|hf
zhSKY#s?AMunx5gqLJ?dZd~zj9e3%^)BK3-s8jr3%1NCMnGqN*rSO(GPBT;|D=l9jt
zGHO^VRV^J@0us*2%b~onie5p(!rWohbhHv5mrA%?q^P--$yu3rT{eokP0Yzm{Xwp=
z!{P?560KZ{(_~}+;Q>ZZN+wPd2ol!mAgr@ypTpJjc5w6M0ldLo!%i9{)$sbJn_2$$
zD<@A_!BxUD9^X_1Fqr)O14AyCvuxQrj2_m?_z@z42vP|Qn8E4*l^T??qxF-%cEM!O
zZv?*tRNwG0w%cI93U=qQ54Rt5-?37N*$gfLG^!tV414>bxM3WZU3%e3c!ER8&w?Nj
zqe<YyPipa~H0U*QR7xpckC*(_HS8@ll9myT=yYQBN^$Q$%nJvlOdYPp-fiTKw`!2b
z>FF$P<gI0uSR!H=9w(!{!;U6Qh1c%JV0056ro=knz-aLiqLk3tWhW$5jiIK47yenz
z-1#Xi{o5YO+uUSl=vebX1&5m)jL3;VcEV+nMGlqj<xjgy7?YI5mcxaV8qJJMj6beh
zxT$zQn(%0L7k|c{4in?!ecZpggz4F7;BDch-A#;2jYr|P^YDsQv<O-vgh5sutROlr
ziT3t-)>hUrEFqPq%5D5^XALv6hLOKx1^;e$F*zxg7ykVw230J*Z54b_T7^U#O-tQj
zHa2#Xo1BQ~bMdE@>p5psChzasO|?xVUTWpdf&$hySy_;(=EgTZK&DT?HQ2`biW*{~
z;@DGuC>YjodIc?zxZuv;!|ZEe#?^4{ZLp&OLXM#>N@dVj3+LPn%kqba?s%m3?mKY7
zEiiWp%>K$T>uR{>X;3Rp{i_E8@YGZA=arzA|Cok6!1e<M1izHR^_3jhUdLN+9j0+W
zWZI+{+G~60Z|>s%-fyR{pdGg#I-2|V_qsMJ)|QevF@gVky^hJ}<dL2n%H%vP+c(tG
z+iR!C;9|p;Hf%;a-EAh;?CryCa$>T05yb#2-l-sEWD1JjKD<ERpbNjxg~J0ETr~!X
z#e&OyavDLa(Z)4%W|64VaLvrwG?o`(JI=$dzNU~SuZZ9mC~0b;VPF73lwh(BvUE=Y
zNM+cZW}e=-3yDNP8JWa|S@G<ztwg2q@sBP0Sy^6()N7^B<)N{sp9`j)MT|;HLyw)y
zr;J5~pFY2mdBYNzKXDd|vXe>FsHttMr=f3vK)}pvy9yZa_yHw9n=ziXrPV~oq;Y;?
z7{fC%5$q;HlSeW)PR;(-9#BYmd(#H$ZNW__PAgeyWU%lGSYHKCKMvcM!Y~zFdNmyA
z`#K@{9dO4J&|(0y;~Tn`fW-`L-Eilx;qklSvELj$p122odkOgb-{Jd<VC)B@6@F}y
z8NPs&n{FM0;1`)VB7}F>^pTaQA~YqItCx(XyQqaj)kc~-hmwRxjZdV%-NLLp=3+S1
zM3_bj9vAM&aN<KG82ephjY>c#6Oe1=<cyBR-eV_ecsN<P(Nq*P^YO}h$}9ViTptMz
z;K9G0%hWOPba&fmE2>4El1P|Neo{A4v{pxAR5WUZjAiRrvG9_gqd(^LaPz>H5^7uO
zDDJ4G(HFzKxG;MCe$o<BP<w2+B~mhz(g|35K%pfrTu+=X1cfGwt8!BaAd;P$!%eeB
zu&t_v#855K;bBOnGUBxwVst7L$`E3-Aw(&Me#gP)7Bcl}iux2>nh`^NzX6{nf!xTU
zEP?k6%J}=@a{z&lTio1`sYj;P5E&Xys8)rbj^ySkSqK3LkIe|K5}r1`l0fA_XmZ0N
zkHHnQ!0U(CABIhr!Rw#G(%XmL15l{ot=GXM2gO&OprQyGEyzT0xW4?q#fu?F_VvQK
zV&F*M5(w3R*9&qv3=RSch|qz{eYBlK0va`#OdwT(R{3MqN2DyA8PD1^HO#qe6bG7Y
z>{vOQ!$sY+cH0nq0nWX48n;9>5t0x=Sd4&gYd4c-B_X=J=whR}_h(sH9e!p_hz4Nt
zltgxIsAcLo*~EoN*|MpLdFN%&u&J4C-Bx1KVwjT{pwHmK&}KxF5sRVK#DUU2Y@*18
z3zGQzM;0c}55wyVpgf82hUCO#G*YmbdhkXhV>UG42p@@7_SN65=97Ewz-Z}1p$bK5
z_hON$iB&}qC21x;Et^n@7N@0&NfT!QFghUykT5YVnN=0-Jg{gE9c{I&DeLBv@zW4{
z1;URg{3Eh+(H%M0<ecF{F9a(oDPsT$H%`l@!z<&WxI7#^ho}fd5)f?IynYH>I!GLz
z#GKKij_4*@rYB25s$pilhSkL_+<ECG9I7b~iteXFbf0zB*<8C|C)ZybV88_0&>`JQ
zDuaPK$Xx<A-3!lOH$*Bj1+*8!lzU+3QkeNO_~pIu#Lplgf>sMRUkeR-Sn(u8YT+-B
z!PBduxDc{r-%#m$0LJ|seswRDt%J3Phl+B}ng?$`0ZQLcTelhR`V(xa1V3=&tuR;s
zmONPVJ8=Gh0qCVQ@ao2!c<1d`gQELS3_+Lh^gZg4%OOG!DmfUsVB==E<oA#~0v=v+
z)Maz^!MVSIYj1}sxyP`U80t%L412k`1!|kWeAG07&2z++6QE}Ro_QL&6!7%@aNT^^
zxE5~v`w&?QKDh0-u&Egyycb@&4|e_=J}NrCj&|l+wh{zSfUYhp1J*D5#Ks;w-92`^
z{-Y!8tZ!pa{SX@qZZ9oOW~{CNwm}DN%_e%xC+Al?EKVBg%>Z<?nCR(q;`5)n&ET^1
z@UNY_={tc3hQ(%~(`3Ob2pG*Kx-3=#Um$!Dk?sK_y^b@tMpn=zJOiMR!&`5`o>r*u
zhRIoAv_M!G2qHZEBqYv;=WYg^$GB;o@Z|Flkbw3pD|T01bL?}z{uW$4=I9b~N-nH=
z9#nwl3aB{*)n#A}Kz})`uYmm3Fgp_j;JoQDW#K7qadnzS_x0=Qktij!wAx5a(sSWF
zJr!LtWZec{{j`<)9-KwtmIgx8Vws^F<X@{h@mx2Ykg7_0V^b;L+Rwe0Mf35iMNGV7
zF1A(!1*HSbxo9+v1&#EX{akcqF6&p+pw_7vGdhB@awFR4NM?@F@caYYc<GZXc<}Z$
zOuKdpx7|E~f(_-=Iy5Y~EaQYD-UEW4x3=%Vn=%re#LtQYg(#I8=8qXq*fD0d)7r(K
zHXr1!MGKMiHS%Op3-A8?S_;bc&@GMQ+DsX57q-%2cJa!Ri%#2<{9sWxnGpiJdo;v)
zO|&#yn10y=YBnDZ64sdjuMht8FgzpyQyWaY8g70NHopSZ+hKV*RIUNh%a<5J{Gx`X
zId<QN4??yK0>{v>0$*sKHwM%Uxu8B3WW+*?3nVhwwHKnYAU6hFN1o(rJ<J&ogFiOL
z5=C61h}5k>>2Y(}EEVG~FQj7UBE*s5+!dw6T2#wN2i;`1v@vFeg83KaQF)+?pU+R>
zgMZf0Cyyrljtt~kiOkDT@!?y&Tz<nOeEoK83I*3*H=MeHcH*ZdGdD+%*)T|t!9hzw
zFXzslOM09N2k_iGms3&NMN?fH%QiY$`qG$_bB|<lMkXW?HEt}{-g?BC;ar*-ecaC{
zB#q$y1!^R6DS4x&a9co!O4i4&PAPx6bU3!w{dhD{_&Q2Y>my}UqKvt}sitt%9NzrE
z!Y#Mu^2S>YSX%8t!aA+ytzswy!R<M^hh0J*Ja`d2v>Pl&xcv7Jn+bn<>WBt*glO_N
zK}Qw5^gL)>$G3C>0T3kLZV4Tygc1@7m<B<s8Pc|n-d3Owg&$icq$rg!ELuY#M1oHm
z&$=BJUiou2#id3p7B`lDJ0mmVSvbqhytCqnG#O~y-AQhWj>w!OmMj(+43EOr?_kWx
zq0Jr=60{WUX(M}N95{Rw?(ZNyT~G0WKFS;}8k;Q4JvRgS<|a%QJ2r`o-T?>3Ml&`K
zgzBT2lG(-HLw!se8-qfA;(oR^M2kuSF_AIY%UUUu+sR5wM=Srj<x*HvLzmr2Mu?K_
zRXwzt%s9p2WNMx4ZS7`8QZ88?<%H*sJFVBKtl7n1e-_K80t*o;KcDUBAaisA9o`^e
zoxbOY6xOeV`(A?;A3;{gkbo`-L)Mab#PYg)5x5mY77-Fq3PWTelMRu~_hsN5uOA@*
zX{pd#KBRYj@$&-~Amv9!SOJ(iH;sV-7gMIF@p=P<sAPCOeq1g;q9hJ|xRUf-4^E$i
z(3ET*$n>KMQGg8cCZ!S?sYVQl%$}+R;H<NAFj>6lBh@Tin1RhH5EZFr@wqD8ei$`6
z7MphB8r1**AOJ~3K~&w(b+=7GDhk~5#C$XwIkBUo$vtwuTkoEV$?8WgJ2_Es+^BI#
z<RFtraQ(y(>^>2V{MeSu=waz(2P8yj)L3;9OwP$BOs3?zd2_M*0>~6<E}J|Rl~R3L
zuhE35sVG%491b7qNfDUsexf4PxJQi*64vQNax}Dd!O~Um^z|T<g1ry^?^76_3t`dl
zkH3LLJZjdceem{rIBy|5bpyCuL+=mvgHH-E`mcz*POu*<tU&~w?%TH(_j_T%`QUjK
z)>p%l$wNYWcL!`f1T#ken4cOFLXH$(QmW*5T>k%9qbiLG6%cTFkf@ZXl|v&XJ3`hj
zy9cL7L>sC?qm~gBHIz0WQ!9u%5|JCCQ}KB+fnGm!9-k+GOeRGWBFEwL<Mjm)1QEGR
zMr4HSq<?~x0R46cky<TErJBfZ2shEFH7NW(0-^+sQjSv?x+{EsKPtHjQS^aCjzTKI
z<8@>4_)#fUs3ifc9xr-bC<+96Y)+zdI=mhieu<oL_4ga&BKQRQ?LMNT)HrM&0zv?r
z-G?ef9we;OD5WrQHav6<JoW;#S3+VK?A{HX8d&=v=oRp#O-&@A_6`|3ZV$M<Lz73R
zh3hYenn>98B19?R^U5nX-wLW@u#(*edp1G@;PHPwh}7o=kM{_%CBc)|!JWT=%?lw~
z1sk`5JnU$k*pJDwE!^3LsFl#L-OIGe31kn`(9><Dr_(`KpP9S~S*Xl?7zib^zlkRf
zYxu*BnK;Yq+1DXKoe;y^4A`-z4$b_DT$llyc62d&Q5LRNBSm!%F1jF{rjkw?%@U@M
z4QJ=>E~cN81N~-Re7=k)UOb!UpDN(WTP6?|p=O}9kGerA(<elqaM9v`Ah2S`2DV$J
zJax$>bhp=FQ^qngCF;0s{<V1>SIn8uyIVgaEh&M;qZ4>_ZygGimS0Yf;cx3|xdHw$
z0nYXO1?c@Y>RM{pW{=~X2rGe*7$$2&DKFp0qeWdjFmE!A_5kr-1DPXckrn#=P>C22
z*}9>Quy83Y4jou5j2#z8T(p8UJNtuS4X2N>z$3stzlS}qgDwD#-EjF0(6|OBr4G4c
zUuz?U`)`H?V~^$=dcAP*Vz_zXP>4hz0CVQTA8v)k^I*~3uOFAr2ZaEl79PAE7EL&M
zKA#sZxD4*P3e=Jz9qX>&LH>(?9Xc(r^i5d$09-u{d_SU!6Ow>H`+$?p>$`9pjC7SX
z@Q3?%VAqC|rWe?}r2`CYJhk3|sjDBmLjZ+@k3VT*pxH=FQYfp}w-T2ggHa4&(dZCX
zt*m15v;-{eHZ~Ova?aFfn#v69>XCBx#0Z>zDT^-6;)56W6Pq4GsLzELhzkv{^vy#I
zw03geKie=H1~J=CJfKY~lM%0r<gSY^#@1C&t0V%Ip^(Fa$L?e2p7q3}W#jWJ(D{4W
z+u4IWB$}SCDmvYML{UO~L<CQ-`V_rB21CD-8>SA&?{Twi+ZL*A0ft9}a_;o=nVAt!
zWkVI)ntO@R$iLT#(cRL|rVY*LBGj}u7}>eAl|CVaY1)CHg>@!i++=uf){v{^_Z_vI
zjs>R-9=mtwbDtB1*9%K-915!Qc!vmU-q~>OxyPHeLx0?E5Owg#T_E_6_UH4#MOO~F
zKb|AsMG#>6?4f=?Z!5_ia#w#;R+dD9JOEc*lS%%THnia?P=uhc*=TjES-2>JzBU`i
z`T<Hq;~AL+(twE5?q$lar}5OoyBU#}f!Ay&JSBXn9+m`}T5Y7IgrdYpeWw$hOo|2v
zjRqHWr5#kZIO#FCv3Wc+ciL&UdYHF(90`qsm^v*CcJ*<%TFT4?C+8Lh0>aP*l}b5q
zcpuTBkz9AIL{z-&8<Zon)DWYBgC;HWvbFT~RN;!qMQs~IlqBNtc+e_jh@zWzMFdwV
zAtWP@-zj};sB33L9QXs!-`7KGdM?8~jnwtonUSFT-Y!vOauoCDC$s*L5owr?`Sa4z
z3l3JaD}#~lKQ#Um={|oaHwDYfoD#lEq`TYgX7R<BV=&s$goWU7`bdaXVlw-1xcrC#
zk@y51{XKSMAxa`uBF()X^bsM%hRNvYb`lY%LnRS$c?7~jmDnvVEH)pJaiKU(PCR~*
z*mx~QgB__{ib^FT5D;;@1R^37bhO!tPYuOk_TWb(K0cJeUK^rZL2Qf~=}9DK+8uV}
z8XYQ8pvUGwE|n0W3*~qVjUJx|iBwL%*@RyzCplb4*Pt0ut|BE&MXS+_GDJtBPKntg
z5D}unWVd2=d5DjSLFIQbASj7ZiF8@)fJjVu1j_HxS2LSjghzzX+hIZYyr#cGibAIj
zT3A8+)U-npnMz7>a@f!tVM79WM5LTARx3|9@_$hXFf3h-;>hY<N^01DKBG8Ne_a<I
zf-ZbWUJr@Y9_=G3^qAivCvPaaH|z@unQ@6>r}TSt+9Q^YL`FjRxA&n^44peM>S(-H
za#SP^uOEq2$*{QC|GXb@#8QjUg%R<&0i_H<>v7{1l_W*zzbHOo_xjMPR0IS+-T;Is
zPK{pl5kq4cpA!Bh(bw+q1vRYGfq*C?l?BJ)R3ViPiL<BX5lZN9HL?2BDhg}uU(!zY
zY-wb}mL>*mM@2b%c>`N&hRk4B-ym<kUPg7dm)hbsK6vvGTS^@#b^f->4*vO%QUsu}
zsEJQDw&1in`1rj_KHb!MLTNe;tu-twX#fK3sjg)Cfnw}#C+ka!S#h}hghE~Ni$3F{
zk}5ocNT0czy-l5nf|C`W?PhyhKMqSDs}B}(xX(saOC8Ji?4{EUIC@xGT#wT)f?(zO
z%|m6MOG@`qXtW{$HtpX<yTkqcW<f|qw!B*uB&^ec^weak>P6)8AwfHMocJM^4dp{7
zB*dNCeNTWb2YSg!kEQU_Lp<}`Av)_@S-+>B5$S3+Z)~8y&&++l-o!I6SKzd`c=pkJ
zUR~A7?td3C<-B3MysVboNoipBGCWty-i?(!_V6yMy1cyoQXzl)%YFu|9-e%3AOHI2
zVag75^7p4d<K?#-NE?-ct)?B30MEVIh{<TjrwHM)t8;OgZ8)9ZE(m7FMRB;hAGgy^
zr`1BdtDRl_5-uD+33q2H?Z?sWx9nZRZ$DX2lhw%PMk8{;jVEAb>E><h>onr*C_|o*
z%gUYG(S}FSW2oc(s!m1@8_uG5k#{QE*jQA+XU*+cd|uw&TZ-A*iP351g`Edz?jN9`
zy^dE3O6WA(PI-P*7q;@m<9pe(w};K2RPxt{^EuGuBPlGHOZbDs=kxK<L-%vux%q^s
zdPs}|f;)Ykm}MmavjyJSkj#f4U2)1=ec=}vFnRC?<lKB=I2YYr$*xToBKYCXn?wc+
z>uFZTkgb*CaXMLi>on|jUCg~=9RK%5F&38|0$v8f!%0`ezHTQEJuw$cw+(H23=jM&
zgWAv9n0WPQ&d&>{y0n|oW8&DA-wI?S1>}e{whP>UUjk({eI!c#ghhrC8g>Fz6=gC&
zf)oi(uNR#VARzcDsXdG$eI9AY42u$YwXmHV=T4=~;w0cOQ`W6w=IC);KW7?lc@iqU
zh;hd*DlHyB#x3*a^6Wt~ZpR?+wZk9JPQ%%5qAf0yNVgGnd@8P{8Z;U`=cXld{<vJC
zfw`G!EJ#l{RiB;ub{oIF|15NJKYMn$7&%7I{=L1-QUwX?hj#}90frAB&bIBl*!Ni>
z{rv;MK{<)BOH7Yu?H!ZJ%E~;o`GAyjW+t$9dmA$@%%!N!&Z;+NQgg^aO^p$oPs-wp
z$8v+B371Ao_%I!|Egg)TkccWmOH`bm2QSRUV)Aj;#38+B^2B)Fc&(I+mW(Dr?q}KZ
zDz3gJm&UcVd|1^-PKp|rS7ge}RGO+f7*uQctlGv?zsq3r&Tg){B$;RaQbFvP6c%^`
zsJ}(QuIn-&cNr+N<d7b&quH+GvTzSCmUNPt;KS-qIY#ocjK3_NPhpppDN#|F^M+v*
zRcK@qQ0b7$q)6l{B6MN=?edv)cQ>)Jx|!+O<JnnNfk*Ulu*b?6jh+moghnPXOX0vd
zEDH&cnw-YxD#!5T)NicI{w+Q`(<dje@|_Y!&Pd1M@S+F}WlW-$kr~5-tAwXli;)I5
zQauIHJP-(+bh}_ZtpAZY6C8rmYcU9d5Ij!eI2E$`>JuDb=Z-eMQk<2Fq7Dj6`@bX>
zyW0$ucKZKgpB>oSi5I9Z>15NER+_rqCv|$W!9+okap)X=54(1E;IcW{xUrdSySq<F
zbnhMPqsll`Q>(MLi;_MoK98O4)m7|kZsD6`Ftg2!!!I&u>Za6S{L*jrIZdo9uV7D0
z_t)CBc6Z<q0nx?kk_wD&0h~tGRyE)jVX&`-T`gTh7GP5ql}El`X?-Ov)}fK!RaJ>i
z2;g)(*iqYn2=ol}vb(YE%jc@?W6O@Az8Wff*}S=hikd+NokEbXg7~TFU?QtNsA1$-
zJ<mT?#Qx#|z(;LOKhY_X_y_wauXj+kt%^^#8*p{@@zSfMRJ1uc`2J_~IDI_#b}KpK
z6A2saqt+?I)@$M)|0u@jgSw(t{_*nAO5K5t)x7>rEqz^sJparAY7JhbN;w<eC`14r
zzHc{q6B3YzsF*V|kv@Y7x98glS?#y-Qc(?}$4)_yh3W&JQ0>z(H*X}xB?WkoEA;qz
z{L@e9w{-HS4W%@7wqf!3Xz8fq^`Z(C8a?M`M6;^00}%Q6vt4X$?IYmm=i!e(rqKr*
zcIES4StEUxLH_#bDz>%uU@-RZ`wv!9Ibfopy`DdOvJr#RLuJEZp4hkplTT#hfo&|?
zcNmu>z#E&_vbwSvLG<$6hV|@f>N;vc2LhCo^)VvG!2?fMvc1sAym={%&eHIY=SzZw
z6~s@@ti`K<H7h%aR{01qcX9Rg`GjXhqZgg**guG(qmgI#g3M*ZX7!Mm8^f0M&4fm2
zkp=vel=cBqiu#o-%2M#@ntE>k<plg)Rtnm@+<nIg>I*w)42|XX8?v#x;b%9EX5~Nk
z6BZSUUI}u%9ISS+^4(I(8muT)5=22nqy6@Hm+*)v6jCW}zlgD`mXNS$s(bB7E%o$<
zk4Ar-cCW7dkgVY&F}wW4X%!gy`WTejd39d{w@exdNGNUTX35O4G__Zem^^}+aiOfM
zX=H3v2;KGo=VYgI?$omx85hHO!&12Htg{#v8_(IP$y_sO6xpdc%*h<aIcaf>%AUZ5
zV@5C`O2dLl^Z416al}gHTrlG-?wU0TxkSml@l$zl!PGB(&;CvmZ!D{0@{D-;+XndP
zqiPxkq|8rs2MH^PpPX<=f=YrY^WY8FQ_?JO%aTm$_qFlP#x9gfDPm|i@{U%@TU{t*
z5)SQd!6T87J8Kx*KCR{a^HVSx%p|4_1%~Q%GM2r57^^~oug}EW%d62QhG8gfVdcsO
z4jpLcy>}}ynEbT0^pL;5hk_OtbH|3@_KHXqGHSP$qRUF*M8fl0+MD^Tx|AxD6G=!Y
z#a)BUAEx7p4aMBM;CSUT1SU+FO)L)VqMj)+UP`TA5@i}9WH#P9R0Ra6H9HugQ=nF9
zDX2WeuFe4_4$FXmfHxrG^Lep(j>M&T-8heAYS`T_KF`y)xm^EoHEk~Uky1%M?Czm>
z3%A#U)9V97oE{IZuVmh9BX#`x{#jIQD97XyaJd516f{w-ObCkZLHslj6y5(vo;SfE
z2qK8%L$EvPw*|icj>XewC!FY+`v-a{?Hv-&8#-HQu?&gl)oo1}99|&6;pQgneh~y0
zCGDN~MQ}Jw)EZ6SDbl^A*&HOSAcBxcB-9^h<MF@j;DhbPFN#~d{o(=s`rHB9jYl)m
zZRHJYt{!rBOm%Ji;+D;9DYvt4Z5j98vYHn+nNI5bWjm_4;*z!aB@%XjP{5y`IY{@w
z$?cJLpkz0<uKf(~^XB$^?)q>QCsW}^0zCcEJ3O*w4<dtH_s^w#Sk*+pJIK?kSMc0{
zTENHJ1_PsF!U<RnY%+)p3lG8HSI5SFH3?cJ4dpv%SEZnnOIWvkBdYjh<Pvyq`%Y3~
zBEC~RwB|V5i3bBmgZOC?76Jv$PA*<FhP@lgd96O2lq4nU#AKFSlg-~=t;AvI<%YWt
z5tkd!Z)Ym__j~&=RHZV>*TD^UPvG_UYFYmGNpy7kx!{5bHhy@Rnl3L3uNueR)us3)
z3NE{1IBzYlBsoFH#Ibr-tZG0W9?8SMAItRBElBY5@&*gnUX_7X;pWaI8zDK8zx{az
z;o5JWmeWR$<==){oOTBx8Vy$_xma3UPjhn_qR+=YS1ch(_4Rg3KV8m2M+mpg%A-@3
z$}AOh`h6sXg%hV%Ayr0lPHr0is_MaOQM04EisYC$5}eHx*AG&W9)Y2zj*8w8n$tC`
zu57}Z7{z3D3hQcGnUmavMlWGYV;iHojLb-iIVI9EcJy=e?+&uz-FZCq<W3H>$yqo$
zguR_&(83Dhr$<@1{e(uyF#A<ZN|&>0V>ekDS}d9fE;%oSf%0|~c{%+2$}D67fhp(Y
zB3j+dxppe<mL9@mwcv2#hzLaw3|M{q`nOYwz>6v|ieKI}9!uLG8FR9^;pZc0XmN1k
zZR7EF^#b7Y2*{A*bp#kUI-1)3b@b@txbtVZ$WLSg3Ne6Rgb=wDuS|u}V!`QgF@EG2
z?wB(LiT~I&i*|K*xbK{KgzGc7Wo$h477Gfunn$j_kk!Q{;CC}Jb0jji6=ir5vqp^K
z+{^^B;}e-SViKcc^h{4nW>Vf1GNK}wlN!&QvExaKie^SaEN73%Bt0>M$;k=KJVmks
zh)IcNY`O+ffJtYklb4r7gu+ki$RuPBJ@n9{!J9aU|8+>EQW_c>@cRXpTsDnm%d5HW
zj`0}1Dt>+INO~Ij*_&Ta%b<*lZWvFZ+dx5smq`=iXs$Ifb#6LI5wLn&AHVzMC_LT(
z2~i<LM5sxOQS<uJD#k6yKyS0~-lrWbx_mh1l4dp*4086gXtwU`V&bfHoZY>Y_JI(h
z=Jrct_;|B{bFZApq(~R}C03?Qi2c@$C`y~_Y47Vo8lFsiz=9!cICoCYqrIh;!vh|s
zWu&4wMi&?4C9wQJ8DoZJ($iH<XnZ!4V?%g8e-{@|olcz6%L`lgapj!3Bx>YHr7{x2
zbVEfCl_4bRlz?QYUY1slL@FgLEQ$yPNTo93Vq#GOGMS8&=$P+xy|!*^<D7+=NF@?t
zBDJJPNvNzf2UiJ$_-WvOeU<Q(bN9|bwAFNTuuIAnXU89X)9Iw3B@lE8gZPO#gc1q(
ze7yY9A^N|fb#MBxjQ3VI^Tntj>%nSP9{N1}#?L!T%dq-j@7i*ndb*H(RrZrQe^*T>
z%igI60=)TRF@JylFr7vRE8jfC=6yXUw6a#;*1-CPP9VUJ@`D`gu_1WvEZ@C@ZEgME
z*tXTsPQOQ>wXK>JWwnUF{__3o?JyGX+j({CHk$3n->SZ&tC80ZQ~|K_Z~-4xG=0y^
zE7IHTpuOIRAK0~_j%S`JV)KE1;^LG+moSK*mP;rIK8lMZoP9wGuReDOK`KM5_S4+q
zWYpMr2HU%E_|=r|s^?IPhcuakm)3NlkJ8e)rT}Sf3U7U4;P#tFBJJ!!9G;4#%fP!I
zHIOngp6WdftlQSj=y9=Z`=p9}r6%I_Qr>;93a>JR%&Z93zO<i-m*z2jY9gT$2Y!i~
zQDb7*wX>PLyg1aVZ?+?JqK)T^+qpP54Y|3U<y|t)9Tr1QLISHceMrX0NrWAv3!i(C
zCpP6XF(a8rSARxQgqG|G53d~TrLDJz1tW%&87b%Y>kn~hP7H7E-G^TtNr=zH+xrWV
zt2JzD?B?unBd?cqGpJ2wn6;ciZ3c-N+4sa(BK!7rGH0}mr<V8Na(lV$=FyDI3FGBw
zi-Q(c5I-@90mKkF786A4L`Fn9xbl{LWQ~YIuan}HY4BFou&l_B;Bet~`4~GpgW^5y
z<Sod>Z5W`p+Xe_6wuf+5l9b*1I=S=L6HuCMw7O*6dHZNu3)>NLleuxpa17lxvh$+Z
z^g$`=5G9eJaz3wmwReYs^c+1AS}AIk3fT$FNL8qwQ1y{g$9g?#g#wV^aXCniNhEMg
z&0XL(Z+?h2Je&rji71^Kzu%A3E230@QYHnYAW@MKrlhEJAJUL8^2@3yZfWDjd1sTQ
zQ=n5wkwnDfwA)en9XL^<lzzW)YJRtuy*s;^JSz#o>7%9Dj9rkEs`Um5D~O*MUrA()
zPf)O8WhtS#sVv`Y=hLN=$^W>9hyPm0?%f^4&&Va++lRsCN1>AQ=^KSe^%^3h)a=;N
z#q~Gl(AQxlBW<XDds2*wNB_73gG7b3xsRuw{EVm(aTKqp;9oBtqPfjZYpWTrAf>jn
zg-`eNvg6Pors6U@!*d96S@`Xr4^Yu$9ja3JEvTrkW_M`;pLGuKNqIHf3b%8hrJdJy
z?`2<)9lh#Utz^9X%U`lMZy3WOBayfVDKQvPh3M$-Yoo&*z&FsuBWt!`mTAb&98Ob5
zGf8o=#D{8ldflfS9`qsin0Rg5VJ@CFp0<ugiVSA7%I`NiN~Kk^<o*RTtvZ0A&&H}x
z>iPGZhfz)*5ft5n_-Wuw7Ty1s1oQv8YabkfAc8nPyuE|e_xQh+a88M(j^I?u>QpU_
zuVw|gTy{P<Q~{!smVWE^e!d`K1rfw4LL!w=w56VhAKAuBAGPAJ`v?er1izPM&+X$k
zf7nK2mmBk-3!6*8Ufasr113Cvk&gXU+;Y<<mT&K;U_&{#UH)&L-(*JO_hUA>@d+Y!
zn+J>8LqHU<nB7>dUc6pER;vf6J3z&rYUWS-0KWuYf4-1k+_{B<eJwok=sp%-w+WN=
z+c&B_ShACg{=E$e0p48w7Qf%yg3H#=i`(+K{QsV%{Wyz!g5Se{-HAj3m;L2op4nZ5
zHxQt*tAUJ|1U&9uw$-#^cKa|{yP5aw8vs<+7jf1rtC0Y&<Zs}<ci!f(Nx(hO#PrAi
zL33{_e_6MdCpK*bVD*kwyne9el&_J?IaJBPH0Z`^cF{lJ#^Ll~HoJqXghBj7T#3(D
z34I=VU9pVHO=7UB8JX0}^Gh4Z8<)hqnQ@p+E+YMQ?s?)c1;xEgNtLms#zjrl07()%
z{#ZR*cNw|&?uqo7{oH!ZFxI|*n0^PSLX>RTRFBUmBD%b6F6>1v1d#dNy!>h@JNEUl
z<mcn*FKuP?!r{!Eo{V&`pAqv$vFO}1WIhjL#wYMCaib)~=sD13<AUrIMn|am%&O$P
z%tWT9=qR!3xjZ-NnC+HtT#ZE;Mof4ZVG0E*rHZ`7XiDm8FbWz*L`%u9>R^3YC5tCb
z!DKQqJtu?MsA!6tdsvhcOIfdlvqmMey`%}VTu-vh%z2Y%F()m82BQnNr59gJI?<v?
zW?b|snSYx$H4@`D@$~zBm^<5e^&<nOhIWeEgZmN&@zY~2BrbsoQ}y)wLol}5Nr@CN
zTRk*cWuzx-u=ZKWnm&Sm{B0(o8W{>*2ofQ{m__4RG%147ljHCV+R!G1qXIm>029W?
zAn^-$<!Yvmi^S*hA!tLHI69m)`3C;*&`fmhp{=jHz9RvUE+a+VI^uN_2CM4u=wnfw
z$czjK1djN1f*=qOhF-tEb~`tpGv)Y}i`_zULK-0wFH=WMz~i#u_DL9#lE|pIXab^0
zWN0|PBlWI4!sjW~0zM%CN(DAlq__u>>B4C3u47YUJEiT7{2{-NTW3$jXtS}qtmyyS
zJM-wc>MPHGUcK5&C8@M;)^5x4CJfkMV`5^K^vM7rohH+SboWVmlIi4hGV{-LPbMcP
z$uyIVK-Lam!j=ODLNE|E<3+ZFZF$qaFD0o;QmG`BO0}rAx6U6WY)I_b0VaoO)%TyO
z^M3FC-ut~@y<7Kpf8TpAhdr~ruhNl%z=l#QU-{k;U;pY_N@`t{mFMC#$f%C2jD?lK
z>awsDMdfclx0_e?yZO5>HDS!l;m+IFp@d?LcFz#S&MkLtpxzRqwP%^eEv1NwBs+Ik
zk!w+T>*Nw&zNZ#h7pN?CV7Hs7t<K@i170@mD5uh*aG-6G-FvFA1r|9z5a+Jj$~fBM
zW5+G^Ec+G++p`e_kt|hX)2?c=tpW=Hg{|9*uc+kv$m}elvW#TR!V_7>t}Nnmm5`fX
z%BI|`OUiBAbQLGM+bJ$6q+_s`@``%a735+yTgkE6v6*cwhJxIF!!FEPj9@%We?%om
zPhm2oSR$KSODwd89enw^jqIqa=f>I^@*Nf=ImT!(!l$m?#%+xo*;-nJ!(x74bCp+Q
zC$GAgrWyxXP8(}$a@c&`8Y;Bq%r0RDs{@$?e*Z!KcruS5gVh8<5J&`~{N%yY49%uc
z&R3~XdHJah9{$Y$%aV>FDM%UwkG1o&m7G^nB+Ac!e1`FWOv_7M{I7pK%A4)!UA1^z
zMgvq?C7wv{D$0^VBB`Kh+WB^GkB9GluN}~N_<_@W>$`0XOfI8q8u5g3MLTf=?mqT*
zq{DmOIDL%QCxQSdszO|nFWrZ(t)wP~w(d6ewsjzBI=UwDe_l^J%wId(%6-je(@R2G
zLQ>PD&=;EDVp;<|?BVW5pQdwahMycd$S+z>p#rTZUg6u#XOMwM_dmsR1C#H6S5enV
z#ARevN0HLcQ%k1!)|Y;pSrTTjx|W2hBGEf&rnKD2@i&G^##4+<1W1Z@wybs1dDcUI
zwuSv~c=6B2C^aN`zAZ#b(g+=G$9Zi%kL>gE^{+OuJhe!}u4=~GMj0H7V$aRuMDsZQ
z**MwRCf+#YB^F6xwHO#22ym_=z;(N8IQG;TuDY|4T{|mqq{6r=3puc_i-08QqcffW
z02HZ7L_t(iRqjB%40*KBtnf(p40kkC;gS}4ZdT-$G9%Bl_ajLO@^kYqy0rX#TMOgi
zI0n0gXPQr-nr&<^wejeQ4u(Ss?$}htYh45ESht>RLxQ*ZM@R`4^kk6N+D=e))phs>
z&N6MQ=hjja9YK}G0w<NO9DaT97`N^IIQeRfCr<b9xf^f5Wj4L9x$5tjp{qZLZZZ)I
zL>cOv!mnks!4c0`SQ)G~=qLt}zxu0sjObjq-pF?z9Hp_wL2h{-dp@y_`BTFj>JH<d
zOQ32R*WOrzcQC-Nf4q^!{z(K?0X2o+;$&@(!1zRjJ)f*2OO=qVCT_m9n#IvYinkPV
z!>$U3JE!RAp6B#&F9PXon&Qg69Bm6xU8HlUQ{lFcm0>boNo<Z4n<>pMciOC&jUr0{
zKjwmJcCKB^#S8B!JaxLCxp0tJEWiQ<T%GS^+Bbw;u#WY4S%8I&Ybt0eD`GJ?&6=`0
zt}V;w$(ExGhQl1}pQf?6kjml;N=vHvmyd6!I59>4vdH?pT-Fxml9QcJeZGsTEZh6G
zt|q);c7Cjy#wshvTD<fPEzsT-LRK>g{4!W|>PqD1rd%G`dxlN7uII%QGHtJXjMjtW
z{QE=g96aP<)7{(oWP=e`p$$h-E<JDcQMsW2L6VpYi+t@XjVvxmY;8;z)M{Ms;_;uK
zVbNs47>V=Pqg|A2EyI0eoM)dKK)2bctIegZK97l^X(nO<odaPa{iD?1x*4$Y`J0UV
z{K)~5(&gjwMyIA(Ui8rE57FwKXTjTx<g6g!?dF+NrwLt@%4Osmw`@hnN<nrBJBxMt
zLowFWU60e>%{y74U5+e_f=*#!9X&(mcy)A|Z{GcP{Oj(Wd}eb6y2(Mg!$@*D$m1=|
zG>42_<q|0=Ean{-du3tK2U)YTsUeT&pXsKheTjl%C$*J16c?Iky0I?fbkAUQAmeoZ
z53;n+Jc0~X6;|9ssg&|ZW#MH>B_*lv;SVJye4HLnC(hC}jbu_m(R5TrC7D!^lt1tP
zUR5*_E4Ae1ltL<%zMd>8Nb;3sJy2DZq>|=HNs2;JUg1s264IX_Kgo(hQc(bn-**k1
zKc13h)IX5ZG>xPzBd;7!N)p;fVEQsn_Y79YKl6&yT~igNMnsOEp5l1>BC4cO>e88*
zmFPM+!2NrB*w9o;&nYkSF^w$$3=h5$q_W(O?`Q`vz8&QFm`tT9#!tW7La4Hmf>fB(
zXZ>Uq<uKOcV|aLpl8S6jws`UR<CsL9-rji@qdJCIn6KRXCZGQMO?>m858z*xG1@H*
zwYhnvd5)diOD;Q>smX5s>BtbD-B`)V;UOM<^JUgHZsX{oeY_McVt1MIqH;fe?nwrt
z5;ljCN8db%GdG{AJQq(lA7n{4Qj_Q6>_{JDQH5Nh9PT*IlM^a8ms<F*KYM`k?Yk)#
z|KHA&uIqHZ?WV1FiC{z_wh*Sb%a5WP2&4=d3oC<F22CR<>0~=|u|z^_StIeW|9q0#
zDkrzzy@h|gr-9{;5gvTr%TvGUC%P=NeoGOD4@^>8>0*3jp3^6MRBbG$aBDT6*=pz5
zu}L;wy9Q%CfqOpA)!WOM>hh5+aIm$h2)n3o>f{X1{-&3b+7h;|wW9(qo50{m7=vhF
z$8C)iWnJ0pSXEI;X_g%jxuG&2HD?1=7Pz&co<CK?BHwCe*gua+G?A56fIYUrKs?E=
z4NYVjMP$WK@4UjciXvQj<;c2)dzxx!oA9t_T{YrgV0v^-XMS#p_7REpg9Dr%PO|NW
zeBN#z=f(Z*jKa!b)tOr4S&VGmmW`I<;?R*G|MLqawD$%%GY}>mNg+6G+_<Zn`@VfW
zu0jXC@kQ)TGo{zm^ObwoamQUX!~)CIugk*#IGrXIW<tbNfmB>0;0s}O+3-!oSXzj%
z|4kqFezA#)9Dx)nNnK!BjpG+``TSi~M3X6&{1GB?1@#J6m~t`+N|IP2&I7HzeEsGo
zWDVxyGD`ANDVuf15?21p_AM+VWwcb78O1<>Q6#h+VLp~XFytU=%S;ACOiquGuoqKd
z5m1yAr{)$pHR}6|Op)DbAwSPTUY-?QmYEx0B&V*DMsqmhbkAUQ;Jnj4ndGx~-_77a
zfV%bhM58kKIcB1vB#VnNRMAXbwUh9Cn7NohZHa{`e*#xw7CBa(p|L0p>+?`$6-Cjp
z*^J03nK5^S+Qxk3r5IBS5{(Tmg1#_;gg{NX74J-(+&mjbMPeo(lUL}#WmcH*ORQVx
zVrF!KCE3V^hTO|m%?U<B%td45IP;K_VIq>s+M*Jsf&oBhO+hiXi}ayNafX9Y8j6bu
zgqKL^B9*QjCjB#nbu&$+g#;r@EU89HEjsR{2zG~yx?BgzL=4g9!1NcGt9UF$QZZl@
zG%SLKdnU<-^)8fnGNZ6ESY--pWtUJ>bp%m(PcABL#ldWNH*r(f(Gboj0@XAfgF!&o
zbTmDEuJC6hw9<7QeMRow-`{ByuAnnr*U<rkAe;|^Hmt~Lx_<uqrDO#`cuybi=}*%T
z42D0-(RDGoKfLybxh&Ll5Jdq^OFtt)NJlATobDN{l9k{)MJQBEavmqnO*1~LkYzXF
zbQlST;+$>ua;kfdyb>4k;u5~703AJiuUX=n^-h+Cy*&G}hp=cv^7;AgQ$6^z3t68B
z=Q<Z~m1Gg0kI*|3ro7aFe`1l*nFP6Z1DzdnI1950j?Z%c4?DT(wrci0(!t2oGWKj6
z*@grUJvPLatBNmcVNG}j_*L&LAFC|jXkQNp`}<i}Q_J$)7~eY7%_kabE-CwT%OUa$
ziuheiD?JM#HWb-;?AS@V=A&Fwp3UnW?X=9qxu(2;kr^*h-9)Zg=Lau5Pieyz+WWid
zc8?$#Z5$aIWo&w!yn+g{jKYVetX_Yim(FfKzNmpyN8EU(qsX$%(R0C!4=aP!1wmKo
z8d+knKZ>Vgf`OAG{P2gz@hcWK)!I0FVw!|^njifxfO}w;cuFH2j`Q5h6HJ_RQ@Np#
z$M%h}{@QBH*$(z>a`5|?2FP_;2+YKI?bs}p`6fI=3%uDEr#jC_G@;SBDW7K_K1bQQ
zGVIYXG7y_v;9O4t!EE5^M|#N0x1e1Ccc8YUklAP)1S5MkZ)IlOjg(4oY*B>eg-gn{
zpKC_RDMV2WEG<sa;h)D~vf=iQFcyk}!3K#SQ!$0Pz$B9q34<chH$6kH9%nW#;hFd0
zL*exBB>gipv`<cBFn*Y7L}$jc#Ax3v^C6iDcMzX1f+07D>gAb?!pdN^X)FOv75LIW
zZ6+ZL)K%MQACf4x>&Urz+;i_nd_6wKhJ5r-#4#8I$}6&oEX3IP<r{GyAEKhfh8~M!
zEXl=bgk(a&U^QbkgT)Gh-GUsKDJn4`*erCkj`GWY?__u)f&xTh3P}>Qj+*)W9aW6C
zc5`q{<*k?8EJ(`bUujt;mWZQjDo-DJjUBiB4gTqAyuK0IXJ(j9T&#~24|mTpIND2(
zZ-lN`9(zh$%+B_rm0pb{5e8jl_qLk|&5R%@Nd$ulr`^W!fo_h^F7Wp7IF{Ts+*6gy
zbSOx}x+ea*K8NAC=!ZH*`4xHGd2<=jND6yl4xjo|168>?&0}PISQ)G?A67D%<db`D
zr*CYLg7Q4VfjC!haWXL;XMQPxrsy<XUCeOz9A=k;x@?UjJyB}v^4L&r;^esibz4es
z3M!#xg|ZR{bJI(BreoA^DI+iuAevCwbX76^opYG1MzWnIWK|=)BvV^u<K#&{TW(lG
zXkw8#B5NB9$;&b_H5H+(Jo~bxz806}I6f6%Yvmd|^FC~53mdCyunBO^J;}9o)fcf_
z(wx~yJc4MlGCVm+LbR~Gs)V!d33N*~JBl3~pPa?wEaaMECq3RN961Fv<mce?O=2&r
zCNMkATqMS(>S{)Pv*@};V`a^Uwj@N?@l1rMtaZ`T=0!3Z(RG0=yOFGtoQ%TCV09_1
zOlZ#k=f23yBgkNNtq28T!31Z|O*7_8zNc-lXO7OEd6ttG97)T4ZVnBmLvy6aGRK-d
z%q%JR#si!<HbIXk^=Dl_FullI2R!J&P{#~s+UJNRWX>J;a;|#;<qC*c{skW`9zSR*
zeVz$g$HtKqiFS{NvlAYaE4Ytt_b_LsX3?ZLrzggFb8sBA6rB@pdgsG{&Vi0|w0ajn
zOYqp+Z43wFAcy$Hu{LI6GVy?$y{Ec~>);-3XaC?h04?X<=9F*Y16A2+KRcUISQ%s>
zpz+3G52>Wi>-#!*=#gGRJ|Blq1+XNSdE}9HX8jTF|85Jves+X-Aj$*ZZ{fK^GrawD
z8^$~vKYe_Z(lyx(obaMMjC8b)^1zQyGBT&|;%~b6<xkHNip%`s!81JZcrOFJv+Uj5
z&c2sD6qM(3Y+olTu=j}}&{U=;d_48i4DOKy;_=I?n*x){)7@?`h*TDrG17I2W0UiY
z%Vx$0PcoIbxLjMu5$-#93}0Y`M?3w@&Uo=F8l_ePXZ%4hh`7B2+}GTJ6!!3B#~?{r
zp{Ku{!;|w!s>E9-TWFh&kV-D|%Y%oQh^s6G7x?}g%|tbwNuQga96N*Z0koBWa)C$o
zje#uj(2tMt-@bXA{m=IDKfZe^qp&hqWzcmLO=EFULDY1<czZUx@9p50>kFv7rk1aN
zX%nH-LmZzs;q!)w$5Pz&57*!uTx9zv*7MR6?MzKABbW@tOY&(d5E&W`@wI>1Ns*qw
zP?XI-|MzY9yL@cCV?AH^;$~b~M(j2-U2nTV5Xp6j=s>P6@yZ(>M3b51e1Oiu=oRg_
z8Etl~VmeSJ5%S`9?cl}&16>1W>4}-hzGxw4l^-4Hr^G1J7IjjuPw{+LKT*L*N`c$z
zN<cU8=^eYdzQ}<&r;J;gwsKotDGg<7_;}OxY%a`YS4|Z+HtnP~-^HGq3U0mTYRdBq
zxoJ%~pWIkSby*!Z)Ks#oyzqV3TP&$Aq|l_H%Nh;Wmy(rRfErk&d~+4X%r7{DRi&>4
zk*gbA3{8cp-B!h0XW~5jv#oS=%rQM3CLEQy>H2!^R_9q$pO4EL#dp}t=Ei)S75VJi
zxrV|ml|%wbwl@_5(6G+MD=!SO<Ca?NvdpWmj<IW3IekYw9P%z<P!%d`UFeFA&l_M#
zG&AH4QL(X@oMHzC0XAJ%L9WYsMKAeuAOOh#eRGQ(Xdh<Nnl(%%MXs)_M2khzX^sD=
z{Eo=iZoQ6#A)D=`1uR^%mBOGxt;I_3a*&G3El9CN_V<k;TI>K6J64kLi55z1E2_fm
zpwybaOS?1geD;gNg5vYmPenoD2d-wV>l%XDNRHD+Z6y>5PEPjEWSs69tPcF4(_K|{
z3}TwOeV*;DrFYXr@dA@wG=QpIV6>~MjwrsvOiwegbzMi(z#s~65tg>W0GhVK)+WtH
z7Yu2Zy{5hET)1p{<n(p*bRR4C4QXPmu4(9kfOtvfxsIyo>2q}r5YCT1&9Gl-7Yyge
z^$zp?ow0(Bt_$be5z^y$@3~jT*uT_0b~F#Nw^ioh?=-D2>jk9gIUYZwW|o8*tTrcB
z`b8QY2_kbLtV9q5X1z;zW@2gUz#t%s0&*~dFQT6hzwwNRP=Pt`5`Fyv7D945WMn1G
z=N-AU5?MLE(rz#aB%%o>y)g`efD%tKJ`q7(3C~#!#8H&XGe@KGD08tS1_6A*1!m(C
z!iv%gFZo$kFD|FaN!)=TnhvUzU?#kLe(djf_(X%@{8-<ubS``q-qU_w@;&E%5Zg-N
z>OC8H_&ZJK`!Wb%T~o|gKU0=bSQ)G?7zCYzuZ&`}syzHq51svCKx4ukBq4)m*vsH#
zlCjgH96lXjd2oUs{HmAnxfH#>KgZer0FS;jLr$)RnbV`R&FUmWQJ#FFm!JZkz8M~W
zdI*4?mNEA2A162$=GS{W@dQ<p@f1(oe*z8o#y8Fq3db05M;JXd!h;X>kw~bQ9YZQI
z%l#+%0FAh$^6H`A;*sERS0~T59%c3t)$ado{~OGQmzW68^Zl3Jq;+(Zs3d>n=E&!s
zW8c#Qgf&>4oa6DQhEP?Nqs`+Pg_Xf7gQgLZ6<&D8gDtg8Vtj%xfAt_jNghRFg4YiC
zFwai#gF`CHQiy0&BC9BimtS_HBqXw&CYoD(ShMX6EnB#=(aej#8|2e}vyQ}cgyz0w
zzWCSGjJD5kPIB_O+slb720s6V%{>3J6Xcb;$VNs6))yuD?JJWwW3&9*YbiFbwOvtq
znZo=6R80d!8p?_ZBrN!+-I&X3F)EQu`i_>8Dh@$maB7SZ#m?AJKVD7!Xw8qVbK;Dj
zPkqA45B_%t&m3OjAMSMW;C-h#IGQO!k-@4nu?#p3uyvb@n8{8sC34l4BEn<yw2ma%
zyrq!HvQA=rf=+iFlPECfSt2Q^Y`tp>CtmGm$BrUm3lRz`vjMPM3>-e<K{6W=;xP`i
z`Y`8Mk^KQ$Pt9?r#m!HDau)A`#C#ycxxOIog%E9nDqGh(nTu!?hzTaA6IV2Zxp_am
zo-xJ(OMLseXDFy|z-AEf`=^OW`Xy5te{E+yzdG4TO<64!gm9Lup;-9nseo*|5h2%#
z9@B7=;y}v+C1rLJ3riWNdj_im7eaFq+<o_FNhTFUqXA9Tv6v0Wik`MwbTC^)<dlja
z8Za4j;wc@I$$;4?kW8u=Eg~YIYC1-v0YypY#xhxqsIrQ#gV`)1NlMz!v*OU!R4|zY
z5=j+{b>&<E%q9_8Qqcgb#dz6tHL9kPlvOMyBeJSsK)_@)BC9I8reQXlFKUUXs*0@X
zSd2zwMMguwYWnCA1r$X?Gzv&59fP2wX*%lsB9EPtGqi>bRu@(_)v#Jue)=mPCX;~a
zU9Y*tdg0Y@*e}RiZ5NIkS9bJ_MiJx6VbOdck+8+`2d~#k_B)3oeI27{yy*2V2hkwn
zu!t-7V7}0Y@lW?5iXtoYEzBm<M|O^kD_k^-<$~tc3Um2SH|YFdP-x=yFRPLY00000
LNkvXXu0mjf{=2gT

literal 0
HcmV?d00001

diff --git a/deps/v8/tools/turbolizer/util.js b/deps/v8/tools/turbolizer/util.js
deleted file mode 100644
index 282221af483355..00000000000000
--- a/deps/v8/tools/turbolizer/util.js
+++ /dev/null
@@ -1,80 +0,0 @@
-// Copyright 2015 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-"use strict";
-
-function makeContainerPosVisible(container, pos) {
-  var height = container.offsetHeight;
-  var margin = Math.floor(height / 4);
-  if (pos < container.scrollTop + margin) {
-    pos -= margin;
-    if (pos < 0) pos = 0;
-    container.scrollTop = pos;
-    return;
-  }
-  if (pos > (container.scrollTop + 3 * margin)) {
-    pos = pos - 3 * margin;
-    if (pos < 0) pos = 0;
-    container.scrollTop = pos;
-  }
-}
-
-
-function lowerBound(a, value, compare, lookup) {
-  let first = 0;
-  let count = a.length;
-  while (count > 0) {
-    let step = Math.floor(count / 2);
-    let middle = first + step;
-    let middle_value = (lookup === undefined) ? a[middle] : lookup(a, middle);
-    let result = (compare === undefined) ? (middle_value < value) : compare(middle_value, value);
-    if (result) {
-      first = middle + 1;
-      count -= step + 1;
-    } else {
-      count = step;
-    }
-  }
-  return first;
-}
-
-
-function upperBound(a, value, compare, lookup) {
-  let first = 0;
-  let count = a.length;
-  while (count > 0) {
-    let step = Math.floor(count / 2);
-    let middle = first + step;
-    let middle_value = (lookup === undefined) ? a[middle] : lookup(a, middle);
-    let result = (compare === undefined) ? (value < middle_value) : compare(value, middle_value);
-    if (!result) {
-      first = middle + 1;
-      count -= step + 1;
-    } else {
-      count = step;
-    }
-  }
-  return first;
-}
-
-
-function sortUnique(arr, f) {
-  arr = arr.sort(f);
-  let ret = [arr[0]];
-  for (var i = 1; i < arr.length; i++) {
-    if (arr[i-1] !== arr[i]) {
-      ret.push(arr[i]);
-    }
-  }
-  return ret;
-}
-
-// Partial application without binding the receiver
-function partial(f) {
-  var arguments1 = Array.prototype.slice.call(arguments, 1);
-  return function() {
-    var arguments2 = Array.from(arguments);
-    f.apply(this, arguments1.concat(arguments2));
-  }
-}
diff --git a/deps/v8/tools/turbolizer/view.js b/deps/v8/tools/turbolizer/view.js
deleted file mode 100644
index a7c1f1e4178da1..00000000000000
--- a/deps/v8/tools/turbolizer/view.js
+++ /dev/null
@@ -1,33 +0,0 @@
-// Copyright 2015 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-"use strict";
-
-class View {
-  constructor(id, broker) {
-    this.divElement = d3.select("#" + id);
-    this.divNode = this.divElement[0][0];
-    this.parentNode = this.divNode.parentNode;
-  }
-
-  isScrollable() {
-    return false;
-  }
-
-  show(data, rememberedSelection) {
-    this.parentNode.appendChild(this.divElement[0][0]);
-    this.initializeContent(data, rememberedSelection);
-    this.divElement.attr(VISIBILITY, 'visible');
-  }
-
-  hide() {
-    this.divElement.attr(VISIBILITY, 'hidden');
-    this.deleteContent();
-    this.parentNode.removeChild(this.divNode);
-  }
-
-  detachSelection() {
-    return null;
-  }
-}
diff --git a/deps/v8/tools/ubsan/blacklist.txt b/deps/v8/tools/ubsan/blacklist.txt
new file mode 100644
index 00000000000000..213f2da600ab56
--- /dev/null
+++ b/deps/v8/tools/ubsan/blacklist.txt
@@ -0,0 +1,2 @@
+#############################################################################
+# UBSan blacklist.
\ No newline at end of file
diff --git a/deps/v8/tools/v8heapconst.py b/deps/v8/tools/v8heapconst.py
index e3b29f820423b0..b818073d75d6fa 100644
--- a/deps/v8/tools/v8heapconst.py
+++ b/deps/v8/tools/v8heapconst.py
@@ -59,60 +59,71 @@
   155: "ACCESSOR_PAIR_TYPE",
   156: "ALIASED_ARGUMENTS_ENTRY_TYPE",
   157: "ALLOCATION_MEMENTO_TYPE",
-  158: "ALLOCATION_SITE_TYPE",
-  159: "ASYNC_GENERATOR_REQUEST_TYPE",
-  160: "CONTEXT_EXTENSION_TYPE",
-  161: "DEBUG_INFO_TYPE",
-  162: "FUNCTION_TEMPLATE_INFO_TYPE",
-  163: "INTERCEPTOR_INFO_TYPE",
-  164: "INTERPRETER_DATA_TYPE",
-  165: "MODULE_INFO_ENTRY_TYPE",
-  166: "MODULE_TYPE",
-  167: "OBJECT_TEMPLATE_INFO_TYPE",
-  168: "PROMISE_CAPABILITY_TYPE",
-  169: "PROMISE_REACTION_TYPE",
-  170: "PROTOTYPE_INFO_TYPE",
-  171: "SCRIPT_TYPE",
-  172: "STACK_FRAME_INFO_TYPE",
-  173: "TUPLE2_TYPE",
-  174: "TUPLE3_TYPE",
-  175: "WASM_COMPILED_MODULE_TYPE",
-  176: "WASM_DEBUG_INFO_TYPE",
-  177: "WASM_SHARED_MODULE_DATA_TYPE",
-  178: "CALLABLE_TASK_TYPE",
-  179: "CALLBACK_TASK_TYPE",
-  180: "PROMISE_FULFILL_REACTION_JOB_TASK_TYPE",
-  181: "PROMISE_REJECT_REACTION_JOB_TASK_TYPE",
-  182: "PROMISE_RESOLVE_THENABLE_JOB_TASK_TYPE",
-  183: "FIXED_ARRAY_TYPE",
-  184: "BOILERPLATE_DESCRIPTION_TYPE",
-  185: "DESCRIPTOR_ARRAY_TYPE",
-  186: "HASH_TABLE_TYPE",
-  187: "SCOPE_INFO_TYPE",
-  188: "TRANSITION_ARRAY_TYPE",
-  189: "BLOCK_CONTEXT_TYPE",
-  190: "CATCH_CONTEXT_TYPE",
-  191: "DEBUG_EVALUATE_CONTEXT_TYPE",
-  192: "EVAL_CONTEXT_TYPE",
-  193: "FUNCTION_CONTEXT_TYPE",
-  194: "MODULE_CONTEXT_TYPE",
-  195: "NATIVE_CONTEXT_TYPE",
-  196: "SCRIPT_CONTEXT_TYPE",
-  197: "WITH_CONTEXT_TYPE",
-  198: "CALL_HANDLER_INFO_TYPE",
-  199: "CELL_TYPE",
-  200: "CODE_DATA_CONTAINER_TYPE",
-  201: "FEEDBACK_CELL_TYPE",
-  202: "FEEDBACK_VECTOR_TYPE",
-  203: "LOAD_HANDLER_TYPE",
-  204: "PROPERTY_ARRAY_TYPE",
-  205: "PROPERTY_CELL_TYPE",
-  206: "SHARED_FUNCTION_INFO_TYPE",
-  207: "SMALL_ORDERED_HASH_MAP_TYPE",
-  208: "SMALL_ORDERED_HASH_SET_TYPE",
-  209: "STORE_HANDLER_TYPE",
-  210: "WEAK_CELL_TYPE",
-  211: "WEAK_FIXED_ARRAY_TYPE",
+  158: "ASYNC_GENERATOR_REQUEST_TYPE",
+  159: "DEBUG_INFO_TYPE",
+  160: "FUNCTION_TEMPLATE_INFO_TYPE",
+  161: "INTERCEPTOR_INFO_TYPE",
+  162: "INTERPRETER_DATA_TYPE",
+  163: "MODULE_INFO_ENTRY_TYPE",
+  164: "MODULE_TYPE",
+  165: "OBJECT_TEMPLATE_INFO_TYPE",
+  166: "PROMISE_CAPABILITY_TYPE",
+  167: "PROMISE_REACTION_TYPE",
+  168: "PROTOTYPE_INFO_TYPE",
+  169: "SCRIPT_TYPE",
+  170: "STACK_FRAME_INFO_TYPE",
+  171: "TUPLE2_TYPE",
+  172: "TUPLE3_TYPE",
+  173: "ARRAY_BOILERPLATE_DESCRIPTION_TYPE",
+  174: "WASM_DEBUG_INFO_TYPE",
+  175: "WASM_EXPORTED_FUNCTION_DATA_TYPE",
+  176: "CALLABLE_TASK_TYPE",
+  177: "CALLBACK_TASK_TYPE",
+  178: "PROMISE_FULFILL_REACTION_JOB_TASK_TYPE",
+  179: "PROMISE_REJECT_REACTION_JOB_TASK_TYPE",
+  180: "PROMISE_RESOLVE_THENABLE_JOB_TASK_TYPE",
+  181: "ALLOCATION_SITE_TYPE",
+  182: "FIXED_ARRAY_TYPE",
+  183: "OBJECT_BOILERPLATE_DESCRIPTION_TYPE",
+  184: "HASH_TABLE_TYPE",
+  185: "ORDERED_HASH_MAP_TYPE",
+  186: "ORDERED_HASH_SET_TYPE",
+  187: "NAME_DICTIONARY_TYPE",
+  188: "GLOBAL_DICTIONARY_TYPE",
+  189: "NUMBER_DICTIONARY_TYPE",
+  190: "SIMPLE_NUMBER_DICTIONARY_TYPE",
+  191: "STRING_TABLE_TYPE",
+  192: "EPHEMERON_HASH_TABLE_TYPE",
+  193: "SCOPE_INFO_TYPE",
+  194: "SCRIPT_CONTEXT_TABLE_TYPE",
+  195: "BLOCK_CONTEXT_TYPE",
+  196: "CATCH_CONTEXT_TYPE",
+  197: "DEBUG_EVALUATE_CONTEXT_TYPE",
+  198: "EVAL_CONTEXT_TYPE",
+  199: "FUNCTION_CONTEXT_TYPE",
+  200: "MODULE_CONTEXT_TYPE",
+  201: "NATIVE_CONTEXT_TYPE",
+  202: "SCRIPT_CONTEXT_TYPE",
+  203: "WITH_CONTEXT_TYPE",
+  204: "WEAK_FIXED_ARRAY_TYPE",
+  205: "DESCRIPTOR_ARRAY_TYPE",
+  206: "TRANSITION_ARRAY_TYPE",
+  207: "CALL_HANDLER_INFO_TYPE",
+  208: "CELL_TYPE",
+  209: "CODE_DATA_CONTAINER_TYPE",
+  210: "FEEDBACK_CELL_TYPE",
+  211: "FEEDBACK_VECTOR_TYPE",
+  212: "LOAD_HANDLER_TYPE",
+  213: "PROPERTY_ARRAY_TYPE",
+  214: "PROPERTY_CELL_TYPE",
+  215: "SHARED_FUNCTION_INFO_TYPE",
+  216: "SMALL_ORDERED_HASH_MAP_TYPE",
+  217: "SMALL_ORDERED_HASH_SET_TYPE",
+  218: "STORE_HANDLER_TYPE",
+  219: "UNCOMPILED_DATA_WITHOUT_PRE_PARSED_SCOPE_TYPE",
+  220: "UNCOMPILED_DATA_WITH_PRE_PARSED_SCOPE_TYPE",
+  221: "WEAK_CELL_TYPE",
+  222: "WEAK_ARRAY_LIST_TYPE",
   1024: "JS_PROXY_TYPE",
   1025: "JS_GLOBAL_OBJECT_TYPE",
   1026: "JS_GLOBAL_PROXY_TYPE",
@@ -147,199 +158,208 @@
   1081: "JS_WEAK_SET_TYPE",
   1082: "JS_TYPED_ARRAY_TYPE",
   1083: "JS_DATA_VIEW_TYPE",
-  1084: "WASM_GLOBAL_TYPE",
-  1085: "WASM_INSTANCE_TYPE",
-  1086: "WASM_MEMORY_TYPE",
-  1087: "WASM_MODULE_TYPE",
-  1088: "WASM_TABLE_TYPE",
-  1089: "JS_BOUND_FUNCTION_TYPE",
-  1090: "JS_FUNCTION_TYPE",
+  1084: "JS_INTL_LOCALE_TYPE",
+  1085: "JS_INTL_RELATIVE_TIME_FORMAT_TYPE",
+  1086: "WASM_GLOBAL_TYPE",
+  1087: "WASM_INSTANCE_TYPE",
+  1088: "WASM_MEMORY_TYPE",
+  1089: "WASM_MODULE_TYPE",
+  1090: "WASM_TABLE_TYPE",
+  1091: "JS_BOUND_FUNCTION_TYPE",
+  1092: "JS_FUNCTION_TYPE",
 }
 
 # List of known V8 maps.
 KNOWN_MAPS = {
-  ("MAP_SPACE", 0x02201): (138, "FreeSpaceMap"),
-  ("MAP_SPACE", 0x02259): (132, "MetaMap"),
-  ("MAP_SPACE", 0x022b1): (131, "NullMap"),
-  ("MAP_SPACE", 0x02309): (185, "DescriptorArrayMap"),
-  ("MAP_SPACE", 0x02361): (183, "FixedArrayMap"),
-  ("MAP_SPACE", 0x023b9): (152, "OnePointerFillerMap"),
-  ("MAP_SPACE", 0x02411): (152, "TwoPointerFillerMap"),
-  ("MAP_SPACE", 0x02469): (131, "UninitializedMap"),
-  ("MAP_SPACE", 0x024c1): (8, "OneByteInternalizedStringMap"),
-  ("MAP_SPACE", 0x02519): (131, "UndefinedMap"),
-  ("MAP_SPACE", 0x02571): (129, "HeapNumberMap"),
-  ("MAP_SPACE", 0x025c9): (131, "TheHoleMap"),
-  ("MAP_SPACE", 0x02621): (131, "BooleanMap"),
-  ("MAP_SPACE", 0x02679): (136, "ByteArrayMap"),
-  ("MAP_SPACE", 0x026d1): (183, "FixedCOWArrayMap"),
-  ("MAP_SPACE", 0x02729): (186, "HashTableMap"),
-  ("MAP_SPACE", 0x02781): (128, "SymbolMap"),
-  ("MAP_SPACE", 0x027d9): (72, "OneByteStringMap"),
-  ("MAP_SPACE", 0x02831): (187, "ScopeInfoMap"),
-  ("MAP_SPACE", 0x02889): (206, "SharedFunctionInfoMap"),
-  ("MAP_SPACE", 0x028e1): (133, "CodeMap"),
-  ("MAP_SPACE", 0x02939): (193, "FunctionContextMap"),
-  ("MAP_SPACE", 0x02991): (199, "CellMap"),
-  ("MAP_SPACE", 0x029e9): (210, "WeakCellMap"),
-  ("MAP_SPACE", 0x02a41): (205, "GlobalPropertyCellMap"),
-  ("MAP_SPACE", 0x02a99): (135, "ForeignMap"),
-  ("MAP_SPACE", 0x02af1): (188, "TransitionArrayMap"),
-  ("MAP_SPACE", 0x02b49): (202, "FeedbackVectorMap"),
-  ("MAP_SPACE", 0x02ba1): (131, "ArgumentsMarkerMap"),
-  ("MAP_SPACE", 0x02bf9): (131, "ExceptionMap"),
-  ("MAP_SPACE", 0x02c51): (131, "TerminationExceptionMap"),
-  ("MAP_SPACE", 0x02ca9): (131, "OptimizedOutMap"),
-  ("MAP_SPACE", 0x02d01): (131, "StaleRegisterMap"),
-  ("MAP_SPACE", 0x02d59): (195, "NativeContextMap"),
-  ("MAP_SPACE", 0x02db1): (194, "ModuleContextMap"),
-  ("MAP_SPACE", 0x02e09): (192, "EvalContextMap"),
-  ("MAP_SPACE", 0x02e61): (196, "ScriptContextMap"),
-  ("MAP_SPACE", 0x02eb9): (189, "BlockContextMap"),
-  ("MAP_SPACE", 0x02f11): (190, "CatchContextMap"),
-  ("MAP_SPACE", 0x02f69): (197, "WithContextMap"),
-  ("MAP_SPACE", 0x02fc1): (191, "DebugEvaluateContextMap"),
-  ("MAP_SPACE", 0x03019): (183, "ScriptContextTableMap"),
-  ("MAP_SPACE", 0x03071): (151, "FeedbackMetadataArrayMap"),
-  ("MAP_SPACE", 0x030c9): (183, "ArrayListMap"),
-  ("MAP_SPACE", 0x03121): (130, "BigIntMap"),
-  ("MAP_SPACE", 0x03179): (184, "BoilerplateDescriptionMap"),
-  ("MAP_SPACE", 0x031d1): (137, "BytecodeArrayMap"),
-  ("MAP_SPACE", 0x03229): (200, "CodeDataContainerMap"),
-  ("MAP_SPACE", 0x03281): (1057, "ExternalMap"),
-  ("MAP_SPACE", 0x032d9): (150, "FixedDoubleArrayMap"),
-  ("MAP_SPACE", 0x03331): (186, "GlobalDictionaryMap"),
-  ("MAP_SPACE", 0x03389): (201, "ManyClosuresCellMap"),
-  ("MAP_SPACE", 0x033e1): (1072, "JSMessageObjectMap"),
-  ("MAP_SPACE", 0x03439): (183, "ModuleInfoMap"),
-  ("MAP_SPACE", 0x03491): (134, "MutableHeapNumberMap"),
-  ("MAP_SPACE", 0x034e9): (186, "NameDictionaryMap"),
-  ("MAP_SPACE", 0x03541): (201, "NoClosuresCellMap"),
-  ("MAP_SPACE", 0x03599): (186, "NumberDictionaryMap"),
-  ("MAP_SPACE", 0x035f1): (201, "OneClosureCellMap"),
-  ("MAP_SPACE", 0x03649): (186, "OrderedHashMapMap"),
-  ("MAP_SPACE", 0x036a1): (186, "OrderedHashSetMap"),
-  ("MAP_SPACE", 0x036f9): (204, "PropertyArrayMap"),
-  ("MAP_SPACE", 0x03751): (198, "SideEffectCallHandlerInfoMap"),
-  ("MAP_SPACE", 0x037a9): (198, "SideEffectFreeCallHandlerInfoMap"),
-  ("MAP_SPACE", 0x03801): (186, "SimpleNumberDictionaryMap"),
-  ("MAP_SPACE", 0x03859): (183, "SloppyArgumentsElementsMap"),
-  ("MAP_SPACE", 0x038b1): (207, "SmallOrderedHashMapMap"),
-  ("MAP_SPACE", 0x03909): (208, "SmallOrderedHashSetMap"),
-  ("MAP_SPACE", 0x03961): (186, "StringTableMap"),
-  ("MAP_SPACE", 0x039b9): (211, "WeakFixedArrayMap"),
-  ("MAP_SPACE", 0x03a11): (106, "NativeSourceStringMap"),
-  ("MAP_SPACE", 0x03a69): (64, "StringMap"),
-  ("MAP_SPACE", 0x03ac1): (73, "ConsOneByteStringMap"),
-  ("MAP_SPACE", 0x03b19): (65, "ConsStringMap"),
-  ("MAP_SPACE", 0x03b71): (77, "ThinOneByteStringMap"),
-  ("MAP_SPACE", 0x03bc9): (69, "ThinStringMap"),
-  ("MAP_SPACE", 0x03c21): (67, "SlicedStringMap"),
-  ("MAP_SPACE", 0x03c79): (75, "SlicedOneByteStringMap"),
-  ("MAP_SPACE", 0x03cd1): (66, "ExternalStringMap"),
-  ("MAP_SPACE", 0x03d29): (82, "ExternalStringWithOneByteDataMap"),
-  ("MAP_SPACE", 0x03d81): (74, "ExternalOneByteStringMap"),
-  ("MAP_SPACE", 0x03dd9): (98, "ShortExternalStringMap"),
-  ("MAP_SPACE", 0x03e31): (114, "ShortExternalStringWithOneByteDataMap"),
-  ("MAP_SPACE", 0x03e89): (0, "InternalizedStringMap"),
-  ("MAP_SPACE", 0x03ee1): (2, "ExternalInternalizedStringMap"),
-  ("MAP_SPACE", 0x03f39): (18, "ExternalInternalizedStringWithOneByteDataMap"),
-  ("MAP_SPACE", 0x03f91): (10, "ExternalOneByteInternalizedStringMap"),
-  ("MAP_SPACE", 0x03fe9): (34, "ShortExternalInternalizedStringMap"),
-  ("MAP_SPACE", 0x04041): (50, "ShortExternalInternalizedStringWithOneByteDataMap"),
-  ("MAP_SPACE", 0x04099): (42, "ShortExternalOneByteInternalizedStringMap"),
-  ("MAP_SPACE", 0x040f1): (106, "ShortExternalOneByteStringMap"),
-  ("MAP_SPACE", 0x04149): (140, "FixedUint8ArrayMap"),
-  ("MAP_SPACE", 0x041a1): (139, "FixedInt8ArrayMap"),
-  ("MAP_SPACE", 0x041f9): (142, "FixedUint16ArrayMap"),
-  ("MAP_SPACE", 0x04251): (141, "FixedInt16ArrayMap"),
-  ("MAP_SPACE", 0x042a9): (144, "FixedUint32ArrayMap"),
-  ("MAP_SPACE", 0x04301): (143, "FixedInt32ArrayMap"),
-  ("MAP_SPACE", 0x04359): (145, "FixedFloat32ArrayMap"),
-  ("MAP_SPACE", 0x043b1): (146, "FixedFloat64ArrayMap"),
-  ("MAP_SPACE", 0x04409): (147, "FixedUint8ClampedArrayMap"),
-  ("MAP_SPACE", 0x04461): (149, "FixedBigUint64ArrayMap"),
-  ("MAP_SPACE", 0x044b9): (148, "FixedBigInt64ArrayMap"),
-  ("MAP_SPACE", 0x04511): (173, "Tuple2Map"),
-  ("MAP_SPACE", 0x04569): (171, "ScriptMap"),
-  ("MAP_SPACE", 0x045c1): (163, "InterceptorInfoMap"),
-  ("MAP_SPACE", 0x04619): (158, "AllocationSiteMap"),
-  ("MAP_SPACE", 0x04671): (154, "AccessorInfoMap"),
-  ("MAP_SPACE", 0x046c9): (153, "AccessCheckInfoMap"),
-  ("MAP_SPACE", 0x04721): (155, "AccessorPairMap"),
-  ("MAP_SPACE", 0x04779): (156, "AliasedArgumentsEntryMap"),
-  ("MAP_SPACE", 0x047d1): (157, "AllocationMementoMap"),
-  ("MAP_SPACE", 0x04829): (159, "AsyncGeneratorRequestMap"),
-  ("MAP_SPACE", 0x04881): (160, "ContextExtensionMap"),
-  ("MAP_SPACE", 0x048d9): (161, "DebugInfoMap"),
-  ("MAP_SPACE", 0x04931): (162, "FunctionTemplateInfoMap"),
-  ("MAP_SPACE", 0x04989): (164, "InterpreterDataMap"),
-  ("MAP_SPACE", 0x049e1): (165, "ModuleInfoEntryMap"),
-  ("MAP_SPACE", 0x04a39): (166, "ModuleMap"),
-  ("MAP_SPACE", 0x04a91): (167, "ObjectTemplateInfoMap"),
-  ("MAP_SPACE", 0x04ae9): (168, "PromiseCapabilityMap"),
-  ("MAP_SPACE", 0x04b41): (169, "PromiseReactionMap"),
-  ("MAP_SPACE", 0x04b99): (170, "PrototypeInfoMap"),
-  ("MAP_SPACE", 0x04bf1): (172, "StackFrameInfoMap"),
-  ("MAP_SPACE", 0x04c49): (174, "Tuple3Map"),
-  ("MAP_SPACE", 0x04ca1): (175, "WasmCompiledModuleMap"),
-  ("MAP_SPACE", 0x04cf9): (176, "WasmDebugInfoMap"),
-  ("MAP_SPACE", 0x04d51): (177, "WasmSharedModuleDataMap"),
-  ("MAP_SPACE", 0x04da9): (178, "CallableTaskMap"),
-  ("MAP_SPACE", 0x04e01): (179, "CallbackTaskMap"),
-  ("MAP_SPACE", 0x04e59): (180, "PromiseFulfillReactionJobTaskMap"),
-  ("MAP_SPACE", 0x04eb1): (181, "PromiseRejectReactionJobTaskMap"),
-  ("MAP_SPACE", 0x04f09): (182, "PromiseResolveThenableJobTaskMap"),
+  ("RO_SPACE", 0x02201): (138, "FreeSpaceMap"),
+  ("RO_SPACE", 0x02259): (132, "MetaMap"),
+  ("RO_SPACE", 0x022e1): (131, "NullMap"),
+  ("RO_SPACE", 0x02359): (205, "DescriptorArrayMap"),
+  ("RO_SPACE", 0x023c1): (182, "FixedArrayMap"),
+  ("RO_SPACE", 0x02429): (221, "WeakCellMap"),
+  ("RO_SPACE", 0x024d1): (152, "OnePointerFillerMap"),
+  ("RO_SPACE", 0x02539): (152, "TwoPointerFillerMap"),
+  ("RO_SPACE", 0x025d1): (131, "UninitializedMap"),
+  ("RO_SPACE", 0x02661): (8, "OneByteInternalizedStringMap"),
+  ("RO_SPACE", 0x02721): (131, "UndefinedMap"),
+  ("RO_SPACE", 0x02799): (129, "HeapNumberMap"),
+  ("RO_SPACE", 0x02831): (131, "TheHoleMap"),
+  ("RO_SPACE", 0x028f9): (131, "BooleanMap"),
+  ("RO_SPACE", 0x02a09): (136, "ByteArrayMap"),
+  ("RO_SPACE", 0x02a71): (182, "FixedCOWArrayMap"),
+  ("RO_SPACE", 0x02ad9): (184, "HashTableMap"),
+  ("RO_SPACE", 0x02b41): (128, "SymbolMap"),
+  ("RO_SPACE", 0x02ba9): (72, "OneByteStringMap"),
+  ("RO_SPACE", 0x02c11): (193, "ScopeInfoMap"),
+  ("RO_SPACE", 0x02c79): (215, "SharedFunctionInfoMap"),
+  ("RO_SPACE", 0x02ce1): (133, "CodeMap"),
+  ("RO_SPACE", 0x02d49): (199, "FunctionContextMap"),
+  ("RO_SPACE", 0x02db1): (208, "CellMap"),
+  ("RO_SPACE", 0x02e19): (214, "GlobalPropertyCellMap"),
+  ("RO_SPACE", 0x02e81): (135, "ForeignMap"),
+  ("RO_SPACE", 0x02ee9): (206, "TransitionArrayMap"),
+  ("RO_SPACE", 0x02f51): (211, "FeedbackVectorMap"),
+  ("RO_SPACE", 0x02ff9): (131, "ArgumentsMarkerMap"),
+  ("RO_SPACE", 0x030b9): (131, "ExceptionMap"),
+  ("RO_SPACE", 0x03179): (131, "TerminationExceptionMap"),
+  ("RO_SPACE", 0x03241): (131, "OptimizedOutMap"),
+  ("RO_SPACE", 0x03301): (131, "StaleRegisterMap"),
+  ("RO_SPACE", 0x03391): (201, "NativeContextMap"),
+  ("RO_SPACE", 0x033f9): (200, "ModuleContextMap"),
+  ("RO_SPACE", 0x03461): (198, "EvalContextMap"),
+  ("RO_SPACE", 0x034c9): (202, "ScriptContextMap"),
+  ("RO_SPACE", 0x03531): (195, "BlockContextMap"),
+  ("RO_SPACE", 0x03599): (196, "CatchContextMap"),
+  ("RO_SPACE", 0x03601): (203, "WithContextMap"),
+  ("RO_SPACE", 0x03669): (197, "DebugEvaluateContextMap"),
+  ("RO_SPACE", 0x036d1): (194, "ScriptContextTableMap"),
+  ("RO_SPACE", 0x03739): (151, "FeedbackMetadataArrayMap"),
+  ("RO_SPACE", 0x037a1): (182, "ArrayListMap"),
+  ("RO_SPACE", 0x03809): (130, "BigIntMap"),
+  ("RO_SPACE", 0x03871): (183, "ObjectBoilerplateDescriptionMap"),
+  ("RO_SPACE", 0x038d9): (137, "BytecodeArrayMap"),
+  ("RO_SPACE", 0x03941): (209, "CodeDataContainerMap"),
+  ("RO_SPACE", 0x039a9): (150, "FixedDoubleArrayMap"),
+  ("RO_SPACE", 0x03a11): (188, "GlobalDictionaryMap"),
+  ("RO_SPACE", 0x03a79): (210, "ManyClosuresCellMap"),
+  ("RO_SPACE", 0x03ae1): (182, "ModuleInfoMap"),
+  ("RO_SPACE", 0x03b49): (134, "MutableHeapNumberMap"),
+  ("RO_SPACE", 0x03bb1): (187, "NameDictionaryMap"),
+  ("RO_SPACE", 0x03c19): (210, "NoClosuresCellMap"),
+  ("RO_SPACE", 0x03c81): (189, "NumberDictionaryMap"),
+  ("RO_SPACE", 0x03ce9): (210, "OneClosureCellMap"),
+  ("RO_SPACE", 0x03d51): (185, "OrderedHashMapMap"),
+  ("RO_SPACE", 0x03db9): (186, "OrderedHashSetMap"),
+  ("RO_SPACE", 0x03e21): (213, "PropertyArrayMap"),
+  ("RO_SPACE", 0x03e89): (207, "SideEffectCallHandlerInfoMap"),
+  ("RO_SPACE", 0x03ef1): (207, "SideEffectFreeCallHandlerInfoMap"),
+  ("RO_SPACE", 0x03f59): (207, "NextCallSideEffectFreeCallHandlerInfoMap"),
+  ("RO_SPACE", 0x03fc1): (190, "SimpleNumberDictionaryMap"),
+  ("RO_SPACE", 0x04029): (182, "SloppyArgumentsElementsMap"),
+  ("RO_SPACE", 0x04091): (216, "SmallOrderedHashMapMap"),
+  ("RO_SPACE", 0x040f9): (217, "SmallOrderedHashSetMap"),
+  ("RO_SPACE", 0x04161): (191, "StringTableMap"),
+  ("RO_SPACE", 0x041c9): (219, "UncompiledDataWithoutPreParsedScopeMap"),
+  ("RO_SPACE", 0x04231): (220, "UncompiledDataWithPreParsedScopeMap"),
+  ("RO_SPACE", 0x04299): (204, "WeakFixedArrayMap"),
+  ("RO_SPACE", 0x04301): (222, "WeakArrayListMap"),
+  ("RO_SPACE", 0x04369): (192, "EphemeronHashTableMap"),
+  ("RO_SPACE", 0x043d1): (106, "NativeSourceStringMap"),
+  ("RO_SPACE", 0x04439): (64, "StringMap"),
+  ("RO_SPACE", 0x044a1): (73, "ConsOneByteStringMap"),
+  ("RO_SPACE", 0x04509): (65, "ConsStringMap"),
+  ("RO_SPACE", 0x04571): (77, "ThinOneByteStringMap"),
+  ("RO_SPACE", 0x045d9): (69, "ThinStringMap"),
+  ("RO_SPACE", 0x04641): (67, "SlicedStringMap"),
+  ("RO_SPACE", 0x046a9): (75, "SlicedOneByteStringMap"),
+  ("RO_SPACE", 0x04711): (66, "ExternalStringMap"),
+  ("RO_SPACE", 0x04779): (82, "ExternalStringWithOneByteDataMap"),
+  ("RO_SPACE", 0x047e1): (74, "ExternalOneByteStringMap"),
+  ("RO_SPACE", 0x04849): (98, "ShortExternalStringMap"),
+  ("RO_SPACE", 0x048b1): (114, "ShortExternalStringWithOneByteDataMap"),
+  ("RO_SPACE", 0x04919): (0, "InternalizedStringMap"),
+  ("RO_SPACE", 0x04981): (2, "ExternalInternalizedStringMap"),
+  ("RO_SPACE", 0x049e9): (18, "ExternalInternalizedStringWithOneByteDataMap"),
+  ("RO_SPACE", 0x04a51): (10, "ExternalOneByteInternalizedStringMap"),
+  ("RO_SPACE", 0x04ab9): (34, "ShortExternalInternalizedStringMap"),
+  ("RO_SPACE", 0x04b21): (50, "ShortExternalInternalizedStringWithOneByteDataMap"),
+  ("RO_SPACE", 0x04b89): (42, "ShortExternalOneByteInternalizedStringMap"),
+  ("RO_SPACE", 0x04bf1): (106, "ShortExternalOneByteStringMap"),
+  ("RO_SPACE", 0x04c59): (140, "FixedUint8ArrayMap"),
+  ("RO_SPACE", 0x04cc1): (139, "FixedInt8ArrayMap"),
+  ("RO_SPACE", 0x04d29): (142, "FixedUint16ArrayMap"),
+  ("RO_SPACE", 0x04d91): (141, "FixedInt16ArrayMap"),
+  ("RO_SPACE", 0x04df9): (144, "FixedUint32ArrayMap"),
+  ("RO_SPACE", 0x04e61): (143, "FixedInt32ArrayMap"),
+  ("RO_SPACE", 0x04ec9): (145, "FixedFloat32ArrayMap"),
+  ("RO_SPACE", 0x04f31): (146, "FixedFloat64ArrayMap"),
+  ("RO_SPACE", 0x04f99): (147, "FixedUint8ClampedArrayMap"),
+  ("RO_SPACE", 0x05001): (149, "FixedBigUint64ArrayMap"),
+  ("RO_SPACE", 0x05069): (148, "FixedBigInt64ArrayMap"),
+  ("RO_SPACE", 0x050d1): (131, "SelfReferenceMarkerMap"),
+  ("RO_SPACE", 0x05151): (171, "Tuple2Map"),
+  ("RO_SPACE", 0x054a1): (161, "InterceptorInfoMap"),
+  ("RO_SPACE", 0x055c1): (169, "ScriptMap"),
+  ("RO_SPACE", 0x09fb9): (154, "AccessorInfoMap"),
+  ("RO_SPACE", 0x0a021): (153, "AccessCheckInfoMap"),
+  ("RO_SPACE", 0x0a089): (155, "AccessorPairMap"),
+  ("RO_SPACE", 0x0a0f1): (156, "AliasedArgumentsEntryMap"),
+  ("RO_SPACE", 0x0a159): (157, "AllocationMementoMap"),
+  ("RO_SPACE", 0x0a1c1): (158, "AsyncGeneratorRequestMap"),
+  ("RO_SPACE", 0x0a229): (159, "DebugInfoMap"),
+  ("RO_SPACE", 0x0a291): (160, "FunctionTemplateInfoMap"),
+  ("RO_SPACE", 0x0a2f9): (162, "InterpreterDataMap"),
+  ("RO_SPACE", 0x0a361): (163, "ModuleInfoEntryMap"),
+  ("RO_SPACE", 0x0a3c9): (164, "ModuleMap"),
+  ("RO_SPACE", 0x0a431): (165, "ObjectTemplateInfoMap"),
+  ("RO_SPACE", 0x0a499): (166, "PromiseCapabilityMap"),
+  ("RO_SPACE", 0x0a501): (167, "PromiseReactionMap"),
+  ("RO_SPACE", 0x0a569): (168, "PrototypeInfoMap"),
+  ("RO_SPACE", 0x0a5d1): (170, "StackFrameInfoMap"),
+  ("RO_SPACE", 0x0a639): (172, "Tuple3Map"),
+  ("RO_SPACE", 0x0a6a1): (173, "ArrayBoilerplateDescriptionMap"),
+  ("RO_SPACE", 0x0a709): (174, "WasmDebugInfoMap"),
+  ("RO_SPACE", 0x0a771): (175, "WasmExportedFunctionDataMap"),
+  ("RO_SPACE", 0x0a7d9): (176, "CallableTaskMap"),
+  ("RO_SPACE", 0x0a841): (177, "CallbackTaskMap"),
+  ("RO_SPACE", 0x0a8a9): (178, "PromiseFulfillReactionJobTaskMap"),
+  ("RO_SPACE", 0x0a911): (179, "PromiseRejectReactionJobTaskMap"),
+  ("RO_SPACE", 0x0a979): (180, "PromiseResolveThenableJobTaskMap"),
+  ("RO_SPACE", 0x0a9e1): (181, "AllocationSiteMap"),
+  ("RO_SPACE", 0x0aa49): (181, "AllocationSiteMap"),
+  ("MAP_SPACE", 0x02201): (1057, "ExternalMap"),
+  ("MAP_SPACE", 0x02259): (1072, "JSMessageObjectMap"),
 }
 
 # List of known V8 objects.
 KNOWN_OBJECTS = {
-  ("OLD_SPACE", 0x02201): "NullValue",
-  ("OLD_SPACE", 0x02231): "EmptyDescriptorArray",
-  ("OLD_SPACE", 0x02251): "EmptyFixedArray",
-  ("OLD_SPACE", 0x02261): "UninitializedValue",
-  ("OLD_SPACE", 0x022e1): "UndefinedValue",
-  ("OLD_SPACE", 0x02311): "NanValue",
-  ("OLD_SPACE", 0x02321): "TheHoleValue",
-  ("OLD_SPACE", 0x02371): "HoleNanValue",
-  ("OLD_SPACE", 0x02381): "TrueValue",
-  ("OLD_SPACE", 0x023f1): "FalseValue",
-  ("OLD_SPACE", 0x02441): "empty_string",
-  ("OLD_SPACE", 0x02459): "EmptyScopeInfo",
-  ("OLD_SPACE", 0x02469): "ArgumentsMarker",
-  ("OLD_SPACE", 0x024c1): "Exception",
-  ("OLD_SPACE", 0x02519): "TerminationException",
-  ("OLD_SPACE", 0x02579): "OptimizedOut",
-  ("OLD_SPACE", 0x025d1): "StaleRegister",
-  ("OLD_SPACE", 0x02661): "EmptyByteArray",
-  ("OLD_SPACE", 0x02681): "EmptyFixedUint8Array",
-  ("OLD_SPACE", 0x026a1): "EmptyFixedInt8Array",
-  ("OLD_SPACE", 0x026c1): "EmptyFixedUint16Array",
-  ("OLD_SPACE", 0x026e1): "EmptyFixedInt16Array",
-  ("OLD_SPACE", 0x02701): "EmptyFixedUint32Array",
-  ("OLD_SPACE", 0x02721): "EmptyFixedInt32Array",
-  ("OLD_SPACE", 0x02741): "EmptyFixedFloat32Array",
-  ("OLD_SPACE", 0x02761): "EmptyFixedFloat64Array",
-  ("OLD_SPACE", 0x02781): "EmptyFixedUint8ClampedArray",
-  ("OLD_SPACE", 0x027e1): "EmptyScript",
-  ("OLD_SPACE", 0x02879): "ManyClosuresCell",
-  ("OLD_SPACE", 0x02889): "EmptySloppyArgumentsElements",
-  ("OLD_SPACE", 0x028a9): "EmptySlowElementDictionary",
-  ("OLD_SPACE", 0x028f1): "EmptyOrderedHashMap",
-  ("OLD_SPACE", 0x02919): "EmptyOrderedHashSet",
-  ("OLD_SPACE", 0x02951): "EmptyPropertyCell",
-  ("OLD_SPACE", 0x02979): "EmptyWeakCell",
-  ("OLD_SPACE", 0x029e9): "NoElementsProtector",
-  ("OLD_SPACE", 0x02a11): "IsConcatSpreadableProtector",
-  ("OLD_SPACE", 0x02a21): "ArraySpeciesProtector",
-  ("OLD_SPACE", 0x02a49): "TypedArraySpeciesProtector",
-  ("OLD_SPACE", 0x02a71): "PromiseSpeciesProtector",
-  ("OLD_SPACE", 0x02a99): "StringLengthProtector",
-  ("OLD_SPACE", 0x02aa9): "ArrayIteratorProtector",
-  ("OLD_SPACE", 0x02ad1): "ArrayBufferNeuteringProtector",
-  ("OLD_SPACE", 0x02b59): "InfinityValue",
-  ("OLD_SPACE", 0x02b69): "MinusZeroValue",
-  ("OLD_SPACE", 0x02b79): "MinusInfinityValue",
+  ("RO_SPACE", 0x022b1): "NullValue",
+  ("RO_SPACE", 0x02339): "EmptyDescriptorArray",
+  ("RO_SPACE", 0x023b1): "EmptyFixedArray",
+  ("RO_SPACE", 0x025a1): "UninitializedValue",
+  ("RO_SPACE", 0x026f1): "UndefinedValue",
+  ("RO_SPACE", 0x02789): "NanValue",
+  ("RO_SPACE", 0x02801): "TheHoleValue",
+  ("RO_SPACE", 0x028b9): "HoleNanValue",
+  ("RO_SPACE", 0x028c9): "TrueValue",
+  ("RO_SPACE", 0x029a1): "FalseValue",
+  ("RO_SPACE", 0x029f1): "empty_string",
+  ("RO_SPACE", 0x02fb9): "EmptyScopeInfo",
+  ("RO_SPACE", 0x02fc9): "ArgumentsMarker",
+  ("RO_SPACE", 0x03089): "Exception",
+  ("RO_SPACE", 0x03149): "TerminationException",
+  ("RO_SPACE", 0x03211): "OptimizedOut",
+  ("RO_SPACE", 0x032d1): "StaleRegister",
+  ("RO_SPACE", 0x051c9): "EmptyByteArray",
+  ("RO_SPACE", 0x051f1): "EmptyFixedUint8Array",
+  ("RO_SPACE", 0x05211): "EmptyFixedInt8Array",
+  ("RO_SPACE", 0x05231): "EmptyFixedUint16Array",
+  ("RO_SPACE", 0x05251): "EmptyFixedInt16Array",
+  ("RO_SPACE", 0x05271): "EmptyFixedUint32Array",
+  ("RO_SPACE", 0x05291): "EmptyFixedInt32Array",
+  ("RO_SPACE", 0x052b1): "EmptyFixedFloat32Array",
+  ("RO_SPACE", 0x052d1): "EmptyFixedFloat64Array",
+  ("RO_SPACE", 0x052f1): "EmptyFixedUint8ClampedArray",
+  ("RO_SPACE", 0x05351): "EmptySloppyArgumentsElements",
+  ("RO_SPACE", 0x05371): "EmptySlowElementDictionary",
+  ("RO_SPACE", 0x053b9): "EmptyOrderedHashMap",
+  ("RO_SPACE", 0x053e1): "EmptyOrderedHashSet",
+  ("RO_SPACE", 0x05419): "EmptyPropertyCell",
+  ("RO_SPACE", 0x05441): "EmptyWeakCell",
+  ("RO_SPACE", 0x05531): "InfinityValue",
+  ("RO_SPACE", 0x05541): "MinusZeroValue",
+  ("RO_SPACE", 0x05551): "MinusInfinityValue",
+  ("RO_SPACE", 0x05561): "SelfReferenceMarker",
+  ("OLD_SPACE", 0x02211): "EmptyScript",
+  ("OLD_SPACE", 0x02291): "ManyClosuresCell",
+  ("OLD_SPACE", 0x022b1): "NoElementsProtector",
+  ("OLD_SPACE", 0x022d9): "IsConcatSpreadableProtector",
+  ("OLD_SPACE", 0x022e9): "ArraySpeciesProtector",
+  ("OLD_SPACE", 0x02311): "TypedArraySpeciesProtector",
+  ("OLD_SPACE", 0x02339): "PromiseSpeciesProtector",
+  ("OLD_SPACE", 0x02361): "StringLengthProtector",
+  ("OLD_SPACE", 0x02371): "ArrayIteratorProtector",
+  ("OLD_SPACE", 0x02399): "ArrayBufferNeuteringProtector",
 }
 
 # List of known V8 Frame Markers.
@@ -353,6 +373,7 @@
   "JS_TO_WASM",
   "WASM_INTERPRETER_ENTRY",
   "C_WASM_ENTRY",
+  "WASM_COMPILE_LAZY",
   "INTERPRETED",
   "STUB",
   "BUILTIN_CONTINUATION",
@@ -366,4 +387,4 @@
   "NATIVE",
 )
 
-# This set of constants is generated from a non-shipping build.
+# This set of constants is generated from a shipping build.
diff --git a/deps/v8/tools/whitespace.txt b/deps/v8/tools/whitespace.txt
index ed5e51f96a63e8..53fe4f594505f7 100644
--- a/deps/v8/tools/whitespace.txt
+++ b/deps/v8/tools/whitespace.txt
@@ -7,6 +7,4 @@ A Smi balks into a war and says:
 The doubles heard this and started to unbox.
 The Smi looked at them when a crazy v8-autoroll account showed up...
 The autoroller bought a round of Himbeerbrause. Suddenly...
-The bartender starts to shake the bottles.......................
-.
-.
+The bartender starts to shake the bottles...............................

From 0316fdfbac760c1482aea25946eb725e8040fdd9 Mon Sep 17 00:00:00 2001
From: Yang Guo <yangguo@chromium.org>
Date: Wed, 11 Jul 2018 09:51:45 +0200
Subject: [PATCH 17/28] Fix node_test_fixture.h

---
 test/cctest/node_test_fixture.h | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/test/cctest/node_test_fixture.h b/test/cctest/node_test_fixture.h
index 4a729be09c2d0b..0138e55a0ef01c 100644
--- a/test/cctest/node_test_fixture.h
+++ b/test/cctest/node_test_fixture.h
@@ -88,7 +88,9 @@ class NodeTestFixture : public ::testing::Test {
   virtual void SetUp() {
     allocator = ArrayBufferUniquePtr(node::CreateArrayBufferAllocator(),
                                      &node::FreeArrayBufferAllocator);
-    isolate_ = NewIsolate(allocator.get());
+    v8::Isolate::CreateParams params;
+    params.array_buffer_allocator = allocator.get();
+    isolate_ = v8::Isolate::Allocate();
     CHECK_NE(isolate_, nullptr);
     platform->RegisterIsolate(isolate_, &current_loop);
     v8::Isolate::Initialize(isolate_, params);

From e3636fbdd5c0ef6f01b02d6a58aa71bb892bc5de Mon Sep 17 00:00:00 2001
From: Ingvar Stepanyan <me@rreverser.com>
Date: Tue, 17 Apr 2018 17:35:04 +0100
Subject: [PATCH 18/28] test: fix scriptParsed event expectations

As per Node.js docs, vm.Script instance is not bound to any context.

However, this test was expecting otherwise and depended on
implementation details which are going to change.

Refs: https://chromium-review.googlesource.com/c/v8/v8/+/1013581
---
 .../test-inspector-scriptparsed-context.js    | 34 ++++---------------
 1 file changed, 7 insertions(+), 27 deletions(-)

diff --git a/test/sequential/test-inspector-scriptparsed-context.js b/test/sequential/test-inspector-scriptparsed-context.js
index abffbfe5fc67f2..515616a55e35c1 100644
--- a/test/sequential/test-inspector-scriptparsed-context.js
+++ b/test/sequential/test-inspector-scriptparsed-context.js
@@ -10,27 +10,17 @@ const script = `
   'use strict';
   const assert = require('assert');
   const vm = require('vm');
-  const { kParsingContext } = process.binding('contextify');
   global.outer = true;
   global.inner = false;
   const context = vm.createContext({
     outer: false,
     inner: true
   });
+  const script = new vm.Script("outer");
   debugger;
 
-  const scriptMain = new vm.Script("outer");
-  debugger;
-
-  const scriptContext = new vm.Script("inner", {
-    [kParsingContext]: context
-  });
-  debugger;
-
-  assert.strictEqual(scriptMain.runInThisContext(), true);
-  assert.strictEqual(scriptMain.runInContext(context), false);
-  assert.strictEqual(scriptContext.runInThisContext(), false);
-  assert.strictEqual(scriptContext.runInContext(context), true);
+  assert.strictEqual(script.runInThisContext(), true);
+  assert.strictEqual(script.runInContext(context), false);
   debugger;
 
   vm.runInContext('inner', context);
@@ -65,35 +55,25 @@ async function runTests() {
   await session.waitForBreakOnLine(0, '[eval]');
 
   await session.send({ 'method': 'Runtime.enable' });
-  const topContext = await getContext(session);
+  await getContext(session);
   await session.send({ 'method': 'Debugger.resume' });
   const childContext = await getContext(session);
   await session.waitForBreakOnLine(13, '[eval]');
 
-  console.error('[test]', 'Script associated with current context by default');
-  await session.send({ 'method': 'Debugger.resume' });
-  await checkScriptContext(session, topContext);
-  await session.waitForBreakOnLine(16, '[eval]');
-
-  console.error('[test]', 'Script associated with selected context');
-  await session.send({ 'method': 'Debugger.resume' });
-  await checkScriptContext(session, childContext);
-  await session.waitForBreakOnLine(21, '[eval]');
-
   console.error('[test]', 'Script is unbound');
   await session.send({ 'method': 'Debugger.resume' });
-  await session.waitForBreakOnLine(27, '[eval]');
+  await session.waitForBreakOnLine(17, '[eval]');
 
   console.error('[test]', 'vm.runInContext associates script with context');
   await session.send({ 'method': 'Debugger.resume' });
   await checkScriptContext(session, childContext);
-  await session.waitForBreakOnLine(30, '[eval]');
+  await session.waitForBreakOnLine(20, '[eval]');
 
   console.error('[test]', 'vm.runInNewContext associates script with context');
   await session.send({ 'method': 'Debugger.resume' });
   const thirdContext = await getContext(session);
   await checkScriptContext(session, thirdContext);
-  await session.waitForBreakOnLine(33, '[eval]');
+  await session.waitForBreakOnLine(23, '[eval]');
 
   console.error('[test]', 'vm.runInNewContext can contain debugger statements');
   await session.send({ 'method': 'Debugger.resume' });

From c4f045227ae0bb20abe16bd766691f947811ed1e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Micha=C3=ABl=20Zasso?= <targos@protonmail.com>
Date: Mon, 2 Jul 2018 20:58:11 +0200
Subject: [PATCH 19/28] src: update NODE_MODULE_VERSION to 66

Major V8 updates are usually API/ABI incompatible with previous
versions. This commit adapts NODE_MODULE_VERSION for V8 6.9.

Refs: https://github.com/nodejs/CTC/blob/master/meetings/2016-09-28.md
---
 src/node_version.h | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/src/node_version.h b/src/node_version.h
index eeb77b4a180b55..815c6c2ddd78d0 100644
--- a/src/node_version.h
+++ b/src/node_version.h
@@ -108,10 +108,11 @@
  * V8 6.5: 62
  * V8 6.6: 63
  * V8 6.7: 64
+ * V8 6.9: 66
  *
  * More information can be found at https://nodejs.org/en/download/releases/
  */
-#define NODE_MODULE_VERSION 64
+#define NODE_MODULE_VERSION 66
 
 // the NAPI_VERSION provided by this version of the runtime
 #define NAPI_VERSION  3

From d5a76afecb2aa71f86493f5d3798d4b40aa8bf11 Mon Sep 17 00:00:00 2001
From: Alexey Kozyatinskiy <kozyatinskiy@chromium.org>
Date: Fri, 11 May 2018 13:47:45 -0700
Subject: [PATCH 20/28] test: fix inspector tests after V8 upgrade

V8 improved break locations for the node --inspect-brk -e case.
---
 .../test-inspector-async-hook-setup-at-inspect-brk.js          | 2 +-
 .../test-inspector-async-stack-traces-promise-then.js          | 2 +-
 .../test-inspector-async-stack-traces-set-interval.js          | 2 +-
 test/sequential/test-inspector-break-e.js                      | 3 +--
 test/sequential/test-inspector-exception.js                    | 2 +-
 test/sequential/test-inspector-scriptparsed-context.js         | 2 +-
 6 files changed, 6 insertions(+), 7 deletions(-)

diff --git a/test/sequential/test-inspector-async-hook-setup-at-inspect-brk.js b/test/sequential/test-inspector-async-hook-setup-at-inspect-brk.js
index e0c3b4dcb86e37..a224f511616a72 100644
--- a/test/sequential/test-inspector-async-hook-setup-at-inspect-brk.js
+++ b/test/sequential/test-inspector-async-hook-setup-at-inspect-brk.js
@@ -15,7 +15,7 @@ setTimeout(() => {
 `;
 
 async function skipBreakpointAtStart(session) {
-  await session.waitForBreakOnLine(0, '[eval]');
+  await session.waitForBreakOnLine(3, '[eval]');
   await session.send({ 'method': 'Debugger.resume' });
 }
 
diff --git a/test/sequential/test-inspector-async-stack-traces-promise-then.js b/test/sequential/test-inspector-async-stack-traces-promise-then.js
index e803be7167f592..da878cbe10495f 100644
--- a/test/sequential/test-inspector-async-stack-traces-promise-then.js
+++ b/test/sequential/test-inspector-async-stack-traces-promise-then.js
@@ -32,7 +32,7 @@ async function runTests() {
     { 'method': 'Runtime.runIfWaitingForDebugger' }
   ]);
 
-  await session.waitForBreakOnLine(0, '[eval]');
+  await session.waitForBreakOnLine(2, '[eval]');
   await session.send({ 'method': 'Debugger.resume' });
 
   console.error('[test] Waiting for break1');
diff --git a/test/sequential/test-inspector-async-stack-traces-set-interval.js b/test/sequential/test-inspector-async-stack-traces-set-interval.js
index 326032d40b20e6..92304055fa2ebf 100644
--- a/test/sequential/test-inspector-async-stack-traces-set-interval.js
+++ b/test/sequential/test-inspector-async-stack-traces-set-interval.js
@@ -11,7 +11,7 @@ const script = 'setInterval(() => { debugger; }, 50);';
 
 async function skipFirstBreakpoint(session) {
   console.log('[test]', 'Skipping the first breakpoint in the eval script');
-  await session.waitForBreakOnLine(0, '[eval]');
+  await session.waitForBreakOnLine(2, '[eval]');
   await session.send({ 'method': 'Debugger.resume' });
 }
 
diff --git a/test/sequential/test-inspector-break-e.js b/test/sequential/test-inspector-break-e.js
index 8db403ad2cd0d0..983c97a36cec66 100644
--- a/test/sequential/test-inspector-break-e.js
+++ b/test/sequential/test-inspector-break-e.js
@@ -1,7 +1,6 @@
 // Flags: --expose-internals
 'use strict';
 const common = require('../common');
-
 common.skipIfInspectorDisabled();
 common.crashOnUnhandledRejection();
 
@@ -16,7 +15,7 @@ async function runTests() {
     { 'method': 'Debugger.enable' },
     { 'method': 'Runtime.runIfWaitingForDebugger' }
   ]);
-  await session.waitForBreakOnLine(0, '[eval]');
+  await session.waitForBreakOnLine(2, '[eval]');
   await session.runToCompletion();
   assert.strictEqual(0, (await instance.expectShutdown()).exitCode);
 }
diff --git a/test/sequential/test-inspector-exception.js b/test/sequential/test-inspector-exception.js
index 3f83b37c7265a8..8044c867a41d83 100644
--- a/test/sequential/test-inspector-exception.js
+++ b/test/sequential/test-inspector-exception.js
@@ -29,7 +29,7 @@ async function testBreakpointOnStart(session) {
   ];
 
   await session.send(commands);
-  await session.waitForBreakOnLine(0, script);
+  await session.waitForBreakOnLine(21, script);
 }
 
 
diff --git a/test/sequential/test-inspector-scriptparsed-context.js b/test/sequential/test-inspector-scriptparsed-context.js
index 515616a55e35c1..8189c8f4dd93a4 100644
--- a/test/sequential/test-inspector-scriptparsed-context.js
+++ b/test/sequential/test-inspector-scriptparsed-context.js
@@ -52,7 +52,7 @@ async function runTests() {
     { 'method': 'Debugger.enable' },
     { 'method': 'Runtime.runIfWaitingForDebugger' }
   ]);
-  await session.waitForBreakOnLine(0, '[eval]');
+  await session.waitForBreakOnLine(4, '[eval]');
 
   await session.send({ 'method': 'Runtime.enable' });
   await getContext(session);

From 820faa8e82d52cc607cab5bcb4decb8a47086637 Mon Sep 17 00:00:00 2001
From: Yang Guo <yangguo@chromium.org>
Date: Wed, 11 Jul 2018 10:26:59 +0200
Subject: [PATCH 21/28] Bump ICU to 62.1

---
 deps/v8/DEPS                                  |   2 +-
 deps/v8/src/regexp/regexp-parser.cc           |   3 +
 .../intl/number-format/format-currency.js     |   2 +-
 .../regexp-property-script-extensions.js      | 626 +++++++++---------
 .../intl-numberformat-formattoparts.js        |   6 +-
 deps/v8/test/mozilla/mozilla.status           |   4 +
 deps/v8/test/test262/test262.status           | 117 ----
 7 files changed, 337 insertions(+), 423 deletions(-)

diff --git a/deps/v8/DEPS b/deps/v8/DEPS
index 3054e957c96bdc..79ceacc75082a2 100644
--- a/deps/v8/DEPS
+++ b/deps/v8/DEPS
@@ -18,7 +18,7 @@ deps = {
   'v8/third_party/depot_tools':
     Var('chromium_url') + '/chromium/tools/depot_tools.git' + '@' + 'c3975e55e1465d9d9320ae67889f0b057c7d7ec3',
   'v8/third_party/icu':
-    Var('chromium_url') + '/chromium/deps/icu.git' + '@' + '172d33141cd16df9d027cfd49bfe940b1dc66f1a',
+    Var('chromium_url') + '/chromium/deps/icu.git' + '@' + 'a9a2bd3ee4f1d313651c5272252aaf2a3e7ed529',
   'v8/third_party/instrumented_libraries':
     Var('chromium_url') + '/chromium/src/third_party/instrumented_libraries.git' + '@' + '323cf32193caecbf074d1a0cb5b02b905f163e0f',
   'v8/buildtools':
diff --git a/deps/v8/src/regexp/regexp-parser.cc b/deps/v8/src/regexp/regexp-parser.cc
index b6e4485254c38a..c1d2c7d5cd8ddf 100644
--- a/deps/v8/src/regexp/regexp-parser.cc
+++ b/deps/v8/src/regexp/regexp-parser.cc
@@ -1291,6 +1291,9 @@ bool IsSupportedBinaryProperty(UProperty property) {
     case UCHAR_EMOJI_MODIFIER_BASE:
     case UCHAR_EMOJI_MODIFIER:
     case UCHAR_EMOJI_PRESENTATION:
+#if U_ICU_VERSION_MAJOR_NUM >= 62
+    case UCHAR_EXTENDED_PICTOGRAPHIC:
+#endif
     case UCHAR_EXTENDER:
     case UCHAR_GRAPHEME_BASE:
     case UCHAR_GRAPHEME_EXTEND:
diff --git a/deps/v8/test/intl/number-format/format-currency.js b/deps/v8/test/intl/number-format/format-currency.js
index 97e49f9aa67178..0013ebea7794ac 100755
--- a/deps/v8/test/intl/number-format/format-currency.js
+++ b/deps/v8/test/intl/number-format/format-currency.js
@@ -12,7 +12,7 @@ assertEquals("$54,306.40", nf_USD.format(parseFloat(54306.4047970)));
 var nf_JPY = new Intl.NumberFormat(['ja'],
     {style: 'currency', currency: 'JPY', currencyDisplay: "code"});
 
-assertEquals("JPY54,306", nf_JPY.format(parseFloat(54306.4047970)));
+assertEquals("JPY\u00a054,306", nf_JPY.format(parseFloat(54306.4047970)));
 
 var nf_EUR = new Intl.NumberFormat(['pt'], {style: 'currency', currency: 'EUR'});
 
diff --git a/deps/v8/test/mjsunit/harmony/regexp-property-script-extensions.js b/deps/v8/test/mjsunit/harmony/regexp-property-script-extensions.js
index db7d3a88744ee7..149ee904490452 100644
--- a/deps/v8/test/mjsunit/harmony/regexp-property-script-extensions.js
+++ b/deps/v8/test/mjsunit/harmony/regexp-property-script-extensions.js
@@ -52,360 +52,384 @@ for (let s of map.keys()){
 }
 */
 
-// Unicode version 10.0.0
+// Unicode version 11.0.0
 // https://unicode.org/Public/10.0.0/ucd/ScriptExtensions.txt
 
 // Script_Extension=Beng
-f(/(?=\P{sc=Beng})\p{scx=Beng}/u, "\u{52ddd}");
-f(/(?=\P{sc=Beng})\p{scx=Beng}/u, "\u{10b77b}");
-f(/(?=\P{sc=Beng})\p{scx=Beng}/u, "\u{74b3}");
-f(/(?=\P{sc=Beng})\p{scx=Beng}/u, "\u{b8edf}");
-f(/(?=\P{sc=Beng})\p{scx=Beng}/u, "\u{7eebe}");
+f(/(?=\P{sc=Beng})\p{scx=Beng}/u, "\u{e52ee}");
+f(/(?=\P{sc=Beng})\p{scx=Beng}/u, "\u{78b48}");
+f(/(?=\P{sc=Beng})\p{scx=Beng}/u, "\u{59987}");
+f(/(?=\P{sc=Beng})\p{scx=Beng}/u, "\u{d18a8}");
+f(/(?=\P{sc=Beng})\p{scx=Beng}/u, "\u{2b84e}");
 // Script_Extension=Deva
-f(/(?=\P{sc=Deva})\p{scx=Deva}/u, "\u{51c7e}");
-f(/(?=\P{sc=Deva})\p{scx=Deva}/u, "\u{bd4e8}");
-f(/(?=\P{sc=Deva})\p{scx=Deva}/u, "\u{a376f}");
-f(/(?=\P{sc=Deva})\p{scx=Deva}/u, "\u{d26}");
-f(/(?=\P{sc=Deva})\p{scx=Deva}/u, "\u{301f2}");
+f(/(?=\P{sc=Deva})\p{scx=Deva}/u, "\u{757f8}");
+f(/(?=\P{sc=Deva})\p{scx=Deva}/u, "\u{2cb44}");
+f(/(?=\P{sc=Deva})\p{scx=Deva}/u, "\u{7624d}");
+f(/(?=\P{sc=Deva})\p{scx=Deva}/u, "\u{9a219}");
+f(/(?=\P{sc=Deva})\p{scx=Deva}/u, "\u{e41a8}");
 // Script_Extension=Dupl
-f(/(?=\P{sc=Dupl})\p{scx=Dupl}/u, "\u{d0910}");
-f(/(?=\P{sc=Dupl})\p{scx=Dupl}/u, "\u{4262c}");
-f(/(?=\P{sc=Dupl})\p{scx=Dupl}/u, "\u{fc99b}");
-f(/(?=\P{sc=Dupl})\p{scx=Dupl}/u, "\u{b4a3c}");
-f(/(?=\P{sc=Dupl})\p{scx=Dupl}/u, "\u{27c19}");
+f(/(?=\P{sc=Dupl})\p{scx=Dupl}/u, "\u{4ae62}");
+f(/(?=\P{sc=Dupl})\p{scx=Dupl}/u, "\u{b80a}");
+f(/(?=\P{sc=Dupl})\p{scx=Dupl}/u, "\u{c856c}");
+f(/(?=\P{sc=Dupl})\p{scx=Dupl}/u, "\u{36c5f}");
+f(/(?=\P{sc=Dupl})\p{scx=Dupl}/u, "\u{42ef3}");
 // Script_Extension=Grek
-f(/(?=\P{sc=Grek})\p{scx=Grek}/u, "\u{331fb}");
-f(/(?=\P{sc=Grek})\p{scx=Grek}/u, "\u{49feb}");
-f(/(?=\P{sc=Grek})\p{scx=Grek}/u, "\u{9b52c}");
-f(/(?=\P{sc=Grek})\p{scx=Grek}/u, "\u{466fb}");
-f(/(?=\P{sc=Grek})\p{scx=Grek}/u, "\u{ed86b}");
+f(/(?=\P{sc=Grek})\p{scx=Grek}/u, "\u{85c59}");
+f(/(?=\P{sc=Grek})\p{scx=Grek}/u, "\u{bd40}");
+f(/(?=\P{sc=Grek})\p{scx=Grek}/u, "\u{7ffef}");
+f(/(?=\P{sc=Grek})\p{scx=Grek}/u, "\u{b4a21}");
+f(/(?=\P{sc=Grek})\p{scx=Grek}/u, "\u{b97b3}");
 // Script_Extension=Hani
-f(/(?=\P{sc=Hani})\p{scx=Hani}/u, "\u{10b11f}");
-f(/(?=\P{sc=Hani})\p{scx=Hani}/u, "\u{16e09}");
-f(/(?=\P{sc=Hani})\p{scx=Hani}/u, "\u{8287c}");
-f(/(?=\P{sc=Hani})\p{scx=Hani}/u, "\u{2b7aa}");
-f(/(?=\P{sc=Hani})\p{scx=Hani}/u, "\u{8074a}");
+f(/(?=\P{sc=Hani})\p{scx=Hani}/u, "\u{d59d4}");
+f(/(?=\P{sc=Hani})\p{scx=Hani}/u, "\u{8da54}");
+f(/(?=\P{sc=Hani})\p{scx=Hani}/u, "\u{77a36}");
+f(/(?=\P{sc=Hani})\p{scx=Hani}/u, "\u{8d66b}");
+f(/(?=\P{sc=Hani})\p{scx=Hani}/u, "\u{b2371}");
 // Script_Extension=Latn
-f(/(?=\P{sc=Latn})\p{scx=Latn}/u, "\u{2cc83}");
-f(/(?=\P{sc=Latn})\p{scx=Latn}/u, "\u{10a158}");
-f(/(?=\P{sc=Latn})\p{scx=Latn}/u, "\u{97717}");
-f(/(?=\P{sc=Latn})\p{scx=Latn}/u, "\u{10a2c2}");
-f(/(?=\P{sc=Latn})\p{scx=Latn}/u, "\u{98275}");
+f(/(?=\P{sc=Latn})\p{scx=Latn}/u, "\u{10d47b}");
+f(/(?=\P{sc=Latn})\p{scx=Latn}/u, "\u{7a184}");
+f(/(?=\P{sc=Latn})\p{scx=Latn}/u, "\u{a64ac}");
+f(/(?=\P{sc=Latn})\p{scx=Latn}/u, "\u{ea450}");
+f(/(?=\P{sc=Latn})\p{scx=Latn}/u, "\u{ab23e}");
 // Script_Extension=Arab
-f(/(?=\P{sc=Arab})\p{scx=Arab}/u, "\u{ad4b4}");
-f(/(?=\P{sc=Arab})\p{scx=Arab}/u, "\u{5e088}");
-f(/(?=\P{sc=Arab})\p{scx=Arab}/u, "\u{65bf1}");
-f(/(?=\P{sc=Arab})\p{scx=Arab}/u, "\u{32ca1}");
-f(/(?=\P{sc=Arab})\p{scx=Arab}/u, "\u{19c04}");
+f(/(?=\P{sc=Arab})\p{scx=Arab}/u, "\u{43609}");
+f(/(?=\P{sc=Arab})\p{scx=Arab}/u, "\u{bea28}");
+f(/(?=\P{sc=Arab})\p{scx=Arab}/u, "\u{f9ef}");
+f(/(?=\P{sc=Arab})\p{scx=Arab}/u, "\u{7b3fc}");
+f(/(?=\P{sc=Arab})\p{scx=Arab}/u, "\u{3a64a}");
 // Script_Extension=Copt
-f(/(?=\P{sc=Copt})\p{scx=Copt}/u, "\u{62c6}");
-f(/(?=\P{sc=Copt})\p{scx=Copt}/u, "\u{10f13d}");
-f(/(?=\P{sc=Copt})\p{scx=Copt}/u, "\u{9ebe5}");
-f(/(?=\P{sc=Copt})\p{scx=Copt}/u, "\u{60645}");
-f(/(?=\P{sc=Copt})\p{scx=Copt}/u, "\u{f2fff}");
+f(/(?=\P{sc=Copt})\p{scx=Copt}/u, "\u{a7927}");
+f(/(?=\P{sc=Copt})\p{scx=Copt}/u, "\u{e11a5}");
+f(/(?=\P{sc=Copt})\p{scx=Copt}/u, "\u{a7afe}");
+f(/(?=\P{sc=Copt})\p{scx=Copt}/u, "\u{68bd4}");
+f(/(?=\P{sc=Copt})\p{scx=Copt}/u, "\u{4c963}");
+// Script_Extension=Rohg
+f(/(?=\P{sc=Rohg})\p{scx=Rohg}/u, "\u{cd74e}");
+f(/(?=\P{sc=Rohg})\p{scx=Rohg}/u, "\u{c4e3c}");
+f(/(?=\P{sc=Rohg})\p{scx=Rohg}/u, "\u{1f2de}");
+f(/(?=\P{sc=Rohg})\p{scx=Rohg}/u, "\u{999ca}");
+f(/(?=\P{sc=Rohg})\p{scx=Rohg}/u, "\u{f25d9}");
 // Script_Extension=Syrc
-f(/(?=\P{sc=Syrc})\p{scx=Syrc}/u, "\u{6ff8f}");
-f(/(?=\P{sc=Syrc})\p{scx=Syrc}/u, "\u{f6e6}");
-f(/(?=\P{sc=Syrc})\p{scx=Syrc}/u, "\u{1037ae}");
-f(/(?=\P{sc=Syrc})\p{scx=Syrc}/u, "\u{fdd94}");
-f(/(?=\P{sc=Syrc})\p{scx=Syrc}/u, "\u{218af}");
+f(/(?=\P{sc=Syrc})\p{scx=Syrc}/u, "\u{dd913}");
+f(/(?=\P{sc=Syrc})\p{scx=Syrc}/u, "\u{81cdc}");
+f(/(?=\P{sc=Syrc})\p{scx=Syrc}/u, "\u{32fb2}");
+f(/(?=\P{sc=Syrc})\p{scx=Syrc}/u, "\u{cc6ec}");
+f(/(?=\P{sc=Syrc})\p{scx=Syrc}/u, "\u{adba2}");
 // Script_Extension=Thaa
-f(/(?=\P{sc=Thaa})\p{scx=Thaa}/u, "\u{82166}");
-f(/(?=\P{sc=Thaa})\p{scx=Thaa}/u, "\u{dc7e1}");
-f(/(?=\P{sc=Thaa})\p{scx=Thaa}/u, "\u{638e}");
-f(/(?=\P{sc=Thaa})\p{scx=Thaa}/u, "\u{edd2e}");
-f(/(?=\P{sc=Thaa})\p{scx=Thaa}/u, "\u{20737}");
+f(/(?=\P{sc=Thaa})\p{scx=Thaa}/u, "\u{782b1}");
+f(/(?=\P{sc=Thaa})\p{scx=Thaa}/u, "\u{ca567}");
+f(/(?=\P{sc=Thaa})\p{scx=Thaa}/u, "\u{c1506}");
+f(/(?=\P{sc=Thaa})\p{scx=Thaa}/u, "\u{e783}");
+f(/(?=\P{sc=Thaa})\p{scx=Thaa}/u, "\u{fc8e1}");
 // Script_Extension=Armn
-f(/(?=\P{sc=Armn})\p{scx=Armn}/u, "\u{bbd25}");
-f(/(?=\P{sc=Armn})\p{scx=Armn}/u, "\u{3b15}");
-f(/(?=\P{sc=Armn})\p{scx=Armn}/u, "\u{f0000}");
-f(/(?=\P{sc=Armn})\p{scx=Armn}/u, "\u{13f76}");
-f(/(?=\P{sc=Armn})\p{scx=Armn}/u, "\u{8f861}");
+f(/(?=\P{sc=Armn})\p{scx=Armn}/u, "\u{36a6d}");
+f(/(?=\P{sc=Armn})\p{scx=Armn}/u, "\u{6c98}");
+f(/(?=\P{sc=Armn})\p{scx=Armn}/u, "\u{c4326}");
+f(/(?=\P{sc=Armn})\p{scx=Armn}/u, "\u{25eb6}");
+f(/(?=\P{sc=Armn})\p{scx=Armn}/u, "\u{db9d9}");
 // Script_Extension=Geor
-f(/(?=\P{sc=Geor})\p{scx=Geor}/u, "\u{a2c35}");
-f(/(?=\P{sc=Geor})\p{scx=Geor}/u, "\u{71c36}");
-f(/(?=\P{sc=Geor})\p{scx=Geor}/u, "\u{103dfc}");
-f(/(?=\P{sc=Geor})\p{scx=Geor}/u, "\u{8df23}");
-f(/(?=\P{sc=Geor})\p{scx=Geor}/u, "\u{9e978}");
+f(/(?=\P{sc=Geor})\p{scx=Geor}/u, "\u{e48f5}");
+f(/(?=\P{sc=Geor})\p{scx=Geor}/u, "\u{9914e}");
+f(/(?=\P{sc=Geor})\p{scx=Geor}/u, "\u{49dad}");
+f(/(?=\P{sc=Geor})\p{scx=Geor}/u, "\u{9d193}");
+f(/(?=\P{sc=Geor})\p{scx=Geor}/u, "\u{10ce35}");
 // Script_Extension=Bopo
-f(/(?=\P{sc=Bopo})\p{scx=Bopo}/u, "\u{10e25d}");
-f(/(?=\P{sc=Bopo})\p{scx=Bopo}/u, "\u{f336d}");
-f(/(?=\P{sc=Bopo})\p{scx=Bopo}/u, "\u{2dd6d}");
-f(/(?=\P{sc=Bopo})\p{scx=Bopo}/u, "\u{544a3}");
-f(/(?=\P{sc=Bopo})\p{scx=Bopo}/u, "\u{3b09c}");
+f(/(?=\P{sc=Bopo})\p{scx=Bopo}/u, "\u{36ac1}");
+f(/(?=\P{sc=Bopo})\p{scx=Bopo}/u, "\u{73ae5}");
+f(/(?=\P{sc=Bopo})\p{scx=Bopo}/u, "\u{cd0a}");
+f(/(?=\P{sc=Bopo})\p{scx=Bopo}/u, "\u{bd8bd}");
+f(/(?=\P{sc=Bopo})\p{scx=Bopo}/u, "\u{eb174}");
 // Script_Extension=Bugi
-f(/(?=\P{sc=Bugi})\p{scx=Bugi}/u, "\u{95d74}");
-f(/(?=\P{sc=Bugi})\p{scx=Bugi}/u, "\u{7ac62}");
-f(/(?=\P{sc=Bugi})\p{scx=Bugi}/u, "\u{6b7a3}");
-f(/(?=\P{sc=Bugi})\p{scx=Bugi}/u, "\u{d5b12}");
-f(/(?=\P{sc=Bugi})\p{scx=Bugi}/u, "\u{57ab9}");
+f(/(?=\P{sc=Bugi})\p{scx=Bugi}/u, "\u{7dcfc}");
+f(/(?=\P{sc=Bugi})\p{scx=Bugi}/u, "\u{b17d1}");
+f(/(?=\P{sc=Bugi})\p{scx=Bugi}/u, "\u{15cb5}");
+f(/(?=\P{sc=Bugi})\p{scx=Bugi}/u, "\u{10d4f6}");
+f(/(?=\P{sc=Bugi})\p{scx=Bugi}/u, "\u{12bbe}");
 // Script_Extension=Java
-f(/(?=\P{sc=Java})\p{scx=Java}/u, "\u{ea049}");
-f(/(?=\P{sc=Java})\p{scx=Java}/u, "\u{b2073}");
-f(/(?=\P{sc=Java})\p{scx=Java}/u, "\u{ed4f8}");
-f(/(?=\P{sc=Java})\p{scx=Java}/u, "\u{6d30f}");
-f(/(?=\P{sc=Java})\p{scx=Java}/u, "\u{b1dd9}");
+f(/(?=\P{sc=Java})\p{scx=Java}/u, "\u{10f6f3}");
+f(/(?=\P{sc=Java})\p{scx=Java}/u, "\u{75579}");
+f(/(?=\P{sc=Java})\p{scx=Java}/u, "\u{b39e4}");
+f(/(?=\P{sc=Java})\p{scx=Java}/u, "\u{104b64}");
+f(/(?=\P{sc=Java})\p{scx=Java}/u, "\u{102995}");
 // Script_Extension=Cprt
-f(/(?=\P{sc=Cprt})\p{scx=Cprt}/u, "\u{dd4bd}");
-f(/(?=\P{sc=Cprt})\p{scx=Cprt}/u, "\u{20588}");
-f(/(?=\P{sc=Cprt})\p{scx=Cprt}/u, "\u{1f362}");
-f(/(?=\P{sc=Cprt})\p{scx=Cprt}/u, "\u{6b96e}");
-f(/(?=\P{sc=Cprt})\p{scx=Cprt}/u, "\u{3557}");
+f(/(?=\P{sc=Cprt})\p{scx=Cprt}/u, "\u{46b94}");
+f(/(?=\P{sc=Cprt})\p{scx=Cprt}/u, "\u{3eaa1}");
+f(/(?=\P{sc=Cprt})\p{scx=Cprt}/u, "\u{3dd9a}");
+f(/(?=\P{sc=Cprt})\p{scx=Cprt}/u, "\u{c3e90}");
+f(/(?=\P{sc=Cprt})\p{scx=Cprt}/u, "\u{75301}");
 // Script_Extension=Linb
-f(/(?=\P{sc=Linb})\p{scx=Linb}/u, "\u{568d4}");
-f(/(?=\P{sc=Linb})\p{scx=Linb}/u, "\u{b2730}");
-f(/(?=\P{sc=Linb})\p{scx=Linb}/u, "\u{783cd}");
-f(/(?=\P{sc=Linb})\p{scx=Linb}/u, "\u{65555}");
-f(/(?=\P{sc=Linb})\p{scx=Linb}/u, "\u{e8671}");
+f(/(?=\P{sc=Linb})\p{scx=Linb}/u, "\u{b0cc}");
+f(/(?=\P{sc=Linb})\p{scx=Linb}/u, "\u{2759a}");
+f(/(?=\P{sc=Linb})\p{scx=Linb}/u, "\u{a6482}");
+f(/(?=\P{sc=Linb})\p{scx=Linb}/u, "\u{11c84}");
+f(/(?=\P{sc=Linb})\p{scx=Linb}/u, "\u{a3931}");
 // Script_Extension=Cyrl
-f(/(?=\P{sc=Cyrl})\p{scx=Cyrl}/u, "\u{85d00}");
-f(/(?=\P{sc=Cyrl})\p{scx=Cyrl}/u, "\u{3bf7f}");
-f(/(?=\P{sc=Cyrl})\p{scx=Cyrl}/u, "\u{e18a0}");
-f(/(?=\P{sc=Cyrl})\p{scx=Cyrl}/u, "\u{b87b}");
-f(/(?=\P{sc=Cyrl})\p{scx=Cyrl}/u, "\u{79fa1}");
+f(/(?=\P{sc=Cyrl})\p{scx=Cyrl}/u, "\u{2d4a3}");
+f(/(?=\P{sc=Cyrl})\p{scx=Cyrl}/u, "\u{394c9}");
+f(/(?=\P{sc=Cyrl})\p{scx=Cyrl}/u, "\u{aa2e7}");
+f(/(?=\P{sc=Cyrl})\p{scx=Cyrl}/u, "\u{823e3}");
+f(/(?=\P{sc=Cyrl})\p{scx=Cyrl}/u, "\u{f753e}");
 // Script_Extension=Glag
-f(/(?=\P{sc=Glag})\p{scx=Glag}/u, "\u{b13fe}");
-f(/(?=\P{sc=Glag})\p{scx=Glag}/u, "\u{a3bfd}");
-f(/(?=\P{sc=Glag})\p{scx=Glag}/u, "\u{a8c1d}");
-f(/(?=\P{sc=Glag})\p{scx=Glag}/u, "\u{d5d35}");
-f(/(?=\P{sc=Glag})\p{scx=Glag}/u, "\u{549bc}");
+f(/(?=\P{sc=Glag})\p{scx=Glag}/u, "\u{f060c}");
+f(/(?=\P{sc=Glag})\p{scx=Glag}/u, "\u{f4430}");
+f(/(?=\P{sc=Glag})\p{scx=Glag}/u, "\u{89208}");
+f(/(?=\P{sc=Glag})\p{scx=Glag}/u, "\u{3b2fa}");
+f(/(?=\P{sc=Glag})\p{scx=Glag}/u, "\u{5a463}");
 // Script_Extension=Perm
-f(/(?=\P{sc=Perm})\p{scx=Perm}/u, "\u{9702f}");
-f(/(?=\P{sc=Perm})\p{scx=Perm}/u, "\u{482b5}");
-f(/(?=\P{sc=Perm})\p{scx=Perm}/u, "\u{4e9ff}");
-f(/(?=\P{sc=Perm})\p{scx=Perm}/u, "\u{43858}");
-f(/(?=\P{sc=Perm})\p{scx=Perm}/u, "\u{f21da}");
+f(/(?=\P{sc=Perm})\p{scx=Perm}/u, "\u{f4f29}");
+f(/(?=\P{sc=Perm})\p{scx=Perm}/u, "\u{154a1}");
+f(/(?=\P{sc=Perm})\p{scx=Perm}/u, "\u{8d2e1}");
+f(/(?=\P{sc=Perm})\p{scx=Perm}/u, "\u{6ddec}");
+f(/(?=\P{sc=Perm})\p{scx=Perm}/u, "\u{2859e}");
 // Script_Extension=Gran
-f(/(?=\P{sc=Gran})\p{scx=Gran}/u, "\u{3a8d}");
-f(/(?=\P{sc=Gran})\p{scx=Gran}/u, "\u{5f951}");
-f(/(?=\P{sc=Gran})\p{scx=Gran}/u, "\u{1007a2}");
-f(/(?=\P{sc=Gran})\p{scx=Gran}/u, "\u{c25ae}");
-f(/(?=\P{sc=Gran})\p{scx=Gran}/u, "\u{25a9e}");
-// Script_Extension=Knda
-f(/(?=\P{sc=Knda})\p{scx=Knda}/u, "\u{4a07}");
-f(/(?=\P{sc=Knda})\p{scx=Knda}/u, "\u{e128d}");
-f(/(?=\P{sc=Knda})\p{scx=Knda}/u, "\u{f2880}");
-f(/(?=\P{sc=Knda})\p{scx=Knda}/u, "\u{7643b}");
-f(/(?=\P{sc=Knda})\p{scx=Knda}/u, "\u{105a3b}");
+f(/(?=\P{sc=Gran})\p{scx=Gran}/u, "\u{dcc3b}");
+f(/(?=\P{sc=Gran})\p{scx=Gran}/u, "\u{240a1}");
+f(/(?=\P{sc=Gran})\p{scx=Gran}/u, "\u{d94fd}");
+f(/(?=\P{sc=Gran})\p{scx=Gran}/u, "\u{3e537}");
+f(/(?=\P{sc=Gran})\p{scx=Gran}/u, "\u{ddf65}");
 // Script_Extension=Shrd
-f(/(?=\P{sc=Shrd})\p{scx=Shrd}/u, "\u{22e84}");
-f(/(?=\P{sc=Shrd})\p{scx=Shrd}/u, "\u{aee2}");
-f(/(?=\P{sc=Shrd})\p{scx=Shrd}/u, "\u{cf578}");
-f(/(?=\P{sc=Shrd})\p{scx=Shrd}/u, "\u{a7369}");
-f(/(?=\P{sc=Shrd})\p{scx=Shrd}/u, "\u{cd94d}");
+f(/(?=\P{sc=Shrd})\p{scx=Shrd}/u, "\u{c17cc}");
+f(/(?=\P{sc=Shrd})\p{scx=Shrd}/u, "\u{2d717}");
+f(/(?=\P{sc=Shrd})\p{scx=Shrd}/u, "\u{93c84}");
+f(/(?=\P{sc=Shrd})\p{scx=Shrd}/u, "\u{e4d57}");
+f(/(?=\P{sc=Shrd})\p{scx=Shrd}/u, "\u{4449a}");
 // Script_Extension=Taml
-f(/(?=\P{sc=Taml})\p{scx=Taml}/u, "\u{47bf9}");
-f(/(?=\P{sc=Taml})\p{scx=Taml}/u, "\u{1064eb}");
-f(/(?=\P{sc=Taml})\p{scx=Taml}/u, "\u{33b58}");
-f(/(?=\P{sc=Taml})\p{scx=Taml}/u, "\u{28884}");
-f(/(?=\P{sc=Taml})\p{scx=Taml}/u, "\u{4bee2}");
+f(/(?=\P{sc=Taml})\p{scx=Taml}/u, "\u{fb7ab}");
+f(/(?=\P{sc=Taml})\p{scx=Taml}/u, "\u{d687c}");
+f(/(?=\P{sc=Taml})\p{scx=Taml}/u, "\u{b6aea}");
+f(/(?=\P{sc=Taml})\p{scx=Taml}/u, "\u{e42bc}");
+f(/(?=\P{sc=Taml})\p{scx=Taml}/u, "\u{77534}");
 // Script_Extension=Gujr
-f(/(?=\P{sc=Gujr})\p{scx=Gujr}/u, "\u{82ad7}");
-f(/(?=\P{sc=Gujr})\p{scx=Gujr}/u, "\u{ab492}");
-f(/(?=\P{sc=Gujr})\p{scx=Gujr}/u, "\u{a27c8}");
-f(/(?=\P{sc=Gujr})\p{scx=Gujr}/u, "\u{66750}");
-f(/(?=\P{sc=Gujr})\p{scx=Gujr}/u, "\u{3bc29}");
+f(/(?=\P{sc=Gujr})\p{scx=Gujr}/u, "\u{4b35c}");
+f(/(?=\P{sc=Gujr})\p{scx=Gujr}/u, "\u{889e5}");
+f(/(?=\P{sc=Gujr})\p{scx=Gujr}/u, "\u{107d78}");
+f(/(?=\P{sc=Gujr})\p{scx=Gujr}/u, "\u{c68d8}");
+f(/(?=\P{sc=Gujr})\p{scx=Gujr}/u, "\u{a5b0a}");
 // Script_Extension=Khoj
-f(/(?=\P{sc=Khoj})\p{scx=Khoj}/u, "\u{e72d5}");
-f(/(?=\P{sc=Khoj})\p{scx=Khoj}/u, "\u{ce3f5}");
-f(/(?=\P{sc=Khoj})\p{scx=Khoj}/u, "\u{ec31b}");
-f(/(?=\P{sc=Khoj})\p{scx=Khoj}/u, "\u{57e80}");
-f(/(?=\P{sc=Khoj})\p{scx=Khoj}/u, "\u{60009}");
+f(/(?=\P{sc=Khoj})\p{scx=Khoj}/u, "\u{2da77}");
+f(/(?=\P{sc=Khoj})\p{scx=Khoj}/u, "\u{9fb5}");
+f(/(?=\P{sc=Khoj})\p{scx=Khoj}/u, "\u{a0268}");
+f(/(?=\P{sc=Khoj})\p{scx=Khoj}/u, "\u{10d835}");
+f(/(?=\P{sc=Khoj})\p{scx=Khoj}/u, "\u{49e92}");
 // Script_Extension=Guru
-f(/(?=\P{sc=Guru})\p{scx=Guru}/u, "\u{7ffed}");
-f(/(?=\P{sc=Guru})\p{scx=Guru}/u, "\u{82048}");
-f(/(?=\P{sc=Guru})\p{scx=Guru}/u, "\u{502a7}");
-f(/(?=\P{sc=Guru})\p{scx=Guru}/u, "\u{7b0e6}");
-f(/(?=\P{sc=Guru})\p{scx=Guru}/u, "\u{9416e}");
+f(/(?=\P{sc=Guru})\p{scx=Guru}/u, "\u{54186}");
+f(/(?=\P{sc=Guru})\p{scx=Guru}/u, "\u{a2fff}");
+f(/(?=\P{sc=Guru})\p{scx=Guru}/u, "\u{e25c3}");
+f(/(?=\P{sc=Guru})\p{scx=Guru}/u, "\u{10496}");
+f(/(?=\P{sc=Guru})\p{scx=Guru}/u, "\u{10ad15}");
 // Script_Extension=Mult
-f(/(?=\P{sc=Mult})\p{scx=Mult}/u, "\u{4f15d}");
-f(/(?=\P{sc=Mult})\p{scx=Mult}/u, "\u{cd3cd}");
-f(/(?=\P{sc=Mult})\p{scx=Mult}/u, "\u{7f24d}");
-f(/(?=\P{sc=Mult})\p{scx=Mult}/u, "\u{4e181}");
-f(/(?=\P{sc=Mult})\p{scx=Mult}/u, "\u{2a651}");
+f(/(?=\P{sc=Mult})\p{scx=Mult}/u, "\u{2794e}");
+f(/(?=\P{sc=Mult})\p{scx=Mult}/u, "\u{2f6b4}");
+f(/(?=\P{sc=Mult})\p{scx=Mult}/u, "\u{d50f2}");
+f(/(?=\P{sc=Mult})\p{scx=Mult}/u, "\u{62dac}");
+f(/(?=\P{sc=Mult})\p{scx=Mult}/u, "\u{ad0b2}");
 // Script_Extension=Hira
-f(/(?=\P{sc=Hira})\p{scx=Hira}/u, "\u{22465}");
-f(/(?=\P{sc=Hira})\p{scx=Hira}/u, "\u{c5418}");
-f(/(?=\P{sc=Hira})\p{scx=Hira}/u, "\u{977b5}");
-f(/(?=\P{sc=Hira})\p{scx=Hira}/u, "\u{f2219}");
-f(/(?=\P{sc=Hira})\p{scx=Hira}/u, "\u{2be9a}");
+f(/(?=\P{sc=Hira})\p{scx=Hira}/u, "\u{be070}");
+f(/(?=\P{sc=Hira})\p{scx=Hira}/u, "\u{d2d48}");
+f(/(?=\P{sc=Hira})\p{scx=Hira}/u, "\u{ec3a2}");
+f(/(?=\P{sc=Hira})\p{scx=Hira}/u, "\u{b2f9d}");
+f(/(?=\P{sc=Hira})\p{scx=Hira}/u, "\u{4b539}");
 // Script_Extension=Kana
-f(/(?=\P{sc=Kana})\p{scx=Kana}/u, "\u{a2db4}");
-f(/(?=\P{sc=Kana})\p{scx=Kana}/u, "\u{bc311}");
-f(/(?=\P{sc=Kana})\p{scx=Kana}/u, "\u{447b8}");
-f(/(?=\P{sc=Kana})\p{scx=Kana}/u, "\u{e4667}");
-f(/(?=\P{sc=Kana})\p{scx=Kana}/u, "\u{b5aac}");
+f(/(?=\P{sc=Kana})\p{scx=Kana}/u, "\u{545d5}");
+f(/(?=\P{sc=Kana})\p{scx=Kana}/u, "\u{23e9d}");
+f(/(?=\P{sc=Kana})\p{scx=Kana}/u, "\u{104ba8}");
+f(/(?=\P{sc=Kana})\p{scx=Kana}/u, "\u{dc9d5}");
+f(/(?=\P{sc=Kana})\p{scx=Kana}/u, "\u{8229c}");
 // Script_Extension=Mong
-f(/(?=\P{sc=Mong})\p{scx=Mong}/u, "\u{7a208}");
-f(/(?=\P{sc=Mong})\p{scx=Mong}/u, "\u{da800}");
-f(/(?=\P{sc=Mong})\p{scx=Mong}/u, "\u{fbafa}");
-f(/(?=\P{sc=Mong})\p{scx=Mong}/u, "\u{b8421}");
-f(/(?=\P{sc=Mong})\p{scx=Mong}/u, "\u{10a54e}");
+f(/(?=\P{sc=Mong})\p{scx=Mong}/u, "\u{3b0ad}");
+f(/(?=\P{sc=Mong})\p{scx=Mong}/u, "\u{d9402}");
+f(/(?=\P{sc=Mong})\p{scx=Mong}/u, "\u{8f4ae}");
+f(/(?=\P{sc=Mong})\p{scx=Mong}/u, "\u{18b7d}");
+f(/(?=\P{sc=Mong})\p{scx=Mong}/u, "\u{e0393}");
 // Script_Extension=Phag
-f(/(?=\P{sc=Phag})\p{scx=Phag}/u, "\u{1580d}");
-f(/(?=\P{sc=Phag})\p{scx=Phag}/u, "\u{828b0}");
-f(/(?=\P{sc=Phag})\p{scx=Phag}/u, "\u{b60db}");
-f(/(?=\P{sc=Phag})\p{scx=Phag}/u, "\u{53ce1}");
-f(/(?=\P{sc=Phag})\p{scx=Phag}/u, "\u{a6e2b}");
+f(/(?=\P{sc=Phag})\p{scx=Phag}/u, "\u{3eb13}");
+f(/(?=\P{sc=Phag})\p{scx=Phag}/u, "\u{273e7}");
+f(/(?=\P{sc=Phag})\p{scx=Phag}/u, "\u{d7ad4}");
+f(/(?=\P{sc=Phag})\p{scx=Phag}/u, "\u{80daf}");
+f(/(?=\P{sc=Phag})\p{scx=Phag}/u, "\u{bd1ad}");
 // Script_Extension=Cakm
-f(/(?=\P{sc=Cakm})\p{scx=Cakm}/u, "\u{a8dc9}");
-f(/(?=\P{sc=Cakm})\p{scx=Cakm}/u, "\u{6c8fb}");
-f(/(?=\P{sc=Cakm})\p{scx=Cakm}/u, "\u{d9a31}");
-f(/(?=\P{sc=Cakm})\p{scx=Cakm}/u, "\u{f643f}");
-f(/(?=\P{sc=Cakm})\p{scx=Cakm}/u, "\u{aaf87}");
+f(/(?=\P{sc=Cakm})\p{scx=Cakm}/u, "\u{19eeb}");
+f(/(?=\P{sc=Cakm})\p{scx=Cakm}/u, "\u{19dab}");
+f(/(?=\P{sc=Cakm})\p{scx=Cakm}/u, "\u{f3a42}");
+f(/(?=\P{sc=Cakm})\p{scx=Cakm}/u, "\u{455c7}");
+f(/(?=\P{sc=Cakm})\p{scx=Cakm}/u, "\u{baa96}");
 // Script_Extension=Sylo
-f(/(?=\P{sc=Sylo})\p{scx=Sylo}/u, "\u{7be3f}");
-f(/(?=\P{sc=Sylo})\p{scx=Sylo}/u, "\u{1a96}");
-f(/(?=\P{sc=Sylo})\p{scx=Sylo}/u, "\u{df39d}");
-f(/(?=\P{sc=Sylo})\p{scx=Sylo}/u, "\u{b2f9b}");
-f(/(?=\P{sc=Sylo})\p{scx=Sylo}/u, "\u{d41b6}");
+f(/(?=\P{sc=Sylo})\p{scx=Sylo}/u, "\u{54d3}");
+f(/(?=\P{sc=Sylo})\p{scx=Sylo}/u, "\u{283e9}");
+f(/(?=\P{sc=Sylo})\p{scx=Sylo}/u, "\u{edab9}");
+f(/(?=\P{sc=Sylo})\p{scx=Sylo}/u, "\u{e135d}");
+f(/(?=\P{sc=Sylo})\p{scx=Sylo}/u, "\u{31bc2}");
 // Script_Extension=Mymr
-f(/(?=\P{sc=Mymr})\p{scx=Mymr}/u, "\u{83733}");
-f(/(?=\P{sc=Mymr})\p{scx=Mymr}/u, "\u{65653}");
-f(/(?=\P{sc=Mymr})\p{scx=Mymr}/u, "\u{f05d8}");
-f(/(?=\P{sc=Mymr})\p{scx=Mymr}/u, "\u{d48a5}");
-f(/(?=\P{sc=Mymr})\p{scx=Mymr}/u, "\u{d028d}");
+f(/(?=\P{sc=Mymr})\p{scx=Mymr}/u, "\u{9d605}");
+f(/(?=\P{sc=Mymr})\p{scx=Mymr}/u, "\u{109cae}");
+f(/(?=\P{sc=Mymr})\p{scx=Mymr}/u, "\u{cc2dd}");
+f(/(?=\P{sc=Mymr})\p{scx=Mymr}/u, "\u{d1757}");
+f(/(?=\P{sc=Mymr})\p{scx=Mymr}/u, "\u{baaff}");
 // Script_Extension=Tale
-f(/(?=\P{sc=Tale})\p{scx=Tale}/u, "\u{b15b8}");
-f(/(?=\P{sc=Tale})\p{scx=Tale}/u, "\u{d13dd}");
-f(/(?=\P{sc=Tale})\p{scx=Tale}/u, "\u{107e0d}");
-f(/(?=\P{sc=Tale})\p{scx=Tale}/u, "\u{72fa9}");
-f(/(?=\P{sc=Tale})\p{scx=Tale}/u, "\u{4ffc3}");
+f(/(?=\P{sc=Tale})\p{scx=Tale}/u, "\u{81845}");
+f(/(?=\P{sc=Tale})\p{scx=Tale}/u, "\u{fe9d6}");
+f(/(?=\P{sc=Tale})\p{scx=Tale}/u, "\u{8c1a0}");
+f(/(?=\P{sc=Tale})\p{scx=Tale}/u, "\u{f1a55}");
+f(/(?=\P{sc=Tale})\p{scx=Tale}/u, "\u{a8f6}");
 // Script_Extension=Lina
-f(/(?=\P{sc=Lina})\p{scx=Lina}/u, "\u{34b7}");
-f(/(?=\P{sc=Lina})\p{scx=Lina}/u, "\u{89cc7}");
-f(/(?=\P{sc=Lina})\p{scx=Lina}/u, "\u{b27b9}");
-f(/(?=\P{sc=Lina})\p{scx=Lina}/u, "\u{19122}");
-f(/(?=\P{sc=Lina})\p{scx=Lina}/u, "\u{7f93b}");
-// Script_Extension=Kthi
-f(/(?=\P{sc=Kthi})\p{scx=Kthi}/u, "\u{8a452}");
-f(/(?=\P{sc=Kthi})\p{scx=Kthi}/u, "\u{39395}");
-f(/(?=\P{sc=Kthi})\p{scx=Kthi}/u, "\u{28802}");
-f(/(?=\P{sc=Kthi})\p{scx=Kthi}/u, "\u{de82b}");
-f(/(?=\P{sc=Kthi})\p{scx=Kthi}/u, "\u{1019cc}");
-// Script_Extension=Mahj
-f(/(?=\P{sc=Mahj})\p{scx=Mahj}/u, "\u{64a2d}");
-f(/(?=\P{sc=Mahj})\p{scx=Mahj}/u, "\u{7fe13}");
-f(/(?=\P{sc=Mahj})\p{scx=Mahj}/u, "\u{5da4a}");
-f(/(?=\P{sc=Mahj})\p{scx=Mahj}/u, "\u{fc2cf}");
-f(/(?=\P{sc=Mahj})\p{scx=Mahj}/u, "\u{53629}");
+f(/(?=\P{sc=Lina})\p{scx=Lina}/u, "\u{e3554}");
+f(/(?=\P{sc=Lina})\p{scx=Lina}/u, "\u{e7555}");
+f(/(?=\P{sc=Lina})\p{scx=Lina}/u, "\u{29fc1}");
+f(/(?=\P{sc=Lina})\p{scx=Lina}/u, "\u{3fe04}");
+f(/(?=\P{sc=Lina})\p{scx=Lina}/u, "\u{df6e2}");
+// Script_Extension=Knda
+f(/(?=\P{sc=Knda})\p{scx=Knda}/u, "\u{36afd}");
+f(/(?=\P{sc=Knda})\p{scx=Knda}/u, "\u{72966}");
+f(/(?=\P{sc=Knda})\p{scx=Knda}/u, "\u{531de}");
+f(/(?=\P{sc=Knda})\p{scx=Knda}/u, "\u{cd350}");
+f(/(?=\P{sc=Knda})\p{scx=Knda}/u, "\u{4081f}");
 // Script_Extension=Kali
-f(/(?=\P{sc=Kali})\p{scx=Kali}/u, "\u{5cf1d}");
-f(/(?=\P{sc=Kali})\p{scx=Kali}/u, "\u{104c01}");
-f(/(?=\P{sc=Kali})\p{scx=Kali}/u, "\u{ef11a}");
-f(/(?=\P{sc=Kali})\p{scx=Kali}/u, "\u{92a12}");
-f(/(?=\P{sc=Kali})\p{scx=Kali}/u, "\u{e4e79}");
+f(/(?=\P{sc=Kali})\p{scx=Kali}/u, "\u{2cc77}");
+f(/(?=\P{sc=Kali})\p{scx=Kali}/u, "\u{7973a}");
+f(/(?=\P{sc=Kali})\p{scx=Kali}/u, "\u{d67e0}");
+f(/(?=\P{sc=Kali})\p{scx=Kali}/u, "\u{6f0a6}");
+f(/(?=\P{sc=Kali})\p{scx=Kali}/u, "\u{130b7}");
 // Script_Extension=Buhd
-f(/(?=\P{sc=Buhd})\p{scx=Buhd}/u, "\u{ab261}");
-f(/(?=\P{sc=Buhd})\p{scx=Buhd}/u, "\u{ca43a}");
-f(/(?=\P{sc=Buhd})\p{scx=Buhd}/u, "\u{7dc01}");
-f(/(?=\P{sc=Buhd})\p{scx=Buhd}/u, "\u{1e9f}");
-f(/(?=\P{sc=Buhd})\p{scx=Buhd}/u, "\u{12dd2}");
+f(/(?=\P{sc=Buhd})\p{scx=Buhd}/u, "\u{91a77}");
+f(/(?=\P{sc=Buhd})\p{scx=Buhd}/u, "\u{dad60}");
+f(/(?=\P{sc=Buhd})\p{scx=Buhd}/u, "\u{10577d}");
+f(/(?=\P{sc=Buhd})\p{scx=Buhd}/u, "\u{107c7d}");
+f(/(?=\P{sc=Buhd})\p{scx=Buhd}/u, "\u{6d43d}");
 // Script_Extension=Hano
-f(/(?=\P{sc=Hano})\p{scx=Hano}/u, "\u{3ec65}");
-f(/(?=\P{sc=Hano})\p{scx=Hano}/u, "\u{eff3d}");
-f(/(?=\P{sc=Hano})\p{scx=Hano}/u, "\u{a7239}");
-f(/(?=\P{sc=Hano})\p{scx=Hano}/u, "\u{4e718}");
-f(/(?=\P{sc=Hano})\p{scx=Hano}/u, "\u{ed8e6}");
+f(/(?=\P{sc=Hano})\p{scx=Hano}/u, "\u{7e942}");
+f(/(?=\P{sc=Hano})\p{scx=Hano}/u, "\u{b0a24}");
+f(/(?=\P{sc=Hano})\p{scx=Hano}/u, "\u{106205}");
+f(/(?=\P{sc=Hano})\p{scx=Hano}/u, "\u{4ac72}");
+f(/(?=\P{sc=Hano})\p{scx=Hano}/u, "\u{e6681}");
 // Script_Extension=Tagb
-f(/(?=\P{sc=Tagb})\p{scx=Tagb}/u, "\u{23a92}");
-f(/(?=\P{sc=Tagb})\p{scx=Tagb}/u, "\u{103d41}");
-f(/(?=\P{sc=Tagb})\p{scx=Tagb}/u, "\u{60057}");
-f(/(?=\P{sc=Tagb})\p{scx=Tagb}/u, "\u{192de}");
-f(/(?=\P{sc=Tagb})\p{scx=Tagb}/u, "\u{b1caf}");
+f(/(?=\P{sc=Tagb})\p{scx=Tagb}/u, "\u{dd8fa}");
+f(/(?=\P{sc=Tagb})\p{scx=Tagb}/u, "\u{e622d}");
+f(/(?=\P{sc=Tagb})\p{scx=Tagb}/u, "\u{d43fb}");
+f(/(?=\P{sc=Tagb})\p{scx=Tagb}/u, "\u{10ba23}");
+f(/(?=\P{sc=Tagb})\p{scx=Tagb}/u, "\u{bfbce}");
 // Script_Extension=Tglg
-f(/(?=\P{sc=Tglg})\p{scx=Tglg}/u, "\u{42efc}");
-f(/(?=\P{sc=Tglg})\p{scx=Tglg}/u, "\u{90987}");
-f(/(?=\P{sc=Tglg})\p{scx=Tglg}/u, "\u{ba103}");
-f(/(?=\P{sc=Tglg})\p{scx=Tglg}/u, "\u{91eeb}");
-f(/(?=\P{sc=Tglg})\p{scx=Tglg}/u, "\u{dbf0e}");
+f(/(?=\P{sc=Tglg})\p{scx=Tglg}/u, "\u{bb9f4}");
+f(/(?=\P{sc=Tglg})\p{scx=Tglg}/u, "\u{cb69f}");
+f(/(?=\P{sc=Tglg})\p{scx=Tglg}/u, "\u{5bb3f}");
+f(/(?=\P{sc=Tglg})\p{scx=Tglg}/u, "\u{b6f43}");
+f(/(?=\P{sc=Tglg})\p{scx=Tglg}/u, "\u{d013b}");
+// Script_Extension=Dogr
+f(/(?=\P{sc=Dogr})\p{scx=Dogr}/u, "\u{2d845}");
+f(/(?=\P{sc=Dogr})\p{scx=Dogr}/u, "\u{1a910}");
+f(/(?=\P{sc=Dogr})\p{scx=Dogr}/u, "\u{3ba2a}");
+f(/(?=\P{sc=Dogr})\p{scx=Dogr}/u, "\u{bde46}");
+f(/(?=\P{sc=Dogr})\p{scx=Dogr}/u, "\u{108e84}");
+// Script_Extension=Kthi
+f(/(?=\P{sc=Kthi})\p{scx=Kthi}/u, "\u{10dd0}");
+f(/(?=\P{sc=Kthi})\p{scx=Kthi}/u, "\u{5484b}");
+f(/(?=\P{sc=Kthi})\p{scx=Kthi}/u, "\u{3aed6}");
+f(/(?=\P{sc=Kthi})\p{scx=Kthi}/u, "\u{1e733}");
+f(/(?=\P{sc=Kthi})\p{scx=Kthi}/u, "\u{9448f}");
+// Script_Extension=Mahj
+f(/(?=\P{sc=Mahj})\p{scx=Mahj}/u, "\u{a2006}");
+f(/(?=\P{sc=Mahj})\p{scx=Mahj}/u, "\u{184cd}");
+f(/(?=\P{sc=Mahj})\p{scx=Mahj}/u, "\u{575ba}");
+f(/(?=\P{sc=Mahj})\p{scx=Mahj}/u, "\u{1005cb}");
+f(/(?=\P{sc=Mahj})\p{scx=Mahj}/u, "\u{c2d02}");
 // Script_Extension=Hang
-f(/(?=\P{sc=Hang})\p{scx=Hang}/u, "\u{7aa}");
-f(/(?=\P{sc=Hang})\p{scx=Hang}/u, "\u{12138}");
-f(/(?=\P{sc=Hang})\p{scx=Hang}/u, "\u{478c1}");
-f(/(?=\P{sc=Hang})\p{scx=Hang}/u, "\u{ec529}");
-f(/(?=\P{sc=Hang})\p{scx=Hang}/u, "\u{bb438}");
+f(/(?=\P{sc=Hang})\p{scx=Hang}/u, "\u{b42fb}");
+f(/(?=\P{sc=Hang})\p{scx=Hang}/u, "\u{15eff}");
+f(/(?=\P{sc=Hang})\p{scx=Hang}/u, "\u{cc05b}");
+f(/(?=\P{sc=Hang})\p{scx=Hang}/u, "\u{85919}");
+f(/(?=\P{sc=Hang})\p{scx=Hang}/u, "\u{c27ea}");
+// Script_Extension=Yiii
+f(/(?=\P{sc=Yiii})\p{scx=Yiii}/u, "\u{b9c10}");
+f(/(?=\P{sc=Yiii})\p{scx=Yiii}/u, "\u{55fef}");
+f(/(?=\P{sc=Yiii})\p{scx=Yiii}/u, "\u{fe59b}");
+f(/(?=\P{sc=Yiii})\p{scx=Yiii}/u, "\u{ffd82}");
+f(/(?=\P{sc=Yiii})\p{scx=Yiii}/u, "\u{7df88}");
 // Script_Extension=Mlym
-f(/(?=\P{sc=Mlym})\p{scx=Mlym}/u, "\u{e6470}");
-f(/(?=\P{sc=Mlym})\p{scx=Mlym}/u, "\u{a9ffc}");
-f(/(?=\P{sc=Mlym})\p{scx=Mlym}/u, "\u{b220c}");
-f(/(?=\P{sc=Mlym})\p{scx=Mlym}/u, "\u{3676b}");
-f(/(?=\P{sc=Mlym})\p{scx=Mlym}/u, "\u{78657}");
+f(/(?=\P{sc=Mlym})\p{scx=Mlym}/u, "\u{38ca6}");
+f(/(?=\P{sc=Mlym})\p{scx=Mlym}/u, "\u{b536b}");
+f(/(?=\P{sc=Mlym})\p{scx=Mlym}/u, "\u{d73c3}");
+f(/(?=\P{sc=Mlym})\p{scx=Mlym}/u, "\u{ef7c}");
+f(/(?=\P{sc=Mlym})\p{scx=Mlym}/u, "\u{54f11}");
+// Script_Extension=Orya
+f(/(?=\P{sc=Orya})\p{scx=Orya}/u, "\u{103437}");
+f(/(?=\P{sc=Orya})\p{scx=Orya}/u, "\u{6db9f}");
+f(/(?=\P{sc=Orya})\p{scx=Orya}/u, "\u{c0cbf}");
+f(/(?=\P{sc=Orya})\p{scx=Orya}/u, "\u{693e6}");
+f(/(?=\P{sc=Orya})\p{scx=Orya}/u, "\u{107f31}");
 // Script_Extension=Telu
-f(/(?=\P{sc=Telu})\p{scx=Telu}/u, "\u{d1aa}");
-f(/(?=\P{sc=Telu})\p{scx=Telu}/u, "\u{81dfa}");
-f(/(?=\P{sc=Telu})\p{scx=Telu}/u, "\u{3ccad}");
-f(/(?=\P{sc=Telu})\p{scx=Telu}/u, "\u{c694a}");
-f(/(?=\P{sc=Telu})\p{scx=Telu}/u, "\u{d4da6}");
+f(/(?=\P{sc=Telu})\p{scx=Telu}/u, "\u{4565}");
+f(/(?=\P{sc=Telu})\p{scx=Telu}/u, "\u{92ad2}");
+f(/(?=\P{sc=Telu})\p{scx=Telu}/u, "\u{7de0b}");
+f(/(?=\P{sc=Telu})\p{scx=Telu}/u, "\u{bc7b2}");
+f(/(?=\P{sc=Telu})\p{scx=Telu}/u, "\u{9edd7}");
 // Script_Extension=Adlm
-f(/(?=\P{sc=Adlm})\p{scx=Adlm}/u, "\u{79f20}");
-f(/(?=\P{sc=Adlm})\p{scx=Adlm}/u, "\u{1013cc}");
-f(/(?=\P{sc=Adlm})\p{scx=Adlm}/u, "\u{37748}");
-f(/(?=\P{sc=Adlm})\p{scx=Adlm}/u, "\u{63b26}");
-f(/(?=\P{sc=Adlm})\p{scx=Adlm}/u, "\u{8a04f}");
+f(/(?=\P{sc=Adlm})\p{scx=Adlm}/u, "\u{8be77}");
+f(/(?=\P{sc=Adlm})\p{scx=Adlm}/u, "\u{31dbb}");
+f(/(?=\P{sc=Adlm})\p{scx=Adlm}/u, "\u{f2854}");
+f(/(?=\P{sc=Adlm})\p{scx=Adlm}/u, "\u{10a682}");
+f(/(?=\P{sc=Adlm})\p{scx=Adlm}/u, "\u{eba94}");
 // Script_Extension=Mand
-f(/(?=\P{sc=Mand})\p{scx=Mand}/u, "\u{4e6a8}");
-f(/(?=\P{sc=Mand})\p{scx=Mand}/u, "\u{4d1bc}");
-f(/(?=\P{sc=Mand})\p{scx=Mand}/u, "\u{e67d0}");
-f(/(?=\P{sc=Mand})\p{scx=Mand}/u, "\u{72336}");
-f(/(?=\P{sc=Mand})\p{scx=Mand}/u, "\u{bdf70}");
+f(/(?=\P{sc=Mand})\p{scx=Mand}/u, "\u{180bd}");
+f(/(?=\P{sc=Mand})\p{scx=Mand}/u, "\u{98fb9}");
+f(/(?=\P{sc=Mand})\p{scx=Mand}/u, "\u{aaa0c}");
+f(/(?=\P{sc=Mand})\p{scx=Mand}/u, "\u{de7c8}");
+f(/(?=\P{sc=Mand})\p{scx=Mand}/u, "\u{e27ed}");
 // Script_Extension=Mani
-f(/(?=\P{sc=Mani})\p{scx=Mani}/u, "\u{e67bb}");
-f(/(?=\P{sc=Mani})\p{scx=Mani}/u, "\u{9c604}");
-f(/(?=\P{sc=Mani})\p{scx=Mani}/u, "\u{43609}");
-f(/(?=\P{sc=Mani})\p{scx=Mani}/u, "\u{8d39}");
-f(/(?=\P{sc=Mani})\p{scx=Mani}/u, "\u{5a0d6}");
+f(/(?=\P{sc=Mani})\p{scx=Mani}/u, "\u{88d89}");
+f(/(?=\P{sc=Mani})\p{scx=Mani}/u, "\u{2102d}");
+f(/(?=\P{sc=Mani})\p{scx=Mani}/u, "\u{35a92}");
+f(/(?=\P{sc=Mani})\p{scx=Mani}/u, "\u{1e78e}");
+f(/(?=\P{sc=Mani})\p{scx=Mani}/u, "\u{6afba}");
 // Script_Extension=Phlp
-f(/(?=\P{sc=Phlp})\p{scx=Phlp}/u, "\u{aee68}");
-f(/(?=\P{sc=Phlp})\p{scx=Phlp}/u, "\u{d60ec}");
-f(/(?=\P{sc=Phlp})\p{scx=Phlp}/u, "\u{407c7}");
-f(/(?=\P{sc=Phlp})\p{scx=Phlp}/u, "\u{2c40e}");
-f(/(?=\P{sc=Phlp})\p{scx=Phlp}/u, "\u{5cf39}");
-// Script_Extension=Yiii
-f(/(?=\P{sc=Yiii})\p{scx=Yiii}/u, "\u{d2efb}");
-f(/(?=\P{sc=Yiii})\p{scx=Yiii}/u, "\u{83b57}");
-f(/(?=\P{sc=Yiii})\p{scx=Yiii}/u, "\u{c8c5f}");
-f(/(?=\P{sc=Yiii})\p{scx=Yiii}/u, "\u{10e9de}");
-f(/(?=\P{sc=Yiii})\p{scx=Yiii}/u, "\u{2d5ba}");
+f(/(?=\P{sc=Phlp})\p{scx=Phlp}/u, "\u{10677d}");
+f(/(?=\P{sc=Phlp})\p{scx=Phlp}/u, "\u{31238}");
+f(/(?=\P{sc=Phlp})\p{scx=Phlp}/u, "\u{62ae}");
+f(/(?=\P{sc=Phlp})\p{scx=Phlp}/u, "\u{88872}");
+f(/(?=\P{sc=Phlp})\p{scx=Phlp}/u, "\u{9720e}");
+// Script_Extension=Sogd
+f(/(?=\P{sc=Sogd})\p{scx=Sogd}/u, "\u{4c593}");
+f(/(?=\P{sc=Sogd})\p{scx=Sogd}/u, "\u{74ba6}");
+f(/(?=\P{sc=Sogd})\p{scx=Sogd}/u, "\u{f97a0}");
+f(/(?=\P{sc=Sogd})\p{scx=Sogd}/u, "\u{62e97}");
+f(/(?=\P{sc=Sogd})\p{scx=Sogd}/u, "\u{d2895}");
 // Script_Extension=Modi
-f(/(?=\P{sc=Modi})\p{scx=Modi}/u, "\u{4d486}");
-f(/(?=\P{sc=Modi})\p{scx=Modi}/u, "\u{7d0d5}");
-f(/(?=\P{sc=Modi})\p{scx=Modi}/u, "\u{4c4d6}");
-f(/(?=\P{sc=Modi})\p{scx=Modi}/u, "\u{a47e9}");
-f(/(?=\P{sc=Modi})\p{scx=Modi}/u, "\u{1f8a1}");
+f(/(?=\P{sc=Modi})\p{scx=Modi}/u, "\u{107b3}");
+f(/(?=\P{sc=Modi})\p{scx=Modi}/u, "\u{c6ffe}");
+f(/(?=\P{sc=Modi})\p{scx=Modi}/u, "\u{57254}");
+f(/(?=\P{sc=Modi})\p{scx=Modi}/u, "\u{3a9de}");
+f(/(?=\P{sc=Modi})\p{scx=Modi}/u, "\u{bb58d}");
 // Script_Extension=Sind
-f(/(?=\P{sc=Sind})\p{scx=Sind}/u, "\u{a8c86}");
-f(/(?=\P{sc=Sind})\p{scx=Sind}/u, "\u{507cc}");
-f(/(?=\P{sc=Sind})\p{scx=Sind}/u, "\u{e9d11}");
-f(/(?=\P{sc=Sind})\p{scx=Sind}/u, "\u{5b3b8}");
-f(/(?=\P{sc=Sind})\p{scx=Sind}/u, "\u{9c93e}");
+f(/(?=\P{sc=Sind})\p{scx=Sind}/u, "\u{b2f72}");
+f(/(?=\P{sc=Sind})\p{scx=Sind}/u, "\u{f7673}");
+f(/(?=\P{sc=Sind})\p{scx=Sind}/u, "\u{b2066}");
+f(/(?=\P{sc=Sind})\p{scx=Sind}/u, "\u{22ea9}");
+f(/(?=\P{sc=Sind})\p{scx=Sind}/u, "\u{492a}");
 // Script_Extension=Takr
-f(/(?=\P{sc=Takr})\p{scx=Takr}/u, "\u{d18cf}");
-f(/(?=\P{sc=Takr})\p{scx=Takr}/u, "\u{b09e7}");
-f(/(?=\P{sc=Takr})\p{scx=Takr}/u, "\u{b134e}");
-f(/(?=\P{sc=Takr})\p{scx=Takr}/u, "\u{5f1d5}");
-f(/(?=\P{sc=Takr})\p{scx=Takr}/u, "\u{bca99}");
+f(/(?=\P{sc=Takr})\p{scx=Takr}/u, "\u{89a3a}");
+f(/(?=\P{sc=Takr})\p{scx=Takr}/u, "\u{2c9bb}");
+f(/(?=\P{sc=Takr})\p{scx=Takr}/u, "\u{60523}");
+f(/(?=\P{sc=Takr})\p{scx=Takr}/u, "\u{86916}");
+f(/(?=\P{sc=Takr})\p{scx=Takr}/u, "\u{ce4af}");
 // Script_Extension=Tirh
-f(/(?=\P{sc=Tirh})\p{scx=Tirh}/u, "\u{8366f}");
-f(/(?=\P{sc=Tirh})\p{scx=Tirh}/u, "\u{a17ba}");
-f(/(?=\P{sc=Tirh})\p{scx=Tirh}/u, "\u{100f3b}");
-f(/(?=\P{sc=Tirh})\p{scx=Tirh}/u, "\u{f23d9}");
-f(/(?=\P{sc=Tirh})\p{scx=Tirh}/u, "\u{56a64}");
-// Script_Extension=Orya
-f(/(?=\P{sc=Orya})\p{scx=Orya}/u, "\u{30394}");
-f(/(?=\P{sc=Orya})\p{scx=Orya}/u, "\u{2f022}");
-f(/(?=\P{sc=Orya})\p{scx=Orya}/u, "\u{af689}");
-f(/(?=\P{sc=Orya})\p{scx=Orya}/u, "\u{5ad58}");
-f(/(?=\P{sc=Orya})\p{scx=Orya}/u, "\u{24a87}");
+f(/(?=\P{sc=Tirh})\p{scx=Tirh}/u, "\u{2905}");
+f(/(?=\P{sc=Tirh})\p{scx=Tirh}/u, "\u{900cf}");
+f(/(?=\P{sc=Tirh})\p{scx=Tirh}/u, "\u{4b07a}");
+f(/(?=\P{sc=Tirh})\p{scx=Tirh}/u, "\u{2319}");
+f(/(?=\P{sc=Tirh})\p{scx=Tirh}/u, "\u{69d82}");
+// Script_Extension=Gong
+f(/(?=\P{sc=Gong})\p{scx=Gong}/u, "\u{3ce05}");
+f(/(?=\P{sc=Gong})\p{scx=Gong}/u, "\u{362e8}");
+f(/(?=\P{sc=Gong})\p{scx=Gong}/u, "\u{fe0b9}");
+f(/(?=\P{sc=Gong})\p{scx=Gong}/u, "\u{99c0c}");
+f(/(?=\P{sc=Gong})\p{scx=Gong}/u, "\u{10a9c2}");
 // Script_Extension=Sinh
-f(/(?=\P{sc=Sinh})\p{scx=Sinh}/u, "\u{7451c}");
-f(/(?=\P{sc=Sinh})\p{scx=Sinh}/u, "\u{2d340}");
-f(/(?=\P{sc=Sinh})\p{scx=Sinh}/u, "\u{847bb}");
-f(/(?=\P{sc=Sinh})\p{scx=Sinh}/u, "\u{e8785}");
-f(/(?=\P{sc=Sinh})\p{scx=Sinh}/u, "\u{bf9ed}");
+f(/(?=\P{sc=Sinh})\p{scx=Sinh}/u, "\u{8ac14}");
+f(/(?=\P{sc=Sinh})\p{scx=Sinh}/u, "\u{fea84}");
+f(/(?=\P{sc=Sinh})\p{scx=Sinh}/u, "\u{5f107}");
+f(/(?=\P{sc=Sinh})\p{scx=Sinh}/u, "\u{7ed82}");
+f(/(?=\P{sc=Sinh})\p{scx=Sinh}/u, "\u{1b5b4}");
 // Script_Extension=Limb
-f(/(?=\P{sc=Limb})\p{scx=Limb}/u, "\u{5f22f}");
-f(/(?=\P{sc=Limb})\p{scx=Limb}/u, "\u{d729e}");
-f(/(?=\P{sc=Limb})\p{scx=Limb}/u, "\u{84288}");
-f(/(?=\P{sc=Limb})\p{scx=Limb}/u, "\u{320ef}");
-f(/(?=\P{sc=Limb})\p{scx=Limb}/u, "\u{260ac}");
+f(/(?=\P{sc=Limb})\p{scx=Limb}/u, "\u{36208}");
+f(/(?=\P{sc=Limb})\p{scx=Limb}/u, "\u{dff4e}");
+f(/(?=\P{sc=Limb})\p{scx=Limb}/u, "\u{fb421}");
+f(/(?=\P{sc=Limb})\p{scx=Limb}/u, "\u{5e20e}");
+f(/(?=\P{sc=Limb})\p{scx=Limb}/u, "\u{b6402}");
diff --git a/deps/v8/test/mjsunit/intl-numberformat-formattoparts.js b/deps/v8/test/mjsunit/intl-numberformat-formattoparts.js
index 30ae3447088fc4..c667c7bdec35a8 100644
--- a/deps/v8/test/mjsunit/intl-numberformat-formattoparts.js
+++ b/deps/v8/test/mjsunit/intl-numberformat-formattoparts.js
@@ -60,7 +60,7 @@ if (this.Intl) {
   var usDollarsCode = new Intl.NumberFormat("en-US", usdCodeOptions);
 
   assertParts(usDollarsCode, 25,
-              [Currency("USD"), Integer("25")]);
+              [Currency("USD"), Literal("\u00a0"), Integer("25")]);
 
   // ISO 4217 currency codes are formed from an ISO 3166-1 alpha-2 country code
   // followed by a third letter.  ISO 3166 guarantees that no country code
@@ -79,7 +79,7 @@ if (this.Intl) {
   var xqqMoneyCode = new Intl.NumberFormat("en-US", xqqCodeOptions);
 
   assertParts(xqqMoneyCode, 25,
-              [Currency("XQQ"), Integer("25")]);
+              [Currency("XQQ"), Literal("\u00a0"), Integer("25")]);
 
   // Test currencyDisplay: "name".
   var usdNameOptions =
@@ -187,7 +187,7 @@ if (this.Intl) {
                PercentSign("%")]);
 
   assertParts(usPercentFormatter, NaN,
-              [Nan("NaN")]);
+              [Nan("NaN"), PercentSign("%")]);
 
   assertParts(usPercentFormatter, Infinity,
               [Inf("∞"), PercentSign("%")]);
diff --git a/deps/v8/test/mozilla/mozilla.status b/deps/v8/test/mozilla/mozilla.status
index 84d17f3fdb2cbb..8e7a4a64903231 100644
--- a/deps/v8/test/mozilla/mozilla.status
+++ b/deps/v8/test/mozilla/mozilla.status
@@ -122,6 +122,10 @@
   # (https://chromium-review.googlesource.com/c/546941#message-5dc0f5efe277388501e8870e39ec70383dfc7db8)
   'js1_5/Scope/regress-185485': [FAIL],
 
+  # Georgina is bicameral as of Unicode 11, but the test assumes that it's unicameral.
+  # no_i18n build has an old ICU data and Georgian is treated as unicameral.
+  'ecma/String/15.5.4.12-3': [FAIL, ['no_i18n == True', PASS]],
+
   ##################### SKIPPED TESTS #####################
 
   # This test checks that we behave properly in an out-of-memory
diff --git a/deps/v8/test/test262/test262.status b/deps/v8/test/test262/test262.status
index ecc23f43e7d5df..0584a3918f3d51 100644
--- a/deps/v8/test/test262/test262.status
+++ b/deps/v8/test/test262/test262.status
@@ -388,123 +388,6 @@
   'built-ins/Object/internals/DefineOwnProperty/consistent-value-function-caller': [FAIL_SLOPPY],
   'built-ins/Object/internals/DefineOwnProperty/consistent-value-function-arguments': [FAIL_SLOPPY],
 
-  # ICU < 62 doesn't support Unicode v11.
-  # TODO(mathias): Re-enable these after we've updated to ICU 62.
-  # https://bugs.chromium.org/p/v8/issues/detail?id=7825
-  'built-ins/RegExp/property-escapes/generated/Alphabetic': [SKIP],
-  'built-ins/RegExp/property-escapes/generated/Assigned': [SKIP],
-  'built-ins/RegExp/property-escapes/generated/Bidi_Mirrored': [SKIP],
-  'built-ins/RegExp/property-escapes/generated/Cased': [SKIP],
-  'built-ins/RegExp/property-escapes/generated/Case_Ignorable': [SKIP],
-  'built-ins/RegExp/property-escapes/generated/Changes_When_Casefolded': [SKIP],
-  'built-ins/RegExp/property-escapes/generated/Changes_When_Casemapped': [SKIP],
-  'built-ins/RegExp/property-escapes/generated/Changes_When_Lowercased': [SKIP],
-  'built-ins/RegExp/property-escapes/generated/Changes_When_NFKC_Casefolded': [SKIP],
-  'built-ins/RegExp/property-escapes/generated/Changes_When_Titlecased': [SKIP],
-  'built-ins/RegExp/property-escapes/generated/Changes_When_Uppercased': [SKIP],
-  'built-ins/RegExp/property-escapes/generated/Diacritic': [SKIP],
-  'built-ins/RegExp/property-escapes/generated/Emoji': [SKIP],
-  'built-ins/RegExp/property-escapes/generated/Emoji_Component': [SKIP],
-  'built-ins/RegExp/property-escapes/generated/Emoji_Modifier_Base': [SKIP],
-  'built-ins/RegExp/property-escapes/generated/Emoji_Presentation': [SKIP],
-  'built-ins/RegExp/property-escapes/generated/Extended_Pictographic': [SKIP],
-  'built-ins/RegExp/property-escapes/generated/General_Category_-_Cased_Letter': [SKIP],
-  'built-ins/RegExp/property-escapes/generated/General_Category_-_Currency_Symbol': [SKIP],
-  'built-ins/RegExp/property-escapes/generated/General_Category_-_Decimal_Number': [SKIP],
-  'built-ins/RegExp/property-escapes/generated/General_Category_-_Format': [SKIP],
-  'built-ins/RegExp/property-escapes/generated/General_Category_-_Letter': [SKIP],
-  'built-ins/RegExp/property-escapes/generated/General_Category_-_Lowercase_Letter': [SKIP],
-  'built-ins/RegExp/property-escapes/generated/General_Category_-_Mark': [SKIP],
-  'built-ins/RegExp/property-escapes/generated/General_Category_-_Nonspacing_Mark': [SKIP],
-  'built-ins/RegExp/property-escapes/generated/General_Category_-_Number': [SKIP],
-  'built-ins/RegExp/property-escapes/generated/General_Category_-_Other': [SKIP],
-  'built-ins/RegExp/property-escapes/generated/General_Category_-_Other_Letter': [SKIP],
-  'built-ins/RegExp/property-escapes/generated/General_Category_-_Other_Number': [SKIP],
-  'built-ins/RegExp/property-escapes/generated/General_Category_-_Other_Punctuation': [SKIP],
-  'built-ins/RegExp/property-escapes/generated/General_Category_-_Other_Symbol': [SKIP],
-  'built-ins/RegExp/property-escapes/generated/General_Category_-_Punctuation': [SKIP],
-  'built-ins/RegExp/property-escapes/generated/General_Category_-_Spacing_Mark': [SKIP],
-  'built-ins/RegExp/property-escapes/generated/General_Category_-_Symbol': [SKIP],
-  'built-ins/RegExp/property-escapes/generated/General_Category_-_Unassigned': [SKIP],
-  'built-ins/RegExp/property-escapes/generated/General_Category_-_Uppercase_Letter': [SKIP],
-  'built-ins/RegExp/property-escapes/generated/Grapheme_Base': [SKIP],
-  'built-ins/RegExp/property-escapes/generated/Grapheme_Extend': [SKIP],
-  'built-ins/RegExp/property-escapes/generated/ID_Continue': [SKIP],
-  'built-ins/RegExp/property-escapes/generated/Ideographic': [SKIP],
-  'built-ins/RegExp/property-escapes/generated/ID_Start': [SKIP],
-  'built-ins/RegExp/property-escapes/generated/Lowercase': [SKIP],
-  'built-ins/RegExp/property-escapes/generated/Script_-_Ahom': [SKIP],
-  'built-ins/RegExp/property-escapes/generated/Script_-_Arabic': [SKIP],
-  'built-ins/RegExp/property-escapes/generated/Script_-_Armenian': [SKIP],
-  'built-ins/RegExp/property-escapes/generated/Script_-_Bengali': [SKIP],
-  'built-ins/RegExp/property-escapes/generated/Script_-_Bopomofo': [SKIP],
-  'built-ins/RegExp/property-escapes/generated/Script_-_Chakma': [SKIP],
-  'built-ins/RegExp/property-escapes/generated/Script_-_Common': [SKIP],
-  'built-ins/RegExp/property-escapes/generated/Script_-_Devanagari': [SKIP],
-  'built-ins/RegExp/property-escapes/generated/Script_-_Dogra': [SKIP],
-  'built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Ahom': [SKIP],
-  'built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Arabic': [SKIP],
-  'built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Armenian': [SKIP],
-  'built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Bengali': [SKIP],
-  'built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Bopomofo': [SKIP],
-  'built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Chakma': [SKIP],
-  'built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Common': [SKIP],
-  'built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Devanagari': [SKIP],
-  'built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Dogra': [SKIP],
-  'built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Georgian': [SKIP],
-  'built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Grantha': [SKIP],
-  'built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Gunjala_Gondi': [SKIP],
-  'built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Gurmukhi': [SKIP],
-  'built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Han': [SKIP],
-  'built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Hanifi_Rohingya': [SKIP],
-  'built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Hebrew': [SKIP],
-  'built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Kaithi': [SKIP],
-  'built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Kannada': [SKIP],
-  'built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Kharoshthi': [SKIP],
-  'built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Khojki': [SKIP],
-  'built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Latin': [SKIP],
-  'built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Makasar': [SKIP],
-  'built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Malayalam': [SKIP],
-  'built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Medefaidrin': [SKIP],
-  'built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Mongolian': [SKIP],
-  'built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Newa': [SKIP],
-  'built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Nko': [SKIP],
-  'built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Old_Sogdian': [SKIP],
-  'built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Oriya': [SKIP],
-  'built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Sogdian': [SKIP],
-  'built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Soyombo': [SKIP],
-  'built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Tamil': [SKIP],
-  'built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Tangut': [SKIP],
-  'built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Telugu': [SKIP],
-  'built-ins/RegExp/property-escapes/generated/Script_Extensions_-_Tirhuta': [SKIP],
-  'built-ins/RegExp/property-escapes/generated/Script_-_Georgian': [SKIP],
-  'built-ins/RegExp/property-escapes/generated/Script_-_Gunjala_Gondi': [SKIP],
-  'built-ins/RegExp/property-escapes/generated/Script_-_Gurmukhi': [SKIP],
-  'built-ins/RegExp/property-escapes/generated/Script_-_Han': [SKIP],
-  'built-ins/RegExp/property-escapes/generated/Script_-_Hanifi_Rohingya': [SKIP],
-  'built-ins/RegExp/property-escapes/generated/Script_-_Hebrew': [SKIP],
-  'built-ins/RegExp/property-escapes/generated/Script_-_Inherited': [SKIP],
-  'built-ins/RegExp/property-escapes/generated/Script_-_Kaithi': [SKIP],
-  'built-ins/RegExp/property-escapes/generated/Script_-_Kannada': [SKIP],
-  'built-ins/RegExp/property-escapes/generated/Script_-_Kharoshthi': [SKIP],
-  'built-ins/RegExp/property-escapes/generated/Script_-_Latin': [SKIP],
-  'built-ins/RegExp/property-escapes/generated/Script_-_Makasar': [SKIP],
-  'built-ins/RegExp/property-escapes/generated/Script_-_Medefaidrin': [SKIP],
-  'built-ins/RegExp/property-escapes/generated/Script_-_Mongolian': [SKIP],
-  'built-ins/RegExp/property-escapes/generated/Script_-_Newa': [SKIP],
-  'built-ins/RegExp/property-escapes/generated/Script_-_Nko': [SKIP],
-  'built-ins/RegExp/property-escapes/generated/Script_-_Old_Sogdian': [SKIP],
-  'built-ins/RegExp/property-escapes/generated/Script_-_Sogdian': [SKIP],
-  'built-ins/RegExp/property-escapes/generated/Script_-_Soyombo': [SKIP],
-  'built-ins/RegExp/property-escapes/generated/Script_-_Tangut': [SKIP],
-  'built-ins/RegExp/property-escapes/generated/Script_-_Telugu': [SKIP],
-  'built-ins/RegExp/property-escapes/generated/Sentence_Terminal': [SKIP],
-  'built-ins/RegExp/property-escapes/generated/Terminal_Punctuation': [SKIP],
-  'built-ins/RegExp/property-escapes/generated/Unified_Ideograph': [SKIP],
-  'built-ins/RegExp/property-escapes/generated/Uppercase': [SKIP],
-  'built-ins/RegExp/property-escapes/generated/XID_Continue': [SKIP],
-  'built-ins/RegExp/property-escapes/generated/XID_Start': [SKIP],
-
   # https://bugs.chromium.org/p/v8/issues/detail?id=7874
   'built-ins/Reflect/ownKeys/return-on-corresponding-order-large-index': [FAIL],
 

From c59d247b3105cf1379d3c386b6a4121593fafad1 Mon Sep 17 00:00:00 2001
From: Yang Guo <yangguo@chromium.org>
Date: Wed, 11 Jul 2018 11:50:40 +0200
Subject: [PATCH 22/28] Temporarily remove doctool/test-make-doc

---
 test/doctool/test-make-doc.js | 52 -----------------------------------
 1 file changed, 52 deletions(-)
 delete mode 100644 test/doctool/test-make-doc.js

diff --git a/test/doctool/test-make-doc.js b/test/doctool/test-make-doc.js
deleted file mode 100644
index a11da0e97d8355..00000000000000
--- a/test/doctool/test-make-doc.js
+++ /dev/null
@@ -1,52 +0,0 @@
-'use strict';
-const common = require('../common');
-if (common.isWindows) {
-  common.skip('`make doc` does not run on Windows');
-}
-
-// This tests that `make doc` generates the documentation properly.
-// Note that for this test to pass, `make doc` must be run first.
-
-const assert = require('assert');
-const fs = require('fs');
-const path = require('path');
-
-const apiPath = path.resolve(__dirname, '..', '..', 'out', 'doc', 'api');
-const allDocs = fs.readdirSync(apiPath);
-assert.ok(allDocs.includes('index.html'));
-
-const actualDocs = allDocs.filter(
-  (name) => {
-    const extension = path.extname(name);
-    return extension === '.html' || extension === '.json';
-  }
-);
-
-const toc = fs.readFileSync(path.resolve(apiPath, 'index.html'), 'utf8');
-const re = /href="([^/]+\.html)"/;
-const globalRe = new RegExp(re, 'g');
-const links = toc.match(globalRe);
-assert.notStrictEqual(links, null);
-
-// Filter out duplicate links, leave just filenames, add expected JSON files.
-const linkedHtmls = [...new Set(links)].map((link) => link.match(re)[1]);
-const expectedJsons = linkedHtmls
-                       .map((name) => name.replace('.html', '.json'));
-const expectedDocs = linkedHtmls.concat(expectedJsons);
-
-// Test that all the relative links in the TOC match to the actual documents.
-for (const expectedDoc of expectedDocs) {
-  assert.ok(actualDocs.includes(expectedDoc), `${expectedDoc} does not exist`);
-}
-
-// Test that all the actual documents match to the relative links in the TOC
-// and that they are not empty files.
-for (const actualDoc of actualDocs) {
-  assert.ok(
-    expectedDocs.includes(actualDoc), `${actualDoc} does not not match TOC`);
-
-  assert.ok(
-    fs.statSync(path.join(apiPath, actualDoc)).size !== 0,
-    `${actualDoc} is empty`
-  );
-}

From 43906ca5e4c728b664df3f6d40d13f29964dd6fc Mon Sep 17 00:00:00 2001
From: Clemens Hammacher <clemensh@chromium.org>
Date: Thu, 12 Jul 2018 13:18:58 +0200
Subject: [PATCH 23/28] tools: Remove lldbinit file from install script

In v8 we want to remove the lldbinit file (https://crrev.com/c/1127892).
In order to not brake node.js, we need to remove it here first.
---
 tools/install.py | 1 -
 1 file changed, 1 deletion(-)

diff --git a/tools/install.py b/tools/install.py
index ce9ceeee1dd578..d78c622d9af63b 100755
--- a/tools/install.py
+++ b/tools/install.py
@@ -144,7 +144,6 @@ def files(action):
   action(['src/node.stp'], 'share/systemtap/tapset/')
 
   action(['deps/v8/tools/gdbinit'], 'share/doc/node/')
-  action(['deps/v8/tools/lldbinit'], 'share/doc/node/')
   action(['deps/v8/tools/lldb_commands.py'], 'share/doc/node/')
 
   if 'freebsd' in sys.platform or 'openbsd' in sys.platform:

From 7571231566aa72f7c004f5e4fa09009d9c63f06c Mon Sep 17 00:00:00 2001
From: Yang Guo <yangguo@chromium.org>
Date: Fri, 13 Jul 2018 07:39:24 +0200
Subject: [PATCH 24/28] Update V8 to a37b78bd90

---
 deps/v8/.gitignore                            |    3 +
 deps/v8/BUILD.gn                              |    2 +
 deps/v8/DEPS                                  |   10 +-
 deps/v8/include/v8-profiler.h                 |    9 +-
 deps/v8/include/v8.h                          |   74 +
 deps/v8/infra/mb/mb_config.pyl                |   50 +-
 deps/v8/src/api-natives.cc                    |    4 +-
 deps/v8/src/api.cc                            |   14 +-
 deps/v8/src/api.h                             |    2 +
 deps/v8/src/arm/simulator-arm.cc              |    2 +-
 deps/v8/src/arm64/simulator-arm64.cc          |    2 +-
 deps/v8/src/asmjs/asm-parser.cc               |    6 +-
 deps/v8/src/asmjs/asm-parser.h                |    9 +-
 deps/v8/src/ast/modules.cc                    |   15 +
 deps/v8/src/ast/modules.h                     |   31 +-
 deps/v8/src/ast/scopes.cc                     |    8 +
 deps/v8/src/ast/scopes.h                      |    7 +-
 deps/v8/src/base/atomic-utils.h               |   40 -
 deps/v8/src/base/platform/platform-posix.cc   |    2 +
 deps/v8/src/bootstrapper.cc                   |    3 +-
 deps/v8/src/builtins/builtins-array.cc        |    6 +-
 deps/v8/src/builtins/builtins-internal-gen.cc |   46 -
 deps/v8/src/cancelable-task.h                 |    6 +-
 deps/v8/src/code-stub-assembler.cc            |    7 +-
 deps/v8/src/code-stub-assembler.h             |  103 +-
 deps/v8/src/code-stubs.cc                     |    2 +-
 deps/v8/src/compilation-cache.cc              |    3 +-
 deps/v8/src/compiler/access-info.cc           |    3 +-
 deps/v8/src/compiler/code-assembler.cc        |    2 +-
 .../src/compiler/effect-control-linearizer.cc |   10 +-
 deps/v8/src/compiler/js-heap-broker.cc        |   68 +
 deps/v8/src/compiler/js-heap-broker.h         |   37 +
 deps/v8/src/compiler/js-typed-lowering.cc     |  151 +-
 deps/v8/src/compiler/js-typed-lowering.h      |    2 +
 deps/v8/src/compiler/jump-threading.cc        |    7 +-
 deps/v8/src/compiler/jump-threading.h         |    3 +-
 deps/v8/src/compiler/node-matchers.h          |    2 +
 deps/v8/src/compiler/pipeline.cc              |    2 +-
 .../v8/src/compiler/ppc/code-generator-ppc.cc |    4 +-
 .../src/compiler/s390/code-generator-s390.cc  |    4 +-
 deps/v8/src/compiler/types.cc                 |    1 +
 deps/v8/src/debug/debug-evaluate.cc           |    2 +-
 deps/v8/src/debug/debug-scopes.cc             |   18 +-
 deps/v8/src/debug/debug.cc                    |    4 +-
 deps/v8/src/elements.cc                       |   33 +-
 deps/v8/src/flag-definitions.h                |    6 +-
 deps/v8/src/frames.cc                         |   11 +-
 deps/v8/src/gdb-jit.cc                        |    2 +-
 deps/v8/src/heap/embedder-tracing.h           |   20 +-
 deps/v8/src/heap/factory.cc                   |   30 +-
 deps/v8/src/heap/factory.h                    |    2 +-
 deps/v8/src/heap/heap-inl.h                   |   21 +
 deps/v8/src/heap/heap.cc                      |  168 ++-
 deps/v8/src/heap/heap.h                       |   23 +-
 deps/v8/src/heap/mark-compact.cc              |    9 +-
 deps/v8/src/heap/objects-visiting.h           |    1 +
 deps/v8/src/heap/setup-heap-internal.cc       |    1 +
 deps/v8/src/heap/spaces.cc                    |   17 +-
 deps/v8/src/heap/spaces.h                     |    4 +
 deps/v8/src/ic/accessor-assembler.cc          |    7 +-
 deps/v8/src/ic/ic.cc                          |    2 +-
 .../v8/src/inspector/v8-debugger-agent-impl.h |    9 +-
 deps/v8/src/inspector/v8-debugger.h           |   13 +-
 deps/v8/src/inspector/v8-inspector-impl.h     |   13 +-
 deps/v8/src/inspector/v8-runtime-agent-impl.h |    4 +-
 deps/v8/src/interpreter/interpreter.cc        |    2 +-
 deps/v8/src/intl.h                            |    4 +-
 deps/v8/src/isolate.cc                        |    8 +-
 deps/v8/src/isolate.h                         |    1 +
 deps/v8/src/js/OWNERS                         |    1 +
 deps/v8/src/js/intl.js                        |   20 +-
 deps/v8/src/keys.cc                           |    4 +-
 deps/v8/src/layout-descriptor.h               |    2 +-
 deps/v8/src/log.cc                            |    2 +-
 deps/v8/src/mips/simulator-mips.cc            |    2 +-
 deps/v8/src/mips64/simulator-mips64.cc        |    2 +-
 deps/v8/src/objects-body-descriptors-inl.h    |   21 +
 deps/v8/src/objects-debug.cc                  |   36 +-
 deps/v8/src/objects-definitions.h             |    1 +
 deps/v8/src/objects-inl.h                     |   61 +-
 deps/v8/src/objects-printer.cc                |  326 +++--
 deps/v8/src/objects.cc                        |  385 ++---
 deps/v8/src/objects.h                         |   95 +-
 deps/v8/src/objects/api-callbacks.h           |    3 +-
 deps/v8/src/objects/bigint.h                  |    5 +-
 deps/v8/src/objects/code.h                    |    4 +-
 deps/v8/src/objects/compilation-cache.h       |    2 +-
 deps/v8/src/objects/descriptor-array.h        |    3 +-
 deps/v8/src/objects/dictionary.h              |   13 +-
 deps/v8/src/objects/fixed-array.h             |   12 +-
 deps/v8/src/objects/frame-array.h             |    2 +-
 deps/v8/src/objects/hash-table-inl.h          |   24 +-
 deps/v8/src/objects/hash-table.h              |   40 +-
 deps/v8/src/objects/intl-objects.cc           |   48 +-
 deps/v8/src/objects/js-array.h                |   10 +-
 deps/v8/src/objects/js-collection.h           |   12 +-
 deps/v8/src/objects/js-promise.h              |    2 +-
 .../src/objects/js-regexp-string-iterator.h   |    2 +-
 deps/v8/src/objects/js-regexp.h               |    2 +-
 .../v8/src/objects/js-relative-time-format.cc |   20 +-
 deps/v8/src/objects/js-relative-time-format.h |    6 +-
 deps/v8/src/objects/literal-objects.cc        |    6 +-
 deps/v8/src/objects/map-inl.h                 |    1 +
 deps/v8/src/objects/map.h                     |    5 +-
 deps/v8/src/objects/maybe-object.h            |    8 +-
 deps/v8/src/objects/module-inl.h              |   35 +
 deps/v8/src/objects/module.cc                 |   24 +-
 deps/v8/src/objects/module.h                  |   40 +-
 deps/v8/src/objects/name-inl.h                |    5 +-
 deps/v8/src/objects/name.h                    |    8 +-
 deps/v8/src/objects/ordered-hash-table.cc     |    2 +-
 deps/v8/src/objects/prototype-info-inl.h      |   45 +
 deps/v8/src/objects/prototype-info.h          |   75 +
 .../v8/src/objects/shared-function-info-inl.h |   32 +-
 deps/v8/src/objects/shared-function-info.h    |   35 +-
 deps/v8/src/objects/string-inl.h              |   34 +-
 deps/v8/src/objects/string-table.h            |    6 +-
 deps/v8/src/objects/string.h                  |   18 +-
 deps/v8/src/parsing/func-name-inferrer.cc     |    6 +
 deps/v8/src/parsing/func-name-inferrer.h      |    6 +-
 deps/v8/src/parsing/parser.cc                 |    4 +-
 deps/v8/src/parsing/preparsed-scope-data.cc   |   72 +-
 deps/v8/src/parsing/preparsed-scope-data.h    |    2 +
 .../src/parsing/scanner-character-streams.cc  |    6 +-
 deps/v8/src/profiler/cpu-profiler-inl.h       |    2 +-
 deps/v8/src/profiler/cpu-profiler.cc          |    6 +-
 deps/v8/src/profiler/cpu-profiler.h           |    2 +-
 .../src/profiler/heap-snapshot-generator.cc   |   26 +-
 deps/v8/src/property.h                        |   11 -
 deps/v8/src/roots.h                           |    1 +
 deps/v8/src/runtime/runtime-array.cc          |    2 +-
 deps/v8/src/runtime/runtime-classes.cc        |    3 +-
 deps/v8/src/runtime/runtime-collections.cc    |    4 +-
 deps/v8/src/runtime/runtime-object.cc         |    3 +-
 deps/v8/src/runtime/runtime-regexp.cc         |   10 +-
 deps/v8/src/runtime/runtime-test.cc           |    8 +-
 deps/v8/src/runtime/runtime-wasm.cc           |    7 +-
 deps/v8/src/s390/assembler-s390.h             |   40 +
 deps/v8/src/s390/constants-s390.h             |   53 -
 deps/v8/src/s390/disasm-s390.cc               | 1243 +++++------------
 deps/v8/src/s390/simulator-s390.cc            |   21 -
 deps/v8/src/signature.h                       |   23 +-
 deps/v8/src/snapshot/deserializer.cc          |    6 +-
 deps/v8/src/snapshot/serializer.cc            |    2 +-
 deps/v8/src/snapshot/startup-serializer.cc    |    2 +-
 deps/v8/src/transitions-inl.h                 |    9 +-
 deps/v8/src/transitions.cc                    |   38 +-
 deps/v8/src/transitions.h                     |   16 +-
 deps/v8/src/value-serializer.cc               |    3 +-
 deps/v8/src/vector.h                          |    9 +-
 deps/v8/src/wasm/function-compiler.cc         |    4 +
 deps/v8/src/wasm/module-compiler.cc           |  146 +-
 deps/v8/src/wasm/module-decoder.cc            |   18 +-
 deps/v8/src/wasm/signature-map.cc             |   22 +-
 deps/v8/src/wasm/signature-map.h              |   16 +-
 deps/v8/src/wasm/value-type.h                 |    2 +
 deps/v8/src/wasm/wasm-debug.cc                |    4 +-
 deps/v8/src/wasm/wasm-interpreter.cc          |    4 +-
 deps/v8/src/wasm/wasm-js.cc                   |   36 +
 deps/v8/src/wasm/wasm-module-builder.cc       |   32 +-
 deps/v8/src/wasm/wasm-module-builder.h        |    9 +-
 deps/v8/src/wasm/wasm-objects.cc              |    2 +-
 deps/v8/src/wasm/wasm-objects.h               |    2 +-
 deps/v8/src/wasm/wasm-opcodes.cc              |    2 -
 deps/v8/src/wasm/wasm-opcodes.h               |    6 +-
 deps/v8/test/cctest/BUILD.gn                  |    1 +
 deps/v8/test/cctest/assembler-helper-arm.cc   |    2 +-
 deps/v8/test/cctest/cctest.h                  |    8 +-
 deps/v8/test/cctest/cctest.status             |    3 -
 .../cctest/compiler/test-code-generator.cc    |   12 +-
 .../cctest/compiler/test-jump-threading.cc    |    2 +-
 .../test/cctest/heap/test-embedder-tracing.cc |   67 +-
 .../heap/test-external-string-tracker.cc      |  176 +++
 deps/v8/test/cctest/heap/test-heap.cc         |   14 +-
 deps/v8/test/cctest/parsing/test-preparser.cc |    6 +
 .../cctest/parsing/test-scanner-streams.cc    |    4 +-
 deps/v8/test/cctest/test-api.cc               |   16 +-
 deps/v8/test/cctest/test-assembler-arm.cc     |   84 +-
 deps/v8/test/cctest/test-assembler-ia32.cc    |   38 +-
 deps/v8/test/cctest/test-assembler-mips.cc    |   42 +-
 deps/v8/test/cctest/test-assembler-mips64.cc  |   48 +-
 deps/v8/test/cctest/test-assembler-ppc.cc     |   24 +-
 deps/v8/test/cctest/test-assembler-s390.cc    |   26 +-
 deps/v8/test/cctest/test-assembler-x64.cc     |   30 +-
 .../test/cctest/test-code-stub-assembler.cc   |    2 +-
 deps/v8/test/cctest/test-dictionary.cc        |   12 +-
 deps/v8/test/cctest/test-disasm-ia32.cc       |    2 +-
 deps/v8/test/cctest/test-disasm-x64.cc        |    2 +-
 .../test/cctest/test-field-type-tracking.cc   |    2 +-
 deps/v8/test/cctest/test-heap-profiler.cc     |   83 ++
 deps/v8/test/cctest/test-intl.cc              |    6 +
 deps/v8/test/cctest/test-log.cc               |    4 +-
 .../test/cctest/test-macro-assembler-arm.cc   |    4 +-
 .../test/cctest/test-macro-assembler-mips.cc  |   10 +-
 .../cctest/test-macro-assembler-mips64.cc     |   10 +-
 deps/v8/test/cctest/test-serialize.cc         |    8 +-
 deps/v8/test/cctest/test-strings.cc           |    8 +-
 deps/v8/test/cctest/test-symbols.cc           |    2 +-
 deps/v8/test/cctest/test-transitions.cc       |   10 +-
 .../test/cctest/wasm/test-run-wasm-module.cc  |    2 +-
 .../cctest/wasm/test-wasm-trap-position.cc    |    2 +-
 deps/v8/test/cctest/wasm/wasm-run-utils.cc    |    2 +-
 deps/v8/test/cctest/wasm/wasm-run-utils.h     |    2 +-
 deps/v8/test/fuzzer/wasm-code.cc              |    6 +-
 deps/v8/test/fuzzer/wasm-compile.cc           |   32 +-
 deps/v8/test/fuzzer/wasm-fuzzer-common.cc     |   53 +-
 deps/v8/test/fuzzer/wasm-fuzzer-common.h      |    5 +-
 deps/v8/test/inspector/task-runner.cc         |    9 +-
 deps/v8/test/inspector/task-runner.h          |    3 +-
 deps/v8/test/mjsunit/mjsunit.status           |    7 +-
 .../v8/test/mjsunit/regress/regress-862433.js |    9 +
 .../mjsunit/regress/regress-crbug-862538.js   |   13 +
 .../test/mjsunit/wasm/tier-up-testing-flag.js |   46 +
 deps/v8/test/test262/test262.status           |    1 -
 .../unittests/base/atomic-utils-unittest.cc   |   73 -
 .../heap/embedder-tracing-unittest.cc         |   45 +-
 deps/v8/test/unittests/object-unittest.cc     |    4 +-
 .../wasm/function-body-decoder-unittest.cc    |    1 -
 .../unittests/wasm/module-decoder-unittest.cc |  256 ++++
 deps/v8/third_party/antlr4/BUILD.gn           |    3 +
 deps/v8/tools/lldb_commands.py                |   76 +-
 deps/v8/tools/lldbinit                        |   20 +
 deps/v8/tools/mb/mb.py                        |    2 +
 deps/v8/tools/turbolizer/package-lock.json    |  390 +++++-
 deps/v8/tools/turbolizer/package.json         |    8 +-
 deps/v8/tools/turbolizer/rollup.config.js     |   12 +
 deps/v8/tools/turbolizer/src/code-view.ts     |   10 +-
 deps/v8/tools/turbolizer/src/constants.ts     |   35 +-
 .../tools/turbolizer/src/disassembly-view.ts  |    6 +-
 deps/v8/tools/turbolizer/src/edge.ts          |   10 +-
 deps/v8/tools/turbolizer/src/graph-layout.ts  |   10 +-
 deps/v8/tools/turbolizer/src/graph-view.ts    |   23 +-
 .../v8/tools/turbolizer/src/graphmultiview.ts |    8 +-
 deps/v8/tools/turbolizer/src/monkey.ts        |    9 -
 deps/v8/tools/turbolizer/src/node.ts          |   16 +-
 deps/v8/tools/turbolizer/src/schedule-view.ts |    7 +-
 .../tools/turbolizer/src/selection-broker.ts  |    4 +-
 deps/v8/tools/turbolizer/src/selection.ts     |    4 +-
 .../tools/turbolizer/src/source-resolver.ts   |   16 +-
 deps/v8/tools/turbolizer/src/text-view.ts     |   10 +-
 .../tools/turbolizer/src/turbo-visualizer.ts  |   31 +-
 deps/v8/tools/turbolizer/src/util.ts          |   16 +-
 deps/v8/tools/turbolizer/src/view.ts          |    6 +-
 deps/v8/tools/turbolizer/tsconfig.json        |   13 +-
 deps/v8/tools/v8heapconst.py                  |  220 +--
 245 files changed, 3980 insertions(+), 3019 deletions(-)
 create mode 100644 deps/v8/src/objects/prototype-info-inl.h
 create mode 100644 deps/v8/src/objects/prototype-info.h
 create mode 100644 deps/v8/test/cctest/heap/test-external-string-tracker.cc
 create mode 100644 deps/v8/test/mjsunit/regress/regress-862433.js
 create mode 100644 deps/v8/test/mjsunit/regress/regress-crbug-862538.js
 create mode 100644 deps/v8/test/mjsunit/wasm/tier-up-testing-flag.js
 create mode 100755 deps/v8/tools/lldbinit
 create mode 100644 deps/v8/tools/turbolizer/rollup.config.js
 delete mode 100644 deps/v8/tools/turbolizer/src/monkey.ts

diff --git a/deps/v8/.gitignore b/deps/v8/.gitignore
index a6339d7e6fe693..7cd7a0928de372 100644
--- a/deps/v8/.gitignore
+++ b/deps/v8/.gitignore
@@ -1,3 +1,4 @@
+
 #*#
 *.Makefile
 *.a
@@ -108,7 +109,9 @@ node_modules
 shell
 shell_g
 tags
+tools/turbolizer/.rpt2_cache
 tools/turbolizer/build
+tools/turbolizer/deploy
 turbo*.cfg
 turbo*.dot
 turbo*.json
diff --git a/deps/v8/BUILD.gn b/deps/v8/BUILD.gn
index e76866f9d5c0e9..8931e4fc620693 100644
--- a/deps/v8/BUILD.gn
+++ b/deps/v8/BUILD.gn
@@ -2180,6 +2180,8 @@ v8_source_set("v8_base") {
     "src/objects/promise.h",
     "src/objects/property-descriptor-object-inl.h",
     "src/objects/property-descriptor-object.h",
+    "src/objects/prototype-info-inl.h",
+    "src/objects/prototype-info.h",
     "src/objects/regexp-match-info.h",
     "src/objects/scope-info.cc",
     "src/objects/scope-info.h",
diff --git a/deps/v8/DEPS b/deps/v8/DEPS
index 79ceacc75082a2..cc7c2dc824cc3b 100644
--- a/deps/v8/DEPS
+++ b/deps/v8/DEPS
@@ -12,11 +12,11 @@ vars = {
 
 deps = {
   'v8/build':
-    Var('chromium_url') + '/chromium/src/build.git' + '@' + '9b4b41368c26e443873813b0922d9e2fb02a9dd8',
+    Var('chromium_url') + '/chromium/src/build.git' + '@' + '7b4d0db3ac880a5cc310ebfaf9a22d471c8592c8',
   'v8/tools/gyp':
     Var('chromium_url') + '/external/gyp.git' + '@' + 'd61a9397e668fa9843c4aa7da9e79460fe590bfb',
   'v8/third_party/depot_tools':
-    Var('chromium_url') + '/chromium/tools/depot_tools.git' + '@' + 'c3975e55e1465d9d9320ae67889f0b057c7d7ec3',
+    Var('chromium_url') + '/chromium/tools/depot_tools.git' + '@' + '882c91ed97c39cde9fb93b153c25676a7c084499',
   'v8/third_party/icu':
     Var('chromium_url') + '/chromium/deps/icu.git' + '@' + 'a9a2bd3ee4f1d313651c5272252aaf2a3e7ed529',
   'v8/third_party/instrumented_libraries':
@@ -34,7 +34,7 @@ deps = {
     'condition': 'checkout_android',
   },
   'v8/third_party/catapult': {
-    'url': Var('chromium_url') + '/catapult.git' + '@' + '0c92958e3ed066e66cb0fc3882d023f15193e802',
+    'url': Var('chromium_url') + '/catapult.git' + '@' + '8495de1eb482068897a88bbd3a59199d1a4525f5',
     'condition': 'checkout_android',
   },
   'v8/third_party/colorama/src': {
@@ -62,9 +62,9 @@ deps = {
   'v8/test/test262/harness':
     Var('chromium_url') + '/external/github.com/test262-utils/test262-harness-py.git' + '@' + '0f2acdd882c84cff43b9d60df7574a1901e2cdcd',
   'v8/tools/clang':
-    Var('chromium_url') + '/chromium/src/tools/clang.git' + '@' + '2024df99f9388a126b750a14bd827bb2e946f5d3',
+    Var('chromium_url') + '/chromium/src/tools/clang.git' + '@' + 'e9cc24f5fef7fea00b265829002cc12973353b00',
   'v8/tools/luci-go':
-    Var('chromium_url') + '/chromium/src/tools/luci-go.git' + '@' + 'e3d4003364ba53f0db6e235609d8e7f5b7d7ab9d',
+    Var('chromium_url') + '/chromium/src/tools/luci-go.git' + '@' + '7edc822ab85483d64946e62a7e66a579b6929f0b',
   'v8/test/wasm-js':
     Var('chromium_url') + '/external/github.com/WebAssembly/spec.git' + '@' + '2113ea7e106f8a964e0445ba38f289d2aa845edd',
 }
diff --git a/deps/v8/include/v8-profiler.h b/deps/v8/include/v8-profiler.h
index a8a9b48333604b..b486683c279f31 100644
--- a/deps/v8/include/v8-profiler.h
+++ b/deps/v8/include/v8-profiler.h
@@ -703,11 +703,14 @@ class V8_EXPORT EmbedderGraph {
   virtual Node* AddNode(std::unique_ptr<Node> node) = 0;
 
   /**
-   * Adds an edge that represents a strong reference from the given node
-   * |from| to the given node |to|. The nodes must be added to the graph
+   * Adds an edge that represents a strong reference from the given
+   * node |from| to the given node |to|. The nodes must be added to the graph
    * before calling this function.
+   *
+   * If name is nullptr, the edge will have auto-increment indexes, otherwise
+   * it will be named accordingly.
    */
-  virtual void AddEdge(Node* from, Node* to) = 0;
+  virtual void AddEdge(Node* from, Node* to, const char* name = nullptr) = 0;
 
   virtual ~EmbedderGraph() = default;
 };
diff --git a/deps/v8/include/v8.h b/deps/v8/include/v8.h
index b29a0cb127060c..1842f16914544d 100644
--- a/deps/v8/include/v8.h
+++ b/deps/v8/include/v8.h
@@ -145,6 +145,7 @@ class DeferredHandles;
 class Heap;
 class HeapObject;
 class Isolate;
+class LocalEmbedderHeapTracer;
 class Object;
 struct ScriptStreamingData;
 template<typename T> class CustomArguments;
@@ -153,6 +154,7 @@ class FunctionCallbackArguments;
 class GlobalHandles;
 
 namespace wasm {
+class CompilationResultResolver;
 class StreamingDecoder;
 }  // namespace wasm
 
@@ -4461,6 +4463,52 @@ operator WasmCompiledModule::CallerOwnedBuffer() {
   return {start, size};
 }
 
+/**
+ * The V8 interface for WebAssembly streaming compilation. When streaming
+ * compilation is initiated, V8 passes a {WasmStreaming} object to the embedder
+ * such that the embedder can pass the input butes for streaming compilation to
+ * V8.
+ */
+class V8_EXPORT WasmStreaming final {
+ public:
+  class WasmStreamingImpl;
+
+  WasmStreaming(std::unique_ptr<WasmStreamingImpl> impl);
+
+  ~WasmStreaming();
+
+  /**
+   * Pass a new chunck of bytes to WebAssembly streaming compilation.
+   * The buffer passed into {OnBytesReceived} is owned by the caller.
+   */
+  void OnBytesReceived(const uint8_t* bytes, size_t size);
+
+  /**
+   * {Finish} should be called after all received bytes where passed to
+   * {OnBytesReceived} to tell V8 that there will be no more bytes. {Finish}
+   * does not have to be called after {Abort} has been called already.
+   */
+  void Finish();
+
+  /**
+   * Abort streaming compilation. If {exception} has a value, then the promise
+   * associated with streaming compilation is rejected with that value. If
+   * {exception} does not have value, the promise does not get rejected.
+   */
+  void Abort(MaybeLocal<Value> exception);
+
+  /**
+   * Unpacks a {WasmStreaming} object wrapped in a  {Managed} for the embedder.
+   * Since the embedder is on the other side of the API, it cannot unpack the
+   * {Managed} itself.
+   */
+  static std::shared_ptr<WasmStreaming> Unpack(Isolate* isolate,
+                                               Local<Value> value);
+
+ private:
+  std::unique_ptr<WasmStreamingImpl> impl_;
+};
+
 // TODO(mtrofin): when streaming compilation is done, we can rename this
 // to simply WasmModuleObjectBuilder
 class V8_EXPORT WasmModuleObjectBuilderStreaming final {
@@ -6677,6 +6725,9 @@ typedef bool (*AllowWasmCodeGenerationCallback)(Local<Context> context,
 // by the embedder. Example: WebAssembly.{compile|instantiate}Streaming ---
 typedef void (*ApiImplementationCallback)(const FunctionCallbackInfo<Value>&);
 
+// --- Callback for WebAssembly.compileStreaming ---
+typedef void (*WasmStreamingCallback)(const FunctionCallbackInfo<Value>&);
+
 // --- Garbage Collection Callbacks ---
 
 /**
@@ -7065,6 +7116,23 @@ class V8_EXPORT EmbedderHeapTracer {
    */
   virtual void AbortTracing() = 0;
 
+  /*
+   * Called by the embedder to request immediaet finalization of the currently
+   * running tracing phase that has been started with TracePrologue and not
+   * yet finished with TraceEpilogue.
+   *
+   * Will be a noop when currently not in tracing.
+   *
+   * This is an experimental feature.
+   */
+  void FinalizeTracing();
+
+  /*
+   * Returns the v8::Isolate this tracer is attached too and |nullptr| if it
+   * is not attached to any v8::Isolate.
+   */
+  v8::Isolate* isolate() const { return isolate_; }
+
   /**
    * Returns the number of wrappers that are still to be traced by the embedder.
    */
@@ -7073,6 +7141,10 @@ class V8_EXPORT EmbedderHeapTracer {
 
  protected:
   virtual ~EmbedderHeapTracer() = default;
+
+  v8::Isolate* isolate_ = nullptr;
+
+  friend class internal::LocalEmbedderHeapTracer;
 };
 
 /**
@@ -8168,6 +8240,8 @@ class V8_EXPORT Isolate {
 
   void SetWasmCompileStreamingCallback(ApiImplementationCallback callback);
 
+  void SetWasmStreamingCallback(WasmStreamingCallback callback);
+
   /**
   * Check if V8 is dead and therefore unusable.  This is the case after
   * fatal errors such as out-of-memory situations.
diff --git a/deps/v8/infra/mb/mb_config.pyl b/deps/v8/infra/mb/mb_config.pyl
index 52d4fe90abe582..80874bf14810cb 100644
--- a/deps/v8/infra/mb/mb_config.pyl
+++ b/deps/v8/infra/mb/mb_config.pyl
@@ -27,18 +27,21 @@
       'mips64el.debug': 'default_debug_mips64el',
       'mips64el.optdebug': 'default_optdebug_mips64el',
       'mips64el.release': 'default_release_mips64el',
-      'ppc.debug': 'default_debug_ppc',
-      'ppc.optdebug': 'default_optdebug_ppc',
-      'ppc.release': 'default_release_ppc',
+      'ppc.debug.sim': 'default_debug_ppc_sim',
+      'ppc.optdebug.sim': 'default_optdebug_ppc_sim',
+      'ppc.release.sim': 'default_release_ppc_sim',
       'ppc64.debug': 'default_debug_ppc64',
+      'ppc64.debug.sim': 'default_debug_ppc64_sim',
       'ppc64.optdebug': 'default_optdebug_ppc64',
+      'ppc64.optdebug.sim': 'default_optdebug_ppc64_sim',
       'ppc64.release': 'default_release_ppc64',
-      's390.debug': 'default_debug_s390',
-      's390.optdebug': 'default_optdebug_s390',
-      's390.release': 'default_release_s390',
-      's390x.debug': 'default_debug_s390x',
-      's390x.optdebug': 'default_optdebug_s390x',
-      's390x.release': 'default_release_s390x',
+      'ppc64.release.sim': 'default_release_ppc64_sim',
+      's390.debug.sim': 'default_debug_s390_sim',
+      's390.optdebug.sim': 'default_optdebug_s390_sim',
+      's390.release.sim': 'default_release_s390_sim',
+      's390x.debug.sim': 'default_debug_s390x_sim',
+      's390x.optdebug.sim': 'default_optdebug_s390x_sim',
+      's390x.release.sim': 'default_release_s390x_sim',
       'x64.debug': 'default_debug_x64',
       'x64.optdebug': 'default_optdebug_x64',
       'x64.release': 'default_release_x64',
@@ -253,6 +256,7 @@
 
   # To ease readability, config values are ordered by:
   # release/debug, arch type, other values alphabetically.
+  # TODO: create separate native configurations for ppc,s390[x].
   'configs': {
     # Developer default configs.
     'default_debug_arm': [
@@ -285,29 +289,35 @@
       'debug', 'simulate_mips64el', 'v8_enable_slow_dchecks'],
     'default_release_mips64el': [
       'release', 'simulate_mips64el'],
-    'default_debug_ppc': [
+    'default_debug_ppc_sim': [
       'debug', 'simulate_ppc', 'v8_enable_slow_dchecks', 'v8_full_debug'],
-    'default_optdebug_ppc': [
+    'default_optdebug_ppc_sim': [
       'debug', 'simulate_ppc', 'v8_enable_slow_dchecks'],
-    'default_release_ppc': [
+    'default_release_ppc_sim': [
       'release', 'simulate_ppc'],
     'default_debug_ppc64': [
+      'debug', 'ppc64', 'gcc', 'v8_enable_slow_dchecks', 'v8_full_debug'],
+    'default_debug_ppc64_sim': [
       'debug', 'simulate_ppc64', 'v8_enable_slow_dchecks', 'v8_full_debug'],
     'default_optdebug_ppc64': [
+      'debug', 'ppc64', 'gcc', 'v8_enable_slow_dchecks'],
+    'default_optdebug_ppc64_sim': [
       'debug', 'simulate_ppc64', 'v8_enable_slow_dchecks'],
     'default_release_ppc64': [
+      'release', 'ppc64', 'gcc'],
+    'default_release_ppc64_sim': [
       'release', 'simulate_ppc64'],
-    'default_debug_s390': [
+    'default_debug_s390_sim': [
       'debug', 'simulate_s390', 'v8_enable_slow_dchecks', 'v8_full_debug'],
-    'default_optdebug_s390': [
+    'default_optdebug_s390_sim': [
       'debug', 'simulate_s390', 'v8_enable_slow_dchecks'],
-    'default_release_s390': [
+    'default_release_s390_sim': [
       'release', 'simulate_s390'],
-    'default_debug_s390x': [
+    'default_debug_s390x_sim': [
       'debug', 'simulate_s390x', 'v8_enable_slow_dchecks', 'v8_full_debug'],
-    'default_optdebug_s390x': [
+    'default_optdebug_s390x_sim': [
       'debug', 'simulate_s390x', 'v8_enable_slow_dchecks'],
-    'default_release_s390x': [
+    'default_release_s390x_sim': [
       'release', 'simulate_s390x'],
     'default_debug_x64': [
       'debug', 'x64', 'v8_enable_slow_dchecks', 'v8_full_debug'],
@@ -833,5 +843,9 @@
     'x86': {
       'gn_args': 'target_cpu="x86"',
     },
+
+    'ppc64': {
+      'gn_args': 'target_cpu="ppc64"',
+    },
   },
 }
diff --git a/deps/v8/src/api-natives.cc b/deps/v8/src/api-natives.cc
index 8d564509c12f8d..6c01d6d9261038 100644
--- a/deps/v8/src/api-natives.cc
+++ b/deps/v8/src/api-natives.cc
@@ -308,7 +308,7 @@ void CacheTemplateInstantiation(Isolate* isolate, int serial_number,
     Handle<FixedArray> fast_cache =
         isolate->fast_template_instantiations_cache();
     Handle<FixedArray> new_cache =
-        FixedArray::SetAndGrow(fast_cache, serial_number - 1, object);
+        FixedArray::SetAndGrow(isolate, fast_cache, serial_number - 1, object);
     if (*new_cache != *fast_cache) {
       isolate->native_context()->set_fast_template_instantiations_cache(
           *new_cache);
@@ -341,7 +341,7 @@ void UncacheTemplateInstantiation(Isolate* isolate, int serial_number,
         isolate->slow_template_instantiations_cache();
     int entry = cache->FindEntry(serial_number);
     DCHECK_NE(SimpleNumberDictionary::kNotFound, entry);
-    cache = SimpleNumberDictionary::DeleteEntry(cache, entry);
+    cache = SimpleNumberDictionary::DeleteEntry(isolate, cache, entry);
     isolate->native_context()->set_slow_template_instantiations_cache(*cache);
   }
 }
diff --git a/deps/v8/src/api.cc b/deps/v8/src/api.cc
index ecd8e5d37976ff..0cf34bb394f380 100644
--- a/deps/v8/src/api.cc
+++ b/deps/v8/src/api.cc
@@ -6460,7 +6460,7 @@ i::Object** GetSerializedDataFromFixedArray(i::Isolate* isolate,
       // empty FixedArray).
       int last = list->length() - 1;
       while (last >= 0 && list->is_the_hole(isolate, last)) last--;
-      if (last != -1) list->Shrink(last + 1);
+      if (last != -1) list->Shrink(isolate, last + 1);
       return i::Handle<i::Object>(object, isolate).location();
     }
   }
@@ -8939,6 +8939,9 @@ CALLBACK_SETTER(WasmInstanceCallback, ExtensionCallback, wasm_instance_callback)
 CALLBACK_SETTER(WasmCompileStreamingCallback, ApiImplementationCallback,
                 wasm_compile_streaming_callback)
 
+CALLBACK_SETTER(WasmStreamingCallback, WasmStreamingCallback,
+                wasm_streaming_callback)
+
 void Isolate::AddNearHeapLimitCallback(v8::NearHeapLimitCallback callback,
                                        void* data) {
   i::Isolate* isolate = reinterpret_cast<i::Isolate*>(this);
@@ -10636,6 +10639,15 @@ void Testing::DeoptimizeAll(Isolate* isolate) {
   i::Deoptimizer::DeoptimizeAll(i_isolate);
 }
 
+void EmbedderHeapTracer::FinalizeTracing() {
+  if (isolate_) {
+    i::Isolate* isolate = reinterpret_cast<i::Isolate*>(isolate_);
+    if (isolate->heap()->incremental_marking()->IsMarking()) {
+      isolate->heap()->FinalizeIncrementalMarkingAtomically(
+          i::GarbageCollectionReason::kExternalFinalize);
+    }
+  }
+}
 
 namespace internal {
 
diff --git a/deps/v8/src/api.h b/deps/v8/src/api.h
index 4cc35bea6a82f4..8ffec881ed6992 100644
--- a/deps/v8/src/api.h
+++ b/deps/v8/src/api.h
@@ -11,9 +11,11 @@
 #include "src/detachable-vector.h"
 #include "src/heap/factory.h"
 #include "src/isolate.h"
+#include "src/objects/bigint.h"
 #include "src/objects/js-collection.h"
 #include "src/objects/js-promise.h"
 #include "src/objects/module.h"
+#include "src/objects/templates.h"
 
 namespace v8 {
 
diff --git a/deps/v8/src/arm/simulator-arm.cc b/deps/v8/src/arm/simulator-arm.cc
index b254ab000c46c5..e0f57396c1b5f1 100644
--- a/deps/v8/src/arm/simulator-arm.cc
+++ b/deps/v8/src/arm/simulator-arm.cc
@@ -290,7 +290,7 @@ void ArmDebugger::Debug() {
             Object* obj = reinterpret_cast<Object*>(value);
             os << arg1 << ": \n";
 #ifdef DEBUG
-            obj->Print(sim_->isolate_, os);
+            obj->Print(os);
             os << "\n";
 #else
             os << Brief(obj) << "\n";
diff --git a/deps/v8/src/arm64/simulator-arm64.cc b/deps/v8/src/arm64/simulator-arm64.cc
index 56b3da2331ddbf..09c447fdb56aaa 100644
--- a/deps/v8/src/arm64/simulator-arm64.cc
+++ b/deps/v8/src/arm64/simulator-arm64.cc
@@ -3189,7 +3189,7 @@ void Simulator::Debug() {
             Object* obj = reinterpret_cast<Object*>(value);
             os << arg1 << ": \n";
 #ifdef DEBUG
-            obj->Print(isolate_, os);
+            obj->Print(os);
             os << "\n";
 #else
             os << Brief(obj) << "\n";
diff --git a/deps/v8/src/asmjs/asm-parser.cc b/deps/v8/src/asmjs/asm-parser.cc
index 1fca56b0fc8480..fee309d9fb412d 100644
--- a/deps/v8/src/asmjs/asm-parser.cc
+++ b/deps/v8/src/asmjs/asm-parser.cc
@@ -553,7 +553,7 @@ void AsmJsParser::ValidateModuleVarImport(VarInfo* info,
     } else {
       info->kind = VarKind::kImportedFunction;
       info->import = new (zone()->New(sizeof(FunctionImportInfo)))
-          FunctionImportInfo({name, WasmModuleBuilder::SignatureMap(zone())});
+          FunctionImportInfo(name, zone());
       info->mutable_variable = false;
     }
   }
@@ -2210,14 +2210,14 @@ AsmType* AsmJsParser::ValidateCall() {
     DCHECK_NOT_NULL(function_info->import);
     // TODO(bradnelson): Factor out.
     uint32_t index;
-    auto it = function_info->import->cache.find(sig);
+    auto it = function_info->import->cache.find(*sig);
     if (it != function_info->import->cache.end()) {
       index = it->second;
       DCHECK(function_info->function_defined);
     } else {
       index =
           module_builder_->AddImport(function_info->import->function_name, sig);
-      function_info->import->cache[sig] = index;
+      function_info->import->cache[*sig] = index;
       function_info->function_defined = true;
     }
     current_function_builder_->AddAsmWasmOffset(call_pos, to_number_pos);
diff --git a/deps/v8/src/asmjs/asm-parser.h b/deps/v8/src/asmjs/asm-parser.h
index bddb8c62e90b12..ac8a05a0284cc9 100644
--- a/deps/v8/src/asmjs/asm-parser.h
+++ b/deps/v8/src/asmjs/asm-parser.h
@@ -76,9 +76,16 @@ class AsmJsParser {
   };
   // clang-format on
 
+  // A single import in asm.js can require multiple imports in wasm, if the
+  // function is used with different signatures. {cache} keeps the wasm
+  // imports for the single asm.js import of name {function_name}.
   struct FunctionImportInfo {
     Vector<const char> function_name;
-    WasmModuleBuilder::SignatureMap cache;
+    ZoneUnorderedMap<FunctionSig, uint32_t> cache;
+
+    // Constructor.
+    FunctionImportInfo(Vector<const char> name, Zone* zone)
+        : function_name(name), cache(zone) {}
   };
 
   struct VarInfo {
diff --git a/deps/v8/src/ast/modules.cc b/deps/v8/src/ast/modules.cc
index 065cffe93105fc..0f66ac91ecde74 100644
--- a/deps/v8/src/ast/modules.cc
+++ b/deps/v8/src/ast/modules.cc
@@ -12,6 +12,21 @@
 namespace v8 {
 namespace internal {
 
+bool ModuleDescriptor::AstRawStringComparer::operator()(
+    const AstRawString* lhs, const AstRawString* rhs) const {
+  // Fast path for equal pointers: a pointer is not strictly less than itself.
+  if (lhs == rhs) return false;
+
+  // Order by contents (ordering by hash is unstable across runs).
+  if (lhs->is_one_byte() != rhs->is_one_byte()) {
+    return lhs->is_one_byte();
+  }
+  if (lhs->byte_length() != rhs->byte_length()) {
+    return lhs->byte_length() < rhs->byte_length();
+  }
+  return memcmp(lhs->raw_data(), rhs->raw_data(), lhs->byte_length()) < 0;
+}
+
 void ModuleDescriptor::AddImport(const AstRawString* import_name,
                                  const AstRawString* local_name,
                                  const AstRawString* module_request,
diff --git a/deps/v8/src/ast/modules.h b/deps/v8/src/ast/modules.h
index 465eca447fd918..44e86dce42b480 100644
--- a/deps/v8/src/ast/modules.h
+++ b/deps/v8/src/ast/modules.h
@@ -124,10 +124,21 @@ class ModuleDescriptor : public ZoneObject {
     ModuleRequest(int index, int position) : index(index), position(position) {}
   };
 
+  // Custom content-based comparer for the below maps, to keep them stable
+  // across parses.
+  struct AstRawStringComparer {
+    bool operator()(const AstRawString* lhs, const AstRawString* rhs) const;
+  };
+
+  typedef ZoneMap<const AstRawString*, ModuleRequest, AstRawStringComparer>
+      ModuleRequestMap;
+  typedef ZoneMultimap<const AstRawString*, Entry*, AstRawStringComparer>
+      RegularExportMap;
+  typedef ZoneMap<const AstRawString*, Entry*, AstRawStringComparer>
+      RegularImportMap;
+
   // Module requests.
-  const ZoneMap<const AstRawString*, ModuleRequest>& module_requests() const {
-    return module_requests_;
-  }
+  const ModuleRequestMap& module_requests() const { return module_requests_; }
 
   // Namespace imports.
   const ZoneVector<const Entry*>& namespace_imports() const {
@@ -135,9 +146,7 @@ class ModuleDescriptor : public ZoneObject {
   }
 
   // All the remaining imports, indexed by local name.
-  const ZoneMap<const AstRawString*, Entry*>& regular_imports() const {
-    return regular_imports_;
-  }
+  const RegularImportMap& regular_imports() const { return regular_imports_; }
 
   // Star exports and explicitly indirect exports.
   const ZoneVector<const Entry*>& special_exports() const {
@@ -146,9 +155,7 @@ class ModuleDescriptor : public ZoneObject {
 
   // All the remaining exports, indexed by local name.
   // After canonicalization (see Validate), these are exactly the local exports.
-  const ZoneMultimap<const AstRawString*, Entry*>& regular_exports() const {
-    return regular_exports_;
-  }
+  const RegularExportMap& regular_exports() const { return regular_exports_; }
 
   void AddRegularExport(Entry* entry) {
     DCHECK_NOT_NULL(entry->export_name);
@@ -188,11 +195,11 @@ class ModuleDescriptor : public ZoneObject {
                                  Handle<ModuleInfo> module_info);
 
  private:
-  ZoneMap<const AstRawString*, ModuleRequest> module_requests_;
+  ModuleRequestMap module_requests_;
   ZoneVector<const Entry*> special_exports_;
   ZoneVector<const Entry*> namespace_imports_;
-  ZoneMultimap<const AstRawString*, Entry*> regular_exports_;
-  ZoneMap<const AstRawString*, Entry*> regular_imports_;
+  RegularExportMap regular_exports_;
+  RegularImportMap regular_imports_;
 
   // If there are multiple export entries with the same export name, return the
   // last of them (in source order).  Otherwise return nullptr.
diff --git a/deps/v8/src/ast/scopes.cc b/deps/v8/src/ast/scopes.cc
index 6793edf0c0566f..18db88f9501445 100644
--- a/deps/v8/src/ast/scopes.cc
+++ b/deps/v8/src/ast/scopes.cc
@@ -17,6 +17,7 @@
 #include "src/objects/scope-info.h"
 #include "src/parsing/parse-info.h"
 #include "src/parsing/preparsed-scope-data.h"
+#include "src/zone/zone-list-inl.h"
 
 namespace v8 {
 namespace internal {
@@ -189,6 +190,13 @@ DeclarationScope::DeclarationScope(Zone* zone, Scope* outer_scope,
   SetDefaults();
 }
 
+bool DeclarationScope::IsDeclaredParameter(const AstRawString* name) {
+  // If IsSimpleParameterList is false, duplicate parameters are not allowed,
+  // however `arguments` may be allowed if function is not strict code. Thus,
+  // the assumptions explained above do not hold.
+  return params_.Contains(variables_.Lookup(name));
+}
+
 ModuleScope::ModuleScope(DeclarationScope* script_scope,
                          AstValueFactory* ast_value_factory)
     : DeclarationScope(ast_value_factory->zone(), script_scope, MODULE_SCOPE,
diff --git a/deps/v8/src/ast/scopes.h b/deps/v8/src/ast/scopes.h
index dd1220077e3ad0..5618adee9ebce4 100644
--- a/deps/v8/src/ast/scopes.h
+++ b/deps/v8/src/ast/scopes.h
@@ -646,12 +646,7 @@ class V8_EXPORT_PRIVATE DeclarationScope : public Scope {
   // Creates a script scope.
   DeclarationScope(Zone* zone, AstValueFactory* ast_value_factory);
 
-  bool IsDeclaredParameter(const AstRawString* name) {
-    // If IsSimpleParameterList is false, duplicate parameters are not allowed,
-    // however `arguments` may be allowed if function is not strict code. Thus,
-    // the assumptions explained above do not hold.
-    return params_.Contains(variables_.Lookup(name));
-  }
+  bool IsDeclaredParameter(const AstRawString* name);
 
   FunctionKind function_kind() const { return function_kind_; }
 
diff --git a/deps/v8/src/base/atomic-utils.h b/deps/v8/src/base/atomic-utils.h
index 7787e4ff5279d3..d81c537e577455 100644
--- a/deps/v8/src/base/atomic-utils.h
+++ b/deps/v8/src/base/atomic-utils.h
@@ -15,46 +15,6 @@ namespace v8 {
 namespace base {
 
 // Deprecated. Use std::atomic<T> for new code.
-template <class T>
-class AtomicNumber {
- public:
-  AtomicNumber() : value_(0) {}
-  explicit AtomicNumber(T initial) : value_(initial) {}
-
-  // Returns the value after incrementing.
-  V8_INLINE T Increment(T increment) {
-    return static_cast<T>(base::Barrier_AtomicIncrement(
-        &value_, static_cast<base::AtomicWord>(increment)));
-  }
-
-  // Returns the value after decrementing.
-  V8_INLINE T Decrement(T decrement) {
-    return static_cast<T>(base::Barrier_AtomicIncrement(
-        &value_, -static_cast<base::AtomicWord>(decrement)));
-  }
-
-  V8_INLINE T Value() const {
-    return static_cast<T>(base::Acquire_Load(&value_));
-  }
-
-  V8_INLINE void SetValue(T new_value) {
-    base::Release_Store(&value_, static_cast<base::AtomicWord>(new_value));
-  }
-
-  V8_INLINE T operator=(T value) {
-    SetValue(value);
-    return value;
-  }
-
-  V8_INLINE T operator+=(T value) { return Increment(value); }
-  V8_INLINE T operator-=(T value) { return Decrement(value); }
-
- private:
-  STATIC_ASSERT(sizeof(T) <= sizeof(base::AtomicWord));
-
-  base::AtomicWord value_;
-};
-
 // Flag using T atomically. Also accepts void* as T.
 template <typename T>
 class AtomicValue {
diff --git a/deps/v8/src/base/platform/platform-posix.cc b/deps/v8/src/base/platform/platform-posix.cc
index d21107d6f785f6..cf7f3ec9bb1628 100644
--- a/deps/v8/src/base/platform/platform-posix.cc
+++ b/deps/v8/src/base/platform/platform-posix.cc
@@ -156,6 +156,8 @@ int ReclaimInaccessibleMemory(void* address, size_t size) {
 #else
   int ret = madvise(address, size, MADV_FREE);
 #endif
+  if (ret != 0 && errno == ENOSYS)
+    return 0;  // madvise is not available on all systems.
   if (ret != 0 && errno == EINVAL) {
     // MADV_FREE only works on Linux 4.5+ . If request failed, retry with older
     // MADV_DONTNEED . Note that MADV_FREE being defined at compile time doesn't
diff --git a/deps/v8/src/bootstrapper.cc b/deps/v8/src/bootstrapper.cc
index 4e793ecb618dff..97aca0dcfabfad 100644
--- a/deps/v8/src/bootstrapper.cc
+++ b/deps/v8/src/bootstrapper.cc
@@ -5452,10 +5452,11 @@ void Genesis::TransferNamedProperties(Handle<JSObject> from,
         Handle<NameDictionary>(from->property_dictionary(), isolate());
     Handle<FixedArray> key_indices =
         NameDictionary::IterationIndices(properties);
+    ReadOnlyRoots roots(isolate());
     for (int i = 0; i < key_indices->length(); i++) {
       int key_index = Smi::ToInt(key_indices->get(i));
       Object* raw_key = properties->KeyAt(key_index);
-      DCHECK(properties->IsKey(isolate(), raw_key));
+      DCHECK(properties->IsKey(roots, raw_key));
       DCHECK(raw_key->IsName());
       // If the property is already there we skip it.
       Handle<Name> key(Name::cast(raw_key), isolate());
diff --git a/deps/v8/src/builtins/builtins-array.cc b/deps/v8/src/builtins/builtins-array.cc
index ce84f6bc38eb07..460c8aa801bc60 100644
--- a/deps/v8/src/builtins/builtins-array.cc
+++ b/deps/v8/src/builtins/builtins-array.cc
@@ -651,9 +651,10 @@ uint32_t EstimateElementCount(Isolate* isolate, Handle<JSArray> array) {
     case DICTIONARY_ELEMENTS: {
       NumberDictionary* dictionary = NumberDictionary::cast(array->elements());
       int capacity = dictionary->Capacity();
+      ReadOnlyRoots roots(isolate);
       for (int i = 0; i < capacity; i++) {
         Object* key = dictionary->KeyAt(i);
-        if (dictionary->IsKey(isolate, key)) {
+        if (dictionary->IsKey(roots, key)) {
           element_count++;
         }
       }
@@ -718,9 +719,10 @@ void CollectElementIndices(Isolate* isolate, Handle<JSObject> object,
       DisallowHeapAllocation no_gc;
       NumberDictionary* dict = NumberDictionary::cast(object->elements());
       uint32_t capacity = dict->Capacity();
+      ReadOnlyRoots roots(isolate);
       FOR_WITH_HANDLE_SCOPE(isolate, uint32_t, j = 0, j, j < capacity, j++, {
         Object* k = dict->KeyAt(j);
-        if (!dict->IsKey(isolate, k)) continue;
+        if (!dict->IsKey(roots, k)) continue;
         DCHECK(k->IsNumber());
         uint32_t index = static_cast<uint32_t>(k->Number());
         if (index < range) {
diff --git a/deps/v8/src/builtins/builtins-internal-gen.cc b/deps/v8/src/builtins/builtins-internal-gen.cc
index 658ab03d062eeb..c2a16e35707854 100644
--- a/deps/v8/src/builtins/builtins-internal-gen.cc
+++ b/deps/v8/src/builtins/builtins-internal-gen.cc
@@ -228,48 +228,6 @@ class RecordWriteCodeStubAssembler : public CodeStubAssembler {
                         IntPtrConstant(0));
   }
 
-  void GotoIfNotBlack(Node* object, Label* not_black) {
-    Label exit(this);
-    Label* black = &exit;
-
-    DCHECK_EQ(strcmp(Marking::kBlackBitPattern, "11"), 0);
-
-    Node* cell;
-    Node* mask;
-
-    GetMarkBit(object, &cell, &mask);
-    mask = TruncateIntPtrToInt32(mask);
-
-    Node* bits = Load(MachineType::Int32(), cell);
-    Node* bit_0 = Word32And(bits, mask);
-
-    GotoIf(Word32Equal(bit_0, Int32Constant(0)), not_black);
-
-    mask = Word32Shl(mask, Int32Constant(1));
-
-    Label word_boundary(this), in_word(this);
-
-    // If mask becomes zero, we know mask was `1 << 31`, i.e., the bit is on
-    // word boundary. Otherwise, the bit is within the word.
-    Branch(Word32Equal(mask, Int32Constant(0)), &word_boundary, &in_word);
-
-    BIND(&word_boundary);
-    {
-      Node* bit_1 = Word32And(
-          Load(MachineType::Int32(), IntPtrAdd(cell, IntPtrConstant(4))),
-          Int32Constant(1));
-      Branch(Word32Equal(bit_1, Int32Constant(0)), not_black, black);
-    }
-
-    BIND(&in_word);
-    {
-      Branch(Word32Equal(Word32And(bits, mask), Int32Constant(0)), not_black,
-             black);
-    }
-
-    BIND(&exit);
-  }
-
   Node* IsWhite(Node* object) {
     DCHECK_EQ(strcmp(Marking::kWhiteBitPattern, "00"), 0);
     Node* cell;
@@ -444,10 +402,6 @@ TF_BUILTIN(RecordWrite, RecordWriteCodeStubAssembler) {
   {
     Label call_incremental_wb(this);
 
-#ifndef V8_CONCURRENT_MARKING
-    GotoIfNotBlack(object, &exit);
-#endif
-
     // There are two cases we need to call incremental write barrier.
     // 1) value_is_white
     GotoIf(IsWhite(value), &call_incremental_wb);
diff --git a/deps/v8/src/cancelable-task.h b/deps/v8/src/cancelable-task.h
index a5cb8ad9ca7b56..64ca6814166b30 100644
--- a/deps/v8/src/cancelable-task.h
+++ b/deps/v8/src/cancelable-task.h
@@ -96,7 +96,7 @@ class V8_EXPORT_PRIVATE Cancelable {
  protected:
   bool TryRun() { return status_.TrySetValue(kWaiting, kRunning); }
   bool IsRunning() { return status_.Value() == kRunning; }
-  intptr_t CancelAttempts() { return cancel_counter_.Value(); }
+  intptr_t CancelAttempts() { return cancel_counter_; }
 
  private:
   // Identifies the state a cancelable task is in:
@@ -116,7 +116,7 @@ class V8_EXPORT_PRIVATE Cancelable {
     if (status_.TrySetValue(kWaiting, kCanceled)) {
       return true;
     }
-    cancel_counter_.Increment(1);
+    cancel_counter_++;
     return false;
   }
 
@@ -127,7 +127,7 @@ class V8_EXPORT_PRIVATE Cancelable {
   // The counter is incremented for failing tries to cancel a task. This can be
   // used by the task itself as an indication how often external entities tried
   // to abort it.
-  base::AtomicNumber<intptr_t> cancel_counter_;
+  std::atomic<intptr_t> cancel_counter_;
 
   friend class CancelableTaskManager;
 
diff --git a/deps/v8/src/code-stub-assembler.cc b/deps/v8/src/code-stub-assembler.cc
index c0da2333958fb0..bc8a83628811c0 100644
--- a/deps/v8/src/code-stub-assembler.cc
+++ b/deps/v8/src/code-stub-assembler.cc
@@ -7218,8 +7218,11 @@ void CodeStubAssembler::TryInternalizeString(
   CSA_SLOW_ASSERT(this, IsString(string));
   Node* function =
       ExternalConstant(ExternalReference::try_internalize_string_function());
-  Node* result = CallCFunction1(MachineType::AnyTagged(),
-                                MachineType::AnyTagged(), function, string);
+  Node* const isolate_ptr =
+      ExternalConstant(ExternalReference::isolate_address(isolate()));
+  Node* result =
+      CallCFunction2(MachineType::AnyTagged(), MachineType::Pointer(),
+                     MachineType::AnyTagged(), function, isolate_ptr, string);
   Label internalized(this);
   GotoIf(TaggedIsNotSmi(result), &internalized);
   Node* word_result = SmiUntag(result);
diff --git a/deps/v8/src/code-stub-assembler.h b/deps/v8/src/code-stub-assembler.h
index 2260b09f1be2f0..d7be1d5bd5162e 100644
--- a/deps/v8/src/code-stub-assembler.h
+++ b/deps/v8/src/code-stub-assembler.h
@@ -34,57 +34,58 @@ enum class PrimitiveType { kBoolean, kNumber, kString, kSymbol };
     TypedArraySpeciesProtector)                                            \
   V(StoreHandler0Map, store_handler0_map, StoreHandler0Map)
 
-#define HEAP_IMMUTABLE_IMMOVABLE_OBJECT_LIST(V)                             \
-  V(AccessorInfoMap, accessor_info_map, AccessorInfoMap)                    \
-  V(AccessorPairMap, accessor_pair_map, AccessorPairMap)                    \
-  V(AllocationSiteWithWeakNextMap, allocation_site_map, AllocationSiteMap)  \
-  V(AllocationSiteWithoutWeakNextMap, allocation_site_without_weaknext_map, \
-    AllocationSiteWithoutWeakNextMap)                                       \
-  V(BooleanMap, boolean_map, BooleanMap)                                    \
-  V(CodeMap, code_map, CodeMap)                                             \
-  V(EmptyFixedArray, empty_fixed_array, EmptyFixedArray)                    \
-  V(EmptySlowElementDictionary, empty_slow_element_dictionary,              \
-    EmptySlowElementDictionary)                                             \
-  V(empty_string, empty_string, EmptyString)                                \
-  V(EmptyWeakCell, empty_weak_cell, EmptyWeakCell)                          \
-  V(FalseValue, false_value, False)                                         \
-  V(FeedbackVectorMap, feedback_vector_map, FeedbackVectorMap)              \
-  V(FixedArrayMap, fixed_array_map, FixedArrayMap)                          \
-  V(FixedCOWArrayMap, fixed_cow_array_map, FixedCOWArrayMap)                \
-  V(FixedDoubleArrayMap, fixed_double_array_map, FixedDoubleArrayMap)       \
-  V(FunctionTemplateInfoMap, function_template_info_map,                    \
-    FunctionTemplateInfoMap)                                                \
-  V(GlobalPropertyCellMap, global_property_cell_map, PropertyCellMap)       \
-  V(has_instance_symbol, has_instance_symbol, HasInstanceSymbol)            \
-  V(HeapNumberMap, heap_number_map, HeapNumberMap)                          \
-  V(iterator_symbol, iterator_symbol, IteratorSymbol)                       \
-  V(length_string, length_string, LengthString)                             \
-  V(ManyClosuresCellMap, many_closures_cell_map, ManyClosuresCellMap)       \
-  V(MetaMap, meta_map, MetaMap)                                             \
-  V(MinusZeroValue, minus_zero_value, MinusZero)                            \
-  V(MutableHeapNumberMap, mutable_heap_number_map, MutableHeapNumberMap)    \
-  V(NanValue, nan_value, Nan)                                               \
-  V(NoClosuresCellMap, no_closures_cell_map, NoClosuresCellMap)             \
-  V(NullValue, null_value, Null)                                            \
-  V(OneClosureCellMap, one_closure_cell_map, OneClosureCellMap)             \
-  V(prototype_string, prototype_string, PrototypeString)                    \
-  V(SharedFunctionInfoMap, shared_function_info_map, SharedFunctionInfoMap) \
-  V(SymbolMap, symbol_map, SymbolMap)                                       \
-  V(TheHoleValue, the_hole_value, TheHole)                                  \
-  V(TransitionArrayMap, transition_array_map, TransitionArrayMap)           \
-  V(TrueValue, true_value, True)                                            \
-  V(Tuple2Map, tuple2_map, Tuple2Map)                                       \
-  V(Tuple3Map, tuple3_map, Tuple3Map)                                       \
-  V(ArrayBoilerplateDescriptionMap, array_boilerplate_description_map,      \
-    ArrayBoilerplateDescriptionMap)                                         \
-  V(UncompiledDataWithoutPreParsedScopeMap,                                 \
-    uncompiled_data_without_pre_parsed_scope_map,                           \
-    UncompiledDataWithoutPreParsedScopeMap)                                 \
-  V(UncompiledDataWithPreParsedScopeMap,                                    \
-    uncompiled_data_with_pre_parsed_scope_map,                              \
-    UncompiledDataWithPreParsedScopeMap)                                    \
-  V(UndefinedValue, undefined_value, Undefined)                             \
-  V(WeakCellMap, weak_cell_map, WeakCellMap)                                \
+#define HEAP_IMMUTABLE_IMMOVABLE_OBJECT_LIST(V)                              \
+  V(AccessorInfoMap, accessor_info_map, AccessorInfoMap)                     \
+  V(AccessorPairMap, accessor_pair_map, AccessorPairMap)                     \
+  V(AllocationSiteWithWeakNextMap, allocation_site_map, AllocationSiteMap)   \
+  V(AllocationSiteWithoutWeakNextMap, allocation_site_without_weaknext_map,  \
+    AllocationSiteWithoutWeakNextMap)                                        \
+  V(BooleanMap, boolean_map, BooleanMap)                                     \
+  V(CodeMap, code_map, CodeMap)                                              \
+  V(EmptyFixedArray, empty_fixed_array, EmptyFixedArray)                     \
+  V(EmptySlowElementDictionary, empty_slow_element_dictionary,               \
+    EmptySlowElementDictionary)                                              \
+  V(empty_string, empty_string, EmptyString)                                 \
+  V(EmptyWeakCell, empty_weak_cell, EmptyWeakCell)                           \
+  V(FalseValue, false_value, False)                                          \
+  V(FeedbackVectorMap, feedback_vector_map, FeedbackVectorMap)               \
+  V(FixedArrayMap, fixed_array_map, FixedArrayMap)                           \
+  V(FixedCOWArrayMap, fixed_cow_array_map, FixedCOWArrayMap)                 \
+  V(FixedDoubleArrayMap, fixed_double_array_map, FixedDoubleArrayMap)        \
+  V(FunctionTemplateInfoMap, function_template_info_map,                     \
+    FunctionTemplateInfoMap)                                                 \
+  V(GlobalPropertyCellMap, global_property_cell_map, PropertyCellMap)        \
+  V(has_instance_symbol, has_instance_symbol, HasInstanceSymbol)             \
+  V(HeapNumberMap, heap_number_map, HeapNumberMap)                           \
+  V(iterator_symbol, iterator_symbol, IteratorSymbol)                        \
+  V(length_string, length_string, LengthString)                              \
+  V(ManyClosuresCellMap, many_closures_cell_map, ManyClosuresCellMap)        \
+  V(MetaMap, meta_map, MetaMap)                                              \
+  V(MinusZeroValue, minus_zero_value, MinusZero)                             \
+  V(MutableHeapNumberMap, mutable_heap_number_map, MutableHeapNumberMap)     \
+  V(NanValue, nan_value, Nan)                                                \
+  V(NoClosuresCellMap, no_closures_cell_map, NoClosuresCellMap)              \
+  V(NullValue, null_value, Null)                                             \
+  V(OneClosureCellMap, one_closure_cell_map, OneClosureCellMap)              \
+  V(PreParsedScopeDataMap, pre_parsed_scope_data_map, PreParsedScopeDataMap) \
+  V(prototype_string, prototype_string, PrototypeString)                     \
+  V(SharedFunctionInfoMap, shared_function_info_map, SharedFunctionInfoMap)  \
+  V(SymbolMap, symbol_map, SymbolMap)                                        \
+  V(TheHoleValue, the_hole_value, TheHole)                                   \
+  V(TransitionArrayMap, transition_array_map, TransitionArrayMap)            \
+  V(TrueValue, true_value, True)                                             \
+  V(Tuple2Map, tuple2_map, Tuple2Map)                                        \
+  V(Tuple3Map, tuple3_map, Tuple3Map)                                        \
+  V(ArrayBoilerplateDescriptionMap, array_boilerplate_description_map,       \
+    ArrayBoilerplateDescriptionMap)                                          \
+  V(UncompiledDataWithoutPreParsedScopeMap,                                  \
+    uncompiled_data_without_pre_parsed_scope_map,                            \
+    UncompiledDataWithoutPreParsedScopeMap)                                  \
+  V(UncompiledDataWithPreParsedScopeMap,                                     \
+    uncompiled_data_with_pre_parsed_scope_map,                               \
+    UncompiledDataWithPreParsedScopeMap)                                     \
+  V(UndefinedValue, undefined_value, Undefined)                              \
+  V(WeakCellMap, weak_cell_map, WeakCellMap)                                 \
   V(WeakFixedArrayMap, weak_fixed_array_map, WeakFixedArrayMap)
 
 #define HEAP_IMMOVABLE_OBJECT_LIST(V)   \
diff --git a/deps/v8/src/code-stubs.cc b/deps/v8/src/code-stubs.cc
index 8bb1cb05b04661..f00120c369eebf 100644
--- a/deps/v8/src/code-stubs.cc
+++ b/deps/v8/src/code-stubs.cc
@@ -98,7 +98,7 @@ void CodeStub::DeleteStubFromCacheForTesting() {
   Handle<SimpleNumberDictionary> dict(heap->code_stubs(), isolate());
   int entry = dict->FindEntry(GetKey());
   DCHECK_NE(SimpleNumberDictionary::kNotFound, entry);
-  dict = SimpleNumberDictionary::DeleteEntry(dict, entry);
+  dict = SimpleNumberDictionary::DeleteEntry(isolate(), dict, entry);
   heap->SetRootCodeStubs(*dict);
 }
 
diff --git a/deps/v8/src/compilation-cache.cc b/deps/v8/src/compilation-cache.cc
index 5af2cbc91929bf..61b83b1a1853b2 100644
--- a/deps/v8/src/compilation-cache.cc
+++ b/deps/v8/src/compilation-cache.cc
@@ -248,7 +248,8 @@ void CompilationCacheRegExp::Put(Handle<String> source,
                                  Handle<FixedArray> data) {
   HandleScope scope(isolate());
   Handle<CompilationCacheTable> table = GetFirstTable();
-  SetFirstTable(CompilationCacheTable::PutRegExp(table, source, flags, data));
+  SetFirstTable(
+      CompilationCacheTable::PutRegExp(isolate(), table, source, flags, data));
 }
 
 void CompilationCache::Remove(Handle<SharedFunctionInfo> function_info) {
diff --git a/deps/v8/src/compiler/access-info.cc b/deps/v8/src/compiler/access-info.cc
index 3aae014e917e48..2c8ebfd76094b6 100644
--- a/deps/v8/src/compiler/access-info.cc
+++ b/deps/v8/src/compiler/access-info.cc
@@ -434,7 +434,8 @@ bool AccessInfoFactory::ComputePropertyAccessInfo(
                 isolate());
             Handle<Cell> cell(
                 Cell::cast(module_namespace->module()->exports()->Lookup(
-                    isolate(), name, Smi::ToInt(name->GetHash()))),
+                    ReadOnlyRoots(isolate()), name,
+                    Smi::ToInt(name->GetHash()))),
                 isolate());
             if (cell->value()->IsTheHole(isolate())) {
               // This module has not been fully initialized yet.
diff --git a/deps/v8/src/compiler/code-assembler.cc b/deps/v8/src/compiler/code-assembler.cc
index 7a8f6aef75f521..0b77d100723312 100644
--- a/deps/v8/src/compiler/code-assembler.cc
+++ b/deps/v8/src/compiler/code-assembler.cc
@@ -1709,7 +1709,7 @@ Smi* CheckObjectType(Isolate* isolate, Object* value, Smi* type,
 #undef TYPE_STRUCT_CASE
   }
   std::stringstream value_description;
-  value->Print(isolate, value_description);
+  value->Print(value_description);
   V8_Fatal(__FILE__, __LINE__,
            "Type cast failed in %s\n"
            "  Expected %s but found %s",
diff --git a/deps/v8/src/compiler/effect-control-linearizer.cc b/deps/v8/src/compiler/effect-control-linearizer.cc
index a67fa6ab903983..9a3a2930555e9d 100644
--- a/deps/v8/src/compiler/effect-control-linearizer.cc
+++ b/deps/v8/src/compiler/effect-control-linearizer.cc
@@ -3372,15 +3372,19 @@ void EffectControlLinearizer::LowerCheckEqualsInternalizedString(
           frame_state);
 
       // Try to find the {val} in the string table.
-      MachineSignature::Builder builder(graph()->zone(), 1, 1);
+      MachineSignature::Builder builder(graph()->zone(), 1, 2);
       builder.AddReturn(MachineType::AnyTagged());
+      builder.AddParam(MachineType::Pointer());
       builder.AddParam(MachineType::AnyTagged());
       Node* try_internalize_string_function = __ ExternalConstant(
           ExternalReference::try_internalize_string_function());
+      Node* const isolate_ptr =
+          __ ExternalConstant(ExternalReference::isolate_address(isolate()));
       auto call_descriptor =
           Linkage::GetSimplifiedCDescriptor(graph()->zone(), builder.Build());
-      Node* val_internalized = __ Call(common()->Call(call_descriptor),
-                                       try_internalize_string_function, val);
+      Node* val_internalized =
+          __ Call(common()->Call(call_descriptor),
+                  try_internalize_string_function, isolate_ptr, val);
 
       // Now see if the results match.
       __ DeoptimizeIfNot(DeoptimizeReason::kWrongName, VectorSlotPair(),
diff --git a/deps/v8/src/compiler/js-heap-broker.cc b/deps/v8/src/compiler/js-heap-broker.cc
index 7133bb0b8d9bc9..6262adc9df7c74 100644
--- a/deps/v8/src/compiler/js-heap-broker.cc
+++ b/deps/v8/src/compiler/js-heap-broker.cc
@@ -7,6 +7,7 @@
 #include "src/compiler/compilation-dependencies.h"
 #include "src/objects-inl.h"
 #include "src/objects/js-regexp-inl.h"
+#include "src/objects/module-inl.h"
 
 namespace v8 {
 namespace internal {
@@ -129,6 +130,16 @@ base::Optional<MapRef> HeapObjectRef::TryGetObjectCreateMap(
   }
 }
 
+bool HeapObjectRef::IsSeqString() const {
+  AllowHandleDereference allow_handle_dereference;
+  return object<HeapObject>()->IsSeqString();
+}
+
+bool HeapObjectRef::IsExternalString() const {
+  AllowHandleDereference allow_handle_dereference;
+  return object<HeapObject>()->IsExternalString();
+}
+
 bool JSFunctionRef::HasBuiltinFunctionId() const {
   AllowHandleDereference allow_handle_dereference;
   return object<JSFunction>()->shared()->HasBuiltinFunctionId();
@@ -178,6 +189,20 @@ MapRef JSFunctionRef::initial_map(const JSHeapBroker* broker) const {
   return MapRef(handle(object<JSFunction>()->initial_map(), broker->isolate()));
 }
 
+SharedFunctionInfoRef JSFunctionRef::shared(const JSHeapBroker* broker) const {
+  AllowHandleAllocation handle_allocation;
+  AllowHandleDereference allow_handle_dereference;
+  return SharedFunctionInfoRef(
+      handle(object<JSFunction>()->shared(), broker->isolate()));
+}
+
+JSGlobalProxyRef JSFunctionRef::global_proxy(const JSHeapBroker* broker) const {
+  AllowHandleAllocation handle_allocation;
+  AllowHandleDereference allow_handle_dereference;
+  return JSGlobalProxyRef(
+      handle(object<JSFunction>()->global_proxy(), broker->isolate()));
+}
+
 base::Optional<ScriptContextTableRef::LookupResult>
 ScriptContextTableRef::lookup(const NameRef& name) const {
   AllowHandleAllocation handle_allocation;
@@ -550,6 +575,41 @@ bool SharedFunctionInfoRef::has_duplicate_parameters() const {
   return object<SharedFunctionInfo>()->has_duplicate_parameters();
 }
 
+FunctionKind SharedFunctionInfoRef::kind() const {
+  AllowHandleDereference allow_handle_dereference;
+  return object<SharedFunctionInfo>()->kind();
+}
+
+LanguageMode SharedFunctionInfoRef::language_mode() {
+  AllowHandleDereference allow_handle_dereference;
+  return object<SharedFunctionInfo>()->language_mode();
+}
+
+bool SharedFunctionInfoRef::native() const {
+  AllowHandleDereference allow_handle_dereference;
+  return object<SharedFunctionInfo>()->native();
+}
+
+bool SharedFunctionInfoRef::HasBreakInfo() const {
+  AllowHandleDereference allow_handle_dereference;
+  return object<SharedFunctionInfo>()->HasBreakInfo();
+}
+
+bool SharedFunctionInfoRef::HasBuiltinId() const {
+  AllowHandleDereference allow_handle_dereference;
+  return object<SharedFunctionInfo>()->HasBuiltinId();
+}
+
+int SharedFunctionInfoRef::builtin_id() const {
+  AllowHandleDereference allow_handle_dereference;
+  return object<SharedFunctionInfo>()->builtin_id();
+}
+
+bool SharedFunctionInfoRef::construct_as_builtin() const {
+  AllowHandleDereference allow_handle_dereference;
+  return object<SharedFunctionInfo>()->construct_as_builtin();
+}
+
 MapRef NativeContextRef::fast_aliased_arguments_map(
     const JSHeapBroker* broker) const {
   AllowHandleAllocation handle_allocation;
@@ -643,6 +703,14 @@ bool ObjectRef::BooleanValue(const JSHeapBroker* broker) {
   return object<Object>()->BooleanValue(broker->isolate());
 }
 
+CellRef ModuleRef::GetCell(const JSHeapBroker* broker, int cell_index) {
+  AllowHandleAllocation handle_allocation;
+  AllowHandleDereference allow_handle_dereference;
+
+  return CellRef(
+      handle(object<Module>()->GetCell(cell_index), broker->isolate()));
+}
+
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/src/compiler/js-heap-broker.h b/deps/v8/src/compiler/js-heap-broker.h
index b1faee0ed25406..8caa822b38a35a 100644
--- a/deps/v8/src/compiler/js-heap-broker.h
+++ b/deps/v8/src/compiler/js-heap-broker.h
@@ -61,6 +61,8 @@ class HeapObjectType {
 
 #define HEAP_BROKER_OBJECT_LIST(V) \
   V(AllocationSite)                \
+  V(Cell)                          \
+  V(Code)                          \
   V(Context)                       \
   V(FeedbackVector)                \
   V(FixedArray)                    \
@@ -71,9 +73,11 @@ class HeapObjectType {
   V(InternalizedString)            \
   V(JSArray)                       \
   V(JSFunction)                    \
+  V(JSGlobalProxy)                 \
   V(JSObject)                      \
   V(JSRegExp)                      \
   V(Map)                           \
+  V(Module)                        \
   V(MutableHeapNumber)             \
   V(Name)                          \
   V(NativeContext)                 \
@@ -128,6 +132,8 @@ class HeapObjectRef : public ObjectRef {
   MapRef map(const JSHeapBroker* broker) const;
   base::Optional<MapRef> TryGetObjectCreateMap(
       const JSHeapBroker* broker) const;
+  bool IsSeqString() const;
+  bool IsExternalString() const;
 };
 
 class JSObjectRef : public HeapObjectRef {
@@ -156,6 +162,8 @@ class JSFunctionRef : public JSObjectRef {
   MapRef DependOnInitialMap(const JSHeapBroker* broker,
                             CompilationDependencies* dependencies) const;
   int GetInstanceSizeWithFinishedSlackTracking() const;
+  SharedFunctionInfoRef shared(const JSHeapBroker* broker) const;
+  JSGlobalProxyRef global_proxy(const JSHeapBroker* broker) const;
 };
 
 class JSRegExpRef : public JSObjectRef {
@@ -317,6 +325,13 @@ class SharedFunctionInfoRef : public HeapObjectRef {
   int internal_formal_parameter_count() const;
   bool has_duplicate_parameters() const;
   int function_map_index() const;
+  FunctionKind kind() const;
+  LanguageMode language_mode();
+  bool native() const;
+  bool HasBreakInfo() const;
+  bool HasBuiltinId() const;
+  int builtin_id() const;
+  bool construct_as_builtin() const;
 };
 
 class StringRef : public NameRef {
@@ -327,6 +342,28 @@ class StringRef : public NameRef {
   uint16_t GetFirstChar();
 };
 
+class ModuleRef : public HeapObjectRef {
+ public:
+  explicit ModuleRef(Handle<Object> object) : HeapObjectRef(object) {}
+
+  CellRef GetCell(const JSHeapBroker* broker, int cell_index);
+};
+
+class CellRef : public HeapObjectRef {
+ public:
+  explicit CellRef(Handle<Object> object) : HeapObjectRef(object) {}
+};
+
+class JSGlobalProxyRef : public JSObjectRef {
+ public:
+  explicit JSGlobalProxyRef(Handle<Object> object) : JSObjectRef(object) {}
+};
+
+class CodeRef : public HeapObjectRef {
+ public:
+  explicit CodeRef(Handle<Object> object) : HeapObjectRef(object) {}
+};
+
 class InternalizedStringRef : public StringRef {
  public:
   using StringRef::StringRef;
diff --git a/deps/v8/src/compiler/js-typed-lowering.cc b/deps/v8/src/compiler/js-typed-lowering.cc
index 9f957b7b82864f..0063d72f7a536d 100644
--- a/deps/v8/src/compiler/js-typed-lowering.cc
+++ b/deps/v8/src/compiler/js-typed-lowering.cc
@@ -93,19 +93,19 @@ class JSBinopReduction final {
     if (BothInputsAre(Type::String()) ||
         BinaryOperationHintOf(node_->op()) == BinaryOperationHint::kString) {
       HeapObjectBinopMatcher m(node_);
-      if (m.right().HasValue() && m.right().Value()->IsString()) {
-        Handle<String> right_string = Handle<String>::cast(m.right().Value());
-        if (right_string->length() >= ConsString::kMinLength) return true;
+      if (m.right().HasValue() && m.right().Ref().IsString()) {
+        StringRef right_string(m.right().Value());
+        if (right_string.length() >= ConsString::kMinLength) return true;
       }
-      if (m.left().HasValue() && m.left().Value()->IsString()) {
-        Handle<String> left_string = Handle<String>::cast(m.left().Value());
-        if (left_string->length() >= ConsString::kMinLength) {
+      if (m.left().HasValue() && m.left().Ref().IsString()) {
+        StringRef left_string(m.left().Value());
+        if (left_string.length() >= ConsString::kMinLength) {
           // The invariant for ConsString requires the left hand side to be
           // a sequential or external string if the right hand side is the
           // empty string. Since we don't know anything about the right hand
           // side here, we must ensure that the left hand side satisfy the
           // constraints independent of the right hand side.
-          return left_string->IsSeqString() || left_string->IsExternalString();
+          return left_string.IsSeqString() || left_string.IsExternalString();
         }
       }
     }
@@ -410,6 +410,7 @@ JSTypedLowering::JSTypedLowering(Editor* editor, JSGraph* jsgraph,
                                  const JSHeapBroker* js_heap_broker, Zone* zone)
     : AdvancedReducer(editor),
       jsgraph_(jsgraph),
+      js_heap_broker_(js_heap_broker),
       empty_string_type_(Type::HeapConstant(
           js_heap_broker, factory()->empty_string(), graph()->zone())),
       pointer_comparable_type_(
@@ -531,14 +532,24 @@ Reduction JSTypedLowering::ReduceJSAdd(Node* node) {
     if (r.BothInputsAre(Type::String())) {
       HeapObjectBinopMatcher m(node);
       if (m.IsFoldable()) {
-        Handle<String> left = Handle<String>::cast(m.left().Value());
-        Handle<String> right = Handle<String>::cast(m.right().Value());
-        if (left->length() + right->length() > String::kMaxLength) {
+        StringRef left(m.left().Value());
+        StringRef right(m.right().Value());
+        if (left.length() + right.length() > String::kMaxLength) {
           // No point in trying to optimize this, as it will just throw.
           return NoChange();
         }
-        Node* value = jsgraph()->HeapConstant(
-            factory()->NewConsString(left, right).ToHandleChecked());
+        // TODO(mslekova): get rid of these allows by doing either one of:
+        // 1. remove the optimization and check if it ruins the performance
+        // 2. leave a placeholder and do the actual allocations once back on the
+        // MT
+        AllowHandleDereference allow_handle_dereference;
+        AllowHandleAllocation allow_handle_allocation;
+        AllowHeapAllocation allow_heap_allocation;
+        ObjectRef cons(
+            factory()
+                ->NewConsString(left.object<String>(), right.object<String>())
+                .ToHandleChecked());
+        Node* value = jsgraph()->Constant(js_heap_broker(), cons);
         ReplaceWithValue(node, value);
         return Replace(value);
       }
@@ -733,11 +744,11 @@ Node* JSTypedLowering::BuildGetStringLength(Node* value) {
   // TODO(bmeurer): Get rid of this hack and instead have a way to
   // express the string length in the types.
   HeapObjectMatcher m(value);
-  Node* length =
-      (m.HasValue() && m.Value()->IsString())
-          ? jsgraph()->Constant(Handle<String>::cast(m.Value())->length())
-          : graph()->NewNode(simplified()->StringLength(), value);
-  return length;
+  if (!m.HasValue() || !m.Ref().IsString()) {
+    return graph()->NewNode(simplified()->StringLength(), value);
+  }
+
+  return jsgraph()->Constant(m.Ref().AsString().length());
 }
 
 Reduction JSTypedLowering::ReduceSpeculativeNumberComparison(Node* node) {
@@ -971,19 +982,28 @@ Reduction JSTypedLowering::ReduceJSToNumberOrNumericInput(Node* input) {
   // Try constant-folding of JSToNumber/JSToNumeric with constant inputs. Here
   // we only cover cases where ToNumber and ToNumeric coincide.
   Type input_type = NodeProperties::GetType(input);
+
+  // TODO(mslekova): get rid of these allows by doing either one of:
+  // 1. remove the optimization and check if it ruins the performance
+  // 2. leave a placeholder and do the actual allocations once back on the MT
   if (input_type.Is(Type::String())) {
     HeapObjectMatcher m(input);
-    if (m.HasValue() && m.Value()->IsString()) {
-      Handle<Object> input_value = m.Value();
+    if (m.HasValue() && m.Ref().IsString()) {
+      AllowHandleDereference allow_handle_dereference;
+      AllowHandleAllocation allow_handle_allocation;
+      AllowHeapAllocation allow_heap_allocation;
+      StringRef input_value = m.Ref().AsString();
       return Replace(jsgraph()->Constant(
-          String::ToNumber(isolate(), Handle<String>::cast(input_value))));
+          String::ToNumber(isolate(), input_value.object<String>())));
     }
   }
   if (input_type.IsHeapConstant()) {
-    Handle<Object> input_value = input_type.AsHeapConstant()->Value();
-    if (input_value->IsOddball()) {
+    ObjectRef input_value = input_type.AsHeapConstant()->Ref();
+    if (input_value.oddball_type(js_heap_broker()) != OddballType::kNone) {
+      AllowHandleDereference allow_handle_dereference;
+      AllowHandleAllocation allow_handle_allocation;
       return Replace(jsgraph()->Constant(
-          Oddball::ToNumber(Handle<Oddball>::cast(input_value))));
+          Oddball::ToNumber(isolate(), input_value.object<Oddball>())));
     }
   }
   if (input_type.Is(Type::Number())) {
@@ -1052,6 +1072,13 @@ Reduction JSTypedLowering::ReduceJSToStringInput(Node* input) {
   }
   if (input_type.Is(Type::OrderedNumber()) &&
       input_type.Min() == input_type.Max()) {
+    // TODO(mslekova): get rid of these allows by doing either one of:
+    // 1. remove the optimization and check if it ruins the performance
+    // 2. allocate all the ToString's from numbers before the compilation
+    // 3. leave a placeholder and do the actual allocations once back on the MT
+    AllowHandleDereference allow_handle_dereference;
+    AllowHandleAllocation allow_handle_allocation;
+    AllowHeapAllocation allow_heap_allocation;
     // Note that we can use Type::OrderedNumber(), since
     // both 0 and -0 map to the String "0" in JavaScript.
     return Replace(jsgraph()->HeapConstant(
@@ -1142,10 +1169,10 @@ Reduction JSTypedLowering::ReduceJSLoadNamed(Node* node) {
   DCHECK_EQ(IrOpcode::kJSLoadNamed, node->opcode());
   Node* receiver = NodeProperties::GetValueInput(node, 0);
   Type receiver_type = NodeProperties::GetType(receiver);
-  Handle<Name> name = NamedAccessOf(node->op()).name();
+  NameRef name(NamedAccessOf(node->op()).name());
+  NameRef length_str(factory()->length_string());
   // Optimize "length" property of strings.
-  if (name.is_identical_to(factory()->length_string()) &&
-      receiver_type.Is(Type::String())) {
+  if (name.equals(length_str) && receiver_type.Is(Type::String())) {
     Node* value = graph()->NewNode(simplified()->StringLength(), receiver);
     ReplaceWithValue(node, value);
     return Replace(value);
@@ -1377,10 +1404,10 @@ Node* JSTypedLowering::BuildGetModuleCell(Node* node) {
   Type module_type = NodeProperties::GetType(module);
 
   if (module_type.IsHeapConstant()) {
-    Handle<Module> module_constant =
-        Handle<Module>::cast(module_type.AsHeapConstant()->Value());
-    Handle<Cell> cell_constant(module_constant->GetCell(cell_index), isolate());
-    return jsgraph()->HeapConstant(cell_constant);
+    ModuleRef module_constant = module_type.AsHeapConstant()->Ref().AsModule();
+    CellRef cell_constant(
+        module_constant.GetCell(js_heap_broker(), cell_index));
+    return jsgraph()->Constant(js_heap_broker(), cell_constant);
   }
 
   FieldAccess field_access;
@@ -1510,9 +1537,9 @@ void ReduceBuiltin(Isolate* isolate, JSGraph* jsgraph, Node* node,
   NodeProperties::ChangeOp(node, jsgraph->common()->Call(call_descriptor));
 }
 
-bool NeedsArgumentAdaptorFrame(Handle<SharedFunctionInfo> shared, int arity) {
+bool NeedsArgumentAdaptorFrame(SharedFunctionInfoRef shared, int arity) {
   static const int sentinel = SharedFunctionInfo::kDontAdaptArgumentsSentinel;
-  const int num_decl_parms = shared->internal_formal_parameter_count();
+  const int num_decl_parms = shared.internal_formal_parameter_count();
   return (num_decl_parms != arity && num_decl_parms != sentinel);
 }
 
@@ -1531,11 +1558,10 @@ Reduction JSTypedLowering::ReduceJSConstructForwardVarargs(Node* node) {
 
   // Check if {target} is a JSFunction.
   if (target_type.IsHeapConstant() &&
-      target_type.AsHeapConstant()->Value()->IsJSFunction()) {
+      target_type.AsHeapConstant()->Ref().IsJSFunction()) {
     // Only optimize [[Construct]] here if {function} is a Constructor.
-    Handle<JSFunction> function =
-        Handle<JSFunction>::cast(target_type.AsHeapConstant()->Value());
-    if (!function->IsConstructor()) return NoChange();
+    JSFunctionRef function = target_type.AsHeapConstant()->Ref().AsJSFunction();
+    if (!function.IsConstructor()) return NoChange();
     // Patch {node} to an indirect call via ConstructFunctionForwardVarargs.
     Callable callable = CodeFactory::ConstructFunctionForwardVarargs(isolate());
     node->RemoveInput(arity + 1);
@@ -1566,25 +1592,25 @@ Reduction JSTypedLowering::ReduceJSConstruct(Node* node) {
 
   // Check if {target} is a known JSFunction.
   if (target_type.IsHeapConstant() &&
-      target_type.AsHeapConstant()->Value()->IsJSFunction()) {
-    Handle<JSFunction> function =
-        Handle<JSFunction>::cast(target_type.AsHeapConstant()->Value());
-    Handle<SharedFunctionInfo> shared(function->shared(), isolate());
+      target_type.AsHeapConstant()->Ref().IsJSFunction()) {
+    JSFunctionRef function = target_type.AsHeapConstant()->Ref().AsJSFunction();
+    SharedFunctionInfoRef shared = function.shared(js_heap_broker());
 
     // Only optimize [[Construct]] here if {function} is a Constructor.
-    if (!function->IsConstructor()) return NoChange();
+    if (!function.IsConstructor()) return NoChange();
 
     CallDescriptor::Flags flags = CallDescriptor::kNeedsFrameState;
 
     // Patch {node} to an indirect call via the {function}s construct stub.
-    bool use_builtin_construct_stub = shared->construct_as_builtin();
+    bool use_builtin_construct_stub = shared.construct_as_builtin();
 
-    Handle<Code> code = use_builtin_construct_stub
-                            ? BUILTIN_CODE(isolate(), JSBuiltinsConstructStub)
-                            : BUILTIN_CODE(isolate(), JSConstructStubGeneric);
+    CodeRef code(use_builtin_construct_stub
+                     ? BUILTIN_CODE(isolate(), JSBuiltinsConstructStub)
+                     : BUILTIN_CODE(isolate(), JSConstructStubGeneric));
 
     node->RemoveInput(arity + 1);
-    node->InsertInput(graph()->zone(), 0, jsgraph()->HeapConstant(code));
+    node->InsertInput(graph()->zone(), 0,
+                      jsgraph()->Constant(js_heap_broker(), code));
     node->InsertInput(graph()->zone(), 2, new_target);
     node->InsertInput(graph()->zone(), 3, jsgraph()->Constant(arity));
     node->InsertInput(graph()->zone(), 4, jsgraph()->UndefinedConstant());
@@ -1649,19 +1675,18 @@ Reduction JSTypedLowering::ReduceJSCall(Node* node) {
 
   // Check if {target} is a known JSFunction.
   if (target_type.IsHeapConstant() &&
-      target_type.AsHeapConstant()->Value()->IsJSFunction()) {
-    Handle<JSFunction> function =
-        Handle<JSFunction>::cast(target_type.AsHeapConstant()->Value());
-    Handle<SharedFunctionInfo> shared(function->shared(), isolate());
+      target_type.AsHeapConstant()->Ref().IsJSFunction()) {
+    JSFunctionRef function = target_type.AsHeapConstant()->Ref().AsJSFunction();
+    SharedFunctionInfoRef shared = function.shared(js_heap_broker());
 
-    if (function->shared()->HasBreakInfo()) {
+    if (shared.HasBreakInfo()) {
       // Do not inline the call if we need to check whether to break at entry.
       return NoChange();
     }
 
     // Class constructors are callable, but [[Call]] will raise an exception.
     // See ES6 section 9.2.1 [[Call]] ( thisArgument, argumentsList ).
-    if (IsClassConstructor(shared->kind())) return NoChange();
+    if (IsClassConstructor(shared.kind())) return NoChange();
 
     // Load the context from the {target}.
     Node* context = effect = graph()->NewNode(
@@ -1670,10 +1695,10 @@ Reduction JSTypedLowering::ReduceJSCall(Node* node) {
     NodeProperties::ReplaceContextInput(node, context);
 
     // Check if we need to convert the {receiver}.
-    if (is_sloppy(shared->language_mode()) && !shared->native() &&
+    if (is_sloppy(shared.language_mode()) && !shared.native() &&
         !receiver_type.Is(Type::Receiver())) {
-      Node* global_proxy =
-          jsgraph()->HeapConstant(handle(function->global_proxy(), isolate()));
+      Node* global_proxy = jsgraph()->Constant(
+          js_heap_broker(), function.global_proxy(js_heap_broker()));
       receiver = effect =
           graph()->NewNode(simplified()->ConvertReceiver(convert_mode),
                            receiver, global_proxy, effect, control);
@@ -1697,20 +1722,20 @@ Reduction JSTypedLowering::ReduceJSCall(Node* node) {
       node->InsertInput(graph()->zone(), 3, argument_count);
       node->InsertInput(
           graph()->zone(), 4,
-          jsgraph()->Constant(shared->internal_formal_parameter_count()));
+          jsgraph()->Constant(shared.internal_formal_parameter_count()));
       NodeProperties::ChangeOp(
           node, common()->Call(Linkage::GetStubCallDescriptor(
                     graph()->zone(), callable.descriptor(), 1 + arity, flags)));
-    } else if (shared->HasBuiltinId() &&
-               Builtins::HasCppImplementation(shared->builtin_id())) {
+    } else if (shared.HasBuiltinId() &&
+               Builtins::HasCppImplementation(shared.builtin_id())) {
       // Patch {node} to a direct CEntry call.
-      ReduceBuiltin(isolate(), jsgraph(), node, shared->builtin_id(), arity,
+      ReduceBuiltin(isolate(), jsgraph(), node, shared.builtin_id(), arity,
                     flags);
-    } else if (shared->HasBuiltinId() &&
-               Builtins::KindOf(shared->builtin_id()) == Builtins::TFJ) {
+    } else if (shared.HasBuiltinId() &&
+               Builtins::KindOf(shared.builtin_id()) == Builtins::TFJ) {
       // Patch {node} to a direct code object call.
       Callable callable = Builtins::CallableFor(
-          isolate(), static_cast<Builtins::Name>(shared->builtin_id()));
+          isolate(), static_cast<Builtins::Name>(shared.builtin_id()));
       CallDescriptor::Flags flags = CallDescriptor::kNeedsFrameState;
 
       const CallInterfaceDescriptor& descriptor = callable.descriptor();
@@ -2256,6 +2281,8 @@ Reduction JSTypedLowering::ReduceJSParseInt(Node* node) {
 }
 
 Reduction JSTypedLowering::Reduce(Node* node) {
+  DisallowHeapAccess no_heap_access;
+
   switch (node->opcode()) {
     case IrOpcode::kJSEqual:
       return ReduceJSEqual(node);
diff --git a/deps/v8/src/compiler/js-typed-lowering.h b/deps/v8/src/compiler/js-typed-lowering.h
index 37d433cadfdcb1..c8fcac5ff6a563 100644
--- a/deps/v8/src/compiler/js-typed-lowering.h
+++ b/deps/v8/src/compiler/js-typed-lowering.h
@@ -98,12 +98,14 @@ class V8_EXPORT_PRIVATE JSTypedLowering final
   Factory* factory() const;
   Graph* graph() const;
   JSGraph* jsgraph() const { return jsgraph_; }
+  const JSHeapBroker* js_heap_broker() const { return js_heap_broker_; }
   Isolate* isolate() const;
   JSOperatorBuilder* javascript() const;
   CommonOperatorBuilder* common() const;
   SimplifiedOperatorBuilder* simplified() const;
 
   JSGraph* jsgraph_;
+  const JSHeapBroker* js_heap_broker_;
   Type empty_string_type_;
   Type pointer_comparable_type_;
   TypeCache const& type_cache_;
diff --git a/deps/v8/src/compiler/jump-threading.cc b/deps/v8/src/compiler/jump-threading.cc
index 933ccc0a9cd256..d10f06e4f40c60 100644
--- a/deps/v8/src/compiler/jump-threading.cc
+++ b/deps/v8/src/compiler/jump-threading.cc
@@ -155,13 +155,12 @@ bool JumpThreading::ComputeForwarding(Zone* local_zone,
   return state.forwarded;
 }
 
-
-void JumpThreading::ApplyForwarding(ZoneVector<RpoNumber>& result,
+void JumpThreading::ApplyForwarding(Zone* local_zone,
+                                    ZoneVector<RpoNumber>& result,
                                     InstructionSequence* code) {
   if (!FLAG_turbo_jt) return;
 
-  Zone local_zone(code->isolate()->allocator(), ZONE_NAME);
-  ZoneVector<bool> skip(static_cast<int>(result.size()), false, &local_zone);
+  ZoneVector<bool> skip(static_cast<int>(result.size()), false, local_zone);
 
   // Skip empty blocks when the previous block doesn't fall through.
   bool prev_fallthru = true;
diff --git a/deps/v8/src/compiler/jump-threading.h b/deps/v8/src/compiler/jump-threading.h
index 3a378d0499c295..4d57f281c5dc62 100644
--- a/deps/v8/src/compiler/jump-threading.h
+++ b/deps/v8/src/compiler/jump-threading.h
@@ -22,7 +22,8 @@ class JumpThreading {
 
   // Rewrite the instructions to forward jumps and branches.
   // May also negate some branches.
-  static void ApplyForwarding(ZoneVector<RpoNumber>& forwarding,
+  static void ApplyForwarding(Zone* local_zone,
+                              ZoneVector<RpoNumber>& forwarding,
                               InstructionSequence* code);
 };
 
diff --git a/deps/v8/src/compiler/node-matchers.h b/deps/v8/src/compiler/node-matchers.h
index 2dd0d472b0e29a..e153cf524bd874 100644
--- a/deps/v8/src/compiler/node-matchers.h
+++ b/deps/v8/src/compiler/node-matchers.h
@@ -192,6 +192,8 @@ struct HeapObjectMatcher final
   bool Is(Handle<HeapObject> const& value) const {
     return this->HasValue() && this->Value().address() == value.address();
   }
+
+  ObjectRef Ref() const { return ObjectRef(this->Value()); }
 };
 
 
diff --git a/deps/v8/src/compiler/pipeline.cc b/deps/v8/src/compiler/pipeline.cc
index 45ca08199e59d4..b9443fb302eed6 100644
--- a/deps/v8/src/compiler/pipeline.cc
+++ b/deps/v8/src/compiler/pipeline.cc
@@ -1852,7 +1852,7 @@ struct JumpThreadingPhase {
     ZoneVector<RpoNumber> result(temp_zone);
     if (JumpThreading::ComputeForwarding(temp_zone, result, data->sequence(),
                                          frame_at_start)) {
-      JumpThreading::ApplyForwarding(result, data->sequence());
+      JumpThreading::ApplyForwarding(temp_zone, result, data->sequence());
     }
   }
 };
diff --git a/deps/v8/src/compiler/ppc/code-generator-ppc.cc b/deps/v8/src/compiler/ppc/code-generator-ppc.cc
index 57db999df124d7..3df779f9d2ddad 100644
--- a/deps/v8/src/compiler/ppc/code-generator-ppc.cc
+++ b/deps/v8/src/compiler/ppc/code-generator-ppc.cc
@@ -2374,12 +2374,12 @@ void CodeGenerator::AssembleConstructFrame() {
         __ bge(&done);
       }
 
-      __ LoadP(r3,
+      __ LoadP(r5,
                FieldMemOperand(kWasmInstanceRegister,
                                WasmInstanceObject::kCEntryStubOffset),
                r0);
       __ Move(cp, Smi::kZero);
-      __ CallRuntimeWithCEntry(Runtime::kThrowWasmStackOverflow, r3);
+      __ CallRuntimeWithCEntry(Runtime::kThrowWasmStackOverflow, r5);
       // We come from WebAssembly, there are no references for the GC.
       ReferenceMap* reference_map = new (zone()) ReferenceMap(zone());
       RecordSafepoint(reference_map, Safepoint::kSimple, 0,
diff --git a/deps/v8/src/compiler/s390/code-generator-s390.cc b/deps/v8/src/compiler/s390/code-generator-s390.cc
index 3e4ab9c1996517..851119381b7141 100644
--- a/deps/v8/src/compiler/s390/code-generator-s390.cc
+++ b/deps/v8/src/compiler/s390/code-generator-s390.cc
@@ -3014,10 +3014,10 @@ void CodeGenerator::AssembleConstructFrame() {
         __ bge(&done);
       }
 
-      __ LoadP(r2, FieldMemOperand(kWasmInstanceRegister,
+      __ LoadP(r4, FieldMemOperand(kWasmInstanceRegister,
                                    WasmInstanceObject::kCEntryStubOffset));
       __ Move(cp, Smi::kZero);
-      __ CallRuntimeWithCEntry(Runtime::kThrowWasmStackOverflow, r2);
+      __ CallRuntimeWithCEntry(Runtime::kThrowWasmStackOverflow, r4);
       // We come from WebAssembly, there are no references for the GC.
       ReferenceMap* reference_map = new (zone()) ReferenceMap(zone());
       RecordSafepoint(reference_map, Safepoint::kSimple, 0,
diff --git a/deps/v8/src/compiler/types.cc b/deps/v8/src/compiler/types.cc
index 420a923b14d041..0af70027b39b43 100644
--- a/deps/v8/src/compiler/types.cc
+++ b/deps/v8/src/compiler/types.cc
@@ -296,6 +296,7 @@ Type::bitset BitsetType::Lub(HeapObjectType const& type) {
     case MODULE_TYPE:
     case MODULE_INFO_ENTRY_TYPE:
     case CELL_TYPE:
+    case PRE_PARSED_SCOPE_DATA_TYPE:
     case UNCOMPILED_DATA_WITHOUT_PRE_PARSED_SCOPE_TYPE:
     case UNCOMPILED_DATA_WITH_PRE_PARSED_SCOPE_TYPE:
       return kOtherInternal;
diff --git a/deps/v8/src/debug/debug-evaluate.cc b/deps/v8/src/debug/debug-evaluate.cc
index 161f95d6a47b14..0dd23037723ff4 100644
--- a/deps/v8/src/debug/debug-evaluate.cc
+++ b/deps/v8/src/debug/debug-evaluate.cc
@@ -869,7 +869,7 @@ DebugInfo::SideEffectState DebugEvaluate::FunctionGetSideEffectState(
     // Check bytecodes against whitelist.
     Handle<BytecodeArray> bytecode_array(info->GetBytecodeArray(), isolate);
     if (FLAG_trace_side_effect_free_debug_evaluate) {
-      bytecode_array->Print(isolate);
+      bytecode_array->Print();
     }
     bool requires_runtime_checks = false;
     for (interpreter::BytecodeArrayIterator it(bytecode_array); !it.done();
diff --git a/deps/v8/src/debug/debug-scopes.cc b/deps/v8/src/debug/debug-scopes.cc
index 104bf2a8a5c0ef..9971ee217f80a7 100644
--- a/deps/v8/src/debug/debug-scopes.cc
+++ b/deps/v8/src/debug/debug-scopes.cc
@@ -448,17 +448,17 @@ void ScopeIterator::DebugPrint() {
   switch (Type()) {
     case ScopeIterator::ScopeTypeGlobal:
       os << "Global:\n";
-      context_->Print(isolate_, os);
+      context_->Print(os);
       break;
 
     case ScopeIterator::ScopeTypeLocal: {
       os << "Local:\n";
       if (current_scope_->NeedsContext()) {
-        context_->Print(isolate_, os);
+        context_->Print(os);
         if (context_->has_extension()) {
           Handle<HeapObject> extension(context_->extension(), isolate_);
           DCHECK(extension->IsJSContextExtensionObject());
-          extension->Print(isolate_, os);
+          extension->Print(os);
         }
       }
       break;
@@ -466,22 +466,22 @@ void ScopeIterator::DebugPrint() {
 
     case ScopeIterator::ScopeTypeWith:
       os << "With:\n";
-      context_->extension()->Print(isolate_, os);
+      context_->extension()->Print(os);
       break;
 
     case ScopeIterator::ScopeTypeCatch:
       os << "Catch:\n";
-      context_->extension()->Print(isolate_, os);
-      context_->get(Context::THROWN_OBJECT_INDEX)->Print(isolate_, os);
+      context_->extension()->Print(os);
+      context_->get(Context::THROWN_OBJECT_INDEX)->Print(os);
       break;
 
     case ScopeIterator::ScopeTypeClosure:
       os << "Closure:\n";
-      context_->Print(isolate_, os);
+      context_->Print(os);
       if (context_->has_extension()) {
         Handle<HeapObject> extension(context_->extension(), isolate_);
         DCHECK(extension->IsJSContextExtensionObject());
-        extension->Print(isolate_, os);
+        extension->Print(os);
       }
       break;
 
@@ -490,7 +490,7 @@ void ScopeIterator::DebugPrint() {
       context_->global_object()
           ->native_context()
           ->script_context_table()
-          ->Print(isolate_, os);
+          ->Print(os);
       break;
 
     default:
diff --git a/deps/v8/src/debug/debug.cc b/deps/v8/src/debug/debug.cc
index 8f127be35c0946..253bafd9b3376f 100644
--- a/deps/v8/src/debug/debug.cc
+++ b/deps/v8/src/debug/debug.cc
@@ -824,7 +824,7 @@ MaybeHandle<FixedArray> Debug::GetHitBreakPoints(Handle<DebugInfo> debug_info,
     }
   }
   if (break_points_hit_count == 0) return {};
-  break_points_hit->Shrink(break_points_hit_count);
+  break_points_hit->Shrink(isolate_, break_points_hit_count);
   return break_points_hit;
 }
 
@@ -1634,7 +1634,7 @@ Handle<FixedArray> Debug::GetLoadedScripts() {
       if (script->HasValidSource()) results->set(length++, script);
     }
   }
-  return FixedArray::ShrinkOrEmpty(results, length);
+  return FixedArray::ShrinkOrEmpty(isolate_, results, length);
 }
 
 void Debug::OnThrow(Handle<Object> exception) {
diff --git a/deps/v8/src/elements.cc b/deps/v8/src/elements.cc
index 1e4983ca63be12..fbe4ad6dcba6ff 100644
--- a/deps/v8/src/elements.cc
+++ b/deps/v8/src/elements.cc
@@ -1264,7 +1264,7 @@ class ElementsAccessorBase : public InternalElementsAccessor {
       // Shrink combined_keys to the final size.
       int final_size = nof_indices + nof_property_keys;
       DCHECK_LE(final_size, combined_keys->length());
-      return FixedArray::ShrinkOrEmpty(combined_keys, final_size);
+      return FixedArray::ShrinkOrEmpty(isolate, combined_keys, final_size);
     }
 
     return combined_keys;
@@ -1432,13 +1432,14 @@ class DictionaryElementsAccessor
     CHECK(array->length()->ToArrayLength(&old_length));
     {
       DisallowHeapAllocation no_gc;
+      ReadOnlyRoots roots(isolate);
       if (length < old_length) {
         if (dict->requires_slow_elements()) {
           // Find last non-deletable element in range of elements to be
           // deleted and adjust range accordingly.
           for (int entry = 0; entry < capacity; entry++) {
             Object* index = dict->KeyAt(entry);
-            if (dict->IsKey(isolate, index)) {
+            if (dict->IsKey(roots, index)) {
               uint32_t number = static_cast<uint32_t>(index->Number());
               if (length <= number && number < old_length) {
                 PropertyDetails details = dict->DetailsAt(entry);
@@ -1456,7 +1457,7 @@ class DictionaryElementsAccessor
           int removed_entries = 0;
           for (int entry = 0; entry < capacity; entry++) {
             Object* index = dict->KeyAt(entry);
-            if (dict->IsKey(isolate, index)) {
+            if (dict->IsKey(roots, index)) {
               uint32_t number = static_cast<uint32_t>(index->Number());
               if (length <= number && number < old_length) {
                 dict->ClearEntry(entry);
@@ -1497,9 +1498,10 @@ class DictionaryElementsAccessor
     Handle<NumberDictionary> source_dict(
         NumberDictionary::cast(receiver->elements()), isolate);
     int entry_count = source_dict->Capacity();
+    ReadOnlyRoots roots(isolate);
     for (int i = 0; i < entry_count; i++) {
       Object* key = source_dict->KeyAt(i);
-      if (!source_dict->ToKey(isolate, i, &key)) continue;
+      if (!source_dict->ToKey(roots, i, &key)) continue;
       uint64_t key_value = NumberToInt64(key);
       if (key_value >= start && key_value < end) {
         Handle<NumberDictionary> dest_dict(
@@ -1518,7 +1520,7 @@ class DictionaryElementsAccessor
   static void DeleteImpl(Handle<JSObject> obj, uint32_t entry) {
     Handle<NumberDictionary> dict(NumberDictionary::cast(obj->elements()),
                                   obj->GetIsolate());
-    dict = NumberDictionary::DeleteEntry(dict, entry);
+    dict = NumberDictionary::DeleteEntry(obj->GetIsolate(), dict, entry);
     obj->set_elements(*dict);
   }
 
@@ -1528,10 +1530,10 @@ class DictionaryElementsAccessor
     NumberDictionary* dict = NumberDictionary::cast(backing_store);
     if (!dict->requires_slow_elements()) return false;
     int capacity = dict->Capacity();
-    Isolate* isolate = holder->GetIsolate();
+    ReadOnlyRoots roots = holder->GetReadOnlyRoots();
     for (int i = 0; i < capacity; i++) {
       Object* key = dict->KeyAt(i);
-      if (!dict->IsKey(isolate, key)) continue;
+      if (!dict->IsKey(roots, key)) continue;
       PropertyDetails details = dict->DetailsAt(i);
       if (details.kind() == kAccessor) return true;
     }
@@ -1644,7 +1646,7 @@ class DictionaryElementsAccessor
                                      int entry, PropertyFilter filter) {
     DisallowHeapAllocation no_gc;
     Object* raw_key = dictionary->KeyAt(entry);
-    if (!dictionary->IsKey(isolate, raw_key)) return kMaxUInt32;
+    if (!dictionary->IsKey(ReadOnlyRoots(isolate), raw_key)) return kMaxUInt32;
     return FilterKey(dictionary, entry, raw_key, filter);
   }
 
@@ -1660,9 +1662,10 @@ class DictionaryElementsAccessor
         GetMaxNumberOfEntries(*object, *backing_store));
     int insertion_index = 0;
     PropertyFilter filter = keys->filter();
+    ReadOnlyRoots roots(isolate);
     for (int i = 0; i < capacity; i++) {
       Object* raw_key = dictionary->KeyAt(i);
-      if (!dictionary->IsKey(isolate, raw_key)) continue;
+      if (!dictionary->IsKey(roots, raw_key)) continue;
       uint32_t key = FilterKey(dictionary, i, raw_key, filter);
       if (key == kMaxUInt32) {
         keys->AddShadowingKey(raw_key);
@@ -1706,9 +1709,10 @@ class DictionaryElementsAccessor
     Handle<NumberDictionary> dictionary(
         NumberDictionary::cast(receiver->elements()), isolate);
     int capacity = dictionary->Capacity();
+    ReadOnlyRoots roots(isolate);
     for (int i = 0; i < capacity; i++) {
       Object* k = dictionary->KeyAt(i);
-      if (!dictionary->IsKey(isolate, k)) continue;
+      if (!dictionary->IsKey(roots, k)) continue;
       Object* value = dictionary->ValueAt(i);
       DCHECK(!value->IsTheHole(isolate));
       DCHECK(!value->IsAccessorPair());
@@ -1901,7 +1905,7 @@ class DictionaryElementsAccessor
 #if DEBUG
     DCHECK_EQ(holder->map()->elements_kind(), DICTIONARY_ELEMENTS);
     if (!FLAG_enable_slow_asserts) return;
-    Isolate* isolate = holder->GetIsolate();
+    ReadOnlyRoots roots = holder->GetReadOnlyRoots();
     NumberDictionary* dictionary = NumberDictionary::cast(holder->elements());
     // Validate the requires_slow_elements and max_number_key values.
     int capacity = dictionary->Capacity();
@@ -1909,7 +1913,7 @@ class DictionaryElementsAccessor
     int max_key = 0;
     for (int i = 0; i < capacity; ++i) {
       Object* k;
-      if (!dictionary->ToKey(isolate, i, &k)) continue;
+      if (!dictionary->ToKey(roots, i, &k)) continue;
       DCHECK_LE(0.0, k->Number());
       if (k->Number() > NumberDictionary::kRequiresSlowElementsLimit) {
         requires_slow_elements = true;
@@ -2276,9 +2280,6 @@ class FastElementsAccessor : public ElementsAccessorBase<Subclass, KindTraits> {
     Handle<BackingStore> dst_elms = Handle<BackingStore>::cast(backing_store);
     if (len > JSArray::kMaxCopyElements && dst_index == 0 &&
         heap->CanMoveObjectStart(*dst_elms)) {
-      // Remove all the pointers to the FixedArrayBase we're going to left trim
-      // from the heap.
-      receiver->set_elements(ReadOnlyRoots(heap).empty_fixed_array());
       // Update all the copies of this backing_store handle.
       *dst_elms.location() =
           BackingStore::cast(heap->LeftTrimFixedArray(*dst_elms, src_index));
@@ -3999,7 +4000,7 @@ class SlowSloppyArgumentsElementsAccessor
     Handle<NumberDictionary> dict(NumberDictionary::cast(elements->arguments()),
                                   isolate);
     int length = elements->parameter_map_length();
-    dict = NumberDictionary::DeleteEntry(dict, entry - length);
+    dict = NumberDictionary::DeleteEntry(isolate, dict, entry - length);
     elements->set_arguments(*dict);
   }
   static void AddImpl(Handle<JSObject> object, uint32_t index,
diff --git a/deps/v8/src/flag-definitions.h b/deps/v8/src/flag-definitions.h
index 3a7d52772988d8..501335375932ca 100644
--- a/deps/v8/src/flag-definitions.h
+++ b/deps/v8/src/flag-definitions.h
@@ -567,6 +567,10 @@ DEFINE_DEBUG_BOOL(wasm_break_on_decoder_error, false,
                   "debug break when wasm decoder encounters an error")
 DEFINE_BOOL(wasm_trace_memory, false,
             "print all memory updates performed in wasm code")
+// Fuzzers use {wasm_tier_mask_for_testing} together with {liftoff} and
+// {no_wasm_tier_up} to force some functions to be compiled with Turbofan.
+DEFINE_INT(wasm_tier_mask_for_testing, 0,
+           "bitmask of functions to compile with TurboFan instead of Liftoff")
 
 DEFINE_BOOL(validate_asm, true, "validate asm.js modules before compiling")
 DEFINE_BOOL(suppress_asm_messages, false,
@@ -700,7 +704,7 @@ DEFINE_BOOL(concurrent_marking, V8_CONCURRENT_MARKING_BOOL,
             "use concurrent marking")
 DEFINE_BOOL(parallel_marking, true, "use parallel marking in atomic pause")
 DEFINE_IMPLICATION(parallel_marking, concurrent_marking)
-DEFINE_INT(ephemeron_fixpoint_iterations, 0,
+DEFINE_INT(ephemeron_fixpoint_iterations, 10,
            "number of fixpoint iterations it takes to switch to linear "
            "ephemeron algorithm")
 DEFINE_BOOL(trace_concurrent_marking, false, "trace concurrent marking")
diff --git a/deps/v8/src/frames.cc b/deps/v8/src/frames.cc
index 61d241a51e3c3a..3c19f867caa625 100644
--- a/deps/v8/src/frames.cc
+++ b/deps/v8/src/frames.cc
@@ -1759,23 +1759,22 @@ void WasmCompiledFrame::Print(StringStream* accumulator, PrintMode mode,
                               int index) const {
   PrintIndex(accumulator, mode, index);
   accumulator->Add("WASM [");
-  Script* script = this->script();
-  accumulator->PrintName(script->name());
+  accumulator->PrintName(script()->name());
   Address instruction_start = isolate()
                                   ->wasm_engine()
                                   ->code_manager()
                                   ->LookupCode(pc())
                                   ->instruction_start();
-  int pc = static_cast<int>(this->pc() - instruction_start);
   Vector<const uint8_t> raw_func_name =
-      module_object()->GetRawFunctionName(this->function_index());
+      module_object()->GetRawFunctionName(function_index());
   const int kMaxPrintedFunctionName = 64;
   char func_name[kMaxPrintedFunctionName + 1];
   int func_name_len = std::min(kMaxPrintedFunctionName, raw_func_name.length());
   memcpy(func_name, raw_func_name.start(), func_name_len);
   func_name[func_name_len] = '\0';
-  accumulator->Add("], function #%u ('%s'), pc=+0x%x, pos=%d\n",
-                   this->function_index(), func_name, pc, this->position());
+  accumulator->Add("], function #%u ('%s'), pc=%p (+0x%x), pos=%d\n",
+                   function_index(), func_name, reinterpret_cast<void*>(pc()),
+                   static_cast<int>(pc() - instruction_start), position());
   if (mode != OVERVIEW) accumulator->Add("\n");
 }
 
diff --git a/deps/v8/src/gdb-jit.cc b/deps/v8/src/gdb-jit.cc
index 355bcbd62f0e87..4e2587dec21209 100644
--- a/deps/v8/src/gdb-jit.cc
+++ b/deps/v8/src/gdb-jit.cc
@@ -1854,7 +1854,7 @@ extern "C" {
 #ifdef OBJECT_PRINT
   void __gdb_print_v8_object(Object* object) {
     StdoutStream os;
-    object->Print(Isolate::Current(), os);
+    object->Print(os);
     os << std::flush;
   }
 #endif
diff --git a/deps/v8/src/heap/embedder-tracing.h b/deps/v8/src/heap/embedder-tracing.h
index 06450241a2e2b4..994695942ba46b 100644
--- a/deps/v8/src/heap/embedder-tracing.h
+++ b/deps/v8/src/heap/embedder-tracing.h
@@ -18,10 +18,23 @@ class V8_EXPORT_PRIVATE LocalEmbedderHeapTracer final {
  public:
   typedef std::pair<void*, void*> WrapperInfo;
 
-  LocalEmbedderHeapTracer()
-      : remote_tracer_(nullptr), num_v8_marking_worklist_was_empty_(0) {}
+  explicit LocalEmbedderHeapTracer(Isolate* isolate)
+      : isolate_(isolate),
+        remote_tracer_(nullptr),
+        num_v8_marking_worklist_was_empty_(0) {}
+
+  ~LocalEmbedderHeapTracer() {
+    if (remote_tracer_) remote_tracer_->isolate_ = nullptr;
+  }
+
+  void SetRemoteTracer(EmbedderHeapTracer* tracer) {
+    if (remote_tracer_) remote_tracer_->isolate_ = nullptr;
+
+    remote_tracer_ = tracer;
+    if (remote_tracer_)
+      remote_tracer_->isolate_ = reinterpret_cast<v8::Isolate*>(isolate_);
+  }
 
-  void SetRemoteTracer(EmbedderHeapTracer* tracer) { remote_tracer_ = tracer; }
   bool InUse() { return remote_tracer_ != nullptr; }
 
   void TracePrologue();
@@ -58,6 +71,7 @@ class V8_EXPORT_PRIVATE LocalEmbedderHeapTracer final {
  private:
   typedef std::vector<WrapperInfo> WrapperCache;
 
+  Isolate* const isolate_;
   EmbedderHeapTracer* remote_tracer_;
   WrapperCache cached_wrappers_to_trace_;
   size_t num_v8_marking_worklist_was_empty_;
diff --git a/deps/v8/src/heap/factory.cc b/deps/v8/src/heap/factory.cc
index 3e72c1384f6146..6dc112478be8a7 100644
--- a/deps/v8/src/heap/factory.cc
+++ b/deps/v8/src/heap/factory.cc
@@ -574,7 +574,7 @@ Handle<String> Factory::InternalizeOneByteString(Vector<const uint8_t> string) {
 
 Handle<String> Factory::InternalizeOneByteString(
     Handle<SeqOneByteString> string, int from, int length) {
-  SeqOneByteSubStringKey key(string, from, length);
+  SeqOneByteSubStringKey key(isolate(), string, from, length);
   return InternalizeStringWithKey(&key);
 }
 
@@ -926,7 +926,7 @@ Handle<StringClass> Factory::InternalizeExternalString(Handle<String> string) {
                                       isolate());
   external_string->set_length(cast_string->length());
   external_string->set_hash_field(cast_string->hash_field());
-  external_string->set_resource(nullptr);
+  external_string->SetResource(nullptr);
   isolate()->heap()->RegisterExternalString(*external_string);
   return external_string;
 }
@@ -1145,8 +1145,8 @@ Handle<String> Factory::NewConsString(Handle<String> left, Handle<String> right,
 
   result->set_hash_field(String::kEmptyHashField);
   result->set_length(length);
-  result->set_first(*left, mode);
-  result->set_second(*right, mode);
+  result->set_first(isolate(), *left, mode);
+  result->set_second(isolate(), *right, mode);
   return result;
 }
 
@@ -1226,7 +1226,7 @@ Handle<String> Factory::NewProperSubString(Handle<String> str, int begin,
 
   slice->set_hash_field(String::kEmptyHashField);
   slice->set_length(length);
-  slice->set_parent(*str);
+  slice->set_parent(isolate(), *str);
   slice->set_offset(offset);
   return slice;
 }
@@ -1250,7 +1250,7 @@ MaybeHandle<String> Factory::NewExternalStringFromOneByte(
       ExternalOneByteString::cast(New(map, TENURED)), isolate());
   external_string->set_length(static_cast<int>(length));
   external_string->set_hash_field(String::kEmptyHashField);
-  external_string->set_resource(resource);
+  external_string->SetResource(resource);
   isolate()->heap()->RegisterExternalString(*external_string);
 
   return external_string;
@@ -1283,7 +1283,7 @@ MaybeHandle<String> Factory::NewExternalStringFromTwoByte(
       ExternalTwoByteString::cast(New(map, TENURED)), isolate());
   external_string->set_length(static_cast<int>(length));
   external_string->set_hash_field(String::kEmptyHashField);
-  external_string->set_resource(resource);
+  external_string->SetResource(resource);
   isolate()->heap()->RegisterExternalString(*external_string);
 
   return external_string;
@@ -1299,7 +1299,7 @@ Handle<ExternalOneByteString> Factory::NewNativeSourceString(
       ExternalOneByteString::cast(New(map, TENURED)), isolate());
   external_string->set_length(static_cast<int>(length));
   external_string->set_hash_field(String::kEmptyHashField);
-  external_string->set_resource(resource);
+  external_string->SetResource(resource);
   isolate()->heap()->RegisterExternalString(*external_string);
 
   return external_string;
@@ -2498,11 +2498,17 @@ Handle<ModuleInfo> Factory::NewModuleInfo() {
                                           ModuleInfo::kLength, TENURED);
 }
 
-Handle<PreParsedScopeData> Factory::NewPreParsedScopeData() {
-  Handle<PreParsedScopeData> result =
-      Handle<PreParsedScopeData>::cast(NewStruct(TUPLE2_TYPE, TENURED));
+Handle<PreParsedScopeData> Factory::NewPreParsedScopeData(int length) {
+  int size = PreParsedScopeData::SizeFor(length);
+  Handle<PreParsedScopeData> result(
+      PreParsedScopeData::cast(AllocateRawWithImmortalMap(
+          size, TENURED, *pre_parsed_scope_data_map())),
+      isolate());
   result->set_scope_data(PodArray<uint8_t>::cast(*empty_byte_array()));
-  result->set_child_data(*empty_fixed_array());
+  result->set_length(length);
+  MemsetPointer(result->child_data_start(), *null_value(), length);
+
+  result->clear_padding();
   return result;
 }
 
diff --git a/deps/v8/src/heap/factory.h b/deps/v8/src/heap/factory.h
index 58374be3729996..21e3036c8ffebf 100644
--- a/deps/v8/src/heap/factory.h
+++ b/deps/v8/src/heap/factory.h
@@ -724,7 +724,7 @@ class V8_EXPORT_PRIVATE Factory {
 
   Handle<ModuleInfo> NewModuleInfo();
 
-  Handle<PreParsedScopeData> NewPreParsedScopeData();
+  Handle<PreParsedScopeData> NewPreParsedScopeData(int length);
 
   Handle<UncompiledDataWithoutPreParsedScope>
   NewUncompiledDataWithoutPreParsedScope(int32_t start_position,
diff --git a/deps/v8/src/heap/heap-inl.h b/deps/v8/src/heap/heap-inl.h
index cc31a31e3a316d..75be7b784dbeb0 100644
--- a/deps/v8/src/heap/heap-inl.h
+++ b/deps/v8/src/heap/heap-inl.h
@@ -279,12 +279,33 @@ void Heap::UpdateAllocationsHash(uint32_t value) {
 
 
 void Heap::RegisterExternalString(String* string) {
+  DCHECK(string->IsExternalString());
+  DCHECK(!string->IsThinString());
   external_string_table_.AddString(string);
 }
 
+void Heap::UpdateExternalString(String* string, size_t old_payload,
+                                size_t new_payload) {
+  DCHECK(string->IsExternalString());
+  Page* page = Page::FromHeapObject(string);
+
+  if (old_payload > new_payload)
+    page->DecrementExternalBackingStoreBytes(
+        ExternalBackingStoreType::kExternalString, old_payload - new_payload);
+  else
+    page->IncrementExternalBackingStoreBytes(
+        ExternalBackingStoreType::kExternalString, new_payload - old_payload);
+}
 
 void Heap::FinalizeExternalString(String* string) {
   DCHECK(string->IsExternalString());
+  Page* page = Page::FromHeapObject(string);
+  ExternalString* ext_string = ExternalString::cast(string);
+
+  page->DecrementExternalBackingStoreBytes(
+      ExternalBackingStoreType::kExternalString,
+      ext_string->ExternalPayloadSize());
+
   v8::String::ExternalStringResourceBase** resource_addr =
       reinterpret_cast<v8::String::ExternalStringResourceBase**>(
           reinterpret_cast<byte*>(string) + ExternalString::kResourceOffset -
diff --git a/deps/v8/src/heap/heap.cc b/deps/v8/src/heap/heap.cc
index d6183326ccfd3e..b3dc3f8c665184 100644
--- a/deps/v8/src/heap/heap.cc
+++ b/deps/v8/src/heap/heap.cc
@@ -572,7 +572,7 @@ void Heap::PrintRetainingPath(HeapObject* target, RetainingPathOption option) {
     object->ShortPrint();
     PrintF("\n");
 #ifdef OBJECT_PRINT
-    object->Print(isolate());
+    object->Print();
     PrintF("\n");
 #endif
     --distance;
@@ -1093,7 +1093,7 @@ void Heap::HandleGCRequest() {
              incremental_marking()->IsMarking() &&
              !incremental_marking()->finalize_marking_completed()) {
     incremental_marking()->reset_request_type();
-    FinalizeIncrementalMarking(
+    FinalizeIncrementalMarkingIncrementally(
         GarbageCollectionReason::kFinalizeMarkingViaStackGuard);
   }
 }
@@ -1103,41 +1103,6 @@ void Heap::ScheduleIdleScavengeIfNeeded(int bytes_allocated) {
   scavenge_job_->ScheduleIdleTaskIfNeeded(this, bytes_allocated);
 }
 
-void Heap::FinalizeIncrementalMarking(GarbageCollectionReason gc_reason) {
-  if (FLAG_trace_incremental_marking) {
-    isolate()->PrintWithTimestamp(
-        "[IncrementalMarking] (%s).\n",
-        Heap::GarbageCollectionReasonToString(gc_reason));
-  }
-
-  HistogramTimerScope incremental_marking_scope(
-      isolate()->counters()->gc_incremental_marking_finalize());
-  TRACE_EVENT0("v8", "V8.GCIncrementalMarkingFinalize");
-  TRACE_GC(tracer(), GCTracer::Scope::MC_INCREMENTAL_FINALIZE);
-
-  {
-    GCCallbacksScope scope(this);
-    if (scope.CheckReenter()) {
-      AllowHeapAllocation allow_allocation;
-      TRACE_GC(tracer(), GCTracer::Scope::MC_INCREMENTAL_EXTERNAL_PROLOGUE);
-      VMState<EXTERNAL> state(isolate_);
-      HandleScope handle_scope(isolate_);
-      CallGCPrologueCallbacks(kGCTypeIncrementalMarking, kNoGCCallbackFlags);
-    }
-  }
-  incremental_marking()->FinalizeIncrementally();
-  {
-    GCCallbacksScope scope(this);
-    if (scope.CheckReenter()) {
-      AllowHeapAllocation allow_allocation;
-      TRACE_GC(tracer(), GCTracer::Scope::MC_INCREMENTAL_EXTERNAL_EPILOGUE);
-      VMState<EXTERNAL> state(isolate_);
-      HandleScope handle_scope(isolate_);
-      CallGCEpilogueCallbacks(kGCTypeIncrementalMarking, kNoGCCallbackFlags);
-    }
-  }
-}
-
 HistogramTimer* Heap::GCTypePriorityTimer(GarbageCollector collector) {
   if (IsYoungGenerationCollector(collector)) {
     if (isolate_->IsIsolateInBackground()) {
@@ -1247,7 +1212,7 @@ void ReportDuplicates(Isolate* isolate, int size,
     PrintF("%d duplicates of size %d each (%dKB)\n", it->first, size,
            duplicate_bytes / KB);
     PrintF("Sample object: ");
-    it->second->Print(isolate);
+    it->second->Print();
     PrintF("============================\n");
   }
 }
@@ -2332,6 +2297,15 @@ void Heap::ProtectUnprotectedMemoryChunks() {
   unprotected_memory_chunks_.clear();
 }
 
+void Heap::ProcessMovedExternalString(Page* old_page, Page* new_page,
+                                      ExternalString* string) {
+  size_t size = string->ExternalPayloadSize();
+  old_page->DecrementExternalBackingStoreBytes(
+      ExternalBackingStoreType::kExternalString, size);
+  new_page->IncrementExternalBackingStoreBytes(
+      ExternalBackingStoreType::kExternalString, size);
+}
+
 String* Heap::UpdateNewSpaceReferenceInExternalStringTableEntry(Heap* heap,
                                                                 Object** p) {
   MapWord first_word = HeapObject::cast(*p)->map_word();
@@ -2349,24 +2323,53 @@ String* Heap::UpdateNewSpaceReferenceInExternalStringTableEntry(Heap* heap,
   }
 
   // String is still reachable.
-  String* string = String::cast(first_word.ToForwardingAddress());
-  if (string->IsThinString()) string = ThinString::cast(string)->actual();
+  String* new_string = String::cast(first_word.ToForwardingAddress());
+  if (new_string->IsThinString()) {
+    // Filtering Thin strings out of the external string table.
+    return nullptr;
+  } else if (new_string->IsExternalString()) {
+    heap->ProcessMovedExternalString(
+        Page::FromAddress(reinterpret_cast<Address>(*p)),
+        Page::FromHeapObject(new_string), ExternalString::cast(new_string));
+    return new_string;
+  }
+
   // Internalization can replace external strings with non-external strings.
-  return string->IsExternalString() ? string : nullptr;
+  return new_string->IsExternalString() ? new_string : nullptr;
 }
 
 void Heap::ExternalStringTable::Verify() {
 #ifdef DEBUG
+  std::set<String*> visited_map;
+  std::map<MemoryChunk*, size_t> size_map;
+  ExternalBackingStoreType type = ExternalBackingStoreType::kExternalString;
   for (size_t i = 0; i < new_space_strings_.size(); ++i) {
-    Object* obj = Object::cast(new_space_strings_[i]);
-    DCHECK(InNewSpace(obj));
+    String* obj = String::cast(new_space_strings_[i]);
+    MemoryChunk* mc = MemoryChunk::FromHeapObject(obj);
+    DCHECK(mc->InNewSpace());
+    DCHECK(heap_->InNewSpace(obj));
     DCHECK(!obj->IsTheHole(heap_->isolate()));
+    DCHECK(obj->IsExternalString());
+    // Note: we can have repeated elements in the table.
+    DCHECK_EQ(0, visited_map.count(obj));
+    visited_map.insert(obj);
+    size_map[mc] += ExternalString::cast(obj)->ExternalPayloadSize();
   }
   for (size_t i = 0; i < old_space_strings_.size(); ++i) {
-    Object* obj = Object::cast(old_space_strings_[i]);
-    DCHECK(!InNewSpace(obj));
+    String* obj = String::cast(old_space_strings_[i]);
+    MemoryChunk* mc = MemoryChunk::FromHeapObject(obj);
+    DCHECK(!mc->InNewSpace());
+    DCHECK(!heap_->InNewSpace(obj));
     DCHECK(!obj->IsTheHole(heap_->isolate()));
-  }
+    DCHECK(obj->IsExternalString());
+    // Note: we can have repeated elements in the table.
+    DCHECK_EQ(0, visited_map.count(obj));
+    visited_map.insert(obj);
+    size_map[mc] += ExternalString::cast(obj)->ExternalPayloadSize();
+  }
+  for (std::map<MemoryChunk*, size_t>::iterator it = size_map.begin();
+       it != size_map.end(); it++)
+    DCHECK_EQ(it->first->ExternalBackingStoreBytes(type), it->second);
 #endif
 }
 
@@ -3198,7 +3201,7 @@ void Heap::FinalizeIncrementalMarkingIfComplete(
        (!incremental_marking()->finalize_marking_completed() &&
         mark_compact_collector()->marking_worklist()->IsEmpty() &&
         local_embedder_heap_tracer()->ShouldFinalizeIncrementalMarking()))) {
-    FinalizeIncrementalMarking(gc_reason);
+    FinalizeIncrementalMarkingIncrementally(gc_reason);
   } else if (incremental_marking()->IsComplete() ||
              (mark_compact_collector()->marking_worklist()->IsEmpty() &&
               local_embedder_heap_tracer()
@@ -3207,6 +3210,48 @@ void Heap::FinalizeIncrementalMarkingIfComplete(
   }
 }
 
+void Heap::FinalizeIncrementalMarkingAtomically(
+    GarbageCollectionReason gc_reason) {
+  DCHECK(!incremental_marking()->IsStopped());
+  CollectAllGarbage(current_gc_flags_, gc_reason, current_gc_callback_flags_);
+}
+
+void Heap::FinalizeIncrementalMarkingIncrementally(
+    GarbageCollectionReason gc_reason) {
+  if (FLAG_trace_incremental_marking) {
+    isolate()->PrintWithTimestamp(
+        "[IncrementalMarking] (%s).\n",
+        Heap::GarbageCollectionReasonToString(gc_reason));
+  }
+
+  HistogramTimerScope incremental_marking_scope(
+      isolate()->counters()->gc_incremental_marking_finalize());
+  TRACE_EVENT0("v8", "V8.GCIncrementalMarkingFinalize");
+  TRACE_GC(tracer(), GCTracer::Scope::MC_INCREMENTAL_FINALIZE);
+
+  {
+    GCCallbacksScope scope(this);
+    if (scope.CheckReenter()) {
+      AllowHeapAllocation allow_allocation;
+      TRACE_GC(tracer(), GCTracer::Scope::MC_INCREMENTAL_EXTERNAL_PROLOGUE);
+      VMState<EXTERNAL> state(isolate_);
+      HandleScope handle_scope(isolate_);
+      CallGCPrologueCallbacks(kGCTypeIncrementalMarking, kNoGCCallbackFlags);
+    }
+  }
+  incremental_marking()->FinalizeIncrementally();
+  {
+    GCCallbacksScope scope(this);
+    if (scope.CheckReenter()) {
+      AllowHeapAllocation allow_allocation;
+      TRACE_GC(tracer(), GCTracer::Scope::MC_INCREMENTAL_EXTERNAL_EPILOGUE);
+      VMState<EXTERNAL> state(isolate_);
+      HandleScope handle_scope(isolate_);
+      CallGCEpilogueCallbacks(kGCTypeIncrementalMarking, kNoGCCallbackFlags);
+    }
+  }
+}
+
 void Heap::RegisterDeserializedObjectsForBlackAllocation(
     Reservation* reservations, const std::vector<HeapObject*>& large_objects,
     const std::vector<Address>& maps) {
@@ -3664,6 +3709,8 @@ const char* Heap::GarbageCollectionReasonToString(
       return "snapshot creator";
     case GarbageCollectionReason::kTesting:
       return "testing";
+    case GarbageCollectionReason::kExternalFinalize:
+      return "external finalize";
     case GarbageCollectionReason::kUnknown:
       return "unknown";
   }
@@ -4680,7 +4727,7 @@ void Heap::SetUp() {
     dead_object_stats_ = new ObjectStats(this);
   }
   scavenge_job_ = new ScavengeJob();
-  local_embedder_heap_tracer_ = new LocalEmbedderHeapTracer();
+  local_embedder_heap_tracer_ = new LocalEmbedderHeapTracer(isolate());
 
   LOG(isolate_, IntPtrTEvent("heap-capacity", Capacity()));
   LOG(isolate_, IntPtrTEvent("heap-available", Available()));
@@ -5004,10 +5051,10 @@ void Heap::RemoveGCEpilogueCallback(v8::Isolate::GCCallbackWithData callback,
 }
 
 namespace {
-void CompactFixedArrayOfWeakCells(Object* object) {
+void CompactFixedArrayOfWeakCells(Isolate* isolate, Object* object) {
   if (object->IsFixedArrayOfWeakCells()) {
     FixedArrayOfWeakCells* array = FixedArrayOfWeakCells::cast(object);
-    array->Compact<FixedArrayOfWeakCells::NullCallback>();
+    array->Compact<FixedArrayOfWeakCells::NullCallback>(isolate);
   }
 }
 }  // anonymous namespace
@@ -5021,13 +5068,14 @@ void Heap::CompactFixedArraysOfWeakCells() {
       if (prototype_users->IsFixedArrayOfWeakCells()) {
         FixedArrayOfWeakCells* array =
             FixedArrayOfWeakCells::cast(prototype_users);
-        array->Compact<JSObject::PrototypeRegistryCompactionCallback>();
+        array->Compact<JSObject::PrototypeRegistryCompactionCallback>(
+            isolate());
       }
     }
   }
-  CompactFixedArrayOfWeakCells(noscript_shared_function_infos());
-  CompactFixedArrayOfWeakCells(script_list());
-  CompactFixedArrayOfWeakCells(weak_stack_trace_list());
+  CompactFixedArrayOfWeakCells(isolate(), noscript_shared_function_infos());
+  CompactFixedArrayOfWeakCells(isolate(), script_list());
+  CompactFixedArrayOfWeakCells(isolate(), weak_stack_trace_list());
 }
 
 void Heap::AddRetainedMap(Handle<Map> map) {
@@ -5438,19 +5486,15 @@ void Heap::ExternalStringTable::CleanUpAll() {
 void Heap::ExternalStringTable::TearDown() {
   for (size_t i = 0; i < new_space_strings_.size(); ++i) {
     Object* o = new_space_strings_[i];
-    if (o->IsThinString()) {
-      o = ThinString::cast(o)->actual();
-      if (!o->IsExternalString()) continue;
-    }
+    // Dont finalize thin strings.
+    if (o->IsThinString()) continue;
     heap_->FinalizeExternalString(ExternalString::cast(o));
   }
   new_space_strings_.clear();
   for (size_t i = 0; i < old_space_strings_.size(); ++i) {
     Object* o = old_space_strings_[i];
-    if (o->IsThinString()) {
-      o = ThinString::cast(o)->actual();
-      if (!o->IsExternalString()) continue;
-    }
+    // Dont finalize thin strings.
+    if (o->IsThinString()) continue;
     heap_->FinalizeExternalString(ExternalString::cast(o));
   }
   old_space_strings_.clear();
diff --git a/deps/v8/src/heap/heap.h b/deps/v8/src/heap/heap.h
index 471fa95b7f1c38..be97ad1b6c31eb 100644
--- a/deps/v8/src/heap/heap.h
+++ b/deps/v8/src/heap/heap.h
@@ -47,7 +47,7 @@ class DeoptimizationData;
 class HandlerTable;
 class IncrementalMarking;
 class JSArrayBuffer;
-
+class ExternalString;
 using v8::MemoryPressureLevel;
 
 // Heap roots that are known to be immortal immovable, for which we can safely
@@ -129,6 +129,7 @@ using v8::MemoryPressureLevel;
   V(OptimizedOut)                           \
   V(OrderedHashMapMap)                      \
   V(OrderedHashSetMap)                      \
+  V(PreParsedScopeDataMap)                  \
   V(PropertyArrayMap)                       \
   V(ScopeInfoMap)                           \
   V(ScriptContextMap)                       \
@@ -241,7 +242,8 @@ enum class GarbageCollectionReason {
   kRuntime = 18,
   kSamplingProfiler = 19,
   kSnapshotCreator = 20,
-  kTesting = 21
+  kTesting = 21,
+  kExternalFinalize = 22
   // If you add new items here, then update the incremental_marking_reason,
   // mark_compact_reason, and scavenge_reason counters in counters.h.
   // Also update src/tools/metrics/histograms/histograms.xml in chromium.
@@ -676,6 +678,9 @@ class Heap {
     external_memory_concurrently_freed_ = 0;
   }
 
+  void ProcessMovedExternalString(Page* old_page, Page* new_page,
+                                  ExternalString* string);
+
   void CompactFixedArraysOfWeakCells();
 
   void AddRetainedMap(Handle<Map> map);
@@ -912,14 +917,14 @@ class Heap {
   // Performs garbage collection operation.
   // Returns whether there is a chance that another major GC could
   // collect more garbage.
-  bool CollectGarbage(
+  V8_EXPORT_PRIVATE bool CollectGarbage(
       AllocationSpace space, GarbageCollectionReason gc_reason,
       const GCCallbackFlags gc_callback_flags = kNoGCCallbackFlags);
 
   // Performs a full garbage collection.  If (flags & kMakeHeapIterableMask) is
   // non-zero, then the slower precise sweeper is used, which leaves the heap
   // in a state where we can iterate over the heap visiting all objects.
-  void CollectAllGarbage(
+  V8_EXPORT_PRIVATE void CollectAllGarbage(
       int flags, GarbageCollectionReason gc_reason,
       const GCCallbackFlags gc_callback_flags = kNoGCCallbackFlags);
 
@@ -1019,6 +1024,8 @@ class Heap {
       GCCallbackFlags gc_callback_flags = GCCallbackFlags::kNoGCCallbackFlags);
 
   void FinalizeIncrementalMarkingIfComplete(GarbageCollectionReason gc_reason);
+  // Synchronously finalizes incremental marking.
+  void FinalizeIncrementalMarkingAtomically(GarbageCollectionReason gc_reason);
 
   void RegisterDeserializedObjectsForBlackAllocation(
       Reservation* reservations, const std::vector<HeapObject*>& large_objects,
@@ -1085,6 +1092,11 @@ class Heap {
   // Registers an external string.
   inline void RegisterExternalString(String* string);
 
+  // Called when a string's resource is changed. The size of the payload is sent
+  // as argument of the method.
+  inline void UpdateExternalString(String* string, size_t old_payload,
+                                   size_t new_payload);
+
   // Finalizes an external string by deleting the associated external
   // data and clearing the resource pointer.
   inline void FinalizeExternalString(String* string);
@@ -1720,7 +1732,8 @@ class Heap {
   // implicit references from global handles, but don't atomically complete
   // marking. If we continue to mark incrementally, we might have marked
   // objects that die later.
-  void FinalizeIncrementalMarking(GarbageCollectionReason gc_reason);
+  void FinalizeIncrementalMarkingIncrementally(
+      GarbageCollectionReason gc_reason);
 
   // Returns the timer used for a given GC type.
   // - GCScavenger: young generation GC
diff --git a/deps/v8/src/heap/mark-compact.cc b/deps/v8/src/heap/mark-compact.cc
index 9f8c12fb78316a..87ab7668ec3df6 100644
--- a/deps/v8/src/heap/mark-compact.cc
+++ b/deps/v8/src/heap/mark-compact.cc
@@ -2301,7 +2301,14 @@ static String* UpdateReferenceInExternalStringTableEntry(Heap* heap,
   MapWord map_word = HeapObject::cast(*p)->map_word();
 
   if (map_word.IsForwardingAddress()) {
-    return String::cast(map_word.ToForwardingAddress());
+    String* new_string = String::cast(map_word.ToForwardingAddress());
+
+    if (new_string->IsExternalString()) {
+      heap->ProcessMovedExternalString(
+          Page::FromAddress(reinterpret_cast<Address>(*p)),
+          Page::FromHeapObject(new_string), ExternalString::cast(new_string));
+    }
+    return new_string;
   }
 
   return String::cast(*p);
diff --git a/deps/v8/src/heap/objects-visiting.h b/deps/v8/src/heap/objects-visiting.h
index 410dbeba9faa9e..cdb7c917b0e02b 100644
--- a/deps/v8/src/heap/objects-visiting.h
+++ b/deps/v8/src/heap/objects-visiting.h
@@ -48,6 +48,7 @@ class UncompiledDataWithPreParsedScope;
   V(JSWeakCollection)                 \
   V(Map)                              \
   V(Oddball)                          \
+  V(PreParsedScopeData)               \
   V(PropertyArray)                    \
   V(PropertyCell)                     \
   V(PrototypeInfo)                    \
diff --git a/deps/v8/src/heap/setup-heap-internal.cc b/deps/v8/src/heap/setup-heap-internal.cc
index 38eb0efcb822b5..58f7ba435ad0a1 100644
--- a/deps/v8/src/heap/setup-heap-internal.cc
+++ b/deps/v8/src/heap/setup-heap-internal.cc
@@ -498,6 +498,7 @@ bool Heap::CreateInitialMaps() {
     ALLOCATE_MAP(CALL_HANDLER_INFO_TYPE, CallHandlerInfo::kSize,
                  next_call_side_effect_free_call_handler_info)
 
+    ALLOCATE_VARSIZE_MAP(PRE_PARSED_SCOPE_DATA_TYPE, pre_parsed_scope_data)
     ALLOCATE_MAP(UNCOMPILED_DATA_WITHOUT_PRE_PARSED_SCOPE_TYPE,
                  UncompiledDataWithoutPreParsedScope::kSize,
                  uncompiled_data_without_pre_parsed_scope)
diff --git a/deps/v8/src/heap/spaces.cc b/deps/v8/src/heap/spaces.cc
index ad4ca490445443..9611ef773b01eb 100644
--- a/deps/v8/src/heap/spaces.cc
+++ b/deps/v8/src/heap/spaces.cc
@@ -1957,7 +1957,11 @@ void PagedSpace::Verify(Isolate* isolate, ObjectVisitor* visitor) {
       CHECK(object->address() + size <= top);
       end_of_previous_object = object->address() + size;
 
-      if (object->IsJSArrayBuffer()) {
+      if (object->IsExternalString()) {
+        ExternalString* external_string = ExternalString::cast(object);
+        size_t size = external_string->ExternalPayloadSize();
+        external_page_bytes[ExternalBackingStoreType::kExternalString] += size;
+      } else if (object->IsJSArrayBuffer()) {
         JSArrayBuffer* array_buffer = JSArrayBuffer::cast(object);
         if (ArrayBufferTracker::IsTracked(array_buffer)) {
           size_t size = NumberToSize(array_buffer->byte_length());
@@ -2441,7 +2445,11 @@ void NewSpace::Verify(Isolate* isolate) {
       int size = object->Size();
       object->IterateBody(map, size, &visitor);
 
-      if (object->IsJSArrayBuffer()) {
+      if (object->IsExternalString()) {
+        ExternalString* external_string = ExternalString::cast(object);
+        size_t size = external_string->ExternalPayloadSize();
+        external_space_bytes[ExternalBackingStoreType::kExternalString] += size;
+      } else if (object->IsJSArrayBuffer()) {
         JSArrayBuffer* array_buffer = JSArrayBuffer::cast(object);
         if (ArrayBufferTracker::IsTracked(array_buffer)) {
           size_t size = NumberToSize(array_buffer->byte_length());
@@ -3591,7 +3599,7 @@ void LargeObjectSpace::Verify(Isolate* isolate) {
           object->IsWeakFixedArray() || object->IsWeakArrayList() ||
           object->IsPropertyArray() || object->IsByteArray() ||
           object->IsFeedbackVector() || object->IsBigInt() ||
-          object->IsFreeSpace());
+          object->IsFreeSpace() || object->IsFeedbackMetadata());
 
     // The object itself should look OK.
     object->ObjectVerify(isolate);
@@ -3641,9 +3649,8 @@ void LargeObjectSpace::Verify(Isolate* isolate) {
 void LargeObjectSpace::Print() {
   StdoutStream os;
   LargeObjectIterator it(this);
-  Isolate* isolate = heap()->isolate();
   for (HeapObject* obj = it.Next(); obj != nullptr; obj = it.Next()) {
-    obj->Print(isolate, os);
+    obj->Print(os);
   }
 }
 
diff --git a/deps/v8/src/heap/spaces.h b/deps/v8/src/heap/spaces.h
index 140cd200efe77a..c1ef24081723f3 100644
--- a/deps/v8/src/heap/spaces.h
+++ b/deps/v8/src/heap/spaces.h
@@ -759,6 +759,10 @@ class Page : public MemoryChunk {
   static Page* FromAddress(Address addr) {
     return reinterpret_cast<Page*>(OffsetFrom(addr) & ~kPageAlignmentMask);
   }
+  static Page* FromHeapObject(const HeapObject* o) {
+    return reinterpret_cast<Page*>(reinterpret_cast<Address>(o) &
+                                   ~kAlignmentMask);
+  }
 
   // Returns the page containing the address provided. The address can
   // potentially point righter after the page. To be also safe for tagged values
diff --git a/deps/v8/src/ic/accessor-assembler.cc b/deps/v8/src/ic/accessor-assembler.cc
index 1600bcc9fed526..f471381dd8d97b 100644
--- a/deps/v8/src/ic/accessor-assembler.cc
+++ b/deps/v8/src/ic/accessor-assembler.cc
@@ -2676,8 +2676,11 @@ void AccessorAssembler::KeyedLoadIC(const LoadICParameters* p) {
       // Try to internalize the {name}.
       Node* function = ExternalConstant(
           ExternalReference::try_internalize_string_function());
-      var_name.Bind(CallCFunction1(MachineType::AnyTagged(),
-                                   MachineType::AnyTagged(), function, name));
+      Node* const isolate_ptr =
+          ExternalConstant(ExternalReference::isolate_address(isolate()));
+      var_name.Bind(CallCFunction2(
+          MachineType::AnyTagged(), MachineType::Pointer(),
+          MachineType::AnyTagged(), function, isolate_ptr, name));
       Goto(&if_internalized);
     }
 
diff --git a/deps/v8/src/ic/ic.cc b/deps/v8/src/ic/ic.cc
index bcedbb967961be..5f84b2f190465b 100644
--- a/deps/v8/src/ic/ic.cc
+++ b/deps/v8/src/ic/ic.cc
@@ -804,7 +804,7 @@ Handle<Object> LoadIC::ComputeHandler(LookupIterator* lookup) {
         Handle<ObjectHashTable> exports(
             Handle<JSModuleNamespace>::cast(holder)->module()->exports(),
             isolate());
-        int entry = exports->FindEntry(isolate(), lookup->name(),
+        int entry = exports->FindEntry(roots, lookup->name(),
                                        Smi::ToInt(lookup->name()->GetHash()));
         // We found the accessor, so the entry must exist.
         DCHECK_NE(entry, ObjectHashTable::kNotFound);
diff --git a/deps/v8/src/inspector/v8-debugger-agent-impl.h b/deps/v8/src/inspector/v8-debugger-agent-impl.h
index f5623a8dc55509..65f7677b4753f5 100644
--- a/deps/v8/src/inspector/v8-debugger-agent-impl.h
+++ b/deps/v8/src/inspector/v8-debugger-agent-impl.h
@@ -6,6 +6,7 @@
 #define V8_INSPECTOR_V8_DEBUGGER_AGENT_IMPL_H_
 
 #include <deque>
+#include <unordered_map>
 #include <vector>
 
 #include "src/base/macros.h"
@@ -183,11 +184,11 @@ class V8DebuggerAgentImpl : public protocol::Debugger::Backend {
   bool isPaused() const;
 
   using ScriptsMap =
-      protocol::HashMap<String16, std::unique_ptr<V8DebuggerScript>>;
+      std::unordered_map<String16, std::unique_ptr<V8DebuggerScript>>;
   using BreakpointIdToDebuggerBreakpointIdsMap =
-      protocol::HashMap<String16, std::vector<v8::debug::BreakpointId>>;
+      std::unordered_map<String16, std::vector<v8::debug::BreakpointId>>;
   using DebuggerBreakpointIdToBreakpointIdMap =
-      protocol::HashMap<v8::debug::BreakpointId, String16>;
+      std::unordered_map<v8::debug::BreakpointId, String16>;
 
   V8InspectorImpl* m_inspector;
   V8Debugger* m_debugger;
@@ -216,7 +217,7 @@ class V8DebuggerAgentImpl : public protocol::Debugger::Backend {
   bool m_breakpointsActive = false;
 
   std::unique_ptr<V8Regex> m_blackboxPattern;
-  protocol::HashMap<String16, std::vector<std::pair<int, int>>>
+  std::unordered_map<String16, std::vector<std::pair<int, int>>>
       m_blackboxedPositions;
 
   DISALLOW_COPY_AND_ASSIGN(V8DebuggerAgentImpl);
diff --git a/deps/v8/src/inspector/v8-debugger.h b/deps/v8/src/inspector/v8-debugger.h
index dc3bb609c8ad51..72962dde316354 100644
--- a/deps/v8/src/inspector/v8-debugger.h
+++ b/deps/v8/src/inspector/v8-debugger.h
@@ -7,6 +7,7 @@
 
 #include <list>
 #include <unordered_map>
+#include <unordered_set>
 #include <vector>
 
 #include "src/base/macros.h"
@@ -203,9 +204,9 @@ class V8Debugger : public v8::debug::DebugDelegate,
   std::unique_ptr<V8StackTraceImpl> m_continueToLocationStack;
 
   using AsyncTaskToStackTrace =
-      protocol::HashMap<void*, std::weak_ptr<AsyncStackTrace>>;
+      std::unordered_map<void*, std::weak_ptr<AsyncStackTrace>>;
   AsyncTaskToStackTrace m_asyncTaskStacks;
-  protocol::HashSet<void*> m_recurringTasks;
+  std::unordered_set<void*> m_recurringTasks;
 
   int m_maxAsyncCallStacks;
   int m_maxAsyncCallStackDepth;
@@ -221,7 +222,7 @@ class V8Debugger : public v8::debug::DebugDelegate,
   std::list<std::shared_ptr<AsyncStackTrace>> m_allAsyncStacks;
   std::unordered_map<int, std::weak_ptr<StackFrame>> m_framesCache;
 
-  protocol::HashMap<V8DebuggerAgentImpl*, int> m_maxAsyncCallStackDepthMap;
+  std::unordered_map<V8DebuggerAgentImpl*, int> m_maxAsyncCallStackDepthMap;
   void* m_taskWithScheduledBreak = nullptr;
   String16 m_taskWithScheduledBreakDebuggerId;
 
@@ -233,13 +234,13 @@ class V8Debugger : public v8::debug::DebugDelegate,
   v8_inspector::V8StackTraceId m_scheduledAsyncCall;
 
   using StackTraceIdToStackTrace =
-      protocol::HashMap<uintptr_t, std::weak_ptr<AsyncStackTrace>>;
+      std::unordered_map<uintptr_t, std::weak_ptr<AsyncStackTrace>>;
   StackTraceIdToStackTrace m_storedStackTraces;
   uintptr_t m_lastStackTraceId = 0;
 
-  protocol::HashMap<int, std::pair<int64_t, int64_t>>
+  std::unordered_map<int, std::pair<int64_t, int64_t>>
       m_contextGroupIdToDebuggerId;
-  protocol::HashMap<String16, std::pair<int64_t, int64_t>>
+  std::unordered_map<String16, std::pair<int64_t, int64_t>>
       m_serializedDebuggerIdToDebuggerId;
 
   std::unique_ptr<TerminateExecutionCallback> m_terminateExecutionCallback;
diff --git a/deps/v8/src/inspector/v8-inspector-impl.h b/deps/v8/src/inspector/v8-inspector-impl.h
index 73a9253e9e8314..b255feed40628a 100644
--- a/deps/v8/src/inspector/v8-inspector-impl.h
+++ b/deps/v8/src/inspector/v8-inspector-impl.h
@@ -33,6 +33,7 @@
 
 #include <functional>
 #include <map>
+#include <unordered_map>
 
 #include "src/base/macros.h"
 #include "src/base/platform/mutex.h"
@@ -147,23 +148,23 @@ class V8InspectorImpl : public V8Inspector {
   int m_lastSessionId = 0;
   uint64_t m_isolateId;
 
-  using MuteExceptionsMap = protocol::HashMap<int, int>;
+  using MuteExceptionsMap = std::unordered_map<int, int>;
   MuteExceptionsMap m_muteExceptionsMap;
 
   using ContextByIdMap =
-      protocol::HashMap<int, std::unique_ptr<InspectedContext>>;
+      std::unordered_map<int, std::unique_ptr<InspectedContext>>;
   using ContextsByGroupMap =
-      protocol::HashMap<int, std::unique_ptr<ContextByIdMap>>;
+      std::unordered_map<int, std::unique_ptr<ContextByIdMap>>;
   ContextsByGroupMap m_contexts;
 
   // contextGroupId -> sessionId -> session
-  protocol::HashMap<int, std::map<int, V8InspectorSessionImpl*>> m_sessions;
+  std::unordered_map<int, std::map<int, V8InspectorSessionImpl*>> m_sessions;
 
   using ConsoleStorageMap =
-      protocol::HashMap<int, std::unique_ptr<V8ConsoleMessageStorage>>;
+      std::unordered_map<int, std::unique_ptr<V8ConsoleMessageStorage>>;
   ConsoleStorageMap m_consoleStorageMap;
 
-  protocol::HashMap<int, int> m_contextIdToGroupIdMap;
+  std::unordered_map<int, int> m_contextIdToGroupIdMap;
 
   std::unique_ptr<V8Console> m_console;
 
diff --git a/deps/v8/src/inspector/v8-runtime-agent-impl.h b/deps/v8/src/inspector/v8-runtime-agent-impl.h
index fb98236c268382..bf76cb849167f8 100644
--- a/deps/v8/src/inspector/v8-runtime-agent-impl.h
+++ b/deps/v8/src/inspector/v8-runtime-agent-impl.h
@@ -31,6 +31,8 @@
 #ifndef V8_INSPECTOR_V8_RUNTIME_AGENT_IMPL_H_
 #define V8_INSPECTOR_V8_RUNTIME_AGENT_IMPL_H_
 
+#include <unordered_map>
+
 #include "src/base/macros.h"
 #include "src/inspector/protocol/Forward.h"
 #include "src/inspector/protocol/Runtime.h"
@@ -137,7 +139,7 @@ class V8RuntimeAgentImpl : public protocol::Runtime::Backend {
   protocol::Runtime::Frontend m_frontend;
   V8InspectorImpl* m_inspector;
   bool m_enabled;
-  protocol::HashMap<String16, std::unique_ptr<v8::Global<v8::Script>>>
+  std::unordered_map<String16, std::unique_ptr<v8::Global<v8::Script>>>
       m_compiledScripts;
 
   DISALLOW_COPY_AND_ASSIGN(V8RuntimeAgentImpl);
diff --git a/deps/v8/src/interpreter/interpreter.cc b/deps/v8/src/interpreter/interpreter.cc
index cac8f45f4132e9..0446ed494dd04f 100644
--- a/deps/v8/src/interpreter/interpreter.cc
+++ b/deps/v8/src/interpreter/interpreter.cc
@@ -213,7 +213,7 @@ InterpreterCompilationJob::Status InterpreterCompilationJob::FinalizeJobImpl(
         compilation_info()->literal()->GetDebugName();
     os << "[generated bytecode for function: " << name.get() << "]"
        << std::endl;
-    bytecodes->Disassemble(isolate, os);
+    bytecodes->Disassemble(os);
     os << std::flush;
   }
 
diff --git a/deps/v8/src/intl.h b/deps/v8/src/intl.h
index e5d3441164ba48..e250e78fb081ef 100644
--- a/deps/v8/src/intl.h
+++ b/deps/v8/src/intl.h
@@ -28,7 +28,9 @@ enum class IcuService {
   kCollator,
   kDateFormat,
   kNumberFormat,
-  kPluralRules
+  kPluralRules,
+  kResourceBundle,
+  kRelativeDateTimeFormatter
 };
 
 const UChar* GetUCharBufferFromFlat(const String::FlatContent& flat,
diff --git a/deps/v8/src/isolate.cc b/deps/v8/src/isolate.cc
index 2291310188175a..9d4353461bceb9 100644
--- a/deps/v8/src/isolate.cc
+++ b/deps/v8/src/isolate.cc
@@ -535,7 +535,7 @@ class FrameArrayBuilder {
   bool full() { return elements_->FrameCount() >= limit_; }
 
   Handle<FrameArray> GetElements() {
-    elements_->ShrinkToFit();
+    elements_->ShrinkToFit(isolate_);
     return elements_;
   }
 
@@ -876,7 +876,7 @@ Handle<FixedArray> Isolate::CaptureCurrentStackTrace(
       frames_seen++;
     }
   }
-  return FixedArray::ShrinkOrEmpty(stack_trace_elems, frames_seen);
+  return FixedArray::ShrinkOrEmpty(this, stack_trace_elems, frames_seen);
 }
 
 
@@ -1199,7 +1199,7 @@ Object* Isolate::Throw(Object* raw_exception, MessageLocation* location) {
         printf(", line %d\n", script->GetLineNumber(location->start_pos()) + 1);
       }
     }
-    raw_exception->Print(this);
+    raw_exception->Print();
     printf("Stack Trace:\n");
     PrintStack(stdout);
     printf("=========================================================\n");
@@ -2436,7 +2436,7 @@ class VerboseAccountingAllocator : public AccountingAllocator {
         "\"name\": \"%s\", "
         "\"size\": %" PRIuS
         ","
-        "\"nesting\": %" PRIuS "}\n",
+        "\"nesting\": %zu}\n",
         type, reinterpret_cast<void*>(heap_->isolate()),
         heap_->isolate()->time_millis_since_init(),
         reinterpret_cast<const void*>(zone), zone->name(),
diff --git a/deps/v8/src/isolate.h b/deps/v8/src/isolate.h
index 00522a66d2e058..4483e1ff9145b2 100644
--- a/deps/v8/src/isolate.h
+++ b/deps/v8/src/isolate.h
@@ -431,6 +431,7 @@ typedef std::vector<HeapObject*> DebugObjectCache;
   V(ExtensionCallback, wasm_module_callback, &NoExtension)                    \
   V(ExtensionCallback, wasm_instance_callback, &NoExtension)                  \
   V(ApiImplementationCallback, wasm_compile_streaming_callback, nullptr)      \
+  V(WasmStreamingCallback, wasm_streaming_callback, nullptr)                  \
   /* State for Relocatable. */                                                \
   V(Relocatable*, relocatable_top, nullptr)                                   \
   V(DebugObjectCache*, string_stream_debug_object_cache, nullptr)             \
diff --git a/deps/v8/src/js/OWNERS b/deps/v8/src/js/OWNERS
index de2152c0566dce..2ca285742b72f4 100644
--- a/deps/v8/src/js/OWNERS
+++ b/deps/v8/src/js/OWNERS
@@ -3,6 +3,7 @@ set noparent
 adamk@chromium.org
 bmeurer@chromium.org
 cbruni@chromium.org
+gsathya@chromium.org
 ishell@chromium.org
 jgruber@chromium.org
 jkummerow@chromium.org
diff --git a/deps/v8/src/js/intl.js b/deps/v8/src/js/intl.js
index 694c0afa74d55e..c02c4fa97d18a4 100644
--- a/deps/v8/src/js/intl.js
+++ b/deps/v8/src/js/intl.js
@@ -354,23 +354,29 @@ function bestFitSupportedLocalesOf(requestedLocales, availableLocales) {
 function getGetOption(options, caller) {
   if (IS_UNDEFINED(options)) throw %make_error(kDefaultOptionsMissing, caller);
 
-  var getOption = function getOption(property, type, values, defaultValue) {
-    if (!IS_UNDEFINED(options[property])) {
-      var value = options[property];
+  // Ecma 402 #sec-getoption
+  var getOption = function (property, type, values, fallback) {
+    // 1. Let value be ? Get(options, property).
+    var value = options[property];
+    // 2. If value is not undefined, then
+    if (!IS_UNDEFINED(value)) {
       switch (type) {
+        // If type is "boolean", then let value be ToBoolean(value).
         case 'boolean':
           value = TO_BOOLEAN(value);
           break;
+        // If type is "string", then let value be ToString(value).
         case 'string':
           value = TO_STRING(value);
           break;
-        case 'number':
-          value = TO_NUMBER(value);
-          break;
+        // Assert: type is "boolean" or "string".
         default:
           throw %make_error(kWrongValueType);
       }
 
+      // d. If values is not undefined, then
+      // If values does not contain an element equal to value, throw a
+      // RangeError exception.
       if (!IS_UNDEFINED(values) && %ArrayIndexOf(values, value, 0) === -1) {
         throw %make_range_error(kValueOutOfRange, value, caller, property);
       }
@@ -378,7 +384,7 @@ function getGetOption(options, caller) {
       return value;
     }
 
-    return defaultValue;
+    return fallback;
   }
 
   return getOption;
diff --git a/deps/v8/src/keys.cc b/deps/v8/src/keys.cc
index 12bc791ba48026..8ecbe0a1d7b2ad 100644
--- a/deps/v8/src/keys.cc
+++ b/deps/v8/src/keys.cc
@@ -136,7 +136,7 @@ MaybeHandle<FixedArray> FilterProxyKeys(KeyAccumulator* accumulator,
     }
     store_position++;
   }
-  return FixedArray::ShrinkOrEmpty(keys, store_position);
+  return FixedArray::ShrinkOrEmpty(isolate, keys, store_position);
 }
 
 // Returns "nothing" in case of exception, "true" on success.
@@ -216,7 +216,7 @@ void KeyAccumulator::AddShadowingKey(Handle<Object> key) {
   if (shadowing_keys_.is_null()) {
     shadowing_keys_ = ObjectHashSet::New(isolate_, 16);
   }
-  shadowing_keys_ = ObjectHashSet::Add(shadowing_keys_, key);
+  shadowing_keys_ = ObjectHashSet::Add(isolate(), shadowing_keys_, key);
 }
 
 namespace {
diff --git a/deps/v8/src/layout-descriptor.h b/deps/v8/src/layout-descriptor.h
index 176109bdaac98d..623ae0508983fa 100644
--- a/deps/v8/src/layout-descriptor.h
+++ b/deps/v8/src/layout-descriptor.h
@@ -83,7 +83,7 @@ class LayoutDescriptor : public ByteArray {
 
 #ifdef OBJECT_PRINT
   // For our gdb macros, we should perhaps change these in the future.
-  void Print(Isolate* isolate);
+  void Print();
 
   void ShortPrint(std::ostream& os);
   void Print(std::ostream& os);  // NOLINT
diff --git a/deps/v8/src/log.cc b/deps/v8/src/log.cc
index cf0cc014fbb50e..a1f3d38055b3da 100644
--- a/deps/v8/src/log.cc
+++ b/deps/v8/src/log.cc
@@ -1744,7 +1744,7 @@ void Logger::MapDetails(Map* map) {
       << reinterpret_cast<void*>(map) << kNext;
   if (FLAG_trace_maps_details) {
     std::ostringstream buffer;
-    map->PrintMapDetails(isolate_, buffer);
+    map->PrintMapDetails(buffer);
     msg << buffer.str().c_str();
   }
   msg.WriteToLogFile();
diff --git a/deps/v8/src/mips/simulator-mips.cc b/deps/v8/src/mips/simulator-mips.cc
index 078ce821010f48..d58b899755ca7f 100644
--- a/deps/v8/src/mips/simulator-mips.cc
+++ b/deps/v8/src/mips/simulator-mips.cc
@@ -478,7 +478,7 @@ void MipsDebugger::Debug() {
             Object* obj = reinterpret_cast<Object*>(value);
             os << arg1 << ": \n";
 #ifdef DEBUG
-            obj->Print(sim_->isolate_, os);
+            obj->Print(os);
             os << "\n";
 #else
             os << Brief(obj) << "\n";
diff --git a/deps/v8/src/mips64/simulator-mips64.cc b/deps/v8/src/mips64/simulator-mips64.cc
index 5bfb9e9d550a5c..f5231fe89feadc 100644
--- a/deps/v8/src/mips64/simulator-mips64.cc
+++ b/deps/v8/src/mips64/simulator-mips64.cc
@@ -423,7 +423,7 @@ void MipsDebugger::Debug() {
             Object* obj = reinterpret_cast<Object*>(value);
             os << arg1 << ": \n";
 #ifdef DEBUG
-            obj->Print(sim_->isolate_, os);
+            obj->Print(os);
             os << "\n";
 #else
             os << Brief(obj) << "\n";
diff --git a/deps/v8/src/objects-body-descriptors-inl.h b/deps/v8/src/objects-body-descriptors-inl.h
index e882335dc06f3a..d4ee72654fcf92 100644
--- a/deps/v8/src/objects-body-descriptors-inl.h
+++ b/deps/v8/src/objects-body-descriptors-inl.h
@@ -388,6 +388,24 @@ class FeedbackVector::BodyDescriptor final : public BodyDescriptorBase {
   }
 };
 
+class PreParsedScopeData::BodyDescriptor final : public BodyDescriptorBase {
+ public:
+  static bool IsValidSlot(Map* map, HeapObject* obj, int offset) {
+    return offset == kScopeDataOffset || offset >= kChildDataStartOffset;
+  }
+
+  template <typename ObjectVisitor>
+  static inline void IterateBody(Map* map, HeapObject* obj, int object_size,
+                                 ObjectVisitor* v) {
+    IteratePointer(obj, kScopeDataOffset, v);
+    IteratePointers(obj, kChildDataStartOffset, object_size, v);
+  }
+
+  static inline int SizeOf(Map* map, HeapObject* obj) {
+    return PreParsedScopeData::SizeFor(PreParsedScopeData::cast(obj)->length());
+  }
+};
+
 class PrototypeInfo::BodyDescriptor final : public BodyDescriptorBase {
  public:
   static bool IsValidSlot(Map* map, HeapObject* obj, int offset) {
@@ -761,6 +779,9 @@ ReturnType BodyDescriptorApply(InstanceType type, T1 p1, T2 p2, T3 p3, T4 p4) {
     case CODE_DATA_CONTAINER_TYPE:
       return Op::template apply<CodeDataContainer::BodyDescriptor>(p1, p2, p3,
                                                                    p4);
+    case PRE_PARSED_SCOPE_DATA_TYPE:
+      return Op::template apply<PreParsedScopeData::BodyDescriptor>(p1, p2, p3,
+                                                                    p4);
     case UNCOMPILED_DATA_WITH_PRE_PARSED_SCOPE_TYPE:
       return Op::template apply<
           UncompiledDataWithPreParsedScope::BodyDescriptor>(p1, p2, p3, p4);
diff --git a/deps/v8/src/objects-debug.cc b/deps/v8/src/objects-debug.cc
index dca45ba0bbed83..0956240fd1b9c0 100644
--- a/deps/v8/src/objects-debug.cc
+++ b/deps/v8/src/objects-debug.cc
@@ -321,6 +321,9 @@ void HeapObject::HeapObjectVerify(Isolate* isolate) {
     case FOREIGN_TYPE:
       Foreign::cast(this)->ForeignVerify(isolate);
       break;
+    case PRE_PARSED_SCOPE_DATA_TYPE:
+      PreParsedScopeData::cast(this)->PreParsedScopeDataVerify(isolate);
+      break;
     case UNCOMPILED_DATA_WITHOUT_PRE_PARSED_SCOPE_TYPE:
       UncompiledDataWithoutPreParsedScope::cast(this)
           ->UncompiledDataWithoutPreParsedScopeVerify(isolate);
@@ -573,10 +576,10 @@ void Map::MapVerify(Isolate* isolate) {
         !Map::cast(GetBackPointer())->is_stable());
   VerifyHeapPointer(prototype());
   VerifyHeapPointer(instance_descriptors());
-  SLOW_DCHECK(instance_descriptors()->IsSortedNoDuplicates(isolate));
+  SLOW_DCHECK(instance_descriptors()->IsSortedNoDuplicates());
   DisallowHeapAllocation no_gc;
   SLOW_DCHECK(
-      TransitionsAccessor(isolate, this, &no_gc).IsSortedNoDuplicates(isolate));
+      TransitionsAccessor(isolate, this, &no_gc).IsSortedNoDuplicates());
   SLOW_DCHECK(TransitionsAccessor(isolate, this, &no_gc)
                   .IsConsistentWithBackPointers());
   SLOW_DCHECK(!FLAG_unbox_double_fields ||
@@ -1789,7 +1792,13 @@ void StackFrameInfo::StackFrameInfoVerify(Isolate* isolate) {
 void PreParsedScopeData::PreParsedScopeDataVerify(Isolate* isolate) {
   CHECK(IsPreParsedScopeData());
   CHECK(scope_data()->IsByteArray());
-  CHECK(child_data()->IsFixedArray());
+  CHECK_GE(length(), 0);
+
+  for (int i = 0; i < length(); ++i) {
+    Object* child = child_data(i);
+    CHECK(child->IsPreParsedScopeData() || child->IsNull());
+    VerifyPointer(child);
+  }
 }
 
 void UncompiledDataWithPreParsedScope::UncompiledDataWithPreParsedScopeVerify(
@@ -1940,21 +1949,20 @@ void JSObject::SpillInformation::Print() {
   PrintF("\n");
 }
 
-bool DescriptorArray::IsSortedNoDuplicates(Isolate* isolate,
-                                           int valid_entries) {
+bool DescriptorArray::IsSortedNoDuplicates(int valid_entries) {
   if (valid_entries == -1) valid_entries = number_of_descriptors();
   Name* current_key = nullptr;
   uint32_t current = 0;
   for (int i = 0; i < number_of_descriptors(); i++) {
     Name* key = GetSortedKey(i);
     if (key == current_key) {
-      Print(isolate);
+      Print();
       return false;
     }
     current_key = key;
     uint32_t hash = GetSortedKey(i)->Hash();
     if (hash < current) {
-      Print(isolate);
+      Print();
       return false;
     }
     current = hash;
@@ -1962,8 +1970,7 @@ bool DescriptorArray::IsSortedNoDuplicates(Isolate* isolate,
   return true;
 }
 
-bool TransitionArray::IsSortedNoDuplicates(Isolate* isolate,
-                                           int valid_entries) {
+bool TransitionArray::IsSortedNoDuplicates(int valid_entries) {
   DCHECK_EQ(valid_entries, -1);
   Name* prev_key = nullptr;
   PropertyKind prev_kind = kData;
@@ -1975,10 +1982,11 @@ bool TransitionArray::IsSortedNoDuplicates(Isolate* isolate,
     uint32_t hash = key->Hash();
     PropertyKind kind = kData;
     PropertyAttributes attributes = NONE;
-    if (!TransitionsAccessor::IsSpecialTransition(isolate, key)) {
+    if (!TransitionsAccessor::IsSpecialTransition(key->GetReadOnlyRoots(),
+                                                  key)) {
       Map* target = GetTarget(i);
       PropertyDetails details =
-          TransitionsAccessor::GetTargetDetails(isolate, key, target);
+          TransitionsAccessor::GetTargetDetails(key, target);
       kind = details.kind();
       attributes = details.attributes();
     } else {
@@ -1989,7 +1997,7 @@ bool TransitionArray::IsSortedNoDuplicates(Isolate* isolate,
     int cmp = CompareKeys(prev_key, prev_hash, prev_kind, prev_attributes, key,
                           hash, kind, attributes);
     if (cmp >= 0) {
-      Print(isolate);
+      Print();
       return false;
     }
     prev_key = key;
@@ -2000,10 +2008,10 @@ bool TransitionArray::IsSortedNoDuplicates(Isolate* isolate,
   return true;
 }
 
-bool TransitionsAccessor::IsSortedNoDuplicates(Isolate* isolate) {
+bool TransitionsAccessor::IsSortedNoDuplicates() {
   // Simple and non-existent transitions are always sorted.
   if (encoding() != kFullTransitionArray) return true;
-  return transitions()->IsSortedNoDuplicates(isolate);
+  return transitions()->IsSortedNoDuplicates();
 }
 
 
diff --git a/deps/v8/src/objects-definitions.h b/deps/v8/src/objects-definitions.h
index a16158f65794f2..5e922a487cdc79 100644
--- a/deps/v8/src/objects-definitions.h
+++ b/deps/v8/src/objects-definitions.h
@@ -157,6 +157,7 @@ namespace internal {
   V(FEEDBACK_CELL_TYPE)                                         \
   V(FEEDBACK_VECTOR_TYPE)                                       \
   V(LOAD_HANDLER_TYPE)                                          \
+  V(PRE_PARSED_SCOPE_DATA_TYPE)                                 \
   V(PROPERTY_ARRAY_TYPE)                                        \
   V(PROPERTY_CELL_TYPE)                                         \
   V(SHARED_FUNCTION_INFO_TYPE)                                  \
diff --git a/deps/v8/src/objects-inl.h b/deps/v8/src/objects-inl.h
index 7013ec9dc42977..59a2096cd8ad82 100644
--- a/deps/v8/src/objects-inl.h
+++ b/deps/v8/src/objects-inl.h
@@ -131,7 +131,7 @@ TYPE_CHECKER(NumberDictionary, NUMBER_DICTIONARY_TYPE)
 TYPE_CHECKER(Oddball, ODDBALL_TYPE)
 TYPE_CHECKER(OrderedHashMap, ORDERED_HASH_MAP_TYPE)
 TYPE_CHECKER(OrderedHashSet, ORDERED_HASH_SET_TYPE)
-TYPE_CHECKER(PreParsedScopeData, TUPLE2_TYPE)
+TYPE_CHECKER(PreParsedScopeData, PRE_PARSED_SCOPE_DATA_TYPE)
 TYPE_CHECKER(PropertyArray, PROPERTY_ARRAY_TYPE)
 TYPE_CHECKER(PropertyCell, PROPERTY_CELL_TYPE)
 TYPE_CHECKER(PropertyDescriptorObject, FIXED_ARRAY_TYPE)
@@ -645,7 +645,6 @@ CAST_ACCESSOR(OrderedHashMap)
 CAST_ACCESSOR(OrderedHashSet)
 CAST_ACCESSOR(PropertyArray)
 CAST_ACCESSOR(PropertyCell)
-CAST_ACCESSOR(PrototypeInfo)
 CAST_ACCESSOR(RegExpMatchInfo)
 CAST_ACCESSOR(ScopeInfo)
 CAST_ACCESSOR(SimpleNumberDictionary)
@@ -1447,8 +1446,8 @@ void Oddball::set_kind(byte value) {
 
 
 // static
-Handle<Object> Oddball::ToNumber(Handle<Oddball> input) {
-  return handle(input->to_number(), input->GetIsolate());
+Handle<Object> Oddball::ToNumber(Isolate* isolate, Handle<Oddball> input) {
+  return handle(input->to_number(), isolate);
 }
 
 
@@ -1967,9 +1966,8 @@ int LinearSearch(T* array, Name* name, int valid_entries,
 }
 
 template <SearchMode search_mode, typename T>
-int Search(Isolate* isolate, T* array, Name* name, int valid_entries,
-           int* out_insertion_index) {
-  SLOW_DCHECK(array->IsSortedNoDuplicates(isolate));
+int Search(T* array, Name* name, int valid_entries, int* out_insertion_index) {
+  SLOW_DCHECK(array->IsSortedNoDuplicates());
 
   if (valid_entries == 0) {
     if (search_mode == ALL_ENTRIES && out_insertion_index != nullptr) {
@@ -1993,8 +1991,8 @@ int Search(Isolate* isolate, T* array, Name* name, int valid_entries,
 
 int DescriptorArray::Search(Name* name, int valid_descriptors) {
   DCHECK(name->IsUniqueName());
-  return internal::Search<VALID_ENTRIES>(GetIsolate(), this, name,
-                                         valid_descriptors, nullptr);
+  return internal::Search<VALID_ENTRIES>(this, name, valid_descriptors,
+                                         nullptr);
 }
 
 int DescriptorArray::Search(Name* name, Map* map) {
@@ -2101,12 +2099,6 @@ FieldType* DescriptorArray::GetFieldType(int descriptor_number) {
   return Map::UnwrapFieldType(wrapped_type);
 }
 
-void DescriptorArray::Get(int descriptor_number, Descriptor* desc) {
-  desc->Init(handle(GetKey(descriptor_number), GetIsolate()),
-             MaybeObjectHandle(GetStrongValue(descriptor_number), GetIsolate()),
-             GetDetails(descriptor_number));
-}
-
 void DescriptorArray::Set(int descriptor_number, Name* key, MaybeObject* value,
                           PropertyDetails details) {
   // Range check.
@@ -2367,6 +2359,10 @@ int HeapObject::SizeFromMap(Map* map) const {
   if (instance_type == BIGINT_TYPE) {
     return BigInt::SizeFor(reinterpret_cast<const BigInt*>(this)->length());
   }
+  if (instance_type == PRE_PARSED_SCOPE_DATA_TYPE) {
+    return PreParsedScopeData::SizeFor(
+        reinterpret_cast<const PreParsedScopeData*>(this)->length());
+  }
   DCHECK(instance_type == CODE_TYPE);
   return reinterpret_cast<const Code*>(this)->CodeSize();
 }
@@ -2393,28 +2389,6 @@ SMI_ACCESSORS(AsyncGeneratorRequest, resume_mode, kResumeModeOffset)
 ACCESSORS(AsyncGeneratorRequest, value, Object, kValueOffset)
 ACCESSORS(AsyncGeneratorRequest, promise, Object, kPromiseOffset)
 
-Map* PrototypeInfo::ObjectCreateMap() {
-  return Map::cast(object_create_map()->ToWeakHeapObject());
-}
-
-// static
-void PrototypeInfo::SetObjectCreateMap(Handle<PrototypeInfo> info,
-                                       Handle<Map> map) {
-  info->set_object_create_map(HeapObjectReference::Weak(*map));
-}
-
-bool PrototypeInfo::HasObjectCreateMap() {
-  MaybeObject* cache = object_create_map();
-  return cache->IsWeakHeapObject();
-}
-
-ACCESSORS(PrototypeInfo, weak_cell, Object, kWeakCellOffset)
-ACCESSORS(PrototypeInfo, prototype_users, Object, kPrototypeUsersOffset)
-WEAK_ACCESSORS(PrototypeInfo, object_create_map, kObjectCreateMapOffset)
-SMI_ACCESSORS(PrototypeInfo, registry_slot, kRegistrySlotOffset)
-SMI_ACCESSORS(PrototypeInfo, bit_field, kBitFieldOffset)
-BOOL_ACCESSORS(PrototypeInfo, bit_field, should_be_fast_map, kShouldBeFastBit)
-
 ACCESSORS(Tuple2, value1, Object, kValue1Offset)
 ACCESSORS(Tuple2, value2, Object, kValue2Offset)
 ACCESSORS(Tuple3, value3, Object, kValue3Offset)
@@ -3182,15 +3156,13 @@ PropertyCell* GlobalDictionary::CellAt(int entry) {
   return PropertyCell::cast(KeyAt(entry));
 }
 
-bool GlobalDictionaryShape::IsLive(Isolate* isolate, Object* k) {
-  ReadOnlyRoots roots(isolate);
+bool GlobalDictionaryShape::IsLive(ReadOnlyRoots roots, Object* k) {
   DCHECK_NE(roots.the_hole_value(), k);
   return k != roots.undefined_value();
 }
 
-bool GlobalDictionaryShape::IsKey(Isolate* isolate, Object* k) {
-  return IsLive(isolate, k) &&
-         !PropertyCell::cast(k)->value()->IsTheHole(isolate);
+bool GlobalDictionaryShape::IsKey(ReadOnlyRoots roots, Object* k) {
+  return IsLive(roots, k) && !PropertyCell::cast(k)->value()->IsTheHole(roots);
 }
 
 Name* GlobalDictionary::NameAt(int entry) { return CellAt(entry)->name(); }
@@ -3432,6 +3404,11 @@ bool ScopeInfo::HasSimpleParameters() const {
 FOR_EACH_SCOPE_INFO_NUMERIC_FIELD(FIELD_ACCESSORS)
 #undef FIELD_ACCESSORS
 
+FreshlyAllocatedBigInt* FreshlyAllocatedBigInt::cast(Object* object) {
+  SLOW_DCHECK(object->IsBigInt());
+  return reinterpret_cast<FreshlyAllocatedBigInt*>(object);
+}
+
 }  // namespace internal
 }  // namespace v8
 
diff --git a/deps/v8/src/objects-printer.cc b/deps/v8/src/objects-printer.cc
index 9b0a1ec7d7a61c..aeadc2d3981615 100644
--- a/deps/v8/src/objects-printer.cc
+++ b/deps/v8/src/objects-printer.cc
@@ -41,18 +41,18 @@ namespace internal {
 
 #ifdef OBJECT_PRINT
 
-void Object::Print(Isolate* isolate) {
+void Object::Print() {
   StdoutStream os;
-  this->Print(isolate, os);
+  this->Print(os);
   os << std::flush;
 }
 
-void Object::Print(Isolate* isolate, std::ostream& os) {  // NOLINT
+void Object::Print(std::ostream& os) {  // NOLINT
   if (IsSmi()) {
     os << "Smi: " << std::hex << "0x" << Smi::ToInt(this);
     os << std::dec << " (" << Smi::ToInt(this) << ")\n";
   } else {
-    HeapObject::cast(this)->HeapObjectPrint(isolate, os);
+    HeapObject::cast(this)->HeapObjectPrint(os);
   }
 }
 
@@ -70,11 +70,9 @@ void HeapObject::PrintHeader(std::ostream& os, const char* id) {  // NOLINT
   if (!IsMap()) os << "\n - map: " << Brief(map());
 }
 
-void HeapObject::HeapObjectPrint(Isolate* isolate,
-                                 std::ostream& os) {  // NOLINT
+void HeapObject::HeapObjectPrint(std::ostream& os) {  // NOLINT
   InstanceType instance_type = map()->instance_type();
 
-  HandleScope scope(isolate);
   if (instance_type < FIRST_NONSTRING_TYPE) {
     String::cast(this)->StringPrint(os);
     os << "\n";
@@ -83,10 +81,10 @@ void HeapObject::HeapObjectPrint(Isolate* isolate,
 
   switch (instance_type) {
     case SYMBOL_TYPE:
-      Symbol::cast(this)->SymbolPrint(isolate, os);
+      Symbol::cast(this)->SymbolPrint(os);
       break;
     case MAP_TYPE:
-      Map::cast(this)->MapPrint(isolate, os);
+      Map::cast(this)->MapPrint(os);
       break;
     case HEAP_NUMBER_TYPE:
       HeapNumber::cast(this)->HeapNumberPrint(os);
@@ -143,16 +141,16 @@ void HeapObject::HeapObjectPrint(Isolate* isolate,
       ByteArray::cast(this)->ByteArrayPrint(os);
       break;
     case BYTECODE_ARRAY_TYPE:
-      BytecodeArray::cast(this)->BytecodeArrayPrint(isolate, os);
+      BytecodeArray::cast(this)->BytecodeArrayPrint(os);
       break;
     case DESCRIPTOR_ARRAY_TYPE:
       DescriptorArray::cast(this)->DescriptorArrayPrint(os);
       break;
     case TRANSITION_ARRAY_TYPE:
-      TransitionArray::cast(this)->TransitionArrayPrint(isolate, os);
+      TransitionArray::cast(this)->TransitionArrayPrint(os);
       break;
     case FEEDBACK_CELL_TYPE:
-      FeedbackCell::cast(this)->FeedbackCellPrint(isolate, os);
+      FeedbackCell::cast(this)->FeedbackCellPrint(os);
       break;
     case FEEDBACK_VECTOR_TYPE:
       FeedbackVector::cast(this)->FeedbackVectorPrint(os);
@@ -184,47 +182,46 @@ void HeapObject::HeapObjectPrint(Isolate* isolate,
     case WASM_MEMORY_TYPE:
     case WASM_MODULE_TYPE:
     case WASM_TABLE_TYPE:
-      JSObject::cast(this)->JSObjectPrint(isolate, os);
+      JSObject::cast(this)->JSObjectPrint(os);
       break;
     case WASM_INSTANCE_TYPE:
       WasmInstanceObject::cast(this)->WasmInstanceObjectPrint(os);
       break;
     case JS_GENERATOR_OBJECT_TYPE:
-      JSGeneratorObject::cast(this)->JSGeneratorObjectPrint(isolate, os);
+      JSGeneratorObject::cast(this)->JSGeneratorObjectPrint(os);
       break;
     case JS_PROMISE_TYPE:
-      JSPromise::cast(this)->JSPromisePrint(isolate, os);
+      JSPromise::cast(this)->JSPromisePrint(os);
       break;
     case JS_ARRAY_TYPE:
-      JSArray::cast(this)->JSArrayPrint(isolate, os);
+      JSArray::cast(this)->JSArrayPrint(os);
       break;
     case JS_REGEXP_TYPE:
-      JSRegExp::cast(this)->JSRegExpPrint(isolate, os);
+      JSRegExp::cast(this)->JSRegExpPrint(os);
       break;
     case JS_REGEXP_STRING_ITERATOR_TYPE:
-      JSRegExpStringIterator::cast(this)->JSRegExpStringIteratorPrint(isolate,
-                                                                      os);
+      JSRegExpStringIterator::cast(this)->JSRegExpStringIteratorPrint(os);
       break;
     case ODDBALL_TYPE:
-      Oddball::cast(this)->to_string()->Print(isolate, os);
+      Oddball::cast(this)->to_string()->Print(os);
       break;
     case JS_BOUND_FUNCTION_TYPE:
-      JSBoundFunction::cast(this)->JSBoundFunctionPrint(isolate, os);
+      JSBoundFunction::cast(this)->JSBoundFunctionPrint(os);
       break;
     case JS_FUNCTION_TYPE:
-      JSFunction::cast(this)->JSFunctionPrint(isolate, os);
+      JSFunction::cast(this)->JSFunctionPrint(os);
       break;
     case JS_GLOBAL_PROXY_TYPE:
-      JSGlobalProxy::cast(this)->JSGlobalProxyPrint(isolate, os);
+      JSGlobalProxy::cast(this)->JSGlobalProxyPrint(os);
       break;
     case JS_GLOBAL_OBJECT_TYPE:
-      JSGlobalObject::cast(this)->JSGlobalObjectPrint(isolate, os);
+      JSGlobalObject::cast(this)->JSGlobalObjectPrint(os);
       break;
     case JS_VALUE_TYPE:
-      JSValue::cast(this)->JSValuePrint(isolate, os);
+      JSValue::cast(this)->JSValuePrint(os);
       break;
     case JS_DATE_TYPE:
-      JSDate::cast(this)->JSDatePrint(isolate, os);
+      JSDate::cast(this)->JSDatePrint(os);
       break;
     case CODE_TYPE:
       Code::cast(this)->CodePrint(os);
@@ -236,28 +233,28 @@ void HeapObject::HeapObjectPrint(Isolate* isolate,
       JSProxy::cast(this)->JSProxyPrint(os);
       break;
     case JS_SET_TYPE:
-      JSSet::cast(this)->JSSetPrint(isolate, os);
+      JSSet::cast(this)->JSSetPrint(os);
       break;
     case JS_MAP_TYPE:
-      JSMap::cast(this)->JSMapPrint(isolate, os);
+      JSMap::cast(this)->JSMapPrint(os);
       break;
     case JS_SET_KEY_VALUE_ITERATOR_TYPE:
     case JS_SET_VALUE_ITERATOR_TYPE:
-      JSSetIterator::cast(this)->JSSetIteratorPrint(isolate, os);
+      JSSetIterator::cast(this)->JSSetIteratorPrint(os);
       break;
     case JS_MAP_KEY_ITERATOR_TYPE:
     case JS_MAP_KEY_VALUE_ITERATOR_TYPE:
     case JS_MAP_VALUE_ITERATOR_TYPE:
-      JSMapIterator::cast(this)->JSMapIteratorPrint(isolate, os);
+      JSMapIterator::cast(this)->JSMapIteratorPrint(os);
       break;
     case JS_WEAK_MAP_TYPE:
-      JSWeakMap::cast(this)->JSWeakMapPrint(isolate, os);
+      JSWeakMap::cast(this)->JSWeakMapPrint(os);
       break;
     case JS_WEAK_SET_TYPE:
-      JSWeakSet::cast(this)->JSWeakSetPrint(isolate, os);
+      JSWeakSet::cast(this)->JSWeakSetPrint(os);
       break;
     case JS_MODULE_NAMESPACE_TYPE:
-      JSModuleNamespace::cast(this)->JSModuleNamespacePrint(isolate, os);
+      JSModuleNamespace::cast(this)->JSModuleNamespacePrint(os);
       break;
     case FOREIGN_TYPE:
       Foreign::cast(this)->ForeignPrint(os);
@@ -265,6 +262,9 @@ void HeapObject::HeapObjectPrint(Isolate* isolate,
     case CALL_HANDLER_INFO_TYPE:
       CallHandlerInfo::cast(this)->CallHandlerInfoPrint(os);
       break;
+    case PRE_PARSED_SCOPE_DATA_TYPE:
+      PreParsedScopeData::cast(this)->PreParsedScopeDataPrint(os);
+      break;
     case UNCOMPILED_DATA_WITHOUT_PRE_PARSED_SCOPE_TYPE:
       UncompiledDataWithoutPreParsedScope::cast(this)
           ->UncompiledDataWithoutPreParsedScopePrint(os);
@@ -277,7 +277,7 @@ void HeapObject::HeapObjectPrint(Isolate* isolate,
       SharedFunctionInfo::cast(this)->SharedFunctionInfoPrint(os);
       break;
     case JS_MESSAGE_OBJECT_TYPE:
-      JSMessageObject::cast(this)->JSMessageObjectPrint(isolate, os);
+      JSMessageObject::cast(this)->JSMessageObjectPrint(os);
       break;
     case CELL_TYPE:
       Cell::cast(this)->CellPrint(os);
@@ -289,23 +289,23 @@ void HeapObject::HeapObjectPrint(Isolate* isolate,
       WeakCell::cast(this)->WeakCellPrint(os);
       break;
     case JS_ARRAY_BUFFER_TYPE:
-      JSArrayBuffer::cast(this)->JSArrayBufferPrint(isolate, os);
+      JSArrayBuffer::cast(this)->JSArrayBufferPrint(os);
       break;
     case JS_ARRAY_ITERATOR_TYPE:
-      JSArrayIterator::cast(this)->JSArrayIteratorPrint(isolate, os);
+      JSArrayIterator::cast(this)->JSArrayIteratorPrint(os);
       break;
     case JS_TYPED_ARRAY_TYPE:
-      JSTypedArray::cast(this)->JSTypedArrayPrint(isolate, os);
+      JSTypedArray::cast(this)->JSTypedArrayPrint(os);
       break;
     case JS_DATA_VIEW_TYPE:
-      JSDataView::cast(this)->JSDataViewPrint(isolate, os);
+      JSDataView::cast(this)->JSDataViewPrint(os);
       break;
 #ifdef V8_INTL_SUPPORT
     case JS_INTL_LOCALE_TYPE:
       JSLocale::cast(this)->JSLocalePrint(os);
       break;
     case JS_INTL_RELATIVE_TIME_FORMAT_TYPE:
-      JSRelativeTimeFormat::cast(this)->JSRelativeTimeFormatPrint(isolate, os);
+      JSRelativeTimeFormat::cast(this)->JSRelativeTimeFormatPrint(os);
       break;
 #endif  // V8_INTL_SUPPORT
 #define MAKE_STRUCT_CASE(NAME, Name, name) \
@@ -373,10 +373,9 @@ void ByteArray::ByteArrayPrint(std::ostream& os) {  // NOLINT
   os << "byte array, data starts at " << GetDataStartAddress();
 }
 
-void BytecodeArray::BytecodeArrayPrint(Isolate* isolate,
-                                       std::ostream& os) {  // NOLINT
+void BytecodeArray::BytecodeArrayPrint(std::ostream& os) {  // NOLINT
   HeapObject::PrintHeader(os, "BytecodeArray");
-  Disassemble(isolate, os);
+  Disassemble(os);
 }
 
 
@@ -598,9 +597,9 @@ void JSObject::PrintElements(std::ostream& os) {  // NOLINT
   os << "\n }\n";
 }
 
-static void JSObjectPrintHeader(Isolate* isolate, std::ostream& os,
-                                JSObject* obj,
+static void JSObjectPrintHeader(std::ostream& os, JSObject* obj,
                                 const char* id) {  // NOLINT
+  Isolate* isolate = obj->GetIsolate();
   obj->PrintHeader(os, id);
   // Don't call GetElementsKind, its validation code can cause the printer to
   // fail when debugging.
@@ -649,14 +648,13 @@ static void JSObjectPrintBody(std::ostream& os,
   }
 }
 
-void JSObject::JSObjectPrint(Isolate* isolate, std::ostream& os) {  // NOLINT
-  JSObjectPrintHeader(isolate, os, this, nullptr);
+void JSObject::JSObjectPrint(std::ostream& os) {  // NOLINT
+  JSObjectPrintHeader(os, this, nullptr);
   JSObjectPrintBody(os, this);
 }
 
-void JSGeneratorObject::JSGeneratorObjectPrint(Isolate* isolate,
-                                               std::ostream& os) {  // NOLINT
-  JSObjectPrintHeader(isolate, os, this, "JSGeneratorObject");
+void JSGeneratorObject::JSGeneratorObjectPrint(std::ostream& os) {  // NOLINT
+  JSObjectPrintHeader(os, this, "JSGeneratorObject");
   os << "\n - function: " << Brief(function());
   os << "\n - context: " << Brief(context());
   os << "\n - receiver: " << Brief(receiver());
@@ -692,7 +690,7 @@ void JSGeneratorObject::JSGeneratorObjectPrint(Isolate* isolate,
       int col = script->GetColumnNumber(source_position()) + 1;
       String* script_name = script->name()->IsString()
                                 ? String::cast(script->name())
-                                : ReadOnlyRoots(isolate).empty_string();
+                                : GetReadOnlyRoots().empty_string();
       os << "\n - source position: " << source_position();
       os << " (";
       script_name->PrintUC16(os);
@@ -705,14 +703,14 @@ void JSGeneratorObject::JSGeneratorObjectPrint(Isolate* isolate,
   os << "\n";
 }
 
-void JSArray::JSArrayPrint(Isolate* isolate, std::ostream& os) {  // NOLINT
-  JSObjectPrintHeader(isolate, os, this, "JSArray");
+void JSArray::JSArrayPrint(std::ostream& os) {  // NOLINT
+  JSObjectPrintHeader(os, this, "JSArray");
   os << "\n - length: " << Brief(this->length());
   JSObjectPrintBody(os, this);
 }
 
-void JSPromise::JSPromisePrint(Isolate* isolate, std::ostream& os) {  // NOLINT
-  JSObjectPrintHeader(isolate, os, this, "JSPromise");
+void JSPromise::JSPromisePrint(std::ostream& os) {  // NOLINT
+  JSObjectPrintHeader(os, this, "JSPromise");
   os << "\n - status: " << JSPromise::Status(status());
   if (status() == Promise::kPending) {
     os << "\n - reactions: " << Brief(reactions());
@@ -723,17 +721,16 @@ void JSPromise::JSPromisePrint(Isolate* isolate, std::ostream& os) {  // NOLINT
   os << "\n ";
 }
 
-void JSRegExp::JSRegExpPrint(Isolate* isolate, std::ostream& os) {  // NOLINT
-  JSObjectPrintHeader(isolate, os, this, "JSRegExp");
+void JSRegExp::JSRegExpPrint(std::ostream& os) {  // NOLINT
+  JSObjectPrintHeader(os, this, "JSRegExp");
   os << "\n - data: " << Brief(data());
   os << "\n - source: " << Brief(source());
   JSObjectPrintBody(os, this);
 }
 
 void JSRegExpStringIterator::JSRegExpStringIteratorPrint(
-    Isolate* isolate,
     std::ostream& os) {  // NOLINT
-  JSObjectPrintHeader(isolate, os, this, "JSRegExpStringIterator");
+  JSObjectPrintHeader(os, this, "JSRegExpStringIterator");
   os << "\n - regex: " << Brief(iterating_regexp());
   os << "\n - string: " << Brief(iterating_string());
   os << "\n - done: " << done();
@@ -742,18 +739,18 @@ void JSRegExpStringIterator::JSRegExpStringIteratorPrint(
   JSObjectPrintBody(os, this);
 }
 
-void Symbol::SymbolPrint(Isolate* isolate, std::ostream& os) {  // NOLINT
+void Symbol::SymbolPrint(std::ostream& os) {  // NOLINT
   HeapObject::PrintHeader(os, "Symbol");
   os << "\n - hash: " << Hash();
   os << "\n - name: " << Brief(name());
-  if (name()->IsUndefined(isolate)) {
-    os << " (" << PrivateSymbolToName(isolate) << ")";
+  if (name()->IsUndefined()) {
+    os << " (" << PrivateSymbolToName() << ")";
   }
   os << "\n - private: " << is_private();
   os << "\n";
 }
 
-void Map::MapPrint(Isolate* isolate, std::ostream& os) {  // NOLINT
+void Map::MapPrint(std::ostream& os) {  // NOLINT
   HeapObject::PrintHeader(os, "Map");
   os << "\n - type: " << instance_type();
   os << "\n - instance size: ";
@@ -804,9 +801,13 @@ void Map::MapPrint(Isolate* isolate, std::ostream& os) {  // NOLINT
     os << "\n - layout descriptor: ";
     layout_descriptor()->ShortPrint(os);
   }
-  {
+
+  MemoryChunk* chunk = MemoryChunk::FromHeapObject(this);
+  // Read-only maps can't have transitions, which is fortunate because we need
+  // the isolate to iterate over the transitions.
+  if (chunk->owner()->identity() != RO_SPACE) {
     DisallowHeapAllocation no_gc;
-    TransitionsAccessor transitions(isolate, this, &no_gc);
+    TransitionsAccessor transitions(chunk->heap()->isolate(), this, &no_gc);
     int nof_transitions = transitions.NumberOfTransitions();
     if (nof_transitions > 0) {
       os << "\n - transitions #" << nof_transitions << ": ";
@@ -952,21 +953,19 @@ void WeakArrayList::WeakArrayListPrint(std::ostream& os) {
   os << "\n";
 }
 
-void TransitionArray::TransitionArrayPrint(Isolate* isolate,
-                                           std::ostream& os) {  // NOLINT
+void TransitionArray::TransitionArrayPrint(std::ostream& os) {  // NOLINT
   HeapObject::PrintHeader(os, "TransitionArray");
-  PrintInternal(isolate, os);
+  PrintInternal(os);
 }
 
-void FeedbackCell::FeedbackCellPrint(Isolate* isolate,
-                                     std::ostream& os) {  // NOLINT
+void FeedbackCell::FeedbackCellPrint(std::ostream& os) {  // NOLINT
   HeapObject::PrintHeader(os, "FeedbackCell");
-  Heap* heap = isolate->heap();
-  if (map() == ReadOnlyRoots(heap).no_closures_cell_map()) {
+  ReadOnlyRoots roots = GetReadOnlyRoots();
+  if (map() == roots.no_closures_cell_map()) {
     os << "\n - no closures";
-  } else if (map() == ReadOnlyRoots(heap).one_closure_cell_map()) {
+  } else if (map() == roots.one_closure_cell_map()) {
     os << "\n - one closure";
-  } else if (map() == ReadOnlyRoots(heap).many_closures_cell_map()) {
+  } else if (map() == roots.many_closures_cell_map()) {
     os << "\n - many closures";
   } else {
     os << "\n - Invalid FeedbackCell map";
@@ -1123,15 +1122,14 @@ void FeedbackNexus::Print(std::ostream& os) {  // NOLINT
   }
 }
 
-void JSValue::JSValuePrint(Isolate* isolate, std::ostream& os) {  // NOLINT
-  JSObjectPrintHeader(isolate, os, this, "JSValue");
+void JSValue::JSValuePrint(std::ostream& os) {  // NOLINT
+  JSObjectPrintHeader(os, this, "JSValue");
   os << "\n - value: " << Brief(value());
   JSObjectPrintBody(os, this);
 }
 
-void JSMessageObject::JSMessageObjectPrint(Isolate* isolate,
-                                           std::ostream& os) {  // NOLINT
-  JSObjectPrintHeader(isolate, os, this, "JSMessageObject");
+void JSMessageObject::JSMessageObjectPrint(std::ostream& os) {  // NOLINT
+  JSObjectPrintHeader(os, this, "JSMessageObject");
   os << "\n - type: " << type();
   os << "\n - arguments: " << Brief(argument());
   os << "\n - start_position: " << start_position();
@@ -1187,8 +1185,8 @@ static const char* const weekdays[] = {
   "???", "Sun", "Mon", "Tue", "Wed", "Thu", "Fri", "Sat"
 };
 
-void JSDate::JSDatePrint(Isolate* isolate, std::ostream& os) {  // NOLINT
-  JSObjectPrintHeader(isolate, os, this, "JSDate");
+void JSDate::JSDatePrint(std::ostream& os) {  // NOLINT
+  JSObjectPrintHeader(os, this, "JSDate");
   os << "\n - value: " << Brief(value());
   if (!year()->IsSmi()) {
     os << "\n - time = NaN\n";
@@ -1218,14 +1216,14 @@ void JSProxy::JSProxyPrint(std::ostream& os) {  // NOLINT
   os << "\n";
 }
 
-void JSSet::JSSetPrint(Isolate* isolate, std::ostream& os) {  // NOLINT
-  JSObjectPrintHeader(isolate, os, this, "JSSet");
+void JSSet::JSSetPrint(std::ostream& os) {  // NOLINT
+  JSObjectPrintHeader(os, this, "JSSet");
   os << " - table: " << Brief(table());
   JSObjectPrintBody(os, this);
 }
 
-void JSMap::JSMapPrint(Isolate* isolate, std::ostream& os) {  // NOLINT
-  JSObjectPrintHeader(isolate, os, this, "JSMap");
+void JSMap::JSMapPrint(std::ostream& os) {  // NOLINT
+  JSObjectPrintHeader(os, this, "JSMap");
   os << " - table: " << Brief(table());
   JSObjectPrintBody(os, this);
 }
@@ -1237,33 +1235,30 @@ void JSCollectionIterator::JSCollectionIteratorPrint(
   os << "\n";
 }
 
-void JSSetIterator::JSSetIteratorPrint(Isolate* isolate,
-                                       std::ostream& os) {  // NOLINT
-  JSObjectPrintHeader(isolate, os, this, "JSSetIterator");
+void JSSetIterator::JSSetIteratorPrint(std::ostream& os) {  // NOLINT
+  JSObjectPrintHeader(os, this, "JSSetIterator");
   JSCollectionIteratorPrint(os);
 }
 
-void JSMapIterator::JSMapIteratorPrint(Isolate* isolate,
-                                       std::ostream& os) {  // NOLINT
-  JSObjectPrintHeader(isolate, os, this, "JSMapIterator");
+void JSMapIterator::JSMapIteratorPrint(std::ostream& os) {  // NOLINT
+  JSObjectPrintHeader(os, this, "JSMapIterator");
   JSCollectionIteratorPrint(os);
 }
 
-void JSWeakMap::JSWeakMapPrint(Isolate* isolate, std::ostream& os) {  // NOLINT
-  JSObjectPrintHeader(isolate, os, this, "JSWeakMap");
+void JSWeakMap::JSWeakMapPrint(std::ostream& os) {  // NOLINT
+  JSObjectPrintHeader(os, this, "JSWeakMap");
   os << "\n - table: " << Brief(table());
   JSObjectPrintBody(os, this);
 }
 
-void JSWeakSet::JSWeakSetPrint(Isolate* isolate, std::ostream& os) {  // NOLINT
-  JSObjectPrintHeader(isolate, os, this, "JSWeakSet");
+void JSWeakSet::JSWeakSetPrint(std::ostream& os) {  // NOLINT
+  JSObjectPrintHeader(os, this, "JSWeakSet");
   os << "\n - table: " << Brief(table());
   JSObjectPrintBody(os, this);
 }
 
-void JSArrayBuffer::JSArrayBufferPrint(Isolate* isolate,
-                                       std::ostream& os) {  // NOLINT
-  JSObjectPrintHeader(isolate, os, this, "JSArrayBuffer");
+void JSArrayBuffer::JSArrayBufferPrint(std::ostream& os) {  // NOLINT
+  JSObjectPrintHeader(os, this, "JSArrayBuffer");
   os << "\n - backing_store: " << backing_store();
   os << "\n - byte_length: " << Brief(byte_length());
   if (is_external()) os << "\n - external";
@@ -1275,9 +1270,8 @@ void JSArrayBuffer::JSArrayBufferPrint(Isolate* isolate,
   JSObjectPrintBody(os, this, !was_neutered());
 }
 
-void JSTypedArray::JSTypedArrayPrint(Isolate* isolate,
-                                     std::ostream& os) {  // NOLINT
-  JSObjectPrintHeader(isolate, os, this, "JSTypedArray");
+void JSTypedArray::JSTypedArrayPrint(std::ostream& os) {  // NOLINT
+  JSObjectPrintHeader(os, this, "JSTypedArray");
   os << "\n - buffer: " << Brief(buffer());
   os << "\n - byte_offset: " << Brief(byte_offset());
   os << "\n - byte_length: " << Brief(byte_length());
@@ -1286,18 +1280,16 @@ void JSTypedArray::JSTypedArrayPrint(Isolate* isolate,
   JSObjectPrintBody(os, this, !WasNeutered());
 }
 
-void JSArrayIterator::JSArrayIteratorPrint(Isolate* isolate,
-                                           std::ostream& os) {  // NOLING
-  JSObjectPrintHeader(isolate, os, this, "JSArrayIterator");
+void JSArrayIterator::JSArrayIteratorPrint(std::ostream& os) {  // NOLING
+  JSObjectPrintHeader(os, this, "JSArrayIterator");
   os << "\n - iterated_object: " << Brief(iterated_object());
   os << "\n - next_index: " << Brief(next_index());
   os << "\n - kind: " << kind();
   JSObjectPrintBody(os, this);
 }
 
-void JSDataView::JSDataViewPrint(Isolate* isolate,
-                                 std::ostream& os) {  // NOLINT
-  JSObjectPrintHeader(isolate, os, this, "JSDataView");
+void JSDataView::JSDataViewPrint(std::ostream& os) {  // NOLINT
+  JSObjectPrintHeader(os, this, "JSDataView");
   os << "\n - buffer =" << Brief(buffer());
   os << "\n - byte_offset: " << Brief(byte_offset());
   os << "\n - byte_length: " << Brief(byte_length());
@@ -1305,18 +1297,17 @@ void JSDataView::JSDataViewPrint(Isolate* isolate,
   JSObjectPrintBody(os, this, !WasNeutered());
 }
 
-void JSBoundFunction::JSBoundFunctionPrint(Isolate* isolate,
-                                           std::ostream& os) {  // NOLINT
-  JSObjectPrintHeader(isolate, os, this, "JSBoundFunction");
+void JSBoundFunction::JSBoundFunctionPrint(std::ostream& os) {  // NOLINT
+  JSObjectPrintHeader(os, this, "JSBoundFunction");
   os << "\n - bound_target_function: " << Brief(bound_target_function());
   os << "\n - bound_this: " << Brief(bound_this());
   os << "\n - bound_arguments: " << Brief(bound_arguments());
   JSObjectPrintBody(os, this);
 }
 
-void JSFunction::JSFunctionPrint(Isolate* isolate,
-                                 std::ostream& os) {  // NOLINT
-  JSObjectPrintHeader(isolate, os, this, "Function");
+void JSFunction::JSFunctionPrint(std::ostream& os) {  // NOLINT
+  Isolate* isolate = GetIsolate();
+  JSObjectPrintHeader(os, this, "Function");
   os << "\n - function prototype: ";
   if (has_prototype_slot()) {
     if (has_prototype()) {
@@ -1442,19 +1433,17 @@ void SharedFunctionInfo::SharedFunctionInfoPrint(std::ostream& os) {  // NOLINT
   os << "\n";
 }
 
-void JSGlobalProxy::JSGlobalProxyPrint(Isolate* isolate,
-                                       std::ostream& os) {  // NOLINT
-  JSObjectPrintHeader(isolate, os, this, "JSGlobalProxy");
-  if (!isolate->bootstrapper()->IsActive()) {
+void JSGlobalProxy::JSGlobalProxyPrint(std::ostream& os) {  // NOLINT
+  JSObjectPrintHeader(os, this, "JSGlobalProxy");
+  if (!GetIsolate()->bootstrapper()->IsActive()) {
     os << "\n - native context: " << Brief(native_context());
   }
   JSObjectPrintBody(os, this);
 }
 
-void JSGlobalObject::JSGlobalObjectPrint(Isolate* isolate,
-                                         std::ostream& os) {  // NOLINT
-  JSObjectPrintHeader(isolate, os, this, "JSGlobalObject");
-  if (!isolate->bootstrapper()->IsActive()) {
+void JSGlobalObject::JSGlobalObjectPrint(std::ostream& os) {  // NOLINT
+  JSObjectPrintHeader(os, this, "JSGlobalObject");
+  if (!GetIsolate()->bootstrapper()->IsActive()) {
     os << "\n - native context: " << Brief(native_context());
   }
   os << "\n - global proxy: " << Brief(global_proxy());
@@ -1669,9 +1658,8 @@ void Module::ModulePrint(std::ostream& os) {  // NOLINT
   os << "\n";
 }
 
-void JSModuleNamespace::JSModuleNamespacePrint(Isolate* isolate,
-                                               std::ostream& os) {  // NOLINT
-  JSObjectPrintHeader(isolate, os, this, "JSModuleNamespace");
+void JSModuleNamespace::JSModuleNamespacePrint(std::ostream& os) {  // NOLINT
+  JSObjectPrintHeader(os, this, "JSModuleNamespace");
   os << "\n - module: " << Brief(module());
   JSObjectPrintBody(os, this);
 }
@@ -1773,9 +1761,8 @@ void WasmExportedFunctionData::WasmExportedFunctionDataPrint(
   os << "\n";
 }
 
-void WasmModuleObject::WasmModuleObjectPrint(Isolate* isolate,
-                                             std::ostream& os) {  // NOLINT
-  JSObjectPrintHeader(isolate, os, this, "WasmModuleObject");
+void WasmModuleObject::WasmModuleObjectPrint(std::ostream& os) {  // NOLINT
+  JSObjectPrintHeader(os, this, "WasmModuleObject");
   JSObjectPrintBody(os, this);
   os << "\n - module: " << module();
   os << "\n - native module: " << native_module();
@@ -1974,12 +1961,11 @@ void JSLocale::JSLocalePrint(std::ostream& os) {  // NOLINT
 }
 
 void JSRelativeTimeFormat::JSRelativeTimeFormatPrint(
-    Isolate* isolate,
     std::ostream& os) {  // NOLINT
-  JSObjectPrintHeader(isolate, os, this, "JSRelativeTimeFormat");
+  JSObjectPrintHeader(os, this, "JSRelativeTimeFormat");
   os << "\n - locale: " << Brief(locale());
-  os << "\n - style: " << StyleAsString(isolate);
-  os << "\n - numeric: " << NumericAsString(isolate);
+  os << "\n - style: " << StyleAsString();
+  os << "\n - numeric: " << NumericAsString();
   os << "\n - formatter: " << Brief(formatter());
   os << "\n";
 }
@@ -2090,7 +2076,7 @@ static void PrintBitMask(std::ostream& os, uint32_t value) {  // NOLINT
   }
 }
 
-void LayoutDescriptor::Print(Isolate* isolate) {
+void LayoutDescriptor::Print() {
   StdoutStream os;
   this->Print(os);
   os << std::flush;
@@ -2127,7 +2113,10 @@ void LayoutDescriptor::Print(std::ostream& os) {  // NOLINT
 void PreParsedScopeData::PreParsedScopeDataPrint(std::ostream& os) {  // NOLINT
   HeapObject::PrintHeader(os, "PreParsedScopeData");
   os << "\n - scope_data: " << Brief(scope_data());
-  os << "\n - child_data: " << Brief(child_data());
+  os << "\n - length: " << length();
+  for (int i = 0; i < length(); ++i) {
+    os << "\n - [" << i << "]: " << Brief(child_data(i));
+  }
   os << "\n";
 }
 
@@ -2155,13 +2144,13 @@ void InterpreterData::InterpreterDataPrint(std::ostream& os) {  // NOLINT
   os << "\n";
 }
 
-void MaybeObject::Print(Isolate* isolate) {
+void MaybeObject::Print() {
   StdoutStream os;
-  this->Print(isolate, os);
+  this->Print(os);
   os << std::flush;
 }
 
-void MaybeObject::Print(Isolate* isolate, std::ostream& os) {
+void MaybeObject::Print(std::ostream& os) {
   Smi* smi;
   HeapObject* heap_object;
   if (ToSmi(&smi)) {
@@ -2170,9 +2159,9 @@ void MaybeObject::Print(Isolate* isolate, std::ostream& os) {
     os << "[cleared]";
   } else if (ToWeakHeapObject(&heap_object)) {
     os << "[weak] ";
-    heap_object->HeapObjectPrint(isolate, os);
+    heap_object->HeapObjectPrint(os);
   } else if (ToStrongHeapObject(&heap_object)) {
-    heap_object->HeapObjectPrint(isolate, os);
+    heap_object->HeapObjectPrint(os);
   } else {
     UNREACHABLE();
   }
@@ -2187,14 +2176,14 @@ void MutableHeapNumber::MutableHeapNumberPrint(std::ostream& os) {
 }
 
 // TODO(cbruni): remove once the new maptracer is in place.
-void Name::NameShortPrint(Isolate* isolate) {
+void Name::NameShortPrint() {
   if (this->IsString()) {
     PrintF("%s", String::cast(this)->ToCString().get());
   } else {
     DCHECK(this->IsSymbol());
     Symbol* s = Symbol::cast(this);
-    if (s->name()->IsUndefined(isolate)) {
-      PrintF("#<%s>", s->PrivateSymbolToName(isolate));
+    if (s->name()->IsUndefined()) {
+      PrintF("#<%s>", s->PrivateSymbolToName());
     } else {
       PrintF("<%s>", String::cast(s->name())->ToCString().get());
     }
@@ -2202,24 +2191,24 @@ void Name::NameShortPrint(Isolate* isolate) {
 }
 
 // TODO(cbruni): remove once the new maptracer is in place.
-int Name::NameShortPrint(Isolate* isolate, Vector<char> str) {
+int Name::NameShortPrint(Vector<char> str) {
   if (this->IsString()) {
     return SNPrintF(str, "%s", String::cast(this)->ToCString().get());
   } else {
     DCHECK(this->IsSymbol());
     Symbol* s = Symbol::cast(this);
-    if (s->name()->IsUndefined(isolate)) {
-      return SNPrintF(str, "#<%s>", s->PrivateSymbolToName(isolate));
+    if (s->name()->IsUndefined()) {
+      return SNPrintF(str, "#<%s>", s->PrivateSymbolToName());
     } else {
       return SNPrintF(str, "<%s>", String::cast(s->name())->ToCString().get());
     }
   }
 }
 
-void Map::PrintMapDetails(Isolate* isolate, std::ostream& os) {
+void Map::PrintMapDetails(std::ostream& os) {
   DisallowHeapAllocation no_gc;
 #ifdef OBJECT_PRINT
-  this->MapPrint(isolate, os);
+  this->MapPrint(os);
 #else
   os << "Map=" << reinterpret_cast<void*>(this);
 #endif
@@ -2281,8 +2270,8 @@ char* String::ToAsciiArray() {
 }
 
 // static
-void TransitionsAccessor::PrintOneTransition(Isolate* isolate, std::ostream& os,
-                                             Name* key, Map* target) {
+void TransitionsAccessor::PrintOneTransition(std::ostream& os, Name* key,
+                                             Map* target) {
   os << "\n     ";
 #ifdef OBJECT_PRINT
   key->NamePrint(os);
@@ -2290,20 +2279,20 @@ void TransitionsAccessor::PrintOneTransition(Isolate* isolate, std::ostream& os,
   key->ShortPrint(os);
 #endif
   os << ": ";
-  Heap* heap = isolate->heap();
-  if (key == ReadOnlyRoots(heap).nonextensible_symbol()) {
+  ReadOnlyRoots roots = key->GetReadOnlyRoots();
+  if (key == roots.nonextensible_symbol()) {
     os << "(transition to non-extensible)";
-  } else if (key == ReadOnlyRoots(heap).sealed_symbol()) {
+  } else if (key == roots.sealed_symbol()) {
     os << "(transition to sealed)";
-  } else if (key == ReadOnlyRoots(heap).frozen_symbol()) {
+  } else if (key == roots.frozen_symbol()) {
     os << "(transition to frozen)";
-  } else if (key == ReadOnlyRoots(heap).elements_transition_symbol()) {
+  } else if (key == roots.elements_transition_symbol()) {
     os << "(transition to " << ElementsKindToString(target->elements_kind())
        << ")";
-  } else if (key == ReadOnlyRoots(heap).strict_function_transition_symbol()) {
+  } else if (key == roots.strict_function_transition_symbol()) {
     os << " (transition to strict function)";
   } else {
-    DCHECK(!IsSpecialTransition(heap->isolate(), key));
+    DCHECK(!IsSpecialTransition(roots, key));
     os << "(transition to ";
     int descriptor = target->LastAdded();
     DescriptorArray* descriptors = target->instance_descriptors();
@@ -2314,13 +2303,13 @@ void TransitionsAccessor::PrintOneTransition(Isolate* isolate, std::ostream& os,
   os << " -> " << Brief(target);
 }
 
-void TransitionArray::PrintInternal(Isolate* isolate, std::ostream& os) {
+void TransitionArray::PrintInternal(std::ostream& os) {
   int num_transitions = number_of_transitions();
   os << "Transition array #" << num_transitions << ":";
   for (int i = 0; i < num_transitions; i++) {
     Name* key = GetKey(i);
     Map* target = GetTarget(i);
-    TransitionsAccessor::PrintOneTransition(isolate, os, key, target);
+    TransitionsAccessor::PrintOneTransition(os, key, target);
   }
   os << "\n" << std::flush;
 }
@@ -2333,11 +2322,11 @@ void TransitionsAccessor::PrintTransitions(std::ostream& os) {  // NOLINT
     case kWeakRef: {
       Map* target = Map::cast(raw_transitions_->ToWeakHeapObject());
       Name* key = GetSimpleTransitionKey(target);
-      PrintOneTransition(isolate_, os, key, target);
+      PrintOneTransition(os, key, target);
       break;
     }
     case kFullTransitionArray:
-      return transitions()->PrintInternal(isolate_, os);
+      return transitions()->PrintInternal(os);
   }
 }
 
@@ -2351,6 +2340,7 @@ void TransitionsAccessor::PrintTransitionTree() {
 
 void TransitionsAccessor::PrintTransitionTree(std::ostream& os, int level,
                                               DisallowHeapAllocation* no_gc) {
+  ReadOnlyRoots roots = ReadOnlyRoots(isolate_);
   int num_transitions = NumberOfTransitions();
   if (num_transitions == 0) return;
   for (int i = 0; i < num_transitions; i++) {
@@ -2362,16 +2352,15 @@ void TransitionsAccessor::PrintTransitionTree(std::ostream& os, int level,
     ss << Brief(target);
     os << std::left << std::setw(50) << ss.str() << ": ";
 
-    Heap* heap = isolate_->heap();
-    if (key == ReadOnlyRoots(heap).nonextensible_symbol()) {
+    if (key == roots.nonextensible_symbol()) {
       os << "to non-extensible";
-    } else if (key == ReadOnlyRoots(heap).sealed_symbol()) {
+    } else if (key == roots.sealed_symbol()) {
       os << "to sealed ";
-    } else if (key == ReadOnlyRoots(heap).frozen_symbol()) {
+    } else if (key == roots.frozen_symbol()) {
       os << "to frozen";
-    } else if (key == ReadOnlyRoots(heap).elements_transition_symbol()) {
+    } else if (key == roots.elements_transition_symbol()) {
       os << "to " << ElementsKindToString(target->elements_kind());
-    } else if (key == ReadOnlyRoots(heap).strict_function_transition_symbol()) {
+    } else if (key == roots.strict_function_transition_symbol()) {
       os << "to strict function";
     } else {
 #ifdef OBJECT_PRINT
@@ -2380,7 +2369,7 @@ void TransitionsAccessor::PrintTransitionTree(std::ostream& os, int level,
       key->ShortPrint(os);
 #endif
       os << " ";
-      DCHECK(!IsSpecialTransition(isolate_, key));
+      DCHECK(!IsSpecialTransition(ReadOnlyRoots(isolate_), key));
       os << "to ";
       int descriptor = target->LastAdded();
       DescriptorArray* descriptors = target->instance_descriptors();
@@ -2408,7 +2397,7 @@ void JSObject::PrintTransitions(std::ostream& os) {  // NOLINT
 // The following functions are used by our gdb macros.
 //
 extern void _v8_internal_Print_Object(void* object) {
-  reinterpret_cast<i::Object*>(object)->Print(i::Isolate::Current());
+  reinterpret_cast<i::Object*>(object)->Print();
 }
 
 extern void _v8_internal_Print_Code(void* object) {
@@ -2442,7 +2431,7 @@ extern void _v8_internal_Print_Code(void* object) {
   i::StdoutStream os;
   code->Disassemble(nullptr, os, address);
 #else   // ENABLE_DISASSEMBLER
-  code->Print(i::Isolate::Current());
+  code->Print();
 #endif  // ENABLE_DISASSEMBLER
 }
 
@@ -2451,8 +2440,7 @@ extern void _v8_internal_Print_LayoutDescriptor(void* object) {
   if (!o->IsLayoutDescriptor()) {
     printf("Please provide a layout descriptor\n");
   } else {
-    reinterpret_cast<i::LayoutDescriptor*>(object)->Print(
-        i::Isolate::Current());
+    reinterpret_cast<i::LayoutDescriptor*>(object)->Print();
   }
 }
 
diff --git a/deps/v8/src/objects.cc b/deps/v8/src/objects.cc
index e3f58d1fae7cd0..117e399d16c81f 100644
--- a/deps/v8/src/objects.cc
+++ b/deps/v8/src/objects.cc
@@ -200,7 +200,7 @@ MaybeHandle<Object> Object::ConvertToNumberOrNumeric(Isolate* isolate,
       return String::ToNumber(isolate, Handle<String>::cast(input));
     }
     if (input->IsOddball()) {
-      return Oddball::ToNumber(Handle<Oddball>::cast(input));
+      return Oddball::ToNumber(isolate, Handle<Oddball>::cast(input));
     }
     if (input->IsSymbol()) {
       THROW_NEW_ERROR(isolate, NewTypeError(MessageTemplate::kSymbolToNumber),
@@ -646,14 +646,14 @@ Maybe<bool> Object::Equals(Isolate* isolate, Handle<Object> x,
         y = String::ToNumber(isolate, Handle<String>::cast(y));
         return Just(NumberEquals(Handle<Oddball>::cast(x)->to_number(), *y));
       } else if (y->IsBigInt()) {
-        x = Oddball::ToNumber(Handle<Oddball>::cast(x));
+        x = Oddball::ToNumber(isolate, Handle<Oddball>::cast(x));
         return Just(BigInt::EqualToNumber(Handle<BigInt>::cast(y), x));
       } else if (y->IsJSReceiver()) {
         if (!JSReceiver::ToPrimitive(Handle<JSReceiver>::cast(y))
                  .ToHandle(&y)) {
           return Nothing<bool>();
         }
-        x = Oddball::ToNumber(Handle<Oddball>::cast(x));
+        x = Oddball::ToNumber(isolate, Handle<Oddball>::cast(x));
       } else {
         return Just(false);
       }
@@ -679,7 +679,7 @@ Maybe<bool> Object::Equals(Isolate* isolate, Handle<Object> x,
       } else if (y->IsUndetectable()) {
         return Just(x->IsUndetectable());
       } else if (y->IsBoolean()) {
-        y = Oddball::ToNumber(Handle<Oddball>::cast(y));
+        y = Oddball::ToNumber(isolate, Handle<Oddball>::cast(y));
       } else if (!JSReceiver::ToPrimitive(Handle<JSReceiver>::cast(x))
                       .ToHandle(&x)) {
         return Nothing<bool>();
@@ -1296,7 +1296,7 @@ Handle<TemplateList> TemplateList::Add(Isolate* isolate,
   STATIC_ASSERT(kFirstElementIndex == 1);
   int index = list->length() + 1;
   Handle<i::FixedArray> fixed_array = Handle<FixedArray>::cast(list);
-  fixed_array = FixedArray::SetAndGrow(fixed_array, index, value);
+  fixed_array = FixedArray::SetAndGrow(isolate, fixed_array, index, value);
   fixed_array->set(kLengthIndex, Smi::FromInt(index));
   return Handle<TemplateList>::cast(fixed_array);
 }
@@ -1565,8 +1565,7 @@ MaybeHandle<Object> Object::GetPropertyWithAccessor(LookupIterator* it) {
 }
 
 // static
-Address AccessorInfo::redirect(Isolate* isolate, Address address,
-                               AccessorComponent component) {
+Address AccessorInfo::redirect(Address address, AccessorComponent component) {
   ApiFunction fun(address);
   DCHECK_EQ(ACCESSOR_GETTER, component);
   ExternalReference::Type type = ExternalReference::DIRECT_GETTER_CALL;
@@ -1576,7 +1575,7 @@ Address AccessorInfo::redirect(Isolate* isolate, Address address,
 Address AccessorInfo::redirected_getter() const {
   Address accessor = v8::ToCData<Address>(getter());
   if (accessor == kNullAddress) return kNullAddress;
-  return redirect(GetIsolate(), accessor, ACCESSOR_GETTER);
+  return redirect(accessor, ACCESSOR_GETTER);
 }
 
 Address CallHandlerInfo::redirected_callback() const {
@@ -2029,7 +2028,7 @@ void JSObject::SetNormalizedProperty(Handle<JSObject> object,
     Handle<JSGlobalObject> global_obj = Handle<JSGlobalObject>::cast(object);
     Handle<GlobalDictionary> dictionary(global_obj->global_dictionary(),
                                         isolate);
-    int entry = dictionary->FindEntry(isolate, name, hash);
+    int entry = dictionary->FindEntry(ReadOnlyRoots(isolate), name, hash);
 
     if (entry == GlobalDictionary::kNotFound) {
       DCHECK_IMPLIES(global_obj->map()->is_prototype_map(),
@@ -2557,8 +2556,8 @@ Handle<String> String::SlowFlatten(Isolate* isolate, Handle<ConsString> cons,
     WriteToFlat(*cons, flat->GetChars(), 0, length);
     result = flat;
   }
-  cons->set_first(*result);
-  cons->set_second(ReadOnlyRoots(isolate).empty_string());
+  cons->set_first(isolate, *result);
+  cons->set_second(isolate, ReadOnlyRoots(isolate).empty_string());
   DCHECK(result->IsFlat());
   return result;
 }
@@ -2638,7 +2637,7 @@ bool String::MakeExternal(v8::String::ExternalStringResource* resource) {
   this->synchronized_set_map(new_map);
 
   ExternalTwoByteString* self = ExternalTwoByteString::cast(this);
-  self->set_resource(resource);
+  self->SetResource(resource);
   heap->RegisterExternalString(this);
   if (is_internalized) self->Hash();  // Force regeneration of the hash value.
   return true;
@@ -2712,7 +2711,7 @@ bool String::MakeExternal(v8::String::ExternalOneByteStringResource* resource) {
   this->synchronized_set_map(new_map);
 
   ExternalOneByteString* self = ExternalOneByteString::cast(this);
-  self->set_resource(resource);
+  self->SetResource(resource);
   heap->RegisterExternalString(this);
   if (is_internalized) self->Hash();  // Force regeneration of the hash value.
   return true;
@@ -3104,6 +3103,9 @@ VisitorId Map::GetVisitorId(Map* map) {
     case WASM_INSTANCE_TYPE:
       return kVisitWasmInstanceObject;
 
+    case PRE_PARSED_SCOPE_DATA_TYPE:
+      return kVisitPreParsedScopeData;
+
     case UNCOMPILED_DATA_WITH_PRE_PARSED_SCOPE_TYPE:
       return kVisitUncompiledDataWithPreParsedScope;
 
@@ -3435,6 +3437,12 @@ void HeapObject::HeapObjectShortPrint(std::ostream& os) {  // NOLINT
     TYPED_ARRAYS(TYPED_ARRAY_SHORT_PRINT)
 #undef TYPED_ARRAY_SHORT_PRINT
 
+    case PRE_PARSED_SCOPE_DATA_TYPE: {
+      PreParsedScopeData* data = PreParsedScopeData::cast(this);
+      os << "<PreParsedScopeData[" << data->length() << "]>";
+      break;
+    }
+
     case UNCOMPILED_DATA_WITHOUT_PRE_PARSED_SCOPE_TYPE: {
       UncompiledDataWithoutPreParsedScope* data =
           UncompiledDataWithoutPreParsedScope::cast(this);
@@ -3727,25 +3735,25 @@ bool HeapObject::CanBeRehashed() const {
   return false;
 }
 
-void HeapObject::RehashBasedOnMap() {
+void HeapObject::RehashBasedOnMap(Isolate* isolate) {
   switch (map()->instance_type()) {
     case HASH_TABLE_TYPE:
       UNREACHABLE();
       break;
     case NAME_DICTIONARY_TYPE:
-      NameDictionary::cast(this)->Rehash();
+      NameDictionary::cast(this)->Rehash(isolate);
       break;
     case GLOBAL_DICTIONARY_TYPE:
-      GlobalDictionary::cast(this)->Rehash();
+      GlobalDictionary::cast(this)->Rehash(isolate);
       break;
     case NUMBER_DICTIONARY_TYPE:
-      NumberDictionary::cast(this)->Rehash();
+      NumberDictionary::cast(this)->Rehash(isolate);
       break;
     case SIMPLE_NUMBER_DICTIONARY_TYPE:
-      SimpleNumberDictionary::cast(this)->Rehash();
+      SimpleNumberDictionary::cast(this)->Rehash(isolate);
       break;
     case STRING_TABLE_TYPE:
-      StringTable::cast(this)->Rehash();
+      StringTable::cast(this)->Rehash(isolate);
       break;
     case DESCRIPTOR_ARRAY_TYPE:
       DCHECK_LE(1, DescriptorArray::cast(this)->number_of_descriptors());
@@ -4382,7 +4390,7 @@ void MigrateFastToSlow(Handle<JSObject> object, Handle<Map> new_map,
   if (FLAG_trace_normalization) {
     StdoutStream os;
     os << "Object properties have been normalized:\n";
-    object->Print(isolate, os);
+    object->Print(os);
   }
 #endif
 }
@@ -6402,9 +6410,10 @@ void JSObject::MigrateSlowToFast(Handle<JSObject> object,
   int number_of_fields = 0;
 
   // Compute the length of the instance descriptor.
+  ReadOnlyRoots roots(isolate);
   for (int i = 0; i < instance_descriptor_length; i++) {
     int index = Smi::ToInt(iteration_order->get(i));
-    DCHECK(dictionary->IsKey(isolate, dictionary->KeyAt(index)));
+    DCHECK(dictionary->IsKey(roots, dictionary->KeyAt(index)));
 
     PropertyKind kind = dictionary->DetailsAt(index).kind();
     if (kind == kData) {
@@ -6608,7 +6617,7 @@ Handle<NumberDictionary> JSObject::NormalizeElements(Handle<JSObject> object) {
   if (FLAG_trace_normalization) {
     StdoutStream os;
     os << "Object elements have been normalized:\n";
-    object->Print(isolate, os);
+    object->Print(os);
   }
 #endif
 
@@ -6790,7 +6799,7 @@ void JSReceiver::DeleteNormalizedProperty(Handle<JSReceiver> object,
     Handle<NameDictionary> dictionary(object->property_dictionary(), isolate);
     DCHECK_NE(NameDictionary::kNotFound, entry);
 
-    dictionary = NameDictionary::DeleteEntry(dictionary, entry);
+    dictionary = NameDictionary::DeleteEntry(isolate, dictionary, entry);
     object->SetProperties(*dictionary);
   }
   if (object->map()->is_prototype_map()) {
@@ -8230,14 +8239,15 @@ Maybe<bool> JSReceiver::SetIntegrityLevel(Handle<JSReceiver> receiver,
 namespace {
 
 template <typename Dictionary>
-bool TestDictionaryPropertiesIntegrityLevel(Dictionary* dict, Isolate* isolate,
+bool TestDictionaryPropertiesIntegrityLevel(Dictionary* dict,
+                                            ReadOnlyRoots roots,
                                             PropertyAttributes level) {
   DCHECK(level == SEALED || level == FROZEN);
 
   uint32_t capacity = dict->Capacity();
   for (uint32_t i = 0; i < capacity; i++) {
     Object* key;
-    if (!dict->ToKey(isolate, i, &key)) continue;
+    if (!dict->ToKey(roots, i, &key)) continue;
     if (key->FilterKey(ALL_PROPERTIES)) continue;
     PropertyDetails details = dict->DetailsAt(i);
     if (details.IsConfigurable()) return false;
@@ -8273,8 +8283,8 @@ bool TestPropertiesIntegrityLevel(JSObject* object, PropertyAttributes level) {
     return TestFastPropertiesIntegrityLevel(object->map(), level);
   }
 
-  return TestDictionaryPropertiesIntegrityLevel(object->property_dictionary(),
-                                                object->GetIsolate(), level);
+  return TestDictionaryPropertiesIntegrityLevel(
+      object->property_dictionary(), object->GetReadOnlyRoots(), level);
 }
 
 bool TestElementsIntegrityLevel(JSObject* object, PropertyAttributes level) {
@@ -8284,7 +8294,7 @@ bool TestElementsIntegrityLevel(JSObject* object, PropertyAttributes level) {
 
   if (IsDictionaryElementsKind(kind)) {
     return TestDictionaryPropertiesIntegrityLevel(
-        NumberDictionary::cast(object->elements()), object->GetIsolate(),
+        NumberDictionary::cast(object->elements()), object->GetReadOnlyRoots(),
         level);
   }
 
@@ -8535,13 +8545,13 @@ bool JSObject::IsExtensible(Handle<JSObject> object) {
 namespace {
 
 template <typename Dictionary>
-void ApplyAttributesToDictionary(Isolate* isolate,
+void ApplyAttributesToDictionary(ReadOnlyRoots roots,
                                  Handle<Dictionary> dictionary,
                                  const PropertyAttributes attributes) {
   int capacity = dictionary->Capacity();
   for (int i = 0; i < capacity; i++) {
     Object* k;
-    if (!dictionary->ToKey(isolate, i, &k)) continue;
+    if (!dictionary->ToKey(roots, i, &k)) continue;
     if (k->FilterKey(ALL_PROPERTIES)) continue;
     PropertyDetails details = dictionary->DetailsAt(i);
     int attrs = attributes;
@@ -8663,14 +8673,15 @@ Maybe<bool> JSObject::PreventExtensionsWithTransition(
     JSObject::MigrateToMap(object, new_map);
 
     if (attrs != NONE) {
+      ReadOnlyRoots roots(isolate);
       if (object->IsJSGlobalObject()) {
         Handle<GlobalDictionary> dictionary(
             JSGlobalObject::cast(*object)->global_dictionary(), isolate);
-        ApplyAttributesToDictionary(isolate, dictionary, attrs);
+        ApplyAttributesToDictionary(roots, dictionary, attrs);
       } else {
         Handle<NameDictionary> dictionary(object->property_dictionary(),
                                           isolate);
-        ApplyAttributesToDictionary(isolate, dictionary, attrs);
+        ApplyAttributesToDictionary(roots, dictionary, attrs);
       }
     }
   }
@@ -8699,7 +8710,7 @@ Maybe<bool> JSObject::PreventExtensionsWithTransition(
     // Make sure we never go back to the fast case
     object->RequireSlowElements(*dictionary);
     if (attrs != NONE) {
-      ApplyAttributesToDictionary(isolate, dictionary, attrs);
+      ApplyAttributesToDictionary(ReadOnlyRoots(isolate), dictionary, attrs);
     }
   }
 
@@ -8955,7 +8966,7 @@ V8_WARN_UNUSED_RESULT Maybe<bool> FastGetOwnValuesOrEntries(
   }
 
   DCHECK_LE(count, values_or_entries->length());
-  *result = FixedArray::ShrinkOrEmpty(values_or_entries, count);
+  *result = FixedArray::ShrinkOrEmpty(isolate, values_or_entries, count);
   return Just(true);
 }
 
@@ -9014,7 +9025,7 @@ MaybeHandle<FixedArray> GetOwnValuesOrEntries(Isolate* isolate,
     length++;
   }
   DCHECK_LE(length, values_or_entries->length());
-  return FixedArray::ShrinkOrEmpty(values_or_entries, length);
+  return FixedArray::ShrinkOrEmpty(isolate, values_or_entries, length);
 }
 
 MaybeHandle<FixedArray> JSReceiver::GetOwnValues(Handle<JSReceiver> object,
@@ -9494,7 +9505,7 @@ Handle<Map> Map::CopyReplaceDescriptors(
     Handle<LayoutDescriptor> layout_descriptor, TransitionFlag flag,
     MaybeHandle<Name> maybe_name, const char* reason,
     SimpleTransitionFlag simple_flag) {
-  DCHECK(descriptors->IsSortedNoDuplicates(isolate));
+  DCHECK(descriptors->IsSortedNoDuplicates());
 
   Handle<Map> result = CopyDropDescriptors(isolate, map);
 
@@ -9539,7 +9550,7 @@ Handle<Map> Map::AddMissingTransitions(
     Isolate* isolate, Handle<Map> split_map,
     Handle<DescriptorArray> descriptors,
     Handle<LayoutDescriptor> full_layout_descriptor) {
-  DCHECK(descriptors->IsSortedNoDuplicates(isolate));
+  DCHECK(descriptors->IsSortedNoDuplicates());
   int split_nof = split_map->NumberOfOwnDescriptors();
   int nof_descriptors = descriptors->number_of_descriptors();
   DCHECK_LT(split_nof, nof_descriptors);
@@ -9584,7 +9595,7 @@ void Map::InstallDescriptors(Isolate* isolate, Handle<Map> parent,
                              Handle<Map> child, int new_descriptor,
                              Handle<DescriptorArray> descriptors,
                              Handle<LayoutDescriptor> full_layout_descriptor) {
-  DCHECK(descriptors->IsSortedNoDuplicates(isolate));
+  DCHECK(descriptors->IsSortedNoDuplicates());
 
   child->set_instance_descriptors(*descriptors);
   child->SetNumberOfOwnDescriptors(new_descriptor + 1);
@@ -9906,7 +9917,7 @@ Handle<Map> Map::TransitionToDataProperty(Isolate* isolate, Handle<Map> map,
     std::unique_ptr<ScopedVector<char>> buffer;
     if (FLAG_trace_maps) {
       ScopedVector<char> name_buffer(100);
-      name->NameShortPrint(isolate, name_buffer);
+      name->NameShortPrint(name_buffer);
       buffer.reset(new ScopedVector<char>(128));
       SNPrintF(*buffer, "TooManyFastProperties %s", name_buffer.start());
       reason = buffer->start();
@@ -10215,7 +10226,8 @@ Handle<Map> Map::CopyReplaceDescriptor(Isolate* isolate, Handle<Map> map,
                                 "CopyReplaceDescriptor", simple_flag);
 }
 
-Handle<FixedArray> FixedArray::SetAndGrow(Handle<FixedArray> array, int index,
+Handle<FixedArray> FixedArray::SetAndGrow(Isolate* isolate,
+                                          Handle<FixedArray> array, int index,
                                           Handle<Object> value,
                                           PretenureFlag pretenure) {
   if (index < array->length()) {
@@ -10227,8 +10239,7 @@ Handle<FixedArray> FixedArray::SetAndGrow(Handle<FixedArray> array, int index,
     capacity = JSObject::NewElementsCapacity(capacity);
   } while (capacity <= index);
   Handle<FixedArray> new_array =
-      array->GetIsolate()->factory()->NewUninitializedFixedArray(capacity,
-                                                                 pretenure);
+      isolate->factory()->NewUninitializedFixedArray(capacity, pretenure);
   array->CopyTo(0, *new_array, 0, array->length());
   new_array->FillWithHoles(array->length(), new_array->length());
   new_array->set(index, *value);
@@ -10249,20 +10260,21 @@ bool FixedArray::ContainsSortedNumbers() {
   return true;
 }
 
-Handle<FixedArray> FixedArray::ShrinkOrEmpty(Handle<FixedArray> array,
+Handle<FixedArray> FixedArray::ShrinkOrEmpty(Isolate* isolate,
+                                             Handle<FixedArray> array,
                                              int new_length) {
   if (new_length == 0) {
     return array->GetReadOnlyRoots().empty_fixed_array_handle();
   } else {
-    array->Shrink(new_length);
+    array->Shrink(isolate, new_length);
     return array;
   }
 }
 
-void FixedArray::Shrink(int new_length) {
+void FixedArray::Shrink(Isolate* isolate, int new_length) {
   DCHECK(0 < new_length && new_length <= length());
   if (new_length < length()) {
-    GetHeap()->RightTrimFixedArray(this, length() - new_length);
+    isolate->heap()->RightTrimFixedArray(this, length() - new_length);
   }
 }
 
@@ -10335,7 +10347,7 @@ Handle<FixedArrayOfWeakCells> FixedArrayOfWeakCells::Add(
 }
 
 template <class CompactionCallback>
-void FixedArrayOfWeakCells::Compact() {
+void FixedArrayOfWeakCells::Compact(Isolate* isolate) {
   FixedArray* array = FixedArray::cast(this);
   int new_length = kFirstIndex;
   for (int i = kFirstIndex; i < array->length(); i++) {
@@ -10347,7 +10359,7 @@ void FixedArrayOfWeakCells::Compact() {
                                  new_length - kFirstIndex);
     array->set(new_length++, element);
   }
-  array->Shrink(new_length);
+  array->Shrink(isolate, new_length);
   set_last_used_index(0);
 }
 
@@ -10373,10 +10385,10 @@ void JSObject::PrototypeRegistryCompactionCallback::Callback(Object* value,
   proto_info->set_registry_slot(new_index);
 }
 
-template void
-FixedArrayOfWeakCells::Compact<FixedArrayOfWeakCells::NullCallback>();
-template void
-FixedArrayOfWeakCells::Compact<JSObject::PrototypeRegistryCompactionCallback>();
+template void FixedArrayOfWeakCells::Compact<
+    FixedArrayOfWeakCells::NullCallback>(Isolate* isolate);
+template void FixedArrayOfWeakCells::Compact<
+    JSObject::PrototypeRegistryCompactionCallback>(Isolate* isolate);
 
 bool FixedArrayOfWeakCells::Remove(Handle<HeapObject> value) {
   if (Length() == 0) return false;
@@ -10570,7 +10582,9 @@ Handle<FrameArray> FrameArray::AppendWasmFrame(
   return array;
 }
 
-void FrameArray::ShrinkToFit() { Shrink(LengthFor(FrameCount())); }
+void FrameArray::ShrinkToFit(Isolate* isolate) {
+  Shrink(isolate, LengthFor(FrameCount()));
+}
 
 // static
 Handle<FrameArray> FrameArray::EnsureSpace(Handle<FrameArray> array,
@@ -10678,7 +10692,7 @@ void DescriptorArray::Sort() {
       parent_index = child_index;
     }
   }
-  DCHECK(IsSortedNoDuplicates(GetIsolate()));
+  DCHECK(IsSortedNoDuplicates());
 }
 
 
@@ -12149,13 +12163,13 @@ bool String::IsTwoByteEqualTo(Vector<const uc16> str) {
   return true;
 }
 
-
-uint32_t String::ComputeAndSetHash() {
+uint32_t String::ComputeAndSetHash(Isolate* isolate) {
   // Should only be called if hash code has not yet been computed.
   DCHECK(!HasHashCode());
 
   // Store the hash code in the object.
-  uint32_t field = IteratingStringHasher::Hash(this, GetHeap()->HashSeed());
+  uint32_t field =
+      IteratingStringHasher::Hash(this, isolate->heap()->HashSeed());
   set_hash_field(field);
 
   // Check the hash code is there.
@@ -12189,8 +12203,7 @@ bool String::SlowAsArrayIndex(uint32_t* index) {
 
 
 Handle<String> SeqString::Truncate(Handle<SeqString> string, int new_length) {
-  Heap* heap = string->GetHeap();
-  if (new_length == 0) return heap->isolate()->factory()->empty_string();
+  if (new_length == 0) return string->GetReadOnlyRoots().empty_string_handle();
 
   int new_size, old_size;
   int old_length = string->length();
@@ -12211,6 +12224,7 @@ Handle<String> SeqString::Truncate(Handle<SeqString> string, int new_length) {
   DCHECK_OBJECT_ALIGNED(start_of_string);
   DCHECK_OBJECT_ALIGNED(start_of_string + new_size);
 
+  Heap* heap = Heap::FromWritableHeapObject(*string);
   // Sizes are pointer size aligned, so that we can use filler objects
   // that are a multiple of pointer size.
   heap->CreateFillerObjectAt(start_of_string + new_size, delta,
@@ -13635,9 +13649,8 @@ int Script::GetLineNumber(int code_pos) const {
 }
 
 Object* Script::GetNameOrSourceURL() {
-  Isolate* isolate = GetIsolate();
   // Keep in sync with ScriptNameOrSourceURL in messages.js.
-  if (!source_url()->IsUndefined(isolate)) return source_url();
+  if (!source_url()->IsUndefined()) return source_url();
   return name();
 }
 
@@ -14896,14 +14909,20 @@ void Code::Disassemble(const char* name, std::ostream& os, Address current_pc) {
 }
 #endif  // ENABLE_DISASSEMBLER
 
-void BytecodeArray::Disassemble(Isolate* isolate, std::ostream& os) {
+void BytecodeArray::Disassemble(std::ostream& os) {
+  DisallowHeapAllocation no_gc;
+
   os << "Parameter count " << parameter_count() << "\n";
   os << "Frame size " << frame_size() << "\n";
 
   Address base_address = GetFirstBytecodeAddress();
   SourcePositionTableIterator source_positions(SourcePositionTable());
 
-  interpreter::BytecodeArrayIterator iterator(handle(this, isolate));
+  // Storage for backing the handle passed to the iterator. This handle won't be
+  // updated by the gc, but that's ok because we've disallowed GCs anyway.
+  BytecodeArray* handle_storage = this;
+  Handle<BytecodeArray> handle(&handle_storage);
+  interpreter::BytecodeArrayIterator iterator(handle);
   while (!iterator.done()) {
     if (!source_positions.done() &&
         iterator.current_offset() == source_positions.code_offset()) {
@@ -14943,7 +14962,7 @@ void BytecodeArray::Disassemble(Isolate* isolate, std::ostream& os) {
   os << "Constant pool (size = " << constant_pool()->length() << ")\n";
 #ifdef OBJECT_PRINT
   if (constant_pool()->length() > 0) {
-    constant_pool()->Print(isolate);
+    constant_pool()->Print();
   }
 #endif
 
@@ -15908,12 +15927,12 @@ int JSObject::GetFastElementsUsage() {
 template <typename Derived, typename Shape>
 void Dictionary<Derived, Shape>::Print(std::ostream& os) {
   DisallowHeapAllocation no_gc;
-  Isolate* isolate = this->GetIsolate();
+  ReadOnlyRoots roots = this->GetReadOnlyRoots();
   Derived* dictionary = Derived::cast(this);
   int capacity = dictionary->Capacity();
   for (int i = 0; i < capacity; i++) {
     Object* k = dictionary->KeyAt(i);
-    if (!dictionary->ToKey(isolate, i, &k)) continue;
+    if (!dictionary->ToKey(roots, i, &k)) continue;
     os << "\n   ";
     if (k->IsString()) {
       String::cast(k)->StringPrint(os);
@@ -16004,8 +16023,8 @@ bool JSObject::WasConstructedFromApiFunction() {
   return is_api_object;
 }
 
-const char* Symbol::PrivateSymbolToName(Isolate* isolate) const {
-  ReadOnlyRoots roots(isolate);
+const char* Symbol::PrivateSymbolToName() const {
+  ReadOnlyRoots roots = GetReadOnlyRoots();
 #define SYMBOL_CHECK_AND_PRINT(name) \
   if (this == roots.name()) return #name;
   PRIVATE_SYMBOL_LIST(SYMBOL_CHECK_AND_PRINT)
@@ -16015,16 +16034,15 @@ const char* Symbol::PrivateSymbolToName(Isolate* isolate) const {
 
 
 void Symbol::SymbolShortPrint(std::ostream& os) {
-  Isolate* isolate = GetIsolate();
   os << "<Symbol:";
-  if (!name()->IsUndefined(isolate)) {
+  if (!name()->IsUndefined()) {
     os << " ";
     HeapStringAllocator allocator;
     StringStream accumulator(&allocator);
     String::cast(name())->StringShortPrint(&accumulator, false);
     os << accumulator.ToCString().get();
   } else {
-    os << " (" << PrivateSymbolToName(isolate) << ")";
+    os << " (" << PrivateSymbolToName() << ")";
   }
   os << ">";
 }
@@ -16633,7 +16651,7 @@ Handle<Derived> HashTable<Derived, Shape>::NewInternal(
 }
 
 template <typename Derived, typename Shape>
-void HashTable<Derived, Shape>::Rehash(Derived* new_table) {
+void HashTable<Derived, Shape>::Rehash(Isolate* isolate, Derived* new_table) {
   DisallowHeapAllocation no_gc;
   WriteBarrierMode mode = new_table->GetWriteBarrierMode(no_gc);
 
@@ -16646,11 +16664,11 @@ void HashTable<Derived, Shape>::Rehash(Derived* new_table) {
 
   // Rehash the elements.
   int capacity = this->Capacity();
-  Isolate* isolate = new_table->GetIsolate();
+  ReadOnlyRoots roots(isolate);
   for (int i = 0; i < capacity; i++) {
     uint32_t from_index = EntryToIndex(i);
     Object* k = this->get(from_index);
-    if (!Shape::IsLive(isolate, k)) continue;
+    if (!Shape::IsLive(roots, k)) continue;
     uint32_t hash = Shape::HashForObject(isolate, k);
     uint32_t insertion_index =
         EntryToIndex(new_table->FindInsertionEntry(hash));
@@ -16663,9 +16681,10 @@ void HashTable<Derived, Shape>::Rehash(Derived* new_table) {
 }
 
 template <typename Derived, typename Shape>
-uint32_t HashTable<Derived, Shape>::EntryForProbe(Object* k, int probe,
+uint32_t HashTable<Derived, Shape>::EntryForProbe(Isolate* isolate, Object* k,
+                                                  int probe,
                                                   uint32_t expected) {
-  uint32_t hash = Shape::HashForObject(GetIsolate(), k);
+  uint32_t hash = Shape::HashForObject(isolate, k);
   uint32_t capacity = this->Capacity();
   uint32_t entry = FirstProbe(hash, capacity);
   for (int i = 1; i < probe; i++) {
@@ -16693,10 +16712,10 @@ void HashTable<Derived, Shape>::Swap(uint32_t entry1, uint32_t entry2,
 }
 
 template <typename Derived, typename Shape>
-void HashTable<Derived, Shape>::Rehash() {
+void HashTable<Derived, Shape>::Rehash(Isolate* isolate) {
   DisallowHeapAllocation no_gc;
   WriteBarrierMode mode = GetWriteBarrierMode(no_gc);
-  Isolate* isolate = GetIsolate();
+  ReadOnlyRoots roots(isolate);
   uint32_t capacity = Capacity();
   bool done = false;
   for (int probe = 1; !done; probe++) {
@@ -16705,12 +16724,12 @@ void HashTable<Derived, Shape>::Rehash() {
     done = true;
     for (uint32_t current = 0; current < capacity; current++) {
       Object* current_key = KeyAt(current);
-      if (!Shape::IsLive(isolate, current_key)) continue;
-      uint32_t target = EntryForProbe(current_key, probe, current);
+      if (!Shape::IsLive(roots, current_key)) continue;
+      uint32_t target = EntryForProbe(isolate, current_key, probe, current);
       if (current == target) continue;
       Object* target_key = KeyAt(target);
-      if (!Shape::IsLive(isolate, target_key) ||
-          EntryForProbe(target_key, probe, target) != target) {
+      if (!Shape::IsLive(roots, target_key) ||
+          EntryForProbe(isolate, target_key, probe, target) != target) {
         // Put the current element into the correct position.
         Swap(current, target, mode);
         // The other element will be processed on the next iteration.
@@ -16723,8 +16742,8 @@ void HashTable<Derived, Shape>::Rehash() {
     }
   }
   // Wipe deleted entries.
-  Object* the_hole = ReadOnlyRoots(isolate).the_hole_value();
-  Object* undefined = ReadOnlyRoots(isolate).undefined_value();
+  Object* the_hole = roots.the_hole_value();
+  Object* undefined = roots.undefined_value();
   for (uint32_t current = 0; current < capacity; current++) {
     if (KeyAt(current) == the_hole) {
       set(EntryToIndex(current) + kEntryKeyIndex, undefined);
@@ -16735,10 +16754,9 @@ void HashTable<Derived, Shape>::Rehash() {
 
 template <typename Derived, typename Shape>
 Handle<Derived> HashTable<Derived, Shape>::EnsureCapacity(
-    Handle<Derived> table, int n, PretenureFlag pretenure) {
+    Isolate* isolate, Handle<Derived> table, int n, PretenureFlag pretenure) {
   if (table->HasSufficientCapacityToAdd(n)) return table;
 
-  Isolate* isolate = table->GetIsolate();
   int capacity = table->Capacity();
   int new_nof = table->NumberOfElements() + n;
 
@@ -16749,7 +16767,7 @@ Handle<Derived> HashTable<Derived, Shape>::EnsureCapacity(
   Handle<Derived> new_table = HashTable::New(
       isolate, new_nof, should_pretenure ? TENURED : NOT_TENURED);
 
-  table->Rehash(*new_table);
+  table->Rehash(isolate, *new_table);
   return new_table;
 }
 
@@ -16773,7 +16791,8 @@ bool HashTable<Derived, Shape>::HasSufficientCapacityToAdd(
 }
 
 template <typename Derived, typename Shape>
-Handle<Derived> HashTable<Derived, Shape>::Shrink(Handle<Derived> table,
+Handle<Derived> HashTable<Derived, Shape>::Shrink(Isolate* isolate,
+                                                  Handle<Derived> table,
                                                   int additionalCapacity) {
   int capacity = table->Capacity();
   int nof = table->NumberOfElements();
@@ -16790,7 +16809,6 @@ Handle<Derived> HashTable<Derived, Shape>::Shrink(Handle<Derived> table,
   if (new_capacity < Derived::kMinShrinkCapacity) return table;
   if (new_capacity == capacity) return table;
 
-  Isolate* isolate = table->GetIsolate();
   const int kMinCapacityForPretenure = 256;
   bool pretenure = (at_least_room_for > kMinCapacityForPretenure) &&
                    !Heap::InNewSpace(*table);
@@ -16798,7 +16816,7 @@ Handle<Derived> HashTable<Derived, Shape>::Shrink(Handle<Derived> table,
       HashTable::New(isolate, new_capacity, pretenure ? TENURED : NOT_TENURED,
                      USE_CUSTOM_MINIMUM_CAPACITY);
 
-  table->Rehash(*new_table);
+  table->Rehash(isolate, *new_table);
   return new_table;
 }
 
@@ -16808,9 +16826,9 @@ uint32_t HashTable<Derived, Shape>::FindInsertionEntry(uint32_t hash) {
   uint32_t entry = FirstProbe(hash, capacity);
   uint32_t count = 1;
   // EnsureCapacity will guarantee the hash table is never full.
-  Isolate* isolate = GetIsolate();
+  ReadOnlyRoots roots = GetReadOnlyRoots();
   while (true) {
-    if (!Shape::IsLive(isolate, KeyAt(entry))) break;
+    if (!Shape::IsLive(roots, KeyAt(entry))) break;
     entry = NextProbe(entry, count++, capacity);
   }
   return entry;
@@ -17058,7 +17076,7 @@ void StringTable::EnsureCapacityForDeserialization(Isolate* isolate,
                                                    int expected) {
   Handle<StringTable> table = isolate->factory()->string_table();
   // We need a key instance for the virtual hash function.
-  table = StringTable::EnsureCapacity(table, expected);
+  table = StringTable::EnsureCapacity(isolate, table, expected);
   isolate->heap()->SetRootStringTable(*table);
 }
 
@@ -17071,10 +17089,12 @@ void MigrateExternalStringResource(Isolate* isolate, String* from, String* to) {
   const typename StringClass::Resource* to_resource = cast_to->resource();
   if (to_resource == nullptr) {
     // |to| is a just-created internalized copy of |from|. Migrate the resource.
-    cast_to->set_resource(cast_from->resource());
+    cast_to->SetResource(cast_from->resource());
     // Zap |from|'s resource pointer to reflect the fact that |from| has
     // relinquished ownership of its resource.
-    cast_from->set_resource(nullptr);
+    isolate->heap()->UpdateExternalString(
+        from, ExternalString::cast(from)->ExternalPayloadSize(), 0);
+    cast_from->SetResource(nullptr);
   } else if (to_resource != cast_from->resource()) {
     // |to| already existed and has its own resource. Finalize |from|.
     isolate->heap()->FinalizeExternalString(from);
@@ -17136,8 +17156,8 @@ Handle<String> StringTable::LookupString(Isolate* isolate,
   } else {  // !FLAG_thin_strings
     if (string->IsConsString()) {
       Handle<ConsString> cons = Handle<ConsString>::cast(string);
-      cons->set_first(*result);
-      cons->set_second(ReadOnlyRoots(isolate).empty_string());
+      cons->set_first(isolate, *result);
+      cons->set_second(isolate, ReadOnlyRoots(isolate).empty_string());
     } else if (string->IsSlicedString()) {
       STATIC_ASSERT(ConsString::kSize == SlicedString::kSize);
       DisallowHeapAllocation no_gc;
@@ -17147,8 +17167,8 @@ Handle<String> StringTable::LookupString(Isolate* isolate,
                             : isolate->factory()->cons_string_map();
       string->set_map(*map);
       Handle<ConsString> cons = Handle<ConsString>::cast(string);
-      cons->set_first(*result);
-      cons->set_second(ReadOnlyRoots(isolate).empty_string());
+      cons->set_first(isolate, *result);
+      cons->set_second(isolate, ReadOnlyRoots(isolate).empty_string());
     }
   }
   return result;
@@ -17164,9 +17184,9 @@ Handle<String> StringTable::LookupKey(Isolate* isolate, StringTableKey* key) {
     return handle(String::cast(table->KeyAt(entry)), isolate);
   }
 
-  table = StringTable::CautiousShrink(table);
+  table = StringTable::CautiousShrink(isolate, table);
   // Adding new string. Grow table if needed.
-  table = StringTable::EnsureCapacity(table, 1);
+  table = StringTable::EnsureCapacity(isolate, table, 1);
   isolate->heap()->SetRootStringTable(*table);
 
   return AddKeyNoResize(isolate, key);
@@ -17192,7 +17212,8 @@ Handle<String> StringTable::AddKeyNoResize(Isolate* isolate,
   return Handle<String>::cast(string);
 }
 
-Handle<StringTable> StringTable::CautiousShrink(Handle<StringTable> table) {
+Handle<StringTable> StringTable::CautiousShrink(Isolate* isolate,
+                                                Handle<StringTable> table) {
   // Only shrink if the table is very empty to avoid performance penalty.
   int capacity = table->Capacity();
   int nof = table->NumberOfElements();
@@ -17200,7 +17221,7 @@ Handle<StringTable> StringTable::CautiousShrink(Handle<StringTable> table) {
   if (nof > (capacity / kMaxEmptyFactor)) return table;
   // Keep capacity for at least half of the current nof elements.
   int slack_capacity = nof >> 2;
-  return Shrink(table, slack_capacity);
+  return Shrink(isolate, table, slack_capacity);
 }
 
 namespace {
@@ -17336,10 +17357,10 @@ class StringTableNoAllocateKey : public StringTableKey {
 }  // namespace
 
 // static
-Object* StringTable::LookupStringIfExists_NoAllocate(String* string) {
+Object* StringTable::LookupStringIfExists_NoAllocate(Isolate* isolate,
+                                                     String* string) {
   DisallowHeapAllocation no_gc;
-  Heap* heap = string->GetHeap();
-  Isolate* isolate = heap->isolate();
+  Heap* heap = isolate->heap();
   StringTable* table = heap->string_table();
 
   StringTableNoAllocateKey key(string, heap->HashSeed());
@@ -17363,7 +17384,7 @@ Object* StringTable::LookupStringIfExists_NoAllocate(String* string) {
   }
 
   DCHECK(!string->IsInternalizedString());
-  int entry = table->FindEntry(isolate, &key, key.Hash());
+  int entry = table->FindEntry(ReadOnlyRoots(isolate), &key, key.Hash());
   if (entry != kNotFound) {
     String* internalized = String::cast(table->KeyAt(entry));
     if (FLAG_thin_strings) {
@@ -17395,7 +17416,7 @@ Handle<StringSet> StringSet::New(Isolate* isolate) {
 Handle<StringSet> StringSet::Add(Isolate* isolate, Handle<StringSet> stringset,
                                  Handle<String> name) {
   if (!stringset->Has(name)) {
-    stringset = EnsureCapacity(stringset, 1);
+    stringset = EnsureCapacity(isolate, stringset, 1);
     uint32_t hash = ShapeT::Hash(isolate, *name);
     int entry = stringset->FindInsertionEntry(hash);
     stringset->set(EntryToIndex(entry), *name);
@@ -17408,12 +17429,12 @@ bool StringSet::Has(Handle<String> name) {
   return FindEntry(*name) != kNotFound;
 }
 
-Handle<ObjectHashSet> ObjectHashSet::Add(Handle<ObjectHashSet> set,
+Handle<ObjectHashSet> ObjectHashSet::Add(Isolate* isolate,
+                                         Handle<ObjectHashSet> set,
                                          Handle<Object> key) {
-  Isolate* isolate = set->GetIsolate();
   int32_t hash = key->GetOrCreateHash(isolate)->value();
   if (!set->Has(isolate, key, hash)) {
-    set = EnsureCapacity(set, 1);
+    set = EnsureCapacity(isolate, set, 1);
     int entry = set->FindInsertionEntry(hash);
     set->set(EntryToIndex(entry), *key);
     set->ElementAdded();
@@ -17598,7 +17619,7 @@ Handle<CompilationCacheTable> CompilationCacheTable::Put(
   Isolate* isolate = cache->GetIsolate();
   StringSharedKey key(src, shared, language_mode, kNoSourcePosition);
   Handle<Object> k = key.AsHandle(isolate);
-  cache = EnsureCapacity(cache, 1);
+  cache = EnsureCapacity(isolate, cache, 1);
   int entry = cache->FindInsertionEntry(key.Hash());
   cache->set(EntryToIndex(entry), *k);
   cache->set(EntryToIndex(entry) + 1, *value);
@@ -17615,7 +17636,7 @@ Handle<CompilationCacheTable> CompilationCacheTable::PutScript(
                                     isolate);
   StringSharedKey key(src, shared, language_mode, kNoSourcePosition);
   Handle<Object> k = key.AsHandle(isolate);
-  cache = EnsureCapacity(cache, 1);
+  cache = EnsureCapacity(isolate, cache, 1);
   int entry = cache->FindInsertionEntry(key.Hash());
   cache->set(EntryToIndex(entry), *k);
   cache->set(EntryToIndex(entry) + 1, *value);
@@ -17645,7 +17666,7 @@ Handle<CompilationCacheTable> CompilationCacheTable::PutEval(
     }
   }
 
-  cache = EnsureCapacity(cache, 1);
+  cache = EnsureCapacity(isolate, cache, 1);
   int entry = cache->FindInsertionEntry(key.Hash());
   Handle<Object> k =
       isolate->factory()->NewNumber(static_cast<double>(key.Hash()));
@@ -17655,12 +17676,11 @@ Handle<CompilationCacheTable> CompilationCacheTable::PutEval(
   return cache;
 }
 
-
 Handle<CompilationCacheTable> CompilationCacheTable::PutRegExp(
-      Handle<CompilationCacheTable> cache, Handle<String> src,
-      JSRegExp::Flags flags, Handle<FixedArray> value) {
+    Isolate* isolate, Handle<CompilationCacheTable> cache, Handle<String> src,
+    JSRegExp::Flags flags, Handle<FixedArray> value) {
   RegExpKey key(src, flags);
-  cache = EnsureCapacity(cache, 1);
+  cache = EnsureCapacity(isolate, cache, 1);
   int entry = cache->FindInsertionEntry(key.Hash());
   // We store the value in the key slot, and compare the search key
   // to the stored value with a custon IsMatch function during lookups.
@@ -17731,7 +17751,7 @@ Handle<Derived> BaseNameDictionary<Derived, Shape>::New(
 
 template <typename Derived, typename Shape>
 Handle<Derived> BaseNameDictionary<Derived, Shape>::EnsureCapacity(
-    Handle<Derived> dictionary, int n) {
+    Isolate* isolate, Handle<Derived> dictionary, int n) {
   // Check whether there are enough enumeration indices to add n elements.
   if (!PropertyDetails::IsValidIndex(dictionary->NextEnumerationIndex() + n)) {
     // If not, we generate new indices for the properties.
@@ -17744,7 +17764,7 @@ Handle<Derived> BaseNameDictionary<Derived, Shape>::EnsureCapacity(
     // the dictionary with new enumeration indices.
     for (int i = 0; i < length; i++) {
       int index = Smi::ToInt(iteration_order->get(i));
-      DCHECK(dictionary->IsKey(dictionary->GetIsolate(),
+      DCHECK(dictionary->IsKey(dictionary->GetReadOnlyRoots(),
                                dictionary->KeyAt(index)));
 
       int enum_index = PropertyDetails::kInitialIndex + i;
@@ -17758,17 +17778,17 @@ Handle<Derived> BaseNameDictionary<Derived, Shape>::EnsureCapacity(
     dictionary->SetNextEnumerationIndex(PropertyDetails::kInitialIndex +
                                         length);
   }
-  return HashTable<Derived, Shape>::EnsureCapacity(dictionary, n);
+  return HashTable<Derived, Shape>::EnsureCapacity(isolate, dictionary, n);
 }
 
 template <typename Derived, typename Shape>
 Handle<Derived> Dictionary<Derived, Shape>::DeleteEntry(
-    Handle<Derived> dictionary, int entry) {
+    Isolate* isolate, Handle<Derived> dictionary, int entry) {
   DCHECK(Shape::kEntrySize != 3 ||
          dictionary->DetailsAt(entry).IsConfigurable());
   dictionary->ClearEntry(entry);
   dictionary->ElementRemoved();
-  return Shrink(dictionary);
+  return Shrink(isolate, dictionary);
 }
 
 template <typename Derived, typename Shape>
@@ -17830,7 +17850,7 @@ Handle<Derived> Dictionary<Derived, Shape>::Add(Handle<Derived> dictionary,
   // Valdate key is absent.
   SLOW_DCHECK((dictionary->FindEntry(key) == Dictionary::kNotFound));
   // Check whether the dictionary should be extended.
-  dictionary = Derived::EnsureCapacity(dictionary, 1);
+  dictionary = Derived::EnsureCapacity(isolate, dictionary, 1);
 
   // Compute the key object.
   Handle<Object> k = Shape::AsHandle(isolate, key);
@@ -17853,11 +17873,11 @@ Handle<SimpleNumberDictionary> SimpleNumberDictionary::Set(
 
 bool NumberDictionary::HasComplexElements() {
   if (!requires_slow_elements()) return false;
-  Isolate* isolate = this->GetIsolate();
+  ReadOnlyRoots roots = GetReadOnlyRoots();
   int capacity = this->Capacity();
   for (int i = 0; i < capacity; i++) {
     Object* k;
-    if (!this->ToKey(isolate, i, &k)) continue;
+    if (!this->ToKey(roots, i, &k)) continue;
     PropertyDetails details = this->DetailsAt(i);
     if (details.kind() == kAccessor) return true;
     PropertyAttributes attr = details.attributes();
@@ -17897,14 +17917,14 @@ Handle<NumberDictionary> NumberDictionary::Set(
 }
 
 void NumberDictionary::CopyValuesTo(FixedArray* elements) {
-  Isolate* isolate = this->GetIsolate();
+  ReadOnlyRoots roots = GetReadOnlyRoots();
   int pos = 0;
   int capacity = this->Capacity();
   DisallowHeapAllocation no_gc;
   WriteBarrierMode mode = elements->GetWriteBarrierMode(no_gc);
   for (int i = 0; i < capacity; i++) {
     Object* k;
-    if (this->ToKey(isolate, i, &k)) {
+    if (this->ToKey(roots, i, &k)) {
       elements->set(pos++, this->ValueAt(i), mode);
     }
   }
@@ -17913,12 +17933,12 @@ void NumberDictionary::CopyValuesTo(FixedArray* elements) {
 
 template <typename Derived, typename Shape>
 int Dictionary<Derived, Shape>::NumberOfEnumerableProperties() {
-  Isolate* isolate = this->GetIsolate();
+  ReadOnlyRoots roots = this->GetReadOnlyRoots();
   int capacity = this->Capacity();
   int result = 0;
   for (int i = 0; i < capacity; i++) {
     Object* k;
-    if (!this->ToKey(isolate, i, &k)) continue;
+    if (!this->ToKey(roots, i, &k)) continue;
     if (k->FilterKey(ENUMERABLE_STRINGS)) continue;
     PropertyDetails details = this->DetailsAt(i);
     PropertyAttributes attr = details.attributes();
@@ -17948,9 +17968,10 @@ void BaseNameDictionary<Derived, Shape>::CopyEnumKeysTo(
   int length = storage->length();
   int capacity = dictionary->Capacity();
   int properties = 0;
+  ReadOnlyRoots roots(isolate);
   for (int i = 0; i < capacity; i++) {
     Object* key;
-    if (!dictionary->ToKey(isolate, i, &key)) continue;
+    if (!dictionary->ToKey(roots, i, &key)) continue;
     bool is_shadowing_key = false;
     if (key->IsSymbol()) continue;
     PropertyDetails details = dictionary->DetailsAt(i);
@@ -17995,13 +18016,14 @@ Handle<FixedArray> BaseNameDictionary<Derived, Shape>::IterationIndices(
   int capacity = dictionary->Capacity();
   int length = dictionary->NumberOfElements();
   Handle<FixedArray> array = isolate->factory()->NewFixedArray(length);
+  ReadOnlyRoots roots(isolate);
   int array_size = 0;
   {
     DisallowHeapAllocation no_gc;
     Derived* raw_dictionary = *dictionary;
     for (int i = 0; i < capacity; i++) {
       Object* k;
-      if (!raw_dictionary->ToKey(isolate, i, &k)) continue;
+      if (!raw_dictionary->ToKey(roots, i, &k)) continue;
       array->set(array_size++, Smi::FromInt(i));
     }
 
@@ -18015,13 +18037,14 @@ Handle<FixedArray> BaseNameDictionary<Derived, Shape>::IterationIndices(
             array->GetFirstElementAddress());
     std::sort(start, start + array_size, cmp);
   }
-  return FixedArray::ShrinkOrEmpty(array, array_size);
+  return FixedArray::ShrinkOrEmpty(isolate, array, array_size);
 }
 
 template <typename Derived, typename Shape>
 void BaseNameDictionary<Derived, Shape>::CollectKeysTo(
     Handle<Derived> dictionary, KeyAccumulator* keys) {
   Isolate* isolate = keys->isolate();
+  ReadOnlyRoots roots(isolate);
   int capacity = dictionary->Capacity();
   Handle<FixedArray> array =
       isolate->factory()->NewFixedArray(dictionary->NumberOfElements());
@@ -18032,7 +18055,7 @@ void BaseNameDictionary<Derived, Shape>::CollectKeysTo(
     Derived* raw_dictionary = *dictionary;
     for (int i = 0; i < capacity; i++) {
       Object* k;
-      if (!raw_dictionary->ToKey(isolate, i, &k)) continue;
+      if (!raw_dictionary->ToKey(roots, i, &k)) continue;
       if (k->FilterKey(filter)) continue;
       PropertyDetails details = raw_dictionary->DetailsAt(i);
       if ((details.attributes() & filter) != 0) {
@@ -18081,15 +18104,15 @@ void BaseNameDictionary<Derived, Shape>::CollectKeysTo(
 template <typename Derived, typename Shape>
 Object* Dictionary<Derived, Shape>::SlowReverseLookup(Object* value) {
   Derived* dictionary = Derived::cast(this);
-  Isolate* isolate = dictionary->GetIsolate();
+  ReadOnlyRoots roots = dictionary->GetReadOnlyRoots();
   int capacity = dictionary->Capacity();
   for (int i = 0; i < capacity; i++) {
     Object* k;
-    if (!dictionary->ToKey(isolate, i, &k)) continue;
+    if (!dictionary->ToKey(roots, i, &k)) continue;
     Object* e = dictionary->ValueAt(i);
     if (e == value) return k;
   }
-  return ReadOnlyRoots(isolate).undefined_value();
+  return roots.undefined_value();
 }
 
 template <typename Derived, typename Shape>
@@ -18102,14 +18125,14 @@ void ObjectHashTableBase<Derived, Shape>::FillEntriesWithHoles(
 }
 
 template <typename Derived, typename Shape>
-Object* ObjectHashTableBase<Derived, Shape>::Lookup(Isolate* isolate,
+Object* ObjectHashTableBase<Derived, Shape>::Lookup(ReadOnlyRoots roots,
                                                     Handle<Object> key,
                                                     int32_t hash) {
   DisallowHeapAllocation no_gc;
-  DCHECK(this->IsKey(isolate, *key));
+  DCHECK(this->IsKey(roots, *key));
 
-  int entry = this->FindEntry(isolate, key, hash);
-  if (entry == kNotFound) return ReadOnlyRoots(isolate).the_hole_value();
+  int entry = this->FindEntry(roots, key, hash);
+  if (entry == kNotFound) return roots.the_hole_value();
   return this->get(Derived::EntryToIndex(entry) + 1);
 }
 
@@ -18117,21 +18140,21 @@ template <typename Derived, typename Shape>
 Object* ObjectHashTableBase<Derived, Shape>::Lookup(Handle<Object> key) {
   DisallowHeapAllocation no_gc;
 
-  Isolate* isolate = this->GetIsolate();
-  DCHECK(this->IsKey(isolate, *key));
+  ReadOnlyRoots roots = this->GetReadOnlyRoots();
+  DCHECK(this->IsKey(roots, *key));
 
   // If the object does not have an identity hash, it was never used as a key.
   Object* hash = key->GetHash();
-  if (hash->IsUndefined(isolate)) {
-    return ReadOnlyRoots(isolate).the_hole_value();
+  if (hash->IsUndefined(roots)) {
+    return roots.the_hole_value();
   }
-  return Lookup(isolate, key, Smi::ToInt(hash));
+  return Lookup(roots, key, Smi::ToInt(hash));
 }
 
 template <typename Derived, typename Shape>
 Object* ObjectHashTableBase<Derived, Shape>::Lookup(Handle<Object> key,
                                                     int32_t hash) {
-  return Lookup(this->GetIsolate(), key, hash);
+  return Lookup(this->GetReadOnlyRoots(), key, hash);
 }
 
 template <typename Derived, typename Shape>
@@ -18143,26 +18166,28 @@ template <typename Derived, typename Shape>
 Handle<Derived> ObjectHashTableBase<Derived, Shape>::Put(Handle<Derived> table,
                                                          Handle<Object> key,
                                                          Handle<Object> value) {
-  Isolate* isolate = table->GetIsolate();
-  DCHECK(table->IsKey(isolate, *key));
-  DCHECK(!value->IsTheHole(isolate));
+  Isolate* isolate = Heap::FromWritableHeapObject(*table)->isolate();
+  DCHECK(table->IsKey(ReadOnlyRoots(isolate), *key));
+  DCHECK(!value->IsTheHole(ReadOnlyRoots(isolate)));
 
   // Make sure the key object has an identity hash code.
   int32_t hash = key->GetOrCreateHash(isolate)->value();
 
-  return ObjectHashTableBase<Derived, Shape>::Put(table, key, value, hash);
+  return ObjectHashTableBase<Derived, Shape>::Put(isolate, table, key, value,
+                                                  hash);
 }
 
 template <typename Derived, typename Shape>
-Handle<Derived> ObjectHashTableBase<Derived, Shape>::Put(Handle<Derived> table,
+Handle<Derived> ObjectHashTableBase<Derived, Shape>::Put(Isolate* isolate,
+                                                         Handle<Derived> table,
                                                          Handle<Object> key,
                                                          Handle<Object> value,
                                                          int32_t hash) {
-  Isolate* isolate = table->GetIsolate();
-  DCHECK(table->IsKey(isolate, *key));
-  DCHECK(!value->IsTheHole(isolate));
+  ReadOnlyRoots roots(isolate);
+  DCHECK(table->IsKey(roots, *key));
+  DCHECK(!value->IsTheHole(roots));
 
-  int entry = table->FindEntry(isolate, key, hash);
+  int entry = table->FindEntry(roots, key, hash);
 
   // Key is already in table, just overwrite value.
   if (entry != kNotFound) {
@@ -18173,7 +18198,7 @@ Handle<Derived> ObjectHashTableBase<Derived, Shape>::Put(Handle<Derived> table,
   // Rehash if more than 33% of the entries are deleted entries.
   // TODO(jochen): Consider to shrink the fixed array in place.
   if ((table->NumberOfDeletedElements() << 1) > table->NumberOfElements()) {
-    table->Rehash();
+    table->Rehash(isolate);
   }
   // If we're out of luck, we didn't get a GC recently, and so rehashing
   // isn't enough to avoid a crash.
@@ -18186,20 +18211,21 @@ Handle<Derived> ObjectHashTableBase<Derived, Shape>::Put(Handle<Derived> table,
             Heap::kFinalizeIncrementalMarkingMask,
             GarbageCollectionReason::kFullHashtable);
       }
-      table->Rehash();
+      table->Rehash(isolate);
     }
   }
 
   // Check whether the hash table should be extended.
-  table = Derived::EnsureCapacity(table, 1);
+  table = Derived::EnsureCapacity(isolate, table, 1);
   table->AddEntry(table->FindInsertionEntry(hash), *key, *value);
   return table;
 }
 
 template <typename Derived, typename Shape>
 Handle<Derived> ObjectHashTableBase<Derived, Shape>::Remove(
-    Handle<Derived> table, Handle<Object> key, bool* was_present) {
-  DCHECK(table->IsKey(table->GetIsolate(), *key));
+    Isolate* isolate, Handle<Derived> table, Handle<Object> key,
+    bool* was_present) {
+  DCHECK(table->IsKey(table->GetReadOnlyRoots(), *key));
 
   Object* hash = key->GetHash();
   if (hash->IsUndefined()) {
@@ -18207,17 +18233,17 @@ Handle<Derived> ObjectHashTableBase<Derived, Shape>::Remove(
     return table;
   }
 
-  return Remove(table, key, was_present, Smi::ToInt(hash));
+  return Remove(isolate, table, key, was_present, Smi::ToInt(hash));
 }
 
 template <typename Derived, typename Shape>
 Handle<Derived> ObjectHashTableBase<Derived, Shape>::Remove(
-    Handle<Derived> table, Handle<Object> key, bool* was_present,
-    int32_t hash) {
-  Isolate* isolate = table->GetIsolate();
-  DCHECK(table->IsKey(isolate, *key));
+    Isolate* isolate, Handle<Derived> table, Handle<Object> key,
+    bool* was_present, int32_t hash) {
+  ReadOnlyRoots roots = table->GetReadOnlyRoots();
+  DCHECK(table->IsKey(roots, *key));
 
-  int entry = table->FindEntry(isolate, key, hash);
+  int entry = table->FindEntry(roots, key, hash);
   if (entry == kNotFound) {
     *was_present = false;
     return table;
@@ -18225,7 +18251,7 @@ Handle<Derived> ObjectHashTableBase<Derived, Shape>::Remove(
 
   *was_present = true;
   table->RemoveEntry(entry);
-  return Derived::Shrink(table);
+  return Derived::Shrink(isolate, table);
 }
 
 template <typename Derived, typename Shape>
@@ -18282,9 +18308,9 @@ void JSWeakCollection::Set(Handle<JSWeakCollection> weak_collection,
   Handle<EphemeronHashTable> table(
       EphemeronHashTable::cast(weak_collection->table()),
       weak_collection->GetIsolate());
-  DCHECK(table->IsKey(weak_collection->GetIsolate(), *key));
-  Handle<EphemeronHashTable> new_table =
-      EphemeronHashTable::Put(table, key, value, hash);
+  DCHECK(table->IsKey(weak_collection->GetReadOnlyRoots(), *key));
+  Handle<EphemeronHashTable> new_table = EphemeronHashTable::Put(
+      weak_collection->GetIsolate(), table, key, value, hash);
   weak_collection->set_table(*new_table);
   if (*table != *new_table) {
     // Zap the old table since we didn't record slots for its elements.
@@ -18299,10 +18325,10 @@ bool JSWeakCollection::Delete(Handle<JSWeakCollection> weak_collection,
   Handle<EphemeronHashTable> table(
       EphemeronHashTable::cast(weak_collection->table()),
       weak_collection->GetIsolate());
-  DCHECK(table->IsKey(weak_collection->GetIsolate(), *key));
+  DCHECK(table->IsKey(weak_collection->GetReadOnlyRoots(), *key));
   bool was_present = false;
-  Handle<EphemeronHashTable> new_table =
-      EphemeronHashTable::Remove(table, key, &was_present, hash);
+  Handle<EphemeronHashTable> new_table = EphemeronHashTable::Remove(
+      weak_collection->GetIsolate(), table, key, &was_present, hash);
   weak_collection->set_table(*new_table);
   if (*table != *new_table) {
     // Zap the old table since we didn't record slots for its elements.
@@ -18329,11 +18355,12 @@ Handle<JSArray> JSWeakCollection::GetEntries(Handle<JSWeakCollection> holder,
 
   {
     DisallowHeapAllocation no_gc;
+    ReadOnlyRoots roots = ReadOnlyRoots(isolate);
     int count = 0;
     for (int i = 0;
          count / values_per_entry < max_entries && i < table->Capacity(); i++) {
       Object* key;
-      if (table->ToKey(isolate, i, &key)) {
+      if (table->ToKey(roots, i, &key)) {
         entries->set(count++, key);
         if (values_per_entry > 1) {
           Object* value = table->Lookup(handle(key, isolate));
@@ -19009,7 +19036,8 @@ HashTable<ObjectHashSet, ObjectHashSetShape>::New(Isolate*, int n,
                                                   MinimumCapacity);
 
 template Handle<NameDictionary>
-HashTable<NameDictionary, NameDictionaryShape>::Shrink(Handle<NameDictionary>,
+HashTable<NameDictionary, NameDictionaryShape>::Shrink(Isolate* isolate,
+                                                       Handle<NameDictionary>,
                                                        int additionalCapacity);
 
 template Handle<NameDictionary>
@@ -19022,11 +19050,12 @@ BaseNameDictionary<GlobalDictionary, GlobalDictionaryShape>::Add(
     Handle<GlobalDictionary>, Handle<Name>, Handle<Object>, PropertyDetails,
     int*);
 
-template void HashTable<GlobalDictionary, GlobalDictionaryShape>::Rehash();
+template void HashTable<GlobalDictionary, GlobalDictionaryShape>::Rehash(
+    Isolate* isolate);
 
 template Handle<NameDictionary>
 BaseNameDictionary<NameDictionary, NameDictionaryShape>::EnsureCapacity(
-    Handle<NameDictionary>, int);
+    Isolate* isolate, Handle<NameDictionary>, int);
 
 template void
 BaseNameDictionary<GlobalDictionary, GlobalDictionaryShape>::CopyEnumKeysTo(
diff --git a/deps/v8/src/objects.h b/deps/v8/src/objects.h
index 6e0279db34a287..7b903a82e72c3f 100644
--- a/deps/v8/src/objects.h
+++ b/deps/v8/src/objects.h
@@ -170,10 +170,10 @@
 //         - PromiseResolveThenableJobTask
 //       - Module
 //       - ModuleInfoEntry
-//       - PreParsedScopeData
 //     - WeakCell
 //     - FeedbackCell
 //     - FeedbackVector
+//     - PreParsedScopeData
 //     - UncompiledData
 //       - UncompiledDataWithoutPreParsedScope
 //       - UncompiledDataWithPreParsedScope
@@ -523,6 +523,7 @@ enum InstanceType : uint16_t {
   FEEDBACK_CELL_TYPE,
   FEEDBACK_VECTOR_TYPE,
   LOAD_HANDLER_TYPE,
+  PRE_PARSED_SCOPE_DATA_TYPE,
   PROPERTY_ARRAY_TYPE,
   PROPERTY_CELL_TYPE,
   SHARED_FUNCTION_INFO_TYPE,
@@ -706,6 +707,7 @@ class ModuleInfoEntry;
 class ObjectHashTable;
 class ObjectTemplateInfo;
 class ObjectVisitor;
+class PreParsedScopeData;
 class PropertyCell;
 class PropertyDescriptor;
 class RootVisitor;
@@ -728,11 +730,8 @@ template <class C> inline bool Is(Object* obj);
 
 #ifdef OBJECT_PRINT
 #define DECL_PRINTER(Name) void Name##Print(std::ostream& os);  // NOLINT
-#define DECL_PRINTER_WITH_ISOLATE(Name) \
-  void Name##Print(Isolate* isolate, std::ostream& os);  // NOLINT
 #else
 #define DECL_PRINTER(Name)
-#define DECL_PRINTER_WITH_ISOLATE(Name)
 #endif
 
 #define OBJECT_TYPE_LIST(V) \
@@ -1297,13 +1296,13 @@ class Object {
 
 #ifdef OBJECT_PRINT
   // For our gdb macros, we should perhaps change these in the future.
-  void Print(Isolate* isolate);
+  void Print();
 
   // Prints this object with details.
-  void Print(Isolate* isolate, std::ostream& os);  // NOLINT
+  void Print(std::ostream& os);  // NOLINT
 #else
-  void Print(Isolate* isolate) { ShortPrint(); }
-  void Print(Isolate* isolate, std::ostream& os) { ShortPrint(os); }  // NOLINT
+  void Print() { ShortPrint(); }
+  void Print(std::ostream& os) { ShortPrint(os); }  // NOLINT
 #endif
 
  private:
@@ -1625,7 +1624,7 @@ class HeapObject: public Object {
 #ifdef OBJECT_PRINT
   void PrintHeader(std::ostream& os, const char* id);  // NOLINT
 #endif
-  DECL_PRINTER_WITH_ISOLATE(HeapObject)
+  DECL_PRINTER(HeapObject)
   DECL_VERIFIER(HeapObject)
 #ifdef VERIFY_HEAP
   inline void VerifyObjectField(int offset);
@@ -1650,7 +1649,7 @@ class HeapObject: public Object {
   bool CanBeRehashed() const;
 
   // Rehash the object based on the layout inferred from its map.
-  void RehashBasedOnMap();
+  void RehashBasedOnMap(Isolate* isolate);
 
   // Layout description.
   // First field in a heap object is map.
@@ -2461,7 +2460,7 @@ class JSObject: public JSReceiver {
 
   // Dispatched behavior.
   void JSObjectShortPrint(StringStream* accumulator);
-  DECL_PRINTER_WITH_ISOLATE(JSObject)
+  DECL_PRINTER(JSObject)
   DECL_VERIFIER(JSObject)
 #ifdef OBJECT_PRINT
   bool PrintProperties(std::ostream& os);  // NOLINT
@@ -2772,60 +2771,6 @@ class AsyncGeneratorRequest : public Struct {
   DISALLOW_IMPLICIT_CONSTRUCTORS(AsyncGeneratorRequest);
 };
 
-// Container for metadata stored on each prototype map.
-class PrototypeInfo : public Struct {
- public:
-  static const int UNREGISTERED = -1;
-
-  // [weak_cell]: A WeakCell containing this prototype. ICs cache the cell here.
-  DECL_ACCESSORS(weak_cell, Object)
-
-  // [prototype_users]: FixedArrayOfWeakCells containing maps using this
-  // prototype, or Smi(0) if uninitialized.
-  DECL_ACCESSORS(prototype_users, Object)
-
-  // [object_create_map]: A field caching the map for Object.create(prototype).
-  static inline void SetObjectCreateMap(Handle<PrototypeInfo> info,
-                                        Handle<Map> map);
-  inline Map* ObjectCreateMap();
-  inline bool HasObjectCreateMap();
-
-  // [registry_slot]: Slot in prototype's user registry where this user
-  // is stored. Returns UNREGISTERED if this prototype has not been registered.
-  inline int registry_slot() const;
-  inline void set_registry_slot(int slot);
-
-  // [bit_field]
-  inline int bit_field() const;
-  inline void set_bit_field(int bit_field);
-
-  DECL_BOOLEAN_ACCESSORS(should_be_fast_map)
-
-  DECL_CAST(PrototypeInfo)
-
-  // Dispatched behavior.
-  DECL_PRINTER(PrototypeInfo)
-  DECL_VERIFIER(PrototypeInfo)
-
-  static const int kWeakCellOffset = HeapObject::kHeaderSize;
-  static const int kPrototypeUsersOffset = kWeakCellOffset + kPointerSize;
-  static const int kRegistrySlotOffset = kPrototypeUsersOffset + kPointerSize;
-  static const int kValidityCellOffset = kRegistrySlotOffset + kPointerSize;
-  static const int kObjectCreateMapOffset = kValidityCellOffset + kPointerSize;
-  static const int kBitFieldOffset = kObjectCreateMapOffset + kPointerSize;
-  static const int kSize = kBitFieldOffset + kPointerSize;
-
-  // Bit field usage.
-  static const int kShouldBeFastBit = 0;
-
-  class BodyDescriptor;
-
- private:
-  DECL_ACCESSORS(object_create_map, MaybeObject)
-
-  DISALLOW_IMPLICIT_CONSTRUCTORS(PrototypeInfo);
-};
-
 // List of builtin functions we want to identify to improve code
 // generation.
 //
@@ -3068,7 +3013,7 @@ class JSGeneratorObject: public JSObject {
   DECL_CAST(JSGeneratorObject)
 
   // Dispatched behavior.
-  DECL_PRINTER_WITH_ISOLATE(JSGeneratorObject)
+  DECL_PRINTER(JSGeneratorObject)
   DECL_VERIFIER(JSGeneratorObject)
 
   // Magic sentinel values for the continuation.
@@ -3140,7 +3085,7 @@ class JSBoundFunction : public JSObject {
   DECL_CAST(JSBoundFunction)
 
   // Dispatched behavior.
-  DECL_PRINTER_WITH_ISOLATE(JSBoundFunction)
+  DECL_PRINTER(JSBoundFunction)
   DECL_VERIFIER(JSBoundFunction)
 
   // The bound function's string representation implemented according
@@ -3311,7 +3256,7 @@ class JSFunction: public JSObject {
   class BodyDescriptor;
 
   // Dispatched behavior.
-  DECL_PRINTER_WITH_ISOLATE(JSFunction)
+  DECL_PRINTER(JSFunction)
   DECL_VERIFIER(JSFunction)
 
   // The function's name if it is configured, otherwise shared function info
@@ -3378,7 +3323,7 @@ class JSGlobalProxy : public JSObject {
   static int SizeWithEmbedderFields(int embedder_field_count);
 
   // Dispatched behavior.
-  DECL_PRINTER_WITH_ISOLATE(JSGlobalProxy)
+  DECL_PRINTER(JSGlobalProxy)
   DECL_VERIFIER(JSGlobalProxy)
 
   // Layout description.
@@ -3415,7 +3360,7 @@ class JSGlobalObject : public JSObject {
   inline bool IsDetached();
 
   // Dispatched behavior.
-  DECL_PRINTER_WITH_ISOLATE(JSGlobalObject)
+  DECL_PRINTER(JSGlobalObject)
   DECL_VERIFIER(JSGlobalObject)
 
   // Layout description.
@@ -3438,7 +3383,7 @@ class JSValue: public JSObject {
   DECL_CAST(JSValue)
 
   // Dispatched behavior.
-  DECL_PRINTER_WITH_ISOLATE(JSValue)
+  DECL_PRINTER(JSValue)
   DECL_VERIFIER(JSValue)
 
   // Layout description.
@@ -3493,7 +3438,7 @@ class JSDate: public JSObject {
   void SetValue(Object* value, bool is_value_nan);
 
   // Dispatched behavior.
-  DECL_PRINTER_WITH_ISOLATE(JSDate)
+  DECL_PRINTER(JSDate)
   DECL_VERIFIER(JSDate)
 
   // The order is important. It must be kept in sync with date macros
@@ -3596,7 +3541,7 @@ class JSMessageObject: public JSObject {
   DECL_CAST(JSMessageObject)
 
   // Dispatched behavior.
-  DECL_PRINTER_WITH_ISOLATE(JSMessageObject)
+  DECL_PRINTER(JSMessageObject)
   DECL_VERIFIER(JSMessageObject)
 
   // Layout description.
@@ -3844,7 +3789,7 @@ class Oddball: public HeapObject {
 
   // ES6 section 7.1.3 ToNumber for Boolean, Null, Undefined.
   V8_WARN_UNUSED_RESULT static inline Handle<Object> ToNumber(
-      Handle<Oddball> input);
+      Isolate* isolate, Handle<Oddball> input);
 
   DECL_CAST(Oddball)
 
@@ -3940,7 +3885,7 @@ class FeedbackCell : public Struct {
   DECL_CAST(FeedbackCell)
 
   // Dispatched behavior.
-  DECL_PRINTER_WITH_ISOLATE(FeedbackCell)
+  DECL_PRINTER(FeedbackCell)
   DECL_VERIFIER(FeedbackCell)
 
   static const int kValueOffset = HeapObject::kHeaderSize;
diff --git a/deps/v8/src/objects/api-callbacks.h b/deps/v8/src/objects/api-callbacks.h
index 46247e9b98f73c..146b7a5adaf6ce 100644
--- a/deps/v8/src/objects/api-callbacks.h
+++ b/deps/v8/src/objects/api-callbacks.h
@@ -37,8 +37,7 @@ class AccessorInfo : public Struct {
   DECL_ACCESSORS(js_getter, Object)
   DECL_ACCESSORS(data, Object)
 
-  static Address redirect(Isolate* isolate, Address address,
-                          AccessorComponent component);
+  static Address redirect(Address address, AccessorComponent component);
   Address redirected_getter() const;
 
   // Dispatched behavior.
diff --git a/deps/v8/src/objects/bigint.h b/deps/v8/src/objects/bigint.h
index 43660990eea13b..f8c5c3dbf69798 100644
--- a/deps/v8/src/objects/bigint.h
+++ b/deps/v8/src/objects/bigint.h
@@ -85,10 +85,7 @@ class FreshlyAllocatedBigInt : public BigIntBase {
   //   (and no explicit operator is provided either).
 
  public:
-  inline static FreshlyAllocatedBigInt* cast(Object* object) {
-    SLOW_DCHECK(object->IsBigInt());
-    return reinterpret_cast<FreshlyAllocatedBigInt*>(object);
-  }
+  inline static FreshlyAllocatedBigInt* cast(Object* object);
 
  private:
   DISALLOW_IMPLICIT_CONSTRUCTORS(FreshlyAllocatedBigInt);
diff --git a/deps/v8/src/objects/code.h b/deps/v8/src/objects/code.h
index fb39d53983c862..3f3c3498c8f499 100644
--- a/deps/v8/src/objects/code.h
+++ b/deps/v8/src/objects/code.h
@@ -763,10 +763,10 @@ class BytecodeArray : public FixedArrayBase {
   int SourcePosition(int offset);
   int SourceStatementPosition(int offset);
 
-  DECL_PRINTER_WITH_ISOLATE(BytecodeArray)
+  DECL_PRINTER(BytecodeArray)
   DECL_VERIFIER(BytecodeArray)
 
-  void Disassemble(Isolate* isolate, std::ostream& os);
+  void Disassemble(std::ostream& os);
 
   void CopyBytecodesTo(BytecodeArray* to);
 
diff --git a/deps/v8/src/objects/compilation-cache.h b/deps/v8/src/objects/compilation-cache.h
index e65dc22fb4a080..bec4e8dd627e9e 100644
--- a/deps/v8/src/objects/compilation-cache.h
+++ b/deps/v8/src/objects/compilation-cache.h
@@ -93,7 +93,7 @@ class CompilationCacheTable
       Handle<Context> native_context, Handle<FeedbackCell> feedback_cell,
       int position);
   static Handle<CompilationCacheTable> PutRegExp(
-      Handle<CompilationCacheTable> cache, Handle<String> src,
+      Isolate* isolate, Handle<CompilationCacheTable> cache, Handle<String> src,
       JSRegExp::Flags flags, Handle<FixedArray> value);
   void Remove(Object* value);
   void Age();
diff --git a/deps/v8/src/objects/descriptor-array.h b/deps/v8/src/objects/descriptor-array.h
index 9e2b7783a50040..c77e1000b7dc7c 100644
--- a/deps/v8/src/objects/descriptor-array.h
+++ b/deps/v8/src/objects/descriptor-array.h
@@ -85,7 +85,6 @@ class DescriptorArray : public WeakFixedArray {
   inline void SetSortedKey(int pointer, int descriptor_number);
 
   // Accessor for complete descriptor.
-  inline void Get(int descriptor_number, Descriptor* desc);
   inline void Set(int descriptor_number, Descriptor* desc);
   inline void Set(int descriptor_number, Name* key, MaybeObject* value,
                   PropertyDetails details);
@@ -158,7 +157,7 @@ class DescriptorArray : public WeakFixedArray {
 
 #ifdef DEBUG
   // Is the descriptor array sorted and without duplicates?
-  bool IsSortedNoDuplicates(Isolate* isolate, int valid_descriptors = -1);
+  bool IsSortedNoDuplicates(int valid_descriptors = -1);
 
   // Are two DescriptorArrays equal?
   bool IsEqualTo(DescriptorArray* other);
diff --git a/deps/v8/src/objects/dictionary.h b/deps/v8/src/objects/dictionary.h
index aeb094d6755c73..e6504a1876e041 100644
--- a/deps/v8/src/objects/dictionary.h
+++ b/deps/v8/src/objects/dictionary.h
@@ -49,12 +49,12 @@ class Dictionary : public HashTable<Derived, Shape> {
 
   // Delete a property from the dictionary.
   V8_WARN_UNUSED_RESULT static Handle<Derived> DeleteEntry(
-      Handle<Derived> dictionary, int entry);
+      Isolate* isolate, Handle<Derived> dictionary, int entry);
 
   // Attempt to shrink the dictionary after deletion of key.
   V8_WARN_UNUSED_RESULT static inline Handle<Derived> Shrink(
-      Handle<Derived> dictionary) {
-    return DerivedHashTable::Shrink(dictionary);
+      Isolate* isolate, Handle<Derived> dictionary) {
+    return DerivedHashTable::Shrink(isolate, dictionary);
   }
 
   int NumberOfEnumerableProperties();
@@ -174,7 +174,8 @@ class BaseNameDictionary : public Dictionary<Derived, Shape> {
                              KeyAccumulator* accumulator);
 
   // Ensure enough space for n additional elements.
-  static Handle<Derived> EnsureCapacity(Handle<Derived> dictionary, int n);
+  static Handle<Derived> EnsureCapacity(Isolate* isolate,
+                                        Handle<Derived> dictionary, int n);
 
   V8_WARN_UNUSED_RESULT static Handle<Derived> AddNoUpdateNextEnumerationIndex(
       Handle<Derived> dictionary, Key key, Handle<Object> value,
@@ -215,8 +216,8 @@ class GlobalDictionaryShape : public NameDictionaryShape {
                                   PropertyDetails value);
 
   static inline Object* Unwrap(Object* key);
-  static inline bool IsKey(Isolate* isolate, Object* k);
-  static inline bool IsLive(Isolate* isolate, Object* key);
+  static inline bool IsKey(ReadOnlyRoots roots, Object* k);
+  static inline bool IsLive(ReadOnlyRoots roots, Object* key);
   static inline int GetMapRootIndex();
 };
 
diff --git a/deps/v8/src/objects/fixed-array.h b/deps/v8/src/objects/fixed-array.h
index 5082f0fa010b07..b29d3d57771245 100644
--- a/deps/v8/src/objects/fixed-array.h
+++ b/deps/v8/src/objects/fixed-array.h
@@ -104,7 +104,8 @@ class FixedArray : public FixedArrayBase {
   Handle<T> GetValueChecked(Isolate* isolate, int index) const;
 
   // Return a grown copy if the index is bigger than the array's length.
-  static Handle<FixedArray> SetAndGrow(Handle<FixedArray> array, int index,
+  static Handle<FixedArray> SetAndGrow(Isolate* isolate,
+                                       Handle<FixedArray> array, int index,
                                        Handle<Object> value,
                                        PretenureFlag pretenure = NOT_TENURED);
 
@@ -136,10 +137,11 @@ class FixedArray : public FixedArrayBase {
   inline void FillWithHoles(int from, int to);
 
   // Shrink the array and insert filler objects. {new_length} must be > 0.
-  void Shrink(int new_length);
+  void Shrink(Isolate* isolate, int new_length);
   // If {new_length} is 0, return the canonical empty FixedArray. Otherwise
   // like above.
-  static Handle<FixedArray> ShrinkOrEmpty(Handle<FixedArray> array,
+  static Handle<FixedArray> ShrinkOrEmpty(Isolate* isolate,
+                                          Handle<FixedArray> array,
                                           int new_length);
 
   // Copy a sub array from the receiver to dest.
@@ -390,7 +392,7 @@ class FixedArrayOfWeakCells : public FixedArray {
   };
 
   template <class CompactionCallback>
-  void Compact();
+  void Compact(Isolate* isolate);
 
   inline Object* Get(int index) const;
   inline void Clear(int index);
@@ -491,7 +493,7 @@ class ArrayList : public FixedArray {
 enum SearchMode { ALL_ENTRIES, VALID_ENTRIES };
 
 template <SearchMode search_mode, typename T>
-inline int Search(Isolate* isolate, T* array, Name* name, int valid_entries = 0,
+inline int Search(T* array, Name* name, int valid_entries = 0,
                   int* out_insertion_index = nullptr);
 
 // ByteArray represents fixed sized byte arrays.  Used for the relocation info
diff --git a/deps/v8/src/objects/frame-array.h b/deps/v8/src/objects/frame-array.h
index 55b78384841b09..1f5b1a9d661400 100644
--- a/deps/v8/src/objects/frame-array.h
+++ b/deps/v8/src/objects/frame-array.h
@@ -41,7 +41,7 @@ class FrameArray : public FixedArray {
   inline bool IsAsmJsWasmFrame(int frame_ix) const;
   inline int FrameCount() const;
 
-  void ShrinkToFit();
+  void ShrinkToFit(Isolate* isolate);
 
   // Flags.
   enum Flag {
diff --git a/deps/v8/src/objects/hash-table-inl.h b/deps/v8/src/objects/hash-table-inl.h
index 1995806913c63e..7ebaa5cc1c33eb 100644
--- a/deps/v8/src/objects/hash-table-inl.h
+++ b/deps/v8/src/objects/hash-table-inl.h
@@ -69,18 +69,17 @@ int HashTable<Derived, Shape>::FindEntry(Key key) {
 
 template <typename Derived, typename Shape>
 int HashTable<Derived, Shape>::FindEntry(Isolate* isolate, Key key) {
-  return FindEntry(isolate, key, Shape::Hash(isolate, key));
+  return FindEntry(ReadOnlyRoots(isolate), key, Shape::Hash(isolate, key));
 }
 
 // Find entry for key otherwise return kNotFound.
 template <typename Derived, typename Shape>
-int HashTable<Derived, Shape>::FindEntry(Isolate* isolate, Key key,
+int HashTable<Derived, Shape>::FindEntry(ReadOnlyRoots roots, Key key,
                                          int32_t hash) {
   uint32_t capacity = Capacity();
   uint32_t entry = FirstProbe(hash, capacity);
   uint32_t count = 1;
   // EnsureCapacity will guarantee the hash table is never full.
-  ReadOnlyRoots roots(isolate);
   Object* undefined = roots.undefined_value();
   Object* the_hole = roots.the_hole_value();
   USE(the_hole);
@@ -98,27 +97,26 @@ int HashTable<Derived, Shape>::FindEntry(Isolate* isolate, Key key,
 }
 
 template <typename Derived, typename Shape>
-bool HashTable<Derived, Shape>::IsKey(Isolate* isolate, Object* k) {
-  return Shape::IsKey(isolate, k);
+bool HashTable<Derived, Shape>::IsKey(ReadOnlyRoots roots, Object* k) {
+  return Shape::IsKey(roots, k);
 }
 
 template <typename Derived, typename Shape>
-bool HashTable<Derived, Shape>::ToKey(Isolate* isolate, int entry,
+bool HashTable<Derived, Shape>::ToKey(ReadOnlyRoots roots, int entry,
                                       Object** out_k) {
   Object* k = KeyAt(entry);
-  if (!IsKey(isolate, k)) return false;
+  if (!IsKey(roots, k)) return false;
   *out_k = Shape::Unwrap(k);
   return true;
 }
 
 template <typename KeyT>
-bool BaseShape<KeyT>::IsKey(Isolate* isolate, Object* key) {
-  return IsLive(isolate, key);
+bool BaseShape<KeyT>::IsKey(ReadOnlyRoots roots, Object* key) {
+  return IsLive(roots, key);
 }
 
 template <typename KeyT>
-bool BaseShape<KeyT>::IsLive(Isolate* isolate, Object* k) {
-  ReadOnlyRoots roots(isolate);
+bool BaseShape<KeyT>::IsLive(ReadOnlyRoots roots, Object* k) {
   return k != roots.the_hole_value() && k != roots.undefined_value();
 }
 
@@ -136,13 +134,13 @@ const HashTable<Derived, Shape>* HashTable<Derived, Shape>::cast(
 }
 
 bool ObjectHashSet::Has(Isolate* isolate, Handle<Object> key, int32_t hash) {
-  return FindEntry(isolate, key, hash) != kNotFound;
+  return FindEntry(ReadOnlyRoots(isolate), key, hash) != kNotFound;
 }
 
 bool ObjectHashSet::Has(Isolate* isolate, Handle<Object> key) {
   Object* hash = key->GetHash();
   if (!hash->IsSmi()) return false;
-  return FindEntry(isolate, key, Smi::ToInt(hash)) != kNotFound;
+  return FindEntry(ReadOnlyRoots(isolate), key, Smi::ToInt(hash)) != kNotFound;
 }
 
 }  // namespace internal
diff --git a/deps/v8/src/objects/hash-table.h b/deps/v8/src/objects/hash-table.h
index e0740b7380c408..4b1df4e1ab0dd9 100644
--- a/deps/v8/src/objects/hash-table.h
+++ b/deps/v8/src/objects/hash-table.h
@@ -58,8 +58,8 @@ class BaseShape {
   static inline int GetMapRootIndex();
   static const bool kNeedsHoleCheck = true;
   static Object* Unwrap(Object* key) { return key; }
-  static inline bool IsKey(Isolate* isolate, Object* key);
-  static inline bool IsLive(Isolate* isolate, Object* key);
+  static inline bool IsKey(ReadOnlyRoots roots, Object* key);
+  static inline bool IsLive(ReadOnlyRoots roots, Object* key);
 };
 
 class V8_EXPORT_PRIVATE HashTableBase : public NON_EXPORTED_BASE(FixedArray) {
@@ -145,17 +145,17 @@ class HashTable : public HashTableBase {
 
   // Find entry for key otherwise return kNotFound.
   inline int FindEntry(Key key);
-  inline int FindEntry(Isolate* isolate, Key key, int32_t hash);
+  inline int FindEntry(ReadOnlyRoots roots, Key key, int32_t hash);
   int FindEntry(Isolate* isolate, Key key);
 
   // Rehashes the table in-place.
-  void Rehash();
+  void Rehash(Isolate* isolate);
 
   // Tells whether k is a real key.  The hole and undefined are not allowed
   // as keys and can be used to indicate missing or deleted elements.
-  static bool IsKey(Isolate* isolate, Object* k);
+  static bool IsKey(ReadOnlyRoots roots, Object* k);
 
-  inline bool ToKey(Isolate* isolate, int entry, Object** out_k);
+  inline bool ToKey(ReadOnlyRoots roots, int entry, Object** out_k);
 
   // Returns the key at entry.
   Object* KeyAt(int entry) { return get(EntryToIndex(entry) + kEntryKeyIndex); }
@@ -185,7 +185,8 @@ class HashTable : public HashTableBase {
 
   // Ensure enough space for n additional elements.
   V8_WARN_UNUSED_RESULT static Handle<Derived> EnsureCapacity(
-      Handle<Derived> table, int n, PretenureFlag pretenure = NOT_TENURED);
+      Isolate* isolate, Handle<Derived> table, int n,
+      PretenureFlag pretenure = NOT_TENURED);
 
   // Returns true if this table has sufficient capacity for adding n elements.
   bool HasSufficientCapacityToAdd(int number_of_additional_elements);
@@ -202,7 +203,7 @@ class HashTable : public HashTableBase {
 
   // Attempt to shrink hash table after removal of key.
   V8_WARN_UNUSED_RESULT static Handle<Derived> Shrink(
-      Handle<Derived> table, int additionalCapacity = 0);
+      Isolate* isolate, Handle<Derived> table, int additionalCapacity = 0);
 
  private:
   // Ensure that kMaxRegularCapacity yields a non-large object dictionary.
@@ -226,12 +227,13 @@ class HashTable : public HashTableBase {
   // Returns _expected_ if one of entries given by the first _probe_ probes is
   // equal to  _expected_. Otherwise, returns the entry given by the probe
   // number _probe_.
-  uint32_t EntryForProbe(Object* k, int probe, uint32_t expected);
+  uint32_t EntryForProbe(Isolate* isolate, Object* k, int probe,
+                         uint32_t expected);
 
   void Swap(uint32_t entry1, uint32_t entry2, WriteBarrierMode mode);
 
   // Rehashes this hash-table into the new table.
-  void Rehash(Derived* new_table);
+  void Rehash(Isolate* isolate, Derived* new_table);
 };
 
 // HashTableKey is an abstract superclass for virtual key behavior.
@@ -276,7 +278,7 @@ class ObjectHashTableBase : public HashTable<Derived, Shape> {
   // returned in case the key is not present.
   Object* Lookup(Handle<Object> key);
   Object* Lookup(Handle<Object> key, int32_t hash);
-  Object* Lookup(Isolate* isolate, Handle<Object> key, int32_t hash);
+  Object* Lookup(ReadOnlyRoots roots, Handle<Object> key, int32_t hash);
 
   // Returns the value at entry.
   Object* ValueAt(int entry);
@@ -287,14 +289,16 @@ class ObjectHashTableBase : public HashTable<Derived, Shape> {
   // Adds (or overwrites) the value associated with the given key.
   static Handle<Derived> Put(Handle<Derived> table, Handle<Object> key,
                              Handle<Object> value);
-  static Handle<Derived> Put(Handle<Derived> table, Handle<Object> key,
-                             Handle<Object> value, int32_t hash);
+  static Handle<Derived> Put(Isolate* isolate, Handle<Derived> table,
+                             Handle<Object> key, Handle<Object> value,
+                             int32_t hash);
 
   // Returns an ObjectHashTable (possibly |table|) where |key| has been removed.
-  static Handle<Derived> Remove(Handle<Derived> table, Handle<Object> key,
-                                bool* was_present);
-  static Handle<Derived> Remove(Handle<Derived> table, Handle<Object> key,
-                                bool* was_present, int32_t hash);
+  static Handle<Derived> Remove(Isolate* isolate, Handle<Derived> table,
+                                Handle<Object> key, bool* was_present);
+  static Handle<Derived> Remove(Isolate* isolate, Handle<Derived> table,
+                                Handle<Object> key, bool* was_present,
+                                int32_t hash);
 
   // Returns the index to the value of an entry.
   static inline int EntryToValueIndex(int entry) {
@@ -343,7 +347,7 @@ class ObjectHashSetShape : public ObjectHashTableShape {
 
 class ObjectHashSet : public HashTable<ObjectHashSet, ObjectHashSetShape> {
  public:
-  static Handle<ObjectHashSet> Add(Handle<ObjectHashSet> set,
+  static Handle<ObjectHashSet> Add(Isolate* isolate, Handle<ObjectHashSet> set,
                                    Handle<Object> key);
 
   inline bool Has(Isolate* isolate, Handle<Object> key, int32_t hash);
diff --git a/deps/v8/src/objects/intl-objects.cc b/deps/v8/src/objects/intl-objects.cc
index 57187d0f45a501..7fb1e27a6896b6 100644
--- a/deps/v8/src/objects/intl-objects.cc
+++ b/deps/v8/src/objects/intl-objects.cc
@@ -42,6 +42,7 @@
 #include "unicode/ucurr.h"
 #include "unicode/unum.h"
 #include "unicode/upluralrules.h"
+#include "unicode/ures.h"
 #include "unicode/uvernum.h"
 #include "unicode/uversion.h"
 
@@ -1103,6 +1104,7 @@ bool Intl::RemoveLocaleScriptTag(const std::string& icu_locale,
 std::set<std::string> Intl::GetAvailableLocales(const IcuService& service) {
   const icu::Locale* icu_available_locales = nullptr;
   int32_t count = 0;
+  std::set<std::string> locales;
 
   switch (service) {
     case IcuService::kBreakIterator:
@@ -1125,12 +1127,48 @@ std::set<std::string> Intl::GetAvailableLocales(const IcuService& service) {
       // https://ssl.icu-project.org/trac/ticket/12756
       icu_available_locales = icu::Locale::getAvailableLocales(count);
       break;
+    case IcuService::kResourceBundle: {
+      UErrorCode status = U_ZERO_ERROR;
+      UEnumeration* en = ures_openAvailableLocales(nullptr, &status);
+      int32_t length = 0;
+      const char* locale_str = uenum_next(en, &length, &status);
+      while (U_SUCCESS(status) && (locale_str != nullptr)) {
+        std::string locale(locale_str, length);
+        std::replace(locale.begin(), locale.end(), '_', '-');
+        locales.insert(locale);
+        std::string shortened_locale;
+        if (Intl::RemoveLocaleScriptTag(locale_str, &shortened_locale)) {
+          std::replace(shortened_locale.begin(), shortened_locale.end(), '_',
+                       '-');
+          locales.insert(shortened_locale);
+        }
+        locale_str = uenum_next(en, &length, &status);
+      }
+      uenum_close(en);
+      return locales;
+    }
+    case IcuService::kRelativeDateTimeFormatter: {
+      // ICU RelativeDateTimeFormatter does not provide a getAvailableLocales()
+      // interface, because RelativeDateTimeFormatter depends on
+      // 1. NumberFormat and 2. ResourceBundle, return the
+      // intersection of these two set.
+      // ICU FR at https://unicode-org.atlassian.net/browse/ICU-20009
+      // TODO(ftang): change to call ICU's getAvailableLocales() after it is
+      // added.
+      std::set<std::string> number_format_set(
+          Intl::GetAvailableLocales(IcuService::kNumberFormat));
+      std::set<std::string> resource_bundle_set(
+          Intl::GetAvailableLocales(IcuService::kResourceBundle));
+      set_intersection(resource_bundle_set.begin(), resource_bundle_set.end(),
+                       number_format_set.begin(), number_format_set.end(),
+                       std::inserter(locales, locales.begin()));
+      return locales;
+    }
   }
 
   UErrorCode error = U_ZERO_ERROR;
   char result[ULOC_FULLNAME_CAPACITY];
 
-  std::set<std::string> locales;
   for (int32_t i = 0; i < count; ++i) {
     const char* icu_name = icu_available_locales[i].getName();
 
@@ -1272,7 +1310,7 @@ MaybeHandle<Object> NumberFormat::FormatNumber(
 // namespace {
 
 // TODO(bstell): Make all these a constexpr on the Intl class.
-void BuildLanguageTagRegexes(Isolate* isolate) {
+void BuildLanguageTagRegexps(Isolate* isolate) {
   std::string alpha = "[a-zA-Z]";
   std::string digit = "[0-9]";
   std::string alphanum = "(" + alpha + "|" + digit + ")";
@@ -1327,7 +1365,7 @@ icu::RegexMatcher* GetLanguageSingletonRegexMatcher(Isolate* isolate) {
   icu::RegexMatcher* language_singleton_regexp_matcher =
       isolate->language_singleton_regexp_matcher();
   if (language_singleton_regexp_matcher == nullptr) {
-    BuildLanguageTagRegexes(isolate);
+    BuildLanguageTagRegexps(isolate);
     language_singleton_regexp_matcher =
         isolate->language_singleton_regexp_matcher();
   }
@@ -1338,7 +1376,7 @@ icu::RegexMatcher* GetLanguageTagRegexMatcher(Isolate* isolate) {
   icu::RegexMatcher* language_tag_regexp_matcher =
       isolate->language_tag_regexp_matcher();
   if (language_tag_regexp_matcher == nullptr) {
-    BuildLanguageTagRegexes(isolate);
+    BuildLanguageTagRegexps(isolate);
     language_tag_regexp_matcher = isolate->language_tag_regexp_matcher();
   }
   return language_tag_regexp_matcher;
@@ -1348,7 +1386,7 @@ icu::RegexMatcher* GetLanguageVariantRegexMatcher(Isolate* isolate) {
   icu::RegexMatcher* language_variant_regexp_matcher =
       isolate->language_variant_regexp_matcher();
   if (language_variant_regexp_matcher == nullptr) {
-    BuildLanguageTagRegexes(isolate);
+    BuildLanguageTagRegexps(isolate);
     language_variant_regexp_matcher =
         isolate->language_variant_regexp_matcher();
   }
diff --git a/deps/v8/src/objects/js-array.h b/deps/v8/src/objects/js-array.h
index 652d4df108cc7c..34b4f1f523d232 100644
--- a/deps/v8/src/objects/js-array.h
+++ b/deps/v8/src/objects/js-array.h
@@ -71,7 +71,7 @@ class JSArray : public JSObject {
   DECL_CAST(JSArray)
 
   // Dispatched behavior.
-  DECL_PRINTER_WITH_ISOLATE(JSArray)
+  DECL_PRINTER(JSArray)
   DECL_VERIFIER(JSArray)
 
   // Number of element slots to pre-allocate for an empty array.
@@ -108,7 +108,7 @@ Handle<Object> CacheInitialJSArrayMaps(Handle<Context> native_context,
 // defined in ES section #sec-array-iterator-objects.
 class JSArrayIterator : public JSObject {
  public:
-  DECL_PRINTER_WITH_ISOLATE(JSArrayIterator)
+  DECL_PRINTER(JSArrayIterator)
   DECL_VERIFIER(JSArrayIterator)
 
   DECL_CAST(JSArrayIterator)
@@ -215,7 +215,7 @@ class JSArrayBuffer : public JSObject {
       SharedFlag shared = SharedFlag::kNotShared) V8_WARN_UNUSED_RESULT;
 
   // Dispatched behavior.
-  DECL_PRINTER_WITH_ISOLATE(JSArrayBuffer)
+  DECL_PRINTER(JSArrayBuffer)
   DECL_VERIFIER(JSArrayBuffer)
 
   static const int kByteLengthOffset = JSObject::kHeaderSize;
@@ -307,7 +307,7 @@ class JSTypedArray : public JSArrayBufferView {
                                                    const char* method_name);
 
   // Dispatched behavior.
-  DECL_PRINTER_WITH_ISOLATE(JSTypedArray)
+  DECL_PRINTER(JSTypedArray)
   DECL_VERIFIER(JSTypedArray)
 
   static const int kLengthOffset = kViewSize;
@@ -331,7 +331,7 @@ class JSDataView : public JSArrayBufferView {
   DECL_CAST(JSDataView)
 
   // Dispatched behavior.
-  DECL_PRINTER_WITH_ISOLATE(JSDataView)
+  DECL_PRINTER(JSDataView)
   DECL_VERIFIER(JSDataView)
 
   static const int kSize = kViewSize;
diff --git a/deps/v8/src/objects/js-collection.h b/deps/v8/src/objects/js-collection.h
index af54ea8731373b..5b9fcf1c298e53 100644
--- a/deps/v8/src/objects/js-collection.h
+++ b/deps/v8/src/objects/js-collection.h
@@ -34,7 +34,7 @@ class JSSet : public JSCollection {
   static void Clear(Isolate* isolate, Handle<JSSet> set);
 
   // Dispatched behavior.
-  DECL_PRINTER_WITH_ISOLATE(JSSet)
+  DECL_PRINTER(JSSet)
   DECL_VERIFIER(JSSet)
 
  private:
@@ -45,7 +45,7 @@ class JSSetIterator
     : public OrderedHashTableIterator<JSSetIterator, OrderedHashSet> {
  public:
   // Dispatched behavior.
-  DECL_PRINTER_WITH_ISOLATE(JSSetIterator)
+  DECL_PRINTER(JSSetIterator)
   DECL_VERIFIER(JSSetIterator)
 
   DECL_CAST(JSSetIterator)
@@ -63,7 +63,7 @@ class JSMap : public JSCollection {
   static void Clear(Isolate* isolate, Handle<JSMap> map);
 
   // Dispatched behavior.
-  DECL_PRINTER_WITH_ISOLATE(JSMap)
+  DECL_PRINTER(JSMap)
   DECL_VERIFIER(JSMap)
 
  private:
@@ -74,7 +74,7 @@ class JSMapIterator
     : public OrderedHashTableIterator<JSMapIterator, OrderedHashMap> {
  public:
   // Dispatched behavior.
-  DECL_PRINTER_WITH_ISOLATE(JSMapIterator)
+  DECL_PRINTER(JSMapIterator)
   DECL_VERIFIER(JSMapIterator)
 
   DECL_CAST(JSMapIterator)
@@ -125,7 +125,7 @@ class JSWeakMap : public JSWeakCollection {
   DECL_CAST(JSWeakMap)
 
   // Dispatched behavior.
-  DECL_PRINTER_WITH_ISOLATE(JSWeakMap)
+  DECL_PRINTER(JSWeakMap)
   DECL_VERIFIER(JSWeakMap)
 
  private:
@@ -138,7 +138,7 @@ class JSWeakSet : public JSWeakCollection {
   DECL_CAST(JSWeakSet)
 
   // Dispatched behavior.
-  DECL_PRINTER_WITH_ISOLATE(JSWeakSet)
+  DECL_PRINTER(JSWeakSet)
   DECL_VERIFIER(JSWeakSet)
 
  private:
diff --git a/deps/v8/src/objects/js-promise.h b/deps/v8/src/objects/js-promise.h
index ffad6e60dced90..c52e19ce49d820 100644
--- a/deps/v8/src/objects/js-promise.h
+++ b/deps/v8/src/objects/js-promise.h
@@ -65,7 +65,7 @@ class JSPromise : public JSObject {
   DECL_CAST(JSPromise)
 
   // Dispatched behavior.
-  DECL_PRINTER_WITH_ISOLATE(JSPromise)
+  DECL_PRINTER(JSPromise)
   DECL_VERIFIER(JSPromise)
 
   // Layout description.
diff --git a/deps/v8/src/objects/js-regexp-string-iterator.h b/deps/v8/src/objects/js-regexp-string-iterator.h
index 2a5b0ff9ecb90f..9821e33efbcff8 100644
--- a/deps/v8/src/objects/js-regexp-string-iterator.h
+++ b/deps/v8/src/objects/js-regexp-string-iterator.h
@@ -33,7 +33,7 @@ class JSRegExpStringIterator : public JSObject {
   DECL_BOOLEAN_ACCESSORS(unicode)
 
   DECL_CAST(JSRegExpStringIterator)
-  DECL_PRINTER_WITH_ISOLATE(JSRegExpStringIterator)
+  DECL_PRINTER(JSRegExpStringIterator)
   DECL_VERIFIER(JSRegExpStringIterator)
 
   static const int kIteratingRegExpOffset = JSObject::kHeaderSize;
diff --git a/deps/v8/src/objects/js-regexp.h b/deps/v8/src/objects/js-regexp.h
index d0904193e767bc..6a0c4e3391b7e3 100644
--- a/deps/v8/src/objects/js-regexp.h
+++ b/deps/v8/src/objects/js-regexp.h
@@ -86,7 +86,7 @@ class JSRegExp : public JSObject {
   DECL_CAST(JSRegExp)
 
   // Dispatched behavior.
-  DECL_PRINTER_WITH_ISOLATE(JSRegExp)
+  DECL_PRINTER(JSRegExp)
   DECL_VERIFIER(JSRegExp)
 
   static const int kDataOffset = JSObject::kHeaderSize;
diff --git a/deps/v8/src/objects/js-relative-time-format.cc b/deps/v8/src/objects/js-relative-time-format.cc
index 4ab12ddacaa16e..c70db1b3392d12 100644
--- a/deps/v8/src/objects/js-relative-time-format.cc
+++ b/deps/v8/src/objects/js-relative-time-format.cc
@@ -183,9 +183,9 @@ Handle<JSObject> JSRelativeTimeFormat::ResolvedOptions(
   JSObject::AddProperty(isolate, result, factory->locale_string(), locale,
                         NONE);
   JSObject::AddProperty(isolate, result, factory->style_string(),
-                        format_holder->StyleAsString(isolate), NONE);
+                        format_holder->StyleAsString(), NONE);
   JSObject::AddProperty(isolate, result, factory->numeric_string(),
-                        format_holder->NumericAsString(isolate), NONE);
+                        format_holder->NumericAsString(), NONE);
   return result;
 }
 
@@ -195,27 +195,25 @@ icu::RelativeDateTimeFormatter* JSRelativeTimeFormat::UnpackFormatter(
       ->raw();
 }
 
-Handle<String> JSRelativeTimeFormat::StyleAsString(Isolate* isolate) const {
-  Factory* factory = isolate->factory();
+Handle<String> JSRelativeTimeFormat::StyleAsString() const {
   switch (style()) {
     case Style::LONG:
-      return factory->long_string();
+      return GetReadOnlyRoots().long_string_handle();
     case Style::SHORT:
-      return factory->short_string();
+      return GetReadOnlyRoots().short_string_handle();
     case Style::NARROW:
-      return factory->narrow_string();
+      return GetReadOnlyRoots().narrow_string_handle();
     case Style::COUNT:
       UNREACHABLE();
   }
 }
 
-Handle<String> JSRelativeTimeFormat::NumericAsString(Isolate* isolate) const {
-  Factory* factory = isolate->factory();
+Handle<String> JSRelativeTimeFormat::NumericAsString() const {
   switch (numeric()) {
     case Numeric::ALWAYS:
-      return factory->always_string();
+      return GetReadOnlyRoots().always_string_handle();
     case Numeric::AUTO:
-      return factory->auto_string();
+      return GetReadOnlyRoots().auto_string_handle();
     case Numeric::COUNT:
       UNREACHABLE();
   }
diff --git a/deps/v8/src/objects/js-relative-time-format.h b/deps/v8/src/objects/js-relative-time-format.h
index 997fae7e4c7ef0..70d1cdacf43148 100644
--- a/deps/v8/src/objects/js-relative-time-format.h
+++ b/deps/v8/src/objects/js-relative-time-format.h
@@ -40,8 +40,8 @@ class JSRelativeTimeFormat : public JSObject {
   static icu::RelativeDateTimeFormatter* UnpackFormatter(
       Isolate* isolate,
       Handle<JSRelativeTimeFormat> relative_time_format_holder);
-  Handle<String> StyleAsString(Isolate* isolate) const;
-  Handle<String> NumericAsString(Isolate* isolate) const;
+  Handle<String> StyleAsString() const;
+  Handle<String> NumericAsString() const;
 
   DECL_CAST(JSRelativeTimeFormat)
 
@@ -79,7 +79,7 @@ class JSRelativeTimeFormat : public JSObject {
   inline Numeric numeric() const;
 
   DECL_ACCESSORS(formatter, Foreign)
-  DECL_PRINTER_WITH_ISOLATE(JSRelativeTimeFormat)
+  DECL_PRINTER(JSRelativeTimeFormat)
   DECL_VERIFIER(JSRelativeTimeFormat)
 
   // Layout description.
diff --git a/deps/v8/src/objects/literal-objects.cc b/deps/v8/src/objects/literal-objects.cc
index f75338c47b2d09..69f4e2c3f935c7 100644
--- a/deps/v8/src/objects/literal-objects.cc
+++ b/deps/v8/src/objects/literal-objects.cc
@@ -394,10 +394,10 @@ class ObjectDescriptor {
     if (HasDictionaryProperties()) {
       properties_dictionary_template_->SetNextEnumerationIndex(
           next_enumeration_index_);
-      computed_properties_ = FixedArray::ShrinkOrEmpty(computed_properties_,
-                                                       current_computed_index_);
+      computed_properties_ = FixedArray::ShrinkOrEmpty(
+          isolate, computed_properties_, current_computed_index_);
     } else {
-      DCHECK(descriptor_array_template_->IsSortedNoDuplicates(isolate));
+      DCHECK(descriptor_array_template_->IsSortedNoDuplicates());
     }
   }
 
diff --git a/deps/v8/src/objects/map-inl.h b/deps/v8/src/objects/map-inl.h
index 57183a896eeff5..0d6ca925560fcc 100644
--- a/deps/v8/src/objects/map-inl.h
+++ b/deps/v8/src/objects/map-inl.h
@@ -11,6 +11,7 @@
 #include "src/objects-inl.h"
 #include "src/objects/api-callbacks-inl.h"
 #include "src/objects/descriptor-array.h"
+#include "src/objects/prototype-info-inl.h"
 #include "src/objects/shared-function-info.h"
 #include "src/objects/templates-inl.h"
 #include "src/property.h"
diff --git a/deps/v8/src/objects/map.h b/deps/v8/src/objects/map.h
index c3f8a33d859c1f..da3dcfb278ebec 100644
--- a/deps/v8/src/objects/map.h
+++ b/deps/v8/src/objects/map.h
@@ -44,6 +44,7 @@ namespace internal {
   V(Map)                              \
   V(NativeContext)                    \
   V(Oddball)                          \
+  V(PreParsedScopeData)               \
   V(PropertyArray)                    \
   V(PropertyCell)                     \
   V(PrototypeInfo)                    \
@@ -782,7 +783,7 @@ class Map : public HeapObject {
   static Handle<WeakCell> WeakCellForMap(Isolate* isolate, Handle<Map> map);
 
   // Dispatched behavior.
-  DECL_PRINTER_WITH_ISOLATE(Map)
+  DECL_PRINTER(Map)
   DECL_VERIFIER(Map)
 
 #ifdef VERIFY_HEAP
@@ -842,7 +843,7 @@ class Map : public HeapObject {
   // Returns true if given field is unboxed double.
   inline bool IsUnboxedDoubleField(FieldIndex index) const;
 
-  void PrintMapDetails(Isolate* isolate, std::ostream& os);
+  void PrintMapDetails(std::ostream& os);
 
   static inline Handle<Map> AddMissingTransitionsForTesting(
       Isolate* isolate, Handle<Map> split_map,
diff --git a/deps/v8/src/objects/maybe-object.h b/deps/v8/src/objects/maybe-object.h
index c242cd55d73c11..df62050b8ad30c 100644
--- a/deps/v8/src/objects/maybe-object.h
+++ b/deps/v8/src/objects/maybe-object.h
@@ -71,11 +71,11 @@ class MaybeObject {
   void ShortPrint(std::ostream& os);
 
 #ifdef OBJECT_PRINT
-  void Print(Isolate* isolate);
-  void Print(Isolate* isolate, std::ostream& os);
+  void Print();
+  void Print(std::ostream& os);
 #else
-  void Print(Isolate* isolate) { ShortPrint(); }
-  void Print(Isolate* isolate, std::ostream& os) { ShortPrint(os); }
+  void Print() { ShortPrint(); }
+  void Print(std::ostream& os) { ShortPrint(os); }
 #endif
 
  private:
diff --git a/deps/v8/src/objects/module-inl.h b/deps/v8/src/objects/module-inl.h
index 201804b5954c66..1fffd01005a75d 100644
--- a/deps/v8/src/objects/module-inl.h
+++ b/deps/v8/src/objects/module-inl.h
@@ -49,6 +49,41 @@ SMI_ACCESSORS(ModuleInfoEntry, end_pos, kEndPosOffset)
 
 CAST_ACCESSOR(ModuleInfo)
 
+FixedArray* ModuleInfo::module_requests() const {
+  return FixedArray::cast(get(kModuleRequestsIndex));
+}
+
+FixedArray* ModuleInfo::special_exports() const {
+  return FixedArray::cast(get(kSpecialExportsIndex));
+}
+
+FixedArray* ModuleInfo::regular_exports() const {
+  return FixedArray::cast(get(kRegularExportsIndex));
+}
+
+FixedArray* ModuleInfo::regular_imports() const {
+  return FixedArray::cast(get(kRegularImportsIndex));
+}
+
+FixedArray* ModuleInfo::namespace_imports() const {
+  return FixedArray::cast(get(kNamespaceImportsIndex));
+}
+
+FixedArray* ModuleInfo::module_request_positions() const {
+  return FixedArray::cast(get(kModuleRequestPositionsIndex));
+}
+
+#ifdef DEBUG
+bool ModuleInfo::Equals(ModuleInfo* other) const {
+  return regular_exports() == other->regular_exports() &&
+         regular_imports() == other->regular_imports() &&
+         special_exports() == other->special_exports() &&
+         namespace_imports() == other->namespace_imports() &&
+         module_requests() == other->module_requests() &&
+         module_request_positions() == other->module_request_positions();
+}
+#endif
+
 }  // namespace internal
 }  // namespace v8
 
diff --git a/deps/v8/src/objects/module.cc b/deps/v8/src/objects/module.cc
index bca6abba0eff1e..8672d432640f23 100644
--- a/deps/v8/src/objects/module.cc
+++ b/deps/v8/src/objects/module.cc
@@ -181,7 +181,7 @@ void Module::PrintStatusTransition(Isolate* isolate, Status new_status) {
     StdoutStream os;
     os << "Changing module status from " << status() << " to " << new_status
        << " for ";
-    script()->GetNameOrSourceURL()->Print(isolate, os);
+    script()->GetNameOrSourceURL()->Print(os);
 #ifndef OBJECT_PRINT
     os << "\n";
 #endif  // OBJECT_PRINT
@@ -443,7 +443,7 @@ bool Module::Instantiate(Isolate* isolate, Handle<Module> module,
   if (FLAG_trace_module_status) {
     StdoutStream os;
     os << "Instantiating module ";
-    module->script()->GetNameOrSourceURL()->Print(isolate, os);
+    module->script()->GetNameOrSourceURL()->Print(os);
 #ifndef OBJECT_PRINT
     os << "\n";
 #endif  // OBJECT_PRINT
@@ -668,7 +668,7 @@ MaybeHandle<Object> Module::Evaluate(Isolate* isolate, Handle<Module> module) {
   if (FLAG_trace_module_status) {
     StdoutStream os;
     os << "Evaluating module ";
-    module->script()->GetNameOrSourceURL()->Print(isolate, os);
+    module->script()->GetNameOrSourceURL()->Print(os);
 #ifndef OBJECT_PRINT
     os << "\n";
 #endif  // OBJECT_PRINT
@@ -778,12 +778,13 @@ void FetchStarExports(Isolate* isolate, Handle<Module> module, Zone* zone,
   // TODO(neis): Only allocate more_exports if there are star exports.
   // Maybe split special_exports into indirect_exports and star_exports.
 
+  ReadOnlyRoots roots(isolate);
   Handle<FixedArray> special_exports(module->info()->special_exports(),
                                      isolate);
   for (int i = 0, n = special_exports->length(); i < n; ++i) {
     Handle<ModuleInfoEntry> entry(
         ModuleInfoEntry::cast(special_exports->get(i)), isolate);
-    if (!entry->export_name()->IsUndefined(isolate)) {
+    if (!entry->export_name()->IsUndefined(roots)) {
       continue;  // Indirect export.
     }
 
@@ -802,24 +803,24 @@ void FetchStarExports(Isolate* isolate, Handle<Module> module, Zone* zone,
                                               isolate);
     for (int i = 0, n = requested_exports->Capacity(); i < n; ++i) {
       Object* key;
-      if (!requested_exports->ToKey(isolate, i, &key)) continue;
+      if (!requested_exports->ToKey(roots, i, &key)) continue;
       Handle<String> name(String::cast(key), isolate);
 
-      if (name->Equals(ReadOnlyRoots(isolate).default_string())) continue;
-      if (!exports->Lookup(name)->IsTheHole(isolate)) continue;
+      if (name->Equals(roots.default_string())) continue;
+      if (!exports->Lookup(name)->IsTheHole(roots)) continue;
 
       Handle<Cell> cell(Cell::cast(requested_exports->ValueAt(i)), isolate);
       auto insert_result = more_exports.insert(std::make_pair(name, cell));
       if (!insert_result.second) {
         auto it = insert_result.first;
-        if (*it->second == *cell || it->second->IsUndefined(isolate)) {
+        if (*it->second == *cell || it->second->IsUndefined(roots)) {
           // We already recorded this mapping before, or the name is already
           // known to be ambiguous.  In either case, there's nothing to do.
         } else {
           DCHECK(it->second->IsCell());
           // Different star exports provide different cells for this name, hence
           // mark the name as ambiguous.
-          it->second = isolate->factory()->undefined_value();
+          it->second = roots.undefined_value_handle();
         }
       }
     }
@@ -848,7 +849,8 @@ Handle<JSModuleNamespace> Module::GetModuleNamespace(Isolate* isolate,
 Handle<JSModuleNamespace> Module::GetModuleNamespace(Isolate* isolate,
                                                      Handle<Module> module) {
   Handle<HeapObject> object(module->module_namespace(), isolate);
-  if (!object->IsUndefined(isolate)) {
+  ReadOnlyRoots roots(isolate);
+  if (!object->IsUndefined(roots)) {
     // Namespace object already exists.
     return Handle<JSModuleNamespace>::cast(object);
   }
@@ -862,7 +864,7 @@ Handle<JSModuleNamespace> Module::GetModuleNamespace(Isolate* isolate,
   names.reserve(exports->NumberOfElements());
   for (int i = 0, n = exports->Capacity(); i < n; ++i) {
     Object* key;
-    if (!exports->ToKey(isolate, i, &key)) continue;
+    if (!exports->ToKey(roots, i, &key)) continue;
     names.push_back(handle(String::cast(key), isolate));
   }
   DCHECK_EQ(static_cast<int>(names.size()), exports->NumberOfElements());
diff --git a/deps/v8/src/objects/module.h b/deps/v8/src/objects/module.h
index f45cb101ae96f2..b3035d285155b0 100644
--- a/deps/v8/src/objects/module.h
+++ b/deps/v8/src/objects/module.h
@@ -215,7 +215,7 @@ class Module : public Struct {
 class JSModuleNamespace : public JSObject {
  public:
   DECL_CAST(JSModuleNamespace)
-  DECL_PRINTER_WITH_ISOLATE(JSModuleNamespace)
+  DECL_PRINTER(JSModuleNamespace)
   DECL_VERIFIER(JSModuleNamespace)
 
   // The actual module whose namespace is being represented.
@@ -256,29 +256,12 @@ class ModuleInfo : public FixedArray {
   static Handle<ModuleInfo> New(Isolate* isolate, Zone* zone,
                                 ModuleDescriptor* descr);
 
-  inline FixedArray* module_requests() const {
-    return FixedArray::cast(get(kModuleRequestsIndex));
-  }
-
-  inline FixedArray* special_exports() const {
-    return FixedArray::cast(get(kSpecialExportsIndex));
-  }
-
-  inline FixedArray* regular_exports() const {
-    return FixedArray::cast(get(kRegularExportsIndex));
-  }
-
-  inline FixedArray* regular_imports() const {
-    return FixedArray::cast(get(kRegularImportsIndex));
-  }
-
-  inline FixedArray* namespace_imports() const {
-    return FixedArray::cast(get(kNamespaceImportsIndex));
-  }
-
-  inline FixedArray* module_request_positions() const {
-    return FixedArray::cast(get(kModuleRequestPositionsIndex));
-  }
+  inline FixedArray* module_requests() const;
+  inline FixedArray* special_exports() const;
+  inline FixedArray* regular_exports() const;
+  inline FixedArray* regular_imports() const;
+  inline FixedArray* namespace_imports() const;
+  inline FixedArray* module_request_positions() const;
 
   // Accessors for [regular_exports].
   int RegularExportCount() const;
@@ -287,14 +270,7 @@ class ModuleInfo : public FixedArray {
   FixedArray* RegularExportExportNames(int i) const;
 
 #ifdef DEBUG
-  inline bool Equals(ModuleInfo* other) const {
-    return regular_exports() == other->regular_exports() &&
-           regular_imports() == other->regular_imports() &&
-           special_exports() == other->special_exports() &&
-           namespace_imports() == other->namespace_imports() &&
-           module_requests() == other->module_requests() &&
-           module_request_positions() == other->module_request_positions();
-  }
+  inline bool Equals(ModuleInfo* other) const;
 #endif
 
  private:
diff --git a/deps/v8/src/objects/name-inl.h b/deps/v8/src/objects/name-inl.h
index 11b19adb3b6b4e..e768a40ec29b72 100644
--- a/deps/v8/src/objects/name-inl.h
+++ b/deps/v8/src/objects/name-inl.h
@@ -90,7 +90,10 @@ uint32_t Name::Hash() {
   uint32_t field = hash_field();
   if (IsHashFieldComputed(field)) return field >> kHashShift;
   // Slow case: compute hash code and set it. Has to be a string.
-  return String::cast(this)->ComputeAndSetHash();
+  // Also the string must be writable, because read-only strings will have their
+  // hash values precomputed.
+  return String::cast(this)->ComputeAndSetHash(
+      Heap::FromWritableHeapObject(this)->isolate());
 }
 
 bool Name::IsInterestingSymbol() const {
diff --git a/deps/v8/src/objects/name.h b/deps/v8/src/objects/name.h
index 779597290d2053..c4b7da0ef732b3 100644
--- a/deps/v8/src/objects/name.h
+++ b/deps/v8/src/objects/name.h
@@ -63,8 +63,8 @@ class Name : public HeapObject {
   DECL_CAST(Name)
 
   DECL_PRINTER(Name)
-  void NameShortPrint(Isolate* isolate);
-  int NameShortPrint(Isolate* isolate, Vector<char> str);
+  void NameShortPrint();
+  int NameShortPrint(Vector<char> str);
 
   // Layout description.
   static const int kHashFieldSlot = HeapObject::kHeaderSize;
@@ -177,7 +177,7 @@ class Symbol : public Name {
   DECL_CAST(Symbol)
 
   // Dispatched behavior.
-  DECL_PRINTER_WITH_ISOLATE(Symbol)
+  DECL_PRINTER(Symbol)
   DECL_VERIFIER(Symbol)
 
   // Layout description.
@@ -199,7 +199,7 @@ class Symbol : public Name {
   void SymbolShortPrint(std::ostream& os);
 
  private:
-  const char* PrivateSymbolToName(Isolate* isolate) const;
+  const char* PrivateSymbolToName() const;
 
   // TODO(cbruni): remove once the new maptracer is in place.
   friend class Name;  // For PrivateSymbolToName.
diff --git a/deps/v8/src/objects/ordered-hash-table.cc b/deps/v8/src/objects/ordered-hash-table.cc
index 17237546e9c078..ad558e731e6251 100644
--- a/deps/v8/src/objects/ordered-hash-table.cc
+++ b/deps/v8/src/objects/ordered-hash-table.cc
@@ -139,7 +139,7 @@ Handle<FixedArray> OrderedHashSet::ConvertToKeysArray(
     }
     result->set(i, key);
   }
-  return FixedArray::ShrinkOrEmpty(result, length);
+  return FixedArray::ShrinkOrEmpty(isolate, result, length);
 }
 
 HeapObject* OrderedHashSet::GetEmpty(ReadOnlyRoots ro_roots) {
diff --git a/deps/v8/src/objects/prototype-info-inl.h b/deps/v8/src/objects/prototype-info-inl.h
new file mode 100644
index 00000000000000..455673cbdd77d0
--- /dev/null
+++ b/deps/v8/src/objects/prototype-info-inl.h
@@ -0,0 +1,45 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef V8_OBJECTS_PROTOTYPE_INFO_INL_H_
+#define V8_OBJECTS_PROTOTYPE_INFO_INL_H_
+
+#include "src/objects/prototype-info.h"
+
+// Has to be the last include (doesn't have include guards):
+#include "src/objects/object-macros.h"
+
+namespace v8 {
+namespace internal {
+
+CAST_ACCESSOR(PrototypeInfo)
+
+Map* PrototypeInfo::ObjectCreateMap() {
+  return Map::cast(object_create_map()->ToWeakHeapObject());
+}
+
+// static
+void PrototypeInfo::SetObjectCreateMap(Handle<PrototypeInfo> info,
+                                       Handle<Map> map) {
+  info->set_object_create_map(HeapObjectReference::Weak(*map));
+}
+
+bool PrototypeInfo::HasObjectCreateMap() {
+  MaybeObject* cache = object_create_map();
+  return cache->IsWeakHeapObject();
+}
+
+ACCESSORS(PrototypeInfo, weak_cell, Object, kWeakCellOffset)
+ACCESSORS(PrototypeInfo, prototype_users, Object, kPrototypeUsersOffset)
+WEAK_ACCESSORS(PrototypeInfo, object_create_map, kObjectCreateMapOffset)
+SMI_ACCESSORS(PrototypeInfo, registry_slot, kRegistrySlotOffset)
+SMI_ACCESSORS(PrototypeInfo, bit_field, kBitFieldOffset)
+BOOL_ACCESSORS(PrototypeInfo, bit_field, should_be_fast_map, kShouldBeFastBit)
+
+}  // namespace internal
+}  // namespace v8
+
+#include "src/objects/object-macros-undef.h"
+
+#endif  // V8_OBJECTS_PROTOTYPE_INFO_INL_H_
diff --git a/deps/v8/src/objects/prototype-info.h b/deps/v8/src/objects/prototype-info.h
new file mode 100644
index 00000000000000..5c474bb3b7ba24
--- /dev/null
+++ b/deps/v8/src/objects/prototype-info.h
@@ -0,0 +1,75 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef V8_OBJECTS_PROTOTYPE_INFO_H_
+#define V8_OBJECTS_PROTOTYPE_INFO_H_
+
+#include "src/objects.h"
+
+// Has to be the last include (doesn't have include guards):
+#include "src/objects/object-macros.h"
+
+namespace v8 {
+namespace internal {
+
+// Container for metadata stored on each prototype map.
+class PrototypeInfo : public Struct {
+ public:
+  static const int UNREGISTERED = -1;
+
+  // [weak_cell]: A WeakCell containing this prototype. ICs cache the cell here.
+  DECL_ACCESSORS(weak_cell, Object)
+
+  // [prototype_users]: FixedArrayOfWeakCells containing maps using this
+  // prototype, or Smi(0) if uninitialized.
+  DECL_ACCESSORS(prototype_users, Object)
+
+  // [object_create_map]: A field caching the map for Object.create(prototype).
+  static inline void SetObjectCreateMap(Handle<PrototypeInfo> info,
+                                        Handle<Map> map);
+  inline Map* ObjectCreateMap();
+  inline bool HasObjectCreateMap();
+
+  // [registry_slot]: Slot in prototype's user registry where this user
+  // is stored. Returns UNREGISTERED if this prototype has not been registered.
+  inline int registry_slot() const;
+  inline void set_registry_slot(int slot);
+
+  // [bit_field]
+  inline int bit_field() const;
+  inline void set_bit_field(int bit_field);
+
+  DECL_BOOLEAN_ACCESSORS(should_be_fast_map)
+
+  DECL_CAST(PrototypeInfo)
+
+  // Dispatched behavior.
+  DECL_PRINTER(PrototypeInfo)
+  DECL_VERIFIER(PrototypeInfo)
+
+  static const int kWeakCellOffset = HeapObject::kHeaderSize;
+  static const int kPrototypeUsersOffset = kWeakCellOffset + kPointerSize;
+  static const int kRegistrySlotOffset = kPrototypeUsersOffset + kPointerSize;
+  static const int kValidityCellOffset = kRegistrySlotOffset + kPointerSize;
+  static const int kObjectCreateMapOffset = kValidityCellOffset + kPointerSize;
+  static const int kBitFieldOffset = kObjectCreateMapOffset + kPointerSize;
+  static const int kSize = kBitFieldOffset + kPointerSize;
+
+  // Bit field usage.
+  static const int kShouldBeFastBit = 0;
+
+  class BodyDescriptor;
+
+ private:
+  DECL_ACCESSORS(object_create_map, MaybeObject)
+
+  DISALLOW_IMPLICIT_CONSTRUCTORS(PrototypeInfo);
+};
+
+}  // namespace internal
+}  // namespace v8
+
+#include "src/objects/object-macros-undef.h"
+
+#endif  // V8_OBJECTS_PROTOTYPE_INFO_H_
diff --git a/deps/v8/src/objects/shared-function-info-inl.h b/deps/v8/src/objects/shared-function-info-inl.h
index e4a4d22f83150e..415c9397be9378 100644
--- a/deps/v8/src/objects/shared-function-info-inl.h
+++ b/deps/v8/src/objects/shared-function-info-inl.h
@@ -20,7 +20,37 @@ namespace internal {
 
 CAST_ACCESSOR(PreParsedScopeData)
 ACCESSORS(PreParsedScopeData, scope_data, PodArray<uint8_t>, kScopeDataOffset)
-ACCESSORS(PreParsedScopeData, child_data, FixedArray, kChildDataOffset)
+INT_ACCESSORS(PreParsedScopeData, length, kLengthOffset)
+
+Object* PreParsedScopeData::child_data(int index) const {
+  DCHECK_GE(index, 0);
+  DCHECK_LT(index, this->length());
+  int offset = kChildDataStartOffset + index * kPointerSize;
+  return RELAXED_READ_FIELD(this, offset);
+}
+
+void PreParsedScopeData::set_child_data(int index, Object* value,
+                                        WriteBarrierMode mode) {
+  DCHECK_GE(index, 0);
+  DCHECK_LT(index, this->length());
+  int offset = kChildDataStartOffset + index * kPointerSize;
+  RELAXED_WRITE_FIELD(this, offset, value);
+  CONDITIONAL_WRITE_BARRIER(Heap::FromWritableHeapObject(this), this, offset,
+                            value, mode);
+}
+
+Object** PreParsedScopeData::child_data_start() const {
+  return HeapObject::RawField(this, kChildDataStartOffset);
+}
+
+void PreParsedScopeData::clear_padding() {
+  // For archs where kIntSize < kPointerSize, there will be padding between the
+  // length field and the start of the child data.
+  if (kUnalignedChildDataStartOffset < kChildDataStartOffset) {
+    memset(reinterpret_cast<void*>(address() + kUnalignedChildDataStartOffset),
+           0, kChildDataStartOffset - kUnalignedChildDataStartOffset);
+  }
+}
 
 CAST_ACCESSOR(UncompiledData)
 INT32_ACCESSORS(UncompiledData, start_position, kStartPositionOffset)
diff --git a/deps/v8/src/objects/shared-function-info.h b/deps/v8/src/objects/shared-function-info.h
index b6fa3ddc8cabe0..07b7cdad428c01 100644
--- a/deps/v8/src/objects/shared-function-info.h
+++ b/deps/v8/src/objects/shared-function-info.h
@@ -22,19 +22,44 @@ class WasmExportedFunctionData;
 
 // Data collected by the pre-parser storing information about scopes and inner
 // functions.
-class PreParsedScopeData : public Struct {
+class PreParsedScopeData : public HeapObject {
  public:
   DECL_ACCESSORS(scope_data, PodArray<uint8_t>)
-  DECL_ACCESSORS(child_data, FixedArray)
+  DECL_INT_ACCESSORS(length)
 
-  static const int kScopeDataOffset = Struct::kHeaderSize;
-  static const int kChildDataOffset = kScopeDataOffset + kPointerSize;
-  static const int kSize = kChildDataOffset + kPointerSize;
+  inline Object* child_data(int index) const;
+  inline void set_child_data(int index, Object* value,
+                             WriteBarrierMode mode = UPDATE_WRITE_BARRIER);
+
+  inline Object** child_data_start() const;
+
+  // Clear uninitialized padding space.
+  inline void clear_padding();
 
   DECL_CAST(PreParsedScopeData)
   DECL_PRINTER(PreParsedScopeData)
   DECL_VERIFIER(PreParsedScopeData)
 
+#define PRE_PARSED_SCOPE_DATA_FIELDS(V) \
+  V(kScopeDataOffset, kPointerSize)     \
+  V(kLengthOffset, kIntSize)            \
+  V(kUnalignedChildDataStartOffset, 0)
+
+  DEFINE_FIELD_OFFSET_CONSTANTS(HeapObject::kHeaderSize,
+                                PRE_PARSED_SCOPE_DATA_FIELDS)
+#undef PRE_PARSED_SCOPE_DATA_FIELDS
+
+  static const int kChildDataStartOffset =
+      POINTER_SIZE_ALIGN(kUnalignedChildDataStartOffset);
+
+  class BodyDescriptor;
+  // No weak fields.
+  typedef BodyDescriptor BodyDescriptorWeak;
+
+  static constexpr int SizeFor(int length) {
+    return kChildDataStartOffset + length * kPointerSize;
+  }
+
  private:
   DISALLOW_IMPLICIT_CONSTRUCTORS(PreParsedScopeData);
 };
diff --git a/deps/v8/src/objects/string-inl.h b/deps/v8/src/objects/string-inl.h
index 6c79e10fe0edac..780b29de116c48 100644
--- a/deps/v8/src/objects/string-inl.h
+++ b/deps/v8/src/objects/string-inl.h
@@ -225,9 +225,10 @@ class SeqOneByteSubStringKey : public StringTableKey {
 #pragma warning(push)
 #pragma warning(disable : 4789)
 #endif
-  SeqOneByteSubStringKey(Handle<SeqOneByteString> string, int from, int length)
+  SeqOneByteSubStringKey(Isolate* isolate, Handle<SeqOneByteString> string,
+                         int from, int length)
       : StringTableKey(StringHasher::HashSequentialString(
-            string->GetChars() + from, length, string->GetHeap()->HashSeed())),
+            string->GetChars() + from, length, isolate->heap()->HashSeed())),
         string_(string),
         from_(from),
         length_(length) {
@@ -492,10 +493,11 @@ String* SlicedString::parent() {
   return String::cast(READ_FIELD(this, kParentOffset));
 }
 
-void SlicedString::set_parent(String* parent, WriteBarrierMode mode) {
+void SlicedString::set_parent(Isolate* isolate, String* parent,
+                              WriteBarrierMode mode) {
   DCHECK(parent->IsSeqString() || parent->IsExternalString());
   WRITE_FIELD(this, kParentOffset, parent);
-  CONDITIONAL_WRITE_BARRIER(GetHeap(), this, kParentOffset, parent, mode);
+  CONDITIONAL_WRITE_BARRIER(isolate->heap(), this, kParentOffset, parent, mode);
 }
 
 SMI_ACCESSORS(SlicedString, offset, kOffsetOffset)
@@ -506,9 +508,10 @@ String* ConsString::first() {
 
 Object* ConsString::unchecked_first() { return READ_FIELD(this, kFirstOffset); }
 
-void ConsString::set_first(String* value, WriteBarrierMode mode) {
+void ConsString::set_first(Isolate* isolate, String* value,
+                           WriteBarrierMode mode) {
   WRITE_FIELD(this, kFirstOffset, value);
-  CONDITIONAL_WRITE_BARRIER(GetHeap(), this, kFirstOffset, value, mode);
+  CONDITIONAL_WRITE_BARRIER(isolate->heap(), this, kFirstOffset, value, mode);
 }
 
 String* ConsString::second() {
@@ -519,9 +522,10 @@ Object* ConsString::unchecked_second() {
   return RELAXED_READ_FIELD(this, kSecondOffset);
 }
 
-void ConsString::set_second(String* value, WriteBarrierMode mode) {
+void ConsString::set_second(Isolate* isolate, String* value,
+                            WriteBarrierMode mode) {
   WRITE_FIELD(this, kSecondOffset, value);
-  CONDITIONAL_WRITE_BARRIER(GetHeap(), this, kSecondOffset, value, mode);
+  CONDITIONAL_WRITE_BARRIER(isolate->heap(), this, kSecondOffset, value, mode);
 }
 
 ACCESSORS(ThinString, actual, String, kActualOffset);
@@ -573,6 +577,13 @@ void ExternalOneByteString::update_data_cache() {
   *data_field = resource()->data();
 }
 
+void ExternalOneByteString::SetResource(
+    const ExternalOneByteString::Resource* resource) {
+  set_resource(resource);
+  size_t new_payload = resource == nullptr ? 0 : resource->length();
+  if (new_payload > 0) GetHeap()->UpdateExternalString(this, 0, new_payload);
+}
+
 void ExternalOneByteString::set_resource(
     const ExternalOneByteString::Resource* resource) {
   DCHECK(IsAligned(reinterpret_cast<intptr_t>(resource), kPointerSize));
@@ -601,6 +612,13 @@ void ExternalTwoByteString::update_data_cache() {
   *data_field = resource()->data();
 }
 
+void ExternalTwoByteString::SetResource(
+    const ExternalTwoByteString::Resource* resource) {
+  set_resource(resource);
+  size_t new_payload = resource == nullptr ? 0 : resource->length() * 2;
+  if (new_payload > 0) GetHeap()->UpdateExternalString(this, 0, new_payload);
+}
+
 void ExternalTwoByteString::set_resource(
     const ExternalTwoByteString::Resource* resource) {
   *reinterpret_cast<const Resource**>(FIELD_ADDR(this, kResourceOffset)) =
diff --git a/deps/v8/src/objects/string-table.h b/deps/v8/src/objects/string-table.h
index 736e87afb6940b..dd68700ce0dc19 100644
--- a/deps/v8/src/objects/string-table.h
+++ b/deps/v8/src/objects/string-table.h
@@ -67,13 +67,15 @@ class StringTable : public HashTable<StringTable, StringTableShape> {
 
   // Shink the StringTable if it's very empty (kMaxEmptyFactor) to avoid the
   // performance overhead of re-allocating the StringTable over and over again.
-  static Handle<StringTable> CautiousShrink(Handle<StringTable> table);
+  static Handle<StringTable> CautiousShrink(Isolate* isolate,
+                                            Handle<StringTable> table);
 
   // Looks up a string that is equal to the given string and returns
   // string handle if it is found, or an empty handle otherwise.
   V8_WARN_UNUSED_RESULT static MaybeHandle<String> LookupTwoCharsStringIfExists(
       Isolate* isolate, uint16_t c1, uint16_t c2);
-  static Object* LookupStringIfExists_NoAllocate(String* string);
+  static Object* LookupStringIfExists_NoAllocate(Isolate* isolate,
+                                                 String* string);
 
   static void EnsureCapacityForDeserialization(Isolate* isolate, int expected);
 
diff --git a/deps/v8/src/objects/string.h b/deps/v8/src/objects/string.h
index f9b8957a314c8c..279650e5da1efb 100644
--- a/deps/v8/src/objects/string.h
+++ b/deps/v8/src/objects/string.h
@@ -463,7 +463,7 @@ class String : public Name {
   V8_EXPORT_PRIVATE bool SlowAsArrayIndex(uint32_t* index);
 
   // Compute and set the hash code.
-  uint32_t ComputeAndSetHash();
+  uint32_t ComputeAndSetHash(Isolate* isolate);
 
   DISALLOW_IMPLICIT_CONSTRUCTORS(String);
 };
@@ -593,7 +593,7 @@ class ConsString : public String {
   // Doesn't check that the result is a string, even in debug mode.  This is
   // useful during GC where the mark bits confuse the checks.
   inline Object* unchecked_first();
-  inline void set_first(String* first,
+  inline void set_first(Isolate* isolate, String* first,
                         WriteBarrierMode mode = UPDATE_WRITE_BARRIER);
 
   // Second string of the cons cell.
@@ -601,7 +601,7 @@ class ConsString : public String {
   // Doesn't check that the result is a string, even in debug mode.  This is
   // useful during GC where the mark bits confuse the checks.
   inline Object* unchecked_second();
-  inline void set_second(String* second,
+  inline void set_second(Isolate* isolate, String* second,
                          WriteBarrierMode mode = UPDATE_WRITE_BARRIER);
 
   // Dispatched behavior.
@@ -675,7 +675,7 @@ class ThinString : public String {
 class SlicedString : public String {
  public:
   inline String* parent();
-  inline void set_parent(String* parent,
+  inline void set_parent(Isolate* isolate, String* parent,
                          WriteBarrierMode mode = UPDATE_WRITE_BARRIER);
   inline int offset() const;
   inline void set_offset(int offset);
@@ -751,6 +751,11 @@ class ExternalOneByteString : public ExternalString {
 
   // The underlying resource.
   inline const Resource* resource();
+
+  // It is assumed that the previous resource is null. If it is not null, then
+  // it is the responsability of the caller the handle the previous resource.
+  inline void SetResource(const Resource* buffer);
+  // Used only during serialization.
   inline void set_resource(const Resource* buffer);
 
   // Update the pointer cache to the external character array.
@@ -784,6 +789,11 @@ class ExternalTwoByteString : public ExternalString {
 
   // The underlying string resource.
   inline const Resource* resource();
+
+  // It is assumed that the previous resource is null. If it is not null, then
+  // it is the responsability of the caller the handle the previous resource.
+  inline void SetResource(const Resource* buffer);
+  // Used only during serialization.
   inline void set_resource(const Resource* buffer);
 
   // Update the pointer cache to the external character array.
diff --git a/deps/v8/src/parsing/func-name-inferrer.cc b/deps/v8/src/parsing/func-name-inferrer.cc
index b55c5ddd5d2355..4920877610121f 100644
--- a/deps/v8/src/parsing/func-name-inferrer.cc
+++ b/deps/v8/src/parsing/func-name-inferrer.cc
@@ -52,6 +52,12 @@ void FuncNameInferrer::RemoveAsyncKeywordFromEnd() {
   }
 }
 
+void FuncNameInferrer::Leave() {
+  DCHECK(IsOpen());
+  names_stack_.Rewind(entries_stack_.RemoveLast());
+  if (entries_stack_.is_empty()) funcs_to_infer_.Clear();
+}
+
 const AstConsString* FuncNameInferrer::MakeNameFromStack() {
   AstConsString* result = ast_value_factory_->NewConsString();
   for (int pos = 0; pos < names_stack_.length(); pos++) {
diff --git a/deps/v8/src/parsing/func-name-inferrer.h b/deps/v8/src/parsing/func-name-inferrer.h
index 643909f701e0e7..21c4da3be9e686 100644
--- a/deps/v8/src/parsing/func-name-inferrer.h
+++ b/deps/v8/src/parsing/func-name-inferrer.h
@@ -96,11 +96,7 @@ class FuncNameInferrer : public ZoneObject {
 
   void Enter() { entries_stack_.Add(names_stack_.length(), zone()); }
 
-  void Leave() {
-    DCHECK(IsOpen());
-    names_stack_.Rewind(entries_stack_.RemoveLast());
-    if (entries_stack_.is_empty()) funcs_to_infer_.Clear();
-  }
+  void Leave();
 
   Zone* zone() const { return zone_; }
 
diff --git a/deps/v8/src/parsing/parser.cc b/deps/v8/src/parsing/parser.cc
index 59b18fd9682c25..dacce7d38f7b44 100644
--- a/deps/v8/src/parsing/parser.cc
+++ b/deps/v8/src/parsing/parser.cc
@@ -7,7 +7,6 @@
 #include <algorithm>
 #include <memory>
 
-#include "src/api.h"
 #include "src/ast/ast-function-literal-id-reindexer.h"
 #include "src/ast/ast-traversal-visitor.h"
 #include "src/ast/ast.h"
@@ -15,9 +14,10 @@
 #include "src/base/platform/platform.h"
 #include "src/char-predicates-inl.h"
 #include "src/compiler-dispatcher/compiler-dispatcher.h"
+#include "src/conversions-inl.h"
 #include "src/log.h"
 #include "src/messages.h"
-#include "src/objects-inl.h"
+#include "src/objects/scope-info.h"
 #include "src/parsing/duplicate-finder.h"
 #include "src/parsing/expression-scope-reparenter.h"
 #include "src/parsing/parse-info.h"
diff --git a/deps/v8/src/parsing/preparsed-scope-data.cc b/deps/v8/src/parsing/preparsed-scope-data.cc
index 3b5105b4a82fa9..0dab3f9ee1b5a1 100644
--- a/deps/v8/src/parsing/preparsed-scope-data.cc
+++ b/deps/v8/src/parsing/preparsed-scope-data.cc
@@ -24,19 +24,21 @@ class VariableMaybeAssignedField : public BitField8<bool, 0, 1> {};
 class VariableContextAllocatedField
     : public BitField8<bool, VariableMaybeAssignedField::kNext, 1> {};
 
-const int kMagicValue = 0xC0DE0DE;
 
 #ifdef DEBUG
+const int kMagicValue = 0xC0DE0DE;
+
 const size_t kUint32Size = 5;
 const size_t kUint8Size = 2;
 const size_t kQuarterMarker = 0;
+const size_t kPlaceholderSize = kUint32Size;
 #else
 const size_t kUint32Size = 4;
 const size_t kUint8Size = 1;
+const size_t kPlaceholderSize = 0;
 #endif
 
-const int kPlaceholderSize = kUint32Size;
-const int kSkippableFunctionDataSize = 4 * kUint32Size + 1 * kUint8Size;
+const size_t kSkippableFunctionDataSize = 4 * kUint32Size + 1 * kUint8Size;
 
 class LanguageField : public BitField8<LanguageMode, 0, 1> {};
 class UsesSuperField : public BitField8<bool, LanguageField::kNext, 1> {};
@@ -51,7 +53,7 @@ STATIC_ASSERT(LanguageModeSize <= LanguageField::kNumValues);
 
   (Skippable function data:)
   ------------------------------------
-  | scope_data_start                 |
+  | scope_data_start (debug only)    |
   ------------------------------------
   | data for inner function 1        |
   | ...                              |
@@ -59,11 +61,11 @@ STATIC_ASSERT(LanguageModeSize <= LanguageField::kNumValues);
   | data for inner function n        |
   | ...                              |
   ------------------------------------
-  (Scope allocation data:)             << scope_data_start points here
+  (Scope allocation data:)             << scope_data_start points here in debug
   ------------------------------------
-  magic value
+  magic value (debug only)
   ------------------------------------
-  scope positions
+  scope positions (debug only)
   ------------------------------------
   | scope type << only in debug      |
   | eval                             |
@@ -101,19 +103,19 @@ void ProducedPreParsedScopeData::ByteData::WriteUint32(uint32_t data) {
   free_quarters_in_last_byte_ = 0;
 }
 
+#ifdef DEBUG
 void ProducedPreParsedScopeData::ByteData::OverwriteFirstUint32(uint32_t data) {
   auto it = backing_store_.begin();
-#ifdef DEBUG
   // Check that that position already holds an item of the expected size.
   DCHECK_GE(backing_store_.size(), kUint32Size);
   DCHECK_EQ(*it, kUint32Size);
   ++it;
-#endif
   const uint8_t* d = reinterpret_cast<uint8_t*>(&data);
   for (size_t i = 0; i < 4; ++i) {
     *it++ = *d++;
   }
 }
+#endif
 
 void ProducedPreParsedScopeData::ByteData::WriteUint8(uint8_t data) {
 #ifdef DEBUG
@@ -166,8 +168,10 @@ ProducedPreParsedScopeData::ProducedPreParsedScopeData(
   if (parent != nullptr) {
     parent->data_for_inner_functions_.push_back(this);
   }
+#ifdef DEBUG
   // Reserve space for scope_data_start, written later:
   byte_data_->WriteUint32(0);
+#endif
 }
 
 // Create a ProducedPreParsedScopeData which is just a proxy for a previous
@@ -227,6 +231,9 @@ void ProducedPreParsedScopeData::AddSkippableFunction(
     return;
   }
 
+  // Start position is used for a sanity check when consuming the data, we could
+  // remove it in the future if we're very pressed for space but it's been good
+  // at catching bugs in the wild so far.
   byte_data_->WriteUint32(start_position);
   byte_data_->WriteUint32(end_position);
   byte_data_->WriteUint32(num_parameters);
@@ -259,6 +266,7 @@ void ProducedPreParsedScopeData::SaveScopeAllocationData(
     return;
   }
 
+#ifdef DEBUG
   byte_data_->OverwriteFirstUint32(scope_data_start);
 
   // For a data integrity check, write a value between data about skipped inner
@@ -266,6 +274,7 @@ void ProducedPreParsedScopeData::SaveScopeAllocationData(
   byte_data_->WriteUint32(kMagicValue);
   byte_data_->WriteUint32(scope->start_position());
   byte_data_->WriteUint32(scope->end_position());
+#endif
 
   SaveDataForScope(scope);
 }
@@ -292,30 +301,22 @@ MaybeHandle<PreParsedScopeData> ProducedPreParsedScopeData::Serialize(
     return MaybeHandle<PreParsedScopeData>();
   }
 
-  Handle<PreParsedScopeData> data = isolate->factory()->NewPreParsedScopeData();
+  int child_data_length = static_cast<int>(data_for_inner_functions_.size());
+  Handle<PreParsedScopeData> data =
+      isolate->factory()->NewPreParsedScopeData(child_data_length);
 
   Handle<PodArray<uint8_t>> scope_data_array = byte_data_->Serialize(isolate);
   data->set_scope_data(*scope_data_array);
 
-  int child_data_length = static_cast<int>(data_for_inner_functions_.size());
-  if (child_data_length == 0) {
-    data->set_child_data(*(isolate->factory()->empty_fixed_array()));
-  } else {
-    Handle<FixedArray> child_array =
-        isolate->factory()->NewFixedArray(child_data_length, TENURED);
-    int i = 0;
-    for (const auto& item : data_for_inner_functions_) {
-      MaybeHandle<PreParsedScopeData> maybe_child_data =
-          item->Serialize(isolate);
-      if (maybe_child_data.is_null()) {
-        child_array->set(i++, *(isolate->factory()->null_value()));
-      } else {
-        Handle<PreParsedScopeData> child_data =
-            maybe_child_data.ToHandleChecked();
-        child_array->set(i++, *child_data);
-      }
+  int i = 0;
+  for (const auto& item : data_for_inner_functions_) {
+    Handle<PreParsedScopeData> child_data;
+    if (item->Serialize(isolate).ToHandle(&child_data)) {
+      data->set_child_data(i, *child_data);
+    } else {
+      DCHECK(data->child_data(i)->IsNull());
     }
-    data->set_child_data(*child_array);
+    i++;
   }
 
   return data;
@@ -496,9 +497,9 @@ void ConsumedPreParsedScopeData::SetData(Isolate* isolate,
   int scope_data_start = scope_data_->ReadUint32();
   scope_data_->SetPosition(scope_data_start);
   DCHECK_EQ(scope_data_->ReadUint32(), kMagicValue);
-#endif
   // The first data item is scope_data_start. Skip over it.
   scope_data_->SetPosition(kPlaceholderSize);
+#endif
 }
 
 ProducedPreParsedScopeData*
@@ -525,9 +526,8 @@ ConsumedPreParsedScopeData::GetDataForSkippableFunction(
   // Retrieve the corresponding PreParsedScopeData and associate it to the
   // skipped function. If the skipped functions contains inner functions, those
   // can be skipped when the skipped function is eagerly parsed.
-  FixedArray* children = data_->child_data();
-  CHECK_GT(children->length(), child_index_);
-  Object* child_data = children->get(child_index_++);
+  CHECK_GT(data_->length(), child_index_);
+  Object* child_data = data_->child_data(child_index_++);
   if (!child_data->IsPreParsedScopeData()) {
     return nullptr;
   }
@@ -544,14 +544,16 @@ void ConsumedPreParsedScopeData::RestoreScopeAllocationData(
 
   ByteData::ReadingScope reading_scope(this);
 
+#ifdef DEBUG
   int magic_value_from_data = scope_data_->ReadUint32();
   // Check that we've consumed all inner function data.
-  CHECK_EQ(magic_value_from_data, kMagicValue);
+  DCHECK_EQ(magic_value_from_data, kMagicValue);
 
   int start_position_from_data = scope_data_->ReadUint32();
   int end_position_from_data = scope_data_->ReadUint32();
-  CHECK_EQ(start_position_from_data, scope->start_position());
-  CHECK_EQ(end_position_from_data, scope->end_position());
+  DCHECK_EQ(start_position_from_data, scope->start_position());
+  DCHECK_EQ(end_position_from_data, scope->end_position());
+#endif
 
   RestoreData(scope);
 
diff --git a/deps/v8/src/parsing/preparsed-scope-data.h b/deps/v8/src/parsing/preparsed-scope-data.h
index 2b66c0150d74df..6ad0f491f8e803 100644
--- a/deps/v8/src/parsing/preparsed-scope-data.h
+++ b/deps/v8/src/parsing/preparsed-scope-data.h
@@ -76,8 +76,10 @@ class ProducedPreParsedScopeData : public ZoneObject {
     void WriteUint8(uint8_t data);
     void WriteQuarter(uint8_t data);
 
+#ifdef DEBUG
     // For overwriting previously written data at position 0.
     void OverwriteFirstUint32(uint32_t data);
+#endif
 
     Handle<PodArray<uint8_t>> Serialize(Isolate* isolate);
 
diff --git a/deps/v8/src/parsing/scanner-character-streams.cc b/deps/v8/src/parsing/scanner-character-streams.cc
index 7ac7af74ab451c..052b6007ae435d 100644
--- a/deps/v8/src/parsing/scanner-character-streams.cc
+++ b/deps/v8/src/parsing/scanner-character-streams.cc
@@ -564,9 +564,11 @@ Utf16CharacterStream* ScannerStream::For(Isolate* isolate, Handle<String> data,
   if (data->IsSlicedString()) {
     SlicedString* string = SlicedString::cast(*data);
     start_offset = string->offset();
-    data = handle(string->parent(), string->GetIsolate());
+    String* parent = string->parent();
+    if (parent->IsThinString()) parent = ThinString::cast(parent)->actual();
+    data = handle(parent, isolate);
   } else {
-    data = String::Flatten(data->GetIsolate(), data);
+    data = String::Flatten(isolate, data);
   }
   if (data->IsExternalOneByteString()) {
     return new BufferedCharacterStream<uint8_t, ExternalStringStream>(
diff --git a/deps/v8/src/profiler/cpu-profiler-inl.h b/deps/v8/src/profiler/cpu-profiler-inl.h
index c26c9ee06d6d54..f6eaa8f8a33e72 100644
--- a/deps/v8/src/profiler/cpu-profiler-inl.h
+++ b/deps/v8/src/profiler/cpu-profiler-inl.h
@@ -58,7 +58,7 @@ TickSample* ProfilerEventsProcessor::StartTickSample() {
   void* address = ticks_buffer_.StartEnqueue();
   if (address == nullptr) return nullptr;
   TickSampleEventRecord* evt =
-      new (address) TickSampleEventRecord(last_code_event_id_.Value());
+      new (address) TickSampleEventRecord(last_code_event_id_);
   return &evt->sample;
 }
 
diff --git a/deps/v8/src/profiler/cpu-profiler.cc b/deps/v8/src/profiler/cpu-profiler.cc
index e96b4b63aa7c31..463a30f1842c24 100644
--- a/deps/v8/src/profiler/cpu-profiler.cc
+++ b/deps/v8/src/profiler/cpu-profiler.cc
@@ -63,14 +63,14 @@ ProfilerEventsProcessor::~ProfilerEventsProcessor() {
 }
 
 void ProfilerEventsProcessor::Enqueue(const CodeEventsContainer& event) {
-  event.generic.order = last_code_event_id_.Increment(1);
+  event.generic.order = ++last_code_event_id_;
   events_buffer_.Enqueue(event);
 }
 
 
 void ProfilerEventsProcessor::AddDeoptStack(Isolate* isolate, Address from,
                                             int fp_to_sp_delta) {
-  TickSampleEventRecord record(last_code_event_id_.Value());
+  TickSampleEventRecord record(last_code_event_id_);
   RegisterState regs;
   Address fp = isolate->c_entry_fp(isolate->thread_local_top());
   regs.sp = reinterpret_cast<void*>(fp - fp_to_sp_delta);
@@ -82,7 +82,7 @@ void ProfilerEventsProcessor::AddDeoptStack(Isolate* isolate, Address from,
 
 void ProfilerEventsProcessor::AddCurrentStack(Isolate* isolate,
                                               bool update_stats) {
-  TickSampleEventRecord record(last_code_event_id_.Value());
+  TickSampleEventRecord record(last_code_event_id_);
   RegisterState regs;
   StackFrameIterator it(isolate);
   if (!it.done()) {
diff --git a/deps/v8/src/profiler/cpu-profiler.h b/deps/v8/src/profiler/cpu-profiler.h
index 4502b35f8538b8..febc15480215b7 100644
--- a/deps/v8/src/profiler/cpu-profiler.h
+++ b/deps/v8/src/profiler/cpu-profiler.h
@@ -183,7 +183,7 @@ class ProfilerEventsProcessor : public base::Thread {
   SamplingCircularQueue<TickSampleEventRecord,
                         kTickSampleQueueLength> ticks_buffer_;
   LockedQueue<TickSampleEventRecord> ticks_from_vm_buffer_;
-  base::AtomicNumber<unsigned> last_code_event_id_;
+  std::atomic<unsigned> last_code_event_id_;
   unsigned last_processed_code_event_id_;
 };
 
diff --git a/deps/v8/src/profiler/heap-snapshot-generator.cc b/deps/v8/src/profiler/heap-snapshot-generator.cc
index ff977cc0c005db..b51ea0de7e42ab 100644
--- a/deps/v8/src/profiler/heap-snapshot-generator.cc
+++ b/deps/v8/src/profiler/heap-snapshot-generator.cc
@@ -1431,8 +1431,9 @@ void V8HeapExplorer::ExtractPropertyReferences(JSObject* js_obj, int entry) {
     GlobalDictionary* dictionary =
         JSGlobalObject::cast(js_obj)->global_dictionary();
     int length = dictionary->Capacity();
+    ReadOnlyRoots roots(isolate);
     for (int i = 0; i < length; ++i) {
-      if (dictionary->IsKey(isolate, dictionary->KeyAt(i))) {
+      if (dictionary->IsKey(roots, dictionary->KeyAt(i))) {
         PropertyCell* cell = dictionary->CellAt(i);
         Name* name = cell->name();
         Object* value = cell->value();
@@ -1444,9 +1445,10 @@ void V8HeapExplorer::ExtractPropertyReferences(JSObject* js_obj, int entry) {
   } else {
     NameDictionary* dictionary = js_obj->property_dictionary();
     int length = dictionary->Capacity();
+    ReadOnlyRoots roots(isolate);
     for (int i = 0; i < length; ++i) {
       Object* k = dictionary->KeyAt(i);
-      if (dictionary->IsKey(isolate, k)) {
+      if (dictionary->IsKey(roots, k)) {
         Object* value = dictionary->ValueAt(i);
         PropertyDetails details = dictionary->DetailsAt(i);
         SetDataOrAccessorPropertyReference(details.kind(), js_obj, entry,
@@ -1476,14 +1478,14 @@ void V8HeapExplorer::ExtractAccessorPairProperty(JSObject* js_obj, int entry,
 
 
 void V8HeapExplorer::ExtractElementReferences(JSObject* js_obj, int entry) {
-  Isolate* isolate = js_obj->GetIsolate();
+  ReadOnlyRoots roots = js_obj->GetReadOnlyRoots();
   if (js_obj->HasObjectElements()) {
     FixedArray* elements = FixedArray::cast(js_obj->elements());
     int length = js_obj->IsJSArray()
                      ? Smi::ToInt(JSArray::cast(js_obj)->length())
                      : elements->length();
     for (int i = 0; i < length; ++i) {
-      if (!elements->get(i)->IsTheHole(isolate)) {
+      if (!elements->get(i)->IsTheHole(roots)) {
         SetElementReference(js_obj, entry, i, elements->get(i));
       }
     }
@@ -1492,7 +1494,7 @@ void V8HeapExplorer::ExtractElementReferences(JSObject* js_obj, int entry) {
     int length = dictionary->Capacity();
     for (int i = 0; i < length; ++i) {
       Object* k = dictionary->KeyAt(i);
-      if (dictionary->IsKey(isolate, k)) {
+      if (dictionary->IsKey(roots, k)) {
         DCHECK(k->IsNumber());
         uint32_t index = static_cast<uint32_t>(k->Number());
         SetElementReference(js_obj, entry, index, dictionary->ValueAt(i));
@@ -1955,6 +1957,7 @@ class EmbedderGraphImpl : public EmbedderGraph {
   struct Edge {
     Node* from;
     Node* to;
+    const char* name;
   };
 
   class V8NodeImpl : public Node {
@@ -1991,7 +1994,9 @@ class EmbedderGraphImpl : public EmbedderGraph {
     return result;
   }
 
-  void AddEdge(Node* from, Node* to) final { edges_.push_back({from, to}); }
+  void AddEdge(Node* from, Node* to, const char* name) final {
+    edges_.push_back({from, to, name});
+  }
 
   const std::vector<std::unique_ptr<Node>>& nodes() { return nodes_; }
   const std::vector<Edge>& edges() { return edges_; }
@@ -2284,8 +2289,13 @@ bool NativeObjectsExplorer::IterateAndExtractReferences(
       int from_index = from->index();
       HeapEntry* to = EntryForEmbedderGraphNode(edge.to);
       if (to) {
-        filler_->SetIndexedAutoIndexReference(HeapGraphEdge::kElement,
-                                              from_index, to);
+        if (edge.name == nullptr) {
+          filler_->SetIndexedAutoIndexReference(HeapGraphEdge::kElement,
+                                                from_index, to);
+        } else {
+          filler_->SetNamedReference(HeapGraphEdge::kInternal, from_index,
+                                     edge.name, to);
+        }
       }
     }
   } else {
diff --git a/deps/v8/src/property.h b/deps/v8/src/property.h
index 6a99e32ef6f687..41734914668b34 100644
--- a/deps/v8/src/property.h
+++ b/deps/v8/src/property.h
@@ -65,15 +65,6 @@ class Descriptor final BASE_EMBEDDED {
   PropertyDetails details_;
 
  protected:
-  void Init(Handle<Name> key, MaybeObjectHandle value,
-            PropertyDetails details) {
-    DCHECK(key->IsUniqueName());
-    DCHECK_IMPLIES(key->IsPrivate(), !details.IsEnumerable());
-    key_ = key;
-    value_ = value;
-    details_ = details;
-  }
-
   Descriptor(Handle<Name> key, MaybeObjectHandle value, PropertyDetails details)
       : key_(key), value_(value), details_(details) {
     DCHECK(key->IsUniqueName());
@@ -92,8 +83,6 @@ class Descriptor final BASE_EMBEDDED {
     DCHECK_IMPLIES(key->IsPrivate(), !details_.IsEnumerable());
   }
 
-  friend class DescriptorArray;
-  friend class Map;
   friend class MapUpdater;
 };
 
diff --git a/deps/v8/src/roots.h b/deps/v8/src/roots.h
index 4e676b456e48e9..5818e3c3ac8b72 100644
--- a/deps/v8/src/roots.h
+++ b/deps/v8/src/roots.h
@@ -89,6 +89,7 @@ namespace internal {
   V(Map, one_closure_cell_map, OneClosureCellMap)                              \
   V(Map, ordered_hash_map_map, OrderedHashMapMap)                              \
   V(Map, ordered_hash_set_map, OrderedHashSetMap)                              \
+  V(Map, pre_parsed_scope_data_map, PreParsedScopeDataMap)                     \
   V(Map, property_array_map, PropertyArrayMap)                                 \
   V(Map, side_effect_call_handler_info_map, SideEffectCallHandlerInfoMap)      \
   V(Map, side_effect_free_call_handler_info_map,                               \
diff --git a/deps/v8/src/runtime/runtime-array.cc b/deps/v8/src/runtime/runtime-array.cc
index df0f5ea4cfe85c..63b3d9004cba9d 100644
--- a/deps/v8/src/runtime/runtime-array.cc
+++ b/deps/v8/src/runtime/runtime-array.cc
@@ -500,7 +500,7 @@ RUNTIME_FUNCTION(Runtime_GetArrayKeys) {
     j++;
   }
 
-  keys = FixedArray::ShrinkOrEmpty(keys, j);
+  keys = FixedArray::ShrinkOrEmpty(isolate, keys, j);
   return *isolate->factory()->NewJSArrayWithElements(keys);
 }
 
diff --git a/deps/v8/src/runtime/runtime-classes.cc b/deps/v8/src/runtime/runtime-classes.cc
index 6c221842076046..31f9fed96b07ca 100644
--- a/deps/v8/src/runtime/runtime-classes.cc
+++ b/deps/v8/src/runtime/runtime-classes.cc
@@ -228,9 +228,10 @@ bool SubstituteValues(Isolate* isolate, Handle<Dictionary> dictionary,
 
   // Replace all indices with proper methods.
   int capacity = dictionary->Capacity();
+  ReadOnlyRoots roots(isolate);
   for (int i = 0; i < capacity; i++) {
     Object* maybe_key = dictionary->KeyAt(i);
-    if (!Dictionary::IsKey(isolate, maybe_key)) continue;
+    if (!Dictionary::IsKey(roots, maybe_key)) continue;
     if (install_name_accessor && *install_name_accessor &&
         (maybe_key == *name_string)) {
       *install_name_accessor = false;
diff --git a/deps/v8/src/runtime/runtime-collections.cc b/deps/v8/src/runtime/runtime-collections.cc
index 9494f80518025e..30e4341be32594 100644
--- a/deps/v8/src/runtime/runtime-collections.cc
+++ b/deps/v8/src/runtime/runtime-collections.cc
@@ -98,7 +98,7 @@ RUNTIME_FUNCTION(Runtime_WeakCollectionDelete) {
 
 #ifdef DEBUG
   DCHECK(key->IsJSReceiver());
-  DCHECK(EphemeronHashTableShape::IsLive(isolate, *key));
+  DCHECK(EphemeronHashTableShape::IsLive(ReadOnlyRoots(isolate), *key));
   Handle<EphemeronHashTable> table(
       EphemeronHashTable::cast(weak_collection->table()), isolate);
   // Should only be called when shrinking the table is necessary. See
@@ -130,7 +130,7 @@ RUNTIME_FUNCTION(Runtime_WeakCollectionSet) {
 
 #ifdef DEBUG
   DCHECK(key->IsJSReceiver());
-  DCHECK(EphemeronHashTableShape::IsLive(isolate, *key));
+  DCHECK(EphemeronHashTableShape::IsLive(ReadOnlyRoots(isolate), *key));
   Handle<EphemeronHashTable> table(
       EphemeronHashTable::cast(weak_collection->table()), isolate);
   // Should only be called when rehashing or resizing the table is necessary.
diff --git a/deps/v8/src/runtime/runtime-object.cc b/deps/v8/src/runtime/runtime-object.cc
index 8d40fe5226ceb6..f53d12cf349f8e 100644
--- a/deps/v8/src/runtime/runtime-object.cc
+++ b/deps/v8/src/runtime/runtime-object.cc
@@ -688,7 +688,8 @@ RUNTIME_FUNCTION(Runtime_ShrinkPropertyDictionary) {
   DCHECK_EQ(1, args.length());
   CONVERT_ARG_HANDLE_CHECKED(JSReceiver, receiver, 0);
   Handle<NameDictionary> dictionary(receiver->property_dictionary(), isolate);
-  Handle<NameDictionary> new_properties = NameDictionary::Shrink(dictionary);
+  Handle<NameDictionary> new_properties =
+      NameDictionary::Shrink(isolate, dictionary);
   receiver->SetProperties(*new_properties);
   return Smi::kZero;
 }
diff --git a/deps/v8/src/runtime/runtime-regexp.cc b/deps/v8/src/runtime/runtime-regexp.cc
index 556918b69bb06d..91a47bad0cebf4 100644
--- a/deps/v8/src/runtime/runtime-regexp.cc
+++ b/deps/v8/src/runtime/runtime-regexp.cc
@@ -1279,7 +1279,7 @@ static Object* SearchRegExpMultiple(Isolate* isolate, Handle<String> subject,
         last_match_cache->set(i, Smi::FromInt(last_match[i]));
       }
       Handle<FixedArray> result_fixed_array =
-          FixedArray::ShrinkOrEmpty(builder.array(), builder.length());
+          FixedArray::ShrinkOrEmpty(isolate, builder.array(), builder.length());
       // Cache the result and copy the FixedArray into a COW array.
       Handle<FixedArray> copied_fixed_array =
           isolate->factory()->CopyFixedArrayWithMap(
@@ -1558,7 +1558,7 @@ Handle<JSArray> NewJSArrayWithElements(Isolate* isolate,
                                        Handle<FixedArray> elems,
                                        int num_elems) {
   return isolate->factory()->NewJSArrayWithElements(
-      FixedArray::ShrinkOrEmpty(elems, num_elems));
+      FixedArray::ShrinkOrEmpty(isolate, elems, num_elems));
 }
 
 }  // namespace
@@ -1679,7 +1679,7 @@ RUNTIME_FUNCTION(Runtime_RegExpSplit) {
     {
       Handle<String> substr =
           factory->NewSubString(string, prev_string_index, string_index);
-      elems = FixedArray::SetAndGrow(elems, num_elems++, substr);
+      elems = FixedArray::SetAndGrow(isolate, elems, num_elems++, substr);
       if (num_elems == limit) {
         return *NewJSArrayWithElements(isolate, elems, num_elems);
       }
@@ -1700,7 +1700,7 @@ RUNTIME_FUNCTION(Runtime_RegExpSplit) {
       Handle<Object> capture;
       ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
           isolate, capture, Object::GetElement(isolate, result, i));
-      elems = FixedArray::SetAndGrow(elems, num_elems++, capture);
+      elems = FixedArray::SetAndGrow(isolate, elems, num_elems++, capture);
       if (num_elems == limit) {
         return *NewJSArrayWithElements(isolate, elems, num_elems);
       }
@@ -1712,7 +1712,7 @@ RUNTIME_FUNCTION(Runtime_RegExpSplit) {
   {
     Handle<String> substr =
         factory->NewSubString(string, prev_string_index, length);
-    elems = FixedArray::SetAndGrow(elems, num_elems++, substr);
+    elems = FixedArray::SetAndGrow(isolate, elems, num_elems++, substr);
   }
 
   return *NewJSArrayWithElements(isolate, elems, num_elems);
diff --git a/deps/v8/src/runtime/runtime-test.cc b/deps/v8/src/runtime/runtime-test.cc
index 157e3fd4146ac9..03251b67e189d4 100644
--- a/deps/v8/src/runtime/runtime-test.cc
+++ b/deps/v8/src/runtime/runtime-test.cc
@@ -551,7 +551,7 @@ RUNTIME_FUNCTION(Runtime_DebugPrint) {
       DCHECK(!weak);
       // If we have a string, assume it's a code "marker"
       // and print some interesting cpu debugging info.
-      object->Print(isolate, os);
+      object->Print(os);
       JavaScriptFrameIterator it(isolate);
       JavaScriptFrame* frame = it.frame();
       os << "fp = " << reinterpret_cast<void*>(frame->fp())
@@ -563,10 +563,10 @@ RUNTIME_FUNCTION(Runtime_DebugPrint) {
       if (weak) {
         os << "[weak] ";
       }
-      object->Print(isolate, os);
+      object->Print(os);
     }
     if (object->IsHeapObject()) {
-      HeapObject::cast(object)->map()->Print(isolate, os);
+      HeapObject::cast(object)->map()->Print(os);
     }
 #else
     if (weak) {
@@ -720,7 +720,7 @@ RUNTIME_FUNCTION(Runtime_DisassembleFunction) {
     return ReadOnlyRoots(isolate).exception();
   }
   StdoutStream os;
-  func->code()->Print(isolate, os);
+  func->code()->Print(os);
   os << std::endl;
 #endif  // DEBUG
   return ReadOnlyRoots(isolate).undefined_value();
diff --git a/deps/v8/src/runtime/runtime-wasm.cc b/deps/v8/src/runtime/runtime-wasm.cc
index c692b21c53970e..43768f48fa98e1 100644
--- a/deps/v8/src/runtime/runtime-wasm.cc
+++ b/deps/v8/src/runtime/runtime-wasm.cc
@@ -80,8 +80,11 @@ RUNTIME_FUNCTION(Runtime_WasmGrowMemory) {
   DCHECK_NULL(isolate->context());
   isolate->set_context(instance->native_context());
 
-  return *isolate->factory()->NewNumberFromInt(WasmMemoryObject::Grow(
-      isolate, handle(instance->memory_object(), isolate), delta_pages));
+  int ret = WasmMemoryObject::Grow(
+      isolate, handle(instance->memory_object(), isolate), delta_pages);
+  // The WasmGrowMemory builtin which calls this runtime function expects us to
+  // always return a Smi.
+  return Smi::FromInt(ret);
 }
 
 RUNTIME_FUNCTION(Runtime_ThrowWasmError) {
diff --git a/deps/v8/src/s390/assembler-s390.h b/deps/v8/src/s390/assembler-s390.h
index 480ba37093c078..4bd7927ef23c15 100644
--- a/deps/v8/src/s390/assembler-s390.h
+++ b/deps/v8/src/s390/assembler-s390.h
@@ -1331,6 +1331,46 @@ inline void ss_a_format(Opcode op, int f1, int f2, int f3, int f4, int f5) {
     brxhg(dst, inc, Operand(offset_halfwords));
   }
 
+  template <class R1, class R2>
+  void ledbr(R1 r1, R2 r2) {
+    ledbra(Condition(0), Condition(0), r1, r2);
+  }
+
+  template <class R1, class R2>
+  void cdfbr(R1 r1, R2 r2) {
+    cdfbra(Condition(0), Condition(0), r1, r2);
+  }
+
+  template <class R1, class R2>
+  void cdgbr(R1 r1, R2 r2) {
+    cdgbra(Condition(0), Condition(0), r1, r2);
+  }
+
+  template <class R1, class R2>
+  void cegbr(R1 r1, R2 r2) {
+    cegbra(Condition(0), Condition(0), r1, r2);
+  }
+
+  template <class R1, class R2>
+  void cgebr(Condition m3, R1 r1, R2 r2) {
+    cgebra(m3, Condition(0), r1, r2);
+  }
+
+  template <class R1, class R2>
+  void cgdbr(Condition m3, R1 r1, R2 r2) {
+    cgdbra(m3, Condition(0), r1, r2);
+  }
+
+  template <class R1, class R2>
+  void cfdbr(Condition m3, R1 r1, R2 r2) {
+    cfdbra(m3, Condition(0), r1, r2);
+  }
+
+  template <class R1, class R2>
+  void cfebr(Condition m3, R1 r1, R2 r2) {
+    cfebra(m3, Condition(0), r1, r2);
+  }
+
   // ---------------------------------------------------------------------------
   // Code generation
 
diff --git a/deps/v8/src/s390/constants-s390.h b/deps/v8/src/s390/constants-s390.h
index a9aa304cb1d588..e02a3ab2158d1b 100644
--- a/deps/v8/src/s390/constants-s390.h
+++ b/deps/v8/src/s390/constants-s390.h
@@ -278,23 +278,15 @@ typedef uint64_t SixByteInstr;
 
 #define S390_RRF_A_OPCODE_LIST(V)                                           \
   V(ipte, IPTE, 0xB221)     /* type = RRF_A INVALIDATE PAGE TABLE ENTRY  */ \
-  V(mdtr, MDTR, 0xB3D0)     /* type = RRF_A MULTIPLY (long DFP)  */         \
   V(mdtra, MDTRA, 0xB3D0)   /* type = RRF_A MULTIPLY (long DFP)  */         \
-  V(ddtr, DDTR, 0xB3D1)     /* type = RRF_A DIVIDE (long DFP)  */           \
   V(ddtra, DDTRA, 0xB3D1)   /* type = RRF_A DIVIDE (long DFP)  */           \
-  V(adtr, ADTR, 0xB3D2)     /* type = RRF_A ADD (long DFP)  */              \
   V(adtra, ADTRA, 0xB3D2)   /* type = RRF_A ADD (long DFP)  */              \
-  V(sdtr, SDTR, 0xB3D3)     /* type = RRF_A SUBTRACT (long DFP)  */         \
   V(sdtra, SDTRA, 0xB3D3)   /* type = RRF_A SUBTRACT (long DFP)  */         \
-  V(mxtr, MXTR, 0xB3D8)     /* type = RRF_A MULTIPLY (extended DFP)  */     \
   V(mxtra, MXTRA, 0xB3D8)   /* type = RRF_A MULTIPLY (extended DFP)  */     \
   V(msrkc, MSRKC, 0xB9FD)   /* type = RRF_A MULTIPLY (32)*/                 \
   V(msgrkc, MSGRKC, 0xB9ED) /* type = RRF_A MULTIPLY (64)*/                 \
-  V(dxtr, DXTR, 0xB3D9)     /* type = RRF_A DIVIDE (extended DFP)  */       \
   V(dxtra, DXTRA, 0xB3D9)   /* type = RRF_A DIVIDE (extended DFP)  */       \
-  V(axtr, AXTR, 0xB3DA)     /* type = RRF_A ADD (extended DFP)  */          \
   V(axtra, AXTRA, 0xB3DA)   /* type = RRF_A ADD (extended DFP)  */          \
-  V(sxtr, SXTR, 0xB3DB)     /* type = RRF_A SUBTRACT (extended DFP)  */     \
   V(sxtra, SXTRA, 0xB3DB)   /* type = RRF_A SUBTRACT (extended DFP)  */     \
   V(ahhhr, AHHHR, 0xB9C8)   /* type = RRF_A ADD HIGH (32)  */               \
   V(shhhr, SHHHR, 0xB9C9)   /* type = RRF_A SUBTRACT HIGH (32)  */          \
@@ -370,9 +362,7 @@ typedef uint64_t SixByteInstr;
 
 #define S390_RRF_C_OPCODE_LIST(V)                                           \
   V(sske, SSKE, 0xB22B)   /* type = RRF_C SET STORAGE KEY EXTENDED  */      \
-  V(cuutf, CUUTF, 0xB2A6) /* type = RRF_C CONVERT UNICODE TO UTF-8  */      \
   V(cu21, CU21, 0xB2A6)   /* type = RRF_C CONVERT UTF-16 TO UTF-8  */       \
-  V(cutfu, CUTFU, 0xB2A7) /* type = RRF_C CONVERT UTF-8 TO UNICODE  */      \
   V(cu12, CU12, 0xB2A7)   /* type = RRF_C CONVERT UTF-8 TO UTF-16  */       \
   V(ppa, PPA, 0xB2E8)     /* type = RRF_C PERFORM PROCESSOR ASSIST  */      \
   V(cgrt, CGRT, 0xB960)   /* type = RRF_C COMPARE AND TRAP (64)  */         \
@@ -412,14 +402,11 @@ typedef uint64_t SixByteInstr;
     0xB345) /* type = RRF_E LOAD ROUNDED (extended to long BFP)  */            \
   V(lexbra, LEXBRA,                                                            \
     0xB346) /* type = RRF_E LOAD ROUNDED (extended to short BFP)  */           \
-  V(fixbr, FIXBR, 0xB347)   /* type = RRF_E LOAD FP INTEGER (extended BFP)  */ \
   V(fixbra, FIXBRA, 0xB347) /* type = RRF_E LOAD FP INTEGER (extended BFP)  */ \
   V(tbedr, TBEDR,                                                              \
     0xB350)             /* type = RRF_E CONVERT HFP TO BFP (long to short)  */ \
   V(tbdr, TBDR, 0xB351) /* type = RRF_E CONVERT HFP TO BFP (long)  */          \
-  V(fiebr, FIEBR, 0xB357)   /* type = RRF_E LOAD FP INTEGER (short BFP)  */    \
   V(fiebra, FIEBRA, 0xB357) /* type = RRF_E LOAD FP INTEGER (short BFP)  */    \
-  V(fidbr, FIDBR, 0xB35F)   /* type = RRF_E LOAD FP INTEGER (long BFP)  */     \
   V(fidbra, FIDBRA, 0xB35F) /* type = RRF_E LOAD FP INTEGER (long BFP)  */     \
   V(celfbr, CELFBR,                                                            \
     0xB390) /* type = RRF_E CONVERT FROM LOGICAL (32 to short BFP)  */         \
@@ -433,15 +420,10 @@ typedef uint64_t SixByteInstr;
     0xB395) /* type = RRF_E CONVERT FROM FIXED (32 to long BFP)  */            \
   V(cxfbra, CXFBRA,                                                            \
     0xB396) /* type = RRF_E CONVERT FROM FIXED (32 to extended BFP)  */        \
-  V(cfebr, CFEBR,                                                              \
-    0xB398) /* type = RRF_E CONVERT TO FIXED (short BFP to 32)  */             \
   V(cfebra, CFEBRA,                                                            \
     0xB398) /* type = RRF_E CONVERT TO FIXED (short BFP to 32)  */             \
-  V(cfdbr, CFDBR, 0xB399) /* type = RRF_E CONVERT TO FIXED (long BFP to 32) */ \
   V(cfdbra, CFDBRA,                                                            \
     0xB399) /* type = RRF_E CONVERT TO FIXED (long BFP to 32)  */              \
-  V(cfxbr, CFXBR,                                                              \
-    0xB39A) /* type = RRF_E CONVERT TO FIXED (extended BFP to 32)  */          \
   V(cfxbra, CFXBRA,                                                            \
     0xB39A) /* type = RRF_E CONVERT TO FIXED (extended BFP to 32)  */          \
   V(clfebr, CLFEBR,                                                            \
@@ -462,15 +444,10 @@ typedef uint64_t SixByteInstr;
     0xB3A5) /* type = RRF_E CONVERT FROM FIXED (64 to long BFP)  */            \
   V(cxgbra, CXGBRA,                                                            \
     0xB3A6) /* type = RRF_E CONVERT FROM FIXED (64 to extended BFP)  */        \
-  V(cgebr, CGEBR,                                                              \
-    0xB3A8) /* type = RRF_E CONVERT TO FIXED (short BFP to 64)  */             \
   V(cgebra, CGEBRA,                                                            \
     0xB3A8) /* type = RRF_E CONVERT TO FIXED (short BFP to 64)  */             \
-  V(cgdbr, CGDBR, 0xB3A9) /* type = RRF_E CONVERT TO FIXED (long BFP to 64) */ \
   V(cgdbra, CGDBRA,                                                            \
     0xB3A9) /* type = RRF_E CONVERT TO FIXED (long BFP to 64)  */              \
-  V(cgxbr, CGXBR,                                                              \
-    0xB3AA) /* type = RRF_E CONVERT TO FIXED (extended BFP to 64)  */          \
   V(cgxbra, CGXBRA,                                                            \
     0xB3AA) /* type = RRF_E CONVERT TO FIXED (extended BFP to 64)  */          \
   V(clgebr, CLGEBR,                                                            \
@@ -492,11 +469,8 @@ typedef uint64_t SixByteInstr;
   V(ldxtr, LDXTR,                                                              \
     0xB3DD) /* type = RRF_E LOAD ROUNDED (extended to long DFP)  */            \
   V(fixtr, FIXTR, 0xB3DF) /* type = RRF_E LOAD FP INTEGER (extended DFP)  */   \
-  V(cgdtr, CGDTR, 0xB3E1) /* type = RRF_E CONVERT TO FIXED (long DFP to 64) */ \
   V(cgdtra, CGDTRA,                                                            \
     0xB3E1) /* type = RRF_E CONVERT TO FIXED (long DFP to 64)  */              \
-  V(cgxtr, CGXTR,                                                              \
-    0xB3E9) /* type = RRF_E CONVERT TO FIXED (extended DFP to 64)  */          \
   V(cgxtra, CGXTRA,                                                            \
     0xB3E9) /* type = RRF_E CONVERT TO FIXED (extended DFP to 64)  */          \
   V(cdgtra, CDGTRA,                                                            \
@@ -841,9 +815,7 @@ typedef uint64_t SixByteInstr;
   V(llilh, LLILH, 0xA5E) /* type = RI_A  LOAD LOGICAL IMMEDIATE (low high)  */ \
   V(llill, LLILL, 0xA5F) /* type = RI_A  LOAD LOGICAL IMMEDIATE (low low)  */  \
   V(tmlh, TMLH, 0xA70)   /* type = RI_A  TEST UNDER MASK (low high)  */        \
-  V(tmh, TMH, 0xA70)     /* type = RI_A  TEST UNDER MASK HIGH  */              \
   V(tmll, TMLL, 0xA71)   /* type = RI_A  TEST UNDER MASK (low low)  */         \
-  V(tml, TML, 0xA71)     /* type = RI_A  TEST UNDER MASK LOW  */               \
   V(tmhh, TMHH, 0xA72)   /* type = RI_A  TEST UNDER MASK (high high)  */       \
   V(tmhl, TMHL, 0xA73)   /* type = RI_A  TEST UNDER MASK (high low)  */        \
   V(lhi, LHI, 0xA78)     /* type = RI_A  LOAD HALFWORD IMMEDIATE (32)<-16  */  \
@@ -1199,7 +1171,6 @@ typedef uint64_t SixByteInstr;
   V(ae, AE, 0x7A)     /* type = RX_A  ADD NORMALIZED (short HFP)  */        \
   V(se, SE, 0x7B)     /* type = RX_A  SUBTRACT NORMALIZED (short HFP)  */   \
   V(mde, MDE, 0x7C)   /* type = RX_A  MULTIPLY (short to long HFP)  */      \
-  V(me, ME, 0x7C)     /* type = RX_A  MULTIPLY (short to long HFP)  */      \
   V(de, DE, 0x7D)     /* type = RX_A  DIVIDE (short HFP)  */                \
   V(au, AU, 0x7E)     /* type = RX_A  ADD UNNORMALIZED (short HFP)  */      \
   V(su, SU, 0x7F)     /* type = RX_A  SUBTRACT UNNORMALIZED (short HFP)  */ \
@@ -1330,11 +1301,6 @@ typedef uint64_t SixByteInstr;
   V(lnxbr, LNXBR, 0xB341) /* type = RRE   LOAD NEGATIVE (extended BFP)  */     \
   V(ltxbr, LTXBR, 0xB342) /* type = RRE   LOAD AND TEST (extended BFP)  */     \
   V(lcxbr, LCXBR, 0xB343) /* type = RRE   LOAD COMPLEMENT (extended BFP)  */   \
-  V(ledbr, LEDBR, 0xB344) /* type = RRE   LOAD ROUNDED (long to short BFP)  */ \
-  V(ldxbr, LDXBR,                                                              \
-    0xB345) /* type = RRE   LOAD ROUNDED (extended to long BFP)  */            \
-  V(lexbr, LEXBR,                                                              \
-    0xB346) /* type = RRE   LOAD ROUNDED (extended to short BFP)  */           \
   V(kxbr, KXBR, 0xB348) /* type = RRE   COMPARE AND SIGNAL (extended BFP)  */  \
   V(cxbr, CXBR, 0xB349) /* type = RRE   COMPARE (extended BFP)  */             \
   V(axbr, AXBR, 0xB34A) /* type = RRE   ADD (extended BFP)  */                 \
@@ -1364,18 +1330,6 @@ typedef uint64_t SixByteInstr;
   V(sfpc, SFPC, 0xB384)   /* type = RRE   SET FPC  */                          \
   V(sfasr, SFASR, 0xB385) /* type = RRE   SET FPC AND SIGNAL  */               \
   V(efpc, EFPC, 0xB38C)   /* type = RRE   EXTRACT FPC  */                      \
-  V(cefbr, CEFBR,                                                              \
-    0xB394) /* type = RRE   CONVERT FROM FIXED (32 to short BFP)  */           \
-  V(cdfbr, CDFBR,                                                              \
-    0xB395) /* type = RRE   CONVERT FROM FIXED (32 to long BFP)  */            \
-  V(cxfbr, CXFBR,                                                              \
-    0xB396) /* type = RRE   CONVERT FROM FIXED (32 to extended BFP)  */        \
-  V(cegbr, CEGBR,                                                              \
-    0xB3A4) /* type = RRE   CONVERT FROM FIXED (64 to short BFP)  */           \
-  V(cdgbr, CDGBR,                                                              \
-    0xB3A5) /* type = RRE   CONVERT FROM FIXED (64 to long BFP)  */            \
-  V(cxgbr, CXGBR,                                                              \
-    0xB3A6) /* type = RRE   CONVERT FROM FIXED (64 to extended BFP)  */        \
   V(cefr, CEFR,                                                                \
     0xB3B4) /* type = RRE   CONVERT FROM FIXED (32 to short HFP)  */           \
   V(cdfr, CDFR, 0xB3B5) /* type = RRE   CONVERT FROM FIXED (32 to long HFP) */ \
@@ -1407,16 +1361,12 @@ typedef uint64_t SixByteInstr;
     0xB3ED) /* type = RRE   EXTRACT BIASED EXPONENT (extended DFP to 64)  */   \
   V(esxtr, ESXTR,                                                              \
     0xB3EF) /* type = RRE   EXTRACT SIGNIFICANCE (extended DFP to 64)  */      \
-  V(cdgtr, CDGTR,                                                              \
-    0xB3F1) /* type = RRE   CONVERT FROM FIXED (64 to long DFP)  */            \
   V(cdutr, CDUTR,                                                              \
     0xB3F2) /* type = RRE   CONVERT FROM UNSIGNED PACKED (64 to long DFP)  */  \
   V(cdstr, CDSTR,                                                              \
     0xB3F3) /* type = RRE   CONVERT FROM SIGNED PACKED (64 to long DFP)  */    \
   V(cedtr, CEDTR,                                                              \
     0xB3F4) /* type = RRE   COMPARE BIASED EXPONENT (long DFP)  */             \
-  V(cxgtr, CXGTR,                                                              \
-    0xB3F9) /* type = RRE   CONVERT FROM FIXED (64 to extended DFP)  */        \
   V(cxutr, CXUTR,                                                              \
     0xB3FA) /* type = RRE   CONVERT FROM UNSIGNED PACKED (128 to ext. DFP)  */ \
   V(cxstr, CXSTR, 0xB3FB) /* type = RRE   CONVERT FROM SIGNED PACKED (128 to*/ \
@@ -1578,7 +1528,6 @@ typedef uint64_t SixByteInstr;
   V(lcdr, LCDR, 0x23)   /* type = RR    LOAD COMPLEMENT (long HFP)  */         \
   V(hdr, HDR, 0x24)     /* type = RR    HALVE (long HFP)  */                   \
   V(ldxr, LDXR, 0x25) /* type = RR    LOAD ROUNDED (extended to long HFP)  */  \
-  V(lrdr, LRDR, 0x25) /* type = RR    LOAD ROUNDED (extended to long HFP)  */  \
   V(mxr, MXR, 0x26)   /* type = RR    MULTIPLY (extended HFP)  */              \
   V(mxdr, MXDR, 0x27) /* type = RR    MULTIPLY (long to extended HFP)  */      \
   V(ldr, LDR, 0x28)   /* type = RR    LOAD (long)  */                          \
@@ -1594,7 +1543,6 @@ typedef uint64_t SixByteInstr;
   V(lcer, LCER, 0x33) /* type = RR    LOAD COMPLEMENT (short HFP)  */          \
   V(her_z, HER_Z, 0x34) /* type = RR    HALVE (short HFP)  */                  \
   V(ledr, LEDR, 0x35)   /* type = RR    LOAD ROUNDED (long to short HFP)  */   \
-  V(lrer, LRER, 0x35)   /* type = RR    LOAD ROUNDED (long to short HFP)  */   \
   V(axr, AXR, 0x36)     /* type = RR    ADD NORMALIZED (extended HFP)  */      \
   V(sxr, SXR, 0x37)     /* type = RR    SUBTRACT NORMALIZED (extended HFP)  */ \
   V(ler, LER, 0x38)     /* type = RR    LOAD (short)  */                       \
@@ -1602,7 +1550,6 @@ typedef uint64_t SixByteInstr;
   V(aer, AER, 0x3A)     /* type = RR    ADD NORMALIZED (short HFP)  */         \
   V(ser, SER, 0x3B)     /* type = RR    SUBTRACT NORMALIZED (short HFP)  */    \
   V(mder, MDER, 0x3C)   /* type = RR    MULTIPLY (short to long HFP)  */       \
-  V(mer, MER, 0x3C)     /* type = RR    MULTIPLY (short to long HFP)  */       \
   V(der, DER, 0x3D)     /* type = RR    DIVIDE (short HFP)  */                 \
   V(aur, AUR, 0x3E)     /* type = RR    ADD UNNORMALIZED (short HFP)  */       \
   V(sur, SUR, 0x3F)     /* type = RR    SUBTRACT UNNORMALIZED (short HFP)  */
diff --git a/deps/v8/src/s390/disasm-s390.cc b/deps/v8/src/s390/disasm-s390.cc
index a26eef69e29554..5acd0e775538d3 100644
--- a/deps/v8/src/s390/disasm-s390.cc
+++ b/deps/v8/src/s390/disasm-s390.cc
@@ -78,9 +78,8 @@ class Decoder {
   void Unknown(Instruction* instr);
   void UnknownFormat(Instruction* instr, const char* opcname);
 
-  bool DecodeTwoByte(Instruction* instr);
-  bool DecodeFourByte(Instruction* instr);
-  bool DecodeSixByte(Instruction* instr);
+  bool DecodeSpecial(Instruction* instr);
+  bool DecodeGeneric(Instruction* instr);
 
   const disasm::NameConverter& converter_;
   Vector<char> out_buffer_;
@@ -143,13 +142,11 @@ int Decoder::FormatRegister(Instruction* instr, const char* format) {
   DCHECK_EQ(format[0], 'r');
 
   if (format[1] == '1') {  // 'r1: register resides in bit 8-11
-    RRInstruction* rrinstr = reinterpret_cast<RRInstruction*>(instr);
-    int reg = rrinstr->R1Value();
+    int reg = instr->Bits<SixByteInstr, int>(39, 36);
     PrintRegister(reg);
     return 2;
   } else if (format[1] == '2') {  // 'r2: register resides in bit 12-15
-    RRInstruction* rrinstr = reinterpret_cast<RRInstruction*>(instr);
-    int reg = rrinstr->R2Value();
+    int reg = instr->Bits<SixByteInstr, int>(35, 32);
     // indicating it is a r0 for displacement, in which case the offset
     // should be 0.
     if (format[2] == 'd') {
@@ -161,28 +158,23 @@ int Decoder::FormatRegister(Instruction* instr, const char* format) {
       return 2;
     }
   } else if (format[1] == '3') {  // 'r3: register resides in bit 16-19
-    RSInstruction* rsinstr = reinterpret_cast<RSInstruction*>(instr);
-    int reg = rsinstr->B2Value();
+    int reg = instr->Bits<SixByteInstr, int>(31, 28);
     PrintRegister(reg);
     return 2;
   } else if (format[1] == '4') {  // 'r4: register resides in bit 20-23
-    RSInstruction* rsinstr = reinterpret_cast<RSInstruction*>(instr);
-    int reg = rsinstr->B2Value();
+    int reg = instr->Bits<SixByteInstr, int>(27, 24);
     PrintRegister(reg);
     return 2;
-  } else if (format[1] == '5') {  // 'r5: register resides in bit 24-28
-    RREInstruction* rreinstr = reinterpret_cast<RREInstruction*>(instr);
-    int reg = rreinstr->R1Value();
+  } else if (format[1] == '5') {  // 'r5: register resides in bit 24-27
+    int reg = instr->Bits<SixByteInstr, int>(23, 20);
     PrintRegister(reg);
     return 2;
-  } else if (format[1] == '6') {  // 'r6: register resides in bit 29-32
-    RREInstruction* rreinstr = reinterpret_cast<RREInstruction*>(instr);
-    int reg = rreinstr->R2Value();
+  } else if (format[1] == '6') {  // 'r6: register resides in bit 28-31
+    int reg = instr->Bits<SixByteInstr, int>(19, 16);
     PrintRegister(reg);
     return 2;
   } else if (format[1] == '7') {  // 'r6: register resides in bit 32-35
-    SSInstruction* ssinstr = reinterpret_cast<SSInstruction*>(instr);
-    int reg = ssinstr->B2Value();
+    int reg = instr->Bits<SixByteInstr, int>(15, 12);
     PrintRegister(reg);
     return 2;
   }
@@ -493,449 +485,120 @@ void Decoder::UnknownFormat(Instruction* instr, const char* name) {
   Format(instr, buffer);
 }
 
-// Disassembles Two Byte S390 Instructions
-// @return true if successfully decoded
-bool Decoder::DecodeTwoByte(Instruction* instr) {
-  // Print the Instruction bits.
-  out_buffer_pos_ += SNPrintF(out_buffer_ + out_buffer_pos_, "%04x           ",
-                              instr->InstructionBits<TwoByteInstr>());
+#undef VERIFY
+#undef STRING_STARTS_WITH
 
+// Handles special cases of instructions;
+// @return true if successfully decoded
+bool Decoder::DecodeSpecial(Instruction* instr) {
   Opcode opcode = instr->S390OpcodeValue();
   switch (opcode) {
-    case AR:
-      Format(instr, "ar\t'r1,'r2");
+    case BKPT:
+      Format(instr, "bkpt");
       break;
-    case SR:
-      Format(instr, "sr\t'r1,'r2");
+    case DUMY:
+      Format(instr, "dumy\t'r1, 'd2 ( 'r2d, 'r3 )");
       break;
-    case MR:
-      Format(instr, "mr\t'r1,'r2");
+    /* RR format */
+    case LDR:
+      Format(instr, "ldr\t'f1,'f2");
       break;
-    case DR:
-      Format(instr, "dr\t'r1,'r2");
+    case BCR:
+      Format(instr, "bcr\t'm1,'r2");
       break;
     case OR:
       Format(instr, "or\t'r1,'r2");
       break;
-    case NR:
-      Format(instr, "nr\t'r1,'r2");
-      break;
-    case XR:
-      Format(instr, "xr\t'r1,'r2");
-      break;
-    case LR:
-      Format(instr, "lr\t'r1,'r2");
-      break;
     case CR:
       Format(instr, "cr\t'r1,'r2");
       break;
-    case CLR:
-      Format(instr, "clr\t'r1,'r2");
-      break;
-    case BCR:
-      Format(instr, "bcr\t'm1,'r2");
-      break;
-    case LTR:
-      Format(instr, "ltr\t'r1,'r2");
-      break;
-    case ALR:
-      Format(instr, "alr\t'r1,'r2");
-      break;
-    case SLR:
-      Format(instr, "slr\t'r1,'r2");
-      break;
-    case LNR:
-      Format(instr, "lnr\t'r1,'r2");
-      break;
-    case LCR:
-      Format(instr, "lcr\t'r1,'r2");
-      break;
-    case BASR:
-      Format(instr, "basr\t'r1,'r2");
-      break;
-    case LDR:
-      Format(instr, "ldr\t'f1,'f2");
-      break;
-    case BKPT:
-      Format(instr, "bkpt");
-      break;
-    case LPR:
-      Format(instr, "lpr\t'r1, 'r2");
-      break;
-    default:
-      return false;
-  }
-  return true;
-}
-
-// Disassembles Four Byte S390 Instructions
-// @return true if successfully decoded
-bool Decoder::DecodeFourByte(Instruction* instr) {
-  // Print the Instruction bits.
-  out_buffer_pos_ += SNPrintF(out_buffer_ + out_buffer_pos_, "%08x       ",
-                              instr->InstructionBits<FourByteInstr>());
-
-  Opcode opcode = instr->S390OpcodeValue();
-  switch (opcode) {
-    case AHI:
-      Format(instr, "ahi\t'r1,'i1");
-      break;
-    case AGHI:
-      Format(instr, "aghi\t'r1,'i1");
-      break;
-    case LHI:
-      Format(instr, "lhi\t'r1,'i1");
-      break;
-    case LGHI:
-      Format(instr, "lghi\t'r1,'i1");
-      break;
-    case MHI:
-      Format(instr, "mhi\t'r1,'i1");
-      break;
-    case MGHI:
-      Format(instr, "mghi\t'r1,'i1");
-      break;
-    case CHI:
-      Format(instr, "chi\t'r1,'i1");
+    case MR:
+      Format(instr, "mr\t'r1,'r2");
       break;
-    case CGHI:
-      Format(instr, "cghi\t'r1,'i1");
+    case HER_Z:
+      Format(instr, "her\t'r1,'r2");
       break;
+    /* RI-b format */
     case BRAS:
       Format(instr, "bras\t'r1,'i1");
       break;
-    case BRC:
-      Format(instr, "brc\t'm1,'i4");
-      break;
-    case BRCT:
-      Format(instr, "brct\t'r1,'i4");
-      break;
-    case BRCTG:
-      Format(instr, "brctg\t'r1,'i4");
-      break;
-    case IIHH:
-      Format(instr, "iihh\t'r1,'i1");
-      break;
-    case IIHL:
-      Format(instr, "iihl\t'r1,'i1");
-      break;
-    case IILH:
-      Format(instr, "iilh\t'r1,'i1");
-      break;
-    case IILL:
-      Format(instr, "iill\t'r1,'i1");
-      break;
-    case OILL:
-      Format(instr, "oill\t'r1,'i1");
-      break;
-    case TMLL:
-      Format(instr, "tmll\t'r1,'i1");
-      break;
-    case STM:
-      Format(instr, "stm\t'r1,'r2,'d1('r3)");
-      break;
-    case LM:
-      Format(instr, "lm\t'r1,'r2,'d1('r3)");
-      break;
-    case CS:
-      Format(instr, "cs\t'r1,'r2,'d1('r3)");
-      break;
-    case SLL:
-      Format(instr, "sll\t'r1,'d1('r3)");
-      break;
-    case SRL:
-      Format(instr, "srl\t'r1,'d1('r3)");
-      break;
-    case SLA:
-      Format(instr, "sla\t'r1,'d1('r3)");
-      break;
-    case SRA:
-      Format(instr, "sra\t'r1,'d1('r3)");
-      break;
-    case SLDL:
-      Format(instr, "sldl\t'r1,'d1('r3)");
-      break;
-    case AGR:
-      Format(instr, "agr\t'r5,'r6");
-      break;
-    case AGFR:
-      Format(instr, "agfr\t'r5,'r6");
-      break;
-    case ARK:
-      Format(instr, "ark\t'r5,'r6,'r3");
-      break;
-    case AGRK:
-      Format(instr, "agrk\t'r5,'r6,'r3");
-      break;
-    case SGR:
-      Format(instr, "sgr\t'r5,'r6");
-      break;
-    case SGFR:
-      Format(instr, "sgfr\t'r5,'r6");
-      break;
-    case SRK:
-      Format(instr, "srk\t'r5,'r6,'r3");
-      break;
-    case SGRK:
-      Format(instr, "sgrk\t'r5,'r6,'r3");
-      break;
-    case NGR:
-      Format(instr, "ngr\t'r5,'r6");
-      break;
-    case NRK:
-      Format(instr, "nrk\t'r5,'r6,'r3");
-      break;
-    case NGRK:
-      Format(instr, "ngrk\t'r5,'r6,'r3");
-      break;
-    case NILL:
-      Format(instr, "nill\t'r1,'i1");
-      break;
-    case NILH:
-      Format(instr, "nilh\t'r1,'i1");
-      break;
-    case OGR:
-      Format(instr, "ogr\t'r5,'r6");
-      break;
-    case ORK:
-      Format(instr, "ork\t'r5,'r6,'r3");
-      break;
-    case OGRK:
-      Format(instr, "ogrk\t'r5,'r6,'r3");
-      break;
-    case XGR:
-      Format(instr, "xgr\t'r5,'r6");
-      break;
-    case XRK:
-      Format(instr, "xrk\t'r5,'r6,'r3");
-      break;
-    case XGRK:
-      Format(instr, "xgrk\t'r5,'r6,'r3");
-      break;
-    case CGFR:
-      Format(instr, "cgfr\t'r5,'r6");
-      break;
-    case CGR:
-      Format(instr, "cgr\t'r5,'r6");
-      break;
-    case CLGR:
-      Format(instr, "clgr\t'r5,'r6");
-      break;
-    case LLGFR:
-      Format(instr, "llgfr\t'r5,'r6");
+    /* RRE format */
+    case MDBR:
+      Format(instr, "mdbr\t'f5,'f6");
       break;
-    case POPCNT_Z:
-      Format(instr, "popcnt\t'r5,'r6");
+    case SDBR:
+      Format(instr, "sdbr\t'f5,'f6");
       break;
-    case LLGCR:
-      Format(instr, "llgcr\t'r5,'r6");
+    case ADBR:
+      Format(instr, "adbr\t'f5,'f6");
       break;
-    case LLCR:
-      Format(instr, "llcr\t'r5,'r6");
+    case CDBR:
+      Format(instr, "cdbr\t'f5,'f6");
       break;
-    case LBR:
-      Format(instr, "lbr\t'r5,'r6");
+    case MEEBR:
+      Format(instr, "meebr\t'f5,'f6");
       break;
-    case LEDBR:
-      Format(instr, "ledbr\t'f5,'f6");
+    case SQDBR:
+      Format(instr, "sqdbr\t'f5,'f6");
       break;
-    case LDEBR:
-      Format(instr, "ldebr\t'f5,'f6");
+    case SQEBR:
+      Format(instr, "sqebr\t'f5,'f6");
       break;
-    case LTGR:
-      Format(instr, "ltgr\t'r5,'r6");
+    case LCDBR:
+      Format(instr, "lcdbr\t'f5,'f6");
       break;
-    case LTDBR:
-      Format(instr, "ltdbr\t'f5,'f6");
+    case LCEBR:
+      Format(instr, "lcebr\t'f5,'f6");
       break;
     case LTEBR:
       Format(instr, "ltebr\t'f5,'f6");
       break;
-    case LRVR:
-      Format(instr, "lrvr\t'r5,'r6");
-      break;
-    case LRVGR:
-      Format(instr, "lrvgr\t'r5,'r6");
-      break;
-    case LGR:
-      Format(instr, "lgr\t'r5,'r6");
-      break;
-    case LGDR:
-      Format(instr, "lgdr\t'r5,'f6");
-      break;
-    case LGFR:
-      Format(instr, "lgfr\t'r5,'r6");
-      break;
-    case LTGFR:
-      Format(instr, "ltgfr\t'r5,'r6");
-      break;
-    case LCGR:
-      Format(instr, "lcgr\t'r5,'r6");
-      break;
-    case MSR:
-      Format(instr, "msr\t'r5,'r6");
-      break;
-    case MSRKC:
-      Format(instr, "msrkc\t'r5,'r6,'r3");
+    case LDEBR:
+      Format(instr, "ldebr\t'f5,'f6");
       break;
-    case LGBR:
-      Format(instr, "lgbr\t'r5,'r6");
+    case CEBR:
+      Format(instr, "cebr\t'f5,'f6");
       break;
-    case LGHR:
-      Format(instr, "lghr\t'r5,'r6");
+    case AEBR:
+      Format(instr, "aebr\t'f5,'f6");
       break;
-    case MSGR:
-      Format(instr, "msgr\t'r5,'r6");
+    case SEBR:
+      Format(instr, "sebr\t'f5,'f6");
       break;
-    case MSGRKC:
-      Format(instr, "msgrkc\t'r5,'r6,'r3");
+    case DEBR:
+      Format(instr, "debr\t'f5,'f6");
       break;
-    case DSGR:
-      Format(instr, "dsgr\t'r5,'r6");
+    case LTDBR:
+      Format(instr, "ltdbr\t'f5,'f6");
       break;
-    case DSGFR:
-      Format(instr, "dsgfr\t'r5,'r6");
+    case LDGR:
+      Format(instr, "ldgr\t'f5,'f6");
       break;
-    case MSGFR:
-      Format(instr, "msgfr\t'r5,'r6");
+    case DDBR:
+      Format(instr, "ddbr\t'f5,'f6");
       break;
     case LZDR:
       Format(instr, "lzdr\t'f5");
       break;
-    case MLR:
-      Format(instr, "mlr\t'r5,'r6");
-      break;
-    case MLGR:
-      Format(instr, "mlgr\t'r5,'r6");
-      break;
-    case ALCR:
-      Format(instr, "alcr\t'r5,'r6");
-      break;
-    case ALGR:
-      Format(instr, "algr\t'r5,'r6");
-      break;
-    case ALRK:
-      Format(instr, "alrk\t'r5,'r6,'r3");
-      break;
-    case ALGRK:
-      Format(instr, "algrk\t'r5,'r6,'r3");
-      break;
-    case SLGR:
-      Format(instr, "slgr\t'r5,'r6");
-      break;
-    case SLBR:
-      Format(instr, "slbr\t'r5,'r6");
-      break;
-    case DLR:
-      Format(instr, "dlr\t'r5,'r6");
-      break;
-    case DLGR:
-      Format(instr, "dlgr\t'r5,'r6");
-      break;
-    case SLRK:
-      Format(instr, "slrk\t'r5,'r6,'r3");
-      break;
-    case SLGRK:
-      Format(instr, "slgrk\t'r5,'r6,'r3");
-      break;
-    case LHR:
-      Format(instr, "lhr\t'r5,'r6");
-      break;
-    case LLHR:
-      Format(instr, "llhr\t'r5,'r6");
-      break;
-    case LLGHR:
-      Format(instr, "llghr\t'r5,'r6");
-      break;
-    case LOCR:
-      Format(instr, "locr\t'r5,'r6,'m2");
-      break;
-    case LOCGR:
-      Format(instr, "locgr\t'r5,'r6,'m2");
-      break;
-    case LNGR:
-      Format(instr, "lngr\t'r5,'r6");
-      break;
-    case A:
-      Format(instr, "a\t'r1,'d1('r2d,'r3)");
-      break;
-    case S:
-      Format(instr, "s\t'r1,'d1('r2d,'r3)");
-      break;
-    case M:
-      Format(instr, "m\t'r1,'d1('r2d,'r3)");
-      break;
-    case D:
-      Format(instr, "d\t'r1,'d1('r2d,'r3)");
-      break;
-    case O:
-      Format(instr, "o\t'r1,'d1('r2d,'r3)");
-      break;
-    case N:
-      Format(instr, "n\t'r1,'d1('r2d,'r3)");
-      break;
-    case L:
-      Format(instr, "l\t'r1,'d1('r2d,'r3)");
-      break;
-    case C:
-      Format(instr, "c\t'r1,'d1('r2d,'r3)");
-      break;
-    case AH:
-      Format(instr, "ah\t'r1,'d1('r2d,'r3)");
-      break;
-    case SH:
-      Format(instr, "sh\t'r1,'d1('r2d,'r3)");
-      break;
-    case MH:
-      Format(instr, "mh\t'r1,'d1('r2d,'r3)");
-      break;
-    case AL:
-      Format(instr, "al\t'r1,'d1('r2d,'r3)");
-      break;
-    case SL:
-      Format(instr, "sl\t'r1,'d1('r2d,'r3)");
-      break;
-    case LA:
-      Format(instr, "la\t'r1,'d1('r2d,'r3)");
-      break;
-    case CH:
-      Format(instr, "ch\t'r1,'d1('r2d,'r3)");
-      break;
-    case CL:
-      Format(instr, "cl\t'r1,'d1('r2d,'r3)");
-      break;
-    case CLI:
-      Format(instr, "cli\t'd1('r3),'i8");
-      break;
-    case TM:
-      Format(instr, "tm\t'd1('r3),'i8");
-      break;
-    case BC:
-      Format(instr, "bc\t'm1,'d1('r2d,'r3)");
-      break;
-    case BCT:
-      Format(instr, "bct\t'r1,'d1('r2d,'r3)");
-      break;
-    case ST:
-      Format(instr, "st\t'r1,'d1('r2d,'r3)");
+    /* RRF-e format */
+    case FIEBRA:
+      Format(instr, "fiebra\t'f5,'m2,'f6,'m3");
       break;
-    case STC:
-      Format(instr, "stc\t'r1,'d1('r2d,'r3)");
+    case FIDBRA:
+      Format(instr, "fidbra\t'f5,'m2,'f6,'m3");
       break;
+    /* RX-a format */
     case IC_z:
       Format(instr, "ic\t'r1,'d1('r2d,'r3)");
       break;
-    case LD:
-      Format(instr, "ld\t'f1,'d1('r2d,'r3)");
+    case AL:
+      Format(instr, "al\t'r1,'d1('r2d,'r3)");
       break;
     case LE:
       Format(instr, "le\t'f1,'d1('r2d,'r3)");
       break;
-    case LDGR:
-      Format(instr, "ldgr\t'f5,'r6");
-      break;
-    case MS:
-      Format(instr, "ms\t'r1,'d1('r2d,'r3)");
+    case LD:
+      Format(instr, "ld\t'f1,'d1('r2d,'r3)");
       break;
     case STE:
       Format(instr, "ste\t'f1,'d1('r2d,'r3)");
@@ -943,570 +606,318 @@ bool Decoder::DecodeFourByte(Instruction* instr) {
     case STD:
       Format(instr, "std\t'f1,'d1('r2d,'r3)");
       break;
-    case CFDBR:
-      Format(instr, "cfdbr\t'r5,'m2,'f6");
-      break;
-    case CDFBR:
-      Format(instr, "cdfbr\t'f5,'m2,'r6");
-      break;
-    case CFEBR:
-      Format(instr, "cfebr\t'r5,'m2,'f6");
-      break;
-    case CEFBR:
-      Format(instr, "cefbr\t'f5,'m2,'r6");
-      break;
-    case CELFBR:
-      Format(instr, "celfbr\t'f5,'m2,'r6");
-      break;
-    case CGEBR:
-      Format(instr, "cgebr\t'r5,'m2,'f6");
-      break;
-    case CGDBR:
-      Format(instr, "cgdbr\t'r5,'m2,'f6");
-      break;
-    case CEGBR:
-      Format(instr, "cegbr\t'f5,'m2,'r6");
-      break;
-    case CDGBR:
-      Format(instr, "cdgbr\t'f5,'m2,'r6");
-      break;
-    case CDLFBR:
-      Format(instr, "cdlfbr\t'f5,'m2,'r6");
-      break;
-    case CDLGBR:
-      Format(instr, "cdlgbr\t'f5,'m2,'r6");
-      break;
-    case CELGBR:
-      Format(instr, "celgbr\t'f5,'m2,'r6");
-      break;
-    case CLFDBR:
-      Format(instr, "clfdbr\t'r5,'m2,'f6");
-      break;
-    case CLFEBR:
-      Format(instr, "clfebr\t'r5,'m2,'f6");
-      break;
-    case CLGEBR:
-      Format(instr, "clgebr\t'r5,'m2,'f6");
-      break;
-    case CLGDBR:
-      Format(instr, "clgdbr\t'r5,'m2,'f6");
-      break;
-    case AEBR:
-      Format(instr, "aebr\t'f5,'f6");
-      break;
-    case SEBR:
-      Format(instr, "sebr\t'f5,'f6");
-      break;
-    case MEEBR:
-      Format(instr, "meebr\t'f5,'f6");
-      break;
-    case DEBR:
-      Format(instr, "debr\t'f5,'f6");
-      break;
-    case ADBR:
-      Format(instr, "adbr\t'f5,'f6");
-      break;
-    case SDBR:
-      Format(instr, "sdbr\t'f5,'f6");
-      break;
-    case MDBR:
-      Format(instr, "mdbr\t'f5,'f6");
-      break;
-    case DDBR:
-      Format(instr, "ddbr\t'f5,'f6");
-      break;
-    case CDBR:
-      Format(instr, "cdbr\t'f5,'f6");
-      break;
-    case CEBR:
-      Format(instr, "cebr\t'f5,'f6");
-      break;
-    case SQDBR:
-      Format(instr, "sqdbr\t'f5,'f6");
-      break;
-    case SQEBR:
-      Format(instr, "sqebr\t'f5,'f6");
-      break;
-    case LCDBR:
-      Format(instr, "lcdbr\t'f5,'f6");
-      break;
-    case LCEBR:
-      Format(instr, "lcebr\t'f5,'f6");
-      break;
-    case STH:
-      Format(instr, "sth\t'r1,'d1('r2d,'r3)");
-      break;
-    case SRDA:
-      Format(instr, "srda\t'r1,'d1('r3)");
-      break;
-    case SRDL:
-      Format(instr, "srdl\t'r1,'d1('r3)");
-      break;
-    case MADBR:
-      Format(instr, "madbr\t'f3,'f5,'f6");
-      break;
-    case MSDBR:
-      Format(instr, "msdbr\t'f3,'f5,'f6");
-      break;
-    case FLOGR:
-      Format(instr, "flogr\t'r5,'r6");
-      break;
-    case FIEBRA:
-      Format(instr, "fiebra\t'f5,'m2,'f6,'m3");
-      break;
-    case FIDBRA:
-      Format(instr, "fidbra\t'f5,'m2,'f6,'m3");
-      break;
+    /* S format */
     // TRAP4 is used in calling to native function. it will not be generated
     // in native code.
-    case TRAP4: {
+    case TRAP4:
       Format(instr, "trap4");
       break;
-    }
-    case LPGR:
-      Format(instr, "lpgr\t'r5,'r6");
-      break;
-    case LPGFR:
-      Format(instr, "lpgfr\t'r5,'r6");
-      break;
-    case BRXH:
-      Format(instr, "brxh\t'r1,'r2,'i4");
-      break;
-    default:
-      return false;
-  }
-  return true;
-}
-
-// Disassembles Six Byte S390 Instructions
-// @return true if successfully decoded
-bool Decoder::DecodeSixByte(Instruction* instr) {
-  // Print the Instruction bits.
-  out_buffer_pos_ +=
-      SNPrintF(out_buffer_ + out_buffer_pos_, "%012" PRIx64 "   ",
-               instr->InstructionBits<SixByteInstr>());
-
-  Opcode opcode = instr->S390OpcodeValue();
-  switch (opcode) {
-    case DUMY:
-      Format(instr, "dumy\t'r1, 'd2 ( 'r2d, 'r3 )");
-      break;
-#define DECODE_VRR_C_INSTRUCTIONS(name, opcode_name, opcode_value) \
-  case opcode_name:                                                \
-    Format(instr, #name "\t'f1,'f2,'f3");                          \
-    break;
-      S390_VRR_C_OPCODE_LIST(DECODE_VRR_C_INSTRUCTIONS)
-#undef DECODE_VRR_C_INSTRUCTIONS
-    case LLILF:
-      Format(instr, "llilf\t'r1,'i7");
-      break;
-    case LLIHF:
-      Format(instr, "llihf\t'r1,'i7");
-      break;
-    case AFI:
-      Format(instr, "afi\t'r1,'i7");
-      break;
-    case AIH:
-      Format(instr, "aih\t'r1,'i7");
-      break;
-    case ASI:
-      Format(instr, "asi\t'd2('r3),'ic");
-      break;
-    case AGSI:
-      Format(instr, "agsi\t'd2('r3),'ic");
-      break;
-    case ALFI:
-      Format(instr, "alfi\t'r1,'i7");
-      break;
-    case AHIK:
-      Format(instr, "ahik\t'r1,'r2,'i1");
-      break;
-    case AGHIK:
-      Format(instr, "aghik\t'r1,'r2,'i1");
-      break;
-    case CLGFI:
-      Format(instr, "clgfi\t'r1,'i7");
-      break;
-    case CLFI:
-      Format(instr, "clfi\t'r1,'i7");
-      break;
-    case CLIH:
-      Format(instr, "clih\t'r1,'i7");
-      break;
-    case CIH:
-      Format(instr, "cih\t'r1,'i2");
-      break;
+    /* RIL-a format */
     case CFI:
       Format(instr, "cfi\t'r1,'i2");
       break;
     case CGFI:
       Format(instr, "cgfi\t'r1,'i2");
       break;
-    case BRASL:
-      Format(instr, "brasl\t'r1,'ie");
-      break;
-    case BRCL:
-      Format(instr, "brcl\t'm1,'i5");
-      break;
-    case IIHF:
-      Format(instr, "iihf\t'r1,'i7");
-      break;
-    case LGFI:
-      Format(instr, "lgfi\t'r1,'i7");
-      break;
-    case IILF:
-      Format(instr, "iilf\t'r1,'i7");
-      break;
-    case XIHF:
-      Format(instr, "xihf\t'r1,'i7");
-      break;
-    case XILF:
-      Format(instr, "xilf\t'r1,'i7");
-      break;
-    case SLLK:
-      Format(instr, "sllk\t'r1,'r2,'d2('r3)");
-      break;
-    case SLLG:
-      Format(instr, "sllg\t'r1,'r2,'d2('r3)");
-      break;
-    case RLL:
-      Format(instr, "rll\t'r1,'r2,'d2('r3)");
-      break;
-    case RLLG:
-      Format(instr, "rllg\t'r1,'r2,'d2('r3)");
-      break;
-    case SRLK:
-      Format(instr, "srlk\t'r1,'r2,'d2('r3)");
-      break;
-    case SRLG:
-      Format(instr, "srlg\t'r1,'r2,'d2('r3)");
-      break;
-    case SLAK:
-      Format(instr, "slak\t'r1,'r2,'d2('r3)");
-      break;
-    case SLAG:
-      Format(instr, "slag\t'r1,'r2,'d2('r3)");
-      break;
-    case SRAK:
-      Format(instr, "srak\t'r1,'r2,'d2('r3)");
-      break;
-    case SRAG:
-      Format(instr, "srag\t'r1,'r2,'d2('r3)");
+    case AFI:
+      Format(instr, "afi\t'r1,'i2");
       break;
-    case RISBG:
-      Format(instr, "risbg\t'r1,'r2,'i9,'ia,'ib");
+    case AGFI:
+      Format(instr, "agfi\t'r1,'i2");
       break;
-    case RISBGN:
-      Format(instr, "risbgn\t'r1,'r2,'i9,'ia,'ib");
+    case MSFI:
+      Format(instr, "msfi\t'r1,'i2");
       break;
-    case LOCG:
-      Format(instr, "locg\t'm2,'r1,'d2('r3)");
+    case MSGFI:
+      Format(instr, "msgfi\t'r1,'i2");
       break;
-    case LOC:
-      Format(instr, "loc\t'm2,'r1,'d2('r3)");
+    case ALSIH:
+      Format(instr, "alsih\t'r1,'i2");
       break;
-    case LMY:
-      Format(instr, "lmy\t'r1,'r2,'d2('r3)");
+    case ALSIHN:
+      Format(instr, "alsihn\t'r1,'i2");
       break;
-    case LMG:
-      Format(instr, "lmg\t'r1,'r2,'d2('r3)");
+    case CIH:
+      Format(instr, "cih\t'r1,'i2");
       break;
-    case CSY:
-      Format(instr, "csy\t'r1,'r2,'d2('r3)");
+    case AIH:
+      Format(instr, "aih\t'r1,'i2");
       break;
-    case CSG:
-      Format(instr, "csg\t'r1,'r2,'d2('r3)");
+    case LGFI:
+      Format(instr, "lgfi\t'r1,'i2");
       break;
-    case STMY:
-      Format(instr, "stmy\t'r1,'r2,'d2('r3)");
+    /* SIY format */
+    case ASI:
+      Format(instr, "asi\t'd2('r3),'ic");
       break;
-    case STMG:
-      Format(instr, "stmg\t'r1,'r2,'d2('r3)");
+    case AGSI:
+      Format(instr, "agsi\t'd2('r3),'ic");
       break;
+    /* RXY-a format */
     case LT:
       Format(instr, "lt\t'r1,'d2('r2d,'r3)");
       break;
-    case LTG:
-      Format(instr, "ltg\t'r1,'d2('r2d,'r3)");
-      break;
-    case ML:
-      Format(instr, "ml\t'r1,'d2('r2d,'r3)");
-      break;
-    case AY:
-      Format(instr, "ay\t'r1,'d2('r2d,'r3)");
-      break;
-    case SY:
-      Format(instr, "sy\t'r1,'d2('r2d,'r3)");
-      break;
-    case NY:
-      Format(instr, "ny\t'r1,'d2('r2d,'r3)");
-      break;
-    case OY:
-      Format(instr, "oy\t'r1,'d2('r2d,'r3)");
-      break;
-    case XY:
-      Format(instr, "xy\t'r1,'d2('r2d,'r3)");
-      break;
-    case CY:
-      Format(instr, "cy\t'r1,'d2('r2d,'r3)");
-      break;
-    case AHY:
-      Format(instr, "ahy\t'r1,'d2('r2d,'r3)");
-      break;
-    case SHY:
-      Format(instr, "shy\t'r1,'d2('r2d,'r3)");
-      break;
-    case LGH:
-      Format(instr, "lgh\t'r1,'d2('r2d,'r3)");
-      break;
-    case AG:
-      Format(instr, "ag\t'r1,'d2('r2d,'r3)");
-      break;
-    case AGF:
-      Format(instr, "agf\t'r1,'d2('r2d,'r3)");
-      break;
-    case SG:
-      Format(instr, "sg\t'r1,'d2('r2d,'r3)");
-      break;
-    case NG:
-      Format(instr, "ng\t'r1,'d2('r2d,'r3)");
-      break;
-    case OG:
-      Format(instr, "og\t'r1,'d2('r2d,'r3)");
-      break;
-    case XG:
-      Format(instr, "xg\t'r1,'d2('r2d,'r3)");
-      break;
-    case CG:
-      Format(instr, "cg\t'r1,'d2('r2d,'r3)");
-      break;
-    case LB:
-      Format(instr, "lb\t'r1,'d2('r2d,'r3)");
-      break;
-    case LRVH:
-      Format(instr, "lrvh\t'r1,'d2('r2d,'r3)");
-      break;
-    case LRV:
-      Format(instr, "lrv\t'r1,'d2('r2d,'r3)");
-      break;
-    case LRVG:
-      Format(instr, "lrvg\t'r1,'d2('r2d,'r3)");
-      break;
-    case LG:
-      Format(instr, "lg\t'r1,'d2('r2d,'r3)");
-      break;
-    case LGF:
-      Format(instr, "lgf\t'r1,'d2('r2d,'r3)");
-      break;
-    case LLGF:
-      Format(instr, "llgf\t'r1,'d2('r2d,'r3)");
-      break;
-    case LY:
-      Format(instr, "ly\t'r1,'d2('r2d,'r3)");
-      break;
-    case ALY:
-      Format(instr, "aly\t'r1,'d2('r2d,'r3)");
-      break;
-    case ALG:
-      Format(instr, "alg\t'r1,'d2('r2d,'r3)");
-      break;
-    case SLG:
-      Format(instr, "slg\t'r1,'d2('r2d,'r3)");
-      break;
-    case SGF:
-      Format(instr, "sgf\t'r1,'d2('r2d,'r3)");
-      break;
-    case SLY:
-      Format(instr, "sly\t'r1,'d2('r2d,'r3)");
-      break;
-    case LLH:
-      Format(instr, "llh\t'r1,'d2('r2d,'r3)");
-      break;
-    case LLGH:
-      Format(instr, "llgh\t'r1,'d2('r2d,'r3)");
-      break;
-    case LLC:
-      Format(instr, "llc\t'r1,'d2('r2d,'r3)");
-      break;
-    case LLGC:
-      Format(instr, "llgc\t'r1,'d2('r2d,'r3)");
-      break;
-    case LDEB:
-      Format(instr, "ldeb\t'f1,'d2('r2d,'r3)");
-      break;
-    case LAY:
-      Format(instr, "lay\t'r1,'d2('r2d,'r3)");
-      break;
-    case LARL:
-      Format(instr, "larl\t'r1,'i5");
-      break;
-    case LGB:
-      Format(instr, "lgb\t'r1,'d2('r2d,'r3)");
-      break;
-    case CHY:
-      Format(instr, "chy\t'r1,'d2('r2d,'r3)");
-      break;
-    case CLY:
-      Format(instr, "cly\t'r1,'d2('r2d,'r3)");
-      break;
-    case CLIY:
-      Format(instr, "cliy\t'd2('r3),'i8");
-      break;
-    case TMY:
-      Format(instr, "tmy\t'd2('r3),'i8");
-      break;
-    case CLG:
-      Format(instr, "clg\t'r1,'d2('r2d,'r3)");
-      break;
-    case BCTG:
-      Format(instr, "bctg\t'r1,'d2('r2d,'r3)");
-      break;
-    case STY:
-      Format(instr, "sty\t'r1,'d2('r2d,'r3)");
-      break;
-    case STRVH:
-      Format(instr, "strvh\t'r1,'d2('r2d,'r3)");
-      break;
-    case STRV:
-      Format(instr, "strv\t'r1,'d2('r2d,'r3)");
-      break;
-    case STRVG:
-      Format(instr, "strvg\t'r1,'d2('r2d,'r3)");
-      break;
-    case STG:
-      Format(instr, "stg\t'r1,'d2('r2d,'r3)");
-      break;
-    case ICY:
-      Format(instr, "icy\t'r1,'d2('r2d,'r3)");
-      break;
-    case MVC:
-      Format(instr, "mvc\t'd3('i8,'r3),'d4('r7)");
-      break;
-    case MVHI:
-      Format(instr, "mvhi\t'd3('r3),'id");
-      break;
-    case MVGHI:
-      Format(instr, "mvghi\t'd3('r3),'id");
-      break;
-    case ALGFI:
-      Format(instr, "algfi\t'r1,'i7");
-      break;
-    case SLGFI:
-      Format(instr, "slgfi\t'r1,'i7");
-      break;
-    case SLFI:
-      Format(instr, "slfi\t'r1,'i7");
-      break;
-    case NIHF:
-      Format(instr, "nihf\t'r1,'i7");
-      break;
-    case NILF:
-      Format(instr, "nilf\t'r1,'i7");
-      break;
-    case OIHF:
-      Format(instr, "oihf\t'r1,'i7");
-      break;
-    case OILF:
-      Format(instr, "oilf\t'r1,'i7");
-      break;
-    case MSFI:
-      Format(instr, "msfi\t'r1,'i7");
-      break;
-    case MSGFI:
-      Format(instr, "msgfi\t'r1,'i7");
-      break;
     case LDY:
       Format(instr, "ldy\t'f1,'d2('r2d,'r3)");
       break;
     case LEY:
       Format(instr, "ley\t'f1,'d2('r2d,'r3)");
       break;
-    case MSG:
-      Format(instr, "msg\t'r1,'d2('r2d,'r3)");
-      break;
-    case DSG:
-      Format(instr, "dsg\t'r1,'d2('r2d,'r3)");
-      break;
-    case DSGF:
-      Format(instr, "dsgf\t'r1,'d2('r2d,'r3)");
-      break;
-    case MSGF:
-      Format(instr, "msgf\t'r1,'d2('r2d,'r3)");
-      break;
-    case MSY:
-      Format(instr, "msy\t'r1,'d2('r2d,'r3)");
-      break;
-    case MSC:
-      Format(instr, "msc\t'r1,'d2('r2d,'r3)");
-      break;
-    case MSGC:
-      Format(instr, "msgc\t'r1,'d2('r2d,'r3)");
+    case STDY:
+      Format(instr, "stdy\t'f1,'d2('r2d,'r3)");
       break;
     case STEY:
       Format(instr, "stey\t'f1,'d2('r2d,'r3)");
       break;
-    case STDY:
-      Format(instr, "stdy\t'f1,'d2('r2d,'r3)");
+    /* RXE format */
+    case LDEB:
+      Format(instr, "ldeb\t'f1,'d2('r2d,'r3)");
       break;
-    case ADB:
-      Format(instr, "adb\t'f1,'d1('r2d, 'r3)");
+    default:
+      return false;
+  }
+  return true;
+}
+
+// Handles common cases of instructions;
+// @return true if successfully decoded
+bool Decoder::DecodeGeneric(Instruction* instr) {
+  Opcode opcode = instr->S390OpcodeValue();
+  switch (opcode) {
+  /* 2 bytes */
+#define DECODE_RR_INSTRUCTIONS(name, opcode_name, opcode_value) \
+  case opcode_name:                                             \
+    Format(instr, #name "\t'r1,'r2");                           \
+    break;
+  S390_RR_OPCODE_LIST(DECODE_RR_INSTRUCTIONS)
+#undef DECODE_RR_INSTRUCTIONS
+
+  /* 4 bytes */
+#define DECODE_RS_A_INSTRUCTIONS(name, opcode_name, opcode_value)  \
+    case opcode_name:                                              \
+      Format(instr, #name "\t'r1,'r2,'d1('r3)");                   \
       break;
-    case AEB:
-      Format(instr, "aeb\t'f1,'d1('r2d, 'r3)");
+  S390_RS_A_OPCODE_LIST(DECODE_RS_A_INSTRUCTIONS)
+#undef DECODE_RS_A_INSTRUCTIONS
+
+#define DECODE_RSI_INSTRUCTIONS(name, opcode_name, opcode_value)   \
+    case opcode_name:                                              \
+      Format(instr, #name "\t'r1,'r2,'i4");                        \
       break;
-    case CDB:
-      Format(instr, "cdb\t'f1,'d1('r2d, 'r3)");
+  S390_RSI_OPCODE_LIST(DECODE_RSI_INSTRUCTIONS)
+#undef DECODE_RSI_INSTRUCTIONS
+
+#define DECODE_RI_A_INSTRUCTIONS(name, opcode_name, opcode_value)  \
+    case opcode_name:                                              \
+      Format(instr, #name "\t'r1,'i1");                            \
       break;
-    case CEB:
-      Format(instr, "ceb\t'f1,'d1('r2d, 'r3)");
+  S390_RI_A_OPCODE_LIST(DECODE_RI_A_INSTRUCTIONS)
+#undef DECODE_RI_A_INSTRUCTIONS
+
+#define DECODE_RI_B_INSTRUCTIONS(name, opcode_name, opcode_value)  \
+    case opcode_name:                                              \
+      Format(instr, #name "\t'r1,'i4");                            \
       break;
-    case SDB:
-      Format(instr, "sdb\t'r1,'d1('r2d, 'r3)");
+  S390_RI_B_OPCODE_LIST(DECODE_RI_B_INSTRUCTIONS)
+#undef DECODE_RI_B_INSTRUCTIONS
+
+#define DECODE_RI_C_INSTRUCTIONS(name, opcode_name, opcode_value)  \
+    case opcode_name:                                              \
+      Format(instr, #name "\t'm1,'i4");                            \
       break;
-    case SEB:
-      Format(instr, "seb\t'r1,'d1('r2d, 'r3)");
+  S390_RI_C_OPCODE_LIST(DECODE_RI_C_INSTRUCTIONS)
+#undef DECODE_RI_C_INSTRUCTIONS
+
+#define DECODE_RRE_INSTRUCTIONS(name, opcode_name, opcode_value)   \
+    case opcode_name:                                              \
+      Format(instr, #name "\t'r5,'r6");                            \
       break;
-    case MDB:
-      Format(instr, "mdb\t'r1,'d1('r2d, 'r3)");
+  S390_RRE_OPCODE_LIST(DECODE_RRE_INSTRUCTIONS)
+#undef DECODE_RRE_INSTRUCTIONS
+
+#define DECODE_RRF_A_INSTRUCTIONS(name, opcode_name, opcode_val)   \
+    case opcode_name:                                              \
+      Format(instr, #name "\t'r5,'r6,'r3");                        \
       break;
-    case MEEB:
-      Format(instr, "meeb\t'r1,'d1('r2d, 'r3)");
+  S390_RRF_A_OPCODE_LIST(DECODE_RRF_A_INSTRUCTIONS)
+#undef DECODE_RRF_A_INSTRUCTIONS
+
+#define DECODE_RRF_C_INSTRUCTIONS(name, opcode_name, opcode_val)   \
+    case opcode_name:                                              \
+      Format(instr, #name "\t'r5,'r6,'m2");                        \
       break;
-    case DDB:
-      Format(instr, "ddb\t'r1,'d1('r2d, 'r3)");
+  S390_RRF_C_OPCODE_LIST(DECODE_RRF_C_INSTRUCTIONS)
+#undef DECODE_RRF_C_INSTRUCTIONS
+
+#define DECODE_RRF_E_INSTRUCTIONS(name, opcode_name, opcode_val)   \
+    case opcode_name:                                              \
+      Format(instr, #name "\t'r5,'m2,'f6");                        \
       break;
-    case DEB:
-      Format(instr, "deb\t'r1,'d1('r2d, 'r3)");
+  S390_RRF_E_OPCODE_LIST(DECODE_RRF_E_INSTRUCTIONS)
+#undef DECODE_RRF_E_INSTRUCTIONS
+
+#define DECODE_RX_A_INSTRUCTIONS(name, opcode_name, opcode_value)  \
+    case opcode_name:                                              \
+      Format(instr, #name "\t'r1,'d1('r2d,'r3)");                  \
       break;
-    case SQDB:
-      Format(instr, "sqdb\t'r1,'d1('r2d, 'r3)");
+  S390_RX_A_OPCODE_LIST(DECODE_RX_A_INSTRUCTIONS)
+#undef DECODE_RX_A_INSTRUCTIONS
+
+#define DECODE_RX_B_INSTRUCTIONS(name, opcode_name, opcode_value)  \
+    case opcode_name:                                              \
+      Format(instr, #name "\t'm1,'d1('r2d,'r3)");                  \
       break;
-    case PFD:
-      Format(instr, "pfd\t'm1,'d2('r2d,'r3)");
+  S390_RX_B_OPCODE_LIST(DECODE_RX_B_INSTRUCTIONS)
+#undef DECODE_RX_B_INSTRUCTIONS
+
+#define DECODE_RRD_INSTRUCTIONS(name, opcode_name, opcode_value)   \
+    case opcode_name:                                              \
+      Format(instr, #name "\t'f3,'f5,'f6");                        \
       break;
-    case BRXHG:
-      Format(instr, "brxhg\t'r1,'r2,'i4");
+  S390_RRD_OPCODE_LIST(DECODE_RRD_INSTRUCTIONS)
+#undef DECODE_RRD_INSTRUCTIONS
+
+#define DECODE_SI_INSTRUCTIONS(name, opcode_name, opcode_value)    \
+    case opcode_name:                                              \
+      Format(instr, #name "\t'd1('r3),'i8");                       \
       break;
+  S390_SI_OPCODE_LIST(DECODE_SI_INSTRUCTIONS)
+#undef DECODE_SI_INSTRUCTIONS
+
+  /* 6 bytes */
+#define DECODE_VRR_C_INSTRUCTIONS(name, opcode_name, opcode_value) \
+  case opcode_name:                                                \
+    Format(instr, #name "\t'f1,'f2,'f3");                          \
+    break;
+  S390_VRR_C_OPCODE_LIST(DECODE_VRR_C_INSTRUCTIONS)
+#undef DECODE_VRR_C_INSTRUCTIONS
+
+#define DECODE_RIL_A_INSTRUCTIONS(name, opcode_name, opcode_value) \
+  case opcode_name:                                                \
+    Format(instr, #name "\t'r1,'i7");                              \
+    break;
+  S390_RIL_A_OPCODE_LIST(DECODE_RIL_A_INSTRUCTIONS)
+#undef DECODE_RIL_A_INSTRUCTIONS
+
+#define DECODE_RIL_B_INSTRUCTIONS(name, opcode_name, opcode_value) \
+  case opcode_name:                                                \
+    Format(instr, #name "\t'r1,'ie");                              \
+    break;
+  S390_RIL_B_OPCODE_LIST(DECODE_RIL_B_INSTRUCTIONS)
+#undef DECODE_RIL_B_INSTRUCTIONS
+
+#define DECODE_RIL_C_INSTRUCTIONS(name, opcode_name, opcode_value) \
+  case opcode_name:                                                \
+    Format(instr, #name "\t'm1,'ie");                              \
+    break;
+  S390_RIL_C_OPCODE_LIST(DECODE_RIL_C_INSTRUCTIONS)
+#undef DECODE_RIL_C_INSTRUCTIONS
+
+#define DECODE_SIY_INSTRUCTIONS(name, opcode_name, opcode_value)   \
+  case opcode_name:                                                \
+    Format(instr, #name "\t'd2('r3),'i8");                         \
+    break;
+  S390_SIY_OPCODE_LIST(DECODE_SIY_INSTRUCTIONS)
+#undef DECODE_SIY_INSTRUCTIONS
+
+#define DECODE_RIE_D_INSTRUCTIONS(name, opcode_name, opcode_value) \
+  case opcode_name:                                                \
+    Format(instr, #name "\t'r1,'r2,'i1");                          \
+    break;
+  S390_RIE_D_OPCODE_LIST(DECODE_RIE_D_INSTRUCTIONS)
+#undef DECODE_RIE_D_INSTRUCTIONS
+
+#define DECODE_RIE_E_INSTRUCTIONS(name, opcode_name, opcode_value) \
+  case opcode_name:                                                \
+    Format(instr, #name "\t'r1,'r2,'i4");                          \
+    break;
+  S390_RIE_E_OPCODE_LIST(DECODE_RIE_E_INSTRUCTIONS)
+#undef DECODE_RIE_E_INSTRUCTIONS
+
+#define DECODE_RIE_F_INSTRUCTIONS(name, opcode_name, opcode_value) \
+  case opcode_name:                                                \
+    Format(instr, #name "\t'r1,'r2,'i9,'ia,'ib");                  \
+    break;
+  S390_RIE_F_OPCODE_LIST(DECODE_RIE_F_INSTRUCTIONS)
+#undef DECODE_RIE_F_INSTRUCTIONS
+
+#define DECODE_RSY_A_INSTRUCTIONS(name, opcode_name, opcode_value) \
+  case opcode_name:                                                \
+    Format(instr, #name "\t'r1,'r2,'d2('r3)");                     \
+    break;
+  S390_RSY_A_OPCODE_LIST(DECODE_RSY_A_INSTRUCTIONS)
+#undef DECODE_RSY_A_INSTRUCTIONS
+
+#define DECODE_RSY_B_INSTRUCTIONS(name, opcode_name, opcode_value) \
+  case opcode_name:                                                \
+    Format(instr, #name "\t'm2,'r1,'d2('r3)");                     \
+    break;
+  S390_RSY_B_OPCODE_LIST(DECODE_RSY_B_INSTRUCTIONS)
+#undef DECODE_RSY_B_INSTRUCTIONS
+
+#define DECODE_RXY_A_INSTRUCTIONS(name, opcode_name, opcode_value) \
+  case opcode_name:                                                \
+    Format(instr, #name "\t'r1,'d2('r2d,'r3)");                    \
+    break;
+  S390_RXY_A_OPCODE_LIST(DECODE_RXY_A_INSTRUCTIONS)
+#undef DECODE_RXY_A_INSTRUCTIONS
+
+#define DECODE_RXY_B_INSTRUCTIONS(name, opcode_name, opcode_value) \
+  case opcode_name:                                                \
+    Format(instr, #name "\t'm1,'d2('r2d,'r3)");                    \
+    break;
+  S390_RXY_B_OPCODE_LIST(DECODE_RXY_B_INSTRUCTIONS)
+#undef DECODE_RXY_B_INSTRUCTIONS
+
+#define DECODE_RXE_INSTRUCTIONS(name, opcode_name, opcode_value)   \
+  case opcode_name:                                                \
+    Format(instr, #name "\t'f1,'d1('r2d, 'r3)");                   \
+    break;
+  S390_RXE_OPCODE_LIST(DECODE_RXE_INSTRUCTIONS)
+#undef DECODE_RXE_INSTRUCTIONS
+
+#define DECODE_SIL_INSTRUCTIONS(name, opcode_name, opcode_value)   \
+  case opcode_name:                                                \
+    Format(instr, #name "\t'd3('r3),'id");                         \
+    break;
+  S390_SIL_OPCODE_LIST(DECODE_SIL_INSTRUCTIONS)
+#undef DECODE_SIL_INSTRUCTIONS
+
+#define DECODE_SS_A_INSTRUCTIONS(name, opcode_name, opcode_value)  \
+  case opcode_name:                                                \
+    Format(instr, #name "\t'd3('i8,'r3),'d4('r7)");                \
+    break;
+  S390_SS_A_OPCODE_LIST(DECODE_SS_A_INSTRUCTIONS)
+#undef DECODE_SS_A_INSTRUCTIONS
+
     default:
       return false;
   }
   return true;
 }
 
-#undef VERIFIY
-
 // Disassemble the instruction at *instr_ptr into the output buffer.
 int Decoder::InstructionDecode(byte* instr_ptr) {
   Instruction* instr = Instruction::At(instr_ptr);
   int instrLength = instr->InstructionLength();
 
-  if (2 == instrLength)
-    DecodeTwoByte(instr);
-  else if (4 == instrLength)
-    DecodeFourByte(instr);
-  else
-    DecodeSixByte(instr);
+  // Print the Instruction bits.
+  if (instrLength == 2) {
+    out_buffer_pos_ += SNPrintF(out_buffer_ + out_buffer_pos_,
+                  "%04x           ", instr->InstructionBits<TwoByteInstr>());
+  } else if (instrLength == 4) {
+    out_buffer_pos_ += SNPrintF(out_buffer_ + out_buffer_pos_,
+                  "%08x       ", instr->InstructionBits<FourByteInstr>());
+  } else {
+    out_buffer_pos_ += SNPrintF(out_buffer_ + out_buffer_pos_,
+                  "%012" PRIx64 "   ", instr->InstructionBits<SixByteInstr>());
+  }
 
+  bool decoded = DecodeSpecial(instr);
+  if (!decoded)
+    decoded = DecodeGeneric(instr);
+  if (!decoded)
+    Unknown(instr);
   return instrLength;
 }
 
diff --git a/deps/v8/src/s390/simulator-s390.cc b/deps/v8/src/s390/simulator-s390.cc
index 147519deb29e1b..0fec28b69e5ab8 100644
--- a/deps/v8/src/s390/simulator-s390.cc
+++ b/deps/v8/src/s390/simulator-s390.cc
@@ -998,8 +998,6 @@ void Simulator::EvalTableInit() {
   EvalTable[STFPC] = &Simulator::Evaluate_STFPC;
   EvalTable[LFPC] = &Simulator::Evaluate_LFPC;
   EvalTable[TRE] = &Simulator::Evaluate_TRE;
-  EvalTable[CUUTF] = &Simulator::Evaluate_CUUTF;
-  EvalTable[CUTFU] = &Simulator::Evaluate_CUTFU;
   EvalTable[STFLE] = &Simulator::Evaluate_STFLE;
   EvalTable[SRNMB] = &Simulator::Evaluate_SRNMB;
   EvalTable[SRNMT] = &Simulator::Evaluate_SRNMT;
@@ -1105,7 +1103,6 @@ void Simulator::EvalTableInit() {
   EvalTable[CGDR] = &Simulator::Evaluate_CGDR;
   EvalTable[CGXR] = &Simulator::Evaluate_CGXR;
   EvalTable[LGDR] = &Simulator::Evaluate_LGDR;
-  EvalTable[MDTR] = &Simulator::Evaluate_MDTR;
   EvalTable[MDTRA] = &Simulator::Evaluate_MDTRA;
   EvalTable[DDTRA] = &Simulator::Evaluate_DDTRA;
   EvalTable[ADTRA] = &Simulator::Evaluate_ADTRA;
@@ -5291,18 +5288,6 @@ EVALUATE(TRE) {
   return 0;
 }
 
-EVALUATE(CUUTF) {
-  UNIMPLEMENTED();
-  USE(instr);
-  return 0;
-}
-
-EVALUATE(CUTFU) {
-  UNIMPLEMENTED();
-  USE(instr);
-  return 0;
-}
-
 EVALUATE(STFLE) {
   UNIMPLEMENTED();
   USE(instr);
@@ -6412,12 +6397,6 @@ EVALUATE(LGDR) {
   return length;
 }
 
-EVALUATE(MDTR) {
-  UNIMPLEMENTED();
-  USE(instr);
-  return 0;
-}
-
 EVALUATE(MDTRA) {
   UNIMPLEMENTED();
   USE(instr);
diff --git a/deps/v8/src/signature.h b/deps/v8/src/signature.h
index 1c84703147f4f3..60950a93bb591f 100644
--- a/deps/v8/src/signature.h
+++ b/deps/v8/src/signature.h
@@ -5,6 +5,7 @@
 #ifndef V8_SIGNATURE_H_
 #define V8_SIGNATURE_H_
 
+#include "src/base/functional.h"
 #include "src/base/iterator.h"
 #include "src/machine-type.h"
 #include "src/zone/zone.h"
@@ -46,16 +47,13 @@ class Signature : public ZoneObject {
     return {reps_, reps_ + return_count_ + parameter_count_};
   }
 
-  bool Equals(const Signature* that) const {
-    if (this == that) return true;
-    if (this->parameter_count() != that->parameter_count()) return false;
-    if (this->return_count() != that->return_count()) return false;
-    size_t size = this->return_count() + this->parameter_count();
-    for (size_t i = 0; i < size; i++) {
-      if (this->reps_[i] != that->reps_[i]) return false;
-    }
-    return true;
+  bool operator==(const Signature& other) const {
+    if (this == &other) return true;
+    if (parameter_count() != other.parameter_count()) return false;
+    if (return_count() != other.return_count()) return false;
+    return std::equal(all().begin(), all().end(), other.all().begin());
   }
+  bool operator!=(const Signature& other) const { return !(*this == other); }
 
   // For incrementally building signatures.
   class Builder {
@@ -101,6 +99,13 @@ class Signature : public ZoneObject {
 
 typedef Signature<MachineType> MachineSignature;
 
+template <typename T>
+size_t hash_value(const Signature<T>& sig) {
+  size_t hash = base::hash_combine(sig.parameter_count(), sig.return_count());
+  for (const T& t : sig.all()) hash = base::hash_combine(hash, t);
+  return hash;
+}
+
 }  // namespace internal
 }  // namespace v8
 
diff --git a/deps/v8/src/snapshot/deserializer.cc b/deps/v8/src/snapshot/deserializer.cc
index 735fa9a7ad1bac..ee4a2d116e6b03 100644
--- a/deps/v8/src/snapshot/deserializer.cc
+++ b/deps/v8/src/snapshot/deserializer.cc
@@ -45,7 +45,7 @@ bool Deserializer<AllocatorT>::IsLazyDeserializationEnabled() const {
 template <class AllocatorT>
 void Deserializer<AllocatorT>::Rehash() {
   DCHECK(can_rehash() || deserializing_user_code());
-  for (const auto& item : to_rehash_) item->RehashBasedOnMap();
+  for (const auto& item : to_rehash_) item->RehashBasedOnMap(isolate());
 }
 
 template <class AllocatorT>
@@ -206,7 +206,7 @@ HeapObject* Deserializer<AllocatorT>::PostProcessNewObject(HeapObject* obj,
     if (obj->map() == ReadOnlyRoots(isolate_).native_source_string_map()) {
       ExternalOneByteString* string = ExternalOneByteString::cast(obj);
       DCHECK(string->is_short());
-      string->set_resource(
+      string->SetResource(
           NativesExternalStringResource::DecodeForDeserialization(
               string->resource()));
     } else {
@@ -215,6 +215,8 @@ HeapObject* Deserializer<AllocatorT>::PostProcessNewObject(HeapObject* obj,
       Address address =
           static_cast<Address>(isolate_->api_external_references()[index]);
       string->set_address_as_resource(address);
+      isolate_->heap()->UpdateExternalString(string, 0,
+                                             string->ExternalPayloadSize());
     }
     isolate_->heap()->RegisterExternalString(String::cast(obj));
   } else if (obj->IsJSTypedArray()) {
diff --git a/deps/v8/src/snapshot/serializer.cc b/deps/v8/src/snapshot/serializer.cc
index 17ddfc27374424..67644b83f348d3 100644
--- a/deps/v8/src/snapshot/serializer.cc
+++ b/deps/v8/src/snapshot/serializer.cc
@@ -142,7 +142,7 @@ void Serializer<AllocatorT>::VisitRootPointers(Root root,
 template <class AllocatorT>
 void Serializer<AllocatorT>::PrintStack() {
   for (const auto o : stack_) {
-    o->Print(isolate());
+    o->Print();
     PrintF("\n");
   }
 }
diff --git a/deps/v8/src/snapshot/startup-serializer.cc b/deps/v8/src/snapshot/startup-serializer.cc
index 2d606dc2e41b06..5434dc9d4721c4 100644
--- a/deps/v8/src/snapshot/startup-serializer.cc
+++ b/deps/v8/src/snapshot/startup-serializer.cc
@@ -197,7 +197,7 @@ void SerializedHandleChecker::VisitRootPointers(Root root,
     if (serialized_.find(*p) != serialized_.end()) continue;
     PrintF("%s handle not serialized: ",
            root == Root::kGlobalHandles ? "global" : "eternal");
-    (*p)->Print(isolate_);
+    (*p)->Print();
     ok_ = false;
   }
 }
diff --git a/deps/v8/src/transitions-inl.h b/deps/v8/src/transitions-inl.h
index 8e0396cd93b5e3..86bcd661285568 100644
--- a/deps/v8/src/transitions-inl.h
+++ b/deps/v8/src/transitions-inl.h
@@ -89,9 +89,8 @@ HeapObjectReference** TransitionArray::GetTargetSlot(int transition_number) {
 }
 
 // static
-PropertyDetails TransitionsAccessor::GetTargetDetails(Isolate* isolate,
-                                                      Name* name, Map* target) {
-  DCHECK(!IsSpecialTransition(isolate, name));
+PropertyDetails TransitionsAccessor::GetTargetDetails(Name* name, Map* target) {
+  DCHECK(!IsSpecialTransition(name->GetReadOnlyRoots(), name));
   int descriptor = target->LastAdded();
   DescriptorArray* descriptors = target->instance_descriptors();
   // Transitions are allowed only for the last added property.
@@ -148,8 +147,8 @@ bool TransitionArray::GetTargetIfExists(int transition_number, Isolate* isolate,
 
 int TransitionArray::SearchName(Name* name, int* out_insertion_index) {
   DCHECK(name->IsUniqueName());
-  return internal::Search<ALL_ENTRIES>(
-      GetIsolate(), this, name, number_of_entries(), out_insertion_index);
+  return internal::Search<ALL_ENTRIES>(this, name, number_of_entries(),
+                                       out_insertion_index);
 }
 
 int TransitionArray::number_of_transitions() const {
diff --git a/deps/v8/src/transitions.cc b/deps/v8/src/transitions.cc
index fcecf6965892f2..cf1ae4853b3f9a 100644
--- a/deps/v8/src/transitions.cc
+++ b/deps/v8/src/transitions.cc
@@ -79,9 +79,9 @@ void TransitionsAccessor::Insert(Handle<Name> name, Handle<Map> target,
   if (simple_transition != nullptr) {
     Name* key = GetSimpleTransitionKey(simple_transition);
     PropertyDetails old_details = GetSimpleTargetDetails(simple_transition);
-    PropertyDetails new_details =
-        is_special_transition ? PropertyDetails::Empty()
-                              : GetTargetDetails(isolate_, *name, *target);
+    PropertyDetails new_details = is_special_transition
+                                      ? PropertyDetails::Empty()
+                                      : GetTargetDetails(*name, *target);
     if (flag == SIMPLE_PROPERTY_TRANSITION && key->Equals(*name) &&
         old_details.kind() == new_details.kind() &&
         old_details.attributes() == new_details.attributes()) {
@@ -116,10 +116,11 @@ void TransitionsAccessor::Insert(Handle<Name> name, Handle<Map> target,
   int number_of_transitions = 0;
   int new_nof = 0;
   int insertion_index = kNotFound;
-  DCHECK_EQ(is_special_transition, IsSpecialTransition(isolate_, *name));
+  DCHECK_EQ(is_special_transition,
+            IsSpecialTransition(ReadOnlyRoots(isolate_), *name));
   PropertyDetails details = is_special_transition
                                 ? PropertyDetails::Empty()
-                                : GetTargetDetails(isolate_, *name, *target);
+                                : GetTargetDetails(*name, *target);
 
   {
     DisallowHeapAllocation no_gc;
@@ -151,7 +152,7 @@ void TransitionsAccessor::Insert(Handle<Name> name, Handle<Map> target,
       }
       array->SetKey(index, *name);
       array->SetRawTarget(index, HeapObjectReference::Weak(*target));
-      SLOW_DCHECK(array->IsSortedNoDuplicates(isolate_));
+      SLOW_DCHECK(array->IsSortedNoDuplicates());
       return;
     }
   }
@@ -202,7 +203,7 @@ void TransitionsAccessor::Insert(Handle<Name> name, Handle<Map> target,
     result->Set(i + 1, array->GetKey(i), array->GetRawTarget(i));
   }
 
-  SLOW_DCHECK(result->IsSortedNoDuplicates(isolate_));
+  SLOW_DCHECK(result->IsSortedNoDuplicates());
   ReplaceTransitions(MaybeObject::FromObject(*result));
 }
 
@@ -235,9 +236,8 @@ Map* TransitionsAccessor::SearchSpecial(Symbol* name) {
 }
 
 // static
-bool TransitionsAccessor::IsSpecialTransition(Isolate* isolate, Name* name) {
+bool TransitionsAccessor::IsSpecialTransition(ReadOnlyRoots roots, Name* name) {
   if (!name->IsSymbol()) return false;
-  ReadOnlyRoots roots(isolate);
   return name == roots.nonextensible_symbol() ||
          name == roots.sealed_symbol() || name == roots.frozen_symbol() ||
          name == roots.elements_transition_symbol() ||
@@ -540,10 +540,10 @@ void TransitionsAccessor::CheckNewTransitionsAreConsistent(
     if (target->instance_descriptors() == map_->instance_descriptors()) {
       Name* key = old_transitions->GetKey(i);
       int new_target_index;
-      if (IsSpecialTransition(isolate_, key)) {
+      if (IsSpecialTransition(ReadOnlyRoots(isolate_), key)) {
         new_target_index = new_transitions->SearchSpecial(Symbol::cast(key));
       } else {
-        PropertyDetails details = GetTargetDetails(isolate_, key, target);
+        PropertyDetails details = GetTargetDetails(key, target);
         new_target_index = new_transitions->Search(isolate_, details.kind(),
                                                    key, details.attributes());
       }
@@ -567,7 +567,7 @@ int TransitionArray::SearchDetails(Isolate* isolate, int transition,
        transition++) {
     Map* target = GetTarget(transition);
     PropertyDetails target_details =
-        TransitionsAccessor::GetTargetDetails(isolate, key, target);
+        TransitionsAccessor::GetTargetDetails(key, target);
 
     int cmp = CompareDetails(kind, attributes, target_details.kind(),
                              target_details.attributes());
@@ -599,10 +599,11 @@ void TransitionArray::Sort(Isolate* isolate) {
     MaybeObject* target = GetRawTarget(i);
     PropertyKind kind = kData;
     PropertyAttributes attributes = NONE;
-    if (!TransitionsAccessor::IsSpecialTransition(isolate, key)) {
+    if (!TransitionsAccessor::IsSpecialTransition(ReadOnlyRoots(isolate),
+                                                  key)) {
       Map* target_map = TransitionsAccessor::GetTargetFromRaw(target);
       PropertyDetails details =
-          TransitionsAccessor::GetTargetDetails(isolate, key, target_map);
+          TransitionsAccessor::GetTargetDetails(key, target_map);
       kind = details.kind();
       attributes = details.attributes();
     }
@@ -612,11 +613,12 @@ void TransitionArray::Sort(Isolate* isolate) {
       MaybeObject* temp_target = GetRawTarget(j);
       PropertyKind temp_kind = kData;
       PropertyAttributes temp_attributes = NONE;
-      if (!TransitionsAccessor::IsSpecialTransition(isolate, temp_key)) {
+      if (!TransitionsAccessor::IsSpecialTransition(ReadOnlyRoots(isolate),
+                                                    temp_key)) {
         Map* temp_target_map =
             TransitionsAccessor::GetTargetFromRaw(temp_target);
-        PropertyDetails details = TransitionsAccessor::GetTargetDetails(
-            isolate, temp_key, temp_target_map);
+        PropertyDetails details =
+            TransitionsAccessor::GetTargetDetails(temp_key, temp_target_map);
         temp_kind = details.kind();
         temp_attributes = details.attributes();
       }
@@ -633,7 +635,7 @@ void TransitionArray::Sort(Isolate* isolate) {
     SetKey(j + 1, key);
     SetRawTarget(j + 1, target);
   }
-  DCHECK(IsSortedNoDuplicates(isolate));
+  DCHECK(IsSortedNoDuplicates());
 }
 
 }  // namespace internal
diff --git a/deps/v8/src/transitions.h b/deps/v8/src/transitions.h
index bd0d91336322e4..542d5ba403f15f 100644
--- a/deps/v8/src/transitions.h
+++ b/deps/v8/src/transitions.h
@@ -59,7 +59,7 @@ class TransitionsAccessor {
   Map* SearchSpecial(Symbol* name);
   // Returns true for non-property transitions like elements kind, or
   // or frozen/sealed transitions.
-  static bool IsSpecialTransition(Isolate* isolate, Name* name);
+  static bool IsSpecialTransition(ReadOnlyRoots roots, Name* name);
 
   enum RequestedLocation { kAnyLocation, kFieldOnly };
   MaybeHandle<Map> FindTransitionToDataProperty(
@@ -80,8 +80,7 @@ class TransitionsAccessor {
   bool CanHaveMoreTransitions();
   inline Name* GetKey(int transition_number);
   inline Map* GetTarget(int transition_number);
-  static inline PropertyDetails GetTargetDetails(Isolate* isolate, Name* name,
-                                                 Map* target);
+  static inline PropertyDetails GetTargetDetails(Name* name, Map* target);
 
   static bool IsMatchingMap(Map* target, Name* name, PropertyKind kind,
                             PropertyAttributes attributes);
@@ -109,8 +108,7 @@ class TransitionsAccessor {
 
 #if DEBUG || OBJECT_PRINT
   void PrintTransitions(std::ostream& os);
-  static void PrintOneTransition(Isolate* isolate, std::ostream& os, Name* key,
-                                 Map* target);
+  static void PrintOneTransition(std::ostream& os, Name* key, Map* target);
   void PrintTransitionTree();
   void PrintTransitionTree(std::ostream& os, int level,
                            DisallowHeapAllocation* no_gc);
@@ -119,7 +117,7 @@ class TransitionsAccessor {
   void CheckNewTransitionsAreConsistent(TransitionArray* old_transitions,
                                         Object* transitions);
   bool IsConsistentWithBackPointers();
-  bool IsSortedNoDuplicates(Isolate* isolate);
+  bool IsSortedNoDuplicates();
 #endif
 
  protected:
@@ -232,14 +230,14 @@ class TransitionArray : public WeakFixedArray {
   int GetSortedKeyIndex(int transition_number) { return transition_number; }
   inline int number_of_entries() const { return number_of_transitions(); }
 #ifdef DEBUG
-  bool IsSortedNoDuplicates(Isolate* isolate, int valid_entries = -1);
+  bool IsSortedNoDuplicates(int valid_entries = -1);
 #endif
 
   void Sort(Isolate* isolate);
 
-  void PrintInternal(Isolate* isolate, std::ostream& os);
+  void PrintInternal(std::ostream& os);
 
-  DECL_PRINTER_WITH_ISOLATE(TransitionArray)
+  DECL_PRINTER(TransitionArray)
   DECL_VERIFIER(TransitionArray)
 
   // Layout for full transition arrays.
diff --git a/deps/v8/src/value-serializer.cc b/deps/v8/src/value-serializer.cc
index 79ad64e66d9a4b..5d894a41304f92 100644
--- a/deps/v8/src/value-serializer.cc
+++ b/deps/v8/src/value-serializer.cc
@@ -2035,7 +2035,8 @@ MaybeHandle<JSReceiver> ValueDeserializer::GetObjectWithID(uint32_t id) {
 void ValueDeserializer::AddObjectWithID(uint32_t id,
                                         Handle<JSReceiver> object) {
   DCHECK(!HasObjectWithID(id));
-  Handle<FixedArray> new_array = FixedArray::SetAndGrow(id_map_, id, object);
+  Handle<FixedArray> new_array =
+      FixedArray::SetAndGrow(isolate_, id_map_, id, object);
 
   // If the dictionary was reallocated, update the global handle.
   if (!new_array.is_identical_to(id_map_)) {
diff --git a/deps/v8/src/vector.h b/deps/v8/src/vector.h
index 355fc8082948a0..b8f10133b54ac6 100644
--- a/deps/v8/src/vector.h
+++ b/deps/v8/src/vector.h
@@ -123,11 +123,18 @@ class Vector {
     length_ = 0;
   }
 
-  inline Vector<T> operator+(size_t offset) {
+  Vector<T> operator+(size_t offset) {
     DCHECK_LE(offset, length_);
     return Vector<T>(start_ + offset, length_ - offset);
   }
 
+  Vector<T> operator+=(size_t offset) {
+    DCHECK_LE(offset, length_);
+    start_ += offset;
+    length_ -= offset;
+    return *this;
+  }
+
   // Implicit conversion from Vector<T> to Vector<const T>.
   inline operator Vector<const T>() { return Vector<const T>::cast(*this); }
 
diff --git a/deps/v8/src/wasm/function-compiler.cc b/deps/v8/src/wasm/function-compiler.cc
index 0009ed3bc1ac61..0cec3991b7532e 100644
--- a/deps/v8/src/wasm/function-compiler.cc
+++ b/deps/v8/src/wasm/function-compiler.cc
@@ -54,6 +54,10 @@ WasmCompilationUnit::WasmCompilationUnit(Isolate* isolate, ModuleEnv* env,
   //    1) asm-specific opcodes are not implemented, and
   //    2) tier-up does not work with lazy compilation.
   if (env->module->origin == kAsmJsOrigin) mode = CompilationMode::kTurbofan;
+  if (V8_UNLIKELY(FLAG_wasm_tier_mask_for_testing) && index < 32 &&
+      (FLAG_wasm_tier_mask_for_testing & (1 << index))) {
+    mode = CompilationMode::kTurbofan;
+  }
   SwitchMode(mode);
 }
 
diff --git a/deps/v8/src/wasm/module-compiler.cc b/deps/v8/src/wasm/module-compiler.cc
index 0c58672f82b067..632d9e101fdda3 100644
--- a/deps/v8/src/wasm/module-compiler.cc
+++ b/deps/v8/src/wasm/module-compiler.cc
@@ -179,29 +179,23 @@ class JSToWasmWrapperCache {
     const wasm::WasmModule* module = native_module->module();
     const wasm::WasmFunction* func = &module->functions[func_index];
     bool is_import = func_index < module->num_imported_functions;
-    auto& cache = cache_[is_import ? 1 : 0];
-    int cached_idx = cache.sig_map.Find(func->sig);
-    if (cached_idx >= 0) return cache.code_cache[cached_idx];
+    std::pair<bool, wasm::FunctionSig> key(is_import, *func->sig);
+    Handle<Code>& cached = cache_[key];
+    if (!cached.is_null()) return cached;
 
     Handle<Code> code =
         compiler::CompileJSToWasmWrapper(isolate, native_module, func->sig,
                                          is_import, use_trap_handler)
             .ToHandleChecked();
-    uint32_t new_cache_idx = cache.sig_map.FindOrInsert(func->sig);
-    DCHECK_EQ(cache.code_cache.size(), new_cache_idx);
-    USE(new_cache_idx);
-    cache.code_cache.push_back(code);
+    cached = code;
     return code;
   }
 
  private:
   // We generate different code for calling imports than calling wasm functions
   // in this module. Both are cached separately.
-  // [0] for non-imports, [1] for imports.
-  struct Cache {
-    wasm::SignatureMap sig_map;
-    std::vector<Handle<Code>> code_cache;
-  } cache_[2];
+  using CacheKey = std::pair<bool, wasm::FunctionSig>;
+  std::unordered_map<CacheKey, Handle<Code>, base::hash<CacheKey>> cache_;
 };
 
 // A helper class to simplify instantiating a module from a module object.
@@ -1512,7 +1506,7 @@ int InstanceBuilder::ProcessImports(Handle<WasmInstanceObject> instance) {
               imported_instance->module()
                   ->functions[imported_function->function_index()]
                   .sig;
-          if (!imported_sig->Equals(expected_sig)) {
+          if (*imported_sig != *expected_sig) {
             ReportLinkError(
                 "imported function does not match the expected type", index,
                 module_name, import_name);
@@ -1611,7 +1605,7 @@ int InstanceBuilder::ProcessImports(Handle<WasmInstanceObject> instance) {
                                  ->functions[target->function_index()]
                                  .sig;
           IndirectFunctionTableEntry(instance, i)
-              .set(module_->signature_map.Find(sig), *imported_instance,
+              .set(module_->signature_map.Find(*sig), *imported_instance,
                    exported_call_target);
         }
         num_imported_tables++;
@@ -2048,7 +2042,8 @@ void InstanceBuilder::InitializeTables(Handle<WasmInstanceObject> instance) {
     const WasmTable& table = module_->tables[index];
     TableInstance& table_instance = table_instances_[index];
 
-    if (!instance->has_indirect_function_table()) {
+    if (!instance->has_indirect_function_table() &&
+        table.type == kWasmAnyFunc) {
       WasmInstanceObject::EnsureIndirectFunctionTableWithMinimumSize(
           instance, table.initial_size);
       table_instance.table_size = table.initial_size;
@@ -2058,74 +2053,71 @@ void InstanceBuilder::InitializeTables(Handle<WasmInstanceObject> instance) {
 
 void InstanceBuilder::LoadTableSegments(Handle<WasmInstanceObject> instance) {
   NativeModule* native_module = module_object_->native_module();
-  int table_count = static_cast<int>(module_->tables.size());
-  for (int index = 0; index < table_count; ++index) {
+  for (auto& table_init : module_->table_inits) {
+    uint32_t base = EvalUint32InitExpr(table_init.offset);
+    uint32_t num_entries = static_cast<uint32_t>(table_init.entries.size());
+    uint32_t index = table_init.table_index;
     TableInstance& table_instance = table_instances_[index];
+    DCHECK(in_bounds(base, num_entries, table_instance.table_size));
+    for (uint32_t i = 0; i < num_entries; ++i) {
+      uint32_t func_index = table_init.entries[i];
+      const WasmFunction* function = &module_->functions[func_index];
+      int table_index = static_cast<int>(i + base);
+
+      // Update the local dispatch table first.
+      uint32_t sig_id = module_->signature_ids[function->sig_index];
+      WasmInstanceObject* target_instance = *instance;
+      Address call_target;
+      const bool is_import = func_index < module_->num_imported_functions;
+      if (is_import) {
+        // For imported calls, take target instance and address from the
+        // import table.
+        ImportedFunctionEntry entry(instance, func_index);
+        target_instance = entry.instance();
+        call_target = entry.target();
+      } else {
+        call_target = native_module->GetCallTargetForFunction(func_index);
+      }
+      IndirectFunctionTableEntry(instance, table_index)
+          .set(sig_id, target_instance, call_target);
 
-    // TODO(titzer): this does redundant work if there are multiple tables,
-    // since initializations are not sorted by table index.
-    for (auto& table_init : module_->table_inits) {
-      uint32_t base = EvalUint32InitExpr(table_init.offset);
-      uint32_t num_entries = static_cast<uint32_t>(table_init.entries.size());
-      DCHECK(in_bounds(base, num_entries, table_instance.table_size));
-      for (uint32_t i = 0; i < num_entries; ++i) {
-        uint32_t func_index = table_init.entries[i];
-        const WasmFunction* function = &module_->functions[func_index];
-        int table_index = static_cast<int>(i + base);
-
-        // Update the local dispatch table first.
-        uint32_t sig_id = module_->signature_ids[function->sig_index];
-        WasmInstanceObject* target_instance = *instance;
-        Address call_target;
-        const bool is_import = func_index < module_->num_imported_functions;
-        if (is_import) {
-          // For imported calls, take target instance and address from the
-          // import table.
-          ImportedFunctionEntry entry(instance, func_index);
-          target_instance = entry.instance();
-          call_target = entry.target();
-        } else {
-          call_target = native_module->GetCallTargetForFunction(func_index);
-        }
-        IndirectFunctionTableEntry(instance, table_index)
-            .set(sig_id, target_instance, call_target);
-
-        if (!table_instance.table_object.is_null()) {
-          // Update the table object's other dispatch tables.
-          if (js_wrappers_[func_index].is_null()) {
-            // No JSFunction entry yet exists for this function. Create one.
-            // TODO(titzer): We compile JS->wasm wrappers for functions are
-            // not exported but are in an exported table. This should be done
-            // at module compile time and cached instead.
-
-            Handle<Code> wrapper_code =
-                js_to_wasm_cache_.GetOrCompileJSToWasmWrapper(
-                    isolate_, native_module, func_index, use_trap_handler());
-            MaybeHandle<String> func_name;
-            if (module_->origin == kAsmJsOrigin) {
-              // For modules arising from asm.js, honor the names section.
-              WireBytesRef func_name_ref = module_->LookupFunctionName(
-                  native_module->wire_bytes(), func_index);
-              func_name = WasmModuleObject::ExtractUtf8StringFromModuleBytes(
-                              isolate_, module_object_, func_name_ref)
-                              .ToHandleChecked();
-            }
-            Handle<WasmExportedFunction> js_function =
-                WasmExportedFunction::New(
-                    isolate_, instance, func_name, func_index,
-                    static_cast<int>(function->sig->parameter_count()),
-                    wrapper_code);
-            js_wrappers_[func_index] = js_function;
+      if (!table_instance.table_object.is_null()) {
+        // Update the table object's other dispatch tables.
+        if (js_wrappers_[func_index].is_null()) {
+          // No JSFunction entry yet exists for this function. Create one.
+          // TODO(titzer): We compile JS->wasm wrappers for functions are
+          // not exported but are in an exported table. This should be done
+          // at module compile time and cached instead.
+
+          Handle<Code> wrapper_code =
+              js_to_wasm_cache_.GetOrCompileJSToWasmWrapper(
+                  isolate_, native_module, func_index, use_trap_handler());
+          MaybeHandle<String> func_name;
+          if (module_->origin == kAsmJsOrigin) {
+            // For modules arising from asm.js, honor the names section.
+            WireBytesRef func_name_ref = module_->LookupFunctionName(
+                native_module->wire_bytes(), func_index);
+            func_name = WasmModuleObject::ExtractUtf8StringFromModuleBytes(
+                            isolate_, module_object_, func_name_ref)
+                            .ToHandleChecked();
           }
-          table_instance.js_wrappers->set(table_index,
-                                          *js_wrappers_[func_index]);
-          // UpdateDispatchTables() should update this instance as well.
-          WasmTableObject::UpdateDispatchTables(
-              isolate_, table_instance.table_object, table_index, function->sig,
-              instance, call_target);
+          Handle<WasmExportedFunction> js_function = WasmExportedFunction::New(
+              isolate_, instance, func_name, func_index,
+              static_cast<int>(function->sig->parameter_count()), wrapper_code);
+          js_wrappers_[func_index] = js_function;
         }
+        table_instance.js_wrappers->set(table_index, *js_wrappers_[func_index]);
+        // UpdateDispatchTables() should update this instance as well.
+        WasmTableObject::UpdateDispatchTables(
+            isolate_, table_instance.table_object, table_index, function->sig,
+            instance, call_target);
       }
     }
+  }
+
+  int table_count = static_cast<int>(module_->tables.size());
+  for (int index = 0; index < table_count; ++index) {
+    TableInstance& table_instance = table_instances_[index];
 
     // TODO(titzer): we add the new dispatch table at the end to avoid
     // redundant work and also because the new instance is not yet fully
diff --git a/deps/v8/src/wasm/module-decoder.cc b/deps/v8/src/wasm/module-decoder.cc
index 3099f971d950d9..bae8e4baf836d3 100644
--- a/deps/v8/src/wasm/module-decoder.cc
+++ b/deps/v8/src/wasm/module-decoder.cc
@@ -428,7 +428,7 @@ class ModuleDecoderImpl : public Decoder {
             static_cast<int>(pc_ - start_));
       FunctionSig* s = consume_sig(module_->signature_zone.get());
       module_->signatures.push_back(s);
-      uint32_t id = s ? module_->signature_map.FindOrInsert(s) : 0;
+      uint32_t id = s ? module_->signature_map.FindOrInsert(*s) : 0;
       module_->signature_ids.push_back(id);
     }
     module_->signature_map.Freeze();
@@ -477,7 +477,14 @@ class ModuleDecoderImpl : public Decoder {
           module_->tables.emplace_back();
           WasmTable* table = &module_->tables.back();
           table->imported = true;
-          expect_u8("element type", kLocalAnyFunc);
+          ValueType type = consume_reference_type();
+          if (!FLAG_experimental_wasm_anyref) {
+            if (type != kWasmAnyFunc) {
+              error(pc_ - 1, "invalid table type");
+              break;
+            }
+          }
+          table->type = type;
           uint8_t flags = validate_table_flags("element count");
           consume_resizable_limits(
               "element count", "elements", FLAG_wasm_max_table_size,
@@ -702,13 +709,18 @@ class ModuleDecoderImpl : public Decoder {
     for (uint32_t i = 0; ok() && i < element_count; ++i) {
       const byte* pos = pc();
       uint32_t table_index = consume_u32v("table index");
-      if (table_index != 0) {
+      if (!FLAG_experimental_wasm_anyref && table_index != 0) {
         errorf(pos, "illegal table index %u != 0", table_index);
       }
       if (table_index >= module_->tables.size()) {
         errorf(pos, "out of bounds table index %u", table_index);
         break;
       }
+      if (module_->tables[table_index].type != kWasmAnyFunc) {
+        errorf(pos, "Invalid element segment. Table %u is not of type AnyFunc",
+               table_index);
+        break;
+      }
       WasmInitExpr offset = consume_init_expr(module_.get(), kWasmI32);
       uint32_t num_elem =
           consume_count("number of elements", kV8MaxWasmTableEntries);
diff --git a/deps/v8/src/wasm/signature-map.cc b/deps/v8/src/wasm/signature-map.cc
index b4054596f88864..dca3b1ef894ffc 100644
--- a/deps/v8/src/wasm/signature-map.cc
+++ b/deps/v8/src/wasm/signature-map.cc
@@ -10,7 +10,7 @@ namespace v8 {
 namespace internal {
 namespace wasm {
 
-uint32_t SignatureMap::FindOrInsert(FunctionSig* sig) {
+uint32_t SignatureMap::FindOrInsert(const FunctionSig& sig) {
   CHECK(!frozen_);
   auto pos = map_.find(sig);
   if (pos != map_.end()) {
@@ -22,7 +22,7 @@ uint32_t SignatureMap::FindOrInsert(FunctionSig* sig) {
   }
 }
 
-int32_t SignatureMap::Find(FunctionSig* sig) const {
+int32_t SignatureMap::Find(const FunctionSig& sig) const {
   auto pos = map_.find(sig);
   if (pos != map_.end()) {
     return static_cast<int32_t>(pos->second);
@@ -31,24 +31,6 @@ int32_t SignatureMap::Find(FunctionSig* sig) const {
   }
 }
 
-bool SignatureMap::CompareFunctionSigs::operator()(FunctionSig* a,
-                                                   FunctionSig* b) const {
-  if (a == b) return false;
-  if (a->return_count() < b->return_count()) return true;
-  if (a->return_count() > b->return_count()) return false;
-  if (a->parameter_count() < b->parameter_count()) return true;
-  if (a->parameter_count() > b->parameter_count()) return false;
-  for (size_t r = 0; r < a->return_count(); r++) {
-    if (a->GetReturn(r) < b->GetReturn(r)) return true;
-    if (a->GetReturn(r) > b->GetReturn(r)) return false;
-  }
-  for (size_t p = 0; p < a->parameter_count(); p++) {
-    if (a->GetParam(p) < b->GetParam(p)) return true;
-    if (a->GetParam(p) > b->GetParam(p)) return false;
-  }
-  return false;
-}
-
 }  // namespace wasm
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/src/wasm/signature-map.h b/deps/v8/src/wasm/signature-map.h
index 3fab0fde167d65..5ed66976d51e06 100644
--- a/deps/v8/src/wasm/signature-map.h
+++ b/deps/v8/src/wasm/signature-map.h
@@ -5,16 +5,14 @@
 #ifndef V8_WASM_SIGNATURE_MAP_H_
 #define V8_WASM_SIGNATURE_MAP_H_
 
-#include <map>
+#include <unordered_map>
 
+#include "src/signature.h"
 #include "src/wasm/value-type.h"
 
 namespace v8 {
 namespace internal {
 
-template <typename T>
-class Signature;
-
 namespace wasm {
 
 using FunctionSig = Signature<ValueType>;
@@ -30,22 +28,18 @@ class V8_EXPORT_PRIVATE SignatureMap {
   MOVE_ONLY_WITH_DEFAULT_CONSTRUCTORS(SignatureMap);
 
   // Gets the index for a signature, assigning a new index if necessary.
-  uint32_t FindOrInsert(FunctionSig* sig);
+  uint32_t FindOrInsert(const FunctionSig& sig);
 
   // Gets the index for a signature, returning {-1} if not found.
-  int32_t Find(FunctionSig* sig) const;
+  int32_t Find(const FunctionSig& sig) const;
 
   // Disallows further insertions to this signature map.
   void Freeze() { frozen_ = true; }
 
  private:
-  // TODO(wasm): use a hashmap instead of an ordered map?
-  struct CompareFunctionSigs {
-    bool operator()(FunctionSig* a, FunctionSig* b) const;
-  };
   uint32_t next_ = 0;
   bool frozen_ = false;
-  std::map<FunctionSig*, uint32_t, CompareFunctionSigs> map_;
+  std::unordered_map<FunctionSig, uint32_t, base::hash<FunctionSig>> map_;
 };
 
 }  // namespace wasm
diff --git a/deps/v8/src/wasm/value-type.h b/deps/v8/src/wasm/value-type.h
index cf0360e9324394..8522b3a50020ed 100644
--- a/deps/v8/src/wasm/value-type.h
+++ b/deps/v8/src/wasm/value-type.h
@@ -24,6 +24,8 @@ enum ValueType : uint8_t {
   kWasmVar,
 };
 
+inline size_t hash_value(ValueType type) { return static_cast<size_t>(type); }
+
 // TODO(clemensh): Compute memtype and size from ValueType once we have c++14
 // constexpr support.
 #define FOREACH_LOAD_TYPE(V) \
diff --git a/deps/v8/src/wasm/wasm-debug.cc b/deps/v8/src/wasm/wasm-debug.cc
index 069d5e8ed6032d..b1f57fa8f88d2f 100644
--- a/deps/v8/src/wasm/wasm-debug.cc
+++ b/deps/v8/src/wasm/wasm-debug.cc
@@ -703,9 +703,9 @@ Handle<JSFunction> WasmDebugInfo::GetCWasmEntry(
   }
   Handle<FixedArray> entries(debug_info->c_wasm_entries(), isolate);
   wasm::SignatureMap* map = debug_info->c_wasm_entry_map()->raw();
-  int32_t index = map->Find(sig);
+  int32_t index = map->Find(*sig);
   if (index == -1) {
-    index = static_cast<int32_t>(map->FindOrInsert(sig));
+    index = static_cast<int32_t>(map->FindOrInsert(*sig));
     if (index == entries->length()) {
       entries = isolate->factory()->CopyFixedArrayAndGrow(
           entries, entries->length(), TENURED);
diff --git a/deps/v8/src/wasm/wasm-interpreter.cc b/deps/v8/src/wasm/wasm-interpreter.cc
index 022159e1577cf1..581277cbab7873 100644
--- a/deps/v8/src/wasm/wasm-interpreter.cc
+++ b/deps/v8/src/wasm/wasm-interpreter.cc
@@ -2846,7 +2846,7 @@ class ThreadImpl {
             module()->signature_ids[code->function->sig_index];
         int expected_canonical_id = module()->signature_ids[sig_index];
         DCHECK_EQ(function_canonical_id,
-                  module()->signature_map.Find(code->function->sig));
+                  module()->signature_map.Find(*code->function->sig));
         if (function_canonical_id != expected_canonical_id) {
           return {ExternalCallResult::SIGNATURE_MISMATCH};
         }
@@ -2857,7 +2857,7 @@ class ThreadImpl {
     Isolate* isolate = instance_object_->GetIsolate();
     uint32_t expected_sig_id = module()->signature_ids[sig_index];
     DCHECK_EQ(expected_sig_id,
-              module()->signature_map.Find(module()->signatures[sig_index]));
+              module()->signature_map.Find(*module()->signatures[sig_index]));
 
     // The function table is stored in the instance.
     // TODO(wasm): the wasm interpreter currently supports only one table.
diff --git a/deps/v8/src/wasm/wasm-js.cc b/deps/v8/src/wasm/wasm-js.cc
index 1f216c030899d3..c7c6216446e3d4 100644
--- a/deps/v8/src/wasm/wasm-js.cc
+++ b/deps/v8/src/wasm/wasm-js.cc
@@ -17,6 +17,7 @@
 #include "src/objects/templates.h"
 #include "src/parsing/parse-info.h"
 #include "src/trap-handler/trap-handler.h"
+#include "src/wasm/streaming-decoder.h"
 #include "src/wasm/wasm-engine.h"
 #include "src/wasm/wasm-limits.h"
 #include "src/wasm/wasm-memory.h"
@@ -26,6 +27,41 @@ using v8::internal::wasm::ErrorThrower;
 
 namespace v8 {
 
+class WasmStreaming::WasmStreamingImpl {
+ public:
+  void OnBytesReceived(const uint8_t* bytes, size_t size) {}
+
+  void Finish() {}
+
+  void Abort(MaybeLocal<Value> exception) {}
+};
+
+WasmStreaming::WasmStreaming(std::unique_ptr<WasmStreamingImpl> impl)
+    : impl_(std::move(impl)) {}
+
+// The destructor is defined here because we have a unique_ptr with forward
+// declaration.
+WasmStreaming::~WasmStreaming() = default;
+
+void WasmStreaming::OnBytesReceived(const uint8_t* bytes, size_t size) {
+  impl_->OnBytesReceived(bytes, size);
+}
+
+void WasmStreaming::Finish() { impl_->Finish(); }
+
+void WasmStreaming::Abort(MaybeLocal<Value> exception) {
+  impl_->Abort(exception);
+}
+
+// static
+std::shared_ptr<WasmStreaming> WasmStreaming::Unpack(Isolate* isolate,
+                                                     Local<Value> value) {
+  i::HandleScope scope(reinterpret_cast<i::Isolate*>(isolate));
+  auto managed =
+      i::Handle<i::Managed<WasmStreaming>>::cast(Utils::OpenHandle(*value));
+  return managed->get();
+}
+
 namespace {
 
 #define ASSIGN(type, var, expr)                      \
diff --git a/deps/v8/src/wasm/wasm-module-builder.cc b/deps/v8/src/wasm/wasm-module-builder.cc
index a3ddc00ce45ca6..15a4b0bbf1a8b8 100644
--- a/deps/v8/src/wasm/wasm-module-builder.cc
+++ b/deps/v8/src/wasm/wasm-module-builder.cc
@@ -249,33 +249,13 @@ void WasmModuleBuilder::AddDataSegment(const byte* data, uint32_t size,
   }
 }
 
-bool WasmModuleBuilder::CompareFunctionSigs::operator()(FunctionSig* a,
-                                                        FunctionSig* b) const {
-  if (a->return_count() < b->return_count()) return true;
-  if (a->return_count() > b->return_count()) return false;
-  if (a->parameter_count() < b->parameter_count()) return true;
-  if (a->parameter_count() > b->parameter_count()) return false;
-  for (size_t r = 0; r < a->return_count(); r++) {
-    if (a->GetReturn(r) < b->GetReturn(r)) return true;
-    if (a->GetReturn(r) > b->GetReturn(r)) return false;
-  }
-  for (size_t p = 0; p < a->parameter_count(); p++) {
-    if (a->GetParam(p) < b->GetParam(p)) return true;
-    if (a->GetParam(p) > b->GetParam(p)) return false;
-  }
-  return false;
-}
-
 uint32_t WasmModuleBuilder::AddSignature(FunctionSig* sig) {
-  SignatureMap::iterator pos = signature_map_.find(sig);
-  if (pos != signature_map_.end()) {
-    return pos->second;
-  } else {
-    uint32_t index = static_cast<uint32_t>(signatures_.size());
-    signature_map_[sig] = index;
-    signatures_.push_back(sig);
-    return index;
-  }
+  auto sig_entry = signature_map_.find(*sig);
+  if (sig_entry != signature_map_.end()) return sig_entry->second;
+  uint32_t index = static_cast<uint32_t>(signatures_.size());
+  signature_map_.emplace(*sig, index);
+  signatures_.push_back(sig);
+  return index;
 }
 
 uint32_t WasmModuleBuilder::AllocateIndirectFunctions(uint32_t count) {
diff --git a/deps/v8/src/wasm/wasm-module-builder.h b/deps/v8/src/wasm/wasm-module-builder.h
index 19ca123f0e25f2..db70502886df14 100644
--- a/deps/v8/src/wasm/wasm-module-builder.h
+++ b/deps/v8/src/wasm/wasm-module-builder.h
@@ -241,13 +241,6 @@ class V8_EXPORT_PRIVATE WasmModuleBuilder : public ZoneObject {
   void WriteTo(ZoneBuffer& buffer) const;
   void WriteAsmJsOffsetTable(ZoneBuffer& buffer) const;
 
-  // TODO(titzer): use SignatureMap from signature-map.h here.
-  // This signature map is zone-allocated, but the other is heap allocated.
-  struct CompareFunctionSigs {
-    bool operator()(FunctionSig* a, FunctionSig* b) const;
-  };
-  typedef ZoneMap<FunctionSig*, uint32_t, CompareFunctionSigs> SignatureMap;
-
   Zone* zone() { return zone_; }
 
   FunctionSig* GetSignature(uint32_t index) { return signatures_[index]; }
@@ -290,7 +283,7 @@ class V8_EXPORT_PRIVATE WasmModuleBuilder : public ZoneObject {
   ZoneVector<WasmDataSegment> data_segments_;
   ZoneVector<uint32_t> indirect_functions_;
   ZoneVector<WasmGlobal> globals_;
-  SignatureMap signature_map_;
+  ZoneUnorderedMap<FunctionSig, uint32_t> signature_map_;
   int start_function_index_;
   uint32_t min_memory_size_;
   uint32_t max_memory_size_;
diff --git a/deps/v8/src/wasm/wasm-objects.cc b/deps/v8/src/wasm/wasm-objects.cc
index c941477c77c3b9..45910ddfb5af24 100644
--- a/deps/v8/src/wasm/wasm-objects.cc
+++ b/deps/v8/src/wasm/wasm-objects.cc
@@ -845,7 +845,7 @@ void WasmTableObject::UpdateDispatchTables(
         isolate);
     // Note that {SignatureMap::Find} may return {-1} if the signature is
     // not found; it will simply never match any check.
-    auto sig_id = to_instance->module()->signature_map.Find(sig);
+    auto sig_id = to_instance->module()->signature_map.Find(*sig);
     IndirectFunctionTableEntry(to_instance, table_index)
         .set(sig_id, *from_instance, call_target);
   }
diff --git a/deps/v8/src/wasm/wasm-objects.h b/deps/v8/src/wasm/wasm-objects.h
index 3d3f81dcd126ba..ee884ec0ddb5a1 100644
--- a/deps/v8/src/wasm/wasm-objects.h
+++ b/deps/v8/src/wasm/wasm-objects.h
@@ -115,7 +115,7 @@ class WasmModuleObject : public JSObject {
   inline void reset_breakpoint_infos();
 
   // Dispatched behavior.
-  DECL_PRINTER_WITH_ISOLATE(WasmModuleObject)
+  DECL_PRINTER(WasmModuleObject)
   DECL_VERIFIER(WasmModuleObject)
 
 // Layout description.
diff --git a/deps/v8/src/wasm/wasm-opcodes.cc b/deps/v8/src/wasm/wasm-opcodes.cc
index cd91fd92bb4da1..22c906e270676a 100644
--- a/deps/v8/src/wasm/wasm-opcodes.cc
+++ b/deps/v8/src/wasm/wasm-opcodes.cc
@@ -107,7 +107,6 @@ const char* WasmOpcodes::OpcodeName(WasmOpcode opcode) {
     CASE_FLOAT_OP(CopySign, "copysign")
     CASE_REF_OP(Null, "null")
     CASE_REF_OP(IsNull, "is_null")
-    CASE_REF_OP(Eq, "eq")
     CASE_I32_OP(ConvertI64, "wrap/i64")
     CASE_CONVERT_OP(Convert, INT, F32, "f32", "trunc")
     CASE_CONVERT_OP(Convert, INT, F64, "f64", "trunc")
@@ -354,7 +353,6 @@ bool WasmOpcodes::IsAnyRefOpcode(WasmOpcode opcode) {
   switch (opcode) {
     case kExprRefNull:
     case kExprRefIsNull:
-    case kExprRefEq:
       return true;
     default:
       return false;
diff --git a/deps/v8/src/wasm/wasm-opcodes.h b/deps/v8/src/wasm/wasm-opcodes.h
index f074cad11d36e5..dff02f8147f6d0 100644
--- a/deps/v8/src/wasm/wasm-opcodes.h
+++ b/deps/v8/src/wasm/wasm-opcodes.h
@@ -226,8 +226,7 @@ using WasmName = Vector<const char>;
   V(I64SExtendI8, 0xc2, l_l)               \
   V(I64SExtendI16, 0xc3, l_l)              \
   V(I64SExtendI32, 0xc4, l_l)              \
-  V(RefIsNull, 0xd1, i_r)                  \
-  V(RefEq, 0xd2, i_rr)
+  V(RefIsNull, 0xd1, i_r)
 
 // For compatibility with Asm.js.
 #define FOREACH_ASMJS_COMPAT_OPCODE(V) \
@@ -535,8 +534,7 @@ using WasmName = Vector<const char>;
   V(l_il, kWasmI64, kWasmI32, kWasmI64)            \
   V(i_iii, kWasmI32, kWasmI32, kWasmI32, kWasmI32) \
   V(l_ill, kWasmI64, kWasmI32, kWasmI64, kWasmI64) \
-  V(i_r, kWasmI32, kWasmAnyRef)                    \
-  V(i_rr, kWasmI32, kWasmAnyRef, kWasmAnyRef)
+  V(i_r, kWasmI32, kWasmAnyRef)
 
 #define FOREACH_SIMD_SIGNATURE(V)          \
   V(s_s, kWasmS128, kWasmS128)             \
diff --git a/deps/v8/test/cctest/BUILD.gn b/deps/v8/test/cctest/BUILD.gn
index 9072d6bed7213f..a5ee0ce3b47c2d 100644
--- a/deps/v8/test/cctest/BUILD.gn
+++ b/deps/v8/test/cctest/BUILD.gn
@@ -117,6 +117,7 @@ v8_source_set("cctest_sources") {
     "heap/test-compaction.cc",
     "heap/test-concurrent-marking.cc",
     "heap/test-embedder-tracing.cc",
+    "heap/test-external-string-tracker.cc",
     "heap/test-heap.cc",
     "heap/test-incremental-marking.cc",
     "heap/test-invalidated-slots.cc",
diff --git a/deps/v8/test/cctest/assembler-helper-arm.cc b/deps/v8/test/cctest/assembler-helper-arm.cc
index cb647062da9c9b..b2533d14301ed1 100644
--- a/deps/v8/test/cctest/assembler-helper-arm.cc
+++ b/deps/v8/test/cctest/assembler-helper-arm.cc
@@ -24,7 +24,7 @@ Handle<Code> AssembleCodeImpl(std::function<void(Assembler&)> assemble) {
   Handle<Code> code =
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
   if (FLAG_print_code) {
-    code->Print(isolate);
+    code->Print();
   }
   return code;
 }
diff --git a/deps/v8/test/cctest/cctest.h b/deps/v8/test/cctest/cctest.h
index c4392b4f5f85b5..f1deea17be1103 100644
--- a/deps/v8/test/cctest/cctest.h
+++ b/deps/v8/test/cctest/cctest.h
@@ -640,18 +640,23 @@ class ManualGCScope {
       : flag_concurrent_marking_(i::FLAG_concurrent_marking),
         flag_concurrent_sweeping_(i::FLAG_concurrent_sweeping),
         flag_stress_incremental_marking_(i::FLAG_stress_incremental_marking),
-        flag_parallel_marking_(i::FLAG_parallel_marking) {
+        flag_parallel_marking_(i::FLAG_parallel_marking),
+        flag_detect_ineffective_gcs_near_heap_limit_(
+            i::FLAG_detect_ineffective_gcs_near_heap_limit) {
     i::FLAG_concurrent_marking = false;
     i::FLAG_concurrent_sweeping = false;
     i::FLAG_stress_incremental_marking = false;
     // Parallel marking has a dependency on concurrent marking.
     i::FLAG_parallel_marking = false;
+    i::FLAG_detect_ineffective_gcs_near_heap_limit = false;
   }
   ~ManualGCScope() {
     i::FLAG_concurrent_marking = flag_concurrent_marking_;
     i::FLAG_concurrent_sweeping = flag_concurrent_sweeping_;
     i::FLAG_stress_incremental_marking = flag_stress_incremental_marking_;
     i::FLAG_parallel_marking = flag_parallel_marking_;
+    i::FLAG_detect_ineffective_gcs_near_heap_limit =
+        flag_detect_ineffective_gcs_near_heap_limit_;
   }
 
  private:
@@ -659,6 +664,7 @@ class ManualGCScope {
   bool flag_concurrent_sweeping_;
   bool flag_stress_incremental_marking_;
   bool flag_parallel_marking_;
+  bool flag_detect_ineffective_gcs_near_heap_limit_;
 };
 
 // This is an abstract base class that can be overridden to implement a test
diff --git a/deps/v8/test/cctest/cctest.status b/deps/v8/test/cctest/cctest.status
index 06b3e719a9cbc0..a7fcb4f2370039 100644
--- a/deps/v8/test/cctest/cctest.status
+++ b/deps/v8/test/cctest/cctest.status
@@ -125,9 +125,6 @@
   'test-serialize/SnapshotCreatorNoExternalReferencesCustomFail1': [FAIL],
   'test-serialize/SnapshotCreatorNoExternalReferencesCustomFail2': [FAIL],
 
-  # https://crbug.com/v8/7859
-  'test-heap/Regress538257': [SKIP],
-
   ############################################################################
   # Slow tests.
   'test-debug/CallFunctionInDebugger': [PASS, ['mode == debug', SLOW]],
diff --git a/deps/v8/test/cctest/compiler/test-code-generator.cc b/deps/v8/test/cctest/compiler/test-code-generator.cc
index cc9ddcd104e25f..9a7b590f5a3484 100644
--- a/deps/v8/test/cctest/compiler/test-code-generator.cc
+++ b/deps/v8/test/cctest/compiler/test-code-generator.cc
@@ -1212,7 +1212,7 @@ TEST(FuzzAssembleMove) {
 
     Handle<Code> test = c.FinalizeForExecuting();
     if (FLAG_print_code) {
-      test->Print(env.main_isolate());
+      test->Print();
     }
 
     Handle<FixedArray> actual = env.Run(test, state_in);
@@ -1238,7 +1238,7 @@ TEST(FuzzAssembleSwap) {
 
     Handle<Code> test = c.FinalizeForExecuting();
     if (FLAG_print_code) {
-      test->Print(env.main_isolate());
+      test->Print();
     }
 
     Handle<FixedArray> actual = env.Run(test, state_in);
@@ -1276,7 +1276,7 @@ TEST(FuzzAssembleMoveAndSwap) {
 
     Handle<Code> test = c.FinalizeForExecuting();
     if (FLAG_print_code) {
-      test->Print(env.main_isolate());
+      test->Print();
     }
 
     Handle<FixedArray> actual = env.Run(test, state_in);
@@ -1357,7 +1357,7 @@ TEST(AssembleTailCallGap) {
                                 CodeGeneratorTester::kRegisterPush);
     Handle<Code> code = c.Finalize();
     if (FLAG_print_code) {
-      code->Print(env.main_isolate());
+      code->Print();
     }
   }
 
@@ -1386,7 +1386,7 @@ TEST(AssembleTailCallGap) {
                                 CodeGeneratorTester::kStackSlotPush);
     Handle<Code> code = c.Finalize();
     if (FLAG_print_code) {
-      code->Print(env.main_isolate());
+      code->Print();
     }
   }
 
@@ -1415,7 +1415,7 @@ TEST(AssembleTailCallGap) {
                                 CodeGeneratorTester::kScalarPush);
     Handle<Code> code = c.Finalize();
     if (FLAG_print_code) {
-      code->Print(env.main_isolate());
+      code->Print();
     }
   }
 }
diff --git a/deps/v8/test/cctest/compiler/test-jump-threading.cc b/deps/v8/test/cctest/compiler/test-jump-threading.cc
index 7cb2aa58b9650e..52309f41e05a58 100644
--- a/deps/v8/test/cctest/compiler/test-jump-threading.cc
+++ b/deps/v8/test/cctest/compiler/test-jump-threading.cc
@@ -617,7 +617,7 @@ void ApplyForwarding(TestCode& code, int size, int* forward) {
   for (int i = 0; i < size; i++) {
     vector.push_back(RpoNumber::FromInt(forward[i]));
   }
-  JumpThreading::ApplyForwarding(vector, &code.sequence_);
+  JumpThreading::ApplyForwarding(code.main_zone(), vector, &code.sequence_);
 }
 
 
diff --git a/deps/v8/test/cctest/heap/test-embedder-tracing.cc b/deps/v8/test/cctest/heap/test-embedder-tracing.cc
index f124369172331c..47f48c0c7aabc5 100644
--- a/deps/v8/test/cctest/heap/test-embedder-tracing.cc
+++ b/deps/v8/test/cctest/heap/test-embedder-tracing.cc
@@ -76,6 +76,22 @@ class TestEmbedderHeapTracer final : public v8::EmbedderHeapTracer {
   std::vector<v8::Persistent<v8::Object>*> to_register_with_v8_;
 };
 
+class TemporaryEmbedderHeapTracerScope {
+ public:
+  TemporaryEmbedderHeapTracerScope(v8::Isolate* isolate,
+                                   EmbedderHeapTracer* tracer)
+      : isolate_(isolate) {
+    isolate_->SetEmbedderHeapTracer(tracer);
+  }
+
+  ~TemporaryEmbedderHeapTracerScope() {
+    isolate_->SetEmbedderHeapTracer(nullptr);
+  }
+
+ private:
+  v8::Isolate* const isolate_;
+};
+
 }  // namespace
 
 TEST(V8RegisteringEmbedderReference) {
@@ -85,7 +101,7 @@ TEST(V8RegisteringEmbedderReference) {
   CcTest::InitializeVM();
   v8::Isolate* isolate = CcTest::isolate();
   TestEmbedderHeapTracer tracer(isolate);
-  isolate->SetEmbedderHeapTracer(&tracer);
+  TemporaryEmbedderHeapTracerScope tracer_scope(isolate, &tracer);
   v8::HandleScope scope(isolate);
   v8::Local<v8::Context> context = v8::Context::New(isolate);
   v8::Context::Scope context_scope(context);
@@ -105,7 +121,7 @@ TEST(EmbedderRegisteringV8Reference) {
   CcTest::InitializeVM();
   v8::Isolate* isolate = CcTest::isolate();
   TestEmbedderHeapTracer tracer(isolate);
-  isolate->SetEmbedderHeapTracer(&tracer);
+  TemporaryEmbedderHeapTracerScope tracer_scope(isolate, &tracer);
   v8::HandleScope scope(isolate);
   v8::Local<v8::Context> context = v8::Context::New(isolate);
   v8::Context::Scope context_scope(context);
@@ -139,7 +155,7 @@ TEST(TracingInRevivedSubgraph) {
   CcTest::InitializeVM();
   v8::Isolate* isolate = CcTest::isolate();
   TestEmbedderHeapTracer tracer(isolate);
-  isolate->SetEmbedderHeapTracer(&tracer);
+  TemporaryEmbedderHeapTracerScope tracer_scope(isolate, &tracer);
   v8::HandleScope scope(isolate);
   v8::Local<v8::Context> context = v8::Context::New(isolate);
   v8::Context::Scope context_scope(context);
@@ -167,7 +183,7 @@ TEST(TracingInEphemerons) {
   CcTest::InitializeVM();
   v8::Isolate* isolate = CcTest::isolate();
   TestEmbedderHeapTracer tracer(isolate);
-  isolate->SetEmbedderHeapTracer(&tracer);
+  TemporaryEmbedderHeapTracerScope tracer_scope(isolate, &tracer);
   v8::HandleScope scope(isolate);
   v8::Local<v8::Context> context = v8::Context::New(isolate);
   v8::Context::Scope context_scope(context);
@@ -192,6 +208,49 @@ TEST(TracingInEphemerons) {
   CHECK(tracer.IsRegisteredFromV8(first_field));
 }
 
+TEST(FinalizeTracingIsNoopWhenNotMarking) {
+  ManualGCScope manual_gc;
+  CcTest::InitializeVM();
+  v8::Isolate* isolate = CcTest::isolate();
+  Isolate* i_isolate = CcTest::i_isolate();
+  TestEmbedderHeapTracer tracer(isolate);
+  TemporaryEmbedderHeapTracerScope tracer_scope(isolate, &tracer);
+
+  // Finalize a potentially running garbage collection.
+  i_isolate->heap()->CollectGarbage(OLD_SPACE,
+                                    GarbageCollectionReason::kTesting);
+  CHECK(i_isolate->heap()->incremental_marking()->IsStopped());
+
+  int gc_counter = i_isolate->heap()->gc_count();
+  tracer.FinalizeTracing();
+  CHECK(i_isolate->heap()->incremental_marking()->IsStopped());
+  CHECK_EQ(gc_counter, i_isolate->heap()->gc_count());
+}
+
+TEST(FinalizeTracingWhenMarking) {
+  ManualGCScope manual_gc;
+  CcTest::InitializeVM();
+  v8::Isolate* isolate = CcTest::isolate();
+  Isolate* i_isolate = CcTest::i_isolate();
+  TestEmbedderHeapTracer tracer(isolate);
+  TemporaryEmbedderHeapTracerScope tracer_scope(isolate, &tracer);
+
+  // Finalize a potentially running garbage collection.
+  i_isolate->heap()->CollectGarbage(OLD_SPACE,
+                                    GarbageCollectionReason::kTesting);
+  if (i_isolate->heap()->mark_compact_collector()->sweeping_in_progress()) {
+    i_isolate->heap()->mark_compact_collector()->EnsureSweepingCompleted();
+  }
+  CHECK(i_isolate->heap()->incremental_marking()->IsStopped());
+
+  i::IncrementalMarking* marking = i_isolate->heap()->incremental_marking();
+  marking->Start(i::GarbageCollectionReason::kTesting);
+  // Sweeping is not runing so we should immediately start marking.
+  CHECK(marking->IsMarking());
+  tracer.FinalizeTracing();
+  CHECK(marking->IsStopped());
+}
+
 }  // namespace heap
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/test/cctest/heap/test-external-string-tracker.cc b/deps/v8/test/cctest/heap/test-external-string-tracker.cc
new file mode 100644
index 00000000000000..e0a6c43a558f65
--- /dev/null
+++ b/deps/v8/test/cctest/heap/test-external-string-tracker.cc
@@ -0,0 +1,176 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "src/api.h"
+#include "src/heap/spaces.h"
+#include "src/isolate.h"
+#include "src/objects-inl.h"
+#include "test/cctest/cctest.h"
+#include "test/cctest/heap/heap-tester.h"
+#include "test/cctest/heap/heap-utils.h"
+
+#define TEST_STR "tests are great!"
+
+namespace v8 {
+namespace internal {
+namespace heap {
+
+// Adapted from cctest/test-api.cc
+class TestOneByteResource : public v8::String::ExternalOneByteStringResource {
+ public:
+  explicit TestOneByteResource(const char* data, int* counter = nullptr,
+                               size_t offset = 0)
+      : orig_data_(data),
+        data_(data + offset),
+        length_(strlen(data) - offset),
+        counter_(counter) {}
+
+  ~TestOneByteResource() {
+    i::DeleteArray(orig_data_);
+    if (counter_ != nullptr) ++*counter_;
+  }
+
+  const char* data() const { return data_; }
+
+  size_t length() const { return length_; }
+
+ private:
+  const char* orig_data_;
+  const char* data_;
+  size_t length_;
+  int* counter_;
+};
+
+TEST(ExternalString_ExternalBackingStoreSizeIncreases) {
+  CcTest::InitializeVM();
+  LocalContext env;
+  v8::Isolate* isolate = env->GetIsolate();
+  Heap* heap = reinterpret_cast<Isolate*>(isolate)->heap();
+  ExternalBackingStoreType type = ExternalBackingStoreType::kExternalString;
+
+  const size_t backing_store_before =
+      heap->old_space()->ExternalBackingStoreBytes(type);
+
+  {
+    v8::HandleScope handle_scope(isolate);
+    v8::Local<v8::String> es = v8::String::NewExternal(
+        isolate, new TestOneByteResource(i::StrDup(TEST_STR)));
+    USE(es);
+
+    const size_t backing_store_after =
+        heap->old_space()->ExternalBackingStoreBytes(type);
+
+    CHECK_EQ(es->Length(), backing_store_after - backing_store_before);
+  }
+}
+
+TEST(ExternalString_ExternalBackingStoreSizeDecreases) {
+  ManualGCScope manual_gc_scope;
+  CcTest::InitializeVM();
+  LocalContext env;
+  v8::Isolate* isolate = env->GetIsolate();
+  Heap* heap = reinterpret_cast<Isolate*>(isolate)->heap();
+  ExternalBackingStoreType type = ExternalBackingStoreType::kExternalString;
+
+  const size_t backing_store_before =
+      heap->old_space()->ExternalBackingStoreBytes(type);
+
+  {
+    v8::HandleScope handle_scope(isolate);
+    v8::Local<v8::String> es = v8::String::NewExternal(
+        isolate, new TestOneByteResource(i::StrDup(TEST_STR)));
+    USE(es);
+  }
+
+  heap::GcAndSweep(heap, OLD_SPACE);
+
+  const size_t backing_store_after =
+      heap->old_space()->ExternalBackingStoreBytes(type);
+
+  CHECK_EQ(0, backing_store_after - backing_store_before);
+}
+
+TEST(ExternalString_ExternalBackingStoreSizeIncreasesMarkCompact) {
+  if (FLAG_never_compact) return;
+  ManualGCScope manual_gc_scope;
+  FLAG_manual_evacuation_candidates_selection = true;
+  CcTest::InitializeVM();
+  LocalContext env;
+  v8::Isolate* isolate = env->GetIsolate();
+  Heap* heap = reinterpret_cast<Isolate*>(isolate)->heap();
+  heap::AbandonCurrentlyFreeMemory(heap->old_space());
+  ExternalBackingStoreType type = ExternalBackingStoreType::kExternalString;
+
+  const size_t backing_store_before =
+      heap->old_space()->ExternalBackingStoreBytes(type);
+
+  {
+    v8::HandleScope handle_scope(isolate);
+    v8::Local<v8::String> es = v8::String::NewExternal(
+        isolate, new TestOneByteResource(i::StrDup(TEST_STR)));
+    Handle<String> esh = v8::Utils::OpenHandle(*es);
+
+    Page* page_before_gc = Page::FromAddress(esh->address());
+    heap::ForceEvacuationCandidate(page_before_gc);
+
+    CcTest::CollectAllGarbage();
+
+    const size_t backing_store_after =
+        heap->old_space()->ExternalBackingStoreBytes(type);
+    CHECK_EQ(es->Length(), backing_store_after - backing_store_before);
+  }
+
+  heap::GcAndSweep(heap, OLD_SPACE);
+  const size_t backing_store_after =
+      heap->old_space()->ExternalBackingStoreBytes(type);
+  CHECK_EQ(0, backing_store_after - backing_store_before);
+}
+
+TEST(ExternalString_ExternalBackingStoreSizeIncreasesAfterExternalization) {
+  CcTest::InitializeVM();
+  LocalContext env;
+  v8::Isolate* isolate = env->GetIsolate();
+  Heap* heap = reinterpret_cast<Isolate*>(isolate)->heap();
+  ExternalBackingStoreType type = ExternalBackingStoreType::kExternalString;
+  size_t old_backing_store_before = 0, new_backing_store_before = 0;
+
+  {
+    v8::HandleScope handle_scope(isolate);
+
+    new_backing_store_before =
+        heap->new_space()->ExternalBackingStoreBytes(type);
+    old_backing_store_before =
+        heap->old_space()->ExternalBackingStoreBytes(type);
+
+    // Allocate normal string in the new gen.
+    v8::Local<v8::String> str =
+        v8::String::NewFromUtf8(isolate, TEST_STR, v8::NewStringType::kNormal)
+            .ToLocalChecked();
+
+    CHECK_EQ(0, heap->new_space()->ExternalBackingStoreBytes(type) -
+                    new_backing_store_before);
+
+    // Trigger GCs so that the newly allocated string moves to old gen.
+    heap::GcAndSweep(heap, NEW_SPACE);  // in survivor space now
+    heap::GcAndSweep(heap, NEW_SPACE);  // in old gen now
+
+    bool success =
+        str->MakeExternal(new TestOneByteResource(i::StrDup(TEST_STR)));
+    CHECK(success);
+
+    CHECK_EQ(str->Length(), heap->old_space()->ExternalBackingStoreBytes(type) -
+                                old_backing_store_before);
+  }
+
+  heap::GcAndSweep(heap, OLD_SPACE);
+
+  CHECK_EQ(0, heap->old_space()->ExternalBackingStoreBytes(type) -
+                  old_backing_store_before);
+}
+
+}  // namespace heap
+}  // namespace internal
+}  // namespace v8
+
+#undef TEST_STR
diff --git a/deps/v8/test/cctest/heap/test-heap.cc b/deps/v8/test/cctest/heap/test-heap.cc
index 311eadcc992cde..c35f665106b74d 100644
--- a/deps/v8/test/cctest/heap/test-heap.cc
+++ b/deps/v8/test/cctest/heap/test-heap.cc
@@ -3030,7 +3030,7 @@ TEST(PrintSharedFunctionInfo) {
           CcTest::global()->Get(ctx, v8_str("g")).ToLocalChecked())));
 
   StdoutStream os;
-  g->shared()->Print(g->GetIsolate(), os);
+  g->shared()->Print(os);
   os << std::endl;
 }
 #endif  // OBJECT_PRINT
@@ -4530,7 +4530,7 @@ TEST(Regress507979) {
 
   // Replace parts of an object placed before a live object with a filler. This
   // way the filler object shares the mark bits with the following live object.
-  o1->Shrink(kFixedArrayLen - 1);
+  o1->Shrink(isolate, kFixedArrayLen - 1);
 
   for (HeapObject* obj = it.next(); obj != nullptr; obj = it.next()) {
     // Let's not optimize the loop away.
@@ -4754,7 +4754,7 @@ TEST(FixedArrayOfWeakCells) {
   Handle<FixedArrayOfWeakCells> array =
       FixedArrayOfWeakCells::Add(isolate, Handle<Object>(), number);
   array->Remove(number);
-  array->Compact<FixedArrayOfWeakCells::NullCallback>();
+  array->Compact<FixedArrayOfWeakCells::NullCallback>(isolate);
   FixedArrayOfWeakCells::Add(isolate, array, number);
 }
 
@@ -5337,7 +5337,7 @@ Handle<FixedArray> ShrinkArrayAndCheckSize(Heap* heap, int length) {
       heap->isolate()->factory()->NewFixedArray(length, TENURED);
   size_t size_after_allocation = heap->SizeOfObjects();
   CHECK_EQ(size_after_allocation, size_before_allocation + array->Size());
-  array->Shrink(1);
+  array->Shrink(heap->isolate(), 1);
   size_t size_after_shrinking = heap->SizeOfObjects();
   // Shrinking does not change the space size immediately.
   CHECK_EQ(size_after_allocation, size_after_shrinking);
@@ -5465,7 +5465,7 @@ TEST(Regress631969) {
     s3->MakeExternal(&external_string);
     CcTest::CollectGarbage(OLD_SPACE);
     // This avoids the GC from trying to free stack allocated resources.
-    i::Handle<i::ExternalOneByteString>::cast(s3)->set_resource(nullptr);
+    i::Handle<i::ExternalOneByteString>::cast(s3)->SetResource(nullptr);
   }
 }
 
@@ -5689,7 +5689,7 @@ TEST(UncommitUnusedLargeObjectMemory) {
   intptr_t size_before = array->Size();
   size_t committed_memory_before = chunk->CommittedPhysicalMemory();
 
-  array->Shrink(1);
+  array->Shrink(isolate, 1);
   CHECK(array->Size() < size_before);
 
   CcTest::CollectAllGarbage();
@@ -5843,7 +5843,7 @@ HEAP_TEST(Regress5831) {
   bool overflowed_into_lospace = false;
   for (int i = 0; i < kMaxIterations; i++) {
     Handle<Code> code = GenerateDummyImmovableCode(isolate);
-    array = FixedArray::SetAndGrow(array, i, code);
+    array = FixedArray::SetAndGrow(isolate, array, i, code);
     CHECK(heap->code_space()->Contains(code->address()) ||
           heap->lo_space()->Contains(*code));
     if (heap->lo_space()->Contains(*code)) {
diff --git a/deps/v8/test/cctest/parsing/test-preparser.cc b/deps/v8/test/cctest/parsing/test-preparser.cc
index 8d7a430a6e0b61..b63a079a78f86d 100644
--- a/deps/v8/test/cctest/parsing/test-preparser.cc
+++ b/deps/v8/test/cctest/parsing/test-preparser.cc
@@ -822,7 +822,9 @@ TEST(ProducingAndConsumingByteData) {
   bytes.WriteUint8(255);
   bytes.WriteUint32(0);
   bytes.WriteUint8(0);
+#ifdef DEBUG
   bytes.OverwriteFirstUint32(2017);
+#endif
   bytes.WriteUint8(100);
   // Write quarter bytes between uint8s and uint32s to verify they're stored
   // correctly.
@@ -845,7 +847,11 @@ TEST(ProducingAndConsumingByteData) {
       &bytes_for_reading, *data_on_heap);
 
   // Read the data back.
+#ifdef DEBUG
   CHECK_EQ(bytes_for_reading.ReadUint32(), 2017);
+#else
+  CHECK_EQ(bytes_for_reading.ReadUint32(), 1983);
+#endif
   CHECK_EQ(bytes_for_reading.ReadUint32(), 2147483647);
   CHECK_EQ(bytes_for_reading.ReadUint8(), 4);
   CHECK_EQ(bytes_for_reading.ReadUint8(), 255);
diff --git a/deps/v8/test/cctest/parsing/test-scanner-streams.cc b/deps/v8/test/cctest/parsing/test-scanner-streams.cc
index 6f9b58daf3d830..8021141052231c 100644
--- a/deps/v8/test/cctest/parsing/test-scanner-streams.cc
+++ b/deps/v8/test/cctest/parsing/test-scanner-streams.cc
@@ -323,7 +323,7 @@ void TestCharacterStreams(const char* one_byte_source, unsigned length,
     // This avoids the GC from trying to free a stack allocated resource.
     if (uc16_string->IsExternalString())
       i::Handle<i::ExternalTwoByteString>::cast(uc16_string)
-          ->set_resource(nullptr);
+          ->SetResource(nullptr);
   }
 
   // 1-byte external string
@@ -343,7 +343,7 @@ void TestCharacterStreams(const char* one_byte_source, unsigned length,
     // This avoids the GC from trying to free a stack allocated resource.
     if (ext_one_byte_string->IsExternalString())
       i::Handle<i::ExternalOneByteString>::cast(ext_one_byte_string)
-          ->set_resource(nullptr);
+          ->SetResource(nullptr);
   }
 
   // 1-byte generic i::String
diff --git a/deps/v8/test/cctest/test-api.cc b/deps/v8/test/cctest/test-api.cc
index 55e5ecdcfe01d9..ea4c31e14db617 100644
--- a/deps/v8/test/cctest/test-api.cc
+++ b/deps/v8/test/cctest/test-api.cc
@@ -15654,14 +15654,16 @@ static void MorphAString(i::String* string,
     string->set_map(roots.external_string_map());
     i::ExternalTwoByteString* morphed =
          i::ExternalTwoByteString::cast(string);
-    morphed->set_resource(uc16_resource);
+    CcTest::heap()->UpdateExternalString(morphed, string->length(), 0);
+    morphed->SetResource(uc16_resource);
   } else {
     // Check old map is not internalized or long.
     CHECK(string->map() == roots.external_string_map());
     // Morph external string to be one-byte string.
     string->set_map(roots.external_one_byte_string_map());
     i::ExternalOneByteString* morphed = i::ExternalOneByteString::cast(string);
-    morphed->set_resource(one_byte_resource);
+    CcTest::heap()->UpdateExternalString(morphed, string->length(), 0);
+    morphed->SetResource(one_byte_resource);
   }
 }
 
@@ -15749,13 +15751,13 @@ THREADED_TEST(MorphCompositeStringTest) {
 
     // This avoids the GC from trying to free a stack allocated resource.
     if (ilhs->IsExternalOneByteString())
-      i::ExternalOneByteString::cast(ilhs)->set_resource(nullptr);
+      i::ExternalOneByteString::cast(ilhs)->SetResource(nullptr);
     else
-      i::ExternalTwoByteString::cast(ilhs)->set_resource(nullptr);
+      i::ExternalTwoByteString::cast(ilhs)->SetResource(nullptr);
     if (irhs->IsExternalOneByteString())
-      i::ExternalOneByteString::cast(irhs)->set_resource(nullptr);
+      i::ExternalOneByteString::cast(irhs)->SetResource(nullptr);
     else
-      i::ExternalTwoByteString::cast(irhs)->set_resource(nullptr);
+      i::ExternalTwoByteString::cast(irhs)->SetResource(nullptr);
   }
   i::DeleteArray(two_byte_string);
 }
@@ -20375,7 +20377,7 @@ THREADED_TEST(TwoByteStringInOneByteCons) {
   CHECK_EQ(static_cast<int32_t>('e'),
            reresult->Int32Value(context.local()).FromJust());
   // This avoids the GC from trying to free stack allocated resources.
-  i::Handle<i::ExternalTwoByteString>::cast(flat_string)->set_resource(nullptr);
+  i::Handle<i::ExternalTwoByteString>::cast(flat_string)->SetResource(nullptr);
 }
 
 
diff --git a/deps/v8/test/cctest/test-assembler-arm.cc b/deps/v8/test/cctest/test-assembler-arm.cc
index e5edb5472ece7f..6ed918a533b5ff 100644
--- a/deps/v8/test/cctest/test-assembler-arm.cc
+++ b/deps/v8/test/cctest/test-assembler-arm.cc
@@ -64,7 +64,7 @@ TEST(0) {
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef DEBUG
   StdoutStream os;
-  code->Print(isolate, os);
+  code->Print(os);
 #endif
   auto f = GeneratedCode<F_iiiii>::FromCode(*code);
   int res = reinterpret_cast<int>(f.Call(3, 4, 0, 0, 0));
@@ -100,7 +100,7 @@ TEST(1) {
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef DEBUG
   StdoutStream os;
-  code->Print(isolate, os);
+  code->Print(os);
 #endif
   auto f = GeneratedCode<F_iiiii>::FromCode(*code);
   int res = reinterpret_cast<int>(f.Call(100, 0, 0, 0, 0));
@@ -145,7 +145,7 @@ TEST(2) {
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef DEBUG
   StdoutStream os;
-  code->Print(isolate, os);
+  code->Print(os);
 #endif
   auto f = GeneratedCode<F_iiiii>::FromCode(*code);
   int res = reinterpret_cast<int>(f.Call(10, 0, 0, 0, 0));
@@ -192,7 +192,7 @@ TEST(3) {
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef DEBUG
   StdoutStream os;
-  code->Print(isolate, os);
+  code->Print(os);
 #endif
   auto f = GeneratedCode<F_piiii>::FromCode(*code);
   t.i = 100000;
@@ -323,7 +323,7 @@ TEST(4) {
         isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef DEBUG
     StdoutStream os;
-    code->Print(isolate, os);
+    code->Print(os);
 #endif
     auto f = GeneratedCode<F_piiii>::FromCode(*code);
     t.a = 1.5;
@@ -385,7 +385,7 @@ TEST(5) {
         isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef DEBUG
     StdoutStream os;
-    code->Print(isolate, os);
+    code->Print(os);
 #endif
     auto f = GeneratedCode<F_iiiii>::FromCode(*code);
     int res = reinterpret_cast<int>(f.Call(0xAAAAAAAA, 0, 0, 0, 0));
@@ -416,7 +416,7 @@ TEST(6) {
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef DEBUG
   StdoutStream os;
-  code->Print(isolate, os);
+  code->Print(os);
 #endif
   auto f = GeneratedCode<F_iiiii>::FromCode(*code);
   int res = reinterpret_cast<int>(f.Call(0xFFFF, 0, 0, 0, 0));
@@ -484,7 +484,7 @@ static void TestRoundingMode(VCVTTypes types,
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef DEBUG
   StdoutStream os;
-  code->Print(isolate, os);
+  code->Print(os);
 #endif
   auto f = GeneratedCode<F_iiiii>::FromCode(*code);
   int res = reinterpret_cast<int>(f.Call(0, 0, 0, 0, 0));
@@ -666,7 +666,7 @@ TEST(8) {
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef DEBUG
   StdoutStream os;
-  code->Print(isolate, os);
+  code->Print(os);
 #endif
   auto fn = GeneratedCode<F_ppiii>::FromCode(*code);
   d.a = 1.1;
@@ -775,7 +775,7 @@ TEST(9) {
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef DEBUG
   StdoutStream os;
-  code->Print(isolate, os);
+  code->Print(os);
 #endif
   auto fn = GeneratedCode<F_ppiii>::FromCode(*code);
   d.a = 1.1;
@@ -880,7 +880,7 @@ TEST(10) {
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef DEBUG
   StdoutStream os;
-  code->Print(isolate, os);
+  code->Print(os);
 #endif
   auto fn = GeneratedCode<F_ppiii>::FromCode(*code);
   d.a = 1.1;
@@ -974,7 +974,7 @@ TEST(11) {
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef DEBUG
   StdoutStream os;
-  code->Print(isolate, os);
+  code->Print(os);
 #endif
   auto f = GeneratedCode<F_piiii>::FromCode(*code);
   f.Call(&i, 0, 0, 0, 0);
@@ -1100,7 +1100,7 @@ TEST(13) {
         isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef DEBUG
     StdoutStream os;
-    code->Print(isolate, os);
+    code->Print(os);
 #endif
     auto f = GeneratedCode<F_piiii>::FromCode(*code);
     t.a = 1.5;
@@ -1172,7 +1172,7 @@ TEST(14) {
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef DEBUG
   StdoutStream os;
-  code->Print(isolate, os);
+  code->Print(os);
 #endif
   auto f = GeneratedCode<F_piiii>::FromCode(*code);
   t.left = bit_cast<double>(kHoleNanInt64);
@@ -2052,7 +2052,7 @@ TEST(15) {
         isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef DEBUG
     StdoutStream os;
-    code->Print(isolate, os);
+    code->Print(os);
 #endif
     auto f = GeneratedCode<F_piiii>::FromCode(*code);
     t.src0 = 0x01020304;
@@ -2328,7 +2328,7 @@ TEST(16) {
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef DEBUG
   StdoutStream os;
-  code->Print(isolate, os);
+  code->Print(os);
 #endif
   auto f = GeneratedCode<F_piiii>::FromCode(*code);
   t.src0 = 0x01020304;
@@ -2406,7 +2406,7 @@ TEST(sdiv) {
         isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef DEBUG
     StdoutStream os;
-    code->Print(isolate, os);
+    code->Print(os);
 #endif
     auto f = GeneratedCode<F_piiii>::FromCode(*code);
     TEST_SDIV(0, kMinInt, 0);
@@ -2466,7 +2466,7 @@ TEST(udiv) {
         isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef DEBUG
     StdoutStream os;
-    code->Print(isolate, os);
+    code->Print(os);
 #endif
     auto f = GeneratedCode<F_piiii>::FromCode(*code);
     TEST_UDIV(0u, 0, 0);
@@ -2494,7 +2494,7 @@ TEST(smmla) {
   Handle<Code> code =
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef OBJECT_PRINT
-  code->Print(isolate, std::cout);
+  code->Print(std::cout);
 #endif
   auto f = GeneratedCode<F_piiii>::FromCode(*code);
   for (size_t i = 0; i < 128; ++i) {
@@ -2519,7 +2519,7 @@ TEST(smmul) {
   Handle<Code> code =
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef OBJECT_PRINT
-  code->Print(isolate, std::cout);
+  code->Print(std::cout);
 #endif
   auto f = GeneratedCode<F_piiii>::FromCode(*code);
   for (size_t i = 0; i < 128; ++i) {
@@ -2544,7 +2544,7 @@ TEST(sxtb) {
   Handle<Code> code =
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef OBJECT_PRINT
-  code->Print(isolate, std::cout);
+  code->Print(std::cout);
 #endif
   auto f = GeneratedCode<F_piiii>::FromCode(*code);
   for (size_t i = 0; i < 128; ++i) {
@@ -2569,7 +2569,7 @@ TEST(sxtab) {
   Handle<Code> code =
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef OBJECT_PRINT
-  code->Print(isolate, std::cout);
+  code->Print(std::cout);
 #endif
   auto f = GeneratedCode<F_piiii>::FromCode(*code);
   for (size_t i = 0; i < 128; ++i) {
@@ -2594,7 +2594,7 @@ TEST(sxth) {
   Handle<Code> code =
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef OBJECT_PRINT
-  code->Print(isolate, std::cout);
+  code->Print(std::cout);
 #endif
   auto f = GeneratedCode<F_piiii>::FromCode(*code);
   for (size_t i = 0; i < 128; ++i) {
@@ -2619,7 +2619,7 @@ TEST(sxtah) {
   Handle<Code> code =
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef OBJECT_PRINT
-  code->Print(isolate, std::cout);
+  code->Print(std::cout);
 #endif
   auto f = GeneratedCode<F_piiii>::FromCode(*code);
   for (size_t i = 0; i < 128; ++i) {
@@ -2644,7 +2644,7 @@ TEST(uxtb) {
   Handle<Code> code =
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef OBJECT_PRINT
-  code->Print(isolate, std::cout);
+  code->Print(std::cout);
 #endif
   auto f = GeneratedCode<F_piiii>::FromCode(*code);
   for (size_t i = 0; i < 128; ++i) {
@@ -2669,7 +2669,7 @@ TEST(uxtab) {
   Handle<Code> code =
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef OBJECT_PRINT
-  code->Print(isolate, std::cout);
+  code->Print(std::cout);
 #endif
   auto f = GeneratedCode<F_piiii>::FromCode(*code);
   for (size_t i = 0; i < 128; ++i) {
@@ -2694,7 +2694,7 @@ TEST(uxth) {
   Handle<Code> code =
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef OBJECT_PRINT
-  code->Print(isolate, std::cout);
+  code->Print(std::cout);
 #endif
   auto f = GeneratedCode<F_piiii>::FromCode(*code);
   for (size_t i = 0; i < 128; ++i) {
@@ -2719,7 +2719,7 @@ TEST(uxtah) {
   Handle<Code> code =
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef OBJECT_PRINT
-  code->Print(isolate, std::cout);
+  code->Print(std::cout);
 #endif
   auto f = GeneratedCode<F_piiii>::FromCode(*code);
   for (size_t i = 0; i < 128; ++i) {
@@ -2761,7 +2761,7 @@ TEST(rbit) {
         isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 
 #ifdef OBJECT_PRINT
-    code->Print(isolate, std::cout);
+    code->Print(std::cout);
 #endif
 
     auto f = GeneratedCode<F_piiii>::FromCode(*code);
@@ -2881,7 +2881,7 @@ TEST(msr_mrs) {
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef DEBUG
   StdoutStream os;
-  code->Print(isolate, os);
+  code->Print(os);
 #endif
   auto f = GeneratedCode<F_ippii>::FromCode(*code);
 
@@ -2979,7 +2979,7 @@ TEST(ARMv8_float32_vrintX) {
         isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef DEBUG
     StdoutStream os;
-    code->Print(isolate, os);
+    code->Print(os);
 #endif
     auto f = GeneratedCode<F_piiii>::FromCode(*code);
 
@@ -3081,7 +3081,7 @@ TEST(ARMv8_vrintX) {
         isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef DEBUG
     StdoutStream os;
-    code->Print(isolate, os);
+    code->Print(os);
 #endif
     auto f = GeneratedCode<F_piiii>::FromCode(*code);
 
@@ -3218,7 +3218,7 @@ TEST(ARMv8_vsel) {
         isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef DEBUG
     StdoutStream os;
-    code->Print(isolate, os);
+    code->Print(os);
 #endif
     auto f = GeneratedCode<F_ippii>::FromCode(*code);
 
@@ -3309,7 +3309,7 @@ TEST(ARMv8_vminmax_f64) {
         isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef DEBUG
     StdoutStream os;
-    code->Print(isolate, os);
+    code->Print(os);
 #endif
     auto f = GeneratedCode<F_ppiii>::FromCode(*code);
 
@@ -3389,7 +3389,7 @@ TEST(ARMv8_vminmax_f32) {
         isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef DEBUG
     StdoutStream os;
-    code->Print(isolate, os);
+    code->Print(os);
 #endif
     auto f = GeneratedCode<F_ppiii>::FromCode(*code);
 
@@ -3519,7 +3519,7 @@ static GeneratedCode<F_ppiii> GenerateMacroFloatMinMax(MacroAssembler& assm) {
       assm.isolate()->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef DEBUG
   StdoutStream os;
-  code->Print(assm.isolate(), os);
+  code->Print(os);
 #endif
   return GeneratedCode<F_ppiii>::FromCode(*code);
 }
@@ -3682,7 +3682,7 @@ TEST(unaligned_loads) {
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef DEBUG
   StdoutStream os;
-  code->Print(isolate, os);
+  code->Print(os);
 #endif
   auto f = GeneratedCode<F_ppiii>::FromCode(*code);
 
@@ -3725,7 +3725,7 @@ TEST(unaligned_stores) {
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef DEBUG
   StdoutStream os;
-  code->Print(isolate, os);
+  code->Print(os);
 #endif
   auto f = GeneratedCode<F_ppiii>::FromCode(*code);
 
@@ -3825,7 +3825,7 @@ TEST(vswp) {
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef DEBUG
   StdoutStream os;
-  code->Print(isolate, os);
+  code->Print(os);
 #endif
   auto f = GeneratedCode<F_piiii>::FromCode(*code);
   f.Call(&t, 0, 0, 0, 0);
@@ -4037,7 +4037,7 @@ TEST(split_add_immediate) {
         isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef DEBUG
     StdoutStream os;
-    code->Print(isolate, os);
+    code->Print(os);
 #endif
     auto f = GeneratedCode<F_iiiii>::FromCode(*code);
     uint32_t res = reinterpret_cast<int>(f.Call(0, 0, 0, 0, 0));
@@ -4057,7 +4057,7 @@ TEST(split_add_immediate) {
         isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef DEBUG
     StdoutStream os;
-    code->Print(isolate, os);
+    code->Print(os);
 #endif
     auto f = GeneratedCode<F_iiiii>::FromCode(*code);
     uint32_t res = reinterpret_cast<int>(f.Call(0, 0, 0, 0, 0));
@@ -4080,7 +4080,7 @@ TEST(split_add_immediate) {
         isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef DEBUG
     StdoutStream os;
-    code->Print(isolate, os);
+    code->Print(os);
 #endif
     auto f = GeneratedCode<F_iiiii>::FromCode(*code);
     uint32_t res = reinterpret_cast<int>(f.Call(0, 0, 0, 0, 0));
diff --git a/deps/v8/test/cctest/test-assembler-ia32.cc b/deps/v8/test/cctest/test-assembler-ia32.cc
index 3650f1a7462909..562dc5a8abea63 100644
--- a/deps/v8/test/cctest/test-assembler-ia32.cc
+++ b/deps/v8/test/cctest/test-assembler-ia32.cc
@@ -66,7 +66,7 @@ TEST(AssemblerIa320) {
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef OBJECT_PRINT
   StdoutStream os;
-  code->Print(isolate, os);
+  code->Print(os);
 #endif
   F2 f = FUNCTION_CAST<F2>(code->entry());
   int res = f(3, 4);
@@ -103,7 +103,7 @@ TEST(AssemblerIa321) {
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef OBJECT_PRINT
   StdoutStream os;
-  code->Print(isolate, os);
+  code->Print(os);
 #endif
   F1 f = FUNCTION_CAST<F1>(code->entry());
   int res = f(100);
@@ -144,7 +144,7 @@ TEST(AssemblerIa322) {
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef OBJECT_PRINT
   StdoutStream os;
-  code->Print(isolate, os);
+  code->Print(os);
 #endif
   F1 f = FUNCTION_CAST<F1>(code->entry());
   int res = f(10);
@@ -173,7 +173,7 @@ TEST(AssemblerIa323) {
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef OBJECT_PRINT
   StdoutStream os;
-  code->Print(isolate, os);
+  code->Print(os);
 #endif
   F3 f = FUNCTION_CAST<F3>(code->entry());
   int res = f(static_cast<float>(-3.1415));
@@ -202,7 +202,7 @@ TEST(AssemblerIa324) {
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef OBJECT_PRINT
   StdoutStream os;
-  code->Print(isolate, os);
+  code->Print(os);
 #endif
   F4 f = FUNCTION_CAST<F4>(code->entry());
   int res = f(2.718281828);
@@ -262,7 +262,7 @@ TEST(AssemblerIa326) {
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef OBJECT_PRINT
   StdoutStream os;
-  code->Print(isolate, os);
+  code->Print(os);
 #endif
   F5 f = FUNCTION_CAST<F5>(code->entry());
   double res = f(2.2, 1.1);
@@ -294,7 +294,7 @@ TEST(AssemblerIa328) {
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef OBJECT_PRINT
   StdoutStream os;
-  code->Print(isolate, os);
+  code->Print(os);
 #endif
   F6 f = FUNCTION_CAST<F6>(code->entry());
   double res = f(12);
@@ -491,7 +491,7 @@ TEST(AssemblerIa32Extractps) {
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef OBJECT_PRINT
   StdoutStream os;
-  code->Print(isolate, os);
+  code->Print(os);
 #endif
 
   F4 f = FUNCTION_CAST<F4>(code->entry());
@@ -531,7 +531,7 @@ TEST(AssemblerIa32SSE) {
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef OBJECT_PRINT
   StdoutStream os;
-  code->Print(isolate, os);
+  code->Print(os);
 #endif
 
   F8 f = FUNCTION_CAST<F8>(code->entry());
@@ -564,7 +564,7 @@ TEST(AssemblerIa32SSE3) {
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef OBJECT_PRINT
   StdoutStream os;
-  code->Print(isolate, os);
+  code->Print(os);
 #endif
 
   F8 f = FUNCTION_CAST<F8>(code->entry());
@@ -792,7 +792,7 @@ TEST(AssemblerX64FMA_sd) {
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef OBJECT_PRINT
   StdoutStream os;
-  code->Print(isolate, os);
+  code->Print(os);
 #endif
 
   F9 f = FUNCTION_CAST<F9>(code->entry());
@@ -1021,7 +1021,7 @@ TEST(AssemblerX64FMA_ss) {
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef OBJECT_PRINT
   StdoutStream os;
-  code->Print(isolate, os);
+  code->Print(os);
 #endif
 
   F10 f = FUNCTION_CAST<F10>(code->entry());
@@ -1129,7 +1129,7 @@ TEST(AssemblerIa32BMI1) {
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef OBJECT_PRINT
   StdoutStream os;
-  code->Print(isolate, os);
+  code->Print(os);
 #endif
 
   F0 f = FUNCTION_CAST<F0>(code->entry());
@@ -1177,7 +1177,7 @@ TEST(AssemblerIa32LZCNT) {
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef OBJECT_PRINT
   StdoutStream os;
-  code->Print(isolate, os);
+  code->Print(os);
 #endif
 
   F0 f = FUNCTION_CAST<F0>(code->entry());
@@ -1225,7 +1225,7 @@ TEST(AssemblerIa32POPCNT) {
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef OBJECT_PRINT
   StdoutStream os;
-  code->Print(isolate, os);
+  code->Print(os);
 #endif
 
   F0 f = FUNCTION_CAST<F0>(code->entry());
@@ -1371,7 +1371,7 @@ TEST(AssemblerIa32BMI2) {
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef OBJECT_PRINT
   StdoutStream os;
-  code->Print(isolate, os);
+  code->Print(os);
 #endif
 
   F0 f = FUNCTION_CAST<F0>(code->entry());
@@ -1415,7 +1415,7 @@ TEST(AssemblerIa32JumpTables1) {
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef OBJECT_PRINT
   StdoutStream os;
-  code->Print(isolate, os);
+  code->Print(os);
 #endif
   F1 f = FUNCTION_CAST<F1>(code->entry());
   for (int i = 0; i < kNumCases; ++i) {
@@ -1463,7 +1463,7 @@ TEST(AssemblerIa32JumpTables2) {
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef OBJECT_PRINT
   StdoutStream os;
-  code->Print(isolate, os);
+  code->Print(os);
 #endif
   F1 f = FUNCTION_CAST<F1>(code->entry());
   for (int i = 0; i < kNumCases; ++i) {
@@ -1507,7 +1507,7 @@ TEST(Regress621926) {
 
 #ifdef OBJECT_PRINT
   StdoutStream os;
-  code->Print(isolate, os);
+  code->Print(os);
 #endif
 
   F0 f = FUNCTION_CAST<F0>(code->entry());
diff --git a/deps/v8/test/cctest/test-assembler-mips.cc b/deps/v8/test/cctest/test-assembler-mips.cc
index e3880b533158ca..4538e8ac78d01f 100644
--- a/deps/v8/test/cctest/test-assembler-mips.cc
+++ b/deps/v8/test/cctest/test-assembler-mips.cc
@@ -3202,7 +3202,7 @@ TEST(jump_tables1) {
   Handle<Code> code =
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef OBJECT_PRINT
-  code->Print(isolate, std::cout);
+  code->Print(std::cout);
 #endif
   auto f = GeneratedCode<F1>::FromCode(*code);
   for (int i = 0; i < kNumCases; ++i) {
@@ -3271,7 +3271,7 @@ TEST(jump_tables2) {
   Handle<Code> code =
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef OBJECT_PRINT
-  code->Print(isolate, std::cout);
+  code->Print(std::cout);
 #endif
   auto f = GeneratedCode<F1>::FromCode(*code);
   for (int i = 0; i < kNumCases; ++i) {
@@ -3347,14 +3347,14 @@ TEST(jump_tables3) {
   Handle<Code> code =
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef OBJECT_PRINT
-  code->Print(isolate, std::cout);
+  code->Print(std::cout);
 #endif
   auto f = GeneratedCode<F1>::FromCode(*code);
   for (int i = 0; i < kNumCases; ++i) {
     Handle<Object> result(f.Call(i, 0, 0, 0, 0), isolate);
 #ifdef OBJECT_PRINT
     ::printf("f(%d) = ", i);
-    result->Print(isolate, std::cout);
+    result->Print(std::cout);
     ::printf("\n");
 #endif
     CHECK(values[i].is_identical_to(result));
@@ -5013,7 +5013,7 @@ void run_bz_bnz(TestCaseMsaBranch* input, Branch GenerateBranch,
   Handle<Code> code =
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef OBJECT_PRINT
-  code->Print(isolate, std::cout);
+  code->Print(std::cout);
 #endif
   auto f = GeneratedCode<F3>::FromCode(*code);
 
@@ -5830,7 +5830,7 @@ TEST(MSA_fill_copy) {
   Handle<Code> code =
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef OBJECT_PRINT
-  code->Print(isolate, std::cout);
+  code->Print(std::cout);
 #endif
   auto f = GeneratedCode<F3>::FromCode(*code);
 
@@ -5899,7 +5899,7 @@ TEST(MSA_fill_copy_2) {
   Handle<Code> code =
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef OBJECT_PRINT
-  code->Print(isolate, std::cout);
+  code->Print(std::cout);
 #endif
   auto f = GeneratedCode<F4>::FromCode(*code);
 
@@ -5957,7 +5957,7 @@ TEST(MSA_fill_copy_3) {
   Handle<Code> code =
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef OBJECT_PRINT
-  code->Print(isolate, std::cout);
+  code->Print(std::cout);
 #endif
   auto f = GeneratedCode<F4>::FromCode(*code);
 
@@ -6003,7 +6003,7 @@ void run_msa_insert(int32_t rs_value, int n, msa_reg_t* w) {
   Handle<Code> code =
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef OBJECT_PRINT
-  code->Print(isolate, std::cout);
+  code->Print(std::cout);
 #endif
   auto f = GeneratedCode<F3>::FromCode(*code);
 
@@ -6104,7 +6104,7 @@ TEST(MSA_move_v) {
     Handle<Code> code =
         isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef OBJECT_PRINT
-    code->Print(isolate, std::cout);
+    code->Print(std::cout);
 #endif
     auto f = GeneratedCode<F3>::FromCode(*code);
     (f.Call(&t[i].wd_lo, 0, 0, 0, 0));
@@ -6150,7 +6150,7 @@ void run_msa_sldi(OperFunc GenerateOperation,
     Handle<Code> code =
         isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef OBJECT_PRINT
-    code->Print(isolate, std::cout);
+    code->Print(std::cout);
 #endif
     auto f = GeneratedCode<F3>::FromCode(*code);
     (f.Call(&res[0], 0, 0, 0, 0));
@@ -6236,7 +6236,7 @@ void run_msa_ctc_cfc(uint32_t value) {
   Handle<Code> code =
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef OBJECT_PRINT
-  code->Print(isolate, std::cout);
+  code->Print(std::cout);
 #endif
   auto f = GeneratedCode<F3>::FromCode(*code);
 
@@ -6347,7 +6347,7 @@ void run_msa_i8(SecondaryField opcode, uint64_t ws_lo, uint64_t ws_hi,
   Handle<Code> code =
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef OBJECT_PRINT
-  code->Print(isolate, std::cout);
+  code->Print(std::cout);
 #endif
   auto f = GeneratedCode<F3>::FromCode(*code);
 
@@ -6640,7 +6640,7 @@ void run_msa_i5(struct TestCaseMsaI5* input, bool i5_sign_ext,
   Handle<Code> code =
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef OBJECT_PRINT
-  code->Print(isolate, std::cout);
+  code->Print(std::cout);
 #endif
   auto f = GeneratedCode<F3>::FromCode(*code);
 
@@ -7061,7 +7061,7 @@ void run_msa_2r(const struct TestCaseMsa2R* input,
   Handle<Code> code =
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef OBJECT_PRINT
-  code->Print(isolate, std::cout);
+  code->Print(std::cout);
 #endif
   auto f = GeneratedCode<F3>::FromCode(*code);
 
@@ -8112,7 +8112,7 @@ void run_msa_vector(struct TestCaseMsaVector* input,
   Handle<Code> code =
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef OBJECT_PRINT
-  code->Print(isolate, std::cout);
+  code->Print(std::cout);
 #endif
   auto f = GeneratedCode<F3>::FromCode(*code);
 
@@ -8201,7 +8201,7 @@ void run_msa_bit(struct TestCaseMsaBit* input, InstFunc GenerateInstructionFunc,
   Handle<Code> code =
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef OBJECT_PRINT
-  code->Print(isolate, std::cout);
+  code->Print(std::cout);
 #endif
   auto f = GeneratedCode<F3>::FromCode(*code);
 
@@ -8675,7 +8675,7 @@ void run_msa_i10(int32_t input, InstFunc GenerateVectorInstructionFunc,
   Handle<Code> code =
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef OBJECT_PRINT
-  code->Print(isolate, std::cout);
+  code->Print(std::cout);
 #endif
   auto f = GeneratedCode<F3>::FromCode(*code);
 
@@ -8754,7 +8754,7 @@ void run_msa_mi10(InstFunc GenerateVectorInstructionFunc) {
   Handle<Code> code =
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef OBJECT_PRINT
-  code->Print(isolate, std::cout);
+  code->Print(std::cout);
 #endif
   auto f = GeneratedCode<F4>::FromCode(*code);
 
@@ -8834,7 +8834,7 @@ void run_msa_3r(struct TestCaseMsa3R* input, InstFunc GenerateI5InstructionFunc,
   Handle<Code> code =
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef OBJECT_PRINT
-  code->Print(isolate, std::cout);
+  code->Print(std::cout);
 #endif
   auto f = GeneratedCode<F3>::FromCode(*code);
 
@@ -9840,7 +9840,7 @@ void run_msa_3rf(const struct TestCaseMsa3RF* input,
   Handle<Code> code =
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef OBJECT_PRINT
-  code->Print(isolate, std::cout);
+  code->Print(std::cout);
 #endif
   auto f = GeneratedCode<F3>::FromCode(*code);
 
diff --git a/deps/v8/test/cctest/test-assembler-mips64.cc b/deps/v8/test/cctest/test-assembler-mips64.cc
index e048636dcb05b9..bd96375c4864cb 100644
--- a/deps/v8/test/cctest/test-assembler-mips64.cc
+++ b/deps/v8/test/cctest/test-assembler-mips64.cc
@@ -3330,7 +3330,7 @@ TEST(jump_tables1) {
   Handle<Code> code =
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef OBJECT_PRINT
-  code->Print(isolate, std::cout);
+  code->Print(std::cout);
 #endif
   auto f = GeneratedCode<F1>::FromCode(*code);
   for (int i = 0; i < kNumCases; ++i) {
@@ -3400,7 +3400,7 @@ TEST(jump_tables2) {
   Handle<Code> code =
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef OBJECT_PRINT
-  code->Print(isolate, std::cout);
+  code->Print(std::cout);
 #endif
   auto f = GeneratedCode<F1>::FromCode(*code);
   for (int i = 0; i < kNumCases; ++i) {
@@ -3480,14 +3480,14 @@ TEST(jump_tables3) {
   Handle<Code> code =
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef OBJECT_PRINT
-  code->Print(isolate, std::cout);
+  code->Print(std::cout);
 #endif
   auto f = GeneratedCode<F1>::FromCode(*code);
   for (int i = 0; i < kNumCases; ++i) {
     Handle<Object> result(f.Call(i, 0, 0, 0, 0), isolate);
 #ifdef OBJECT_PRINT
     ::printf("f(%d) = ", i);
-    result->Print(isolate, std::cout);
+    result->Print(std::cout);
     ::printf("\n");
 #endif
     CHECK(values[i].is_identical_to(result));
@@ -5087,7 +5087,7 @@ uint64_t run_li_macro(uint64_t imm, LiFlags mode, int32_t num_instr = 0) {
   Handle<Code> code =
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef OBJECT_PRINT
-  code->Print(isolate, std::cout);
+  code->Print(std::cout);
 #endif
   auto f = GeneratedCode<F2>::FromCode(*code);
 
@@ -5639,7 +5639,7 @@ void run_bz_bnz(TestCaseMsaBranch* input, Branch GenerateBranch,
   Handle<Code> code =
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef OBJECT_PRINT
-  code->Print(isolate, std::cout);
+  code->Print(std::cout);
 #endif
   auto f = GeneratedCode<F3>::FromCode(*code);
 
@@ -6428,7 +6428,7 @@ uint64_t run_Subu(uint64_t imm, int32_t num_instr) {
   Handle<Code> code =
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef OBJECT_PRINT
-  code->Print(isolate, std::cout);
+  code->Print(std::cout);
 #endif
   auto f = GeneratedCode<F2>::FromCode(*code);
 
@@ -6512,7 +6512,7 @@ uint64_t run_Dsubu(uint64_t imm, int32_t num_instr) {
   Handle<Code> code =
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef OBJECT_PRINT
-  code->Print(isolate, std::cout);
+  code->Print(std::cout);
 #endif
   auto f = GeneratedCode<F2>::FromCode(*code);
 
@@ -6823,7 +6823,7 @@ TEST(MSA_fill_copy) {
   Handle<Code> code =
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef OBJECT_PRINT
-  code->Print(isolate, std::cout);
+  code->Print(std::cout);
 #endif
   auto f = GeneratedCode<F3>::FromCode(*code);
 
@@ -6887,7 +6887,7 @@ TEST(MSA_fill_copy_2) {
   Handle<Code> code =
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef OBJECT_PRINT
-  code->Print(isolate, std::cout);
+  code->Print(std::cout);
 #endif
   auto f = GeneratedCode<F5>::FromCode(*code);
 
@@ -6941,7 +6941,7 @@ TEST(MSA_fill_copy_3) {
   Handle<Code> code =
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef OBJECT_PRINT
-  code->Print(isolate, std::cout);
+  code->Print(std::cout);
 #endif
   auto f = GeneratedCode<F5>::FromCode(*code);
 
@@ -6991,7 +6991,7 @@ void run_msa_insert(int64_t rs_value, int n, msa_reg_t* w) {
   Handle<Code> code =
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef OBJECT_PRINT
-  code->Print(isolate, std::cout);
+  code->Print(std::cout);
 #endif
   auto f = GeneratedCode<F3>::FromCode(*code);
 
@@ -7102,7 +7102,7 @@ void run_msa_ctc_cfc(uint64_t value) {
   Handle<Code> code =
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef OBJECT_PRINT
-  code->Print(isolate, std::cout);
+  code->Print(std::cout);
 #endif
   auto f = GeneratedCode<F3>::FromCode(*code);
 
@@ -7152,7 +7152,7 @@ TEST(MSA_move_v) {
     Handle<Code> code =
         isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef OBJECT_PRINT
-    code->Print(isolate, std::cout);
+    code->Print(std::cout);
 #endif
     auto f = GeneratedCode<F3>::FromCode(*code);
     f.Call(&t[i].wd_lo, 0, 0, 0, 0);
@@ -7198,7 +7198,7 @@ void run_msa_sldi(OperFunc GenerateOperation,
     Handle<Code> code =
         isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef OBJECT_PRINT
-    code->Print(isolate, std::cout);
+    code->Print(std::cout);
 #endif
     auto f = GeneratedCode<F3>::FromCode(*code);
     f.Call(&res[0], 0, 0, 0, 0);
@@ -7359,7 +7359,7 @@ void run_msa_i8(SecondaryField opcode, uint64_t ws_lo, uint64_t ws_hi,
   Handle<Code> code =
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef OBJECT_PRINT
-  code->Print(isolate, std::cout);
+  code->Print(std::cout);
 #endif
   auto f = GeneratedCode<F3>::FromCode(*code);
 
@@ -7564,7 +7564,7 @@ void run_msa_i5(struct TestCaseMsaI5* input, bool i5_sign_ext,
   Handle<Code> code =
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef OBJECT_PRINT
-  code->Print(isolate, std::cout);
+  code->Print(std::cout);
 #endif
   auto f = GeneratedCode<F3>::FromCode(*code);
 
@@ -7991,7 +7991,7 @@ void run_msa_2r(const struct TestCaseMsa2R* input,
   Handle<Code> code =
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef OBJECT_PRINT
-  code->Print(isolate, std::cout);
+  code->Print(std::cout);
 #endif
   auto f = GeneratedCode<F3>::FromCode(*code);
 
@@ -9042,7 +9042,7 @@ void run_msa_vector(struct TestCaseMsaVector* input,
   Handle<Code> code =
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef OBJECT_PRINT
-  code->Print(isolate, std::cout);
+  code->Print(std::cout);
 #endif
   auto f = GeneratedCode<F3>::FromCode(*code);
 
@@ -9131,7 +9131,7 @@ void run_msa_bit(struct TestCaseMsaBit* input, InstFunc GenerateInstructionFunc,
   Handle<Code> code =
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef OBJECT_PRINT
-  code->Print(isolate, std::cout);
+  code->Print(std::cout);
 #endif
   auto f = GeneratedCode<F3>::FromCode(*code);
 
@@ -9605,7 +9605,7 @@ void run_msa_i10(int32_t input, InstFunc GenerateVectorInstructionFunc,
   Handle<Code> code =
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef OBJECT_PRINT
-  code->Print(isolate, std::cout);
+  code->Print(std::cout);
 #endif
   auto f = GeneratedCode<F3>::FromCode(*code);
 
@@ -9684,7 +9684,7 @@ void run_msa_mi10(InstFunc GenerateVectorInstructionFunc) {
   Handle<Code> code =
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef OBJECT_PRINT
-  code->Print(isolate, std::cout);
+  code->Print(std::cout);
 #endif
   auto f = GeneratedCode<F5>::FromCode(*code);
 
@@ -9764,7 +9764,7 @@ void run_msa_3r(struct TestCaseMsa3R* input, InstFunc GenerateI5InstructionFunc,
   Handle<Code> code =
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef OBJECT_PRINT
-  code->Print(isolate, std::cout);
+  code->Print(std::cout);
 #endif
   auto f = GeneratedCode<F3>::FromCode(*code);
 
@@ -10769,7 +10769,7 @@ void run_msa_3rf(const struct TestCaseMsa3RF* input,
   Handle<Code> code =
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef OBJECT_PRINT
-  code->Print(isolate, std::cout);
+  code->Print(std::cout);
 #endif
   auto f = GeneratedCode<F3>::FromCode(*code);
 
diff --git a/deps/v8/test/cctest/test-assembler-ppc.cc b/deps/v8/test/cctest/test-assembler-ppc.cc
index de8f458b248581..08559cd7623d9f 100644
--- a/deps/v8/test/cctest/test-assembler-ppc.cc
+++ b/deps/v8/test/cctest/test-assembler-ppc.cc
@@ -64,7 +64,7 @@ TEST(0) {
   Handle<Code> code =
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef DEBUG
-  code->Print(isolate);
+  code->Print();
 #endif
   auto f = GeneratedCode<F_iiiii>::FromCode(*code);
   intptr_t res = reinterpret_cast<intptr_t>(f.Call(3, 4, 0, 0, 0));
@@ -102,7 +102,7 @@ TEST(1) {
   Handle<Code> code =
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef DEBUG
-  code->Print(isolate);
+  code->Print();
 #endif
   auto f = GeneratedCode<F_iiiii>::FromCode(*code);
   intptr_t res = reinterpret_cast<intptr_t>(f.Call(100, 0, 0, 0, 0));
@@ -152,7 +152,7 @@ TEST(2) {
   Handle<Code> code =
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef DEBUG
-  code->Print(isolate);
+  code->Print();
 #endif
   auto f = GeneratedCode<F_iiiii>::FromCode(*code);
   intptr_t res = reinterpret_cast<intptr_t>(f.Call(10, 0, 0, 0, 0));
@@ -224,7 +224,7 @@ TEST(3) {
   Handle<Code> code =
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef DEBUG
-  code->Print(isolate);
+  code->Print();
 #endif
   auto f = GeneratedCode<F_piiii>::FromCode(*code);
   t.i = 100000;
@@ -339,7 +339,7 @@ TEST(4) {
         Handle<Code>())->ToObjectChecked();
     CHECK(code->IsCode());
 #ifdef DEBUG
-    Code::cast(code)->Print(isolate);
+    Code::cast(code)->Print();
 #endif
     auto f = GeneratedCode<F_piiii>::FromCode(*code);
     t.a = 1.5;
@@ -399,7 +399,7 @@ TEST(5) {
         Handle<Code>())->ToObjectChecked();
     CHECK(code->IsCode());
 #ifdef DEBUG
-    Code::cast(code)->Print(isolate);
+    Code::cast(code)->Print();
 #endif
     auto f = GeneratedCode<F_iiiii>::FromCode(*code);
     int res = reinterpret_cast<int>(f.Call(0xAAAAAAAA, 0, 0, 0, 0));
@@ -434,7 +434,7 @@ TEST(6) {
         Handle<Code>())->ToObjectChecked();
     CHECK(code->IsCode());
 #ifdef DEBUG
-    Code::cast(code)->Print(isolate);
+    Code::cast(code)->Print();
 #endif
     auto f = GeneratedCode<F_iiiii>::FromCode(*code);
     int res = reinterpret_cast<int>(f.Call(0xFFFF, 0, 0, 0, 0));
@@ -509,7 +509,7 @@ static void TestRoundingMode(VCVTTypes types,
         Handle<Code>())->ToObjectChecked();
     CHECK(code->IsCode());
 #ifdef DEBUG
-    Code::cast(code)->Print(isolate);
+    Code::cast(code)->Print();
 #endif
     auto f = GeneratedCode<F_iiiii>::FromCode(*code);
     int res = reinterpret_cast<int>(f.Call(0, 0, 0, 0, 0));
@@ -696,7 +696,7 @@ TEST(8) {
         Handle<Code>())->ToObjectChecked();
     CHECK(code->IsCode());
 #ifdef DEBUG
-    Code::cast(code)->Print(isolate);
+    Code::cast(code)->Print();
 #endif
     auto fn = GeneratedCode<F_ppiii>::FromCode(*code);
     d.a = 1.1;
@@ -811,7 +811,7 @@ TEST(9) {
         Handle<Code>())->ToObjectChecked();
     CHECK(code->IsCode());
 #ifdef DEBUG
-    Code::cast(code)->Print(isolate);
+    Code::cast(code)->Print();
 #endif
     auto fn = GeneratedCode<F_ppiii>::FromCode(*code);
     d.a = 1.1;
@@ -922,7 +922,7 @@ TEST(10) {
         Handle<Code>())->ToObjectChecked();
     CHECK(code->IsCode());
 #ifdef DEBUG
-    Code::cast(code)->Print(isolate);
+    Code::cast(code)->Print();
 #endif
     auto fn = GeneratedCode<F_ppiii>::FromCode(*code);
     d.a = 1.1;
@@ -1019,7 +1019,7 @@ TEST(11) {
       Handle<Code>())->ToObjectChecked();
   CHECK(code->IsCode());
 #ifdef DEBUG
-  Code::cast(code)->Print(isolate);
+  Code::cast(code)->Print();
 #endif
   auto f = GeneratedCode<F_piiii>::FromCode(*code);
   f.Call(&i, 0, 0, 0, 0);
diff --git a/deps/v8/test/cctest/test-assembler-s390.cc b/deps/v8/test/cctest/test-assembler-s390.cc
index 9d7c933bb9f3fa..752f9bfb1e0d7f 100644
--- a/deps/v8/test/cctest/test-assembler-s390.cc
+++ b/deps/v8/test/cctest/test-assembler-s390.cc
@@ -65,7 +65,7 @@ TEST(0) {
   Handle<Code> code =
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef DEBUG
-  code->Print(isolate);
+  code->Print();
 #endif
   auto f = GeneratedCode<F2>::FromCode(*code);
   intptr_t res = reinterpret_cast<intptr_t>(f.Call(3, 4, 0, 0, 0));
@@ -104,7 +104,7 @@ TEST(1) {
   Handle<Code> code =
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef DEBUG
-  code->Print(isolate);
+  code->Print();
 #endif
   auto f = GeneratedCode<F1>::FromCode(*code);
   intptr_t res = reinterpret_cast<intptr_t>(f.Call(100, 0, 0, 0, 0));
@@ -155,7 +155,7 @@ TEST(2) {
   Handle<Code> code =
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef DEBUG
-  code->Print(isolate);
+  code->Print();
 #endif
   auto f = GeneratedCode<F1>::FromCode(*code);
   intptr_t res = reinterpret_cast<intptr_t>(f.Call(10, 0, 0, 0, 0));
@@ -210,7 +210,7 @@ TEST(3) {
   Handle<Code> code =
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef DEBUG
-  code->Print(isolate);
+  code->Print();
 #endif
   USE(code);
   ::exit(0);
@@ -251,7 +251,7 @@ TEST(4) {
   Handle<Code> code = isolate->factory()->NewCode(
       desc, Code::STUB, Handle<Code>());
 #ifdef DEBUG
-  code->Print(isolate);
+  code->Print();
 #endif
   auto f = GeneratedCode<F2>::FromCode(*code);
   intptr_t res = reinterpret_cast<intptr_t>(
@@ -279,7 +279,7 @@ TEST(5) {
   Handle<Code> code = isolate->factory()->NewCode(
       desc, Code::STUB, Handle<Code>());
 #ifdef DEBUG
-  code->Print(isolate);
+  code->Print();
 #endif
   auto f = GeneratedCode<F2>::FromCode(*code);
   intptr_t res =
@@ -313,7 +313,7 @@ TEST(6) {
   Handle<Code> code = isolate->factory()->NewCode(
       desc, Code::STUB, Handle<Code>());
 #ifdef DEBUG
-  code->Print(isolate);
+  code->Print();
 #endif
   auto f = GeneratedCode<F2>::FromCode(*code);
   intptr_t res =
@@ -345,7 +345,7 @@ TEST(7) {
   Handle<Code> code = isolate->factory()->NewCode(
       desc, Code::STUB, Handle<Code>());
 #ifdef DEBUG
-  code->Print(isolate);
+  code->Print();
 #endif
   auto f = GeneratedCode<F2>::FromCode(*code);
   intptr_t res =
@@ -376,7 +376,7 @@ TEST(8) {
   Handle<Code> code = isolate->factory()->NewCode(
       desc, Code::STUB, Handle<Code>());
 #ifdef DEBUG
-  code->Print(isolate);
+  code->Print();
 #endif
   auto f = GeneratedCode<F1>::FromCode(*code);
   intptr_t res =
@@ -403,7 +403,7 @@ TEST(9) {
   Handle<Code> code = isolate->factory()->NewCode(
       desc, Code::STUB, Handle<Code>());
 #ifdef DEBUG
-  code->Print(isolate);
+  code->Print();
 #endif
   auto f = GeneratedCode<F1>::FromCode(*code);
   intptr_t res =
@@ -488,7 +488,7 @@ TEST(10) {
   Handle<Code> code =
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef DEBUG
-  code->Print(isolate);
+  code->Print();
 #endif
   auto f = GeneratedCode<F2>::FromCode(*code);
   intptr_t res = reinterpret_cast<intptr_t>(f.Call(3, 4, 0, 0, 0));
@@ -542,7 +542,7 @@ TEST(11) {
   Handle<Code> code = isolate->factory()->NewCode(
       desc, Code::STUB, Handle<Code>());
 #ifdef DEBUG
-  code->Print(isolate);
+  code->Print();
 #endif
   auto f = GeneratedCode<F1>::FromCode(*code);
   intptr_t res = reinterpret_cast<intptr_t>(f.Call(0, 0, 0, 0, 0));
@@ -610,7 +610,7 @@ TEST(12) {
   Handle<Code> code = isolate->factory()->NewCode(
       desc, Code::STUB, Handle<Code>());
 #ifdef DEBUG
-  code->Print(isolate);
+  code->Print();
 #endif
   auto f = GeneratedCode<F1>::FromCode(*code);
   intptr_t res = reinterpret_cast<intptr_t>(f.Call(0, 0, 0, 0, 0));
diff --git a/deps/v8/test/cctest/test-assembler-x64.cc b/deps/v8/test/cctest/test-assembler-x64.cc
index eb7af1bab4340a..eb172ee2aaf530 100644
--- a/deps/v8/test/cctest/test-assembler-x64.cc
+++ b/deps/v8/test/cctest/test-assembler-x64.cc
@@ -881,7 +881,7 @@ TEST(AssemblerX64Extractps) {
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef OBJECT_PRINT
   StdoutStream os;
-  code->Print(isolate, os);
+  code->Print(os);
 #endif
 
   auto f = GeneratedCode<F3>::FromCode(*code);
@@ -918,7 +918,7 @@ TEST(AssemblerX64SSE) {
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef OBJECT_PRINT
   StdoutStream os;
-  code->Print(isolate, os);
+  code->Print(os);
 #endif
 
   auto f = GeneratedCode<F6>::FromCode(*code);
@@ -949,7 +949,7 @@ TEST(AssemblerX64SSE3) {
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef OBJECT_PRINT
   StdoutStream os;
-  code->Print(isolate, os);
+  code->Print(os);
 #endif
 
   auto f = GeneratedCode<F6>::FromCode(*code);
@@ -1174,7 +1174,7 @@ TEST(AssemblerX64FMA_sd) {
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef OBJECT_PRINT
   StdoutStream os;
-  code->Print(isolate, os);
+  code->Print(os);
 #endif
 
   auto f = GeneratedCode<F7>::FromCode(*code);
@@ -1400,7 +1400,7 @@ TEST(AssemblerX64FMA_ss) {
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef OBJECT_PRINT
   StdoutStream os;
-  code->Print(isolate, os);
+  code->Print(os);
 #endif
 
   auto f = GeneratedCode<F8>::FromCode(*code);
@@ -1475,7 +1475,7 @@ TEST(AssemblerX64SSE_ss) {
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef OBJECT_PRINT
   StdoutStream os;
-  code->Print(isolate, os);
+  code->Print(os);
 #endif
 
   auto f = GeneratedCode<F8>::FromCode(*code);
@@ -1560,7 +1560,7 @@ TEST(AssemblerX64AVX_ss) {
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef OBJECT_PRINT
   StdoutStream os;
-  code->Print(isolate, os);
+  code->Print(os);
 #endif
 
   auto f = GeneratedCode<F8>::FromCode(*code);
@@ -1799,7 +1799,7 @@ TEST(AssemblerX64AVX_sd) {
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef OBJECT_PRINT
   StdoutStream os;
-  code->Print(isolate, os);
+  code->Print(os);
 #endif
 
   auto f = GeneratedCode<F7>::FromCode(*code);
@@ -1991,7 +1991,7 @@ TEST(AssemblerX64BMI1) {
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef OBJECT_PRINT
   StdoutStream os;
-  code->Print(isolate, os);
+  code->Print(os);
 #endif
 
   auto f = GeneratedCode<F0>::FromCode(*code);
@@ -2051,7 +2051,7 @@ TEST(AssemblerX64LZCNT) {
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef OBJECT_PRINT
   StdoutStream os;
-  code->Print(isolate, os);
+  code->Print(os);
 #endif
 
   auto f = GeneratedCode<F0>::FromCode(*code);
@@ -2111,7 +2111,7 @@ TEST(AssemblerX64POPCNT) {
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef OBJECT_PRINT
   StdoutStream os;
-  code->Print(isolate, os);
+  code->Print(os);
 #endif
 
   auto f = GeneratedCode<F0>::FromCode(*code);
@@ -2374,7 +2374,7 @@ TEST(AssemblerX64BMI2) {
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef OBJECT_PRINT
   StdoutStream os;
-  code->Print(isolate, os);
+  code->Print(os);
 #endif
 
   auto f = GeneratedCode<F0>::FromCode(*code);
@@ -2418,7 +2418,7 @@ TEST(AssemblerX64JumpTables1) {
   Handle<Code> code =
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef OBJECT_PRINT
-  code->Print(isolate, std::cout);
+  code->Print(std::cout);
 #endif
 
   auto f = GeneratedCode<F1>::FromCode(*code);
@@ -2467,7 +2467,7 @@ TEST(AssemblerX64JumpTables2) {
   Handle<Code> code =
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef OBJECT_PRINT
-  code->Print(isolate, std::cout);
+  code->Print(std::cout);
 #endif
 
   auto f = GeneratedCode<F1>::FromCode(*code);
@@ -2526,7 +2526,7 @@ TEST(AssemblerX64vmovups) {
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef OBJECT_PRINT
   StdoutStream os;
-  code->Print(isolate, os);
+  code->Print(os);
 #endif
 
   auto f = GeneratedCode<F9>::FromCode(*code);
diff --git a/deps/v8/test/cctest/test-code-stub-assembler.cc b/deps/v8/test/cctest/test-code-stub-assembler.cc
index a89504c3bd9db7..fd47725dbe7c77 100644
--- a/deps/v8/test/cctest/test-code-stub-assembler.cc
+++ b/deps/v8/test/cctest/test-code-stub-assembler.cc
@@ -908,7 +908,7 @@ TEST(TransitionLookup) {
   Handle<TransitionArray> transitions(
       TransitionArray::cast(root_map->raw_transitions()->ToStrongHeapObject()),
       isolate);
-  DCHECK(transitions->IsSortedNoDuplicates(isolate));
+  DCHECK(transitions->IsSortedNoDuplicates());
 
   // Ensure we didn't overflow transition array and therefore all the
   // combinations of cases are covered.
diff --git a/deps/v8/test/cctest/test-dictionary.cc b/deps/v8/test/cctest/test-dictionary.cc
index df75285a051b93..98206487a6a257 100644
--- a/deps/v8/test/cctest/test-dictionary.cc
+++ b/deps/v8/test/cctest/test-dictionary.cc
@@ -73,7 +73,7 @@ static void TestHashMap(Handle<HashMap> table) {
 
   // Keys that have been removed are mapped to the hole.
   bool was_present = false;
-  table = HashMap::Remove(table, a, &was_present);
+  table = HashMap::Remove(isolate, table, a, &was_present);
   CHECK(was_present);
   CHECK_EQ(0, table->NumberOfElements());
   CHECK_EQ(table->Lookup(a), roots.the_hole_value());
@@ -125,7 +125,7 @@ static void TestHashSet(Handle<HashSet> table) {
 
   Handle<JSObject> a = factory->NewJSArray(7);
   Handle<JSObject> b = factory->NewJSArray(11);
-  table = HashSet::Add(table, a);
+  table = HashSet::Add(isolate, table, a);
   CHECK_EQ(1, table->NumberOfElements());
   CHECK(table->Has(isolate, a));
   CHECK(!table->Has(isolate, b));
@@ -137,7 +137,7 @@ static void TestHashSet(Handle<HashSet> table) {
   CHECK(!table->Has(isolate, b));
 
   // Keys that are overwritten should not change number of elements.
-  table = HashSet::Add(table, a);
+  table = HashSet::Add(isolate, table, a);
   CHECK_EQ(1, table->NumberOfElements());
   CHECK(table->Has(isolate, a));
   CHECK(!table->Has(isolate, b));
@@ -155,7 +155,7 @@ static void TestHashSet(Handle<HashSet> table) {
   // an identity hash code generated.
   for (int i = 0; i < 100; i++) {
     Handle<JSReceiver> key = factory->NewJSArray(7);
-    table = HashSet::Add(table, key);
+    table = HashSet::Add(isolate, table, key);
     CHECK_EQ(table->NumberOfElements(), i + 2);
     CHECK(table->Has(isolate, key));
     CHECK(key->GetIdentityHash(isolate)->IsSmi());
@@ -217,7 +217,7 @@ TEST(HashTableRehash) {
     for (int i = 0; i < capacity - 1; i++) {
       t->insert(i, i * i, i);
     }
-    t->Rehash();
+    t->Rehash(isolate);
     for (int i = 0; i < capacity - 1; i++) {
       CHECK_EQ(i, t->lookup(i * i));
     }
@@ -230,7 +230,7 @@ TEST(HashTableRehash) {
     for (int i = 0; i < capacity / 2; i++) {
       t->insert(i, i * i, i);
     }
-    t->Rehash();
+    t->Rehash(isolate);
     for (int i = 0; i < capacity / 2; i++) {
       CHECK_EQ(i, t->lookup(i * i));
     }
diff --git a/deps/v8/test/cctest/test-disasm-ia32.cc b/deps/v8/test/cctest/test-disasm-ia32.cc
index 7aa75a5c8a87b3..84764621c98797 100644
--- a/deps/v8/test/cctest/test-disasm-ia32.cc
+++ b/deps/v8/test/cctest/test-disasm-ia32.cc
@@ -897,7 +897,7 @@ TEST(DisasmIa320) {
   USE(code);
 #ifdef OBJECT_PRINT
   StdoutStream os;
-  code->Print(isolate, os);
+  code->Print(os);
   Address begin = code->raw_instruction_start();
   Address end = code->raw_instruction_end();
   disasm::Disassembler::Disassemble(stdout, reinterpret_cast<byte*>(begin),
diff --git a/deps/v8/test/cctest/test-disasm-x64.cc b/deps/v8/test/cctest/test-disasm-x64.cc
index 61f6ac6b49210b..58113719992940 100644
--- a/deps/v8/test/cctest/test-disasm-x64.cc
+++ b/deps/v8/test/cctest/test-disasm-x64.cc
@@ -965,7 +965,7 @@ TEST(DisasmX64) {
   USE(code);
 #ifdef OBJECT_PRINT
   StdoutStream os;
-  code->Print(isolate, os);
+  code->Print(os);
   Address begin = code->raw_instruction_start();
   Address end = code->raw_instruction_end();
   disasm::Disassembler::Disassemble(stdout, reinterpret_cast<byte*>(begin),
diff --git a/deps/v8/test/cctest/test-field-type-tracking.cc b/deps/v8/test/cctest/test-field-type-tracking.cc
index c6879bb65d3fdf..9968b18e456833 100644
--- a/deps/v8/test/cctest/test-field-type-tracking.cc
+++ b/deps/v8/test/cctest/test-field-type-tracking.cc
@@ -306,7 +306,7 @@ class Expectations {
       if (!Check(descriptors, i)) {
         Print();
 #ifdef OBJECT_PRINT
-        descriptors->Print(isolate_);
+        descriptors->Print();
 #endif
         Check(descriptors, i);
         return false;
diff --git a/deps/v8/test/cctest/test-heap-profiler.cc b/deps/v8/test/cctest/test-heap-profiler.cc
index 0f02b0dc1c2b12..18203c7725cece 100644
--- a/deps/v8/test/cctest/test-heap-profiler.cc
+++ b/deps/v8/test/cctest/test-heap-profiler.cc
@@ -112,6 +112,12 @@ static const char* GetName(const v8::HeapGraphNode* node) {
       ->name();
 }
 
+static const char* GetName(const v8::HeapGraphEdge* edge) {
+  return const_cast<i::HeapGraphEdge*>(
+             reinterpret_cast<const i::HeapGraphEdge*>(edge))
+      ->name();
+}
+
 static size_t GetSize(const v8::HeapGraphNode* node) {
   return const_cast<i::HeapEntry*>(reinterpret_cast<const i::HeapEntry*>(node))
       ->self_size();
@@ -128,6 +134,18 @@ static const v8::HeapGraphNode* GetChildByName(const v8::HeapGraphNode* node,
   return nullptr;
 }
 
+static const v8::HeapGraphEdge* GetEdgeByChildName(
+    const v8::HeapGraphNode* node, const char* name) {
+  for (int i = 0, count = node->GetChildrenCount(); i < count; ++i) {
+    const v8::HeapGraphEdge* edge = node->GetChild(i);
+    const v8::HeapGraphNode* child = edge->GetToNode();
+    if (!strcmp(name, GetName(child))) {
+      return edge;
+    }
+  }
+  return nullptr;
+}
+
 static const v8::HeapGraphNode* GetRootChild(const v8::HeapSnapshot* snapshot,
                                              const char* name) {
   return GetChildByName(snapshot->GetRoot(), name);
@@ -2957,6 +2975,71 @@ TEST(EmbedderGraph) {
   CheckEmbedderGraphSnapshot(env->GetIsolate(), snapshot);
 }
 
+void BuildEmbedderGraphWithNamedEdges(v8::Isolate* v8_isolate,
+                                      v8::EmbedderGraph* graph, void* data) {
+  using Node = v8::EmbedderGraph::Node;
+  Node* global_node = graph->V8Node(*global_object_pointer);
+  Node* embedder_node_A = graph->AddNode(
+      std::unique_ptr<Node>(new EmbedderNode("EmbedderNodeA", 10)));
+  Node* embedder_node_B = graph->AddNode(
+      std::unique_ptr<Node>(new EmbedderNode("EmbedderNodeB", 20)));
+  Node* embedder_node_C = graph->AddNode(
+      std::unique_ptr<Node>(new EmbedderNode("EmbedderNodeC", 30)));
+  graph->AddEdge(global_node, embedder_node_A, "global_to_a");
+  graph->AddEdge(embedder_node_A, embedder_node_B, "a_to_b");
+  graph->AddEdge(embedder_node_B, embedder_node_C);
+}
+
+void CheckEmbedderGraphWithNamedEdges(v8::Isolate* isolate,
+                                      const v8::HeapSnapshot* snapshot) {
+  const v8::HeapGraphNode* global = GetGlobalObject(snapshot);
+  const v8::HeapGraphEdge* global_to_a =
+      GetEdgeByChildName(global, "EmbedderNodeA");
+  CHECK(global_to_a);
+  CHECK_EQ(v8::HeapGraphEdge::kInternal, global_to_a->GetType());
+  CHECK(global_to_a->GetName()->IsString());
+  CHECK_EQ(0, strcmp("global_to_a", GetName(global_to_a)));
+  const v8::HeapGraphNode* embedder_node_A = global_to_a->GetToNode();
+  CHECK_EQ(0, strcmp("EmbedderNodeA", GetName(embedder_node_A)));
+  CHECK_EQ(10, GetSize(embedder_node_A));
+
+  const v8::HeapGraphEdge* a_to_b =
+      GetEdgeByChildName(embedder_node_A, "EmbedderNodeB");
+  CHECK(a_to_b);
+  CHECK(a_to_b->GetName()->IsString());
+  CHECK_EQ(0, strcmp("a_to_b", GetName(a_to_b)));
+  CHECK_EQ(v8::HeapGraphEdge::kInternal, a_to_b->GetType());
+  const v8::HeapGraphNode* embedder_node_B = a_to_b->GetToNode();
+  CHECK_EQ(0, strcmp("EmbedderNodeB", GetName(embedder_node_B)));
+  CHECK_EQ(20, GetSize(embedder_node_B));
+
+  const v8::HeapGraphEdge* b_to_c =
+      GetEdgeByChildName(embedder_node_B, "EmbedderNodeC");
+  CHECK(b_to_c);
+  CHECK(b_to_c->GetName()->IsNumber());
+  CHECK_EQ(v8::HeapGraphEdge::kElement, b_to_c->GetType());
+  const v8::HeapGraphNode* embedder_node_C = b_to_c->GetToNode();
+  CHECK_EQ(0, strcmp("EmbedderNodeC", GetName(embedder_node_C)));
+  CHECK_EQ(30, GetSize(embedder_node_C));
+}
+
+TEST(EmbedderGraphWithNamedEdges) {
+  i::FLAG_heap_profiler_use_embedder_graph = true;
+  LocalContext env;
+  v8::HandleScope scope(env->GetIsolate());
+  i::Isolate* isolate = reinterpret_cast<i::Isolate*>(env->GetIsolate());
+  v8::Local<v8::Value> global_object =
+      v8::Utils::ToLocal(i::Handle<i::JSObject>(
+          (isolate->context()->native_context()->global_object()), isolate));
+  global_object_pointer = &global_object;
+  v8::HeapProfiler* heap_profiler = env->GetIsolate()->GetHeapProfiler();
+  heap_profiler->AddBuildEmbedderGraphCallback(BuildEmbedderGraphWithNamedEdges,
+                                               nullptr);
+  const v8::HeapSnapshot* snapshot = heap_profiler->TakeHeapSnapshot();
+  CHECK(ValidateSnapshot(snapshot));
+  CheckEmbedderGraphWithNamedEdges(env->GetIsolate(), snapshot);
+}
+
 struct GraphBuildingContext {
   int counter = 0;
 };
diff --git a/deps/v8/test/cctest/test-intl.cc b/deps/v8/test/cctest/test-intl.cc
index b31977ed97e121..7f7bcab5530cc7 100644
--- a/deps/v8/test/cctest/test-intl.cc
+++ b/deps/v8/test/cctest/test-intl.cc
@@ -248,6 +248,12 @@ TEST(GetAvailableLocales) {
 
   locales = Intl::GetAvailableLocales(IcuService::kPluralRules);
   CHECK(locales.count("en-US"));
+
+  locales = Intl::GetAvailableLocales(IcuService::kResourceBundle);
+  CHECK(locales.count("en-US"));
+
+  locales = Intl::GetAvailableLocales(IcuService::kRelativeDateTimeFormatter);
+  CHECK(locales.count("en-US"));
 }
 
 TEST(IsObjectOfType) {
diff --git a/deps/v8/test/cctest/test-log.cc b/deps/v8/test/cctest/test-log.cc
index 10fdb3d8de2623..54ed85a68d7ca3 100644
--- a/deps/v8/test/cctest/test-log.cc
+++ b/deps/v8/test/cctest/test-log.cc
@@ -533,7 +533,7 @@ TEST(Issue23768) {
       CcTest::i_isolate());
   // This situation can happen if source was an external string disposed
   // by its owner.
-  i_source->set_resource(nullptr);
+  i_source->SetResource(nullptr);
 
   // Must not crash.
   CcTest::i_isolate()->logger()->LogCompiledFunctions();
@@ -1007,7 +1007,7 @@ TEST(LogMaps) {
       uintptr_t address = reinterpret_cast<uintptr_t>(obj);
       if (map_addresses.find(address) != map_addresses.end()) continue;
       logger.PrintLog(200);
-      i::Map::cast(obj)->Print(heap->isolate());
+      i::Map::cast(obj)->Print();
       V8_Fatal(__FILE__, __LINE__,
                "Map (%p, #%zu) was not logged during startup with --trace-maps!"
                "\n# Expected Log Line: map_details, ... %p"
diff --git a/deps/v8/test/cctest/test-macro-assembler-arm.cc b/deps/v8/test/cctest/test-macro-assembler-arm.cc
index 263a07825d1224..d442903ea09191 100644
--- a/deps/v8/test/cctest/test-macro-assembler-arm.cc
+++ b/deps/v8/test/cctest/test-macro-assembler-arm.cc
@@ -237,7 +237,7 @@ TEST(ExtractLane) {
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef DEBUG
   StdoutStream os;
-  code->Print(isolate, os);
+  code->Print(os);
 #endif
   auto f = GeneratedCode<F3>::FromCode(*code);
   f.Call(&t, 0, 0, 0, 0);
@@ -369,7 +369,7 @@ TEST(ReplaceLane) {
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef DEBUG
   StdoutStream os;
-  code->Print(isolate, os);
+  code->Print(os);
 #endif
   auto f = GeneratedCode<F3>::FromCode(*code);
   f.Call(&t, 0, 0, 0, 0);
diff --git a/deps/v8/test/cctest/test-macro-assembler-mips.cc b/deps/v8/test/cctest/test-macro-assembler-mips.cc
index fa92793678173e..accee77f344047 100644
--- a/deps/v8/test/cctest/test-macro-assembler-mips.cc
+++ b/deps/v8/test/cctest/test-macro-assembler-mips.cc
@@ -202,7 +202,7 @@ TEST(jump_tables4) {
   Handle<Code> code =
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef OBJECT_PRINT
-  code->Print(isolate, std::cout);
+  code->Print(std::cout);
 #endif
   auto f = GeneratedCode<F1>::FromCode(*code);
   for (int i = 0; i < kNumCases; ++i) {
@@ -268,7 +268,7 @@ TEST(jump_tables5) {
   Handle<Code> code =
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef OBJECT_PRINT
-  code->Print(isolate, std::cout);
+  code->Print(std::cout);
 #endif
   auto f = GeneratedCode<F1>::FromCode(*code);
   for (int i = 0; i < kNumCases; ++i) {
@@ -358,7 +358,7 @@ TEST(jump_tables6) {
   Handle<Code> code =
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef OBJECT_PRINT
-  code->Print(isolate, std::cout);
+  code->Print(std::cout);
 #endif
   auto f = GeneratedCode<F1>::FromCode(*code);
   for (int i = 0; i < kSwitchTableCases; ++i) {
@@ -1129,7 +1129,7 @@ static GeneratedCode<F4> GenerateMacroFloat32MinMax(MacroAssembler* masm) {
       masm->isolate()->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef DEBUG
   StdoutStream os;
-  code->Print(masm->isolate(), os);
+  code->Print(os);
 #endif
   return GeneratedCode<F4>::FromCode(*code);
 }
@@ -1271,7 +1271,7 @@ static GeneratedCode<F4> GenerateMacroFloat64MinMax(MacroAssembler* masm) {
       masm->isolate()->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef DEBUG
   StdoutStream os;
-  code->Print(masm->isolate(), os);
+  code->Print(os);
 #endif
   return GeneratedCode<F4>::FromCode(*code);
 }
diff --git a/deps/v8/test/cctest/test-macro-assembler-mips64.cc b/deps/v8/test/cctest/test-macro-assembler-mips64.cc
index 2bfce03a41151d..f982e869fee871 100644
--- a/deps/v8/test/cctest/test-macro-assembler-mips64.cc
+++ b/deps/v8/test/cctest/test-macro-assembler-mips64.cc
@@ -269,7 +269,7 @@ TEST(jump_tables4) {
   Handle<Code> code =
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef OBJECT_PRINT
-  code->Print(isolate, std::cout);
+  code->Print(std::cout);
 #endif
   auto f = GeneratedCode<F1>::FromCode(*code);
   for (int i = 0; i < kNumCases; ++i) {
@@ -342,7 +342,7 @@ TEST(jump_tables5) {
   Handle<Code> code =
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef OBJECT_PRINT
-  code->Print(isolate, std::cout);
+  code->Print(std::cout);
 #endif
   auto f = GeneratedCode<F1>::FromCode(*code);
   for (int i = 0; i < kNumCases; ++i) {
@@ -433,7 +433,7 @@ TEST(jump_tables6) {
   Handle<Code> code =
       isolate->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef OBJECT_PRINT
-  code->Print(isolate, std::cout);
+  code->Print(std::cout);
 #endif
   auto f = GeneratedCode<F1>::FromCode(*code);
   for (int i = 0; i < kSwitchTableCases; ++i) {
@@ -1487,7 +1487,7 @@ static GeneratedCode<F4> GenerateMacroFloat32MinMax(MacroAssembler* masm) {
       masm->isolate()->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef DEBUG
   StdoutStream os;
-  code->Print(masm->isolate(), os);
+  code->Print(os);
 #endif
   return GeneratedCode<F4>::FromCode(*code);
 }
@@ -1629,7 +1629,7 @@ static GeneratedCode<F4> GenerateMacroFloat64MinMax(MacroAssembler* masm) {
       masm->isolate()->factory()->NewCode(desc, Code::STUB, Handle<Code>());
 #ifdef DEBUG
   StdoutStream os;
-  code->Print(masm->isolate(), os);
+  code->Print(os);
 #endif
   return GeneratedCode<F4>::FromCode(*code);
 }
diff --git a/deps/v8/test/cctest/test-serialize.cc b/deps/v8/test/cctest/test-serialize.cc
index 50775d4f9d91c9..c0e03230524cb3 100644
--- a/deps/v8/test/cctest/test-serialize.cc
+++ b/deps/v8/test/cctest/test-serialize.cc
@@ -1903,9 +1903,9 @@ TEST(CodeSerializerExternalString) {
 
   // This avoids the GC from trying to free stack allocated resources.
   i::Handle<i::ExternalOneByteString>::cast(one_byte_string)
-      ->set_resource(nullptr);
+      ->SetResource(nullptr);
   i::Handle<i::ExternalTwoByteString>::cast(two_byte_string)
-      ->set_resource(nullptr);
+      ->SetResource(nullptr);
   delete cache;
 }
 
@@ -1963,7 +1963,7 @@ TEST(CodeSerializerLargeExternalString) {
   CHECK_EQ(42.0, copy_result->Number());
 
   // This avoids the GC from trying to free stack allocated resources.
-  i::Handle<i::ExternalOneByteString>::cast(name)->set_resource(nullptr);
+  i::Handle<i::ExternalOneByteString>::cast(name)->SetResource(nullptr);
   delete cache;
   string.Dispose();
 }
@@ -2014,7 +2014,7 @@ TEST(CodeSerializerExternalScriptName) {
   CHECK_EQ(10.0, copy_result->Number());
 
   // This avoids the GC from trying to free stack allocated resources.
-  i::Handle<i::ExternalOneByteString>::cast(name)->set_resource(nullptr);
+  i::Handle<i::ExternalOneByteString>::cast(name)->SetResource(nullptr);
   delete cache;
 }
 
diff --git a/deps/v8/test/cctest/test-strings.cc b/deps/v8/test/cctest/test-strings.cc
index 488721d37abf8a..3243aabe433c34 100644
--- a/deps/v8/test/cctest/test-strings.cc
+++ b/deps/v8/test/cctest/test-strings.cc
@@ -627,8 +627,8 @@ TEST(ConsStringWithEmptyFirstFlatten) {
   i::Handle<i::String> new_fst = isolate->factory()->empty_string();
   i::Handle<i::String> new_snd =
       isolate->factory()->NewStringFromAsciiChecked("snd012345012345678");
-  cons->set_first(*new_fst);
-  cons->set_second(*new_snd);
+  cons->set_first(isolate, *new_fst);
+  cons->set_second(isolate, *new_snd);
   CHECK(!cons->IsFlat());
   CHECK_EQ(initial_length, new_fst->length() + new_snd->length());
   CHECK_EQ(initial_length, cons->length());
@@ -1217,7 +1217,7 @@ TEST(InternalizeExternal) {
     CHECK(!i::Heap::InNewSpace(*string));
     CHECK_EQ(
         isolate->factory()->string_table()->LookupStringIfExists_NoAllocate(
-            *string),
+            isolate, *string),
         Smi::FromInt(ResultSentinel::kNotFound));
     factory->InternalizeName(string);
     CHECK(string->IsExternalString());
@@ -1245,7 +1245,7 @@ TEST(SliceFromExternal) {
   CHECK(SlicedString::cast(*slice)->parent()->IsExternalString());
   CHECK(slice->IsFlat());
   // This avoids the GC from trying to free stack allocated resources.
-  i::Handle<i::ExternalOneByteString>::cast(string)->set_resource(nullptr);
+  i::Handle<i::ExternalOneByteString>::cast(string)->SetResource(nullptr);
 }
 
 
diff --git a/deps/v8/test/cctest/test-symbols.cc b/deps/v8/test/cctest/test-symbols.cc
index 63bc8cb73fd970..4a6b6af5453ed2 100644
--- a/deps/v8/test/cctest/test-symbols.cc
+++ b/deps/v8/test/cctest/test-symbols.cc
@@ -57,7 +57,7 @@ TEST(Create) {
     CHECK_GT(symbols[i]->Hash(), 0u);
     os << Brief(*symbols[i]) << "\n";
 #if OBJECT_PRINT
-    symbols[i]->Print(isolate, os);
+    symbols[i]->Print(os);
 #endif
 #if VERIFY_HEAP
     symbols[i]->ObjectVerify(isolate);
diff --git a/deps/v8/test/cctest/test-transitions.cc b/deps/v8/test/cctest/test-transitions.cc
index aa5553bd4a3ab7..f3658664d9d76c 100644
--- a/deps/v8/test/cctest/test-transitions.cc
+++ b/deps/v8/test/cctest/test-transitions.cc
@@ -74,7 +74,7 @@ TEST(TransitionArray_SimpleFieldTransitions) {
             (key == *name2 && target == *map2));
     }
 
-    DCHECK(transitions.IsSortedNoDuplicates(isolate));
+    DCHECK(transitions.IsSortedNoDuplicates());
   }
 }
 
@@ -133,7 +133,7 @@ TEST(TransitionArray_FullFieldTransitions) {
             (key == *name2 && target == *map2));
     }
 
-    DCHECK(transitions.IsSortedNoDuplicates(isolate));
+    DCHECK(transitions.IsSortedNoDuplicates());
   }
 }
 
@@ -184,7 +184,7 @@ TEST(TransitionArray_DifferentFieldNames) {
     }
   }
 
-  DCHECK(transitions.IsSortedNoDuplicates(isolate));
+  DCHECK(transitions.IsSortedNoDuplicates());
 }
 
 
@@ -227,7 +227,7 @@ TEST(TransitionArray_SameFieldNamesDifferentAttributesSimple) {
     CHECK_EQ(*name, transitions.GetKey(i));
   }
 
-  DCHECK(transitions.IsSortedNoDuplicates(isolate));
+  DCHECK(transitions.IsSortedNoDuplicates());
 }
 
 
@@ -308,7 +308,7 @@ TEST(TransitionArray_SameFieldNamesDifferentAttributes) {
     }
   }
 
-  DCHECK(transitions.IsSortedNoDuplicates(isolate));
+  DCHECK(transitions.IsSortedNoDuplicates());
 }
 
 }  // namespace internal
diff --git a/deps/v8/test/cctest/wasm/test-run-wasm-module.cc b/deps/v8/test/cctest/wasm/test-run-wasm-module.cc
index aab660f96fc8b8..bbceec73a34fa8 100644
--- a/deps/v8/test/cctest/wasm/test-run-wasm-module.cc
+++ b/deps/v8/test/cctest/wasm/test-run-wasm-module.cc
@@ -604,7 +604,7 @@ TEST(InitDataAtTheUpperLimit) {
     CompileAndInstantiateForTesting(
         isolate, &thrower, ModuleWireBytes(data, data + arraysize(data)));
     if (thrower.error()) {
-      thrower.Reify()->Print(isolate);
+      thrower.Reify()->Print();
       FATAL("compile or instantiate error");
     }
   }
diff --git a/deps/v8/test/cctest/wasm/test-wasm-trap-position.cc b/deps/v8/test/cctest/wasm/test-wasm-trap-position.cc
index 6e2b2878ae7620..08ad5d31f88770 100644
--- a/deps/v8/test/cctest/wasm/test-wasm-trap-position.cc
+++ b/deps/v8/test/cctest/wasm/test-wasm-trap-position.cc
@@ -46,7 +46,7 @@ void CheckExceptionInfos(v8::internal::Isolate* i_isolate, Handle<Object> exc,
   CHECK(exc->IsJSError());
   v8::Isolate* v8_isolate = reinterpret_cast<v8::Isolate*>(i_isolate);
 
-  exc->Print(i_isolate);
+  exc->Print();
   // Extract stack frame from the exception.
   Local<v8::Value> localExc = Utils::ToLocal(exc);
   v8::Local<v8::StackTrace> stack = v8::Exception::GetStackTrace(localExc);
diff --git a/deps/v8/test/cctest/wasm/wasm-run-utils.cc b/deps/v8/test/cctest/wasm/wasm-run-utils.cc
index 36fcf470499e95..ee358d2efb35c7 100644
--- a/deps/v8/test/cctest/wasm/wasm-run-utils.cc
+++ b/deps/v8/test/cctest/wasm/wasm-run-utils.cc
@@ -168,7 +168,7 @@ void TestingModuleBuilder::PopulateIndirectFunctionTable() {
     int table_size = static_cast<int>(instance->indirect_function_table_size());
     for (int j = 0; j < table_size; j++) {
       WasmFunction& function = test_module_->functions[table.values[j]];
-      int sig_id = test_module_->signature_map.Find(function.sig);
+      int sig_id = test_module_->signature_map.Find(*function.sig);
       auto target =
           native_module_->GetCallTargetForFunction(function.func_index);
       IndirectFunctionTableEntry(instance, j).set(sig_id, *instance, target);
diff --git a/deps/v8/test/cctest/wasm/wasm-run-utils.h b/deps/v8/test/cctest/wasm/wasm-run-utils.h
index c09659733fae2b..ca1c922dd435c0 100644
--- a/deps/v8/test/cctest/wasm/wasm-run-utils.h
+++ b/deps/v8/test/cctest/wasm/wasm-run-utils.h
@@ -116,7 +116,7 @@ class TestingModuleBuilder {
     DCHECK_EQ(test_module_->signatures.size(),
               test_module_->signature_ids.size());
     test_module_->signatures.push_back(sig);
-    auto canonical_sig_num = test_module_->signature_map.FindOrInsert(sig);
+    auto canonical_sig_num = test_module_->signature_map.FindOrInsert(*sig);
     test_module_->signature_ids.push_back(canonical_sig_num);
     size_t size = test_module_->signatures.size();
     CHECK_GT(127, size);
diff --git a/deps/v8/test/fuzzer/wasm-code.cc b/deps/v8/test/fuzzer/wasm-code.cc
index 54a3da5768c04a..ec9a179945d016 100644
--- a/deps/v8/test/fuzzer/wasm-code.cc
+++ b/deps/v8/test/fuzzer/wasm-code.cc
@@ -20,14 +20,14 @@ namespace fuzzer {
 
 class WasmCodeFuzzer : public WasmExecutionFuzzer {
   bool GenerateModule(
-      Isolate* isolate, Zone* zone, const uint8_t* data, size_t size,
+      Isolate* isolate, Zone* zone, Vector<const uint8_t> data,
       ZoneBuffer& buffer, int32_t& num_args,
       std::unique_ptr<WasmValue[]>& interpreter_args,
       std::unique_ptr<Handle<Object>[]>& compiler_args) override {
     TestSignatures sigs;
     WasmModuleBuilder builder(zone);
     WasmFunctionBuilder* f = builder.AddFunction(sigs.i_iii());
-    f->EmitCode(data, static_cast<uint32_t>(size));
+    f->EmitCode(data.start(), static_cast<uint32_t>(data.size()));
     uint8_t end_opcode = kExprEnd;
     f->EmitCode(&end_opcode, 1);
     builder.AddExport(CStrVector("main"), f);
@@ -46,7 +46,7 @@ class WasmCodeFuzzer : public WasmExecutionFuzzer {
 };
 
 extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
-  return WasmCodeFuzzer().FuzzWasmModule(data, size);
+  return WasmCodeFuzzer().FuzzWasmModule({data, size});
 }
 
 }  // namespace fuzzer
diff --git a/deps/v8/test/fuzzer/wasm-compile.cc b/deps/v8/test/fuzzer/wasm-compile.cc
index c255c693230f7b..93c03a92db7693 100644
--- a/deps/v8/test/fuzzer/wasm-compile.cc
+++ b/deps/v8/test/fuzzer/wasm-compile.cc
@@ -34,35 +34,28 @@ constexpr int kMaxFunctions = 4;
 constexpr int kMaxGlobals = 64;
 
 class DataRange {
-  const uint8_t* data_;
-  size_t size_;
+  Vector<const uint8_t> data_;
 
  public:
-  DataRange(const uint8_t* data, size_t size) : data_(data), size_(size) {}
+  explicit DataRange(Vector<const uint8_t> data) : data_(data) {}
 
   // Don't accidentally pass DataRange by value. This will reuse bytes and might
   // lead to OOM because the end might not be reached.
   // Define move constructor and move assignment, disallow copy constructor and
   // copy assignment (below).
-  DataRange(DataRange&& other) : DataRange(other.data_, other.size_) {
-    other.data_ = nullptr;
-    other.size_ = 0;
-  }
+  DataRange(DataRange&& other) : DataRange(other.data_) { other.data_ = {}; }
   DataRange& operator=(DataRange&& other) {
     data_ = other.data_;
-    size_ = other.size_;
-    other.data_ = nullptr;
-    other.size_ = 0;
+    other.data_ = {};
     return *this;
   }
 
-  size_t size() const { return size_; }
+  size_t size() const { return data_.size(); }
 
   DataRange split() {
-    uint16_t num_bytes = get<uint16_t>() % std::max(size_t{1}, size_);
-    DataRange split(data_, num_bytes);
+    uint16_t num_bytes = get<uint16_t>() % std::max(size_t{1}, data_.size());
+    DataRange split(data_.SubVector(0, num_bytes));
     data_ += num_bytes;
-    size_ -= num_bytes;
     return split;
   }
 
@@ -73,11 +66,10 @@ class DataRange {
     // okay if we don't have a full four bytes available, we'll just use what
     // we have. We aren't concerned about endianness because we are generating
     // arbitrary expressions.
-    const size_t num_bytes = std::min(sizeof(T), size_);
+    const size_t num_bytes = std::min(sizeof(T), data_.size());
     T result = T();
-    memcpy(&result, data_, num_bytes);
+    memcpy(&result, data_.start(), num_bytes);
     data_ += num_bytes;
-    size_ -= num_bytes;
     return result;
   }
 
@@ -751,7 +743,7 @@ FunctionSig* GenerateSig(Zone* zone, DataRange& data) {
 
 class WasmCompileFuzzer : public WasmExecutionFuzzer {
   bool GenerateModule(
-      Isolate* isolate, Zone* zone, const uint8_t* data, size_t size,
+      Isolate* isolate, Zone* zone, Vector<const uint8_t> data,
       ZoneBuffer& buffer, int32_t& num_args,
       std::unique_ptr<WasmValue[]>& interpreter_args,
       std::unique_ptr<Handle<Object>[]>& compiler_args) override {
@@ -759,7 +751,7 @@ class WasmCompileFuzzer : public WasmExecutionFuzzer {
 
     WasmModuleBuilder builder(zone);
 
-    DataRange range(data, static_cast<uint32_t>(size));
+    DataRange range(data);
     std::vector<FunctionSig*> function_signatures;
     function_signatures.push_back(sigs.i_iii());
 
@@ -819,7 +811,7 @@ class WasmCompileFuzzer : public WasmExecutionFuzzer {
 
 extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
   constexpr bool require_valid = true;
-  return WasmCompileFuzzer().FuzzWasmModule(data, size, require_valid);
+  return WasmCompileFuzzer().FuzzWasmModule({data, size}, require_valid);
 }
 
 }  // namespace fuzzer
diff --git a/deps/v8/test/fuzzer/wasm-fuzzer-common.cc b/deps/v8/test/fuzzer/wasm-fuzzer-common.cc
index 9285757863dd73..f84e700fc96c43 100644
--- a/deps/v8/test/fuzzer/wasm-fuzzer-common.cc
+++ b/deps/v8/test/fuzzer/wasm-fuzzer-common.cc
@@ -247,7 +247,7 @@ void GenerateTestCase(Isolate* isolate, ModuleWireBytes wire_bytes,
   os << "})();\n";
 }
 
-int WasmExecutionFuzzer::FuzzWasmModule(const uint8_t* data, size_t size,
+int WasmExecutionFuzzer::FuzzWasmModule(Vector<const uint8_t> data,
                                         bool require_valid) {
   v8_fuzzer::FuzzerSupport* support = v8_fuzzer::FuzzerSupport::Get();
   v8::Isolate* isolate = support->GetIsolate();
@@ -269,7 +269,11 @@ int WasmExecutionFuzzer::FuzzWasmModule(const uint8_t* data, size_t size,
   int32_t num_args = 0;
   std::unique_ptr<WasmValue[]> interpreter_args;
   std::unique_ptr<Handle<Object>[]> compiler_args;
-  if (!GenerateModule(i_isolate, &zone, data, size, buffer, num_args,
+  // The first byte builds the bitmask to control which function will be
+  // compiled with Turbofan and which one with Liftoff.
+  uint8_t tier_mask = data.is_empty() ? 0 : data[0];
+  if (!data.is_empty()) data += 1;
+  if (!GenerateModule(i_isolate, &zone, data, buffer, num_args,
                       interpreter_args, compiler_args)) {
     return 0;
   }
@@ -282,7 +286,11 @@ int WasmExecutionFuzzer::FuzzWasmModule(const uint8_t* data, size_t size,
   // Compile with Turbofan here. Liftoff will be tested later.
   MaybeHandle<WasmModuleObject> compiled_module;
   {
-    FlagScope<bool> no_liftoff(&FLAG_liftoff, false);
+    // Explicitly enable Liftoff, disable tiering and set the tier_mask. This
+    // way, we deterministically test a combination of Liftoff and Turbofan.
+    FlagScope<bool> liftoff(&FLAG_liftoff, true);
+    FlagScope<bool> no_tier_up(&FLAG_wasm_tier_up, false);
+    FlagScope<int> tier_mask_scope(&FLAG_wasm_tier_mask_for_testing, tier_mask);
     compiled_module = i_isolate->wasm_engine()->SyncCompile(
         i_isolate, &interpreter_thrower, wire_bytes);
   }
@@ -327,59 +335,32 @@ int WasmExecutionFuzzer::FuzzWasmModule(const uint8_t* data, size_t size,
   bool expect_exception =
       result_interpreter == static_cast<int32_t>(0xDEADBEEF);
 
-  int32_t result_turbofan;
+  int32_t result_compiled;
   {
-    ErrorThrower compiler_thrower(i_isolate, "Turbofan");
+    ErrorThrower compiler_thrower(i_isolate, "Compile");
     MaybeHandle<WasmInstanceObject> compiled_instance =
         i_isolate->wasm_engine()->SyncInstantiate(
             i_isolate, &compiler_thrower, compiled_module.ToHandleChecked(),
             MaybeHandle<JSReceiver>(), MaybeHandle<JSArrayBuffer>());
 
     DCHECK(!compiler_thrower.error());
-    result_turbofan = testing::CallWasmFunctionForTesting(
+    result_compiled = testing::CallWasmFunctionForTesting(
         i_isolate, compiled_instance.ToHandleChecked(), &compiler_thrower,
         "main", num_args, compiler_args.get());
   }
 
   // The WebAssembly spec allows the sign bit of NaN to be non-deterministic.
   // This sign bit may cause result_interpreter to be different than
-  // result_turbofan. Therefore we do not check the equality of the results
+  // result_compiled. Therefore we do not check the equality of the results
   // if the execution may have produced a NaN at some point.
   if (!possible_nondeterminism) {
     if (expect_exception != i_isolate->has_pending_exception()) {
       const char* exception_text[] = {"no exception", "exception"};
-      FATAL("interpreter: %s; turbofan: %s", exception_text[expect_exception],
-            exception_text[i_isolate->has_pending_exception()]);
-    }
-
-    if (!expect_exception) CHECK_EQ(result_interpreter, result_turbofan);
-  }
-
-  // Clear any pending exceptions for the next run.
-  i_isolate->clear_pending_exception();
-
-  int32_t result_liftoff;
-  {
-    FlagScope<bool> liftoff(&FLAG_liftoff, true);
-    FlagScope<bool> no_tier_up(&FLAG_wasm_tier_up, false);
-    ErrorThrower compiler_thrower(i_isolate, "Liftoff");
-    // Re-compile with Liftoff.
-    MaybeHandle<WasmInstanceObject> compiled_instance =
-        testing::CompileAndInstantiateForTesting(i_isolate, &compiler_thrower,
-                                                 wire_bytes);
-    DCHECK(!compiler_thrower.error());
-    result_liftoff = testing::CallWasmFunctionForTesting(
-        i_isolate, compiled_instance.ToHandleChecked(), &compiler_thrower,
-        "main", num_args, compiler_args.get());
-  }
-  if (!possible_nondeterminism) {
-    if (expect_exception != i_isolate->has_pending_exception()) {
-      const char* exception_text[] = {"no exception", "exception"};
-      FATAL("interpreter: %s; liftoff: %s", exception_text[expect_exception],
+      FATAL("interpreter: %s; compiled: %s", exception_text[expect_exception],
             exception_text[i_isolate->has_pending_exception()]);
     }
 
-    if (!expect_exception) CHECK_EQ(result_interpreter, result_liftoff);
+    if (!expect_exception) CHECK_EQ(result_interpreter, result_compiled);
   }
 
   // Cleanup any pending exception.
diff --git a/deps/v8/test/fuzzer/wasm-fuzzer-common.h b/deps/v8/test/fuzzer/wasm-fuzzer-common.h
index 8971d66e764bed..4a86148ca7e625 100644
--- a/deps/v8/test/fuzzer/wasm-fuzzer-common.h
+++ b/deps/v8/test/fuzzer/wasm-fuzzer-common.h
@@ -32,12 +32,11 @@ void GenerateTestCase(Isolate* isolate, ModuleWireBytes wire_bytes,
 class WasmExecutionFuzzer {
  public:
   virtual ~WasmExecutionFuzzer() {}
-  int FuzzWasmModule(const uint8_t* data, size_t size,
-                     bool require_valid = false);
+  int FuzzWasmModule(Vector<const uint8_t> data, bool require_valid = false);
 
  protected:
   virtual bool GenerateModule(
-      Isolate* isolate, Zone* zone, const uint8_t* data, size_t size,
+      Isolate* isolate, Zone* zone, Vector<const uint8_t> data,
       ZoneBuffer& buffer, int32_t& num_args,
       std::unique_ptr<WasmValue[]>& interpreter_args,
       std::unique_ptr<Handle<Object>[]>& compiler_args) = 0;
diff --git a/deps/v8/test/inspector/task-runner.cc b/deps/v8/test/inspector/task-runner.cc
index 921317d0c04539..d76de0d323e8df 100644
--- a/deps/v8/test/inspector/task-runner.cc
+++ b/deps/v8/test/inspector/task-runner.cc
@@ -41,7 +41,8 @@ TaskRunner::TaskRunner(IsolateData::SetupGlobalTasks setup_global_tasks,
       ready_semaphore_(ready_semaphore),
       data_(nullptr),
       process_queue_semaphore_(0),
-      nested_loop_count_(0) {
+      nested_loop_count_(0),
+      is_terminated_(0) {
   Start();
 }
 
@@ -56,7 +57,7 @@ void TaskRunner::Run() {
 
 void TaskRunner::RunMessageLoop(bool only_protocol) {
   int loop_number = ++nested_loop_count_;
-  while (nested_loop_count_ == loop_number && !is_terminated_.Value()) {
+  while (nested_loop_count_ == loop_number && !is_terminated_) {
     TaskRunner::Task* task = GetNext(only_protocol);
     if (!task) return;
     v8::Isolate::Scope isolate_scope(isolate());
@@ -88,13 +89,13 @@ void TaskRunner::Append(Task* task) {
 }
 
 void TaskRunner::Terminate() {
-  is_terminated_.Increment(1);
+  is_terminated_++;
   process_queue_semaphore_.Signal();
 }
 
 TaskRunner::Task* TaskRunner::GetNext(bool only_protocol) {
   for (;;) {
-    if (is_terminated_.Value()) return nullptr;
+    if (is_terminated_) return nullptr;
     if (only_protocol) {
       Task* task = nullptr;
       if (queue_.Dequeue(&task)) {
diff --git a/deps/v8/test/inspector/task-runner.h b/deps/v8/test/inspector/task-runner.h
index 353c78326d1a50..eea9f19e7c5727 100644
--- a/deps/v8/test/inspector/task-runner.h
+++ b/deps/v8/test/inspector/task-runner.h
@@ -10,7 +10,6 @@
 #include "include/v8-inspector.h"
 #include "include/v8-platform.h"
 #include "include/v8.h"
-#include "src/base/atomic-utils.h"
 #include "src/base/macros.h"
 #include "src/base/platform/platform.h"
 #include "src/locked-queue-inl.h"
@@ -64,7 +63,7 @@ class TaskRunner : public v8::base::Thread {
 
   int nested_loop_count_;
 
-  v8::base::AtomicNumber<int> is_terminated_;
+  std::atomic<int> is_terminated_;
 
   DISALLOW_COPY_AND_ASSIGN(TaskRunner);
 };
diff --git a/deps/v8/test/mjsunit/mjsunit.status b/deps/v8/test/mjsunit/mjsunit.status
index 63e73d1a4e29d3..28900d22da0d14 100644
--- a/deps/v8/test/mjsunit/mjsunit.status
+++ b/deps/v8/test/mjsunit/mjsunit.status
@@ -821,11 +821,12 @@
 }], # arch != x64 or deopt_fuzzer
 
 ##############################################################################
-# Liftoff is currently only sufficiently implemented on x64 and ia32.
+# Liftoff is currently only sufficiently implemented on x64, ia32 and arm64.
 # TODO(clemensh): Implement on all other platforms (crbug.com/v8/6600).
-['arch != x64 and arch != ia32', {
+['arch != x64 and arch != ia32 and arch != arm64', {
   'wasm/liftoff': [SKIP],
-}], # arch != x64 and arch != ia32
+  'wasm/tier-up-testing-flag': [SKIP],
+}], # arch != x64 and arch != ia32 and arch != arm64
 
 ##############################################################################
 ['variant == slow_path and gc_stress', {
diff --git a/deps/v8/test/mjsunit/regress/regress-862433.js b/deps/v8/test/mjsunit/regress/regress-862433.js
new file mode 100644
index 00000000000000..015a45a2b04b19
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-862433.js
@@ -0,0 +1,9 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var arr = [];
+for (var i = 1; i != 390000; ++i) {
+  arr.push("f()");
+}
+new Function(arr.join());
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-862538.js b/deps/v8/test/mjsunit/regress/regress-crbug-862538.js
new file mode 100644
index 00000000000000..f5da2eecbe9333
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-862538.js
@@ -0,0 +1,13 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var uvwxyzundefined;
+
+function __f_5778(__v_29973) {
+  var __v_29975 = __v_29973 + undefined;
+  var __v_29976 = __v_29975.substring( 20);
+  ({})[__v_29975];
+  return eval(__v_29976);
+}
+__f_5778("abcdefghijklmnopqrstuvwxyz");
diff --git a/deps/v8/test/mjsunit/wasm/tier-up-testing-flag.js b/deps/v8/test/mjsunit/wasm/tier-up-testing-flag.js
new file mode 100644
index 00000000000000..1b2a11e0caa567
--- /dev/null
+++ b/deps/v8/test/mjsunit/wasm/tier-up-testing-flag.js
@@ -0,0 +1,46 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --liftoff --no-future --no-wasm-tier-up
+// Compile functions 0 and 2 with Turbofan, the rest with Liftoff:
+// Flags: --wasm-tier-mask-for-testing=5
+
+load('test/mjsunit/wasm/wasm-constants.js');
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+const num_functions = 5;
+
+function create_builder() {
+  const builder = new WasmModuleBuilder();
+  for (let i = 0; i < num_functions; ++i) {
+    builder.addFunction('f' + i, kSig_i_v)
+        .addBody(wasmI32Const(i))
+        .exportFunc();
+  }
+  return builder;
+}
+
+function check(instance) {
+  for (let i = 0; i < num_functions; ++i) {
+    const expect_liftoff = i != 0 && i != 2;
+    assertEquals(
+        expect_liftoff, %IsLiftoffFunction(instance.exports['f' + i]),
+        'function ' + i);
+  }
+}
+
+(function testTierTestingFlag() {
+  print(arguments.callee.name);
+  const instance = create_builder().instantiate();
+  check(instance);
+})();
+
+
+async function testTierTestingFlag() {
+  print(arguments.callee.name);
+  const instance = await create_builder().asyncInstantiate();
+  check(instance);
+}
+
+assertPromiseResult(testTierTestingFlag());
diff --git a/deps/v8/test/test262/test262.status b/deps/v8/test/test262/test262.status
index 0584a3918f3d51..3df9ea9859cbb3 100644
--- a/deps/v8/test/test262/test262.status
+++ b/deps/v8/test/test262/test262.status
@@ -480,7 +480,6 @@
   'intl402/Locale/prototype/toStringTag/toString': [FAIL],
 
   # https://bugs.chromium.org/p/v8/issues/detail?id=7869
-  'intl402/RelativeTimeFormat/constructor/constructor/options-order': [FAIL],
   'intl402/RelativeTimeFormat/constructor/supportedLocalesOf/branding': [FAIL],
   'intl402/RelativeTimeFormat/constructor/supportedLocalesOf/length': [FAIL],
   'intl402/RelativeTimeFormat/constructor/supportedLocalesOf/name': [FAIL],
diff --git a/deps/v8/test/unittests/base/atomic-utils-unittest.cc b/deps/v8/test/unittests/base/atomic-utils-unittest.cc
index 794d4c4a50cda5..1d8e71c9aa2819 100644
--- a/deps/v8/test/unittests/base/atomic-utils-unittest.cc
+++ b/deps/v8/test/unittests/base/atomic-utils-unittest.cc
@@ -10,79 +10,6 @@
 
 namespace v8 {
 namespace base {
-
-TEST(AtomicNumber, Constructor) {
-  // Test some common types.
-  AtomicNumber<int> zero_int;
-  AtomicNumber<size_t> zero_size_t;
-  AtomicNumber<intptr_t> zero_intptr_t;
-  EXPECT_EQ(0, zero_int.Value());
-  EXPECT_EQ(0u, zero_size_t.Value());
-  EXPECT_EQ(0, zero_intptr_t.Value());
-}
-
-
-TEST(AtomicNumber, Value) {
-  AtomicNumber<int> a(1);
-  EXPECT_EQ(1, a.Value());
-  AtomicNumber<int> b(-1);
-  EXPECT_EQ(-1, b.Value());
-  AtomicNumber<size_t> c(1);
-  EXPECT_EQ(1u, c.Value());
-  AtomicNumber<size_t> d(static_cast<size_t>(-1));
-  EXPECT_EQ(std::numeric_limits<size_t>::max(), d.Value());
-}
-
-
-TEST(AtomicNumber, SetValue) {
-  AtomicNumber<int> a(1);
-  a.SetValue(-1);
-  EXPECT_EQ(-1, a.Value());
-}
-
-
-TEST(AtomicNumber, Increment) {
-  AtomicNumber<int> a(std::numeric_limits<int>::max());
-  a.Increment(1);
-  EXPECT_EQ(std::numeric_limits<int>::min(), a.Value());
-  // Check that potential signed-ness of the underlying storage has no impact
-  // on unsigned types.
-  AtomicNumber<size_t> b(std::numeric_limits<intptr_t>::max());
-  b.Increment(1);
-  EXPECT_EQ(static_cast<size_t>(std::numeric_limits<intptr_t>::max()) + 1,
-            b.Value());
-  // Should work as decrement as well.
-  AtomicNumber<size_t> c(1);
-  c.Increment(-1);
-  EXPECT_EQ(0u, c.Value());
-  c.Increment(-1);
-  EXPECT_EQ(std::numeric_limits<size_t>::max(), c.Value());
-}
-
-TEST(AtomicNumber, Decrement) {
-  AtomicNumber<size_t> a(std::numeric_limits<size_t>::max());
-  a.Increment(1);
-  EXPECT_EQ(0u, a.Value());
-  a.Decrement(1);
-  EXPECT_EQ(std::numeric_limits<size_t>::max(), a.Value());
-}
-
-TEST(AtomicNumber, OperatorAdditionAssignment) {
-  AtomicNumber<size_t> a(0u);
-  AtomicNumber<size_t> b(std::numeric_limits<size_t>::max());
-  a += b.Value();
-  EXPECT_EQ(a.Value(), b.Value());
-  EXPECT_EQ(b.Value(), std::numeric_limits<size_t>::max());
-}
-
-TEST(AtomicNumber, OperatorSubtractionAssignment) {
-  AtomicNumber<size_t> a(std::numeric_limits<size_t>::max());
-  AtomicNumber<size_t> b(std::numeric_limits<size_t>::max());
-  a -= b.Value();
-  EXPECT_EQ(a.Value(), 0u);
-  EXPECT_EQ(b.Value(), std::numeric_limits<size_t>::max());
-}
-
 namespace {
 
 enum TestFlag : base::AtomicWord {
diff --git a/deps/v8/test/unittests/heap/embedder-tracing-unittest.cc b/deps/v8/test/unittests/heap/embedder-tracing-unittest.cc
index 2aa711258747a7..e07fa1b3278771 100644
--- a/deps/v8/test/unittests/heap/embedder-tracing-unittest.cc
+++ b/deps/v8/test/unittests/heap/embedder-tracing-unittest.cc
@@ -3,11 +3,15 @@
 // found in the LICENSE file.
 
 #include "src/heap/embedder-tracing.h"
+#include "test/unittests/test-utils.h"
 #include "testing/gmock/include/gmock/gmock.h"
 #include "testing/gtest/include/gtest/gtest.h"
 
 namespace v8 {
 namespace internal {
+
+using LocalEmbedderHeapTracerWithIsolate = TestWithIsolate;
+
 namespace heap {
 
 using testing::StrictMock;
@@ -38,14 +42,14 @@ class MockEmbedderHeapTracer : public EmbedderHeapTracer {
 };
 
 TEST(LocalEmbedderHeapTracer, InUse) {
-  LocalEmbedderHeapTracer local_tracer;
   MockEmbedderHeapTracer mock_remote_tracer;
+  LocalEmbedderHeapTracer local_tracer(nullptr);
   local_tracer.SetRemoteTracer(&mock_remote_tracer);
   EXPECT_TRUE(local_tracer.InUse());
 }
 
 TEST(LocalEmbedderHeapTracer, NoRemoteTracer) {
-  LocalEmbedderHeapTracer local_tracer;
+  LocalEmbedderHeapTracer local_tracer(nullptr);
   // We should be able to call all functions without a remote tracer being
   // attached.
   EXPECT_FALSE(local_tracer.InUse());
@@ -59,32 +63,32 @@ TEST(LocalEmbedderHeapTracer, NoRemoteTracer) {
 }
 
 TEST(LocalEmbedderHeapTracer, TracePrologueForwards) {
-  LocalEmbedderHeapTracer local_tracer;
   StrictMock<MockEmbedderHeapTracer> remote_tracer;
+  LocalEmbedderHeapTracer local_tracer(nullptr);
   local_tracer.SetRemoteTracer(&remote_tracer);
   EXPECT_CALL(remote_tracer, TracePrologue());
   local_tracer.TracePrologue();
 }
 
 TEST(LocalEmbedderHeapTracer, TraceEpilogueForwards) {
-  LocalEmbedderHeapTracer local_tracer;
   StrictMock<MockEmbedderHeapTracer> remote_tracer;
+  LocalEmbedderHeapTracer local_tracer(nullptr);
   local_tracer.SetRemoteTracer(&remote_tracer);
   EXPECT_CALL(remote_tracer, TraceEpilogue());
   local_tracer.TraceEpilogue();
 }
 
 TEST(LocalEmbedderHeapTracer, AbortTracingForwards) {
-  LocalEmbedderHeapTracer local_tracer;
   StrictMock<MockEmbedderHeapTracer> remote_tracer;
+  LocalEmbedderHeapTracer local_tracer(nullptr);
   local_tracer.SetRemoteTracer(&remote_tracer);
   EXPECT_CALL(remote_tracer, AbortTracing());
   local_tracer.AbortTracing();
 }
 
 TEST(LocalEmbedderHeapTracer, AbortTracingClearsCachedWrappers) {
-  LocalEmbedderHeapTracer local_tracer;
   StrictMock<MockEmbedderHeapTracer> remote_tracer;
+  LocalEmbedderHeapTracer local_tracer(nullptr);
   local_tracer.SetRemoteTracer(&remote_tracer);
   local_tracer.AddWrapperToTrace(CreateWrapperInfo());
   EXPECT_CALL(remote_tracer, AbortTracing());
@@ -93,31 +97,31 @@ TEST(LocalEmbedderHeapTracer, AbortTracingClearsCachedWrappers) {
 }
 
 TEST(LocalEmbedderHeapTracer, EnterFinalPauseForwards) {
-  LocalEmbedderHeapTracer local_tracer;
   StrictMock<MockEmbedderHeapTracer> remote_tracer;
+  LocalEmbedderHeapTracer local_tracer(nullptr);
   local_tracer.SetRemoteTracer(&remote_tracer);
   EXPECT_CALL(remote_tracer, EnterFinalPause());
   local_tracer.EnterFinalPause();
 }
 
 TEST(LocalEmbedderHeapTracer, IsRemoteTracingDoneIncludesRemote) {
-  LocalEmbedderHeapTracer local_tracer;
   StrictMock<MockEmbedderHeapTracer> remote_tracer;
+  LocalEmbedderHeapTracer local_tracer(nullptr);
   local_tracer.SetRemoteTracer(&remote_tracer);
   EXPECT_CALL(remote_tracer, IsTracingDone());
   local_tracer.IsRemoteTracingDone();
 }
 
 TEST(LocalEmbedderHeapTracer, NumberOfCachedWrappersToTraceExcludesRemote) {
-  LocalEmbedderHeapTracer local_tracer;
+  LocalEmbedderHeapTracer local_tracer(nullptr);
   StrictMock<MockEmbedderHeapTracer> remote_tracer;
   local_tracer.SetRemoteTracer(&remote_tracer);
   local_tracer.NumberOfCachedWrappersToTrace();
 }
 
 TEST(LocalEmbedderHeapTracer, RegisterWrappersWithRemoteTracer) {
-  LocalEmbedderHeapTracer local_tracer;
   StrictMock<MockEmbedderHeapTracer> remote_tracer;
+  LocalEmbedderHeapTracer local_tracer(nullptr);
   local_tracer.SetRemoteTracer(&remote_tracer);
   local_tracer.AddWrapperToTrace(CreateWrapperInfo());
   EXPECT_EQ(1u, local_tracer.NumberOfCachedWrappersToTrace());
@@ -129,8 +133,8 @@ TEST(LocalEmbedderHeapTracer, RegisterWrappersWithRemoteTracer) {
 }
 
 TEST(LocalEmbedderHeapTracer, TraceFinishes) {
-  LocalEmbedderHeapTracer local_tracer;
   StrictMock<MockEmbedderHeapTracer> remote_tracer;
+  LocalEmbedderHeapTracer local_tracer(nullptr);
   local_tracer.SetRemoteTracer(&remote_tracer);
   local_tracer.AddWrapperToTrace(CreateWrapperInfo());
   EXPECT_EQ(1u, local_tracer.NumberOfCachedWrappersToTrace());
@@ -144,8 +148,8 @@ TEST(LocalEmbedderHeapTracer, TraceFinishes) {
 }
 
 TEST(LocalEmbedderHeapTracer, TraceDoesNotFinish) {
-  LocalEmbedderHeapTracer local_tracer;
   StrictMock<MockEmbedderHeapTracer> remote_tracer;
+  LocalEmbedderHeapTracer local_tracer(nullptr);
   local_tracer.SetRemoteTracer(&remote_tracer);
   local_tracer.AddWrapperToTrace(CreateWrapperInfo());
   EXPECT_EQ(1u, local_tracer.NumberOfCachedWrappersToTrace());
@@ -158,6 +162,23 @@ TEST(LocalEmbedderHeapTracer, TraceDoesNotFinish) {
   EXPECT_EQ(0u, local_tracer.NumberOfCachedWrappersToTrace());
 }
 
+TEST_F(LocalEmbedderHeapTracerWithIsolate, SetRemoteTracerSetsIsolate) {
+  StrictMock<MockEmbedderHeapTracer> remote_tracer;
+  LocalEmbedderHeapTracer local_tracer(isolate());
+  local_tracer.SetRemoteTracer(&remote_tracer);
+  EXPECT_EQ(isolate(), reinterpret_cast<Isolate*>(remote_tracer.isolate()));
+}
+
+TEST_F(LocalEmbedderHeapTracerWithIsolate, DestructorClearsIsolate) {
+  StrictMock<MockEmbedderHeapTracer> remote_tracer;
+  {
+    LocalEmbedderHeapTracer local_tracer(isolate());
+    local_tracer.SetRemoteTracer(&remote_tracer);
+    EXPECT_EQ(isolate(), reinterpret_cast<Isolate*>(remote_tracer.isolate()));
+  }
+  EXPECT_EQ(nullptr, remote_tracer.isolate());
+}
+
 }  // namespace heap
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/test/unittests/object-unittest.cc b/deps/v8/test/unittests/object-unittest.cc
index 6856053d2f1805..1fe09d81c99736 100644
--- a/deps/v8/test/unittests/object-unittest.cc
+++ b/deps/v8/test/unittests/object-unittest.cc
@@ -143,11 +143,11 @@ TEST_F(ObjectWithIsolate, DictionaryGrowth) {
   // If we grow by larger chunks, the next (sufficiently big) power of 2 is
   // chosen as the capacity.
   dict = NumberDictionary::New(isolate(), 1);
-  dict = NumberDictionary::EnsureCapacity(dict, 65);
+  dict = NumberDictionary::EnsureCapacity(isolate(), dict, 65);
   CHECK_EQ(128, dict->Capacity());
 
   dict = NumberDictionary::New(isolate(), 1);
-  dict = NumberDictionary::EnsureCapacity(dict, 30);
+  dict = NumberDictionary::EnsureCapacity(isolate(), dict, 30);
   CHECK_EQ(64, dict->Capacity());
 }
 
diff --git a/deps/v8/test/unittests/wasm/function-body-decoder-unittest.cc b/deps/v8/test/unittests/wasm/function-body-decoder-unittest.cc
index 1d480a9d094626..3b25056160a320 100644
--- a/deps/v8/test/unittests/wasm/function-body-decoder-unittest.cc
+++ b/deps/v8/test/unittests/wasm/function-body-decoder-unittest.cc
@@ -2975,7 +2975,6 @@ TEST_F(WasmOpcodeLengthTest, SimpleExpressions) {
   EXPECT_LENGTH(1, kExprF64ReinterpretI64);
   EXPECT_LENGTH(1, kExprI32ReinterpretF32);
   EXPECT_LENGTH(1, kExprI64ReinterpretF64);
-  EXPECT_LENGTH(1, kExprRefEq);
 }
 
 TEST_F(WasmOpcodeLengthTest, SimdExpressions) {
diff --git a/deps/v8/test/unittests/wasm/module-decoder-unittest.cc b/deps/v8/test/unittests/wasm/module-decoder-unittest.cc
index a6ad2ce0c82904..26b4f74a7ab4c9 100644
--- a/deps/v8/test/unittests/wasm/module-decoder-unittest.cc
+++ b/deps/v8/test/unittests/wasm/module-decoder-unittest.cc
@@ -936,6 +936,262 @@ TEST_F(WasmModuleVerifyTest, MultipleIndirectFunctions) {
   }
 }
 
+TEST_F(WasmModuleVerifyTest, ElementSectionMultipleTables) {
+  // Test that if we have multiple tables, in the element section we can target
+  // and initialize all tables.
+  FlagScope<bool> flag_scope(&FLAG_experimental_wasm_anyref, true);
+  static const byte data[] = {
+      // sig#0 ---------------------------------------------------------------
+      SIGNATURES_SECTION_VOID_VOID,
+      // funcs ---------------------------------------------------------------
+      ONE_EMPTY_FUNCTION,
+      // table declaration ---------------------------------------------------
+      SECTION(Table, 7), ENTRY_COUNT(2),  // section header
+      kLocalAnyFunc, 0, 5,                // table 0
+      kLocalAnyFunc, 0, 9,                // table 1
+      // elements ------------------------------------------------------------
+      SECTION(Element, 14),
+      2,                         // entry count
+      TABLE_INDEX(0),            // element for table 0
+      WASM_INIT_EXPR_I32V_1(0),  // index
+      1,                         // elements count
+      FUNC_INDEX(0),             // function
+      TABLE_INDEX(1),            // element for table 1
+      WASM_INIT_EXPR_I32V_1(7),  // index
+      2,                         // elements count
+      FUNC_INDEX(0),             // entry 0
+      FUNC_INDEX(0),             // entry 1
+  };
+
+  EXPECT_VERIFIES(data);
+}
+
+TEST_F(WasmModuleVerifyTest, ElementSectionMixedTables) {
+  // Test that if we have multiple tables, both imported and module-defined, in
+  // the element section we can target and initialize all tables.
+  FlagScope<bool> flag_scope(&FLAG_experimental_wasm_anyref, true);
+  static const byte data[] = {
+      // sig#0 ---------------------------------------------------------------
+      SIGNATURES_SECTION_VOID_VOID,
+      // imports -------------------------------------------------------------
+      SECTION(Import, 17), ENTRY_COUNT(2),
+      NAME_LENGTH(1),  // --
+      'm',             // module name
+      NAME_LENGTH(1),  // --
+      't',             // table name
+      kExternalTable,  // import kind
+      kLocalAnyFunc,   // elem_type
+      0,               // no maximum field
+      5,               // initial size
+      NAME_LENGTH(1),  // --
+      'm',             // module name
+      NAME_LENGTH(1),  // --
+      's',             // table name
+      kExternalTable,  // import kind
+      kLocalAnyFunc,   // elem_type
+      0,               // no maximum field
+      10,              // initial size
+      // funcs ---------------------------------------------------------------
+      ONE_EMPTY_FUNCTION,
+      // table declaration ---------------------------------------------------
+      SECTION(Table, 7), ENTRY_COUNT(2),  // section header
+      kLocalAnyFunc, 0, 15,               // table 0
+      kLocalAnyFunc, 0, 19,               // table 1
+      // elements ------------------------------------------------------------
+      SECTION(Element, 27),
+      4,                          // entry count
+      TABLE_INDEX(0),             // element for table 0
+      WASM_INIT_EXPR_I32V_1(0),   // index
+      1,                          // elements count
+      FUNC_INDEX(0),              // function
+      TABLE_INDEX(1),             // element for table 1
+      WASM_INIT_EXPR_I32V_1(7),   // index
+      2,                          // elements count
+      FUNC_INDEX(0),              // entry 0
+      FUNC_INDEX(0),              // entry 1
+      TABLE_INDEX(2),             // element for table 2
+      WASM_INIT_EXPR_I32V_1(12),  // index
+      1,                          // elements count
+      FUNC_INDEX(0),              // function
+      TABLE_INDEX(3),             // element for table 1
+      WASM_INIT_EXPR_I32V_1(17),  // index
+      2,                          // elements count
+      FUNC_INDEX(0),              // entry 0
+      FUNC_INDEX(0),              // entry 1
+  };
+
+  EXPECT_VERIFIES(data);
+}
+
+TEST_F(WasmModuleVerifyTest, ElementSectionMultipleTablesArbitraryOrder) {
+  // Test that the order in which tables are targeted in the element secion
+  // can be arbitrary.
+  FlagScope<bool> flag_scope(&FLAG_experimental_wasm_anyref, true);
+  static const byte data[] = {
+      // sig#0 ---------------------------------------------------------------
+      SIGNATURES_SECTION_VOID_VOID,
+      // funcs ---------------------------------------------------------------
+      ONE_EMPTY_FUNCTION,
+      // table declaration ---------------------------------------------------
+      SECTION(Table, 7), ENTRY_COUNT(2),  // section header
+      kLocalAnyFunc, 0, 5,                // table 0
+      kLocalAnyFunc, 0, 9,                // table 1
+      // elements ------------------------------------------------------------
+      SECTION(Element, 20),
+      3,                         // entry count
+      TABLE_INDEX(0),            // element for table 1
+      WASM_INIT_EXPR_I32V_1(0),  // index
+      1,                         // elements count
+      FUNC_INDEX(0),             // function
+      TABLE_INDEX(1),            // element for table 0
+      WASM_INIT_EXPR_I32V_1(7),  // index
+      2,                         // elements count
+      FUNC_INDEX(0),             // entry 0
+      FUNC_INDEX(0),             // entry 1
+      TABLE_INDEX(0),            // element for table 1
+      WASM_INIT_EXPR_I32V_1(3),  // index
+      1,                         // elements count
+      FUNC_INDEX(0),             // function
+  };
+
+  EXPECT_VERIFIES(data);
+}
+
+TEST_F(WasmModuleVerifyTest, ElementSectionMixedTablesArbitraryOrder) {
+  // Test that the order in which tables are targeted in the element secion can
+  // be arbitrary. In this test, tables can be both imported and module-defined.
+  FlagScope<bool> flag_scope(&FLAG_experimental_wasm_anyref, true);
+  static const byte data[] = {
+      // sig#0 ---------------------------------------------------------------
+      SIGNATURES_SECTION_VOID_VOID,
+      // imports -------------------------------------------------------------
+      SECTION(Import, 17), ENTRY_COUNT(2),
+      NAME_LENGTH(1),  // --
+      'm',             // module name
+      NAME_LENGTH(1),  // --
+      't',             // table name
+      kExternalTable,  // import kind
+      kLocalAnyFunc,   // elem_type
+      0,               // no maximum field
+      5,               // initial size
+      NAME_LENGTH(1),  // --
+      'm',             // module name
+      NAME_LENGTH(1),  // --
+      's',             // table name
+      kExternalTable,  // import kind
+      kLocalAnyFunc,   // elem_type
+      0,               // no maximum field
+      10,              // initial size
+      // funcs ---------------------------------------------------------------
+      ONE_EMPTY_FUNCTION,
+      // table declaration ---------------------------------------------------
+      SECTION(Table, 7), ENTRY_COUNT(2),  // section header
+      kLocalAnyFunc, 0, 15,               // table 0
+      kLocalAnyFunc, 0, 19,               // table 1
+      // elements ------------------------------------------------------------
+      SECTION(Element, 27),
+      4,                          // entry count
+      TABLE_INDEX(2),             // element for table 0
+      WASM_INIT_EXPR_I32V_1(10),  // index
+      1,                          // elements count
+      FUNC_INDEX(0),              // function
+      TABLE_INDEX(3),             // element for table 1
+      WASM_INIT_EXPR_I32V_1(17),  // index
+      2,                          // elements count
+      FUNC_INDEX(0),              // entry 0
+      FUNC_INDEX(0),              // entry 1
+      TABLE_INDEX(0),             // element for table 2
+      WASM_INIT_EXPR_I32V_1(2),   // index
+      1,                          // elements count
+      FUNC_INDEX(0),              // function
+      TABLE_INDEX(1),             // element for table 1
+      WASM_INIT_EXPR_I32V_1(7),   // index
+      2,                          // elements count
+      FUNC_INDEX(0),              // entry 0
+      FUNC_INDEX(0),              // entry 1
+  };
+
+  EXPECT_VERIFIES(data);
+}
+
+TEST_F(WasmModuleVerifyTest, ElementSectionDontInitAnyRefTable) {
+  // Test that tables of type 'AnyRef' cannot be initialized by the element
+  // section.
+  FlagScope<bool> flag_scope(&FLAG_experimental_wasm_anyref, true);
+  static const byte data[] = {
+      // sig#0 ---------------------------------------------------------------
+      SIGNATURES_SECTION_VOID_VOID,
+      // funcs ---------------------------------------------------------------
+      ONE_EMPTY_FUNCTION,
+      // table declaration ---------------------------------------------------
+      SECTION(Table, 7), ENTRY_COUNT(2),  // section header
+      kLocalAnyRef, 0, 5,                 // table 0
+      kLocalAnyFunc, 0, 9,                // table 1
+      // elements ------------------------------------------------------------
+      SECTION(Element, 14),
+      2,                         // entry count
+      TABLE_INDEX(0),            // element for table 0
+      WASM_INIT_EXPR_I32V_1(0),  // index
+      1,                         // elements count
+      FUNC_INDEX(0),             // function
+      TABLE_INDEX(1),            // element for table 1
+      WASM_INIT_EXPR_I32V_1(7),  // index
+      2,                         // elements count
+      FUNC_INDEX(0),             // entry 0
+      FUNC_INDEX(0),             // entry 1
+  };
+
+  EXPECT_FAILURE(data);
+}
+
+TEST_F(WasmModuleVerifyTest, ElementSectionDontInitAnyRefImportedTable) {
+  // Test that imported tables of type AnyRef cannot be initialized in the
+  // elements section.
+  FlagScope<bool> flag_scope(&FLAG_experimental_wasm_anyref, true);
+  static const byte data[] = {
+      // sig#0 ---------------------------------------------------------------
+      SIGNATURES_SECTION_VOID_VOID,
+      // imports -------------------------------------------------------------
+      SECTION(Import, 17), ENTRY_COUNT(2),
+      NAME_LENGTH(1),  // --
+      'm',             // module name
+      NAME_LENGTH(1),  // --
+      't',             // table name
+      kExternalTable,  // import kind
+      kLocalAnyFunc,   // elem_type
+      0,               // no maximum field
+      5,               // initial size
+      NAME_LENGTH(1),  // --
+      'm',             // module name
+      NAME_LENGTH(1),  // --
+      's',             // table name
+      kExternalTable,  // import kind
+      kLocalAnyRef,    // elem_type
+      0,               // no maximum field
+      10,              // initial size
+      // funcs ---------------------------------------------------------------
+      ONE_EMPTY_FUNCTION,
+      // table declaration ---------------------------------------------------
+      SECTION(Table, 7), ENTRY_COUNT(2),  // section header
+      kLocalAnyFunc, 0, 15,               // table 0
+      kLocalAnyFunc, 0, 19,               // table 1
+      // elements ------------------------------------------------------------
+      SECTION(Element, 14),
+      4,                          // entry count
+      TABLE_INDEX(0),             // element for table 0
+      WASM_INIT_EXPR_I32V_1(10),  // index
+      1,                          // elements count
+      FUNC_INDEX(0),              // function
+      TABLE_INDEX(1),             // element for table 1
+      WASM_INIT_EXPR_I32V_1(17),  // index
+      2,                          // elements count
+      FUNC_INDEX(0),              // entry 0
+      FUNC_INDEX(0),              // entry 1
+  };
+
+  EXPECT_FAILURE(data);
+}
+
 TEST_F(WasmModuleVerifyTest, IndirectFunctionNoFunctions) {
   static const byte data[] = {
       // sig#0 -------------------------------------------------------
diff --git a/deps/v8/third_party/antlr4/BUILD.gn b/deps/v8/third_party/antlr4/BUILD.gn
index bd58a1804d1558..65e2a78eb4c398 100644
--- a/deps/v8/third_party/antlr4/BUILD.gn
+++ b/deps/v8/third_party/antlr4/BUILD.gn
@@ -9,6 +9,9 @@ config("antlr-compatibility") {
       "-Wno-unused-but-set-variable",
     ]
   }
+  if (is_aix) {
+    cflags += [ "-fdollars-in-identifiers" ]
+  }
 }
 
 source_set("antlr4") {
diff --git a/deps/v8/tools/lldb_commands.py b/deps/v8/tools/lldb_commands.py
index 46e5e8b0fb78b6..d8946ee485a237 100644
--- a/deps/v8/tools/lldb_commands.py
+++ b/deps/v8/tools/lldb_commands.py
@@ -2,66 +2,24 @@
 # Use of this source code is governed by a BSD-style license that can be
 # found in the LICENSE file.
 
-# Load this file by adding this to your ~/.lldbinit:
-# command script import <this_dir>/lldb_commands.py
-
 import lldb
 import re
 
-#####################
-# Helper functions. #
-#####################
-def current_thread(debugger):
-  return debugger.GetSelectedTarget().GetProcess().GetSelectedThread()
-
-def current_frame(debugger):
-  return current_thread(debugger).GetSelectedFrame()
-
-def no_arg_cmd(debugger, cmd):
-  current_frame(debugger).EvaluateExpression(cmd)
-  print("")
-
-def ptr_arg_cmd(debugger, name, param, cmd):
-  if not param:
-    print("'{}' requires an argument".format(name))
-    return
-  param = '(void*)({})'.format(param)
-  no_arg_cmd(debugger, cmd.format(param))
-
-#####################
-# lldb commands.    #
-#####################
-def job(debugger, param, *args):
-  """Print a v8 heap object"""
-  ptr_arg_cmd(debugger, 'job', param, "_v8_internal_Print_Object({})")
-
-def jlh(debugger, param, *args):
-  """Print v8::Local handle value"""
-  ptr_arg_cmd(debugger, 'jlh', param,
-              "_v8_internal_Print_Object(*(v8::internal::Object**)(*{}))")
-
-def jco(debugger, param, *args):
-  """Print the code object at the given pc (default: current pc)"""
-  if not param:
-    param = str(current_frame(debugger).FindRegister("pc").value)
-  ptr_arg_cmd(debugger, 'jco', param, "_v8_internal_Print_Code({})")
-
-def jld(debugger, param, *args):
-  """Print a v8 LayoutDescriptor object"""
-  ptr_arg_cmd(debugger, 'jld', param,
-              "_v8_internal_Print_LayoutDescriptor({})")
-
-def jtt(debugger, param, *args):
-  """Print the transition tree of a v8 Map"""
-  ptr_arg_cmd(debugger, 'jtt', param, "_v8_internal_Print_TransitionTree({})")
-
 def jst(debugger, *args):
   """Print the current JavaScript stack trace"""
-  no_arg_cmd(debugger, "_v8_internal_Print_StackTrace()")
+  target = debugger.GetSelectedTarget()
+  process = target.GetProcess()
+  thread = process.GetSelectedThread()
+  frame = thread.GetSelectedFrame()
+  frame.EvaluateExpression("_v8_internal_Print_StackTrace();")
+  print("")
 
 def jss(debugger, *args):
   """Skip the jitted stack on x64 to where we entered JS last"""
-  frame = current_frame(debugger)
+  target = debugger.GetSelectedTarget()
+  process = target.GetProcess()
+  thread = process.GetSelectedThread()
+  frame = thread.GetSelectedFrame()
   js_entry_sp = frame.EvaluateExpression(
       "v8::internal::Isolate::Current()->thread_local_top()->js_entry_sp_;") \
        .GetValue()
@@ -78,7 +36,10 @@ def bta(debugger, *args):
   func_name_re = re.compile("([^(<]+)(?:\(.+\))?")
   assert_re = re.compile(
       "^v8::internal::Per\w+AssertType::(\w+)_ASSERT, (false|true)>")
-  thread = current_thread(debugger)
+  target = debugger.GetSelectedTarget()
+  process = target.GetProcess()
+  thread = process.GetSelectedThread()
+  frame = thread.GetSelectedFrame()
   for frame in thread:
     functionSignature = frame.GetDisplayFunctionName()
     if functionSignature is None:
@@ -105,8 +66,7 @@ def bta(debugger, *args):
       print("%s -> %s %s (%s)\033[0m" % (
           color, prefix, match.group(2), match.group(1)))
 
-def __lldb_init_module(debugger, dict):
-  debugger.HandleCommand('settings set target.x86-disassembly-flavor intel')
-  for cmd in ('job', 'jlh', 'jco', 'jld', 'jtt', 'jst', 'jss', 'bta'):
-    debugger.HandleCommand(
-      'command script add -f lldb_commands.{} {}'.format(cmd, cmd))
+def __lldb_init_module (debugger, dict):
+  debugger.HandleCommand('command script add -f lldb_commands.jst jst')
+  debugger.HandleCommand('command script add -f lldb_commands.jss jss')
+  debugger.HandleCommand('command script add -f lldb_commands.bta bta')
diff --git a/deps/v8/tools/lldbinit b/deps/v8/tools/lldbinit
new file mode 100755
index 00000000000000..1d093d85e34e0a
--- /dev/null
+++ b/deps/v8/tools/lldbinit
@@ -0,0 +1,20 @@
+# Copyright 2017 the V8 project authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+# Print HeapObjects.
+command regex -h 'Print a v8 JavaScript object' job 's/(.+)/expr -- '_v8_internal_Print_Object((void*)(%1))/'
+
+# Print v8::Local handle value.
+command regex -h 'Print content of a v8::Local handle' jlh 's/(.+)/expr -- '_v8_internal_Print_Object(*(v8::internal::Object**)(*%1))/'
+
+# Print Code objects containing given PC.
+command regex -h 'Print a v8 Code object from an internal code address' jco 's/(.+)/expr -- '_v8_internal_Print_Code((void*)(*%1))/'
+
+# Print LayoutDescriptor.
+command regex -h 'Print a v8 LayoutDescriptor object' jld 's/(.+)/expr -- '_v8_internal_Print_LayoutDescriptor((void*)(%1))/'
+
+# Print TransitionTree.
+command regex -h 'Print the transition tree of a v8 Map' jtt 's/(.+)/expr -- '_v8_internal_Print_TransitionTree((void*)(%1))/'
+
+command script import ~/lldb_commands.py
diff --git a/deps/v8/tools/mb/mb.py b/deps/v8/tools/mb/mb.py
index b2ae0c763f6a15..189de8b6b7f2d7 100755
--- a/deps/v8/tools/mb/mb.py
+++ b/deps/v8/tools/mb/mb.py
@@ -832,6 +832,8 @@ def GNCmd(self, subcommand, path, *args):
       subdir, exe = 'linux64', 'gn'
     elif self.platform == 'darwin':
       subdir, exe = 'mac', 'gn'
+    elif self.platform == 'aix6':
+      subdir, exe = 'aix', 'gn'
     else:
       subdir, exe = 'win', 'gn.exe'
 
diff --git a/deps/v8/tools/turbolizer/package-lock.json b/deps/v8/tools/turbolizer/package-lock.json
index 05a5daf031de72..d12b8096d5e83d 100644
--- a/deps/v8/tools/turbolizer/package-lock.json
+++ b/deps/v8/tools/turbolizer/package-lock.json
@@ -241,17 +241,55 @@
         "@types/d3-selection": "*"
       }
     },
+    "@types/estree": {
+      "version": "0.0.39",
+      "resolved": "https://registry.npmjs.org/@types/estree/-/estree-0.0.39.tgz",
+      "integrity": "sha512-EYNwp3bU+98cpU4lAWYYL7Zz+2gryWH1qbdDTidVd6hkiR6weksdbMadyXKXNPEkQFhXM+hVO9ZygomHXp+AIw=="
+    },
     "@types/geojson": {
       "version": "7946.0.3",
       "resolved": "https://registry.npmjs.org/@types/geojson/-/geojson-7946.0.3.tgz",
       "integrity": "sha512-BYHiG1vQJ7T93uswzuXZ0OBPWqj5tsAPtaMDQADV8sn2InllXarwg9llr6uaW22q1QCwBZ81gVajOpYWzjesug=="
     },
+    "@types/node": {
+      "version": "10.5.2",
+      "resolved": "https://registry.npmjs.org/@types/node/-/node-10.5.2.tgz",
+      "integrity": "sha512-m9zXmifkZsMHZBOyxZWilMwmTlpC8x5Ty360JKTiXvlXZfBWYpsg9ZZvP/Ye+iZUh+Q+MxDLjItVTWIsfwz+8Q=="
+    },
     "@types/semver": {
       "version": "5.5.0",
       "resolved": "https://registry.npmjs.org/@types/semver/-/semver-5.5.0.tgz",
       "integrity": "sha512-41qEJgBH/TWgo5NFSvBCJ1qkoi3Q6ONSF2avrHq1LVEZfYpdHmj0y9SuTK+u9ZhG1sYQKBL1AWXKyLWP4RaUoQ==",
       "dev": true
     },
+    "arr-diff": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/arr-diff/-/arr-diff-2.0.0.tgz",
+      "integrity": "sha1-jzuCf5Vai9ZpaX5KQlasPOrjVs8=",
+      "requires": {
+        "arr-flatten": "^1.0.1"
+      }
+    },
+    "arr-flatten": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/arr-flatten/-/arr-flatten-1.1.0.tgz",
+      "integrity": "sha512-L3hKV5R/p5o81R7O02IGnwpDmkp6E982XhtbuwSe3O4qOtMMMtodicASA1Cny2U+aCXcNpml+m4dPsvsJ3jatg=="
+    },
+    "array-unique": {
+      "version": "0.2.1",
+      "resolved": "https://registry.npmjs.org/array-unique/-/array-unique-0.2.1.tgz",
+      "integrity": "sha1-odl8yvy8JiXMcPrc6zalDFiwGlM="
+    },
+    "braces": {
+      "version": "1.8.5",
+      "resolved": "https://registry.npmjs.org/braces/-/braces-1.8.5.tgz",
+      "integrity": "sha1-uneWLhLf+WnWt2cR6RS3N4V79qc=",
+      "requires": {
+        "expand-range": "^1.8.1",
+        "preserve": "^0.2.0",
+        "repeat-element": "^1.1.2"
+      }
+    },
     "commander": {
       "version": "2.15.1",
       "resolved": "https://registry.npmjs.org/commander/-/commander-2.15.1.tgz",
@@ -264,9 +302,9 @@
       "dev": true
     },
     "d3": {
-      "version": "5.4.0",
-      "resolved": "https://registry.npmjs.org/d3/-/d3-5.4.0.tgz",
-      "integrity": "sha1-CQGZqFadHeI9BKP/B/4TYJX+p04=",
+      "version": "5.5.0",
+      "resolved": "https://registry.npmjs.org/d3/-/d3-5.5.0.tgz",
+      "integrity": "sha512-HRDSYvT3n7kMvJH7Avp7iR0Xsz97bkCFka9aOg04EdyXyiAP8yQzUpLH3712y9R7ffVo1g94t1OYFHBB0yI9vQ==",
       "requires": {
         "d3-array": "1",
         "d3-axis": "1",
@@ -343,9 +381,9 @@
       "integrity": "sha512-dmL9Zr/v39aSSMnLOTd58in2RbregCg4UtGyUArvEKTTN6S3HKEy+ziBWVYo9PTzRyVW+pUBHUtRKz0HYX+SQg=="
     },
     "d3-contour": {
-      "version": "1.2.0",
-      "resolved": "https://registry.npmjs.org/d3-contour/-/d3-contour-1.2.0.tgz",
-      "integrity": "sha512-nDzZ2KDnrgTrhMjV8TH0RNrljk6uPNAGkG/v/1SKNVvJa2JU8szjh7o2ZYTX8yufA2oCI5HyeMqbzwiB+oDoIA==",
+      "version": "1.3.0",
+      "resolved": "https://registry.npmjs.org/d3-contour/-/d3-contour-1.3.0.tgz",
+      "integrity": "sha512-6zccxidQRtcydx0lWqHawdW1UcBzKZTxv0cW90Dlx98pY/L7GjQJmftH1tWopYFDaLCoXU0ECg9x/z2EuFT8tg==",
       "requires": {
         "d3-array": "^1.1.1"
       }
@@ -445,9 +483,9 @@
       "integrity": "sha1-ZkLlBsb6OmSFldKyRpeIqNElKdM="
     },
     "d3-scale": {
-      "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/d3-scale/-/d3-scale-2.0.0.tgz",
-      "integrity": "sha512-Sa2Ny6CoJT7x6dozxPnvUQT61epGWsgppFvnNl8eJEzfJBG0iDBBTJAtz2JKem7Mb+NevnaZiDiIDHsuWkv6vg==",
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/d3-scale/-/d3-scale-2.1.0.tgz",
+      "integrity": "sha512-Bb2N3ZgzPdKVEoWGkt8lPV6R7YdpSBWI70Xf26NQHOVjs77a6gLUmBOOPt9d9nB8JiQhwXY1RHCa+eSyWCJZIQ==",
       "requires": {
         "d3-array": "^1.2.0",
         "d3-collection": "1",
@@ -541,6 +579,97 @@
         "sigmund": "^1.0.1"
       }
     },
+    "estree-walker": {
+      "version": "0.5.2",
+      "resolved": "https://registry.npmjs.org/estree-walker/-/estree-walker-0.5.2.tgz",
+      "integrity": "sha512-XpCnW/AE10ws/kDAs37cngSkvgIR8aN3G0MS85m7dUpuK2EREo9VJ00uvw6Dg/hXEpfsE1I1TvJOJr+Z+TL+ig=="
+    },
+    "expand-brackets": {
+      "version": "0.1.5",
+      "resolved": "https://registry.npmjs.org/expand-brackets/-/expand-brackets-0.1.5.tgz",
+      "integrity": "sha1-3wcoTjQqgHzXM6xa9yQR5YHRF3s=",
+      "requires": {
+        "is-posix-bracket": "^0.1.0"
+      }
+    },
+    "expand-range": {
+      "version": "1.8.2",
+      "resolved": "https://registry.npmjs.org/expand-range/-/expand-range-1.8.2.tgz",
+      "integrity": "sha1-opnv/TNf4nIeuujiV+x5ZE/IUzc=",
+      "requires": {
+        "fill-range": "^2.1.0"
+      }
+    },
+    "extglob": {
+      "version": "0.3.2",
+      "resolved": "https://registry.npmjs.org/extglob/-/extglob-0.3.2.tgz",
+      "integrity": "sha1-Lhj/PS9JqydlzskCPwEdqo2DSaE=",
+      "requires": {
+        "is-extglob": "^1.0.0"
+      }
+    },
+    "filename-regex": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/filename-regex/-/filename-regex-2.0.1.tgz",
+      "integrity": "sha1-wcS5vuPglyXdsQa3XB4wH+LxiyY="
+    },
+    "fill-range": {
+      "version": "2.2.4",
+      "resolved": "https://registry.npmjs.org/fill-range/-/fill-range-2.2.4.tgz",
+      "integrity": "sha512-cnrcCbj01+j2gTG921VZPnHbjmdAf8oQV/iGeV2kZxGSyfYjjTyY79ErsK1WJWMpw6DaApEX72binqJE+/d+5Q==",
+      "requires": {
+        "is-number": "^2.1.0",
+        "isobject": "^2.0.0",
+        "randomatic": "^3.0.0",
+        "repeat-element": "^1.1.2",
+        "repeat-string": "^1.5.2"
+      }
+    },
+    "for-in": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/for-in/-/for-in-1.0.2.tgz",
+      "integrity": "sha1-gQaNKVqBQuwKxybG4iAMMPttXoA="
+    },
+    "for-own": {
+      "version": "0.1.5",
+      "resolved": "https://registry.npmjs.org/for-own/-/for-own-0.1.5.tgz",
+      "integrity": "sha1-UmXGgaTylNq78XyVCbZ2OqhFEM4=",
+      "requires": {
+        "for-in": "^1.0.1"
+      }
+    },
+    "fs-extra": {
+      "version": "5.0.0",
+      "resolved": "https://registry.npmjs.org/fs-extra/-/fs-extra-5.0.0.tgz",
+      "integrity": "sha512-66Pm4RYbjzdyeuqudYqhFiNBbCIuI9kgRqLPSHIlXHidW8NIQtVdkM1yeZ4lXwuhbTETv3EUGMNHAAw6hiundQ==",
+      "requires": {
+        "graceful-fs": "^4.1.2",
+        "jsonfile": "^4.0.0",
+        "universalify": "^0.1.0"
+      }
+    },
+    "glob-base": {
+      "version": "0.3.0",
+      "resolved": "https://registry.npmjs.org/glob-base/-/glob-base-0.3.0.tgz",
+      "integrity": "sha1-27Fk9iIbHAscz4Kuoyi0l98Oo8Q=",
+      "requires": {
+        "glob-parent": "^2.0.0",
+        "is-glob": "^2.0.0"
+      }
+    },
+    "glob-parent": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/glob-parent/-/glob-parent-2.0.0.tgz",
+      "integrity": "sha1-gTg9ctsFT8zPUzbaqQLxgvbtuyg=",
+      "requires": {
+        "is-glob": "^2.0.0"
+      }
+    },
+    "graceful-fs": {
+      "version": "4.1.11",
+      "resolved": "https://registry.npmjs.org/graceful-fs/-/graceful-fs-4.1.11.tgz",
+      "integrity": "sha1-Dovf5NHduIVNZOBOp8AOKgJuVlg="
+    },
     "iconv-lite": {
       "version": "0.4.23",
       "resolved": "https://registry.npmjs.org/iconv-lite/-/iconv-lite-0.4.23.tgz",
@@ -549,6 +678,89 @@
         "safer-buffer": ">= 2.1.2 < 3"
       }
     },
+    "is-buffer": {
+      "version": "1.1.6",
+      "resolved": "https://registry.npmjs.org/is-buffer/-/is-buffer-1.1.6.tgz",
+      "integrity": "sha512-NcdALwpXkTm5Zvvbk7owOUSvVvBKDgKP5/ewfXEznmQFfs4ZRmanOeKBTjRVjka3QFoN6XJ+9F3USqfHqTaU5w=="
+    },
+    "is-dotfile": {
+      "version": "1.0.3",
+      "resolved": "https://registry.npmjs.org/is-dotfile/-/is-dotfile-1.0.3.tgz",
+      "integrity": "sha1-pqLzL/0t+wT1yiXs0Pa4PPeYoeE="
+    },
+    "is-equal-shallow": {
+      "version": "0.1.3",
+      "resolved": "https://registry.npmjs.org/is-equal-shallow/-/is-equal-shallow-0.1.3.tgz",
+      "integrity": "sha1-IjgJj8Ih3gvPpdnqxMRdY4qhxTQ=",
+      "requires": {
+        "is-primitive": "^2.0.0"
+      }
+    },
+    "is-extendable": {
+      "version": "0.1.1",
+      "resolved": "https://registry.npmjs.org/is-extendable/-/is-extendable-0.1.1.tgz",
+      "integrity": "sha1-YrEQ4omkcUGOPsNqYX1HLjAd/Ik="
+    },
+    "is-extglob": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/is-extglob/-/is-extglob-1.0.0.tgz",
+      "integrity": "sha1-rEaBd8SUNAWgkvyPKXYMb/xiBsA="
+    },
+    "is-glob": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/is-glob/-/is-glob-2.0.1.tgz",
+      "integrity": "sha1-0Jb5JqPe1WAPP9/ZEZjLCIjC2GM=",
+      "requires": {
+        "is-extglob": "^1.0.0"
+      }
+    },
+    "is-number": {
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/is-number/-/is-number-2.1.0.tgz",
+      "integrity": "sha1-Afy7s5NGOlSPL0ZszhbezknbkI8=",
+      "requires": {
+        "kind-of": "^3.0.2"
+      }
+    },
+    "is-posix-bracket": {
+      "version": "0.1.1",
+      "resolved": "https://registry.npmjs.org/is-posix-bracket/-/is-posix-bracket-0.1.1.tgz",
+      "integrity": "sha1-MzTceXdDaOkvAW5vvAqI9c1ua8Q="
+    },
+    "is-primitive": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/is-primitive/-/is-primitive-2.0.0.tgz",
+      "integrity": "sha1-IHurkWOEmcB7Kt8kCkGochADRXU="
+    },
+    "isarray": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/isarray/-/isarray-1.0.0.tgz",
+      "integrity": "sha1-u5NdSFgsuhaMBoNJV6VKPgcSTxE="
+    },
+    "isobject": {
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/isobject/-/isobject-2.1.0.tgz",
+      "integrity": "sha1-8GVWEJaj8dou9GJy+BXIQNh+DIk=",
+      "requires": {
+        "isarray": "1.0.0"
+      }
+    },
+    "jsonfile": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/jsonfile/-/jsonfile-4.0.0.tgz",
+      "integrity": "sha1-h3Gq4HmbZAdrdmQPygWPnBDjPss=",
+      "requires": {
+        "graceful-fs": "^4.1.6"
+      }
+    },
+    "kind-of": {
+      "version": "3.2.2",
+      "resolved": "https://registry.npmjs.org/kind-of/-/kind-of-3.2.2.tgz",
+      "integrity": "sha1-MeohpzS6ubuw8yRm2JOupR5KPGQ=",
+      "requires": {
+        "is-buffer": "^1.1.5"
+      }
+    },
     "lru-cache": {
       "version": "4.1.3",
       "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-4.1.3.tgz",
@@ -559,12 +771,162 @@
         "yallist": "^2.1.2"
       }
     },
+    "math-random": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/math-random/-/math-random-1.0.1.tgz",
+      "integrity": "sha1-izqsWIuKZuSXXjzepn97sylgH6w="
+    },
+    "micromatch": {
+      "version": "2.3.11",
+      "resolved": "https://registry.npmjs.org/micromatch/-/micromatch-2.3.11.tgz",
+      "integrity": "sha1-hmd8l9FyCzY0MdBNDRUpO9OMFWU=",
+      "requires": {
+        "arr-diff": "^2.0.0",
+        "array-unique": "^0.2.1",
+        "braces": "^1.8.2",
+        "expand-brackets": "^0.1.4",
+        "extglob": "^0.3.1",
+        "filename-regex": "^2.0.0",
+        "is-extglob": "^1.0.0",
+        "is-glob": "^2.0.1",
+        "kind-of": "^3.0.2",
+        "normalize-path": "^2.0.1",
+        "object.omit": "^2.0.0",
+        "parse-glob": "^3.0.4",
+        "regex-cache": "^0.4.2"
+      }
+    },
+    "normalize-path": {
+      "version": "2.1.1",
+      "resolved": "https://registry.npmjs.org/normalize-path/-/normalize-path-2.1.1.tgz",
+      "integrity": "sha1-GrKLVW4Zg2Oowab35vogE3/mrtk=",
+      "requires": {
+        "remove-trailing-separator": "^1.0.1"
+      }
+    },
+    "object.omit": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/object.omit/-/object.omit-2.0.1.tgz",
+      "integrity": "sha1-Gpx0SCnznbuFjHbKNXmuKlTr0fo=",
+      "requires": {
+        "for-own": "^0.1.4",
+        "is-extendable": "^0.1.1"
+      }
+    },
+    "parse-glob": {
+      "version": "3.0.4",
+      "resolved": "https://registry.npmjs.org/parse-glob/-/parse-glob-3.0.4.tgz",
+      "integrity": "sha1-ssN2z7EfNVE7rdFz7wu246OIORw=",
+      "requires": {
+        "glob-base": "^0.3.0",
+        "is-dotfile": "^1.0.0",
+        "is-extglob": "^1.0.0",
+        "is-glob": "^2.0.0"
+      }
+    },
+    "path-parse": {
+      "version": "1.0.5",
+      "resolved": "https://registry.npmjs.org/path-parse/-/path-parse-1.0.5.tgz",
+      "integrity": "sha1-PBrfhx6pzWyUMbbqK9dKD/BVxME="
+    },
+    "pegjs": {
+      "version": "0.10.0",
+      "resolved": "https://registry.npmjs.org/pegjs/-/pegjs-0.10.0.tgz",
+      "integrity": "sha1-z4uvrm7d/0tafvsYUmnqr0YQ3b0="
+    },
+    "preserve": {
+      "version": "0.2.0",
+      "resolved": "https://registry.npmjs.org/preserve/-/preserve-0.2.0.tgz",
+      "integrity": "sha1-gV7R9uvGWSb4ZbMQwHE7yzMVzks="
+    },
     "pseudomap": {
       "version": "1.0.2",
       "resolved": "https://registry.npmjs.org/pseudomap/-/pseudomap-1.0.2.tgz",
       "integrity": "sha1-8FKijacOYYkX7wqKw0wa5aaChrM=",
       "dev": true
     },
+    "randomatic": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/randomatic/-/randomatic-3.0.0.tgz",
+      "integrity": "sha512-VdxFOIEY3mNO5PtSRkkle/hPJDHvQhK21oa73K4yAc9qmp6N429gAyF1gZMOTMeS0/AYzaV/2Trcef+NaIonSA==",
+      "requires": {
+        "is-number": "^4.0.0",
+        "kind-of": "^6.0.0",
+        "math-random": "^1.0.1"
+      },
+      "dependencies": {
+        "is-number": {
+          "version": "4.0.0",
+          "resolved": "https://registry.npmjs.org/is-number/-/is-number-4.0.0.tgz",
+          "integrity": "sha512-rSklcAIlf1OmFdyAqbnWTLVelsQ58uvZ66S/ZyawjWqIviTWCjg2PzVGw8WUA+nNuPTqb4wgA+NszrJ+08LlgQ=="
+        },
+        "kind-of": {
+          "version": "6.0.2",
+          "resolved": "https://registry.npmjs.org/kind-of/-/kind-of-6.0.2.tgz",
+          "integrity": "sha512-s5kLOcnH0XqDO+FvuaLX8DDjZ18CGFk7VygH40QoKPUQhW4e2rvM0rwUq0t8IQDOwYSeLK01U90OjzBTme2QqA=="
+        }
+      }
+    },
+    "regex-cache": {
+      "version": "0.4.4",
+      "resolved": "https://registry.npmjs.org/regex-cache/-/regex-cache-0.4.4.tgz",
+      "integrity": "sha512-nVIZwtCjkC9YgvWkpM55B5rBhBYRZhAaJbgcFYXXsHnbZ9UZI9nnVWYZpBlCqv9ho2eZryPnWrZGsOdPwVWXWQ==",
+      "requires": {
+        "is-equal-shallow": "^0.1.3"
+      }
+    },
+    "remove-trailing-separator": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/remove-trailing-separator/-/remove-trailing-separator-1.1.0.tgz",
+      "integrity": "sha1-wkvOKig62tW8P1jg1IJJuSN52O8="
+    },
+    "repeat-element": {
+      "version": "1.1.2",
+      "resolved": "https://registry.npmjs.org/repeat-element/-/repeat-element-1.1.2.tgz",
+      "integrity": "sha1-7wiaF40Ug7quTZPrmLT55OEdmQo="
+    },
+    "repeat-string": {
+      "version": "1.6.1",
+      "resolved": "https://registry.npmjs.org/repeat-string/-/repeat-string-1.6.1.tgz",
+      "integrity": "sha1-jcrkcOHIirwtYA//Sndihtp15jc="
+    },
+    "resolve": {
+      "version": "1.8.1",
+      "resolved": "https://registry.npmjs.org/resolve/-/resolve-1.8.1.tgz",
+      "integrity": "sha512-AicPrAC7Qu1JxPCZ9ZgCZlY35QgFnNqc+0LtbRNxnVw4TXvjQ72wnuL9JQcEBgXkI9JM8MsT9kaQoHcpCRJOYA==",
+      "requires": {
+        "path-parse": "^1.0.5"
+      }
+    },
+    "rollup": {
+      "version": "0.62.0",
+      "resolved": "https://registry.npmjs.org/rollup/-/rollup-0.62.0.tgz",
+      "integrity": "sha512-mZS0aIGfYzuJySJD78znu9/hCJsNfBzg4lDuZGMj0hFVcYHt2evNRHv8aqiu9/w6z6Qn8AQoVl4iyEjDmisGeA==",
+      "requires": {
+        "@types/estree": "0.0.39",
+        "@types/node": "*"
+      }
+    },
+    "rollup-plugin-typescript2": {
+      "version": "0.15.1",
+      "resolved": "https://registry.npmjs.org/rollup-plugin-typescript2/-/rollup-plugin-typescript2-0.15.1.tgz",
+      "integrity": "sha512-lJ/yfIj1fmp0KyfgPmd2QFeRpLgXlc58fS3Ha9Loc7/p3qByDL7CRndcI9MflE/pUSrfUdDjZMR0mHSKvqrZ+g==",
+      "requires": {
+        "fs-extra": "^5.0.0",
+        "resolve": "^1.7.1",
+        "rollup-pluginutils": "^2.0.1",
+        "tslib": "1.9.2"
+      }
+    },
+    "rollup-pluginutils": {
+      "version": "2.3.0",
+      "resolved": "https://registry.npmjs.org/rollup-pluginutils/-/rollup-pluginutils-2.3.0.tgz",
+      "integrity": "sha512-xB6hsRsjdJdIYWEyYUJy/3ki5g69wrf0luHPGNK3ZSocV6HLNfio59l3dZ3TL4xUwEKgROhFi9jOCt6c5gfUWw==",
+      "requires": {
+        "estree-walker": "^0.5.2",
+        "micromatch": "^2.3.11"
+      }
+    },
     "rw": {
       "version": "1.3.3",
       "resolved": "https://registry.npmjs.org/rw/-/rw-1.3.3.tgz",
@@ -587,6 +949,11 @@
       "integrity": "sha1-P/IfGYytIXX587eBhT/ZTQ0ZtZA=",
       "dev": true
     },
+    "tslib": {
+      "version": "1.9.2",
+      "resolved": "https://registry.npmjs.org/tslib/-/tslib-1.9.2.tgz",
+      "integrity": "sha512-AVP5Xol3WivEr7hnssHDsaM+lVrVXWUvd1cfXTRkTj80b//6g2wIFEH6hZG0muGZRnHGrfttpdzRk3YlBkWjKw=="
+    },
     "typescript": {
       "version": "2.9.1",
       "resolved": "https://registry.npmjs.org/typescript/-/typescript-2.9.1.tgz",
@@ -603,6 +970,11 @@
         "editorconfig": "^0.15.0"
       }
     },
+    "universalify": {
+      "version": "0.1.2",
+      "resolved": "https://registry.npmjs.org/universalify/-/universalify-0.1.2.tgz",
+      "integrity": "sha512-rBJeI5CXAlmy1pV+617WB9J63U6XcazHHF2f2dbJix4XzpUF0RS3Zbj0FGIOCAva5P/d/GBOYaACQ1w+0azUkg=="
+    },
     "yallist": {
       "version": "2.1.2",
       "resolved": "https://registry.npmjs.org/yallist/-/yallist-2.1.2.tgz",
diff --git a/deps/v8/tools/turbolizer/package.json b/deps/v8/tools/turbolizer/package.json
index 5c77b303130e5e..e5d1b1a011574a 100644
--- a/deps/v8/tools/turbolizer/package.json
+++ b/deps/v8/tools/turbolizer/package.json
@@ -2,9 +2,8 @@
   "name": "turbolizer",
   "version": "0.1.0",
   "description": "Visualization tool for V8 TurboFan IR graphs",
-  "main": "index.html",
   "scripts": {
-    "build": "tsc",
+    "build": "rollup -c",
     "watch": "tsc --watch",
     "deploy": "./deploy.sh",
     "format": "tsfmt -r"
@@ -13,7 +12,10 @@
   "license": "MIT",
   "dependencies": {
     "@types/d3": "^5.0.0",
-    "d3": "^5.4.0"
+    "d3": "^5.5.0",
+    "pegjs": "^0.10.0",
+    "rollup": "^0.62.0",
+    "rollup-plugin-typescript2": "^0.15.1"
   },
   "repository": {
     "type": "git",
diff --git a/deps/v8/tools/turbolizer/rollup.config.js b/deps/v8/tools/turbolizer/rollup.config.js
new file mode 100644
index 00000000000000..f01ab4916f6407
--- /dev/null
+++ b/deps/v8/tools/turbolizer/rollup.config.js
@@ -0,0 +1,12 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+import typescript from 'rollup-plugin-typescript2';
+
+export default {
+  entry: "src/turbo-visualizer.ts",
+  format: "iife",
+  plugins: [typescript({abortOnError:false})],
+  dest: "build/turbolizer.js"
+};
diff --git a/deps/v8/tools/turbolizer/src/code-view.ts b/deps/v8/tools/turbolizer/src/code-view.ts
index 4bd66412e80cd4..5975ff7a60d051 100644
--- a/deps/v8/tools/turbolizer/src/code-view.ts
+++ b/deps/v8/tools/turbolizer/src/code-view.ts
@@ -2,14 +2,18 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-"use strict";
+import {Source,SourceResolver,sourcePositionToStringKey} from "./source-resolver.js"
+import {SelectionBroker} from "./selection-broker.js"
+import {View} from "./view.js"
+import {MySelection} from "./selection.js"
+import {anyToString,ViewElements} from "./util.js"
 
-enum CodeMode {
+export enum CodeMode {
   MAIN_SOURCE = "main function",
   INLINED_SOURCE = "inlined function"
 };
 
-class CodeView extends View {
+export class CodeView extends View {
   broker: SelectionBroker;
   source: Source;
   sourceResolver: SourceResolver;
diff --git a/deps/v8/tools/turbolizer/src/constants.ts b/deps/v8/tools/turbolizer/src/constants.ts
index 369c97749f5b4b..1551d486eb6f06 100644
--- a/deps/v8/tools/turbolizer/src/constants.ts
+++ b/deps/v8/tools/turbolizer/src/constants.ts
@@ -2,25 +2,22 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-const MAX_RANK_SENTINEL = 0;
-const GRAPH_MARGIN = 250;
-const WIDTH = 'width';
-const HEIGHT = 'height';
-const VISIBILITY = 'visibility';
-const SOURCE_PANE_ID = 'left';
-const SOURCE_COLLAPSE_ID = 'source-shrink';
-const SOURCE_EXPAND_ID = 'source-expand';
-const INTERMEDIATE_PANE_ID = 'middle';
-const GRAPH_PANE_ID = 'graph';
-const SCHEDULE_PANE_ID = 'schedule';
-const GENERATED_PANE_ID = 'right';
-const DISASSEMBLY_PANE_ID = 'disassembly';
-const DISASSEMBLY_COLLAPSE_ID = 'disassembly-shrink';
-const DISASSEMBLY_EXPAND_ID = 'disassembly-expand';
-const COLLAPSE_PANE_BUTTON_VISIBLE = 'button-input';
-const COLLAPSE_PANE_BUTTON_INVISIBLE = 'button-input-invisible';
-const UNICODE_BLOCK = '&#9611;';
-const PROF_COLS = [
+export const MAX_RANK_SENTINEL = 0;
+export const GRAPH_MARGIN = 250;
+export const SOURCE_PANE_ID = 'left';
+export const SOURCE_COLLAPSE_ID = 'source-shrink';
+export const SOURCE_EXPAND_ID = 'source-expand';
+export const INTERMEDIATE_PANE_ID = 'middle';
+export const GRAPH_PANE_ID = 'graph';
+export const SCHEDULE_PANE_ID = 'schedule';
+export const GENERATED_PANE_ID = 'right';
+export const DISASSEMBLY_PANE_ID = 'disassembly';
+export const DISASSEMBLY_COLLAPSE_ID = 'disassembly-shrink';
+export const DISASSEMBLY_EXPAND_ID = 'disassembly-expand';
+export const COLLAPSE_PANE_BUTTON_VISIBLE = 'button-input';
+export const COLLAPSE_PANE_BUTTON_INVISIBLE = 'button-input-invisible';
+export const UNICODE_BLOCK = '&#9611;';
+export const PROF_COLS = [
   { perc: 0, col: { r: 255, g: 255, b: 255 } },
   { perc: 0.5, col: { r: 255, g: 255, b: 128 } },
   { perc: 5, col: { r: 255, g: 128, b: 0 } },
diff --git a/deps/v8/tools/turbolizer/src/disassembly-view.ts b/deps/v8/tools/turbolizer/src/disassembly-view.ts
index 8bc2e02ac55d4f..8142b2aa0d55ce 100644
--- a/deps/v8/tools/turbolizer/src/disassembly-view.ts
+++ b/deps/v8/tools/turbolizer/src/disassembly-view.ts
@@ -2,9 +2,11 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-"use strict";
+import {PROF_COLS, UNICODE_BLOCK} from "./constants.js"
+import {SelectionBroker} from "./selection-broker.js"
+import {TextView} from "./text-view.js"
 
-class DisassemblyView extends TextView {
+export class DisassemblyView extends TextView {
   SOURCE_POSITION_HEADER_REGEX: any;
   addr_event_counts: any;
   total_event_counts: any;
diff --git a/deps/v8/tools/turbolizer/src/edge.ts b/deps/v8/tools/turbolizer/src/edge.ts
index a7c65df59cbee1..7ca6d9dba09d20 100644
--- a/deps/v8/tools/turbolizer/src/edge.ts
+++ b/deps/v8/tools/turbolizer/src/edge.ts
@@ -2,13 +2,15 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-var MINIMUM_EDGE_SEPARATION = 20;
+import {GNode, DEFAULT_NODE_BUBBLE_RADIUS} from "./node.js"
 
-function isEdgeInitiallyVisible(target, index, source, type) {
+export const MINIMUM_EDGE_SEPARATION = 20;
+
+export function isEdgeInitiallyVisible(target, index, source, type) {
   return type == "control" && (target.cfg || source.cfg);
 }
 
-class Edge {
+export class Edge {
   target: GNode;
   source: GNode;
   index: number;
@@ -89,4 +91,4 @@ class Edge {
 
 }
 
-const edgeToStr = (e: Edge) => e.stringID();
+export const edgeToStr = (e: Edge) => e.stringID();
diff --git a/deps/v8/tools/turbolizer/src/graph-layout.ts b/deps/v8/tools/turbolizer/src/graph-layout.ts
index 14915409f16ae8..302a98aacc938d 100644
--- a/deps/v8/tools/turbolizer/src/graph-layout.ts
+++ b/deps/v8/tools/turbolizer/src/graph-layout.ts
@@ -2,7 +2,13 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-var DEFAULT_NODE_ROW_SEPARATION = 130
+
+import {MAX_RANK_SENTINEL} from "./constants.js"
+import {MINIMUM_EDGE_SEPARATION} from "./edge.js"
+import {NODE_INPUT_WIDTH, MINIMUM_NODE_OUTPUT_APPROACH, DEFAULT_NODE_BUBBLE_RADIUS} from "./node.js"
+
+
+const DEFAULT_NODE_ROW_SEPARATION = 130
 
 var traceLayout = false;
 
@@ -246,7 +252,7 @@ function newGraphOccupation(graph) {
   return occupation;
 }
 
-function layoutNodeGraph(graph) {
+export function layoutNodeGraph(graph) {
   // First determine the set of nodes that have no outputs. Those are the
   // basis for bottom-up DFS to determine rank and node placement.
   var endNodesHasNoOutputs = [];
diff --git a/deps/v8/tools/turbolizer/src/graph-view.ts b/deps/v8/tools/turbolizer/src/graph-view.ts
index 0dc033e0a73a9b..9e136f8225fd36 100644
--- a/deps/v8/tools/turbolizer/src/graph-view.ts
+++ b/deps/v8/tools/turbolizer/src/graph-view.ts
@@ -2,7 +2,16 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-"use strict";
+import * as d3 from "d3"
+import {layoutNodeGraph} from "./graph-layout.js"
+import {MAX_RANK_SENTINEL} from "./constants.js"
+import {GNode, nodeToStr, isNodeInitiallyVisible} from "./node.js"
+import {NODE_INPUT_WIDTH, MINIMUM_NODE_OUTPUT_APPROACH} from "./node.js"
+import {DEFAULT_NODE_BUBBLE_RADIUS} from "./node.js"
+import {Edge, edgeToStr} from "./edge.js"
+import {View, PhaseView} from "./view.js"
+import {MySelection} from "./selection.js"
+import {partial, alignUp} from "./util.js"
 
 function nodeToStringKey(n) {
   return "" + n.id;
@@ -18,7 +27,7 @@ interface GraphState {
   hideDead: boolean
 }
 
-class GraphView extends View implements PhaseView {
+export class GraphView extends View implements PhaseView {
   divElement: d3.Selection<any, any, any, any>;
   svg: d3.Selection<any, any, any, any>;
   showPhaseByName: (string) => void;
@@ -272,7 +281,7 @@ class GraphView extends View implements PhaseView {
   };
 
   measureText(text) {
-    const textMeasure = document.getElementById('text-measure');
+    const textMeasure = document.getElementById('text-measure') as SVGTSpanElement;
     textMeasure.textContent = text;
     return {
       width: textMeasure.getBBox().width,
@@ -304,7 +313,7 @@ class GraphView extends View implements PhaseView {
       n.labelbbox = g.measureText(n.displayLabel);
       n.typebbox = g.measureText(n.getDisplayType());
       var innerwidth = Math.max(n.labelbbox.width, n.typebbox.width);
-      n.width = MoreMath.alignUp(innerwidth + NODE_INPUT_WIDTH * 2,
+      n.width = alignUp(innerwidth + NODE_INPUT_WIDTH * 2,
         NODE_INPUT_WIDTH);
       var innerheight = Math.max(n.labelbbox.height, n.typebbox.height);
       n.normalheight = innerheight + 20;
@@ -748,10 +757,10 @@ class GraphView extends View implements PhaseView {
     newGs.append("rect")
       .attr("rx", 10)
       .attr("ry", 10)
-      .attr(WIDTH, function (d) {
+      .attr('width', function (d) {
         return d.getTotalNodeWidth();
       })
-      .attr(HEIGHT, function (d) {
+      .attr('height', function (d) {
         return graph.getNodeHeight(d);
       })
 
@@ -856,7 +865,7 @@ class GraphView extends View implements PhaseView {
       })
       .attr("transform", function (d) { return "translate(" + d.x + "," + d.y + ")"; })
       .select('rect')
-      .attr(HEIGHT, function (d) { return graph.getNodeHeight(d); });
+      .attr('height', function (d) { return graph.getNodeHeight(d); });
 
     graph.visibleBubbles = d3.selectAll('circle');
 
diff --git a/deps/v8/tools/turbolizer/src/graphmultiview.ts b/deps/v8/tools/turbolizer/src/graphmultiview.ts
index 226fc38e030c4a..66d1103e38ad02 100644
--- a/deps/v8/tools/turbolizer/src/graphmultiview.ts
+++ b/deps/v8/tools/turbolizer/src/graphmultiview.ts
@@ -2,9 +2,13 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-"use strict";
+import {GraphView} from "./graph-view.js"
+import {ScheduleView} from "./schedule-view.js"
+import {SourceResolver} from "./source-resolver.js"
+import {SelectionBroker} from "./selection-broker.js"
+import {View, PhaseView} from "./view.js"
 
-class GraphMultiView extends View {
+export class GraphMultiView extends View {
   sourceResolver: SourceResolver;
   selectionBroker: SelectionBroker;
   graph: GraphView;
diff --git a/deps/v8/tools/turbolizer/src/monkey.ts b/deps/v8/tools/turbolizer/src/monkey.ts
deleted file mode 100644
index 3e38aefcc5091a..00000000000000
--- a/deps/v8/tools/turbolizer/src/monkey.ts
+++ /dev/null
@@ -1,9 +0,0 @@
-// Copyright 2014 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-const MoreMath = {
-  alignUp: (raw, multiple) => {
-    return Math.floor((raw + multiple - 1) / multiple) * multiple;
-  }
-};
diff --git a/deps/v8/tools/turbolizer/src/node.ts b/deps/v8/tools/turbolizer/src/node.ts
index 533c51763b3002..95c47cab20faed 100644
--- a/deps/v8/tools/turbolizer/src/node.ts
+++ b/deps/v8/tools/turbolizer/src/node.ts
@@ -2,13 +2,15 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-const TYPE_HEIGHT = 25;
-const DEFAULT_NODE_BUBBLE_RADIUS = 12;
-const NODE_INPUT_WIDTH = 50;
+import {NodeOrigin} from "./source-resolver.js"
+import {MINIMUM_EDGE_SEPARATION} from "./edge.js"
+
+export const DEFAULT_NODE_BUBBLE_RADIUS = 12;
+export const NODE_INPUT_WIDTH = 50;
+export const MINIMUM_NODE_OUTPUT_APPROACH = 15;
 const MINIMUM_NODE_INPUT_APPROACH = 15 + 2 * DEFAULT_NODE_BUBBLE_RADIUS;
-const MINIMUM_NODE_OUTPUT_APPROACH = 15;
 
-function isNodeInitiallyVisible(node) {
+export function isNodeInitiallyVisible(node) {
   return node.cfg;
 }
 
@@ -22,7 +24,7 @@ function formatOrigin(origin) {
   return "unknown origin";
 }
 
-class GNode {
+export class GNode {
   control: boolean;
   opcode: string;
   live: boolean;
@@ -177,4 +179,4 @@ class GNode {
   }
 };
 
-const nodeToStr = (n: GNode) => "N" + n.id;
+export const nodeToStr = (n: GNode) => "N" + n.id;
diff --git a/deps/v8/tools/turbolizer/src/schedule-view.ts b/deps/v8/tools/turbolizer/src/schedule-view.ts
index ec8e1914ac2c42..f62aba0c866cbc 100644
--- a/deps/v8/tools/turbolizer/src/schedule-view.ts
+++ b/deps/v8/tools/turbolizer/src/schedule-view.ts
@@ -2,9 +2,12 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-"use strict";
+import {Schedule,SourceResolver} from "./source-resolver.js"
+import {isIterable} from "./util.js"
+import {PhaseView} from "./view.js"
+import {TextView} from "./text-view.js"
 
-class ScheduleView extends TextView implements PhaseView {
+export class ScheduleView extends TextView implements PhaseView {
   schedule: Schedule;
   sourceResolver: SourceResolver;
 
diff --git a/deps/v8/tools/turbolizer/src/selection-broker.ts b/deps/v8/tools/turbolizer/src/selection-broker.ts
index 973e945da4c508..e20fd977d29aa3 100644
--- a/deps/v8/tools/turbolizer/src/selection-broker.ts
+++ b/deps/v8/tools/turbolizer/src/selection-broker.ts
@@ -2,7 +2,9 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-class SelectionBroker {
+import {SourceResolver, sourcePositionValid} from "./source-resolver.js"
+
+export class SelectionBroker {
   sourceResolver: SourceResolver;
   sourcePositionHandlers: Array<SelectionHandler>;
   nodeHandlers: Array<NodeSelectionHandler>;
diff --git a/deps/v8/tools/turbolizer/src/selection.ts b/deps/v8/tools/turbolizer/src/selection.ts
index 54b685e9d68b7d..b02a3e9cbb7565 100644
--- a/deps/v8/tools/turbolizer/src/selection.ts
+++ b/deps/v8/tools/turbolizer/src/selection.ts
@@ -2,7 +2,9 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-class MySelection {
+import {isIterable} from "./util.js"
+
+export class MySelection {
   selection: any;
   stringKey: (o: any) => string;
 
diff --git a/deps/v8/tools/turbolizer/src/source-resolver.ts b/deps/v8/tools/turbolizer/src/source-resolver.ts
index ba7e55d588611b..b2412d3e3108f9 100644
--- a/deps/v8/tools/turbolizer/src/source-resolver.ts
+++ b/deps/v8/tools/turbolizer/src/source-resolver.ts
@@ -2,6 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
+import {sortUnique, anyToString} from "./util.js"
+
 function sourcePositionLe(a, b) {
   if (a.inliningId == b.inliningId) {
     return a.scriptOffset - b.scriptOffset;
@@ -14,7 +16,7 @@ function sourcePositionEq(a, b) {
     a.scriptOffset == b.scriptOffset;
 }
 
-function sourcePositionToStringKey(sourcePosition): string {
+export function sourcePositionToStringKey(sourcePosition): string {
   if (!sourcePosition) return "undefined";
   if (sourcePosition.inliningId && sourcePosition.scriptOffset)
     return "SP:" + sourcePosition.inliningId + ":" + sourcePosition.scriptOffset;
@@ -23,12 +25,12 @@ function sourcePositionToStringKey(sourcePosition): string {
   return "undefined";
 }
 
-function sourcePositionValid(l) {
+export function sourcePositionValid(l) {
   return (typeof l.scriptOffset !== undefined
     && typeof l.inliningId !== undefined) || typeof l.bytecodePosition != undefined;
 }
 
-interface SourcePosition {
+export interface SourcePosition {
   scriptOffset: number;
   inliningId: number;
 }
@@ -38,7 +40,7 @@ interface TurboFanOrigin {
   reducer: string;
 }
 
-interface NodeOrigin {
+export interface NodeOrigin {
   nodeId: number;
 }
 
@@ -52,7 +54,7 @@ type TurboFanBytecodeOrigin = BytecodePosition & TurboFanOrigin;
 
 type AnyPosition = SourcePosition | BytecodePosition;
 
-interface Source {
+export interface Source {
   sourcePositions: Array<SourcePosition>;
   sourceName: string;
   functionName: string;
@@ -70,11 +72,11 @@ interface Phase {
   data: any;
 }
 
-interface Schedule {
+export interface Schedule {
   nodes: Array<any>;
 }
 
-class SourceResolver {
+export class SourceResolver {
   nodePositionMap: Array<AnyPosition>;
   sources: Array<Source>;
   inlinings: Array<Inlining>;
diff --git a/deps/v8/tools/turbolizer/src/text-view.ts b/deps/v8/tools/turbolizer/src/text-view.ts
index d4d2840871bb31..a88d31d1946af4 100644
--- a/deps/v8/tools/turbolizer/src/text-view.ts
+++ b/deps/v8/tools/turbolizer/src/text-view.ts
@@ -2,13 +2,11 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-"use strict";
+import {View} from "./view.js"
+import {anyToString, ViewElements, isIterable} from "./util.js"
+import {MySelection} from "./selection.js"
 
-function anyToString(x: any): string {
-  return "" + x;
-}
-
-abstract class TextView extends View {
+export abstract class TextView extends View {
   selectionHandler: NodeSelectionHandler;
   blockSelectionHandler: BlockSelectionHandler;
   nodeSelectionHandler: NodeSelectionHandler;
diff --git a/deps/v8/tools/turbolizer/src/turbo-visualizer.ts b/deps/v8/tools/turbolizer/src/turbo-visualizer.ts
index 9d41042300b9ae..4cab92a1975fbb 100644
--- a/deps/v8/tools/turbolizer/src/turbo-visualizer.ts
+++ b/deps/v8/tools/turbolizer/src/turbo-visualizer.ts
@@ -2,6 +2,14 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
+import * as C from "./constants.js"
+import {SourceResolver} from "./source-resolver.js"
+import {SelectionBroker} from "./selection-broker.js"
+import {DisassemblyView} from "./disassembly-view.js"
+import {GraphMultiView} from "./graphmultiview.js"
+import {CodeMode, CodeView} from "./code-view.js"
+import * as d3 from "d3"
+
 class Snapper {
   resizer: Resizer;
   sourceExpand: HTMLElement;
@@ -12,10 +20,10 @@ class Snapper {
   constructor(resizer: Resizer) {
     const snapper = this;
     snapper.resizer = resizer;
-    snapper.sourceExpand = document.getElementById(SOURCE_EXPAND_ID);
-    snapper.sourceCollapse = document.getElementById(SOURCE_COLLAPSE_ID);
-    snapper.disassemblyExpand = document.getElementById(DISASSEMBLY_EXPAND_ID);
-    snapper.disassemblyCollapse = document.getElementById(DISASSEMBLY_COLLAPSE_ID);
+    snapper.sourceExpand = document.getElementById(C.SOURCE_EXPAND_ID);
+    snapper.sourceCollapse = document.getElementById(C.SOURCE_COLLAPSE_ID);
+    snapper.disassemblyExpand = document.getElementById(C.DISASSEMBLY_EXPAND_ID);
+    snapper.disassemblyCollapse = document.getElementById(C.DISASSEMBLY_COLLAPSE_ID);
 
     document.getElementById("source-collapse").addEventListener("click", function () {
       resizer.snapper.toggleSourceExpanded();
@@ -112,9 +120,9 @@ class Resizer {
     resizer.panes_updated_callback = panes_updated_callback;
     resizer.dead_width = dead_width
     resizer.client_width = document.body.getBoundingClientRect().width;
-    resizer.left = document.getElementById(SOURCE_PANE_ID);
-    resizer.middle = document.getElementById(INTERMEDIATE_PANE_ID);
-    resizer.right = document.getElementById(GENERATED_PANE_ID);
+    resizer.left = document.getElementById(C.SOURCE_PANE_ID);
+    resizer.middle = document.getElementById(C.INTERMEDIATE_PANE_ID);
+    resizer.right = document.getElementById(C.GENERATED_PANE_ID);
     resizer.resizer_left = d3.select('.resizer-left');
     resizer.resizer_right = d3.select('.resizer-right');
     resizer.sep_left = resizer.client_width / 3;
@@ -188,7 +196,6 @@ class Resizer {
 }
 
 window.onload = function () {
-  "use strict";
   var svg = null;
   var multiview = null;
   var disassemblyView = null;
@@ -237,24 +244,24 @@ window.onload = function () {
       sourceResolver.setNodePositionMap(jsonObj.nodePositions);
       sourceResolver.parsePhases(jsonObj.phases);
 
-      let sourceView = new CodeView(SOURCE_PANE_ID, selectionBroker, sourceResolver, fnc, CodeMode.MAIN_SOURCE);
+      let sourceView = new CodeView(C.SOURCE_PANE_ID, selectionBroker, sourceResolver, fnc, CodeMode.MAIN_SOURCE);
       sourceView.show(null, null);
       sourceViews.push(sourceView);
 
       sourceResolver.forEachSource((source) => {
-        let sourceView = new CodeView(SOURCE_PANE_ID, selectionBroker, sourceResolver, source, CodeMode.INLINED_SOURCE);
+        let sourceView = new CodeView(C.SOURCE_PANE_ID, selectionBroker, sourceResolver, source, CodeMode.INLINED_SOURCE);
         sourceView.show(null, null);
         sourceViews.push(sourceView);
       });
 
-      disassemblyView = new DisassemblyView(GENERATED_PANE_ID, selectionBroker);
+      disassemblyView = new DisassemblyView(C.GENERATED_PANE_ID, selectionBroker);
       disassemblyView.initializeCode(fnc.sourceText);
       if (sourceResolver.disassemblyPhase) {
         disassemblyView.initializePerfProfile(jsonObj.eventCounts);
         disassemblyView.show(sourceResolver.disassemblyPhase.data, null);
       }
 
-      multiview = new GraphMultiView(INTERMEDIATE_PANE_ID, selectionBroker, sourceResolver);
+      multiview = new GraphMultiView(C.INTERMEDIATE_PANE_ID, selectionBroker, sourceResolver);
       multiview.show(jsonObj);
     } catch (err) {
       if (window.confirm("Error: Exception during load of TurboFan JSON file:\n" +
diff --git a/deps/v8/tools/turbolizer/src/util.ts b/deps/v8/tools/turbolizer/src/util.ts
index 1b390d371c13a6..ef877e508c35a0 100644
--- a/deps/v8/tools/turbolizer/src/util.ts
+++ b/deps/v8/tools/turbolizer/src/util.ts
@@ -2,7 +2,9 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-"use strict";
+export function anyToString(x: any): string {
+  return "" + x;
+}
 
 function computeScrollTop(container, element) {
   const height = container.offsetHeight;
@@ -17,7 +19,7 @@ function computeScrollTop(container, element) {
   return pos;
 }
 
-class ViewElements {
+export class ViewElements {
   container: HTMLElement;
   scrollTop: number;
 
@@ -84,7 +86,7 @@ function upperBound(a, value, compare, lookup) {
 }
 
 
-function sortUnique<T>(arr: Array<T>, f: (a: T, b: T) => number, equal: (a: T, b: T) => boolean) {
+export function sortUnique<T>(arr: Array<T>, f: (a: T, b: T) => number, equal: (a: T, b: T) => boolean) {
   if (arr.length == 0) return arr;
   arr = arr.sort(f);
   let ret = [arr[0]];
@@ -97,14 +99,18 @@ function sortUnique<T>(arr: Array<T>, f: (a: T, b: T) => number, equal: (a: T, b
 }
 
 // Partial application without binding the receiver
-function partial(f, ...arguments1) {
+export function partial(f, ...arguments1) {
   return function (...arguments2) {
     var arguments2 = Array.from(arguments);
     f.apply(this, [...arguments1, ...arguments2]);
   }
 }
 
-function isIterable(obj: any): obj is Iterable<any> {
+export function isIterable(obj: any): obj is Iterable<any> {
   return obj != null && obj != undefined
     && typeof obj != 'string' && typeof obj[Symbol.iterator] === 'function';
 }
+
+export function alignUp(raw:number, multiple:number):number {
+  return Math.floor((raw + multiple - 1) / multiple) * multiple;
+}
diff --git a/deps/v8/tools/turbolizer/src/view.ts b/deps/v8/tools/turbolizer/src/view.ts
index 6da1ce17ae02c2..dbb8514fe2d600 100644
--- a/deps/v8/tools/turbolizer/src/view.ts
+++ b/deps/v8/tools/turbolizer/src/view.ts
@@ -2,9 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-"use strict";
-
-abstract class View {
+export abstract class View {
   container: HTMLElement;
   divNode: HTMLElement;
   abstract initializeContent(data: any, rememberedSelection: Selection): void;
@@ -32,7 +30,7 @@ abstract class View {
   }
 }
 
-interface PhaseView {
+export interface PhaseView {
   onresize();
   searchInputAction(searchInput: HTMLInputElement, e: Event);
 }
diff --git a/deps/v8/tools/turbolizer/tsconfig.json b/deps/v8/tools/turbolizer/tsconfig.json
index 0547457e5f06f7..c54157280fc2b9 100644
--- a/deps/v8/tools/turbolizer/tsconfig.json
+++ b/deps/v8/tools/turbolizer/tsconfig.json
@@ -1,12 +1,15 @@
 {
     "compilerOptions": {
-        "outFile": "build/turbolizer.js",
-        "allowJs": true,
+        "outDir": "build/",
+        "allowJs": false,
         "target": "es2017",
-        "sourceMap": true
+        "module": "es2015",
+        "sourceMap": true,
+        "experimentalDecorators": true,
+        "emitDecoratorMetadata": true,
+        "moduleResolution": "node"
     },
     "files": [
-        "src/monkey.ts",
         "src/util.ts",
         "src/lang-disassembly.ts",
         "src/node.ts",
@@ -26,4 +29,4 @@
         "src/graphmultiview.ts",
         "src/turbo-visualizer.ts"
     ]
-}
\ No newline at end of file
+}
diff --git a/deps/v8/tools/v8heapconst.py b/deps/v8/tools/v8heapconst.py
index b818073d75d6fa..56a74c208c2008 100644
--- a/deps/v8/tools/v8heapconst.py
+++ b/deps/v8/tools/v8heapconst.py
@@ -114,16 +114,17 @@
   210: "FEEDBACK_CELL_TYPE",
   211: "FEEDBACK_VECTOR_TYPE",
   212: "LOAD_HANDLER_TYPE",
-  213: "PROPERTY_ARRAY_TYPE",
-  214: "PROPERTY_CELL_TYPE",
-  215: "SHARED_FUNCTION_INFO_TYPE",
-  216: "SMALL_ORDERED_HASH_MAP_TYPE",
-  217: "SMALL_ORDERED_HASH_SET_TYPE",
-  218: "STORE_HANDLER_TYPE",
-  219: "UNCOMPILED_DATA_WITHOUT_PRE_PARSED_SCOPE_TYPE",
-  220: "UNCOMPILED_DATA_WITH_PRE_PARSED_SCOPE_TYPE",
-  221: "WEAK_CELL_TYPE",
-  222: "WEAK_ARRAY_LIST_TYPE",
+  213: "PRE_PARSED_SCOPE_DATA_TYPE",
+  214: "PROPERTY_ARRAY_TYPE",
+  215: "PROPERTY_CELL_TYPE",
+  216: "SHARED_FUNCTION_INFO_TYPE",
+  217: "SMALL_ORDERED_HASH_MAP_TYPE",
+  218: "SMALL_ORDERED_HASH_SET_TYPE",
+  219: "STORE_HANDLER_TYPE",
+  220: "UNCOMPILED_DATA_WITHOUT_PRE_PARSED_SCOPE_TYPE",
+  221: "UNCOMPILED_DATA_WITH_PRE_PARSED_SCOPE_TYPE",
+  222: "WEAK_CELL_TYPE",
+  223: "WEAK_ARRAY_LIST_TYPE",
   1024: "JS_PROXY_TYPE",
   1025: "JS_GLOBAL_OBJECT_TYPE",
   1026: "JS_GLOBAL_PROXY_TYPE",
@@ -176,7 +177,7 @@
   ("RO_SPACE", 0x022e1): (131, "NullMap"),
   ("RO_SPACE", 0x02359): (205, "DescriptorArrayMap"),
   ("RO_SPACE", 0x023c1): (182, "FixedArrayMap"),
-  ("RO_SPACE", 0x02429): (221, "WeakCellMap"),
+  ("RO_SPACE", 0x02429): (222, "WeakCellMap"),
   ("RO_SPACE", 0x024d1): (152, "OnePointerFillerMap"),
   ("RO_SPACE", 0x02539): (152, "TwoPointerFillerMap"),
   ("RO_SPACE", 0x025d1): (131, "UninitializedMap"),
@@ -191,11 +192,11 @@
   ("RO_SPACE", 0x02b41): (128, "SymbolMap"),
   ("RO_SPACE", 0x02ba9): (72, "OneByteStringMap"),
   ("RO_SPACE", 0x02c11): (193, "ScopeInfoMap"),
-  ("RO_SPACE", 0x02c79): (215, "SharedFunctionInfoMap"),
+  ("RO_SPACE", 0x02c79): (216, "SharedFunctionInfoMap"),
   ("RO_SPACE", 0x02ce1): (133, "CodeMap"),
   ("RO_SPACE", 0x02d49): (199, "FunctionContextMap"),
   ("RO_SPACE", 0x02db1): (208, "CellMap"),
-  ("RO_SPACE", 0x02e19): (214, "GlobalPropertyCellMap"),
+  ("RO_SPACE", 0x02e19): (215, "GlobalPropertyCellMap"),
   ("RO_SPACE", 0x02e81): (135, "ForeignMap"),
   ("RO_SPACE", 0x02ee9): (206, "TransitionArrayMap"),
   ("RO_SPACE", 0x02f51): (211, "FeedbackVectorMap"),
@@ -230,83 +231,84 @@
   ("RO_SPACE", 0x03ce9): (210, "OneClosureCellMap"),
   ("RO_SPACE", 0x03d51): (185, "OrderedHashMapMap"),
   ("RO_SPACE", 0x03db9): (186, "OrderedHashSetMap"),
-  ("RO_SPACE", 0x03e21): (213, "PropertyArrayMap"),
-  ("RO_SPACE", 0x03e89): (207, "SideEffectCallHandlerInfoMap"),
-  ("RO_SPACE", 0x03ef1): (207, "SideEffectFreeCallHandlerInfoMap"),
-  ("RO_SPACE", 0x03f59): (207, "NextCallSideEffectFreeCallHandlerInfoMap"),
-  ("RO_SPACE", 0x03fc1): (190, "SimpleNumberDictionaryMap"),
-  ("RO_SPACE", 0x04029): (182, "SloppyArgumentsElementsMap"),
-  ("RO_SPACE", 0x04091): (216, "SmallOrderedHashMapMap"),
-  ("RO_SPACE", 0x040f9): (217, "SmallOrderedHashSetMap"),
-  ("RO_SPACE", 0x04161): (191, "StringTableMap"),
-  ("RO_SPACE", 0x041c9): (219, "UncompiledDataWithoutPreParsedScopeMap"),
-  ("RO_SPACE", 0x04231): (220, "UncompiledDataWithPreParsedScopeMap"),
-  ("RO_SPACE", 0x04299): (204, "WeakFixedArrayMap"),
-  ("RO_SPACE", 0x04301): (222, "WeakArrayListMap"),
-  ("RO_SPACE", 0x04369): (192, "EphemeronHashTableMap"),
-  ("RO_SPACE", 0x043d1): (106, "NativeSourceStringMap"),
-  ("RO_SPACE", 0x04439): (64, "StringMap"),
-  ("RO_SPACE", 0x044a1): (73, "ConsOneByteStringMap"),
-  ("RO_SPACE", 0x04509): (65, "ConsStringMap"),
-  ("RO_SPACE", 0x04571): (77, "ThinOneByteStringMap"),
-  ("RO_SPACE", 0x045d9): (69, "ThinStringMap"),
-  ("RO_SPACE", 0x04641): (67, "SlicedStringMap"),
-  ("RO_SPACE", 0x046a9): (75, "SlicedOneByteStringMap"),
-  ("RO_SPACE", 0x04711): (66, "ExternalStringMap"),
-  ("RO_SPACE", 0x04779): (82, "ExternalStringWithOneByteDataMap"),
-  ("RO_SPACE", 0x047e1): (74, "ExternalOneByteStringMap"),
-  ("RO_SPACE", 0x04849): (98, "ShortExternalStringMap"),
-  ("RO_SPACE", 0x048b1): (114, "ShortExternalStringWithOneByteDataMap"),
-  ("RO_SPACE", 0x04919): (0, "InternalizedStringMap"),
-  ("RO_SPACE", 0x04981): (2, "ExternalInternalizedStringMap"),
-  ("RO_SPACE", 0x049e9): (18, "ExternalInternalizedStringWithOneByteDataMap"),
-  ("RO_SPACE", 0x04a51): (10, "ExternalOneByteInternalizedStringMap"),
-  ("RO_SPACE", 0x04ab9): (34, "ShortExternalInternalizedStringMap"),
-  ("RO_SPACE", 0x04b21): (50, "ShortExternalInternalizedStringWithOneByteDataMap"),
-  ("RO_SPACE", 0x04b89): (42, "ShortExternalOneByteInternalizedStringMap"),
-  ("RO_SPACE", 0x04bf1): (106, "ShortExternalOneByteStringMap"),
-  ("RO_SPACE", 0x04c59): (140, "FixedUint8ArrayMap"),
-  ("RO_SPACE", 0x04cc1): (139, "FixedInt8ArrayMap"),
-  ("RO_SPACE", 0x04d29): (142, "FixedUint16ArrayMap"),
-  ("RO_SPACE", 0x04d91): (141, "FixedInt16ArrayMap"),
-  ("RO_SPACE", 0x04df9): (144, "FixedUint32ArrayMap"),
-  ("RO_SPACE", 0x04e61): (143, "FixedInt32ArrayMap"),
-  ("RO_SPACE", 0x04ec9): (145, "FixedFloat32ArrayMap"),
-  ("RO_SPACE", 0x04f31): (146, "FixedFloat64ArrayMap"),
-  ("RO_SPACE", 0x04f99): (147, "FixedUint8ClampedArrayMap"),
-  ("RO_SPACE", 0x05001): (149, "FixedBigUint64ArrayMap"),
-  ("RO_SPACE", 0x05069): (148, "FixedBigInt64ArrayMap"),
-  ("RO_SPACE", 0x050d1): (131, "SelfReferenceMarkerMap"),
-  ("RO_SPACE", 0x05151): (171, "Tuple2Map"),
-  ("RO_SPACE", 0x054a1): (161, "InterceptorInfoMap"),
-  ("RO_SPACE", 0x055c1): (169, "ScriptMap"),
-  ("RO_SPACE", 0x09fb9): (154, "AccessorInfoMap"),
-  ("RO_SPACE", 0x0a021): (153, "AccessCheckInfoMap"),
-  ("RO_SPACE", 0x0a089): (155, "AccessorPairMap"),
-  ("RO_SPACE", 0x0a0f1): (156, "AliasedArgumentsEntryMap"),
-  ("RO_SPACE", 0x0a159): (157, "AllocationMementoMap"),
-  ("RO_SPACE", 0x0a1c1): (158, "AsyncGeneratorRequestMap"),
-  ("RO_SPACE", 0x0a229): (159, "DebugInfoMap"),
-  ("RO_SPACE", 0x0a291): (160, "FunctionTemplateInfoMap"),
-  ("RO_SPACE", 0x0a2f9): (162, "InterpreterDataMap"),
-  ("RO_SPACE", 0x0a361): (163, "ModuleInfoEntryMap"),
-  ("RO_SPACE", 0x0a3c9): (164, "ModuleMap"),
-  ("RO_SPACE", 0x0a431): (165, "ObjectTemplateInfoMap"),
-  ("RO_SPACE", 0x0a499): (166, "PromiseCapabilityMap"),
-  ("RO_SPACE", 0x0a501): (167, "PromiseReactionMap"),
-  ("RO_SPACE", 0x0a569): (168, "PrototypeInfoMap"),
-  ("RO_SPACE", 0x0a5d1): (170, "StackFrameInfoMap"),
-  ("RO_SPACE", 0x0a639): (172, "Tuple3Map"),
-  ("RO_SPACE", 0x0a6a1): (173, "ArrayBoilerplateDescriptionMap"),
-  ("RO_SPACE", 0x0a709): (174, "WasmDebugInfoMap"),
-  ("RO_SPACE", 0x0a771): (175, "WasmExportedFunctionDataMap"),
-  ("RO_SPACE", 0x0a7d9): (176, "CallableTaskMap"),
-  ("RO_SPACE", 0x0a841): (177, "CallbackTaskMap"),
-  ("RO_SPACE", 0x0a8a9): (178, "PromiseFulfillReactionJobTaskMap"),
-  ("RO_SPACE", 0x0a911): (179, "PromiseRejectReactionJobTaskMap"),
-  ("RO_SPACE", 0x0a979): (180, "PromiseResolveThenableJobTaskMap"),
-  ("RO_SPACE", 0x0a9e1): (181, "AllocationSiteMap"),
+  ("RO_SPACE", 0x03e21): (213, "PreParsedScopeDataMap"),
+  ("RO_SPACE", 0x03e89): (214, "PropertyArrayMap"),
+  ("RO_SPACE", 0x03ef1): (207, "SideEffectCallHandlerInfoMap"),
+  ("RO_SPACE", 0x03f59): (207, "SideEffectFreeCallHandlerInfoMap"),
+  ("RO_SPACE", 0x03fc1): (207, "NextCallSideEffectFreeCallHandlerInfoMap"),
+  ("RO_SPACE", 0x04029): (190, "SimpleNumberDictionaryMap"),
+  ("RO_SPACE", 0x04091): (182, "SloppyArgumentsElementsMap"),
+  ("RO_SPACE", 0x040f9): (217, "SmallOrderedHashMapMap"),
+  ("RO_SPACE", 0x04161): (218, "SmallOrderedHashSetMap"),
+  ("RO_SPACE", 0x041c9): (191, "StringTableMap"),
+  ("RO_SPACE", 0x04231): (220, "UncompiledDataWithoutPreParsedScopeMap"),
+  ("RO_SPACE", 0x04299): (221, "UncompiledDataWithPreParsedScopeMap"),
+  ("RO_SPACE", 0x04301): (204, "WeakFixedArrayMap"),
+  ("RO_SPACE", 0x04369): (223, "WeakArrayListMap"),
+  ("RO_SPACE", 0x043d1): (192, "EphemeronHashTableMap"),
+  ("RO_SPACE", 0x04439): (106, "NativeSourceStringMap"),
+  ("RO_SPACE", 0x044a1): (64, "StringMap"),
+  ("RO_SPACE", 0x04509): (73, "ConsOneByteStringMap"),
+  ("RO_SPACE", 0x04571): (65, "ConsStringMap"),
+  ("RO_SPACE", 0x045d9): (77, "ThinOneByteStringMap"),
+  ("RO_SPACE", 0x04641): (69, "ThinStringMap"),
+  ("RO_SPACE", 0x046a9): (67, "SlicedStringMap"),
+  ("RO_SPACE", 0x04711): (75, "SlicedOneByteStringMap"),
+  ("RO_SPACE", 0x04779): (66, "ExternalStringMap"),
+  ("RO_SPACE", 0x047e1): (82, "ExternalStringWithOneByteDataMap"),
+  ("RO_SPACE", 0x04849): (74, "ExternalOneByteStringMap"),
+  ("RO_SPACE", 0x048b1): (98, "ShortExternalStringMap"),
+  ("RO_SPACE", 0x04919): (114, "ShortExternalStringWithOneByteDataMap"),
+  ("RO_SPACE", 0x04981): (0, "InternalizedStringMap"),
+  ("RO_SPACE", 0x049e9): (2, "ExternalInternalizedStringMap"),
+  ("RO_SPACE", 0x04a51): (18, "ExternalInternalizedStringWithOneByteDataMap"),
+  ("RO_SPACE", 0x04ab9): (10, "ExternalOneByteInternalizedStringMap"),
+  ("RO_SPACE", 0x04b21): (34, "ShortExternalInternalizedStringMap"),
+  ("RO_SPACE", 0x04b89): (50, "ShortExternalInternalizedStringWithOneByteDataMap"),
+  ("RO_SPACE", 0x04bf1): (42, "ShortExternalOneByteInternalizedStringMap"),
+  ("RO_SPACE", 0x04c59): (106, "ShortExternalOneByteStringMap"),
+  ("RO_SPACE", 0x04cc1): (140, "FixedUint8ArrayMap"),
+  ("RO_SPACE", 0x04d29): (139, "FixedInt8ArrayMap"),
+  ("RO_SPACE", 0x04d91): (142, "FixedUint16ArrayMap"),
+  ("RO_SPACE", 0x04df9): (141, "FixedInt16ArrayMap"),
+  ("RO_SPACE", 0x04e61): (144, "FixedUint32ArrayMap"),
+  ("RO_SPACE", 0x04ec9): (143, "FixedInt32ArrayMap"),
+  ("RO_SPACE", 0x04f31): (145, "FixedFloat32ArrayMap"),
+  ("RO_SPACE", 0x04f99): (146, "FixedFloat64ArrayMap"),
+  ("RO_SPACE", 0x05001): (147, "FixedUint8ClampedArrayMap"),
+  ("RO_SPACE", 0x05069): (149, "FixedBigUint64ArrayMap"),
+  ("RO_SPACE", 0x050d1): (148, "FixedBigInt64ArrayMap"),
+  ("RO_SPACE", 0x05139): (131, "SelfReferenceMarkerMap"),
+  ("RO_SPACE", 0x051b9): (171, "Tuple2Map"),
+  ("RO_SPACE", 0x05509): (161, "InterceptorInfoMap"),
+  ("RO_SPACE", 0x05629): (169, "ScriptMap"),
+  ("RO_SPACE", 0x0a021): (154, "AccessorInfoMap"),
+  ("RO_SPACE", 0x0a089): (153, "AccessCheckInfoMap"),
+  ("RO_SPACE", 0x0a0f1): (155, "AccessorPairMap"),
+  ("RO_SPACE", 0x0a159): (156, "AliasedArgumentsEntryMap"),
+  ("RO_SPACE", 0x0a1c1): (157, "AllocationMementoMap"),
+  ("RO_SPACE", 0x0a229): (158, "AsyncGeneratorRequestMap"),
+  ("RO_SPACE", 0x0a291): (159, "DebugInfoMap"),
+  ("RO_SPACE", 0x0a2f9): (160, "FunctionTemplateInfoMap"),
+  ("RO_SPACE", 0x0a361): (162, "InterpreterDataMap"),
+  ("RO_SPACE", 0x0a3c9): (163, "ModuleInfoEntryMap"),
+  ("RO_SPACE", 0x0a431): (164, "ModuleMap"),
+  ("RO_SPACE", 0x0a499): (165, "ObjectTemplateInfoMap"),
+  ("RO_SPACE", 0x0a501): (166, "PromiseCapabilityMap"),
+  ("RO_SPACE", 0x0a569): (167, "PromiseReactionMap"),
+  ("RO_SPACE", 0x0a5d1): (168, "PrototypeInfoMap"),
+  ("RO_SPACE", 0x0a639): (170, "StackFrameInfoMap"),
+  ("RO_SPACE", 0x0a6a1): (172, "Tuple3Map"),
+  ("RO_SPACE", 0x0a709): (173, "ArrayBoilerplateDescriptionMap"),
+  ("RO_SPACE", 0x0a771): (174, "WasmDebugInfoMap"),
+  ("RO_SPACE", 0x0a7d9): (175, "WasmExportedFunctionDataMap"),
+  ("RO_SPACE", 0x0a841): (176, "CallableTaskMap"),
+  ("RO_SPACE", 0x0a8a9): (177, "CallbackTaskMap"),
+  ("RO_SPACE", 0x0a911): (178, "PromiseFulfillReactionJobTaskMap"),
+  ("RO_SPACE", 0x0a979): (179, "PromiseRejectReactionJobTaskMap"),
+  ("RO_SPACE", 0x0a9e1): (180, "PromiseResolveThenableJobTaskMap"),
   ("RO_SPACE", 0x0aa49): (181, "AllocationSiteMap"),
+  ("RO_SPACE", 0x0aab1): (181, "AllocationSiteMap"),
   ("MAP_SPACE", 0x02201): (1057, "ExternalMap"),
   ("MAP_SPACE", 0x02259): (1072, "JSMessageObjectMap"),
 }
@@ -330,26 +332,26 @@
   ("RO_SPACE", 0x03149): "TerminationException",
   ("RO_SPACE", 0x03211): "OptimizedOut",
   ("RO_SPACE", 0x032d1): "StaleRegister",
-  ("RO_SPACE", 0x051c9): "EmptyByteArray",
-  ("RO_SPACE", 0x051f1): "EmptyFixedUint8Array",
-  ("RO_SPACE", 0x05211): "EmptyFixedInt8Array",
-  ("RO_SPACE", 0x05231): "EmptyFixedUint16Array",
-  ("RO_SPACE", 0x05251): "EmptyFixedInt16Array",
-  ("RO_SPACE", 0x05271): "EmptyFixedUint32Array",
-  ("RO_SPACE", 0x05291): "EmptyFixedInt32Array",
-  ("RO_SPACE", 0x052b1): "EmptyFixedFloat32Array",
-  ("RO_SPACE", 0x052d1): "EmptyFixedFloat64Array",
-  ("RO_SPACE", 0x052f1): "EmptyFixedUint8ClampedArray",
-  ("RO_SPACE", 0x05351): "EmptySloppyArgumentsElements",
-  ("RO_SPACE", 0x05371): "EmptySlowElementDictionary",
-  ("RO_SPACE", 0x053b9): "EmptyOrderedHashMap",
-  ("RO_SPACE", 0x053e1): "EmptyOrderedHashSet",
-  ("RO_SPACE", 0x05419): "EmptyPropertyCell",
-  ("RO_SPACE", 0x05441): "EmptyWeakCell",
-  ("RO_SPACE", 0x05531): "InfinityValue",
-  ("RO_SPACE", 0x05541): "MinusZeroValue",
-  ("RO_SPACE", 0x05551): "MinusInfinityValue",
-  ("RO_SPACE", 0x05561): "SelfReferenceMarker",
+  ("RO_SPACE", 0x05231): "EmptyByteArray",
+  ("RO_SPACE", 0x05259): "EmptyFixedUint8Array",
+  ("RO_SPACE", 0x05279): "EmptyFixedInt8Array",
+  ("RO_SPACE", 0x05299): "EmptyFixedUint16Array",
+  ("RO_SPACE", 0x052b9): "EmptyFixedInt16Array",
+  ("RO_SPACE", 0x052d9): "EmptyFixedUint32Array",
+  ("RO_SPACE", 0x052f9): "EmptyFixedInt32Array",
+  ("RO_SPACE", 0x05319): "EmptyFixedFloat32Array",
+  ("RO_SPACE", 0x05339): "EmptyFixedFloat64Array",
+  ("RO_SPACE", 0x05359): "EmptyFixedUint8ClampedArray",
+  ("RO_SPACE", 0x053b9): "EmptySloppyArgumentsElements",
+  ("RO_SPACE", 0x053d9): "EmptySlowElementDictionary",
+  ("RO_SPACE", 0x05421): "EmptyOrderedHashMap",
+  ("RO_SPACE", 0x05449): "EmptyOrderedHashSet",
+  ("RO_SPACE", 0x05481): "EmptyPropertyCell",
+  ("RO_SPACE", 0x054a9): "EmptyWeakCell",
+  ("RO_SPACE", 0x05599): "InfinityValue",
+  ("RO_SPACE", 0x055a9): "MinusZeroValue",
+  ("RO_SPACE", 0x055b9): "MinusInfinityValue",
+  ("RO_SPACE", 0x055c9): "SelfReferenceMarker",
   ("OLD_SPACE", 0x02211): "EmptyScript",
   ("OLD_SPACE", 0x02291): "ManyClosuresCell",
   ("OLD_SPACE", 0x022b1): "NoElementsProtector",

From 14e856561f8f34af9af899147e16680da1603354 Mon Sep 17 00:00:00 2001
From: Yang Guo <yangguo@chromium.org>
Date: Tue, 17 Jul 2018 09:09:50 +0200
Subject: [PATCH 25/28] Simplify python version string parsing

---
 deps/npm/node_modules/node-gyp/lib/configure.js | 14 +-------------
 1 file changed, 1 insertion(+), 13 deletions(-)

diff --git a/deps/npm/node_modules/node-gyp/lib/configure.js b/deps/npm/node_modules/node-gyp/lib/configure.js
index e297e98d726a38..40cc748f3d1390 100644
--- a/deps/npm/node_modules/node-gyp/lib/configure.js
+++ b/deps/npm/node_modules/node-gyp/lib/configure.js
@@ -439,7 +439,7 @@ PythonFinder.prototype = {
   },
 
   checkPythonVersion: function checkPythonVersion () {
-    var args = ['-c', 'import platform; print(platform.python_version());']
+    var args = ['-c', 'import sys; print "%s.%s.%s" % sys.version_info[:3]']
     var env = extend({}, this.env)
     env.TERM = 'dumb'
 
@@ -451,18 +451,6 @@ PythonFinder.prototype = {
                        '`%s -c "' + args[1] + '"` returned: %j',
                        this.python, stdout)
       var version = stdout.trim()
-      if (~version.indexOf('+')) {
-        this.log.silly('stripping "+" sign(s) from version')
-        version = version.replace(/\+/g, '')
-      }
-      if (~version.indexOf('rc')) {
-        this.log.silly('stripping "rc" identifier from version')
-        version = version.replace(/rc(.*)$/ig, '')
-      }
-      if (~version.indexOf('chromium')) {
-        this.log.silly('stripping "chromium" identifier from version')
-        version = version.replace(/chromium(.*)$/ig, '')
-      }
       var range = semver.Range('>=2.5.0 <3.0.0')
       var valid = false
       try {

From 94831afaad2aba9252a042552e585aad88cc4317 Mon Sep 17 00:00:00 2001
From: Yang Guo <yangguo@chromium.org>
Date: Wed, 18 Jul 2018 15:35:24 +0200
Subject: [PATCH 26/28] Update V8 to b819afeb4f

---
 deps/v8/AUTHORS                               |    1 +
 deps/v8/BUILD.gn                              |   18 +-
 deps/v8/DEPS                                  |   14 +-
 deps/v8/OWNERS                                |    3 +-
 deps/v8/include/v8.h                          |   67 +-
 deps/v8/infra/mb/mb_config.pyl                |   59 +-
 deps/v8/src/accessors.cc                      |    6 +-
 deps/v8/src/api-natives.cc                    |   10 +-
 deps/v8/src/api.cc                            |  303 +-
 deps/v8/src/arm/assembler-arm.cc              |    9 +-
 deps/v8/src/arm64/macro-assembler-arm64.cc    |    3 +-
 deps/v8/src/asmjs/asm-js.cc                   |    4 +-
 deps/v8/src/assembler.cc                      |    2 +-
 deps/v8/src/ast/ast-value-factory.cc          |    2 +-
 deps/v8/src/ast/ast-value-factory.h           |   10 +-
 deps/v8/src/bootstrapper.cc                   |  137 +-
 deps/v8/src/builtins/base.tq                  |   36 +-
 deps/v8/src/builtins/builtins-array.cc        |   28 +-
 deps/v8/src/builtins/builtins-console.cc      |    2 +-
 .../src/builtins/builtins-conversion-gen.cc   |    8 +
 deps/v8/src/builtins/builtins-date.cc         |  154 +-
 deps/v8/src/builtins/builtins-definitions.h   |   15 +-
 deps/v8/src/builtins/builtins-function.cc     |    4 +-
 deps/v8/src/builtins/builtins-intl.cc         |  442 ++-
 deps/v8/src/builtins/builtins-math.cc         |    3 +-
 deps/v8/src/builtins/builtins-object.cc       |    2 +-
 deps/v8/src/builtins/builtins-proxy-gen.h     |    1 +
 .../builtins/builtins-sharedarraybuffer.cc    |    5 +-
 deps/v8/src/builtins/builtins-string.cc       |   12 +-
 deps/v8/src/builtins/builtins-typed-array.cc  |    2 +-
 deps/v8/src/code-stub-assembler.cc            |   43 +-
 deps/v8/src/code-stub-assembler.h             |   10 +-
 deps/v8/src/code-stubs.cc                     |    5 +-
 deps/v8/src/code-tracer.h                     |   83 +
 .../unoptimized-compile-job.cc                |    3 +-
 deps/v8/src/compiler.cc                       |   12 +-
 deps/v8/src/compiler.h                        |   13 +-
 deps/v8/src/compiler/access-info.cc           |   28 +-
 deps/v8/src/compiler/access-info.h            |    7 +-
 deps/v8/src/compiler/allocation-builder.h     |    8 +-
 .../v8/src/compiler/arm/code-generator-arm.cc |   14 +-
 .../compiler/arm/instruction-selector-arm.cc  |   10 +-
 .../arm64/instruction-selector-arm64.cc       |    2 +
 deps/v8/src/compiler/code-generator.cc        |    2 +-
 .../src/compiler/common-operator-reducer.cc   |    4 +-
 .../src/compiler/compilation-dependencies.cc  |  257 +-
 .../src/compiler/compilation-dependencies.h   |   26 +-
 .../src/compiler/constant-folding-reducer.cc  |    7 +-
 .../ia32/instruction-selector-ia32.cc         |   17 +-
 deps/v8/src/compiler/js-call-reducer.cc       |  117 +-
 deps/v8/src/compiler/js-call-reducer.h        |    2 +
 .../src/compiler/js-context-specialization.cc |   24 +-
 deps/v8/src/compiler/js-create-lowering.cc    |  450 +--
 deps/v8/src/compiler/js-create-lowering.h     |    9 +-
 deps/v8/src/compiler/js-generic-lowering.cc   |    1 +
 deps/v8/src/compiler/js-graph.cc              |    4 +-
 deps/v8/src/compiler/js-graph.h               |    3 +-
 deps/v8/src/compiler/js-heap-broker.cc        |  457 ++-
 deps/v8/src/compiler/js-heap-broker.h         |  155 +-
 .../js-native-context-specialization.cc       |  128 +-
 deps/v8/src/compiler/js-operator.cc           |    1 +
 deps/v8/src/compiler/js-operator.h            |    1 +
 deps/v8/src/compiler/js-typed-lowering.cc     |   96 +-
 .../src/compiler/loop-variable-optimizer.cc   |    3 +-
 deps/v8/src/compiler/node-matchers.h          |    6 +-
 deps/v8/src/compiler/node-properties.cc       |    1 +
 deps/v8/src/compiler/opcodes.h                |    1 +
 deps/v8/src/compiler/operation-typer.cc       |   18 +-
 deps/v8/src/compiler/operation-typer.h        |    2 +
 deps/v8/src/compiler/operator-properties.cc   |    1 +
 deps/v8/src/compiler/pipeline.cc              |   99 +-
 deps/v8/src/compiler/pipeline.h               |    2 +-
 .../src/compiler/property-access-builder.cc   |   12 +-
 .../v8/src/compiler/property-access-builder.h |   10 +-
 deps/v8/src/compiler/simplified-lowering.cc   |   58 +-
 deps/v8/src/compiler/simplified-lowering.h    |    4 +
 .../compiler/simplified-operator-reducer.cc   |    3 +-
 deps/v8/src/compiler/typed-optimization.cc    |   32 +-
 deps/v8/src/compiler/typer.cc                 |   10 +
 deps/v8/src/compiler/types.cc                 |    9 +-
 deps/v8/src/compiler/types.h                  |    6 +-
 deps/v8/src/compiler/verifier.cc              |    1 +
 deps/v8/src/compiler/wasm-compiler.cc         |  101 +-
 deps/v8/src/compiler/wasm-compiler.h          |   15 +-
 .../v8/src/compiler/x64/code-generator-x64.cc |    3 +-
 .../compiler/x64/instruction-selector-x64.cc  |   36 +-
 deps/v8/src/contexts-inl.h                    |    5 +-
 deps/v8/src/contexts.cc                       |   17 +-
 deps/v8/src/contexts.h                        |    7 +-
 deps/v8/src/counters-inl.h                    |    5 +-
 deps/v8/src/counters.cc                       |   19 -
 deps/v8/src/counters.h                        |   23 +-
 deps/v8/src/d8.cc                             |   29 +-
 deps/v8/src/debug/OWNERS                      |    1 -
 deps/v8/src/debug/debug-evaluate.cc           |    3 +-
 deps/v8/src/debug/debug-scopes.cc             |   12 +-
 .../src/debug/debug-stack-trace-iterator.cc   |    3 +-
 deps/v8/src/debug/debug.cc                    |    3 +-
 deps/v8/src/debug/liveedit.cc                 |   60 +-
 deps/v8/src/deoptimizer.h                     |    1 +
 deps/v8/src/elements.cc                       |   25 +-
 deps/v8/src/feedback-vector.cc                |   14 +-
 deps/v8/src/field-type.cc                     |    9 +-
 deps/v8/src/field-type.h                      |    2 +-
 deps/v8/src/flag-definitions.h                |    7 +-
 deps/v8/src/flags.cc                          |   28 +
 deps/v8/src/frames.cc                         |   11 +-
 deps/v8/src/global-handles.cc                 |    9 +-
 deps/v8/src/handles-inl.h                     |    4 +
 deps/v8/src/handles.cc                        |    4 +-
 deps/v8/src/heap/array-buffer-tracker-inl.h   |    9 +-
 deps/v8/src/heap/array-buffer-tracker.cc      |    8 +-
 deps/v8/src/heap/array-buffer-tracker.h       |    9 +-
 deps/v8/src/heap/concurrent-marking.cc        |    7 +-
 deps/v8/src/heap/concurrent-marking.h         |    2 +-
 deps/v8/src/heap/factory.cc                   |   48 +-
 deps/v8/src/heap/factory.h                    |    7 +-
 deps/v8/src/heap/gc-tracer.cc                 |   21 +-
 deps/v8/src/heap/heap-inl.h                   |   27 +-
 deps/v8/src/heap/heap.cc                      |  132 +-
 deps/v8/src/heap/heap.h                       |   16 +-
 deps/v8/src/heap/item-parallel-job.h          |   11 +-
 deps/v8/src/heap/mark-compact.cc              |   11 +-
 deps/v8/src/heap/object-stats.cc              |    4 +-
 deps/v8/src/heap/setup-heap-internal.cc       |   20 +-
 deps/v8/src/heap/spaces.cc                    |   22 +-
 deps/v8/src/heap/spaces.h                     |   69 +-
 deps/v8/src/heap/sweeper.cc                   |   25 +-
 deps/v8/src/heap/sweeper.h                    |    2 +-
 deps/v8/src/ic/handler-configuration.h        |    2 +
 deps/v8/src/ic/ic.cc                          |   48 +-
 .../src/inspector/injected-script-source.js   |    3 +
 deps/v8/src/isolate.cc                        |   82 +-
 deps/v8/src/isolate.h                         |  126 +-
 deps/v8/src/js/array.js                       |   49 +-
 deps/v8/src/js/intl.js                        |    5 +-
 deps/v8/src/js/typedarray.js                  |    6 +-
 deps/v8/src/json-parser.cc                    |    6 +-
 deps/v8/src/json-stringifier.cc               |   20 +-
 deps/v8/src/keys.h                            |    2 +
 deps/v8/src/layout-descriptor.cc              |   15 +-
 deps/v8/src/layout-descriptor.h               |    6 +-
 deps/v8/src/log.cc                            |   95 +-
 deps/v8/src/log.h                             |    9 +-
 deps/v8/src/lookup.cc                         |   25 +-
 deps/v8/src/lookup.h                          |    6 +-
 deps/v8/src/map-updater.cc                    |   12 +-
 deps/v8/src/messages.cc                       |   11 +-
 deps/v8/src/messages.h                        |    3 +-
 deps/v8/src/mips/assembler-mips-inl.h         |    7 -
 deps/v8/src/mips/assembler-mips.cc            |  105 +-
 deps/v8/src/mips/assembler-mips.h             |   22 +-
 deps/v8/src/mips/macro-assembler-mips.cc      |   90 +-
 deps/v8/src/mips64/assembler-mips64-inl.h     |    7 -
 deps/v8/src/mips64/assembler-mips64.cc        |   66 +-
 deps/v8/src/mips64/assembler-mips64.h         |   18 +-
 deps/v8/src/mips64/macro-assembler-mips64.cc  |  118 +-
 deps/v8/src/objects-debug.cc                  |  411 +-
 deps/v8/src/objects-inl.h                     |   84 +-
 deps/v8/src/objects-printer.cc                |    2 +-
 deps/v8/src/objects.cc                        |  652 ++--
 deps/v8/src/objects.h                         |  198 +-
 deps/v8/src/objects/api-callbacks.h           |    4 +-
 deps/v8/src/objects/bigint.cc                 |   17 +-
 deps/v8/src/objects/code.h                    |   23 +-
 deps/v8/src/objects/compilation-cache.h       |    6 +-
 deps/v8/src/objects/debug-objects.h           |    5 +-
 deps/v8/src/objects/dictionary.h              |   49 +-
 deps/v8/src/objects/fixed-array-inl.h         |    5 +-
 deps/v8/src/objects/fixed-array.h             |   26 +-
 deps/v8/src/objects/frame-array.h             |    3 +-
 deps/v8/src/objects/hash-table-inl.h          |    5 -
 deps/v8/src/objects/hash-table.h              |    1 -
 deps/v8/src/objects/intl-objects.cc           |  257 +-
 deps/v8/src/objects/js-array.h                |    2 -
 deps/v8/src/objects/js-locale.cc              |   87 +-
 deps/v8/src/objects/js-locale.h               |    2 +
 deps/v8/src/objects/js-proxy-inl.h            |   28 +
 deps/v8/src/objects/js-proxy.h                |  155 +
 deps/v8/src/objects/js-regexp.h               |    3 +-
 deps/v8/src/objects/literal-objects.cc        |   41 +-
 deps/v8/src/objects/map-inl.h                 |   32 +-
 deps/v8/src/objects/map.h                     |   29 +-
 deps/v8/src/objects/maybe-object.h            |    2 +-
 deps/v8/src/objects/module.h                  |    5 +-
 deps/v8/src/objects/name.h                    |    4 +-
 deps/v8/src/objects/prototype-info-inl.h      |   19 +
 deps/v8/src/objects/prototype-info.h          |   41 +-
 deps/v8/src/objects/regexp-match-info.h       |    2 +-
 deps/v8/src/objects/script.h                  |    5 +-
 .../v8/src/objects/shared-function-info-inl.h |   31 +-
 deps/v8/src/objects/shared-function-info.h    |   43 +-
 deps/v8/src/objects/string-inl.h              |   22 +-
 deps/v8/src/objects/string-table.h            |    2 +-
 deps/v8/src/objects/string.h                  |   10 -
 deps/v8/src/objects/templates.h               |    5 +-
 deps/v8/src/parsing/parse-info.cc             |    2 +-
 deps/v8/src/parsing/parse-info.h              |    6 +-
 deps/v8/src/parsing/parser-base.h             |    9 +-
 deps/v8/src/parsing/preparsed-scope-data.cc   |    2 +-
 .../src/pending-compilation-error-handler.cc  |    7 +-
 deps/v8/src/perf-jit.cc                       |    2 +-
 deps/v8/src/perf-jit.h                        |    4 +-
 deps/v8/src/profiler/heap-profiler.cc         |    4 +-
 .../src/profiler/heap-snapshot-generator.cc   |    3 -
 deps/v8/src/profiler/profile-generator.cc     |    4 +-
 deps/v8/src/profiler/profiler-listener.cc     |    4 +-
 deps/v8/src/profiler/strings-storage.cc       |    5 +-
 deps/v8/src/profiler/strings-storage.h        |    3 +-
 deps/v8/src/property.cc                       |   13 +-
 deps/v8/src/property.h                        |    8 +-
 deps/v8/src/prototype.h                       |    8 +-
 deps/v8/src/regexp/jsregexp.cc                |    5 +-
 deps/v8/src/regexp/regexp-utils.cc            |   12 +-
 deps/v8/src/roots-inl.h                       |    6 +
 deps/v8/src/roots.h                           |    6 +-
 deps/v8/src/runtime/runtime-array.cc          |    6 +-
 deps/v8/src/runtime/runtime-classes.cc        |    8 +-
 deps/v8/src/runtime/runtime-function.cc       |    9 +-
 deps/v8/src/runtime/runtime-internal.cc       |    3 +-
 deps/v8/src/runtime/runtime-intl.cc           |    5 +-
 deps/v8/src/runtime/runtime-literals.cc       |    3 +-
 deps/v8/src/runtime/runtime-liveedit.cc       |  260 --
 deps/v8/src/runtime/runtime-numbers.cc        |    3 +-
 deps/v8/src/runtime/runtime-object.cc         |   13 +-
 deps/v8/src/runtime/runtime-regexp.cc         |   17 +-
 deps/v8/src/runtime/runtime-scopes.cc         |   11 +-
 deps/v8/src/runtime/runtime-typedarray.cc     |    2 +-
 deps/v8/src/runtime/runtime-wasm.cc           |    4 +-
 deps/v8/src/snapshot/code-serializer.cc       |   19 +-
 deps/v8/src/snapshot/deserializer.cc          |    5 +-
 deps/v8/src/snapshot/mksnapshot.cc            |    7 +-
 deps/v8/src/snapshot/object-deserializer.cc   |    1 +
 deps/v8/src/snapshot/serializer.h             |    3 +-
 deps/v8/src/snapshot/startup-deserializer.cc  |    1 +
 deps/v8/src/snapshot/startup-serializer.cc    |    1 +
 deps/v8/src/string-builder.h                  |   10 +-
 deps/v8/src/string-hasher-inl.h               |   10 +-
 deps/v8/src/string-hasher.h                   |   14 +-
 deps/v8/src/string-stream.cc                  |   96 +-
 deps/v8/src/string-stream.h                   |    4 +-
 deps/v8/src/third_party/vtune/vtune-jit.cc    |    3 +-
 deps/v8/src/torque/Torque.g4                  |   36 +-
 deps/v8/src/torque/Torque.interp              |  249 ++
 deps/v8/src/torque/Torque.tokens              |  154 +
 deps/v8/src/torque/TorqueBaseListener.h       |   30 +
 deps/v8/src/torque/TorqueBaseVisitor.h        |   30 +
 deps/v8/src/torque/TorqueLexer.cpp            | 1178 +++---
 deps/v8/src/torque/TorqueLexer.h              |   75 +-
 deps/v8/src/torque/TorqueLexer.interp         |  264 ++
 deps/v8/src/torque/TorqueLexer.tokens         |  154 +
 deps/v8/src/torque/TorqueListener.h           |   30 +
 deps/v8/src/torque/TorqueParser.cpp           | 3477 ++++++++++-------
 deps/v8/src/torque/TorqueParser.h             |  287 +-
 deps/v8/src/torque/TorqueVisitor.h            |   18 +
 deps/v8/src/torque/ast-generator.cc           |   89 +-
 deps/v8/src/torque/ast-generator.h            |   12 +
 deps/v8/src/torque/ast.h                      |   47 +-
 deps/v8/src/torque/declarable.cc              |   12 +
 deps/v8/src/torque/declarable.h               |   57 +-
 deps/v8/src/torque/declaration-visitor.cc     |  113 +-
 deps/v8/src/torque/declaration-visitor.h      |   14 +-
 deps/v8/src/torque/declarations.cc            |   41 +-
 deps/v8/src/torque/declarations.h             |   13 +-
 deps/v8/src/torque/file-visitor.cc            |    6 +
 deps/v8/src/torque/file-visitor.h             |    1 +
 deps/v8/src/torque/implementation-visitor.cc  |  366 +-
 deps/v8/src/torque/implementation-visitor.h   |   40 +-
 deps/v8/src/torque/type-oracle.h              |    9 +
 deps/v8/src/torque/types.cc                   |   33 +-
 deps/v8/src/torque/types.h                    |   53 +-
 deps/v8/src/transitions.cc                    |    9 +-
 deps/v8/src/transitions.h                     |    2 +-
 deps/v8/src/trap-handler/OWNERS               |    6 +-
 deps/v8/src/utils.h                           |    6 +-
 deps/v8/src/value-serializer.cc               |    6 +-
 deps/v8/src/wasm/baseline/liftoff-compiler.cc |   26 +-
 .../wasm/baseline/x64/liftoff-assembler-x64.h |   13 +-
 deps/v8/src/wasm/function-compiler.cc         |    4 +-
 deps/v8/src/wasm/function-compiler.h          |    5 +-
 deps/v8/src/wasm/module-compiler.cc           |   50 +-
 deps/v8/src/wasm/wasm-code-manager.cc         |   37 +-
 deps/v8/src/wasm/wasm-code-manager.h          |    5 +
 deps/v8/src/wasm/wasm-engine.cc               |    9 +
 deps/v8/src/wasm/wasm-engine.h                |   18 +-
 deps/v8/src/wasm/wasm-interpreter.cc          |    1 +
 deps/v8/src/wasm/wasm-js.cc                   |    4 +-
 deps/v8/src/wasm/wasm-memory.cc               |   59 +-
 deps/v8/src/wasm/wasm-memory.h                |   28 +-
 deps/v8/src/wasm/wasm-objects.cc              |    2 +-
 deps/v8/src/wasm/wasm-objects.h               |    5 +-
 deps/v8/test/BUILD.gn                         |   11 +
 deps/v8/test/cctest/BUILD.gn                  |    1 -
 deps/v8/test/cctest/cctest.h                  |    2 +-
 .../cctest/compiler/test-code-assembler.cc    |    4 +-
 .../cctest/compiler/test-js-typed-lowering.cc |    3 +-
 deps/v8/test/cctest/compiler/test-linkage.cc  |    5 +-
 .../cctest/compiler/test-run-jsobjects.cc     |    9 +-
 .../heap/test-external-string-tracker.cc      |  176 -
 deps/v8/test/cctest/heap/test-heap.cc         |  127 +-
 deps/v8/test/cctest/heap/test-mark-compact.cc |   15 +-
 .../test/cctest/heap/test-weak-references.cc  |  155 +-
 .../AsyncGenerators.golden                    |    2 +-
 .../bytecode_expectations/ForAwaitOf.golden   |    8 +-
 .../bytecode_expectations/ForOf.golden        |    8 +-
 .../bytecode_expectations/ForOfLoop.golden    |   16 +-
 .../bytecode_expectations/Generators.golden   |    2 +-
 .../cctest/interpreter/test-interpreter.cc    |    6 +-
 .../cctest/parsing/test-scanner-streams.cc    |    4 +-
 deps/v8/test/cctest/test-api-interceptors.cc  |   12 +-
 deps/v8/test/cctest/test-api.cc               |   30 +-
 deps/v8/test/cctest/test-array-list.cc        |    4 +-
 .../test/cctest/test-code-stub-assembler.cc   |   38 +-
 deps/v8/test/cctest/test-compiler.cc          |    5 +-
 deps/v8/test/cctest/test-dictionary.cc        |    6 +-
 .../test/cctest/test-field-type-tracking.cc   |   28 +-
 .../cctest/test-inobject-slack-tracking.cc    |   11 +-
 deps/v8/test/cctest/test-intl.cc              |   21 +-
 deps/v8/test/cctest/test-log.cc               |   19 +-
 deps/v8/test/cctest/test-parsing.cc           |   35 +
 deps/v8/test/cctest/test-serialize.cc         |   27 +-
 deps/v8/test/cctest/test-strings.cc           |   11 +-
 deps/v8/test/cctest/test-unboxed-doubles.cc   |   44 +-
 deps/v8/test/cctest/torque/test-torque.cc     |   24 +
 .../v8/test/cctest/wasm/test-run-wasm-simd.cc |  450 ++-
 deps/v8/test/cctest/wasm/test-run-wasm.cc     |    6 +-
 deps/v8/test/cctest/wasm/wasm-run-utils.cc    |    1 +
 deps/v8/test/fuzzer/json.cc                   |    5 +
 deps/v8/test/fuzzer/multi-return.cc           |    3 +-
 deps/v8/test/fuzzer/parser.cc                 |    5 +
 deps/v8/test/fuzzer/regexp.cc                 |    3 +-
 deps/v8/test/intl/locale/locale-properties.js |    2 +-
 deps/v8/test/intl/locale/maximize_minimize.js |  138 +
 .../intl/relative-time-format/format-en.js    |  502 +++
 .../format-to-parts-en.js                     |   68 +
 .../relative-time-format/format-to-parts.js   |   82 +
 .../test/intl/relative-time-format/format.js  |   82 +
 deps/v8/test/js-perf-test/JSTests.json        |   13 +
 deps/v8/test/js-perf-test/Numbers/run.js      |   20 +
 deps/v8/test/js-perf-test/Numbers/toNumber.js |   25 +
 .../harmony/bigint/regress-tonumbercode.js    |   16 +
 deps/v8/test/mjsunit/harmony/bigint/turbo.js  |   11 +-
 .../v8/test/mjsunit/regress/regress-852765.js |   17 +
 .../v8/test/mjsunit/regress/regress-863155.js |   10 +
 .../v8/test/mjsunit/regress/regress-863810.js |   19 +
 .../mjsunit/regress/wasm/regress-808848.js    |   18 +-
 .../mjsunit/regress/wasm/regress-864509.js    |   62 +
 deps/v8/test/mjsunit/wasm/worker-module.js    |    4 +-
 deps/v8/test/test262/test262.status           |   22 -
 deps/v8/test/torque/test-torque.tq            |   99 +-
 .../compiler/js-call-reducer-unittest.cc      |    9 +-
 deps/v8/test/unittests/object-unittest.cc     |   12 +-
 .../unittests/strings-storage-unittest.cc     |   12 +-
 deps/v8/test/unittests/test-helpers.cc        |    6 +-
 .../CheckProtocolCompatibility.py             |  478 +--
 .../inspector_protocol/CodeGenerator.py       |  652 +---
 .../ConvertProtocolToJSON.py                  |  183 +-
 .../third_party/inspector_protocol/README.md  |   10 +
 .../third_party/inspector_protocol/README.v8  |    2 +-
 .../check_protocol_compatibility.py           |  482 +++
 .../inspector_protocol/code_generator.py      |  661 ++++
 .../inspector_protocol/codereview.settings    |    6 +
 ...eProtocols.py => concatenate_protocols.py} |    4 +-
 .../convert_protocol_to_json.py               |   33 +
 .../inspector_protocol/inspector_protocol.gni |    3 +-
 .../inspector_protocol.gypi                   |    3 +-
 .../lib/Collections_h.template                |   43 -
 .../lib/DispatcherBase_cpp.template           |    4 +-
 .../lib/DispatcherBase_h.template             |   11 +-
 .../lib/ErrorSupport_h.template               |    2 +-
 .../inspector_protocol/lib/Forward_h.template |    3 +
 .../lib/Parser_cpp.template                   |    5 +-
 .../lib/Protocol_cpp.template                 |    2 +-
 .../inspector_protocol/lib/Values_h.template  |    3 +-
 deps/v8/third_party/inspector_protocol/pdl.py |  167 +
 .../templates/TypeBuilder_cpp.template        |   12 +-
 .../templates/TypeBuilder_h.template          |    4 +-
 deps/v8/tools/callstats.py                    |   13 +-
 deps/v8/tools/gen-postmortem-metadata.py      |    5 +
 deps/v8/tools/lldb_commands.py                |   76 +-
 deps/v8/tools/lldbinit                        |   20 -
 deps/v8/tools/mb/mb.py                        |    8 +-
 deps/v8/tools/parse-processor.html            |  116 +-
 deps/v8/tools/parse-processor.js              |  398 +-
 deps/v8/tools/turbolizer/index.html           |    1 -
 deps/v8/tools/turbolizer/package-lock.json    |   20 +
 deps/v8/tools/turbolizer/package.json         |    1 +
 deps/v8/tools/turbolizer/rollup.config.js     |    3 +-
 deps/v8/tools/v8heapconst.py                  |  348 +-
 389 files changed, 13490 insertions(+), 8524 deletions(-)
 create mode 100644 deps/v8/src/code-tracer.h
 create mode 100644 deps/v8/src/objects/js-proxy-inl.h
 create mode 100644 deps/v8/src/objects/js-proxy.h
 delete mode 100644 deps/v8/src/runtime/runtime-liveedit.cc
 create mode 100644 deps/v8/src/torque/Torque.interp
 create mode 100644 deps/v8/src/torque/Torque.tokens
 create mode 100644 deps/v8/src/torque/TorqueLexer.interp
 create mode 100644 deps/v8/src/torque/TorqueLexer.tokens
 delete mode 100644 deps/v8/test/cctest/heap/test-external-string-tracker.cc
 create mode 100644 deps/v8/test/intl/locale/maximize_minimize.js
 create mode 100644 deps/v8/test/intl/relative-time-format/format-en.js
 create mode 100644 deps/v8/test/intl/relative-time-format/format-to-parts-en.js
 create mode 100644 deps/v8/test/intl/relative-time-format/format-to-parts.js
 create mode 100644 deps/v8/test/intl/relative-time-format/format.js
 create mode 100644 deps/v8/test/js-perf-test/Numbers/run.js
 create mode 100644 deps/v8/test/js-perf-test/Numbers/toNumber.js
 create mode 100644 deps/v8/test/mjsunit/harmony/bigint/regress-tonumbercode.js
 create mode 100644 deps/v8/test/mjsunit/regress/regress-852765.js
 create mode 100644 deps/v8/test/mjsunit/regress/regress-863155.js
 create mode 100644 deps/v8/test/mjsunit/regress/regress-863810.js
 create mode 100644 deps/v8/test/mjsunit/regress/wasm/regress-864509.js
 mode change 100644 => 100755 deps/v8/third_party/inspector_protocol/CodeGenerator.py
 mode change 100644 => 100755 deps/v8/third_party/inspector_protocol/ConvertProtocolToJSON.py
 create mode 100644 deps/v8/third_party/inspector_protocol/README.md
 create mode 100755 deps/v8/third_party/inspector_protocol/check_protocol_compatibility.py
 create mode 100755 deps/v8/third_party/inspector_protocol/code_generator.py
 create mode 100644 deps/v8/third_party/inspector_protocol/codereview.settings
 rename deps/v8/third_party/inspector_protocol/{ConcatenateProtocols.py => concatenate_protocols.py} (92%)
 create mode 100755 deps/v8/third_party/inspector_protocol/convert_protocol_to_json.py
 create mode 100644 deps/v8/third_party/inspector_protocol/pdl.py
 delete mode 100755 deps/v8/tools/lldbinit

diff --git a/deps/v8/AUTHORS b/deps/v8/AUTHORS
index 6f4b3fe6aeae70..b9391a0d284999 100644
--- a/deps/v8/AUTHORS
+++ b/deps/v8/AUTHORS
@@ -150,6 +150,7 @@ Teddy Katz <teddy.katz@gmail.com>
 Tiancheng "Timothy" Gu <timothygu99@gmail.com>
 Tobias Burnus <burnus@net-b.de>
 Tobias Nießen <tniessen@tnie.de>
+Ujjwal Sharma <usharma1998@gmail.com>
 Victor Costan <costan@gmail.com>
 Vlad Burlik <vladbph@gmail.com>
 Vladimir Krivosheev <develar@gmail.com>
diff --git a/deps/v8/BUILD.gn b/deps/v8/BUILD.gn
index 8931e4fc620693..50f11649c3ee99 100644
--- a/deps/v8/BUILD.gn
+++ b/deps/v8/BUILD.gn
@@ -25,10 +25,6 @@ declare_args() {
   # Dynamically set an additional dependency from v8/custom_deps.
   v8_custom_deps = ""
 
-  # Turns on deprecation warnings for HeapObject::GetIsolate,
-  # HeapObject::GetHeap, Handle(T* obj) and handle(T* obj).
-  v8_deprecate_get_isolate = false
-
   # Turns on all V8 debug features. Enables running V8 in a pseudo debug mode
   # within a release Chrome.
   v8_enable_debugging_features = is_debug
@@ -77,8 +73,10 @@ declare_args() {
 
   # Enable embedded builtins.
   # TODO(jgruber,v8:6666): Support ia32 and maybe MSVC.
+  # TODO(jgruber,v8:6666): Enable for remaining architectures once performance
+  #                        regressions are addressed.
   v8_enable_embedded_builtins =
-      v8_use_snapshot && v8_current_cpu != "x86" && (!is_win || is_clang)
+      v8_use_snapshot && v8_current_cpu == "x64" && (!is_win || is_clang)
 
   # Enable code-generation-time checking of types in the CodeStubAssembler.
   v8_enable_verify_csa = false
@@ -338,9 +336,6 @@ config("features") {
   if (v8_imminent_deprecation_warnings) {
     defines += [ "V8_IMMINENT_DEPRECATION_WARNINGS" ]
   }
-  if (v8_deprecate_get_isolate) {
-    defines += [ "DEPRECATE_GET_ISOLATE" ]
-  }
   if (v8_enable_i18n_support) {
     defines += [ "V8_INTL_SUPPORT" ]
   }
@@ -584,10 +579,6 @@ config("toolchain") {
         v8_current_cpu == "mips64el") {
       cflags += [ "-Wshorten-64-to-32" ]
     }
-
-    if (v8_deprecate_get_isolate) {
-      cflags += [ "-Wno-error=deprecated" ]
-    }
   }
 
   if (is_win) {
@@ -1611,6 +1602,7 @@ v8_source_set("v8_base") {
     "src/code-stubs-utils.h",
     "src/code-stubs.cc",
     "src/code-stubs.h",
+    "src/code-tracer.h",
     "src/codegen.cc",
     "src/codegen.h",
     "src/collector.h",
@@ -2148,6 +2140,8 @@ v8_source_set("v8_base") {
     "src/objects/js-locale.h",
     "src/objects/js-promise-inl.h",
     "src/objects/js-promise.h",
+    "src/objects/js-proxy-inl.h",
+    "src/objects/js-proxy.h",
     "src/objects/js-regexp-inl.h",
     "src/objects/js-regexp-string-iterator-inl.h",
     "src/objects/js-regexp-string-iterator.h",
diff --git a/deps/v8/DEPS b/deps/v8/DEPS
index cc7c2dc824cc3b..ab6d0a521b72a8 100644
--- a/deps/v8/DEPS
+++ b/deps/v8/DEPS
@@ -12,11 +12,11 @@ vars = {
 
 deps = {
   'v8/build':
-    Var('chromium_url') + '/chromium/src/build.git' + '@' + '7b4d0db3ac880a5cc310ebfaf9a22d471c8592c8',
+    Var('chromium_url') + '/chromium/src/build.git' + '@' + 'e4fb293b7b93dffec18a4f0197b287dec7134a8e',
   'v8/tools/gyp':
     Var('chromium_url') + '/external/gyp.git' + '@' + 'd61a9397e668fa9843c4aa7da9e79460fe590bfb',
   'v8/third_party/depot_tools':
-    Var('chromium_url') + '/chromium/tools/depot_tools.git' + '@' + '882c91ed97c39cde9fb93b153c25676a7c084499',
+    Var('chromium_url') + '/chromium/tools/depot_tools.git' + '@' + '302bb847d356a011f685542fc469f4c3e58b25fc',
   'v8/third_party/icu':
     Var('chromium_url') + '/chromium/deps/icu.git' + '@' + 'a9a2bd3ee4f1d313651c5272252aaf2a3e7ed529',
   'v8/third_party/instrumented_libraries':
@@ -34,7 +34,7 @@ deps = {
     'condition': 'checkout_android',
   },
   'v8/third_party/catapult': {
-    'url': Var('chromium_url') + '/catapult.git' + '@' + '8495de1eb482068897a88bbd3a59199d1a4525f5',
+    'url': Var('chromium_url') + '/catapult.git' + '@' + 'f5342c4cf3d3e85e43be84c22bdfd8ebff23ec70',
     'condition': 'checkout_android',
   },
   'v8/third_party/colorama/src': {
@@ -42,7 +42,7 @@ deps = {
     'condition': 'checkout_android',
   },
   'v8/third_party/fuchsia-sdk': {
-    'url': Var('chromium_url') + '/chromium/src/third_party/fuchsia-sdk.git' + '@' + '272de12d87a80905fd2df2339644a8561e3c2c30',
+    'url': Var('chromium_url') + '/chromium/src/third_party/fuchsia-sdk.git' + '@' + '976ce5e581e5e3d72174aff09d74417ea5d4df34',
     'condition': 'checkout_fuchsia',
   },
   'v8/third_party/googletest/src':
@@ -51,6 +51,8 @@ deps = {
     Var('chromium_url') + '/chromium/src/third_party/jinja2.git' + '@' + 'b41863e42637544c2941b574c7877d3e1f663e25',
   'v8/third_party/markupsafe':
     Var('chromium_url') + '/chromium/src/third_party/markupsafe.git' + '@' + '8f45f5cfa0009d2a70589bcda0349b8cb2b72783',
+  'v8/third_party/proguard':
+    Var('chromium_url') + '/chromium/src/third_party/proguard.git' + '@' + 'eba7a98d98735b2cc65c54d36baa5c9b46fe4f8e',
   'v8/tools/swarming_client':
     Var('chromium_url') + '/infra/luci/client-py.git' + '@' + '9a518d097dca20b7b00ce3bdfc5d418ccc79893a',
   'v8/test/benchmarks/data':
@@ -62,9 +64,9 @@ deps = {
   'v8/test/test262/harness':
     Var('chromium_url') + '/external/github.com/test262-utils/test262-harness-py.git' + '@' + '0f2acdd882c84cff43b9d60df7574a1901e2cdcd',
   'v8/tools/clang':
-    Var('chromium_url') + '/chromium/src/tools/clang.git' + '@' + 'e9cc24f5fef7fea00b265829002cc12973353b00',
+    Var('chromium_url') + '/chromium/src/tools/clang.git' + '@' + '5d1ce93fd599836f6317aaccad784b13a64f6e90',
   'v8/tools/luci-go':
-    Var('chromium_url') + '/chromium/src/tools/luci-go.git' + '@' + '7edc822ab85483d64946e62a7e66a579b6929f0b',
+    Var('chromium_url') + '/chromium/src/tools/luci-go.git' + '@' + 'abcd908f74fdb155cc8870f5cae48dff1ece7c3c',
   'v8/test/wasm-js':
     Var('chromium_url') + '/external/github.com/WebAssembly/spec.git' + '@' + '2113ea7e106f8a964e0445ba38f289d2aa845edd',
 }
diff --git a/deps/v8/OWNERS b/deps/v8/OWNERS
index 3e3eef5ff2bebf..d32f7213822f10 100644
--- a/deps/v8/OWNERS
+++ b/deps/v8/OWNERS
@@ -10,10 +10,10 @@ clemensh@chromium.org
 danno@chromium.org
 delphick@chromium.org
 eholk@chromium.org
-franzih@chromium.org
 gdeepti@chromium.org
 gsathya@chromium.org
 hablich@chromium.org
+herhut@chromium.org
 hpayer@chromium.org
 ishell@chromium.org
 jarin@chromium.org
@@ -22,6 +22,7 @@ jkummerow@chromium.org
 kschimpf@chromium.org
 leszeks@chromium.org
 machenbach@chromium.org
+mathias@chromium.org
 marja@chromium.org
 mlippautz@chromium.org
 mslekova@chromium.org
diff --git a/deps/v8/include/v8.h b/deps/v8/include/v8.h
index 1842f16914544d..23d5ba36db97da 100644
--- a/deps/v8/include/v8.h
+++ b/deps/v8/include/v8.h
@@ -146,6 +146,7 @@ class Heap;
 class HeapObject;
 class Isolate;
 class LocalEmbedderHeapTracer;
+class NeverReadOnlySpaceObject;
 class Object;
 struct ScriptStreamingData;
 template<typename T> class CustomArguments;
@@ -994,8 +995,8 @@ class V8_EXPORT HandleScope {
   void operator delete[](void*, size_t);
 
   // Uses heap_object to obtain the current Isolate.
-  static internal::Object** CreateHandle(internal::HeapObject* heap_object,
-                                         internal::Object* value);
+  static internal::Object** CreateHandle(
+      internal::NeverReadOnlySpaceObject* heap_object, internal::Object* value);
 
   internal::Isolate* isolate_;
   internal::Object** prev_next_;
@@ -1122,8 +1123,12 @@ class V8_EXPORT PrimitiveArray {
  public:
   static Local<PrimitiveArray> New(Isolate* isolate, int length);
   int Length() const;
-  void Set(int index, Local<Primitive> item);
-  Local<Primitive> Get(int index);
+  void Set(Isolate* isolate, int index, Local<Primitive> item);
+  Local<Primitive> Get(Isolate* isolate, int index);
+
+  V8_DEPRECATE_SOON("Use Isolate version",
+                    void Set(int index, Local<Primitive> item));
+  V8_DEPRECATE_SOON("Use Isolate version", Local<Primitive> Get(int index));
 };
 
 /**
@@ -1848,7 +1853,9 @@ class V8_EXPORT StackTrace {
   /**
    * Returns a StackFrame at a particular index.
    */
-  Local<StackFrame> GetFrame(uint32_t index) const;
+  V8_DEPRECATE_SOON("Use Isolate version",
+                    Local<StackFrame> GetFrame(uint32_t index) const);
+  Local<StackFrame> GetFrame(Isolate* isolate, uint32_t index) const;
 
   /**
    * Returns the number of StackFrames.
@@ -2692,7 +2699,9 @@ class V8_EXPORT String : public Name {
    * Returns the number of bytes in the UTF-8 encoded
    * representation of this string.
    */
-  int Utf8Length() const;
+  V8_DEPRECATE_SOON("Use Isolate version instead", int Utf8Length() const);
+
+  int Utf8Length(Isolate* isolate) const;
 
   /**
    * Returns whether this string is known to contain only one byte data,
@@ -2746,20 +2755,25 @@ class V8_EXPORT String : public Name {
   };
 
   // 16-bit character codes.
-  int Write(uint16_t* buffer,
-            int start = 0,
-            int length = -1,
+  int Write(Isolate* isolate, uint16_t* buffer, int start = 0, int length = -1,
             int options = NO_OPTIONS) const;
+  V8_DEPRECATE_SOON("Use Isolate* version",
+                    int Write(uint16_t* buffer, int start = 0, int length = -1,
+                              int options = NO_OPTIONS) const);
   // One byte characters.
-  int WriteOneByte(uint8_t* buffer,
-                   int start = 0,
-                   int length = -1,
-                   int options = NO_OPTIONS) const;
+  int WriteOneByte(Isolate* isolate, uint8_t* buffer, int start = 0,
+                   int length = -1, int options = NO_OPTIONS) const;
+  V8_DEPRECATE_SOON("Use Isolate* version",
+                    int WriteOneByte(uint8_t* buffer, int start = 0,
+                                     int length = -1, int options = NO_OPTIONS)
+                        const);
   // UTF-8 encoded characters.
-  int WriteUtf8(char* buffer,
-                int length = -1,
-                int* nchars_ref = NULL,
-                int options = NO_OPTIONS) const;
+  int WriteUtf8(Isolate* isolate, char* buffer, int length = -1,
+                int* nchars_ref = NULL, int options = NO_OPTIONS) const;
+  V8_DEPRECATE_SOON("Use Isolate* version",
+                    int WriteUtf8(char* buffer, int length = -1,
+                                  int* nchars_ref = NULL,
+                                  int options = NO_OPTIONS) const);
 
   /**
    * A zero length string.
@@ -2921,7 +2935,11 @@ class V8_EXPORT String : public Name {
    * Creates a new string by concatenating the left and the right strings
    * passed in as parameters.
    */
-  static Local<String> Concat(Local<String> left, Local<String> right);
+  static Local<String> Concat(Isolate* isolate, Local<String> left,
+                              Local<String> right);
+  static V8_DEPRECATE_SOON("Use Isolate* version",
+                           Local<String> Concat(Local<String> left,
+                                                Local<String> right));
 
   /**
    * Creates a new external string using the data defined in the given
@@ -5220,7 +5238,9 @@ class V8_EXPORT BooleanObject : public Object {
  */
 class V8_EXPORT StringObject : public Object {
  public:
-  static Local<Value> New(Local<String> value);
+  static Local<Value> New(Isolate* isolate, Local<String> value);
+  static V8_DEPRECATE_SOON("Use Isolate* version",
+                           Local<Value> New(Local<String> value));
 
   Local<String> ValueOf() const;
 
@@ -6968,6 +6988,8 @@ struct JitCodeEvent {
     // New location of instructions. Only valid for CODE_MOVED.
     void* new_code_start;
   };
+
+  Isolate* isolate;
 };
 
 /**
@@ -10090,7 +10112,6 @@ AccessorSignature* AccessorSignature::Cast(Data* data) {
 Local<Value> Object::GetInternalField(int index) {
 #ifndef V8_ENABLE_CHECKS
   typedef internal::Object O;
-  typedef internal::HeapObject HO;
   typedef internal::Internals I;
   O* obj = *reinterpret_cast<O**>(this);
   // Fast path: If the object is a plain JSObject, which is the common case, we
@@ -10101,7 +10122,8 @@ Local<Value> Object::GetInternalField(int index) {
       instance_type == I::kJSSpecialApiObjectType) {
     int offset = I::kJSObjectHeaderSize + (internal::kApiPointerSize * index);
     O* value = I::ReadField<O*>(obj, offset);
-    O** result = HandleScope::CreateHandle(reinterpret_cast<HO*>(obj), value);
+    O** result = HandleScope::CreateHandle(
+        reinterpret_cast<internal::NeverReadOnlySpaceObject*>(obj), value);
     return Local<Value>(reinterpret_cast<Value*>(result));
   }
 #endif
@@ -10741,9 +10763,8 @@ int64_t Isolate::AdjustAmountOfExternalAllocatedMemory(
 Local<Value> Context::GetEmbedderData(int index) {
 #ifndef V8_ENABLE_CHECKS
   typedef internal::Object O;
-  typedef internal::HeapObject HO;
   typedef internal::Internals I;
-  HO* context = *reinterpret_cast<HO**>(this);
+  auto* context = *reinterpret_cast<internal::NeverReadOnlySpaceObject**>(this);
   O** result =
       HandleScope::CreateHandle(context, I::ReadEmbedderData<O*>(this, index));
   return Local<Value>(reinterpret_cast<Value*>(result));
diff --git a/deps/v8/infra/mb/mb_config.pyl b/deps/v8/infra/mb/mb_config.pyl
index 80874bf14810cb..0492cf31a5f9b3 100644
--- a/deps/v8/infra/mb/mb_config.pyl
+++ b/deps/v8/infra/mb/mb_config.pyl
@@ -27,18 +27,27 @@
       'mips64el.debug': 'default_debug_mips64el',
       'mips64el.optdebug': 'default_optdebug_mips64el',
       'mips64el.release': 'default_release_mips64el',
+      'ppc.debug': 'default_debug_ppc',
+      'ppc.optdebug': 'default_optdebug_ppc',
+      'ppc.release': 'default_release_ppc',
       'ppc.debug.sim': 'default_debug_ppc_sim',
       'ppc.optdebug.sim': 'default_optdebug_ppc_sim',
       'ppc.release.sim': 'default_release_ppc_sim',
       'ppc64.debug': 'default_debug_ppc64',
-      'ppc64.debug.sim': 'default_debug_ppc64_sim',
       'ppc64.optdebug': 'default_optdebug_ppc64',
-      'ppc64.optdebug.sim': 'default_optdebug_ppc64_sim',
       'ppc64.release': 'default_release_ppc64',
+      'ppc64.debug.sim': 'default_debug_ppc64_sim',
+      'ppc64.optdebug.sim': 'default_optdebug_ppc64_sim',
       'ppc64.release.sim': 'default_release_ppc64_sim',
+      's390.debug': 'default_debug_s390',
+      's390.optdebug': 'default_optdebug_s390',
+      's390.release': 'default_release_s390',
       's390.debug.sim': 'default_debug_s390_sim',
       's390.optdebug.sim': 'default_optdebug_s390_sim',
       's390.release.sim': 'default_release_s390_sim',
+      's390x.debug': 'default_debug_s390x',
+      's390x.optdebug': 'default_optdebug_s390x',
+      's390x.release': 'default_release_s390x',
       's390x.debug.sim': 'default_debug_s390x_sim',
       's390x.optdebug.sim': 'default_optdebug_s390x_sim',
       's390x.release.sim': 'default_release_s390x_sim',
@@ -256,7 +265,6 @@
 
   # To ease readability, config values are ordered by:
   # release/debug, arch type, other values alphabetically.
-  # TODO: create separate native configurations for ppc,s390[x].
   'configs': {
     # Developer default configs.
     'default_debug_arm': [
@@ -289,6 +297,12 @@
       'debug', 'simulate_mips64el', 'v8_enable_slow_dchecks'],
     'default_release_mips64el': [
       'release', 'simulate_mips64el'],
+    'default_debug_ppc': [
+      'debug', 'ppc', 'v8_enable_slow_dchecks', 'v8_full_debug'],
+    'default_optdebug_ppc': [
+      'debug', 'ppc', 'v8_enable_slow_dchecks'],
+    'default_release_ppc': [
+      'release', 'ppc'],
     'default_debug_ppc_sim': [
       'debug', 'simulate_ppc', 'v8_enable_slow_dchecks', 'v8_full_debug'],
     'default_optdebug_ppc_sim': [
@@ -297,22 +311,34 @@
       'release', 'simulate_ppc'],
     'default_debug_ppc64': [
       'debug', 'ppc64', 'gcc', 'v8_enable_slow_dchecks', 'v8_full_debug'],
-    'default_debug_ppc64_sim': [
-      'debug', 'simulate_ppc64', 'v8_enable_slow_dchecks', 'v8_full_debug'],
     'default_optdebug_ppc64': [
       'debug', 'ppc64', 'gcc', 'v8_enable_slow_dchecks'],
-    'default_optdebug_ppc64_sim': [
-      'debug', 'simulate_ppc64', 'v8_enable_slow_dchecks'],
     'default_release_ppc64': [
       'release', 'ppc64', 'gcc'],
+    'default_debug_ppc64_sim': [
+      'debug', 'simulate_ppc64', 'v8_enable_slow_dchecks', 'v8_full_debug'],
+    'default_optdebug_ppc64_sim': [
+      'debug', 'simulate_ppc64', 'v8_enable_slow_dchecks'],
     'default_release_ppc64_sim': [
       'release', 'simulate_ppc64'],
+    'default_debug_s390': [
+      'debug', 's390', 'v8_enable_slow_dchecks', 'v8_full_debug'],
+    'default_optdebug_s390': [
+      'debug', 's390', 'v8_enable_slow_dchecks'],
+    'default_release_s390': [
+      'release', 's390'],
     'default_debug_s390_sim': [
       'debug', 'simulate_s390', 'v8_enable_slow_dchecks', 'v8_full_debug'],
     'default_optdebug_s390_sim': [
       'debug', 'simulate_s390', 'v8_enable_slow_dchecks'],
     'default_release_s390_sim': [
       'release', 'simulate_s390'],
+    'default_debug_s390x': [
+      'debug', 's390x', 'v8_enable_slow_dchecks', 'v8_full_debug'],
+    'default_optdebug_s390x': [
+      'debug', 's390x', 'v8_enable_slow_dchecks'],
+    'default_release_s390x': [
+      'release', 's390x'],
     'default_debug_s390x_sim': [
       'debug', 'simulate_s390x', 'v8_enable_slow_dchecks', 'v8_full_debug'],
     'default_optdebug_s390x_sim': [
@@ -836,6 +862,22 @@
       'gn_args': 'v8_enable_verify_csa=true',
     },
 
+    's390': {
+      'gn_args': 'target_cpu="s390x" v8_target_cpu="s390"',
+    },
+
+    's390x': {
+      'gn_args': 'target_cpu="s390x" v8_target_cpu="s390x"',
+    },
+
+    'ppc': {
+      'gn_args': 'target_cpu="ppc"',
+    },
+
+    'ppc64': {
+      'gn_args': 'target_cpu="ppc64" use_custom_libcxx=false',
+    },
+
     'x64': {
       'gn_args': 'target_cpu="x64"',
     },
@@ -844,8 +886,5 @@
       'gn_args': 'target_cpu="x86"',
     },
 
-    'ppc64': {
-      'gn_args': 'target_cpu="ppc64"',
-    },
   },
 }
diff --git a/deps/v8/src/accessors.cc b/deps/v8/src/accessors.cc
index 9057865ac3b564..ae59ec3356e87f 100644
--- a/deps/v8/src/accessors.cc
+++ b/deps/v8/src/accessors.cc
@@ -792,9 +792,9 @@ MaybeHandle<JSReceiver> ClearInternalStackTrace(Isolate* isolate,
                                                 Handle<JSObject> error) {
   RETURN_ON_EXCEPTION(
       isolate,
-      JSReceiver::SetProperty(error, isolate->factory()->stack_trace_symbol(),
-                              isolate->factory()->undefined_value(),
-                              LanguageMode::kStrict),
+      JSReceiver::SetProperty(
+          isolate, error, isolate->factory()->stack_trace_symbol(),
+          isolate->factory()->undefined_value(), LanguageMode::kStrict),
       JSReceiver);
   return error;
 }
diff --git a/deps/v8/src/api-natives.cc b/deps/v8/src/api-natives.cc
index 6c01d6d9261038..11dd4d67d53d44 100644
--- a/deps/v8/src/api-natives.cc
+++ b/deps/v8/src/api-natives.cc
@@ -208,7 +208,8 @@ MaybeHandle<JSObject> ConfigureInstance(Isolate* isolate, Handle<JSObject> obj,
       Object* maybe_properties = temp->property_accessors();
       if (!maybe_properties->IsUndefined(isolate)) {
         valid_descriptors = AccessorInfo::AppendUnique(
-            handle(maybe_properties, isolate), array, valid_descriptors);
+            isolate, handle(maybe_properties, isolate), array,
+            valid_descriptors);
       }
     }
 
@@ -290,7 +291,7 @@ MaybeHandle<JSObject> ProbeInstantiationsCache(Isolate* isolate,
               TemplateInfo::kSlowTemplateInstantiationsCacheSize)) {
     Handle<SimpleNumberDictionary> slow_cache =
         isolate->slow_template_instantiations_cache();
-    int entry = slow_cache->FindEntry(serial_number);
+    int entry = slow_cache->FindEntry(isolate, serial_number);
     if (entry == SimpleNumberDictionary::kNotFound) {
       return MaybeHandle<JSObject>();
     }
@@ -318,7 +319,8 @@ void CacheTemplateInstantiation(Isolate* isolate, int serial_number,
               TemplateInfo::kSlowTemplateInstantiationsCacheSize)) {
     Handle<SimpleNumberDictionary> cache =
         isolate->slow_template_instantiations_cache();
-    auto new_cache = SimpleNumberDictionary::Set(cache, serial_number, object);
+    auto new_cache =
+        SimpleNumberDictionary::Set(isolate, cache, serial_number, object);
     if (*new_cache != *cache) {
       isolate->native_context()->set_slow_template_instantiations_cache(
           *new_cache);
@@ -339,7 +341,7 @@ void UncacheTemplateInstantiation(Isolate* isolate, int serial_number,
               TemplateInfo::kSlowTemplateInstantiationsCacheSize)) {
     Handle<SimpleNumberDictionary> cache =
         isolate->slow_template_instantiations_cache();
-    int entry = cache->FindEntry(serial_number);
+    int entry = cache->FindEntry(isolate, serial_number);
     DCHECK_NE(SimpleNumberDictionary::kNotFound, entry);
     cache = SimpleNumberDictionary::DeleteEntry(isolate, cache, entry);
     isolate->native_context()->set_slow_template_instantiations_cache(*cache);
diff --git a/deps/v8/src/api.cc b/deps/v8/src/api.cc
index 0cf34bb394f380..f20503e484a541 100644
--- a/deps/v8/src/api.cc
+++ b/deps/v8/src/api.cc
@@ -207,11 +207,28 @@ namespace v8 {
 
 #define RETURN_ESCAPED(value) return handle_scope.Escape(value);
 
-
 namespace {
 
-Local<Context> ContextFromHeapObject(i::Handle<i::Object> obj) {
-  return reinterpret_cast<v8::Isolate*>(i::HeapObject::cast(*obj)->GetIsolate())
+Local<Context> ContextFromNeverReadOnlySpaceObject(
+    i::Handle<i::NeverReadOnlySpaceObject> obj) {
+  return reinterpret_cast<v8::Isolate*>(obj->GetIsolate())->GetCurrentContext();
+}
+
+// TODO(delphick): Remove this completely when the deprecated functions that use
+// it are removed.
+// DO NOT USE THIS IN NEW CODE!
+i::Isolate* UnsafeIsolateFromHeapObject(i::Handle<i::HeapObject> obj) {
+  i::MemoryChunk* chunk = i::MemoryChunk::FromHeapObject(*obj);
+  return chunk->heap()->isolate();
+}
+
+// TODO(delphick): Remove this completely when the deprecated functions that use
+// it are removed.
+// DO NOT USE THIS IN NEW CODE!
+Local<Context> UnsafeContextFromHeapObject(i::Handle<i::Object> obj) {
+  i::MemoryChunk* chunk =
+      i::MemoryChunk::FromHeapObject(i::HeapObject::cast(*obj));
+  return reinterpret_cast<Isolate*>(chunk->heap()->isolate())
       ->GetCurrentContext();
 }
 
@@ -645,7 +662,7 @@ size_t SnapshotCreator::AddData(i::Object* object) {
         i::ArrayList::cast(isolate->heap()->serialized_objects()), isolate);
   }
   size_t index = static_cast<size_t>(list->Length());
-  list = i::ArrayList::Add(list, obj);
+  list = i::ArrayList::Add(isolate, list, obj);
   isolate->heap()->SetSerializedObjects(*list);
   return index;
 }
@@ -665,7 +682,7 @@ size_t SnapshotCreator::AddData(Local<Context> context, i::Object* object) {
         i::ArrayList::cast(ctx->serialized_objects()), isolate);
   }
   size_t index = static_cast<size_t>(list->Length());
-  list = i::ArrayList::Add(list, obj);
+  list = i::ArrayList::Add(isolate, list, obj);
   ctx->set_serialized_objects(*list);
   return index;
 }
@@ -679,7 +696,7 @@ void ConvertSerializedObjectsToFixedArray(Local<Context> context) {
   } else {
     i::Handle<i::ArrayList> list(i::ArrayList::cast(ctx->serialized_objects()),
                                  isolate);
-    i::Handle<i::FixedArray> elements = i::ArrayList::Elements(list);
+    i::Handle<i::FixedArray> elements = i::ArrayList::Elements(isolate, list);
     ctx->set_serialized_objects(*elements);
   }
 }
@@ -691,7 +708,7 @@ void ConvertSerializedObjectsToFixedArray(i::Isolate* isolate) {
   } else {
     i::Handle<i::ArrayList> list(
         i::ArrayList::cast(isolate->heap()->serialized_objects()), isolate);
-    i::Handle<i::FixedArray> elements = i::ArrayList::Elements(list);
+    i::Handle<i::FixedArray> elements = i::ArrayList::Elements(isolate, list);
     isolate->heap()->SetSerializedObjects(*elements);
   }
 }
@@ -738,7 +755,10 @@ StartupData SnapshotCreator::CreateBlob(
   // context even after we have disposed of the context.
   isolate->heap()->CollectAllAvailableGarbage(
       i::GarbageCollectionReason::kSnapshotCreator);
-  isolate->heap()->CompactFixedArraysOfWeakCells();
+  {
+    i::HandleScope scope(isolate);
+    isolate->heap()->CompactFixedArraysOfWeakCells();
+  }
 
   isolate->heap()->read_only_space()->ClearStringPaddingIfNeeded();
 
@@ -1059,11 +1079,6 @@ i::Object** V8::GlobalizeReference(i::Isolate* isolate, i::Object** obj) {
 
 i::Object** V8::CopyPersistent(i::Object** obj) {
   i::Handle<i::Object> result = i::GlobalHandles::CopyGlobal(obj);
-#ifdef VERIFY_HEAP
-  if (i::FLAG_verify_heap) {
-    (*obj)->ObjectVerify();
-  }
-#endif  // VERIFY_HEAP
   return result.location();
 }
 
@@ -1186,11 +1201,10 @@ i::Object** HandleScope::CreateHandle(i::Isolate* isolate, i::Object* value) {
   return i::HandleScope::CreateHandle(isolate, value);
 }
 
-
-i::Object** HandleScope::CreateHandle(i::HeapObject* heap_object,
-                                      i::Object* value) {
-  DCHECK(heap_object->IsHeapObject());
-  return i::HandleScope::CreateHandle(heap_object->GetIsolate(), value);
+i::Object** HandleScope::CreateHandle(
+    i::NeverReadOnlySpaceObject* writable_object, i::Object* value) {
+  DCHECK(reinterpret_cast<i::HeapObject*>(writable_object)->IsHeapObject());
+  return i::HandleScope::CreateHandle(writable_object->GetIsolate(), value);
 }
 
 
@@ -1332,7 +1346,9 @@ v8::Local<v8::Value> Context::SlowGetEmbedderData(int index) {
   const char* location = "v8::Context::GetEmbedderData()";
   i::Handle<i::FixedArray> data = EmbedderDataFor(this, index, false, location);
   if (data.is_null()) return Local<Value>();
-  i::Handle<i::Object> result(data->get(index), data->GetIsolate());
+  i::Handle<i::Object> result(
+      data->get(index),
+      reinterpret_cast<i::Isolate*>(Utils::OpenHandle(this)->GetIsolate()));
   return Utils::ToLocal(result);
 }
 
@@ -2131,11 +2147,9 @@ ScriptCompiler::StreamedSource::GetCachedData() const {
 
 
 Local<Script> UnboundScript::BindToCurrentContext() {
-  i::Handle<i::HeapObject> obj =
-      i::Handle<i::HeapObject>::cast(Utils::OpenHandle(this));
-  i::Isolate* isolate = obj->GetIsolate();
-  i::Handle<i::SharedFunctionInfo> function_info(
-      i::SharedFunctionInfo::cast(*obj), isolate);
+  auto function_info =
+      i::Handle<i::SharedFunctionInfo>::cast(Utils::OpenHandle(this));
+  i::Isolate* isolate = function_info->GetIsolate();
   i::Handle<i::JSFunction> function =
       isolate->factory()->NewFunctionFromSharedFunctionInfo(
           function_info, isolate->native_context());
@@ -2144,13 +2158,11 @@ Local<Script> UnboundScript::BindToCurrentContext() {
 
 
 int UnboundScript::GetId() {
-  i::Handle<i::HeapObject> obj =
-      i::Handle<i::HeapObject>::cast(Utils::OpenHandle(this));
-  i::Isolate* isolate = obj->GetIsolate();
+  auto function_info =
+      i::Handle<i::SharedFunctionInfo>::cast(Utils::OpenHandle(this));
+  i::Isolate* isolate = function_info->GetIsolate();
   LOG_API(isolate, UnboundScript, GetId);
   i::HandleScope scope(isolate);
-  i::Handle<i::SharedFunctionInfo> function_info(
-      i::SharedFunctionInfo::cast(*obj), isolate);
   i::Handle<i::Script> script(i::Script::cast(function_info->script()),
                               isolate);
   return script->id();
@@ -2238,7 +2250,7 @@ Local<Value> Script::Run() {
   // If execution is terminating, Compile(..)->Run() requires this
   // check.
   if (self.is_null()) return Local<Value>();
-  auto context = ContextFromHeapObject(self);
+  auto context = ContextFromNeverReadOnlySpaceObject(self);
   RETURN_TO_LOCAL_UNCHECKED(Run(context), Value);
 }
 
@@ -2277,14 +2289,13 @@ Local<PrimitiveArray> PrimitiveArray::New(Isolate* v8_isolate, int length) {
 
 int PrimitiveArray::Length() const {
   i::Handle<i::FixedArray> array = Utils::OpenHandle(this);
-  i::Isolate* isolate = array->GetIsolate();
-  ENTER_V8_NO_SCRIPT_NO_EXCEPTION(isolate);
   return array->length();
 }
 
-void PrimitiveArray::Set(int index, Local<Primitive> item) {
+void PrimitiveArray::Set(Isolate* v8_isolate, int index,
+                         Local<Primitive> item) {
+  i::Isolate* isolate = reinterpret_cast<i::Isolate*>(v8_isolate);
   i::Handle<i::FixedArray> array = Utils::OpenHandle(this);
-  i::Isolate* isolate = array->GetIsolate();
   ENTER_V8_NO_SCRIPT_NO_EXCEPTION(isolate);
   Utils::ApiCheck(index >= 0 && index < array->length(),
                   "v8::PrimitiveArray::Set",
@@ -2294,9 +2305,15 @@ void PrimitiveArray::Set(int index, Local<Primitive> item) {
   array->set(index, *i_item);
 }
 
-Local<Primitive> PrimitiveArray::Get(int index) {
+void PrimitiveArray::Set(int index, Local<Primitive> item) {
+  i::Handle<i::FixedArray> array = Utils::OpenHandle(this);
+  i::Isolate* isolate = UnsafeIsolateFromHeapObject(array);
+  Set(reinterpret_cast<Isolate*>(isolate), index, item);
+}
+
+Local<Primitive> PrimitiveArray::Get(Isolate* v8_isolate, int index) {
+  i::Isolate* isolate = reinterpret_cast<i::Isolate*>(v8_isolate);
   i::Handle<i::FixedArray> array = Utils::OpenHandle(this);
-  i::Isolate* isolate = array->GetIsolate();
   ENTER_V8_NO_SCRIPT_NO_EXCEPTION(isolate);
   Utils::ApiCheck(index >= 0 && index < array->length(),
                   "v8::PrimitiveArray::Get",
@@ -2306,6 +2323,12 @@ Local<Primitive> PrimitiveArray::Get(int index) {
   return ToApiHandle<Primitive>(i_item);
 }
 
+Local<Primitive> PrimitiveArray::Get(int index) {
+  i::Handle<i::FixedArray> array = Utils::OpenHandle(this);
+  i::Isolate* isolate = UnsafeIsolateFromHeapObject(array);
+  return Get(reinterpret_cast<Isolate*>(isolate), index);
+}
+
 Module::Status Module::GetStatus() const {
   i::Handle<i::Module> self = Utils::OpenHandle(this);
   switch (self->status()) {
@@ -2484,8 +2507,8 @@ MaybeLocal<UnboundScript> ScriptCompiler::CompileUnboundInternal(
       source->host_defined_options);
   i::MaybeHandle<i::SharedFunctionInfo> maybe_function_info =
       i::Compiler::GetSharedFunctionInfoForScript(
-          str, script_details, source->resource_options, nullptr, script_data,
-          options, no_cache_reason, i::NOT_NATIVES_CODE);
+          isolate, str, script_details, source->resource_options, nullptr,
+          script_data, options, no_cache_reason, i::NOT_NATIVES_CODE);
   if (options == kConsumeCodeCache) {
     source->cached_data->rejected = script_data->rejected();
   }
@@ -2693,7 +2716,7 @@ MaybeLocal<Script> ScriptCompiler::Compile(Local<Context> context,
 
   i::MaybeHandle<i::SharedFunctionInfo> maybe_function_info =
       i::Compiler::GetSharedFunctionInfoForStreamedScript(
-          str, script_details, origin.Options(), streaming_data);
+          isolate, str, script_details, origin.Options(), streaming_data);
 
   i::Handle<i::SharedFunctionInfo> result;
   has_pending_exception = !maybe_function_info.ToHandle(&result);
@@ -2767,7 +2790,7 @@ MaybeLocal<Script> Script::Compile(Local<Context> context, Local<String> source,
 Local<Script> Script::Compile(v8::Local<String> source,
                               v8::ScriptOrigin* origin) {
   auto str = Utils::OpenHandle(*source);
-  auto context = ContextFromHeapObject(str);
+  auto context = UnsafeContextFromHeapObject(str);
   RETURN_TO_LOCAL_UNCHECKED(Compile(context, source, origin), Script);
 }
 
@@ -2775,7 +2798,7 @@ Local<Script> Script::Compile(v8::Local<String> source,
 Local<Script> Script::Compile(v8::Local<String> source,
                               v8::Local<String> file_name) {
   auto str = Utils::OpenHandle(*source);
-  auto context = ContextFromHeapObject(str);
+  auto context = UnsafeContextFromHeapObject(str);
   ScriptOrigin origin(file_name);
   return Compile(context, source, &origin).FromMaybe(Local<Script>());
 }
@@ -2983,7 +3006,7 @@ Maybe<int> Message::GetLineNumber(Local<Context> context) const {
 
 
 int Message::GetLineNumber() const {
-  auto context = ContextFromHeapObject(Utils::OpenHandle(this));
+  auto context = ContextFromNeverReadOnlySpaceObject(Utils::OpenHandle(this));
   return GetLineNumber(context).FromMaybe(0);
 }
 
@@ -3062,7 +3085,7 @@ MaybeLocal<String> Message::GetSourceLine(Local<Context> context) const {
 
 
 Local<String> Message::GetSourceLine() const {
-  auto context = ContextFromHeapObject(Utils::OpenHandle(this));
+  auto context = ContextFromNeverReadOnlySpaceObject(Utils::OpenHandle(this));
   RETURN_TO_LOCAL_UNCHECKED(GetSourceLine(context), String)
 }
 
@@ -3076,15 +3099,20 @@ void Message::PrintCurrentStackTrace(Isolate* isolate, FILE* out) {
 
 // --- S t a c k T r a c e ---
 
-Local<StackFrame> StackTrace::GetFrame(uint32_t index) const {
-  i::Isolate* isolate = Utils::OpenHandle(this)->GetIsolate();
+Local<StackFrame> StackTrace::GetFrame(Isolate* v8_isolate,
+                                       uint32_t index) const {
+  i::Isolate* isolate = reinterpret_cast<i::Isolate*>(v8_isolate);
   ENTER_V8_NO_SCRIPT_NO_EXCEPTION(isolate);
-  EscapableHandleScope scope(reinterpret_cast<Isolate*>(isolate));
+  EscapableHandleScope scope(v8_isolate);
   auto obj = handle(Utils::OpenHandle(this)->get(index), isolate);
   auto info = i::Handle<i::StackFrameInfo>::cast(obj);
   return scope.Escape(Utils::StackFrameToLocal(info));
 }
 
+Local<StackFrame> StackTrace::GetFrame(uint32_t index) const {
+  i::Isolate* isolate = UnsafeIsolateFromHeapObject(Utils::OpenHandle(this));
+  return GetFrame(reinterpret_cast<Isolate*>(isolate), index);
+}
 
 int StackTrace::GetFrameCount() const {
   return Utils::OpenHandle(this)->length();
@@ -3609,12 +3637,16 @@ bool Value::IsBoolean() const {
   return Utils::OpenHandle(this)->IsBoolean();
 }
 
-
 bool Value::IsExternal() const {
   i::Handle<i::Object> obj = Utils::OpenHandle(this);
   if (!obj->IsHeapObject()) return false;
   i::Handle<i::HeapObject> heap_obj = i::Handle<i::HeapObject>::cast(obj);
-  return heap_obj->IsExternal(heap_obj->GetIsolate());
+  // Check the instance type is JS_OBJECT (instance type of Externals) before
+  // attempting to get the Isolate since that guarantees the object is writable
+  // and GetIsolate will work.
+  if (heap_obj->map()->instance_type() != i::JS_OBJECT_TYPE) return false;
+  i::Isolate* isolate = i::JSObject::cast(*heap_obj)->GetIsolate();
+  return heap_obj->IsExternal(isolate);
 }
 
 
@@ -3761,7 +3793,8 @@ MaybeLocal<Number> Value::ToNumber(Local<Context> context) const {
   if (obj->IsNumber()) return ToApiHandle<Number>(obj);
   PREPARE_FOR_EXECUTION(context, Object, ToNumber, Number);
   Local<Number> result;
-  has_pending_exception = !ToLocal<Number>(i::Object::ToNumber(obj), &result);
+  has_pending_exception =
+      !ToLocal<Number>(i::Object::ToNumber(isolate, obj), &result);
   RETURN_ON_FAILED_EXECUTION(Number);
   RETURN_ESCAPED(result);
 }
@@ -4069,7 +4102,8 @@ bool Value::BooleanValue() const {
   auto obj = Utils::OpenHandle(this);
   if (obj->IsSmi()) return *obj != i::Smi::kZero;
   DCHECK(obj->IsHeapObject());
-  i::Isolate* isolate = i::Handle<i::HeapObject>::cast(obj)->GetIsolate();
+  i::Isolate* isolate =
+      UnsafeIsolateFromHeapObject(i::Handle<i::HeapObject>::cast(obj));
   return obj->BooleanValue(isolate);
 }
 
@@ -4081,7 +4115,7 @@ Maybe<double> Value::NumberValue(Local<Context> context) const {
   ENTER_V8(isolate, context, Value, NumberValue, Nothing<double>(),
            i::HandleScope);
   i::Handle<i::Object> num;
-  has_pending_exception = !i::Object::ToNumber(obj).ToHandle(&num);
+  has_pending_exception = !i::Object::ToNumber(isolate, obj).ToHandle(&num);
   RETURN_ON_FAILED_EXECUTION_PRIMITIVE(double);
   return Just(num->Number());
 }
@@ -4090,7 +4124,7 @@ Maybe<double> Value::NumberValue(Local<Context> context) const {
 double Value::NumberValue() const {
   auto obj = Utils::OpenHandle(this);
   if (obj->IsNumber()) return obj->Number();
-  return NumberValue(ContextFromHeapObject(obj))
+  return NumberValue(UnsafeContextFromHeapObject(obj))
       .FromMaybe(std::numeric_limits<double>::quiet_NaN());
 }
 
@@ -4119,7 +4153,7 @@ int64_t Value::IntegerValue() const {
       return static_cast<int64_t>(obj->Number());
     }
   }
-  return IntegerValue(ContextFromHeapObject(obj)).FromMaybe(0);
+  return IntegerValue(UnsafeContextFromHeapObject(obj)).FromMaybe(0);
 }
 
 
@@ -4140,7 +4174,7 @@ Maybe<int32_t> Value::Int32Value(Local<Context> context) const {
 int32_t Value::Int32Value() const {
   auto obj = Utils::OpenHandle(this);
   if (obj->IsNumber()) return NumberToInt32(*obj);
-  return Int32Value(ContextFromHeapObject(obj)).FromMaybe(0);
+  return Int32Value(UnsafeContextFromHeapObject(obj)).FromMaybe(0);
 }
 
 
@@ -4161,7 +4195,7 @@ Maybe<uint32_t> Value::Uint32Value(Local<Context> context) const {
 uint32_t Value::Uint32Value() const {
   auto obj = Utils::OpenHandle(this);
   if (obj->IsNumber()) return NumberToUint32(*obj);
-  return Uint32Value(ContextFromHeapObject(obj)).FromMaybe(0);
+  return Uint32Value(UnsafeContextFromHeapObject(obj)).FromMaybe(0);
 }
 
 
@@ -4209,7 +4243,7 @@ bool Value::Equals(Local<Value> that) const {
     return *self == *other;
   }
   auto heap_object = self->IsSmi() ? other : self;
-  auto context = ContextFromHeapObject(heap_object);
+  auto context = UnsafeContextFromHeapObject(heap_object);
   return Equals(context, that).FromMaybe(false);
 }
 
@@ -4265,7 +4299,7 @@ Maybe<bool> v8::Object::Set(v8::Local<v8::Context> context,
 
 
 bool v8::Object::Set(v8::Local<Value> key, v8::Local<Value> value) {
-  auto context = ContextFromHeapObject(Utils::OpenHandle(this));
+  auto context = ContextFromNeverReadOnlySpaceObject(Utils::OpenHandle(this));
   return Set(context, key, value).FromMaybe(false);
 }
 
@@ -4285,7 +4319,7 @@ Maybe<bool> v8::Object::Set(v8::Local<v8::Context> context, uint32_t index,
 
 
 bool v8::Object::Set(uint32_t index, v8::Local<Value> value) {
-  auto context = ContextFromHeapObject(Utils::OpenHandle(this));
+  auto context = ContextFromNeverReadOnlySpaceObject(Utils::OpenHandle(this));
   return Set(context, index, value).FromMaybe(false);
 }
 
@@ -4512,7 +4546,7 @@ MaybeLocal<Value> v8::Object::Get(Local<v8::Context> context,
 
 
 Local<Value> v8::Object::Get(v8::Local<Value> key) {
-  auto context = ContextFromHeapObject(Utils::OpenHandle(this));
+  auto context = ContextFromNeverReadOnlySpaceObject(Utils::OpenHandle(this));
   RETURN_TO_LOCAL_UNCHECKED(Get(context, key), Value);
 }
 
@@ -4529,7 +4563,7 @@ MaybeLocal<Value> v8::Object::Get(Local<Context> context, uint32_t index) {
 
 
 Local<Value> v8::Object::Get(uint32_t index) {
-  auto context = ContextFromHeapObject(Utils::OpenHandle(this));
+  auto context = ContextFromNeverReadOnlySpaceObject(Utils::OpenHandle(this));
   RETURN_TO_LOCAL_UNCHECKED(Get(context, index), Value);
 }
 
@@ -4653,7 +4687,7 @@ MaybeLocal<Array> v8::Object::GetPropertyNames(
 
 
 Local<Array> v8::Object::GetPropertyNames() {
-  auto context = ContextFromHeapObject(Utils::OpenHandle(this));
+  auto context = ContextFromNeverReadOnlySpaceObject(Utils::OpenHandle(this));
   RETURN_TO_LOCAL_UNCHECKED(GetPropertyNames(context), Array);
 }
 
@@ -4663,7 +4697,7 @@ MaybeLocal<Array> v8::Object::GetOwnPropertyNames(Local<Context> context) {
 }
 
 Local<Array> v8::Object::GetOwnPropertyNames() {
-  auto context = ContextFromHeapObject(Utils::OpenHandle(this));
+  auto context = ContextFromNeverReadOnlySpaceObject(Utils::OpenHandle(this));
   RETURN_TO_LOCAL_UNCHECKED(GetOwnPropertyNames(context), Array);
 }
 
@@ -4733,7 +4767,7 @@ Maybe<bool> v8::Object::Delete(Local<Context> context, Local<Value> key) {
 }
 
 bool v8::Object::Delete(v8::Local<Value> key) {
-  auto context = ContextFromHeapObject(Utils::OpenHandle(this));
+  auto context = ContextFromNeverReadOnlySpaceObject(Utils::OpenHandle(this));
   return Delete(context, key).FromMaybe(false);
 }
 
@@ -4777,7 +4811,7 @@ Maybe<bool> v8::Object::Has(Local<Context> context, Local<Value> key) {
 
 
 bool v8::Object::Has(v8::Local<Value> key) {
-  auto context = ContextFromHeapObject(Utils::OpenHandle(this));
+  auto context = ContextFromNeverReadOnlySpaceObject(Utils::OpenHandle(this));
   return Has(context, key).FromMaybe(false);
 }
 
@@ -4936,7 +4970,7 @@ Maybe<bool> v8::Object::HasRealNamedProperty(Local<Context> context,
 
 
 bool v8::Object::HasRealNamedProperty(Local<String> key) {
-  auto context = ContextFromHeapObject(Utils::OpenHandle(this));
+  auto context = ContextFromNeverReadOnlySpaceObject(Utils::OpenHandle(this));
   return HasRealNamedProperty(context, key).FromMaybe(false);
 }
 
@@ -4957,7 +4991,7 @@ Maybe<bool> v8::Object::HasRealIndexedProperty(Local<Context> context,
 
 
 bool v8::Object::HasRealIndexedProperty(uint32_t index) {
-  auto context = ContextFromHeapObject(Utils::OpenHandle(this));
+  auto context = ContextFromNeverReadOnlySpaceObject(Utils::OpenHandle(this));
   return HasRealIndexedProperty(context, index).FromMaybe(false);
 }
 
@@ -4979,7 +5013,7 @@ Maybe<bool> v8::Object::HasRealNamedCallbackProperty(Local<Context> context,
 
 
 bool v8::Object::HasRealNamedCallbackProperty(Local<String> key) {
-  auto context = ContextFromHeapObject(Utils::OpenHandle(this));
+  auto context = ContextFromNeverReadOnlySpaceObject(Utils::OpenHandle(this));
   return HasRealNamedCallbackProperty(context, key).FromMaybe(false);
 }
 
@@ -5255,7 +5289,7 @@ MaybeLocal<v8::Value> Function::Call(Local<Context> context,
 
 Local<v8::Value> Function::Call(v8::Local<v8::Value> recv, int argc,
                                 v8::Local<v8::Value> argv[]) {
-  auto context = ContextFromHeapObject(Utils::OpenHandle(this));
+  auto context = ContextFromNeverReadOnlySpaceObject(Utils::OpenHandle(this));
   RETURN_TO_LOCAL_UNCHECKED(Call(context, recv, argc, argv), Value);
 }
 
@@ -5539,10 +5573,14 @@ bool String::ContainsOnlyOneByte() const {
   return helper.Check(*str);
 }
 
-// TODO(v8:7786): Deprecate this function and pass the isolate in instead.
 int String::Utf8Length() const {
+  i::Isolate* isolate = UnsafeIsolateFromHeapObject(Utils::OpenHandle(this));
+  return Utf8Length(reinterpret_cast<Isolate*>(isolate));
+}
+
+int String::Utf8Length(Isolate* isolate) const {
   i::Handle<i::String> str = Utils::OpenHandle(this);
-  str = i::String::Flatten(str->GetIsolate(), str);
+  str = i::String::Flatten(reinterpret_cast<i::Isolate*>(isolate), str);
   int length = str->length();
   if (length == 0) return 0;
   i::DisallowHeapAllocation no_gc;
@@ -5564,7 +5602,6 @@ int String::Utf8Length() const {
   return utf8_length;
 }
 
-
 class Utf8WriterVisitor {
  public:
   Utf8WriterVisitor(
@@ -5764,13 +5801,10 @@ static bool RecursivelySerializeToUtf8(i::String* current,
   return true;
 }
 
-
-int String::WriteUtf8(char* buffer,
-                      int capacity,
-                      int* nchars_ref,
-                      int options) const {
+int String::WriteUtf8(Isolate* v8_isolate, char* buffer, int capacity,
+                      int* nchars_ref, int options) const {
   i::Handle<i::String> str = Utils::OpenHandle(this);
-  i::Isolate* isolate = str->GetIsolate();
+  i::Isolate* isolate = reinterpret_cast<i::Isolate*>(v8_isolate);
   LOG_API(isolate, String, WriteUtf8);
   ENTER_V8_NO_SCRIPT_NO_EXCEPTION(isolate);
   str = i::String::Flatten(isolate, str);  // Flatten the string for efficiency.
@@ -5786,7 +5820,7 @@ int String::WriteUtf8(char* buffer,
     if (success) return writer.CompleteWrite(write_null, nchars_ref);
   } else if (capacity >= string_length) {
     // First check that the buffer is large enough.
-    int utf8_bytes = Utf8Length();
+    int utf8_bytes = Utf8Length(reinterpret_cast<Isolate*>(isolate));
     if (utf8_bytes <= capacity) {
       // one-byte fast path.
       if (utf8_bytes == string_length) {
@@ -5811,14 +5845,18 @@ int String::WriteUtf8(char* buffer,
   return writer.CompleteWrite(write_null, nchars_ref);
 }
 
+int String::WriteUtf8(char* buffer, int capacity, int* nchars_ref,
+                      int options) const {
+  i::Handle<i::String> str = Utils::OpenHandle(this);
+  i::Isolate* isolate = UnsafeIsolateFromHeapObject(str);
+  return WriteUtf8(reinterpret_cast<Isolate*>(isolate), buffer, capacity,
+                   nchars_ref, options);
+}
 
-template<typename CharType>
-static inline int WriteHelper(const String* string,
-                              CharType* buffer,
-                              int start,
-                              int length,
+template <typename CharType>
+static inline int WriteHelper(i::Isolate* isolate, const String* string,
+                              CharType* buffer, int start, int length,
                               int options) {
-  i::Isolate* isolate = Utils::OpenHandle(string)->GetIsolate();
   LOG_API(isolate, String, Write);
   ENTER_V8_NO_SCRIPT_NO_EXCEPTION(isolate);
   DCHECK(start >= 0 && length >= -1);
@@ -5841,7 +5879,14 @@ int String::WriteOneByte(uint8_t* buffer,
                          int start,
                          int length,
                          int options) const {
-  return WriteHelper(this, buffer, start, length, options);
+  i::Isolate* isolate = UnsafeIsolateFromHeapObject(Utils::OpenHandle(this));
+  return WriteHelper(isolate, this, buffer, start, length, options);
+}
+
+int String::WriteOneByte(Isolate* isolate, uint8_t* buffer, int start,
+                         int length, int options) const {
+  return WriteHelper(reinterpret_cast<i::Isolate*>(isolate), this, buffer,
+                     start, length, options);
 }
 
 
@@ -5849,7 +5894,14 @@ int String::Write(uint16_t* buffer,
                   int start,
                   int length,
                   int options) const {
-  return WriteHelper(this, buffer, start, length, options);
+  i::Isolate* isolate = UnsafeIsolateFromHeapObject(Utils::OpenHandle(this));
+  return WriteHelper(isolate, this, buffer, start, length, options);
+}
+
+int String::Write(Isolate* isolate, uint16_t* buffer, int start, int length,
+                  int options) const {
+  return WriteHelper(reinterpret_cast<i::Isolate*>(isolate), this, buffer,
+                     start, length, options);
 }
 
 
@@ -5918,7 +5970,19 @@ v8::String::GetExternalOneByteStringResource() const {
 
 Local<Value> Symbol::Name() const {
   i::Handle<i::Symbol> sym = Utils::OpenHandle(this);
-  i::Handle<i::Object> name(sym->name(), sym->GetIsolate());
+
+  i::MemoryChunk* chunk = i::MemoryChunk::FromHeapObject(*sym);
+  // If the Symbol is in RO_SPACE, then its name must be too. Since RO_SPACE
+  // objects are immovable we can use the Handle(T**) constructor with the
+  // address of the name field in the Symbol object without needing an isolate.
+  if (chunk->owner()->identity() == i::RO_SPACE) {
+    i::Handle<i::HeapObject> ro_name(reinterpret_cast<i::HeapObject**>(
+        sym->GetFieldAddress(i::Symbol::kNameOffset)));
+    return Utils::ToLocal(ro_name);
+  }
+
+  i::Handle<i::Object> name(sym->name(), chunk->heap()->isolate());
+
   return Utils::ToLocal(name);
 }
 
@@ -6487,7 +6551,7 @@ MaybeLocal<v8::Object> ObjectTemplate::NewInstance(Local<Context> context) {
 
 
 Local<v8::Object> ObjectTemplate::NewInstance() {
-  auto context = ContextFromHeapObject(Utils::OpenHandle(this));
+  auto context = ContextFromNeverReadOnlySpaceObject(Utils::OpenHandle(this));
   RETURN_TO_LOCAL_UNCHECKED(NewInstance(context), Object);
 }
 
@@ -6527,7 +6591,7 @@ MaybeLocal<v8::Function> FunctionTemplate::GetFunction(Local<Context> context) {
 
 
 Local<v8::Function> FunctionTemplate::GetFunction() {
-  auto context = ContextFromHeapObject(Utils::OpenHandle(this));
+  auto context = ContextFromNeverReadOnlySpaceObject(Utils::OpenHandle(this));
   RETURN_TO_LOCAL_UNCHECKED(GetFunction(context), Function);
 }
 
@@ -6567,7 +6631,8 @@ bool FunctionTemplate::HasInstance(v8::Local<v8::Value> value) {
   if (obj->IsJSGlobalProxy()) {
     // If it's a global proxy, then test with the global object. Note that the
     // inner global object may not necessarily be a JSGlobalObject.
-    i::PrototypeIterator iter(i::JSObject::cast(*obj)->map());
+    i::PrototypeIterator iter(self->GetIsolate(),
+                              i::JSObject::cast(*obj)->map());
     // The global proxy should always have a prototype, as it is a bug to call
     // this on a detached JSGlobalProxy.
     DCHECK(!iter.IsAtEnd());
@@ -6708,10 +6773,10 @@ MaybeLocal<String> String::NewFromTwoByte(Isolate* isolate,
   return result;
 }
 
-
-Local<String> v8::String::Concat(Local<String> left, Local<String> right) {
+Local<String> v8::String::Concat(Isolate* v8_isolate, Local<String> left,
+                                 Local<String> right) {
+  i::Isolate* isolate = reinterpret_cast<i::Isolate*>(v8_isolate);
   i::Handle<i::String> left_string = Utils::OpenHandle(*left);
-  i::Isolate* isolate = left_string->GetIsolate();
   ENTER_V8_NO_SCRIPT_NO_EXCEPTION(isolate);
   LOG_API(isolate, String, Concat);
   i::Handle<i::String> right_string = Utils::OpenHandle(*right);
@@ -6725,6 +6790,11 @@ Local<String> v8::String::Concat(Local<String> left, Local<String> right) {
   return Utils::ToLocal(result);
 }
 
+Local<String> v8::String::Concat(Local<String> left, Local<String> right) {
+  i::Handle<i::String> left_string = Utils::OpenHandle(*left);
+  i::Isolate* isolate = UnsafeIsolateFromHeapObject(left_string);
+  return Concat(reinterpret_cast<Isolate*>(isolate), left, right);
+}
 
 MaybeLocal<String> v8::String::NewExternalTwoByte(
     Isolate* isolate, v8::String::ExternalStringResource* resource) {
@@ -6780,7 +6850,13 @@ Local<String> v8::String::NewExternal(
 
 bool v8::String::MakeExternal(v8::String::ExternalStringResource* resource) {
   i::Handle<i::String> obj = Utils::OpenHandle(this);
-  i::Isolate* isolate = obj->GetIsolate();
+  // RO_SPACE strings cannot be externalized.
+  i::MemoryChunk* chunk = i::MemoryChunk::FromHeapObject(*obj);
+  if (chunk->owner()->identity() == i::RO_SPACE) {
+    return false;
+  }
+
+  i::Isolate* isolate = chunk->heap()->isolate();
   if (i::StringShape(*obj).IsExternal()) {
     return false;  // Already an external string.
   }
@@ -6803,7 +6879,14 @@ bool v8::String::MakeExternal(v8::String::ExternalStringResource* resource) {
 bool v8::String::MakeExternal(
     v8::String::ExternalOneByteStringResource* resource) {
   i::Handle<i::String> obj = Utils::OpenHandle(this);
-  i::Isolate* isolate = obj->GetIsolate();
+
+  // RO_SPACE strings cannot be externalized.
+  i::MemoryChunk* chunk = i::MemoryChunk::FromHeapObject(*obj);
+  if (chunk->owner()->identity() == i::RO_SPACE) {
+    return false;
+  }
+
+  i::Isolate* isolate = chunk->heap()->isolate();
   if (i::StringShape(*obj).IsExternal()) {
     return false;  // Already an external string.
   }
@@ -6914,7 +6997,14 @@ bool v8::BooleanObject::ValueOf() const {
 
 Local<v8::Value> v8::StringObject::New(Local<String> value) {
   i::Handle<i::String> string = Utils::OpenHandle(*value);
-  i::Isolate* isolate = string->GetIsolate();
+  i::Isolate* isolate = UnsafeIsolateFromHeapObject(string);
+  return New(reinterpret_cast<Isolate*>(isolate), value);
+}
+
+Local<v8::Value> v8::StringObject::New(Isolate* v8_isolate,
+                                       Local<String> value) {
+  i::Handle<i::String> string = Utils::OpenHandle(*value);
+  i::Isolate* isolate = reinterpret_cast<i::Isolate*>(v8_isolate);
   LOG_API(isolate, StringObject, New);
   ENTER_V8_NO_SCRIPT_NO_EXCEPTION(isolate);
   i::Handle<i::Object> obj =
@@ -7007,7 +7097,7 @@ MaybeLocal<v8::RegExp> v8::RegExp::New(Local<Context> context,
   PREPARE_FOR_EXECUTION(context, RegExp, New, RegExp);
   Local<v8::RegExp> result;
   has_pending_exception =
-      !ToLocal<RegExp>(i::JSRegExp::New(Utils::OpenHandle(*pattern),
+      !ToLocal<RegExp>(i::JSRegExp::New(isolate, Utils::OpenHandle(*pattern),
                                         static_cast<i::JSRegExp::Flags>(flags)),
                        &result);
   RETURN_ON_FAILED_EXECUTION(RegExp);
@@ -7016,8 +7106,8 @@ MaybeLocal<v8::RegExp> v8::RegExp::New(Local<Context> context,
 
 
 Local<v8::RegExp> v8::RegExp::New(Local<String> pattern, Flags flags) {
-  auto isolate =
-      reinterpret_cast<Isolate*>(Utils::OpenHandle(*pattern)->GetIsolate());
+  auto* isolate = reinterpret_cast<Isolate*>(
+      UnsafeIsolateFromHeapObject(Utils::OpenHandle(*pattern)));
   auto context = isolate->GetCurrentContext();
   RETURN_TO_LOCAL_UNCHECKED(New(context, pattern, flags), RegExp);
 }
@@ -7345,7 +7435,7 @@ Maybe<bool> Promise::Resolver::Resolve(Local<Context> context,
 
 
 void Promise::Resolver::Resolve(Local<Value> value) {
-  auto context = ContextFromHeapObject(Utils::OpenHandle(this));
+  auto context = ContextFromNeverReadOnlySpaceObject(Utils::OpenHandle(this));
   USE(Resolve(context, value));
 }
 
@@ -7370,7 +7460,7 @@ Maybe<bool> Promise::Resolver::Reject(Local<Context> context,
 
 
 void Promise::Resolver::Reject(Local<Value> value) {
-  auto context = ContextFromHeapObject(Utils::OpenHandle(this));
+  auto context = ContextFromNeverReadOnlySpaceObject(Utils::OpenHandle(this));
   USE(Reject(context, value));
 }
 
@@ -9110,7 +9200,7 @@ String::Utf8Value::Utf8Value(v8::Isolate* isolate, v8::Local<v8::Value> obj)
   TryCatch try_catch(isolate);
   Local<String> str;
   if (!obj->ToString(context).ToLocal(&str)) return;
-  length_ = str->Utf8Length();
+  length_ = str->Utf8Length(isolate);
   str_ = i::NewArray<char>(length_ + 1);
   str->WriteUtf8(str_);
 }
@@ -9634,7 +9724,7 @@ MaybeLocal<UnboundScript> debug::CompileInspectorScript(Isolate* v8_isolate,
     i::ScriptData* script_data = nullptr;
     i::MaybeHandle<i::SharedFunctionInfo> maybe_function_info =
         i::Compiler::GetSharedFunctionInfoForScript(
-            str, i::Compiler::ScriptDetails(), origin_options, nullptr,
+            isolate, str, i::Compiler::ScriptDetails(), origin_options, nullptr,
             script_data, ScriptCompiler::kNoCompileOptions,
             ScriptCompiler::kNoCacheBecauseInspector,
             i::FLAG_expose_inspector_scripts ? i::NOT_NATIVES_CODE
@@ -9851,7 +9941,8 @@ void debug::GlobalLexicalScopeNames(
       context->global_object()->native_context()->script_context_table(),
       isolate);
   for (int i = 0; i < table->used(); i++) {
-    i::Handle<i::Context> context = i::ScriptContextTable::GetContext(table, i);
+    i::Handle<i::Context> context =
+        i::ScriptContextTable::GetContext(isolate, table, i);
     DCHECK(context->IsScriptContext());
     i::Handle<i::ScopeInfo> scope_info(context->scope_info(), isolate);
     int local_count = scope_info->ContextLocalCount();
@@ -9879,8 +9970,8 @@ int debug::GetNativeAccessorDescriptor(v8::Local<v8::Context> context,
   if (name->AsArrayIndex(&index)) {
     return static_cast<int>(debug::NativeAccessorType::None);
   }
-  i::LookupIterator it =
-      i::LookupIterator(object, name, i::LookupIterator::OWN);
+  i::LookupIterator it = i::LookupIterator(object->GetIsolate(), object, name,
+                                           i::LookupIterator::OWN);
   if (!it.IsFound()) return static_cast<int>(debug::NativeAccessorType::None);
   if (it.state() != i::LookupIterator::ACCESSOR) {
     return static_cast<int>(debug::NativeAccessorType::None);
diff --git a/deps/v8/src/arm/assembler-arm.cc b/deps/v8/src/arm/assembler-arm.cc
index cfd4078a14512b..fe843c3629d0ad 100644
--- a/deps/v8/src/arm/assembler-arm.cc
+++ b/deps/v8/src/arm/assembler-arm.cc
@@ -1421,7 +1421,8 @@ void Assembler::b(int branch_offset, Condition cond, RelocInfo::Mode rmode) {
   RecordRelocInfo(rmode);
   DCHECK_EQ(branch_offset & 3, 0);
   int imm24 = branch_offset >> 2;
-  CHECK(is_int24(imm24));
+  const bool b_imm_check = is_int24(imm24);
+  CHECK(b_imm_check);
   emit(cond | B27 | B25 | (imm24 & kImm24Mask));
 
   if (cond == al) {
@@ -1434,7 +1435,8 @@ void Assembler::bl(int branch_offset, Condition cond, RelocInfo::Mode rmode) {
   RecordRelocInfo(rmode);
   DCHECK_EQ(branch_offset & 3, 0);
   int imm24 = branch_offset >> 2;
-  CHECK(is_int24(imm24));
+  const bool bl_imm_check = is_int24(imm24);
+  CHECK(bl_imm_check);
   emit(cond | B27 | B25 | B24 | (imm24 & kImm24Mask));
 }
 
@@ -1442,7 +1444,8 @@ void Assembler::blx(int branch_offset) {
   DCHECK_EQ(branch_offset & 1, 0);
   int h = ((branch_offset & 2) >> 1)*B24;
   int imm24 = branch_offset >> 2;
-  CHECK(is_int24(imm24));
+  const bool blx_imm_check = is_int24(imm24);
+  CHECK(blx_imm_check);
   emit(kSpecialCondition | B27 | B25 | h | (imm24 & kImm24Mask));
 }
 
diff --git a/deps/v8/src/arm64/macro-assembler-arm64.cc b/deps/v8/src/arm64/macro-assembler-arm64.cc
index 96dff8fb45b457..74583523afe971 100644
--- a/deps/v8/src/arm64/macro-assembler-arm64.cc
+++ b/deps/v8/src/arm64/macro-assembler-arm64.cc
@@ -1428,7 +1428,8 @@ void MacroAssembler::PopCalleeSavedRegisters() {
 }
 
 void TurboAssembler::AssertSpAligned() {
-  if (emit_debug_code() && use_real_aborts()) {
+  if (emit_debug_code()) {
+    TrapOnAbortScope trap_on_abort_scope(this);  // Avoid calls to Abort.
     // Arm64 requires the stack pointer to be 16-byte aligned prior to address
     // calculation.
     UseScratchRegisterScope scope(this);
diff --git a/deps/v8/src/asmjs/asm-js.cc b/deps/v8/src/asmjs/asm-js.cc
index 5579a3fab07752..604207bc0dcacd 100644
--- a/deps/v8/src/asmjs/asm-js.cc
+++ b/deps/v8/src/asmjs/asm-js.cc
@@ -405,7 +405,7 @@ MaybeHandle<Object> AsmJs::InstantiateAsmWasm(Isolate* isolate,
   Handle<Name> single_function_name(
       isolate->factory()->InternalizeUtf8String(AsmJs::kSingleFunctionName));
   MaybeHandle<Object> single_function =
-      Object::GetProperty(module_object, single_function_name);
+      Object::GetProperty(isolate, module_object, single_function_name);
   if (!single_function.is_null() &&
       !single_function.ToHandleChecked()->IsUndefined(isolate)) {
     return single_function;
@@ -413,7 +413,7 @@ MaybeHandle<Object> AsmJs::InstantiateAsmWasm(Isolate* isolate,
 
   Handle<String> exports_name =
       isolate->factory()->InternalizeUtf8String("exports");
-  return Object::GetProperty(module_object, exports_name);
+  return Object::GetProperty(isolate, module_object, exports_name);
 }
 
 }  // namespace internal
diff --git a/deps/v8/src/assembler.cc b/deps/v8/src/assembler.cc
index ecf8a8edcf4597..a431c7442d561e 100644
--- a/deps/v8/src/assembler.cc
+++ b/deps/v8/src/assembler.cc
@@ -626,7 +626,7 @@ void RelocInfo::Print(Isolate* isolate, std::ostream& os) {  // NOLINT
 void RelocInfo::Verify(Isolate* isolate) {
   switch (rmode_) {
     case EMBEDDED_OBJECT:
-      Object::VerifyPointer(target_object());
+      Object::VerifyPointer(isolate, target_object());
       break;
     case CODE_TARGET:
     case RELATIVE_CODE_TARGET: {
diff --git a/deps/v8/src/ast/ast-value-factory.cc b/deps/v8/src/ast/ast-value-factory.cc
index 5efecc5375a33d..fc8be819f6cf93 100644
--- a/deps/v8/src/ast/ast-value-factory.cc
+++ b/deps/v8/src/ast/ast-value-factory.cc
@@ -182,7 +182,7 @@ std::forward_list<const AstRawString*> AstConsString::ToRawStrings() const {
   return result;
 }
 
-AstStringConstants::AstStringConstants(Isolate* isolate, uint32_t hash_seed)
+AstStringConstants::AstStringConstants(Isolate* isolate, uint64_t hash_seed)
     : zone_(isolate->allocator(), ZONE_NAME),
       string_table_(AstRawString::Compare),
       hash_seed_(hash_seed) {
diff --git a/deps/v8/src/ast/ast-value-factory.h b/deps/v8/src/ast/ast-value-factory.h
index a453455dd015b3..e85b0675bf6fed 100644
--- a/deps/v8/src/ast/ast-value-factory.h
+++ b/deps/v8/src/ast/ast-value-factory.h
@@ -240,14 +240,14 @@ class AstBigInt {
 
 class AstStringConstants final {
  public:
-  AstStringConstants(Isolate* isolate, uint32_t hash_seed);
+  AstStringConstants(Isolate* isolate, uint64_t hash_seed);
 
 #define F(name, str) \
   const AstRawString* name##_string() const { return name##_string_; }
   AST_STRING_CONSTANTS(F)
 #undef F
 
-  uint32_t hash_seed() const { return hash_seed_; }
+  uint64_t hash_seed() const { return hash_seed_; }
   const base::CustomMatcherHashMap* string_table() const {
     return &string_table_;
   }
@@ -255,7 +255,7 @@ class AstStringConstants final {
  private:
   Zone zone_;
   base::CustomMatcherHashMap string_table_;
-  uint32_t hash_seed_;
+  uint64_t hash_seed_;
 
 #define F(name, str) AstRawString* name##_string_;
   AST_STRING_CONSTANTS(F)
@@ -267,7 +267,7 @@ class AstStringConstants final {
 class AstValueFactory {
  public:
   AstValueFactory(Zone* zone, const AstStringConstants* string_constants,
-                  uint32_t hash_seed)
+                  uint64_t hash_seed)
       : string_table_(string_constants->string_table()),
         strings_(nullptr),
         strings_end_(&strings_),
@@ -354,7 +354,7 @@ class AstValueFactory {
 
   Zone* zone_;
 
-  uint32_t hash_seed_;
+  uint64_t hash_seed_;
 };
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/src/bootstrapper.cc b/deps/v8/src/bootstrapper.cc
index 97aca0dcfabfad..35560a16824301 100644
--- a/deps/v8/src/bootstrapper.cc
+++ b/deps/v8/src/bootstrapper.cc
@@ -397,7 +397,8 @@ V8_NOINLINE void InstallFunction(Isolate* isolate, Handle<JSObject> target,
 V8_NOINLINE void InstallFunction(Isolate* isolate, Handle<JSObject> target,
                                  Handle<JSFunction> function, Handle<Name> name,
                                  PropertyAttributes attributes = DONT_ENUM) {
-  Handle<String> name_string = Name::ToFunctionName(name).ToHandleChecked();
+  Handle<String> name_string =
+      Name::ToFunctionName(isolate, name).ToHandleChecked();
   InstallFunction(isolate, target, name, function, name_string, attributes);
 }
 
@@ -434,7 +435,8 @@ V8_NOINLINE Handle<JSFunction> InstallFunction(
     InstanceType type, int instance_size, int inobject_properties,
     MaybeHandle<Object> maybe_prototype, Builtins::Name call,
     PropertyAttributes attributes) {
-  Handle<String> name_string = Name::ToFunctionName(name).ToHandleChecked();
+  Handle<String> name_string =
+      Name::ToFunctionName(isolate, name).ToHandleChecked();
   Handle<JSFunction> function =
       CreateFunction(isolate, name_string, type, instance_size,
                      inobject_properties, maybe_prototype, call);
@@ -529,13 +531,13 @@ V8_NOINLINE void SimpleInstallGetterSetter(Isolate* isolate,
                                            Builtins::Name call_setter,
                                            PropertyAttributes attribs) {
   Handle<String> getter_name =
-      Name::ToFunctionName(name, isolate->factory()->get_string())
+      Name::ToFunctionName(isolate, name, isolate->factory()->get_string())
           .ToHandleChecked();
   Handle<JSFunction> getter =
       SimpleCreateFunction(isolate, getter_name, call_getter, 0, true);
 
   Handle<String> setter_name =
-      Name::ToFunctionName(name, isolate->factory()->set_string())
+      Name::ToFunctionName(isolate, name, isolate->factory()->set_string())
           .ToHandleChecked();
   Handle<JSFunction> setter =
       SimpleCreateFunction(isolate, setter_name, call_setter, 1, true);
@@ -547,7 +549,7 @@ V8_NOINLINE Handle<JSFunction> SimpleInstallGetter(
     Isolate* isolate, Handle<JSObject> base, Handle<Name> name,
     Handle<Name> property_name, Builtins::Name call, bool adapt) {
   Handle<String> getter_name =
-      Name::ToFunctionName(name, isolate->factory()->get_string())
+      Name::ToFunctionName(isolate, name, isolate->factory()->get_string())
           .ToHandleChecked();
   Handle<JSFunction> getter =
       SimpleCreateFunction(isolate, getter_name, call, 0, adapt);
@@ -621,10 +623,9 @@ Handle<JSFunction> Genesis::CreateEmptyFunction() {
   Handle<WeakFixedArray> infos = factory()->NewWeakFixedArray(2);
   script->set_shared_function_infos(*infos);
   empty_function->shared()->set_scope_info(*scope_info);
-  empty_function->shared()->set_function_literal_id(1);
   empty_function->shared()->DontAdaptArguments();
   SharedFunctionInfo::SetScript(handle(empty_function->shared(), isolate()),
-                                script);
+                                script, 1);
 
   return empty_function;
 }
@@ -1103,15 +1104,15 @@ void Genesis::CreateJSProxyMaps() {
     Map::EnsureDescriptorSlack(isolate_, map, 2);
 
     {  // proxy
-      Descriptor d = Descriptor::DataField(factory()->proxy_string(),
+      Descriptor d = Descriptor::DataField(isolate(), factory()->proxy_string(),
                                            JSProxyRevocableResult::kProxyIndex,
                                            NONE, Representation::Tagged());
       map->AppendDescriptor(&d);
     }
     {  // revoke
-      Descriptor d = Descriptor::DataField(factory()->revoke_string(),
-                                           JSProxyRevocableResult::kRevokeIndex,
-                                           NONE, Representation::Tagged());
+      Descriptor d = Descriptor::DataField(
+          isolate(), factory()->revoke_string(),
+          JSProxyRevocableResult::kRevokeIndex, NONE, Representation::Tagged());
       map->AppendDescriptor(&d);
     }
 
@@ -2610,7 +2611,7 @@ void Genesis::InitializeGlobal(Handle<JSGlobalObject> global_object,
     // ECMA-262, section 15.10.7.5.
     PropertyAttributes writable =
         static_cast<PropertyAttributes>(DONT_ENUM | DONT_DELETE);
-    Descriptor d = Descriptor::DataField(factory->lastIndex_string(),
+    Descriptor d = Descriptor::DataField(isolate(), factory->lastIndex_string(),
                                          JSRegExp::kLastIndexFieldIndex,
                                          writable, Representation::Tagged());
     initial_map->AppendDescriptor(&d);
@@ -3323,7 +3324,7 @@ void Genesis::InitializeGlobal(Handle<JSGlobalObject> global_object,
       PropertyAttributes attribs =
           static_cast<PropertyAttributes>(DONT_DELETE | DONT_ENUM | READ_ONLY);
       Descriptor d =
-          Descriptor::DataField(factory->to_string_tag_symbol(),
+          Descriptor::DataField(isolate(), factory->to_string_tag_symbol(),
                                 JSModuleNamespace::kToStringTagFieldIndex,
                                 attribs, Representation::Tagged());
       map->AppendDescriptor(&d);
@@ -3337,14 +3338,14 @@ void Genesis::InitializeGlobal(Handle<JSGlobalObject> global_object,
     Map::EnsureDescriptorSlack(isolate_, map, 2);
 
     {  // value
-      Descriptor d = Descriptor::DataField(factory->value_string(),
+      Descriptor d = Descriptor::DataField(isolate(), factory->value_string(),
                                            JSIteratorResult::kValueIndex, NONE,
                                            Representation::Tagged());
       map->AppendDescriptor(&d);
     }
 
     {  // done
-      Descriptor d = Descriptor::DataField(factory->done_string(),
+      Descriptor d = Descriptor::DataField(isolate(), factory->done_string(),
                                            JSIteratorResult::kDoneIndex, NONE,
                                            Representation::Tagged());
       map->AppendDescriptor(&d);
@@ -3555,15 +3556,17 @@ void Genesis::InitializeGlobal(Handle<JSGlobalObject> global_object,
     Map::EnsureDescriptorSlack(isolate_, map, 2);
 
     {  // length
-      Descriptor d = Descriptor::DataField(
-          factory->length_string(), JSSloppyArgumentsObject::kLengthIndex,
-          DONT_ENUM, Representation::Tagged());
+      Descriptor d =
+          Descriptor::DataField(isolate(), factory->length_string(),
+                                JSSloppyArgumentsObject::kLengthIndex,
+                                DONT_ENUM, Representation::Tagged());
       map->AppendDescriptor(&d);
     }
     {  // callee
-      Descriptor d = Descriptor::DataField(
-          factory->callee_string(), JSSloppyArgumentsObject::kCalleeIndex,
-          DONT_ENUM, Representation::Tagged());
+      Descriptor d =
+          Descriptor::DataField(isolate(), factory->callee_string(),
+                                JSSloppyArgumentsObject::kCalleeIndex,
+                                DONT_ENUM, Representation::Tagged());
       map->AppendDescriptor(&d);
     }
     // @@iterator method is added later.
@@ -3607,9 +3610,10 @@ void Genesis::InitializeGlobal(Handle<JSGlobalObject> global_object,
     Map::EnsureDescriptorSlack(isolate_, map, 2);
 
     {  // length
-      Descriptor d = Descriptor::DataField(
-          factory->length_string(), JSStrictArgumentsObject::kLengthIndex,
-          DONT_ENUM, Representation::Tagged());
+      Descriptor d =
+          Descriptor::DataField(isolate(), factory->length_string(),
+                                JSStrictArgumentsObject::kLengthIndex,
+                                DONT_ENUM, Representation::Tagged());
       map->AppendDescriptor(&d);
     }
     {  // callee
@@ -3762,9 +3766,10 @@ bool Bootstrapper::CompileNative(Isolate* isolate, Vector<const char> name,
       isolate->factory()->NewStringFromUtf8(name).ToHandleChecked();
   MaybeHandle<SharedFunctionInfo> maybe_function_info =
       Compiler::GetSharedFunctionInfoForScript(
-          source, Compiler::ScriptDetails(script_name), ScriptOriginOptions(),
-          nullptr, nullptr, ScriptCompiler::kNoCompileOptions,
-          ScriptCompiler::kNoCacheNoReason, natives_flag);
+          isolate, source, Compiler::ScriptDetails(script_name),
+          ScriptOriginOptions(), nullptr, nullptr,
+          ScriptCompiler::kNoCompileOptions, ScriptCompiler::kNoCacheNoReason,
+          natives_flag);
   Handle<SharedFunctionInfo> function_info;
   if (!maybe_function_info.ToHandle(&function_info)) return false;
 
@@ -3827,8 +3832,9 @@ bool Genesis::CompileExtension(Isolate* isolate, v8::Extension* extension) {
         factory->NewStringFromUtf8(name).ToHandleChecked();
     MaybeHandle<SharedFunctionInfo> maybe_function_info =
         Compiler::GetSharedFunctionInfoForScript(
-            source, Compiler::ScriptDetails(script_name), ScriptOriginOptions(),
-            extension, nullptr, ScriptCompiler::kNoCompileOptions,
+            isolate, source, Compiler::ScriptDetails(script_name),
+            ScriptOriginOptions(), extension, nullptr,
+            ScriptCompiler::kNoCompileOptions,
             ScriptCompiler::kNoCacheBecauseV8Extension, EXTENSION_CODE);
     if (!maybe_function_info.ToHandle(&function_info)) return false;
     cache->Add(isolate, name, function_info);
@@ -3857,7 +3863,7 @@ static Handle<JSObject> ResolveBuiltinIdHolder(Isolate* isolate,
   if (period_pos == nullptr) {
     return Handle<JSObject>::cast(
         Object::GetPropertyOrElement(
-            global, factory->InternalizeUtf8String(holder_expr))
+            isolate, global, factory->InternalizeUtf8String(holder_expr))
             .ToHandleChecked());
   }
   const char* inner = period_pos + 1;
@@ -3936,7 +3942,7 @@ void Bootstrapper::ExportFromRuntime(Isolate* isolate,
                         iterator_prototype, NONE);
 
   {
-    PrototypeIterator iter(native_context->generator_function_map());
+    PrototypeIterator iter(isolate, native_context->generator_function_map());
     Handle<JSObject> generator_function_prototype(iter.GetCurrent<JSObject>(),
                                                   isolate);
 
@@ -3969,7 +3975,8 @@ void Bootstrapper::ExportFromRuntime(Isolate* isolate,
   }
 
   {
-    PrototypeIterator iter(native_context->async_generator_function_map());
+    PrototypeIterator iter(isolate,
+                           native_context->async_generator_function_map());
     Handle<JSObject> async_generator_function_prototype(
         iter.GetCurrent<JSObject>(), isolate);
 
@@ -4074,7 +4081,7 @@ void Bootstrapper::ExportFromRuntime(Isolate* isolate,
 
   {  // -- A s y n c F u n c t i o n
     // Builtin functions for AsyncFunction.
-    PrototypeIterator iter(native_context->async_function_map());
+    PrototypeIterator iter(isolate, native_context->async_function_map());
     Handle<JSObject> async_function_prototype(iter.GetCurrent<JSObject>(),
                                               isolate);
 
@@ -4527,6 +4534,10 @@ void Genesis::InitializeGlobal_harmony_locale() {
 
   SimpleInstallFunction(isolate(), prototype, "toString",
                         Builtins::kLocalePrototypeToString, 0, false);
+  SimpleInstallFunction(isolate(), prototype, "maximize",
+                        Builtins::kLocalePrototypeMaximize, 0, false);
+  SimpleInstallFunction(isolate(), prototype, "minimize",
+                        Builtins::kLocalePrototypeMinimize, 0, false);
   // Base locale getters.
   SimpleInstallGetter(isolate(), prototype,
                       factory()->InternalizeUtf8String("language"),
@@ -4590,6 +4601,11 @@ void Genesis::InitializeGlobal_harmony_intl_relative_time_format() {
   SimpleInstallFunction(isolate(), prototype, "resolvedOptions",
                         Builtins::kRelativeTimeFormatPrototypeResolvedOptions,
                         0, false);
+  SimpleInstallFunction(isolate(), prototype, "format",
+                        Builtins::kRelativeTimeFormatPrototypeFormat, 2, false);
+  SimpleInstallFunction(isolate(), prototype, "formatToParts",
+                        Builtins::kRelativeTimeFormatPrototypeFormatToParts, 2,
+                        false);
 }
 
 #endif  // V8_INTL_SUPPORT
@@ -4883,27 +4899,29 @@ bool Genesis::InstallNatives(GlobalContextType context_type) {
     Map::EnsureDescriptorSlack(isolate(), map, 4);
 
     {  // get
-      Descriptor d = Descriptor::DataField(
-          factory()->get_string(), JSAccessorPropertyDescriptor::kGetIndex,
-          NONE, Representation::Tagged());
+      Descriptor d =
+          Descriptor::DataField(isolate(), factory()->get_string(),
+                                JSAccessorPropertyDescriptor::kGetIndex, NONE,
+                                Representation::Tagged());
       map->AppendDescriptor(&d);
     }
     {  // set
-      Descriptor d = Descriptor::DataField(
-          factory()->set_string(), JSAccessorPropertyDescriptor::kSetIndex,
-          NONE, Representation::Tagged());
+      Descriptor d =
+          Descriptor::DataField(isolate(), factory()->set_string(),
+                                JSAccessorPropertyDescriptor::kSetIndex, NONE,
+                                Representation::Tagged());
       map->AppendDescriptor(&d);
     }
     {  // enumerable
       Descriptor d =
-          Descriptor::DataField(factory()->enumerable_string(),
+          Descriptor::DataField(isolate(), factory()->enumerable_string(),
                                 JSAccessorPropertyDescriptor::kEnumerableIndex,
                                 NONE, Representation::Tagged());
       map->AppendDescriptor(&d);
     }
     {  // configurable
       Descriptor d = Descriptor::DataField(
-          factory()->configurable_string(),
+          isolate(), factory()->configurable_string(),
           JSAccessorPropertyDescriptor::kConfigurableIndex, NONE,
           Representation::Tagged());
       map->AppendDescriptor(&d);
@@ -4927,28 +4945,29 @@ bool Genesis::InstallNatives(GlobalContextType context_type) {
     Map::EnsureDescriptorSlack(isolate(), map, 4);
 
     {  // value
-      Descriptor d = Descriptor::DataField(
-          factory()->value_string(), JSDataPropertyDescriptor::kValueIndex,
-          NONE, Representation::Tagged());
+      Descriptor d =
+          Descriptor::DataField(isolate(), factory()->value_string(),
+                                JSDataPropertyDescriptor::kValueIndex, NONE,
+                                Representation::Tagged());
       map->AppendDescriptor(&d);
     }
     {  // writable
       Descriptor d =
-          Descriptor::DataField(factory()->writable_string(),
+          Descriptor::DataField(isolate(), factory()->writable_string(),
                                 JSDataPropertyDescriptor::kWritableIndex, NONE,
                                 Representation::Tagged());
       map->AppendDescriptor(&d);
     }
     {  // enumerable
       Descriptor d =
-          Descriptor::DataField(factory()->enumerable_string(),
+          Descriptor::DataField(isolate(), factory()->enumerable_string(),
                                 JSDataPropertyDescriptor::kEnumerableIndex,
                                 NONE, Representation::Tagged());
       map->AppendDescriptor(&d);
     }
     {  // configurable
       Descriptor d =
-          Descriptor::DataField(factory()->configurable_string(),
+          Descriptor::DataField(isolate(), factory()->configurable_string(),
                                 JSDataPropertyDescriptor::kConfigurableIndex,
                                 NONE, Representation::Tagged());
       map->AppendDescriptor(&d);
@@ -5003,7 +5022,7 @@ bool Genesis::InstallNatives(GlobalContextType context_type) {
 
     // index descriptor.
     {
-      Descriptor d = Descriptor::DataField(factory()->index_string(),
+      Descriptor d = Descriptor::DataField(isolate(), factory()->index_string(),
                                            JSRegExpResult::kIndexIndex, NONE,
                                            Representation::Tagged());
       initial_map->AppendDescriptor(&d);
@@ -5011,7 +5030,7 @@ bool Genesis::InstallNatives(GlobalContextType context_type) {
 
     // input descriptor.
     {
-      Descriptor d = Descriptor::DataField(factory()->input_string(),
+      Descriptor d = Descriptor::DataField(isolate(), factory()->input_string(),
                                            JSRegExpResult::kInputIndex, NONE,
                                            Representation::Tagged());
       initial_map->AppendDescriptor(&d);
@@ -5019,9 +5038,9 @@ bool Genesis::InstallNatives(GlobalContextType context_type) {
 
     // groups descriptor.
     {
-      Descriptor d = Descriptor::DataField(factory()->groups_string(),
-                                           JSRegExpResult::kGroupsIndex, NONE,
-                                           Representation::Tagged());
+      Descriptor d = Descriptor::DataField(
+          isolate(), factory()->groups_string(), JSRegExpResult::kGroupsIndex,
+          NONE, Representation::Tagged());
       initial_map->AppendDescriptor(&d);
     }
 
@@ -5412,7 +5431,8 @@ void Genesis::TransferNamedProperties(Handle<JSObject> from,
         } else {
           DCHECK_EQ(kAccessor, details.kind());
           Handle<Name> key(descs->GetKey(i), isolate());
-          LookupIterator it(to, key, LookupIterator::OWN_SKIP_INTERCEPTOR);
+          LookupIterator it(isolate(), to, key,
+                            LookupIterator::OWN_SKIP_INTERCEPTOR);
           CHECK_NE(LookupIterator::ACCESS_CHECK, it.state());
           // If the property is already there we skip it
           if (it.IsFound()) continue;
@@ -5430,13 +5450,15 @@ void Genesis::TransferNamedProperties(Handle<JSObject> from,
     // Copy all keys and values in enumeration order.
     Handle<GlobalDictionary> properties(
         JSGlobalObject::cast(*from)->global_dictionary(), isolate());
-    Handle<FixedArray> indices = GlobalDictionary::IterationIndices(properties);
+    Handle<FixedArray> indices =
+        GlobalDictionary::IterationIndices(isolate(), properties);
     for (int i = 0; i < indices->length(); i++) {
       int index = Smi::ToInt(indices->get(i));
       // If the property is already there we skip it.
       Handle<PropertyCell> cell(properties->CellAt(index), isolate());
       Handle<Name> key(cell->name(), isolate());
-      LookupIterator it(to, key, LookupIterator::OWN_SKIP_INTERCEPTOR);
+      LookupIterator it(isolate(), to, key,
+                        LookupIterator::OWN_SKIP_INTERCEPTOR);
       CHECK_NE(LookupIterator::ACCESS_CHECK, it.state());
       if (it.IsFound()) continue;
       // Set the property.
@@ -5451,7 +5473,7 @@ void Genesis::TransferNamedProperties(Handle<JSObject> from,
     Handle<NameDictionary> properties =
         Handle<NameDictionary>(from->property_dictionary(), isolate());
     Handle<FixedArray> key_indices =
-        NameDictionary::IterationIndices(properties);
+        NameDictionary::IterationIndices(isolate(), properties);
     ReadOnlyRoots roots(isolate());
     for (int i = 0; i < key_indices->length(); i++) {
       int key_index = Smi::ToInt(key_indices->get(i));
@@ -5460,7 +5482,8 @@ void Genesis::TransferNamedProperties(Handle<JSObject> from,
       DCHECK(raw_key->IsName());
       // If the property is already there we skip it.
       Handle<Name> key(Name::cast(raw_key), isolate());
-      LookupIterator it(to, key, LookupIterator::OWN_SKIP_INTERCEPTOR);
+      LookupIterator it(isolate(), to, key,
+                        LookupIterator::OWN_SKIP_INTERCEPTOR);
       CHECK_NE(LookupIterator::ACCESS_CHECK, it.state());
       if (it.IsFound()) continue;
       // Set the property.
diff --git a/deps/v8/src/builtins/base.tq b/deps/v8/src/builtins/base.tq
index 6ab1f644c1b960..cd298e10e0dd0f 100644
--- a/deps/v8/src/builtins/base.tq
+++ b/deps/v8/src/builtins/base.tq
@@ -108,9 +108,10 @@ type FixedBigInt64Array extends FixedTypedArray;
 const kAllFixedArrays: constexpr ExtractFixedArrayFlags generates
 'ExtractFixedArrayFlag::kAllFixedArrays';
 
-const kCOWMap: Map generates 'LoadRoot(Heap::kFixedCOWArrayMapRootIndex)';
-const kEmptyFixedArray: FixedArrayBase generates
-'UncheckedCast<FixedArrayBase>(LoadRoot(Heap::kEmptyFixedArrayRootIndex))';
+const kFixedCOWArrayMapRootIndex: constexpr RootListIndex generates
+'Heap::kFixedCOWArrayMapRootIndex';
+const kEmptyFixedArrayRootIndex: constexpr RootListIndex generates
+'Heap::kEmptyFixedArrayRootIndex';
 
 const kInvalidArrayLength: constexpr MessageTemplate generates
 'MessageTemplate::kInvalidArrayLength';
@@ -136,11 +137,18 @@ const kInvalidDataViewAccessorOffset: constexpr MessageTemplate generates
 const kStrictReadOnlyProperty: constexpr MessageTemplate generates
 'MessageTemplate::kStrictReadOnlyProperty';
 
-const Hole: Oddball generates 'TheHoleConstant()';
-const Null: Oddball generates 'NullConstant()';
-const Undefined: Oddball generates 'UndefinedConstant()';
-const True: Boolean generates 'TrueConstant()';
-const False: Boolean generates 'FalseConstant()';
+extern macro TheHoleConstant(): Oddball;
+extern macro NullConstant(): Oddball;
+extern macro UndefinedConstant(): Oddball;
+extern macro TrueConstant(): Boolean;
+extern macro FalseConstant(): Boolean;
+
+const Hole: Oddball = TheHoleConstant();
+const Null: Oddball = NullConstant();
+const Undefined: Oddball = UndefinedConstant();
+const True: Boolean = TrueConstant();
+const False: Boolean = FalseConstant();
+
 const true: constexpr bool generates 'true';
 const false: constexpr bool generates 'false';
 
@@ -489,6 +497,7 @@ convert<intptr>(r: RawPtr): intptr {
 }
 
 extern macro UnsafeCastNumberToHeapNumber(Number): HeapNumber;
+extern macro UnsafeCastObjectToFixedArrayBase(Object): FixedArrayBase;
 extern macro UnsafeCastObjectToFixedArray(Object): FixedArray;
 extern macro UnsafeCastObjectToFixedDoubleArray(Object): FixedDoubleArray;
 extern macro UnsafeCastObjectToHeapNumber(Object): HeapNumber;
@@ -501,6 +510,7 @@ extern macro UnsafeCastObjectToFixedTypedArrayBase(Object): FixedTypedArrayBase;
 extern macro UnsafeCastObjectToNumberDictionary(Object): NumberDictionary;
 extern macro UnsafeCastObjectToJSReceiver(Object): JSReceiver;
 extern macro UnsafeCastObjectToJSObject(Object): JSObject;
+extern macro UnsafeCastObjectToMap(Object): Map;
 
 macro unsafe_cast<A : type>(n: Number): A;
 unsafe_cast<HeapNumber>(n: Number): HeapNumber {
@@ -543,6 +553,16 @@ unsafe_cast<JSReceiver>(o: Object): JSReceiver {
 unsafe_cast<JSObject>(o: Object): JSObject {
   return UnsafeCastObjectToJSObject(o);
 }
+unsafe_cast<Map>(o: Object): Map {
+  return UnsafeCastObjectToMap(o);
+}
+unsafe_cast<FixedArrayBase>(o: Object): FixedArrayBase {
+  return UnsafeCastObjectToFixedArrayBase(o);
+}
+
+const kCOWMap: Map = unsafe_cast<Map>(LoadRoot(kFixedCOWArrayMapRootIndex));
+const kEmptyFixedArray: FixedArrayBase = unsafe_cast<FixedArrayBase>(
+    LoadRoot(kEmptyFixedArrayRootIndex));
 
 extern macro BranchIfFastJSArray(Object, Context): never labels Taken, NotTaken;
 extern macro BranchIfNotFastJSArray(Object, Context): never labels Taken,
diff --git a/deps/v8/src/builtins/builtins-array.cc b/deps/v8/src/builtins/builtins-array.cc
index 460c8aa801bc60..5154b904f5fda9 100644
--- a/deps/v8/src/builtins/builtins-array.cc
+++ b/deps/v8/src/builtins/builtins-array.cc
@@ -198,9 +198,9 @@ V8_WARN_UNUSED_RESULT Object* GenericArrayPush(Isolate* isolate,
   // 7. Perform ? Set(O, "length", len, true).
   Handle<Object> final_length = isolate->factory()->NewNumber(length);
   RETURN_FAILURE_ON_EXCEPTION(
-      isolate,
-      Object::SetProperty(receiver, isolate->factory()->length_string(),
-                          final_length, LanguageMode::kStrict));
+      isolate, Object::SetProperty(isolate, receiver,
+                                   isolate->factory()->length_string(),
+                                   final_length, LanguageMode::kStrict));
 
   // 8. Return len.
   return *final_length;
@@ -253,7 +253,7 @@ V8_WARN_UNUSED_RESULT Object* GenericArrayPop(Isolate* isolate,
     // a. Perform ? Set(O, "length", 0, true).
     RETURN_FAILURE_ON_EXCEPTION(
         isolate, Object::SetProperty(
-                     receiver, isolate->factory()->length_string(),
+                     isolate, receiver, isolate->factory()->length_string(),
                      Handle<Smi>(Smi::kZero, isolate), LanguageMode::kStrict));
 
     // b. Return undefined.
@@ -270,7 +270,8 @@ V8_WARN_UNUSED_RESULT Object* GenericArrayPop(Isolate* isolate,
   // c. Let element be ? Get(O, index).
   Handle<Object> element;
   ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
-      isolate, element, JSReceiver::GetPropertyOrElement(receiver, index));
+      isolate, element,
+      JSReceiver::GetPropertyOrElement(isolate, receiver, index));
 
   // d. Perform ? DeletePropertyOrThrow(O, index).
   MAYBE_RETURN(JSReceiver::DeletePropertyOrElement(receiver, index,
@@ -279,9 +280,9 @@ V8_WARN_UNUSED_RESULT Object* GenericArrayPop(Isolate* isolate,
 
   // e. Perform ? Set(O, "length", newLen, true).
   RETURN_FAILURE_ON_EXCEPTION(
-      isolate,
-      Object::SetProperty(receiver, isolate->factory()->length_string(),
-                          new_length, LanguageMode::kStrict));
+      isolate, Object::SetProperty(isolate, receiver,
+                                   isolate->factory()->length_string(),
+                                   new_length, LanguageMode::kStrict));
 
   // f. Return element.
   return *element;
@@ -490,8 +491,8 @@ class ArrayConcatVisitor {
     // The object holding this backing store has just been allocated, so
     // it cannot yet be used as a prototype.
     Handle<JSObject> not_a_prototype_holder;
-    Handle<NumberDictionary> result =
-        NumberDictionary::Set(dict, index, elm, not_a_prototype_holder);
+    Handle<NumberDictionary> result = NumberDictionary::Set(
+        isolate_, dict, index, elm, not_a_prototype_holder);
     if (!result.is_identical_to(dict)) {
       // Dictionary needed to grow.
       clear_storage();
@@ -542,8 +543,9 @@ class ArrayConcatVisitor {
         isolate_->factory()->NewNumber(static_cast<double>(index_offset_));
     RETURN_ON_EXCEPTION(
         isolate_,
-        JSReceiver::SetProperty(result, isolate_->factory()->length_string(),
-                                length, LanguageMode::kStrict),
+        JSReceiver::SetProperty(isolate_, result,
+                                isolate_->factory()->length_string(), length,
+                                LanguageMode::kStrict),
         JSReceiver);
     return result;
   }
@@ -567,7 +569,7 @@ class ArrayConcatVisitor {
             // it cannot yet be used as a prototype.
             Handle<JSObject> not_a_prototype_holder;
             Handle<NumberDictionary> new_storage = NumberDictionary::Set(
-                slow_storage, i, element, not_a_prototype_holder);
+                isolate_, slow_storage, i, element, not_a_prototype_holder);
             if (!new_storage.is_identical_to(slow_storage)) {
               slow_storage = loop_scope.CloseAndEscape(new_storage);
             }
diff --git a/deps/v8/src/builtins/builtins-console.cc b/deps/v8/src/builtins/builtins-console.cc
index e19aefd2738465..d87183c7164b31 100644
--- a/deps/v8/src/builtins/builtins-console.cc
+++ b/deps/v8/src/builtins/builtins-console.cc
@@ -111,7 +111,7 @@ void InstallContextFunction(Isolate* isolate, Handle<JSObject> target,
   Factory* const factory = isolate->factory();
 
   Handle<String> name_string =
-      Name::ToFunctionName(factory->InternalizeUtf8String(name))
+      Name::ToFunctionName(isolate, factory->InternalizeUtf8String(name))
           .ToHandleChecked();
   NewFunctionArgs args = NewFunctionArgs::ForBuiltinWithoutPrototype(
       name_string, builtin_id, i::LanguageMode::kSloppy);
diff --git a/deps/v8/src/builtins/builtins-conversion-gen.cc b/deps/v8/src/builtins/builtins-conversion-gen.cc
index b1441adc372272..296f8d7661aff8 100644
--- a/deps/v8/src/builtins/builtins-conversion-gen.cc
+++ b/deps/v8/src/builtins/builtins-conversion-gen.cc
@@ -142,6 +142,14 @@ TF_BUILTIN(ToNumber, CodeStubAssembler) {
   Return(ToNumber(context, input));
 }
 
+// Like ToNumber, but also converts BigInts.
+TF_BUILTIN(ToNumberConvertBigInt, CodeStubAssembler) {
+  Node* context = Parameter(Descriptor::kContext);
+  Node* input = Parameter(Descriptor::kArgument);
+
+  Return(ToNumber(context, input, BigIntHandling::kConvertToNumber));
+}
+
 // ES section #sec-tostring-applied-to-the-number-type
 TF_BUILTIN(NumberToString, CodeStubAssembler) {
   TNode<Number> input = CAST(Parameter(Descriptor::kArgument));
diff --git a/deps/v8/src/builtins/builtins-date.cc b/deps/v8/src/builtins/builtins-date.cc
index e6d5846cc7eee9..0669963a0991a6 100644
--- a/deps/v8/src/builtins/builtins-date.cc
+++ b/deps/v8/src/builtins/builtins-date.cc
@@ -213,44 +213,45 @@ BUILTIN(DateConstructor) {
           time_val = ParseDateTimeString(isolate, Handle<String>::cast(value));
         } else {
           ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, value,
-                                             Object::ToNumber(value));
+                                             Object::ToNumber(isolate, value));
           time_val = value->Number();
         }
       }
     } else {
       Handle<Object> year_object;
       ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, year_object,
-                                         Object::ToNumber(args.at(1)));
+                                         Object::ToNumber(isolate, args.at(1)));
       Handle<Object> month_object;
       ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, month_object,
-                                         Object::ToNumber(args.at(2)));
+                                         Object::ToNumber(isolate, args.at(2)));
       double year = year_object->Number();
       double month = month_object->Number();
       double date = 1.0, hours = 0.0, minutes = 0.0, seconds = 0.0, ms = 0.0;
       if (argc >= 3) {
         Handle<Object> date_object;
-        ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, date_object,
-                                           Object::ToNumber(args.at(3)));
+        ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
+            isolate, date_object, Object::ToNumber(isolate, args.at(3)));
         date = date_object->Number();
         if (argc >= 4) {
           Handle<Object> hours_object;
-          ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, hours_object,
-                                             Object::ToNumber(args.at(4)));
+          ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
+              isolate, hours_object, Object::ToNumber(isolate, args.at(4)));
           hours = hours_object->Number();
           if (argc >= 5) {
             Handle<Object> minutes_object;
-            ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, minutes_object,
-                                               Object::ToNumber(args.at(5)));
+            ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
+                isolate, minutes_object, Object::ToNumber(isolate, args.at(5)));
             minutes = minutes_object->Number();
             if (argc >= 6) {
               Handle<Object> seconds_object;
-              ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, seconds_object,
-                                                 Object::ToNumber(args.at(6)));
+              ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
+                  isolate, seconds_object,
+                  Object::ToNumber(isolate, args.at(6)));
               seconds = seconds_object->Number();
               if (argc >= 7) {
                 Handle<Object> ms_object;
                 ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
-                    isolate, ms_object, Object::ToNumber(args.at(7)));
+                    isolate, ms_object, Object::ToNumber(isolate, args.at(7)));
                 ms = ms_object->Number();
               }
             }
@@ -302,37 +303,38 @@ BUILTIN(DateUTC) {
   if (argc >= 1) {
     Handle<Object> year_object;
     ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, year_object,
-                                       Object::ToNumber(args.at(1)));
+                                       Object::ToNumber(isolate, args.at(1)));
     year = year_object->Number();
     if (argc >= 2) {
       Handle<Object> month_object;
       ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, month_object,
-                                         Object::ToNumber(args.at(2)));
+                                         Object::ToNumber(isolate, args.at(2)));
       month = month_object->Number();
       if (argc >= 3) {
         Handle<Object> date_object;
-        ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, date_object,
-                                           Object::ToNumber(args.at(3)));
+        ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
+            isolate, date_object, Object::ToNumber(isolate, args.at(3)));
         date = date_object->Number();
         if (argc >= 4) {
           Handle<Object> hours_object;
-          ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, hours_object,
-                                             Object::ToNumber(args.at(4)));
+          ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
+              isolate, hours_object, Object::ToNumber(isolate, args.at(4)));
           hours = hours_object->Number();
           if (argc >= 5) {
             Handle<Object> minutes_object;
-            ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, minutes_object,
-                                               Object::ToNumber(args.at(5)));
+            ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
+                isolate, minutes_object, Object::ToNumber(isolate, args.at(5)));
             minutes = minutes_object->Number();
             if (argc >= 6) {
               Handle<Object> seconds_object;
-              ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, seconds_object,
-                                                 Object::ToNumber(args.at(6)));
+              ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
+                  isolate, seconds_object,
+                  Object::ToNumber(isolate, args.at(6)));
               seconds = seconds_object->Number();
               if (argc >= 7) {
                 Handle<Object> ms_object;
                 ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
-                    isolate, ms_object, Object::ToNumber(args.at(7)));
+                    isolate, ms_object, Object::ToNumber(isolate, args.at(7)));
                 ms = ms_object->Number();
               }
             }
@@ -356,7 +358,8 @@ BUILTIN(DatePrototypeSetDate) {
   HandleScope scope(isolate);
   CHECK_RECEIVER(JSDate, date, "Date.prototype.setDate");
   Handle<Object> value = args.atOrUndefined(isolate, 1);
-  ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, value, Object::ToNumber(value));
+  ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, value,
+                                     Object::ToNumber(isolate, value));
   double time_val = date->value()->Number();
   if (!std::isnan(time_val)) {
     int64_t const time_ms = static_cast<int64_t>(time_val);
@@ -376,7 +379,8 @@ BUILTIN(DatePrototypeSetFullYear) {
   CHECK_RECEIVER(JSDate, date, "Date.prototype.setFullYear");
   int const argc = args.length() - 1;
   Handle<Object> year = args.atOrUndefined(isolate, 1);
-  ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, year, Object::ToNumber(year));
+  ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, year,
+                                     Object::ToNumber(isolate, year));
   double y = year->Number(), m = 0.0, dt = 1.0;
   int time_within_day = 0;
   if (!std::isnan(date->value()->Number())) {
@@ -391,11 +395,13 @@ BUILTIN(DatePrototypeSetFullYear) {
   }
   if (argc >= 2) {
     Handle<Object> month = args.at(2);
-    ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, month, Object::ToNumber(month));
+    ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, month,
+                                       Object::ToNumber(isolate, month));
     m = month->Number();
     if (argc >= 3) {
       Handle<Object> date = args.at(3);
-      ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, date, Object::ToNumber(date));
+      ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, date,
+                                         Object::ToNumber(isolate, date));
       dt = date->Number();
     }
   }
@@ -409,7 +415,8 @@ BUILTIN(DatePrototypeSetHours) {
   CHECK_RECEIVER(JSDate, date, "Date.prototype.setHours");
   int const argc = args.length() - 1;
   Handle<Object> hour = args.atOrUndefined(isolate, 1);
-  ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, hour, Object::ToNumber(hour));
+  ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, hour,
+                                     Object::ToNumber(isolate, hour));
   double h = hour->Number();
   double time_val = date->value()->Number();
   if (!std::isnan(time_val)) {
@@ -422,15 +429,18 @@ BUILTIN(DatePrototypeSetHours) {
     double milli = time_within_day % 1000;
     if (argc >= 2) {
       Handle<Object> min = args.at(2);
-      ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, min, Object::ToNumber(min));
+      ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, min,
+                                         Object::ToNumber(isolate, min));
       m = min->Number();
       if (argc >= 3) {
         Handle<Object> sec = args.at(3);
-        ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, sec, Object::ToNumber(sec));
+        ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, sec,
+                                           Object::ToNumber(isolate, sec));
         s = sec->Number();
         if (argc >= 4) {
           Handle<Object> ms = args.at(4);
-          ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, ms, Object::ToNumber(ms));
+          ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, ms,
+                                             Object::ToNumber(isolate, ms));
           milli = ms->Number();
         }
       }
@@ -445,7 +455,8 @@ BUILTIN(DatePrototypeSetMilliseconds) {
   HandleScope scope(isolate);
   CHECK_RECEIVER(JSDate, date, "Date.prototype.setMilliseconds");
   Handle<Object> ms = args.atOrUndefined(isolate, 1);
-  ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, ms, Object::ToNumber(ms));
+  ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, ms,
+                                     Object::ToNumber(isolate, ms));
   double time_val = date->value()->Number();
   if (!std::isnan(time_val)) {
     int64_t const time_ms = static_cast<int64_t>(time_val);
@@ -466,7 +477,8 @@ BUILTIN(DatePrototypeSetMinutes) {
   CHECK_RECEIVER(JSDate, date, "Date.prototype.setMinutes");
   int const argc = args.length() - 1;
   Handle<Object> min = args.atOrUndefined(isolate, 1);
-  ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, min, Object::ToNumber(min));
+  ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, min,
+                                     Object::ToNumber(isolate, min));
   double time_val = date->value()->Number();
   if (!std::isnan(time_val)) {
     int64_t const time_ms = static_cast<int64_t>(time_val);
@@ -479,11 +491,13 @@ BUILTIN(DatePrototypeSetMinutes) {
     double milli = time_within_day % 1000;
     if (argc >= 2) {
       Handle<Object> sec = args.at(2);
-      ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, sec, Object::ToNumber(sec));
+      ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, sec,
+                                         Object::ToNumber(isolate, sec));
       s = sec->Number();
       if (argc >= 3) {
         Handle<Object> ms = args.at(3);
-        ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, ms, Object::ToNumber(ms));
+        ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, ms,
+                                           Object::ToNumber(isolate, ms));
         milli = ms->Number();
       }
     }
@@ -498,7 +512,8 @@ BUILTIN(DatePrototypeSetMonth) {
   CHECK_RECEIVER(JSDate, date, "Date.prototype.setMonth");
   int const argc = args.length() - 1;
   Handle<Object> month = args.atOrUndefined(isolate, 1);
-  ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, month, Object::ToNumber(month));
+  ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, month,
+                                     Object::ToNumber(isolate, month));
   double time_val = date->value()->Number();
   if (!std::isnan(time_val)) {
     int64_t const time_ms = static_cast<int64_t>(time_val);
@@ -511,7 +526,8 @@ BUILTIN(DatePrototypeSetMonth) {
     double dt = day;
     if (argc >= 2) {
       Handle<Object> date = args.at(2);
-      ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, date, Object::ToNumber(date));
+      ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, date,
+                                         Object::ToNumber(isolate, date));
       dt = date->Number();
     }
     time_val = MakeDate(MakeDay(year, m, dt), time_within_day);
@@ -525,7 +541,8 @@ BUILTIN(DatePrototypeSetSeconds) {
   CHECK_RECEIVER(JSDate, date, "Date.prototype.setSeconds");
   int const argc = args.length() - 1;
   Handle<Object> sec = args.atOrUndefined(isolate, 1);
-  ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, sec, Object::ToNumber(sec));
+  ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, sec,
+                                     Object::ToNumber(isolate, sec));
   double time_val = date->value()->Number();
   if (!std::isnan(time_val)) {
     int64_t const time_ms = static_cast<int64_t>(time_val);
@@ -538,7 +555,8 @@ BUILTIN(DatePrototypeSetSeconds) {
     double milli = time_within_day % 1000;
     if (argc >= 2) {
       Handle<Object> ms = args.at(2);
-      ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, ms, Object::ToNumber(ms));
+      ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, ms,
+                                         Object::ToNumber(isolate, ms));
       milli = ms->Number();
     }
     time_val = MakeDate(day, MakeTime(h, m, s, milli));
@@ -551,7 +569,8 @@ BUILTIN(DatePrototypeSetTime) {
   HandleScope scope(isolate);
   CHECK_RECEIVER(JSDate, date, "Date.prototype.setTime");
   Handle<Object> value = args.atOrUndefined(isolate, 1);
-  ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, value, Object::ToNumber(value));
+  ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, value,
+                                     Object::ToNumber(isolate, value));
   return *JSDate::SetValue(date, DateCache::TimeClip(value->Number()));
 }
 
@@ -560,7 +579,8 @@ BUILTIN(DatePrototypeSetUTCDate) {
   HandleScope scope(isolate);
   CHECK_RECEIVER(JSDate, date, "Date.prototype.setUTCDate");
   Handle<Object> value = args.atOrUndefined(isolate, 1);
-  ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, value, Object::ToNumber(value));
+  ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, value,
+                                     Object::ToNumber(isolate, value));
   if (std::isnan(date->value()->Number())) return date->value();
   int64_t const time_ms = static_cast<int64_t>(date->value()->Number());
   int const days = isolate->date_cache()->DaysFromTime(time_ms);
@@ -578,7 +598,8 @@ BUILTIN(DatePrototypeSetUTCFullYear) {
   CHECK_RECEIVER(JSDate, date, "Date.prototype.setUTCFullYear");
   int const argc = args.length() - 1;
   Handle<Object> year = args.atOrUndefined(isolate, 1);
-  ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, year, Object::ToNumber(year));
+  ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, year,
+                                     Object::ToNumber(isolate, year));
   double y = year->Number(), m = 0.0, dt = 1.0;
   int time_within_day = 0;
   if (!std::isnan(date->value()->Number())) {
@@ -592,11 +613,13 @@ BUILTIN(DatePrototypeSetUTCFullYear) {
   }
   if (argc >= 2) {
     Handle<Object> month = args.at(2);
-    ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, month, Object::ToNumber(month));
+    ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, month,
+                                       Object::ToNumber(isolate, month));
     m = month->Number();
     if (argc >= 3) {
       Handle<Object> date = args.at(3);
-      ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, date, Object::ToNumber(date));
+      ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, date,
+                                         Object::ToNumber(isolate, date));
       dt = date->Number();
     }
   }
@@ -610,7 +633,8 @@ BUILTIN(DatePrototypeSetUTCHours) {
   CHECK_RECEIVER(JSDate, date, "Date.prototype.setUTCHours");
   int const argc = args.length() - 1;
   Handle<Object> hour = args.atOrUndefined(isolate, 1);
-  ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, hour, Object::ToNumber(hour));
+  ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, hour,
+                                     Object::ToNumber(isolate, hour));
   double h = hour->Number();
   double time_val = date->value()->Number();
   if (!std::isnan(time_val)) {
@@ -622,15 +646,18 @@ BUILTIN(DatePrototypeSetUTCHours) {
     double milli = time_within_day % 1000;
     if (argc >= 2) {
       Handle<Object> min = args.at(2);
-      ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, min, Object::ToNumber(min));
+      ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, min,
+                                         Object::ToNumber(isolate, min));
       m = min->Number();
       if (argc >= 3) {
         Handle<Object> sec = args.at(3);
-        ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, sec, Object::ToNumber(sec));
+        ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, sec,
+                                           Object::ToNumber(isolate, sec));
         s = sec->Number();
         if (argc >= 4) {
           Handle<Object> ms = args.at(4);
-          ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, ms, Object::ToNumber(ms));
+          ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, ms,
+                                             Object::ToNumber(isolate, ms));
           milli = ms->Number();
         }
       }
@@ -645,7 +672,8 @@ BUILTIN(DatePrototypeSetUTCMilliseconds) {
   HandleScope scope(isolate);
   CHECK_RECEIVER(JSDate, date, "Date.prototype.setUTCMilliseconds");
   Handle<Object> ms = args.atOrUndefined(isolate, 1);
-  ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, ms, Object::ToNumber(ms));
+  ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, ms,
+                                     Object::ToNumber(isolate, ms));
   double time_val = date->value()->Number();
   if (!std::isnan(time_val)) {
     int64_t const time_ms = static_cast<int64_t>(time_val);
@@ -665,7 +693,8 @@ BUILTIN(DatePrototypeSetUTCMinutes) {
   CHECK_RECEIVER(JSDate, date, "Date.prototype.setUTCMinutes");
   int const argc = args.length() - 1;
   Handle<Object> min = args.atOrUndefined(isolate, 1);
-  ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, min, Object::ToNumber(min));
+  ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, min,
+                                     Object::ToNumber(isolate, min));
   double time_val = date->value()->Number();
   if (!std::isnan(time_val)) {
     int64_t const time_ms = static_cast<int64_t>(time_val);
@@ -677,11 +706,13 @@ BUILTIN(DatePrototypeSetUTCMinutes) {
     double milli = time_within_day % 1000;
     if (argc >= 2) {
       Handle<Object> sec = args.at(2);
-      ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, sec, Object::ToNumber(sec));
+      ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, sec,
+                                         Object::ToNumber(isolate, sec));
       s = sec->Number();
       if (argc >= 3) {
         Handle<Object> ms = args.at(3);
-        ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, ms, Object::ToNumber(ms));
+        ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, ms,
+                                           Object::ToNumber(isolate, ms));
         milli = ms->Number();
       }
     }
@@ -696,7 +727,8 @@ BUILTIN(DatePrototypeSetUTCMonth) {
   CHECK_RECEIVER(JSDate, date, "Date.prototype.setUTCMonth");
   int const argc = args.length() - 1;
   Handle<Object> month = args.atOrUndefined(isolate, 1);
-  ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, month, Object::ToNumber(month));
+  ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, month,
+                                     Object::ToNumber(isolate, month));
   double time_val = date->value()->Number();
   if (!std::isnan(time_val)) {
     int64_t const time_ms = static_cast<int64_t>(time_val);
@@ -708,7 +740,8 @@ BUILTIN(DatePrototypeSetUTCMonth) {
     double dt = day;
     if (argc >= 2) {
       Handle<Object> date = args.at(2);
-      ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, date, Object::ToNumber(date));
+      ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, date,
+                                         Object::ToNumber(isolate, date));
       dt = date->Number();
     }
     time_val = MakeDate(MakeDay(year, m, dt), time_within_day);
@@ -722,7 +755,8 @@ BUILTIN(DatePrototypeSetUTCSeconds) {
   CHECK_RECEIVER(JSDate, date, "Date.prototype.setUTCSeconds");
   int const argc = args.length() - 1;
   Handle<Object> sec = args.atOrUndefined(isolate, 1);
-  ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, sec, Object::ToNumber(sec));
+  ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, sec,
+                                     Object::ToNumber(isolate, sec));
   double time_val = date->value()->Number();
   if (!std::isnan(time_val)) {
     int64_t const time_ms = static_cast<int64_t>(time_val);
@@ -734,7 +768,8 @@ BUILTIN(DatePrototypeSetUTCSeconds) {
     double milli = time_within_day % 1000;
     if (argc >= 2) {
       Handle<Object> ms = args.at(2);
-      ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, ms, Object::ToNumber(ms));
+      ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, ms,
+                                         Object::ToNumber(isolate, ms));
       milli = ms->Number();
     }
     time_val = MakeDate(day, MakeTime(h, m, s, milli));
@@ -840,7 +875,8 @@ BUILTIN(DatePrototypeSetYear) {
   HandleScope scope(isolate);
   CHECK_RECEIVER(JSDate, date, "Date.prototype.setYear");
   Handle<Object> year = args.atOrUndefined(isolate, 1);
-  ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, year, Object::ToNumber(year));
+  ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, year,
+                                     Object::ToNumber(isolate, year));
   double m = 0.0, dt = 1.0, y = year->Number();
   if (0.0 <= y && y <= 99.0) {
     y = 1900.0 + DoubleToInteger(y);
@@ -877,8 +913,8 @@ BUILTIN(DatePrototypeToJson) {
     Handle<String> name =
         isolate->factory()->NewStringFromAsciiChecked("toISOString");
     Handle<Object> function;
-    ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, function,
-                                       Object::GetProperty(receiver_obj, name));
+    ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
+        isolate, function, Object::GetProperty(isolate, receiver_obj, name));
     if (!function->IsCallable()) {
       THROW_NEW_ERROR_RETURN_FAILURE(
           isolate, NewTypeError(MessageTemplate::kCalledNonCallable, name));
diff --git a/deps/v8/src/builtins/builtins-definitions.h b/deps/v8/src/builtins/builtins-definitions.h
index 46b02d88d81719..78f4b712db48b8 100644
--- a/deps/v8/src/builtins/builtins-definitions.h
+++ b/deps/v8/src/builtins/builtins-definitions.h
@@ -186,6 +186,7 @@ namespace internal {
   TFC(NonNumberToNumber, TypeConversion, 1)                                    \
   TFC(NonNumberToNumeric, TypeConversion, 1)                                   \
   TFC(ToNumber, TypeConversion, 1)                                             \
+  TFC(ToNumberConvertBigInt, TypeConversion, 1)                                \
   TFC(ToNumeric, TypeConversion, 1)                                            \
   TFC(NumberToString, TypeConversion, 1)                                       \
   TFC(ToString, TypeConversion, 1)                                             \
@@ -1340,14 +1341,22 @@ namespace internal {
   CPP(LocalePrototypeNumeric)                                          \
   CPP(LocalePrototypeNumberingSystem)                                  \
   CPP(LocalePrototypeToString)                                         \
+  /* ecma402 #sec-Intl.Locale.prototype.maximize */                    \
+  CPP(LocalePrototypeMaximize)                                         \
+  /* ecma402 #sec-Intl.Locale.prototype.minimize */                    \
+  CPP(LocalePrototypeMinimize)                                         \
   /* ecma402 #sec-number-format-functions */                           \
   CPP(NumberFormatInternalFormatNumber)                                \
   /* ecma402 #sec-intl.numberformat.prototype.format */                \
   CPP(NumberFormatPrototypeFormatNumber)                               \
-  /* ecma402 #sec-intl-relativetimeformat-constructor */               \
+  /* ecma402 #sec-intl.RelativeTimeFormat.constructor */               \
   CPP(RelativeTimeFormatConstructor)                                   \
-  /* ecma402 #sec-intl.relativetimeformat.prototype.resolvedoptions */ \
-  CPP(RelativeTimeFormatPrototypeResolvedOptions)
+  /* ecma402 #sec-intl.RelativeTimeFormat.prototype.resolvedOptions */ \
+  CPP(RelativeTimeFormatPrototypeResolvedOptions)                      \
+  /* ecma402 #sec-intl.RelativeTimeFormat.prototype.format */          \
+  CPP(RelativeTimeFormatPrototypeFormat)                               \
+  /* ecma402 #sec-intl.RelativeTimeFormat.prototype.formatToParts */   \
+  CPP(RelativeTimeFormatPrototypeFormatToParts)
 #else
 #define BUILTIN_LIST(CPP, API, TFJ, TFC, TFS, TFH, ASM)    \
   BUILTIN_LIST_BASE(CPP, API, TFJ, TFC, TFS, TFH, ASM)     \
diff --git a/deps/v8/src/builtins/builtins-function.cc b/deps/v8/src/builtins/builtins-function.cc
index d0e96847c9a5d2..663eedc29a1aab 100644
--- a/deps/v8/src/builtins/builtins-function.cc
+++ b/deps/v8/src/builtins/builtins-function.cc
@@ -270,14 +270,14 @@ Object* DoFunctionBind(Isolate* isolate, BuiltinArguments args) {
     if (target_name->IsString()) {
       ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
           isolate, name,
-          Name::ToFunctionName(Handle<String>::cast(target_name)));
+          Name::ToFunctionName(isolate, Handle<String>::cast(target_name)));
       ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
           isolate, name, isolate->factory()->NewConsString(
                              isolate->factory()->bound__string(), name));
     } else {
       name = isolate->factory()->bound__string();
     }
-    LookupIterator it(function, isolate->factory()->name_string());
+    LookupIterator it(isolate, function, isolate->factory()->name_string());
     DCHECK_EQ(LookupIterator::ACCESSOR, it.state());
     RETURN_FAILURE_ON_EXCEPTION(isolate,
                                 JSObject::DefineOwnPropertyIgnoreAttributes(
diff --git a/deps/v8/src/builtins/builtins-intl.cc b/deps/v8/src/builtins/builtins-intl.cc
index 3c16f0b23e6050..e07eef0cbcce5e 100644
--- a/deps/v8/src/builtins/builtins-intl.cc
+++ b/deps/v8/src/builtins/builtins-intl.cc
@@ -6,6 +6,8 @@
 #error Internationalization is expected to be enabled.
 #endif  // V8_INTL_SUPPORT
 
+#include <cmath>
+
 #include "src/builtins/builtins-intl.h"
 #include "src/builtins/builtins-utils.h"
 #include "src/builtins/builtins.h"
@@ -22,10 +24,12 @@
 #include "unicode/fpositer.h"
 #include "unicode/normalizer2.h"
 #include "unicode/numfmt.h"
+#include "unicode/reldatefmt.h"
 #include "unicode/smpdtfmt.h"
 #include "unicode/udat.h"
 #include "unicode/ufieldpositer.h"
 #include "unicode/unistr.h"
+#include "unicode/ureldatefmt.h"
 #include "unicode/ustring.h"
 
 namespace v8 {
@@ -212,11 +216,11 @@ Handle<String> IcuDateFieldIdToDateType(int32_t field_id, Isolate* isolate) {
   }
 }
 
-bool AddElement(Handle<JSArray> array, int index,
-                Handle<String> field_type_string,
-                const icu::UnicodeString& formatted, int32_t begin, int32_t end,
-                Isolate* isolate) {
-  HandleScope scope(isolate);
+MaybeHandle<JSObject> InnerAddElement(Isolate* isolate, Handle<JSArray> array,
+                                      int index,
+                                      Handle<String> field_type_string,
+                                      const icu::UnicodeString& formatted,
+                                      int32_t begin, int32_t end) {
   Factory* factory = isolate->factory();
   Handle<JSObject> element = factory->NewJSObject(isolate->object_function());
   Handle<String> value;
@@ -224,16 +228,42 @@ bool AddElement(Handle<JSArray> array, int index,
                         field_type_string, NONE);
 
   icu::UnicodeString field(formatted.tempSubStringBetween(begin, end));
-  ASSIGN_RETURN_ON_EXCEPTION_VALUE(
+  ASSIGN_RETURN_ON_EXCEPTION(
       isolate, value,
       factory->NewStringFromTwoByte(Vector<const uint16_t>(
           reinterpret_cast<const uint16_t*>(field.getBuffer()),
           field.length())),
-      false);
+      JSObject);
 
   JSObject::AddProperty(isolate, element, factory->value_string(), value, NONE);
   JSObject::AddDataElement(array, index, element, NONE);
-  return true;
+  return element;
+}
+
+Maybe<bool> AddElement(Isolate* isolate, Handle<JSArray> array, int index,
+                       Handle<String> field_type_string,
+                       const icu::UnicodeString& formatted, int32_t begin,
+                       int32_t end) {
+  RETURN_ON_EXCEPTION_VALUE(
+      isolate,
+      InnerAddElement(isolate, array, index, field_type_string, formatted,
+                      begin, end),
+      Nothing<bool>());
+  return Just(true);
+}
+
+Maybe<bool> AddElement(Isolate* isolate, Handle<JSArray> array, int index,
+                       Handle<String> field_type_string,
+                       const icu::UnicodeString& formatted, int32_t begin,
+                       int32_t end, Handle<String> name, Handle<String> value) {
+  Handle<JSObject> element;
+  ASSIGN_RETURN_ON_EXCEPTION_VALUE(
+      isolate, element,
+      InnerAddElement(isolate, array, index, field_type_string, formatted,
+                      begin, end),
+      Nothing<bool>());
+  JSObject::AddProperty(isolate, element, name, value, NONE);
+  return Just(true);
 }
 
 bool cmp_NumberFormatSpan(const NumberFormatSpan& a,
@@ -289,10 +319,10 @@ Object* FormatNumberToParts(Isolate* isolate, icu::NumberFormat* fmt,
         part.field_id == -1
             ? isolate->factory()->literal_string()
             : IcuNumberFieldIdToNumberType(part.field_id, number, isolate);
-    if (!AddElement(result, index, field_type_string, formatted, part.begin_pos,
-                    part.end_pos, isolate)) {
-      return ReadOnlyRoots(isolate).undefined_value();
-    }
+    Maybe<bool> maybe_added_element =
+        AddElement(isolate, result, index, field_type_string, formatted,
+                   part.begin_pos, part.end_pos);
+    MAYBE_RETURN(maybe_added_element, ReadOnlyRoots(isolate).undefined_value());
     ++index;
   }
   JSObject::ValidateElements(*result);
@@ -322,25 +352,26 @@ Object* FormatDateToParts(Isolate* isolate, icu::DateFormat* format,
     int32_t end_pos = fp.getEndIndex();
 
     if (previous_end_pos < begin_pos) {
-      if (!AddElement(result, index, IcuDateFieldIdToDateType(-1, isolate),
-                      formatted, previous_end_pos, begin_pos, isolate)) {
-        return ReadOnlyRoots(isolate).undefined_value();
-      }
+      Maybe<bool> maybe_added_element = AddElement(
+          isolate, result, index, IcuDateFieldIdToDateType(-1, isolate),
+          formatted, previous_end_pos, begin_pos);
+      MAYBE_RETURN(maybe_added_element,
+                   ReadOnlyRoots(isolate).undefined_value());
       ++index;
     }
-    if (!AddElement(result, index,
-                    IcuDateFieldIdToDateType(fp.getField(), isolate), formatted,
-                    begin_pos, end_pos, isolate)) {
-      return ReadOnlyRoots(isolate).undefined_value();
-    }
+    Maybe<bool> maybe_added_element =
+        AddElement(isolate, result, index,
+                   IcuDateFieldIdToDateType(fp.getField(), isolate), formatted,
+                   begin_pos, end_pos);
+    MAYBE_RETURN(maybe_added_element, ReadOnlyRoots(isolate).undefined_value());
     previous_end_pos = end_pos;
     ++index;
   }
   if (previous_end_pos < length) {
-    if (!AddElement(result, index, IcuDateFieldIdToDateType(-1, isolate),
-                    formatted, previous_end_pos, length, isolate)) {
-      return ReadOnlyRoots(isolate).undefined_value();
-    }
+    Maybe<bool> maybe_added_element = AddElement(
+        isolate, result, index, IcuDateFieldIdToDateType(-1, isolate),
+        formatted, previous_end_pos, length);
+    MAYBE_RETURN(maybe_added_element, ReadOnlyRoots(isolate).undefined_value());
   }
   JSObject::ValidateElements(*result);
   return *result;
@@ -455,7 +486,7 @@ BUILTIN(NumberFormatPrototypeFormatToParts) {
   Handle<Object> x;
   if (args.length() >= 2) {
     ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, x,
-                                       Object::ToNumber(args.at(1)));
+                                       Object::ToNumber(isolate, args.at(1)));
   } else {
     x = isolate->factory()->nan_value();
   }
@@ -487,7 +518,7 @@ BUILTIN(DateTimeFormatPrototypeFormatToParts) {
     x = factory->NewNumber(JSDate::CurrentTimeValue(isolate));
   } else {
     ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, x,
-                                       Object::ToNumber(args.at(1)));
+                                       Object::ToNumber(isolate, args.at(1)));
   }
 
   double date_value = DateCache::TimeClip(x->Number());
@@ -580,7 +611,7 @@ BUILTIN(NumberFormatInternalFormatNumber) {
   // 4. Let x be ? ToNumber(value).
   Handle<Object> number_obj;
   ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, number_obj,
-                                     Object::ToNumber(value));
+                                     Object::ToNumber(isolate, value));
 
   // Spec treats -0 as 0.
   if (number_obj->IsMinusZero()) {
@@ -593,7 +624,46 @@ BUILTIN(NumberFormatInternalFormatNumber) {
                                         isolate, number_format_holder, number));
 }
 
-// Intl.Locale implementation
+namespace {
+
+MaybeHandle<JSLocale> CreateLocale(Isolate* isolate,
+                                   Handle<JSFunction> constructor,
+                                   Handle<JSReceiver> new_target,
+                                   Handle<Object> tag, Handle<Object> options) {
+  Handle<JSObject> result;
+  ASSIGN_RETURN_ON_EXCEPTION(isolate, result,
+                             JSObject::New(constructor, new_target), JSLocale);
+
+  // First parameter is a locale, as a string/object. Can't be empty.
+  if (!tag->IsName() && !tag->IsJSReceiver()) {
+    THROW_NEW_ERROR(isolate, NewTypeError(MessageTemplate::kLocaleNotEmpty),
+                    JSLocale);
+  }
+
+  Handle<String> locale_string;
+  if (tag->IsJSLocale() && Handle<JSLocale>::cast(tag)->locale()->IsString()) {
+    locale_string =
+        Handle<String>(Handle<JSLocale>::cast(tag)->locale(), isolate);
+  } else {
+    ASSIGN_RETURN_ON_EXCEPTION(isolate, locale_string,
+                               Object::ToString(isolate, tag), JSLocale);
+  }
+
+  Handle<JSReceiver> options_object;
+  if (options->IsNullOrUndefined(isolate)) {
+    // Make empty options bag.
+    options_object = isolate->factory()->NewJSObjectWithNullProto();
+  } else {
+    ASSIGN_RETURN_ON_EXCEPTION(isolate, options_object,
+                               Object::ToObject(isolate, options), JSLocale);
+  }
+
+  return JSLocale::InitializeLocale(isolate, Handle<JSLocale>::cast(result),
+                                    locale_string, options_object);
+}
+
+}  // namespace
+
 BUILTIN(LocaleConstructor) {
   HandleScope scope(isolate);
   if (args.new_target()->IsUndefined(isolate)) {  // [[Call]]
@@ -601,85 +671,245 @@ BUILTIN(LocaleConstructor) {
         isolate, NewTypeError(MessageTemplate::kConstructorNotFunction,
                               isolate->factory()->NewStringFromAsciiChecked(
                                   "Intl.Locale")));
-  } else {  // [[Construct]]
-    Handle<JSFunction> target = args.target();
-    Handle<JSReceiver> new_target = Handle<JSReceiver>::cast(args.new_target());
+  }
+  // [[Construct]]
+  Handle<JSFunction> target = args.target();
+  Handle<JSReceiver> new_target = Handle<JSReceiver>::cast(args.new_target());
 
-    Handle<JSObject> result;
-    ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, result,
-                                       JSObject::New(target, new_target));
+  Handle<Object> tag = args.atOrUndefined(isolate, 1);
+  Handle<Object> options = args.atOrUndefined(isolate, 2);
 
-    Handle<Object> tag = args.atOrUndefined(isolate, 1);
-    Handle<Object> options = args.atOrUndefined(isolate, 2);
+  RETURN_RESULT_OR_FAILURE(
+      isolate, CreateLocale(isolate, target, new_target, tag, options));
+}
 
-    // First parameter is a locale, as a string/object. Can't be empty.
-    if (!tag->IsName() && !tag->IsJSReceiver()) {
-      THROW_NEW_ERROR_RETURN_FAILURE(
-          isolate, NewTypeError(MessageTemplate::kLocaleNotEmpty));
-    }
+BUILTIN(LocalePrototypeMaximize) {
+  HandleScope scope(isolate);
+  CHECK_RECEIVER(JSLocale, locale_holder, "Intl.Locale.prototype.maximize");
+  Handle<JSFunction> constructor(
+      isolate->native_context()->intl_locale_function(), isolate);
+  RETURN_RESULT_OR_FAILURE(
+      isolate,
+      CreateLocale(isolate, constructor, constructor,
+                   JSLocale::Maximize(isolate, locale_holder->locale()),
+                   isolate->factory()->NewJSObjectWithNullProto()));
+}
 
-    Handle<String> locale_string;
-    if (tag->IsJSLocale() &&
-        Handle<JSLocale>::cast(tag)->locale()->IsString()) {
-      locale_string =
-          Handle<String>(Handle<JSLocale>::cast(tag)->locale(), isolate);
-    } else {
-      ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, locale_string,
-                                         Object::ToString(isolate, tag));
+BUILTIN(LocalePrototypeMinimize) {
+  HandleScope scope(isolate);
+  CHECK_RECEIVER(JSLocale, locale_holder, "Intl.Locale.prototype.minimize");
+  Handle<JSFunction> constructor(
+      isolate->native_context()->intl_locale_function(), isolate);
+  RETURN_RESULT_OR_FAILURE(
+      isolate,
+      CreateLocale(isolate, constructor, constructor,
+                   JSLocale::Minimize(isolate, locale_holder->locale()),
+                   isolate->factory()->NewJSObjectWithNullProto()));
+}
+
+namespace {
+
+MaybeHandle<JSArray> GenerateRelativeTimeFormatParts(
+    Isolate* isolate, icu::UnicodeString formatted,
+    icu::UnicodeString integer_part, Handle<String> unit) {
+  Factory* factory = isolate->factory();
+  Handle<JSArray> array = factory->NewJSArray(0);
+  int32_t found = formatted.indexOf(integer_part);
+
+  if (found < 0) {
+    // Cannot find the integer_part in the formatted.
+    // Return [{'type': 'literal', 'value': formatted}]
+    Maybe<bool> maybe_added_element =
+        AddElement(isolate, array,
+                   0,                          // index
+                   factory->literal_string(),  // field_type_string
+                   formatted,
+                   0,                    // begin
+                   formatted.length());  // end
+    MAYBE_RETURN(maybe_added_element, MaybeHandle<JSArray>());
+
+  } else {
+    // Found the formatted integer in the result.
+    int index = 0;
+
+    // array.push({
+    //     'type': 'literal',
+    //     'value': formatted.substring(0, found)})
+    if (found > 0) {
+      Maybe<bool> maybe_added_element =
+          AddElement(isolate, array, index++,
+                     factory->literal_string(),  // field_type_string
+                     formatted,
+                     0,       // begin
+                     found);  // end
+      MAYBE_RETURN(maybe_added_element, MaybeHandle<JSArray>());
     }
 
-    Handle<JSReceiver> options_object;
-    if (options->IsNullOrUndefined(isolate)) {
-      // Make empty options bag.
-      options_object = isolate->factory()->NewJSObjectWithNullProto();
-    } else {
-      ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, options_object,
-                                         Object::ToObject(isolate, options));
+    // array.push({
+    //     'type': 'integer',
+    //     'value': formatted.substring(found, found + integer_part.length),
+    //     'unit': unit})
+    Maybe<bool> maybe_added_element =
+        AddElement(isolate, array, index++,
+                   factory->integer_string(),  // field_type_string
+                   formatted,
+                   found,                          // begin
+                   found + integer_part.length(),  // end
+                   factory->unit_string(), unit);
+    MAYBE_RETURN(maybe_added_element, MaybeHandle<JSArray>());
+
+    // array.push({
+    //     'type': 'literal',
+    //     'value': formatted.substring(
+    //         found + integer_part.length, formatted.length)})
+    if (found + integer_part.length() < formatted.length()) {
+      Maybe<bool> maybe_added_element =
+          AddElement(isolate, array, index,
+                     factory->literal_string(),  // field_type_string
+                     formatted,
+                     found + integer_part.length(),  // begin
+                     formatted.length());            // end
+      MAYBE_RETURN(maybe_added_element, MaybeHandle<JSArray>());
     }
+  }
+  return array;
+}
 
-    RETURN_RESULT_OR_FAILURE(
-        isolate,
-        JSLocale::InitializeLocale(isolate, Handle<JSLocale>::cast(result),
-                                   locale_string, options_object));
+bool GetURelativeDateTimeUnit(Handle<String> unit,
+                              URelativeDateTimeUnit* unit_enum) {
+  std::unique_ptr<char[]> unit_str = unit->ToCString();
+  if ((strcmp("second", unit_str.get()) == 0) ||
+      (strcmp("seconds", unit_str.get()) == 0)) {
+    *unit_enum = UDAT_REL_UNIT_SECOND;
+  } else if ((strcmp("minute", unit_str.get()) == 0) ||
+             (strcmp("minutes", unit_str.get()) == 0)) {
+    *unit_enum = UDAT_REL_UNIT_MINUTE;
+  } else if ((strcmp("hour", unit_str.get()) == 0) ||
+             (strcmp("hours", unit_str.get()) == 0)) {
+    *unit_enum = UDAT_REL_UNIT_HOUR;
+  } else if ((strcmp("day", unit_str.get()) == 0) ||
+             (strcmp("days", unit_str.get()) == 0)) {
+    *unit_enum = UDAT_REL_UNIT_DAY;
+  } else if ((strcmp("week", unit_str.get()) == 0) ||
+             (strcmp("weeks", unit_str.get()) == 0)) {
+    *unit_enum = UDAT_REL_UNIT_WEEK;
+  } else if ((strcmp("month", unit_str.get()) == 0) ||
+             (strcmp("months", unit_str.get()) == 0)) {
+    *unit_enum = UDAT_REL_UNIT_MONTH;
+  } else if ((strcmp("quarter", unit_str.get()) == 0) ||
+             (strcmp("quarters", unit_str.get()) == 0)) {
+    *unit_enum = UDAT_REL_UNIT_QUARTER;
+  } else if ((strcmp("year", unit_str.get()) == 0) ||
+             (strcmp("years", unit_str.get()) == 0)) {
+    *unit_enum = UDAT_REL_UNIT_YEAR;
+  } else {
+    return false;
   }
+  return true;
 }
 
-BUILTIN(RelativeTimeFormatConstructor) {
-  HandleScope scope(isolate);
-  // 1. If NewTarget is undefined, throw a TypeError exception.
-  if (args.new_target()->IsUndefined(isolate)) {  // [[Call]]
+Object* RelativeTimeFormatPrototypeFormatCommon(
+    BuiltinArguments args, Isolate* isolate,
+    Handle<JSRelativeTimeFormat> format_holder, const char* func_name,
+    bool to_parts) {
+  Factory* factory = isolate->factory();
+  Handle<Object> value_obj = args.atOrUndefined(isolate, 1);
+  Handle<Object> unit_obj = args.atOrUndefined(isolate, 2);
+
+  // 3. Let value be ? ToNumber(value).
+  Handle<Object> value;
+  ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, value,
+                                     Object::ToNumber(isolate, value_obj));
+  double number = value->Number();
+  // 4. Let unit be ? ToString(unit).
+  Handle<String> unit;
+  ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, unit,
+                                     Object::ToString(isolate, unit_obj));
+
+  // 4. If isFinite(value) is false, then throw a RangeError exception.
+  if (!std::isfinite(number)) {
     THROW_NEW_ERROR_RETURN_FAILURE(
-        isolate, NewTypeError(MessageTemplate::kConstructorNotFunction,
-                              isolate->factory()->NewStringFromStaticChars(
-                                  "Intl.RelativeTimeFormat")));
+        isolate, NewRangeError(
+                     MessageTemplate::kNotFiniteNumber,
+                     isolate->factory()->NewStringFromAsciiChecked(func_name)));
   }
-  // [[Construct]]
-  Handle<JSFunction> target = args.target();
-  Handle<JSReceiver> new_target = Handle<JSReceiver>::cast(args.new_target());
 
-  Handle<JSObject> result;
-  // 2. Let relativeTimeFormat be
-  //    ! OrdinaryCreateFromConstructor(NewTarget,
-  //                                    "%RelativeTimeFormatPrototype%").
-  ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, result,
-                                     JSObject::New(target, new_target));
+  icu::RelativeDateTimeFormatter* formatter =
+      JSRelativeTimeFormat::UnpackFormatter(isolate, format_holder);
+  CHECK_NOT_NULL(formatter);
 
-  Handle<Object> locales = args.atOrUndefined(isolate, 1);
-  Handle<Object> options = args.atOrUndefined(isolate, 2);
+  URelativeDateTimeUnit unit_enum;
+  if (!GetURelativeDateTimeUnit(unit, &unit_enum)) {
+    THROW_NEW_ERROR_RETURN_FAILURE(
+        isolate,
+        NewRangeError(MessageTemplate::kInvalidUnit,
+                      isolate->factory()->NewStringFromAsciiChecked(func_name),
+                      unit));
+  }
+
+  UErrorCode status = U_ZERO_ERROR;
+  icu::UnicodeString formatted;
+  if (unit_enum == UDAT_REL_UNIT_QUARTER) {
+    // ICU have not yet implement UDAT_REL_UNIT_QUARTER.
+  } else {
+    if (format_holder->numeric() == JSRelativeTimeFormat::Numeric::ALWAYS) {
+      formatter->formatNumeric(number, unit_enum, formatted, status);
+    } else {
+      DCHECK_EQ(JSRelativeTimeFormat::Numeric::AUTO, format_holder->numeric());
+      formatter->format(number, unit_enum, formatted, status);
+    }
+  }
+
+  if (U_FAILURE(status)) {
+    // Internal ICU error.
+    return ReadOnlyRoots(isolate).undefined_value();
+  }
+
+  if (to_parts) {
+    icu::UnicodeString integer;
+    icu::FieldPosition pos;
+    formatter->getNumberFormat().format(std::abs(number), integer, pos, status);
+    if (U_FAILURE(status)) {
+      // Internal ICU error.
+      return ReadOnlyRoots(isolate).undefined_value();
+    }
+    Handle<JSArray> elements;
+    ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
+        isolate, elements,
+        GenerateRelativeTimeFormatParts(isolate, formatted, integer, unit));
+    return *elements;
+  }
 
-  // 3. Return ? InitializeRelativeTimeFormat(relativeTimeFormat, locales,
-  //                                          options).
   RETURN_RESULT_OR_FAILURE(
-      isolate, JSRelativeTimeFormat::InitializeRelativeTimeFormat(
-                   isolate, Handle<JSRelativeTimeFormat>::cast(result), locales,
-                   options));
+      isolate, factory->NewStringFromTwoByte(Vector<const uint16_t>(
+                   reinterpret_cast<const uint16_t*>(formatted.getBuffer()),
+                   formatted.length())));
 }
 
-BUILTIN(RelativeTimeFormatPrototypeResolvedOptions) {
+}  // namespace
+
+BUILTIN(RelativeTimeFormatPrototypeFormat) {
   HandleScope scope(isolate);
+  // 1. Let relativeTimeFormat be the this value.
+  // 2. If Type(relativeTimeFormat) is not Object or relativeTimeFormat does not
+  //    have an [[InitializedRelativeTimeFormat]] internal slot whose value is
+  //    true, throw a TypeError exception.
   CHECK_RECEIVER(JSRelativeTimeFormat, format_holder,
-                 "Intl.RelativeTimeFormat.prototype.resolvedOptions");
-  return *JSRelativeTimeFormat::ResolvedOptions(isolate, format_holder);
+                 "Intl.RelativeTimeFormat.prototype.format");
+  return RelativeTimeFormatPrototypeFormatCommon(args, isolate, format_holder,
+                                                 "format", false);
+}
+
+BUILTIN(RelativeTimeFormatPrototypeFormatToParts) {
+  HandleScope scope(isolate);
+  // 1. Let relativeTimeFormat be the this value.
+  // 2. If Type(relativeTimeFormat) is not Object or relativeTimeFormat does not
+  //    have an [[InitializedRelativeTimeFormat]] internal slot whose value is
+  //    true, throw a TypeError exception.
+  CHECK_RECEIVER(JSRelativeTimeFormat, format_holder,
+                 "Intl.RelativeTimeFormat.prototype.formatToParts");
+  return RelativeTimeFormatPrototypeFormatCommon(args, isolate, format_holder,
+                                                 "formatToParts", true);
 }
 
 // Locale getters.
@@ -762,5 +992,43 @@ BUILTIN(LocalePrototypeToString) {
   return locale_holder->locale();
 }
 
+BUILTIN(RelativeTimeFormatConstructor) {
+  HandleScope scope(isolate);
+  // 1. If NewTarget is undefined, throw a TypeError exception.
+  if (args.new_target()->IsUndefined(isolate)) {  // [[Call]]
+    THROW_NEW_ERROR_RETURN_FAILURE(
+        isolate, NewTypeError(MessageTemplate::kConstructorNotFunction,
+                              isolate->factory()->NewStringFromStaticChars(
+                                  "Intl.RelativeTimeFormat")));
+  }
+  // [[Construct]]
+  Handle<JSFunction> target = args.target();
+  Handle<JSReceiver> new_target = Handle<JSReceiver>::cast(args.new_target());
+
+  Handle<JSObject> result;
+  // 2. Let relativeTimeFormat be
+  //    ! OrdinaryCreateFromConstructor(NewTarget,
+  //                                    "%RelativeTimeFormatPrototype%").
+  ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, result,
+                                     JSObject::New(target, new_target));
+
+  Handle<Object> locales = args.atOrUndefined(isolate, 1);
+  Handle<Object> options = args.atOrUndefined(isolate, 2);
+
+  // 3. Return ? InitializeRelativeTimeFormat(relativeTimeFormat, locales,
+  //                                          options).
+  RETURN_RESULT_OR_FAILURE(
+      isolate, JSRelativeTimeFormat::InitializeRelativeTimeFormat(
+                   isolate, Handle<JSRelativeTimeFormat>::cast(result), locales,
+                   options));
+}
+
+BUILTIN(RelativeTimeFormatPrototypeResolvedOptions) {
+  HandleScope scope(isolate);
+  CHECK_RECEIVER(JSRelativeTimeFormat, format_holder,
+                 "Intl.RelativeTimeFormat.prototype.resolvedOptions");
+  return *JSRelativeTimeFormat::ResolvedOptions(isolate, format_holder);
+}
+
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/src/builtins/builtins-math.cc b/deps/v8/src/builtins/builtins-math.cc
index df310bdfa10c4c..ae2bf03d694afa 100644
--- a/deps/v8/src/builtins/builtins-math.cc
+++ b/deps/v8/src/builtins/builtins-math.cc
@@ -25,7 +25,8 @@ BUILTIN(MathHypot) {
   abs_values.reserve(length);
   for (int i = 0; i < length; i++) {
     Handle<Object> x = args.at(i + 1);
-    ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, x, Object::ToNumber(x));
+    ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, x,
+                                       Object::ToNumber(isolate, x));
     double abs_value = std::abs(x->Number());
 
     if (std::isnan(abs_value)) {
diff --git a/deps/v8/src/builtins/builtins-object.cc b/deps/v8/src/builtins/builtins-object.cc
index 927161d45f549d..074c926587c729 100644
--- a/deps/v8/src/builtins/builtins-object.cc
+++ b/deps/v8/src/builtins/builtins-object.cc
@@ -156,7 +156,7 @@ Object* ObjectLookupAccessor(Isolate* isolate, Handle<Object> object,
         Handle<Object> maybe_pair = it.GetAccessors();
         if (maybe_pair->IsAccessorPair()) {
           return *AccessorPair::GetComponent(
-              Handle<AccessorPair>::cast(maybe_pair), component);
+              isolate, Handle<AccessorPair>::cast(maybe_pair), component);
         }
       }
     }
diff --git a/deps/v8/src/builtins/builtins-proxy-gen.h b/deps/v8/src/builtins/builtins-proxy-gen.h
index 92b175bfde94c1..95845fca4ef03a 100644
--- a/deps/v8/src/builtins/builtins-proxy-gen.h
+++ b/deps/v8/src/builtins/builtins-proxy-gen.h
@@ -6,6 +6,7 @@
 #define V8_BUILTINS_BUILTINS_PROXY_GEN_H_
 
 #include "src/code-stub-assembler.h"
+#include "src/objects/js-proxy.h"
 
 namespace v8 {
 namespace internal {
diff --git a/deps/v8/src/builtins/builtins-sharedarraybuffer.cc b/deps/v8/src/builtins/builtins-sharedarraybuffer.cc
index a1b36c5fb6e922..cb9ecfbc6177be 100644
--- a/deps/v8/src/builtins/builtins-sharedarraybuffer.cc
+++ b/deps/v8/src/builtins/builtins-sharedarraybuffer.cc
@@ -29,7 +29,8 @@ inline bool AtomicIsLockFree(uint32_t size) {
 BUILTIN(AtomicsIsLockFree) {
   HandleScope scope(isolate);
   Handle<Object> size = args.atOrUndefined(isolate, 1);
-  ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, size, Object::ToNumber(size));
+  ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, size,
+                                     Object::ToNumber(isolate, size));
   return *isolate->factory()->ToBoolean(AtomicIsLockFree(size->Number()));
 }
 
@@ -142,7 +143,7 @@ BUILTIN(AtomicsWait) {
     timeout_number = ReadOnlyRoots(isolate).infinity_value()->Number();
   } else {
     ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, timeout,
-                                       Object::ToNumber(timeout));
+                                       Object::ToNumber(isolate, timeout));
     timeout_number = timeout->Number();
     if (std::isnan(timeout_number))
       timeout_number = ReadOnlyRoots(isolate).infinity_value()->Number();
diff --git a/deps/v8/src/builtins/builtins-string.cc b/deps/v8/src/builtins/builtins-string.cc
index b9f802e3f11ee3..e52fbd577dd4b6 100644
--- a/deps/v8/src/builtins/builtins-string.cc
+++ b/deps/v8/src/builtins/builtins-string.cc
@@ -19,7 +19,8 @@ namespace internal {
 namespace {  // for String.fromCodePoint
 
 bool IsValidCodePoint(Isolate* isolate, Handle<Object> value) {
-  if (!value->IsNumber() && !Object::ToNumber(value).ToHandle(&value)) {
+  if (!value->IsNumber() &&
+      !Object::ToNumber(isolate, value).ToHandle(&value)) {
     return false;
   }
 
@@ -37,7 +38,8 @@ bool IsValidCodePoint(Isolate* isolate, Handle<Object> value) {
 
 uc32 NextCodePoint(Isolate* isolate, BuiltinArguments args, int index) {
   Handle<Object> value = args.at(1 + index);
-  ASSIGN_RETURN_ON_EXCEPTION_VALUE(isolate, value, Object::ToNumber(value), -1);
+  ASSIGN_RETURN_ON_EXCEPTION_VALUE(isolate, value,
+                                   Object::ToNumber(isolate, value), -1);
   if (!IsValidCodePoint(isolate, value)) {
     isolate->Throw(*isolate->factory()->NewRangeError(
         MessageTemplate::kInvalidCodePoint, value));
@@ -526,14 +528,14 @@ BUILTIN(StringRaw) {
                                      Object::ToObject(isolate, templ));
 
   Handle<Object> raw;
-  ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, raw,
-                                     Object::GetProperty(cooked, raw_string));
+  ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
+      isolate, raw, Object::GetProperty(isolate, cooked, raw_string));
   ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, raw,
                                      Object::ToObject(isolate, raw));
   Handle<Object> raw_len;
   ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
       isolate, raw_len,
-      Object::GetProperty(raw, isolate->factory()->length_string()));
+      Object::GetProperty(isolate, raw, isolate->factory()->length_string()));
 
   ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, raw_len,
                                      Object::ToLength(isolate, raw_len));
diff --git a/deps/v8/src/builtins/builtins-typed-array.cc b/deps/v8/src/builtins/builtins-typed-array.cc
index 4ca09988fcd191..6750f2863bcb77 100644
--- a/deps/v8/src/builtins/builtins-typed-array.cc
+++ b/deps/v8/src/builtins/builtins-typed-array.cc
@@ -122,7 +122,7 @@ BUILTIN(TypedArrayPrototypeFill) {
                                        BigInt::FromObject(isolate, obj_value));
   } else {
     ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, obj_value,
-                                       Object::ToNumber(obj_value));
+                                       Object::ToNumber(isolate, obj_value));
   }
 
   int64_t len = array->length_value();
diff --git a/deps/v8/src/code-stub-assembler.cc b/deps/v8/src/code-stub-assembler.cc
index bc8a83628811c0..b1330664ff7305 100644
--- a/deps/v8/src/code-stub-assembler.cc
+++ b/deps/v8/src/code-stub-assembler.cc
@@ -244,8 +244,38 @@ HEAP_IMMUTABLE_IMMOVABLE_OBJECT_LIST(HEAP_CONSTANT_ACCESSOR);
 HEAP_IMMOVABLE_OBJECT_LIST(HEAP_CONSTANT_TEST);
 #undef HEAP_CONSTANT_TEST
 
-TNode<Int32T> CodeStubAssembler::HashSeed() {
-  return LoadAndUntagToWord32Root(Heap::kHashSeedRootIndex);
+TNode<Int64T> CodeStubAssembler::HashSeed() {
+  DCHECK(Is64());
+  TNode<HeapObject> hash_seed_root =
+      TNode<HeapObject>::UncheckedCast(LoadRoot(Heap::kHashSeedRootIndex));
+  return TNode<Int64T>::UncheckedCast(LoadObjectField(
+      hash_seed_root, ByteArray::kHeaderSize, MachineType::Int64()));
+}
+
+TNode<Int32T> CodeStubAssembler::HashSeedHigh() {
+  DCHECK(!Is64());
+#ifdef V8_TARGET_BIG_ENDIAN
+  static int kOffset = 0;
+#else
+  static int kOffset = kInt32Size;
+#endif
+  TNode<HeapObject> hash_seed_root =
+      TNode<HeapObject>::UncheckedCast(LoadRoot(Heap::kHashSeedRootIndex));
+  return TNode<Int32T>::UncheckedCast(LoadObjectField(
+      hash_seed_root, ByteArray::kHeaderSize + kOffset, MachineType::Int32()));
+}
+
+TNode<Int32T> CodeStubAssembler::HashSeedLow() {
+  DCHECK(!Is64());
+#ifdef V8_TARGET_BIG_ENDIAN
+  static int kOffset = kInt32Size;
+#else
+  static int kOffset = 0;
+#endif
+  TNode<HeapObject> hash_seed_root =
+      TNode<HeapObject>::UncheckedCast(LoadRoot(Heap::kHashSeedRootIndex));
+  return TNode<Int32T>::UncheckedCast(LoadObjectField(
+      hash_seed_root, ByteArray::kHeaderSize + kOffset, MachineType::Int32()));
 }
 
 Node* CodeStubAssembler::IntPtrOrSmiConstant(int value, ParameterMode mode) {
@@ -7433,7 +7463,14 @@ void CodeStubAssembler::NumberDictionaryLookup(
   TNode<IntPtrT> capacity = SmiUntag(GetCapacity<NumberDictionary>(dictionary));
   TNode<WordT> mask = IntPtrSub(capacity, IntPtrConstant(1));
 
-  TNode<Int32T> int32_seed = HashSeed();
+  TNode<Int32T> int32_seed;
+
+  if (Is64()) {
+    int32_seed = TruncateInt64ToInt32(HashSeed());
+  } else {
+    int32_seed = HashSeedLow();
+  }
+
   TNode<WordT> hash =
       ChangeUint32ToWord(ComputeIntegerHash(intptr_index, int32_seed));
   Node* key_as_float64 = RoundIntPtrToFloat64(intptr_index);
diff --git a/deps/v8/src/code-stub-assembler.h b/deps/v8/src/code-stub-assembler.h
index d7be1d5bd5162e..3d7859f0647b57 100644
--- a/deps/v8/src/code-stub-assembler.h
+++ b/deps/v8/src/code-stub-assembler.h
@@ -338,6 +338,10 @@ class V8_EXPORT_PRIVATE CodeStubAssembler : public compiler::CodeAssembler {
     return CAST(p_n);
   }
 
+  TNode<FixedArrayBase> UnsafeCastObjectToFixedArrayBase(TNode<Object> p_o) {
+    return CAST(p_o);
+  }
+
   TNode<FixedArray> UnsafeCastObjectToFixedArray(TNode<Object> p_o) {
     return CAST(p_o);
   }
@@ -391,6 +395,8 @@ class V8_EXPORT_PRIVATE CodeStubAssembler : public compiler::CodeAssembler {
     return CAST(p_o);
   }
 
+  TNode<Map> UnsafeCastObjectToMap(TNode<Object> p_o) { return CAST(p_o); }
+
   Node* MatchesParameterMode(Node* value, ParameterMode mode);
 
 #define PARAMETER_BINOP(OpName, IntPtrOpName, SmiOpName) \
@@ -438,7 +444,9 @@ class V8_EXPORT_PRIVATE CodeStubAssembler : public compiler::CodeAssembler {
   HEAP_IMMOVABLE_OBJECT_LIST(HEAP_CONSTANT_TEST)
 #undef HEAP_CONSTANT_TEST
 
-  TNode<Int32T> HashSeed();
+  TNode<Int64T> HashSeed();
+  TNode<Int32T> HashSeedHigh();
+  TNode<Int32T> HashSeedLow();
 
   Node* IntPtrOrSmiConstant(int value, ParameterMode mode);
   TNode<Smi> LanguageModeConstant(LanguageMode mode) {
diff --git a/deps/v8/src/code-stubs.cc b/deps/v8/src/code-stubs.cc
index f00120c369eebf..adca79ac8f4975 100644
--- a/deps/v8/src/code-stubs.cc
+++ b/deps/v8/src/code-stubs.cc
@@ -13,6 +13,7 @@
 #include "src/code-factory.h"
 #include "src/code-stub-assembler.h"
 #include "src/code-stubs-utils.h"
+#include "src/code-tracer.h"
 #include "src/counters.h"
 #include "src/gdb-jit.h"
 #include "src/heap/heap-inl.h"
@@ -96,7 +97,7 @@ void CodeStub::RecordCodeGeneration(Handle<Code> code) {
 void CodeStub::DeleteStubFromCacheForTesting() {
   Heap* heap = isolate_->heap();
   Handle<SimpleNumberDictionary> dict(heap->code_stubs(), isolate());
-  int entry = dict->FindEntry(GetKey());
+  int entry = dict->FindEntry(isolate(), GetKey());
   DCHECK_NE(SimpleNumberDictionary::kNotFound, entry);
   dict = SimpleNumberDictionary::DeleteEntry(isolate(), dict, entry);
   heap->SetRootCodeStubs(*dict);
@@ -166,7 +167,7 @@ Handle<Code> CodeStub::GetCode() {
 
     // Update the dictionary and the root in Heap.
     Handle<SimpleNumberDictionary> dict = SimpleNumberDictionary::Set(
-        handle(heap->code_stubs(), isolate_), GetKey(), new_object);
+        isolate(), handle(heap->code_stubs(), isolate_), GetKey(), new_object);
     heap->SetRootCodeStubs(*dict);
     code = *new_object;
   }
diff --git a/deps/v8/src/code-tracer.h b/deps/v8/src/code-tracer.h
new file mode 100644
index 00000000000000..3ed07be77ea6e7
--- /dev/null
+++ b/deps/v8/src/code-tracer.h
@@ -0,0 +1,83 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef V8_CODE_TRACER_H_
+#define V8_CODE_TRACER_H_
+
+#include "src/allocation.h"
+#include "src/flags.h"
+#include "src/globals.h"
+#include "src/utils.h"
+
+namespace v8 {
+namespace internal {
+
+class CodeTracer final : public Malloced {
+ public:
+  explicit CodeTracer(int isolate_id) : file_(nullptr), scope_depth_(0) {
+    if (!ShouldRedirect()) {
+      file_ = stdout;
+      return;
+    }
+
+    if (FLAG_redirect_code_traces_to != nullptr) {
+      StrNCpy(filename_, FLAG_redirect_code_traces_to, filename_.length());
+    } else if (isolate_id >= 0) {
+      SNPrintF(filename_, "code-%d-%d.asm", base::OS::GetCurrentProcessId(),
+               isolate_id);
+    } else {
+      SNPrintF(filename_, "code-%d.asm", base::OS::GetCurrentProcessId());
+    }
+
+    WriteChars(filename_.start(), "", 0, false);
+  }
+
+  class Scope {
+   public:
+    explicit Scope(CodeTracer* tracer) : tracer_(tracer) { tracer->OpenFile(); }
+    ~Scope() { tracer_->CloseFile(); }
+
+    FILE* file() const { return tracer_->file(); }
+
+   private:
+    CodeTracer* tracer_;
+  };
+
+  void OpenFile() {
+    if (!ShouldRedirect()) {
+      return;
+    }
+
+    if (file_ == nullptr) {
+      file_ = base::OS::FOpen(filename_.start(), "ab");
+    }
+
+    scope_depth_++;
+  }
+
+  void CloseFile() {
+    if (!ShouldRedirect()) {
+      return;
+    }
+
+    if (--scope_depth_ == 0) {
+      fclose(file_);
+      file_ = nullptr;
+    }
+  }
+
+  FILE* file() const { return file_; }
+
+ private:
+  static bool ShouldRedirect() { return FLAG_redirect_code_traces; }
+
+  EmbeddedVector<char, 128> filename_;
+  FILE* file_;
+  int scope_depth_;
+};
+
+}  // namespace internal
+}  // namespace v8
+
+#endif  // V8_CODE_TRACER_H_
diff --git a/deps/v8/src/compiler-dispatcher/unoptimized-compile-job.cc b/deps/v8/src/compiler-dispatcher/unoptimized-compile-job.cc
index e5c58f62b2a7aa..2e8065ed11b1d7 100644
--- a/deps/v8/src/compiler-dispatcher/unoptimized-compile-job.cc
+++ b/deps/v8/src/compiler-dispatcher/unoptimized-compile-job.cc
@@ -121,7 +121,7 @@ void UnoptimizedCompileJob::PrepareOnMainThread(Isolate* isolate) {
 
   unicode_cache_.reset(new UnicodeCache());
   parse_info_->set_unicode_cache(unicode_cache_.get());
-  parse_info_->set_function_literal_id(shared_->function_literal_id());
+  parse_info_->set_function_literal_id(shared_->FunctionLiteralId(isolate));
   if (V8_UNLIKELY(FLAG_runtime_stats)) {
     parse_info_->set_runtime_call_stats(new (parse_info_->zone())
                                             RuntimeCallStats());
@@ -196,6 +196,7 @@ void UnoptimizedCompileJob::PrepareOnMainThread(Isolate* isolate) {
                            shared_->EndPosition() - offset));
     parse_info_->set_character_stream(std::move(stream));
   }
+
   parser_.reset(new Parser(parse_info_.get()));
   parser_->DeserializeScopeChain(isolate, parse_info_.get(),
                                  parse_info_->maybe_outer_scope_info());
diff --git a/deps/v8/src/compiler.cc b/deps/v8/src/compiler.cc
index 62bdd708b49cd8..47af8e9981d891 100644
--- a/deps/v8/src/compiler.cc
+++ b/deps/v8/src/compiler.cc
@@ -970,7 +970,7 @@ BackgroundCompileTask::BackgroundCompileTask(ScriptStreamingData* source,
   // Prepare the data for the internalization phase and compilation phase, which
   // will happen in the main thread after parsing.
   ParseInfo* info = new ParseInfo(isolate);
-  LOG(isolate, ScriptEvent(Logger::ScriptEventType::kBackgroundCompile,
+  LOG(isolate, ScriptEvent(Logger::ScriptEventType::kStreamingCompile,
                            info->script_id()));
   if (V8_UNLIKELY(FLAG_runtime_stats)) {
     info->set_runtime_call_stats(new (info->zone()) RuntimeCallStats());
@@ -1595,11 +1595,11 @@ Handle<Script> NewScript(Isolate* isolate, ParseInfo* parse_info,
 }  // namespace
 
 MaybeHandle<SharedFunctionInfo> Compiler::GetSharedFunctionInfoForScript(
-    Handle<String> source, const Compiler::ScriptDetails& script_details,
+    Isolate* isolate, Handle<String> source,
+    const Compiler::ScriptDetails& script_details,
     ScriptOriginOptions origin_options, v8::Extension* extension,
     ScriptData* cached_data, ScriptCompiler::CompileOptions compile_options,
     ScriptCompiler::NoCacheReason no_cache_reason, NativesFlag natives) {
-  Isolate* isolate = source->GetIsolate();
   ScriptCompileTimerScope compile_timer(isolate, no_cache_reason);
 
   if (compile_options == ScriptCompiler::kNoCompileOptions ||
@@ -1775,9 +1775,9 @@ ScriptCompiler::ScriptStreamingTask* Compiler::NewBackgroundCompileTask(
 
 MaybeHandle<SharedFunctionInfo>
 Compiler::GetSharedFunctionInfoForStreamedScript(
-    Handle<String> source, const ScriptDetails& script_details,
-    ScriptOriginOptions origin_options, ScriptStreamingData* streaming_data) {
-  Isolate* isolate = source->GetIsolate();
+    Isolate* isolate, Handle<String> source,
+    const ScriptDetails& script_details, ScriptOriginOptions origin_options,
+    ScriptStreamingData* streaming_data) {
   ScriptCompileTimerScope compile_timer(
       isolate, ScriptCompiler::kNoCacheBecauseStreamingSource);
   PostponeInterruptsScope postpone(isolate);
diff --git a/deps/v8/src/compiler.h b/deps/v8/src/compiler.h
index e6e2195b42d5a1..b3a5b739979d00 100644
--- a/deps/v8/src/compiler.h
+++ b/deps/v8/src/compiler.h
@@ -139,9 +139,10 @@ class V8_EXPORT_PRIVATE Compiler : public AllStatic {
 
   // Create a shared function info object for a String source.
   static MaybeHandle<SharedFunctionInfo> GetSharedFunctionInfoForScript(
-      Handle<String> source, const ScriptDetails& script_details,
-      ScriptOriginOptions origin_options, v8::Extension* extension,
-      ScriptData* cached_data, ScriptCompiler::CompileOptions compile_options,
+      Isolate* isolate, Handle<String> source,
+      const ScriptDetails& script_details, ScriptOriginOptions origin_options,
+      v8::Extension* extension, ScriptData* cached_data,
+      ScriptCompiler::CompileOptions compile_options,
       ScriptCompiler::NoCacheReason no_cache_reason,
       NativesFlag is_natives_code);
 
@@ -151,8 +152,9 @@ class V8_EXPORT_PRIVATE Compiler : public AllStatic {
   // have been released, however the object itself isn't freed and is still
   // owned by the caller.
   static MaybeHandle<SharedFunctionInfo> GetSharedFunctionInfoForStreamedScript(
-      Handle<String> source, const ScriptDetails& script_details,
-      ScriptOriginOptions origin_options, ScriptStreamingData* streaming_data);
+      Isolate* isolate, Handle<String> source,
+      const ScriptDetails& script_details, ScriptOriginOptions origin_options,
+      ScriptStreamingData* streaming_data);
 
   // Create a shared function info object for the given function literal
   // node (the code may be lazily compiled).
@@ -302,7 +304,6 @@ class OptimizedCompilationJob : public CompilationJob {
   OptimizedCompilationInfo* compilation_info() const {
     return compilation_info_;
   }
-  virtual size_t AllocatedMemory() const { return 0; }
 
  protected:
   // Overridden by the actual implementation.
diff --git a/deps/v8/src/compiler/access-info.cc b/deps/v8/src/compiler/access-info.cc
index 2c8ebfd76094b6..2e0cbe0c810bb9 100644
--- a/deps/v8/src/compiler/access-info.cc
+++ b/deps/v8/src/compiler/access-info.cc
@@ -237,11 +237,11 @@ Handle<Cell> PropertyAccessInfo::export_cell() const {
   return Handle<Cell>::cast(constant_);
 }
 
-AccessInfoFactory::AccessInfoFactory(CompilationDependencies* dependencies,
-                                     const JSHeapBroker* js_heap_broker,
+AccessInfoFactory::AccessInfoFactory(const JSHeapBroker* js_heap_broker,
+                                     CompilationDependencies* dependencies,
                                      Handle<Context> native_context, Zone* zone)
-    : dependencies_(dependencies),
-      js_heap_broker_(js_heap_broker),
+    : js_heap_broker_(js_heap_broker),
+      dependencies_(dependencies),
       native_context_(native_context),
       isolate_(native_context->GetIsolate()),
       type_cache_(TypeCache::Get()),
@@ -396,11 +396,12 @@ bool AccessInfoFactory::ComputePropertyAccessInfo(
               // The field type was cleared by the GC, so we don't know anything
               // about the contents now.
             } else if (descriptors_field_type->IsClass()) {
-              dependencies()->DependOnFieldType(map, number);
+              dependencies()->DependOnFieldType(MapRef(js_heap_broker(), map),
+                                                number);
               // Remember the field map, and try to infer a useful type.
-              field_type = Type::For(js_heap_broker(),
-                                     descriptors_field_type->AsClass());
-              field_map = descriptors_field_type->AsClass();
+              Handle<Map> map(descriptors_field_type->AsClass(), isolate());
+              field_type = Type::For(js_heap_broker(), map);
+              field_map = MaybeHandle<Map>(map);
             }
           }
           *access_info = PropertyAccessInfo::DataField(
@@ -699,14 +700,15 @@ bool AccessInfoFactory::LookupTransition(Handle<Map> map, Handle<Name> name,
       // Store is not safe if the field type was cleared.
       return false;
     } else if (descriptors_field_type->IsClass()) {
-      dependencies()->DependOnFieldType(transition_map, number);
+      dependencies()->DependOnFieldType(
+          MapRef(js_heap_broker(), transition_map), number);
       // Remember the field map, and try to infer a useful type.
-      field_type =
-          Type::For(js_heap_broker(), descriptors_field_type->AsClass());
-      field_map = descriptors_field_type->AsClass();
+      Handle<Map> map(descriptors_field_type->AsClass(), isolate());
+      field_type = Type::For(js_heap_broker(), map);
+      field_map = MaybeHandle<Map>(map);
     }
   }
-  dependencies()->DependOnTransition(transition_map);
+  dependencies()->DependOnTransition(MapRef(js_heap_broker(), transition_map));
   // Transitioning stores are never stores to constant fields.
   *access_info = PropertyAccessInfo::DataField(
       PropertyConstness::kMutable, MapHandles{map}, field_index,
diff --git a/deps/v8/src/compiler/access-info.h b/deps/v8/src/compiler/access-info.h
index 887147deecdb4b..fa737ce0c41759 100644
--- a/deps/v8/src/compiler/access-info.h
+++ b/deps/v8/src/compiler/access-info.h
@@ -140,8 +140,9 @@ class PropertyAccessInfo final {
 // Factory class for {ElementAccessInfo}s and {PropertyAccessInfo}s.
 class AccessInfoFactory final {
  public:
-  AccessInfoFactory(CompilationDependencies* dependencies,
-                    const JSHeapBroker* js_heap_broker,
+  AccessInfoFactory(const JSHeapBroker* js_heap_broker,
+                    CompilationDependencies* dependencies,
+
                     Handle<Context> native_context, Zone* zone);
 
   bool ComputeElementAccessInfo(Handle<Map> map, AccessMode access_mode,
@@ -174,8 +175,8 @@ class AccessInfoFactory final {
   Handle<Context> native_context() const { return native_context_; }
   Zone* zone() const { return zone_; }
 
-  CompilationDependencies* const dependencies_;
   const JSHeapBroker* const js_heap_broker_;
+  CompilationDependencies* const dependencies_;
   Handle<Context> const native_context_;
   Isolate* const isolate_;
   TypeCache const& type_cache_;
diff --git a/deps/v8/src/compiler/allocation-builder.h b/deps/v8/src/compiler/allocation-builder.h
index 6368a43240f54f..4aabac1c110f3c 100644
--- a/deps/v8/src/compiler/allocation-builder.h
+++ b/deps/v8/src/compiler/allocation-builder.h
@@ -18,10 +18,8 @@ namespace compiler {
 // allocated object and also provides helpers for commonly allocated objects.
 class AllocationBuilder final {
  public:
-  AllocationBuilder(JSGraph* jsgraph, const JSHeapBroker* js_heap_broker,
-                    Node* effect, Node* control)
+  AllocationBuilder(JSGraph* jsgraph, Node* effect, Node* control)
       : jsgraph_(jsgraph),
-        js_heap_broker_(js_heap_broker),
         allocation_(nullptr),
         effect_(effect),
         control_(control) {}
@@ -79,7 +77,7 @@ class AllocationBuilder final {
   }
   // Compound store of a constant into a field.
   void Store(const FieldAccess& access, const ObjectRef& value) {
-    Store(access, jsgraph()->Constant(js_heap_broker(), value));
+    Store(access, jsgraph()->Constant(value));
   }
 
   void FinishAndChange(Node* node) {
@@ -96,7 +94,6 @@ class AllocationBuilder final {
 
  protected:
   JSGraph* jsgraph() { return jsgraph_; }
-  const JSHeapBroker* js_heap_broker() { return js_heap_broker_; }
   Isolate* isolate() const { return jsgraph_->isolate(); }
   Graph* graph() { return jsgraph_->graph(); }
   CommonOperatorBuilder* common() { return jsgraph_->common(); }
@@ -104,7 +101,6 @@ class AllocationBuilder final {
 
  private:
   JSGraph* const jsgraph_;
-  const JSHeapBroker* const js_heap_broker_;
   Node* allocation_;
   Node* effect_;
   Node* control_;
diff --git a/deps/v8/src/compiler/arm/code-generator-arm.cc b/deps/v8/src/compiler/arm/code-generator-arm.cc
index e1987732d85352..d129274863134f 100644
--- a/deps/v8/src/compiler/arm/code-generator-arm.cc
+++ b/deps/v8/src/compiler/arm/code-generator-arm.cc
@@ -2331,18 +2331,8 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       Simd128Register dst = i.OutputSimd128Register(),
                       src0 = i.InputSimd128Register(0),
                       src1 = i.InputSimd128Register(1);
-      UseScratchRegisterScope temps(tasm());
-      // Check for in-place shuffles.
-      // If dst == src0 == src1, then the shuffle is unary and we only use src0.
-      if (dst == src0) {
-        Simd128Register scratch = temps.AcquireQ();
-        __ vmov(scratch, src0);
-        src0 = scratch;
-      } else if (dst == src1) {
-        Simd128Register scratch = temps.AcquireQ();
-        __ vmov(scratch, src1);
-        src1 = scratch;
-      }
+      DCHECK_NE(dst, src0);
+      DCHECK_NE(dst, src1);
       // Perform shuffle as a vmov per lane.
       int dst_code = dst.code() * 4;
       int src0_code = src0.code() * 4;
diff --git a/deps/v8/src/compiler/arm/instruction-selector-arm.cc b/deps/v8/src/compiler/arm/instruction-selector-arm.cc
index 56054e87a8c49a..8fc57791127d39 100644
--- a/deps/v8/src/compiler/arm/instruction-selector-arm.cc
+++ b/deps/v8/src/compiler/arm/instruction-selector-arm.cc
@@ -2491,9 +2491,15 @@ void InstructionSelector::VisitS8x16Shuffle(Node* node) {
       DCHECK_GT(4, index);
       Emit(kArmS128Dup, g.DefineAsRegister(node), g.UseRegister(input0),
            g.UseImmediate(Neon32), g.UseImmediate(index % 4));
+    } else if (TryMatchIdentity(shuffle)) {
+      EmitIdentity(node);
     } else {
-      Emit(kArmS32x4Shuffle, g.DefineAsRegister(node), g.UseRegister(input0),
-           g.UseRegister(input1), g.UseImmediate(Pack4Lanes(shuffle32x4)));
+      // 32x4 shuffles are implemented as s-register moves. To simplify these,
+      // make sure the destination is distinct from both sources.
+      InstructionOperand src0 = g.UseUniqueRegister(input0);
+      InstructionOperand src1 = is_swizzle ? src0 : g.UseUniqueRegister(input1);
+      Emit(kArmS32x4Shuffle, g.DefineAsRegister(node), src0, src1,
+           g.UseImmediate(Pack4Lanes(shuffle32x4)));
     }
     return;
   }
diff --git a/deps/v8/src/compiler/arm64/instruction-selector-arm64.cc b/deps/v8/src/compiler/arm64/instruction-selector-arm64.cc
index aaa079b44a90fc..e07debf9ecf9ed 100644
--- a/deps/v8/src/compiler/arm64/instruction-selector-arm64.cc
+++ b/deps/v8/src/compiler/arm64/instruction-selector-arm64.cc
@@ -3181,6 +3181,8 @@ void InstructionSelector::VisitS8x16Shuffle(Node* node) {
       DCHECK_GT(4, index);
       Emit(kArm64S128Dup, g.DefineAsRegister(node), g.UseRegister(input0),
            g.UseImmediate(4), g.UseImmediate(index % 4));
+    } else if (TryMatchIdentity(shuffle)) {
+      EmitIdentity(node);
     } else {
       Emit(kArm64S32x4Shuffle, g.DefineAsRegister(node), g.UseRegister(input0),
            g.UseRegister(input1), g.UseImmediate(Pack4Lanes(shuffle32x4)));
diff --git a/deps/v8/src/compiler/code-generator.cc b/deps/v8/src/compiler/code-generator.cc
index 98620a0961dd40..6a7d0985f4d860 100644
--- a/deps/v8/src/compiler/code-generator.cc
+++ b/deps/v8/src/compiler/code-generator.cc
@@ -723,7 +723,7 @@ void CodeGenerator::AssembleSourcePosition(SourcePosition source_position) {
     buffer << "-- ";
     // Turbolizer only needs the source position, as it can reconstruct
     // the inlining stack from other information.
-    if (info->trace_turbo_json_enabled() ||
+    if (info->trace_turbo_json_enabled() || !tasm()->isolate() ||
         tasm()->isolate()->concurrent_recompilation_enabled()) {
       buffer << source_position;
     } else {
diff --git a/deps/v8/src/compiler/common-operator-reducer.cc b/deps/v8/src/compiler/common-operator-reducer.cc
index 76837d1fcad51f..6e50d700b71aae 100644
--- a/deps/v8/src/compiler/common-operator-reducer.cc
+++ b/deps/v8/src/compiler/common-operator-reducer.cc
@@ -27,8 +27,8 @@ Decision DecideCondition(const JSHeapBroker* broker, Node* const cond) {
     }
     case IrOpcode::kHeapConstant: {
       HeapObjectMatcher mcond(cond);
-      ObjectRef object(mcond.Value());
-      return object.BooleanValue(broker) ? Decision::kTrue : Decision::kFalse;
+      return mcond.Ref(broker).BooleanValue() ? Decision::kTrue
+                                              : Decision::kFalse;
     }
     default:
       return Decision::kUnknown;
diff --git a/deps/v8/src/compiler/compilation-dependencies.cc b/deps/v8/src/compiler/compilation-dependencies.cc
index 46481b4fb0e3f8..0926bc43d9cb61 100644
--- a/deps/v8/src/compiler/compilation-dependencies.cc
+++ b/deps/v8/src/compiler/compilation-dependencies.cc
@@ -12,278 +12,309 @@ namespace internal {
 namespace compiler {
 
 CompilationDependencies::CompilationDependencies(Isolate* isolate, Zone* zone)
-    : isolate_(isolate), zone_(zone), dependencies_(zone) {}
+    : zone_(zone), dependencies_(zone) {}
 
 class CompilationDependencies::Dependency : public ZoneObject {
  public:
+  virtual bool IsSane() const = 0;
   virtual bool IsValid() const = 0;
   virtual void Install(Isolate* isolate, Handle<WeakCell> code) = 0;
 };
 
 class InitialMapDependency final : public CompilationDependencies::Dependency {
  public:
-  InitialMapDependency(Handle<JSFunction> function, Handle<Map> initial_map)
+  InitialMapDependency(JSFunctionRef function, MapRef initial_map)
       : function_(function), initial_map_(initial_map) {
-    DCHECK(IsValid());
+    DCHECK(IsSane());
+  }
+
+  bool IsSane() const override {
+    DisallowHeapAccess no_heap_access;
+    CHECK(function_.has_initial_map());
+    return function_.initial_map().equals(initial_map_);
   }
 
   bool IsValid() const override {
-    DisallowHeapAllocation no_heap_allocation;
-    DCHECK(function_->has_initial_map());
-    return *initial_map_ == function_->initial_map();
+    Handle<JSFunction> function = function_.object<JSFunction>();
+    CHECK(function->has_initial_map());
+    return function->initial_map() == *initial_map_.object<Map>();
   }
 
   void Install(Isolate* isolate, Handle<WeakCell> code) override {
     DCHECK(IsValid());
-    DependentCode::InstallDependency(isolate, code, initial_map_,
+    DependentCode::InstallDependency(isolate, code, initial_map_.object<Map>(),
                                      DependentCode::kInitialMapChangedGroup);
   }
 
  private:
-  Handle<JSFunction> function_;
-  Handle<Map> initial_map_;
+  JSFunctionRef function_;
+  MapRef initial_map_;
 };
 
 class StableMapDependency final : public CompilationDependencies::Dependency {
  public:
-  explicit StableMapDependency(Handle<Map> map) : map_(map) {
-    DCHECK(IsValid());
+  explicit StableMapDependency(const MapRef& map) : map_(map) {
+    DCHECK(IsSane());
   }
 
-  bool IsValid() const override {
-    DisallowHeapAllocation no_heap_allocation;
-    return map_->is_stable();
+  bool IsSane() const override {
+    DisallowHeapAccess no_heap_access;
+    return map_.is_stable();
   }
 
+  bool IsValid() const override { return map_.object<Map>()->is_stable(); }
+
   void Install(Isolate* isolate, Handle<WeakCell> code) override {
     DCHECK(IsValid());
-    DependentCode::InstallDependency(isolate, code, map_,
+    DependentCode::InstallDependency(isolate, code, map_.object<Map>(),
                                      DependentCode::kPrototypeCheckGroup);
   }
 
  private:
-  Handle<Map> map_;
+  MapRef map_;
 };
 
 class TransitionDependency final : public CompilationDependencies::Dependency {
  public:
-  explicit TransitionDependency(Handle<Map> map) : map_(map) {
-    DCHECK(IsValid());
+  explicit TransitionDependency(const MapRef& map) : map_(map) {
+    DCHECK(IsSane());
   }
 
-  bool IsValid() const override {
-    DisallowHeapAllocation no_heap_allocation;
-    return !map_->is_deprecated();
+  bool IsSane() const override {
+    DisallowHeapAccess no_heap_access;
+    return !map_.is_deprecated();
   }
 
+  bool IsValid() const override { return !map_.object<Map>()->is_deprecated(); }
+
   void Install(Isolate* isolate, Handle<WeakCell> code) override {
     DCHECK(IsValid());
-    DependentCode::InstallDependency(isolate, code, map_,
+    DependentCode::InstallDependency(isolate, code, map_.object<Map>(),
                                      DependentCode::kTransitionGroup);
   }
 
  private:
-  Handle<Map> map_;
+  MapRef map_;
 };
 
 class PretenureModeDependency final
     : public CompilationDependencies::Dependency {
  public:
-  PretenureModeDependency(Handle<AllocationSite> site, PretenureFlag mode)
+  PretenureModeDependency(const AllocationSiteRef& site, PretenureFlag mode)
       : site_(site), mode_(mode) {
-    DCHECK(IsValid());
+    DCHECK(IsSane());
+  }
+
+  bool IsSane() const override {
+    DisallowHeapAccess no_heap_access;
+    return mode_ == site_.GetPretenureMode();
   }
 
   bool IsValid() const override {
-    DisallowHeapAllocation no_heap_allocation;
-    return mode_ == site_->GetPretenureMode();
+    return mode_ == site_.object<AllocationSite>()->GetPretenureMode();
   }
 
   void Install(Isolate* isolate, Handle<WeakCell> code) override {
     DCHECK(IsValid());
     DependentCode::InstallDependency(
-        isolate, code, site_,
+        isolate, code, site_.object<AllocationSite>(),
         DependentCode::kAllocationSiteTenuringChangedGroup);
   }
 
  private:
-  Handle<AllocationSite> site_;
+  AllocationSiteRef site_;
   PretenureFlag mode_;
 };
 
 class FieldTypeDependency final : public CompilationDependencies::Dependency {
  public:
-  FieldTypeDependency(Isolate* isolate, Handle<Map> owner, int descriptor,
-                      Handle<FieldType> type)
-      : isolate_(isolate), owner_(owner), descriptor_(descriptor), type_(type) {
-    DCHECK(IsValid());
+  FieldTypeDependency(const MapRef& owner, int descriptor,
+                      const FieldTypeRef& type)
+      : owner_(owner), descriptor_(descriptor), type_(type) {
+    DCHECK(IsSane());
+  }
+
+  bool IsSane() const override {
+    DisallowHeapAccess no_heap_access;
+    CHECK(owner_.equals(owner_.FindFieldOwner(descriptor_)));
+    return type_.equals(owner_.GetFieldType(descriptor_));
   }
 
   bool IsValid() const override {
     DisallowHeapAllocation no_heap_allocation;
-    CHECK_EQ(*owner_, owner_->FindFieldOwner(isolate_, descriptor_));
-    return *type_ == owner_->instance_descriptors()->GetFieldType(descriptor_);
+    Handle<Map> owner = owner_.object<Map>();
+    Handle<FieldType> type = type_.object<FieldType>();
+    return *type == owner->instance_descriptors()->GetFieldType(descriptor_);
   }
 
   void Install(Isolate* isolate, Handle<WeakCell> code) override {
     DCHECK(IsValid());
-    DependentCode::InstallDependency(isolate, code, owner_,
+    DependentCode::InstallDependency(isolate, code, owner_.object<Map>(),
                                      DependentCode::kFieldOwnerGroup);
   }
 
  private:
-  Isolate* isolate_;
-  Handle<Map> owner_;
+  MapRef owner_;
   int descriptor_;
-  Handle<FieldType> type_;
+  FieldTypeRef type_;
 };
 
 class GlobalPropertyDependency final
     : public CompilationDependencies::Dependency {
  public:
-  GlobalPropertyDependency(Handle<PropertyCell> cell, PropertyCellType type,
+  GlobalPropertyDependency(const PropertyCellRef& cell, PropertyCellType type,
                            bool read_only)
       : cell_(cell), type_(type), read_only_(read_only) {
-    DCHECK(IsValid());
+    DCHECK(IsSane());
+  }
+
+  bool IsSane() const override {
+    DisallowHeapAccess no_heap_access;
+    return type_ == cell_.property_details().cell_type() &&
+           read_only_ == cell_.property_details().IsReadOnly();
   }
 
   bool IsValid() const override {
-    DisallowHeapAllocation no_heap_allocation;
-    return type_ == cell_->property_details().cell_type() &&
-           read_only_ == cell_->property_details().IsReadOnly();
+    Handle<PropertyCell> cell = cell_.object<PropertyCell>();
+    return type_ == cell->property_details().cell_type() &&
+           read_only_ == cell->property_details().IsReadOnly();
   }
 
   void Install(Isolate* isolate, Handle<WeakCell> code) override {
     DCHECK(IsValid());
-    DependentCode::InstallDependency(isolate, code, cell_,
+    DependentCode::InstallDependency(isolate, code,
+                                     cell_.object<PropertyCell>(),
                                      DependentCode::kPropertyCellChangedGroup);
   }
 
  private:
-  Handle<PropertyCell> cell_;
+  PropertyCellRef cell_;
   PropertyCellType type_;
   bool read_only_;
 };
 
 class ProtectorDependency final : public CompilationDependencies::Dependency {
  public:
-  explicit ProtectorDependency(Handle<PropertyCell> cell) : cell_(cell) {
-    DCHECK(IsValid());
+  explicit ProtectorDependency(const PropertyCellRef& cell) : cell_(cell) {
+    DCHECK(IsSane());
+  }
+
+  bool IsSane() const override {
+    DisallowHeapAccess no_heap_access;
+    return cell_.value().IsSmi() &&
+           cell_.value().AsSmi() == Isolate::kProtectorValid;
   }
 
   bool IsValid() const override {
-    DisallowHeapAllocation no_heap_allocation;
-    return cell_->value() == Smi::FromInt(Isolate::kProtectorValid);
+    Handle<PropertyCell> cell = cell_.object<PropertyCell>();
+    return cell->value() == Smi::FromInt(Isolate::kProtectorValid);
   }
 
   void Install(Isolate* isolate, Handle<WeakCell> code) override {
     DCHECK(IsValid());
-    DependentCode::InstallDependency(isolate, code, cell_,
+    DependentCode::InstallDependency(isolate, code,
+                                     cell_.object<PropertyCell>(),
                                      DependentCode::kPropertyCellChangedGroup);
   }
 
  private:
-  Handle<PropertyCell> cell_;
+  PropertyCellRef cell_;
 };
 
 class ElementsKindDependency final
     : public CompilationDependencies::Dependency {
  public:
-  ElementsKindDependency(Handle<AllocationSite> site, ElementsKind kind)
+  ElementsKindDependency(const AllocationSiteRef& site, ElementsKind kind)
       : site_(site), kind_(kind) {
-    DCHECK(IsValid());
+    DCHECK(IsSane());
   }
 
-  bool IsValid() const override {
-    DisallowHeapAllocation no_heap_allocation;
+  bool IsSane() const override {
+    DisallowHeapAccess no_heap_access;
     DCHECK(AllocationSite::ShouldTrack(kind_));
-    ElementsKind kind = site_->PointsToLiteral()
-                            ? site_->boilerplate()->GetElementsKind()
-                            : site_->GetElementsKind();
+    ElementsKind kind = site_.PointsToLiteral()
+                            ? site_.boilerplate().GetElementsKind()
+                            : site_.GetElementsKind();
+    return kind_ == kind;
+  }
+
+  bool IsValid() const override {
+    Handle<AllocationSite> site = site_.object<AllocationSite>();
+    ElementsKind kind = site->PointsToLiteral()
+                            ? site->boilerplate()->GetElementsKind()
+                            : site->GetElementsKind();
     return kind_ == kind;
   }
 
   void Install(Isolate* isolate, Handle<WeakCell> code) override {
     DCHECK(IsValid());
     DependentCode::InstallDependency(
-        isolate, code, site_,
+        isolate, code, site_.object<AllocationSite>(),
         DependentCode::kAllocationSiteTransitionChangedGroup);
   }
 
  private:
-  Handle<AllocationSite> site_;
+  AllocationSiteRef site_;
   ElementsKind kind_;
 };
 
-Handle<Map> CompilationDependencies::DependOnInitialMap(
-    Handle<JSFunction> function) {
-  Handle<Map> map(function->initial_map(), function->GetIsolate());
+MapRef CompilationDependencies::DependOnInitialMap(
+    const JSFunctionRef& function) {
+  MapRef map = function.initial_map();
   dependencies_.push_front(new (zone_) InitialMapDependency(function, map));
   return map;
 }
 
-void CompilationDependencies::DependOnStableMap(Handle<Map> map) {
-  if (map->CanTransition()) {
+void CompilationDependencies::DependOnStableMap(const MapRef& map) {
+  if (map.CanTransition()) {
     dependencies_.push_front(new (zone_) StableMapDependency(map));
   } else {
-    DCHECK(map->is_stable());
+    DCHECK(map.is_stable());
   }
 }
 
-void CompilationDependencies::DependOnTransition(Handle<Map> target_map) {
-  if (target_map->CanBeDeprecated()) {
+void CompilationDependencies::DependOnTransition(const MapRef& target_map) {
+  if (target_map.CanBeDeprecated()) {
     dependencies_.push_front(new (zone_) TransitionDependency(target_map));
   } else {
-    DCHECK(!target_map->is_deprecated());
+    DCHECK(!target_map.is_deprecated());
   }
 }
 
 PretenureFlag CompilationDependencies::DependOnPretenureMode(
-    Handle<AllocationSite> site) {
-  PretenureFlag mode = site->GetPretenureMode();
+    const AllocationSiteRef& site) {
+  PretenureFlag mode = site.GetPretenureMode();
   dependencies_.push_front(new (zone_) PretenureModeDependency(site, mode));
   return mode;
 }
 
-void CompilationDependencies::DependOnFieldType(Handle<Map> map,
+void CompilationDependencies::DependOnFieldType(const MapRef& map,
                                                 int descriptor) {
-  Handle<Map> owner(map->FindFieldOwner(isolate_, descriptor), isolate_);
-  Handle<FieldType> type(
-      owner->instance_descriptors()->GetFieldType(descriptor), isolate_);
-  DCHECK_EQ(*type, map->instance_descriptors()->GetFieldType(descriptor));
-  dependencies_.push_front(
-      new (zone_) FieldTypeDependency(isolate_, owner, descriptor, type));
-}
-
-void CompilationDependencies::DependOnFieldType(const LookupIterator* it) {
-  Handle<Map> owner = it->GetFieldOwnerMap();
-  int descriptor = it->GetFieldDescriptorIndex();
-  Handle<FieldType> type = it->GetFieldType();
-  CHECK_EQ(*type,
-           it->GetHolder<Map>()->map()->instance_descriptors()->GetFieldType(
-               descriptor));
-  dependencies_.push_front(
-      new (zone_) FieldTypeDependency(isolate_, owner, descriptor, type));
+  MapRef owner = map.FindFieldOwner(descriptor);
+  FieldTypeRef type = owner.GetFieldType(descriptor);
+  DCHECK(type.equals(map.GetFieldType(descriptor)));
+  dependencies_.push_front(new (zone_)
+                               FieldTypeDependency(owner, descriptor, type));
 }
 
 void CompilationDependencies::DependOnGlobalProperty(
-    Handle<PropertyCell> cell) {
-  PropertyCellType type = cell->property_details().cell_type();
-  bool read_only = cell->property_details().IsReadOnly();
+    const PropertyCellRef& cell) {
+  PropertyCellType type = cell.property_details().cell_type();
+  bool read_only = cell.property_details().IsReadOnly();
   dependencies_.push_front(new (zone_)
                                GlobalPropertyDependency(cell, type, read_only));
 }
 
-void CompilationDependencies::DependOnProtector(Handle<PropertyCell> cell) {
+void CompilationDependencies::DependOnProtector(const PropertyCellRef& cell) {
   dependencies_.push_front(new (zone_) ProtectorDependency(cell));
 }
 
 void CompilationDependencies::DependOnElementsKind(
-    Handle<AllocationSite> site) {
+    const AllocationSiteRef& site) {
   // Do nothing if the object doesn't have any useful element transitions left.
-  ElementsKind kind = site->PointsToLiteral()
-                          ? site->boilerplate()->GetElementsKind()
-                          : site->GetElementsKind();
+  ElementsKind kind = site.PointsToLiteral()
+                          ? site.boilerplate().GetElementsKind()
+                          : site.GetElementsKind();
   if (AllocationSite::ShouldTrack(kind)) {
     dependencies_.push_front(new (zone_) ElementsKindDependency(site, kind));
   }
@@ -297,6 +328,8 @@ bool CompilationDependencies::AreValid() const {
 }
 
 bool CompilationDependencies::Commit(Handle<Code> code) {
+  Isolate* isolate = code->GetIsolate();
+
   // Check validity of all dependencies first, such that we can abort before
   // installing anything.
   if (!AreValid()) {
@@ -306,20 +339,22 @@ bool CompilationDependencies::Commit(Handle<Code> code) {
 
   Handle<WeakCell> cell = Code::WeakCellFor(code);
   for (auto dep : dependencies_) {
-    dep->Install(isolate_, cell);
+    dep->Install(isolate, cell);
   }
   dependencies_.clear();
   return true;
 }
 
 namespace {
-void DependOnStablePrototypeChain(CompilationDependencies* deps,
+void DependOnStablePrototypeChain(const JSHeapBroker* broker,
+                                  CompilationDependencies* deps,
                                   Handle<Map> map,
                                   MaybeHandle<JSReceiver> last_prototype) {
-  for (PrototypeIterator i(map); !i.IsAtEnd(); i.Advance()) {
+  for (PrototypeIterator i(broker->isolate(), map); !i.IsAtEnd(); i.Advance()) {
     Handle<JSReceiver> const current =
         PrototypeIterator::GetCurrent<JSReceiver>(i);
-    deps->DependOnStableMap(handle(current->map(), current->GetIsolate()));
+    deps->DependOnStableMap(
+        MapRef(broker, handle(current->map(), broker->isolate())));
     Handle<JSReceiver> last;
     if (last_prototype.ToHandle(&last) && last.is_identical_to(current)) {
       break;
@@ -329,8 +364,9 @@ void DependOnStablePrototypeChain(CompilationDependencies* deps,
 }  // namespace
 
 void CompilationDependencies::DependOnStablePrototypeChains(
-    Handle<Context> native_context,
+    const JSHeapBroker* broker, Handle<Context> native_context,
     std::vector<Handle<Map>> const& receiver_maps, Handle<JSObject> holder) {
+  Isolate* isolate = holder->GetIsolate();
   // Determine actual holder and perform prototype chain checks.
   for (auto map : receiver_maps) {
     // Perform the implicit ToObject for primitives here.
@@ -338,20 +374,21 @@ void CompilationDependencies::DependOnStablePrototypeChains(
     Handle<JSFunction> constructor;
     if (Map::GetConstructorFunction(map, native_context)
             .ToHandle(&constructor)) {
-      map = handle(constructor->initial_map(), isolate_);
+      map = handle(constructor->initial_map(), isolate);
     }
-    DependOnStablePrototypeChain(this, map, holder);
+    DependOnStablePrototypeChain(broker, this, map, holder);
   }
 }
 
 void CompilationDependencies::DependOnElementsKinds(
-    Handle<AllocationSite> site) {
+    const AllocationSiteRef& site) {
+  AllocationSiteRef current = site;
   while (true) {
-    DependOnElementsKind(site);
-    if (!site->nested_site()->IsAllocationSite()) break;
-    site = handle(AllocationSite::cast(site->nested_site()), isolate_);
+    DependOnElementsKind(current);
+    if (!current.nested_site().IsAllocationSite()) break;
+    current = current.nested_site().AsAllocationSite();
   }
-  CHECK_EQ(site->nested_site(), Smi::kZero);
+  CHECK_EQ(current.nested_site().AsSmi(), 0);
 }
 
 }  // namespace compiler
diff --git a/deps/v8/src/compiler/compilation-dependencies.h b/deps/v8/src/compiler/compilation-dependencies.h
index 3438bfaf271cb1..9770775c2e4e37 100644
--- a/deps/v8/src/compiler/compilation-dependencies.h
+++ b/deps/v8/src/compiler/compilation-dependencies.h
@@ -5,6 +5,7 @@
 #ifndef V8_COMPILER_COMPILATION_DEPENDENCIES_H_
 #define V8_COMPILER_COMPILATION_DEPENDENCIES_H_
 
+#include "src/compiler/js-heap-broker.h"
 #include "src/objects.h"
 #include "src/zone/zone-containers.h"
 
@@ -21,42 +22,42 @@ class V8_EXPORT_PRIVATE CompilationDependencies : public ZoneObject {
 
   // Return the initial map of {function} and record the assumption that it
   // stays the intial map.
-  Handle<Map> DependOnInitialMap(Handle<JSFunction> function);
+  MapRef DependOnInitialMap(const JSFunctionRef& function);
 
   // Record the assumption that {map} stays stable.
-  void DependOnStableMap(Handle<Map> map);
+  void DependOnStableMap(const MapRef& map);
 
   // Record the assumption that {target_map} can be transitioned to, i.e., that
   // it does not become deprecated.
-  void DependOnTransition(Handle<Map> target_map);
+  void DependOnTransition(const MapRef& target_map);
 
   // Return the pretenure mode of {site} and record the assumption that it does
   // not change.
-  PretenureFlag DependOnPretenureMode(Handle<AllocationSite> site);
+  PretenureFlag DependOnPretenureMode(const AllocationSiteRef& site);
 
   // Record the assumption that the field type of a field does not change. The
-  // field is identified by the argument(s).
-  void DependOnFieldType(Handle<Map> map, int descriptor);
-  void DependOnFieldType(const LookupIterator* it);
+  // field is identified by the arguments.
+  void DependOnFieldType(const MapRef& map, int descriptor);
 
   // Record the assumption that neither {cell}'s {CellType} changes, nor the
   // {IsReadOnly()} flag of {cell}'s {PropertyDetails}.
-  void DependOnGlobalProperty(Handle<PropertyCell> cell);
+  void DependOnGlobalProperty(const PropertyCellRef& cell);
 
   // Record the assumption that the protector remains valid.
-  void DependOnProtector(Handle<PropertyCell> cell);
+  void DependOnProtector(const PropertyCellRef& cell);
 
   // Record the assumption that {site}'s {ElementsKind} doesn't change.
-  void DependOnElementsKind(Handle<AllocationSite> site);
+  void DependOnElementsKind(const AllocationSiteRef& site);
 
   // Depend on the stability of (the maps of) all prototypes of every class in
   // {receiver_type} up to (and including) the {holder}.
+  // TODO(neis): Fully brokerize!
   void DependOnStablePrototypeChains(
-      Handle<Context> native_context,
+      const JSHeapBroker* broker, Handle<Context> native_context,
       std::vector<Handle<Map>> const& receiver_maps, Handle<JSObject> holder);
 
   // Like DependOnElementsKind but also applies to all nested allocation sites.
-  void DependOnElementsKinds(Handle<AllocationSite> site);
+  void DependOnElementsKinds(const AllocationSiteRef& site);
 
   // Exposed only for testing purposes.
   bool AreValid() const;
@@ -65,7 +66,6 @@ class V8_EXPORT_PRIVATE CompilationDependencies : public ZoneObject {
   class Dependency;
 
  private:
-  Isolate* isolate_;
   Zone* zone_;
   ZoneForwardList<Dependency*> dependencies_;
 };
diff --git a/deps/v8/src/compiler/constant-folding-reducer.cc b/deps/v8/src/compiler/constant-folding-reducer.cc
index 29d93ee073d3d1..1811c06f98e25c 100644
--- a/deps/v8/src/compiler/constant-folding-reducer.cc
+++ b/deps/v8/src/compiler/constant-folding-reducer.cc
@@ -37,12 +37,11 @@ Reduction ConstantFoldingReducer::Reduce(Node* node) {
     if (!upper.IsNone()) {
       Node* replacement = nullptr;
       if (upper.IsHeapConstant()) {
-        replacement = jsgraph()->Constant(js_heap_broker(),
-                                          upper.AsHeapConstant()->Ref());
+        replacement = jsgraph()->Constant(upper.AsHeapConstant()->Ref());
       } else if (upper.Is(Type::MinusZero())) {
         Factory* factory = jsgraph()->isolate()->factory();
-        ObjectRef minus_zero(factory->minus_zero_value());
-        replacement = jsgraph()->Constant(js_heap_broker(), minus_zero);
+        ObjectRef minus_zero(js_heap_broker(), factory->minus_zero_value());
+        replacement = jsgraph()->Constant(minus_zero);
       } else if (upper.Is(Type::NaN())) {
         replacement = jsgraph()->NaNConstant();
       } else if (upper.Is(Type::Null())) {
diff --git a/deps/v8/src/compiler/ia32/instruction-selector-ia32.cc b/deps/v8/src/compiler/ia32/instruction-selector-ia32.cc
index a789673b48d477..b1c7c09d5b80e2 100644
--- a/deps/v8/src/compiler/ia32/instruction-selector-ia32.cc
+++ b/deps/v8/src/compiler/ia32/instruction-selector-ia32.cc
@@ -2212,7 +2212,6 @@ bool TryMatchArchShuffle(const uint8_t* shuffle, const ShuffleEntry* table,
 
 }  // namespace
 
-// TODO(bbudge) Make sure identity shuffle emits no instructions.
 void InstructionSelector::VisitS8x16Shuffle(Node* node) {
   uint8_t shuffle[kSimd128Size];
   bool is_swizzle;
@@ -2259,11 +2258,17 @@ void InstructionSelector::VisitS8x16Shuffle(Node* node) {
   } else if (TryMatch32x4Shuffle(shuffle, shuffle32x4)) {
     uint8_t shuffle_mask = PackShuffle4(shuffle32x4);
     if (is_swizzle) {
-      // pshufd takes a single imm8 shuffle mask.
-      opcode = kIA32S32x4Swizzle;
-      no_same_as_first = true;
-      src0_needs_reg = false;
-      imms[imm_count++] = shuffle_mask;
+      if (TryMatchIdentity(shuffle)) {
+        // Bypass normal shuffle code generation in this case.
+        EmitIdentity(node);
+        return;
+      } else {
+        // pshufd takes a single imm8 shuffle mask.
+        opcode = kIA32S32x4Swizzle;
+        no_same_as_first = true;
+        src0_needs_reg = false;
+        imms[imm_count++] = shuffle_mask;
+      }
     } else {
       // 2 operand shuffle
       // A blend is more efficient than a general 32x4 shuffle; try it first.
diff --git a/deps/v8/src/compiler/js-call-reducer.cc b/deps/v8/src/compiler/js-call-reducer.cc
index b86897eb6a7de6..cf807c233a0fa0 100644
--- a/deps/v8/src/compiler/js-call-reducer.cc
+++ b/deps/v8/src/compiler/js-call-reducer.cc
@@ -594,7 +594,8 @@ Reduction JSCallReducer::ReduceObjectGetPrototype(Node* node, Node* object) {
     }
     if (result == NodeProperties::kUnreliableReceiverMaps) {
       for (size_t i = 0; i < object_maps.size(); ++i) {
-        dependencies()->DependOnStableMap(object_maps[i]);
+        dependencies()->DependOnStableMap(
+            MapRef(js_heap_broker(), object_maps[i]));
       }
     }
     Node* value = jsgraph()->Constant(candidate_prototype);
@@ -1050,7 +1051,8 @@ Reduction JSCallReducer::ReduceArrayForEach(Node* node,
 
   // Install code dependencies on the {receiver} prototype maps and the
   // global array protector cell.
-  dependencies()->DependOnProtector(factory()->no_elements_protector());
+  dependencies()->DependOnProtector(
+      PropertyCellRef(js_heap_broker(), factory()->no_elements_protector()));
 
   // If we have unreliable maps, we need a map check.
   if (result == NodeProperties::kUnreliableReceiverMaps) {
@@ -1234,7 +1236,8 @@ Reduction JSCallReducer::ReduceArrayReduce(Node* node,
 
   // Install code dependencies on the {receiver} prototype maps and the
   // global array protector cell.
-  dependencies()->DependOnProtector(factory()->no_elements_protector());
+  dependencies()->DependOnProtector(
+      PropertyCellRef(js_heap_broker(), factory()->no_elements_protector()));
 
   // If we have unreliable maps, we need a map check.
   if (result == NodeProperties::kUnreliableReceiverMaps) {
@@ -1504,7 +1507,8 @@ Reduction JSCallReducer::ReduceArrayMap(Node* node,
     if (receiver_map->elements_kind() != kind) return NoChange();
   }
 
-  dependencies()->DependOnProtector(factory()->array_species_protector());
+  dependencies()->DependOnProtector(
+      PropertyCellRef(js_heap_broker(), factory()->array_species_protector()));
 
   Handle<JSFunction> handle_constructor(
       JSFunction::cast(
@@ -1711,7 +1715,8 @@ Reduction JSCallReducer::ReduceArrayFilter(Node* node,
     if (receiver_map->elements_kind() != kind) return NoChange();
   }
 
-  dependencies()->DependOnProtector(factory()->array_species_protector());
+  dependencies()->DependOnProtector(
+      PropertyCellRef(js_heap_broker(), factory()->array_species_protector()));
 
   Handle<Map> initial_map(
       Map::cast(native_context()->GetInitialJSArrayMap(packed_kind)),
@@ -1730,7 +1735,7 @@ Reduction JSCallReducer::ReduceArrayFilter(Node* node,
 
   Node* a;  // Construct the output array.
   {
-    AllocationBuilder ab(jsgraph(), js_heap_broker(), effect, control);
+    AllocationBuilder ab(jsgraph(), effect, control);
     ab.Allocate(initial_map->instance_size(), NOT_TENURED, Type::Array());
     ab.Store(AccessBuilder::ForMap(), initial_map);
     Node* empty_fixed_array = jsgraph()->EmptyFixedArrayConstant();
@@ -1739,9 +1744,9 @@ Reduction JSCallReducer::ReduceArrayFilter(Node* node,
     ab.Store(AccessBuilder::ForJSArrayLength(packed_kind),
              jsgraph()->ZeroConstant());
     for (int i = 0; i < initial_map->GetInObjectProperties(); ++i) {
-      ab.Store(
-          AccessBuilder::ForJSObjectInObjectProperty(MapRef(initial_map), i),
-          jsgraph()->UndefinedConstant());
+      ab.Store(AccessBuilder::ForJSObjectInObjectProperty(
+                   MapRef(js_heap_broker(), initial_map), i),
+               jsgraph()->UndefinedConstant());
     }
     a = effect = ab.Finish();
   }
@@ -1989,7 +1994,8 @@ Reduction JSCallReducer::ReduceArrayFind(Node* node, ArrayFindVariant variant,
 
   // Install code dependencies on the {receiver} prototype maps and the
   // global array protector cell.
-  dependencies()->DependOnProtector(factory()->no_elements_protector());
+  dependencies()->DependOnProtector(
+      PropertyCellRef(js_heap_broker(), factory()->no_elements_protector()));
 
   // If we have unreliable maps, we need a map check.
   if (result == NodeProperties::kUnreliableReceiverMaps) {
@@ -2304,7 +2310,8 @@ Reduction JSCallReducer::ReduceArrayEvery(Node* node,
     if (receiver_map->elements_kind() != kind) return NoChange();
   }
 
-  dependencies()->DependOnProtector(factory()->array_species_protector());
+  dependencies()->DependOnProtector(
+      PropertyCellRef(js_heap_broker(), factory()->array_species_protector()));
 
   // If we have unreliable maps, we need a map check.
   if (result == NodeProperties::kUnreliableReceiverMaps) {
@@ -2644,7 +2651,8 @@ Reduction JSCallReducer::ReduceArraySome(Node* node,
     if (receiver_map->elements_kind() != kind) return NoChange();
   }
 
-  dependencies()->DependOnProtector(factory()->array_species_protector());
+  dependencies()->DependOnProtector(
+      PropertyCellRef(js_heap_broker(), factory()->array_species_protector()));
 
   Node* k = jsgraph()->ZeroConstant();
 
@@ -2892,7 +2900,8 @@ Reduction JSCallReducer::ReduceCallApiFunction(
   // Install stability dependencies for unreliable {receiver_maps}.
   if (result == NodeProperties::kUnreliableReceiverMaps) {
     for (size_t i = 0; i < receiver_maps.size(); ++i) {
-      dependencies()->DependOnStableMap(receiver_maps[i]);
+      dependencies()->DependOnStableMap(
+          MapRef(js_heap_broker(), receiver_maps[i]));
     }
   }
 
@@ -3062,7 +3071,8 @@ Reduction JSCallReducer::ReduceCallOrConstructWithArrayLikeOrSpread(
   // that no one messed with the %ArrayIteratorPrototype%.next method.
   if (node->opcode() == IrOpcode::kJSCallWithSpread ||
       node->opcode() == IrOpcode::kJSConstructWithSpread) {
-    dependencies()->DependOnProtector(factory()->array_iterator_protector());
+    dependencies()->DependOnProtector(PropertyCellRef(
+        js_heap_broker(), factory()->array_iterator_protector()));
   }
 
   // Remove the {arguments_list} input from the {node}.
@@ -3665,6 +3675,8 @@ Reduction JSCallReducer::ReduceJSCall(Node* node,
       return ReduceDatePrototypeGetTime(node);
     case Builtins::kDateNow:
       return ReduceDateNow(node);
+    case Builtins::kNumberConstructor:
+      return ReduceNumberConstructor(node);
     default:
       break;
   }
@@ -4334,7 +4346,8 @@ Reduction JSCallReducer::ReduceArrayPrototypePush(Node* node) {
   }
 
   // Install code dependencies on the {receiver} global array protector cell.
-  dependencies()->DependOnProtector(factory()->no_elements_protector());
+  dependencies()->DependOnProtector(
+      PropertyCellRef(js_heap_broker(), factory()->no_elements_protector()));
 
   // If the {receiver_maps} information is not reliable, we need
   // to check that the {receiver} still has one of these maps.
@@ -4448,7 +4461,8 @@ Reduction JSCallReducer::ReduceArrayPrototypePop(Node* node) {
   }
 
   // Install code dependencies on the {receiver} global array protector cell.
-  dependencies()->DependOnProtector(factory()->no_elements_protector());
+  dependencies()->DependOnProtector(
+      PropertyCellRef(js_heap_broker(), factory()->no_elements_protector()));
 
   // If the {receiver_maps} information is not reliable, we need
   // to check that the {receiver} still has one of these maps.
@@ -4566,7 +4580,8 @@ Reduction JSCallReducer::ReduceArrayPrototypeShift(Node* node) {
   }
 
   // Install code dependencies on the {receiver} global array protector cell.
-  dependencies()->DependOnProtector(factory()->no_elements_protector());
+  dependencies()->DependOnProtector(
+      PropertyCellRef(js_heap_broker(), factory()->no_elements_protector()));
 
   // If the {receiver_maps} information is not reliable, we need
   // to check that the {receiver} still has one of these maps.
@@ -4847,7 +4862,8 @@ Reduction JSCallReducer::ReduceArrayIteratorPrototypeNext(Node* node) {
 
   // Install code dependency on the array protector for holey arrays.
   if (IsHoleyElementsKind(elements_kind)) {
-    dependencies()->DependOnProtector(factory()->no_elements_protector());
+    dependencies()->DependOnProtector(
+        PropertyCellRef(js_heap_broker(), factory()->no_elements_protector()));
   }
 
   // Load the (current) {iterated_object} from the {iterator}; this might be
@@ -4871,8 +4887,8 @@ Reduction JSCallReducer::ReduceArrayIteratorPrototypeNext(Node* node) {
     if (isolate()->IsArrayBufferNeuteringIntact()) {
       // Add a code dependency so we are deoptimized in case an ArrayBuffer
       // gets neutered.
-      dependencies()->DependOnProtector(
-          factory()->array_buffer_neutering_protector());
+      dependencies()->DependOnProtector(PropertyCellRef(
+          js_heap_broker(), factory()->array_buffer_neutering_protector()));
     } else {
       // Deoptimize if the array buffer was neutered.
       Node* buffer = effect = graph()->NewNode(
@@ -5357,7 +5373,8 @@ Reduction JSCallReducer::ReduceAsyncFunctionPromiseCreate(Node* node) {
   if (!isolate()->IsPromiseHookProtectorIntact()) return NoChange();
 
   // Install a code dependency on the promise hook protector cell.
-  dependencies()->DependOnProtector(factory()->promise_hook_protector());
+  dependencies()->DependOnProtector(
+      PropertyCellRef(js_heap_broker(), factory()->promise_hook_protector()));
 
   // Morph this {node} into a JSCreatePromise node.
   RelaxControls(node);
@@ -5372,7 +5389,8 @@ Reduction JSCallReducer::ReduceAsyncFunctionPromiseRelease(Node* node) {
   DCHECK_EQ(IrOpcode::kJSCall, node->opcode());
   if (!isolate()->IsPromiseHookProtectorIntact()) return NoChange();
 
-  dependencies()->DependOnProtector(factory()->promise_hook_protector());
+  dependencies()->DependOnProtector(
+      PropertyCellRef(js_heap_broker(), factory()->promise_hook_protector()));
 
   // The AsyncFunctionPromiseRelease builtin is a no-op as long as neither
   // the debugger is active nor any promise hook has been installed (ever).
@@ -5427,7 +5445,8 @@ Reduction JSCallReducer::ReducePromiseConstructor(Node* node) {
   // Only handle builtins Promises, not subclasses.
   if (target != new_target) return NoChange();
 
-  dependencies()->DependOnProtector(factory()->promise_hook_protector());
+  dependencies()->DependOnProtector(
+      PropertyCellRef(js_heap_broker(), factory()->promise_hook_protector()));
 
   Handle<SharedFunctionInfo> promise_shared(
       handle(native_context()->promise_function()->shared(), isolate()));
@@ -5584,7 +5603,8 @@ Reduction JSCallReducer::ReducePromiseInternalConstructor(Node* node) {
   // Check that promises aren't being observed through (debug) hooks.
   if (!isolate()->IsPromiseHookProtectorIntact()) return NoChange();
 
-  dependencies()->DependOnProtector(factory()->promise_hook_protector());
+  dependencies()->DependOnProtector(
+      PropertyCellRef(js_heap_broker(), factory()->promise_hook_protector()));
 
   // Create a new pending promise.
   Node* value = effect =
@@ -5676,7 +5696,8 @@ Reduction JSCallReducer::ReducePromisePrototypeCatch(Node* node) {
     }
   }
 
-  dependencies()->DependOnProtector(factory()->promise_then_protector());
+  dependencies()->DependOnProtector(
+      PropertyCellRef(js_heap_broker(), factory()->promise_then_protector()));
 
   // If the {receiver_maps} aren't reliable, we need to repeat the
   // map check here, guarded by the CALL_IC.
@@ -5752,9 +5773,12 @@ Reduction JSCallReducer::ReducePromisePrototypeFinally(Node* node) {
     }
   }
 
-  dependencies()->DependOnProtector(factory()->promise_hook_protector());
-  dependencies()->DependOnProtector(factory()->promise_then_protector());
-  dependencies()->DependOnProtector(factory()->promise_species_protector());
+  dependencies()->DependOnProtector(
+      PropertyCellRef(js_heap_broker(), factory()->promise_hook_protector()));
+  dependencies()->DependOnProtector(
+      PropertyCellRef(js_heap_broker(), factory()->promise_then_protector()));
+  dependencies()->DependOnProtector(PropertyCellRef(
+      js_heap_broker(), factory()->promise_species_protector()));
 
   // If the {receiver_maps} aren't reliable, we need to repeat the
   // map check here, guarded by the CALL_IC.
@@ -5904,8 +5928,10 @@ Reduction JSCallReducer::ReducePromisePrototypeThen(Node* node) {
     }
   }
 
-  dependencies()->DependOnProtector(factory()->promise_hook_protector());
-  dependencies()->DependOnProtector(factory()->promise_species_protector());
+  dependencies()->DependOnProtector(
+      PropertyCellRef(js_heap_broker(), factory()->promise_hook_protector()));
+  dependencies()->DependOnProtector(PropertyCellRef(
+      js_heap_broker(), factory()->promise_species_protector()));
 
   // If the {receiver_maps} aren't reliable, we need to repeat the
   // map check here, guarded by the CALL_IC.
@@ -6582,8 +6608,8 @@ Reduction JSCallReducer::ReduceArrayBufferViewAccessor(
     if (isolate()->IsArrayBufferNeuteringIntact()) {
       // Add a code dependency so we are deoptimized in case an ArrayBuffer
       // gets neutered.
-      dependencies()->DependOnProtector(
-          factory()->array_buffer_neutering_protector());
+      dependencies()->DependOnProtector(PropertyCellRef(
+          js_heap_broker(), factory()->array_buffer_neutering_protector()));
     } else {
       // Check if the {receiver}s buffer was neutered.
       Node* buffer = effect = graph()->NewNode(
@@ -7098,7 +7124,7 @@ Reduction JSCallReducer::ReduceRegExpPrototypeTest(Node* node) {
 
   // Compute property access info for "exec" on {resolution}.
   PropertyAccessInfo ai_exec;
-  AccessInfoFactory access_info_factory(dependencies(), js_heap_broker(),
+  AccessInfoFactory access_info_factory(js_heap_broker(), dependencies(),
                                         native_context(), graph()->zone());
   if (!access_info_factory.ComputePropertyAccessInfo(
           MapHandles(regexp_maps.begin(), regexp_maps.end()),
@@ -7110,13 +7136,14 @@ Reduction JSCallReducer::ReduceRegExpPrototypeTest(Node* node) {
   Handle<Object> exec_on_proto = ai_exec.constant();
   if (*exec_on_proto != *isolate()->regexp_exec_function()) return NoChange();
 
-  PropertyAccessBuilder access_builder(jsgraph(), dependencies());
+  PropertyAccessBuilder access_builder(jsgraph(), js_heap_broker(),
+                                       dependencies());
 
   // Add proper dependencies on the {regexp}s [[Prototype]]s.
   Handle<JSObject> holder;
   if (ai_exec.holder().ToHandle(&holder)) {
     dependencies()->DependOnStablePrototypeChains(
-        native_context(), ai_exec.receiver_maps(), holder);
+        js_heap_broker(), native_context(), ai_exec.receiver_maps(), holder);
   }
 
   if (need_map_check) {
@@ -7157,6 +7184,26 @@ Reduction JSCallReducer::ReduceRegExpPrototypeTest(Node* node) {
   return Changed(node);
 }
 
+// ES section #sec-number-constructor
+Reduction JSCallReducer::ReduceNumberConstructor(Node* node) {
+  DCHECK_EQ(IrOpcode::kJSCall, node->opcode());
+  CallParameters const& p = CallParametersOf(node->op());
+
+  if (p.arity() <= 2) {
+    ReplaceWithValue(node, jsgraph()->ZeroConstant());
+  }
+
+  // We don't have a new.target argument, so we can convert to number,
+  // but must also convert BigInts.
+  if (p.arity() == 3) {
+    Node* value = NodeProperties::GetValueInput(node, 2);
+    NodeProperties::ReplaceValueInputs(node, value);
+    NodeProperties::ChangeOp(node, javascript()->ToNumberConvertBigInt());
+    return Changed(node);
+  }
+  return NoChange();
+}
+
 Graph* JSCallReducer::graph() const { return jsgraph()->graph(); }
 
 Isolate* JSCallReducer::isolate() const { return jsgraph()->isolate(); }
diff --git a/deps/v8/src/compiler/js-call-reducer.h b/deps/v8/src/compiler/js-call-reducer.h
index 6e3f53164712de..ab2f6aa96f1690 100644
--- a/deps/v8/src/compiler/js-call-reducer.h
+++ b/deps/v8/src/compiler/js-call-reducer.h
@@ -190,6 +190,8 @@ class V8_EXPORT_PRIVATE JSCallReducer final : public AdvancedReducer {
   Reduction ReduceDateNow(Node* node);
   Reduction ReduceNumberParseInt(Node* node);
 
+  Reduction ReduceNumberConstructor(Node* node);
+
   // Returns the updated {to} node, and updates control and effect along the
   // way.
   Node* DoFilterPostCallbackWork(ElementsKind kind, Node** control,
diff --git a/deps/v8/src/compiler/js-context-specialization.cc b/deps/v8/src/compiler/js-context-specialization.cc
index e11be7ea4852ec..85a80a2b2fe9b6 100644
--- a/deps/v8/src/compiler/js-context-specialization.cc
+++ b/deps/v8/src/compiler/js-context-specialization.cc
@@ -105,7 +105,7 @@ base::Optional<ContextRef> GetSpecializationContext(
     Maybe<OuterContext> maybe_outer) {
   switch (node->opcode()) {
     case IrOpcode::kHeapConstant: {
-      HeapObjectRef object(HeapConstantOf(node->op()));
+      HeapObjectRef object(broker, HeapConstantOf(node->op()));
       if (object.IsContext()) return object.AsContext();
       break;
     }
@@ -114,7 +114,7 @@ base::Optional<ContextRef> GetSpecializationContext(
       if (maybe_outer.To(&outer) && IsContextParameter(node) &&
           *distance >= outer.distance) {
         *distance -= outer.distance;
-        return ContextRef(outer.context);
+        return ContextRef(broker, outer.context);
       }
       break;
     }
@@ -146,28 +146,26 @@ Reduction JSContextSpecialization::ReduceJSLoadContext(Node* node) {
   // Now walk up the concrete context chain for the remaining depth.
   ContextRef concrete = maybe_concrete.value();
   for (; depth > 0; --depth) {
-    concrete = concrete.previous(js_heap_broker()).value();
+    concrete = concrete.previous().value();
   }
 
   if (!access.immutable()) {
     // We found the requested context object but since the context slot is
     // mutable we can only partially reduce the load.
-    return SimplifyJSLoadContext(
-        node, jsgraph()->Constant(js_heap_broker(), concrete), depth);
+    return SimplifyJSLoadContext(node, jsgraph()->Constant(concrete), depth);
   }
 
   // This will hold the final value, if we can figure it out.
   base::Optional<ObjectRef> maybe_value;
 
-  maybe_value =
-      concrete.get(js_heap_broker(), static_cast<int>(access.index()));
+  maybe_value = concrete.get(static_cast<int>(access.index()));
   if (maybe_value.has_value() && !maybe_value->IsSmi()) {
     // Even though the context slot is immutable, the context might have escaped
     // before the function to which it belongs has initialized the slot.
     // We must be conservative and check if the value in the slot is currently
     // the hole or undefined. Only if it is neither of these, can we be sure
     // that it won't change anymore.
-    OddballType oddball_type = maybe_value->oddball_type(js_heap_broker());
+    OddballType oddball_type = maybe_value->oddball_type();
     if (oddball_type == OddballType::kUndefined ||
         oddball_type == OddballType::kHole) {
       maybe_value.reset();
@@ -175,15 +173,14 @@ Reduction JSContextSpecialization::ReduceJSLoadContext(Node* node) {
   }
 
   if (!maybe_value.has_value()) {
-    return SimplifyJSLoadContext(
-        node, jsgraph()->Constant(js_heap_broker(), concrete), depth);
+    return SimplifyJSLoadContext(node, jsgraph()->Constant(concrete), depth);
   }
 
   // Success. The context load can be replaced with the constant.
   // TODO(titzer): record the specialization for sharing code across
   // multiple contexts that have the same value in the corresponding context
   // slot.
-  Node* constant = jsgraph_->Constant(js_heap_broker(), *maybe_value);
+  Node* constant = jsgraph_->Constant(*maybe_value);
   ReplaceWithValue(node, constant);
   return Replace(constant);
 }
@@ -210,11 +207,10 @@ Reduction JSContextSpecialization::ReduceJSStoreContext(Node* node) {
   // Now walk up the concrete context chain for the remaining depth.
   ContextRef concrete = maybe_concrete.value();
   for (; depth > 0; --depth) {
-    concrete = concrete.previous(js_heap_broker()).value();
+    concrete = concrete.previous().value();
   }
 
-  return SimplifyJSStoreContext(
-      node, jsgraph()->Constant(js_heap_broker(), concrete), depth);
+  return SimplifyJSStoreContext(node, jsgraph()->Constant(concrete), depth);
 }
 
 
diff --git a/deps/v8/src/compiler/js-create-lowering.cc b/deps/v8/src/compiler/js-create-lowering.cc
index b550f277ca4318..fdb7b3dd17ae17 100644
--- a/deps/v8/src/compiler/js-create-lowering.cc
+++ b/deps/v8/src/compiler/js-create-lowering.cc
@@ -42,13 +42,10 @@ Node* GetArgumentsFrameState(Node* frame_state) {
 // Checks whether allocation using the given target and new.target can be
 // inlined.
 bool IsAllocationInlineable(const JSFunctionRef& target,
-                            const JSFunctionRef& new_target,
-                            const JSHeapBroker* broker) {
+                            const JSFunctionRef& new_target) {
   return new_target.has_initial_map() &&
-         !new_target.initial_map(broker).is_dictionary_map() &&
-         new_target.initial_map(broker)
-             .constructor_or_backpointer(broker)
-             .equals(target);
+         !new_target.initial_map().is_dictionary_map() &&
+         new_target.initial_map().constructor_or_backpointer().equals(target);
 }
 
 // When initializing arrays, we'll unfold the loop if the number of
@@ -136,31 +133,29 @@ Reduction JSCreateLowering::ReduceJSCreate(Node* node) {
   if (!original_constructor.IsConstructor()) return NoChange();
 
   // Check if we can inline the allocation.
-  if (!IsAllocationInlineable(constructor, original_constructor,
-                              js_heap_broker())) {
+  if (!IsAllocationInlineable(constructor, original_constructor)) {
     return NoChange();
   }
 
   // Add a dependency on the {initial_map} to make sure that this code is
   // deoptimized whenever the {initial_map} changes.
-  MapRef initial_map =
-      original_constructor.DependOnInitialMap(js_heap_broker(), dependencies());
+  MapRef initial_map = dependencies()->DependOnInitialMap(original_constructor);
 
   // Force completion of inobject slack tracking before
   // generating code to finalize the instance size.
-  int const instance_size =
-      original_constructor.GetInstanceSizeWithFinishedSlackTracking();
+  SlackTrackingResult slack_tracking_result =
+      original_constructor.FinishSlackTracking();
 
   // Emit code to allocate the JSObject instance for the
   // {original_constructor}.
-  AllocationBuilder a(jsgraph(), js_heap_broker(), effect, control);
-  a.Allocate(instance_size);
+  AllocationBuilder a(jsgraph(), effect, control);
+  a.Allocate(slack_tracking_result.instance_size);
   a.Store(AccessBuilder::ForMap(), initial_map);
   a.Store(AccessBuilder::ForJSObjectPropertiesOrHash(),
           jsgraph()->EmptyFixedArrayConstant());
   a.Store(AccessBuilder::ForJSObjectElements(),
           jsgraph()->EmptyFixedArrayConstant());
-  for (int i = 0; i < initial_map.GetInObjectProperties(); ++i) {
+  for (int i = 0; i < slack_tracking_result.inobject_property_count; ++i) {
     a.Store(AccessBuilder::ForJSObjectInObjectProperty(initial_map, i),
             jsgraph()->UndefinedConstant());
   }
@@ -178,7 +173,8 @@ Reduction JSCreateLowering::ReduceJSCreateArguments(Node* node) {
   Node* const outer_state = frame_state->InputAt(kFrameStateOuterStateInput);
   Node* const control = graph()->start();
   FrameStateInfo state_info = FrameStateInfoOf(frame_state->op());
-  SharedFunctionInfoRef shared(state_info.shared_info().ToHandleChecked());
+  SharedFunctionInfoRef shared(js_heap_broker(),
+                               state_info.shared_info().ToHandleChecked());
 
   // Use the ArgumentsAccessStub for materializing both mapped and unmapped
   // arguments object, but only for non-inlined (i.e. outermost) frames.
@@ -203,13 +199,11 @@ Reduction JSCreateLowering::ReduceJSCreateArguments(Node* node) {
             &has_aliased_arguments);
         // Load the arguments object map.
         Node* const arguments_map = jsgraph()->Constant(
-            js_heap_broker(),
             has_aliased_arguments
-                ? native_context_ref().fast_aliased_arguments_map(
-                      js_heap_broker())
-                : native_context_ref().sloppy_arguments_map(js_heap_broker()));
+                ? native_context_ref().fast_aliased_arguments_map()
+                : native_context_ref().sloppy_arguments_map());
         // Actually allocate and initialize the arguments object.
-        AllocationBuilder a(jsgraph(), js_heap_broker(), effect, control);
+        AllocationBuilder a(jsgraph(), effect, control);
         Node* properties = jsgraph()->EmptyFixedArrayConstant();
         STATIC_ASSERT(JSSloppyArgumentsObject::kSize == 5 * kPointerSize);
         a.Allocate(JSSloppyArgumentsObject::kSize);
@@ -235,11 +229,10 @@ Reduction JSCreateLowering::ReduceJSCreateArguments(Node* node) {
             graph()->NewNode(simplified()->NewArgumentsElements(0),
                              arguments_frame, arguments_length, effect);
         // Load the arguments object map.
-        Node* const arguments_map = jsgraph()->Constant(
-            js_heap_broker(),
-            native_context_ref().strict_arguments_map(js_heap_broker()));
+        Node* const arguments_map =
+            jsgraph()->Constant(native_context_ref().strict_arguments_map());
         // Actually allocate and initialize the arguments object.
-        AllocationBuilder a(jsgraph(), js_heap_broker(), effect, control);
+        AllocationBuilder a(jsgraph(), effect, control);
         Node* properties = jsgraph()->EmptyFixedArrayConstant();
         STATIC_ASSERT(JSStrictArgumentsObject::kSize == 4 * kPointerSize);
         a.Allocate(JSStrictArgumentsObject::kSize);
@@ -267,11 +260,9 @@ Reduction JSCreateLowering::ReduceJSCreateArguments(Node* node) {
                              arguments_frame, rest_length, effect);
         // Load the JSArray object map.
         Node* const jsarray_map = jsgraph()->Constant(
-            js_heap_broker(),
-            native_context_ref().js_array_fast_elements_map_index(
-                js_heap_broker()));
+            native_context_ref().js_array_fast_elements_map_index());
         // Actually allocate and initialize the jsarray.
-        AllocationBuilder a(jsgraph(), js_heap_broker(), effect, control);
+        AllocationBuilder a(jsgraph(), effect, control);
         Node* properties = jsgraph()->EmptyFixedArrayConstant();
         STATIC_ASSERT(JSArray::kSize == 4 * kPointerSize);
         a.Allocate(JSArray::kSize);
@@ -313,13 +304,11 @@ Reduction JSCreateLowering::ReduceJSCreateArguments(Node* node) {
       effect = elements->op()->EffectOutputCount() > 0 ? elements : effect;
       // Load the arguments object map.
       Node* const arguments_map = jsgraph()->Constant(
-          js_heap_broker(),
           has_aliased_arguments
-              ? native_context_ref().fast_aliased_arguments_map(
-                    js_heap_broker())
-              : native_context_ref().sloppy_arguments_map(js_heap_broker()));
+              ? native_context_ref().fast_aliased_arguments_map()
+              : native_context_ref().sloppy_arguments_map());
       // Actually allocate and initialize the arguments object.
-      AllocationBuilder a(jsgraph(), js_heap_broker(), effect, control);
+      AllocationBuilder a(jsgraph(), effect, control);
       Node* properties = jsgraph()->EmptyFixedArrayConstant();
       int length = args_state_info.parameter_count() - 1;  // Minus receiver.
       STATIC_ASSERT(JSSloppyArgumentsObject::kSize == 5 * kPointerSize);
@@ -352,11 +341,10 @@ Reduction JSCreateLowering::ReduceJSCreateArguments(Node* node) {
       Node* const elements = AllocateArguments(effect, control, args_state);
       effect = elements->op()->EffectOutputCount() > 0 ? elements : effect;
       // Load the arguments object map.
-      Node* const arguments_map = jsgraph()->Constant(
-          js_heap_broker(),
-          native_context_ref().strict_arguments_map(js_heap_broker()));
+      Node* const arguments_map =
+          jsgraph()->Constant(native_context_ref().strict_arguments_map());
       // Actually allocate and initialize the arguments object.
-      AllocationBuilder a(jsgraph(), js_heap_broker(), effect, control);
+      AllocationBuilder a(jsgraph(), effect, control);
       Node* properties = jsgraph()->EmptyFixedArrayConstant();
       int length = args_state_info.parameter_count() - 1;  // Minus receiver.
       STATIC_ASSERT(JSStrictArgumentsObject::kSize == 4 * kPointerSize);
@@ -391,11 +379,9 @@ Reduction JSCreateLowering::ReduceJSCreateArguments(Node* node) {
       effect = elements->op()->EffectOutputCount() > 0 ? elements : effect;
       // Load the JSArray object map.
       Node* const jsarray_map = jsgraph()->Constant(
-          js_heap_broker(),
-          native_context_ref().js_array_fast_elements_map_index(
-              js_heap_broker()));
+          native_context_ref().js_array_fast_elements_map_index());
       // Actually allocate and initialize the jsarray.
-      AllocationBuilder a(jsgraph(), js_heap_broker(), effect, control);
+      AllocationBuilder a(jsgraph(), effect, control);
       Node* properties = jsgraph()->EmptyFixedArrayConstant();
 
       // -1 to minus receiver
@@ -418,6 +404,7 @@ Reduction JSCreateLowering::ReduceJSCreateArguments(Node* node) {
 }
 
 Reduction JSCreateLowering::ReduceJSCreateGeneratorObject(Node* node) {
+  DisallowHeapAccess no_heap_access;
   DCHECK_EQ(IrOpcode::kJSCreateGeneratorObject, node->opcode());
   Node* const closure = NodeProperties::GetValueInput(node, 0);
   Node* const receiver = NodeProperties::GetValueInput(node, 1);
@@ -426,30 +413,29 @@ Reduction JSCreateLowering::ReduceJSCreateGeneratorObject(Node* node) {
   Node* effect = NodeProperties::GetEffectInput(node);
   Node* const control = NodeProperties::GetControlInput(node);
   if (closure_type.IsHeapConstant()) {
-    DCHECK(closure_type.AsHeapConstant()->Value()->IsJSFunction());
-    Handle<JSFunction> js_function =
-        Handle<JSFunction>::cast(closure_type.AsHeapConstant()->Value());
-    JSFunction::EnsureHasInitialMap(js_function);
+    DCHECK(closure_type.AsHeapConstant()->Ref().IsJSFunction());
+    JSFunctionRef js_function =
+        closure_type.AsHeapConstant()->Ref().AsJSFunction();
+    js_function.EnsureHasInitialMap();
 
     // Force completion of inobject slack tracking before
     // generating code to finalize the instance size.
-    js_function->CompleteInobjectSlackTrackingIfActive();
+    SlackTrackingResult slack_tracking_result =
+        js_function.FinishSlackTracking();
 
     // Add a dependency on the {initial_map} to make sure that this code is
     // deoptimized whenever the {initial_map} changes.
-    Handle<Map> initial_map = dependencies()->DependOnInitialMap(js_function);
-    DCHECK(initial_map->instance_type() == JS_GENERATOR_OBJECT_TYPE ||
-           initial_map->instance_type() == JS_ASYNC_GENERATOR_OBJECT_TYPE);
+    MapRef initial_map = dependencies()->DependOnInitialMap(js_function);
+    DCHECK(initial_map.instance_type() == JS_GENERATOR_OBJECT_TYPE ||
+           initial_map.instance_type() == JS_ASYNC_GENERATOR_OBJECT_TYPE);
 
     // Allocate a register file.
-    DCHECK(js_function->shared()->HasBytecodeArray());
-    Handle<BytecodeArray> bytecode_array(
-        js_function->shared()->GetBytecodeArray(), isolate());
-    int parameter_count_no_receiver = bytecode_array->parameter_count() - 1;
-    DCHECK_EQ(parameter_count_no_receiver,
-              js_function->shared()->internal_formal_parameter_count());
-    int size = parameter_count_no_receiver + bytecode_array->register_count();
-    AllocationBuilder ab(jsgraph(), js_heap_broker(), effect, control);
+    SharedFunctionInfoRef shared = js_function.shared();
+    DCHECK(shared.HasBytecodeArray());
+    int parameter_count_no_receiver = shared.internal_formal_parameter_count();
+    int size =
+        parameter_count_no_receiver + shared.GetBytecodeArrayRegisterCount();
+    AllocationBuilder ab(jsgraph(), effect, control);
     ab.AllocateArray(size, factory()->fixed_array_map());
     for (int i = 0; i < size; ++i) {
       ab.Store(AccessBuilder::ForFixedArraySlot(i),
@@ -458,8 +444,8 @@ Reduction JSCreateLowering::ReduceJSCreateGeneratorObject(Node* node) {
     Node* parameters_and_registers = effect = ab.Finish();
 
     // Emit code to allocate the JS[Async]GeneratorObject instance.
-    AllocationBuilder a(jsgraph(), js_heap_broker(), effect, control);
-    a.Allocate(initial_map->instance_size());
+    AllocationBuilder a(jsgraph(), effect, control);
+    a.Allocate(slack_tracking_result.instance_size);
     Node* empty_fixed_array = jsgraph()->EmptyFixedArrayConstant();
     Node* undefined = jsgraph()->UndefinedConstant();
     a.Store(AccessBuilder::ForMap(), initial_map);
@@ -476,17 +462,16 @@ Reduction JSCreateLowering::ReduceJSCreateGeneratorObject(Node* node) {
     a.Store(AccessBuilder::ForJSGeneratorObjectParametersAndRegisters(),
             parameters_and_registers);
 
-    if (initial_map->instance_type() == JS_ASYNC_GENERATOR_OBJECT_TYPE) {
+    if (initial_map.instance_type() == JS_ASYNC_GENERATOR_OBJECT_TYPE) {
       a.Store(AccessBuilder::ForJSAsyncGeneratorObjectQueue(), undefined);
       a.Store(AccessBuilder::ForJSAsyncGeneratorObjectIsAwaiting(),
               jsgraph()->ZeroConstant());
     }
 
     // Handle in-object properties, too.
-    for (int i = 0; i < initial_map->GetInObjectProperties(); ++i) {
-      a.Store(
-          AccessBuilder::ForJSObjectInObjectProperty(MapRef(initial_map), i),
-          undefined);
+    for (int i = 0; i < slack_tracking_result.inobject_property_count; ++i) {
+      a.Store(AccessBuilder::ForJSObjectInObjectProperty(initial_map, i),
+              undefined);
     }
     a.FinishAndChange(node);
     return Changed(node);
@@ -497,7 +482,7 @@ Reduction JSCreateLowering::ReduceJSCreateGeneratorObject(Node* node) {
 // Constructs an array with a variable {length} when no upper bound
 // is known for the capacity.
 Reduction JSCreateLowering::ReduceNewArray(Node* node, Node* length,
-                                           Handle<Map> initial_map,
+                                           MapRef initial_map,
                                            PretenureFlag pretenure) {
   DCHECK_EQ(IrOpcode::kJSCreateArray, node->opcode());
   Node* effect = NodeProperties::GetEffectInput(node);
@@ -505,10 +490,9 @@ Reduction JSCreateLowering::ReduceNewArray(Node* node, Node* length,
 
   // Constructing an Array via new Array(N) where N is an unsigned
   // integer, always creates a holey backing store.
-  if (!IsHoleyElementsKind(initial_map->elements_kind())) {
-    initial_map =
-        Map::AsElementsKind(isolate(), initial_map,
-                            GetHoleyElementsKind(initial_map->elements_kind()));
+  if (!IsHoleyElementsKind(initial_map.elements_kind())) {
+    initial_map = initial_map.AsElementsKind(
+        GetHoleyElementsKind(initial_map.elements_kind()), js_heap_broker());
   }
 
   // Check that the {limit} is an unsigned integer in the valid range.
@@ -521,22 +505,21 @@ Reduction JSCreateLowering::ReduceNewArray(Node* node, Node* length,
 
   // Construct elements and properties for the resulting JSArray.
   Node* elements = effect =
-      graph()->NewNode(IsDoubleElementsKind(initial_map->elements_kind())
+      graph()->NewNode(IsDoubleElementsKind(initial_map.elements_kind())
                            ? simplified()->NewDoubleElements(pretenure)
                            : simplified()->NewSmiOrObjectElements(pretenure),
                        length, effect, control);
   Node* properties = jsgraph()->EmptyFixedArrayConstant();
 
   // Perform the allocation of the actual JSArray object.
-  AllocationBuilder a(jsgraph(), js_heap_broker(), effect, control);
-  a.Allocate(initial_map->instance_size(), pretenure);
+  AllocationBuilder a(jsgraph(), effect, control);
+  a.Allocate(initial_map.instance_size(), pretenure);
   a.Store(AccessBuilder::ForMap(), initial_map);
   a.Store(AccessBuilder::ForJSObjectPropertiesOrHash(), properties);
   a.Store(AccessBuilder::ForJSObjectElements(), elements);
-  a.Store(AccessBuilder::ForJSArrayLength(initial_map->elements_kind()),
-          length);
-  for (int i = 0; i < initial_map->GetInObjectProperties(); ++i) {
-    a.Store(AccessBuilder::ForJSObjectInObjectProperty(MapRef(initial_map), i),
+  a.Store(AccessBuilder::ForJSArrayLength(initial_map.elements_kind()), length);
+  for (int i = 0; i < initial_map.GetInObjectProperties(); ++i) {
+    a.Store(AccessBuilder::ForJSObjectInObjectProperty(initial_map, i),
             jsgraph()->UndefinedConstant());
   }
   RelaxControls(node);
@@ -547,8 +530,7 @@ Reduction JSCreateLowering::ReduceNewArray(Node* node, Node* length,
 // Constructs an array with a variable {length} when an actual
 // upper bound is known for the {capacity}.
 Reduction JSCreateLowering::ReduceNewArray(Node* node, Node* length,
-                                           int capacity,
-                                           Handle<Map> initial_map,
+                                           int capacity, MapRef initial_map,
                                            PretenureFlag pretenure) {
   DCHECK(node->opcode() == IrOpcode::kJSCreateArray ||
          node->opcode() == IrOpcode::kJSCreateEmptyLiteralArray);
@@ -556,10 +538,10 @@ Reduction JSCreateLowering::ReduceNewArray(Node* node, Node* length,
   Node* control = NodeProperties::GetControlInput(node);
 
   // Determine the appropriate elements kind.
-  ElementsKind elements_kind = initial_map->elements_kind();
+  ElementsKind elements_kind = initial_map.elements_kind();
   if (NodeProperties::GetType(length).Max() > 0.0) {
     elements_kind = GetHoleyElementsKind(elements_kind);
-    initial_map = Map::AsElementsKind(isolate(), initial_map, elements_kind);
+    initial_map = initial_map.AsElementsKind(elements_kind, js_heap_broker());
   }
   DCHECK(IsFastElementsKind(elements_kind));
 
@@ -574,14 +556,14 @@ Reduction JSCreateLowering::ReduceNewArray(Node* node, Node* length,
   Node* properties = jsgraph()->EmptyFixedArrayConstant();
 
   // Perform the allocation of the actual JSArray object.
-  AllocationBuilder a(jsgraph(), js_heap_broker(), effect, control);
-  a.Allocate(initial_map->instance_size(), pretenure);
+  AllocationBuilder a(jsgraph(), effect, control);
+  a.Allocate(initial_map.instance_size(), pretenure);
   a.Store(AccessBuilder::ForMap(), initial_map);
   a.Store(AccessBuilder::ForJSObjectPropertiesOrHash(), properties);
   a.Store(AccessBuilder::ForJSObjectElements(), elements);
   a.Store(AccessBuilder::ForJSArrayLength(elements_kind), length);
-  for (int i = 0; i < initial_map->GetInObjectProperties(); ++i) {
-    a.Store(AccessBuilder::ForJSObjectInObjectProperty(MapRef(initial_map), i),
+  for (int i = 0; i < initial_map.GetInObjectProperties(); ++i) {
+    a.Store(AccessBuilder::ForJSObjectInObjectProperty(initial_map, i),
             jsgraph()->UndefinedConstant());
   }
   RelaxControls(node);
@@ -591,14 +573,14 @@ Reduction JSCreateLowering::ReduceNewArray(Node* node, Node* length,
 
 Reduction JSCreateLowering::ReduceNewArray(Node* node,
                                            std::vector<Node*> values,
-                                           Handle<Map> initial_map,
+                                           MapRef initial_map,
                                            PretenureFlag pretenure) {
   DCHECK_EQ(IrOpcode::kJSCreateArray, node->opcode());
   Node* effect = NodeProperties::GetEffectInput(node);
   Node* control = NodeProperties::GetControlInput(node);
 
   // Determine the appropriate elements kind.
-  ElementsKind elements_kind = initial_map->elements_kind();
+  ElementsKind elements_kind = initial_map.elements_kind();
   DCHECK(IsFastElementsKind(elements_kind));
 
   // Check {values} based on the {elements_kind}. These checks are guarded
@@ -630,14 +612,14 @@ Reduction JSCreateLowering::ReduceNewArray(Node* node,
   Node* length = jsgraph()->Constant(static_cast<int>(values.size()));
 
   // Perform the allocation of the actual JSArray object.
-  AllocationBuilder a(jsgraph(), js_heap_broker(), effect, control);
-  a.Allocate(initial_map->instance_size(), pretenure);
+  AllocationBuilder a(jsgraph(), effect, control);
+  a.Allocate(initial_map.instance_size(), pretenure);
   a.Store(AccessBuilder::ForMap(), initial_map);
   a.Store(AccessBuilder::ForJSObjectPropertiesOrHash(), properties);
   a.Store(AccessBuilder::ForJSObjectElements(), elements);
   a.Store(AccessBuilder::ForJSArrayLength(elements_kind), length);
-  for (int i = 0; i < initial_map->GetInObjectProperties(); ++i) {
-    a.Store(AccessBuilder::ForJSObjectInObjectProperty(MapRef(initial_map), i),
+  for (int i = 0; i < initial_map.GetInObjectProperties(); ++i) {
+    a.Store(AccessBuilder::ForJSObjectInObjectProperty(initial_map, i),
             jsgraph()->UndefinedConstant());
   }
   RelaxControls(node);
@@ -646,19 +628,19 @@ Reduction JSCreateLowering::ReduceNewArray(Node* node,
 }
 
 Reduction JSCreateLowering::ReduceNewArrayToStubCall(
-    Node* node, Handle<AllocationSite> site) {
+    Node* node, base::Optional<AllocationSiteRef> site) {
   CreateArrayParameters const& p = CreateArrayParametersOf(node->op());
   int const arity = static_cast<int>(p.arity());
   Node* target = NodeProperties::GetValueInput(node, 0);
   Node* new_target = NodeProperties::GetValueInput(node, 1);
   Type new_target_type = NodeProperties::GetType(new_target);
-  Node* type_info = site.is_null() ? jsgraph()->UndefinedConstant()
-                                   : jsgraph()->HeapConstant(site);
+  Node* type_info =
+      site ? jsgraph()->Constant(*site) : jsgraph()->UndefinedConstant();
 
   ElementsKind elements_kind =
-      site.is_null() ? GetInitialFastElementsKind() : site->GetElementsKind();
+      site ? site->GetElementsKind() : GetInitialFastElementsKind();
   AllocationSiteOverrideMode override_mode =
-      (site.is_null() || AllocationSite::ShouldTrack(elements_kind))
+      (!site || AllocationSite::ShouldTrack(elements_kind))
           ? DISABLE_ALLOCATION_SITES
           : DONT_OVERRIDE;
 
@@ -708,38 +690,39 @@ Reduction JSCreateLowering::ReduceNewArrayToStubCall(
 }
 
 Reduction JSCreateLowering::ReduceJSCreateArray(Node* node) {
+  DisallowHeapAccess disallow_heap_access;
   DCHECK_EQ(IrOpcode::kJSCreateArray, node->opcode());
   CreateArrayParameters const& p = CreateArrayParametersOf(node->op());
   int const arity = static_cast<int>(p.arity());
-  Handle<AllocationSite> const site = p.site();
+  base::Optional<AllocationSiteRef> site;
+  if (!p.site().is_null()) {
+    site = AllocationSiteRef(js_heap_broker(), p.site());
+  }
   PretenureFlag pretenure = NOT_TENURED;
-  Handle<JSFunction> constructor(native_context()->array_function(), isolate());
+  JSFunctionRef constructor = native_context_ref().array_function();
   Node* target = NodeProperties::GetValueInput(node, 0);
   Node* new_target = NodeProperties::GetValueInput(node, 1);
-  Type new_target_type =
-      (target == new_target)
-          ? Type::HeapConstant(js_heap_broker(), constructor, zone())
-          : NodeProperties::GetType(new_target);
+  Type new_target_type = (target == new_target)
+                             ? Type::HeapConstant(constructor, zone())
+                             : NodeProperties::GetType(new_target);
 
   // Extract original constructor function.
   if (new_target_type.IsHeapConstant() &&
-      new_target_type.AsHeapConstant()->Value()->IsJSFunction()) {
-    Handle<JSFunction> original_constructor =
-        Handle<JSFunction>::cast(new_target_type.AsHeapConstant()->Value());
-    DCHECK(constructor->IsConstructor());
-    DCHECK(original_constructor->IsConstructor());
+      new_target_type.AsHeapConstant()->Ref().IsJSFunction()) {
+    JSFunctionRef original_constructor =
+        new_target_type.AsHeapConstant()->Ref().AsJSFunction();
+    DCHECK(constructor.IsConstructor());
+    DCHECK(original_constructor.IsConstructor());
 
     // Check if we can inline the allocation.
-    if (IsAllocationInlineable(JSFunctionRef(constructor),
-                               JSFunctionRef(original_constructor),
-                               js_heap_broker())) {
+    if (IsAllocationInlineable(constructor, original_constructor)) {
       // Force completion of inobject slack tracking before
       // generating code to finalize the instance size.
-      original_constructor->CompleteInobjectSlackTrackingIfActive();
+      original_constructor.FinishSlackTracking();
 
       // Add a dependency on the {initial_map} to make sure that this code is
       // deoptimized whenever the {initial_map} changes.
-      Handle<Map> initial_map =
+      MapRef initial_map =
           dependencies()->DependOnInitialMap(original_constructor);
 
       // Tells whether we are protected by either the {site} or a
@@ -747,15 +730,15 @@ Reduction JSCreateLowering::ReduceJSCreateArray(Node* node) {
       bool can_inline_call = false;
 
       // Check if we have a feedback {site} on the {node}.
-      if (!site.is_null()) {
+      if (site) {
         ElementsKind elements_kind = site->GetElementsKind();
-        if (initial_map->elements_kind() != elements_kind) {
+        if (initial_map.elements_kind() != elements_kind) {
           initial_map =
-              Map::AsElementsKind(isolate(), initial_map, elements_kind);
+              initial_map.AsElementsKind(elements_kind, js_heap_broker());
         }
         can_inline_call = site->CanInlineCall();
-        pretenure = dependencies()->DependOnPretenureMode(site);
-        dependencies()->DependOnElementsKind(site);
+        pretenure = dependencies()->DependOnPretenureMode(*site);
+        dependencies()->DependOnElementsKind(*site);
       } else {
         can_inline_call = isolate()->IsArrayConstructorIntact();
       }
@@ -770,13 +753,13 @@ Reduction JSCreateLowering::ReduceJSCreateArray(Node* node) {
         if (!length_type.Maybe(Type::Number())) {
           // Handle the single argument case, where we know that the value
           // cannot be a valid Array length.
-          ElementsKind elements_kind = initial_map->elements_kind();
+          ElementsKind elements_kind = initial_map.elements_kind();
           elements_kind = GetMoreGeneralElementsKind(
               elements_kind, IsHoleyElementsKind(elements_kind)
                                  ? HOLEY_ELEMENTS
                                  : PACKED_ELEMENTS);
           initial_map =
-              Map::AsElementsKind(isolate(), initial_map, elements_kind);
+              initial_map.AsElementsKind(elements_kind, js_heap_broker());
           return ReduceNewArray(node, std::vector<Node*>{length}, initial_map,
                                 pretenure);
         }
@@ -811,7 +794,7 @@ Reduction JSCreateLowering::ReduceJSCreateArray(Node* node) {
         }
 
         // Try to figure out the ideal elements kind statically.
-        ElementsKind elements_kind = initial_map->elements_kind();
+        ElementsKind elements_kind = initial_map.elements_kind();
         if (values_all_smis) {
           // Smis can be stored with any elements kind.
         } else if (values_all_numbers) {
@@ -833,7 +816,7 @@ Reduction JSCreateLowering::ReduceJSCreateArray(Node* node) {
           return NoChange();
         }
         initial_map =
-            Map::AsElementsKind(isolate(), initial_map, elements_kind);
+            initial_map.AsElementsKind(elements_kind, js_heap_broker());
 
         return ReduceNewArray(node, values, initial_map, pretenure);
       }
@@ -856,10 +839,10 @@ Reduction JSCreateLowering::ReduceJSCreateArrayIterator(Node* node) {
   Node* control = NodeProperties::GetControlInput(node);
 
   // Create the JSArrayIterator result.
-  AllocationBuilder a(jsgraph(), js_heap_broker(), effect, control);
+  AllocationBuilder a(jsgraph(), effect, control);
   a.Allocate(JSArrayIterator::kSize, NOT_TENURED, Type::OtherObject());
   a.Store(AccessBuilder::ForMap(),
-          native_context_ref().initial_array_iterator_map(js_heap_broker()));
+          native_context_ref().initial_array_iterator_map());
   a.Store(AccessBuilder::ForJSObjectPropertiesOrHash(),
           jsgraph()->EmptyFixedArrayConstant());
   a.Store(AccessBuilder::ForJSObjectElements(),
@@ -877,7 +860,6 @@ Reduction JSCreateLowering::ReduceJSCreateArrayIterator(Node* node) {
 namespace {
 
 MapRef MapForCollectionIterationKind(const NativeContextRef& native_context,
-                                     const JSHeapBroker* broker,
                                      CollectionKind collection_kind,
                                      IterationKind iteration_kind) {
   switch (collection_kind) {
@@ -886,19 +868,19 @@ MapRef MapForCollectionIterationKind(const NativeContextRef& native_context,
         case IterationKind::kKeys:
           UNREACHABLE();
         case IterationKind::kValues:
-          return native_context.set_value_iterator_map(broker);
+          return native_context.set_value_iterator_map();
         case IterationKind::kEntries:
-          return native_context.set_key_value_iterator_map(broker);
+          return native_context.set_key_value_iterator_map();
       }
       break;
     case CollectionKind::kMap:
       switch (iteration_kind) {
         case IterationKind::kKeys:
-          return native_context.map_key_iterator_map(broker);
+          return native_context.map_key_iterator_map();
         case IterationKind::kValues:
-          return native_context.map_value_iterator_map(broker);
+          return native_context.map_value_iterator_map();
         case IterationKind::kEntries:
-          return native_context.map_key_value_iterator_map(broker);
+          return native_context.map_key_value_iterator_map();
       }
       break;
   }
@@ -922,12 +904,11 @@ Reduction JSCreateLowering::ReduceJSCreateCollectionIterator(Node* node) {
       iterated_object, effect, control);
 
   // Create the JSArrayIterator result.
-  AllocationBuilder a(jsgraph(), js_heap_broker(), effect, control);
+  AllocationBuilder a(jsgraph(), effect, control);
   a.Allocate(JSCollectionIterator::kSize, NOT_TENURED, Type::OtherObject());
-  a.Store(
-      AccessBuilder::ForMap(),
-      MapForCollectionIterationKind(native_context_ref(), js_heap_broker(),
-                                    p.collection_kind(), p.iteration_kind()));
+  a.Store(AccessBuilder::ForMap(),
+          MapForCollectionIterationKind(
+              native_context_ref(), p.collection_kind(), p.iteration_kind()));
   a.Store(AccessBuilder::ForJSObjectPropertiesOrHash(),
           jsgraph()->EmptyFixedArrayConstant());
   a.Store(AccessBuilder::ForJSObjectElements(),
@@ -946,7 +927,7 @@ Reduction JSCreateLowering::ReduceJSCreateBoundFunction(Node* node) {
   CreateBoundFunctionParameters const& p =
       CreateBoundFunctionParametersOf(node->op());
   int const arity = static_cast<int>(p.arity());
-  MapRef const map(p.map());
+  MapRef const map(js_heap_broker(), p.map());
   Node* bound_target_function = NodeProperties::GetValueInput(node, 0);
   Node* bound_this = NodeProperties::GetValueInput(node, 1);
   Node* effect = NodeProperties::GetEffectInput(node);
@@ -955,7 +936,7 @@ Reduction JSCreateLowering::ReduceJSCreateBoundFunction(Node* node) {
   // Create the [[BoundArguments]] for the result.
   Node* bound_arguments = jsgraph()->EmptyFixedArrayConstant();
   if (arity > 0) {
-    AllocationBuilder a(jsgraph(), js_heap_broker(), effect, control);
+    AllocationBuilder a(jsgraph(), effect, control);
     a.AllocateArray(arity, factory()->fixed_array_map());
     for (int i = 0; i < arity; ++i) {
       a.Store(AccessBuilder::ForFixedArraySlot(i),
@@ -965,7 +946,7 @@ Reduction JSCreateLowering::ReduceJSCreateBoundFunction(Node* node) {
   }
 
   // Create the JSBoundFunction result.
-  AllocationBuilder a(jsgraph(), js_heap_broker(), effect, control);
+  AllocationBuilder a(jsgraph(), effect, control);
   a.Allocate(JSBoundFunction::kSize, NOT_TENURED, Type::BoundFunction());
   a.Store(AccessBuilder::ForMap(), map);
   a.Store(AccessBuilder::ForJSObjectPropertiesOrHash(),
@@ -985,9 +966,9 @@ Reduction JSCreateLowering::ReduceJSCreateClosure(Node* node) {
   DisallowHeapAccess no_heap_access;
   DCHECK_EQ(IrOpcode::kJSCreateClosure, node->opcode());
   CreateClosureParameters const& p = CreateClosureParametersOf(node->op());
-  SharedFunctionInfoRef shared(p.shared_info());
-  HeapObjectRef feedback_cell(p.feedback_cell());
-  HeapObjectRef code(p.code());
+  SharedFunctionInfoRef shared(js_heap_broker(), p.shared_info());
+  HeapObjectRef feedback_cell(js_heap_broker(), p.feedback_cell());
+  HeapObjectRef code(js_heap_broker(), p.code());
   Node* effect = NodeProperties::GetEffectInput(node);
   Node* control = NodeProperties::GetControlInput(node);
   Node* context = NodeProperties::GetContextInput(node);
@@ -995,13 +976,13 @@ Reduction JSCreateLowering::ReduceJSCreateClosure(Node* node) {
   // Use inline allocation of closures only for instantiation sites that have
   // seen more than one instantiation, this simplifies the generated code and
   // also serves as a heuristic of which allocation sites benefit from it.
-  if (!feedback_cell.map(js_heap_broker())
-           .equals(MapRef(factory()->many_closures_cell_map()))) {
+  if (!feedback_cell.map().equals(
+          MapRef(js_heap_broker(), factory()->many_closures_cell_map()))) {
     return NoChange();
   }
 
-  MapRef function_map = native_context_ref().GetFunctionMapFromIndex(
-      js_heap_broker(), shared.function_map_index());
+  MapRef function_map =
+      native_context_ref().GetFunctionMapFromIndex(shared.function_map_index());
   DCHECK(!function_map.IsInobjectSlackTrackingInProgress());
   DCHECK(!function_map.is_dictionary_map());
 
@@ -1018,7 +999,7 @@ Reduction JSCreateLowering::ReduceJSCreateClosure(Node* node) {
 
   // Emit code to allocate the JSFunction instance.
   STATIC_ASSERT(JSFunction::kSizeWithoutPrototype == 7 * kPointerSize);
-  AllocationBuilder a(jsgraph(), js_heap_broker(), effect, control);
+  AllocationBuilder a(jsgraph(), effect, control);
   a.Allocate(function_map.instance_size(), pretenure, Type::Function());
   a.Store(AccessBuilder::ForMap(), function_map);
   a.Store(AccessBuilder::ForJSObjectPropertiesOrHash(),
@@ -1045,16 +1026,17 @@ Reduction JSCreateLowering::ReduceJSCreateClosure(Node* node) {
 }
 
 Reduction JSCreateLowering::ReduceJSCreateIterResultObject(Node* node) {
+  DisallowHeapAccess no_heap_access;
   DCHECK_EQ(IrOpcode::kJSCreateIterResultObject, node->opcode());
   Node* value = NodeProperties::GetValueInput(node, 0);
   Node* done = NodeProperties::GetValueInput(node, 1);
   Node* effect = NodeProperties::GetEffectInput(node);
 
-  Node* iterator_result_map = jsgraph()->HeapConstant(
-      handle(native_context()->iterator_result_map(), isolate()));
+  Node* iterator_result_map =
+      jsgraph()->Constant(native_context_ref().iterator_result_map());
 
   // Emit code to allocate the JSIteratorResult instance.
-  AllocationBuilder a(jsgraph(), js_heap_broker(), effect, graph()->start());
+  AllocationBuilder a(jsgraph(), effect, graph()->start());
   a.Allocate(JSIteratorResult::kSize);
   a.Store(AccessBuilder::ForMap(), iterator_result_map);
   a.Store(AccessBuilder::ForJSObjectPropertiesOrHash(),
@@ -1069,14 +1051,14 @@ Reduction JSCreateLowering::ReduceJSCreateIterResultObject(Node* node) {
 }
 
 Reduction JSCreateLowering::ReduceJSCreateStringIterator(Node* node) {
+  DisallowHeapAccess no_heap_access;
   DCHECK_EQ(IrOpcode::kJSCreateStringIterator, node->opcode());
   Node* string = NodeProperties::GetValueInput(node, 0);
   Node* effect = NodeProperties::GetEffectInput(node);
 
-  Node* map = jsgraph()->HeapConstant(
-      handle(native_context()->string_iterator_map(), isolate()));
+  Node* map = jsgraph()->Constant(native_context_ref().string_iterator_map());
   // Allocate new iterator and attach the iterator to this string.
-  AllocationBuilder a(jsgraph(), js_heap_broker(), effect, graph()->start());
+  AllocationBuilder a(jsgraph(), effect, graph()->start());
   a.Allocate(JSStringIterator::kSize, NOT_TENURED, Type::OtherObject());
   a.Store(AccessBuilder::ForMap(), map);
   a.Store(AccessBuilder::ForJSObjectPropertiesOrHash(),
@@ -1091,17 +1073,18 @@ Reduction JSCreateLowering::ReduceJSCreateStringIterator(Node* node) {
 }
 
 Reduction JSCreateLowering::ReduceJSCreateKeyValueArray(Node* node) {
+  DisallowHeapAccess no_heap_access;
   DCHECK_EQ(IrOpcode::kJSCreateKeyValueArray, node->opcode());
   Node* key = NodeProperties::GetValueInput(node, 0);
   Node* value = NodeProperties::GetValueInput(node, 1);
   Node* effect = NodeProperties::GetEffectInput(node);
 
-  Node* array_map = jsgraph()->HeapConstant(
-      handle(native_context()->js_array_fast_elements_map_index(), isolate()));
+  Node* array_map = jsgraph()->Constant(
+      native_context_ref().js_array_fast_elements_map_index());
   Node* properties = jsgraph()->EmptyFixedArrayConstant();
   Node* length = jsgraph()->Constant(2);
 
-  AllocationBuilder aa(jsgraph(), js_heap_broker(), effect, graph()->start());
+  AllocationBuilder aa(jsgraph(), effect, graph()->start());
   aa.AllocateArray(2, factory()->fixed_array_map());
   aa.Store(AccessBuilder::ForFixedArrayElement(PACKED_ELEMENTS),
            jsgraph()->ZeroConstant(), key);
@@ -1109,7 +1092,7 @@ Reduction JSCreateLowering::ReduceJSCreateKeyValueArray(Node* node) {
            jsgraph()->OneConstant(), value);
   Node* elements = aa.Finish();
 
-  AllocationBuilder a(jsgraph(), js_heap_broker(), elements, graph()->start());
+  AllocationBuilder a(jsgraph(), elements, graph()->start());
   a.Allocate(JSArray::kSize);
   a.Store(AccessBuilder::ForMap(), array_map);
   a.Store(AccessBuilder::ForJSObjectPropertiesOrHash(), properties);
@@ -1121,14 +1104,14 @@ Reduction JSCreateLowering::ReduceJSCreateKeyValueArray(Node* node) {
 }
 
 Reduction JSCreateLowering::ReduceJSCreatePromise(Node* node) {
+  DisallowHeapAccess no_heap_access;
   DCHECK_EQ(IrOpcode::kJSCreatePromise, node->opcode());
   Node* effect = NodeProperties::GetEffectInput(node);
 
-  Handle<Map> promise_map(native_context()->promise_function()->initial_map(),
-                          isolate());
+  MapRef promise_map = native_context_ref().promise_function_initial_map();
 
-  AllocationBuilder a(jsgraph(), js_heap_broker(), effect, graph()->start());
-  a.Allocate(promise_map->instance_size());
+  AllocationBuilder a(jsgraph(), effect, graph()->start());
+  a.Allocate(promise_map.instance_size());
   a.Store(AccessBuilder::ForMap(), promise_map);
   a.Store(AccessBuilder::ForJSObjectPropertiesOrHash(),
           jsgraph()->EmptyFixedArrayConstant());
@@ -1150,25 +1133,24 @@ Reduction JSCreateLowering::ReduceJSCreatePromise(Node* node) {
 }
 
 Reduction JSCreateLowering::ReduceJSCreateLiteralArrayOrObject(Node* node) {
+  DisallowHeapAccess no_heap_access;
   DCHECK(node->opcode() == IrOpcode::kJSCreateLiteralArray ||
          node->opcode() == IrOpcode::kJSCreateLiteralObject);
   CreateLiteralParameters const& p = CreateLiteralParametersOf(node->op());
   Node* effect = NodeProperties::GetEffectInput(node);
   Node* control = NodeProperties::GetControlInput(node);
 
-  FeedbackVectorRef feedback_vector(p.feedback().vector());
-  ObjectRef feedback =
-      feedback_vector.get(js_heap_broker(), p.feedback().slot());
+  FeedbackVectorRef feedback_vector(js_heap_broker(), p.feedback().vector());
+  ObjectRef feedback = feedback_vector.get(p.feedback().slot());
   if (feedback.IsAllocationSite()) {
     AllocationSiteRef site = feedback.AsAllocationSite();
-    if (site.IsFastLiteral(js_heap_broker())) {
+    if (site.IsFastLiteral()) {
       PretenureFlag pretenure = NOT_TENURED;
       if (FLAG_allocation_site_pretenuring) {
-        pretenure = dependencies()->DependOnPretenureMode(
-            site.object<AllocationSite>());
+        pretenure = dependencies()->DependOnPretenureMode(site);
       }
-      dependencies()->DependOnElementsKinds(site.object<AllocationSite>());
-      JSObjectRef boilerplate = site.boilerplate(js_heap_broker());
+      dependencies()->DependOnElementsKinds(site);
+      JSObjectRef boilerplate = site.boilerplate();
       Node* value = effect =
           AllocateFastLiteral(effect, control, boilerplate, pretenure);
       ReplaceWithValue(node, value, effect, control);
@@ -1189,37 +1171,41 @@ Reduction JSCreateLowering::ReduceJSCreateEmptyLiteralArray(Node* node) {
     Handle<Map> const initial_map(
         native_context()->GetInitialJSArrayMap(site->GetElementsKind()),
         isolate());
-    PretenureFlag const pretenure = dependencies()->DependOnPretenureMode(site);
-    dependencies()->DependOnElementsKind(site);
+    auto site_ref = AllocationSiteRef(js_heap_broker(), site);
+    PretenureFlag const pretenure =
+        dependencies()->DependOnPretenureMode(site_ref);
+    dependencies()->DependOnElementsKind(site_ref);
     Node* length = jsgraph()->ZeroConstant();
-    return ReduceNewArray(node, length, 0, initial_map, pretenure);
+    return ReduceNewArray(node, length, 0,
+                          MapRef(js_heap_broker(), initial_map), pretenure);
   }
   return NoChange();
 }
 
 Reduction JSCreateLowering::ReduceJSCreateEmptyLiteralObject(Node* node) {
+  DisallowHeapAccess no_heap_access;
   DCHECK_EQ(IrOpcode::kJSCreateEmptyLiteralObject, node->opcode());
   Node* effect = NodeProperties::GetEffectInput(node);
   Node* control = NodeProperties::GetControlInput(node);
 
   // Retrieve the initial map for the object.
-  Handle<Map> map = factory()->ObjectLiteralMapFromCache(native_context(), 0);
-  DCHECK(!map->is_dictionary_map());
-  DCHECK(!map->IsInobjectSlackTrackingInProgress());
-  Node* js_object_map = jsgraph()->HeapConstant(map);
+  MapRef map = native_context_ref().ObjectLiteralMapFromCache();
+  DCHECK(!map.is_dictionary_map());
+  DCHECK(!map.IsInobjectSlackTrackingInProgress());
+  Node* js_object_map = jsgraph()->Constant(map);
 
   // Setup elements and properties.
   Node* elements = jsgraph()->EmptyFixedArrayConstant();
   Node* properties = jsgraph()->EmptyFixedArrayConstant();
 
   // Perform the allocation of the actual JSArray object.
-  AllocationBuilder a(jsgraph(), js_heap_broker(), effect, control);
-  a.Allocate(map->instance_size());
+  AllocationBuilder a(jsgraph(), effect, control);
+  a.Allocate(map.instance_size());
   a.Store(AccessBuilder::ForMap(), js_object_map);
   a.Store(AccessBuilder::ForJSObjectPropertiesOrHash(), properties);
   a.Store(AccessBuilder::ForJSObjectElements(), elements);
-  for (int i = 0; i < map->GetInObjectProperties(); i++) {
-    a.Store(AccessBuilder::ForJSObjectInObjectProperty(MapRef(map), i),
+  for (int i = 0; i < map.GetInObjectProperties(); i++) {
+    a.Store(AccessBuilder::ForJSObjectInObjectProperty(map, i),
             jsgraph()->UndefinedConstant());
   }
 
@@ -1235,9 +1221,8 @@ Reduction JSCreateLowering::ReduceJSCreateLiteralRegExp(Node* node) {
   Node* effect = NodeProperties::GetEffectInput(node);
   Node* control = NodeProperties::GetControlInput(node);
 
-  FeedbackVectorRef feedback_vector(p.feedback().vector());
-  ObjectRef feedback =
-      feedback_vector.get(js_heap_broker(), p.feedback().slot());
+  FeedbackVectorRef feedback_vector(js_heap_broker(), p.feedback().vector());
+  ObjectRef feedback = feedback_vector.get(p.feedback().slot());
   if (feedback.IsJSRegExp()) {
     JSRegExpRef boilerplate = feedback.AsJSRegExp();
     Node* value = effect = AllocateLiteralRegExp(effect, control, boilerplate);
@@ -1252,7 +1237,7 @@ Reduction JSCreateLowering::ReduceJSCreateFunctionContext(Node* node) {
   DCHECK_EQ(IrOpcode::kJSCreateFunctionContext, node->opcode());
   const CreateFunctionContextParameters& parameters =
       CreateFunctionContextParametersOf(node->op());
-  ScopeInfoRef scope_info(parameters.scope_info());
+  ScopeInfoRef scope_info(js_heap_broker(), parameters.scope_info());
   int slot_count = parameters.slot_count();
   ScopeType scope_type = parameters.scope_type();
 
@@ -1263,7 +1248,7 @@ Reduction JSCreateLowering::ReduceJSCreateFunctionContext(Node* node) {
     Node* control = NodeProperties::GetControlInput(node);
     Node* context = NodeProperties::GetContextInput(node);
     Node* extension = jsgraph()->TheHoleConstant();
-    AllocationBuilder a(jsgraph(), js_heap_broker(), effect, control);
+    AllocationBuilder a(jsgraph(), effect, control);
     STATIC_ASSERT(Context::MIN_CONTEXT_SLOTS == 4);  // Ensure fully covered.
     int context_length = slot_count + Context::MIN_CONTEXT_SLOTS;
     Handle<Map> map;
@@ -1298,13 +1283,13 @@ Reduction JSCreateLowering::ReduceJSCreateFunctionContext(Node* node) {
 Reduction JSCreateLowering::ReduceJSCreateWithContext(Node* node) {
   DisallowHeapAccess no_heap_access;
   DCHECK_EQ(IrOpcode::kJSCreateWithContext, node->opcode());
-  ScopeInfoRef scope_info(ScopeInfoOf(node->op()));
+  ScopeInfoRef scope_info(js_heap_broker(), ScopeInfoOf(node->op()));
   Node* extension = NodeProperties::GetValueInput(node, 0);
   Node* effect = NodeProperties::GetEffectInput(node);
   Node* control = NodeProperties::GetControlInput(node);
   Node* context = NodeProperties::GetContextInput(node);
 
-  AllocationBuilder a(jsgraph(), js_heap_broker(), effect, control);
+  AllocationBuilder a(jsgraph(), effect, control);
   STATIC_ASSERT(Context::MIN_CONTEXT_SLOTS == 4);  // Ensure fully covered.
   a.AllocateContext(Context::MIN_CONTEXT_SLOTS, factory()->with_context_map());
   a.Store(AccessBuilder::ForContextSlot(Context::SCOPE_INFO_INDEX), scope_info);
@@ -1320,14 +1305,14 @@ Reduction JSCreateLowering::ReduceJSCreateWithContext(Node* node) {
 Reduction JSCreateLowering::ReduceJSCreateCatchContext(Node* node) {
   DisallowHeapAccess no_heap_access;
   DCHECK_EQ(IrOpcode::kJSCreateCatchContext, node->opcode());
-  ScopeInfoRef scope_info(ScopeInfoOf(node->op()));
+  ScopeInfoRef scope_info(js_heap_broker(), ScopeInfoOf(node->op()));
   Node* exception = NodeProperties::GetValueInput(node, 0);
   Node* effect = NodeProperties::GetEffectInput(node);
   Node* control = NodeProperties::GetControlInput(node);
   Node* context = NodeProperties::GetContextInput(node);
   Node* extension = jsgraph()->TheHoleConstant();
 
-  AllocationBuilder a(jsgraph(), js_heap_broker(), effect, control);
+  AllocationBuilder a(jsgraph(), effect, control);
   STATIC_ASSERT(Context::MIN_CONTEXT_SLOTS == 4);  // Ensure fully covered.
   a.AllocateContext(Context::MIN_CONTEXT_SLOTS + 1,
                     factory()->catch_context_map());
@@ -1346,7 +1331,7 @@ Reduction JSCreateLowering::ReduceJSCreateCatchContext(Node* node) {
 Reduction JSCreateLowering::ReduceJSCreateBlockContext(Node* node) {
   DisallowHeapAccess no_heap_access;
   DCHECK_EQ(IrOpcode::kJSCreateBlockContext, node->opcode());
-  ScopeInfoRef scope_info(ScopeInfoOf(node->op()));
+  ScopeInfoRef scope_info(js_heap_broker(), ScopeInfoOf(node->op()));
   int const context_length = scope_info.ContextLength();
 
   // Use inline allocation for block contexts up to a size limit.
@@ -1357,7 +1342,7 @@ Reduction JSCreateLowering::ReduceJSCreateBlockContext(Node* node) {
     Node* context = NodeProperties::GetContextInput(node);
     Node* extension = jsgraph()->TheHoleConstant();
 
-    AllocationBuilder a(jsgraph(), js_heap_broker(), effect, control);
+    AllocationBuilder a(jsgraph(), effect, control);
     STATIC_ASSERT(Context::MIN_CONTEXT_SLOTS == 4);  // Ensure fully covered.
     a.AllocateContext(context_length, factory()->block_context_map());
     a.Store(AccessBuilder::ForContextSlot(Context::SCOPE_INFO_INDEX),
@@ -1387,15 +1372,13 @@ Reduction JSCreateLowering::ReduceJSCreateObject(Node* node) {
   if (!prototype_type.IsHeapConstant()) return NoChange();
 
   HeapObjectRef prototype_const = prototype_type.AsHeapConstant()->Ref();
-  auto maybe_instance_map =
-      prototype_const.TryGetObjectCreateMap(js_heap_broker());
+  auto maybe_instance_map = prototype_const.TryGetObjectCreateMap();
   if (!maybe_instance_map) return NoChange();
   MapRef instance_map = maybe_instance_map.value();
 
   Node* properties = jsgraph()->EmptyFixedArrayConstant();
   if (instance_map.is_dictionary_map()) {
-    DCHECK_EQ(prototype_const.type(js_heap_broker()).oddball_type(),
-              OddballType::kNull);
+    DCHECK_EQ(prototype_const.type().oddball_type(), OddballType::kNull);
     // Allocate an empty NameDictionary as backing store for the properties.
     Handle<Map> map = isolate()->factory()->name_dictionary_map();
     int capacity =
@@ -1404,7 +1387,7 @@ Reduction JSCreateLowering::ReduceJSCreateObject(Node* node) {
     int length = NameDictionary::EntryToIndex(capacity);
     int size = NameDictionary::SizeFor(length);
 
-    AllocationBuilder a(jsgraph(), js_heap_broker(), effect, control);
+    AllocationBuilder a(jsgraph(), effect, control);
     a.Allocate(size, NOT_TENURED, Type::Any());
     a.Store(AccessBuilder::ForMap(), map);
     // Initialize FixedArray fields.
@@ -1440,7 +1423,7 @@ Reduction JSCreateLowering::ReduceJSCreateObject(Node* node) {
 
   // Emit code to allocate the JSObject instance for the given
   // {instance_map}.
-  AllocationBuilder a(jsgraph(), js_heap_broker(), effect, control);
+  AllocationBuilder a(jsgraph(), effect, control);
   a.Allocate(instance_size, NOT_TENURED, Type::Any());
   a.Store(AccessBuilder::ForMap(), instance_map);
   a.Store(AccessBuilder::ForJSObjectPropertiesOrHash(), properties);
@@ -1473,7 +1456,7 @@ Node* JSCreateLowering::AllocateArguments(Node* effect, Node* control,
   auto parameters_it = ++parameters_access.begin();
 
   // Actually allocate the backing store.
-  AllocationBuilder a(jsgraph(), js_heap_broker(), effect, control);
+  AllocationBuilder a(jsgraph(), effect, control);
   a.AllocateArray(argument_count, factory()->fixed_array_map());
   for (int i = 0; i < argument_count; ++i, ++parameters_it) {
     DCHECK_NOT_NULL((*parameters_it).node);
@@ -1503,7 +1486,7 @@ Node* JSCreateLowering::AllocateRestArguments(Node* effect, Node* control,
   }
 
   // Actually allocate the backing store.
-  AllocationBuilder a(jsgraph(), js_heap_broker(), effect, control);
+  AllocationBuilder a(jsgraph(), effect, control);
   a.AllocateArray(num_elements, factory()->fixed_array_map());
   for (int i = 0; i < num_elements; ++i, ++parameters_it) {
     DCHECK_NOT_NULL((*parameters_it).node);
@@ -1541,7 +1524,7 @@ Node* JSCreateLowering::AllocateAliasedArguments(
   // The unmapped argument values recorded in the frame state are stored yet
   // another indirection away and then linked into the parameter map below,
   // whereas mapped argument values are replaced with a hole instead.
-  AllocationBuilder aa(jsgraph(), js_heap_broker(), effect, control);
+  AllocationBuilder aa(jsgraph(), effect, control);
   aa.AllocateArray(argument_count, factory()->fixed_array_map());
   for (int i = 0; i < mapped_count; ++i, ++parameters_it) {
     aa.Store(AccessBuilder::ForFixedArraySlot(i), jsgraph()->TheHoleConstant());
@@ -1553,7 +1536,7 @@ Node* JSCreateLowering::AllocateAliasedArguments(
   Node* arguments = aa.Finish();
 
   // Actually allocate the backing store.
-  AllocationBuilder a(jsgraph(), js_heap_broker(), arguments, control);
+  AllocationBuilder a(jsgraph(), arguments, control);
   a.AllocateArray(mapped_count + 2, factory()->sloppy_arguments_elements_map());
   a.Store(AccessBuilder::ForFixedArraySlot(0), context);
   a.Store(AccessBuilder::ForFixedArraySlot(1), arguments);
@@ -1595,7 +1578,7 @@ Node* JSCreateLowering::AllocateAliasedArguments(
                        arguments_frame, arguments_length, effect);
 
   // Actually allocate the backing store.
-  AllocationBuilder a(jsgraph(), js_heap_broker(), arguments, control);
+  AllocationBuilder a(jsgraph(), arguments, control);
   a.AllocateArray(mapped_count + 2, factory()->sloppy_arguments_elements_map());
   a.Store(AccessBuilder::ForFixedArraySlot(0), context);
   a.Store(AccessBuilder::ForFixedArraySlot(1), arguments);
@@ -1627,7 +1610,7 @@ Node* JSCreateLowering::AllocateElements(Node* effect, Node* control,
   Node* value = jsgraph()->TheHoleConstant();
 
   // Actually allocate the backing store.
-  AllocationBuilder a(jsgraph(), js_heap_broker(), effect, control);
+  AllocationBuilder a(jsgraph(), effect, control);
   a.AllocateArray(capacity, elements_map, pretenure);
   for (int i = 0; i < capacity; ++i) {
     Node* index = jsgraph()->Constant(i);
@@ -1652,7 +1635,7 @@ Node* JSCreateLowering::AllocateElements(Node* effect, Node* control,
                              : AccessBuilder::ForFixedArrayElement();
 
   // Actually allocate the backing store.
-  AllocationBuilder a(jsgraph(), js_heap_broker(), effect, control);
+  AllocationBuilder a(jsgraph(), effect, control);
   a.AllocateArray(capacity, elements_map, pretenure);
   for (int i = 0; i < capacity; ++i) {
     Node* index = jsgraph()->Constant(i);
@@ -1668,7 +1651,7 @@ Node* JSCreateLowering::AllocateFastLiteral(Node* effect, Node* control,
   Node* properties = jsgraph()->EmptyFixedArrayConstant();
 
   // Compute the in-object properties to store first (might have effects).
-  MapRef boilerplate_map = boilerplate.map(js_heap_broker());
+  MapRef boilerplate_map = boilerplate.map();
   ZoneVector<std::pair<FieldAccess, Node*>> inobject_fields(zone());
   inobject_fields.reserve(boilerplate_map.GetInObjectProperties());
   int const boilerplate_nof = boilerplate_map.NumberOfOwnDescriptors();
@@ -1677,7 +1660,7 @@ Node* JSCreateLowering::AllocateFastLiteral(Node* effect, Node* control,
         boilerplate_map.GetPropertyDetails(i);
     if (property_details.location() != kField) continue;
     DCHECK_EQ(kData, property_details.kind());
-    NameRef property_name = boilerplate_map.GetPropertyKey(js_heap_broker(), i);
+    NameRef property_name = boilerplate_map.GetPropertyKey(i);
     FieldIndex index = boilerplate_map.GetFieldIndexFor(i);
     FieldAccess access = {
         kTaggedBase,        index.offset(), property_name.object<Name>(),
@@ -1689,8 +1672,7 @@ Node* JSCreateLowering::AllocateFastLiteral(Node* effect, Node* control,
       access.type = Type::Number();
       value = jsgraph()->Constant(boilerplate.RawFastDoublePropertyAt(index));
     } else {
-      ObjectRef boilerplate_value =
-          boilerplate.RawFastPropertyAt(js_heap_broker(), index);
+      ObjectRef boilerplate_value = boilerplate.RawFastPropertyAt(index);
       if (boilerplate_value.IsJSObject()) {
         JSObjectRef boilerplate_object = boilerplate_value.AsJSObject();
         value = effect =
@@ -1698,7 +1680,7 @@ Node* JSCreateLowering::AllocateFastLiteral(Node* effect, Node* control,
       } else if (property_details.representation().IsDouble()) {
         double number = boilerplate_value.AsMutableHeapNumber().value();
         // Allocate a mutable HeapNumber box and store the value into it.
-        AllocationBuilder builder(jsgraph(), js_heap_broker(), effect, control);
+        AllocationBuilder builder(jsgraph(), effect, control);
         builder.Allocate(HeapNumber::kSize, pretenure);
         builder.Store(AccessBuilder::ForMap(),
                       factory()->mutable_heap_number_map());
@@ -1707,12 +1689,11 @@ Node* JSCreateLowering::AllocateFastLiteral(Node* effect, Node* control,
         value = effect = builder.Finish();
       } else if (property_details.representation().IsSmi()) {
         // Ensure that value is stored as smi.
-        value = boilerplate_value.oddball_type(js_heap_broker()) ==
-                        OddballType::kUninitialized
+        value = boilerplate_value.oddball_type() == OddballType::kUninitialized
                     ? jsgraph()->ZeroConstant()
                     : jsgraph()->Constant(boilerplate_value.AsSmi());
       } else {
-        value = jsgraph()->Constant(js_heap_broker(), boilerplate_value);
+        value = jsgraph()->Constant(boilerplate_value);
       }
     }
     inobject_fields.push_back(std::make_pair(access, value));
@@ -1734,7 +1715,7 @@ Node* JSCreateLowering::AllocateFastLiteral(Node* effect, Node* control,
   if (elements->op()->EffectOutputCount() > 0) effect = elements;
 
   // Actually allocate and initialize the object.
-  AllocationBuilder builder(jsgraph(), js_heap_broker(), effect, control);
+  AllocationBuilder builder(jsgraph(), effect, control);
   builder.Allocate(boilerplate_map.instance_size(), pretenure,
                    Type::For(js_heap_broker(), boilerplate_map.object<Map>()));
   builder.Store(AccessBuilder::ForMap(), boilerplate_map);
@@ -1744,7 +1725,7 @@ Node* JSCreateLowering::AllocateFastLiteral(Node* effect, Node* control,
     JSArrayRef boilerplate_array = boilerplate.AsJSArray();
     builder.Store(
         AccessBuilder::ForJSArrayLength(boilerplate_array.GetElementsKind()),
-        boilerplate_array.length(js_heap_broker()));
+        boilerplate_array.length());
   }
   for (auto const& inobject_field : inobject_fields) {
     builder.Store(inobject_field.first, inobject_field.second);
@@ -1755,17 +1736,15 @@ Node* JSCreateLowering::AllocateFastLiteral(Node* effect, Node* control,
 Node* JSCreateLowering::AllocateFastLiteralElements(Node* effect, Node* control,
                                                     JSObjectRef boilerplate,
                                                     PretenureFlag pretenure) {
-  FixedArrayBaseRef boilerplate_elements =
-      boilerplate.elements(js_heap_broker());
+  FixedArrayBaseRef boilerplate_elements = boilerplate.elements();
 
   // Empty or copy-on-write elements just store a constant.
   int const elements_length = boilerplate_elements.length();
-  MapRef elements_map = boilerplate_elements.map(js_heap_broker());
-  if (boilerplate_elements.length() == 0 ||
-      elements_map.IsFixedCowArrayMap(js_heap_broker())) {
+  MapRef elements_map = boilerplate_elements.map();
+  if (boilerplate_elements.length() == 0 || elements_map.IsFixedCowArrayMap()) {
     if (pretenure == TENURED) {
-      boilerplate.EnsureElementsTenured(js_heap_broker());
-      boilerplate_elements = boilerplate.elements(js_heap_broker());
+      boilerplate.EnsureElementsTenured();
+      boilerplate_elements = boilerplate.elements();
     }
     return jsgraph()->HeapConstant(boilerplate_elements.object<HeapObject>());
   }
@@ -1784,23 +1763,22 @@ Node* JSCreateLowering::AllocateFastLiteralElements(Node* effect, Node* control,
   } else {
     FixedArrayRef elements = boilerplate_elements.AsFixedArray();
     for (int i = 0; i < elements_length; ++i) {
-      if (elements.is_the_hole(js_heap_broker(), i)) {
+      if (elements.is_the_hole(i)) {
         elements_values[i] = jsgraph()->TheHoleConstant();
       } else {
-        ObjectRef element_value = elements.get(js_heap_broker(), i);
+        ObjectRef element_value = elements.get(i);
         if (element_value.IsJSObject()) {
           elements_values[i] = effect = AllocateFastLiteral(
               effect, control, element_value.AsJSObject(), pretenure);
         } else {
-          elements_values[i] =
-              jsgraph()->Constant(js_heap_broker(), element_value);
+          elements_values[i] = jsgraph()->Constant(element_value);
         }
       }
     }
   }
 
   // Allocate the backing store array and store the elements.
-  AllocationBuilder builder(jsgraph(), js_heap_broker(), effect, control);
+  AllocationBuilder builder(jsgraph(), effect, control);
   builder.AllocateArray(elements_length, elements_map.object<Map>(), pretenure);
   ElementAccess const access =
       (elements_map.instance_type() == FIXED_DOUBLE_ARRAY_TYPE)
@@ -1814,7 +1792,7 @@ Node* JSCreateLowering::AllocateFastLiteralElements(Node* effect, Node* control,
 
 Node* JSCreateLowering::AllocateLiteralRegExp(Node* effect, Node* control,
                                               JSRegExpRef boilerplate) {
-  MapRef boilerplate_map = boilerplate.map(js_heap_broker());
+  MapRef boilerplate_map = boilerplate.map();
 
   // Sanity check that JSRegExp object layout hasn't changed.
   STATIC_ASSERT(JSRegExp::kDataOffset == JSObject::kHeaderSize);
@@ -1830,23 +1808,19 @@ Node* JSCreateLowering::AllocateLiteralRegExp(Node* effect, Node* control,
   const int size =
       JSRegExp::kSize + JSRegExp::kInObjectFieldCount * kPointerSize;
 
-  AllocationBuilder builder(jsgraph(), js_heap_broker(), effect, control);
+  AllocationBuilder builder(jsgraph(), effect, control);
   builder.Allocate(size, pretenure,
                    Type::For(js_heap_broker(), boilerplate_map.object<Map>()));
   builder.Store(AccessBuilder::ForMap(), boilerplate_map);
   builder.Store(AccessBuilder::ForJSObjectPropertiesOrHash(),
-                boilerplate.raw_properties_or_hash(js_heap_broker()));
-  builder.Store(AccessBuilder::ForJSObjectElements(),
-                boilerplate.elements(js_heap_broker()));
-
-  builder.Store(AccessBuilder::ForJSRegExpData(),
-                boilerplate.data(js_heap_broker()));
-  builder.Store(AccessBuilder::ForJSRegExpSource(),
-                boilerplate.source(js_heap_broker()));
-  builder.Store(AccessBuilder::ForJSRegExpFlags(),
-                boilerplate.flags(js_heap_broker()));
+                boilerplate.raw_properties_or_hash());
+  builder.Store(AccessBuilder::ForJSObjectElements(), boilerplate.elements());
+
+  builder.Store(AccessBuilder::ForJSRegExpData(), boilerplate.data());
+  builder.Store(AccessBuilder::ForJSRegExpSource(), boilerplate.source());
+  builder.Store(AccessBuilder::ForJSRegExpFlags(), boilerplate.flags());
   builder.Store(AccessBuilder::ForJSRegExpLastIndex(),
-                boilerplate.last_index(js_heap_broker()));
+                boilerplate.last_index());
 
   return builder.Finish();
 }
@@ -1866,7 +1840,7 @@ SimplifiedOperatorBuilder* JSCreateLowering::simplified() const {
 }
 
 NativeContextRef JSCreateLowering::native_context_ref() const {
-  return NativeContextRef(native_context());
+  return NativeContextRef(js_heap_broker(), native_context());
 }
 
 }  // namespace compiler
diff --git a/deps/v8/src/compiler/js-create-lowering.h b/deps/v8/src/compiler/js-create-lowering.h
index 667298c2388db6..cb58140c0e1923 100644
--- a/deps/v8/src/compiler/js-create-lowering.h
+++ b/deps/v8/src/compiler/js-create-lowering.h
@@ -68,12 +68,12 @@ class V8_EXPORT_PRIVATE JSCreateLowering final
   Reduction ReduceJSCreateCatchContext(Node* node);
   Reduction ReduceJSCreateBlockContext(Node* node);
   Reduction ReduceJSCreateGeneratorObject(Node* node);
-  Reduction ReduceNewArray(Node* node, Node* length, Handle<Map> initial_map,
+  Reduction ReduceNewArray(Node* node, Node* length, MapRef initial_map,
                            PretenureFlag pretenure);
   Reduction ReduceNewArray(Node* node, Node* length, int capacity,
-                           Handle<Map> initial_map, PretenureFlag pretenure);
+                           MapRef initial_map, PretenureFlag pretenure);
   Reduction ReduceNewArray(Node* node, std::vector<Node*> values,
-                           Handle<Map> initial_map, PretenureFlag pretenure);
+                           MapRef initial_map, PretenureFlag pretenure);
   Reduction ReduceJSCreateObject(Node* node);
 
   Node* AllocateArguments(Node* effect, Node* control, Node* frame_state);
@@ -104,7 +104,8 @@ class V8_EXPORT_PRIVATE JSCreateLowering final
   Node* AllocateLiteralRegExp(Node* effect, Node* control,
                               JSRegExpRef boilerplate);
 
-  Reduction ReduceNewArrayToStubCall(Node* node, Handle<AllocationSite> site);
+  Reduction ReduceNewArrayToStubCall(Node* node,
+                                     base::Optional<AllocationSiteRef> site);
 
   Factory* factory() const;
   Graph* graph() const;
diff --git a/deps/v8/src/compiler/js-generic-lowering.cc b/deps/v8/src/compiler/js-generic-lowering.cc
index 5e134307f423c7..9d3636862f054e 100644
--- a/deps/v8/src/compiler/js-generic-lowering.cc
+++ b/deps/v8/src/compiler/js-generic-lowering.cc
@@ -82,6 +82,7 @@ REPLACE_STUB_CALL(Equal)
 REPLACE_STUB_CALL(ToInteger)
 REPLACE_STUB_CALL(ToLength)
 REPLACE_STUB_CALL(ToNumber)
+REPLACE_STUB_CALL(ToNumberConvertBigInt)
 REPLACE_STUB_CALL(ToNumeric)
 REPLACE_STUB_CALL(ToName)
 REPLACE_STUB_CALL(ToObject)
diff --git a/deps/v8/src/compiler/js-graph.cc b/deps/v8/src/compiler/js-graph.cc
index 9feb518e463dd8..b3ef85fb07000d 100644
--- a/deps/v8/src/compiler/js-graph.cc
+++ b/deps/v8/src/compiler/js-graph.cc
@@ -66,9 +66,9 @@ Node* JSGraph::Constant(Handle<Object> value) {
   }
 }
 
-Node* JSGraph::Constant(const JSHeapBroker* broker, const ObjectRef& ref) {
+Node* JSGraph::Constant(const ObjectRef& ref) {
   if (ref.IsSmi()) return Constant(ref.AsSmi());
-  OddballType oddball_type = ref.oddball_type(broker);
+  OddballType oddball_type = ref.oddball_type();
   if (ref.IsHeapNumber()) {
     return Constant(ref.AsHeapNumber().value());
   } else if (oddball_type == OddballType::kUndefined) {
diff --git a/deps/v8/src/compiler/js-graph.h b/deps/v8/src/compiler/js-graph.h
index 6d66e1724affea..517b799a24ca4d 100644
--- a/deps/v8/src/compiler/js-graph.h
+++ b/deps/v8/src/compiler/js-graph.h
@@ -56,8 +56,7 @@ class V8_EXPORT_PRIVATE JSGraph : public MachineGraph {
   Node* Constant(Handle<Object> value);
 
   // Like above, but doesn't access the heap directly.
-  // TODO(neis): Make the broker a member of JSGraph.
-  Node* Constant(const JSHeapBroker* broker, const ObjectRef& value);
+  Node* Constant(const ObjectRef& value);
 
   // Creates a NumberConstant node, usually canonicalized.
   Node* Constant(double value);
diff --git a/deps/v8/src/compiler/js-heap-broker.cc b/deps/v8/src/compiler/js-heap-broker.cc
index 6262adc9df7c74..bcb9ffe5582142 100644
--- a/deps/v8/src/compiler/js-heap-broker.cc
+++ b/deps/v8/src/compiler/js-heap-broker.cc
@@ -13,10 +13,11 @@ namespace v8 {
 namespace internal {
 namespace compiler {
 
-MapRef HeapObjectRef::map(const JSHeapBroker* broker) const {
+MapRef HeapObjectRef::map() const {
   AllowHandleAllocation handle_allocation;
   AllowHandleDereference allow_handle_dereference;
-  return MapRef(handle(object<HeapObject>()->map(), broker->isolate()));
+  return MapRef(broker(),
+                handle(object<HeapObject>()->map(), broker()->isolate()));
 }
 
 double HeapNumberRef::value() const {
@@ -40,25 +41,26 @@ bool ObjectRef::equals(const ObjectRef& other) const {
   return object<Object>().equals(other.object<Object>());
 }
 
-StringRef ObjectRef::TypeOf(const JSHeapBroker* broker) const {
+StringRef ObjectRef::TypeOf() const {
+  AllowHandleAllocation handle_allocation;
   AllowHandleDereference handle_dereference;
-  return StringRef(Object::TypeOf(broker->isolate(), object<Object>()));
+  return StringRef(broker(),
+                   Object::TypeOf(broker()->isolate(), object<Object>()));
 }
 
-base::Optional<ContextRef> ContextRef::previous(
-    const JSHeapBroker* broker) const {
+base::Optional<ContextRef> ContextRef::previous() const {
   AllowHandleAllocation handle_allocation;
   AllowHandleDereference handle_dereference;
   Context* previous = object<Context>()->previous();
   if (previous == nullptr) return base::Optional<ContextRef>();
-  return ContextRef(handle(previous, broker->isolate()));
+  return ContextRef(broker(), handle(previous, broker()->isolate()));
 }
 
-ObjectRef ContextRef::get(const JSHeapBroker* broker, int index) const {
+ObjectRef ContextRef::get(int index) const {
   AllowHandleAllocation handle_allocation;
   AllowHandleDereference handle_dereference;
-  Handle<Object> value(object<Context>()->get(index), broker->isolate());
-  return ObjectRef(value);
+  Handle<Object> value(object<Context>()->get(index), broker()->isolate());
+  return ObjectRef(broker(), value);
 }
 
 JSHeapBroker::JSHeapBroker(Isolate* isolate) : isolate_(isolate) {}
@@ -100,31 +102,30 @@ base::Optional<int> JSHeapBroker::TryGetSmi(Handle<Object> object) {
   return Smi::cast(*object)->value();
 }
 
-#define DEFINE_IS_AND_AS(Name)                       \
-  bool ObjectRef::Is##Name() const {                 \
-    AllowHandleDereference allow_handle_dereference; \
-    return object<Object>()->Is##Name();             \
-  }                                                  \
-  Name##Ref ObjectRef::As##Name() const {            \
-    DCHECK(Is##Name());                              \
-    return Name##Ref(object<HeapObject>());          \
+#define DEFINE_IS_AND_AS(Name)                        \
+  bool ObjectRef::Is##Name() const {                  \
+    AllowHandleDereference allow_handle_dereference;  \
+    return object<Object>()->Is##Name();              \
+  }                                                   \
+  Name##Ref ObjectRef::As##Name() const {             \
+    DCHECK(Is##Name());                               \
+    return Name##Ref(broker(), object<HeapObject>()); \
   }
 HEAP_BROKER_OBJECT_LIST(DEFINE_IS_AND_AS)
 #undef DEFINE_IS_AND_AS
 
-HeapObjectType HeapObjectRef::type(const JSHeapBroker* broker) const {
+HeapObjectType HeapObjectRef::type() const {
   AllowHandleDereference allow_handle_dereference;
-  return broker->HeapObjectTypeFromMap(object<HeapObject>()->map());
+  return broker()->HeapObjectTypeFromMap(object<HeapObject>()->map());
 }
 
-base::Optional<MapRef> HeapObjectRef::TryGetObjectCreateMap(
-    const JSHeapBroker* broker) const {
+base::Optional<MapRef> HeapObjectRef::TryGetObjectCreateMap() const {
   AllowHandleAllocation handle_allocation;
   AllowHandleDereference allow_handle_dereference;
   Handle<Map> instance_map;
-  if (Map::TryGetObjectCreateMap(broker->isolate(), object<HeapObject>())
+  if (Map::TryGetObjectCreateMap(broker()->isolate(), object<HeapObject>())
           .ToHandle(&instance_map)) {
-    return MapRef(instance_map);
+    return MapRef(broker(), instance_map);
   } else {
     return base::Optional<MapRef>();
   }
@@ -155,27 +156,34 @@ bool JSFunctionRef::IsConstructor() const {
   return object<JSFunction>()->IsConstructor();
 }
 
-MapRef JSFunctionRef::DependOnInitialMap(
-    const JSHeapBroker* broker, CompilationDependencies* dependencies) const {
+void JSFunctionRef::EnsureHasInitialMap() const {
   AllowHandleAllocation handle_allocation;
   AllowHandleDereference allow_handle_dereference;
-  Handle<Map> initial_map =
-      dependencies->DependOnInitialMap(object<JSFunction>());
-  return MapRef(initial_map);
+  AllowHeapAllocation heap_allocation;
+  // TODO(jarin) Eventually, we will prepare initial maps for resumable
+  // functions (i.e., generators).
+  DCHECK(IsResumableFunction(object<JSFunction>()->shared()->kind()));
+  JSFunction::EnsureHasInitialMap(object<JSFunction>());
 }
 
-void MapRef::DependOnStableMap(const JSHeapBroker* broker,
-                               CompilationDependencies* dependencies) const {
+// TODO(mslekova): Pre-compute these on the main thread.
+MapRef MapRef::AsElementsKind(ElementsKind kind,
+                              const JSHeapBroker* broker) const {
   AllowHandleAllocation handle_allocation;
+  AllowHeapAllocation heap_allocation;
   AllowHandleDereference allow_handle_dereference;
-  dependencies->DependOnStableMap(object<Map>());
+  return MapRef(broker,
+                Map::AsElementsKind(broker->isolate(), object<Map>(), kind));
 }
 
-int JSFunctionRef::GetInstanceSizeWithFinishedSlackTracking() const {
-  AllowHandleAllocation handle_allocation;
+SlackTrackingResult JSFunctionRef::FinishSlackTracking() const {
   AllowHandleDereference allow_handle_dereference;
+  AllowHandleAllocation handle_allocation;
   object<JSFunction>()->CompleteInobjectSlackTrackingIfActive();
-  return object<JSFunction>()->initial_map()->instance_size();
+  int instance_size = object<JSFunction>()->initial_map()->instance_size();
+  int inobject_property_count =
+      object<JSFunction>()->initial_map()->GetInObjectProperties();
+  return SlackTrackingResult(instance_size, inobject_property_count);
 }
 
 bool JSFunctionRef::has_initial_map() const {
@@ -183,24 +191,25 @@ bool JSFunctionRef::has_initial_map() const {
   return object<JSFunction>()->has_initial_map();
 }
 
-MapRef JSFunctionRef::initial_map(const JSHeapBroker* broker) const {
+MapRef JSFunctionRef::initial_map() const {
   AllowHandleAllocation handle_allocation;
   AllowHandleDereference allow_handle_dereference;
-  return MapRef(handle(object<JSFunction>()->initial_map(), broker->isolate()));
+  return MapRef(broker(), handle(object<JSFunction>()->initial_map(),
+                                 broker()->isolate()));
 }
 
-SharedFunctionInfoRef JSFunctionRef::shared(const JSHeapBroker* broker) const {
+SharedFunctionInfoRef JSFunctionRef::shared() const {
   AllowHandleAllocation handle_allocation;
   AllowHandleDereference allow_handle_dereference;
   return SharedFunctionInfoRef(
-      handle(object<JSFunction>()->shared(), broker->isolate()));
+      broker(), handle(object<JSFunction>()->shared(), broker()->isolate()));
 }
 
-JSGlobalProxyRef JSFunctionRef::global_proxy(const JSHeapBroker* broker) const {
+JSGlobalProxyRef JSFunctionRef::global_proxy() const {
   AllowHandleAllocation handle_allocation;
   AllowHandleDereference allow_handle_dereference;
-  return JSGlobalProxyRef(
-      handle(object<JSFunction>()->global_proxy(), broker->isolate()));
+  return JSGlobalProxyRef(broker(), handle(object<JSFunction>()->global_proxy(),
+                                           broker()->isolate()));
 }
 
 base::Optional<ScriptContextTableRef::LookupResult>
@@ -210,46 +219,67 @@ ScriptContextTableRef::lookup(const NameRef& name) const {
   if (!name.IsString()) return {};
   ScriptContextTable::LookupResult lookup_result;
   auto table = object<ScriptContextTable>();
-  if (!ScriptContextTable::Lookup(table, name.object<String>(),
-                                  &lookup_result)) {
+  if (!ScriptContextTable::Lookup(broker()->isolate(), table,
+                                  name.object<String>(), &lookup_result)) {
     return {};
   }
-  Handle<Context> script_context =
-      ScriptContextTable::GetContext(table, lookup_result.context_index);
-  LookupResult result{ContextRef(script_context),
+  Handle<Context> script_context = ScriptContextTable::GetContext(
+      broker()->isolate(), table, lookup_result.context_index);
+  LookupResult result{ContextRef(broker(), script_context),
                       lookup_result.mode == VariableMode::kConst,
                       lookup_result.slot_index};
   return result;
 }
 
-ScriptContextTableRef NativeContextRef::script_context_table(
-    const JSHeapBroker* broker) const {
+ScriptContextTableRef NativeContextRef::script_context_table() const {
   AllowHandleAllocation handle_allocation;
   AllowHandleDereference handle_dereference;
   return ScriptContextTableRef(
-      handle(object<Context>()->script_context_table(), broker->isolate()));
+      broker(),
+      handle(object<Context>()->script_context_table(), broker()->isolate()));
 }
 
-OddballType ObjectRef::oddball_type(const JSHeapBroker* broker) const {
-  return IsSmi() ? OddballType::kNone
-                 : AsHeapObject().type(broker).oddball_type();
+OddballType ObjectRef::oddball_type() const {
+  return IsSmi() ? OddballType::kNone : AsHeapObject().type().oddball_type();
 }
 
-ObjectRef FeedbackVectorRef::get(const JSHeapBroker* broker,
-                                 FeedbackSlot slot) const {
+ObjectRef FeedbackVectorRef::get(FeedbackSlot slot) const {
   AllowHandleAllocation handle_allocation;
   AllowHandleDereference handle_dereference;
   Handle<Object> value(object<FeedbackVector>()->Get(slot)->ToObject(),
-                       broker->isolate());
-  return ObjectRef(value);
+                       broker()->isolate());
+  return ObjectRef(broker(), value);
 }
 
-JSObjectRef AllocationSiteRef::boilerplate(const JSHeapBroker* broker) const {
+JSObjectRef AllocationSiteRef::boilerplate() const {
   AllowHandleAllocation handle_allocation;
   AllowHandleDereference handle_dereference;
   Handle<JSObject> value(object<AllocationSite>()->boilerplate(),
-                         broker->isolate());
-  return JSObjectRef(value);
+                         broker()->isolate());
+  return JSObjectRef(broker(), value);
+}
+
+ObjectRef AllocationSiteRef::nested_site() const {
+  AllowHandleAllocation handle_allocation;
+  AllowHandleDereference handle_dereference;
+  Handle<Object> obj(object<AllocationSite>()->nested_site(),
+                     broker()->isolate());
+  return ObjectRef(broker(), obj);
+}
+
+bool AllocationSiteRef::PointsToLiteral() const {
+  AllowHandleDereference handle_dereference;
+  return object<AllocationSite>()->PointsToLiteral();
+}
+
+ElementsKind AllocationSiteRef::GetElementsKind() const {
+  AllowHandleDereference handle_dereference;
+  return object<AllocationSite>()->GetElementsKind();
+}
+
+bool AllocationSiteRef::CanInlineCall() const {
+  AllowHandleDereference handle_dereference;
+  return object<AllocationSite>()->CanInlineCall();
 }
 
 bool JSObjectRef::IsUnboxedDoubleField(FieldIndex index) const {
@@ -262,19 +292,24 @@ double JSObjectRef::RawFastDoublePropertyAt(FieldIndex index) const {
   return object<JSObject>()->RawFastDoublePropertyAt(index);
 }
 
-ObjectRef JSObjectRef::RawFastPropertyAt(const JSHeapBroker* broker,
-                                         FieldIndex index) const {
+ObjectRef JSObjectRef::RawFastPropertyAt(FieldIndex index) const {
   AllowHandleAllocation handle_allocation;
   AllowHandleDereference handle_dereference;
-  return ObjectRef(
-      handle(object<JSObject>()->RawFastPropertyAt(index), broker->isolate()));
+  return ObjectRef(broker(),
+                   handle(object<JSObject>()->RawFastPropertyAt(index),
+                          broker()->isolate()));
 }
 
-FixedArrayBaseRef JSObjectRef::elements(const JSHeapBroker* broker) const {
+ElementsKind JSObjectRef::GetElementsKind() {
+  AllowHandleDereference handle_dereference;
+  return object<JSObject>()->GetElementsKind();
+}
+
+FixedArrayBaseRef JSObjectRef::elements() const {
   AllowHandleAllocation handle_allocation;
   AllowHandleDereference handle_dereference;
   return FixedArrayBaseRef(
-      handle(object<JSObject>()->elements(), broker->isolate()));
+      broker(), handle(object<JSObject>()->elements(), broker()->isolate()));
 }
 
 namespace {
@@ -360,11 +395,14 @@ const int kMaxFastLiteralProperties = JSObject::kMaxInObjectProperties;
 // Determines whether the given array or object literal boilerplate satisfies
 // all limits to be considered for fast deep-copying and computes the total
 // size of all objects that are part of the graph.
-bool AllocationSiteRef::IsFastLiteral(const JSHeapBroker* broker) const {
+bool AllocationSiteRef::IsFastLiteral() const {
+  AllowHeapAllocation
+      allow_heap_allocation;  // This is needed for TryMigrateInstance.
+  AllowHandleAllocation allow_handle_allocation;
   AllowHandleDereference allow_handle_dereference;
   int max_properties = kMaxFastLiteralProperties;
   Handle<JSObject> boilerplate(object<AllocationSite>()->boilerplate(),
-                               broker->isolate());
+                               broker()->isolate());
   return IsFastLiteralHelper(boilerplate, kMaxFastLiteralDepth,
                              &max_properties);
 }
@@ -374,23 +412,33 @@ PretenureFlag AllocationSiteRef::GetPretenureMode() const {
   return object<AllocationSite>()->GetPretenureMode();
 }
 
-void JSObjectRef::EnsureElementsTenured(const JSHeapBroker* broker) {
+void JSObjectRef::EnsureElementsTenured() {
   // TODO(jarin) Eventually, we will pretenure the boilerplates before
   // the compilation job starts.
+  AllowHandleAllocation allow_handle_allocation;
   AllowHandleDereference allow_handle_dereference;
-  Handle<FixedArrayBase> object_elements =
-      elements(broker).object<FixedArrayBase>();
+  Handle<FixedArrayBase> object_elements = elements().object<FixedArrayBase>();
   if (Heap::InNewSpace(*object_elements)) {
     // If we would like to pretenure a fixed cow array, we must ensure that
     // the array is already in old space, otherwise we'll create too many
     // old-to-new-space pointers (overflowing the store buffer).
     object_elements = Handle<FixedArrayBase>(
-        broker->isolate()->factory()->CopyAndTenureFixedCOWArray(
+        broker()->isolate()->factory()->CopyAndTenureFixedCOWArray(
             Handle<FixedArray>::cast(object_elements)));
     object<JSObject>()->set_elements(*object_elements);
   }
 }
 
+bool MapRef::is_deprecated() const {
+  AllowHandleDereference allow_handle_dereference;
+  return object<Map>()->is_deprecated();
+}
+
+bool MapRef::CanBeDeprecated() const {
+  AllowHandleDereference allow_handle_dereference;
+  return object<Map>()->CanBeDeprecated();
+}
+
 int MapRef::GetInObjectProperties() const {
   AllowHandleDereference allow_handle_dereference;
   return object<Map>()->GetInObjectProperties();
@@ -416,11 +464,16 @@ bool MapRef::is_dictionary_map() const {
   return object<Map>()->is_dictionary_map();
 }
 
-ObjectRef MapRef::constructor_or_backpointer(const JSHeapBroker* broker) const {
+ObjectRef MapRef::constructor_or_backpointer() const {
   AllowHandleAllocation handle_allocation;
   AllowHandleDereference allow_handle_dereference;
-  return ObjectRef(
-      handle(object<Map>()->constructor_or_backpointer(), broker->isolate()));
+  return ObjectRef(broker(), handle(object<Map>()->constructor_or_backpointer(),
+                                    broker()->isolate()));
+}
+
+ElementsKind MapRef::elements_kind() const {
+  AllowHandleDereference allow_handle_dereference;
+  return object<Map>()->elements_kind();
 }
 
 int MapRef::instance_size() const {
@@ -438,11 +491,12 @@ PropertyDetails MapRef::GetPropertyDetails(int i) const {
   return object<Map>()->instance_descriptors()->GetDetails(i);
 }
 
-NameRef MapRef::GetPropertyKey(const JSHeapBroker* broker, int i) const {
+NameRef MapRef::GetPropertyKey(int i) const {
   AllowHandleAllocation handle_allocation;
   AllowHandleDereference allow_handle_dereference;
-  return NameRef(handle(object<Map>()->instance_descriptors()->GetKey(i),
-                        broker->isolate()));
+  return NameRef(broker(),
+                 handle(object<Map>()->instance_descriptors()->GetKey(i),
+                        broker()->isolate()));
 }
 
 bool MapRef::IsJSArrayMap() const {
@@ -455,10 +509,10 @@ bool MapRef::IsInobjectSlackTrackingInProgress() const {
   return object<Map>()->IsInobjectSlackTrackingInProgress();
 }
 
-bool MapRef::IsFixedCowArrayMap(const JSHeapBroker* broker) const {
+bool MapRef::IsFixedCowArrayMap() const {
   AllowHandleDereference allow_handle_dereference;
   return *object<Map>() ==
-         ReadOnlyRoots(broker->isolate()).fixed_cow_array_map();
+         ReadOnlyRoots(broker()->isolate()).fixed_cow_array_map();
 }
 
 bool MapRef::has_prototype_slot() const {
@@ -476,15 +530,34 @@ bool MapRef::CanTransition() const {
   return object<Map>()->CanTransition();
 }
 
+MapRef MapRef::FindFieldOwner(int descriptor) const {
+  AllowHandleAllocation handle_allocation;
+  AllowHandleDereference allow_handle_dereference;
+  Handle<Map> owner(
+      object<Map>()->FindFieldOwner(broker()->isolate(), descriptor),
+      broker()->isolate());
+  return MapRef(broker(), owner);
+}
+
+FieldTypeRef MapRef::GetFieldType(int descriptor) const {
+  AllowHandleAllocation handle_allocation;
+  AllowHandleDereference allow_handle_dereference;
+  Handle<FieldType> field_type(
+      object<Map>()->instance_descriptors()->GetFieldType(descriptor),
+      broker()->isolate());
+  return FieldTypeRef(broker(), field_type);
+}
+
 ElementsKind JSArrayRef::GetElementsKind() const {
   AllowHandleDereference allow_handle_dereference;
   return object<JSArray>()->GetElementsKind();
 }
 
-ObjectRef JSArrayRef::length(const JSHeapBroker* broker) const {
+ObjectRef JSArrayRef::length() const {
   AllowHandleAllocation handle_allocation;
   AllowHandleDereference allow_handle_dereference;
-  return ObjectRef(handle(object<JSArray>()->length(), broker->isolate()));
+  return ObjectRef(broker(),
+                   handle(object<JSArray>()->length(), broker()->isolate()));
 }
 
 int StringRef::length() const {
@@ -497,36 +570,50 @@ uint16_t StringRef::GetFirstChar() {
   return object<String>()->Get(0);
 }
 
-ObjectRef JSRegExpRef::raw_properties_or_hash(
-    const JSHeapBroker* broker) const {
+double StringRef::ToNumber() {
+  AllowHandleDereference allow_handle_dereference;
+  AllowHandleAllocation allow_handle_allocation;
+  AllowHeapAllocation allow_heap_allocation;
+  int flags = ALLOW_HEX | ALLOW_OCTAL | ALLOW_BINARY;
+  return StringToDouble(broker()->isolate(),
+                        broker()->isolate()->unicode_cache(), object<String>(),
+                        flags);
+}
+
+ObjectRef JSRegExpRef::raw_properties_or_hash() const {
   AllowHandleAllocation handle_allocation;
   AllowHandleDereference allow_handle_dereference;
-  return ObjectRef(
-      handle(object<JSRegExp>()->raw_properties_or_hash(), broker->isolate()));
+  return ObjectRef(broker(),
+                   handle(object<JSRegExp>()->raw_properties_or_hash(),
+                          broker()->isolate()));
 }
 
-ObjectRef JSRegExpRef::data(const JSHeapBroker* broker) const {
+ObjectRef JSRegExpRef::data() const {
   AllowHandleAllocation handle_allocation;
   AllowHandleDereference allow_handle_dereference;
-  return ObjectRef(handle(object<JSRegExp>()->data(), broker->isolate()));
+  return ObjectRef(broker(),
+                   handle(object<JSRegExp>()->data(), broker()->isolate()));
 }
 
-ObjectRef JSRegExpRef::source(const JSHeapBroker* broker) const {
+ObjectRef JSRegExpRef::source() const {
   AllowHandleAllocation handle_allocation;
   AllowHandleDereference allow_handle_dereference;
-  return ObjectRef(handle(object<JSRegExp>()->source(), broker->isolate()));
+  return ObjectRef(broker(),
+                   handle(object<JSRegExp>()->source(), broker()->isolate()));
 }
 
-ObjectRef JSRegExpRef::flags(const JSHeapBroker* broker) const {
+ObjectRef JSRegExpRef::flags() const {
   AllowHandleAllocation handle_allocation;
   AllowHandleDereference allow_handle_dereference;
-  return ObjectRef(handle(object<JSRegExp>()->flags(), broker->isolate()));
+  return ObjectRef(broker(),
+                   handle(object<JSRegExp>()->flags(), broker()->isolate()));
 }
 
-ObjectRef JSRegExpRef::last_index(const JSHeapBroker* broker) const {
+ObjectRef JSRegExpRef::last_index() const {
   AllowHandleAllocation handle_allocation;
   AllowHandleDereference allow_handle_dereference;
-  return ObjectRef(handle(object<JSRegExp>()->last_index(), broker->isolate()));
+  return ObjectRef(
+      broker(), handle(object<JSRegExp>()->last_index(), broker()->isolate()));
 }
 
 int FixedArrayBaseRef::length() const {
@@ -534,15 +621,16 @@ int FixedArrayBaseRef::length() const {
   return object<FixedArrayBase>()->length();
 }
 
-bool FixedArrayRef::is_the_hole(const JSHeapBroker* broker, int i) const {
+bool FixedArrayRef::is_the_hole(int i) const {
   AllowHandleDereference allow_handle_dereference;
-  return object<FixedArray>()->is_the_hole(broker->isolate(), i);
+  return object<FixedArray>()->is_the_hole(broker()->isolate(), i);
 }
 
-ObjectRef FixedArrayRef::get(const JSHeapBroker* broker, int i) const {
+ObjectRef FixedArrayRef::get(int i) const {
   AllowHandleAllocation handle_allocation;
   AllowHandleDereference allow_handle_dereference;
-  return ObjectRef(handle(object<FixedArray>()->get(i), broker->isolate()));
+  return ObjectRef(broker(),
+                   handle(object<FixedArray>()->get(i), broker()->isolate()));
 }
 
 bool FixedDoubleArrayRef::is_the_hole(int i) const {
@@ -610,105 +698,182 @@ bool SharedFunctionInfoRef::construct_as_builtin() const {
   return object<SharedFunctionInfo>()->construct_as_builtin();
 }
 
-MapRef NativeContextRef::fast_aliased_arguments_map(
-    const JSHeapBroker* broker) const {
+bool SharedFunctionInfoRef::HasBytecodeArray() const {
+  AllowHandleDereference allow_handle_dereference;
+  return object<SharedFunctionInfo>()->HasBytecodeArray();
+}
+
+int SharedFunctionInfoRef::GetBytecodeArrayRegisterCount() const {
+  AllowHandleDereference allow_handle_dereference;
+  return object<SharedFunctionInfo>()->GetBytecodeArray()->register_count();
+}
+
+MapRef NativeContextRef::fast_aliased_arguments_map() const {
   AllowHandleAllocation handle_allocation;
   AllowHandleDereference allow_handle_dereference;
-  return MapRef(handle(object<Context>()->fast_aliased_arguments_map(),
-                       broker->isolate()));
+  return MapRef(broker(),
+                handle(object<Context>()->fast_aliased_arguments_map(),
+                       broker()->isolate()));
 }
 
-MapRef NativeContextRef::sloppy_arguments_map(
-    const JSHeapBroker* broker) const {
+MapRef NativeContextRef::sloppy_arguments_map() const {
   AllowHandleAllocation handle_allocation;
   AllowHandleDereference allow_handle_dereference;
-  return MapRef(
-      handle(object<Context>()->sloppy_arguments_map(), broker->isolate()));
+  return MapRef(broker(), handle(object<Context>()->sloppy_arguments_map(),
+                                 broker()->isolate()));
 }
 
-MapRef NativeContextRef::strict_arguments_map(
-    const JSHeapBroker* broker) const {
+MapRef NativeContextRef::strict_arguments_map() const {
   AllowHandleAllocation handle_allocation;
   AllowHandleDereference allow_handle_dereference;
-  return MapRef(
-      handle(object<Context>()->strict_arguments_map(), broker->isolate()));
+  return MapRef(broker(), handle(object<Context>()->strict_arguments_map(),
+                                 broker()->isolate()));
 }
 
-MapRef NativeContextRef::js_array_fast_elements_map_index(
-    const JSHeapBroker* broker) const {
+MapRef NativeContextRef::js_array_fast_elements_map_index() const {
   AllowHandleAllocation handle_allocation;
   AllowHandleDereference allow_handle_dereference;
-  return MapRef(handle(object<Context>()->js_array_fast_elements_map_index(),
-                       broker->isolate()));
+  return MapRef(broker(),
+                handle(object<Context>()->js_array_fast_elements_map_index(),
+                       broker()->isolate()));
 }
 
-MapRef NativeContextRef::initial_array_iterator_map(
-    const JSHeapBroker* broker) const {
+MapRef NativeContextRef::initial_array_iterator_map() const {
   AllowHandleAllocation handle_allocation;
   AllowHandleDereference allow_handle_dereference;
-  return MapRef(handle(object<Context>()->initial_array_iterator_map(),
-                       broker->isolate()));
+  return MapRef(broker(),
+                handle(object<Context>()->initial_array_iterator_map(),
+                       broker()->isolate()));
 }
 
-MapRef NativeContextRef::set_value_iterator_map(
-    const JSHeapBroker* broker) const {
+MapRef NativeContextRef::set_value_iterator_map() const {
   AllowHandleAllocation handle_allocation;
   AllowHandleDereference allow_handle_dereference;
-  return MapRef(
-      handle(object<Context>()->set_value_iterator_map(), broker->isolate()));
+  return MapRef(broker(), handle(object<Context>()->set_value_iterator_map(),
+                                 broker()->isolate()));
 }
 
-MapRef NativeContextRef::set_key_value_iterator_map(
-    const JSHeapBroker* broker) const {
+MapRef NativeContextRef::set_key_value_iterator_map() const {
   AllowHandleAllocation handle_allocation;
   AllowHandleDereference allow_handle_dereference;
-  return MapRef(handle(object<Context>()->set_key_value_iterator_map(),
-                       broker->isolate()));
+  return MapRef(broker(),
+                handle(object<Context>()->set_key_value_iterator_map(),
+                       broker()->isolate()));
 }
 
-MapRef NativeContextRef::map_key_iterator_map(
-    const JSHeapBroker* broker) const {
+MapRef NativeContextRef::map_key_iterator_map() const {
   AllowHandleAllocation handle_allocation;
   AllowHandleDereference allow_handle_dereference;
-  return MapRef(
-      handle(object<Context>()->map_key_iterator_map(), broker->isolate()));
+  return MapRef(broker(), handle(object<Context>()->map_key_iterator_map(),
+                                 broker()->isolate()));
 }
 
-MapRef NativeContextRef::map_value_iterator_map(
-    const JSHeapBroker* broker) const {
+MapRef NativeContextRef::map_value_iterator_map() const {
   AllowHandleAllocation handle_allocation;
   AllowHandleDereference allow_handle_dereference;
-  return MapRef(
-      handle(object<Context>()->map_value_iterator_map(), broker->isolate()));
+  return MapRef(broker(), handle(object<Context>()->map_value_iterator_map(),
+                                 broker()->isolate()));
 }
 
-MapRef NativeContextRef::map_key_value_iterator_map(
-    const JSHeapBroker* broker) const {
+MapRef NativeContextRef::map_key_value_iterator_map() const {
   AllowHandleAllocation handle_allocation;
   AllowHandleDereference allow_handle_dereference;
-  return MapRef(handle(object<Context>()->map_key_value_iterator_map(),
-                       broker->isolate()));
+  return MapRef(broker(),
+                handle(object<Context>()->map_key_value_iterator_map(),
+                       broker()->isolate()));
 }
 
-MapRef NativeContextRef::GetFunctionMapFromIndex(const JSHeapBroker* broker,
-                                                 int index) const {
+MapRef NativeContextRef::iterator_result_map() const {
+  AllowHandleAllocation handle_allocation;
+  AllowHandleDereference allow_handle_dereference;
+  return MapRef(broker(), handle(object<Context>()->iterator_result_map(),
+                                 broker()->isolate()));
+}
+
+MapRef NativeContextRef::string_iterator_map() const {
+  AllowHandleAllocation handle_allocation;
+  AllowHandleDereference allow_handle_dereference;
+  return MapRef(broker(), handle(object<Context>()->string_iterator_map(),
+                                 broker()->isolate()));
+}
+
+MapRef NativeContextRef::promise_function_initial_map() const {
+  AllowHandleAllocation handle_allocation;
+  AllowHandleDereference allow_handle_dereference;
+  return MapRef(broker(),
+                handle(object<Context>()->promise_function()->initial_map(),
+                       broker()->isolate()));
+}
+
+JSFunctionRef NativeContextRef::array_function() const {
+  AllowHandleAllocation handle_allocation;
   AllowHandleDereference allow_handle_dereference;
+  return JSFunctionRef(broker(), handle(object<Context>()->array_function(),
+                                        broker()->isolate()));
+}
+
+MapRef NativeContextRef::GetFunctionMapFromIndex(int index) const {
   DCHECK_LE(index, Context::LAST_FUNCTION_MAP_INDEX);
   DCHECK_GE(index, Context::FIRST_FUNCTION_MAP_INDEX);
-  return get(broker, index).AsMap();
+  return get(index).AsMap();
+}
+
+MapRef NativeContextRef::ObjectLiteralMapFromCache() const {
+  AllowHeapAllocation heap_allocation;
+  AllowHandleAllocation handle_allocation;
+  AllowHandleDereference allow_handle_dereference;
+  Factory* factory = broker()->isolate()->factory();
+  Handle<Map> map = factory->ObjectLiteralMapFromCache(object<Context>(), 0);
+  return MapRef(broker(), map);
 }
 
-bool ObjectRef::BooleanValue(const JSHeapBroker* broker) {
+bool ObjectRef::BooleanValue() {
   AllowHandleDereference allow_handle_dereference;
-  return object<Object>()->BooleanValue(broker->isolate());
+  return object<Object>()->BooleanValue(broker()->isolate());
+}
+
+double ObjectRef::OddballToNumber() const {
+  OddballType type = oddball_type();
+
+  switch (type) {
+    case OddballType::kBoolean: {
+      ObjectRef true_ref(broker(),
+                         broker()->isolate()->factory()->true_value());
+      return this->equals(true_ref) ? 1 : 0;
+      break;
+    }
+    case OddballType::kUndefined: {
+      return std::numeric_limits<double>::quiet_NaN();
+      break;
+    }
+    case OddballType::kNull: {
+      return 0;
+      break;
+    }
+    default: {
+      UNREACHABLE();
+      break;
+    }
+  }
 }
 
-CellRef ModuleRef::GetCell(const JSHeapBroker* broker, int cell_index) {
+CellRef ModuleRef::GetCell(int cell_index) {
   AllowHandleAllocation handle_allocation;
   AllowHandleDereference allow_handle_dereference;
+  return CellRef(broker(), handle(object<Module>()->GetCell(cell_index),
+                                  broker()->isolate()));
+}
+
+ObjectRef PropertyCellRef::value() const {
+  AllowHandleAllocation allow_handle_allocation;
+  AllowHandleDereference allow_handle_dereference;
+  return ObjectRef(
+      broker(), handle(object<PropertyCell>()->value(), broker()->isolate()));
+}
 
-  return CellRef(
-      handle(object<Module>()->GetCell(cell_index), broker->isolate()));
+PropertyDetails PropertyCellRef::property_details() const {
+  AllowHandleDereference allow_handle_dereference;
+  return object<PropertyCell>()->property_details();
 }
 
 }  // namespace compiler
diff --git a/deps/v8/src/compiler/js-heap-broker.h b/deps/v8/src/compiler/js-heap-broker.h
index 8caa822b38a35a..5c0c20d78f0246 100644
--- a/deps/v8/src/compiler/js-heap-broker.h
+++ b/deps/v8/src/compiler/js-heap-broker.h
@@ -81,6 +81,7 @@ class HeapObjectType {
   V(MutableHeapNumber)             \
   V(Name)                          \
   V(NativeContext)                 \
+  V(PropertyCell)                  \
   V(ScopeInfo)                     \
   V(ScriptContextTable)            \
   V(SharedFunctionInfo)            \
@@ -94,7 +95,8 @@ HEAP_BROKER_OBJECT_LIST(FORWARD_DECL)
 
 class ObjectRef {
  public:
-  explicit ObjectRef(Handle<Object> object) : object_(object) {}
+  explicit ObjectRef(const JSHeapBroker* broker, Handle<Object> object)
+      : broker_(broker), object_(object) {}
 
   template <typename T>
   Handle<T> object() const {
@@ -102,7 +104,7 @@ class ObjectRef {
     return Handle<T>::cast(object_);
   }
 
-  OddballType oddball_type(const JSHeapBroker* broker) const;
+  OddballType oddball_type() const;
 
   bool IsSmi() const;
   int AsSmi() const;
@@ -117,36 +119,61 @@ class ObjectRef {
   HEAP_BROKER_OBJECT_LIST(HEAP_AS_METHOD_DECL)
 #undef HEAP_AS_METHOD_DECL
 
-  StringRef TypeOf(const JSHeapBroker* broker) const;
-  bool BooleanValue(const JSHeapBroker* broker);
+  StringRef TypeOf() const;
+  bool BooleanValue();
+  double OddballToNumber() const;
+
+ protected:
+  const JSHeapBroker* broker() const { return broker_; }
 
  private:
+  const JSHeapBroker* broker_;
   Handle<Object> object_;
 };
 
+class FieldTypeRef : public ObjectRef {
+ public:
+  using ObjectRef::ObjectRef;
+};
+
 class HeapObjectRef : public ObjectRef {
  public:
   using ObjectRef::ObjectRef;
 
-  HeapObjectType type(const JSHeapBroker* broker) const;
-  MapRef map(const JSHeapBroker* broker) const;
-  base::Optional<MapRef> TryGetObjectCreateMap(
-      const JSHeapBroker* broker) const;
+  HeapObjectType type() const;
+  MapRef map() const;
+  base::Optional<MapRef> TryGetObjectCreateMap() const;
   bool IsSeqString() const;
   bool IsExternalString() const;
 };
 
+class PropertyCellRef : public HeapObjectRef {
+ public:
+  using HeapObjectRef::HeapObjectRef;
+
+  ObjectRef value() const;
+  PropertyDetails property_details() const;
+};
+
 class JSObjectRef : public HeapObjectRef {
  public:
   using HeapObjectRef::HeapObjectRef;
 
   bool IsUnboxedDoubleField(FieldIndex index) const;
   double RawFastDoublePropertyAt(FieldIndex index) const;
-  ObjectRef RawFastPropertyAt(const JSHeapBroker* broker,
-                              FieldIndex index) const;
+  ObjectRef RawFastPropertyAt(FieldIndex index) const;
+
+  FixedArrayBaseRef elements() const;
+  void EnsureElementsTenured();
+  ElementsKind GetElementsKind();
+};
 
-  FixedArrayBaseRef elements(const JSHeapBroker* broker) const;
-  void EnsureElementsTenured(const JSHeapBroker* broker);
+struct SlackTrackingResult {
+  SlackTrackingResult(int instance_sizex, int inobject_property_countx)
+      : instance_size(instance_sizex),
+        inobject_property_count(inobject_property_countx) {}
+  int instance_size;
+  int inobject_property_count;
 };
 
 class JSFunctionRef : public JSObjectRef {
@@ -157,24 +184,23 @@ class JSFunctionRef : public JSObjectRef {
   BuiltinFunctionId GetBuiltinFunctionId() const;
   bool IsConstructor() const;
   bool has_initial_map() const;
-  MapRef initial_map(const JSHeapBroker* broker) const;
+  MapRef initial_map() const;
 
-  MapRef DependOnInitialMap(const JSHeapBroker* broker,
-                            CompilationDependencies* dependencies) const;
-  int GetInstanceSizeWithFinishedSlackTracking() const;
-  SharedFunctionInfoRef shared(const JSHeapBroker* broker) const;
-  JSGlobalProxyRef global_proxy(const JSHeapBroker* broker) const;
+  JSGlobalProxyRef global_proxy() const;
+  SlackTrackingResult FinishSlackTracking() const;
+  SharedFunctionInfoRef shared() const;
+  void EnsureHasInitialMap() const;
 };
 
 class JSRegExpRef : public JSObjectRef {
  public:
   using JSObjectRef::JSObjectRef;
 
-  ObjectRef raw_properties_or_hash(const JSHeapBroker* broker) const;
-  ObjectRef data(const JSHeapBroker* broker) const;
-  ObjectRef source(const JSHeapBroker* broker) const;
-  ObjectRef flags(const JSHeapBroker* broker) const;
-  ObjectRef last_index(const JSHeapBroker* broker) const;
+  ObjectRef raw_properties_or_hash() const;
+  ObjectRef data() const;
+  ObjectRef source() const;
+  ObjectRef flags() const;
+  ObjectRef last_index() const;
 };
 
 class HeapNumberRef : public HeapObjectRef {
@@ -195,28 +221,33 @@ class ContextRef : public HeapObjectRef {
  public:
   using HeapObjectRef::HeapObjectRef;
 
-  base::Optional<ContextRef> previous(const JSHeapBroker* broker) const;
-  ObjectRef get(const JSHeapBroker* broker, int index) const;
+  base::Optional<ContextRef> previous() const;
+  ObjectRef get(int index) const;
 };
 
 class NativeContextRef : public ContextRef {
  public:
   using ContextRef::ContextRef;
 
-  ScriptContextTableRef script_context_table(const JSHeapBroker* broker) const;
-
-  MapRef fast_aliased_arguments_map(const JSHeapBroker* broker) const;
-  MapRef sloppy_arguments_map(const JSHeapBroker* broker) const;
-  MapRef strict_arguments_map(const JSHeapBroker* broker) const;
-  MapRef js_array_fast_elements_map_index(const JSHeapBroker* broker) const;
-  MapRef initial_array_iterator_map(const JSHeapBroker* broker) const;
-  MapRef set_value_iterator_map(const JSHeapBroker* broker) const;
-  MapRef set_key_value_iterator_map(const JSHeapBroker* broker) const;
-  MapRef map_key_iterator_map(const JSHeapBroker* broker) const;
-  MapRef map_value_iterator_map(const JSHeapBroker* broker) const;
-  MapRef map_key_value_iterator_map(const JSHeapBroker* broker) const;
-
-  MapRef GetFunctionMapFromIndex(const JSHeapBroker* broker, int index) const;
+  ScriptContextTableRef script_context_table() const;
+
+  MapRef fast_aliased_arguments_map() const;
+  MapRef sloppy_arguments_map() const;
+  MapRef strict_arguments_map() const;
+  MapRef js_array_fast_elements_map_index() const;
+  MapRef initial_array_iterator_map() const;
+  MapRef set_value_iterator_map() const;
+  MapRef set_key_value_iterator_map() const;
+  MapRef map_key_iterator_map() const;
+  MapRef map_value_iterator_map() const;
+  MapRef map_key_value_iterator_map() const;
+  MapRef iterator_result_map() const;
+  MapRef string_iterator_map() const;
+  MapRef promise_function_initial_map() const;
+  JSFunctionRef array_function() const;
+
+  MapRef GetFunctionMapFromIndex(int index) const;
+  MapRef ObjectLiteralMapFromCache() const;
 };
 
 class NameRef : public HeapObjectRef {
@@ -241,16 +272,20 @@ class FeedbackVectorRef : public HeapObjectRef {
  public:
   using HeapObjectRef::HeapObjectRef;
 
-  ObjectRef get(const JSHeapBroker* broker, FeedbackSlot slot) const;
+  ObjectRef get(FeedbackSlot slot) const;
 };
 
 class AllocationSiteRef : public HeapObjectRef {
  public:
   using HeapObjectRef::HeapObjectRef;
 
-  JSObjectRef boilerplate(const JSHeapBroker* broker) const;
+  JSObjectRef boilerplate() const;
   PretenureFlag GetPretenureMode() const;
-  bool IsFastLiteral(const JSHeapBroker* broker) const;
+  bool IsFastLiteral() const;
+  ObjectRef nested_site() const;
+  bool PointsToLiteral() const;
+  ElementsKind GetElementsKind() const;
+  bool CanInlineCall() const;
 };
 
 class MapRef : public HeapObjectRef {
@@ -262,22 +297,27 @@ class MapRef : public HeapObjectRef {
   int GetInObjectProperties() const;
   int NumberOfOwnDescriptors() const;
   PropertyDetails GetPropertyDetails(int i) const;
-  NameRef GetPropertyKey(const JSHeapBroker* broker, int i) const;
+  NameRef GetPropertyKey(int i) const;
   FieldIndex GetFieldIndexFor(int i) const;
   int GetInObjectPropertyOffset(int index) const;
-  ObjectRef constructor_or_backpointer(const JSHeapBroker* broker) const;
+  ObjectRef constructor_or_backpointer() const;
+  ElementsKind elements_kind() const;
+
+  MapRef AsElementsKind(ElementsKind kind, const JSHeapBroker* broker) const;
 
   bool is_stable() const;
   bool has_prototype_slot() const;
+  bool is_deprecated() const;
+  bool CanBeDeprecated() const;
   bool CanTransition() const;
   bool IsInobjectSlackTrackingInProgress() const;
-
+  MapRef FindFieldOwner(int descriptor) const;
   bool is_dictionary_map() const;
   bool IsJSArrayMap() const;
-  bool IsFixedCowArrayMap(const JSHeapBroker* broker) const;
+  bool IsFixedCowArrayMap() const;
 
-  void DependOnStableMap(const JSHeapBroker* broker,
-                         CompilationDependencies* dependencies) const;
+  // Concerning the underlying instance_descriptors:
+  FieldTypeRef GetFieldType(int descriptor) const;
 };
 
 class FixedArrayBaseRef : public HeapObjectRef {
@@ -291,8 +331,8 @@ class FixedArrayRef : public FixedArrayBaseRef {
  public:
   using FixedArrayBaseRef::FixedArrayBaseRef;
 
-  ObjectRef get(const JSHeapBroker* broker, int i) const;
-  bool is_the_hole(const JSHeapBroker* broker, int i) const;
+  ObjectRef get(int i) const;
+  bool is_the_hole(int i) const;
 };
 
 class FixedDoubleArrayRef : public FixedArrayBaseRef {
@@ -308,7 +348,7 @@ class JSArrayRef : public JSObjectRef {
   using JSObjectRef::JSObjectRef;
 
   ElementsKind GetElementsKind() const;
-  ObjectRef length(const JSHeapBroker* broker) const;
+  ObjectRef length() const;
 };
 
 class ScopeInfoRef : public HeapObjectRef {
@@ -332,6 +372,8 @@ class SharedFunctionInfoRef : public HeapObjectRef {
   bool HasBuiltinId() const;
   int builtin_id() const;
   bool construct_as_builtin() const;
+  bool HasBytecodeArray() const;
+  int GetBytecodeArrayRegisterCount() const;
 };
 
 class StringRef : public NameRef {
@@ -340,28 +382,29 @@ class StringRef : public NameRef {
 
   int length() const;
   uint16_t GetFirstChar();
+  double ToNumber();
 };
 
 class ModuleRef : public HeapObjectRef {
  public:
-  explicit ModuleRef(Handle<Object> object) : HeapObjectRef(object) {}
+  using HeapObjectRef::HeapObjectRef;
 
-  CellRef GetCell(const JSHeapBroker* broker, int cell_index);
+  CellRef GetCell(int cell_index);
 };
 
 class CellRef : public HeapObjectRef {
  public:
-  explicit CellRef(Handle<Object> object) : HeapObjectRef(object) {}
+  using HeapObjectRef::HeapObjectRef;
 };
 
 class JSGlobalProxyRef : public JSObjectRef {
  public:
-  explicit JSGlobalProxyRef(Handle<Object> object) : JSObjectRef(object) {}
+  using JSObjectRef::JSObjectRef;
 };
 
 class CodeRef : public HeapObjectRef {
  public:
-  explicit CodeRef(Handle<Object> object) : HeapObjectRef(object) {}
+  using HeapObjectRef::HeapObjectRef;
 };
 
 class InternalizedStringRef : public StringRef {
diff --git a/deps/v8/src/compiler/js-native-context-specialization.cc b/deps/v8/src/compiler/js-native-context-specialization.cc
index 7584b7913a63fc..4c6ea30bae7b79 100644
--- a/deps/v8/src/compiler/js-native-context-specialization.cc
+++ b/deps/v8/src/compiler/js-native-context-specialization.cc
@@ -68,7 +68,7 @@ JSNativeContextSpecialization::JSNativeContextSpecialization(
       global_object_(native_context->global_object(), jsgraph->isolate()),
       global_proxy_(JSGlobalProxy::cast(native_context->global_proxy()),
                     jsgraph->isolate()),
-      native_context_(native_context),
+      native_context_(js_heap_broker, native_context),
       dependencies_(dependencies),
       zone_(zone),
       type_cache_(TypeCache::Get()) {}
@@ -155,7 +155,7 @@ Reduction JSNativeContextSpecialization::ReduceJSGetSuperConstructor(
   // {function}s map is stable, i.e. we can use a code dependency
   // to guard against [[Prototype]] changes of {function}.
   if (function_map->is_stable() && function_prototype->IsConstructor()) {
-    dependencies()->DependOnStableMap(function_map);
+    dependencies()->DependOnStableMap(MapRef(js_heap_broker(), function_map));
     Node* value = jsgraph()->Constant(function_prototype);
     ReplaceWithValue(node, value);
     return Replace(value);
@@ -190,7 +190,7 @@ Reduction JSNativeContextSpecialization::ReduceJSInstanceOf(Node* node) {
 
   // Compute property access info for @@hasInstance on {receiver}.
   PropertyAccessInfo access_info;
-  AccessInfoFactory access_info_factory(dependencies(), js_heap_broker(),
+  AccessInfoFactory access_info_factory(js_heap_broker(), dependencies(),
                                         native_context().object<Context>(),
                                         graph()->zone());
   if (!access_info_factory.ComputePropertyAccessInfo(
@@ -199,7 +199,8 @@ Reduction JSNativeContextSpecialization::ReduceJSInstanceOf(Node* node) {
     return NoChange();
   }
 
-  PropertyAccessBuilder access_builder(jsgraph(), dependencies());
+  PropertyAccessBuilder access_builder(jsgraph(), js_heap_broker(),
+                                       dependencies());
 
   if (access_info.IsNotFound()) {
     // If there's no @@hasInstance handler, the OrdinaryHasInstance operation
@@ -209,8 +210,8 @@ Reduction JSNativeContextSpecialization::ReduceJSInstanceOf(Node* node) {
       Handle<JSObject> holder;
       if (access_info.holder().ToHandle(&holder)) {
         dependencies()->DependOnStablePrototypeChains(
-            native_context().object<Context>(), access_info.receiver_maps(),
-            holder);
+            js_heap_broker(), native_context().object<Context>(),
+            access_info.receiver_maps(), holder);
       }
 
       // Check that {constructor} is actually {receiver}.
@@ -235,8 +236,8 @@ Reduction JSNativeContextSpecialization::ReduceJSInstanceOf(Node* node) {
     Handle<JSObject> holder;
     if (access_info.holder().ToHandle(&holder)) {
       dependencies()->DependOnStablePrototypeChains(
-          native_context().object<Context>(), access_info.receiver_maps(),
-          holder);
+          js_heap_broker(), native_context().object<Context>(),
+          access_info.receiver_maps(), holder);
     } else {
       holder = receiver;
     }
@@ -326,7 +327,7 @@ JSNativeContextSpecialization::InferHasInPrototypeChain(
         return kMayBeInPrototypeChain;
       }
     }
-    for (PrototypeIterator j(receiver_map);; j.Advance()) {
+    for (PrototypeIterator j(isolate(), receiver_map);; j.Advance()) {
       if (j.IsAtEnd()) {
         all = false;
         break;
@@ -411,9 +412,10 @@ Reduction JSNativeContextSpecialization::ReduceJSOrdinaryHasInstance(
       // depend on that for the prototype constant-folding below.
       JSFunction::EnsureHasInitialMap(function);
 
-      Handle<Map> initial_map = dependencies()->DependOnInitialMap(function);
-      Node* prototype =
-          jsgraph()->Constant(handle(initial_map->prototype(), isolate()));
+      MapRef initial_map = dependencies()->DependOnInitialMap(
+          JSFunctionRef(js_heap_broker(), function));
+      Node* prototype = jsgraph()->Constant(
+          handle(initial_map.object<Map>()->prototype(), isolate()));
 
       // Lower the {node} to JSHasInPrototypeChain.
       NodeProperties::ReplaceValueInput(node, object, 0);
@@ -483,7 +485,7 @@ Reduction JSNativeContextSpecialization::ReduceJSResolvePromise(Node* node) {
 
   // Compute property access info for "then" on {resolution}.
   PropertyAccessInfo access_info;
-  AccessInfoFactory access_info_factory(dependencies(), js_heap_broker(),
+  AccessInfoFactory access_info_factory(js_heap_broker(), dependencies(),
                                         native_context().object<Context>(),
                                         graph()->zone());
   if (!access_info_factory.ComputePropertyAccessInfo(
@@ -495,14 +497,15 @@ Reduction JSNativeContextSpecialization::ReduceJSResolvePromise(Node* node) {
   // We can further optimize the case where {resolution}
   // definitely doesn't have a "then" property.
   if (!access_info.IsNotFound()) return NoChange();
-  PropertyAccessBuilder access_builder(jsgraph(), dependencies());
+  PropertyAccessBuilder access_builder(jsgraph(), js_heap_broker(),
+                                       dependencies());
 
   // Add proper dependencies on the {resolution}s [[Prototype]]s.
   Handle<JSObject> holder;
   if (access_info.holder().ToHandle(&holder)) {
     dependencies()->DependOnStablePrototypeChains(
-        native_context().object<Context>(), access_info.receiver_maps(),
-        holder);
+        js_heap_broker(), native_context().object<Context>(),
+        access_info.receiver_maps(), holder);
   }
 
   // Simply fulfill the {promise} with the {resolution}.
@@ -520,7 +523,7 @@ Reduction JSNativeContextSpecialization::ReduceJSLoadContext(Node* node) {
   // context (if any), so we can constant-fold those fields, which is
   // safe, since the NATIVE_CONTEXT_INDEX slot is always immutable.
   if (access.index() == Context::NATIVE_CONTEXT_INDEX) {
-    Node* value = jsgraph()->Constant(js_heap_broker(), native_context());
+    Node* value = jsgraph()->Constant(native_context());
     ReplaceWithValue(node, value);
     return Replace(value);
   }
@@ -554,7 +557,7 @@ Reduction JSNativeContextSpecialization::ReduceGlobalAccess(
 
   // Lookup on the global object. We only deal with own data properties
   // of the global object here (represented as PropertyCell).
-  LookupIterator it(global_object(), name, LookupIterator::OWN);
+  LookupIterator it(isolate(), global_object(), name, LookupIterator::OWN);
   it.TryLookupCachedProperty();
   if (it.state() != LookupIterator::DATA) return NoChange();
   if (!it.GetHolder<JSObject>()->IsJSGlobalObject()) return NoChange();
@@ -608,7 +611,8 @@ Reduction JSNativeContextSpecialization::ReduceGlobalAccess(
       // can be deleted or reconfigured to an accessor property).
       if (property_details.cell_type() != PropertyCellType::kMutable ||
           property_details.IsConfigurable()) {
-        dependencies()->DependOnGlobalProperty(property_cell);
+        dependencies()->DependOnGlobalProperty(
+            PropertyCellRef(js_heap_broker(), property_cell));
       }
 
       // Load from constant/undefined global property can be constant-folded.
@@ -640,7 +644,8 @@ Reduction JSNativeContextSpecialization::ReduceGlobalAccess(
             // elimination if it's stable, i.e. the HeapObject wasn't
             // mutated without the cell state being updated.
             if (property_cell_value_map->is_stable()) {
-              dependencies()->DependOnStableMap(property_cell_value_map);
+              dependencies()->DependOnStableMap(
+                  MapRef(js_heap_broker(), property_cell_value_map));
               map = property_cell_value_map;
             }
           }
@@ -662,7 +667,8 @@ Reduction JSNativeContextSpecialization::ReduceGlobalAccess(
       case PropertyCellType::kConstant: {
         // Record a code dependency on the cell, and just deoptimize if the new
         // value doesn't match the previous value stored inside the cell.
-        dependencies()->DependOnGlobalProperty(property_cell);
+        dependencies()->DependOnGlobalProperty(
+            PropertyCellRef(js_heap_broker(), property_cell));
         Node* check =
             graph()->NewNode(simplified()->ReferenceEqual(), value,
                              jsgraph()->Constant(property_cell_value));
@@ -675,7 +681,8 @@ Reduction JSNativeContextSpecialization::ReduceGlobalAccess(
         // Record a code dependency on the cell, and just deoptimize if the new
         // values' type doesn't match the type of the previous value in the
         // cell.
-        dependencies()->DependOnGlobalProperty(property_cell);
+        dependencies()->DependOnGlobalProperty(
+            PropertyCellRef(js_heap_broker(), property_cell));
         Type property_cell_value_type;
         MachineRepresentation representation = MachineRepresentation::kTagged;
         if (property_cell_value->IsHeapObject()) {
@@ -684,7 +691,8 @@ Reduction JSNativeContextSpecialization::ReduceGlobalAccess(
           Handle<Map> property_cell_value_map(
               Handle<HeapObject>::cast(property_cell_value)->map(), isolate());
           DCHECK(property_cell_value_map->is_stable());
-          dependencies()->DependOnStableMap(property_cell_value_map);
+          dependencies()->DependOnStableMap(
+              MapRef(js_heap_broker(), property_cell_value_map));
 
           // Check that the {value} is a HeapObject.
           value = effect = graph()->NewNode(simplified()->CheckHeapObject(),
@@ -715,7 +723,8 @@ Reduction JSNativeContextSpecialization::ReduceGlobalAccess(
       case PropertyCellType::kMutable: {
         // Record a code dependency on the cell, and just deoptimize if the
         // property ever becomes read-only.
-        dependencies()->DependOnGlobalProperty(property_cell);
+        dependencies()->DependOnGlobalProperty(
+            PropertyCellRef(js_heap_broker(), property_cell));
         effect = graph()->NewNode(
             simplified()->StoreField(ForPropertyCellValue(
                 MachineRepresentation::kTagged, Type::NonInternal(),
@@ -732,19 +741,19 @@ Reduction JSNativeContextSpecialization::ReduceGlobalAccess(
 
 Reduction JSNativeContextSpecialization::ReduceJSLoadGlobal(Node* node) {
   DCHECK_EQ(IrOpcode::kJSLoadGlobal, node->opcode());
-  NameRef name(LoadGlobalParametersOf(node->op()).name());
+  NameRef name(js_heap_broker(), LoadGlobalParametersOf(node->op()).name());
   Node* effect = NodeProperties::GetEffectInput(node);
 
   // Try to lookup the name on the script context table first (lexical scoping).
   base::Optional<ScriptContextTableRef::LookupResult> result =
-      native_context().script_context_table(js_heap_broker()).lookup(name);
+      native_context().script_context_table().lookup(name);
   if (result) {
-    ObjectRef contents = result->context.get(js_heap_broker(), result->index);
-    OddballType oddball_type = contents.oddball_type(js_heap_broker());
+    ObjectRef contents = result->context.get(result->index);
+    OddballType oddball_type = contents.oddball_type();
     if (oddball_type == OddballType::kHole) {
       return NoChange();
     }
-    Node* context = jsgraph()->Constant(js_heap_broker(), result->context);
+    Node* context = jsgraph()->Constant(result->context);
     Node* value = effect = graph()->NewNode(
         javascript()->LoadContext(0, result->index, result->immutable), context,
         effect);
@@ -759,21 +768,21 @@ Reduction JSNativeContextSpecialization::ReduceJSLoadGlobal(Node* node) {
 
 Reduction JSNativeContextSpecialization::ReduceJSStoreGlobal(Node* node) {
   DCHECK_EQ(IrOpcode::kJSStoreGlobal, node->opcode());
-  NameRef name(StoreGlobalParametersOf(node->op()).name());
+  NameRef name(js_heap_broker(), StoreGlobalParametersOf(node->op()).name());
   Node* value = NodeProperties::GetValueInput(node, 0);
   Node* effect = NodeProperties::GetEffectInput(node);
   Node* control = NodeProperties::GetControlInput(node);
 
   // Try to lookup the name on the script context table first (lexical scoping).
   base::Optional<ScriptContextTableRef::LookupResult> result =
-      native_context().script_context_table(js_heap_broker()).lookup(name);
+      native_context().script_context_table().lookup(name);
   if (result) {
-    ObjectRef contents = result->context.get(js_heap_broker(), result->index);
-    OddballType oddball_type = contents.oddball_type(js_heap_broker());
+    ObjectRef contents = result->context.get(result->index);
+    OddballType oddball_type = contents.oddball_type();
     if (oddball_type == OddballType::kHole || result->immutable) {
       return NoChange();
     }
-    Node* context = jsgraph()->Constant(js_heap_broker(), result->context);
+    Node* context = jsgraph()->Constant(result->context);
     effect = graph()->NewNode(javascript()->StoreContext(0, result->index),
                               value, context, effect, control);
     ReplaceWithValue(node, value, effect, control);
@@ -817,7 +826,7 @@ Reduction JSNativeContextSpecialization::ReduceNamedAccess(
   }
 
   // Compute property access infos for the receiver maps.
-  AccessInfoFactory access_info_factory(dependencies(), js_heap_broker(),
+  AccessInfoFactory access_info_factory(js_heap_broker(), dependencies(),
                                         native_context().object<Context>(),
                                         graph()->zone());
   ZoneVector<PropertyAccessInfo> access_infos(zone());
@@ -845,7 +854,8 @@ Reduction JSNativeContextSpecialization::ReduceNamedAccess(
     if_exceptions = &if_exception_nodes;
   }
 
-  PropertyAccessBuilder access_builder(jsgraph(), dependencies());
+  PropertyAccessBuilder access_builder(jsgraph(), js_heap_broker(),
+                                       dependencies());
 
   // Check for the monomorphic cases.
   if (access_infos.size() == 1) {
@@ -1096,7 +1106,8 @@ Reduction JSNativeContextSpecialization::ReduceJSLoadNamed(Node* node) {
         // {function} in order to be notified about changes to the
         // "prototype" of {function}.
         JSFunction::EnsureHasInitialMap(function);
-        dependencies()->DependOnInitialMap(function);
+        dependencies()->DependOnInitialMap(
+            JSFunctionRef(js_heap_broker(), function));
         Handle<Object> prototype(function->prototype(), isolate());
         Node* value = jsgraph()->Constant(prototype);
         ReplaceWithValue(node, value);
@@ -1181,7 +1192,7 @@ Reduction JSNativeContextSpecialization::ReduceElementAccess(
   } else {
     // Retrieve the native context from the given {node}.
     // Compute element access infos for the receiver maps.
-    AccessInfoFactory access_info_factory(dependencies(), js_heap_broker(),
+    AccessInfoFactory access_info_factory(js_heap_broker(), dependencies(),
                                           native_context().object<Context>(),
                                           graph()->zone());
     ZoneVector<ElementAccessInfo> access_infos(zone());
@@ -1230,12 +1241,14 @@ Reduction JSNativeContextSpecialization::ReduceElementAccess(
 
       // Install dependencies on the relevant prototype maps.
       for (Handle<Map> prototype_map : prototype_maps) {
-        dependencies()->DependOnStableMap(prototype_map);
+        dependencies()->DependOnStableMap(
+            MapRef(js_heap_broker(), prototype_map));
       }
     }
 
     // Ensure that {receiver} is a heap object.
-    PropertyAccessBuilder access_builder(jsgraph(), dependencies());
+    PropertyAccessBuilder access_builder(jsgraph(), js_heap_broker(),
+                                         dependencies());
     receiver = access_builder.BuildCheckHeapObject(receiver, &effect, control);
 
     // Check for the monomorphic case.
@@ -1774,7 +1787,7 @@ Node* JSNativeContextSpecialization::InlineApiCall(
   Node* code = jsgraph()->HeapConstant(call_api_callback.code());
 
   // Add CallApiCallbackStub's register argument as well.
-  Node* context = jsgraph()->Constant(js_heap_broker(), native_context());
+  Node* context = jsgraph()->Constant(native_context());
   Node* inputs[10] = {code,    context, data, holder, function_reference,
                       receiver};
   int index = 6 + argc;
@@ -1798,11 +1811,12 @@ JSNativeContextSpecialization::BuildPropertyLoad(
     PropertyAccessInfo const& access_info) {
   // Determine actual holder and perform prototype chain checks.
   Handle<JSObject> holder;
-  PropertyAccessBuilder access_builder(jsgraph(), dependencies());
+  PropertyAccessBuilder access_builder(jsgraph(), js_heap_broker(),
+                                       dependencies());
   if (access_info.holder().ToHandle(&holder)) {
     dependencies()->DependOnStablePrototypeChains(
-        native_context().object<Context>(), access_info.receiver_maps(),
-        holder);
+        js_heap_broker(), native_context().object<Context>(),
+        access_info.receiver_maps(), holder);
   }
 
   // Generate the actual property access.
@@ -1855,12 +1869,13 @@ JSNativeContextSpecialization::BuildPropertyStore(
     PropertyAccessInfo const& access_info, AccessMode access_mode) {
   // Determine actual holder and perform prototype chain checks.
   Handle<JSObject> holder;
-  PropertyAccessBuilder access_builder(jsgraph(), dependencies());
+  PropertyAccessBuilder access_builder(jsgraph(), js_heap_broker(),
+                                       dependencies());
   if (access_info.holder().ToHandle(&holder)) {
     DCHECK_NE(AccessMode::kStoreInLiteral, access_mode);
     dependencies()->DependOnStablePrototypeChains(
-        native_context().object<Context>(), access_info.receiver_maps(),
-        holder);
+        js_heap_broker(), native_context().object<Context>(),
+        access_info.receiver_maps(), holder);
   }
 
   DCHECK(!access_info.IsNotFound());
@@ -1913,7 +1928,7 @@ JSNativeContextSpecialization::BuildPropertyStore(
             !FLAG_unbox_double_fields) {
           if (access_info.HasTransitionMap()) {
             // Allocate a MutableHeapNumber for the new property.
-            AllocationBuilder a(jsgraph(), js_heap_broker(), effect, control);
+            AllocationBuilder a(jsgraph(), effect, control);
             a.Allocate(HeapNumber::kSize, NOT_TENURED, Type::OtherInternal());
             a.Store(AccessBuilder::ForMap(),
                     factory()->mutable_heap_number_map());
@@ -2083,7 +2098,7 @@ Reduction JSNativeContextSpecialization::ReduceJSStoreDataPropertyInLiteral(
       Name::cast(nexus.GetFeedbackExtra()->ToStrongHeapObject()), isolate());
 
   PropertyAccessInfo access_info;
-  AccessInfoFactory access_info_factory(dependencies(), js_heap_broker(),
+  AccessInfoFactory access_info_factory(js_heap_broker(), dependencies(),
                                         native_context().object<Context>(),
                                         graph()->zone());
   if (!access_info_factory.ComputePropertyAccessInfo(
@@ -2097,7 +2112,8 @@ Reduction JSNativeContextSpecialization::ReduceJSStoreDataPropertyInLiteral(
   Node* control = NodeProperties::GetControlInput(node);
 
   // Monomorphic property access.
-  PropertyAccessBuilder access_builder(jsgraph(), dependencies());
+  PropertyAccessBuilder access_builder(jsgraph(), js_heap_broker(),
+                                       dependencies());
   receiver = access_builder.BuildCheckHeapObject(receiver, &effect, control);
   access_builder.BuildCheckMaps(receiver, &effect, control,
                                 access_info.receiver_maps());
@@ -2258,8 +2274,8 @@ JSNativeContextSpecialization::BuildElementAccess(
     if (isolate()->IsArrayBufferNeuteringIntact()) {
       // Add a code dependency so we are deoptimized in case an ArrayBuffer
       // gets neutered.
-      dependencies()->DependOnProtector(
-          factory()->array_buffer_neutering_protector());
+      dependencies()->DependOnProtector(PropertyCellRef(
+          js_heap_broker(), factory()->array_buffer_neutering_protector()));
     } else {
       // Default to zero if the {receiver}s buffer was neutered.
       Node* check = effect = graph()->NewNode(
@@ -2661,7 +2677,8 @@ Node* JSNativeContextSpecialization::BuildIndexedStringLoad(
     KeyedAccessLoadMode load_mode) {
   if (load_mode == LOAD_IGNORE_OUT_OF_BOUNDS &&
       isolate()->IsNoElementsProtectorIntact()) {
-    dependencies()->DependOnProtector(factory()->no_elements_protector());
+    dependencies()->DependOnProtector(
+        PropertyCellRef(js_heap_broker(), factory()->no_elements_protector()));
 
     // Ensure that the {index} is a valid String length.
     index = *effect = graph()->NewNode(
@@ -2768,7 +2785,7 @@ Node* JSNativeContextSpecialization::BuildExtendPropertiesBackingStore(
                        new_length_and_hash, effect, control);
 
   // Allocate and initialize the new properties.
-  AllocationBuilder a(jsgraph(), js_heap_broker(), effect, control);
+  AllocationBuilder a(jsgraph(), effect, control);
   a.Allocate(PropertyArray::SizeFor(new_length), NOT_TENURED,
              Type::OtherInternal());
   a.Store(AccessBuilder::ForMap(), jsgraph()->PropertyArrayMapConstant());
@@ -2810,7 +2827,8 @@ bool JSNativeContextSpecialization::CanTreatHoleAsUndefined(
   // Check if the array prototype chain is intact.
   if (!isolate()->IsNoElementsProtectorIntact()) return false;
 
-  dependencies()->DependOnProtector(factory()->no_elements_protector());
+  dependencies()->DependOnProtector(
+      PropertyCellRef(js_heap_broker(), factory()->no_elements_protector()));
   return true;
 }
 
diff --git a/deps/v8/src/compiler/js-operator.cc b/deps/v8/src/compiler/js-operator.cc
index 5d45bb7f954e85..fabf5fd4505663 100644
--- a/deps/v8/src/compiler/js-operator.cc
+++ b/deps/v8/src/compiler/js-operator.cc
@@ -589,6 +589,7 @@ CompareOperationHint CompareOperationHintOf(const Operator* op) {
   V(ToLength, Operator::kNoProperties, 1, 1)                           \
   V(ToName, Operator::kNoProperties, 1, 1)                             \
   V(ToNumber, Operator::kNoProperties, 1, 1)                           \
+  V(ToNumberConvertBigInt, Operator::kNoProperties, 1, 1)              \
   V(ToNumeric, Operator::kNoProperties, 1, 1)                          \
   V(ToObject, Operator::kFoldable, 1, 1)                               \
   V(ToString, Operator::kNoProperties, 1, 1)                           \
diff --git a/deps/v8/src/compiler/js-operator.h b/deps/v8/src/compiler/js-operator.h
index f73aca819f59b8..1e529dc0e675cc 100644
--- a/deps/v8/src/compiler/js-operator.h
+++ b/deps/v8/src/compiler/js-operator.h
@@ -685,6 +685,7 @@ class V8_EXPORT_PRIVATE JSOperatorBuilder final
   const Operator* ToLength();
   const Operator* ToName();
   const Operator* ToNumber();
+  const Operator* ToNumberConvertBigInt();
   const Operator* ToNumeric();
   const Operator* ToObject();
   const Operator* ToString();
diff --git a/deps/v8/src/compiler/js-typed-lowering.cc b/deps/v8/src/compiler/js-typed-lowering.cc
index 0063d72f7a536d..710e3b376506df 100644
--- a/deps/v8/src/compiler/js-typed-lowering.cc
+++ b/deps/v8/src/compiler/js-typed-lowering.cc
@@ -93,12 +93,13 @@ class JSBinopReduction final {
     if (BothInputsAre(Type::String()) ||
         BinaryOperationHintOf(node_->op()) == BinaryOperationHint::kString) {
       HeapObjectBinopMatcher m(node_);
-      if (m.right().HasValue() && m.right().Ref().IsString()) {
-        StringRef right_string(m.right().Value());
+      const JSHeapBroker* broker = lowering_->js_heap_broker();
+      if (m.right().HasValue() && m.right().Ref(broker).IsString()) {
+        StringRef right_string = m.right().Ref(broker).AsString();
         if (right_string.length() >= ConsString::kMinLength) return true;
       }
-      if (m.left().HasValue() && m.left().Ref().IsString()) {
-        StringRef left_string(m.left().Value());
+      if (m.left().HasValue() && m.left().Ref(broker).IsString()) {
+        StringRef left_string = m.left().Ref(broker).AsString();
         if (left_string.length() >= ConsString::kMinLength) {
           // The invariant for ConsString requires the left hand side to be
           // a sequential or external string if the right hand side is the
@@ -528,32 +529,6 @@ Reduction JSTypedLowering::ReduceJSAdd(Node* node) {
         NodeProperties::ReplaceValueInput(node, reduction.replacement(), 0);
       }
     }
-    // We might be able to constant-fold the String concatenation now.
-    if (r.BothInputsAre(Type::String())) {
-      HeapObjectBinopMatcher m(node);
-      if (m.IsFoldable()) {
-        StringRef left(m.left().Value());
-        StringRef right(m.right().Value());
-        if (left.length() + right.length() > String::kMaxLength) {
-          // No point in trying to optimize this, as it will just throw.
-          return NoChange();
-        }
-        // TODO(mslekova): get rid of these allows by doing either one of:
-        // 1. remove the optimization and check if it ruins the performance
-        // 2. leave a placeholder and do the actual allocations once back on the
-        // MT
-        AllowHandleDereference allow_handle_dereference;
-        AllowHandleAllocation allow_handle_allocation;
-        AllowHeapAllocation allow_heap_allocation;
-        ObjectRef cons(
-            factory()
-                ->NewConsString(left.object<String>(), right.object<String>())
-                .ToHandleChecked());
-        Node* value = jsgraph()->Constant(js_heap_broker(), cons);
-        ReplaceWithValue(node, value);
-        return Replace(value);
-      }
-    }
     // We might know for sure that we're creating a ConsString here.
     if (r.ShouldCreateConsString()) {
       return ReduceCreateConsString(node);
@@ -744,11 +719,11 @@ Node* JSTypedLowering::BuildGetStringLength(Node* value) {
   // TODO(bmeurer): Get rid of this hack and instead have a way to
   // express the string length in the types.
   HeapObjectMatcher m(value);
-  if (!m.HasValue() || !m.Ref().IsString()) {
+  if (!m.HasValue() || !m.Ref(js_heap_broker()).IsString()) {
     return graph()->NewNode(simplified()->StringLength(), value);
   }
 
-  return jsgraph()->Constant(m.Ref().AsString().length());
+  return jsgraph()->Constant(m.Ref(js_heap_broker()).AsString().length());
 }
 
 Reduction JSTypedLowering::ReduceSpeculativeNumberComparison(Node* node) {
@@ -983,27 +958,17 @@ Reduction JSTypedLowering::ReduceJSToNumberOrNumericInput(Node* input) {
   // we only cover cases where ToNumber and ToNumeric coincide.
   Type input_type = NodeProperties::GetType(input);
 
-  // TODO(mslekova): get rid of these allows by doing either one of:
-  // 1. remove the optimization and check if it ruins the performance
-  // 2. leave a placeholder and do the actual allocations once back on the MT
   if (input_type.Is(Type::String())) {
     HeapObjectMatcher m(input);
-    if (m.HasValue() && m.Ref().IsString()) {
-      AllowHandleDereference allow_handle_dereference;
-      AllowHandleAllocation allow_handle_allocation;
-      AllowHeapAllocation allow_heap_allocation;
-      StringRef input_value = m.Ref().AsString();
-      return Replace(jsgraph()->Constant(
-          String::ToNumber(isolate(), input_value.object<String>())));
+    if (m.HasValue() && m.Ref(js_heap_broker()).IsString()) {
+      StringRef input_value = m.Ref(js_heap_broker()).AsString();
+      return Replace(jsgraph()->Constant(input_value.ToNumber()));
     }
   }
   if (input_type.IsHeapConstant()) {
     ObjectRef input_value = input_type.AsHeapConstant()->Ref();
-    if (input_value.oddball_type(js_heap_broker()) != OddballType::kNone) {
-      AllowHandleDereference allow_handle_dereference;
-      AllowHandleAllocation allow_handle_allocation;
-      return Replace(jsgraph()->Constant(
-          Oddball::ToNumber(isolate(), input_value.object<Oddball>())));
+    if (input_value.oddball_type() != OddballType::kNone) {
+      return Replace(jsgraph()->Constant(input_value.OddballToNumber()));
     }
   }
   if (input_type.Is(Type::Number())) {
@@ -1070,20 +1035,6 @@ Reduction JSTypedLowering::ReduceJSToStringInput(Node* input) {
   if (input_type.Is(Type::NaN())) {
     return Replace(jsgraph()->HeapConstant(factory()->NaN_string()));
   }
-  if (input_type.Is(Type::OrderedNumber()) &&
-      input_type.Min() == input_type.Max()) {
-    // TODO(mslekova): get rid of these allows by doing either one of:
-    // 1. remove the optimization and check if it ruins the performance
-    // 2. allocate all the ToString's from numbers before the compilation
-    // 3. leave a placeholder and do the actual allocations once back on the MT
-    AllowHandleDereference allow_handle_dereference;
-    AllowHandleAllocation allow_handle_allocation;
-    AllowHeapAllocation allow_heap_allocation;
-    // Note that we can use Type::OrderedNumber(), since
-    // both 0 and -0 map to the String "0" in JavaScript.
-    return Replace(jsgraph()->HeapConstant(
-        factory()->NumberToString(factory()->NewNumber(input_type.Min()))));
-  }
   if (input_type.Is(Type::Number())) {
     return Replace(graph()->NewNode(simplified()->NumberToString(), input));
   }
@@ -1169,8 +1120,8 @@ Reduction JSTypedLowering::ReduceJSLoadNamed(Node* node) {
   DCHECK_EQ(IrOpcode::kJSLoadNamed, node->opcode());
   Node* receiver = NodeProperties::GetValueInput(node, 0);
   Type receiver_type = NodeProperties::GetType(receiver);
-  NameRef name(NamedAccessOf(node->op()).name());
-  NameRef length_str(factory()->length_string());
+  NameRef name(js_heap_broker(), NamedAccessOf(node->op()).name());
+  NameRef length_str(js_heap_broker(), factory()->length_string());
   // Optimize "length" property of strings.
   if (name.equals(length_str) && receiver_type.Is(Type::String())) {
     Node* value = graph()->NewNode(simplified()->StringLength(), receiver);
@@ -1405,9 +1356,8 @@ Node* JSTypedLowering::BuildGetModuleCell(Node* node) {
 
   if (module_type.IsHeapConstant()) {
     ModuleRef module_constant = module_type.AsHeapConstant()->Ref().AsModule();
-    CellRef cell_constant(
-        module_constant.GetCell(js_heap_broker(), cell_index));
-    return jsgraph()->Constant(js_heap_broker(), cell_constant);
+    CellRef cell_constant(module_constant.GetCell(cell_index));
+    return jsgraph()->Constant(cell_constant);
   }
 
   FieldAccess field_access;
@@ -1594,7 +1544,7 @@ Reduction JSTypedLowering::ReduceJSConstruct(Node* node) {
   if (target_type.IsHeapConstant() &&
       target_type.AsHeapConstant()->Ref().IsJSFunction()) {
     JSFunctionRef function = target_type.AsHeapConstant()->Ref().AsJSFunction();
-    SharedFunctionInfoRef shared = function.shared(js_heap_broker());
+    SharedFunctionInfoRef shared = function.shared();
 
     // Only optimize [[Construct]] here if {function} is a Constructor.
     if (!function.IsConstructor()) return NoChange();
@@ -1604,13 +1554,13 @@ Reduction JSTypedLowering::ReduceJSConstruct(Node* node) {
     // Patch {node} to an indirect call via the {function}s construct stub.
     bool use_builtin_construct_stub = shared.construct_as_builtin();
 
-    CodeRef code(use_builtin_construct_stub
+    CodeRef code(js_heap_broker(),
+                 use_builtin_construct_stub
                      ? BUILTIN_CODE(isolate(), JSBuiltinsConstructStub)
                      : BUILTIN_CODE(isolate(), JSConstructStubGeneric));
 
     node->RemoveInput(arity + 1);
-    node->InsertInput(graph()->zone(), 0,
-                      jsgraph()->Constant(js_heap_broker(), code));
+    node->InsertInput(graph()->zone(), 0, jsgraph()->Constant(code));
     node->InsertInput(graph()->zone(), 2, new_target);
     node->InsertInput(graph()->zone(), 3, jsgraph()->Constant(arity));
     node->InsertInput(graph()->zone(), 4, jsgraph()->UndefinedConstant());
@@ -1677,7 +1627,7 @@ Reduction JSTypedLowering::ReduceJSCall(Node* node) {
   if (target_type.IsHeapConstant() &&
       target_type.AsHeapConstant()->Ref().IsJSFunction()) {
     JSFunctionRef function = target_type.AsHeapConstant()->Ref().AsJSFunction();
-    SharedFunctionInfoRef shared = function.shared(js_heap_broker());
+    SharedFunctionInfoRef shared = function.shared();
 
     if (shared.HasBreakInfo()) {
       // Do not inline the call if we need to check whether to break at entry.
@@ -1697,8 +1647,7 @@ Reduction JSTypedLowering::ReduceJSCall(Node* node) {
     // Check if we need to convert the {receiver}.
     if (is_sloppy(shared.language_mode()) && !shared.native() &&
         !receiver_type.Is(Type::Receiver())) {
-      Node* global_proxy = jsgraph()->Constant(
-          js_heap_broker(), function.global_proxy(js_heap_broker()));
+      Node* global_proxy = jsgraph()->Constant(function.global_proxy());
       receiver = effect =
           graph()->NewNode(simplified()->ConvertReceiver(convert_mode),
                            receiver, global_proxy, effect, control);
@@ -2329,6 +2278,7 @@ Reduction JSTypedLowering::Reduce(Node* node) {
     case IrOpcode::kJSToName:
       return ReduceJSToName(node);
     case IrOpcode::kJSToNumber:
+    case IrOpcode::kJSToNumberConvertBigInt:
     case IrOpcode::kJSToNumeric:
       return ReduceJSToNumberOrNumeric(node);
     case IrOpcode::kJSToString:
diff --git a/deps/v8/src/compiler/loop-variable-optimizer.cc b/deps/v8/src/compiler/loop-variable-optimizer.cc
index fe5b8c7889bdd8..5a0fc9dbfbe01e 100644
--- a/deps/v8/src/compiler/loop-variable-optimizer.cc
+++ b/deps/v8/src/compiler/loop-variable-optimizer.cc
@@ -240,7 +240,8 @@ InductionVariable* LoopVariableOptimizer::TryGetInductionVariable(Node* phi) {
   // TODO(jarin) Support both sides.
   Node* input = arith->InputAt(0);
   if (input->opcode() == IrOpcode::kSpeculativeToNumber ||
-      input->opcode() == IrOpcode::kJSToNumber) {
+      input->opcode() == IrOpcode::kJSToNumber ||
+      input->opcode() == IrOpcode::kJSToNumberConvertBigInt) {
     input = input->InputAt(0);
   }
   if (input != phi) return nullptr;
diff --git a/deps/v8/src/compiler/node-matchers.h b/deps/v8/src/compiler/node-matchers.h
index e153cf524bd874..4b02cad9b9976a 100644
--- a/deps/v8/src/compiler/node-matchers.h
+++ b/deps/v8/src/compiler/node-matchers.h
@@ -18,6 +18,8 @@ namespace v8 {
 namespace internal {
 namespace compiler {
 
+class JSHeapBroker;
+
 // A pattern matcher for nodes.
 struct NodeMatcher {
   explicit NodeMatcher(Node* node) : node_(node) {}
@@ -193,7 +195,9 @@ struct HeapObjectMatcher final
     return this->HasValue() && this->Value().address() == value.address();
   }
 
-  ObjectRef Ref() const { return ObjectRef(this->Value()); }
+  ObjectRef Ref(const JSHeapBroker* broker) const {
+    return ObjectRef(broker, this->Value());
+  }
 };
 
 
diff --git a/deps/v8/src/compiler/node-properties.cc b/deps/v8/src/compiler/node-properties.cc
index 0d0e4f3c97efcc..731a683ad82d75 100644
--- a/deps/v8/src/compiler/node-properties.cc
+++ b/deps/v8/src/compiler/node-properties.cc
@@ -602,6 +602,7 @@ bool NodeProperties::CanBeNullOrUndefined(Isolate* isolate, Node* receiver,
       case IrOpcode::kJSToLength:
       case IrOpcode::kJSToName:
       case IrOpcode::kJSToNumber:
+      case IrOpcode::kJSToNumberConvertBigInt:
       case IrOpcode::kJSToNumeric:
       case IrOpcode::kJSToString:
       case IrOpcode::kToBoolean:
diff --git a/deps/v8/src/compiler/opcodes.h b/deps/v8/src/compiler/opcodes.h
index 7a6b19cb35d4ee..9672f8b4485e19 100644
--- a/deps/v8/src/compiler/opcodes.h
+++ b/deps/v8/src/compiler/opcodes.h
@@ -121,6 +121,7 @@
   V(JSToLength)                    \
   V(JSToName)                      \
   V(JSToNumber)                    \
+  V(JSToNumberConvertBigInt)       \
   V(JSToNumeric)                   \
   V(JSToObject)                    \
   V(JSToString)                    \
diff --git a/deps/v8/src/compiler/operation-typer.cc b/deps/v8/src/compiler/operation-typer.cc
index a9ae8c322aa6d1..f8342cb5428e42 100644
--- a/deps/v8/src/compiler/operation-typer.cc
+++ b/deps/v8/src/compiler/operation-typer.cc
@@ -265,7 +265,9 @@ Type OperationTyper::ConvertReceiver(Type type) {
   return type;
 }
 
-Type OperationTyper::ToNumberOrNumeric(Object::Conversion mode, Type type) {
+// Returns the result type of converting {type} to number, if the
+// result does not depend on conversion options.
+base::Optional<Type> OperationTyper::ToNumberCommon(Type type) {
   if (type.Is(Type::Number())) return type;
   if (type.Is(Type::NullOrUndefined())) {
     if (type.Is(Type::Null())) return cache_.kSingletonZero;
@@ -289,6 +291,13 @@ Type OperationTyper::ToNumberOrNumeric(Object::Conversion mode, Type type) {
     }
     return Type::Intersect(type, Type::Number(), zone());
   }
+  return base::Optional<Type>();
+}
+
+Type OperationTyper::ToNumberOrNumeric(Object::Conversion mode, Type type) {
+  if (base::Optional<Type> maybe_result_type = ToNumberCommon(type)) {
+    return *maybe_result_type;
+  }
   if (type.Is(Type::BigInt())) {
     return mode == Object::Conversion::kToNumber ? Type::None() : type;
   }
@@ -300,6 +309,13 @@ Type OperationTyper::ToNumber(Type type) {
   return ToNumberOrNumeric(Object::Conversion::kToNumber, type);
 }
 
+Type OperationTyper::ToNumberConvertBigInt(Type type) {
+  if (base::Optional<Type> maybe_result_type = ToNumberCommon(type)) {
+    return *maybe_result_type;
+  }
+  return Type::Number();
+}
+
 Type OperationTyper::ToNumeric(Type type) {
   return ToNumberOrNumeric(Object::Conversion::kToNumeric, type);
 }
diff --git a/deps/v8/src/compiler/operation-typer.h b/deps/v8/src/compiler/operation-typer.h
index 81f20bcda4e464..7d62decd82bb3c 100644
--- a/deps/v8/src/compiler/operation-typer.h
+++ b/deps/v8/src/compiler/operation-typer.h
@@ -35,6 +35,7 @@ class V8_EXPORT_PRIVATE OperationTyper {
 
   Type ToPrimitive(Type type);
   Type ToNumber(Type type);
+  Type ToNumberConvertBigInt(Type type);
   Type ToNumeric(Type type);
   Type ToBoolean(Type type);
 
@@ -78,6 +79,7 @@ class V8_EXPORT_PRIVATE OperationTyper {
   typedef base::Flags<ComparisonOutcomeFlags> ComparisonOutcome;
 
   Type ToNumberOrNumeric(Object::Conversion mode, Type type);
+  base::Optional<Type> ToNumberCommon(Type type);
 
   ComparisonOutcome Invert(ComparisonOutcome);
   Type Invert(Type);
diff --git a/deps/v8/src/compiler/operator-properties.cc b/deps/v8/src/compiler/operator-properties.cc
index 689561059cf350..2803043ded11c5 100644
--- a/deps/v8/src/compiler/operator-properties.cc
+++ b/deps/v8/src/compiler/operator-properties.cc
@@ -93,6 +93,7 @@ bool OperatorProperties::HasFrameStateInput(const Operator* op) {
     case IrOpcode::kJSToLength:
     case IrOpcode::kJSToName:
     case IrOpcode::kJSToNumber:
+    case IrOpcode::kJSToNumberConvertBigInt:
     case IrOpcode::kJSToNumeric:
     case IrOpcode::kJSToObject:
     case IrOpcode::kJSToString:
diff --git a/deps/v8/src/compiler/pipeline.cc b/deps/v8/src/compiler/pipeline.cc
index b9443fb302eed6..3366d1db9499f9 100644
--- a/deps/v8/src/compiler/pipeline.cc
+++ b/deps/v8/src/compiler/pipeline.cc
@@ -14,6 +14,7 @@
 #include "src/base/optional.h"
 #include "src/base/platform/elapsed-timer.h"
 #include "src/bootstrapper.h"
+#include "src/code-tracer.h"
 #include "src/compiler.h"
 #include "src/compiler/basic-block-instrumentor.h"
 #include "src/compiler/branch-elimination.h"
@@ -104,6 +105,7 @@ class PipelineData {
                OptimizedCompilationInfo* info,
                PipelineStatistics* pipeline_statistics)
       : isolate_(isolate),
+        allocator_(isolate->allocator()),
         info_(info),
         debug_name_(info_->GetDebugName()),
         may_have_unverifiable_graph_(false),
@@ -133,13 +135,13 @@ class PipelineData {
     javascript_ = new (graph_zone_) JSOperatorBuilder(graph_zone_);
     jsgraph_ = new (graph_zone_)
         JSGraph(isolate_, graph_, common_, javascript_, simplified_, machine_);
-    js_heap_broker_ = new (graph_zone_) JSHeapBroker(isolate_);
+    js_heap_broker_ = new (codegen_zone_) JSHeapBroker(isolate_);
     dependencies_ =
         new (codegen_zone_) CompilationDependencies(isolate_, codegen_zone_);
   }
 
   // For WebAssembly compile entry point.
-  PipelineData(ZoneStats* zone_stats, Isolate* isolate,
+  PipelineData(ZoneStats* zone_stats, wasm::WasmEngine* wasm_engine,
                OptimizedCompilationInfo* info, MachineGraph* mcgraph,
                PipelineStatistics* pipeline_statistics,
                SourcePositionTable* source_positions,
@@ -147,7 +149,9 @@ class PipelineData {
                WasmCompilationData* wasm_compilation_data,
                int wasm_function_index,
                const AssemblerOptions& assembler_options)
-      : isolate_(isolate),
+      : isolate_(nullptr),
+        wasm_engine_(wasm_engine),
+        allocator_(wasm_engine->allocator()),
         info_(info),
         debug_name_(info_->GetDebugName()),
         wasm_function_index_(wasm_function_index),
@@ -177,6 +181,7 @@ class PipelineData {
                NodeOriginTable* node_origins, JumpOptimizationInfo* jump_opt,
                const AssemblerOptions& assembler_options)
       : isolate_(isolate),
+        allocator_(isolate->allocator()),
         info_(info),
         debug_name_(info_->GetDebugName()),
         zone_stats_(zone_stats),
@@ -198,6 +203,7 @@ class PipelineData {
   PipelineData(ZoneStats* zone_stats, OptimizedCompilationInfo* info,
                Isolate* isolate, InstructionSequence* sequence)
       : isolate_(isolate),
+        allocator_(isolate->allocator()),
         info_(info),
         debug_name_(info_->GetDebugName()),
         zone_stats_(zone_stats),
@@ -221,6 +227,7 @@ class PipelineData {
   }
 
   Isolate* isolate() const { return isolate_; }
+  AccountingAllocator* allocator() const { return allocator_; }
   OptimizedCompilationInfo* info() const { return info_; }
   ZoneStats* zone_stats() const { return zone_stats_; }
   CompilationDependencies* dependencies() const { return dependencies_; }
@@ -294,6 +301,11 @@ class PipelineData {
     return jump_optimization_info_;
   }
 
+  CodeTracer* GetCodeTracer() const {
+    return wasm_engine_ == nullptr ? isolate_->GetCodeTracer()
+                                   : wasm_engine_->GetCodeTracer();
+  }
+
   void DeleteGraphZone() {
     if (graph_zone_ == nullptr) return;
     graph_zone_scope_.Destroy();
@@ -322,6 +334,7 @@ class PipelineData {
     codegen_zone_scope_.Destroy();
     codegen_zone_ = nullptr;
     dependencies_ = nullptr;
+    js_heap_broker_ = nullptr;
     frame_ = nullptr;
   }
 
@@ -406,6 +419,8 @@ class PipelineData {
 
  private:
   Isolate* const isolate_;
+  wasm::WasmEngine* const wasm_engine_ = nullptr;
+  AccountingAllocator* const allocator_;
   OptimizedCompilationInfo* const info_;
   std::unique_ptr<char[]> debug_name_;
   int wasm_function_index_ = -1;
@@ -433,7 +448,6 @@ class PipelineData {
   JSGraph* jsgraph_ = nullptr;
   MachineGraph* mcgraph_ = nullptr;
   Schedule* schedule_ = nullptr;
-  JSHeapBroker* js_heap_broker_ = nullptr;
 
   // All objects in the following group of fields are allocated in
   // instruction_zone_. They are all set to nullptr when the instruction_zone_
@@ -448,6 +462,7 @@ class PipelineData {
   ZoneStats::Scope codegen_zone_scope_;
   Zone* codegen_zone_;
   CompilationDependencies* dependencies_ = nullptr;
+  JSHeapBroker* js_heap_broker_ = nullptr;
   Frame* frame_ = nullptr;
 
   // All objects in the following group of fields are allocated in
@@ -649,7 +664,7 @@ struct TurboCfgFile : public std::ofstream {
                       std::ios_base::app) {}
 };
 
-void TraceSchedule(OptimizedCompilationInfo* info, Isolate* isolate,
+void TraceSchedule(OptimizedCompilationInfo* info, PipelineData* data,
                    Schedule* schedule, const char* phase_name) {
   if (info->trace_turbo_json_enabled()) {
     AllowHandleDereference allow_deref;
@@ -666,7 +681,7 @@ void TraceSchedule(OptimizedCompilationInfo* info, Isolate* isolate,
   }
   if (info->trace_turbo_graph_enabled() || FLAG_trace_turbo_scheduler) {
     AllowHandleDereference allow_deref;
-    CodeTracer::Scope tracing_scope(isolate->GetCodeTracer());
+    CodeTracer::Scope tracing_scope(data->GetCodeTracer());
     OFStream os(tracing_scope.file());
     os << "-- Schedule --------------------------------------\n" << *schedule;
   }
@@ -972,23 +987,27 @@ void PipelineCompilationJob::RegisterWeakObjectsInOptimizedCode(
   code->set_can_have_weak_objects(true);
 }
 
+// The stack limit used during compilation is used to limit the recursion
+// depth in, e.g. AST walking. No such recursion happens in WASM compilations.
+constexpr uintptr_t kNoStackLimit = 0;
+
 class PipelineWasmCompilationJob final : public OptimizedCompilationJob {
  public:
   explicit PipelineWasmCompilationJob(
       OptimizedCompilationInfo* info, wasm::WasmEngine* wasm_engine,
-      Isolate* isolate, MachineGraph* mcgraph, CallDescriptor* call_descriptor,
+      MachineGraph* mcgraph, CallDescriptor* call_descriptor,
       SourcePositionTable* source_positions, NodeOriginTable* node_origins,
       WasmCompilationData* wasm_compilation_data,
       wasm::FunctionBody function_body, wasm::WasmModule* wasm_module,
       wasm::NativeModule* native_module, int function_index, bool asmjs_origin)
-      : OptimizedCompilationJob(isolate->stack_guard()->real_climit(), info,
-                                "TurboFan", State::kReadyToExecute),
-        zone_stats_(isolate->allocator()),
+      : OptimizedCompilationJob(kNoStackLimit, info, "TurboFan",
+                                State::kReadyToExecute),
+        zone_stats_(wasm_engine->allocator()),
         pipeline_statistics_(CreatePipelineStatistics(
             wasm_engine, function_body, wasm_module, info, &zone_stats_)),
-        data_(&zone_stats_, isolate, info, mcgraph, pipeline_statistics_.get(),
-              source_positions, node_origins, wasm_compilation_data,
-              function_index, WasmAssemblerOptions(isolate)),
+        data_(&zone_stats_, wasm_engine, info, mcgraph,
+              pipeline_statistics_.get(), source_positions, node_origins,
+              wasm_compilation_data, function_index, WasmAssemblerOptions()),
         pipeline_(&data_),
         linkage_(call_descriptor),
         native_module_(native_module),
@@ -1000,8 +1019,6 @@ class PipelineWasmCompilationJob final : public OptimizedCompilationJob {
   Status FinalizeJobImpl(Isolate* isolate) final;
 
  private:
-  size_t AllocatedMemory() const override;
-
   ZoneStats zone_stats_;
   std::unique_ptr<PipelineStatistics> pipeline_statistics_;
   PipelineData data_;
@@ -1056,18 +1073,10 @@ PipelineWasmCompilationJob::ExecuteJobImpl() {
   pipeline_.ComputeScheduledGraph();
   if (!pipeline_.SelectInstructions(&linkage_)) return FAILED;
   pipeline_.AssembleCode(&linkage_);
-  return SUCCEEDED;
-}
 
-size_t PipelineWasmCompilationJob::AllocatedMemory() const {
-  return pipeline_.data_->zone_stats()->GetCurrentAllocatedBytes();
-}
-
-PipelineWasmCompilationJob::Status PipelineWasmCompilationJob::FinalizeJobImpl(
-    Isolate* isolate) {
   CodeGenerator* code_generator = pipeline_.data_->code_generator();
   CodeDesc code_desc;
-  code_generator->tasm()->GetCode(isolate, &code_desc);
+  code_generator->tasm()->GetCode(nullptr, &code_desc);
 
   wasm::WasmCode* code = native_module_->AddCode(
       data_.wasm_function_index(), code_desc,
@@ -1077,15 +1086,13 @@ PipelineWasmCompilationJob::Status PipelineWasmCompilationJob::FinalizeJobImpl(
       data_.wasm_compilation_data()->GetProtectedInstructions(),
       code_generator->GetSourcePositionTable(), wasm::WasmCode::kTurbofan);
 
-  if (!code) return FAILED;
-
   if (data_.info()->trace_turbo_json_enabled()) {
     TurboJsonFile json_of(data_.info(), std::ios_base::app);
     json_of << "{\"name\":\"disassembly\",\"type\":\"disassembly\",\"data\":\"";
 #ifdef ENABLE_DISASSEMBLER
     std::stringstream disassembler_stream;
     Disassembler::Decode(
-        isolate, &disassembler_stream, code->instructions().start(),
+        nullptr, &disassembler_stream, code->instructions().start(),
         code->instructions().start() + code->safepoint_table_offset(),
         CodeReference(code));
     for (auto const c : disassembler_stream.str()) {
@@ -1101,6 +1108,12 @@ PipelineWasmCompilationJob::Status PipelineWasmCompilationJob::FinalizeJobImpl(
   return SUCCEEDED;
 }
 
+PipelineWasmCompilationJob::Status PipelineWasmCompilationJob::FinalizeJobImpl(
+    Isolate* isolate) {
+  UNREACHABLE();  // Finalize should always be skipped for WasmCompilationJob.
+  return SUCCEEDED;
+}
+
 template <typename Phase>
 void PipelineImpl::Run() {
   PipelineRunScope scope(this->data_, Phase::phase_name());
@@ -1451,7 +1464,7 @@ struct EffectControlLinearizationPhase {
       Schedule* schedule = Scheduler::ComputeSchedule(temp_zone, data->graph(),
                                                       Scheduler::kTempSchedule);
       if (FLAG_turbo_verify) ScheduleVerifier::Run(schedule);
-      TraceSchedule(data->info(), data->isolate(), schedule,
+      TraceSchedule(data->info(), data, schedule,
                     "effect linearization schedule");
 
       EffectControlLinearizer::MaskArrayIndexEnable mask_array_index =
@@ -1670,7 +1683,7 @@ struct InstructionSelectionPhase {
         FLAG_turbo_instruction_scheduling
             ? InstructionSelector::kEnableScheduling
             : InstructionSelector::kDisableScheduling,
-        data->isolate()->serializer_enabled()
+        !data->isolate() || data->isolate()->serializer_enabled()
             ? InstructionSelector::kDisableRootsRelativeAddressing
             : InstructionSelector::kEnableRootsRelativeAddressing,
         data->info()->GetPoisoningMitigationLevel(),
@@ -1899,13 +1912,13 @@ struct PrintGraphPhase {
       }
 
       AllowHandleDereference allow_deref;
-      CodeTracer::Scope tracing_scope(data->isolate()->GetCodeTracer());
+      CodeTracer::Scope tracing_scope(data->GetCodeTracer());
       OFStream os(tracing_scope.file());
       os << "-- Graph after " << phase << " -- " << std::endl;
       os << AsScheduledGraph(schedule);
     } else if (info->trace_turbo_graph_enabled()) {  // Simple textual RPO.
       AllowHandleDereference allow_deref;
-      CodeTracer::Scope tracing_scope(data->isolate()->GetCodeTracer());
+      CodeTracer::Scope tracing_scope(data->GetCodeTracer());
       OFStream os(tracing_scope.file());
       os << "-- Graph after " << phase << " -- " << std::endl;
       os << AsRPO(*graph);
@@ -1954,7 +1967,7 @@ bool PipelineImpl::CreateGraph() {
 
   if (info()->trace_turbo_json_enabled() ||
       info()->trace_turbo_graph_enabled()) {
-    CodeTracer::Scope tracing_scope(isolate()->GetCodeTracer());
+    CodeTracer::Scope tracing_scope(data->GetCodeTracer());
     OFStream os(tracing_scope.file());
     os << "---------------------------------------------------\n"
        << "Begin compiling method " << info()->GetDebugName().get()
@@ -2138,7 +2151,7 @@ MaybeHandle<Code> Pipeline::GenerateCodeForCodeStub(
   DCHECK_NOT_NULL(data.schedule());
 
   if (info.trace_turbo_json_enabled() || info.trace_turbo_graph_enabled()) {
-    CodeTracer::Scope tracing_scope(isolate->GetCodeTracer());
+    CodeTracer::Scope tracing_scope(data.GetCodeTracer());
     OFStream os(tracing_scope.file());
     os << "---------------------------------------------------\n"
        << "Begin compiling " << debug_name << " using Turbofan" << std::endl;
@@ -2153,7 +2166,7 @@ MaybeHandle<Code> Pipeline::GenerateCodeForCodeStub(
     pipeline.Run<PrintGraphPhase>("Machine");
   }
 
-  TraceSchedule(data.info(), data.isolate(), data.schedule(), "schedule");
+  TraceSchedule(data.info(), &data, data.schedule(), "schedule");
 
   pipeline.Run<VerifyGraphPhase>(false, true);
   return pipeline.GenerateCode(call_descriptor);
@@ -2239,14 +2252,14 @@ OptimizedCompilationJob* Pipeline::NewCompilationJob(
 // static
 OptimizedCompilationJob* Pipeline::NewWasmCompilationJob(
     OptimizedCompilationInfo* info, wasm::WasmEngine* wasm_engine,
-    Isolate* isolate, MachineGraph* mcgraph, CallDescriptor* call_descriptor,
+    MachineGraph* mcgraph, CallDescriptor* call_descriptor,
     SourcePositionTable* source_positions, NodeOriginTable* node_origins,
     WasmCompilationData* wasm_compilation_data,
     wasm::FunctionBody function_body, wasm::WasmModule* wasm_module,
     wasm::NativeModule* native_module, int function_index,
     wasm::ModuleOrigin asmjs_origin) {
   return new PipelineWasmCompilationJob(
-      info, wasm_engine, isolate, mcgraph, call_descriptor, source_positions,
+      info, wasm_engine, mcgraph, call_descriptor, source_positions,
       node_origins, wasm_compilation_data, function_body, wasm_module,
       native_module, function_index, asmjs_origin);
 }
@@ -2274,7 +2287,7 @@ void PipelineImpl::ComputeScheduledGraph() {
   RunPrintAndVerify(LateGraphTrimmingPhase::phase_name(), true);
 
   Run<ComputeSchedulePhase>();
-  TraceSchedule(data->info(), data->isolate(), data->schedule(), "schedule");
+  TraceSchedule(data->info(), data, data->schedule(), "schedule");
 }
 
 bool PipelineImpl::SelectInstructions(Linkage* linkage) {
@@ -2305,7 +2318,7 @@ bool PipelineImpl::SelectInstructions(Linkage* linkage) {
         !strcmp(FLAG_turbo_verify_machine_graph, data->debug_name())))) {
     if (FLAG_trace_verify_csa) {
       AllowHandleDereference allow_deref;
-      CodeTracer::Scope tracing_scope(data->isolate()->GetCodeTracer());
+      CodeTracer::Scope tracing_scope(data->GetCodeTracer());
       OFStream os(tracing_scope.file());
       os << "--------------------------------------------------\n"
          << "--- Verifying " << data->debug_name() << " generated by TurboFan\n"
@@ -2315,7 +2328,7 @@ bool PipelineImpl::SelectInstructions(Linkage* linkage) {
          << "--- End of " << data->debug_name() << " generated by TurboFan\n"
          << "--------------------------------------------------\n";
     }
-    Zone temp_zone(data->isolate()->allocator(), ZONE_NAME);
+    Zone temp_zone(data->allocator(), ZONE_NAME);
     MachineGraphVerifier::Run(data->graph(), data->schedule(), linkage,
                               data->info()->IsStub(), data->debug_name(),
                               &temp_zone);
@@ -2509,7 +2522,7 @@ MaybeHandle<Code> PipelineImpl::FinalizeCode() {
   }
   if (info()->trace_turbo_json_enabled() ||
       info()->trace_turbo_graph_enabled()) {
-    CodeTracer::Scope tracing_scope(isolate()->GetCodeTracer());
+    CodeTracer::Scope tracing_scope(data->GetCodeTracer());
     OFStream os(tracing_scope.file());
     os << "---------------------------------------------------\n"
        << "Finished compiling method " << info()->GetDebugName().get()
@@ -2542,7 +2555,7 @@ void PipelineImpl::AllocateRegisters(const RegisterConfiguration* config,
   std::unique_ptr<Zone> verifier_zone;
   RegisterAllocatorVerifier* verifier = nullptr;
   if (run_verifier) {
-    verifier_zone.reset(new Zone(isolate()->allocator(), ZONE_NAME));
+    verifier_zone.reset(new Zone(data->allocator(), ZONE_NAME));
     verifier = new (verifier_zone.get()) RegisterAllocatorVerifier(
         verifier_zone.get(), config, data->sequence());
   }
@@ -2561,7 +2574,7 @@ void PipelineImpl::AllocateRegisters(const RegisterConfiguration* config,
   Run<BuildLiveRangesPhase>();
   if (info()->trace_turbo_graph_enabled()) {
     AllowHandleDereference allow_deref;
-    CodeTracer::Scope tracing_scope(isolate()->GetCodeTracer());
+    CodeTracer::Scope tracing_scope(data->GetCodeTracer());
     OFStream os(tracing_scope.file());
     os << "----- Instruction sequence before register allocation -----\n"
        << PrintableInstructionSequence({config, data->sequence()});
@@ -2605,7 +2618,7 @@ void PipelineImpl::AllocateRegisters(const RegisterConfiguration* config,
 
   if (info()->trace_turbo_graph_enabled()) {
     AllowHandleDereference allow_deref;
-    CodeTracer::Scope tracing_scope(isolate()->GetCodeTracer());
+    CodeTracer::Scope tracing_scope(data->GetCodeTracer());
     OFStream os(tracing_scope.file());
     os << "----- Instruction sequence after register allocation -----\n"
        << PrintableInstructionSequence({config, data->sequence()});
diff --git a/deps/v8/src/compiler/pipeline.h b/deps/v8/src/compiler/pipeline.h
index a7d8026765aa9f..95d13f3169c0db 100644
--- a/deps/v8/src/compiler/pipeline.h
+++ b/deps/v8/src/compiler/pipeline.h
@@ -49,7 +49,7 @@ class Pipeline : public AllStatic {
   // Returns a new compilation job for the WebAssembly compilation info.
   static OptimizedCompilationJob* NewWasmCompilationJob(
       OptimizedCompilationInfo* info, wasm::WasmEngine* wasm_engine,
-      Isolate* isolate, MachineGraph* mcgraph, CallDescriptor* call_descriptor,
+      MachineGraph* mcgraph, CallDescriptor* call_descriptor,
       SourcePositionTable* source_positions, NodeOriginTable* node_origins,
       WasmCompilationData* wasm_compilation_data,
       wasm::FunctionBody function_body, wasm::WasmModule* wasm_module,
diff --git a/deps/v8/src/compiler/property-access-builder.cc b/deps/v8/src/compiler/property-access-builder.cc
index a04e44e9c2d3da..d319304df68cc0 100644
--- a/deps/v8/src/compiler/property-access-builder.cc
+++ b/deps/v8/src/compiler/property-access-builder.cc
@@ -136,7 +136,8 @@ void PropertyAccessBuilder::BuildCheckMaps(
     if (receiver_map->is_stable()) {
       for (Handle<Map> map : receiver_maps) {
         if (map.is_identical_to(receiver_map)) {
-          dependencies()->DependOnStableMap(receiver_map);
+          dependencies()->DependOnStableMap(
+              MapRef(js_heap_broker(), receiver_map));
           return;
         }
       }
@@ -193,7 +194,8 @@ Node* PropertyAccessBuilder::TryBuildLoadConstantDataField(
     // TODO(turbofan): Given that we already have the field_index here, we
     // might be smarter in the future and not rely on the LookupIterator,
     // but for now let's just do what Crankshaft does.
-    LookupIterator it(m.Value(), name, LookupIterator::OWN_SKIP_INTERCEPTOR);
+    LookupIterator it(isolate(), m.Value(), name,
+                      LookupIterator::OWN_SKIP_INTERCEPTOR);
     if (it.state() == LookupIterator::DATA) {
       bool is_readonly_non_configurable =
           it.IsReadOnly() && !it.IsConfigurable();
@@ -205,7 +207,9 @@ Node* PropertyAccessBuilder::TryBuildLoadConstantDataField(
           // the field.
           DCHECK(access_info.IsDataConstantField());
           DCHECK(!it.is_dictionary_holder());
-          dependencies()->DependOnFieldType(&it);
+          MapRef map(js_heap_broker(),
+                     handle(it.GetHolder<HeapObject>()->map(), isolate()));
+          dependencies()->DependOnFieldType(map, it.GetFieldDescriptorIndex());
         }
         return value;
       }
@@ -263,7 +267,7 @@ Node* PropertyAccessBuilder::BuildLoadDataField(
     Handle<Map> field_map;
     if (access_info.field_map().ToHandle(&field_map)) {
       if (field_map->is_stable()) {
-        dependencies()->DependOnStableMap(field_map);
+        dependencies()->DependOnStableMap(MapRef(js_heap_broker(), field_map));
         field_access.map = field_map;
       }
     }
diff --git a/deps/v8/src/compiler/property-access-builder.h b/deps/v8/src/compiler/property-access-builder.h
index 50f25f04c8045a..7b569a9a12fb2c 100644
--- a/deps/v8/src/compiler/property-access-builder.h
+++ b/deps/v8/src/compiler/property-access-builder.h
@@ -19,14 +19,18 @@ class CommonOperatorBuilder;
 class CompilationDependencies;
 class Graph;
 class JSGraph;
+class JSHeapBroker;
 class Node;
 class PropertyAccessInfo;
 class SimplifiedOperatorBuilder;
 
 class PropertyAccessBuilder {
  public:
-  PropertyAccessBuilder(JSGraph* jsgraph, CompilationDependencies* dependencies)
-      : jsgraph_(jsgraph), dependencies_(dependencies) {}
+  PropertyAccessBuilder(JSGraph* jsgraph, const JSHeapBroker* js_heap_broker,
+                        CompilationDependencies* dependencies)
+      : jsgraph_(jsgraph),
+        js_heap_broker_(js_heap_broker),
+        dependencies_(dependencies) {}
 
   // Builds the appropriate string check if the maps are only string
   // maps.
@@ -50,6 +54,7 @@ class PropertyAccessBuilder {
 
  private:
   JSGraph* jsgraph() const { return jsgraph_; }
+  const JSHeapBroker* js_heap_broker() const { return js_heap_broker_; }
   CompilationDependencies* dependencies() const { return dependencies_; }
   Graph* graph() const;
   Isolate* isolate() const;
@@ -64,6 +69,7 @@ class PropertyAccessBuilder {
   Node* ResolveHolder(PropertyAccessInfo const& access_info, Node* receiver);
 
   JSGraph* jsgraph_;
+  const JSHeapBroker* js_heap_broker_;
   CompilationDependencies* dependencies_;
 };
 
diff --git a/deps/v8/src/compiler/simplified-lowering.cc b/deps/v8/src/compiler/simplified-lowering.cc
index 74bb7fcd6b5f00..da7ada89c8adb3 100644
--- a/deps/v8/src/compiler/simplified-lowering.cc
+++ b/deps/v8/src/compiler/simplified-lowering.cc
@@ -1563,6 +1563,7 @@ class RepresentationSelector {
         return;
       }
       case IrOpcode::kJSToNumber:
+      case IrOpcode::kJSToNumberConvertBigInt:
       case IrOpcode::kJSToNumeric: {
         VisitInputs(node);
         // TODO(bmeurer): Optimize somewhat based on input type?
@@ -3297,6 +3298,7 @@ void SimplifiedLowering::LowerAllNodes() {
 void SimplifiedLowering::DoJSToNumberOrNumericTruncatesToFloat64(
     Node* node, RepresentationSelector* selector) {
   DCHECK(node->opcode() == IrOpcode::kJSToNumber ||
+         node->opcode() == IrOpcode::kJSToNumberConvertBigInt ||
          node->opcode() == IrOpcode::kJSToNumeric);
   Node* value = node->InputAt(0);
   Node* context = node->InputAt(1);
@@ -3320,11 +3322,17 @@ void SimplifiedLowering::DoJSToNumberOrNumericTruncatesToFloat64(
   Node* efalse0 = effect;
   Node* vfalse0;
   {
-    Operator const* op = node->opcode() == IrOpcode::kJSToNumber
-                             ? ToNumberOperator()
-                             : ToNumericOperator();
-    Node* code = node->opcode() == IrOpcode::kJSToNumber ? ToNumberCode()
-                                                         : ToNumericCode();
+    Operator const* op =
+        node->opcode() == IrOpcode::kJSToNumber
+            ? (node->opcode() == IrOpcode::kJSToNumberConvertBigInt
+                   ? ToNumberConvertBigIntOperator()
+                   : ToNumberOperator())
+            : ToNumericOperator();
+    Node* code = node->opcode() == IrOpcode::kJSToNumber
+                     ? ToNumberCode()
+                     : (node->opcode() == IrOpcode::kJSToNumberConvertBigInt
+                            ? ToNumberConvertBigIntCode()
+                            : ToNumericCode());
     vfalse0 = efalse0 = if_false0 = graph()->NewNode(
         op, code, value, context, frame_state, efalse0, if_false0);
 
@@ -3392,6 +3400,7 @@ void SimplifiedLowering::DoJSToNumberOrNumericTruncatesToFloat64(
 void SimplifiedLowering::DoJSToNumberOrNumericTruncatesToWord32(
     Node* node, RepresentationSelector* selector) {
   DCHECK(node->opcode() == IrOpcode::kJSToNumber ||
+         node->opcode() == IrOpcode::kJSToNumberConvertBigInt ||
          node->opcode() == IrOpcode::kJSToNumeric);
   Node* value = node->InputAt(0);
   Node* context = node->InputAt(1);
@@ -3412,11 +3421,17 @@ void SimplifiedLowering::DoJSToNumberOrNumericTruncatesToWord32(
   Node* efalse0 = effect;
   Node* vfalse0;
   {
-    Operator const* op = node->opcode() == IrOpcode::kJSToNumber
-                             ? ToNumberOperator()
-                             : ToNumericOperator();
-    Node* code = node->opcode() == IrOpcode::kJSToNumber ? ToNumberCode()
-                                                         : ToNumericCode();
+    Operator const* op =
+        node->opcode() == IrOpcode::kJSToNumber
+            ? (node->opcode() == IrOpcode::kJSToNumberConvertBigInt
+                   ? ToNumberConvertBigIntOperator()
+                   : ToNumberOperator())
+            : ToNumericOperator();
+    Node* code = node->opcode() == IrOpcode::kJSToNumber
+                     ? ToNumberCode()
+                     : (node->opcode() == IrOpcode::kJSToNumberConvertBigInt
+                            ? ToNumberConvertBigIntCode()
+                            : ToNumericCode());
     vfalse0 = efalse0 = if_false0 = graph()->NewNode(
         op, code, value, context, frame_state, efalse0, if_false0);
 
@@ -3922,6 +3937,16 @@ Node* SimplifiedLowering::ToNumberCode() {
   return to_number_code_.get();
 }
 
+Node* SimplifiedLowering::ToNumberConvertBigIntCode() {
+  if (!to_number_convert_big_int_code_.is_set()) {
+    Callable callable =
+        Builtins::CallableFor(isolate(), Builtins::kToNumberConvertBigInt);
+    to_number_convert_big_int_code_.set(
+        jsgraph()->HeapConstant(callable.code()));
+  }
+  return to_number_convert_big_int_code_.get();
+}
+
 Node* SimplifiedLowering::ToNumericCode() {
   if (!to_numeric_code_.is_set()) {
     Callable callable = Builtins::CallableFor(isolate(), Builtins::kToNumeric);
@@ -3942,6 +3967,19 @@ Operator const* SimplifiedLowering::ToNumberOperator() {
   return to_number_operator_.get();
 }
 
+Operator const* SimplifiedLowering::ToNumberConvertBigIntOperator() {
+  if (!to_number_convert_big_int_operator_.is_set()) {
+    Callable callable =
+        Builtins::CallableFor(isolate(), Builtins::kToNumberConvertBigInt);
+    CallDescriptor::Flags flags = CallDescriptor::kNeedsFrameState;
+    auto call_descriptor =
+        Linkage::GetStubCallDescriptor(graph()->zone(), callable.descriptor(),
+                                       0, flags, Operator::kNoProperties);
+    to_number_convert_big_int_operator_.set(common()->Call(call_descriptor));
+  }
+  return to_number_convert_big_int_operator_.get();
+}
+
 Operator const* SimplifiedLowering::ToNumericOperator() {
   if (!to_numeric_operator_.is_set()) {
     Callable callable = Builtins::CallableFor(isolate(), Builtins::kToNumeric);
diff --git a/deps/v8/src/compiler/simplified-lowering.h b/deps/v8/src/compiler/simplified-lowering.h
index 86ac8c75ab278b..5b748e7e955157 100644
--- a/deps/v8/src/compiler/simplified-lowering.h
+++ b/deps/v8/src/compiler/simplified-lowering.h
@@ -52,8 +52,10 @@ class V8_EXPORT_PRIVATE SimplifiedLowering final {
   Zone* const zone_;
   TypeCache const& type_cache_;
   SetOncePointer<Node> to_number_code_;
+  SetOncePointer<Node> to_number_convert_big_int_code_;
   SetOncePointer<Node> to_numeric_code_;
   SetOncePointer<Operator const> to_number_operator_;
+  SetOncePointer<Operator const> to_number_convert_big_int_operator_;
   SetOncePointer<Operator const> to_numeric_operator_;
 
   // TODO(danno): SimplifiedLowering shouldn't know anything about the source
@@ -76,8 +78,10 @@ class V8_EXPORT_PRIVATE SimplifiedLowering final {
   Node* Uint32Mod(Node* const node);
 
   Node* ToNumberCode();
+  Node* ToNumberConvertBigIntCode();
   Node* ToNumericCode();
   Operator const* ToNumberOperator();
+  Operator const* ToNumberConvertBigIntOperator();
   Operator const* ToNumericOperator();
 
   friend class RepresentationSelector;
diff --git a/deps/v8/src/compiler/simplified-operator-reducer.cc b/deps/v8/src/compiler/simplified-operator-reducer.cc
index b7adc3b239b144..34be9cb0e46e54 100644
--- a/deps/v8/src/compiler/simplified-operator-reducer.cc
+++ b/deps/v8/src/compiler/simplified-operator-reducer.cc
@@ -62,8 +62,7 @@ Reduction SimplifiedOperatorReducer::Reduce(Node* node) {
     case IrOpcode::kChangeTaggedToBit: {
       HeapObjectMatcher m(node->InputAt(0));
       if (m.HasValue()) {
-        HeapObjectRef object(m.Value());
-        return ReplaceInt32(object.BooleanValue(js_heap_broker()));
+        return ReplaceInt32(m.Ref(js_heap_broker()).BooleanValue());
       }
       if (m.IsChangeBitToTagged()) return Replace(m.InputAt(0));
       break;
diff --git a/deps/v8/src/compiler/typed-optimization.cc b/deps/v8/src/compiler/typed-optimization.cc
index 14c850bf0e92b6..0c001117dee8ca 100644
--- a/deps/v8/src/compiler/typed-optimization.cc
+++ b/deps/v8/src/compiler/typed-optimization.cc
@@ -93,7 +93,7 @@ base::Optional<MapRef> GetStableMapFromObjectType(
     const JSHeapBroker* js_heap_broker, Type object_type) {
   if (object_type.IsHeapConstant()) {
     HeapObjectRef object = object_type.AsHeapConstant()->Ref();
-    MapRef object_map = object.map(js_heap_broker);
+    MapRef object_map = object.map();
     if (object_map.is_stable()) return object_map;
   }
   return {};
@@ -153,7 +153,7 @@ Reduction TypedOptimization::ReduceCheckMaps(Node* node) {
       if (map_type.IsHeapConstant() &&
           map_type.AsHeapConstant()->Ref().equals(*object_map)) {
         if (object_map->CanTransition()) {
-          object_map->DependOnStableMap(js_heap_broker(), dependencies());
+          dependencies()->DependOnStableMap(*object_map);
         }
         return Replace(effect);
       }
@@ -218,10 +218,8 @@ Reduction TypedOptimization::ReduceLoadField(Node* node) {
     base::Optional<MapRef> object_map =
         GetStableMapFromObjectType(js_heap_broker(), object_type);
     if (object_map.has_value()) {
-      if (object_map->CanTransition()) {
-        object_map->DependOnStableMap(js_heap_broker(), dependencies());
-      }
-      Node* const value = jsgraph()->Constant(js_heap_broker(), *object_map);
+      dependencies()->DependOnStableMap(*object_map);
+      Node* const value = jsgraph()->Constant(*object_map);
       ReplaceWithValue(node, value);
       return Replace(value);
     }
@@ -558,32 +556,30 @@ Reduction TypedOptimization::ReduceTypeOf(Node* node) {
   Factory* const f = factory();
   if (type.Is(Type::Boolean())) {
     return Replace(
-        jsgraph()->Constant(js_heap_broker(), ObjectRef(f->boolean_string())));
+        jsgraph()->Constant(ObjectRef(js_heap_broker(), f->boolean_string())));
   } else if (type.Is(Type::Number())) {
     return Replace(
-        jsgraph()->Constant(js_heap_broker(), ObjectRef(f->number_string())));
+        jsgraph()->Constant(ObjectRef(js_heap_broker(), f->number_string())));
   } else if (type.Is(Type::String())) {
     return Replace(
-        jsgraph()->Constant(js_heap_broker(), ObjectRef(f->string_string())));
+        jsgraph()->Constant(ObjectRef(js_heap_broker(), f->string_string())));
   } else if (type.Is(Type::BigInt())) {
     return Replace(
-        jsgraph()->Constant(js_heap_broker(), ObjectRef(f->bigint_string())));
+        jsgraph()->Constant(ObjectRef(js_heap_broker(), f->bigint_string())));
   } else if (type.Is(Type::Symbol())) {
     return Replace(
-        jsgraph()->Constant(js_heap_broker(), ObjectRef(f->symbol_string())));
+        jsgraph()->Constant(ObjectRef(js_heap_broker(), f->symbol_string())));
   } else if (type.Is(Type::OtherUndetectableOrUndefined())) {
-    return Replace(jsgraph()->Constant(js_heap_broker(),
-                                       ObjectRef(f->undefined_string())));
+    return Replace(jsgraph()->Constant(
+        ObjectRef(js_heap_broker(), f->undefined_string())));
   } else if (type.Is(Type::NonCallableOrNull())) {
     return Replace(
-        jsgraph()->Constant(js_heap_broker(), ObjectRef(f->object_string())));
+        jsgraph()->Constant(ObjectRef(js_heap_broker(), f->object_string())));
   } else if (type.Is(Type::Function())) {
     return Replace(
-        jsgraph()->Constant(js_heap_broker(), ObjectRef(f->function_string())));
+        jsgraph()->Constant(ObjectRef(js_heap_broker(), f->function_string())));
   } else if (type.IsHeapConstant()) {
-    return Replace(jsgraph()->Constant(
-        js_heap_broker(),
-        type.AsHeapConstant()->Ref().TypeOf(js_heap_broker())));
+    return Replace(jsgraph()->Constant(type.AsHeapConstant()->Ref().TypeOf()));
   }
   return NoChange();
 }
diff --git a/deps/v8/src/compiler/typer.cc b/deps/v8/src/compiler/typer.cc
index 575d4aa8933345..9ed488a4773261 100644
--- a/deps/v8/src/compiler/typer.cc
+++ b/deps/v8/src/compiler/typer.cc
@@ -266,6 +266,7 @@ class Typer::Visitor : public Reducer {
   static Type ToLength(Type, Typer*);
   static Type ToName(Type, Typer*);
   static Type ToNumber(Type, Typer*);
+  static Type ToNumberConvertBigInt(Type, Typer*);
   static Type ToNumeric(Type, Typer*);
   static Type ToObject(Type, Typer*);
   static Type ToString(Type, Typer*);
@@ -529,6 +530,11 @@ Type Typer::Visitor::ToNumber(Type type, Typer* t) {
   return t->operation_typer_.ToNumber(type);
 }
 
+// static
+Type Typer::Visitor::ToNumberConvertBigInt(Type type, Typer* t) {
+  return t->operation_typer_.ToNumberConvertBigInt(type);
+}
+
 // static
 Type Typer::Visitor::ToNumeric(Type type, Typer* t) {
   return t->operation_typer_.ToNumeric(type);
@@ -1125,6 +1131,10 @@ Type Typer::Visitor::TypeJSToNumber(Node* node) {
   return TypeUnaryOp(node, ToNumber);
 }
 
+Type Typer::Visitor::TypeJSToNumberConvertBigInt(Node* node) {
+  return TypeUnaryOp(node, ToNumberConvertBigInt);
+}
+
 Type Typer::Visitor::TypeJSToNumeric(Node* node) {
   return TypeUnaryOp(node, ToNumeric);
 }
diff --git a/deps/v8/src/compiler/types.cc b/deps/v8/src/compiler/types.cc
index 0af70027b39b43..64b0385f54c4d1 100644
--- a/deps/v8/src/compiler/types.cc
+++ b/deps/v8/src/compiler/types.cc
@@ -827,7 +827,7 @@ Type Type::NewConstant(const JSHeapBroker* js_heap_broker,
     return NewConstant(static_cast<double>(maybe_smi.value()), zone);
   }
 
-  HeapObjectRef heap_ref(value);
+  HeapObjectRef heap_ref(js_heap_broker, value);
   if (heap_ref.IsHeapNumber()) {
     return NewConstant(heap_ref.AsHeapNumber().value(), zone);
   }
@@ -1064,7 +1064,12 @@ Type Type::OtherNumberConstant(double value, Zone* zone) {
 Type Type::HeapConstant(const JSHeapBroker* js_heap_broker,
                         Handle<i::Object> value, Zone* zone) {
   return FromTypeBase(
-      HeapConstantType::New(js_heap_broker, HeapObjectRef(value), zone));
+      HeapConstantType::New(HeapObjectRef(js_heap_broker, value), zone));
+}
+
+// static
+Type Type::HeapConstant(const HeapObjectRef& value, Zone* zone) {
+  return HeapConstantType::New(value, zone);
 }
 
 // static
diff --git a/deps/v8/src/compiler/types.h b/deps/v8/src/compiler/types.h
index dcd1075a6174ef..49f81390b150f0 100644
--- a/deps/v8/src/compiler/types.h
+++ b/deps/v8/src/compiler/types.h
@@ -363,6 +363,7 @@ class V8_EXPORT_PRIVATE Type {
   static Type OtherNumberConstant(double value, Zone* zone);
   static Type HeapConstant(const JSHeapBroker* js_heap_broker,
                            Handle<i::Object> value, Zone* zone);
+  static Type HeapConstant(const HeapObjectRef& value, Zone* zone);
   static Type Range(double min, double max, Zone* zone);
   static Type Range(RangeType::Limits lims, Zone* zone);
   static Type Tuple(Type first, Type second, Type third, Zone* zone);
@@ -541,11 +542,10 @@ class V8_EXPORT_PRIVATE HeapConstantType : public NON_EXPORTED_BASE(TypeBase) {
   friend class Type;
   friend class BitsetType;
 
-  static HeapConstantType* New(const JSHeapBroker* broker,
-                               const HeapObjectRef& heap_ref, Zone* zone) {
+  static HeapConstantType* New(const HeapObjectRef& heap_ref, Zone* zone) {
     DCHECK(!heap_ref.IsHeapNumber());
     DCHECK_IMPLIES(heap_ref.IsString(), heap_ref.IsInternalizedString());
-    BitsetType::bitset bitset = BitsetType::Lub(heap_ref.type(broker));
+    BitsetType::bitset bitset = BitsetType::Lub(heap_ref.type());
     return new (zone->New(sizeof(HeapConstantType)))
         HeapConstantType(bitset, heap_ref);
   }
diff --git a/deps/v8/src/compiler/verifier.cc b/deps/v8/src/compiler/verifier.cc
index 52cbd6e0b72d55..d57e3ba7a35556 100644
--- a/deps/v8/src/compiler/verifier.cc
+++ b/deps/v8/src/compiler/verifier.cc
@@ -629,6 +629,7 @@ void Verifier::Visitor::Check(Node* node, const AllNodes& all) {
       CheckTypeIs(node, Type::Name());
       break;
     case IrOpcode::kJSToNumber:
+    case IrOpcode::kJSToNumberConvertBigInt:
       // Type is Number.
       CheckTypeIs(node, Type::Number());
       break;
diff --git a/deps/v8/src/compiler/wasm-compiler.cc b/deps/v8/src/compiler/wasm-compiler.cc
index a1c6cb003edf1f..1b8f4e90669a36 100644
--- a/deps/v8/src/compiler/wasm-compiler.cc
+++ b/deps/v8/src/compiler/wasm-compiler.cc
@@ -36,6 +36,8 @@
 #include "src/heap/factory.h"
 #include "src/isolate-inl.h"
 #include "src/log-inl.h"
+#include "src/optimized-compilation-info.h"
+#include "src/tracing/trace-event.h"
 #include "src/trap-handler/trap-handler.h"
 #include "src/wasm/function-body-decoder.h"
 #include "src/wasm/function-compiler.h"
@@ -4850,7 +4852,7 @@ MaybeHandle<Code> CompileJSToWasmWrapper(
       &zone, false, params + 1, CallDescriptor::kNoFlags);
 
   MaybeHandle<Code> maybe_code = Pipeline::GenerateCodeForTesting(
-      &info, isolate, incoming, &graph, WasmAssemblerOptions(isolate));
+      &info, isolate, incoming, &graph, WasmAssemblerOptions());
   Handle<Code> code;
   if (!maybe_code.ToHandle(&code)) {
     return maybe_code;
@@ -5087,7 +5089,7 @@ TurbofanWasmCompilationUnit::TurbofanWasmCompilationUnit(
 TurbofanWasmCompilationUnit::~TurbofanWasmCompilationUnit() = default;
 
 SourcePositionTable* TurbofanWasmCompilationUnit::BuildGraphForWasmFunction(
-    double* decode_ms, NodeOriginTable* node_origins) {
+    double* decode_ms, MachineGraph* mcgraph, NodeOriginTable* node_origins) {
   base::ElapsedTimer decode_timer;
   if (FLAG_trace_wasm_decode_time) {
     decode_timer.Start();
@@ -5095,11 +5097,11 @@ SourcePositionTable* TurbofanWasmCompilationUnit::BuildGraphForWasmFunction(
 
   // Create a TF graph during decoding.
   SourcePositionTable* source_position_table =
-      new (mcgraph_->zone()) SourcePositionTable(mcgraph_->graph());
-  WasmGraphBuilder builder(wasm_unit_->env_, mcgraph_->zone(), mcgraph_,
+      new (mcgraph->zone()) SourcePositionTable(mcgraph->graph());
+  WasmGraphBuilder builder(wasm_unit_->env_, mcgraph->zone(), mcgraph,
                            wasm_unit_->func_body_.sig, source_position_table);
   graph_construction_result_ =
-      wasm::BuildTFGraph(wasm_unit_->isolate_->allocator(), &builder,
+      wasm::BuildTFGraph(wasm_unit_->wasm_engine_->allocator(), &builder,
                          wasm_unit_->func_body_, node_origins);
   if (graph_construction_result_.failed()) {
     if (FLAG_trace_wasm_compiler) {
@@ -5114,15 +5116,16 @@ SourcePositionTable* TurbofanWasmCompilationUnit::BuildGraphForWasmFunction(
   if (builder.has_simd() &&
       (!CpuFeatures::SupportsWasmSimd128() || wasm_unit_->lower_simd_)) {
     SimdScalarLowering(
-        mcgraph_,
-        CreateMachineSignature(mcgraph_->zone(), wasm_unit_->func_body_.sig))
+        mcgraph,
+        CreateMachineSignature(mcgraph->zone(), wasm_unit_->func_body_.sig))
         .LowerGraph();
   }
 
   if (wasm_unit_->func_index_ >= FLAG_trace_wasm_ast_start &&
       wasm_unit_->func_index_ < FLAG_trace_wasm_ast_end) {
-    PrintRawWasmCode(wasm_unit_->isolate_->allocator(), wasm_unit_->func_body_,
-                     wasm_unit_->env_->module, wasm::kPrintLocals);
+    PrintRawWasmCode(wasm_unit_->wasm_engine_->allocator(),
+                     wasm_unit_->func_body_, wasm_unit_->env_->module,
+                     wasm::kPrintLocals);
   }
   if (FLAG_trace_wasm_decode_time) {
     *decode_ms = decode_timer.Elapsed().InMillisecondsF();
@@ -5153,13 +5156,15 @@ Vector<const char> GetDebugName(Zone* zone, wasm::WasmName name, int index) {
 }  // namespace
 
 void TurbofanWasmCompilationUnit::ExecuteCompilation() {
+  TRACE_EVENT0(TRACE_DISABLED_BY_DEFAULT("v8.wasm"),
+               "ExecuteTurbofanCompilation");
   double decode_ms = 0;
   size_t node_count = 0;
 
   // Scope for the {graph_zone}.
   {
-    Zone graph_zone(wasm_unit_->isolate_->allocator(), ZONE_NAME);
-    mcgraph_ = new (&graph_zone)
+    Zone graph_zone(wasm_unit_->wasm_engine_->allocator(), ZONE_NAME);
+    MachineGraph* mcgraph = new (&graph_zone)
         MachineGraph(new (&graph_zone) Graph(&graph_zone),
                      new (&graph_zone) CommonOperatorBuilder(&graph_zone),
                      new (&graph_zone) MachineOperatorBuilder(
@@ -5167,20 +5172,19 @@ void TurbofanWasmCompilationUnit::ExecuteCompilation() {
                          InstructionSelector::SupportedMachineOperatorFlags(),
                          InstructionSelector::AlignmentRequirements()));
 
-    compilation_zone_.reset(
-        new Zone(wasm_unit_->isolate_->allocator(), ZONE_NAME));
+    Zone compilation_zone(wasm_unit_->wasm_engine_->allocator(), ZONE_NAME);
 
-    info_.reset(new OptimizedCompilationInfo(
-        GetDebugName(compilation_zone_.get(), wasm_unit_->func_name_,
+    OptimizedCompilationInfo info(
+        GetDebugName(&compilation_zone, wasm_unit_->func_name_,
                      wasm_unit_->func_index_),
-        compilation_zone_.get(), Code::WASM_FUNCTION));
+        &compilation_zone, Code::WASM_FUNCTION);
 
-    NodeOriginTable* node_origins = info_->trace_turbo_json_enabled()
+    NodeOriginTable* node_origins = info.trace_turbo_json_enabled()
                                         ? new (&graph_zone)
-                                              NodeOriginTable(mcgraph_->graph())
+                                              NodeOriginTable(mcgraph->graph())
                                         : nullptr;
     SourcePositionTable* source_positions =
-        BuildGraphForWasmFunction(&decode_ms, node_origins);
+        BuildGraphForWasmFunction(&decode_ms, mcgraph, node_origins);
 
     if (graph_construction_result_.failed()) {
       ok_ = false;
@@ -5193,29 +5197,30 @@ void TurbofanWasmCompilationUnit::ExecuteCompilation() {
 
     base::ElapsedTimer pipeline_timer;
     if (FLAG_trace_wasm_decode_time) {
-      node_count = mcgraph_->graph()->NodeCount();
+      node_count = mcgraph->graph()->NodeCount();
       pipeline_timer.Start();
     }
 
     // Run the compiler pipeline to generate machine code.
-    auto call_descriptor = GetWasmCallDescriptor(compilation_zone_.get(),
-                                                 wasm_unit_->func_body_.sig);
-    if (mcgraph_->machine()->Is32()) {
+    auto call_descriptor =
+        GetWasmCallDescriptor(&compilation_zone, wasm_unit_->func_body_.sig);
+    if (mcgraph->machine()->Is32()) {
       call_descriptor =
-          GetI32WasmCallDescriptor(compilation_zone_.get(), call_descriptor);
+          GetI32WasmCallDescriptor(&compilation_zone, call_descriptor);
     }
 
-    job_.reset(Pipeline::NewWasmCompilationJob(
-        info_.get(), wasm_unit_->isolate_->wasm_engine(), wasm_unit_->isolate_,
-        mcgraph_, call_descriptor, source_positions, node_origins,
-        &wasm_compilation_data_, wasm_unit_->func_body_,
-        const_cast<wasm::WasmModule*>(wasm_unit_->env_->module),
-        wasm_unit_->native_module_, wasm_unit_->func_index_,
-        wasm_unit_->env_->module->origin));
-    ok_ = job_->ExecuteJob() == CompilationJob::SUCCEEDED;
+    std::unique_ptr<OptimizedCompilationJob> job(
+        Pipeline::NewWasmCompilationJob(
+            &info, wasm_unit_->wasm_engine_, mcgraph, call_descriptor,
+            source_positions, node_origins, &wasm_compilation_data_,
+            wasm_unit_->func_body_,
+            const_cast<wasm::WasmModule*>(wasm_unit_->env_->module),
+            wasm_unit_->native_module_, wasm_unit_->func_index_,
+            wasm_unit_->env_->module->origin));
+    ok_ = job->ExecuteJob() == CompilationJob::SUCCEEDED;
     // TODO(bradnelson): Improve histogram handling of size_t.
     wasm_unit_->counters_->wasm_compile_function_peak_memory_bytes()->AddSample(
-        static_cast<int>(mcgraph_->graph()->zone()->allocation_size()));
+        static_cast<int>(mcgraph->graph()->zone()->allocation_size()));
 
     if (FLAG_trace_wasm_decode_time) {
       double pipeline_ms = pipeline_timer.Elapsed().InMillisecondsF();
@@ -5226,13 +5231,8 @@ void TurbofanWasmCompilationUnit::ExecuteCompilation() {
                                 wasm_unit_->func_body_.start),
           decode_ms, node_count, pipeline_ms);
     }
-    // The graph zone is about to get out of scope. Avoid invalid references.
-    mcgraph_ = nullptr;
+    if (ok_) wasm_code_ = info.wasm_code();
   }
-
-  // Record the memory cost this unit places on the system until
-  // it is finalized.
-  wasm_unit_->memory_cost_ = job_->AllocatedMemory();
 }
 
 wasm::WasmCode* TurbofanWasmCompilationUnit::FinishCompilation(
@@ -5255,24 +5255,9 @@ wasm::WasmCode* TurbofanWasmCompilationUnit::FinishCompilation(
 
     return nullptr;
   }
-  base::ElapsedTimer codegen_timer;
-  if (FLAG_trace_wasm_decode_time) {
-    codegen_timer.Start();
-  }
-
-  if (job_->FinalizeJob(wasm_unit_->isolate_) != CompilationJob::SUCCEEDED) {
-    return nullptr;
-  }
-
-  if (FLAG_trace_wasm_decode_time) {
-    double codegen_ms = codegen_timer.Elapsed().InMillisecondsF();
-    PrintF("wasm-code-generation ok: %u bytes, %0.3f ms code generation\n",
-           static_cast<unsigned>(wasm_unit_->func_body_.end -
-                                 wasm_unit_->func_body_.start),
-           codegen_ms);
-  }
 
-  return job_->compilation_info()->wasm_code();
+  wasm_unit_->native_module()->PublishCode(wasm_code_);
+  return wasm_code_;
 }
 
 namespace {
@@ -5462,8 +5447,8 @@ CallDescriptor* GetI32WasmCallDescriptorForSimd(
                                          MachineRepresentation::kWord32);
 }
 
-AssemblerOptions WasmAssemblerOptions(Isolate* isolate) {
-  AssemblerOptions options = AssemblerOptions::Default(isolate);
+AssemblerOptions WasmAssemblerOptions() {
+  AssemblerOptions options;
   options.record_reloc_info_for_serialization = true;
   options.enable_root_array_delta_access = false;
   return options;
diff --git a/deps/v8/src/compiler/wasm-compiler.h b/deps/v8/src/compiler/wasm-compiler.h
index 857eaf7284ab9e..0f6ee0304eda21 100644
--- a/deps/v8/src/compiler/wasm-compiler.h
+++ b/deps/v8/src/compiler/wasm-compiler.h
@@ -9,7 +9,6 @@
 
 // Clients of this interface shouldn't depend on lots of compiler internals.
 // Do not include anything from src/compiler here!
-#include "src/optimized-compilation-info.h"
 #include "src/runtime/runtime.h"
 #include "src/trap-handler/trap-handler.h"
 #include "src/wasm/function-body-decoder.h"
@@ -22,7 +21,6 @@
 namespace v8 {
 namespace internal {
 struct AssemblerOptions;
-class OptimizedCompilationJob;
 
 namespace compiler {
 // Forward declarations for some compiler data structures.
@@ -84,6 +82,7 @@ class TurbofanWasmCompilationUnit {
   ~TurbofanWasmCompilationUnit();
 
   SourcePositionTable* BuildGraphForWasmFunction(double* decode_ms,
+                                                 MachineGraph* mcgraph,
                                                  NodeOriginTable* node_origins);
 
   void ExecuteCompilation();
@@ -94,15 +93,7 @@ class TurbofanWasmCompilationUnit {
   wasm::WasmCompilationUnit* const wasm_unit_;
   WasmCompilationData wasm_compilation_data_;
   bool ok_ = true;
-  // The graph zone is deallocated at the end of {ExecuteCompilation} by virtue
-  // of it being zone allocated.
-  MachineGraph* mcgraph_ = nullptr;
-  // The compilation_zone_, info_, and job_ fields need to survive past
-  // {ExecuteCompilation}, onto {FinishCompilation} (which happens on the main
-  // thread).
-  std::unique_ptr<Zone> compilation_zone_;
-  std::unique_ptr<OptimizedCompilationInfo> info_;
-  std::unique_ptr<OptimizedCompilationJob> job_;
+  wasm::WasmCode* wasm_code_ = nullptr;
   wasm::Result<wasm::DecodeStruct*> graph_construction_result_;
 
   DISALLOW_COPY_AND_ASSIGN(TurbofanWasmCompilationUnit);
@@ -513,7 +504,7 @@ V8_EXPORT_PRIVATE CallDescriptor* GetI32WasmCallDescriptor(
 V8_EXPORT_PRIVATE CallDescriptor* GetI32WasmCallDescriptorForSimd(
     Zone* zone, CallDescriptor* call_descriptor);
 
-AssemblerOptions WasmAssemblerOptions(Isolate* isolate);
+AssemblerOptions WasmAssemblerOptions();
 
 }  // namespace compiler
 }  // namespace internal
diff --git a/deps/v8/src/compiler/x64/code-generator-x64.cc b/deps/v8/src/compiler/x64/code-generator-x64.cc
index dbe127e0e81dbe..548e3eb41671dd 100644
--- a/deps/v8/src/compiler/x64/code-generator-x64.cc
+++ b/deps/v8/src/compiler/x64/code-generator-x64.cc
@@ -1958,9 +1958,10 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       if (i.InputRegister(0) == i.OutputRegister()) {
         if (mode == kMode_MRI) {
           int32_t constant_summand = i.InputInt32(1);
+          DCHECK_NE(0, constant_summand);
           if (constant_summand > 0) {
             __ addl(i.OutputRegister(), Immediate(constant_summand));
-          } else if (constant_summand < 0) {
+          } else {
             __ subl(i.OutputRegister(), Immediate(-constant_summand));
           }
         } else if (mode == kMode_MR1) {
diff --git a/deps/v8/src/compiler/x64/instruction-selector-x64.cc b/deps/v8/src/compiler/x64/instruction-selector-x64.cc
index 975d7b7c88e9d9..b027e18a8b67a3 100644
--- a/deps/v8/src/compiler/x64/instruction-selector-x64.cc
+++ b/deps/v8/src/compiler/x64/instruction-selector-x64.cc
@@ -838,7 +838,6 @@ void InstructionSelector::VisitInt64AddWithOverflow(Node* node) {
   VisitBinop(this, node, kX64Add, &cont);
 }
 
-
 void InstructionSelector::VisitInt32Sub(Node* node) {
   X64OperandGenerator g(this);
   DCHECK_EQ(node->InputCount(), 2);
@@ -846,31 +845,38 @@ void InstructionSelector::VisitInt32Sub(Node* node) {
   Node* input2 = node->InputAt(1);
   if (input1->opcode() == IrOpcode::kTruncateInt64ToInt32 &&
       g.CanBeImmediate(input2)) {
-    // Omit truncation and turn subtractions of constant values into immediate
-    // "leal" instructions by negating the value.
-    Emit(kX64Lea32 | AddressingModeField::encode(kMode_MRI),
-         g.DefineAsRegister(node), g.UseRegister(input1->InputAt(0)),
-         g.TempImmediate(-g.GetImmediateIntegerValue(input2)));
+    int32_t imm = g.GetImmediateIntegerValue(input2);
+    InstructionOperand int64_input = g.UseRegister(input1->InputAt(0));
+    if (imm == 0) {
+      // Emit "movl" for subtraction of 0.
+      Emit(kX64Movl, g.DefineAsRegister(node), int64_input);
+    } else {
+      // Omit truncation and turn subtractions of constant values into immediate
+      // "leal" instructions by negating the value.
+      Emit(kX64Lea32 | AddressingModeField::encode(kMode_MRI),
+           g.DefineAsRegister(node), int64_input, g.TempImmediate(-imm));
+    }
     return;
   }
 
   Int32BinopMatcher m(node);
   if (m.left().Is(0)) {
     Emit(kX64Neg32, g.DefineSameAsFirst(node), g.UseRegister(m.right().node()));
+  } else if (m.right().Is(0)) {
+    // TODO(jarin): We should be able to use {EmitIdentity} here
+    // (https://crbug.com/v8/7947).
+    Emit(kArchNop, g.DefineSameAsFirst(node), g.Use(m.left().node()));
+  } else if (m.right().HasValue() && g.CanBeImmediate(m.right().node())) {
+    // Turn subtractions of constant values into immediate "leal" instructions
+    // by negating the value.
+    Emit(kX64Lea32 | AddressingModeField::encode(kMode_MRI),
+         g.DefineAsRegister(node), g.UseRegister(m.left().node()),
+         g.TempImmediate(-m.right().Value()));
   } else {
-    if (m.right().HasValue() && g.CanBeImmediate(m.right().node())) {
-      // Turn subtractions of constant values into immediate "leal" instructions
-      // by negating the value.
-      Emit(kX64Lea32 | AddressingModeField::encode(kMode_MRI),
-           g.DefineAsRegister(node), g.UseRegister(m.left().node()),
-           g.TempImmediate(-m.right().Value()));
-      return;
-    }
     VisitBinop(this, node, kX64Sub32);
   }
 }
 
-
 void InstructionSelector::VisitInt64Sub(Node* node) {
   X64OperandGenerator g(this);
   Int64BinopMatcher m(node);
diff --git a/deps/v8/src/contexts-inl.h b/deps/v8/src/contexts-inl.h
index b954fd3b8ea88b..62faacbca7307a 100644
--- a/deps/v8/src/contexts-inl.h
+++ b/deps/v8/src/contexts-inl.h
@@ -32,11 +32,12 @@ void ScriptContextTable::set_used(int used) {
 
 
 // static
-Handle<Context> ScriptContextTable::GetContext(Handle<ScriptContextTable> table,
+Handle<Context> ScriptContextTable::GetContext(Isolate* isolate,
+                                               Handle<ScriptContextTable> table,
                                                int i) {
   DCHECK(i < table->used());
   return Handle<Context>::cast(
-      FixedArray::get(*table, i + kFirstContextSlotIndex, table->GetIsolate()));
+      FixedArray::get(*table, i + kFirstContextSlotIndex, isolate));
 }
 
 // static
diff --git a/deps/v8/src/contexts.cc b/deps/v8/src/contexts.cc
index 977f4aec2bcd26..b52d751f3fe918 100644
--- a/deps/v8/src/contexts.cc
+++ b/deps/v8/src/contexts.cc
@@ -37,11 +37,11 @@ Handle<ScriptContextTable> ScriptContextTable::Extend(
   return result;
 }
 
-
-bool ScriptContextTable::Lookup(Handle<ScriptContextTable> table,
+bool ScriptContextTable::Lookup(Isolate* isolate,
+                                Handle<ScriptContextTable> table,
                                 Handle<String> name, LookupResult* result) {
   for (int i = 0; i < table->used(); i++) {
-    Handle<Context> context = GetContext(table, i);
+    Handle<Context> context = GetContext(isolate, table, i);
     DCHECK(context->IsScriptContext());
     Handle<ScopeInfo> scope_info(context->scope_info(), context->GetIsolate());
     int slot_index = ScopeInfo::ContextSlotIndex(
@@ -223,10 +223,10 @@ Handle<Object> Context::Lookup(Handle<String> name, ContextLookupFlags flags,
             context->global_object()->native_context()->script_context_table(),
             isolate);
         ScriptContextTable::LookupResult r;
-        if (ScriptContextTable::Lookup(script_contexts, name, &r)) {
+        if (ScriptContextTable::Lookup(isolate, script_contexts, name, &r)) {
           if (FLAG_trace_contexts) {
-            Handle<Context> c = ScriptContextTable::GetContext(script_contexts,
-                                                               r.context_index);
+            Handle<Context> c = ScriptContextTable::GetContext(
+                isolate, script_contexts, r.context_index);
             PrintF("=> found property in script context %d: %p\n",
                    r.context_index, reinterpret_cast<void*>(*c));
           }
@@ -234,7 +234,7 @@ Handle<Object> Context::Lookup(Handle<String> name, ContextLookupFlags flags,
           *variable_mode = r.mode;
           *init_flag = r.init_flag;
           *attributes = GetAttributesForMode(r.mode);
-          return ScriptContextTable::GetContext(script_contexts,
+          return ScriptContextTable::GetContext(isolate, script_contexts,
                                                 r.context_index);
         }
       }
@@ -378,7 +378,8 @@ Handle<Object> Context::Lookup(Handle<String> name, ContextLookupFlags flags,
       // to with, script or native contexts up the context chain.
       obj = context->get(WHITE_LIST_INDEX);
       if (obj->IsStringSet()) {
-        failed_whitelist = failed_whitelist || !StringSet::cast(obj)->Has(name);
+        failed_whitelist =
+            failed_whitelist || !StringSet::cast(obj)->Has(isolate, name);
       }
     }
 
diff --git a/deps/v8/src/contexts.h b/deps/v8/src/contexts.h
index 92fea766c8b8e0..3a4f8329c70245 100644
--- a/deps/v8/src/contexts.h
+++ b/deps/v8/src/contexts.h
@@ -366,7 +366,8 @@ class ScriptContextTable : public FixedArray {
   inline int used() const;
   inline void set_used(int used);
 
-  static inline Handle<Context> GetContext(Handle<ScriptContextTable> table,
+  static inline Handle<Context> GetContext(Isolate* isolate,
+                                           Handle<ScriptContextTable> table,
                                            int i);
 
   // Lookup a variable `name` in a ScriptContextTable.
@@ -374,8 +375,8 @@ class ScriptContextTable : public FixedArray {
   // valid information about its location.
   // If it returns false, `result` is untouched.
   V8_WARN_UNUSED_RESULT
-  static bool Lookup(Handle<ScriptContextTable> table, Handle<String> name,
-                     LookupResult* result);
+  static bool Lookup(Isolate* isolate, Handle<ScriptContextTable> table,
+                     Handle<String> name, LookupResult* result);
 
   V8_WARN_UNUSED_RESULT
   static Handle<ScriptContextTable> Extend(Handle<ScriptContextTable> table,
diff --git a/deps/v8/src/counters-inl.h b/deps/v8/src/counters-inl.h
index abde3a1af5295d..0f60a768063c5b 100644
--- a/deps/v8/src/counters-inl.h
+++ b/deps/v8/src/counters-inl.h
@@ -57,9 +57,10 @@ void RuntimeCallTimer::CommitTimeToCounter() {
 
 bool RuntimeCallTimer::IsStarted() { return start_ticks_ != base::TimeTicks(); }
 
-RuntimeCallTimerScope::RuntimeCallTimerScope(HeapObject* heap_object,
+RuntimeCallTimerScope::RuntimeCallTimerScope(Isolate* isolate,
+                                             HeapObject* heap_object,
                                              RuntimeCallCounterId counter_id)
-    : RuntimeCallTimerScope(heap_object->GetIsolate(), counter_id) {}
+    : RuntimeCallTimerScope(isolate, counter_id) {}
 
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/src/counters.cc b/deps/v8/src/counters.cc
index 580536d3d6288f..bcea9e0f426e46 100644
--- a/deps/v8/src/counters.cc
+++ b/deps/v8/src/counters.cc
@@ -215,24 +215,6 @@ Counters::Counters(Isolate* isolate)
         Histogram(histogram.caption, 1000, 500000, 50, this);
   }
 
-  // For n = 100, low = 4000, high = 2000000: the factor = 1.06.
-  static const struct {
-    Histogram Counters::*member;
-    AggregatedMemoryHistogram<Histogram> Counters::*aggregated;
-    const char* caption;
-  } kMemoryHistograms[] = {
-#define HM(name, caption) \
-  {&Counters::name##_, &Counters::aggregated_##name##_, #caption},
-      HISTOGRAM_MEMORY_LIST(HM)
-#undef HM
-  };
-  for (const auto& histogram : kMemoryHistograms) {
-    this->*histogram.member =
-        Histogram(histogram.caption, 4000, 2000000, 100, this);
-    this->*histogram.aggregated =
-        AggregatedMemoryHistogram<Histogram>(&(this->*histogram.member));
-  }
-
   // clang-format off
   static const struct {
     StatsCounter Counters::*member;
@@ -323,7 +305,6 @@ void Counters::ResetCreateHistogramFunction(CreateHistogramCallback f) {
 
 #define HM(name, caption) name##_.Reset();
     HISTOGRAM_LEGACY_MEMORY_LIST(HM)
-    HISTOGRAM_MEMORY_LIST(HM)
 #undef HM
 }
 
diff --git a/deps/v8/src/counters.h b/deps/v8/src/counters.h
index 9a329bfe63aab8..0f7ae95769a75e 100644
--- a/deps/v8/src/counters.h
+++ b/deps/v8/src/counters.h
@@ -1095,7 +1095,7 @@ class RuntimeCallTimerScope {
                                RuntimeCallCounterId counter_id);
   // This constructor is here just to avoid calling GetIsolate() when the
   // stats are disabled and the isolate is not directly available.
-  inline RuntimeCallTimerScope(HeapObject* heap_object,
+  inline RuntimeCallTimerScope(Isolate* isolate, HeapObject* heap_object,
                                RuntimeCallCounterId counter_id);
   inline RuntimeCallTimerScope(RuntimeCallStats* stats,
                                RuntimeCallCounterId counter_id) {
@@ -1290,12 +1290,6 @@ class RuntimeCallTimerScope {
   HM(heap_sample_code_space_committed, V8.MemoryHeapSampleCodeSpaceCommitted) \
   HM(heap_sample_maximum_committed, V8.MemoryHeapSampleMaximumCommitted)
 
-// Note: These define both Histogram and AggregatedMemoryHistogram<Histogram>
-// histograms with options (min=4000, max=2000000, buckets=100).
-#define HISTOGRAM_MEMORY_LIST(HM)                   \
-  HM(memory_heap_committed, V8.MemoryHeapCommitted) \
-  HM(memory_heap_used, V8.MemoryHeapUsed)
-
 // WARNING: STATS_COUNTER_LIST_* is a very large macro that is causing MSVC
 // Intellisense to crash.  It was broken into two macros (each of length 40
 // lines) rather than one macro (of length about 80 lines) to work around
@@ -1476,14 +1470,6 @@ class Counters : public std::enable_shared_from_this<Counters> {
 #define HM(name, caption) \
   Histogram* name() { return &name##_; }
   HISTOGRAM_LEGACY_MEMORY_LIST(HM)
-  HISTOGRAM_MEMORY_LIST(HM)
-#undef HM
-
-#define HM(name, caption)                                     \
-  AggregatedMemoryHistogram<Histogram>* aggregated_##name() { \
-    return &aggregated_##name##_;                             \
-  }
-  HISTOGRAM_MEMORY_LIST(HM)
 #undef HM
 
 #define SC(name, caption) \
@@ -1511,7 +1497,6 @@ class Counters : public std::enable_shared_from_this<Counters> {
 #undef PERCENTAGE_ID
 #define MEMORY_ID(name, caption) k_##name,
     HISTOGRAM_LEGACY_MEMORY_LIST(MEMORY_ID)
-    HISTOGRAM_MEMORY_LIST(MEMORY_ID)
 #undef MEMORY_ID
 #define COUNTER_ID(name, caption) k_##name,
     STATS_COUNTER_LIST_1(COUNTER_ID)
@@ -1583,12 +1568,6 @@ class Counters : public std::enable_shared_from_this<Counters> {
 #define HM(name, caption) \
   Histogram name##_;
   HISTOGRAM_LEGACY_MEMORY_LIST(HM)
-  HISTOGRAM_MEMORY_LIST(HM)
-#undef HM
-
-#define HM(name, caption) \
-  AggregatedMemoryHistogram<Histogram> aggregated_##name##_;
-  HISTOGRAM_MEMORY_LIST(HM)
 #undef HM
 
 #define SC(name, caption) \
diff --git a/deps/v8/src/d8.cc b/deps/v8/src/d8.cc
index 975dd03414f5ab..8feefa4634b111 100644
--- a/deps/v8/src/d8.cc
+++ b/deps/v8/src/d8.cc
@@ -425,8 +425,8 @@ base::OnceType Shell::quit_once_ = V8_ONCE_INIT;
 // Dummy external source stream which returns the whole source in one go.
 class DummySourceStream : public v8::ScriptCompiler::ExternalSourceStream {
  public:
-  explicit DummySourceStream(Local<String> source) : done_(false) {
-    source_length_ = source->Utf8Length();
+  DummySourceStream(Local<String> source, Isolate* isolate) : done_(false) {
+    source_length_ = source->Utf8Length(isolate);
     source_buffer_.reset(new uint8_t[source_length_]);
     source->WriteUtf8(reinterpret_cast<char*>(source_buffer_.get()),
                       source_length_);
@@ -453,7 +453,7 @@ class BackgroundCompileThread : public base::Thread {
   BackgroundCompileThread(Isolate* isolate, Local<String> source)
       : base::Thread(GetThreadOptions("BackgroundCompileThread")),
         source_(source),
-        streamed_source_(new DummySourceStream(source),
+        streamed_source_(new DummySourceStream(source, isolate),
                          v8::ScriptCompiler::StreamedSource::UTF8),
         task_(v8::ScriptCompiler::StartStreamingScript(isolate,
                                                        &streamed_source_)) {}
@@ -2423,6 +2423,14 @@ SourceGroup::~SourceGroup() {
   thread_ = nullptr;
 }
 
+bool ends_with(const char* input, const char* suffix) {
+  size_t input_length = strlen(input);
+  size_t suffix_length = strlen(suffix);
+  if (suffix_length <= input_length) {
+    return strcmp(input + input_length - suffix_length, suffix) == 0;
+  }
+  return false;
+}
 
 void SourceGroup::Execute(Isolate* isolate) {
   bool exception_was_thrown = false;
@@ -2446,6 +2454,13 @@ void SourceGroup::Execute(Isolate* isolate) {
       }
       ++i;
       continue;
+    } else if (ends_with(arg, ".mjs")) {
+      Shell::options.script_executed = true;
+      if (!Shell::ExecuteModule(isolate, arg)) {
+        exception_was_thrown = true;
+        break;
+      }
+      continue;
     } else if (strcmp(arg, "--module") == 0 && i + 1 < end_offset_) {
       // Treat the next file as a module.
       arg = argv_[++i];
@@ -2905,8 +2920,8 @@ bool Shell::SetOptions(int argc, char* argv[]) {
       current->Begin(argv, i + 1);
     } else if (strcmp(str, "--module") == 0) {
       // Pass on to SourceGroup, which understands this option.
-    } else if (strncmp(argv[i], "--", 2) == 0) {
-      printf("Warning: unknown flag %s.\nTry --help for options\n", argv[i]);
+    } else if (strncmp(str, "--", 2) == 0) {
+      printf("Warning: unknown flag %s.\nTry --help for options\n", str);
     } else if (strcmp(str, "-e") == 0 && i + 1 < argc) {
       options.script_executed = true;
     } else if (strncmp(str, "-", 1) != 0) {
@@ -3344,7 +3359,9 @@ int Shell::Main(int argc, char* argv[]) {
   if (i::FLAG_trace_turbo_cfg_file == nullptr) {
     SetFlagsFromString("--trace-turbo-cfg-file=turbo.cfg");
   }
-  SetFlagsFromString("--redirect-code-traces-to=code.asm");
+  if (i::FLAG_redirect_code_traces_to == nullptr) {
+    SetFlagsFromString("--redirect-code-traces-to=code.asm");
+  }
   int result = 0;
   Isolate::CreateParams create_params;
   ShellArrayBufferAllocator shell_array_buffer_allocator;
diff --git a/deps/v8/src/debug/OWNERS b/deps/v8/src/debug/OWNERS
index 26899f91144428..46b472480d1a79 100644
--- a/deps/v8/src/debug/OWNERS
+++ b/deps/v8/src/debug/OWNERS
@@ -1,7 +1,6 @@
 set noparent
 
 bmeurer@chromium.org
-franzih@chromium.org
 jgruber@chromium.org
 mvstanton@chromium.org
 verwaest@chromium.org
diff --git a/deps/v8/src/debug/debug-evaluate.cc b/deps/v8/src/debug/debug-evaluate.cc
index 0dd23037723ff4..07cda683287cfa 100644
--- a/deps/v8/src/debug/debug-evaluate.cc
+++ b/deps/v8/src/debug/debug-evaluate.cc
@@ -32,7 +32,8 @@ MaybeHandle<Object> DebugEvaluate::Global(Isolate* isolate,
   ScriptOriginOptions origin_options(false, true);
   MaybeHandle<SharedFunctionInfo> maybe_function_info =
       Compiler::GetSharedFunctionInfoForScript(
-          source, Compiler::ScriptDetails(isolate->factory()->empty_string()),
+          isolate, source,
+          Compiler::ScriptDetails(isolate->factory()->empty_string()),
           origin_options, nullptr, nullptr, ScriptCompiler::kNoCompileOptions,
           ScriptCompiler::kNoCacheNoReason, NOT_NATIVES_CODE);
 
diff --git a/deps/v8/src/debug/debug-scopes.cc b/deps/v8/src/debug/debug-scopes.cc
index 9971ee217f80a7..8c6fae1d9fcaa2 100644
--- a/deps/v8/src/debug/debug-scopes.cc
+++ b/deps/v8/src/debug/debug-scopes.cc
@@ -545,8 +545,8 @@ void ScopeIterator::VisitScriptScope(const Visitor& visitor) const {
   // Skip the first script since that just declares 'this'.
   for (int context_index = 1; context_index < script_contexts->used();
        context_index++) {
-    Handle<Context> context =
-        ScriptContextTable::GetContext(script_contexts, context_index);
+    Handle<Context> context = ScriptContextTable::GetContext(
+        isolate_, script_contexts, context_index);
     Handle<ScopeInfo> scope_info(context->scope_info(), isolate_);
     if (VisitContextLocals(visitor, scope_info, context)) return;
   }
@@ -718,7 +718,7 @@ void ScopeIterator::VisitLocalScope(const Visitor& visitor, Mode mode) const {
       // but don't force |this| to be context-allocated. Otherwise we'd find the
       // wrong |this| value.
       if (!closure_scope_->has_this_declaration() &&
-          !non_locals_->Has(isolate_->factory()->this_string())) {
+          !non_locals_->Has(isolate_, isolate_->factory()->this_string())) {
         if (visitor(isolate_->factory()->this_string(),
                     isolate_->factory()->undefined_value()))
           return;
@@ -843,7 +843,7 @@ bool ScopeIterator::SetContextExtensionValue(Handle<String> variable_name,
 
   DCHECK(context_->extension_object()->IsJSContextExtensionObject());
   Handle<JSObject> ext(context_->extension_object(), isolate_);
-  LookupIterator it(ext, variable_name, LookupIterator::OWN);
+  LookupIterator it(isolate_, ext, variable_name, LookupIterator::OWN);
   Maybe<bool> maybe = JSReceiver::HasOwnProperty(ext, variable_name);
   DCHECK(maybe.IsJust());
   if (!maybe.FromJust()) return false;
@@ -893,10 +893,10 @@ bool ScopeIterator::SetScriptVariableValue(Handle<String> variable_name,
       context_->global_object()->native_context()->script_context_table(),
       isolate_);
   ScriptContextTable::LookupResult lookup_result;
-  if (ScriptContextTable::Lookup(script_contexts, variable_name,
+  if (ScriptContextTable::Lookup(isolate_, script_contexts, variable_name,
                                  &lookup_result)) {
     Handle<Context> script_context = ScriptContextTable::GetContext(
-        script_contexts, lookup_result.context_index);
+        isolate_, script_contexts, lookup_result.context_index);
     script_context->set(lookup_result.slot_index, *new_value);
     return true;
   }
diff --git a/deps/v8/src/debug/debug-stack-trace-iterator.cc b/deps/v8/src/debug/debug-stack-trace-iterator.cc
index f12c8d920d7775..bf1e1b623b427b 100644
--- a/deps/v8/src/debug/debug-stack-trace-iterator.cc
+++ b/deps/v8/src/debug/debug-stack-trace-iterator.cc
@@ -92,7 +92,8 @@ v8::MaybeLocal<v8::Value> DebugStackTraceIterator::GetReceiver() const {
                                  ScopeIterator::COLLECT_NON_LOCALS);
     // We lookup this variable in function context only when it is used in arrow
     // function otherwise V8 can optimize it out.
-    if (!scope_iterator.GetNonLocals()->Has(isolate_->factory()->this_string()))
+    if (!scope_iterator.GetNonLocals()->Has(isolate_,
+                                            isolate_->factory()->this_string()))
       return v8::MaybeLocal<v8::Value>();
 
     Handle<ScopeInfo> scope_info(context->scope_info(), isolate_);
diff --git a/deps/v8/src/debug/debug.cc b/deps/v8/src/debug/debug.cc
index 253bafd9b3376f..47de9523a50f84 100644
--- a/deps/v8/src/debug/debug.cc
+++ b/deps/v8/src/debug/debug.cc
@@ -1701,7 +1701,8 @@ void Debug::OnException(Handle<Object> exception, Handle<Object> promise) {
     Handle<JSObject> jspromise = Handle<JSObject>::cast(promise);
     // Mark the promise as already having triggered a message.
     Handle<Symbol> key = isolate_->factory()->promise_debug_marker_symbol();
-    JSObject::SetProperty(jspromise, key, key, LanguageMode::kStrict).Assert();
+    JSObject::SetProperty(isolate_, jspromise, key, key, LanguageMode::kStrict)
+        .Assert();
     // Check whether the promise reject is considered an uncaught exception.
     uncaught = !isolate_->PromiseHasUserDefinedRejectHandler(jspromise);
   }
diff --git a/deps/v8/src/debug/liveedit.cc b/deps/v8/src/debug/liveedit.cc
index dd0eeeecee9c87..8d2d4d279345a2 100644
--- a/deps/v8/src/debug/liveedit.cc
+++ b/deps/v8/src/debug/liveedit.cc
@@ -779,12 +779,13 @@ class FunctionDataMap : public ThreadVisitor {
                  FunctionData{literal, should_restart});
   }
 
-  bool Lookup(SharedFunctionInfo* sfi, FunctionData** data) {
-    if (!sfi->script()->IsScript() || sfi->function_literal_id() == -1) {
+  bool Lookup(Isolate* isolate, SharedFunctionInfo* sfi, FunctionData** data) {
+    int function_literal_id = sfi->FunctionLiteralId(isolate);
+    if (!sfi->script()->IsScript() || function_literal_id == -1) {
       return false;
     }
     Script* script = Script::cast(sfi->script());
-    return Lookup(script->id(), sfi->function_literal_id(), data);
+    return Lookup(script->id(), function_literal_id, data);
   }
 
   bool Lookup(Handle<Script> script, FunctionLiteral* literal,
@@ -799,20 +800,20 @@ class FunctionDataMap : public ThreadVisitor {
         if (obj->IsSharedFunctionInfo()) {
           SharedFunctionInfo* sfi = SharedFunctionInfo::cast(obj);
           FunctionData* data = nullptr;
-          if (!Lookup(sfi, &data)) continue;
+          if (!Lookup(isolate, sfi, &data)) continue;
           data->shared = handle(sfi, isolate);
         } else if (obj->IsJSFunction()) {
           JSFunction* js_function = JSFunction::cast(obj);
           SharedFunctionInfo* sfi = js_function->shared();
           FunctionData* data = nullptr;
-          if (!Lookup(sfi, &data)) continue;
+          if (!Lookup(isolate, sfi, &data)) continue;
           data->js_functions.emplace_back(js_function, isolate);
         } else if (obj->IsJSGeneratorObject()) {
           JSGeneratorObject* gen = JSGeneratorObject::cast(obj);
           if (gen->is_closed()) continue;
           SharedFunctionInfo* sfi = gen->function()->shared();
           FunctionData* data = nullptr;
-          if (!Lookup(sfi, &data)) continue;
+          if (!Lookup(isolate, sfi, &data)) continue;
           data->running_generators.emplace_back(gen, isolate);
         }
       }
@@ -842,7 +843,7 @@ class FunctionDataMap : public ThreadVisitor {
           stack_position = FunctionData::BELOW_NON_DROPPABLE_FRAME;
         }
         FunctionData* data = nullptr;
-        if (!Lookup(*sfi, &data)) continue;
+        if (!Lookup(isolate, *sfi, &data)) continue;
         if (!data->should_restart) continue;
         data->stack_position = stack_position;
         *restart_frame_fp = frame->fp();
@@ -866,7 +867,7 @@ class FunctionDataMap : public ThreadVisitor {
       it.frame()->GetFunctions(&sfis);
       for (auto& sfi : sfis) {
         FunctionData* data = nullptr;
-        if (!Lookup(*sfi, &data)) continue;
+        if (!Lookup(isolate, *sfi, &data)) continue;
         data->stack_position = FunctionData::ARCHIVED_THREAD;
       }
     }
@@ -931,7 +932,7 @@ bool CanRestartFrame(Isolate* isolate, Address fp,
   JavaScriptFrame::cast(restart_frame)->GetFunctions(&sfis);
   for (auto& sfi : sfis) {
     FunctionData* data = nullptr;
-    if (!function_data_map.Lookup(*sfi, &data)) continue;
+    if (!function_data_map.Lookup(isolate, *sfi, &data)) continue;
     auto new_literal_it = changed.find(data->literal);
     if (new_literal_it == changed.end()) continue;
     if (new_literal_it->second->scope()->new_target_var()) {
@@ -943,9 +944,8 @@ bool CanRestartFrame(Isolate* isolate, Address fp,
   return true;
 }
 
-void TranslateSourcePositionTable(Handle<BytecodeArray> code,
+void TranslateSourcePositionTable(Isolate* isolate, Handle<BytecodeArray> code,
                                   const std::vector<SourceChangeRange>& diffs) {
-  Isolate* isolate = code->GetIsolate();
   SourcePositionTableBuilder builder;
 
   Handle<ByteArray> source_position_table(code->SourcePositionTable(), isolate);
@@ -978,8 +978,8 @@ void UpdatePositions(Isolate* isolate, Handle<SharedFunctionInfo> sfi,
   sfi->SetFunctionTokenPosition(new_function_token_position,
                                 new_start_position);
   if (sfi->HasBytecodeArray()) {
-    TranslateSourcePositionTable(handle(sfi->GetBytecodeArray(), isolate),
-                                 diffs);
+    TranslateSourcePositionTable(
+        isolate, handle(sfi->GetBytecodeArray(), isolate), diffs);
   }
 }
 }  // anonymous namespace
@@ -1060,11 +1060,14 @@ void LiveEdit::PatchScript(Isolate* isolate, Handle<Script> script,
         new_script->shared_function_infos()->Get(
             mapping.second->function_literal_id());
 
-    sfi->set_function_literal_id(mapping.second->function_literal_id());
     sfi->set_script(*new_script);
+    if (sfi->HasUncompiledData()) {
+      sfi->uncompiled_data()->set_function_literal_id(
+          mapping.second->function_literal_id());
+    }
     new_script->shared_function_infos()->Set(
         mapping.second->function_literal_id(), HeapObjectReference::Weak(*sfi));
-    DCHECK_EQ(sfi->function_literal_id(),
+    DCHECK_EQ(sfi->FunctionLiteralId(isolate),
               mapping.second->function_literal_id());
 
     // Swap the now-redundant, newly compiled SFI into the old script, so that
@@ -1076,12 +1079,16 @@ void LiveEdit::PatchScript(Isolate* isolate, Handle<Script> script,
       SharedFunctionInfo* redundant_new_sfi =
           SharedFunctionInfo::cast(redundant_new_sfi_obj);
 
-      redundant_new_sfi->set_function_literal_id(
-          mapping.first->function_literal_id());
       redundant_new_sfi->set_script(*script);
+      if (redundant_new_sfi->HasUncompiledData()) {
+        redundant_new_sfi->uncompiled_data()->set_function_literal_id(
+            mapping.first->function_literal_id());
+      }
       script->shared_function_infos()->Set(
           mapping.first->function_literal_id(),
           HeapObjectReference::Weak(redundant_new_sfi));
+      DCHECK_EQ(redundant_new_sfi->FunctionLiteralId(isolate),
+                mapping.first->function_literal_id());
     }
 
     if (sfi->HasUncompiledDataWithPreParsedScope()) {
@@ -1095,13 +1102,12 @@ void LiveEdit::PatchScript(Isolate* isolate, Handle<Script> script,
     }
 
     if (!sfi->HasBytecodeArray()) continue;
-    Handle<BytecodeArray> bytecode(sfi->GetBytecodeArray(), isolate);
-    Handle<FixedArray> constants(bytecode->constant_pool(), isolate);
+    FixedArray* constants = sfi->GetBytecodeArray()->constant_pool();
     for (int i = 0; i < constants->length(); ++i) {
       if (!constants->get(i)->IsSharedFunctionInfo()) continue;
       FunctionData* data = nullptr;
-      if (!function_data_map.Lookup(SharedFunctionInfo::cast(constants->get(i)),
-                                    &data)) {
+      if (!function_data_map.Lookup(
+              isolate, SharedFunctionInfo::cast(constants->get(i)), &data)) {
         continue;
       }
       auto change_it = changed.find(data->literal);
@@ -1153,7 +1159,7 @@ void LiveEdit::PatchScript(Isolate* isolate, Handle<Script> script,
       // inner_sfi, but the resulting FunctionData will still be referring to
       // the old, unchanged SFI.
       FunctionData* data = nullptr;
-      if (!function_data_map.Lookup(inner_sfi, &data)) continue;
+      if (!function_data_map.Lookup(isolate, inner_sfi, &data)) continue;
       Handle<SharedFunctionInfo> old_unchanged_inner_sfi =
           data->shared.ToHandleChecked();
       // Now some sanity checks. Make sure that this inner_sfi is not the
@@ -1164,17 +1170,21 @@ void LiveEdit::PatchScript(Isolate* isolate, Handle<Script> script,
       DCHECK_EQ(old_unchanged_inner_sfi->script(), *new_script);
       // ... and that the id of the unchanged SFI matches the unchanged target
       // literal's id.
-      DCHECK_EQ(old_unchanged_inner_sfi->function_literal_id(),
+      DCHECK_EQ(old_unchanged_inner_sfi->FunctionLiteralId(isolate),
                 unchanged[data->literal]->function_literal_id());
       constants->set(i, *old_unchanged_inner_sfi);
     }
   }
 #ifdef DEBUG
   {
-    // Check that all the functions in the new script are valid.
+    // Check that all the functions in the new script are valid and that their
+    // function literals match what is expected.
+    DisallowHeapAllocation no_gc;
+
     SharedFunctionInfo::ScriptIterator it(isolate, *new_script);
     while (SharedFunctionInfo* sfi = it.Next()) {
       DCHECK_EQ(sfi->script(), *new_script);
+      DCHECK_EQ(sfi->FunctionLiteralId(isolate), it.CurrentIndex());
 
       if (!sfi->HasBytecodeArray()) continue;
       // Check that all the functions in this function's constant pool are also
@@ -1187,7 +1197,7 @@ void LiveEdit::PatchScript(Isolate* isolate, Handle<Script> script,
             SharedFunctionInfo::cast(constants->get(i));
         DCHECK_EQ(inner_sfi->script(), *new_script);
         DCHECK_EQ(inner_sfi, new_script->shared_function_infos()
-                                 ->Get(inner_sfi->function_literal_id())
+                                 ->Get(inner_sfi->FunctionLiteralId(isolate))
                                  ->GetHeapObject());
       }
     }
diff --git a/deps/v8/src/deoptimizer.h b/deps/v8/src/deoptimizer.h
index 8a24a272c3449f..1f20dbdac1a912 100644
--- a/deps/v8/src/deoptimizer.h
+++ b/deps/v8/src/deoptimizer.h
@@ -11,6 +11,7 @@
 #include "src/allocation.h"
 #include "src/base/macros.h"
 #include "src/boxed-float.h"
+#include "src/code-tracer.h"
 #include "src/deoptimize-reason.h"
 #include "src/feedback-vector.h"
 #include "src/frame-constants.h"
diff --git a/deps/v8/src/elements.cc b/deps/v8/src/elements.cc
index fbe4ad6dcba6ff..9e46d862d8c67d 100644
--- a/deps/v8/src/elements.cc
+++ b/deps/v8/src/elements.cc
@@ -1460,7 +1460,7 @@ class DictionaryElementsAccessor
             if (dict->IsKey(roots, index)) {
               uint32_t number = static_cast<uint32_t>(index->Number());
               if (length <= number && number < old_length) {
-                dict->ClearEntry(entry);
+                dict->ClearEntry(isolate, entry);
                 removed_entries++;
               }
             }
@@ -1571,7 +1571,7 @@ class DictionaryElementsAccessor
     details = PropertyDetails(kData, attributes, PropertyCellType::kNoCell,
                               details.dictionary_index());
 
-    dictionary->DetailsAtPut(entry, details);
+    dictionary->DetailsAtPut(object->GetIsolate(), entry, details);
   }
 
   static void AddImpl(Handle<JSObject> object, uint32_t index,
@@ -1583,8 +1583,8 @@ class DictionaryElementsAccessor
             ? JSObject::NormalizeElements(object)
             : handle(NumberDictionary::cast(object->elements()),
                      object->GetIsolate());
-    Handle<NumberDictionary> new_dictionary =
-        NumberDictionary::Add(dictionary, index, value, details);
+    Handle<NumberDictionary> new_dictionary = NumberDictionary::Add(
+        object->GetIsolate(), dictionary, index, value, details);
     new_dictionary->UpdateMaxNumberKey(index, object);
     if (attributes != NONE) object->RequireSlowElements(*new_dictionary);
     if (dictionary.is_identical_to(new_dictionary)) return;
@@ -1965,7 +1965,8 @@ class FastElementsAccessor : public ElementsAccessorBase<Subclass, KindTraits> {
       }
       max_number_key = i;
       Handle<Object> value = Subclass::GetImpl(isolate, *store, i);
-      dictionary = NumberDictionary::Add(dictionary, i, value, details);
+      dictionary =
+          NumberDictionary::Add(isolate, dictionary, i, value, details);
       j++;
     }
 
@@ -2074,7 +2075,7 @@ class FastElementsAccessor : public ElementsAccessorBase<Subclass, KindTraits> {
                               Handle<Object> value,
                               PropertyAttributes attributes) {
     Handle<NumberDictionary> dictionary = JSObject::NormalizeElements(object);
-    entry = dictionary->FindEntry(entry);
+    entry = dictionary->FindEntry(object->GetIsolate(), entry);
     DictionaryElementsAccessor::ReconfigureImpl(object, dictionary, entry,
                                                 value, attributes);
   }
@@ -2944,7 +2945,7 @@ class TypedElementsAccessor
 
   static Handle<Object> GetImpl(Isolate* isolate, FixedArrayBase* backing_store,
                                 uint32_t entry) {
-    return BackingStore::get(BackingStore::cast(backing_store), entry);
+    return BackingStore::get(isolate, BackingStore::cast(backing_store), entry);
   }
 
   static PropertyDetails GetDetailsImpl(JSObject* holder, uint32_t entry) {
@@ -3506,7 +3507,7 @@ class TypedElementsAccessor
                                            BigInt::FromObject(isolate, elem));
       } else {
         ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, elem,
-                                           Object::ToNumber(elem));
+                                           Object::ToNumber(isolate, elem));
       }
 
       if (V8_UNLIKELY(destination->WasNeutered())) {
@@ -4017,7 +4018,7 @@ class SlowSloppyArgumentsElementsAccessor
             : JSObject::NormalizeElements(object);
     PropertyDetails details(kData, attributes, PropertyCellType::kNoCell);
     Handle<NumberDictionary> new_dictionary =
-        NumberDictionary::Add(dictionary, index, value, details);
+        NumberDictionary::Add(isolate, dictionary, index, value, details);
     if (attributes != NONE) object->RequireSlowElements(*new_dictionary);
     if (*dictionary != *new_dictionary) {
       elements->set_arguments(*new_dictionary);
@@ -4051,7 +4052,8 @@ class SlowSloppyArgumentsElementsAccessor
       PropertyDetails details(kData, attributes, PropertyCellType::kNoCell);
       Handle<NumberDictionary> arguments(
           NumberDictionary::cast(elements->arguments()), isolate);
-      arguments = NumberDictionary::Add(arguments, entry, value, details);
+      arguments =
+          NumberDictionary::Add(isolate, arguments, entry, value, details);
       // If the attributes were NONE, we would have called set rather than
       // reconfigure.
       DCHECK_NE(NONE, attributes);
@@ -4107,7 +4109,8 @@ class FastSloppyArgumentsElementsAccessor
     if (*entry == kMaxUInt32) return dictionary;
     uint32_t length = elements->parameter_map_length();
     if (*entry >= length) {
-      *entry = dictionary->FindEntry(*entry - length) + length;
+      *entry =
+          dictionary->FindEntry(object->GetIsolate(), *entry - length) + length;
     }
     return dictionary;
   }
diff --git a/deps/v8/src/feedback-vector.cc b/deps/v8/src/feedback-vector.cc
index 71ba61565e1a73..ba3b711b1efd55 100644
--- a/deps/v8/src/feedback-vector.cc
+++ b/deps/v8/src/feedback-vector.cc
@@ -295,7 +295,7 @@ void FeedbackVector::AddToVectorsForProfilingTools(
   if (!vector->shared_function_info()->IsSubjectToDebugging()) return;
   Handle<ArrayList> list = Handle<ArrayList>::cast(
       isolate->factory()->feedback_vectors_for_profiling_tools());
-  list = ArrayList::Add(list, vector);
+  list = ArrayList::Add(isolate, list, vector);
   isolate->SetFeedbackVectorsForProfilingTools(*list);
 }
 
@@ -1068,18 +1068,20 @@ void FeedbackNexus::Collect(Handle<String> type, int position) {
 
   Handle<ArrayList> position_specific_types;
 
-  int entry = types->FindEntry(position);
+  int entry = types->FindEntry(isolate, position);
   if (entry == SimpleNumberDictionary::kNotFound) {
     position_specific_types = ArrayList::New(isolate, 1);
     types = SimpleNumberDictionary::Set(
-        types, position, ArrayList::Add(position_specific_types, type));
+        isolate, types, position,
+        ArrayList::Add(isolate, position_specific_types, type));
   } else {
     DCHECK(types->ValueAt(entry)->IsArrayList());
     position_specific_types =
         handle(ArrayList::cast(types->ValueAt(entry)), isolate);
     if (!InList(position_specific_types, type)) {  // Add type
       types = SimpleNumberDictionary::Set(
-          types, position, ArrayList::Add(position_specific_types, type));
+          isolate, types, position,
+          ArrayList::Add(isolate, position_specific_types, type));
     }
   }
   SetFeedback(*types);
@@ -1127,7 +1129,7 @@ std::vector<Handle<String>> FeedbackNexus::GetTypesForSourcePositions(
   Handle<SimpleNumberDictionary> types(
       SimpleNumberDictionary::cast(feedback->ToStrongHeapObject()), isolate);
 
-  int entry = types->FindEntry(position);
+  int entry = types->FindEntry(isolate, position);
   if (entry == SimpleNumberDictionary::kNotFound) {
     return types_for_position;
   }
@@ -1164,7 +1166,7 @@ Handle<JSObject> ConvertToJSObject(Isolate* isolate,
       JSObject::AddDataElement(
           type_profile, position,
           isolate->factory()->NewJSArrayWithElements(
-              ArrayList::Elements(position_specific_types)),
+              ArrayList::Elements(isolate, position_specific_types)),
           PropertyAttributes::NONE);
     }
   }
diff --git a/deps/v8/src/field-type.cc b/deps/v8/src/field-type.cc
index 3b51095323c06b..0542082e5a812c 100644
--- a/deps/v8/src/field-type.cc
+++ b/deps/v8/src/field-type.cc
@@ -49,14 +49,13 @@ FieldType* FieldType::cast(Object* object) {
 
 bool FieldType::IsClass() { return this->IsMap(); }
 
-Handle<i::Map> FieldType::AsClass() {
+Map* FieldType::AsClass() {
   DCHECK(IsClass());
-  i::Map* map = Map::cast(this);
-  return handle(map, map->GetIsolate());
+  return Map::cast(this);
 }
 
 bool FieldType::NowStable() {
-  return !this->IsClass() || this->AsClass()->is_stable();
+  return !this->IsClass() || AsClass()->is_stable();
 }
 
 bool FieldType::NowIs(FieldType* other) {
@@ -78,7 +77,7 @@ void FieldType::PrintTo(std::ostream& os) {
     os << "None";
   } else {
     DCHECK(IsClass());
-    os << "Class(" << static_cast<void*>(*AsClass()) << ")";
+    os << "Class(" << static_cast<void*>(AsClass()) << ")";
   }
 }
 
diff --git a/deps/v8/src/field-type.h b/deps/v8/src/field-type.h
index 8eec7a5b583edb..06d71d53a3957e 100644
--- a/deps/v8/src/field-type.h
+++ b/deps/v8/src/field-type.h
@@ -34,7 +34,7 @@ class FieldType : public Object {
   bool NowContains(Handle<Object> value) { return NowContains(*value); }
 
   bool IsClass();
-  Handle<i::Map> AsClass();
+  Map* AsClass();
   bool IsNone() { return this == None(); }
   bool IsAny() { return this == Any(); }
   bool NowStable();
diff --git a/deps/v8/src/flag-definitions.h b/deps/v8/src/flag-definitions.h
index 501335375932ca..052869f3081ed6 100644
--- a/deps/v8/src/flag-definitions.h
+++ b/deps/v8/src/flag-definitions.h
@@ -162,6 +162,7 @@ struct MaybeBoolFlag {
   FLAG(MAYBE_BOOL, MaybeBoolFlag, nam, {false COMMA false}, cmt)
 #define DEFINE_INT(nam, def, cmt) FLAG(INT, int, nam, def, cmt)
 #define DEFINE_UINT(nam, def, cmt) FLAG(UINT, unsigned int, nam, def, cmt)
+#define DEFINE_UINT64(nam, def, cmt) FLAG(UINT64, uint64_t, nam, def, cmt)
 #define DEFINE_FLOAT(nam, def, cmt) FLAG(FLOAT, double, nam, def, cmt)
 #define DEFINE_SIZE_T(nam, def, cmt) FLAG(SIZE_T, size_t, nam, def, cmt)
 #define DEFINE_STRING(nam, def, cmt) FLAG(STRING, const char*, nam, def, cmt)
@@ -1041,9 +1042,9 @@ DEFINE_BOOL(randomize_hashes, true,
             "(with snapshots this option cannot override the baked-in seed)")
 DEFINE_BOOL(rehash_snapshot, true,
             "rehash strings from the snapshot to override the baked-in seed")
-DEFINE_INT(hash_seed, 0,
-           "Fixed seed to use to hash property keys (0 means random)"
-           "(with snapshots this option cannot override the baked-in seed)")
+DEFINE_UINT64(hash_seed, 0,
+              "Fixed seed to use to hash property keys (0 means random)"
+              "(with snapshots this option cannot override the baked-in seed)")
 DEFINE_INT(random_seed, 0,
            "Default seed for initializing random generator "
            "(0, the default, means to use system random).")
diff --git a/deps/v8/src/flags.cc b/deps/v8/src/flags.cc
index 50ffb3330e5fa0..13046097a6fbe9 100644
--- a/deps/v8/src/flags.cc
+++ b/deps/v8/src/flags.cc
@@ -39,6 +39,7 @@ struct Flag {
     TYPE_MAYBE_BOOL,
     TYPE_INT,
     TYPE_UINT,
+    TYPE_UINT64,
     TYPE_FLOAT,
     TYPE_SIZE_T,
     TYPE_STRING,
@@ -78,6 +79,11 @@ struct Flag {
     return reinterpret_cast<unsigned int*>(valptr_);
   }
 
+  uint64_t* uint64_variable() const {
+    DCHECK(type_ == TYPE_UINT64);
+    return reinterpret_cast<uint64_t*>(valptr_);
+  }
+
   double* float_variable() const {
     DCHECK(type_ == TYPE_FLOAT);
     return reinterpret_cast<double*>(valptr_);
@@ -121,6 +127,11 @@ struct Flag {
     return *reinterpret_cast<const unsigned int*>(defptr_);
   }
 
+  uint64_t uint64_default() const {
+    DCHECK(type_ == TYPE_UINT64);
+    return *reinterpret_cast<const uint64_t*>(defptr_);
+  }
+
   double float_default() const {
     DCHECK(type_ == TYPE_FLOAT);
     return *reinterpret_cast<const double*>(defptr_);
@@ -152,6 +163,8 @@ struct Flag {
         return *int_variable() == int_default();
       case TYPE_UINT:
         return *uint_variable() == uint_default();
+      case TYPE_UINT64:
+        return *uint64_variable() == uint64_default();
       case TYPE_FLOAT:
         return *float_variable() == float_default();
       case TYPE_SIZE_T:
@@ -184,6 +197,9 @@ struct Flag {
       case TYPE_UINT:
         *uint_variable() = uint_default();
         break;
+      case TYPE_UINT64:
+        *uint64_variable() = uint64_default();
+        break;
       case TYPE_FLOAT:
         *float_variable() = float_default();
         break;
@@ -217,6 +233,8 @@ static const char* Type2String(Flag::FlagType type) {
     case Flag::TYPE_INT: return "int";
     case Flag::TYPE_UINT:
       return "uint";
+    case Flag::TYPE_UINT64:
+      return "uint64";
     case Flag::TYPE_FLOAT: return "float";
     case Flag::TYPE_SIZE_T:
       return "size_t";
@@ -243,6 +261,9 @@ std::ostream& operator<<(std::ostream& os, const Flag& flag) {  // NOLINT
     case Flag::TYPE_UINT:
       os << *flag.uint_variable();
       break;
+    case Flag::TYPE_UINT64:
+      os << *flag.uint64_variable();
+      break;
     case Flag::TYPE_FLOAT:
       os << *flag.float_variable();
       break;
@@ -464,6 +485,12 @@ int FlagList::SetFlagsFromCommandLine(int* argc,
             return_code = j;
           }
           break;
+        case Flag::TYPE_UINT64:
+          if (!TryParseUnsigned(flag, arg, value, &endp,
+                                flag->uint64_variable())) {
+            return_code = j;
+          }
+          break;
         case Flag::TYPE_FLOAT:
           *flag->float_variable() = strtod(value, &endp);
           break;
@@ -611,6 +638,7 @@ void FlagList::PrintHelp() {
         "  -e        execute a string in V8\n"
         "  --shell   run an interactive JavaScript shell\n"
         "  --module  execute a file as a JavaScript module\n\n"
+        "Note: the --module option is implicitly enabled for *.mjs files.\n\n"
         "Options:\n";
 
   for (const Flag& f : flags) {
diff --git a/deps/v8/src/frames.cc b/deps/v8/src/frames.cc
index 3c19f867caa625..96930e68543107 100644
--- a/deps/v8/src/frames.cc
+++ b/deps/v8/src/frames.cc
@@ -1772,9 +1772,14 @@ void WasmCompiledFrame::Print(StringStream* accumulator, PrintMode mode,
   int func_name_len = std::min(kMaxPrintedFunctionName, raw_func_name.length());
   memcpy(func_name, raw_func_name.start(), func_name_len);
   func_name[func_name_len] = '\0';
-  accumulator->Add("], function #%u ('%s'), pc=%p (+0x%x), pos=%d\n",
-                   function_index(), func_name, reinterpret_cast<void*>(pc()),
-                   static_cast<int>(pc() - instruction_start), position());
+  int pos = position();
+  const wasm::WasmModule* module = wasm_instance()->module_object()->module();
+  int func_index = function_index();
+  int func_code_offset = module->functions[func_index].code.offset();
+  accumulator->Add("], function #%u ('%s'), pc=%p (+0x%x), pos=%d (+%d)\n",
+                   func_index, func_name, reinterpret_cast<void*>(pc()),
+                   static_cast<int>(pc() - instruction_start), pos,
+                   pos - func_code_offset);
   if (mode != OVERVIEW) accumulator->Add("\n");
 }
 
diff --git a/deps/v8/src/global-handles.cc b/deps/v8/src/global-handles.cc
index 370270748204fe..c7e5e76b348504 100644
--- a/deps/v8/src/global-handles.cc
+++ b/deps/v8/src/global-handles.cc
@@ -562,7 +562,14 @@ Handle<Object> GlobalHandles::Create(Object* value) {
 
 Handle<Object> GlobalHandles::CopyGlobal(Object** location) {
   DCHECK_NOT_NULL(location);
-  return Node::FromLocation(location)->GetGlobalHandles()->Create(*location);
+  GlobalHandles* global_handles =
+      Node::FromLocation(location)->GetGlobalHandles();
+#ifdef VERIFY_HEAP
+  if (i::FLAG_verify_heap) {
+    (*location)->ObjectVerify(global_handles->isolate());
+  }
+#endif  // VERIFY_HEAP
+  return global_handles->Create(*location);
 }
 
 
diff --git a/deps/v8/src/handles-inl.h b/deps/v8/src/handles-inl.h
index 536388476ba668..982f4db10753d0 100644
--- a/deps/v8/src/handles-inl.h
+++ b/deps/v8/src/handles-inl.h
@@ -78,6 +78,10 @@ MaybeObjectHandle MaybeObjectHandle::Weak(Handle<Object> object) {
   return MaybeObjectHandle(object, HeapObjectReferenceType::WEAK);
 }
 
+MaybeObjectHandle MaybeObjectHandle::Weak(Object* object, Isolate* isolate) {
+  return MaybeObjectHandle(object, HeapObjectReferenceType::WEAK, isolate);
+}
+
 MaybeObject* MaybeObjectHandle::operator*() const {
   if (reference_type_ == HeapObjectReferenceType::WEAK) {
     return HeapObjectReference::Weak(*handle_.ToHandleChecked());
diff --git a/deps/v8/src/handles.cc b/deps/v8/src/handles.cc
index cc79ee17ffce5b..ff4a5f88de4154 100644
--- a/deps/v8/src/handles.cc
+++ b/deps/v8/src/handles.cc
@@ -26,7 +26,9 @@ bool HandleBase::IsDereferenceAllowed(DereferenceCheckMode mode) const {
   Object* object = *location_;
   if (object->IsSmi()) return true;
   HeapObject* heap_object = HeapObject::cast(object);
-  Heap* heap = heap_object->GetHeap();
+  MemoryChunk* chunk = MemoryChunk::FromHeapObject(heap_object);
+  if (chunk->owner()->identity() == RO_SPACE) return true;
+  Heap* heap = chunk->heap();
   Object** roots_array_start = heap->roots_array_start();
   if (roots_array_start <= location_ &&
       location_ < roots_array_start + Heap::kStrongRootListLength &&
diff --git a/deps/v8/src/heap/array-buffer-tracker-inl.h b/deps/v8/src/heap/array-buffer-tracker-inl.h
index 7bfdca351f6ea0..697d4405d80044 100644
--- a/deps/v8/src/heap/array-buffer-tracker-inl.h
+++ b/deps/v8/src/heap/array-buffer-tracker-inl.h
@@ -65,9 +65,7 @@ void LocalArrayBufferTracker::Free(Callback should_free) {
     const size_t length = it->second.length;
 
     if (should_free(buffer)) {
-      JSArrayBuffer::FreeBackingStore(
-          isolate, {it->second.backing_store, length, it->second.backing_store,
-                    buffer->is_wasm_memory()});
+      JSArrayBuffer::FreeBackingStore(isolate, it->second);
       it = array_buffers_.erase(it);
       freed_memory += length;
     } else {
@@ -101,7 +99,10 @@ void LocalArrayBufferTracker::Add(JSArrayBuffer* buffer, size_t length) {
   page_->IncrementExternalBackingStoreBytes(
       ExternalBackingStoreType::kArrayBuffer, length);
 
-  auto ret = array_buffers_.insert({buffer, {buffer->backing_store(), length}});
+  auto ret = array_buffers_.insert(
+      {buffer,
+       {buffer->backing_store(), length, buffer->backing_store(),
+        buffer->is_wasm_memory()}});
   USE(ret);
   // Check that we indeed inserted a new value and did not overwrite an existing
   // one (which would be a bug).
diff --git a/deps/v8/src/heap/array-buffer-tracker.cc b/deps/v8/src/heap/array-buffer-tracker.cc
index f2dc085b92d67b..4f92e7e17c1c68 100644
--- a/deps/v8/src/heap/array-buffer-tracker.cc
+++ b/deps/v8/src/heap/array-buffer-tracker.cc
@@ -29,7 +29,7 @@ void LocalArrayBufferTracker::Process(Callback callback) {
   size_t moved_memory = 0;
   for (TrackingData::iterator it = array_buffers_.begin();
        it != array_buffers_.end(); ++it) {
-    old_buffer = reinterpret_cast<JSArrayBuffer*>(it->first);
+    old_buffer = it->first;
     Page* old_page = Page::FromAddress(old_buffer->address());
     const CallbackResult result = callback(old_buffer, &new_buffer);
     if (result == kKeepEntry) {
@@ -48,6 +48,7 @@ void LocalArrayBufferTracker::Process(Callback callback) {
         const size_t size = NumberToSize(new_buffer->byte_length());
         // We should decrement before adding to avoid potential overflows in
         // the external memory counters.
+        DCHECK_EQ(it->first->is_wasm_memory(), it->second.is_wasm_memory);
         old_page->DecrementExternalBackingStoreBytes(
             ExternalBackingStoreType::kArrayBuffer, it->second.length);
         tracker->Add(new_buffer, size);
@@ -59,12 +60,9 @@ void LocalArrayBufferTracker::Process(Callback callback) {
       // We pass backing_store() and stored length to the collector for freeing
       // the backing store. Wasm allocations will go through their own tracker
       // based on the backing store.
-      backing_stores_to_free.emplace_back(
-          it->second.backing_store, it->second.length, it->second.backing_store,
-          old_buffer->is_wasm_memory());
+      backing_stores_to_free.push_back(it->second);
       old_page->DecrementExternalBackingStoreBytes(
           ExternalBackingStoreType::kArrayBuffer, it->second.length);
-
     } else {
       UNREACHABLE();
     }
diff --git a/deps/v8/src/heap/array-buffer-tracker.h b/deps/v8/src/heap/array-buffer-tracker.h
index 40de8d962b153d..347260dde05dd3 100644
--- a/deps/v8/src/heap/array-buffer-tracker.h
+++ b/deps/v8/src/heap/array-buffer-tracker.h
@@ -10,11 +10,11 @@
 #include "src/allocation.h"
 #include "src/base/platform/mutex.h"
 #include "src/globals.h"
+#include "src/objects/js-array.h"
 
 namespace v8 {
 namespace internal {
 
-class JSArrayBuffer;
 class MarkingState;
 class Page;
 class Space;
@@ -105,17 +105,12 @@ class LocalArrayBufferTracker {
     }
   };
 
-  struct BackingStoreAndLength {
-    void* backing_store;
-    size_t length;
-  };
-
   // Keep track of the backing store and the corresponding length at time of
   // registering. The length is accessed from JavaScript and can be a
   // HeapNumber. The reason for tracking the length is that in the case of
   // length being a HeapNumber, the buffer and its length may be stored on
   // different memory pages, making it impossible to guarantee order of freeing.
-  typedef std::unordered_map<JSArrayBuffer*, BackingStoreAndLength, Hasher>
+  typedef std::unordered_map<JSArrayBuffer*, JSArrayBuffer::Allocation, Hasher>
       TrackingData;
 
   inline Space* space();
diff --git a/deps/v8/src/heap/concurrent-marking.cc b/deps/v8/src/heap/concurrent-marking.cc
index 3a1f5456fa5fd8..9e1e9f017caed6 100644
--- a/deps/v8/src/heap/concurrent-marking.cc
+++ b/deps/v8/src/heap/concurrent-marking.cc
@@ -310,7 +310,6 @@ class ConcurrentMarkingVisitor final
       VisitPointer(map, HeapObject::RawMaybeWeakField(
                             map, Map::kTransitionsOrPrototypeInfoOffset));
       VisitPointer(map, HeapObject::RawField(map, Map::kDependentCodeOffset));
-      VisitPointer(map, HeapObject::RawField(map, Map::kWeakCellCacheOffset));
       bailout_.Push(map);
     }
     return 0;
@@ -627,7 +626,7 @@ void ConcurrentMarking::Run(int task_id, TaskState* task_state) {
       marked_bytes += current_marked_bytes;
       base::AsAtomicWord::Relaxed_Store<size_t>(&task_state->marked_bytes,
                                                 marked_bytes);
-      if (task_state->preemption_request.Value()) {
+      if (task_state->preemption_request) {
         TRACE_EVENT0(TRACE_DISABLED_BY_DEFAULT("v8.gc"),
                      "ConcurrentMarking::Run Preempted");
         break;
@@ -703,7 +702,7 @@ void ConcurrentMarking::ScheduleTasks() {
         heap_->isolate()->PrintWithTimestamp(
             "Scheduling concurrent marking task %d\n", i);
       }
-      task_state_[i].preemption_request.SetValue(false);
+      task_state_[i].preemption_request = false;
       is_pending_[i] = true;
       ++pending_task_count_;
       auto task =
@@ -744,7 +743,7 @@ bool ConcurrentMarking::Stop(StopRequest stop_request) {
           is_pending_[i] = false;
           --pending_task_count_;
         } else if (stop_request == StopRequest::PREEMPT_TASKS) {
-          task_state_[i].preemption_request.SetValue(true);
+          task_state_[i].preemption_request = true;
         }
       }
     }
diff --git a/deps/v8/src/heap/concurrent-marking.h b/deps/v8/src/heap/concurrent-marking.h
index a99fb706cc3a22..0b8ffd933672e7 100644
--- a/deps/v8/src/heap/concurrent-marking.h
+++ b/deps/v8/src/heap/concurrent-marking.h
@@ -95,7 +95,7 @@ class ConcurrentMarking {
   struct TaskState {
     // The main thread sets this flag to true when it wants the concurrent
     // marker to give up the worker thread.
-    base::AtomicValue<bool> preemption_request;
+    std::atomic<bool> preemption_request;
 
     LiveBytesMap live_bytes;
     size_t marked_bytes = 0;
diff --git a/deps/v8/src/heap/factory.cc b/deps/v8/src/heap/factory.cc
index 6dc112478be8a7..bbbf2f0b47e506 100644
--- a/deps/v8/src/heap/factory.cc
+++ b/deps/v8/src/heap/factory.cc
@@ -205,7 +205,7 @@ Handle<HeapObject> Factory::NewFillerObject(int size, bool double_align,
 Handle<PrototypeInfo> Factory::NewPrototypeInfo() {
   Handle<PrototypeInfo> result =
       Handle<PrototypeInfo>::cast(NewStruct(PROTOTYPE_INFO_TYPE, TENURED));
-  result->set_prototype_users(FixedArrayOfWeakCells::Empty());
+  result->set_prototype_users(*empty_weak_array_list());
   result->set_registry_slot(PrototypeInfo::UNREGISTERED);
   result->set_bit_field(0);
   return result;
@@ -926,7 +926,7 @@ Handle<StringClass> Factory::InternalizeExternalString(Handle<String> string) {
                                       isolate());
   external_string->set_length(cast_string->length());
   external_string->set_hash_field(cast_string->hash_field());
-  external_string->SetResource(nullptr);
+  external_string->set_resource(nullptr);
   isolate()->heap()->RegisterExternalString(*external_string);
   return external_string;
 }
@@ -1250,7 +1250,7 @@ MaybeHandle<String> Factory::NewExternalStringFromOneByte(
       ExternalOneByteString::cast(New(map, TENURED)), isolate());
   external_string->set_length(static_cast<int>(length));
   external_string->set_hash_field(String::kEmptyHashField);
-  external_string->SetResource(resource);
+  external_string->set_resource(resource);
   isolate()->heap()->RegisterExternalString(*external_string);
 
   return external_string;
@@ -1283,7 +1283,7 @@ MaybeHandle<String> Factory::NewExternalStringFromTwoByte(
       ExternalTwoByteString::cast(New(map, TENURED)), isolate());
   external_string->set_length(static_cast<int>(length));
   external_string->set_hash_field(String::kEmptyHashField);
-  external_string->SetResource(resource);
+  external_string->set_resource(resource);
   isolate()->heap()->RegisterExternalString(*external_string);
 
   return external_string;
@@ -1299,7 +1299,7 @@ Handle<ExternalOneByteString> Factory::NewNativeSourceString(
       ExternalOneByteString::cast(New(map, TENURED)), isolate());
   external_string->set_length(static_cast<int>(length));
   external_string->set_hash_field(String::kEmptyHashField);
-  external_string->SetResource(resource);
+  external_string->set_resource(resource);
   isolate()->heap()->RegisterExternalString(*external_string);
 
   return external_string;
@@ -1852,7 +1852,6 @@ Map* Factory::InitializeMap(Map* map, InstanceType type, int instance_size,
   }
   map->set_dependent_code(DependentCode::cast(*empty_fixed_array()),
                           SKIP_WRITE_BARRIER);
-  map->set_weak_cell_cache(Smi::kZero);
   map->set_raw_transitions(MaybeObject::FromSmi(Smi::kZero));
   map->SetInObjectUnusedPropertyFields(inobject_properties);
   map->set_instance_descriptors(*empty_descriptor_array());
@@ -2514,19 +2513,23 @@ Handle<PreParsedScopeData> Factory::NewPreParsedScopeData(int length) {
 
 Handle<UncompiledDataWithoutPreParsedScope>
 Factory::NewUncompiledDataWithoutPreParsedScope(int32_t start_position,
-                                                int32_t end_position) {
+                                                int32_t end_position,
+                                                int32_t function_literal_id) {
   Handle<UncompiledDataWithoutPreParsedScope> result(
       UncompiledDataWithoutPreParsedScope::cast(
           New(uncompiled_data_without_pre_parsed_scope_map(), TENURED)),
       isolate());
   result->set_start_position(start_position);
   result->set_end_position(end_position);
+  result->set_function_literal_id(function_literal_id);
+
+  result->clear_padding();
   return result;
 }
 
 Handle<UncompiledDataWithPreParsedScope>
 Factory::NewUncompiledDataWithPreParsedScope(
-    int32_t start_position, int32_t end_position,
+    int32_t start_position, int32_t end_position, int32_t function_literal_id,
     Handle<PreParsedScopeData> pre_parsed_scope_data) {
   Handle<UncompiledDataWithPreParsedScope> result(
       UncompiledDataWithPreParsedScope::cast(
@@ -2534,7 +2537,10 @@ Factory::NewUncompiledDataWithPreParsedScope(
       isolate());
   result->set_start_position(start_position);
   result->set_end_position(end_position);
+  result->set_function_literal_id(function_literal_id);
   result->set_pre_parsed_scope_data(*pre_parsed_scope_data);
+
+  result->clear_padding();
   return result;
 }
 
@@ -2812,7 +2818,7 @@ Handle<JSGlobalObject> Factory::NewJSGlobalObject(
     Handle<PropertyCell> cell = NewPropertyCell(name);
     cell->set_value(descs->GetStrongValue(i));
     // |dictionary| already contains enough space for all properties.
-    USE(GlobalDictionary::Add(dictionary, name, cell, d));
+    USE(GlobalDictionary::Add(isolate(), dictionary, name, cell, d));
   }
 
   // Allocate the global object and initialize it with the backing store.
@@ -3392,7 +3398,7 @@ void Factory::ReinitializeJSGlobalProxy(Handle<JSGlobalProxy> object,
     map->set_is_prototype_map(true);
   }
   JSObject::NotifyMapChange(old_map, map, isolate());
-  old_map->NotifyLeafMapLayoutChange();
+  old_map->NotifyLeafMapLayoutChange(isolate());
 
   // Check that the already allocated object has the same size and type as
   // objects allocated using the constructor.
@@ -3416,7 +3422,8 @@ Handle<SharedFunctionInfo> Factory::NewSharedFunctionInfoForLiteral(
   Handle<SharedFunctionInfo> shared = NewSharedFunctionInfoForBuiltin(
       literal->name(), Builtins::kCompileLazy, kind);
   SharedFunctionInfo::InitFromFunctionLiteral(shared, literal, is_toplevel);
-  SharedFunctionInfo::SetScript(shared, script, false);
+  SharedFunctionInfo::SetScript(shared, script, literal->function_literal_id(),
+                                false);
   return shared;
 }
 
@@ -3504,7 +3511,6 @@ Handle<SharedFunctionInfo> Factory::NewSharedFunctionInfo(
     share->set_script(*undefined_value(), SKIP_WRITE_BARRIER);
     share->set_function_identifier_or_debug_info(*undefined_value(),
                                                  SKIP_WRITE_BARRIER);
-    share->set_function_literal_id(FunctionLiteral::kIdTypeInvalid);
 #if V8_SFI_HAS_UNIQUE_ID
     share->set_unique_id(isolate()->GetNextUniqueSharedFunctionInfoId());
 #endif
@@ -3690,10 +3696,12 @@ Handle<JSObject> Factory::NewArgumentsObject(Handle<JSFunction> callee,
   DCHECK(!isolate()->has_pending_exception());
   Handle<JSObject> result = NewJSObjectFromMap(map);
   Handle<Smi> value(Smi::FromInt(length), isolate());
-  Object::SetProperty(result, length_string(), value, LanguageMode::kStrict)
+  Object::SetProperty(isolate(), result, length_string(), value,
+                      LanguageMode::kStrict)
       .Assert();
   if (!strict_mode_callee) {
-    Object::SetProperty(result, callee_string(), callee, LanguageMode::kStrict)
+    Object::SetProperty(isolate(), result, callee_string(), callee,
+                        LanguageMode::kStrict)
         .Assert();
   }
   return result;
@@ -3902,8 +3910,8 @@ Handle<Map> Factory::CreateSloppyFunctionMap(
   if (IsFunctionModeWithName(function_mode)) {
     // Add name field.
     Handle<Name> name = isolate()->factory()->name_string();
-    Descriptor d = Descriptor::DataField(name, field_index++, roc_attribs,
-                                         Representation::Tagged());
+    Descriptor d = Descriptor::DataField(isolate(), name, field_index++,
+                                         roc_attribs, Representation::Tagged());
     map->AppendDescriptor(&d);
 
   } else {
@@ -3978,8 +3986,8 @@ Handle<Map> Factory::CreateStrictFunctionMap(
   if (IsFunctionModeWithName(function_mode)) {
     // Add name field.
     Handle<Name> name = isolate()->factory()->name_string();
-    Descriptor d = Descriptor::DataField(name, field_index++, roc_attribs,
-                                         Representation::Tagged());
+    Descriptor d = Descriptor::DataField(isolate(), name, field_index++,
+                                         roc_attribs, Representation::Tagged());
     map->AppendDescriptor(&d);
 
   } else {
@@ -3993,8 +4001,8 @@ Handle<Map> Factory::CreateStrictFunctionMap(
   if (IsFunctionModeWithHomeObject(function_mode)) {
     // Add home object field.
     Handle<Name> name = isolate()->factory()->home_object_symbol();
-    Descriptor d = Descriptor::DataField(name, field_index++, DONT_ENUM,
-                                         Representation::Tagged());
+    Descriptor d = Descriptor::DataField(isolate(), name, field_index++,
+                                         DONT_ENUM, Representation::Tagged());
     map->AppendDescriptor(&d);
   }
 
diff --git a/deps/v8/src/heap/factory.h b/deps/v8/src/heap/factory.h
index 21e3036c8ffebf..511a61db06d5d2 100644
--- a/deps/v8/src/heap/factory.h
+++ b/deps/v8/src/heap/factory.h
@@ -39,6 +39,7 @@ class Isolate;
 class JSMap;
 class JSMapIterator;
 class JSModuleNamespace;
+class JSProxy;
 class JSSet;
 class JSSetIterator;
 class JSWeakMap;
@@ -728,10 +729,12 @@ class V8_EXPORT_PRIVATE Factory {
 
   Handle<UncompiledDataWithoutPreParsedScope>
   NewUncompiledDataWithoutPreParsedScope(int32_t start_position,
-                                         int32_t end_position);
+                                         int32_t end_position,
+                                         int32_t function_literal_id);
 
   Handle<UncompiledDataWithPreParsedScope> NewUncompiledDataWithPreParsedScope(
-      int32_t start_position, int32_t end_position, Handle<PreParsedScopeData>);
+      int32_t start_position, int32_t end_position, int32_t function_literal_id,
+      Handle<PreParsedScopeData>);
 
   // Create an External object for V8's external API.
   Handle<JSObject> NewExternal(void* value);
diff --git a/deps/v8/src/heap/gc-tracer.cc b/deps/v8/src/heap/gc-tracer.cc
index 5ddb2b023700bc..60a3b256c8aad0 100644
--- a/deps/v8/src/heap/gc-tracer.cc
+++ b/deps/v8/src/heap/gc-tracer.cc
@@ -253,9 +253,6 @@ void GCTracer::Start(GarbageCollector collector,
     current_.scopes[i] = 0;
   }
 
-  size_t committed_memory = heap_->CommittedMemory() / KB;
-  size_t used_memory = current_.start_object_size / KB;
-
   Counters* counters = heap_->isolate()->counters();
 
   if (Heap::IsYoungGenerationCollector(collector)) {
@@ -263,9 +260,6 @@ void GCTracer::Start(GarbageCollector collector,
   } else {
     counters->mark_compact_reason()->AddSample(static_cast<int>(gc_reason));
   }
-  counters->aggregated_memory_heap_committed()->AddSample(start_time,
-                                                          committed_memory);
-  counters->aggregated_memory_heap_used()->AddSample(start_time, used_memory);
 }
 
 void GCTracer::ResetIncrementalMarkingCounters() {
@@ -283,9 +277,11 @@ void GCTracer::ResetIncrementalMarkingCounters() {
 void GCTracer::Stop(GarbageCollector collector) {
   start_counter_--;
   if (start_counter_ != 0) {
-    heap_->isolate()->PrintWithTimestamp("[Finished reentrant %s during %s.]\n",
-                                         Heap::CollectorName(collector),
-                                         current_.TypeName(false));
+    if (FLAG_trace_gc_verbose) {
+      heap_->isolate()->PrintWithTimestamp(
+          "[Finished reentrant %s during %s.]\n",
+          Heap::CollectorName(collector), current_.TypeName(false));
+    }
     return;
   }
 
@@ -305,13 +301,6 @@ void GCTracer::Stop(GarbageCollector collector) {
 
   AddAllocation(current_.end_time);
 
-  size_t committed_memory = heap_->CommittedMemory() / KB;
-  size_t used_memory = current_.end_object_size / KB;
-  heap_->isolate()->counters()->aggregated_memory_heap_committed()->AddSample(
-      current_.end_time, committed_memory);
-  heap_->isolate()->counters()->aggregated_memory_heap_used()->AddSample(
-      current_.end_time, used_memory);
-
   double duration = current_.end_time - current_.start_time;
 
   switch (current_.type) {
diff --git a/deps/v8/src/heap/heap-inl.h b/deps/v8/src/heap/heap-inl.h
index 75be7b784dbeb0..5ad1a1bdd6e983 100644
--- a/deps/v8/src/heap/heap-inl.h
+++ b/deps/v8/src/heap/heap-inl.h
@@ -279,33 +279,12 @@ void Heap::UpdateAllocationsHash(uint32_t value) {
 
 
 void Heap::RegisterExternalString(String* string) {
-  DCHECK(string->IsExternalString());
-  DCHECK(!string->IsThinString());
   external_string_table_.AddString(string);
 }
 
-void Heap::UpdateExternalString(String* string, size_t old_payload,
-                                size_t new_payload) {
-  DCHECK(string->IsExternalString());
-  Page* page = Page::FromHeapObject(string);
-
-  if (old_payload > new_payload)
-    page->DecrementExternalBackingStoreBytes(
-        ExternalBackingStoreType::kExternalString, old_payload - new_payload);
-  else
-    page->IncrementExternalBackingStoreBytes(
-        ExternalBackingStoreType::kExternalString, new_payload - old_payload);
-}
 
 void Heap::FinalizeExternalString(String* string) {
   DCHECK(string->IsExternalString());
-  Page* page = Page::FromHeapObject(string);
-  ExternalString* ext_string = ExternalString::cast(string);
-
-  page->DecrementExternalBackingStoreBytes(
-      ExternalBackingStoreType::kExternalString,
-      ext_string->ExternalPayloadSize());
-
   v8::String::ExternalStringResourceBase** resource_addr =
       reinterpret_cast<v8::String::ExternalStringResourceBase**>(
           reinterpret_cast<byte*>(string) + ExternalString::kResourceOffset -
@@ -563,13 +542,13 @@ Oddball* Heap::ToBoolean(bool condition) {
   return condition ? roots.true_value() : roots.false_value();
 }
 
-uint32_t Heap::HashSeed() {
-  uint32_t seed = static_cast<uint32_t>(hash_seed()->value());
+uint64_t Heap::HashSeed() {
+  uint64_t seed;
+  hash_seed()->copy_out(0, reinterpret_cast<byte*>(&seed), kInt64Size);
   DCHECK(FLAG_randomize_hashes || seed == 0);
   return seed;
 }
 
-
 int Heap::NextScriptId() {
   int last_id = last_script_id()->value();
   if (last_id == Smi::kMaxValue) last_id = v8::UnboundScript::kNoScriptId;
diff --git a/deps/v8/src/heap/heap.cc b/deps/v8/src/heap/heap.cc
index b3dc3f8c665184..9a0a826c85f5a9 100644
--- a/deps/v8/src/heap/heap.cc
+++ b/deps/v8/src/heap/heap.cc
@@ -1425,7 +1425,7 @@ bool Heap::CollectGarbage(AllocationSpace space,
       if (deserialization_complete_) {
         memory_reducer_->NotifyMarkCompact(event);
       }
-      memory_pressure_level_.SetValue(MemoryPressureLevel::kNone);
+      memory_pressure_level_ = MemoryPressureLevel::kNone;
     }
 
     tracer()->Stop(collector);
@@ -2297,15 +2297,6 @@ void Heap::ProtectUnprotectedMemoryChunks() {
   unprotected_memory_chunks_.clear();
 }
 
-void Heap::ProcessMovedExternalString(Page* old_page, Page* new_page,
-                                      ExternalString* string) {
-  size_t size = string->ExternalPayloadSize();
-  old_page->DecrementExternalBackingStoreBytes(
-      ExternalBackingStoreType::kExternalString, size);
-  new_page->IncrementExternalBackingStoreBytes(
-      ExternalBackingStoreType::kExternalString, size);
-}
-
 String* Heap::UpdateNewSpaceReferenceInExternalStringTableEntry(Heap* heap,
                                                                 Object** p) {
   MapWord first_word = HeapObject::cast(*p)->map_word();
@@ -2323,53 +2314,24 @@ String* Heap::UpdateNewSpaceReferenceInExternalStringTableEntry(Heap* heap,
   }
 
   // String is still reachable.
-  String* new_string = String::cast(first_word.ToForwardingAddress());
-  if (new_string->IsThinString()) {
-    // Filtering Thin strings out of the external string table.
-    return nullptr;
-  } else if (new_string->IsExternalString()) {
-    heap->ProcessMovedExternalString(
-        Page::FromAddress(reinterpret_cast<Address>(*p)),
-        Page::FromHeapObject(new_string), ExternalString::cast(new_string));
-    return new_string;
-  }
-
+  String* string = String::cast(first_word.ToForwardingAddress());
+  if (string->IsThinString()) string = ThinString::cast(string)->actual();
   // Internalization can replace external strings with non-external strings.
-  return new_string->IsExternalString() ? new_string : nullptr;
+  return string->IsExternalString() ? string : nullptr;
 }
 
 void Heap::ExternalStringTable::Verify() {
 #ifdef DEBUG
-  std::set<String*> visited_map;
-  std::map<MemoryChunk*, size_t> size_map;
-  ExternalBackingStoreType type = ExternalBackingStoreType::kExternalString;
   for (size_t i = 0; i < new_space_strings_.size(); ++i) {
-    String* obj = String::cast(new_space_strings_[i]);
-    MemoryChunk* mc = MemoryChunk::FromHeapObject(obj);
-    DCHECK(mc->InNewSpace());
-    DCHECK(heap_->InNewSpace(obj));
+    Object* obj = Object::cast(new_space_strings_[i]);
+    DCHECK(InNewSpace(obj));
     DCHECK(!obj->IsTheHole(heap_->isolate()));
-    DCHECK(obj->IsExternalString());
-    // Note: we can have repeated elements in the table.
-    DCHECK_EQ(0, visited_map.count(obj));
-    visited_map.insert(obj);
-    size_map[mc] += ExternalString::cast(obj)->ExternalPayloadSize();
   }
   for (size_t i = 0; i < old_space_strings_.size(); ++i) {
-    String* obj = String::cast(old_space_strings_[i]);
-    MemoryChunk* mc = MemoryChunk::FromHeapObject(obj);
-    DCHECK(!mc->InNewSpace());
-    DCHECK(!heap_->InNewSpace(obj));
+    Object* obj = Object::cast(old_space_strings_[i]);
+    DCHECK(!InNewSpace(obj));
     DCHECK(!obj->IsTheHole(heap_->isolate()));
-    DCHECK(obj->IsExternalString());
-    // Note: we can have repeated elements in the table.
-    DCHECK_EQ(0, visited_map.count(obj));
-    visited_map.insert(obj);
-    size_map[mc] += ExternalString::cast(obj)->ExternalPayloadSize();
-  }
-  for (std::map<MemoryChunk*, size_t>::iterator it = size_map.begin();
-       it != size_map.end(); it++)
-    DCHECK_EQ(it->first->ExternalBackingStoreBytes(type), it->second);
+  }
 #endif
 }
 
@@ -3427,16 +3389,6 @@ void Heap::IdleNotificationEpilogue(GCIdleTimeAction action,
 
   contexts_disposed_ = 0;
 
-  if (deadline_in_ms - start_ms >
-      GCIdleTimeHandler::kMaxFrameRenderingIdleTime) {
-    int committed_memory = static_cast<int>(CommittedMemory() / KB);
-    int used_memory = static_cast<int>(heap_state.size_of_objects / KB);
-    isolate()->counters()->aggregated_memory_heap_committed()->AddSample(
-        start_ms, committed_memory);
-    isolate()->counters()->aggregated_memory_heap_used()->AddSample(
-        start_ms, used_memory);
-  }
-
   if ((FLAG_trace_idle_notification && action.type > DO_NOTHING) ||
       FLAG_trace_idle_notification_verbose) {
     isolate_->PrintWithTimestamp(
@@ -3522,9 +3474,9 @@ void Heap::CheckMemoryPressure() {
     // The optimizing compiler may be unnecessarily holding on to memory.
     isolate()->AbortConcurrentOptimization(BlockingBehavior::kDontBlock);
   }
-  if (memory_pressure_level_.Value() == MemoryPressureLevel::kCritical) {
+  if (memory_pressure_level_ == MemoryPressureLevel::kCritical) {
     CollectGarbageOnMemoryPressure();
-  } else if (memory_pressure_level_.Value() == MemoryPressureLevel::kModerate) {
+  } else if (memory_pressure_level_ == MemoryPressureLevel::kModerate) {
     if (FLAG_incremental_marking && incremental_marking()->IsStopped()) {
       StartIncrementalMarking(kReduceMemoryFootprintMask,
                               GarbageCollectionReason::kMemoryPressure);
@@ -3576,8 +3528,8 @@ void Heap::CollectGarbageOnMemoryPressure() {
 
 void Heap::MemoryPressureNotification(MemoryPressureLevel level,
                                       bool is_isolate_locked) {
-  MemoryPressureLevel previous = memory_pressure_level_.Value();
-  memory_pressure_level_.SetValue(level);
+  MemoryPressureLevel previous = memory_pressure_level_;
+  memory_pressure_level_ = level;
   if ((previous != MemoryPressureLevel::kCritical &&
        level == MemoryPressureLevel::kCritical) ||
       (previous == MemoryPressureLevel::kNone &&
@@ -4704,10 +4656,6 @@ void Heap::SetUp() {
   space_[LO_SPACE] = lo_space_ = new LargeObjectSpace(this);
   space_[NEW_LO_SPACE] = new_lo_space_ = new NewLargeObjectSpace(this);
 
-  // Set up the seed that is used to randomize the string hash function.
-  DCHECK_EQ(Smi::kZero, hash_seed());
-  if (FLAG_randomize_hashes) InitializeHashSeed();
-
   for (int i = 0; i < static_cast<int>(v8::Isolate::kUseCounterFeatureCount);
        i++) {
     deferred_counters_[i] = 0;
@@ -4765,12 +4713,14 @@ void Heap::SetUp() {
 }
 
 void Heap::InitializeHashSeed() {
+  uint64_t new_hash_seed;
   if (FLAG_hash_seed == 0) {
-    int rnd = isolate()->random_number_generator()->NextInt();
-    set_hash_seed(Smi::FromInt(rnd & Name::kHashBitMask));
+    int64_t rnd = isolate()->random_number_generator()->NextInt64();
+    new_hash_seed = static_cast<uint64_t>(rnd);
   } else {
-    set_hash_seed(Smi::FromInt(FLAG_hash_seed));
+    new_hash_seed = static_cast<uint64_t>(FLAG_hash_seed);
   }
+  hash_seed()->copy_in(0, reinterpret_cast<byte*>(&new_hash_seed), kInt64Size);
 }
 
 void Heap::SetStackLimits() {
@@ -5060,19 +5010,28 @@ void CompactFixedArrayOfWeakCells(Isolate* isolate, Object* object) {
 }  // anonymous namespace
 
 void Heap::CompactFixedArraysOfWeakCells() {
-  // Find known FixedArrayOfWeakCells and compact them.
-  HeapIterator iterator(this);
-  for (HeapObject* o = iterator.next(); o != nullptr; o = iterator.next()) {
-    if (o->IsPrototypeInfo()) {
-      Object* prototype_users = PrototypeInfo::cast(o)->prototype_users();
-      if (prototype_users->IsFixedArrayOfWeakCells()) {
-        FixedArrayOfWeakCells* array =
-            FixedArrayOfWeakCells::cast(prototype_users);
-        array->Compact<JSObject::PrototypeRegistryCompactionCallback>(
-            isolate());
+  // Find known PrototypeUsers and compact them.
+  std::vector<Handle<PrototypeInfo>> prototype_infos;
+  {
+    HeapIterator iterator(this);
+    for (HeapObject* o = iterator.next(); o != nullptr; o = iterator.next()) {
+      if (o->IsPrototypeInfo()) {
+        PrototypeInfo* prototype_info = PrototypeInfo::cast(o);
+        if (prototype_info->prototype_users()->IsWeakArrayList()) {
+          prototype_infos.emplace_back(handle(prototype_info, isolate()));
+        }
       }
     }
   }
+  for (auto& prototype_info : prototype_infos) {
+    Handle<WeakArrayList> array(
+        WeakArrayList::cast(prototype_info->prototype_users()), isolate());
+    WeakArrayList* new_array = PrototypeUsers::Compact(
+        array, this, JSObject::PrototypeRegistryCompactionCallback);
+    prototype_info->set_prototype_users(new_array);
+  }
+
+  // Find known FixedArrayOfWeakCells and compact them.
   CompactFixedArrayOfWeakCells(isolate(), noscript_shared_function_infos());
   CompactFixedArrayOfWeakCells(isolate(), script_list());
   CompactFixedArrayOfWeakCells(isolate(), weak_stack_trace_list());
@@ -5086,9 +5045,10 @@ void Heap::AddRetainedMap(Handle<Map> map) {
   if (array->IsFull()) {
     CompactRetainedMaps(*array);
   }
-  array = WeakArrayList::AddToEnd(array, MaybeObjectHandle::Weak(map));
+  array =
+      WeakArrayList::AddToEnd(isolate(), array, MaybeObjectHandle::Weak(map));
   array = WeakArrayList::AddToEnd(
-      array,
+      isolate(), array,
       MaybeObjectHandle(Smi::FromInt(FLAG_retain_maps_for_n_gc), isolate()));
   if (*array != retained_maps()) {
     set_retained_maps(*array);
@@ -5486,15 +5446,19 @@ void Heap::ExternalStringTable::CleanUpAll() {
 void Heap::ExternalStringTable::TearDown() {
   for (size_t i = 0; i < new_space_strings_.size(); ++i) {
     Object* o = new_space_strings_[i];
-    // Dont finalize thin strings.
-    if (o->IsThinString()) continue;
+    if (o->IsThinString()) {
+      o = ThinString::cast(o)->actual();
+      if (!o->IsExternalString()) continue;
+    }
     heap_->FinalizeExternalString(ExternalString::cast(o));
   }
   new_space_strings_.clear();
   for (size_t i = 0; i < old_space_strings_.size(); ++i) {
     Object* o = old_space_strings_[i];
-    // Dont finalize thin strings.
-    if (o->IsThinString()) continue;
+    if (o->IsThinString()) {
+      o = ThinString::cast(o)->actual();
+      if (!o->IsExternalString()) continue;
+    }
     heap_->FinalizeExternalString(ExternalString::cast(o));
   }
   old_space_strings_.clear();
diff --git a/deps/v8/src/heap/heap.h b/deps/v8/src/heap/heap.h
index be97ad1b6c31eb..0f3c9ea3899667 100644
--- a/deps/v8/src/heap/heap.h
+++ b/deps/v8/src/heap/heap.h
@@ -47,7 +47,7 @@ class DeoptimizationData;
 class HandlerTable;
 class IncrementalMarking;
 class JSArrayBuffer;
-class ExternalString;
+
 using v8::MemoryPressureLevel;
 
 // Heap roots that are known to be immortal immovable, for which we can safely
@@ -652,7 +652,7 @@ class Heap {
 
   void IncrementDeferredCount(v8::Isolate::UseCounterFeature feature);
 
-  inline uint32_t HashSeed();
+  inline uint64_t HashSeed();
 
   inline int NextScriptId();
   inline int NextDebuggingId();
@@ -678,9 +678,6 @@ class Heap {
     external_memory_concurrently_freed_ = 0;
   }
 
-  void ProcessMovedExternalString(Page* old_page, Page* new_page,
-                                  ExternalString* string);
-
   void CompactFixedArraysOfWeakCells();
 
   void AddRetainedMap(Handle<Map> map);
@@ -707,7 +704,7 @@ class Heap {
   bool ShouldOptimizeForMemoryUsage();
 
   bool HighMemoryPressure() {
-    return memory_pressure_level_.Value() != MemoryPressureLevel::kNone;
+    return memory_pressure_level_ != MemoryPressureLevel::kNone;
   }
 
   void RestoreHeapLimit(size_t heap_limit) {
@@ -1092,11 +1089,6 @@ class Heap {
   // Registers an external string.
   inline void RegisterExternalString(String* string);
 
-  // Called when a string's resource is changed. The size of the payload is sent
-  // as argument of the method.
-  inline void UpdateExternalString(String* string, size_t old_payload,
-                                   size_t new_payload);
-
   // Finalizes an external string by deleting the associated external
   // data and clearing the resource pointer.
   inline void FinalizeExternalString(String* string);
@@ -2013,7 +2005,7 @@ class Heap {
 
   // Stores the memory pressure level that set by MemoryPressureNotification
   // and reset by a mark-compact garbage collection.
-  base::AtomicValue<MemoryPressureLevel> memory_pressure_level_;
+  std::atomic<MemoryPressureLevel> memory_pressure_level_;
 
   std::vector<std::pair<v8::NearHeapLimitCallback, void*> >
       near_heap_limit_callbacks_;
diff --git a/deps/v8/src/heap/item-parallel-job.h b/deps/v8/src/heap/item-parallel-job.h
index 51e0afd4018779..1ad9d22fa4e0f3 100644
--- a/deps/v8/src/heap/item-parallel-job.h
+++ b/deps/v8/src/heap/item-parallel-job.h
@@ -49,17 +49,18 @@ class V8_EXPORT_PRIVATE ItemParallelJob {
     virtual ~Item() = default;
 
     // Marks an item as being finished.
-    void MarkFinished() { CHECK(state_.TrySetValue(kProcessing, kFinished)); }
+    void MarkFinished() { CHECK_EQ(kProcessing, state_.exchange(kFinished)); }
 
    private:
-    enum ProcessingState { kAvailable, kProcessing, kFinished };
+    enum ProcessingState : uintptr_t { kAvailable, kProcessing, kFinished };
 
     bool TryMarkingAsProcessing() {
-      return state_.TrySetValue(kAvailable, kProcessing);
+      ProcessingState available = kAvailable;
+      return state_.compare_exchange_strong(available, kProcessing);
     }
-    bool IsFinished() { return state_.Value() == kFinished; }
+    bool IsFinished() { return state_ == kFinished; }
 
-    base::AtomicValue<ProcessingState> state_{kAvailable};
+    std::atomic<ProcessingState> state_{kAvailable};
 
     friend class ItemParallelJob;
     friend class ItemParallelJob::Task;
diff --git a/deps/v8/src/heap/mark-compact.cc b/deps/v8/src/heap/mark-compact.cc
index 87ab7668ec3df6..6bc01238b8ab78 100644
--- a/deps/v8/src/heap/mark-compact.cc
+++ b/deps/v8/src/heap/mark-compact.cc
@@ -2301,14 +2301,7 @@ static String* UpdateReferenceInExternalStringTableEntry(Heap* heap,
   MapWord map_word = HeapObject::cast(*p)->map_word();
 
   if (map_word.IsForwardingAddress()) {
-    String* new_string = String::cast(map_word.ToForwardingAddress());
-
-    if (new_string->IsExternalString()) {
-      heap->ProcessMovedExternalString(
-          Page::FromAddress(reinterpret_cast<Address>(*p)),
-          Page::FromHeapObject(new_string), ExternalString::cast(new_string));
-    }
-    return new_string;
+    return String::cast(map_word.ToForwardingAddress());
   }
 
   return String::cast(*p);
@@ -3386,7 +3379,7 @@ void MarkCompactCollector::StartSweepSpace(PagedSpace* space) {
       // that this adds unusable memory into the free list that is later on
       // (in the free list) dropped again. Since we only use the flag for
       // testing this is fine.
-      p->concurrent_sweeping_state().SetValue(Page::kSweepingInProgress);
+      p->set_concurrent_sweeping_state(Page::kSweepingInProgress);
       sweeper()->RawSweep(p, Sweeper::IGNORE_FREE_LIST,
                           Heap::ShouldZapGarbage()
                               ? FreeSpaceTreatmentMode::ZAP_FREE_SPACE
diff --git a/deps/v8/src/heap/object-stats.cc b/deps/v8/src/heap/object-stats.cc
index 6c15fba55c7aa8..6c7a26b672b2b0 100644
--- a/deps/v8/src/heap/object-stats.cc
+++ b/deps/v8/src/heap/object-stats.cc
@@ -762,8 +762,8 @@ void ObjectStatsCollectorImpl::RecordVirtualMapDetails(Map* map) {
     if (map->prototype_info()->IsPrototypeInfo()) {
       PrototypeInfo* info = PrototypeInfo::cast(map->prototype_info());
       Object* users = info->prototype_users();
-      if (users->IsFixedArrayOfWeakCells()) {
-        RecordSimpleVirtualObjectStats(map, FixedArrayOfWeakCells::cast(users),
+      if (users->IsWeakFixedArray()) {
+        RecordSimpleVirtualObjectStats(map, WeakArrayList::cast(users),
                                        ObjectStats::PROTOTYPE_USERS_TYPE);
       }
     }
diff --git a/deps/v8/src/heap/setup-heap-internal.cc b/deps/v8/src/heap/setup-heap-internal.cc
index 58f7ba435ad0a1..b987506a10fcf3 100644
--- a/deps/v8/src/heap/setup-heap-internal.cc
+++ b/deps/v8/src/heap/setup-heap-internal.cc
@@ -108,15 +108,6 @@ AllocationResult Heap::AllocateMap(InstanceType instance_type,
       Map::cast(result), instance_type, instance_size, elements_kind,
       inobject_properties);
 
-  if (!is_js_object) {
-    // Eagerly initialize the WeakCell cache for the map as it will not be
-    // writable in RO_SPACE.
-    HandleScope handle_scope(isolate());
-    Handle<WeakCell> weak_cell = isolate()->factory()->NewWeakCell(
-        Handle<Map>(map, isolate()), TENURED_READ_ONLY);
-    map->set_weak_cell_cache(*weak_cell);
-  }
-
   return map;
 }
 
@@ -148,7 +139,6 @@ AllocationResult Heap::AllocatePartialMap(InstanceType instance_type,
                    Map::OwnsDescriptorsBit::encode(true) |
                    Map::ConstructionCounterBits::encode(Map::kNoSlackTracking);
   map->set_bit_field3(bit_field3);
-  map->set_weak_cell_cache(Smi::kZero);
   map->set_elements_kind(TERMINAL_FAST_ELEMENTS_KIND);
   return map;
 }
@@ -163,13 +153,6 @@ void Heap::FinalizePartialMap(Map* map) {
   }
   map->set_prototype(roots.null_value());
   map->set_constructor_or_backpointer(roots.null_value());
-
-  // Eagerly initialize the WeakCell cache for the map as it will not be
-  // writable in RO_SPACE.
-  HandleScope handle_scope(isolate());
-  Handle<WeakCell> weak_cell = isolate()->factory()->NewWeakCell(
-      Handle<Map>(map, isolate()), TENURED_READ_ONLY);
-  map->set_weak_cell_cache(*weak_cell);
 }
 
 AllocationResult Heap::Allocate(Map* map, AllocationSpace space) {
@@ -621,6 +604,9 @@ void Heap::CreateInitialObjects() {
   set_minus_infinity_value(
       *factory->NewHeapNumber(-V8_INFINITY, TENURED_READ_ONLY));
 
+  set_hash_seed(*factory->NewByteArray(kInt64Size, TENURED));
+  InitializeHashSeed();
+
   // Allocate cache for single character one byte strings.
   set_single_character_string_cache(
       *factory->NewFixedArray(String::kMaxOneByteCharCode + 1, TENURED));
diff --git a/deps/v8/src/heap/spaces.cc b/deps/v8/src/heap/spaces.cc
index 9611ef773b01eb..70e698aeb57f91 100644
--- a/deps/v8/src/heap/spaces.cc
+++ b/deps/v8/src/heap/spaces.cc
@@ -621,8 +621,8 @@ MemoryChunk* MemoryChunk::Initialize(Heap* heap, Address base, size_t size,
   chunk->invalidated_slots_ = nullptr;
   chunk->skip_list_ = nullptr;
   chunk->progress_bar_ = 0;
-  chunk->high_water_mark_.SetValue(static_cast<intptr_t>(area_start - base));
-  chunk->concurrent_sweeping_state().SetValue(kSweepingDone);
+  chunk->high_water_mark_ = static_cast<intptr_t>(area_start - base);
+  chunk->set_concurrent_sweeping_state(kSweepingDone);
   chunk->page_protection_change_mutex_ = new base::Mutex();
   chunk->write_unprotect_counter_ = 0;
   chunk->mutex_ = new base::Mutex();
@@ -760,7 +760,7 @@ Page* Page::ConvertNewToOld(Page* old_page) {
 size_t MemoryChunk::CommittedPhysicalMemory() {
   if (!base::OS::HasLazyCommits() || owner()->identity() == LO_SPACE)
     return size();
-  return high_water_mark_.Value();
+  return high_water_mark_;
 }
 
 bool MemoryChunk::IsPagedSpace() const {
@@ -1957,11 +1957,7 @@ void PagedSpace::Verify(Isolate* isolate, ObjectVisitor* visitor) {
       CHECK(object->address() + size <= top);
       end_of_previous_object = object->address() + size;
 
-      if (object->IsExternalString()) {
-        ExternalString* external_string = ExternalString::cast(object);
-        size_t size = external_string->ExternalPayloadSize();
-        external_page_bytes[ExternalBackingStoreType::kExternalString] += size;
-      } else if (object->IsJSArrayBuffer()) {
+      if (object->IsJSArrayBuffer()) {
         JSArrayBuffer* array_buffer = JSArrayBuffer::cast(object);
         if (ArrayBufferTracker::IsTracked(array_buffer)) {
           size_t size = NumberToSize(array_buffer->byte_length());
@@ -2233,8 +2229,8 @@ void NewSpace::UpdateLinearAllocationArea() {
   Address new_top = to_space_.page_low();
   MemoryChunk::UpdateHighWaterMark(allocation_info_.top());
   allocation_info_.Reset(new_top, to_space_.page_high());
-  original_top_.SetValue(top());
-  original_limit_.SetValue(limit());
+  original_top_ = top();
+  original_limit_ = limit();
   StartNextInlineAllocationStep();
   DCHECK_SEMISPACE_ALLOCATION_INFO(allocation_info_, to_space_);
 }
@@ -2445,11 +2441,7 @@ void NewSpace::Verify(Isolate* isolate) {
       int size = object->Size();
       object->IterateBody(map, size, &visitor);
 
-      if (object->IsExternalString()) {
-        ExternalString* external_string = ExternalString::cast(object);
-        size_t size = external_string->ExternalPayloadSize();
-        external_space_bytes[ExternalBackingStoreType::kExternalString] += size;
-      } else if (object->IsJSArrayBuffer()) {
+      if (object->IsJSArrayBuffer()) {
         JSArrayBuffer* array_buffer = JSArrayBuffer::cast(object);
         if (ArrayBufferTracker::IsTracked(array_buffer)) {
           size_t size = NumberToSize(array_buffer->byte_length());
diff --git a/deps/v8/src/heap/spaces.h b/deps/v8/src/heap/spaces.h
index c1ef24081723f3..30edeab2b814c0 100644
--- a/deps/v8/src/heap/spaces.h
+++ b/deps/v8/src/heap/spaces.h
@@ -368,9 +368,10 @@ class MemoryChunk {
       + kPointerSize * NUMBER_OF_REMEMBERED_SET_TYPES  // TypedSlotSet* array
       + kPointerSize  // InvalidatedSlots* invalidated_slots_
       + kPointerSize  // SkipList* skip_list_
-      + kPointerSize  // AtomicValue high_water_mark_
+      + kPointerSize  // std::atomic<intptr_t> high_water_mark_
       + kPointerSize  // base::Mutex* mutex_
-      + kPointerSize  // base::AtomicWord concurrent_sweeping_
+      +
+      kPointerSize  // std::atomic<ConcurrentSweepingState> concurrent_sweeping_
       + kPointerSize  // base::Mutex* page_protection_change_mutex_
       + kPointerSize  // unitptr_t write_unprotect_counter_
       + kSizetSize * kNumTypes
@@ -434,9 +435,10 @@ class MemoryChunk {
     intptr_t new_mark = static_cast<intptr_t>(mark - chunk->address());
     intptr_t old_mark = 0;
     do {
-      old_mark = chunk->high_water_mark_.Value();
-    } while ((new_mark > old_mark) &&
-             !chunk->high_water_mark_.TrySetValue(old_mark, new_mark));
+      old_mark = chunk->high_water_mark_;
+    } while (
+        (new_mark > old_mark) &&
+        !chunk->high_water_mark_.compare_exchange_weak(old_mark, new_mark));
   }
 
   Address address() const {
@@ -455,14 +457,16 @@ class MemoryChunk {
     return addr >= area_start() && addr <= area_end();
   }
 
-  base::AtomicValue<ConcurrentSweepingState>& concurrent_sweeping_state() {
-    return concurrent_sweeping_;
+  void set_concurrent_sweeping_state(ConcurrentSweepingState state) {
+    concurrent_sweeping_ = state;
   }
 
-  bool SweepingDone() {
-    return concurrent_sweeping_state().Value() == kSweepingDone;
+  ConcurrentSweepingState concurrent_sweeping_state() {
+    return static_cast<ConcurrentSweepingState>(concurrent_sweeping_.load());
   }
 
+  bool SweepingDone() { return concurrent_sweeping_ == kSweepingDone; }
+
   size_t size() const { return size_; }
   void set_size(size_t size) { size_ = size; }
 
@@ -522,7 +526,7 @@ class MemoryChunk {
   // Approximate amount of physical memory committed for this chunk.
   size_t CommittedPhysicalMemory();
 
-  Address HighWaterMark() { return address() + high_water_mark_.Value(); }
+  Address HighWaterMark() { return address() + high_water_mark_; }
 
   int progress_bar() {
     DCHECK(IsFlagSet(HAS_PROGRESS_BAR));
@@ -619,9 +623,9 @@ class MemoryChunk {
 
   bool InFromSpace() { return IsFlagSet(IN_FROM_SPACE); }
 
-  Space* owner() const { return owner_.Value(); }
+  Space* owner() const { return owner_; }
 
-  void set_owner(Space* space) { owner_.SetValue(space); }
+  void set_owner(Space* space) { owner_ = space; }
 
   bool IsPagedSpace() const;
 
@@ -656,7 +660,7 @@ class MemoryChunk {
   VirtualMemory reservation_;
 
   // The space owning this memory chunk.
-  base::AtomicValue<Space*> owner_;
+  std::atomic<Space*> owner_;
 
   Heap* heap_;
 
@@ -678,11 +682,11 @@ class MemoryChunk {
 
   // Assuming the initial allocation on a page is sequential,
   // count highest number of bytes ever allocated on the page.
-  base::AtomicValue<intptr_t> high_water_mark_;
+  std::atomic<intptr_t> high_water_mark_;
 
   base::Mutex* mutex_;
 
-  base::AtomicValue<ConcurrentSweepingState> concurrent_sweeping_;
+  std::atomic<intptr_t> concurrent_sweeping_;
 
   base::Mutex* page_protection_change_mutex_;
 
@@ -734,6 +738,9 @@ class MemoryChunk {
   friend class PagedSpace;
 };
 
+static_assert(sizeof(std::atomic<intptr_t>) == kPointerSize,
+              "sizeof(std::atomic<intptr_t>) == kPointerSize");
+
 static_assert(kMaxRegularHeapObjectSize <= MemoryChunk::kAllocatableMemory,
               "kMaxRegularHeapObjectSize <= MemoryChunk::kAllocatableMemory");
 
@@ -759,10 +766,6 @@ class Page : public MemoryChunk {
   static Page* FromAddress(Address addr) {
     return reinterpret_cast<Page*>(OffsetFrom(addr) & ~kPageAlignmentMask);
   }
-  static Page* FromHeapObject(const HeapObject* o) {
-    return reinterpret_cast<Page*>(reinterpret_cast<Address>(o) &
-                                   ~kAlignmentMask);
-  }
 
   // Returns the page containing the address provided. The address can
   // potentially point righter after the page. To be also safe for tagged values
@@ -1375,8 +1378,8 @@ class V8_EXPORT_PRIVATE MemoryAllocator {
   // Returns an indication of whether a pointer is in a space that has
   // been allocated by this MemoryAllocator.
   V8_INLINE bool IsOutsideAllocatedSpace(Address address) {
-    return address < lowest_ever_allocated_.Value() ||
-           address >= highest_ever_allocated_.Value();
+    return address < lowest_ever_allocated_ ||
+           address >= highest_ever_allocated_;
   }
 
   // Returns a MemoryChunk in which the memory region from commit_area_size to
@@ -1459,11 +1462,13 @@ class V8_EXPORT_PRIVATE MemoryAllocator {
     // values only if they did not change in between.
     Address ptr = kNullAddress;
     do {
-      ptr = lowest_ever_allocated_.Value();
-    } while ((low < ptr) && !lowest_ever_allocated_.TrySetValue(ptr, low));
+      ptr = lowest_ever_allocated_;
+    } while ((low < ptr) &&
+             !lowest_ever_allocated_.compare_exchange_weak(ptr, low));
     do {
-      ptr = highest_ever_allocated_.Value();
-    } while ((high > ptr) && !highest_ever_allocated_.TrySetValue(ptr, high));
+      ptr = highest_ever_allocated_;
+    } while ((high > ptr) &&
+             !highest_ever_allocated_.compare_exchange_weak(ptr, high));
   }
 
   void RegisterExecutableMemoryChunk(MemoryChunk* chunk) {
@@ -1494,8 +1499,8 @@ class V8_EXPORT_PRIVATE MemoryAllocator {
   // conservative, i.e. not all addresses in 'allocated' space are allocated
   // to our heap. The range is [lowest, highest[, inclusive on the low end
   // and exclusive on the high end.
-  base::AtomicValue<Address> lowest_ever_allocated_;
-  base::AtomicValue<Address> highest_ever_allocated_;
+  std::atomic<Address> lowest_ever_allocated_;
+  std::atomic<Address> highest_ever_allocated_;
 
   VirtualMemory last_chunk_;
   Unmapper unmapper_;
@@ -2687,11 +2692,11 @@ class NewSpace : public SpaceWithLinearArea {
   void ResetOriginalTop() {
     DCHECK_GE(top(), original_top());
     DCHECK_LE(top(), original_limit());
-    original_top_.SetValue(top());
+    original_top_ = top();
   }
 
-  Address original_top() { return original_top_.Value(); }
-  Address original_limit() { return original_limit_.Value(); }
+  Address original_top() { return original_top_; }
+  Address original_limit() { return original_limit_; }
 
   // Return the address of the first allocatable address in the active
   // semispace. This may be the address where the first object resides.
@@ -2780,8 +2785,8 @@ class NewSpace : public SpaceWithLinearArea {
 
   // The top and the limit at the time of setting the linear allocation area.
   // These values can be accessed by background tasks.
-  base::AtomicValue<Address> original_top_;
-  base::AtomicValue<Address> original_limit_;
+  std::atomic<Address> original_top_;
+  std::atomic<Address> original_limit_;
 
   // The semispaces.
   SemiSpace to_space_;
diff --git a/deps/v8/src/heap/sweeper.cc b/deps/v8/src/heap/sweeper.cc
index efd5d304861770..8b62213cb6ef0b 100644
--- a/deps/v8/src/heap/sweeper.cc
+++ b/deps/v8/src/heap/sweeper.cc
@@ -17,7 +17,7 @@ namespace internal {
 
 Sweeper::PauseOrCompleteScope::PauseOrCompleteScope(Sweeper* sweeper)
     : sweeper_(sweeper) {
-  sweeper_->stop_sweeper_tasks_.SetValue(true);
+  sweeper_->stop_sweeper_tasks_ = true;
   if (!sweeper_->sweeping_in_progress()) return;
 
   sweeper_->AbortAndWaitForTasks();
@@ -34,7 +34,7 @@ Sweeper::PauseOrCompleteScope::PauseOrCompleteScope(Sweeper* sweeper)
 }
 
 Sweeper::PauseOrCompleteScope::~PauseOrCompleteScope() {
-  sweeper_->stop_sweeper_tasks_.SetValue(false);
+  sweeper_->stop_sweeper_tasks_ = false;
   if (!sweeper_->sweeping_in_progress()) return;
 
   sweeper_->StartSweeperTasks();
@@ -133,7 +133,7 @@ class Sweeper::IncrementalSweeperTask final : public CancelableTask {
 };
 
 void Sweeper::StartSweeping() {
-  CHECK(!stop_sweeper_tasks_.Value());
+  CHECK(!stop_sweeper_tasks_);
   sweeping_in_progress_ = true;
   iterability_in_progress_ = true;
   MajorNonAtomicMarkingState* marking_state =
@@ -366,14 +366,14 @@ int Sweeper::RawSweep(Page* p, FreeListRebuildingMode free_list_mode,
     // The allocated_bytes() counter is precisely the total size of objects.
     DCHECK_EQ(live_bytes, p->allocated_bytes());
   }
-  p->concurrent_sweeping_state().SetValue(Page::kSweepingDone);
+  p->set_concurrent_sweeping_state(Page::kSweepingDone);
   if (free_list_mode == IGNORE_FREE_LIST) return 0;
   return static_cast<int>(FreeList::GuaranteedAllocatable(max_freed_bytes));
 }
 
 void Sweeper::SweepSpaceFromTask(AllocationSpace identity) {
   Page* page = nullptr;
-  while (!stop_sweeper_tasks_.Value() &&
+  while (!stop_sweeper_tasks_ &&
          ((page = GetSweepingPageSafe(identity)) != nullptr)) {
     ParallelSweepPage(page, identity);
   }
@@ -419,9 +419,8 @@ int Sweeper::ParallelSweepPage(Page* page, AllocationSpace identity) {
     // the page protection mode from rx -> rw while sweeping.
     CodePageMemoryModificationScope code_page_scope(page);
 
-    DCHECK_EQ(Page::kSweepingPending,
-              page->concurrent_sweeping_state().Value());
-    page->concurrent_sweeping_state().SetValue(Page::kSweepingInProgress);
+    DCHECK_EQ(Page::kSweepingPending, page->concurrent_sweeping_state());
+    page->set_concurrent_sweeping_state(Page::kSweepingInProgress);
     const FreeSpaceTreatmentMode free_space_mode =
         Heap::ShouldZapGarbage() ? ZAP_FREE_SPACE : IGNORE_FREE_SPACE;
     max_freed = RawSweep(page, REBUILD_FREE_LIST, free_space_mode);
@@ -467,17 +466,17 @@ void Sweeper::AddPage(AllocationSpace space, Page* page,
     // happened when the page was initially added, so it is skipped here.
     DCHECK_EQ(Sweeper::READD_TEMPORARY_REMOVED_PAGE, mode);
   }
-  DCHECK_EQ(Page::kSweepingPending, page->concurrent_sweeping_state().Value());
+  DCHECK_EQ(Page::kSweepingPending, page->concurrent_sweeping_state());
   sweeping_list_[GetSweepSpaceIndex(space)].push_back(page);
 }
 
 void Sweeper::PrepareToBeSweptPage(AllocationSpace space, Page* page) {
   DCHECK_GE(page->area_size(),
             static_cast<size_t>(marking_state_->live_bytes(page)));
-  DCHECK_EQ(Page::kSweepingDone, page->concurrent_sweeping_state().Value());
+  DCHECK_EQ(Page::kSweepingDone, page->concurrent_sweeping_state());
   page->ForAllFreeListCategories(
       [](FreeListCategory* category) { DCHECK(!category->is_linked()); });
-  page->concurrent_sweeping_state().SetValue(Page::kSweepingPending);
+  page->set_concurrent_sweeping_state(Page::kSweepingPending);
   heap_->paged_space(space)->IncreaseAllocatedBytes(
       marking_state_->live_bytes(page), page);
 }
@@ -569,10 +568,10 @@ void Sweeper::AddPageForIterability(Page* page) {
   DCHECK(iterability_in_progress_);
   DCHECK(!iterability_task_started_);
   DCHECK(IsValidIterabilitySpace(page->owner()->identity()));
-  DCHECK_EQ(Page::kSweepingDone, page->concurrent_sweeping_state().Value());
+  DCHECK_EQ(Page::kSweepingDone, page->concurrent_sweeping_state());
 
   iterability_list_.push_back(page);
-  page->concurrent_sweeping_state().SetValue(Page::kSweepingPending);
+  page->set_concurrent_sweeping_state(Page::kSweepingPending);
 }
 
 void Sweeper::MakeIterable(Page* page) {
diff --git a/deps/v8/src/heap/sweeper.h b/deps/v8/src/heap/sweeper.h
index af2e5629c68cf6..90a429b3eace28 100644
--- a/deps/v8/src/heap/sweeper.h
+++ b/deps/v8/src/heap/sweeper.h
@@ -188,7 +188,7 @@ class Sweeper {
   // the semaphore for maintaining a task counter on the main thread.
   std::atomic<intptr_t> num_sweeping_tasks_;
   // Used by PauseOrCompleteScope to signal early bailout to tasks.
-  base::AtomicValue<bool> stop_sweeper_tasks_;
+  std::atomic<bool> stop_sweeper_tasks_;
 
   // Pages that are only made iterable but have their free lists ignored.
   IterabilityList iterability_list_;
diff --git a/deps/v8/src/ic/handler-configuration.h b/deps/v8/src/ic/handler-configuration.h
index 4807ad695dd951..eed300d30e9e51 100644
--- a/deps/v8/src/ic/handler-configuration.h
+++ b/deps/v8/src/ic/handler-configuration.h
@@ -18,6 +18,8 @@
 namespace v8 {
 namespace internal {
 
+class JSProxy;
+
 // A set of bit fields representing Smi handlers for loads and a HeapObject
 // that represents load handlers that can't be encoded in a Smi.
 // TODO(ishell): move to load-handler.h
diff --git a/deps/v8/src/ic/ic.cc b/deps/v8/src/ic/ic.cc
index 5f84b2f190465b..0937d792c27b1f 100644
--- a/deps/v8/src/ic/ic.cc
+++ b/deps/v8/src/ic/ic.cc
@@ -442,7 +442,7 @@ MaybeHandle<Object> LoadIC::Load(Handle<Object> object, Handle<Name> name) {
     update_receiver_map(object);
   }
   // Named lookup in the object.
-  LookupIterator it(object, name);
+  LookupIterator it(isolate(), object, name);
   LookupForRead(isolate(), &it);
 
   if (name->IsPrivate()) {
@@ -487,11 +487,12 @@ MaybeHandle<Object> LoadGlobalIC::Load(Handle<Name> name) {
         global->native_context()->script_context_table(), isolate());
 
     ScriptContextTable::LookupResult lookup_result;
-    if (ScriptContextTable::Lookup(script_contexts, str_name, &lookup_result)) {
-      Handle<Object> result =
-          FixedArray::get(*ScriptContextTable::GetContext(
-                              script_contexts, lookup_result.context_index),
-                          lookup_result.slot_index, isolate());
+    if (ScriptContextTable::Lookup(isolate(), script_contexts, str_name,
+                                   &lookup_result)) {
+      Handle<Object> result = FixedArray::get(
+          *ScriptContextTable::GetContext(isolate(), script_contexts,
+                                          lookup_result.context_index),
+          lookup_result.slot_index, isolate());
       if (result->IsTheHole(isolate())) {
         // Do not install stubs and stay pre-monomorphic for
         // uninitialized accesses.
@@ -1134,7 +1135,7 @@ void KeyedLoadIC::LoadElementPolymorphicHandlers(
       Map* tmap = receiver_map->FindElementsKindTransitionedMap(isolate(),
                                                                 *receiver_maps);
       if (tmap != nullptr) {
-        receiver_map->NotifyLeafMapLayoutChange();
+        receiver_map->NotifyLeafMapLayoutChange(isolate());
       }
     }
     handlers->push_back(
@@ -1345,9 +1346,10 @@ MaybeHandle<Object> StoreGlobalIC::Store(Handle<Name> name,
       global->native_context()->script_context_table(), isolate());
 
   ScriptContextTable::LookupResult lookup_result;
-  if (ScriptContextTable::Lookup(script_contexts, str_name, &lookup_result)) {
+  if (ScriptContextTable::Lookup(isolate(), script_contexts, str_name,
+                                 &lookup_result)) {
     Handle<Context> script_context = ScriptContextTable::GetContext(
-        script_contexts, lookup_result.context_index);
+        isolate(), script_contexts, lookup_result.context_index);
     if (lookup_result.mode == VariableMode::kConst) {
       return TypeError(MessageTemplate::kConstAssign, global, name);
     }
@@ -1389,7 +1391,8 @@ MaybeHandle<Object> StoreIC::Store(Handle<Object> object, Handle<Name> name,
     Handle<Object> result;
     ASSIGN_RETURN_ON_EXCEPTION(
         isolate(), result,
-        Object::SetProperty(object, name, value, language_mode()), Object);
+        Object::SetProperty(isolate(), object, name, value, language_mode()),
+        Object);
     return result;
   }
 
@@ -1409,7 +1412,7 @@ MaybeHandle<Object> StoreIC::Store(Handle<Object> object, Handle<Name> name,
   if (state() != UNINITIALIZED) {
     JSObject::MakePrototypesFast(object, kStartAtPrototype, isolate());
   }
-  LookupIterator it(object, name);
+  LookupIterator it(isolate(), object, name);
   bool use_ic = FLAG_use_ic;
 
   if (name->IsPrivate()) {
@@ -1835,8 +1838,9 @@ Handle<Object> KeyedStoreIC::StoreElementHandler(
          store_mode == STORE_AND_GROW_NO_TRANSITION_HANDLE_COW ||
          store_mode == STORE_NO_TRANSITION_IGNORE_OUT_OF_BOUNDS ||
          store_mode == STORE_NO_TRANSITION_HANDLE_COW);
-  DCHECK_IMPLIES(receiver_map->DictionaryElementsInPrototypeChainOnly(),
-                 IsStoreInArrayLiteralICKind(kind()));
+  DCHECK_IMPLIES(
+      receiver_map->DictionaryElementsInPrototypeChainOnly(isolate()),
+      IsStoreInArrayLiteralICKind(kind()));
 
   if (receiver_map->IsJSProxyMap()) {
     return StoreHandler::StoreProxy(isolate());
@@ -1899,7 +1903,7 @@ void KeyedStoreIC::StoreElementPolymorphicHandlers(
     Handle<Map> transition;
 
     if (receiver_map->instance_type() < FIRST_JS_RECEIVER_TYPE ||
-        receiver_map->DictionaryElementsInPrototypeChainOnly()) {
+        receiver_map->DictionaryElementsInPrototypeChainOnly(isolate())) {
       // TODO(mvstanton): Consider embedding store_mode in the state of the slow
       // keyed store ic for uniformity.
       TRACE_HANDLER_STATS(isolate(), KeyedStoreIC_SlowStub);
@@ -1911,7 +1915,7 @@ void KeyedStoreIC::StoreElementPolymorphicHandlers(
             isolate(), *receiver_maps);
         if (tmap != nullptr) {
           if (receiver_map->is_stable()) {
-            receiver_map->NotifyLeafMapLayoutChange();
+            receiver_map->NotifyLeafMapLayoutChange(isolate());
           }
           transition = handle(tmap, isolate());
         }
@@ -2076,8 +2080,8 @@ MaybeHandle<Object> KeyedStoreIC::Store(Handle<Object> object,
       } else if (key_is_valid_index) {
         if (old_receiver_map->is_abandoned_prototype_map()) {
           set_slow_stub_reason("receiver with prototype map");
-        } else if (!old_receiver_map
-                        ->DictionaryElementsInPrototypeChainOnly()) {
+        } else if (!old_receiver_map->DictionaryElementsInPrototypeChainOnly(
+                       isolate())) {
           // We should go generic if receiver isn't a dictionary, but our
           // prototype chain does have dictionary elements. This ensures that
           // other non-dictionary receivers in the polymorphic case benefit
@@ -2219,9 +2223,10 @@ RUNTIME_FUNCTION(Runtime_LoadGlobalIC_Slow) {
       native_context->script_context_table(), isolate);
 
   ScriptContextTable::LookupResult lookup_result;
-  if (ScriptContextTable::Lookup(script_contexts, name, &lookup_result)) {
+  if (ScriptContextTable::Lookup(isolate, script_contexts, name,
+                                 &lookup_result)) {
     Handle<Context> script_context = ScriptContextTable::GetContext(
-        script_contexts, lookup_result.context_index);
+        isolate, script_contexts, lookup_result.context_index);
     Handle<Object> result =
         FixedArray::get(*script_context, lookup_result.slot_index, isolate);
     if (*result == ReadOnlyRoots(isolate).the_hole_value()) {
@@ -2335,9 +2340,10 @@ RUNTIME_FUNCTION(Runtime_StoreGlobalIC_Slow) {
       native_context->script_context_table(), isolate);
 
   ScriptContextTable::LookupResult lookup_result;
-  if (ScriptContextTable::Lookup(script_contexts, name, &lookup_result)) {
+  if (ScriptContextTable::Lookup(isolate, script_contexts, name,
+                                 &lookup_result)) {
     Handle<Context> script_context = ScriptContextTable::GetContext(
-        script_contexts, lookup_result.context_index);
+        isolate, script_contexts, lookup_result.context_index);
     if (lookup_result.mode == VariableMode::kConst) {
       THROW_NEW_ERROR_RETURN_FAILURE(
           isolate, NewTypeError(MessageTemplate::kConstAssign, global, name));
diff --git a/deps/v8/src/inspector/injected-script-source.js b/deps/v8/src/inspector/injected-script-source.js
index 5e5302fbbe52ee..23899530721bfa 100644
--- a/deps/v8/src/inspector/injected-script-source.js
+++ b/deps/v8/src/inspector/injected-script-source.js
@@ -594,6 +594,9 @@ InjectedScript.prototype = {
             return toString(obj);
 
         if (subtype === "node") {
+            // We should warmup blink dom binding before calling anything,
+            // see (crbug.com/827585) for details.
+            InjectedScriptHost.getOwnPropertyDescriptor(/** @type {!Object} */(obj), "nodeName");
             var description = "";
             var nodeName = InjectedScriptHost.getProperty(obj, "nodeName");
             if (nodeName) {
diff --git a/deps/v8/src/isolate.cc b/deps/v8/src/isolate.cc
index 9d4353461bceb9..6c7bfe0d96b23c 100644
--- a/deps/v8/src/isolate.cc
+++ b/deps/v8/src/isolate.cc
@@ -149,44 +149,11 @@ int ThreadId::GetCurrentThreadId() {
   return thread_id;
 }
 
-
-ThreadLocalTop::ThreadLocalTop() {
-  InitializeInternal();
-}
-
-
-void ThreadLocalTop::InitializeInternal() {
-  c_entry_fp_ = 0;
-  c_function_ = 0;
-  handler_ = 0;
-#ifdef USE_SIMULATOR
-  simulator_ = nullptr;
-#endif
-  js_entry_sp_ = kNullAddress;
-  external_callback_scope_ = nullptr;
-  current_vm_state_ = EXTERNAL;
-  try_catch_handler_ = nullptr;
-  context_ = nullptr;
-  thread_id_ = ThreadId::Invalid();
-  external_caught_exception_ = false;
-  failed_access_check_callback_ = nullptr;
-  save_context_ = nullptr;
-  promise_on_stack_ = nullptr;
-
-  // These members are re-initialized later after deserialization
-  // is complete.
-  pending_exception_ = nullptr;
-  wasm_caught_exception_ = nullptr;
-  rethrowing_message_ = false;
-  pending_message_obj_ = nullptr;
-  scheduled_exception_ = nullptr;
-}
-
-
-void ThreadLocalTop::Initialize() {
-  InitializeInternal();
+void ThreadLocalTop::Initialize(Isolate* isolate) {
+  *this = ThreadLocalTop();
+  isolate_ = isolate;
 #ifdef USE_SIMULATOR
-  simulator_ = Simulator::current(isolate_);
+  simulator_ = Simulator::current(isolate);
 #endif
   thread_id_ = ThreadId::Current();
 }
@@ -685,10 +652,11 @@ MaybeHandle<JSReceiver> Isolate::CaptureAndSetDetailedStackTrace(
     Handle<FixedArray> stack_trace = CaptureCurrentStackTrace(
         stack_trace_for_uncaught_exceptions_frame_limit_,
         stack_trace_for_uncaught_exceptions_options_);
-    RETURN_ON_EXCEPTION(this,
-                        JSReceiver::SetProperty(error_object, key, stack_trace,
-                                                LanguageMode::kStrict),
-                        JSReceiver);
+    RETURN_ON_EXCEPTION(
+        this,
+        JSReceiver::SetProperty(this, error_object, key, stack_trace,
+                                LanguageMode::kStrict),
+        JSReceiver);
   }
   return error_object;
 }
@@ -700,10 +668,11 @@ MaybeHandle<JSReceiver> Isolate::CaptureAndSetSimpleStackTrace(
   Handle<Name> key = factory()->stack_trace_symbol();
   Handle<Object> stack_trace =
       CaptureSimpleStackTrace(error_object, mode, caller);
-  RETURN_ON_EXCEPTION(this,
-                      JSReceiver::SetProperty(error_object, key, stack_trace,
-                                              LanguageMode::kStrict),
-                      JSReceiver);
+  RETURN_ON_EXCEPTION(
+      this,
+      JSReceiver::SetProperty(this, error_object, key, stack_trace,
+                              LanguageMode::kStrict),
+      JSReceiver);
   return error_object;
 }
 
@@ -777,7 +746,7 @@ class CaptureStackTraceHelper {
       } else {
         cache = SimpleNumberDictionary::New(isolate_, 1);
       }
-      int entry = cache->FindEntry(code_offset);
+      int entry = cache->FindEntry(isolate_, code_offset);
       if (entry != NumberDictionary::kNotFound) {
         Handle<StackFrameInfo> frame(
             StackFrameInfo::cast(cache->ValueAt(entry)), isolate_);
@@ -804,7 +773,8 @@ class CaptureStackTraceHelper {
     frame->set_is_constructor(summ.is_constructor());
     frame->set_is_wasm(false);
     if (!FLAG_optimize_for_size) {
-      auto new_cache = SimpleNumberDictionary::Set(cache, code_offset, frame);
+      auto new_cache =
+          SimpleNumberDictionary::Set(isolate_, cache, code_offset, frame);
       if (*new_cache != *cache || !maybe_cache->IsNumberDictionary()) {
         AbstractCode::SetStackFrameCache(summ.abstract_code(), new_cache);
       }
@@ -2809,11 +2779,7 @@ Isolate::~Isolate() {
   allocator_ = nullptr;
 }
 
-
-void Isolate::InitializeThreadLocal() {
-  thread_local_top_.isolate_ = this;
-  thread_local_top_.Initialize();
-}
+void Isolate::InitializeThreadLocal() { thread_local_top_.Initialize(this); }
 
 void Isolate::SetTerminationOnExternalTryCatch() {
   if (try_catch_handler() == nullptr) return;
@@ -3002,10 +2968,6 @@ bool Isolate::Init(StartupDeserializer* des) {
     wasm_engine_.reset(
         new wasm::WasmEngine(std::unique_ptr<wasm::WasmCodeManager>(
             new wasm::WasmCodeManager(kMaxWasmCodeMemory))));
-    wasm_engine_->memory_tracker()->SetAllocationResultHistogram(
-        counters()->wasm_memory_allocation_result());
-    wasm_engine_->memory_tracker()->SetAddressSpaceUsageHistogram(
-        counters()->wasm_address_space_usage_mb());
     wasm_engine_->code_manager()->SetModuleCodeSizeHistogram(
         counters()->wasm_module_code_size_mb());
   }
@@ -3320,7 +3282,7 @@ void Isolate::MaybeInitializeVectorListFromHeap() {
   // Add collected feedback vectors to the root list lest we lose them to GC.
   Handle<ArrayList> list =
       ArrayList::New(this, static_cast<int>(vectors.size()));
-  for (const auto& vector : vectors) list = ArrayList::Add(list, vector);
+  for (const auto& vector : vectors) list = ArrayList::Add(this, list, vector);
   SetFeedbackVectorsForProfilingTools(*list);
 }
 
@@ -3451,7 +3413,7 @@ bool Isolate::IsIsConcatSpreadableLookupChainIntact() {
   Handle<Object> array_prototype(array_function()->prototype(), this);
   Handle<Symbol> key = factory()->is_concat_spreadable_symbol();
   Handle<Object> value;
-  LookupIterator it(array_prototype, key);
+  LookupIterator it(this, array_prototype, key);
   if (it.IsFound() && !JSReceiver::GetDataProperty(&it)->IsUndefined(this)) {
     // TODO(cbruni): Currently we do not revert if we unset the
     // @@isConcatSpreadable property on Array.prototype or Object.prototype
@@ -3668,13 +3630,13 @@ Handle<Symbol> Isolate::SymbolFor(Heap::RootListIndex dictionary_index,
   Handle<String> key = factory()->InternalizeString(name);
   Handle<NameDictionary> dictionary =
       Handle<NameDictionary>::cast(heap()->root_handle(dictionary_index));
-  int entry = dictionary->FindEntry(key);
+  int entry = dictionary->FindEntry(this, key);
   Handle<Symbol> symbol;
   if (entry == NameDictionary::kNotFound) {
     symbol =
         private_symbol ? factory()->NewPrivateSymbol() : factory()->NewSymbol();
     symbol->set_name(*key);
-    dictionary = NameDictionary::Add(dictionary, key, symbol,
+    dictionary = NameDictionary::Add(this, dictionary, key, symbol,
                                      PropertyDetails::Empty(), &entry);
     switch (dictionary_index) {
       case Heap::kPublicSymbolTableRootIndex:
diff --git a/deps/v8/src/isolate.h b/deps/v8/src/isolate.h
index 4483e1ff9145b2..09aaf996849017 100644
--- a/deps/v8/src/isolate.h
+++ b/deps/v8/src/isolate.h
@@ -313,10 +313,10 @@ class ThreadLocalTop BASE_EMBEDDED {
  public:
   // Does early low-level initialization that does not depend on the
   // isolate being present.
-  ThreadLocalTop();
+  ThreadLocalTop() = default;
 
   // Initialize the thread data.
-  void Initialize();
+  void Initialize(Isolate*);
 
   // Get the top C++ try catch handler or nullptr if none are registered.
   //
@@ -342,60 +342,62 @@ class ThreadLocalTop BASE_EMBEDDED {
 
   void Free();
 
-  Isolate* isolate_;
+  Isolate* isolate_ = nullptr;
   // The context where the current execution method is created and for variable
   // lookups.
-  Context* context_;
-  ThreadId thread_id_;
-  Object* pending_exception_;
+  Context* context_ = nullptr;
+  ThreadId thread_id_ = ThreadId::Invalid();
+  Object* pending_exception_ = nullptr;
   // TODO(kschimpf): Change this to a stack of caught exceptions (rather than
   // just innermost catching try block).
   Object* wasm_caught_exception_ = nullptr;
 
   // Communication channel between Isolate::FindHandler and the CEntry.
-  Context* pending_handler_context_;
-  Address pending_handler_entrypoint_;
-  Address pending_handler_constant_pool_;
-  Address pending_handler_fp_;
-  Address pending_handler_sp_;
+  Context* pending_handler_context_ = nullptr;
+  Address pending_handler_entrypoint_ = kNullAddress;
+  Address pending_handler_constant_pool_ = kNullAddress;
+  Address pending_handler_fp_ = kNullAddress;
+  Address pending_handler_sp_ = kNullAddress;
 
   // Communication channel between Isolate::Throw and message consumers.
-  bool rethrowing_message_;
-  Object* pending_message_obj_;
+  bool rethrowing_message_ = false;
+  Object* pending_message_obj_ = nullptr;
 
   // Use a separate value for scheduled exceptions to preserve the
   // invariants that hold about pending_exception.  We may want to
   // unify them later.
-  Object* scheduled_exception_;
-  bool external_caught_exception_;
-  SaveContext* save_context_;
+  Object* scheduled_exception_ = nullptr;
+  bool external_caught_exception_ = false;
+  SaveContext* save_context_ = nullptr;
 
   // Stack.
-  Address c_entry_fp_;  // the frame pointer of the top c entry frame
-  Address handler_;     // try-blocks are chained through the stack
-  Address c_function_;  // C function that was called at c entry.
+  // The frame pointer of the top c entry frame.
+  Address c_entry_fp_ = kNullAddress;
+  // Try-blocks are chained through the stack.
+  Address handler_ = kNullAddress;
+  // C function that was called at c entry.
+  Address c_function_ = kNullAddress;
 
   // Throwing an exception may cause a Promise rejection.  For this purpose
   // we keep track of a stack of nested promises and the corresponding
   // try-catch handlers.
-  PromiseOnStack* promise_on_stack_;
+  PromiseOnStack* promise_on_stack_ = nullptr;
 
 #ifdef USE_SIMULATOR
-  Simulator* simulator_;
+  Simulator* simulator_ = nullptr;
 #endif
 
-  Address js_entry_sp_;  // the stack pointer of the bottom JS entry frame
-  // the external callback we're currently in
-  ExternalCallbackScope* external_callback_scope_;
-  StateTag current_vm_state_;
+  // The stack pointer of the bottom JS entry frame.
+  Address js_entry_sp_ = kNullAddress;
+  // The external callback we're currently in.
+  ExternalCallbackScope* external_callback_scope_ = nullptr;
+  StateTag current_vm_state_ = EXTERNAL;
 
   // Call back function to report unsafe JS accesses.
-  v8::FailedAccessCheckCallback failed_access_check_callback_;
+  v8::FailedAccessCheckCallback failed_access_check_callback_ = nullptr;
 
  private:
-  void InitializeInternal();
-
-  v8::TryCatch* try_catch_handler_;
+  v8::TryCatch* try_catch_handler_ = nullptr;
 };
 
 
@@ -1949,72 +1951,6 @@ class SafeForInterruptsScope : public InterruptsScope {
   virtual ~SafeForInterruptsScope() = default;
 };
 
-class CodeTracer final : public Malloced {
- public:
-  explicit CodeTracer(int isolate_id) : file_(nullptr), scope_depth_(0) {
-    if (!ShouldRedirect()) {
-      file_ = stdout;
-      return;
-    }
-
-    if (FLAG_redirect_code_traces_to == nullptr) {
-      SNPrintF(filename_,
-               "code-%d-%d.asm",
-               base::OS::GetCurrentProcessId(),
-               isolate_id);
-    } else {
-      StrNCpy(filename_, FLAG_redirect_code_traces_to, filename_.length());
-    }
-
-    WriteChars(filename_.start(), "", 0, false);
-  }
-
-  class Scope {
-   public:
-    explicit Scope(CodeTracer* tracer) : tracer_(tracer) { tracer->OpenFile(); }
-    ~Scope() { tracer_->CloseFile();  }
-
-    FILE* file() const { return tracer_->file(); }
-
-   private:
-    CodeTracer* tracer_;
-  };
-
-  void OpenFile() {
-    if (!ShouldRedirect()) {
-      return;
-    }
-
-    if (file_ == nullptr) {
-      file_ = base::OS::FOpen(filename_.start(), "ab");
-    }
-
-    scope_depth_++;
-  }
-
-  void CloseFile() {
-    if (!ShouldRedirect()) {
-      return;
-    }
-
-    if (--scope_depth_ == 0) {
-      fclose(file_);
-      file_ = nullptr;
-    }
-  }
-
-  FILE* file() const { return file_; }
-
- private:
-  static bool ShouldRedirect() {
-    return FLAG_redirect_code_traces;
-  }
-
-  EmbeddedVector<char, 128> filename_;
-  FILE* file_;
-  int scope_depth_;
-};
-
 class StackTraceFailureMessage {
  public:
   explicit StackTraceFailureMessage(Isolate* isolate, void* ptr1 = nullptr,
diff --git a/deps/v8/src/js/array.js b/deps/v8/src/js/array.js
index fa819be8393a38..35db963d1838f1 100644
--- a/deps/v8/src/js/array.js
+++ b/deps/v8/src/js/array.js
@@ -58,24 +58,26 @@ function GetSortedArrayKeys(array, indices) {
 }
 
 
-function SparseJoinWithSeparatorJS(array, keys, length, use_locale, separator) {
+function SparseJoinWithSeparatorJS(
+    array, keys, length, use_locale, separator, locales, options) {
   var keys_length = keys.length;
   var elements = new InternalArray(keys_length * 2);
   for (var i = 0; i < keys_length; i++) {
     var key = keys[i];
     elements[i * 2] = key;
-    elements[i * 2 + 1] = ConvertToString(use_locale, array[key]);
+    elements[i * 2 + 1] = ConvertToString(
+        use_locale, array[key], locales, options);
   }
   return %SparseJoinWithSeparator(elements, length, separator);
 }
 
 
 // Optimized for sparse arrays if separator is ''.
-function SparseJoin(array, keys, use_locale) {
+function SparseJoin(array, keys, use_locale, locales, options) {
   var keys_length = keys.length;
   var elements = new InternalArray(keys_length);
   for (var i = 0; i < keys_length; i++) {
-    elements[i] = ConvertToString(use_locale, array[keys[i]]);
+    elements[i] = ConvertToString(use_locale, array[keys[i]], locales, options);
   }
   return %StringBuilderConcat(elements, keys_length, '');
 }
@@ -128,28 +130,29 @@ function StackHas(stack, v) {
 // join invocations.
 var visited_arrays = new Stack();
 
-function DoJoin(array, length, is_array, separator, use_locale) {
+function DoJoin(
+    array, length, is_array, separator, use_locale, locales, options) {
   if (UseSparseVariant(array, length, is_array, length)) {
     %NormalizeElements(array);
     var keys = GetSortedArrayKeys(array, %GetArrayKeys(array, length));
     if (separator === '') {
       if (keys.length === 0) return '';
-      return SparseJoin(array, keys, use_locale);
+      return SparseJoin(array, keys, use_locale, locales, options);
     } else {
       return SparseJoinWithSeparatorJS(
-          array, keys, length, use_locale, separator);
+          array, keys, length, use_locale, separator, locales, options);
     }
   }
 
   // Fast case for one-element arrays.
   if (length === 1) {
-    return ConvertToString(use_locale, array[0]);
+    return ConvertToString(use_locale, array[0], locales, options);
   }
 
   // Construct an array for the elements.
   var elements = new InternalArray(length);
   for (var i = 0; i < length; i++) {
-    elements[i] = ConvertToString(use_locale, array[i]);
+    elements[i] = ConvertToString(use_locale, array[i], locales, options);
   }
 
   if (separator === '') {
@@ -159,7 +162,7 @@ function DoJoin(array, length, is_array, separator, use_locale) {
   }
 }
 
-function Join(array, length, separator, use_locale) {
+function Join(array, length, separator, use_locale, locales, options) {
   if (length === 0) return '';
 
   var is_array = IS_ARRAY(array);
@@ -173,7 +176,8 @@ function Join(array, length, separator, use_locale) {
 
   // Attempt to convert the elements.
   try {
-    return DoJoin(array, length, is_array, separator, use_locale);
+    return DoJoin(
+        array, length, is_array, separator, use_locale, locales, options);
   } finally {
     // Make sure to remove the last element of the visited array no
     // matter what happens.
@@ -182,9 +186,18 @@ function Join(array, length, separator, use_locale) {
 }
 
 
-function ConvertToString(use_locale, x) {
+function ConvertToString(use_locale, x, locales, options) {
   if (IS_NULL_OR_UNDEFINED(x)) return '';
-  return TO_STRING(use_locale ? x.toLocaleString() : x);
+  if (use_locale) {
+    if (IS_NULL_OR_UNDEFINED(locales)) {
+      return TO_STRING(x.toLocaleString());
+    } else if (IS_NULL_OR_UNDEFINED(options)) {
+      return TO_STRING(x.toLocaleString(locales));
+    }
+    return TO_STRING(x.toLocaleString(locales, options));
+  }
+
+  return TO_STRING(x);
 }
 
 
@@ -347,17 +360,21 @@ DEFINE_METHOD(
   }
 );
 
-function InnerArrayToLocaleString(array, length) {
-  return Join(array, TO_LENGTH(length), ',', true);
+// ecma402 #sup-array.prototype.tolocalestring
+function InnerArrayToLocaleString(array, length, locales, options) {
+  return Join(array, TO_LENGTH(length), ',', true, locales, options);
 }
 
 
 DEFINE_METHOD(
   GlobalArray.prototype,
+  // ecma402 #sup-array.prototype.tolocalestring
   toLocaleString() {
     var array = TO_OBJECT(this);
     var arrayLen = array.length;
-    return InnerArrayToLocaleString(array, arrayLen);
+    var locales = arguments[0];
+    var options = arguments[1];
+    return InnerArrayToLocaleString(array, arrayLen, locales, options);
   }
 );
 
diff --git a/deps/v8/src/js/intl.js b/deps/v8/src/js/intl.js
index c02c4fa97d18a4..82c28f79e0c9f4 100644
--- a/deps/v8/src/js/intl.js
+++ b/deps/v8/src/js/intl.js
@@ -29,6 +29,7 @@ var GlobalIntlv8BreakIterator = GlobalIntl.v8BreakIterator;
 var GlobalNumber = global.Number;
 var GlobalRegExp = global.RegExp;
 var GlobalString = global.String;
+var GlobalArray = global.Array;
 var IntlFallbackSymbol = utils.ImportNow("intl_fallback_symbol");
 var InternalArray = utils.InternalArray;
 var MathMax = global.Math.max;
@@ -38,6 +39,7 @@ var patternSymbol = utils.ImportNow("intl_pattern_symbol");
 var resolvedSymbol = utils.ImportNow("intl_resolved_symbol");
 var StringSubstr = GlobalString.prototype.substr;
 var StringSubstring = GlobalString.prototype.substring;
+var ArraySlice = GlobalArray.prototype.slice;
 
 utils.Import(function(from) {
   ArrayJoin = from.ArrayJoin;
@@ -1207,8 +1209,7 @@ DEFINE_METHOD(
     }
 
     defineWECProperty(result, 'pluralCategories',
-                      this[resolvedSymbol].pluralCategories);
-
+        %_Call(ArraySlice, this[resolvedSymbol].pluralCategories));
     return result;
   }
 );
diff --git a/deps/v8/src/js/typedarray.js b/deps/v8/src/js/typedarray.js
index 3d42498b035126..2c25b6c58a17ca 100644
--- a/deps/v8/src/js/typedarray.js
+++ b/deps/v8/src/js/typedarray.js
@@ -59,14 +59,16 @@ function ValidateTypedArray(array, methodName) {
 
 
 // ES6 section 22.2.3.27
+// ecma402 #sup-array.prototype.tolocalestring
 DEFINE_METHOD(
   GlobalTypedArray.prototype,
   toLocaleString() {
     ValidateTypedArray(this, "%TypedArray%.prototype.toLocaleString");
 
+    var locales = arguments[0];
+    var options = arguments[1];
     var length = %_TypedArrayGetLength(this);
-
-    return InnerArrayToLocaleString(this, length);
+    return InnerArrayToLocaleString(this, length, locales, options);
   }
 );
 
diff --git a/deps/v8/src/json-parser.cc b/deps/v8/src/json-parser.cc
index d7205891cbd34d..28819c4cd04729 100644
--- a/deps/v8/src/json-parser.cc
+++ b/deps/v8/src/json-parser.cc
@@ -69,7 +69,8 @@ MaybeHandle<Object> JsonParseInternalizer::InternalizeJsonProperty(
   HandleScope outer_scope(isolate_);
   Handle<Object> value;
   ASSIGN_RETURN_ON_EXCEPTION(
-      isolate_, value, Object::GetPropertyOrElement(holder, name), Object);
+      isolate_, value, Object::GetPropertyOrElement(isolate_, holder, name),
+      Object);
   if (value->IsJSReceiver()) {
     Handle<JSReceiver> object = Handle<JSReceiver>::cast(value);
     Maybe<bool> is_array = Object::IsArray(object);
@@ -832,7 +833,8 @@ Handle<String> JsonParser<seq_one_byte>::ScanJsonString() {
 
     int position = position_;
     uc32 c0 = c0_;
-    uint32_t running_hash = isolate()->heap()->HashSeed();
+    uint32_t running_hash =
+        static_cast<uint32_t>(isolate()->heap()->HashSeed());
     uint32_t index = 0;
     bool is_array_index = true;
 
diff --git a/deps/v8/src/json-stringifier.cc b/deps/v8/src/json-stringifier.cc
index a0f74899ecb020..b1d95422b0c689 100644
--- a/deps/v8/src/json-stringifier.cc
+++ b/deps/v8/src/json-stringifier.cc
@@ -153,8 +153,8 @@ bool JsonStringifier::InitializeGap(Handle<Object> gap) {
       ASSIGN_RETURN_ON_EXCEPTION_VALUE(isolate_, gap,
                                        Object::ToString(isolate_, gap), false);
     } else if (value->IsNumber()) {
-      ASSIGN_RETURN_ON_EXCEPTION_VALUE(isolate_, gap, Object::ToNumber(gap),
-                                       false);
+      ASSIGN_RETURN_ON_EXCEPTION_VALUE(isolate_, gap,
+                                       Object::ToNumber(isolate_, gap), false);
     }
   }
 
@@ -198,7 +198,7 @@ MaybeHandle<Object> JsonStringifier::ApplyToJsonFunction(Handle<Object> object,
   // Retrieve toJSON function.
   Handle<Object> fun;
   {
-    LookupIterator it(object_for_lookup, tojson_string_,
+    LookupIterator it(isolate_, object_for_lookup, tojson_string_,
                       LookupIterator::PROTOTYPE_CHAIN_SKIP_INTERCEPTOR);
     ASSIGN_RETURN_ON_EXCEPTION(isolate_, fun, Object::GetProperty(&it), Object);
     if (!fun->IsCallable()) return object;
@@ -361,8 +361,8 @@ JsonStringifier::Result JsonStringifier::SerializeJSValue(
     SerializeString(Handle<String>::cast(value));
   } else if (raw->IsNumber()) {
     Handle<Object> value;
-    ASSIGN_RETURN_ON_EXCEPTION_VALUE(isolate_, value, Object::ToNumber(object),
-                                     EXCEPTION);
+    ASSIGN_RETURN_ON_EXCEPTION_VALUE(
+        isolate_, value, Object::ToNumber(isolate_, object), EXCEPTION);
     if (value->IsSmi()) return SerializeSmi(Smi::cast(*value));
     SerializeHeapNumber(Handle<HeapNumber>::cast(value));
   } else if (raw->IsBigInt()) {
@@ -547,8 +547,8 @@ JsonStringifier::Result JsonStringifier::SerializeJSObject(
                                             field_index);
       } else {
         ASSIGN_RETURN_ON_EXCEPTION_VALUE(
-            isolate_, property, Object::GetPropertyOrElement(js_obj, key),
-            EXCEPTION);
+            isolate_, property,
+            Object::GetPropertyOrElement(isolate_, js_obj, key), EXCEPTION);
       }
       Result result = SerializeProperty(property, comma, key);
       if (!comma && result == SUCCESS) comma = true;
@@ -582,9 +582,9 @@ JsonStringifier::Result JsonStringifier::SerializeJSReceiverSlow(
   for (int i = 0; i < contents->length(); i++) {
     Handle<String> key(String::cast(contents->get(i)), isolate_);
     Handle<Object> property;
-    ASSIGN_RETURN_ON_EXCEPTION_VALUE(isolate_, property,
-                                     Object::GetPropertyOrElement(object, key),
-                                     EXCEPTION);
+    ASSIGN_RETURN_ON_EXCEPTION_VALUE(
+        isolate_, property, Object::GetPropertyOrElement(isolate_, object, key),
+        EXCEPTION);
     Result result = SerializeProperty(property, comma, key);
     if (!comma && result == SUCCESS) comma = true;
     if (result == EXCEPTION) return result;
diff --git a/deps/v8/src/keys.h b/deps/v8/src/keys.h
index 649d6a95999fc7..7333d3663f38b2 100644
--- a/deps/v8/src/keys.h
+++ b/deps/v8/src/keys.h
@@ -12,6 +12,8 @@
 namespace v8 {
 namespace internal {
 
+class JSProxy;
+
 enum AddKeyConversion { DO_NOT_CONVERT, CONVERT_TO_ARRAY_INDEX };
 
 // This is a helper class for JSReceiver::GetKeys which collects and sorts keys.
diff --git a/deps/v8/src/layout-descriptor.cc b/deps/v8/src/layout-descriptor.cc
index 190237edafda15..684b7d5cd6296f 100644
--- a/deps/v8/src/layout-descriptor.cc
+++ b/deps/v8/src/layout-descriptor.cc
@@ -14,8 +14,8 @@ namespace v8 {
 namespace internal {
 
 Handle<LayoutDescriptor> LayoutDescriptor::New(
-    Handle<Map> map, Handle<DescriptorArray> descriptors, int num_descriptors) {
-  Isolate* isolate = descriptors->GetIsolate();
+    Isolate* isolate, Handle<Map> map, Handle<DescriptorArray> descriptors,
+    int num_descriptors) {
   if (!FLAG_unbox_double_fields) return handle(FastPointerLayout(), isolate);
 
   int layout_descriptor_length =
@@ -37,11 +37,9 @@ Handle<LayoutDescriptor> LayoutDescriptor::New(
   return handle(layout_descriptor, isolate);
 }
 
-
 Handle<LayoutDescriptor> LayoutDescriptor::ShareAppend(
-    Handle<Map> map, PropertyDetails details) {
+    Isolate* isolate, Handle<Map> map, PropertyDetails details) {
   DCHECK(map->owns_descriptors());
-  Isolate* isolate = map->GetIsolate();
   Handle<LayoutDescriptor> layout_descriptor(map->GetLayoutDescriptor(),
                                              isolate);
 
@@ -63,9 +61,8 @@ Handle<LayoutDescriptor> LayoutDescriptor::ShareAppend(
   return handle(layout_desc, isolate);
 }
 
-
 Handle<LayoutDescriptor> LayoutDescriptor::AppendIfFastOrUseFull(
-    Handle<Map> map, PropertyDetails details,
+    Isolate* isolate, Handle<Map> map, PropertyDetails details,
     Handle<LayoutDescriptor> full_layout_descriptor) {
   DisallowHeapAllocation no_allocation;
   LayoutDescriptor* layout_descriptor = map->layout_descriptor();
@@ -75,7 +72,7 @@ Handle<LayoutDescriptor> LayoutDescriptor::AppendIfFastOrUseFull(
   if (!InobjectUnboxedField(map->GetInObjectProperties(), details)) {
     DCHECK(details.location() != kField ||
            layout_descriptor->IsTagged(details.field_index()));
-    return handle(layout_descriptor, map->GetIsolate());
+    return handle(layout_descriptor, isolate);
   }
   int field_index = details.field_index();
   int new_capacity = field_index + details.field_width_in_words();
@@ -89,7 +86,7 @@ Handle<LayoutDescriptor> LayoutDescriptor::AppendIfFastOrUseFull(
   if (details.field_width_in_words() > 1) {
     layout_descriptor = layout_descriptor->SetRawData(field_index + 1);
   }
-  return handle(layout_descriptor, map->GetIsolate());
+  return handle(layout_descriptor, isolate);
 }
 
 
diff --git a/deps/v8/src/layout-descriptor.h b/deps/v8/src/layout-descriptor.h
index 623ae0508983fa..0e75096197867d 100644
--- a/deps/v8/src/layout-descriptor.h
+++ b/deps/v8/src/layout-descriptor.h
@@ -51,20 +51,20 @@ class LayoutDescriptor : public ByteArray {
   // Builds layout descriptor optimized for given |map| by |num_descriptors|
   // elements of given descriptors array. The |map|'s descriptors could be
   // different.
-  static Handle<LayoutDescriptor> New(Handle<Map> map,
+  static Handle<LayoutDescriptor> New(Isolate* isolate, Handle<Map> map,
                                       Handle<DescriptorArray> descriptors,
                                       int num_descriptors);
 
   // Modifies |map|'s layout descriptor or creates a new one if necessary by
   // appending property with |details| to it.
-  static Handle<LayoutDescriptor> ShareAppend(Handle<Map> map,
+  static Handle<LayoutDescriptor> ShareAppend(Isolate* isolate, Handle<Map> map,
                                               PropertyDetails details);
 
   // Creates new layout descriptor by appending property with |details| to
   // |map|'s layout descriptor and if it is still fast then returns it.
   // Otherwise the |full_layout_descriptor| is returned.
   static Handle<LayoutDescriptor> AppendIfFastOrUseFull(
-      Handle<Map> map, PropertyDetails details,
+      Isolate* isolate, Handle<Map> map, PropertyDetails details,
       Handle<LayoutDescriptor> full_layout_descriptor);
 
   // Layout descriptor that corresponds to an object all fields of which are
diff --git a/deps/v8/src/log.cc b/deps/v8/src/log.cc
index a1f3d38055b3da..77d68ef94eb6d5 100644
--- a/deps/v8/src/log.cc
+++ b/deps/v8/src/log.cc
@@ -191,8 +191,8 @@ class CodeEventLogger::NameBuffer {
   uc16 utf16_buffer[kUtf16BufferSize];
 };
 
-
-CodeEventLogger::CodeEventLogger() : name_buffer_(new NameBuffer) { }
+CodeEventLogger::CodeEventLogger(Isolate* isolate)
+    : isolate_(isolate), name_buffer_(new NameBuffer) {}
 
 CodeEventLogger::~CodeEventLogger() { delete name_buffer_; }
 
@@ -267,7 +267,7 @@ void CodeEventLogger::RegExpCodeCreateEvent(AbstractCode* code,
 // Linux perf tool logging support
 class PerfBasicLogger : public CodeEventLogger {
  public:
-  PerfBasicLogger();
+  explicit PerfBasicLogger(Isolate* isolate);
   ~PerfBasicLogger() override;
 
   void CodeMoveEvent(AbstractCode* from, Address to) override {}
@@ -293,7 +293,8 @@ const char PerfBasicLogger::kFilenameFormatString[] = "/tmp/perf-%d.map";
 // Extra space for the PID in the filename
 const int PerfBasicLogger::kFilenameBufferPadding = 16;
 
-PerfBasicLogger::PerfBasicLogger() : perf_output_handle_(nullptr) {
+PerfBasicLogger::PerfBasicLogger(Isolate* isolate)
+    : CodeEventLogger(isolate), perf_output_handle_(nullptr) {
   // Open the perf JIT dump file.
   int bufferSize = sizeof(kFilenameFormatString) + kFilenameBufferPadding;
   ScopedVector<char> perf_dump_name(bufferSize);
@@ -405,7 +406,8 @@ void ExternalCodeEventListener::CodeCreateEvent(
 void ExternalCodeEventListener::CodeCreateEvent(
     CodeEventListener::LogEventsAndTags tag, AbstractCode* code, Name* name) {
   Handle<String> name_string =
-      Name::ToFunctionName(Handle<Name>(name, isolate_)).ToHandleChecked();
+      Name::ToFunctionName(isolate_, Handle<Name>(name, isolate_))
+          .ToHandleChecked();
 
   CodeEvent code_event;
   code_event.code_start_address =
@@ -425,7 +427,8 @@ void ExternalCodeEventListener::CodeCreateEvent(
     CodeEventListener::LogEventsAndTags tag, AbstractCode* code,
     SharedFunctionInfo* shared, Name* name) {
   Handle<String> name_string =
-      Name::ToFunctionName(Handle<Name>(name, isolate_)).ToHandleChecked();
+      Name::ToFunctionName(isolate_, Handle<Name>(name, isolate_))
+          .ToHandleChecked();
 
   CodeEvent code_event;
   code_event.code_start_address =
@@ -445,10 +448,11 @@ void ExternalCodeEventListener::CodeCreateEvent(
     CodeEventListener::LogEventsAndTags tag, AbstractCode* code,
     SharedFunctionInfo* shared, Name* source, int line, int column) {
   Handle<String> name_string =
-      Name::ToFunctionName(Handle<Name>(shared->Name(), isolate_))
+      Name::ToFunctionName(isolate_, Handle<Name>(shared->Name(), isolate_))
           .ToHandleChecked();
   Handle<String> source_string =
-      Name::ToFunctionName(Handle<Name>(source, isolate_)).ToHandleChecked();
+      Name::ToFunctionName(isolate_, Handle<Name>(source, isolate_))
+          .ToHandleChecked();
 
   CodeEvent code_event;
   code_event.code_start_address =
@@ -489,7 +493,7 @@ void ExternalCodeEventListener::RegExpCodeCreateEvent(AbstractCode* code,
 // Low-level logging support.
 class LowLevelLogger : public CodeEventLogger {
  public:
-  explicit LowLevelLogger(const char* file_name);
+  LowLevelLogger(Isolate* isolate, const char* file_name);
   ~LowLevelLogger() override;
 
   void CodeMoveEvent(AbstractCode* from, Address to) override;
@@ -543,7 +547,8 @@ class LowLevelLogger : public CodeEventLogger {
 
 const char LowLevelLogger::kLogExt[] = ".ll";
 
-LowLevelLogger::LowLevelLogger(const char* name) : ll_output_handle_(nullptr) {
+LowLevelLogger::LowLevelLogger(Isolate* isolate, const char* name)
+    : CodeEventLogger(isolate), ll_output_handle_(nullptr) {
   // Open the low-level log file.
   size_t len = strlen(name);
   ScopedVector<char> ll_name(static_cast<int>(len + sizeof(kLogExt)));
@@ -634,7 +639,7 @@ void LowLevelLogger::CodeMovingGCEvent() {
 
 class JitLogger : public CodeEventLogger {
  public:
-  explicit JitLogger(JitCodeEventHandler code_event_handler);
+  JitLogger(Isolate* isolate, JitCodeEventHandler code_event_handler);
 
   void CodeMoveEvent(AbstractCode* from, Address to) override;
   void CodeDisableOptEvent(AbstractCode* code,
@@ -656,10 +661,8 @@ class JitLogger : public CodeEventLogger {
   base::Mutex logger_mutex_;
 };
 
-
-JitLogger::JitLogger(JitCodeEventHandler code_event_handler)
-    : code_event_handler_(code_event_handler) {
-}
+JitLogger::JitLogger(Isolate* isolate, JitCodeEventHandler code_event_handler)
+    : CodeEventLogger(isolate), code_event_handler_(code_event_handler) {}
 
 void JitLogger::LogRecordedBuffer(AbstractCode* code,
                                   SharedFunctionInfo* shared, const char* name,
@@ -679,6 +682,7 @@ void JitLogger::LogRecordedBuffer(AbstractCode* code,
   event.script = ToApiHandle<v8::UnboundScript>(shared_function_handle);
   event.name.str = name;
   event.name.len = length;
+  event.isolate = reinterpret_cast<v8::Isolate*>(isolate_);
   code_event_handler_(&event);
 }
 
@@ -692,6 +696,7 @@ void JitLogger::LogRecordedBuffer(const wasm::WasmCode* code, const char* name,
   event.code_len = code->instructions().length();
   event.name.str = name;
   event.name.len = length;
+  event.isolate = reinterpret_cast<v8::Isolate*>(isolate_);
   code_event_handler_(&event);
 }
 
@@ -710,6 +715,7 @@ void JitLogger::CodeMoveEvent(AbstractCode* from, Address to) {
 
   // Calculate the new start address of the instructions.
   event.new_code_start = reinterpret_cast<void*>(to + header_size);
+  event.isolate = reinterpret_cast<v8::Isolate*>(isolate_);
 
   code_event_handler_(&event);
 }
@@ -726,6 +732,7 @@ void JitLogger::AddCodeLinePosInfoEvent(
   event.line_info.offset = pc_offset;
   event.line_info.pos = position;
   event.line_info.position_type = position_type;
+  event.isolate = reinterpret_cast<v8::Isolate*>(isolate_);
 
   code_event_handler_(&event);
 }
@@ -735,6 +742,7 @@ void* JitLogger::StartCodePosInfoEvent() {
   JitCodeEvent event;
   memset(&event, 0, sizeof(event));
   event.type = JitCodeEvent::CODE_START_LINE_INFO_RECORDING;
+  event.isolate = reinterpret_cast<v8::Isolate*>(isolate_);
 
   code_event_handler_(&event);
   return event.user_data;
@@ -747,6 +755,7 @@ void JitLogger::EndCodePosInfoEvent(Address start_address,
   event.type = JitCodeEvent::CODE_END_LINE_INFO_RECORDING;
   event.code_start = reinterpret_cast<void*>(start_address);
   event.user_data = jit_handler_data;
+  event.isolate = reinterpret_cast<v8::Isolate*>(isolate_);
 
   code_event_handler_(&event);
 }
@@ -1546,25 +1555,18 @@ void Logger::FunctionEvent(const char* reason, int script_id, double time_delta,
   msg.WriteToLogFile();
 }
 
-namespace {
-void AppendCompilationCacheMessage(Log::MessageBuilder& msg,
+void Logger::CompilationCacheEvent(const char* action, const char* cache_type,
                                    SharedFunctionInfo* sfi) {
+  if (!log_->IsEnabled() || !FLAG_log_function_events) return;
+  Log::MessageBuilder msg(log_);
   int script_id = -1;
   if (sfi->script()->IsScript()) {
     script_id = Script::cast(sfi->script())->id();
   }
-  msg << script_id << Logger::kNext << sfi->StartPosition() << Logger::kNext
-      << sfi->EndPosition();
-}
-}  // namespace
-
-void Logger::CompilationCacheEvent(const char* action, const char* cache_type,
-                                   SharedFunctionInfo* sfi) {
-  if (!log_->IsEnabled() || !FLAG_log_function_events) return;
-  Log::MessageBuilder msg(log_);
   msg << "compilation-cache" << Logger::kNext << action << Logger::kNext
-      << cache_type << Logger::kNext;
-  AppendCompilationCacheMessage(msg, sfi);
+      << cache_type << Logger::kNext << script_id << Logger::kNext
+      << sfi->StartPosition() << Logger::kNext << sfi->EndPosition()
+      << Logger::kNext << timer_.Elapsed().InMicroseconds();
   msg.WriteToLogFile();
 }
 
@@ -1585,24 +1587,31 @@ void Logger::ScriptEvent(ScriptEventType type, int script_id) {
     case ScriptEventType::kBackgroundCompile:
       msg << "background-compile";
       break;
+    case ScriptEventType::kStreamingCompile:
+      msg << "streaming-compile";
+      break;
   }
-  msg << Logger::kNext << script_id;
+  msg << Logger::kNext << script_id << Logger::kNext
+      << timer_.Elapsed().InMicroseconds();
   msg.WriteToLogFile();
 }
 
 void Logger::ScriptDetails(Script* script) {
   if (!log_->IsEnabled() || !FLAG_log_function_events) return;
-  Log::MessageBuilder msg(log_);
-  msg << "script-details" << Logger::kNext << script->id() << Logger::kNext;
-  if (script->name()->IsString()) {
-    msg << String::cast(script->name());
-  }
-  msg << Logger::kNext << script->line_offset() << Logger::kNext
-      << script->column_offset() << Logger::kNext;
-  if (script->source_mapping_url()->IsString()) {
-    msg << String::cast(script->source_mapping_url());
+  {
+    Log::MessageBuilder msg(log_);
+    msg << "script-details" << Logger::kNext << script->id() << Logger::kNext;
+    if (script->name()->IsString()) {
+      msg << String::cast(script->name());
+    }
+    msg << Logger::kNext << script->line_offset() << Logger::kNext
+        << script->column_offset() << Logger::kNext;
+    if (script->source_mapping_url()->IsString()) {
+      msg << String::cast(script->source_mapping_url());
+    }
+    msg.WriteToLogFile();
   }
-  msg.WriteToLogFile();
+  EnsureLogScriptSource(script);
 }
 
 bool Logger::EnsureLogScriptSource(Script* script) {
@@ -1964,17 +1973,17 @@ bool Logger::SetUp(Isolate* isolate) {
   log_ = new Log(this, log_file_name.str().c_str());
 
   if (FLAG_perf_basic_prof) {
-    perf_basic_logger_ = new PerfBasicLogger();
+    perf_basic_logger_ = new PerfBasicLogger(isolate);
     AddCodeEventListener(perf_basic_logger_);
   }
 
   if (FLAG_perf_prof) {
-    perf_jit_logger_ = new PerfJitLogger();
+    perf_jit_logger_ = new PerfJitLogger(isolate);
     AddCodeEventListener(perf_jit_logger_);
   }
 
   if (FLAG_ll_prof) {
-    ll_logger_ = new LowLevelLogger(log_file_name.str().c_str());
+    ll_logger_ = new LowLevelLogger(isolate, log_file_name.str().c_str());
     AddCodeEventListener(ll_logger_);
   }
 
@@ -2009,7 +2018,7 @@ void Logger::SetCodeEventHandler(uint32_t options,
   }
 
   if (event_handler) {
-    jit_logger_ = new JitLogger(event_handler);
+    jit_logger_ = new JitLogger(isolate_, event_handler);
     AddCodeEventListener(jit_logger_);
     if (options & kJitCodeEventEnumExisting) {
       HandleScope scope(isolate_);
diff --git a/deps/v8/src/log.h b/deps/v8/src/log.h
index 97865dc0f5575b..485de0f4d17db7 100644
--- a/deps/v8/src/log.h
+++ b/deps/v8/src/log.h
@@ -128,7 +128,8 @@ class Logger : public CodeEventListener {
     kReserveId,
     kCreate,
     kDeserialize,
-    kBackgroundCompile
+    kBackgroundCompile,
+    kStreamingCompile
   };
 
   // The separator is used to write an unescaped "," into the log.
@@ -413,7 +414,7 @@ class TimerEventScope {
 
 class CodeEventLogger : public CodeEventListener {
  public:
-  CodeEventLogger();
+  explicit CodeEventLogger(Isolate* isolate);
   ~CodeEventLogger() override;
 
   void CodeCreateEvent(LogEventsAndTags tag, AbstractCode* code,
@@ -437,6 +438,9 @@ class CodeEventLogger : public CodeEventListener {
   void CodeDeoptEvent(Code* code, DeoptimizeKind kind, Address pc,
                       int fp_to_sp_delta) override {}
 
+ protected:
+  Isolate* isolate_;
+
  private:
   class NameBuffer;
 
@@ -449,6 +453,7 @@ class CodeEventLogger : public CodeEventListener {
 };
 
 struct CodeEvent {
+  Isolate* isolate_;
   uintptr_t code_start_address;
   size_t code_size;
   Handle<String> function_name;
diff --git a/deps/v8/src/lookup.cc b/deps/v8/src/lookup.cc
index 6d108f6edcfca2..32261c91d1ae62 100644
--- a/deps/v8/src/lookup.cc
+++ b/deps/v8/src/lookup.cc
@@ -29,7 +29,8 @@ LookupIterator LookupIterator::PropertyOrElement(
   if (!*success) {
     DCHECK(isolate->has_pending_exception());
     // Return an unusable dummy.
-    return LookupIterator(receiver, isolate->factory()->empty_string());
+    return LookupIterator(isolate, receiver,
+                          isolate->factory()->empty_string());
   }
 
   if (name->AsArrayIndex(&index)) {
@@ -61,7 +62,8 @@ LookupIterator LookupIterator::PropertyOrElement(Isolate* isolate,
   if (!*success) {
     DCHECK(isolate->has_pending_exception());
     // Return an unusable dummy.
-    return LookupIterator(receiver, isolate->factory()->empty_string());
+    return LookupIterator(isolate, receiver,
+                          isolate->factory()->empty_string());
   }
 
   if (name->AsArrayIndex(&index)) {
@@ -72,7 +74,7 @@ LookupIterator LookupIterator::PropertyOrElement(Isolate* isolate,
     return it;
   }
 
-  return LookupIterator(receiver, name, configuration);
+  return LookupIterator(isolate, receiver, name, configuration);
 }
 
 // TODO(ishell): Consider removing this way of LookupIterator creation.
@@ -84,7 +86,7 @@ LookupIterator LookupIterator::ForTransitionHandler(
   if (!maybe_transition_map.ToHandle(&transition_map) ||
       !transition_map->IsPrototypeValidityCellValid()) {
     // This map is not a valid transition handler, so full lookup is required.
-    return LookupIterator(receiver, name);
+    return LookupIterator(isolate, receiver, name);
   }
 
   PropertyDetails details = PropertyDetails::Empty();
@@ -513,7 +515,8 @@ void LookupIterator::ReconfigureDataProperty(Handle<Object> value,
       int enumeration_index = original_details.dictionary_index();
       DCHECK_GT(enumeration_index, 0);
       details = details.set_index(enumeration_index);
-      dictionary->SetEntry(dictionary_entry(), *name(), *value, details);
+      dictionary->SetEntry(isolate(), dictionary_entry(), *name(), *value,
+                           details);
       property_details_ = details;
     }
     state_ = DATA;
@@ -639,7 +642,7 @@ void LookupIterator::ApplyTransitionToDataProperty(
     if (receiver->map()->is_prototype_map() && receiver->IsJSObject()) {
       JSObject::InvalidatePrototypeChains(receiver->map());
     }
-    dictionary = NameDictionary::Add(dictionary, name(),
+    dictionary = NameDictionary::Add(isolate(), dictionary, name(),
                                      isolate_->factory()->uninitialized_value(),
                                      property_details_, &entry);
     receiver->SetProperties(*dictionary);
@@ -736,7 +739,7 @@ void LookupIterator::TransitionToAccessorProperty(
         return;
       }
     } else {
-      pair = AccessorPair::Copy(pair);
+      pair = AccessorPair::Copy(isolate(), pair);
       pair->SetComponents(*getter, *setter);
     }
   } else {
@@ -766,8 +769,8 @@ void LookupIterator::TransitionToAccessorPair(Handle<Object> pair,
     isolate_->CountUsage(v8::Isolate::kIndexAccessor);
     Handle<NumberDictionary> dictionary = JSObject::NormalizeElements(receiver);
 
-    dictionary =
-        NumberDictionary::Set(dictionary, index_, pair, receiver, details);
+    dictionary = NumberDictionary::Set(isolate_, dictionary, index_, pair,
+                                       receiver, details);
     receiver->RequireSlowElements(*dictionary);
 
     if (receiver->HasSlowArgumentsElements()) {
@@ -1064,7 +1067,7 @@ LookupIterator::State LookupIterator::LookupInSpecialHolder(
       if (!is_element && map->IsJSGlobalObjectMap()) {
         GlobalDictionary* dict =
             JSGlobalObject::cast(holder)->global_dictionary();
-        int number = dict->FindEntry(name_);
+        int number = dict->FindEntry(isolate(), name_);
         if (number == GlobalDictionary::kNotFound) return NOT_FOUND;
         number_ = static_cast<uint32_t>(number);
         PropertyCell* cell = dict->CellAt(number_);
@@ -1117,7 +1120,7 @@ LookupIterator::State LookupIterator::LookupInRegularHolder(
   } else {
     DCHECK_IMPLIES(holder->IsJSProxy(), name()->IsPrivate());
     NameDictionary* dict = holder->property_dictionary();
-    int number = dict->FindEntry(name_);
+    int number = dict->FindEntry(isolate(), name_);
     if (number == NameDictionary::kNotFound) return NotFound(holder);
     number_ = static_cast<uint32_t>(number);
     property_details_ = dict->DetailsAt(number_);
diff --git a/deps/v8/src/lookup.h b/deps/v8/src/lookup.h
index d2d4a8ed05f3d3..36ba78be27179e 100644
--- a/deps/v8/src/lookup.h
+++ b/deps/v8/src/lookup.h
@@ -44,10 +44,6 @@ class V8_EXPORT_PRIVATE LookupIterator final BASE_EMBEDDED {
     BEFORE_PROPERTY = INTERCEPTOR
   };
 
-  LookupIterator(Handle<Object> receiver, Handle<Name> name,
-                 Configuration configuration = DEFAULT)
-      : LookupIterator(name->GetIsolate(), receiver, name, configuration) {}
-
   LookupIterator(Isolate* isolate, Handle<Object> receiver, Handle<Name> name,
                  Configuration configuration = DEFAULT)
       : LookupIterator(isolate, receiver, name, GetRoot(isolate, receiver),
@@ -110,7 +106,7 @@ class V8_EXPORT_PRIVATE LookupIterator final BASE_EMBEDDED {
       it.name_ = name;
       return it;
     }
-    return LookupIterator(receiver, name, configuration);
+    return LookupIterator(isolate, receiver, name, configuration);
   }
 
   static LookupIterator PropertyOrElement(
diff --git a/deps/v8/src/map-updater.cc b/deps/v8/src/map-updater.cc
index 29a4eccb714bcc..3439c8122a31e6 100644
--- a/deps/v8/src/map-updater.cc
+++ b/deps/v8/src/map-updater.cc
@@ -383,7 +383,7 @@ MapUpdater::State MapUpdater::FindTargetMap() {
     }
 #endif
     if (*target_map_ != *old_map_) {
-      old_map_->NotifyLeafMapLayoutChange();
+      old_map_->NotifyLeafMapLayoutChange(isolate_);
     }
     result_map_ = target_map_;
     state_ = kEnd;
@@ -508,7 +508,8 @@ Handle<DescriptorArray> MapUpdater::BuildDescriptorArray() {
           isolate_, instance_type, &next_constness, &next_representation,
           &next_field_type);
 
-      MaybeObjectHandle wrapped_type(Map::WrapFieldType(next_field_type));
+      MaybeObjectHandle wrapped_type(
+          Map::WrapFieldType(isolate_, next_field_type));
       Descriptor d;
       if (next_kind == kData) {
         d = Descriptor::DataField(key, current_offset, next_attributes,
@@ -561,7 +562,8 @@ Handle<DescriptorArray> MapUpdater::BuildDescriptorArray() {
                     !Map::IsInplaceGeneralizableField(
                         next_constness, next_representation, *next_field_type));
 
-      MaybeObjectHandle wrapped_type(Map::WrapFieldType(next_field_type));
+      MaybeObjectHandle wrapped_type(
+          Map::WrapFieldType(isolate_, next_field_type));
       Descriptor d;
       if (next_kind == kData) {
         DCHECK_IMPLIES(!FLAG_track_constant_fields,
@@ -655,7 +657,7 @@ MapUpdater::State MapUpdater::ConstructNewMap() {
     return CopyGeneralizeAllFields("GenAll_CantHaveMoreTransitions");
   }
 
-  old_map_->NotifyLeafMapLayoutChange();
+  old_map_->NotifyLeafMapLayoutChange(isolate_);
 
   if (FLAG_trace_generalization && modified_descriptor_ >= 0) {
     PropertyDetails old_details =
@@ -689,7 +691,7 @@ MapUpdater::State MapUpdater::ConstructNewMap() {
   }
 
   Handle<LayoutDescriptor> new_layout_descriptor =
-      LayoutDescriptor::New(split_map, new_descriptors, old_nof_);
+      LayoutDescriptor::New(isolate_, split_map, new_descriptors, old_nof_);
 
   Handle<Map> new_map = Map::AddMissingTransitions(
       isolate_, split_map, new_descriptors, new_layout_descriptor);
diff --git a/deps/v8/src/messages.cc b/deps/v8/src/messages.cc
index 4fd27f98072adc..cb3180060873b7 100644
--- a/deps/v8/src/messages.cc
+++ b/deps/v8/src/messages.cc
@@ -1029,7 +1029,7 @@ Handle<String> MessageTemplate::FormatMessage(Isolate* isolate,
   Factory* factory = isolate->factory();
   Handle<String> result_string = Object::NoSideEffectsToString(isolate, arg);
   MaybeHandle<String> maybe_result_string = MessageTemplate::FormatMessage(
-      template_index, result_string, factory->empty_string(),
+      isolate, template_index, result_string, factory->empty_string(),
       factory->empty_string());
   if (!maybe_result_string.ToHandle(&result_string)) {
     DCHECK(isolate->has_pending_exception());
@@ -1058,12 +1058,11 @@ const char* MessageTemplate::TemplateString(int template_index) {
   }
 }
 
-
-MaybeHandle<String> MessageTemplate::FormatMessage(int template_index,
+MaybeHandle<String> MessageTemplate::FormatMessage(Isolate* isolate,
+                                                   int template_index,
                                                    Handle<String> arg0,
                                                    Handle<String> arg1,
                                                    Handle<String> arg2) {
-  Isolate* isolate = arg0->GetIsolate();
   const char* template_string = TemplateString(template_index);
   if (template_string == nullptr) {
     isolate->ThrowIllegalOperation();
@@ -1228,8 +1227,8 @@ Handle<String> FormatMessage(Isolate* isolate, int template_index,
   isolate->native_context()->IncrementErrorsThrown();
 
   Handle<String> msg;
-  if (!MessageTemplate::FormatMessage(template_index, arg0_str, arg1_str,
-                                      arg2_str)
+  if (!MessageTemplate::FormatMessage(isolate, template_index, arg0_str,
+                                      arg1_str, arg2_str)
            .ToHandle(&msg)) {
     DCHECK(isolate->has_pending_exception());
     isolate->clear_pending_exception();
diff --git a/deps/v8/src/messages.h b/deps/v8/src/messages.h
index 1d1a07d7b696f3..1bdd0673f52b39 100644
--- a/deps/v8/src/messages.h
+++ b/deps/v8/src/messages.h
@@ -372,6 +372,7 @@ class ErrorUtils : public AllStatic {
     "% is not a function or its return value is not iterable")                 \
   T(NotCallableOrAsyncIterable,                                                \
     "% is not a function or its return value is not async iterable")           \
+  T(NotFiniteNumber, "Value need to be finite number for %()")                 \
   T(NotIterable, "% is not iterable")                                          \
   T(NotAsyncIterable, "% is not async iterable")                               \
   T(NotPropertyName, "% is not a valid property name")                         \
@@ -770,7 +771,7 @@ class MessageTemplate {
 
   static const char* TemplateString(int template_index);
 
-  static MaybeHandle<String> FormatMessage(int template_index,
+  static MaybeHandle<String> FormatMessage(Isolate* isolate, int template_index,
                                            Handle<String> arg0,
                                            Handle<String> arg1,
                                            Handle<String> arg2);
diff --git a/deps/v8/src/mips/assembler-mips-inl.h b/deps/v8/src/mips/assembler-mips-inl.h
index 26860d961e2a3b..e9f84b61006921 100644
--- a/deps/v8/src/mips/assembler-mips-inl.h
+++ b/deps/v8/src/mips/assembler-mips-inl.h
@@ -311,13 +311,6 @@ void Assembler::CheckBuffer() {
 }
 
 
-void Assembler::CheckTrampolinePoolQuick(int extra_instructions) {
-  if (pc_offset() >= next_buffer_check_ - extra_instructions * kInstrSize) {
-    CheckTrampolinePool();
-  }
-}
-
-
 void Assembler::CheckForEmitInForbiddenSlot() {
   if (!is_buffer_growth_blocked()) {
     CheckBuffer();
diff --git a/deps/v8/src/mips/assembler-mips.cc b/deps/v8/src/mips/assembler-mips.cc
index 7b4fcb12edc229..2a5799f863be93 100644
--- a/deps/v8/src/mips/assembler-mips.cc
+++ b/deps/v8/src/mips/assembler-mips.cc
@@ -664,6 +664,19 @@ bool Assembler::IsOri(Instr instr) {
   return opcode == ORI;
 }
 
+bool Assembler::IsMov(Instr instr, Register rd, Register rs) {
+  uint32_t opcode = GetOpcodeField(instr);
+  uint32_t rd_field = GetRd(instr);
+  uint32_t rs_field = GetRs(instr);
+  uint32_t rt_field = GetRt(instr);
+  uint32_t rd_reg = static_cast<uint32_t>(rd.code());
+  uint32_t rs_reg = static_cast<uint32_t>(rs.code());
+  uint32_t function_field = GetFunctionField(instr);
+  // Checks if the instruction is a OR with zero_reg argument (aka MOV).
+  bool res = opcode == SPECIAL && function_field == OR && rd_field == rd_reg &&
+             rs_field == rs_reg && rt_field == 0;
+  return res;
+}
 
 bool Assembler::IsNop(Instr instr, unsigned int type) {
   // See Assembler::nop(type).
@@ -898,10 +911,38 @@ void Assembler::target_at_put(int32_t pos, int32_t target_pos,
     return;
   }
 
-  DCHECK(IsBranch(instr) || IsLui(instr));
+  DCHECK(IsBranch(instr) || IsLui(instr) || IsMov(instr, t8, ra));
   if (IsBranch(instr)) {
     instr = SetBranchOffset(pos, target_pos, instr);
     instr_at_put(pos, instr);
+  } else if (IsMov(instr, t8, ra)) {
+    Instr instr_lui = instr_at(pos + 4 * Assembler::kInstrSize);
+    Instr instr_ori = instr_at(pos + 5 * Assembler::kInstrSize);
+    DCHECK(IsLui(instr_lui));
+    DCHECK(IsOri(instr_ori));
+
+    int32_t imm_short = target_pos - (pos + Assembler::kBranchPCOffset);
+
+    if (is_int16(imm_short)) {
+      // Optimize by converting to regular branch with 16-bit
+      // offset
+      Instr instr_b = BEQ;
+      instr_b = SetBranchOffset(pos, target_pos, instr_b);
+
+      instr_at_put(pos, instr_b);
+      instr_at_put(pos + 1 * Assembler::kInstrSize, 0);
+    } else {
+      int32_t imm = target_pos - (pos + Assembler::kLongBranchPCOffset);
+      DCHECK_EQ(imm & 3, 0);
+
+      instr_lui &= ~kImm16Mask;
+      instr_ori &= ~kImm16Mask;
+
+      instr_at_put(pos + 4 * Assembler::kInstrSize,
+                   instr_lui | ((imm >> 16) & kImm16Mask));
+      instr_at_put(pos + 5 * Assembler::kInstrSize,
+                   instr_ori | (imm & kImm16Mask));
+    }
   } else {
     Instr instr1 = instr_at(pos + 0 * Assembler::kInstrSize);
     Instr instr2 = instr_at(pos + 1 * Assembler::kInstrSize);
@@ -3785,49 +3826,37 @@ void Assembler::CheckTrampolinePool() {
         bc(&after_pool);
       } else {
         b(&after_pool);
-        nop();
       }
+      nop();
 
       int pool_start = pc_offset();
-      if (IsMipsArchVariant(kMips32r6)) {
-        for (int i = 0; i < unbound_labels_count_; i++) {
-          uint32_t imm32;
-          imm32 = jump_address(&after_pool);
-          uint32_t lui_offset, jic_offset;
-          UnpackTargetAddressUnsigned(imm32, lui_offset, jic_offset);
-          {
-            BlockGrowBufferScope block_buf_growth(this);
-            // Buffer growth (and relocation) must be blocked for internal
-            // references until associated instructions are emitted and
-            // available to be patched.
-            RecordRelocInfo(RelocInfo::INTERNAL_REFERENCE_ENCODED);
-            UseScratchRegisterScope temps(this);
-            Register scratch = temps.hasAvailable() ? temps.Acquire() : t8;
-            lui(scratch, lui_offset);
-            jic(scratch, jic_offset);
-          }
-          CheckBuffer();
-        }
-      } else {
-        for (int i = 0; i < unbound_labels_count_; i++) {
-          uint32_t imm32;
-          imm32 = jump_address(&after_pool);
-          UseScratchRegisterScope temps(this);
-          Register scratch = temps.hasAvailable() ? temps.Acquire() : t8;
-          {
-            BlockGrowBufferScope block_buf_growth(this);
-            // Buffer growth (and relocation) must be blocked for internal
-            // references until associated instructions are emitted and
-            // available to be patched.
-            RecordRelocInfo(RelocInfo::INTERNAL_REFERENCE_ENCODED);
-            lui(scratch, (imm32 & kHiMask) >> kLuiShift);
-            ori(scratch, scratch, (imm32 & kImm16Mask));
+      for (int i = 0; i < unbound_labels_count_; i++) {
+        {
+          // printf("Generate trampoline %d\n", i);
+          // Buffer growth (and relocation) must be blocked for internal
+          // references until associated instructions are emitted and
+          // available to be patched.
+          if (IsMipsArchVariant(kMips32r6)) {
+            bc(&after_pool);
+            nop();
+          } else {
+            Label find_pc;
+            or_(t8, ra, zero_reg);
+            bal(&find_pc);
+            or_(t9, ra, zero_reg);
+            bind(&find_pc);
+            or_(ra, t8, zero_reg);
+            lui(t8, 0);
+            ori(t8, t8, 0);
+            addu(t9, t9, t8);
+            // Instruction jr will take or_ from the next trampoline.
+            // in its branch delay slot. This is the expected behavior
+            // in order to decrease size of trampoline pool.
+            jr(t9);
           }
-          CheckBuffer();
-          jr(scratch);
-          nop();
         }
       }
+      nop();
       bind(&after_pool);
       trampoline_ = Trampoline(pool_start, unbound_labels_count_);
 
diff --git a/deps/v8/src/mips/assembler-mips.h b/deps/v8/src/mips/assembler-mips.h
index 8a46b811f1b142..ea34e7a440722a 100644
--- a/deps/v8/src/mips/assembler-mips.h
+++ b/deps/v8/src/mips/assembler-mips.h
@@ -612,6 +612,11 @@ class Assembler : public AssemblerBase {
   // Difference between address of current opcode and target address offset.
   static constexpr int kBranchPCOffset = 4;
 
+  // Difference between address of current opcode and target address offset,
+  // when we are generatinga sequence of instructions for long relative PC
+  // branches
+  static constexpr int kLongBranchPCOffset = 12;
+
   // Here we are patching the address in the LUI/ORI instruction pair.
   // These values are used in the serialization process and must be zero for
   // MIPS platform, as Code, Embedded Object or External-reference pointers
@@ -644,11 +649,8 @@ class Assembler : public AssemblerBase {
   // Max offset for compact branch instructions with 26-bit offset field
   static constexpr int kMaxCompactBranchOffset = (1 << (28 - 1)) - 1;
 
-#ifdef _MIPS_ARCH_MIPS32R6
-  static constexpr int kTrampolineSlotsSize = 2 * kInstrSize;
-#else
-  static constexpr int kTrampolineSlotsSize = 4 * kInstrSize;
-#endif
+  static constexpr int kTrampolineSlotsSize =
+      IsMipsArchVariant(kMips32r6) ? 2 * kInstrSize : 8 * kInstrSize;
 
   RegList* GetScratchRegisterList() { return &scratch_register_list_; }
 
@@ -1765,6 +1767,7 @@ class Assembler : public AssemblerBase {
   static bool IsBeqc(Instr instr);
   static bool IsBnec(Instr instr);
   static bool IsJicOrJialc(Instr instr);
+  static bool IsMov(Instr instr, Register rd, Register rs);
 
   static bool IsJump(Instr instr);
   static bool IsJ(Instr instr);
@@ -1881,6 +1884,9 @@ class Assembler : public AssemblerBase {
 
   void EndBlockTrampolinePool() {
     trampoline_pool_blocked_nesting_--;
+    if (trampoline_pool_blocked_nesting_ == 0) {
+      CheckTrampolinePoolQuick(1);
+    }
   }
 
   bool is_trampoline_pool_blocked() const {
@@ -1916,7 +1922,11 @@ class Assembler : public AssemblerBase {
     }
   }
 
-  inline void CheckTrampolinePoolQuick(int extra_instructions = 0);
+  inline void CheckTrampolinePoolQuick(int extra_instructions = 0) {
+    if (pc_offset() >= next_buffer_check_ - extra_instructions * kInstrSize) {
+      CheckTrampolinePool();
+    }
+  }
 
   inline void CheckBuffer();
 
diff --git a/deps/v8/src/mips/macro-assembler-mips.cc b/deps/v8/src/mips/macro-assembler-mips.cc
index 9ed119c28d3b88..c254e4a78e0aac 100644
--- a/deps/v8/src/mips/macro-assembler-mips.cc
+++ b/deps/v8/src/mips/macro-assembler-mips.cc
@@ -212,6 +212,7 @@ void MacroAssembler::RecordWriteField(Register object, int offset,
 
   Addu(dst, object, Operand(offset - kHeapObjectTag));
   if (emit_debug_code()) {
+    BlockTrampolinePoolScope block_trampoline_pool(this);
     Label ok;
     And(t8, dst, Operand(kPointerSize - 1));
     Branch(&ok, eq, t8, Operand(zero_reg));
@@ -799,6 +800,7 @@ void TurboAssembler::Slt(Register rd, Register rs, const Operand& rt) {
       slti(rd, rs, rt.immediate());
     } else {
       // li handles the relocation.
+      BlockTrampolinePoolScope block_trampoline_pool(this);
       UseScratchRegisterScope temps(this);
       Register scratch = rd == at ? t8 : temps.Acquire();
       DCHECK(rs != scratch);
@@ -822,6 +824,7 @@ void TurboAssembler::Sltu(Register rd, Register rs, const Operand& rt) {
       sltiu(rd, rs, static_cast<uint16_t>(rt.immediate()));
     } else {
       // li handles the relocation.
+      BlockTrampolinePoolScope block_trampoline_pool(this);
       UseScratchRegisterScope temps(this);
       Register scratch = rd == at ? t8 : temps.Acquire();
       DCHECK(rs != scratch);
@@ -836,6 +839,7 @@ void TurboAssembler::Sle(Register rd, Register rs, const Operand& rt) {
     slt(rd, rt.rm(), rs);
   } else {
     // li handles the relocation.
+    BlockTrampolinePoolScope block_trampoline_pool(this);
     UseScratchRegisterScope temps(this);
     Register scratch = temps.hasAvailable() ? temps.Acquire() : t8;
     DCHECK(rs != scratch);
@@ -850,6 +854,7 @@ void TurboAssembler::Sleu(Register rd, Register rs, const Operand& rt) {
     sltu(rd, rt.rm(), rs);
   } else {
     // li handles the relocation.
+    BlockTrampolinePoolScope block_trampoline_pool(this);
     UseScratchRegisterScope temps(this);
     Register scratch = temps.hasAvailable() ? temps.Acquire() : t8;
     DCHECK(rs != scratch);
@@ -874,6 +879,7 @@ void TurboAssembler::Sgt(Register rd, Register rs, const Operand& rt) {
     slt(rd, rt.rm(), rs);
   } else {
     // li handles the relocation.
+    BlockTrampolinePoolScope block_trampoline_pool(this);
     UseScratchRegisterScope temps(this);
     Register scratch = temps.hasAvailable() ? temps.Acquire() : t8;
     DCHECK(rs != scratch);
@@ -887,6 +893,7 @@ void TurboAssembler::Sgtu(Register rd, Register rs, const Operand& rt) {
     sltu(rd, rt.rm(), rs);
   } else {
     // li handles the relocation.
+    BlockTrampolinePoolScope block_trampoline_pool(this);
     UseScratchRegisterScope temps(this);
     Register scratch = temps.hasAvailable() ? temps.Acquire() : t8;
     DCHECK(rs != scratch);
@@ -904,6 +911,7 @@ void TurboAssembler::Ror(Register rd, Register rs, const Operand& rt) {
     }
   } else {
     if (rt.is_reg()) {
+      BlockTrampolinePoolScope block_trampoline_pool(this);
       UseScratchRegisterScope temps(this);
       Register scratch = temps.hasAvailable() ? temps.Acquire() : t8;
       subu(scratch, zero_reg, rt.rm());
@@ -995,6 +1003,7 @@ void TurboAssembler::ByteSwapSigned(Register dest, Register src,
       sll(dest, dest, 16);
       sra(dest, dest, 16);
     } else {
+      BlockTrampolinePoolScope block_trampoline_pool(this);
       Register tmp = at;
       Register tmp2 = t8;
       DCHECK(dest != tmp && dest != tmp2);
@@ -1275,6 +1284,7 @@ void TurboAssembler::Sdc1(FPURegister fd, const MemOperand& src) {
       swc1(nextfpreg,
            MemOperand(tmp.rm(), tmp.offset() + Register::kExponentOffset));
     } else {
+      BlockTrampolinePoolScope block_trampoline_pool(this);
       DCHECK(IsFp64Mode() || IsFpxxMode());
       // Currently we support FPXX and FP64 on Mips32r2 and Mips32r6
       DCHECK(IsMipsArchVariant(kMips32r2) || IsMipsArchVariant(kMips32r6));
@@ -1653,6 +1663,7 @@ void TurboAssembler::Ins(Register rt, Register rs, uint16_t pos,
     ins_(rt, rs, pos, size);
   } else {
     DCHECK(rt != t8 && rs != t8);
+    BlockTrampolinePoolScope block_trampoline_pool(this);
     UseScratchRegisterScope temps(this);
     Register scratch = temps.Acquire();
     Subu(scratch, zero_reg, Operand(1));
@@ -1824,6 +1835,7 @@ void TurboAssembler::Trunc_uw_s(FPURegister fd, FPURegister fs,
 
 void TurboAssembler::Trunc_w_d(FPURegister fd, FPURegister fs) {
   if (IsMipsArchVariant(kLoongson) && fd == fs) {
+    BlockTrampolinePoolScope block_trampoline_pool(this);
     Mfhc1(t8, fs);
     trunc_w_d(fd, fs);
     Mthc1(t8, fs);
@@ -1834,6 +1846,7 @@ void TurboAssembler::Trunc_w_d(FPURegister fd, FPURegister fs) {
 
 void TurboAssembler::Round_w_d(FPURegister fd, FPURegister fs) {
   if (IsMipsArchVariant(kLoongson) && fd == fs) {
+    BlockTrampolinePoolScope block_trampoline_pool(this);
     Mfhc1(t8, fs);
     round_w_d(fd, fs);
     Mthc1(t8, fs);
@@ -1844,6 +1857,7 @@ void TurboAssembler::Round_w_d(FPURegister fd, FPURegister fs) {
 
 void TurboAssembler::Floor_w_d(FPURegister fd, FPURegister fs) {
   if (IsMipsArchVariant(kLoongson) && fd == fs) {
+    BlockTrampolinePoolScope block_trampoline_pool(this);
     Mfhc1(t8, fs);
     floor_w_d(fd, fs);
     Mthc1(t8, fs);
@@ -1854,6 +1868,7 @@ void TurboAssembler::Floor_w_d(FPURegister fd, FPURegister fs) {
 
 void TurboAssembler::Ceil_w_d(FPURegister fd, FPURegister fs) {
   if (IsMipsArchVariant(kLoongson) && fd == fs) {
+    BlockTrampolinePoolScope block_trampoline_pool(this);
     Mfhc1(t8, fs);
     ceil_w_d(fd, fs);
     Mthc1(t8, fs);
@@ -2314,6 +2329,7 @@ void TurboAssembler::Move(FPURegister dst, uint64_t src) {
 
 void TurboAssembler::LoadZeroOnCondition(Register rd, Register rs,
                                          const Operand& rt, Condition cond) {
+  BlockTrampolinePoolScope block_trampoline_pool(this);
   switch (cond) {
     case cc_always:
       mov(rd, zero_reg);
@@ -2463,6 +2479,7 @@ void TurboAssembler::Movn(Register rd, Register rs, Register rt) {
 
 void TurboAssembler::Movt(Register rd, Register rs, uint16_t cc) {
   if (IsMipsArchVariant(kLoongson)) {
+    BlockTrampolinePoolScope block_trampoline_pool(this);
     // Tests an FP condition code and then conditionally move rs to rd.
     // We do not currently use any FPU cc bit other than bit 0.
     DCHECK_EQ(cc, 0);
@@ -2488,6 +2505,7 @@ void TurboAssembler::Movt(Register rd, Register rs, uint16_t cc) {
 
 void TurboAssembler::Movf(Register rd, Register rs, uint16_t cc) {
   if (IsMipsArchVariant(kLoongson)) {
+    BlockTrampolinePoolScope block_trampoline_pool(this);
     // Tests an FP condition code and then conditionally move rs to rd.
     // We do not currently use any FPU cc bit other than bit 0.
     DCHECK_EQ(cc, 0);
@@ -2513,6 +2531,7 @@ void TurboAssembler::Movf(Register rd, Register rs, uint16_t cc) {
 
 void TurboAssembler::Clz(Register rd, Register rs) {
   if (IsMipsArchVariant(kLoongson)) {
+    BlockTrampolinePoolScope block_trampoline_pool(this);
     DCHECK(rd != t8 && rd != t9 && rs != t8 && rs != t9);
     Register mask = t8;
     Register scratch = t9;
@@ -2589,6 +2608,7 @@ void TurboAssembler::Popcnt(Register rd, Register rs) {
   uint32_t B2 = 0x0F0F0F0F;     // (T)~(T)0/255*15
   uint32_t value = 0x01010101;  // (T)~(T)0/255
   uint32_t shift = 24;          // (sizeof(T) - 1) * BITS_PER_BYTE
+  BlockTrampolinePoolScope block_trampoline_pool(this);
   UseScratchRegisterScope temps(this);
   Register scratch = temps.Acquire();
   Register scratch2 = t8;
@@ -2677,6 +2697,7 @@ void MacroAssembler::EmitFPUTruncate(FPURoundingMode rounding_mode,
 void TurboAssembler::TryInlineTruncateDoubleToI(Register result,
                                                 DoubleRegister double_input,
                                                 Label* done) {
+  BlockTrampolinePoolScope block_trampoline_pool(this);
   DoubleRegister single_scratch = kScratchDoubleReg.low();
   UseScratchRegisterScope temps(this);
   Register scratch = temps.Acquire();
@@ -3749,6 +3770,7 @@ void TurboAssembler::Jump(Handle<Code> code, RelocInfo::Mode rmode,
                           Condition cond, Register rs, const Operand& rt,
                           BranchDelaySlot bd) {
   DCHECK(RelocInfo::IsCodeTarget(rmode));
+  BlockTrampolinePoolScope block_trampoline_pool(this);
   if (FLAG_embedded_builtins) {
     if (root_array_available_ && options().isolate_independent_code) {
       IndirectLoadConstant(t9, code);
@@ -4526,6 +4548,7 @@ bool TurboAssembler::AllowThisStubCall(CodeStub* stub) {
 
 void TurboAssembler::AddOverflow(Register dst, Register left,
                                  const Operand& right, Register overflow) {
+  BlockTrampolinePoolScope block_trampoline_pool(this);
   Register right_reg = no_reg;
   Register scratch = t8;
   if (!right.is_reg()) {
@@ -4555,6 +4578,7 @@ void TurboAssembler::AddOverflow(Register dst, Register left,
 
 void TurboAssembler::SubOverflow(Register dst, Register left,
                                  const Operand& right, Register overflow) {
+  BlockTrampolinePoolScope block_trampoline_pool(this);
   Register right_reg = no_reg;
   Register scratch = t8;
   if (!right.is_reg()) {
@@ -4584,6 +4608,7 @@ void TurboAssembler::SubOverflow(Register dst, Register left,
 
 void TurboAssembler::MulOverflow(Register dst, Register left,
                                  const Operand& right, Register overflow) {
+  BlockTrampolinePoolScope block_trampoline_pool(this);
   Register right_reg = no_reg;
   Register scratch = t8;
   Register scratch2 = t9;
@@ -4772,6 +4797,7 @@ void TurboAssembler::StubPrologue(StackFrame::Type type) {
 void TurboAssembler::Prologue() { PushStandardFrame(a1); }
 
 void TurboAssembler::EnterFrame(StackFrame::Type type) {
+  BlockTrampolinePoolScope block_trampoline_pool(this);
   int stack_offset = -3 * kPointerSize;
   const int fp_offset = 1 * kPointerSize;
   addiu(sp, sp, stack_offset);
@@ -4808,6 +4834,7 @@ void MacroAssembler::LeaveBuiltinFrame(Register context, Register target,
 
 void MacroAssembler::EnterExitFrame(bool save_doubles, int stack_space,
                                     StackFrame::Type frame_type) {
+  BlockTrampolinePoolScope block_trampoline_pool(this);
   DCHECK(frame_type == StackFrame::EXIT ||
          frame_type == StackFrame::BUILTIN_EXIT);
 
@@ -4893,6 +4920,7 @@ void MacroAssembler::EnterExitFrame(bool save_doubles, int stack_space,
 void MacroAssembler::LeaveExitFrame(bool save_doubles, Register argument_count,
                                     bool do_return,
                                     bool argument_count_is_length) {
+  BlockTrampolinePoolScope block_trampoline_pool(this);
   // Optionally restore all double registers.
   if (save_doubles) {
     // Remember: we only need to restore every 2nd double FPU value.
@@ -5036,6 +5064,7 @@ void MacroAssembler::AssertSmi(Register object) {
 
 void MacroAssembler::AssertConstructor(Register object) {
   if (emit_debug_code()) {
+    BlockTrampolinePoolScope block_trampoline_pool(this);
     STATIC_ASSERT(kSmiTag == 0);
     SmiTst(object, t8);
     Check(ne, AbortReason::kOperandIsASmiAndNotAConstructor, t8,
@@ -5050,6 +5079,7 @@ void MacroAssembler::AssertConstructor(Register object) {
 
 void MacroAssembler::AssertFunction(Register object) {
   if (emit_debug_code()) {
+    BlockTrampolinePoolScope block_trampoline_pool(this);
     STATIC_ASSERT(kSmiTag == 0);
     SmiTst(object, t8);
     Check(ne, AbortReason::kOperandIsASmiAndNotAFunction, t8,
@@ -5063,6 +5093,7 @@ void MacroAssembler::AssertFunction(Register object) {
 
 void MacroAssembler::AssertBoundFunction(Register object) {
   if (emit_debug_code()) {
+    BlockTrampolinePoolScope block_trampoline_pool(this);
     STATIC_ASSERT(kSmiTag == 0);
     SmiTst(object, t8);
     Check(ne, AbortReason::kOperandIsASmiAndNotABoundFunction, t8,
@@ -5075,6 +5106,7 @@ void MacroAssembler::AssertBoundFunction(Register object) {
 
 void MacroAssembler::AssertGeneratorObject(Register object) {
   if (!emit_debug_code()) return;
+  BlockTrampolinePoolScope block_trampoline_pool(this);
   STATIC_ASSERT(kSmiTag == 0);
   SmiTst(object, t8);
   Check(ne, AbortReason::kOperandIsASmiAndNotAGeneratorObject, t8,
@@ -5132,9 +5164,12 @@ void TurboAssembler::Float32Max(FPURegister dst, FPURegister src1,
     BranchTrueShortF(&return_left);
 
     // Operands are equal, but check for +/-0.
-    mfc1(t8, src1);
-    Branch(&return_left, eq, t8, Operand(zero_reg));
-    Branch(&return_right);
+    {
+      BlockTrampolinePoolScope block_trampoline_pool(this);
+      mfc1(t8, src1);
+      Branch(&return_left, eq, t8, Operand(zero_reg));
+      Branch(&return_right);
+    }
 
     bind(&return_right);
     if (src2 != dst) {
@@ -5178,9 +5213,12 @@ void TurboAssembler::Float32Min(FPURegister dst, FPURegister src1,
     BranchTrueShortF(&return_right);
 
     // Left equals right => check for -0.
-    mfc1(t8, src1);
-    Branch(&return_right, eq, t8, Operand(zero_reg));
-    Branch(&return_left);
+    {
+      BlockTrampolinePoolScope block_trampoline_pool(this);
+      mfc1(t8, src1);
+      Branch(&return_right, eq, t8, Operand(zero_reg));
+      Branch(&return_left);
+    }
 
     bind(&return_right);
     if (src2 != dst) {
@@ -5224,9 +5262,12 @@ void TurboAssembler::Float64Max(DoubleRegister dst, DoubleRegister src1,
     BranchTrueShortF(&return_left);
 
     // Left equals right => check for -0.
-    Mfhc1(t8, src1);
-    Branch(&return_left, eq, t8, Operand(zero_reg));
-    Branch(&return_right);
+    {
+      BlockTrampolinePoolScope block_trampoline_pool(this);
+      Mfhc1(t8, src1);
+      Branch(&return_left, eq, t8, Operand(zero_reg));
+      Branch(&return_right);
+    }
 
     bind(&return_right);
     if (src2 != dst) {
@@ -5271,9 +5312,12 @@ void TurboAssembler::Float64Min(DoubleRegister dst, DoubleRegister src1,
     BranchTrueShortF(&return_right);
 
     // Left equals right => check for -0.
-    Mfhc1(t8, src1);
-    Branch(&return_right, eq, t8, Operand(zero_reg));
-    Branch(&return_left);
+    {
+      BlockTrampolinePoolScope block_trampoline_pool(this);
+      Mfhc1(t8, src1);
+      Branch(&return_right, eq, t8, Operand(zero_reg));
+      Branch(&return_left);
+    }
 
     bind(&return_right);
     if (src2 != dst) {
@@ -5347,6 +5391,7 @@ void TurboAssembler::CallCFunction(ExternalReference function,
   // Linux/MIPS convention demands that register t9 contains
   // the address of the function being call in case of
   // Position independent code
+  BlockTrampolinePoolScope block_trampoline_pool(this);
   li(t9, function);
   CallCFunctionHelper(t9, 0, num_reg_arguments, num_double_arguments);
 }
@@ -5400,17 +5445,20 @@ void TurboAssembler::CallCFunctionHelper(Register function_base,
   // allow preemption, so the return address in the link register
   // stays correct.
 
-  if (function_base != t9) {
-    mov(t9, function_base);
-    function_base = t9;
-  }
+  {
+    BlockTrampolinePoolScope block_trampoline_pool(this);
+    if (function_base != t9) {
+      mov(t9, function_base);
+      function_base = t9;
+    }
 
-  if (function_offset != 0) {
-    addiu(t9, t9, function_offset);
-    function_offset = 0;
-  }
+    if (function_offset != 0) {
+      addiu(t9, t9, function_offset);
+      function_offset = 0;
+    }
 
-  Call(function_base, function_offset);
+    Call(function_base, function_offset);
+  }
 
   int stack_passed_arguments = CalculateStackPassedWords(
       num_reg_arguments, num_double_arguments);
diff --git a/deps/v8/src/mips64/assembler-mips64-inl.h b/deps/v8/src/mips64/assembler-mips64-inl.h
index 2e5d0d144dce4c..d0a16883672f84 100644
--- a/deps/v8/src/mips64/assembler-mips64-inl.h
+++ b/deps/v8/src/mips64/assembler-mips64-inl.h
@@ -273,13 +273,6 @@ void Assembler::CheckBuffer() {
 }
 
 
-void Assembler::CheckTrampolinePoolQuick(int extra_instructions) {
-  if (pc_offset() >= next_buffer_check_ - extra_instructions * kInstrSize) {
-    CheckTrampolinePool();
-  }
-}
-
-
 void Assembler::CheckForEmitInForbiddenSlot() {
   if (!is_buffer_growth_blocked()) {
     CheckBuffer();
diff --git a/deps/v8/src/mips64/assembler-mips64.cc b/deps/v8/src/mips64/assembler-mips64.cc
index d1939ea1c7c265..24d67a7be1b5ed 100644
--- a/deps/v8/src/mips64/assembler-mips64.cc
+++ b/deps/v8/src/mips64/assembler-mips64.cc
@@ -585,6 +585,19 @@ bool Assembler::IsBnec(Instr instr) {
   return opcode == POP30 && rs != 0 && rs < rt;  // && rt != 0
 }
 
+bool Assembler::IsMov(Instr instr, Register rd, Register rs) {
+  uint32_t opcode = GetOpcodeField(instr);
+  uint32_t rd_field = GetRd(instr);
+  uint32_t rs_field = GetRs(instr);
+  uint32_t rt_field = GetRt(instr);
+  uint32_t rd_reg = static_cast<uint32_t>(rd.code());
+  uint32_t rs_reg = static_cast<uint32_t>(rs.code());
+  uint32_t function_field = GetFunctionField(instr);
+  // Checks if the instruction is a OR with zero_reg argument (aka MOV).
+  bool res = opcode == SPECIAL && function_field == OR && rd_field == rd_reg &&
+             rs_field == rs_reg && rt_field == 0;
+  return res;
+}
 
 bool Assembler::IsJump(Instr instr) {
   uint32_t opcode   = GetOpcodeField(instr);
@@ -865,6 +878,34 @@ void Assembler::target_at_put(int pos, int target_pos, bool is_internal) {
                  instr_ori | ((imm >> 16) & kImm16Mask));
     instr_at_put(pos + 3 * Assembler::kInstrSize,
                  instr_ori2 | (imm & kImm16Mask));
+  } else if (IsMov(instr, t8, ra)) {
+    Instr instr_lui = instr_at(pos + 4 * Assembler::kInstrSize);
+    Instr instr_ori = instr_at(pos + 5 * Assembler::kInstrSize);
+    DCHECK(IsLui(instr_lui));
+    DCHECK(IsOri(instr_ori));
+
+    int32_t imm_short = target_pos - (pos + Assembler::kBranchPCOffset);
+
+    if (is_int16(imm_short)) {
+      // Optimize by converting to regular branch with 16-bit
+      // offset
+      Instr instr_b = BEQ;
+      instr_b = SetBranchOffset(pos, target_pos, instr_b);
+
+      instr_at_put(pos, instr_b);
+      instr_at_put(pos + 1 * Assembler::kInstrSize, 0);
+    } else {
+      int32_t imm = target_pos - (pos + Assembler::kLongBranchPCOffset);
+      DCHECK_EQ(imm & 3, 0);
+
+      instr_lui &= ~kImm16Mask;
+      instr_ori &= ~kImm16Mask;
+
+      instr_at_put(pos + 4 * Assembler::kInstrSize,
+                   instr_lui | ((imm >> 16) & kImm16Mask));
+      instr_at_put(pos + 5 * Assembler::kInstrSize,
+                   instr_ori | (imm & kImm16Mask));
+    }
   } else if (IsJ(instr) || IsJal(instr)) {
     int32_t imm28 = target_pos - pos;
     DCHECK_EQ(imm28 & 3, 0);
@@ -4143,15 +4184,30 @@ void Assembler::CheckTrampolinePool() {
 
       int pool_start = pc_offset();
       for (int i = 0; i < unbound_labels_count_; i++) {
-        { BlockGrowBufferScope block_buf_growth(this);
-          // Buffer growth (and relocation) must be blocked for internal
+        {  // Buffer growth (and relocation) must be blocked for internal
           // references until associated instructions are emitted and available
           // to be patched.
-          RecordRelocInfo(RelocInfo::INTERNAL_REFERENCE_ENCODED);
-          j(&after_pool);
+          if (kArchVariant == kMips64r6) {
+            bc(&after_pool);
+            nop();
+          } else {
+            Label find_pc;
+            or_(t8, ra, zero_reg);
+            bal(&find_pc);
+            or_(t9, ra, zero_reg);
+            bind(&find_pc);
+            or_(ra, t8, zero_reg);
+            lui(t8, 0);
+            ori(t8, t8, 0);
+            daddu(t9, t9, t8);
+            // Instruction jr will take or_ from the next trampoline.
+            // in its branch delay slot. This is the expected behavior
+            // in order to decrease size of trampoline pool.
+            jr(t9);
+          }
         }
-        nop();
       }
+      nop();
       bind(&after_pool);
       trampoline_ = Trampoline(pool_start, unbound_labels_count_);
 
diff --git a/deps/v8/src/mips64/assembler-mips64.h b/deps/v8/src/mips64/assembler-mips64.h
index 0e25969b432dee..f94db359742c1c 100644
--- a/deps/v8/src/mips64/assembler-mips64.h
+++ b/deps/v8/src/mips64/assembler-mips64.h
@@ -622,6 +622,11 @@ class Assembler : public AssemblerBase {
   // Difference between address of current opcode and target address offset.
   static constexpr int kBranchPCOffset = 4;
 
+  // Difference between address of current opcode and target address offset,
+  // when we are generatinga sequence of instructions for long relative PC
+  // branches
+  static constexpr int kLongBranchPCOffset = 12;
+
   // Here we are patching the address in the LUI/ORI instruction pair.
   // These values are used in the serialization process and must be zero for
   // MIPS platform, as Code, Embedded Object or External-reference pointers
@@ -655,7 +660,8 @@ class Assembler : public AssemblerBase {
   // Max offset for compact branch instructions with 26-bit offset field
   static constexpr int kMaxCompactBranchOffset = (1 << (28 - 1)) - 1;
 
-  static constexpr int kTrampolineSlotsSize = 2 * kInstrSize;
+  static constexpr int kTrampolineSlotsSize =
+      kArchVariant == kMips64r6 ? 2 * kInstrSize : 8 * kInstrSize;
 
   RegList* GetScratchRegisterList() { return &scratch_register_list_; }
 
@@ -1845,6 +1851,7 @@ class Assembler : public AssemblerBase {
   static bool IsJ(Instr instr);
   static bool IsLui(Instr instr);
   static bool IsOri(Instr instr);
+  static bool IsMov(Instr instr, Register rd, Register rs);
 
   static bool IsJal(Instr instr);
   static bool IsJr(Instr instr);
@@ -1950,6 +1957,9 @@ class Assembler : public AssemblerBase {
 
   void EndBlockTrampolinePool() {
     trampoline_pool_blocked_nesting_--;
+    if (trampoline_pool_blocked_nesting_ == 0) {
+      CheckTrampolinePoolQuick(1);
+    }
   }
 
   bool is_trampoline_pool_blocked() const {
@@ -1985,7 +1995,11 @@ class Assembler : public AssemblerBase {
     }
   }
 
-  inline void CheckTrampolinePoolQuick(int extra_instructions = 0);
+  void CheckTrampolinePoolQuick(int extra_instructions = 0) {
+    if (pc_offset() >= next_buffer_check_ - extra_instructions * kInstrSize) {
+      CheckTrampolinePool();
+    }
+  }
 
  private:
   // Avoid overflows for displacements etc.
diff --git a/deps/v8/src/mips64/macro-assembler-mips64.cc b/deps/v8/src/mips64/macro-assembler-mips64.cc
index f5d671cb714ab6..889d09f27e8a39 100644
--- a/deps/v8/src/mips64/macro-assembler-mips64.cc
+++ b/deps/v8/src/mips64/macro-assembler-mips64.cc
@@ -212,6 +212,7 @@ void MacroAssembler::RecordWriteField(Register object, int offset,
 
   Daddu(dst, object, Operand(offset - kHeapObjectTag));
   if (emit_debug_code()) {
+    BlockTrampolinePoolScope block_trampoline_pool(this);
     Label ok;
     And(t8, dst, Operand(kPointerSize - 1));
     Branch(&ok, eq, t8, Operand(zero_reg));
@@ -938,6 +939,7 @@ void TurboAssembler::Slt(Register rd, Register rs, const Operand& rt) {
     } else {
       // li handles the relocation.
       UseScratchRegisterScope temps(this);
+      BlockTrampolinePoolScope block_trampoline_pool(this);
       Register scratch = temps.hasAvailable() ? temps.Acquire() : t8;
       DCHECK(rs != scratch);
       li(scratch, rt);
@@ -961,6 +963,7 @@ void TurboAssembler::Sltu(Register rd, Register rs, const Operand& rt) {
     } else {
       // li handles the relocation.
       UseScratchRegisterScope temps(this);
+      BlockTrampolinePoolScope block_trampoline_pool(this);
       Register scratch = temps.hasAvailable() ? temps.Acquire() : t8;
       DCHECK(rs != scratch);
       li(scratch, rt);
@@ -976,6 +979,7 @@ void TurboAssembler::Sle(Register rd, Register rs, const Operand& rt) {
     // li handles the relocation.
     UseScratchRegisterScope temps(this);
     Register scratch = temps.hasAvailable() ? temps.Acquire() : t8;
+    BlockTrampolinePoolScope block_trampoline_pool(this);
     DCHECK(rs != scratch);
     li(scratch, rt);
     slt(rd, scratch, rs);
@@ -990,6 +994,7 @@ void TurboAssembler::Sleu(Register rd, Register rs, const Operand& rt) {
     // li handles the relocation.
     UseScratchRegisterScope temps(this);
     Register scratch = temps.hasAvailable() ? temps.Acquire() : t8;
+    BlockTrampolinePoolScope block_trampoline_pool(this);
     DCHECK(rs != scratch);
     li(scratch, rt);
     sltu(rd, scratch, rs);
@@ -1014,6 +1019,7 @@ void TurboAssembler::Sgt(Register rd, Register rs, const Operand& rt) {
     // li handles the relocation.
     UseScratchRegisterScope temps(this);
     Register scratch = temps.hasAvailable() ? temps.Acquire() : t8;
+    BlockTrampolinePoolScope block_trampoline_pool(this);
     DCHECK(rs != scratch);
     li(scratch, rt);
     slt(rd, scratch, rs);
@@ -1027,6 +1033,7 @@ void TurboAssembler::Sgtu(Register rd, Register rs, const Operand& rt) {
     // li handles the relocation.
     UseScratchRegisterScope temps(this);
     Register scratch = temps.hasAvailable() ? temps.Acquire() : t8;
+    BlockTrampolinePoolScope block_trampoline_pool(this);
     DCHECK(rs != scratch);
     li(scratch, rt);
     sltu(rd, scratch, rs);
@@ -2115,11 +2122,14 @@ void TurboAssembler::Neg_d(FPURegister fd, FPURegister fs) {
 
 void TurboAssembler::Cvt_d_uw(FPURegister fd, FPURegister fs) {
   // Move the data from fs to t8.
+  BlockTrampolinePoolScope block_trampoline_pool(this);
   mfc1(t8, fs);
   Cvt_d_uw(fd, t8);
 }
 
 void TurboAssembler::Cvt_d_uw(FPURegister fd, Register rs) {
+  BlockTrampolinePoolScope block_trampoline_pool(this);
+
   // Convert rs to a FP value in fd.
   DCHECK(rs != t9);
   DCHECK(rs != at);
@@ -2131,12 +2141,14 @@ void TurboAssembler::Cvt_d_uw(FPURegister fd, Register rs) {
 }
 
 void TurboAssembler::Cvt_d_ul(FPURegister fd, FPURegister fs) {
+  BlockTrampolinePoolScope block_trampoline_pool(this);
   // Move the data from fs to t8.
   dmfc1(t8, fs);
   Cvt_d_ul(fd, t8);
 }
 
 void TurboAssembler::Cvt_d_ul(FPURegister fd, Register rs) {
+  BlockTrampolinePoolScope block_trampoline_pool(this);
   // Convert rs to a FP value in fd.
 
   DCHECK(rs != t9);
@@ -2164,12 +2176,14 @@ void TurboAssembler::Cvt_d_ul(FPURegister fd, Register rs) {
 }
 
 void TurboAssembler::Cvt_s_uw(FPURegister fd, FPURegister fs) {
+  BlockTrampolinePoolScope block_trampoline_pool(this);
   // Move the data from fs to t8.
   mfc1(t8, fs);
   Cvt_s_uw(fd, t8);
 }
 
 void TurboAssembler::Cvt_s_uw(FPURegister fd, Register rs) {
+  BlockTrampolinePoolScope block_trampoline_pool(this);
   // Convert rs to a FP value in fd.
   DCHECK(rs != t9);
   DCHECK(rs != at);
@@ -2181,12 +2195,14 @@ void TurboAssembler::Cvt_s_uw(FPURegister fd, Register rs) {
 }
 
 void TurboAssembler::Cvt_s_ul(FPURegister fd, FPURegister fs) {
+  BlockTrampolinePoolScope block_trampoline_pool(this);
   // Move the data from fs to t8.
   dmfc1(t8, fs);
   Cvt_s_ul(fd, t8);
 }
 
 void TurboAssembler::Cvt_s_ul(FPURegister fd, Register rs) {
+  BlockTrampolinePoolScope block_trampoline_pool(this);
   // Convert rs to a FP value in fd.
 
   DCHECK(rs != t9);
@@ -2237,6 +2253,7 @@ void MacroAssembler::Trunc_l_d(FPURegister fd, FPURegister fs) {
 void MacroAssembler::Trunc_l_ud(FPURegister fd,
                                 FPURegister fs,
                                 FPURegister scratch) {
+  BlockTrampolinePoolScope block_trampoline_pool(this);
   // Load to GPR.
   dmfc1(t8, fs);
   // Reset sign bit.
@@ -2842,6 +2859,7 @@ void TurboAssembler::Movn(Register rd, Register rs, Register rt) {
 
 void TurboAssembler::LoadZeroOnCondition(Register rd, Register rs,
                                          const Operand& rt, Condition cond) {
+  BlockTrampolinePoolScope block_trampoline_pool(this);
   switch (cond) {
     case cc_always:
       mov(rd, zero_reg);
@@ -3059,6 +3077,7 @@ void TurboAssembler::Popcnt(Register rd, Register rs) {
   uint32_t shift = 24;          // (sizeof(T) - 1) * BITS_PER_BYTE
 
   UseScratchRegisterScope temps(this);
+  BlockTrampolinePoolScope block_trampoline_pool(this);
   Register scratch = temps.Acquire();
   Register scratch2 = t8;
   srl(scratch, rs, 1);
@@ -3087,6 +3106,7 @@ void TurboAssembler::Dpopcnt(Register rd, Register rs) {
   uint64_t shift = 24;                   // (sizeof(T) - 1) * BITS_PER_BYTE
 
   UseScratchRegisterScope temps(this);
+  BlockTrampolinePoolScope block_trampoline_pool(this);
   Register scratch = temps.Acquire();
   Register scratch2 = t8;
   dsrl(scratch, rs, 1);
@@ -3176,6 +3196,7 @@ void TurboAssembler::TryInlineTruncateDoubleToI(Register result,
                                                 Label* done) {
   DoubleRegister single_scratch = kScratchDoubleReg.low();
   UseScratchRegisterScope temps(this);
+  BlockTrampolinePoolScope block_trampoline_pool(this);
   Register scratch = temps.Acquire();
   Register scratch2 = t9;
 
@@ -3374,6 +3395,7 @@ bool TurboAssembler::BranchShortHelperR6(int32_t offset, Label* L,
                                          const Operand& rt) {
   DCHECK(L == nullptr || offset == 0);
   UseScratchRegisterScope temps(this);
+  BlockTrampolinePoolScope block_trampoline_pool(this);
   Register scratch = temps.hasAvailable() ? temps.Acquire() : t8;
 
   // Be careful to always use shifted_branch_offset only just before the
@@ -3588,6 +3610,7 @@ bool TurboAssembler::BranchShortHelper(int16_t offset, Label* L, Condition cond,
   if (!is_near(L, OffsetSize::kOffset16)) return false;
 
   UseScratchRegisterScope temps(this);
+  BlockTrampolinePoolScope block_trampoline_pool(this);
   Register scratch = temps.hasAvailable() ? temps.Acquire() : t8;
   int32_t offset32;
 
@@ -4153,9 +4176,12 @@ void TurboAssembler::Jump(intptr_t target, RelocInfo::Mode rmode,
   }
   // The first instruction of 'li' may be placed in the delay slot.
   // This is not an issue, t9 is expected to be clobbered anyway.
-  li(t9, Operand(target, rmode));
-  Jump(t9, al, zero_reg, Operand(zero_reg), bd);
-  bind(&skip);
+  {
+    BlockTrampolinePoolScope block_trampoline_pool(this);
+    li(t9, Operand(target, rmode));
+    Jump(t9, al, zero_reg, Operand(zero_reg), bd);
+    bind(&skip);
+  }
 }
 
 void TurboAssembler::Jump(Address target, RelocInfo::Mode rmode, Condition cond,
@@ -4169,6 +4195,7 @@ void TurboAssembler::Jump(Handle<Code> code, RelocInfo::Mode rmode,
                           BranchDelaySlot bd) {
   DCHECK(RelocInfo::IsCodeTarget(rmode));
   if (FLAG_embedded_builtins) {
+    BlockTrampolinePoolScope block_trampoline_pool(this);
     if (root_array_available_ && options().isolate_independent_code) {
       IndirectLoadConstant(t9, code);
       Daddu(t9, t9, Operand(Code::kHeaderSize - kHeapObjectTag));
@@ -4833,6 +4860,7 @@ bool TurboAssembler::AllowThisStubCall(CodeStub* stub) {
 
 void TurboAssembler::DaddOverflow(Register dst, Register left,
                                   const Operand& right, Register overflow) {
+  BlockTrampolinePoolScope block_trampoline_pool(this);
   Register right_reg = no_reg;
   Register scratch = t8;
   if (!right.is_reg()) {
@@ -4862,6 +4890,7 @@ void TurboAssembler::DaddOverflow(Register dst, Register left,
 
 void TurboAssembler::DsubOverflow(Register dst, Register left,
                                   const Operand& right, Register overflow) {
+  BlockTrampolinePoolScope block_trampoline_pool(this);
   Register right_reg = no_reg;
   Register scratch = t8;
   if (!right.is_reg()) {
@@ -4891,6 +4920,7 @@ void TurboAssembler::DsubOverflow(Register dst, Register left,
 
 void TurboAssembler::MulOverflow(Register dst, Register left,
                                  const Operand& right, Register overflow) {
+  BlockTrampolinePoolScope block_trampoline_pool(this);
   Register right_reg = no_reg;
   Register scratch = t8;
   if (!right.is_reg()) {
@@ -5081,6 +5111,7 @@ void TurboAssembler::StubPrologue(StackFrame::Type type) {
 void TurboAssembler::Prologue() { PushStandardFrame(a1); }
 
 void TurboAssembler::EnterFrame(StackFrame::Type type) {
+  BlockTrampolinePoolScope block_trampoline_pool(this);
   int stack_offset = -3 * kPointerSize;
   const int fp_offset = 1 * kPointerSize;
   daddiu(sp, sp, stack_offset);
@@ -5152,17 +5183,20 @@ void MacroAssembler::EnterExitFrame(bool save_doubles, int stack_space,
     Sd(zero_reg, MemOperand(fp, ExitFrameConstants::kSPOffset));
   }
 
-  // Accessed from ExitFrame::code_slot.
-  li(t8, CodeObject(), CONSTANT_SIZE);
-  Sd(t8, MemOperand(fp, ExitFrameConstants::kCodeOffset));
+  {
+    BlockTrampolinePoolScope block_trampoline_pool(this);
+    // Accessed from ExitFrame::code_slot.
+    li(t8, CodeObject(), CONSTANT_SIZE);
+    Sd(t8, MemOperand(fp, ExitFrameConstants::kCodeOffset));
 
-  // Save the frame pointer and the context in top.
-  li(t8,
-     ExternalReference::Create(IsolateAddressId::kCEntryFPAddress, isolate()));
-  Sd(fp, MemOperand(t8));
-  li(t8,
-     ExternalReference::Create(IsolateAddressId::kContextAddress, isolate()));
-  Sd(cp, MemOperand(t8));
+    // Save the frame pointer and the context in top.
+    li(t8, ExternalReference::Create(IsolateAddressId::kCEntryFPAddress,
+                                     isolate()));
+    Sd(fp, MemOperand(t8));
+    li(t8,
+       ExternalReference::Create(IsolateAddressId::kContextAddress, isolate()));
+    Sd(cp, MemOperand(t8));
+  }
 
   const int frame_alignment = MacroAssembler::ActivationFrameAlignment();
   if (save_doubles) {
@@ -5198,6 +5232,7 @@ void MacroAssembler::EnterExitFrame(bool save_doubles, int stack_space,
 void MacroAssembler::LeaveExitFrame(bool save_doubles, Register argument_count,
                                     bool do_return,
                                     bool argument_count_is_length) {
+  BlockTrampolinePoolScope block_trampoline_pool(this);
   // Optionally restore all double registers.
   if (save_doubles) {
     // Remember: we only need to restore every 2nd double FPU value.
@@ -5361,6 +5396,7 @@ void MacroAssembler::AssertSmi(Register object) {
 
 void MacroAssembler::AssertConstructor(Register object) {
   if (emit_debug_code()) {
+    BlockTrampolinePoolScope block_trampoline_pool(this);
     STATIC_ASSERT(kSmiTag == 0);
     SmiTst(object, t8);
     Check(ne, AbortReason::kOperandIsASmiAndNotAConstructor, t8,
@@ -5375,6 +5411,7 @@ void MacroAssembler::AssertConstructor(Register object) {
 
 void MacroAssembler::AssertFunction(Register object) {
   if (emit_debug_code()) {
+    BlockTrampolinePoolScope block_trampoline_pool(this);
     STATIC_ASSERT(kSmiTag == 0);
     SmiTst(object, t8);
     Check(ne, AbortReason::kOperandIsASmiAndNotAFunction, t8,
@@ -5388,6 +5425,7 @@ void MacroAssembler::AssertFunction(Register object) {
 
 void MacroAssembler::AssertBoundFunction(Register object) {
   if (emit_debug_code()) {
+    BlockTrampolinePoolScope block_trampoline_pool(this);
     STATIC_ASSERT(kSmiTag == 0);
     SmiTst(object, t8);
     Check(ne, AbortReason::kOperandIsASmiAndNotABoundFunction, t8,
@@ -5400,6 +5438,7 @@ void MacroAssembler::AssertBoundFunction(Register object) {
 
 void MacroAssembler::AssertGeneratorObject(Register object) {
   if (!emit_debug_code()) return;
+  BlockTrampolinePoolScope block_trampoline_pool(this);
   STATIC_ASSERT(kSmiTag == 0);
   SmiTst(object, t8);
   Check(ne, AbortReason::kOperandIsASmiAndNotAGeneratorObject, t8,
@@ -5457,10 +5496,13 @@ void TurboAssembler::Float32Max(FPURegister dst, FPURegister src1,
     BranchTrueShortF(&return_left);
 
     // Operands are equal, but check for +/-0.
-    mfc1(t8, src1);
-    dsll32(t8, t8, 0);
-    Branch(&return_left, eq, t8, Operand(zero_reg));
-    Branch(&return_right);
+    {
+      BlockTrampolinePoolScope block_trampoline_pool(this);
+      mfc1(t8, src1);
+      dsll32(t8, t8, 0);
+      Branch(&return_left, eq, t8, Operand(zero_reg));
+      Branch(&return_right);
+    }
 
     bind(&return_right);
     if (src2 != dst) {
@@ -5504,10 +5546,13 @@ void TurboAssembler::Float32Min(FPURegister dst, FPURegister src1,
     BranchTrueShortF(&return_right);
 
     // Left equals right => check for -0.
-    mfc1(t8, src1);
-    dsll32(t8, t8, 0);
-    Branch(&return_right, eq, t8, Operand(zero_reg));
-    Branch(&return_left);
+    {
+      BlockTrampolinePoolScope block_trampoline_pool(this);
+      mfc1(t8, src1);
+      dsll32(t8, t8, 0);
+      Branch(&return_right, eq, t8, Operand(zero_reg));
+      Branch(&return_left);
+    }
 
     bind(&return_right);
     if (src2 != dst) {
@@ -5551,9 +5596,12 @@ void TurboAssembler::Float64Max(FPURegister dst, FPURegister src1,
     BranchTrueShortF(&return_left);
 
     // Left equals right => check for -0.
-    dmfc1(t8, src1);
-    Branch(&return_left, eq, t8, Operand(zero_reg));
-    Branch(&return_right);
+    {
+      BlockTrampolinePoolScope block_trampoline_pool(this);
+      dmfc1(t8, src1);
+      Branch(&return_left, eq, t8, Operand(zero_reg));
+      Branch(&return_right);
+    }
 
     bind(&return_right);
     if (src2 != dst) {
@@ -5597,9 +5645,12 @@ void TurboAssembler::Float64Min(FPURegister dst, FPURegister src1,
     BranchTrueShortF(&return_right);
 
     // Left equals right => check for -0.
-    dmfc1(t8, src1);
-    Branch(&return_right, eq, t8, Operand(zero_reg));
-    Branch(&return_left);
+    {
+      BlockTrampolinePoolScope block_trampoline_pool(this);
+      dmfc1(t8, src1);
+      Branch(&return_right, eq, t8, Operand(zero_reg));
+      Branch(&return_left);
+    }
 
     bind(&return_right);
     if (src2 != dst) {
@@ -5672,6 +5723,7 @@ void TurboAssembler::PrepareCallCFunction(int num_reg_arguments,
 void TurboAssembler::CallCFunction(ExternalReference function,
                                    int num_reg_arguments,
                                    int num_double_arguments) {
+  BlockTrampolinePoolScope block_trampoline_pool(this);
   li(t9, function);
   CallCFunctionHelper(t9, num_reg_arguments, num_double_arguments);
 }
@@ -5725,14 +5777,16 @@ void TurboAssembler::CallCFunctionHelper(Register function,
   // Just call directly. The function called cannot cause a GC, or
   // allow preemption, so the return address in the link register
   // stays correct.
+  {
+    BlockTrampolinePoolScope block_trampoline_pool(this);
+    if (function != t9) {
+      mov(t9, function);
+      function = t9;
+    }
 
-  if (function != t9) {
-    mov(t9, function);
-    function = t9;
+    Call(function);
   }
 
-  Call(function);
-
   int stack_passed_arguments = CalculateStackPassedWords(
       num_reg_arguments, num_double_arguments);
 
diff --git a/deps/v8/src/objects-debug.cc b/deps/v8/src/objects-debug.cc
index 0956240fd1b9c0..86bf7b68facdd8 100644
--- a/deps/v8/src/objects-debug.cc
+++ b/deps/v8/src/objects-debug.cc
@@ -64,12 +64,6 @@ namespace internal {
 
 #ifdef VERIFY_HEAP
 
-// TODO(v8:7786): Remove this overload.
-void Object::ObjectVerify() {
-  // Passing a nullptr into here for non-heap-objects should be safe.
-  ObjectVerify(IsHeapObject() ? HeapObject::cast(this)->GetIsolate() : nullptr);
-}
-
 void Object::ObjectVerify(Isolate* isolate) {
   if (IsSmi()) {
     Smi::cast(this)->SmiVerify(isolate);
@@ -79,19 +73,18 @@ void Object::ObjectVerify(Isolate* isolate) {
   CHECK(!IsConstructor() || IsCallable());
 }
 
-
-void Object::VerifyPointer(Object* p) {
+void Object::VerifyPointer(Isolate* isolate, Object* p) {
   if (p->IsHeapObject()) {
-    HeapObject::VerifyHeapPointer(p);
+    HeapObject::VerifyHeapPointer(isolate, p);
   } else {
     CHECK(p->IsSmi());
   }
 }
 
-void MaybeObject::VerifyMaybeObjectPointer(MaybeObject* p) {
+void MaybeObject::VerifyMaybeObjectPointer(Isolate* isolate, MaybeObject* p) {
   HeapObject* heap_object;
   if (p->ToStrongOrWeakHeapObject(&heap_object)) {
-    HeapObject::VerifyHeapPointer(heap_object);
+    HeapObject::VerifyHeapPointer(isolate, heap_object);
   } else {
     CHECK(p->IsSmi() || p->IsClearedWeakHeapObject());
   }
@@ -99,7 +92,7 @@ void MaybeObject::VerifyMaybeObjectPointer(MaybeObject* p) {
 
 namespace {
 void VerifyForeignPointer(Isolate* isolate, HeapObject* host, Object* foreign) {
-  host->VerifyPointer(foreign);
+  host->VerifyPointer(isolate, foreign);
   CHECK(foreign->IsUndefined(isolate) || Foreign::IsNormalized(foreign));
 }
 }  // namespace
@@ -111,7 +104,7 @@ void Smi::SmiVerify(Isolate* isolate) {
 }
 
 void HeapObject::HeapObjectVerify(Isolate* isolate) {
-  VerifyHeapPointer(map());
+  VerifyHeapPointer(isolate, map());
   CHECK(map()->IsMap());
 
   switch (map()->instance_type()) {
@@ -386,11 +379,10 @@ void HeapObject::HeapObjectVerify(Isolate* isolate) {
   }
 }
 
-
-void HeapObject::VerifyHeapPointer(Object* p) {
+void HeapObject::VerifyHeapPointer(Isolate* isolate, Object* p) {
   CHECK(p->IsHeapObject());
   HeapObject* ho = HeapObject::cast(p);
-  CHECK(ho->GetHeap()->Contains(ho));
+  CHECK(isolate->heap()->Contains(ho));
 }
 
 void Symbol::SymbolVerify(Isolate* isolate) {
@@ -411,7 +403,7 @@ void BytecodeArray::BytecodeArrayVerify(Isolate* isolate) {
   // - No consecutive sequences of prefix Wide / ExtraWide.
   CHECK(IsBytecodeArray());
   CHECK(constant_pool()->IsFixedArray());
-  VerifyHeapPointer(constant_pool());
+  VerifyHeapPointer(isolate, constant_pool());
 }
 
 void FreeSpace::FreeSpaceVerify(Isolate* isolate) { CHECK(IsFreeSpace()); }
@@ -419,14 +411,14 @@ void FreeSpace::FreeSpaceVerify(Isolate* isolate) { CHECK(IsFreeSpace()); }
 void FeedbackCell::FeedbackCellVerify(Isolate* isolate) {
   CHECK(IsFeedbackCell());
 
-  VerifyHeapPointer(value());
+  VerifyHeapPointer(isolate, value());
   CHECK(value()->IsUndefined(isolate) || value()->IsFeedbackVector());
 }
 
 void FeedbackVector::FeedbackVectorVerify(Isolate* isolate) {
   CHECK(IsFeedbackVector());
   MaybeObject* code = optimized_code_weak_or_smi();
-  MaybeObject::VerifyMaybeObjectPointer(code);
+  MaybeObject::VerifyMaybeObjectPointer(isolate, code);
   CHECK(code->IsSmi() || code->IsClearedWeakHeapObject() ||
         code->IsWeakHeapObject());
 }
@@ -490,8 +482,8 @@ void VerifyJSObjectElements(Isolate* isolate, JSObject* object) {
 }  // namespace
 
 void JSObject::JSObjectVerify(Isolate* isolate) {
-  VerifyPointer(raw_properties_or_hash());
-  VerifyHeapPointer(elements());
+  VerifyPointer(isolate, raw_properties_or_hash());
+  VerifyHeapPointer(isolate, elements());
 
   CHECK_IMPLIES(HasSloppyArgumentsElements(), IsJSArgumentsObject());
   if (HasFastProperties()) {
@@ -574,8 +566,8 @@ void Map::MapVerify(Isolate* isolate) {
          static_cast<size_t>(instance_size()) < heap->Capacity()));
   CHECK(GetBackPointer()->IsUndefined(heap->isolate()) ||
         !Map::cast(GetBackPointer())->is_stable());
-  VerifyHeapPointer(prototype());
-  VerifyHeapPointer(instance_descriptors());
+  VerifyHeapPointer(isolate, prototype());
+  VerifyHeapPointer(isolate, instance_descriptors());
   SLOW_DCHECK(instance_descriptors()->IsSortedNoDuplicates());
   DisallowHeapAllocation no_gc;
   SLOW_DCHECK(
@@ -624,19 +616,19 @@ void AliasedArgumentsEntry::AliasedArgumentsEntryVerify(Isolate* isolate) {
 void FixedArray::FixedArrayVerify(Isolate* isolate) {
   for (int i = 0; i < length(); i++) {
     Object* e = get(i);
-    VerifyPointer(e);
+    VerifyPointer(isolate, e);
   }
 }
 
 void WeakFixedArray::WeakFixedArrayVerify(Isolate* isolate) {
   for (int i = 0; i < length(); i++) {
-    MaybeObject::VerifyMaybeObjectPointer(Get(i));
+    MaybeObject::VerifyMaybeObjectPointer(isolate, Get(i));
   }
 }
 
 void WeakArrayList::WeakArrayListVerify(Isolate* isolate) {
   for (int i = 0; i < length(); i++) {
-    MaybeObject::VerifyMaybeObjectPointer(Get(i));
+    MaybeObject::VerifyMaybeObjectPointer(isolate, Get(i));
   }
 }
 
@@ -649,7 +641,7 @@ void PropertyArray::PropertyArrayVerify(Isolate* isolate) {
   CHECK_LT(0, length());
   for (int i = 0; i < length(); i++) {
     Object* e = get(i);
-    VerifyPointer(e);
+    VerifyPointer(isolate, e);
   }
 }
 
@@ -735,11 +727,11 @@ void JSArgumentsObject::JSArgumentsObjectVerify(Isolate* isolate) {
                               Context::SLOW_ALIASED_ARGUMENTS_MAP_INDEX) ||
       isolate->IsInAnyContext(map(),
                               Context::FAST_ALIASED_ARGUMENTS_MAP_INDEX)) {
-    VerifyObjectField(JSSloppyArgumentsObject::kLengthOffset);
-    VerifyObjectField(JSSloppyArgumentsObject::kCalleeOffset);
+    VerifyObjectField(isolate, JSSloppyArgumentsObject::kLengthOffset);
+    VerifyObjectField(isolate, JSSloppyArgumentsObject::kCalleeOffset);
   } else if (isolate->IsInAnyContext(map(),
                                      Context::STRICT_ARGUMENTS_MAP_INDEX)) {
-    VerifyObjectField(JSStrictArgumentsObject::kLengthOffset);
+    VerifyObjectField(isolate, JSStrictArgumentsObject::kLengthOffset);
   }
   JSObjectVerify(isolate);
 }
@@ -802,30 +794,30 @@ void JSGeneratorObject::JSGeneratorObjectVerify(Isolate* isolate) {
   // In an expression like "new g()", there can be a point where a generator
   // object is allocated but its fields are all undefined, as it hasn't yet been
   // initialized by the generator.  Hence these weak checks.
-  VerifyObjectField(kFunctionOffset);
-  VerifyObjectField(kContextOffset);
-  VerifyObjectField(kReceiverOffset);
-  VerifyObjectField(kParametersAndRegistersOffset);
-  VerifyObjectField(kContinuationOffset);
+  VerifyObjectField(isolate, kFunctionOffset);
+  VerifyObjectField(isolate, kContextOffset);
+  VerifyObjectField(isolate, kReceiverOffset);
+  VerifyObjectField(isolate, kParametersAndRegistersOffset);
+  VerifyObjectField(isolate, kContinuationOffset);
 }
 
 void JSAsyncGeneratorObject::JSAsyncGeneratorObjectVerify(Isolate* isolate) {
   // Check inherited fields
   JSGeneratorObjectVerify(isolate);
-  VerifyObjectField(kQueueOffset);
+  VerifyObjectField(isolate, kQueueOffset);
   queue()->HeapObjectVerify(isolate);
 }
 
 void JSValue::JSValueVerify(Isolate* isolate) {
   Object* v = value();
   if (v->IsHeapObject()) {
-    VerifyHeapPointer(v);
+    VerifyHeapPointer(isolate, v);
   }
 }
 
 void JSDate::JSDateVerify(Isolate* isolate) {
   if (value()->IsHeapObject()) {
-    VerifyHeapPointer(value());
+    VerifyHeapPointer(isolate, value());
   }
   CHECK(value()->IsUndefined(isolate) || value()->IsSmi() ||
         value()->IsHeapNumber());
@@ -872,11 +864,11 @@ void JSDate::JSDateVerify(Isolate* isolate) {
 
 void JSMessageObject::JSMessageObjectVerify(Isolate* isolate) {
   CHECK(IsJSMessageObject());
-  VerifyObjectField(kStartPositionOffset);
-  VerifyObjectField(kEndPositionOffset);
-  VerifyObjectField(kArgumentsOffset);
-  VerifyObjectField(kScriptOffset);
-  VerifyObjectField(kStackFramesOffset);
+  VerifyObjectField(isolate, kStartPositionOffset);
+  VerifyObjectField(isolate, kEndPositionOffset);
+  VerifyObjectField(isolate, kArgumentsOffset);
+  VerifyObjectField(isolate, kScriptOffset);
+  VerifyObjectField(isolate, kStackFramesOffset);
 }
 
 void String::StringVerify(Isolate* isolate) {
@@ -923,9 +915,9 @@ void SlicedString::SlicedStringVerify(Isolate* isolate) {
 void JSBoundFunction::JSBoundFunctionVerify(Isolate* isolate) {
   CHECK(IsJSBoundFunction());
   JSObjectVerify(isolate);
-  VerifyObjectField(kBoundThisOffset);
-  VerifyObjectField(kBoundTargetFunctionOffset);
-  VerifyObjectField(kBoundArgumentsOffset);
+  VerifyObjectField(isolate, kBoundThisOffset);
+  VerifyObjectField(isolate, kBoundTargetFunctionOffset);
+  VerifyObjectField(isolate, kBoundArgumentsOffset);
   CHECK(IsCallable());
 
   if (!raw_bound_target_function()->IsUndefined(isolate)) {
@@ -937,23 +929,23 @@ void JSBoundFunction::JSBoundFunctionVerify(Isolate* isolate) {
 void JSFunction::JSFunctionVerify(Isolate* isolate) {
   CHECK(IsJSFunction());
   JSObjectVerify(isolate);
-  VerifyHeapPointer(feedback_cell());
+  VerifyHeapPointer(isolate, feedback_cell());
   CHECK(feedback_cell()->IsFeedbackCell());
   CHECK(code()->IsCode());
   CHECK(map()->is_callable());
   if (has_prototype_slot()) {
-    VerifyObjectField(kPrototypeOrInitialMapOffset);
+    VerifyObjectField(isolate, kPrototypeOrInitialMapOffset);
   }
 }
 
 void SharedFunctionInfo::SharedFunctionInfoVerify(Isolate* isolate) {
   CHECK(IsSharedFunctionInfo());
 
-  VerifyObjectField(kFunctionDataOffset);
-  VerifyObjectField(kOuterScopeInfoOrFeedbackMetadataOffset);
-  VerifyObjectField(kFunctionIdentifierOrDebugInfoOffset);
-  VerifyObjectField(kNameOrScopeInfoOffset);
-  VerifyObjectField(kScriptOffset);
+  VerifyObjectField(isolate, kFunctionDataOffset);
+  VerifyObjectField(isolate, kOuterScopeInfoOrFeedbackMetadataOffset);
+  VerifyObjectField(isolate, kFunctionIdentifierOrDebugInfoOffset);
+  VerifyObjectField(isolate, kNameOrScopeInfoOffset);
+  VerifyObjectField(isolate, kScriptOffset);
 
   Object* value = name_or_scope_info();
   CHECK(value == kNoSharedNameSentinel || value->IsString() ||
@@ -1007,7 +999,7 @@ void SharedFunctionInfo::SharedFunctionInfoVerify(Isolate* isolate) {
 void JSGlobalProxy::JSGlobalProxyVerify(Isolate* isolate) {
   CHECK(IsJSGlobalProxy());
   JSObjectVerify(isolate);
-  VerifyObjectField(JSGlobalProxy::kNativeContextOffset);
+  VerifyObjectField(isolate, JSGlobalProxy::kNativeContextOffset);
   // Make sure that this object has no properties, elements.
   CHECK_EQ(0, FixedArray::cast(elements())->length());
 }
@@ -1025,7 +1017,7 @@ void JSGlobalObject::JSGlobalObjectVerify(Isolate* isolate) {
 void Oddball::OddballVerify(Isolate* isolate) {
   CHECK(IsOddball());
   Heap* heap = isolate->heap();
-  VerifyHeapPointer(to_string());
+  VerifyHeapPointer(isolate, to_string());
   Object* number = to_number();
   if (number->IsHeapObject()) {
     CHECK(number == ReadOnlyRoots(heap).nan_value() ||
@@ -1070,22 +1062,22 @@ void Oddball::OddballVerify(Isolate* isolate) {
 
 void Cell::CellVerify(Isolate* isolate) {
   CHECK(IsCell());
-  VerifyObjectField(kValueOffset);
+  VerifyObjectField(isolate, kValueOffset);
 }
 
 void PropertyCell::PropertyCellVerify(Isolate* isolate) {
   CHECK(IsPropertyCell());
-  VerifyObjectField(kValueOffset);
+  VerifyObjectField(isolate, kValueOffset);
 }
 
 void WeakCell::WeakCellVerify(Isolate* isolate) {
   CHECK(IsWeakCell());
-  VerifyObjectField(kValueOffset);
+  VerifyObjectField(isolate, kValueOffset);
 }
 
 void CodeDataContainer::CodeDataContainerVerify(Isolate* isolate) {
   CHECK(IsCodeDataContainer());
-  VerifyObjectField(kNextCodeLinkOffset);
+  VerifyObjectField(isolate, kNextCodeLinkOffset);
   CHECK(next_code_link()->IsCode() || next_code_link()->IsUndefined(isolate));
 }
 
@@ -1149,7 +1141,7 @@ void JSArray::JSArrayVerify(Isolate* isolate) {
 void JSSet::JSSetVerify(Isolate* isolate) {
   CHECK(IsJSSet());
   JSObjectVerify(isolate);
-  VerifyHeapPointer(table());
+  VerifyHeapPointer(isolate, table());
   CHECK(table()->IsOrderedHashSet() || table()->IsUndefined(isolate));
   // TODO(arv): Verify OrderedHashTable too.
 }
@@ -1157,7 +1149,7 @@ void JSSet::JSSetVerify(Isolate* isolate) {
 void JSMap::JSMapVerify(Isolate* isolate) {
   CHECK(IsJSMap());
   JSObjectVerify(isolate);
-  VerifyHeapPointer(table());
+  VerifyHeapPointer(isolate, table());
   CHECK(table()->IsOrderedHashMap() || table()->IsUndefined(isolate));
   // TODO(arv): Verify OrderedHashTable too.
 }
@@ -1165,7 +1157,7 @@ void JSMap::JSMapVerify(Isolate* isolate) {
 void JSSetIterator::JSSetIteratorVerify(Isolate* isolate) {
   CHECK(IsJSSetIterator());
   JSObjectVerify(isolate);
-  VerifyHeapPointer(table());
+  VerifyHeapPointer(isolate, table());
   CHECK(table()->IsOrderedHashSet());
   CHECK(index()->IsSmi());
 }
@@ -1173,7 +1165,7 @@ void JSSetIterator::JSSetIteratorVerify(Isolate* isolate) {
 void JSMapIterator::JSMapIteratorVerify(Isolate* isolate) {
   CHECK(IsJSMapIterator());
   JSObjectVerify(isolate);
-  VerifyHeapPointer(table());
+  VerifyHeapPointer(isolate, table());
   CHECK(table()->IsOrderedHashMap());
   CHECK(index()->IsSmi());
 }
@@ -1181,7 +1173,7 @@ void JSMapIterator::JSMapIteratorVerify(Isolate* isolate) {
 void JSWeakMap::JSWeakMapVerify(Isolate* isolate) {
   CHECK(IsJSWeakMap());
   JSObjectVerify(isolate);
-  VerifyHeapPointer(table());
+  VerifyHeapPointer(isolate, table());
   CHECK(table()->IsEphemeronHashTable() || table()->IsUndefined(isolate));
 }
 
@@ -1216,13 +1208,13 @@ void JSStringIterator::JSStringIteratorVerify(Isolate* isolate) {
 void JSAsyncFromSyncIterator::JSAsyncFromSyncIteratorVerify(Isolate* isolate) {
   CHECK(IsJSAsyncFromSyncIterator());
   JSObjectVerify(isolate);
-  VerifyHeapPointer(sync_iterator());
+  VerifyHeapPointer(isolate, sync_iterator());
 }
 
 void JSWeakSet::JSWeakSetVerify(Isolate* isolate) {
   CHECK(IsJSWeakSet());
   JSObjectVerify(isolate);
-  VerifyHeapPointer(table());
+  VerifyHeapPointer(isolate, table());
   CHECK(table()->IsEphemeronHashTable() || table()->IsUndefined(isolate));
 }
 
@@ -1231,28 +1223,28 @@ void Microtask::MicrotaskVerify(Isolate* isolate) { CHECK(IsMicrotask()); }
 void CallableTask::CallableTaskVerify(Isolate* isolate) {
   CHECK(IsCallableTask());
   MicrotaskVerify(isolate);
-  VerifyHeapPointer(callable());
+  VerifyHeapPointer(isolate, callable());
   CHECK(callable()->IsCallable());
-  VerifyHeapPointer(context());
+  VerifyHeapPointer(isolate, context());
   CHECK(context()->IsContext());
 }
 
 void CallbackTask::CallbackTaskVerify(Isolate* isolate) {
   CHECK(IsCallbackTask());
   MicrotaskVerify(isolate);
-  VerifyHeapPointer(callback());
-  VerifyHeapPointer(data());
+  VerifyHeapPointer(isolate, callback());
+  VerifyHeapPointer(isolate, data());
 }
 
 void PromiseReactionJobTask::PromiseReactionJobTaskVerify(Isolate* isolate) {
   CHECK(IsPromiseReactionJobTask());
   MicrotaskVerify(isolate);
-  VerifyPointer(argument());
-  VerifyHeapPointer(context());
+  VerifyPointer(isolate, argument());
+  VerifyHeapPointer(isolate, context());
   CHECK(context()->IsContext());
-  VerifyHeapPointer(handler());
+  VerifyHeapPointer(isolate, handler());
   CHECK(handler()->IsUndefined(isolate) || handler()->IsCallable());
-  VerifyHeapPointer(promise_or_capability());
+  VerifyHeapPointer(isolate, promise_or_capability());
   CHECK(promise_or_capability()->IsJSPromise() ||
         promise_or_capability()->IsPromiseCapability());
 }
@@ -1273,38 +1265,38 @@ void PromiseResolveThenableJobTask::PromiseResolveThenableJobTaskVerify(
     Isolate* isolate) {
   CHECK(IsPromiseResolveThenableJobTask());
   MicrotaskVerify(isolate);
-  VerifyHeapPointer(context());
+  VerifyHeapPointer(isolate, context());
   CHECK(context()->IsContext());
-  VerifyHeapPointer(promise_to_resolve());
+  VerifyHeapPointer(isolate, promise_to_resolve());
   CHECK(promise_to_resolve()->IsJSPromise());
-  VerifyHeapPointer(then());
+  VerifyHeapPointer(isolate, then());
   CHECK(then()->IsCallable());
   CHECK(then()->IsJSReceiver());
-  VerifyHeapPointer(thenable());
+  VerifyHeapPointer(isolate, thenable());
   CHECK(thenable()->IsJSReceiver());
 }
 
 void PromiseCapability::PromiseCapabilityVerify(Isolate* isolate) {
   CHECK(IsPromiseCapability());
 
-  VerifyHeapPointer(promise());
+  VerifyHeapPointer(isolate, promise());
   CHECK(promise()->IsJSReceiver() || promise()->IsUndefined(isolate));
-  VerifyPointer(resolve());
-  VerifyPointer(reject());
+  VerifyPointer(isolate, resolve());
+  VerifyPointer(isolate, reject());
 }
 
 void PromiseReaction::PromiseReactionVerify(Isolate* isolate) {
   CHECK(IsPromiseReaction());
 
-  VerifyPointer(next());
+  VerifyPointer(isolate, next());
   CHECK(next()->IsSmi() || next()->IsPromiseReaction());
-  VerifyHeapPointer(reject_handler());
+  VerifyHeapPointer(isolate, reject_handler());
   CHECK(reject_handler()->IsUndefined(isolate) ||
         reject_handler()->IsCallable());
-  VerifyHeapPointer(fulfill_handler());
+  VerifyHeapPointer(isolate, fulfill_handler());
   CHECK(fulfill_handler()->IsUndefined(isolate) ||
         fulfill_handler()->IsCallable());
-  VerifyHeapPointer(promise_or_capability());
+  VerifyHeapPointer(isolate, promise_or_capability());
   CHECK(promise_or_capability()->IsJSPromise() ||
         promise_or_capability()->IsPromiseCapability());
 }
@@ -1312,7 +1304,7 @@ void PromiseReaction::PromiseReactionVerify(Isolate* isolate) {
 void JSPromise::JSPromiseVerify(Isolate* isolate) {
   CHECK(IsJSPromise());
   JSObjectVerify(isolate);
-  VerifyPointer(reactions_or_result());
+  VerifyPointer(isolate, reactions_or_result());
   VerifySmiField(kFlagsOffset);
   if (status() == Promise::kPending) {
     CHECK(reactions()->IsSmi() || reactions()->IsPromiseReaction());
@@ -1345,7 +1337,7 @@ void SmallOrderedHashTable<Derived>::SmallOrderedHashTableVerify(
   for (int entry = 0; entry < NumberOfElements(); entry++) {
     for (int offset = 0; offset < Derived::kEntrySize; offset++) {
       Object* val = GetDataEntry(entry, offset);
-      VerifyPointer(val);
+      VerifyPointer(isolate, val);
     }
   }
 
@@ -1417,8 +1409,8 @@ void JSRegExpStringIterator::JSRegExpStringIteratorVerify(Isolate* isolate) {
 
 void JSProxy::JSProxyVerify(Isolate* isolate) {
   CHECK(IsJSProxy());
-  VerifyPointer(target());
-  VerifyPointer(handler());
+  VerifyPointer(isolate, target());
+  VerifyPointer(isolate, handler());
   if (!IsRevoked()) {
     CHECK_EQ(target()->IsCallable(), map()->is_callable());
     CHECK_EQ(target()->IsConstructor(), map()->is_constructor());
@@ -1431,7 +1423,7 @@ void JSProxy::JSProxyVerify(Isolate* isolate) {
 void JSArrayBuffer::JSArrayBufferVerify(Isolate* isolate) {
   CHECK(IsJSArrayBuffer());
   JSObjectVerify(isolate);
-  VerifyPointer(byte_length());
+  VerifyPointer(isolate, byte_length());
   CHECK(byte_length()->IsSmi() || byte_length()->IsHeapNumber() ||
         byte_length()->IsUndefined(isolate));
 }
@@ -1439,15 +1431,15 @@ void JSArrayBuffer::JSArrayBufferVerify(Isolate* isolate) {
 void JSArrayBufferView::JSArrayBufferViewVerify(Isolate* isolate) {
   CHECK(IsJSArrayBufferView());
   JSObjectVerify(isolate);
-  VerifyPointer(buffer());
+  VerifyPointer(isolate, buffer());
   CHECK(buffer()->IsJSArrayBuffer() || buffer()->IsUndefined(isolate) ||
         buffer() == Smi::kZero);
 
-  VerifyPointer(raw_byte_offset());
+  VerifyPointer(isolate, raw_byte_offset());
   CHECK(raw_byte_offset()->IsSmi() || raw_byte_offset()->IsHeapNumber() ||
         raw_byte_offset()->IsUndefined(isolate));
 
-  VerifyPointer(raw_byte_length());
+  VerifyPointer(isolate, raw_byte_length());
   CHECK(raw_byte_length()->IsSmi() || raw_byte_length()->IsHeapNumber() ||
         raw_byte_length()->IsUndefined(isolate));
 }
@@ -1455,9 +1447,9 @@ void JSArrayBufferView::JSArrayBufferViewVerify(Isolate* isolate) {
 void JSTypedArray::JSTypedArrayVerify(Isolate* isolate) {
   CHECK(IsJSTypedArray());
   JSArrayBufferViewVerify(isolate);
-  VerifyPointer(raw_length());
+  VerifyPointer(isolate, raw_length());
   CHECK(raw_length()->IsSmi() || raw_length()->IsUndefined(isolate));
-  VerifyPointer(elements());
+  VerifyPointer(isolate, elements());
 }
 
 void JSDataView::JSDataViewVerify(Isolate* isolate) {
@@ -1473,8 +1465,8 @@ void AsyncGeneratorRequest::AsyncGeneratorRequestVerify(Isolate* isolate) {
   CHECK_GE(resume_mode(), JSGeneratorObject::kNext);
   CHECK_LE(resume_mode(), JSGeneratorObject::kThrow);
   CHECK(promise()->IsJSPromise());
-  VerifyPointer(value());
-  VerifyPointer(next());
+  VerifyPointer(isolate, value());
+  VerifyPointer(isolate, next());
   next()->ObjectVerify(isolate);
 }
 
@@ -1486,7 +1478,7 @@ void BigInt::BigIntVerify(Isolate* isolate) {
 
 void JSModuleNamespace::JSModuleNamespaceVerify(Isolate* isolate) {
   CHECK(IsJSModuleNamespace());
-  VerifyPointer(module());
+  VerifyPointer(isolate, module());
 }
 
 void ModuleInfoEntry::ModuleInfoEntryVerify(Isolate* isolate) {
@@ -1509,13 +1501,13 @@ void ModuleInfoEntry::ModuleInfoEntryVerify(Isolate* isolate) {
 void Module::ModuleVerify(Isolate* isolate) {
   CHECK(IsModule());
 
-  VerifyPointer(code());
-  VerifyPointer(exports());
-  VerifyPointer(module_namespace());
-  VerifyPointer(requested_modules());
-  VerifyPointer(script());
-  VerifyPointer(import_meta());
-  VerifyPointer(exception());
+  VerifyPointer(isolate, code());
+  VerifyPointer(isolate, exports());
+  VerifyPointer(isolate, module_namespace());
+  VerifyPointer(isolate, requested_modules());
+  VerifyPointer(isolate, script());
+  VerifyPointer(isolate, import_meta());
+  VerifyPointer(isolate, exception());
   VerifySmiField(kHashOffset);
   VerifySmiField(kStatusOffset);
 
@@ -1543,13 +1535,45 @@ void Module::ModuleVerify(Isolate* isolate) {
 void PrototypeInfo::PrototypeInfoVerify(Isolate* isolate) {
   CHECK(IsPrototypeInfo());
   CHECK(weak_cell()->IsWeakCell() || weak_cell()->IsUndefined(isolate));
-  if (prototype_users()->IsFixedArrayOfWeakCells()) {
-    FixedArrayOfWeakCells::cast(prototype_users())->FixedArrayVerify(isolate);
+  if (prototype_users()->IsWeakArrayList()) {
+    PrototypeUsers::Verify(WeakArrayList::cast(prototype_users()));
   } else {
     CHECK(prototype_users()->IsSmi());
   }
 }
 
+void PrototypeUsers::Verify(WeakArrayList* array) {
+  if (array->length() == 0) {
+    // Allow empty & uninitialized lists.
+    return;
+  }
+  // Verify empty slot chain.
+  int empty_slot = Smi::ToInt(empty_slot_index(array));
+  int empty_slots_count = 0;
+  while (empty_slot != kNoEmptySlotsMarker) {
+    CHECK_GT(empty_slot, 0);
+    CHECK_LT(empty_slot, array->length());
+    empty_slot = Smi::ToInt(array->Get(empty_slot)->ToSmi());
+    ++empty_slots_count;
+  }
+
+  // Verify that all elements are either weak pointers or SMIs marking empty
+  // slots.
+  int weak_maps_count = 0;
+  for (int i = kFirstIndex; i < array->length(); ++i) {
+    HeapObject* heap_object;
+    MaybeObject* object = array->Get(i);
+    if ((object->ToWeakHeapObject(&heap_object) && heap_object->IsMap()) ||
+        object->IsClearedWeakHeapObject()) {
+      ++weak_maps_count;
+    } else {
+      CHECK(object->IsSmi());
+    }
+  }
+
+  CHECK_EQ(weak_maps_count + empty_slots_count + 1, array->length());
+}
+
 void Tuple2::Tuple2Verify(Isolate* isolate) {
   CHECK(IsTuple2());
   Heap* heap = isolate->heap();
@@ -1559,16 +1583,16 @@ void Tuple2::Tuple2Verify(Isolate* isolate) {
     CHECK_EQ(ReadOnlyRoots(heap).empty_fixed_array(),
              EnumCache::cast(this)->indices());
   } else {
-    VerifyObjectField(kValue1Offset);
-    VerifyObjectField(kValue2Offset);
+    VerifyObjectField(isolate, kValue1Offset);
+    VerifyObjectField(isolate, kValue2Offset);
   }
 }
 
 void Tuple3::Tuple3Verify(Isolate* isolate) {
   CHECK(IsTuple3());
-  VerifyObjectField(kValue1Offset);
-  VerifyObjectField(kValue2Offset);
-  VerifyObjectField(kValue3Offset);
+  VerifyObjectField(isolate, kValue1Offset);
+  VerifyObjectField(isolate, kValue2Offset);
+  VerifyObjectField(isolate, kValue3Offset);
 }
 
 void ObjectBoilerplateDescription::ObjectBoilerplateDescriptionVerify(
@@ -1583,20 +1607,20 @@ void ArrayBoilerplateDescription::ArrayBoilerplateDescriptionVerify(
     Isolate* isolate) {
   CHECK(IsArrayBoilerplateDescription());
   CHECK(constant_elements()->IsFixedArrayBase());
-  VerifyObjectField(kConstantElementsOffset);
+  VerifyObjectField(isolate, kConstantElementsOffset);
 }
 
 void WasmDebugInfo::WasmDebugInfoVerify(Isolate* isolate) {
   CHECK(IsWasmDebugInfo());
-  VerifyObjectField(kInstanceOffset);
+  VerifyObjectField(isolate, kInstanceOffset);
   CHECK(wasm_instance()->IsWasmInstanceObject());
-  VerifyObjectField(kInterpreterHandleOffset);
+  VerifyObjectField(isolate, kInterpreterHandleOffset);
   CHECK(interpreter_handle()->IsUndefined(isolate) ||
         interpreter_handle()->IsForeign());
-  VerifyObjectField(kInterpretedFunctionsOffset);
-  VerifyObjectField(kLocalsNamesOffset);
-  VerifyObjectField(kCWasmEntriesOffset);
-  VerifyObjectField(kCWasmEntryMapOffset);
+  VerifyObjectField(isolate, kInterpretedFunctionsOffset);
+  VerifyObjectField(isolate, kLocalsNamesOffset);
+  VerifyObjectField(isolate, kCWasmEntriesOffset);
+  VerifyObjectField(isolate, kCWasmEntryMapOffset);
 }
 
 void WasmInstanceObject::WasmInstanceObjectVerify(Isolate* isolate) {
@@ -1608,27 +1632,27 @@ void WasmInstanceObject::WasmInstanceObjectVerify(Isolate* isolate) {
   // WasmInstanceObject is not fully set up yet.
   for (int offset = kHeaderSize; offset < kFirstUntaggedOffset;
        offset += kPointerSize) {
-    VerifyObjectField(offset);
+    VerifyObjectField(isolate, offset);
   }
 }
 
 void WasmExportedFunctionData::WasmExportedFunctionDataVerify(
     Isolate* isolate) {
   CHECK(IsWasmExportedFunctionData());
-  VerifyObjectField(kWrapperCodeOffset);
+  VerifyObjectField(isolate, kWrapperCodeOffset);
   CHECK(wrapper_code()->kind() == Code::JS_TO_WASM_FUNCTION ||
         wrapper_code()->kind() == Code::C_WASM_ENTRY);
-  VerifyObjectField(kInstanceOffset);
+  VerifyObjectField(isolate, kInstanceOffset);
   VerifySmiField(kFunctionIndexOffset);
 }
 
 void WasmModuleObject::WasmModuleObjectVerify(Isolate* isolate) {
   CHECK(IsWasmModuleObject());
-  VerifyObjectField(kNativeModuleOffset);
-  VerifyObjectField(kExportWrappersOffset);
-  VerifyObjectField(kScriptOffset);
-  VerifyObjectField(kAsmJsOffsetTableOffset);
-  VerifyObjectField(kBreakPointInfosOffset);
+  VerifyObjectField(isolate, kNativeModuleOffset);
+  VerifyObjectField(isolate, kExportWrappersOffset);
+  VerifyObjectField(isolate, kScriptOffset);
+  VerifyObjectField(isolate, kAsmJsOffsetTableOffset);
+  VerifyObjectField(isolate, kBreakPointInfosOffset);
 }
 
 void DataHandler::DataHandlerVerify(Isolate* isolate) {
@@ -1638,13 +1662,13 @@ void DataHandler::DataHandlerVerify(Isolate* isolate) {
   CHECK(validity_cell()->IsSmi() || validity_cell()->IsCell());
   int data_count = data_field_count();
   if (data_count >= 1) {
-    VerifyMaybeObjectField(kData1Offset);
+    VerifyMaybeObjectField(isolate, kData1Offset);
   }
   if (data_count >= 2) {
-    VerifyObjectField(kData2Offset);
+    VerifyObjectField(isolate, kData2Offset);
   }
   if (data_count >= 3) {
-    VerifyObjectField(kData3Offset);
+    VerifyObjectField(isolate, kData3Offset);
   }
 }
 
@@ -1660,26 +1684,26 @@ void StoreHandler::StoreHandlerVerify(Isolate* isolate) {
 
 void AccessorInfo::AccessorInfoVerify(Isolate* isolate) {
   CHECK(IsAccessorInfo());
-  VerifyPointer(name());
-  VerifyPointer(expected_receiver_type());
+  VerifyPointer(isolate, name());
+  VerifyPointer(isolate, expected_receiver_type());
   VerifyForeignPointer(isolate, this, getter());
   VerifyForeignPointer(isolate, this, setter());
   VerifyForeignPointer(isolate, this, js_getter());
-  VerifyPointer(data());
+  VerifyPointer(isolate, data());
 }
 
 void AccessorPair::AccessorPairVerify(Isolate* isolate) {
   CHECK(IsAccessorPair());
-  VerifyPointer(getter());
-  VerifyPointer(setter());
+  VerifyPointer(isolate, getter());
+  VerifyPointer(isolate, setter());
 }
 
 void AccessCheckInfo::AccessCheckInfoVerify(Isolate* isolate) {
   CHECK(IsAccessCheckInfo());
-  VerifyPointer(callback());
-  VerifyPointer(named_interceptor());
-  VerifyPointer(indexed_interceptor());
-  VerifyPointer(data());
+  VerifyPointer(isolate, callback());
+  VerifyPointer(isolate, named_interceptor());
+  VerifyPointer(isolate, indexed_interceptor());
+  VerifyPointer(isolate, data());
 }
 
 void CallHandlerInfo::CallHandlerInfoVerify(Isolate* isolate) {
@@ -1689,9 +1713,9 @@ void CallHandlerInfo::CallHandlerInfoVerify(Isolate* isolate) {
             ReadOnlyRoots(isolate).side_effect_free_call_handler_info_map() ||
         map() == ReadOnlyRoots(isolate)
                      .next_call_side_effect_free_call_handler_info_map());
-  VerifyPointer(callback());
-  VerifyPointer(js_callback());
-  VerifyPointer(data());
+  VerifyPointer(isolate, callback());
+  VerifyPointer(isolate, js_callback());
+  VerifyPointer(isolate, data());
 }
 
 void InterceptorInfo::InterceptorInfoVerify(Isolate* isolate) {
@@ -1701,36 +1725,36 @@ void InterceptorInfo::InterceptorInfoVerify(Isolate* isolate) {
   VerifyForeignPointer(isolate, this, query());
   VerifyForeignPointer(isolate, this, deleter());
   VerifyForeignPointer(isolate, this, enumerator());
-  VerifyPointer(data());
+  VerifyPointer(isolate, data());
   VerifySmiField(kFlagsOffset);
 }
 
 void TemplateInfo::TemplateInfoVerify(Isolate* isolate) {
-  VerifyPointer(tag());
-  VerifyPointer(property_list());
-  VerifyPointer(property_accessors());
+  VerifyPointer(isolate, tag());
+  VerifyPointer(isolate, property_list());
+  VerifyPointer(isolate, property_accessors());
 }
 
 void FunctionTemplateInfo::FunctionTemplateInfoVerify(Isolate* isolate) {
   CHECK(IsFunctionTemplateInfo());
   TemplateInfoVerify(isolate);
-  VerifyPointer(serial_number());
-  VerifyPointer(call_code());
-  VerifyPointer(prototype_template());
-  VerifyPointer(parent_template());
-  VerifyPointer(named_property_handler());
-  VerifyPointer(indexed_property_handler());
-  VerifyPointer(instance_template());
-  VerifyPointer(signature());
-  VerifyPointer(access_check_info());
-  VerifyPointer(cached_property_name());
+  VerifyPointer(isolate, serial_number());
+  VerifyPointer(isolate, call_code());
+  VerifyPointer(isolate, prototype_template());
+  VerifyPointer(isolate, parent_template());
+  VerifyPointer(isolate, named_property_handler());
+  VerifyPointer(isolate, indexed_property_handler());
+  VerifyPointer(isolate, instance_template());
+  VerifyPointer(isolate, signature());
+  VerifyPointer(isolate, access_check_info());
+  VerifyPointer(isolate, cached_property_name());
 }
 
 void ObjectTemplateInfo::ObjectTemplateInfoVerify(Isolate* isolate) {
   CHECK(IsObjectTemplateInfo());
   TemplateInfoVerify(isolate);
-  VerifyPointer(constructor());
-  VerifyPointer(data());
+  VerifyPointer(isolate, constructor());
+  VerifyPointer(isolate, data());
 }
 
 void AllocationSite::AllocationSiteVerify(Isolate* isolate) {
@@ -1739,15 +1763,15 @@ void AllocationSite::AllocationSiteVerify(Isolate* isolate) {
 
 void AllocationMemento::AllocationMementoVerify(Isolate* isolate) {
   CHECK(IsAllocationMemento());
-  VerifyHeapPointer(allocation_site());
+  VerifyHeapPointer(isolate, allocation_site());
   CHECK(!IsValid() || GetAllocationSite()->IsAllocationSite());
 }
 
 void Script::ScriptVerify(Isolate* isolate) {
   CHECK(IsScript());
-  VerifyPointer(source());
-  VerifyPointer(name());
-  VerifyPointer(line_ends());
+  VerifyPointer(isolate, source());
+  VerifyPointer(isolate, name());
+  VerifyPointer(isolate, line_ends());
   for (int i = 0; i < shared_function_infos()->length(); ++i) {
     MaybeObject* maybe_object = shared_function_infos()->Get(i);
     HeapObject* heap_object;
@@ -1759,16 +1783,17 @@ void Script::ScriptVerify(Isolate* isolate) {
 }
 
 void NormalizedMapCache::NormalizedMapCacheVerify(Isolate* isolate) {
-  FixedArray::cast(this)->FixedArrayVerify(isolate);
+  WeakFixedArray::cast(this)->WeakFixedArrayVerify(isolate);
   if (FLAG_enable_slow_asserts) {
     for (int i = 0; i < length(); i++) {
-      Object* e = FixedArray::get(i);
-      if (e->IsWeakCell()) {
-        if (!WeakCell::cast(e)->cleared()) {
-          Map::cast(WeakCell::cast(e)->value())->DictionaryMapVerify(isolate);
-        }
+      MaybeObject* e = WeakFixedArray::Get(i);
+      HeapObject* heap_object;
+      if (e->ToWeakHeapObject(&heap_object)) {
+        Map::cast(heap_object)->DictionaryMapVerify(isolate);
       } else {
-        CHECK(e->IsUndefined(isolate));
+        CHECK(e->IsClearedWeakHeapObject() ||
+              (e->ToStrongHeapObject(&heap_object) &&
+               heap_object->IsUndefined(isolate)));
       }
     }
   }
@@ -1776,17 +1801,17 @@ void NormalizedMapCache::NormalizedMapCacheVerify(Isolate* isolate) {
 
 void DebugInfo::DebugInfoVerify(Isolate* isolate) {
   CHECK(IsDebugInfo());
-  VerifyPointer(shared());
-  VerifyPointer(function_identifier());
-  VerifyPointer(original_bytecode_array());
-  VerifyPointer(break_points());
+  VerifyPointer(isolate, shared());
+  VerifyPointer(isolate, function_identifier());
+  VerifyPointer(isolate, original_bytecode_array());
+  VerifyPointer(isolate, break_points());
 }
 
 void StackFrameInfo::StackFrameInfoVerify(Isolate* isolate) {
   CHECK(IsStackFrameInfo());
-  VerifyPointer(script_name());
-  VerifyPointer(script_name_or_source_url());
-  VerifyPointer(function_name());
+  VerifyPointer(isolate, script_name());
+  VerifyPointer(isolate, script_name_or_source_url());
+  VerifyPointer(isolate, function_name());
 }
 
 void PreParsedScopeData::PreParsedScopeDataVerify(Isolate* isolate) {
@@ -1797,14 +1822,14 @@ void PreParsedScopeData::PreParsedScopeDataVerify(Isolate* isolate) {
   for (int i = 0; i < length(); ++i) {
     Object* child = child_data(i);
     CHECK(child->IsPreParsedScopeData() || child->IsNull());
-    VerifyPointer(child);
+    VerifyPointer(isolate, child);
   }
 }
 
 void UncompiledDataWithPreParsedScope::UncompiledDataWithPreParsedScopeVerify(
     Isolate* isolate) {
   CHECK(IsUncompiledDataWithPreParsedScope());
-  VerifyPointer(pre_parsed_scope_data());
+  VerifyPointer(isolate, pre_parsed_scope_data());
 }
 
 void UncompiledDataWithoutPreParsedScope::
@@ -1820,25 +1845,25 @@ void InterpreterData::InterpreterDataVerify(Isolate* isolate) {
 
 #ifdef V8_INTL_SUPPORT
 void JSLocale::JSLocaleVerify(Isolate* isolate) {
-  VerifyObjectField(kLanguageOffset);
-  VerifyObjectField(kScriptOffset);
-  VerifyObjectField(kRegionOffset);
-  VerifyObjectField(kBaseNameOffset);
-  VerifyObjectField(kLocaleOffset);
+  VerifyObjectField(isolate, kLanguageOffset);
+  VerifyObjectField(isolate, kScriptOffset);
+  VerifyObjectField(isolate, kRegionOffset);
+  VerifyObjectField(isolate, kBaseNameOffset);
+  VerifyObjectField(isolate, kLocaleOffset);
   // Unicode extension fields.
-  VerifyObjectField(kCalendarOffset);
-  VerifyObjectField(kCaseFirstOffset);
-  VerifyObjectField(kCollationOffset);
-  VerifyObjectField(kHourCycleOffset);
-  VerifyObjectField(kNumericOffset);
-  VerifyObjectField(kNumberingSystemOffset);
+  VerifyObjectField(isolate, kCalendarOffset);
+  VerifyObjectField(isolate, kCaseFirstOffset);
+  VerifyObjectField(isolate, kCollationOffset);
+  VerifyObjectField(isolate, kHourCycleOffset);
+  VerifyObjectField(isolate, kNumericOffset);
+  VerifyObjectField(isolate, kNumberingSystemOffset);
 }
 
 void JSRelativeTimeFormat::JSRelativeTimeFormatVerify(Isolate* isolate) {
-  VerifyObjectField(kLocaleOffset);
-  VerifyObjectField(kStyleOffset);
-  VerifyObjectField(kNumericOffset);
-  VerifyObjectField(kFormatterOffset);
+  VerifyObjectField(isolate, kLocaleOffset);
+  VerifyObjectField(isolate, kStyleOffset);
+  VerifyObjectField(isolate, kNumericOffset);
+  VerifyObjectField(isolate, kFormatterOffset);
 }
 #endif  // V8_INTL_SUPPORT
 
diff --git a/deps/v8/src/objects-inl.h b/deps/v8/src/objects-inl.h
index 59a2096cd8ad82..dea3929b918812 100644
--- a/deps/v8/src/objects-inl.h
+++ b/deps/v8/src/objects-inl.h
@@ -32,6 +32,7 @@
 #include "src/lookup.h"
 #include "src/objects/bigint.h"
 #include "src/objects/descriptor-array.h"
+#include "src/objects/js-proxy-inl.h"
 #include "src/objects/literal-objects.h"
 #include "src/objects/maybe-object-inl.h"
 #include "src/objects/regexp-match-info.h"
@@ -517,7 +518,7 @@ bool HeapObject::IsStringSet() const { return IsHashTable(); }
 bool HeapObject::IsObjectHashSet() const { return IsHashTable(); }
 
 bool HeapObject::IsNormalizedMapCache() const {
-  return NormalizedMapCache::IsNormalizedMapCache(GetIsolate(), this);
+  return NormalizedMapCache::IsNormalizedMapCache(this);
 }
 
 bool HeapObject::IsCompilationCacheTable() const { return IsHashTable(); }
@@ -627,7 +628,6 @@ CAST_ACCESSOR(JSGlobalObject)
 CAST_ACCESSOR(JSGlobalProxy)
 CAST_ACCESSOR(JSMessageObject)
 CAST_ACCESSOR(JSObject)
-CAST_ACCESSOR(JSProxy)
 CAST_ACCESSOR(JSReceiver)
 CAST_ACCESSOR(JSStringIterator)
 CAST_ACCESSOR(JSValue)
@@ -802,17 +802,15 @@ MaybeHandle<Object> Object::ToPrimitive(Handle<Object> input,
 }
 
 // static
-MaybeHandle<Object> Object::ToNumber(Handle<Object> input) {
+MaybeHandle<Object> Object::ToNumber(Isolate* isolate, Handle<Object> input) {
   if (input->IsNumber()) return input;  // Shortcut.
-  return ConvertToNumberOrNumeric(HeapObject::cast(*input)->GetIsolate(), input,
-                                  Conversion::kToNumber);
+  return ConvertToNumberOrNumeric(isolate, input, Conversion::kToNumber);
 }
 
 // static
-MaybeHandle<Object> Object::ToNumeric(Handle<Object> input) {
+MaybeHandle<Object> Object::ToNumeric(Isolate* isolate, Handle<Object> input) {
   if (input->IsNumber() || input->IsBigInt()) return input;  // Shortcut.
-  return ConvertToNumberOrNumeric(HeapObject::cast(*input)->GetIsolate(), input,
-                                  Conversion::kToNumeric);
+  return ConvertToNumberOrNumeric(isolate, input, Conversion::kToNumeric);
 }
 
 // static
@@ -855,9 +853,9 @@ MaybeHandle<Object> Object::ToIndex(Isolate* isolate, Handle<Object> input,
   return ConvertToIndex(isolate, input, error_index);
 }
 
-MaybeHandle<Object> Object::GetProperty(Handle<Object> object,
+MaybeHandle<Object> Object::GetProperty(Isolate* isolate, Handle<Object> object,
                                         Handle<Name> name) {
-  LookupIterator it(object, name);
+  LookupIterator it(isolate, object, name);
   if (!it.IsFound()) return it.factory()->undefined_value();
   return GetProperty(&it);
 }
@@ -984,12 +982,12 @@ HeapObject* MapWord::ToForwardingAddress() {
 
 
 #ifdef VERIFY_HEAP
-void HeapObject::VerifyObjectField(int offset) {
-  VerifyPointer(READ_FIELD(this, offset));
+void HeapObject::VerifyObjectField(Isolate* isolate, int offset) {
+  VerifyPointer(isolate, READ_FIELD(this, offset));
 }
 
-void HeapObject::VerifyMaybeObjectField(int offset) {
-  MaybeObject::VerifyMaybeObjectPointer(READ_WEAK_FIELD(this, offset));
+void HeapObject::VerifyMaybeObjectField(Isolate* isolate, int offset) {
+  MaybeObject::VerifyMaybeObjectPointer(isolate, READ_WEAK_FIELD(this, offset));
 }
 
 void HeapObject::VerifySmiField(int offset) {
@@ -1003,19 +1001,6 @@ ReadOnlyRoots HeapObject::GetReadOnlyRoots() const {
   return ReadOnlyRoots(MemoryChunk::FromHeapObject(this)->heap());
 }
 
-Heap* HeapObject::GetHeap() const {
-  Heap* heap = MemoryChunk::FromAddress(
-                   reinterpret_cast<Address>(const_cast<HeapObject*>(this)))
-                   ->heap();
-  SLOW_DCHECK(heap != nullptr);
-  return heap;
-}
-
-
-Isolate* HeapObject::GetIsolate() const {
-  return GetHeap()->isolate();
-}
-
 Heap* NeverReadOnlySpaceObject::GetHeap() const {
   MemoryChunk* chunk =
       MemoryChunk::FromAddress(reinterpret_cast<Address>(this));
@@ -1458,7 +1443,7 @@ ACCESSORS(PropertyCell, name, Name, kNameOffset)
 ACCESSORS(PropertyCell, value, Object, kValueOffset)
 ACCESSORS(PropertyCell, property_details_raw, Object, kDetailsOffset)
 
-PropertyDetails PropertyCell::property_details() {
+PropertyDetails PropertyCell::property_details() const {
   return PropertyDetails(Smi::cast(property_details_raw()));
 }
 
@@ -1840,6 +1825,10 @@ bool HeapObject::NeedsRehashing() const {
   }
 }
 
+Address HeapObject::GetFieldAddress(int field_offset) const {
+  return FIELD_ADDR(this, field_offset);
+}
+
 void PropertyArray::set(int index, Object* value, WriteBarrierMode mode) {
   DCHECK_GE(index, 0);
   DCHECK_LT(index, this->length());
@@ -2646,11 +2635,6 @@ bool JSFunction::is_compiled() {
   return code()->builtin_index() != Builtins::kCompileLazy;
 }
 
-ACCESSORS(JSProxy, target, Object, kTargetOffset)
-ACCESSORS(JSProxy, handler, Object, kHandlerOffset)
-
-bool JSProxy::IsRevoked() const { return !handler()->IsJSReceiver(); }
-
 // static
 bool Foreign::IsNormalized(Object* value) {
   if (value == Smi::kZero) return true;
@@ -2923,20 +2907,20 @@ Maybe<bool> Object::LessThanOrEqual(Isolate* isolate, Handle<Object> x,
   return Nothing<bool>();
 }
 
-MaybeHandle<Object> Object::GetPropertyOrElement(Handle<Object> object,
+MaybeHandle<Object> Object::GetPropertyOrElement(Isolate* isolate,
+                                                 Handle<Object> object,
                                                  Handle<Name> name) {
-  LookupIterator it =
-      LookupIterator::PropertyOrElement(name->GetIsolate(), object, name);
+  LookupIterator it = LookupIterator::PropertyOrElement(isolate, object, name);
   return GetProperty(&it);
 }
 
-MaybeHandle<Object> Object::SetPropertyOrElement(Handle<Object> object,
+MaybeHandle<Object> Object::SetPropertyOrElement(Isolate* isolate,
+                                                 Handle<Object> object,
                                                  Handle<Name> name,
                                                  Handle<Object> value,
                                                  LanguageMode language_mode,
                                                  StoreFromKeyed store_mode) {
-  LookupIterator it =
-      LookupIterator::PropertyOrElement(name->GetIsolate(), object, name);
+  LookupIterator it = LookupIterator::PropertyOrElement(isolate, object, name);
   MAYBE_RETURN_NULL(SetProperty(&it, value, language_mode, store_mode));
   return value;
 }
@@ -3118,14 +3102,15 @@ bool AccessorPair::IsJSAccessor(Object* obj) {
 }
 
 template <typename Derived, typename Shape>
-void Dictionary<Derived, Shape>::ClearEntry(int entry) {
+void Dictionary<Derived, Shape>::ClearEntry(Isolate* isolate, int entry) {
   Object* the_hole = this->GetReadOnlyRoots().the_hole_value();
   PropertyDetails details = PropertyDetails::Empty();
-  Derived::cast(this)->SetEntry(entry, the_hole, the_hole, details);
+  Derived::cast(this)->SetEntry(isolate, entry, the_hole, the_hole, details);
 }
 
 template <typename Derived, typename Shape>
-void Dictionary<Derived, Shape>::SetEntry(int entry, Object* key, Object* value,
+void Dictionary<Derived, Shape>::SetEntry(Isolate* isolate, int entry,
+                                          Object* key, Object* value,
                                           PropertyDetails details) {
   DCHECK(Dictionary::kEntrySize == 2 || Dictionary::kEntrySize == 3);
   DCHECK(!key->IsName() || details.dictionary_index() > 0);
@@ -3134,7 +3119,7 @@ void Dictionary<Derived, Shape>::SetEntry(int entry, Object* key, Object* value,
   WriteBarrierMode mode = this->GetWriteBarrierMode(no_gc);
   this->set(index + Derived::kEntryKeyIndex, key, mode);
   this->set(index + Derived::kEntryValueIndex, value, mode);
-  if (Shape::kHasDetails) DetailsAtPut(entry, details);
+  if (Shape::kHasDetails) DetailsAtPut(isolate, entry, details);
 }
 
 Object* GlobalDictionaryShape::Unwrap(Object* object) {
@@ -3168,11 +3153,11 @@ bool GlobalDictionaryShape::IsKey(ReadOnlyRoots roots, Object* k) {
 Name* GlobalDictionary::NameAt(int entry) { return CellAt(entry)->name(); }
 Object* GlobalDictionary::ValueAt(int entry) { return CellAt(entry)->value(); }
 
-void GlobalDictionary::SetEntry(int entry, Object* key, Object* value,
-                                PropertyDetails details) {
+void GlobalDictionary::SetEntry(Isolate* isolate, int entry, Object* key,
+                                Object* value, PropertyDetails details) {
   DCHECK_EQ(key, PropertyCell::cast(value)->name());
   set(EntryToIndex(entry) + kEntryKeyIndex, value);
-  DetailsAtPut(entry, details);
+  DetailsAtPut(isolate, entry, details);
 }
 
 void GlobalDictionary::ValueAtPut(int entry, Object* value) {
@@ -3244,15 +3229,14 @@ PropertyDetails GlobalDictionaryShape::DetailsAt(Dictionary* dict, int entry) {
   return dict->CellAt(entry)->property_details();
 }
 
-
 template <typename Dictionary>
-void GlobalDictionaryShape::DetailsAtPut(Dictionary* dict, int entry,
-                                         PropertyDetails value) {
+void GlobalDictionaryShape::DetailsAtPut(Isolate* isolate, Dictionary* dict,
+                                         int entry, PropertyDetails value) {
   DCHECK_LE(0, entry);  // Not found is -1, which is not caught by get().
   PropertyCell* cell = dict->CellAt(entry);
   if (cell->property_details().IsReadOnly() != value.IsReadOnly()) {
     cell->dependent_code()->DeoptimizeDependentCodeGroup(
-        cell->GetIsolate(), DependentCode::kPropertyCellChangedGroup);
+        isolate, DependentCode::kPropertyCellChangedGroup);
   }
   cell->set_property_details(value);
 }
diff --git a/deps/v8/src/objects-printer.cc b/deps/v8/src/objects-printer.cc
index aeadc2d3981615..17f4f22f31d127 100644
--- a/deps/v8/src/objects-printer.cc
+++ b/deps/v8/src/objects-printer.cc
@@ -2457,7 +2457,7 @@ extern void _v8_internal_Print_TransitionTree(void* object) {
 #if defined(DEBUG) || defined(OBJECT_PRINT)
     i::DisallowHeapAllocation no_gc;
     i::Map* map = reinterpret_cast<i::Map*>(object);
-    i::TransitionsAccessor transitions(map->GetIsolate(), map, &no_gc);
+    i::TransitionsAccessor transitions(i::Isolate::Current(), map, &no_gc);
     transitions.PrintTransitionTree();
 #endif
   }
diff --git a/deps/v8/src/objects.cc b/deps/v8/src/objects.cc
index 117e399d16c81f..f6454f64a6ffc6 100644
--- a/deps/v8/src/objects.cc
+++ b/deps/v8/src/objects.cc
@@ -465,7 +465,7 @@ Handle<String> Object::NoSideEffectsToString(Isolate* isolate,
 // static
 MaybeHandle<Object> Object::ConvertToLength(Isolate* isolate,
                                             Handle<Object> input) {
-  ASSIGN_RETURN_ON_EXCEPTION(isolate, input, ToNumber(input), Object);
+  ASSIGN_RETURN_ON_EXCEPTION(isolate, input, ToNumber(isolate, input), Object);
   if (input->IsSmi()) {
     int value = std::max(Smi::ToInt(*input), 0);
     return handle(Smi::FromInt(value), isolate);
@@ -484,7 +484,7 @@ MaybeHandle<Object> Object::ConvertToIndex(
     Isolate* isolate, Handle<Object> input,
     MessageTemplate::Template error_index) {
   if (input->IsUndefined(isolate)) return handle(Smi::kZero, isolate);
-  ASSIGN_RETURN_ON_EXCEPTION(isolate, input, ToNumber(input), Object);
+  ASSIGN_RETURN_ON_EXCEPTION(isolate, input, ToNumber(isolate, input), Object);
   if (input->IsSmi() && Smi::ToInt(*input) >= 0) return input;
   double len = DoubleToInteger(input->Number()) + 0.0;
   auto js_len = isolate->factory()->NewNumber(len);
@@ -572,8 +572,8 @@ Maybe<ComparisonResult> Object::Compare(Isolate* isolate, Handle<Object> x,
         isolate, Handle<BigInt>::cast(y), Handle<String>::cast(x))));
   }
   // ES6 section 7.2.11 Abstract Relational Comparison step 6.
-  if (!Object::ToNumeric(x).ToHandle(&x) ||
-      !Object::ToNumeric(y).ToHandle(&y)) {
+  if (!Object::ToNumeric(isolate, x).ToHandle(&x) ||
+      !Object::ToNumeric(isolate, y).ToHandle(&y)) {
     return Nothing<ComparisonResult>();
   }
 
@@ -741,8 +741,10 @@ MaybeHandle<Object> Object::Add(Isolate* isolate, Handle<Object> lhs,
     return isolate->factory()->NewConsString(Handle<String>::cast(lhs),
                                              Handle<String>::cast(rhs));
   }
-  ASSIGN_RETURN_ON_EXCEPTION(isolate, rhs, Object::ToNumber(rhs), Object);
-  ASSIGN_RETURN_ON_EXCEPTION(isolate, lhs, Object::ToNumber(lhs), Object);
+  ASSIGN_RETURN_ON_EXCEPTION(isolate, rhs, Object::ToNumber(isolate, rhs),
+                             Object);
+  ASSIGN_RETURN_ON_EXCEPTION(isolate, lhs, Object::ToNumber(isolate, lhs),
+                             Object);
   return isolate->factory()->NewNumber(lhs->Number() + rhs->Number());
 }
 
@@ -770,7 +772,8 @@ MaybeHandle<Object> Object::OrdinaryHasInstance(Isolate* isolate,
   Handle<Object> prototype;
   ASSIGN_RETURN_ON_EXCEPTION(
       isolate, prototype,
-      Object::GetProperty(callable, isolate->factory()->prototype_string()),
+      Object::GetProperty(isolate, callable,
+                          isolate->factory()->prototype_string()),
       Object);
   if (!prototype->IsJSReceiver()) {
     THROW_NEW_ERROR(
@@ -2040,7 +2043,8 @@ void JSObject::SetNormalizedProperty(Handle<JSObject> object,
                            : PropertyCellType::kConstant;
       details = details.set_cell_type(cell_type);
       value = cell;
-      dictionary = GlobalDictionary::Add(dictionary, name, value, details);
+      dictionary =
+          GlobalDictionary::Add(isolate, dictionary, name, value, details);
       global_obj->set_global_dictionary(*dictionary);
     } else {
       Handle<PropertyCell> cell = PropertyCell::PrepareForValue(
@@ -2050,18 +2054,19 @@ void JSObject::SetNormalizedProperty(Handle<JSObject> object,
   } else {
     Handle<NameDictionary> dictionary(object->property_dictionary(), isolate);
 
-    int entry = dictionary->FindEntry(name);
+    int entry = dictionary->FindEntry(isolate, name);
     if (entry == NameDictionary::kNotFound) {
       DCHECK_IMPLIES(object->map()->is_prototype_map(),
                      Map::IsPrototypeChainInvalidated(object->map()));
-      dictionary = NameDictionary::Add(dictionary, name, value, details);
+      dictionary =
+          NameDictionary::Add(isolate, dictionary, name, value, details);
       object->SetProperties(*dictionary);
     } else {
       PropertyDetails original_details = dictionary->DetailsAt(entry);
       int enumeration_index = original_details.dictionary_index();
       DCHECK_GT(enumeration_index, 0);
       details = details.set_index(enumeration_index);
-      dictionary->SetEntry(entry, *name, *value, details);
+      dictionary->SetEntry(isolate, entry, *name, *value, details);
     }
   }
 }
@@ -2350,7 +2355,7 @@ MaybeHandle<Object> Object::ArraySpeciesConstructor(
   if (is_array.FromJust()) {
     ASSIGN_RETURN_ON_EXCEPTION(
         isolate, constructor,
-        Object::GetProperty(original_array,
+        Object::GetProperty(isolate, original_array,
                             isolate->factory()->constructor_string()),
         Object);
     if (constructor->IsConstructor()) {
@@ -2637,7 +2642,7 @@ bool String::MakeExternal(v8::String::ExternalStringResource* resource) {
   this->synchronized_set_map(new_map);
 
   ExternalTwoByteString* self = ExternalTwoByteString::cast(this);
-  self->SetResource(resource);
+  self->set_resource(resource);
   heap->RegisterExternalString(this);
   if (is_internalized) self->Hash();  // Force regeneration of the hash value.
   return true;
@@ -2711,7 +2716,7 @@ bool String::MakeExternal(v8::String::ExternalOneByteStringResource* resource) {
   this->synchronized_set_map(new_map);
 
   ExternalOneByteString* self = ExternalOneByteString::cast(this);
-  self->SetResource(resource);
+  self->set_resource(resource);
   heap->RegisterExternalString(this);
   if (is_internalized) self->Hash();  // Force regeneration of the hash value.
   return true;
@@ -3760,7 +3765,7 @@ void HeapObject::RehashBasedOnMap(Isolate* isolate) {
       DescriptorArray::cast(this)->Sort();
       break;
     case TRANSITION_ARRAY_TYPE:
-      TransitionArray::cast(this)->Sort(GetIsolate());
+      TransitionArray::cast(this)->Sort();
       break;
     case SMALL_ORDERED_HASH_MAP_TYPE:
       DCHECK_EQ(0, SmallOrderedHashMap::cast(this)->NumberOfElements());
@@ -3847,9 +3852,9 @@ Handle<Context> JSReceiver::GetCreationContext() {
 }
 
 // static
-MaybeObjectHandle Map::WrapFieldType(Handle<FieldType> type) {
+MaybeObjectHandle Map::WrapFieldType(Isolate* isolate, Handle<FieldType> type) {
   if (type->IsClass()) {
-    return MaybeObjectHandle::Weak(type->AsClass());
+    return MaybeObjectHandle::Weak(type->AsClass(), isolate);
   }
   return MaybeObjectHandle(type);
 }
@@ -3893,7 +3898,7 @@ MaybeHandle<Map> Map::CopyWithField(Isolate* isolate, Handle<Map> map,
         isolate, map->instance_type(), &constness, &representation, &type);
   }
 
-  MaybeObjectHandle wrapped_type = WrapFieldType(type);
+  MaybeObjectHandle wrapped_type = WrapFieldType(isolate, type);
 
   DCHECK_IMPLIES(!FLAG_track_constant_fields,
                  constness == PropertyConstness::kMutable);
@@ -3921,7 +3926,8 @@ MaybeHandle<Map> Map::CopyWithConstant(Isolate* isolate, Handle<Map> map,
                          PropertyConstness::kConst, representation, flag);
   } else {
     // Allocate new instance descriptors with (name, constant) added.
-    Descriptor d = Descriptor::DataConstant(name, 0, constant, attributes);
+    Descriptor d =
+        Descriptor::DataConstant(isolate, name, 0, constant, attributes);
     Handle<Map> new_map = Map::CopyAddDescriptor(isolate, map, &d, flag);
     return new_map;
   }
@@ -4340,7 +4346,7 @@ void MigrateFastToSlow(Handle<JSObject> object, Handle<Map> new_map,
     DCHECK(!value.is_null());
     PropertyDetails d(details.kind(), details.attributes(),
                       PropertyCellType::kNoCell);
-    dictionary = NameDictionary::Add(dictionary, key, value, d);
+    dictionary = NameDictionary::Add(isolate, dictionary, key, value, d);
   }
 
   // Copy the next enumeration index from instance descriptor.
@@ -4518,8 +4524,8 @@ Handle<Map> Map::CopyGeneralizeAllFields(Isolate* isolate, Handle<Map> map,
                             ? details.field_index()
                             : new_map->NumberOfFields();
       Descriptor d = Descriptor::DataField(
-          handle(descriptors->GetKey(modify_index), isolate), field_index,
-          attributes, Representation::Tagged());
+          isolate, handle(descriptors->GetKey(modify_index), isolate),
+          field_index, attributes, Representation::Tagged());
       descriptors->Replace(modify_index, &d);
       if (details.location() != kField) {
         new_map->AccountAddedPropertyField();
@@ -4561,7 +4567,7 @@ void Map::DeprecateTransitionTree(Isolate* isolate) {
   }
   dependent_code()->DeoptimizeDependentCodeGroup(
       isolate, DependentCode::kTransitionGroup);
-  NotifyLeafMapLayoutChange();
+  NotifyLeafMapLayoutChange(isolate);
 }
 
 
@@ -4736,7 +4742,7 @@ void Map::GeneralizeField(Isolate* isolate, Handle<Map> map, int modify_index,
   PropertyDetails details = descriptors->GetDetails(modify_index);
   Handle<Name> name(descriptors->GetKey(modify_index), isolate);
 
-  MaybeObjectHandle wrapped_type(WrapFieldType(new_field_type));
+  MaybeObjectHandle wrapped_type(WrapFieldType(isolate, new_field_type));
   field_owner->UpdateFieldType(isolate, modify_index, name, new_constness,
                                new_representation, wrapped_type);
   field_owner->dependent_code()->DeoptimizeDependentCodeGroup(
@@ -4917,11 +4923,11 @@ Maybe<bool> JSObject::SetPropertyWithInterceptor(LookupIterator* it,
                                             should_throw, value);
 }
 
-MaybeHandle<Object> Object::SetProperty(Handle<Object> object,
+MaybeHandle<Object> Object::SetProperty(Isolate* isolate, Handle<Object> object,
                                         Handle<Name> name, Handle<Object> value,
                                         LanguageMode language_mode,
                                         StoreFromKeyed store_mode) {
-  LookupIterator it(object, name);
+  LookupIterator it(isolate, object, name);
   MAYBE_RETURN_NULL(SetProperty(&it, value, language_mode, store_mode));
   return value;
 }
@@ -5002,9 +5008,9 @@ Maybe<bool> Object::SetPropertyInternal(LookupIterator* it,
               it->isolate(), throwaway_value,
               BigInt::FromObject(it->isolate(), value), Nothing<bool>());
         } else {
-          ASSIGN_RETURN_ON_EXCEPTION_VALUE(it->isolate(), throwaway_value,
-                                           Object::ToNumber(value),
-                                           Nothing<bool>());
+          ASSIGN_RETURN_ON_EXCEPTION_VALUE(
+              it->isolate(), throwaway_value,
+              Object::ToNumber(it->isolate(), value), Nothing<bool>());
         }
 
         // FIXME: Throw a TypeError if the holder is neutered here
@@ -5090,7 +5096,7 @@ Maybe<bool> Object::SetSuperProperty(LookupIterator* it, Handle<Object> value,
   LookupIterator::Configuration c = LookupIterator::OWN;
   LookupIterator own_lookup =
       it->IsElement() ? LookupIterator(isolate, receiver, it->index(), c)
-                      : LookupIterator(receiver, it->name(), c);
+                      : LookupIterator(isolate, receiver, it->name(), c);
 
   for (; own_lookup.IsFound(); own_lookup.Next()) {
     switch (own_lookup.state()) {
@@ -5219,8 +5225,9 @@ Maybe<bool> Object::SetDataProperty(LookupIterator* it, Handle<Object> value) {
         // TODO(neis): According to the spec, this should throw a TypeError.
       }
     } else if (!value->IsNumber() && !value->IsUndefined(it->isolate())) {
-      ASSIGN_RETURN_ON_EXCEPTION_VALUE(
-          it->isolate(), to_assign, Object::ToNumber(value), Nothing<bool>());
+      ASSIGN_RETURN_ON_EXCEPTION_VALUE(it->isolate(), to_assign,
+                                       Object::ToNumber(it->isolate(), value),
+                                       Nothing<bool>());
       // We have to recheck the length. However, it can only change if the
       // underlying buffer was neutered, so just check that.
       if (Handle<JSArrayBufferView>::cast(receiver)->WasNeutered()) {
@@ -5419,7 +5426,8 @@ MaybeHandle<Map> Map::TryGetObjectCreateMap(Isolate* isolate,
 }
 
 template <class T>
-static int AppendUniqueCallbacks(Handle<TemplateList> callbacks,
+static int AppendUniqueCallbacks(Isolate* isolate,
+                                 Handle<TemplateList> callbacks,
                                  Handle<typename T::Array> array,
                                  int valid_descriptors) {
   int nof_callbacks = callbacks->length();
@@ -5427,7 +5435,6 @@ static int AppendUniqueCallbacks(Handle<TemplateList> callbacks,
   // Fill in new callback descriptors.  Process the callbacks from
   // back to front so that the last callback with a given name takes
   // precedence over previously added callbacks with that name.
-  Isolate* isolate = callbacks->GetIsolate();
   for (int i = nof_callbacks - 1; i >= 0; i--) {
     Handle<AccessorInfo> entry(AccessorInfo::cast(callbacks->get(i)), isolate);
     Handle<Name> key(Name::cast(entry->name()), isolate);
@@ -5462,13 +5469,12 @@ struct FixedArrayAppender {
   }
 };
 
-
-int AccessorInfo::AppendUnique(Handle<Object> descriptors,
+int AccessorInfo::AppendUnique(Isolate* isolate, Handle<Object> descriptors,
                                Handle<FixedArray> array,
                                int valid_descriptors) {
   Handle<TemplateList> callbacks = Handle<TemplateList>::cast(descriptors);
   DCHECK_GE(array->length(), callbacks->length() + valid_descriptors);
-  return AppendUniqueCallbacks<FixedArrayAppender>(callbacks, array,
+  return AppendUniqueCallbacks<FixedArrayAppender>(isolate, callbacks, array,
                                                    valid_descriptors);
 }
 
@@ -5554,15 +5560,6 @@ bool Map::IsMapInArrayPrototypeChain(Isolate* isolate) const {
   return false;
 }
 
-Handle<WeakCell> Map::WeakCellForMap(Isolate* isolate, Handle<Map> map) {
-  if (map->weak_cell_cache()->IsWeakCell()) {
-    return Handle<WeakCell>(WeakCell::cast(map->weak_cell_cache()), isolate);
-  }
-  Handle<WeakCell> weak_cell = isolate->factory()->NewWeakCell(map);
-  map->set_weak_cell_cache(*weak_cell);
-  return weak_cell;
-}
-
 static Handle<Map> AddMissingElementsTransitions(Isolate* isolate,
                                                  Handle<Map> map,
                                                  ElementsKind to_kind) {
@@ -6338,8 +6335,8 @@ Maybe<PropertyAttributes> JSReceiver::GetPropertyAttributes(
 
 
 Handle<NormalizedMapCache> NormalizedMapCache::New(Isolate* isolate) {
-  Handle<FixedArray> array(
-      isolate->factory()->NewFixedArray(kEntries, TENURED));
+  Handle<WeakFixedArray> array(
+      isolate->factory()->NewWeakFixedArray(kEntries, TENURED));
   return Handle<NormalizedMapCache>::cast(array);
 }
 
@@ -6347,35 +6344,26 @@ Handle<NormalizedMapCache> NormalizedMapCache::New(Isolate* isolate) {
 MaybeHandle<Map> NormalizedMapCache::Get(Handle<Map> fast_map,
                                          PropertyNormalizationMode mode) {
   DisallowHeapAllocation no_gc;
-  Object* value = FixedArray::get(GetIndex(fast_map));
-  if (!value->IsWeakCell() || WeakCell::cast(value)->cleared()) {
+  MaybeObject* value = WeakFixedArray::Get(GetIndex(fast_map));
+  HeapObject* heap_object;
+  if (!value->ToWeakHeapObject(&heap_object)) {
     return MaybeHandle<Map>();
   }
 
-  Map* normalized_map = Map::cast(WeakCell::cast(value)->value());
+  Map* normalized_map = Map::cast(heap_object);
   if (!normalized_map->EquivalentToForNormalization(*fast_map, mode)) {
     return MaybeHandle<Map>();
   }
-  return handle(normalized_map, normalized_map->GetIsolate());
+  return handle(normalized_map, GetIsolate());
 }
 
-void NormalizedMapCache::Set(Handle<Map> fast_map, Handle<Map> normalized_map,
-                             Handle<WeakCell> normalized_map_weak_cell) {
+void NormalizedMapCache::Set(Handle<Map> fast_map, Handle<Map> normalized_map) {
   DisallowHeapAllocation no_gc;
   DCHECK(normalized_map->is_dictionary_map());
-  DCHECK_EQ(normalized_map_weak_cell->value(), *normalized_map);
-  FixedArray::set(GetIndex(fast_map), *normalized_map_weak_cell);
-}
-
-
-void NormalizedMapCache::Clear() {
-  int entries = length();
-  for (int i = 0; i != entries; i++) {
-    set_undefined(i);
-  }
+  WeakFixedArray::Set(GetIndex(fast_map),
+                      HeapObjectReference::Weak(*normalized_map));
 }
 
-
 void JSObject::NormalizeProperties(Handle<JSObject> object,
                                    PropertyNormalizationMode mode,
                                    int expected_additional_properties,
@@ -6404,7 +6392,7 @@ void JSObject::MigrateSlowToFast(Handle<JSObject> object,
   if (number_of_elements > kMaxNumberOfDescriptors) return;
 
   Handle<FixedArray> iteration_order =
-      NameDictionary::IterationIndices(dictionary);
+      NameDictionary::IterationIndices(isolate, dictionary);
 
   int instance_descriptor_length = iteration_order->length();
   int number_of_fields = 0;
@@ -6540,7 +6528,7 @@ void JSObject::MigrateSlowToFast(Handle<JSObject> object,
   descriptors->Sort();
 
   Handle<LayoutDescriptor> layout_descriptor = LayoutDescriptor::New(
-      new_map, descriptors, descriptors->number_of_descriptors());
+      isolate, new_map, descriptors, descriptors->number_of_descriptors());
 
   DisallowHeapAllocation no_gc;
   new_map->InitializeDescriptors(*descriptors, *layout_descriptor);
@@ -6629,11 +6617,12 @@ Handle<NumberDictionary> JSObject::NormalizeElements(Handle<JSObject> object) {
 
 namespace {
 
-Object* SetHashAndUpdateProperties(HeapObject* properties, int hash) {
+Object* SetHashAndUpdateProperties(Isolate* isolate, HeapObject* properties,
+                                   int hash) {
   DCHECK_NE(PropertyArray::kNoHashSentinel, hash);
   DCHECK(PropertyArray::HashField::is_valid(hash));
 
-  Heap* heap = properties->GetHeap();
+  Heap* heap = isolate->heap();
   ReadOnlyRoots roots(heap);
   if (properties == roots.empty_fixed_array() ||
       properties == roots.empty_property_array() ||
@@ -6690,7 +6679,7 @@ void JSReceiver::SetIdentityHash(int hash) {
 
   HeapObject* existing_properties = HeapObject::cast(raw_properties_or_hash());
   Object* new_properties =
-      SetHashAndUpdateProperties(existing_properties, hash);
+      SetHashAndUpdateProperties(GetIsolate(), existing_properties, hash);
   set_raw_properties_or_hash(new_properties);
 }
 
@@ -6706,7 +6695,7 @@ void JSReceiver::SetProperties(HeapObject* properties) {
   // TODO(cbruni): Make GetIdentityHashHelper return a bool so that we
   // don't have to manually compare against kNoHashSentinel.
   if (hash != PropertyArray::kNoHashSentinel) {
-    new_properties = SetHashAndUpdateProperties(properties, hash);
+    new_properties = SetHashAndUpdateProperties(isolate, properties, hash);
   }
 
   set_raw_properties_or_hash(new_properties);
@@ -7533,7 +7522,7 @@ bool JSArray::AnythingToArrayLength(Isolate* isolate,
   }
   // 5. Let numberLen be ToNumber(Desc.[[Value]]).
   Handle<Object> number_v;
-  if (!Object::ToNumber(length_object).ToHandle(&number_v)) {
+  if (!Object::ToNumber(isolate, length_object).ToHandle(&number_v)) {
     // 6. ReturnIfAbrupt(newLen).
     return false;
   }
@@ -7779,7 +7768,7 @@ Maybe<bool> JSProxy::SetPrivateSymbol(Isolate* isolate, Handle<JSProxy> proxy,
   Handle<NameDictionary> dict(proxy->property_dictionary(), isolate);
   PropertyDetails details(kData, DONT_ENUM, PropertyCellType::kNoCell);
   Handle<NameDictionary> result =
-      NameDictionary::Add(dict, private_name, value, details);
+      NameDictionary::Add(isolate, dict, private_name, value, details);
   if (!dict.is_identical_to(result)) proxy->SetProperties(*result);
   return Just(true);
 }
@@ -7801,13 +7790,17 @@ namespace {
 
 Maybe<bool> GetPropertyDescriptorWithInterceptor(LookupIterator* it,
                                                  PropertyDescriptor* desc) {
-  bool has_access = true;
   if (it->state() == LookupIterator::ACCESS_CHECK) {
-    has_access = it->HasAccess() || JSObject::AllCanRead(it);
-    it->Next();
+    if (it->HasAccess()) {
+      it->Next();
+    } else if (!JSObject::AllCanRead(it) ||
+               it->state() != LookupIterator::INTERCEPTOR) {
+      it->Restart();
+      return Just(false);
+    }
   }
 
-  if (has_access && it->state() == LookupIterator::INTERCEPTOR) {
+  if (it->state() == LookupIterator::INTERCEPTOR) {
     Isolate* isolate = it->isolate();
     Handle<InterceptorInfo> interceptor = it->GetInterceptor();
     if (!interceptor->descriptor()->IsUndefined(isolate)) {
@@ -7839,9 +7832,9 @@ Maybe<bool> GetPropertyDescriptorWithInterceptor(LookupIterator* it,
 
         return Just(true);
       }
+      it->Next();
     }
   }
-  it->Restart();
   return Just(false);
 }
 }  // namespace
@@ -7895,9 +7888,11 @@ Maybe<bool> JSReceiver::GetOwnPropertyDescriptor(LookupIterator* it,
     Handle<AccessorPair> accessors =
         Handle<AccessorPair>::cast(it->GetAccessors());
     // 6a. Set D.[[Get]] to the value of X's [[Get]] attribute.
-    desc->set_get(AccessorPair::GetComponent(accessors, ACCESSOR_GETTER));
+    desc->set_get(
+        AccessorPair::GetComponent(isolate, accessors, ACCESSOR_GETTER));
     // 6b. Set D.[[Set]] to the value of X's [[Set]] attribute.
-    desc->set_set(AccessorPair::GetComponent(accessors, ACCESSOR_SETTER));
+    desc->set_set(
+        AccessorPair::GetComponent(isolate, accessors, ACCESSOR_SETTER));
   }
 
   // 7. Set D.[[Enumerable]] to the value of X's [[Enumerable]] attribute.
@@ -8545,7 +8540,7 @@ bool JSObject::IsExtensible(Handle<JSObject> object) {
 namespace {
 
 template <typename Dictionary>
-void ApplyAttributesToDictionary(ReadOnlyRoots roots,
+void ApplyAttributesToDictionary(Isolate* isolate, ReadOnlyRoots roots,
                                  Handle<Dictionary> dictionary,
                                  const PropertyAttributes attributes) {
   int capacity = dictionary->Capacity();
@@ -8561,7 +8556,7 @@ void ApplyAttributesToDictionary(ReadOnlyRoots roots,
       if (v->IsAccessorPair()) attrs &= ~READ_ONLY;
     }
     details = details.CopyAddAttributes(static_cast<PropertyAttributes>(attrs));
-    dictionary->DetailsAtPut(i, details);
+    dictionary->DetailsAtPut(isolate, i, details);
   }
 }
 
@@ -8677,11 +8672,11 @@ Maybe<bool> JSObject::PreventExtensionsWithTransition(
       if (object->IsJSGlobalObject()) {
         Handle<GlobalDictionary> dictionary(
             JSGlobalObject::cast(*object)->global_dictionary(), isolate);
-        ApplyAttributesToDictionary(roots, dictionary, attrs);
+        ApplyAttributesToDictionary(isolate, roots, dictionary, attrs);
       } else {
         Handle<NameDictionary> dictionary(object->property_dictionary(),
                                           isolate);
-        ApplyAttributesToDictionary(roots, dictionary, attrs);
+        ApplyAttributesToDictionary(isolate, roots, dictionary, attrs);
       }
     }
   }
@@ -8710,7 +8705,8 @@ Maybe<bool> JSObject::PreventExtensionsWithTransition(
     // Make sure we never go back to the fast case
     object->RequireSlowElements(*dictionary);
     if (attrs != NONE) {
-      ApplyAttributesToDictionary(ReadOnlyRoots(isolate), dictionary, attrs);
+      ApplyAttributesToDictionary(isolate, ReadOnlyRoots(isolate), dictionary,
+                                  attrs);
     }
   }
 
@@ -8948,7 +8944,8 @@ V8_WARN_UNUSED_RESULT Maybe<bool> FastGetOwnValuesOrEntries(
     } else {
       // If the map did change, do a slower lookup. We are still guaranteed that
       // the object has a simple shape, and that the key is a name.
-      LookupIterator it(object, next_key, LookupIterator::OWN_SKIP_INTERCEPTOR);
+      LookupIterator it(isolate, object, next_key,
+                        LookupIterator::OWN_SKIP_INTERCEPTOR);
       if (!it.IsFound()) continue;
       DCHECK(it.state() == LookupIterator::DATA ||
              it.state() == LookupIterator::ACCESSOR);
@@ -9009,7 +9006,7 @@ MaybeHandle<FixedArray> GetOwnValuesOrEntries(Isolate* isolate,
 
     Handle<Object> value;
     ASSIGN_RETURN_ON_EXCEPTION_VALUE(
-        isolate, value, JSReceiver::GetPropertyOrElement(object, key),
+        isolate, value, JSReceiver::GetPropertyOrElement(isolate, object, key),
         MaybeHandle<FixedArray>());
 
     if (get_entries) {
@@ -9054,12 +9051,12 @@ Handle<FixedArray> JSReceiver::GetOwnElementIndices(Isolate* isolate,
   return keys;
 }
 
-bool Map::DictionaryElementsInPrototypeChainOnly() {
+bool Map::DictionaryElementsInPrototypeChainOnly(Isolate* isolate) {
   if (IsDictionaryElementsKind(elements_kind())) {
     return false;
   }
 
-  for (PrototypeIterator iter(this); !iter.IsAtEnd(); iter.Advance()) {
+  for (PrototypeIterator iter(isolate, this); !iter.IsAtEnd(); iter.Advance()) {
     // Be conservative, don't walk into proxies.
     if (iter.GetCurrent()->IsJSProxy()) return true;
     // String wrappers have non-configurable, non-writable elements.
@@ -9279,10 +9276,8 @@ Handle<Map> Map::Normalize(Isolate* isolate, Handle<Map> fast_map,
                             reinterpret_cast<void*>(new_map->address()),
                             Map::kDependentCodeOffset));
       }
-      STATIC_ASSERT(Map::kWeakCellCacheOffset ==
-                    Map::kDependentCodeOffset + kPointerSize);
       STATIC_ASSERT(Map::kPrototypeValidityCellOffset ==
-                    Map::kWeakCellCacheOffset + kPointerSize);
+                    Map::kDependentCodeOffset + kPointerSize);
       int offset = Map::kPrototypeValidityCellOffset + kPointerSize;
       DCHECK_EQ(0, memcmp(reinterpret_cast<void*>(fresh->address() + offset),
                           reinterpret_cast<void*>(new_map->address() + offset),
@@ -9292,15 +9287,14 @@ Handle<Map> Map::Normalize(Isolate* isolate, Handle<Map> fast_map,
   } else {
     new_map = Map::CopyNormalized(isolate, fast_map, mode);
     if (use_cache) {
-      Handle<WeakCell> cell = Map::WeakCellForMap(isolate, new_map);
-      cache->Set(fast_map, new_map, cell);
+      cache->Set(fast_map, new_map);
       isolate->counters()->maps_normalized()->Increment();
     }
     if (FLAG_trace_maps) {
       LOG(isolate, MapEvent("Normalize", *fast_map, *new_map, reason));
     }
   }
-  fast_map->NotifyLeafMapLayoutChange();
+  fast_map->NotifyLeafMapLayoutChange(isolate);
   return new_map;
 }
 
@@ -9342,9 +9336,8 @@ Handle<Map> Map::TransitionToImmutableProto(Isolate* isolate, Handle<Map> map) {
 }
 
 namespace {
-void EnsureInitialMap(Handle<Map> map) {
+void EnsureInitialMap(Isolate* isolate, Handle<Map> map) {
 #ifdef DEBUG
-  Isolate* isolate = map->GetIsolate();
   // Strict function maps have Function as a constructor but the
   // Function's initial map is a sloppy function map. Same holds for
   // GeneratorFunction / AsyncFunction and its initial map.
@@ -9373,7 +9366,7 @@ void EnsureInitialMap(Handle<Map> map) {
 // static
 Handle<Map> Map::CopyInitialMapNormalized(Isolate* isolate, Handle<Map> map,
                                           PropertyNormalizationMode mode) {
-  EnsureInitialMap(map);
+  EnsureInitialMap(isolate, map);
   return CopyNormalized(isolate, map, mode);
 }
 
@@ -9381,7 +9374,7 @@ Handle<Map> Map::CopyInitialMapNormalized(Isolate* isolate, Handle<Map> map,
 Handle<Map> Map::CopyInitialMap(Isolate* isolate, Handle<Map> map,
                                 int instance_size, int inobject_properties,
                                 int unused_property_fields) {
-  EnsureInitialMap(map);
+  EnsureInitialMap(isolate, map);
   Handle<Map> result =
       RawCopy(isolate, map, instance_size, inobject_properties);
 
@@ -9411,7 +9404,7 @@ Handle<Map> Map::CopyDropDescriptors(Isolate* isolate, Handle<Map> map) {
   if (map->IsJSObjectMap()) {
     result->CopyUnusedPropertyFields(*map);
   }
-  map->NotifyLeafMapLayoutChange();
+  map->NotifyLeafMapLayoutChange(isolate);
   return result;
 }
 
@@ -9446,7 +9439,8 @@ Handle<Map> Map::ShareDescriptor(Isolate* isolate, Handle<Map> map,
 
   Handle<LayoutDescriptor> layout_descriptor =
       FLAG_unbox_double_fields
-          ? LayoutDescriptor::ShareAppend(map, descriptor->GetDetails())
+          ? LayoutDescriptor::ShareAppend(isolate, map,
+                                          descriptor->GetDetails())
           : handle(LayoutDescriptor::FastPointerLayout(), isolate);
 
   {
@@ -9581,7 +9575,7 @@ Handle<Map> Map::AddMissingTransitions(
                        full_layout_descriptor);
     map = new_map;
   }
-  map->NotifyLeafMapLayoutChange();
+  map->NotifyLeafMapLayoutChange(isolate);
   last_map->set_may_have_interesting_symbols(false);
   InstallDescriptors(isolate, map, last_map, nof_descriptors - 1, descriptors,
                      full_layout_descriptor);
@@ -9607,7 +9601,7 @@ void Map::InstallDescriptors(Isolate* isolate, Handle<Map> parent,
 
   if (FLAG_unbox_double_fields) {
     Handle<LayoutDescriptor> layout_descriptor =
-        LayoutDescriptor::AppendIfFastOrUseFull(parent, details,
+        LayoutDescriptor::AppendIfFastOrUseFull(isolate, parent, details,
                                                 full_layout_descriptor);
     child->set_layout_descriptor(*layout_descriptor);
 #ifdef VERIFY_HEAP
@@ -9694,7 +9688,7 @@ Handle<Map> Map::AsLanguageMode(Isolate* isolate, Handle<Map> initial_map,
   if (maybe_transition != nullptr) {
     return handle(maybe_transition, isolate);
   }
-  initial_map->NotifyLeafMapLayoutChange();
+  initial_map->NotifyLeafMapLayoutChange(isolate);
 
   // Create new map taking descriptors from the |function_map| and all
   // the other details from the |initial_map|.
@@ -9833,7 +9827,8 @@ bool CanHoldValue(DescriptorArray* descriptors, int descriptor,
   UNREACHABLE();
 }
 
-Handle<Map> UpdateDescriptorForValue(Handle<Map> map, int descriptor,
+Handle<Map> UpdateDescriptorForValue(Isolate* isolate, Handle<Map> map,
+                                     int descriptor,
                                      PropertyConstness constness,
                                      Handle<Object> value) {
   if (CanHoldValue(map->instance_descriptors(), descriptor, constness,
@@ -9841,7 +9836,6 @@ Handle<Map> UpdateDescriptorForValue(Handle<Map> map, int descriptor,
     return map;
   }
 
-  Isolate* isolate = map->GetIsolate();
   PropertyAttributes attributes =
       map->instance_descriptors()->GetDetails(descriptor).attributes();
   Representation representation = value->OptimalRepresentation();
@@ -9862,8 +9856,8 @@ Handle<Map> Map::PrepareForDataProperty(Isolate* isolate, Handle<Map> map,
   // Dictionaries can store any property value.
   DCHECK(!map->is_dictionary_map());
   // Update to the newest map before storing the property.
-  return UpdateDescriptorForValue(Update(isolate, map), descriptor, constness,
-                                  value);
+  return UpdateDescriptorForValue(isolate, Update(isolate, map), descriptor,
+                                  constness, value);
 }
 
 Handle<Map> Map::TransitionToDataProperty(Isolate* isolate, Handle<Map> map,
@@ -9873,9 +9867,10 @@ Handle<Map> Map::TransitionToDataProperty(Isolate* isolate, Handle<Map> map,
                                           PropertyConstness constness,
                                           StoreFromKeyed store_mode) {
   RuntimeCallTimerScope stats_scope(
-      *map, map->is_prototype_map()
-                ? RuntimeCallCounterId::kPrototypeMap_TransitionToDataProperty
-                : RuntimeCallCounterId::kMap_TransitionToDataProperty);
+      isolate, *map,
+      map->is_prototype_map()
+          ? RuntimeCallCounterId::kPrototypeMap_TransitionToDataProperty
+          : RuntimeCallCounterId::kMap_TransitionToDataProperty);
 
   DCHECK(name->IsUniqueName());
   DCHECK(!map->is_dictionary_map());
@@ -9893,7 +9888,8 @@ Handle<Map> Map::TransitionToDataProperty(Isolate* isolate, Handle<Map> map,
                               ->GetDetails(descriptor)
                               .attributes());
 
-    return UpdateDescriptorForValue(transition, descriptor, constness, value);
+    return UpdateDescriptorForValue(isolate, transition, descriptor, constness,
+                                    value);
   }
 
   TransitionFlag flag = INSERT_TRANSITION;
@@ -10072,7 +10068,7 @@ Handle<Map> Map::TransitionToAccessorProperty(Isolate* isolate, Handle<Map> map,
                             "AccessorsOverwritingAccessors");
     }
 
-    pair = AccessorPair::Copy(Handle<AccessorPair>::cast(maybe_pair));
+    pair = AccessorPair::Copy(isolate, Handle<AccessorPair>::cast(maybe_pair));
   } else if (map->NumberOfOwnDescriptors() >= kMaxNumberOfDescriptors ||
              map->TooManyFastProperties(CERTAINLY_NOT_STORE_FROM_KEYED)) {
     return Map::Normalize(isolate, map, CLEAR_INOBJECT_PROPERTIES,
@@ -10107,7 +10103,7 @@ Handle<Map> Map::CopyAddDescriptor(Isolate* isolate, Handle<Map> map,
 
   Handle<LayoutDescriptor> new_layout_descriptor =
       FLAG_unbox_double_fields
-          ? LayoutDescriptor::New(map, new_descriptors, nof + 1)
+          ? LayoutDescriptor::New(isolate, map, new_descriptors, nof + 1)
           : handle(LayoutDescriptor::FastPointerLayout(), isolate);
 
   return CopyReplaceDescriptors(
@@ -10215,7 +10211,7 @@ Handle<Map> Map::CopyReplaceDescriptor(Isolate* isolate, Handle<Map> map,
 
   new_descriptors->Replace(insertion_index, descriptor);
   Handle<LayoutDescriptor> new_layout_descriptor = LayoutDescriptor::New(
-      map, new_descriptors, new_descriptors->number_of_descriptors());
+      isolate, map, new_descriptors, new_descriptors->number_of_descriptors());
 
   SimpleTransitionFlag simple_flag =
       (insertion_index == descriptors->number_of_descriptors() - 1)
@@ -10305,9 +10301,8 @@ void FixedArrayOfWeakCells::Set(Isolate* isolate,
                                 Handle<FixedArrayOfWeakCells> array, int index,
                                 Handle<HeapObject> value) {
   DCHECK(array->IsEmptySlot(index));  // Don't overwrite anything.
-  Handle<WeakCell> cell =
-      value->IsMap() ? Map::WeakCellForMap(isolate, Handle<Map>::cast(value))
-                     : isolate->factory()->NewWeakCell(value);
+  DCHECK(!value->IsMap());
+  Handle<WeakCell> cell = isolate->factory()->NewWeakCell(value);
   Handle<FixedArray>::cast(array)->set(index + kFirstIndex, *cell);
   array->set_last_used_index(index);
 }
@@ -10373,10 +10368,9 @@ void FixedArrayOfWeakCells::Iterator::Reset(Object* maybe_array) {
   }
 }
 
-
-void JSObject::PrototypeRegistryCompactionCallback::Callback(Object* value,
-                                                             int old_index,
-                                                             int new_index) {
+void JSObject::PrototypeRegistryCompactionCallback(HeapObject* value,
+                                                   int old_index,
+                                                   int new_index) {
   DCHECK(value->IsMap() && Map::cast(value)->is_prototype_map());
   Map* map = Map::cast(value);
   DCHECK(map->prototype_info()->IsPrototypeInfo());
@@ -10387,8 +10381,6 @@ void JSObject::PrototypeRegistryCompactionCallback::Callback(Object* value,
 
 template void FixedArrayOfWeakCells::Compact<
     FixedArrayOfWeakCells::NullCallback>(Isolate* isolate);
-template void FixedArrayOfWeakCells::Compact<
-    JSObject::PrototypeRegistryCompactionCallback>(Isolate* isolate);
 
 bool FixedArrayOfWeakCells::Remove(Handle<HeapObject> value) {
   if (Length() == 0) return false;
@@ -10433,9 +10425,10 @@ Handle<FixedArrayOfWeakCells> FixedArrayOfWeakCells::Allocate(
 }
 
 // static
-Handle<ArrayList> ArrayList::Add(Handle<ArrayList> array, Handle<Object> obj) {
+Handle<ArrayList> ArrayList::Add(Isolate* isolate, Handle<ArrayList> array,
+                                 Handle<Object> obj) {
   int length = array->Length();
-  array = EnsureSpace(array, length + 1);
+  array = EnsureSpace(isolate, array, length + 1);
   // Check that GC didn't remove elements from the array.
   DCHECK_EQ(array->Length(), length);
   array->Set(length, *obj);
@@ -10444,10 +10437,10 @@ Handle<ArrayList> ArrayList::Add(Handle<ArrayList> array, Handle<Object> obj) {
 }
 
 // static
-Handle<ArrayList> ArrayList::Add(Handle<ArrayList> array, Handle<Object> obj1,
-                                 Handle<Object> obj2) {
+Handle<ArrayList> ArrayList::Add(Isolate* isolate, Handle<ArrayList> array,
+                                 Handle<Object> obj1, Handle<Object> obj2) {
   int length = array->Length();
-  array = EnsureSpace(array, length + 2);
+  array = EnsureSpace(isolate, array, length + 2);
   // Check that GC didn't remove elements from the array.
   DCHECK_EQ(array->Length(), length);
   array->Set(length, *obj1);
@@ -10467,10 +10460,10 @@ Handle<ArrayList> ArrayList::New(Isolate* isolate, int size) {
   return result;
 }
 
-Handle<FixedArray> ArrayList::Elements(Handle<ArrayList> array) {
+Handle<FixedArray> ArrayList::Elements(Isolate* isolate,
+                                       Handle<ArrayList> array) {
   int length = array->Length();
-  Handle<FixedArray> result =
-      array->GetIsolate()->factory()->NewFixedArray(length);
+  Handle<FixedArray> result = isolate->factory()->NewFixedArray(length);
   // Do not copy the first entry, i.e., the length.
   array->CopyTo(kFirstIndex, *result, 0, length);
   return result;
@@ -10483,11 +10476,11 @@ bool ArrayList::IsFull() {
 
 namespace {
 
-Handle<FixedArray> EnsureSpaceInFixedArray(Handle<FixedArray> array,
+Handle<FixedArray> EnsureSpaceInFixedArray(Isolate* isolate,
+                                           Handle<FixedArray> array,
                                            int length) {
   int capacity = array->length();
   if (capacity < length) {
-    Isolate* isolate = array->GetIsolate();
     int new_capacity = length;
     new_capacity = new_capacity + Max(new_capacity / 2, 2);
     int grow_by = new_capacity - capacity;
@@ -10499,9 +10492,10 @@ Handle<FixedArray> EnsureSpaceInFixedArray(Handle<FixedArray> array,
 }  // namespace
 
 // static
-Handle<ArrayList> ArrayList::EnsureSpace(Handle<ArrayList> array, int length) {
+Handle<ArrayList> ArrayList::EnsureSpace(Isolate* isolate,
+                                         Handle<ArrayList> array, int length) {
   const bool empty = (array->length() == 0);
-  auto ret = EnsureSpaceInFixedArray(array, kFirstIndex + length);
+  auto ret = EnsureSpaceInFixedArray(isolate, array, kFirstIndex + length);
   if (empty) {
     ret->set_map_no_write_barrier(array->GetReadOnlyRoots().array_list_map());
 
@@ -10511,10 +10505,11 @@ Handle<ArrayList> ArrayList::EnsureSpace(Handle<ArrayList> array, int length) {
 }
 
 // static
-Handle<WeakArrayList> WeakArrayList::AddToEnd(Handle<WeakArrayList> array,
+Handle<WeakArrayList> WeakArrayList::AddToEnd(Isolate* isolate,
+                                              Handle<WeakArrayList> array,
                                               MaybeObjectHandle value) {
   int length = array->length();
-  array = EnsureSpace(array, length + 1);
+  array = EnsureSpace(isolate, array, length + 1);
   // Check that GC didn't remove elements from the array.
   DCHECK_EQ(array->length(), length);
   array->Set(length, *value);
@@ -10525,11 +10520,11 @@ Handle<WeakArrayList> WeakArrayList::AddToEnd(Handle<WeakArrayList> array,
 bool WeakArrayList::IsFull() { return length() == capacity(); }
 
 // static
-Handle<WeakArrayList> WeakArrayList::EnsureSpace(Handle<WeakArrayList> array,
+Handle<WeakArrayList> WeakArrayList::EnsureSpace(Isolate* isolate,
+                                                 Handle<WeakArrayList> array,
                                                  int length) {
   int capacity = array->capacity();
   if (capacity < length) {
-    Isolate* isolate = array->GetIsolate();
     int new_capacity = length;
     new_capacity = new_capacity + Max(new_capacity / 2, 2);
     int grow_by = new_capacity - capacity;
@@ -10538,12 +10533,97 @@ Handle<WeakArrayList> WeakArrayList::EnsureSpace(Handle<WeakArrayList> array,
   return array;
 }
 
+// static
+Handle<WeakArrayList> PrototypeUsers::Add(Isolate* isolate,
+                                          Handle<WeakArrayList> array,
+                                          Handle<Map> value,
+                                          int* assigned_index) {
+  int length = array->length();
+  if (length == 0) {
+    // Uninitialized WeakArrayList; need to initialize empty_slot_index.
+    array = WeakArrayList::EnsureSpace(isolate, array, kFirstIndex + 1);
+    set_empty_slot_index(*array, kNoEmptySlotsMarker);
+    array->Set(kFirstIndex, HeapObjectReference::Weak(*value));
+    array->set_length(kFirstIndex + 1);
+    if (assigned_index != nullptr) *assigned_index = kFirstIndex;
+    return array;
+  }
+
+  // If the array has unfilled space at the end, use it.
+  if (!array->IsFull()) {
+    array->Set(length, HeapObjectReference::Weak(*value));
+    array->set_length(length + 1);
+    if (assigned_index != nullptr) *assigned_index = length;
+    return array;
+  }
+
+  // If there are empty slots, use one of them.
+  int empty_slot = Smi::ToInt(empty_slot_index(*array));
+  if (empty_slot != kNoEmptySlotsMarker) {
+    DCHECK_GE(empty_slot, kFirstIndex);
+    CHECK_LT(empty_slot, array->length());
+    int next_empty_slot = Smi::ToInt(array->Get(empty_slot)->ToSmi());
+
+    array->Set(empty_slot, HeapObjectReference::Weak(*value));
+    if (assigned_index != nullptr) *assigned_index = empty_slot;
+
+    set_empty_slot_index(*array, next_empty_slot);
+    return array;
+  } else {
+    DCHECK_EQ(empty_slot, kNoEmptySlotsMarker);
+  }
+
+  // Array full and no empty slots. Grow the array.
+  array = WeakArrayList::EnsureSpace(isolate, array, length + 1);
+  array->Set(length, HeapObjectReference::Weak(*value));
+  array->set_length(length + 1);
+  if (assigned_index != nullptr) *assigned_index = length;
+  return array;
+}
+
+WeakArrayList* PrototypeUsers::Compact(Handle<WeakArrayList> array, Heap* heap,
+                                       CompactionCallback callback) {
+  if (array->length() == 0) {
+    return *array;
+  }
+  // Count the amount of live references.
+  int new_length = kFirstIndex;
+  for (int i = kFirstIndex; i < array->length(); i++) {
+    MaybeObject* element = array->Get(i);
+    if (element->IsSmi()) continue;
+    if (element->IsClearedWeakHeapObject()) continue;
+    ++new_length;
+  }
+  if (new_length == array->length()) {
+    return *array;
+  }
+
+  Handle<WeakArrayList> new_array = WeakArrayList::EnsureSpace(
+      heap->isolate(),
+      handle(ReadOnlyRoots(heap).empty_weak_array_list(), heap->isolate()),
+      new_length);
+  // Allocation might have caused GC and turned some of the elements into
+  // cleared weak heap objects. Count the number of live objects again.
+  int copy_to = kFirstIndex;
+  for (int i = kFirstIndex; i < array->length(); i++) {
+    MaybeObject* element = array->Get(i);
+    if (element->IsSmi()) continue;
+    if (element->IsClearedWeakHeapObject()) continue;
+    HeapObject* value = element->ToWeakHeapObject();
+    callback(value, i, copy_to);
+    new_array->Set(copy_to++, element);
+  }
+  new_array->set_length(copy_to);
+  set_empty_slot_index(*new_array, kNoEmptySlotsMarker);
+  return *new_array;
+}
+
 Handle<RegExpMatchInfo> RegExpMatchInfo::ReserveCaptures(
-    Handle<RegExpMatchInfo> match_info, int capture_count) {
+    Isolate* isolate, Handle<RegExpMatchInfo> match_info, int capture_count) {
   DCHECK_GE(match_info->length(), kLastMatchOverhead);
   const int required_length = kFirstCaptureIndex + capture_count;
   Handle<FixedArray> result =
-      EnsureSpaceInFixedArray(match_info, required_length);
+      EnsureSpaceInFixedArray(isolate, match_info, required_length);
   return Handle<RegExpMatchInfo>::cast(result);
 }
 
@@ -10555,7 +10635,8 @@ Handle<FrameArray> FrameArray::AppendJSFrame(Handle<FrameArray> in,
                                              int offset, int flags) {
   const int frame_count = in->FrameCount();
   const int new_length = LengthFor(frame_count + 1);
-  Handle<FrameArray> array = EnsureSpace(in, new_length);
+  Handle<FrameArray> array =
+      EnsureSpace(function->GetIsolate(), in, new_length);
   array->SetReceiver(frame_count, *receiver);
   array->SetFunction(frame_count, *function);
   array->SetCode(frame_count, *code);
@@ -10571,7 +10652,8 @@ Handle<FrameArray> FrameArray::AppendWasmFrame(
     int wasm_function_index, wasm::WasmCode* code, int offset, int flags) {
   const int frame_count = in->FrameCount();
   const int new_length = LengthFor(frame_count + 1);
-  Handle<FrameArray> array = EnsureSpace(in, new_length);
+  Handle<FrameArray> array =
+      EnsureSpace(wasm_instance->GetIsolate(), in, new_length);
   array->SetWasmInstance(frame_count, *wasm_instance);
   array->SetWasmFunctionIndex(frame_count, Smi::FromInt(wasm_function_index));
   // The {code} will be {nullptr} for interpreted wasm frames.
@@ -10587,9 +10669,11 @@ void FrameArray::ShrinkToFit(Isolate* isolate) {
 }
 
 // static
-Handle<FrameArray> FrameArray::EnsureSpace(Handle<FrameArray> array,
+Handle<FrameArray> FrameArray::EnsureSpace(Isolate* isolate,
+                                           Handle<FrameArray> array,
                                            int length) {
-  return Handle<FrameArray>::cast(EnsureSpaceInFixedArray(array, length));
+  return Handle<FrameArray>::cast(
+      EnsureSpaceInFixedArray(isolate, array, length));
 }
 
 Handle<DescriptorArray> DescriptorArray::Allocate(Isolate* isolate,
@@ -10695,17 +10779,17 @@ void DescriptorArray::Sort() {
   DCHECK(IsSortedNoDuplicates());
 }
 
-
-Handle<AccessorPair> AccessorPair::Copy(Handle<AccessorPair> pair) {
-  Handle<AccessorPair> copy = pair->GetIsolate()->factory()->NewAccessorPair();
+Handle<AccessorPair> AccessorPair::Copy(Isolate* isolate,
+                                        Handle<AccessorPair> pair) {
+  Handle<AccessorPair> copy = isolate->factory()->NewAccessorPair();
   copy->set_getter(pair->getter());
   copy->set_setter(pair->setter());
   return copy;
 }
 
-Handle<Object> AccessorPair::GetComponent(Handle<AccessorPair> accessor_pair,
+Handle<Object> AccessorPair::GetComponent(Isolate* isolate,
+                                          Handle<AccessorPair> accessor_pair,
                                           AccessorComponent component) {
-  Isolate* isolate = accessor_pair->GetIsolate();
   Object* accessor = accessor_pair->get(component);
   if (accessor->IsFunctionTemplateInfo()) {
     return ApiNatives::InstantiateFunction(
@@ -10788,10 +10872,9 @@ bool String::LooksValid() {
 }
 
 // static
-MaybeHandle<String> Name::ToFunctionName(Handle<Name> name) {
+MaybeHandle<String> Name::ToFunctionName(Isolate* isolate, Handle<Name> name) {
   if (name->IsString()) return Handle<String>::cast(name);
   // ES6 section 9.2.11 SetFunctionName, step 4.
-  Isolate* const isolate = name->GetIsolate();
   Handle<Object> description(Handle<Symbol>::cast(name)->name(), isolate);
   if (description->IsUndefined(isolate)) {
     return isolate->factory()->empty_string();
@@ -10804,12 +10887,11 @@ MaybeHandle<String> Name::ToFunctionName(Handle<Name> name) {
 }
 
 // static
-MaybeHandle<String> Name::ToFunctionName(Handle<Name> name,
+MaybeHandle<String> Name::ToFunctionName(Isolate* isolate, Handle<Name> name,
                                          Handle<String> prefix) {
   Handle<String> name_string;
-  Isolate* const isolate = name->GetIsolate();
-  ASSIGN_RETURN_ON_EXCEPTION(isolate, name_string, ToFunctionName(name),
-                             String);
+  ASSIGN_RETURN_ON_EXCEPTION(isolate, name_string,
+                             ToFunctionName(isolate, name), String);
   IncrementalStringBuilder builder(isolate);
   builder.AppendString(prefix);
   builder.AppendCharacter(' ');
@@ -12049,7 +12131,7 @@ Object* String::LastIndexOf(Isolate* isolate, Handle<Object> receiver,
                                      Object::ToString(isolate, search));
 
   ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, position,
-                                     Object::ToNumber(position));
+                                     Object::ToNumber(isolate, position));
 
   uint32_t start_index;
 
@@ -12283,9 +12365,7 @@ uint32_t StringHasher::GetHashField() {
   }
 }
 
-
-uint32_t StringHasher::ComputeUtf8Hash(Vector<const char> chars,
-                                       uint32_t seed,
+uint32_t StringHasher::ComputeUtf8Hash(Vector<const char> chars, uint64_t seed,
                                        int* utf16_length_out) {
   int vector_length = chars.length();
   // Handle some edge cases
@@ -12621,7 +12701,7 @@ void JSObject::LazyRegisterPrototypeUser(Handle<Map> user, Isolate* isolate) {
   Handle<Map> current_user = user;
   Handle<PrototypeInfo> current_user_info =
       Map::GetOrCreatePrototypeInfo(user, isolate);
-  for (PrototypeIterator iter(user); !iter.IsAtEnd(); iter.Advance()) {
+  for (PrototypeIterator iter(isolate, user); !iter.IsAtEnd(); iter.Advance()) {
     // Walk up the prototype chain as far as links haven't been registered yet.
     if (current_user_info->registry_slot() != PrototypeInfo::UNREGISTERED) {
       break;
@@ -12634,9 +12714,14 @@ void JSObject::LazyRegisterPrototypeUser(Handle<Map> user, Isolate* isolate) {
     Handle<PrototypeInfo> proto_info =
         Map::GetOrCreatePrototypeInfo(proto, isolate);
     Handle<Object> maybe_registry(proto_info->prototype_users(), isolate);
+    Handle<WeakArrayList> registry =
+        maybe_registry->IsSmi()
+            ? handle(ReadOnlyRoots(isolate->heap()).empty_weak_array_list(),
+                     isolate)
+            : Handle<WeakArrayList>::cast(maybe_registry);
     int slot = 0;
-    Handle<FixedArrayOfWeakCells> new_array = FixedArrayOfWeakCells::Add(
-        isolate, maybe_registry, current_user, &slot);
+    Handle<WeakArrayList> new_array =
+        PrototypeUsers::Add(isolate, registry, current_user, &slot);
     current_user_info->set_registry_slot(slot);
     if (!maybe_registry.is_identical_to(new_array)) {
       proto_info->set_prototype_users(*new_array);
@@ -12666,7 +12751,7 @@ bool JSObject::UnregisterPrototypeUser(Handle<Map> user, Isolate* isolate) {
   if (!user->prototype()->IsJSObject()) {
     Object* users =
         PrototypeInfo::cast(user->prototype_info())->prototype_users();
-    return users->IsFixedArrayOfWeakCells();
+    return users->IsWeakArrayList();
   }
   Handle<JSObject> prototype(JSObject::cast(user->prototype()), isolate);
   Handle<PrototypeInfo> user_info =
@@ -12679,10 +12764,10 @@ bool JSObject::UnregisterPrototypeUser(Handle<Map> user, Isolate* isolate) {
   DCHECK(maybe_proto_info->IsPrototypeInfo());
   Handle<PrototypeInfo> proto_info(PrototypeInfo::cast(maybe_proto_info),
                                    isolate);
-  Object* maybe_registry = proto_info->prototype_users();
-  DCHECK(maybe_registry->IsFixedArrayOfWeakCells());
-  DCHECK(FixedArrayOfWeakCells::cast(maybe_registry)->Get(slot) == *user);
-  FixedArrayOfWeakCells::cast(maybe_registry)->Clear(slot);
+  Handle<WeakArrayList> prototype_users(
+      WeakArrayList::cast(proto_info->prototype_users()), isolate);
+  DCHECK_EQ(prototype_users->Get(slot), HeapObjectReference::Weak(*user));
+  PrototypeUsers::MarkSlotEmpty(*prototype_users, slot);
   if (FLAG_trace_prototype_users) {
     PrintF("Unregistering %p as a user of prototype %p.\n",
            reinterpret_cast<void*>(*user), reinterpret_cast<void*>(*prototype));
@@ -12715,12 +12800,18 @@ void InvalidatePrototypeChainsInternal(Map* map) {
   Object* maybe_proto_info = map->prototype_info();
   if (!maybe_proto_info->IsPrototypeInfo()) return;
   PrototypeInfo* proto_info = PrototypeInfo::cast(maybe_proto_info);
-  FixedArrayOfWeakCells::Iterator iterator(proto_info->prototype_users());
+  WeakArrayList* prototype_users =
+      WeakArrayList::cast(proto_info->prototype_users());
   // For now, only maps register themselves as users.
-  Map* user;
-  while ((user = iterator.Next<Map>()) != nullptr) {
-    // Walk the prototype chain (backwards, towards leaf objects) if necessary.
-    InvalidatePrototypeChainsInternal(user);
+  for (int i = PrototypeUsers::kFirstIndex; i < prototype_users->length();
+       ++i) {
+    HeapObject* heap_object;
+    if (prototype_users->Get(i)->ToWeakHeapObject(&heap_object) &&
+        heap_object->IsMap()) {
+      // Walk the prototype chain (backwards, towards leaf objects) if
+      // necessary.
+      InvalidatePrototypeChainsInternal(Map::cast(heap_object));
+    }
   }
 }
 
@@ -12857,7 +12948,7 @@ Handle<WeakCell> Map::GetOrCreatePrototypeWeakCell(Handle<JSReceiver> prototype,
 void Map::SetPrototype(Isolate* isolate, Handle<Map> map,
                        Handle<Object> prototype,
                        bool enable_prototype_setup_mode) {
-  RuntimeCallTimerScope stats_scope(*map,
+  RuntimeCallTimerScope stats_scope(isolate, *map,
                                     RuntimeCallCounterId::kMap_SetPrototype);
 
   bool is_hidden = false;
@@ -12885,9 +12976,8 @@ void Map::SetPrototype(Isolate* isolate, Handle<Map> map,
   map->set_prototype(*prototype, wb_mode);
 }
 
-
-Handle<Object> CacheInitialJSArrayMaps(
-    Handle<Context> native_context, Handle<Map> initial_map) {
+Handle<Object> CacheInitialJSArrayMaps(Handle<Context> native_context,
+                                       Handle<Map> initial_map) {
   // Replace all of the cached initial array maps in the native context with
   // the appropriate transitioned elements kind maps.
   Handle<Map> current_map = initial_map;
@@ -13008,7 +13098,6 @@ void JSFunction::SetPrototype(Handle<JSFunction> function,
   SetInstancePrototype(isolate, function, construct_prototype);
 }
 
-
 void JSFunction::SetInitialMap(Handle<JSFunction> function, Handle<Map> map,
                                Handle<Object> prototype) {
   if (map->prototype() != *prototype)
@@ -13310,7 +13399,7 @@ bool JSFunction::SetName(Handle<JSFunction> function, Handle<Name> name,
   Isolate* isolate = function->GetIsolate();
   Handle<String> function_name;
   ASSIGN_RETURN_ON_EXCEPTION_VALUE(isolate, function_name,
-                                   Name::ToFunctionName(name), false);
+                                   Name::ToFunctionName(isolate, name), false);
   if (prefix->length() > 0) {
     IncrementalStringBuilder builder(isolate);
     builder.AppendString(prefix);
@@ -13726,8 +13815,8 @@ SharedFunctionInfo* SharedFunctionInfo::GlobalIterator::Next() {
 
 void SharedFunctionInfo::SetScript(Handle<SharedFunctionInfo> shared,
                                    Handle<Object> script_object,
+                                   int function_literal_id,
                                    bool reset_preparsed_scope_data) {
-  DCHECK_NE(shared->function_literal_id(), FunctionLiteral::kIdTypeInvalid);
   if (shared->script() == *script_object) return;
   Isolate* isolate = shared->GetIsolate();
 
@@ -13745,15 +13834,14 @@ void SharedFunctionInfo::SetScript(Handle<SharedFunctionInfo> shared,
     Handle<WeakFixedArray> list =
         handle(script->shared_function_infos(), isolate);
 #ifdef DEBUG
-    DCHECK_LT(shared->function_literal_id(), list->length());
-    MaybeObject* maybe_object = list->Get(shared->function_literal_id());
+    DCHECK_LT(function_literal_id, list->length());
+    MaybeObject* maybe_object = list->Get(function_literal_id);
     HeapObject* heap_object;
     if (maybe_object->ToWeakHeapObject(&heap_object)) {
       DCHECK_EQ(heap_object, *shared);
     }
 #endif
-    list->Set(shared->function_literal_id(),
-              HeapObjectReference::Weak(*shared));
+    list->Set(function_literal_id, HeapObjectReference::Weak(*shared));
   } else {
     Handle<Object> list = isolate->factory()->noscript_shared_function_infos();
 
@@ -13779,15 +13867,14 @@ void SharedFunctionInfo::SetScript(Handle<SharedFunctionInfo> shared,
     // Due to liveedit, it might happen that the old_script doesn't know
     // about the SharedFunctionInfo, so we have to guard against that.
     Handle<WeakFixedArray> infos(old_script->shared_function_infos(), isolate);
-    if (shared->function_literal_id() < infos->length()) {
-      MaybeObject* raw = old_script->shared_function_infos()->Get(
-          shared->function_literal_id());
+    if (function_literal_id < infos->length()) {
+      MaybeObject* raw =
+          old_script->shared_function_infos()->Get(function_literal_id);
       HeapObject* heap_object;
       if (raw->ToWeakHeapObject(&heap_object) && heap_object == *shared) {
         old_script->shared_function_infos()->Set(
-            shared->function_literal_id(),
-            HeapObjectReference::Strong(
-                ReadOnlyRoots(isolate).undefined_value()));
+            function_literal_id, HeapObjectReference::Strong(
+                                     ReadOnlyRoots(isolate).undefined_value()));
       }
     }
   } else {
@@ -13900,6 +13987,27 @@ bool SharedFunctionInfo::IsInlineable() {
 
 int SharedFunctionInfo::SourceSize() { return EndPosition() - StartPosition(); }
 
+int SharedFunctionInfo::FindIndexInScript(Isolate* isolate) const {
+  DisallowHeapAllocation no_gc;
+
+  Object* script_obj = script();
+  if (!script_obj->IsScript()) return FunctionLiteral::kIdTypeInvalid;
+
+  WeakFixedArray* shared_info_list =
+      Script::cast(script_obj)->shared_function_infos();
+  SharedFunctionInfo::ScriptIterator iterator(
+      isolate, Handle<WeakFixedArray>(&shared_info_list));
+
+  for (SharedFunctionInfo* shared = iterator.Next(); shared != nullptr;
+       shared = iterator.Next()) {
+    if (shared == this) {
+      return iterator.CurrentIndex();
+    }
+  }
+
+  return FunctionLiteral::kIdTypeInvalid;
+}
+
 void JSFunction::CalculateInstanceSizeHelper(InstanceType instance_type,
                                              bool has_prototype_slot,
                                              int requested_embedder_fields,
@@ -14042,7 +14150,6 @@ void SharedFunctionInfo::InitFromFunctionLiteral(
   // FunctionKind must have already been set.
   DCHECK(lit->kind() == shared_info->kind());
   shared_info->set_needs_home_object(lit->scope()->NeedsHomeObject());
-  shared_info->set_function_literal_id(lit->function_literal_id());
   DCHECK_IMPLIES(lit->requires_instance_fields_initializer(),
                  IsClassConstructor(lit->kind()));
   shared_info->set_requires_instance_fields_initializer(
@@ -14089,7 +14196,7 @@ void SharedFunctionInfo::InitFromFunctionLiteral(
           Handle<UncompiledData> data =
               isolate->factory()->NewUncompiledDataWithPreParsedScope(
                   lit->start_position(), lit->end_position(),
-                  pre_parsed_scope_data);
+                  lit->function_literal_id(), pre_parsed_scope_data);
           shared_info->set_uncompiled_data(*data);
           needs_position_info = false;
         }
@@ -14099,7 +14206,8 @@ void SharedFunctionInfo::InitFromFunctionLiteral(
   if (needs_position_info) {
     Handle<UncompiledData> data =
         isolate->factory()->NewUncompiledDataWithoutPreParsedScope(
-            lit->start_position(), lit->end_position());
+            lit->start_position(), lit->end_position(),
+            lit->function_literal_id());
     shared_info->set_uncompiled_data(*data);
   }
 }
@@ -14277,9 +14385,9 @@ Address Code::OffHeapInstructionEnd() const {
 
 namespace {
 template <typename Code>
-void SetStackFrameCacheCommon(Handle<Code> code,
+void SetStackFrameCacheCommon(Isolate* isolate, Handle<Code> code,
                               Handle<SimpleNumberDictionary> cache) {
-  Handle<Object> maybe_table(code->source_position_table(), code->GetIsolate());
+  Handle<Object> maybe_table(code->source_position_table(), isolate);
   if (maybe_table->IsSourcePositionTableWithFrameCache()) {
     Handle<SourcePositionTableWithFrameCache>::cast(maybe_table)
         ->set_stack_frame_cache(*cache);
@@ -14288,8 +14396,7 @@ void SetStackFrameCacheCommon(Handle<Code> code,
   DCHECK(maybe_table->IsByteArray());
   Handle<ByteArray> table(Handle<ByteArray>::cast(maybe_table));
   Handle<SourcePositionTableWithFrameCache> table_with_cache =
-      code->GetIsolate()->factory()->NewSourcePositionTableWithFrameCache(
-          table, cache);
+      isolate->factory()->NewSourcePositionTableWithFrameCache(table, cache);
   code->set_source_position_table(*table_with_cache);
 }
 }  // namespace
@@ -14299,9 +14406,11 @@ void AbstractCode::SetStackFrameCache(Handle<AbstractCode> abstract_code,
                                       Handle<SimpleNumberDictionary> cache) {
   if (abstract_code->IsCode()) {
     SetStackFrameCacheCommon(
+        abstract_code->GetIsolate(),
         handle(abstract_code->GetCode(), abstract_code->GetIsolate()), cache);
   } else {
     SetStackFrameCacheCommon(
+        abstract_code->GetIsolate(),
         handle(abstract_code->GetBytecodeArray(), abstract_code->GetIsolate()),
         cache);
   }
@@ -15046,22 +15155,24 @@ void DependentCode::InstallDependency(Isolate* isolate, Handle<WeakCell> cell,
                                       Handle<HeapObject> object,
                                       DependencyGroup group) {
   Handle<DependentCode> old_deps(DependentCode::Get(object), isolate);
-  Handle<DependentCode> new_deps = InsertWeakCode(old_deps, group, cell);
+  Handle<DependentCode> new_deps =
+      InsertWeakCode(isolate, old_deps, group, cell);
   // Update the list head if necessary.
   if (!new_deps.is_identical_to(old_deps)) DependentCode::Set(object, new_deps);
 }
 
 Handle<DependentCode> DependentCode::InsertWeakCode(
-    Handle<DependentCode> entries, DependencyGroup group,
+    Isolate* isolate, Handle<DependentCode> entries, DependencyGroup group,
     Handle<WeakCell> code_cell) {
   if (entries->length() == 0 || entries->group() > group) {
     // There is no such group.
-    return DependentCode::New(group, code_cell, entries);
+    return DependentCode::New(isolate, group, code_cell, entries);
   }
   if (entries->group() < group) {
     // The group comes later in the list.
-    Handle<DependentCode> old_next(entries->next_link(), entries->GetIsolate());
-    Handle<DependentCode> new_next = InsertWeakCode(old_next, group, code_cell);
+    Handle<DependentCode> old_next(entries->next_link(), isolate);
+    Handle<DependentCode> new_next =
+        InsertWeakCode(isolate, old_next, group, code_cell);
     if (!old_next.is_identical_to(new_next)) {
       entries->set_next_link(*new_next);
     }
@@ -15074,7 +15185,7 @@ Handle<DependentCode> DependentCode::InsertWeakCode(
     if (entries->object_at(i) == *code_cell) return entries;
   }
   if (entries->length() < kCodesStartIndex + count + 1) {
-    entries = EnsureSpace(entries);
+    entries = EnsureSpace(isolate, entries);
     // Count could have changed, reload it.
     count = entries->count();
   }
@@ -15083,11 +15194,10 @@ Handle<DependentCode> DependentCode::InsertWeakCode(
   return entries;
 }
 
-
-Handle<DependentCode> DependentCode::New(DependencyGroup group,
+Handle<DependentCode> DependentCode::New(Isolate* isolate,
+                                         DependencyGroup group,
                                          Handle<Object> object,
                                          Handle<DependentCode> next) {
-  Isolate* isolate = next->GetIsolate();
   Handle<DependentCode> result = Handle<DependentCode>::cast(
       isolate->factory()->NewFixedArray(kCodesStartIndex + 1, TENURED));
   result->set_next_link(*next);
@@ -15096,11 +15206,9 @@ Handle<DependentCode> DependentCode::New(DependencyGroup group,
   return result;
 }
 
-
 Handle<DependentCode> DependentCode::EnsureSpace(
-    Handle<DependentCode> entries) {
+    Isolate* isolate, Handle<DependentCode> entries) {
   if (entries->Compact()) return entries;
-  Isolate* isolate = entries->GetIsolate();
   int capacity = kCodesStartIndex + DependentCode::Grow(entries->count());
   int grow_by = capacity - entries->length();
   return Handle<DependentCode>::cast(
@@ -16259,7 +16367,7 @@ MaybeHandle<Object> JSPromise::Resolve(Handle<JSPromise> promise,
           Handle<JSReceiver>::cast(resolution), isolate->native_context());
   if (isolate->debug()->is_active() && resolution->IsJSPromise()) {
     // Mark the dependency of the new {promise} on the {resolution}.
-    Object::SetProperty(resolution,
+    Object::SetProperty(isolate, resolution,
                         isolate->factory()->promise_handled_by_symbol(),
                         promise, LanguageMode::kStrict)
         .Check();
@@ -16373,8 +16481,8 @@ JSRegExp::Flags RegExpFlagsFromString(Handle<String> flags, bool* success) {
 
 
 // static
-MaybeHandle<JSRegExp> JSRegExp::New(Handle<String> pattern, Flags flags) {
-  Isolate* isolate = pattern->GetIsolate();
+MaybeHandle<JSRegExp> JSRegExp::New(Isolate* isolate, Handle<String> pattern,
+                                    Flags flags) {
   Handle<JSFunction> constructor = isolate->regexp_function();
   Handle<JSRegExp> regexp =
       Handle<JSRegExp>::cast(isolate->factory()->NewJSObject(constructor));
@@ -16506,7 +16614,7 @@ MaybeHandle<JSRegExp> JSRegExp::Initialize(Handle<JSRegExp> regexp,
     // Map has changed, so use generic, but slower, method.
     RETURN_ON_EXCEPTION(
         isolate,
-        JSReceiver::SetProperty(regexp, factory->lastIndex_string(),
+        JSReceiver::SetProperty(isolate, regexp, factory->lastIndex_string(),
                                 Handle<Smi>(Smi::kZero, isolate),
                                 LanguageMode::kStrict),
         JSRegExp);
@@ -16964,7 +17072,7 @@ void JSGlobalObject::InvalidatePropertyCell(Handle<JSGlobalObject> global,
 
   DCHECK(!global->HasFastProperties());
   auto dictionary = handle(global->global_dictionary(), global->GetIsolate());
-  int entry = dictionary->FindEntry(name);
+  int entry = dictionary->FindEntry(global->GetIsolate(), name);
   if (entry == GlobalDictionary::kNotFound) return;
   PropertyCell::InvalidateEntry(global->GetIsolate(), dictionary, entry);
 }
@@ -16975,7 +17083,7 @@ Handle<PropertyCell> JSGlobalObject::EnsureEmptyPropertyCell(
   Isolate* isolate = global->GetIsolate();
   DCHECK(!global->HasFastProperties());
   Handle<GlobalDictionary> dictionary(global->global_dictionary(), isolate);
-  int entry = dictionary->FindEntry(name);
+  int entry = dictionary->FindEntry(isolate, name);
   Handle<PropertyCell> cell;
   if (entry != GlobalDictionary::kNotFound) {
     if (entry_out) *entry_out = entry;
@@ -16993,8 +17101,8 @@ Handle<PropertyCell> JSGlobalObject::EnsureEmptyPropertyCell(
   }
   cell = isolate->factory()->NewPropertyCell(name);
   PropertyDetails details(kData, NONE, cell_type);
-  dictionary =
-      GlobalDictionary::Add(dictionary, name, cell, details, entry_out);
+  dictionary = GlobalDictionary::Add(isolate, dictionary, name, cell, details,
+                                     entry_out);
   // {*entry_out} is initialized inside GlobalDictionary::Add().
   global->SetProperties(*dictionary);
   return cell;
@@ -17008,7 +17116,7 @@ Handle<PropertyCell> JSGlobalObject::EnsureEmptyPropertyCell(
 // algorithm.
 class TwoCharHashTableKey : public StringTableKey {
  public:
-  TwoCharHashTableKey(uint16_t c1, uint16_t c2, uint32_t seed)
+  TwoCharHashTableKey(uint16_t c1, uint16_t c2, uint64_t seed)
       : StringTableKey(ComputeHashField(c1, c2, seed)), c1_(c1), c2_(c2) {}
 
   bool IsMatch(Object* o) override {
@@ -17025,9 +17133,9 @@ class TwoCharHashTableKey : public StringTableKey {
   }
 
  private:
-  uint32_t ComputeHashField(uint16_t c1, uint16_t c2, uint32_t seed) {
+  uint32_t ComputeHashField(uint16_t c1, uint16_t c2, uint64_t seed) {
     // Char 1.
-    uint32_t hash = seed;
+    uint32_t hash = static_cast<uint32_t>(seed);
     hash += c1;
     hash += hash << 10;
     hash ^= hash >> 6;
@@ -17063,7 +17171,7 @@ MaybeHandle<String> StringTable::LookupTwoCharsStringIfExists(
     uint16_t c2) {
   TwoCharHashTableKey key(c1, c2, isolate->heap()->HashSeed());
   Handle<StringTable> string_table = isolate->factory()->string_table();
-  int entry = string_table->FindEntry(&key);
+  int entry = string_table->FindEntry(isolate, &key);
   if (entry == kNotFound) return MaybeHandle<String>();
 
   Handle<String> result(String::cast(string_table->KeyAt(entry)), isolate);
@@ -17089,12 +17197,10 @@ void MigrateExternalStringResource(Isolate* isolate, String* from, String* to) {
   const typename StringClass::Resource* to_resource = cast_to->resource();
   if (to_resource == nullptr) {
     // |to| is a just-created internalized copy of |from|. Migrate the resource.
-    cast_to->SetResource(cast_from->resource());
+    cast_to->set_resource(cast_from->resource());
     // Zap |from|'s resource pointer to reflect the fact that |from| has
     // relinquished ownership of its resource.
-    isolate->heap()->UpdateExternalString(
-        from, ExternalString::cast(from)->ExternalPayloadSize(), 0);
-    cast_from->SetResource(nullptr);
+    cast_from->set_resource(nullptr);
   } else if (to_resource != cast_from->resource()) {
     // |to| already existed and has its own resource. Finalize |from|.
     isolate->heap()->FinalizeExternalString(from);
@@ -17177,7 +17283,7 @@ Handle<String> StringTable::LookupString(Isolate* isolate,
 // static
 Handle<String> StringTable::LookupKey(Isolate* isolate, StringTableKey* key) {
   Handle<StringTable> table = isolate->factory()->string_table();
-  int entry = table->FindEntry(key);
+  int entry = table->FindEntry(isolate, key);
 
   // String already in table.
   if (entry != kNotFound) {
@@ -17202,7 +17308,7 @@ Handle<String> StringTable::AddKeyNoResize(Isolate* isolate,
   // InvalidStringLength error.
   CHECK(!string.is_null());
   DCHECK(string->HasHashCode());
-  DCHECK_EQ(table->FindEntry(key), kNotFound);
+  DCHECK_EQ(table->FindEntry(isolate, key), kNotFound);
 
   // Add the new string and return it along with the string table.
   int entry = table->FindInsertionEntry(key->Hash());
@@ -17228,7 +17334,7 @@ namespace {
 
 class StringTableNoAllocateKey : public StringTableKey {
  public:
-  StringTableNoAllocateKey(String* string, uint32_t seed)
+  StringTableNoAllocateKey(String* string, uint64_t seed)
       : StringTableKey(0), string_(string) {
     StringShape shape(string);
     one_byte_ = shape.HasOnlyOneByteChars();
@@ -17415,7 +17521,7 @@ Handle<StringSet> StringSet::New(Isolate* isolate) {
 
 Handle<StringSet> StringSet::Add(Isolate* isolate, Handle<StringSet> stringset,
                                  Handle<String> name) {
-  if (!stringset->Has(name)) {
+  if (!stringset->Has(isolate, name)) {
     stringset = EnsureCapacity(isolate, stringset, 1);
     uint32_t hash = ShapeT::Hash(isolate, *name);
     int entry = stringset->FindInsertionEntry(hash);
@@ -17425,8 +17531,8 @@ Handle<StringSet> StringSet::Add(Isolate* isolate, Handle<StringSet> stringset,
   return stringset;
 }
 
-bool StringSet::Has(Handle<String> name) {
-  return FindEntry(*name) != kNotFound;
+bool StringSet::Has(Isolate* isolate, Handle<String> name) {
+  return FindEntry(isolate, *name) != kNotFound;
 }
 
 Handle<ObjectHashSet> ObjectHashSet::Add(Isolate* isolate,
@@ -17447,7 +17553,7 @@ Handle<Object> CompilationCacheTable::Lookup(Handle<String> src,
                                              LanguageMode language_mode) {
   Isolate* isolate = GetIsolate();
   StringSharedKey key(src, shared, language_mode, kNoSourcePosition);
-  int entry = FindEntry(&key);
+  int entry = FindEntry(isolate, &key);
   if (entry == kNotFound) return isolate->factory()->undefined_value();
   int index = EntryToIndex(entry);
   if (!get(index)->IsFixedArray()) return isolate->factory()->undefined_value();
@@ -17573,7 +17679,7 @@ MaybeHandle<SharedFunctionInfo> CompilationCacheTable::LookupScript(
   Handle<SharedFunctionInfo> shared(native_context->empty_function()->shared(),
                                     native_context->GetIsolate());
   StringSharedKey key(src, shared, language_mode, kNoSourcePosition);
-  int entry = FindEntry(&key);
+  int entry = FindEntry(GetIsolate(), &key);
   if (entry == kNotFound) return MaybeHandle<SharedFunctionInfo>();
   int index = EntryToIndex(entry);
   if (!get(index)->IsFixedArray()) return MaybeHandle<SharedFunctionInfo>();
@@ -17589,7 +17695,7 @@ InfoCellPair CompilationCacheTable::LookupEval(
     Handle<Context> native_context, LanguageMode language_mode, int position) {
   InfoCellPair empty_result;
   StringSharedKey key(src, outer_info, language_mode, position);
-  int entry = FindEntry(&key);
+  int entry = FindEntry(GetIsolate(), &key);
   if (entry == kNotFound) return empty_result;
   int index = EntryToIndex(entry);
   if (!get(index)->IsFixedArray()) return empty_result;
@@ -17607,7 +17713,7 @@ Handle<Object> CompilationCacheTable::LookupRegExp(Handle<String> src,
   Isolate* isolate = GetIsolate();
   DisallowHeapAllocation no_allocation;
   RegExpKey key(src, flags);
-  int entry = FindEntry(&key);
+  int entry = FindEntry(isolate, &key);
   if (entry == kNotFound) return isolate->factory()->undefined_value();
   return Handle<Object>(get(EntryToIndex(entry) + 1), isolate);
 }
@@ -17653,7 +17759,7 @@ Handle<CompilationCacheTable> CompilationCacheTable::PutEval(
   StringSharedKey key(src, outer_info, value->language_mode(), position);
   {
     Handle<Object> k = key.AsHandle(isolate);
-    int entry = cache->FindEntry(&key);
+    int entry = cache->FindEntry(isolate, &key);
     if (entry != kNotFound) {
       cache->set(EntryToIndex(entry), *k);
       cache->set(EntryToIndex(entry) + 1, *value);
@@ -17757,7 +17863,7 @@ Handle<Derived> BaseNameDictionary<Derived, Shape>::EnsureCapacity(
     // If not, we generate new indices for the properties.
     int length = dictionary->NumberOfElements();
 
-    Handle<FixedArray> iteration_order = IterationIndices(dictionary);
+    Handle<FixedArray> iteration_order = IterationIndices(isolate, dictionary);
     DCHECK_EQ(length, iteration_order->length());
 
     // Iterate over the dictionary using the enumeration order and update
@@ -17771,7 +17877,7 @@ Handle<Derived> BaseNameDictionary<Derived, Shape>::EnsureCapacity(
 
       PropertyDetails details = dictionary->DetailsAt(index);
       PropertyDetails new_details = details.set_index(enum_index);
-      dictionary->DetailsAtPut(index, new_details);
+      dictionary->DetailsAtPut(isolate, index, new_details);
     }
 
     // Set the next enumeration index.
@@ -17786,48 +17892,50 @@ Handle<Derived> Dictionary<Derived, Shape>::DeleteEntry(
     Isolate* isolate, Handle<Derived> dictionary, int entry) {
   DCHECK(Shape::kEntrySize != 3 ||
          dictionary->DetailsAt(entry).IsConfigurable());
-  dictionary->ClearEntry(entry);
+  dictionary->ClearEntry(isolate, entry);
   dictionary->ElementRemoved();
   return Shrink(isolate, dictionary);
 }
 
 template <typename Derived, typename Shape>
-Handle<Derived> Dictionary<Derived, Shape>::AtPut(Handle<Derived> dictionary,
+Handle<Derived> Dictionary<Derived, Shape>::AtPut(Isolate* isolate,
+                                                  Handle<Derived> dictionary,
                                                   Key key, Handle<Object> value,
                                                   PropertyDetails details) {
-  int entry = dictionary->FindEntry(key);
+  int entry = dictionary->FindEntry(isolate, key);
 
   // If the entry is present set the value;
   if (entry == Dictionary::kNotFound) {
-    return Derived::Add(dictionary, key, value, details);
+    return Derived::Add(isolate, dictionary, key, value, details);
   }
 
   // We don't need to copy over the enumeration index.
   dictionary->ValueAtPut(entry, *value);
-  if (Shape::kEntrySize == 3) dictionary->DetailsAtPut(entry, details);
+  if (Shape::kEntrySize == 3) dictionary->DetailsAtPut(isolate, entry, details);
   return dictionary;
 }
 
 template <typename Derived, typename Shape>
 Handle<Derived>
 BaseNameDictionary<Derived, Shape>::AddNoUpdateNextEnumerationIndex(
-    Handle<Derived> dictionary, Key key, Handle<Object> value,
+    Isolate* isolate, Handle<Derived> dictionary, Key key, Handle<Object> value,
     PropertyDetails details, int* entry_out) {
   // Insert element at empty or deleted entry
-  return Dictionary<Derived, Shape>::Add(dictionary, key, value, details,
-                                         entry_out);
+  return Dictionary<Derived, Shape>::Add(isolate, dictionary, key, value,
+                                         details, entry_out);
 }
 
 // GCC workaround: Explicitly instantiate template method for NameDictionary
 // to avoid "undefined reference" issues during linking.
 template Handle<NameDictionary>
 BaseNameDictionary<NameDictionary, NameDictionaryShape>::
-    AddNoUpdateNextEnumerationIndex(Handle<NameDictionary>, Handle<Name>,
-                                    Handle<Object>, PropertyDetails, int*);
+    AddNoUpdateNextEnumerationIndex(Isolate* isolate, Handle<NameDictionary>,
+                                    Handle<Name>, Handle<Object>,
+                                    PropertyDetails, int*);
 
 template <typename Derived, typename Shape>
 Handle<Derived> BaseNameDictionary<Derived, Shape>::Add(
-    Handle<Derived> dictionary, Key key, Handle<Object> value,
+    Isolate* isolate, Handle<Derived> dictionary, Key key, Handle<Object> value,
     PropertyDetails details, int* entry_out) {
   // Insert element at empty or deleted entry
   DCHECK_EQ(0, details.dictionary_index());
@@ -17836,19 +17944,19 @@ Handle<Derived> BaseNameDictionary<Derived, Shape>::Add(
   int index = dictionary->NextEnumerationIndex();
   details = details.set_index(index);
   dictionary->SetNextEnumerationIndex(index + 1);
-  return AddNoUpdateNextEnumerationIndex(dictionary, key, value, details,
-                                         entry_out);
+  return AddNoUpdateNextEnumerationIndex(isolate, dictionary, key, value,
+                                         details, entry_out);
 }
 
 template <typename Derived, typename Shape>
-Handle<Derived> Dictionary<Derived, Shape>::Add(Handle<Derived> dictionary,
+Handle<Derived> Dictionary<Derived, Shape>::Add(Isolate* isolate,
+                                                Handle<Derived> dictionary,
                                                 Key key, Handle<Object> value,
                                                 PropertyDetails details,
                                                 int* entry_out) {
-  Isolate* isolate = dictionary->GetIsolate();
   uint32_t hash = Shape::Hash(isolate, key);
   // Valdate key is absent.
-  SLOW_DCHECK((dictionary->FindEntry(key) == Dictionary::kNotFound));
+  SLOW_DCHECK((dictionary->FindEntry(isolate, key) == Dictionary::kNotFound));
   // Check whether the dictionary should be extended.
   dictionary = Derived::EnsureCapacity(isolate, dictionary, 1);
 
@@ -17856,7 +17964,7 @@ Handle<Derived> Dictionary<Derived, Shape>::Add(Handle<Derived> dictionary,
   Handle<Object> k = Shape::AsHandle(isolate, key);
 
   uint32_t entry = dictionary->FindInsertionEntry(hash);
-  dictionary->SetEntry(entry, *k, *value, details);
+  dictionary->SetEntry(isolate, entry, *k, *value, details);
   DCHECK(dictionary->KeyAt(entry)->IsNumber() ||
          Shape::Unwrap(dictionary->KeyAt(entry))->IsUniqueName());
   dictionary->ElementAdded();
@@ -17866,9 +17974,9 @@ Handle<Derived> Dictionary<Derived, Shape>::Add(Handle<Derived> dictionary,
 
 // static
 Handle<SimpleNumberDictionary> SimpleNumberDictionary::Set(
-    Handle<SimpleNumberDictionary> dictionary, uint32_t key,
+    Isolate* isolate, Handle<SimpleNumberDictionary> dictionary, uint32_t key,
     Handle<Object> value) {
-  return AtPut(dictionary, key, value, PropertyDetails::Empty());
+  return AtPut(isolate, dictionary, key, value, PropertyDetails::Empty());
 }
 
 bool NumberDictionary::HasComplexElements() {
@@ -17910,10 +18018,11 @@ void NumberDictionary::UpdateMaxNumberKey(uint32_t key,
 }
 
 Handle<NumberDictionary> NumberDictionary::Set(
-    Handle<NumberDictionary> dictionary, uint32_t key, Handle<Object> value,
-    Handle<JSObject> dictionary_holder, PropertyDetails details) {
+    Isolate* isolate, Handle<NumberDictionary> dictionary, uint32_t key,
+    Handle<Object> value, Handle<JSObject> dictionary_holder,
+    PropertyDetails details) {
   dictionary->UpdateMaxNumberKey(key, dictionary_holder);
-  return AtPut(dictionary, key, value, details);
+  return AtPut(isolate, dictionary, key, value, details);
 }
 
 void NumberDictionary::CopyValuesTo(FixedArray* elements) {
@@ -18011,8 +18120,7 @@ void BaseNameDictionary<Derived, Shape>::CopyEnumKeysTo(
 
 template <typename Derived, typename Shape>
 Handle<FixedArray> BaseNameDictionary<Derived, Shape>::IterationIndices(
-    Handle<Derived> dictionary) {
-  Isolate* isolate = dictionary->GetIsolate();
+    Isolate* isolate, Handle<Derived> dictionary) {
   int capacity = dictionary->Capacity();
   int length = dictionary->NumberOfElements();
   Handle<FixedArray> array = isolate->factory()->NewFixedArray(length);
@@ -18608,7 +18716,8 @@ void JSArrayBuffer::Neuter() {
 
 void JSArrayBuffer::StopTrackingWasmMemory(Isolate* isolate) {
   DCHECK(is_wasm_memory());
-  isolate->wasm_engine()->memory_tracker()->ReleaseAllocation(backing_store());
+  isolate->wasm_engine()->memory_tracker()->ReleaseAllocation(isolate,
+                                                              backing_store());
   set_is_wasm_memory(false);
 }
 
@@ -18628,7 +18737,8 @@ void JSArrayBuffer::FreeBackingStore(Isolate* isolate, Allocation allocation) {
   if (allocation.is_wasm_memory) {
     wasm::WasmMemoryTracker* memory_tracker =
         isolate->wasm_engine()->memory_tracker();
-    if (!memory_tracker->FreeMemoryIfIsWasmMemory(allocation.backing_store)) {
+    if (!memory_tracker->FreeMemoryIfIsWasmMemory(isolate,
+                                                  allocation.backing_store)) {
       CHECK(FreePages(allocation.allocation_base, allocation.length));
     }
   } else {
@@ -19042,13 +19152,13 @@ HashTable<NameDictionary, NameDictionaryShape>::Shrink(Isolate* isolate,
 
 template Handle<NameDictionary>
 BaseNameDictionary<NameDictionary, NameDictionaryShape>::Add(
-    Handle<NameDictionary>, Handle<Name>, Handle<Object>, PropertyDetails,
-    int*);
+    Isolate* isolate, Handle<NameDictionary>, Handle<Name>, Handle<Object>,
+    PropertyDetails, int*);
 
 template Handle<GlobalDictionary>
 BaseNameDictionary<GlobalDictionary, GlobalDictionaryShape>::Add(
-    Handle<GlobalDictionary>, Handle<Name>, Handle<Object>, PropertyDetails,
-    int*);
+    Isolate* isolate, Handle<GlobalDictionary>, Handle<Name>, Handle<Object>,
+    PropertyDetails, int*);
 
 template void HashTable<GlobalDictionary, GlobalDictionaryShape>::Rehash(
     Isolate* isolate);
@@ -19071,14 +19181,14 @@ BaseNameDictionary<NameDictionary, NameDictionaryShape>::CopyEnumKeysTo(
 
 template Handle<FixedArray>
 BaseNameDictionary<GlobalDictionary, GlobalDictionaryShape>::IterationIndices(
-    Handle<GlobalDictionary> dictionary);
+    Isolate* isolate, Handle<GlobalDictionary> dictionary);
 template void
 BaseNameDictionary<GlobalDictionary, GlobalDictionaryShape>::CollectKeysTo(
     Handle<GlobalDictionary> dictionary, KeyAccumulator* keys);
 
 template Handle<FixedArray>
 BaseNameDictionary<NameDictionary, NameDictionaryShape>::IterationIndices(
-    Handle<NameDictionary> dictionary);
+    Isolate* isolate, Handle<NameDictionary> dictionary);
 template void
 BaseNameDictionary<NameDictionary, NameDictionaryShape>::CollectKeysTo(
     Handle<NameDictionary> dictionary, KeyAccumulator* keys);
diff --git a/deps/v8/src/objects.h b/deps/v8/src/objects.h
index 7b903a82e72c3f..cadc8b72c0cc7b 100644
--- a/deps/v8/src/objects.h
+++ b/deps/v8/src/objects.h
@@ -1081,10 +1081,10 @@ class Object {
 
   // ES6 section 7.1.3 ToNumber
   V8_WARN_UNUSED_RESULT static inline MaybeHandle<Object> ToNumber(
-      Handle<Object> input);
+      Isolate* isolate, Handle<Object> input);
 
   V8_WARN_UNUSED_RESULT static inline MaybeHandle<Object> ToNumeric(
-      Handle<Object> input);
+      Isolate* isolate, Handle<Object> input);
 
   // ES6 section 7.1.4 ToInteger
   V8_WARN_UNUSED_RESULT static inline MaybeHandle<Object> ToInteger(
@@ -1173,12 +1173,12 @@ class Object {
       LookupIterator* it, Handle<Object> value, LanguageMode language_mode,
       StoreFromKeyed store_mode);
   V8_WARN_UNUSED_RESULT static MaybeHandle<Object> SetProperty(
-      Handle<Object> object, Handle<Name> name, Handle<Object> value,
-      LanguageMode language_mode,
+      Isolate* isolate, Handle<Object> object, Handle<Name> name,
+      Handle<Object> value, LanguageMode language_mode,
       StoreFromKeyed store_mode = MAY_BE_STORE_FROM_KEYED);
   V8_WARN_UNUSED_RESULT static inline MaybeHandle<Object> SetPropertyOrElement(
-      Handle<Object> object, Handle<Name> name, Handle<Object> value,
-      LanguageMode language_mode,
+      Isolate* isolate, Handle<Object> object, Handle<Name> name,
+      Handle<Object> value, LanguageMode language_mode,
       StoreFromKeyed store_mode = MAY_BE_STORE_FROM_KEYED);
 
   V8_WARN_UNUSED_RESULT static Maybe<bool> SetSuperProperty(
@@ -1202,11 +1202,11 @@ class Object {
       LookupIterator* it, Handle<Object> value, PropertyAttributes attributes,
       ShouldThrow should_throw, StoreFromKeyed store_mode);
   V8_WARN_UNUSED_RESULT static inline MaybeHandle<Object> GetPropertyOrElement(
-      Handle<Object> object, Handle<Name> name);
+      Isolate* isolate, Handle<Object> object, Handle<Name> name);
   V8_WARN_UNUSED_RESULT static inline MaybeHandle<Object> GetPropertyOrElement(
       Handle<Object> receiver, Handle<Name> name, Handle<JSReceiver> holder);
   V8_WARN_UNUSED_RESULT static inline MaybeHandle<Object> GetProperty(
-      Handle<Object> object, Handle<Name> name);
+      Isolate* isolate, Handle<Object> object, Handle<Name> name);
 
   V8_WARN_UNUSED_RESULT static MaybeHandle<Object> GetPropertyWithAccessor(
       LookupIterator* it);
@@ -1273,10 +1273,7 @@ class Object {
   DECL_VERIFIER(Object)
 #ifdef VERIFY_HEAP
   // Verify a pointer is a valid object pointer.
-  static void VerifyPointer(Object* p);
-  // Special non-isolate overload for cases where we don't have an isolate.
-  // TODO(v8:7786): Remove this overload.
-  void ObjectVerify();
+  static void VerifyPointer(Isolate* isolate, Object* p);
 #endif
 
   inline void VerifyApiCallResultType();
@@ -1518,20 +1515,6 @@ class HeapObject: public Object {
   // places where it might not be safe to access it.
   inline ReadOnlyRoots GetReadOnlyRoots() const;
 
-  // The Heap the object was allocated in. Used also to access Isolate.
-#ifdef DEPRECATE_GET_ISOLATE
-  [[deprecated("Pass Heap explicitly or use a NeverReadOnlyHeapObject")]]
-#endif
-      inline Heap*
-      GetHeap() const;
-
-// Convenience method to get current isolate.
-#ifdef DEPRECATE_GET_ISOLATE
-  [[deprecated("Pass Isolate explicitly or use a NeverReadOnlyHeapObject")]]
-#endif
-      inline Isolate*
-      GetIsolate() const;
-
 #define IS_TYPE_FUNCTION_DECL(Type) V8_INLINE bool Is##Type() const;
   HEAP_OBJECT_TYPE_LIST(IS_TYPE_FUNCTION_DECL)
 #undef IS_TYPE_FUNCTION_DECL
@@ -1627,13 +1610,13 @@ class HeapObject: public Object {
   DECL_PRINTER(HeapObject)
   DECL_VERIFIER(HeapObject)
 #ifdef VERIFY_HEAP
-  inline void VerifyObjectField(int offset);
+  inline void VerifyObjectField(Isolate* isolate, int offset);
   inline void VerifySmiField(int offset);
-  inline void VerifyMaybeObjectField(int offset);
+  inline void VerifyMaybeObjectField(Isolate* isolate, int offset);
 
   // Verify a pointer is a valid HeapObject pointer that points to object
   // areas in the heap.
-  static void VerifyHeapPointer(Object* p);
+  static void VerifyHeapPointer(Isolate* isolate, Object* p);
 #endif
 
   static inline AllocationAlignment RequiredAlignment(Map* map);
@@ -1658,6 +1641,8 @@ class HeapObject: public Object {
 
   STATIC_ASSERT(kMapOffset == Internals::kHeapObjectMapOffset);
 
+  inline Address GetFieldAddress(int field_offset) const;
+
  private:
   DISALLOW_IMPLICIT_CONSTRUCTORS(HeapObject);
 };
@@ -2258,11 +2243,9 @@ class JSObject: public JSReceiver {
   // Utility used by many Array builtins and runtime functions
   static inline bool PrototypeHasNoElements(Isolate* isolate, JSObject* object);
 
-  // Alternative implementation of FixedArrayOfWeakCells::NullCallback.
-  class PrototypeRegistryCompactionCallback {
-   public:
-    static void Callback(Object* value, int old_index, int new_index);
-  };
+  // To be passed to PrototypeUsers::Compact.
+  static void PrototypeRegistryCompactionCallback(HeapObject* value,
+                                                  int old_index, int new_index);
 
   // Retrieve interceptors.
   inline InterceptorInfo* GetNamedInterceptor();
@@ -3912,7 +3895,7 @@ class PropertyCell : public HeapObject {
   // property.
   DECL_ACCESSORS(dependent_code, DependentCode)
 
-  inline PropertyDetails property_details();
+  inline PropertyDetails property_details() const;
   inline void set_property_details(PropertyDetails details);
 
   PropertyCellConstantType GetConstantType();
@@ -3986,141 +3969,6 @@ class WeakCell : public HeapObject {
   DISALLOW_IMPLICIT_CONSTRUCTORS(WeakCell);
 };
 
-
-// The JSProxy describes EcmaScript Harmony proxies
-class JSProxy: public JSReceiver {
- public:
-  V8_WARN_UNUSED_RESULT static MaybeHandle<JSProxy> New(Isolate* isolate,
-                                                        Handle<Object>,
-                                                        Handle<Object>);
-
-  // [handler]: The handler property.
-  DECL_ACCESSORS(handler, Object)
-  // [target]: The target property.
-  DECL_ACCESSORS(target, Object)
-
-  static MaybeHandle<Context> GetFunctionRealm(Handle<JSProxy> proxy);
-
-  DECL_CAST(JSProxy)
-
-  V8_INLINE bool IsRevoked() const;
-  static void Revoke(Handle<JSProxy> proxy);
-
-  // ES6 9.5.1
-  static MaybeHandle<Object> GetPrototype(Handle<JSProxy> receiver);
-
-  // ES6 9.5.2
-  V8_WARN_UNUSED_RESULT static Maybe<bool> SetPrototype(
-      Handle<JSProxy> proxy, Handle<Object> value, bool from_javascript,
-      ShouldThrow should_throw);
-  // ES6 9.5.3
-  V8_WARN_UNUSED_RESULT static Maybe<bool> IsExtensible(Handle<JSProxy> proxy);
-
-  // ES6, #sec-isarray.  NOT to be confused with %_IsArray.
-  V8_WARN_UNUSED_RESULT static Maybe<bool> IsArray(Handle<JSProxy> proxy);
-
-  // ES6 9.5.4 (when passed kDontThrow)
-  V8_WARN_UNUSED_RESULT static Maybe<bool> PreventExtensions(
-      Handle<JSProxy> proxy, ShouldThrow should_throw);
-
-  // ES6 9.5.5
-  V8_WARN_UNUSED_RESULT static Maybe<bool> GetOwnPropertyDescriptor(
-      Isolate* isolate, Handle<JSProxy> proxy, Handle<Name> name,
-      PropertyDescriptor* desc);
-
-  // ES6 9.5.6
-  V8_WARN_UNUSED_RESULT static Maybe<bool> DefineOwnProperty(
-      Isolate* isolate, Handle<JSProxy> object, Handle<Object> key,
-      PropertyDescriptor* desc, ShouldThrow should_throw);
-
-  // ES6 9.5.7
-  V8_WARN_UNUSED_RESULT static Maybe<bool> HasProperty(Isolate* isolate,
-                                                       Handle<JSProxy> proxy,
-                                                       Handle<Name> name);
-
-  // This function never returns false.
-  // It returns either true or throws.
-  V8_WARN_UNUSED_RESULT static Maybe<bool> CheckHasTrap(
-      Isolate* isolate, Handle<Name> name, Handle<JSReceiver> target);
-
-  // ES6 9.5.8
-  V8_WARN_UNUSED_RESULT static MaybeHandle<Object> GetProperty(
-      Isolate* isolate, Handle<JSProxy> proxy, Handle<Name> name,
-      Handle<Object> receiver, bool* was_found);
-
-  enum AccessKind { kGet, kSet };
-
-  static MaybeHandle<Object> CheckGetSetTrapResult(Isolate* isolate,
-                                                   Handle<Name> name,
-                                                   Handle<JSReceiver> target,
-                                                   Handle<Object> trap_result,
-                                                   AccessKind access_kind);
-
-  // ES6 9.5.9
-  V8_WARN_UNUSED_RESULT static Maybe<bool> SetProperty(
-      Handle<JSProxy> proxy, Handle<Name> name, Handle<Object> value,
-      Handle<Object> receiver, LanguageMode language_mode);
-
-  // ES6 9.5.10 (when passed LanguageMode::kSloppy)
-  V8_WARN_UNUSED_RESULT static Maybe<bool> DeletePropertyOrElement(
-      Handle<JSProxy> proxy, Handle<Name> name, LanguageMode language_mode);
-
-  // ES6 9.5.12
-  V8_WARN_UNUSED_RESULT static Maybe<bool> OwnPropertyKeys(
-      Isolate* isolate, Handle<JSReceiver> receiver, Handle<JSProxy> proxy,
-      PropertyFilter filter, KeyAccumulator* accumulator);
-
-  V8_WARN_UNUSED_RESULT static Maybe<PropertyAttributes> GetPropertyAttributes(
-      LookupIterator* it);
-
-  // Dispatched behavior.
-  DECL_PRINTER(JSProxy)
-  DECL_VERIFIER(JSProxy)
-
-  static const int kMaxIterationLimit = 100 * 1024;
-
-  // Layout description.
-  static const int kTargetOffset = JSReceiver::kHeaderSize;
-  static const int kHandlerOffset = kTargetOffset + kPointerSize;
-  static const int kSize = kHandlerOffset + kPointerSize;
-
-  // kTargetOffset aliases with the elements of JSObject. The fact that
-  // JSProxy::target is a Javascript value which cannot be confused with an
-  // elements backing store is exploited by loading from this offset from an
-  // unknown JSReceiver.
-  STATIC_ASSERT(JSObject::kElementsOffset == JSProxy::kTargetOffset);
-
-  typedef FixedBodyDescriptor<JSReceiver::kPropertiesOrHashOffset, kSize, kSize>
-      BodyDescriptor;
-  // No weak fields.
-  typedef BodyDescriptor BodyDescriptorWeak;
-
-  static Maybe<bool> SetPrivateSymbol(Isolate* isolate, Handle<JSProxy> proxy,
-                                      Handle<Symbol> private_name,
-                                      PropertyDescriptor* desc,
-                                      ShouldThrow should_throw);
-
- private:
-  DISALLOW_IMPLICIT_CONSTRUCTORS(JSProxy);
-};
-
-// JSProxyRevocableResult is just a JSObject with a specific initial map.
-// This initial map adds in-object properties for "proxy" and "revoke".
-// See https://tc39.github.io/ecma262/#sec-proxy.revocable
-class JSProxyRevocableResult : public JSObject {
- public:
-  // Offsets of object fields.
-  static const int kProxyOffset = JSObject::kHeaderSize;
-  static const int kRevokeOffset = kProxyOffset + kPointerSize;
-  static const int kSize = kRevokeOffset + kPointerSize;
-  // Indices of in-object properties.
-  static const int kProxyIndex = 0;
-  static const int kRevokeIndex = 1;
-
- private:
-  DISALLOW_IMPLICIT_CONSTRUCTORS(JSProxyRevocableResult);
-};
-
 // The [Async-from-Sync Iterator] object
 // (proposal-async-iteration/#sec-async-from-sync-iterator-objects)
 // An object which wraps an ordinary Iterator and converts it to behave
@@ -4223,13 +4071,14 @@ class AccessorPair: public Struct {
 
   DECL_CAST(AccessorPair)
 
-  static Handle<AccessorPair> Copy(Handle<AccessorPair> pair);
+  static Handle<AccessorPair> Copy(Isolate* isolate, Handle<AccessorPair> pair);
 
   inline Object* get(AccessorComponent component);
   inline void set(AccessorComponent component, Object* value);
 
   // Note: Returns undefined if the component is not set.
-  static Handle<Object> GetComponent(Handle<AccessorPair> accessor_pair,
+  static Handle<Object> GetComponent(Isolate* isolate,
+                                     Handle<AccessorPair> accessor_pair,
                                      AccessorComponent component);
 
   // Set both components, skipping arguments which are a JavaScript null.
@@ -4259,8 +4108,11 @@ class AccessorPair: public Struct {
   DISALLOW_IMPLICIT_CONSTRUCTORS(AccessorPair);
 };
 
-class StackFrameInfo : public Struct {
+class StackFrameInfo : public Struct, public NeverReadOnlySpaceObject {
  public:
+  using NeverReadOnlySpaceObject::GetHeap;
+  using NeverReadOnlySpaceObject::GetIsolate;
+
   DECL_INT_ACCESSORS(line_number)
   DECL_INT_ACCESSORS(column_number)
   DECL_INT_ACCESSORS(script_id)
diff --git a/deps/v8/src/objects/api-callbacks.h b/deps/v8/src/objects/api-callbacks.h
index 146b7a5adaf6ce..d4f42bee11b671 100644
--- a/deps/v8/src/objects/api-callbacks.h
+++ b/deps/v8/src/objects/api-callbacks.h
@@ -69,8 +69,8 @@ class AccessorInfo : public Struct {
 
   // Append all descriptors to the array that are not already there.
   // Return number added.
-  static int AppendUnique(Handle<Object> descriptors, Handle<FixedArray> array,
-                          int valid_descriptors);
+  static int AppendUnique(Isolate* isolate, Handle<Object> descriptors,
+                          Handle<FixedArray> array, int valid_descriptors);
 
 // Layout description.
 #define ACCESSOR_INFO_FIELDS(V)                \
diff --git a/deps/v8/src/objects/bigint.cc b/deps/v8/src/objects/bigint.cc
index 4bb83a93b67cc0..458aa7c1eb2533 100644
--- a/deps/v8/src/objects/bigint.cc
+++ b/deps/v8/src/objects/bigint.cc
@@ -33,8 +33,12 @@ namespace internal {
 // Many of the functions in this class use arguments of type {BigIntBase},
 // indicating that they will be used in a read-only capacity, and both
 // {BigInt} and {MutableBigInt} objects can be passed in.
-class MutableBigInt : public FreshlyAllocatedBigInt {
+class MutableBigInt : public FreshlyAllocatedBigInt,
+                      public NeverReadOnlySpaceObject {
  public:
+  using NeverReadOnlySpaceObject::GetHeap;
+  using NeverReadOnlySpaceObject::GetIsolate;
+
   // Bottleneck for converting MutableBigInts to BigInts.
   static MaybeHandle<BigInt> MakeImmutable(MaybeHandle<MutableBigInt> maybe);
   static Handle<BigInt> MakeImmutable(Handle<MutableBigInt> result);
@@ -152,7 +156,8 @@ class MutableBigInt : public FreshlyAllocatedBigInt {
   static MaybeHandle<String> ToStringBasePowerOfTwo(Isolate* isolate,
                                                     Handle<BigIntBase> x,
                                                     int radix);
-  static MaybeHandle<String> ToStringGeneric(Handle<BigIntBase> x, int radix);
+  static MaybeHandle<String> ToStringGeneric(Isolate* isolate,
+                                             Handle<BigIntBase> x, int radix);
 
   static double ToDouble(Handle<BigIntBase> x);
   enum Rounding { kRoundDown, kTie, kRoundUp };
@@ -926,7 +931,7 @@ MaybeHandle<String> BigInt::ToString(Isolate* isolate, Handle<BigInt> bigint,
   if (base::bits::IsPowerOfTwo(radix)) {
     return MutableBigInt::ToStringBasePowerOfTwo(isolate, bigint, radix);
   }
-  return MutableBigInt::ToStringGeneric(bigint, radix);
+  return MutableBigInt::ToStringGeneric(isolate, bigint, radix);
 }
 
 MaybeHandle<BigInt> BigInt::FromNumber(Isolate* isolate,
@@ -1981,12 +1986,12 @@ MaybeHandle<String> MutableBigInt::ToStringBasePowerOfTwo(Isolate* isolate,
   return result;
 }
 
-MaybeHandle<String> MutableBigInt::ToStringGeneric(Handle<BigIntBase> x,
+MaybeHandle<String> MutableBigInt::ToStringGeneric(Isolate* isolate,
+                                                   Handle<BigIntBase> x,
                                                    int radix) {
   DCHECK(radix >= 2 && radix <= 36);
   DCHECK(!x->is_zero());
-  Heap* heap = x->GetHeap();
-  Isolate* isolate = heap->isolate();
+  Heap* heap = isolate->heap();
 
   const int length = x->length();
   const bool sign = x->sign();
diff --git a/deps/v8/src/objects/code.h b/deps/v8/src/objects/code.h
index 3f3c3498c8f499..99a159a9779aad 100644
--- a/deps/v8/src/objects/code.h
+++ b/deps/v8/src/objects/code.h
@@ -24,8 +24,10 @@ class Register;
 }
 
 // Code describes objects with on-the-fly generated machine code.
-class Code : public HeapObject {
+class Code : public HeapObject, public NeverReadOnlySpaceObject {
  public:
+  using NeverReadOnlySpaceObject::GetHeap;
+  using NeverReadOnlySpaceObject::GetIsolate;
   // Opaque data type for encapsulating code flags like kind, inline
   // cache state, and arguments count.
   typedef uint32_t Flags;
@@ -457,8 +459,11 @@ class Code : public HeapObject {
 // pages within the heap, its header fields need to be immutable. There always
 // is a 1-to-1 relation between {Code} and {CodeDataContainer}, the referencing
 // field {Code::code_data_container} itself is immutable.
-class CodeDataContainer : public HeapObject {
+class CodeDataContainer : public HeapObject, public NeverReadOnlySpaceObject {
  public:
+  using NeverReadOnlySpaceObject::GetHeap;
+  using NeverReadOnlySpaceObject::GetIsolate;
+
   DECL_ACCESSORS(next_code_link, Object)
   DECL_INT_ACCESSORS(kind_specific_flags)
 
@@ -496,8 +501,11 @@ class CodeDataContainer : public HeapObject {
   DISALLOW_IMPLICIT_CONSTRUCTORS(CodeDataContainer);
 };
 
-class AbstractCode : public HeapObject {
+class AbstractCode : public HeapObject, public NeverReadOnlySpaceObject {
  public:
+  using NeverReadOnlySpaceObject::GetHeap;
+  using NeverReadOnlySpaceObject::GetIsolate;
+
   // All code kinds and INTERPRETED_FUNCTION.
   enum Kind {
 #define DEFINE_CODE_KIND_ENUM(name) name,
@@ -644,10 +652,13 @@ class DependentCode : public FixedArray {
   static DependentCode* Get(Handle<HeapObject> object);
   static void Set(Handle<HeapObject> object, Handle<DependentCode> dep);
 
-  static Handle<DependentCode> New(DependencyGroup group, Handle<Object> object,
+  static Handle<DependentCode> New(Isolate* isolate, DependencyGroup group,
+                                   Handle<Object> object,
                                    Handle<DependentCode> next);
-  static Handle<DependentCode> EnsureSpace(Handle<DependentCode> entries);
-  static Handle<DependentCode> InsertWeakCode(Handle<DependentCode> entries,
+  static Handle<DependentCode> EnsureSpace(Isolate* isolate,
+                                           Handle<DependentCode> entries);
+  static Handle<DependentCode> InsertWeakCode(Isolate* isolate,
+                                              Handle<DependentCode> entries,
                                               DependencyGroup group,
                                               Handle<WeakCell> code_cell);
 
diff --git a/deps/v8/src/objects/compilation-cache.h b/deps/v8/src/objects/compilation-cache.h
index bec4e8dd627e9e..76deeb9684f425 100644
--- a/deps/v8/src/objects/compilation-cache.h
+++ b/deps/v8/src/objects/compilation-cache.h
@@ -66,8 +66,12 @@ class InfoCellPair {
 // recompilation stub, or to "old" code. This avoids memory leaks due to
 // premature caching of scripts and eval strings that are never needed later.
 class CompilationCacheTable
-    : public HashTable<CompilationCacheTable, CompilationCacheShape> {
+    : public HashTable<CompilationCacheTable, CompilationCacheShape>,
+      public NeverReadOnlySpaceObject {
  public:
+  using NeverReadOnlySpaceObject::GetHeap;
+  using NeverReadOnlySpaceObject::GetIsolate;
+
   // Find cached value for a string key, otherwise return null.
   Handle<Object> Lookup(Handle<String> src, Handle<SharedFunctionInfo> shared,
                         LanguageMode language_mode);
diff --git a/deps/v8/src/objects/debug-objects.h b/deps/v8/src/objects/debug-objects.h
index 45d26d882f3e60..749489a1c1dbaf 100644
--- a/deps/v8/src/objects/debug-objects.h
+++ b/deps/v8/src/objects/debug-objects.h
@@ -19,8 +19,11 @@ class BytecodeArray;
 
 // The DebugInfo class holds additional information for a function being
 // debugged.
-class DebugInfo : public Struct {
+class DebugInfo : public Struct, public NeverReadOnlySpaceObject {
  public:
+  using NeverReadOnlySpaceObject::GetHeap;
+  using NeverReadOnlySpaceObject::GetIsolate;
+
   enum Flag {
     kNone = 0,
     kHasBreakInfo = 1 << 0,
diff --git a/deps/v8/src/objects/dictionary.h b/deps/v8/src/objects/dictionary.h
index e6504a1876e041..eac358c1cda733 100644
--- a/deps/v8/src/objects/dictionary.h
+++ b/deps/v8/src/objects/dictionary.h
@@ -43,8 +43,8 @@ class Dictionary : public HashTable<Derived, Shape> {
   }
 
   // Set the details for entry.
-  void DetailsAtPut(int entry, PropertyDetails value) {
-    Shape::DetailsAtPut(static_cast<Derived*>(this), entry, value);
+  void DetailsAtPut(Isolate* isolate, int entry, PropertyDetails value) {
+    Shape::DetailsAtPut(isolate, static_cast<Derived*>(this), entry, value);
   }
 
   // Delete a property from the dictionary.
@@ -69,19 +69,18 @@ class Dictionary : public HashTable<Derived, Shape> {
   Object* SlowReverseLookup(Object* value);
 
   // Sets the entry to (key, value) pair.
-  inline void ClearEntry(int entry);
-  inline void SetEntry(int entry, Object* key, Object* value,
+  inline void ClearEntry(Isolate* isolate, int entry);
+  inline void SetEntry(Isolate* isolate, int entry, Object* key, Object* value,
                        PropertyDetails details);
 
-  V8_WARN_UNUSED_RESULT static Handle<Derived> Add(Handle<Derived> dictionary,
-                                                   Key key,
-                                                   Handle<Object> value,
-                                                   PropertyDetails details,
-                                                   int* entry_out = nullptr);
+  V8_WARN_UNUSED_RESULT static Handle<Derived> Add(
+      Isolate* isolate, Handle<Derived> dictionary, Key key,
+      Handle<Object> value, PropertyDetails details, int* entry_out = nullptr);
 
  protected:
   // Generic at put operation.
-  V8_WARN_UNUSED_RESULT static Handle<Derived> AtPut(Handle<Derived> dictionary,
+  V8_WARN_UNUSED_RESULT static Handle<Derived> AtPut(Isolate* isolate,
+                                                     Handle<Derived> dictionary,
                                                      Key key,
                                                      Handle<Object> value,
                                                      PropertyDetails details);
@@ -100,7 +99,7 @@ class BaseDictionaryShape : public BaseShape<Key> {
   }
 
   template <typename Dictionary>
-  static inline void DetailsAtPut(Dictionary* dict, int entry,
+  static inline void DetailsAtPut(Isolate* isolate, Dictionary* dict, int entry,
                                   PropertyDetails value) {
     STATIC_ASSERT(Dictionary::kEntrySize == 3);
     dict->set(Dictionary::EntryToIndex(entry) + Dictionary::kEntryDetailsIndex,
@@ -164,7 +163,8 @@ class BaseNameDictionary : public Dictionary<Derived, Shape> {
   static void CollectKeysTo(Handle<Derived> dictionary, KeyAccumulator* keys);
 
   // Return the key indices sorted by its enumeration index.
-  static Handle<FixedArray> IterationIndices(Handle<Derived> dictionary);
+  static Handle<FixedArray> IterationIndices(Isolate* isolate,
+                                             Handle<Derived> dictionary);
 
   // Copies enumerable keys to preallocated fixed array.
   // Does not throw for uninitialized exports in module namespace objects, so
@@ -178,14 +178,12 @@ class BaseNameDictionary : public Dictionary<Derived, Shape> {
                                         Handle<Derived> dictionary, int n);
 
   V8_WARN_UNUSED_RESULT static Handle<Derived> AddNoUpdateNextEnumerationIndex(
-      Handle<Derived> dictionary, Key key, Handle<Object> value,
-      PropertyDetails details, int* entry_out = nullptr);
-
-  V8_WARN_UNUSED_RESULT static Handle<Derived> Add(Handle<Derived> dictionary,
-                                                   Key key,
-                                                   Handle<Object> value,
-                                                   PropertyDetails details,
-                                                   int* entry_out = nullptr);
+      Isolate* isolate, Handle<Derived> dictionary, Key key,
+      Handle<Object> value, PropertyDetails details, int* entry_out = nullptr);
+
+  V8_WARN_UNUSED_RESULT static Handle<Derived> Add(
+      Isolate* isolate, Handle<Derived> dictionary, Key key,
+      Handle<Object> value, PropertyDetails details, int* entry_out = nullptr);
 };
 
 class NameDictionary
@@ -212,7 +210,7 @@ class GlobalDictionaryShape : public NameDictionaryShape {
   static inline PropertyDetails DetailsAt(Dictionary* dict, int entry);
 
   template <typename Dictionary>
-  static inline void DetailsAtPut(Dictionary* dict, int entry,
+  static inline void DetailsAtPut(Isolate* isolate, Dictionary* dict, int entry,
                                   PropertyDetails value);
 
   static inline Object* Unwrap(Object* key);
@@ -228,7 +226,7 @@ class GlobalDictionary
 
   inline Object* ValueAt(int entry);
   inline PropertyCell* CellAt(int entry);
-  inline void SetEntry(int entry, Object* key, Object* value,
+  inline void SetEntry(Isolate* isolate, int entry, Object* key, Object* value,
                        PropertyDetails details);
   inline Name* NameAt(int entry);
   inline void ValueAtPut(int entry, Object* value);
@@ -263,7 +261,7 @@ class SimpleNumberDictionaryShape : public NumberDictionaryBaseShape {
   }
 
   template <typename Dictionary>
-  static inline void DetailsAtPut(Dictionary* dict, int entry,
+  static inline void DetailsAtPut(Isolate* isolate, Dictionary* dict, int entry,
                                   PropertyDetails value) {
     UNREACHABLE();
   }
@@ -284,7 +282,7 @@ class SimpleNumberDictionary
   DECL_CAST(SimpleNumberDictionary)
   // Type specific at put (default NONE attributes is used when adding).
   V8_WARN_UNUSED_RESULT static Handle<SimpleNumberDictionary> Set(
-      Handle<SimpleNumberDictionary> dictionary, uint32_t key,
+      Isolate* isolate, Handle<SimpleNumberDictionary> dictionary, uint32_t key,
       Handle<Object> value);
 
   static const int kEntryValueIndex = 1;
@@ -306,7 +304,8 @@ class NumberDictionary
 
   // Type specific at put (default NONE attributes is used when adding).
   V8_WARN_UNUSED_RESULT static Handle<NumberDictionary> Set(
-      Handle<NumberDictionary> dictionary, uint32_t key, Handle<Object> value,
+      Isolate* isolate, Handle<NumberDictionary> dictionary, uint32_t key,
+      Handle<Object> value,
       Handle<JSObject> dictionary_holder = Handle<JSObject>::null(),
       PropertyDetails details = PropertyDetails::Empty());
 
diff --git a/deps/v8/src/objects/fixed-array-inl.h b/deps/v8/src/objects/fixed-array-inl.h
index 45107ce7fe00d6..3e6473e4fa68a2 100644
--- a/deps/v8/src/objects/fixed-array-inl.h
+++ b/deps/v8/src/objects/fixed-array-inl.h
@@ -688,9 +688,10 @@ inline uint64_t FixedTypedArray<BigUint64ArrayTraits>::FromHandle(
 }
 
 template <class Traits>
-Handle<Object> FixedTypedArray<Traits>::get(FixedTypedArray<Traits>* array,
+Handle<Object> FixedTypedArray<Traits>::get(Isolate* isolate,
+                                            FixedTypedArray<Traits>* array,
                                             int index) {
-  return Traits::ToHandle(array->GetIsolate(), array->get_scalar(index));
+  return Traits::ToHandle(isolate, array->get_scalar(index));
 }
 
 template <class Traits>
diff --git a/deps/v8/src/objects/fixed-array.h b/deps/v8/src/objects/fixed-array.h
index b29d3d57771245..04e044351135d7 100644
--- a/deps/v8/src/objects/fixed-array.h
+++ b/deps/v8/src/objects/fixed-array.h
@@ -324,7 +324,8 @@ class WeakArrayList : public HeapObject {
   DECL_VERIFIER(WeakArrayList)
   DECL_PRINTER(WeakArrayList)
 
-  static Handle<WeakArrayList> AddToEnd(Handle<WeakArrayList> array,
+  static Handle<WeakArrayList> AddToEnd(Isolate* isolate,
+                                        Handle<WeakArrayList> array,
                                         MaybeObjectHandle value);
 
   inline MaybeObject* Get(int index) const;
@@ -361,14 +362,16 @@ class WeakArrayList : public HeapObject {
   static const int kMaxCapacity =
       (FixedArray::kMaxSize - kHeaderSize) / kPointerSize;
 
+ protected:
+  static Handle<WeakArrayList> EnsureSpace(Isolate* isolate,
+                                           Handle<WeakArrayList> array,
+                                           int length);
+
  private:
   static int OffsetOfElementAt(int index) {
     return kHeaderSize + index * kPointerSize;
   }
 
-  static Handle<WeakArrayList> EnsureSpace(Handle<WeakArrayList> array,
-                                           int length);
-
   DISALLOW_IMPLICIT_CONSTRUCTORS(WeakArrayList);
 };
 
@@ -454,9 +457,10 @@ class FixedArrayOfWeakCells : public FixedArray {
 // underlying FixedArray starting at kFirstIndex.
 class ArrayList : public FixedArray {
  public:
-  static Handle<ArrayList> Add(Handle<ArrayList> array, Handle<Object> obj);
-  static Handle<ArrayList> Add(Handle<ArrayList> array, Handle<Object> obj1,
-                               Handle<Object> obj2);
+  static Handle<ArrayList> Add(Isolate* isolate, Handle<ArrayList> array,
+                               Handle<Object> obj);
+  static Handle<ArrayList> Add(Isolate* isolate, Handle<ArrayList> array,
+                               Handle<Object> obj1, Handle<Object> obj2);
   static Handle<ArrayList> New(Isolate* isolate, int size);
 
   // Returns the number of elements in the list, not the allocated size, which
@@ -479,12 +483,13 @@ class ArrayList : public FixedArray {
 
   // Return a copy of the list of size Length() without the first entry. The
   // number returned by Length() is stored in the first entry.
-  static Handle<FixedArray> Elements(Handle<ArrayList> array);
+  static Handle<FixedArray> Elements(Isolate* isolate, Handle<ArrayList> array);
   bool IsFull();
   DECL_CAST(ArrayList)
 
  private:
-  static Handle<ArrayList> EnsureSpace(Handle<ArrayList> array, int length);
+  static Handle<ArrayList> EnsureSpace(Isolate* isolate,
+                                       Handle<ArrayList> array, int length);
   static const int kLengthIndex = 0;
   static const int kFirstIndex = 1;
   DISALLOW_IMPLICIT_CONSTRUCTORS(ArrayList);
@@ -671,7 +676,8 @@ class FixedTypedArray : public FixedTypedArrayBase {
 
   static inline ElementType get_scalar_from_data_ptr(void* data_ptr, int index);
   inline ElementType get_scalar(int index);
-  static inline Handle<Object> get(FixedTypedArray* array, int index);
+  static inline Handle<Object> get(Isolate* isolate, FixedTypedArray* array,
+                                   int index);
   inline void set(int index, ElementType value);
 
   static inline ElementType from(int value);
diff --git a/deps/v8/src/objects/frame-array.h b/deps/v8/src/objects/frame-array.h
index 1f5b1a9d661400..08ed8fe6afc937 100644
--- a/deps/v8/src/objects/frame-array.h
+++ b/deps/v8/src/objects/frame-array.h
@@ -95,7 +95,8 @@ class FrameArray : public FixedArray {
     return kFirstIndex + frame_count * kElementsPerFrame;
   }
 
-  static Handle<FrameArray> EnsureSpace(Handle<FrameArray> array, int length);
+  static Handle<FrameArray> EnsureSpace(Isolate* isolate,
+                                        Handle<FrameArray> array, int length);
 
   friend class Factory;
   DISALLOW_IMPLICIT_CONSTRUCTORS(FrameArray);
diff --git a/deps/v8/src/objects/hash-table-inl.h b/deps/v8/src/objects/hash-table-inl.h
index 7ebaa5cc1c33eb..11aa0392c0d806 100644
--- a/deps/v8/src/objects/hash-table-inl.h
+++ b/deps/v8/src/objects/hash-table-inl.h
@@ -62,11 +62,6 @@ int EphemeronHashTableShape::GetMapRootIndex() {
   return Heap::kEphemeronHashTableMapRootIndex;
 }
 
-template <typename Derived, typename Shape>
-int HashTable<Derived, Shape>::FindEntry(Key key) {
-  return FindEntry(GetIsolate(), key);
-}
-
 template <typename Derived, typename Shape>
 int HashTable<Derived, Shape>::FindEntry(Isolate* isolate, Key key) {
   return FindEntry(ReadOnlyRoots(isolate), key, Shape::Hash(isolate, key));
diff --git a/deps/v8/src/objects/hash-table.h b/deps/v8/src/objects/hash-table.h
index 4b1df4e1ab0dd9..f83f3274b46521 100644
--- a/deps/v8/src/objects/hash-table.h
+++ b/deps/v8/src/objects/hash-table.h
@@ -144,7 +144,6 @@ class HashTable : public HashTableBase {
   void IterateElements(ObjectVisitor* visitor);
 
   // Find entry for key otherwise return kNotFound.
-  inline int FindEntry(Key key);
   inline int FindEntry(ReadOnlyRoots roots, Key key, int32_t hash);
   int FindEntry(Isolate* isolate, Key key);
 
diff --git a/deps/v8/src/objects/intl-objects.cc b/deps/v8/src/objects/intl-objects.cc
index 7fb1e27a6896b6..67f691a3366a8c 100644
--- a/deps/v8/src/objects/intl-objects.cc
+++ b/deps/v8/src/objects/intl-objects.cc
@@ -18,6 +18,7 @@
 #include "src/isolate.h"
 #include "src/objects-inl.h"
 #include "src/objects/managed.h"
+#include "src/objects/string.h"
 #include "src/property-descriptor.h"
 #include "unicode/brkiter.h"
 #include "unicode/bytestream.h"
@@ -167,7 +168,7 @@ void SetResolvedDateSettings(Isolate* isolate, const icu::Locale& icu_locale,
   icu::UnicodeString pattern;
   date_format->toPattern(pattern);
   JSObject::SetProperty(
-      resolved, factory->intl_pattern_symbol(),
+      isolate, resolved, factory->intl_pattern_symbol(),
       factory
           ->NewStringFromTwoByte(Vector<const uint16_t>(
               reinterpret_cast<const uint16_t*>(pattern.getBuffer()),
@@ -182,9 +183,9 @@ void SetResolvedDateSettings(Isolate* isolate, const icu::Locale& icu_locale,
   // key values. intl.js maps them to BCP47 values for key "ca".
   // TODO(jshin): Consider doing it here, instead.
   const char* calendar_name = calendar->getType();
-  JSObject::SetProperty(resolved, factory->NewStringFromStaticChars("calendar"),
-                        factory->NewStringFromAsciiChecked(calendar_name),
-                        LanguageMode::kSloppy)
+  JSObject::SetProperty(
+      isolate, resolved, factory->NewStringFromStaticChars("calendar"),
+      factory->NewStringFromAsciiChecked(calendar_name), LanguageMode::kSloppy)
       .Assert();
 
   const icu::TimeZone& tz = calendar->getTimeZone();
@@ -204,11 +205,11 @@ void SetResolvedDateSettings(Isolate* isolate, const icu::Locale& icu_locale,
     if (canonical_time_zone == UNICODE_STRING_SIMPLE("Etc/UTC") ||
         canonical_time_zone == UNICODE_STRING_SIMPLE("Etc/GMT")) {
       JSObject::SetProperty(
-          resolved, factory->NewStringFromStaticChars("timeZone"),
+          isolate, resolved, factory->NewStringFromStaticChars("timeZone"),
           factory->NewStringFromStaticChars("UTC"), LanguageMode::kSloppy)
           .Assert();
     } else {
-      JSObject::SetProperty(resolved,
+      JSObject::SetProperty(isolate, resolved,
                             factory->NewStringFromStaticChars("timeZone"),
                             factory
                                 ->NewStringFromTwoByte(Vector<const uint16_t>(
@@ -230,11 +231,11 @@ void SetResolvedDateSettings(Isolate* isolate, const icu::Locale& icu_locale,
   if (U_SUCCESS(status)) {
     const char* ns = numbering_system->getName();
     JSObject::SetProperty(
-        resolved, factory->NewStringFromStaticChars("numberingSystem"),
+        isolate, resolved, factory->NewStringFromStaticChars("numberingSystem"),
         factory->NewStringFromAsciiChecked(ns), LanguageMode::kSloppy)
         .Assert();
   } else {
-    JSObject::SetProperty(resolved,
+    JSObject::SetProperty(isolate, resolved,
                           factory->NewStringFromStaticChars("numberingSystem"),
                           factory->undefined_value(), LanguageMode::kSloppy)
         .Assert();
@@ -247,15 +248,15 @@ void SetResolvedDateSettings(Isolate* isolate, const icu::Locale& icu_locale,
   uloc_toLanguageTag(icu_locale.getName(), result, ULOC_FULLNAME_CAPACITY,
                      FALSE, &status);
   if (U_SUCCESS(status)) {
-    JSObject::SetProperty(resolved, factory->NewStringFromStaticChars("locale"),
-                          factory->NewStringFromAsciiChecked(result),
-                          LanguageMode::kSloppy)
+    JSObject::SetProperty(
+        isolate, resolved, factory->NewStringFromStaticChars("locale"),
+        factory->NewStringFromAsciiChecked(result), LanguageMode::kSloppy)
         .Assert();
   } else {
     // This would never happen, since we got the locale from ICU.
-    JSObject::SetProperty(resolved, factory->NewStringFromStaticChars("locale"),
-                          factory->NewStringFromStaticChars("und"),
-                          LanguageMode::kSloppy)
+    JSObject::SetProperty(
+        isolate, resolved, factory->NewStringFromStaticChars("locale"),
+        factory->NewStringFromStaticChars("und"), LanguageMode::kSloppy)
         .Assert();
   }
 }
@@ -380,19 +381,22 @@ void SetResolvedNumericSettings(Isolate* isolate, const icu::Locale& icu_locale,
   Factory* factory = isolate->factory();
 
   JSObject::SetProperty(
-      resolved, factory->NewStringFromStaticChars("minimumIntegerDigits"),
+      isolate, resolved,
+      factory->NewStringFromStaticChars("minimumIntegerDigits"),
       factory->NewNumberFromInt(number_format->getMinimumIntegerDigits()),
       LanguageMode::kSloppy)
       .Assert();
 
   JSObject::SetProperty(
-      resolved, factory->NewStringFromStaticChars("minimumFractionDigits"),
+      isolate, resolved,
+      factory->NewStringFromStaticChars("minimumFractionDigits"),
       factory->NewNumberFromInt(number_format->getMinimumFractionDigits()),
       LanguageMode::kSloppy)
       .Assert();
 
   JSObject::SetProperty(
-      resolved, factory->NewStringFromStaticChars("maximumFractionDigits"),
+      isolate, resolved,
+      factory->NewStringFromStaticChars("maximumFractionDigits"),
       factory->NewNumberFromInt(number_format->getMaximumFractionDigits()),
       LanguageMode::kSloppy)
       .Assert();
@@ -403,7 +407,8 @@ void SetResolvedNumericSettings(Isolate* isolate, const icu::Locale& icu_locale,
   CHECK(maybe.IsJust());
   if (maybe.FromJust()) {
     JSObject::SetProperty(
-        resolved, factory->NewStringFromStaticChars("minimumSignificantDigits"),
+        isolate, resolved,
+        factory->NewStringFromStaticChars("minimumSignificantDigits"),
         factory->NewNumberFromInt(number_format->getMinimumSignificantDigits()),
         LanguageMode::kSloppy)
         .Assert();
@@ -414,7 +419,8 @@ void SetResolvedNumericSettings(Isolate* isolate, const icu::Locale& icu_locale,
   CHECK(maybe.IsJust());
   if (maybe.FromJust()) {
     JSObject::SetProperty(
-        resolved, factory->NewStringFromStaticChars("maximumSignificantDigits"),
+        isolate, resolved,
+        factory->NewStringFromStaticChars("maximumSignificantDigits"),
         factory->NewNumberFromInt(number_format->getMaximumSignificantDigits()),
         LanguageMode::kSloppy)
         .Assert();
@@ -426,15 +432,15 @@ void SetResolvedNumericSettings(Isolate* isolate, const icu::Locale& icu_locale,
   uloc_toLanguageTag(icu_locale.getName(), result, ULOC_FULLNAME_CAPACITY,
                      FALSE, &status);
   if (U_SUCCESS(status)) {
-    JSObject::SetProperty(resolved, factory->NewStringFromStaticChars("locale"),
-                          factory->NewStringFromAsciiChecked(result),
-                          LanguageMode::kSloppy)
+    JSObject::SetProperty(
+        isolate, resolved, factory->NewStringFromStaticChars("locale"),
+        factory->NewStringFromAsciiChecked(result), LanguageMode::kSloppy)
         .Assert();
   } else {
     // This would never happen, since we got the locale from ICU.
-    JSObject::SetProperty(resolved, factory->NewStringFromStaticChars("locale"),
-                          factory->NewStringFromStaticChars("und"),
-                          LanguageMode::kSloppy)
+    JSObject::SetProperty(
+        isolate, resolved, factory->NewStringFromStaticChars("locale"),
+        factory->NewStringFromStaticChars("und"), LanguageMode::kSloppy)
         .Assert();
   }
 }
@@ -448,7 +454,7 @@ void SetResolvedNumberSettings(Isolate* isolate, const icu::Locale& icu_locale,
   icu::UnicodeString currency(number_format->getCurrency());
   if (!currency.isEmpty()) {
     JSObject::SetProperty(
-        resolved, factory->NewStringFromStaticChars("currency"),
+        isolate, resolved, factory->NewStringFromStaticChars("currency"),
         factory
             ->NewStringFromTwoByte(Vector<const uint16_t>(
                 reinterpret_cast<const uint16_t*>(currency.getBuffer()),
@@ -467,18 +473,18 @@ void SetResolvedNumberSettings(Isolate* isolate, const icu::Locale& icu_locale,
   if (U_SUCCESS(status)) {
     const char* ns = numbering_system->getName();
     JSObject::SetProperty(
-        resolved, factory->NewStringFromStaticChars("numberingSystem"),
+        isolate, resolved, factory->NewStringFromStaticChars("numberingSystem"),
         factory->NewStringFromAsciiChecked(ns), LanguageMode::kSloppy)
         .Assert();
   } else {
-    JSObject::SetProperty(resolved,
+    JSObject::SetProperty(isolate, resolved,
                           factory->NewStringFromStaticChars("numberingSystem"),
                           factory->undefined_value(), LanguageMode::kSloppy)
         .Assert();
   }
   delete numbering_system;
 
-  JSObject::SetProperty(resolved,
+  JSObject::SetProperty(isolate, resolved,
                         factory->NewStringFromStaticChars("useGrouping"),
                         factory->ToBoolean(number_format->isGroupingUsed()),
                         LanguageMode::kSloppy)
@@ -557,7 +563,7 @@ void SetResolvedCollatorSettings(Isolate* isolate,
   UErrorCode status = U_ZERO_ERROR;
 
   JSObject::SetProperty(
-      resolved, factory->NewStringFromStaticChars("numeric"),
+      isolate, resolved, factory->NewStringFromStaticChars("numeric"),
       factory->ToBoolean(
           collator->getAttribute(UCOL_NUMERIC_COLLATION, status) == UCOL_ON),
       LanguageMode::kSloppy)
@@ -566,19 +572,19 @@ void SetResolvedCollatorSettings(Isolate* isolate,
   switch (collator->getAttribute(UCOL_CASE_FIRST, status)) {
     case UCOL_LOWER_FIRST:
       JSObject::SetProperty(
-          resolved, factory->NewStringFromStaticChars("caseFirst"),
+          isolate, resolved, factory->NewStringFromStaticChars("caseFirst"),
           factory->NewStringFromStaticChars("lower"), LanguageMode::kSloppy)
           .Assert();
       break;
     case UCOL_UPPER_FIRST:
       JSObject::SetProperty(
-          resolved, factory->NewStringFromStaticChars("caseFirst"),
+          isolate, resolved, factory->NewStringFromStaticChars("caseFirst"),
           factory->NewStringFromStaticChars("upper"), LanguageMode::kSloppy)
           .Assert();
       break;
     default:
       JSObject::SetProperty(
-          resolved, factory->NewStringFromStaticChars("caseFirst"),
+          isolate, resolved, factory->NewStringFromStaticChars("caseFirst"),
           factory->NewStringFromStaticChars("false"), LanguageMode::kSloppy)
           .Assert();
   }
@@ -586,19 +592,19 @@ void SetResolvedCollatorSettings(Isolate* isolate,
   switch (collator->getAttribute(UCOL_STRENGTH, status)) {
     case UCOL_PRIMARY: {
       JSObject::SetProperty(
-          resolved, factory->NewStringFromStaticChars("strength"),
+          isolate, resolved, factory->NewStringFromStaticChars("strength"),
           factory->NewStringFromStaticChars("primary"), LanguageMode::kSloppy)
           .Assert();
 
       // case level: true + s1 -> case, s1 -> base.
       if (UCOL_ON == collator->getAttribute(UCOL_CASE_LEVEL, status)) {
         JSObject::SetProperty(
-            resolved, factory->NewStringFromStaticChars("sensitivity"),
+            isolate, resolved, factory->NewStringFromStaticChars("sensitivity"),
             factory->NewStringFromStaticChars("case"), LanguageMode::kSloppy)
             .Assert();
       } else {
         JSObject::SetProperty(
-            resolved, factory->NewStringFromStaticChars("sensitivity"),
+            isolate, resolved, factory->NewStringFromStaticChars("sensitivity"),
             factory->NewStringFromStaticChars("base"), LanguageMode::kSloppy)
             .Assert();
       }
@@ -606,50 +612,50 @@ void SetResolvedCollatorSettings(Isolate* isolate,
     }
     case UCOL_SECONDARY:
       JSObject::SetProperty(
-          resolved, factory->NewStringFromStaticChars("strength"),
+          isolate, resolved, factory->NewStringFromStaticChars("strength"),
           factory->NewStringFromStaticChars("secondary"), LanguageMode::kSloppy)
           .Assert();
       JSObject::SetProperty(
-          resolved, factory->NewStringFromStaticChars("sensitivity"),
+          isolate, resolved, factory->NewStringFromStaticChars("sensitivity"),
           factory->NewStringFromStaticChars("accent"), LanguageMode::kSloppy)
           .Assert();
       break;
     case UCOL_TERTIARY:
       JSObject::SetProperty(
-          resolved, factory->NewStringFromStaticChars("strength"),
+          isolate, resolved, factory->NewStringFromStaticChars("strength"),
           factory->NewStringFromStaticChars("tertiary"), LanguageMode::kSloppy)
           .Assert();
       JSObject::SetProperty(
-          resolved, factory->NewStringFromStaticChars("sensitivity"),
+          isolate, resolved, factory->NewStringFromStaticChars("sensitivity"),
           factory->NewStringFromStaticChars("variant"), LanguageMode::kSloppy)
           .Assert();
       break;
     case UCOL_QUATERNARY:
       // We shouldn't get quaternary and identical from ICU, but if we do
       // put them into variant.
-      JSObject::SetProperty(resolved,
+      JSObject::SetProperty(isolate, resolved,
                             factory->NewStringFromStaticChars("strength"),
                             factory->NewStringFromStaticChars("quaternary"),
                             LanguageMode::kSloppy)
           .Assert();
       JSObject::SetProperty(
-          resolved, factory->NewStringFromStaticChars("sensitivity"),
+          isolate, resolved, factory->NewStringFromStaticChars("sensitivity"),
           factory->NewStringFromStaticChars("variant"), LanguageMode::kSloppy)
           .Assert();
       break;
     default:
       JSObject::SetProperty(
-          resolved, factory->NewStringFromStaticChars("strength"),
+          isolate, resolved, factory->NewStringFromStaticChars("strength"),
           factory->NewStringFromStaticChars("identical"), LanguageMode::kSloppy)
           .Assert();
       JSObject::SetProperty(
-          resolved, factory->NewStringFromStaticChars("sensitivity"),
+          isolate, resolved, factory->NewStringFromStaticChars("sensitivity"),
           factory->NewStringFromStaticChars("variant"), LanguageMode::kSloppy)
           .Assert();
   }
 
   JSObject::SetProperty(
-      resolved, factory->NewStringFromStaticChars("ignorePunctuation"),
+      isolate, resolved, factory->NewStringFromStaticChars("ignorePunctuation"),
       factory->ToBoolean(collator->getAttribute(UCOL_ALTERNATE_HANDLING,
                                                 status) == UCOL_SHIFTED),
       LanguageMode::kSloppy)
@@ -661,15 +667,15 @@ void SetResolvedCollatorSettings(Isolate* isolate,
   uloc_toLanguageTag(icu_locale.getName(), result, ULOC_FULLNAME_CAPACITY,
                      FALSE, &status);
   if (U_SUCCESS(status)) {
-    JSObject::SetProperty(resolved, factory->NewStringFromStaticChars("locale"),
-                          factory->NewStringFromAsciiChecked(result),
-                          LanguageMode::kSloppy)
+    JSObject::SetProperty(
+        isolate, resolved, factory->NewStringFromStaticChars("locale"),
+        factory->NewStringFromAsciiChecked(result), LanguageMode::kSloppy)
         .Assert();
   } else {
     // This would never happen, since we got the locale from ICU.
-    JSObject::SetProperty(resolved, factory->NewStringFromStaticChars("locale"),
-                          factory->NewStringFromStaticChars("und"),
-                          LanguageMode::kSloppy)
+    JSObject::SetProperty(
+        isolate, resolved, factory->NewStringFromStaticChars("locale"),
+        factory->NewStringFromStaticChars("und"), LanguageMode::kSloppy)
         .Assert();
   }
 }
@@ -801,15 +807,15 @@ void SetResolvedBreakIteratorSettings(Isolate* isolate,
   uloc_toLanguageTag(icu_locale.getName(), result, ULOC_FULLNAME_CAPACITY,
                      FALSE, &status);
   if (U_SUCCESS(status)) {
-    JSObject::SetProperty(resolved, factory->NewStringFromStaticChars("locale"),
-                          factory->NewStringFromAsciiChecked(result),
-                          LanguageMode::kSloppy)
+    JSObject::SetProperty(
+        isolate, resolved, factory->NewStringFromStaticChars("locale"),
+        factory->NewStringFromAsciiChecked(result), LanguageMode::kSloppy)
         .Assert();
   } else {
     // This would never happen, since we got the locale from ICU.
-    JSObject::SetProperty(resolved, factory->NewStringFromStaticChars("locale"),
-                          factory->NewStringFromStaticChars("und"),
-                          LanguageMode::kSloppy)
+    JSObject::SetProperty(
+        isolate, resolved, factory->NewStringFromStaticChars("locale"),
+        factory->NewStringFromStaticChars("und"), LanguageMode::kSloppy)
         .Assert();
   }
 }
@@ -1303,11 +1309,7 @@ MaybeHandle<Object> NumberFormat::FormatNumber(
       reinterpret_cast<const uint16_t*>(result.getBuffer()), result.length()));
 }
 
-// TODO(bstell): enable this anonymous namespace once these routines are called:
-//  * GetLanguageSingletonRegexMatcher,
-//  * GetLanguageTagRegexMatcher
-//  * GetLanguageVariantRegexMatcher
-// namespace {
+namespace {
 
 // TODO(bstell): Make all these a constexpr on the Intl class.
 void BuildLanguageTagRegexps(Isolate* isolate) {
@@ -1348,13 +1350,13 @@ void BuildLanguageTagRegexps(Isolate* isolate) {
   UErrorCode status = U_ZERO_ERROR;
   icu::RegexMatcher* language_singleton_regexp_matcher = new icu::RegexMatcher(
       icu::UnicodeString::fromUTF8(language_singleton_regexp), 0, status);
+  CHECK(U_SUCCESS(status));
   icu::RegexMatcher* language_tag_regexp_matcher = new icu::RegexMatcher(
       icu::UnicodeString::fromUTF8(language_tag_regexp), 0, status);
+  CHECK(U_SUCCESS(status));
   icu::RegexMatcher* language_variant_regexp_matcher = new icu::RegexMatcher(
       icu::UnicodeString::fromUTF8(language_variant_regexp), 0, status);
-  if (!U_SUCCESS(status)) {
-    return;
-  }
+  CHECK(U_SUCCESS(status));
 
   isolate->set_language_tag_regexp_matchers(language_singleton_regexp_matcher,
                                             language_tag_regexp_matcher,
@@ -1393,7 +1395,7 @@ icu::RegexMatcher* GetLanguageVariantRegexMatcher(Isolate* isolate) {
   return language_variant_regexp_matcher;
 }
 
-// }  // anonymous namespace
+}  // anonymous namespace
 
 MaybeHandle<JSObject> Intl::ResolveLocale(Isolate* isolate, const char* service,
                                           Handle<Object> requestedLocales,
@@ -1427,7 +1429,8 @@ Maybe<bool> Intl::GetStringOption(Isolate* isolate, Handle<JSReceiver> options,
   // 1. Let value be ? Get(options, property).
   Handle<Object> value;
   ASSIGN_RETURN_ON_EXCEPTION_VALUE(
-      isolate, value, Object::GetPropertyOrElement(options, property_str),
+      isolate, value,
+      Object::GetPropertyOrElement(isolate, options, property_str),
       Nothing<bool>());
 
   if (value->IsUndefined(isolate)) {
@@ -1475,7 +1478,8 @@ V8_WARN_UNUSED_RESULT Maybe<bool> Intl::GetBoolOption(
   // 1. Let value be ? Get(options, property).
   Handle<Object> value;
   ASSIGN_RETURN_ON_EXCEPTION_VALUE(
-      isolate, value, Object::GetPropertyOrElement(options, property_str),
+      isolate, value,
+      Object::GetPropertyOrElement(isolate, options, property_str),
       Nothing<bool>());
 
   // 2. If value is not undefined, then
@@ -1490,5 +1494,122 @@ V8_WARN_UNUSED_RESULT Maybe<bool> Intl::GetBoolOption(
   return Just(false);
 }
 
+// TODO(bstell): enable this anonymous namespace once
+// IsStructurallyValidLanguageTag called.
+// namespace {
+
+char AsciiToLower(char c) {
+  if (c < 'A' || c > 'Z') {
+    return c;
+  }
+  return c | (1 << 5);
+}
+
+/**
+ * Check the structural Validity of the language tag per ECMA 402 6.2.2:
+ *   - Well-formed per RFC 5646 2.1
+ *   - There are no duplicate variant subtags
+ *   - There are no duplicate singleton (extension) subtags
+ *
+ * One extra-check is done (from RFC 5646 2.2.9): the tag is compared
+ * against the list of grandfathered tags. However, subtags for
+ * primary/extended language, script, region, variant are not checked
+ * against the IANA language subtag registry.
+ *
+ * ICU is too permissible and lets invalid tags, like
+ * hant-cmn-cn, through.
+ *
+ * Returns false if the language tag is invalid.
+ */
+bool IsStructurallyValidLanguageTag(Isolate* isolate,
+                                    const std::string& locale_in) {
+  if (!String::IsAscii(locale_in.c_str(),
+                       static_cast<int>(locale_in.length()))) {
+    return false;
+  }
+  std::string locale(locale_in);
+  icu::RegexMatcher* language_tag_regexp_matcher =
+      GetLanguageTagRegexMatcher(isolate);
+
+  // Check if it's well-formed, including grandfathered tags.
+  language_tag_regexp_matcher->reset(
+      icu::UnicodeString(locale.c_str(), -1, US_INV));
+  UErrorCode status = U_ZERO_ERROR;
+  bool is_valid_lang_tag = language_tag_regexp_matcher->matches(status);
+  if (!is_valid_lang_tag || V8_UNLIKELY(U_FAILURE(status))) {
+    return false;
+  }
+
+  std::transform(locale.begin(), locale.end(), locale.begin(), AsciiToLower);
+
+  // Just return if it's a x- form. It's all private.
+  if (locale.find("x-") == 0) {
+    return true;
+  }
+
+  // Check if there are any duplicate variants or singletons (extensions).
+
+  // Remove private use section.
+  locale = locale.substr(0, locale.find("-x-"));
+
+  // Skip language since it can match variant regex, so we start from 1.
+  // We are matching i-klingon here, but that's ok, since i-klingon-klingon
+  // is not valid and would fail LANGUAGE_TAG_RE test.
+  size_t pos = 0;
+  std::vector<std::string> parts;
+  while ((pos = locale.find("-")) != std::string::npos) {
+    std::string token = locale.substr(0, pos);
+    parts.push_back(token);
+    locale = locale.substr(pos + 1);
+  }
+  if (locale.length() != 0) {
+    parts.push_back(locale);
+  }
+
+  icu::RegexMatcher* language_variant_regexp_matcher =
+      GetLanguageVariantRegexMatcher(isolate);
+
+  icu::RegexMatcher* language_singleton_regexp_matcher =
+      GetLanguageSingletonRegexMatcher(isolate);
+
+  std::vector<std::string> variants;
+  std::vector<std::string> extensions;
+  for (const auto& value : parts) {
+    language_variant_regexp_matcher->reset(
+        icu::UnicodeString::fromUTF8(value.c_str()));
+    bool is_language_variant = language_variant_regexp_matcher->matches(status);
+    if (V8_UNLIKELY(U_FAILURE(status))) {
+      return false;
+    }
+    if (is_language_variant && extensions.size() == 0) {
+      if (std::find(variants.begin(), variants.end(), value) ==
+          variants.end()) {
+        variants.push_back(value);
+      } else {
+        return false;
+      }
+    }
+
+    language_singleton_regexp_matcher->reset(
+        icu::UnicodeString(value.c_str(), -1, US_INV));
+    bool is_language_singleton =
+        language_singleton_regexp_matcher->matches(status);
+    if (V8_UNLIKELY(U_FAILURE(status))) {
+      return false;
+    }
+    if (is_language_singleton) {
+      if (std::find(extensions.begin(), extensions.end(), value) ==
+          extensions.end()) {
+        extensions.push_back(value);
+      } else {
+        return false;
+      }
+    }
+  }
+
+  return true;
+}
+// }  // anonymous namespace
+
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/src/objects/js-array.h b/deps/v8/src/objects/js-array.h
index 34b4f1f523d232..28cfe71f5ddda2 100644
--- a/deps/v8/src/objects/js-array.h
+++ b/deps/v8/src/objects/js-array.h
@@ -174,8 +174,6 @@ class JSArrayBuffer : public JSObject {
   void Neuter();
 
   struct Allocation {
-    using AllocationMode = ArrayBuffer::Allocator::AllocationMode;
-
     Allocation(void* allocation_base, size_t length, void* backing_store,
                bool is_wasm_memory)
         : allocation_base(allocation_base),
diff --git a/deps/v8/src/objects/js-locale.cc b/deps/v8/src/objects/js-locale.cc
index 4dc93aa67cbef1..27483c10718e64 100644
--- a/deps/v8/src/objects/js-locale.cc
+++ b/deps/v8/src/objects/js-locale.cc
@@ -11,6 +11,7 @@
 #include <map>
 #include <memory>
 #include <string>
+#include <vector>
 
 #include "src/api.h"
 #include "src/global-handles.h"
@@ -20,6 +21,7 @@
 #include "src/objects/intl-objects.h"
 #include "src/objects/js-locale-inl.h"
 #include "unicode/locid.h"
+#include "unicode/uloc.h"
 #include "unicode/unistr.h"
 #include "unicode/uvernum.h"
 #include "unicode/uversion.h"
@@ -32,6 +34,14 @@ namespace v8 {
 namespace internal {
 
 namespace {
+
+struct OptionData {
+  const char* name;
+  const char* key;
+  const std::vector<const char*>* possible_values;
+  bool is_bool_value;
+};
+
 // Inserts tags from options into locale string.
 Maybe<bool> InsertOptionsIntoLocale(Isolate* isolate,
                                     Handle<JSReceiver> options,
@@ -39,32 +49,47 @@ Maybe<bool> InsertOptionsIntoLocale(Isolate* isolate,
   CHECK(isolate);
   CHECK(icu_locale);
 
-  static const std::array<std::pair<const char*, const char*>, 6>
-      kOptionToUnicodeTagMap = {{{"calendar", "ca"},
-                                 {"collation", "co"},
-                                 {"hourCycle", "hc"},
-                                 {"caseFirst", "kf"},
-                                 {"numeric", "kn"},
-                                 {"numberingSystem", "nu"}}};
+  static std::vector<const char*> hour_cycle_values = {"h11", "h12", "h23",
+                                                       "h24"};
+  static std::vector<const char*> case_first_values = {"upper", "lower",
+                                                       "false"};
+  static std::vector<const char*> empty_values = {};
+  static const std::array<OptionData, 6> kOptionToUnicodeTagMap = {
+      {{"calendar", "ca", &empty_values, false},
+       {"collation", "co", &empty_values, false},
+       {"hourCycle", "hc", &hour_cycle_values, false},
+       {"caseFirst", "kf", &case_first_values, false},
+       {"numeric", "kn", &empty_values, true},
+       {"numberingSystem", "nu", &empty_values, false}}};
 
   // TODO(cira): Pass in values as per the spec to make this to be
   // spec compliant.
-  std::vector<const char*> values = {};
 
   for (const auto& option_to_bcp47 : kOptionToUnicodeTagMap) {
     std::unique_ptr<char[]> value_str = nullptr;
-    Maybe<bool> maybe_found = Intl::GetStringOption(
-        isolate, options, option_to_bcp47.first, values, "locale", &value_str);
+    bool value_bool = false;
+    Maybe<bool> maybe_found =
+        option_to_bcp47.is_bool_value
+            ? Intl::GetBoolOption(isolate, options, option_to_bcp47.name,
+                                  "locale", &value_bool)
+            : Intl::GetStringOption(isolate, options, option_to_bcp47.name,
+                                    *(option_to_bcp47.possible_values),
+                                    "locale", &value_str);
     if (maybe_found.IsNothing()) return maybe_found;
 
     // TODO(cira): Use fallback value if value is not found to make
     // this spec compliant.
     if (!maybe_found.FromJust()) continue;
+
+    if (option_to_bcp47.is_bool_value) {
+      value_str = value_bool ? isolate->factory()->true_string()->ToCString()
+                             : isolate->factory()->false_string()->ToCString();
+    }
     DCHECK_NOT_NULL(value_str.get());
 
     // Convert bcp47 key and value into legacy ICU format so we can use
     // uloc_setKeywordValue.
-    const char* key = uloc_toLegacyKey(option_to_bcp47.second);
+    const char* key = uloc_toLegacyKey(option_to_bcp47.key);
     DCHECK_NOT_NULL(key);
 
     // Overwrite existing, or insert new key-value to the locale string.
@@ -113,17 +138,11 @@ bool PopulateLocaleWithUnicodeTags(Isolate* isolate, const char* icu_locale,
     if (bcp47_key) {
       const char* bcp47_value = uloc_toUnicodeLocaleType(bcp47_key, value);
       if (bcp47_value) {
-          // It's either Boolean value.
-          if (strncmp(bcp47_key, "kn", 2) == 0) {
-            bool numeric = strcmp(bcp47_value, "true") == 0 ? true : false;
-            Handle<Object> numeric_handle = factory->ToBoolean(numeric);
-            locale_holder->set_numeric(*numeric_handle);
-            continue;
-          }
-          // Or a string.
           Handle<String> bcp47_handle =
               factory->NewStringFromAsciiChecked(bcp47_value);
-          if (strncmp(bcp47_key, "ca", 2) == 0) {
+          if (strncmp(bcp47_key, "kn", 2) == 0) {
+            locale_holder->set_numeric(*bcp47_handle);
+          } else if (strncmp(bcp47_key, "ca", 2) == 0) {
             locale_holder->set_calendar(*bcp47_handle);
           } else if (strncmp(bcp47_key, "kf", 2) == 0) {
             locale_holder->set_case_first(*bcp47_handle);
@@ -283,5 +302,33 @@ MaybeHandle<JSLocale> JSLocale::InitializeLocale(Isolate* isolate,
   return locale_holder;
 }
 
+namespace {
+
+Handle<String> MorphLocale(Isolate* isolate, String* input,
+                           int32_t (*morph_func)(const char*, char*, int32_t,
+                                                 UErrorCode*)) {
+  Factory* factory = isolate->factory();
+  char localeBuffer[ULOC_FULLNAME_CAPACITY];
+  UErrorCode status = U_ZERO_ERROR;
+  DCHECK_NOT_NULL(morph_func);
+  int32_t length = (*morph_func)(input->ToCString().get(), localeBuffer,
+                                 ULOC_FULLNAME_CAPACITY, &status);
+  DCHECK(U_SUCCESS(status));
+  DCHECK_GT(length, 0);
+  std::string locale(localeBuffer, length);
+  std::replace(locale.begin(), locale.end(), '_', '-');
+  return factory->NewStringFromAsciiChecked(locale.c_str());
+}
+
+}  // namespace
+
+Handle<String> JSLocale::Maximize(Isolate* isolate, String* locale) {
+  return MorphLocale(isolate, locale, uloc_addLikelySubtags);
+}
+
+Handle<String> JSLocale::Minimize(Isolate* isolate, String* locale) {
+  return MorphLocale(isolate, locale, uloc_minimizeSubtags);
+}
+
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/src/objects/js-locale.h b/deps/v8/src/objects/js-locale.h
index 74d64bf486932f..80b44b02314240 100644
--- a/deps/v8/src/objects/js-locale.h
+++ b/deps/v8/src/objects/js-locale.h
@@ -30,6 +30,8 @@ class JSLocale : public JSObject {
                                                 Handle<JSLocale> locale_holder,
                                                 Handle<String> locale,
                                                 Handle<JSReceiver> options);
+  static Handle<String> Maximize(Isolate* isolate, String* locale);
+  static Handle<String> Minimize(Isolate* isolate, String* locale);
 
   DECL_CAST(JSLocale)
 
diff --git a/deps/v8/src/objects/js-proxy-inl.h b/deps/v8/src/objects/js-proxy-inl.h
new file mode 100644
index 00000000000000..503453ab087a44
--- /dev/null
+++ b/deps/v8/src/objects/js-proxy-inl.h
@@ -0,0 +1,28 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef V8_OBJECTS_JS_PROXY_INL_H_
+#define V8_OBJECTS_JS_PROXY_INL_H_
+
+#include "src/objects/js-proxy.h"
+
+// Has to be the last include (doesn't have include guards):
+#include "src/objects/object-macros.h"
+
+namespace v8 {
+namespace internal {
+
+CAST_ACCESSOR(JSProxy)
+
+ACCESSORS(JSProxy, target, Object, kTargetOffset)
+ACCESSORS(JSProxy, handler, Object, kHandlerOffset)
+
+bool JSProxy::IsRevoked() const { return !handler()->IsJSReceiver(); }
+
+}  // namespace internal
+}  // namespace v8
+
+#include "src/objects/object-macros-undef.h"
+
+#endif  // V8_OBJECTS_JS_PROXY_INL_H_
diff --git a/deps/v8/src/objects/js-proxy.h b/deps/v8/src/objects/js-proxy.h
new file mode 100644
index 00000000000000..45e27473fe445a
--- /dev/null
+++ b/deps/v8/src/objects/js-proxy.h
@@ -0,0 +1,155 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef V8_OBJECTS_JS_PROXY_H_
+#define V8_OBJECTS_JS_PROXY_H_
+
+#include "src/objects.h"
+
+// Has to be the last include (doesn't have include guards):
+#include "src/objects/object-macros.h"
+
+namespace v8 {
+namespace internal {
+
+// The JSProxy describes EcmaScript Harmony proxies
+class JSProxy : public JSReceiver {
+ public:
+  V8_WARN_UNUSED_RESULT static MaybeHandle<JSProxy> New(Isolate* isolate,
+                                                        Handle<Object>,
+                                                        Handle<Object>);
+
+  // [handler]: The handler property.
+  DECL_ACCESSORS(handler, Object)
+  // [target]: The target property.
+  DECL_ACCESSORS(target, Object)
+
+  static MaybeHandle<Context> GetFunctionRealm(Handle<JSProxy> proxy);
+
+  DECL_CAST(JSProxy)
+
+  V8_INLINE bool IsRevoked() const;
+  static void Revoke(Handle<JSProxy> proxy);
+
+  // ES6 9.5.1
+  static MaybeHandle<Object> GetPrototype(Handle<JSProxy> receiver);
+
+  // ES6 9.5.2
+  V8_WARN_UNUSED_RESULT static Maybe<bool> SetPrototype(
+      Handle<JSProxy> proxy, Handle<Object> value, bool from_javascript,
+      ShouldThrow should_throw);
+  // ES6 9.5.3
+  V8_WARN_UNUSED_RESULT static Maybe<bool> IsExtensible(Handle<JSProxy> proxy);
+
+  // ES6, #sec-isarray.  NOT to be confused with %_IsArray.
+  V8_WARN_UNUSED_RESULT static Maybe<bool> IsArray(Handle<JSProxy> proxy);
+
+  // ES6 9.5.4 (when passed kDontThrow)
+  V8_WARN_UNUSED_RESULT static Maybe<bool> PreventExtensions(
+      Handle<JSProxy> proxy, ShouldThrow should_throw);
+
+  // ES6 9.5.5
+  V8_WARN_UNUSED_RESULT static Maybe<bool> GetOwnPropertyDescriptor(
+      Isolate* isolate, Handle<JSProxy> proxy, Handle<Name> name,
+      PropertyDescriptor* desc);
+
+  // ES6 9.5.6
+  V8_WARN_UNUSED_RESULT static Maybe<bool> DefineOwnProperty(
+      Isolate* isolate, Handle<JSProxy> object, Handle<Object> key,
+      PropertyDescriptor* desc, ShouldThrow should_throw);
+
+  // ES6 9.5.7
+  V8_WARN_UNUSED_RESULT static Maybe<bool> HasProperty(Isolate* isolate,
+                                                       Handle<JSProxy> proxy,
+                                                       Handle<Name> name);
+
+  // This function never returns false.
+  // It returns either true or throws.
+  V8_WARN_UNUSED_RESULT static Maybe<bool> CheckHasTrap(
+      Isolate* isolate, Handle<Name> name, Handle<JSReceiver> target);
+
+  // ES6 9.5.8
+  V8_WARN_UNUSED_RESULT static MaybeHandle<Object> GetProperty(
+      Isolate* isolate, Handle<JSProxy> proxy, Handle<Name> name,
+      Handle<Object> receiver, bool* was_found);
+
+  enum AccessKind { kGet, kSet };
+
+  static MaybeHandle<Object> CheckGetSetTrapResult(Isolate* isolate,
+                                                   Handle<Name> name,
+                                                   Handle<JSReceiver> target,
+                                                   Handle<Object> trap_result,
+                                                   AccessKind access_kind);
+
+  // ES6 9.5.9
+  V8_WARN_UNUSED_RESULT static Maybe<bool> SetProperty(
+      Handle<JSProxy> proxy, Handle<Name> name, Handle<Object> value,
+      Handle<Object> receiver, LanguageMode language_mode);
+
+  // ES6 9.5.10 (when passed LanguageMode::kSloppy)
+  V8_WARN_UNUSED_RESULT static Maybe<bool> DeletePropertyOrElement(
+      Handle<JSProxy> proxy, Handle<Name> name, LanguageMode language_mode);
+
+  // ES6 9.5.12
+  V8_WARN_UNUSED_RESULT static Maybe<bool> OwnPropertyKeys(
+      Isolate* isolate, Handle<JSReceiver> receiver, Handle<JSProxy> proxy,
+      PropertyFilter filter, KeyAccumulator* accumulator);
+
+  V8_WARN_UNUSED_RESULT static Maybe<PropertyAttributes> GetPropertyAttributes(
+      LookupIterator* it);
+
+  // Dispatched behavior.
+  DECL_PRINTER(JSProxy)
+  DECL_VERIFIER(JSProxy)
+
+  static const int kMaxIterationLimit = 100 * 1024;
+
+  // Layout description.
+  static const int kTargetOffset = JSReceiver::kHeaderSize;
+  static const int kHandlerOffset = kTargetOffset + kPointerSize;
+  static const int kSize = kHandlerOffset + kPointerSize;
+
+  // kTargetOffset aliases with the elements of JSObject. The fact that
+  // JSProxy::target is a Javascript value which cannot be confused with an
+  // elements backing store is exploited by loading from this offset from an
+  // unknown JSReceiver.
+  STATIC_ASSERT(JSObject::kElementsOffset == JSProxy::kTargetOffset);
+
+  typedef FixedBodyDescriptor<JSReceiver::kPropertiesOrHashOffset, kSize, kSize>
+      BodyDescriptor;
+  // No weak fields.
+  typedef BodyDescriptor BodyDescriptorWeak;
+
+  static Maybe<bool> SetPrivateSymbol(Isolate* isolate, Handle<JSProxy> proxy,
+                                      Handle<Symbol> private_name,
+                                      PropertyDescriptor* desc,
+                                      ShouldThrow should_throw);
+
+ private:
+  DISALLOW_IMPLICIT_CONSTRUCTORS(JSProxy);
+};
+
+// JSProxyRevocableResult is just a JSObject with a specific initial map.
+// This initial map adds in-object properties for "proxy" and "revoke".
+// See https://tc39.github.io/ecma262/#sec-proxy.revocable
+class JSProxyRevocableResult : public JSObject {
+ public:
+  // Offsets of object fields.
+  static const int kProxyOffset = JSObject::kHeaderSize;
+  static const int kRevokeOffset = kProxyOffset + kPointerSize;
+  static const int kSize = kRevokeOffset + kPointerSize;
+  // Indices of in-object properties.
+  static const int kProxyIndex = 0;
+  static const int kRevokeIndex = 1;
+
+ private:
+  DISALLOW_IMPLICIT_CONSTRUCTORS(JSProxyRevocableResult);
+};
+
+}  // namespace internal
+}  // namespace v8
+
+#include "src/objects/object-macros-undef.h"
+
+#endif  // V8_OBJECTS_JS_PROXY_H_
diff --git a/deps/v8/src/objects/js-regexp.h b/deps/v8/src/objects/js-regexp.h
index 6a0c4e3391b7e3..7c8841ee7916b9 100644
--- a/deps/v8/src/objects/js-regexp.h
+++ b/deps/v8/src/objects/js-regexp.h
@@ -55,7 +55,8 @@ class JSRegExp : public JSObject {
   DECL_ACCESSORS(last_index, Object)
   DECL_ACCESSORS(source, Object)
 
-  V8_EXPORT_PRIVATE static MaybeHandle<JSRegExp> New(Handle<String> source,
+  V8_EXPORT_PRIVATE static MaybeHandle<JSRegExp> New(Isolate* isolate,
+                                                     Handle<String> source,
                                                      Flags flags);
   static Handle<JSRegExp> Copy(Handle<JSRegExp> regexp);
 
diff --git a/deps/v8/src/objects/literal-objects.cc b/deps/v8/src/objects/literal-objects.cc
index 69f4e2c3f935c7..29d7c42b5d740e 100644
--- a/deps/v8/src/objects/literal-objects.cc
+++ b/deps/v8/src/objects/literal-objects.cc
@@ -128,18 +128,19 @@ void AddToDescriptorArrayTemplate(
 }
 
 Handle<NameDictionary> DictionaryAddNoUpdateNextEnumerationIndex(
-    Handle<NameDictionary> dictionary, Handle<Name> name, Handle<Object> value,
-    PropertyDetails details, int* entry_out = nullptr) {
+    Isolate* isolate, Handle<NameDictionary> dictionary, Handle<Name> name,
+    Handle<Object> value, PropertyDetails details, int* entry_out = nullptr) {
   return NameDictionary::AddNoUpdateNextEnumerationIndex(
-      dictionary, name, value, details, entry_out);
+      isolate, dictionary, name, value, details, entry_out);
 }
 
 Handle<NumberDictionary> DictionaryAddNoUpdateNextEnumerationIndex(
-    Handle<NumberDictionary> dictionary, uint32_t element, Handle<Object> value,
-    PropertyDetails details, int* entry_out = nullptr) {
+    Isolate* isolate, Handle<NumberDictionary> dictionary, uint32_t element,
+    Handle<Object> value, PropertyDetails details, int* entry_out = nullptr) {
   // NumberDictionary does not maintain the enumeration order, so it's
   // a normal Add().
-  return NumberDictionary::Add(dictionary, element, value, details, entry_out);
+  return NumberDictionary::Add(isolate, dictionary, element, value, details,
+                               entry_out);
 }
 
 void DictionaryUpdateMaxNumberKey(Handle<NameDictionary> dictionary,
@@ -198,7 +199,7 @@ void AddToDictionaryTemplate(Isolate* isolate, Handle<Dictionary> dictionary,
 
     // Add value to the dictionary without updating next enumeration index.
     Handle<Dictionary> dict = DictionaryAddNoUpdateNextEnumerationIndex(
-        dictionary, key, value_handle, details, &entry);
+        isolate, dictionary, key, value_handle, details, &entry);
     // It is crucial to avoid dictionary reallocations because it may remove
     // potential gaps in enumeration indices values that are necessary for
     // inserting computed properties into right places in the enumeration order.
@@ -225,7 +226,7 @@ void AddToDictionaryTemplate(Isolate* isolate, Handle<Dictionary> dictionary,
           // so overwrite both.
           PropertyDetails details(kData, DONT_ENUM, PropertyCellType::kNoCell,
                                   enum_order);
-          dictionary->DetailsAtPut(entry, details);
+          dictionary->DetailsAtPut(isolate, entry, details);
           dictionary->ValueAtPut(entry, value);
 
         } else {
@@ -250,7 +251,7 @@ void AddToDictionaryTemplate(Isolate* isolate, Handle<Dictionary> dictionary,
         if (existing_value_index < key_index) {
           PropertyDetails details(kData, DONT_ENUM, PropertyCellType::kNoCell,
                                   enum_order);
-          dictionary->DetailsAtPut(entry, details);
+          dictionary->DetailsAtPut(isolate, entry, details);
           dictionary->ValueAtPut(entry, value);
         }
       }
@@ -272,7 +273,7 @@ void AddToDictionaryTemplate(Isolate* isolate, Handle<Dictionary> dictionary,
         pair->set(component, value);
         PropertyDetails details(kAccessor, DONT_ENUM, PropertyCellType::kNoCell,
                                 enum_order);
-        dictionary->DetailsAtPut(entry, details);
+        dictionary->DetailsAtPut(isolate, entry, details);
         dictionary->ValueAtPut(entry, *pair);
       }
     }
@@ -334,7 +335,7 @@ class ObjectDescriptor {
     temp_handle_ = handle(Smi::kZero, isolate);
   }
 
-  void AddConstant(Handle<Name> name, Handle<Object> value,
+  void AddConstant(Isolate* isolate, Handle<Name> name, Handle<Object> value,
                    PropertyAttributes attribs) {
     bool is_accessor = value->IsAccessorInfo();
     DCHECK(!value->IsAccessorPair());
@@ -344,7 +345,7 @@ class ObjectDescriptor {
                               next_enumeration_index_++);
       properties_dictionary_template_ =
           DictionaryAddNoUpdateNextEnumerationIndex(
-              properties_dictionary_template_, name, value, details);
+              isolate, properties_dictionary_template_, name, value, details);
     } else {
       Descriptor d = is_accessor
                          ? Descriptor::AccessorConstant(name, value, attribs)
@@ -467,14 +468,14 @@ Handle<ClassBoilerplate> ClassBoilerplate::BuildClassBoilerplate(
     // Add length_accessor.
     PropertyAttributes attribs =
         static_cast<PropertyAttributes>(DONT_ENUM | READ_ONLY);
-    static_desc.AddConstant(factory->length_string(),
+    static_desc.AddConstant(isolate, factory->length_string(),
                             factory->function_length_accessor(), attribs);
   }
   {
     // Add prototype_accessor.
     PropertyAttributes attribs =
         static_cast<PropertyAttributes>(DONT_ENUM | DONT_DELETE | READ_ONLY);
-    static_desc.AddConstant(factory->prototype_string(),
+    static_desc.AddConstant(isolate, factory->prototype_string(),
                             factory->function_prototype_accessor(), attribs);
   }
   if (FunctionLiteral::NeedsHomeObject(expr->constructor())) {
@@ -482,15 +483,16 @@ Handle<ClassBoilerplate> ClassBoilerplate::BuildClassBoilerplate(
         static_cast<PropertyAttributes>(DONT_ENUM | DONT_DELETE | READ_ONLY);
     Handle<Object> value(
         Smi::FromInt(ClassBoilerplate::kPrototypeArgumentIndex), isolate);
-    static_desc.AddConstant(factory->home_object_symbol(), value, attribs);
+    static_desc.AddConstant(isolate, factory->home_object_symbol(), value,
+                            attribs);
   }
   {
     Handle<Smi> start_position(Smi::FromInt(expr->start_position()), isolate);
     Handle<Smi> end_position(Smi::FromInt(expr->end_position()), isolate);
     Handle<Tuple2> class_positions =
         factory->NewTuple2(start_position, end_position, NOT_TENURED);
-    static_desc.AddConstant(factory->class_positions_symbol(), class_positions,
-                            DONT_ENUM);
+    static_desc.AddConstant(isolate, factory->class_positions_symbol(),
+                            class_positions, DONT_ENUM);
   }
 
   //
@@ -500,7 +502,8 @@ Handle<ClassBoilerplate> ClassBoilerplate::BuildClassBoilerplate(
   {
     Handle<Object> value(
         Smi::FromInt(ClassBoilerplate::kConstructorArgumentIndex), isolate);
-    instance_desc.AddConstant(factory->constructor_string(), value, DONT_ENUM);
+    instance_desc.AddConstant(isolate, factory->constructor_string(), value,
+                              DONT_ENUM);
   }
 
   //
@@ -566,7 +569,7 @@ Handle<ClassBoilerplate> ClassBoilerplate::BuildClassBoilerplate(
       // Set class name accessor if the "name" method was not added yet.
       PropertyAttributes attribs =
           static_cast<PropertyAttributes>(DONT_ENUM | READ_ONLY);
-      static_desc.AddConstant(factory->name_string(),
+      static_desc.AddConstant(isolate, factory->name_string(),
                               factory->function_name_accessor(), attribs);
     }
   }
diff --git a/deps/v8/src/objects/map-inl.h b/deps/v8/src/objects/map-inl.h
index 0d6ca925560fcc..59214bd18fb6f9 100644
--- a/deps/v8/src/objects/map-inl.h
+++ b/deps/v8/src/objects/map-inl.h
@@ -185,7 +185,7 @@ FixedArrayBase* Map::GetInitialElements() const {
   } else if (has_fast_sloppy_arguments_elements()) {
     result = GetReadOnlyRoots().empty_sloppy_arguments_elements();
   } else if (has_fixed_typed_array_elements()) {
-    result = GetHeap()->EmptyFixedTypedArrayForMap(this);
+    result = GetReadOnlyRoots().EmptyFixedTypedArrayForMap(this);
   } else if (has_dictionary_elements()) {
     result = GetReadOnlyRoots().empty_slow_element_dictionary();
   } else {
@@ -482,11 +482,11 @@ bool Map::CanBeDeprecated() const {
   return false;
 }
 
-void Map::NotifyLeafMapLayoutChange() {
+void Map::NotifyLeafMapLayoutChange(Isolate* isolate) {
   if (is_stable()) {
     mark_unstable();
     dependent_code()->DeoptimizeDependentCodeGroup(
-        GetIsolate(), DependentCode::kPrototypeCheckGroup);
+        isolate, DependentCode::kPrototypeCheckGroup);
   }
 }
 
@@ -536,7 +536,8 @@ Object* Map::prototype() const { return READ_FIELD(this, kPrototypeOffset); }
 void Map::set_prototype(Object* value, WriteBarrierMode mode) {
   DCHECK(value->IsNull() || value->IsJSReceiver());
   WRITE_FIELD(this, kPrototypeOffset, value);
-  CONDITIONAL_WRITE_BARRIER(GetHeap(), this, kPrototypeOffset, value, mode);
+  CONDITIONAL_WRITE_BARRIER(Heap::FromWritableHeapObject(this), this,
+                            kPrototypeOffset, value, mode);
 }
 
 LayoutDescriptor* Map::layout_descriptor_gc_safe() const {
@@ -641,7 +642,10 @@ Object* Map::GetBackPointer() const {
 
 Map* Map::ElementsTransitionMap() {
   DisallowHeapAllocation no_gc;
-  return TransitionsAccessor(GetIsolate(), this, &no_gc)
+  // TODO(delphick): While it's safe to pass nullptr for Isolate* here as
+  // SearchSpecial doesn't need it, this is really ugly. Perhaps factor out a
+  // base class for methods not requiring an Isolate?
+  return TransitionsAccessor(nullptr, this, &no_gc)
       .SearchSpecial(GetReadOnlyRoots().elements_transition_symbol());
 }
 
@@ -653,8 +657,9 @@ Object* Map::prototype_info() const {
 void Map::set_prototype_info(Object* value, WriteBarrierMode mode) {
   CHECK(is_prototype_map());
   WRITE_FIELD(this, Map::kTransitionsOrPrototypeInfoOffset, value);
-  CONDITIONAL_WRITE_BARRIER(
-      GetHeap(), this, Map::kTransitionsOrPrototypeInfoOffset, value, mode);
+  CONDITIONAL_WRITE_BARRIER(Heap::FromWritableHeapObject(this), this,
+                            Map::kTransitionsOrPrototypeInfoOffset, value,
+                            mode);
 }
 
 void Map::SetBackPointer(Object* value, WriteBarrierMode mode) {
@@ -667,7 +672,6 @@ void Map::SetBackPointer(Object* value, WriteBarrierMode mode) {
 }
 
 ACCESSORS(Map, dependent_code, DependentCode, kDependentCodeOffset)
-ACCESSORS(Map, weak_cell_cache, Object, kWeakCellCacheOffset)
 ACCESSORS(Map, prototype_validity_cell, Object, kPrototypeValidityCellOffset)
 ACCESSORS(Map, constructor_or_backpointer, Object,
           kConstructorOrBackPointerOffset)
@@ -740,16 +744,16 @@ int NormalizedMapCache::GetIndex(Handle<Map> map) {
   return map->Hash() % NormalizedMapCache::kEntries;
 }
 
-bool NormalizedMapCache::IsNormalizedMapCache(Isolate* isolate,
-                                              const HeapObject* obj) {
-  if (!obj->IsFixedArray()) return false;
-  if (FixedArray::cast(obj)->length() != NormalizedMapCache::kEntries) {
+bool NormalizedMapCache::IsNormalizedMapCache(const HeapObject* obj) {
+  if (!obj->IsWeakFixedArray()) return false;
+  if (WeakFixedArray::cast(obj)->length() != NormalizedMapCache::kEntries) {
     return false;
   }
 #ifdef VERIFY_HEAP
   if (FLAG_verify_heap) {
-    reinterpret_cast<NormalizedMapCache*>(const_cast<HeapObject*>(obj))
-        ->NormalizedMapCacheVerify(isolate);
+    NormalizedMapCache* cache =
+        reinterpret_cast<NormalizedMapCache*>(const_cast<HeapObject*>(obj));
+    cache->NormalizedMapCacheVerify(cache->GetIsolate());
   }
 #endif
   return true;
diff --git a/deps/v8/src/objects/map.h b/deps/v8/src/objects/map.h
index da3dcfb278ebec..da607be5f3b0e9 100644
--- a/deps/v8/src/objects/map.h
+++ b/deps/v8/src/objects/map.h
@@ -166,8 +166,6 @@ typedef std::vector<Handle<Map>> MapHandles;
 // +*************************************************************+
 // | TaggedPointer | [dependent_code]                            |
 // +---------------+---------------------------------------------+
-// | TaggedPointer | [weak_cell_cache]                           |
-// +---------------+---------------------------------------------+
 
 class Map : public HeapObject {
  public:
@@ -402,7 +400,7 @@ class Map : public HeapObject {
 
   // Returns true if the current map doesn't have DICTIONARY_ELEMENTS but if a
   // map with DICTIONARY_ELEMENTS was found in the prototype chain.
-  bool DictionaryElementsInPrototypeChainOnly();
+  bool DictionaryElementsInPrototypeChainOnly(Isolate* isolate);
 
   inline Map* ElementsTransitionMap();
 
@@ -574,9 +572,6 @@ class Map : public HeapObject {
   // [dependent code]: list of optimized codes that weakly embed this map.
   DECL_ACCESSORS(dependent_code, DependentCode)
 
-  // [weak cell cache]: cache that stores a weak cell pointing to this map.
-  DECL_ACCESSORS(weak_cell_cache, Object)
-
   // [prototype_validity_cell]: Cell containing the validity bit for prototype
   // chains or Smi(0) if uninitialized.
   // The meaning of this validity cell is different for prototype maps and
@@ -656,7 +651,8 @@ class Map : public HeapObject {
                                           Descriptor* descriptor,
                                           TransitionFlag flag);
 
-  static MaybeObjectHandle WrapFieldType(Handle<FieldType> type);
+  static MaybeObjectHandle WrapFieldType(Isolate* isolate,
+                                         Handle<FieldType> type);
   static FieldType* UnwrapFieldType(MaybeObject* wrapped_type);
 
   V8_WARN_UNUSED_RESULT static MaybeHandle<Map> CopyWithField(
@@ -780,8 +776,6 @@ class Map : public HeapObject {
 
   bool IsMapInArrayPrototypeChain(Isolate* isolate) const;
 
-  static Handle<WeakCell> WeakCellForMap(Isolate* isolate, Handle<Map> map);
-
   // Dispatched behavior.
   DECL_PRINTER(Map)
   DECL_VERIFIER(Map)
@@ -820,7 +814,6 @@ class Map : public HeapObject {
   V(kDescriptorsOffset, kPointerSize)                                       \
   V(kLayoutDescriptorOffset, FLAG_unbox_double_fields ? kPointerSize : 0)   \
   V(kDependentCodeOffset, kPointerSize)                                     \
-  V(kWeakCellCacheOffset, kPointerSize)                                     \
   V(kPrototypeValidityCellOffset, kPointerSize)                             \
   V(kPointerFieldsEndOffset, 0)                                             \
   /* Total size. */                                                         \
@@ -853,7 +846,7 @@ class Map : public HeapObject {
   // Fires when the layout of an object with a leaf map changes.
   // This includes adding transitions to the leaf map or changing
   // the descriptor array.
-  inline void NotifyLeafMapLayoutChange();
+  inline void NotifyLeafMapLayoutChange(Isolate* isolate);
 
   static VisitorId GetVisitorId(Map* map);
 
@@ -969,21 +962,21 @@ class Map : public HeapObject {
 // The cache for maps used by normalized (dictionary mode) objects.
 // Such maps do not have property descriptors, so a typical program
 // needs very limited number of distinct normalized maps.
-class NormalizedMapCache : public FixedArray {
+class NormalizedMapCache : public WeakFixedArray,
+                           public NeverReadOnlySpaceObject {
  public:
+  using NeverReadOnlySpaceObject::GetHeap;
+  using NeverReadOnlySpaceObject::GetIsolate;
+
   static Handle<NormalizedMapCache> New(Isolate* isolate);
 
   V8_WARN_UNUSED_RESULT MaybeHandle<Map> Get(Handle<Map> fast_map,
                                              PropertyNormalizationMode mode);
-  void Set(Handle<Map> fast_map, Handle<Map> normalized_map,
-           Handle<WeakCell> normalized_map_weak_cell);
-
-  void Clear();
+  void Set(Handle<Map> fast_map, Handle<Map> normalized_map);
 
   DECL_CAST(NormalizedMapCache)
 
-  static inline bool IsNormalizedMapCache(Isolate* isolate,
-                                          const HeapObject* obj);
+  static inline bool IsNormalizedMapCache(const HeapObject* obj);
 
   DECL_VERIFIER(NormalizedMapCache)
 
diff --git a/deps/v8/src/objects/maybe-object.h b/deps/v8/src/objects/maybe-object.h
index df62050b8ad30c..0d8751b65205a8 100644
--- a/deps/v8/src/objects/maybe-object.h
+++ b/deps/v8/src/objects/maybe-object.h
@@ -59,7 +59,7 @@ class MaybeObject {
   static inline MaybeObject* MakeWeak(MaybeObject* object);
 
 #ifdef VERIFY_HEAP
-  static void VerifyMaybeObjectPointer(MaybeObject* p);
+  static void VerifyMaybeObjectPointer(Isolate* isolate, MaybeObject* p);
 #endif
 
   // Prints this object without details.
diff --git a/deps/v8/src/objects/module.h b/deps/v8/src/objects/module.h
index b3035d285155b0..23c13568179c5d 100644
--- a/deps/v8/src/objects/module.h
+++ b/deps/v8/src/objects/module.h
@@ -25,8 +25,11 @@ class String;
 class Zone;
 
 // The runtime representation of an ECMAScript module.
-class Module : public Struct {
+class Module : public Struct, public NeverReadOnlySpaceObject {
  public:
+  using NeverReadOnlySpaceObject::GetHeap;
+  using NeverReadOnlySpaceObject::GetIsolate;
+
   DECL_CAST(Module)
   DECL_VERIFIER(Module)
   DECL_PRINTER(Module)
diff --git a/deps/v8/src/objects/name.h b/deps/v8/src/objects/name.h
index c4b7da0ef732b3..06e08deb828864 100644
--- a/deps/v8/src/objects/name.h
+++ b/deps/v8/src/objects/name.h
@@ -56,9 +56,9 @@ class Name : public HeapObject {
   // Return a string version of this name that is converted according to the
   // rules described in ES6 section 9.2.11.
   V8_WARN_UNUSED_RESULT static MaybeHandle<String> ToFunctionName(
-      Handle<Name> name);
+      Isolate* isolate, Handle<Name> name);
   V8_WARN_UNUSED_RESULT static MaybeHandle<String> ToFunctionName(
-      Handle<Name> name, Handle<String> prefix);
+      Isolate* isolate, Handle<Name> name, Handle<String> prefix);
 
   DECL_CAST(Name)
 
diff --git a/deps/v8/src/objects/prototype-info-inl.h b/deps/v8/src/objects/prototype-info-inl.h
index 455673cbdd77d0..df638c9e5bf9a1 100644
--- a/deps/v8/src/objects/prototype-info-inl.h
+++ b/deps/v8/src/objects/prototype-info-inl.h
@@ -7,6 +7,8 @@
 
 #include "src/objects/prototype-info.h"
 
+#include "src/objects/maybe-object.h"
+
 // Has to be the last include (doesn't have include guards):
 #include "src/objects/object-macros.h"
 
@@ -37,6 +39,23 @@ SMI_ACCESSORS(PrototypeInfo, registry_slot, kRegistrySlotOffset)
 SMI_ACCESSORS(PrototypeInfo, bit_field, kBitFieldOffset)
 BOOL_ACCESSORS(PrototypeInfo, bit_field, should_be_fast_map, kShouldBeFastBit)
 
+void PrototypeUsers::MarkSlotEmpty(WeakArrayList* array, int index) {
+  DCHECK_GT(index, 0);
+  DCHECK_LT(index, array->length());
+  // Chain the empty slots into a linked list (each empty slot contains the
+  // index of the next empty slot).
+  array->Set(index, MaybeObject::FromObject(empty_slot_index(array)));
+  set_empty_slot_index(array, index);
+}
+
+Smi* PrototypeUsers::empty_slot_index(WeakArrayList* array) {
+  return array->Get(kEmptySlotIndex)->ToSmi();
+}
+
+void PrototypeUsers::set_empty_slot_index(WeakArrayList* array, int index) {
+  array->Set(kEmptySlotIndex, MaybeObject::FromObject(Smi::FromInt(index)));
+}
+
 }  // namespace internal
 }  // namespace v8
 
diff --git a/deps/v8/src/objects/prototype-info.h b/deps/v8/src/objects/prototype-info.h
index 5c474bb3b7ba24..303617fda02af4 100644
--- a/deps/v8/src/objects/prototype-info.h
+++ b/deps/v8/src/objects/prototype-info.h
@@ -6,6 +6,7 @@
 #define V8_OBJECTS_PROTOTYPE_INFO_H_
 
 #include "src/objects.h"
+#include "src/objects/fixed-array.h"
 
 // Has to be the last include (doesn't have include guards):
 #include "src/objects/object-macros.h"
@@ -21,8 +22,8 @@ class PrototypeInfo : public Struct {
   // [weak_cell]: A WeakCell containing this prototype. ICs cache the cell here.
   DECL_ACCESSORS(weak_cell, Object)
 
-  // [prototype_users]: FixedArrayOfWeakCells containing maps using this
-  // prototype, or Smi(0) if uninitialized.
+  // [prototype_users]: WeakArrayList containing weak references to maps using
+  // this prototype, or Smi(0) if uninitialized.
   DECL_ACCESSORS(prototype_users, Object)
 
   // [object_create_map]: A field caching the map for Object.create(prototype).
@@ -67,6 +68,42 @@ class PrototypeInfo : public Struct {
   DISALLOW_IMPLICIT_CONSTRUCTORS(PrototypeInfo);
 };
 
+// A growing array with an additional API for marking slots "empty". When adding
+// new elements, we reuse the empty slots instead of growing the array.
+class PrototypeUsers : public WeakArrayList {
+ public:
+  static Handle<WeakArrayList> Add(Isolate* isolate,
+                                   Handle<WeakArrayList> array,
+                                   Handle<Map> value, int* assigned_index);
+
+  static inline void MarkSlotEmpty(WeakArrayList* array, int index);
+
+  // The callback is called when a weak pointer to HeapObject "object" is moved
+  // from index "from_index" to index "to_index" during compaction. The callback
+  // must not cause GC.
+  typedef void (*CompactionCallback)(HeapObject* object, int from_index,
+                                     int to_index);
+  static WeakArrayList* Compact(Handle<WeakArrayList> array, Heap* heap,
+                                CompactionCallback callback);
+
+#ifdef VERIFY_HEAP
+  static void Verify(WeakArrayList* array);
+#endif  // VERIFY_HEAP
+
+  static const int kEmptySlotIndex = 0;
+  static const int kFirstIndex = 1;
+
+  static const int kNoEmptySlotsMarker = 0;
+
+ private:
+  static inline Smi* empty_slot_index(WeakArrayList* array);
+  static inline void set_empty_slot_index(WeakArrayList* array, int index);
+
+  static void IsSlotEmpty(WeakArrayList* array, int index);
+
+  DISALLOW_IMPLICIT_CONSTRUCTORS(PrototypeUsers);
+};
+
 }  // namespace internal
 }  // namespace v8
 
diff --git a/deps/v8/src/objects/regexp-match-info.h b/deps/v8/src/objects/regexp-match-info.h
index 24eb805f5a2e80..838c299bd2bde4 100644
--- a/deps/v8/src/objects/regexp-match-info.h
+++ b/deps/v8/src/objects/regexp-match-info.h
@@ -46,7 +46,7 @@ class V8_EXPORT_PRIVATE RegExpMatchInfo : NON_EXPORTED_BASE(public FixedArray) {
 
   // Reserves space for captures.
   static Handle<RegExpMatchInfo> ReserveCaptures(
-      Handle<RegExpMatchInfo> match_info, int capture_count);
+      Isolate* isolate, Handle<RegExpMatchInfo> match_info, int capture_count);
 
   DECL_CAST(RegExpMatchInfo)
 
diff --git a/deps/v8/src/objects/script.h b/deps/v8/src/objects/script.h
index 5537ecbf1f002d..46adcb2a8abd5e 100644
--- a/deps/v8/src/objects/script.h
+++ b/deps/v8/src/objects/script.h
@@ -15,8 +15,11 @@ namespace v8 {
 namespace internal {
 
 // Script describes a script which has been added to the VM.
-class Script : public Struct {
+class Script : public Struct, public NeverReadOnlySpaceObject {
  public:
+  using NeverReadOnlySpaceObject::GetHeap;
+  using NeverReadOnlySpaceObject::GetIsolate;
+
   // Script types.
   enum Type {
     TYPE_NATIVE = 0,
diff --git a/deps/v8/src/objects/shared-function-info-inl.h b/deps/v8/src/objects/shared-function-info-inl.h
index 415c9397be9378..892da7c5c58afd 100644
--- a/deps/v8/src/objects/shared-function-info-inl.h
+++ b/deps/v8/src/objects/shared-function-info-inl.h
@@ -55,6 +55,16 @@ void PreParsedScopeData::clear_padding() {
 CAST_ACCESSOR(UncompiledData)
 INT32_ACCESSORS(UncompiledData, start_position, kStartPositionOffset)
 INT32_ACCESSORS(UncompiledData, end_position, kEndPositionOffset)
+INT32_ACCESSORS(UncompiledData, function_literal_id, kFunctionLiteralIdOffset)
+
+void UncompiledData::clear_padding() {
+  // For archs where kIntSize < kPointerSize, there will be padding at the end
+  // of the data.
+  if (kUnalignedSize < kSize) {
+    memset(reinterpret_cast<void*>(address() + kUnalignedSize), 0,
+           kSize - kUnalignedSize);
+  }
+}
 
 CAST_ACCESSOR(UncompiledDataWithoutPreParsedScope)
 
@@ -77,7 +87,6 @@ ACCESSORS(SharedFunctionInfo, script, Object, kScriptOffset)
 ACCESSORS(SharedFunctionInfo, function_identifier_or_debug_info, Object,
           kFunctionIdentifierOrDebugInfoOffset)
 
-INT_ACCESSORS(SharedFunctionInfo, function_literal_id, kFunctionLiteralIdOffset)
 #if V8_SFI_HAS_UNIQUE_ID
 INT_ACCESSORS(SharedFunctionInfo, unique_id, kUniqueIdOffset)
 #endif
@@ -650,6 +659,21 @@ WasmExportedFunctionData* SharedFunctionInfo::wasm_exported_function_data()
   return WasmExportedFunctionData::cast(function_data());
 }
 
+int SharedFunctionInfo::FunctionLiteralId(Isolate* isolate) const {
+  // Fast path for the common case when the SFI is uncompiled and so the
+  // function literal id is already in the uncompiled data.
+  if (HasUncompiledData()) {
+    int id = uncompiled_data()->function_literal_id();
+    // Make sure the id is what we should have found with the slow path.
+    DCHECK_EQ(id, FindIndexInScript(isolate));
+    return id;
+  }
+
+  // Otherwise, search for the function in the SFI's script's function list,
+  // and return its index in that list.
+  return FindIndexInScript(isolate);
+}
+
 bool SharedFunctionInfo::HasDebugInfo() const {
   return function_identifier_or_debug_info()->IsDebugInfo();
 }
@@ -737,8 +761,11 @@ void SharedFunctionInfo::DiscardCompiled(
 
   int start_position = shared_info->StartPosition();
   int end_position = shared_info->EndPosition();
+  int function_literal_id = shared_info->FunctionLiteralId(isolate);
 
   if (shared_info->is_compiled()) {
+    DisallowHeapAllocation no_gc;
+
     HeapObject* outer_scope_info;
     if (shared_info->scope_info()->HasOuterScopeInfo()) {
       outer_scope_info = shared_info->scope_info()->OuterScopeInfo();
@@ -764,7 +791,7 @@ void SharedFunctionInfo::DiscardCompiled(
     // validity checks, since we're performing the unusual task of decompiling.
     Handle<UncompiledData> data =
         isolate->factory()->NewUncompiledDataWithoutPreParsedScope(
-            start_position, end_position);
+            start_position, end_position, function_literal_id);
     shared_info->set_function_data(*data);
   }
 }
diff --git a/deps/v8/src/objects/shared-function-info.h b/deps/v8/src/objects/shared-function-info.h
index 07b7cdad428c01..d49899f16f85d2 100644
--- a/deps/v8/src/objects/shared-function-info.h
+++ b/deps/v8/src/objects/shared-function-info.h
@@ -70,13 +70,15 @@ class UncompiledData : public HeapObject {
  public:
   DECL_INT32_ACCESSORS(start_position)
   DECL_INT32_ACCESSORS(end_position)
+  DECL_INT32_ACCESSORS(function_literal_id)
 
   DECL_CAST(UncompiledData)
 
-#define UNCOMPILED_DATA_FIELDS(V)     \
-  V(kStartPositionOffset, kInt32Size) \
-  V(kEndPositionOffset, kInt32Size)   \
-  /* Total size. */                   \
+#define UNCOMPILED_DATA_FIELDS(V)         \
+  V(kStartPositionOffset, kInt32Size)     \
+  V(kEndPositionOffset, kInt32Size)       \
+  V(kFunctionLiteralIdOffset, kInt32Size) \
+  /* Total size. */                       \
   V(kUnalignedSize, 0)
 
   DEFINE_FIELD_OFFSET_CONSTANTS(HeapObject::kHeaderSize, UNCOMPILED_DATA_FIELDS)
@@ -84,6 +86,9 @@ class UncompiledData : public HeapObject {
 
   static const int kSize = POINTER_SIZE_ALIGN(kUnalignedSize);
 
+  // Clear uninitialized padding space.
+  inline void clear_padding();
+
  private:
   DISALLOW_IMPLICIT_CONSTRUCTORS(UncompiledData);
 };
@@ -118,16 +123,17 @@ class UncompiledDataWithPreParsedScope : public UncompiledData {
   V(kPreParsedScopeDataOffset, kPointerSize)            \
   V(kEndOfPointerFieldsOffset, 0)                       \
   /* Total size. */                                     \
-  V(kUnalignedSize, 0)
+  V(kSize, 0)
 
   DEFINE_FIELD_OFFSET_CONSTANTS(UncompiledData::kSize,
                                 UNCOMPILED_DATA_WITH_PRE_PARSED_SCOPE_FIELDS)
 #undef UNCOMPILED_DATA_WITH_PRE_PARSED_SCOPE_FIELDS
 
-  static const int kSize = POINTER_SIZE_ALIGN(kUnalignedSize);
+  // Make sure the size is aligned
+  STATIC_ASSERT(kSize == POINTER_SIZE_ALIGN(kSize));
 
   typedef FixedBodyDescriptor<kStartOfPointerFieldsOffset,
-                              kEndOfPointerFieldsOffset, kUnalignedSize>
+                              kEndOfPointerFieldsOffset, kSize>
       BodyDescriptor;
   // No weak fields.
   typedef BodyDescriptor BodyDescriptorWeak;
@@ -156,8 +162,11 @@ class InterpreterData : public Struct {
 
 // SharedFunctionInfo describes the JSFunction information that can be
 // shared by multiple instances of the function.
-class SharedFunctionInfo : public HeapObject {
+class SharedFunctionInfo : public HeapObject, public NeverReadOnlySpaceObject {
  public:
+  using NeverReadOnlySpaceObject::GetHeap;
+  using NeverReadOnlySpaceObject::GetIsolate;
+
   static constexpr Object* const kNoSharedNameSentinel = Smi::kZero;
 
   // [name]: Returns shared name if it exists or an empty string otherwise.
@@ -182,7 +191,7 @@ class SharedFunctionInfo : public HeapObject {
   // function info is added to the list on the script.
   V8_EXPORT_PRIVATE static void SetScript(
       Handle<SharedFunctionInfo> shared, Handle<Object> script_object,
-      bool reset_preparsed_scope_data = true);
+      int function_literal_id, bool reset_preparsed_scope_data = true);
 
   // Layout description of the optimized code map.
   static const int kEntriesStart = 0;
@@ -252,11 +261,6 @@ class SharedFunctionInfo : public HeapObject {
   // function. The value is only reliable when the function has been compiled.
   DECL_UINT16_ACCESSORS(expected_nof_properties)
 
-  // [function_literal_id] - uniquely identifies the FunctionLiteral this
-  // SharedFunctionInfo represents within its script, or -1 if this
-  // SharedFunctionInfo object doesn't correspond to a parsed FunctionLiteral.
-  DECL_INT_ACCESSORS(function_literal_id)
-
 #if V8_SFI_HAS_UNIQUE_ID
   // [unique_id] - For --trace-maps purposes, an identifier that's persistent
   // even if the GC moves this SharedFunctionInfo.
@@ -338,6 +342,9 @@ class SharedFunctionInfo : public HeapObject {
   inline String* inferred_name();
   inline void set_inferred_name(String* inferred_name);
 
+  // Get the function literal id associated with this function, for parsing.
+  inline int FunctionLiteralId(Isolate* isolate) const;
+
   // The function is subject to debugging if a debug info is attached.
   inline bool HasDebugInfo() const;
   inline DebugInfo* GetDebugInfo() const;
@@ -527,6 +534,7 @@ class SharedFunctionInfo : public HeapObject {
     ScriptIterator(Isolate* isolate,
                    Handle<WeakFixedArray> shared_function_infos);
     SharedFunctionInfo* Next();
+    int CurrentIndex() const { return index_ - 1; }
 
     // Reset the iterator to run on |script|.
     void Reset(Script* script);
@@ -579,7 +587,6 @@ class SharedFunctionInfo : public HeapObject {
   V(kFunctionIdentifierOrDebugInfoOffset, kPointerSize)    \
   V(kEndOfPointerFieldsOffset, 0)                          \
   /* Raw data fields. */                                   \
-  V(kFunctionLiteralIdOffset, kInt32Size)                  \
   V(kUniqueIdOffset, kUniqueIdFieldSize)                   \
   V(kLengthOffset, kUInt16Size)                            \
   V(kFormalParameterCountOffset, kUInt16Size)              \
@@ -596,7 +603,7 @@ class SharedFunctionInfo : public HeapObject {
   static const int kAlignedSize = POINTER_SIZE_ALIGN(kSize);
 
   typedef FixedBodyDescriptor<kStartOfPointerFieldsOffset,
-                              kEndOfPointerFieldsOffset, kSize>
+                              kEndOfPointerFieldsOffset, kAlignedSize>
       BodyDescriptor;
   // No weak fields.
   typedef BodyDescriptor BodyDescriptorWeak;
@@ -659,6 +666,10 @@ class SharedFunctionInfo : public HeapObject {
 
   inline uint16_t length() const;
 
+  // Find the index of this function in the parent script. Slow path of
+  // FunctionLiteralId.
+  int FindIndexInScript(Isolate* isolate) const;
+
   DISALLOW_IMPLICIT_CONSTRUCTORS(SharedFunctionInfo);
 };
 
diff --git a/deps/v8/src/objects/string-inl.h b/deps/v8/src/objects/string-inl.h
index 780b29de116c48..235bdcd8e7b3c3 100644
--- a/deps/v8/src/objects/string-inl.h
+++ b/deps/v8/src/objects/string-inl.h
@@ -195,7 +195,7 @@ Char FlatStringReader::Get(int index) {
 template <typename Char>
 class SequentialStringKey : public StringTableKey {
  public:
-  explicit SequentialStringKey(Vector<const Char> string, uint32_t seed)
+  explicit SequentialStringKey(Vector<const Char> string, uint64_t seed)
       : StringTableKey(StringHasher::HashSequentialString<Char>(
             string.start(), string.length(), seed)),
         string_(string) {}
@@ -205,7 +205,7 @@ class SequentialStringKey : public StringTableKey {
 
 class OneByteStringKey : public SequentialStringKey<uint8_t> {
  public:
-  OneByteStringKey(Vector<const uint8_t> str, uint32_t seed)
+  OneByteStringKey(Vector<const uint8_t> str, uint64_t seed)
       : SequentialStringKey<uint8_t>(str, seed) {}
 
   bool IsMatch(Object* string) override {
@@ -251,7 +251,7 @@ class SeqOneByteSubStringKey : public StringTableKey {
 
 class TwoByteStringKey : public SequentialStringKey<uc16> {
  public:
-  explicit TwoByteStringKey(Vector<const uc16> str, uint32_t seed)
+  explicit TwoByteStringKey(Vector<const uc16> str, uint64_t seed)
       : SequentialStringKey<uc16>(str, seed) {}
 
   bool IsMatch(Object* string) override {
@@ -264,7 +264,7 @@ class TwoByteStringKey : public SequentialStringKey<uc16> {
 // Utf8StringKey carries a vector of chars as key.
 class Utf8StringKey : public StringTableKey {
  public:
-  explicit Utf8StringKey(Vector<const char> string, uint32_t seed)
+  explicit Utf8StringKey(Vector<const char> string, uint64_t seed)
       : StringTableKey(StringHasher::ComputeUtf8Hash(string, seed, &chars_)),
         string_(string) {}
 
@@ -577,13 +577,6 @@ void ExternalOneByteString::update_data_cache() {
   *data_field = resource()->data();
 }
 
-void ExternalOneByteString::SetResource(
-    const ExternalOneByteString::Resource* resource) {
-  set_resource(resource);
-  size_t new_payload = resource == nullptr ? 0 : resource->length();
-  if (new_payload > 0) GetHeap()->UpdateExternalString(this, 0, new_payload);
-}
-
 void ExternalOneByteString::set_resource(
     const ExternalOneByteString::Resource* resource) {
   DCHECK(IsAligned(reinterpret_cast<intptr_t>(resource), kPointerSize));
@@ -612,13 +605,6 @@ void ExternalTwoByteString::update_data_cache() {
   *data_field = resource()->data();
 }
 
-void ExternalTwoByteString::SetResource(
-    const ExternalTwoByteString::Resource* resource) {
-  set_resource(resource);
-  size_t new_payload = resource == nullptr ? 0 : resource->length() * 2;
-  if (new_payload > 0) GetHeap()->UpdateExternalString(this, 0, new_payload);
-}
-
 void ExternalTwoByteString::set_resource(
     const ExternalTwoByteString::Resource* resource) {
   *reinterpret_cast<const Resource**>(FIELD_ADDR(this, kResourceOffset)) =
diff --git a/deps/v8/src/objects/string-table.h b/deps/v8/src/objects/string-table.h
index dd68700ce0dc19..8003bf1aac6643 100644
--- a/deps/v8/src/objects/string-table.h
+++ b/deps/v8/src/objects/string-table.h
@@ -107,7 +107,7 @@ class StringSet : public HashTable<StringSet, StringSetShape> {
   static Handle<StringSet> New(Isolate* isolate);
   static Handle<StringSet> Add(Isolate* isolate, Handle<StringSet> blacklist,
                                Handle<String> name);
-  bool Has(Handle<String> name);
+  bool Has(Isolate* isolate, Handle<String> name);
 
   DECL_CAST(StringSet)
 };
diff --git a/deps/v8/src/objects/string.h b/deps/v8/src/objects/string.h
index 279650e5da1efb..ba036edee96386 100644
--- a/deps/v8/src/objects/string.h
+++ b/deps/v8/src/objects/string.h
@@ -751,11 +751,6 @@ class ExternalOneByteString : public ExternalString {
 
   // The underlying resource.
   inline const Resource* resource();
-
-  // It is assumed that the previous resource is null. If it is not null, then
-  // it is the responsability of the caller the handle the previous resource.
-  inline void SetResource(const Resource* buffer);
-  // Used only during serialization.
   inline void set_resource(const Resource* buffer);
 
   // Update the pointer cache to the external character array.
@@ -789,11 +784,6 @@ class ExternalTwoByteString : public ExternalString {
 
   // The underlying string resource.
   inline const Resource* resource();
-
-  // It is assumed that the previous resource is null. If it is not null, then
-  // it is the responsability of the caller the handle the previous resource.
-  inline void SetResource(const Resource* buffer);
-  // Used only during serialization.
   inline void set_resource(const Resource* buffer);
 
   // Update the pointer cache to the external character array.
diff --git a/deps/v8/src/objects/templates.h b/deps/v8/src/objects/templates.h
index f9f0056a113b02..6a229d847b7e19 100644
--- a/deps/v8/src/objects/templates.h
+++ b/deps/v8/src/objects/templates.h
@@ -13,8 +13,11 @@
 namespace v8 {
 namespace internal {
 
-class TemplateInfo : public Struct {
+class TemplateInfo : public Struct, public NeverReadOnlySpaceObject {
  public:
+  using NeverReadOnlySpaceObject::GetHeap;
+  using NeverReadOnlySpaceObject::GetIsolate;
+
   DECL_ACCESSORS(tag, Object)
   DECL_ACCESSORS(serial_number, Object)
   DECL_INT_ACCESSORS(number_of_properties)
diff --git a/deps/v8/src/parsing/parse-info.cc b/deps/v8/src/parsing/parse-info.cc
index 9ec37373e85d82..ee7e4b156988ec 100644
--- a/deps/v8/src/parsing/parse-info.cc
+++ b/deps/v8/src/parsing/parse-info.cc
@@ -68,7 +68,7 @@ ParseInfo::ParseInfo(Isolate* isolate, Handle<SharedFunctionInfo> shared)
   set_function_flags(shared->flags());
   set_start_position(shared->StartPosition());
   set_end_position(shared->EndPosition());
-  function_literal_id_ = shared->function_literal_id();
+  function_literal_id_ = shared->FunctionLiteralId(isolate);
   set_language_mode(shared->language_mode());
   set_asm_wasm_broken(shared->is_asm_wasm_broken());
 
diff --git a/deps/v8/src/parsing/parse-info.h b/deps/v8/src/parsing/parse-info.h
index 75ed6a3802d0e4..4abf3a1fb0dbfe 100644
--- a/deps/v8/src/parsing/parse-info.h
+++ b/deps/v8/src/parsing/parse-info.h
@@ -140,8 +140,8 @@ class V8_EXPORT_PRIVATE ParseInfo {
   uintptr_t stack_limit() const { return stack_limit_; }
   void set_stack_limit(uintptr_t stack_limit) { stack_limit_ = stack_limit; }
 
-  uint32_t hash_seed() const { return hash_seed_; }
-  void set_hash_seed(uint32_t hash_seed) { hash_seed_ = hash_seed; }
+  uint64_t hash_seed() const { return hash_seed_; }
+  void set_hash_seed(uint64_t hash_seed) { hash_seed_ = hash_seed; }
 
   int function_flags() const { return function_flags_; }
   void set_function_flags(int function_flags) {
@@ -258,7 +258,7 @@ class V8_EXPORT_PRIVATE ParseInfo {
   DeclarationScope* script_scope_;
   UnicodeCache* unicode_cache_;
   uintptr_t stack_limit_;
-  uint32_t hash_seed_;
+  uint64_t hash_seed_;
   // TODO(leszeks): Move any remaining flags used here either to the flags_
   // field or to other fields.
   int function_flags_;
diff --git a/deps/v8/src/parsing/parser-base.h b/deps/v8/src/parsing/parser-base.h
index 24bf610e8a3bc9..6f6cff8e20eeb0 100644
--- a/deps/v8/src/parsing/parser-base.h
+++ b/deps/v8/src/parsing/parser-base.h
@@ -3599,13 +3599,14 @@ template <typename Impl>
 typename ParserBase<Impl>::ExpressionT ParserBase<Impl>::ParseImportExpressions(
     bool* ok) {
   DCHECK(allow_harmony_dynamic_import());
+
+  classifier()->RecordPatternError(scanner()->peek_location(),
+                                   MessageTemplate::kUnexpectedToken,
+                                   Token::String(Token::IMPORT));
+
   Consume(Token::IMPORT);
   int pos = position();
   if (allow_harmony_import_meta() && peek() == Token::PERIOD) {
-    classifier()->RecordPatternError(
-        Scanner::Location(pos, scanner()->location().end_pos),
-        MessageTemplate::kInvalidDestructuringTarget);
-    ArrowFormalParametersUnexpectedToken();
     ExpectMetaProperty(Token::META, "import.meta", pos, CHECK_OK);
     if (!parsing_module_) {
       impl()->ReportMessageAt(scanner()->location(),
diff --git a/deps/v8/src/parsing/preparsed-scope-data.cc b/deps/v8/src/parsing/preparsed-scope-data.cc
index 0dab3f9ee1b5a1..f2457fed26967e 100644
--- a/deps/v8/src/parsing/preparsed-scope-data.cc
+++ b/deps/v8/src/parsing/preparsed-scope-data.cc
@@ -577,7 +577,7 @@ void ConsumedPreParsedScopeData::RestoreData(Scope* scope) {
   if (scope_data_->RemainingBytes() < kUint8Size) {
     // Temporary debugging code for detecting inconsistent data. Write debug
     // information on the stack, then crash.
-    data_->GetIsolate()->PushStackTraceAndDie();
+    isolate_->PushStackTraceAndDie();
   }
 
   // scope_type is stored only in debug mode.
diff --git a/deps/v8/src/pending-compilation-error-handler.cc b/deps/v8/src/pending-compilation-error-handler.cc
index 26da880b126b6a..50e1403626139c 100644
--- a/deps/v8/src/pending-compilation-error-handler.cc
+++ b/deps/v8/src/pending-compilation-error-handler.cc
@@ -117,19 +117,20 @@ void PendingCompilationErrorHandler::ThrowPendingError(Isolate* isolate,
   Handle<JSObject> jserror = Handle<JSObject>::cast(error);
 
   Handle<Name> key_start_pos = factory->error_start_pos_symbol();
-  JSObject::SetProperty(jserror, key_start_pos,
+  JSObject::SetProperty(isolate, jserror, key_start_pos,
                         handle(Smi::FromInt(location.start_pos()), isolate),
                         LanguageMode::kSloppy)
       .Check();
 
   Handle<Name> key_end_pos = factory->error_end_pos_symbol();
-  JSObject::SetProperty(jserror, key_end_pos,
+  JSObject::SetProperty(isolate, jserror, key_end_pos,
                         handle(Smi::FromInt(location.end_pos()), isolate),
                         LanguageMode::kSloppy)
       .Check();
 
   Handle<Name> key_script = factory->error_script_symbol();
-  JSObject::SetProperty(jserror, key_script, script, LanguageMode::kSloppy)
+  JSObject::SetProperty(isolate, jserror, key_script, script,
+                        LanguageMode::kSloppy)
       .Check();
 
   isolate->Throw(*error, &location);
diff --git a/deps/v8/src/perf-jit.cc b/deps/v8/src/perf-jit.cc
index 0a78ef9ab3e398..3aaa36bc12f4ec 100644
--- a/deps/v8/src/perf-jit.cc
+++ b/deps/v8/src/perf-jit.cc
@@ -164,7 +164,7 @@ void PerfJitLogger::CloseMarkerFile(void* marker_address) {
   munmap(marker_address, page_size);
 }
 
-PerfJitLogger::PerfJitLogger() {
+PerfJitLogger::PerfJitLogger(Isolate* isolate) : CodeEventLogger(isolate) {
   base::LockGuard<base::RecursiveMutex> guard_file(file_mutex_.Pointer());
 
   reference_count_++;
diff --git a/deps/v8/src/perf-jit.h b/deps/v8/src/perf-jit.h
index ef83e9423d1987..d08f4b91ab26ef 100644
--- a/deps/v8/src/perf-jit.h
+++ b/deps/v8/src/perf-jit.h
@@ -38,7 +38,7 @@ namespace internal {
 // Linux perf tool logging support
 class PerfJitLogger : public CodeEventLogger {
  public:
-  PerfJitLogger();
+  explicit PerfJitLogger(Isolate* isolate);
   virtual ~PerfJitLogger();
 
   void CodeMoveEvent(AbstractCode* from, Address to) override;
@@ -118,6 +118,8 @@ class PerfJitLogger : public CodeEventLogger {
 // PerfJitLogger is only implemented on Linux
 class PerfJitLogger : public CodeEventLogger {
  public:
+  explicit PerfJitLogger(Isolate* isolate) : CodeEventLogger(isolate) {}
+
   void CodeMoveEvent(AbstractCode* from, Address to) override {
     UNIMPLEMENTED();
   }
diff --git a/deps/v8/src/profiler/heap-profiler.cc b/deps/v8/src/profiler/heap-profiler.cc
index f930a77eb16561..e5aa7c554ed9ef 100644
--- a/deps/v8/src/profiler/heap-profiler.cc
+++ b/deps/v8/src/profiler/heap-profiler.cc
@@ -16,14 +16,14 @@ namespace internal {
 
 HeapProfiler::HeapProfiler(Heap* heap)
     : ids_(new HeapObjectsMap(heap)),
-      names_(new StringsStorage(heap->HashSeed())),
+      names_(new StringsStorage()),
       is_tracking_object_moves_(false) {}
 
 HeapProfiler::~HeapProfiler() = default;
 
 void HeapProfiler::DeleteAllSnapshots() {
   snapshots_.clear();
-  names_.reset(new StringsStorage(heap()->HashSeed()));
+  names_.reset(new StringsStorage());
 }
 
 
diff --git a/deps/v8/src/profiler/heap-snapshot-generator.cc b/deps/v8/src/profiler/heap-snapshot-generator.cc
index b51ea0de7e42ab..1c14b7f32e86fe 100644
--- a/deps/v8/src/profiler/heap-snapshot-generator.cc
+++ b/deps/v8/src/profiler/heap-snapshot-generator.cc
@@ -1172,9 +1172,6 @@ void V8HeapExplorer::ExtractMapReferences(int entry, Map* map) {
   TagObject(map->dependent_code(), "(dependent code)");
   SetInternalReference(map, entry, "dependent_code", map->dependent_code(),
                        Map::kDependentCodeOffset);
-  TagObject(map->weak_cell_cache(), "(weak cell)");
-  SetInternalReference(map, entry, "weak_cell_cache", map->weak_cell_cache(),
-                       Map::kWeakCellCacheOffset);
 }
 
 
diff --git a/deps/v8/src/profiler/profile-generator.cc b/deps/v8/src/profiler/profile-generator.cc
index 8e76d4108aae4b..92619f2fbf3cf5 100644
--- a/deps/v8/src/profiler/profile-generator.cc
+++ b/deps/v8/src/profiler/profile-generator.cc
@@ -590,9 +590,7 @@ void CodeMap::Print() {
 }
 
 CpuProfilesCollection::CpuProfilesCollection(Isolate* isolate)
-    : resource_names_(isolate->heap()->HashSeed()),
-      profiler_(nullptr),
-      current_profiles_semaphore_(1) {}
+    : profiler_(nullptr), current_profiles_semaphore_(1) {}
 
 bool CpuProfilesCollection::StartProfiling(const char* title,
                                            bool record_samples,
diff --git a/deps/v8/src/profiler/profiler-listener.cc b/deps/v8/src/profiler/profiler-listener.cc
index 51327685059037..9c29da9ec7972a 100644
--- a/deps/v8/src/profiler/profiler-listener.cc
+++ b/deps/v8/src/profiler/profiler-listener.cc
@@ -17,9 +17,7 @@ namespace internal {
 
 ProfilerListener::ProfilerListener(Isolate* isolate,
                                    CodeEventObserver* observer)
-    : isolate_(isolate),
-      observer_(observer),
-      function_and_resource_names_(isolate->heap()->HashSeed()) {}
+    : isolate_(isolate), observer_(observer) {}
 
 ProfilerListener::~ProfilerListener() = default;
 
diff --git a/deps/v8/src/profiler/strings-storage.cc b/deps/v8/src/profiler/strings-storage.cc
index 44164792793a23..9a5a006ff4324b 100644
--- a/deps/v8/src/profiler/strings-storage.cc
+++ b/deps/v8/src/profiler/strings-storage.cc
@@ -17,8 +17,7 @@ bool StringsStorage::StringsMatch(void* key1, void* key2) {
          0;
 }
 
-StringsStorage::StringsStorage(uint32_t hash_seed)
-    : hash_seed_(hash_seed), names_(StringsMatch) {}
+StringsStorage::StringsStorage() : names_(StringsMatch) {}
 
 StringsStorage::~StringsStorage() {
   for (base::HashMap::Entry* p = names_.Start(); p != nullptr;
@@ -108,7 +107,7 @@ const char* StringsStorage::GetConsName(const char* prefix, Name* name) {
 }
 
 base::HashMap::Entry* StringsStorage::GetEntry(const char* str, int len) {
-  uint32_t hash = StringHasher::HashSequentialString(str, len, hash_seed_);
+  uint32_t hash = StringHasher::HashSequentialString(str, len, kZeroHashSeed);
   return names_.LookupOrInsert(const_cast<char*>(str), hash);
 }
 
diff --git a/deps/v8/src/profiler/strings-storage.h b/deps/v8/src/profiler/strings-storage.h
index ccd58f746eaf7f..5c0f8afd93056b 100644
--- a/deps/v8/src/profiler/strings-storage.h
+++ b/deps/v8/src/profiler/strings-storage.h
@@ -20,7 +20,7 @@ class Name;
 // forever, even if they disappear from JS heap or external storage.
 class V8_EXPORT_PRIVATE StringsStorage {
  public:
-  explicit StringsStorage(uint32_t hash_seed);
+  StringsStorage();
   ~StringsStorage();
 
   // Copies the given c-string and stores it, returning the stored copy, or just
@@ -45,7 +45,6 @@ class V8_EXPORT_PRIVATE StringsStorage {
   PRINTF_FORMAT(2, 0)
   const char* GetVFormatted(const char* format, va_list args);
 
-  uint32_t hash_seed_;
   base::CustomMatcherHashMap names_;
 
   DISALLOW_COPY_AND_ASSIGN(StringsStorage);
diff --git a/deps/v8/src/property.cc b/deps/v8/src/property.cc
index dfa5221bc47749..a930e5f6dec69f 100644
--- a/deps/v8/src/property.cc
+++ b/deps/v8/src/property.cc
@@ -22,12 +22,11 @@ std::ostream& operator<<(std::ostream& os,
   return os;
 }
 
-Descriptor Descriptor::DataField(Handle<Name> key, int field_index,
-                                 PropertyAttributes attributes,
+Descriptor Descriptor::DataField(Isolate* isolate, Handle<Name> key,
+                                 int field_index, PropertyAttributes attributes,
                                  Representation representation) {
   return DataField(key, field_index, attributes, PropertyConstness::kMutable,
-                   representation,
-                   MaybeObjectHandle(FieldType::Any(key->GetIsolate())));
+                   representation, MaybeObjectHandle(FieldType::Any(isolate)));
 }
 
 Descriptor Descriptor::DataField(Handle<Name> key, int field_index,
@@ -41,11 +40,11 @@ Descriptor Descriptor::DataField(Handle<Name> key, int field_index,
   return Descriptor(key, wrapped_field_type, details);
 }
 
-Descriptor Descriptor::DataConstant(Handle<Name> key, int field_index,
-                                    Handle<Object> value,
+Descriptor Descriptor::DataConstant(Isolate* isolate, Handle<Name> key,
+                                    int field_index, Handle<Object> value,
                                     PropertyAttributes attributes) {
   if (FLAG_track_constant_fields) {
-    MaybeObjectHandle any_type(FieldType::Any(), key->GetIsolate());
+    MaybeObjectHandle any_type(FieldType::Any(), isolate);
     return DataField(key, field_index, attributes, PropertyConstness::kConst,
                      Representation::Tagged(), any_type);
 
diff --git a/deps/v8/src/property.h b/deps/v8/src/property.h
index 41734914668b34..0319a3c32b3dcb 100644
--- a/deps/v8/src/property.h
+++ b/deps/v8/src/property.h
@@ -31,8 +31,8 @@ class Descriptor final BASE_EMBEDDED {
 
   void SetSortedKeyIndex(int index) { details_ = details_.set_pointer(index); }
 
-  static Descriptor DataField(Handle<Name> key, int field_index,
-                              PropertyAttributes attributes,
+  static Descriptor DataField(Isolate* isolate, Handle<Name> key,
+                              int field_index, PropertyAttributes attributes,
                               Representation representation);
 
   static Descriptor DataField(Handle<Name> key, int field_index,
@@ -48,8 +48,8 @@ class Descriptor final BASE_EMBEDDED {
                       value->OptimalRepresentation(), 0);
   }
 
-  static Descriptor DataConstant(Handle<Name> key, int field_index,
-                                 Handle<Object> value,
+  static Descriptor DataConstant(Isolate* isolate, Handle<Name> key,
+                                 int field_index, Handle<Object> value,
                                  PropertyAttributes attributes);
 
   static Descriptor AccessorConstant(Handle<Name> key, Handle<Object> foreign,
diff --git a/deps/v8/src/prototype.h b/deps/v8/src/prototype.h
index 1a0f196fb0476a..71ae1ff9f1fed0 100644
--- a/deps/v8/src/prototype.h
+++ b/deps/v8/src/prototype.h
@@ -51,9 +51,9 @@ class PrototypeIterator {
     if (where_to_start == kStartAtPrototype) Advance();
   }
 
-  explicit PrototypeIterator(Map* receiver_map,
+  explicit PrototypeIterator(Isolate* isolate, Map* receiver_map,
                              WhereToEnd where_to_end = END_AT_NULL)
-      : isolate_(receiver_map->GetIsolate()),
+      : isolate_(isolate),
         object_(receiver_map->GetPrototypeChainRootMap(isolate_)->prototype()),
         where_to_end_(where_to_end),
         is_at_end_(object_->IsNull(isolate_)),
@@ -65,9 +65,9 @@ class PrototypeIterator {
     }
   }
 
-  explicit PrototypeIterator(Handle<Map> receiver_map,
+  explicit PrototypeIterator(Isolate* isolate, Handle<Map> receiver_map,
                              WhereToEnd where_to_end = END_AT_NULL)
-      : isolate_(receiver_map->GetIsolate()),
+      : isolate_(isolate),
         object_(nullptr),
         handle_(receiver_map->GetPrototypeChainRootMap(isolate_)->prototype(),
                 isolate_),
diff --git a/deps/v8/src/regexp/jsregexp.cc b/deps/v8/src/regexp/jsregexp.cc
index 79e17351272324..3fdc3d98f5f70a 100644
--- a/deps/v8/src/regexp/jsregexp.cc
+++ b/deps/v8/src/regexp/jsregexp.cc
@@ -8,6 +8,7 @@
 #include <vector>
 
 #include "src/base/platform/platform.h"
+#include "src/code-tracer.h"
 #include "src/compilation-cache.h"
 #include "src/elements.h"
 #include "src/execution.h"
@@ -571,8 +572,8 @@ Handle<RegExpMatchInfo> RegExpImpl::SetLastMatchInfo(
   // here.
 
   int capture_register_count = (capture_count + 1) * 2;
-  Handle<RegExpMatchInfo> result =
-      RegExpMatchInfo::ReserveCaptures(last_match_info, capture_register_count);
+  Handle<RegExpMatchInfo> result = RegExpMatchInfo::ReserveCaptures(
+      isolate, last_match_info, capture_register_count);
   result->SetNumberOfCaptureRegisters(capture_register_count);
 
   if (*result != *last_match_info) {
diff --git a/deps/v8/src/regexp/regexp-utils.cc b/deps/v8/src/regexp/regexp-utils.cc
index 4b394b3e8d5bf6..1f89844f10352e 100644
--- a/deps/v8/src/regexp/regexp-utils.cc
+++ b/deps/v8/src/regexp/regexp-utils.cc
@@ -51,7 +51,8 @@ MaybeHandle<Object> RegExpUtils::SetLastIndex(Isolate* isolate,
     JSRegExp::cast(*recv)->set_last_index(*value_as_object, SKIP_WRITE_BARRIER);
     return recv;
   } else {
-    return Object::SetProperty(recv, isolate->factory()->lastIndex_string(),
+    return Object::SetProperty(isolate, recv,
+                               isolate->factory()->lastIndex_string(),
                                value_as_object, LanguageMode::kStrict);
   }
 }
@@ -61,7 +62,8 @@ MaybeHandle<Object> RegExpUtils::GetLastIndex(Isolate* isolate,
   if (HasInitialRegExpMap(isolate, recv)) {
     return handle(JSRegExp::cast(*recv)->last_index(), isolate);
   } else {
-    return Object::GetProperty(recv, isolate->factory()->lastIndex_string());
+    return Object::GetProperty(isolate, recv,
+                               isolate->factory()->lastIndex_string());
   }
 }
 
@@ -75,7 +77,8 @@ MaybeHandle<Object> RegExpUtils::RegExpExec(Isolate* isolate,
   if (exec->IsUndefined(isolate)) {
     ASSIGN_RETURN_ON_EXCEPTION(
         isolate, exec,
-        Object::GetProperty(regexp, isolate->factory()->exec_string()), Object);
+        Object::GetProperty(isolate, regexp, isolate->factory()->exec_string()),
+        Object);
   }
 
   if (exec->IsCallable()) {
@@ -188,7 +191,8 @@ MaybeHandle<Object> RegExpUtils::SetAdvancedStringIndex(
   Handle<Object> last_index_obj;
   ASSIGN_RETURN_ON_EXCEPTION(
       isolate, last_index_obj,
-      Object::GetProperty(regexp, isolate->factory()->lastIndex_string()),
+      Object::GetProperty(isolate, regexp,
+                          isolate->factory()->lastIndex_string()),
       Object);
 
   ASSIGN_RETURN_ON_EXCEPTION(isolate, last_index_obj,
diff --git a/deps/v8/src/roots-inl.h b/deps/v8/src/roots-inl.h
index ee5d69231cab5e..4caa9d8f0abf3b 100644
--- a/deps/v8/src/roots-inl.h
+++ b/deps/v8/src/roots-inl.h
@@ -83,6 +83,12 @@ STRUCT_LIST(STRUCT_MAP_ACCESSOR)
 ALLOCATION_SITE_LIST(ALLOCATION_SITE_MAP_ACCESSOR)
 #undef ALLOCATION_SITE_MAP_ACCESSOR
 
+FixedTypedArrayBase* ReadOnlyRoots::EmptyFixedTypedArrayForMap(const Map* map) {
+  // TODO(delphick): All of these empty fixed type arrays are in RO_SPACE so
+  // this the method below can be moved into ReadOnlyRoots.
+  return heap_->EmptyFixedTypedArrayForMap(map);
+}
+
 }  // namespace internal
 
 }  // namespace v8
diff --git a/deps/v8/src/roots.h b/deps/v8/src/roots.h
index 5818e3c3ac8b72..20e11317c5171b 100644
--- a/deps/v8/src/roots.h
+++ b/deps/v8/src/roots.h
@@ -254,6 +254,8 @@ namespace internal {
   V(Object, deserialize_lazy_handler_wide, DeserializeLazyHandlerWide)       \
   V(Object, deserialize_lazy_handler_extra_wide,                             \
     DeserializeLazyHandlerExtraWide)                                         \
+  /* Hash seed */                                                            \
+  V(ByteArray, hash_seed, HashSeed)                                          \
   /* JS Entries */                                                           \
   V(Code, js_entry_code, JsEntryCode)                                        \
   V(Code, js_construct_entry_code, JsConstructEntryCode)                     \
@@ -269,7 +271,6 @@ namespace internal {
   V(Smi, real_stack_limit, RealStackLimit)                                     \
   V(Smi, last_script_id, LastScriptId)                                         \
   V(Smi, last_debugging_id, LastDebuggingId)                                   \
-  V(Smi, hash_seed, HashSeed)                                                  \
   /* To distinguish the function templates, so that we can find them in the */ \
   /* function cache of the native context. */                                  \
   V(Smi, next_template_serial_number, NextTemplateSerialNumber)                \
@@ -289,6 +290,7 @@ namespace internal {
   MUTABLE_ROOT_LIST(V) \
   STRONG_READ_ONLY_ROOT_LIST(V)
 
+class FixedTypedArrayBase;
 class Heap;
 class Isolate;
 class Map;
@@ -338,6 +340,8 @@ class ReadOnlyRoots {
   ALLOCATION_SITE_LIST(ALLOCATION_SITE_MAP_ACCESSOR)
 #undef ALLOCATION_SITE_MAP_ACCESSOR
 
+  inline FixedTypedArrayBase* EmptyFixedTypedArrayForMap(const Map* map);
+
  private:
   Heap* heap_;
 };
diff --git a/deps/v8/src/runtime/runtime-array.cc b/deps/v8/src/runtime/runtime-array.cc
index 63b3d9004cba9d..ae23c99910b4d5 100644
--- a/deps/v8/src/runtime/runtime-array.cc
+++ b/deps/v8/src/runtime/runtime-array.cc
@@ -744,7 +744,8 @@ RUNTIME_FUNCTION(Runtime_ArrayIncludes_Slow) {
       Handle<Object> len_;
       ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
           isolate, len_,
-          Object::GetProperty(object, isolate->factory()->length_string()));
+          Object::GetProperty(isolate, object,
+                              isolate->factory()->length_string()));
 
       ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, len_,
                                          Object::ToLength(isolate, len_));
@@ -845,7 +846,8 @@ RUNTIME_FUNCTION(Runtime_ArrayIndexOf) {
       Handle<Object> len_;
       ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
           isolate, len_,
-          Object::GetProperty(object, isolate->factory()->length_string()));
+          Object::GetProperty(isolate, object,
+                              isolate->factory()->length_string()));
 
       ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, len_,
                                          Object::ToLength(isolate, len_));
diff --git a/deps/v8/src/runtime/runtime-classes.cc b/deps/v8/src/runtime/runtime-classes.cc
index 31f9fed96b07ca..6a83087a532fa4 100644
--- a/deps/v8/src/runtime/runtime-classes.cc
+++ b/deps/v8/src/runtime/runtime-classes.cc
@@ -213,7 +213,7 @@ Handle<Dictionary> ShallowCopyDictionaryTemplate(
     Object* value = dictionary->ValueAt(i);
     if (value->IsAccessorPair()) {
       Handle<AccessorPair> pair(AccessorPair::cast(value), isolate);
-      pair = AccessorPair::Copy(pair);
+      pair = AccessorPair::Copy(isolate, pair);
       dictionary->ValueAtPut(i, *pair);
     }
   }
@@ -298,8 +298,8 @@ bool AddDescriptorsByTemplate(
   for (int i = 0; i < nof_descriptors; i++) {
     Object* value = descriptors_template->GetStrongValue(i);
     if (value->IsAccessorPair()) {
-      Handle<AccessorPair> pair =
-          AccessorPair::Copy(handle(AccessorPair::cast(value), isolate));
+      Handle<AccessorPair> pair = AccessorPair::Copy(
+          isolate, handle(AccessorPair::cast(value), isolate));
       value = *pair;
     }
     DisallowHeapAllocation no_gc;
@@ -410,7 +410,7 @@ bool AddDescriptorsByTemplate(
         static_cast<PropertyAttributes>(DONT_ENUM | READ_ONLY);
     PropertyDetails details(kAccessor, attribs, PropertyCellType::kNoCell);
     Handle<NameDictionary> dict = NameDictionary::Add(
-        properties_dictionary, isolate->factory()->name_string(),
+        isolate, properties_dictionary, isolate->factory()->name_string(),
         isolate->factory()->function_name_accessor(), details);
     CHECK_EQ(*dict, *properties_dictionary);
   }
diff --git a/deps/v8/src/runtime/runtime-function.cc b/deps/v8/src/runtime/runtime-function.cc
index 7199263e539613..1057dfa1776aae 100644
--- a/deps/v8/src/runtime/runtime-function.cc
+++ b/deps/v8/src/runtime/runtime-function.cc
@@ -114,16 +114,17 @@ RUNTIME_FUNCTION(Runtime_SetCode) {
   bool was_native = target_shared->native();
   target_shared->set_flags(source_shared->flags());
   target_shared->set_native(was_native);
-  target_shared->set_function_literal_id(source_shared->function_literal_id());
-
   target_shared->set_scope_info(source_shared->scope_info());
 
   Handle<Object> source_script(source_shared->script(), isolate);
+  int function_literal_id = source_shared->FunctionLiteralId(isolate);
   if (source_script->IsScript()) {
     SharedFunctionInfo::SetScript(source_shared,
-                                  isolate->factory()->undefined_value());
+                                  isolate->factory()->undefined_value(),
+                                  function_literal_id);
   }
-  SharedFunctionInfo::SetScript(target_shared, source_script);
+  SharedFunctionInfo::SetScript(target_shared, source_script,
+                                function_literal_id);
 
   // Set the code of the target function.
   target->set_code(source_shared->GetCode());
diff --git a/deps/v8/src/runtime/runtime-internal.cc b/deps/v8/src/runtime/runtime-internal.cc
index c5ad02efe3d510..310c20b1026cd2 100644
--- a/deps/v8/src/runtime/runtime-internal.cc
+++ b/deps/v8/src/runtime/runtime-internal.cc
@@ -559,7 +559,8 @@ RUNTIME_FUNCTION(Runtime_CreateAsyncFromSyncIterator) {
   Handle<Object> next;
   ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
       isolate, next,
-      Object::GetProperty(sync_iterator, isolate->factory()->next_string()));
+      Object::GetProperty(isolate, sync_iterator,
+                          isolate->factory()->next_string()));
 
   return *isolate->factory()->NewJSAsyncFromSyncIterator(
       Handle<JSReceiver>::cast(sync_iterator), next);
diff --git a/deps/v8/src/runtime/runtime-intl.cc b/deps/v8/src/runtime/runtime-intl.cc
index 98c89371d1df17..5d39074984ae2d 100644
--- a/deps/v8/src/runtime/runtime-intl.cc
+++ b/deps/v8/src/runtime/runtime-intl.cc
@@ -207,7 +207,8 @@ RUNTIME_FUNCTION(Runtime_MarkAsInitializedIntlObjectOfType) {
 #endif
 
   Handle<Symbol> marker = isolate->factory()->intl_initialized_marker_symbol();
-  JSObject::SetProperty(input, marker, type, LanguageMode::kStrict).Assert();
+  JSObject::SetProperty(isolate, input, marker, type, LanguageMode::kStrict)
+      .Assert();
 
   return ReadOnlyRoots(isolate).undefined_value();
 }
@@ -313,7 +314,7 @@ RUNTIME_FUNCTION(Runtime_InternalNumberFormat) {
 
   Handle<Object> number_obj;
   ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, number_obj,
-                                     Object::ToNumber(value));
+                                     Object::ToNumber(isolate, value));
 
   double number = number_obj->Number();
   RETURN_RESULT_OR_FAILURE(isolate, NumberFormat::FormatNumber(
diff --git a/deps/v8/src/runtime/runtime-literals.cc b/deps/v8/src/runtime/runtime-literals.cc
index 68d0eafd7c9b7a..6e17ba85d4a2dc 100644
--- a/deps/v8/src/runtime/runtime-literals.cc
+++ b/deps/v8/src/runtime/runtime-literals.cc
@@ -575,7 +575,8 @@ RUNTIME_FUNCTION(Runtime_CreateRegExpLiteral) {
   Handle<Object> boilerplate;
   if (!HasBoilerplate(isolate, literal_site)) {
     ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
-        isolate, boilerplate, JSRegExp::New(pattern, JSRegExp::Flags(flags)));
+        isolate, boilerplate,
+        JSRegExp::New(isolate, pattern, JSRegExp::Flags(flags)));
     if (IsUninitializedLiteralSite(*literal_site)) {
       PreInitializeLiteralSite(vector, literal_slot);
       return *boilerplate;
diff --git a/deps/v8/src/runtime/runtime-liveedit.cc b/deps/v8/src/runtime/runtime-liveedit.cc
deleted file mode 100644
index 03ec0e17c05b7b..00000000000000
--- a/deps/v8/src/runtime/runtime-liveedit.cc
+++ /dev/null
@@ -1,260 +0,0 @@
-// Copyright 2014 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "src/runtime/runtime-utils.h"
-
-#include "src/arguments.h"
-#include "src/debug/debug.h"
-#include "src/debug/debug-frames.h"
-#include "src/debug/liveedit.h"
-#include "src/frames-inl.h"
-#include "src/isolate-inl.h"
-#include "src/runtime/runtime.h"
-
-namespace v8 {
-namespace internal {
-
-// For a script finds all SharedFunctionInfo's in the heap that points
-// to this script. Returns JSArray of SharedFunctionInfo wrapped
-// in OpaqueReferences.
-RUNTIME_FUNCTION(Runtime_LiveEditFindSharedFunctionInfosForScript) {
-  HandleScope scope(isolate);
-  DCHECK_EQ(1, args.length());
-  CONVERT_ARG_CHECKED(JSValue, script_value, 0);
-
-  CHECK(script_value->value()->IsScript());
-  Handle<Script> script(Script::cast(script_value->value()), isolate);
-
-  std::vector<Handle<SharedFunctionInfo>> found;
-  Heap* heap = isolate->heap();
-  {
-    HeapIterator iterator(heap);
-    HeapObject* heap_obj;
-    while ((heap_obj = iterator.next()) != nullptr) {
-      if (!heap_obj->IsSharedFunctionInfo()) continue;
-      SharedFunctionInfo* shared = SharedFunctionInfo::cast(heap_obj);
-      if (shared->script() != *script) continue;
-      found.push_back(Handle<SharedFunctionInfo>(shared, isolate));
-    }
-  }
-
-  int found_size = static_cast<int>(found.size());
-  Handle<FixedArray> result = isolate->factory()->NewFixedArray(found_size);
-  for (int i = 0; i < found_size; ++i) {
-    Handle<SharedFunctionInfo> shared = found[i];
-    SharedInfoWrapper info_wrapper = SharedInfoWrapper::Create(isolate);
-    Handle<String> name(shared->Name(), isolate);
-    info_wrapper.SetProperties(name, shared->StartPosition(),
-                               shared->EndPosition(), shared);
-    result->set(i, *info_wrapper.GetJSArray());
-  }
-  return *isolate->factory()->NewJSArrayWithElements(result);
-}
-
-
-// For a script calculates compilation information about all its functions.
-// The script source is explicitly specified by the second argument.
-// The source of the actual script is not used, however it is important that
-// all generated code keeps references to this particular instance of script.
-// Returns a JSArray of compilation infos. The array is ordered so that
-// each function with all its descendant is always stored in a continues range
-// with the function itself going first. The root function is a script function.
-RUNTIME_FUNCTION(Runtime_LiveEditGatherCompileInfo) {
-  HandleScope scope(isolate);
-  DCHECK_EQ(2, args.length());
-  CONVERT_ARG_CHECKED(JSValue, script, 0);
-  CONVERT_ARG_HANDLE_CHECKED(String, source, 1);
-
-  CHECK(script->value()->IsScript());
-  Handle<Script> script_handle(Script::cast(script->value()), isolate);
-
-  RETURN_RESULT_OR_FAILURE(
-      isolate, LiveEdit::GatherCompileInfo(isolate, script_handle, source));
-}
-
-
-// Changes the source of the script to a new_source.
-// If old_script_name is provided (i.e. is a String), also creates a copy of
-// the script with its original source and sends notification to debugger.
-RUNTIME_FUNCTION(Runtime_LiveEditReplaceScript) {
-  HandleScope scope(isolate);
-  DCHECK_EQ(3, args.length());
-  CONVERT_ARG_CHECKED(JSValue, original_script_value, 0);
-  CONVERT_ARG_HANDLE_CHECKED(String, new_source, 1);
-  CONVERT_ARG_HANDLE_CHECKED(Object, old_script_name, 2);
-
-  CHECK(original_script_value->value()->IsScript());
-  Handle<Script> original_script(Script::cast(original_script_value->value()),
-                                 isolate);
-
-  Handle<Object> old_script = LiveEdit::ChangeScriptSource(
-      isolate, original_script, new_source, old_script_name);
-
-  if (old_script->IsScript()) {
-    Handle<Script> script_handle = Handle<Script>::cast(old_script);
-    return *Script::GetWrapper(script_handle);
-  } else {
-    return ReadOnlyRoots(isolate).null_value();
-  }
-}
-
-// Recreate the shared function infos array after changing the IDs of all
-// SharedFunctionInfos.
-RUNTIME_FUNCTION(Runtime_LiveEditFixupScript) {
-  HandleScope scope(isolate);
-  DCHECK_EQ(args.length(), 2);
-  CONVERT_ARG_CHECKED(JSValue, script_value, 0);
-  CONVERT_INT32_ARG_CHECKED(max_function_literal_id, 1);
-
-  CHECK(script_value->value()->IsScript());
-  Handle<Script> script(Script::cast(script_value->value()), isolate);
-
-  LiveEdit::FixupScript(isolate, script, max_function_literal_id);
-  return ReadOnlyRoots(isolate).undefined_value();
-}
-
-RUNTIME_FUNCTION(Runtime_LiveEditFunctionSourceUpdated) {
-  HandleScope scope(isolate);
-  DCHECK_EQ(args.length(), 2);
-  CONVERT_ARG_HANDLE_CHECKED(JSArray, shared_info, 0);
-  CONVERT_INT32_ARG_CHECKED(new_function_literal_id, 1);
-  CHECK(SharedInfoWrapper::IsInstance(shared_info));
-
-  LiveEdit::FunctionSourceUpdated(shared_info, new_function_literal_id);
-  return ReadOnlyRoots(isolate).undefined_value();
-}
-
-
-// Replaces code of SharedFunctionInfo with a new one.
-RUNTIME_FUNCTION(Runtime_LiveEditReplaceFunctionCode) {
-  HandleScope scope(isolate);
-  DCHECK_EQ(2, args.length());
-  CONVERT_ARG_HANDLE_CHECKED(JSArray, new_compile_info, 0);
-  CONVERT_ARG_HANDLE_CHECKED(JSArray, shared_info, 1);
-  CHECK(SharedInfoWrapper::IsInstance(shared_info));
-
-  LiveEdit::ReplaceFunctionCode(new_compile_info, shared_info);
-  return ReadOnlyRoots(isolate).undefined_value();
-}
-
-
-// Connects SharedFunctionInfo to another script.
-RUNTIME_FUNCTION(Runtime_LiveEditFunctionSetScript) {
-  HandleScope scope(isolate);
-  DCHECK_EQ(2, args.length());
-  CONVERT_ARG_HANDLE_CHECKED(Object, function_object, 0);
-  CONVERT_ARG_HANDLE_CHECKED(Object, script_object, 1);
-
-  if (function_object->IsJSValue()) {
-    Handle<JSValue> function_wrapper = Handle<JSValue>::cast(function_object);
-    if (script_object->IsJSValue()) {
-      CHECK(JSValue::cast(*script_object)->value()->IsScript());
-      Script* script = Script::cast(JSValue::cast(*script_object)->value());
-      script_object = Handle<Object>(script, isolate);
-    }
-    CHECK(function_wrapper->value()->IsSharedFunctionInfo());
-    LiveEdit::SetFunctionScript(function_wrapper, script_object);
-  } else {
-    // Just ignore this. We may not have a SharedFunctionInfo for some functions
-    // and we check it in this function.
-  }
-
-  return ReadOnlyRoots(isolate).undefined_value();
-}
-
-
-// In a code of a parent function replaces original function as embedded object
-// with a substitution one.
-RUNTIME_FUNCTION(Runtime_LiveEditReplaceRefToNestedFunction) {
-  HandleScope scope(isolate);
-  DCHECK_EQ(3, args.length());
-
-  CONVERT_ARG_HANDLE_CHECKED(JSValue, parent_wrapper, 0);
-  CONVERT_ARG_HANDLE_CHECKED(JSValue, orig_wrapper, 1);
-  CONVERT_ARG_HANDLE_CHECKED(JSValue, subst_wrapper, 2);
-  CHECK(parent_wrapper->value()->IsSharedFunctionInfo());
-  CHECK(orig_wrapper->value()->IsSharedFunctionInfo());
-  CHECK(subst_wrapper->value()->IsSharedFunctionInfo());
-
-  LiveEdit::ReplaceRefToNestedFunction(isolate->heap(), parent_wrapper,
-                                       orig_wrapper, subst_wrapper);
-  return ReadOnlyRoots(isolate).undefined_value();
-}
-
-
-// Updates positions of a shared function info (first parameter) according
-// to script source change. Text change is described in second parameter as
-// array of groups of 3 numbers:
-// (change_begin, change_end, change_end_new_position).
-// Each group describes a change in text; groups are sorted by change_begin.
-RUNTIME_FUNCTION(Runtime_LiveEditPatchFunctionPositions) {
-  HandleScope scope(isolate);
-  DCHECK_EQ(2, args.length());
-  CONVERT_ARG_HANDLE_CHECKED(JSArray, shared_array, 0);
-  CONVERT_ARG_HANDLE_CHECKED(JSArray, position_change_array, 1);
-  CHECK(SharedInfoWrapper::IsInstance(shared_array));
-
-  LiveEdit::PatchFunctionPositions(shared_array, position_change_array);
-  return ReadOnlyRoots(isolate).undefined_value();
-}
-
-
-// For array of SharedFunctionInfo's (each wrapped in JSValue)
-// checks that none of them have activations on stacks (of any thread).
-// Returns array of the same length with corresponding results of
-// LiveEdit::FunctionPatchabilityStatus type.
-RUNTIME_FUNCTION(Runtime_LiveEditCheckAndDropActivations) {
-  HandleScope scope(isolate);
-  DCHECK_EQ(3, args.length());
-  CONVERT_ARG_HANDLE_CHECKED(JSArray, old_shared_array, 0);
-  CONVERT_ARG_HANDLE_CHECKED(JSArray, new_shared_array, 1);
-  CONVERT_BOOLEAN_ARG_CHECKED(do_drop, 2);
-  USE(new_shared_array);
-  CHECK(old_shared_array->length()->IsSmi());
-  CHECK(new_shared_array->length() == old_shared_array->length());
-  CHECK(old_shared_array->HasFastElements());
-  CHECK(new_shared_array->HasFastElements());
-  int array_length = Smi::ToInt(old_shared_array->length());
-  for (int i = 0; i < array_length; i++) {
-    Handle<Object> old_element;
-    Handle<Object> new_element;
-    ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
-        isolate, old_element,
-        JSReceiver::GetElement(isolate, old_shared_array, i));
-    CHECK(old_element->IsJSValue() &&
-          Handle<JSValue>::cast(old_element)->value()->IsSharedFunctionInfo());
-    ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
-        isolate, new_element,
-        JSReceiver::GetElement(isolate, new_shared_array, i));
-    CHECK(
-        new_element->IsUndefined(isolate) ||
-        (new_element->IsJSValue() &&
-         Handle<JSValue>::cast(new_element)->value()->IsSharedFunctionInfo()));
-  }
-
-  return *LiveEdit::CheckAndDropActivations(old_shared_array, new_shared_array,
-                                            do_drop);
-}
-
-
-// Compares 2 strings line-by-line, then token-wise and returns diff in form
-// of JSArray of triplets (pos1, pos1_end, pos2_end) describing list
-// of diff chunks.
-RUNTIME_FUNCTION(Runtime_LiveEditCompareStrings) {
-  HandleScope scope(isolate);
-  DCHECK_EQ(2, args.length());
-  CONVERT_ARG_HANDLE_CHECKED(String, s1, 0);
-  CONVERT_ARG_HANDLE_CHECKED(String, s2, 1);
-
-  Handle<JSArray> result = LiveEdit::CompareStrings(isolate, s1, s2);
-  uint32_t array_length = 0;
-  CHECK(result->length()->ToArrayLength(&array_length));
-  if (array_length > 0) {
-    isolate->debug()->feature_tracker()->Track(DebugFeatureTracker::kLiveEdit);
-  }
-
-  return *result;
-}
-}  // namespace internal
-}  // namespace v8
diff --git a/deps/v8/src/runtime/runtime-numbers.cc b/deps/v8/src/runtime/runtime-numbers.cc
index 322586e51f1d2d..2eac95923f08ed 100644
--- a/deps/v8/src/runtime/runtime-numbers.cc
+++ b/deps/v8/src/runtime/runtime-numbers.cc
@@ -44,7 +44,8 @@ RUNTIME_FUNCTION(Runtime_StringParseInt) {
 
   // Convert {radix} to Int32.
   if (!radix->IsNumber()) {
-    ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, radix, Object::ToNumber(radix));
+    ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, radix,
+                                       Object::ToNumber(isolate, radix));
   }
   int radix32 = DoubleToInt32(radix->Number());
   if (radix32 != 0 && (radix32 < 2 || radix32 > 36)) {
diff --git a/deps/v8/src/runtime/runtime-object.cc b/deps/v8/src/runtime/runtime-object.cc
index f53d12cf349f8e..b3a8b18906cfb0 100644
--- a/deps/v8/src/runtime/runtime-object.cc
+++ b/deps/v8/src/runtime/runtime-object.cc
@@ -82,7 +82,7 @@ static MaybeHandle<Object> KeyedGetObjectProperty(Isolate* isolate,
         // Attempt dictionary lookup.
         GlobalDictionary* dictionary =
             JSGlobalObject::cast(*receiver)->global_dictionary();
-        int entry = dictionary->FindEntry(key);
+        int entry = dictionary->FindEntry(isolate, key);
         if (entry != GlobalDictionary::kNotFound) {
           PropertyCell* cell = dictionary->CellAt(entry);
           if (cell->property_details().kind() == kData) {
@@ -96,7 +96,7 @@ static MaybeHandle<Object> KeyedGetObjectProperty(Isolate* isolate,
       } else if (!receiver->HasFastProperties()) {
         // Attempt dictionary lookup.
         NameDictionary* dictionary = receiver->property_dictionary();
-        int entry = dictionary->FindEntry(key);
+        int entry = dictionary->FindEntry(isolate, key);
         if ((entry != NameDictionary::kNotFound) &&
             (dictionary->DetailsAt(entry).kind() == kData)) {
           Object* value = dictionary->ValueAt(entry);
@@ -198,7 +198,7 @@ bool DeleteObjectPropertyFast(Isolate* isolate, Handle<JSReceiver> receiver,
   // that depends on the assumption that no object that reached this map
   // transitions away from it without triggering the "deoptimize dependent
   // code" mechanism.
-  map->NotifyLeafMapLayoutChange();
+  map->NotifyLeafMapLayoutChange(isolate);
   // Finally, perform the map rollback.
   receiver->synchronized_set_map(Map::cast(backpointer));
 #if VERIFY_HEAP
@@ -393,7 +393,8 @@ RUNTIME_FUNCTION(Runtime_AddDictionaryProperty) {
 
   Handle<NameDictionary> dictionary(receiver->property_dictionary(), isolate);
   PropertyDetails property_details(kData, NONE, PropertyCellType::kNoCell);
-  dictionary = NameDictionary::Add(dictionary, name, value, property_details);
+  dictionary =
+      NameDictionary::Add(isolate, dictionary, name, value, property_details);
   receiver->SetProperties(*dictionary);
   return *value;
 }
@@ -1141,14 +1142,14 @@ RUNTIME_FUNCTION(Runtime_ToNumber) {
   HandleScope scope(isolate);
   DCHECK_EQ(1, args.length());
   CONVERT_ARG_HANDLE_CHECKED(Object, input, 0);
-  RETURN_RESULT_OR_FAILURE(isolate, Object::ToNumber(input));
+  RETURN_RESULT_OR_FAILURE(isolate, Object::ToNumber(isolate, input));
 }
 
 RUNTIME_FUNCTION(Runtime_ToNumeric) {
   HandleScope scope(isolate);
   DCHECK_EQ(1, args.length());
   CONVERT_ARG_HANDLE_CHECKED(Object, input, 0);
-  RETURN_RESULT_OR_FAILURE(isolate, Object::ToNumeric(input));
+  RETURN_RESULT_OR_FAILURE(isolate, Object::ToNumeric(isolate, input));
 }
 
 RUNTIME_FUNCTION(Runtime_ToInteger) {
diff --git a/deps/v8/src/runtime/runtime-regexp.cc b/deps/v8/src/runtime/runtime-regexp.cc
index 91a47bad0cebf4..f58a3dd6f791fe 100644
--- a/deps/v8/src/runtime/runtime-regexp.cc
+++ b/deps/v8/src/runtime/runtime-regexp.cc
@@ -1075,7 +1075,8 @@ class VectorBackedMatch : public String::Match {
 
     Handle<Object> capture_obj;
     ASSIGN_RETURN_ON_EXCEPTION(isolate_, capture_obj,
-                               Object::GetProperty(groups_obj_, name), String);
+                               Object::GetProperty(isolate_, groups_obj_, name),
+                               String);
     if (capture_obj->IsUndefined(isolate_)) {
       *state = UNMATCHED;
       return isolate_->factory()->empty_string();
@@ -1188,7 +1189,7 @@ static Object* SearchRegExpMultiple(Isolate* isolate, Handle<String> subject,
     int32_t* current_match = global_cache.FetchNext();
     if (current_match == nullptr) break;
     match_start = current_match[0];
-    builder.EnsureCapacity(kMaxBuilderEntriesPerRegExpMatch);
+    builder.EnsureCapacity(isolate, kMaxBuilderEntriesPerRegExpMatch);
     if (match_end < match_start) {
       ReplacementStringBuilder::AddSubjectSlice(&builder, match_end,
                                                 match_start);
@@ -1549,7 +1550,8 @@ V8_WARN_UNUSED_RESULT MaybeHandle<Object> ToUint32(Isolate* isolate,
   }
 
   Handle<Object> number;
-  ASSIGN_RETURN_ON_EXCEPTION(isolate, number, Object::ToNumber(object), Object);
+  ASSIGN_RETURN_ON_EXCEPTION(isolate, number, Object::ToNumber(isolate, object),
+                             Object);
   *out = NumberToUint32(*number);
   return object;
 }
@@ -1690,7 +1692,8 @@ RUNTIME_FUNCTION(Runtime_RegExpSplit) {
     Handle<Object> num_captures_obj;
     ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
         isolate, num_captures_obj,
-        Object::GetProperty(result, isolate->factory()->length_string()));
+        Object::GetProperty(isolate, result,
+                            isolate->factory()->length_string()));
 
     ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
         isolate, num_captures_obj, Object::ToLength(isolate, num_captures_obj));
@@ -1804,7 +1807,7 @@ RUNTIME_FUNCTION(Runtime_RegExpReplace) {
     Handle<Object> captures_length_obj;
     ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
         isolate, captures_length_obj,
-        Object::GetProperty(result, factory->length_string()));
+        Object::GetProperty(isolate, result, factory->length_string()));
 
     ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
         isolate, captures_length_obj,
@@ -1825,7 +1828,7 @@ RUNTIME_FUNCTION(Runtime_RegExpReplace) {
     Handle<Object> position_obj;
     ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
         isolate, position_obj,
-        Object::GetProperty(result, factory->index_string()));
+        Object::GetProperty(isolate, result, factory->index_string()));
 
     ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
         isolate, position_obj, Object::ToInteger(isolate, position_obj));
@@ -1850,7 +1853,7 @@ RUNTIME_FUNCTION(Runtime_RegExpReplace) {
     Handle<Object> groups_obj = isolate->factory()->undefined_value();
     ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
         isolate, groups_obj,
-        Object::GetProperty(result, factory->groups_string()));
+        Object::GetProperty(isolate, result, factory->groups_string()));
 
     const bool has_named_captures = !groups_obj->IsUndefined(isolate);
 
diff --git a/deps/v8/src/runtime/runtime-scopes.cc b/deps/v8/src/runtime/runtime-scopes.cc
index 8e323b18d56c7b..93a062978359ce 100644
--- a/deps/v8/src/runtime/runtime-scopes.cc
+++ b/deps/v8/src/runtime/runtime-scopes.cc
@@ -52,7 +52,7 @@ Object* DeclareGlobal(
   Handle<ScriptContextTable> script_contexts(
       global->native_context()->script_context_table(), isolate);
   ScriptContextTable::LookupResult lookup;
-  if (ScriptContextTable::Lookup(script_contexts, name, &lookup) &&
+  if (ScriptContextTable::Lookup(isolate, script_contexts, name, &lookup) &&
       IsLexicalVariableMode(lookup.mode)) {
     // ES#sec-globaldeclarationinstantiation 6.a:
     // If envRec.HasLexicalDeclaration(name) is true, throw a SyntaxError
@@ -634,7 +634,7 @@ static Object* FindNameClash(Isolate* isolate, Handle<ScopeInfo> scope_info,
     Handle<String> name(scope_info->ContextLocalName(var), isolate);
     VariableMode mode = scope_info->ContextLocalMode(var);
     ScriptContextTable::LookupResult lookup;
-    if (ScriptContextTable::Lookup(script_context, name, &lookup)) {
+    if (ScriptContextTable::Lookup(isolate, script_context, name, &lookup)) {
       if (IsLexicalVariableMode(mode) || IsLexicalVariableMode(lookup.mode)) {
         // ES#sec-globaldeclarationinstantiation 5.b:
         // If envRec.HasLexicalDeclaration(name) is true, throw a SyntaxError
@@ -831,8 +831,7 @@ MaybeHandle<Object> LoadLookupSlot(Isolate* isolate, Handle<String> name,
     // GetProperty function.
     Handle<Object> value;
     ASSIGN_RETURN_ON_EXCEPTION(
-        isolate, value, Object::GetProperty(holder, name),
-        Object);
+        isolate, value, Object::GetProperty(isolate, holder, name), Object);
     if (receiver_return) {
       *receiver_return =
           (holder->IsJSGlobalObject() || holder->IsJSContextExtensionObject())
@@ -949,8 +948,8 @@ MaybeHandle<Object> StoreLookupSlot(
   }
 
   ASSIGN_RETURN_ON_EXCEPTION(
-      isolate, value, Object::SetProperty(object, name, value, language_mode),
-      Object);
+      isolate, value,
+      Object::SetProperty(isolate, object, name, value, language_mode), Object);
   return value;
 }
 
diff --git a/deps/v8/src/runtime/runtime-typedarray.cc b/deps/v8/src/runtime/runtime-typedarray.cc
index 929ce5772d17d0..d68bb06e82221c 100644
--- a/deps/v8/src/runtime/runtime-typedarray.cc
+++ b/deps/v8/src/runtime/runtime-typedarray.cc
@@ -175,7 +175,7 @@ RUNTIME_FUNCTION(Runtime_TypedArraySet) {
   Handle<Object> len;
   ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
       isolate, len,
-      Object::GetProperty(obj, isolate->factory()->length_string()));
+      Object::GetProperty(isolate, obj, isolate->factory()->length_string()));
   ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, len,
                                      Object::ToLength(isolate, len));
 
diff --git a/deps/v8/src/runtime/runtime-wasm.cc b/deps/v8/src/runtime/runtime-wasm.cc
index 43768f48fa98e1..55c549a6cfe2dd 100644
--- a/deps/v8/src/runtime/runtime-wasm.cc
+++ b/deps/v8/src/runtime/runtime-wasm.cc
@@ -126,7 +126,7 @@ RUNTIME_FUNCTION(Runtime_WasmThrowCreate) {
           MessageTemplate::kWasmExceptionError));
   isolate->set_wasm_caught_exception(*exception);
   CONVERT_ARG_HANDLE_CHECKED(Smi, id, 0);
-  CHECK(!JSReceiver::SetProperty(exception,
+  CHECK(!JSReceiver::SetProperty(isolate, exception,
                                  isolate->factory()->InternalizeUtf8String(
                                      wasm::WasmException::kRuntimeIdStr),
                                  id, LanguageMode::kStrict)
@@ -134,7 +134,7 @@ RUNTIME_FUNCTION(Runtime_WasmThrowCreate) {
   CONVERT_SMI_ARG_CHECKED(size, 1);
   Handle<JSTypedArray> values =
       isolate->factory()->NewJSTypedArray(ElementsKind::UINT16_ELEMENTS, size);
-  CHECK(!JSReceiver::SetProperty(exception,
+  CHECK(!JSReceiver::SetProperty(isolate, exception,
                                  isolate->factory()->InternalizeUtf8String(
                                      wasm::WasmException::kRuntimeValuesStr),
                                  values, LanguageMode::kStrict)
diff --git a/deps/v8/src/snapshot/code-serializer.cc b/deps/v8/src/snapshot/code-serializer.cc
index 8729547ef246b9..e91799cdadd4fa 100644
--- a/deps/v8/src/snapshot/code-serializer.cc
+++ b/deps/v8/src/snapshot/code-serializer.cc
@@ -276,7 +276,7 @@ MaybeHandle<SharedFunctionInfo> CodeSerializer::Deserialize(
     Isolate* isolate, ScriptData* cached_data, Handle<String> source,
     ScriptOriginOptions origin_options) {
   base::ElapsedTimer timer;
-  if (FLAG_profile_deserialization) timer.Start();
+  if (FLAG_profile_deserialization || FLAG_log_function_events) timer.Start();
 
   HandleScope scope(isolate);
 
@@ -311,15 +311,24 @@ MaybeHandle<SharedFunctionInfo> CodeSerializer::Deserialize(
     PrintF("[Deserializing from %d bytes took %0.3f ms]\n", length, ms);
   }
 
-  if (isolate->logger()->is_listening_to_code_events() ||
-      isolate->is_profiling()) {
+  bool log_code_creation = isolate->logger()->is_listening_to_code_events() ||
+                           isolate->is_profiling();
+  if (log_code_creation || FLAG_log_function_events) {
     String* name = ReadOnlyRoots(isolate).empty_string();
     if (result->script()->IsScript()) {
       Script* script = Script::cast(result->script());
       if (script->name()->IsString()) name = String::cast(script->name());
+      if (FLAG_log_function_events) {
+        LOG(isolate, FunctionEvent("deserialize", script->id(),
+                                   timer.Elapsed().InMillisecondsF(),
+                                   result->StartPosition(),
+                                   result->EndPosition(), name));
+      }
+    }
+    if (log_code_creation) {
+      PROFILE(isolate, CodeCreateEvent(CodeEventListener::SCRIPT_TAG,
+                                       result->abstract_code(), *result, name));
     }
-    PROFILE(isolate, CodeCreateEvent(CodeEventListener::SCRIPT_TAG,
-                                     result->abstract_code(), *result, name));
   }
 
   if (isolate->NeedsSourcePositionsForProfiling()) {
diff --git a/deps/v8/src/snapshot/deserializer.cc b/deps/v8/src/snapshot/deserializer.cc
index ee4a2d116e6b03..dcb37ce63c67ef 100644
--- a/deps/v8/src/snapshot/deserializer.cc
+++ b/deps/v8/src/snapshot/deserializer.cc
@@ -172,6 +172,7 @@ HeapObject* Deserializer<AllocatorT>::PostProcessNewObject(HeapObject* obj,
   } else if (obj->IsScript()) {
     LOG(isolate_, ScriptEvent(Logger::ScriptEventType::kDeserialize,
                               Script::cast(obj)->id()));
+    LOG(isolate_, ScriptDetails(Script::cast(obj)));
   }
 
   if (obj->IsAllocationSite()) {
@@ -206,7 +207,7 @@ HeapObject* Deserializer<AllocatorT>::PostProcessNewObject(HeapObject* obj,
     if (obj->map() == ReadOnlyRoots(isolate_).native_source_string_map()) {
       ExternalOneByteString* string = ExternalOneByteString::cast(obj);
       DCHECK(string->is_short());
-      string->SetResource(
+      string->set_resource(
           NativesExternalStringResource::DecodeForDeserialization(
               string->resource()));
     } else {
@@ -215,8 +216,6 @@ HeapObject* Deserializer<AllocatorT>::PostProcessNewObject(HeapObject* obj,
       Address address =
           static_cast<Address>(isolate_->api_external_references()[index]);
       string->set_address_as_resource(address);
-      isolate_->heap()->UpdateExternalString(string, 0,
-                                             string->ExternalPayloadSize());
     }
     isolate_->heap()->RegisterExternalString(String::cast(obj));
   } else if (obj->IsJSTypedArray()) {
diff --git a/deps/v8/src/snapshot/mksnapshot.cc b/deps/v8/src/snapshot/mksnapshot.cc
index 1cf0bfa9a5b4f1..9516108749f75b 100644
--- a/deps/v8/src/snapshot/mksnapshot.cc
+++ b/deps/v8/src/snapshot/mksnapshot.cc
@@ -393,8 +393,11 @@ int main(int argc, char** argv) {
         // Set code range such that relative jumps for builtins to
         // builtin calls in the snapshot are possible.
         i::Isolate* i_isolate = reinterpret_cast<i::Isolate*>(isolate);
-        size_t code_range_size = std::min(i::kMaximalCodeRangeSize / i::MB,
-                                          i::kMaxPCRelativeCodeRangeInMB);
+        size_t code_range_size =
+            i::kMaximalCodeRangeSize == 0
+                ? i::kMaxPCRelativeCodeRangeInMB
+                : std::min(i::kMaximalCodeRangeSize / i::MB,
+                           i::kMaxPCRelativeCodeRangeInMB);
         i_isolate->heap()->ConfigureHeap(0, 0, code_range_size);
       }
       v8::SnapshotCreator snapshot_creator(isolate);
diff --git a/deps/v8/src/snapshot/object-deserializer.cc b/deps/v8/src/snapshot/object-deserializer.cc
index 716b6f9729838d..2fb86867d0ca84 100644
--- a/deps/v8/src/snapshot/object-deserializer.cc
+++ b/deps/v8/src/snapshot/object-deserializer.cc
@@ -83,6 +83,7 @@ void ObjectDeserializer::CommitPostProcessedObjects() {
     script->set_id(isolate()->heap()->NextScriptId());
     LOG(isolate(),
         ScriptEvent(Logger::ScriptEventType::kDeserialize, script->id()));
+    LOG(isolate(), ScriptDetails(*script));
     // Add script to list.
     Handle<Object> list =
         FixedArrayOfWeakCells::Add(isolate(), factory->script_list(), script);
diff --git a/deps/v8/src/snapshot/serializer.h b/deps/v8/src/snapshot/serializer.h
index 21cca458855f9c..6a5d1a4aacae64 100644
--- a/deps/v8/src/snapshot/serializer.h
+++ b/deps/v8/src/snapshot/serializer.h
@@ -20,7 +20,7 @@ namespace internal {
 
 class CodeAddressMap : public CodeEventLogger {
  public:
-  explicit CodeAddressMap(Isolate* isolate) : isolate_(isolate) {
+  explicit CodeAddressMap(Isolate* isolate) : CodeEventLogger(isolate) {
     isolate->logger()->AddCodeEventListener(this);
   }
 
@@ -125,7 +125,6 @@ class CodeAddressMap : public CodeEventLogger {
   }
 
   NameMap address_to_name_map_;
-  Isolate* isolate_;
 };
 
 template <class AllocatorT = DefaultSerializerAllocator>
diff --git a/deps/v8/src/snapshot/startup-deserializer.cc b/deps/v8/src/snapshot/startup-deserializer.cc
index e19c67051b787d..8fbb0737037109 100644
--- a/deps/v8/src/snapshot/startup-deserializer.cc
+++ b/deps/v8/src/snapshot/startup-deserializer.cc
@@ -7,6 +7,7 @@
 #include "src/api.h"
 #include "src/assembler-inl.h"
 #include "src/code-stubs.h"
+#include "src/code-tracer.h"
 #include "src/heap/heap-inl.h"
 #include "src/snapshot/builtin-deserializer.h"
 #include "src/snapshot/snapshot.h"
diff --git a/deps/v8/src/snapshot/startup-serializer.cc b/deps/v8/src/snapshot/startup-serializer.cc
index 5434dc9d4721c4..34c23a607739d6 100644
--- a/deps/v8/src/snapshot/startup-serializer.cc
+++ b/deps/v8/src/snapshot/startup-serializer.cc
@@ -5,6 +5,7 @@
 #include "src/snapshot/startup-serializer.h"
 
 #include "src/api.h"
+#include "src/code-tracer.h"
 #include "src/global-handles.h"
 #include "src/objects-inl.h"
 #include "src/v8threads.h"
diff --git a/deps/v8/src/string-builder.h b/deps/v8/src/string-builder.h
index c1b232701d443a..aa11161620a715 100644
--- a/deps/v8/src/string-builder.h
+++ b/deps/v8/src/string-builder.h
@@ -138,7 +138,7 @@ class FixedArrayBuilder {
     return (length >= required_length);
   }
 
-  void EnsureCapacity(int elements) {
+  void EnsureCapacity(Isolate* isolate, int elements) {
     int length = array_->length();
     int required_length = length_ + elements;
     if (length < required_length) {
@@ -147,7 +147,7 @@ class FixedArrayBuilder {
         new_length *= 2;
       } while (new_length < required_length);
       Handle<FixedArray> extended_array =
-          array_->GetIsolate()->factory()->NewFixedArrayWithHoles(new_length);
+          isolate->factory()->NewFixedArrayWithHoles(new_length);
       array_->CopyTo(0, *extended_array, 0, length_);
       array_ = extended_array;
     }
@@ -218,9 +218,9 @@ class ReplacementStringBuilder {
     }
   }
 
-
-  void EnsureCapacity(int elements) { array_builder_.EnsureCapacity(elements); }
-
+  void EnsureCapacity(int elements) {
+    array_builder_.EnsureCapacity(heap_->isolate(), elements);
+  }
 
   void AddSubjectSlice(int from, int to) {
     AddSubjectSlice(&array_builder_, from, to);
diff --git a/deps/v8/src/string-hasher-inl.h b/deps/v8/src/string-hasher-inl.h
index c742c651642e2e..caf0e082bab474 100644
--- a/deps/v8/src/string-hasher-inl.h
+++ b/deps/v8/src/string-hasher-inl.h
@@ -12,9 +12,9 @@
 namespace v8 {
 namespace internal {
 
-StringHasher::StringHasher(int length, uint32_t seed)
+StringHasher::StringHasher(int length, uint64_t seed)
     : length_(length),
-      raw_running_hash_(seed),
+      raw_running_hash_(static_cast<uint32_t>(seed)),
       array_index_(0),
       is_array_index_(0 < length_ && length_ <= String::kMaxArrayIndexSize),
       is_first_char_(true) {
@@ -113,16 +113,16 @@ inline void StringHasher::AddCharacters(const Char* chars, int length) {
 
 template <typename schar>
 uint32_t StringHasher::HashSequentialString(const schar* chars, int length,
-                                            uint32_t seed) {
+                                            uint64_t seed) {
   StringHasher hasher(length, seed);
   if (!hasher.has_trivial_hash()) hasher.AddCharacters(chars, length);
   return hasher.GetHashField();
 }
 
-IteratingStringHasher::IteratingStringHasher(int len, uint32_t seed)
+IteratingStringHasher::IteratingStringHasher(int len, uint64_t seed)
     : StringHasher(len, seed) {}
 
-uint32_t IteratingStringHasher::Hash(String* string, uint32_t seed) {
+uint32_t IteratingStringHasher::Hash(String* string, uint64_t seed) {
   IteratingStringHasher hasher(string->length(), seed);
   // Nothing to do.
   if (hasher.has_trivial_hash()) return hasher.GetHashField();
diff --git a/deps/v8/src/string-hasher.h b/deps/v8/src/string-hasher.h
index b9f45972e7aa6f..68cff519c2bd20 100644
--- a/deps/v8/src/string-hasher.h
+++ b/deps/v8/src/string-hasher.h
@@ -18,14 +18,14 @@ class Vector;
 
 class V8_EXPORT_PRIVATE StringHasher {
  public:
-  explicit inline StringHasher(int length, uint32_t seed);
+  explicit inline StringHasher(int length, uint64_t seed);
 
   template <typename schar>
   static inline uint32_t HashSequentialString(const schar* chars, int length,
-                                              uint32_t seed);
+                                              uint64_t seed);
 
   // Reads all the data, even for long strings and computes the utf16 length.
-  static uint32_t ComputeUtf8Hash(Vector<const char> chars, uint32_t seed,
+  static uint32_t ComputeUtf8Hash(Vector<const char> chars, uint64_t seed,
                                   int* utf16_length_out);
 
   // Calculated hash value for a string consisting of 1 to
@@ -74,22 +74,22 @@ class V8_EXPORT_PRIVATE StringHasher {
 
 class IteratingStringHasher : public StringHasher {
  public:
-  static inline uint32_t Hash(String* string, uint32_t seed);
+  static inline uint32_t Hash(String* string, uint64_t seed);
   inline void VisitOneByteString(const uint8_t* chars, int length);
   inline void VisitTwoByteString(const uint16_t* chars, int length);
 
  private:
-  inline IteratingStringHasher(int len, uint32_t seed);
+  inline IteratingStringHasher(int len, uint64_t seed);
   void VisitConsString(ConsString* cons_string);
   DISALLOW_COPY_AND_ASSIGN(IteratingStringHasher);
 };
 
 // Useful for std containers that require something ()'able.
 struct SeededStringHasher {
-  explicit SeededStringHasher(uint32_t hashseed) : hashseed_(hashseed) {}
+  explicit SeededStringHasher(uint64_t hashseed) : hashseed_(hashseed) {}
   inline std::size_t operator()(const char* name) const;
 
-  uint32_t hashseed_;
+  uint64_t hashseed_;
 };
 
 // Useful for std containers that require something ()'able.
diff --git a/deps/v8/src/string-stream.cc b/deps/v8/src/string-stream.cc
index 272b2a354d3191..80e8b2837bec69 100644
--- a/deps/v8/src/string-stream.cc
+++ b/deps/v8/src/string-stream.cc
@@ -187,9 +187,10 @@ void StringStream::PrintObject(Object* o) {
     return;
   }
   if (o->IsHeapObject() && object_print_mode_ == kPrintObjectVerbose) {
-    HeapObject* ho = HeapObject::cast(o);
-    DebugObjectCache* debug_object_cache = ho->GetIsolate()->
-        string_stream_debug_object_cache();
+    // TODO(delphick): Consider whether we can get the isolate without using
+    // TLS.
+    DebugObjectCache* debug_object_cache =
+        Isolate::Current()->string_stream_debug_object_cache();
     for (size_t i = 0; i < debug_object_cache->size(); i++) {
       if ((*debug_object_cache)[i] == o) {
         Add("#%d#", static_cast<int>(i));
@@ -294,12 +295,6 @@ void StringStream::PrintName(Object* name) {
 
 void StringStream::PrintUsingMap(JSObject* js_object) {
   Map* map = js_object->map();
-  if (!js_object->GetHeap()->Contains(map) ||
-      !map->IsHeapObject() ||
-      !map->IsMap()) {
-    Add("<Invalid map>\n");
-    return;
-  }
   int real_size = map->NumberOfOwnDescriptors();
   DescriptorArray* descs = map->instance_descriptors();
   for (int i = 0; i < real_size; i++) {
@@ -335,10 +330,10 @@ void StringStream::PrintUsingMap(JSObject* js_object) {
 
 
 void StringStream::PrintFixedArray(FixedArray* array, unsigned int limit) {
-  Isolate* isolate = array->GetIsolate();
+  ReadOnlyRoots roots = array->GetReadOnlyRoots();
   for (unsigned int i = 0; i < 10 && i < limit; i++) {
     Object* element = array->get(i);
-    if (element->IsTheHole(isolate)) continue;
+    if (element->IsTheHole(roots)) continue;
     for (int len = 1; len < 18; len++) {
       Put(' ');
     }
@@ -406,77 +401,20 @@ void StringStream::PrintMentionedObjectCache(Isolate* isolate) {
   }
 }
 
-
-void StringStream::PrintSecurityTokenIfChanged(Object* f) {
-  if (!f->IsHeapObject()) return;
-  HeapObject* obj = HeapObject::cast(f);
-  Isolate* isolate = obj->GetIsolate();
-  Heap* heap = isolate->heap();
-  if (!heap->Contains(obj)) return;
-  Map* map = obj->map();
-  if (!map->IsHeapObject() ||
-      !heap->Contains(map) ||
-      !map->IsMap() ||
-      !f->IsJSFunction()) {
-    return;
-  }
-
-  JSFunction* fun = JSFunction::cast(f);
-  Object* perhaps_context = fun->context();
-  if (perhaps_context->IsHeapObject() &&
-      heap->Contains(HeapObject::cast(perhaps_context)) &&
-      perhaps_context->IsContext()) {
-    Context* context = fun->context();
-    if (!heap->Contains(context)) {
-      Add("(Function context is outside heap)\n");
-      return;
-    }
-    Object* token = context->native_context()->security_token();
-    if (token != isolate->string_stream_current_security_token()) {
-      Add("Security context: %o\n", token);
-      isolate->set_string_stream_current_security_token(token);
-    }
-  } else {
-    Add("(Function context is corrupt)\n");
+void StringStream::PrintSecurityTokenIfChanged(JSFunction* fun) {
+  Context* context = fun->context();
+  Object* token = context->native_context()->security_token();
+  Isolate* isolate = fun->GetIsolate();
+  if (token != isolate->string_stream_current_security_token()) {
+    Add("Security context: %o\n", token);
+    isolate->set_string_stream_current_security_token(token);
   }
 }
 
-
-void StringStream::PrintFunction(Object* f, Object* receiver, Code** code) {
-  if (!f->IsHeapObject()) {
-    Add("/* warning: 'function' was not a heap object */ ");
-    return;
-  }
-  Heap* heap = HeapObject::cast(f)->GetHeap();
-  if (!heap->Contains(HeapObject::cast(f))) {
-    Add("/* warning: 'function' was not on the heap */ ");
-    return;
-  }
-  if (!heap->Contains(HeapObject::cast(f)->map())) {
-    Add("/* warning: function's map was not on the heap */ ");
-    return;
-  }
-  if (!HeapObject::cast(f)->map()->IsMap()) {
-    Add("/* warning: function's map was not a valid map */ ");
-    return;
-  }
-  if (f->IsJSFunction()) {
-    JSFunction* fun = JSFunction::cast(f);
-    // Common case: on-stack function present and resolved.
-    PrintPrototype(fun, receiver);
-    *code = fun->code();
-  } else if (f->IsInternalizedString()) {
-    // Unresolved and megamorphic calls: Instead of the function
-    // we have the function name on the stack.
-    PrintName(f);
-    Add("/* unresolved */ ");
-  } else {
-    // Unless this is the frame of a built-in function, we should always have
-    // the callee function or name on the stack. If we don't, we have a
-    // problem or a change of the stack frame layout.
-    Add("%o", f);
-    Add("/* warning: no JSFunction object or function name found */ ");
-  }
+void StringStream::PrintFunction(JSFunction* fun, Object* receiver,
+                                 Code** code) {
+  PrintPrototype(fun, receiver);
+  *code = fun->code();
 }
 
 
diff --git a/deps/v8/src/string-stream.h b/deps/v8/src/string-stream.h
index c9be46f0465158..aa4edffab4e7c4 100644
--- a/deps/v8/src/string-stream.h
+++ b/deps/v8/src/string-stream.h
@@ -144,9 +144,9 @@ class StringStream final {
   void PrintByteArray(ByteArray* ba);
   void PrintUsingMap(JSObject* js_object);
   void PrintPrototype(JSFunction* fun, Object* receiver);
-  void PrintSecurityTokenIfChanged(Object* function);
+  void PrintSecurityTokenIfChanged(JSFunction* function);
   // NOTE: Returns the code in the output parameter.
-  void PrintFunction(Object* function, Object* receiver, Code** code);
+  void PrintFunction(JSFunction* function, Object* receiver, Code** code);
 
   // Reset the stream.
   void Reset() {
diff --git a/deps/v8/src/third_party/vtune/vtune-jit.cc b/deps/v8/src/third_party/vtune/vtune-jit.cc
index 57d84440178cfc..53fc289351c9e3 100644
--- a/deps/v8/src/third_party/vtune/vtune-jit.cc
+++ b/deps/v8/src/third_party/vtune/vtune-jit.cc
@@ -182,7 +182,8 @@ void VTUNEJITInterface::event_handler(const v8::JitCodeEvent* event) {
           if ((*script->GetScriptName())->IsString()) {
             Local<String> script_name =
                 Local<String>::Cast(script->GetScriptName());
-            temp_file_name = new char[script_name->Utf8Length() + 1];
+            temp_file_name =
+                new char[script_name->Utf8Length(event->isolate) + 1];
             script_name->WriteUtf8(temp_file_name);
             jmethod.source_file_name = temp_file_name;
           }
diff --git a/deps/v8/src/torque/Torque.g4 b/deps/v8/src/torque/Torque.g4
index 662f96dc382dbc..1497aaf9c1d0b9 100644
--- a/deps/v8/src/torque/Torque.g4
+++ b/deps/v8/src/torque/Torque.g4
@@ -31,6 +31,7 @@ TAIL: 'tail';
 ISNT: 'isnt';
 IS: 'is';
 LET: 'let';
+CONST: 'const';
 EXTERN: 'extern';
 ASSERT_TOKEN: 'assert';
 CHECK_TOKEN: 'check';
@@ -189,9 +190,11 @@ unaryExpression
         | op=(PLUS | MINUS | BIT_NOT | NOT) unaryExpression;
 
 locationExpression
-        : IDENTIFIER genericSpecializationTypeList?
+        : IDENTIFIER
         | locationExpression '.' IDENTIFIER
-        | locationExpression '[' expression ']';
+        | primaryExpression '.' IDENTIFIER
+        | locationExpression '[' expression ']'
+        | primaryExpression '[' expression ']';
 
 incrementDecrement
         : INCREMENT locationExpression
@@ -205,14 +208,24 @@ assignment
         | locationExpression ((ASSIGNMENT | ASSIGNMENT_OPERATOR) expression)?;
 
 assignmentExpression
-        : primaryExpression
+        : functionPointerExpression
         | assignment;
 
+structExpression
+        : IDENTIFIER '{' (expression (',' expression)*)? '}';
+
+functionPointerExpression
+        : primaryExpression
+        | IDENTIFIER genericSpecializationTypeList?
+        ;
+
 primaryExpression
         : helperCall
+        | structExpression
         | DECIMAL_LITERAL
         | STRING_LITERAL
-        | ('(' expression ')');
+        | ('(' expression ')')
+        ;
 
 forInitialization : variableDeclarationWithInitialization?;
 forLoop: FOR '(' forInitialization ';' expression ';' assignment ')' statementBlock;
@@ -227,7 +240,7 @@ argumentList: '(' argument? (',' argument)* ')';
 helperCall: (MIN | MAX | IDENTIFIER) genericSpecializationTypeList? argumentList optionalOtherwise;
 
 labelReference: IDENTIFIER;
-variableDeclaration: LET IDENTIFIER ':' type;
+variableDeclaration: (LET | CONST) IDENTIFIER ':' type;
 variableDeclarationWithInitialization: variableDeclaration (ASSIGNMENT expression)?;
 helperCallStatement: (TAIL)? helperCall;
 expressionStatement: assignment;
@@ -265,6 +278,9 @@ statementBlock
 
 helperBody : statementScope;
 
+fieldDeclaration: IDENTIFIER ':' type ';';
+fieldListDeclaration: fieldDeclaration*;
+
 extendsDeclaration: 'extends' IDENTIFIER;
 generatesDeclaration: 'generates' STRING_LITERAL;
 constexprDeclaration: 'constexpr' STRING_LITERAL;
@@ -277,10 +293,13 @@ externalRuntime : EXTERN RUNTIME IDENTIFIER typeListMaybeVarArgs optionalType ';
 builtinDeclaration : JAVASCRIPT? BUILTIN IDENTIFIER optionalGenericTypeList parameterList optionalType (helperBody | ';');
 genericSpecialization: IDENTIFIER genericSpecializationTypeList parameterList optionalType optionalLabelList helperBody;
 macroDeclaration : ('operator' STRING_LITERAL)? MACRO IDENTIFIER optionalGenericTypeList parameterList optionalType optionalLabelList (helperBody | ';');
-externConstDeclaration : 'const' IDENTIFIER ':' type generatesDeclaration ';';
+externConstDeclaration : CONST IDENTIFIER ':' type generatesDeclaration ';';
+constDeclaration: CONST IDENTIFIER ':' type ASSIGNMENT expression ';';
+structDeclaration : 'struct' IDENTIFIER '{' fieldListDeclaration '}';
 
 declaration
-        : typeDeclaration
+        : structDeclaration
+        | typeDeclaration
         | typeAliasDeclaration
         | builtinDeclaration
         | genericSpecialization
@@ -288,7 +307,8 @@ declaration
         | externalMacro
         | externalBuiltin
         | externalRuntime
-        | externConstDeclaration;
+        | externConstDeclaration
+        | constDeclaration;
 
 moduleDeclaration : MODULE IDENTIFIER '{' declaration* '}';
 
diff --git a/deps/v8/src/torque/Torque.interp b/deps/v8/src/torque/Torque.interp
new file mode 100644
index 00000000000000..0ffb78795f6578
--- /dev/null
+++ b/deps/v8/src/torque/Torque.interp
@@ -0,0 +1,249 @@
+token literal names:
+null
+'('
+')'
+'=>'
+','
+':'
+'type'
+'?'
+'||'
+'&&'
+'.'
+'['
+']'
+'{'
+'}'
+';'
+'of'
+'else'
+'extends'
+'generates'
+'operator'
+'struct'
+'macro'
+'builtin'
+'runtime'
+'module'
+'javascript'
+'deferred'
+'if'
+'for'
+'while'
+'return'
+'constexpr'
+'continue'
+'break'
+'goto'
+'otherwise'
+'try'
+'label'
+'labels'
+'tail'
+'isnt'
+'is'
+'let'
+'const'
+'extern'
+'assert'
+'check'
+'unreachable'
+'debug'
+'='
+null
+'=='
+'+'
+'-'
+'*'
+'/'
+'%'
+'|'
+'&'
+'~'
+'max'
+'min'
+'!='
+'<'
+'<='
+'>'
+'>='
+'<<'
+'>>'
+'>>>'
+'...'
+null
+'++'
+'--'
+'!'
+null
+null
+null
+null
+null
+null
+
+token symbolic names:
+null
+null
+null
+null
+null
+null
+null
+null
+null
+null
+null
+null
+null
+null
+null
+null
+null
+null
+null
+null
+null
+null
+MACRO
+BUILTIN
+RUNTIME
+MODULE
+JAVASCRIPT
+DEFERRED
+IF
+FOR
+WHILE
+RETURN
+CONSTEXPR
+CONTINUE
+BREAK
+GOTO
+OTHERWISE
+TRY
+LABEL
+LABELS
+TAIL
+ISNT
+IS
+LET
+CONST
+EXTERN
+ASSERT_TOKEN
+CHECK_TOKEN
+UNREACHABLE_TOKEN
+DEBUG_TOKEN
+ASSIGNMENT
+ASSIGNMENT_OPERATOR
+EQUAL
+PLUS
+MINUS
+MULTIPLY
+DIVIDE
+MODULO
+BIT_OR
+BIT_AND
+BIT_NOT
+MAX
+MIN
+NOT_EQUAL
+LESS_THAN
+LESS_THAN_EQUAL
+GREATER_THAN
+GREATER_THAN_EQUAL
+SHIFT_LEFT
+SHIFT_RIGHT
+SHIFT_RIGHT_ARITHMETIC
+VARARGS
+EQUALITY_OPERATOR
+INCREMENT
+DECREMENT
+NOT
+STRING_LITERAL
+IDENTIFIER
+WS
+BLOCK_COMMENT
+LINE_COMMENT
+DECIMAL_LITERAL
+
+rule names:
+type
+typeList
+genericSpecializationTypeList
+optionalGenericTypeList
+typeListMaybeVarArgs
+labelParameter
+optionalType
+optionalLabelList
+optionalOtherwise
+parameter
+parameterList
+labelDeclaration
+expression
+conditionalExpression
+logicalORExpression
+logicalANDExpression
+bitwiseExpression
+equalityExpression
+relationalExpression
+shiftExpression
+additiveExpression
+multiplicativeExpression
+unaryExpression
+locationExpression
+incrementDecrement
+assignment
+assignmentExpression
+structExpression
+functionPointerExpression
+primaryExpression
+forInitialization
+forLoop
+rangeSpecifier
+forOfRange
+forOfLoop
+argument
+argumentList
+helperCall
+labelReference
+variableDeclaration
+variableDeclarationWithInitialization
+helperCallStatement
+expressionStatement
+ifStatement
+whileLoop
+returnStatement
+breakStatement
+continueStatement
+gotoStatement
+handlerWithStatement
+tryLabelStatement
+diagnosticStatement
+statement
+statementList
+statementScope
+statementBlock
+helperBody
+fieldDeclaration
+fieldListDeclaration
+extendsDeclaration
+generatesDeclaration
+constexprDeclaration
+typeDeclaration
+typeAliasDeclaration
+externalBuiltin
+externalMacro
+externalRuntime
+builtinDeclaration
+genericSpecialization
+macroDeclaration
+externConstDeclaration
+constDeclaration
+structDeclaration
+declaration
+moduleDeclaration
+file
+
+
+atn:
+[3, 24715, 42794, 33075, 47597, 16764, 15335, 30598, 22884, 3, 83, 821, 4, 2, 9, 2, 4, 3, 9, 3, 4, 4, 9, 4, 4, 5, 9, 5, 4, 6, 9, 6, 4, 7, 9, 7, 4, 8, 9, 8, 4, 9, 9, 9, 4, 10, 9, 10, 4, 11, 9, 11, 4, 12, 9, 12, 4, 13, 9, 13, 4, 14, 9, 14, 4, 15, 9, 15, 4, 16, 9, 16, 4, 17, 9, 17, 4, 18, 9, 18, 4, 19, 9, 19, 4, 20, 9, 20, 4, 21, 9, 21, 4, 22, 9, 22, 4, 23, 9, 23, 4, 24, 9, 24, 4, 25, 9, 25, 4, 26, 9, 26, 4, 27, 9, 27, 4, 28, 9, 28, 4, 29, 9, 29, 4, 30, 9, 30, 4, 31, 9, 31, 4, 32, 9, 32, 4, 33, 9, 33, 4, 34, 9, 34, 4, 35, 9, 35, 4, 36, 9, 36, 4, 37, 9, 37, 4, 38, 9, 38, 4, 39, 9, 39, 4, 40, 9, 40, 4, 41, 9, 41, 4, 42, 9, 42, 4, 43, 9, 43, 4, 44, 9, 44, 4, 45, 9, 45, 4, 46, 9, 46, 4, 47, 9, 47, 4, 48, 9, 48, 4, 49, 9, 49, 4, 50, 9, 50, 4, 51, 9, 51, 4, 52, 9, 52, 4, 53, 9, 53, 4, 54, 9, 54, 4, 55, 9, 55, 4, 56, 9, 56, 4, 57, 9, 57, 4, 58, 9, 58, 4, 59, 9, 59, 4, 60, 9, 60, 4, 61, 9, 61, 4, 62, 9, 62, 4, 63, 9, 63, 4, 64, 9, 64, 4, 65, 9, 65, 4, 66, 9, 66, 4, 67, 9, 67, 4, 68, 9, 68, 4, 69, 9, 69, 4, 70, 9, 70, 4, 71, 9, 71, 4, 72, 9, 72, 4, 73, 9, 73, 4, 74, 9, 74, 4, 75, 9, 75, 4, 76, 9, 76, 4, 77, 9, 77, 3, 2, 3, 2, 5, 2, 157, 10, 2, 3, 2, 3, 2, 3, 2, 3, 2, 3, 2, 3, 2, 3, 2, 3, 2, 3, 2, 3, 2, 3, 2, 3, 2, 5, 2, 171, 10, 2, 3, 2, 3, 2, 3, 2, 7, 2, 176, 10, 2, 12, 2, 14, 2, 179, 11, 2, 3, 3, 3, 3, 3, 3, 7, 3, 184, 10, 3, 12, 3, 14, 3, 187, 11, 3, 5, 3, 189, 10, 3, 3, 4, 3, 4, 3, 4, 3, 4, 3, 5, 3, 5, 3, 5, 3, 5, 3, 5, 3, 5, 3, 5, 3, 5, 7, 5, 203, 10, 5, 12, 5, 14, 5, 206, 11, 5, 3, 5, 5, 5, 209, 10, 5, 3, 6, 3, 6, 5, 6, 213, 10, 6, 3, 6, 3, 6, 7, 6, 217, 10, 6, 12, 6, 14, 6, 220, 11, 6, 3, 6, 3, 6, 5, 6, 224, 10, 6, 3, 6, 3, 6, 3, 6, 3, 6, 5, 6, 230, 10, 6, 3, 7, 3, 7, 3, 7, 3, 7, 3, 7, 5, 7, 237, 10, 7, 3, 8, 3, 8, 5, 8, 241, 10, 8, 3, 9, 3, 9, 3, 9, 3, 9, 7, 9, 247, 10, 9, 12, 9, 14, 9, 250, 11, 9, 5, 9, 252, 10, 9, 3, 10, 3, 10, 3, 10, 3, 10, 7, 10, 258, 10, 10, 12, 10, 14, 10, 261, 11, 10, 5, 10, 263, 10, 10, 3, 11, 3, 11, 3, 11, 5, 11, 268, 10, 11, 3, 12, 3, 12, 5, 12, 272, 10, 12, 3, 12, 3, 12, 7, 12, 276, 10, 12, 12, 12, 14, 12, 279, 11, 12, 3, 12, 3, 12, 3, 12, 3, 12, 3, 12, 3, 12, 3, 12, 3, 12, 3, 12, 3, 12, 5, 12, 291, 10, 12, 3, 13, 3, 13, 5, 13, 295, 10, 13, 3, 14, 3, 14, 3, 15, 3, 15, 3, 15, 3, 15, 3, 15, 3, 15, 3, 15, 3, 15, 3, 15, 7, 15, 308, 10, 15, 12, 15, 14, 15, 311, 11, 15, 3, 16, 3, 16, 3, 16, 3, 16, 3, 16, 3, 16, 7, 16, 319, 10, 16, 12, 16, 14, 16, 322, 11, 16, 3, 17, 3, 17, 3, 17, 3, 17, 3, 17, 3, 17, 7, 17, 330, 10, 17, 12, 17, 14, 17, 333, 11, 17, 3, 18, 3, 18, 3, 18, 3, 18, 3, 18, 3, 18, 7, 18, 341, 10, 18, 12, 18, 14, 18, 344, 11, 18, 3, 19, 3, 19, 3, 19, 3, 19, 3, 19, 3, 19, 7, 19, 352, 10, 19, 12, 19, 14, 19, 355, 11, 19, 3, 20, 3, 20, 3, 20, 3, 20, 3, 20, 3, 20, 7, 20, 363, 10, 20, 12, 20, 14, 20, 366, 11, 20, 3, 21, 3, 21, 3, 21, 3, 21, 3, 21, 3, 21, 7, 21, 374, 10, 21, 12, 21, 14, 21, 377, 11, 21, 3, 22, 3, 22, 3, 22, 3, 22, 3, 22, 3, 22, 7, 22, 385, 10, 22, 12, 22, 14, 22, 388, 11, 22, 3, 23, 3, 23, 3, 23, 3, 23, 3, 23, 3, 23, 7, 23, 396, 10, 23, 12, 23, 14, 23, 399, 11, 23, 3, 24, 3, 24, 3, 24, 5, 24, 404, 10, 24, 3, 25, 3, 25, 3, 25, 3, 25, 3, 25, 3, 25, 3, 25, 3, 25, 3, 25, 3, 25, 3, 25, 5, 25, 417, 10, 25, 3, 25, 3, 25, 3, 25, 3, 25, 3, 25, 3, 25, 3, 25, 3, 25, 7, 25, 427, 10, 25, 12, 25, 14, 25, 430, 11, 25, 3, 26, 3, 26, 3, 26, 3, 26, 3, 26, 3, 26, 3, 26, 3, 26, 3, 26, 3, 26, 5, 26, 442, 10, 26, 3, 27, 3, 27, 3, 27, 3, 27, 5, 27, 448, 10, 27, 5, 27, 450, 10, 27, 3, 28, 3, 28, 5, 28, 454, 10, 28, 3, 29, 3, 29, 3, 29, 3, 29, 3, 29, 7, 29, 461, 10, 29, 12, 29, 14, 29, 464, 11, 29, 5, 29, 466, 10, 29, 3, 29, 3, 29, 3, 30, 3, 30, 3, 30, 5, 30, 473, 10, 30, 5, 30, 475, 10, 30, 3, 31, 3, 31, 3, 31, 3, 31, 3, 31, 3, 31, 3, 31, 3, 31, 5, 31, 485, 10, 31, 3, 32, 5, 32, 488, 10, 32, 3, 33, 3, 33, 3, 33, 3, 33, 3, 33, 3, 33, 3, 33, 3, 33, 3, 33, 3, 33, 3, 34, 3, 34, 5, 34, 502, 10, 34, 3, 34, 3, 34, 5, 34, 506, 10, 34, 3, 34, 3, 34, 3, 35, 5, 35, 511, 10, 35, 3, 36, 3, 36, 3, 36, 3, 36, 3, 36, 3, 36, 3, 36, 3, 36, 3, 36, 3, 37, 3, 37, 3, 38, 3, 38, 5, 38, 526, 10, 38, 3, 38, 3, 38, 7, 38, 530, 10, 38, 12, 38, 14, 38, 533, 11, 38, 3, 38, 3, 38, 3, 39, 3, 39, 5, 39, 539, 10, 39, 3, 39, 3, 39, 3, 39, 3, 40, 3, 40, 3, 41, 3, 41, 3, 41, 3, 41, 3, 41, 3, 42, 3, 42, 3, 42, 5, 42, 554, 10, 42, 3, 43, 5, 43, 557, 10, 43, 3, 43, 3, 43, 3, 44, 3, 44, 3, 45, 3, 45, 5, 45, 565, 10, 45, 3, 45, 3, 45, 3, 45, 3, 45, 3, 45, 3, 45, 5, 45, 573, 10, 45, 3, 46, 3, 46, 3, 46, 3, 46, 3, 46, 3, 46, 3, 47, 3, 47, 5, 47, 583, 10, 47, 3, 48, 3, 48, 3, 49, 3, 49, 3, 50, 3, 50, 3, 50, 5, 50, 592, 10, 50, 3, 51, 3, 51, 3, 51, 3, 51, 3, 52, 3, 52, 3, 52, 6, 52, 601, 10, 52, 13, 52, 14, 52, 602, 3, 53, 3, 53, 3, 53, 3, 53, 3, 53, 3, 53, 3, 53, 5, 53, 612, 10, 53, 3, 54, 3, 54, 3, 54, 3, 54, 3, 54, 3, 54, 3, 54, 3, 54, 3, 54, 3, 54, 3, 54, 3, 54, 3, 54, 3, 54, 3, 54, 3, 54, 3, 54, 3, 54, 3, 54, 3, 54, 3, 54, 3, 54, 3, 54, 3, 54, 3, 54, 3, 54, 3, 54, 3, 54, 3, 54, 5, 54, 643, 10, 54, 3, 55, 7, 55, 646, 10, 55, 12, 55, 14, 55, 649, 11, 55, 3, 56, 5, 56, 652, 10, 56, 3, 56, 3, 56, 3, 56, 3, 56, 3, 57, 3, 57, 5, 57, 660, 10, 57, 3, 58, 3, 58, 3, 59, 3, 59, 3, 59, 3, 59, 3, 59, 3, 60, 7, 60, 670, 10, 60, 12, 60, 14, 60, 673, 11, 60, 3, 61, 3, 61, 3, 61, 3, 62, 3, 62, 3, 62, 3, 63, 3, 63, 3, 63, 3, 64, 3, 64, 3, 64, 5, 64, 687, 10, 64, 3, 64, 5, 64, 690, 10, 64, 3, 64, 5, 64, 693, 10, 64, 3, 64, 3, 64, 3, 65, 3, 65, 3, 65, 3, 65, 3, 65, 3, 65, 3, 66, 3, 66, 5, 66, 705, 10, 66, 3, 66, 3, 66, 3, 66, 3, 66, 3, 66, 3, 66, 3, 66, 3, 66, 3, 66, 3, 67, 3, 67, 3, 67, 5, 67, 719, 10, 67, 3, 67, 3, 67, 3, 67, 3, 67, 3, 67, 3, 67, 3, 67, 3, 67, 3, 68, 3, 68, 3, 68, 3, 68, 3, 68, 3, 68, 3, 68, 3, 69, 5, 69, 737, 10, 69, 3, 69, 3, 69, 3, 69, 3, 69, 3, 69, 3, 69, 3, 69, 5, 69, 746, 10, 69, 3, 70, 3, 70, 3, 70, 3, 70, 3, 70, 3, 70, 3, 70, 3, 71, 3, 71, 5, 71, 757, 10, 71, 3, 71, 3, 71, 3, 71, 3, 71, 3, 71, 3, 71, 3, 71, 3, 71, 5, 71, 767, 10, 71, 3, 72, 3, 72, 3, 72, 3, 72, 3, 72, 3, 72, 3, 72, 3, 73, 3, 73, 3, 73, 3, 73, 3, 73, 3, 73, 3, 73, 3, 73, 3, 74, 3, 74, 3, 74, 3, 74, 3, 74, 3, 74, 3, 75, 3, 75, 3, 75, 3, 75, 3, 75, 3, 75, 3, 75, 3, 75, 3, 75, 3, 75, 3, 75, 5, 75, 801, 10, 75, 3, 76, 3, 76, 3, 76, 3, 76, 7, 76, 807, 10, 76, 12, 76, 14, 76, 810, 11, 76, 3, 76, 3, 76, 3, 77, 3, 77, 7, 77, 816, 10, 77, 12, 77, 14, 77, 819, 11, 77, 3, 77, 2, 13, 2, 28, 30, 32, 34, 36, 38, 40, 42, 44, 48, 78, 2, 4, 6, 8, 10, 12, 14, 16, 18, 20, 22, 24, 26, 28, 30, 32, 34, 36, 38, 40, 42, 44, 46, 48, 50, 52, 54, 56, 58, 60, 62, 64, 66, 68, 70, 72, 74, 76, 78, 80, 82, 84, 86, 88, 90, 92, 94, 96, 98, 100, 102, 104, 106, 108, 110, 112, 114, 116, 118, 120, 122, 124, 126, 128, 130, 132, 134, 136, 138, 140, 142, 144, 146, 148, 150, 152, 2, 13, 3, 2, 60, 61, 4, 2, 54, 54, 65, 65, 3, 2, 66, 69, 3, 2, 70, 72, 3, 2, 55, 56, 3, 2, 57, 59, 5, 2, 55, 56, 62, 62, 77, 77, 3, 2, 52, 53, 4, 2, 63, 64, 79, 79, 3, 2, 45, 46, 3, 2, 48, 49, 2, 849, 2, 170, 3, 2, 2, 2, 4, 188, 3, 2, 2, 2, 6, 190, 3, 2, 2, 2, 8, 208, 3, 2, 2, 2, 10, 229, 3, 2, 2, 2, 12, 231, 3, 2, 2, 2, 14, 240, 3, 2, 2, 2, 16, 251, 3, 2, 2, 2, 18, 262, 3, 2, 2, 2, 20, 264, 3, 2, 2, 2, 22, 290, 3, 2, 2, 2, 24, 292, 3, 2, 2, 2, 26, 296, 3, 2, 2, 2, 28, 298, 3, 2, 2, 2, 30, 312, 3, 2, 2, 2, 32, 323, 3, 2, 2, 2, 34, 334, 3, 2, 2, 2, 36, 345, 3, 2, 2, 2, 38, 356, 3, 2, 2, 2, 40, 367, 3, 2, 2, 2, 42, 378, 3, 2, 2, 2, 44, 389, 3, 2, 2, 2, 46, 403, 3, 2, 2, 2, 48, 416, 3, 2, 2, 2, 50, 441, 3, 2, 2, 2, 52, 449, 3, 2, 2, 2, 54, 453, 3, 2, 2, 2, 56, 455, 3, 2, 2, 2, 58, 474, 3, 2, 2, 2, 60, 484, 3, 2, 2, 2, 62, 487, 3, 2, 2, 2, 64, 489, 3, 2, 2, 2, 66, 499, 3, 2, 2, 2, 68, 510, 3, 2, 2, 2, 70, 512, 3, 2, 2, 2, 72, 521, 3, 2, 2, 2, 74, 523, 3, 2, 2, 2, 76, 536, 3, 2, 2, 2, 78, 543, 3, 2, 2, 2, 80, 545, 3, 2, 2, 2, 82, 550, 3, 2, 2, 2, 84, 556, 3, 2, 2, 2, 86, 560, 3, 2, 2, 2, 88, 562, 3, 2, 2, 2, 90, 574, 3, 2, 2, 2, 92, 580, 3, 2, 2, 2, 94, 584, 3, 2, 2, 2, 96, 586, 3, 2, 2, 2, 98, 588, 3, 2, 2, 2, 100, 593, 3, 2, 2, 2, 102, 597, 3, 2, 2, 2, 104, 611, 3, 2, 2, 2, 106, 642, 3, 2, 2, 2, 108, 647, 3, 2, 2, 2, 110, 651, 3, 2, 2, 2, 112, 659, 3, 2, 2, 2, 114, 661, 3, 2, 2, 2, 116, 663, 3, 2, 2, 2, 118, 671, 3, 2, 2, 2, 120, 674, 3, 2, 2, 2, 122, 677, 3, 2, 2, 2, 124, 680, 3, 2, 2, 2, 126, 683, 3, 2, 2, 2, 128, 696, 3, 2, 2, 2, 130, 702, 3, 2, 2, 2, 132, 715, 3, 2, 2, 2, 134, 728, 3, 2, 2, 2, 136, 736, 3, 2, 2, 2, 138, 747, 3, 2, 2, 2, 140, 756, 3, 2, 2, 2, 142, 768, 3, 2, 2, 2, 144, 775, 3, 2, 2, 2, 146, 783, 3, 2, 2, 2, 148, 800, 3, 2, 2, 2, 150, 802, 3, 2, 2, 2, 152, 817, 3, 2, 2, 2, 154, 156, 8, 2, 1, 2, 155, 157, 7, 34, 2, 2, 156, 155, 3, 2, 2, 2, 156, 157, 3, 2, 2, 2, 157, 158, 3, 2, 2, 2, 158, 171, 7, 79, 2, 2, 159, 160, 7, 25, 2, 2, 160, 161, 7, 3, 2, 2, 161, 162, 5, 4, 3, 2, 162, 163, 7, 4, 2, 2, 163, 164, 7, 5, 2, 2, 164, 165, 5, 2, 2, 5, 165, 171, 3, 2, 2, 2, 166, 167, 7, 3, 2, 2, 167, 168, 5, 2, 2, 2, 168, 169, 7, 4, 2, 2, 169, 171, 3, 2, 2, 2, 170, 154, 3, 2, 2, 2, 170, 159, 3, 2, 2, 2, 170, 166, 3, 2, 2, 2, 171, 177, 3, 2, 2, 2, 172, 173, 12, 4, 2, 2, 173, 174, 7, 60, 2, 2, 174, 176, 5, 2, 2, 5, 175, 172, 3, 2, 2, 2, 176, 179, 3, 2, 2, 2, 177, 175, 3, 2, 2, 2, 177, 178, 3, 2, 2, 2, 178, 3, 3, 2, 2, 2, 179, 177, 3, 2, 2, 2, 180, 185, 5, 2, 2, 2, 181, 182, 7, 6, 2, 2, 182, 184, 5, 2, 2, 2, 183, 181, 3, 2, 2, 2, 184, 187, 3, 2, 2, 2, 185, 183, 3, 2, 2, 2, 185, 186, 3, 2, 2, 2, 186, 189, 3, 2, 2, 2, 187, 185, 3, 2, 2, 2, 188, 180, 3, 2, 2, 2, 188, 189, 3, 2, 2, 2, 189, 5, 3, 2, 2, 2, 190, 191, 7, 66, 2, 2, 191, 192, 5, 4, 3, 2, 192, 193, 7, 68, 2, 2, 193, 7, 3, 2, 2, 2, 194, 195, 7, 66, 2, 2, 195, 196, 7, 79, 2, 2, 196, 197, 7, 7, 2, 2, 197, 204, 7, 8, 2, 2, 198, 199, 7, 6, 2, 2, 199, 200, 7, 79, 2, 2, 200, 201, 7, 7, 2, 2, 201, 203, 7, 8, 2, 2, 202, 198, 3, 2, 2, 2, 203, 206, 3, 2, 2, 2, 204, 202, 3, 2, 2, 2, 204, 205, 3, 2, 2, 2, 205, 207, 3, 2, 2, 2, 206, 204, 3, 2, 2, 2, 207, 209, 7, 68, 2, 2, 208, 194, 3, 2, 2, 2, 208, 209, 3, 2, 2, 2, 209, 9, 3, 2, 2, 2, 210, 212, 7, 3, 2, 2, 211, 213, 5, 2, 2, 2, 212, 211, 3, 2, 2, 2, 212, 213, 3, 2, 2, 2, 213, 218, 3, 2, 2, 2, 214, 215, 7, 6, 2, 2, 215, 217, 5, 2, 2, 2, 216, 214, 3, 2, 2, 2, 217, 220, 3, 2, 2, 2, 218, 216, 3, 2, 2, 2, 218, 219, 3, 2, 2, 2, 219, 223, 3, 2, 2, 2, 220, 218, 3, 2, 2, 2, 221, 222, 7, 6, 2, 2, 222, 224, 7, 73, 2, 2, 223, 221, 3, 2, 2, 2, 223, 224, 3, 2, 2, 2, 224, 225, 3, 2, 2, 2, 225, 230, 7, 4, 2, 2, 226, 227, 7, 3, 2, 2, 227, 228, 7, 73, 2, 2, 228, 230, 7, 4, 2, 2, 229, 210, 3, 2, 2, 2, 229, 226, 3, 2, 2, 2, 230, 11, 3, 2, 2, 2, 231, 236, 7, 79, 2, 2, 232, 233, 7, 3, 2, 2, 233, 234, 5, 4, 3, 2, 234, 235, 7, 4, 2, 2, 235, 237, 3, 2, 2, 2, 236, 232, 3, 2, 2, 2, 236, 237, 3, 2, 2, 2, 237, 13, 3, 2, 2, 2, 238, 239, 7, 7, 2, 2, 239, 241, 5, 2, 2, 2, 240, 238, 3, 2, 2, 2, 240, 241, 3, 2, 2, 2, 241, 15, 3, 2, 2, 2, 242, 243, 7, 41, 2, 2, 243, 248, 5, 12, 7, 2, 244, 245, 7, 6, 2, 2, 245, 247, 5, 12, 7, 2, 246, 244, 3, 2, 2, 2, 247, 250, 3, 2, 2, 2, 248, 246, 3, 2, 2, 2, 248, 249, 3, 2, 2, 2, 249, 252, 3, 2, 2, 2, 250, 248, 3, 2, 2, 2, 251, 242, 3, 2, 2, 2, 251, 252, 3, 2, 2, 2, 252, 17, 3, 2, 2, 2, 253, 254, 7, 38, 2, 2, 254, 259, 7, 79, 2, 2, 255, 256, 7, 6, 2, 2, 256, 258, 7, 79, 2, 2, 257, 255, 3, 2, 2, 2, 258, 261, 3, 2, 2, 2, 259, 257, 3, 2, 2, 2, 259, 260, 3, 2, 2, 2, 260, 263, 3, 2, 2, 2, 261, 259, 3, 2, 2, 2, 262, 253, 3, 2, 2, 2, 262, 263, 3, 2, 2, 2, 263, 19, 3, 2, 2, 2, 264, 265, 7, 79, 2, 2, 265, 267, 7, 7, 2, 2, 266, 268, 5, 2, 2, 2, 267, 266, 3, 2, 2, 2, 267, 268, 3, 2, 2, 2, 268, 21, 3, 2, 2, 2, 269, 271, 7, 3, 2, 2, 270, 272, 5, 20, 11, 2, 271, 270, 3, 2, 2, 2, 271, 272, 3, 2, 2, 2, 272, 277, 3, 2, 2, 2, 273, 274, 7, 6, 2, 2, 274, 276, 5, 20, 11, 2, 275, 273, 3, 2, 2, 2, 276, 279, 3, 2, 2, 2, 277, 275, 3, 2, 2, 2, 277, 278, 3, 2, 2, 2, 278, 280, 3, 2, 2, 2, 279, 277, 3, 2, 2, 2, 280, 291, 7, 4, 2, 2, 281, 282, 7, 3, 2, 2, 282, 283, 5, 20, 11, 2, 283, 284, 7, 6, 2, 2, 284, 285, 5, 20, 11, 2, 285, 286, 7, 6, 2, 2, 286, 287, 7, 73, 2, 2, 287, 288, 7, 79, 2, 2, 288, 289, 7, 4, 2, 2, 289, 291, 3, 2, 2, 2, 290, 269, 3, 2, 2, 2, 290, 281, 3, 2, 2, 2, 291, 23, 3, 2, 2, 2, 292, 294, 7, 79, 2, 2, 293, 295, 5, 22, 12, 2, 294, 293, 3, 2, 2, 2, 294, 295, 3, 2, 2, 2, 295, 25, 3, 2, 2, 2, 296, 297, 5, 28, 15, 2, 297, 27, 3, 2, 2, 2, 298, 299, 8, 15, 1, 2, 299, 300, 5, 30, 16, 2, 300, 309, 3, 2, 2, 2, 301, 302, 12, 3, 2, 2, 302, 303, 7, 9, 2, 2, 303, 304, 5, 30, 16, 2, 304, 305, 7, 7, 2, 2, 305, 306, 5, 30, 16, 2, 306, 308, 3, 2, 2, 2, 307, 301, 3, 2, 2, 2, 308, 311, 3, 2, 2, 2, 309, 307, 3, 2, 2, 2, 309, 310, 3, 2, 2, 2, 310, 29, 3, 2, 2, 2, 311, 309, 3, 2, 2, 2, 312, 313, 8, 16, 1, 2, 313, 314, 5, 32, 17, 2, 314, 320, 3, 2, 2, 2, 315, 316, 12, 3, 2, 2, 316, 317, 7, 10, 2, 2, 317, 319, 5, 32, 17, 2, 318, 315, 3, 2, 2, 2, 319, 322, 3, 2, 2, 2, 320, 318, 3, 2, 2, 2, 320, 321, 3, 2, 2, 2, 321, 31, 3, 2, 2, 2, 322, 320, 3, 2, 2, 2, 323, 324, 8, 17, 1, 2, 324, 325, 5, 34, 18, 2, 325, 331, 3, 2, 2, 2, 326, 327, 12, 3, 2, 2, 327, 328, 7, 11, 2, 2, 328, 330, 5, 34, 18, 2, 329, 326, 3, 2, 2, 2, 330, 333, 3, 2, 2, 2, 331, 329, 3, 2, 2, 2, 331, 332, 3, 2, 2, 2, 332, 33, 3, 2, 2, 2, 333, 331, 3, 2, 2, 2, 334, 335, 8, 18, 1, 2, 335, 336, 5, 36, 19, 2, 336, 342, 3, 2, 2, 2, 337, 338, 12, 3, 2, 2, 338, 339, 9, 2, 2, 2, 339, 341, 5, 36, 19, 2, 340, 337, 3, 2, 2, 2, 341, 344, 3, 2, 2, 2, 342, 340, 3, 2, 2, 2, 342, 343, 3, 2, 2, 2, 343, 35, 3, 2, 2, 2, 344, 342, 3, 2, 2, 2, 345, 346, 8, 19, 1, 2, 346, 347, 5, 38, 20, 2, 347, 353, 3, 2, 2, 2, 348, 349, 12, 3, 2, 2, 349, 350, 9, 3, 2, 2, 350, 352, 5, 38, 20, 2, 351, 348, 3, 2, 2, 2, 352, 355, 3, 2, 2, 2, 353, 351, 3, 2, 2, 2, 353, 354, 3, 2, 2, 2, 354, 37, 3, 2, 2, 2, 355, 353, 3, 2, 2, 2, 356, 357, 8, 20, 1, 2, 357, 358, 5, 40, 21, 2, 358, 364, 3, 2, 2, 2, 359, 360, 12, 3, 2, 2, 360, 361, 9, 4, 2, 2, 361, 363, 5, 40, 21, 2, 362, 359, 3, 2, 2, 2, 363, 366, 3, 2, 2, 2, 364, 362, 3, 2, 2, 2, 364, 365, 3, 2, 2, 2, 365, 39, 3, 2, 2, 2, 366, 364, 3, 2, 2, 2, 367, 368, 8, 21, 1, 2, 368, 369, 5, 42, 22, 2, 369, 375, 3, 2, 2, 2, 370, 371, 12, 3, 2, 2, 371, 372, 9, 5, 2, 2, 372, 374, 5, 42, 22, 2, 373, 370, 3, 2, 2, 2, 374, 377, 3, 2, 2, 2, 375, 373, 3, 2, 2, 2, 375, 376, 3, 2, 2, 2, 376, 41, 3, 2, 2, 2, 377, 375, 3, 2, 2, 2, 378, 379, 8, 22, 1, 2, 379, 380, 5, 44, 23, 2, 380, 386, 3, 2, 2, 2, 381, 382, 12, 3, 2, 2, 382, 383, 9, 6, 2, 2, 383, 385, 5, 44, 23, 2, 384, 381, 3, 2, 2, 2, 385, 388, 3, 2, 2, 2, 386, 384, 3, 2, 2, 2, 386, 387, 3, 2, 2, 2, 387, 43, 3, 2, 2, 2, 388, 386, 3, 2, 2, 2, 389, 390, 8, 23, 1, 2, 390, 391, 5, 46, 24, 2, 391, 397, 3, 2, 2, 2, 392, 393, 12, 3, 2, 2, 393, 394, 9, 7, 2, 2, 394, 396, 5, 46, 24, 2, 395, 392, 3, 2, 2, 2, 396, 399, 3, 2, 2, 2, 397, 395, 3, 2, 2, 2, 397, 398, 3, 2, 2, 2, 398, 45, 3, 2, 2, 2, 399, 397, 3, 2, 2, 2, 400, 404, 5, 54, 28, 2, 401, 402, 9, 8, 2, 2, 402, 404, 5, 46, 24, 2, 403, 400, 3, 2, 2, 2, 403, 401, 3, 2, 2, 2, 404, 47, 3, 2, 2, 2, 405, 406, 8, 25, 1, 2, 406, 417, 7, 79, 2, 2, 407, 408, 5, 60, 31, 2, 408, 409, 7, 12, 2, 2, 409, 410, 7, 79, 2, 2, 410, 417, 3, 2, 2, 2, 411, 412, 5, 60, 31, 2, 412, 413, 7, 13, 2, 2, 413, 414, 5, 26, 14, 2, 414, 415, 7, 14, 2, 2, 415, 417, 3, 2, 2, 2, 416, 405, 3, 2, 2, 2, 416, 407, 3, 2, 2, 2, 416, 411, 3, 2, 2, 2, 417, 428, 3, 2, 2, 2, 418, 419, 12, 6, 2, 2, 419, 420, 7, 12, 2, 2, 420, 427, 7, 79, 2, 2, 421, 422, 12, 4, 2, 2, 422, 423, 7, 13, 2, 2, 423, 424, 5, 26, 14, 2, 424, 425, 7, 14, 2, 2, 425, 427, 3, 2, 2, 2, 426, 418, 3, 2, 2, 2, 426, 421, 3, 2, 2, 2, 427, 430, 3, 2, 2, 2, 428, 426, 3, 2, 2, 2, 428, 429, 3, 2, 2, 2, 429, 49, 3, 2, 2, 2, 430, 428, 3, 2, 2, 2, 431, 432, 7, 75, 2, 2, 432, 442, 5, 48, 25, 2, 433, 434, 7, 76, 2, 2, 434, 442, 5, 48, 25, 2, 435, 436, 5, 48, 25, 2, 436, 437, 7, 75, 2, 2, 437, 442, 3, 2, 2, 2, 438, 439, 5, 48, 25, 2, 439, 440, 7, 76, 2, 2, 440, 442, 3, 2, 2, 2, 441, 431, 3, 2, 2, 2, 441, 433, 3, 2, 2, 2, 441, 435, 3, 2, 2, 2, 441, 438, 3, 2, 2, 2, 442, 51, 3, 2, 2, 2, 443, 450, 5, 50, 26, 2, 444, 447, 5, 48, 25, 2, 445, 446, 9, 9, 2, 2, 446, 448, 5, 26, 14, 2, 447, 445, 3, 2, 2, 2, 447, 448, 3, 2, 2, 2, 448, 450, 3, 2, 2, 2, 449, 443, 3, 2, 2, 2, 449, 444, 3, 2, 2, 2, 450, 53, 3, 2, 2, 2, 451, 454, 5, 58, 30, 2, 452, 454, 5, 52, 27, 2, 453, 451, 3, 2, 2, 2, 453, 452, 3, 2, 2, 2, 454, 55, 3, 2, 2, 2, 455, 456, 7, 79, 2, 2, 456, 465, 7, 15, 2, 2, 457, 462, 5, 26, 14, 2, 458, 459, 7, 6, 2, 2, 459, 461, 5, 26, 14, 2, 460, 458, 3, 2, 2, 2, 461, 464, 3, 2, 2, 2, 462, 460, 3, 2, 2, 2, 462, 463, 3, 2, 2, 2, 463, 466, 3, 2, 2, 2, 464, 462, 3, 2, 2, 2, 465, 457, 3, 2, 2, 2, 465, 466, 3, 2, 2, 2, 466, 467, 3, 2, 2, 2, 467, 468, 7, 16, 2, 2, 468, 57, 3, 2, 2, 2, 469, 475, 5, 60, 31, 2, 470, 472, 7, 79, 2, 2, 471, 473, 5, 6, 4, 2, 472, 471, 3, 2, 2, 2, 472, 473, 3, 2, 2, 2, 473, 475, 3, 2, 2, 2, 474, 469, 3, 2, 2, 2, 474, 470, 3, 2, 2, 2, 475, 59, 3, 2, 2, 2, 476, 485, 5, 76, 39, 2, 477, 485, 5, 56, 29, 2, 478, 485, 7, 83, 2, 2, 479, 485, 7, 78, 2, 2, 480, 481, 7, 3, 2, 2, 481, 482, 5, 26, 14, 2, 482, 483, 7, 4, 2, 2, 483, 485, 3, 2, 2, 2, 484, 476, 3, 2, 2, 2, 484, 477, 3, 2, 2, 2, 484, 478, 3, 2, 2, 2, 484, 479, 3, 2, 2, 2, 484, 480, 3, 2, 2, 2, 485, 61, 3, 2, 2, 2, 486, 488, 5, 82, 42, 2, 487, 486, 3, 2, 2, 2, 487, 488, 3, 2, 2, 2, 488, 63, 3, 2, 2, 2, 489, 490, 7, 31, 2, 2, 490, 491, 7, 3, 2, 2, 491, 492, 5, 62, 32, 2, 492, 493, 7, 17, 2, 2, 493, 494, 5, 26, 14, 2, 494, 495, 7, 17, 2, 2, 495, 496, 5, 52, 27, 2, 496, 497, 7, 4, 2, 2, 497, 498, 5, 112, 57, 2, 498, 65, 3, 2, 2, 2, 499, 501, 7, 13, 2, 2, 500, 502, 5, 26, 14, 2, 501, 500, 3, 2, 2, 2, 501, 502, 3, 2, 2, 2, 502, 503, 3, 2, 2, 2, 503, 505, 7, 7, 2, 2, 504, 506, 5, 26, 14, 2, 505, 504, 3, 2, 2, 2, 505, 506, 3, 2, 2, 2, 506, 507, 3, 2, 2, 2, 507, 508, 7, 14, 2, 2, 508, 67, 3, 2, 2, 2, 509, 511, 5, 66, 34, 2, 510, 509, 3, 2, 2, 2, 510, 511, 3, 2, 2, 2, 511, 69, 3, 2, 2, 2, 512, 513, 7, 31, 2, 2, 513, 514, 7, 3, 2, 2, 514, 515, 5, 80, 41, 2, 515, 516, 7, 18, 2, 2, 516, 517, 5, 26, 14, 2, 517, 518, 5, 68, 35, 2, 518, 519, 7, 4, 2, 2, 519, 520, 5, 112, 57, 2, 520, 71, 3, 2, 2, 2, 521, 522, 5, 26, 14, 2, 522, 73, 3, 2, 2, 2, 523, 525, 7, 3, 2, 2, 524, 526, 5, 72, 37, 2, 525, 524, 3, 2, 2, 2, 525, 526, 3, 2, 2, 2, 526, 531, 3, 2, 2, 2, 527, 528, 7, 6, 2, 2, 528, 530, 5, 72, 37, 2, 529, 527, 3, 2, 2, 2, 530, 533, 3, 2, 2, 2, 531, 529, 3, 2, 2, 2, 531, 532, 3, 2, 2, 2, 532, 534, 3, 2, 2, 2, 533, 531, 3, 2, 2, 2, 534, 535, 7, 4, 2, 2, 535, 75, 3, 2, 2, 2, 536, 538, 9, 10, 2, 2, 537, 539, 5, 6, 4, 2, 538, 537, 3, 2, 2, 2, 538, 539, 3, 2, 2, 2, 539, 540, 3, 2, 2, 2, 540, 541, 5, 74, 38, 2, 541, 542, 5, 18, 10, 2, 542, 77, 3, 2, 2, 2, 543, 544, 7, 79, 2, 2, 544, 79, 3, 2, 2, 2, 545, 546, 9, 11, 2, 2, 546, 547, 7, 79, 2, 2, 547, 548, 7, 7, 2, 2, 548, 549, 5, 2, 2, 2, 549, 81, 3, 2, 2, 2, 550, 553, 5, 80, 41, 2, 551, 552, 7, 52, 2, 2, 552, 554, 5, 26, 14, 2, 553, 551, 3, 2, 2, 2, 553, 554, 3, 2, 2, 2, 554, 83, 3, 2, 2, 2, 555, 557, 7, 42, 2, 2, 556, 555, 3, 2, 2, 2, 556, 557, 3, 2, 2, 2, 557, 558, 3, 2, 2, 2, 558, 559, 5, 76, 39, 2, 559, 85, 3, 2, 2, 2, 560, 561, 5, 52, 27, 2, 561, 87, 3, 2, 2, 2, 562, 564, 7, 30, 2, 2, 563, 565, 7, 34, 2, 2, 564, 563, 3, 2, 2, 2, 564, 565, 3, 2, 2, 2, 565, 566, 3, 2, 2, 2, 566, 567, 7, 3, 2, 2, 567, 568, 5, 26, 14, 2, 568, 569, 7, 4, 2, 2, 569, 572, 5, 112, 57, 2, 570, 571, 7, 19, 2, 2, 571, 573, 5, 112, 57, 2, 572, 570, 3, 2, 2, 2, 572, 573, 3, 2, 2, 2, 573, 89, 3, 2, 2, 2, 574, 575, 7, 32, 2, 2, 575, 576, 7, 3, 2, 2, 576, 577, 5, 26, 14, 2, 577, 578, 7, 4, 2, 2, 578, 579, 5, 112, 57, 2, 579, 91, 3, 2, 2, 2, 580, 582, 7, 33, 2, 2, 581, 583, 5, 26, 14, 2, 582, 581, 3, 2, 2, 2, 582, 583, 3, 2, 2, 2, 583, 93, 3, 2, 2, 2, 584, 585, 7, 36, 2, 2, 585, 95, 3, 2, 2, 2, 586, 587, 7, 35, 2, 2, 587, 97, 3, 2, 2, 2, 588, 589, 7, 37, 2, 2, 589, 591, 5, 78, 40, 2, 590, 592, 5, 74, 38, 2, 591, 590, 3, 2, 2, 2, 591, 592, 3, 2, 2, 2, 592, 99, 3, 2, 2, 2, 593, 594, 7, 40, 2, 2, 594, 595, 5, 24, 13, 2, 595, 596, 5, 112, 57, 2, 596, 101, 3, 2, 2, 2, 597, 598, 7, 39, 2, 2, 598, 600, 5, 112, 57, 2, 599, 601, 5, 100, 51, 2, 600, 599, 3, 2, 2, 2, 601, 602, 3, 2, 2, 2, 602, 600, 3, 2, 2, 2, 602, 603, 3, 2, 2, 2, 603, 103, 3, 2, 2, 2, 604, 605, 9, 12, 2, 2, 605, 606, 7, 3, 2, 2, 606, 607, 5, 26, 14, 2, 607, 608, 7, 4, 2, 2, 608, 612, 3, 2, 2, 2, 609, 612, 7, 50, 2, 2, 610, 612, 7, 51, 2, 2, 611, 604, 3, 2, 2, 2, 611, 609, 3, 2, 2, 2, 611, 610, 3, 2, 2, 2, 612, 105, 3, 2, 2, 2, 613, 614, 5, 82, 42, 2, 614, 615, 7, 17, 2, 2, 615, 643, 3, 2, 2, 2, 616, 617, 5, 84, 43, 2, 617, 618, 7, 17, 2, 2, 618, 643, 3, 2, 2, 2, 619, 620, 5, 86, 44, 2, 620, 621, 7, 17, 2, 2, 621, 643, 3, 2, 2, 2, 622, 623, 5, 92, 47, 2, 623, 624, 7, 17, 2, 2, 624, 643, 3, 2, 2, 2, 625, 626, 5, 94, 48, 2, 626, 627, 7, 17, 2, 2, 627, 643, 3, 2, 2, 2, 628, 629, 5, 96, 49, 2, 629, 630, 7, 17, 2, 2, 630, 643, 3, 2, 2, 2, 631, 632, 5, 98, 50, 2, 632, 633, 7, 17, 2, 2, 633, 643, 3, 2, 2, 2, 634, 643, 5, 88, 45, 2, 635, 636, 5, 104, 53, 2, 636, 637, 7, 17, 2, 2, 637, 643, 3, 2, 2, 2, 638, 643, 5, 90, 46, 2, 639, 643, 5, 70, 36, 2, 640, 643, 5, 64, 33, 2, 641, 643, 5, 102, 52, 2, 642, 613, 3, 2, 2, 2, 642, 616, 3, 2, 2, 2, 642, 619, 3, 2, 2, 2, 642, 622, 3, 2, 2, 2, 642, 625, 3, 2, 2, 2, 642, 628, 3, 2, 2, 2, 642, 631, 3, 2, 2, 2, 642, 634, 3, 2, 2, 2, 642, 635, 3, 2, 2, 2, 642, 638, 3, 2, 2, 2, 642, 639, 3, 2, 2, 2, 642, 640, 3, 2, 2, 2, 642, 641, 3, 2, 2, 2, 643, 107, 3, 2, 2, 2, 644, 646, 5, 106, 54, 2, 645, 644, 3, 2, 2, 2, 646, 649, 3, 2, 2, 2, 647, 645, 3, 2, 2, 2, 647, 648, 3, 2, 2, 2, 648, 109, 3, 2, 2, 2, 649, 647, 3, 2, 2, 2, 650, 652, 7, 29, 2, 2, 651, 650, 3, 2, 2, 2, 651, 652, 3, 2, 2, 2, 652, 653, 3, 2, 2, 2, 653, 654, 7, 15, 2, 2, 654, 655, 5, 108, 55, 2, 655, 656, 7, 16, 2, 2, 656, 111, 3, 2, 2, 2, 657, 660, 5, 106, 54, 2, 658, 660, 5, 110, 56, 2, 659, 657, 3, 2, 2, 2, 659, 658, 3, 2, 2, 2, 660, 113, 3, 2, 2, 2, 661, 662, 5, 110, 56, 2, 662, 115, 3, 2, 2, 2, 663, 664, 7, 79, 2, 2, 664, 665, 7, 7, 2, 2, 665, 666, 5, 2, 2, 2, 666, 667, 7, 17, 2, 2, 667, 117, 3, 2, 2, 2, 668, 670, 5, 116, 59, 2, 669, 668, 3, 2, 2, 2, 670, 673, 3, 2, 2, 2, 671, 669, 3, 2, 2, 2, 671, 672, 3, 2, 2, 2, 672, 119, 3, 2, 2, 2, 673, 671, 3, 2, 2, 2, 674, 675, 7, 20, 2, 2, 675, 676, 7, 79, 2, 2, 676, 121, 3, 2, 2, 2, 677, 678, 7, 21, 2, 2, 678, 679, 7, 78, 2, 2, 679, 123, 3, 2, 2, 2, 680, 681, 7, 34, 2, 2, 681, 682, 7, 78, 2, 2, 682, 125, 3, 2, 2, 2, 683, 684, 7, 8, 2, 2, 684, 686, 7, 79, 2, 2, 685, 687, 5, 120, 61, 2, 686, 685, 3, 2, 2, 2, 686, 687, 3, 2, 2, 2, 687, 689, 3, 2, 2, 2, 688, 690, 5, 122, 62, 2, 689, 688, 3, 2, 2, 2, 689, 690, 3, 2, 2, 2, 690, 692, 3, 2, 2, 2, 691, 693, 5, 124, 63, 2, 692, 691, 3, 2, 2, 2, 692, 693, 3, 2, 2, 2, 693, 694, 3, 2, 2, 2, 694, 695, 7, 17, 2, 2, 695, 127, 3, 2, 2, 2, 696, 697, 7, 8, 2, 2, 697, 698, 7, 79, 2, 2, 698, 699, 7, 52, 2, 2, 699, 700, 5, 2, 2, 2, 700, 701, 7, 17, 2, 2, 701, 129, 3, 2, 2, 2, 702, 704, 7, 47, 2, 2, 703, 705, 7, 28, 2, 2, 704, 703, 3, 2, 2, 2, 704, 705, 3, 2, 2, 2, 705, 706, 3, 2, 2, 2, 706, 707, 7, 25, 2, 2, 707, 708, 7, 79, 2, 2, 708, 709, 5, 8, 5, 2, 709, 710, 7, 3, 2, 2, 710, 711, 5, 4, 3, 2, 711, 712, 7, 4, 2, 2, 712, 713, 5, 14, 8, 2, 713, 714, 7, 17, 2, 2, 714, 131, 3, 2, 2, 2, 715, 718, 7, 47, 2, 2, 716, 717, 7, 22, 2, 2, 717, 719, 7, 78, 2, 2, 718, 716, 3, 2, 2, 2, 718, 719, 3, 2, 2, 2, 719, 720, 3, 2, 2, 2, 720, 721, 7, 24, 2, 2, 721, 722, 7, 79, 2, 2, 722, 723, 5, 8, 5, 2, 723, 724, 5, 10, 6, 2, 724, 725, 5, 14, 8, 2, 725, 726, 5, 16, 9, 2, 726, 727, 7, 17, 2, 2, 727, 133, 3, 2, 2, 2, 728, 729, 7, 47, 2, 2, 729, 730, 7, 26, 2, 2, 730, 731, 7, 79, 2, 2, 731, 732, 5, 10, 6, 2, 732, 733, 5, 14, 8, 2, 733, 734, 7, 17, 2, 2, 734, 135, 3, 2, 2, 2, 735, 737, 7, 28, 2, 2, 736, 735, 3, 2, 2, 2, 736, 737, 3, 2, 2, 2, 737, 738, 3, 2, 2, 2, 738, 739, 7, 25, 2, 2, 739, 740, 7, 79, 2, 2, 740, 741, 5, 8, 5, 2, 741, 742, 5, 22, 12, 2, 742, 745, 5, 14, 8, 2, 743, 746, 5, 114, 58, 2, 744, 746, 7, 17, 2, 2, 745, 743, 3, 2, 2, 2, 745, 744, 3, 2, 2, 2, 746, 137, 3, 2, 2, 2, 747, 748, 7, 79, 2, 2, 748, 749, 5, 6, 4, 2, 749, 750, 5, 22, 12, 2, 750, 751, 5, 14, 8, 2, 751, 752, 5, 16, 9, 2, 752, 753, 5, 114, 58, 2, 753, 139, 3, 2, 2, 2, 754, 755, 7, 22, 2, 2, 755, 757, 7, 78, 2, 2, 756, 754, 3, 2, 2, 2, 756, 757, 3, 2, 2, 2, 757, 758, 3, 2, 2, 2, 758, 759, 7, 24, 2, 2, 759, 760, 7, 79, 2, 2, 760, 761, 5, 8, 5, 2, 761, 762, 5, 22, 12, 2, 762, 763, 5, 14, 8, 2, 763, 766, 5, 16, 9, 2, 764, 767, 5, 114, 58, 2, 765, 767, 7, 17, 2, 2, 766, 764, 3, 2, 2, 2, 766, 765, 3, 2, 2, 2, 767, 141, 3, 2, 2, 2, 768, 769, 7, 46, 2, 2, 769, 770, 7, 79, 2, 2, 770, 771, 7, 7, 2, 2, 771, 772, 5, 2, 2, 2, 772, 773, 5, 122, 62, 2, 773, 774, 7, 17, 2, 2, 774, 143, 3, 2, 2, 2, 775, 776, 7, 46, 2, 2, 776, 777, 7, 79, 2, 2, 777, 778, 7, 7, 2, 2, 778, 779, 5, 2, 2, 2, 779, 780, 7, 52, 2, 2, 780, 781, 5, 26, 14, 2, 781, 782, 7, 17, 2, 2, 782, 145, 3, 2, 2, 2, 783, 784, 7, 23, 2, 2, 784, 785, 7, 79, 2, 2, 785, 786, 7, 15, 2, 2, 786, 787, 5, 118, 60, 2, 787, 788, 7, 16, 2, 2, 788, 147, 3, 2, 2, 2, 789, 801, 5, 146, 74, 2, 790, 801, 5, 126, 64, 2, 791, 801, 5, 128, 65, 2, 792, 801, 5, 136, 69, 2, 793, 801, 5, 138, 70, 2, 794, 801, 5, 140, 71, 2, 795, 801, 5, 132, 67, 2, 796, 801, 5, 130, 66, 2, 797, 801, 5, 134, 68, 2, 798, 801, 5, 142, 72, 2, 799, 801, 5, 144, 73, 2, 800, 789, 3, 2, 2, 2, 800, 790, 3, 2, 2, 2, 800, 791, 3, 2, 2, 2, 800, 792, 3, 2, 2, 2, 800, 793, 3, 2, 2, 2, 800, 794, 3, 2, 2, 2, 800, 795, 3, 2, 2, 2, 800, 796, 3, 2, 2, 2, 800, 797, 3, 2, 2, 2, 800, 798, 3, 2, 2, 2, 800, 799, 3, 2, 2, 2, 801, 149, 3, 2, 2, 2, 802, 803, 7, 27, 2, 2, 803, 804, 7, 79, 2, 2, 804, 808, 7, 15, 2, 2, 805, 807, 5, 148, 75, 2, 806, 805, 3, 2, 2, 2, 807, 810, 3, 2, 2, 2, 808, 806, 3, 2, 2, 2, 808, 809, 3, 2, 2, 2, 809, 811, 3, 2, 2, 2, 810, 808, 3, 2, 2, 2, 811, 812, 7, 16, 2, 2, 812, 151, 3, 2, 2, 2, 813, 816, 5, 150, 76, 2, 814, 816, 5, 148, 75, 2, 815, 813, 3, 2, 2, 2, 815, 814, 3, 2, 2, 2, 816, 819, 3, 2, 2, 2, 817, 815, 3, 2, 2, 2, 817, 818, 3, 2, 2, 2, 818, 153, 3, 2, 2, 2, 819, 817, 3, 2, 2, 2, 79, 156, 170, 177, 185, 188, 204, 208, 212, 218, 223, 229, 236, 240, 248, 251, 259, 262, 267, 271, 277, 290, 294, 309, 320, 331, 342, 353, 364, 375, 386, 397, 403, 416, 426, 428, 441, 447, 449, 453, 462, 465, 472, 474, 484, 487, 501, 505, 510, 525, 531, 538, 553, 556, 564, 572, 582, 591, 602, 611, 642, 647, 651, 659, 671, 686, 689, 692, 704, 718, 736, 745, 756, 766, 800, 808, 815, 817]
\ No newline at end of file
diff --git a/deps/v8/src/torque/Torque.tokens b/deps/v8/src/torque/Torque.tokens
new file mode 100644
index 00000000000000..63589b27b74ef9
--- /dev/null
+++ b/deps/v8/src/torque/Torque.tokens
@@ -0,0 +1,154 @@
+T__0=1
+T__1=2
+T__2=3
+T__3=4
+T__4=5
+T__5=6
+T__6=7
+T__7=8
+T__8=9
+T__9=10
+T__10=11
+T__11=12
+T__12=13
+T__13=14
+T__14=15
+T__15=16
+T__16=17
+T__17=18
+T__18=19
+T__19=20
+T__20=21
+MACRO=22
+BUILTIN=23
+RUNTIME=24
+MODULE=25
+JAVASCRIPT=26
+DEFERRED=27
+IF=28
+FOR=29
+WHILE=30
+RETURN=31
+CONSTEXPR=32
+CONTINUE=33
+BREAK=34
+GOTO=35
+OTHERWISE=36
+TRY=37
+LABEL=38
+LABELS=39
+TAIL=40
+ISNT=41
+IS=42
+LET=43
+CONST=44
+EXTERN=45
+ASSERT_TOKEN=46
+CHECK_TOKEN=47
+UNREACHABLE_TOKEN=48
+DEBUG_TOKEN=49
+ASSIGNMENT=50
+ASSIGNMENT_OPERATOR=51
+EQUAL=52
+PLUS=53
+MINUS=54
+MULTIPLY=55
+DIVIDE=56
+MODULO=57
+BIT_OR=58
+BIT_AND=59
+BIT_NOT=60
+MAX=61
+MIN=62
+NOT_EQUAL=63
+LESS_THAN=64
+LESS_THAN_EQUAL=65
+GREATER_THAN=66
+GREATER_THAN_EQUAL=67
+SHIFT_LEFT=68
+SHIFT_RIGHT=69
+SHIFT_RIGHT_ARITHMETIC=70
+VARARGS=71
+EQUALITY_OPERATOR=72
+INCREMENT=73
+DECREMENT=74
+NOT=75
+STRING_LITERAL=76
+IDENTIFIER=77
+WS=78
+BLOCK_COMMENT=79
+LINE_COMMENT=80
+DECIMAL_LITERAL=81
+'('=1
+')'=2
+'=>'=3
+','=4
+':'=5
+'type'=6
+'?'=7
+'||'=8
+'&&'=9
+'.'=10
+'['=11
+']'=12
+'{'=13
+'}'=14
+';'=15
+'of'=16
+'else'=17
+'extends'=18
+'generates'=19
+'operator'=20
+'struct'=21
+'macro'=22
+'builtin'=23
+'runtime'=24
+'module'=25
+'javascript'=26
+'deferred'=27
+'if'=28
+'for'=29
+'while'=30
+'return'=31
+'constexpr'=32
+'continue'=33
+'break'=34
+'goto'=35
+'otherwise'=36
+'try'=37
+'label'=38
+'labels'=39
+'tail'=40
+'isnt'=41
+'is'=42
+'let'=43
+'const'=44
+'extern'=45
+'assert'=46
+'check'=47
+'unreachable'=48
+'debug'=49
+'='=50
+'=='=52
+'+'=53
+'-'=54
+'*'=55
+'/'=56
+'%'=57
+'|'=58
+'&'=59
+'~'=60
+'max'=61
+'min'=62
+'!='=63
+'<'=64
+'<='=65
+'>'=66
+'>='=67
+'<<'=68
+'>>'=69
+'>>>'=70
+'...'=71
+'++'=73
+'--'=74
+'!'=75
diff --git a/deps/v8/src/torque/TorqueBaseListener.h b/deps/v8/src/torque/TorqueBaseListener.h
index 8f6095721b796d..5b2e7613cc286e 100644
--- a/deps/v8/src/torque/TorqueBaseListener.h
+++ b/deps/v8/src/torque/TorqueBaseListener.h
@@ -141,6 +141,16 @@ class TorqueBaseListener : public TorqueListener {
   void exitAssignmentExpression(
       TorqueParser::AssignmentExpressionContext* /*ctx*/) override {}
 
+  void enterStructExpression(
+      TorqueParser::StructExpressionContext* /*ctx*/) override {}
+  void exitStructExpression(
+      TorqueParser::StructExpressionContext* /*ctx*/) override {}
+
+  void enterFunctionPointerExpression(
+      TorqueParser::FunctionPointerExpressionContext* /*ctx*/) override {}
+  void exitFunctionPointerExpression(
+      TorqueParser::FunctionPointerExpressionContext* /*ctx*/) override {}
+
   void enterPrimaryExpression(
       TorqueParser::PrimaryExpressionContext* /*ctx*/) override {}
   void exitPrimaryExpression(
@@ -263,6 +273,16 @@ class TorqueBaseListener : public TorqueListener {
   void enterHelperBody(TorqueParser::HelperBodyContext* /*ctx*/) override {}
   void exitHelperBody(TorqueParser::HelperBodyContext* /*ctx*/) override {}
 
+  void enterFieldDeclaration(
+      TorqueParser::FieldDeclarationContext* /*ctx*/) override {}
+  void exitFieldDeclaration(
+      TorqueParser::FieldDeclarationContext* /*ctx*/) override {}
+
+  void enterFieldListDeclaration(
+      TorqueParser::FieldListDeclarationContext* /*ctx*/) override {}
+  void exitFieldListDeclaration(
+      TorqueParser::FieldListDeclarationContext* /*ctx*/) override {}
+
   void enterExtendsDeclaration(
       TorqueParser::ExtendsDeclarationContext* /*ctx*/) override {}
   void exitExtendsDeclaration(
@@ -323,6 +343,16 @@ class TorqueBaseListener : public TorqueListener {
   void exitExternConstDeclaration(
       TorqueParser::ExternConstDeclarationContext* /*ctx*/) override {}
 
+  void enterConstDeclaration(
+      TorqueParser::ConstDeclarationContext* /*ctx*/) override {}
+  void exitConstDeclaration(
+      TorqueParser::ConstDeclarationContext* /*ctx*/) override {}
+
+  void enterStructDeclaration(
+      TorqueParser::StructDeclarationContext* /*ctx*/) override {}
+  void exitStructDeclaration(
+      TorqueParser::StructDeclarationContext* /*ctx*/) override {}
+
   void enterDeclaration(TorqueParser::DeclarationContext* /*ctx*/) override {}
   void exitDeclaration(TorqueParser::DeclarationContext* /*ctx*/) override {}
 
diff --git a/deps/v8/src/torque/TorqueBaseVisitor.h b/deps/v8/src/torque/TorqueBaseVisitor.h
index a1129c1643f60e..df84a2ead5573a 100644
--- a/deps/v8/src/torque/TorqueBaseVisitor.h
+++ b/deps/v8/src/torque/TorqueBaseVisitor.h
@@ -148,6 +148,16 @@ class TorqueBaseVisitor : public TorqueVisitor {
     return visitChildren(ctx);
   }
 
+  antlrcpp::Any visitStructExpression(
+      TorqueParser::StructExpressionContext* ctx) override {
+    return visitChildren(ctx);
+  }
+
+  antlrcpp::Any visitFunctionPointerExpression(
+      TorqueParser::FunctionPointerExpressionContext* ctx) override {
+    return visitChildren(ctx);
+  }
+
   antlrcpp::Any visitPrimaryExpression(
       TorqueParser::PrimaryExpressionContext* ctx) override {
     return visitChildren(ctx);
@@ -281,6 +291,16 @@ class TorqueBaseVisitor : public TorqueVisitor {
     return visitChildren(ctx);
   }
 
+  antlrcpp::Any visitFieldDeclaration(
+      TorqueParser::FieldDeclarationContext* ctx) override {
+    return visitChildren(ctx);
+  }
+
+  antlrcpp::Any visitFieldListDeclaration(
+      TorqueParser::FieldListDeclarationContext* ctx) override {
+    return visitChildren(ctx);
+  }
+
   antlrcpp::Any visitExtendsDeclaration(
       TorqueParser::ExtendsDeclarationContext* ctx) override {
     return visitChildren(ctx);
@@ -341,6 +361,16 @@ class TorqueBaseVisitor : public TorqueVisitor {
     return visitChildren(ctx);
   }
 
+  antlrcpp::Any visitConstDeclaration(
+      TorqueParser::ConstDeclarationContext* ctx) override {
+    return visitChildren(ctx);
+  }
+
+  antlrcpp::Any visitStructDeclaration(
+      TorqueParser::StructDeclarationContext* ctx) override {
+    return visitChildren(ctx);
+  }
+
   antlrcpp::Any visitDeclaration(
       TorqueParser::DeclarationContext* ctx) override {
     return visitChildren(ctx);
diff --git a/deps/v8/src/torque/TorqueLexer.cpp b/deps/v8/src/torque/TorqueLexer.cpp
index b82fa7a721cffb..b48f0cbf781336 100644
--- a/deps/v8/src/torque/TorqueLexer.cpp
+++ b/deps/v8/src/torque/TorqueLexer.cpp
@@ -92,6 +92,7 @@ std::vector<std::string> TorqueLexer::_ruleNames = {u8"T__0",
                                                     u8"ISNT",
                                                     u8"IS",
                                                     u8"LET",
+                                                    u8"CONST",
                                                     u8"EXTERN",
                                                     u8"ASSERT_TOKEN",
                                                     u8"CHECK_TOKEN",
@@ -152,15 +153,15 @@ std::vector<std::string> TorqueLexer::_literalNames = {"",
                                                        u8"'.'",
                                                        u8"'['",
                                                        u8"']'",
+                                                       u8"'{'",
+                                                       u8"'}'",
                                                        u8"';'",
                                                        u8"'of'",
                                                        u8"'else'",
-                                                       u8"'{'",
-                                                       u8"'}'",
                                                        u8"'extends'",
                                                        u8"'generates'",
                                                        u8"'operator'",
-                                                       u8"'const'",
+                                                       u8"'struct'",
                                                        u8"'macro'",
                                                        u8"'builtin'",
                                                        u8"'runtime'",
@@ -183,6 +184,7 @@ std::vector<std::string> TorqueLexer::_literalNames = {"",
                                                        u8"'isnt'",
                                                        u8"'is'",
                                                        u8"'let'",
+                                                       u8"'const'",
                                                        u8"'extern'",
                                                        u8"'assert'",
                                                        u8"'check'",
@@ -260,6 +262,7 @@ std::vector<std::string> TorqueLexer::_symbolicNames = {
     u8"ISNT",
     u8"IS",
     u8"LET",
+    u8"CONST",
     u8"EXTERN",
     u8"ASSERT_TOKEN",
     u8"CHECK_TOKEN",
@@ -320,7 +323,7 @@ TorqueLexer::Initializer::Initializer() {
 
   _serializedATN = {
       0x3,   0x608b, 0xa72a, 0x8133, 0xb9ed, 0x417c, 0x3be7, 0x7786, 0x5964,
-      0x2,   0x52,   0x290,  0x8,    0x1,    0x4,    0x2,    0x9,    0x2,
+      0x2,   0x53,   0x299,  0x8,    0x1,    0x4,    0x2,    0x9,    0x2,
       0x4,   0x3,    0x9,    0x3,    0x4,    0x4,    0x9,    0x4,    0x4,
       0x5,   0x9,    0x5,    0x4,    0x6,    0x9,    0x6,    0x4,    0x7,
       0x9,   0x7,    0x4,    0x8,    0x9,    0x8,    0x4,    0x9,    0x9,
@@ -357,120 +360,122 @@ TorqueLexer::Initializer::Initializer() {
       0x4d,  0x9,    0x4d,   0x4,    0x4e,   0x9,    0x4e,   0x4,    0x4f,
       0x9,   0x4f,   0x4,    0x50,   0x9,    0x50,   0x4,    0x51,   0x9,
       0x51,  0x4,    0x52,   0x9,    0x52,   0x4,    0x53,   0x9,    0x53,
-      0x4,   0x54,   0x9,    0x54,   0x4,    0x55,   0x9,    0x55,   0x3,
-      0x2,   0x3,    0x2,    0x3,    0x3,    0x3,    0x3,    0x3,    0x4,
-      0x3,   0x4,    0x3,    0x4,    0x3,    0x5,    0x3,    0x5,    0x3,
-      0x6,   0x3,    0x6,    0x3,    0x7,    0x3,    0x7,    0x3,    0x7,
-      0x3,   0x7,    0x3,    0x7,    0x3,    0x8,    0x3,    0x8,    0x3,
-      0x9,   0x3,    0x9,    0x3,    0x9,    0x3,    0xa,    0x3,    0xa,
-      0x3,   0xa,    0x3,    0xb,    0x3,    0xb,    0x3,    0xc,    0x3,
-      0xc,   0x3,    0xd,    0x3,    0xd,    0x3,    0xe,    0x3,    0xe,
-      0x3,   0xf,    0x3,    0xf,    0x3,    0xf,    0x3,    0x10,   0x3,
-      0x10,  0x3,    0x10,   0x3,    0x10,   0x3,    0x10,   0x3,    0x11,
-      0x3,   0x11,   0x3,    0x12,   0x3,    0x12,   0x3,    0x13,   0x3,
-      0x13,  0x3,    0x13,   0x3,    0x13,   0x3,    0x13,   0x3,    0x13,
-      0x3,   0x13,   0x3,    0x13,   0x3,    0x14,   0x3,    0x14,   0x3,
+      0x4,   0x54,   0x9,    0x54,   0x4,    0x55,   0x9,    0x55,   0x4,
+      0x56,  0x9,    0x56,   0x3,    0x2,    0x3,    0x2,    0x3,    0x3,
+      0x3,   0x3,    0x3,    0x4,    0x3,    0x4,    0x3,    0x4,    0x3,
+      0x5,   0x3,    0x5,    0x3,    0x6,    0x3,    0x6,    0x3,    0x7,
+      0x3,   0x7,    0x3,    0x7,    0x3,    0x7,    0x3,    0x7,    0x3,
+      0x8,   0x3,    0x8,    0x3,    0x9,    0x3,    0x9,    0x3,    0x9,
+      0x3,   0xa,    0x3,    0xa,    0x3,    0xa,    0x3,    0xb,    0x3,
+      0xb,   0x3,    0xc,    0x3,    0xc,    0x3,    0xd,    0x3,    0xd,
+      0x3,   0xe,    0x3,    0xe,    0x3,    0xf,    0x3,    0xf,    0x3,
+      0x10,  0x3,    0x10,   0x3,    0x11,   0x3,    0x11,   0x3,    0x11,
+      0x3,   0x12,   0x3,    0x12,   0x3,    0x12,   0x3,    0x12,   0x3,
+      0x12,  0x3,    0x13,   0x3,    0x13,   0x3,    0x13,   0x3,    0x13,
+      0x3,   0x13,   0x3,    0x13,   0x3,    0x13,   0x3,    0x13,   0x3,
       0x14,  0x3,    0x14,   0x3,    0x14,   0x3,    0x14,   0x3,    0x14,
-      0x3,   0x14,   0x3,    0x14,   0x3,    0x14,   0x3,    0x15,   0x3,
-      0x15,  0x3,    0x15,   0x3,    0x15,   0x3,    0x15,   0x3,    0x15,
-      0x3,   0x15,   0x3,    0x15,   0x3,    0x15,   0x3,    0x16,   0x3,
-      0x16,  0x3,    0x16,   0x3,    0x16,   0x3,    0x16,   0x3,    0x16,
-      0x3,   0x17,   0x3,    0x17,   0x3,    0x17,   0x3,    0x17,   0x3,
-      0x17,  0x3,    0x17,   0x3,    0x18,   0x3,    0x18,   0x3,    0x18,
+      0x3,   0x14,   0x3,    0x14,   0x3,    0x14,   0x3,    0x14,   0x3,
+      0x14,  0x3,    0x15,   0x3,    0x15,   0x3,    0x15,   0x3,    0x15,
+      0x3,   0x15,   0x3,    0x15,   0x3,    0x15,   0x3,    0x15,   0x3,
+      0x15,  0x3,    0x16,   0x3,    0x16,   0x3,    0x16,   0x3,    0x16,
+      0x3,   0x16,   0x3,    0x16,   0x3,    0x16,   0x3,    0x17,   0x3,
+      0x17,  0x3,    0x17,   0x3,    0x17,   0x3,    0x17,   0x3,    0x17,
       0x3,   0x18,   0x3,    0x18,   0x3,    0x18,   0x3,    0x18,   0x3,
-      0x18,  0x3,    0x19,   0x3,    0x19,   0x3,    0x19,   0x3,    0x19,
+      0x18,  0x3,    0x18,   0x3,    0x18,   0x3,    0x18,   0x3,    0x19,
       0x3,   0x19,   0x3,    0x19,   0x3,    0x19,   0x3,    0x19,   0x3,
-      0x1a,  0x3,    0x1a,   0x3,    0x1a,   0x3,    0x1a,   0x3,    0x1a,
-      0x3,   0x1a,   0x3,    0x1a,   0x3,    0x1b,   0x3,    0x1b,   0x3,
-      0x1b,  0x3,    0x1b,   0x3,    0x1b,   0x3,    0x1b,   0x3,    0x1b,
+      0x19,  0x3,    0x19,   0x3,    0x19,   0x3,    0x1a,   0x3,    0x1a,
+      0x3,   0x1a,   0x3,    0x1a,   0x3,    0x1a,   0x3,    0x1a,   0x3,
+      0x1a,  0x3,    0x1b,   0x3,    0x1b,   0x3,    0x1b,   0x3,    0x1b,
       0x3,   0x1b,   0x3,    0x1b,   0x3,    0x1b,   0x3,    0x1b,   0x3,
-      0x1c,  0x3,    0x1c,   0x3,    0x1c,   0x3,    0x1c,   0x3,    0x1c,
+      0x1b,  0x3,    0x1b,   0x3,    0x1b,   0x3,    0x1c,   0x3,    0x1c,
       0x3,   0x1c,   0x3,    0x1c,   0x3,    0x1c,   0x3,    0x1c,   0x3,
-      0x1d,  0x3,    0x1d,   0x3,    0x1d,   0x3,    0x1e,   0x3,    0x1e,
-      0x3,   0x1e,   0x3,    0x1e,   0x3,    0x1f,   0x3,    0x1f,   0x3,
-      0x1f,  0x3,    0x1f,   0x3,    0x1f,   0x3,    0x1f,   0x3,    0x20,
-      0x3,   0x20,   0x3,    0x20,   0x3,    0x20,   0x3,    0x20,   0x3,
-      0x20,  0x3,    0x20,   0x3,    0x21,   0x3,    0x21,   0x3,    0x21,
+      0x1c,  0x3,    0x1c,   0x3,    0x1c,   0x3,    0x1d,   0x3,    0x1d,
+      0x3,   0x1d,   0x3,    0x1e,   0x3,    0x1e,   0x3,    0x1e,   0x3,
+      0x1e,  0x3,    0x1f,   0x3,    0x1f,   0x3,    0x1f,   0x3,    0x1f,
+      0x3,   0x1f,   0x3,    0x1f,   0x3,    0x20,   0x3,    0x20,   0x3,
+      0x20,  0x3,    0x20,   0x3,    0x20,   0x3,    0x20,   0x3,    0x20,
       0x3,   0x21,   0x3,    0x21,   0x3,    0x21,   0x3,    0x21,   0x3,
-      0x21,  0x3,    0x21,   0x3,    0x21,   0x3,    0x22,   0x3,    0x22,
-      0x3,   0x22,   0x3,    0x22,   0x3,    0x22,   0x3,    0x22,   0x3,
-      0x22,  0x3,    0x22,   0x3,    0x22,   0x3,    0x23,   0x3,    0x23,
-      0x3,   0x23,   0x3,    0x23,   0x3,    0x23,   0x3,    0x23,   0x3,
-      0x24,  0x3,    0x24,   0x3,    0x24,   0x3,    0x24,   0x3,    0x24,
-      0x3,   0x25,   0x3,    0x25,   0x3,    0x25,   0x3,    0x25,   0x3,
+      0x21,  0x3,    0x21,   0x3,    0x21,   0x3,    0x21,   0x3,    0x21,
+      0x3,   0x21,   0x3,    0x22,   0x3,    0x22,   0x3,    0x22,   0x3,
+      0x22,  0x3,    0x22,   0x3,    0x22,   0x3,    0x22,   0x3,    0x22,
+      0x3,   0x22,   0x3,    0x23,   0x3,    0x23,   0x3,    0x23,   0x3,
+      0x23,  0x3,    0x23,   0x3,    0x23,   0x3,    0x24,   0x3,    0x24,
+      0x3,   0x24,   0x3,    0x24,   0x3,    0x24,   0x3,    0x25,   0x3,
       0x25,  0x3,    0x25,   0x3,    0x25,   0x3,    0x25,   0x3,    0x25,
-      0x3,   0x25,   0x3,    0x26,   0x3,    0x26,   0x3,    0x26,   0x3,
-      0x26,  0x3,    0x27,   0x3,    0x27,   0x3,    0x27,   0x3,    0x27,
-      0x3,   0x27,   0x3,    0x27,   0x3,    0x28,   0x3,    0x28,   0x3,
-      0x28,  0x3,    0x28,   0x3,    0x28,   0x3,    0x28,   0x3,    0x28,
-      0x3,   0x29,   0x3,    0x29,   0x3,    0x29,   0x3,    0x29,   0x3,
-      0x29,  0x3,    0x2a,   0x3,    0x2a,   0x3,    0x2a,   0x3,    0x2a,
-      0x3,   0x2a,   0x3,    0x2b,   0x3,    0x2b,   0x3,    0x2b,   0x3,
-      0x2c,  0x3,    0x2c,   0x3,    0x2c,   0x3,    0x2c,   0x3,    0x2d,
-      0x3,   0x2d,   0x3,    0x2d,   0x3,    0x2d,   0x3,    0x2d,   0x3,
-      0x2d,  0x3,    0x2d,   0x3,    0x2e,   0x3,    0x2e,   0x3,    0x2e,
+      0x3,   0x25,   0x3,    0x25,   0x3,    0x25,   0x3,    0x25,   0x3,
+      0x26,  0x3,    0x26,   0x3,    0x26,   0x3,    0x26,   0x3,    0x27,
+      0x3,   0x27,   0x3,    0x27,   0x3,    0x27,   0x3,    0x27,   0x3,
+      0x27,  0x3,    0x28,   0x3,    0x28,   0x3,    0x28,   0x3,    0x28,
+      0x3,   0x28,   0x3,    0x28,   0x3,    0x28,   0x3,    0x29,   0x3,
+      0x29,  0x3,    0x29,   0x3,    0x29,   0x3,    0x29,   0x3,    0x2a,
+      0x3,   0x2a,   0x3,    0x2a,   0x3,    0x2a,   0x3,    0x2a,   0x3,
+      0x2b,  0x3,    0x2b,   0x3,    0x2b,   0x3,    0x2c,   0x3,    0x2c,
+      0x3,   0x2c,   0x3,    0x2c,   0x3,    0x2d,   0x3,    0x2d,   0x3,
+      0x2d,  0x3,    0x2d,   0x3,    0x2d,   0x3,    0x2d,   0x3,    0x2e,
       0x3,   0x2e,   0x3,    0x2e,   0x3,    0x2e,   0x3,    0x2e,   0x3,
-      0x2f,  0x3,    0x2f,   0x3,    0x2f,   0x3,    0x2f,   0x3,    0x2f,
-      0x3,   0x2f,   0x3,    0x30,   0x3,    0x30,   0x3,    0x30,   0x3,
+      0x2e,  0x3,    0x2e,   0x3,    0x2f,   0x3,    0x2f,   0x3,    0x2f,
+      0x3,   0x2f,   0x3,    0x2f,   0x3,    0x2f,   0x3,    0x2f,   0x3,
       0x30,  0x3,    0x30,   0x3,    0x30,   0x3,    0x30,   0x3,    0x30,
-      0x3,   0x30,   0x3,    0x30,   0x3,    0x30,   0x3,    0x30,   0x3,
+      0x3,   0x30,   0x3,    0x31,   0x3,    0x31,   0x3,    0x31,   0x3,
       0x31,  0x3,    0x31,   0x3,    0x31,   0x3,    0x31,   0x3,    0x31,
-      0x3,   0x31,   0x3,    0x32,   0x3,    0x32,   0x3,    0x33,   0x3,
-      0x33,  0x3,    0x33,   0x3,    0x33,   0x3,    0x33,   0x3,    0x33,
-      0x3,   0x33,   0x3,    0x33,   0x3,    0x33,   0x3,    0x33,   0x3,
-      0x33,  0x3,    0x33,   0x3,    0x33,   0x3,    0x33,   0x3,    0x33,
-      0x3,   0x33,   0x3,    0x33,   0x3,    0x33,   0x3,    0x33,   0x3,
-      0x33,  0x3,    0x33,   0x3,    0x33,   0x3,    0x33,   0x3,    0x33,
-      0x3,   0x33,   0x3,    0x33,   0x5,    0x33,   0x1ca,  0xa,    0x33,
-      0x3,   0x34,   0x3,    0x34,   0x3,    0x34,   0x3,    0x35,   0x3,
-      0x35,  0x3,    0x36,   0x3,    0x36,   0x3,    0x37,   0x3,    0x37,
-      0x3,   0x38,   0x3,    0x38,   0x3,    0x39,   0x3,    0x39,   0x3,
-      0x3a,  0x3,    0x3a,   0x3,    0x3b,   0x3,    0x3b,   0x3,    0x3c,
-      0x3,   0x3c,   0x3,    0x3d,   0x3,    0x3d,   0x3,    0x3d,   0x3,
-      0x3d,  0x3,    0x3e,   0x3,    0x3e,   0x3,    0x3e,   0x3,    0x3e,
-      0x3,   0x3f,   0x3,    0x3f,   0x3,    0x3f,   0x3,    0x40,   0x3,
-      0x40,  0x3,    0x41,   0x3,    0x41,   0x3,    0x41,   0x3,    0x42,
-      0x3,   0x42,   0x3,    0x43,   0x3,    0x43,   0x3,    0x43,   0x3,
-      0x44,  0x3,    0x44,   0x3,    0x44,   0x3,    0x45,   0x3,    0x45,
-      0x3,   0x45,   0x3,    0x46,   0x3,    0x46,   0x3,    0x46,   0x3,
-      0x46,  0x3,    0x47,   0x3,    0x47,   0x3,    0x47,   0x3,    0x47,
-      0x3,   0x48,   0x3,    0x48,   0x5,    0x48,   0x204,  0xa,    0x48,
-      0x3,   0x49,   0x3,    0x49,   0x3,    0x49,   0x3,    0x4a,   0x3,
-      0x4a,  0x3,    0x4a,   0x3,    0x4b,   0x3,    0x4b,   0x3,    0x4c,
-      0x3,   0x4c,   0x3,    0x4c,   0x7,    0x4c,   0x211,  0xa,    0x4c,
-      0xc,   0x4c,   0xe,    0x4c,   0x214,  0xb,    0x4c,   0x3,    0x4c,
-      0x3,   0x4c,   0x3,    0x4c,   0x3,    0x4c,   0x7,    0x4c,   0x21a,
-      0xa,   0x4c,   0xc,    0x4c,   0xe,    0x4c,   0x21d,  0xb,    0x4c,
-      0x3,   0x4c,   0x5,    0x4c,   0x220,  0xa,    0x4c,   0x3,    0x4d,
-      0x3,   0x4d,   0x3,    0x4d,   0x3,    0x4e,   0x3,    0x4e,   0x7,
-      0x4e,  0x227,  0xa,    0x4e,   0xc,    0x4e,   0xe,    0x4e,   0x22a,
-      0xb,   0x4e,   0x3,    0x4f,   0x6,    0x4f,   0x22d,  0xa,    0x4f,
-      0xd,   0x4f,   0xe,    0x4f,   0x22e,  0x3,    0x4f,   0x3,    0x4f,
-      0x3,   0x50,   0x3,    0x50,   0x3,    0x50,   0x3,    0x50,   0x7,
-      0x50,  0x237,  0xa,    0x50,   0xc,    0x50,   0xe,    0x50,   0x23a,
-      0xb,   0x50,   0x3,    0x50,   0x3,    0x50,   0x3,    0x50,   0x5,
-      0x50,  0x23f,  0xa,    0x50,   0x3,    0x50,   0x3,    0x50,   0x3,
-      0x51,  0x3,    0x51,   0x3,    0x51,   0x3,    0x51,   0x7,    0x51,
-      0x247, 0xa,    0x51,   0xc,    0x51,   0xe,    0x51,   0x24a,  0xb,
-      0x51,  0x3,    0x51,   0x3,    0x51,   0x3,    0x52,   0x3,    0x52,
-      0x3,   0x53,   0x3,    0x53,   0x3,    0x53,   0x7,    0x53,   0x253,
-      0xa,   0x53,   0xc,    0x53,   0xe,    0x53,   0x256,  0xb,    0x53,
-      0x5,   0x53,   0x258,  0xa,    0x53,   0x3,    0x54,   0x3,    0x54,
-      0x5,   0x54,   0x25c,  0xa,    0x54,   0x3,    0x54,   0x6,    0x54,
-      0x25f, 0xa,    0x54,   0xd,    0x54,   0xe,    0x54,   0x260,  0x3,
-      0x55,  0x5,    0x55,   0x264,  0xa,    0x55,   0x3,    0x55,   0x3,
-      0x55,  0x3,    0x55,   0x7,    0x55,   0x269,  0xa,    0x55,   0xc,
-      0x55,  0xe,    0x55,   0x26c,  0xb,    0x55,   0x3,    0x55,   0x5,
-      0x55,  0x26f,  0xa,    0x55,   0x3,    0x55,   0x5,    0x55,   0x272,
-      0xa,   0x55,   0x3,    0x55,   0x3,    0x55,   0x6,    0x55,   0x276,
-      0xa,   0x55,   0xd,    0x55,   0xe,    0x55,   0x277,  0x3,    0x55,
-      0x5,   0x55,   0x27b,  0xa,    0x55,   0x3,    0x55,   0x5,    0x55,
-      0x27e, 0xa,    0x55,   0x3,    0x55,   0x3,    0x55,   0x5,    0x55,
-      0x282, 0xa,    0x55,   0x3,    0x55,   0x5,    0x55,   0x285,  0xa,
-      0x55,  0x3,    0x55,   0x3,    0x55,   0x3,    0x55,   0x3,    0x55,
-      0x6,   0x55,   0x28b,  0xa,    0x55,   0xd,    0x55,   0xe,    0x55,
-      0x28c, 0x5,    0x55,   0x28f,  0xa,    0x55,   0x3,    0x238,  0x2,
-      0x56,  0x3,    0x3,    0x5,    0x4,    0x7,    0x5,    0x9,    0x6,
+      0x3,   0x31,   0x3,    0x31,   0x3,    0x31,   0x3,    0x31,   0x3,
+      0x32,  0x3,    0x32,   0x3,    0x32,   0x3,    0x32,   0x3,    0x32,
+      0x3,   0x32,   0x3,    0x33,   0x3,    0x33,   0x3,    0x34,   0x3,
+      0x34,  0x3,    0x34,   0x3,    0x34,   0x3,    0x34,   0x3,    0x34,
+      0x3,   0x34,   0x3,    0x34,   0x3,    0x34,   0x3,    0x34,   0x3,
+      0x34,  0x3,    0x34,   0x3,    0x34,   0x3,    0x34,   0x3,    0x34,
+      0x3,   0x34,   0x3,    0x34,   0x3,    0x34,   0x3,    0x34,   0x3,
+      0x34,  0x3,    0x34,   0x3,    0x34,   0x3,    0x34,   0x3,    0x34,
+      0x3,   0x34,   0x3,    0x34,   0x5,    0x34,   0x1d3,  0xa,    0x34,
+      0x3,   0x35,   0x3,    0x35,   0x3,    0x35,   0x3,    0x36,   0x3,
+      0x36,  0x3,    0x37,   0x3,    0x37,   0x3,    0x38,   0x3,    0x38,
+      0x3,   0x39,   0x3,    0x39,   0x3,    0x3a,   0x3,    0x3a,   0x3,
+      0x3b,  0x3,    0x3b,   0x3,    0x3c,   0x3,    0x3c,   0x3,    0x3d,
+      0x3,   0x3d,   0x3,    0x3e,   0x3,    0x3e,   0x3,    0x3e,   0x3,
+      0x3e,  0x3,    0x3f,   0x3,    0x3f,   0x3,    0x3f,   0x3,    0x3f,
+      0x3,   0x40,   0x3,    0x40,   0x3,    0x40,   0x3,    0x41,   0x3,
+      0x41,  0x3,    0x42,   0x3,    0x42,   0x3,    0x42,   0x3,    0x43,
+      0x3,   0x43,   0x3,    0x44,   0x3,    0x44,   0x3,    0x44,   0x3,
+      0x45,  0x3,    0x45,   0x3,    0x45,   0x3,    0x46,   0x3,    0x46,
+      0x3,   0x46,   0x3,    0x47,   0x3,    0x47,   0x3,    0x47,   0x3,
+      0x47,  0x3,    0x48,   0x3,    0x48,   0x3,    0x48,   0x3,    0x48,
+      0x3,   0x49,   0x3,    0x49,   0x5,    0x49,   0x20d,  0xa,    0x49,
+      0x3,   0x4a,   0x3,    0x4a,   0x3,    0x4a,   0x3,    0x4b,   0x3,
+      0x4b,  0x3,    0x4b,   0x3,    0x4c,   0x3,    0x4c,   0x3,    0x4d,
+      0x3,   0x4d,   0x3,    0x4d,   0x7,    0x4d,   0x21a,  0xa,    0x4d,
+      0xc,   0x4d,   0xe,    0x4d,   0x21d,  0xb,    0x4d,   0x3,    0x4d,
+      0x3,   0x4d,   0x3,    0x4d,   0x3,    0x4d,   0x7,    0x4d,   0x223,
+      0xa,   0x4d,   0xc,    0x4d,   0xe,    0x4d,   0x226,  0xb,    0x4d,
+      0x3,   0x4d,   0x5,    0x4d,   0x229,  0xa,    0x4d,   0x3,    0x4e,
+      0x3,   0x4e,   0x3,    0x4e,   0x3,    0x4f,   0x3,    0x4f,   0x7,
+      0x4f,  0x230,  0xa,    0x4f,   0xc,    0x4f,   0xe,    0x4f,   0x233,
+      0xb,   0x4f,   0x3,    0x50,   0x6,    0x50,   0x236,  0xa,    0x50,
+      0xd,   0x50,   0xe,    0x50,   0x237,  0x3,    0x50,   0x3,    0x50,
+      0x3,   0x51,   0x3,    0x51,   0x3,    0x51,   0x3,    0x51,   0x7,
+      0x51,  0x240,  0xa,    0x51,   0xc,    0x51,   0xe,    0x51,   0x243,
+      0xb,   0x51,   0x3,    0x51,   0x3,    0x51,   0x3,    0x51,   0x5,
+      0x51,  0x248,  0xa,    0x51,   0x3,    0x51,   0x3,    0x51,   0x3,
+      0x52,  0x3,    0x52,   0x3,    0x52,   0x3,    0x52,   0x7,    0x52,
+      0x250, 0xa,    0x52,   0xc,    0x52,   0xe,    0x52,   0x253,  0xb,
+      0x52,  0x3,    0x52,   0x3,    0x52,   0x3,    0x53,   0x3,    0x53,
+      0x3,   0x54,   0x3,    0x54,   0x3,    0x54,   0x7,    0x54,   0x25c,
+      0xa,   0x54,   0xc,    0x54,   0xe,    0x54,   0x25f,  0xb,    0x54,
+      0x5,   0x54,   0x261,  0xa,    0x54,   0x3,    0x55,   0x3,    0x55,
+      0x5,   0x55,   0x265,  0xa,    0x55,   0x3,    0x55,   0x6,    0x55,
+      0x268, 0xa,    0x55,   0xd,    0x55,   0xe,    0x55,   0x269,  0x3,
+      0x56,  0x5,    0x56,   0x26d,  0xa,    0x56,   0x3,    0x56,   0x3,
+      0x56,  0x3,    0x56,   0x7,    0x56,   0x272,  0xa,    0x56,   0xc,
+      0x56,  0xe,    0x56,   0x275,  0xb,    0x56,   0x3,    0x56,   0x5,
+      0x56,  0x278,  0xa,    0x56,   0x3,    0x56,   0x5,    0x56,   0x27b,
+      0xa,   0x56,   0x3,    0x56,   0x3,    0x56,   0x6,    0x56,   0x27f,
+      0xa,   0x56,   0xd,    0x56,   0xe,    0x56,   0x280,  0x3,    0x56,
+      0x5,   0x56,   0x284,  0xa,    0x56,   0x3,    0x56,   0x5,    0x56,
+      0x287, 0xa,    0x56,   0x3,    0x56,   0x3,    0x56,   0x5,    0x56,
+      0x28b, 0xa,    0x56,   0x3,    0x56,   0x5,    0x56,   0x28e,  0xa,
+      0x56,  0x3,    0x56,   0x3,    0x56,   0x3,    0x56,   0x3,    0x56,
+      0x6,   0x56,   0x294,  0xa,    0x56,   0xd,    0x56,   0xe,    0x56,
+      0x295, 0x5,    0x56,   0x298,  0xa,    0x56,   0x3,    0x241,  0x2,
+      0x57,  0x3,    0x3,    0x5,    0x4,    0x7,    0x5,    0x9,    0x6,
       0xb,   0x7,    0xd,    0x8,    0xf,    0x9,    0x11,   0xa,    0x13,
       0xb,   0x15,   0xc,    0x17,   0xd,    0x19,   0xe,    0x1b,   0xf,
       0x1d,  0x10,   0x1f,   0x11,   0x21,   0x12,   0x23,   0x13,   0x25,
@@ -486,481 +491,488 @@ TorqueLexer::Initializer::Initializer() {
       0x77,  0x3d,   0x79,   0x3e,   0x7b,   0x3f,   0x7d,   0x40,   0x7f,
       0x41,  0x81,   0x42,   0x83,   0x43,   0x85,   0x44,   0x87,   0x45,
       0x89,  0x46,   0x8b,   0x47,   0x8d,   0x48,   0x8f,   0x49,   0x91,
-      0x4a,  0x93,   0x4b,   0x95,   0x4c,   0x97,   0x4d,   0x99,   0x2,
-      0x9b,  0x4e,   0x9d,   0x4f,   0x9f,   0x50,   0xa1,   0x51,   0xa3,
-      0x2,   0xa5,   0x2,    0xa7,   0x2,    0xa9,   0x52,   0x3,    0x2,
-      0xe,   0x6,    0x2,    0xc,    0xc,    0xf,    0xf,    0x24,   0x24,
-      0x5e,  0x5e,   0x6,    0x2,    0xc,    0xc,    0xf,    0xf,    0x29,
-      0x29,  0x5e,   0x5e,   0x7,    0x2,    0x24,   0x24,   0x29,   0x29,
-      0x5e,  0x5e,   0x70,   0x70,   0x74,   0x74,   0x4,    0x2,    0x43,
-      0x5c,  0x63,   0x7c,   0x6,    0x2,    0x32,   0x3b,   0x43,   0x5c,
-      0x61,  0x61,   0x63,   0x7c,   0x5,    0x2,    0xb,    0xc,    0xe,
-      0xf,   0x22,   0x22,   0x4,    0x2,    0xc,    0xc,    0xf,    0xf,
-      0x3,   0x2,    0x32,   0x3b,   0x3,    0x2,    0x33,   0x3b,   0x4,
-      0x2,   0x47,   0x47,   0x67,   0x67,   0x4,    0x2,    0x2d,   0x2d,
-      0x2f,  0x2f,   0x5,    0x2,    0x32,   0x3b,   0x43,   0x48,   0x63,
-      0x68,  0x2,    0x2b1,  0x2,    0x3,    0x3,    0x2,    0x2,    0x2,
-      0x2,   0x5,    0x3,    0x2,    0x2,    0x2,    0x2,    0x7,    0x3,
-      0x2,   0x2,    0x2,    0x2,    0x9,    0x3,    0x2,    0x2,    0x2,
-      0x2,   0xb,    0x3,    0x2,    0x2,    0x2,    0x2,    0xd,    0x3,
-      0x2,   0x2,    0x2,    0x2,    0xf,    0x3,    0x2,    0x2,    0x2,
-      0x2,   0x11,   0x3,    0x2,    0x2,    0x2,    0x2,    0x13,   0x3,
-      0x2,   0x2,    0x2,    0x2,    0x15,   0x3,    0x2,    0x2,    0x2,
-      0x2,   0x17,   0x3,    0x2,    0x2,    0x2,    0x2,    0x19,   0x3,
-      0x2,   0x2,    0x2,    0x2,    0x1b,   0x3,    0x2,    0x2,    0x2,
-      0x2,   0x1d,   0x3,    0x2,    0x2,    0x2,    0x2,    0x1f,   0x3,
-      0x2,   0x2,    0x2,    0x2,    0x21,   0x3,    0x2,    0x2,    0x2,
-      0x2,   0x23,   0x3,    0x2,    0x2,    0x2,    0x2,    0x25,   0x3,
-      0x2,   0x2,    0x2,    0x2,    0x27,   0x3,    0x2,    0x2,    0x2,
-      0x2,   0x29,   0x3,    0x2,    0x2,    0x2,    0x2,    0x2b,   0x3,
-      0x2,   0x2,    0x2,    0x2,    0x2d,   0x3,    0x2,    0x2,    0x2,
-      0x2,   0x2f,   0x3,    0x2,    0x2,    0x2,    0x2,    0x31,   0x3,
-      0x2,   0x2,    0x2,    0x2,    0x33,   0x3,    0x2,    0x2,    0x2,
-      0x2,   0x35,   0x3,    0x2,    0x2,    0x2,    0x2,    0x37,   0x3,
-      0x2,   0x2,    0x2,    0x2,    0x39,   0x3,    0x2,    0x2,    0x2,
-      0x2,   0x3b,   0x3,    0x2,    0x2,    0x2,    0x2,    0x3d,   0x3,
-      0x2,   0x2,    0x2,    0x2,    0x3f,   0x3,    0x2,    0x2,    0x2,
-      0x2,   0x41,   0x3,    0x2,    0x2,    0x2,    0x2,    0x43,   0x3,
-      0x2,   0x2,    0x2,    0x2,    0x45,   0x3,    0x2,    0x2,    0x2,
-      0x2,   0x47,   0x3,    0x2,    0x2,    0x2,    0x2,    0x49,   0x3,
-      0x2,   0x2,    0x2,    0x2,    0x4b,   0x3,    0x2,    0x2,    0x2,
-      0x2,   0x4d,   0x3,    0x2,    0x2,    0x2,    0x2,    0x4f,   0x3,
-      0x2,   0x2,    0x2,    0x2,    0x51,   0x3,    0x2,    0x2,    0x2,
-      0x2,   0x53,   0x3,    0x2,    0x2,    0x2,    0x2,    0x55,   0x3,
-      0x2,   0x2,    0x2,    0x2,    0x57,   0x3,    0x2,    0x2,    0x2,
-      0x2,   0x59,   0x3,    0x2,    0x2,    0x2,    0x2,    0x5b,   0x3,
-      0x2,   0x2,    0x2,    0x2,    0x5d,   0x3,    0x2,    0x2,    0x2,
-      0x2,   0x5f,   0x3,    0x2,    0x2,    0x2,    0x2,    0x61,   0x3,
-      0x2,   0x2,    0x2,    0x2,    0x63,   0x3,    0x2,    0x2,    0x2,
-      0x2,   0x65,   0x3,    0x2,    0x2,    0x2,    0x2,    0x67,   0x3,
-      0x2,   0x2,    0x2,    0x2,    0x69,   0x3,    0x2,    0x2,    0x2,
-      0x2,   0x6b,   0x3,    0x2,    0x2,    0x2,    0x2,    0x6d,   0x3,
-      0x2,   0x2,    0x2,    0x2,    0x6f,   0x3,    0x2,    0x2,    0x2,
-      0x2,   0x71,   0x3,    0x2,    0x2,    0x2,    0x2,    0x73,   0x3,
-      0x2,   0x2,    0x2,    0x2,    0x75,   0x3,    0x2,    0x2,    0x2,
-      0x2,   0x77,   0x3,    0x2,    0x2,    0x2,    0x2,    0x79,   0x3,
-      0x2,   0x2,    0x2,    0x2,    0x7b,   0x3,    0x2,    0x2,    0x2,
-      0x2,   0x7d,   0x3,    0x2,    0x2,    0x2,    0x2,    0x7f,   0x3,
-      0x2,   0x2,    0x2,    0x2,    0x81,   0x3,    0x2,    0x2,    0x2,
-      0x2,   0x83,   0x3,    0x2,    0x2,    0x2,    0x2,    0x85,   0x3,
-      0x2,   0x2,    0x2,    0x2,    0x87,   0x3,    0x2,    0x2,    0x2,
-      0x2,   0x89,   0x3,    0x2,    0x2,    0x2,    0x2,    0x8b,   0x3,
-      0x2,   0x2,    0x2,    0x2,    0x8d,   0x3,    0x2,    0x2,    0x2,
-      0x2,   0x8f,   0x3,    0x2,    0x2,    0x2,    0x2,    0x91,   0x3,
-      0x2,   0x2,    0x2,    0x2,    0x93,   0x3,    0x2,    0x2,    0x2,
-      0x2,   0x95,   0x3,    0x2,    0x2,    0x2,    0x2,    0x97,   0x3,
-      0x2,   0x2,    0x2,    0x2,    0x9b,   0x3,    0x2,    0x2,    0x2,
-      0x2,   0x9d,   0x3,    0x2,    0x2,    0x2,    0x2,    0x9f,   0x3,
-      0x2,   0x2,    0x2,    0x2,    0xa1,   0x3,    0x2,    0x2,    0x2,
-      0x2,   0xa9,   0x3,    0x2,    0x2,    0x2,    0x3,    0xab,   0x3,
-      0x2,   0x2,    0x2,    0x5,    0xad,   0x3,    0x2,    0x2,    0x2,
-      0x7,   0xaf,   0x3,    0x2,    0x2,    0x2,    0x9,    0xb2,   0x3,
-      0x2,   0x2,    0x2,    0xb,    0xb4,   0x3,    0x2,    0x2,    0x2,
-      0xd,   0xb6,   0x3,    0x2,    0x2,    0x2,    0xf,    0xbb,   0x3,
-      0x2,   0x2,    0x2,    0x11,   0xbd,   0x3,    0x2,    0x2,    0x2,
-      0x13,  0xc0,   0x3,    0x2,    0x2,    0x2,    0x15,   0xc3,   0x3,
-      0x2,   0x2,    0x2,    0x17,   0xc5,   0x3,    0x2,    0x2,    0x2,
-      0x19,  0xc7,   0x3,    0x2,    0x2,    0x2,    0x1b,   0xc9,   0x3,
-      0x2,   0x2,    0x2,    0x1d,   0xcb,   0x3,    0x2,    0x2,    0x2,
-      0x1f,  0xce,   0x3,    0x2,    0x2,    0x2,    0x21,   0xd3,   0x3,
-      0x2,   0x2,    0x2,    0x23,   0xd5,   0x3,    0x2,    0x2,    0x2,
-      0x25,  0xd7,   0x3,    0x2,    0x2,    0x2,    0x27,   0xdf,   0x3,
-      0x2,   0x2,    0x2,    0x29,   0xe9,   0x3,    0x2,    0x2,    0x2,
-      0x2b,  0xf2,   0x3,    0x2,    0x2,    0x2,    0x2d,   0xf8,   0x3,
-      0x2,   0x2,    0x2,    0x2f,   0xfe,   0x3,    0x2,    0x2,    0x2,
-      0x31,  0x106,  0x3,    0x2,    0x2,    0x2,    0x33,   0x10e,  0x3,
-      0x2,   0x2,    0x2,    0x35,   0x115,  0x3,    0x2,    0x2,    0x2,
-      0x37,  0x120,  0x3,    0x2,    0x2,    0x2,    0x39,   0x129,  0x3,
-      0x2,   0x2,    0x2,    0x3b,   0x12c,  0x3,    0x2,    0x2,    0x2,
-      0x3d,  0x130,  0x3,    0x2,    0x2,    0x2,    0x3f,   0x136,  0x3,
-      0x2,   0x2,    0x2,    0x41,   0x13d,  0x3,    0x2,    0x2,    0x2,
-      0x43,  0x147,  0x3,    0x2,    0x2,    0x2,    0x45,   0x150,  0x3,
-      0x2,   0x2,    0x2,    0x47,   0x156,  0x3,    0x2,    0x2,    0x2,
-      0x49,  0x15b,  0x3,    0x2,    0x2,    0x2,    0x4b,   0x165,  0x3,
-      0x2,   0x2,    0x2,    0x4d,   0x169,  0x3,    0x2,    0x2,    0x2,
-      0x4f,  0x16f,  0x3,    0x2,    0x2,    0x2,    0x51,   0x176,  0x3,
-      0x2,   0x2,    0x2,    0x53,   0x17b,  0x3,    0x2,    0x2,    0x2,
-      0x55,  0x180,  0x3,    0x2,    0x2,    0x2,    0x57,   0x183,  0x3,
-      0x2,   0x2,    0x2,    0x59,   0x187,  0x3,    0x2,    0x2,    0x2,
-      0x5b,  0x18e,  0x3,    0x2,    0x2,    0x2,    0x5d,   0x195,  0x3,
-      0x2,   0x2,    0x2,    0x5f,   0x19b,  0x3,    0x2,    0x2,    0x2,
-      0x61,  0x1a7,  0x3,    0x2,    0x2,    0x2,    0x63,   0x1ad,  0x3,
-      0x2,   0x2,    0x2,    0x65,   0x1c9,  0x3,    0x2,    0x2,    0x2,
-      0x67,  0x1cb,  0x3,    0x2,    0x2,    0x2,    0x69,   0x1ce,  0x3,
-      0x2,   0x2,    0x2,    0x6b,   0x1d0,  0x3,    0x2,    0x2,    0x2,
-      0x6d,  0x1d2,  0x3,    0x2,    0x2,    0x2,    0x6f,   0x1d4,  0x3,
-      0x2,   0x2,    0x2,    0x71,   0x1d6,  0x3,    0x2,    0x2,    0x2,
-      0x73,  0x1d8,  0x3,    0x2,    0x2,    0x2,    0x75,   0x1da,  0x3,
-      0x2,   0x2,    0x2,    0x77,   0x1dc,  0x3,    0x2,    0x2,    0x2,
-      0x79,  0x1de,  0x3,    0x2,    0x2,    0x2,    0x7b,   0x1e2,  0x3,
-      0x2,   0x2,    0x2,    0x7d,   0x1e6,  0x3,    0x2,    0x2,    0x2,
-      0x7f,  0x1e9,  0x3,    0x2,    0x2,    0x2,    0x81,   0x1eb,  0x3,
-      0x2,   0x2,    0x2,    0x83,   0x1ee,  0x3,    0x2,    0x2,    0x2,
-      0x85,  0x1f0,  0x3,    0x2,    0x2,    0x2,    0x87,   0x1f3,  0x3,
-      0x2,   0x2,    0x2,    0x89,   0x1f6,  0x3,    0x2,    0x2,    0x2,
-      0x8b,  0x1f9,  0x3,    0x2,    0x2,    0x2,    0x8d,   0x1fd,  0x3,
-      0x2,   0x2,    0x2,    0x8f,   0x203,  0x3,    0x2,    0x2,    0x2,
-      0x91,  0x205,  0x3,    0x2,    0x2,    0x2,    0x93,   0x208,  0x3,
-      0x2,   0x2,    0x2,    0x95,   0x20b,  0x3,    0x2,    0x2,    0x2,
-      0x97,  0x21f,  0x3,    0x2,    0x2,    0x2,    0x99,   0x221,  0x3,
-      0x2,   0x2,    0x2,    0x9b,   0x224,  0x3,    0x2,    0x2,    0x2,
-      0x9d,  0x22c,  0x3,    0x2,    0x2,    0x2,    0x9f,   0x232,  0x3,
-      0x2,   0x2,    0x2,    0xa1,   0x242,  0x3,    0x2,    0x2,    0x2,
-      0xa3,  0x24d,  0x3,    0x2,    0x2,    0x2,    0xa5,   0x257,  0x3,
-      0x2,   0x2,    0x2,    0xa7,   0x259,  0x3,    0x2,    0x2,    0x2,
-      0xa9,  0x28e,  0x3,    0x2,    0x2,    0x2,    0xab,   0xac,   0x7,
-      0x2a,  0x2,    0x2,    0xac,   0x4,    0x3,    0x2,    0x2,    0x2,
-      0xad,  0xae,   0x7,    0x2b,   0x2,    0x2,    0xae,   0x6,    0x3,
-      0x2,   0x2,    0x2,    0xaf,   0xb0,   0x7,    0x3f,   0x2,    0x2,
-      0xb0,  0xb1,   0x7,    0x40,   0x2,    0x2,    0xb1,   0x8,    0x3,
-      0x2,   0x2,    0x2,    0xb2,   0xb3,   0x7,    0x2e,   0x2,    0x2,
-      0xb3,  0xa,    0x3,    0x2,    0x2,    0x2,    0xb4,   0xb5,   0x7,
-      0x3c,  0x2,    0x2,    0xb5,   0xc,    0x3,    0x2,    0x2,    0x2,
-      0xb6,  0xb7,   0x7,    0x76,   0x2,    0x2,    0xb7,   0xb8,   0x7,
-      0x7b,  0x2,    0x2,    0xb8,   0xb9,   0x7,    0x72,   0x2,    0x2,
-      0xb9,  0xba,   0x7,    0x67,   0x2,    0x2,    0xba,   0xe,    0x3,
-      0x2,   0x2,    0x2,    0xbb,   0xbc,   0x7,    0x41,   0x2,    0x2,
-      0xbc,  0x10,   0x3,    0x2,    0x2,    0x2,    0xbd,   0xbe,   0x7,
-      0x7e,  0x2,    0x2,    0xbe,   0xbf,   0x7,    0x7e,   0x2,    0x2,
-      0xbf,  0x12,   0x3,    0x2,    0x2,    0x2,    0xc0,   0xc1,   0x7,
-      0x28,  0x2,    0x2,    0xc1,   0xc2,   0x7,    0x28,   0x2,    0x2,
-      0xc2,  0x14,   0x3,    0x2,    0x2,    0x2,    0xc3,   0xc4,   0x7,
-      0x30,  0x2,    0x2,    0xc4,   0x16,   0x3,    0x2,    0x2,    0x2,
-      0xc5,  0xc6,   0x7,    0x5d,   0x2,    0x2,    0xc6,   0x18,   0x3,
-      0x2,   0x2,    0x2,    0xc7,   0xc8,   0x7,    0x5f,   0x2,    0x2,
-      0xc8,  0x1a,   0x3,    0x2,    0x2,    0x2,    0xc9,   0xca,   0x7,
-      0x3d,  0x2,    0x2,    0xca,   0x1c,   0x3,    0x2,    0x2,    0x2,
-      0xcb,  0xcc,   0x7,    0x71,   0x2,    0x2,    0xcc,   0xcd,   0x7,
-      0x68,  0x2,    0x2,    0xcd,   0x1e,   0x3,    0x2,    0x2,    0x2,
-      0xce,  0xcf,   0x7,    0x67,   0x2,    0x2,    0xcf,   0xd0,   0x7,
-      0x6e,  0x2,    0x2,    0xd0,   0xd1,   0x7,    0x75,   0x2,    0x2,
-      0xd1,  0xd2,   0x7,    0x67,   0x2,    0x2,    0xd2,   0x20,   0x3,
-      0x2,   0x2,    0x2,    0xd3,   0xd4,   0x7,    0x7d,   0x2,    0x2,
-      0xd4,  0x22,   0x3,    0x2,    0x2,    0x2,    0xd5,   0xd6,   0x7,
-      0x7f,  0x2,    0x2,    0xd6,   0x24,   0x3,    0x2,    0x2,    0x2,
-      0xd7,  0xd8,   0x7,    0x67,   0x2,    0x2,    0xd8,   0xd9,   0x7,
-      0x7a,  0x2,    0x2,    0xd9,   0xda,   0x7,    0x76,   0x2,    0x2,
-      0xda,  0xdb,   0x7,    0x67,   0x2,    0x2,    0xdb,   0xdc,   0x7,
-      0x70,  0x2,    0x2,    0xdc,   0xdd,   0x7,    0x66,   0x2,    0x2,
-      0xdd,  0xde,   0x7,    0x75,   0x2,    0x2,    0xde,   0x26,   0x3,
-      0x2,   0x2,    0x2,    0xdf,   0xe0,   0x7,    0x69,   0x2,    0x2,
-      0xe0,  0xe1,   0x7,    0x67,   0x2,    0x2,    0xe1,   0xe2,   0x7,
-      0x70,  0x2,    0x2,    0xe2,   0xe3,   0x7,    0x67,   0x2,    0x2,
-      0xe3,  0xe4,   0x7,    0x74,   0x2,    0x2,    0xe4,   0xe5,   0x7,
-      0x63,  0x2,    0x2,    0xe5,   0xe6,   0x7,    0x76,   0x2,    0x2,
-      0xe6,  0xe7,   0x7,    0x67,   0x2,    0x2,    0xe7,   0xe8,   0x7,
-      0x75,  0x2,    0x2,    0xe8,   0x28,   0x3,    0x2,    0x2,    0x2,
-      0xe9,  0xea,   0x7,    0x71,   0x2,    0x2,    0xea,   0xeb,   0x7,
-      0x72,  0x2,    0x2,    0xeb,   0xec,   0x7,    0x67,   0x2,    0x2,
-      0xec,  0xed,   0x7,    0x74,   0x2,    0x2,    0xed,   0xee,   0x7,
-      0x63,  0x2,    0x2,    0xee,   0xef,   0x7,    0x76,   0x2,    0x2,
-      0xef,  0xf0,   0x7,    0x71,   0x2,    0x2,    0xf0,   0xf1,   0x7,
-      0x74,  0x2,    0x2,    0xf1,   0x2a,   0x3,    0x2,    0x2,    0x2,
-      0xf2,  0xf3,   0x7,    0x65,   0x2,    0x2,    0xf3,   0xf4,   0x7,
-      0x71,  0x2,    0x2,    0xf4,   0xf5,   0x7,    0x70,   0x2,    0x2,
-      0xf5,  0xf6,   0x7,    0x75,   0x2,    0x2,    0xf6,   0xf7,   0x7,
-      0x76,  0x2,    0x2,    0xf7,   0x2c,   0x3,    0x2,    0x2,    0x2,
-      0xf8,  0xf9,   0x7,    0x6f,   0x2,    0x2,    0xf9,   0xfa,   0x7,
-      0x63,  0x2,    0x2,    0xfa,   0xfb,   0x7,    0x65,   0x2,    0x2,
-      0xfb,  0xfc,   0x7,    0x74,   0x2,    0x2,    0xfc,   0xfd,   0x7,
-      0x71,  0x2,    0x2,    0xfd,   0x2e,   0x3,    0x2,    0x2,    0x2,
-      0xfe,  0xff,   0x7,    0x64,   0x2,    0x2,    0xff,   0x100,  0x7,
-      0x77,  0x2,    0x2,    0x100,  0x101,  0x7,    0x6b,   0x2,    0x2,
-      0x101, 0x102,  0x7,    0x6e,   0x2,    0x2,    0x102,  0x103,  0x7,
-      0x76,  0x2,    0x2,    0x103,  0x104,  0x7,    0x6b,   0x2,    0x2,
-      0x104, 0x105,  0x7,    0x70,   0x2,    0x2,    0x105,  0x30,   0x3,
-      0x2,   0x2,    0x2,    0x106,  0x107,  0x7,    0x74,   0x2,    0x2,
-      0x107, 0x108,  0x7,    0x77,   0x2,    0x2,    0x108,  0x109,  0x7,
-      0x70,  0x2,    0x2,    0x109,  0x10a,  0x7,    0x76,   0x2,    0x2,
-      0x10a, 0x10b,  0x7,    0x6b,   0x2,    0x2,    0x10b,  0x10c,  0x7,
-      0x6f,  0x2,    0x2,    0x10c,  0x10d,  0x7,    0x67,   0x2,    0x2,
-      0x10d, 0x32,   0x3,    0x2,    0x2,    0x2,    0x10e,  0x10f,  0x7,
-      0x6f,  0x2,    0x2,    0x10f,  0x110,  0x7,    0x71,   0x2,    0x2,
-      0x110, 0x111,  0x7,    0x66,   0x2,    0x2,    0x111,  0x112,  0x7,
-      0x77,  0x2,    0x2,    0x112,  0x113,  0x7,    0x6e,   0x2,    0x2,
-      0x113, 0x114,  0x7,    0x67,   0x2,    0x2,    0x114,  0x34,   0x3,
-      0x2,   0x2,    0x2,    0x115,  0x116,  0x7,    0x6c,   0x2,    0x2,
-      0x116, 0x117,  0x7,    0x63,   0x2,    0x2,    0x117,  0x118,  0x7,
-      0x78,  0x2,    0x2,    0x118,  0x119,  0x7,    0x63,   0x2,    0x2,
-      0x119, 0x11a,  0x7,    0x75,   0x2,    0x2,    0x11a,  0x11b,  0x7,
-      0x65,  0x2,    0x2,    0x11b,  0x11c,  0x7,    0x74,   0x2,    0x2,
-      0x11c, 0x11d,  0x7,    0x6b,   0x2,    0x2,    0x11d,  0x11e,  0x7,
-      0x72,  0x2,    0x2,    0x11e,  0x11f,  0x7,    0x76,   0x2,    0x2,
-      0x11f, 0x36,   0x3,    0x2,    0x2,    0x2,    0x120,  0x121,  0x7,
-      0x66,  0x2,    0x2,    0x121,  0x122,  0x7,    0x67,   0x2,    0x2,
-      0x122, 0x123,  0x7,    0x68,   0x2,    0x2,    0x123,  0x124,  0x7,
-      0x67,  0x2,    0x2,    0x124,  0x125,  0x7,    0x74,   0x2,    0x2,
-      0x125, 0x126,  0x7,    0x74,   0x2,    0x2,    0x126,  0x127,  0x7,
-      0x67,  0x2,    0x2,    0x127,  0x128,  0x7,    0x66,   0x2,    0x2,
-      0x128, 0x38,   0x3,    0x2,    0x2,    0x2,    0x129,  0x12a,  0x7,
-      0x6b,  0x2,    0x2,    0x12a,  0x12b,  0x7,    0x68,   0x2,    0x2,
-      0x12b, 0x3a,   0x3,    0x2,    0x2,    0x2,    0x12c,  0x12d,  0x7,
-      0x68,  0x2,    0x2,    0x12d,  0x12e,  0x7,    0x71,   0x2,    0x2,
-      0x12e, 0x12f,  0x7,    0x74,   0x2,    0x2,    0x12f,  0x3c,   0x3,
-      0x2,   0x2,    0x2,    0x130,  0x131,  0x7,    0x79,   0x2,    0x2,
-      0x131, 0x132,  0x7,    0x6a,   0x2,    0x2,    0x132,  0x133,  0x7,
-      0x6b,  0x2,    0x2,    0x133,  0x134,  0x7,    0x6e,   0x2,    0x2,
-      0x134, 0x135,  0x7,    0x67,   0x2,    0x2,    0x135,  0x3e,   0x3,
-      0x2,   0x2,    0x2,    0x136,  0x137,  0x7,    0x74,   0x2,    0x2,
-      0x137, 0x138,  0x7,    0x67,   0x2,    0x2,    0x138,  0x139,  0x7,
-      0x76,  0x2,    0x2,    0x139,  0x13a,  0x7,    0x77,   0x2,    0x2,
-      0x13a, 0x13b,  0x7,    0x74,   0x2,    0x2,    0x13b,  0x13c,  0x7,
-      0x70,  0x2,    0x2,    0x13c,  0x40,   0x3,    0x2,    0x2,    0x2,
-      0x13d, 0x13e,  0x7,    0x65,   0x2,    0x2,    0x13e,  0x13f,  0x7,
-      0x71,  0x2,    0x2,    0x13f,  0x140,  0x7,    0x70,   0x2,    0x2,
-      0x140, 0x141,  0x7,    0x75,   0x2,    0x2,    0x141,  0x142,  0x7,
-      0x76,  0x2,    0x2,    0x142,  0x143,  0x7,    0x67,   0x2,    0x2,
-      0x143, 0x144,  0x7,    0x7a,   0x2,    0x2,    0x144,  0x145,  0x7,
-      0x72,  0x2,    0x2,    0x145,  0x146,  0x7,    0x74,   0x2,    0x2,
-      0x146, 0x42,   0x3,    0x2,    0x2,    0x2,    0x147,  0x148,  0x7,
-      0x65,  0x2,    0x2,    0x148,  0x149,  0x7,    0x71,   0x2,    0x2,
-      0x149, 0x14a,  0x7,    0x70,   0x2,    0x2,    0x14a,  0x14b,  0x7,
-      0x76,  0x2,    0x2,    0x14b,  0x14c,  0x7,    0x6b,   0x2,    0x2,
-      0x14c, 0x14d,  0x7,    0x70,   0x2,    0x2,    0x14d,  0x14e,  0x7,
-      0x77,  0x2,    0x2,    0x14e,  0x14f,  0x7,    0x67,   0x2,    0x2,
-      0x14f, 0x44,   0x3,    0x2,    0x2,    0x2,    0x150,  0x151,  0x7,
-      0x64,  0x2,    0x2,    0x151,  0x152,  0x7,    0x74,   0x2,    0x2,
-      0x152, 0x153,  0x7,    0x67,   0x2,    0x2,    0x153,  0x154,  0x7,
-      0x63,  0x2,    0x2,    0x154,  0x155,  0x7,    0x6d,   0x2,    0x2,
-      0x155, 0x46,   0x3,    0x2,    0x2,    0x2,    0x156,  0x157,  0x7,
-      0x69,  0x2,    0x2,    0x157,  0x158,  0x7,    0x71,   0x2,    0x2,
-      0x158, 0x159,  0x7,    0x76,   0x2,    0x2,    0x159,  0x15a,  0x7,
-      0x71,  0x2,    0x2,    0x15a,  0x48,   0x3,    0x2,    0x2,    0x2,
-      0x15b, 0x15c,  0x7,    0x71,   0x2,    0x2,    0x15c,  0x15d,  0x7,
-      0x76,  0x2,    0x2,    0x15d,  0x15e,  0x7,    0x6a,   0x2,    0x2,
-      0x15e, 0x15f,  0x7,    0x67,   0x2,    0x2,    0x15f,  0x160,  0x7,
-      0x74,  0x2,    0x2,    0x160,  0x161,  0x7,    0x79,   0x2,    0x2,
-      0x161, 0x162,  0x7,    0x6b,   0x2,    0x2,    0x162,  0x163,  0x7,
-      0x75,  0x2,    0x2,    0x163,  0x164,  0x7,    0x67,   0x2,    0x2,
-      0x164, 0x4a,   0x3,    0x2,    0x2,    0x2,    0x165,  0x166,  0x7,
-      0x76,  0x2,    0x2,    0x166,  0x167,  0x7,    0x74,   0x2,    0x2,
-      0x167, 0x168,  0x7,    0x7b,   0x2,    0x2,    0x168,  0x4c,   0x3,
-      0x2,   0x2,    0x2,    0x169,  0x16a,  0x7,    0x6e,   0x2,    0x2,
-      0x16a, 0x16b,  0x7,    0x63,   0x2,    0x2,    0x16b,  0x16c,  0x7,
-      0x64,  0x2,    0x2,    0x16c,  0x16d,  0x7,    0x67,   0x2,    0x2,
-      0x16d, 0x16e,  0x7,    0x6e,   0x2,    0x2,    0x16e,  0x4e,   0x3,
-      0x2,   0x2,    0x2,    0x16f,  0x170,  0x7,    0x6e,   0x2,    0x2,
-      0x170, 0x171,  0x7,    0x63,   0x2,    0x2,    0x171,  0x172,  0x7,
-      0x64,  0x2,    0x2,    0x172,  0x173,  0x7,    0x67,   0x2,    0x2,
-      0x173, 0x174,  0x7,    0x6e,   0x2,    0x2,    0x174,  0x175,  0x7,
-      0x75,  0x2,    0x2,    0x175,  0x50,   0x3,    0x2,    0x2,    0x2,
-      0x176, 0x177,  0x7,    0x76,   0x2,    0x2,    0x177,  0x178,  0x7,
-      0x63,  0x2,    0x2,    0x178,  0x179,  0x7,    0x6b,   0x2,    0x2,
-      0x179, 0x17a,  0x7,    0x6e,   0x2,    0x2,    0x17a,  0x52,   0x3,
-      0x2,   0x2,    0x2,    0x17b,  0x17c,  0x7,    0x6b,   0x2,    0x2,
-      0x17c, 0x17d,  0x7,    0x75,   0x2,    0x2,    0x17d,  0x17e,  0x7,
-      0x70,  0x2,    0x2,    0x17e,  0x17f,  0x7,    0x76,   0x2,    0x2,
-      0x17f, 0x54,   0x3,    0x2,    0x2,    0x2,    0x180,  0x181,  0x7,
-      0x6b,  0x2,    0x2,    0x181,  0x182,  0x7,    0x75,   0x2,    0x2,
-      0x182, 0x56,   0x3,    0x2,    0x2,    0x2,    0x183,  0x184,  0x7,
-      0x6e,  0x2,    0x2,    0x184,  0x185,  0x7,    0x67,   0x2,    0x2,
-      0x185, 0x186,  0x7,    0x76,   0x2,    0x2,    0x186,  0x58,   0x3,
-      0x2,   0x2,    0x2,    0x187,  0x188,  0x7,    0x67,   0x2,    0x2,
-      0x188, 0x189,  0x7,    0x7a,   0x2,    0x2,    0x189,  0x18a,  0x7,
-      0x76,  0x2,    0x2,    0x18a,  0x18b,  0x7,    0x67,   0x2,    0x2,
-      0x18b, 0x18c,  0x7,    0x74,   0x2,    0x2,    0x18c,  0x18d,  0x7,
-      0x70,  0x2,    0x2,    0x18d,  0x5a,   0x3,    0x2,    0x2,    0x2,
-      0x18e, 0x18f,  0x7,    0x63,   0x2,    0x2,    0x18f,  0x190,  0x7,
-      0x75,  0x2,    0x2,    0x190,  0x191,  0x7,    0x75,   0x2,    0x2,
-      0x191, 0x192,  0x7,    0x67,   0x2,    0x2,    0x192,  0x193,  0x7,
-      0x74,  0x2,    0x2,    0x193,  0x194,  0x7,    0x76,   0x2,    0x2,
-      0x194, 0x5c,   0x3,    0x2,    0x2,    0x2,    0x195,  0x196,  0x7,
-      0x65,  0x2,    0x2,    0x196,  0x197,  0x7,    0x6a,   0x2,    0x2,
-      0x197, 0x198,  0x7,    0x67,   0x2,    0x2,    0x198,  0x199,  0x7,
-      0x65,  0x2,    0x2,    0x199,  0x19a,  0x7,    0x6d,   0x2,    0x2,
-      0x19a, 0x5e,   0x3,    0x2,    0x2,    0x2,    0x19b,  0x19c,  0x7,
-      0x77,  0x2,    0x2,    0x19c,  0x19d,  0x7,    0x70,   0x2,    0x2,
-      0x19d, 0x19e,  0x7,    0x74,   0x2,    0x2,    0x19e,  0x19f,  0x7,
-      0x67,  0x2,    0x2,    0x19f,  0x1a0,  0x7,    0x63,   0x2,    0x2,
-      0x1a0, 0x1a1,  0x7,    0x65,   0x2,    0x2,    0x1a1,  0x1a2,  0x7,
-      0x6a,  0x2,    0x2,    0x1a2,  0x1a3,  0x7,    0x63,   0x2,    0x2,
-      0x1a3, 0x1a4,  0x7,    0x64,   0x2,    0x2,    0x1a4,  0x1a5,  0x7,
-      0x6e,  0x2,    0x2,    0x1a5,  0x1a6,  0x7,    0x67,   0x2,    0x2,
-      0x1a6, 0x60,   0x3,    0x2,    0x2,    0x2,    0x1a7,  0x1a8,  0x7,
-      0x66,  0x2,    0x2,    0x1a8,  0x1a9,  0x7,    0x67,   0x2,    0x2,
-      0x1a9, 0x1aa,  0x7,    0x64,   0x2,    0x2,    0x1aa,  0x1ab,  0x7,
-      0x77,  0x2,    0x2,    0x1ab,  0x1ac,  0x7,    0x69,   0x2,    0x2,
-      0x1ac, 0x62,   0x3,    0x2,    0x2,    0x2,    0x1ad,  0x1ae,  0x7,
-      0x3f,  0x2,    0x2,    0x1ae,  0x64,   0x3,    0x2,    0x2,    0x2,
-      0x1af, 0x1b0,  0x7,    0x2c,   0x2,    0x2,    0x1b0,  0x1ca,  0x7,
-      0x3f,  0x2,    0x2,    0x1b1,  0x1b2,  0x7,    0x31,   0x2,    0x2,
-      0x1b2, 0x1ca,  0x7,    0x3f,   0x2,    0x2,    0x1b3,  0x1b4,  0x7,
-      0x27,  0x2,    0x2,    0x1b4,  0x1ca,  0x7,    0x3f,   0x2,    0x2,
-      0x1b5, 0x1b6,  0x7,    0x2d,   0x2,    0x2,    0x1b6,  0x1ca,  0x7,
-      0x3f,  0x2,    0x2,    0x1b7,  0x1b8,  0x7,    0x2f,   0x2,    0x2,
-      0x1b8, 0x1ca,  0x7,    0x3f,   0x2,    0x2,    0x1b9,  0x1ba,  0x7,
-      0x3e,  0x2,    0x2,    0x1ba,  0x1bb,  0x7,    0x3e,   0x2,    0x2,
-      0x1bb, 0x1ca,  0x7,    0x3f,   0x2,    0x2,    0x1bc,  0x1bd,  0x7,
-      0x40,  0x2,    0x2,    0x1bd,  0x1be,  0x7,    0x40,   0x2,    0x2,
-      0x1be, 0x1ca,  0x7,    0x3f,   0x2,    0x2,    0x1bf,  0x1c0,  0x7,
-      0x40,  0x2,    0x2,    0x1c0,  0x1c1,  0x7,    0x40,   0x2,    0x2,
-      0x1c1, 0x1c2,  0x7,    0x40,   0x2,    0x2,    0x1c2,  0x1ca,  0x7,
-      0x3f,  0x2,    0x2,    0x1c3,  0x1c4,  0x7,    0x28,   0x2,    0x2,
-      0x1c4, 0x1ca,  0x7,    0x3f,   0x2,    0x2,    0x1c5,  0x1c6,  0x7,
-      0x60,  0x2,    0x2,    0x1c6,  0x1ca,  0x7,    0x3f,   0x2,    0x2,
-      0x1c7, 0x1c8,  0x7,    0x7e,   0x2,    0x2,    0x1c8,  0x1ca,  0x7,
-      0x3f,  0x2,    0x2,    0x1c9,  0x1af,  0x3,    0x2,    0x2,    0x2,
-      0x1c9, 0x1b1,  0x3,    0x2,    0x2,    0x2,    0x1c9,  0x1b3,  0x3,
-      0x2,   0x2,    0x2,    0x1c9,  0x1b5,  0x3,    0x2,    0x2,    0x2,
-      0x1c9, 0x1b7,  0x3,    0x2,    0x2,    0x2,    0x1c9,  0x1b9,  0x3,
-      0x2,   0x2,    0x2,    0x1c9,  0x1bc,  0x3,    0x2,    0x2,    0x2,
-      0x1c9, 0x1bf,  0x3,    0x2,    0x2,    0x2,    0x1c9,  0x1c3,  0x3,
-      0x2,   0x2,    0x2,    0x1c9,  0x1c5,  0x3,    0x2,    0x2,    0x2,
-      0x1c9, 0x1c7,  0x3,    0x2,    0x2,    0x2,    0x1ca,  0x66,   0x3,
-      0x2,   0x2,    0x2,    0x1cb,  0x1cc,  0x7,    0x3f,   0x2,    0x2,
-      0x1cc, 0x1cd,  0x7,    0x3f,   0x2,    0x2,    0x1cd,  0x68,   0x3,
-      0x2,   0x2,    0x2,    0x1ce,  0x1cf,  0x7,    0x2d,   0x2,    0x2,
-      0x1cf, 0x6a,   0x3,    0x2,    0x2,    0x2,    0x1d0,  0x1d1,  0x7,
-      0x2f,  0x2,    0x2,    0x1d1,  0x6c,   0x3,    0x2,    0x2,    0x2,
-      0x1d2, 0x1d3,  0x7,    0x2c,   0x2,    0x2,    0x1d3,  0x6e,   0x3,
-      0x2,   0x2,    0x2,    0x1d4,  0x1d5,  0x7,    0x31,   0x2,    0x2,
-      0x1d5, 0x70,   0x3,    0x2,    0x2,    0x2,    0x1d6,  0x1d7,  0x7,
-      0x27,  0x2,    0x2,    0x1d7,  0x72,   0x3,    0x2,    0x2,    0x2,
-      0x1d8, 0x1d9,  0x7,    0x7e,   0x2,    0x2,    0x1d9,  0x74,   0x3,
-      0x2,   0x2,    0x2,    0x1da,  0x1db,  0x7,    0x28,   0x2,    0x2,
-      0x1db, 0x76,   0x3,    0x2,    0x2,    0x2,    0x1dc,  0x1dd,  0x7,
-      0x80,  0x2,    0x2,    0x1dd,  0x78,   0x3,    0x2,    0x2,    0x2,
-      0x1de, 0x1df,  0x7,    0x6f,   0x2,    0x2,    0x1df,  0x1e0,  0x7,
-      0x63,  0x2,    0x2,    0x1e0,  0x1e1,  0x7,    0x7a,   0x2,    0x2,
-      0x1e1, 0x7a,   0x3,    0x2,    0x2,    0x2,    0x1e2,  0x1e3,  0x7,
-      0x6f,  0x2,    0x2,    0x1e3,  0x1e4,  0x7,    0x6b,   0x2,    0x2,
-      0x1e4, 0x1e5,  0x7,    0x70,   0x2,    0x2,    0x1e5,  0x7c,   0x3,
-      0x2,   0x2,    0x2,    0x1e6,  0x1e7,  0x7,    0x23,   0x2,    0x2,
-      0x1e7, 0x1e8,  0x7,    0x3f,   0x2,    0x2,    0x1e8,  0x7e,   0x3,
-      0x2,   0x2,    0x2,    0x1e9,  0x1ea,  0x7,    0x3e,   0x2,    0x2,
-      0x1ea, 0x80,   0x3,    0x2,    0x2,    0x2,    0x1eb,  0x1ec,  0x7,
-      0x3e,  0x2,    0x2,    0x1ec,  0x1ed,  0x7,    0x3f,   0x2,    0x2,
-      0x1ed, 0x82,   0x3,    0x2,    0x2,    0x2,    0x1ee,  0x1ef,  0x7,
-      0x40,  0x2,    0x2,    0x1ef,  0x84,   0x3,    0x2,    0x2,    0x2,
-      0x1f0, 0x1f1,  0x7,    0x40,   0x2,    0x2,    0x1f1,  0x1f2,  0x7,
-      0x3f,  0x2,    0x2,    0x1f2,  0x86,   0x3,    0x2,    0x2,    0x2,
-      0x1f3, 0x1f4,  0x7,    0x3e,   0x2,    0x2,    0x1f4,  0x1f5,  0x7,
-      0x3e,  0x2,    0x2,    0x1f5,  0x88,   0x3,    0x2,    0x2,    0x2,
-      0x1f6, 0x1f7,  0x7,    0x40,   0x2,    0x2,    0x1f7,  0x1f8,  0x7,
-      0x40,  0x2,    0x2,    0x1f8,  0x8a,   0x3,    0x2,    0x2,    0x2,
-      0x1f9, 0x1fa,  0x7,    0x40,   0x2,    0x2,    0x1fa,  0x1fb,  0x7,
-      0x40,  0x2,    0x2,    0x1fb,  0x1fc,  0x7,    0x40,   0x2,    0x2,
-      0x1fc, 0x8c,   0x3,    0x2,    0x2,    0x2,    0x1fd,  0x1fe,  0x7,
-      0x30,  0x2,    0x2,    0x1fe,  0x1ff,  0x7,    0x30,   0x2,    0x2,
-      0x1ff, 0x200,  0x7,    0x30,   0x2,    0x2,    0x200,  0x8e,   0x3,
-      0x2,   0x2,    0x2,    0x201,  0x204,  0x5,    0x67,   0x34,   0x2,
-      0x202, 0x204,  0x5,    0x7d,   0x3f,   0x2,    0x203,  0x201,  0x3,
-      0x2,   0x2,    0x2,    0x203,  0x202,  0x3,    0x2,    0x2,    0x2,
-      0x204, 0x90,   0x3,    0x2,    0x2,    0x2,    0x205,  0x206,  0x7,
-      0x2d,  0x2,    0x2,    0x206,  0x207,  0x7,    0x2d,   0x2,    0x2,
-      0x207, 0x92,   0x3,    0x2,    0x2,    0x2,    0x208,  0x209,  0x7,
-      0x2f,  0x2,    0x2,    0x209,  0x20a,  0x7,    0x2f,   0x2,    0x2,
-      0x20a, 0x94,   0x3,    0x2,    0x2,    0x2,    0x20b,  0x20c,  0x7,
-      0x23,  0x2,    0x2,    0x20c,  0x96,   0x3,    0x2,    0x2,    0x2,
-      0x20d, 0x212,  0x7,    0x24,   0x2,    0x2,    0x20e,  0x211,  0x5,
-      0x99,  0x4d,   0x2,    0x20f,  0x211,  0xa,    0x2,    0x2,    0x2,
-      0x210, 0x20e,  0x3,    0x2,    0x2,    0x2,    0x210,  0x20f,  0x3,
-      0x2,   0x2,    0x2,    0x211,  0x214,  0x3,    0x2,    0x2,    0x2,
-      0x212, 0x210,  0x3,    0x2,    0x2,    0x2,    0x212,  0x213,  0x3,
-      0x2,   0x2,    0x2,    0x213,  0x215,  0x3,    0x2,    0x2,    0x2,
-      0x214, 0x212,  0x3,    0x2,    0x2,    0x2,    0x215,  0x220,  0x7,
-      0x24,  0x2,    0x2,    0x216,  0x21b,  0x7,    0x29,   0x2,    0x2,
-      0x217, 0x21a,  0x5,    0x99,   0x4d,   0x2,    0x218,  0x21a,  0xa,
-      0x3,   0x2,    0x2,    0x219,  0x217,  0x3,    0x2,    0x2,    0x2,
-      0x219, 0x218,  0x3,    0x2,    0x2,    0x2,    0x21a,  0x21d,  0x3,
-      0x2,   0x2,    0x2,    0x21b,  0x219,  0x3,    0x2,    0x2,    0x2,
-      0x21b, 0x21c,  0x3,    0x2,    0x2,    0x2,    0x21c,  0x21e,  0x3,
-      0x2,   0x2,    0x2,    0x21d,  0x21b,  0x3,    0x2,    0x2,    0x2,
-      0x21e, 0x220,  0x7,    0x29,   0x2,    0x2,    0x21f,  0x20d,  0x3,
-      0x2,   0x2,    0x2,    0x21f,  0x216,  0x3,    0x2,    0x2,    0x2,
-      0x220, 0x98,   0x3,    0x2,    0x2,    0x2,    0x221,  0x222,  0x7,
-      0x5e,  0x2,    0x2,    0x222,  0x223,  0x9,    0x4,    0x2,    0x2,
-      0x223, 0x9a,   0x3,    0x2,    0x2,    0x2,    0x224,  0x228,  0x9,
-      0x5,   0x2,    0x2,    0x225,  0x227,  0x9,    0x6,    0x2,    0x2,
-      0x226, 0x225,  0x3,    0x2,    0x2,    0x2,    0x227,  0x22a,  0x3,
-      0x2,   0x2,    0x2,    0x228,  0x226,  0x3,    0x2,    0x2,    0x2,
-      0x228, 0x229,  0x3,    0x2,    0x2,    0x2,    0x229,  0x9c,   0x3,
-      0x2,   0x2,    0x2,    0x22a,  0x228,  0x3,    0x2,    0x2,    0x2,
-      0x22b, 0x22d,  0x9,    0x7,    0x2,    0x2,    0x22c,  0x22b,  0x3,
-      0x2,   0x2,    0x2,    0x22d,  0x22e,  0x3,    0x2,    0x2,    0x2,
-      0x22e, 0x22c,  0x3,    0x2,    0x2,    0x2,    0x22e,  0x22f,  0x3,
-      0x2,   0x2,    0x2,    0x22f,  0x230,  0x3,    0x2,    0x2,    0x2,
-      0x230, 0x231,  0x8,    0x4f,   0x2,    0x2,    0x231,  0x9e,   0x3,
-      0x2,   0x2,    0x2,    0x232,  0x233,  0x7,    0x31,   0x2,    0x2,
-      0x233, 0x234,  0x7,    0x2c,   0x2,    0x2,    0x234,  0x238,  0x3,
-      0x2,   0x2,    0x2,    0x235,  0x237,  0xb,    0x2,    0x2,    0x2,
-      0x236, 0x235,  0x3,    0x2,    0x2,    0x2,    0x237,  0x23a,  0x3,
-      0x2,   0x2,    0x2,    0x238,  0x239,  0x3,    0x2,    0x2,    0x2,
-      0x238, 0x236,  0x3,    0x2,    0x2,    0x2,    0x239,  0x23e,  0x3,
-      0x2,   0x2,    0x2,    0x23a,  0x238,  0x3,    0x2,    0x2,    0x2,
-      0x23b, 0x23c,  0x7,    0x2c,   0x2,    0x2,    0x23c,  0x23f,  0x7,
-      0x31,  0x2,    0x2,    0x23d,  0x23f,  0x7,    0x2,    0x2,    0x3,
-      0x23e, 0x23b,  0x3,    0x2,    0x2,    0x2,    0x23e,  0x23d,  0x3,
-      0x2,   0x2,    0x2,    0x23f,  0x240,  0x3,    0x2,    0x2,    0x2,
-      0x240, 0x241,  0x8,    0x50,   0x2,    0x2,    0x241,  0xa0,   0x3,
-      0x2,   0x2,    0x2,    0x242,  0x243,  0x7,    0x31,   0x2,    0x2,
-      0x243, 0x244,  0x7,    0x31,   0x2,    0x2,    0x244,  0x248,  0x3,
-      0x2,   0x2,    0x2,    0x245,  0x247,  0xa,    0x8,    0x2,    0x2,
-      0x246, 0x245,  0x3,    0x2,    0x2,    0x2,    0x247,  0x24a,  0x3,
-      0x2,   0x2,    0x2,    0x248,  0x246,  0x3,    0x2,    0x2,    0x2,
-      0x248, 0x249,  0x3,    0x2,    0x2,    0x2,    0x249,  0x24b,  0x3,
-      0x2,   0x2,    0x2,    0x24a,  0x248,  0x3,    0x2,    0x2,    0x2,
-      0x24b, 0x24c,  0x8,    0x51,   0x2,    0x2,    0x24c,  0xa2,   0x3,
-      0x2,   0x2,    0x2,    0x24d,  0x24e,  0x9,    0x9,    0x2,    0x2,
-      0x24e, 0xa4,   0x3,    0x2,    0x2,    0x2,    0x24f,  0x258,  0x7,
-      0x32,  0x2,    0x2,    0x250,  0x254,  0x9,    0xa,    0x2,    0x2,
-      0x251, 0x253,  0x5,    0xa3,   0x52,   0x2,    0x252,  0x251,  0x3,
-      0x2,   0x2,    0x2,    0x253,  0x256,  0x3,    0x2,    0x2,    0x2,
-      0x254, 0x252,  0x3,    0x2,    0x2,    0x2,    0x254,  0x255,  0x3,
-      0x2,   0x2,    0x2,    0x255,  0x258,  0x3,    0x2,    0x2,    0x2,
-      0x256, 0x254,  0x3,    0x2,    0x2,    0x2,    0x257,  0x24f,  0x3,
-      0x2,   0x2,    0x2,    0x257,  0x250,  0x3,    0x2,    0x2,    0x2,
-      0x258, 0xa6,   0x3,    0x2,    0x2,    0x2,    0x259,  0x25b,  0x9,
-      0xb,   0x2,    0x2,    0x25a,  0x25c,  0x9,    0xc,    0x2,    0x2,
-      0x25b, 0x25a,  0x3,    0x2,    0x2,    0x2,    0x25b,  0x25c,  0x3,
-      0x2,   0x2,    0x2,    0x25c,  0x25e,  0x3,    0x2,    0x2,    0x2,
-      0x25d, 0x25f,  0x5,    0xa3,   0x52,   0x2,    0x25e,  0x25d,  0x3,
-      0x2,   0x2,    0x2,    0x25f,  0x260,  0x3,    0x2,    0x2,    0x2,
-      0x260, 0x25e,  0x3,    0x2,    0x2,    0x2,    0x260,  0x261,  0x3,
-      0x2,   0x2,    0x2,    0x261,  0xa8,   0x3,    0x2,    0x2,    0x2,
-      0x262, 0x264,  0x5,    0x6b,   0x36,   0x2,    0x263,  0x262,  0x3,
-      0x2,   0x2,    0x2,    0x263,  0x264,  0x3,    0x2,    0x2,    0x2,
-      0x264, 0x265,  0x3,    0x2,    0x2,    0x2,    0x265,  0x266,  0x5,
-      0xa5,  0x53,   0x2,    0x266,  0x26a,  0x7,    0x30,   0x2,    0x2,
-      0x267, 0x269,  0x5,    0xa3,   0x52,   0x2,    0x268,  0x267,  0x3,
-      0x2,   0x2,    0x2,    0x269,  0x26c,  0x3,    0x2,    0x2,    0x2,
-      0x26a, 0x268,  0x3,    0x2,    0x2,    0x2,    0x26a,  0x26b,  0x3,
-      0x2,   0x2,    0x2,    0x26b,  0x26e,  0x3,    0x2,    0x2,    0x2,
-      0x26c, 0x26a,  0x3,    0x2,    0x2,    0x2,    0x26d,  0x26f,  0x5,
-      0xa7,  0x54,   0x2,    0x26e,  0x26d,  0x3,    0x2,    0x2,    0x2,
-      0x26e, 0x26f,  0x3,    0x2,    0x2,    0x2,    0x26f,  0x28f,  0x3,
-      0x2,   0x2,    0x2,    0x270,  0x272,  0x5,    0x6b,   0x36,   0x2,
-      0x271, 0x270,  0x3,    0x2,    0x2,    0x2,    0x271,  0x272,  0x3,
-      0x2,   0x2,    0x2,    0x272,  0x273,  0x3,    0x2,    0x2,    0x2,
-      0x273, 0x275,  0x7,    0x30,   0x2,    0x2,    0x274,  0x276,  0x5,
-      0xa3,  0x52,   0x2,    0x275,  0x274,  0x3,    0x2,    0x2,    0x2,
-      0x276, 0x277,  0x3,    0x2,    0x2,    0x2,    0x277,  0x275,  0x3,
-      0x2,   0x2,    0x2,    0x277,  0x278,  0x3,    0x2,    0x2,    0x2,
-      0x278, 0x27a,  0x3,    0x2,    0x2,    0x2,    0x279,  0x27b,  0x5,
-      0xa7,  0x54,   0x2,    0x27a,  0x279,  0x3,    0x2,    0x2,    0x2,
-      0x27a, 0x27b,  0x3,    0x2,    0x2,    0x2,    0x27b,  0x28f,  0x3,
-      0x2,   0x2,    0x2,    0x27c,  0x27e,  0x5,    0x6b,   0x36,   0x2,
-      0x27d, 0x27c,  0x3,    0x2,    0x2,    0x2,    0x27d,  0x27e,  0x3,
-      0x2,   0x2,    0x2,    0x27e,  0x27f,  0x3,    0x2,    0x2,    0x2,
-      0x27f, 0x281,  0x5,    0xa5,   0x53,   0x2,    0x280,  0x282,  0x5,
-      0xa7,  0x54,   0x2,    0x281,  0x280,  0x3,    0x2,    0x2,    0x2,
-      0x281, 0x282,  0x3,    0x2,    0x2,    0x2,    0x282,  0x28f,  0x3,
-      0x2,   0x2,    0x2,    0x283,  0x285,  0x5,    0x6b,   0x36,   0x2,
-      0x284, 0x283,  0x3,    0x2,    0x2,    0x2,    0x284,  0x285,  0x3,
-      0x2,   0x2,    0x2,    0x285,  0x286,  0x3,    0x2,    0x2,    0x2,
-      0x286, 0x287,  0x7,    0x32,   0x2,    0x2,    0x287,  0x288,  0x7,
-      0x7a,  0x2,    0x2,    0x288,  0x28a,  0x3,    0x2,    0x2,    0x2,
-      0x289, 0x28b,  0x9,    0xd,    0x2,    0x2,    0x28a,  0x289,  0x3,
-      0x2,   0x2,    0x2,    0x28b,  0x28c,  0x3,    0x2,    0x2,    0x2,
-      0x28c, 0x28a,  0x3,    0x2,    0x2,    0x2,    0x28c,  0x28d,  0x3,
-      0x2,   0x2,    0x2,    0x28d,  0x28f,  0x3,    0x2,    0x2,    0x2,
-      0x28e, 0x263,  0x3,    0x2,    0x2,    0x2,    0x28e,  0x271,  0x3,
-      0x2,   0x2,    0x2,    0x28e,  0x27d,  0x3,    0x2,    0x2,    0x2,
-      0x28e, 0x284,  0x3,    0x2,    0x2,    0x2,    0x28f,  0xaa,   0x3,
-      0x2,   0x2,    0x2,    0x1e,   0x2,    0x1c9,  0x203,  0x210,  0x212,
-      0x219, 0x21b,  0x21f,  0x228,  0x22e,  0x238,  0x23e,  0x248,  0x254,
-      0x257, 0x25b,  0x260,  0x263,  0x26a,  0x26e,  0x271,  0x277,  0x27a,
-      0x27d, 0x281,  0x284,  0x28c,  0x28e,  0x3,    0x2,    0x3,    0x2,
+      0x4a,  0x93,   0x4b,   0x95,   0x4c,   0x97,   0x4d,   0x99,   0x4e,
+      0x9b,  0x2,    0x9d,   0x4f,   0x9f,   0x50,   0xa1,   0x51,   0xa3,
+      0x52,  0xa5,   0x2,    0xa7,   0x2,    0xa9,   0x2,    0xab,   0x53,
+      0x3,   0x2,    0xe,    0x6,    0x2,    0xc,    0xc,    0xf,    0xf,
+      0x24,  0x24,   0x5e,   0x5e,   0x6,    0x2,    0xc,    0xc,    0xf,
+      0xf,   0x29,   0x29,   0x5e,   0x5e,   0x7,    0x2,    0x24,   0x24,
+      0x29,  0x29,   0x5e,   0x5e,   0x70,   0x70,   0x74,   0x74,   0x4,
+      0x2,   0x43,   0x5c,   0x63,   0x7c,   0x6,    0x2,    0x32,   0x3b,
+      0x43,  0x5c,   0x61,   0x61,   0x63,   0x7c,   0x5,    0x2,    0xb,
+      0xc,   0xe,    0xf,    0x22,   0x22,   0x4,    0x2,    0xc,    0xc,
+      0xf,   0xf,    0x3,    0x2,    0x32,   0x3b,   0x3,    0x2,    0x33,
+      0x3b,  0x4,    0x2,    0x47,   0x47,   0x67,   0x67,   0x4,    0x2,
+      0x2d,  0x2d,   0x2f,   0x2f,   0x5,    0x2,    0x32,   0x3b,   0x43,
+      0x48,  0x63,   0x68,   0x2,    0x2ba,  0x2,    0x3,    0x3,    0x2,
+      0x2,   0x2,    0x2,    0x5,    0x3,    0x2,    0x2,    0x2,    0x2,
+      0x7,   0x3,    0x2,    0x2,    0x2,    0x2,    0x9,    0x3,    0x2,
+      0x2,   0x2,    0x2,    0xb,    0x3,    0x2,    0x2,    0x2,    0x2,
+      0xd,   0x3,    0x2,    0x2,    0x2,    0x2,    0xf,    0x3,    0x2,
+      0x2,   0x2,    0x2,    0x11,   0x3,    0x2,    0x2,    0x2,    0x2,
+      0x13,  0x3,    0x2,    0x2,    0x2,    0x2,    0x15,   0x3,    0x2,
+      0x2,   0x2,    0x2,    0x17,   0x3,    0x2,    0x2,    0x2,    0x2,
+      0x19,  0x3,    0x2,    0x2,    0x2,    0x2,    0x1b,   0x3,    0x2,
+      0x2,   0x2,    0x2,    0x1d,   0x3,    0x2,    0x2,    0x2,    0x2,
+      0x1f,  0x3,    0x2,    0x2,    0x2,    0x2,    0x21,   0x3,    0x2,
+      0x2,   0x2,    0x2,    0x23,   0x3,    0x2,    0x2,    0x2,    0x2,
+      0x25,  0x3,    0x2,    0x2,    0x2,    0x2,    0x27,   0x3,    0x2,
+      0x2,   0x2,    0x2,    0x29,   0x3,    0x2,    0x2,    0x2,    0x2,
+      0x2b,  0x3,    0x2,    0x2,    0x2,    0x2,    0x2d,   0x3,    0x2,
+      0x2,   0x2,    0x2,    0x2f,   0x3,    0x2,    0x2,    0x2,    0x2,
+      0x31,  0x3,    0x2,    0x2,    0x2,    0x2,    0x33,   0x3,    0x2,
+      0x2,   0x2,    0x2,    0x35,   0x3,    0x2,    0x2,    0x2,    0x2,
+      0x37,  0x3,    0x2,    0x2,    0x2,    0x2,    0x39,   0x3,    0x2,
+      0x2,   0x2,    0x2,    0x3b,   0x3,    0x2,    0x2,    0x2,    0x2,
+      0x3d,  0x3,    0x2,    0x2,    0x2,    0x2,    0x3f,   0x3,    0x2,
+      0x2,   0x2,    0x2,    0x41,   0x3,    0x2,    0x2,    0x2,    0x2,
+      0x43,  0x3,    0x2,    0x2,    0x2,    0x2,    0x45,   0x3,    0x2,
+      0x2,   0x2,    0x2,    0x47,   0x3,    0x2,    0x2,    0x2,    0x2,
+      0x49,  0x3,    0x2,    0x2,    0x2,    0x2,    0x4b,   0x3,    0x2,
+      0x2,   0x2,    0x2,    0x4d,   0x3,    0x2,    0x2,    0x2,    0x2,
+      0x4f,  0x3,    0x2,    0x2,    0x2,    0x2,    0x51,   0x3,    0x2,
+      0x2,   0x2,    0x2,    0x53,   0x3,    0x2,    0x2,    0x2,    0x2,
+      0x55,  0x3,    0x2,    0x2,    0x2,    0x2,    0x57,   0x3,    0x2,
+      0x2,   0x2,    0x2,    0x59,   0x3,    0x2,    0x2,    0x2,    0x2,
+      0x5b,  0x3,    0x2,    0x2,    0x2,    0x2,    0x5d,   0x3,    0x2,
+      0x2,   0x2,    0x2,    0x5f,   0x3,    0x2,    0x2,    0x2,    0x2,
+      0x61,  0x3,    0x2,    0x2,    0x2,    0x2,    0x63,   0x3,    0x2,
+      0x2,   0x2,    0x2,    0x65,   0x3,    0x2,    0x2,    0x2,    0x2,
+      0x67,  0x3,    0x2,    0x2,    0x2,    0x2,    0x69,   0x3,    0x2,
+      0x2,   0x2,    0x2,    0x6b,   0x3,    0x2,    0x2,    0x2,    0x2,
+      0x6d,  0x3,    0x2,    0x2,    0x2,    0x2,    0x6f,   0x3,    0x2,
+      0x2,   0x2,    0x2,    0x71,   0x3,    0x2,    0x2,    0x2,    0x2,
+      0x73,  0x3,    0x2,    0x2,    0x2,    0x2,    0x75,   0x3,    0x2,
+      0x2,   0x2,    0x2,    0x77,   0x3,    0x2,    0x2,    0x2,    0x2,
+      0x79,  0x3,    0x2,    0x2,    0x2,    0x2,    0x7b,   0x3,    0x2,
+      0x2,   0x2,    0x2,    0x7d,   0x3,    0x2,    0x2,    0x2,    0x2,
+      0x7f,  0x3,    0x2,    0x2,    0x2,    0x2,    0x81,   0x3,    0x2,
+      0x2,   0x2,    0x2,    0x83,   0x3,    0x2,    0x2,    0x2,    0x2,
+      0x85,  0x3,    0x2,    0x2,    0x2,    0x2,    0x87,   0x3,    0x2,
+      0x2,   0x2,    0x2,    0x89,   0x3,    0x2,    0x2,    0x2,    0x2,
+      0x8b,  0x3,    0x2,    0x2,    0x2,    0x2,    0x8d,   0x3,    0x2,
+      0x2,   0x2,    0x2,    0x8f,   0x3,    0x2,    0x2,    0x2,    0x2,
+      0x91,  0x3,    0x2,    0x2,    0x2,    0x2,    0x93,   0x3,    0x2,
+      0x2,   0x2,    0x2,    0x95,   0x3,    0x2,    0x2,    0x2,    0x2,
+      0x97,  0x3,    0x2,    0x2,    0x2,    0x2,    0x99,   0x3,    0x2,
+      0x2,   0x2,    0x2,    0x9d,   0x3,    0x2,    0x2,    0x2,    0x2,
+      0x9f,  0x3,    0x2,    0x2,    0x2,    0x2,    0xa1,   0x3,    0x2,
+      0x2,   0x2,    0x2,    0xa3,   0x3,    0x2,    0x2,    0x2,    0x2,
+      0xab,  0x3,    0x2,    0x2,    0x2,    0x3,    0xad,   0x3,    0x2,
+      0x2,   0x2,    0x5,    0xaf,   0x3,    0x2,    0x2,    0x2,    0x7,
+      0xb1,  0x3,    0x2,    0x2,    0x2,    0x9,    0xb4,   0x3,    0x2,
+      0x2,   0x2,    0xb,    0xb6,   0x3,    0x2,    0x2,    0x2,    0xd,
+      0xb8,  0x3,    0x2,    0x2,    0x2,    0xf,    0xbd,   0x3,    0x2,
+      0x2,   0x2,    0x11,   0xbf,   0x3,    0x2,    0x2,    0x2,    0x13,
+      0xc2,  0x3,    0x2,    0x2,    0x2,    0x15,   0xc5,   0x3,    0x2,
+      0x2,   0x2,    0x17,   0xc7,   0x3,    0x2,    0x2,    0x2,    0x19,
+      0xc9,  0x3,    0x2,    0x2,    0x2,    0x1b,   0xcb,   0x3,    0x2,
+      0x2,   0x2,    0x1d,   0xcd,   0x3,    0x2,    0x2,    0x2,    0x1f,
+      0xcf,  0x3,    0x2,    0x2,    0x2,    0x21,   0xd1,   0x3,    0x2,
+      0x2,   0x2,    0x23,   0xd4,   0x3,    0x2,    0x2,    0x2,    0x25,
+      0xd9,  0x3,    0x2,    0x2,    0x2,    0x27,   0xe1,   0x3,    0x2,
+      0x2,   0x2,    0x29,   0xeb,   0x3,    0x2,    0x2,    0x2,    0x2b,
+      0xf4,  0x3,    0x2,    0x2,    0x2,    0x2d,   0xfb,   0x3,    0x2,
+      0x2,   0x2,    0x2f,   0x101,  0x3,    0x2,    0x2,    0x2,    0x31,
+      0x109, 0x3,    0x2,    0x2,    0x2,    0x33,   0x111,  0x3,    0x2,
+      0x2,   0x2,    0x35,   0x118,  0x3,    0x2,    0x2,    0x2,    0x37,
+      0x123, 0x3,    0x2,    0x2,    0x2,    0x39,   0x12c,  0x3,    0x2,
+      0x2,   0x2,    0x3b,   0x12f,  0x3,    0x2,    0x2,    0x2,    0x3d,
+      0x133, 0x3,    0x2,    0x2,    0x2,    0x3f,   0x139,  0x3,    0x2,
+      0x2,   0x2,    0x41,   0x140,  0x3,    0x2,    0x2,    0x2,    0x43,
+      0x14a, 0x3,    0x2,    0x2,    0x2,    0x45,   0x153,  0x3,    0x2,
+      0x2,   0x2,    0x47,   0x159,  0x3,    0x2,    0x2,    0x2,    0x49,
+      0x15e, 0x3,    0x2,    0x2,    0x2,    0x4b,   0x168,  0x3,    0x2,
+      0x2,   0x2,    0x4d,   0x16c,  0x3,    0x2,    0x2,    0x2,    0x4f,
+      0x172, 0x3,    0x2,    0x2,    0x2,    0x51,   0x179,  0x3,    0x2,
+      0x2,   0x2,    0x53,   0x17e,  0x3,    0x2,    0x2,    0x2,    0x55,
+      0x183, 0x3,    0x2,    0x2,    0x2,    0x57,   0x186,  0x3,    0x2,
+      0x2,   0x2,    0x59,   0x18a,  0x3,    0x2,    0x2,    0x2,    0x5b,
+      0x190, 0x3,    0x2,    0x2,    0x2,    0x5d,   0x197,  0x3,    0x2,
+      0x2,   0x2,    0x5f,   0x19e,  0x3,    0x2,    0x2,    0x2,    0x61,
+      0x1a4, 0x3,    0x2,    0x2,    0x2,    0x63,   0x1b0,  0x3,    0x2,
+      0x2,   0x2,    0x65,   0x1b6,  0x3,    0x2,    0x2,    0x2,    0x67,
+      0x1d2, 0x3,    0x2,    0x2,    0x2,    0x69,   0x1d4,  0x3,    0x2,
+      0x2,   0x2,    0x6b,   0x1d7,  0x3,    0x2,    0x2,    0x2,    0x6d,
+      0x1d9, 0x3,    0x2,    0x2,    0x2,    0x6f,   0x1db,  0x3,    0x2,
+      0x2,   0x2,    0x71,   0x1dd,  0x3,    0x2,    0x2,    0x2,    0x73,
+      0x1df, 0x3,    0x2,    0x2,    0x2,    0x75,   0x1e1,  0x3,    0x2,
+      0x2,   0x2,    0x77,   0x1e3,  0x3,    0x2,    0x2,    0x2,    0x79,
+      0x1e5, 0x3,    0x2,    0x2,    0x2,    0x7b,   0x1e7,  0x3,    0x2,
+      0x2,   0x2,    0x7d,   0x1eb,  0x3,    0x2,    0x2,    0x2,    0x7f,
+      0x1ef, 0x3,    0x2,    0x2,    0x2,    0x81,   0x1f2,  0x3,    0x2,
+      0x2,   0x2,    0x83,   0x1f4,  0x3,    0x2,    0x2,    0x2,    0x85,
+      0x1f7, 0x3,    0x2,    0x2,    0x2,    0x87,   0x1f9,  0x3,    0x2,
+      0x2,   0x2,    0x89,   0x1fc,  0x3,    0x2,    0x2,    0x2,    0x8b,
+      0x1ff, 0x3,    0x2,    0x2,    0x2,    0x8d,   0x202,  0x3,    0x2,
+      0x2,   0x2,    0x8f,   0x206,  0x3,    0x2,    0x2,    0x2,    0x91,
+      0x20c, 0x3,    0x2,    0x2,    0x2,    0x93,   0x20e,  0x3,    0x2,
+      0x2,   0x2,    0x95,   0x211,  0x3,    0x2,    0x2,    0x2,    0x97,
+      0x214, 0x3,    0x2,    0x2,    0x2,    0x99,   0x228,  0x3,    0x2,
+      0x2,   0x2,    0x9b,   0x22a,  0x3,    0x2,    0x2,    0x2,    0x9d,
+      0x22d, 0x3,    0x2,    0x2,    0x2,    0x9f,   0x235,  0x3,    0x2,
+      0x2,   0x2,    0xa1,   0x23b,  0x3,    0x2,    0x2,    0x2,    0xa3,
+      0x24b, 0x3,    0x2,    0x2,    0x2,    0xa5,   0x256,  0x3,    0x2,
+      0x2,   0x2,    0xa7,   0x260,  0x3,    0x2,    0x2,    0x2,    0xa9,
+      0x262, 0x3,    0x2,    0x2,    0x2,    0xab,   0x297,  0x3,    0x2,
+      0x2,   0x2,    0xad,   0xae,   0x7,    0x2a,   0x2,    0x2,    0xae,
+      0x4,   0x3,    0x2,    0x2,    0x2,    0xaf,   0xb0,   0x7,    0x2b,
+      0x2,   0x2,    0xb0,   0x6,    0x3,    0x2,    0x2,    0x2,    0xb1,
+      0xb2,  0x7,    0x3f,   0x2,    0x2,    0xb2,   0xb3,   0x7,    0x40,
+      0x2,   0x2,    0xb3,   0x8,    0x3,    0x2,    0x2,    0x2,    0xb4,
+      0xb5,  0x7,    0x2e,   0x2,    0x2,    0xb5,   0xa,    0x3,    0x2,
+      0x2,   0x2,    0xb6,   0xb7,   0x7,    0x3c,   0x2,    0x2,    0xb7,
+      0xc,   0x3,    0x2,    0x2,    0x2,    0xb8,   0xb9,   0x7,    0x76,
+      0x2,   0x2,    0xb9,   0xba,   0x7,    0x7b,   0x2,    0x2,    0xba,
+      0xbb,  0x7,    0x72,   0x2,    0x2,    0xbb,   0xbc,   0x7,    0x67,
+      0x2,   0x2,    0xbc,   0xe,    0x3,    0x2,    0x2,    0x2,    0xbd,
+      0xbe,  0x7,    0x41,   0x2,    0x2,    0xbe,   0x10,   0x3,    0x2,
+      0x2,   0x2,    0xbf,   0xc0,   0x7,    0x7e,   0x2,    0x2,    0xc0,
+      0xc1,  0x7,    0x7e,   0x2,    0x2,    0xc1,   0x12,   0x3,    0x2,
+      0x2,   0x2,    0xc2,   0xc3,   0x7,    0x28,   0x2,    0x2,    0xc3,
+      0xc4,  0x7,    0x28,   0x2,    0x2,    0xc4,   0x14,   0x3,    0x2,
+      0x2,   0x2,    0xc5,   0xc6,   0x7,    0x30,   0x2,    0x2,    0xc6,
+      0x16,  0x3,    0x2,    0x2,    0x2,    0xc7,   0xc8,   0x7,    0x5d,
+      0x2,   0x2,    0xc8,   0x18,   0x3,    0x2,    0x2,    0x2,    0xc9,
+      0xca,  0x7,    0x5f,   0x2,    0x2,    0xca,   0x1a,   0x3,    0x2,
+      0x2,   0x2,    0xcb,   0xcc,   0x7,    0x7d,   0x2,    0x2,    0xcc,
+      0x1c,  0x3,    0x2,    0x2,    0x2,    0xcd,   0xce,   0x7,    0x7f,
+      0x2,   0x2,    0xce,   0x1e,   0x3,    0x2,    0x2,    0x2,    0xcf,
+      0xd0,  0x7,    0x3d,   0x2,    0x2,    0xd0,   0x20,   0x3,    0x2,
+      0x2,   0x2,    0xd1,   0xd2,   0x7,    0x71,   0x2,    0x2,    0xd2,
+      0xd3,  0x7,    0x68,   0x2,    0x2,    0xd3,   0x22,   0x3,    0x2,
+      0x2,   0x2,    0xd4,   0xd5,   0x7,    0x67,   0x2,    0x2,    0xd5,
+      0xd6,  0x7,    0x6e,   0x2,    0x2,    0xd6,   0xd7,   0x7,    0x75,
+      0x2,   0x2,    0xd7,   0xd8,   0x7,    0x67,   0x2,    0x2,    0xd8,
+      0x24,  0x3,    0x2,    0x2,    0x2,    0xd9,   0xda,   0x7,    0x67,
+      0x2,   0x2,    0xda,   0xdb,   0x7,    0x7a,   0x2,    0x2,    0xdb,
+      0xdc,  0x7,    0x76,   0x2,    0x2,    0xdc,   0xdd,   0x7,    0x67,
+      0x2,   0x2,    0xdd,   0xde,   0x7,    0x70,   0x2,    0x2,    0xde,
+      0xdf,  0x7,    0x66,   0x2,    0x2,    0xdf,   0xe0,   0x7,    0x75,
+      0x2,   0x2,    0xe0,   0x26,   0x3,    0x2,    0x2,    0x2,    0xe1,
+      0xe2,  0x7,    0x69,   0x2,    0x2,    0xe2,   0xe3,   0x7,    0x67,
+      0x2,   0x2,    0xe3,   0xe4,   0x7,    0x70,   0x2,    0x2,    0xe4,
+      0xe5,  0x7,    0x67,   0x2,    0x2,    0xe5,   0xe6,   0x7,    0x74,
+      0x2,   0x2,    0xe6,   0xe7,   0x7,    0x63,   0x2,    0x2,    0xe7,
+      0xe8,  0x7,    0x76,   0x2,    0x2,    0xe8,   0xe9,   0x7,    0x67,
+      0x2,   0x2,    0xe9,   0xea,   0x7,    0x75,   0x2,    0x2,    0xea,
+      0x28,  0x3,    0x2,    0x2,    0x2,    0xeb,   0xec,   0x7,    0x71,
+      0x2,   0x2,    0xec,   0xed,   0x7,    0x72,   0x2,    0x2,    0xed,
+      0xee,  0x7,    0x67,   0x2,    0x2,    0xee,   0xef,   0x7,    0x74,
+      0x2,   0x2,    0xef,   0xf0,   0x7,    0x63,   0x2,    0x2,    0xf0,
+      0xf1,  0x7,    0x76,   0x2,    0x2,    0xf1,   0xf2,   0x7,    0x71,
+      0x2,   0x2,    0xf2,   0xf3,   0x7,    0x74,   0x2,    0x2,    0xf3,
+      0x2a,  0x3,    0x2,    0x2,    0x2,    0xf4,   0xf5,   0x7,    0x75,
+      0x2,   0x2,    0xf5,   0xf6,   0x7,    0x76,   0x2,    0x2,    0xf6,
+      0xf7,  0x7,    0x74,   0x2,    0x2,    0xf7,   0xf8,   0x7,    0x77,
+      0x2,   0x2,    0xf8,   0xf9,   0x7,    0x65,   0x2,    0x2,    0xf9,
+      0xfa,  0x7,    0x76,   0x2,    0x2,    0xfa,   0x2c,   0x3,    0x2,
+      0x2,   0x2,    0xfb,   0xfc,   0x7,    0x6f,   0x2,    0x2,    0xfc,
+      0xfd,  0x7,    0x63,   0x2,    0x2,    0xfd,   0xfe,   0x7,    0x65,
+      0x2,   0x2,    0xfe,   0xff,   0x7,    0x74,   0x2,    0x2,    0xff,
+      0x100, 0x7,    0x71,   0x2,    0x2,    0x100,  0x2e,   0x3,    0x2,
+      0x2,   0x2,    0x101,  0x102,  0x7,    0x64,   0x2,    0x2,    0x102,
+      0x103, 0x7,    0x77,   0x2,    0x2,    0x103,  0x104,  0x7,    0x6b,
+      0x2,   0x2,    0x104,  0x105,  0x7,    0x6e,   0x2,    0x2,    0x105,
+      0x106, 0x7,    0x76,   0x2,    0x2,    0x106,  0x107,  0x7,    0x6b,
+      0x2,   0x2,    0x107,  0x108,  0x7,    0x70,   0x2,    0x2,    0x108,
+      0x30,  0x3,    0x2,    0x2,    0x2,    0x109,  0x10a,  0x7,    0x74,
+      0x2,   0x2,    0x10a,  0x10b,  0x7,    0x77,   0x2,    0x2,    0x10b,
+      0x10c, 0x7,    0x70,   0x2,    0x2,    0x10c,  0x10d,  0x7,    0x76,
+      0x2,   0x2,    0x10d,  0x10e,  0x7,    0x6b,   0x2,    0x2,    0x10e,
+      0x10f, 0x7,    0x6f,   0x2,    0x2,    0x10f,  0x110,  0x7,    0x67,
+      0x2,   0x2,    0x110,  0x32,   0x3,    0x2,    0x2,    0x2,    0x111,
+      0x112, 0x7,    0x6f,   0x2,    0x2,    0x112,  0x113,  0x7,    0x71,
+      0x2,   0x2,    0x113,  0x114,  0x7,    0x66,   0x2,    0x2,    0x114,
+      0x115, 0x7,    0x77,   0x2,    0x2,    0x115,  0x116,  0x7,    0x6e,
+      0x2,   0x2,    0x116,  0x117,  0x7,    0x67,   0x2,    0x2,    0x117,
+      0x34,  0x3,    0x2,    0x2,    0x2,    0x118,  0x119,  0x7,    0x6c,
+      0x2,   0x2,    0x119,  0x11a,  0x7,    0x63,   0x2,    0x2,    0x11a,
+      0x11b, 0x7,    0x78,   0x2,    0x2,    0x11b,  0x11c,  0x7,    0x63,
+      0x2,   0x2,    0x11c,  0x11d,  0x7,    0x75,   0x2,    0x2,    0x11d,
+      0x11e, 0x7,    0x65,   0x2,    0x2,    0x11e,  0x11f,  0x7,    0x74,
+      0x2,   0x2,    0x11f,  0x120,  0x7,    0x6b,   0x2,    0x2,    0x120,
+      0x121, 0x7,    0x72,   0x2,    0x2,    0x121,  0x122,  0x7,    0x76,
+      0x2,   0x2,    0x122,  0x36,   0x3,    0x2,    0x2,    0x2,    0x123,
+      0x124, 0x7,    0x66,   0x2,    0x2,    0x124,  0x125,  0x7,    0x67,
+      0x2,   0x2,    0x125,  0x126,  0x7,    0x68,   0x2,    0x2,    0x126,
+      0x127, 0x7,    0x67,   0x2,    0x2,    0x127,  0x128,  0x7,    0x74,
+      0x2,   0x2,    0x128,  0x129,  0x7,    0x74,   0x2,    0x2,    0x129,
+      0x12a, 0x7,    0x67,   0x2,    0x2,    0x12a,  0x12b,  0x7,    0x66,
+      0x2,   0x2,    0x12b,  0x38,   0x3,    0x2,    0x2,    0x2,    0x12c,
+      0x12d, 0x7,    0x6b,   0x2,    0x2,    0x12d,  0x12e,  0x7,    0x68,
+      0x2,   0x2,    0x12e,  0x3a,   0x3,    0x2,    0x2,    0x2,    0x12f,
+      0x130, 0x7,    0x68,   0x2,    0x2,    0x130,  0x131,  0x7,    0x71,
+      0x2,   0x2,    0x131,  0x132,  0x7,    0x74,   0x2,    0x2,    0x132,
+      0x3c,  0x3,    0x2,    0x2,    0x2,    0x133,  0x134,  0x7,    0x79,
+      0x2,   0x2,    0x134,  0x135,  0x7,    0x6a,   0x2,    0x2,    0x135,
+      0x136, 0x7,    0x6b,   0x2,    0x2,    0x136,  0x137,  0x7,    0x6e,
+      0x2,   0x2,    0x137,  0x138,  0x7,    0x67,   0x2,    0x2,    0x138,
+      0x3e,  0x3,    0x2,    0x2,    0x2,    0x139,  0x13a,  0x7,    0x74,
+      0x2,   0x2,    0x13a,  0x13b,  0x7,    0x67,   0x2,    0x2,    0x13b,
+      0x13c, 0x7,    0x76,   0x2,    0x2,    0x13c,  0x13d,  0x7,    0x77,
+      0x2,   0x2,    0x13d,  0x13e,  0x7,    0x74,   0x2,    0x2,    0x13e,
+      0x13f, 0x7,    0x70,   0x2,    0x2,    0x13f,  0x40,   0x3,    0x2,
+      0x2,   0x2,    0x140,  0x141,  0x7,    0x65,   0x2,    0x2,    0x141,
+      0x142, 0x7,    0x71,   0x2,    0x2,    0x142,  0x143,  0x7,    0x70,
+      0x2,   0x2,    0x143,  0x144,  0x7,    0x75,   0x2,    0x2,    0x144,
+      0x145, 0x7,    0x76,   0x2,    0x2,    0x145,  0x146,  0x7,    0x67,
+      0x2,   0x2,    0x146,  0x147,  0x7,    0x7a,   0x2,    0x2,    0x147,
+      0x148, 0x7,    0x72,   0x2,    0x2,    0x148,  0x149,  0x7,    0x74,
+      0x2,   0x2,    0x149,  0x42,   0x3,    0x2,    0x2,    0x2,    0x14a,
+      0x14b, 0x7,    0x65,   0x2,    0x2,    0x14b,  0x14c,  0x7,    0x71,
+      0x2,   0x2,    0x14c,  0x14d,  0x7,    0x70,   0x2,    0x2,    0x14d,
+      0x14e, 0x7,    0x76,   0x2,    0x2,    0x14e,  0x14f,  0x7,    0x6b,
+      0x2,   0x2,    0x14f,  0x150,  0x7,    0x70,   0x2,    0x2,    0x150,
+      0x151, 0x7,    0x77,   0x2,    0x2,    0x151,  0x152,  0x7,    0x67,
+      0x2,   0x2,    0x152,  0x44,   0x3,    0x2,    0x2,    0x2,    0x153,
+      0x154, 0x7,    0x64,   0x2,    0x2,    0x154,  0x155,  0x7,    0x74,
+      0x2,   0x2,    0x155,  0x156,  0x7,    0x67,   0x2,    0x2,    0x156,
+      0x157, 0x7,    0x63,   0x2,    0x2,    0x157,  0x158,  0x7,    0x6d,
+      0x2,   0x2,    0x158,  0x46,   0x3,    0x2,    0x2,    0x2,    0x159,
+      0x15a, 0x7,    0x69,   0x2,    0x2,    0x15a,  0x15b,  0x7,    0x71,
+      0x2,   0x2,    0x15b,  0x15c,  0x7,    0x76,   0x2,    0x2,    0x15c,
+      0x15d, 0x7,    0x71,   0x2,    0x2,    0x15d,  0x48,   0x3,    0x2,
+      0x2,   0x2,    0x15e,  0x15f,  0x7,    0x71,   0x2,    0x2,    0x15f,
+      0x160, 0x7,    0x76,   0x2,    0x2,    0x160,  0x161,  0x7,    0x6a,
+      0x2,   0x2,    0x161,  0x162,  0x7,    0x67,   0x2,    0x2,    0x162,
+      0x163, 0x7,    0x74,   0x2,    0x2,    0x163,  0x164,  0x7,    0x79,
+      0x2,   0x2,    0x164,  0x165,  0x7,    0x6b,   0x2,    0x2,    0x165,
+      0x166, 0x7,    0x75,   0x2,    0x2,    0x166,  0x167,  0x7,    0x67,
+      0x2,   0x2,    0x167,  0x4a,   0x3,    0x2,    0x2,    0x2,    0x168,
+      0x169, 0x7,    0x76,   0x2,    0x2,    0x169,  0x16a,  0x7,    0x74,
+      0x2,   0x2,    0x16a,  0x16b,  0x7,    0x7b,   0x2,    0x2,    0x16b,
+      0x4c,  0x3,    0x2,    0x2,    0x2,    0x16c,  0x16d,  0x7,    0x6e,
+      0x2,   0x2,    0x16d,  0x16e,  0x7,    0x63,   0x2,    0x2,    0x16e,
+      0x16f, 0x7,    0x64,   0x2,    0x2,    0x16f,  0x170,  0x7,    0x67,
+      0x2,   0x2,    0x170,  0x171,  0x7,    0x6e,   0x2,    0x2,    0x171,
+      0x4e,  0x3,    0x2,    0x2,    0x2,    0x172,  0x173,  0x7,    0x6e,
+      0x2,   0x2,    0x173,  0x174,  0x7,    0x63,   0x2,    0x2,    0x174,
+      0x175, 0x7,    0x64,   0x2,    0x2,    0x175,  0x176,  0x7,    0x67,
+      0x2,   0x2,    0x176,  0x177,  0x7,    0x6e,   0x2,    0x2,    0x177,
+      0x178, 0x7,    0x75,   0x2,    0x2,    0x178,  0x50,   0x3,    0x2,
+      0x2,   0x2,    0x179,  0x17a,  0x7,    0x76,   0x2,    0x2,    0x17a,
+      0x17b, 0x7,    0x63,   0x2,    0x2,    0x17b,  0x17c,  0x7,    0x6b,
+      0x2,   0x2,    0x17c,  0x17d,  0x7,    0x6e,   0x2,    0x2,    0x17d,
+      0x52,  0x3,    0x2,    0x2,    0x2,    0x17e,  0x17f,  0x7,    0x6b,
+      0x2,   0x2,    0x17f,  0x180,  0x7,    0x75,   0x2,    0x2,    0x180,
+      0x181, 0x7,    0x70,   0x2,    0x2,    0x181,  0x182,  0x7,    0x76,
+      0x2,   0x2,    0x182,  0x54,   0x3,    0x2,    0x2,    0x2,    0x183,
+      0x184, 0x7,    0x6b,   0x2,    0x2,    0x184,  0x185,  0x7,    0x75,
+      0x2,   0x2,    0x185,  0x56,   0x3,    0x2,    0x2,    0x2,    0x186,
+      0x187, 0x7,    0x6e,   0x2,    0x2,    0x187,  0x188,  0x7,    0x67,
+      0x2,   0x2,    0x188,  0x189,  0x7,    0x76,   0x2,    0x2,    0x189,
+      0x58,  0x3,    0x2,    0x2,    0x2,    0x18a,  0x18b,  0x7,    0x65,
+      0x2,   0x2,    0x18b,  0x18c,  0x7,    0x71,   0x2,    0x2,    0x18c,
+      0x18d, 0x7,    0x70,   0x2,    0x2,    0x18d,  0x18e,  0x7,    0x75,
+      0x2,   0x2,    0x18e,  0x18f,  0x7,    0x76,   0x2,    0x2,    0x18f,
+      0x5a,  0x3,    0x2,    0x2,    0x2,    0x190,  0x191,  0x7,    0x67,
+      0x2,   0x2,    0x191,  0x192,  0x7,    0x7a,   0x2,    0x2,    0x192,
+      0x193, 0x7,    0x76,   0x2,    0x2,    0x193,  0x194,  0x7,    0x67,
+      0x2,   0x2,    0x194,  0x195,  0x7,    0x74,   0x2,    0x2,    0x195,
+      0x196, 0x7,    0x70,   0x2,    0x2,    0x196,  0x5c,   0x3,    0x2,
+      0x2,   0x2,    0x197,  0x198,  0x7,    0x63,   0x2,    0x2,    0x198,
+      0x199, 0x7,    0x75,   0x2,    0x2,    0x199,  0x19a,  0x7,    0x75,
+      0x2,   0x2,    0x19a,  0x19b,  0x7,    0x67,   0x2,    0x2,    0x19b,
+      0x19c, 0x7,    0x74,   0x2,    0x2,    0x19c,  0x19d,  0x7,    0x76,
+      0x2,   0x2,    0x19d,  0x5e,   0x3,    0x2,    0x2,    0x2,    0x19e,
+      0x19f, 0x7,    0x65,   0x2,    0x2,    0x19f,  0x1a0,  0x7,    0x6a,
+      0x2,   0x2,    0x1a0,  0x1a1,  0x7,    0x67,   0x2,    0x2,    0x1a1,
+      0x1a2, 0x7,    0x65,   0x2,    0x2,    0x1a2,  0x1a3,  0x7,    0x6d,
+      0x2,   0x2,    0x1a3,  0x60,   0x3,    0x2,    0x2,    0x2,    0x1a4,
+      0x1a5, 0x7,    0x77,   0x2,    0x2,    0x1a5,  0x1a6,  0x7,    0x70,
+      0x2,   0x2,    0x1a6,  0x1a7,  0x7,    0x74,   0x2,    0x2,    0x1a7,
+      0x1a8, 0x7,    0x67,   0x2,    0x2,    0x1a8,  0x1a9,  0x7,    0x63,
+      0x2,   0x2,    0x1a9,  0x1aa,  0x7,    0x65,   0x2,    0x2,    0x1aa,
+      0x1ab, 0x7,    0x6a,   0x2,    0x2,    0x1ab,  0x1ac,  0x7,    0x63,
+      0x2,   0x2,    0x1ac,  0x1ad,  0x7,    0x64,   0x2,    0x2,    0x1ad,
+      0x1ae, 0x7,    0x6e,   0x2,    0x2,    0x1ae,  0x1af,  0x7,    0x67,
+      0x2,   0x2,    0x1af,  0x62,   0x3,    0x2,    0x2,    0x2,    0x1b0,
+      0x1b1, 0x7,    0x66,   0x2,    0x2,    0x1b1,  0x1b2,  0x7,    0x67,
+      0x2,   0x2,    0x1b2,  0x1b3,  0x7,    0x64,   0x2,    0x2,    0x1b3,
+      0x1b4, 0x7,    0x77,   0x2,    0x2,    0x1b4,  0x1b5,  0x7,    0x69,
+      0x2,   0x2,    0x1b5,  0x64,   0x3,    0x2,    0x2,    0x2,    0x1b6,
+      0x1b7, 0x7,    0x3f,   0x2,    0x2,    0x1b7,  0x66,   0x3,    0x2,
+      0x2,   0x2,    0x1b8,  0x1b9,  0x7,    0x2c,   0x2,    0x2,    0x1b9,
+      0x1d3, 0x7,    0x3f,   0x2,    0x2,    0x1ba,  0x1bb,  0x7,    0x31,
+      0x2,   0x2,    0x1bb,  0x1d3,  0x7,    0x3f,   0x2,    0x2,    0x1bc,
+      0x1bd, 0x7,    0x27,   0x2,    0x2,    0x1bd,  0x1d3,  0x7,    0x3f,
+      0x2,   0x2,    0x1be,  0x1bf,  0x7,    0x2d,   0x2,    0x2,    0x1bf,
+      0x1d3, 0x7,    0x3f,   0x2,    0x2,    0x1c0,  0x1c1,  0x7,    0x2f,
+      0x2,   0x2,    0x1c1,  0x1d3,  0x7,    0x3f,   0x2,    0x2,    0x1c2,
+      0x1c3, 0x7,    0x3e,   0x2,    0x2,    0x1c3,  0x1c4,  0x7,    0x3e,
+      0x2,   0x2,    0x1c4,  0x1d3,  0x7,    0x3f,   0x2,    0x2,    0x1c5,
+      0x1c6, 0x7,    0x40,   0x2,    0x2,    0x1c6,  0x1c7,  0x7,    0x40,
+      0x2,   0x2,    0x1c7,  0x1d3,  0x7,    0x3f,   0x2,    0x2,    0x1c8,
+      0x1c9, 0x7,    0x40,   0x2,    0x2,    0x1c9,  0x1ca,  0x7,    0x40,
+      0x2,   0x2,    0x1ca,  0x1cb,  0x7,    0x40,   0x2,    0x2,    0x1cb,
+      0x1d3, 0x7,    0x3f,   0x2,    0x2,    0x1cc,  0x1cd,  0x7,    0x28,
+      0x2,   0x2,    0x1cd,  0x1d3,  0x7,    0x3f,   0x2,    0x2,    0x1ce,
+      0x1cf, 0x7,    0x60,   0x2,    0x2,    0x1cf,  0x1d3,  0x7,    0x3f,
+      0x2,   0x2,    0x1d0,  0x1d1,  0x7,    0x7e,   0x2,    0x2,    0x1d1,
+      0x1d3, 0x7,    0x3f,   0x2,    0x2,    0x1d2,  0x1b8,  0x3,    0x2,
+      0x2,   0x2,    0x1d2,  0x1ba,  0x3,    0x2,    0x2,    0x2,    0x1d2,
+      0x1bc, 0x3,    0x2,    0x2,    0x2,    0x1d2,  0x1be,  0x3,    0x2,
+      0x2,   0x2,    0x1d2,  0x1c0,  0x3,    0x2,    0x2,    0x2,    0x1d2,
+      0x1c2, 0x3,    0x2,    0x2,    0x2,    0x1d2,  0x1c5,  0x3,    0x2,
+      0x2,   0x2,    0x1d2,  0x1c8,  0x3,    0x2,    0x2,    0x2,    0x1d2,
+      0x1cc, 0x3,    0x2,    0x2,    0x2,    0x1d2,  0x1ce,  0x3,    0x2,
+      0x2,   0x2,    0x1d2,  0x1d0,  0x3,    0x2,    0x2,    0x2,    0x1d3,
+      0x68,  0x3,    0x2,    0x2,    0x2,    0x1d4,  0x1d5,  0x7,    0x3f,
+      0x2,   0x2,    0x1d5,  0x1d6,  0x7,    0x3f,   0x2,    0x2,    0x1d6,
+      0x6a,  0x3,    0x2,    0x2,    0x2,    0x1d7,  0x1d8,  0x7,    0x2d,
+      0x2,   0x2,    0x1d8,  0x6c,   0x3,    0x2,    0x2,    0x2,    0x1d9,
+      0x1da, 0x7,    0x2f,   0x2,    0x2,    0x1da,  0x6e,   0x3,    0x2,
+      0x2,   0x2,    0x1db,  0x1dc,  0x7,    0x2c,   0x2,    0x2,    0x1dc,
+      0x70,  0x3,    0x2,    0x2,    0x2,    0x1dd,  0x1de,  0x7,    0x31,
+      0x2,   0x2,    0x1de,  0x72,   0x3,    0x2,    0x2,    0x2,    0x1df,
+      0x1e0, 0x7,    0x27,   0x2,    0x2,    0x1e0,  0x74,   0x3,    0x2,
+      0x2,   0x2,    0x1e1,  0x1e2,  0x7,    0x7e,   0x2,    0x2,    0x1e2,
+      0x76,  0x3,    0x2,    0x2,    0x2,    0x1e3,  0x1e4,  0x7,    0x28,
+      0x2,   0x2,    0x1e4,  0x78,   0x3,    0x2,    0x2,    0x2,    0x1e5,
+      0x1e6, 0x7,    0x80,   0x2,    0x2,    0x1e6,  0x7a,   0x3,    0x2,
+      0x2,   0x2,    0x1e7,  0x1e8,  0x7,    0x6f,   0x2,    0x2,    0x1e8,
+      0x1e9, 0x7,    0x63,   0x2,    0x2,    0x1e9,  0x1ea,  0x7,    0x7a,
+      0x2,   0x2,    0x1ea,  0x7c,   0x3,    0x2,    0x2,    0x2,    0x1eb,
+      0x1ec, 0x7,    0x6f,   0x2,    0x2,    0x1ec,  0x1ed,  0x7,    0x6b,
+      0x2,   0x2,    0x1ed,  0x1ee,  0x7,    0x70,   0x2,    0x2,    0x1ee,
+      0x7e,  0x3,    0x2,    0x2,    0x2,    0x1ef,  0x1f0,  0x7,    0x23,
+      0x2,   0x2,    0x1f0,  0x1f1,  0x7,    0x3f,   0x2,    0x2,    0x1f1,
+      0x80,  0x3,    0x2,    0x2,    0x2,    0x1f2,  0x1f3,  0x7,    0x3e,
+      0x2,   0x2,    0x1f3,  0x82,   0x3,    0x2,    0x2,    0x2,    0x1f4,
+      0x1f5, 0x7,    0x3e,   0x2,    0x2,    0x1f5,  0x1f6,  0x7,    0x3f,
+      0x2,   0x2,    0x1f6,  0x84,   0x3,    0x2,    0x2,    0x2,    0x1f7,
+      0x1f8, 0x7,    0x40,   0x2,    0x2,    0x1f8,  0x86,   0x3,    0x2,
+      0x2,   0x2,    0x1f9,  0x1fa,  0x7,    0x40,   0x2,    0x2,    0x1fa,
+      0x1fb, 0x7,    0x3f,   0x2,    0x2,    0x1fb,  0x88,   0x3,    0x2,
+      0x2,   0x2,    0x1fc,  0x1fd,  0x7,    0x3e,   0x2,    0x2,    0x1fd,
+      0x1fe, 0x7,    0x3e,   0x2,    0x2,    0x1fe,  0x8a,   0x3,    0x2,
+      0x2,   0x2,    0x1ff,  0x200,  0x7,    0x40,   0x2,    0x2,    0x200,
+      0x201, 0x7,    0x40,   0x2,    0x2,    0x201,  0x8c,   0x3,    0x2,
+      0x2,   0x2,    0x202,  0x203,  0x7,    0x40,   0x2,    0x2,    0x203,
+      0x204, 0x7,    0x40,   0x2,    0x2,    0x204,  0x205,  0x7,    0x40,
+      0x2,   0x2,    0x205,  0x8e,   0x3,    0x2,    0x2,    0x2,    0x206,
+      0x207, 0x7,    0x30,   0x2,    0x2,    0x207,  0x208,  0x7,    0x30,
+      0x2,   0x2,    0x208,  0x209,  0x7,    0x30,   0x2,    0x2,    0x209,
+      0x90,  0x3,    0x2,    0x2,    0x2,    0x20a,  0x20d,  0x5,    0x69,
+      0x35,  0x2,    0x20b,  0x20d,  0x5,    0x7f,   0x40,   0x2,    0x20c,
+      0x20a, 0x3,    0x2,    0x2,    0x2,    0x20c,  0x20b,  0x3,    0x2,
+      0x2,   0x2,    0x20d,  0x92,   0x3,    0x2,    0x2,    0x2,    0x20e,
+      0x20f, 0x7,    0x2d,   0x2,    0x2,    0x20f,  0x210,  0x7,    0x2d,
+      0x2,   0x2,    0x210,  0x94,   0x3,    0x2,    0x2,    0x2,    0x211,
+      0x212, 0x7,    0x2f,   0x2,    0x2,    0x212,  0x213,  0x7,    0x2f,
+      0x2,   0x2,    0x213,  0x96,   0x3,    0x2,    0x2,    0x2,    0x214,
+      0x215, 0x7,    0x23,   0x2,    0x2,    0x215,  0x98,   0x3,    0x2,
+      0x2,   0x2,    0x216,  0x21b,  0x7,    0x24,   0x2,    0x2,    0x217,
+      0x21a, 0x5,    0x9b,   0x4e,   0x2,    0x218,  0x21a,  0xa,    0x2,
+      0x2,   0x2,    0x219,  0x217,  0x3,    0x2,    0x2,    0x2,    0x219,
+      0x218, 0x3,    0x2,    0x2,    0x2,    0x21a,  0x21d,  0x3,    0x2,
+      0x2,   0x2,    0x21b,  0x219,  0x3,    0x2,    0x2,    0x2,    0x21b,
+      0x21c, 0x3,    0x2,    0x2,    0x2,    0x21c,  0x21e,  0x3,    0x2,
+      0x2,   0x2,    0x21d,  0x21b,  0x3,    0x2,    0x2,    0x2,    0x21e,
+      0x229, 0x7,    0x24,   0x2,    0x2,    0x21f,  0x224,  0x7,    0x29,
+      0x2,   0x2,    0x220,  0x223,  0x5,    0x9b,   0x4e,   0x2,    0x221,
+      0x223, 0xa,    0x3,    0x2,    0x2,    0x222,  0x220,  0x3,    0x2,
+      0x2,   0x2,    0x222,  0x221,  0x3,    0x2,    0x2,    0x2,    0x223,
+      0x226, 0x3,    0x2,    0x2,    0x2,    0x224,  0x222,  0x3,    0x2,
+      0x2,   0x2,    0x224,  0x225,  0x3,    0x2,    0x2,    0x2,    0x225,
+      0x227, 0x3,    0x2,    0x2,    0x2,    0x226,  0x224,  0x3,    0x2,
+      0x2,   0x2,    0x227,  0x229,  0x7,    0x29,   0x2,    0x2,    0x228,
+      0x216, 0x3,    0x2,    0x2,    0x2,    0x228,  0x21f,  0x3,    0x2,
+      0x2,   0x2,    0x229,  0x9a,   0x3,    0x2,    0x2,    0x2,    0x22a,
+      0x22b, 0x7,    0x5e,   0x2,    0x2,    0x22b,  0x22c,  0x9,    0x4,
+      0x2,   0x2,    0x22c,  0x9c,   0x3,    0x2,    0x2,    0x2,    0x22d,
+      0x231, 0x9,    0x5,    0x2,    0x2,    0x22e,  0x230,  0x9,    0x6,
+      0x2,   0x2,    0x22f,  0x22e,  0x3,    0x2,    0x2,    0x2,    0x230,
+      0x233, 0x3,    0x2,    0x2,    0x2,    0x231,  0x22f,  0x3,    0x2,
+      0x2,   0x2,    0x231,  0x232,  0x3,    0x2,    0x2,    0x2,    0x232,
+      0x9e,  0x3,    0x2,    0x2,    0x2,    0x233,  0x231,  0x3,    0x2,
+      0x2,   0x2,    0x234,  0x236,  0x9,    0x7,    0x2,    0x2,    0x235,
+      0x234, 0x3,    0x2,    0x2,    0x2,    0x236,  0x237,  0x3,    0x2,
+      0x2,   0x2,    0x237,  0x235,  0x3,    0x2,    0x2,    0x2,    0x237,
+      0x238, 0x3,    0x2,    0x2,    0x2,    0x238,  0x239,  0x3,    0x2,
+      0x2,   0x2,    0x239,  0x23a,  0x8,    0x50,   0x2,    0x2,    0x23a,
+      0xa0,  0x3,    0x2,    0x2,    0x2,    0x23b,  0x23c,  0x7,    0x31,
+      0x2,   0x2,    0x23c,  0x23d,  0x7,    0x2c,   0x2,    0x2,    0x23d,
+      0x241, 0x3,    0x2,    0x2,    0x2,    0x23e,  0x240,  0xb,    0x2,
+      0x2,   0x2,    0x23f,  0x23e,  0x3,    0x2,    0x2,    0x2,    0x240,
+      0x243, 0x3,    0x2,    0x2,    0x2,    0x241,  0x242,  0x3,    0x2,
+      0x2,   0x2,    0x241,  0x23f,  0x3,    0x2,    0x2,    0x2,    0x242,
+      0x247, 0x3,    0x2,    0x2,    0x2,    0x243,  0x241,  0x3,    0x2,
+      0x2,   0x2,    0x244,  0x245,  0x7,    0x2c,   0x2,    0x2,    0x245,
+      0x248, 0x7,    0x31,   0x2,    0x2,    0x246,  0x248,  0x7,    0x2,
+      0x2,   0x3,    0x247,  0x244,  0x3,    0x2,    0x2,    0x2,    0x247,
+      0x246, 0x3,    0x2,    0x2,    0x2,    0x248,  0x249,  0x3,    0x2,
+      0x2,   0x2,    0x249,  0x24a,  0x8,    0x51,   0x2,    0x2,    0x24a,
+      0xa2,  0x3,    0x2,    0x2,    0x2,    0x24b,  0x24c,  0x7,    0x31,
+      0x2,   0x2,    0x24c,  0x24d,  0x7,    0x31,   0x2,    0x2,    0x24d,
+      0x251, 0x3,    0x2,    0x2,    0x2,    0x24e,  0x250,  0xa,    0x8,
+      0x2,   0x2,    0x24f,  0x24e,  0x3,    0x2,    0x2,    0x2,    0x250,
+      0x253, 0x3,    0x2,    0x2,    0x2,    0x251,  0x24f,  0x3,    0x2,
+      0x2,   0x2,    0x251,  0x252,  0x3,    0x2,    0x2,    0x2,    0x252,
+      0x254, 0x3,    0x2,    0x2,    0x2,    0x253,  0x251,  0x3,    0x2,
+      0x2,   0x2,    0x254,  0x255,  0x8,    0x52,   0x2,    0x2,    0x255,
+      0xa4,  0x3,    0x2,    0x2,    0x2,    0x256,  0x257,  0x9,    0x9,
+      0x2,   0x2,    0x257,  0xa6,   0x3,    0x2,    0x2,    0x2,    0x258,
+      0x261, 0x7,    0x32,   0x2,    0x2,    0x259,  0x25d,  0x9,    0xa,
+      0x2,   0x2,    0x25a,  0x25c,  0x5,    0xa5,   0x53,   0x2,    0x25b,
+      0x25a, 0x3,    0x2,    0x2,    0x2,    0x25c,  0x25f,  0x3,    0x2,
+      0x2,   0x2,    0x25d,  0x25b,  0x3,    0x2,    0x2,    0x2,    0x25d,
+      0x25e, 0x3,    0x2,    0x2,    0x2,    0x25e,  0x261,  0x3,    0x2,
+      0x2,   0x2,    0x25f,  0x25d,  0x3,    0x2,    0x2,    0x2,    0x260,
+      0x258, 0x3,    0x2,    0x2,    0x2,    0x260,  0x259,  0x3,    0x2,
+      0x2,   0x2,    0x261,  0xa8,   0x3,    0x2,    0x2,    0x2,    0x262,
+      0x264, 0x9,    0xb,    0x2,    0x2,    0x263,  0x265,  0x9,    0xc,
+      0x2,   0x2,    0x264,  0x263,  0x3,    0x2,    0x2,    0x2,    0x264,
+      0x265, 0x3,    0x2,    0x2,    0x2,    0x265,  0x267,  0x3,    0x2,
+      0x2,   0x2,    0x266,  0x268,  0x5,    0xa5,   0x53,   0x2,    0x267,
+      0x266, 0x3,    0x2,    0x2,    0x2,    0x268,  0x269,  0x3,    0x2,
+      0x2,   0x2,    0x269,  0x267,  0x3,    0x2,    0x2,    0x2,    0x269,
+      0x26a, 0x3,    0x2,    0x2,    0x2,    0x26a,  0xaa,   0x3,    0x2,
+      0x2,   0x2,    0x26b,  0x26d,  0x5,    0x6d,   0x37,   0x2,    0x26c,
+      0x26b, 0x3,    0x2,    0x2,    0x2,    0x26c,  0x26d,  0x3,    0x2,
+      0x2,   0x2,    0x26d,  0x26e,  0x3,    0x2,    0x2,    0x2,    0x26e,
+      0x26f, 0x5,    0xa7,   0x54,   0x2,    0x26f,  0x273,  0x7,    0x30,
+      0x2,   0x2,    0x270,  0x272,  0x5,    0xa5,   0x53,   0x2,    0x271,
+      0x270, 0x3,    0x2,    0x2,    0x2,    0x272,  0x275,  0x3,    0x2,
+      0x2,   0x2,    0x273,  0x271,  0x3,    0x2,    0x2,    0x2,    0x273,
+      0x274, 0x3,    0x2,    0x2,    0x2,    0x274,  0x277,  0x3,    0x2,
+      0x2,   0x2,    0x275,  0x273,  0x3,    0x2,    0x2,    0x2,    0x276,
+      0x278, 0x5,    0xa9,   0x55,   0x2,    0x277,  0x276,  0x3,    0x2,
+      0x2,   0x2,    0x277,  0x278,  0x3,    0x2,    0x2,    0x2,    0x278,
+      0x298, 0x3,    0x2,    0x2,    0x2,    0x279,  0x27b,  0x5,    0x6d,
+      0x37,  0x2,    0x27a,  0x279,  0x3,    0x2,    0x2,    0x2,    0x27a,
+      0x27b, 0x3,    0x2,    0x2,    0x2,    0x27b,  0x27c,  0x3,    0x2,
+      0x2,   0x2,    0x27c,  0x27e,  0x7,    0x30,   0x2,    0x2,    0x27d,
+      0x27f, 0x5,    0xa5,   0x53,   0x2,    0x27e,  0x27d,  0x3,    0x2,
+      0x2,   0x2,    0x27f,  0x280,  0x3,    0x2,    0x2,    0x2,    0x280,
+      0x27e, 0x3,    0x2,    0x2,    0x2,    0x280,  0x281,  0x3,    0x2,
+      0x2,   0x2,    0x281,  0x283,  0x3,    0x2,    0x2,    0x2,    0x282,
+      0x284, 0x5,    0xa9,   0x55,   0x2,    0x283,  0x282,  0x3,    0x2,
+      0x2,   0x2,    0x283,  0x284,  0x3,    0x2,    0x2,    0x2,    0x284,
+      0x298, 0x3,    0x2,    0x2,    0x2,    0x285,  0x287,  0x5,    0x6d,
+      0x37,  0x2,    0x286,  0x285,  0x3,    0x2,    0x2,    0x2,    0x286,
+      0x287, 0x3,    0x2,    0x2,    0x2,    0x287,  0x288,  0x3,    0x2,
+      0x2,   0x2,    0x288,  0x28a,  0x5,    0xa7,   0x54,   0x2,    0x289,
+      0x28b, 0x5,    0xa9,   0x55,   0x2,    0x28a,  0x289,  0x3,    0x2,
+      0x2,   0x2,    0x28a,  0x28b,  0x3,    0x2,    0x2,    0x2,    0x28b,
+      0x298, 0x3,    0x2,    0x2,    0x2,    0x28c,  0x28e,  0x5,    0x6d,
+      0x37,  0x2,    0x28d,  0x28c,  0x3,    0x2,    0x2,    0x2,    0x28d,
+      0x28e, 0x3,    0x2,    0x2,    0x2,    0x28e,  0x28f,  0x3,    0x2,
+      0x2,   0x2,    0x28f,  0x290,  0x7,    0x32,   0x2,    0x2,    0x290,
+      0x291, 0x7,    0x7a,   0x2,    0x2,    0x291,  0x293,  0x3,    0x2,
+      0x2,   0x2,    0x292,  0x294,  0x9,    0xd,    0x2,    0x2,    0x293,
+      0x292, 0x3,    0x2,    0x2,    0x2,    0x294,  0x295,  0x3,    0x2,
+      0x2,   0x2,    0x295,  0x293,  0x3,    0x2,    0x2,    0x2,    0x295,
+      0x296, 0x3,    0x2,    0x2,    0x2,    0x296,  0x298,  0x3,    0x2,
+      0x2,   0x2,    0x297,  0x26c,  0x3,    0x2,    0x2,    0x2,    0x297,
+      0x27a, 0x3,    0x2,    0x2,    0x2,    0x297,  0x286,  0x3,    0x2,
+      0x2,   0x2,    0x297,  0x28d,  0x3,    0x2,    0x2,    0x2,    0x298,
+      0xac,  0x3,    0x2,    0x2,    0x2,    0x1e,   0x2,    0x1d2,  0x20c,
+      0x219, 0x21b,  0x222,  0x224,  0x228,  0x231,  0x237,  0x241,  0x247,
+      0x251, 0x25d,  0x260,  0x264,  0x269,  0x26c,  0x273,  0x277,  0x27a,
+      0x280, 0x283,  0x286,  0x28a,  0x28d,  0x295,  0x297,  0x3,    0x2,
+      0x3,   0x2,
   };
 
   atn::ATNDeserializer deserializer;
diff --git a/deps/v8/src/torque/TorqueLexer.h b/deps/v8/src/torque/TorqueLexer.h
index 6823dccfd5d858..c95a80debd36d6 100644
--- a/deps/v8/src/torque/TorqueLexer.h
+++ b/deps/v8/src/torque/TorqueLexer.h
@@ -56,43 +56,44 @@ class TorqueLexer : public antlr4::Lexer {
     ISNT = 41,
     IS = 42,
     LET = 43,
-    EXTERN = 44,
-    ASSERT_TOKEN = 45,
-    CHECK_TOKEN = 46,
-    UNREACHABLE_TOKEN = 47,
-    DEBUG_TOKEN = 48,
-    ASSIGNMENT = 49,
-    ASSIGNMENT_OPERATOR = 50,
-    EQUAL = 51,
-    PLUS = 52,
-    MINUS = 53,
-    MULTIPLY = 54,
-    DIVIDE = 55,
-    MODULO = 56,
-    BIT_OR = 57,
-    BIT_AND = 58,
-    BIT_NOT = 59,
-    MAX = 60,
-    MIN = 61,
-    NOT_EQUAL = 62,
-    LESS_THAN = 63,
-    LESS_THAN_EQUAL = 64,
-    GREATER_THAN = 65,
-    GREATER_THAN_EQUAL = 66,
-    SHIFT_LEFT = 67,
-    SHIFT_RIGHT = 68,
-    SHIFT_RIGHT_ARITHMETIC = 69,
-    VARARGS = 70,
-    EQUALITY_OPERATOR = 71,
-    INCREMENT = 72,
-    DECREMENT = 73,
-    NOT = 74,
-    STRING_LITERAL = 75,
-    IDENTIFIER = 76,
-    WS = 77,
-    BLOCK_COMMENT = 78,
-    LINE_COMMENT = 79,
-    DECIMAL_LITERAL = 80
+    CONST = 44,
+    EXTERN = 45,
+    ASSERT_TOKEN = 46,
+    CHECK_TOKEN = 47,
+    UNREACHABLE_TOKEN = 48,
+    DEBUG_TOKEN = 49,
+    ASSIGNMENT = 50,
+    ASSIGNMENT_OPERATOR = 51,
+    EQUAL = 52,
+    PLUS = 53,
+    MINUS = 54,
+    MULTIPLY = 55,
+    DIVIDE = 56,
+    MODULO = 57,
+    BIT_OR = 58,
+    BIT_AND = 59,
+    BIT_NOT = 60,
+    MAX = 61,
+    MIN = 62,
+    NOT_EQUAL = 63,
+    LESS_THAN = 64,
+    LESS_THAN_EQUAL = 65,
+    GREATER_THAN = 66,
+    GREATER_THAN_EQUAL = 67,
+    SHIFT_LEFT = 68,
+    SHIFT_RIGHT = 69,
+    SHIFT_RIGHT_ARITHMETIC = 70,
+    VARARGS = 71,
+    EQUALITY_OPERATOR = 72,
+    INCREMENT = 73,
+    DECREMENT = 74,
+    NOT = 75,
+    STRING_LITERAL = 76,
+    IDENTIFIER = 77,
+    WS = 78,
+    BLOCK_COMMENT = 79,
+    LINE_COMMENT = 80,
+    DECIMAL_LITERAL = 81
   };
 
   explicit TorqueLexer(antlr4::CharStream* input);
diff --git a/deps/v8/src/torque/TorqueLexer.interp b/deps/v8/src/torque/TorqueLexer.interp
new file mode 100644
index 00000000000000..bbe1cb77ee3ca4
--- /dev/null
+++ b/deps/v8/src/torque/TorqueLexer.interp
@@ -0,0 +1,264 @@
+token literal names:
+null
+'('
+')'
+'=>'
+','
+':'
+'type'
+'?'
+'||'
+'&&'
+'.'
+'['
+']'
+'{'
+'}'
+';'
+'of'
+'else'
+'extends'
+'generates'
+'operator'
+'struct'
+'macro'
+'builtin'
+'runtime'
+'module'
+'javascript'
+'deferred'
+'if'
+'for'
+'while'
+'return'
+'constexpr'
+'continue'
+'break'
+'goto'
+'otherwise'
+'try'
+'label'
+'labels'
+'tail'
+'isnt'
+'is'
+'let'
+'const'
+'extern'
+'assert'
+'check'
+'unreachable'
+'debug'
+'='
+null
+'=='
+'+'
+'-'
+'*'
+'/'
+'%'
+'|'
+'&'
+'~'
+'max'
+'min'
+'!='
+'<'
+'<='
+'>'
+'>='
+'<<'
+'>>'
+'>>>'
+'...'
+null
+'++'
+'--'
+'!'
+null
+null
+null
+null
+null
+null
+
+token symbolic names:
+null
+null
+null
+null
+null
+null
+null
+null
+null
+null
+null
+null
+null
+null
+null
+null
+null
+null
+null
+null
+null
+null
+MACRO
+BUILTIN
+RUNTIME
+MODULE
+JAVASCRIPT
+DEFERRED
+IF
+FOR
+WHILE
+RETURN
+CONSTEXPR
+CONTINUE
+BREAK
+GOTO
+OTHERWISE
+TRY
+LABEL
+LABELS
+TAIL
+ISNT
+IS
+LET
+CONST
+EXTERN
+ASSERT_TOKEN
+CHECK_TOKEN
+UNREACHABLE_TOKEN
+DEBUG_TOKEN
+ASSIGNMENT
+ASSIGNMENT_OPERATOR
+EQUAL
+PLUS
+MINUS
+MULTIPLY
+DIVIDE
+MODULO
+BIT_OR
+BIT_AND
+BIT_NOT
+MAX
+MIN
+NOT_EQUAL
+LESS_THAN
+LESS_THAN_EQUAL
+GREATER_THAN
+GREATER_THAN_EQUAL
+SHIFT_LEFT
+SHIFT_RIGHT
+SHIFT_RIGHT_ARITHMETIC
+VARARGS
+EQUALITY_OPERATOR
+INCREMENT
+DECREMENT
+NOT
+STRING_LITERAL
+IDENTIFIER
+WS
+BLOCK_COMMENT
+LINE_COMMENT
+DECIMAL_LITERAL
+
+rule names:
+T__0
+T__1
+T__2
+T__3
+T__4
+T__5
+T__6
+T__7
+T__8
+T__9
+T__10
+T__11
+T__12
+T__13
+T__14
+T__15
+T__16
+T__17
+T__18
+T__19
+T__20
+MACRO
+BUILTIN
+RUNTIME
+MODULE
+JAVASCRIPT
+DEFERRED
+IF
+FOR
+WHILE
+RETURN
+CONSTEXPR
+CONTINUE
+BREAK
+GOTO
+OTHERWISE
+TRY
+LABEL
+LABELS
+TAIL
+ISNT
+IS
+LET
+CONST
+EXTERN
+ASSERT_TOKEN
+CHECK_TOKEN
+UNREACHABLE_TOKEN
+DEBUG_TOKEN
+ASSIGNMENT
+ASSIGNMENT_OPERATOR
+EQUAL
+PLUS
+MINUS
+MULTIPLY
+DIVIDE
+MODULO
+BIT_OR
+BIT_AND
+BIT_NOT
+MAX
+MIN
+NOT_EQUAL
+LESS_THAN
+LESS_THAN_EQUAL
+GREATER_THAN
+GREATER_THAN_EQUAL
+SHIFT_LEFT
+SHIFT_RIGHT
+SHIFT_RIGHT_ARITHMETIC
+VARARGS
+EQUALITY_OPERATOR
+INCREMENT
+DECREMENT
+NOT
+STRING_LITERAL
+ESCAPE
+IDENTIFIER
+WS
+BLOCK_COMMENT
+LINE_COMMENT
+DECIMAL_DIGIT
+DECIMAL_INTEGER_LITERAL
+EXPONENT_PART
+DECIMAL_LITERAL
+
+channel names:
+DEFAULT_TOKEN_CHANNEL
+HIDDEN
+
+mode names:
+DEFAULT_MODE
+
+atn:
+[3, 24715, 42794, 33075, 47597, 16764, 15335, 30598, 22884, 2, 83, 665, 8, 1, 4, 2, 9, 2, 4, 3, 9, 3, 4, 4, 9, 4, 4, 5, 9, 5, 4, 6, 9, 6, 4, 7, 9, 7, 4, 8, 9, 8, 4, 9, 9, 9, 4, 10, 9, 10, 4, 11, 9, 11, 4, 12, 9, 12, 4, 13, 9, 13, 4, 14, 9, 14, 4, 15, 9, 15, 4, 16, 9, 16, 4, 17, 9, 17, 4, 18, 9, 18, 4, 19, 9, 19, 4, 20, 9, 20, 4, 21, 9, 21, 4, 22, 9, 22, 4, 23, 9, 23, 4, 24, 9, 24, 4, 25, 9, 25, 4, 26, 9, 26, 4, 27, 9, 27, 4, 28, 9, 28, 4, 29, 9, 29, 4, 30, 9, 30, 4, 31, 9, 31, 4, 32, 9, 32, 4, 33, 9, 33, 4, 34, 9, 34, 4, 35, 9, 35, 4, 36, 9, 36, 4, 37, 9, 37, 4, 38, 9, 38, 4, 39, 9, 39, 4, 40, 9, 40, 4, 41, 9, 41, 4, 42, 9, 42, 4, 43, 9, 43, 4, 44, 9, 44, 4, 45, 9, 45, 4, 46, 9, 46, 4, 47, 9, 47, 4, 48, 9, 48, 4, 49, 9, 49, 4, 50, 9, 50, 4, 51, 9, 51, 4, 52, 9, 52, 4, 53, 9, 53, 4, 54, 9, 54, 4, 55, 9, 55, 4, 56, 9, 56, 4, 57, 9, 57, 4, 58, 9, 58, 4, 59, 9, 59, 4, 60, 9, 60, 4, 61, 9, 61, 4, 62, 9, 62, 4, 63, 9, 63, 4, 64, 9, 64, 4, 65, 9, 65, 4, 66, 9, 66, 4, 67, 9, 67, 4, 68, 9, 68, 4, 69, 9, 69, 4, 70, 9, 70, 4, 71, 9, 71, 4, 72, 9, 72, 4, 73, 9, 73, 4, 74, 9, 74, 4, 75, 9, 75, 4, 76, 9, 76, 4, 77, 9, 77, 4, 78, 9, 78, 4, 79, 9, 79, 4, 80, 9, 80, 4, 81, 9, 81, 4, 82, 9, 82, 4, 83, 9, 83, 4, 84, 9, 84, 4, 85, 9, 85, 4, 86, 9, 86, 3, 2, 3, 2, 3, 3, 3, 3, 3, 4, 3, 4, 3, 4, 3, 5, 3, 5, 3, 6, 3, 6, 3, 7, 3, 7, 3, 7, 3, 7, 3, 7, 3, 8, 3, 8, 3, 9, 3, 9, 3, 9, 3, 10, 3, 10, 3, 10, 3, 11, 3, 11, 3, 12, 3, 12, 3, 13, 3, 13, 3, 14, 3, 14, 3, 15, 3, 15, 3, 16, 3, 16, 3, 17, 3, 17, 3, 17, 3, 18, 3, 18, 3, 18, 3, 18, 3, 18, 3, 19, 3, 19, 3, 19, 3, 19, 3, 19, 3, 19, 3, 19, 3, 19, 3, 20, 3, 20, 3, 20, 3, 20, 3, 20, 3, 20, 3, 20, 3, 20, 3, 20, 3, 20, 3, 21, 3, 21, 3, 21, 3, 21, 3, 21, 3, 21, 3, 21, 3, 21, 3, 21, 3, 22, 3, 22, 3, 22, 3, 22, 3, 22, 3, 22, 3, 22, 3, 23, 3, 23, 3, 23, 3, 23, 3, 23, 3, 23, 3, 24, 3, 24, 3, 24, 3, 24, 3, 24, 3, 24, 3, 24, 3, 24, 3, 25, 3, 25, 3, 25, 3, 25, 3, 25, 3, 25, 3, 25, 3, 25, 3, 26, 3, 26, 3, 26, 3, 26, 3, 26, 3, 26, 3, 26, 3, 27, 3, 27, 3, 27, 3, 27, 3, 27, 3, 27, 3, 27, 3, 27, 3, 27, 3, 27, 3, 27, 3, 28, 3, 28, 3, 28, 3, 28, 3, 28, 3, 28, 3, 28, 3, 28, 3, 28, 3, 29, 3, 29, 3, 29, 3, 30, 3, 30, 3, 30, 3, 30, 3, 31, 3, 31, 3, 31, 3, 31, 3, 31, 3, 31, 3, 32, 3, 32, 3, 32, 3, 32, 3, 32, 3, 32, 3, 32, 3, 33, 3, 33, 3, 33, 3, 33, 3, 33, 3, 33, 3, 33, 3, 33, 3, 33, 3, 33, 3, 34, 3, 34, 3, 34, 3, 34, 3, 34, 3, 34, 3, 34, 3, 34, 3, 34, 3, 35, 3, 35, 3, 35, 3, 35, 3, 35, 3, 35, 3, 36, 3, 36, 3, 36, 3, 36, 3, 36, 3, 37, 3, 37, 3, 37, 3, 37, 3, 37, 3, 37, 3, 37, 3, 37, 3, 37, 3, 37, 3, 38, 3, 38, 3, 38, 3, 38, 3, 39, 3, 39, 3, 39, 3, 39, 3, 39, 3, 39, 3, 40, 3, 40, 3, 40, 3, 40, 3, 40, 3, 40, 3, 40, 3, 41, 3, 41, 3, 41, 3, 41, 3, 41, 3, 42, 3, 42, 3, 42, 3, 42, 3, 42, 3, 43, 3, 43, 3, 43, 3, 44, 3, 44, 3, 44, 3, 44, 3, 45, 3, 45, 3, 45, 3, 45, 3, 45, 3, 45, 3, 46, 3, 46, 3, 46, 3, 46, 3, 46, 3, 46, 3, 46, 3, 47, 3, 47, 3, 47, 3, 47, 3, 47, 3, 47, 3, 47, 3, 48, 3, 48, 3, 48, 3, 48, 3, 48, 3, 48, 3, 49, 3, 49, 3, 49, 3, 49, 3, 49, 3, 49, 3, 49, 3, 49, 3, 49, 3, 49, 3, 49, 3, 49, 3, 50, 3, 50, 3, 50, 3, 50, 3, 50, 3, 50, 3, 51, 3, 51, 3, 52, 3, 52, 3, 52, 3, 52, 3, 52, 3, 52, 3, 52, 3, 52, 3, 52, 3, 52, 3, 52, 3, 52, 3, 52, 3, 52, 3, 52, 3, 52, 3, 52, 3, 52, 3, 52, 3, 52, 3, 52, 3, 52, 3, 52, 3, 52, 3, 52, 3, 52, 5, 52, 467, 10, 52, 3, 53, 3, 53, 3, 53, 3, 54, 3, 54, 3, 55, 3, 55, 3, 56, 3, 56, 3, 57, 3, 57, 3, 58, 3, 58, 3, 59, 3, 59, 3, 60, 3, 60, 3, 61, 3, 61, 3, 62, 3, 62, 3, 62, 3, 62, 3, 63, 3, 63, 3, 63, 3, 63, 3, 64, 3, 64, 3, 64, 3, 65, 3, 65, 3, 66, 3, 66, 3, 66, 3, 67, 3, 67, 3, 68, 3, 68, 3, 68, 3, 69, 3, 69, 3, 69, 3, 70, 3, 70, 3, 70, 3, 71, 3, 71, 3, 71, 3, 71, 3, 72, 3, 72, 3, 72, 3, 72, 3, 73, 3, 73, 5, 73, 525, 10, 73, 3, 74, 3, 74, 3, 74, 3, 75, 3, 75, 3, 75, 3, 76, 3, 76, 3, 77, 3, 77, 3, 77, 7, 77, 538, 10, 77, 12, 77, 14, 77, 541, 11, 77, 3, 77, 3, 77, 3, 77, 3, 77, 7, 77, 547, 10, 77, 12, 77, 14, 77, 550, 11, 77, 3, 77, 5, 77, 553, 10, 77, 3, 78, 3, 78, 3, 78, 3, 79, 3, 79, 7, 79, 560, 10, 79, 12, 79, 14, 79, 563, 11, 79, 3, 80, 6, 80, 566, 10, 80, 13, 80, 14, 80, 567, 3, 80, 3, 80, 3, 81, 3, 81, 3, 81, 3, 81, 7, 81, 576, 10, 81, 12, 81, 14, 81, 579, 11, 81, 3, 81, 3, 81, 3, 81, 5, 81, 584, 10, 81, 3, 81, 3, 81, 3, 82, 3, 82, 3, 82, 3, 82, 7, 82, 592, 10, 82, 12, 82, 14, 82, 595, 11, 82, 3, 82, 3, 82, 3, 83, 3, 83, 3, 84, 3, 84, 3, 84, 7, 84, 604, 10, 84, 12, 84, 14, 84, 607, 11, 84, 5, 84, 609, 10, 84, 3, 85, 3, 85, 5, 85, 613, 10, 85, 3, 85, 6, 85, 616, 10, 85, 13, 85, 14, 85, 617, 3, 86, 5, 86, 621, 10, 86, 3, 86, 3, 86, 3, 86, 7, 86, 626, 10, 86, 12, 86, 14, 86, 629, 11, 86, 3, 86, 5, 86, 632, 10, 86, 3, 86, 5, 86, 635, 10, 86, 3, 86, 3, 86, 6, 86, 639, 10, 86, 13, 86, 14, 86, 640, 3, 86, 5, 86, 644, 10, 86, 3, 86, 5, 86, 647, 10, 86, 3, 86, 3, 86, 5, 86, 651, 10, 86, 3, 86, 5, 86, 654, 10, 86, 3, 86, 3, 86, 3, 86, 3, 86, 6, 86, 660, 10, 86, 13, 86, 14, 86, 661, 5, 86, 664, 10, 86, 3, 577, 2, 87, 3, 3, 5, 4, 7, 5, 9, 6, 11, 7, 13, 8, 15, 9, 17, 10, 19, 11, 21, 12, 23, 13, 25, 14, 27, 15, 29, 16, 31, 17, 33, 18, 35, 19, 37, 20, 39, 21, 41, 22, 43, 23, 45, 24, 47, 25, 49, 26, 51, 27, 53, 28, 55, 29, 57, 30, 59, 31, 61, 32, 63, 33, 65, 34, 67, 35, 69, 36, 71, 37, 73, 38, 75, 39, 77, 40, 79, 41, 81, 42, 83, 43, 85, 44, 87, 45, 89, 46, 91, 47, 93, 48, 95, 49, 97, 50, 99, 51, 101, 52, 103, 53, 105, 54, 107, 55, 109, 56, 111, 57, 113, 58, 115, 59, 117, 60, 119, 61, 121, 62, 123, 63, 125, 64, 127, 65, 129, 66, 131, 67, 133, 68, 135, 69, 137, 70, 139, 71, 141, 72, 143, 73, 145, 74, 147, 75, 149, 76, 151, 77, 153, 78, 155, 2, 157, 79, 159, 80, 161, 81, 163, 82, 165, 2, 167, 2, 169, 2, 171, 83, 3, 2, 14, 6, 2, 12, 12, 15, 15, 36, 36, 94, 94, 6, 2, 12, 12, 15, 15, 41, 41, 94, 94, 7, 2, 36, 36, 41, 41, 94, 94, 112, 112, 116, 116, 4, 2, 67, 92, 99, 124, 6, 2, 50, 59, 67, 92, 97, 97, 99, 124, 5, 2, 11, 12, 14, 15, 34, 34, 4, 2, 12, 12, 15, 15, 3, 2, 50, 59, 3, 2, 51, 59, 4, 2, 71, 71, 103, 103, 4, 2, 45, 45, 47, 47, 5, 2, 50, 59, 67, 72, 99, 104, 2, 698, 2, 3, 3, 2, 2, 2, 2, 5, 3, 2, 2, 2, 2, 7, 3, 2, 2, 2, 2, 9, 3, 2, 2, 2, 2, 11, 3, 2, 2, 2, 2, 13, 3, 2, 2, 2, 2, 15, 3, 2, 2, 2, 2, 17, 3, 2, 2, 2, 2, 19, 3, 2, 2, 2, 2, 21, 3, 2, 2, 2, 2, 23, 3, 2, 2, 2, 2, 25, 3, 2, 2, 2, 2, 27, 3, 2, 2, 2, 2, 29, 3, 2, 2, 2, 2, 31, 3, 2, 2, 2, 2, 33, 3, 2, 2, 2, 2, 35, 3, 2, 2, 2, 2, 37, 3, 2, 2, 2, 2, 39, 3, 2, 2, 2, 2, 41, 3, 2, 2, 2, 2, 43, 3, 2, 2, 2, 2, 45, 3, 2, 2, 2, 2, 47, 3, 2, 2, 2, 2, 49, 3, 2, 2, 2, 2, 51, 3, 2, 2, 2, 2, 53, 3, 2, 2, 2, 2, 55, 3, 2, 2, 2, 2, 57, 3, 2, 2, 2, 2, 59, 3, 2, 2, 2, 2, 61, 3, 2, 2, 2, 2, 63, 3, 2, 2, 2, 2, 65, 3, 2, 2, 2, 2, 67, 3, 2, 2, 2, 2, 69, 3, 2, 2, 2, 2, 71, 3, 2, 2, 2, 2, 73, 3, 2, 2, 2, 2, 75, 3, 2, 2, 2, 2, 77, 3, 2, 2, 2, 2, 79, 3, 2, 2, 2, 2, 81, 3, 2, 2, 2, 2, 83, 3, 2, 2, 2, 2, 85, 3, 2, 2, 2, 2, 87, 3, 2, 2, 2, 2, 89, 3, 2, 2, 2, 2, 91, 3, 2, 2, 2, 2, 93, 3, 2, 2, 2, 2, 95, 3, 2, 2, 2, 2, 97, 3, 2, 2, 2, 2, 99, 3, 2, 2, 2, 2, 101, 3, 2, 2, 2, 2, 103, 3, 2, 2, 2, 2, 105, 3, 2, 2, 2, 2, 107, 3, 2, 2, 2, 2, 109, 3, 2, 2, 2, 2, 111, 3, 2, 2, 2, 2, 113, 3, 2, 2, 2, 2, 115, 3, 2, 2, 2, 2, 117, 3, 2, 2, 2, 2, 119, 3, 2, 2, 2, 2, 121, 3, 2, 2, 2, 2, 123, 3, 2, 2, 2, 2, 125, 3, 2, 2, 2, 2, 127, 3, 2, 2, 2, 2, 129, 3, 2, 2, 2, 2, 131, 3, 2, 2, 2, 2, 133, 3, 2, 2, 2, 2, 135, 3, 2, 2, 2, 2, 137, 3, 2, 2, 2, 2, 139, 3, 2, 2, 2, 2, 141, 3, 2, 2, 2, 2, 143, 3, 2, 2, 2, 2, 145, 3, 2, 2, 2, 2, 147, 3, 2, 2, 2, 2, 149, 3, 2, 2, 2, 2, 151, 3, 2, 2, 2, 2, 153, 3, 2, 2, 2, 2, 157, 3, 2, 2, 2, 2, 159, 3, 2, 2, 2, 2, 161, 3, 2, 2, 2, 2, 163, 3, 2, 2, 2, 2, 171, 3, 2, 2, 2, 3, 173, 3, 2, 2, 2, 5, 175, 3, 2, 2, 2, 7, 177, 3, 2, 2, 2, 9, 180, 3, 2, 2, 2, 11, 182, 3, 2, 2, 2, 13, 184, 3, 2, 2, 2, 15, 189, 3, 2, 2, 2, 17, 191, 3, 2, 2, 2, 19, 194, 3, 2, 2, 2, 21, 197, 3, 2, 2, 2, 23, 199, 3, 2, 2, 2, 25, 201, 3, 2, 2, 2, 27, 203, 3, 2, 2, 2, 29, 205, 3, 2, 2, 2, 31, 207, 3, 2, 2, 2, 33, 209, 3, 2, 2, 2, 35, 212, 3, 2, 2, 2, 37, 217, 3, 2, 2, 2, 39, 225, 3, 2, 2, 2, 41, 235, 3, 2, 2, 2, 43, 244, 3, 2, 2, 2, 45, 251, 3, 2, 2, 2, 47, 257, 3, 2, 2, 2, 49, 265, 3, 2, 2, 2, 51, 273, 3, 2, 2, 2, 53, 280, 3, 2, 2, 2, 55, 291, 3, 2, 2, 2, 57, 300, 3, 2, 2, 2, 59, 303, 3, 2, 2, 2, 61, 307, 3, 2, 2, 2, 63, 313, 3, 2, 2, 2, 65, 320, 3, 2, 2, 2, 67, 330, 3, 2, 2, 2, 69, 339, 3, 2, 2, 2, 71, 345, 3, 2, 2, 2, 73, 350, 3, 2, 2, 2, 75, 360, 3, 2, 2, 2, 77, 364, 3, 2, 2, 2, 79, 370, 3, 2, 2, 2, 81, 377, 3, 2, 2, 2, 83, 382, 3, 2, 2, 2, 85, 387, 3, 2, 2, 2, 87, 390, 3, 2, 2, 2, 89, 394, 3, 2, 2, 2, 91, 400, 3, 2, 2, 2, 93, 407, 3, 2, 2, 2, 95, 414, 3, 2, 2, 2, 97, 420, 3, 2, 2, 2, 99, 432, 3, 2, 2, 2, 101, 438, 3, 2, 2, 2, 103, 466, 3, 2, 2, 2, 105, 468, 3, 2, 2, 2, 107, 471, 3, 2, 2, 2, 109, 473, 3, 2, 2, 2, 111, 475, 3, 2, 2, 2, 113, 477, 3, 2, 2, 2, 115, 479, 3, 2, 2, 2, 117, 481, 3, 2, 2, 2, 119, 483, 3, 2, 2, 2, 121, 485, 3, 2, 2, 2, 123, 487, 3, 2, 2, 2, 125, 491, 3, 2, 2, 2, 127, 495, 3, 2, 2, 2, 129, 498, 3, 2, 2, 2, 131, 500, 3, 2, 2, 2, 133, 503, 3, 2, 2, 2, 135, 505, 3, 2, 2, 2, 137, 508, 3, 2, 2, 2, 139, 511, 3, 2, 2, 2, 141, 514, 3, 2, 2, 2, 143, 518, 3, 2, 2, 2, 145, 524, 3, 2, 2, 2, 147, 526, 3, 2, 2, 2, 149, 529, 3, 2, 2, 2, 151, 532, 3, 2, 2, 2, 153, 552, 3, 2, 2, 2, 155, 554, 3, 2, 2, 2, 157, 557, 3, 2, 2, 2, 159, 565, 3, 2, 2, 2, 161, 571, 3, 2, 2, 2, 163, 587, 3, 2, 2, 2, 165, 598, 3, 2, 2, 2, 167, 608, 3, 2, 2, 2, 169, 610, 3, 2, 2, 2, 171, 663, 3, 2, 2, 2, 173, 174, 7, 42, 2, 2, 174, 4, 3, 2, 2, 2, 175, 176, 7, 43, 2, 2, 176, 6, 3, 2, 2, 2, 177, 178, 7, 63, 2, 2, 178, 179, 7, 64, 2, 2, 179, 8, 3, 2, 2, 2, 180, 181, 7, 46, 2, 2, 181, 10, 3, 2, 2, 2, 182, 183, 7, 60, 2, 2, 183, 12, 3, 2, 2, 2, 184, 185, 7, 118, 2, 2, 185, 186, 7, 123, 2, 2, 186, 187, 7, 114, 2, 2, 187, 188, 7, 103, 2, 2, 188, 14, 3, 2, 2, 2, 189, 190, 7, 65, 2, 2, 190, 16, 3, 2, 2, 2, 191, 192, 7, 126, 2, 2, 192, 193, 7, 126, 2, 2, 193, 18, 3, 2, 2, 2, 194, 195, 7, 40, 2, 2, 195, 196, 7, 40, 2, 2, 196, 20, 3, 2, 2, 2, 197, 198, 7, 48, 2, 2, 198, 22, 3, 2, 2, 2, 199, 200, 7, 93, 2, 2, 200, 24, 3, 2, 2, 2, 201, 202, 7, 95, 2, 2, 202, 26, 3, 2, 2, 2, 203, 204, 7, 125, 2, 2, 204, 28, 3, 2, 2, 2, 205, 206, 7, 127, 2, 2, 206, 30, 3, 2, 2, 2, 207, 208, 7, 61, 2, 2, 208, 32, 3, 2, 2, 2, 209, 210, 7, 113, 2, 2, 210, 211, 7, 104, 2, 2, 211, 34, 3, 2, 2, 2, 212, 213, 7, 103, 2, 2, 213, 214, 7, 110, 2, 2, 214, 215, 7, 117, 2, 2, 215, 216, 7, 103, 2, 2, 216, 36, 3, 2, 2, 2, 217, 218, 7, 103, 2, 2, 218, 219, 7, 122, 2, 2, 219, 220, 7, 118, 2, 2, 220, 221, 7, 103, 2, 2, 221, 222, 7, 112, 2, 2, 222, 223, 7, 102, 2, 2, 223, 224, 7, 117, 2, 2, 224, 38, 3, 2, 2, 2, 225, 226, 7, 105, 2, 2, 226, 227, 7, 103, 2, 2, 227, 228, 7, 112, 2, 2, 228, 229, 7, 103, 2, 2, 229, 230, 7, 116, 2, 2, 230, 231, 7, 99, 2, 2, 231, 232, 7, 118, 2, 2, 232, 233, 7, 103, 2, 2, 233, 234, 7, 117, 2, 2, 234, 40, 3, 2, 2, 2, 235, 236, 7, 113, 2, 2, 236, 237, 7, 114, 2, 2, 237, 238, 7, 103, 2, 2, 238, 239, 7, 116, 2, 2, 239, 240, 7, 99, 2, 2, 240, 241, 7, 118, 2, 2, 241, 242, 7, 113, 2, 2, 242, 243, 7, 116, 2, 2, 243, 42, 3, 2, 2, 2, 244, 245, 7, 117, 2, 2, 245, 246, 7, 118, 2, 2, 246, 247, 7, 116, 2, 2, 247, 248, 7, 119, 2, 2, 248, 249, 7, 101, 2, 2, 249, 250, 7, 118, 2, 2, 250, 44, 3, 2, 2, 2, 251, 252, 7, 111, 2, 2, 252, 253, 7, 99, 2, 2, 253, 254, 7, 101, 2, 2, 254, 255, 7, 116, 2, 2, 255, 256, 7, 113, 2, 2, 256, 46, 3, 2, 2, 2, 257, 258, 7, 100, 2, 2, 258, 259, 7, 119, 2, 2, 259, 260, 7, 107, 2, 2, 260, 261, 7, 110, 2, 2, 261, 262, 7, 118, 2, 2, 262, 263, 7, 107, 2, 2, 263, 264, 7, 112, 2, 2, 264, 48, 3, 2, 2, 2, 265, 266, 7, 116, 2, 2, 266, 267, 7, 119, 2, 2, 267, 268, 7, 112, 2, 2, 268, 269, 7, 118, 2, 2, 269, 270, 7, 107, 2, 2, 270, 271, 7, 111, 2, 2, 271, 272, 7, 103, 2, 2, 272, 50, 3, 2, 2, 2, 273, 274, 7, 111, 2, 2, 274, 275, 7, 113, 2, 2, 275, 276, 7, 102, 2, 2, 276, 277, 7, 119, 2, 2, 277, 278, 7, 110, 2, 2, 278, 279, 7, 103, 2, 2, 279, 52, 3, 2, 2, 2, 280, 281, 7, 108, 2, 2, 281, 282, 7, 99, 2, 2, 282, 283, 7, 120, 2, 2, 283, 284, 7, 99, 2, 2, 284, 285, 7, 117, 2, 2, 285, 286, 7, 101, 2, 2, 286, 287, 7, 116, 2, 2, 287, 288, 7, 107, 2, 2, 288, 289, 7, 114, 2, 2, 289, 290, 7, 118, 2, 2, 290, 54, 3, 2, 2, 2, 291, 292, 7, 102, 2, 2, 292, 293, 7, 103, 2, 2, 293, 294, 7, 104, 2, 2, 294, 295, 7, 103, 2, 2, 295, 296, 7, 116, 2, 2, 296, 297, 7, 116, 2, 2, 297, 298, 7, 103, 2, 2, 298, 299, 7, 102, 2, 2, 299, 56, 3, 2, 2, 2, 300, 301, 7, 107, 2, 2, 301, 302, 7, 104, 2, 2, 302, 58, 3, 2, 2, 2, 303, 304, 7, 104, 2, 2, 304, 305, 7, 113, 2, 2, 305, 306, 7, 116, 2, 2, 306, 60, 3, 2, 2, 2, 307, 308, 7, 121, 2, 2, 308, 309, 7, 106, 2, 2, 309, 310, 7, 107, 2, 2, 310, 311, 7, 110, 2, 2, 311, 312, 7, 103, 2, 2, 312, 62, 3, 2, 2, 2, 313, 314, 7, 116, 2, 2, 314, 315, 7, 103, 2, 2, 315, 316, 7, 118, 2, 2, 316, 317, 7, 119, 2, 2, 317, 318, 7, 116, 2, 2, 318, 319, 7, 112, 2, 2, 319, 64, 3, 2, 2, 2, 320, 321, 7, 101, 2, 2, 321, 322, 7, 113, 2, 2, 322, 323, 7, 112, 2, 2, 323, 324, 7, 117, 2, 2, 324, 325, 7, 118, 2, 2, 325, 326, 7, 103, 2, 2, 326, 327, 7, 122, 2, 2, 327, 328, 7, 114, 2, 2, 328, 329, 7, 116, 2, 2, 329, 66, 3, 2, 2, 2, 330, 331, 7, 101, 2, 2, 331, 332, 7, 113, 2, 2, 332, 333, 7, 112, 2, 2, 333, 334, 7, 118, 2, 2, 334, 335, 7, 107, 2, 2, 335, 336, 7, 112, 2, 2, 336, 337, 7, 119, 2, 2, 337, 338, 7, 103, 2, 2, 338, 68, 3, 2, 2, 2, 339, 340, 7, 100, 2, 2, 340, 341, 7, 116, 2, 2, 341, 342, 7, 103, 2, 2, 342, 343, 7, 99, 2, 2, 343, 344, 7, 109, 2, 2, 344, 70, 3, 2, 2, 2, 345, 346, 7, 105, 2, 2, 346, 347, 7, 113, 2, 2, 347, 348, 7, 118, 2, 2, 348, 349, 7, 113, 2, 2, 349, 72, 3, 2, 2, 2, 350, 351, 7, 113, 2, 2, 351, 352, 7, 118, 2, 2, 352, 353, 7, 106, 2, 2, 353, 354, 7, 103, 2, 2, 354, 355, 7, 116, 2, 2, 355, 356, 7, 121, 2, 2, 356, 357, 7, 107, 2, 2, 357, 358, 7, 117, 2, 2, 358, 359, 7, 103, 2, 2, 359, 74, 3, 2, 2, 2, 360, 361, 7, 118, 2, 2, 361, 362, 7, 116, 2, 2, 362, 363, 7, 123, 2, 2, 363, 76, 3, 2, 2, 2, 364, 365, 7, 110, 2, 2, 365, 366, 7, 99, 2, 2, 366, 367, 7, 100, 2, 2, 367, 368, 7, 103, 2, 2, 368, 369, 7, 110, 2, 2, 369, 78, 3, 2, 2, 2, 370, 371, 7, 110, 2, 2, 371, 372, 7, 99, 2, 2, 372, 373, 7, 100, 2, 2, 373, 374, 7, 103, 2, 2, 374, 375, 7, 110, 2, 2, 375, 376, 7, 117, 2, 2, 376, 80, 3, 2, 2, 2, 377, 378, 7, 118, 2, 2, 378, 379, 7, 99, 2, 2, 379, 380, 7, 107, 2, 2, 380, 381, 7, 110, 2, 2, 381, 82, 3, 2, 2, 2, 382, 383, 7, 107, 2, 2, 383, 384, 7, 117, 2, 2, 384, 385, 7, 112, 2, 2, 385, 386, 7, 118, 2, 2, 386, 84, 3, 2, 2, 2, 387, 388, 7, 107, 2, 2, 388, 389, 7, 117, 2, 2, 389, 86, 3, 2, 2, 2, 390, 391, 7, 110, 2, 2, 391, 392, 7, 103, 2, 2, 392, 393, 7, 118, 2, 2, 393, 88, 3, 2, 2, 2, 394, 395, 7, 101, 2, 2, 395, 396, 7, 113, 2, 2, 396, 397, 7, 112, 2, 2, 397, 398, 7, 117, 2, 2, 398, 399, 7, 118, 2, 2, 399, 90, 3, 2, 2, 2, 400, 401, 7, 103, 2, 2, 401, 402, 7, 122, 2, 2, 402, 403, 7, 118, 2, 2, 403, 404, 7, 103, 2, 2, 404, 405, 7, 116, 2, 2, 405, 406, 7, 112, 2, 2, 406, 92, 3, 2, 2, 2, 407, 408, 7, 99, 2, 2, 408, 409, 7, 117, 2, 2, 409, 410, 7, 117, 2, 2, 410, 411, 7, 103, 2, 2, 411, 412, 7, 116, 2, 2, 412, 413, 7, 118, 2, 2, 413, 94, 3, 2, 2, 2, 414, 415, 7, 101, 2, 2, 415, 416, 7, 106, 2, 2, 416, 417, 7, 103, 2, 2, 417, 418, 7, 101, 2, 2, 418, 419, 7, 109, 2, 2, 419, 96, 3, 2, 2, 2, 420, 421, 7, 119, 2, 2, 421, 422, 7, 112, 2, 2, 422, 423, 7, 116, 2, 2, 423, 424, 7, 103, 2, 2, 424, 425, 7, 99, 2, 2, 425, 426, 7, 101, 2, 2, 426, 427, 7, 106, 2, 2, 427, 428, 7, 99, 2, 2, 428, 429, 7, 100, 2, 2, 429, 430, 7, 110, 2, 2, 430, 431, 7, 103, 2, 2, 431, 98, 3, 2, 2, 2, 432, 433, 7, 102, 2, 2, 433, 434, 7, 103, 2, 2, 434, 435, 7, 100, 2, 2, 435, 436, 7, 119, 2, 2, 436, 437, 7, 105, 2, 2, 437, 100, 3, 2, 2, 2, 438, 439, 7, 63, 2, 2, 439, 102, 3, 2, 2, 2, 440, 441, 7, 44, 2, 2, 441, 467, 7, 63, 2, 2, 442, 443, 7, 49, 2, 2, 443, 467, 7, 63, 2, 2, 444, 445, 7, 39, 2, 2, 445, 467, 7, 63, 2, 2, 446, 447, 7, 45, 2, 2, 447, 467, 7, 63, 2, 2, 448, 449, 7, 47, 2, 2, 449, 467, 7, 63, 2, 2, 450, 451, 7, 62, 2, 2, 451, 452, 7, 62, 2, 2, 452, 467, 7, 63, 2, 2, 453, 454, 7, 64, 2, 2, 454, 455, 7, 64, 2, 2, 455, 467, 7, 63, 2, 2, 456, 457, 7, 64, 2, 2, 457, 458, 7, 64, 2, 2, 458, 459, 7, 64, 2, 2, 459, 467, 7, 63, 2, 2, 460, 461, 7, 40, 2, 2, 461, 467, 7, 63, 2, 2, 462, 463, 7, 96, 2, 2, 463, 467, 7, 63, 2, 2, 464, 465, 7, 126, 2, 2, 465, 467, 7, 63, 2, 2, 466, 440, 3, 2, 2, 2, 466, 442, 3, 2, 2, 2, 466, 444, 3, 2, 2, 2, 466, 446, 3, 2, 2, 2, 466, 448, 3, 2, 2, 2, 466, 450, 3, 2, 2, 2, 466, 453, 3, 2, 2, 2, 466, 456, 3, 2, 2, 2, 466, 460, 3, 2, 2, 2, 466, 462, 3, 2, 2, 2, 466, 464, 3, 2, 2, 2, 467, 104, 3, 2, 2, 2, 468, 469, 7, 63, 2, 2, 469, 470, 7, 63, 2, 2, 470, 106, 3, 2, 2, 2, 471, 472, 7, 45, 2, 2, 472, 108, 3, 2, 2, 2, 473, 474, 7, 47, 2, 2, 474, 110, 3, 2, 2, 2, 475, 476, 7, 44, 2, 2, 476, 112, 3, 2, 2, 2, 477, 478, 7, 49, 2, 2, 478, 114, 3, 2, 2, 2, 479, 480, 7, 39, 2, 2, 480, 116, 3, 2, 2, 2, 481, 482, 7, 126, 2, 2, 482, 118, 3, 2, 2, 2, 483, 484, 7, 40, 2, 2, 484, 120, 3, 2, 2, 2, 485, 486, 7, 128, 2, 2, 486, 122, 3, 2, 2, 2, 487, 488, 7, 111, 2, 2, 488, 489, 7, 99, 2, 2, 489, 490, 7, 122, 2, 2, 490, 124, 3, 2, 2, 2, 491, 492, 7, 111, 2, 2, 492, 493, 7, 107, 2, 2, 493, 494, 7, 112, 2, 2, 494, 126, 3, 2, 2, 2, 495, 496, 7, 35, 2, 2, 496, 497, 7, 63, 2, 2, 497, 128, 3, 2, 2, 2, 498, 499, 7, 62, 2, 2, 499, 130, 3, 2, 2, 2, 500, 501, 7, 62, 2, 2, 501, 502, 7, 63, 2, 2, 502, 132, 3, 2, 2, 2, 503, 504, 7, 64, 2, 2, 504, 134, 3, 2, 2, 2, 505, 506, 7, 64, 2, 2, 506, 507, 7, 63, 2, 2, 507, 136, 3, 2, 2, 2, 508, 509, 7, 62, 2, 2, 509, 510, 7, 62, 2, 2, 510, 138, 3, 2, 2, 2, 511, 512, 7, 64, 2, 2, 512, 513, 7, 64, 2, 2, 513, 140, 3, 2, 2, 2, 514, 515, 7, 64, 2, 2, 515, 516, 7, 64, 2, 2, 516, 517, 7, 64, 2, 2, 517, 142, 3, 2, 2, 2, 518, 519, 7, 48, 2, 2, 519, 520, 7, 48, 2, 2, 520, 521, 7, 48, 2, 2, 521, 144, 3, 2, 2, 2, 522, 525, 5, 105, 53, 2, 523, 525, 5, 127, 64, 2, 524, 522, 3, 2, 2, 2, 524, 523, 3, 2, 2, 2, 525, 146, 3, 2, 2, 2, 526, 527, 7, 45, 2, 2, 527, 528, 7, 45, 2, 2, 528, 148, 3, 2, 2, 2, 529, 530, 7, 47, 2, 2, 530, 531, 7, 47, 2, 2, 531, 150, 3, 2, 2, 2, 532, 533, 7, 35, 2, 2, 533, 152, 3, 2, 2, 2, 534, 539, 7, 36, 2, 2, 535, 538, 5, 155, 78, 2, 536, 538, 10, 2, 2, 2, 537, 535, 3, 2, 2, 2, 537, 536, 3, 2, 2, 2, 538, 541, 3, 2, 2, 2, 539, 537, 3, 2, 2, 2, 539, 540, 3, 2, 2, 2, 540, 542, 3, 2, 2, 2, 541, 539, 3, 2, 2, 2, 542, 553, 7, 36, 2, 2, 543, 548, 7, 41, 2, 2, 544, 547, 5, 155, 78, 2, 545, 547, 10, 3, 2, 2, 546, 544, 3, 2, 2, 2, 546, 545, 3, 2, 2, 2, 547, 550, 3, 2, 2, 2, 548, 546, 3, 2, 2, 2, 548, 549, 3, 2, 2, 2, 549, 551, 3, 2, 2, 2, 550, 548, 3, 2, 2, 2, 551, 553, 7, 41, 2, 2, 552, 534, 3, 2, 2, 2, 552, 543, 3, 2, 2, 2, 553, 154, 3, 2, 2, 2, 554, 555, 7, 94, 2, 2, 555, 556, 9, 4, 2, 2, 556, 156, 3, 2, 2, 2, 557, 561, 9, 5, 2, 2, 558, 560, 9, 6, 2, 2, 559, 558, 3, 2, 2, 2, 560, 563, 3, 2, 2, 2, 561, 559, 3, 2, 2, 2, 561, 562, 3, 2, 2, 2, 562, 158, 3, 2, 2, 2, 563, 561, 3, 2, 2, 2, 564, 566, 9, 7, 2, 2, 565, 564, 3, 2, 2, 2, 566, 567, 3, 2, 2, 2, 567, 565, 3, 2, 2, 2, 567, 568, 3, 2, 2, 2, 568, 569, 3, 2, 2, 2, 569, 570, 8, 80, 2, 2, 570, 160, 3, 2, 2, 2, 571, 572, 7, 49, 2, 2, 572, 573, 7, 44, 2, 2, 573, 577, 3, 2, 2, 2, 574, 576, 11, 2, 2, 2, 575, 574, 3, 2, 2, 2, 576, 579, 3, 2, 2, 2, 577, 578, 3, 2, 2, 2, 577, 575, 3, 2, 2, 2, 578, 583, 3, 2, 2, 2, 579, 577, 3, 2, 2, 2, 580, 581, 7, 44, 2, 2, 581, 584, 7, 49, 2, 2, 582, 584, 7, 2, 2, 3, 583, 580, 3, 2, 2, 2, 583, 582, 3, 2, 2, 2, 584, 585, 3, 2, 2, 2, 585, 586, 8, 81, 2, 2, 586, 162, 3, 2, 2, 2, 587, 588, 7, 49, 2, 2, 588, 589, 7, 49, 2, 2, 589, 593, 3, 2, 2, 2, 590, 592, 10, 8, 2, 2, 591, 590, 3, 2, 2, 2, 592, 595, 3, 2, 2, 2, 593, 591, 3, 2, 2, 2, 593, 594, 3, 2, 2, 2, 594, 596, 3, 2, 2, 2, 595, 593, 3, 2, 2, 2, 596, 597, 8, 82, 2, 2, 597, 164, 3, 2, 2, 2, 598, 599, 9, 9, 2, 2, 599, 166, 3, 2, 2, 2, 600, 609, 7, 50, 2, 2, 601, 605, 9, 10, 2, 2, 602, 604, 5, 165, 83, 2, 603, 602, 3, 2, 2, 2, 604, 607, 3, 2, 2, 2, 605, 603, 3, 2, 2, 2, 605, 606, 3, 2, 2, 2, 606, 609, 3, 2, 2, 2, 607, 605, 3, 2, 2, 2, 608, 600, 3, 2, 2, 2, 608, 601, 3, 2, 2, 2, 609, 168, 3, 2, 2, 2, 610, 612, 9, 11, 2, 2, 611, 613, 9, 12, 2, 2, 612, 611, 3, 2, 2, 2, 612, 613, 3, 2, 2, 2, 613, 615, 3, 2, 2, 2, 614, 616, 5, 165, 83, 2, 615, 614, 3, 2, 2, 2, 616, 617, 3, 2, 2, 2, 617, 615, 3, 2, 2, 2, 617, 618, 3, 2, 2, 2, 618, 170, 3, 2, 2, 2, 619, 621, 5, 109, 55, 2, 620, 619, 3, 2, 2, 2, 620, 621, 3, 2, 2, 2, 621, 622, 3, 2, 2, 2, 622, 623, 5, 167, 84, 2, 623, 627, 7, 48, 2, 2, 624, 626, 5, 165, 83, 2, 625, 624, 3, 2, 2, 2, 626, 629, 3, 2, 2, 2, 627, 625, 3, 2, 2, 2, 627, 628, 3, 2, 2, 2, 628, 631, 3, 2, 2, 2, 629, 627, 3, 2, 2, 2, 630, 632, 5, 169, 85, 2, 631, 630, 3, 2, 2, 2, 631, 632, 3, 2, 2, 2, 632, 664, 3, 2, 2, 2, 633, 635, 5, 109, 55, 2, 634, 633, 3, 2, 2, 2, 634, 635, 3, 2, 2, 2, 635, 636, 3, 2, 2, 2, 636, 638, 7, 48, 2, 2, 637, 639, 5, 165, 83, 2, 638, 637, 3, 2, 2, 2, 639, 640, 3, 2, 2, 2, 640, 638, 3, 2, 2, 2, 640, 641, 3, 2, 2, 2, 641, 643, 3, 2, 2, 2, 642, 644, 5, 169, 85, 2, 643, 642, 3, 2, 2, 2, 643, 644, 3, 2, 2, 2, 644, 664, 3, 2, 2, 2, 645, 647, 5, 109, 55, 2, 646, 645, 3, 2, 2, 2, 646, 647, 3, 2, 2, 2, 647, 648, 3, 2, 2, 2, 648, 650, 5, 167, 84, 2, 649, 651, 5, 169, 85, 2, 650, 649, 3, 2, 2, 2, 650, 651, 3, 2, 2, 2, 651, 664, 3, 2, 2, 2, 652, 654, 5, 109, 55, 2, 653, 652, 3, 2, 2, 2, 653, 654, 3, 2, 2, 2, 654, 655, 3, 2, 2, 2, 655, 656, 7, 50, 2, 2, 656, 657, 7, 122, 2, 2, 657, 659, 3, 2, 2, 2, 658, 660, 9, 13, 2, 2, 659, 658, 3, 2, 2, 2, 660, 661, 3, 2, 2, 2, 661, 659, 3, 2, 2, 2, 661, 662, 3, 2, 2, 2, 662, 664, 3, 2, 2, 2, 663, 620, 3, 2, 2, 2, 663, 634, 3, 2, 2, 2, 663, 646, 3, 2, 2, 2, 663, 653, 3, 2, 2, 2, 664, 172, 3, 2, 2, 2, 30, 2, 466, 524, 537, 539, 546, 548, 552, 561, 567, 577, 583, 593, 605, 608, 612, 617, 620, 627, 631, 634, 640, 643, 646, 650, 653, 661, 663, 3, 2, 3, 2]
\ No newline at end of file
diff --git a/deps/v8/src/torque/TorqueLexer.tokens b/deps/v8/src/torque/TorqueLexer.tokens
new file mode 100644
index 00000000000000..63589b27b74ef9
--- /dev/null
+++ b/deps/v8/src/torque/TorqueLexer.tokens
@@ -0,0 +1,154 @@
+T__0=1
+T__1=2
+T__2=3
+T__3=4
+T__4=5
+T__5=6
+T__6=7
+T__7=8
+T__8=9
+T__9=10
+T__10=11
+T__11=12
+T__12=13
+T__13=14
+T__14=15
+T__15=16
+T__16=17
+T__17=18
+T__18=19
+T__19=20
+T__20=21
+MACRO=22
+BUILTIN=23
+RUNTIME=24
+MODULE=25
+JAVASCRIPT=26
+DEFERRED=27
+IF=28
+FOR=29
+WHILE=30
+RETURN=31
+CONSTEXPR=32
+CONTINUE=33
+BREAK=34
+GOTO=35
+OTHERWISE=36
+TRY=37
+LABEL=38
+LABELS=39
+TAIL=40
+ISNT=41
+IS=42
+LET=43
+CONST=44
+EXTERN=45
+ASSERT_TOKEN=46
+CHECK_TOKEN=47
+UNREACHABLE_TOKEN=48
+DEBUG_TOKEN=49
+ASSIGNMENT=50
+ASSIGNMENT_OPERATOR=51
+EQUAL=52
+PLUS=53
+MINUS=54
+MULTIPLY=55
+DIVIDE=56
+MODULO=57
+BIT_OR=58
+BIT_AND=59
+BIT_NOT=60
+MAX=61
+MIN=62
+NOT_EQUAL=63
+LESS_THAN=64
+LESS_THAN_EQUAL=65
+GREATER_THAN=66
+GREATER_THAN_EQUAL=67
+SHIFT_LEFT=68
+SHIFT_RIGHT=69
+SHIFT_RIGHT_ARITHMETIC=70
+VARARGS=71
+EQUALITY_OPERATOR=72
+INCREMENT=73
+DECREMENT=74
+NOT=75
+STRING_LITERAL=76
+IDENTIFIER=77
+WS=78
+BLOCK_COMMENT=79
+LINE_COMMENT=80
+DECIMAL_LITERAL=81
+'('=1
+')'=2
+'=>'=3
+','=4
+':'=5
+'type'=6
+'?'=7
+'||'=8
+'&&'=9
+'.'=10
+'['=11
+']'=12
+'{'=13
+'}'=14
+';'=15
+'of'=16
+'else'=17
+'extends'=18
+'generates'=19
+'operator'=20
+'struct'=21
+'macro'=22
+'builtin'=23
+'runtime'=24
+'module'=25
+'javascript'=26
+'deferred'=27
+'if'=28
+'for'=29
+'while'=30
+'return'=31
+'constexpr'=32
+'continue'=33
+'break'=34
+'goto'=35
+'otherwise'=36
+'try'=37
+'label'=38
+'labels'=39
+'tail'=40
+'isnt'=41
+'is'=42
+'let'=43
+'const'=44
+'extern'=45
+'assert'=46
+'check'=47
+'unreachable'=48
+'debug'=49
+'='=50
+'=='=52
+'+'=53
+'-'=54
+'*'=55
+'/'=56
+'%'=57
+'|'=58
+'&'=59
+'~'=60
+'max'=61
+'min'=62
+'!='=63
+'<'=64
+'<='=65
+'>'=66
+'>='=67
+'<<'=68
+'>>'=69
+'>>>'=70
+'...'=71
+'++'=73
+'--'=74
+'!'=75
diff --git a/deps/v8/src/torque/TorqueListener.h b/deps/v8/src/torque/TorqueListener.h
index eb8d7de85b6753..937ed606baf55c 100644
--- a/deps/v8/src/torque/TorqueListener.h
+++ b/deps/v8/src/torque/TorqueListener.h
@@ -137,6 +137,16 @@ class TorqueListener : public antlr4::tree::ParseTreeListener {
   virtual void exitAssignmentExpression(
       TorqueParser::AssignmentExpressionContext* ctx) = 0;
 
+  virtual void enterStructExpression(
+      TorqueParser::StructExpressionContext* ctx) = 0;
+  virtual void exitStructExpression(
+      TorqueParser::StructExpressionContext* ctx) = 0;
+
+  virtual void enterFunctionPointerExpression(
+      TorqueParser::FunctionPointerExpressionContext* ctx) = 0;
+  virtual void exitFunctionPointerExpression(
+      TorqueParser::FunctionPointerExpressionContext* ctx) = 0;
+
   virtual void enterPrimaryExpression(
       TorqueParser::PrimaryExpressionContext* ctx) = 0;
   virtual void exitPrimaryExpression(
@@ -248,6 +258,16 @@ class TorqueListener : public antlr4::tree::ParseTreeListener {
   virtual void enterHelperBody(TorqueParser::HelperBodyContext* ctx) = 0;
   virtual void exitHelperBody(TorqueParser::HelperBodyContext* ctx) = 0;
 
+  virtual void enterFieldDeclaration(
+      TorqueParser::FieldDeclarationContext* ctx) = 0;
+  virtual void exitFieldDeclaration(
+      TorqueParser::FieldDeclarationContext* ctx) = 0;
+
+  virtual void enterFieldListDeclaration(
+      TorqueParser::FieldListDeclarationContext* ctx) = 0;
+  virtual void exitFieldListDeclaration(
+      TorqueParser::FieldListDeclarationContext* ctx) = 0;
+
   virtual void enterExtendsDeclaration(
       TorqueParser::ExtendsDeclarationContext* ctx) = 0;
   virtual void exitExtendsDeclaration(
@@ -306,6 +326,16 @@ class TorqueListener : public antlr4::tree::ParseTreeListener {
   virtual void exitExternConstDeclaration(
       TorqueParser::ExternConstDeclarationContext* ctx) = 0;
 
+  virtual void enterConstDeclaration(
+      TorqueParser::ConstDeclarationContext* ctx) = 0;
+  virtual void exitConstDeclaration(
+      TorqueParser::ConstDeclarationContext* ctx) = 0;
+
+  virtual void enterStructDeclaration(
+      TorqueParser::StructDeclarationContext* ctx) = 0;
+  virtual void exitStructDeclaration(
+      TorqueParser::StructDeclarationContext* ctx) = 0;
+
   virtual void enterDeclaration(TorqueParser::DeclarationContext* ctx) = 0;
   virtual void exitDeclaration(TorqueParser::DeclarationContext* ctx) = 0;
 
diff --git a/deps/v8/src/torque/TorqueParser.cpp b/deps/v8/src/torque/TorqueParser.cpp
index 91c80af77fff5c..24548073a156ee 100644
--- a/deps/v8/src/torque/TorqueParser.cpp
+++ b/deps/v8/src/torque/TorqueParser.cpp
@@ -101,46 +101,46 @@ TorqueParser::TypeContext* TorqueParser::type(int precedence) {
   try {
     size_t alt;
     enterOuterAlt(_localctx, 1);
-    setState(156);
+    setState(168);
     _errHandler->sync(this);
     switch (_input->LA(1)) {
       case TorqueParser::CONSTEXPR:
       case TorqueParser::IDENTIFIER: {
-        setState(142);
+        setState(154);
         _errHandler->sync(this);
 
         _la = _input->LA(1);
         if (_la == TorqueParser::CONSTEXPR) {
-          setState(141);
+          setState(153);
           match(TorqueParser::CONSTEXPR);
         }
-        setState(144);
+        setState(156);
         match(TorqueParser::IDENTIFIER);
         break;
       }
 
       case TorqueParser::BUILTIN: {
-        setState(145);
+        setState(157);
         match(TorqueParser::BUILTIN);
-        setState(146);
+        setState(158);
         match(TorqueParser::T__0);
-        setState(147);
+        setState(159);
         typeList();
-        setState(148);
+        setState(160);
         match(TorqueParser::T__1);
-        setState(149);
+        setState(161);
         match(TorqueParser::T__2);
-        setState(150);
+        setState(162);
         type(3);
         break;
       }
 
       case TorqueParser::T__0: {
-        setState(152);
+        setState(164);
         match(TorqueParser::T__0);
-        setState(153);
+        setState(165);
         type(0);
-        setState(154);
+        setState(166);
         match(TorqueParser::T__1);
         break;
       }
@@ -149,7 +149,7 @@ TorqueParser::TypeContext* TorqueParser::type(int precedence) {
         throw NoViableAltException(this);
     }
     _ctx->stop = _input->LT(-1);
-    setState(163);
+    setState(175);
     _errHandler->sync(this);
     alt = getInterpreter<atn::ParserATNSimulator>()->adaptivePredict(_input, 2,
                                                                      _ctx);
@@ -160,16 +160,16 @@ TorqueParser::TypeContext* TorqueParser::type(int precedence) {
         _localctx =
             _tracker.createInstance<TypeContext>(parentContext, parentState);
         pushNewRecursionContext(_localctx, startState, RuleType);
-        setState(158);
+        setState(170);
 
         if (!(precpred(_ctx, 2)))
           throw FailedPredicateException(this, "precpred(_ctx, 2)");
-        setState(159);
+        setState(171);
         match(TorqueParser::BIT_OR);
-        setState(160);
+        setState(172);
         type(3);
       }
-      setState(165);
+      setState(177);
       _errHandler->sync(this);
       alt = getInterpreter<atn::ParserATNSimulator>()->adaptivePredict(_input,
                                                                        2, _ctx);
@@ -230,7 +230,7 @@ TorqueParser::TypeListContext* TorqueParser::typeList() {
   auto onExit = finally([=] { exitRule(); });
   try {
     enterOuterAlt(_localctx, 1);
-    setState(174);
+    setState(186);
     _errHandler->sync(this);
 
     _la = _input->LA(1);
@@ -239,17 +239,17 @@ TorqueParser::TypeListContext* TorqueParser::typeList() {
           ((1ULL << TorqueParser::T__0) | (1ULL << TorqueParser::BUILTIN) |
            (1ULL << TorqueParser::CONSTEXPR))) != 0) ||
         _la == TorqueParser::IDENTIFIER) {
-      setState(166);
+      setState(178);
       type(0);
-      setState(171);
+      setState(183);
       _errHandler->sync(this);
       _la = _input->LA(1);
       while (_la == TorqueParser::T__3) {
-        setState(167);
+        setState(179);
         match(TorqueParser::T__3);
-        setState(168);
+        setState(180);
         type(0);
-        setState(173);
+        setState(185);
         _errHandler->sync(this);
         _la = _input->LA(1);
       }
@@ -314,11 +314,11 @@ TorqueParser::genericSpecializationTypeList() {
   auto onExit = finally([=] { exitRule(); });
   try {
     enterOuterAlt(_localctx, 1);
-    setState(176);
+    setState(188);
     match(TorqueParser::LESS_THAN);
-    setState(177);
+    setState(189);
     typeList();
-    setState(178);
+    setState(190);
     match(TorqueParser::GREATER_THAN);
 
   } catch (RecognitionException& e) {
@@ -383,36 +383,36 @@ TorqueParser::optionalGenericTypeList() {
   auto onExit = finally([=] { exitRule(); });
   try {
     enterOuterAlt(_localctx, 1);
-    setState(194);
+    setState(206);
     _errHandler->sync(this);
 
     _la = _input->LA(1);
     if (_la == TorqueParser::LESS_THAN) {
-      setState(180);
+      setState(192);
       match(TorqueParser::LESS_THAN);
-      setState(181);
+      setState(193);
       match(TorqueParser::IDENTIFIER);
-      setState(182);
+      setState(194);
       match(TorqueParser::T__4);
-      setState(183);
+      setState(195);
       match(TorqueParser::T__5);
-      setState(190);
+      setState(202);
       _errHandler->sync(this);
       _la = _input->LA(1);
       while (_la == TorqueParser::T__3) {
-        setState(184);
+        setState(196);
         match(TorqueParser::T__3);
-        setState(185);
+        setState(197);
         match(TorqueParser::IDENTIFIER);
-        setState(186);
+        setState(198);
         match(TorqueParser::T__4);
-        setState(187);
+        setState(199);
         match(TorqueParser::T__5);
-        setState(192);
+        setState(204);
         _errHandler->sync(this);
         _la = _input->LA(1);
       }
-      setState(193);
+      setState(205);
       match(TorqueParser::GREATER_THAN);
     }
 
@@ -481,15 +481,15 @@ TorqueParser::typeListMaybeVarArgs() {
   auto onExit = finally([=] { exitRule(); });
   try {
     size_t alt;
-    setState(215);
+    setState(227);
     _errHandler->sync(this);
     switch (getInterpreter<atn::ParserATNSimulator>()->adaptivePredict(
         _input, 10, _ctx)) {
       case 1: {
         enterOuterAlt(_localctx, 1);
-        setState(196);
+        setState(208);
         match(TorqueParser::T__0);
-        setState(198);
+        setState(210);
         _errHandler->sync(this);
 
         _la = _input->LA(1);
@@ -498,47 +498,47 @@ TorqueParser::typeListMaybeVarArgs() {
               ((1ULL << TorqueParser::T__0) | (1ULL << TorqueParser::BUILTIN) |
                (1ULL << TorqueParser::CONSTEXPR))) != 0) ||
             _la == TorqueParser::IDENTIFIER) {
-          setState(197);
+          setState(209);
           type(0);
         }
-        setState(204);
+        setState(216);
         _errHandler->sync(this);
         alt = getInterpreter<atn::ParserATNSimulator>()->adaptivePredict(
             _input, 8, _ctx);
         while (alt != 2 && alt != atn::ATN::INVALID_ALT_NUMBER) {
           if (alt == 1) {
-            setState(200);
+            setState(212);
             match(TorqueParser::T__3);
-            setState(201);
+            setState(213);
             type(0);
           }
-          setState(206);
+          setState(218);
           _errHandler->sync(this);
           alt = getInterpreter<atn::ParserATNSimulator>()->adaptivePredict(
               _input, 8, _ctx);
         }
-        setState(209);
+        setState(221);
         _errHandler->sync(this);
 
         _la = _input->LA(1);
         if (_la == TorqueParser::T__3) {
-          setState(207);
+          setState(219);
           match(TorqueParser::T__3);
-          setState(208);
+          setState(220);
           match(TorqueParser::VARARGS);
         }
-        setState(211);
+        setState(223);
         match(TorqueParser::T__1);
         break;
       }
 
       case 2: {
         enterOuterAlt(_localctx, 2);
-        setState(212);
+        setState(224);
         match(TorqueParser::T__0);
-        setState(213);
+        setState(225);
         match(TorqueParser::VARARGS);
-        setState(214);
+        setState(226);
         match(TorqueParser::T__1);
         break;
       }
@@ -601,18 +601,18 @@ TorqueParser::LabelParameterContext* TorqueParser::labelParameter() {
   auto onExit = finally([=] { exitRule(); });
   try {
     enterOuterAlt(_localctx, 1);
-    setState(217);
+    setState(229);
     match(TorqueParser::IDENTIFIER);
-    setState(222);
+    setState(234);
     _errHandler->sync(this);
 
     _la = _input->LA(1);
     if (_la == TorqueParser::T__0) {
-      setState(218);
+      setState(230);
       match(TorqueParser::T__0);
-      setState(219);
+      setState(231);
       typeList();
-      setState(220);
+      setState(232);
       match(TorqueParser::T__1);
     }
 
@@ -669,14 +669,14 @@ TorqueParser::OptionalTypeContext* TorqueParser::optionalType() {
   auto onExit = finally([=] { exitRule(); });
   try {
     enterOuterAlt(_localctx, 1);
-    setState(226);
+    setState(238);
     _errHandler->sync(this);
 
     _la = _input->LA(1);
     if (_la == TorqueParser::T__4) {
-      setState(224);
+      setState(236);
       match(TorqueParser::T__4);
-      setState(225);
+      setState(237);
       type(0);
     }
 
@@ -743,24 +743,24 @@ TorqueParser::OptionalLabelListContext* TorqueParser::optionalLabelList() {
   auto onExit = finally([=] { exitRule(); });
   try {
     enterOuterAlt(_localctx, 1);
-    setState(237);
+    setState(249);
     _errHandler->sync(this);
 
     _la = _input->LA(1);
     if (_la == TorqueParser::LABELS) {
-      setState(228);
+      setState(240);
       match(TorqueParser::LABELS);
-      setState(229);
+      setState(241);
       labelParameter();
-      setState(234);
+      setState(246);
       _errHandler->sync(this);
       _la = _input->LA(1);
       while (_la == TorqueParser::T__3) {
-        setState(230);
+        setState(242);
         match(TorqueParser::T__3);
-        setState(231);
+        setState(243);
         labelParameter();
-        setState(236);
+        setState(248);
         _errHandler->sync(this);
         _la = _input->LA(1);
       }
@@ -829,28 +829,28 @@ TorqueParser::OptionalOtherwiseContext* TorqueParser::optionalOtherwise() {
   try {
     size_t alt;
     enterOuterAlt(_localctx, 1);
-    setState(248);
+    setState(260);
     _errHandler->sync(this);
 
     switch (getInterpreter<atn::ParserATNSimulator>()->adaptivePredict(
         _input, 16, _ctx)) {
       case 1: {
-        setState(239);
+        setState(251);
         match(TorqueParser::OTHERWISE);
-        setState(240);
+        setState(252);
         match(TorqueParser::IDENTIFIER);
-        setState(245);
+        setState(257);
         _errHandler->sync(this);
         alt = getInterpreter<atn::ParserATNSimulator>()->adaptivePredict(
             _input, 15, _ctx);
         while (alt != 2 && alt != atn::ATN::INVALID_ALT_NUMBER) {
           if (alt == 1) {
-            setState(241);
+            setState(253);
             match(TorqueParser::T__3);
-            setState(242);
+            setState(254);
             match(TorqueParser::IDENTIFIER);
           }
-          setState(247);
+          setState(259);
           _errHandler->sync(this);
           alt = getInterpreter<atn::ParserATNSimulator>()->adaptivePredict(
               _input, 15, _ctx);
@@ -916,11 +916,11 @@ TorqueParser::ParameterContext* TorqueParser::parameter() {
   auto onExit = finally([=] { exitRule(); });
   try {
     enterOuterAlt(_localctx, 1);
-    setState(250);
+    setState(262);
     match(TorqueParser::IDENTIFIER);
-    setState(251);
+    setState(263);
     match(TorqueParser::T__4);
-    setState(253);
+    setState(265);
     _errHandler->sync(this);
 
     _la = _input->LA(1);
@@ -929,7 +929,7 @@ TorqueParser::ParameterContext* TorqueParser::parameter() {
           ((1ULL << TorqueParser::T__0) | (1ULL << TorqueParser::BUILTIN) |
            (1ULL << TorqueParser::CONSTEXPR))) != 0) ||
         _la == TorqueParser::IDENTIFIER) {
-      setState(252);
+      setState(264);
       type(0);
     }
 
@@ -999,56 +999,56 @@ TorqueParser::ParameterListContext* TorqueParser::parameterList() {
 
   auto onExit = finally([=] { exitRule(); });
   try {
-    setState(276);
+    setState(288);
     _errHandler->sync(this);
     switch (getInterpreter<atn::ParserATNSimulator>()->adaptivePredict(
         _input, 20, _ctx)) {
       case 1: {
         enterOuterAlt(_localctx, 1);
-        setState(255);
+        setState(267);
         match(TorqueParser::T__0);
-        setState(257);
+        setState(269);
         _errHandler->sync(this);
 
         _la = _input->LA(1);
         if (_la == TorqueParser::IDENTIFIER) {
-          setState(256);
+          setState(268);
           parameter();
         }
-        setState(263);
+        setState(275);
         _errHandler->sync(this);
         _la = _input->LA(1);
         while (_la == TorqueParser::T__3) {
-          setState(259);
+          setState(271);
           match(TorqueParser::T__3);
-          setState(260);
+          setState(272);
           parameter();
-          setState(265);
+          setState(277);
           _errHandler->sync(this);
           _la = _input->LA(1);
         }
-        setState(266);
+        setState(278);
         match(TorqueParser::T__1);
         break;
       }
 
       case 2: {
         enterOuterAlt(_localctx, 2);
-        setState(267);
+        setState(279);
         match(TorqueParser::T__0);
-        setState(268);
+        setState(280);
         parameter();
-        setState(269);
+        setState(281);
         match(TorqueParser::T__3);
-        setState(270);
+        setState(282);
         parameter();
-        setState(271);
+        setState(283);
         match(TorqueParser::T__3);
-        setState(272);
+        setState(284);
         match(TorqueParser::VARARGS);
-        setState(273);
+        setState(285);
         match(TorqueParser::IDENTIFIER);
-        setState(274);
+        setState(286);
         match(TorqueParser::T__1);
         break;
       }
@@ -1107,20 +1107,22 @@ TorqueParser::LabelDeclarationContext* TorqueParser::labelDeclaration() {
   LabelDeclarationContext* _localctx =
       _tracker.createInstance<LabelDeclarationContext>(_ctx, getState());
   enterRule(_localctx, 22, TorqueParser::RuleLabelDeclaration);
-  size_t _la = 0;
 
   auto onExit = finally([=] { exitRule(); });
   try {
     enterOuterAlt(_localctx, 1);
-    setState(278);
+    setState(290);
     match(TorqueParser::IDENTIFIER);
-    setState(280);
+    setState(292);
     _errHandler->sync(this);
 
-    _la = _input->LA(1);
-    if (_la == TorqueParser::T__0) {
-      setState(279);
-      parameterList();
+    switch (getInterpreter<atn::ParserATNSimulator>()->adaptivePredict(
+        _input, 21, _ctx)) {
+      case 1: {
+        setState(291);
+        parameterList();
+        break;
+      }
     }
 
   } catch (RecognitionException& e) {
@@ -1176,7 +1178,7 @@ TorqueParser::ExpressionContext* TorqueParser::expression() {
   auto onExit = finally([=] { exitRule(); });
   try {
     enterOuterAlt(_localctx, 1);
-    setState(282);
+    setState(294);
     conditionalExpression(0);
 
   } catch (RecognitionException& e) {
@@ -1256,10 +1258,10 @@ TorqueParser::ConditionalExpressionContext* TorqueParser::conditionalExpression(
   try {
     size_t alt;
     enterOuterAlt(_localctx, 1);
-    setState(285);
+    setState(297);
     logicalORExpression(0);
     _ctx->stop = _input->LT(-1);
-    setState(295);
+    setState(307);
     _errHandler->sync(this);
     alt = getInterpreter<atn::ParserATNSimulator>()->adaptivePredict(_input, 22,
                                                                      _ctx);
@@ -1271,20 +1273,20 @@ TorqueParser::ConditionalExpressionContext* TorqueParser::conditionalExpression(
             parentContext, parentState);
         pushNewRecursionContext(_localctx, startState,
                                 RuleConditionalExpression);
-        setState(287);
+        setState(299);
 
         if (!(precpred(_ctx, 1)))
           throw FailedPredicateException(this, "precpred(_ctx, 1)");
-        setState(288);
+        setState(300);
         match(TorqueParser::T__6);
-        setState(289);
+        setState(301);
         logicalORExpression(0);
-        setState(290);
+        setState(302);
         match(TorqueParser::T__4);
-        setState(291);
+        setState(303);
         logicalORExpression(0);
       }
-      setState(297);
+      setState(309);
       _errHandler->sync(this);
       alt = getInterpreter<atn::ParserATNSimulator>()->adaptivePredict(
           _input, 22, _ctx);
@@ -1357,10 +1359,10 @@ TorqueParser::LogicalORExpressionContext* TorqueParser::logicalORExpression(
   try {
     size_t alt;
     enterOuterAlt(_localctx, 1);
-    setState(299);
+    setState(311);
     logicalANDExpression(0);
     _ctx->stop = _input->LT(-1);
-    setState(306);
+    setState(318);
     _errHandler->sync(this);
     alt = getInterpreter<atn::ParserATNSimulator>()->adaptivePredict(_input, 23,
                                                                      _ctx);
@@ -1371,16 +1373,16 @@ TorqueParser::LogicalORExpressionContext* TorqueParser::logicalORExpression(
         _localctx = _tracker.createInstance<LogicalORExpressionContext>(
             parentContext, parentState);
         pushNewRecursionContext(_localctx, startState, RuleLogicalORExpression);
-        setState(301);
+        setState(313);
 
         if (!(precpred(_ctx, 1)))
           throw FailedPredicateException(this, "precpred(_ctx, 1)");
-        setState(302);
+        setState(314);
         match(TorqueParser::T__7);
-        setState(303);
+        setState(315);
         logicalANDExpression(0);
       }
-      setState(308);
+      setState(320);
       _errHandler->sync(this);
       alt = getInterpreter<atn::ParserATNSimulator>()->adaptivePredict(
           _input, 23, _ctx);
@@ -1455,10 +1457,10 @@ TorqueParser::LogicalANDExpressionContext* TorqueParser::logicalANDExpression(
   try {
     size_t alt;
     enterOuterAlt(_localctx, 1);
-    setState(310);
+    setState(322);
     bitwiseExpression(0);
     _ctx->stop = _input->LT(-1);
-    setState(317);
+    setState(329);
     _errHandler->sync(this);
     alt = getInterpreter<atn::ParserATNSimulator>()->adaptivePredict(_input, 24,
                                                                      _ctx);
@@ -1470,16 +1472,16 @@ TorqueParser::LogicalANDExpressionContext* TorqueParser::logicalANDExpression(
             parentContext, parentState);
         pushNewRecursionContext(_localctx, startState,
                                 RuleLogicalANDExpression);
-        setState(312);
+        setState(324);
 
         if (!(precpred(_ctx, 1)))
           throw FailedPredicateException(this, "precpred(_ctx, 1)");
-        setState(313);
+        setState(325);
         match(TorqueParser::T__8);
-        setState(314);
+        setState(326);
         bitwiseExpression(0);
       }
-      setState(319);
+      setState(331);
       _errHandler->sync(this);
       alt = getInterpreter<atn::ParserATNSimulator>()->adaptivePredict(
           _input, 24, _ctx);
@@ -1562,10 +1564,10 @@ TorqueParser::BitwiseExpressionContext* TorqueParser::bitwiseExpression(
   try {
     size_t alt;
     enterOuterAlt(_localctx, 1);
-    setState(321);
+    setState(333);
     equalityExpression(0);
     _ctx->stop = _input->LT(-1);
-    setState(328);
+    setState(340);
     _errHandler->sync(this);
     alt = getInterpreter<atn::ParserATNSimulator>()->adaptivePredict(_input, 25,
                                                                      _ctx);
@@ -1576,11 +1578,11 @@ TorqueParser::BitwiseExpressionContext* TorqueParser::bitwiseExpression(
         _localctx = _tracker.createInstance<BitwiseExpressionContext>(
             parentContext, parentState);
         pushNewRecursionContext(_localctx, startState, RuleBitwiseExpression);
-        setState(323);
+        setState(335);
 
         if (!(precpred(_ctx, 1)))
           throw FailedPredicateException(this, "precpred(_ctx, 1)");
-        setState(324);
+        setState(336);
         dynamic_cast<BitwiseExpressionContext*>(_localctx)->op = _input->LT(1);
         _la = _input->LA(1);
         if (!(_la == TorqueParser::BIT_OR
@@ -1592,10 +1594,10 @@ TorqueParser::BitwiseExpressionContext* TorqueParser::bitwiseExpression(
           _errHandler->reportMatch(this);
           consume();
         }
-        setState(325);
+        setState(337);
         equalityExpression(0);
       }
-      setState(330);
+      setState(342);
       _errHandler->sync(this);
       alt = getInterpreter<atn::ParserATNSimulator>()->adaptivePredict(
           _input, 25, _ctx);
@@ -1678,10 +1680,10 @@ TorqueParser::EqualityExpressionContext* TorqueParser::equalityExpression(
   try {
     size_t alt;
     enterOuterAlt(_localctx, 1);
-    setState(332);
+    setState(344);
     relationalExpression(0);
     _ctx->stop = _input->LT(-1);
-    setState(339);
+    setState(351);
     _errHandler->sync(this);
     alt = getInterpreter<atn::ParserATNSimulator>()->adaptivePredict(_input, 26,
                                                                      _ctx);
@@ -1692,11 +1694,11 @@ TorqueParser::EqualityExpressionContext* TorqueParser::equalityExpression(
         _localctx = _tracker.createInstance<EqualityExpressionContext>(
             parentContext, parentState);
         pushNewRecursionContext(_localctx, startState, RuleEqualityExpression);
-        setState(334);
+        setState(346);
 
         if (!(precpred(_ctx, 1)))
           throw FailedPredicateException(this, "precpred(_ctx, 1)");
-        setState(335);
+        setState(347);
         dynamic_cast<EqualityExpressionContext*>(_localctx)->op = _input->LT(1);
         _la = _input->LA(1);
         if (!(_la == TorqueParser::EQUAL
@@ -1708,10 +1710,10 @@ TorqueParser::EqualityExpressionContext* TorqueParser::equalityExpression(
           _errHandler->reportMatch(this);
           consume();
         }
-        setState(336);
+        setState(348);
         relationalExpression(0);
       }
-      setState(341);
+      setState(353);
       _errHandler->sync(this);
       alt = getInterpreter<atn::ParserATNSimulator>()->adaptivePredict(
           _input, 26, _ctx);
@@ -1806,10 +1808,10 @@ TorqueParser::RelationalExpressionContext* TorqueParser::relationalExpression(
   try {
     size_t alt;
     enterOuterAlt(_localctx, 1);
-    setState(343);
+    setState(355);
     shiftExpression(0);
     _ctx->stop = _input->LT(-1);
-    setState(350);
+    setState(362);
     _errHandler->sync(this);
     alt = getInterpreter<atn::ParserATNSimulator>()->adaptivePredict(_input, 27,
                                                                      _ctx);
@@ -1821,30 +1823,30 @@ TorqueParser::RelationalExpressionContext* TorqueParser::relationalExpression(
             parentContext, parentState);
         pushNewRecursionContext(_localctx, startState,
                                 RuleRelationalExpression);
-        setState(345);
+        setState(357);
 
         if (!(precpred(_ctx, 1)))
           throw FailedPredicateException(this, "precpred(_ctx, 1)");
-        setState(346);
+        setState(358);
         dynamic_cast<RelationalExpressionContext*>(_localctx)->op =
             _input->LT(1);
         _la = _input->LA(1);
-        if (!(((((_la - 63) & ~0x3fULL) == 0) &&
-               ((1ULL << (_la - 63)) &
-                ((1ULL << (TorqueParser::LESS_THAN - 63)) |
-                 (1ULL << (TorqueParser::LESS_THAN_EQUAL - 63)) |
-                 (1ULL << (TorqueParser::GREATER_THAN - 63)) |
-                 (1ULL << (TorqueParser::GREATER_THAN_EQUAL - 63)))) != 0))) {
+        if (!(((((_la - 64) & ~0x3fULL) == 0) &&
+               ((1ULL << (_la - 64)) &
+                ((1ULL << (TorqueParser::LESS_THAN - 64)) |
+                 (1ULL << (TorqueParser::LESS_THAN_EQUAL - 64)) |
+                 (1ULL << (TorqueParser::GREATER_THAN - 64)) |
+                 (1ULL << (TorqueParser::GREATER_THAN_EQUAL - 64)))) != 0))) {
           dynamic_cast<RelationalExpressionContext*>(_localctx)->op =
               _errHandler->recoverInline(this);
         } else {
           _errHandler->reportMatch(this);
           consume();
         }
-        setState(347);
+        setState(359);
         shiftExpression(0);
       }
-      setState(352);
+      setState(364);
       _errHandler->sync(this);
       alt = getInterpreter<atn::ParserATNSimulator>()->adaptivePredict(
           _input, 27, _ctx);
@@ -1932,10 +1934,10 @@ TorqueParser::ShiftExpressionContext* TorqueParser::shiftExpression(
   try {
     size_t alt;
     enterOuterAlt(_localctx, 1);
-    setState(354);
+    setState(366);
     additiveExpression(0);
     _ctx->stop = _input->LT(-1);
-    setState(361);
+    setState(373);
     _errHandler->sync(this);
     alt = getInterpreter<atn::ParserATNSimulator>()->adaptivePredict(_input, 28,
                                                                      _ctx);
@@ -1946,18 +1948,18 @@ TorqueParser::ShiftExpressionContext* TorqueParser::shiftExpression(
         _localctx = _tracker.createInstance<ShiftExpressionContext>(
             parentContext, parentState);
         pushNewRecursionContext(_localctx, startState, RuleShiftExpression);
-        setState(356);
+        setState(368);
 
         if (!(precpred(_ctx, 1)))
           throw FailedPredicateException(this, "precpred(_ctx, 1)");
-        setState(357);
+        setState(369);
         dynamic_cast<ShiftExpressionContext*>(_localctx)->op = _input->LT(1);
         _la = _input->LA(1);
-        if (!(((((_la - 67) & ~0x3fULL) == 0) &&
-               ((1ULL << (_la - 67)) &
-                ((1ULL << (TorqueParser::SHIFT_LEFT - 67)) |
-                 (1ULL << (TorqueParser::SHIFT_RIGHT - 67)) |
-                 (1ULL << (TorqueParser::SHIFT_RIGHT_ARITHMETIC - 67)))) !=
+        if (!(((((_la - 68) & ~0x3fULL) == 0) &&
+               ((1ULL << (_la - 68)) &
+                ((1ULL << (TorqueParser::SHIFT_LEFT - 68)) |
+                 (1ULL << (TorqueParser::SHIFT_RIGHT - 68)) |
+                 (1ULL << (TorqueParser::SHIFT_RIGHT_ARITHMETIC - 68)))) !=
                    0))) {
           dynamic_cast<ShiftExpressionContext*>(_localctx)->op =
               _errHandler->recoverInline(this);
@@ -1965,10 +1967,10 @@ TorqueParser::ShiftExpressionContext* TorqueParser::shiftExpression(
           _errHandler->reportMatch(this);
           consume();
         }
-        setState(358);
+        setState(370);
         additiveExpression(0);
       }
-      setState(363);
+      setState(375);
       _errHandler->sync(this);
       alt = getInterpreter<atn::ParserATNSimulator>()->adaptivePredict(
           _input, 28, _ctx);
@@ -2051,10 +2053,10 @@ TorqueParser::AdditiveExpressionContext* TorqueParser::additiveExpression(
   try {
     size_t alt;
     enterOuterAlt(_localctx, 1);
-    setState(365);
+    setState(377);
     multiplicativeExpression(0);
     _ctx->stop = _input->LT(-1);
-    setState(372);
+    setState(384);
     _errHandler->sync(this);
     alt = getInterpreter<atn::ParserATNSimulator>()->adaptivePredict(_input, 29,
                                                                      _ctx);
@@ -2065,11 +2067,11 @@ TorqueParser::AdditiveExpressionContext* TorqueParser::additiveExpression(
         _localctx = _tracker.createInstance<AdditiveExpressionContext>(
             parentContext, parentState);
         pushNewRecursionContext(_localctx, startState, RuleAdditiveExpression);
-        setState(367);
+        setState(379);
 
         if (!(precpred(_ctx, 1)))
           throw FailedPredicateException(this, "precpred(_ctx, 1)");
-        setState(368);
+        setState(380);
         dynamic_cast<AdditiveExpressionContext*>(_localctx)->op = _input->LT(1);
         _la = _input->LA(1);
         if (!(_la == TorqueParser::PLUS
@@ -2081,10 +2083,10 @@ TorqueParser::AdditiveExpressionContext* TorqueParser::additiveExpression(
           _errHandler->reportMatch(this);
           consume();
         }
-        setState(369);
+        setState(381);
         multiplicativeExpression(0);
       }
-      setState(374);
+      setState(386);
       _errHandler->sync(this);
       alt = getInterpreter<atn::ParserATNSimulator>()->adaptivePredict(
           _input, 29, _ctx);
@@ -2175,10 +2177,10 @@ TorqueParser::multiplicativeExpression(int precedence) {
   try {
     size_t alt;
     enterOuterAlt(_localctx, 1);
-    setState(376);
+    setState(388);
     unaryExpression();
     _ctx->stop = _input->LT(-1);
-    setState(383);
+    setState(395);
     _errHandler->sync(this);
     alt = getInterpreter<atn::ParserATNSimulator>()->adaptivePredict(_input, 30,
                                                                      _ctx);
@@ -2190,11 +2192,11 @@ TorqueParser::multiplicativeExpression(int precedence) {
             parentContext, parentState);
         pushNewRecursionContext(_localctx, startState,
                                 RuleMultiplicativeExpression);
-        setState(378);
+        setState(390);
 
         if (!(precpred(_ctx, 1)))
           throw FailedPredicateException(this, "precpred(_ctx, 1)");
-        setState(379);
+        setState(391);
         dynamic_cast<MultiplicativeExpressionContext*>(_localctx)->op =
             _input->LT(1);
         _la = _input->LA(1);
@@ -2208,10 +2210,10 @@ TorqueParser::multiplicativeExpression(int precedence) {
           _errHandler->reportMatch(this);
           consume();
         }
-        setState(380);
+        setState(392);
         unaryExpression();
       }
-      setState(385);
+      setState(397);
       _errHandler->sync(this);
       alt = getInterpreter<atn::ParserATNSimulator>()->adaptivePredict(
           _input, 30, _ctx);
@@ -2289,7 +2291,7 @@ TorqueParser::UnaryExpressionContext* TorqueParser::unaryExpression() {
 
   auto onExit = finally([=] { exitRule(); });
   try {
-    setState(389);
+    setState(401);
     _errHandler->sync(this);
     switch (_input->LA(1)) {
       case TorqueParser::T__0:
@@ -2301,7 +2303,7 @@ TorqueParser::UnaryExpressionContext* TorqueParser::unaryExpression() {
       case TorqueParser::IDENTIFIER:
       case TorqueParser::DECIMAL_LITERAL: {
         enterOuterAlt(_localctx, 1);
-        setState(386);
+        setState(398);
         assignmentExpression();
         break;
       }
@@ -2311,14 +2313,14 @@ TorqueParser::UnaryExpressionContext* TorqueParser::unaryExpression() {
       case TorqueParser::BIT_NOT:
       case TorqueParser::NOT: {
         enterOuterAlt(_localctx, 2);
-        setState(387);
+        setState(399);
         dynamic_cast<UnaryExpressionContext*>(_localctx)->op = _input->LT(1);
         _la = _input->LA(1);
-        if (!(((((_la - 52) & ~0x3fULL) == 0) &&
-               ((1ULL << (_la - 52)) & ((1ULL << (TorqueParser::PLUS - 52)) |
-                                        (1ULL << (TorqueParser::MINUS - 52)) |
-                                        (1ULL << (TorqueParser::BIT_NOT - 52)) |
-                                        (1ULL << (TorqueParser::NOT - 52)))) !=
+        if (!(((((_la - 53) & ~0x3fULL) == 0) &&
+               ((1ULL << (_la - 53)) & ((1ULL << (TorqueParser::PLUS - 53)) |
+                                        (1ULL << (TorqueParser::MINUS - 53)) |
+                                        (1ULL << (TorqueParser::BIT_NOT - 53)) |
+                                        (1ULL << (TorqueParser::NOT - 53)))) !=
                    0))) {
           dynamic_cast<UnaryExpressionContext*>(_localctx)->op =
               _errHandler->recoverInline(this);
@@ -2326,7 +2328,7 @@ TorqueParser::UnaryExpressionContext* TorqueParser::unaryExpression() {
           _errHandler->reportMatch(this);
           consume();
         }
-        setState(388);
+        setState(400);
         unaryExpression();
         break;
       }
@@ -2355,14 +2357,9 @@ tree::TerminalNode* TorqueParser::LocationExpressionContext::IDENTIFIER() {
   return getToken(TorqueParser::IDENTIFIER, 0);
 }
 
-TorqueParser::GenericSpecializationTypeListContext*
-TorqueParser::LocationExpressionContext::genericSpecializationTypeList() {
-  return getRuleContext<TorqueParser::GenericSpecializationTypeListContext>(0);
-}
-
-TorqueParser::LocationExpressionContext*
-TorqueParser::LocationExpressionContext::locationExpression() {
-  return getRuleContext<TorqueParser::LocationExpressionContext>(0);
+TorqueParser::PrimaryExpressionContext*
+TorqueParser::LocationExpressionContext::primaryExpression() {
+  return getRuleContext<TorqueParser::PrimaryExpressionContext>(0);
 }
 
 TorqueParser::ExpressionContext*
@@ -2370,6 +2367,11 @@ TorqueParser::LocationExpressionContext::expression() {
   return getRuleContext<TorqueParser::ExpressionContext>(0);
 }
 
+TorqueParser::LocationExpressionContext*
+TorqueParser::LocationExpressionContext::locationExpression() {
+  return getRuleContext<TorqueParser::LocationExpressionContext>(0);
+}
+
 size_t TorqueParser::LocationExpressionContext::getRuleIndex() const {
   return TorqueParser::RuleLocationExpression;
 }
@@ -2413,21 +2415,40 @@ TorqueParser::LocationExpressionContext* TorqueParser::locationExpression(
   try {
     size_t alt;
     enterOuterAlt(_localctx, 1);
-    setState(392);
-    match(TorqueParser::IDENTIFIER);
-    setState(394);
+    setState(414);
     _errHandler->sync(this);
-
     switch (getInterpreter<atn::ParserATNSimulator>()->adaptivePredict(
         _input, 32, _ctx)) {
       case 1: {
-        setState(393);
-        genericSpecializationTypeList();
+        setState(404);
+        match(TorqueParser::IDENTIFIER);
+        break;
+      }
+
+      case 2: {
+        setState(405);
+        primaryExpression();
+        setState(406);
+        match(TorqueParser::T__9);
+        setState(407);
+        match(TorqueParser::IDENTIFIER);
+        break;
+      }
+
+      case 3: {
+        setState(409);
+        primaryExpression();
+        setState(410);
+        match(TorqueParser::T__10);
+        setState(411);
+        expression();
+        setState(412);
+        match(TorqueParser::T__11);
         break;
       }
     }
     _ctx->stop = _input->LT(-1);
-    setState(406);
+    setState(426);
     _errHandler->sync(this);
     alt = getInterpreter<atn::ParserATNSimulator>()->adaptivePredict(_input, 34,
                                                                      _ctx);
@@ -2435,7 +2456,7 @@ TorqueParser::LocationExpressionContext* TorqueParser::locationExpression(
       if (alt == 1) {
         if (!_parseListeners.empty()) triggerExitRuleEvent();
         previousContext = _localctx;
-        setState(404);
+        setState(424);
         _errHandler->sync(this);
         switch (getInterpreter<atn::ParserATNSimulator>()->adaptivePredict(
             _input, 33, _ctx)) {
@@ -2444,13 +2465,13 @@ TorqueParser::LocationExpressionContext* TorqueParser::locationExpression(
                 parentContext, parentState);
             pushNewRecursionContext(_localctx, startState,
                                     RuleLocationExpression);
-            setState(396);
+            setState(416);
 
-            if (!(precpred(_ctx, 2)))
-              throw FailedPredicateException(this, "precpred(_ctx, 2)");
-            setState(397);
+            if (!(precpred(_ctx, 4)))
+              throw FailedPredicateException(this, "precpred(_ctx, 4)");
+            setState(417);
             match(TorqueParser::T__9);
-            setState(398);
+            setState(418);
             match(TorqueParser::IDENTIFIER);
             break;
           }
@@ -2460,21 +2481,21 @@ TorqueParser::LocationExpressionContext* TorqueParser::locationExpression(
                 parentContext, parentState);
             pushNewRecursionContext(_localctx, startState,
                                     RuleLocationExpression);
-            setState(399);
+            setState(419);
 
-            if (!(precpred(_ctx, 1)))
-              throw FailedPredicateException(this, "precpred(_ctx, 1)");
-            setState(400);
+            if (!(precpred(_ctx, 2)))
+              throw FailedPredicateException(this, "precpred(_ctx, 2)");
+            setState(420);
             match(TorqueParser::T__10);
-            setState(401);
+            setState(421);
             expression();
-            setState(402);
+            setState(422);
             match(TorqueParser::T__11);
             break;
           }
         }
       }
-      setState(408);
+      setState(428);
       _errHandler->sync(this);
       alt = getInterpreter<atn::ParserATNSimulator>()->adaptivePredict(
           _input, 34, _ctx);
@@ -2538,33 +2559,33 @@ TorqueParser::IncrementDecrementContext* TorqueParser::incrementDecrement() {
 
   auto onExit = finally([=] { exitRule(); });
   try {
-    setState(419);
+    setState(439);
     _errHandler->sync(this);
     switch (getInterpreter<atn::ParserATNSimulator>()->adaptivePredict(
         _input, 35, _ctx)) {
       case 1: {
         enterOuterAlt(_localctx, 1);
-        setState(409);
+        setState(429);
         match(TorqueParser::INCREMENT);
-        setState(410);
+        setState(430);
         locationExpression(0);
         break;
       }
 
       case 2: {
         enterOuterAlt(_localctx, 2);
-        setState(411);
+        setState(431);
         match(TorqueParser::DECREMENT);
-        setState(412);
+        setState(432);
         locationExpression(0);
         break;
       }
 
       case 3: {
         enterOuterAlt(_localctx, 3);
-        setState(413);
+        setState(433);
         locationExpression(0);
-        setState(414);
+        setState(434);
         dynamic_cast<IncrementDecrementContext*>(_localctx)->op =
             match(TorqueParser::INCREMENT);
         break;
@@ -2572,9 +2593,9 @@ TorqueParser::IncrementDecrementContext* TorqueParser::incrementDecrement() {
 
       case 4: {
         enterOuterAlt(_localctx, 4);
-        setState(416);
+        setState(436);
         locationExpression(0);
-        setState(417);
+        setState(437);
         dynamic_cast<IncrementDecrementContext*>(_localctx)->op =
             match(TorqueParser::DECREMENT);
         break;
@@ -2651,28 +2672,28 @@ TorqueParser::AssignmentContext* TorqueParser::assignment() {
 
   auto onExit = finally([=] { exitRule(); });
   try {
-    setState(427);
+    setState(447);
     _errHandler->sync(this);
     switch (getInterpreter<atn::ParserATNSimulator>()->adaptivePredict(
         _input, 37, _ctx)) {
       case 1: {
         enterOuterAlt(_localctx, 1);
-        setState(421);
+        setState(441);
         incrementDecrement();
         break;
       }
 
       case 2: {
         enterOuterAlt(_localctx, 2);
-        setState(422);
+        setState(442);
         locationExpression(0);
-        setState(425);
+        setState(445);
         _errHandler->sync(this);
 
         switch (getInterpreter<atn::ParserATNSimulator>()->adaptivePredict(
             _input, 36, _ctx)) {
           case 1: {
-            setState(423);
+            setState(443);
             _la = _input->LA(1);
             if (!(_la == TorqueParser::ASSIGNMENT
 
@@ -2682,7 +2703,7 @@ TorqueParser::AssignmentContext* TorqueParser::assignment() {
               _errHandler->reportMatch(this);
               consume();
             }
-            setState(424);
+            setState(444);
             expression();
             break;
           }
@@ -2707,9 +2728,9 @@ TorqueParser::AssignmentExpressionContext::AssignmentExpressionContext(
     ParserRuleContext* parent, size_t invokingState)
     : ParserRuleContext(parent, invokingState) {}
 
-TorqueParser::PrimaryExpressionContext*
-TorqueParser::AssignmentExpressionContext::primaryExpression() {
-  return getRuleContext<TorqueParser::PrimaryExpressionContext>(0);
+TorqueParser::FunctionPointerExpressionContext*
+TorqueParser::AssignmentExpressionContext::functionPointerExpression() {
+  return getRuleContext<TorqueParser::FunctionPointerExpressionContext>(0);
 }
 
 TorqueParser::AssignmentContext*
@@ -2750,20 +2771,20 @@ TorqueParser::assignmentExpression() {
 
   auto onExit = finally([=] { exitRule(); });
   try {
-    setState(431);
+    setState(451);
     _errHandler->sync(this);
     switch (getInterpreter<atn::ParserATNSimulator>()->adaptivePredict(
         _input, 38, _ctx)) {
       case 1: {
         enterOuterAlt(_localctx, 1);
-        setState(429);
-        primaryExpression();
+        setState(449);
+        functionPointerExpression();
         break;
       }
 
       case 2: {
         enterOuterAlt(_localctx, 2);
-        setState(430);
+        setState(450);
         assignment();
         break;
       }
@@ -2778,103 +2799,98 @@ TorqueParser::assignmentExpression() {
   return _localctx;
 }
 
-//----------------- PrimaryExpressionContext
+//----------------- StructExpressionContext
 //------------------------------------------------------------------
 
-TorqueParser::PrimaryExpressionContext::PrimaryExpressionContext(
+TorqueParser::StructExpressionContext::StructExpressionContext(
     ParserRuleContext* parent, size_t invokingState)
     : ParserRuleContext(parent, invokingState) {}
 
-TorqueParser::HelperCallContext*
-TorqueParser::PrimaryExpressionContext::helperCall() {
-  return getRuleContext<TorqueParser::HelperCallContext>(0);
-}
-
-tree::TerminalNode* TorqueParser::PrimaryExpressionContext::DECIMAL_LITERAL() {
-  return getToken(TorqueParser::DECIMAL_LITERAL, 0);
+tree::TerminalNode* TorqueParser::StructExpressionContext::IDENTIFIER() {
+  return getToken(TorqueParser::IDENTIFIER, 0);
 }
 
-tree::TerminalNode* TorqueParser::PrimaryExpressionContext::STRING_LITERAL() {
-  return getToken(TorqueParser::STRING_LITERAL, 0);
+std::vector<TorqueParser::ExpressionContext*>
+TorqueParser::StructExpressionContext::expression() {
+  return getRuleContexts<TorqueParser::ExpressionContext>();
 }
 
 TorqueParser::ExpressionContext*
-TorqueParser::PrimaryExpressionContext::expression() {
-  return getRuleContext<TorqueParser::ExpressionContext>(0);
+TorqueParser::StructExpressionContext::expression(size_t i) {
+  return getRuleContext<TorqueParser::ExpressionContext>(i);
 }
 
-
-size_t TorqueParser::PrimaryExpressionContext::getRuleIndex() const {
-  return TorqueParser::RulePrimaryExpression;
+size_t TorqueParser::StructExpressionContext::getRuleIndex() const {
+  return TorqueParser::RuleStructExpression;
 }
 
-void TorqueParser::PrimaryExpressionContext::enterRule(
+void TorqueParser::StructExpressionContext::enterRule(
     tree::ParseTreeListener* listener) {
   auto parserListener = dynamic_cast<TorqueListener*>(listener);
-  if (parserListener != nullptr) parserListener->enterPrimaryExpression(this);
+  if (parserListener != nullptr) parserListener->enterStructExpression(this);
 }
 
-void TorqueParser::PrimaryExpressionContext::exitRule(
+void TorqueParser::StructExpressionContext::exitRule(
     tree::ParseTreeListener* listener) {
   auto parserListener = dynamic_cast<TorqueListener*>(listener);
-  if (parserListener != nullptr) parserListener->exitPrimaryExpression(this);
+  if (parserListener != nullptr) parserListener->exitStructExpression(this);
 }
 
-antlrcpp::Any TorqueParser::PrimaryExpressionContext::accept(
+antlrcpp::Any TorqueParser::StructExpressionContext::accept(
     tree::ParseTreeVisitor* visitor) {
   if (auto parserVisitor = dynamic_cast<TorqueVisitor*>(visitor))
-    return parserVisitor->visitPrimaryExpression(this);
+    return parserVisitor->visitStructExpression(this);
   else
     return visitor->visitChildren(this);
 }
 
-TorqueParser::PrimaryExpressionContext* TorqueParser::primaryExpression() {
-  PrimaryExpressionContext* _localctx =
-      _tracker.createInstance<PrimaryExpressionContext>(_ctx, getState());
-  enterRule(_localctx, 54, TorqueParser::RulePrimaryExpression);
+TorqueParser::StructExpressionContext* TorqueParser::structExpression() {
+  StructExpressionContext* _localctx =
+      _tracker.createInstance<StructExpressionContext>(_ctx, getState());
+  enterRule(_localctx, 54, TorqueParser::RuleStructExpression);
+  size_t _la = 0;
 
   auto onExit = finally([=] { exitRule(); });
   try {
-    setState(440);
+    enterOuterAlt(_localctx, 1);
+    setState(453);
+    match(TorqueParser::IDENTIFIER);
+    setState(454);
+    match(TorqueParser::T__12);
+    setState(463);
     _errHandler->sync(this);
-    switch (_input->LA(1)) {
-      case TorqueParser::MAX:
-      case TorqueParser::MIN:
-      case TorqueParser::IDENTIFIER: {
-        enterOuterAlt(_localctx, 1);
-        setState(433);
-        helperCall();
-        break;
-      }
-
-      case TorqueParser::DECIMAL_LITERAL: {
-        enterOuterAlt(_localctx, 2);
-        setState(434);
-        match(TorqueParser::DECIMAL_LITERAL);
-        break;
-      }
-
-      case TorqueParser::STRING_LITERAL: {
-        enterOuterAlt(_localctx, 3);
-        setState(435);
-        match(TorqueParser::STRING_LITERAL);
-        break;
-      }
 
-      case TorqueParser::T__0: {
-        enterOuterAlt(_localctx, 4);
-        setState(436);
-        match(TorqueParser::T__0);
-        setState(437);
+    _la = _input->LA(1);
+    if ((((_la & ~0x3fULL) == 0) &&
+         ((1ULL << _la) &
+          ((1ULL << TorqueParser::T__0) | (1ULL << TorqueParser::PLUS) |
+           (1ULL << TorqueParser::MINUS) | (1ULL << TorqueParser::BIT_NOT) |
+           (1ULL << TorqueParser::MAX) | (1ULL << TorqueParser::MIN))) != 0) ||
+        ((((_la - 73) & ~0x3fULL) == 0) &&
+         ((1ULL << (_la - 73)) &
+          ((1ULL << (TorqueParser::INCREMENT - 73)) |
+           (1ULL << (TorqueParser::DECREMENT - 73)) |
+           (1ULL << (TorqueParser::NOT - 73)) |
+           (1ULL << (TorqueParser::STRING_LITERAL - 73)) |
+           (1ULL << (TorqueParser::IDENTIFIER - 73)) |
+           (1ULL << (TorqueParser::DECIMAL_LITERAL - 73)))) != 0)) {
+      setState(455);
+      expression();
+      setState(460);
+      _errHandler->sync(this);
+      _la = _input->LA(1);
+      while (_la == TorqueParser::T__3) {
+        setState(456);
+        match(TorqueParser::T__3);
+        setState(457);
         expression();
-        setState(438);
-        match(TorqueParser::T__1);
-        break;
+        setState(462);
+        _errHandler->sync(this);
+        _la = _input->LA(1);
       }
-
-      default:
-        throw NoViableAltException(this);
     }
+    setState(465);
+    match(TorqueParser::T__13);
 
   } catch (RecognitionException& e) {
     _errHandler->reportError(this, e);
@@ -2885,64 +2901,277 @@ TorqueParser::PrimaryExpressionContext* TorqueParser::primaryExpression() {
   return _localctx;
 }
 
-//----------------- ForInitializationContext
+//----------------- FunctionPointerExpressionContext
 //------------------------------------------------------------------
 
-TorqueParser::ForInitializationContext::ForInitializationContext(
-    ParserRuleContext* parent, size_t invokingState)
+TorqueParser::FunctionPointerExpressionContext::
+    FunctionPointerExpressionContext(ParserRuleContext* parent,
+                                     size_t invokingState)
     : ParserRuleContext(parent, invokingState) {}
 
-TorqueParser::VariableDeclarationWithInitializationContext* TorqueParser::
-    ForInitializationContext::variableDeclarationWithInitialization() {
-  return getRuleContext<
-      TorqueParser::VariableDeclarationWithInitializationContext>(0);
+TorqueParser::PrimaryExpressionContext*
+TorqueParser::FunctionPointerExpressionContext::primaryExpression() {
+  return getRuleContext<TorqueParser::PrimaryExpressionContext>(0);
 }
 
-size_t TorqueParser::ForInitializationContext::getRuleIndex() const {
-  return TorqueParser::RuleForInitialization;
+tree::TerminalNode*
+TorqueParser::FunctionPointerExpressionContext::IDENTIFIER() {
+  return getToken(TorqueParser::IDENTIFIER, 0);
 }
 
-void TorqueParser::ForInitializationContext::enterRule(
+TorqueParser::GenericSpecializationTypeListContext* TorqueParser::
+    FunctionPointerExpressionContext::genericSpecializationTypeList() {
+  return getRuleContext<TorqueParser::GenericSpecializationTypeListContext>(0);
+}
+
+size_t TorqueParser::FunctionPointerExpressionContext::getRuleIndex() const {
+  return TorqueParser::RuleFunctionPointerExpression;
+}
+
+void TorqueParser::FunctionPointerExpressionContext::enterRule(
     tree::ParseTreeListener* listener) {
   auto parserListener = dynamic_cast<TorqueListener*>(listener);
-  if (parserListener != nullptr) parserListener->enterForInitialization(this);
+  if (parserListener != nullptr)
+    parserListener->enterFunctionPointerExpression(this);
 }
 
-void TorqueParser::ForInitializationContext::exitRule(
+void TorqueParser::FunctionPointerExpressionContext::exitRule(
     tree::ParseTreeListener* listener) {
   auto parserListener = dynamic_cast<TorqueListener*>(listener);
-  if (parserListener != nullptr) parserListener->exitForInitialization(this);
+  if (parserListener != nullptr)
+    parserListener->exitFunctionPointerExpression(this);
 }
 
-antlrcpp::Any TorqueParser::ForInitializationContext::accept(
+antlrcpp::Any TorqueParser::FunctionPointerExpressionContext::accept(
     tree::ParseTreeVisitor* visitor) {
   if (auto parserVisitor = dynamic_cast<TorqueVisitor*>(visitor))
-    return parserVisitor->visitForInitialization(this);
+    return parserVisitor->visitFunctionPointerExpression(this);
   else
     return visitor->visitChildren(this);
 }
 
-TorqueParser::ForInitializationContext* TorqueParser::forInitialization() {
-  ForInitializationContext* _localctx =
-      _tracker.createInstance<ForInitializationContext>(_ctx, getState());
-  enterRule(_localctx, 56, TorqueParser::RuleForInitialization);
-  size_t _la = 0;
+TorqueParser::FunctionPointerExpressionContext*
+TorqueParser::functionPointerExpression() {
+  FunctionPointerExpressionContext* _localctx =
+      _tracker.createInstance<FunctionPointerExpressionContext>(_ctx,
+                                                                getState());
+  enterRule(_localctx, 56, TorqueParser::RuleFunctionPointerExpression);
 
   auto onExit = finally([=] { exitRule(); });
   try {
-    enterOuterAlt(_localctx, 1);
-    setState(443);
+    setState(472);
     _errHandler->sync(this);
+    switch (getInterpreter<atn::ParserATNSimulator>()->adaptivePredict(
+        _input, 42, _ctx)) {
+      case 1: {
+        enterOuterAlt(_localctx, 1);
+        setState(467);
+        primaryExpression();
+        break;
+      }
 
-    _la = _input->LA(1);
-    if (_la == TorqueParser::LET) {
-      setState(442);
-      variableDeclarationWithInitialization();
-    }
+      case 2: {
+        enterOuterAlt(_localctx, 2);
+        setState(468);
+        match(TorqueParser::IDENTIFIER);
+        setState(470);
+        _errHandler->sync(this);
 
-  } catch (RecognitionException& e) {
-    _errHandler->reportError(this, e);
-    _localctx->exception = std::current_exception();
+        switch (getInterpreter<atn::ParserATNSimulator>()->adaptivePredict(
+            _input, 41, _ctx)) {
+          case 1: {
+            setState(469);
+            genericSpecializationTypeList();
+            break;
+          }
+        }
+        break;
+      }
+    }
+
+  } catch (RecognitionException& e) {
+    _errHandler->reportError(this, e);
+    _localctx->exception = std::current_exception();
+    _errHandler->recover(this, _localctx->exception);
+  }
+
+  return _localctx;
+}
+
+//----------------- PrimaryExpressionContext
+//------------------------------------------------------------------
+
+TorqueParser::PrimaryExpressionContext::PrimaryExpressionContext(
+    ParserRuleContext* parent, size_t invokingState)
+    : ParserRuleContext(parent, invokingState) {}
+
+TorqueParser::HelperCallContext*
+TorqueParser::PrimaryExpressionContext::helperCall() {
+  return getRuleContext<TorqueParser::HelperCallContext>(0);
+}
+
+TorqueParser::StructExpressionContext*
+TorqueParser::PrimaryExpressionContext::structExpression() {
+  return getRuleContext<TorqueParser::StructExpressionContext>(0);
+}
+
+tree::TerminalNode* TorqueParser::PrimaryExpressionContext::DECIMAL_LITERAL() {
+  return getToken(TorqueParser::DECIMAL_LITERAL, 0);
+}
+
+tree::TerminalNode* TorqueParser::PrimaryExpressionContext::STRING_LITERAL() {
+  return getToken(TorqueParser::STRING_LITERAL, 0);
+}
+
+TorqueParser::ExpressionContext*
+TorqueParser::PrimaryExpressionContext::expression() {
+  return getRuleContext<TorqueParser::ExpressionContext>(0);
+}
+
+size_t TorqueParser::PrimaryExpressionContext::getRuleIndex() const {
+  return TorqueParser::RulePrimaryExpression;
+}
+
+void TorqueParser::PrimaryExpressionContext::enterRule(
+    tree::ParseTreeListener* listener) {
+  auto parserListener = dynamic_cast<TorqueListener*>(listener);
+  if (parserListener != nullptr) parserListener->enterPrimaryExpression(this);
+}
+
+void TorqueParser::PrimaryExpressionContext::exitRule(
+    tree::ParseTreeListener* listener) {
+  auto parserListener = dynamic_cast<TorqueListener*>(listener);
+  if (parserListener != nullptr) parserListener->exitPrimaryExpression(this);
+}
+
+antlrcpp::Any TorqueParser::PrimaryExpressionContext::accept(
+    tree::ParseTreeVisitor* visitor) {
+  if (auto parserVisitor = dynamic_cast<TorqueVisitor*>(visitor))
+    return parserVisitor->visitPrimaryExpression(this);
+  else
+    return visitor->visitChildren(this);
+}
+
+TorqueParser::PrimaryExpressionContext* TorqueParser::primaryExpression() {
+  PrimaryExpressionContext* _localctx =
+      _tracker.createInstance<PrimaryExpressionContext>(_ctx, getState());
+  enterRule(_localctx, 58, TorqueParser::RulePrimaryExpression);
+
+  auto onExit = finally([=] { exitRule(); });
+  try {
+    setState(482);
+    _errHandler->sync(this);
+    switch (getInterpreter<atn::ParserATNSimulator>()->adaptivePredict(
+        _input, 43, _ctx)) {
+      case 1: {
+        enterOuterAlt(_localctx, 1);
+        setState(474);
+        helperCall();
+        break;
+      }
+
+      case 2: {
+        enterOuterAlt(_localctx, 2);
+        setState(475);
+        structExpression();
+        break;
+      }
+
+      case 3: {
+        enterOuterAlt(_localctx, 3);
+        setState(476);
+        match(TorqueParser::DECIMAL_LITERAL);
+        break;
+      }
+
+      case 4: {
+        enterOuterAlt(_localctx, 4);
+        setState(477);
+        match(TorqueParser::STRING_LITERAL);
+        break;
+      }
+
+      case 5: {
+        enterOuterAlt(_localctx, 5);
+        setState(478);
+        match(TorqueParser::T__0);
+        setState(479);
+        expression();
+        setState(480);
+        match(TorqueParser::T__1);
+        break;
+      }
+    }
+
+  } catch (RecognitionException& e) {
+    _errHandler->reportError(this, e);
+    _localctx->exception = std::current_exception();
+    _errHandler->recover(this, _localctx->exception);
+  }
+
+  return _localctx;
+}
+
+//----------------- ForInitializationContext
+//------------------------------------------------------------------
+
+TorqueParser::ForInitializationContext::ForInitializationContext(
+    ParserRuleContext* parent, size_t invokingState)
+    : ParserRuleContext(parent, invokingState) {}
+
+TorqueParser::VariableDeclarationWithInitializationContext* TorqueParser::
+    ForInitializationContext::variableDeclarationWithInitialization() {
+  return getRuleContext<
+      TorqueParser::VariableDeclarationWithInitializationContext>(0);
+}
+
+size_t TorqueParser::ForInitializationContext::getRuleIndex() const {
+  return TorqueParser::RuleForInitialization;
+}
+
+void TorqueParser::ForInitializationContext::enterRule(
+    tree::ParseTreeListener* listener) {
+  auto parserListener = dynamic_cast<TorqueListener*>(listener);
+  if (parserListener != nullptr) parserListener->enterForInitialization(this);
+}
+
+void TorqueParser::ForInitializationContext::exitRule(
+    tree::ParseTreeListener* listener) {
+  auto parserListener = dynamic_cast<TorqueListener*>(listener);
+  if (parserListener != nullptr) parserListener->exitForInitialization(this);
+}
+
+antlrcpp::Any TorqueParser::ForInitializationContext::accept(
+    tree::ParseTreeVisitor* visitor) {
+  if (auto parserVisitor = dynamic_cast<TorqueVisitor*>(visitor))
+    return parserVisitor->visitForInitialization(this);
+  else
+    return visitor->visitChildren(this);
+}
+
+TorqueParser::ForInitializationContext* TorqueParser::forInitialization() {
+  ForInitializationContext* _localctx =
+      _tracker.createInstance<ForInitializationContext>(_ctx, getState());
+  enterRule(_localctx, 60, TorqueParser::RuleForInitialization);
+  size_t _la = 0;
+
+  auto onExit = finally([=] { exitRule(); });
+  try {
+    enterOuterAlt(_localctx, 1);
+    setState(485);
+    _errHandler->sync(this);
+
+    _la = _input->LA(1);
+    if (_la == TorqueParser::LET
+
+        || _la == TorqueParser::CONST) {
+      setState(484);
+      variableDeclarationWithInitialization();
+    }
+
+  } catch (RecognitionException& e) {
+    _errHandler->reportError(this, e);
+    _localctx->exception = std::current_exception();
     _errHandler->recover(this, _localctx->exception);
   }
 
@@ -3004,28 +3233,28 @@ antlrcpp::Any TorqueParser::ForLoopContext::accept(
 TorqueParser::ForLoopContext* TorqueParser::forLoop() {
   ForLoopContext* _localctx =
       _tracker.createInstance<ForLoopContext>(_ctx, getState());
-  enterRule(_localctx, 58, TorqueParser::RuleForLoop);
+  enterRule(_localctx, 62, TorqueParser::RuleForLoop);
 
   auto onExit = finally([=] { exitRule(); });
   try {
     enterOuterAlt(_localctx, 1);
-    setState(445);
+    setState(487);
     match(TorqueParser::FOR);
-    setState(446);
+    setState(488);
     match(TorqueParser::T__0);
-    setState(447);
+    setState(489);
     forInitialization();
-    setState(448);
-    match(TorqueParser::T__12);
-    setState(449);
+    setState(490);
+    match(TorqueParser::T__14);
+    setState(491);
     expression();
-    setState(450);
-    match(TorqueParser::T__12);
-    setState(451);
+    setState(492);
+    match(TorqueParser::T__14);
+    setState(493);
     assignment();
-    setState(452);
+    setState(494);
     match(TorqueParser::T__1);
-    setState(453);
+    setState(495);
     statementBlock();
 
   } catch (RecognitionException& e) {
@@ -3081,15 +3310,15 @@ antlrcpp::Any TorqueParser::RangeSpecifierContext::accept(
 TorqueParser::RangeSpecifierContext* TorqueParser::rangeSpecifier() {
   RangeSpecifierContext* _localctx =
       _tracker.createInstance<RangeSpecifierContext>(_ctx, getState());
-  enterRule(_localctx, 60, TorqueParser::RuleRangeSpecifier);
+  enterRule(_localctx, 64, TorqueParser::RuleRangeSpecifier);
   size_t _la = 0;
 
   auto onExit = finally([=] { exitRule(); });
   try {
     enterOuterAlt(_localctx, 1);
-    setState(455);
+    setState(497);
     match(TorqueParser::T__10);
-    setState(457);
+    setState(499);
     _errHandler->sync(this);
 
     _la = _input->LA(1);
@@ -3098,20 +3327,20 @@ TorqueParser::RangeSpecifierContext* TorqueParser::rangeSpecifier() {
           ((1ULL << TorqueParser::T__0) | (1ULL << TorqueParser::PLUS) |
            (1ULL << TorqueParser::MINUS) | (1ULL << TorqueParser::BIT_NOT) |
            (1ULL << TorqueParser::MAX) | (1ULL << TorqueParser::MIN))) != 0) ||
-        ((((_la - 72) & ~0x3fULL) == 0) &&
-         ((1ULL << (_la - 72)) &
-          ((1ULL << (TorqueParser::INCREMENT - 72)) |
-           (1ULL << (TorqueParser::DECREMENT - 72)) |
-           (1ULL << (TorqueParser::NOT - 72)) |
-           (1ULL << (TorqueParser::STRING_LITERAL - 72)) |
-           (1ULL << (TorqueParser::IDENTIFIER - 72)) |
-           (1ULL << (TorqueParser::DECIMAL_LITERAL - 72)))) != 0)) {
-      setState(456);
+        ((((_la - 73) & ~0x3fULL) == 0) &&
+         ((1ULL << (_la - 73)) &
+          ((1ULL << (TorqueParser::INCREMENT - 73)) |
+           (1ULL << (TorqueParser::DECREMENT - 73)) |
+           (1ULL << (TorqueParser::NOT - 73)) |
+           (1ULL << (TorqueParser::STRING_LITERAL - 73)) |
+           (1ULL << (TorqueParser::IDENTIFIER - 73)) |
+           (1ULL << (TorqueParser::DECIMAL_LITERAL - 73)))) != 0)) {
+      setState(498);
       dynamic_cast<RangeSpecifierContext*>(_localctx)->begin = expression();
     }
-    setState(459);
+    setState(501);
     match(TorqueParser::T__4);
-    setState(461);
+    setState(503);
     _errHandler->sync(this);
 
     _la = _input->LA(1);
@@ -3120,18 +3349,18 @@ TorqueParser::RangeSpecifierContext* TorqueParser::rangeSpecifier() {
           ((1ULL << TorqueParser::T__0) | (1ULL << TorqueParser::PLUS) |
            (1ULL << TorqueParser::MINUS) | (1ULL << TorqueParser::BIT_NOT) |
            (1ULL << TorqueParser::MAX) | (1ULL << TorqueParser::MIN))) != 0) ||
-        ((((_la - 72) & ~0x3fULL) == 0) &&
-         ((1ULL << (_la - 72)) &
-          ((1ULL << (TorqueParser::INCREMENT - 72)) |
-           (1ULL << (TorqueParser::DECREMENT - 72)) |
-           (1ULL << (TorqueParser::NOT - 72)) |
-           (1ULL << (TorqueParser::STRING_LITERAL - 72)) |
-           (1ULL << (TorqueParser::IDENTIFIER - 72)) |
-           (1ULL << (TorqueParser::DECIMAL_LITERAL - 72)))) != 0)) {
-      setState(460);
+        ((((_la - 73) & ~0x3fULL) == 0) &&
+         ((1ULL << (_la - 73)) &
+          ((1ULL << (TorqueParser::INCREMENT - 73)) |
+           (1ULL << (TorqueParser::DECREMENT - 73)) |
+           (1ULL << (TorqueParser::NOT - 73)) |
+           (1ULL << (TorqueParser::STRING_LITERAL - 73)) |
+           (1ULL << (TorqueParser::IDENTIFIER - 73)) |
+           (1ULL << (TorqueParser::DECIMAL_LITERAL - 73)))) != 0)) {
+      setState(502);
       dynamic_cast<RangeSpecifierContext*>(_localctx)->end = expression();
     }
-    setState(463);
+    setState(505);
     match(TorqueParser::T__11);
 
   } catch (RecognitionException& e) {
@@ -3182,18 +3411,18 @@ antlrcpp::Any TorqueParser::ForOfRangeContext::accept(
 TorqueParser::ForOfRangeContext* TorqueParser::forOfRange() {
   ForOfRangeContext* _localctx =
       _tracker.createInstance<ForOfRangeContext>(_ctx, getState());
-  enterRule(_localctx, 62, TorqueParser::RuleForOfRange);
+  enterRule(_localctx, 66, TorqueParser::RuleForOfRange);
   size_t _la = 0;
 
   auto onExit = finally([=] { exitRule(); });
   try {
     enterOuterAlt(_localctx, 1);
-    setState(466);
+    setState(508);
     _errHandler->sync(this);
 
     _la = _input->LA(1);
     if (_la == TorqueParser::T__10) {
-      setState(465);
+      setState(507);
       rangeSpecifier();
     }
 
@@ -3262,26 +3491,26 @@ antlrcpp::Any TorqueParser::ForOfLoopContext::accept(
 TorqueParser::ForOfLoopContext* TorqueParser::forOfLoop() {
   ForOfLoopContext* _localctx =
       _tracker.createInstance<ForOfLoopContext>(_ctx, getState());
-  enterRule(_localctx, 64, TorqueParser::RuleForOfLoop);
+  enterRule(_localctx, 68, TorqueParser::RuleForOfLoop);
 
   auto onExit = finally([=] { exitRule(); });
   try {
     enterOuterAlt(_localctx, 1);
-    setState(468);
+    setState(510);
     match(TorqueParser::FOR);
-    setState(469);
+    setState(511);
     match(TorqueParser::T__0);
-    setState(470);
+    setState(512);
     variableDeclaration();
-    setState(471);
-    match(TorqueParser::T__13);
-    setState(472);
+    setState(513);
+    match(TorqueParser::T__15);
+    setState(514);
     expression();
-    setState(473);
+    setState(515);
     forOfRange();
-    setState(474);
+    setState(516);
     match(TorqueParser::T__1);
-    setState(475);
+    setState(517);
     statementBlock();
 
   } catch (RecognitionException& e) {
@@ -3331,12 +3560,12 @@ antlrcpp::Any TorqueParser::ArgumentContext::accept(
 TorqueParser::ArgumentContext* TorqueParser::argument() {
   ArgumentContext* _localctx =
       _tracker.createInstance<ArgumentContext>(_ctx, getState());
-  enterRule(_localctx, 66, TorqueParser::RuleArgument);
+  enterRule(_localctx, 70, TorqueParser::RuleArgument);
 
   auto onExit = finally([=] { exitRule(); });
   try {
     enterOuterAlt(_localctx, 1);
-    setState(477);
+    setState(519);
     expression();
 
   } catch (RecognitionException& e) {
@@ -3392,15 +3621,15 @@ antlrcpp::Any TorqueParser::ArgumentListContext::accept(
 TorqueParser::ArgumentListContext* TorqueParser::argumentList() {
   ArgumentListContext* _localctx =
       _tracker.createInstance<ArgumentListContext>(_ctx, getState());
-  enterRule(_localctx, 68, TorqueParser::RuleArgumentList);
+  enterRule(_localctx, 72, TorqueParser::RuleArgumentList);
   size_t _la = 0;
 
   auto onExit = finally([=] { exitRule(); });
   try {
     enterOuterAlt(_localctx, 1);
-    setState(479);
+    setState(521);
     match(TorqueParser::T__0);
-    setState(481);
+    setState(523);
     _errHandler->sync(this);
 
     _la = _input->LA(1);
@@ -3409,30 +3638,30 @@ TorqueParser::ArgumentListContext* TorqueParser::argumentList() {
           ((1ULL << TorqueParser::T__0) | (1ULL << TorqueParser::PLUS) |
            (1ULL << TorqueParser::MINUS) | (1ULL << TorqueParser::BIT_NOT) |
            (1ULL << TorqueParser::MAX) | (1ULL << TorqueParser::MIN))) != 0) ||
-        ((((_la - 72) & ~0x3fULL) == 0) &&
-         ((1ULL << (_la - 72)) &
-          ((1ULL << (TorqueParser::INCREMENT - 72)) |
-           (1ULL << (TorqueParser::DECREMENT - 72)) |
-           (1ULL << (TorqueParser::NOT - 72)) |
-           (1ULL << (TorqueParser::STRING_LITERAL - 72)) |
-           (1ULL << (TorqueParser::IDENTIFIER - 72)) |
-           (1ULL << (TorqueParser::DECIMAL_LITERAL - 72)))) != 0)) {
-      setState(480);
+        ((((_la - 73) & ~0x3fULL) == 0) &&
+         ((1ULL << (_la - 73)) &
+          ((1ULL << (TorqueParser::INCREMENT - 73)) |
+           (1ULL << (TorqueParser::DECREMENT - 73)) |
+           (1ULL << (TorqueParser::NOT - 73)) |
+           (1ULL << (TorqueParser::STRING_LITERAL - 73)) |
+           (1ULL << (TorqueParser::IDENTIFIER - 73)) |
+           (1ULL << (TorqueParser::DECIMAL_LITERAL - 73)))) != 0)) {
+      setState(522);
       argument();
     }
-    setState(487);
+    setState(529);
     _errHandler->sync(this);
     _la = _input->LA(1);
     while (_la == TorqueParser::T__3) {
-      setState(483);
+      setState(525);
       match(TorqueParser::T__3);
-      setState(484);
+      setState(526);
       argument();
-      setState(489);
+      setState(531);
       _errHandler->sync(this);
       _la = _input->LA(1);
     }
-    setState(490);
+    setState(532);
     match(TorqueParser::T__1);
 
   } catch (RecognitionException& e) {
@@ -3505,35 +3734,35 @@ antlrcpp::Any TorqueParser::HelperCallContext::accept(
 TorqueParser::HelperCallContext* TorqueParser::helperCall() {
   HelperCallContext* _localctx =
       _tracker.createInstance<HelperCallContext>(_ctx, getState());
-  enterRule(_localctx, 70, TorqueParser::RuleHelperCall);
+  enterRule(_localctx, 74, TorqueParser::RuleHelperCall);
   size_t _la = 0;
 
   auto onExit = finally([=] { exitRule(); });
   try {
     enterOuterAlt(_localctx, 1);
-    setState(492);
+    setState(534);
     _la = _input->LA(1);
-    if (!(((((_la - 60) & ~0x3fULL) == 0) &&
-           ((1ULL << (_la - 60)) &
-            ((1ULL << (TorqueParser::MAX - 60)) |
-             (1ULL << (TorqueParser::MIN - 60)) |
-             (1ULL << (TorqueParser::IDENTIFIER - 60)))) != 0))) {
+    if (!(((((_la - 61) & ~0x3fULL) == 0) &&
+           ((1ULL << (_la - 61)) &
+            ((1ULL << (TorqueParser::MAX - 61)) |
+             (1ULL << (TorqueParser::MIN - 61)) |
+             (1ULL << (TorqueParser::IDENTIFIER - 61)))) != 0))) {
       _errHandler->recoverInline(this);
     } else {
       _errHandler->reportMatch(this);
       consume();
     }
-    setState(494);
+    setState(536);
     _errHandler->sync(this);
 
     _la = _input->LA(1);
     if (_la == TorqueParser::LESS_THAN) {
-      setState(493);
+      setState(535);
       genericSpecializationTypeList();
     }
-    setState(496);
+    setState(538);
     argumentList();
-    setState(497);
+    setState(539);
     optionalOtherwise();
 
   } catch (RecognitionException& e) {
@@ -3583,12 +3812,12 @@ antlrcpp::Any TorqueParser::LabelReferenceContext::accept(
 TorqueParser::LabelReferenceContext* TorqueParser::labelReference() {
   LabelReferenceContext* _localctx =
       _tracker.createInstance<LabelReferenceContext>(_ctx, getState());
-  enterRule(_localctx, 72, TorqueParser::RuleLabelReference);
+  enterRule(_localctx, 76, TorqueParser::RuleLabelReference);
 
   auto onExit = finally([=] { exitRule(); });
   try {
     enterOuterAlt(_localctx, 1);
-    setState(499);
+    setState(541);
     match(TorqueParser::IDENTIFIER);
 
   } catch (RecognitionException& e) {
@@ -3607,10 +3836,6 @@ TorqueParser::VariableDeclarationContext::VariableDeclarationContext(
     ParserRuleContext* parent, size_t invokingState)
     : ParserRuleContext(parent, invokingState) {}
 
-tree::TerminalNode* TorqueParser::VariableDeclarationContext::LET() {
-  return getToken(TorqueParser::LET, 0);
-}
-
 tree::TerminalNode* TorqueParser::VariableDeclarationContext::IDENTIFIER() {
   return getToken(TorqueParser::IDENTIFIER, 0);
 }
@@ -3619,6 +3844,14 @@ TorqueParser::TypeContext* TorqueParser::VariableDeclarationContext::type() {
   return getRuleContext<TorqueParser::TypeContext>(0);
 }
 
+tree::TerminalNode* TorqueParser::VariableDeclarationContext::LET() {
+  return getToken(TorqueParser::LET, 0);
+}
+
+tree::TerminalNode* TorqueParser::VariableDeclarationContext::CONST() {
+  return getToken(TorqueParser::CONST, 0);
+}
+
 size_t TorqueParser::VariableDeclarationContext::getRuleIndex() const {
   return TorqueParser::RuleVariableDeclaration;
 }
@@ -3646,18 +3879,27 @@ antlrcpp::Any TorqueParser::VariableDeclarationContext::accept(
 TorqueParser::VariableDeclarationContext* TorqueParser::variableDeclaration() {
   VariableDeclarationContext* _localctx =
       _tracker.createInstance<VariableDeclarationContext>(_ctx, getState());
-  enterRule(_localctx, 74, TorqueParser::RuleVariableDeclaration);
+  enterRule(_localctx, 78, TorqueParser::RuleVariableDeclaration);
+  size_t _la = 0;
 
   auto onExit = finally([=] { exitRule(); });
   try {
     enterOuterAlt(_localctx, 1);
-    setState(501);
-    match(TorqueParser::LET);
-    setState(502);
+    setState(543);
+    _la = _input->LA(1);
+    if (!(_la == TorqueParser::LET
+
+          || _la == TorqueParser::CONST)) {
+      _errHandler->recoverInline(this);
+    } else {
+      _errHandler->reportMatch(this);
+      consume();
+    }
+    setState(544);
     match(TorqueParser::IDENTIFIER);
-    setState(503);
+    setState(545);
     match(TorqueParser::T__4);
-    setState(504);
+    setState(546);
     type(0);
 
   } catch (RecognitionException& e) {
@@ -3726,23 +3968,23 @@ TorqueParser::variableDeclarationWithInitialization() {
   VariableDeclarationWithInitializationContext* _localctx =
       _tracker.createInstance<VariableDeclarationWithInitializationContext>(
           _ctx, getState());
-  enterRule(_localctx, 76,
+  enterRule(_localctx, 80,
             TorqueParser::RuleVariableDeclarationWithInitialization);
   size_t _la = 0;
 
   auto onExit = finally([=] { exitRule(); });
   try {
     enterOuterAlt(_localctx, 1);
-    setState(506);
+    setState(548);
     variableDeclaration();
-    setState(509);
+    setState(551);
     _errHandler->sync(this);
 
     _la = _input->LA(1);
     if (_la == TorqueParser::ASSIGNMENT) {
-      setState(507);
+      setState(549);
       match(TorqueParser::ASSIGNMENT);
-      setState(508);
+      setState(550);
       expression();
     }
 
@@ -3798,21 +4040,21 @@ antlrcpp::Any TorqueParser::HelperCallStatementContext::accept(
 TorqueParser::HelperCallStatementContext* TorqueParser::helperCallStatement() {
   HelperCallStatementContext* _localctx =
       _tracker.createInstance<HelperCallStatementContext>(_ctx, getState());
-  enterRule(_localctx, 78, TorqueParser::RuleHelperCallStatement);
+  enterRule(_localctx, 82, TorqueParser::RuleHelperCallStatement);
   size_t _la = 0;
 
   auto onExit = finally([=] { exitRule(); });
   try {
     enterOuterAlt(_localctx, 1);
-    setState(512);
+    setState(554);
     _errHandler->sync(this);
 
     _la = _input->LA(1);
     if (_la == TorqueParser::TAIL) {
-      setState(511);
+      setState(553);
       match(TorqueParser::TAIL);
     }
-    setState(514);
+    setState(556);
     helperCall();
 
   } catch (RecognitionException& e) {
@@ -3863,12 +4105,12 @@ antlrcpp::Any TorqueParser::ExpressionStatementContext::accept(
 TorqueParser::ExpressionStatementContext* TorqueParser::expressionStatement() {
   ExpressionStatementContext* _localctx =
       _tracker.createInstance<ExpressionStatementContext>(_ctx, getState());
-  enterRule(_localctx, 80, TorqueParser::RuleExpressionStatement);
+  enterRule(_localctx, 84, TorqueParser::RuleExpressionStatement);
 
   auto onExit = finally([=] { exitRule(); });
   try {
     enterOuterAlt(_localctx, 1);
-    setState(516);
+    setState(558);
     assignment();
 
   } catch (RecognitionException& e) {
@@ -3937,39 +4179,39 @@ antlrcpp::Any TorqueParser::IfStatementContext::accept(
 TorqueParser::IfStatementContext* TorqueParser::ifStatement() {
   IfStatementContext* _localctx =
       _tracker.createInstance<IfStatementContext>(_ctx, getState());
-  enterRule(_localctx, 82, TorqueParser::RuleIfStatement);
+  enterRule(_localctx, 86, TorqueParser::RuleIfStatement);
   size_t _la = 0;
 
   auto onExit = finally([=] { exitRule(); });
   try {
     enterOuterAlt(_localctx, 1);
-    setState(518);
+    setState(560);
     match(TorqueParser::IF);
-    setState(520);
+    setState(562);
     _errHandler->sync(this);
 
     _la = _input->LA(1);
     if (_la == TorqueParser::CONSTEXPR) {
-      setState(519);
+      setState(561);
       match(TorqueParser::CONSTEXPR);
     }
-    setState(522);
+    setState(564);
     match(TorqueParser::T__0);
-    setState(523);
+    setState(565);
     expression();
-    setState(524);
+    setState(566);
     match(TorqueParser::T__1);
-    setState(525);
+    setState(567);
     statementBlock();
-    setState(528);
+    setState(570);
     _errHandler->sync(this);
 
     switch (getInterpreter<atn::ParserATNSimulator>()->adaptivePredict(
-        _input, 50, _ctx)) {
+        _input, 54, _ctx)) {
       case 1: {
-        setState(526);
-        match(TorqueParser::T__14);
-        setState(527);
+        setState(568);
+        match(TorqueParser::T__16);
+        setState(569);
         statementBlock();
         break;
       }
@@ -4031,20 +4273,20 @@ antlrcpp::Any TorqueParser::WhileLoopContext::accept(
 TorqueParser::WhileLoopContext* TorqueParser::whileLoop() {
   WhileLoopContext* _localctx =
       _tracker.createInstance<WhileLoopContext>(_ctx, getState());
-  enterRule(_localctx, 84, TorqueParser::RuleWhileLoop);
+  enterRule(_localctx, 88, TorqueParser::RuleWhileLoop);
 
   auto onExit = finally([=] { exitRule(); });
   try {
     enterOuterAlt(_localctx, 1);
-    setState(530);
+    setState(572);
     match(TorqueParser::WHILE);
-    setState(531);
+    setState(573);
     match(TorqueParser::T__0);
-    setState(532);
+    setState(574);
     expression();
-    setState(533);
+    setState(575);
     match(TorqueParser::T__1);
-    setState(534);
+    setState(576);
     statementBlock();
 
   } catch (RecognitionException& e) {
@@ -4099,15 +4341,15 @@ antlrcpp::Any TorqueParser::ReturnStatementContext::accept(
 TorqueParser::ReturnStatementContext* TorqueParser::returnStatement() {
   ReturnStatementContext* _localctx =
       _tracker.createInstance<ReturnStatementContext>(_ctx, getState());
-  enterRule(_localctx, 86, TorqueParser::RuleReturnStatement);
+  enterRule(_localctx, 90, TorqueParser::RuleReturnStatement);
   size_t _la = 0;
 
   auto onExit = finally([=] { exitRule(); });
   try {
     enterOuterAlt(_localctx, 1);
-    setState(536);
+    setState(578);
     match(TorqueParser::RETURN);
-    setState(538);
+    setState(580);
     _errHandler->sync(this);
 
     _la = _input->LA(1);
@@ -4116,15 +4358,15 @@ TorqueParser::ReturnStatementContext* TorqueParser::returnStatement() {
           ((1ULL << TorqueParser::T__0) | (1ULL << TorqueParser::PLUS) |
            (1ULL << TorqueParser::MINUS) | (1ULL << TorqueParser::BIT_NOT) |
            (1ULL << TorqueParser::MAX) | (1ULL << TorqueParser::MIN))) != 0) ||
-        ((((_la - 72) & ~0x3fULL) == 0) &&
-         ((1ULL << (_la - 72)) &
-          ((1ULL << (TorqueParser::INCREMENT - 72)) |
-           (1ULL << (TorqueParser::DECREMENT - 72)) |
-           (1ULL << (TorqueParser::NOT - 72)) |
-           (1ULL << (TorqueParser::STRING_LITERAL - 72)) |
-           (1ULL << (TorqueParser::IDENTIFIER - 72)) |
-           (1ULL << (TorqueParser::DECIMAL_LITERAL - 72)))) != 0)) {
-      setState(537);
+        ((((_la - 73) & ~0x3fULL) == 0) &&
+         ((1ULL << (_la - 73)) &
+          ((1ULL << (TorqueParser::INCREMENT - 73)) |
+           (1ULL << (TorqueParser::DECREMENT - 73)) |
+           (1ULL << (TorqueParser::NOT - 73)) |
+           (1ULL << (TorqueParser::STRING_LITERAL - 73)) |
+           (1ULL << (TorqueParser::IDENTIFIER - 73)) |
+           (1ULL << (TorqueParser::DECIMAL_LITERAL - 73)))) != 0)) {
+      setState(579);
       expression();
     }
 
@@ -4175,12 +4417,12 @@ antlrcpp::Any TorqueParser::BreakStatementContext::accept(
 TorqueParser::BreakStatementContext* TorqueParser::breakStatement() {
   BreakStatementContext* _localctx =
       _tracker.createInstance<BreakStatementContext>(_ctx, getState());
-  enterRule(_localctx, 88, TorqueParser::RuleBreakStatement);
+  enterRule(_localctx, 92, TorqueParser::RuleBreakStatement);
 
   auto onExit = finally([=] { exitRule(); });
   try {
     enterOuterAlt(_localctx, 1);
-    setState(540);
+    setState(582);
     match(TorqueParser::BREAK);
 
   } catch (RecognitionException& e) {
@@ -4230,12 +4472,12 @@ antlrcpp::Any TorqueParser::ContinueStatementContext::accept(
 TorqueParser::ContinueStatementContext* TorqueParser::continueStatement() {
   ContinueStatementContext* _localctx =
       _tracker.createInstance<ContinueStatementContext>(_ctx, getState());
-  enterRule(_localctx, 90, TorqueParser::RuleContinueStatement);
+  enterRule(_localctx, 94, TorqueParser::RuleContinueStatement);
 
   auto onExit = finally([=] { exitRule(); });
   try {
     enterOuterAlt(_localctx, 1);
-    setState(542);
+    setState(584);
     match(TorqueParser::CONTINUE);
 
   } catch (RecognitionException& e) {
@@ -4295,22 +4537,22 @@ antlrcpp::Any TorqueParser::GotoStatementContext::accept(
 TorqueParser::GotoStatementContext* TorqueParser::gotoStatement() {
   GotoStatementContext* _localctx =
       _tracker.createInstance<GotoStatementContext>(_ctx, getState());
-  enterRule(_localctx, 92, TorqueParser::RuleGotoStatement);
+  enterRule(_localctx, 96, TorqueParser::RuleGotoStatement);
   size_t _la = 0;
 
   auto onExit = finally([=] { exitRule(); });
   try {
     enterOuterAlt(_localctx, 1);
-    setState(544);
+    setState(586);
     match(TorqueParser::GOTO);
-    setState(545);
+    setState(587);
     labelReference();
-    setState(547);
+    setState(589);
     _errHandler->sync(this);
 
     _la = _input->LA(1);
     if (_la == TorqueParser::T__0) {
-      setState(546);
+      setState(588);
       argumentList();
     }
 
@@ -4373,16 +4615,16 @@ TorqueParser::HandlerWithStatementContext*
 TorqueParser::handlerWithStatement() {
   HandlerWithStatementContext* _localctx =
       _tracker.createInstance<HandlerWithStatementContext>(_ctx, getState());
-  enterRule(_localctx, 94, TorqueParser::RuleHandlerWithStatement);
+  enterRule(_localctx, 98, TorqueParser::RuleHandlerWithStatement);
 
   auto onExit = finally([=] { exitRule(); });
   try {
     enterOuterAlt(_localctx, 1);
-    setState(549);
+    setState(591);
     match(TorqueParser::LABEL);
-    setState(550);
+    setState(592);
     labelDeclaration();
-    setState(551);
+    setState(593);
     statementBlock();
 
   } catch (RecognitionException& e) {
@@ -4447,23 +4689,23 @@ antlrcpp::Any TorqueParser::TryLabelStatementContext::accept(
 TorqueParser::TryLabelStatementContext* TorqueParser::tryLabelStatement() {
   TryLabelStatementContext* _localctx =
       _tracker.createInstance<TryLabelStatementContext>(_ctx, getState());
-  enterRule(_localctx, 96, TorqueParser::RuleTryLabelStatement);
+  enterRule(_localctx, 100, TorqueParser::RuleTryLabelStatement);
 
   auto onExit = finally([=] { exitRule(); });
   try {
     size_t alt;
     enterOuterAlt(_localctx, 1);
-    setState(553);
+    setState(595);
     match(TorqueParser::TRY);
-    setState(554);
+    setState(596);
     statementBlock();
-    setState(556);
+    setState(598);
     _errHandler->sync(this);
     alt = 1;
     do {
       switch (alt) {
         case 1: {
-          setState(555);
+          setState(597);
           handlerWithStatement();
           break;
         }
@@ -4471,10 +4713,10 @@ TorqueParser::TryLabelStatementContext* TorqueParser::tryLabelStatement() {
         default:
           throw NoViableAltException(this);
       }
-      setState(558);
+      setState(600);
       _errHandler->sync(this);
       alt = getInterpreter<atn::ParserATNSimulator>()->adaptivePredict(
-          _input, 53, _ctx);
+          _input, 57, _ctx);
     } while (alt != 2 && alt != atn::ATN::INVALID_ALT_NUMBER);
 
   } catch (RecognitionException& e) {
@@ -4542,18 +4784,18 @@ antlrcpp::Any TorqueParser::DiagnosticStatementContext::accept(
 TorqueParser::DiagnosticStatementContext* TorqueParser::diagnosticStatement() {
   DiagnosticStatementContext* _localctx =
       _tracker.createInstance<DiagnosticStatementContext>(_ctx, getState());
-  enterRule(_localctx, 98, TorqueParser::RuleDiagnosticStatement);
+  enterRule(_localctx, 102, TorqueParser::RuleDiagnosticStatement);
   size_t _la = 0;
 
   auto onExit = finally([=] { exitRule(); });
   try {
-    setState(567);
+    setState(609);
     _errHandler->sync(this);
     switch (_input->LA(1)) {
       case TorqueParser::ASSERT_TOKEN:
       case TorqueParser::CHECK_TOKEN: {
         enterOuterAlt(_localctx, 1);
-        setState(560);
+        setState(602);
         _la = _input->LA(1);
         if (!(_la == TorqueParser::ASSERT_TOKEN
 
@@ -4563,25 +4805,25 @@ TorqueParser::DiagnosticStatementContext* TorqueParser::diagnosticStatement() {
           _errHandler->reportMatch(this);
           consume();
         }
-        setState(561);
+        setState(603);
         match(TorqueParser::T__0);
-        setState(562);
+        setState(604);
         expression();
-        setState(563);
+        setState(605);
         match(TorqueParser::T__1);
         break;
       }
 
       case TorqueParser::UNREACHABLE_TOKEN: {
         enterOuterAlt(_localctx, 2);
-        setState(565);
+        setState(607);
         match(TorqueParser::UNREACHABLE_TOKEN);
         break;
       }
 
       case TorqueParser::DEBUG_TOKEN: {
         enterOuterAlt(_localctx, 3);
-        setState(566);
+        setState(608);
         match(TorqueParser::DEBUG_TOKEN);
         break;
       }
@@ -4696,117 +4938,117 @@ antlrcpp::Any TorqueParser::StatementContext::accept(
 TorqueParser::StatementContext* TorqueParser::statement() {
   StatementContext* _localctx =
       _tracker.createInstance<StatementContext>(_ctx, getState());
-  enterRule(_localctx, 100, TorqueParser::RuleStatement);
+  enterRule(_localctx, 104, TorqueParser::RuleStatement);
 
   auto onExit = finally([=] { exitRule(); });
   try {
-    setState(598);
+    setState(640);
     _errHandler->sync(this);
     switch (getInterpreter<atn::ParserATNSimulator>()->adaptivePredict(
-        _input, 55, _ctx)) {
+        _input, 59, _ctx)) {
       case 1: {
         enterOuterAlt(_localctx, 1);
-        setState(569);
+        setState(611);
         variableDeclarationWithInitialization();
-        setState(570);
-        match(TorqueParser::T__12);
+        setState(612);
+        match(TorqueParser::T__14);
         break;
       }
 
       case 2: {
         enterOuterAlt(_localctx, 2);
-        setState(572);
+        setState(614);
         helperCallStatement();
-        setState(573);
-        match(TorqueParser::T__12);
+        setState(615);
+        match(TorqueParser::T__14);
         break;
       }
 
       case 3: {
         enterOuterAlt(_localctx, 3);
-        setState(575);
+        setState(617);
         expressionStatement();
-        setState(576);
-        match(TorqueParser::T__12);
+        setState(618);
+        match(TorqueParser::T__14);
         break;
       }
 
       case 4: {
         enterOuterAlt(_localctx, 4);
-        setState(578);
+        setState(620);
         returnStatement();
-        setState(579);
-        match(TorqueParser::T__12);
+        setState(621);
+        match(TorqueParser::T__14);
         break;
       }
 
       case 5: {
         enterOuterAlt(_localctx, 5);
-        setState(581);
+        setState(623);
         breakStatement();
-        setState(582);
-        match(TorqueParser::T__12);
+        setState(624);
+        match(TorqueParser::T__14);
         break;
       }
 
       case 6: {
         enterOuterAlt(_localctx, 6);
-        setState(584);
+        setState(626);
         continueStatement();
-        setState(585);
-        match(TorqueParser::T__12);
+        setState(627);
+        match(TorqueParser::T__14);
         break;
       }
 
       case 7: {
         enterOuterAlt(_localctx, 7);
-        setState(587);
+        setState(629);
         gotoStatement();
-        setState(588);
-        match(TorqueParser::T__12);
+        setState(630);
+        match(TorqueParser::T__14);
         break;
       }
 
       case 8: {
         enterOuterAlt(_localctx, 8);
-        setState(590);
+        setState(632);
         ifStatement();
         break;
       }
 
       case 9: {
         enterOuterAlt(_localctx, 9);
-        setState(591);
+        setState(633);
         diagnosticStatement();
-        setState(592);
-        match(TorqueParser::T__12);
+        setState(634);
+        match(TorqueParser::T__14);
         break;
       }
 
       case 10: {
         enterOuterAlt(_localctx, 10);
-        setState(594);
+        setState(636);
         whileLoop();
         break;
       }
 
       case 11: {
         enterOuterAlt(_localctx, 11);
-        setState(595);
+        setState(637);
         forOfLoop();
         break;
       }
 
       case 12: {
         enterOuterAlt(_localctx, 12);
-        setState(596);
+        setState(638);
         forLoop();
         break;
       }
 
       case 13: {
         enterOuterAlt(_localctx, 13);
-        setState(597);
+        setState(639);
         tryLabelStatement();
         break;
       }
@@ -4865,39 +5107,39 @@ antlrcpp::Any TorqueParser::StatementListContext::accept(
 TorqueParser::StatementListContext* TorqueParser::statementList() {
   StatementListContext* _localctx =
       _tracker.createInstance<StatementListContext>(_ctx, getState());
-  enterRule(_localctx, 102, TorqueParser::RuleStatementList);
+  enterRule(_localctx, 106, TorqueParser::RuleStatementList);
   size_t _la = 0;
 
   auto onExit = finally([=] { exitRule(); });
   try {
     enterOuterAlt(_localctx, 1);
-    setState(603);
+    setState(645);
     _errHandler->sync(this);
     _la = _input->LA(1);
-    while (((((_la - 28) & ~0x3fULL) == 0) &&
-            ((1ULL << (_la - 28)) &
-             ((1ULL << (TorqueParser::IF - 28)) |
-              (1ULL << (TorqueParser::FOR - 28)) |
-              (1ULL << (TorqueParser::WHILE - 28)) |
-              (1ULL << (TorqueParser::RETURN - 28)) |
-              (1ULL << (TorqueParser::CONTINUE - 28)) |
-              (1ULL << (TorqueParser::BREAK - 28)) |
-              (1ULL << (TorqueParser::GOTO - 28)) |
-              (1ULL << (TorqueParser::TRY - 28)) |
-              (1ULL << (TorqueParser::TAIL - 28)) |
-              (1ULL << (TorqueParser::LET - 28)) |
-              (1ULL << (TorqueParser::ASSERT_TOKEN - 28)) |
-              (1ULL << (TorqueParser::CHECK_TOKEN - 28)) |
-              (1ULL << (TorqueParser::UNREACHABLE_TOKEN - 28)) |
-              (1ULL << (TorqueParser::DEBUG_TOKEN - 28)) |
-              (1ULL << (TorqueParser::MAX - 28)) |
-              (1ULL << (TorqueParser::MIN - 28)) |
-              (1ULL << (TorqueParser::INCREMENT - 28)) |
-              (1ULL << (TorqueParser::DECREMENT - 28)) |
-              (1ULL << (TorqueParser::IDENTIFIER - 28)))) != 0)) {
-      setState(600);
+    while (
+        (((_la & ~0x3fULL) == 0) &&
+         ((1ULL << _la) &
+          ((1ULL << TorqueParser::T__0) | (1ULL << TorqueParser::IF) |
+           (1ULL << TorqueParser::FOR) | (1ULL << TorqueParser::WHILE) |
+           (1ULL << TorqueParser::RETURN) | (1ULL << TorqueParser::CONTINUE) |
+           (1ULL << TorqueParser::BREAK) | (1ULL << TorqueParser::GOTO) |
+           (1ULL << TorqueParser::TRY) | (1ULL << TorqueParser::TAIL) |
+           (1ULL << TorqueParser::LET) | (1ULL << TorqueParser::CONST) |
+           (1ULL << TorqueParser::ASSERT_TOKEN) |
+           (1ULL << TorqueParser::CHECK_TOKEN) |
+           (1ULL << TorqueParser::UNREACHABLE_TOKEN) |
+           (1ULL << TorqueParser::DEBUG_TOKEN) | (1ULL << TorqueParser::MAX) |
+           (1ULL << TorqueParser::MIN))) != 0) ||
+        ((((_la - 73) & ~0x3fULL) == 0) &&
+         ((1ULL << (_la - 73)) &
+          ((1ULL << (TorqueParser::INCREMENT - 73)) |
+           (1ULL << (TorqueParser::DECREMENT - 73)) |
+           (1ULL << (TorqueParser::STRING_LITERAL - 73)) |
+           (1ULL << (TorqueParser::IDENTIFIER - 73)) |
+           (1ULL << (TorqueParser::DECIMAL_LITERAL - 73)))) != 0)) {
+      setState(642);
       statement();
-      setState(605);
+      setState(647);
       _errHandler->sync(this);
       _la = _input->LA(1);
     }
@@ -4954,26 +5196,26 @@ antlrcpp::Any TorqueParser::StatementScopeContext::accept(
 TorqueParser::StatementScopeContext* TorqueParser::statementScope() {
   StatementScopeContext* _localctx =
       _tracker.createInstance<StatementScopeContext>(_ctx, getState());
-  enterRule(_localctx, 104, TorqueParser::RuleStatementScope);
+  enterRule(_localctx, 108, TorqueParser::RuleStatementScope);
   size_t _la = 0;
 
   auto onExit = finally([=] { exitRule(); });
   try {
     enterOuterAlt(_localctx, 1);
-    setState(607);
+    setState(649);
     _errHandler->sync(this);
 
     _la = _input->LA(1);
     if (_la == TorqueParser::DEFERRED) {
-      setState(606);
+      setState(648);
       match(TorqueParser::DEFERRED);
     }
-    setState(609);
-    match(TorqueParser::T__15);
-    setState(610);
+    setState(651);
+    match(TorqueParser::T__12);
+    setState(652);
     statementList();
-    setState(611);
-    match(TorqueParser::T__16);
+    setState(653);
+    match(TorqueParser::T__13);
 
   } catch (RecognitionException& e) {
     _errHandler->reportError(this, e);
@@ -5028,13 +5270,14 @@ antlrcpp::Any TorqueParser::StatementBlockContext::accept(
 TorqueParser::StatementBlockContext* TorqueParser::statementBlock() {
   StatementBlockContext* _localctx =
       _tracker.createInstance<StatementBlockContext>(_ctx, getState());
-  enterRule(_localctx, 106, TorqueParser::RuleStatementBlock);
+  enterRule(_localctx, 110, TorqueParser::RuleStatementBlock);
 
   auto onExit = finally([=] { exitRule(); });
   try {
-    setState(615);
+    setState(657);
     _errHandler->sync(this);
     switch (_input->LA(1)) {
+      case TorqueParser::T__0:
       case TorqueParser::IF:
       case TorqueParser::FOR:
       case TorqueParser::WHILE:
@@ -5045,6 +5288,7 @@ TorqueParser::StatementBlockContext* TorqueParser::statementBlock() {
       case TorqueParser::TRY:
       case TorqueParser::TAIL:
       case TorqueParser::LET:
+      case TorqueParser::CONST:
       case TorqueParser::ASSERT_TOKEN:
       case TorqueParser::CHECK_TOKEN:
       case TorqueParser::UNREACHABLE_TOKEN:
@@ -5053,24 +5297,147 @@ TorqueParser::StatementBlockContext* TorqueParser::statementBlock() {
       case TorqueParser::MIN:
       case TorqueParser::INCREMENT:
       case TorqueParser::DECREMENT:
-      case TorqueParser::IDENTIFIER: {
+      case TorqueParser::STRING_LITERAL:
+      case TorqueParser::IDENTIFIER:
+      case TorqueParser::DECIMAL_LITERAL: {
         enterOuterAlt(_localctx, 1);
-        setState(613);
+        setState(655);
         statement();
         break;
       }
 
-      case TorqueParser::T__15:
+      case TorqueParser::T__12:
       case TorqueParser::DEFERRED: {
         enterOuterAlt(_localctx, 2);
-        setState(614);
+        setState(656);
         statementScope();
         break;
       }
 
-      default:
-        throw NoViableAltException(this);
-    }
+      default:
+        throw NoViableAltException(this);
+    }
+
+  } catch (RecognitionException& e) {
+    _errHandler->reportError(this, e);
+    _localctx->exception = std::current_exception();
+    _errHandler->recover(this, _localctx->exception);
+  }
+
+  return _localctx;
+}
+
+//----------------- HelperBodyContext
+//------------------------------------------------------------------
+
+TorqueParser::HelperBodyContext::HelperBodyContext(ParserRuleContext* parent,
+                                                   size_t invokingState)
+    : ParserRuleContext(parent, invokingState) {}
+
+TorqueParser::StatementScopeContext*
+TorqueParser::HelperBodyContext::statementScope() {
+  return getRuleContext<TorqueParser::StatementScopeContext>(0);
+}
+
+size_t TorqueParser::HelperBodyContext::getRuleIndex() const {
+  return TorqueParser::RuleHelperBody;
+}
+
+void TorqueParser::HelperBodyContext::enterRule(
+    tree::ParseTreeListener* listener) {
+  auto parserListener = dynamic_cast<TorqueListener*>(listener);
+  if (parserListener != nullptr) parserListener->enterHelperBody(this);
+}
+
+void TorqueParser::HelperBodyContext::exitRule(
+    tree::ParseTreeListener* listener) {
+  auto parserListener = dynamic_cast<TorqueListener*>(listener);
+  if (parserListener != nullptr) parserListener->exitHelperBody(this);
+}
+
+antlrcpp::Any TorqueParser::HelperBodyContext::accept(
+    tree::ParseTreeVisitor* visitor) {
+  if (auto parserVisitor = dynamic_cast<TorqueVisitor*>(visitor))
+    return parserVisitor->visitHelperBody(this);
+  else
+    return visitor->visitChildren(this);
+}
+
+TorqueParser::HelperBodyContext* TorqueParser::helperBody() {
+  HelperBodyContext* _localctx =
+      _tracker.createInstance<HelperBodyContext>(_ctx, getState());
+  enterRule(_localctx, 112, TorqueParser::RuleHelperBody);
+
+  auto onExit = finally([=] { exitRule(); });
+  try {
+    enterOuterAlt(_localctx, 1);
+    setState(659);
+    statementScope();
+
+  } catch (RecognitionException& e) {
+    _errHandler->reportError(this, e);
+    _localctx->exception = std::current_exception();
+    _errHandler->recover(this, _localctx->exception);
+  }
+
+  return _localctx;
+}
+
+//----------------- FieldDeclarationContext
+//------------------------------------------------------------------
+
+TorqueParser::FieldDeclarationContext::FieldDeclarationContext(
+    ParserRuleContext* parent, size_t invokingState)
+    : ParserRuleContext(parent, invokingState) {}
+
+tree::TerminalNode* TorqueParser::FieldDeclarationContext::IDENTIFIER() {
+  return getToken(TorqueParser::IDENTIFIER, 0);
+}
+
+TorqueParser::TypeContext* TorqueParser::FieldDeclarationContext::type() {
+  return getRuleContext<TorqueParser::TypeContext>(0);
+}
+
+size_t TorqueParser::FieldDeclarationContext::getRuleIndex() const {
+  return TorqueParser::RuleFieldDeclaration;
+}
+
+void TorqueParser::FieldDeclarationContext::enterRule(
+    tree::ParseTreeListener* listener) {
+  auto parserListener = dynamic_cast<TorqueListener*>(listener);
+  if (parserListener != nullptr) parserListener->enterFieldDeclaration(this);
+}
+
+void TorqueParser::FieldDeclarationContext::exitRule(
+    tree::ParseTreeListener* listener) {
+  auto parserListener = dynamic_cast<TorqueListener*>(listener);
+  if (parserListener != nullptr) parserListener->exitFieldDeclaration(this);
+}
+
+antlrcpp::Any TorqueParser::FieldDeclarationContext::accept(
+    tree::ParseTreeVisitor* visitor) {
+  if (auto parserVisitor = dynamic_cast<TorqueVisitor*>(visitor))
+    return parserVisitor->visitFieldDeclaration(this);
+  else
+    return visitor->visitChildren(this);
+}
+
+TorqueParser::FieldDeclarationContext* TorqueParser::fieldDeclaration() {
+  FieldDeclarationContext* _localctx =
+      _tracker.createInstance<FieldDeclarationContext>(_ctx, getState());
+  enterRule(_localctx, 114, TorqueParser::RuleFieldDeclaration);
+
+  auto onExit = finally([=] { exitRule(); });
+  try {
+    enterOuterAlt(_localctx, 1);
+    setState(661);
+    match(TorqueParser::IDENTIFIER);
+    setState(662);
+    match(TorqueParser::T__4);
+    setState(663);
+    type(0);
+    setState(664);
+    match(TorqueParser::T__14);
 
   } catch (RecognitionException& e) {
     _errHandler->reportError(this, e);
@@ -5081,52 +5448,68 @@ TorqueParser::StatementBlockContext* TorqueParser::statementBlock() {
   return _localctx;
 }
 
-//----------------- HelperBodyContext
+//----------------- FieldListDeclarationContext
 //------------------------------------------------------------------
 
-TorqueParser::HelperBodyContext::HelperBodyContext(ParserRuleContext* parent,
-                                                   size_t invokingState)
+TorqueParser::FieldListDeclarationContext::FieldListDeclarationContext(
+    ParserRuleContext* parent, size_t invokingState)
     : ParserRuleContext(parent, invokingState) {}
 
-TorqueParser::StatementScopeContext*
-TorqueParser::HelperBodyContext::statementScope() {
-  return getRuleContext<TorqueParser::StatementScopeContext>(0);
+std::vector<TorqueParser::FieldDeclarationContext*>
+TorqueParser::FieldListDeclarationContext::fieldDeclaration() {
+  return getRuleContexts<TorqueParser::FieldDeclarationContext>();
 }
 
-size_t TorqueParser::HelperBodyContext::getRuleIndex() const {
-  return TorqueParser::RuleHelperBody;
+TorqueParser::FieldDeclarationContext*
+TorqueParser::FieldListDeclarationContext::fieldDeclaration(size_t i) {
+  return getRuleContext<TorqueParser::FieldDeclarationContext>(i);
 }
 
-void TorqueParser::HelperBodyContext::enterRule(
+size_t TorqueParser::FieldListDeclarationContext::getRuleIndex() const {
+  return TorqueParser::RuleFieldListDeclaration;
+}
+
+void TorqueParser::FieldListDeclarationContext::enterRule(
     tree::ParseTreeListener* listener) {
   auto parserListener = dynamic_cast<TorqueListener*>(listener);
-  if (parserListener != nullptr) parserListener->enterHelperBody(this);
+  if (parserListener != nullptr)
+    parserListener->enterFieldListDeclaration(this);
 }
 
-void TorqueParser::HelperBodyContext::exitRule(
+void TorqueParser::FieldListDeclarationContext::exitRule(
     tree::ParseTreeListener* listener) {
   auto parserListener = dynamic_cast<TorqueListener*>(listener);
-  if (parserListener != nullptr) parserListener->exitHelperBody(this);
+  if (parserListener != nullptr) parserListener->exitFieldListDeclaration(this);
 }
 
-antlrcpp::Any TorqueParser::HelperBodyContext::accept(
+antlrcpp::Any TorqueParser::FieldListDeclarationContext::accept(
     tree::ParseTreeVisitor* visitor) {
   if (auto parserVisitor = dynamic_cast<TorqueVisitor*>(visitor))
-    return parserVisitor->visitHelperBody(this);
+    return parserVisitor->visitFieldListDeclaration(this);
   else
     return visitor->visitChildren(this);
 }
 
-TorqueParser::HelperBodyContext* TorqueParser::helperBody() {
-  HelperBodyContext* _localctx =
-      _tracker.createInstance<HelperBodyContext>(_ctx, getState());
-  enterRule(_localctx, 108, TorqueParser::RuleHelperBody);
+TorqueParser::FieldListDeclarationContext*
+TorqueParser::fieldListDeclaration() {
+  FieldListDeclarationContext* _localctx =
+      _tracker.createInstance<FieldListDeclarationContext>(_ctx, getState());
+  enterRule(_localctx, 116, TorqueParser::RuleFieldListDeclaration);
+  size_t _la = 0;
 
   auto onExit = finally([=] { exitRule(); });
   try {
     enterOuterAlt(_localctx, 1);
-    setState(617);
-    statementScope();
+    setState(669);
+    _errHandler->sync(this);
+    _la = _input->LA(1);
+    while (_la == TorqueParser::IDENTIFIER) {
+      setState(666);
+      fieldDeclaration();
+      setState(671);
+      _errHandler->sync(this);
+      _la = _input->LA(1);
+    }
 
   } catch (RecognitionException& e) {
     _errHandler->reportError(this, e);
@@ -5175,14 +5558,14 @@ antlrcpp::Any TorqueParser::ExtendsDeclarationContext::accept(
 TorqueParser::ExtendsDeclarationContext* TorqueParser::extendsDeclaration() {
   ExtendsDeclarationContext* _localctx =
       _tracker.createInstance<ExtendsDeclarationContext>(_ctx, getState());
-  enterRule(_localctx, 110, TorqueParser::RuleExtendsDeclaration);
+  enterRule(_localctx, 118, TorqueParser::RuleExtendsDeclaration);
 
   auto onExit = finally([=] { exitRule(); });
   try {
     enterOuterAlt(_localctx, 1);
-    setState(619);
+    setState(672);
     match(TorqueParser::T__17);
-    setState(620);
+    setState(673);
     match(TorqueParser::IDENTIFIER);
 
   } catch (RecognitionException& e) {
@@ -5235,14 +5618,14 @@ TorqueParser::GeneratesDeclarationContext*
 TorqueParser::generatesDeclaration() {
   GeneratesDeclarationContext* _localctx =
       _tracker.createInstance<GeneratesDeclarationContext>(_ctx, getState());
-  enterRule(_localctx, 112, TorqueParser::RuleGeneratesDeclaration);
+  enterRule(_localctx, 120, TorqueParser::RuleGeneratesDeclaration);
 
   auto onExit = finally([=] { exitRule(); });
   try {
     enterOuterAlt(_localctx, 1);
-    setState(622);
+    setState(675);
     match(TorqueParser::T__18);
-    setState(623);
+    setState(676);
     match(TorqueParser::STRING_LITERAL);
 
   } catch (RecognitionException& e) {
@@ -5295,14 +5678,14 @@ TorqueParser::ConstexprDeclarationContext*
 TorqueParser::constexprDeclaration() {
   ConstexprDeclarationContext* _localctx =
       _tracker.createInstance<ConstexprDeclarationContext>(_ctx, getState());
-  enterRule(_localctx, 114, TorqueParser::RuleConstexprDeclaration);
+  enterRule(_localctx, 122, TorqueParser::RuleConstexprDeclaration);
 
   auto onExit = finally([=] { exitRule(); });
   try {
     enterOuterAlt(_localctx, 1);
-    setState(625);
+    setState(678);
     match(TorqueParser::CONSTEXPR);
-    setState(626);
+    setState(679);
     match(TorqueParser::STRING_LITERAL);
 
   } catch (RecognitionException& e) {
@@ -5367,42 +5750,42 @@ antlrcpp::Any TorqueParser::TypeDeclarationContext::accept(
 TorqueParser::TypeDeclarationContext* TorqueParser::typeDeclaration() {
   TypeDeclarationContext* _localctx =
       _tracker.createInstance<TypeDeclarationContext>(_ctx, getState());
-  enterRule(_localctx, 116, TorqueParser::RuleTypeDeclaration);
+  enterRule(_localctx, 124, TorqueParser::RuleTypeDeclaration);
   size_t _la = 0;
 
   auto onExit = finally([=] { exitRule(); });
   try {
     enterOuterAlt(_localctx, 1);
-    setState(628);
+    setState(681);
     match(TorqueParser::T__5);
-    setState(629);
+    setState(682);
     match(TorqueParser::IDENTIFIER);
-    setState(631);
+    setState(684);
     _errHandler->sync(this);
 
     _la = _input->LA(1);
     if (_la == TorqueParser::T__17) {
-      setState(630);
+      setState(683);
       extendsDeclaration();
     }
-    setState(634);
+    setState(687);
     _errHandler->sync(this);
 
     _la = _input->LA(1);
     if (_la == TorqueParser::T__18) {
-      setState(633);
+      setState(686);
       generatesDeclaration();
     }
-    setState(637);
+    setState(690);
     _errHandler->sync(this);
 
     _la = _input->LA(1);
     if (_la == TorqueParser::CONSTEXPR) {
-      setState(636);
+      setState(689);
       constexprDeclaration();
     }
-    setState(639);
-    match(TorqueParser::T__12);
+    setState(692);
+    match(TorqueParser::T__14);
 
   } catch (RecognitionException& e) {
     _errHandler->reportError(this, e);
@@ -5457,21 +5840,21 @@ TorqueParser::TypeAliasDeclarationContext*
 TorqueParser::typeAliasDeclaration() {
   TypeAliasDeclarationContext* _localctx =
       _tracker.createInstance<TypeAliasDeclarationContext>(_ctx, getState());
-  enterRule(_localctx, 118, TorqueParser::RuleTypeAliasDeclaration);
+  enterRule(_localctx, 126, TorqueParser::RuleTypeAliasDeclaration);
 
   auto onExit = finally([=] { exitRule(); });
   try {
     enterOuterAlt(_localctx, 1);
-    setState(641);
+    setState(694);
     match(TorqueParser::T__5);
-    setState(642);
+    setState(695);
     match(TorqueParser::IDENTIFIER);
-    setState(643);
+    setState(696);
     match(TorqueParser::ASSIGNMENT);
-    setState(644);
+    setState(697);
     type(0);
-    setState(645);
-    match(TorqueParser::T__12);
+    setState(698);
+    match(TorqueParser::T__14);
 
   } catch (RecognitionException& e) {
     _errHandler->reportError(this, e);
@@ -5547,38 +5930,38 @@ antlrcpp::Any TorqueParser::ExternalBuiltinContext::accept(
 TorqueParser::ExternalBuiltinContext* TorqueParser::externalBuiltin() {
   ExternalBuiltinContext* _localctx =
       _tracker.createInstance<ExternalBuiltinContext>(_ctx, getState());
-  enterRule(_localctx, 120, TorqueParser::RuleExternalBuiltin);
+  enterRule(_localctx, 128, TorqueParser::RuleExternalBuiltin);
   size_t _la = 0;
 
   auto onExit = finally([=] { exitRule(); });
   try {
     enterOuterAlt(_localctx, 1);
-    setState(647);
+    setState(700);
     match(TorqueParser::EXTERN);
-    setState(649);
+    setState(702);
     _errHandler->sync(this);
 
     _la = _input->LA(1);
     if (_la == TorqueParser::JAVASCRIPT) {
-      setState(648);
+      setState(701);
       match(TorqueParser::JAVASCRIPT);
     }
-    setState(651);
+    setState(704);
     match(TorqueParser::BUILTIN);
-    setState(652);
+    setState(705);
     match(TorqueParser::IDENTIFIER);
-    setState(653);
+    setState(706);
     optionalGenericTypeList();
-    setState(654);
+    setState(707);
     match(TorqueParser::T__0);
-    setState(655);
+    setState(708);
     typeList();
-    setState(656);
+    setState(709);
     match(TorqueParser::T__1);
-    setState(657);
+    setState(710);
     optionalType();
-    setState(658);
-    match(TorqueParser::T__12);
+    setState(711);
+    match(TorqueParser::T__14);
 
   } catch (RecognitionException& e) {
     _errHandler->reportError(this, e);
@@ -5660,38 +6043,38 @@ antlrcpp::Any TorqueParser::ExternalMacroContext::accept(
 TorqueParser::ExternalMacroContext* TorqueParser::externalMacro() {
   ExternalMacroContext* _localctx =
       _tracker.createInstance<ExternalMacroContext>(_ctx, getState());
-  enterRule(_localctx, 122, TorqueParser::RuleExternalMacro);
+  enterRule(_localctx, 130, TorqueParser::RuleExternalMacro);
   size_t _la = 0;
 
   auto onExit = finally([=] { exitRule(); });
   try {
     enterOuterAlt(_localctx, 1);
-    setState(660);
+    setState(713);
     match(TorqueParser::EXTERN);
-    setState(663);
+    setState(716);
     _errHandler->sync(this);
 
     _la = _input->LA(1);
     if (_la == TorqueParser::T__19) {
-      setState(661);
+      setState(714);
       match(TorqueParser::T__19);
-      setState(662);
+      setState(715);
       match(TorqueParser::STRING_LITERAL);
     }
-    setState(665);
+    setState(718);
     match(TorqueParser::MACRO);
-    setState(666);
+    setState(719);
     match(TorqueParser::IDENTIFIER);
-    setState(667);
+    setState(720);
     optionalGenericTypeList();
-    setState(668);
+    setState(721);
     typeListMaybeVarArgs();
-    setState(669);
+    setState(722);
     optionalType();
-    setState(670);
+    setState(723);
     optionalLabelList();
-    setState(671);
-    match(TorqueParser::T__12);
+    setState(724);
+    match(TorqueParser::T__14);
 
   } catch (RecognitionException& e) {
     _errHandler->reportError(this, e);
@@ -5758,23 +6141,23 @@ antlrcpp::Any TorqueParser::ExternalRuntimeContext::accept(
 TorqueParser::ExternalRuntimeContext* TorqueParser::externalRuntime() {
   ExternalRuntimeContext* _localctx =
       _tracker.createInstance<ExternalRuntimeContext>(_ctx, getState());
-  enterRule(_localctx, 124, TorqueParser::RuleExternalRuntime);
+  enterRule(_localctx, 132, TorqueParser::RuleExternalRuntime);
 
   auto onExit = finally([=] { exitRule(); });
   try {
     enterOuterAlt(_localctx, 1);
-    setState(673);
+    setState(726);
     match(TorqueParser::EXTERN);
-    setState(674);
+    setState(727);
     match(TorqueParser::RUNTIME);
-    setState(675);
+    setState(728);
     match(TorqueParser::IDENTIFIER);
-    setState(676);
+    setState(729);
     typeListMaybeVarArgs();
-    setState(677);
+    setState(730);
     optionalType();
-    setState(678);
-    match(TorqueParser::T__12);
+    setState(731);
+    match(TorqueParser::T__14);
 
   } catch (RecognitionException& e) {
     _errHandler->reportError(this, e);
@@ -5851,43 +6234,43 @@ antlrcpp::Any TorqueParser::BuiltinDeclarationContext::accept(
 TorqueParser::BuiltinDeclarationContext* TorqueParser::builtinDeclaration() {
   BuiltinDeclarationContext* _localctx =
       _tracker.createInstance<BuiltinDeclarationContext>(_ctx, getState());
-  enterRule(_localctx, 126, TorqueParser::RuleBuiltinDeclaration);
+  enterRule(_localctx, 134, TorqueParser::RuleBuiltinDeclaration);
   size_t _la = 0;
 
   auto onExit = finally([=] { exitRule(); });
   try {
     enterOuterAlt(_localctx, 1);
-    setState(681);
+    setState(734);
     _errHandler->sync(this);
 
     _la = _input->LA(1);
     if (_la == TorqueParser::JAVASCRIPT) {
-      setState(680);
+      setState(733);
       match(TorqueParser::JAVASCRIPT);
     }
-    setState(683);
+    setState(736);
     match(TorqueParser::BUILTIN);
-    setState(684);
+    setState(737);
     match(TorqueParser::IDENTIFIER);
-    setState(685);
+    setState(738);
     optionalGenericTypeList();
-    setState(686);
+    setState(739);
     parameterList();
-    setState(687);
+    setState(740);
     optionalType();
-    setState(690);
+    setState(743);
     _errHandler->sync(this);
     switch (_input->LA(1)) {
-      case TorqueParser::T__15:
+      case TorqueParser::T__12:
       case TorqueParser::DEFERRED: {
-        setState(688);
+        setState(741);
         helperBody();
         break;
       }
 
-      case TorqueParser::T__12: {
-        setState(689);
-        match(TorqueParser::T__12);
+      case TorqueParser::T__14: {
+        setState(742);
+        match(TorqueParser::T__14);
         break;
       }
 
@@ -5970,22 +6353,22 @@ TorqueParser::GenericSpecializationContext*
 TorqueParser::genericSpecialization() {
   GenericSpecializationContext* _localctx =
       _tracker.createInstance<GenericSpecializationContext>(_ctx, getState());
-  enterRule(_localctx, 128, TorqueParser::RuleGenericSpecialization);
+  enterRule(_localctx, 136, TorqueParser::RuleGenericSpecialization);
 
   auto onExit = finally([=] { exitRule(); });
   try {
     enterOuterAlt(_localctx, 1);
-    setState(692);
+    setState(745);
     match(TorqueParser::IDENTIFIER);
-    setState(693);
+    setState(746);
     genericSpecializationTypeList();
-    setState(694);
+    setState(747);
     parameterList();
-    setState(695);
+    setState(748);
     optionalType();
-    setState(696);
+    setState(749);
     optionalLabelList();
-    setState(697);
+    setState(750);
     helperBody();
 
   } catch (RecognitionException& e) {
@@ -6068,47 +6451,47 @@ antlrcpp::Any TorqueParser::MacroDeclarationContext::accept(
 TorqueParser::MacroDeclarationContext* TorqueParser::macroDeclaration() {
   MacroDeclarationContext* _localctx =
       _tracker.createInstance<MacroDeclarationContext>(_ctx, getState());
-  enterRule(_localctx, 130, TorqueParser::RuleMacroDeclaration);
+  enterRule(_localctx, 138, TorqueParser::RuleMacroDeclaration);
   size_t _la = 0;
 
   auto onExit = finally([=] { exitRule(); });
   try {
     enterOuterAlt(_localctx, 1);
-    setState(701);
+    setState(754);
     _errHandler->sync(this);
 
     _la = _input->LA(1);
     if (_la == TorqueParser::T__19) {
-      setState(699);
+      setState(752);
       match(TorqueParser::T__19);
-      setState(700);
+      setState(753);
       match(TorqueParser::STRING_LITERAL);
     }
-    setState(703);
+    setState(756);
     match(TorqueParser::MACRO);
-    setState(704);
+    setState(757);
     match(TorqueParser::IDENTIFIER);
-    setState(705);
+    setState(758);
     optionalGenericTypeList();
-    setState(706);
+    setState(759);
     parameterList();
-    setState(707);
+    setState(760);
     optionalType();
-    setState(708);
+    setState(761);
     optionalLabelList();
-    setState(711);
+    setState(764);
     _errHandler->sync(this);
     switch (_input->LA(1)) {
-      case TorqueParser::T__15:
+      case TorqueParser::T__12:
       case TorqueParser::DEFERRED: {
-        setState(709);
+        setState(762);
         helperBody();
         break;
       }
 
-      case TorqueParser::T__12: {
-        setState(710);
-        match(TorqueParser::T__12);
+      case TorqueParser::T__14: {
+        setState(763);
+        match(TorqueParser::T__14);
         break;
       }
 
@@ -6132,6 +6515,10 @@ TorqueParser::ExternConstDeclarationContext::ExternConstDeclarationContext(
     ParserRuleContext* parent, size_t invokingState)
     : ParserRuleContext(parent, invokingState) {}
 
+tree::TerminalNode* TorqueParser::ExternConstDeclarationContext::CONST() {
+  return getToken(TorqueParser::CONST, 0);
+}
+
 tree::TerminalNode* TorqueParser::ExternConstDeclarationContext::IDENTIFIER() {
   return getToken(TorqueParser::IDENTIFIER, 0);
 }
@@ -6175,23 +6562,175 @@ TorqueParser::ExternConstDeclarationContext*
 TorqueParser::externConstDeclaration() {
   ExternConstDeclarationContext* _localctx =
       _tracker.createInstance<ExternConstDeclarationContext>(_ctx, getState());
-  enterRule(_localctx, 132, TorqueParser::RuleExternConstDeclaration);
+  enterRule(_localctx, 140, TorqueParser::RuleExternConstDeclaration);
 
   auto onExit = finally([=] { exitRule(); });
   try {
     enterOuterAlt(_localctx, 1);
-    setState(713);
-    match(TorqueParser::T__20);
-    setState(714);
+    setState(766);
+    match(TorqueParser::CONST);
+    setState(767);
     match(TorqueParser::IDENTIFIER);
-    setState(715);
+    setState(768);
     match(TorqueParser::T__4);
-    setState(716);
+    setState(769);
     type(0);
-    setState(717);
+    setState(770);
     generatesDeclaration();
-    setState(718);
+    setState(771);
+    match(TorqueParser::T__14);
+
+  } catch (RecognitionException& e) {
+    _errHandler->reportError(this, e);
+    _localctx->exception = std::current_exception();
+    _errHandler->recover(this, _localctx->exception);
+  }
+
+  return _localctx;
+}
+
+//----------------- ConstDeclarationContext
+//------------------------------------------------------------------
+
+TorqueParser::ConstDeclarationContext::ConstDeclarationContext(
+    ParserRuleContext* parent, size_t invokingState)
+    : ParserRuleContext(parent, invokingState) {}
+
+tree::TerminalNode* TorqueParser::ConstDeclarationContext::CONST() {
+  return getToken(TorqueParser::CONST, 0);
+}
+
+tree::TerminalNode* TorqueParser::ConstDeclarationContext::IDENTIFIER() {
+  return getToken(TorqueParser::IDENTIFIER, 0);
+}
+
+TorqueParser::TypeContext* TorqueParser::ConstDeclarationContext::type() {
+  return getRuleContext<TorqueParser::TypeContext>(0);
+}
+
+tree::TerminalNode* TorqueParser::ConstDeclarationContext::ASSIGNMENT() {
+  return getToken(TorqueParser::ASSIGNMENT, 0);
+}
+
+TorqueParser::ExpressionContext*
+TorqueParser::ConstDeclarationContext::expression() {
+  return getRuleContext<TorqueParser::ExpressionContext>(0);
+}
+
+size_t TorqueParser::ConstDeclarationContext::getRuleIndex() const {
+  return TorqueParser::RuleConstDeclaration;
+}
+
+void TorqueParser::ConstDeclarationContext::enterRule(
+    tree::ParseTreeListener* listener) {
+  auto parserListener = dynamic_cast<TorqueListener*>(listener);
+  if (parserListener != nullptr) parserListener->enterConstDeclaration(this);
+}
+
+void TorqueParser::ConstDeclarationContext::exitRule(
+    tree::ParseTreeListener* listener) {
+  auto parserListener = dynamic_cast<TorqueListener*>(listener);
+  if (parserListener != nullptr) parserListener->exitConstDeclaration(this);
+}
+
+antlrcpp::Any TorqueParser::ConstDeclarationContext::accept(
+    tree::ParseTreeVisitor* visitor) {
+  if (auto parserVisitor = dynamic_cast<TorqueVisitor*>(visitor))
+    return parserVisitor->visitConstDeclaration(this);
+  else
+    return visitor->visitChildren(this);
+}
+
+TorqueParser::ConstDeclarationContext* TorqueParser::constDeclaration() {
+  ConstDeclarationContext* _localctx =
+      _tracker.createInstance<ConstDeclarationContext>(_ctx, getState());
+  enterRule(_localctx, 142, TorqueParser::RuleConstDeclaration);
+
+  auto onExit = finally([=] { exitRule(); });
+  try {
+    enterOuterAlt(_localctx, 1);
+    setState(773);
+    match(TorqueParser::CONST);
+    setState(774);
+    match(TorqueParser::IDENTIFIER);
+    setState(775);
+    match(TorqueParser::T__4);
+    setState(776);
+    type(0);
+    setState(777);
+    match(TorqueParser::ASSIGNMENT);
+    setState(778);
+    expression();
+    setState(779);
+    match(TorqueParser::T__14);
+
+  } catch (RecognitionException& e) {
+    _errHandler->reportError(this, e);
+    _localctx->exception = std::current_exception();
+    _errHandler->recover(this, _localctx->exception);
+  }
+
+  return _localctx;
+}
+
+//----------------- StructDeclarationContext
+//------------------------------------------------------------------
+
+TorqueParser::StructDeclarationContext::StructDeclarationContext(
+    ParserRuleContext* parent, size_t invokingState)
+    : ParserRuleContext(parent, invokingState) {}
+
+tree::TerminalNode* TorqueParser::StructDeclarationContext::IDENTIFIER() {
+  return getToken(TorqueParser::IDENTIFIER, 0);
+}
+
+TorqueParser::FieldListDeclarationContext*
+TorqueParser::StructDeclarationContext::fieldListDeclaration() {
+  return getRuleContext<TorqueParser::FieldListDeclarationContext>(0);
+}
+
+size_t TorqueParser::StructDeclarationContext::getRuleIndex() const {
+  return TorqueParser::RuleStructDeclaration;
+}
+
+void TorqueParser::StructDeclarationContext::enterRule(
+    tree::ParseTreeListener* listener) {
+  auto parserListener = dynamic_cast<TorqueListener*>(listener);
+  if (parserListener != nullptr) parserListener->enterStructDeclaration(this);
+}
+
+void TorqueParser::StructDeclarationContext::exitRule(
+    tree::ParseTreeListener* listener) {
+  auto parserListener = dynamic_cast<TorqueListener*>(listener);
+  if (parserListener != nullptr) parserListener->exitStructDeclaration(this);
+}
+
+antlrcpp::Any TorqueParser::StructDeclarationContext::accept(
+    tree::ParseTreeVisitor* visitor) {
+  if (auto parserVisitor = dynamic_cast<TorqueVisitor*>(visitor))
+    return parserVisitor->visitStructDeclaration(this);
+  else
+    return visitor->visitChildren(this);
+}
+
+TorqueParser::StructDeclarationContext* TorqueParser::structDeclaration() {
+  StructDeclarationContext* _localctx =
+      _tracker.createInstance<StructDeclarationContext>(_ctx, getState());
+  enterRule(_localctx, 144, TorqueParser::RuleStructDeclaration);
+
+  auto onExit = finally([=] { exitRule(); });
+  try {
+    enterOuterAlt(_localctx, 1);
+    setState(781);
+    match(TorqueParser::T__20);
+    setState(782);
+    match(TorqueParser::IDENTIFIER);
+    setState(783);
     match(TorqueParser::T__12);
+    setState(784);
+    fieldListDeclaration();
+    setState(785);
+    match(TorqueParser::T__13);
 
   } catch (RecognitionException& e) {
     _errHandler->reportError(this, e);
@@ -6209,6 +6748,11 @@ TorqueParser::DeclarationContext::DeclarationContext(ParserRuleContext* parent,
                                                      size_t invokingState)
     : ParserRuleContext(parent, invokingState) {}
 
+TorqueParser::StructDeclarationContext*
+TorqueParser::DeclarationContext::structDeclaration() {
+  return getRuleContext<TorqueParser::StructDeclarationContext>(0);
+}
+
 TorqueParser::TypeDeclarationContext*
 TorqueParser::DeclarationContext::typeDeclaration() {
   return getRuleContext<TorqueParser::TypeDeclarationContext>(0);
@@ -6254,6 +6798,11 @@ TorqueParser::DeclarationContext::externConstDeclaration() {
   return getRuleContext<TorqueParser::ExternConstDeclarationContext>(0);
 }
 
+TorqueParser::ConstDeclarationContext*
+TorqueParser::DeclarationContext::constDeclaration() {
+  return getRuleContext<TorqueParser::ConstDeclarationContext>(0);
+}
+
 size_t TorqueParser::DeclarationContext::getRuleIndex() const {
   return TorqueParser::RuleDeclaration;
 }
@@ -6281,76 +6830,90 @@ antlrcpp::Any TorqueParser::DeclarationContext::accept(
 TorqueParser::DeclarationContext* TorqueParser::declaration() {
   DeclarationContext* _localctx =
       _tracker.createInstance<DeclarationContext>(_ctx, getState());
-  enterRule(_localctx, 134, TorqueParser::RuleDeclaration);
+  enterRule(_localctx, 146, TorqueParser::RuleDeclaration);
 
   auto onExit = finally([=] { exitRule(); });
   try {
-    setState(729);
+    setState(798);
     _errHandler->sync(this);
     switch (getInterpreter<atn::ParserATNSimulator>()->adaptivePredict(
-        _input, 68, _ctx)) {
+        _input, 73, _ctx)) {
       case 1: {
         enterOuterAlt(_localctx, 1);
-        setState(720);
-        typeDeclaration();
+        setState(787);
+        structDeclaration();
         break;
       }
 
       case 2: {
         enterOuterAlt(_localctx, 2);
-        setState(721);
-        typeAliasDeclaration();
+        setState(788);
+        typeDeclaration();
         break;
       }
 
       case 3: {
         enterOuterAlt(_localctx, 3);
-        setState(722);
-        builtinDeclaration();
+        setState(789);
+        typeAliasDeclaration();
         break;
       }
 
       case 4: {
         enterOuterAlt(_localctx, 4);
-        setState(723);
-        genericSpecialization();
+        setState(790);
+        builtinDeclaration();
         break;
       }
 
       case 5: {
         enterOuterAlt(_localctx, 5);
-        setState(724);
-        macroDeclaration();
+        setState(791);
+        genericSpecialization();
         break;
       }
 
       case 6: {
         enterOuterAlt(_localctx, 6);
-        setState(725);
-        externalMacro();
+        setState(792);
+        macroDeclaration();
         break;
       }
 
       case 7: {
         enterOuterAlt(_localctx, 7);
-        setState(726);
-        externalBuiltin();
+        setState(793);
+        externalMacro();
         break;
       }
 
       case 8: {
         enterOuterAlt(_localctx, 8);
-        setState(727);
-        externalRuntime();
+        setState(794);
+        externalBuiltin();
         break;
       }
 
       case 9: {
         enterOuterAlt(_localctx, 9);
-        setState(728);
+        setState(795);
+        externalRuntime();
+        break;
+      }
+
+      case 10: {
+        enterOuterAlt(_localctx, 10);
+        setState(796);
         externConstDeclaration();
         break;
       }
+
+      case 11: {
+        enterOuterAlt(_localctx, 11);
+        setState(797);
+        constDeclaration();
+        break;
+      }
     }
 
   } catch (RecognitionException& e) {
@@ -6414,37 +6977,38 @@ antlrcpp::Any TorqueParser::ModuleDeclarationContext::accept(
 TorqueParser::ModuleDeclarationContext* TorqueParser::moduleDeclaration() {
   ModuleDeclarationContext* _localctx =
       _tracker.createInstance<ModuleDeclarationContext>(_ctx, getState());
-  enterRule(_localctx, 136, TorqueParser::RuleModuleDeclaration);
+  enterRule(_localctx, 148, TorqueParser::RuleModuleDeclaration);
   size_t _la = 0;
 
   auto onExit = finally([=] { exitRule(); });
   try {
     enterOuterAlt(_localctx, 1);
-    setState(731);
+    setState(800);
     match(TorqueParser::MODULE);
-    setState(732);
+    setState(801);
     match(TorqueParser::IDENTIFIER);
-    setState(733);
-    match(TorqueParser::T__15);
-    setState(737);
+    setState(802);
+    match(TorqueParser::T__12);
+    setState(806);
     _errHandler->sync(this);
     _la = _input->LA(1);
-    while ((((_la & ~0x3fULL) == 0) &&
-            ((1ULL << _la) &
-             ((1ULL << TorqueParser::T__5) | (1ULL << TorqueParser::T__19) |
-              (1ULL << TorqueParser::T__20) | (1ULL << TorqueParser::MACRO) |
-              (1ULL << TorqueParser::BUILTIN) |
-              (1ULL << TorqueParser::JAVASCRIPT) |
-              (1ULL << TorqueParser::EXTERN))) != 0) ||
-           _la == TorqueParser::IDENTIFIER) {
-      setState(734);
+    while (
+        (((_la & ~0x3fULL) == 0) &&
+         ((1ULL << _la) &
+          ((1ULL << TorqueParser::T__5) | (1ULL << TorqueParser::T__19) |
+           (1ULL << TorqueParser::T__20) | (1ULL << TorqueParser::MACRO) |
+           (1ULL << TorqueParser::BUILTIN) |
+           (1ULL << TorqueParser::JAVASCRIPT) | (1ULL << TorqueParser::CONST) |
+           (1ULL << TorqueParser::EXTERN))) != 0) ||
+        _la == TorqueParser::IDENTIFIER) {
+      setState(803);
       declaration();
-      setState(739);
+      setState(808);
       _errHandler->sync(this);
       _la = _input->LA(1);
     }
-    setState(740);
-    match(TorqueParser::T__16);
+    setState(809);
+    match(TorqueParser::T__13);
 
   } catch (RecognitionException& e) {
     _errHandler->reportError(this, e);
@@ -6507,28 +7071,29 @@ antlrcpp::Any TorqueParser::FileContext::accept(
 TorqueParser::FileContext* TorqueParser::file() {
   FileContext* _localctx =
       _tracker.createInstance<FileContext>(_ctx, getState());
-  enterRule(_localctx, 138, TorqueParser::RuleFile);
+  enterRule(_localctx, 150, TorqueParser::RuleFile);
   size_t _la = 0;
 
   auto onExit = finally([=] { exitRule(); });
   try {
     enterOuterAlt(_localctx, 1);
-    setState(746);
+    setState(815);
     _errHandler->sync(this);
     _la = _input->LA(1);
-    while ((((_la & ~0x3fULL) == 0) &&
-            ((1ULL << _la) &
-             ((1ULL << TorqueParser::T__5) | (1ULL << TorqueParser::T__19) |
-              (1ULL << TorqueParser::T__20) | (1ULL << TorqueParser::MACRO) |
-              (1ULL << TorqueParser::BUILTIN) | (1ULL << TorqueParser::MODULE) |
-              (1ULL << TorqueParser::JAVASCRIPT) |
-              (1ULL << TorqueParser::EXTERN))) != 0) ||
-           _la == TorqueParser::IDENTIFIER) {
-      setState(744);
+    while (
+        (((_la & ~0x3fULL) == 0) &&
+         ((1ULL << _la) &
+          ((1ULL << TorqueParser::T__5) | (1ULL << TorqueParser::T__19) |
+           (1ULL << TorqueParser::T__20) | (1ULL << TorqueParser::MACRO) |
+           (1ULL << TorqueParser::BUILTIN) | (1ULL << TorqueParser::MODULE) |
+           (1ULL << TorqueParser::JAVASCRIPT) | (1ULL << TorqueParser::CONST) |
+           (1ULL << TorqueParser::EXTERN))) != 0) ||
+        _la == TorqueParser::IDENTIFIER) {
+      setState(813);
       _errHandler->sync(this);
       switch (_input->LA(1)) {
         case TorqueParser::MODULE: {
-          setState(742);
+          setState(811);
           moduleDeclaration();
           break;
         }
@@ -6539,9 +7104,10 @@ TorqueParser::FileContext* TorqueParser::file() {
         case TorqueParser::MACRO:
         case TorqueParser::BUILTIN:
         case TorqueParser::JAVASCRIPT:
+        case TorqueParser::CONST:
         case TorqueParser::EXTERN:
         case TorqueParser::IDENTIFIER: {
-          setState(743);
+          setState(812);
           declaration();
           break;
         }
@@ -6549,7 +7115,7 @@ TorqueParser::FileContext* TorqueParser::file() {
         default:
           throw NoViableAltException(this);
       }
-      setState(748);
+      setState(817);
       _errHandler->sync(this);
       _la = _input->LA(1);
     }
@@ -6729,9 +7295,9 @@ bool TorqueParser::locationExpressionSempred(
     LocationExpressionContext* _localctx, size_t predicateIndex) {
   switch (predicateIndex) {
     case 10:
-      return precpred(_ctx, 2);
+      return precpred(_ctx, 4);
     case 11:
-      return precpred(_ctx, 1);
+      return precpred(_ctx, 2);
 
     default:
       break;
@@ -6775,6 +7341,8 @@ std::vector<std::string> TorqueParser::_ruleNames = {
     "incrementDecrement",
     "assignment",
     "assignmentExpression",
+    "structExpression",
+    "functionPointerExpression",
     "primaryExpression",
     "forInitialization",
     "forLoop",
@@ -6803,6 +7371,8 @@ std::vector<std::string> TorqueParser::_ruleNames = {
     "statementScope",
     "statementBlock",
     "helperBody",
+    "fieldDeclaration",
+    "fieldListDeclaration",
     "extendsDeclaration",
     "generatesDeclaration",
     "constexprDeclaration",
@@ -6815,6 +7385,8 @@ std::vector<std::string> TorqueParser::_ruleNames = {
     "genericSpecialization",
     "macroDeclaration",
     "externConstDeclaration",
+    "constDeclaration",
+    "structDeclaration",
     "declaration",
     "moduleDeclaration",
     "file"};
@@ -6832,15 +7404,15 @@ std::vector<std::string> TorqueParser::_literalNames = {"",
                                                         "'.'",
                                                         "'['",
                                                         "']'",
+                                                        "'{'",
+                                                        "'}'",
                                                         "';'",
                                                         "'of'",
                                                         "'else'",
-                                                        "'{'",
-                                                        "'}'",
                                                         "'extends'",
                                                         "'generates'",
                                                         "'operator'",
-                                                        "'const'",
+                                                        "'struct'",
                                                         "'macro'",
                                                         "'builtin'",
                                                         "'runtime'",
@@ -6863,6 +7435,7 @@ std::vector<std::string> TorqueParser::_literalNames = {"",
                                                         "'isnt'",
                                                         "'is'",
                                                         "'let'",
+                                                        "'const'",
                                                         "'extern'",
                                                         "'assert'",
                                                         "'check'",
@@ -6940,6 +7513,7 @@ std::vector<std::string> TorqueParser::_symbolicNames = {
     "ISNT",
     "IS",
     "LET",
+    "CONST",
     "EXTERN",
     "ASSERT_TOKEN",
     "CHECK_TOKEN",
@@ -6998,7 +7572,7 @@ TorqueParser::Initializer::Initializer() {
 
   _serializedATN = {
       0x3,   0x608b, 0xa72a, 0x8133, 0xb9ed, 0x417c, 0x3be7, 0x7786, 0x5964,
-      0x3,   0x52,   0x2f0,  0x4,    0x2,    0x9,    0x2,    0x4,    0x3,
+      0x3,   0x53,   0x335,  0x4,    0x2,    0x9,    0x2,    0x4,    0x3,
       0x9,   0x3,    0x4,    0x4,    0x9,    0x4,    0x4,    0x5,    0x9,
       0x5,   0x4,    0x6,    0x9,    0x6,    0x4,    0x7,    0x9,    0x7,
       0x4,   0x8,    0x9,    0x8,    0x4,    0x9,    0x9,    0x9,    0x4,
@@ -7029,693 +7603,758 @@ TorqueParser::Initializer::Initializer() {
       0x40,  0x9,    0x40,   0x4,    0x41,   0x9,    0x41,   0x4,    0x42,
       0x9,   0x42,   0x4,    0x43,   0x9,    0x43,   0x4,    0x44,   0x9,
       0x44,  0x4,    0x45,   0x9,    0x45,   0x4,    0x46,   0x9,    0x46,
-      0x4,   0x47,   0x9,    0x47,   0x3,    0x2,    0x3,    0x2,    0x5,
-      0x2,   0x91,   0xa,    0x2,    0x3,    0x2,    0x3,    0x2,    0x3,
+      0x4,   0x47,   0x9,    0x47,   0x4,    0x48,   0x9,    0x48,   0x4,
+      0x49,  0x9,    0x49,   0x4,    0x4a,   0x9,    0x4a,   0x4,    0x4b,
+      0x9,   0x4b,   0x4,    0x4c,   0x9,    0x4c,   0x4,    0x4d,   0x9,
+      0x4d,  0x3,    0x2,    0x3,    0x2,    0x5,    0x2,    0x9d,   0xa,
       0x2,   0x3,    0x2,    0x3,    0x2,    0x3,    0x2,    0x3,    0x2,
       0x3,   0x2,    0x3,    0x2,    0x3,    0x2,    0x3,    0x2,    0x3,
-      0x2,   0x5,    0x2,    0x9f,   0xa,    0x2,    0x3,    0x2,    0x3,
-      0x2,   0x3,    0x2,    0x7,    0x2,    0xa4,   0xa,    0x2,    0xc,
-      0x2,   0xe,    0x2,    0xa7,   0xb,    0x2,    0x3,    0x3,    0x3,
-      0x3,   0x3,    0x3,    0x7,    0x3,    0xac,   0xa,    0x3,    0xc,
-      0x3,   0xe,    0x3,    0xaf,   0xb,    0x3,    0x5,    0x3,    0xb1,
-      0xa,   0x3,    0x3,    0x4,    0x3,    0x4,    0x3,    0x4,    0x3,
-      0x4,   0x3,    0x5,    0x3,    0x5,    0x3,    0x5,    0x3,    0x5,
-      0x3,   0x5,    0x3,    0x5,    0x3,    0x5,    0x3,    0x5,    0x7,
-      0x5,   0xbf,   0xa,    0x5,    0xc,    0x5,    0xe,    0x5,    0xc2,
-      0xb,   0x5,    0x3,    0x5,    0x5,    0x5,    0xc5,   0xa,    0x5,
-      0x3,   0x6,    0x3,    0x6,    0x5,    0x6,    0xc9,   0xa,    0x6,
-      0x3,   0x6,    0x3,    0x6,    0x7,    0x6,    0xcd,   0xa,    0x6,
-      0xc,   0x6,    0xe,    0x6,    0xd0,   0xb,    0x6,    0x3,    0x6,
-      0x3,   0x6,    0x5,    0x6,    0xd4,   0xa,    0x6,    0x3,    0x6,
-      0x3,   0x6,    0x3,    0x6,    0x3,    0x6,    0x5,    0x6,    0xda,
-      0xa,   0x6,    0x3,    0x7,    0x3,    0x7,    0x3,    0x7,    0x3,
-      0x7,   0x3,    0x7,    0x5,    0x7,    0xe1,   0xa,    0x7,    0x3,
-      0x8,   0x3,    0x8,    0x5,    0x8,    0xe5,   0xa,    0x8,    0x3,
-      0x9,   0x3,    0x9,    0x3,    0x9,    0x3,    0x9,    0x7,    0x9,
-      0xeb,  0xa,    0x9,    0xc,    0x9,    0xe,    0x9,    0xee,   0xb,
-      0x9,   0x5,    0x9,    0xf0,   0xa,    0x9,    0x3,    0xa,    0x3,
-      0xa,   0x3,    0xa,    0x3,    0xa,    0x7,    0xa,    0xf6,   0xa,
-      0xa,   0xc,    0xa,    0xe,    0xa,    0xf9,   0xb,    0xa,    0x5,
-      0xa,   0xfb,   0xa,    0xa,    0x3,    0xb,    0x3,    0xb,    0x3,
-      0xb,   0x5,    0xb,    0x100,  0xa,    0xb,    0x3,    0xc,    0x3,
-      0xc,   0x5,    0xc,    0x104,  0xa,    0xc,    0x3,    0xc,    0x3,
-      0xc,   0x7,    0xc,    0x108,  0xa,    0xc,    0xc,    0xc,    0xe,
-      0xc,   0x10b,  0xb,    0xc,    0x3,    0xc,    0x3,    0xc,    0x3,
+      0x2,   0x3,    0x2,    0x3,    0x2,    0x3,    0x2,    0x5,    0x2,
+      0xab,  0xa,    0x2,    0x3,    0x2,    0x3,    0x2,    0x3,    0x2,
+      0x7,   0x2,    0xb0,   0xa,    0x2,    0xc,    0x2,    0xe,    0x2,
+      0xb3,  0xb,    0x2,    0x3,    0x3,    0x3,    0x3,    0x3,    0x3,
+      0x7,   0x3,    0xb8,   0xa,    0x3,    0xc,    0x3,    0xe,    0x3,
+      0xbb,  0xb,    0x3,    0x5,    0x3,    0xbd,   0xa,    0x3,    0x3,
+      0x4,   0x3,    0x4,    0x3,    0x4,    0x3,    0x4,    0x3,    0x5,
+      0x3,   0x5,    0x3,    0x5,    0x3,    0x5,    0x3,    0x5,    0x3,
+      0x5,   0x3,    0x5,    0x3,    0x5,    0x7,    0x5,    0xcb,   0xa,
+      0x5,   0xc,    0x5,    0xe,    0x5,    0xce,   0xb,    0x5,    0x3,
+      0x5,   0x5,    0x5,    0xd1,   0xa,    0x5,    0x3,    0x6,    0x3,
+      0x6,   0x5,    0x6,    0xd5,   0xa,    0x6,    0x3,    0x6,    0x3,
+      0x6,   0x7,    0x6,    0xd9,   0xa,    0x6,    0xc,    0x6,    0xe,
+      0x6,   0xdc,   0xb,    0x6,    0x3,    0x6,    0x3,    0x6,    0x5,
+      0x6,   0xe0,   0xa,    0x6,    0x3,    0x6,    0x3,    0x6,    0x3,
+      0x6,   0x3,    0x6,    0x5,    0x6,    0xe6,   0xa,    0x6,    0x3,
+      0x7,   0x3,    0x7,    0x3,    0x7,    0x3,    0x7,    0x3,    0x7,
+      0x5,   0x7,    0xed,   0xa,    0x7,    0x3,    0x8,    0x3,    0x8,
+      0x5,   0x8,    0xf1,   0xa,    0x8,    0x3,    0x9,    0x3,    0x9,
+      0x3,   0x9,    0x3,    0x9,    0x7,    0x9,    0xf7,   0xa,    0x9,
+      0xc,   0x9,    0xe,    0x9,    0xfa,   0xb,    0x9,    0x5,    0x9,
+      0xfc,  0xa,    0x9,    0x3,    0xa,    0x3,    0xa,    0x3,    0xa,
+      0x3,   0xa,    0x7,    0xa,    0x102,  0xa,    0xa,    0xc,    0xa,
+      0xe,   0xa,    0x105,  0xb,    0xa,    0x5,    0xa,    0x107,  0xa,
+      0xa,   0x3,    0xb,    0x3,    0xb,    0x3,    0xb,    0x5,    0xb,
+      0x10c, 0xa,    0xb,    0x3,    0xc,    0x3,    0xc,    0x5,    0xc,
+      0x110, 0xa,    0xc,    0x3,    0xc,    0x3,    0xc,    0x7,    0xc,
+      0x114, 0xa,    0xc,    0xc,    0xc,    0xe,    0xc,    0x117,  0xb,
       0xc,   0x3,    0xc,    0x3,    0xc,    0x3,    0xc,    0x3,    0xc,
-      0x3,   0xc,    0x3,    0xc,    0x3,    0xc,    0x5,    0xc,    0x117,
-      0xa,   0xc,    0x3,    0xd,    0x3,    0xd,    0x5,    0xd,    0x11b,
-      0xa,   0xd,    0x3,    0xe,    0x3,    0xe,    0x3,    0xf,    0x3,
-      0xf,   0x3,    0xf,    0x3,    0xf,    0x3,    0xf,    0x3,    0xf,
-      0x3,   0xf,    0x3,    0xf,    0x3,    0xf,    0x7,    0xf,    0x128,
-      0xa,   0xf,    0xc,    0xf,    0xe,    0xf,    0x12b,  0xb,    0xf,
-      0x3,   0x10,   0x3,    0x10,   0x3,    0x10,   0x3,    0x10,   0x3,
-      0x10,  0x3,    0x10,   0x7,    0x10,   0x133,  0xa,    0x10,   0xc,
-      0x10,  0xe,    0x10,   0x136,  0xb,    0x10,   0x3,    0x11,   0x3,
-      0x11,  0x3,    0x11,   0x3,    0x11,   0x3,    0x11,   0x3,    0x11,
-      0x7,   0x11,   0x13e,  0xa,    0x11,   0xc,    0x11,   0xe,    0x11,
-      0x141, 0xb,    0x11,   0x3,    0x12,   0x3,    0x12,   0x3,    0x12,
-      0x3,   0x12,   0x3,    0x12,   0x3,    0x12,   0x7,    0x12,   0x149,
-      0xa,   0x12,   0xc,    0x12,   0xe,    0x12,   0x14c,  0xb,    0x12,
-      0x3,   0x13,   0x3,    0x13,   0x3,    0x13,   0x3,    0x13,   0x3,
-      0x13,  0x3,    0x13,   0x7,    0x13,   0x154,  0xa,    0x13,   0xc,
-      0x13,  0xe,    0x13,   0x157,  0xb,    0x13,   0x3,    0x14,   0x3,
-      0x14,  0x3,    0x14,   0x3,    0x14,   0x3,    0x14,   0x3,    0x14,
-      0x7,   0x14,   0x15f,  0xa,    0x14,   0xc,    0x14,   0xe,    0x14,
-      0x162, 0xb,    0x14,   0x3,    0x15,   0x3,    0x15,   0x3,    0x15,
-      0x3,   0x15,   0x3,    0x15,   0x3,    0x15,   0x7,    0x15,   0x16a,
-      0xa,   0x15,   0xc,    0x15,   0xe,    0x15,   0x16d,  0xb,    0x15,
-      0x3,   0x16,   0x3,    0x16,   0x3,    0x16,   0x3,    0x16,   0x3,
-      0x16,  0x3,    0x16,   0x7,    0x16,   0x175,  0xa,    0x16,   0xc,
-      0x16,  0xe,    0x16,   0x178,  0xb,    0x16,   0x3,    0x17,   0x3,
-      0x17,  0x3,    0x17,   0x3,    0x17,   0x3,    0x17,   0x3,    0x17,
-      0x7,   0x17,   0x180,  0xa,    0x17,   0xc,    0x17,   0xe,    0x17,
-      0x183, 0xb,    0x17,   0x3,    0x18,   0x3,    0x18,   0x3,    0x18,
-      0x5,   0x18,   0x188,  0xa,    0x18,   0x3,    0x19,   0x3,    0x19,
-      0x3,   0x19,   0x5,    0x19,   0x18d,  0xa,    0x19,   0x3,    0x19,
-      0x3,   0x19,   0x3,    0x19,   0x3,    0x19,   0x3,    0x19,   0x3,
-      0x19,  0x3,    0x19,   0x3,    0x19,   0x7,    0x19,   0x197,  0xa,
-      0x19,  0xc,    0x19,   0xe,    0x19,   0x19a,  0xb,    0x19,   0x3,
-      0x1a,  0x3,    0x1a,   0x3,    0x1a,   0x3,    0x1a,   0x3,    0x1a,
+      0x3,   0xc,    0x3,    0xc,    0x3,    0xc,    0x3,    0xc,    0x3,
+      0xc,   0x3,    0xc,    0x5,    0xc,    0x123,  0xa,    0xc,    0x3,
+      0xd,   0x3,    0xd,    0x5,    0xd,    0x127,  0xa,    0xd,    0x3,
+      0xe,   0x3,    0xe,    0x3,    0xf,    0x3,    0xf,    0x3,    0xf,
+      0x3,   0xf,    0x3,    0xf,    0x3,    0xf,    0x3,    0xf,    0x3,
+      0xf,   0x3,    0xf,    0x7,    0xf,    0x134,  0xa,    0xf,    0xc,
+      0xf,   0xe,    0xf,    0x137,  0xb,    0xf,    0x3,    0x10,   0x3,
+      0x10,  0x3,    0x10,   0x3,    0x10,   0x3,    0x10,   0x3,    0x10,
+      0x7,   0x10,   0x13f,  0xa,    0x10,   0xc,    0x10,   0xe,    0x10,
+      0x142, 0xb,    0x10,   0x3,    0x11,   0x3,    0x11,   0x3,    0x11,
+      0x3,   0x11,   0x3,    0x11,   0x3,    0x11,   0x7,    0x11,   0x14a,
+      0xa,   0x11,   0xc,    0x11,   0xe,    0x11,   0x14d,  0xb,    0x11,
+      0x3,   0x12,   0x3,    0x12,   0x3,    0x12,   0x3,    0x12,   0x3,
+      0x12,  0x3,    0x12,   0x7,    0x12,   0x155,  0xa,    0x12,   0xc,
+      0x12,  0xe,    0x12,   0x158,  0xb,    0x12,   0x3,    0x13,   0x3,
+      0x13,  0x3,    0x13,   0x3,    0x13,   0x3,    0x13,   0x3,    0x13,
+      0x7,   0x13,   0x160,  0xa,    0x13,   0xc,    0x13,   0xe,    0x13,
+      0x163, 0xb,    0x13,   0x3,    0x14,   0x3,    0x14,   0x3,    0x14,
+      0x3,   0x14,   0x3,    0x14,   0x3,    0x14,   0x7,    0x14,   0x16b,
+      0xa,   0x14,   0xc,    0x14,   0xe,    0x14,   0x16e,  0xb,    0x14,
+      0x3,   0x15,   0x3,    0x15,   0x3,    0x15,   0x3,    0x15,   0x3,
+      0x15,  0x3,    0x15,   0x7,    0x15,   0x176,  0xa,    0x15,   0xc,
+      0x15,  0xe,    0x15,   0x179,  0xb,    0x15,   0x3,    0x16,   0x3,
+      0x16,  0x3,    0x16,   0x3,    0x16,   0x3,    0x16,   0x3,    0x16,
+      0x7,   0x16,   0x181,  0xa,    0x16,   0xc,    0x16,   0xe,    0x16,
+      0x184, 0xb,    0x16,   0x3,    0x17,   0x3,    0x17,   0x3,    0x17,
+      0x3,   0x17,   0x3,    0x17,   0x3,    0x17,   0x7,    0x17,   0x18c,
+      0xa,   0x17,   0xc,    0x17,   0xe,    0x17,   0x18f,  0xb,    0x17,
+      0x3,   0x18,   0x3,    0x18,   0x3,    0x18,   0x5,    0x18,   0x194,
+      0xa,   0x18,   0x3,    0x19,   0x3,    0x19,   0x3,    0x19,   0x3,
+      0x19,  0x3,    0x19,   0x3,    0x19,   0x3,    0x19,   0x3,    0x19,
+      0x3,   0x19,   0x3,    0x19,   0x3,    0x19,   0x5,    0x19,   0x1a1,
+      0xa,   0x19,   0x3,    0x19,   0x3,    0x19,   0x3,    0x19,   0x3,
+      0x19,  0x3,    0x19,   0x3,    0x19,   0x3,    0x19,   0x3,    0x19,
+      0x7,   0x19,   0x1ab,  0xa,    0x19,   0xc,    0x19,   0xe,    0x19,
+      0x1ae, 0xb,    0x19,   0x3,    0x1a,   0x3,    0x1a,   0x3,    0x1a,
       0x3,   0x1a,   0x3,    0x1a,   0x3,    0x1a,   0x3,    0x1a,   0x3,
-      0x1a,  0x5,    0x1a,   0x1a6,  0xa,    0x1a,   0x3,    0x1b,   0x3,
-      0x1b,  0x3,    0x1b,   0x3,    0x1b,   0x5,    0x1b,   0x1ac,  0xa,
-      0x1b,  0x5,    0x1b,   0x1ae,  0xa,    0x1b,   0x3,    0x1c,   0x3,
-      0x1c,  0x5,    0x1c,   0x1b2,  0xa,    0x1c,   0x3,    0x1d,   0x3,
-      0x1d,  0x3,    0x1d,   0x3,    0x1d,   0x3,    0x1d,   0x3,    0x1d,
-      0x3,   0x1d,   0x5,    0x1d,   0x1bb,  0xa,    0x1d,   0x3,    0x1e,
-      0x5,   0x1e,   0x1be,  0xa,    0x1e,   0x3,    0x1f,   0x3,    0x1f,
+      0x1a,  0x3,    0x1a,   0x3,    0x1a,   0x5,    0x1a,   0x1ba,  0xa,
+      0x1a,  0x3,    0x1b,   0x3,    0x1b,   0x3,    0x1b,   0x3,    0x1b,
+      0x5,   0x1b,   0x1c0,  0xa,    0x1b,   0x5,    0x1b,   0x1c2,  0xa,
+      0x1b,  0x3,    0x1c,   0x3,    0x1c,   0x5,    0x1c,   0x1c6,  0xa,
+      0x1c,  0x3,    0x1d,   0x3,    0x1d,   0x3,    0x1d,   0x3,    0x1d,
+      0x3,   0x1d,   0x7,    0x1d,   0x1cd,  0xa,    0x1d,   0xc,    0x1d,
+      0xe,   0x1d,   0x1d0,  0xb,    0x1d,   0x5,    0x1d,   0x1d2,  0xa,
+      0x1d,  0x3,    0x1d,   0x3,    0x1d,   0x3,    0x1e,   0x3,    0x1e,
+      0x3,   0x1e,   0x5,    0x1e,   0x1d9,  0xa,    0x1e,   0x5,    0x1e,
+      0x1db, 0xa,    0x1e,   0x3,    0x1f,   0x3,    0x1f,   0x3,    0x1f,
       0x3,   0x1f,   0x3,    0x1f,   0x3,    0x1f,   0x3,    0x1f,   0x3,
-      0x1f,  0x3,    0x1f,   0x3,    0x1f,   0x3,    0x1f,   0x3,    0x20,
-      0x3,   0x20,   0x5,    0x20,   0x1cc,  0xa,    0x20,   0x3,    0x20,
-      0x3,   0x20,   0x5,    0x20,   0x1d0,  0xa,    0x20,   0x3,    0x20,
-      0x3,   0x20,   0x3,    0x21,   0x5,    0x21,   0x1d5,  0xa,    0x21,
-      0x3,   0x22,   0x3,    0x22,   0x3,    0x22,   0x3,    0x22,   0x3,
-      0x22,  0x3,    0x22,   0x3,    0x22,   0x3,    0x22,   0x3,    0x22,
-      0x3,   0x23,   0x3,    0x23,   0x3,    0x24,   0x3,    0x24,   0x5,
-      0x24,  0x1e4,  0xa,    0x24,   0x3,    0x24,   0x3,    0x24,   0x7,
-      0x24,  0x1e8,  0xa,    0x24,   0xc,    0x24,   0xe,    0x24,   0x1eb,
-      0xb,   0x24,   0x3,    0x24,   0x3,    0x24,   0x3,    0x25,   0x3,
-      0x25,  0x5,    0x25,   0x1f1,  0xa,    0x25,   0x3,    0x25,   0x3,
-      0x25,  0x3,    0x25,   0x3,    0x26,   0x3,    0x26,   0x3,    0x27,
-      0x3,   0x27,   0x3,    0x27,   0x3,    0x27,   0x3,    0x27,   0x3,
-      0x28,  0x3,    0x28,   0x3,    0x28,   0x5,    0x28,   0x200,  0xa,
-      0x28,  0x3,    0x29,   0x5,    0x29,   0x203,  0xa,    0x29,   0x3,
-      0x29,  0x3,    0x29,   0x3,    0x2a,   0x3,    0x2a,   0x3,    0x2b,
-      0x3,   0x2b,   0x5,    0x2b,   0x20b,  0xa,    0x2b,   0x3,    0x2b,
-      0x3,   0x2b,   0x3,    0x2b,   0x3,    0x2b,   0x3,    0x2b,   0x3,
-      0x2b,  0x5,    0x2b,   0x213,  0xa,    0x2b,   0x3,    0x2c,   0x3,
-      0x2c,  0x3,    0x2c,   0x3,    0x2c,   0x3,    0x2c,   0x3,    0x2c,
-      0x3,   0x2d,   0x3,    0x2d,   0x5,    0x2d,   0x21d,  0xa,    0x2d,
-      0x3,   0x2e,   0x3,    0x2e,   0x3,    0x2f,   0x3,    0x2f,   0x3,
-      0x30,  0x3,    0x30,   0x3,    0x30,   0x5,    0x30,   0x226,  0xa,
-      0x30,  0x3,    0x31,   0x3,    0x31,   0x3,    0x31,   0x3,    0x31,
-      0x3,   0x32,   0x3,    0x32,   0x3,    0x32,   0x6,    0x32,   0x22f,
-      0xa,   0x32,   0xd,    0x32,   0xe,    0x32,   0x230,  0x3,    0x33,
+      0x1f,  0x5,    0x1f,   0x1e5,  0xa,    0x1f,   0x3,    0x20,   0x5,
+      0x20,  0x1e8,  0xa,    0x20,   0x3,    0x21,   0x3,    0x21,   0x3,
+      0x21,  0x3,    0x21,   0x3,    0x21,   0x3,    0x21,   0x3,    0x21,
+      0x3,   0x21,   0x3,    0x21,   0x3,    0x21,   0x3,    0x22,   0x3,
+      0x22,  0x5,    0x22,   0x1f6,  0xa,    0x22,   0x3,    0x22,   0x3,
+      0x22,  0x5,    0x22,   0x1fa,  0xa,    0x22,   0x3,    0x22,   0x3,
+      0x22,  0x3,    0x23,   0x5,    0x23,   0x1ff,  0xa,    0x23,   0x3,
+      0x24,  0x3,    0x24,   0x3,    0x24,   0x3,    0x24,   0x3,    0x24,
+      0x3,   0x24,   0x3,    0x24,   0x3,    0x24,   0x3,    0x24,   0x3,
+      0x25,  0x3,    0x25,   0x3,    0x26,   0x3,    0x26,   0x5,    0x26,
+      0x20e, 0xa,    0x26,   0x3,    0x26,   0x3,    0x26,   0x7,    0x26,
+      0x212, 0xa,    0x26,   0xc,    0x26,   0xe,    0x26,   0x215,  0xb,
+      0x26,  0x3,    0x26,   0x3,    0x26,   0x3,    0x27,   0x3,    0x27,
+      0x5,   0x27,   0x21b,  0xa,    0x27,   0x3,    0x27,   0x3,    0x27,
+      0x3,   0x27,   0x3,    0x28,   0x3,    0x28,   0x3,    0x29,   0x3,
+      0x29,  0x3,    0x29,   0x3,    0x29,   0x3,    0x29,   0x3,    0x2a,
+      0x3,   0x2a,   0x3,    0x2a,   0x5,    0x2a,   0x22a,  0xa,    0x2a,
+      0x3,   0x2b,   0x5,    0x2b,   0x22d,  0xa,    0x2b,   0x3,    0x2b,
+      0x3,   0x2b,   0x3,    0x2c,   0x3,    0x2c,   0x3,    0x2d,   0x3,
+      0x2d,  0x5,    0x2d,   0x235,  0xa,    0x2d,   0x3,    0x2d,   0x3,
+      0x2d,  0x3,    0x2d,   0x3,    0x2d,   0x3,    0x2d,   0x3,    0x2d,
+      0x5,   0x2d,   0x23d,  0xa,    0x2d,   0x3,    0x2e,   0x3,    0x2e,
+      0x3,   0x2e,   0x3,    0x2e,   0x3,    0x2e,   0x3,    0x2e,   0x3,
+      0x2f,  0x3,    0x2f,   0x5,    0x2f,   0x247,  0xa,    0x2f,   0x3,
+      0x30,  0x3,    0x30,   0x3,    0x31,   0x3,    0x31,   0x3,    0x32,
+      0x3,   0x32,   0x3,    0x32,   0x5,    0x32,   0x250,  0xa,    0x32,
       0x3,   0x33,   0x3,    0x33,   0x3,    0x33,   0x3,    0x33,   0x3,
-      0x33,  0x3,    0x33,   0x5,    0x33,   0x23a,  0xa,    0x33,   0x3,
-      0x34,  0x3,    0x34,   0x3,    0x34,   0x3,    0x34,   0x3,    0x34,
-      0x3,   0x34,   0x3,    0x34,   0x3,    0x34,   0x3,    0x34,   0x3,
-      0x34,  0x3,    0x34,   0x3,    0x34,   0x3,    0x34,   0x3,    0x34,
-      0x3,   0x34,   0x3,    0x34,   0x3,    0x34,   0x3,    0x34,   0x3,
-      0x34,  0x3,    0x34,   0x3,    0x34,   0x3,    0x34,   0x3,    0x34,
-      0x3,   0x34,   0x3,    0x34,   0x3,    0x34,   0x3,    0x34,   0x3,
-      0x34,  0x3,    0x34,   0x5,    0x34,   0x259,  0xa,    0x34,   0x3,
-      0x35,  0x7,    0x35,   0x25c,  0xa,    0x35,   0xc,    0x35,   0xe,
-      0x35,  0x25f,  0xb,    0x35,   0x3,    0x36,   0x5,    0x36,   0x262,
-      0xa,   0x36,   0x3,    0x36,   0x3,    0x36,   0x3,    0x36,   0x3,
-      0x36,  0x3,    0x37,   0x3,    0x37,   0x5,    0x37,   0x26a,  0xa,
-      0x37,  0x3,    0x38,   0x3,    0x38,   0x3,    0x39,   0x3,    0x39,
-      0x3,   0x39,   0x3,    0x3a,   0x3,    0x3a,   0x3,    0x3a,   0x3,
-      0x3b,  0x3,    0x3b,   0x3,    0x3b,   0x3,    0x3c,   0x3,    0x3c,
-      0x3,   0x3c,   0x5,    0x3c,   0x27a,  0xa,    0x3c,   0x3,    0x3c,
-      0x5,   0x3c,   0x27d,  0xa,    0x3c,   0x3,    0x3c,   0x5,    0x3c,
-      0x280, 0xa,    0x3c,   0x3,    0x3c,   0x3,    0x3c,   0x3,    0x3d,
-      0x3,   0x3d,   0x3,    0x3d,   0x3,    0x3d,   0x3,    0x3d,   0x3,
-      0x3d,  0x3,    0x3e,   0x3,    0x3e,   0x5,    0x3e,   0x28c,  0xa,
-      0x3e,  0x3,    0x3e,   0x3,    0x3e,   0x3,    0x3e,   0x3,    0x3e,
-      0x3,   0x3e,   0x3,    0x3e,   0x3,    0x3e,   0x3,    0x3e,   0x3,
-      0x3e,  0x3,    0x3f,   0x3,    0x3f,   0x3,    0x3f,   0x5,    0x3f,
-      0x29a, 0xa,    0x3f,   0x3,    0x3f,   0x3,    0x3f,   0x3,    0x3f,
-      0x3,   0x3f,   0x3,    0x3f,   0x3,    0x3f,   0x3,    0x3f,   0x3,
-      0x3f,  0x3,    0x40,   0x3,    0x40,   0x3,    0x40,   0x3,    0x40,
-      0x3,   0x40,   0x3,    0x40,   0x3,    0x40,   0x3,    0x41,   0x5,
-      0x41,  0x2ac,  0xa,    0x41,   0x3,    0x41,   0x3,    0x41,   0x3,
-      0x41,  0x3,    0x41,   0x3,    0x41,   0x3,    0x41,   0x3,    0x41,
-      0x5,   0x41,   0x2b5,  0xa,    0x41,   0x3,    0x42,   0x3,    0x42,
-      0x3,   0x42,   0x3,    0x42,   0x3,    0x42,   0x3,    0x42,   0x3,
-      0x42,  0x3,    0x43,   0x3,    0x43,   0x5,    0x43,   0x2c0,  0xa,
+      0x34,  0x3,    0x34,   0x3,    0x34,   0x6,    0x34,   0x259,  0xa,
+      0x34,  0xd,    0x34,   0xe,    0x34,   0x25a,  0x3,    0x35,   0x3,
+      0x35,  0x3,    0x35,   0x3,    0x35,   0x3,    0x35,   0x3,    0x35,
+      0x3,   0x35,   0x5,    0x35,   0x264,  0xa,    0x35,   0x3,    0x36,
+      0x3,   0x36,   0x3,    0x36,   0x3,    0x36,   0x3,    0x36,   0x3,
+      0x36,  0x3,    0x36,   0x3,    0x36,   0x3,    0x36,   0x3,    0x36,
+      0x3,   0x36,   0x3,    0x36,   0x3,    0x36,   0x3,    0x36,   0x3,
+      0x36,  0x3,    0x36,   0x3,    0x36,   0x3,    0x36,   0x3,    0x36,
+      0x3,   0x36,   0x3,    0x36,   0x3,    0x36,   0x3,    0x36,   0x3,
+      0x36,  0x3,    0x36,   0x3,    0x36,   0x3,    0x36,   0x3,    0x36,
+      0x3,   0x36,   0x5,    0x36,   0x283,  0xa,    0x36,   0x3,    0x37,
+      0x7,   0x37,   0x286,  0xa,    0x37,   0xc,    0x37,   0xe,    0x37,
+      0x289, 0xb,    0x37,   0x3,    0x38,   0x5,    0x38,   0x28c,  0xa,
+      0x38,  0x3,    0x38,   0x3,    0x38,   0x3,    0x38,   0x3,    0x38,
+      0x3,   0x39,   0x3,    0x39,   0x5,    0x39,   0x294,  0xa,    0x39,
+      0x3,   0x3a,   0x3,    0x3a,   0x3,    0x3b,   0x3,    0x3b,   0x3,
+      0x3b,  0x3,    0x3b,   0x3,    0x3b,   0x3,    0x3c,   0x7,    0x3c,
+      0x29e, 0xa,    0x3c,   0xc,    0x3c,   0xe,    0x3c,   0x2a1,  0xb,
+      0x3c,  0x3,    0x3d,   0x3,    0x3d,   0x3,    0x3d,   0x3,    0x3e,
+      0x3,   0x3e,   0x3,    0x3e,   0x3,    0x3f,   0x3,    0x3f,   0x3,
+      0x3f,  0x3,    0x40,   0x3,    0x40,   0x3,    0x40,   0x5,    0x40,
+      0x2af, 0xa,    0x40,   0x3,    0x40,   0x5,    0x40,   0x2b2,  0xa,
+      0x40,  0x3,    0x40,   0x5,    0x40,   0x2b5,  0xa,    0x40,   0x3,
+      0x40,  0x3,    0x40,   0x3,    0x41,   0x3,    0x41,   0x3,    0x41,
+      0x3,   0x41,   0x3,    0x41,   0x3,    0x41,   0x3,    0x42,   0x3,
+      0x42,  0x5,    0x42,   0x2c1,  0xa,    0x42,   0x3,    0x42,   0x3,
+      0x42,  0x3,    0x42,   0x3,    0x42,   0x3,    0x42,   0x3,    0x42,
+      0x3,   0x42,   0x3,    0x42,   0x3,    0x42,   0x3,    0x43,   0x3,
+      0x43,  0x3,    0x43,   0x5,    0x43,   0x2cf,  0xa,    0x43,   0x3,
       0x43,  0x3,    0x43,   0x3,    0x43,   0x3,    0x43,   0x3,    0x43,
-      0x3,   0x43,   0x3,    0x43,   0x3,    0x43,   0x3,    0x43,   0x5,
-      0x43,  0x2ca,  0xa,    0x43,   0x3,    0x44,   0x3,    0x44,   0x3,
+      0x3,   0x43,   0x3,    0x43,   0x3,    0x43,   0x3,    0x44,   0x3,
       0x44,  0x3,    0x44,   0x3,    0x44,   0x3,    0x44,   0x3,    0x44,
+      0x3,   0x44,   0x3,    0x45,   0x5,    0x45,   0x2e1,  0xa,    0x45,
       0x3,   0x45,   0x3,    0x45,   0x3,    0x45,   0x3,    0x45,   0x3,
-      0x45,  0x3,    0x45,   0x3,    0x45,   0x3,    0x45,   0x3,    0x45,
-      0x5,   0x45,   0x2dc,  0xa,    0x45,   0x3,    0x46,   0x3,    0x46,
-      0x3,   0x46,   0x3,    0x46,   0x7,    0x46,   0x2e2,  0xa,    0x46,
-      0xc,   0x46,   0xe,    0x46,   0x2e5,  0xb,    0x46,   0x3,    0x46,
-      0x3,   0x46,   0x3,    0x47,   0x3,    0x47,   0x7,    0x47,   0x2eb,
-      0xa,   0x47,   0xc,    0x47,   0xe,    0x47,   0x2ee,  0xb,    0x47,
-      0x3,   0x47,   0x2,    0xd,    0x2,    0x1c,   0x1e,   0x20,   0x22,
-      0x24,  0x26,   0x28,   0x2a,   0x2c,   0x30,   0x48,   0x2,    0x4,
-      0x6,   0x8,    0xa,    0xc,    0xe,    0x10,   0x12,   0x14,   0x16,
-      0x18,  0x1a,   0x1c,   0x1e,   0x20,   0x22,   0x24,   0x26,   0x28,
-      0x2a,  0x2c,   0x2e,   0x30,   0x32,   0x34,   0x36,   0x38,   0x3a,
-      0x3c,  0x3e,   0x40,   0x42,   0x44,   0x46,   0x48,   0x4a,   0x4c,
-      0x4e,  0x50,   0x52,   0x54,   0x56,   0x58,   0x5a,   0x5c,   0x5e,
-      0x60,  0x62,   0x64,   0x66,   0x68,   0x6a,   0x6c,   0x6e,   0x70,
-      0x72,  0x74,   0x76,   0x78,   0x7a,   0x7c,   0x7e,   0x80,   0x82,
-      0x84,  0x86,   0x88,   0x8a,   0x8c,   0x2,    0xc,    0x3,    0x2,
-      0x3b,  0x3c,   0x4,    0x2,    0x35,   0x35,   0x40,   0x40,   0x3,
-      0x2,   0x41,   0x44,   0x3,    0x2,    0x45,   0x47,   0x3,    0x2,
-      0x36,  0x37,   0x3,    0x2,    0x38,   0x3a,   0x5,    0x2,    0x36,
-      0x37,  0x3d,   0x3d,   0x4c,   0x4c,   0x3,    0x2,    0x33,   0x34,
-      0x4,   0x2,    0x3e,   0x3f,   0x4e,   0x4e,   0x3,    0x2,    0x2f,
-      0x30,  0x2,    0x309,  0x2,    0x9e,   0x3,    0x2,    0x2,    0x2,
-      0x4,   0xb0,   0x3,    0x2,    0x2,    0x2,    0x6,    0xb2,   0x3,
-      0x2,   0x2,    0x2,    0x8,    0xc4,   0x3,    0x2,    0x2,    0x2,
-      0xa,   0xd9,   0x3,    0x2,    0x2,    0x2,    0xc,    0xdb,   0x3,
-      0x2,   0x2,    0x2,    0xe,    0xe4,   0x3,    0x2,    0x2,    0x2,
-      0x10,  0xef,   0x3,    0x2,    0x2,    0x2,    0x12,   0xfa,   0x3,
-      0x2,   0x2,    0x2,    0x14,   0xfc,   0x3,    0x2,    0x2,    0x2,
-      0x16,  0x116,  0x3,    0x2,    0x2,    0x2,    0x18,   0x118,  0x3,
-      0x2,   0x2,    0x2,    0x1a,   0x11c,  0x3,    0x2,    0x2,    0x2,
-      0x1c,  0x11e,  0x3,    0x2,    0x2,    0x2,    0x1e,   0x12c,  0x3,
-      0x2,   0x2,    0x2,    0x20,   0x137,  0x3,    0x2,    0x2,    0x2,
-      0x22,  0x142,  0x3,    0x2,    0x2,    0x2,    0x24,   0x14d,  0x3,
-      0x2,   0x2,    0x2,    0x26,   0x158,  0x3,    0x2,    0x2,    0x2,
-      0x28,  0x163,  0x3,    0x2,    0x2,    0x2,    0x2a,   0x16e,  0x3,
-      0x2,   0x2,    0x2,    0x2c,   0x179,  0x3,    0x2,    0x2,    0x2,
-      0x2e,  0x187,  0x3,    0x2,    0x2,    0x2,    0x30,   0x189,  0x3,
-      0x2,   0x2,    0x2,    0x32,   0x1a5,  0x3,    0x2,    0x2,    0x2,
-      0x34,  0x1ad,  0x3,    0x2,    0x2,    0x2,    0x36,   0x1b1,  0x3,
-      0x2,   0x2,    0x2,    0x38,   0x1ba,  0x3,    0x2,    0x2,    0x2,
-      0x3a,  0x1bd,  0x3,    0x2,    0x2,    0x2,    0x3c,   0x1bf,  0x3,
-      0x2,   0x2,    0x2,    0x3e,   0x1c9,  0x3,    0x2,    0x2,    0x2,
-      0x40,  0x1d4,  0x3,    0x2,    0x2,    0x2,    0x42,   0x1d6,  0x3,
-      0x2,   0x2,    0x2,    0x44,   0x1df,  0x3,    0x2,    0x2,    0x2,
-      0x46,  0x1e1,  0x3,    0x2,    0x2,    0x2,    0x48,   0x1ee,  0x3,
-      0x2,   0x2,    0x2,    0x4a,   0x1f5,  0x3,    0x2,    0x2,    0x2,
-      0x4c,  0x1f7,  0x3,    0x2,    0x2,    0x2,    0x4e,   0x1fc,  0x3,
-      0x2,   0x2,    0x2,    0x50,   0x202,  0x3,    0x2,    0x2,    0x2,
-      0x52,  0x206,  0x3,    0x2,    0x2,    0x2,    0x54,   0x208,  0x3,
-      0x2,   0x2,    0x2,    0x56,   0x214,  0x3,    0x2,    0x2,    0x2,
-      0x58,  0x21a,  0x3,    0x2,    0x2,    0x2,    0x5a,   0x21e,  0x3,
-      0x2,   0x2,    0x2,    0x5c,   0x220,  0x3,    0x2,    0x2,    0x2,
-      0x5e,  0x222,  0x3,    0x2,    0x2,    0x2,    0x60,   0x227,  0x3,
-      0x2,   0x2,    0x2,    0x62,   0x22b,  0x3,    0x2,    0x2,    0x2,
-      0x64,  0x239,  0x3,    0x2,    0x2,    0x2,    0x66,   0x258,  0x3,
-      0x2,   0x2,    0x2,    0x68,   0x25d,  0x3,    0x2,    0x2,    0x2,
-      0x6a,  0x261,  0x3,    0x2,    0x2,    0x2,    0x6c,   0x269,  0x3,
-      0x2,   0x2,    0x2,    0x6e,   0x26b,  0x3,    0x2,    0x2,    0x2,
-      0x70,  0x26d,  0x3,    0x2,    0x2,    0x2,    0x72,   0x270,  0x3,
-      0x2,   0x2,    0x2,    0x74,   0x273,  0x3,    0x2,    0x2,    0x2,
-      0x76,  0x276,  0x3,    0x2,    0x2,    0x2,    0x78,   0x283,  0x3,
-      0x2,   0x2,    0x2,    0x7a,   0x289,  0x3,    0x2,    0x2,    0x2,
-      0x7c,  0x296,  0x3,    0x2,    0x2,    0x2,    0x7e,   0x2a3,  0x3,
-      0x2,   0x2,    0x2,    0x80,   0x2ab,  0x3,    0x2,    0x2,    0x2,
-      0x82,  0x2b6,  0x3,    0x2,    0x2,    0x2,    0x84,   0x2bf,  0x3,
-      0x2,   0x2,    0x2,    0x86,   0x2cb,  0x3,    0x2,    0x2,    0x2,
-      0x88,  0x2db,  0x3,    0x2,    0x2,    0x2,    0x8a,   0x2dd,  0x3,
-      0x2,   0x2,    0x2,    0x8c,   0x2ec,  0x3,    0x2,    0x2,    0x2,
-      0x8e,  0x90,   0x8,    0x2,    0x1,    0x2,    0x8f,   0x91,   0x7,
-      0x22,  0x2,    0x2,    0x90,   0x8f,   0x3,    0x2,    0x2,    0x2,
-      0x90,  0x91,   0x3,    0x2,    0x2,    0x2,    0x91,   0x92,   0x3,
-      0x2,   0x2,    0x2,    0x92,   0x9f,   0x7,    0x4e,   0x2,    0x2,
-      0x93,  0x94,   0x7,    0x19,   0x2,    0x2,    0x94,   0x95,   0x7,
-      0x3,   0x2,    0x2,    0x95,   0x96,   0x5,    0x4,    0x3,    0x2,
-      0x96,  0x97,   0x7,    0x4,    0x2,    0x2,    0x97,   0x98,   0x7,
-      0x5,   0x2,    0x2,    0x98,   0x99,   0x5,    0x2,    0x2,    0x5,
-      0x99,  0x9f,   0x3,    0x2,    0x2,    0x2,    0x9a,   0x9b,   0x7,
-      0x3,   0x2,    0x2,    0x9b,   0x9c,   0x5,    0x2,    0x2,    0x2,
-      0x9c,  0x9d,   0x7,    0x4,    0x2,    0x2,    0x9d,   0x9f,   0x3,
-      0x2,   0x2,    0x2,    0x9e,   0x8e,   0x3,    0x2,    0x2,    0x2,
-      0x9e,  0x93,   0x3,    0x2,    0x2,    0x2,    0x9e,   0x9a,   0x3,
-      0x2,   0x2,    0x2,    0x9f,   0xa5,   0x3,    0x2,    0x2,    0x2,
-      0xa0,  0xa1,   0xc,    0x4,    0x2,    0x2,    0xa1,   0xa2,   0x7,
-      0x3b,  0x2,    0x2,    0xa2,   0xa4,   0x5,    0x2,    0x2,    0x5,
-      0xa3,  0xa0,   0x3,    0x2,    0x2,    0x2,    0xa4,   0xa7,   0x3,
-      0x2,   0x2,    0x2,    0xa5,   0xa3,   0x3,    0x2,    0x2,    0x2,
-      0xa5,  0xa6,   0x3,    0x2,    0x2,    0x2,    0xa6,   0x3,    0x3,
-      0x2,   0x2,    0x2,    0xa7,   0xa5,   0x3,    0x2,    0x2,    0x2,
-      0xa8,  0xad,   0x5,    0x2,    0x2,    0x2,    0xa9,   0xaa,   0x7,
-      0x6,   0x2,    0x2,    0xaa,   0xac,   0x5,    0x2,    0x2,    0x2,
-      0xab,  0xa9,   0x3,    0x2,    0x2,    0x2,    0xac,   0xaf,   0x3,
-      0x2,   0x2,    0x2,    0xad,   0xab,   0x3,    0x2,    0x2,    0x2,
-      0xad,  0xae,   0x3,    0x2,    0x2,    0x2,    0xae,   0xb1,   0x3,
-      0x2,   0x2,    0x2,    0xaf,   0xad,   0x3,    0x2,    0x2,    0x2,
-      0xb0,  0xa8,   0x3,    0x2,    0x2,    0x2,    0xb0,   0xb1,   0x3,
-      0x2,   0x2,    0x2,    0xb1,   0x5,    0x3,    0x2,    0x2,    0x2,
-      0xb2,  0xb3,   0x7,    0x41,   0x2,    0x2,    0xb3,   0xb4,   0x5,
-      0x4,   0x3,    0x2,    0xb4,   0xb5,   0x7,    0x43,   0x2,    0x2,
-      0xb5,  0x7,    0x3,    0x2,    0x2,    0x2,    0xb6,   0xb7,   0x7,
-      0x41,  0x2,    0x2,    0xb7,   0xb8,   0x7,    0x4e,   0x2,    0x2,
-      0xb8,  0xb9,   0x7,    0x7,    0x2,    0x2,    0xb9,   0xc0,   0x7,
-      0x8,   0x2,    0x2,    0xba,   0xbb,   0x7,    0x6,    0x2,    0x2,
-      0xbb,  0xbc,   0x7,    0x4e,   0x2,    0x2,    0xbc,   0xbd,   0x7,
-      0x7,   0x2,    0x2,    0xbd,   0xbf,   0x7,    0x8,    0x2,    0x2,
-      0xbe,  0xba,   0x3,    0x2,    0x2,    0x2,    0xbf,   0xc2,   0x3,
-      0x2,   0x2,    0x2,    0xc0,   0xbe,   0x3,    0x2,    0x2,    0x2,
-      0xc0,  0xc1,   0x3,    0x2,    0x2,    0x2,    0xc1,   0xc3,   0x3,
-      0x2,   0x2,    0x2,    0xc2,   0xc0,   0x3,    0x2,    0x2,    0x2,
-      0xc3,  0xc5,   0x7,    0x43,   0x2,    0x2,    0xc4,   0xb6,   0x3,
-      0x2,   0x2,    0x2,    0xc4,   0xc5,   0x3,    0x2,    0x2,    0x2,
-      0xc5,  0x9,    0x3,    0x2,    0x2,    0x2,    0xc6,   0xc8,   0x7,
-      0x3,   0x2,    0x2,    0xc7,   0xc9,   0x5,    0x2,    0x2,    0x2,
-      0xc8,  0xc7,   0x3,    0x2,    0x2,    0x2,    0xc8,   0xc9,   0x3,
-      0x2,   0x2,    0x2,    0xc9,   0xce,   0x3,    0x2,    0x2,    0x2,
-      0xca,  0xcb,   0x7,    0x6,    0x2,    0x2,    0xcb,   0xcd,   0x5,
-      0x2,   0x2,    0x2,    0xcc,   0xca,   0x3,    0x2,    0x2,    0x2,
-      0xcd,  0xd0,   0x3,    0x2,    0x2,    0x2,    0xce,   0xcc,   0x3,
-      0x2,   0x2,    0x2,    0xce,   0xcf,   0x3,    0x2,    0x2,    0x2,
-      0xcf,  0xd3,   0x3,    0x2,    0x2,    0x2,    0xd0,   0xce,   0x3,
-      0x2,   0x2,    0x2,    0xd1,   0xd2,   0x7,    0x6,    0x2,    0x2,
-      0xd2,  0xd4,   0x7,    0x48,   0x2,    0x2,    0xd3,   0xd1,   0x3,
-      0x2,   0x2,    0x2,    0xd3,   0xd4,   0x3,    0x2,    0x2,    0x2,
-      0xd4,  0xd5,   0x3,    0x2,    0x2,    0x2,    0xd5,   0xda,   0x7,
-      0x4,   0x2,    0x2,    0xd6,   0xd7,   0x7,    0x3,    0x2,    0x2,
-      0xd7,  0xd8,   0x7,    0x48,   0x2,    0x2,    0xd8,   0xda,   0x7,
-      0x4,   0x2,    0x2,    0xd9,   0xc6,   0x3,    0x2,    0x2,    0x2,
-      0xd9,  0xd6,   0x3,    0x2,    0x2,    0x2,    0xda,   0xb,    0x3,
-      0x2,   0x2,    0x2,    0xdb,   0xe0,   0x7,    0x4e,   0x2,    0x2,
-      0xdc,  0xdd,   0x7,    0x3,    0x2,    0x2,    0xdd,   0xde,   0x5,
-      0x4,   0x3,    0x2,    0xde,   0xdf,   0x7,    0x4,    0x2,    0x2,
-      0xdf,  0xe1,   0x3,    0x2,    0x2,    0x2,    0xe0,   0xdc,   0x3,
-      0x2,   0x2,    0x2,    0xe0,   0xe1,   0x3,    0x2,    0x2,    0x2,
-      0xe1,  0xd,    0x3,    0x2,    0x2,    0x2,    0xe2,   0xe3,   0x7,
-      0x7,   0x2,    0x2,    0xe3,   0xe5,   0x5,    0x2,    0x2,    0x2,
-      0xe4,  0xe2,   0x3,    0x2,    0x2,    0x2,    0xe4,   0xe5,   0x3,
-      0x2,   0x2,    0x2,    0xe5,   0xf,    0x3,    0x2,    0x2,    0x2,
-      0xe6,  0xe7,   0x7,    0x29,   0x2,    0x2,    0xe7,   0xec,   0x5,
-      0xc,   0x7,    0x2,    0xe8,   0xe9,   0x7,    0x6,    0x2,    0x2,
-      0xe9,  0xeb,   0x5,    0xc,    0x7,    0x2,    0xea,   0xe8,   0x3,
-      0x2,   0x2,    0x2,    0xeb,   0xee,   0x3,    0x2,    0x2,    0x2,
-      0xec,  0xea,   0x3,    0x2,    0x2,    0x2,    0xec,   0xed,   0x3,
-      0x2,   0x2,    0x2,    0xed,   0xf0,   0x3,    0x2,    0x2,    0x2,
-      0xee,  0xec,   0x3,    0x2,    0x2,    0x2,    0xef,   0xe6,   0x3,
-      0x2,   0x2,    0x2,    0xef,   0xf0,   0x3,    0x2,    0x2,    0x2,
-      0xf0,  0x11,   0x3,    0x2,    0x2,    0x2,    0xf1,   0xf2,   0x7,
-      0x26,  0x2,    0x2,    0xf2,   0xf7,   0x7,    0x4e,   0x2,    0x2,
-      0xf3,  0xf4,   0x7,    0x6,    0x2,    0x2,    0xf4,   0xf6,   0x7,
-      0x4e,  0x2,    0x2,    0xf5,   0xf3,   0x3,    0x2,    0x2,    0x2,
-      0xf6,  0xf9,   0x3,    0x2,    0x2,    0x2,    0xf7,   0xf5,   0x3,
-      0x2,   0x2,    0x2,    0xf7,   0xf8,   0x3,    0x2,    0x2,    0x2,
-      0xf8,  0xfb,   0x3,    0x2,    0x2,    0x2,    0xf9,   0xf7,   0x3,
-      0x2,   0x2,    0x2,    0xfa,   0xf1,   0x3,    0x2,    0x2,    0x2,
-      0xfa,  0xfb,   0x3,    0x2,    0x2,    0x2,    0xfb,   0x13,   0x3,
-      0x2,   0x2,    0x2,    0xfc,   0xfd,   0x7,    0x4e,   0x2,    0x2,
-      0xfd,  0xff,   0x7,    0x7,    0x2,    0x2,    0xfe,   0x100,  0x5,
-      0x2,   0x2,    0x2,    0xff,   0xfe,   0x3,    0x2,    0x2,    0x2,
-      0xff,  0x100,  0x3,    0x2,    0x2,    0x2,    0x100,  0x15,   0x3,
-      0x2,   0x2,    0x2,    0x101,  0x103,  0x7,    0x3,    0x2,    0x2,
-      0x102, 0x104,  0x5,    0x14,   0xb,    0x2,    0x103,  0x102,  0x3,
-      0x2,   0x2,    0x2,    0x103,  0x104,  0x3,    0x2,    0x2,    0x2,
-      0x104, 0x109,  0x3,    0x2,    0x2,    0x2,    0x105,  0x106,  0x7,
-      0x6,   0x2,    0x2,    0x106,  0x108,  0x5,    0x14,   0xb,    0x2,
-      0x107, 0x105,  0x3,    0x2,    0x2,    0x2,    0x108,  0x10b,  0x3,
-      0x2,   0x2,    0x2,    0x109,  0x107,  0x3,    0x2,    0x2,    0x2,
-      0x109, 0x10a,  0x3,    0x2,    0x2,    0x2,    0x10a,  0x10c,  0x3,
-      0x2,   0x2,    0x2,    0x10b,  0x109,  0x3,    0x2,    0x2,    0x2,
-      0x10c, 0x117,  0x7,    0x4,    0x2,    0x2,    0x10d,  0x10e,  0x7,
-      0x3,   0x2,    0x2,    0x10e,  0x10f,  0x5,    0x14,   0xb,    0x2,
-      0x10f, 0x110,  0x7,    0x6,    0x2,    0x2,    0x110,  0x111,  0x5,
-      0x14,  0xb,    0x2,    0x111,  0x112,  0x7,    0x6,    0x2,    0x2,
-      0x112, 0x113,  0x7,    0x48,   0x2,    0x2,    0x113,  0x114,  0x7,
-      0x4e,  0x2,    0x2,    0x114,  0x115,  0x7,    0x4,    0x2,    0x2,
-      0x115, 0x117,  0x3,    0x2,    0x2,    0x2,    0x116,  0x101,  0x3,
-      0x2,   0x2,    0x2,    0x116,  0x10d,  0x3,    0x2,    0x2,    0x2,
-      0x117, 0x17,   0x3,    0x2,    0x2,    0x2,    0x118,  0x11a,  0x7,
-      0x4e,  0x2,    0x2,    0x119,  0x11b,  0x5,    0x16,   0xc,    0x2,
-      0x11a, 0x119,  0x3,    0x2,    0x2,    0x2,    0x11a,  0x11b,  0x3,
-      0x2,   0x2,    0x2,    0x11b,  0x19,   0x3,    0x2,    0x2,    0x2,
-      0x11c, 0x11d,  0x5,    0x1c,   0xf,    0x2,    0x11d,  0x1b,   0x3,
-      0x2,   0x2,    0x2,    0x11e,  0x11f,  0x8,    0xf,    0x1,    0x2,
-      0x11f, 0x120,  0x5,    0x1e,   0x10,   0x2,    0x120,  0x129,  0x3,
-      0x2,   0x2,    0x2,    0x121,  0x122,  0xc,    0x3,    0x2,    0x2,
-      0x122, 0x123,  0x7,    0x9,    0x2,    0x2,    0x123,  0x124,  0x5,
-      0x1e,  0x10,   0x2,    0x124,  0x125,  0x7,    0x7,    0x2,    0x2,
-      0x125, 0x126,  0x5,    0x1e,   0x10,   0x2,    0x126,  0x128,  0x3,
-      0x2,   0x2,    0x2,    0x127,  0x121,  0x3,    0x2,    0x2,    0x2,
-      0x128, 0x12b,  0x3,    0x2,    0x2,    0x2,    0x129,  0x127,  0x3,
-      0x2,   0x2,    0x2,    0x129,  0x12a,  0x3,    0x2,    0x2,    0x2,
-      0x12a, 0x1d,   0x3,    0x2,    0x2,    0x2,    0x12b,  0x129,  0x3,
-      0x2,   0x2,    0x2,    0x12c,  0x12d,  0x8,    0x10,   0x1,    0x2,
-      0x12d, 0x12e,  0x5,    0x20,   0x11,   0x2,    0x12e,  0x134,  0x3,
-      0x2,   0x2,    0x2,    0x12f,  0x130,  0xc,    0x3,    0x2,    0x2,
-      0x130, 0x131,  0x7,    0xa,    0x2,    0x2,    0x131,  0x133,  0x5,
-      0x20,  0x11,   0x2,    0x132,  0x12f,  0x3,    0x2,    0x2,    0x2,
-      0x133, 0x136,  0x3,    0x2,    0x2,    0x2,    0x134,  0x132,  0x3,
-      0x2,   0x2,    0x2,    0x134,  0x135,  0x3,    0x2,    0x2,    0x2,
-      0x135, 0x1f,   0x3,    0x2,    0x2,    0x2,    0x136,  0x134,  0x3,
-      0x2,   0x2,    0x2,    0x137,  0x138,  0x8,    0x11,   0x1,    0x2,
-      0x138, 0x139,  0x5,    0x22,   0x12,   0x2,    0x139,  0x13f,  0x3,
-      0x2,   0x2,    0x2,    0x13a,  0x13b,  0xc,    0x3,    0x2,    0x2,
-      0x13b, 0x13c,  0x7,    0xb,    0x2,    0x2,    0x13c,  0x13e,  0x5,
-      0x22,  0x12,   0x2,    0x13d,  0x13a,  0x3,    0x2,    0x2,    0x2,
-      0x13e, 0x141,  0x3,    0x2,    0x2,    0x2,    0x13f,  0x13d,  0x3,
-      0x2,   0x2,    0x2,    0x13f,  0x140,  0x3,    0x2,    0x2,    0x2,
-      0x140, 0x21,   0x3,    0x2,    0x2,    0x2,    0x141,  0x13f,  0x3,
-      0x2,   0x2,    0x2,    0x142,  0x143,  0x8,    0x12,   0x1,    0x2,
-      0x143, 0x144,  0x5,    0x24,   0x13,   0x2,    0x144,  0x14a,  0x3,
-      0x2,   0x2,    0x2,    0x145,  0x146,  0xc,    0x3,    0x2,    0x2,
-      0x146, 0x147,  0x9,    0x2,    0x2,    0x2,    0x147,  0x149,  0x5,
-      0x24,  0x13,   0x2,    0x148,  0x145,  0x3,    0x2,    0x2,    0x2,
-      0x149, 0x14c,  0x3,    0x2,    0x2,    0x2,    0x14a,  0x148,  0x3,
-      0x2,   0x2,    0x2,    0x14a,  0x14b,  0x3,    0x2,    0x2,    0x2,
-      0x14b, 0x23,   0x3,    0x2,    0x2,    0x2,    0x14c,  0x14a,  0x3,
-      0x2,   0x2,    0x2,    0x14d,  0x14e,  0x8,    0x13,   0x1,    0x2,
-      0x14e, 0x14f,  0x5,    0x26,   0x14,   0x2,    0x14f,  0x155,  0x3,
-      0x2,   0x2,    0x2,    0x150,  0x151,  0xc,    0x3,    0x2,    0x2,
-      0x151, 0x152,  0x9,    0x3,    0x2,    0x2,    0x152,  0x154,  0x5,
-      0x26,  0x14,   0x2,    0x153,  0x150,  0x3,    0x2,    0x2,    0x2,
-      0x154, 0x157,  0x3,    0x2,    0x2,    0x2,    0x155,  0x153,  0x3,
-      0x2,   0x2,    0x2,    0x155,  0x156,  0x3,    0x2,    0x2,    0x2,
-      0x156, 0x25,   0x3,    0x2,    0x2,    0x2,    0x157,  0x155,  0x3,
-      0x2,   0x2,    0x2,    0x158,  0x159,  0x8,    0x14,   0x1,    0x2,
-      0x159, 0x15a,  0x5,    0x28,   0x15,   0x2,    0x15a,  0x160,  0x3,
-      0x2,   0x2,    0x2,    0x15b,  0x15c,  0xc,    0x3,    0x2,    0x2,
-      0x15c, 0x15d,  0x9,    0x4,    0x2,    0x2,    0x15d,  0x15f,  0x5,
-      0x28,  0x15,   0x2,    0x15e,  0x15b,  0x3,    0x2,    0x2,    0x2,
-      0x15f, 0x162,  0x3,    0x2,    0x2,    0x2,    0x160,  0x15e,  0x3,
-      0x2,   0x2,    0x2,    0x160,  0x161,  0x3,    0x2,    0x2,    0x2,
-      0x161, 0x27,   0x3,    0x2,    0x2,    0x2,    0x162,  0x160,  0x3,
-      0x2,   0x2,    0x2,    0x163,  0x164,  0x8,    0x15,   0x1,    0x2,
-      0x164, 0x165,  0x5,    0x2a,   0x16,   0x2,    0x165,  0x16b,  0x3,
-      0x2,   0x2,    0x2,    0x166,  0x167,  0xc,    0x3,    0x2,    0x2,
-      0x167, 0x168,  0x9,    0x5,    0x2,    0x2,    0x168,  0x16a,  0x5,
-      0x2a,  0x16,   0x2,    0x169,  0x166,  0x3,    0x2,    0x2,    0x2,
-      0x16a, 0x16d,  0x3,    0x2,    0x2,    0x2,    0x16b,  0x169,  0x3,
-      0x2,   0x2,    0x2,    0x16b,  0x16c,  0x3,    0x2,    0x2,    0x2,
-      0x16c, 0x29,   0x3,    0x2,    0x2,    0x2,    0x16d,  0x16b,  0x3,
-      0x2,   0x2,    0x2,    0x16e,  0x16f,  0x8,    0x16,   0x1,    0x2,
-      0x16f, 0x170,  0x5,    0x2c,   0x17,   0x2,    0x170,  0x176,  0x3,
-      0x2,   0x2,    0x2,    0x171,  0x172,  0xc,    0x3,    0x2,    0x2,
-      0x172, 0x173,  0x9,    0x6,    0x2,    0x2,    0x173,  0x175,  0x5,
-      0x2c,  0x17,   0x2,    0x174,  0x171,  0x3,    0x2,    0x2,    0x2,
-      0x175, 0x178,  0x3,    0x2,    0x2,    0x2,    0x176,  0x174,  0x3,
-      0x2,   0x2,    0x2,    0x176,  0x177,  0x3,    0x2,    0x2,    0x2,
-      0x177, 0x2b,   0x3,    0x2,    0x2,    0x2,    0x178,  0x176,  0x3,
-      0x2,   0x2,    0x2,    0x179,  0x17a,  0x8,    0x17,   0x1,    0x2,
-      0x17a, 0x17b,  0x5,    0x2e,   0x18,   0x2,    0x17b,  0x181,  0x3,
-      0x2,   0x2,    0x2,    0x17c,  0x17d,  0xc,    0x3,    0x2,    0x2,
-      0x17d, 0x17e,  0x9,    0x7,    0x2,    0x2,    0x17e,  0x180,  0x5,
-      0x2e,  0x18,   0x2,    0x17f,  0x17c,  0x3,    0x2,    0x2,    0x2,
-      0x180, 0x183,  0x3,    0x2,    0x2,    0x2,    0x181,  0x17f,  0x3,
-      0x2,   0x2,    0x2,    0x181,  0x182,  0x3,    0x2,    0x2,    0x2,
-      0x182, 0x2d,   0x3,    0x2,    0x2,    0x2,    0x183,  0x181,  0x3,
-      0x2,   0x2,    0x2,    0x184,  0x188,  0x5,    0x36,   0x1c,   0x2,
-      0x185, 0x186,  0x9,    0x8,    0x2,    0x2,    0x186,  0x188,  0x5,
-      0x2e,  0x18,   0x2,    0x187,  0x184,  0x3,    0x2,    0x2,    0x2,
-      0x187, 0x185,  0x3,    0x2,    0x2,    0x2,    0x188,  0x2f,   0x3,
-      0x2,   0x2,    0x2,    0x189,  0x18a,  0x8,    0x19,   0x1,    0x2,
-      0x18a, 0x18c,  0x7,    0x4e,   0x2,    0x2,    0x18b,  0x18d,  0x5,
-      0x6,   0x4,    0x2,    0x18c,  0x18b,  0x3,    0x2,    0x2,    0x2,
-      0x18c, 0x18d,  0x3,    0x2,    0x2,    0x2,    0x18d,  0x198,  0x3,
-      0x2,   0x2,    0x2,    0x18e,  0x18f,  0xc,    0x4,    0x2,    0x2,
-      0x18f, 0x190,  0x7,    0xc,    0x2,    0x2,    0x190,  0x197,  0x7,
-      0x4e,  0x2,    0x2,    0x191,  0x192,  0xc,    0x3,    0x2,    0x2,
-      0x192, 0x193,  0x7,    0xd,    0x2,    0x2,    0x193,  0x194,  0x5,
-      0x1a,  0xe,    0x2,    0x194,  0x195,  0x7,    0xe,    0x2,    0x2,
-      0x195, 0x197,  0x3,    0x2,    0x2,    0x2,    0x196,  0x18e,  0x3,
-      0x2,   0x2,    0x2,    0x196,  0x191,  0x3,    0x2,    0x2,    0x2,
-      0x197, 0x19a,  0x3,    0x2,    0x2,    0x2,    0x198,  0x196,  0x3,
-      0x2,   0x2,    0x2,    0x198,  0x199,  0x3,    0x2,    0x2,    0x2,
-      0x199, 0x31,   0x3,    0x2,    0x2,    0x2,    0x19a,  0x198,  0x3,
-      0x2,   0x2,    0x2,    0x19b,  0x19c,  0x7,    0x4a,   0x2,    0x2,
-      0x19c, 0x1a6,  0x5,    0x30,   0x19,   0x2,    0x19d,  0x19e,  0x7,
-      0x4b,  0x2,    0x2,    0x19e,  0x1a6,  0x5,    0x30,   0x19,   0x2,
-      0x19f, 0x1a0,  0x5,    0x30,   0x19,   0x2,    0x1a0,  0x1a1,  0x7,
-      0x4a,  0x2,    0x2,    0x1a1,  0x1a6,  0x3,    0x2,    0x2,    0x2,
-      0x1a2, 0x1a3,  0x5,    0x30,   0x19,   0x2,    0x1a3,  0x1a4,  0x7,
-      0x4b,  0x2,    0x2,    0x1a4,  0x1a6,  0x3,    0x2,    0x2,    0x2,
-      0x1a5, 0x19b,  0x3,    0x2,    0x2,    0x2,    0x1a5,  0x19d,  0x3,
-      0x2,   0x2,    0x2,    0x1a5,  0x19f,  0x3,    0x2,    0x2,    0x2,
-      0x1a5, 0x1a2,  0x3,    0x2,    0x2,    0x2,    0x1a6,  0x33,   0x3,
-      0x2,   0x2,    0x2,    0x1a7,  0x1ae,  0x5,    0x32,   0x1a,   0x2,
-      0x1a8, 0x1ab,  0x5,    0x30,   0x19,   0x2,    0x1a9,  0x1aa,  0x9,
-      0x9,   0x2,    0x2,    0x1aa,  0x1ac,  0x5,    0x1a,   0xe,    0x2,
-      0x1ab, 0x1a9,  0x3,    0x2,    0x2,    0x2,    0x1ab,  0x1ac,  0x3,
-      0x2,   0x2,    0x2,    0x1ac,  0x1ae,  0x3,    0x2,    0x2,    0x2,
-      0x1ad, 0x1a7,  0x3,    0x2,    0x2,    0x2,    0x1ad,  0x1a8,  0x3,
-      0x2,   0x2,    0x2,    0x1ae,  0x35,   0x3,    0x2,    0x2,    0x2,
-      0x1af, 0x1b2,  0x5,    0x38,   0x1d,   0x2,    0x1b0,  0x1b2,  0x5,
-      0x34,  0x1b,   0x2,    0x1b1,  0x1af,  0x3,    0x2,    0x2,    0x2,
-      0x1b1, 0x1b0,  0x3,    0x2,    0x2,    0x2,    0x1b2,  0x37,   0x3,
-      0x2,   0x2,    0x2,    0x1b3,  0x1bb,  0x5,    0x48,   0x25,   0x2,
-      0x1b4, 0x1bb,  0x7,    0x52,   0x2,    0x2,    0x1b5,  0x1bb,  0x7,
-      0x4d,  0x2,    0x2,    0x1b6,  0x1b7,  0x7,    0x3,    0x2,    0x2,
-      0x1b7, 0x1b8,  0x5,    0x1a,   0xe,    0x2,    0x1b8,  0x1b9,  0x7,
-      0x4,   0x2,    0x2,    0x1b9,  0x1bb,  0x3,    0x2,    0x2,    0x2,
-      0x1ba, 0x1b3,  0x3,    0x2,    0x2,    0x2,    0x1ba,  0x1b4,  0x3,
-      0x2,   0x2,    0x2,    0x1ba,  0x1b5,  0x3,    0x2,    0x2,    0x2,
-      0x1ba, 0x1b6,  0x3,    0x2,    0x2,    0x2,    0x1bb,  0x39,   0x3,
-      0x2,   0x2,    0x2,    0x1bc,  0x1be,  0x5,    0x4e,   0x28,   0x2,
-      0x1bd, 0x1bc,  0x3,    0x2,    0x2,    0x2,    0x1bd,  0x1be,  0x3,
-      0x2,   0x2,    0x2,    0x1be,  0x3b,   0x3,    0x2,    0x2,    0x2,
-      0x1bf, 0x1c0,  0x7,    0x1f,   0x2,    0x2,    0x1c0,  0x1c1,  0x7,
-      0x3,   0x2,    0x2,    0x1c1,  0x1c2,  0x5,    0x3a,   0x1e,   0x2,
-      0x1c2, 0x1c3,  0x7,    0xf,    0x2,    0x2,    0x1c3,  0x1c4,  0x5,
-      0x1a,  0xe,    0x2,    0x1c4,  0x1c5,  0x7,    0xf,    0x2,    0x2,
-      0x1c5, 0x1c6,  0x5,    0x34,   0x1b,   0x2,    0x1c6,  0x1c7,  0x7,
-      0x4,   0x2,    0x2,    0x1c7,  0x1c8,  0x5,    0x6c,   0x37,   0x2,
-      0x1c8, 0x3d,   0x3,    0x2,    0x2,    0x2,    0x1c9,  0x1cb,  0x7,
-      0xd,   0x2,    0x2,    0x1ca,  0x1cc,  0x5,    0x1a,   0xe,    0x2,
-      0x1cb, 0x1ca,  0x3,    0x2,    0x2,    0x2,    0x1cb,  0x1cc,  0x3,
-      0x2,   0x2,    0x2,    0x1cc,  0x1cd,  0x3,    0x2,    0x2,    0x2,
-      0x1cd, 0x1cf,  0x7,    0x7,    0x2,    0x2,    0x1ce,  0x1d0,  0x5,
-      0x1a,  0xe,    0x2,    0x1cf,  0x1ce,  0x3,    0x2,    0x2,    0x2,
-      0x1cf, 0x1d0,  0x3,    0x2,    0x2,    0x2,    0x1d0,  0x1d1,  0x3,
-      0x2,   0x2,    0x2,    0x1d1,  0x1d2,  0x7,    0xe,    0x2,    0x2,
-      0x1d2, 0x3f,   0x3,    0x2,    0x2,    0x2,    0x1d3,  0x1d5,  0x5,
-      0x3e,  0x20,   0x2,    0x1d4,  0x1d3,  0x3,    0x2,    0x2,    0x2,
-      0x1d4, 0x1d5,  0x3,    0x2,    0x2,    0x2,    0x1d5,  0x41,   0x3,
-      0x2,   0x2,    0x2,    0x1d6,  0x1d7,  0x7,    0x1f,   0x2,    0x2,
-      0x1d7, 0x1d8,  0x7,    0x3,    0x2,    0x2,    0x1d8,  0x1d9,  0x5,
-      0x4c,  0x27,   0x2,    0x1d9,  0x1da,  0x7,    0x10,   0x2,    0x2,
-      0x1da, 0x1db,  0x5,    0x1a,   0xe,    0x2,    0x1db,  0x1dc,  0x5,
-      0x40,  0x21,   0x2,    0x1dc,  0x1dd,  0x7,    0x4,    0x2,    0x2,
-      0x1dd, 0x1de,  0x5,    0x6c,   0x37,   0x2,    0x1de,  0x43,   0x3,
-      0x2,   0x2,    0x2,    0x1df,  0x1e0,  0x5,    0x1a,   0xe,    0x2,
-      0x1e0, 0x45,   0x3,    0x2,    0x2,    0x2,    0x1e1,  0x1e3,  0x7,
-      0x3,   0x2,    0x2,    0x1e2,  0x1e4,  0x5,    0x44,   0x23,   0x2,
-      0x1e3, 0x1e2,  0x3,    0x2,    0x2,    0x2,    0x1e3,  0x1e4,  0x3,
-      0x2,   0x2,    0x2,    0x1e4,  0x1e9,  0x3,    0x2,    0x2,    0x2,
-      0x1e5, 0x1e6,  0x7,    0x6,    0x2,    0x2,    0x1e6,  0x1e8,  0x5,
-      0x44,  0x23,   0x2,    0x1e7,  0x1e5,  0x3,    0x2,    0x2,    0x2,
-      0x1e8, 0x1eb,  0x3,    0x2,    0x2,    0x2,    0x1e9,  0x1e7,  0x3,
-      0x2,   0x2,    0x2,    0x1e9,  0x1ea,  0x3,    0x2,    0x2,    0x2,
-      0x1ea, 0x1ec,  0x3,    0x2,    0x2,    0x2,    0x1eb,  0x1e9,  0x3,
-      0x2,   0x2,    0x2,    0x1ec,  0x1ed,  0x7,    0x4,    0x2,    0x2,
-      0x1ed, 0x47,   0x3,    0x2,    0x2,    0x2,    0x1ee,  0x1f0,  0x9,
-      0xa,   0x2,    0x2,    0x1ef,  0x1f1,  0x5,    0x6,    0x4,    0x2,
-      0x1f0, 0x1ef,  0x3,    0x2,    0x2,    0x2,    0x1f0,  0x1f1,  0x3,
-      0x2,   0x2,    0x2,    0x1f1,  0x1f2,  0x3,    0x2,    0x2,    0x2,
-      0x1f2, 0x1f3,  0x5,    0x46,   0x24,   0x2,    0x1f3,  0x1f4,  0x5,
-      0x12,  0xa,    0x2,    0x1f4,  0x49,   0x3,    0x2,    0x2,    0x2,
-      0x1f5, 0x1f6,  0x7,    0x4e,   0x2,    0x2,    0x1f6,  0x4b,   0x3,
-      0x2,   0x2,    0x2,    0x1f7,  0x1f8,  0x7,    0x2d,   0x2,    0x2,
-      0x1f8, 0x1f9,  0x7,    0x4e,   0x2,    0x2,    0x1f9,  0x1fa,  0x7,
-      0x7,   0x2,    0x2,    0x1fa,  0x1fb,  0x5,    0x2,    0x2,    0x2,
-      0x1fb, 0x4d,   0x3,    0x2,    0x2,    0x2,    0x1fc,  0x1ff,  0x5,
-      0x4c,  0x27,   0x2,    0x1fd,  0x1fe,  0x7,    0x33,   0x2,    0x2,
-      0x1fe, 0x200,  0x5,    0x1a,   0xe,    0x2,    0x1ff,  0x1fd,  0x3,
-      0x2,   0x2,    0x2,    0x1ff,  0x200,  0x3,    0x2,    0x2,    0x2,
-      0x200, 0x4f,   0x3,    0x2,    0x2,    0x2,    0x201,  0x203,  0x7,
-      0x2a,  0x2,    0x2,    0x202,  0x201,  0x3,    0x2,    0x2,    0x2,
-      0x202, 0x203,  0x3,    0x2,    0x2,    0x2,    0x203,  0x204,  0x3,
-      0x2,   0x2,    0x2,    0x204,  0x205,  0x5,    0x48,   0x25,   0x2,
-      0x205, 0x51,   0x3,    0x2,    0x2,    0x2,    0x206,  0x207,  0x5,
-      0x34,  0x1b,   0x2,    0x207,  0x53,   0x3,    0x2,    0x2,    0x2,
-      0x208, 0x20a,  0x7,    0x1e,   0x2,    0x2,    0x209,  0x20b,  0x7,
-      0x22,  0x2,    0x2,    0x20a,  0x209,  0x3,    0x2,    0x2,    0x2,
-      0x20a, 0x20b,  0x3,    0x2,    0x2,    0x2,    0x20b,  0x20c,  0x3,
-      0x2,   0x2,    0x2,    0x20c,  0x20d,  0x7,    0x3,    0x2,    0x2,
-      0x20d, 0x20e,  0x5,    0x1a,   0xe,    0x2,    0x20e,  0x20f,  0x7,
-      0x4,   0x2,    0x2,    0x20f,  0x212,  0x5,    0x6c,   0x37,   0x2,
-      0x210, 0x211,  0x7,    0x11,   0x2,    0x2,    0x211,  0x213,  0x5,
-      0x6c,  0x37,   0x2,    0x212,  0x210,  0x3,    0x2,    0x2,    0x2,
-      0x212, 0x213,  0x3,    0x2,    0x2,    0x2,    0x213,  0x55,   0x3,
-      0x2,   0x2,    0x2,    0x214,  0x215,  0x7,    0x20,   0x2,    0x2,
-      0x215, 0x216,  0x7,    0x3,    0x2,    0x2,    0x216,  0x217,  0x5,
-      0x1a,  0xe,    0x2,    0x217,  0x218,  0x7,    0x4,    0x2,    0x2,
-      0x218, 0x219,  0x5,    0x6c,   0x37,   0x2,    0x219,  0x57,   0x3,
-      0x2,   0x2,    0x2,    0x21a,  0x21c,  0x7,    0x21,   0x2,    0x2,
-      0x21b, 0x21d,  0x5,    0x1a,   0xe,    0x2,    0x21c,  0x21b,  0x3,
-      0x2,   0x2,    0x2,    0x21c,  0x21d,  0x3,    0x2,    0x2,    0x2,
-      0x21d, 0x59,   0x3,    0x2,    0x2,    0x2,    0x21e,  0x21f,  0x7,
-      0x24,  0x2,    0x2,    0x21f,  0x5b,   0x3,    0x2,    0x2,    0x2,
-      0x220, 0x221,  0x7,    0x23,   0x2,    0x2,    0x221,  0x5d,   0x3,
-      0x2,   0x2,    0x2,    0x222,  0x223,  0x7,    0x25,   0x2,    0x2,
-      0x223, 0x225,  0x5,    0x4a,   0x26,   0x2,    0x224,  0x226,  0x5,
-      0x46,  0x24,   0x2,    0x225,  0x224,  0x3,    0x2,    0x2,    0x2,
-      0x225, 0x226,  0x3,    0x2,    0x2,    0x2,    0x226,  0x5f,   0x3,
-      0x2,   0x2,    0x2,    0x227,  0x228,  0x7,    0x28,   0x2,    0x2,
-      0x228, 0x229,  0x5,    0x18,   0xd,    0x2,    0x229,  0x22a,  0x5,
-      0x6c,  0x37,   0x2,    0x22a,  0x61,   0x3,    0x2,    0x2,    0x2,
-      0x22b, 0x22c,  0x7,    0x27,   0x2,    0x2,    0x22c,  0x22e,  0x5,
-      0x6c,  0x37,   0x2,    0x22d,  0x22f,  0x5,    0x60,   0x31,   0x2,
-      0x22e, 0x22d,  0x3,    0x2,    0x2,    0x2,    0x22f,  0x230,  0x3,
-      0x2,   0x2,    0x2,    0x230,  0x22e,  0x3,    0x2,    0x2,    0x2,
-      0x230, 0x231,  0x3,    0x2,    0x2,    0x2,    0x231,  0x63,   0x3,
-      0x2,   0x2,    0x2,    0x232,  0x233,  0x9,    0xb,    0x2,    0x2,
-      0x233, 0x234,  0x7,    0x3,    0x2,    0x2,    0x234,  0x235,  0x5,
-      0x1a,  0xe,    0x2,    0x235,  0x236,  0x7,    0x4,    0x2,    0x2,
-      0x236, 0x23a,  0x3,    0x2,    0x2,    0x2,    0x237,  0x23a,  0x7,
-      0x31,  0x2,    0x2,    0x238,  0x23a,  0x7,    0x32,   0x2,    0x2,
-      0x239, 0x232,  0x3,    0x2,    0x2,    0x2,    0x239,  0x237,  0x3,
-      0x2,   0x2,    0x2,    0x239,  0x238,  0x3,    0x2,    0x2,    0x2,
-      0x23a, 0x65,   0x3,    0x2,    0x2,    0x2,    0x23b,  0x23c,  0x5,
-      0x4e,  0x28,   0x2,    0x23c,  0x23d,  0x7,    0xf,    0x2,    0x2,
-      0x23d, 0x259,  0x3,    0x2,    0x2,    0x2,    0x23e,  0x23f,  0x5,
-      0x50,  0x29,   0x2,    0x23f,  0x240,  0x7,    0xf,    0x2,    0x2,
-      0x240, 0x259,  0x3,    0x2,    0x2,    0x2,    0x241,  0x242,  0x5,
-      0x52,  0x2a,   0x2,    0x242,  0x243,  0x7,    0xf,    0x2,    0x2,
-      0x243, 0x259,  0x3,    0x2,    0x2,    0x2,    0x244,  0x245,  0x5,
-      0x58,  0x2d,   0x2,    0x245,  0x246,  0x7,    0xf,    0x2,    0x2,
-      0x246, 0x259,  0x3,    0x2,    0x2,    0x2,    0x247,  0x248,  0x5,
-      0x5a,  0x2e,   0x2,    0x248,  0x249,  0x7,    0xf,    0x2,    0x2,
-      0x249, 0x259,  0x3,    0x2,    0x2,    0x2,    0x24a,  0x24b,  0x5,
-      0x5c,  0x2f,   0x2,    0x24b,  0x24c,  0x7,    0xf,    0x2,    0x2,
-      0x24c, 0x259,  0x3,    0x2,    0x2,    0x2,    0x24d,  0x24e,  0x5,
-      0x5e,  0x30,   0x2,    0x24e,  0x24f,  0x7,    0xf,    0x2,    0x2,
-      0x24f, 0x259,  0x3,    0x2,    0x2,    0x2,    0x250,  0x259,  0x5,
-      0x54,  0x2b,   0x2,    0x251,  0x252,  0x5,    0x64,   0x33,   0x2,
-      0x252, 0x253,  0x7,    0xf,    0x2,    0x2,    0x253,  0x259,  0x3,
-      0x2,   0x2,    0x2,    0x254,  0x259,  0x5,    0x56,   0x2c,   0x2,
-      0x255, 0x259,  0x5,    0x42,   0x22,   0x2,    0x256,  0x259,  0x5,
-      0x3c,  0x1f,   0x2,    0x257,  0x259,  0x5,    0x62,   0x32,   0x2,
-      0x258, 0x23b,  0x3,    0x2,    0x2,    0x2,    0x258,  0x23e,  0x3,
-      0x2,   0x2,    0x2,    0x258,  0x241,  0x3,    0x2,    0x2,    0x2,
-      0x258, 0x244,  0x3,    0x2,    0x2,    0x2,    0x258,  0x247,  0x3,
-      0x2,   0x2,    0x2,    0x258,  0x24a,  0x3,    0x2,    0x2,    0x2,
-      0x258, 0x24d,  0x3,    0x2,    0x2,    0x2,    0x258,  0x250,  0x3,
-      0x2,   0x2,    0x2,    0x258,  0x251,  0x3,    0x2,    0x2,    0x2,
-      0x258, 0x254,  0x3,    0x2,    0x2,    0x2,    0x258,  0x255,  0x3,
-      0x2,   0x2,    0x2,    0x258,  0x256,  0x3,    0x2,    0x2,    0x2,
-      0x258, 0x257,  0x3,    0x2,    0x2,    0x2,    0x259,  0x67,   0x3,
-      0x2,   0x2,    0x2,    0x25a,  0x25c,  0x5,    0x66,   0x34,   0x2,
-      0x25b, 0x25a,  0x3,    0x2,    0x2,    0x2,    0x25c,  0x25f,  0x3,
-      0x2,   0x2,    0x2,    0x25d,  0x25b,  0x3,    0x2,    0x2,    0x2,
-      0x25d, 0x25e,  0x3,    0x2,    0x2,    0x2,    0x25e,  0x69,   0x3,
-      0x2,   0x2,    0x2,    0x25f,  0x25d,  0x3,    0x2,    0x2,    0x2,
-      0x260, 0x262,  0x7,    0x1d,   0x2,    0x2,    0x261,  0x260,  0x3,
-      0x2,   0x2,    0x2,    0x261,  0x262,  0x3,    0x2,    0x2,    0x2,
-      0x262, 0x263,  0x3,    0x2,    0x2,    0x2,    0x263,  0x264,  0x7,
-      0x12,  0x2,    0x2,    0x264,  0x265,  0x5,    0x68,   0x35,   0x2,
-      0x265, 0x266,  0x7,    0x13,   0x2,    0x2,    0x266,  0x6b,   0x3,
-      0x2,   0x2,    0x2,    0x267,  0x26a,  0x5,    0x66,   0x34,   0x2,
-      0x268, 0x26a,  0x5,    0x6a,   0x36,   0x2,    0x269,  0x267,  0x3,
-      0x2,   0x2,    0x2,    0x269,  0x268,  0x3,    0x2,    0x2,    0x2,
-      0x26a, 0x6d,   0x3,    0x2,    0x2,    0x2,    0x26b,  0x26c,  0x5,
-      0x6a,  0x36,   0x2,    0x26c,  0x6f,   0x3,    0x2,    0x2,    0x2,
-      0x26d, 0x26e,  0x7,    0x14,   0x2,    0x2,    0x26e,  0x26f,  0x7,
-      0x4e,  0x2,    0x2,    0x26f,  0x71,   0x3,    0x2,    0x2,    0x2,
-      0x270, 0x271,  0x7,    0x15,   0x2,    0x2,    0x271,  0x272,  0x7,
-      0x4d,  0x2,    0x2,    0x272,  0x73,   0x3,    0x2,    0x2,    0x2,
-      0x273, 0x274,  0x7,    0x22,   0x2,    0x2,    0x274,  0x275,  0x7,
-      0x4d,  0x2,    0x2,    0x275,  0x75,   0x3,    0x2,    0x2,    0x2,
-      0x276, 0x277,  0x7,    0x8,    0x2,    0x2,    0x277,  0x279,  0x7,
-      0x4e,  0x2,    0x2,    0x278,  0x27a,  0x5,    0x70,   0x39,   0x2,
-      0x279, 0x278,  0x3,    0x2,    0x2,    0x2,    0x279,  0x27a,  0x3,
-      0x2,   0x2,    0x2,    0x27a,  0x27c,  0x3,    0x2,    0x2,    0x2,
-      0x27b, 0x27d,  0x5,    0x72,   0x3a,   0x2,    0x27c,  0x27b,  0x3,
-      0x2,   0x2,    0x2,    0x27c,  0x27d,  0x3,    0x2,    0x2,    0x2,
-      0x27d, 0x27f,  0x3,    0x2,    0x2,    0x2,    0x27e,  0x280,  0x5,
-      0x74,  0x3b,   0x2,    0x27f,  0x27e,  0x3,    0x2,    0x2,    0x2,
-      0x27f, 0x280,  0x3,    0x2,    0x2,    0x2,    0x280,  0x281,  0x3,
-      0x2,   0x2,    0x2,    0x281,  0x282,  0x7,    0xf,    0x2,    0x2,
-      0x282, 0x77,   0x3,    0x2,    0x2,    0x2,    0x283,  0x284,  0x7,
-      0x8,   0x2,    0x2,    0x284,  0x285,  0x7,    0x4e,   0x2,    0x2,
-      0x285, 0x286,  0x7,    0x33,   0x2,    0x2,    0x286,  0x287,  0x5,
-      0x2,   0x2,    0x2,    0x287,  0x288,  0x7,    0xf,    0x2,    0x2,
-      0x288, 0x79,   0x3,    0x2,    0x2,    0x2,    0x289,  0x28b,  0x7,
-      0x2e,  0x2,    0x2,    0x28a,  0x28c,  0x7,    0x1c,   0x2,    0x2,
-      0x28b, 0x28a,  0x3,    0x2,    0x2,    0x2,    0x28b,  0x28c,  0x3,
-      0x2,   0x2,    0x2,    0x28c,  0x28d,  0x3,    0x2,    0x2,    0x2,
-      0x28d, 0x28e,  0x7,    0x19,   0x2,    0x2,    0x28e,  0x28f,  0x7,
-      0x4e,  0x2,    0x2,    0x28f,  0x290,  0x5,    0x8,    0x5,    0x2,
-      0x290, 0x291,  0x7,    0x3,    0x2,    0x2,    0x291,  0x292,  0x5,
-      0x4,   0x3,    0x2,    0x292,  0x293,  0x7,    0x4,    0x2,    0x2,
-      0x293, 0x294,  0x5,    0xe,    0x8,    0x2,    0x294,  0x295,  0x7,
-      0xf,   0x2,    0x2,    0x295,  0x7b,   0x3,    0x2,    0x2,    0x2,
-      0x296, 0x299,  0x7,    0x2e,   0x2,    0x2,    0x297,  0x298,  0x7,
-      0x16,  0x2,    0x2,    0x298,  0x29a,  0x7,    0x4d,   0x2,    0x2,
-      0x299, 0x297,  0x3,    0x2,    0x2,    0x2,    0x299,  0x29a,  0x3,
-      0x2,   0x2,    0x2,    0x29a,  0x29b,  0x3,    0x2,    0x2,    0x2,
-      0x29b, 0x29c,  0x7,    0x18,   0x2,    0x2,    0x29c,  0x29d,  0x7,
-      0x4e,  0x2,    0x2,    0x29d,  0x29e,  0x5,    0x8,    0x5,    0x2,
-      0x29e, 0x29f,  0x5,    0xa,    0x6,    0x2,    0x29f,  0x2a0,  0x5,
-      0xe,   0x8,    0x2,    0x2a0,  0x2a1,  0x5,    0x10,   0x9,    0x2,
-      0x2a1, 0x2a2,  0x7,    0xf,    0x2,    0x2,    0x2a2,  0x7d,   0x3,
-      0x2,   0x2,    0x2,    0x2a3,  0x2a4,  0x7,    0x2e,   0x2,    0x2,
-      0x2a4, 0x2a5,  0x7,    0x1a,   0x2,    0x2,    0x2a5,  0x2a6,  0x7,
-      0x4e,  0x2,    0x2,    0x2a6,  0x2a7,  0x5,    0xa,    0x6,    0x2,
-      0x2a7, 0x2a8,  0x5,    0xe,    0x8,    0x2,    0x2a8,  0x2a9,  0x7,
-      0xf,   0x2,    0x2,    0x2a9,  0x7f,   0x3,    0x2,    0x2,    0x2,
-      0x2aa, 0x2ac,  0x7,    0x1c,   0x2,    0x2,    0x2ab,  0x2aa,  0x3,
-      0x2,   0x2,    0x2,    0x2ab,  0x2ac,  0x3,    0x2,    0x2,    0x2,
-      0x2ac, 0x2ad,  0x3,    0x2,    0x2,    0x2,    0x2ad,  0x2ae,  0x7,
-      0x19,  0x2,    0x2,    0x2ae,  0x2af,  0x7,    0x4e,   0x2,    0x2,
-      0x2af, 0x2b0,  0x5,    0x8,    0x5,    0x2,    0x2b0,  0x2b1,  0x5,
-      0x16,  0xc,    0x2,    0x2b1,  0x2b4,  0x5,    0xe,    0x8,    0x2,
-      0x2b2, 0x2b5,  0x5,    0x6e,   0x38,   0x2,    0x2b3,  0x2b5,  0x7,
-      0xf,   0x2,    0x2,    0x2b4,  0x2b2,  0x3,    0x2,    0x2,    0x2,
-      0x2b4, 0x2b3,  0x3,    0x2,    0x2,    0x2,    0x2b5,  0x81,   0x3,
-      0x2,   0x2,    0x2,    0x2b6,  0x2b7,  0x7,    0x4e,   0x2,    0x2,
-      0x2b7, 0x2b8,  0x5,    0x6,    0x4,    0x2,    0x2b8,  0x2b9,  0x5,
-      0x16,  0xc,    0x2,    0x2b9,  0x2ba,  0x5,    0xe,    0x8,    0x2,
-      0x2ba, 0x2bb,  0x5,    0x10,   0x9,    0x2,    0x2bb,  0x2bc,  0x5,
-      0x6e,  0x38,   0x2,    0x2bc,  0x83,   0x3,    0x2,    0x2,    0x2,
-      0x2bd, 0x2be,  0x7,    0x16,   0x2,    0x2,    0x2be,  0x2c0,  0x7,
-      0x4d,  0x2,    0x2,    0x2bf,  0x2bd,  0x3,    0x2,    0x2,    0x2,
-      0x2bf, 0x2c0,  0x3,    0x2,    0x2,    0x2,    0x2c0,  0x2c1,  0x3,
-      0x2,   0x2,    0x2,    0x2c1,  0x2c2,  0x7,    0x18,   0x2,    0x2,
-      0x2c2, 0x2c3,  0x7,    0x4e,   0x2,    0x2,    0x2c3,  0x2c4,  0x5,
-      0x8,   0x5,    0x2,    0x2c4,  0x2c5,  0x5,    0x16,   0xc,    0x2,
-      0x2c5, 0x2c6,  0x5,    0xe,    0x8,    0x2,    0x2c6,  0x2c9,  0x5,
-      0x10,  0x9,    0x2,    0x2c7,  0x2ca,  0x5,    0x6e,   0x38,   0x2,
-      0x2c8, 0x2ca,  0x7,    0xf,    0x2,    0x2,    0x2c9,  0x2c7,  0x3,
-      0x2,   0x2,    0x2,    0x2c9,  0x2c8,  0x3,    0x2,    0x2,    0x2,
-      0x2ca, 0x85,   0x3,    0x2,    0x2,    0x2,    0x2cb,  0x2cc,  0x7,
-      0x17,  0x2,    0x2,    0x2cc,  0x2cd,  0x7,    0x4e,   0x2,    0x2,
-      0x2cd, 0x2ce,  0x7,    0x7,    0x2,    0x2,    0x2ce,  0x2cf,  0x5,
-      0x2,   0x2,    0x2,    0x2cf,  0x2d0,  0x5,    0x72,   0x3a,   0x2,
-      0x2d0, 0x2d1,  0x7,    0xf,    0x2,    0x2,    0x2d1,  0x87,   0x3,
-      0x2,   0x2,    0x2,    0x2d2,  0x2dc,  0x5,    0x76,   0x3c,   0x2,
-      0x2d3, 0x2dc,  0x5,    0x78,   0x3d,   0x2,    0x2d4,  0x2dc,  0x5,
-      0x80,  0x41,   0x2,    0x2d5,  0x2dc,  0x5,    0x82,   0x42,   0x2,
-      0x2d6, 0x2dc,  0x5,    0x84,   0x43,   0x2,    0x2d7,  0x2dc,  0x5,
-      0x7c,  0x3f,   0x2,    0x2d8,  0x2dc,  0x5,    0x7a,   0x3e,   0x2,
-      0x2d9, 0x2dc,  0x5,    0x7e,   0x40,   0x2,    0x2da,  0x2dc,  0x5,
-      0x86,  0x44,   0x2,    0x2db,  0x2d2,  0x3,    0x2,    0x2,    0x2,
-      0x2db, 0x2d3,  0x3,    0x2,    0x2,    0x2,    0x2db,  0x2d4,  0x3,
-      0x2,   0x2,    0x2,    0x2db,  0x2d5,  0x3,    0x2,    0x2,    0x2,
-      0x2db, 0x2d6,  0x3,    0x2,    0x2,    0x2,    0x2db,  0x2d7,  0x3,
-      0x2,   0x2,    0x2,    0x2db,  0x2d8,  0x3,    0x2,    0x2,    0x2,
-      0x2db, 0x2d9,  0x3,    0x2,    0x2,    0x2,    0x2db,  0x2da,  0x3,
-      0x2,   0x2,    0x2,    0x2dc,  0x89,   0x3,    0x2,    0x2,    0x2,
-      0x2dd, 0x2de,  0x7,    0x1b,   0x2,    0x2,    0x2de,  0x2df,  0x7,
-      0x4e,  0x2,    0x2,    0x2df,  0x2e3,  0x7,    0x12,   0x2,    0x2,
-      0x2e0, 0x2e2,  0x5,    0x88,   0x45,   0x2,    0x2e1,  0x2e0,  0x3,
-      0x2,   0x2,    0x2,    0x2e2,  0x2e5,  0x3,    0x2,    0x2,    0x2,
-      0x2e3, 0x2e1,  0x3,    0x2,    0x2,    0x2,    0x2e3,  0x2e4,  0x3,
-      0x2,   0x2,    0x2,    0x2e4,  0x2e6,  0x3,    0x2,    0x2,    0x2,
-      0x2e5, 0x2e3,  0x3,    0x2,    0x2,    0x2,    0x2e6,  0x2e7,  0x7,
-      0x13,  0x2,    0x2,    0x2e7,  0x8b,   0x3,    0x2,    0x2,    0x2,
-      0x2e8, 0x2eb,  0x5,    0x8a,   0x46,   0x2,    0x2e9,  0x2eb,  0x5,
-      0x88,  0x45,   0x2,    0x2ea,  0x2e8,  0x3,    0x2,    0x2,    0x2,
-      0x2ea, 0x2e9,  0x3,    0x2,    0x2,    0x2,    0x2eb,  0x2ee,  0x3,
-      0x2,   0x2,    0x2,    0x2ec,  0x2ea,  0x3,    0x2,    0x2,    0x2,
-      0x2ec, 0x2ed,  0x3,    0x2,    0x2,    0x2,    0x2ed,  0x8d,   0x3,
-      0x2,   0x2,    0x2,    0x2ee,  0x2ec,  0x3,    0x2,    0x2,    0x2,
-      0x4a,  0x90,   0x9e,   0xa5,   0xad,   0xb0,   0xc0,   0xc4,   0xc8,
-      0xce,  0xd3,   0xd9,   0xe0,   0xe4,   0xec,   0xef,   0xf7,   0xfa,
-      0xff,  0x103,  0x109,  0x116,  0x11a,  0x129,  0x134,  0x13f,  0x14a,
-      0x155, 0x160,  0x16b,  0x176,  0x181,  0x187,  0x18c,  0x196,  0x198,
-      0x1a5, 0x1ab,  0x1ad,  0x1b1,  0x1ba,  0x1bd,  0x1cb,  0x1cf,  0x1d4,
-      0x1e3, 0x1e9,  0x1f0,  0x1ff,  0x202,  0x20a,  0x212,  0x21c,  0x225,
-      0x230, 0x239,  0x258,  0x25d,  0x261,  0x269,  0x279,  0x27c,  0x27f,
-      0x28b, 0x299,  0x2ab,  0x2b4,  0x2bf,  0x2c9,  0x2db,  0x2e3,  0x2ea,
-      0x2ec,
+      0x45,  0x3,    0x45,   0x3,    0x45,   0x5,    0x45,   0x2ea,  0xa,
+      0x45,  0x3,    0x46,   0x3,    0x46,   0x3,    0x46,   0x3,    0x46,
+      0x3,   0x46,   0x3,    0x46,   0x3,    0x46,   0x3,    0x47,   0x3,
+      0x47,  0x5,    0x47,   0x2f5,  0xa,    0x47,   0x3,    0x47,   0x3,
+      0x47,  0x3,    0x47,   0x3,    0x47,   0x3,    0x47,   0x3,    0x47,
+      0x3,   0x47,   0x3,    0x47,   0x5,    0x47,   0x2ff,  0xa,    0x47,
+      0x3,   0x48,   0x3,    0x48,   0x3,    0x48,   0x3,    0x48,   0x3,
+      0x48,  0x3,    0x48,   0x3,    0x48,   0x3,    0x49,   0x3,    0x49,
+      0x3,   0x49,   0x3,    0x49,   0x3,    0x49,   0x3,    0x49,   0x3,
+      0x49,  0x3,    0x49,   0x3,    0x4a,   0x3,    0x4a,   0x3,    0x4a,
+      0x3,   0x4a,   0x3,    0x4a,   0x3,    0x4a,   0x3,    0x4b,   0x3,
+      0x4b,  0x3,    0x4b,   0x3,    0x4b,   0x3,    0x4b,   0x3,    0x4b,
+      0x3,   0x4b,   0x3,    0x4b,   0x3,    0x4b,   0x3,    0x4b,   0x3,
+      0x4b,  0x5,    0x4b,   0x321,  0xa,    0x4b,   0x3,    0x4c,   0x3,
+      0x4c,  0x3,    0x4c,   0x3,    0x4c,   0x7,    0x4c,   0x327,  0xa,
+      0x4c,  0xc,    0x4c,   0xe,    0x4c,   0x32a,  0xb,    0x4c,   0x3,
+      0x4c,  0x3,    0x4c,   0x3,    0x4d,   0x3,    0x4d,   0x7,    0x4d,
+      0x330, 0xa,    0x4d,   0xc,    0x4d,   0xe,    0x4d,   0x333,  0xb,
+      0x4d,  0x3,    0x4d,   0x2,    0xd,    0x2,    0x1c,   0x1e,   0x20,
+      0x22,  0x24,   0x26,   0x28,   0x2a,   0x2c,   0x30,   0x4e,   0x2,
+      0x4,   0x6,    0x8,    0xa,    0xc,    0xe,    0x10,   0x12,   0x14,
+      0x16,  0x18,   0x1a,   0x1c,   0x1e,   0x20,   0x22,   0x24,   0x26,
+      0x28,  0x2a,   0x2c,   0x2e,   0x30,   0x32,   0x34,   0x36,   0x38,
+      0x3a,  0x3c,   0x3e,   0x40,   0x42,   0x44,   0x46,   0x48,   0x4a,
+      0x4c,  0x4e,   0x50,   0x52,   0x54,   0x56,   0x58,   0x5a,   0x5c,
+      0x5e,  0x60,   0x62,   0x64,   0x66,   0x68,   0x6a,   0x6c,   0x6e,
+      0x70,  0x72,   0x74,   0x76,   0x78,   0x7a,   0x7c,   0x7e,   0x80,
+      0x82,  0x84,   0x86,   0x88,   0x8a,   0x8c,   0x8e,   0x90,   0x92,
+      0x94,  0x96,   0x98,   0x2,    0xd,    0x3,    0x2,    0x3c,   0x3d,
+      0x4,   0x2,    0x36,   0x36,   0x41,   0x41,   0x3,    0x2,    0x42,
+      0x45,  0x3,    0x2,    0x46,   0x48,   0x3,    0x2,    0x37,   0x38,
+      0x3,   0x2,    0x39,   0x3b,   0x5,    0x2,    0x37,   0x38,   0x3e,
+      0x3e,  0x4d,   0x4d,   0x3,    0x2,    0x34,   0x35,   0x4,    0x2,
+      0x3f,  0x40,   0x4f,   0x4f,   0x3,    0x2,    0x2d,   0x2e,   0x3,
+      0x2,   0x30,   0x31,   0x2,    0x351,  0x2,    0xaa,   0x3,    0x2,
+      0x2,   0x2,    0x4,    0xbc,   0x3,    0x2,    0x2,    0x2,    0x6,
+      0xbe,  0x3,    0x2,    0x2,    0x2,    0x8,    0xd0,   0x3,    0x2,
+      0x2,   0x2,    0xa,    0xe5,   0x3,    0x2,    0x2,    0x2,    0xc,
+      0xe7,  0x3,    0x2,    0x2,    0x2,    0xe,    0xf0,   0x3,    0x2,
+      0x2,   0x2,    0x10,   0xfb,   0x3,    0x2,    0x2,    0x2,    0x12,
+      0x106, 0x3,    0x2,    0x2,    0x2,    0x14,   0x108,  0x3,    0x2,
+      0x2,   0x2,    0x16,   0x122,  0x3,    0x2,    0x2,    0x2,    0x18,
+      0x124, 0x3,    0x2,    0x2,    0x2,    0x1a,   0x128,  0x3,    0x2,
+      0x2,   0x2,    0x1c,   0x12a,  0x3,    0x2,    0x2,    0x2,    0x1e,
+      0x138, 0x3,    0x2,    0x2,    0x2,    0x20,   0x143,  0x3,    0x2,
+      0x2,   0x2,    0x22,   0x14e,  0x3,    0x2,    0x2,    0x2,    0x24,
+      0x159, 0x3,    0x2,    0x2,    0x2,    0x26,   0x164,  0x3,    0x2,
+      0x2,   0x2,    0x28,   0x16f,  0x3,    0x2,    0x2,    0x2,    0x2a,
+      0x17a, 0x3,    0x2,    0x2,    0x2,    0x2c,   0x185,  0x3,    0x2,
+      0x2,   0x2,    0x2e,   0x193,  0x3,    0x2,    0x2,    0x2,    0x30,
+      0x1a0, 0x3,    0x2,    0x2,    0x2,    0x32,   0x1b9,  0x3,    0x2,
+      0x2,   0x2,    0x34,   0x1c1,  0x3,    0x2,    0x2,    0x2,    0x36,
+      0x1c5, 0x3,    0x2,    0x2,    0x2,    0x38,   0x1c7,  0x3,    0x2,
+      0x2,   0x2,    0x3a,   0x1da,  0x3,    0x2,    0x2,    0x2,    0x3c,
+      0x1e4, 0x3,    0x2,    0x2,    0x2,    0x3e,   0x1e7,  0x3,    0x2,
+      0x2,   0x2,    0x40,   0x1e9,  0x3,    0x2,    0x2,    0x2,    0x42,
+      0x1f3, 0x3,    0x2,    0x2,    0x2,    0x44,   0x1fe,  0x3,    0x2,
+      0x2,   0x2,    0x46,   0x200,  0x3,    0x2,    0x2,    0x2,    0x48,
+      0x209, 0x3,    0x2,    0x2,    0x2,    0x4a,   0x20b,  0x3,    0x2,
+      0x2,   0x2,    0x4c,   0x218,  0x3,    0x2,    0x2,    0x2,    0x4e,
+      0x21f, 0x3,    0x2,    0x2,    0x2,    0x50,   0x221,  0x3,    0x2,
+      0x2,   0x2,    0x52,   0x226,  0x3,    0x2,    0x2,    0x2,    0x54,
+      0x22c, 0x3,    0x2,    0x2,    0x2,    0x56,   0x230,  0x3,    0x2,
+      0x2,   0x2,    0x58,   0x232,  0x3,    0x2,    0x2,    0x2,    0x5a,
+      0x23e, 0x3,    0x2,    0x2,    0x2,    0x5c,   0x244,  0x3,    0x2,
+      0x2,   0x2,    0x5e,   0x248,  0x3,    0x2,    0x2,    0x2,    0x60,
+      0x24a, 0x3,    0x2,    0x2,    0x2,    0x62,   0x24c,  0x3,    0x2,
+      0x2,   0x2,    0x64,   0x251,  0x3,    0x2,    0x2,    0x2,    0x66,
+      0x255, 0x3,    0x2,    0x2,    0x2,    0x68,   0x263,  0x3,    0x2,
+      0x2,   0x2,    0x6a,   0x282,  0x3,    0x2,    0x2,    0x2,    0x6c,
+      0x287, 0x3,    0x2,    0x2,    0x2,    0x6e,   0x28b,  0x3,    0x2,
+      0x2,   0x2,    0x70,   0x293,  0x3,    0x2,    0x2,    0x2,    0x72,
+      0x295, 0x3,    0x2,    0x2,    0x2,    0x74,   0x297,  0x3,    0x2,
+      0x2,   0x2,    0x76,   0x29f,  0x3,    0x2,    0x2,    0x2,    0x78,
+      0x2a2, 0x3,    0x2,    0x2,    0x2,    0x7a,   0x2a5,  0x3,    0x2,
+      0x2,   0x2,    0x7c,   0x2a8,  0x3,    0x2,    0x2,    0x2,    0x7e,
+      0x2ab, 0x3,    0x2,    0x2,    0x2,    0x80,   0x2b8,  0x3,    0x2,
+      0x2,   0x2,    0x82,   0x2be,  0x3,    0x2,    0x2,    0x2,    0x84,
+      0x2cb, 0x3,    0x2,    0x2,    0x2,    0x86,   0x2d8,  0x3,    0x2,
+      0x2,   0x2,    0x88,   0x2e0,  0x3,    0x2,    0x2,    0x2,    0x8a,
+      0x2eb, 0x3,    0x2,    0x2,    0x2,    0x8c,   0x2f4,  0x3,    0x2,
+      0x2,   0x2,    0x8e,   0x300,  0x3,    0x2,    0x2,    0x2,    0x90,
+      0x307, 0x3,    0x2,    0x2,    0x2,    0x92,   0x30f,  0x3,    0x2,
+      0x2,   0x2,    0x94,   0x320,  0x3,    0x2,    0x2,    0x2,    0x96,
+      0x322, 0x3,    0x2,    0x2,    0x2,    0x98,   0x331,  0x3,    0x2,
+      0x2,   0x2,    0x9a,   0x9c,   0x8,    0x2,    0x1,    0x2,    0x9b,
+      0x9d,  0x7,    0x22,   0x2,    0x2,    0x9c,   0x9b,   0x3,    0x2,
+      0x2,   0x2,    0x9c,   0x9d,   0x3,    0x2,    0x2,    0x2,    0x9d,
+      0x9e,  0x3,    0x2,    0x2,    0x2,    0x9e,   0xab,   0x7,    0x4f,
+      0x2,   0x2,    0x9f,   0xa0,   0x7,    0x19,   0x2,    0x2,    0xa0,
+      0xa1,  0x7,    0x3,    0x2,    0x2,    0xa1,   0xa2,   0x5,    0x4,
+      0x3,   0x2,    0xa2,   0xa3,   0x7,    0x4,    0x2,    0x2,    0xa3,
+      0xa4,  0x7,    0x5,    0x2,    0x2,    0xa4,   0xa5,   0x5,    0x2,
+      0x2,   0x5,    0xa5,   0xab,   0x3,    0x2,    0x2,    0x2,    0xa6,
+      0xa7,  0x7,    0x3,    0x2,    0x2,    0xa7,   0xa8,   0x5,    0x2,
+      0x2,   0x2,    0xa8,   0xa9,   0x7,    0x4,    0x2,    0x2,    0xa9,
+      0xab,  0x3,    0x2,    0x2,    0x2,    0xaa,   0x9a,   0x3,    0x2,
+      0x2,   0x2,    0xaa,   0x9f,   0x3,    0x2,    0x2,    0x2,    0xaa,
+      0xa6,  0x3,    0x2,    0x2,    0x2,    0xab,   0xb1,   0x3,    0x2,
+      0x2,   0x2,    0xac,   0xad,   0xc,    0x4,    0x2,    0x2,    0xad,
+      0xae,  0x7,    0x3c,   0x2,    0x2,    0xae,   0xb0,   0x5,    0x2,
+      0x2,   0x5,    0xaf,   0xac,   0x3,    0x2,    0x2,    0x2,    0xb0,
+      0xb3,  0x3,    0x2,    0x2,    0x2,    0xb1,   0xaf,   0x3,    0x2,
+      0x2,   0x2,    0xb1,   0xb2,   0x3,    0x2,    0x2,    0x2,    0xb2,
+      0x3,   0x3,    0x2,    0x2,    0x2,    0xb3,   0xb1,   0x3,    0x2,
+      0x2,   0x2,    0xb4,   0xb9,   0x5,    0x2,    0x2,    0x2,    0xb5,
+      0xb6,  0x7,    0x6,    0x2,    0x2,    0xb6,   0xb8,   0x5,    0x2,
+      0x2,   0x2,    0xb7,   0xb5,   0x3,    0x2,    0x2,    0x2,    0xb8,
+      0xbb,  0x3,    0x2,    0x2,    0x2,    0xb9,   0xb7,   0x3,    0x2,
+      0x2,   0x2,    0xb9,   0xba,   0x3,    0x2,    0x2,    0x2,    0xba,
+      0xbd,  0x3,    0x2,    0x2,    0x2,    0xbb,   0xb9,   0x3,    0x2,
+      0x2,   0x2,    0xbc,   0xb4,   0x3,    0x2,    0x2,    0x2,    0xbc,
+      0xbd,  0x3,    0x2,    0x2,    0x2,    0xbd,   0x5,    0x3,    0x2,
+      0x2,   0x2,    0xbe,   0xbf,   0x7,    0x42,   0x2,    0x2,    0xbf,
+      0xc0,  0x5,    0x4,    0x3,    0x2,    0xc0,   0xc1,   0x7,    0x44,
+      0x2,   0x2,    0xc1,   0x7,    0x3,    0x2,    0x2,    0x2,    0xc2,
+      0xc3,  0x7,    0x42,   0x2,    0x2,    0xc3,   0xc4,   0x7,    0x4f,
+      0x2,   0x2,    0xc4,   0xc5,   0x7,    0x7,    0x2,    0x2,    0xc5,
+      0xcc,  0x7,    0x8,    0x2,    0x2,    0xc6,   0xc7,   0x7,    0x6,
+      0x2,   0x2,    0xc7,   0xc8,   0x7,    0x4f,   0x2,    0x2,    0xc8,
+      0xc9,  0x7,    0x7,    0x2,    0x2,    0xc9,   0xcb,   0x7,    0x8,
+      0x2,   0x2,    0xca,   0xc6,   0x3,    0x2,    0x2,    0x2,    0xcb,
+      0xce,  0x3,    0x2,    0x2,    0x2,    0xcc,   0xca,   0x3,    0x2,
+      0x2,   0x2,    0xcc,   0xcd,   0x3,    0x2,    0x2,    0x2,    0xcd,
+      0xcf,  0x3,    0x2,    0x2,    0x2,    0xce,   0xcc,   0x3,    0x2,
+      0x2,   0x2,    0xcf,   0xd1,   0x7,    0x44,   0x2,    0x2,    0xd0,
+      0xc2,  0x3,    0x2,    0x2,    0x2,    0xd0,   0xd1,   0x3,    0x2,
+      0x2,   0x2,    0xd1,   0x9,    0x3,    0x2,    0x2,    0x2,    0xd2,
+      0xd4,  0x7,    0x3,    0x2,    0x2,    0xd3,   0xd5,   0x5,    0x2,
+      0x2,   0x2,    0xd4,   0xd3,   0x3,    0x2,    0x2,    0x2,    0xd4,
+      0xd5,  0x3,    0x2,    0x2,    0x2,    0xd5,   0xda,   0x3,    0x2,
+      0x2,   0x2,    0xd6,   0xd7,   0x7,    0x6,    0x2,    0x2,    0xd7,
+      0xd9,  0x5,    0x2,    0x2,    0x2,    0xd8,   0xd6,   0x3,    0x2,
+      0x2,   0x2,    0xd9,   0xdc,   0x3,    0x2,    0x2,    0x2,    0xda,
+      0xd8,  0x3,    0x2,    0x2,    0x2,    0xda,   0xdb,   0x3,    0x2,
+      0x2,   0x2,    0xdb,   0xdf,   0x3,    0x2,    0x2,    0x2,    0xdc,
+      0xda,  0x3,    0x2,    0x2,    0x2,    0xdd,   0xde,   0x7,    0x6,
+      0x2,   0x2,    0xde,   0xe0,   0x7,    0x49,   0x2,    0x2,    0xdf,
+      0xdd,  0x3,    0x2,    0x2,    0x2,    0xdf,   0xe0,   0x3,    0x2,
+      0x2,   0x2,    0xe0,   0xe1,   0x3,    0x2,    0x2,    0x2,    0xe1,
+      0xe6,  0x7,    0x4,    0x2,    0x2,    0xe2,   0xe3,   0x7,    0x3,
+      0x2,   0x2,    0xe3,   0xe4,   0x7,    0x49,   0x2,    0x2,    0xe4,
+      0xe6,  0x7,    0x4,    0x2,    0x2,    0xe5,   0xd2,   0x3,    0x2,
+      0x2,   0x2,    0xe5,   0xe2,   0x3,    0x2,    0x2,    0x2,    0xe6,
+      0xb,   0x3,    0x2,    0x2,    0x2,    0xe7,   0xec,   0x7,    0x4f,
+      0x2,   0x2,    0xe8,   0xe9,   0x7,    0x3,    0x2,    0x2,    0xe9,
+      0xea,  0x5,    0x4,    0x3,    0x2,    0xea,   0xeb,   0x7,    0x4,
+      0x2,   0x2,    0xeb,   0xed,   0x3,    0x2,    0x2,    0x2,    0xec,
+      0xe8,  0x3,    0x2,    0x2,    0x2,    0xec,   0xed,   0x3,    0x2,
+      0x2,   0x2,    0xed,   0xd,    0x3,    0x2,    0x2,    0x2,    0xee,
+      0xef,  0x7,    0x7,    0x2,    0x2,    0xef,   0xf1,   0x5,    0x2,
+      0x2,   0x2,    0xf0,   0xee,   0x3,    0x2,    0x2,    0x2,    0xf0,
+      0xf1,  0x3,    0x2,    0x2,    0x2,    0xf1,   0xf,    0x3,    0x2,
+      0x2,   0x2,    0xf2,   0xf3,   0x7,    0x29,   0x2,    0x2,    0xf3,
+      0xf8,  0x5,    0xc,    0x7,    0x2,    0xf4,   0xf5,   0x7,    0x6,
+      0x2,   0x2,    0xf5,   0xf7,   0x5,    0xc,    0x7,    0x2,    0xf6,
+      0xf4,  0x3,    0x2,    0x2,    0x2,    0xf7,   0xfa,   0x3,    0x2,
+      0x2,   0x2,    0xf8,   0xf6,   0x3,    0x2,    0x2,    0x2,    0xf8,
+      0xf9,  0x3,    0x2,    0x2,    0x2,    0xf9,   0xfc,   0x3,    0x2,
+      0x2,   0x2,    0xfa,   0xf8,   0x3,    0x2,    0x2,    0x2,    0xfb,
+      0xf2,  0x3,    0x2,    0x2,    0x2,    0xfb,   0xfc,   0x3,    0x2,
+      0x2,   0x2,    0xfc,   0x11,   0x3,    0x2,    0x2,    0x2,    0xfd,
+      0xfe,  0x7,    0x26,   0x2,    0x2,    0xfe,   0x103,  0x7,    0x4f,
+      0x2,   0x2,    0xff,   0x100,  0x7,    0x6,    0x2,    0x2,    0x100,
+      0x102, 0x7,    0x4f,   0x2,    0x2,    0x101,  0xff,   0x3,    0x2,
+      0x2,   0x2,    0x102,  0x105,  0x3,    0x2,    0x2,    0x2,    0x103,
+      0x101, 0x3,    0x2,    0x2,    0x2,    0x103,  0x104,  0x3,    0x2,
+      0x2,   0x2,    0x104,  0x107,  0x3,    0x2,    0x2,    0x2,    0x105,
+      0x103, 0x3,    0x2,    0x2,    0x2,    0x106,  0xfd,   0x3,    0x2,
+      0x2,   0x2,    0x106,  0x107,  0x3,    0x2,    0x2,    0x2,    0x107,
+      0x13,  0x3,    0x2,    0x2,    0x2,    0x108,  0x109,  0x7,    0x4f,
+      0x2,   0x2,    0x109,  0x10b,  0x7,    0x7,    0x2,    0x2,    0x10a,
+      0x10c, 0x5,    0x2,    0x2,    0x2,    0x10b,  0x10a,  0x3,    0x2,
+      0x2,   0x2,    0x10b,  0x10c,  0x3,    0x2,    0x2,    0x2,    0x10c,
+      0x15,  0x3,    0x2,    0x2,    0x2,    0x10d,  0x10f,  0x7,    0x3,
+      0x2,   0x2,    0x10e,  0x110,  0x5,    0x14,   0xb,    0x2,    0x10f,
+      0x10e, 0x3,    0x2,    0x2,    0x2,    0x10f,  0x110,  0x3,    0x2,
+      0x2,   0x2,    0x110,  0x115,  0x3,    0x2,    0x2,    0x2,    0x111,
+      0x112, 0x7,    0x6,    0x2,    0x2,    0x112,  0x114,  0x5,    0x14,
+      0xb,   0x2,    0x113,  0x111,  0x3,    0x2,    0x2,    0x2,    0x114,
+      0x117, 0x3,    0x2,    0x2,    0x2,    0x115,  0x113,  0x3,    0x2,
+      0x2,   0x2,    0x115,  0x116,  0x3,    0x2,    0x2,    0x2,    0x116,
+      0x118, 0x3,    0x2,    0x2,    0x2,    0x117,  0x115,  0x3,    0x2,
+      0x2,   0x2,    0x118,  0x123,  0x7,    0x4,    0x2,    0x2,    0x119,
+      0x11a, 0x7,    0x3,    0x2,    0x2,    0x11a,  0x11b,  0x5,    0x14,
+      0xb,   0x2,    0x11b,  0x11c,  0x7,    0x6,    0x2,    0x2,    0x11c,
+      0x11d, 0x5,    0x14,   0xb,    0x2,    0x11d,  0x11e,  0x7,    0x6,
+      0x2,   0x2,    0x11e,  0x11f,  0x7,    0x49,   0x2,    0x2,    0x11f,
+      0x120, 0x7,    0x4f,   0x2,    0x2,    0x120,  0x121,  0x7,    0x4,
+      0x2,   0x2,    0x121,  0x123,  0x3,    0x2,    0x2,    0x2,    0x122,
+      0x10d, 0x3,    0x2,    0x2,    0x2,    0x122,  0x119,  0x3,    0x2,
+      0x2,   0x2,    0x123,  0x17,   0x3,    0x2,    0x2,    0x2,    0x124,
+      0x126, 0x7,    0x4f,   0x2,    0x2,    0x125,  0x127,  0x5,    0x16,
+      0xc,   0x2,    0x126,  0x125,  0x3,    0x2,    0x2,    0x2,    0x126,
+      0x127, 0x3,    0x2,    0x2,    0x2,    0x127,  0x19,   0x3,    0x2,
+      0x2,   0x2,    0x128,  0x129,  0x5,    0x1c,   0xf,    0x2,    0x129,
+      0x1b,  0x3,    0x2,    0x2,    0x2,    0x12a,  0x12b,  0x8,    0xf,
+      0x1,   0x2,    0x12b,  0x12c,  0x5,    0x1e,   0x10,   0x2,    0x12c,
+      0x135, 0x3,    0x2,    0x2,    0x2,    0x12d,  0x12e,  0xc,    0x3,
+      0x2,   0x2,    0x12e,  0x12f,  0x7,    0x9,    0x2,    0x2,    0x12f,
+      0x130, 0x5,    0x1e,   0x10,   0x2,    0x130,  0x131,  0x7,    0x7,
+      0x2,   0x2,    0x131,  0x132,  0x5,    0x1e,   0x10,   0x2,    0x132,
+      0x134, 0x3,    0x2,    0x2,    0x2,    0x133,  0x12d,  0x3,    0x2,
+      0x2,   0x2,    0x134,  0x137,  0x3,    0x2,    0x2,    0x2,    0x135,
+      0x133, 0x3,    0x2,    0x2,    0x2,    0x135,  0x136,  0x3,    0x2,
+      0x2,   0x2,    0x136,  0x1d,   0x3,    0x2,    0x2,    0x2,    0x137,
+      0x135, 0x3,    0x2,    0x2,    0x2,    0x138,  0x139,  0x8,    0x10,
+      0x1,   0x2,    0x139,  0x13a,  0x5,    0x20,   0x11,   0x2,    0x13a,
+      0x140, 0x3,    0x2,    0x2,    0x2,    0x13b,  0x13c,  0xc,    0x3,
+      0x2,   0x2,    0x13c,  0x13d,  0x7,    0xa,    0x2,    0x2,    0x13d,
+      0x13f, 0x5,    0x20,   0x11,   0x2,    0x13e,  0x13b,  0x3,    0x2,
+      0x2,   0x2,    0x13f,  0x142,  0x3,    0x2,    0x2,    0x2,    0x140,
+      0x13e, 0x3,    0x2,    0x2,    0x2,    0x140,  0x141,  0x3,    0x2,
+      0x2,   0x2,    0x141,  0x1f,   0x3,    0x2,    0x2,    0x2,    0x142,
+      0x140, 0x3,    0x2,    0x2,    0x2,    0x143,  0x144,  0x8,    0x11,
+      0x1,   0x2,    0x144,  0x145,  0x5,    0x22,   0x12,   0x2,    0x145,
+      0x14b, 0x3,    0x2,    0x2,    0x2,    0x146,  0x147,  0xc,    0x3,
+      0x2,   0x2,    0x147,  0x148,  0x7,    0xb,    0x2,    0x2,    0x148,
+      0x14a, 0x5,    0x22,   0x12,   0x2,    0x149,  0x146,  0x3,    0x2,
+      0x2,   0x2,    0x14a,  0x14d,  0x3,    0x2,    0x2,    0x2,    0x14b,
+      0x149, 0x3,    0x2,    0x2,    0x2,    0x14b,  0x14c,  0x3,    0x2,
+      0x2,   0x2,    0x14c,  0x21,   0x3,    0x2,    0x2,    0x2,    0x14d,
+      0x14b, 0x3,    0x2,    0x2,    0x2,    0x14e,  0x14f,  0x8,    0x12,
+      0x1,   0x2,    0x14f,  0x150,  0x5,    0x24,   0x13,   0x2,    0x150,
+      0x156, 0x3,    0x2,    0x2,    0x2,    0x151,  0x152,  0xc,    0x3,
+      0x2,   0x2,    0x152,  0x153,  0x9,    0x2,    0x2,    0x2,    0x153,
+      0x155, 0x5,    0x24,   0x13,   0x2,    0x154,  0x151,  0x3,    0x2,
+      0x2,   0x2,    0x155,  0x158,  0x3,    0x2,    0x2,    0x2,    0x156,
+      0x154, 0x3,    0x2,    0x2,    0x2,    0x156,  0x157,  0x3,    0x2,
+      0x2,   0x2,    0x157,  0x23,   0x3,    0x2,    0x2,    0x2,    0x158,
+      0x156, 0x3,    0x2,    0x2,    0x2,    0x159,  0x15a,  0x8,    0x13,
+      0x1,   0x2,    0x15a,  0x15b,  0x5,    0x26,   0x14,   0x2,    0x15b,
+      0x161, 0x3,    0x2,    0x2,    0x2,    0x15c,  0x15d,  0xc,    0x3,
+      0x2,   0x2,    0x15d,  0x15e,  0x9,    0x3,    0x2,    0x2,    0x15e,
+      0x160, 0x5,    0x26,   0x14,   0x2,    0x15f,  0x15c,  0x3,    0x2,
+      0x2,   0x2,    0x160,  0x163,  0x3,    0x2,    0x2,    0x2,    0x161,
+      0x15f, 0x3,    0x2,    0x2,    0x2,    0x161,  0x162,  0x3,    0x2,
+      0x2,   0x2,    0x162,  0x25,   0x3,    0x2,    0x2,    0x2,    0x163,
+      0x161, 0x3,    0x2,    0x2,    0x2,    0x164,  0x165,  0x8,    0x14,
+      0x1,   0x2,    0x165,  0x166,  0x5,    0x28,   0x15,   0x2,    0x166,
+      0x16c, 0x3,    0x2,    0x2,    0x2,    0x167,  0x168,  0xc,    0x3,
+      0x2,   0x2,    0x168,  0x169,  0x9,    0x4,    0x2,    0x2,    0x169,
+      0x16b, 0x5,    0x28,   0x15,   0x2,    0x16a,  0x167,  0x3,    0x2,
+      0x2,   0x2,    0x16b,  0x16e,  0x3,    0x2,    0x2,    0x2,    0x16c,
+      0x16a, 0x3,    0x2,    0x2,    0x2,    0x16c,  0x16d,  0x3,    0x2,
+      0x2,   0x2,    0x16d,  0x27,   0x3,    0x2,    0x2,    0x2,    0x16e,
+      0x16c, 0x3,    0x2,    0x2,    0x2,    0x16f,  0x170,  0x8,    0x15,
+      0x1,   0x2,    0x170,  0x171,  0x5,    0x2a,   0x16,   0x2,    0x171,
+      0x177, 0x3,    0x2,    0x2,    0x2,    0x172,  0x173,  0xc,    0x3,
+      0x2,   0x2,    0x173,  0x174,  0x9,    0x5,    0x2,    0x2,    0x174,
+      0x176, 0x5,    0x2a,   0x16,   0x2,    0x175,  0x172,  0x3,    0x2,
+      0x2,   0x2,    0x176,  0x179,  0x3,    0x2,    0x2,    0x2,    0x177,
+      0x175, 0x3,    0x2,    0x2,    0x2,    0x177,  0x178,  0x3,    0x2,
+      0x2,   0x2,    0x178,  0x29,   0x3,    0x2,    0x2,    0x2,    0x179,
+      0x177, 0x3,    0x2,    0x2,    0x2,    0x17a,  0x17b,  0x8,    0x16,
+      0x1,   0x2,    0x17b,  0x17c,  0x5,    0x2c,   0x17,   0x2,    0x17c,
+      0x182, 0x3,    0x2,    0x2,    0x2,    0x17d,  0x17e,  0xc,    0x3,
+      0x2,   0x2,    0x17e,  0x17f,  0x9,    0x6,    0x2,    0x2,    0x17f,
+      0x181, 0x5,    0x2c,   0x17,   0x2,    0x180,  0x17d,  0x3,    0x2,
+      0x2,   0x2,    0x181,  0x184,  0x3,    0x2,    0x2,    0x2,    0x182,
+      0x180, 0x3,    0x2,    0x2,    0x2,    0x182,  0x183,  0x3,    0x2,
+      0x2,   0x2,    0x183,  0x2b,   0x3,    0x2,    0x2,    0x2,    0x184,
+      0x182, 0x3,    0x2,    0x2,    0x2,    0x185,  0x186,  0x8,    0x17,
+      0x1,   0x2,    0x186,  0x187,  0x5,    0x2e,   0x18,   0x2,    0x187,
+      0x18d, 0x3,    0x2,    0x2,    0x2,    0x188,  0x189,  0xc,    0x3,
+      0x2,   0x2,    0x189,  0x18a,  0x9,    0x7,    0x2,    0x2,    0x18a,
+      0x18c, 0x5,    0x2e,   0x18,   0x2,    0x18b,  0x188,  0x3,    0x2,
+      0x2,   0x2,    0x18c,  0x18f,  0x3,    0x2,    0x2,    0x2,    0x18d,
+      0x18b, 0x3,    0x2,    0x2,    0x2,    0x18d,  0x18e,  0x3,    0x2,
+      0x2,   0x2,    0x18e,  0x2d,   0x3,    0x2,    0x2,    0x2,    0x18f,
+      0x18d, 0x3,    0x2,    0x2,    0x2,    0x190,  0x194,  0x5,    0x36,
+      0x1c,  0x2,    0x191,  0x192,  0x9,    0x8,    0x2,    0x2,    0x192,
+      0x194, 0x5,    0x2e,   0x18,   0x2,    0x193,  0x190,  0x3,    0x2,
+      0x2,   0x2,    0x193,  0x191,  0x3,    0x2,    0x2,    0x2,    0x194,
+      0x2f,  0x3,    0x2,    0x2,    0x2,    0x195,  0x196,  0x8,    0x19,
+      0x1,   0x2,    0x196,  0x1a1,  0x7,    0x4f,   0x2,    0x2,    0x197,
+      0x198, 0x5,    0x3c,   0x1f,   0x2,    0x198,  0x199,  0x7,    0xc,
+      0x2,   0x2,    0x199,  0x19a,  0x7,    0x4f,   0x2,    0x2,    0x19a,
+      0x1a1, 0x3,    0x2,    0x2,    0x2,    0x19b,  0x19c,  0x5,    0x3c,
+      0x1f,  0x2,    0x19c,  0x19d,  0x7,    0xd,    0x2,    0x2,    0x19d,
+      0x19e, 0x5,    0x1a,   0xe,    0x2,    0x19e,  0x19f,  0x7,    0xe,
+      0x2,   0x2,    0x19f,  0x1a1,  0x3,    0x2,    0x2,    0x2,    0x1a0,
+      0x195, 0x3,    0x2,    0x2,    0x2,    0x1a0,  0x197,  0x3,    0x2,
+      0x2,   0x2,    0x1a0,  0x19b,  0x3,    0x2,    0x2,    0x2,    0x1a1,
+      0x1ac, 0x3,    0x2,    0x2,    0x2,    0x1a2,  0x1a3,  0xc,    0x6,
+      0x2,   0x2,    0x1a3,  0x1a4,  0x7,    0xc,    0x2,    0x2,    0x1a4,
+      0x1ab, 0x7,    0x4f,   0x2,    0x2,    0x1a5,  0x1a6,  0xc,    0x4,
+      0x2,   0x2,    0x1a6,  0x1a7,  0x7,    0xd,    0x2,    0x2,    0x1a7,
+      0x1a8, 0x5,    0x1a,   0xe,    0x2,    0x1a8,  0x1a9,  0x7,    0xe,
+      0x2,   0x2,    0x1a9,  0x1ab,  0x3,    0x2,    0x2,    0x2,    0x1aa,
+      0x1a2, 0x3,    0x2,    0x2,    0x2,    0x1aa,  0x1a5,  0x3,    0x2,
+      0x2,   0x2,    0x1ab,  0x1ae,  0x3,    0x2,    0x2,    0x2,    0x1ac,
+      0x1aa, 0x3,    0x2,    0x2,    0x2,    0x1ac,  0x1ad,  0x3,    0x2,
+      0x2,   0x2,    0x1ad,  0x31,   0x3,    0x2,    0x2,    0x2,    0x1ae,
+      0x1ac, 0x3,    0x2,    0x2,    0x2,    0x1af,  0x1b0,  0x7,    0x4b,
+      0x2,   0x2,    0x1b0,  0x1ba,  0x5,    0x30,   0x19,   0x2,    0x1b1,
+      0x1b2, 0x7,    0x4c,   0x2,    0x2,    0x1b2,  0x1ba,  0x5,    0x30,
+      0x19,  0x2,    0x1b3,  0x1b4,  0x5,    0x30,   0x19,   0x2,    0x1b4,
+      0x1b5, 0x7,    0x4b,   0x2,    0x2,    0x1b5,  0x1ba,  0x3,    0x2,
+      0x2,   0x2,    0x1b6,  0x1b7,  0x5,    0x30,   0x19,   0x2,    0x1b7,
+      0x1b8, 0x7,    0x4c,   0x2,    0x2,    0x1b8,  0x1ba,  0x3,    0x2,
+      0x2,   0x2,    0x1b9,  0x1af,  0x3,    0x2,    0x2,    0x2,    0x1b9,
+      0x1b1, 0x3,    0x2,    0x2,    0x2,    0x1b9,  0x1b3,  0x3,    0x2,
+      0x2,   0x2,    0x1b9,  0x1b6,  0x3,    0x2,    0x2,    0x2,    0x1ba,
+      0x33,  0x3,    0x2,    0x2,    0x2,    0x1bb,  0x1c2,  0x5,    0x32,
+      0x1a,  0x2,    0x1bc,  0x1bf,  0x5,    0x30,   0x19,   0x2,    0x1bd,
+      0x1be, 0x9,    0x9,    0x2,    0x2,    0x1be,  0x1c0,  0x5,    0x1a,
+      0xe,   0x2,    0x1bf,  0x1bd,  0x3,    0x2,    0x2,    0x2,    0x1bf,
+      0x1c0, 0x3,    0x2,    0x2,    0x2,    0x1c0,  0x1c2,  0x3,    0x2,
+      0x2,   0x2,    0x1c1,  0x1bb,  0x3,    0x2,    0x2,    0x2,    0x1c1,
+      0x1bc, 0x3,    0x2,    0x2,    0x2,    0x1c2,  0x35,   0x3,    0x2,
+      0x2,   0x2,    0x1c3,  0x1c6,  0x5,    0x3a,   0x1e,   0x2,    0x1c4,
+      0x1c6, 0x5,    0x34,   0x1b,   0x2,    0x1c5,  0x1c3,  0x3,    0x2,
+      0x2,   0x2,    0x1c5,  0x1c4,  0x3,    0x2,    0x2,    0x2,    0x1c6,
+      0x37,  0x3,    0x2,    0x2,    0x2,    0x1c7,  0x1c8,  0x7,    0x4f,
+      0x2,   0x2,    0x1c8,  0x1d1,  0x7,    0xf,    0x2,    0x2,    0x1c9,
+      0x1ce, 0x5,    0x1a,   0xe,    0x2,    0x1ca,  0x1cb,  0x7,    0x6,
+      0x2,   0x2,    0x1cb,  0x1cd,  0x5,    0x1a,   0xe,    0x2,    0x1cc,
+      0x1ca, 0x3,    0x2,    0x2,    0x2,    0x1cd,  0x1d0,  0x3,    0x2,
+      0x2,   0x2,    0x1ce,  0x1cc,  0x3,    0x2,    0x2,    0x2,    0x1ce,
+      0x1cf, 0x3,    0x2,    0x2,    0x2,    0x1cf,  0x1d2,  0x3,    0x2,
+      0x2,   0x2,    0x1d0,  0x1ce,  0x3,    0x2,    0x2,    0x2,    0x1d1,
+      0x1c9, 0x3,    0x2,    0x2,    0x2,    0x1d1,  0x1d2,  0x3,    0x2,
+      0x2,   0x2,    0x1d2,  0x1d3,  0x3,    0x2,    0x2,    0x2,    0x1d3,
+      0x1d4, 0x7,    0x10,   0x2,    0x2,    0x1d4,  0x39,   0x3,    0x2,
+      0x2,   0x2,    0x1d5,  0x1db,  0x5,    0x3c,   0x1f,   0x2,    0x1d6,
+      0x1d8, 0x7,    0x4f,   0x2,    0x2,    0x1d7,  0x1d9,  0x5,    0x6,
+      0x4,   0x2,    0x1d8,  0x1d7,  0x3,    0x2,    0x2,    0x2,    0x1d8,
+      0x1d9, 0x3,    0x2,    0x2,    0x2,    0x1d9,  0x1db,  0x3,    0x2,
+      0x2,   0x2,    0x1da,  0x1d5,  0x3,    0x2,    0x2,    0x2,    0x1da,
+      0x1d6, 0x3,    0x2,    0x2,    0x2,    0x1db,  0x3b,   0x3,    0x2,
+      0x2,   0x2,    0x1dc,  0x1e5,  0x5,    0x4c,   0x27,   0x2,    0x1dd,
+      0x1e5, 0x5,    0x38,   0x1d,   0x2,    0x1de,  0x1e5,  0x7,    0x53,
+      0x2,   0x2,    0x1df,  0x1e5,  0x7,    0x4e,   0x2,    0x2,    0x1e0,
+      0x1e1, 0x7,    0x3,    0x2,    0x2,    0x1e1,  0x1e2,  0x5,    0x1a,
+      0xe,   0x2,    0x1e2,  0x1e3,  0x7,    0x4,    0x2,    0x2,    0x1e3,
+      0x1e5, 0x3,    0x2,    0x2,    0x2,    0x1e4,  0x1dc,  0x3,    0x2,
+      0x2,   0x2,    0x1e4,  0x1dd,  0x3,    0x2,    0x2,    0x2,    0x1e4,
+      0x1de, 0x3,    0x2,    0x2,    0x2,    0x1e4,  0x1df,  0x3,    0x2,
+      0x2,   0x2,    0x1e4,  0x1e0,  0x3,    0x2,    0x2,    0x2,    0x1e5,
+      0x3d,  0x3,    0x2,    0x2,    0x2,    0x1e6,  0x1e8,  0x5,    0x52,
+      0x2a,  0x2,    0x1e7,  0x1e6,  0x3,    0x2,    0x2,    0x2,    0x1e7,
+      0x1e8, 0x3,    0x2,    0x2,    0x2,    0x1e8,  0x3f,   0x3,    0x2,
+      0x2,   0x2,    0x1e9,  0x1ea,  0x7,    0x1f,   0x2,    0x2,    0x1ea,
+      0x1eb, 0x7,    0x3,    0x2,    0x2,    0x1eb,  0x1ec,  0x5,    0x3e,
+      0x20,  0x2,    0x1ec,  0x1ed,  0x7,    0x11,   0x2,    0x2,    0x1ed,
+      0x1ee, 0x5,    0x1a,   0xe,    0x2,    0x1ee,  0x1ef,  0x7,    0x11,
+      0x2,   0x2,    0x1ef,  0x1f0,  0x5,    0x34,   0x1b,   0x2,    0x1f0,
+      0x1f1, 0x7,    0x4,    0x2,    0x2,    0x1f1,  0x1f2,  0x5,    0x70,
+      0x39,  0x2,    0x1f2,  0x41,   0x3,    0x2,    0x2,    0x2,    0x1f3,
+      0x1f5, 0x7,    0xd,    0x2,    0x2,    0x1f4,  0x1f6,  0x5,    0x1a,
+      0xe,   0x2,    0x1f5,  0x1f4,  0x3,    0x2,    0x2,    0x2,    0x1f5,
+      0x1f6, 0x3,    0x2,    0x2,    0x2,    0x1f6,  0x1f7,  0x3,    0x2,
+      0x2,   0x2,    0x1f7,  0x1f9,  0x7,    0x7,    0x2,    0x2,    0x1f8,
+      0x1fa, 0x5,    0x1a,   0xe,    0x2,    0x1f9,  0x1f8,  0x3,    0x2,
+      0x2,   0x2,    0x1f9,  0x1fa,  0x3,    0x2,    0x2,    0x2,    0x1fa,
+      0x1fb, 0x3,    0x2,    0x2,    0x2,    0x1fb,  0x1fc,  0x7,    0xe,
+      0x2,   0x2,    0x1fc,  0x43,   0x3,    0x2,    0x2,    0x2,    0x1fd,
+      0x1ff, 0x5,    0x42,   0x22,   0x2,    0x1fe,  0x1fd,  0x3,    0x2,
+      0x2,   0x2,    0x1fe,  0x1ff,  0x3,    0x2,    0x2,    0x2,    0x1ff,
+      0x45,  0x3,    0x2,    0x2,    0x2,    0x200,  0x201,  0x7,    0x1f,
+      0x2,   0x2,    0x201,  0x202,  0x7,    0x3,    0x2,    0x2,    0x202,
+      0x203, 0x5,    0x50,   0x29,   0x2,    0x203,  0x204,  0x7,    0x12,
+      0x2,   0x2,    0x204,  0x205,  0x5,    0x1a,   0xe,    0x2,    0x205,
+      0x206, 0x5,    0x44,   0x23,   0x2,    0x206,  0x207,  0x7,    0x4,
+      0x2,   0x2,    0x207,  0x208,  0x5,    0x70,   0x39,   0x2,    0x208,
+      0x47,  0x3,    0x2,    0x2,    0x2,    0x209,  0x20a,  0x5,    0x1a,
+      0xe,   0x2,    0x20a,  0x49,   0x3,    0x2,    0x2,    0x2,    0x20b,
+      0x20d, 0x7,    0x3,    0x2,    0x2,    0x20c,  0x20e,  0x5,    0x48,
+      0x25,  0x2,    0x20d,  0x20c,  0x3,    0x2,    0x2,    0x2,    0x20d,
+      0x20e, 0x3,    0x2,    0x2,    0x2,    0x20e,  0x213,  0x3,    0x2,
+      0x2,   0x2,    0x20f,  0x210,  0x7,    0x6,    0x2,    0x2,    0x210,
+      0x212, 0x5,    0x48,   0x25,   0x2,    0x211,  0x20f,  0x3,    0x2,
+      0x2,   0x2,    0x212,  0x215,  0x3,    0x2,    0x2,    0x2,    0x213,
+      0x211, 0x3,    0x2,    0x2,    0x2,    0x213,  0x214,  0x3,    0x2,
+      0x2,   0x2,    0x214,  0x216,  0x3,    0x2,    0x2,    0x2,    0x215,
+      0x213, 0x3,    0x2,    0x2,    0x2,    0x216,  0x217,  0x7,    0x4,
+      0x2,   0x2,    0x217,  0x4b,   0x3,    0x2,    0x2,    0x2,    0x218,
+      0x21a, 0x9,    0xa,    0x2,    0x2,    0x219,  0x21b,  0x5,    0x6,
+      0x4,   0x2,    0x21a,  0x219,  0x3,    0x2,    0x2,    0x2,    0x21a,
+      0x21b, 0x3,    0x2,    0x2,    0x2,    0x21b,  0x21c,  0x3,    0x2,
+      0x2,   0x2,    0x21c,  0x21d,  0x5,    0x4a,   0x26,   0x2,    0x21d,
+      0x21e, 0x5,    0x12,   0xa,    0x2,    0x21e,  0x4d,   0x3,    0x2,
+      0x2,   0x2,    0x21f,  0x220,  0x7,    0x4f,   0x2,    0x2,    0x220,
+      0x4f,  0x3,    0x2,    0x2,    0x2,    0x221,  0x222,  0x9,    0xb,
+      0x2,   0x2,    0x222,  0x223,  0x7,    0x4f,   0x2,    0x2,    0x223,
+      0x224, 0x7,    0x7,    0x2,    0x2,    0x224,  0x225,  0x5,    0x2,
+      0x2,   0x2,    0x225,  0x51,   0x3,    0x2,    0x2,    0x2,    0x226,
+      0x229, 0x5,    0x50,   0x29,   0x2,    0x227,  0x228,  0x7,    0x34,
+      0x2,   0x2,    0x228,  0x22a,  0x5,    0x1a,   0xe,    0x2,    0x229,
+      0x227, 0x3,    0x2,    0x2,    0x2,    0x229,  0x22a,  0x3,    0x2,
+      0x2,   0x2,    0x22a,  0x53,   0x3,    0x2,    0x2,    0x2,    0x22b,
+      0x22d, 0x7,    0x2a,   0x2,    0x2,    0x22c,  0x22b,  0x3,    0x2,
+      0x2,   0x2,    0x22c,  0x22d,  0x3,    0x2,    0x2,    0x2,    0x22d,
+      0x22e, 0x3,    0x2,    0x2,    0x2,    0x22e,  0x22f,  0x5,    0x4c,
+      0x27,  0x2,    0x22f,  0x55,   0x3,    0x2,    0x2,    0x2,    0x230,
+      0x231, 0x5,    0x34,   0x1b,   0x2,    0x231,  0x57,   0x3,    0x2,
+      0x2,   0x2,    0x232,  0x234,  0x7,    0x1e,   0x2,    0x2,    0x233,
+      0x235, 0x7,    0x22,   0x2,    0x2,    0x234,  0x233,  0x3,    0x2,
+      0x2,   0x2,    0x234,  0x235,  0x3,    0x2,    0x2,    0x2,    0x235,
+      0x236, 0x3,    0x2,    0x2,    0x2,    0x236,  0x237,  0x7,    0x3,
+      0x2,   0x2,    0x237,  0x238,  0x5,    0x1a,   0xe,    0x2,    0x238,
+      0x239, 0x7,    0x4,    0x2,    0x2,    0x239,  0x23c,  0x5,    0x70,
+      0x39,  0x2,    0x23a,  0x23b,  0x7,    0x13,   0x2,    0x2,    0x23b,
+      0x23d, 0x5,    0x70,   0x39,   0x2,    0x23c,  0x23a,  0x3,    0x2,
+      0x2,   0x2,    0x23c,  0x23d,  0x3,    0x2,    0x2,    0x2,    0x23d,
+      0x59,  0x3,    0x2,    0x2,    0x2,    0x23e,  0x23f,  0x7,    0x20,
+      0x2,   0x2,    0x23f,  0x240,  0x7,    0x3,    0x2,    0x2,    0x240,
+      0x241, 0x5,    0x1a,   0xe,    0x2,    0x241,  0x242,  0x7,    0x4,
+      0x2,   0x2,    0x242,  0x243,  0x5,    0x70,   0x39,   0x2,    0x243,
+      0x5b,  0x3,    0x2,    0x2,    0x2,    0x244,  0x246,  0x7,    0x21,
+      0x2,   0x2,    0x245,  0x247,  0x5,    0x1a,   0xe,    0x2,    0x246,
+      0x245, 0x3,    0x2,    0x2,    0x2,    0x246,  0x247,  0x3,    0x2,
+      0x2,   0x2,    0x247,  0x5d,   0x3,    0x2,    0x2,    0x2,    0x248,
+      0x249, 0x7,    0x24,   0x2,    0x2,    0x249,  0x5f,   0x3,    0x2,
+      0x2,   0x2,    0x24a,  0x24b,  0x7,    0x23,   0x2,    0x2,    0x24b,
+      0x61,  0x3,    0x2,    0x2,    0x2,    0x24c,  0x24d,  0x7,    0x25,
+      0x2,   0x2,    0x24d,  0x24f,  0x5,    0x4e,   0x28,   0x2,    0x24e,
+      0x250, 0x5,    0x4a,   0x26,   0x2,    0x24f,  0x24e,  0x3,    0x2,
+      0x2,   0x2,    0x24f,  0x250,  0x3,    0x2,    0x2,    0x2,    0x250,
+      0x63,  0x3,    0x2,    0x2,    0x2,    0x251,  0x252,  0x7,    0x28,
+      0x2,   0x2,    0x252,  0x253,  0x5,    0x18,   0xd,    0x2,    0x253,
+      0x254, 0x5,    0x70,   0x39,   0x2,    0x254,  0x65,   0x3,    0x2,
+      0x2,   0x2,    0x255,  0x256,  0x7,    0x27,   0x2,    0x2,    0x256,
+      0x258, 0x5,    0x70,   0x39,   0x2,    0x257,  0x259,  0x5,    0x64,
+      0x33,  0x2,    0x258,  0x257,  0x3,    0x2,    0x2,    0x2,    0x259,
+      0x25a, 0x3,    0x2,    0x2,    0x2,    0x25a,  0x258,  0x3,    0x2,
+      0x2,   0x2,    0x25a,  0x25b,  0x3,    0x2,    0x2,    0x2,    0x25b,
+      0x67,  0x3,    0x2,    0x2,    0x2,    0x25c,  0x25d,  0x9,    0xc,
+      0x2,   0x2,    0x25d,  0x25e,  0x7,    0x3,    0x2,    0x2,    0x25e,
+      0x25f, 0x5,    0x1a,   0xe,    0x2,    0x25f,  0x260,  0x7,    0x4,
+      0x2,   0x2,    0x260,  0x264,  0x3,    0x2,    0x2,    0x2,    0x261,
+      0x264, 0x7,    0x32,   0x2,    0x2,    0x262,  0x264,  0x7,    0x33,
+      0x2,   0x2,    0x263,  0x25c,  0x3,    0x2,    0x2,    0x2,    0x263,
+      0x261, 0x3,    0x2,    0x2,    0x2,    0x263,  0x262,  0x3,    0x2,
+      0x2,   0x2,    0x264,  0x69,   0x3,    0x2,    0x2,    0x2,    0x265,
+      0x266, 0x5,    0x52,   0x2a,   0x2,    0x266,  0x267,  0x7,    0x11,
+      0x2,   0x2,    0x267,  0x283,  0x3,    0x2,    0x2,    0x2,    0x268,
+      0x269, 0x5,    0x54,   0x2b,   0x2,    0x269,  0x26a,  0x7,    0x11,
+      0x2,   0x2,    0x26a,  0x283,  0x3,    0x2,    0x2,    0x2,    0x26b,
+      0x26c, 0x5,    0x56,   0x2c,   0x2,    0x26c,  0x26d,  0x7,    0x11,
+      0x2,   0x2,    0x26d,  0x283,  0x3,    0x2,    0x2,    0x2,    0x26e,
+      0x26f, 0x5,    0x5c,   0x2f,   0x2,    0x26f,  0x270,  0x7,    0x11,
+      0x2,   0x2,    0x270,  0x283,  0x3,    0x2,    0x2,    0x2,    0x271,
+      0x272, 0x5,    0x5e,   0x30,   0x2,    0x272,  0x273,  0x7,    0x11,
+      0x2,   0x2,    0x273,  0x283,  0x3,    0x2,    0x2,    0x2,    0x274,
+      0x275, 0x5,    0x60,   0x31,   0x2,    0x275,  0x276,  0x7,    0x11,
+      0x2,   0x2,    0x276,  0x283,  0x3,    0x2,    0x2,    0x2,    0x277,
+      0x278, 0x5,    0x62,   0x32,   0x2,    0x278,  0x279,  0x7,    0x11,
+      0x2,   0x2,    0x279,  0x283,  0x3,    0x2,    0x2,    0x2,    0x27a,
+      0x283, 0x5,    0x58,   0x2d,   0x2,    0x27b,  0x27c,  0x5,    0x68,
+      0x35,  0x2,    0x27c,  0x27d,  0x7,    0x11,   0x2,    0x2,    0x27d,
+      0x283, 0x3,    0x2,    0x2,    0x2,    0x27e,  0x283,  0x5,    0x5a,
+      0x2e,  0x2,    0x27f,  0x283,  0x5,    0x46,   0x24,   0x2,    0x280,
+      0x283, 0x5,    0x40,   0x21,   0x2,    0x281,  0x283,  0x5,    0x66,
+      0x34,  0x2,    0x282,  0x265,  0x3,    0x2,    0x2,    0x2,    0x282,
+      0x268, 0x3,    0x2,    0x2,    0x2,    0x282,  0x26b,  0x3,    0x2,
+      0x2,   0x2,    0x282,  0x26e,  0x3,    0x2,    0x2,    0x2,    0x282,
+      0x271, 0x3,    0x2,    0x2,    0x2,    0x282,  0x274,  0x3,    0x2,
+      0x2,   0x2,    0x282,  0x277,  0x3,    0x2,    0x2,    0x2,    0x282,
+      0x27a, 0x3,    0x2,    0x2,    0x2,    0x282,  0x27b,  0x3,    0x2,
+      0x2,   0x2,    0x282,  0x27e,  0x3,    0x2,    0x2,    0x2,    0x282,
+      0x27f, 0x3,    0x2,    0x2,    0x2,    0x282,  0x280,  0x3,    0x2,
+      0x2,   0x2,    0x282,  0x281,  0x3,    0x2,    0x2,    0x2,    0x283,
+      0x6b,  0x3,    0x2,    0x2,    0x2,    0x284,  0x286,  0x5,    0x6a,
+      0x36,  0x2,    0x285,  0x284,  0x3,    0x2,    0x2,    0x2,    0x286,
+      0x289, 0x3,    0x2,    0x2,    0x2,    0x287,  0x285,  0x3,    0x2,
+      0x2,   0x2,    0x287,  0x288,  0x3,    0x2,    0x2,    0x2,    0x288,
+      0x6d,  0x3,    0x2,    0x2,    0x2,    0x289,  0x287,  0x3,    0x2,
+      0x2,   0x2,    0x28a,  0x28c,  0x7,    0x1d,   0x2,    0x2,    0x28b,
+      0x28a, 0x3,    0x2,    0x2,    0x2,    0x28b,  0x28c,  0x3,    0x2,
+      0x2,   0x2,    0x28c,  0x28d,  0x3,    0x2,    0x2,    0x2,    0x28d,
+      0x28e, 0x7,    0xf,    0x2,    0x2,    0x28e,  0x28f,  0x5,    0x6c,
+      0x37,  0x2,    0x28f,  0x290,  0x7,    0x10,   0x2,    0x2,    0x290,
+      0x6f,  0x3,    0x2,    0x2,    0x2,    0x291,  0x294,  0x5,    0x6a,
+      0x36,  0x2,    0x292,  0x294,  0x5,    0x6e,   0x38,   0x2,    0x293,
+      0x291, 0x3,    0x2,    0x2,    0x2,    0x293,  0x292,  0x3,    0x2,
+      0x2,   0x2,    0x294,  0x71,   0x3,    0x2,    0x2,    0x2,    0x295,
+      0x296, 0x5,    0x6e,   0x38,   0x2,    0x296,  0x73,   0x3,    0x2,
+      0x2,   0x2,    0x297,  0x298,  0x7,    0x4f,   0x2,    0x2,    0x298,
+      0x299, 0x7,    0x7,    0x2,    0x2,    0x299,  0x29a,  0x5,    0x2,
+      0x2,   0x2,    0x29a,  0x29b,  0x7,    0x11,   0x2,    0x2,    0x29b,
+      0x75,  0x3,    0x2,    0x2,    0x2,    0x29c,  0x29e,  0x5,    0x74,
+      0x3b,  0x2,    0x29d,  0x29c,  0x3,    0x2,    0x2,    0x2,    0x29e,
+      0x2a1, 0x3,    0x2,    0x2,    0x2,    0x29f,  0x29d,  0x3,    0x2,
+      0x2,   0x2,    0x29f,  0x2a0,  0x3,    0x2,    0x2,    0x2,    0x2a0,
+      0x77,  0x3,    0x2,    0x2,    0x2,    0x2a1,  0x29f,  0x3,    0x2,
+      0x2,   0x2,    0x2a2,  0x2a3,  0x7,    0x14,   0x2,    0x2,    0x2a3,
+      0x2a4, 0x7,    0x4f,   0x2,    0x2,    0x2a4,  0x79,   0x3,    0x2,
+      0x2,   0x2,    0x2a5,  0x2a6,  0x7,    0x15,   0x2,    0x2,    0x2a6,
+      0x2a7, 0x7,    0x4e,   0x2,    0x2,    0x2a7,  0x7b,   0x3,    0x2,
+      0x2,   0x2,    0x2a8,  0x2a9,  0x7,    0x22,   0x2,    0x2,    0x2a9,
+      0x2aa, 0x7,    0x4e,   0x2,    0x2,    0x2aa,  0x7d,   0x3,    0x2,
+      0x2,   0x2,    0x2ab,  0x2ac,  0x7,    0x8,    0x2,    0x2,    0x2ac,
+      0x2ae, 0x7,    0x4f,   0x2,    0x2,    0x2ad,  0x2af,  0x5,    0x78,
+      0x3d,  0x2,    0x2ae,  0x2ad,  0x3,    0x2,    0x2,    0x2,    0x2ae,
+      0x2af, 0x3,    0x2,    0x2,    0x2,    0x2af,  0x2b1,  0x3,    0x2,
+      0x2,   0x2,    0x2b0,  0x2b2,  0x5,    0x7a,   0x3e,   0x2,    0x2b1,
+      0x2b0, 0x3,    0x2,    0x2,    0x2,    0x2b1,  0x2b2,  0x3,    0x2,
+      0x2,   0x2,    0x2b2,  0x2b4,  0x3,    0x2,    0x2,    0x2,    0x2b3,
+      0x2b5, 0x5,    0x7c,   0x3f,   0x2,    0x2b4,  0x2b3,  0x3,    0x2,
+      0x2,   0x2,    0x2b4,  0x2b5,  0x3,    0x2,    0x2,    0x2,    0x2b5,
+      0x2b6, 0x3,    0x2,    0x2,    0x2,    0x2b6,  0x2b7,  0x7,    0x11,
+      0x2,   0x2,    0x2b7,  0x7f,   0x3,    0x2,    0x2,    0x2,    0x2b8,
+      0x2b9, 0x7,    0x8,    0x2,    0x2,    0x2b9,  0x2ba,  0x7,    0x4f,
+      0x2,   0x2,    0x2ba,  0x2bb,  0x7,    0x34,   0x2,    0x2,    0x2bb,
+      0x2bc, 0x5,    0x2,    0x2,    0x2,    0x2bc,  0x2bd,  0x7,    0x11,
+      0x2,   0x2,    0x2bd,  0x81,   0x3,    0x2,    0x2,    0x2,    0x2be,
+      0x2c0, 0x7,    0x2f,   0x2,    0x2,    0x2bf,  0x2c1,  0x7,    0x1c,
+      0x2,   0x2,    0x2c0,  0x2bf,  0x3,    0x2,    0x2,    0x2,    0x2c0,
+      0x2c1, 0x3,    0x2,    0x2,    0x2,    0x2c1,  0x2c2,  0x3,    0x2,
+      0x2,   0x2,    0x2c2,  0x2c3,  0x7,    0x19,   0x2,    0x2,    0x2c3,
+      0x2c4, 0x7,    0x4f,   0x2,    0x2,    0x2c4,  0x2c5,  0x5,    0x8,
+      0x5,   0x2,    0x2c5,  0x2c6,  0x7,    0x3,    0x2,    0x2,    0x2c6,
+      0x2c7, 0x5,    0x4,    0x3,    0x2,    0x2c7,  0x2c8,  0x7,    0x4,
+      0x2,   0x2,    0x2c8,  0x2c9,  0x5,    0xe,    0x8,    0x2,    0x2c9,
+      0x2ca, 0x7,    0x11,   0x2,    0x2,    0x2ca,  0x83,   0x3,    0x2,
+      0x2,   0x2,    0x2cb,  0x2ce,  0x7,    0x2f,   0x2,    0x2,    0x2cc,
+      0x2cd, 0x7,    0x16,   0x2,    0x2,    0x2cd,  0x2cf,  0x7,    0x4e,
+      0x2,   0x2,    0x2ce,  0x2cc,  0x3,    0x2,    0x2,    0x2,    0x2ce,
+      0x2cf, 0x3,    0x2,    0x2,    0x2,    0x2cf,  0x2d0,  0x3,    0x2,
+      0x2,   0x2,    0x2d0,  0x2d1,  0x7,    0x18,   0x2,    0x2,    0x2d1,
+      0x2d2, 0x7,    0x4f,   0x2,    0x2,    0x2d2,  0x2d3,  0x5,    0x8,
+      0x5,   0x2,    0x2d3,  0x2d4,  0x5,    0xa,    0x6,    0x2,    0x2d4,
+      0x2d5, 0x5,    0xe,    0x8,    0x2,    0x2d5,  0x2d6,  0x5,    0x10,
+      0x9,   0x2,    0x2d6,  0x2d7,  0x7,    0x11,   0x2,    0x2,    0x2d7,
+      0x85,  0x3,    0x2,    0x2,    0x2,    0x2d8,  0x2d9,  0x7,    0x2f,
+      0x2,   0x2,    0x2d9,  0x2da,  0x7,    0x1a,   0x2,    0x2,    0x2da,
+      0x2db, 0x7,    0x4f,   0x2,    0x2,    0x2db,  0x2dc,  0x5,    0xa,
+      0x6,   0x2,    0x2dc,  0x2dd,  0x5,    0xe,    0x8,    0x2,    0x2dd,
+      0x2de, 0x7,    0x11,   0x2,    0x2,    0x2de,  0x87,   0x3,    0x2,
+      0x2,   0x2,    0x2df,  0x2e1,  0x7,    0x1c,   0x2,    0x2,    0x2e0,
+      0x2df, 0x3,    0x2,    0x2,    0x2,    0x2e0,  0x2e1,  0x3,    0x2,
+      0x2,   0x2,    0x2e1,  0x2e2,  0x3,    0x2,    0x2,    0x2,    0x2e2,
+      0x2e3, 0x7,    0x19,   0x2,    0x2,    0x2e3,  0x2e4,  0x7,    0x4f,
+      0x2,   0x2,    0x2e4,  0x2e5,  0x5,    0x8,    0x5,    0x2,    0x2e5,
+      0x2e6, 0x5,    0x16,   0xc,    0x2,    0x2e6,  0x2e9,  0x5,    0xe,
+      0x8,   0x2,    0x2e7,  0x2ea,  0x5,    0x72,   0x3a,   0x2,    0x2e8,
+      0x2ea, 0x7,    0x11,   0x2,    0x2,    0x2e9,  0x2e7,  0x3,    0x2,
+      0x2,   0x2,    0x2e9,  0x2e8,  0x3,    0x2,    0x2,    0x2,    0x2ea,
+      0x89,  0x3,    0x2,    0x2,    0x2,    0x2eb,  0x2ec,  0x7,    0x4f,
+      0x2,   0x2,    0x2ec,  0x2ed,  0x5,    0x6,    0x4,    0x2,    0x2ed,
+      0x2ee, 0x5,    0x16,   0xc,    0x2,    0x2ee,  0x2ef,  0x5,    0xe,
+      0x8,   0x2,    0x2ef,  0x2f0,  0x5,    0x10,   0x9,    0x2,    0x2f0,
+      0x2f1, 0x5,    0x72,   0x3a,   0x2,    0x2f1,  0x8b,   0x3,    0x2,
+      0x2,   0x2,    0x2f2,  0x2f3,  0x7,    0x16,   0x2,    0x2,    0x2f3,
+      0x2f5, 0x7,    0x4e,   0x2,    0x2,    0x2f4,  0x2f2,  0x3,    0x2,
+      0x2,   0x2,    0x2f4,  0x2f5,  0x3,    0x2,    0x2,    0x2,    0x2f5,
+      0x2f6, 0x3,    0x2,    0x2,    0x2,    0x2f6,  0x2f7,  0x7,    0x18,
+      0x2,   0x2,    0x2f7,  0x2f8,  0x7,    0x4f,   0x2,    0x2,    0x2f8,
+      0x2f9, 0x5,    0x8,    0x5,    0x2,    0x2f9,  0x2fa,  0x5,    0x16,
+      0xc,   0x2,    0x2fa,  0x2fb,  0x5,    0xe,    0x8,    0x2,    0x2fb,
+      0x2fe, 0x5,    0x10,   0x9,    0x2,    0x2fc,  0x2ff,  0x5,    0x72,
+      0x3a,  0x2,    0x2fd,  0x2ff,  0x7,    0x11,   0x2,    0x2,    0x2fe,
+      0x2fc, 0x3,    0x2,    0x2,    0x2,    0x2fe,  0x2fd,  0x3,    0x2,
+      0x2,   0x2,    0x2ff,  0x8d,   0x3,    0x2,    0x2,    0x2,    0x300,
+      0x301, 0x7,    0x2e,   0x2,    0x2,    0x301,  0x302,  0x7,    0x4f,
+      0x2,   0x2,    0x302,  0x303,  0x7,    0x7,    0x2,    0x2,    0x303,
+      0x304, 0x5,    0x2,    0x2,    0x2,    0x304,  0x305,  0x5,    0x7a,
+      0x3e,  0x2,    0x305,  0x306,  0x7,    0x11,   0x2,    0x2,    0x306,
+      0x8f,  0x3,    0x2,    0x2,    0x2,    0x307,  0x308,  0x7,    0x2e,
+      0x2,   0x2,    0x308,  0x309,  0x7,    0x4f,   0x2,    0x2,    0x309,
+      0x30a, 0x7,    0x7,    0x2,    0x2,    0x30a,  0x30b,  0x5,    0x2,
+      0x2,   0x2,    0x30b,  0x30c,  0x7,    0x34,   0x2,    0x2,    0x30c,
+      0x30d, 0x5,    0x1a,   0xe,    0x2,    0x30d,  0x30e,  0x7,    0x11,
+      0x2,   0x2,    0x30e,  0x91,   0x3,    0x2,    0x2,    0x2,    0x30f,
+      0x310, 0x7,    0x17,   0x2,    0x2,    0x310,  0x311,  0x7,    0x4f,
+      0x2,   0x2,    0x311,  0x312,  0x7,    0xf,    0x2,    0x2,    0x312,
+      0x313, 0x5,    0x76,   0x3c,   0x2,    0x313,  0x314,  0x7,    0x10,
+      0x2,   0x2,    0x314,  0x93,   0x3,    0x2,    0x2,    0x2,    0x315,
+      0x321, 0x5,    0x92,   0x4a,   0x2,    0x316,  0x321,  0x5,    0x7e,
+      0x40,  0x2,    0x317,  0x321,  0x5,    0x80,   0x41,   0x2,    0x318,
+      0x321, 0x5,    0x88,   0x45,   0x2,    0x319,  0x321,  0x5,    0x8a,
+      0x46,  0x2,    0x31a,  0x321,  0x5,    0x8c,   0x47,   0x2,    0x31b,
+      0x321, 0x5,    0x84,   0x43,   0x2,    0x31c,  0x321,  0x5,    0x82,
+      0x42,  0x2,    0x31d,  0x321,  0x5,    0x86,   0x44,   0x2,    0x31e,
+      0x321, 0x5,    0x8e,   0x48,   0x2,    0x31f,  0x321,  0x5,    0x90,
+      0x49,  0x2,    0x320,  0x315,  0x3,    0x2,    0x2,    0x2,    0x320,
+      0x316, 0x3,    0x2,    0x2,    0x2,    0x320,  0x317,  0x3,    0x2,
+      0x2,   0x2,    0x320,  0x318,  0x3,    0x2,    0x2,    0x2,    0x320,
+      0x319, 0x3,    0x2,    0x2,    0x2,    0x320,  0x31a,  0x3,    0x2,
+      0x2,   0x2,    0x320,  0x31b,  0x3,    0x2,    0x2,    0x2,    0x320,
+      0x31c, 0x3,    0x2,    0x2,    0x2,    0x320,  0x31d,  0x3,    0x2,
+      0x2,   0x2,    0x320,  0x31e,  0x3,    0x2,    0x2,    0x2,    0x320,
+      0x31f, 0x3,    0x2,    0x2,    0x2,    0x321,  0x95,   0x3,    0x2,
+      0x2,   0x2,    0x322,  0x323,  0x7,    0x1b,   0x2,    0x2,    0x323,
+      0x324, 0x7,    0x4f,   0x2,    0x2,    0x324,  0x328,  0x7,    0xf,
+      0x2,   0x2,    0x325,  0x327,  0x5,    0x94,   0x4b,   0x2,    0x326,
+      0x325, 0x3,    0x2,    0x2,    0x2,    0x327,  0x32a,  0x3,    0x2,
+      0x2,   0x2,    0x328,  0x326,  0x3,    0x2,    0x2,    0x2,    0x328,
+      0x329, 0x3,    0x2,    0x2,    0x2,    0x329,  0x32b,  0x3,    0x2,
+      0x2,   0x2,    0x32a,  0x328,  0x3,    0x2,    0x2,    0x2,    0x32b,
+      0x32c, 0x7,    0x10,   0x2,    0x2,    0x32c,  0x97,   0x3,    0x2,
+      0x2,   0x2,    0x32d,  0x330,  0x5,    0x96,   0x4c,   0x2,    0x32e,
+      0x330, 0x5,    0x94,   0x4b,   0x2,    0x32f,  0x32d,  0x3,    0x2,
+      0x2,   0x2,    0x32f,  0x32e,  0x3,    0x2,    0x2,    0x2,    0x330,
+      0x333, 0x3,    0x2,    0x2,    0x2,    0x331,  0x32f,  0x3,    0x2,
+      0x2,   0x2,    0x331,  0x332,  0x3,    0x2,    0x2,    0x2,    0x332,
+      0x99,  0x3,    0x2,    0x2,    0x2,    0x333,  0x331,  0x3,    0x2,
+      0x2,   0x2,    0x4f,   0x9c,   0xaa,   0xb1,   0xb9,   0xbc,   0xcc,
+      0xd0,  0xd4,   0xda,   0xdf,   0xe5,   0xec,   0xf0,   0xf8,   0xfb,
+      0x103, 0x106,  0x10b,  0x10f,  0x115,  0x122,  0x126,  0x135,  0x140,
+      0x14b, 0x156,  0x161,  0x16c,  0x177,  0x182,  0x18d,  0x193,  0x1a0,
+      0x1aa, 0x1ac,  0x1b9,  0x1bf,  0x1c1,  0x1c5,  0x1ce,  0x1d1,  0x1d8,
+      0x1da, 0x1e4,  0x1e7,  0x1f5,  0x1f9,  0x1fe,  0x20d,  0x213,  0x21a,
+      0x229, 0x22c,  0x234,  0x23c,  0x246,  0x24f,  0x25a,  0x263,  0x282,
+      0x287, 0x28b,  0x293,  0x29f,  0x2ae,  0x2b1,  0x2b4,  0x2c0,  0x2ce,
+      0x2e0, 0x2e9,  0x2f4,  0x2fe,  0x320,  0x328,  0x32f,  0x331,
   };
 
   atn::ATNDeserializer deserializer;
diff --git a/deps/v8/src/torque/TorqueParser.h b/deps/v8/src/torque/TorqueParser.h
index 27a0c408b5ddf3..bca847835ffd73 100644
--- a/deps/v8/src/torque/TorqueParser.h
+++ b/deps/v8/src/torque/TorqueParser.h
@@ -56,43 +56,44 @@ class TorqueParser : public antlr4::Parser {
     ISNT = 41,
     IS = 42,
     LET = 43,
-    EXTERN = 44,
-    ASSERT_TOKEN = 45,
-    CHECK_TOKEN = 46,
-    UNREACHABLE_TOKEN = 47,
-    DEBUG_TOKEN = 48,
-    ASSIGNMENT = 49,
-    ASSIGNMENT_OPERATOR = 50,
-    EQUAL = 51,
-    PLUS = 52,
-    MINUS = 53,
-    MULTIPLY = 54,
-    DIVIDE = 55,
-    MODULO = 56,
-    BIT_OR = 57,
-    BIT_AND = 58,
-    BIT_NOT = 59,
-    MAX = 60,
-    MIN = 61,
-    NOT_EQUAL = 62,
-    LESS_THAN = 63,
-    LESS_THAN_EQUAL = 64,
-    GREATER_THAN = 65,
-    GREATER_THAN_EQUAL = 66,
-    SHIFT_LEFT = 67,
-    SHIFT_RIGHT = 68,
-    SHIFT_RIGHT_ARITHMETIC = 69,
-    VARARGS = 70,
-    EQUALITY_OPERATOR = 71,
-    INCREMENT = 72,
-    DECREMENT = 73,
-    NOT = 74,
-    STRING_LITERAL = 75,
-    IDENTIFIER = 76,
-    WS = 77,
-    BLOCK_COMMENT = 78,
-    LINE_COMMENT = 79,
-    DECIMAL_LITERAL = 80
+    CONST = 44,
+    EXTERN = 45,
+    ASSERT_TOKEN = 46,
+    CHECK_TOKEN = 47,
+    UNREACHABLE_TOKEN = 48,
+    DEBUG_TOKEN = 49,
+    ASSIGNMENT = 50,
+    ASSIGNMENT_OPERATOR = 51,
+    EQUAL = 52,
+    PLUS = 53,
+    MINUS = 54,
+    MULTIPLY = 55,
+    DIVIDE = 56,
+    MODULO = 57,
+    BIT_OR = 58,
+    BIT_AND = 59,
+    BIT_NOT = 60,
+    MAX = 61,
+    MIN = 62,
+    NOT_EQUAL = 63,
+    LESS_THAN = 64,
+    LESS_THAN_EQUAL = 65,
+    GREATER_THAN = 66,
+    GREATER_THAN_EQUAL = 67,
+    SHIFT_LEFT = 68,
+    SHIFT_RIGHT = 69,
+    SHIFT_RIGHT_ARITHMETIC = 70,
+    VARARGS = 71,
+    EQUALITY_OPERATOR = 72,
+    INCREMENT = 73,
+    DECREMENT = 74,
+    NOT = 75,
+    STRING_LITERAL = 76,
+    IDENTIFIER = 77,
+    WS = 78,
+    BLOCK_COMMENT = 79,
+    LINE_COMMENT = 80,
+    DECIMAL_LITERAL = 81
   };
 
   enum {
@@ -123,49 +124,55 @@ class TorqueParser : public antlr4::Parser {
     RuleIncrementDecrement = 24,
     RuleAssignment = 25,
     RuleAssignmentExpression = 26,
-    RulePrimaryExpression = 27,
-    RuleForInitialization = 28,
-    RuleForLoop = 29,
-    RuleRangeSpecifier = 30,
-    RuleForOfRange = 31,
-    RuleForOfLoop = 32,
-    RuleArgument = 33,
-    RuleArgumentList = 34,
-    RuleHelperCall = 35,
-    RuleLabelReference = 36,
-    RuleVariableDeclaration = 37,
-    RuleVariableDeclarationWithInitialization = 38,
-    RuleHelperCallStatement = 39,
-    RuleExpressionStatement = 40,
-    RuleIfStatement = 41,
-    RuleWhileLoop = 42,
-    RuleReturnStatement = 43,
-    RuleBreakStatement = 44,
-    RuleContinueStatement = 45,
-    RuleGotoStatement = 46,
-    RuleHandlerWithStatement = 47,
-    RuleTryLabelStatement = 48,
-    RuleDiagnosticStatement = 49,
-    RuleStatement = 50,
-    RuleStatementList = 51,
-    RuleStatementScope = 52,
-    RuleStatementBlock = 53,
-    RuleHelperBody = 54,
-    RuleExtendsDeclaration = 55,
-    RuleGeneratesDeclaration = 56,
-    RuleConstexprDeclaration = 57,
-    RuleTypeDeclaration = 58,
-    RuleTypeAliasDeclaration = 59,
-    RuleExternalBuiltin = 60,
-    RuleExternalMacro = 61,
-    RuleExternalRuntime = 62,
-    RuleBuiltinDeclaration = 63,
-    RuleGenericSpecialization = 64,
-    RuleMacroDeclaration = 65,
-    RuleExternConstDeclaration = 66,
-    RuleDeclaration = 67,
-    RuleModuleDeclaration = 68,
-    RuleFile = 69
+    RuleStructExpression = 27,
+    RuleFunctionPointerExpression = 28,
+    RulePrimaryExpression = 29,
+    RuleForInitialization = 30,
+    RuleForLoop = 31,
+    RuleRangeSpecifier = 32,
+    RuleForOfRange = 33,
+    RuleForOfLoop = 34,
+    RuleArgument = 35,
+    RuleArgumentList = 36,
+    RuleHelperCall = 37,
+    RuleLabelReference = 38,
+    RuleVariableDeclaration = 39,
+    RuleVariableDeclarationWithInitialization = 40,
+    RuleHelperCallStatement = 41,
+    RuleExpressionStatement = 42,
+    RuleIfStatement = 43,
+    RuleWhileLoop = 44,
+    RuleReturnStatement = 45,
+    RuleBreakStatement = 46,
+    RuleContinueStatement = 47,
+    RuleGotoStatement = 48,
+    RuleHandlerWithStatement = 49,
+    RuleTryLabelStatement = 50,
+    RuleDiagnosticStatement = 51,
+    RuleStatement = 52,
+    RuleStatementList = 53,
+    RuleStatementScope = 54,
+    RuleStatementBlock = 55,
+    RuleHelperBody = 56,
+    RuleFieldDeclaration = 57,
+    RuleFieldListDeclaration = 58,
+    RuleExtendsDeclaration = 59,
+    RuleGeneratesDeclaration = 60,
+    RuleConstexprDeclaration = 61,
+    RuleTypeDeclaration = 62,
+    RuleTypeAliasDeclaration = 63,
+    RuleExternalBuiltin = 64,
+    RuleExternalMacro = 65,
+    RuleExternalRuntime = 66,
+    RuleBuiltinDeclaration = 67,
+    RuleGenericSpecialization = 68,
+    RuleMacroDeclaration = 69,
+    RuleExternConstDeclaration = 70,
+    RuleConstDeclaration = 71,
+    RuleStructDeclaration = 72,
+    RuleDeclaration = 73,
+    RuleModuleDeclaration = 74,
+    RuleFile = 75
   };
 
   explicit TorqueParser(antlr4::TokenStream* input);
@@ -206,6 +213,8 @@ class TorqueParser : public antlr4::Parser {
   class IncrementDecrementContext;
   class AssignmentContext;
   class AssignmentExpressionContext;
+  class StructExpressionContext;
+  class FunctionPointerExpressionContext;
   class PrimaryExpressionContext;
   class ForInitializationContext;
   class ForLoopContext;
@@ -234,6 +243,8 @@ class TorqueParser : public antlr4::Parser {
   class StatementScopeContext;
   class StatementBlockContext;
   class HelperBodyContext;
+  class FieldDeclarationContext;
+  class FieldListDeclarationContext;
   class ExtendsDeclarationContext;
   class GeneratesDeclarationContext;
   class ConstexprDeclarationContext;
@@ -246,6 +257,8 @@ class TorqueParser : public antlr4::Parser {
   class GenericSpecializationContext;
   class MacroDeclarationContext;
   class ExternConstDeclarationContext;
+  class ConstDeclarationContext;
+  class StructDeclarationContext;
   class DeclarationContext;
   class ModuleDeclarationContext;
   class FileContext;
@@ -656,9 +669,9 @@ class TorqueParser : public antlr4::Parser {
                               size_t invokingState);
     size_t getRuleIndex() const override;
     antlr4::tree::TerminalNode* IDENTIFIER();
-    GenericSpecializationTypeListContext* genericSpecializationTypeList();
-    LocationExpressionContext* locationExpression();
+    PrimaryExpressionContext* primaryExpression();
     ExpressionContext* expression();
+    LocationExpressionContext* locationExpression();
 
     void enterRule(antlr4::tree::ParseTreeListener* listener) override;
     void exitRule(antlr4::tree::ParseTreeListener* listener) override;
@@ -709,7 +722,7 @@ class TorqueParser : public antlr4::Parser {
     AssignmentExpressionContext(antlr4::ParserRuleContext* parent,
                                 size_t invokingState);
     size_t getRuleIndex() const override;
-    PrimaryExpressionContext* primaryExpression();
+    FunctionPointerExpressionContext* functionPointerExpression();
     AssignmentContext* assignment();
 
     void enterRule(antlr4::tree::ParseTreeListener* listener) override;
@@ -720,12 +733,47 @@ class TorqueParser : public antlr4::Parser {
 
   AssignmentExpressionContext* assignmentExpression();
 
+  class StructExpressionContext : public antlr4::ParserRuleContext {
+   public:
+    StructExpressionContext(antlr4::ParserRuleContext* parent,
+                            size_t invokingState);
+    size_t getRuleIndex() const override;
+    antlr4::tree::TerminalNode* IDENTIFIER();
+    std::vector<ExpressionContext*> expression();
+    ExpressionContext* expression(size_t i);
+
+    void enterRule(antlr4::tree::ParseTreeListener* listener) override;
+    void exitRule(antlr4::tree::ParseTreeListener* listener) override;
+
+    antlrcpp::Any accept(antlr4::tree::ParseTreeVisitor* visitor) override;
+  };
+
+  StructExpressionContext* structExpression();
+
+  class FunctionPointerExpressionContext : public antlr4::ParserRuleContext {
+   public:
+    FunctionPointerExpressionContext(antlr4::ParserRuleContext* parent,
+                                     size_t invokingState);
+    size_t getRuleIndex() const override;
+    PrimaryExpressionContext* primaryExpression();
+    antlr4::tree::TerminalNode* IDENTIFIER();
+    GenericSpecializationTypeListContext* genericSpecializationTypeList();
+
+    void enterRule(antlr4::tree::ParseTreeListener* listener) override;
+    void exitRule(antlr4::tree::ParseTreeListener* listener) override;
+
+    antlrcpp::Any accept(antlr4::tree::ParseTreeVisitor* visitor) override;
+  };
+
+  FunctionPointerExpressionContext* functionPointerExpression();
+
   class PrimaryExpressionContext : public antlr4::ParserRuleContext {
    public:
     PrimaryExpressionContext(antlr4::ParserRuleContext* parent,
                              size_t invokingState);
     size_t getRuleIndex() const override;
     HelperCallContext* helperCall();
+    StructExpressionContext* structExpression();
     antlr4::tree::TerminalNode* DECIMAL_LITERAL();
     antlr4::tree::TerminalNode* STRING_LITERAL();
     ExpressionContext* expression();
@@ -891,9 +939,10 @@ class TorqueParser : public antlr4::Parser {
     VariableDeclarationContext(antlr4::ParserRuleContext* parent,
                                size_t invokingState);
     size_t getRuleIndex() const override;
-    antlr4::tree::TerminalNode* LET();
     antlr4::tree::TerminalNode* IDENTIFIER();
     TypeContext* type();
+    antlr4::tree::TerminalNode* LET();
+    antlr4::tree::TerminalNode* CONST();
 
     void enterRule(antlr4::tree::ParseTreeListener* listener) override;
     void exitRule(antlr4::tree::ParseTreeListener* listener) override;
@@ -1193,6 +1242,38 @@ class TorqueParser : public antlr4::Parser {
 
   HelperBodyContext* helperBody();
 
+  class FieldDeclarationContext : public antlr4::ParserRuleContext {
+   public:
+    FieldDeclarationContext(antlr4::ParserRuleContext* parent,
+                            size_t invokingState);
+    size_t getRuleIndex() const override;
+    antlr4::tree::TerminalNode* IDENTIFIER();
+    TypeContext* type();
+
+    void enterRule(antlr4::tree::ParseTreeListener* listener) override;
+    void exitRule(antlr4::tree::ParseTreeListener* listener) override;
+
+    antlrcpp::Any accept(antlr4::tree::ParseTreeVisitor* visitor) override;
+  };
+
+  FieldDeclarationContext* fieldDeclaration();
+
+  class FieldListDeclarationContext : public antlr4::ParserRuleContext {
+   public:
+    FieldListDeclarationContext(antlr4::ParserRuleContext* parent,
+                                size_t invokingState);
+    size_t getRuleIndex() const override;
+    std::vector<FieldDeclarationContext*> fieldDeclaration();
+    FieldDeclarationContext* fieldDeclaration(size_t i);
+
+    void enterRule(antlr4::tree::ParseTreeListener* listener) override;
+    void exitRule(antlr4::tree::ParseTreeListener* listener) override;
+
+    antlrcpp::Any accept(antlr4::tree::ParseTreeVisitor* visitor) override;
+  };
+
+  FieldListDeclarationContext* fieldListDeclaration();
+
   class ExtendsDeclarationContext : public antlr4::ParserRuleContext {
    public:
     ExtendsDeclarationContext(antlr4::ParserRuleContext* parent,
@@ -1402,6 +1483,7 @@ class TorqueParser : public antlr4::Parser {
     ExternConstDeclarationContext(antlr4::ParserRuleContext* parent,
                                   size_t invokingState);
     size_t getRuleIndex() const override;
+    antlr4::tree::TerminalNode* CONST();
     antlr4::tree::TerminalNode* IDENTIFIER();
     TypeContext* type();
     GeneratesDeclarationContext* generatesDeclaration();
@@ -1414,10 +1496,46 @@ class TorqueParser : public antlr4::Parser {
 
   ExternConstDeclarationContext* externConstDeclaration();
 
+  class ConstDeclarationContext : public antlr4::ParserRuleContext {
+   public:
+    ConstDeclarationContext(antlr4::ParserRuleContext* parent,
+                            size_t invokingState);
+    size_t getRuleIndex() const override;
+    antlr4::tree::TerminalNode* CONST();
+    antlr4::tree::TerminalNode* IDENTIFIER();
+    TypeContext* type();
+    antlr4::tree::TerminalNode* ASSIGNMENT();
+    ExpressionContext* expression();
+
+    void enterRule(antlr4::tree::ParseTreeListener* listener) override;
+    void exitRule(antlr4::tree::ParseTreeListener* listener) override;
+
+    antlrcpp::Any accept(antlr4::tree::ParseTreeVisitor* visitor) override;
+  };
+
+  ConstDeclarationContext* constDeclaration();
+
+  class StructDeclarationContext : public antlr4::ParserRuleContext {
+   public:
+    StructDeclarationContext(antlr4::ParserRuleContext* parent,
+                             size_t invokingState);
+    size_t getRuleIndex() const override;
+    antlr4::tree::TerminalNode* IDENTIFIER();
+    FieldListDeclarationContext* fieldListDeclaration();
+
+    void enterRule(antlr4::tree::ParseTreeListener* listener) override;
+    void exitRule(antlr4::tree::ParseTreeListener* listener) override;
+
+    antlrcpp::Any accept(antlr4::tree::ParseTreeVisitor* visitor) override;
+  };
+
+  StructDeclarationContext* structDeclaration();
+
   class DeclarationContext : public antlr4::ParserRuleContext {
    public:
     DeclarationContext(antlr4::ParserRuleContext* parent, size_t invokingState);
     size_t getRuleIndex() const override;
+    StructDeclarationContext* structDeclaration();
     TypeDeclarationContext* typeDeclaration();
     TypeAliasDeclarationContext* typeAliasDeclaration();
     BuiltinDeclarationContext* builtinDeclaration();
@@ -1427,6 +1545,7 @@ class TorqueParser : public antlr4::Parser {
     ExternalBuiltinContext* externalBuiltin();
     ExternalRuntimeContext* externalRuntime();
     ExternConstDeclarationContext* externConstDeclaration();
+    ConstDeclarationContext* constDeclaration();
 
     void enterRule(antlr4::tree::ParseTreeListener* listener) override;
     void exitRule(antlr4::tree::ParseTreeListener* listener) override;
diff --git a/deps/v8/src/torque/TorqueVisitor.h b/deps/v8/src/torque/TorqueVisitor.h
index f576062bd29c9c..7b1ee2754e2d78 100644
--- a/deps/v8/src/torque/TorqueVisitor.h
+++ b/deps/v8/src/torque/TorqueVisitor.h
@@ -100,6 +100,12 @@ class TorqueVisitor : public antlr4::tree::AbstractParseTreeVisitor {
   virtual antlrcpp::Any visitAssignmentExpression(
       TorqueParser::AssignmentExpressionContext* context) = 0;
 
+  virtual antlrcpp::Any visitStructExpression(
+      TorqueParser::StructExpressionContext* context) = 0;
+
+  virtual antlrcpp::Any visitFunctionPointerExpression(
+      TorqueParser::FunctionPointerExpressionContext* context) = 0;
+
   virtual antlrcpp::Any visitPrimaryExpression(
       TorqueParser::PrimaryExpressionContext* context) = 0;
 
@@ -183,6 +189,12 @@ class TorqueVisitor : public antlr4::tree::AbstractParseTreeVisitor {
   virtual antlrcpp::Any visitHelperBody(
       TorqueParser::HelperBodyContext* context) = 0;
 
+  virtual antlrcpp::Any visitFieldDeclaration(
+      TorqueParser::FieldDeclarationContext* context) = 0;
+
+  virtual antlrcpp::Any visitFieldListDeclaration(
+      TorqueParser::FieldListDeclarationContext* context) = 0;
+
   virtual antlrcpp::Any visitExtendsDeclaration(
       TorqueParser::ExtendsDeclarationContext* context) = 0;
 
@@ -219,6 +231,12 @@ class TorqueVisitor : public antlr4::tree::AbstractParseTreeVisitor {
   virtual antlrcpp::Any visitExternConstDeclaration(
       TorqueParser::ExternConstDeclarationContext* context) = 0;
 
+  virtual antlrcpp::Any visitConstDeclaration(
+      TorqueParser::ConstDeclarationContext* context) = 0;
+
+  virtual antlrcpp::Any visitStructDeclaration(
+      TorqueParser::StructDeclarationContext* context) = 0;
+
   virtual antlrcpp::Any visitDeclaration(
       TorqueParser::DeclarationContext* context) = 0;
 
diff --git a/deps/v8/src/torque/ast-generator.cc b/deps/v8/src/torque/ast-generator.cc
index 9fd072912a034a..5eb2f37ef6cb36 100644
--- a/deps/v8/src/torque/ast-generator.cc
+++ b/deps/v8/src/torque/ast-generator.cc
@@ -278,6 +278,16 @@ antlrcpp::Any AstGenerator::visitExternalRuntime(
       RegisterNode(new StandardDeclaration{Pos(context), runtime, nullptr}));
 }
 
+antlrcpp::Any AstGenerator::visitConstDeclaration(
+    TorqueParser::ConstDeclarationContext* context) {
+  auto name = context->IDENTIFIER()->getSymbol()->getText();
+  auto type = GetType(context->type());
+  Expression* expression =
+      context->expression()->accept(this).as<Expression*>();
+  return implicit_cast<Declaration*>(
+      RegisterNode(new ConstDeclaration{Pos(context), name, type, expression}));
+}
+
 antlrcpp::Any AstGenerator::visitGenericSpecialization(
     TorqueParser::GenericSpecializationContext* context) {
   auto name = context->IDENTIFIER()->getSymbol()->getText();
@@ -335,8 +345,10 @@ antlrcpp::Any AstGenerator::visitTypeAliasDeclaration(
 
 antlrcpp::Any AstGenerator::visitVariableDeclaration(
     TorqueParser::VariableDeclarationContext* context) {
+  bool is_const_qualified = context->CONST() != nullptr;
   return RegisterNode(
       new VarDeclarationStatement{Pos(context),
+                                  is_const_qualified,
                                   context->IDENTIFIER()->getSymbol()->getText(),
                                   GetType(context->type()),
                                   {}});
@@ -533,6 +545,21 @@ antlrcpp::Any AstGenerator::visitTryLabelStatement(
   return implicit_cast<Statement*>(result);
 }
 
+antlrcpp::Any AstGenerator::visitFunctionPointerExpression(
+    TorqueParser::FunctionPointerExpressionContext* context) {
+  if (context->IDENTIFIER()) {
+    std::vector<TypeExpression*> templateArguments;
+    if (context->genericSpecializationTypeList()) {
+      templateArguments =
+          GetTypeVector(context->genericSpecializationTypeList()->typeList());
+    }
+    return implicit_cast<Expression*>(RegisterNode(new IdentifierExpression{
+        Pos(context), context->IDENTIFIER()->getSymbol()->getText(),
+        std::move(templateArguments)}));
+  }
+  return context->primaryExpression()->accept(this);
+}
+
 antlrcpp::Any AstGenerator::visitPrimaryExpression(
     TorqueParser::PrimaryExpressionContext* context) {
   if (auto* e = context->helperCall()) return e->accept(this);
@@ -542,9 +569,23 @@ antlrcpp::Any AstGenerator::visitPrimaryExpression(
   if (auto* e = context->STRING_LITERAL())
     return implicit_cast<Expression*>(RegisterNode(
         new StringLiteralExpression{Pos(context), e->getSymbol()->getText()}));
+  if (context->structExpression()) {
+    return context->structExpression()->accept(this);
+  }
   return context->expression()->accept(this);
 }
 
+antlrcpp::Any AstGenerator::visitStructExpression(
+    TorqueParser::StructExpressionContext* context) {
+  std::vector<Expression*> expressions;
+  for (auto& e : context->expression()) {
+    expressions.push_back(e->accept(this).as<Expression*>());
+  }
+  return implicit_cast<Expression*>(RegisterNode(new StructExpression{
+      Pos(context), context->IDENTIFIER()->getSymbol()->getText(),
+      expressions}));
+}
+
 antlrcpp::Any AstGenerator::visitAssignment(
     TorqueParser::AssignmentContext* context) {
   if (auto* e = context->incrementDecrement()) return e->accept(this);
@@ -577,25 +618,23 @@ antlrcpp::Any AstGenerator::visitIncrementDecrement(
 
 antlrcpp::Any AstGenerator::visitLocationExpression(
     TorqueParser::LocationExpressionContext* context) {
-  if (auto* l = context->locationExpression()) {
-    Expression* location = l->accept(this).as<Expression*>();
-    if (auto* e = context->expression()) {
-      return implicit_cast<Expression*>(
-          RegisterNode(new ElementAccessExpression{
-              Pos(context), location, e->accept(this).as<Expression*>()}));
-    }
-    return implicit_cast<Expression*>(RegisterNode(new FieldAccessExpression{
-        Pos(context), location,
-        context->IDENTIFIER()->getSymbol()->getText()}));
+  Expression* location = nullptr;
+  if (auto* p = context->primaryExpression()) {
+    location = p->accept(this).as<Expression*>();
+  } else if (auto* l = context->locationExpression()) {
+    location = l->accept(this).as<Expression*>();
+  } else {
+    return implicit_cast<Expression*>(RegisterNode(new IdentifierExpression{
+        Pos(context), context->IDENTIFIER()->getSymbol()->getText(), {}}));
   }
-  std::vector<TypeExpression*> templateArguments;
-  if (context->genericSpecializationTypeList()) {
-    templateArguments =
-        GetTypeVector(context->genericSpecializationTypeList()->typeList());
+
+  if (auto* e = context->expression()) {
+    return implicit_cast<Expression*>(RegisterNode(new ElementAccessExpression{
+        Pos(context), location, e->accept(this).as<Expression*>()}));
   }
-  return implicit_cast<Expression*>(RegisterNode(new IdentifierExpression{
-      Pos(context), context->IDENTIFIER()->getSymbol()->getText(),
-      std::move(templateArguments)}));
+
+  return implicit_cast<Expression*>(RegisterNode(new FieldAccessExpression{
+      Pos(context), location, context->IDENTIFIER()->getSymbol()->getText()}));
 }
 
 antlrcpp::Any AstGenerator::visitUnaryExpression(
@@ -756,6 +795,22 @@ antlrcpp::Any AstGenerator::visitDiagnosticStatement(
   }
 }
 
+antlrcpp::Any AstGenerator::visitStructDeclaration(
+    TorqueParser::StructDeclarationContext* context) {
+  StructDeclaration* struct_declaration = RegisterNode(new StructDeclaration{
+      Pos(context), context->IDENTIFIER()->getSymbol()->getText()});
+
+  for (auto* fieldDeclaration :
+       context->fieldListDeclaration()->fieldDeclaration()) {
+    FieldNameAndType field = {
+        fieldDeclaration->IDENTIFIER()->getSymbol()->getText(),
+        GetType(fieldDeclaration->type())};
+    struct_declaration->fields.push_back(field);
+  }
+
+  return implicit_cast<Declaration*>(struct_declaration);
+}
+
 void AstGenerator::visitSourceFile(SourceFileContext* context) {
   source_file_context_ = context;
   current_source_file_ = SourceFileMap::Get().AddSource(context->name);
diff --git a/deps/v8/src/torque/ast-generator.h b/deps/v8/src/torque/ast-generator.h
index 9ec6f3d6ecf305..31eca57b913254 100644
--- a/deps/v8/src/torque/ast-generator.h
+++ b/deps/v8/src/torque/ast-generator.h
@@ -41,6 +41,9 @@ class AstGenerator : public TorqueBaseVisitor {
   antlrcpp::Any visitExternalRuntime(
       TorqueParser::ExternalRuntimeContext* context) override;
 
+  antlrcpp::Any visitConstDeclaration(
+      TorqueParser::ConstDeclarationContext* context) override;
+
   antlrcpp::Any visitGenericSpecialization(
       TorqueParser::GenericSpecializationContext* context) override;
 
@@ -66,6 +69,9 @@ class AstGenerator : public TorqueBaseVisitor {
   antlrcpp::Any visitHelperCallStatement(
       TorqueParser::HelperCallStatementContext* context) override;
 
+  antlrcpp::Any visitStructExpression(
+      TorqueParser::StructExpressionContext* context) override;
+
   antlrcpp::Any visitConditionalExpression(
       TorqueParser::ConditionalExpressionContext* context) override;
 
@@ -105,6 +111,9 @@ class AstGenerator : public TorqueBaseVisitor {
   antlrcpp::Any visitAssignment(
       TorqueParser::AssignmentContext* context) override;
 
+  antlrcpp::Any visitFunctionPointerExpression(
+      TorqueParser::FunctionPointerExpressionContext* context) override;
+
   antlrcpp::Any visitPrimaryExpression(
       TorqueParser::PrimaryExpressionContext* context) override;
 
@@ -143,6 +152,9 @@ class AstGenerator : public TorqueBaseVisitor {
   antlrcpp::Any visitDiagnosticStatement(
       TorqueParser::DiagnosticStatementContext* context) override;
 
+  antlrcpp::Any visitStructDeclaration(
+      TorqueParser::StructDeclarationContext* context) override;
+
   antlrcpp::Any aggregateResult(antlrcpp::Any aggregate,
                                 const antlrcpp::Any& nextResult) override {
     if (aggregate.isNull())
diff --git a/deps/v8/src/torque/ast.h b/deps/v8/src/torque/ast.h
index 216d8843f3310e..6af444a56b87d7 100644
--- a/deps/v8/src/torque/ast.h
+++ b/deps/v8/src/torque/ast.h
@@ -29,6 +29,7 @@ DECLARE_CONTEXTUAL_VARIABLE(CurrentSourcePosition, SourcePosition)
 
 #define AST_EXPRESSION_NODE_KIND_LIST(V) \
   V(CallExpression)                      \
+  V(StructExpression)                    \
   V(LogicalOrExpression)                 \
   V(LogicalAndExpression)                \
   V(ConditionalExpression)               \
@@ -69,8 +70,10 @@ DECLARE_CONTEXTUAL_VARIABLE(CurrentSourcePosition, SourcePosition)
   V(GenericDeclaration)                   \
   V(SpecializationDeclaration)            \
   V(ExternConstDeclaration)               \
+  V(StructDeclaration)                    \
   V(DefaultModuleDeclaration)             \
-  V(ExplicitModuleDeclaration)
+  V(ExplicitModuleDeclaration)            \
+  V(ConstDeclaration)
 
 #define AST_CALLABLE_NODE_KIND_LIST(V) \
   V(TorqueMacroDeclaration)            \
@@ -259,6 +262,14 @@ struct CallExpression : Expression {
   std::vector<std::string> labels;
 };
 
+struct StructExpression : Expression {
+  DEFINE_AST_NODE_LEAF_BOILERPLATE(StructExpression)
+  StructExpression(SourcePosition p, std::string n, std::vector<Expression*> e)
+      : Expression(kKind, p), name(n), expressions(std::move(e)) {}
+  std::string name;
+  std::vector<Expression*> expressions;
+};
+
 struct LogicalOrExpression : Expression {
   DEFINE_AST_NODE_LEAF_BOILERPLATE(LogicalOrExpression)
   LogicalOrExpression(SourcePosition p, Expression* l, Expression* r)
@@ -435,9 +446,14 @@ struct TailCallStatement : Statement {
 
 struct VarDeclarationStatement : Statement {
   DEFINE_AST_NODE_LEAF_BOILERPLATE(VarDeclarationStatement)
-  VarDeclarationStatement(SourcePosition p, std::string n, TypeExpression* t,
-                          base::Optional<Expression*> i)
-      : Statement(kKind, p), name(std::move(n)), type(t), initializer(i) {}
+  VarDeclarationStatement(SourcePosition p, bool c, std::string n,
+                          TypeExpression* t, base::Optional<Expression*> i)
+      : Statement(kKind, p),
+        const_qualified(c),
+        name(std::move(n)),
+        type(t),
+        initializer(i) {}
+  bool const_qualified;
   std::string name;
   TypeExpression* type;
   base::Optional<Expression*> initializer;
@@ -546,6 +562,11 @@ struct TypeAliasDeclaration : Declaration {
   TypeExpression* type;
 };
 
+struct FieldNameAndType {
+  std::string name;
+  TypeExpression* type;
+};
+
 struct LabelAndTypes {
   std::string name;
   std::vector<TypeExpression*> types;
@@ -623,6 +644,16 @@ struct ExternalRuntimeDeclaration : CallableNode {
       : CallableNode(kKind, p, n, pl, r, {}) {}
 };
 
+struct ConstDeclaration : Declaration {
+  DEFINE_AST_NODE_LEAF_BOILERPLATE(ConstDeclaration)
+  ConstDeclaration(SourcePosition p, std::string n, TypeExpression* r,
+                   Expression* e)
+      : Declaration(kKind, p), name(std::move(n)), type(r), expression(e) {}
+  std::string name;
+  TypeExpression* type;
+  Expression* expression;
+};
+
 struct StandardDeclaration : Declaration {
   DEFINE_AST_NODE_LEAF_BOILERPLATE(StandardDeclaration)
   StandardDeclaration(SourcePosition p, CallableNode* c, Statement* b)
@@ -677,6 +708,14 @@ struct ExternConstDeclaration : Declaration {
   std::string literal;
 };
 
+struct StructDeclaration : Declaration {
+  DEFINE_AST_NODE_LEAF_BOILERPLATE(StructDeclaration)
+  StructDeclaration(SourcePosition p, std::string n)
+      : Declaration(kKind, p), name(std::move(n)) {}
+  std::string name;
+  std::vector<FieldNameAndType> fields;
+};
+
 #define ENUM_ITEM(name)                     \
   case AstNode::Kind::k##name:              \
     return std::is_base_of<T, name>::value; \
diff --git a/deps/v8/src/torque/declarable.cc b/deps/v8/src/torque/declarable.cc
index 66f56a19c81324..122f7de9b47750 100644
--- a/deps/v8/src/torque/declarable.cc
+++ b/deps/v8/src/torque/declarable.cc
@@ -34,6 +34,18 @@ std::ostream& operator<<(std::ostream& os, const RuntimeFunction& b) {
   return os;
 }
 
+std::string Variable::RValue() const {
+  if (!IsDefined()) {
+    ReportError("Reading uninitialized variable.");
+  }
+  if (type()->IsStructType()) {
+    return value();
+  }
+  std::string result = "(*" + value() + ")";
+  if (!IsConst()) result += ".value()";
+  return result;
+}
+
 void PrintLabel(std::ostream& os, const Label& l, bool with_names) {
   os << l.name();
   if (l.GetParameterCount() != 0) {
diff --git a/deps/v8/src/torque/declarable.h b/deps/v8/src/torque/declarable.h
index 85a1255560d87c..c20d4ad504f062 100644
--- a/deps/v8/src/torque/declarable.h
+++ b/deps/v8/src/torque/declarable.h
@@ -35,7 +35,8 @@ class Declarable {
     kGenericList,
     kTypeAlias,
     kLabel,
-    kConstant
+    kExternConstant,
+    kModuleConstant
   };
   Kind kind() const { return kind_; }
   bool IsMacro() const { return kind() == kMacro; }
@@ -48,8 +49,12 @@ class Declarable {
   bool IsVariable() const { return kind() == kVariable; }
   bool IsMacroList() const { return kind() == kMacroList; }
   bool IsGenericList() const { return kind() == kGenericList; }
-  bool IsConstant() const { return kind() == kConstant; }
-  bool IsValue() const { return IsVariable() || IsConstant() || IsParameter(); }
+  bool IsExternConstant() const { return kind() == kExternConstant; }
+  bool IsModuleConstant() const { return kind() == kModuleConstant; }
+  bool IsValue() const {
+    return IsVariable() || IsExternConstant() || IsParameter() ||
+           IsModuleConstant();
+  }
   virtual const char* type_name() const { return "<<unknown>>"; }
 
  protected:
@@ -112,22 +117,27 @@ class Parameter : public Value {
   std::string var_name_;
 };
 
+class ModuleConstant : public Value {
+ public:
+  DECLARE_DECLARABLE_BOILERPLATE(ModuleConstant, constant);
+  std::string value() const override { UNREACHABLE(); }
+  std::string RValue() const override { return name() + "()"; }
+
+ private:
+  friend class Declarations;
+  explicit ModuleConstant(const std::string& name, const Type* type)
+      : Value(Declarable::kModuleConstant, type, name) {}
+};
+
 class Variable : public Value {
  public:
   DECLARE_DECLARABLE_BOILERPLATE(Variable, variable);
-  bool IsConst() const override { return false; }
+  bool IsConst() const override { return const_; }
   std::string value() const override { return value_; }
-  std::string RValue() const override {
-    if (!IsDefined()) {
-      ReportError("Reading uninitialized variable.");
-    }
-    std::string result = "(*" + value() + ")";
-    if (!type()->IsConstexpr()) result += ".value()";
-    return result;
-  }
+  std::string RValue() const override;
   void Define() {
-    if (defined_ && type()->IsConstexpr()) {
-      ReportError("Cannot re-define a constexpr variable.");
+    if (defined_ && IsConst()) {
+      ReportError("Cannot re-define a const-bound variable.");
     }
     defined_ = true;
   }
@@ -135,13 +145,18 @@ class Variable : public Value {
 
  private:
   friend class Declarations;
-  Variable(const std::string& name, const std::string& value, const Type* type)
+  Variable(const std::string& name, const std::string& value, const Type* type,
+           bool is_const)
       : Value(Declarable::kVariable, type, name),
         value_(value),
-        defined_(false) {}
+        defined_(false),
+        const_(is_const) {
+    DCHECK_IMPLIES(type->IsConstexpr(), IsConst());
+  }
 
   std::string value_;
   bool defined_;
+  bool const_;
 };
 
 class Label : public Declarable {
@@ -172,16 +187,16 @@ class Label : public Declarable {
   bool used_;
 };
 
-class Constant : public Value {
+class ExternConstant : public Value {
  public:
-  DECLARE_DECLARABLE_BOILERPLATE(Constant, constant);
+  DECLARE_DECLARABLE_BOILERPLATE(ExternConstant, constant);
   std::string value() const override { return value_; }
 
  private:
   friend class Declarations;
-  explicit Constant(const std::string& name, const Type* type,
-                    const std::string& value)
-      : Value(Declarable::kConstant, type, name), value_(value) {}
+  explicit ExternConstant(const std::string& name, const Type* type,
+                          const std::string& value)
+      : Value(Declarable::kExternConstant, type, name), value_(value) {}
 
   std::string value_;
 };
diff --git a/deps/v8/src/torque/declaration-visitor.cc b/deps/v8/src/torque/declaration-visitor.cc
index 798a925db5014e..b83dbb3bc3714a 100644
--- a/deps/v8/src/torque/declaration-visitor.cc
+++ b/deps/v8/src/torque/declaration-visitor.cc
@@ -95,6 +95,15 @@ Builtin* DeclarationVisitor::BuiltinDeclarationCommon(
     }
   }
 
+  if (const StructType* struct_type =
+          StructType::DynamicCast(signature.return_type)) {
+    std::stringstream stream;
+    stream << "builtins (in this case" << decl->name
+           << ") cannot return structs (in this case " << struct_type->name()
+           << ")";
+    ReportError(stream.str());
+  }
+
   std::string generated_name = GetGeneratedCallableName(
       decl->name, declarations()->GetCurrentSpecializationTypeNamesVector());
   return declarations()->DeclareBuiltin(generated_name, kind, external,
@@ -117,6 +126,15 @@ void DeclarationVisitor::Visit(ExternalRuntimeDeclaration* decl,
     ReportError(stream.str());
   }
 
+  if (signature.return_type->IsStructType()) {
+    std::stringstream stream;
+    stream << "runtime functions (in this case" << decl->name
+           << ") cannot return structs (in this case "
+           << static_cast<const StructType*>(signature.return_type)->name()
+           << ")";
+    ReportError(stream.str());
+  }
+
   declarations()->DeclareRuntimeFunction(decl->name, signature);
 }
 
@@ -138,7 +156,7 @@ void DeclarationVisitor::Visit(TorqueBuiltinDeclaration* decl,
   CurrentCallableActivator activator(global_context_, builtin, decl);
   DeclareSignature(signature);
   if (signature.parameter_types.var_args) {
-    declarations()->DeclareConstant(
+    declarations()->DeclareExternConstant(
         decl->signature->parameters.arguments_variable,
         TypeOracle::GetArgumentsType(), "arguments");
   }
@@ -158,8 +176,9 @@ void DeclarationVisitor::Visit(TorqueMacroDeclaration* decl,
   DeclareSignature(signature);
   Variable* return_variable = nullptr;
   if (!signature.return_type->IsVoidOrNever()) {
-    return_variable = declarations()->DeclareVariable(kReturnValueVariable,
-                                                      signature.return_type);
+    return_variable =
+        DeclareVariable(kReturnValueVariable, signature.return_type,
+                        signature.return_type->IsConstexpr());
   }
 
   PushControlSplit();
@@ -173,6 +192,12 @@ void DeclarationVisitor::Visit(TorqueMacroDeclaration* decl,
       changed_vars);
 }
 
+void DeclarationVisitor::Visit(ConstDeclaration* decl) {
+  declarations()->DeclareModuleConstant(decl->name,
+                                        declarations()->GetType(decl->type));
+  Visit(decl->expression);
+}
+
 void DeclarationVisitor::Visit(StandardDeclaration* decl) {
   Signature signature = MakeSignature(decl->callable->signature.get());
   Visit(decl->callable, signature, decl->body);
@@ -245,17 +270,53 @@ void DeclarationVisitor::Visit(ReturnStatement* stmt) {
   }
 }
 
+Variable* DeclarationVisitor::DeclareVariable(const std::string& name,
+                                              const Type* type, bool is_const) {
+  Variable* result = declarations()->DeclareVariable(name, type, is_const);
+  if (type->IsStructType()) {
+    const StructType* struct_type = StructType::cast(type);
+    for (auto& field : struct_type->fields()) {
+      std::string field_var_name = name + "." + field.name;
+      DeclareVariable(field_var_name, field.type, is_const);
+    }
+  }
+  return result;
+}
+
+Parameter* DeclarationVisitor::DeclareParameter(const std::string& name,
+                                                const Type* type) {
+  Parameter* result = declarations()->DeclareParameter(
+      name, GetParameterVariableFromName(name), type);
+  if (type->IsStructType()) {
+    const StructType* struct_type = StructType::cast(type);
+    for (auto& field : struct_type->fields()) {
+      std::string field_var_name = name + "." + field.name;
+      DeclareParameter(field_var_name, field.type);
+    }
+  }
+  return result;
+}
+
 void DeclarationVisitor::Visit(VarDeclarationStatement* stmt) {
   std::string variable_name = stmt->name;
   const Type* type = declarations()->GetType(stmt->type);
-  if (type->IsConstexpr()) {
-    ReportError("cannot declare variable with constexpr type");
+  if (type->IsConstexpr() && !stmt->const_qualified) {
+    ReportError(
+        "cannot declare variable with constexpr type. Use 'const' instead.");
   }
-  declarations()->DeclareVariable(variable_name, type);
+  DeclareVariable(variable_name, type, stmt->const_qualified);
   if (global_context_.verbose()) {
     std::cout << "declared variable " << variable_name << " with type " << *type
               << "\n";
   }
+
+  // const qualified variables are required to be initialized properly.
+  if (stmt->const_qualified && !stmt->initializer) {
+    std::stringstream stream;
+    stream << "local constant \"" << variable_name << "\" is not initialized.";
+    ReportError(stream.str());
+  }
+
   if (stmt->initializer) {
     Visit(*stmt->initializer);
     if (global_context_.verbose()) {
@@ -265,6 +326,27 @@ void DeclarationVisitor::Visit(VarDeclarationStatement* stmt) {
   }
 }
 
+void DeclarationVisitor::Visit(ExternConstDeclaration* decl) {
+  const Type* type = declarations()->GetType(decl->type);
+  if (!type->IsConstexpr()) {
+    std::stringstream stream;
+    stream << "extern constants must have constexpr type, but found: \""
+           << *type << "\"\n";
+    ReportError(stream.str());
+  }
+
+  declarations()->DeclareExternConstant(decl->name, type, decl->literal);
+}
+
+void DeclarationVisitor::Visit(StructDeclaration* decl) {
+  std::vector<NameAndType> fields;
+  for (auto& field : decl->fields) {
+    const Type* field_type = declarations()->GetType(field.type);
+    fields.push_back({field.name, field_type});
+  }
+  declarations()->DeclareStruct(CurrentModule(), decl->name, fields);
+}
+
 void DeclarationVisitor::Visit(LogicalOrExpression* expr) {
   {
     Declarations::NodeScopeActivator scope(declarations(), expr->left);
@@ -381,8 +463,13 @@ void DeclarationVisitor::Visit(TryLabelStatement* stmt) {
 
         size_t i = 0;
         for (auto p : block->parameters.names) {
-          shared_label->AddVariable(declarations()->DeclareVariable(
-              p, declarations()->GetType(block->parameters.types[i])));
+          const Type* type =
+              declarations()->GetType(block->parameters.types[i]);
+          if (type->IsConstexpr()) {
+            ReportError("no constexpr type allowed for label arguments");
+          }
+
+          shared_label->AddVariable(DeclareVariable(p, type, false));
           ++i;
         }
       }
@@ -522,8 +609,7 @@ void DeclarationVisitor::DeclareSignature(const Signature& signature) {
   for (auto name : signature.parameter_names) {
     const Type* t(*type_iterator++);
     if (name.size() != 0) {
-      declarations()->DeclareParameter(name, GetParameterVariableFromName(name),
-                                       t);
+      DeclareParameter(name, t);
     }
   }
   for (auto& label : signature.labels) {
@@ -531,9 +617,12 @@ void DeclarationVisitor::DeclareSignature(const Signature& signature) {
     Label* new_label = declarations()->DeclareLabel(label.name);
     size_t i = 0;
     for (auto var_type : label_params) {
+      if (var_type->IsConstexpr()) {
+        ReportError("no constexpr type allowed for label arguments");
+      }
+
       std::string var_name = label.name + std::to_string(i++);
-      new_label->AddVariable(
-          declarations()->DeclareVariable(var_name, var_type));
+      new_label->AddVariable(DeclareVariable(var_name, var_type, false));
     }
   }
 }
diff --git a/deps/v8/src/torque/declaration-visitor.h b/deps/v8/src/torque/declaration-visitor.h
index 3299dc501fc56f..b37ecb28606ffb 100644
--- a/deps/v8/src/torque/declaration-visitor.h
+++ b/deps/v8/src/torque/declaration-visitor.h
@@ -91,6 +91,7 @@ class DeclarationVisitor : public FileVisitor {
 
   void Visit(CallableNode* decl, const Signature& signature, Statement* body);
 
+  void Visit(ConstDeclaration* decl);
   void Visit(StandardDeclaration* decl);
   void Visit(GenericDeclaration* decl);
   void Visit(SpecializationDeclaration* decl);
@@ -106,13 +107,10 @@ class DeclarationVisitor : public FileVisitor {
   }
 
   void Visit(VarDeclarationStatement* stmt);
+  void Visit(ExternConstDeclaration* decl);
 
-  void Visit(ExternConstDeclaration* decl) {
-    // TODO(szuend): When module-wide const bindings are available, only
-    //               constexpr types should be allowed here.
-    declarations()->DeclareConstant(
-        decl->name, declarations()->GetType(decl->type), decl->literal);
-  }
+  void Visit(StructDeclaration* decl);
+  void Visit(StructExpression* decl) {}
 
   void Visit(LogicalOrExpression* expr);
   void Visit(LogicalAndExpression* expr);
@@ -154,6 +152,10 @@ class DeclarationVisitor : public FileVisitor {
     live_and_changed_variables_.push_back(live_and_changed);
   }
 
+  Variable* DeclareVariable(const std::string& name, const Type* type,
+                            bool is_const);
+  Parameter* DeclareParameter(const std::string& name, const Type* type);
+
   std::set<const Variable*> PopControlSplit() {
     auto result = live_and_changed_variables_.back().changed;
     live_and_changed_variables_.pop_back();
diff --git a/deps/v8/src/torque/declarations.cc b/deps/v8/src/torque/declarations.cc
index 4108914f8d0c1a..95764e302919dd 100644
--- a/deps/v8/src/torque/declarations.cc
+++ b/deps/v8/src/torque/declarations.cc
@@ -179,6 +179,18 @@ GenericList* Declarations::LookupGeneric(const std::string& name) {
   return nullptr;
 }
 
+ModuleConstant* Declarations::LookupModuleConstant(const std::string& name) {
+  Declarable* declarable = Lookup(name);
+  if (declarable != nullptr) {
+    if (declarable->IsModuleConstant()) {
+      return ModuleConstant::cast(declarable);
+    }
+    ReportError(name + " is not a constant");
+  }
+  ReportError(std::string("constant \"") + name + "\" is not defined");
+  return nullptr;
+}
+
 const AbstractType* Declarations::DeclareAbstractType(
     const std::string& name, const std::string& generated,
     base::Optional<const AbstractType*> non_constexpr_version,
@@ -212,6 +224,12 @@ void Declarations::DeclareType(const std::string& name, const Type* type) {
   Declare(name, std::unique_ptr<TypeAlias>(result));
 }
 
+void Declarations::DeclareStruct(Module* module, const std::string& name,
+                                 const std::vector<NameAndType>& fields) {
+  const StructType* new_type = TypeOracle::GetStructType(module, name, fields);
+  DeclareType(name, new_type);
+}
+
 Label* Declarations::DeclareLabel(const std::string& name) {
   CheckAlreadyDeclared(name, "label");
   Label* result = new Label(name);
@@ -276,10 +294,12 @@ RuntimeFunction* Declarations::DeclareRuntimeFunction(
 }
 
 Variable* Declarations::DeclareVariable(const std::string& var,
-                                        const Type* type) {
-  std::string name(var + std::to_string(GetNextUniqueDeclarationNumber()));
+                                        const Type* type, bool is_const) {
+  std::string name(var + "_" +
+                   std::to_string(GetNextUniqueDeclarationNumber()));
+  std::replace(name.begin(), name.end(), '.', '_');
   CheckAlreadyDeclared(var, "variable");
-  Variable* result = new Variable(var, name, type);
+  Variable* result = new Variable(var, name, type, is_const);
   Declare(var, std::unique_ptr<Declarable>(result));
   return result;
 }
@@ -302,11 +322,20 @@ Label* Declarations::DeclarePrivateLabel(const std::string& raw_name) {
   return result;
 }
 
-void Declarations::DeclareConstant(const std::string& name, const Type* type,
-                                   const std::string& value) {
+void Declarations::DeclareExternConstant(const std::string& name,
+                                         const Type* type,
+                                         const std::string& value) {
   CheckAlreadyDeclared(name, "constant, parameter or arguments");
-  Constant* result = new Constant(name, type, value);
+  ExternConstant* result = new ExternConstant(name, type, value);
+  Declare(name, std::unique_ptr<Declarable>(result));
+}
+
+ModuleConstant* Declarations::DeclareModuleConstant(const std::string& name,
+                                                    const Type* type) {
+  CheckAlreadyDeclared(name, "module constant");
+  ModuleConstant* result = new ModuleConstant(name, type);
   Declare(name, std::unique_ptr<Declarable>(result));
+  return result;
 }
 
 Generic* Declarations::DeclareGeneric(const std::string& name, Module* module,
diff --git a/deps/v8/src/torque/declarations.h b/deps/v8/src/torque/declarations.h
index 04d5f62410ab5b..76a436e43ee62e 100644
--- a/deps/v8/src/torque/declarations.h
+++ b/deps/v8/src/torque/declarations.h
@@ -67,6 +67,7 @@ class Declarations {
   Label* LookupLabel(const std::string& name);
 
   GenericList* LookupGeneric(const std::string& name);
+  ModuleConstant* LookupModuleConstant(const std::string& name);
 
   const AbstractType* DeclareAbstractType(
       const std::string& name, const std::string& generated,
@@ -75,6 +76,9 @@ class Declarations {
 
   void DeclareType(const std::string& name, const Type* type);
 
+  void DeclareStruct(Module* module, const std::string& name,
+                     const std::vector<NameAndType>& fields);
+
   Label* DeclareLabel(const std::string& name);
 
   Macro* DeclareMacro(const std::string& name, const Signature& signature,
@@ -86,7 +90,8 @@ class Declarations {
   RuntimeFunction* DeclareRuntimeFunction(const std::string& name,
                                           const Signature& signature);
 
-  Variable* DeclareVariable(const std::string& var, const Type* type);
+  Variable* DeclareVariable(const std::string& var, const Type* type,
+                            bool is_const);
 
   Parameter* DeclareParameter(const std::string& name,
                               const std::string& mangled_name,
@@ -94,8 +99,10 @@ class Declarations {
 
   Label* DeclarePrivateLabel(const std::string& name);
 
-  void DeclareConstant(const std::string& name, const Type* type,
-                       const std::string& value);
+  void DeclareExternConstant(const std::string& name, const Type* type,
+                             const std::string& value);
+  ModuleConstant* DeclareModuleConstant(const std::string& name,
+                                        const Type* type);
 
   Generic* DeclareGeneric(const std::string& name, Module* module,
                           GenericDeclaration* generic);
diff --git a/deps/v8/src/torque/file-visitor.cc b/deps/v8/src/torque/file-visitor.cc
index 3ff7cd9baa3d87..c2e5aa79245fac 100644
--- a/deps/v8/src/torque/file-visitor.cc
+++ b/deps/v8/src/torque/file-visitor.cc
@@ -25,6 +25,12 @@ Signature FileVisitor::MakeSignature(const CallableNodeSignature* signature) {
   return result;
 }
 
+Signature FileVisitor::MakeSignatureFromReturnType(
+    TypeExpression* return_type) {
+  Signature result{{}, {{}, false}, declarations()->GetType(return_type), {}};
+  return result;
+}
+
 void FileVisitor::QueueGenericSpecialization(
     const SpecializationKey& key, CallableNode* callable,
     const CallableNodeSignature* signature, base::Optional<Statement*> body) {
diff --git a/deps/v8/src/torque/file-visitor.h b/deps/v8/src/torque/file-visitor.h
index 0c5faae3b44f56..f1b7c4bbefd9d0 100644
--- a/deps/v8/src/torque/file-visitor.h
+++ b/deps/v8/src/torque/file-visitor.h
@@ -66,6 +66,7 @@ class FileVisitor {
   }
 
   Signature MakeSignature(const CallableNodeSignature* signature);
+  Signature MakeSignatureFromReturnType(TypeExpression* return_type);
 
   struct PendingSpecialization {
     SpecializationKey key;
diff --git a/deps/v8/src/torque/implementation-visitor.cc b/deps/v8/src/torque/implementation-visitor.cc
index 72c7efff20fa8f..58fe638a138b6e 100644
--- a/deps/v8/src/torque/implementation-visitor.cc
+++ b/deps/v8/src/torque/implementation-visitor.cc
@@ -2,6 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
+#include <algorithm>
+
 #include "src/torque/implementation-visitor.h"
 #include "src/torque/parameter-difference.h"
 
@@ -164,6 +166,42 @@ void ImplementationVisitor::Visit(ModuleDeclaration* decl) {
   module_ = saved_module;
 }
 
+void ImplementationVisitor::Visit(ConstDeclaration* decl) {
+  Signature signature = MakeSignatureFromReturnType(decl->type);
+  std::string name = decl->name;
+
+  header_out() << "  ";
+  GenerateFunctionDeclaration(header_out(), "", name, signature, {});
+  header_out() << ";\n";
+
+  GenerateFunctionDeclaration(source_out(),
+                              GetDSLAssemblerName(CurrentModule()) + "::", name,
+                              signature, {});
+  source_out() << " {\n";
+
+  DCHECK(!signature.return_type->IsVoidOrNever());
+
+  VisitResult expression_result = Visit(decl->expression);
+  VisitResult return_result =
+      GenerateImplicitConvert(signature.return_type, expression_result);
+
+  GenerateIndent();
+  source_out() << "return " << return_result.RValue() << ";\n";
+  source_out() << "}\n\n";
+}
+
+void ImplementationVisitor::Visit(StructDeclaration* decl) {
+  header_out() << "  struct " << decl->name << " {\n";
+  const StructType* struct_type =
+      static_cast<const StructType*>(declarations()->LookupType(decl->name));
+  for (auto& field : struct_type->fields()) {
+    header_out() << "    " << field.type->GetGeneratedTypeName();
+    header_out() << " " << field.name << ";\n";
+  }
+  header_out() << "  } "
+               << ";\n";
+}
+
 void ImplementationVisitor::Visit(TorqueMacroDeclaration* decl,
                                   const Signature& sig, Statement* body) {
   Signature signature = MakeSignature(decl->signature.get());
@@ -222,7 +260,8 @@ void ImplementationVisitor::Visit(TorqueMacroDeclaration* decl,
     if (result_var != nullptr) {
       GenerateIndent();
       source_out() << "return "
-                   << VisitResult(result_var->type(), result_var).RValue()
+                   << RValueFlattenStructs(
+                          VisitResult(result_var->type(), result_var))
                    << ";" << std::endl;
     }
     source_out() << "}" << std::endl << std::endl;
@@ -251,8 +290,9 @@ void ImplementationVisitor::Visit(TorqueBuiltinDeclaration* decl,
   size_t first = 1;
   if (builtin->IsVarArgsJavaScript()) {
     assert(decl->signature->parameters.has_varargs);
-    Constant* arguments = Constant::cast(declarations()->LookupValue(
-        decl->signature->parameters.arguments_variable));
+    ExternConstant* arguments =
+        ExternConstant::cast(declarations()->LookupValue(
+            decl->signature->parameters.arguments_variable));
     std::string arguments_name = arguments->value();
     GenerateIndent();
     source_out()
@@ -310,7 +350,7 @@ VisitResult ImplementationVisitor::Visit(ConditionalExpression* expr) {
     source_out() << "" << std::endl;
     left = Visit(expr->if_true);
     GenerateIndent();
-    source_out() << "return " << left.RValue() << ";" << std::endl;
+    source_out() << "return " << RValueFlattenStructs(left) << ";" << std::endl;
   }
   source_out() << ";" << std::endl;
   GenerateIndent();
@@ -320,7 +360,8 @@ VisitResult ImplementationVisitor::Visit(ConditionalExpression* expr) {
     source_out() << "" << std::endl;
     right = Visit(expr->if_false);
     GenerateIndent();
-    source_out() << "return " << right.RValue() << ";" << std::endl;
+    source_out() << "return " << RValueFlattenStructs(right) << ";"
+                 << std::endl;
   }
   source_out() << ";" << std::endl;
 
@@ -372,7 +413,7 @@ VisitResult ImplementationVisitor::Visit(LogicalOrExpression* expr) {
     if (left_result.type()->IsBool()) {
       Label* true_label = declarations()->LookupLabel(kTrueLabelName);
       GenerateIndent();
-      source_out() << "GotoIf(" << left_result.RValue() << ", "
+      source_out() << "GotoIf(" << RValueFlattenStructs(left_result) << ", "
                    << true_label->generated() << ");" << std::endl;
     } else if (!left_result.type()->IsConstexprBool()) {
       GenerateLabelBind(false_label);
@@ -387,9 +428,9 @@ VisitResult ImplementationVisitor::Visit(LogicalOrExpression* expr) {
     ReportError(stream.str());
   }
   if (left_result.type()->IsConstexprBool()) {
-    return VisitResult(left_result.type(), std::string("(") +
-                                               left_result.RValue() + " || " +
-                                               right_result.RValue() + ")");
+    return VisitResult(left_result.type(),
+                       std::string("(") + RValueFlattenStructs(left_result) +
+                           " || " + RValueFlattenStructs(right_result) + ")");
   } else {
     return right_result;
   }
@@ -405,7 +446,7 @@ VisitResult ImplementationVisitor::Visit(LogicalAndExpression* expr) {
     if (left_result.type()->IsBool()) {
       Label* false_label = declarations()->LookupLabel(kFalseLabelName);
       GenerateIndent();
-      source_out() << "GotoIfNot(" << left_result.RValue() << ", "
+      source_out() << "GotoIfNot(" << RValueFlattenStructs(left_result) << ", "
                    << false_label->generated() << ");" << std::endl;
     } else if (!left_result.type()->IsConstexprBool()) {
       GenerateLabelBind(true_label);
@@ -420,9 +461,9 @@ VisitResult ImplementationVisitor::Visit(LogicalAndExpression* expr) {
     ReportError(stream.str());
   }
   if (left_result.type()->IsConstexprBool()) {
-    return VisitResult(left_result.type(), std::string("(") +
-                                               left_result.RValue() + " && " +
-                                               right_result.RValue() + ")");
+    return VisitResult(left_result.type(),
+                       std::string("(") + RValueFlattenStructs(left_result) +
+                           " && " + RValueFlattenStructs(right_result) + ")");
   } else {
     return right_result;
   }
@@ -566,7 +607,8 @@ const Type* ImplementationVisitor::Visit(IfStatement* stmt) {
     const Type* right_result = TypeOracle::GetVoidType();
     {
       GenerateIndent();
-      source_out() << "if ((" << expression_result.RValue() << ")) ";
+      source_out() << "if ((" << RValueFlattenStructs(expression_result)
+                   << ")) ";
       ScopedIndent indent(this, false);
       source_out() << std::endl;
       left_result = Visit(stmt->if_true);
@@ -782,11 +824,12 @@ const Type* ImplementationVisitor::Visit(ReturnStatement* stmt) {
     } else if (current_callable->IsBuiltin()) {
       if (Builtin::cast(current_callable)->IsVarArgsJavaScript()) {
         GenerateIndent();
-        source_out() << "arguments->PopAndReturn(" << return_result.RValue()
-                     << ");" << std::endl;
+        source_out() << "arguments->PopAndReturn("
+                     << RValueFlattenStructs(return_result) << ");"
+                     << std::endl;
       } else {
         GenerateIndent();
-        source_out() << "Return(" << return_result.RValue() << ");"
+        source_out() << "Return(" << RValueFlattenStructs(return_result) << ");"
                      << std::endl;
       }
     } else {
@@ -1030,26 +1073,35 @@ void ImplementationVisitor::GenerateIndent() {
 
 void ImplementationVisitor::GenerateMacroFunctionDeclaration(
     std::ostream& o, const std::string& macro_prefix, Macro* macro) {
+  GenerateFunctionDeclaration(o, macro_prefix, macro->name(),
+                              macro->signature(), macro->parameter_names());
+}
+
+void ImplementationVisitor::GenerateFunctionDeclaration(
+    std::ostream& o, const std::string& macro_prefix, const std::string& name,
+    const Signature& signature, const NameVector& parameter_names) {
   if (global_context_.verbose()) {
-    std::cout << "generating source for declaration " << *macro << ""
+    std::cout << "generating source for declaration " << name << ""
               << std::endl;
   }
 
   // Quite a hack here. Make sure that TNode is namespace qualified if the
-  // macro name is also qualified.
-  std::string return_type_name(
-      macro->signature().return_type->GetGeneratedTypeName());
-  if (macro_prefix != "" && (return_type_name.length() > 5) &&
-      (return_type_name.substr(0, 5) == "TNode")) {
+  // macro/constant name is also qualified.
+  std::string return_type_name(signature.return_type->GetGeneratedTypeName());
+  if (const StructType* struct_type =
+          StructType::DynamicCast(signature.return_type)) {
+    o << GetDSLAssemblerName(struct_type->module()) << "::";
+  } else if (macro_prefix != "" && (return_type_name.length() > 5) &&
+             (return_type_name.substr(0, 5) == "TNode")) {
     o << "compiler::";
   }
   o << return_type_name;
-  o << " " << macro_prefix << macro->name() << "(";
+  o << " " << macro_prefix << name << "(";
 
-  DCHECK_EQ(macro->signature().types().size(), macro->parameter_names().size());
-  auto type_iterator = macro->signature().types().begin();
+  DCHECK_EQ(signature.types().size(), parameter_names.size());
+  auto type_iterator = signature.types().begin();
   bool first = true;
-  for (const std::string& name : macro->parameter_names()) {
+  for (const std::string& name : parameter_names) {
     if (!first) {
       o << ", ";
     }
@@ -1062,7 +1114,7 @@ void ImplementationVisitor::GenerateMacroFunctionDeclaration(
     first = false;
   }
 
-  for (const LabelDeclaration& label_info : macro->signature().labels) {
+  for (const LabelDeclaration& label_info : signature.labels) {
     Label* label = declarations()->LookupLabel(label_info.name);
     if (!first) {
       o << ", ";
@@ -1189,21 +1241,33 @@ Callable* ImplementationVisitor::LookupCall(const std::string& name,
   return result;
 }
 
+void ImplementationVisitor::GetFlattenedStructsVars(
+    const Variable* base, std::set<const Variable*>& vars) {
+  const Type* type = base->type();
+  if (base->IsConst()) return;
+  if (type->IsStructType()) {
+    const StructType* struct_type = StructType::cast(type);
+    for (auto& field : struct_type->fields()) {
+      std::string field_var_name = base->name() + "." + field.name;
+      GetFlattenedStructsVars(
+          Variable::cast(declarations()->LookupValue(field_var_name)), vars);
+    }
+  } else {
+    vars.insert(base);
+  }
+}
+
 void ImplementationVisitor::GenerateChangedVarsFromControlSplit(AstNode* node) {
   const std::set<const Variable*>& changed_vars =
       global_context_.GetControlSplitChangedVariables(
           node, declarations()->GetCurrentSpecializationTypeNamesVector());
-  source_out() << "{";
-  bool first = true;
+  std::set<const Variable*> flattened_vars;
   for (auto v : changed_vars) {
-    if (v->type()->IsConstexpr()) continue;
-    if (first) {
-      first = false;
-    } else {
-      source_out() << ", ";
-    }
-    source_out() << v->value();
+    GetFlattenedStructsVars(v, flattened_vars);
   }
+  source_out() << "{";
+  PrintCommaSeparatedList(source_out(), flattened_vars,
+                          [&](const Variable* v) { return v->value(); });
   source_out() << "}";
 }
 
@@ -1223,12 +1287,42 @@ const Type* ImplementationVisitor::GetCommonType(const Type* left,
 
 VisitResult ImplementationVisitor::GenerateCopy(const VisitResult& to_copy) {
   std::string temp = GenerateNewTempVariable(to_copy.type());
-  source_out() << to_copy.RValue() << ";" << std::endl;
+  source_out() << RValueFlattenStructs(to_copy) << ";" << std::endl;
   GenerateIndent();
   source_out() << "USE(" << temp << ");" << std::endl;
   return VisitResult(to_copy.type(), temp);
 }
 
+VisitResult ImplementationVisitor::Visit(StructExpression* decl) {
+  const Type* raw_type = declarations()->LookupType(decl->name);
+  if (!raw_type->IsStructType()) {
+    std::stringstream s;
+    s << decl->name << " is not a struct but used like one ";
+    ReportError(s.str());
+  }
+  const StructType* struct_type = StructType::cast(raw_type);
+  if (struct_type->fields().size() != decl->expressions.size()) {
+    std::stringstream s;
+    s << "initializer count mismatch for struct " << decl->name << " (expected "
+      << struct_type->fields().size() << ", found " << decl->expressions.size()
+      << ")";
+    ReportError(s.str());
+  }
+  std::vector<VisitResult> expression_results;
+  for (auto& field : struct_type->fields()) {
+    VisitResult value = Visit(decl->expressions[expression_results.size()]);
+    value = GenerateImplicitConvert(field.type, value);
+    expression_results.push_back(value);
+  }
+  std::string result_var_name = GenerateNewTempVariable(struct_type);
+  source_out() << "{";
+  PrintCommaSeparatedList(
+      source_out(), expression_results,
+      [&](const VisitResult& result) { return RValueFlattenStructs(result); });
+  source_out() << "};\n";
+  return VisitResult(struct_type, result_var_name);
+}
+
 LocationReference ImplementationVisitor::GetLocationReference(
     LocationExpression* location) {
   switch (location->kind) {
@@ -1245,6 +1339,47 @@ LocationReference ImplementationVisitor::GetLocationReference(
   }
 }
 
+LocationReference ImplementationVisitor::GetLocationReference(
+    FieldAccessExpression* expr) {
+  VisitResult result = Visit(expr->object);
+  if (result.type()->IsStructType()) {
+    if (result.declarable()) {
+      return LocationReference(
+          declarations()->LookupValue((*result.declarable())->name() + "." +
+                                      expr->field),
+          {}, {});
+
+    } else {
+      return LocationReference(
+          nullptr,
+          VisitResult(result.type(), result.RValue() + "." + expr->field), {});
+    }
+  }
+  return LocationReference(nullptr, result, {});
+}
+
+std::string ImplementationVisitor::RValueFlattenStructs(VisitResult result) {
+  if (result.declarable()) {
+    const Value* value = *result.declarable();
+    const Type* type = value->type();
+    if (const StructType* struct_type = StructType::DynamicCast(type)) {
+      std::stringstream s;
+      s << struct_type->name() << "{";
+      PrintCommaSeparatedList(
+          s, struct_type->fields(), [&](const NameAndType& field) {
+            std::string field_declaration = value->name() + "." + field.name;
+            Variable* field_variable =
+                Variable::cast(declarations()->LookupValue(field_declaration));
+            return RValueFlattenStructs(
+                VisitResult(field_variable->type(), field_variable));
+          });
+      s << "}";
+      return s.str();
+    }
+  }
+  return result.RValue();
+}
+
 VisitResult ImplementationVisitor::GenerateFetchFromLocation(
     LocationExpression* location, LocationReference reference) {
   switch (location->kind) {
@@ -1262,28 +1397,77 @@ VisitResult ImplementationVisitor::GenerateFetchFromLocation(
   }
 }
 
+VisitResult ImplementationVisitor::GenerateFetchFromLocation(
+    FieldAccessExpression* expr, LocationReference reference) {
+  const Type* type = reference.base.type();
+  if (reference.value != nullptr) {
+    return GenerateFetchFromLocation(reference);
+  } else if (const StructType* struct_type = StructType::DynamicCast(type)) {
+    auto& fields = struct_type->fields();
+    auto i = std::find_if(
+        fields.begin(), fields.end(),
+        [&](const NameAndType& f) { return f.name == expr->field; });
+    if (i == fields.end()) {
+      std::stringstream s;
+      s << "\"" << expr->field << "\" is not a field of struct type \""
+        << struct_type->name() << "\"";
+      ReportError(s.str());
+    }
+    return VisitResult(i->type, reference.base.RValue());
+  } else {
+    Arguments arguments;
+    arguments.parameters = {reference.base};
+    return GenerateCall(std::string(".") + expr->field, arguments);
+  }
+}
+
 void ImplementationVisitor::GenerateAssignToVariable(Variable* var,
                                                      VisitResult value) {
-  VisitResult casted_value = GenerateImplicitConvert(var->type(), value);
-  GenerateIndent();
-  VisitResult variable_result = {var->type(), var};
-  source_out() << variable_result.LValue() << " = " << casted_value.RValue()
-               << ";\n";
+  if (var->type()->IsStructType()) {
+    if (value.type() != var->type()) {
+      std::stringstream s;
+      s << "incompatable assignment from type " << *value.type() << " to "
+        << *var->type();
+      ReportError(s.str());
+    }
+    const StructType* struct_type = StructType::cast(var->type());
+    for (auto& field : struct_type->fields()) {
+      std::string field_declaration = var->name() + "." + field.name;
+      Variable* field_variable =
+          Variable::cast(declarations()->LookupValue(field_declaration));
+      if (value.declarable() && (*value.declarable())->IsVariable()) {
+        Variable* source_field = Variable::cast(declarations()->LookupValue(
+            Variable::cast((*value.declarable()))->name() + "." + field.name));
+        GenerateAssignToVariable(
+            field_variable, VisitResult{source_field->type(), source_field});
+      } else {
+        GenerateAssignToVariable(
+            field_variable, VisitResult{field_variable->type(),
+                                        value.RValue() + "." + field.name});
+      }
+    }
+  } else {
+    VisitResult casted_value = GenerateImplicitConvert(var->type(), value);
+    GenerateIndent();
+    VisitResult var_value = {var->type(), var};
+    source_out() << var_value.LValue() << " = "
+                 << RValueFlattenStructs(casted_value) << ";" << std::endl;
+  }
   var->Define();
 }
 
 void ImplementationVisitor::GenerateAssignToLocation(
     LocationExpression* location, const LocationReference& reference,
     VisitResult assignment_value) {
-  if (IdentifierExpression::cast(location)) {
+  if (reference.value != nullptr) {
     Value* value = reference.value;
-    if (value->IsConst()) {
+    Variable* var = Variable::cast(value);
+    if (var->IsConst()) {
       std::stringstream s;
-      s << "\"" << value->name()
+      s << "\"" << var->name()
         << "\" is declared const (maybe implicitly) and cannot be assigned to";
       ReportError(s.str());
     }
-    Variable* var = Variable::cast(value);
     GenerateAssignToVariable(var, assignment_value);
   } else if (auto access = FieldAccessExpression::cast(location)) {
     GenerateCall(std::string(".") + access->field + "=",
@@ -1295,6 +1479,36 @@ void ImplementationVisitor::GenerateAssignToLocation(
   }
 }
 
+void ImplementationVisitor::GenerateVariableDeclaration(const Variable* var) {
+  const Type* var_type = var->type();
+  if (var_type->IsStructType()) {
+    const StructType* struct_type = StructType::cast(var_type);
+    for (auto& field : struct_type->fields()) {
+      GenerateVariableDeclaration(Variable::cast(
+          declarations()->LookupValue(var->name() + "." + field.name)));
+    }
+  } else {
+    std::string value = var->value();
+    GenerateIndent();
+    if (var_type->IsConstexpr()) {
+      source_out() << var_type->GetGeneratedTypeName();
+      source_out() << " " << value << "_impl;" << std::endl;
+    } else if (var->IsConst()) {
+      source_out() << "TNode<" << var->type()->GetGeneratedTNodeTypeName();
+      source_out() << "> " << var->value() << "_impl;\n";
+    } else {
+      source_out() << "TVARIABLE(";
+      source_out() << var_type->GetGeneratedTNodeTypeName();
+      source_out() << ", " << value << "_impl);" << std::endl;
+    }
+    GenerateIndent();
+    source_out() << "auto " << value << " = &" << value << "_impl;"
+                 << std::endl;
+    GenerateIndent();
+    source_out() << "USE(" << value << ");" << std::endl;
+  }
+}
+
 Variable* ImplementationVisitor::GenerateVariableDeclaration(
     AstNode* node, const std::string& name,
     const base::Optional<const Type*>& type,
@@ -1304,7 +1518,7 @@ Variable* ImplementationVisitor::GenerateVariableDeclaration(
   if (declarations()->TryLookup(name)) {
     variable = Variable::cast(declarations()->LookupValue(name));
   } else {
-    variable = declarations()->DeclareVariable(name, *type);
+    variable = declarations()->DeclareVariable(name, *type, false);
     // Because the variable is being defined during code generation, it must be
     // assumed that it changes along all control split paths because it's no
     // longer possible to run the control-flow anlaysis in the declaration pass
@@ -1313,21 +1527,7 @@ Variable* ImplementationVisitor::GenerateVariableDeclaration(
         node, declarations()->GetCurrentSpecializationTypeNamesVector(),
         variable);
   }
-
-  GenerateIndent();
-  if (variable->type()->IsConstexpr()) {
-    source_out() << variable->type()->GetGeneratedTypeName();
-    source_out() << " " << variable->value() << "_impl;" << std::endl;
-  } else {
-    source_out() << "TVARIABLE(";
-    source_out() << variable->type()->GetGeneratedTNodeTypeName();
-    source_out() << ", " << variable->value() << "_impl);" << std::endl;
-  }
-  GenerateIndent();
-  source_out() << "auto " << variable->value() << " = &" << variable->value()
-               << "_impl;" << std::endl;
-  GenerateIndent();
-  source_out() << "USE(" << variable->value() << ");" << std::endl;
+  GenerateVariableDeclaration(variable);
   if (initialization) {
     GenerateAssignToVariable(variable, *initialization);
   }
@@ -1397,7 +1597,7 @@ VisitResult ImplementationVisitor::GeneratePointerCall(
     const Type* to_type = type->parameter_types()[current];
     VisitResult result =
         GenerateImplicitConvert(to_type, arguments.parameters[current]);
-    variables.push_back(result.RValue());
+    variables.push_back(RValueFlattenStructs(result));
   }
 
   std::string result_variable_name;
@@ -1405,10 +1605,15 @@ VisitResult ImplementationVisitor::GeneratePointerCall(
   if (no_result) {
     GenerateIndent();
   } else {
-    result_variable_name = GenerateNewTempVariable(type->return_type());
-    source_out() << "UncheckedCast<";
-    source_out() << type->return_type()->GetGeneratedTNodeTypeName();
-    source_out() << ">(";
+    const Type* return_type = type->return_type();
+    result_variable_name = GenerateNewTempVariable(return_type);
+    if (return_type->IsStructType()) {
+      source_out() << "(";
+    } else {
+      source_out() << "UncheckedCast<";
+      source_out() << type->return_type()->GetGeneratedTNodeTypeName();
+      source_out() << ">(";
+    }
   }
 
   Builtin* example_builtin =
@@ -1426,7 +1631,7 @@ VisitResult ImplementationVisitor::GeneratePointerCall(
   }
   source_out() << "Builtins::CallableFor(isolate(), Builtins::k"
                << example_builtin->name() << ").descriptor(), "
-               << callee_result.RValue() << ", ";
+               << RValueFlattenStructs(callee_result) << ", ";
 
   size_t total_parameters = 0;
   for (size_t i = 0; i < arguments.parameters.size(); ++i) {
@@ -1465,7 +1670,7 @@ VisitResult ImplementationVisitor::GenerateCall(
                               : callable->signature().types()[current];
     VisitResult result =
         GenerateImplicitConvert(to_type, arguments.parameters[current]);
-    variables.push_back(result.RValue());
+    variables.push_back(RValueFlattenStructs(result));
   }
 
   std::string result_variable_name;
@@ -1474,9 +1679,13 @@ VisitResult ImplementationVisitor::GenerateCall(
   } else {
     result_variable_name = GenerateNewTempVariable(result_type);
     if (!result_type->IsConstexpr()) {
-      source_out() << "UncheckedCast<";
-      source_out() << result_type->GetGeneratedTNodeTypeName();
-      source_out() << ">(";
+      if (result_type->IsStructType()) {
+        source_out() << "(";
+      } else {
+        source_out() << "UncheckedCast<";
+        source_out() << result_type->GetGeneratedTNodeTypeName();
+        source_out() << ">(";
+      }
     }
   }
   if (callable->IsBuiltin()) {
@@ -1629,7 +1838,7 @@ VisitResult ImplementationVisitor::Visit(CallExpression* expr,
   }
   if (!result.type()->IsVoidOrNever()) {
     GenerateIndent();
-    source_out() << "USE(" << result.RValue() << ");" << std::endl;
+    source_out() << "USE(" << RValueFlattenStructs(result) << ");" << std::endl;
   }
   if (is_tailcall) {
     result = {TypeOracle::GetNeverType(), ""};
@@ -1661,7 +1870,7 @@ void ImplementationVisitor::GenerateBranch(const VisitResult& condition,
                                            Label* true_label,
                                            Label* false_label) {
   GenerateIndent();
-  source_out() << "Branch(" << condition.RValue() << ", "
+  source_out() << "Branch(" << RValueFlattenStructs(condition) << ", "
                << true_label->generated() << ", " << false_label->generated()
                << ");" << std::endl;
 }
@@ -1700,11 +1909,8 @@ VisitResult ImplementationVisitor::GenerateImplicitConvert(
         GetGeneratedCallableName(kFromConstexprMacroName, {destination_type});
     return GenerateCall(name, {{source}, {}}, false);
   } else if (IsAssignableFrom(destination_type, source.type())) {
-    if (source.declarable()) {
-      return VisitResult(destination_type, *source.declarable());
-    } else {
-      return VisitResult(destination_type, source.value());
-    }
+    source.SetType(destination_type);
+    return source;
   } else {
     std::stringstream s;
     s << "cannot use expression of type " << *source.type()
diff --git a/deps/v8/src/torque/implementation-visitor.h b/deps/v8/src/torque/implementation-visitor.h
index bc570e9afcad1a..82cbb48ce87a55 100644
--- a/deps/v8/src/torque/implementation-visitor.h
+++ b/deps/v8/src/torque/implementation-visitor.h
@@ -37,35 +37,31 @@ class ImplementationVisitor : public FileVisitor {
   const Type* Visit(Statement* stmt);
   void Visit(Declaration* decl);
 
+  VisitResult Visit(StructExpression* decl);
+
   LocationReference GetLocationReference(LocationExpression* location);
   LocationReference GetLocationReference(IdentifierExpression* expr) {
     return LocationReference(declarations()->LookupValue(expr->name), {}, {});
   }
-  LocationReference GetLocationReference(FieldAccessExpression* expr) {
-    return LocationReference({}, Visit(expr->object), {});
-  }
+  LocationReference GetLocationReference(FieldAccessExpression* expr);
   LocationReference GetLocationReference(ElementAccessExpression* expr) {
     return LocationReference({}, Visit(expr->array), Visit(expr->index));
   }
 
+  std::string RValueFlattenStructs(VisitResult result);
+
+  VisitResult GenerateFetchFromLocation(LocationReference reference) {
+    const Value* value = reference.value;
+    return VisitResult(value->type(), value);
+  }
   VisitResult GenerateFetchFromLocation(LocationExpression* location,
                                         LocationReference reference);
   VisitResult GenerateFetchFromLocation(IdentifierExpression* expr,
                                         LocationReference reference) {
-    Value* value = reference.value;
-    if (value->IsVariable() && !Variable::cast(value)->IsDefined()) {
-      std::stringstream s;
-      s << "\"" << value->name() << "\" is used before it is defined";
-      ReportError(s.str());
-    }
-    return VisitResult(value->type(), value);
+    return GenerateFetchFromLocation(reference);
   }
   VisitResult GenerateFetchFromLocation(FieldAccessExpression* expr,
-                                        LocationReference reference) {
-    Arguments arguments;
-    arguments.parameters = {reference.base};
-    return GenerateCall(std::string(".") + expr->field, arguments);
-  }
+                                        LocationReference reference);
   VisitResult GenerateFetchFromLocation(ElementAccessExpression* expr,
                                         LocationReference reference) {
     Arguments arguments;
@@ -93,6 +89,7 @@ class ImplementationVisitor : public FileVisitor {
   void Visit(TypeDeclaration* decl) {}
   void Visit(TypeAliasDeclaration* decl) {}
   void Visit(ExternConstDeclaration* decl) {}
+  void Visit(StructDeclaration* decl);
   void Visit(StandardDeclaration* decl);
   void Visit(GenericDeclaration* decl) {}
   void Visit(SpecializationDeclaration* decl);
@@ -108,6 +105,7 @@ class ImplementationVisitor : public FileVisitor {
   void Visit(ExternalRuntimeDeclaration* decl, const Signature& signature,
              Statement* body) {}
   void Visit(CallableNode* decl, const Signature& signature, Statement* body);
+  void Visit(ConstDeclaration* decl);
 
   VisitResult Visit(CallExpression* expr, bool is_tail = false);
   const Type* Visit(TailCallStatement* stmt);
@@ -175,6 +173,11 @@ class ImplementationVisitor : public FileVisitor {
 
   Callable* LookupCall(const std::string& name, const Arguments& arguments);
 
+  bool GenerateChangedVarFromControlSplit(const Variable* v, bool first = true);
+
+  void GetFlattenedStructsVars(const Variable* base,
+                               std::set<const Variable*>& vars);
+
   void GenerateChangedVarsFromControlSplit(AstNode* node);
 
   const Type* GetCommonType(const Type* left, const Type* right);
@@ -187,6 +190,8 @@ class ImplementationVisitor : public FileVisitor {
                                 const LocationReference& reference,
                                 VisitResult assignment_value);
 
+  void GenerateVariableDeclaration(const Variable* var);
+
   Variable* GenerateVariableDeclaration(
       AstNode* node, const std::string& name,
       const base::Optional<const Type*>& type,
@@ -216,6 +221,11 @@ class ImplementationVisitor : public FileVisitor {
   void GenerateMacroFunctionDeclaration(std::ostream& o,
                                         const std::string& macro_prefix,
                                         Macro* macro);
+  void GenerateFunctionDeclaration(std::ostream& o,
+                                   const std::string& macro_prefix,
+                                   const std::string& name,
+                                   const Signature& signature,
+                                   const NameVector& parameter_names);
 
   VisitResult GenerateImplicitConvert(const Type* destination_type,
                                       VisitResult source);
diff --git a/deps/v8/src/torque/type-oracle.h b/deps/v8/src/torque/type-oracle.h
index 037a5d09593cf4..1e498c19f4458a 100644
--- a/deps/v8/src/torque/type-oracle.h
+++ b/deps/v8/src/torque/type-oracle.h
@@ -29,6 +29,14 @@ class TypeOracle : public ContextualClass<TypeOracle> {
     return result;
   }
 
+  static const StructType* GetStructType(
+      Module* module, const std::string& name,
+      const std::vector<NameAndType>& fields) {
+    StructType* result = new StructType(module, name, fields);
+    Get().struct_types_.push_back(std::unique_ptr<StructType>(result));
+    return result;
+  }
+
   static const FunctionPointerType* GetFunctionPointerType(
       TypeVector argument_types, const Type* return_type) {
     const Type* code_type = Get().GetBuiltinType(CODE_TYPE_STRING);
@@ -101,6 +109,7 @@ class TypeOracle : public ContextualClass<TypeOracle> {
   Deduplicator<FunctionPointerType> function_pointer_types_;
   Deduplicator<UnionType> union_types_;
   std::vector<std::unique_ptr<Type>> nominal_types_;
+  std::vector<std::unique_ptr<Type>> struct_types_;
 };
 
 }  // namespace torque
diff --git a/deps/v8/src/torque/types.cc b/deps/v8/src/torque/types.cc
index cb24c41b1e4607..3ba78466789c99 100644
--- a/deps/v8/src/torque/types.cc
+++ b/deps/v8/src/torque/types.cc
@@ -154,6 +154,14 @@ const Type* UnionType::NonConstexprVersion() const {
   return this;
 }
 
+std::string StructType::ToExplicitString() const {
+  std::stringstream result;
+  result << "{";
+  PrintCommaSeparatedList(result, fields_);
+  result << "}";
+  return result.str();
+}
+
 void PrintSignature(std::ostream& os, const Signature& sig, bool with_names) {
   os << "(";
   for (size_t i = 0; i < sig.parameter_types.types.size(); ++i) {
@@ -181,6 +189,13 @@ void PrintSignature(std::ostream& os, const Signature& sig, bool with_names) {
   }
 }
 
+std::ostream& operator<<(std::ostream& os, const NameAndType& name_and_type) {
+  os << name_and_type.name;
+  os << ": ";
+  os << *name_and_type.type;
+  return os;
+}
+
 std::ostream& operator<<(std::ostream& os, const Signature& sig) {
   PrintSignature(os, sig, true);
   return os;
@@ -249,12 +264,24 @@ bool operator<(const Type& a, const Type& b) {
 }
 
 VisitResult::VisitResult(const Type* type, const Value* declarable)
-    : type_(type), value_(declarable->value()), declarable_(declarable) {}
+    : type_(type), value_(), declarable_(declarable) {}
 
-std::string VisitResult::LValue() const { return std::string("*") + value_; }
+std::string VisitResult::LValue() const {
+  return std::string("*") + (declarable_ ? (*declarable_)->value() : value_);
+}
 
 std::string VisitResult::RValue() const {
-  return (declarable_) ? (*declarable_)->RValue() : value_;
+  if (declarable()) {
+    auto value = *declarable();
+    if (value->IsVariable() && !Variable::cast(value)->IsDefined()) {
+      std::stringstream s;
+      s << "\"" << value->name() << "\" is used before it is defined";
+      ReportError(s.str());
+    }
+    return value->RValue();
+  } else {
+    return value_;
+  }
 }
 
 }  // namespace torque
diff --git a/deps/v8/src/torque/types.h b/deps/v8/src/torque/types.h
index b92b7ab7a75299..f1b6cd9c7ed099 100644
--- a/deps/v8/src/torque/types.h
+++ b/deps/v8/src/torque/types.h
@@ -37,13 +37,19 @@ class Value;
 
 class TypeBase {
  public:
-  enum class Kind { kAbstractType, kFunctionPointerType, kUnionType };
+  enum class Kind {
+    kAbstractType,
+    kFunctionPointerType,
+    kUnionType,
+    kStructType
+  };
   virtual ~TypeBase() {}
   bool IsAbstractType() const { return kind() == Kind::kAbstractType; }
   bool IsFunctionPointerType() const {
     return kind() == Kind::kFunctionPointerType;
   }
   bool IsUnionType() const { return kind() == Kind::kUnionType; }
+  bool IsStructType() const { return kind() == Kind::kStructType; }
 
  protected:
   explicit TypeBase(Kind kind) : kind_(kind) {}
@@ -111,6 +117,13 @@ class Type : public TypeBase {
 
 using TypeVector = std::vector<const Type*>;
 
+struct NameAndType {
+  std::string name;
+  const Type* type;
+};
+
+std::ostream& operator<<(std::ostream& os, const NameAndType& name_and_type);
+
 class AbstractType final : public Type {
  public:
   DECLARE_TYPE_BOILERPLATE(AbstractType);
@@ -285,6 +298,37 @@ class UnionType final : public Type {
   std::set<const Type*, TypeLess> types_;
 };
 
+class StructType final : public Type {
+ public:
+  DECLARE_TYPE_BOILERPLATE(StructType);
+  std::string ToExplicitString() const override;
+  std::string MangledName() const override { return name_; }
+  std::string GetGeneratedTypeName() const override { return GetStructName(); }
+  std::string GetGeneratedTNodeTypeName() const override { UNREACHABLE(); }
+  const Type* NonConstexprVersion() const override { return this; }
+
+  bool IsConstexpr() const override { return false; }
+
+  const std::vector<NameAndType>& fields() const { return fields_; }
+  const std::string& name() const { return name_; }
+  Module* module() const { return module_; }
+
+ private:
+  friend class TypeOracle;
+  StructType(Module* module, const std::string& name,
+             const std::vector<NameAndType>& fields)
+      : Type(Kind::kStructType, nullptr),
+        module_(module),
+        name_(name),
+        fields_(fields) {}
+
+  const std::string& GetStructName() const { return name_; }
+
+  Module* module_;
+  std::string name_;
+  std::vector<NameAndType> fields_;
+};
+
 inline std::ostream& operator<<(std::ostream& os, const Type& t) {
   os << t.ToString();
   return os;
@@ -299,9 +343,9 @@ class VisitResult {
   const Type* type() const { return type_; }
   // const std::string& variable() const { return variable_; }
   base::Optional<const Value*> declarable() const { return declarable_; }
-  std::string value() const { return value_; }
   std::string LValue() const;
   std::string RValue() const;
+  void SetType(const Type* new_type) { type_ = new_type; }
 
  private:
   const Type* type_;
@@ -325,11 +369,6 @@ class VisitResultVector : public std::vector<VisitResult> {
 
 std::ostream& operator<<(std::ostream& os, const TypeVector& types);
 
-struct NameAndType {
-  std::string name;
-  const Type* type;
-};
-
 typedef std::vector<NameAndType> NameAndTypeVector;
 
 struct LabelDefinition {
diff --git a/deps/v8/src/transitions.cc b/deps/v8/src/transitions.cc
index cf1ae4853b3f9a..b22e48ef344c78 100644
--- a/deps/v8/src/transitions.cc
+++ b/deps/v8/src/transitions.cc
@@ -590,17 +590,17 @@ int TransitionArray::Search(Isolate* isolate, PropertyKind kind, Name* name,
                        out_insertion_index);
 }
 
-void TransitionArray::Sort(Isolate* isolate) {
+void TransitionArray::Sort() {
   DisallowHeapAllocation no_gc;
   // In-place insertion sort.
   int length = number_of_transitions();
+  ReadOnlyRoots roots = GetReadOnlyRoots();
   for (int i = 1; i < length; i++) {
     Name* key = GetKey(i);
     MaybeObject* target = GetRawTarget(i);
     PropertyKind kind = kData;
     PropertyAttributes attributes = NONE;
-    if (!TransitionsAccessor::IsSpecialTransition(ReadOnlyRoots(isolate),
-                                                  key)) {
+    if (!TransitionsAccessor::IsSpecialTransition(roots, key)) {
       Map* target_map = TransitionsAccessor::GetTargetFromRaw(target);
       PropertyDetails details =
           TransitionsAccessor::GetTargetDetails(key, target_map);
@@ -613,8 +613,7 @@ void TransitionArray::Sort(Isolate* isolate) {
       MaybeObject* temp_target = GetRawTarget(j);
       PropertyKind temp_kind = kData;
       PropertyAttributes temp_attributes = NONE;
-      if (!TransitionsAccessor::IsSpecialTransition(ReadOnlyRoots(isolate),
-                                                    temp_key)) {
+      if (!TransitionsAccessor::IsSpecialTransition(roots, temp_key)) {
         Map* temp_target_map =
             TransitionsAccessor::GetTargetFromRaw(temp_target);
         PropertyDetails details =
diff --git a/deps/v8/src/transitions.h b/deps/v8/src/transitions.h
index 542d5ba403f15f..99fba563ea3753 100644
--- a/deps/v8/src/transitions.h
+++ b/deps/v8/src/transitions.h
@@ -233,7 +233,7 @@ class TransitionArray : public WeakFixedArray {
   bool IsSortedNoDuplicates(int valid_entries = -1);
 #endif
 
-  void Sort(Isolate* isolate);
+  void Sort();
 
   void PrintInternal(std::ostream& os);
 
diff --git a/deps/v8/src/trap-handler/OWNERS b/deps/v8/src/trap-handler/OWNERS
index 9aee9d9a28d32f..ac0d46af0e1301 100644
--- a/deps/v8/src/trap-handler/OWNERS
+++ b/deps/v8/src/trap-handler/OWNERS
@@ -1,11 +1,11 @@
 set noparent
 
-bradnelson@chromium.org
-eholk@chromium.org
+titzer@chromium.org
+ahaas@chromium.org
 
 # Changes to this directory should also be reviewed by:
 #
-#   eholk@chromium.org
+#   ahaas@chromium.org
 #   mseaborn@chromium.org
 #   mark@chromium.org
 
diff --git a/deps/v8/src/utils.h b/deps/v8/src/utils.h
index a19d79654ad7d2..b922332172d0b5 100644
--- a/deps/v8/src/utils.h
+++ b/deps/v8/src/utils.h
@@ -472,13 +472,13 @@ class BitSetComputer {
 // ----------------------------------------------------------------------------
 // Hash function.
 
-static const uint32_t kZeroHashSeed = 0;
+static const uint64_t kZeroHashSeed = 0;
 
 // Thomas Wang, Integer Hash Functions.
 // http://www.concentric.net/~Ttwang/tech/inthash.htm
-inline uint32_t ComputeIntegerHash(uint32_t key, uint32_t seed) {
+inline uint32_t ComputeIntegerHash(uint32_t key, uint64_t seed) {
   uint32_t hash = key;
-  hash = hash ^ seed;
+  hash = hash ^ static_cast<uint32_t>(seed);
   hash = ~hash + (hash << 15);  // hash = (hash << 15) - hash - 1;
   hash = hash ^ (hash >> 12);
   hash = hash + (hash << 2);
diff --git a/deps/v8/src/value-serializer.cc b/deps/v8/src/value-serializer.cc
index 5d894a41304f92..4c9c9a9aa2d9ce 100644
--- a/deps/v8/src/value-serializer.cc
+++ b/deps/v8/src/value-serializer.cc
@@ -1134,8 +1134,8 @@ void ValueDeserializer::TransferArrayBuffer(
   }
   Handle<SimpleNumberDictionary> dictionary =
       array_buffer_transfer_map_.ToHandleChecked();
-  Handle<SimpleNumberDictionary> new_dictionary =
-      SimpleNumberDictionary::Set(dictionary, transfer_id, array_buffer);
+  Handle<SimpleNumberDictionary> new_dictionary = SimpleNumberDictionary::Set(
+      isolate_, dictionary, transfer_id, array_buffer);
   if (!new_dictionary.is_identical_to(dictionary)) {
     GlobalHandles::Destroy(Handle<Object>::cast(dictionary).location());
     array_buffer_transfer_map_ =
@@ -1560,7 +1560,7 @@ MaybeHandle<JSRegExp> ValueDeserializer::ReadJSRegExp() {
   // TODO(adamk): Can we remove this check now that dotAll is always-on?
   uint32_t flags_mask = static_cast<uint32_t>(-1) << JSRegExp::FlagCount();
   if ((raw_flags & flags_mask) ||
-      !JSRegExp::New(pattern, static_cast<JSRegExp::Flags>(raw_flags))
+      !JSRegExp::New(isolate_, pattern, static_cast<JSRegExp::Flags>(raw_flags))
            .ToHandle(&regexp)) {
     return MaybeHandle<JSRegExp>();
   }
diff --git a/deps/v8/src/wasm/baseline/liftoff-compiler.cc b/deps/v8/src/wasm/baseline/liftoff-compiler.cc
index 88a9bf299b43bf..1130cf0cdd5f1e 100644
--- a/deps/v8/src/wasm/baseline/liftoff-compiler.cc
+++ b/deps/v8/src/wasm/baseline/liftoff-compiler.cc
@@ -11,6 +11,7 @@
 #include "src/compiler/wasm-compiler.h"
 #include "src/counters.h"
 #include "src/macro-assembler-inl.h"
+#include "src/tracing/trace-event.h"
 #include "src/wasm/baseline/liftoff-assembler.h"
 #include "src/wasm/function-body-decoder-impl.h"
 #include "src/wasm/function-compiler.h"
@@ -629,9 +630,11 @@ class LiftoffCompiler {
           __ emit_##fn(dst.fp(), src.fp());             \
         });                                             \
     break;
-#define CASE_FLOAT_UNOP_WITH_CFALLBACK(type, fn)                        \
-  EmitFloatUnOpWithCFallback<kWasm##type>(&LiftoffAssembler::emit_##fn, \
-                                          &ExternalReference::wasm_##fn);
+#define CASE_FLOAT_UNOP_WITH_CFALLBACK(opcode, type, fn)                    \
+  case WasmOpcode::kExpr##opcode:                                           \
+    EmitFloatUnOpWithCFallback<kWasm##type>(&LiftoffAssembler::emit_##fn,   \
+                                            &ExternalReference::wasm_##fn); \
+    break;
 #define CASE_TYPE_CONVERSION(opcode, dst_type, src_type, ext_ref, can_trap) \
   case WasmOpcode::kExpr##opcode:                                           \
     EmitTypeConversion<kWasm##dst_type, kWasm##src_type, can_trap>(         \
@@ -650,10 +653,10 @@ class LiftoffCompiler {
       CASE_FLOAT_UNOP(F32Sqrt, F32, f32_sqrt)
       CASE_FLOAT_UNOP(F64Abs, F64, f64_abs)
       CASE_FLOAT_UNOP(F64Neg, F64, f64_neg)
-      CASE_FLOAT_UNOP_WITH_CFALLBACK(F64, f64_ceil)
-      CASE_FLOAT_UNOP_WITH_CFALLBACK(F64, f64_floor)
-      CASE_FLOAT_UNOP_WITH_CFALLBACK(F64, f64_trunc)
-      CASE_FLOAT_UNOP_WITH_CFALLBACK(F64, f64_nearest_int)
+      CASE_FLOAT_UNOP_WITH_CFALLBACK(F64Ceil, F64, f64_ceil)
+      CASE_FLOAT_UNOP_WITH_CFALLBACK(F64Floor, F64, f64_floor)
+      CASE_FLOAT_UNOP_WITH_CFALLBACK(F64Trunc, F64, f64_trunc)
+      CASE_FLOAT_UNOP_WITH_CFALLBACK(F64NearestInt, F64, f64_nearest_int)
       CASE_FLOAT_UNOP(F64Sqrt, F64, f64_sqrt)
       CASE_TYPE_CONVERSION(I32ConvertI64, I32, I64, nullptr, kNoTrap)
       CASE_TYPE_CONVERSION(I32SConvertF32, I32, F32, nullptr, kCanTrap)
@@ -1830,12 +1833,14 @@ class LiftoffCompiler {
 }  // namespace
 
 bool LiftoffCompilationUnit::ExecuteCompilation() {
+  TRACE_EVENT0(TRACE_DISABLED_BY_DEFAULT("v8.wasm"),
+               "ExecuteLiftoffCompilation");
   base::ElapsedTimer compile_timer;
   if (FLAG_trace_wasm_decode_time) {
     compile_timer.Start();
   }
 
-  Zone zone(wasm_unit_->isolate_->allocator(), "LiftoffCompilationZone");
+  Zone zone(wasm_unit_->wasm_engine_->allocator(), "LiftoffCompilationZone");
   const wasm::WasmModule* module =
       wasm_unit_->env_ ? wasm_unit_->env_->module : nullptr;
   auto call_descriptor =
@@ -1879,10 +1884,7 @@ bool LiftoffCompilationUnit::ExecuteCompilation() {
       wasm_unit_->func_index_, desc, frame_slot_count, safepoint_table_offset,
       0, std::move(protected_instructions), std::move(source_positions),
       wasm::WasmCode::kLiftoff);
-
-  // Record the memory cost this unit places on the system until
-  // it is finalized.
-  wasm_unit_->memory_cost_ = sizeof(*this);
+  wasm_unit_->native_module_->PublishCode(code_);
 
   return true;
 }
diff --git a/deps/v8/src/wasm/baseline/x64/liftoff-assembler-x64.h b/deps/v8/src/wasm/baseline/x64/liftoff-assembler-x64.h
index 9bf94de8ba62b2..b8d08c56aa53ec 100644
--- a/deps/v8/src/wasm/baseline/x64/liftoff-assembler-x64.h
+++ b/deps/v8/src/wasm/baseline/x64/liftoff-assembler-x64.h
@@ -1452,7 +1452,18 @@ void LiftoffStackSlots::Construct() {
     const LiftoffAssembler::VarState& src = slot.src_;
     switch (src.loc()) {
       case LiftoffAssembler::VarState::kStack:
-        asm_->pushq(liftoff::GetStackSlot(slot.src_index_));
+        if (src.type() == kWasmI32) {
+          // Load i32 values to a register first to ensure they are zero
+          // extended.
+          asm_->movl(kScratchRegister, liftoff::GetStackSlot(slot.src_index_));
+          asm_->pushq(kScratchRegister);
+        } else {
+          // For all other types, just push the whole (8-byte) stack slot.
+          // This is also ok for f32 values (even though we copy 4 uninitialized
+          // bytes), because f32 and f64 values are clearly distinguished in
+          // Turbofan, so the uninitialized bytes are never accessed.
+          asm_->pushq(liftoff::GetStackSlot(slot.src_index_));
+        }
         break;
       case LiftoffAssembler::VarState::kRegister:
         liftoff::push(asm_, src.reg(), src.type());
diff --git a/deps/v8/src/wasm/function-compiler.cc b/deps/v8/src/wasm/function-compiler.cc
index 0cec3991b7532e..2e47f82ca3d14c 100644
--- a/deps/v8/src/wasm/function-compiler.cc
+++ b/deps/v8/src/wasm/function-compiler.cc
@@ -39,8 +39,8 @@ WasmCompilationUnit::WasmCompilationUnit(Isolate* isolate, ModuleEnv* env,
                                          wasm::WasmName name, int index,
                                          CompilationMode mode,
                                          Counters* counters, bool lower_simd)
-    : isolate_(isolate),
-      env_(env),
+    : env_(env),
+      wasm_engine_(isolate->wasm_engine()),
       func_body_(body),
       func_name_(name),
       counters_(counters ? counters : isolate->counters()),
diff --git a/deps/v8/src/wasm/function-compiler.h b/deps/v8/src/wasm/function-compiler.h
index 65fc35709fd3e1..a270d36f78823c 100644
--- a/deps/v8/src/wasm/function-compiler.h
+++ b/deps/v8/src/wasm/function-compiler.h
@@ -20,6 +20,7 @@ class LiftoffCompilationUnit;
 struct ModuleWireBytes;
 class NativeModule;
 class WasmCode;
+class WasmEngine;
 struct WasmFunction;
 
 enum RuntimeExceptionSupport : bool {
@@ -76,7 +77,6 @@ class WasmCompilationUnit final {
       Isolate* isolate, ModuleEnv* env, const wasm::WasmFunction* function,
       CompilationMode = GetDefaultCompilationMode());
 
-  size_t memory_cost() const { return memory_cost_; }
   wasm::NativeModule* native_module() const { return native_module_; }
   CompilationMode mode() const { return mode_; }
 
@@ -84,13 +84,12 @@ class WasmCompilationUnit final {
   friend class LiftoffCompilationUnit;
   friend class compiler::TurbofanWasmCompilationUnit;
 
-  Isolate* isolate_;
   ModuleEnv* env_;
+  WasmEngine* wasm_engine_;
   wasm::FunctionBody func_body_;
   wasm::WasmName func_name_;
   Counters* counters_;
   int func_index_;
-  size_t memory_cost_ = 0;
   wasm::NativeModule* native_module_;
   // TODO(wasm): Put {lower_simd_} inside the {ModuleEnv}.
   bool lower_simd_;
diff --git a/deps/v8/src/wasm/module-compiler.cc b/deps/v8/src/wasm/module-compiler.cc
index 632d9e101fdda3..bce51dd34fe7c2 100644
--- a/deps/v8/src/wasm/module-compiler.cc
+++ b/deps/v8/src/wasm/module-compiler.cc
@@ -13,6 +13,7 @@
 #include "src/counters.h"
 #include "src/identity-map.h"
 #include "src/property-descriptor.h"
+#include "src/tracing/trace-event.h"
 #include "src/trap-handler/trap-handler.h"
 #include "src/wasm/module-decoder.h"
 #include "src/wasm/streaming-decoder.h"
@@ -94,8 +95,6 @@ class CompilationState {
   bool SetFinisherIsRunning(bool value);
   void ScheduleFinisherTask();
 
-  bool StopBackgroundCompilationTaskForThrottling();
-
   void Abort();
 
   Isolate* isolate() const { return isolate_; }
@@ -126,7 +125,6 @@ class CompilationState {
   WasmEngine* const wasm_engine_;
   // TODO(clemensh): Remove ModuleEnv, generate it when needed.
   ModuleEnv module_env_;
-  const size_t max_memory_;
   const CompileMode compile_mode_;
   bool baseline_compilation_finished_ = false;
 
@@ -147,8 +145,6 @@ class CompilationState {
   std::vector<std::unique_ptr<WasmCompilationUnit>> baseline_finish_units_;
   std::vector<std::unique_ptr<WasmCompilationUnit>> tiering_finish_units_;
 
-  size_t allocated_memory_ = 0;
-
   // End of fields protected by {mutex_}.
   //////////////////////////////////////////////////////////////////////////////
 
@@ -463,12 +459,6 @@ ModuleEnv CreateDefaultModuleEnv(const WasmModule* module,
   return ModuleEnv(module, use_trap_handler, kRuntimeExceptionSupport);
 }
 
-size_t GetMaxUsableMemorySize(Isolate* isolate) {
-  return isolate->heap()->memory_allocator()->code_range()->valid()
-             ? isolate->heap()->memory_allocator()->code_range()->size()
-             : isolate->heap()->code_space()->Capacity();
-}
-
 // The CompilationUnitBuilder builds compilation units and stores them in an
 // internal buffer. The buffer is moved into the working queue of the
 // CompilationState when {Commit} is called.
@@ -577,6 +567,7 @@ void InitializeCompilationUnits(NativeModule* native_module) {
 
 void FinishCompilationUnits(CompilationState* compilation_state,
                             ErrorThrower* thrower) {
+  TRACE_EVENT0(TRACE_DISABLED_BY_DEFAULT("v8.wasm"), "FinishCompilationUnits");
   while (true) {
     if (compilation_state->failed()) break;
     std::unique_ptr<WasmCompilationUnit> unit =
@@ -861,16 +852,14 @@ class BackgroundCompileTask : public CancelableTask {
 
   void RunInternal() override {
     TRACE_COMPILE("(3b) Compiling...\n");
-    // The number of currently running background tasks is reduced either in
-    // {StopBackgroundCompilationTaskForThrottling} or in
+    // The number of currently running background tasks is reduced in
     // {OnBackgroundTaskStopped}.
-    while (!compilation_state_->StopBackgroundCompilationTaskForThrottling()) {
-      if (compilation_state_->failed() ||
-          !FetchAndExecuteCompilationUnit(compilation_state_)) {
-        compilation_state_->OnBackgroundTaskStopped();
+    while (!compilation_state_->failed()) {
+      if (!FetchAndExecuteCompilationUnit(compilation_state_)) {
         break;
       }
     }
+    compilation_state_->OnBackgroundTaskStopped();
   }
 
  private:
@@ -959,6 +948,7 @@ InstanceBuilder::InstanceBuilder(Isolate* isolate, ErrorThrower* thrower,
 
 // Build an instance, in all of its glory.
 MaybeHandle<WasmInstanceObject> InstanceBuilder::Build() {
+  TRACE_EVENT0(TRACE_DISABLED_BY_DEFAULT("v8.wasm"), "InstanceBuilder::Build");
   // Check that an imports argument was provided, if the module requires it.
   // No point in continuing otherwise.
   if (!module_->import_table.empty() && ffi_.is_null()) {
@@ -1235,6 +1225,8 @@ MaybeHandle<WasmInstanceObject> InstanceBuilder::Build() {
 }
 
 bool InstanceBuilder::ExecuteStartFunction() {
+  TRACE_EVENT0(TRACE_DISABLED_BY_DEFAULT("v8.wasm"),
+               "InstanceBuilder::ExecuteStartFunction");
   if (start_function_.is_null()) return true;  // No start function.
 
   HandleScope scope(isolate_);
@@ -1260,8 +1252,8 @@ MaybeHandle<Object> InstanceBuilder::LookupImport(uint32_t index,
   DCHECK(!ffi_.is_null());
 
   // Look up the module first.
-  MaybeHandle<Object> result =
-      Object::GetPropertyOrElement(ffi_.ToHandleChecked(), module_name);
+  MaybeHandle<Object> result = Object::GetPropertyOrElement(
+      isolate_, ffi_.ToHandleChecked(), module_name);
   if (result.is_null()) {
     return ReportTypeError("module not found", index, module_name);
   }
@@ -1274,7 +1266,7 @@ MaybeHandle<Object> InstanceBuilder::LookupImport(uint32_t index,
                            module_name);
   }
 
-  result = Object::GetPropertyOrElement(module, import_name);
+  result = Object::GetPropertyOrElement(isolate_, module, import_name);
   if (result.is_null()) {
     ReportLinkError("import not found", index, module_name, import_name);
     return MaybeHandle<JSFunction>();
@@ -1688,7 +1680,7 @@ int InstanceBuilder::ProcessImports(Handle<WasmInstanceObject> instance) {
             if (global.type == kWasmI32) {
               value = Object::ToInt32(isolate_, value).ToHandleChecked();
             } else {
-              value = Object::ToNumber(value).ToHandleChecked();
+              value = Object::ToNumber(isolate_, value).ToHandleChecked();
             }
           }
         }
@@ -2764,14 +2756,12 @@ CompilationState::CompilationState(internal::Isolate* isolate,
     : isolate_(isolate),
       wasm_engine_(isolate->wasm_engine()),
       module_env_(env),
-      max_memory_(GetMaxUsableMemorySize(isolate) / 2),
       compile_mode_(FLAG_wasm_tier_up && env.module->origin == kWasmOrigin
                         ? CompileMode::kTiering
                         : CompileMode::kRegular),
       max_background_tasks_(std::max(
           1, std::min(FLAG_wasm_num_compilation_tasks,
                       V8::GetCurrentPlatform()->NumberOfWorkerThreads()))) {
-  DCHECK_LT(0, max_memory_);
   v8::Isolate* v8_isolate = reinterpret_cast<v8::Isolate*>(isolate_);
   v8::Platform* platform = V8::GetCurrentPlatform();
   foreground_task_runner_ = platform->GetForegroundTaskRunner(v8_isolate);
@@ -2853,7 +2843,6 @@ std::unique_ptr<WasmCompilationUnit> CompilationState::GetNextExecutedUnit() {
   if (units.empty()) return {};
   std::unique_ptr<WasmCompilationUnit> ret = std::move(units.back());
   units.pop_back();
-  allocated_memory_ -= ret->memory_cost();
   return ret;
 }
 
@@ -2902,7 +2891,6 @@ void CompilationState::OnFinishedUnit() {
 void CompilationState::ScheduleUnitForFinishing(
     std::unique_ptr<WasmCompilationUnit> unit,
     WasmCompilationUnit::CompilationMode mode) {
-  size_t cost = unit->memory_cost();
   base::LockGuard<base::Mutex> guard(&mutex_);
   if (compile_mode_ == CompileMode::kTiering &&
       mode == WasmCompilationUnit::CompilationMode::kTurbofan) {
@@ -2910,7 +2898,6 @@ void CompilationState::ScheduleUnitForFinishing(
   } else {
     baseline_finish_units_.push_back(std::move(unit));
   }
-  allocated_memory_ += cost;
 
   if (!finisher_is_running_ && !failed_) {
     ScheduleFinisherTask();
@@ -2937,8 +2924,6 @@ void CompilationState::RestartBackgroundTasks(size_t max) {
     // No need to restart tasks if compilation already failed.
     if (failed_) return;
 
-    bool should_increase_workload = allocated_memory_ <= max_memory_ / 2;
-    if (!should_increase_workload) return;
     DCHECK_LE(num_background_tasks_, max_background_tasks_);
     if (num_background_tasks_ == max_background_tasks_) return;
     size_t num_compilation_units =
@@ -2974,15 +2959,6 @@ void CompilationState::ScheduleFinisherTask() {
       base::make_unique<FinishCompileTask>(this, &foreground_task_manager_));
 }
 
-bool CompilationState::StopBackgroundCompilationTaskForThrottling() {
-  base::LockGuard<base::Mutex> guard(&mutex_);
-  DCHECK_LE(1, num_background_tasks_);
-  bool can_accept_work = allocated_memory_ < max_memory_;
-  if (can_accept_work) return false;
-  --num_background_tasks_;
-  return true;
-}
-
 void CompilationState::Abort() {
   {
     base::LockGuard<base::Mutex> guard(&mutex_);
diff --git a/deps/v8/src/wasm/wasm-code-manager.cc b/deps/v8/src/wasm/wasm-code-manager.cc
index 0c05e94cf8465c..a7591917031d87 100644
--- a/deps/v8/src/wasm/wasm-code-manager.cc
+++ b/deps/v8/src/wasm/wasm-code-manager.cc
@@ -168,9 +168,6 @@ void WasmCode::LogCode(Isolate* isolate) const {
 
 void WasmCode::Validate() const {
 #ifdef DEBUG
-  // We run NativeModule::Lookup, which accesses owned_code_, thuse we need to
-  // hold the mutex to avoid race conditions.
-  base::LockGuard<base::Mutex> lock(&native_module_->allocation_mutex_);
   // We expect certain relocation info modes to never appear in {WasmCode}
   // objects or to be restricted to a small set of valid values. Hence the
   // iteration below does not use a mask, but visits all relocation data.
@@ -246,6 +243,15 @@ void WasmCode::Disassemble(const char* name, std::ostream& os,
                        CodeReference(this), current_pc);
   os << "\n";
 
+  if (!protected_instructions_.is_empty()) {
+    os << "Protected instructions:\n pc offset  land pad\n";
+    for (auto& data : protected_instructions()) {
+      os << std::setw(10) << std::hex << data.instr_offset << std::setw(10)
+         << std::hex << data.landing_offset << "\n";
+    }
+    os << "\n";
+  }
+
   if (!source_positions().is_empty()) {
     os << "Source positions:\n pc offset  position\n";
     for (SourcePositionTableIterator it(source_positions()); !it.done();
@@ -537,17 +543,6 @@ WasmCode* NativeModule::AddCode(
     }
   }
 
-  {
-    // TODO(clemensh): Remove the need for locking here. Probably requires
-    // word-aligning the jump table slots.
-    base::LockGuard<base::Mutex> lock(&allocation_mutex_);
-    if (!ret->protected_instructions_.is_empty()) {
-      ret->RegisterTrapHandlerData();
-    }
-    set_code(index, ret);
-    PatchJumpTable(index, ret->instruction_start(), WasmCode::kFlushICache);
-  }
-
   // Flush the i-cache here instead of in AddOwnedCode, to include the changes
   // made while iterating over the RelocInfo above.
   Assembler::FlushICache(ret->instructions().start(),
@@ -580,6 +575,19 @@ WasmCode* NativeModule::AddDeserializedCode(
   return code;
 }
 
+void NativeModule::PublishCode(WasmCode* code) {
+  // TODO(clemensh): Remove the need for locking here. Probably requires
+  // word-aligning the jump table slots.
+  base::LockGuard<base::Mutex> lock(&allocation_mutex_);
+  if (!code->protected_instructions_.is_empty()) {
+    code->RegisterTrapHandlerData();
+  }
+  DCHECK(!code->IsAnonymous());
+  set_code(code->index(), code);
+  PatchJumpTable(code->index(), code->instruction_start(),
+                 WasmCode::kFlushICache);
+}
+
 WasmCode* NativeModule::CreateEmptyJumpTable(uint32_t num_wasm_functions) {
   // Only call this if we really need a jump table.
   DCHECK_LT(0, num_wasm_functions);
@@ -675,6 +683,7 @@ Address NativeModule::AllocateForCode(size_t size) {
 }
 
 WasmCode* NativeModule::Lookup(Address pc) const {
+  base::LockGuard<base::Mutex> lock(&allocation_mutex_);
   if (owned_code_.empty()) return nullptr;
   auto iter = std::upper_bound(owned_code_.begin(), owned_code_.end(), pc,
                                WasmCodeUniquePtrComparator());
diff --git a/deps/v8/src/wasm/wasm-code-manager.h b/deps/v8/src/wasm/wasm-code-manager.h
index dd898dcd4d41b2..7d01aa513d4299 100644
--- a/deps/v8/src/wasm/wasm-code-manager.h
+++ b/deps/v8/src/wasm/wasm-code-manager.h
@@ -264,6 +264,11 @@ class V8_EXPORT_PRIVATE NativeModule final {
   // resolved during relocation.
   void SetRuntimeStubs(Isolate* isolate);
 
+  // Makes the code available to the system (by entering it into the code table
+  // and patching the jump table). Callers have to take care not to race with
+  // threads executing the old code.
+  void PublishCode(WasmCode* code);
+
   WasmCode* code(uint32_t index) const {
     DCHECK_LT(index, num_functions());
     DCHECK_LE(module_->num_imported_functions, index);
diff --git a/deps/v8/src/wasm/wasm-engine.cc b/deps/v8/src/wasm/wasm-engine.cc
index c9aff8cd1b0238..8367c07cd7e9f4 100644
--- a/deps/v8/src/wasm/wasm-engine.cc
+++ b/deps/v8/src/wasm/wasm-engine.cc
@@ -4,6 +4,7 @@
 
 #include "src/wasm/wasm-engine.h"
 
+#include "src/code-tracer.h"
 #include "src/compilation-statistics.h"
 #include "src/objects-inl.h"
 #include "src/objects/js-promise.h"
@@ -158,6 +159,7 @@ std::shared_ptr<StreamingDecoder> WasmEngine::StartStreamingCompilation(
 }
 
 CompilationStatistics* WasmEngine::GetOrCreateTurboStatistics() {
+  base::LockGuard<base::Mutex> guard(&mutex_);
   if (compilation_stats_ == nullptr) {
     compilation_stats_.reset(new CompilationStatistics());
   }
@@ -165,6 +167,7 @@ CompilationStatistics* WasmEngine::GetOrCreateTurboStatistics() {
 }
 
 void WasmEngine::DumpAndResetTurboStatistics() {
+  base::LockGuard<base::Mutex> guard(&mutex_);
   if (compilation_stats_ != nullptr) {
     StdoutStream os;
     os << AsPrintableStatistics{*compilation_stats_.get(), false} << std::endl;
@@ -172,6 +175,12 @@ void WasmEngine::DumpAndResetTurboStatistics() {
   compilation_stats_.reset();
 }
 
+CodeTracer* WasmEngine::GetCodeTracer() {
+  base::LockGuard<base::Mutex> guard(&mutex_);
+  if (code_tracer_ == nullptr) code_tracer_.reset(new CodeTracer(-1));
+  return code_tracer_.get();
+}
+
 void WasmEngine::Register(CancelableTaskManager* task_manager) {
   task_managers_.emplace_back(task_manager);
 }
diff --git a/deps/v8/src/wasm/wasm-engine.h b/deps/v8/src/wasm/wasm-engine.h
index 41243bdef43689..4d34b4d3de1ff1 100644
--- a/deps/v8/src/wasm/wasm-engine.h
+++ b/deps/v8/src/wasm/wasm-engine.h
@@ -14,6 +14,7 @@
 namespace v8 {
 namespace internal {
 
+class CodeTracer;
 class CompilationStatistics;
 class WasmModuleObject;
 class WasmInstanceObject;
@@ -99,6 +100,9 @@ class V8_EXPORT_PRIVATE WasmEngine {
   // Prints the gathered compilation statistics, then resets them.
   void DumpAndResetTurboStatistics();
 
+  // Used to redirect tracing output from {stdout} to a file.
+  CodeTracer* GetCodeTracer();
+
   // We register and unregister CancelableTaskManagers that run engine-dependent
   // tasks. These tasks need to be shutdown if the engine is shut down.
   void Register(CancelableTaskManager* task_manager);
@@ -127,7 +131,6 @@ class V8_EXPORT_PRIVATE WasmEngine {
   // job from the map when it is finished.
   std::unordered_map<AsyncCompileJob*, std::unique_ptr<AsyncCompileJob>> jobs_;
   std::unique_ptr<WasmCodeManager> code_manager_;
-  std::unique_ptr<CompilationStatistics> compilation_stats_;
   WasmMemoryTracker memory_tracker_;
   AccountingAllocator allocator_;
 
@@ -135,6 +138,19 @@ class V8_EXPORT_PRIVATE WasmEngine {
   // on the isolate.
   std::list<CancelableTaskManager*> task_managers_;
 
+  // This mutex protects all information which is mutated concurrently or
+  // fields that are initialized lazily on the first access.
+  base::Mutex mutex_;
+
+  //////////////////////////////////////////////////////////////////////////////
+  // Protected by {mutex_}:
+
+  std::unique_ptr<CompilationStatistics> compilation_stats_;
+  std::unique_ptr<CodeTracer> code_tracer_;
+
+  // End of fields protected by {mutex_}.
+  //////////////////////////////////////////////////////////////////////////////
+
   DISALLOW_COPY_AND_ASSIGN(WasmEngine);
 };
 
diff --git a/deps/v8/src/wasm/wasm-interpreter.cc b/deps/v8/src/wasm/wasm-interpreter.cc
index 581277cbab7873..6b7d5d2bc32c8c 100644
--- a/deps/v8/src/wasm/wasm-interpreter.cc
+++ b/deps/v8/src/wasm/wasm-interpreter.cc
@@ -1256,6 +1256,7 @@ class ThreadImpl {
   const WasmModule* module() const { return codemap_->module(); }
 
   void DoTrap(TrapReason trap, pc_t pc) {
+    TRACE("TRAP: %s\n", WasmOpcodes::TrapReasonMessage(trap));
     state_ = WasmInterpreter::TRAPPED;
     trap_reason_ = trap;
     CommitPc(pc);
diff --git a/deps/v8/src/wasm/wasm-js.cc b/deps/v8/src/wasm/wasm-js.cc
index c7c6216446e3d4..ef316c64d06d16 100644
--- a/deps/v8/src/wasm/wasm-js.cc
+++ b/deps/v8/src/wasm/wasm-js.cc
@@ -1324,7 +1324,7 @@ Handle<JSFunction> InstallFunc(Isolate* isolate, Handle<JSObject> object,
 }
 
 Handle<String> GetterName(Isolate* isolate, Handle<String> name) {
-  return Name::ToFunctionName(name, isolate->factory()->get_string())
+  return Name::ToFunctionName(isolate, name, isolate->factory()->get_string())
       .ToHandleChecked();
 }
 
@@ -1342,7 +1342,7 @@ void InstallGetter(Isolate* isolate, Handle<JSObject> object,
 }
 
 Handle<String> SetterName(Isolate* isolate, Handle<String> name) {
-  return Name::ToFunctionName(name, isolate->factory()->set_string())
+  return Name::ToFunctionName(isolate, name, isolate->factory()->set_string())
       .ToHandleChecked();
 }
 
diff --git a/deps/v8/src/wasm/wasm-memory.cc b/deps/v8/src/wasm/wasm-memory.cc
index bda06e42cdffc5..8cdd758fac6e45 100644
--- a/deps/v8/src/wasm/wasm-memory.cc
+++ b/deps/v8/src/wasm/wasm-memory.cc
@@ -18,6 +18,12 @@ namespace {
 
 constexpr size_t kNegativeGuardSize = 1u << 31;  // 2GiB
 
+void AddAllocationStatusSample(Isolate* isolate,
+                               WasmMemoryTracker::AllocationStatus status) {
+  isolate->counters()->wasm_memory_allocation_result()->AddSample(
+      static_cast<int>(status));
+}
+
 void* TryAllocateBackingStore(WasmMemoryTracker* memory_tracker, Heap* heap,
                               size_t size, bool require_full_guard_regions,
                               void** allocation_base,
@@ -62,8 +68,8 @@ void* TryAllocateBackingStore(WasmMemoryTracker* memory_tracker, Heap* heap,
     if (FLAG_abort_on_stack_or_string_length_overflow) {
       FATAL("could not allocate wasm memory");
     }
-    memory_tracker->AddAllocationStatusSample(
-        AllocationStatus::kAddressSpaceLimitReachedFailure);
+    AddAllocationStatusSample(
+        heap->isolate(), AllocationStatus::kAddressSpaceLimitReachedFailure);
     return nullptr;
   }
 
@@ -72,7 +78,7 @@ void* TryAllocateBackingStore(WasmMemoryTracker* memory_tracker, Heap* heap,
                                    PageAllocator::kNoAccess);
   if (*allocation_base == nullptr) {
     memory_tracker->ReleaseReservation(*allocation_length);
-    memory_tracker->AddAllocationStatusSample(AllocationStatus::kOtherFailure);
+    AddAllocationStatusSample(heap->isolate(), AllocationStatus::kOtherFailure);
     return nullptr;
   }
   byte* memory = reinterpret_cast<byte*>(*allocation_base);
@@ -91,11 +97,11 @@ void* TryAllocateBackingStore(WasmMemoryTracker* memory_tracker, Heap* heap,
     }
   }
 
-  memory_tracker->RegisterAllocation(*allocation_base, *allocation_length,
-                                     memory, size);
-  memory_tracker->AddAllocationStatusSample(
-      did_retry ? AllocationStatus::kSuccessAfterRetry
-                : AllocationStatus::kSuccess);
+  memory_tracker->RegisterAllocation(heap->isolate(), *allocation_base,
+                                     *allocation_length, memory, size);
+  AddAllocationStatusSample(heap->isolate(),
+                            did_retry ? AllocationStatus::kSuccessAfterRetry
+                                      : AllocationStatus::kSuccess);
   return memory;
 }
 }  // namespace
@@ -138,14 +144,15 @@ void WasmMemoryTracker::ReleaseReservation(size_t num_bytes) {
   DCHECK_LE(num_bytes, old_reserved);
 }
 
-void WasmMemoryTracker::RegisterAllocation(void* allocation_base,
+void WasmMemoryTracker::RegisterAllocation(Isolate* isolate,
+                                           void* allocation_base,
                                            size_t allocation_length,
                                            void* buffer_start,
                                            size_t buffer_length) {
   base::LockGuard<base::Mutex> scope_lock(&mutex_);
 
   allocated_address_space_ += allocation_length;
-  AddAddressSpaceSample();
+  AddAddressSpaceSample(isolate);
 
   allocations_.emplace(buffer_start,
                        AllocationData{allocation_base, allocation_length,
@@ -153,12 +160,7 @@ void WasmMemoryTracker::RegisterAllocation(void* allocation_base,
 }
 
 WasmMemoryTracker::AllocationData WasmMemoryTracker::ReleaseAllocation(
-    const void* buffer_start) {
-  return InternalReleaseAllocation(buffer_start);
-}
-
-WasmMemoryTracker::AllocationData WasmMemoryTracker::InternalReleaseAllocation(
-    const void* buffer_start) {
+    Isolate* isolate, const void* buffer_start) {
   base::LockGuard<base::Mutex> scope_lock(&mutex_);
 
   auto find_result = allocations_.find(buffer_start);
@@ -170,7 +172,7 @@ WasmMemoryTracker::AllocationData WasmMemoryTracker::InternalReleaseAllocation(
     DCHECK_LE(num_bytes, allocated_address_space_);
     reserved_address_space_ -= num_bytes;
     allocated_address_space_ -= num_bytes;
-    AddAddressSpaceSample();
+    AddAddressSpaceSample(isolate);
 
     AllocationData allocation_data = find_result->second;
     allocations_.erase(find_result);
@@ -209,28 +211,21 @@ bool WasmMemoryTracker::HasFullGuardRegions(const void* buffer_start) {
   return start + kWasmMaxHeapOffset < limit;
 }
 
-bool WasmMemoryTracker::FreeMemoryIfIsWasmMemory(const void* buffer_start) {
+bool WasmMemoryTracker::FreeMemoryIfIsWasmMemory(Isolate* isolate,
+                                                 const void* buffer_start) {
   if (IsWasmMemory(buffer_start)) {
-    const AllocationData allocation = ReleaseAllocation(buffer_start);
+    const AllocationData allocation = ReleaseAllocation(isolate, buffer_start);
     CHECK(FreePages(allocation.allocation_base, allocation.allocation_length));
     return true;
   }
   return false;
 }
 
-void WasmMemoryTracker::AddAllocationStatusSample(AllocationStatus status) {
-  if (allocation_result_) {
-    allocation_result_->AddSample(static_cast<int>(status));
-  }
-}
-
-void WasmMemoryTracker::AddAddressSpaceSample() {
-  if (address_space_usage_mb_) {
-    // Report address space usage in MiB so the full range fits in an int on all
-    // platforms.
-    address_space_usage_mb_->AddSample(
-        static_cast<int>(allocated_address_space_ >> 20));
-  }
+void WasmMemoryTracker::AddAddressSpaceSample(Isolate* isolate) {
+  // Report address space usage in MiB so the full range fits in an int on all
+  // platforms.
+  isolate->counters()->wasm_address_space_usage_mb()->AddSample(
+      static_cast<int>(allocated_address_space_ >> 20));
 }
 
 Handle<JSArrayBuffer> SetupArrayBuffer(Isolate* isolate, void* backing_store,
diff --git a/deps/v8/src/wasm/wasm-memory.h b/deps/v8/src/wasm/wasm-memory.h
index 2ab24739a8726d..ea4934904892d0 100644
--- a/deps/v8/src/wasm/wasm-memory.h
+++ b/deps/v8/src/wasm/wasm-memory.h
@@ -15,9 +15,6 @@
 
 namespace v8 {
 namespace internal {
-
-class Histogram;  // defined in counters.h
-
 namespace wasm {
 
 class WasmMemoryTracker {
@@ -31,8 +28,9 @@ class WasmMemoryTracker {
   // allocate the buffer), false otherwise.
   bool ReserveAddressSpace(size_t num_bytes);
 
-  void RegisterAllocation(void* allocation_base, size_t allocation_length,
-                          void* buffer_start, size_t buffer_length);
+  void RegisterAllocation(Isolate* isolate, void* allocation_base,
+                          size_t allocation_length, void* buffer_start,
+                          size_t buffer_length);
 
   struct AllocationData {
     void* allocation_base = nullptr;
@@ -65,7 +63,7 @@ class WasmMemoryTracker {
   void ReleaseReservation(size_t num_bytes);
 
   // Removes an allocation from the tracker
-  AllocationData ReleaseAllocation(const void* buffer_start);
+  AllocationData ReleaseAllocation(Isolate* isolate, const void* buffer_start);
 
   bool IsWasmMemory(const void* buffer_start);
 
@@ -80,14 +78,7 @@ class WasmMemoryTracker {
   // Checks if a buffer points to a Wasm memory and if so does any necessary
   // work to reclaim the buffer. If this function returns false, the caller must
   // free the buffer manually.
-  bool FreeMemoryIfIsWasmMemory(const void* buffer_start);
-
-  void SetAllocationResultHistogram(Histogram* allocation_result) {
-    allocation_result_ = allocation_result;
-  }
-  void SetAddressSpaceUsageHistogram(Histogram* address_space_usage) {
-    address_space_usage_mb_ = address_space_usage;
-  }
+  bool FreeMemoryIfIsWasmMemory(Isolate* isolate, const void* buffer_start);
 
   // Allocation results are reported to UMA
   //
@@ -103,11 +94,8 @@ class WasmMemoryTracker {
     kOtherFailure  // Failed for an unknown reason
   };
 
-  void AddAllocationStatusSample(AllocationStatus status);
-
  private:
-  AllocationData InternalReleaseAllocation(const void* buffer_start);
-  void AddAddressSpaceSample();
+  void AddAddressSpaceSample(Isolate* isolate);
 
   // Clients use a two-part process. First they "reserve" the address space,
   // which signifies an intent to actually allocate it. This determines whether
@@ -129,10 +117,6 @@ class WasmMemoryTracker {
   // buffer, rather than by the start of the allocation.
   std::unordered_map<const void*, AllocationData> allocations_;
 
-  // Keep pointers to
-  Histogram* allocation_result_ = nullptr;
-  Histogram* address_space_usage_mb_ = nullptr;  // in MiB
-
   DISALLOW_COPY_AND_ASSIGN(WasmMemoryTracker);
 };
 
diff --git a/deps/v8/src/wasm/wasm-objects.cc b/deps/v8/src/wasm/wasm-objects.cc
index 45910ddfb5af24..7cd2fecb7f6a75 100644
--- a/deps/v8/src/wasm/wasm-objects.cc
+++ b/deps/v8/src/wasm/wasm-objects.cc
@@ -1274,7 +1274,7 @@ Handle<WasmInstanceObject> WasmInstanceObject::New(
   Handle<WeakArrayList> weak_instance_list(module_object->weak_instance_list(),
                                            isolate);
   weak_instance_list = WeakArrayList::AddToEnd(
-      weak_instance_list, MaybeObjectHandle::Weak(instance));
+      isolate, weak_instance_list, MaybeObjectHandle::Weak(instance));
   module_object->set_weak_instance_list(*weak_instance_list);
 
   return instance;
diff --git a/deps/v8/src/wasm/wasm-objects.h b/deps/v8/src/wasm/wasm-objects.h
index ee884ec0ddb5a1..3daf5e1e76b4d9 100644
--- a/deps/v8/src/wasm/wasm-objects.h
+++ b/deps/v8/src/wasm/wasm-objects.h
@@ -516,8 +516,11 @@ class WasmExportedFunctionData : public Struct {
 #undef WASM_EXPORTED_FUNCTION_DATA_FIELDS
 };
 
-class WasmDebugInfo : public Struct {
+class WasmDebugInfo : public Struct, public NeverReadOnlySpaceObject {
  public:
+  using NeverReadOnlySpaceObject::GetHeap;
+  using NeverReadOnlySpaceObject::GetIsolate;
+
   DECL_ACCESSORS(wasm_instance, WasmInstanceObject)
   DECL_ACCESSORS(interpreter_handle, Object);
   DECL_ACCESSORS(interpreted_functions, Object);
diff --git a/deps/v8/test/BUILD.gn b/deps/v8/test/BUILD.gn
index c15413675e2fbe..d0d2a40035149f 100644
--- a/deps/v8/test/BUILD.gn
+++ b/deps/v8/test/BUILD.gn
@@ -49,17 +49,28 @@ group("v8_perf") {
 
   data = [
     "../tools/run_perf.py",
+
     # TODO(machenbach): These files are referenced by the perf runner.
     # They should be transformed into a proper python module.
     "../tools/testrunner/local/command.py",
     "../tools/testrunner/local/utils.py",
     "../tools/testrunner/objects/output.py",
+
     # This is often used to trigger performance bots. We include it in the
     # isolate to not get these builds deduped.
     "../tools/whitespace.txt",
     "js-perf-test/",
     "memory/",
   ]
+
+  if (is_android && !build_with_chromium) {
+    data_deps += [ "../build/android:test_runner_py" ]
+
+    data += [
+      # This is used by run_perf.py, but not included by test_runner_py above.
+      "../third_party/catapult/devil/devil/android/perf/",
+    ]
+  }
 }
 
 group("v8_bot_default") {
diff --git a/deps/v8/test/cctest/BUILD.gn b/deps/v8/test/cctest/BUILD.gn
index a5ee0ce3b47c2d..9072d6bed7213f 100644
--- a/deps/v8/test/cctest/BUILD.gn
+++ b/deps/v8/test/cctest/BUILD.gn
@@ -117,7 +117,6 @@ v8_source_set("cctest_sources") {
     "heap/test-compaction.cc",
     "heap/test-concurrent-marking.cc",
     "heap/test-embedder-tracing.cc",
-    "heap/test-external-string-tracker.cc",
     "heap/test-heap.cc",
     "heap/test-incremental-marking.cc",
     "heap/test-invalidated-slots.cc",
diff --git a/deps/v8/test/cctest/cctest.h b/deps/v8/test/cctest/cctest.h
index f1deea17be1103..8bae124ea144a9 100644
--- a/deps/v8/test/cctest/cctest.h
+++ b/deps/v8/test/cctest/cctest.h
@@ -326,7 +326,7 @@ static inline i::Handle<T> GetGlobal(const char* name) {
       isolate->factory()->InternalizeUtf8String(name);
 
   i::Handle<i::Object> value =
-      i::Object::GetProperty(isolate->global_object(), str_name)
+      i::Object::GetProperty(isolate, isolate->global_object(), str_name)
           .ToHandleChecked();
   return i::Handle<T>::cast(value);
 }
diff --git a/deps/v8/test/cctest/compiler/test-code-assembler.cc b/deps/v8/test/cctest/compiler/test-code-assembler.cc
index 2c28a0638d4616..91065cd546464c 100644
--- a/deps/v8/test/cctest/compiler/test-code-assembler.cc
+++ b/deps/v8/test/cctest/compiler/test-code-assembler.cc
@@ -469,7 +469,7 @@ TEST(GotoIfException) {
   CHECK(result->IsJSObject());
 
   Handle<Object> constructor =
-      Object::GetPropertyOrElement(result,
+      Object::GetPropertyOrElement(isolate, result,
                                    isolate->factory()->constructor_string())
           .ToHandleChecked();
   CHECK(constructor->SameValue(*isolate->type_error_function()));
@@ -554,7 +554,7 @@ TEST(GotoIfExceptionMultiple) {
   CHECK(result->IsJSObject());
 
   Handle<Object> constructor =
-      Object::GetPropertyOrElement(result,
+      Object::GetPropertyOrElement(isolate, result,
                                    isolate->factory()->constructor_string())
           .ToHandleChecked();
   CHECK(constructor->SameValue(*isolate->type_error_function()));
diff --git a/deps/v8/test/cctest/compiler/test-js-typed-lowering.cc b/deps/v8/test/cctest/compiler/test-js-typed-lowering.cc
index 3f969f8bfed6fd..6aa84b03175c7b 100644
--- a/deps/v8/test/cctest/compiler/test-js-typed-lowering.cc
+++ b/deps/v8/test/cctest/compiler/test-js-typed-lowering.cc
@@ -605,7 +605,8 @@ static void CheckIsConvertedToNumber(Node* val, Node* converted) {
     CHECK_EQ(val, converted);
   } else {
     if (converted->opcode() == IrOpcode::kNumberConstant) return;
-    CHECK_EQ(IrOpcode::kJSToNumber, converted->opcode());
+    CHECK(IrOpcode::kJSToNumber == converted->opcode() ||
+          IrOpcode::kJSToNumberConvertBigInt == converted->opcode());
     CHECK_EQ(val, converted->InputAt(0));
   }
 }
diff --git a/deps/v8/test/cctest/compiler/test-linkage.cc b/deps/v8/test/cctest/compiler/test-linkage.cc
index 39ef66c5eb8f6f..5dc364394d20c1 100644
--- a/deps/v8/test/cctest/compiler/test-linkage.cc
+++ b/deps/v8/test/cctest/compiler/test-linkage.cc
@@ -35,8 +35,9 @@ static Handle<JSFunction> Compile(const char* source) {
                                    .ToHandleChecked();
   Handle<SharedFunctionInfo> shared =
       Compiler::GetSharedFunctionInfoForScript(
-          source_code, Compiler::ScriptDetails(), v8::ScriptOriginOptions(),
-          nullptr, nullptr, v8::ScriptCompiler::kNoCompileOptions,
+          isolate, source_code, Compiler::ScriptDetails(),
+          v8::ScriptOriginOptions(), nullptr, nullptr,
+          v8::ScriptCompiler::kNoCompileOptions,
           ScriptCompiler::kNoCacheNoReason, NOT_NATIVES_CODE)
           .ToHandleChecked();
   return isolate->factory()->NewFunctionFromSharedFunctionInfo(
diff --git a/deps/v8/test/cctest/compiler/test-run-jsobjects.cc b/deps/v8/test/cctest/compiler/test-run-jsobjects.cc
index ff161ced781302..83282e905de8d8 100644
--- a/deps/v8/test/cctest/compiler/test-run-jsobjects.cc
+++ b/deps/v8/test/cctest/compiler/test-run-jsobjects.cc
@@ -19,7 +19,8 @@ TEST(ArgumentsMapped) {
   CHECK(arguments->IsJSObject() && !arguments->IsJSArray());
   CHECK(JSObject::cast(*arguments)->HasSloppyArgumentsElements());
   Handle<String> l = T.isolate->factory()->length_string();
-  Handle<Object> length = Object::GetProperty(arguments, l).ToHandleChecked();
+  Handle<Object> length =
+      Object::GetProperty(T.isolate, arguments, l).ToHandleChecked();
   CHECK_EQ(4, length->Number());
 }
 
@@ -32,7 +33,8 @@ TEST(ArgumentsUnmapped) {
   CHECK(arguments->IsJSObject() && !arguments->IsJSArray());
   CHECK(!JSObject::cast(*arguments)->HasSloppyArgumentsElements());
   Handle<String> l = T.isolate->factory()->length_string();
-  Handle<Object> length = Object::GetProperty(arguments, l).ToHandleChecked();
+  Handle<Object> length =
+      Object::GetProperty(T.isolate, arguments, l).ToHandleChecked();
   CHECK_EQ(4, length->Number());
 }
 
@@ -45,7 +47,8 @@ TEST(ArgumentsRest) {
   CHECK(arguments->IsJSObject() && arguments->IsJSArray());
   CHECK(!JSObject::cast(*arguments)->HasSloppyArgumentsElements());
   Handle<String> l = T.isolate->factory()->length_string();
-  Handle<Object> length = Object::GetProperty(arguments, l).ToHandleChecked();
+  Handle<Object> length =
+      Object::GetProperty(T.isolate, arguments, l).ToHandleChecked();
   CHECK_EQ(3, length->Number());
 }
 
diff --git a/deps/v8/test/cctest/heap/test-external-string-tracker.cc b/deps/v8/test/cctest/heap/test-external-string-tracker.cc
deleted file mode 100644
index e0a6c43a558f65..00000000000000
--- a/deps/v8/test/cctest/heap/test-external-string-tracker.cc
+++ /dev/null
@@ -1,176 +0,0 @@
-// Copyright 2018 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "src/api.h"
-#include "src/heap/spaces.h"
-#include "src/isolate.h"
-#include "src/objects-inl.h"
-#include "test/cctest/cctest.h"
-#include "test/cctest/heap/heap-tester.h"
-#include "test/cctest/heap/heap-utils.h"
-
-#define TEST_STR "tests are great!"
-
-namespace v8 {
-namespace internal {
-namespace heap {
-
-// Adapted from cctest/test-api.cc
-class TestOneByteResource : public v8::String::ExternalOneByteStringResource {
- public:
-  explicit TestOneByteResource(const char* data, int* counter = nullptr,
-                               size_t offset = 0)
-      : orig_data_(data),
-        data_(data + offset),
-        length_(strlen(data) - offset),
-        counter_(counter) {}
-
-  ~TestOneByteResource() {
-    i::DeleteArray(orig_data_);
-    if (counter_ != nullptr) ++*counter_;
-  }
-
-  const char* data() const { return data_; }
-
-  size_t length() const { return length_; }
-
- private:
-  const char* orig_data_;
-  const char* data_;
-  size_t length_;
-  int* counter_;
-};
-
-TEST(ExternalString_ExternalBackingStoreSizeIncreases) {
-  CcTest::InitializeVM();
-  LocalContext env;
-  v8::Isolate* isolate = env->GetIsolate();
-  Heap* heap = reinterpret_cast<Isolate*>(isolate)->heap();
-  ExternalBackingStoreType type = ExternalBackingStoreType::kExternalString;
-
-  const size_t backing_store_before =
-      heap->old_space()->ExternalBackingStoreBytes(type);
-
-  {
-    v8::HandleScope handle_scope(isolate);
-    v8::Local<v8::String> es = v8::String::NewExternal(
-        isolate, new TestOneByteResource(i::StrDup(TEST_STR)));
-    USE(es);
-
-    const size_t backing_store_after =
-        heap->old_space()->ExternalBackingStoreBytes(type);
-
-    CHECK_EQ(es->Length(), backing_store_after - backing_store_before);
-  }
-}
-
-TEST(ExternalString_ExternalBackingStoreSizeDecreases) {
-  ManualGCScope manual_gc_scope;
-  CcTest::InitializeVM();
-  LocalContext env;
-  v8::Isolate* isolate = env->GetIsolate();
-  Heap* heap = reinterpret_cast<Isolate*>(isolate)->heap();
-  ExternalBackingStoreType type = ExternalBackingStoreType::kExternalString;
-
-  const size_t backing_store_before =
-      heap->old_space()->ExternalBackingStoreBytes(type);
-
-  {
-    v8::HandleScope handle_scope(isolate);
-    v8::Local<v8::String> es = v8::String::NewExternal(
-        isolate, new TestOneByteResource(i::StrDup(TEST_STR)));
-    USE(es);
-  }
-
-  heap::GcAndSweep(heap, OLD_SPACE);
-
-  const size_t backing_store_after =
-      heap->old_space()->ExternalBackingStoreBytes(type);
-
-  CHECK_EQ(0, backing_store_after - backing_store_before);
-}
-
-TEST(ExternalString_ExternalBackingStoreSizeIncreasesMarkCompact) {
-  if (FLAG_never_compact) return;
-  ManualGCScope manual_gc_scope;
-  FLAG_manual_evacuation_candidates_selection = true;
-  CcTest::InitializeVM();
-  LocalContext env;
-  v8::Isolate* isolate = env->GetIsolate();
-  Heap* heap = reinterpret_cast<Isolate*>(isolate)->heap();
-  heap::AbandonCurrentlyFreeMemory(heap->old_space());
-  ExternalBackingStoreType type = ExternalBackingStoreType::kExternalString;
-
-  const size_t backing_store_before =
-      heap->old_space()->ExternalBackingStoreBytes(type);
-
-  {
-    v8::HandleScope handle_scope(isolate);
-    v8::Local<v8::String> es = v8::String::NewExternal(
-        isolate, new TestOneByteResource(i::StrDup(TEST_STR)));
-    Handle<String> esh = v8::Utils::OpenHandle(*es);
-
-    Page* page_before_gc = Page::FromAddress(esh->address());
-    heap::ForceEvacuationCandidate(page_before_gc);
-
-    CcTest::CollectAllGarbage();
-
-    const size_t backing_store_after =
-        heap->old_space()->ExternalBackingStoreBytes(type);
-    CHECK_EQ(es->Length(), backing_store_after - backing_store_before);
-  }
-
-  heap::GcAndSweep(heap, OLD_SPACE);
-  const size_t backing_store_after =
-      heap->old_space()->ExternalBackingStoreBytes(type);
-  CHECK_EQ(0, backing_store_after - backing_store_before);
-}
-
-TEST(ExternalString_ExternalBackingStoreSizeIncreasesAfterExternalization) {
-  CcTest::InitializeVM();
-  LocalContext env;
-  v8::Isolate* isolate = env->GetIsolate();
-  Heap* heap = reinterpret_cast<Isolate*>(isolate)->heap();
-  ExternalBackingStoreType type = ExternalBackingStoreType::kExternalString;
-  size_t old_backing_store_before = 0, new_backing_store_before = 0;
-
-  {
-    v8::HandleScope handle_scope(isolate);
-
-    new_backing_store_before =
-        heap->new_space()->ExternalBackingStoreBytes(type);
-    old_backing_store_before =
-        heap->old_space()->ExternalBackingStoreBytes(type);
-
-    // Allocate normal string in the new gen.
-    v8::Local<v8::String> str =
-        v8::String::NewFromUtf8(isolate, TEST_STR, v8::NewStringType::kNormal)
-            .ToLocalChecked();
-
-    CHECK_EQ(0, heap->new_space()->ExternalBackingStoreBytes(type) -
-                    new_backing_store_before);
-
-    // Trigger GCs so that the newly allocated string moves to old gen.
-    heap::GcAndSweep(heap, NEW_SPACE);  // in survivor space now
-    heap::GcAndSweep(heap, NEW_SPACE);  // in old gen now
-
-    bool success =
-        str->MakeExternal(new TestOneByteResource(i::StrDup(TEST_STR)));
-    CHECK(success);
-
-    CHECK_EQ(str->Length(), heap->old_space()->ExternalBackingStoreBytes(type) -
-                                old_backing_store_before);
-  }
-
-  heap::GcAndSweep(heap, OLD_SPACE);
-
-  CHECK_EQ(0, heap->old_space()->ExternalBackingStoreBytes(type) -
-                  old_backing_store_before);
-}
-
-}  // namespace heap
-}  // namespace internal
-}  // namespace v8
-
-#undef TEST_STR
diff --git a/deps/v8/test/cctest/heap/test-heap.cc b/deps/v8/test/cctest/heap/test-heap.cc
index c35f665106b74d..141b14ba53bf37 100644
--- a/deps/v8/test/cctest/heap/test-heap.cc
+++ b/deps/v8/test/cctest/heap/test-heap.cc
@@ -364,19 +364,22 @@ TEST(GarbageCollection) {
     HandleScope inner_scope(isolate);
     // Allocate a function and keep it in global object's property.
     Handle<JSFunction> function = factory->NewFunctionForTest(name);
-    JSReceiver::SetProperty(global, name, function, LanguageMode::kSloppy)
+    JSReceiver::SetProperty(isolate, global, name, function,
+                            LanguageMode::kSloppy)
         .Check();
     // Allocate an object.  Unrooted after leaving the scope.
     Handle<JSObject> obj = factory->NewJSObject(function);
-    JSReceiver::SetProperty(obj, prop_name, twenty_three, LanguageMode::kSloppy)
+    JSReceiver::SetProperty(isolate, obj, prop_name, twenty_three,
+                            LanguageMode::kSloppy)
         .Check();
-    JSReceiver::SetProperty(obj, prop_namex, twenty_four, LanguageMode::kSloppy)
+    JSReceiver::SetProperty(isolate, obj, prop_namex, twenty_four,
+                            LanguageMode::kSloppy)
         .Check();
 
     CHECK_EQ(Smi::FromInt(23),
-             *Object::GetProperty(obj, prop_name).ToHandleChecked());
+             *Object::GetProperty(isolate, obj, prop_name).ToHandleChecked());
     CHECK_EQ(Smi::FromInt(24),
-             *Object::GetProperty(obj, prop_namex).ToHandleChecked());
+             *Object::GetProperty(isolate, obj, prop_namex).ToHandleChecked());
   }
 
   CcTest::CollectGarbage(NEW_SPACE);
@@ -385,7 +388,7 @@ TEST(GarbageCollection) {
   CHECK(Just(true) == JSReceiver::HasOwnProperty(global, name));
   // Check function is retained.
   Handle<Object> func_value =
-      Object::GetProperty(global, name).ToHandleChecked();
+      Object::GetProperty(isolate, global, name).ToHandleChecked();
   CHECK(func_value->IsJSFunction());
   Handle<JSFunction> function = Handle<JSFunction>::cast(func_value);
 
@@ -393,9 +396,11 @@ TEST(GarbageCollection) {
     HandleScope inner_scope(isolate);
     // Allocate another object, make it reachable from global.
     Handle<JSObject> obj = factory->NewJSObject(function);
-    JSReceiver::SetProperty(global, obj_name, obj, LanguageMode::kSloppy)
+    JSReceiver::SetProperty(isolate, global, obj_name, obj,
+                            LanguageMode::kSloppy)
         .Check();
-    JSReceiver::SetProperty(obj, prop_name, twenty_three, LanguageMode::kSloppy)
+    JSReceiver::SetProperty(isolate, obj, prop_name, twenty_three,
+                            LanguageMode::kSloppy)
         .Check();
   }
 
@@ -404,10 +409,10 @@ TEST(GarbageCollection) {
 
   CHECK(Just(true) == JSReceiver::HasOwnProperty(global, obj_name));
   Handle<Object> obj =
-      Object::GetProperty(global, obj_name).ToHandleChecked();
+      Object::GetProperty(isolate, global, obj_name).ToHandleChecked();
   CHECK(obj->IsJSObject());
   CHECK_EQ(Smi::FromInt(23),
-           *Object::GetProperty(obj, prop_name).ToHandleChecked());
+           *Object::GetProperty(isolate, obj, prop_name).ToHandleChecked());
 }
 
 
@@ -936,16 +941,18 @@ TEST(FunctionAllocation) {
 
   Handle<String> prop_name = factory->InternalizeUtf8String("theSlot");
   Handle<JSObject> obj = factory->NewJSObject(function);
-  JSReceiver::SetProperty(obj, prop_name, twenty_three, LanguageMode::kSloppy)
+  JSReceiver::SetProperty(isolate, obj, prop_name, twenty_three,
+                          LanguageMode::kSloppy)
       .Check();
   CHECK_EQ(Smi::FromInt(23),
-           *Object::GetProperty(obj, prop_name).ToHandleChecked());
+           *Object::GetProperty(isolate, obj, prop_name).ToHandleChecked());
   // Check that we can add properties to function objects.
-  JSReceiver::SetProperty(function, prop_name, twenty_four,
+  JSReceiver::SetProperty(isolate, function, prop_name, twenty_four,
                           LanguageMode::kSloppy)
       .Check();
-  CHECK_EQ(Smi::FromInt(24),
-           *Object::GetProperty(function, prop_name).ToHandleChecked());
+  CHECK_EQ(
+      Smi::FromInt(24),
+      *Object::GetProperty(isolate, function, prop_name).ToHandleChecked());
 }
 
 
@@ -957,8 +964,10 @@ TEST(ObjectProperties) {
   v8::HandleScope sc(CcTest::isolate());
   Handle<String> object_string(
       String::cast(ReadOnlyRoots(CcTest::heap()).Object_string()), isolate);
-  Handle<Object> object = Object::GetProperty(
-      CcTest::i_isolate()->global_object(), object_string).ToHandleChecked();
+  Handle<Object> object =
+      Object::GetProperty(isolate, CcTest::i_isolate()->global_object(),
+                          object_string)
+          .ToHandleChecked();
   Handle<JSFunction> constructor = Handle<JSFunction>::cast(object);
   Handle<JSObject> obj = factory->NewJSObject(constructor);
   Handle<String> first = factory->InternalizeUtf8String("first");
@@ -971,7 +980,8 @@ TEST(ObjectProperties) {
   CHECK(Just(false) == JSReceiver::HasOwnProperty(obj, first));
 
   // add first
-  JSReceiver::SetProperty(obj, first, one, LanguageMode::kSloppy).Check();
+  JSReceiver::SetProperty(isolate, obj, first, one, LanguageMode::kSloppy)
+      .Check();
   CHECK(Just(true) == JSReceiver::HasOwnProperty(obj, first));
 
   // delete first
@@ -980,8 +990,10 @@ TEST(ObjectProperties) {
   CHECK(Just(false) == JSReceiver::HasOwnProperty(obj, first));
 
   // add first and then second
-  JSReceiver::SetProperty(obj, first, one, LanguageMode::kSloppy).Check();
-  JSReceiver::SetProperty(obj, second, two, LanguageMode::kSloppy).Check();
+  JSReceiver::SetProperty(isolate, obj, first, one, LanguageMode::kSloppy)
+      .Check();
+  JSReceiver::SetProperty(isolate, obj, second, two, LanguageMode::kSloppy)
+      .Check();
   CHECK(Just(true) == JSReceiver::HasOwnProperty(obj, first));
   CHECK(Just(true) == JSReceiver::HasOwnProperty(obj, second));
 
@@ -995,8 +1007,10 @@ TEST(ObjectProperties) {
   CHECK(Just(false) == JSReceiver::HasOwnProperty(obj, second));
 
   // add first and then second
-  JSReceiver::SetProperty(obj, first, one, LanguageMode::kSloppy).Check();
-  JSReceiver::SetProperty(obj, second, two, LanguageMode::kSloppy).Check();
+  JSReceiver::SetProperty(isolate, obj, first, one, LanguageMode::kSloppy)
+      .Check();
+  JSReceiver::SetProperty(isolate, obj, second, two, LanguageMode::kSloppy)
+      .Check();
   CHECK(Just(true) == JSReceiver::HasOwnProperty(obj, first));
   CHECK(Just(true) == JSReceiver::HasOwnProperty(obj, second));
 
@@ -1012,14 +1026,15 @@ TEST(ObjectProperties) {
   // check string and internalized string match
   const char* string1 = "fisk";
   Handle<String> s1 = factory->NewStringFromAsciiChecked(string1);
-  JSReceiver::SetProperty(obj, s1, one, LanguageMode::kSloppy).Check();
+  JSReceiver::SetProperty(isolate, obj, s1, one, LanguageMode::kSloppy).Check();
   Handle<String> s1_string = factory->InternalizeUtf8String(string1);
   CHECK(Just(true) == JSReceiver::HasOwnProperty(obj, s1_string));
 
   // check internalized string and string match
   const char* string2 = "fugl";
   Handle<String> s2_string = factory->InternalizeUtf8String(string2);
-  JSReceiver::SetProperty(obj, s2_string, one, LanguageMode::kSloppy).Check();
+  JSReceiver::SetProperty(isolate, obj, s2_string, one, LanguageMode::kSloppy)
+      .Check();
   Handle<String> s2 = factory->NewStringFromAsciiChecked(string2);
   CHECK(Just(true) == JSReceiver::HasOwnProperty(obj, s2));
 }
@@ -1040,10 +1055,11 @@ TEST(JSObjectMaps) {
 
   // Set a propery
   Handle<Smi> twenty_three(Smi::FromInt(23), isolate);
-  JSReceiver::SetProperty(obj, prop_name, twenty_three, LanguageMode::kSloppy)
+  JSReceiver::SetProperty(isolate, obj, prop_name, twenty_three,
+                          LanguageMode::kSloppy)
       .Check();
   CHECK_EQ(Smi::FromInt(23),
-           *Object::GetProperty(obj, prop_name).ToHandleChecked());
+           *Object::GetProperty(isolate, obj, prop_name).ToHandleChecked());
 
   // Check the map has changed
   CHECK(*initial_map != obj->map());
@@ -1057,8 +1073,9 @@ TEST(JSArray) {
 
   v8::HandleScope sc(CcTest::isolate());
   Handle<String> name = factory->InternalizeUtf8String("Array");
-  Handle<Object> fun_obj = Object::GetProperty(
-      CcTest::i_isolate()->global_object(), name).ToHandleChecked();
+  Handle<Object> fun_obj =
+      Object::GetProperty(isolate, CcTest::i_isolate()->global_object(), name)
+          .ToHandleChecked();
   Handle<JSFunction> function = Handle<JSFunction>::cast(fun_obj);
 
   // Allocate the object.
@@ -1111,8 +1128,10 @@ TEST(JSObjectCopy) {
   v8::HandleScope sc(CcTest::isolate());
   Handle<String> object_string(
       String::cast(ReadOnlyRoots(CcTest::heap()).Object_string()), isolate);
-  Handle<Object> object = Object::GetProperty(
-      CcTest::i_isolate()->global_object(), object_string).ToHandleChecked();
+  Handle<Object> object =
+      Object::GetProperty(isolate, CcTest::i_isolate()->global_object(),
+                          object_string)
+          .ToHandleChecked();
   Handle<JSFunction> constructor = Handle<JSFunction>::cast(object);
   Handle<JSObject> obj = factory->NewJSObject(constructor);
   Handle<String> first = factory->InternalizeUtf8String("first");
@@ -1121,8 +1140,10 @@ TEST(JSObjectCopy) {
   Handle<Smi> one(Smi::FromInt(1), isolate);
   Handle<Smi> two(Smi::FromInt(2), isolate);
 
-  JSReceiver::SetProperty(obj, first, one, LanguageMode::kSloppy).Check();
-  JSReceiver::SetProperty(obj, second, two, LanguageMode::kSloppy).Check();
+  JSReceiver::SetProperty(isolate, obj, first, one, LanguageMode::kSloppy)
+      .Check();
+  JSReceiver::SetProperty(isolate, obj, second, two, LanguageMode::kSloppy)
+      .Check();
 
   JSReceiver::SetElement(isolate, obj, 0, first, LanguageMode::kSloppy).Check();
   JSReceiver::SetElement(isolate, obj, 1, second, LanguageMode::kSloppy)
@@ -1140,16 +1161,18 @@ TEST(JSObjectCopy) {
   value2 = Object::GetElement(isolate, clone, 1).ToHandleChecked();
   CHECK_EQ(*value1, *value2);
 
-  value1 = Object::GetProperty(obj, first).ToHandleChecked();
-  value2 = Object::GetProperty(clone, first).ToHandleChecked();
+  value1 = Object::GetProperty(isolate, obj, first).ToHandleChecked();
+  value2 = Object::GetProperty(isolate, clone, first).ToHandleChecked();
   CHECK_EQ(*value1, *value2);
-  value1 = Object::GetProperty(obj, second).ToHandleChecked();
-  value2 = Object::GetProperty(clone, second).ToHandleChecked();
+  value1 = Object::GetProperty(isolate, obj, second).ToHandleChecked();
+  value2 = Object::GetProperty(isolate, clone, second).ToHandleChecked();
   CHECK_EQ(*value1, *value2);
 
   // Flip the values.
-  JSReceiver::SetProperty(clone, first, two, LanguageMode::kSloppy).Check();
-  JSReceiver::SetProperty(clone, second, one, LanguageMode::kSloppy).Check();
+  JSReceiver::SetProperty(isolate, clone, first, two, LanguageMode::kSloppy)
+      .Check();
+  JSReceiver::SetProperty(isolate, clone, second, one, LanguageMode::kSloppy)
+      .Check();
 
   JSReceiver::SetElement(isolate, clone, 0, second, LanguageMode::kSloppy)
       .Check();
@@ -1163,11 +1186,11 @@ TEST(JSObjectCopy) {
   value2 = Object::GetElement(isolate, clone, 1).ToHandleChecked();
   CHECK_EQ(*value1, *value2);
 
-  value1 = Object::GetProperty(obj, second).ToHandleChecked();
-  value2 = Object::GetProperty(clone, first).ToHandleChecked();
+  value1 = Object::GetProperty(isolate, obj, second).ToHandleChecked();
+  value2 = Object::GetProperty(isolate, clone, first).ToHandleChecked();
   CHECK_EQ(*value1, *value2);
-  value1 = Object::GetProperty(obj, first).ToHandleChecked();
-  value2 = Object::GetProperty(clone, second).ToHandleChecked();
+  value1 = Object::GetProperty(isolate, obj, first).ToHandleChecked();
+  value2 = Object::GetProperty(isolate, clone, second).ToHandleChecked();
   CHECK_EQ(*value1, *value2);
 }
 
@@ -1286,14 +1309,16 @@ TEST(TestUseOfIncrementalBarrierOnCompileLazy) {
   // Check f is compiled.
   Handle<String> f_name = factory->InternalizeUtf8String("f");
   Handle<Object> f_value =
-      Object::GetProperty(isolate->global_object(), f_name).ToHandleChecked();
+      Object::GetProperty(isolate, isolate->global_object(), f_name)
+          .ToHandleChecked();
   Handle<JSFunction> f_function = Handle<JSFunction>::cast(f_value);
   CHECK(f_function->is_compiled());
 
   // Check g is not compiled.
   Handle<String> g_name = factory->InternalizeUtf8String("g");
   Handle<Object> g_value =
-      Object::GetProperty(isolate->global_object(), g_name).ToHandleChecked();
+      Object::GetProperty(isolate, isolate->global_object(), g_name)
+          .ToHandleChecked();
   Handle<JSFunction> g_function = Handle<JSFunction>::cast(g_value);
   CHECK(!g_function->is_compiled());
 
@@ -2834,7 +2859,7 @@ static void AddPropertyTo(
   FLAG_gc_global = true;
   FLAG_retain_maps_for_n_gc = 0;
   CcTest::heap()->set_allocation_timeout(gc_count);
-  JSReceiver::SetProperty(object, prop_name, twenty_three,
+  JSReceiver::SetProperty(isolate, object, prop_name, twenty_three,
                           LanguageMode::kSloppy)
       .Check();
 }
@@ -4223,7 +4248,8 @@ TEST(WeakMapInMonomorphicCompareNilIC) {
 Handle<JSFunction> GetFunctionByName(Isolate* isolate, const char* name) {
   Handle<String> str = isolate->factory()->InternalizeUtf8String(name);
   Handle<Object> obj =
-      Object::GetProperty(isolate->global_object(), str).ToHandleChecked();
+      Object::GetProperty(isolate, isolate->global_object(), str)
+          .ToHandleChecked();
   return Handle<JSFunction>::cast(obj);
 }
 
@@ -4643,7 +4669,8 @@ TEST(Regress442710) {
   Handle<JSArray> array = factory->NewJSArray(2);
 
   Handle<String> name = factory->InternalizeUtf8String("testArray");
-  JSReceiver::SetProperty(global, name, array, LanguageMode::kSloppy).Check();
+  JSReceiver::SetProperty(isolate, global, name, array, LanguageMode::kSloppy)
+      .Check();
   CompileRun("testArray[0] = 1; testArray[1] = 2; testArray.shift();");
   CcTest::CollectGarbage(OLD_SPACE);
 }
@@ -4771,7 +4798,7 @@ TEST(PreprocessStackTrace) {
   Handle<Object> exception = v8::Utils::OpenHandle(*try_catch.Exception());
   Handle<Name> key = isolate->factory()->stack_trace_symbol();
   Handle<Object> stack_trace =
-      Object::GetProperty(exception, key).ToHandleChecked();
+      Object::GetProperty(isolate, exception, key).ToHandleChecked();
   Handle<Object> code =
       Object::GetElement(isolate, stack_trace, 3).ToHandleChecked();
   CHECK(code->IsCode());
@@ -5465,7 +5492,7 @@ TEST(Regress631969) {
     s3->MakeExternal(&external_string);
     CcTest::CollectGarbage(OLD_SPACE);
     // This avoids the GC from trying to free stack allocated resources.
-    i::Handle<i::ExternalOneByteString>::cast(s3)->SetResource(nullptr);
+    i::Handle<i::ExternalOneByteString>::cast(s3)->set_resource(nullptr);
   }
 }
 
@@ -5957,7 +5984,7 @@ UNINITIALIZED_TEST(ReinitializeStringHashSeed) {
     v8::Isolate* isolate = v8::Isolate::New(create_params);
     {
       v8::Isolate::Scope isolate_scope(isolate);
-      CHECK_EQ(1337 * i,
+      CHECK_EQ(static_cast<uint64_t>(1337 * i),
                reinterpret_cast<i::Isolate*>(isolate)->heap()->HashSeed());
       v8::HandleScope handle_scope(isolate);
       v8::Local<v8::Context> context = v8::Context::New(isolate);
diff --git a/deps/v8/test/cctest/heap/test-mark-compact.cc b/deps/v8/test/cctest/heap/test-mark-compact.cc
index 0891264669bd51..1e21f92a651a5f 100644
--- a/deps/v8/test/cctest/heap/test-mark-compact.cc
+++ b/deps/v8/test/cctest/heap/test-mark-compact.cc
@@ -165,7 +165,8 @@ HEAP_TEST(MarkCompactCollector) {
     // allocate a garbage
     Handle<String> func_name = factory->InternalizeUtf8String("theFunction");
     Handle<JSFunction> function = factory->NewFunctionForTest(func_name);
-    JSReceiver::SetProperty(global, func_name, function, LanguageMode::kSloppy)
+    JSReceiver::SetProperty(isolate, global, func_name, function,
+                            LanguageMode::kSloppy)
         .Check();
 
     factory->NewJSObject(function);
@@ -177,17 +178,19 @@ HEAP_TEST(MarkCompactCollector) {
     Handle<String> func_name = factory->InternalizeUtf8String("theFunction");
     CHECK(Just(true) == JSReceiver::HasOwnProperty(global, func_name));
     Handle<Object> func_value =
-        Object::GetProperty(global, func_name).ToHandleChecked();
+        Object::GetProperty(isolate, global, func_name).ToHandleChecked();
     CHECK(func_value->IsJSFunction());
     Handle<JSFunction> function = Handle<JSFunction>::cast(func_value);
     Handle<JSObject> obj = factory->NewJSObject(function);
 
     Handle<String> obj_name = factory->InternalizeUtf8String("theObject");
-    JSReceiver::SetProperty(global, obj_name, obj, LanguageMode::kSloppy)
+    JSReceiver::SetProperty(isolate, global, obj_name, obj,
+                            LanguageMode::kSloppy)
         .Check();
     Handle<String> prop_name = factory->InternalizeUtf8String("theSlot");
     Handle<Smi> twenty_three(Smi::FromInt(23), isolate);
-    JSReceiver::SetProperty(obj, prop_name, twenty_three, LanguageMode::kSloppy)
+    JSReceiver::SetProperty(isolate, obj, prop_name, twenty_three,
+                            LanguageMode::kSloppy)
         .Check();
   }
 
@@ -197,10 +200,10 @@ HEAP_TEST(MarkCompactCollector) {
     Handle<String> obj_name = factory->InternalizeUtf8String("theObject");
     CHECK(Just(true) == JSReceiver::HasOwnProperty(global, obj_name));
     Handle<Object> object =
-        Object::GetProperty(global, obj_name).ToHandleChecked();
+        Object::GetProperty(isolate, global, obj_name).ToHandleChecked();
     CHECK(object->IsJSObject());
     Handle<String> prop_name = factory->InternalizeUtf8String("theSlot");
-    CHECK_EQ(*Object::GetProperty(object, prop_name).ToHandleChecked(),
+    CHECK_EQ(*Object::GetProperty(isolate, object, prop_name).ToHandleChecked(),
              Smi::FromInt(23));
   }
 }
diff --git a/deps/v8/test/cctest/heap/test-weak-references.cc b/deps/v8/test/cctest/heap/test-weak-references.cc
index 4b9da81c745ffb..979a28b1cd6ea0 100644
--- a/deps/v8/test/cctest/heap/test-weak-references.cc
+++ b/deps/v8/test/cctest/heap/test-weak-references.cc
@@ -454,24 +454,28 @@ TEST(WeakArrayListBasic) {
     Handle<FixedArray> index6 = factory->NewFixedArray(1);
     index6->set(0, Smi::FromInt(2019));
 
-    array = WeakArrayList::AddToEnd(array, MaybeObjectHandle::Weak(index0));
+    array = WeakArrayList::AddToEnd(isolate, array,
+                                    MaybeObjectHandle::Weak(index0));
     array = WeakArrayList::AddToEnd(
-        array, MaybeObjectHandle(Smi::FromInt(1), isolate));
+        isolate, array, MaybeObjectHandle(Smi::FromInt(1), isolate));
     CHECK_EQ(array->length(), 2);
 
-    array = WeakArrayList::AddToEnd(array, MaybeObjectHandle::Weak(index2));
+    array = WeakArrayList::AddToEnd(isolate, array,
+                                    MaybeObjectHandle::Weak(index2));
     array = WeakArrayList::AddToEnd(
-        array, MaybeObjectHandle(Smi::FromInt(3), isolate));
+        isolate, array, MaybeObjectHandle(Smi::FromInt(3), isolate));
     CHECK_EQ(array->length(), 4);
 
-    array = WeakArrayList::AddToEnd(array, MaybeObjectHandle::Weak(index4));
+    array = WeakArrayList::AddToEnd(isolate, array,
+                                    MaybeObjectHandle::Weak(index4));
     array = WeakArrayList::AddToEnd(
-        array, MaybeObjectHandle(Smi::FromInt(5), isolate));
+        isolate, array, MaybeObjectHandle(Smi::FromInt(5), isolate));
     CHECK_EQ(array->length(), 6);
 
-    array = WeakArrayList::AddToEnd(array, MaybeObjectHandle::Weak(index6));
+    array = WeakArrayList::AddToEnd(isolate, array,
+                                    MaybeObjectHandle::Weak(index6));
     array = WeakArrayList::AddToEnd(
-        array, MaybeObjectHandle(Smi::FromInt(7), isolate));
+        isolate, array, MaybeObjectHandle(Smi::FromInt(7), isolate));
     CHECK_EQ(array->length(), 8);
 
     CHECK(Heap::InNewSpace(*array));
@@ -574,6 +578,141 @@ TEST(Regress7768) {
   CcTest::CollectAllGarbage();
 }
 
+TEST(PrototypeUsersBasic) {
+  CcTest::InitializeVM();
+  LocalContext context;
+  Isolate* isolate = CcTest::i_isolate();
+  Factory* factory = isolate->factory();
+  Heap* heap = isolate->heap();
+  HandleScope outer_scope(isolate);
+
+  Handle<WeakArrayList> array(ReadOnlyRoots(heap).empty_weak_array_list(),
+                              isolate);
+
+  // Add some objects into the array.
+  int index = -1;
+  {
+    Handle<Map> map = factory->NewMap(JS_OBJECT_TYPE, JSObject::kHeaderSize);
+    array = PrototypeUsers::Add(isolate, array, map, &index);
+    CHECK_EQ(array->length(), index + 1);
+  }
+  CHECK_EQ(index, 1);
+
+  int empty_index = index;
+  PrototypeUsers::MarkSlotEmpty(*array, empty_index);
+
+  // Even though we have an empty slot, we still add to the end.
+  int last_index = index;
+  int old_capacity = array->capacity();
+  while (!array->IsFull()) {
+    Handle<Map> map = factory->NewMap(JS_OBJECT_TYPE, JSObject::kHeaderSize);
+    array = PrototypeUsers::Add(isolate, array, map, &index);
+    CHECK_EQ(index, last_index + 1);
+    CHECK_EQ(array->length(), index + 1);
+    last_index = index;
+  }
+
+  // The next addition will fill the empty slot.
+  {
+    Handle<Map> map = factory->NewMap(JS_OBJECT_TYPE, JSObject::kHeaderSize);
+    array = PrototypeUsers::Add(isolate, array, map, &index);
+  }
+  CHECK_EQ(index, empty_index);
+
+  // The next addition will make the arrow grow again.
+  {
+    Handle<Map> map = factory->NewMap(JS_OBJECT_TYPE, JSObject::kHeaderSize);
+    array = PrototypeUsers::Add(isolate, array, map, &index);
+    CHECK_EQ(array->length(), index + 1);
+    last_index = index;
+  }
+  CHECK_GT(array->capacity(), old_capacity);
+
+  // Make multiple slots empty.
+  int empty_index1 = 1;
+  int empty_index2 = 2;
+  PrototypeUsers::MarkSlotEmpty(*array, empty_index1);
+  PrototypeUsers::MarkSlotEmpty(*array, empty_index2);
+
+  // Fill the array (still adding to the end)
+  old_capacity = array->capacity();
+  while (!array->IsFull()) {
+    Handle<Map> map = factory->NewMap(JS_OBJECT_TYPE, JSObject::kHeaderSize);
+    array = PrototypeUsers::Add(isolate, array, map, &index);
+    CHECK_EQ(index, last_index + 1);
+    CHECK_EQ(array->length(), index + 1);
+    last_index = index;
+  }
+
+  // Make sure we use the empty slots in (reverse) order.
+  {
+    Handle<Map> map = factory->NewMap(JS_OBJECT_TYPE, JSObject::kHeaderSize);
+    array = PrototypeUsers::Add(isolate, array, map, &index);
+  }
+  CHECK_EQ(index, empty_index2);
+
+  {
+    Handle<Map> map = factory->NewMap(JS_OBJECT_TYPE, JSObject::kHeaderSize);
+    array = PrototypeUsers::Add(isolate, array, map, &index);
+  }
+  CHECK_EQ(index, empty_index1);
+}
+
+namespace {
+
+HeapObject* saved_heap_object = nullptr;
+
+static void TestCompactCallback(HeapObject* value, int old_index,
+                                int new_index) {
+  saved_heap_object = value;
+  CHECK_EQ(old_index, 2);
+  CHECK_EQ(new_index, 1);
+}
+
+}  // namespace
+
+TEST(PrototypeUsersCompacted) {
+  ManualGCScope manual_gc_scope;
+  CcTest::InitializeVM();
+  LocalContext context;
+  Isolate* isolate = CcTest::i_isolate();
+  Factory* factory = isolate->factory();
+  Heap* heap = isolate->heap();
+  HandleScope outer_scope(isolate);
+
+  Handle<WeakArrayList> array(ReadOnlyRoots(heap).empty_weak_array_list(),
+                              isolate);
+
+  // Add some objects into the array.
+  int index = -1;
+  Handle<Map> map_cleared_by_user =
+      factory->NewMap(JS_OBJECT_TYPE, JSObject::kHeaderSize);
+  array = PrototypeUsers::Add(isolate, array, map_cleared_by_user, &index);
+  CHECK_EQ(index, 1);
+  Handle<Map> live_map = factory->NewMap(JS_OBJECT_TYPE, JSObject::kHeaderSize);
+  array = PrototypeUsers::Add(isolate, array, live_map, &index);
+  CHECK_EQ(index, 2);
+  {
+    HandleScope inner_scope(isolate);
+    Handle<Map> soon_dead_map =
+        factory->NewMap(JS_OBJECT_TYPE, JSObject::kHeaderSize);
+    array = PrototypeUsers::Add(isolate, array, soon_dead_map, &index);
+    CHECK_EQ(index, 3);
+
+    array = inner_scope.CloseAndEscape(array);
+  }
+
+  PrototypeUsers::MarkSlotEmpty(*array, 1);
+  CcTest::CollectAllGarbage();
+  CHECK(array->Get(3)->IsClearedWeakHeapObject());
+
+  CHECK_EQ(array->length(), 3 + PrototypeUsers::kFirstIndex);
+  WeakArrayList* new_array =
+      PrototypeUsers::Compact(array, heap, TestCompactCallback);
+  CHECK_EQ(new_array->length(), 1 + PrototypeUsers::kFirstIndex);
+  CHECK_EQ(saved_heap_object, *live_map);
+}
+
 }  // namespace heap
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/test/cctest/interpreter/bytecode_expectations/AsyncGenerators.golden b/deps/v8/test/cctest/interpreter/bytecode_expectations/AsyncGenerators.golden
index d7109321c6d2a5..f3694e821f0a1b 100644
--- a/deps/v8/test/cctest/interpreter/bytecode_expectations/AsyncGenerators.golden
+++ b/deps/v8/test/cctest/interpreter/bytecode_expectations/AsyncGenerators.golden
@@ -362,7 +362,7 @@ bytecodes: [
                 B(TestTypeOf), U8(6),
                 B(JumpIfFalse), U8(4),
                 B(Jump), U8(18),
-                B(Wide), B(LdaSmi), I16(149),
+                B(Wide), B(LdaSmi), I16(150),
                 B(Star), R(18),
                 B(LdaConstant), U8(14),
                 B(Star), R(19),
diff --git a/deps/v8/test/cctest/interpreter/bytecode_expectations/ForAwaitOf.golden b/deps/v8/test/cctest/interpreter/bytecode_expectations/ForAwaitOf.golden
index e965d7a68901d8..b4598f2d4a861c 100644
--- a/deps/v8/test/cctest/interpreter/bytecode_expectations/ForAwaitOf.golden
+++ b/deps/v8/test/cctest/interpreter/bytecode_expectations/ForAwaitOf.golden
@@ -123,7 +123,7 @@ bytecodes: [
                 B(TestTypeOf), U8(6),
                 B(JumpIfFalse), U8(4),
                 B(Jump), U8(18),
-                B(Wide), B(LdaSmi), I16(149),
+                B(Wide), B(LdaSmi), I16(150),
                 B(Star), R(19),
                 B(LdaConstant), U8(11),
                 B(Star), R(20),
@@ -377,7 +377,7 @@ bytecodes: [
                 B(TestTypeOf), U8(6),
                 B(JumpIfFalse), U8(4),
                 B(Jump), U8(18),
-                B(Wide), B(LdaSmi), I16(149),
+                B(Wide), B(LdaSmi), I16(150),
                 B(Star), R(19),
                 B(LdaConstant), U8(11),
                 B(Star), R(20),
@@ -653,7 +653,7 @@ bytecodes: [
                 B(TestTypeOf), U8(6),
                 B(JumpIfFalse), U8(4),
                 B(Jump), U8(18),
-                B(Wide), B(LdaSmi), I16(149),
+                B(Wide), B(LdaSmi), I16(150),
                 B(Star), R(19),
                 B(LdaConstant), U8(11),
                 B(Star), R(20),
@@ -885,7 +885,7 @@ bytecodes: [
                 B(TestTypeOf), U8(6),
                 B(JumpIfFalse), U8(4),
                 B(Jump), U8(18),
-                B(Wide), B(LdaSmi), I16(149),
+                B(Wide), B(LdaSmi), I16(150),
                 B(Star), R(17),
                 B(LdaConstant), U8(9),
                 B(Star), R(18),
diff --git a/deps/v8/test/cctest/interpreter/bytecode_expectations/ForOf.golden b/deps/v8/test/cctest/interpreter/bytecode_expectations/ForOf.golden
index 5c603964c89feb..cee154cf6a2df9 100644
--- a/deps/v8/test/cctest/interpreter/bytecode_expectations/ForOf.golden
+++ b/deps/v8/test/cctest/interpreter/bytecode_expectations/ForOf.golden
@@ -85,7 +85,7 @@ bytecodes: [
                 B(TestTypeOf), U8(6),
                 B(JumpIfFalse), U8(4),
                 B(Jump), U8(18),
-                B(Wide), B(LdaSmi), I16(149),
+                B(Wide), B(LdaSmi), I16(150),
                 B(Star), R(12),
                 B(LdaConstant), U8(7),
                 B(Star), R(13),
@@ -217,7 +217,7 @@ bytecodes: [
                 B(TestTypeOf), U8(6),
                 B(JumpIfFalse), U8(4),
                 B(Jump), U8(18),
-                B(Wide), B(LdaSmi), I16(149),
+                B(Wide), B(LdaSmi), I16(150),
                 B(Star), R(13),
                 B(LdaConstant), U8(7),
                 B(Star), R(14),
@@ -361,7 +361,7 @@ bytecodes: [
                 B(TestTypeOf), U8(6),
                 B(JumpIfFalse), U8(4),
                 B(Jump), U8(18),
-                B(Wide), B(LdaSmi), I16(149),
+                B(Wide), B(LdaSmi), I16(150),
                 B(Star), R(12),
                 B(LdaConstant), U8(7),
                 B(Star), R(13),
@@ -495,7 +495,7 @@ bytecodes: [
                 B(TestTypeOf), U8(6),
                 B(JumpIfFalse), U8(4),
                 B(Jump), U8(18),
-                B(Wide), B(LdaSmi), I16(149),
+                B(Wide), B(LdaSmi), I16(150),
                 B(Star), R(11),
                 B(LdaConstant), U8(9),
                 B(Star), R(12),
diff --git a/deps/v8/test/cctest/interpreter/bytecode_expectations/ForOfLoop.golden b/deps/v8/test/cctest/interpreter/bytecode_expectations/ForOfLoop.golden
index 90fcb9065d5b16..7d5fd3e7f1474c 100644
--- a/deps/v8/test/cctest/interpreter/bytecode_expectations/ForOfLoop.golden
+++ b/deps/v8/test/cctest/interpreter/bytecode_expectations/ForOfLoop.golden
@@ -89,7 +89,7 @@ bytecodes: [
                 B(TestTypeOf), U8(6),
                 B(JumpIfFalse), U8(4),
                 B(Jump), U8(18),
-                B(Wide), B(LdaSmi), I16(149),
+                B(Wide), B(LdaSmi), I16(150),
                 B(Star), R(14),
                 B(LdaConstant), U8(6),
                 B(Star), R(15),
@@ -256,7 +256,7 @@ bytecodes: [
                 B(TestTypeOf), U8(6),
                 B(JumpIfFalse), U8(4),
                 B(Jump), U8(18),
-                B(Wide), B(LdaSmi), I16(149),
+                B(Wide), B(LdaSmi), I16(150),
                 B(Star), R(14),
                 B(LdaConstant), U8(11),
                 B(Star), R(15),
@@ -401,7 +401,7 @@ bytecodes: [
                 B(TestTypeOf), U8(6),
                 B(JumpIfFalse), U8(4),
                 B(Jump), U8(18),
-                B(Wide), B(LdaSmi), I16(149),
+                B(Wide), B(LdaSmi), I16(150),
                 B(Star), R(12),
                 B(LdaConstant), U8(8),
                 B(Star), R(13),
@@ -550,7 +550,7 @@ bytecodes: [
                 B(TestTypeOf), U8(6),
                 B(JumpIfFalse), U8(4),
                 B(Jump), U8(18),
-                B(Wide), B(LdaSmi), I16(149),
+                B(Wide), B(LdaSmi), I16(150),
                 B(Star), R(17),
                 B(LdaConstant), U8(8),
                 B(Star), R(18),
@@ -697,7 +697,7 @@ bytecodes: [
                 B(TestTypeOf), U8(6),
                 B(JumpIfFalse), U8(4),
                 B(Jump), U8(18),
-                B(Wide), B(LdaSmi), I16(149),
+                B(Wide), B(LdaSmi), I16(150),
                 B(Star), R(15),
                 B(LdaConstant), U8(9),
                 B(Star), R(16),
@@ -859,7 +859,7 @@ bytecodes: [
                 B(TestTypeOf), U8(6),
                 B(JumpIfFalse), U8(4),
                 B(Jump), U8(18),
-                B(Wide), B(LdaSmi), I16(149),
+                B(Wide), B(LdaSmi), I16(150),
                 B(Star), R(14),
                 B(LdaConstant), U8(12),
                 B(Star), R(15),
@@ -1007,7 +1007,7 @@ bytecodes: [
                 B(TestTypeOf), U8(6),
                 B(JumpIfFalse), U8(4),
                 B(Jump), U8(18),
-                B(Wide), B(LdaSmi), I16(149),
+                B(Wide), B(LdaSmi), I16(150),
                 B(Star), R(20),
                 B(LdaConstant), U8(6),
                 B(Star), R(21),
@@ -1218,7 +1218,7 @@ bytecodes: [
                 B(TestTypeOf), U8(6),
                 B(JumpIfFalse), U8(4),
                 B(Jump), U8(18),
-                B(Wide), B(LdaSmi), I16(149),
+                B(Wide), B(LdaSmi), I16(150),
                 B(Star), R(19),
                 B(LdaConstant), U8(7),
                 B(Star), R(20),
diff --git a/deps/v8/test/cctest/interpreter/bytecode_expectations/Generators.golden b/deps/v8/test/cctest/interpreter/bytecode_expectations/Generators.golden
index 54deec71989a54..99567940ee4fef 100644
--- a/deps/v8/test/cctest/interpreter/bytecode_expectations/Generators.golden
+++ b/deps/v8/test/cctest/interpreter/bytecode_expectations/Generators.golden
@@ -203,7 +203,7 @@ bytecodes: [
                 B(TestTypeOf), U8(6),
                 B(JumpIfFalse), U8(4),
                 B(Jump), U8(18),
-                B(Wide), B(LdaSmi), I16(149),
+                B(Wide), B(LdaSmi), I16(150),
                 B(Star), R(14),
                 B(LdaConstant), U8(13),
                 B(Star), R(15),
diff --git a/deps/v8/test/cctest/interpreter/test-interpreter.cc b/deps/v8/test/cctest/interpreter/test-interpreter.cc
index 156927cfec2b02..11163d96885025 100644
--- a/deps/v8/test/cctest/interpreter/test-interpreter.cc
+++ b/deps/v8/test/cctest/interpreter/test-interpreter.cc
@@ -1054,7 +1054,8 @@ TEST(InterpreterStoreGlobal) {
   callable().ToHandleChecked();
   Handle<i::String> name = factory->InternalizeUtf8String("global");
   Handle<i::Object> global_obj =
-      Object::GetProperty(isolate->global_object(), name).ToHandleChecked();
+      Object::GetProperty(isolate, isolate->global_object(), name)
+          .ToHandleChecked();
   CHECK_EQ(Smi::cast(*global_obj), Smi::FromInt(999));
 }
 
@@ -1109,7 +1110,8 @@ TEST(InterpreterStoreUnallocated) {
   callable().ToHandleChecked();
   Handle<i::String> name = factory->InternalizeUtf8String("unallocated");
   Handle<i::Object> global_obj =
-      Object::GetProperty(isolate->global_object(), name).ToHandleChecked();
+      Object::GetProperty(isolate, isolate->global_object(), name)
+          .ToHandleChecked();
   CHECK_EQ(Smi::cast(*global_obj), Smi::FromInt(999));
 }
 
diff --git a/deps/v8/test/cctest/parsing/test-scanner-streams.cc b/deps/v8/test/cctest/parsing/test-scanner-streams.cc
index 8021141052231c..6f9b58daf3d830 100644
--- a/deps/v8/test/cctest/parsing/test-scanner-streams.cc
+++ b/deps/v8/test/cctest/parsing/test-scanner-streams.cc
@@ -323,7 +323,7 @@ void TestCharacterStreams(const char* one_byte_source, unsigned length,
     // This avoids the GC from trying to free a stack allocated resource.
     if (uc16_string->IsExternalString())
       i::Handle<i::ExternalTwoByteString>::cast(uc16_string)
-          ->SetResource(nullptr);
+          ->set_resource(nullptr);
   }
 
   // 1-byte external string
@@ -343,7 +343,7 @@ void TestCharacterStreams(const char* one_byte_source, unsigned length,
     // This avoids the GC from trying to free a stack allocated resource.
     if (ext_one_byte_string->IsExternalString())
       i::Handle<i::ExternalOneByteString>::cast(ext_one_byte_string)
-          ->SetResource(nullptr);
+          ->set_resource(nullptr);
   }
 
   // 1-byte generic i::String
diff --git a/deps/v8/test/cctest/test-api-interceptors.cc b/deps/v8/test/cctest/test-api-interceptors.cc
index 2c7feb13418873..030db759fe95bf 100644
--- a/deps/v8/test/cctest/test-api-interceptors.cc
+++ b/deps/v8/test/cctest/test-api-interceptors.cc
@@ -4771,7 +4771,7 @@ TEST(NamedAllCanReadInterceptor) {
   ExpectInt32("checked.whatever", 17);
   CHECK(!CompileRun("Object.getOwnPropertyDescriptor(checked, 'whatever')")
              ->IsUndefined());
-  CHECK_EQ(6, access_check_data.count);
+  CHECK_EQ(5, access_check_data.count);
 
   access_check_data.result = false;
   ExpectInt32("checked.whatever", intercept_data_0.value);
@@ -4780,7 +4780,7 @@ TEST(NamedAllCanReadInterceptor) {
     CompileRun("Object.getOwnPropertyDescriptor(checked, 'whatever')");
     CHECK(try_catch.HasCaught());
   }
-  CHECK_EQ(9, access_check_data.count);
+  CHECK_EQ(8, access_check_data.count);
 
   intercept_data_1.should_intercept = true;
   ExpectInt32("checked.whatever", intercept_data_1.value);
@@ -4789,7 +4789,7 @@ TEST(NamedAllCanReadInterceptor) {
     CompileRun("Object.getOwnPropertyDescriptor(checked, 'whatever')");
     CHECK(try_catch.HasCaught());
   }
-  CHECK_EQ(12, access_check_data.count);
+  CHECK_EQ(11, access_check_data.count);
   g_access_check_data = nullptr;
 }
 
@@ -4858,7 +4858,7 @@ TEST(IndexedAllCanReadInterceptor) {
   ExpectInt32("checked[15]", 17);
   CHECK(!CompileRun("Object.getOwnPropertyDescriptor(checked, '15')")
              ->IsUndefined());
-  CHECK_EQ(6, access_check_data.count);
+  CHECK_EQ(5, access_check_data.count);
 
   access_check_data.result = false;
   ExpectInt32("checked[15]", intercept_data_0.value);
@@ -4867,7 +4867,7 @@ TEST(IndexedAllCanReadInterceptor) {
     CompileRun("Object.getOwnPropertyDescriptor(checked, '15')");
     CHECK(try_catch.HasCaught());
   }
-  CHECK_EQ(9, access_check_data.count);
+  CHECK_EQ(8, access_check_data.count);
 
   intercept_data_1.should_intercept = true;
   ExpectInt32("checked[15]", intercept_data_1.value);
@@ -4876,7 +4876,7 @@ TEST(IndexedAllCanReadInterceptor) {
     CompileRun("Object.getOwnPropertyDescriptor(checked, '15')");
     CHECK(try_catch.HasCaught());
   }
-  CHECK_EQ(12, access_check_data.count);
+  CHECK_EQ(11, access_check_data.count);
 
   g_access_check_data = nullptr;
 }
diff --git a/deps/v8/test/cctest/test-api.cc b/deps/v8/test/cctest/test-api.cc
index ea4c31e14db617..d5d1ae101b38c2 100644
--- a/deps/v8/test/cctest/test-api.cc
+++ b/deps/v8/test/cctest/test-api.cc
@@ -373,7 +373,7 @@ THREADED_TEST(HulIgennem) {
   v8::HandleScope scope(isolate);
   v8::Local<v8::Primitive> undef = v8::Undefined(isolate);
   Local<String> undef_str = undef->ToString(env.local()).ToLocalChecked();
-  char* value = i::NewArray<char>(undef_str->Utf8Length() + 1);
+  char* value = i::NewArray<char>(undef_str->Utf8Length(isolate) + 1);
   undef_str->WriteUtf8(value);
   CHECK_EQ(0, strcmp(value, "undefined"));
   i::DeleteArray(value);
@@ -2581,7 +2581,8 @@ THREADED_TEST(AccessorIsPreservedOnAttributeChange) {
   CHECK_EQ(0, a->map()->instance_descriptors()->number_of_descriptors());
   // But we should still have an AccessorInfo.
   i::Handle<i::String> name(v8::Utils::OpenHandle(*v8_str("length")));
-  i::LookupIterator it(a, name, i::LookupIterator::OWN_SKIP_INTERCEPTOR);
+  i::LookupIterator it(CcTest::i_isolate(), a, name,
+                       i::LookupIterator::OWN_SKIP_INTERCEPTOR);
   CHECK_EQ(i::LookupIterator::ACCESSOR, it.state());
   CHECK(it.GetAccessors()->IsAccessorInfo());
 }
@@ -8271,12 +8272,12 @@ static int StrNCmp16(uint16_t* a, uint16_t* b, int n) {
 }
 
 int GetUtf8Length(v8::Isolate* isolate, Local<String> str) {
-  int len = str->Utf8Length();
+  int len = str->Utf8Length(isolate);
   if (len < 0) {
     i::Isolate* i_isolate = reinterpret_cast<i::Isolate*>(isolate);
     i::Handle<i::String> istr(v8::Utils::OpenHandle(*str));
     i::String::Flatten(i_isolate, istr);
-    len = str->Utf8Length();
+    len = str->Utf8Length(isolate);
   }
   return len;
 }
@@ -15654,16 +15655,14 @@ static void MorphAString(i::String* string,
     string->set_map(roots.external_string_map());
     i::ExternalTwoByteString* morphed =
          i::ExternalTwoByteString::cast(string);
-    CcTest::heap()->UpdateExternalString(morphed, string->length(), 0);
-    morphed->SetResource(uc16_resource);
+    morphed->set_resource(uc16_resource);
   } else {
     // Check old map is not internalized or long.
     CHECK(string->map() == roots.external_string_map());
     // Morph external string to be one-byte string.
     string->set_map(roots.external_one_byte_string_map());
     i::ExternalOneByteString* morphed = i::ExternalOneByteString::cast(string);
-    CcTest::heap()->UpdateExternalString(morphed, string->length(), 0);
-    morphed->SetResource(one_byte_resource);
+    morphed->set_resource(one_byte_resource);
   }
 }
 
@@ -15678,7 +15677,8 @@ THREADED_TEST(MorphCompositeStringTest) {
   {
     LocalContext env;
     i::Factory* factory = CcTest::i_isolate()->factory();
-    v8::HandleScope scope(env->GetIsolate());
+    v8::Isolate* isolate = env->GetIsolate();
+    v8::HandleScope scope(isolate);
     OneByteVectorResource one_byte_resource(
         i::Vector<const char>(c_string, i::StrLength(c_string)));
     UC16VectorResource uc16_resource(
@@ -15710,7 +15710,7 @@ THREADED_TEST(MorphCompositeStringTest) {
     // This should UTF-8 without flattening, since everything is ASCII.
     Local<String> cons =
         v8_compile("cons")->Run(env.local()).ToLocalChecked().As<String>();
-    CHECK_EQ(128, cons->Utf8Length());
+    CHECK_EQ(128, cons->Utf8Length(isolate));
     int nchars = -1;
     CHECK_EQ(129, cons->WriteUtf8(utf_buffer, -1, &nchars));
     CHECK_EQ(128, nchars);
@@ -15751,13 +15751,13 @@ THREADED_TEST(MorphCompositeStringTest) {
 
     // This avoids the GC from trying to free a stack allocated resource.
     if (ilhs->IsExternalOneByteString())
-      i::ExternalOneByteString::cast(ilhs)->SetResource(nullptr);
+      i::ExternalOneByteString::cast(ilhs)->set_resource(nullptr);
     else
-      i::ExternalTwoByteString::cast(ilhs)->SetResource(nullptr);
+      i::ExternalTwoByteString::cast(ilhs)->set_resource(nullptr);
     if (irhs->IsExternalOneByteString())
-      i::ExternalOneByteString::cast(irhs)->SetResource(nullptr);
+      i::ExternalOneByteString::cast(irhs)->set_resource(nullptr);
     else
-      i::ExternalTwoByteString::cast(irhs)->SetResource(nullptr);
+      i::ExternalTwoByteString::cast(irhs)->set_resource(nullptr);
   }
   i::DeleteArray(two_byte_string);
 }
@@ -20377,7 +20377,7 @@ THREADED_TEST(TwoByteStringInOneByteCons) {
   CHECK_EQ(static_cast<int32_t>('e'),
            reresult->Int32Value(context.local()).FromJust());
   // This avoids the GC from trying to free stack allocated resources.
-  i::Handle<i::ExternalTwoByteString>::cast(flat_string)->SetResource(nullptr);
+  i::Handle<i::ExternalTwoByteString>::cast(flat_string)->set_resource(nullptr);
 }
 
 
diff --git a/deps/v8/test/cctest/test-array-list.cc b/deps/v8/test/cctest/test-array-list.cc
index 7235001409c76b..a8f2913de55d96 100644
--- a/deps/v8/test/cctest/test-array-list.cc
+++ b/deps/v8/test/cctest/test-array-list.cc
@@ -18,10 +18,10 @@ TEST(ArrayList) {
   Handle<ArrayList> array(
       ArrayList::cast(ReadOnlyRoots(isolate).empty_fixed_array()), isolate);
   CHECK_EQ(0, array->Length());
-  array = ArrayList::Add(array, handle(Smi::FromInt(100), isolate));
+  array = ArrayList::Add(isolate, array, handle(Smi::FromInt(100), isolate));
   CHECK_EQ(1, array->Length());
   CHECK_EQ(100, Smi::ToInt(array->Get(0)));
-  array = ArrayList::Add(array, handle(Smi::FromInt(200), isolate),
+  array = ArrayList::Add(isolate, array, handle(Smi::FromInt(200), isolate),
                          handle(Smi::FromInt(300), isolate));
   CHECK_EQ(3, array->Length());
   CHECK_EQ(100, Smi::ToInt(array->Get(0)));
diff --git a/deps/v8/test/cctest/test-code-stub-assembler.cc b/deps/v8/test/cctest/test-code-stub-assembler.cc
index fd47725dbe7c77..219850397e811c 100644
--- a/deps/v8/test/cctest/test-code-stub-assembler.cc
+++ b/deps/v8/test/cctest/test-code-stub-assembler.cc
@@ -325,15 +325,21 @@ TEST(JSFunction) {
 
 TEST(ComputeIntegerHash) {
   Isolate* isolate(CcTest::InitIsolateOnce());
-  const int kNumParams = 2;
+  const int kNumParams = 1;
   CodeAssemblerTester asm_tester(isolate, kNumParams);
   CodeStubAssembler m(asm_tester.state());
-  m.Return(m.SmiFromInt32(m.ComputeIntegerHash(m.SmiUntag(m.Parameter(0)),
-                                               m.SmiToInt32(m.Parameter(1)))));
 
-  FunctionTester ft(asm_tester.GenerateCode(), kNumParams);
+  TNode<Int32T> int32_seed;
+  if (m.Is64()) {
+    int32_seed = m.TruncateInt64ToInt32(m.HashSeed());
+  } else {
+    int32_seed = m.HashSeedLow();
+  }
 
-  Handle<Smi> hash_seed = isolate->factory()->hash_seed();
+  m.Return(m.SmiFromInt32(
+      m.ComputeIntegerHash(m.SmiUntag(m.Parameter(0)), int32_seed)));
+
+  FunctionTester ft(asm_tester.GenerateCode(), kNumParams);
 
   base::RandomNumberGenerator rand_gen(FLAG_random_seed);
 
@@ -341,9 +347,9 @@ TEST(ComputeIntegerHash) {
     int k = rand_gen.NextInt(Smi::kMaxValue);
 
     Handle<Smi> key(Smi::FromInt(k), isolate);
-    Handle<Object> result = ft.Call(key, hash_seed).ToHandleChecked();
+    Handle<Object> result = ft.Call(key).ToHandleChecked();
 
-    uint32_t hash = ComputeIntegerHash(k, hash_seed->value());
+    uint32_t hash = ComputeIntegerHash(k, isolate->heap()->HashSeed());
     Smi* expected = Smi::FromInt(hash & Smi::kMaxValue);
     CHECK_EQ(expected, Smi::cast(*result));
   }
@@ -680,11 +686,12 @@ void TestNameDictionaryLookup() {
 
   for (size_t i = 0; i < arraysize(keys); i++) {
     Handle<Object> value = factory->NewPropertyCell(keys[i]);
-    dictionary = Dictionary::Add(dictionary, keys[i], value, fake_details);
+    dictionary =
+        Dictionary::Add(isolate, dictionary, keys[i], value, fake_details);
   }
 
   for (size_t i = 0; i < arraysize(keys); i++) {
-    int entry = dictionary->FindEntry(keys[i]);
+    int entry = dictionary->FindEntry(isolate, keys[i]);
     int name_index =
         Dictionary::EntryToIndex(entry) + Dictionary::kEntryKeyIndex;
     CHECK_NE(Dictionary::kNotFound, entry);
@@ -706,7 +713,7 @@ void TestNameDictionaryLookup() {
   };
 
   for (size_t i = 0; i < arraysize(non_existing_keys); i++) {
-    int entry = dictionary->FindEntry(non_existing_keys[i]);
+    int entry = dictionary->FindEntry(isolate, non_existing_keys[i]);
     CHECK_EQ(Dictionary::kNotFound, entry);
 
     ft.CheckTrue(dictionary, non_existing_keys[i], expect_not_found);
@@ -776,15 +783,16 @@ TEST(NumberDictionaryLookup) {
   for (int i = 0; i < kKeysCount; i++) {
     int random_key = rand_gen.NextInt(Smi::kMaxValue);
     keys[i] = static_cast<uint32_t>(random_key);
-    if (dictionary->FindEntry(keys[i]) != NumberDictionary::kNotFound) continue;
+    if (dictionary->FindEntry(isolate, keys[i]) != NumberDictionary::kNotFound)
+      continue;
 
-    dictionary =
-        NumberDictionary::Add(dictionary, keys[i], fake_value, fake_details);
+    dictionary = NumberDictionary::Add(isolate, dictionary, keys[i], fake_value,
+                                       fake_details);
   }
 
   // Now try querying existing keys.
   for (int i = 0; i < kKeysCount; i++) {
-    int entry = dictionary->FindEntry(keys[i]);
+    int entry = dictionary->FindEntry(isolate, keys[i]);
     CHECK_NE(NumberDictionary::kNotFound, entry);
 
     Handle<Object> key(Smi::FromInt(keys[i]), isolate);
@@ -795,7 +803,7 @@ TEST(NumberDictionaryLookup) {
   // Now try querying random keys which do not exist in the dictionary.
   for (int i = 0; i < kKeysCount;) {
     int random_key = rand_gen.NextInt(Smi::kMaxValue);
-    int entry = dictionary->FindEntry(random_key);
+    int entry = dictionary->FindEntry(isolate, random_key);
     if (entry != NumberDictionary::kNotFound) continue;
     i++;
 
diff --git a/deps/v8/test/cctest/test-compiler.cc b/deps/v8/test/cctest/test-compiler.cc
index 34868cd4c4c6f7..4ced8639534285 100644
--- a/deps/v8/test/cctest/test-compiler.cc
+++ b/deps/v8/test/cctest/test-compiler.cc
@@ -66,8 +66,9 @@ static Handle<JSFunction> Compile(const char* source) {
       CStrVector(source)).ToHandleChecked();
   Handle<SharedFunctionInfo> shared =
       Compiler::GetSharedFunctionInfoForScript(
-          source_code, Compiler::ScriptDetails(), v8::ScriptOriginOptions(),
-          nullptr, nullptr, v8::ScriptCompiler::kNoCompileOptions,
+          isolate, source_code, Compiler::ScriptDetails(),
+          v8::ScriptOriginOptions(), nullptr, nullptr,
+          v8::ScriptCompiler::kNoCompileOptions,
           ScriptCompiler::kNoCacheNoReason, NOT_NATIVES_CODE)
           .ToHandleChecked();
   return isolate->factory()->NewFunctionFromSharedFunctionInfo(
diff --git a/deps/v8/test/cctest/test-dictionary.cc b/deps/v8/test/cctest/test-dictionary.cc
index 98206487a6a257..ce8dcf83733fe8 100644
--- a/deps/v8/test/cctest/test-dictionary.cc
+++ b/deps/v8/test/cctest/test-dictionary.cc
@@ -85,7 +85,7 @@ static void TestHashMap(Handle<HashMap> table) {
     Handle<JSObject> value = factory->NewJSArray(11);
     table = HashMap::Put(table, key, value);
     CHECK_EQ(table->NumberOfElements(), i + 1);
-    CHECK_NE(table->FindEntry(key), HashMap::kNotFound);
+    CHECK_NE(table->FindEntry(isolate, key), HashMap::kNotFound);
     CHECK_EQ(table->Lookup(key), *value);
     CHECK(key->GetIdentityHash(isolate)->IsSmi());
   }
@@ -95,7 +95,7 @@ static void TestHashMap(Handle<HashMap> table) {
   for (int i = 0; i < 100; i++) {
     Handle<JSReceiver> key = factory->NewJSArray(7);
     CHECK(key->GetOrCreateIdentityHash(isolate)->IsSmi());
-    CHECK_EQ(table->FindEntry(key), HashMap::kNotFound);
+    CHECK_EQ(table->FindEntry(isolate, key), HashMap::kNotFound);
     CHECK_EQ(table->Lookup(key), roots.the_hole_value());
     CHECK(key->GetIdentityHash(isolate)->IsSmi());
   }
@@ -195,7 +195,7 @@ class ObjectHashTableTest: public ObjectHashTable {
   }
 
   int lookup(int key) {
-    Handle<Object> key_obj(Smi::FromInt(key), GetIsolate());
+    Handle<Object> key_obj(Smi::FromInt(key), CcTest::i_isolate());
     return Smi::ToInt(Lookup(key_obj));
   }
 
diff --git a/deps/v8/test/cctest/test-field-type-tracking.cc b/deps/v8/test/cctest/test-field-type-tracking.cc
index 9968b18e456833..95b671b43a9088 100644
--- a/deps/v8/test/cctest/test-field-type-tracking.cc
+++ b/deps/v8/test/cctest/test-field-type-tracking.cc
@@ -11,6 +11,7 @@
 
 #include "src/compilation-cache.h"
 #include "src/compiler/compilation-dependencies.h"
+#include "src/compiler/js-heap-broker.h"
 #include "src/execution.h"
 #include "src/field-type.h"
 #include "src/global-handles.h"
@@ -558,7 +559,8 @@ TEST(ReconfigureAccessorToNonExistingDataFieldHeavy) {
   Handle<String> obj_name = factory->InternalizeUtf8String("o");
 
   Handle<Object> obj_value =
-      Object::GetProperty(isolate->global_object(), obj_name).ToHandleChecked();
+      Object::GetProperty(isolate, isolate->global_object(), obj_name)
+          .ToHandleChecked();
   CHECK(obj_value->IsJSObject());
   Handle<JSObject> obj = Handle<JSObject>::cast(obj_value);
 
@@ -607,6 +609,7 @@ static void TestGeneralizeField(int detach_property_at_index,
                                 bool expected_deprecation,
                                 bool expected_field_type_dependency) {
   Isolate* isolate = CcTest::i_isolate();
+  JSHeapBroker broker(isolate);
   Handle<FieldType> any_type = FieldType::Any(isolate);
 
   CHECK(detach_property_at_index >= -1 &&
@@ -652,11 +655,12 @@ static void TestGeneralizeField(int detach_property_at_index,
   }
 
   // Create new maps by generalizing representation of propX field.
-  Handle<Map> field_owner(map->FindFieldOwner(isolate, property_index),
-                          isolate);
+  CanonicalHandleScope canonical(isolate);
   CompilationDependencies dependencies(isolate, &zone);
-  dependencies.DependOnFieldType(map, property_index);
+  dependencies.DependOnFieldType(MapRef(&broker, map), property_index);
 
+  Handle<Map> field_owner(map->FindFieldOwner(isolate, property_index),
+                          isolate);
   Handle<Map> new_map = Map::ReconfigureProperty(
       isolate, map, property_index, kData, NONE, to.representation, to.type);
 
@@ -985,6 +989,7 @@ TEST(GeneralizeFieldWithAccessorProperties) {
 static void TestReconfigureDataFieldAttribute_GeneralizeField(
     const CRFTData& from, const CRFTData& to, const CRFTData& expected) {
   Isolate* isolate = CcTest::i_isolate();
+  JSHeapBroker broker(isolate);
 
   Expectations expectations(isolate);
 
@@ -1022,8 +1027,9 @@ static void TestReconfigureDataFieldAttribute_GeneralizeField(
   CHECK(expectations2.Check(*map2));
 
   Zone zone(isolate->allocator(), ZONE_NAME);
+  CanonicalHandleScope canonical(isolate);
   CompilationDependencies dependencies(isolate, &zone);
-  dependencies.DependOnFieldType(map, kSplitProp);
+  dependencies.DependOnFieldType(MapRef(&broker, map), kSplitProp);
 
   // Reconfigure attributes of property |kSplitProp| of |map2| to NONE, which
   // should generalize representations in |map1|.
@@ -1067,6 +1073,7 @@ static void TestReconfigureDataFieldAttribute_GeneralizeFieldTrivial(
     const CRFTData& from, const CRFTData& to, const CRFTData& expected,
     bool expected_field_type_dependency = true) {
   Isolate* isolate = CcTest::i_isolate();
+  JSHeapBroker broker(isolate);
 
   Expectations expectations(isolate);
 
@@ -1104,8 +1111,9 @@ static void TestReconfigureDataFieldAttribute_GeneralizeFieldTrivial(
   CHECK(expectations2.Check(*map2));
 
   Zone zone(isolate->allocator(), ZONE_NAME);
+  CanonicalHandleScope canonical(isolate);
   CompilationDependencies dependencies(isolate, &zone);
-  dependencies.DependOnFieldType(map, kSplitProp);
+  dependencies.DependOnFieldType(MapRef(&broker, map), kSplitProp);
 
   // Reconfigure attributes of property |kSplitProp| of |map2| to NONE, which
   // should generalize representations in |map1|.
@@ -1745,6 +1753,7 @@ TEST(ReconfigureDataFieldAttribute_AccConstantToDataFieldAfterTargetMap) {
 static void TestReconfigureElementsKind_GeneralizeField(
     const CRFTData& from, const CRFTData& to, const CRFTData& expected) {
   Isolate* isolate = CcTest::i_isolate();
+  JSHeapBroker broker(isolate);
 
   Expectations expectations(isolate, PACKED_SMI_ELEMENTS);
 
@@ -1783,8 +1792,9 @@ static void TestReconfigureElementsKind_GeneralizeField(
   CHECK(expectations2.Check(*map2));
 
   Zone zone(isolate->allocator(), ZONE_NAME);
+  CanonicalHandleScope canonical(isolate);
   CompilationDependencies dependencies(isolate, &zone);
-  dependencies.DependOnFieldType(map, kDiffProp);
+  dependencies.DependOnFieldType(MapRef(&broker, map), kDiffProp);
 
   // Reconfigure elements kinds of |map2|, which should generalize
   // representations in |map|.
@@ -1838,6 +1848,7 @@ static void TestReconfigureElementsKind_GeneralizeField(
 static void TestReconfigureElementsKind_GeneralizeFieldTrivial(
     const CRFTData& from, const CRFTData& to, const CRFTData& expected) {
   Isolate* isolate = CcTest::i_isolate();
+  JSHeapBroker broker(isolate);
 
   Expectations expectations(isolate, PACKED_SMI_ELEMENTS);
 
@@ -1876,8 +1887,9 @@ static void TestReconfigureElementsKind_GeneralizeFieldTrivial(
   CHECK(expectations2.Check(*map2));
 
   Zone zone(isolate->allocator(), ZONE_NAME);
+  CanonicalHandleScope canonical(isolate);
   CompilationDependencies dependencies(isolate, &zone);
-  dependencies.DependOnFieldType(map, kDiffProp);
+  dependencies.DependOnFieldType(MapRef(&broker, map), kDiffProp);
 
   // Reconfigure elements kinds of |map2|, which should generalize
   // representations in |map|.
diff --git a/deps/v8/test/cctest/test-inobject-slack-tracking.cc b/deps/v8/test/cctest/test-inobject-slack-tracking.cc
index eb7b30fd3a5941..9ebe67cab4bdcb 100644
--- a/deps/v8/test/cctest/test-inobject-slack-tracking.cc
+++ b/deps/v8/test/cctest/test-inobject-slack-tracking.cc
@@ -47,11 +47,12 @@ Handle<T> GetLexical(const char* name) {
       isolate->native_context()->script_context_table(), isolate);
 
   ScriptContextTable::LookupResult lookup_result;
-  if (ScriptContextTable::Lookup(script_contexts, str_name, &lookup_result)) {
-    Handle<Object> result =
-        FixedArray::get(*ScriptContextTable::GetContext(
-                            script_contexts, lookup_result.context_index),
-                        lookup_result.slot_index, isolate);
+  if (ScriptContextTable::Lookup(isolate, script_contexts, str_name,
+                                 &lookup_result)) {
+    Handle<Object> result = FixedArray::get(
+        *ScriptContextTable::GetContext(isolate, script_contexts,
+                                        lookup_result.context_index),
+        lookup_result.slot_index, isolate);
     return Handle<T>::cast(result);
   }
   return Handle<T>();
diff --git a/deps/v8/test/cctest/test-intl.cc b/deps/v8/test/cctest/test-intl.cc
index 7f7bcab5530cc7..950fbe3d303007 100644
--- a/deps/v8/test/cctest/test-intl.cc
+++ b/deps/v8/test/cctest/test-intl.cc
@@ -123,7 +123,7 @@ TEST(GetStringOption) {
   }
 
   Handle<String> key = isolate->factory()->NewStringFromAsciiChecked("foo");
-  v8::internal::LookupIterator it(options, key);
+  v8::internal::LookupIterator it(isolate, options, key);
   CHECK(Object::SetProperty(&it, Handle<Smi>(Smi::FromInt(42), isolate),
                             LanguageMode::kStrict,
                             AllocationMemento::MAY_BE_STORE_FROM_KEYED)
@@ -181,10 +181,11 @@ TEST(GetBoolOption) {
 
   Handle<String> key = isolate->factory()->NewStringFromAsciiChecked("foo");
   {
-    v8::internal::LookupIterator it(options, key);
+    v8::internal::LookupIterator it(isolate, options, key);
     Handle<Object> false_value =
         handle(i::ReadOnlyRoots(isolate).false_value(), isolate);
-    Object::SetProperty(options, key, false_value, LanguageMode::kStrict)
+    Object::SetProperty(isolate, options, key, false_value,
+                        LanguageMode::kStrict)
         .Assert();
     bool result = false;
     Maybe<bool> found =
@@ -194,10 +195,11 @@ TEST(GetBoolOption) {
   }
 
   {
-    v8::internal::LookupIterator it(options, key);
+    v8::internal::LookupIterator it(isolate, options, key);
     Handle<Object> true_value =
         handle(i::ReadOnlyRoots(isolate).true_value(), isolate);
-    Object::SetProperty(options, key, true_value, LanguageMode::kStrict)
+    Object::SetProperty(isolate, options, key, true_value,
+                        LanguageMode::kStrict)
         .Assert();
     bool result = false;
     Maybe<bool> found =
@@ -273,13 +275,15 @@ TEST(IsObjectOfType) {
   for (auto type : types) {
     Handle<Smi> tag =
         Handle<Smi>(Smi::FromInt(static_cast<int>(type)), isolate);
-    JSObject::SetProperty(obj, marker, tag, LanguageMode::kStrict).Assert();
+    JSObject::SetProperty(isolate, obj, marker, tag, LanguageMode::kStrict)
+        .Assert();
 
     CHECK(Intl::IsObjectOfType(isolate, obj, type));
   }
 
   Handle<Object> tag = isolate->factory()->NewStringFromAsciiChecked("foo");
-  JSObject::SetProperty(obj, marker, tag, LanguageMode::kStrict).Assert();
+  JSObject::SetProperty(isolate, obj, marker, tag, LanguageMode::kStrict)
+      .Assert();
   CHECK(!Intl::IsObjectOfType(isolate, obj, types[0]));
 
   CHECK(!Intl::IsObjectOfType(isolate, tag, types[0]));
@@ -288,7 +292,8 @@ TEST(IsObjectOfType) {
 
   // Proxy with target as an initialized object should fail.
   tag = Handle<Smi>(Smi::FromInt(static_cast<int>(types[0])), isolate);
-  JSObject::SetProperty(obj, marker, tag, LanguageMode::kStrict).Assert();
+  JSObject::SetProperty(isolate, obj, marker, tag, LanguageMode::kStrict)
+      .Assert();
   Handle<JSReceiver> proxy = isolate->factory()->NewJSProxy(
       obj, isolate->factory()->NewJSObjectWithNullProto());
   CHECK(!Intl::IsObjectOfType(isolate, proxy, types[0]));
diff --git a/deps/v8/test/cctest/test-log.cc b/deps/v8/test/cctest/test-log.cc
index 54ed85a68d7ca3..0b13a7e6607cc4 100644
--- a/deps/v8/test/cctest/test-log.cc
+++ b/deps/v8/test/cctest/test-log.cc
@@ -265,7 +265,7 @@ class ScopedLoggerInitializer {
 class TestCodeEventHandler : public v8::CodeEventHandler {
  public:
   explicit TestCodeEventHandler(v8::Isolate* isolate)
-      : v8::CodeEventHandler(isolate) {}
+      : v8::CodeEventHandler(isolate), isolate_(isolate) {}
 
   size_t CountLines(std::string prefix, std::string suffix = std::string()) {
     if (!log_.length()) return 0;
@@ -293,8 +293,9 @@ class TestCodeEventHandler : public v8::CodeEventHandler {
     std::string name = std::string(code_event->GetComment());
     if (name.empty()) {
       v8::Local<v8::String> functionName = code_event->GetFunctionName();
-      std::string buffer(functionName->Utf8Length() + 1, 0);
-      functionName->WriteUtf8(&buffer[0], functionName->Utf8Length() + 1);
+      std::string buffer(functionName->Utf8Length(isolate_) + 1, 0);
+      functionName->WriteUtf8(&buffer[0],
+                              functionName->Utf8Length(isolate_) + 1);
       // Sanitize name, removing unwanted \0 resulted from WriteUtf8
       name = std::string(buffer.c_str());
     }
@@ -303,6 +304,7 @@ class TestCodeEventHandler : public v8::CodeEventHandler {
   }
 
   std::string log_;
+  v8::Isolate* isolate_;
 };
 
 }  // namespace
@@ -533,7 +535,7 @@ TEST(Issue23768) {
       CcTest::i_isolate());
   // This situation can happen if source was an external string disposed
   // by its owner.
-  i_source->SetResource(nullptr);
+  i_source->set_resource(nullptr);
 
   // Must not crash.
   CcTest::i_isolate()->logger()->LogCompiledFunctions();
@@ -712,7 +714,7 @@ TEST(EquivalenceOfLoggingAndTraversal) {
     // The result either be the "true" literal or problem description.
     if (!result->IsTrue()) {
       v8::Local<v8::String> s = result->ToString(logger.env()).ToLocalChecked();
-      i::ScopedVector<char> data(s->Utf8Length() + 1);
+      i::ScopedVector<char> data(s->Utf8Length(isolate) + 1);
       CHECK(data.start());
       s->WriteUtf8(data.start());
       FATAL("%s\n", data.start());
@@ -744,8 +746,11 @@ TEST(LogVersion) {
 // https://crbug.com/539892
 // CodeCreateEvents with really large names should not crash.
 TEST(Issue539892) {
-  class : public i::CodeEventLogger {
+  class FakeCodeEventLogger : public i::CodeEventLogger {
    public:
+    explicit FakeCodeEventLogger(i::Isolate* isolate)
+        : CodeEventLogger(isolate) {}
+
     void CodeMoveEvent(i::AbstractCode* from, Address to) override {}
     void CodeDisableOptEvent(i::AbstractCode* code,
                              i::SharedFunctionInfo* shared) override {}
@@ -755,7 +760,7 @@ TEST(Issue539892) {
                            const char* name, int length) override {}
     void LogRecordedBuffer(const i::wasm::WasmCode* code, const char* name,
                            int length) override {}
-  } code_event_logger;
+  } code_event_logger(CcTest::i_isolate());
   SETUP_FLAGS();
   v8::Isolate::CreateParams create_params;
   create_params.array_buffer_allocator = CcTest::array_buffer_allocator();
diff --git a/deps/v8/test/cctest/test-parsing.cc b/deps/v8/test/cctest/test-parsing.cc
index 0e89d769e30304..b48cc493c796be 100644
--- a/deps/v8/test/cctest/test-parsing.cc
+++ b/deps/v8/test/cctest/test-parsing.cc
@@ -4227,6 +4227,39 @@ TEST(ImportExpressionErrors) {
     RunModuleParserSyncTest(context_data, data, kError, nullptr, 0, flags,
                             arraysize(flags));
   }
+
+  // Import statements as arrow function params and destructuring targets.
+  {
+    // clang-format off
+    const char* context_data[][2] = {
+      {"(", ") => {}"},
+      {"(a, ", ") => {}"},
+      {"(1, ", ") => {}"},
+      {"let f = ", " => {}"},
+      {"[", "] = [1];"},
+      {"{", "} = {'a': 1};"},
+      {nullptr, nullptr}
+    };
+
+    const char* data[] = {
+      "import(foo)",
+      "import(1)",
+      "import(y=x)",
+      "import(import(x))",
+      "import(x).then()",
+      nullptr
+    };
+
+    // clang-format on
+    RunParserSyncTest(context_data, data, kError);
+    RunModuleParserSyncTest(context_data, data, kError);
+
+    static const ParserFlag flags[] = {kAllowHarmonyDynamicImport};
+    RunParserSyncTest(context_data, data, kError, nullptr, 0, flags,
+                      arraysize(flags));
+    RunModuleParserSyncTest(context_data, data, kError, nullptr, 0, flags,
+                            arraysize(flags));
+  }
 }
 
 TEST(SuperCall) {
@@ -8133,6 +8166,8 @@ TEST(ImportMetaFailure) {
     {"({", "} = {1})"},
     {"var {", " = 1} = 1"},
     {"for (var ", " of [1]) {}"},
+    {"(", ") => {}"},
+    {"let f = ", " => {}"},
     {nullptr}
   };
 
diff --git a/deps/v8/test/cctest/test-serialize.cc b/deps/v8/test/cctest/test-serialize.cc
index c0e03230524cb3..2719855a82cbc5 100644
--- a/deps/v8/test/cctest/test-serialize.cc
+++ b/deps/v8/test/cctest/test-serialize.cc
@@ -381,7 +381,6 @@ UNINITIALIZED_TEST(StartupSerializerRootMapDependencies) {
     v8::internal::Handle<Map> map(
         ReadOnlyRoots(internal_isolate).one_byte_internalized_string_map(),
         internal_isolate);
-    Map::WeakCellForMap(internal_isolate, map);
     // Need to avoid DCHECKs inside SnapshotCreator.
     snapshot_creator.SetDefaultContext(v8::Context::New(isolate));
   }
@@ -1365,9 +1364,9 @@ static Handle<SharedFunctionInfo> CompileScript(
     Isolate* isolate, Handle<String> source, Handle<String> name,
     ScriptData* cached_data, v8::ScriptCompiler::CompileOptions options) {
   return Compiler::GetSharedFunctionInfoForScript(
-             source, Compiler::ScriptDetails(name), v8::ScriptOriginOptions(),
-             nullptr, cached_data, options, ScriptCompiler::kNoCacheNoReason,
-             NOT_NATIVES_CODE)
+             isolate, source, Compiler::ScriptDetails(name),
+             v8::ScriptOriginOptions(), nullptr, cached_data, options,
+             ScriptCompiler::kNoCacheNoReason, NOT_NATIVES_CODE)
       .ToHandleChecked();
 }
 
@@ -1376,9 +1375,9 @@ static Handle<SharedFunctionInfo> CompileScriptAndProduceCache(
     ScriptData** script_data, v8::ScriptCompiler::CompileOptions options) {
   Handle<SharedFunctionInfo> sfi =
       Compiler::GetSharedFunctionInfoForScript(
-          source, Compiler::ScriptDetails(name), v8::ScriptOriginOptions(),
-          nullptr, nullptr, options, ScriptCompiler::kNoCacheNoReason,
-          NOT_NATIVES_CODE)
+          isolate, source, Compiler::ScriptDetails(name),
+          v8::ScriptOriginOptions(), nullptr, nullptr, options,
+          ScriptCompiler::kNoCacheNoReason, NOT_NATIVES_CODE)
           .ToHandleChecked();
   std::unique_ptr<ScriptCompiler::CachedData> cached_data(
       ScriptCompiler::CreateCodeCache(ToApiHandle<UnboundScript>(sfi)));
@@ -1903,9 +1902,9 @@ TEST(CodeSerializerExternalString) {
 
   // This avoids the GC from trying to free stack allocated resources.
   i::Handle<i::ExternalOneByteString>::cast(one_byte_string)
-      ->SetResource(nullptr);
+      ->set_resource(nullptr);
   i::Handle<i::ExternalTwoByteString>::cast(two_byte_string)
-      ->SetResource(nullptr);
+      ->set_resource(nullptr);
   delete cache;
 }
 
@@ -1963,7 +1962,7 @@ TEST(CodeSerializerLargeExternalString) {
   CHECK_EQ(42.0, copy_result->Number());
 
   // This avoids the GC from trying to free stack allocated resources.
-  i::Handle<i::ExternalOneByteString>::cast(name)->SetResource(nullptr);
+  i::Handle<i::ExternalOneByteString>::cast(name)->set_resource(nullptr);
   delete cache;
   string.Dispose();
 }
@@ -2014,7 +2013,7 @@ TEST(CodeSerializerExternalScriptName) {
   CHECK_EQ(10.0, copy_result->Number());
 
   // This avoids the GC from trying to free stack allocated resources.
-  i::Handle<i::ExternalOneByteString>::cast(name)->SetResource(nullptr);
+  i::Handle<i::ExternalOneByteString>::cast(name)->set_resource(nullptr);
   delete cache;
 }
 
@@ -3467,7 +3466,8 @@ UNINITIALIZED_TEST(ReinitializeHashSeedNotRehashable) {
   v8::Isolate* isolate = v8::Isolate::New(create_params);
   {
     // Check that no rehashing has been performed.
-    CHECK_EQ(42, reinterpret_cast<i::Isolate*>(isolate)->heap()->HashSeed());
+    CHECK_EQ(static_cast<uint64_t>(42),
+             reinterpret_cast<i::Isolate*>(isolate)->heap()->HashSeed());
     v8::Isolate::Scope isolate_scope(isolate);
     v8::HandleScope handle_scope(isolate);
     v8::Local<v8::Context> context = v8::Context::New(isolate);
@@ -3529,7 +3529,8 @@ UNINITIALIZED_TEST(ReinitializeHashSeedRehashable) {
   v8::Isolate* isolate = v8::Isolate::New(create_params);
   {
     // Check that rehashing has been performed.
-    CHECK_EQ(1337, reinterpret_cast<i::Isolate*>(isolate)->heap()->HashSeed());
+    CHECK_EQ(static_cast<uint64_t>(1337),
+             reinterpret_cast<i::Isolate*>(isolate)->heap()->HashSeed());
     v8::Isolate::Scope isolate_scope(isolate);
     v8::HandleScope handle_scope(isolate);
     v8::Local<v8::Context> context = v8::Context::New(isolate);
diff --git a/deps/v8/test/cctest/test-strings.cc b/deps/v8/test/cctest/test-strings.cc
index 3243aabe433c34..322201b5e6ffc1 100644
--- a/deps/v8/test/cctest/test-strings.cc
+++ b/deps/v8/test/cctest/test-strings.cc
@@ -923,7 +923,7 @@ TEST(Utf8Conversion) {
                                     v8::NewStringType::kNormal,
                                     StrLength(one_byte_string))
                 .ToLocalChecked()
-                ->Utf8Length();
+                ->Utf8Length(CcTest::isolate());
   CHECK_EQ(StrLength(one_byte_string), len);
   // A mixed one-byte and two-byte string
   // U+02E4 -> CB A4
@@ -942,7 +942,7 @@ TEST(Utf8Conversion) {
       v8::String::NewFromTwoByte(CcTest::isolate(), mixed_string,
                                  v8::NewStringType::kNormal, 5)
           .ToLocalChecked();
-  CHECK_EQ(10, mixed->Utf8Length());
+  CHECK_EQ(10, mixed->Utf8Length(CcTest::isolate()));
   // Try encoding the string with all capacities
   char buffer[11];
   const char kNoChar = static_cast<char>(-1);
@@ -1245,7 +1245,7 @@ TEST(SliceFromExternal) {
   CHECK(SlicedString::cast(*slice)->parent()->IsExternalString());
   CHECK(slice->IsFlat());
   // This avoids the GC from trying to free stack allocated resources.
-  i::Handle<i::ExternalOneByteString>::cast(string)->SetResource(nullptr);
+  i::Handle<i::ExternalOneByteString>::cast(string)->set_resource(nullptr);
 }
 
 
@@ -1526,8 +1526,9 @@ TEST(FormatMessage) {
   Handle<String> arg1 = isolate->factory()->NewStringFromAsciiChecked("arg1");
   Handle<String> arg2 = isolate->factory()->NewStringFromAsciiChecked("arg2");
   Handle<String> result =
-      MessageTemplate::FormatMessage(MessageTemplate::kPropertyNotFunction,
-                                     arg0, arg1, arg2).ToHandleChecked();
+      MessageTemplate::FormatMessage(
+          isolate, MessageTemplate::kPropertyNotFunction, arg0, arg1, arg2)
+          .ToHandleChecked();
   Handle<String> expected = isolate->factory()->NewStringFromAsciiChecked(
       "'arg0' returned for property 'arg1' of object 'arg2' is not a function");
   CHECK(String::Equals(isolate, result, expected));
diff --git a/deps/v8/test/cctest/test-unboxed-doubles.cc b/deps/v8/test/cctest/test-unboxed-doubles.cc
index 12d16dd08c45d5..50e2fca53c44bb 100644
--- a/deps/v8/test/cctest/test-unboxed-doubles.cc
+++ b/deps/v8/test/cctest/test-unboxed-doubles.cc
@@ -124,7 +124,7 @@ static Handle<DescriptorArray> CreateDescriptorArray(Isolate* isolate,
       d = Descriptor::AccessorConstant(name, info, NONE);
 
     } else {
-      d = Descriptor::DataField(name, next_field_offset, NONE,
+      d = Descriptor::DataField(isolate, name, next_field_offset, NONE,
                                 representations[kind]);
     }
     descriptors->Append(&d);
@@ -192,7 +192,8 @@ TEST(LayoutDescriptorBasicSlow) {
 
     Handle<Map> map = Map::Create(isolate, kPropsCount);
 
-    layout_descriptor = LayoutDescriptor::New(map, descriptors, kPropsCount);
+    layout_descriptor =
+        LayoutDescriptor::New(isolate, map, descriptors, kPropsCount);
     CHECK_EQ(LayoutDescriptor::FastPointerLayout(), *layout_descriptor);
     CHECK_EQ(kBitsInSmiLayout, layout_descriptor->capacity());
     InitializeVerifiedMapDescriptors(*map, *descriptors, *layout_descriptor);
@@ -209,7 +210,8 @@ TEST(LayoutDescriptorBasicSlow) {
     Handle<Map> map = Map::Create(isolate, inobject_properties);
 
     // Should be fast as the only double property is the first one.
-    layout_descriptor = LayoutDescriptor::New(map, descriptors, kPropsCount);
+    layout_descriptor =
+        LayoutDescriptor::New(isolate, map, descriptors, kPropsCount);
     CHECK_NE(LayoutDescriptor::FastPointerLayout(), *layout_descriptor);
     CHECK(!layout_descriptor->IsSlowLayout());
     CHECK(!layout_descriptor->IsFastPointerLayout());
@@ -225,7 +227,8 @@ TEST(LayoutDescriptorBasicSlow) {
     int inobject_properties = kPropsCount;
     Handle<Map> map = Map::Create(isolate, inobject_properties);
 
-    layout_descriptor = LayoutDescriptor::New(map, descriptors, kPropsCount);
+    layout_descriptor =
+        LayoutDescriptor::New(isolate, map, descriptors, kPropsCount);
     CHECK_NE(LayoutDescriptor::FastPointerLayout(), *layout_descriptor);
     CHECK(layout_descriptor->IsSlowLayout());
     CHECK(!layout_descriptor->IsFastPointerLayout());
@@ -514,21 +517,24 @@ TEST(LayoutDescriptorCreateNewFast) {
 
   {
     Handle<Map> map = Map::Create(isolate, 0);
-    layout_descriptor = LayoutDescriptor::New(map, descriptors, kPropsCount);
+    layout_descriptor =
+        LayoutDescriptor::New(isolate, map, descriptors, kPropsCount);
     CHECK_EQ(LayoutDescriptor::FastPointerLayout(), *layout_descriptor);
     InitializeVerifiedMapDescriptors(*map, *descriptors, *layout_descriptor);
   }
 
   {
     Handle<Map> map = Map::Create(isolate, 1);
-    layout_descriptor = LayoutDescriptor::New(map, descriptors, kPropsCount);
+    layout_descriptor =
+        LayoutDescriptor::New(isolate, map, descriptors, kPropsCount);
     CHECK_EQ(LayoutDescriptor::FastPointerLayout(), *layout_descriptor);
     InitializeVerifiedMapDescriptors(*map, *descriptors, *layout_descriptor);
   }
 
   {
     Handle<Map> map = Map::Create(isolate, 2);
-    layout_descriptor = LayoutDescriptor::New(map, descriptors, kPropsCount);
+    layout_descriptor =
+        LayoutDescriptor::New(isolate, map, descriptors, kPropsCount);
     CHECK_NE(LayoutDescriptor::FastPointerLayout(), *layout_descriptor);
     CHECK(!layout_descriptor->IsSlowLayout());
     CHECK(layout_descriptor->IsTagged(0));
@@ -557,21 +563,24 @@ TEST(LayoutDescriptorCreateNewSlow) {
 
   {
     Handle<Map> map = Map::Create(isolate, 0);
-    layout_descriptor = LayoutDescriptor::New(map, descriptors, kPropsCount);
+    layout_descriptor =
+        LayoutDescriptor::New(isolate, map, descriptors, kPropsCount);
     CHECK_EQ(LayoutDescriptor::FastPointerLayout(), *layout_descriptor);
     InitializeVerifiedMapDescriptors(*map, *descriptors, *layout_descriptor);
   }
 
   {
     Handle<Map> map = Map::Create(isolate, 1);
-    layout_descriptor = LayoutDescriptor::New(map, descriptors, kPropsCount);
+    layout_descriptor =
+        LayoutDescriptor::New(isolate, map, descriptors, kPropsCount);
     CHECK_EQ(LayoutDescriptor::FastPointerLayout(), *layout_descriptor);
     InitializeVerifiedMapDescriptors(*map, *descriptors, *layout_descriptor);
   }
 
   {
     Handle<Map> map = Map::Create(isolate, 2);
-    layout_descriptor = LayoutDescriptor::New(map, descriptors, kPropsCount);
+    layout_descriptor =
+        LayoutDescriptor::New(isolate, map, descriptors, kPropsCount);
     CHECK_NE(LayoutDescriptor::FastPointerLayout(), *layout_descriptor);
     CHECK(!layout_descriptor->IsSlowLayout());
     CHECK(layout_descriptor->IsTagged(0));
@@ -584,7 +593,8 @@ TEST(LayoutDescriptorCreateNewSlow) {
   {
     int inobject_properties = kPropsCount / 2;
     Handle<Map> map = Map::Create(isolate, inobject_properties);
-    layout_descriptor = LayoutDescriptor::New(map, descriptors, kPropsCount);
+    layout_descriptor =
+        LayoutDescriptor::New(isolate, map, descriptors, kPropsCount);
     CHECK_NE(LayoutDescriptor::FastPointerLayout(), *layout_descriptor);
     CHECK(layout_descriptor->IsSlowLayout());
     for (int i = 0; i < inobject_properties; i++) {
@@ -600,7 +610,7 @@ TEST(LayoutDescriptorCreateNewSlow) {
 
     // Now test LayoutDescriptor::cast_gc_safe().
     Handle<LayoutDescriptor> layout_descriptor_copy =
-        LayoutDescriptor::New(map, descriptors, kPropsCount);
+        LayoutDescriptor::New(isolate, map, descriptors, kPropsCount);
 
     LayoutDescriptor* layout_desc = *layout_descriptor;
     CHECK_EQ(layout_desc, LayoutDescriptor::cast(layout_desc));
@@ -648,11 +658,11 @@ static Handle<LayoutDescriptor> TestLayoutDescriptorAppend(
       d = Descriptor::AccessorConstant(name, info, NONE);
 
     } else {
-      d = Descriptor::DataField(name, next_field_offset, NONE,
+      d = Descriptor::DataField(isolate, name, next_field_offset, NONE,
                                 representations[kind]);
     }
     PropertyDetails details = d.GetDetails();
-    layout_descriptor = LayoutDescriptor::ShareAppend(map, details);
+    layout_descriptor = LayoutDescriptor::ShareAppend(isolate, map, details);
     descriptors->Append(&d);
     if (details.location() == kField) {
       int field_width_in_words = details.field_width_in_words();
@@ -763,7 +773,7 @@ static Handle<LayoutDescriptor> TestLayoutDescriptorAppendIfFastOrUseFull(
   Handle<Map> initial_map = Map::Create(isolate, inobject_properties);
 
   Handle<LayoutDescriptor> full_layout_descriptor = LayoutDescriptor::New(
-      initial_map, descriptors, descriptors->number_of_descriptors());
+      isolate, initial_map, descriptors, descriptors->number_of_descriptors());
 
   int nof = 0;
   bool switched_to_slow_mode = false;
@@ -933,7 +943,7 @@ TEST(Regress436816) {
 
   Handle<Map> map = Map::Create(isolate, kPropsCount);
   Handle<LayoutDescriptor> layout_descriptor =
-      LayoutDescriptor::New(map, descriptors, kPropsCount);
+      LayoutDescriptor::New(isolate, map, descriptors, kPropsCount);
   map->InitializeDescriptors(*descriptors, *layout_descriptor);
 
   Handle<JSObject> object = factory->NewJSObjectFromMap(map, TENURED);
@@ -1215,7 +1225,7 @@ static void TestLayoutDescriptorHelper(Isolate* isolate,
   Handle<Map> map = Map::Create(isolate, inobject_properties);
 
   Handle<LayoutDescriptor> layout_descriptor = LayoutDescriptor::New(
-      map, descriptors, descriptors->number_of_descriptors());
+      isolate, map, descriptors, descriptors->number_of_descriptors());
   InitializeVerifiedMapDescriptors(*map, *descriptors, *layout_descriptor);
 
   LayoutDescriptorHelper helper(*map);
diff --git a/deps/v8/test/cctest/torque/test-torque.cc b/deps/v8/test/cctest/torque/test-torque.cc
index eb2e0c48cf5e33..11a683f85e6e08 100644
--- a/deps/v8/test/cctest/torque/test-torque.cc
+++ b/deps/v8/test/cctest/torque/test-torque.cc
@@ -200,6 +200,30 @@ TEST(TestHexLiteral) {
   ft.Call();
 }
 
+TEST(TestModuleConstBindings) {
+  Isolate* isolate(CcTest::InitIsolateOnce());
+  CodeAssemblerTester asm_tester(isolate, 0);
+  TestBuiltinsFromDSLAssembler m(asm_tester.state());
+  {
+    m.TestModuleConstBindings();
+    m.Return(m.UndefinedConstant());
+  }
+  FunctionTester ft(asm_tester.GenerateCode(), 0);
+  ft.Call();
+}
+
+TEST(TestLocalConstBindings) {
+  Isolate* isolate(CcTest::InitIsolateOnce());
+  CodeAssemblerTester asm_tester(isolate, 0);
+  TestBuiltinsFromDSLAssembler m(asm_tester.state());
+  {
+    m.TestLocalConstBindings();
+    m.Return(m.UndefinedConstant());
+  }
+  FunctionTester ft(asm_tester.GenerateCode(), 0);
+  ft.Call();
+}
+
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/test/cctest/wasm/test-run-wasm-simd.cc b/deps/v8/test/cctest/wasm/test-run-wasm-simd.cc
index dc1b95894d3a1f..271ce341fee978 100644
--- a/deps/v8/test/cctest/wasm/test-run-wasm-simd.cc
+++ b/deps/v8/test/cctest/wasm/test-run-wasm-simd.cc
@@ -3,6 +3,7 @@
 // found in the LICENSE file.
 
 #include "src/assembler-inl.h"
+#include "src/base/bits.h"
 #include "test/cctest/cctest.h"
 #include "test/cctest/compiler/value-helper.h"
 #include "test/cctest/wasm/wasm-run-utils.h"
@@ -1714,257 +1715,307 @@ void RunBinaryLaneOpTest(
 }
 
 WASM_SIMD_TEST(I32x4AddHoriz) {
+  // Inputs are [0 1 2 3] and [4 5 6 7].
   RunBinaryLaneOpTest<int32_t>(execution_mode, lower_simd, kExprI32x4AddHoriz,
                                {{1, 5, 9, 13}});
 }
 
 WASM_SIMD_TEST(I16x8AddHoriz) {
+  // Inputs are [0 1 2 3 4 5 6 7] and [8 9 10 11 12 13 14 15].
   RunBinaryLaneOpTest<int16_t>(execution_mode, lower_simd, kExprI16x8AddHoriz,
                                {{1, 5, 9, 13, 17, 21, 25, 29}});
 }
 
 WASM_SIMD_TEST(F32x4AddHoriz) {
+  // Inputs are [0.0f 1.0f 2.0f 3.0f] and [4.0f 5.0f 6.0f 7.0f].
   RunBinaryLaneOpTest<float>(execution_mode, lower_simd, kExprF32x4AddHoriz,
                              {{1.0f, 5.0f, 9.0f, 13.0f}});
 }
 
 // Test shuffle ops.
-template <typename T>
 void RunShuffleOpTest(WasmExecutionMode execution_mode, LowerSimd lower_simd,
                       WasmOpcode simd_op,
-                      const std::array<T, kSimd128Size / sizeof(T)>& shuffle) {
+                      const std::array<int8_t, kSimd128Size>& shuffle) {
   // Test the original shuffle.
-  RunBinaryLaneOpTest<T>(execution_mode, lower_simd, simd_op, shuffle);
+  RunBinaryLaneOpTest<int8_t>(execution_mode, lower_simd, simd_op, shuffle);
 
   // Test a non-canonical (inputs reversed) version of the shuffle.
-  std::array<T, kSimd128Size / sizeof(T)> other_shuffle(shuffle);
+  std::array<int8_t, kSimd128Size> other_shuffle(shuffle);
   for (size_t i = 0; i < shuffle.size(); ++i) other_shuffle[i] ^= kSimd128Size;
-  RunBinaryLaneOpTest<T>(execution_mode, lower_simd, simd_op, other_shuffle);
+  RunBinaryLaneOpTest<int8_t>(execution_mode, lower_simd, simd_op,
+                              other_shuffle);
 
   // Test the swizzle (one-operand) version of the shuffle.
-  std::array<T, kSimd128Size / sizeof(T)> swizzle(shuffle);
+  std::array<int8_t, kSimd128Size> swizzle(shuffle);
   for (size_t i = 0; i < shuffle.size(); ++i) swizzle[i] &= (kSimd128Size - 1);
-  RunBinaryLaneOpTest<T>(execution_mode, lower_simd, simd_op, swizzle);
+  RunBinaryLaneOpTest<int8_t>(execution_mode, lower_simd, simd_op, swizzle);
 
   // Test the non-canonical swizzle (one-operand) version of the shuffle.
-  std::array<T, kSimd128Size / sizeof(T)> other_swizzle(shuffle);
+  std::array<int8_t, kSimd128Size> other_swizzle(shuffle);
   for (size_t i = 0; i < shuffle.size(); ++i) other_swizzle[i] |= kSimd128Size;
-  RunBinaryLaneOpTest<T>(execution_mode, lower_simd, simd_op, other_swizzle);
+  RunBinaryLaneOpTest<int8_t>(execution_mode, lower_simd, simd_op,
+                              other_swizzle);
 }
 
 #if V8_TARGET_ARCH_ARM || V8_TARGET_ARCH_ARM64 || V8_TARGET_ARCH_MIPS || \
     V8_TARGET_ARCH_MIPS64 || V8_TARGET_ARCH_IA32
-// Test some regular shuffles that may have special handling on some targets.
-WASM_SIMD_TEST(S32x4Dup) {
-  RunShuffleOpTest<int8_t>(
-      execution_mode, lower_simd, kExprS8x16Shuffle,
-      {{16, 17, 18, 19, 16, 17, 18, 19, 16, 17, 18, 19, 16, 17, 18, 19}});
-}
-
-WASM_SIMD_TEST(S32x4ZipLeft) {
-  RunShuffleOpTest<int8_t>(
-      execution_mode, lower_simd, kExprS8x16Shuffle,
-      {{0, 1, 2, 3, 16, 17, 18, 19, 4, 5, 6, 7, 20, 21, 22, 23}});
-}
-
-WASM_SIMD_TEST(S32x4ZipRight) {
-  RunShuffleOpTest<int8_t>(
-      execution_mode, lower_simd, kExprS8x16Shuffle,
-      {{8, 9, 10, 11, 24, 25, 26, 27, 12, 13, 14, 15, 28, 29, 30, 31}});
-}
-
-WASM_SIMD_TEST(S32x4UnzipLeft) {
-  RunShuffleOpTest<int8_t>(
-      execution_mode, lower_simd, kExprS8x16Shuffle,
-      {{0, 1, 2, 3, 8, 9, 10, 11, 16, 17, 18, 19, 24, 25, 26, 27}});
-}
-
-WASM_SIMD_TEST(S32x4UnzipRight) {
-  RunShuffleOpTest<int8_t>(
-      execution_mode, lower_simd, kExprS8x16Shuffle,
-      {{4, 5, 6, 7, 12, 13, 14, 15, 20, 21, 22, 23, 28, 29, 30, 31}});
-}
-
-WASM_SIMD_TEST(S32x4TransposeLeft) {
-  RunShuffleOpTest<int8_t>(
-      execution_mode, lower_simd, kExprS8x16Shuffle,
-      {{0, 1, 2, 3, 16, 17, 18, 19, 8, 9, 10, 11, 24, 25, 26, 27}});
-}
-
-WASM_SIMD_TEST(S32x4TransposeRight) {
-  RunShuffleOpTest<int8_t>(
-      execution_mode, lower_simd, kExprS8x16Shuffle,
-      {{4, 5, 6, 7, 20, 21, 22, 23, 12, 13, 14, 15, 28, 29, 30, 31}});
-}
-
-// Reverses are only unary.
-WASM_SIMD_TEST(S32x2Reverse) {
-  RunShuffleOpTest<int8_t>(
-      execution_mode, lower_simd, kExprS8x16Shuffle,
-      {{4, 5, 6, 7, 0, 1, 2, 3, 12, 13, 14, 15, 8, 9, 10, 11}});
-}
-
-// Test irregular shuffle.
-WASM_SIMD_TEST(S32x4Irregular) {
-  RunShuffleOpTest<int8_t>(
-      execution_mode, lower_simd, kExprS8x16Shuffle,
-      {{0, 1, 2, 3, 16, 17, 18, 19, 16, 17, 18, 19, 20, 21, 22, 23}});
-}
-
-WASM_SIMD_TEST(S16x8Dup) {
-  RunShuffleOpTest<int8_t>(
-      execution_mode, lower_simd, kExprS8x16Shuffle,
-      {{18, 19, 18, 19, 18, 19, 18, 19, 18, 19, 18, 19, 18, 19, 18, 19}});
-}
-
-WASM_SIMD_TEST(S16x8ZipLeft) {
-  RunShuffleOpTest<int8_t>(
-      execution_mode, lower_simd, kExprS8x16Shuffle,
-      {{0, 1, 16, 17, 2, 3, 18, 19, 4, 5, 20, 21, 6, 7, 22, 23}});
-}
-
-WASM_SIMD_TEST(S16x8ZipRight) {
-  RunShuffleOpTest<int8_t>(
-      execution_mode, lower_simd, kExprS8x16Shuffle,
-      {{8, 9, 24, 25, 10, 11, 26, 27, 12, 13, 28, 29, 14, 15, 30, 31}});
-}
-
-WASM_SIMD_TEST(S16x8UnzipLeft) {
-  RunShuffleOpTest<int8_t>(
-      execution_mode, lower_simd, kExprS8x16Shuffle,
-      {{0, 1, 4, 5, 8, 9, 12, 13, 16, 17, 20, 21, 24, 25, 28, 29}});
-}
-
-WASM_SIMD_TEST(S16x8UnzipRight) {
-  RunShuffleOpTest<int8_t>(
-      execution_mode, lower_simd, kExprS8x16Shuffle,
-      {{2, 3, 6, 7, 10, 11, 14, 15, 18, 19, 22, 23, 26, 27, 30, 31}});
-}
-
-WASM_SIMD_TEST(S16x8TransposeLeft) {
-  RunShuffleOpTest<int8_t>(
-      execution_mode, lower_simd, kExprS8x16Shuffle,
-      {{0, 1, 16, 17, 4, 5, 20, 21, 8, 9, 24, 25, 12, 13, 28, 29}});
-}
-
-WASM_SIMD_TEST(S16x8TransposeRight) {
-  RunShuffleOpTest<int8_t>(
-      execution_mode, lower_simd, kExprS8x16Shuffle,
-      {{2, 3, 18, 19, 6, 7, 22, 23, 10, 11, 26, 27, 14, 15, 30, 31}});
-}
-
-// TODO(simd) 'Reverse' tests should be 2-operand shuffles, not swizzles.
-WASM_SIMD_TEST(S16x4Reverse) {
-  RunShuffleOpTest<int8_t>(
-      execution_mode, lower_simd, kExprS8x16Shuffle,
-      {{6, 7, 4, 5, 2, 3, 0, 1, 14, 15, 12, 13, 10, 11, 8, 9}});
-}
-
-WASM_SIMD_TEST(S16x2Reverse) {
-  RunShuffleOpTest<int8_t>(
-      execution_mode, lower_simd, kExprS8x16Shuffle,
-      {{2, 3, 0, 1, 6, 7, 4, 5, 10, 11, 8, 9, 14, 15, 12, 13}});
-}
-
-WASM_SIMD_TEST(S16x8Irregular) {
-  RunShuffleOpTest<int8_t>(
-      execution_mode, lower_simd, kExprS8x16Shuffle,
-      {{0, 1, 16, 17, 16, 17, 0, 1, 4, 5, 20, 21, 6, 7, 22, 23}});
-}
-
-WASM_SIMD_TEST(S8x16Dup) {
-  RunShuffleOpTest<int8_t>(
-      execution_mode, lower_simd, kExprS8x16Shuffle,
-      {{19, 19, 19, 19, 19, 19, 19, 19, 19, 19, 19, 19, 19, 19, 19, 19}});
-}
-
-WASM_SIMD_TEST(S8x16ZipLeft) {
-  RunShuffleOpTest<int8_t>(
-      execution_mode, lower_simd, kExprS8x16Shuffle,
-      {{0, 16, 1, 17, 2, 18, 3, 19, 4, 20, 5, 21, 6, 22, 7, 23}});
-}
-
-WASM_SIMD_TEST(S8x16ZipRight) {
-  RunShuffleOpTest<int8_t>(
-      execution_mode, lower_simd, kExprS8x16Shuffle,
-      {{8, 24, 9, 25, 10, 26, 11, 27, 12, 28, 13, 29, 14, 30, 15, 31}});
-}
+#define SHUFFLE_LIST(V)  \
+  V(S128Identity)        \
+  V(S32x4Dup)            \
+  V(S32x4ZipLeft)        \
+  V(S32x4ZipRight)       \
+  V(S32x4UnzipLeft)      \
+  V(S32x4UnzipRight)     \
+  V(S32x4TransposeLeft)  \
+  V(S32x4TransposeRight) \
+  V(S32x2Reverse)        \
+  V(S32x4Irregular)      \
+  V(S16x8Dup)            \
+  V(S16x8ZipLeft)        \
+  V(S16x8ZipRight)       \
+  V(S16x8UnzipLeft)      \
+  V(S16x8UnzipRight)     \
+  V(S16x8TransposeLeft)  \
+  V(S16x8TransposeRight) \
+  V(S16x4Reverse)        \
+  V(S16x2Reverse)        \
+  V(S16x8Irregular)      \
+  V(S8x16Dup)            \
+  V(S8x16ZipLeft)        \
+  V(S8x16ZipRight)       \
+  V(S8x16UnzipLeft)      \
+  V(S8x16UnzipRight)     \
+  V(S8x16TransposeLeft)  \
+  V(S8x16TransposeRight) \
+  V(S8x8Reverse)         \
+  V(S8x4Reverse)         \
+  V(S8x2Reverse)         \
+  V(S8x16Irregular)
+
+enum ShuffleKey {
+#define SHUFFLE_ENUM_VALUE(Name) k##Name,
+  SHUFFLE_LIST(SHUFFLE_ENUM_VALUE)
+#undef SHUFFLE_ENUM_VALUE
+      kNumShuffleKeys
+};
+
+using Shuffle = std::array<int8_t, kSimd128Size>;
+using ShuffleMap = std::map<ShuffleKey, const Shuffle>;
+
+ShuffleMap test_shuffles = {
+    {kS128Identity,
+     {{16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31}}},
+    {kS32x4Dup,
+     {{16, 17, 18, 19, 16, 17, 18, 19, 16, 17, 18, 19, 16, 17, 18, 19}}},
+    {kS32x4ZipLeft, {{0, 1, 2, 3, 16, 17, 18, 19, 4, 5, 6, 7, 20, 21, 22, 23}}},
+    {kS32x4ZipRight,
+     {{8, 9, 10, 11, 24, 25, 26, 27, 12, 13, 14, 15, 28, 29, 30, 31}}},
+    {kS32x4UnzipLeft,
+     {{0, 1, 2, 3, 8, 9, 10, 11, 16, 17, 18, 19, 24, 25, 26, 27}}},
+    {kS32x4UnzipRight,
+     {{4, 5, 6, 7, 12, 13, 14, 15, 20, 21, 22, 23, 28, 29, 30, 31}}},
+    {kS32x4TransposeLeft,
+     {{0, 1, 2, 3, 16, 17, 18, 19, 8, 9, 10, 11, 24, 25, 26, 27}}},
+    {kS32x4TransposeRight,
+     {{4, 5, 6, 7, 20, 21, 22, 23, 12, 13, 14, 15, 28, 29, 30, 31}}},
+    {kS32x2Reverse,  // swizzle only
+     {{4, 5, 6, 7, 0, 1, 2, 3, 12, 13, 14, 15, 8, 9, 10, 11}}},
+    {kS32x4Irregular,
+     {{0, 1, 2, 3, 16, 17, 18, 19, 16, 17, 18, 19, 20, 21, 22, 23}}},
+    {kS16x8Dup,
+     {{18, 19, 18, 19, 18, 19, 18, 19, 18, 19, 18, 19, 18, 19, 18, 19}}},
+    {kS16x8ZipLeft, {{0, 1, 16, 17, 2, 3, 18, 19, 4, 5, 20, 21, 6, 7, 22, 23}}},
+    {kS16x8ZipRight,
+     {{8, 9, 24, 25, 10, 11, 26, 27, 12, 13, 28, 29, 14, 15, 30, 31}}},
+    {kS16x8UnzipLeft,
+     {{0, 1, 4, 5, 8, 9, 12, 13, 16, 17, 20, 21, 24, 25, 28, 29}}},
+    {kS16x8UnzipRight,
+     {{2, 3, 6, 7, 10, 11, 14, 15, 18, 19, 22, 23, 26, 27, 30, 31}}},
+    {kS16x8TransposeLeft,
+     {{0, 1, 16, 17, 4, 5, 20, 21, 8, 9, 24, 25, 12, 13, 28, 29}}},
+    {kS16x8TransposeRight,
+     {{2, 3, 18, 19, 6, 7, 22, 23, 10, 11, 26, 27, 14, 15, 30, 31}}},
+    {kS16x4Reverse,  // swizzle only
+     {{6, 7, 4, 5, 2, 3, 0, 1, 14, 15, 12, 13, 10, 11, 8, 9}}},
+    {kS16x2Reverse,  // swizzle only
+     {{2, 3, 0, 1, 6, 7, 4, 5, 10, 11, 8, 9, 14, 15, 12, 13}}},
+    {kS16x8Irregular,
+     {{0, 1, 16, 17, 16, 17, 0, 1, 4, 5, 20, 21, 6, 7, 22, 23}}},
+    {kS8x16Dup,
+     {{19, 19, 19, 19, 19, 19, 19, 19, 19, 19, 19, 19, 19, 19, 19, 19}}},
+    {kS8x16ZipLeft, {{0, 16, 1, 17, 2, 18, 3, 19, 4, 20, 5, 21, 6, 22, 7, 23}}},
+    {kS8x16ZipRight,
+     {{8, 24, 9, 25, 10, 26, 11, 27, 12, 28, 13, 29, 14, 30, 15, 31}}},
+    {kS8x16UnzipLeft,
+     {{0, 2, 4, 6, 8, 10, 12, 14, 16, 18, 20, 22, 24, 26, 28, 30}}},
+    {kS8x16UnzipRight,
+     {{1, 3, 5, 7, 9, 11, 13, 15, 17, 19, 21, 23, 25, 27, 29, 31}}},
+    {kS8x16TransposeLeft,
+     {{0, 16, 2, 18, 4, 20, 6, 22, 8, 24, 10, 26, 12, 28, 14, 30}}},
+    {kS8x16TransposeRight,
+     {{1, 17, 3, 19, 5, 21, 7, 23, 9, 25, 11, 27, 13, 29, 15, 31}}},
+    {kS8x8Reverse,  // swizzle only
+     {{7, 6, 5, 4, 3, 2, 1, 0, 15, 14, 13, 12, 11, 10, 9, 8}}},
+    {kS8x4Reverse,  // swizzle only
+     {{3, 2, 1, 0, 7, 6, 5, 4, 11, 10, 9, 8, 15, 14, 13, 12}}},
+    {kS8x2Reverse,  // swizzle only
+     {{1, 0, 3, 2, 5, 4, 7, 6, 9, 8, 11, 10, 13, 12, 15, 14}}},
+    {kS8x16Irregular,
+     {{0, 16, 0, 16, 2, 18, 3, 19, 4, 20, 5, 21, 6, 22, 7, 23}}},
+};
+
+#define SHUFFLE_TEST(Name)                                          \
+  WASM_SIMD_TEST(Name) {                                            \
+    ShuffleMap::const_iterator it = test_shuffles.find(k##Name);    \
+    DCHECK_NE(it, test_shuffles.end());                             \
+    RunShuffleOpTest(execution_mode, lower_simd, kExprS8x16Shuffle, \
+                     it->second);                                   \
+  }
+SHUFFLE_LIST(SHUFFLE_TEST)
+#undef SHUFFLE_TEST
+#undef SHUFFLE_LIST
 
-WASM_SIMD_TEST(S8x16UnzipLeft) {
-  RunShuffleOpTest<int8_t>(
-      execution_mode, lower_simd, kExprS8x16Shuffle,
-      {{0, 2, 4, 6, 8, 10, 12, 14, 16, 18, 20, 22, 24, 26, 28, 30}});
+// Test shuffles that blend the two vectors (elements remain in their lanes.)
+WASM_SIMD_TEST(S8x16Blend) {
+  std::array<int8_t, kSimd128Size> expected;
+  for (int bias = 1; bias < kSimd128Size; bias++) {
+    for (int i = 0; i < bias; i++) expected[i] = i;
+    for (int i = bias; i < kSimd128Size; i++) expected[i] = i + kSimd128Size;
+    RunShuffleOpTest(execution_mode, lower_simd, kExprS8x16Shuffle, expected);
+  }
 }
 
-WASM_SIMD_TEST(S8x16UnzipRight) {
-  RunShuffleOpTest<int8_t>(
-      execution_mode, lower_simd, kExprS8x16Shuffle,
-      {{1, 3, 5, 7, 9, 11, 13, 15, 17, 19, 21, 23, 25, 27, 29, 31}});
+// Test shuffles that concatenate the two vectors.
+WASM_SIMD_TEST(S8x16Concat) {
+  std::array<int8_t, kSimd128Size> expected;
+  // n is offset or bias of concatenation.
+  for (int n = 1; n < kSimd128Size; ++n) {
+    int i = 0;
+    // last kLanes - n bytes of first vector.
+    for (int j = n; j < kSimd128Size; ++j) {
+      expected[i++] = j;
+    }
+    // first n bytes of second vector
+    for (int j = 0; j < n; ++j) {
+      expected[i++] = j + kSimd128Size;
+    }
+    RunShuffleOpTest(execution_mode, lower_simd, kExprS8x16Shuffle, expected);
+  }
 }
 
-WASM_SIMD_TEST(S8x16TransposeLeft) {
-  RunShuffleOpTest<int8_t>(
-      execution_mode, lower_simd, kExprS8x16Shuffle,
-      {{0, 16, 2, 18, 4, 20, 6, 22, 8, 24, 10, 26, 12, 28, 14, 30}});
+// Combine 3 shuffles a, b, and c by applying both a and b and then applying c
+// to those two results.
+Shuffle Combine(const Shuffle& a, const Shuffle& b, const Shuffle& c) {
+  Shuffle result;
+  for (int i = 0; i < kSimd128Size; ++i) {
+    result[i] = c[i] < kSimd128Size ? a[c[i]] : b[c[i] - kSimd128Size];
+  }
+  return result;
 }
 
-WASM_SIMD_TEST(S8x16TransposeRight) {
-  RunShuffleOpTest<int8_t>(
-      execution_mode, lower_simd, kExprS8x16Shuffle,
-      {{1, 17, 3, 19, 5, 21, 7, 23, 9, 25, 11, 27, 13, 29, 15, 31}});
+const Shuffle& GetRandomTestShuffle(v8::base::RandomNumberGenerator* rng) {
+  return test_shuffles[static_cast<ShuffleKey>(rng->NextInt(kNumShuffleKeys))];
 }
 
-WASM_SIMD_TEST(S8x8Reverse) {
-  RunShuffleOpTest<int8_t>(
-      execution_mode, lower_simd, kExprS8x16Shuffle,
-      {{7, 6, 5, 4, 3, 2, 1, 0, 15, 14, 13, 12, 11, 10, 9, 8}});
+// Test shuffles that are random combinations of 3 test shuffles. Completely
+// random shuffles almost always generate the slow general shuffle code, so
+// don't exercise as many code paths.
+WASM_SIMD_TEST(S8x16ShuffleFuzz) {
+  v8::base::RandomNumberGenerator* rng = CcTest::random_number_generator();
+  static const int kTests = 100;
+  for (int i = 0; i < kTests; ++i) {
+    auto shuffle = Combine(GetRandomTestShuffle(rng), GetRandomTestShuffle(rng),
+                           GetRandomTestShuffle(rng));
+    RunShuffleOpTest(execution_mode, lower_simd, kExprS8x16Shuffle, shuffle);
+  }
 }
 
-WASM_SIMD_TEST(S8x4Reverse) {
-  RunShuffleOpTest<int8_t>(
-      execution_mode, lower_simd, kExprS8x16Shuffle,
-      {{3, 2, 1, 0, 7, 6, 5, 4, 11, 10, 9, 8, 15, 14, 13, 12}});
+void AppendShuffle(const Shuffle& shuffle, std::vector<byte>* buffer) {
+  byte opcode[] = {WASM_SIMD_OP(kExprS8x16Shuffle)};
+  for (size_t i = 0; i < arraysize(opcode); ++i) buffer->push_back(opcode[i]);
+  for (size_t i = 0; i < kSimd128Size; ++i) buffer->push_back((shuffle[i]));
 }
 
-WASM_SIMD_TEST(S8x2Reverse) {
-  RunShuffleOpTest<int8_t>(
-      execution_mode, lower_simd, kExprS8x16Shuffle,
-      {{1, 0, 3, 2, 5, 4, 7, 6, 9, 8, 11, 10, 13, 12, 15, 14}});
+void BuildShuffle(std::vector<Shuffle>& shuffles, std::vector<byte>* buffer) {
+  // Perform the leaf shuffles on globals 0 and 1.
+  size_t row_index = (shuffles.size() - 1) / 2;
+  for (size_t i = row_index; i < shuffles.size(); ++i) {
+    byte operands[] = {WASM_GET_GLOBAL(0), WASM_GET_GLOBAL(1)};
+    for (size_t j = 0; j < arraysize(operands); ++j)
+      buffer->push_back(operands[j]);
+    AppendShuffle(shuffles[i], buffer);
+  }
+  // Now perform inner shuffles in the correct order on operands on the stack.
+  do {
+    for (size_t i = row_index / 2; i < row_index; ++i) {
+      AppendShuffle(shuffles[i], buffer);
+    }
+    row_index /= 2;
+  } while (row_index != 0);
+  byte epilog[] = {kExprSetGlobal, static_cast<byte>(0), WASM_ONE};
+  for (size_t j = 0; j < arraysize(epilog); ++j) buffer->push_back(epilog[j]);
 }
 
-WASM_SIMD_TEST(S8x16Irregular) {
-  RunShuffleOpTest<int8_t>(
-      execution_mode, lower_simd, kExprS8x16Shuffle,
-      {{0, 16, 0, 16, 2, 18, 3, 19, 4, 20, 5, 21, 6, 22, 7, 23}});
-}
+// Runs tests of compiled code, using the interpreter as a reference.
+#define WASM_SIMD_COMPILED_TEST(name)                           \
+  void RunWasm_##name##_Impl(LowerSimd lower_simd,              \
+                             WasmExecutionMode execution_mode); \
+  TEST(RunWasm_##name##_turbofan) {                             \
+    EXPERIMENTAL_FLAG_SCOPE(simd);                              \
+    RunWasm_##name##_Impl(kNoLowerSimd, kExecuteTurbofan);      \
+  }                                                             \
+  TEST(RunWasm_##name##_simd_lowered) {                         \
+    EXPERIMENTAL_FLAG_SCOPE(simd);                              \
+    RunWasm_##name##_Impl(kLowerSimd, kExecuteTurbofan);        \
+  }                                                             \
+  void RunWasm_##name##_Impl(LowerSimd lower_simd,              \
+                             WasmExecutionMode execution_mode)
 
-// Test shuffles that blend the two vectors (elements remain in their lanes.)
-WASM_SIMD_TEST(S8x16Blend) {
-  static const int kLanes = 16;
-  std::array<uint8_t, kLanes> expected;
-  for (int bias = 1; bias < kLanes; bias++) {
-    for (int i = 0; i < bias; i++) expected[i] = i;
-    for (int i = bias; i < kLanes; i++) expected[i] = i + kLanes;
-    RunShuffleOpTest(execution_mode, lower_simd, kExprS8x16Shuffle, expected);
+void RunWasmCode(WasmExecutionMode execution_mode, LowerSimd lower_simd,
+                 const std::vector<byte>& code,
+                 std::array<int8_t, kSimd128Size>* result) {
+  WasmRunner<int32_t> r(execution_mode, lower_simd);
+  // Set up two test patterns as globals, e.g. [0, 1, 2, 3] and [4, 5, 6, 7].
+  int8_t* src0 = r.builder().AddGlobal<int8_t>(kWasmS128);
+  int8_t* src1 = r.builder().AddGlobal<int8_t>(kWasmS128);
+  for (int i = 0; i < kSimd128Size; ++i) {
+    src0[i] = i;
+    src1[i] = kSimd128Size + i;
+  }
+  r.Build(code.data(), code.data() + code.size());
+  CHECK_EQ(1, r.Call());
+  for (size_t i = 0; i < kSimd128Size; i++) {
+    (*result)[i] = src0[i];
   }
 }
 
-// Test shuffles that concatenate the two vectors.
-WASM_SIMD_TEST(S8x16Concat) {
-  static const int kLanes = 16;
-  std::array<uint8_t, kLanes> expected;
-  // n is offset or bias of concatenation.
-  for (int n = 1; n < kLanes; ++n) {
-    int i = 0;
-    // last kLanes - n bytes of first vector.
-    for (int j = n; j < kLanes; ++j) {
-      expected[i++] = j;
+// Test multiple shuffles executed in sequence.
+WASM_SIMD_COMPILED_TEST(S8x16MultiShuffleFuzz) {
+  v8::base::RandomNumberGenerator* rng = CcTest::random_number_generator();
+  static const int kShuffles = 100;
+  for (int i = 0; i < kShuffles; ++i) {
+    // Create an odd number in [3..23] of random test shuffles so we can build
+    // a complete binary tree (stored as a heap) of shuffle operations. The leaf
+    // shuffles operate on the test pattern inputs, while the interior shuffles
+    // operate on the results of the two child shuffles.
+    int num_shuffles = rng->NextInt(10) * 2 + 3;
+    std::vector<Shuffle> shuffles;
+    for (int j = 0; j < num_shuffles; ++j) {
+      shuffles.push_back(GetRandomTestShuffle(rng));
     }
-    // first n bytes of second vector
-    for (int j = 0; j < n; ++j) {
-      expected[i++] = j + kLanes;
+    // Generate the code for the shuffle expression.
+    std::vector<byte> buffer;
+    BuildShuffle(shuffles, &buffer);
+
+    // Run the code using the interpreter to get the expected result.
+    std::array<int8_t, kSimd128Size> expected;
+    RunWasmCode(kExecuteInterpreter, kNoLowerSimd, buffer, &expected);
+    // Run the SIMD or scalar lowered compiled code and compare results.
+    std::array<int8_t, kSimd128Size> result;
+    RunWasmCode(execution_mode, lower_simd, buffer, &result);
+    for (size_t i = 0; i < kSimd128Size; ++i) {
+      CHECK_EQ(result[i], expected[i]);
     }
-    RunShuffleOpTest(execution_mode, lower_simd, kExprS8x16Shuffle, expected);
   }
 }
 
@@ -2350,6 +2401,7 @@ WASM_SIMD_TEST(SimdLoadStoreLoad) {
 #undef WASM_SIMD_STORE_MEM
 #undef WASM_SIMD_SELECT_TEST
 #undef WASM_SIMD_NON_CANONICAL_SELECT_TEST
+#undef WASM_SIMD_COMPILED_TEST
 #undef WASM_SIMD_BOOL_REDUCTION_TEST
 
 }  // namespace test_run_wasm_simd
diff --git a/deps/v8/test/cctest/wasm/test-run-wasm.cc b/deps/v8/test/cctest/wasm/test-run-wasm.cc
index 696b1410b8e0ea..bf47ddeadb3e5d 100644
--- a/deps/v8/test/cctest/wasm/test-run-wasm.cc
+++ b/deps/v8/test/cctest/wasm/test-run-wasm.cc
@@ -3438,8 +3438,10 @@ TEST(Liftoff_tier_up) {
     memcpy(buffer.get(), sub_code->instructions().start(), sub_size);
     desc.buffer = buffer.get();
     desc.instr_size = static_cast<int>(sub_size);
-    native_module->AddCode(add.function_index(), desc, 0, 0, 0, {},
-                           OwnedVector<byte>(), WasmCode::kOther);
+    WasmCode* code =
+        native_module->AddCode(add.function_index(), desc, 0, 0, 0, {},
+                               OwnedVector<byte>(), WasmCode::kOther);
+    native_module->PublishCode(code);
 
     // Second run should now execute {sub}.
     CHECK_EQ(4, r.Call(11, 7));
diff --git a/deps/v8/test/cctest/wasm/wasm-run-utils.cc b/deps/v8/test/cctest/wasm/wasm-run-utils.cc
index ee358d2efb35c7..d7a87849a29e3d 100644
--- a/deps/v8/test/cctest/wasm/wasm-run-utils.cc
+++ b/deps/v8/test/cctest/wasm/wasm-run-utils.cc
@@ -5,6 +5,7 @@
 #include "test/cctest/wasm/wasm-run-utils.h"
 
 #include "src/assembler-inl.h"
+#include "src/code-tracer.h"
 #include "src/wasm/wasm-memory.h"
 #include "src/wasm/wasm-objects-inl.h"
 
diff --git a/deps/v8/test/fuzzer/json.cc b/deps/v8/test/fuzzer/json.cc
index 121939b5a0ea5d..3789baab566a39 100644
--- a/deps/v8/test/fuzzer/json.cc
+++ b/deps/v8/test/fuzzer/json.cc
@@ -10,6 +10,11 @@
 #include "test/fuzzer/fuzzer-support.h"
 
 extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
+  // Ignore too long inputs as they tend to find OOM or timeouts, not real bugs.
+  if (size > 16 * 1024) {
+    return false;
+  }
+
   v8_fuzzer::FuzzerSupport* support = v8_fuzzer::FuzzerSupport::Get();
   v8::Isolate* isolate = support->GetIsolate();
 
diff --git a/deps/v8/test/fuzzer/multi-return.cc b/deps/v8/test/fuzzer/multi-return.cc
index c6636c6eaf03eb..4f109228a58853 100644
--- a/deps/v8/test/fuzzer/multi-return.cc
+++ b/deps/v8/test/fuzzer/multi-return.cc
@@ -254,8 +254,7 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
   }
   callee.Return(static_cast<int>(desc->ReturnCount()), returns.get());
 
-  OptimizedCompilationInfo info(ArrayVector("testing"), &zone,
-                                Code::WASM_FUNCTION);
+  OptimizedCompilationInfo info(ArrayVector("testing"), &zone, Code::STUB);
   Handle<Code> code = Pipeline::GenerateCodeForTesting(
                           &info, i_isolate, desc, callee.graph(),
                           AssemblerOptions::Default(i_isolate), callee.Export())
diff --git a/deps/v8/test/fuzzer/parser.cc b/deps/v8/test/fuzzer/parser.cc
index 6f18889b2896e8..12f7a4eed4b777 100644
--- a/deps/v8/test/fuzzer/parser.cc
+++ b/deps/v8/test/fuzzer/parser.cc
@@ -18,6 +18,11 @@
 #include "test/fuzzer/fuzzer-support.h"
 
 bool IsValidInput(const uint8_t* data, size_t size) {
+  // Ignore too long inputs as they tend to find OOM or timeouts, not real bugs.
+  if (size > 8192) {
+    return false;
+  }
+
   std::list<char> parentheses;
   const char* ptr = reinterpret_cast<const char*>(data);
 
diff --git a/deps/v8/test/fuzzer/regexp.cc b/deps/v8/test/fuzzer/regexp.cc
index 5c6219631d07cb..f39e7094570e6c 100644
--- a/deps/v8/test/fuzzer/regexp.cc
+++ b/deps/v8/test/fuzzer/regexp.cc
@@ -71,7 +71,8 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
     std::string str = std::string(reinterpret_cast<const char*>(data), size);
     i::JSRegExp::Flags flag = static_cast<i::JSRegExp::Flags>(
         std::hash<std::string>()(str) % (kAllFlags + 1));
-    i::MaybeHandle<i::JSRegExp> maybe_regexp = i::JSRegExp::New(source, flag);
+    i::MaybeHandle<i::JSRegExp> maybe_regexp =
+        i::JSRegExp::New(i_isolate, source, flag);
     if (!maybe_regexp.ToHandle(&regexp)) {
       i_isolate->clear_pending_exception();
       return 0;
diff --git a/deps/v8/test/intl/locale/locale-properties.js b/deps/v8/test/intl/locale/locale-properties.js
index 9800e8d6cf6176..9432cb8a770011 100644
--- a/deps/v8/test/intl/locale/locale-properties.js
+++ b/deps/v8/test/intl/locale/locale-properties.js
@@ -24,7 +24,7 @@ assertEquals('buddhist', locale.calendar);
 assertEquals('phonebk', locale.collation);
 assertEquals('h23', locale.hourCycle);
 assertEquals('upper', locale.caseFirst);
-assertEquals(true, locale.numeric);
+assertEquals('true', locale.numeric);
 assertEquals('roman', locale.numberingSystem);
 // Not defined, expected to undefined.
 assertEquals(undefined, locale.currency);
diff --git a/deps/v8/test/intl/locale/maximize_minimize.js b/deps/v8/test/intl/locale/maximize_minimize.js
new file mode 100644
index 00000000000000..823a6670e34a5c
--- /dev/null
+++ b/deps/v8/test/intl/locale/maximize_minimize.js
@@ -0,0 +1,138 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --harmony-locale
+
+// Make sure that maximize and minimize of all locales work reasonbly.
+
+assertEquals(new Intl.Locale("zh-TW").maximize().toString(), "zh-Hant-TW",
+    "zh-TW should maximize to zh-Hant-TW");
+assertEquals(new Intl.Locale("zh-Hant-TW").minimize().toString(), "zh-TW",
+    "zh-Hant-TW should minimize to zh-TW");
+assertEquals(new Intl.Locale("zh-Hans-CN").minimize().toString(), "zh",
+    "zh-Hans-CN should minimize to zh");
+assertEquals(new Intl.Locale("zh-CN").minimize().toString(), "zh",
+    "zh-CN should minimize to zh");
+assertEquals(new Intl.Locale("zh-Hans").minimize().toString(), "zh",
+    "zh-Hans should minimize to zh");
+
+function assertExpandRoundTrip(loc) {
+  assertEquals(
+      loc.toString(), loc.maximize().minimize().toString(), loc.toString());
+  assertEquals(
+      loc.toString(), loc.minimize().toString(), loc.toString());
+  assertTrue(
+      loc.maximize().toString().length > loc.toString().length, loc.toString());
+}
+
+var simpleLocales = [
+  "af", "agq", "ak", "am", "ar", "asa", "ast", "as", "az", "bas", "bem", "be",
+  "bez", "bg", "bm", "bn", "bo", "br", "brx", "bs", "ca", "ccp", "ce", "cgg",
+  "chr", "ckb", "cs", "cu", "cy", "dav", "da", "de", "dje", "dsb", "dua", "dyo",
+  "dz", "ebu", "ee", "el", "en", "eo", "es", "et", "eu", "ewo", "fa", "ff",
+  "fil", "fi", "fo", "fr", "fur", "fy", "ga", "gd", "gl", "gsw", "gu", "guz",
+  "gv", "haw", "ha", "he", "hi", "hr", "hsb", "hu", "hy", "id", "ig", "ii",
+  "is", "it", "ja", "jgo", "jmc", "kab", "kam", "ka", "kde", "kea", "khq", "ki",
+  "kkj", "kk", "kln", "kl", "km", "kn", "kok", "ko", "ksb", "ksf", "ksh", "ks",
+  "kw", "ky", "lag", "lb", "lg", "lkt", "ln", "lo", "lrc", "lt", "luo", "lu",
+  "luy", "lv", "mas", "mer", "mfe", "mgh", "mgo", "mg", "mk", "ml", "mn", "mr",
+  "ms", "mt", "mua", "my", "mzn", "naq", "nb", "nds", "nd", "ne", "nl", "nmg",
+  "nnh", "nn", "nus", "nyn", "om", "or", "os", "pa", "pl", "prg", "ps", "pt",
+  "qu", "rm", "rn", "rof", "ro", "ru", "rwk", "rw", "sah", "saq", "sbp", "sd",
+  "seh", "ses", "se", "sg", "shi", "si", "sk", "sl", "smn", "sn", "so", "sq",
+  "sr", "sv", "sw", "ta", "teo", "te", "tg", "th", "ti", "tk", "to", "tr", "tt",
+  "twq", "tzm", "ug", "uk", "ur", "uz", "vai", "vi", "vo", "vun", "wae", "wo",
+  "xog", "yav", "yi", "yo", "yue", "zgh", "zh", "zu"];
+for (var i = 0; i < simpleLocales.length; i++) {
+  assertExpandRoundTrip(new Intl.Locale(simpleLocales[i]));
+}
+
+function assertReduceRoundTrip(loc) {
+  assertEquals(
+      loc.minimize().toString(), loc.maximize().minimize().toString(),
+      loc.toString());
+  assertEquals(
+      loc.maximize().toString(), loc.minimize().maximize().toString(),
+      loc.toString());
+  assertTrue(
+      loc.maximize().toString().length >= loc.toString().length, loc.toString());
+  assertTrue(
+      loc.minimize().toString().length <= loc.toString().length, loc.toString());
+}
+
+var complexLocales = [
+  "af-NA", "af-ZA", "agq-CM", "ak-GH", "am-ET", "ar-001", "ar-AE", "ar-BH",
+  "ar-DJ", "ar-DZ", "ar-EG", "ar-EH", "ar-ER", "ar-IL", "ar-IQ", "ar-JO",
+  "ar-KM", "ar-KW", "ar-LB", "ar-LY", "ar-MA", "ar-MR", "ar-OM", "ar-PS",
+  "ar-QA", "ar-SA", "ar-SD", "ar-SO", "ar-SS", "ar-SY", "ar-TD", "ar-TN",
+  "ar-YE", "asa-TZ", "as-IN", "ast-ES", "az-Cyrl-AZ", "az-Cyrl", "az-Latn-AZ",
+  "az-Latn", "bas-CM", "be-BY", "bem-ZM", "bez-TZ", "bg-BG", "bm-ML", "bn-BD",
+  "bn-IN", "bo-CN", "bo-IN", "br-FR", "brx-IN", "bs-Cyrl-BA", "bs-Cyrl",
+  "bs-Latn-BA", "bs-Latn", "ca-AD", "ca-ES", "ca-FR", "ca-IT",
+  "ccp-BD", "ccp-IN", "ce-RU", "cgg-UG", "chr-US", "ckb-Arab-IQ", "ckb-Arab-IR",
+  "ckb-Arab", "ckb-IQ", "ckb-IR", "ckb-Latn-IQ", "ckb-Latn", "cs-CZ", "cu-RU",
+  "cy-GB", "da-DK", "da-GL", "dav-KE", "de-AT", "de-BE", "de-CH", "de-DE",
+  "de-IT", "de-LI", "de-LU", "dje-NE", "dsb-DE", "dua-CM", "dyo-SN", "dz-BT",
+  "ebu-KE", "ee-GH", "ee-TG", "el-CY", "el-GR", "en-001", "en-150", "en-AG",
+  "en-AI", "en-AS", "en-AT", "en-AU", "en-BB", "en-BE", "en-BI", "en-BM",
+  "en-BS", "en-BW", "en-BZ", "en-CA", "en-CC", "en-CH", "en-CK", "en-CM",
+  "en-CX", "en-CY", "en-DE", "en-DG", "en-DK", "en-DM", "en-ER", "en-FI",
+  "en-FJ", "en-FK", "en-FM", "en-GB", "en-GD", "en-GG", "en-GH", "en-GI",
+  "en-GM", "en-GU", "en-GY", "en-HK", "en-IE", "en-IL", "en-IM", "en-IN",
+  "en-IO", "en-JE", "en-JM", "en-KE", "en-KI", "en-KN", "en-KY", "en-LC",
+  "en-LR", "en-LS", "en-MG", "en-MH", "en-MO", "en-MP", "en-MS", "en-MT",
+  "en-MU", "en-MW", "en-MY", "en-NA", "en-NF", "en-NG", "en-NL", "en-NR",
+  "en-NU", "en-NZ", "en-PG", "en-PH", "en-PK", "en-PN", "en-PR", "en-PW",
+  "en-RW", "en-SB", "en-SC", "en-SD", "en-SE", "en-SG", "en-SH", "en-SI",
+  "en-SL", "en-SS", "en-SX", "en-SZ", "en-TC", "en-TK", "en-TO", "en-TT",
+  "en-TV", "en-TZ", "en-UG", "en-UM", "en-US", "en-VC",
+  "en-VG", "en-VI", "en-VU", "en-WS", "en-ZA", "en-ZM", "en-ZW", "eo-001",
+  "es-419", "es-AR", "es-BO", "es-BR", "es-BZ", "es-CL", "es-CO", "es-CR",
+  "es-CU", "es-DO", "es-EA", "es-EC", "es-ES", "es-GQ", "es-GT", "es-HN",
+  "es-IC", "es-MX", "es-NI", "es-PA", "es-PE", "es-PH", "es-PR", "es-PY",
+  "es-SV", "es-US", "es-UY", "es-VE", "et-EE", "eu-ES", "ewo-CM", "fa-AF",
+  "fa-IR", "ff-CM", "ff-GN", "ff-MR", "ff-SN", "fi-FI", "fil-PH", "fo-DK",
+  "fo-FO", "fr-BE", "fr-BF", "fr-BI", "fr-BJ", "fr-BL", "fr-CA", "fr-CD",
+  "fr-CF", "fr-CG", "fr-CH", "fr-CI", "fr-CM", "fr-DJ", "fr-DZ", "fr-FR",
+  "fr-GA", "fr-GF", "fr-GN", "fr-GP", "fr-GQ", "fr-HT", "fr-KM", "fr-LU",
+  "fr-MA", "fr-MC", "fr-MF", "fr-MG", "fr-ML", "fr-MQ", "fr-MR", "fr-MU",
+  "fr-NC", "fr-NE", "fr-PF", "fr-PM", "fr-RE", "fr-RW", "fr-SC", "fr-SN",
+  "fr-SY", "fr-TD", "fr-TG", "fr-TN", "fr-VU", "fr-WF", "fr-YT", "fur-IT",
+  "fy-NL", "ga-IE", "gd-GB", "gl-ES", "gsw-CH", "gsw-FR", "gsw-LI", "gu-IN",
+  "guz-KE", "gv-IM", "ha-GH", "ha-NE", "ha-NG", "haw-US", "he-IL", "hi-IN",
+  "hr-BA", "hr-HR", "hsb-DE", "hu-HU", "hy-AM", "id-ID", "ig-NG", "ii-CN",
+  "is-IS", "it-CH", "it-IT", "it-SM", "it-VA", "ja-JP", "jgo-CM", "jmc-TZ",
+  "kab-DZ", "ka-GE", "kam-KE", "kde-TZ", "kea-CV", "khq-ML", "ki-KE",
+  "kkj-CM", "kk-KZ", "kl-GL", "kln-KE", "km-KH", "kn-IN", "kok-IN", "ko-KP",
+  "ko-KR", "ksb-TZ", "ksf-CM", "ksh-DE", "ks-IN", "kw-GB", "ky-KG", "lag-TZ",
+  "lb-LU", "lg-UG", "lkt-US", "ln-AO", "ln-CD", "ln-CF", "ln-CG", "lo-LA",
+  "lrc-IQ", "lrc-IR", "lt-LT", "lu-CD", "luo-KE", "luy-KE", "lv-LV", "mas-KE",
+  "mas-TZ", "mer-KE", "mfe-MU", "mgh-MZ", "mg-MG", "mgo-CM", "mk-MK", "ml-IN",
+  "mn-MN", "mr-IN", "ms-BN", "ms-MY", "ms-SG", "mt-MT", "mua-CM", "my-MM",
+  "mzn-IR", "naq-NA", "nb-NO", "nb-SJ", "nds-DE", "nds-NL", "nd-ZW", "ne-IN",
+  "ne-NP", "nl-AW", "nl-BE", "nl-BQ", "nl-CW", "nl-NL", "nl-SR", "nl-SX",
+  "nmg-CM", "nnh-CM", "nn-NO", "nus-SS", "nyn-UG", "om-ET", "om-KE",
+  "or-IN", "os-GE", "os-RU", "pa-Arab-PK", "pa-Guru-IN", "pa-Guru",
+  "pl-PL", "prg-001", "ps-AF", "pt-AO", "pt-BR", "pt-CH", "pt-CV", "pt-GQ",
+  "pt-GW", "pt-LU", "pt-MO", "pt-MZ", "pt-PT", "pt-ST", "pt-TL", "qu-BO",
+  "qu-EC", "qu-PE", "rm-CH", "rn-BI", "rof-TZ", "ro-MD", "ro-RO", "ru-BY",
+  "ru-KG", "ru-KZ", "ru-MD", "ru-RU", "ru-UA", "rwk-TZ", "rw-RW", "sah-RU",
+  "saq-KE", "sbp-TZ", "sd-PK", "se-FI", "seh-MZ", "se-NO", "se-SE", "ses-ML",
+  "sg-CF", "shi-Latn-MA", "shi-Latn", "shi-Tfng-MA", "shi-Tfng", "si-LK",
+  "sk-SK", "sl-SI", "smn-FI", "sn-ZW", "so-DJ", "so-ET", "so-KE", "so-SO",
+  "sq-AL", "sq-MK", "sq-XK", "sr-Cyrl-BA", "sr-Cyrl-ME", "sr-Cyrl-RS",
+  "sr-Cyrl-XK", "sr-Cyrl", "sr-Latn-BA", "sr-Latn-ME", "sr-Latn-RS",
+  "sr-Latn-XK", "sr-Latn", "sv-AX", "sv-FI", "sv-SE", "sw-CD", "sw-KE",
+  "sw-TZ", "sw-UG", "ta-IN", "ta-LK", "ta-MY", "ta-SG", "te-IN", "teo-KE",
+  "teo-UG", "tg-TJ", "th-TH", "ti-ER", "ti-ET", "tk-TM", "to-TO", "tr-CY",
+  "tr-TR", "tt-RU", "twq-NE", "tzm-MA", "ug-CN", "uk-UA", "ur-IN", "ur-PK",
+  "uz-Arab-AF", "uz-Cyrl-UZ", "uz-Cyrl", "uz-Latn-UZ", "uz-Latn",
+  "vai-Latn-LR", "vai-Latn", "vai-Vaii-LR", "vai-Vaii", "vi-VN", "vo-001",
+  "vun-TZ", "wae-CH", "wo-SN", "xog-UG", "yav-CM", "yi-001", "yo-BJ", "yo-NG",
+  "yue-Hans-CN", "yue-Hant-HK", "yue-Hant", "zgh-MA", "zh-Hans-CN",
+  "zh-Hans-HK", "zh-Hans-MO", "zh-Hans-SG", "zh-Hans", "zh-Hant-HK",
+  "zh-Hant-MO", "zh-Hant-TW", "zu-ZA"];
+for (var i = 0; i < complexLocales.length; i++) {
+  assertReduceRoundTrip(new Intl.Locale(complexLocales[i]));
+}
diff --git a/deps/v8/test/intl/relative-time-format/format-en.js b/deps/v8/test/intl/relative-time-format/format-en.js
new file mode 100644
index 00000000000000..31030847528cef
--- /dev/null
+++ b/deps/v8/test/intl/relative-time-format/format-en.js
@@ -0,0 +1,502 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --harmony-intl-relative-time-format
+
+// The following test are not part of the comformance. Just some output in
+// English to verify the format does return something reasonable for English.
+// It may be changed when we update the CLDR data.
+// NOTE: These are UNSPECIFIED behavior in
+// http://tc39.github.io/proposal-intl-relative-time/
+
+let longAuto = new Intl.RelativeTimeFormat(
+    "en", {style: "long", localeMatcher: 'lookup', numeric: 'auto'});
+
+assertEquals('03 seconds ago', longAuto.format(-3, 'second'));
+assertEquals('02 seconds ago', longAuto.format(-2, 'second'));
+assertEquals('01 second ago', longAuto.format(-1, 'second'));
+assertEquals('now', longAuto.format(0, 'second'));
+assertEquals('now', longAuto.format(-0, 'second'));
+assertEquals('in 01 second', longAuto.format(1, 'second'));
+assertEquals('in 02 seconds', longAuto.format(2, 'second'));
+assertEquals('in 345 seconds', longAuto.format(345, 'second'));
+
+assertEquals('03 minutes ago', longAuto.format(-3, 'minute'));
+assertEquals('02 minutes ago', longAuto.format(-2, 'minute'));
+assertEquals('01 minute ago', longAuto.format(-1, 'minute'));
+assertEquals('in 00 minutes', longAuto.format(0, 'minute'));
+assertEquals('00 minutes ago', longAuto.format(-0, 'minute'));
+assertEquals('in 01 minute', longAuto.format(1, 'minute'));
+assertEquals('in 02 minutes', longAuto.format(2, 'minute'));
+assertEquals('in 345 minutes', longAuto.format(345, 'minute'));
+
+assertEquals('03 hours ago', longAuto.format(-3, 'hour'));
+assertEquals('02 hours ago', longAuto.format(-2, 'hour'));
+assertEquals('01 hour ago', longAuto.format(-1, 'hour'));
+assertEquals('in 00 hours', longAuto.format(0, 'hour'));
+assertEquals('00 hours ago', longAuto.format(-0, 'hour'));
+assertEquals('in 01 hour', longAuto.format(1, 'hour'));
+assertEquals('in 02 hours', longAuto.format(2, 'hour'));
+assertEquals('in 345 hours', longAuto.format(345, 'hour'));
+
+assertEquals('03 days ago', longAuto.format(-3, 'day'));
+assertEquals('02 days ago', longAuto.format(-2, 'day'));
+assertEquals('yesterday', longAuto.format(-1, 'day'));
+assertEquals('today', longAuto.format(0, 'day'));
+assertEquals('today', longAuto.format(-0, 'day'));
+assertEquals('tomorrow', longAuto.format(1, 'day'));
+assertEquals('in 02 days', longAuto.format(2, 'day'));
+assertEquals('in 345 days', longAuto.format(345, 'day'));
+
+assertEquals('03 weeks ago', longAuto.format(-3, 'week'));
+assertEquals('02 weeks ago', longAuto.format(-2, 'week'));
+assertEquals('last week', longAuto.format(-1, 'week'));
+assertEquals('this week', longAuto.format(0, 'week'));
+assertEquals('this week', longAuto.format(-0, 'week'));
+assertEquals('next week', longAuto.format(1, 'week'));
+assertEquals('in 02 weeks', longAuto.format(2, 'week'));
+assertEquals('in 345 weeks', longAuto.format(345, 'week'));
+
+assertEquals('03 months ago', longAuto.format(-3, 'month'));
+assertEquals('02 months ago', longAuto.format(-2, 'month'));
+assertEquals('last month', longAuto.format(-1, 'month'));
+assertEquals('this month', longAuto.format(0, 'month'));
+assertEquals('this month', longAuto.format(-0, 'month'));
+assertEquals('next month', longAuto.format(1, 'month'));
+assertEquals('in 02 months', longAuto.format(2, 'month'));
+assertEquals('in 345 months', longAuto.format(345, 'month'));
+
+// "quarter" is not working in ICU now
+// Tracked by ICU bug in http://bugs.icu-project.org/trac/ticket/12171
+/*
+assertEquals('03 quarters ago', longAuto.format(-3, 'quarter'));
+assertEquals('02 quarters ago', longAuto.format(-2, 'quarter'));
+assertEquals('last quarter', longAuto.format(-1, 'quarter'));
+assertEquals('this quarter', longAuto.format(0, 'quarter'));
+assertEquals('this quarter', longAuto.format(-0, 'quarter'));
+assertEquals('next quarter', longAuto.format(1, 'quarter'));
+assertEquals('in 02 quarters', longAuto.format(2, 'quarter'));
+assertEquals('in 345 quarters', longAuto.format(345, 'quarter'));
+*/
+
+assertEquals('03 years ago', longAuto.format(-3, 'year'));
+assertEquals('02 years ago', longAuto.format(-2, 'year'));
+assertEquals('last year', longAuto.format(-1, 'year'));
+assertEquals('this year', longAuto.format(0, 'year'));
+assertEquals('this year', longAuto.format(-0, 'year'));
+assertEquals('next year', longAuto.format(1, 'year'));
+assertEquals('in 02 years', longAuto.format(2, 'year'));
+assertEquals('in 345 years', longAuto.format(345, 'year'));
+
+let shortAuto = new Intl.RelativeTimeFormat(
+    "en", {style: "short", localeMatcher: 'lookup', numeric: 'auto'});
+
+assertEquals('03 sec. ago', shortAuto.format(-3, 'second'));
+assertEquals('02 sec. ago', shortAuto.format(-2, 'second'));
+assertEquals('01 sec. ago', shortAuto.format(-1, 'second'));
+assertEquals('now', shortAuto.format(0, 'second'));
+assertEquals('now', shortAuto.format(-0, 'second'));
+assertEquals('in 01 sec.', shortAuto.format(1, 'second'));
+assertEquals('in 02 sec.', shortAuto.format(2, 'second'));
+assertEquals('in 345 sec.', shortAuto.format(345, 'second'));
+
+assertEquals('03 min. ago', shortAuto.format(-3, 'minute'));
+assertEquals('02 min. ago', shortAuto.format(-2, 'minute'));
+assertEquals('01 min. ago', shortAuto.format(-1, 'minute'));
+assertEquals('in 00 min.', shortAuto.format(0, 'minute'));
+assertEquals('00 min. ago', shortAuto.format(-0, 'minute'));
+assertEquals('in 01 min.', shortAuto.format(1, 'minute'));
+assertEquals('in 02 min.', shortAuto.format(2, 'minute'));
+assertEquals('in 345 min.', shortAuto.format(345, 'minute'));
+
+assertEquals('03 hr. ago', shortAuto.format(-3, 'hour'));
+assertEquals('02 hr. ago', shortAuto.format(-2, 'hour'));
+assertEquals('01 hr. ago', shortAuto.format(-1, 'hour'));
+assertEquals('in 00 hr.', shortAuto.format(0, 'hour'));
+assertEquals('00 hr. ago', shortAuto.format(-0, 'hour'));
+assertEquals('in 01 hr.', shortAuto.format(1, 'hour'));
+assertEquals('in 02 hr.', shortAuto.format(2, 'hour'));
+assertEquals('in 345 hr.', shortAuto.format(345, 'hour'));
+
+assertEquals('03 days ago', shortAuto.format(-3, 'day'));
+assertEquals('02 days ago', shortAuto.format(-2, 'day'));
+assertEquals('yesterday', shortAuto.format(-1, 'day'));
+assertEquals('today', shortAuto.format(0, 'day'));
+assertEquals('today', shortAuto.format(-0, 'day'));
+assertEquals('tomorrow', shortAuto.format(1, 'day'));
+assertEquals('in 02 days', shortAuto.format(2, 'day'));
+assertEquals('in 345 days', shortAuto.format(345, 'day'));
+
+assertEquals('03 wk. ago', shortAuto.format(-3, 'week'));
+assertEquals('02 wk. ago', shortAuto.format(-2, 'week'));
+assertEquals('last wk.', shortAuto.format(-1, 'week'));
+assertEquals('this wk.', shortAuto.format(0, 'week'));
+assertEquals('this wk.', shortAuto.format(-0, 'week'));
+assertEquals('next wk.', shortAuto.format(1, 'week'));
+assertEquals('in 02 wk.', shortAuto.format(2, 'week'));
+assertEquals('in 345 wk.', shortAuto.format(345, 'week'));
+
+assertEquals('03 mo. ago', shortAuto.format(-3, 'month'));
+assertEquals('02 mo. ago', shortAuto.format(-2, 'month'));
+assertEquals('last mo.', shortAuto.format(-1, 'month'));
+assertEquals('this mo.', shortAuto.format(0, 'month'));
+assertEquals('this mo.', shortAuto.format(-0, 'month'));
+assertEquals('next mo.', shortAuto.format(1, 'month'));
+assertEquals('in 02 mo.', shortAuto.format(2, 'month'));
+assertEquals('in 345 mo.', shortAuto.format(345, 'month'));
+
+// "quarter" is not working in ICU now
+/*
+assertEquals('03 qtrs. ago', shortAuto.format(-3, 'quarter'));
+assertEquals('02 qtrs. ago', shortAuto.format(-2, 'quarter'));
+assertEquals('last qtr.', shortAuto.format(-1, 'quarter'));
+assertEquals('this qtr.', shortAuto.format(0, 'quarter'));
+assertEquals('this qtr.', shortAuto.format(-0, 'quarter'));
+assertEquals('next qtr.', shortAuto.format(1, 'quarter'));
+assertEquals('in 02 qtrs.', shortAuto.format(2, 'quarter'));
+assertEquals('in 345 qtrs.', shortAuto.format(345, 'quarter'));
+*/
+
+assertEquals('03 yr. ago', shortAuto.format(-3, 'year'));
+assertEquals('02 yr. ago', shortAuto.format(-2, 'year'));
+assertEquals('last yr.', shortAuto.format(-1, 'year'));
+assertEquals('this yr.', shortAuto.format(0, 'year'));
+assertEquals('this yr.', shortAuto.format(-0, 'year'));
+assertEquals('next yr.', shortAuto.format(1, 'year'));
+assertEquals('in 02 yr.', shortAuto.format(2, 'year'));
+assertEquals('in 345 yr.', shortAuto.format(345, 'year'));
+
+// Somehow in the 'en' locale, there are no valeu for -narrow
+let narrowAuto = new Intl.RelativeTimeFormat(
+    "en", {style: "narrow", localeMatcher: 'lookup', numeric: 'auto'});
+
+assertEquals('03 sec. ago', narrowAuto.format(-3, 'second'));
+assertEquals('02 sec. ago', narrowAuto.format(-2, 'second'));
+assertEquals('01 sec. ago', narrowAuto.format(-1, 'second'));
+assertEquals('now', narrowAuto.format(0, 'second'));
+assertEquals('now', narrowAuto.format(-0, 'second'));
+assertEquals('in 01 sec.', narrowAuto.format(1, 'second'));
+assertEquals('in 02 sec.', narrowAuto.format(2, 'second'));
+assertEquals('in 345 sec.', narrowAuto.format(345, 'second'));
+
+assertEquals('03 min. ago', narrowAuto.format(-3, 'minute'));
+assertEquals('02 min. ago', narrowAuto.format(-2, 'minute'));
+assertEquals('01 min. ago', narrowAuto.format(-1, 'minute'));
+assertEquals('in 00 min.', narrowAuto.format(0, 'minute'));
+assertEquals('00 min. ago', narrowAuto.format(-0, 'minute'));
+assertEquals('in 01 min.', narrowAuto.format(1, 'minute'));
+assertEquals('in 02 min.', narrowAuto.format(2, 'minute'));
+assertEquals('in 345 min.', narrowAuto.format(345, 'minute'));
+
+assertEquals('03 hr. ago', narrowAuto.format(-3, 'hour'));
+assertEquals('02 hr. ago', narrowAuto.format(-2, 'hour'));
+assertEquals('01 hr. ago', narrowAuto.format(-1, 'hour'));
+assertEquals('in 00 hr.', narrowAuto.format(0, 'hour'));
+assertEquals('00 hr. ago', narrowAuto.format(-0, 'hour'));
+assertEquals('in 01 hr.', narrowAuto.format(1, 'hour'));
+assertEquals('in 02 hr.', narrowAuto.format(2, 'hour'));
+assertEquals('in 345 hr.', narrowAuto.format(345, 'hour'));
+
+assertEquals('03 days ago', narrowAuto.format(-3, 'day'));
+assertEquals('02 days ago', narrowAuto.format(-2, 'day'));
+assertEquals('yesterday', narrowAuto.format(-1, 'day'));
+assertEquals('today', narrowAuto.format(0, 'day'));
+assertEquals('today', narrowAuto.format(-0, 'day'));
+assertEquals('tomorrow', narrowAuto.format(1, 'day'));
+assertEquals('in 02 days', narrowAuto.format(2, 'day'));
+assertEquals('in 345 days', narrowAuto.format(345, 'day'));
+
+assertEquals('03 wk. ago', narrowAuto.format(-3, 'week'));
+assertEquals('02 wk. ago', narrowAuto.format(-2, 'week'));
+assertEquals('last wk.', narrowAuto.format(-1, 'week'));
+assertEquals('this wk.', narrowAuto.format(0, 'week'));
+assertEquals('this wk.', narrowAuto.format(-0, 'week'));
+assertEquals('next wk.', narrowAuto.format(1, 'week'));
+assertEquals('in 02 wk.', narrowAuto.format(2, 'week'));
+assertEquals('in 345 wk.', narrowAuto.format(345, 'week'));
+
+assertEquals('03 mo. ago', narrowAuto.format(-3, 'month'));
+assertEquals('02 mo. ago', narrowAuto.format(-2, 'month'));
+assertEquals('last mo.', narrowAuto.format(-1, 'month'));
+assertEquals('this mo.', narrowAuto.format(0, 'month'));
+assertEquals('this mo.', narrowAuto.format(-0, 'month'));
+assertEquals('next mo.', narrowAuto.format(1, 'month'));
+assertEquals('in 02 mo.', narrowAuto.format(2, 'month'));
+assertEquals('in 345 mo.', narrowAuto.format(345, 'month'));
+
+// "quarter" is not working in ICU now
+/*
+assertEquals('03 qtrs. ago', narrowAuto.format(-3, 'quarter'));
+assertEquals('02 qtrs. ago', narrowAuto.format(-2, 'quarter'));
+assertEquals('last qtr.', narrowAuto.format(-1, 'quarter'));
+assertEquals('this qtr.', narrowAuto.format(0, 'quarter'));
+assertEquals('this qtr.', narrowAuto.format(-0, 'quarter'));
+assertEquals('next qtr.', narrowAuto.format(1, 'quarter'));
+assertEquals('in 02 qtrs.', narrowAuto.format(2, 'quarter'));
+assertEquals('in 345 qtrs.', narrowAuto.format(345, 'quarter'));
+*/
+
+assertEquals('03 yr. ago', narrowAuto.format(-3, 'year'));
+assertEquals('02 yr. ago', narrowAuto.format(-2, 'year'));
+assertEquals('last yr.', narrowAuto.format(-1, 'year'));
+assertEquals('this yr.', narrowAuto.format(0, 'year'));
+assertEquals('this yr.', narrowAuto.format(-0, 'year'));
+assertEquals('next yr.', narrowAuto.format(1, 'year'));
+assertEquals('in 02 yr.', narrowAuto.format(2, 'year'));
+assertEquals('in 345 yr.', narrowAuto.format(345, 'year'));
+
+let longAlways = new Intl.RelativeTimeFormat(
+    "en", {style: "long", localeMatcher: 'lookup', numeric: 'always'});
+
+assertEquals('03 seconds ago', longAlways.format(-3, 'second'));
+assertEquals('02 seconds ago', longAlways.format(-2, 'second'));
+assertEquals('01 second ago', longAlways.format(-1, 'second'));
+assertEquals('in 00 seconds', longAlways.format(0, 'second'));
+assertEquals('00 seconds ago', longAlways.format(-0, 'second'));
+assertEquals('in 01 second', longAlways.format(1, 'second'));
+assertEquals('in 02 seconds', longAlways.format(2, 'second'));
+assertEquals('in 345 seconds', longAlways.format(345, 'second'));
+
+assertEquals('03 minutes ago', longAlways.format(-3, 'minute'));
+assertEquals('02 minutes ago', longAlways.format(-2, 'minute'));
+assertEquals('01 minute ago', longAlways.format(-1, 'minute'));
+assertEquals('in 00 minutes', longAlways.format(0, 'minute'));
+assertEquals('00 minutes ago', longAlways.format(-0, 'minute'));
+assertEquals('in 01 minute', longAlways.format(1, 'minute'));
+assertEquals('in 02 minutes', longAlways.format(2, 'minute'));
+assertEquals('in 345 minutes', longAlways.format(345, 'minute'));
+
+assertEquals('03 hours ago', longAlways.format(-3, 'hour'));
+assertEquals('02 hours ago', longAlways.format(-2, 'hour'));
+assertEquals('01 hour ago', longAlways.format(-1, 'hour'));
+assertEquals('in 00 hours', longAlways.format(0, 'hour'));
+assertEquals('00 hours ago', longAlways.format(-0, 'hour'));
+assertEquals('in 01 hour', longAlways.format(1, 'hour'));
+assertEquals('in 02 hours', longAlways.format(2, 'hour'));
+assertEquals('in 345 hours', longAlways.format(345, 'hour'));
+
+assertEquals('03 days ago', longAlways.format(-3, 'day'));
+assertEquals('02 days ago', longAlways.format(-2, 'day'));
+assertEquals('01 day ago', longAlways.format(-1, 'day'));
+assertEquals('in 00 days', longAlways.format(0, 'day'));
+assertEquals('00 days ago', longAlways.format(-0, 'day'));
+assertEquals('in 01 day', longAlways.format(1, 'day'));
+assertEquals('in 02 days', longAlways.format(2, 'day'));
+assertEquals('in 345 days', longAlways.format(345, 'day'));
+
+assertEquals('03 weeks ago', longAlways.format(-3, 'week'));
+assertEquals('02 weeks ago', longAlways.format(-2, 'week'));
+assertEquals('01 week ago', longAlways.format(-1, 'week'));
+assertEquals('in 00 weeks', longAlways.format(0, 'week'));
+assertEquals('00 weeks ago', longAlways.format(-0, 'week'));
+assertEquals('in 01 week', longAlways.format(1, 'week'));
+assertEquals('in 02 weeks', longAlways.format(2, 'week'));
+assertEquals('in 345 weeks', longAlways.format(345, 'week'));
+
+assertEquals('03 months ago', longAlways.format(-3, 'month'));
+assertEquals('02 months ago', longAlways.format(-2, 'month'));
+assertEquals('01 month ago', longAlways.format(-1, 'month'));
+assertEquals('in 00 months', longAlways.format(0, 'month'));
+assertEquals('00 months ago', longAlways.format(-0, 'month'));
+assertEquals('in 01 month', longAlways.format(1, 'month'));
+assertEquals('in 02 months', longAlways.format(2, 'month'));
+assertEquals('in 345 months', longAlways.format(345, 'month'));
+
+// "quarter" is not working in ICU now
+/*
+assertEquals('03 quarters ago', longAlways.format(-3, 'quarter'));
+assertEquals('02 quarters ago', longAlways.format(-2, 'quarter'));
+assertEquals('01 quarter ago', longAlways.format(-1, 'quarter'));
+assertEquals('in 00 quarters', longAlways.format(0, 'quarter'));
+assertEquals('00 quarters ago', longAlways.format(-0, 'quarter'));
+assertEquals('in 01 quarter', longAlways.format(1, 'quarter'));
+assertEquals('in 02 quarters', longAlways.format(2, 'quarter'));
+assertEquals('in 345 quarters', longAlways.format(345, 'quarter'));
+*/
+
+assertEquals('03 years ago', longAlways.format(-3, 'year'));
+assertEquals('02 years ago', longAlways.format(-2, 'year'));
+assertEquals('01 year ago', longAlways.format(-1, 'year'));
+assertEquals('in 00 years', longAlways.format(0, 'year'));
+assertEquals('00 years ago', longAlways.format(-0, 'year'));
+assertEquals('in 01 year', longAlways.format(1, 'year'));
+assertEquals('in 02 years', longAlways.format(2, 'year'));
+assertEquals('in 345 years', longAlways.format(345, 'year'));
+
+let shortAlways = new Intl.RelativeTimeFormat(
+    "en", {style: "short", localeMatcher: 'lookup', numeric: 'always'});
+
+assertEquals('03 sec. ago', shortAlways.format(-3, 'second'));
+assertEquals('02 sec. ago', shortAlways.format(-2, 'second'));
+assertEquals('01 sec. ago', shortAlways.format(-1, 'second'));
+assertEquals('in 00 sec.', shortAlways.format(0, 'second'));
+assertEquals('00 sec. ago', shortAlways.format(-0, 'second'));
+assertEquals('in 01 sec.', shortAlways.format(1, 'second'));
+assertEquals('in 02 sec.', shortAlways.format(2, 'second'));
+assertEquals('in 345 sec.', shortAlways.format(345, 'second'));
+
+assertEquals('03 min. ago', shortAlways.format(-3, 'minute'));
+assertEquals('02 min. ago', shortAlways.format(-2, 'minute'));
+assertEquals('01 min. ago', shortAlways.format(-1, 'minute'));
+assertEquals('in 00 min.', shortAlways.format(0, 'minute'));
+assertEquals('00 min. ago', shortAlways.format(-0, 'minute'));
+assertEquals('in 01 min.', shortAlways.format(1, 'minute'));
+assertEquals('in 02 min.', shortAlways.format(2, 'minute'));
+assertEquals('in 345 min.', shortAlways.format(345, 'minute'));
+
+assertEquals('03 hr. ago', shortAlways.format(-3, 'hour'));
+assertEquals('02 hr. ago', shortAlways.format(-2, 'hour'));
+assertEquals('01 hr. ago', shortAlways.format(-1, 'hour'));
+assertEquals('in 00 hr.', shortAlways.format(0, 'hour'));
+assertEquals('00 hr. ago', shortAlways.format(-0, 'hour'));
+assertEquals('in 01 hr.', shortAlways.format(1, 'hour'));
+assertEquals('in 02 hr.', shortAlways.format(2, 'hour'));
+assertEquals('in 345 hr.', shortAlways.format(345, 'hour'));
+
+assertEquals('03 days ago', shortAlways.format(-3, 'day'));
+assertEquals('02 days ago', shortAlways.format(-2, 'day'));
+assertEquals('01 day ago', shortAlways.format(-1, 'day'));
+assertEquals('in 00 days', shortAlways.format(0, 'day'));
+assertEquals('00 days ago', shortAlways.format(-0, 'day'));
+assertEquals('in 01 day', shortAlways.format(1, 'day'));
+assertEquals('in 02 days', shortAlways.format(2, 'day'));
+assertEquals('in 345 days', shortAlways.format(345, 'day'));
+
+assertEquals('03 wk. ago', shortAlways.format(-3, 'week'));
+assertEquals('02 wk. ago', shortAlways.format(-2, 'week'));
+assertEquals('01 wk. ago', shortAlways.format(-1, 'week'));
+assertEquals('in 00 wk.', shortAlways.format(0, 'week'));
+assertEquals('00 wk. ago', shortAlways.format(-0, 'week'));
+assertEquals('in 01 wk.', shortAlways.format(1, 'week'));
+assertEquals('in 02 wk.', shortAlways.format(2, 'week'));
+assertEquals('in 345 wk.', shortAlways.format(345, 'week'));
+
+assertEquals('03 mo. ago', shortAlways.format(-3, 'month'));
+assertEquals('02 mo. ago', shortAlways.format(-2, 'month'));
+assertEquals('01 mo. ago', shortAlways.format(-1, 'month'));
+assertEquals('in 00 mo.', shortAlways.format(0, 'month'));
+assertEquals('00 mo. ago', shortAlways.format(-0, 'month'));
+assertEquals('in 01 mo.', shortAlways.format(1, 'month'));
+assertEquals('in 02 mo.', shortAlways.format(2, 'month'));
+assertEquals('in 345 mo.', shortAlways.format(345, 'month'));
+
+// "quarter" is not working in ICU now
+/*
+assertEquals('03 qtrs. ago', shortAlways.format(-3, 'quarter'));
+assertEquals('02 qtrs. ago', shortAlways.format(-2, 'quarter'));
+assertEquals('01 qtr. ago', shortAlways.format(-1, 'quarter'));
+assertEquals('in 00 qtrs.', shortAlways.format(0, 'quarter'));
+assertEquals('00 qtr. ago', shortAlways.format(-0, 'quarter'));
+assertEquals('in 01 qtr.', shortAlways.format(1, 'quarter'));
+assertEquals('in 02 qtrs.', shortAlways.format(2, 'quarter'));
+assertEquals('in 345 qtrs.', shortAlways.format(345, 'quarter'));
+*/
+
+assertEquals('03 yr. ago', shortAlways.format(-3, 'year'));
+assertEquals('02 yr. ago', shortAlways.format(-2, 'year'));
+assertEquals('01 yr. ago', shortAlways.format(-1, 'year'));
+assertEquals('in 00 yr.', shortAlways.format(0, 'year'));
+assertEquals('00 yr. ago', shortAlways.format(-0, 'year'));
+assertEquals('in 01 yr.', shortAlways.format(1, 'year'));
+assertEquals('in 02 yr.', shortAlways.format(2, 'year'));
+assertEquals('in 345 yr.', shortAlways.format(345, 'year'));
+
+// Somehow in the 'en' locale, there are no valeu for -narrow
+let narrowAlways = new Intl.RelativeTimeFormat(
+    "en", {style: "narrow", localeMatcher: 'lookup', numeric: 'always'});
+
+assertEquals('03 sec. ago', narrowAlways.format(-3, 'second'));
+assertEquals('02 sec. ago', narrowAlways.format(-2, 'second'));
+assertEquals('01 sec. ago', narrowAlways.format(-1, 'second'));
+assertEquals('in 00 sec.', narrowAlways.format(0, 'second'));
+assertEquals('00 sec. ago', narrowAlways.format(-0, 'second'));
+assertEquals('in 01 sec.', narrowAlways.format(1, 'second'));
+assertEquals('in 02 sec.', narrowAlways.format(2, 'second'));
+assertEquals('in 345 sec.', narrowAlways.format(345, 'second'));
+
+assertEquals('03 min. ago', narrowAlways.format(-3, 'minute'));
+assertEquals('02 min. ago', narrowAlways.format(-2, 'minute'));
+assertEquals('01 min. ago', narrowAlways.format(-1, 'minute'));
+assertEquals('in 00 min.', narrowAlways.format(0, 'minute'));
+assertEquals('00 min. ago', narrowAlways.format(-0, 'minute'));
+assertEquals('in 01 min.', narrowAlways.format(1, 'minute'));
+assertEquals('in 02 min.', narrowAlways.format(2, 'minute'));
+assertEquals('in 345 min.', narrowAlways.format(345, 'minute'));
+
+assertEquals('03 hr. ago', narrowAlways.format(-3, 'hour'));
+assertEquals('02 hr. ago', narrowAlways.format(-2, 'hour'));
+assertEquals('01 hr. ago', narrowAlways.format(-1, 'hour'));
+assertEquals('in 00 hr.', narrowAlways.format(0, 'hour'));
+assertEquals('00 hr. ago', narrowAlways.format(-0, 'hour'));
+assertEquals('in 01 hr.', narrowAlways.format(1, 'hour'));
+assertEquals('in 02 hr.', narrowAlways.format(2, 'hour'));
+assertEquals('in 345 hr.', narrowAlways.format(345, 'hour'));
+
+assertEquals('03 days ago', narrowAlways.format(-3, 'day'));
+assertEquals('02 days ago', narrowAlways.format(-2, 'day'));
+assertEquals('01 day ago', narrowAlways.format(-1, 'day'));
+assertEquals('in 00 days', narrowAlways.format(0, 'day'));
+assertEquals('00 days ago', narrowAlways.format(-0, 'day'));
+assertEquals('in 01 day', narrowAlways.format(1, 'day'));
+assertEquals('in 02 days', narrowAlways.format(2, 'day'));
+assertEquals('in 345 days', narrowAlways.format(345, 'day'));
+
+assertEquals('03 wk. ago', narrowAlways.format(-3, 'week'));
+assertEquals('02 wk. ago', narrowAlways.format(-2, 'week'));
+assertEquals('01 wk. ago', narrowAlways.format(-1, 'week'));
+assertEquals('in 00 wk.', narrowAlways.format(0, 'week'));
+assertEquals('00 wk. ago', narrowAlways.format(-0, 'week'));
+assertEquals('in 01 wk.', narrowAlways.format(1, 'week'));
+assertEquals('in 02 wk.', narrowAlways.format(2, 'week'));
+assertEquals('in 345 wk.', narrowAlways.format(345, 'week'));
+
+assertEquals('03 mo. ago', narrowAlways.format(-3, 'month'));
+assertEquals('02 mo. ago', narrowAlways.format(-2, 'month'));
+assertEquals('01 mo. ago', narrowAlways.format(-1, 'month'));
+assertEquals('in 00 mo.', narrowAlways.format(0, 'month'));
+assertEquals('00 mo. ago', narrowAlways.format(-0, 'month'));
+assertEquals('in 01 mo.', narrowAlways.format(1, 'month'));
+assertEquals('in 02 mo.', narrowAlways.format(2, 'month'));
+assertEquals('in 345 mo.', narrowAlways.format(345, 'month'));
+
+// "quarter" is not working in ICU now
+/*
+assertEquals('03 qtrs. ago', narrowAlways.format(-3, 'quarter'));
+assertEquals('02 qtrs. ago', narrowAlways.format(-2, 'quarter'));
+assertEquals('01 qtr. ago', narrowAlways.format(-1, 'quarter'));
+assertEquals('in 00 qtrs.', narrowAlways.format(0, 'quarter'));
+assertEquals('00 qtr. ago', narrowAlways.format(-0, 'quarter'));
+assertEquals('in 01 qtr.', narrowAlways.format(1, 'quarter'));
+assertEquals('in 02 qtrs.', narrowAlways.format(2, 'quarter'));
+assertEquals('in 345 qtrs.', narrowAlways.format(345, 'quarter'));
+*/
+
+assertEquals('03 yr. ago', narrowAlways.format(-3, 'year'));
+assertEquals('02 yr. ago', narrowAlways.format(-2, 'year'));
+assertEquals('01 yr. ago', narrowAlways.format(-1, 'year'));
+assertEquals('in 00 yr.', narrowAlways.format(0, 'year'));
+assertEquals('00 yr. ago', narrowAlways.format(-0, 'year'));
+assertEquals('in 01 yr.', narrowAlways.format(1, 'year'));
+assertEquals('in 02 yr.', narrowAlways.format(2, 'year'));
+assertEquals('in 345 yr.', narrowAlways.format(345, 'year'));
+
+var styleNumericCombinations = [
+    longAuto, shortAuto, narrowAuto, longAlways,
+    shortAlways, narrowAlways ];
+var validUnits = [
+    'second', 'minute', 'hour', 'day', 'week', 'month', 'quarter', 'year'];
+
+// Test these all throw RangeError
+for (var i = 0; i < styleNumericCombinations.length; i++) {
+  for (var j = 0; j < validUnits.length; j++) {
+    assertThrows(() => styleNumericCombinations[i].format(NaN, validUnits[j]),
+        RangeError);
+    assertThrows(() => styleNumericCombinations[i].format(NaN, validUnits[j] + 's'),
+        RangeError);
+    assertThrows(() => styleNumericCombinations[i].format(NaN, validUnits[j]),
+        RangeError);
+    assertThrows(() => styleNumericCombinations[i].format(NaN, validUnits[j] + 's'),
+        RangeError);
+  }
+}
diff --git a/deps/v8/test/intl/relative-time-format/format-to-parts-en.js b/deps/v8/test/intl/relative-time-format/format-to-parts-en.js
new file mode 100644
index 00000000000000..32c0cd7f952d31
--- /dev/null
+++ b/deps/v8/test/intl/relative-time-format/format-to-parts-en.js
@@ -0,0 +1,68 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --harmony-intl-relative-time-format
+
+// The following test are not part of the comformance. Just some output in
+// English to verify the format does return something reasonable for English.
+// It may be changed when we update the CLDR data.
+// NOTE: These are UNSPECIFIED behavior in
+// http://tc39.github.io/proposal-intl-relative-time/
+
+// From Sample code in https://github.com/tc39/proposal-intl-relative-time#intlrelativetimeformatprototypeformattopartsvalue-unit
+//   // Format relative time using the day unit.
+//   rtf.formatToParts(-1, "day");
+//   // > [{ type: "literal", value: "yesterday"}]
+let longAuto = new Intl.RelativeTimeFormat(
+    "en", {style: "long", localeMatcher: 'lookup', numeric: 'auto'});
+var parts = longAuto.formatToParts(-1, "day");
+assertEquals(1, parts.length);
+assertEquals(2, Object.getOwnPropertyNames(parts[0]).length);
+assertEquals('literal', parts[0].type);
+assertEquals('yesterday', parts[0].value);
+
+// From Sample code in https://github.com/tc39/proposal-intl-relative-time#intlrelativetimeformatprototypeformattopartsvalue-unit
+//   rtf.formatToParts(100, "day");
+//   // > [{ type: "literal", value: "in " }, { type: "integer", value: "100", unit: "day" }, { type: "literal", value: " days" }]
+let longAlways = new Intl.RelativeTimeFormat(
+    "en", {style: "long", localeMatcher: 'lookup', numeric: 'always'});
+
+parts = longAlways.formatToParts(100, "day");
+assertEquals(3, parts.length);
+
+assertEquals(2, Object.getOwnPropertyNames(parts[0]).length);
+assertEquals('literal', parts[0].type);
+assertEquals('in ', parts[0].value);
+
+assertEquals(3, Object.getOwnPropertyNames(parts[1]).length);
+assertEquals('integer', parts[1].type);
+assertEquals('100', parts[1].value);
+assertEquals('day', parts[1].unit);
+
+assertEquals(2, Object.getOwnPropertyNames(parts[2]).length);
+assertEquals('literal', parts[2].type);
+assertEquals(' days', parts[2].value);
+
+assertThrows(() => longAlways.format(NaN, 'second'), RangeError);
+assertThrows(() => longAuto.format(NaN, 'second'), RangeError);
+
+parts = longAlways.formatToParts(-10, "day");
+assertEquals(2, parts.length);
+assertEquals(3, Object.getOwnPropertyNames(parts[0]).length);
+assertEquals('integer', parts[0].type);
+assertEquals('10', parts[0].value);
+assertEquals('day', parts[0].unit);
+assertEquals(2, Object.getOwnPropertyNames(parts[1]).length);
+assertEquals('literal', parts[1].type);
+assertEquals(' days ago', parts[1].value);
+
+parts = longAlways.formatToParts(-0, "day");
+assertEquals(2, parts.length);
+assertEquals(3, Object.getOwnPropertyNames(parts[0]).length);
+assertEquals('integer', parts[0].type);
+assertEquals('00', parts[0].value);
+assertEquals('day', parts[0].unit);
+assertEquals(2, Object.getOwnPropertyNames(parts[1]).length);
+assertEquals('literal', parts[1].type);
+assertEquals(' days ago', parts[1].value);
diff --git a/deps/v8/test/intl/relative-time-format/format-to-parts.js b/deps/v8/test/intl/relative-time-format/format-to-parts.js
new file mode 100644
index 00000000000000..071c4468c0d139
--- /dev/null
+++ b/deps/v8/test/intl/relative-time-format/format-to-parts.js
@@ -0,0 +1,82 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --harmony-intl-relative-time-format
+
+// Make sure that RelativeTimeFormat exposes all required properties. Those not specified
+// should have undefined value.
+// http://tc39.github.io/proposal-intl-relative-time/
+
+let rtf = new Intl.RelativeTimeFormat();
+
+// Test 1.4.4 Intl.RelativeTimeFormat.prototype.formatToParts( value, unit )
+assertEquals(true, Array.isArray(rtf.formatToParts(-1, 'seconds')));
+assertEquals(true, Array.isArray(rtf.formatToParts(-1, 'second')));
+assertEquals(true, Array.isArray(rtf.formatToParts(-1, 'minutes')));
+assertEquals(true, Array.isArray(rtf.formatToParts(-1, 'minute')));
+assertEquals(true, Array.isArray(rtf.formatToParts(-1, 'hours')));
+assertEquals(true, Array.isArray(rtf.formatToParts(-1, 'hour')));
+assertEquals(true, Array.isArray(rtf.formatToParts(-1, 'days')));
+assertEquals(true, Array.isArray(rtf.formatToParts(-1, 'day')));
+assertEquals(true, Array.isArray(rtf.formatToParts(-1, 'weeks')));
+assertEquals(true, Array.isArray(rtf.formatToParts(-1, 'week')));
+assertEquals(true, Array.isArray(rtf.formatToParts(-1, 'months')));
+assertEquals(true, Array.isArray(rtf.formatToParts(-1, 'month')));
+assertEquals(true, Array.isArray(rtf.formatToParts(-1, 'quarters')));
+assertEquals(true, Array.isArray(rtf.formatToParts(-1, 'quarter')));
+assertEquals(true, Array.isArray(rtf.formatToParts(-1, 'years')));
+assertEquals(true, Array.isArray(rtf.formatToParts(-1, 'year')));
+assertEquals(true, Array.isArray(rtf.formatToParts(-0, 'seconds')));
+assertEquals(true, Array.isArray(rtf.formatToParts(-0, 'second')));
+assertEquals(true, Array.isArray(rtf.formatToParts(-0, 'minutes')));
+assertEquals(true, Array.isArray(rtf.formatToParts(-0, 'minute')));
+assertEquals(true, Array.isArray(rtf.formatToParts(-0, 'hours')));
+assertEquals(true, Array.isArray(rtf.formatToParts(-0, 'hour')));
+assertEquals(true, Array.isArray(rtf.formatToParts(-0, 'days')));
+assertEquals(true, Array.isArray(rtf.formatToParts(-0, 'day')));
+assertEquals(true, Array.isArray(rtf.formatToParts(-0, 'weeks')));
+assertEquals(true, Array.isArray(rtf.formatToParts(-0, 'week')));
+assertEquals(true, Array.isArray(rtf.formatToParts(-0, 'months')));
+assertEquals(true, Array.isArray(rtf.formatToParts(-0, 'month')));
+assertEquals(true, Array.isArray(rtf.formatToParts(-0, 'quarters')));
+assertEquals(true, Array.isArray(rtf.formatToParts(-0, 'quarter')));
+assertEquals(true, Array.isArray(rtf.formatToParts(-0, 'years')));
+assertEquals(true, Array.isArray(rtf.formatToParts(-0, 'year')));
+
+assertThrows(() => rtf.formatToParts(-1, 'decades'), RangeError);
+assertThrows(() => rtf.formatToParts(-1, 'decade'), RangeError);
+assertThrows(() => rtf.formatToParts(-1, 'centuries'), RangeError);
+assertThrows(() => rtf.formatToParts(-1, 'century'), RangeError);
+assertThrows(() => rtf.formatToParts(-1, 'milliseconds'), RangeError);
+assertThrows(() => rtf.formatToParts(-1, 'millisecond'), RangeError);
+assertThrows(() => rtf.formatToParts(-1, 'microseconds'), RangeError);
+assertThrows(() => rtf.formatToParts(-1, 'microsecond'), RangeError);
+assertThrows(() => rtf.formatToParts(-1, 'nanoseconds'), RangeError);
+assertThrows(() => rtf.formatToParts(-1, 'nanosecond'), RangeError);
+
+assertThrows(() => rtf.formatToParts(NaN, 'seconds'), RangeError);
+assertThrows(() => rtf.formatToParts(NaN, 'second'), RangeError);
+assertThrows(() => rtf.formatToParts(NaN, 'minutes'), RangeError);
+assertThrows(() => rtf.formatToParts(NaN, 'minute'), RangeError);
+assertThrows(() => rtf.formatToParts(NaN, 'hours'), RangeError);
+assertThrows(() => rtf.formatToParts(NaN, 'hour'), RangeError);
+assertThrows(() => rtf.formatToParts(NaN, 'days'), RangeError);
+assertThrows(() => rtf.formatToParts(NaN, 'day'), RangeError);
+assertThrows(() => rtf.formatToParts(NaN, 'weeks'), RangeError);
+assertThrows(() => rtf.formatToParts(NaN, 'week'), RangeError);
+assertThrows(() => rtf.formatToParts(NaN, 'months'), RangeError);
+assertThrows(() => rtf.formatToParts(NaN, 'month'), RangeError);
+assertThrows(() => rtf.formatToParts(NaN, 'years'), RangeError);
+assertThrows(() => rtf.formatToParts(NaN, 'year'), RangeError);
+assertThrows(() => rtf.formatToParts(NaN, 'quarters'), RangeError);
+assertThrows(() => rtf.formatToParts(NaN, 'quarter'), RangeError);
+
+assertEquals(true, Array.isArray(rtf.formatToParts(100, 'day')));
+rtf.formatToParts(100, 'day').forEach(function(part) {
+  assertEquals(true, part.type == 'literal' || part.type == 'integer');
+  assertEquals('string', typeof part.value);
+  if (part.type == 'integer') {
+    assertEquals('string', typeof part.unit);
+  }
+});
diff --git a/deps/v8/test/intl/relative-time-format/format.js b/deps/v8/test/intl/relative-time-format/format.js
new file mode 100644
index 00000000000000..769358423dc024
--- /dev/null
+++ b/deps/v8/test/intl/relative-time-format/format.js
@@ -0,0 +1,82 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --harmony-intl-relative-time-format
+
+// Make sure that RelativeTimeFormat exposes all required properties. Those not specified
+// should have undefined value.
+// http://tc39.github.io/proposal-intl-relative-time/
+
+let rtf = new Intl.RelativeTimeFormat();
+
+// Test 1.4.3 Intl.RelativeTimeFormat.prototype.format( value, unit )
+assertEquals('string', typeof rtf.format(-1, 'seconds'));
+assertEquals('string', typeof rtf.format(-1, 'second'));
+assertEquals('string', typeof rtf.format(-1, 'minutes'));
+assertEquals('string', typeof rtf.format(-1, 'minute'));
+assertEquals('string', typeof rtf.format(-1, 'hours'));
+assertEquals('string', typeof rtf.format(-1, 'hour'));
+assertEquals('string', typeof rtf.format(-1, 'days'));
+assertEquals('string', typeof rtf.format(-1, 'day'));
+assertEquals('string', typeof rtf.format(-1, 'weeks'));
+assertEquals('string', typeof rtf.format(-1, 'week'));
+assertEquals('string', typeof rtf.format(-1, 'months'));
+assertEquals('string', typeof rtf.format(-1, 'month'));
+assertEquals('string', typeof rtf.format(-1, 'years'));
+assertEquals('string', typeof rtf.format(-1, 'year'));
+assertEquals('string', typeof rtf.format(-1, 'quarter'));
+assertEquals('string', typeof rtf.format(-1, 'quarters'));
+
+assertEquals('string', typeof rtf.format(-0, 'seconds'));
+assertEquals('string', typeof rtf.format(-0, 'second'));
+assertEquals('string', typeof rtf.format(-0, 'minutes'));
+assertEquals('string', typeof rtf.format(-0, 'minute'));
+assertEquals('string', typeof rtf.format(-0, 'hours'));
+assertEquals('string', typeof rtf.format(-0, 'hour'));
+assertEquals('string', typeof rtf.format(-0, 'days'));
+assertEquals('string', typeof rtf.format(-0, 'day'));
+assertEquals('string', typeof rtf.format(-0, 'weeks'));
+assertEquals('string', typeof rtf.format(-0, 'week'));
+assertEquals('string', typeof rtf.format(-0, 'months'));
+assertEquals('string', typeof rtf.format(-0, 'month'));
+assertEquals('string', typeof rtf.format(-0, 'years'));
+assertEquals('string', typeof rtf.format(-0, 'year'));
+assertEquals('string', typeof rtf.format(-0, 'quarter'));
+assertEquals('string', typeof rtf.format(-0, 'quarters'));
+
+assertThrows(() => rtf.format(NaN, 'seconds'), RangeError);
+assertThrows(() => rtf.format(NaN, 'second'), RangeError);
+assertThrows(() => rtf.format(NaN, 'minutes'), RangeError);
+assertThrows(() => rtf.format(NaN, 'minute'), RangeError);
+assertThrows(() => rtf.format(NaN, 'hours'), RangeError);
+assertThrows(() => rtf.format(NaN, 'hour'), RangeError);
+assertThrows(() => rtf.format(NaN, 'days'), RangeError);
+assertThrows(() => rtf.format(NaN, 'day'), RangeError);
+assertThrows(() => rtf.format(NaN, 'weeks'), RangeError);
+assertThrows(() => rtf.format(NaN, 'week'), RangeError);
+assertThrows(() => rtf.format(NaN, 'months'), RangeError);
+assertThrows(() => rtf.format(NaN, 'month'), RangeError);
+assertThrows(() => rtf.format(NaN, 'years'), RangeError);
+assertThrows(() => rtf.format(NaN, 'year'), RangeError);
+assertThrows(() => rtf.format(NaN, 'quarters'), RangeError);
+assertThrows(() => rtf.format(NaN, 'quarter'), RangeError);
+
+assertThrows(() => rtf.format(-1, 'decades'), RangeError);
+assertThrows(() => rtf.format(-1, 'decade'), RangeError);
+assertThrows(() => rtf.format(-1, 'centuries'), RangeError);
+assertThrows(() => rtf.format(-1, 'century'), RangeError);
+assertThrows(() => rtf.format(-1, 'milliseconds'), RangeError);
+assertThrows(() => rtf.format(-1, 'millisecond'), RangeError);
+assertThrows(() => rtf.format(-1, 'microseconds'), RangeError);
+assertThrows(() => rtf.format(-1, 'microsecond'), RangeError);
+assertThrows(() => rtf.format(-1, 'nanoseconds'), RangeError);
+assertThrows(() => rtf.format(-1, 'nanosecond'), RangeError);
+
+assertEquals('string', typeof rtf.format(5, 'day'));
+assertEquals('string', typeof rtf.format('5', 'day'));
+assertEquals('string', typeof rtf.format('-5', 'day'));
+assertEquals('string', typeof rtf.format('534', 'day'));
+assertEquals('string', typeof rtf.format('-534', 'day'));
+
+//assertThrows(() => rtf.format('xyz', 'day'), RangeError);
diff --git a/deps/v8/test/js-perf-test/JSTests.json b/deps/v8/test/js-perf-test/JSTests.json
index ce7e102b62a72c..fb0a5bfce6a37d 100644
--- a/deps/v8/test/js-perf-test/JSTests.json
+++ b/deps/v8/test/js-perf-test/JSTests.json
@@ -1039,6 +1039,19 @@
         {"name": "OneLineComments"},
         {"name": "MultiLineComment"}
       ]
+    },
+    {
+      "name": "Numbers",
+      "path": ["Numbers"],
+      "main": "run.js",
+      "flags": ["--allow-natives-syntax"],
+      "resources": [ "toNumber.js"],
+      "results_regexp": "^%s\\-Numbers\\(Score\\): (.+)$",
+      "tests": [
+        {"name": "Constructor"},
+        {"name": "UnaryPlus"},
+        {"name": "ParseFloat"}
+      ]
     }
   ]
 }
diff --git a/deps/v8/test/js-perf-test/Numbers/run.js b/deps/v8/test/js-perf-test/Numbers/run.js
new file mode 100644
index 00000000000000..cdfbf25a707960
--- /dev/null
+++ b/deps/v8/test/js-perf-test/Numbers/run.js
@@ -0,0 +1,20 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+load('../base.js');
+load('toNumber.js');
+
+function PrintResult(name, result) {
+  console.log(name);
+  console.log(name + '-Numbers(Score): ' + result);
+}
+
+function PrintError(name, error) {
+  PrintResult(name, error);
+}
+
+BenchmarkSuite.config.doWarmup = undefined;
+BenchmarkSuite.config.doDeterministic = undefined;
+
+BenchmarkSuite.RunSuites({ NotifyResult: PrintResult,
+                           NotifyError: PrintError });
diff --git a/deps/v8/test/js-perf-test/Numbers/toNumber.js b/deps/v8/test/js-perf-test/Numbers/toNumber.js
new file mode 100644
index 00000000000000..44382f092be398
--- /dev/null
+++ b/deps/v8/test/js-perf-test/Numbers/toNumber.js
@@ -0,0 +1,25 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+const A = [undefined, 12, "123"];
+
+function NumberConstructor() {
+  Number.isNaN(Number(A[0]))
+  Number.isNaN(Number(A[1]))
+  Number.isNaN(Number(A[2]))
+}
+createSuite('Constructor', 1000, NumberConstructor, ()=>{});
+
+function NumberPlus() {
+  Number.isNaN(+(A[0]))
+  Number.isNaN(+(A[1]))
+  Number.isNaN(+(A[2]))
+}
+createSuite('UnaryPlus', 1000, NumberPlus, ()=>{});
+
+function NumberParseFloat() {
+  Number.isNaN(parseFloat(A[0]))
+  Number.isNaN(parseFloat(A[1]))
+  Number.isNaN(parseFloat(A[2]))
+}
+createSuite('ParseFloat', 1000, NumberParseFloat, ()=>{});
diff --git a/deps/v8/test/mjsunit/harmony/bigint/regress-tonumbercode.js b/deps/v8/test/mjsunit/harmony/bigint/regress-tonumbercode.js
new file mode 100644
index 00000000000000..4dedf4d27c76fd
--- /dev/null
+++ b/deps/v8/test/mjsunit/harmony/bigint/regress-tonumbercode.js
@@ -0,0 +1,16 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --harmony-bigint
+
+function f(x, b) {
+    if (b) return Math.trunc(+(x))
+    else return Math.trunc(Number(x))
+}
+
+f("1", true);
+f("2", true);
+f("2", false);
+%OptimizeFunctionOnNextCall(f);
+f(3n);
diff --git a/deps/v8/test/mjsunit/harmony/bigint/turbo.js b/deps/v8/test/mjsunit/harmony/bigint/turbo.js
index 87130ea1015052..4ce4880f3de5a0 100644
--- a/deps/v8/test/mjsunit/harmony/bigint/turbo.js
+++ b/deps/v8/test/mjsunit/harmony/bigint/turbo.js
@@ -31,7 +31,7 @@ function Test(f, ...cases) {
 
 function V(input, expected_value) {
   function check(result) {
-    assertFalse(result.exception, input);
+    assertFalse(result.exception, `unexpected exception ${result.value} on input ${input}`);
     assertEquals(expected_value, result.value);
   }
   return {input, check};
@@ -39,7 +39,7 @@ function V(input, expected_value) {
 
 function E(input, expected_exception) {
   function check(result) {
-    assertTrue(result.exception, input);
+    assertTrue(result.exception, `expected exception ${expected_exception.name} on input ${input}`);
     assertInstanceof(result.value, expected_exception);
   }
   return {input, check};
@@ -56,10 +56,15 @@ const six = {[Symbol.toPrimitive]() {return 6n}};
 // inputs.
 ////////////////////////////////////////////////////////////////////////////////
 
-
 Test(x => Number(x),
     V(1n, 1), V(1, 1), V("", 0), V(1.4, 1.4), V(null, 0), V(six, 6));
 
+Test(x => Math.trunc(+x),
+    E(1n, TypeError), V(1, 1), V("", 0), V(1.4, 1), V(null, 0), E(six, TypeError));
+
+Test(x => Math.trunc(Number(x)),
+    V(1n, 1), V(1, 1), V("", 0), V(1.4, 1), V(null, 0), V(six, 6));
+
 Test(x => String(x),
     V(1n, "1"), V(1, "1"), V(1.4, "1.4"), V(null, "null"), V(six, "6"));
 
diff --git a/deps/v8/test/mjsunit/regress/regress-852765.js b/deps/v8/test/mjsunit/regress/regress-852765.js
new file mode 100644
index 00000000000000..bdd3a9ddb2296a
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-852765.js
@@ -0,0 +1,17 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// The actual regression test
+assertThrows("(import(foo)) =>", undefined, "Unexpected token import");
+
+// Other related tests
+assertThrows("import(foo) =>", undefined, "Unexpected token import");
+assertThrows("(a, import(foo)) =>", undefined, "Unexpected token import");
+assertThrows("(1, import(foo)) =>", undefined, "Unexpected number");
+assertThrows("(super(foo)) =>", undefined, "'super' keyword unexpected here");
+assertThrows("(bar(foo)) =>", undefined, "Unexpected token (");
+
+// No syntax errors
+assertThrows("[import(foo).then] = [1];", undefined, "foo is not defined");
+assertThrows("[[import(foo).then]] = [[1]];", undefined, "foo is not defined");
diff --git a/deps/v8/test/mjsunit/regress/regress-863155.js b/deps/v8/test/mjsunit/regress/regress-863155.js
new file mode 100644
index 00000000000000..fb5d465d80192d
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-863155.js
@@ -0,0 +1,10 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --always-opt
+
+for (let i = 0; i < 5; i++) {
+  try { typeof x } catch (e) {};
+  let x;
+}
diff --git a/deps/v8/test/mjsunit/regress/regress-863810.js b/deps/v8/test/mjsunit/regress/regress-863810.js
new file mode 100644
index 00000000000000..0ee13303102a58
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-863810.js
@@ -0,0 +1,19 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --no-liftoff --no-wasm-tier-up --no-future --debug-code
+
+load('test/mjsunit/wasm/wasm-constants.js');
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+const builder = new WasmModuleBuilder();
+builder.addFunction('main', kSig_i_v)
+  .addBody([
+    kExprI64Const, 0xa3, 0x82, 0x83, 0x86, 0x8c, 0xd8, 0xae, 0xb5, 0x40,
+    kExprI32ConvertI64,
+    kExprI32Const, 0x00,
+    kExprI32Sub,
+  ]).exportFunc();
+const instance = builder.instantiate();
+print(instance.exports.main(1, 2, 3));
diff --git a/deps/v8/test/mjsunit/regress/wasm/regress-808848.js b/deps/v8/test/mjsunit/regress/wasm/regress-808848.js
index 28c57ec3406e98..69423b954db600 100644
--- a/deps/v8/test/mjsunit/regress/wasm/regress-808848.js
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-808848.js
@@ -49,16 +49,16 @@ let m1 = new WebAssembly.Module(m1_bytes);
 // Serialize the module and postMessage it to another thread.
 let serialized_m1 = %SerializeWasmModule(m1);
 
-let workerScript =
-  `onmessage = function(msg) {
-    let {serialized_m1, m1_bytes} = msg;
+let worker_onmessage = function(msg) {
+  let {serialized_m1, m1_bytes} = msg;
 
-    let m1_clone = %DeserializeWasmModule(serialized_m1, m1_bytes);
-    let imports = {mod: {get: () => 3, call: () => {}}};
-    let i2 = new WebAssembly.Instance(m1_clone, imports);
-    i2.exports.main();
-    postMessage('done');
-  }`;
+  let m1_clone = %DeserializeWasmModule(serialized_m1, m1_bytes);
+  let imports = {mod: {get: () => 3, call: () => {}}};
+  let i2 = new WebAssembly.Instance(m1_clone, imports);
+  i2.exports.main();
+  postMessage('done');
+}
+let workerScript = "onmessage = " + worker_onmessage.toString();
 
 let worker = new Worker(workerScript);
 worker.postMessage({serialized_m1, m1_bytes});
diff --git a/deps/v8/test/mjsunit/regress/wasm/regress-864509.js b/deps/v8/test/mjsunit/regress/wasm/regress-864509.js
new file mode 100644
index 00000000000000..822c06750afa62
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-864509.js
@@ -0,0 +1,62 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --liftoff --no-wasm-tier-up --no-future --wasm-tier-mask-for-testing=2
+
+load('test/mjsunit/wasm/wasm-constants.js');
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+const builder = new WasmModuleBuilder();
+builder.addMemory(1, 1);
+// First function is Liftoff. The first parameter is used as memory offset.
+builder.addFunction(undefined, kSig_v_i).addBody([
+  kExprGetLocal, 0,        // get_local 0
+  kExprI32Const, 0,        // i32.const 0
+  kExprI32StoreMem, 0, 0,  // i32.store offset=0
+]);
+// Second function is Turbofan. It loads the sixth parameter from the stack
+// into a register for the first argument. Even though it's a 32-bit value, it
+// is loaded as 64-bit value on x64.
+builder.addFunction(undefined, makeSig(new Array(6).fill(kWasmI32), []))
+    .addBody([
+      kExprGetLocal, 5,     // get_local 5
+      kExprCallFunction, 0  // call 0
+    ]);
+// The third function is Liftoff again. A value is spilled on the stack as i32,
+// then used as a call argument, passed via the stack. The full 64-bit are
+// copied on the stack, even though just 32-bit were written before. Hence, the
+// stack slot is not zero-extended.
+const gen_i32_code = [
+  kExprTeeLocal, 0,  // tee_local 0
+  kExprGetLocal, 0,  // get_local 0
+  kExprI32Const, 1,  // i32.const 1
+  kExprI32Add        // i32.add     --> 2nd param
+];
+builder.addFunction(undefined, kSig_v_v).addLocals({i32_count: 1}).addBody([
+  // Generate six values on the stack, then six more to force the other six on
+  // the stack.
+  ...wasmI32Const(0),    // i32.const 0
+  ...wasmI32Const(1),    // i32.const 1
+  kExprI32Add,           // i32.add --> 1st param
+  ...gen_i32_code,       // --> 2nd param
+  ...gen_i32_code,       // --> 3rd param
+  ...gen_i32_code,       // --> 4th param
+  ...gen_i32_code,       // --> 5th param
+  ...gen_i32_code,       // --> 6th param
+  ...gen_i32_code,       // --> garbage
+  ...gen_i32_code,       // --> garbage
+  ...gen_i32_code,       // --> garbage
+  ...gen_i32_code,       // --> garbage
+  ...gen_i32_code,       // --> garbage
+  ...gen_i32_code,       // --> garbage
+  kExprDrop,             // drop garbage
+  kExprDrop,             // drop garbage
+  kExprDrop,             // drop garbage
+  kExprDrop,             // drop garbage
+  kExprDrop,             // drop garbage
+  kExprDrop,             // drop garbage
+  kExprCallFunction,  1  // call 1
+]).exportAs('three');
+const instance = builder.instantiate();
+instance.exports.three();
diff --git a/deps/v8/test/mjsunit/wasm/worker-module.js b/deps/v8/test/mjsunit/wasm/worker-module.js
index d63a8679c548b1..00615b84349198 100644
--- a/deps/v8/test/mjsunit/wasm/worker-module.js
+++ b/deps/v8/test/mjsunit/wasm/worker-module.js
@@ -7,7 +7,7 @@
 load("test/mjsunit/wasm/wasm-constants.js");
 load("test/mjsunit/wasm/wasm-module-builder.js");
 
-function TestCloneModule() {
+(function TestPostModule() {
   let builder = new WasmModuleBuilder();
   builder.addFunction("add", kSig_i_ii)
     .addBody([kExprGetLocal, 0, kExprGetLocal, 1, kExprI32Add])
@@ -31,4 +31,4 @@ function TestCloneModule() {
   worker.postMessage(module);
   assertEquals(42, worker.getMessage());
   worker.terminate();
-}
+})();
diff --git a/deps/v8/test/test262/test262.status b/deps/v8/test/test262/test262.status
index 3df9ea9859cbb3..88c1e32cb4737c 100644
--- a/deps/v8/test/test262/test262.status
+++ b/deps/v8/test/test262/test262.status
@@ -448,12 +448,9 @@
   'intl402/Locale/constructor-getter-order': [FAIL],
   'intl402/Locale/constructor-locale-object': [FAIL],
   'intl402/Locale/constructor-non-iana-canon': [FAIL],
-  'intl402/Locale/constructor-options-casefirst-invalid': [FAIL],
-  'intl402/Locale/constructor-options-hourcycle-invalid': [FAIL],
   'intl402/Locale/constructor-options-language-grandfathered': [FAIL],
   'intl402/Locale/constructor-options-language-invalid': [FAIL],
   'intl402/Locale/constructor-options-language-valid': [FAIL],
-  'intl402/Locale/constructor-options-numeric-valid': [FAIL],
   'intl402/Locale/constructor-options-region-invalid': [FAIL],
   'intl402/Locale/constructor-options-region-valid': [FAIL],
   'intl402/Locale/constructor-options-script-invalid': [FAIL],
@@ -470,12 +467,6 @@
   'intl402/Locale/invalid-tag-throws': [FAIL],
   'intl402/Locale/likely-subtags': [FAIL],
   'intl402/Locale/likely-subtags-grandfathered': [FAIL],
-  'intl402/Locale/prototype/maximize/length': [FAIL],
-  'intl402/Locale/prototype/maximize/name': [FAIL],
-  'intl402/Locale/prototype/maximize/prop-desc': [FAIL],
-  'intl402/Locale/prototype/minimize/length': [FAIL],
-  'intl402/Locale/prototype/minimize/name': [FAIL],
-  'intl402/Locale/prototype/minimize/prop-desc': [FAIL],
   'intl402/Locale/prototype/toStringTag/toStringTag': [FAIL],
   'intl402/Locale/prototype/toStringTag/toString': [FAIL],
 
@@ -484,12 +475,6 @@
   'intl402/RelativeTimeFormat/constructor/supportedLocalesOf/length': [FAIL],
   'intl402/RelativeTimeFormat/constructor/supportedLocalesOf/name': [FAIL],
   'intl402/RelativeTimeFormat/constructor/supportedLocalesOf/prop-desc': [FAIL],
-  'intl402/RelativeTimeFormat/prototype/format/length': [FAIL],
-  'intl402/RelativeTimeFormat/prototype/format/name': [FAIL],
-  'intl402/RelativeTimeFormat/prototype/format/prop-desc': [FAIL],
-  'intl402/RelativeTimeFormat/prototype/formatToParts/length': [FAIL],
-  'intl402/RelativeTimeFormat/prototype/formatToParts/name': [FAIL],
-  'intl402/RelativeTimeFormat/prototype/formatToParts/prop-desc': [FAIL],
 
   # https://bugs.chromium.org/p/v8/issues/detail?id=7813
   'built-ins/Array/prototype/lastIndexOf/calls-only-has-on-prototype-after-length-zeroed': [FAIL],
@@ -503,19 +488,12 @@
   # https://bugs.chromium.org/p/v8/issues/detail?id=7781
   'built-ins/Date/parse/time-value-maximum-range': [FAIL],
 
-  # https://bugs.chromium.org/p/v8/issues/detail?id=7830
-  'intl402/PluralRules/prototype/resolvedOptions/pluralCategories': [FAIL],
-
   # https://bugs.chromium.org/p/v8/issues/detail?id=7831
   'language/statements/generators/generator-created-after-decl-inst': [FAIL],
   'language/expressions/generators/generator-created-after-decl-inst': [FAIL],
   'language/expressions/async-generator/generator-created-after-decl-inst': [FAIL],
   'language/statements/async-generator/generator-created-after-decl-inst': [FAIL],
 
-  # https://bugs.chromium.org/p/v8/issues/detail?id=7832
-  'intl402/Array/prototype/toLocaleString/calls-toLocaleString-number-elements': [FAIL],
-  'intl402/TypedArray/prototype/toLocaleString/calls-toLocaleString-number-elements': [FAIL],
-
   ######################## NEEDS INVESTIGATION ###########################
 
   # These test failures are specific to the intl402 suite and need investigation
diff --git a/deps/v8/test/torque/test-torque.tq b/deps/v8/test/torque/test-torque.tq
index b4512f90421e8e..1ed8e986b67f9d 100644
--- a/deps/v8/test/torque/test-torque.tq
+++ b/deps/v8/test/torque/test-torque.tq
@@ -4,9 +4,9 @@
 
 module test {
   macro ElementsKindTestHelper1(kind: constexpr ElementsKind): bool {
-    if constexpr ((kind == UINT8_ELEMENTS) || (kind == UINT16_ELEMENTS)) {
-      return true;
-    }
+    if constexpr((kind == UINT8_ELEMENTS) || (kind == UINT16_ELEMENTS)) {
+        return true;
+      }
     else {
       return false;
     }
@@ -82,7 +82,7 @@ module test {
     }
   }
 
-  builtin GenericBuiltinTest<T: type>(c: Context, param: T): Object {
+  builtin GenericBuiltinTest<T : type>(c: Context, param: T): Object {
     return Null;
   }
 
@@ -98,7 +98,8 @@ module test {
   }
 
   macro LabelTestHelper4(flag: constexpr bool): never labels Label4, Label5 {
-    if constexpr (flag) goto Label4;
+    if
+      constexpr(flag) goto Label4;
     else
       goto Label5;
   }
@@ -125,7 +126,7 @@ module test {
       return False;
   }
 
-  macro GenericMacroTest<T: type>(param: T): Object {
+  macro GenericMacroTest<T : type>(param: T): Object {
     return Undefined;
   }
 
@@ -133,7 +134,7 @@ module test {
     return param2;
   }
 
-  macro GenericMacroTestWithLabels<T: type>(param: T): Object labels X {
+  macro GenericMacroTestWithLabels<T : type>(param: T): Object labels X {
     return Undefined;
   }
 
@@ -158,29 +159,29 @@ module test {
     }
   }
 
-  builtin TestHelperPlus1(context : Context, x : Smi) : Smi {
+  builtin TestHelperPlus1(context: Context, x: Smi): Smi {
     return x + 1;
   }
-  builtin TestHelperPlus2(context : Context, x : Smi) : Smi {
+  builtin TestHelperPlus2(context: Context, x: Smi): Smi {
     return x + 2;
   }
 
-  macro TestFunctionPointers(context : Context) : Boolean {
-    let fptr : builtin(Context, Smi) => Smi = TestHelperPlus1;
+  macro TestFunctionPointers(context: Context): Boolean {
+    let fptr: builtin(Context, Smi) => Smi = TestHelperPlus1;
     check(fptr(context, 42) == 43);
     fptr = TestHelperPlus2;
     check(fptr(context, 42) == 44);
     return True;
   }
 
-  macro TestVariableRedeclaration(context : Context) : Boolean {
-    let var1 : int31 = from_constexpr<bool>(42 == 0) ? 0 : 1;
-    let var2 : int31 = from_constexpr<bool>(42 == 0) ? 1 : 0;
+  macro TestVariableRedeclaration(context: Context): Boolean {
+    let var1: int31 = from_constexpr<bool>(42 == 0) ? 0 : 1;
+    let var2: int31 = from_constexpr<bool>(42 == 0) ? 1 : 0;
     return True;
   }
 
-  macro TestTernaryOperator(x : Smi) : Smi {
-    let b : bool = x < 0 ? true : false;
+  macro TestTernaryOperator(x: Smi): Smi {
+    let b: bool = x < 0 ? true : false;
     return b ? x - 10 : x + 100;
   }
 
@@ -195,7 +196,7 @@ module test {
   }
 
   type SmiToSmi = builtin(Smi) => Smi;
-  macro TestTypeAlias(x : SmiToSmi) : Code {
+  macro TestTypeAlias(x: SmiToSmi): Code {
     return x;
   }
 
@@ -221,11 +222,71 @@ module test {
 
   macro TestMultilineAssert() {
     let someVeryLongVariableNameThatWillCauseLineBreaks: Smi = 5;
-    check(someVeryLongVariableNameThatWillCauseLineBreaks > 0
-           && someVeryLongVariableNameThatWillCauseLineBreaks < 10);
+    check(
+        someVeryLongVariableNameThatWillCauseLineBreaks > 0 &&
+        someVeryLongVariableNameThatWillCauseLineBreaks < 10);
   }
 
   macro TestNewlineInString() {
     Print('Hello, World!\n');
   }
+
+  const kConstexprConst: constexpr int31 = 5;
+  const kIntptrConst: intptr = 4;
+  const kSmiConst: Smi = 3;
+
+  macro TestModuleConstBindings() {
+    check(kConstexprConst == Int32Constant(5));
+    check(kIntptrConst == 4);
+    check(kSmiConst == 3);
+  }
+
+  macro TestLocalConstBindings() {
+    const kSmi: Smi = 3;
+    check(kSmi == 3);
+  }
+
+  struct TestStructA {
+    indexes: FixedArray;
+    i: Smi;
+    k: Number;
+  }
+
+  struct TestStructB {
+    x: TestStructA;
+    y: Smi;
+  }
+
+  macro TestStruct1(i: TestStructA): Smi {
+    return i.i;
+  }
+
+  macro TestStruct2(): TestStructA {
+    return TestStructA{unsafe_cast<FixedArray>(kEmptyFixedArray), 27, 31};
+  }
+
+  macro TestStruct3(): TestStructA {
+    let a: TestStructA =
+    TestStructA{unsafe_cast<FixedArray>(kEmptyFixedArray), 13, 5};
+    let b: TestStructA = a;
+    let c: TestStructA = TestStruct2();
+    a.i = TestStruct1(c);
+    a.k = a.i;
+    let d: TestStructB;
+    d.x = a;
+    d = TestStructB{a, 7};
+    let e: TestStructA = d.x;
+    let f: Smi = TestStructA{unsafe_cast<FixedArray>(kEmptyFixedArray), 27, 31}.i;
+    f = TestStruct2().i;
+    return a;
+  }
+
+  struct TestStructC {
+    x : TestStructA;
+    y : TestStructA;
+  }
+
+  macro TestStruct4(): TestStructC {
+    return TestStructC{TestStruct2(), TestStruct2()};
+  }
 }
diff --git a/deps/v8/test/unittests/compiler/js-call-reducer-unittest.cc b/deps/v8/test/unittests/compiler/js-call-reducer-unittest.cc
index 606bca59b11f7d..1f5e666eb2542e 100644
--- a/deps/v8/test/unittests/compiler/js-call-reducer-unittest.cc
+++ b/deps/v8/test/unittests/compiler/js-call-reducer-unittest.cc
@@ -60,7 +60,7 @@ class JSCallReducerTest : public TypedGraphTest {
   Node* GlobalFunction(const char* name) {
     Handle<JSFunction> f = Handle<JSFunction>::cast(
         Object::GetProperty(
-            isolate()->global_object(),
+            isolate(), isolate()->global_object(),
             isolate()->factory()->NewStringFromAsciiChecked(name))
             .ToHandleChecked());
     return HeapConstant(f);
@@ -74,7 +74,8 @@ class JSCallReducerTest : public TypedGraphTest {
             .ToHandleChecked();
     Handle<JSFunction> f = Handle<JSFunction>::cast(
         Object::GetProperty(
-            m, isolate()->factory()->NewStringFromAsciiChecked(name.c_str()))
+            isolate(), m,
+            isolate()->factory()->NewStringFromAsciiChecked(name.c_str()))
             .ToHandleChecked());
     return HeapConstant(f);
   }
@@ -87,7 +88,7 @@ class JSCallReducerTest : public TypedGraphTest {
             .ToHandleChecked();
     Handle<JSFunction> f = Handle<JSFunction>::cast(
         Object::GetProperty(
-            m, isolate()->factory()->NewStringFromAsciiChecked(name))
+            isolate(), m, isolate()->factory()->NewStringFromAsciiChecked(name))
             .ToHandleChecked());
     return HeapConstant(f);
   }
@@ -100,7 +101,7 @@ class JSCallReducerTest : public TypedGraphTest {
             .ToHandleChecked();
     Handle<JSFunction> f = Handle<JSFunction>::cast(
         Object::GetProperty(
-            m, isolate()->factory()->NewStringFromAsciiChecked(name))
+            isolate(), m, isolate()->factory()->NewStringFromAsciiChecked(name))
             .ToHandleChecked());
     return HeapConstant(f);
   }
diff --git a/deps/v8/test/unittests/object-unittest.cc b/deps/v8/test/unittests/object-unittest.cc
index 1fe09d81c99736..0b603298ad5468 100644
--- a/deps/v8/test/unittests/object-unittest.cc
+++ b/deps/v8/test/unittests/object-unittest.cc
@@ -106,37 +106,37 @@ TEST_F(ObjectWithIsolate, DictionaryGrowth) {
   uint32_t i = 1;
   // 3 elements fit into the initial capacity.
   for (; i <= 3; i++) {
-    dict = NumberDictionary::Add(dict, i, value, details);
+    dict = NumberDictionary::Add(isolate(), dict, i, value, details);
     CHECK_EQ(4, dict->Capacity());
   }
   // 4th element triggers growth.
   DCHECK_EQ(4, i);
   for (; i <= 5; i++) {
-    dict = NumberDictionary::Add(dict, i, value, details);
+    dict = NumberDictionary::Add(isolate(), dict, i, value, details);
     CHECK_EQ(8, dict->Capacity());
   }
   // 6th element triggers growth.
   DCHECK_EQ(6, i);
   for (; i <= 11; i++) {
-    dict = NumberDictionary::Add(dict, i, value, details);
+    dict = NumberDictionary::Add(isolate(), dict, i, value, details);
     CHECK_EQ(16, dict->Capacity());
   }
   // 12th element triggers growth.
   DCHECK_EQ(12, i);
   for (; i <= 21; i++) {
-    dict = NumberDictionary::Add(dict, i, value, details);
+    dict = NumberDictionary::Add(isolate(), dict, i, value, details);
     CHECK_EQ(32, dict->Capacity());
   }
   // 22nd element triggers growth.
   DCHECK_EQ(22, i);
   for (; i <= 43; i++) {
-    dict = NumberDictionary::Add(dict, i, value, details);
+    dict = NumberDictionary::Add(isolate(), dict, i, value, details);
     CHECK_EQ(64, dict->Capacity());
   }
   // 44th element triggers growth.
   DCHECK_EQ(44, i);
   for (; i <= 50; i++) {
-    dict = NumberDictionary::Add(dict, i, value, details);
+    dict = NumberDictionary::Add(isolate(), dict, i, value, details);
     CHECK_EQ(128, dict->Capacity());
   }
 
diff --git a/deps/v8/test/unittests/strings-storage-unittest.cc b/deps/v8/test/unittests/strings-storage-unittest.cc
index dad8356ad43657..b7f95e5db15540 100644
--- a/deps/v8/test/unittests/strings-storage-unittest.cc
+++ b/deps/v8/test/unittests/strings-storage-unittest.cc
@@ -19,7 +19,7 @@ bool StringEq(const char* left, const char* right) {
 }
 
 TEST_F(StringsStorageWithIsolate, GetNameFromString) {
-  StringsStorage storage(isolate()->heap()->HashSeed());
+  StringsStorage storage;
 
   // One char strings are canonical on the v8 heap so use a 2 char string here.
   Handle<String> str = isolate()->factory()->NewStringFromAsciiChecked("xy");
@@ -40,7 +40,7 @@ TEST_F(StringsStorageWithIsolate, GetNameFromString) {
 }
 
 TEST_F(StringsStorageWithIsolate, GetNameFromSymbol) {
-  StringsStorage storage(isolate()->heap()->HashSeed());
+  StringsStorage storage;
 
   Handle<Symbol> symbol = isolate()->factory()->NewSymbol();
   const char* stored_symbol = storage.GetName(*symbol);
@@ -53,7 +53,7 @@ TEST_F(StringsStorageWithIsolate, GetNameFromSymbol) {
 }
 
 TEST_F(StringsStorageWithIsolate, GetConsName) {
-  StringsStorage storage(isolate()->heap()->HashSeed());
+  StringsStorage storage;
 
   Handle<String> str = isolate()->factory()->NewStringFromAsciiChecked("xy");
 
@@ -65,7 +65,7 @@ TEST_F(StringsStorageWithIsolate, GetConsName) {
 }
 
 TEST_F(StringsStorageWithIsolate, GetNameFromInt) {
-  StringsStorage storage(isolate()->heap()->HashSeed());
+  StringsStorage storage;
 
   const char* stored_str = storage.GetName(0);
   CHECK(StringEq("0", stored_str));
@@ -81,7 +81,7 @@ TEST_F(StringsStorageWithIsolate, GetNameFromInt) {
 }
 
 TEST_F(StringsStorageWithIsolate, Format) {
-  StringsStorage storage(isolate()->heap()->HashSeed());
+  StringsStorage storage;
 
   const char* xy = "xy";
   const char* stored_str = storage.GetFormatted("%s", xy);
@@ -99,7 +99,7 @@ TEST_F(StringsStorageWithIsolate, Format) {
 }
 
 TEST_F(StringsStorageWithIsolate, FormatAndGetShareStorage) {
-  StringsStorage storage(isolate()->heap()->HashSeed());
+  StringsStorage storage;
 
   Handle<String> str = isolate()->factory()->NewStringFromAsciiChecked("xy");
   const char* stored_str = storage.GetName(*str);
diff --git a/deps/v8/test/unittests/test-helpers.cc b/deps/v8/test/unittests/test-helpers.cc
index 1fdb6363abc847..ee601da900ff8b 100644
--- a/deps/v8/test/unittests/test-helpers.cc
+++ b/deps/v8/test/unittests/test-helpers.cc
@@ -38,15 +38,15 @@ Handle<SharedFunctionInfo> CreateSharedFunctionInfo(
       isolate->factory()->NewSharedFunctionInfoForBuiltin(
           isolate->factory()->NewStringFromAsciiChecked("f"),
           Builtins::kCompileLazy);
+  int function_literal_id = 1;
   // Ensure that the function can be compiled lazily.
   shared->set_uncompiled_data(
       *isolate->factory()->NewUncompiledDataWithoutPreParsedScope(
-          0, source->length()));
+          0, source->length(), function_literal_id));
   // Make sure we have an outer scope info, even though it's empty
   shared->set_raw_outer_scope_info_or_feedback_metadata(
       ScopeInfo::Empty(isolate));
-  shared->set_function_literal_id(1);
-  SharedFunctionInfo::SetScript(shared, script);
+  SharedFunctionInfo::SetScript(shared, script, function_literal_id);
   return scope.CloseAndEscape(shared);
 }
 
diff --git a/deps/v8/third_party/inspector_protocol/CheckProtocolCompatibility.py b/deps/v8/third_party/inspector_protocol/CheckProtocolCompatibility.py
index c70162a2a44ef0..adbc74addb551d 100755
--- a/deps/v8/third_party/inspector_protocol/CheckProtocolCompatibility.py
+++ b/deps/v8/third_party/inspector_protocol/CheckProtocolCompatibility.py
@@ -1,479 +1,11 @@
 #!/usr/bin/env python
-# Copyright (c) 2011 Google Inc. All rights reserved.
-#
-# Redistribution and use in source and binary forms, with or without
-# modification, are permitted provided that the following conditions are
-# met:
-#
-#     * Redistributions of source code must retain the above copyright
-# notice, this list of conditions and the following disclaimer.
-#     * Redistributions in binary form must reproduce the above
-# copyright notice, this list of conditions and the following disclaimer
-# in the documentation and/or other materials provided with the
-# distribution.
-#     * Neither the name of Google Inc. nor the names of its
-# contributors may be used to endorse or promote products derived from
-# this software without specific prior written permission.
-#
-# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
-# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
-# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
-# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
-# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
-# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
-# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-#
-# Inspector protocol validator.
-#
-# Tests that subsequent protocol changes are not breaking backwards compatibility.
-# Following violations are reported:
-#
-#   - Domain has been removed
-#   - Command has been removed
-#   - Required command parameter was added or changed from optional
-#   - Required response parameter was removed or changed to optional
-#   - Event has been removed
-#   - Required event parameter was removed or changed to optional
-#   - Parameter type has changed.
-#
-# For the parameters with composite types the above checks are also applied
-# recursively to every property of the type.
-#
-# Adding --show_changes to the command line prints out a list of valid public API changes.
+# Copyright 2018 The Chromium Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
 
-import copy
-import os.path
-import optparse
 import sys
 
-try:
-    import json
-except ImportError:
-    import simplejson as json
+import check_protocol_compatibility
 
 
-def list_to_map(items, key):
-    result = {}
-    for item in items:
-        if "experimental" not in item and "hidden" not in item:
-            result[item[key]] = item
-    return result
-
-
-def named_list_to_map(container, name, key):
-    if name in container:
-        return list_to_map(container[name], key)
-    return {}
-
-
-def removed(reverse):
-    if reverse:
-        return "added"
-    return "removed"
-
-
-def required(reverse):
-    if reverse:
-        return "optional"
-    return "required"
-
-
-def compare_schemas(d_1, d_2, reverse):
-    errors = []
-    domains_1 = copy.deepcopy(d_1)
-    domains_2 = copy.deepcopy(d_2)
-    types_1 = normalize_types_in_schema(domains_1)
-    types_2 = normalize_types_in_schema(domains_2)
-
-    domains_by_name_1 = list_to_map(domains_1, "domain")
-    domains_by_name_2 = list_to_map(domains_2, "domain")
-
-    for name in domains_by_name_1:
-        domain_1 = domains_by_name_1[name]
-        if name not in domains_by_name_2:
-            errors.append("%s: domain has been %s" % (name, removed(reverse)))
-            continue
-        compare_domains(domain_1, domains_by_name_2[name], types_1, types_2, errors, reverse)
-    return errors
-
-
-def compare_domains(domain_1, domain_2, types_map_1, types_map_2, errors, reverse):
-    domain_name = domain_1["domain"]
-    commands_1 = named_list_to_map(domain_1, "commands", "name")
-    commands_2 = named_list_to_map(domain_2, "commands", "name")
-    for name in commands_1:
-        command_1 = commands_1[name]
-        if name not in commands_2:
-            errors.append("%s.%s: command has been %s" % (domain_1["domain"], name, removed(reverse)))
-            continue
-        compare_commands(domain_name, command_1, commands_2[name], types_map_1, types_map_2, errors, reverse)
-
-    events_1 = named_list_to_map(domain_1, "events", "name")
-    events_2 = named_list_to_map(domain_2, "events", "name")
-    for name in events_1:
-        event_1 = events_1[name]
-        if name not in events_2:
-            errors.append("%s.%s: event has been %s" % (domain_1["domain"], name, removed(reverse)))
-            continue
-        compare_events(domain_name, event_1, events_2[name], types_map_1, types_map_2, errors, reverse)
-
-
-def compare_commands(domain_name, command_1, command_2, types_map_1, types_map_2, errors, reverse):
-    context = domain_name + "." + command_1["name"]
-
-    params_1 = named_list_to_map(command_1, "parameters", "name")
-    params_2 = named_list_to_map(command_2, "parameters", "name")
-    # Note the reversed order: we allow removing but forbid adding parameters.
-    compare_params_list(context, "parameter", params_2, params_1, types_map_2, types_map_1, 0, errors, not reverse)
-
-    returns_1 = named_list_to_map(command_1, "returns", "name")
-    returns_2 = named_list_to_map(command_2, "returns", "name")
-    compare_params_list(context, "response parameter", returns_1, returns_2, types_map_1, types_map_2, 0, errors, reverse)
-
-
-def compare_events(domain_name, event_1, event_2, types_map_1, types_map_2, errors, reverse):
-    context = domain_name + "." + event_1["name"]
-    params_1 = named_list_to_map(event_1, "parameters", "name")
-    params_2 = named_list_to_map(event_2, "parameters", "name")
-    compare_params_list(context, "parameter", params_1, params_2, types_map_1, types_map_2, 0, errors, reverse)
-
-
-def compare_params_list(context, kind, params_1, params_2, types_map_1, types_map_2, depth, errors, reverse):
-    for name in params_1:
-        param_1 = params_1[name]
-        if name not in params_2:
-            if "optional" not in param_1:
-                errors.append("%s.%s: required %s has been %s" % (context, name, kind, removed(reverse)))
-            continue
-
-        param_2 = params_2[name]
-        if param_2 and "optional" in param_2 and "optional" not in param_1:
-            errors.append("%s.%s: %s %s is now %s" % (context, name, required(reverse), kind, required(not reverse)))
-            continue
-        type_1 = extract_type(param_1, types_map_1, errors)
-        type_2 = extract_type(param_2, types_map_2, errors)
-        compare_types(context + "." + name, kind, type_1, type_2, types_map_1, types_map_2, depth, errors, reverse)
-
-
-def compare_types(context, kind, type_1, type_2, types_map_1, types_map_2, depth, errors, reverse):
-    if depth > 5:
-        return
-
-    base_type_1 = type_1["type"]
-    base_type_2 = type_2["type"]
-
-    if base_type_1 != base_type_2:
-        errors.append("%s: %s base type mismatch, '%s' vs '%s'" % (context, kind, base_type_1, base_type_2))
-    elif base_type_1 == "object":
-        params_1 = named_list_to_map(type_1, "properties", "name")
-        params_2 = named_list_to_map(type_2, "properties", "name")
-        # If both parameters have the same named type use it in the context.
-        if "id" in type_1 and "id" in type_2 and type_1["id"] == type_2["id"]:
-            type_name = type_1["id"]
-        else:
-            type_name = "<object>"
-        context += " %s->%s" % (kind, type_name)
-        compare_params_list(context, "property", params_1, params_2, types_map_1, types_map_2, depth + 1, errors, reverse)
-    elif base_type_1 == "array":
-        item_type_1 = extract_type(type_1["items"], types_map_1, errors)
-        item_type_2 = extract_type(type_2["items"], types_map_2, errors)
-        compare_types(context, kind, item_type_1, item_type_2, types_map_1, types_map_2, depth + 1, errors, reverse)
-
-
-def extract_type(typed_object, types_map, errors):
-    if "type" in typed_object:
-        result = {"id": "<transient>", "type": typed_object["type"]}
-        if typed_object["type"] == "object":
-            result["properties"] = []
-        elif typed_object["type"] == "array":
-            result["items"] = typed_object["items"]
-        return result
-    elif "$ref" in typed_object:
-        ref = typed_object["$ref"]
-        if ref not in types_map:
-            errors.append("Can not resolve type: %s" % ref)
-            types_map[ref] = {"id": "<transient>", "type": "object"}
-        return types_map[ref]
-
-
-def normalize_types_in_schema(domains):
-    types = {}
-    for domain in domains:
-        domain_name = domain["domain"]
-        normalize_types(domain, domain_name, types)
-    return types
-
-
-def normalize_types(obj, domain_name, types):
-    if isinstance(obj, list):
-        for item in obj:
-            normalize_types(item, domain_name, types)
-    elif isinstance(obj, dict):
-        for key, value in obj.items():
-            if key == "$ref" and value.find(".") == -1:
-                obj[key] = "%s.%s" % (domain_name, value)
-            elif key == "id":
-                obj[key] = "%s.%s" % (domain_name, value)
-                types[obj[key]] = obj
-            else:
-                normalize_types(value, domain_name, types)
-
-
-def load_schema(file_name, domains):
-    # pylint: disable=W0613
-    if not os.path.isfile(file_name):
-        return
-    input_file = open(file_name, "r")
-    json_string = input_file.read()
-    parsed_json = json.loads(json_string)
-    domains += parsed_json["domains"]
-    return parsed_json["version"]
-
-
-def self_test():
-    def create_test_schema_1():
-        return [
-            {
-                "domain": "Network",
-                "types": [
-                    {
-                        "id": "LoaderId",
-                        "type": "string"
-                    },
-                    {
-                        "id": "Headers",
-                        "type": "object"
-                    },
-                    {
-                        "id": "Request",
-                        "type": "object",
-                        "properties": [
-                            {"name": "url", "type": "string"},
-                            {"name": "method", "type": "string"},
-                            {"name": "headers", "$ref": "Headers"},
-                            {"name": "becameOptionalField", "type": "string"},
-                            {"name": "removedField", "type": "string"},
-                        ]
-                    }
-                ],
-                "commands": [
-                    {
-                        "name": "removedCommand",
-                    },
-                    {
-                        "name": "setExtraHTTPHeaders",
-                        "parameters": [
-                            {"name": "headers", "$ref": "Headers"},
-                            {"name": "mismatched", "type": "string"},
-                            {"name": "becameOptional", "$ref": "Headers"},
-                            {"name": "removedRequired", "$ref": "Headers"},
-                            {"name": "becameRequired", "$ref": "Headers", "optional": True},
-                            {"name": "removedOptional", "$ref": "Headers", "optional": True},
-                        ],
-                        "returns": [
-                            {"name": "mimeType", "type": "string"},
-                            {"name": "becameOptional", "type": "string"},
-                            {"name": "removedRequired", "type": "string"},
-                            {"name": "becameRequired", "type": "string", "optional": True},
-                            {"name": "removedOptional", "type": "string", "optional": True},
-                        ]
-                    }
-                ],
-                "events": [
-                    {
-                        "name": "requestWillBeSent",
-                        "parameters": [
-                            {"name": "frameId", "type": "string", "experimental": True},
-                            {"name": "request", "$ref": "Request"},
-                            {"name": "becameOptional", "type": "string"},
-                            {"name": "removedRequired", "type": "string"},
-                            {"name": "becameRequired", "type": "string", "optional": True},
-                            {"name": "removedOptional", "type": "string", "optional": True},
-                        ]
-                    },
-                    {
-                        "name": "removedEvent",
-                        "parameters": [
-                            {"name": "errorText", "type": "string"},
-                            {"name": "canceled", "type": "boolean", "optional": True}
-                        ]
-                    }
-                ]
-            },
-            {
-                "domain":  "removedDomain"
-            }
-        ]
-
-    def create_test_schema_2():
-        return [
-            {
-                "domain": "Network",
-                "types": [
-                    {
-                        "id": "LoaderId",
-                        "type": "string"
-                    },
-                    {
-                        "id": "Request",
-                        "type": "object",
-                        "properties": [
-                            {"name": "url", "type": "string"},
-                            {"name": "method", "type": "string"},
-                            {"name": "headers", "type": "object"},
-                            {"name": "becameOptionalField", "type": "string", "optional": True},
-                        ]
-                    }
-                ],
-                "commands": [
-                    {
-                        "name": "addedCommand",
-                    },
-                    {
-                        "name": "setExtraHTTPHeaders",
-                        "parameters": [
-                            {"name": "headers", "type": "object"},
-                            {"name": "mismatched", "type": "object"},
-                            {"name": "becameOptional", "type": "object", "optional": True},
-                            {"name": "addedRequired", "type": "object"},
-                            {"name": "becameRequired", "type": "object"},
-                            {"name": "addedOptional", "type": "object", "optional": True},
-                        ],
-                        "returns": [
-                            {"name": "mimeType", "type": "string"},
-                            {"name": "becameOptional", "type": "string", "optional": True},
-                            {"name": "addedRequired", "type": "string"},
-                            {"name": "becameRequired", "type": "string"},
-                            {"name": "addedOptional", "type": "string", "optional": True},
-                        ]
-                    }
-                ],
-                "events": [
-                    {
-                        "name": "requestWillBeSent",
-                        "parameters": [
-                            {"name": "request", "$ref": "Request"},
-                            {"name": "becameOptional", "type": "string", "optional": True},
-                            {"name": "addedRequired", "type": "string"},
-                            {"name": "becameRequired", "type": "string"},
-                            {"name": "addedOptional", "type": "string", "optional": True},
-                        ]
-                    },
-                    {
-                        "name": "addedEvent"
-                    }
-                ]
-            },
-            {
-                "domain": "addedDomain"
-            }
-        ]
-
-    expected_errors = [
-        "removedDomain: domain has been removed",
-        "Network.removedCommand: command has been removed",
-        "Network.removedEvent: event has been removed",
-        "Network.setExtraHTTPHeaders.mismatched: parameter base type mismatch, 'object' vs 'string'",
-        "Network.setExtraHTTPHeaders.addedRequired: required parameter has been added",
-        "Network.setExtraHTTPHeaders.becameRequired: optional parameter is now required",
-        "Network.setExtraHTTPHeaders.removedRequired: required response parameter has been removed",
-        "Network.setExtraHTTPHeaders.becameOptional: required response parameter is now optional",
-        "Network.requestWillBeSent.removedRequired: required parameter has been removed",
-        "Network.requestWillBeSent.becameOptional: required parameter is now optional",
-        "Network.requestWillBeSent.request parameter->Network.Request.removedField: required property has been removed",
-        "Network.requestWillBeSent.request parameter->Network.Request.becameOptionalField: required property is now optional",
-    ]
-
-    expected_errors_reverse = [
-        "addedDomain: domain has been added",
-        "Network.addedEvent: event has been added",
-        "Network.addedCommand: command has been added",
-        "Network.setExtraHTTPHeaders.mismatched: parameter base type mismatch, 'string' vs 'object'",
-        "Network.setExtraHTTPHeaders.removedRequired: required parameter has been removed",
-        "Network.setExtraHTTPHeaders.becameOptional: required parameter is now optional",
-        "Network.setExtraHTTPHeaders.addedRequired: required response parameter has been added",
-        "Network.setExtraHTTPHeaders.becameRequired: optional response parameter is now required",
-        "Network.requestWillBeSent.becameRequired: optional parameter is now required",
-        "Network.requestWillBeSent.addedRequired: required parameter has been added",
-    ]
-
-    def is_subset(subset, superset, message):
-        for i in range(len(subset)):
-            if subset[i] not in superset:
-                sys.stderr.write("%s error: %s\n" % (message, subset[i]))
-                return False
-        return True
-
-    def errors_match(expected, actual):
-        return (is_subset(actual, expected, "Unexpected") and
-                is_subset(expected, actual, "Missing"))
-
-    return (errors_match(expected_errors,
-                         compare_schemas(create_test_schema_1(), create_test_schema_2(), False)) and
-            errors_match(expected_errors_reverse,
-                         compare_schemas(create_test_schema_2(), create_test_schema_1(), True)))
-
-
-def load_domains_and_baselines(file_name, domains, baseline_domains):
-    version = load_schema(os.path.normpath(file_name), domains)
-    suffix = "-%s.%s.json" % (version["major"], version["minor"])
-    baseline_file = file_name.replace(".json", suffix)
-    load_schema(os.path.normpath(baseline_file), baseline_domains)
-    return version
-
-
-def main():
-    if not self_test():
-        sys.stderr.write("Self-test failed")
-        return 1
-
-    cmdline_parser = optparse.OptionParser()
-    cmdline_parser.add_option("--show_changes")
-    cmdline_parser.add_option("--expected_errors")
-    cmdline_parser.add_option("--stamp")
-    arg_options, arg_values = cmdline_parser.parse_args()
-
-    if len(arg_values) < 1:
-        sys.stderr.write("Usage: %s [--show_changes] <protocol-1> [, <protocol-2>...]\n" % sys.argv[0])
-        return 1
-
-    domains = []
-    baseline_domains = []
-    version = load_domains_and_baselines(arg_values[0], domains, baseline_domains)
-    for dependency in arg_values[1:]:
-        load_domains_and_baselines(dependency, domains, baseline_domains)
-
-    expected_errors = []
-    if arg_options.expected_errors:
-        expected_errors_file = open(arg_options.expected_errors, "r")
-        expected_errors = json.loads(expected_errors_file.read())["errors"]
-        expected_errors_file.close()
-
-    errors = compare_schemas(baseline_domains, domains, False)
-    unexpected_errors = []
-    for i in range(len(errors)):
-        if errors[i] not in expected_errors:
-            unexpected_errors.append(errors[i])
-    if len(unexpected_errors) > 0:
-        sys.stderr.write("  Compatibility checks FAILED\n")
-        for error in unexpected_errors:
-            sys.stderr.write("    %s\n" % error)
-        return 1
-
-    if arg_options.show_changes:
-        changes = compare_schemas(domains, baseline_domains, True)
-        if len(changes) > 0:
-            print "  Public changes since %s:" % version
-            for change in changes:
-                print "    %s" % change
-
-    if arg_options.stamp:
-        with open(arg_options.stamp, 'a') as _:
-            pass
-
-if __name__ == '__main__':
-    sys.exit(main())
+sys.exit(check_protocol_compatibility.main())
diff --git a/deps/v8/third_party/inspector_protocol/CodeGenerator.py b/deps/v8/third_party/inspector_protocol/CodeGenerator.py
old mode 100644
new mode 100755
index e630b02985710f..4882ed9da5820e
--- a/deps/v8/third_party/inspector_protocol/CodeGenerator.py
+++ b/deps/v8/third_party/inspector_protocol/CodeGenerator.py
@@ -1,654 +1,6 @@
+#!/usr/bin/env python
 # Copyright 2016 The Chromium Authors. All rights reserved.
 # Use of this source code is governed by a BSD-style license that can be
 # found in the LICENSE file.
 
-import os.path
-import sys
-import optparse
-import collections
-import functools
-import re
-import copy
-try:
-    import json
-except ImportError:
-    import simplejson as json
-
-# Path handling for libraries and templates
-# Paths have to be normalized because Jinja uses the exact template path to
-# determine the hash used in the cache filename, and we need a pre-caching step
-# to be concurrency-safe. Use absolute path because __file__ is absolute if
-# module is imported, and relative if executed directly.
-# If paths differ between pre-caching and individual file compilation, the cache
-# is regenerated, which causes a race condition and breaks concurrent build,
-# since some compile processes will try to read the partially written cache.
-module_path, module_filename = os.path.split(os.path.realpath(__file__))
-
-def read_config():
-    # pylint: disable=W0703
-    def json_to_object(data, output_base, config_base):
-        def json_object_hook(object_dict):
-            items = [(k, os.path.join(config_base, v) if k == "path" else v) for (k, v) in object_dict.items()]
-            items = [(k, os.path.join(output_base, v) if k == "output" else v) for (k, v) in items]
-            keys, values = zip(*items)
-            return collections.namedtuple('X', keys)(*values)
-        return json.loads(data, object_hook=json_object_hook)
-
-    def init_defaults(config_tuple, path, defaults):
-        keys = list(config_tuple._fields)  # pylint: disable=E1101
-        values = [getattr(config_tuple, k) for k in keys]
-        for i in xrange(len(keys)):
-            if hasattr(values[i], "_fields"):
-                values[i] = init_defaults(values[i], path + "." + keys[i], defaults)
-        for optional in defaults:
-            if optional.find(path + ".") != 0:
-                continue
-            optional_key = optional[len(path) + 1:]
-            if optional_key.find(".") == -1 and optional_key not in keys:
-                keys.append(optional_key)
-                values.append(defaults[optional])
-        return collections.namedtuple('X', keys)(*values)
-
-    try:
-        cmdline_parser = optparse.OptionParser()
-        cmdline_parser.add_option("--output_base")
-        cmdline_parser.add_option("--jinja_dir")
-        cmdline_parser.add_option("--config")
-        cmdline_parser.add_option("--config_value", action="append", type="string")
-        arg_options, _ = cmdline_parser.parse_args()
-        jinja_dir = arg_options.jinja_dir
-        if not jinja_dir:
-            raise Exception("jinja directory must be specified")
-        jinja_dir = jinja_dir.decode('utf8')
-        output_base = arg_options.output_base
-        if not output_base:
-            raise Exception("Base output directory must be specified")
-        output_base = output_base.decode('utf8')
-        config_file = arg_options.config
-        if not config_file:
-            raise Exception("Config file name must be specified")
-        config_file = config_file.decode('utf8')
-        config_base = os.path.dirname(config_file)
-        config_values = arg_options.config_value
-        if not config_values:
-            config_values = []
-    except Exception:
-        # Work with python 2 and 3 http://docs.python.org/py3k/howto/pyporting.html
-        exc = sys.exc_info()[1]
-        sys.stderr.write("Failed to parse command-line arguments: %s\n\n" % exc)
-        exit(1)
-
-    try:
-        config_json_file = open(config_file, "r")
-        config_json_string = config_json_file.read()
-        config_partial = json_to_object(config_json_string, output_base, config_base)
-        config_json_file.close()
-        defaults = {
-            ".use_snake_file_names": False,
-            ".use_title_case_methods": False,
-            ".imported": False,
-            ".imported.export_macro": "",
-            ".imported.export_header": False,
-            ".imported.header": False,
-            ".imported.package": False,
-            ".imported.options": False,
-            ".protocol.export_macro": "",
-            ".protocol.export_header": False,
-            ".protocol.options": False,
-            ".exported": False,
-            ".exported.export_macro": "",
-            ".exported.export_header": False,
-            ".lib": False,
-            ".lib.export_macro": "",
-            ".lib.export_header": False,
-        }
-        for key_value in config_values:
-            parts = key_value.split("=")
-            if len(parts) == 2:
-                defaults["." + parts[0]] = parts[1]
-        return (jinja_dir, config_file, init_defaults(config_partial, "", defaults))
-    except Exception:
-        # Work with python 2 and 3 http://docs.python.org/py3k/howto/pyporting.html
-        exc = sys.exc_info()[1]
-        sys.stderr.write("Failed to parse config file: %s\n\n" % exc)
-        exit(1)
-
-
-# ---- Begin of utilities exposed to generator ----
-
-
-def to_title_case(name):
-    return name[:1].upper() + name[1:]
-
-
-def dash_to_camelcase(word):
-    prefix = ""
-    if word[0] == "-":
-        prefix = "Negative"
-        word = word[1:]
-    return prefix + "".join(to_title_case(x) or "-" for x in word.split("-"))
-
-
-def to_snake_case(name):
-    return re.sub(r"([a-z0-9])([A-Z])", r"\1_\2", name, sys.maxint).lower()
-
-
-def to_method_case(config, name):
-    if config.use_title_case_methods:
-        return to_title_case(name)
-    return name
-
-
-def join_arrays(dict, keys):
-    result = []
-    for key in keys:
-        if key in dict:
-            result += dict[key]
-    return result
-
-
-def format_include(config, header, file_name=None):
-    if file_name is not None:
-        header = header + "/" + file_name + ".h"
-    header = "\"" + header + "\"" if header[0] not in "<\"" else header
-    if config.use_snake_file_names:
-        header = to_snake_case(header)
-    return header
-
-
-def to_file_name(config, file_name):
-    if config.use_snake_file_names:
-        return to_snake_case(file_name).replace(".cpp", ".cc")
-    return file_name
-
-
-# ---- End of utilities exposed to generator ----
-
-
-def initialize_jinja_env(jinja_dir, cache_dir, config):
-    # pylint: disable=F0401
-    sys.path.insert(1, os.path.abspath(jinja_dir))
-    import jinja2
-
-    jinja_env = jinja2.Environment(
-        loader=jinja2.FileSystemLoader(module_path),
-        # Bytecode cache is not concurrency-safe unless pre-cached:
-        # if pre-cached this is read-only, but writing creates a race condition.
-        bytecode_cache=jinja2.FileSystemBytecodeCache(cache_dir),
-        keep_trailing_newline=True,  # newline-terminate generated files
-        lstrip_blocks=True,  # so can indent control flow tags
-        trim_blocks=True)
-    jinja_env.filters.update({"to_title_case": to_title_case, "dash_to_camelcase": dash_to_camelcase, "to_method_case": functools.partial(to_method_case, config)})
-    jinja_env.add_extension("jinja2.ext.loopcontrols")
-    return jinja_env
-
-
-def create_imported_type_definition(domain_name, type, imported_namespace):
-    # pylint: disable=W0622
-    return {
-        "return_type": "std::unique_ptr<%s::%s::API::%s>" % (imported_namespace, domain_name, type["id"]),
-        "pass_type": "std::unique_ptr<%s::%s::API::%s>" % (imported_namespace, domain_name, type["id"]),
-        "to_raw_type": "%s.get()",
-        "to_pass_type": "std::move(%s)",
-        "to_rvalue": "std::move(%s)",
-        "type": "std::unique_ptr<%s::%s::API::%s>" % (imported_namespace, domain_name, type["id"]),
-        "raw_type": "%s::%s::API::%s" % (imported_namespace, domain_name, type["id"]),
-        "raw_pass_type": "%s::%s::API::%s*" % (imported_namespace, domain_name, type["id"]),
-        "raw_return_type": "%s::%s::API::%s*" % (imported_namespace, domain_name, type["id"]),
-    }
-
-
-def create_user_type_definition(domain_name, type):
-    # pylint: disable=W0622
-    return {
-        "return_type": "std::unique_ptr<protocol::%s::%s>" % (domain_name, type["id"]),
-        "pass_type": "std::unique_ptr<protocol::%s::%s>" % (domain_name, type["id"]),
-        "to_raw_type": "%s.get()",
-        "to_pass_type": "std::move(%s)",
-        "to_rvalue": "std::move(%s)",
-        "type": "std::unique_ptr<protocol::%s::%s>" % (domain_name, type["id"]),
-        "raw_type": "protocol::%s::%s" % (domain_name, type["id"]),
-        "raw_pass_type": "protocol::%s::%s*" % (domain_name, type["id"]),
-        "raw_return_type": "protocol::%s::%s*" % (domain_name, type["id"]),
-    }
-
-
-def create_object_type_definition():
-    # pylint: disable=W0622
-    return {
-        "return_type": "std::unique_ptr<protocol::DictionaryValue>",
-        "pass_type": "std::unique_ptr<protocol::DictionaryValue>",
-        "to_raw_type": "%s.get()",
-        "to_pass_type": "std::move(%s)",
-        "to_rvalue": "std::move(%s)",
-        "type": "std::unique_ptr<protocol::DictionaryValue>",
-        "raw_type": "protocol::DictionaryValue",
-        "raw_pass_type": "protocol::DictionaryValue*",
-        "raw_return_type": "protocol::DictionaryValue*",
-    }
-
-
-def create_any_type_definition():
-    # pylint: disable=W0622
-    return {
-        "return_type": "std::unique_ptr<protocol::Value>",
-        "pass_type": "std::unique_ptr<protocol::Value>",
-        "to_raw_type": "%s.get()",
-        "to_pass_type": "std::move(%s)",
-        "to_rvalue": "std::move(%s)",
-        "type": "std::unique_ptr<protocol::Value>",
-        "raw_type": "protocol::Value",
-        "raw_pass_type": "protocol::Value*",
-        "raw_return_type": "protocol::Value*",
-    }
-
-
-def create_string_type_definition():
-    # pylint: disable=W0622
-    return {
-        "return_type": "String",
-        "pass_type": "const String&",
-        "to_pass_type": "%s",
-        "to_raw_type": "%s",
-        "to_rvalue": "%s",
-        "type": "String",
-        "raw_type": "String",
-        "raw_pass_type": "const String&",
-        "raw_return_type": "String",
-    }
-
-
-def create_primitive_type_definition(type):
-    # pylint: disable=W0622
-    typedefs = {
-        "number": "double",
-        "integer": "int",
-        "boolean": "bool"
-    }
-    defaults = {
-        "number": "0",
-        "integer": "0",
-        "boolean": "false"
-    }
-    jsontypes = {
-        "number": "TypeDouble",
-        "integer": "TypeInteger",
-        "boolean": "TypeBoolean",
-    }
-    return {
-        "return_type": typedefs[type],
-        "pass_type": typedefs[type],
-        "to_pass_type": "%s",
-        "to_raw_type": "%s",
-        "to_rvalue": "%s",
-        "type": typedefs[type],
-        "raw_type": typedefs[type],
-        "raw_pass_type": typedefs[type],
-        "raw_return_type": typedefs[type],
-        "default_value": defaults[type]
-    }
-
-
-def wrap_array_definition(type):
-    # pylint: disable=W0622
-    return {
-        "return_type": "std::unique_ptr<protocol::Array<%s>>" % type["raw_type"],
-        "pass_type": "std::unique_ptr<protocol::Array<%s>>" % type["raw_type"],
-        "to_raw_type": "%s.get()",
-        "to_pass_type": "std::move(%s)",
-        "to_rvalue": "std::move(%s)",
-        "type": "std::unique_ptr<protocol::Array<%s>>" % type["raw_type"],
-        "raw_type": "protocol::Array<%s>" % type["raw_type"],
-        "raw_pass_type": "protocol::Array<%s>*" % type["raw_type"],
-        "raw_return_type": "protocol::Array<%s>*" % type["raw_type"],
-        "out_type": "protocol::Array<%s>&" % type["raw_type"],
-    }
-
-
-class Protocol(object):
-    def __init__(self, config):
-        self.config = config
-        self.json_api = {"domains": []}
-        self.imported_domains = []
-        self.exported_domains = []
-        self.generate_domains = self.read_protocol_file(config.protocol.path)
-
-        if config.protocol.options:
-            self.generate_domains = [rule.domain for rule in config.protocol.options]
-            self.exported_domains = [rule.domain for rule in config.protocol.options if hasattr(rule, "exported")]
-
-        if config.imported:
-            self.imported_domains = self.read_protocol_file(config.imported.path)
-            if config.imported.options:
-                self.imported_domains = [rule.domain for rule in config.imported.options]
-
-        self.patch_full_qualified_refs()
-        self.create_notification_types()
-        self.create_type_definitions()
-        self.generate_used_types()
-
-
-    def read_protocol_file(self, file_name):
-        input_file = open(file_name, "r")
-        json_string = input_file.read()
-        input_file.close()
-        parsed_json = json.loads(json_string)
-        version = parsed_json["version"]["major"] + "." + parsed_json["version"]["minor"]
-        domains = []
-        for domain in parsed_json["domains"]:
-            domains.append(domain["domain"])
-            domain["version"] = version
-        self.json_api["domains"] += parsed_json["domains"]
-        return domains
-
-
-    def patch_full_qualified_refs(self):
-        def patch_full_qualified_refs_in_domain(json, domain_name):
-            if isinstance(json, list):
-                for item in json:
-                    patch_full_qualified_refs_in_domain(item, domain_name)
-            if not isinstance(json, dict):
-                return
-            for key in json:
-                if key == "type" and json[key] == "string":
-                    json[key] = domain_name + ".string"
-                if key != "$ref":
-                    patch_full_qualified_refs_in_domain(json[key], domain_name)
-                    continue
-                if json["$ref"].find(".") == -1:
-                    json["$ref"] = domain_name + "." + json["$ref"]
-            return
-
-        for domain in self.json_api["domains"]:
-            patch_full_qualified_refs_in_domain(domain, domain["domain"])
-
-
-    def all_references(self, json):
-        refs = set()
-        if isinstance(json, list):
-            for item in json:
-                refs |= self.all_references(item)
-        if not isinstance(json, dict):
-            return refs
-        for key in json:
-            if key != "$ref":
-                refs |= self.all_references(json[key])
-            else:
-                refs.add(json["$ref"])
-        return refs
-
-    def generate_used_types(self):
-        all_refs = set()
-        for domain in self.json_api["domains"]:
-            domain_name = domain["domain"]
-            if "commands" in domain:
-                for command in domain["commands"]:
-                    if self.generate_command(domain_name, command["name"]):
-                        all_refs |= self.all_references(command)
-            if "events" in domain:
-                for event in domain["events"]:
-                    if self.generate_event(domain_name, event["name"]):
-                        all_refs |= self.all_references(event)
-                        all_refs.add(domain_name + "." + to_title_case(event["name"]) + "Notification")
-
-        dependencies = self.generate_type_dependencies()
-        queue = set(all_refs)
-        while len(queue):
-            ref = queue.pop()
-            if ref in dependencies:
-                queue |= dependencies[ref] - all_refs
-                all_refs |= dependencies[ref]
-        self.used_types = all_refs
-
-
-    def generate_type_dependencies(self):
-        dependencies = dict()
-        domains_with_types = (x for x in self.json_api["domains"] if "types" in x)
-        for domain in domains_with_types:
-            domain_name = domain["domain"]
-            for type in domain["types"]:
-                related_types = self.all_references(type)
-                if len(related_types):
-                    dependencies[domain_name + "." + type["id"]] = related_types
-        return dependencies
-
-
-    def create_notification_types(self):
-        for domain in self.json_api["domains"]:
-            if "events" in domain:
-                for event in domain["events"]:
-                    event_type = dict()
-                    event_type["description"] = "Wrapper for notification params"
-                    event_type["type"] = "object"
-                    event_type["id"] = to_title_case(event["name"]) + "Notification"
-                    if "parameters" in event:
-                        event_type["properties"] = copy.deepcopy(event["parameters"])
-                    if "types" not in domain:
-                        domain["types"] = list()
-                    domain["types"].append(event_type)
-
-
-    def create_type_definitions(self):
-        imported_namespace = "::".join(self.config.imported.namespace) if self.config.imported else ""
-        self.type_definitions = {}
-        self.type_definitions["number"] = create_primitive_type_definition("number")
-        self.type_definitions["integer"] = create_primitive_type_definition("integer")
-        self.type_definitions["boolean"] = create_primitive_type_definition("boolean")
-        self.type_definitions["object"] = create_object_type_definition()
-        self.type_definitions["any"] = create_any_type_definition()
-        for domain in self.json_api["domains"]:
-            self.type_definitions[domain["domain"] + ".string"] = create_string_type_definition()
-            if not ("types" in domain):
-                continue
-            for type in domain["types"]:
-                type_name = domain["domain"] + "." + type["id"]
-                if type["type"] == "object" and domain["domain"] in self.imported_domains:
-                    self.type_definitions[type_name] = create_imported_type_definition(domain["domain"], type, imported_namespace)
-                elif type["type"] == "object":
-                    self.type_definitions[type_name] = create_user_type_definition(domain["domain"], type)
-                elif type["type"] == "array":
-                    items_type = type["items"]["type"]
-                    self.type_definitions[type_name] = wrap_array_definition(self.type_definitions[items_type])
-                elif type["type"] == domain["domain"] + ".string":
-                    self.type_definitions[type_name] = create_string_type_definition()
-                else:
-                    self.type_definitions[type_name] = create_primitive_type_definition(type["type"])
-
-
-    def check_options(self, options, domain, name, include_attr, exclude_attr, default):
-        for rule in options:
-            if rule.domain != domain:
-                continue
-            if include_attr and hasattr(rule, include_attr):
-                return name in getattr(rule, include_attr)
-            if exclude_attr and hasattr(rule, exclude_attr):
-                return name not in getattr(rule, exclude_attr)
-            return default
-        return False
-
-
-    # ---- Begin of methods exposed to generator
-
-
-    def type_definition(self, name):
-        return self.type_definitions[name]
-
-
-    def resolve_type(self, prop):
-        if "$ref" in prop:
-            return self.type_definitions[prop["$ref"]]
-        if prop["type"] == "array":
-            return wrap_array_definition(self.resolve_type(prop["items"]))
-        return self.type_definitions[prop["type"]]
-
-
-    def generate_command(self, domain, command):
-        if not self.config.protocol.options:
-            return domain in self.generate_domains
-        return self.check_options(self.config.protocol.options, domain, command, "include", "exclude", True)
-
-
-    def generate_event(self, domain, event):
-        if not self.config.protocol.options:
-            return domain in self.generate_domains
-        return self.check_options(self.config.protocol.options, domain, event, "include_events", "exclude_events", True)
-
-
-    def generate_type(self, domain, typename):
-        return domain + "." + typename in self.used_types
-
-
-    def is_async_command(self, domain, command):
-        if not self.config.protocol.options:
-            return False
-        return self.check_options(self.config.protocol.options, domain, command, "async", None, False)
-
-
-    def is_exported(self, domain, name):
-        if not self.config.protocol.options:
-            return False
-        return self.check_options(self.config.protocol.options, domain, name, "exported", None, False)
-
-
-    def is_imported(self, domain, name):
-        if not self.config.imported:
-            return False
-        if not self.config.imported.options:
-            return domain in self.imported_domains
-        return self.check_options(self.config.imported.options, domain, name, "imported", None, False)
-
-
-    def is_exported_domain(self, domain):
-        return domain in self.exported_domains
-
-
-    def generate_disable(self, domain):
-        if "commands" not in domain:
-            return True
-        for command in domain["commands"]:
-            if command["name"] == "disable" and self.generate_command(domain["domain"], "disable"):
-                return False
-        return True
-
-
-    def is_imported_dependency(self, domain):
-        return domain in self.generate_domains or domain in self.imported_domains
-
-
-def main():
-    jinja_dir, config_file, config = read_config()
-
-    protocol = Protocol(config)
-
-    if not config.exported and len(protocol.exported_domains):
-        sys.stderr.write("Domains [%s] are exported, but config is missing export entry\n\n" % ", ".join(protocol.exported_domains))
-        exit(1)
-
-    if not os.path.exists(config.protocol.output):
-        os.mkdir(config.protocol.output)
-    if len(protocol.exported_domains) and not os.path.exists(config.exported.output):
-        os.mkdir(config.exported.output)
-    jinja_env = initialize_jinja_env(jinja_dir, config.protocol.output, config)
-
-    inputs = []
-    inputs.append(__file__)
-    inputs.append(config_file)
-    inputs.append(config.protocol.path)
-    if config.imported:
-        inputs.append(config.imported.path)
-    templates_dir = os.path.join(module_path, "templates")
-    inputs.append(os.path.join(templates_dir, "TypeBuilder_h.template"))
-    inputs.append(os.path.join(templates_dir, "TypeBuilder_cpp.template"))
-    inputs.append(os.path.join(templates_dir, "Exported_h.template"))
-    inputs.append(os.path.join(templates_dir, "Imported_h.template"))
-
-    h_template = jinja_env.get_template("templates/TypeBuilder_h.template")
-    cpp_template = jinja_env.get_template("templates/TypeBuilder_cpp.template")
-    exported_template = jinja_env.get_template("templates/Exported_h.template")
-    imported_template = jinja_env.get_template("templates/Imported_h.template")
-
-    outputs = dict()
-
-    for domain in protocol.json_api["domains"]:
-        class_name = domain["domain"]
-        template_context = {
-            "protocol": protocol,
-            "config": config,
-            "domain": domain,
-            "join_arrays": join_arrays,
-            "format_include": functools.partial(format_include, config),
-        }
-
-        if domain["domain"] in protocol.generate_domains:
-            outputs[os.path.join(config.protocol.output, to_file_name(config, class_name + ".h"))] = h_template.render(template_context)
-            outputs[os.path.join(config.protocol.output, to_file_name(config, class_name + ".cpp"))] = cpp_template.render(template_context)
-            if domain["domain"] in protocol.exported_domains:
-                outputs[os.path.join(config.exported.output, to_file_name(config, class_name + ".h"))] = exported_template.render(template_context)
-        if domain["domain"] in protocol.imported_domains:
-            outputs[os.path.join(config.protocol.output, to_file_name(config, class_name + ".h"))] = imported_template.render(template_context)
-
-    if config.lib:
-        template_context = {
-            "config": config,
-            "format_include": functools.partial(format_include, config),
-        }
-
-        lib_templates_dir = os.path.join(module_path, "lib")
-        # Note these should be sorted in the right order.
-        # TODO(dgozman): sort them programmatically based on commented includes.
-        lib_h_templates = [
-            "Collections_h.template",
-            "ErrorSupport_h.template",
-            "Values_h.template",
-            "Object_h.template",
-            "ValueConversions_h.template",
-            "Maybe_h.template",
-            "Array_h.template",
-            "DispatcherBase_h.template",
-            "Parser_h.template",
-        ]
-
-        lib_cpp_templates = [
-            "Protocol_cpp.template",
-            "ErrorSupport_cpp.template",
-            "Values_cpp.template",
-            "Object_cpp.template",
-            "DispatcherBase_cpp.template",
-            "Parser_cpp.template",
-        ]
-
-        forward_h_templates = [
-            "Forward_h.template",
-            "Allocator_h.template",
-            "FrontendChannel_h.template",
-        ]
-
-        def generate_lib_file(file_name, template_files):
-            parts = []
-            for template_file in template_files:
-                inputs.append(os.path.join(lib_templates_dir, template_file))
-                template = jinja_env.get_template("lib/" + template_file)
-                parts.append(template.render(template_context))
-            outputs[file_name] = "\n\n".join(parts)
-
-        generate_lib_file(os.path.join(config.lib.output, to_file_name(config, "Forward.h")), forward_h_templates)
-        generate_lib_file(os.path.join(config.lib.output, to_file_name(config, "Protocol.h")), lib_h_templates)
-        generate_lib_file(os.path.join(config.lib.output, to_file_name(config, "Protocol.cpp")), lib_cpp_templates)
-
-    # Make gyp / make generatos happy, otherwise make rebuilds world.
-    inputs_ts = max(map(os.path.getmtime, inputs))
-    up_to_date = True
-    for output_file in outputs.iterkeys():
-        if not os.path.exists(output_file) or os.path.getmtime(output_file) < inputs_ts:
-            up_to_date = False
-            break
-    if up_to_date:
-        sys.exit()
-
-    for file_name, content in outputs.iteritems():
-        out_file = open(file_name, "w")
-        out_file.write(content)
-        out_file.close()
-
-
-main()
+import code_generator
diff --git a/deps/v8/third_party/inspector_protocol/ConvertProtocolToJSON.py b/deps/v8/third_party/inspector_protocol/ConvertProtocolToJSON.py
old mode 100644
new mode 100755
index 56fc09d78cb18f..6cfdc7fa07f058
--- a/deps/v8/third_party/inspector_protocol/ConvertProtocolToJSON.py
+++ b/deps/v8/third_party/inspector_protocol/ConvertProtocolToJSON.py
@@ -1,183 +1,10 @@
-# Copyright 2017 The Chromium Authors. All rights reserved.
+#!/usr/bin/env python
+# Copyright 2018 The Chromium Authors. All rights reserved.
 # Use of this source code is governed by a BSD-style license that can be
 # found in the LICENSE file.
 
-import collections
-import json
-import os.path
-import re
-import sys
+import convert_protocol_to_json
 
-file_name = None
-description = ''
 
-primitiveTypes = ['integer', 'number', 'boolean', 'string', 'object', 'any', 'array']
-
-
-def assignType(item, type, isArray=False):
-    if isArray:
-        item['type'] = 'array'
-        item['items'] = collections.OrderedDict()
-        assignType(item['items'], type)
-        return
-
-    if type == 'enum':
-        type = 'string'
-    if type in primitiveTypes:
-        item['type'] = type
-    else:
-        item['$ref'] = type
-
-
-def createItem(d, experimental, deprecated, name=None):
-    result = collections.OrderedDict(d)
-    if name:
-        result['name'] = name
-    global description
-    if description:
-        result['description'] = description.strip()
-    if experimental:
-        result['experimental'] = True
-    if deprecated:
-        result['deprecated'] = True
-    return result
-
-
-def parse(data):
-    protocol = collections.OrderedDict()
-    protocol['version'] = collections.OrderedDict()
-    protocol['domains'] = []
-    domain = None
-    item = None
-    subitems = None
-    nukeDescription = False
-    global description
-    lines = data.split('\n')
-    for i in range(0, len(lines)):
-        if nukeDescription:
-            description = ''
-            nukeDescription = False
-        line = lines[i]
-        trimLine = line.strip()
-
-        if trimLine.startswith('#'):
-            if len(description):
-              description += '\n'
-            description += trimLine[2:]
-            continue
-        else:
-            nukeDescription = True
-
-        if len(trimLine) == 0:
-            continue
-
-        match = re.compile('^(experimental )?(deprecated )?domain (.*)').match(line)
-        if match:
-            domain = createItem({'domain' : match.group(3)}, match.group(1), match.group(2))
-            protocol['domains'].append(domain)
-            continue
-
-        match = re.compile('^  depends on ([^\s]+)').match(line)
-        if match:
-            if 'dependencies' not in domain:
-                domain['dependencies'] = []
-            domain['dependencies'].append(match.group(1))
-            continue
-
-        match = re.compile('^  (experimental )?(deprecated )?type (.*) extends (array of )?([^\s]+)').match(line)
-        if match:
-            if 'types' not in domain:
-                domain['types'] = []
-            item = createItem({'id': match.group(3)}, match.group(1), match.group(2))
-            assignType(item, match.group(5), match.group(4))
-            domain['types'].append(item)
-            continue
-
-        match = re.compile('^  (experimental )?(deprecated )?(command|event) (.*)').match(line)
-        if match:
-            list = []
-            if match.group(3) == 'command':
-                if 'commands' in domain:
-                    list = domain['commands']
-                else:
-                    list = domain['commands'] = []
-            else:
-                if 'events' in domain:
-                    list = domain['events']
-                else:
-                    list = domain['events'] = []
-
-            item = createItem({}, match.group(1), match.group(2), match.group(4))
-            list.append(item)
-            continue
-
-        match = re.compile('^      (experimental )?(deprecated )?(optional )?(array of )?([^\s]+) ([^\s]+)').match(line)
-        if match:
-            param = createItem({}, match.group(1), match.group(2), match.group(6))
-            if match.group(3):
-                param['optional'] = True
-            assignType(param, match.group(5), match.group(4))
-            if match.group(5) == 'enum':
-                enumliterals = param['enum'] = []
-            subitems.append(param)
-            continue
-
-        match = re.compile('^    (parameters|returns|properties)').match(line)
-        if match:
-            subitems = item[match.group(1)] = []
-            continue
-
-        match = re.compile('^    enum').match(line)
-        if match:
-            enumliterals = item['enum'] = []
-            continue
-
-        match = re.compile('^version').match(line)
-        if match:
-            continue
-
-        match = re.compile('^  major (\d+)').match(line)
-        if match:
-            protocol['version']['major'] = match.group(1)
-            continue
-
-        match = re.compile('^  minor (\d+)').match(line)
-        if match:
-            protocol['version']['minor'] = match.group(1)
-            continue
-
-        match = re.compile('^    redirect ([^\s]+)').match(line)
-        if match:
-            item['redirect'] = match.group(1)
-            continue
-
-        match = re.compile('^      (  )?[^\s]+$').match(line)
-        if match:
-            # enum literal
-            enumliterals.append(trimLine)
-            continue
-
-        print 'Error in %s:%s, illegal token: \t%s' % (file_name, i, line)
-        sys.exit(1)
-    return protocol
-
-def main(argv):
-    if len(argv) < 2:
-        sys.stderr.write("Usage: %s <protocol.pdl> <protocol.json>\n" % sys.argv[0])
-        return 1
-    global file_name
-    file_name = os.path.normpath(argv[0])
-    input_file = open(file_name, "r")
-    pdl_string = input_file.read()
-    protocol = parse(pdl_string)
-    output_file = open(argv[0].replace('.pdl', '.json'), 'wb')
-    json.dump(protocol, output_file, indent=4, separators=(',', ': '))
-    output_file.close()
-
-    output_file = open(os.path.normpath(argv[1]), 'wb')
-    json.dump(protocol, output_file, indent=4, separators=(',', ': '))
-    output_file.close()
-
-
-if __name__ == '__main__':
-    sys.exit(main(sys.argv[1:]))
+def main():
+  convert_protocol_to_json.main()
diff --git a/deps/v8/third_party/inspector_protocol/README.md b/deps/v8/third_party/inspector_protocol/README.md
new file mode 100644
index 00000000000000..54b7c129292ecf
--- /dev/null
+++ b/deps/v8/third_party/inspector_protocol/README.md
@@ -0,0 +1,10 @@
+# Chromium inspector (devtools) protocol
+
+This package contains code generators and templates for the Chromium
+inspector protocol.
+
+In the Chromium tree, it's rolled into
+https://cs.chromium.org/chromium/src/third_party/inspector_protocol/
+
+In the V8 tree, it's rolled into
+https://cs.chromium.org/chromium/src/v8/third_party/inspector_protocol/
diff --git a/deps/v8/third_party/inspector_protocol/README.v8 b/deps/v8/third_party/inspector_protocol/README.v8
index 8a82f2a9c9d691..1ae51d18a27640 100644
--- a/deps/v8/third_party/inspector_protocol/README.v8
+++ b/deps/v8/third_party/inspector_protocol/README.v8
@@ -2,7 +2,7 @@ Name: inspector protocol
 Short Name: inspector_protocol
 URL: https://chromium.googlesource.com/deps/inspector_protocol/
 Version: 0
-Revision: 752d4abd13119010cf30e454e8ef9b5fb7ef43a3
+Revision: 0d4255502019144a5dec5669d7992165ae8924e7
 License: BSD
 License File: LICENSE
 Security Critical: no
diff --git a/deps/v8/third_party/inspector_protocol/check_protocol_compatibility.py b/deps/v8/third_party/inspector_protocol/check_protocol_compatibility.py
new file mode 100755
index 00000000000000..7e7d9af3d63c1d
--- /dev/null
+++ b/deps/v8/third_party/inspector_protocol/check_protocol_compatibility.py
@@ -0,0 +1,482 @@
+#!/usr/bin/env python
+# Copyright (c) 2011 Google Inc. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions are
+# met:
+#
+#     * Redistributions of source code must retain the above copyright
+# notice, this list of conditions and the following disclaimer.
+#     * Redistributions in binary form must reproduce the above
+# copyright notice, this list of conditions and the following disclaimer
+# in the documentation and/or other materials provided with the
+# distribution.
+#     * Neither the name of Google Inc. nor the names of its
+# contributors may be used to endorse or promote products derived from
+# this software without specific prior written permission.
+#
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+#
+# Inspector protocol validator.
+#
+# Tests that subsequent protocol changes are not breaking backwards compatibility.
+# Following violations are reported:
+#
+#   - Domain has been removed
+#   - Command has been removed
+#   - Required command parameter was added or changed from optional
+#   - Required response parameter was removed or changed to optional
+#   - Event has been removed
+#   - Required event parameter was removed or changed to optional
+#   - Parameter type has changed.
+#
+# For the parameters with composite types the above checks are also applied
+# recursively to every property of the type.
+#
+# Adding --show_changes to the command line prints out a list of valid public API changes.
+
+import copy
+import os.path
+import optparse
+import sys
+
+import pdl
+
+try:
+    import json
+except ImportError:
+    import simplejson as json
+
+
+def list_to_map(items, key):
+    result = {}
+    for item in items:
+        if "experimental" not in item and "hidden" not in item:
+            result[item[key]] = item
+    return result
+
+
+def named_list_to_map(container, name, key):
+    if name in container:
+        return list_to_map(container[name], key)
+    return {}
+
+
+def removed(reverse):
+    if reverse:
+        return "added"
+    return "removed"
+
+
+def required(reverse):
+    if reverse:
+        return "optional"
+    return "required"
+
+
+def compare_schemas(d_1, d_2, reverse):
+    errors = []
+    domains_1 = copy.deepcopy(d_1)
+    domains_2 = copy.deepcopy(d_2)
+    types_1 = normalize_types_in_schema(domains_1)
+    types_2 = normalize_types_in_schema(domains_2)
+
+    domains_by_name_1 = list_to_map(domains_1, "domain")
+    domains_by_name_2 = list_to_map(domains_2, "domain")
+
+    for name in domains_by_name_1:
+        domain_1 = domains_by_name_1[name]
+        if name not in domains_by_name_2:
+            errors.append("%s: domain has been %s" % (name, removed(reverse)))
+            continue
+        compare_domains(domain_1, domains_by_name_2[name], types_1, types_2, errors, reverse)
+    return errors
+
+
+def compare_domains(domain_1, domain_2, types_map_1, types_map_2, errors, reverse):
+    domain_name = domain_1["domain"]
+    commands_1 = named_list_to_map(domain_1, "commands", "name")
+    commands_2 = named_list_to_map(domain_2, "commands", "name")
+    for name in commands_1:
+        command_1 = commands_1[name]
+        if name not in commands_2:
+            errors.append("%s.%s: command has been %s" % (domain_1["domain"], name, removed(reverse)))
+            continue
+        compare_commands(domain_name, command_1, commands_2[name], types_map_1, types_map_2, errors, reverse)
+
+    events_1 = named_list_to_map(domain_1, "events", "name")
+    events_2 = named_list_to_map(domain_2, "events", "name")
+    for name in events_1:
+        event_1 = events_1[name]
+        if name not in events_2:
+            errors.append("%s.%s: event has been %s" % (domain_1["domain"], name, removed(reverse)))
+            continue
+        compare_events(domain_name, event_1, events_2[name], types_map_1, types_map_2, errors, reverse)
+
+
+def compare_commands(domain_name, command_1, command_2, types_map_1, types_map_2, errors, reverse):
+    context = domain_name + "." + command_1["name"]
+
+    params_1 = named_list_to_map(command_1, "parameters", "name")
+    params_2 = named_list_to_map(command_2, "parameters", "name")
+    # Note the reversed order: we allow removing but forbid adding parameters.
+    compare_params_list(context, "parameter", params_2, params_1, types_map_2, types_map_1, 0, errors, not reverse)
+
+    returns_1 = named_list_to_map(command_1, "returns", "name")
+    returns_2 = named_list_to_map(command_2, "returns", "name")
+    compare_params_list(context, "response parameter", returns_1, returns_2, types_map_1, types_map_2, 0, errors, reverse)
+
+
+def compare_events(domain_name, event_1, event_2, types_map_1, types_map_2, errors, reverse):
+    context = domain_name + "." + event_1["name"]
+    params_1 = named_list_to_map(event_1, "parameters", "name")
+    params_2 = named_list_to_map(event_2, "parameters", "name")
+    compare_params_list(context, "parameter", params_1, params_2, types_map_1, types_map_2, 0, errors, reverse)
+
+
+def compare_params_list(context, kind, params_1, params_2, types_map_1, types_map_2, depth, errors, reverse):
+    for name in params_1:
+        param_1 = params_1[name]
+        if name not in params_2:
+            if "optional" not in param_1:
+                errors.append("%s.%s: required %s has been %s" % (context, name, kind, removed(reverse)))
+            continue
+
+        param_2 = params_2[name]
+        if param_2 and "optional" in param_2 and "optional" not in param_1:
+            errors.append("%s.%s: %s %s is now %s" % (context, name, required(reverse), kind, required(not reverse)))
+            continue
+        type_1 = extract_type(param_1, types_map_1, errors)
+        type_2 = extract_type(param_2, types_map_2, errors)
+        compare_types(context + "." + name, kind, type_1, type_2, types_map_1, types_map_2, depth, errors, reverse)
+
+
+def compare_types(context, kind, type_1, type_2, types_map_1, types_map_2, depth, errors, reverse):
+    if depth > 5:
+        return
+
+    base_type_1 = type_1["type"]
+    base_type_2 = type_2["type"]
+
+    if base_type_1 != base_type_2:
+        errors.append("%s: %s base type mismatch, '%s' vs '%s'" % (context, kind, base_type_1, base_type_2))
+    elif base_type_1 == "object":
+        params_1 = named_list_to_map(type_1, "properties", "name")
+        params_2 = named_list_to_map(type_2, "properties", "name")
+        # If both parameters have the same named type use it in the context.
+        if "id" in type_1 and "id" in type_2 and type_1["id"] == type_2["id"]:
+            type_name = type_1["id"]
+        else:
+            type_name = "<object>"
+        context += " %s->%s" % (kind, type_name)
+        compare_params_list(context, "property", params_1, params_2, types_map_1, types_map_2, depth + 1, errors, reverse)
+    elif base_type_1 == "array":
+        item_type_1 = extract_type(type_1["items"], types_map_1, errors)
+        item_type_2 = extract_type(type_2["items"], types_map_2, errors)
+        compare_types(context, kind, item_type_1, item_type_2, types_map_1, types_map_2, depth + 1, errors, reverse)
+
+
+def extract_type(typed_object, types_map, errors):
+    if "type" in typed_object:
+        result = {"id": "<transient>", "type": typed_object["type"]}
+        if typed_object["type"] == "object":
+            result["properties"] = []
+        elif typed_object["type"] == "array":
+            result["items"] = typed_object["items"]
+        return result
+    elif "$ref" in typed_object:
+        ref = typed_object["$ref"]
+        if ref not in types_map:
+            errors.append("Can not resolve type: %s" % ref)
+            types_map[ref] = {"id": "<transient>", "type": "object"}
+        return types_map[ref]
+
+
+def normalize_types_in_schema(domains):
+    types = {}
+    for domain in domains:
+        domain_name = domain["domain"]
+        normalize_types(domain, domain_name, types)
+    return types
+
+
+def normalize_types(obj, domain_name, types):
+    if isinstance(obj, list):
+        for item in obj:
+            normalize_types(item, domain_name, types)
+    elif isinstance(obj, dict):
+        for key, value in obj.items():
+            if key == "$ref" and value.find(".") == -1:
+                obj[key] = "%s.%s" % (domain_name, value)
+            elif key == "id":
+                obj[key] = "%s.%s" % (domain_name, value)
+                types[obj[key]] = obj
+            else:
+                normalize_types(value, domain_name, types)
+
+
+def load_schema(file_name, domains):
+    # pylint: disable=W0613
+    if not os.path.isfile(file_name):
+        return
+    input_file = open(file_name, "r")
+    parsed_json = pdl.loads(input_file.read(), file_name)
+    input_file.close()
+    domains += parsed_json["domains"]
+    return parsed_json["version"]
+
+
+def self_test():
+    def create_test_schema_1():
+        return [
+            {
+                "domain": "Network",
+                "types": [
+                    {
+                        "id": "LoaderId",
+                        "type": "string"
+                    },
+                    {
+                        "id": "Headers",
+                        "type": "object"
+                    },
+                    {
+                        "id": "Request",
+                        "type": "object",
+                        "properties": [
+                            {"name": "url", "type": "string"},
+                            {"name": "method", "type": "string"},
+                            {"name": "headers", "$ref": "Headers"},
+                            {"name": "becameOptionalField", "type": "string"},
+                            {"name": "removedField", "type": "string"},
+                        ]
+                    }
+                ],
+                "commands": [
+                    {
+                        "name": "removedCommand",
+                    },
+                    {
+                        "name": "setExtraHTTPHeaders",
+                        "parameters": [
+                            {"name": "headers", "$ref": "Headers"},
+                            {"name": "mismatched", "type": "string"},
+                            {"name": "becameOptional", "$ref": "Headers"},
+                            {"name": "removedRequired", "$ref": "Headers"},
+                            {"name": "becameRequired", "$ref": "Headers", "optional": True},
+                            {"name": "removedOptional", "$ref": "Headers", "optional": True},
+                        ],
+                        "returns": [
+                            {"name": "mimeType", "type": "string"},
+                            {"name": "becameOptional", "type": "string"},
+                            {"name": "removedRequired", "type": "string"},
+                            {"name": "becameRequired", "type": "string", "optional": True},
+                            {"name": "removedOptional", "type": "string", "optional": True},
+                        ]
+                    }
+                ],
+                "events": [
+                    {
+                        "name": "requestWillBeSent",
+                        "parameters": [
+                            {"name": "frameId", "type": "string", "experimental": True},
+                            {"name": "request", "$ref": "Request"},
+                            {"name": "becameOptional", "type": "string"},
+                            {"name": "removedRequired", "type": "string"},
+                            {"name": "becameRequired", "type": "string", "optional": True},
+                            {"name": "removedOptional", "type": "string", "optional": True},
+                        ]
+                    },
+                    {
+                        "name": "removedEvent",
+                        "parameters": [
+                            {"name": "errorText", "type": "string"},
+                            {"name": "canceled", "type": "boolean", "optional": True}
+                        ]
+                    }
+                ]
+            },
+            {
+                "domain":  "removedDomain"
+            }
+        ]
+
+    def create_test_schema_2():
+        return [
+            {
+                "domain": "Network",
+                "types": [
+                    {
+                        "id": "LoaderId",
+                        "type": "string"
+                    },
+                    {
+                        "id": "Request",
+                        "type": "object",
+                        "properties": [
+                            {"name": "url", "type": "string"},
+                            {"name": "method", "type": "string"},
+                            {"name": "headers", "type": "object"},
+                            {"name": "becameOptionalField", "type": "string", "optional": True},
+                        ]
+                    }
+                ],
+                "commands": [
+                    {
+                        "name": "addedCommand",
+                    },
+                    {
+                        "name": "setExtraHTTPHeaders",
+                        "parameters": [
+                            {"name": "headers", "type": "object"},
+                            {"name": "mismatched", "type": "object"},
+                            {"name": "becameOptional", "type": "object", "optional": True},
+                            {"name": "addedRequired", "type": "object"},
+                            {"name": "becameRequired", "type": "object"},
+                            {"name": "addedOptional", "type": "object", "optional": True},
+                        ],
+                        "returns": [
+                            {"name": "mimeType", "type": "string"},
+                            {"name": "becameOptional", "type": "string", "optional": True},
+                            {"name": "addedRequired", "type": "string"},
+                            {"name": "becameRequired", "type": "string"},
+                            {"name": "addedOptional", "type": "string", "optional": True},
+                        ]
+                    }
+                ],
+                "events": [
+                    {
+                        "name": "requestWillBeSent",
+                        "parameters": [
+                            {"name": "request", "$ref": "Request"},
+                            {"name": "becameOptional", "type": "string", "optional": True},
+                            {"name": "addedRequired", "type": "string"},
+                            {"name": "becameRequired", "type": "string"},
+                            {"name": "addedOptional", "type": "string", "optional": True},
+                        ]
+                    },
+                    {
+                        "name": "addedEvent"
+                    }
+                ]
+            },
+            {
+                "domain": "addedDomain"
+            }
+        ]
+
+    expected_errors = [
+        "removedDomain: domain has been removed",
+        "Network.removedCommand: command has been removed",
+        "Network.removedEvent: event has been removed",
+        "Network.setExtraHTTPHeaders.mismatched: parameter base type mismatch, 'object' vs 'string'",
+        "Network.setExtraHTTPHeaders.addedRequired: required parameter has been added",
+        "Network.setExtraHTTPHeaders.becameRequired: optional parameter is now required",
+        "Network.setExtraHTTPHeaders.removedRequired: required response parameter has been removed",
+        "Network.setExtraHTTPHeaders.becameOptional: required response parameter is now optional",
+        "Network.requestWillBeSent.removedRequired: required parameter has been removed",
+        "Network.requestWillBeSent.becameOptional: required parameter is now optional",
+        "Network.requestWillBeSent.request parameter->Network.Request.removedField: required property has been removed",
+        "Network.requestWillBeSent.request parameter->Network.Request.becameOptionalField: required property is now optional",
+    ]
+
+    expected_errors_reverse = [
+        "addedDomain: domain has been added",
+        "Network.addedEvent: event has been added",
+        "Network.addedCommand: command has been added",
+        "Network.setExtraHTTPHeaders.mismatched: parameter base type mismatch, 'string' vs 'object'",
+        "Network.setExtraHTTPHeaders.removedRequired: required parameter has been removed",
+        "Network.setExtraHTTPHeaders.becameOptional: required parameter is now optional",
+        "Network.setExtraHTTPHeaders.addedRequired: required response parameter has been added",
+        "Network.setExtraHTTPHeaders.becameRequired: optional response parameter is now required",
+        "Network.requestWillBeSent.becameRequired: optional parameter is now required",
+        "Network.requestWillBeSent.addedRequired: required parameter has been added",
+    ]
+
+    def is_subset(subset, superset, message):
+        for i in range(len(subset)):
+            if subset[i] not in superset:
+                sys.stderr.write("%s error: %s\n" % (message, subset[i]))
+                return False
+        return True
+
+    def errors_match(expected, actual):
+        return (is_subset(actual, expected, "Unexpected") and
+                is_subset(expected, actual, "Missing"))
+
+    return (errors_match(expected_errors,
+                         compare_schemas(create_test_schema_1(), create_test_schema_2(), False)) and
+            errors_match(expected_errors_reverse,
+                         compare_schemas(create_test_schema_2(), create_test_schema_1(), True)))
+
+
+def load_domains_and_baselines(file_name, domains, baseline_domains):
+    version = load_schema(os.path.normpath(file_name), domains)
+    suffix = "-%s.%s.json" % (version["major"], version["minor"])
+    baseline_file = file_name.replace(".json", suffix)
+    baseline_file = file_name.replace(".pdl", suffix)
+    load_schema(os.path.normpath(baseline_file), baseline_domains)
+    return version
+
+
+def main():
+    if not self_test():
+        sys.stderr.write("Self-test failed")
+        return 1
+
+    cmdline_parser = optparse.OptionParser()
+    cmdline_parser.add_option("--show_changes")
+    cmdline_parser.add_option("--expected_errors")
+    cmdline_parser.add_option("--stamp")
+    arg_options, arg_values = cmdline_parser.parse_args()
+
+    if len(arg_values) < 1:
+        sys.stderr.write("Usage: %s [--show_changes] <protocol-1> [, <protocol-2>...]\n" % sys.argv[0])
+        return 1
+
+    domains = []
+    baseline_domains = []
+    version = load_domains_and_baselines(arg_values[0], domains, baseline_domains)
+    for dependency in arg_values[1:]:
+        load_domains_and_baselines(dependency, domains, baseline_domains)
+
+    expected_errors = []
+    if arg_options.expected_errors:
+        expected_errors_file = open(arg_options.expected_errors, "r")
+        expected_errors = json.loads(expected_errors_file.read())["errors"]
+        expected_errors_file.close()
+
+    errors = compare_schemas(baseline_domains, domains, False)
+    unexpected_errors = []
+    for i in range(len(errors)):
+        if errors[i] not in expected_errors:
+            unexpected_errors.append(errors[i])
+    if len(unexpected_errors) > 0:
+        sys.stderr.write("  Compatibility checks FAILED\n")
+        for error in unexpected_errors:
+            sys.stderr.write("    %s\n" % error)
+        return 1
+
+    if arg_options.show_changes:
+        changes = compare_schemas(domains, baseline_domains, True)
+        if len(changes) > 0:
+            print "  Public changes since %s:" % version
+            for change in changes:
+                print "    %s" % change
+
+    if arg_options.stamp:
+        with open(arg_options.stamp, 'a') as _:
+            pass
+
+if __name__ == '__main__':
+    sys.exit(main())
diff --git a/deps/v8/third_party/inspector_protocol/code_generator.py b/deps/v8/third_party/inspector_protocol/code_generator.py
new file mode 100755
index 00000000000000..da220fdbea3b10
--- /dev/null
+++ b/deps/v8/third_party/inspector_protocol/code_generator.py
@@ -0,0 +1,661 @@
+#!/usr/bin/env python
+# Copyright 2016 The Chromium Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+import os.path
+import sys
+import optparse
+import collections
+import functools
+import re
+import copy
+try:
+    import json
+except ImportError:
+    import simplejson as json
+
+import pdl
+
+# Path handling for libraries and templates
+# Paths have to be normalized because Jinja uses the exact template path to
+# determine the hash used in the cache filename, and we need a pre-caching step
+# to be concurrency-safe. Use absolute path because __file__ is absolute if
+# module is imported, and relative if executed directly.
+# If paths differ between pre-caching and individual file compilation, the cache
+# is regenerated, which causes a race condition and breaks concurrent build,
+# since some compile processes will try to read the partially written cache.
+module_path, module_filename = os.path.split(os.path.realpath(__file__))
+
+def read_config():
+    # pylint: disable=W0703
+    def json_to_object(data, output_base, config_base):
+        def json_object_hook(object_dict):
+            items = [(k, os.path.join(config_base, v) if k == "path" else v) for (k, v) in object_dict.items()]
+            items = [(k, os.path.join(output_base, v) if k == "output" else v) for (k, v) in items]
+            keys, values = zip(*items)
+            return collections.namedtuple('X', keys)(*values)
+        return json.loads(data, object_hook=json_object_hook)
+
+    def init_defaults(config_tuple, path, defaults):
+        keys = list(config_tuple._fields)  # pylint: disable=E1101
+        values = [getattr(config_tuple, k) for k in keys]
+        for i in xrange(len(keys)):
+            if hasattr(values[i], "_fields"):
+                values[i] = init_defaults(values[i], path + "." + keys[i], defaults)
+        for optional in defaults:
+            if optional.find(path + ".") != 0:
+                continue
+            optional_key = optional[len(path) + 1:]
+            if optional_key.find(".") == -1 and optional_key not in keys:
+                keys.append(optional_key)
+                values.append(defaults[optional])
+        return collections.namedtuple('X', keys)(*values)
+
+    try:
+        cmdline_parser = optparse.OptionParser()
+        cmdline_parser.add_option("--output_base")
+        cmdline_parser.add_option("--jinja_dir")
+        cmdline_parser.add_option("--config")
+        cmdline_parser.add_option("--config_value", action="append", type="string")
+        arg_options, _ = cmdline_parser.parse_args()
+        jinja_dir = arg_options.jinja_dir
+        if not jinja_dir:
+            raise Exception("jinja directory must be specified")
+        jinja_dir = jinja_dir.decode('utf8')
+        output_base = arg_options.output_base
+        if not output_base:
+            raise Exception("Base output directory must be specified")
+        output_base = output_base.decode('utf8')
+        config_file = arg_options.config
+        if not config_file:
+            raise Exception("Config file name must be specified")
+        config_file = config_file.decode('utf8')
+        config_base = os.path.dirname(config_file)
+        config_values = arg_options.config_value
+        if not config_values:
+            config_values = []
+    except Exception:
+        # Work with python 2 and 3 http://docs.python.org/py3k/howto/pyporting.html
+        exc = sys.exc_info()[1]
+        sys.stderr.write("Failed to parse command-line arguments: %s\n\n" % exc)
+        exit(1)
+
+    try:
+        config_json_file = open(config_file, "r")
+        config_json_string = config_json_file.read()
+        config_partial = json_to_object(config_json_string, output_base, config_base)
+        config_json_file.close()
+        defaults = {
+            ".use_snake_file_names": False,
+            ".use_title_case_methods": False,
+            ".imported": False,
+            ".imported.export_macro": "",
+            ".imported.export_header": False,
+            ".imported.header": False,
+            ".imported.package": False,
+            ".imported.options": False,
+            ".protocol.export_macro": "",
+            ".protocol.export_header": False,
+            ".protocol.options": False,
+            ".protocol.file_name_prefix": "",
+            ".exported": False,
+            ".exported.export_macro": "",
+            ".exported.export_header": False,
+            ".lib": False,
+            ".lib.export_macro": "",
+            ".lib.export_header": False,
+        }
+        for key_value in config_values:
+            parts = key_value.split("=")
+            if len(parts) == 2:
+                defaults["." + parts[0]] = parts[1]
+        return (jinja_dir, config_file, init_defaults(config_partial, "", defaults))
+    except Exception:
+        # Work with python 2 and 3 http://docs.python.org/py3k/howto/pyporting.html
+        exc = sys.exc_info()[1]
+        sys.stderr.write("Failed to parse config file: %s\n\n" % exc)
+        exit(1)
+
+
+# ---- Begin of utilities exposed to generator ----
+
+
+def to_title_case(name):
+    return name[:1].upper() + name[1:]
+
+
+def dash_to_camelcase(word):
+    prefix = ""
+    if word[0] == "-":
+        prefix = "Negative"
+        word = word[1:]
+    return prefix + "".join(to_title_case(x) or "-" for x in word.split("-"))
+
+
+def to_snake_case(name):
+    return re.sub(r"([a-z0-9])([A-Z])", r"\1_\2", name, sys.maxint).lower()
+
+
+def to_method_case(config, name):
+    if config.use_title_case_methods:
+        return to_title_case(name)
+    return name
+
+
+def join_arrays(dict, keys):
+    result = []
+    for key in keys:
+        if key in dict:
+            result += dict[key]
+    return result
+
+
+def format_include(config, header, file_name=None):
+    if file_name is not None:
+        header = header + "/" + file_name + ".h"
+    header = "\"" + header + "\"" if header[0] not in "<\"" else header
+    if config.use_snake_file_names:
+        header = to_snake_case(header)
+    return header
+
+
+def format_domain_include(config, header, file_name):
+    return format_include(config, header, config.protocol.file_name_prefix + file_name)
+
+
+def to_file_name(config, file_name):
+    if config.use_snake_file_names:
+        return to_snake_case(file_name).replace(".cpp", ".cc")
+    return file_name
+
+
+# ---- End of utilities exposed to generator ----
+
+
+def initialize_jinja_env(jinja_dir, cache_dir, config):
+    # pylint: disable=F0401
+    sys.path.insert(1, os.path.abspath(jinja_dir))
+    import jinja2
+
+    jinja_env = jinja2.Environment(
+        loader=jinja2.FileSystemLoader(module_path),
+        # Bytecode cache is not concurrency-safe unless pre-cached:
+        # if pre-cached this is read-only, but writing creates a race condition.
+        bytecode_cache=jinja2.FileSystemBytecodeCache(cache_dir),
+        keep_trailing_newline=True,  # newline-terminate generated files
+        lstrip_blocks=True,  # so can indent control flow tags
+        trim_blocks=True)
+    jinja_env.filters.update({"to_title_case": to_title_case, "dash_to_camelcase": dash_to_camelcase, "to_method_case": functools.partial(to_method_case, config)})
+    jinja_env.add_extension("jinja2.ext.loopcontrols")
+    return jinja_env
+
+
+def create_imported_type_definition(domain_name, type, imported_namespace):
+    # pylint: disable=W0622
+    return {
+        "return_type": "std::unique_ptr<%s::%s::API::%s>" % (imported_namespace, domain_name, type["id"]),
+        "pass_type": "std::unique_ptr<%s::%s::API::%s>" % (imported_namespace, domain_name, type["id"]),
+        "to_raw_type": "%s.get()",
+        "to_pass_type": "std::move(%s)",
+        "to_rvalue": "std::move(%s)",
+        "type": "std::unique_ptr<%s::%s::API::%s>" % (imported_namespace, domain_name, type["id"]),
+        "raw_type": "%s::%s::API::%s" % (imported_namespace, domain_name, type["id"]),
+        "raw_pass_type": "%s::%s::API::%s*" % (imported_namespace, domain_name, type["id"]),
+        "raw_return_type": "%s::%s::API::%s*" % (imported_namespace, domain_name, type["id"]),
+    }
+
+
+def create_user_type_definition(domain_name, type):
+    # pylint: disable=W0622
+    return {
+        "return_type": "std::unique_ptr<protocol::%s::%s>" % (domain_name, type["id"]),
+        "pass_type": "std::unique_ptr<protocol::%s::%s>" % (domain_name, type["id"]),
+        "to_raw_type": "%s.get()",
+        "to_pass_type": "std::move(%s)",
+        "to_rvalue": "std::move(%s)",
+        "type": "std::unique_ptr<protocol::%s::%s>" % (domain_name, type["id"]),
+        "raw_type": "protocol::%s::%s" % (domain_name, type["id"]),
+        "raw_pass_type": "protocol::%s::%s*" % (domain_name, type["id"]),
+        "raw_return_type": "protocol::%s::%s*" % (domain_name, type["id"]),
+    }
+
+
+def create_object_type_definition():
+    # pylint: disable=W0622
+    return {
+        "return_type": "std::unique_ptr<protocol::DictionaryValue>",
+        "pass_type": "std::unique_ptr<protocol::DictionaryValue>",
+        "to_raw_type": "%s.get()",
+        "to_pass_type": "std::move(%s)",
+        "to_rvalue": "std::move(%s)",
+        "type": "std::unique_ptr<protocol::DictionaryValue>",
+        "raw_type": "protocol::DictionaryValue",
+        "raw_pass_type": "protocol::DictionaryValue*",
+        "raw_return_type": "protocol::DictionaryValue*",
+    }
+
+
+def create_any_type_definition():
+    # pylint: disable=W0622
+    return {
+        "return_type": "std::unique_ptr<protocol::Value>",
+        "pass_type": "std::unique_ptr<protocol::Value>",
+        "to_raw_type": "%s.get()",
+        "to_pass_type": "std::move(%s)",
+        "to_rvalue": "std::move(%s)",
+        "type": "std::unique_ptr<protocol::Value>",
+        "raw_type": "protocol::Value",
+        "raw_pass_type": "protocol::Value*",
+        "raw_return_type": "protocol::Value*",
+    }
+
+
+def create_string_type_definition():
+    # pylint: disable=W0622
+    return {
+        "return_type": "String",
+        "pass_type": "const String&",
+        "to_pass_type": "%s",
+        "to_raw_type": "%s",
+        "to_rvalue": "%s",
+        "type": "String",
+        "raw_type": "String",
+        "raw_pass_type": "const String&",
+        "raw_return_type": "String",
+    }
+
+
+def create_primitive_type_definition(type):
+    # pylint: disable=W0622
+    typedefs = {
+        "number": "double",
+        "integer": "int",
+        "boolean": "bool"
+    }
+    defaults = {
+        "number": "0",
+        "integer": "0",
+        "boolean": "false"
+    }
+    jsontypes = {
+        "number": "TypeDouble",
+        "integer": "TypeInteger",
+        "boolean": "TypeBoolean",
+    }
+    return {
+        "return_type": typedefs[type],
+        "pass_type": typedefs[type],
+        "to_pass_type": "%s",
+        "to_raw_type": "%s",
+        "to_rvalue": "%s",
+        "type": typedefs[type],
+        "raw_type": typedefs[type],
+        "raw_pass_type": typedefs[type],
+        "raw_return_type": typedefs[type],
+        "default_value": defaults[type]
+    }
+
+
+def wrap_array_definition(type):
+    # pylint: disable=W0622
+    return {
+        "return_type": "std::unique_ptr<protocol::Array<%s>>" % type["raw_type"],
+        "pass_type": "std::unique_ptr<protocol::Array<%s>>" % type["raw_type"],
+        "to_raw_type": "%s.get()",
+        "to_pass_type": "std::move(%s)",
+        "to_rvalue": "std::move(%s)",
+        "type": "std::unique_ptr<protocol::Array<%s>>" % type["raw_type"],
+        "raw_type": "protocol::Array<%s>" % type["raw_type"],
+        "raw_pass_type": "protocol::Array<%s>*" % type["raw_type"],
+        "raw_return_type": "protocol::Array<%s>*" % type["raw_type"],
+        "out_type": "protocol::Array<%s>&" % type["raw_type"],
+    }
+
+
+class Protocol(object):
+    def __init__(self, config):
+        self.config = config
+        self.json_api = {"domains": []}
+        self.imported_domains = []
+        self.exported_domains = []
+        self.generate_domains = self.read_protocol_file(config.protocol.path)
+
+        if config.protocol.options:
+            self.generate_domains = [rule.domain for rule in config.protocol.options]
+            self.exported_domains = [rule.domain for rule in config.protocol.options if hasattr(rule, "exported")]
+
+        if config.imported:
+            self.imported_domains = self.read_protocol_file(config.imported.path)
+            if config.imported.options:
+                self.imported_domains = [rule.domain for rule in config.imported.options]
+
+        self.patch_full_qualified_refs()
+        self.create_notification_types()
+        self.create_type_definitions()
+        self.generate_used_types()
+
+
+    def read_protocol_file(self, file_name):
+        input_file = open(file_name, "r")
+        parsed_json = pdl.loads(input_file.read(), file_name)
+        input_file.close()
+        version = parsed_json["version"]["major"] + "." + parsed_json["version"]["minor"]
+        domains = []
+        for domain in parsed_json["domains"]:
+            domains.append(domain["domain"])
+            domain["version"] = version
+        self.json_api["domains"] += parsed_json["domains"]
+        return domains
+
+
+    def patch_full_qualified_refs(self):
+        def patch_full_qualified_refs_in_domain(json, domain_name):
+            if isinstance(json, list):
+                for item in json:
+                    patch_full_qualified_refs_in_domain(item, domain_name)
+            if not isinstance(json, dict):
+                return
+            for key in json:
+                if key == "type" and json[key] == "string":
+                    json[key] = domain_name + ".string"
+                if key != "$ref":
+                    patch_full_qualified_refs_in_domain(json[key], domain_name)
+                    continue
+                if json["$ref"].find(".") == -1:
+                    json["$ref"] = domain_name + "." + json["$ref"]
+            return
+
+        for domain in self.json_api["domains"]:
+            patch_full_qualified_refs_in_domain(domain, domain["domain"])
+
+
+    def all_references(self, json):
+        refs = set()
+        if isinstance(json, list):
+            for item in json:
+                refs |= self.all_references(item)
+        if not isinstance(json, dict):
+            return refs
+        for key in json:
+            if key != "$ref":
+                refs |= self.all_references(json[key])
+            else:
+                refs.add(json["$ref"])
+        return refs
+
+    def generate_used_types(self):
+        all_refs = set()
+        for domain in self.json_api["domains"]:
+            domain_name = domain["domain"]
+            if "commands" in domain:
+                for command in domain["commands"]:
+                    if self.generate_command(domain_name, command["name"]):
+                        all_refs |= self.all_references(command)
+            if "events" in domain:
+                for event in domain["events"]:
+                    if self.generate_event(domain_name, event["name"]):
+                        all_refs |= self.all_references(event)
+                        all_refs.add(domain_name + "." + to_title_case(event["name"]) + "Notification")
+
+        dependencies = self.generate_type_dependencies()
+        queue = set(all_refs)
+        while len(queue):
+            ref = queue.pop()
+            if ref in dependencies:
+                queue |= dependencies[ref] - all_refs
+                all_refs |= dependencies[ref]
+        self.used_types = all_refs
+
+
+    def generate_type_dependencies(self):
+        dependencies = dict()
+        domains_with_types = (x for x in self.json_api["domains"] if "types" in x)
+        for domain in domains_with_types:
+            domain_name = domain["domain"]
+            for type in domain["types"]:
+                related_types = self.all_references(type)
+                if len(related_types):
+                    dependencies[domain_name + "." + type["id"]] = related_types
+        return dependencies
+
+
+    def create_notification_types(self):
+        for domain in self.json_api["domains"]:
+            if "events" in domain:
+                for event in domain["events"]:
+                    event_type = dict()
+                    event_type["description"] = "Wrapper for notification params"
+                    event_type["type"] = "object"
+                    event_type["id"] = to_title_case(event["name"]) + "Notification"
+                    if "parameters" in event:
+                        event_type["properties"] = copy.deepcopy(event["parameters"])
+                    if "types" not in domain:
+                        domain["types"] = list()
+                    domain["types"].append(event_type)
+
+
+    def create_type_definitions(self):
+        imported_namespace = "::".join(self.config.imported.namespace) if self.config.imported else ""
+        self.type_definitions = {}
+        self.type_definitions["number"] = create_primitive_type_definition("number")
+        self.type_definitions["integer"] = create_primitive_type_definition("integer")
+        self.type_definitions["boolean"] = create_primitive_type_definition("boolean")
+        self.type_definitions["object"] = create_object_type_definition()
+        self.type_definitions["any"] = create_any_type_definition()
+        for domain in self.json_api["domains"]:
+            self.type_definitions[domain["domain"] + ".string"] = create_string_type_definition()
+            if not ("types" in domain):
+                continue
+            for type in domain["types"]:
+                type_name = domain["domain"] + "." + type["id"]
+                if type["type"] == "object" and domain["domain"] in self.imported_domains:
+                    self.type_definitions[type_name] = create_imported_type_definition(domain["domain"], type, imported_namespace)
+                elif type["type"] == "object":
+                    self.type_definitions[type_name] = create_user_type_definition(domain["domain"], type)
+                elif type["type"] == "array":
+                    self.type_definitions[type_name] = self.resolve_type(type)
+                elif type["type"] == domain["domain"] + ".string":
+                    self.type_definitions[type_name] = create_string_type_definition()
+                else:
+                    self.type_definitions[type_name] = create_primitive_type_definition(type["type"])
+
+
+    def check_options(self, options, domain, name, include_attr, exclude_attr, default):
+        for rule in options:
+            if rule.domain != domain:
+                continue
+            if include_attr and hasattr(rule, include_attr):
+                return name in getattr(rule, include_attr)
+            if exclude_attr and hasattr(rule, exclude_attr):
+                return name not in getattr(rule, exclude_attr)
+            return default
+        return False
+
+
+    # ---- Begin of methods exposed to generator
+
+
+    def type_definition(self, name):
+        return self.type_definitions[name]
+
+
+    def resolve_type(self, prop):
+        if "$ref" in prop:
+            return self.type_definitions[prop["$ref"]]
+        if prop["type"] == "array":
+            return wrap_array_definition(self.resolve_type(prop["items"]))
+        return self.type_definitions[prop["type"]]
+
+
+    def generate_command(self, domain, command):
+        if not self.config.protocol.options:
+            return domain in self.generate_domains
+        return self.check_options(self.config.protocol.options, domain, command, "include", "exclude", True)
+
+
+    def generate_event(self, domain, event):
+        if not self.config.protocol.options:
+            return domain in self.generate_domains
+        return self.check_options(self.config.protocol.options, domain, event, "include_events", "exclude_events", True)
+
+
+    def generate_type(self, domain, typename):
+        return domain + "." + typename in self.used_types
+
+
+    def is_async_command(self, domain, command):
+        if not self.config.protocol.options:
+            return False
+        return self.check_options(self.config.protocol.options, domain, command, "async", None, False)
+
+
+    def is_exported(self, domain, name):
+        if not self.config.protocol.options:
+            return False
+        return self.check_options(self.config.protocol.options, domain, name, "exported", None, False)
+
+
+    def is_imported(self, domain, name):
+        if not self.config.imported:
+            return False
+        if not self.config.imported.options:
+            return domain in self.imported_domains
+        return self.check_options(self.config.imported.options, domain, name, "imported", None, False)
+
+
+    def is_exported_domain(self, domain):
+        return domain in self.exported_domains
+
+
+    def generate_disable(self, domain):
+        if "commands" not in domain:
+            return True
+        for command in domain["commands"]:
+            if command["name"] == "disable" and self.generate_command(domain["domain"], "disable"):
+                return False
+        return True
+
+
+    def is_imported_dependency(self, domain):
+        return domain in self.generate_domains or domain in self.imported_domains
+
+
+def main():
+    jinja_dir, config_file, config = read_config()
+
+    protocol = Protocol(config)
+
+    if not config.exported and len(protocol.exported_domains):
+        sys.stderr.write("Domains [%s] are exported, but config is missing export entry\n\n" % ", ".join(protocol.exported_domains))
+        exit(1)
+
+    if not os.path.exists(config.protocol.output):
+        os.mkdir(config.protocol.output)
+    if len(protocol.exported_domains) and not os.path.exists(config.exported.output):
+        os.mkdir(config.exported.output)
+    jinja_env = initialize_jinja_env(jinja_dir, config.protocol.output, config)
+
+    inputs = []
+    inputs.append(__file__)
+    inputs.append(config_file)
+    inputs.append(config.protocol.path)
+    if config.imported:
+        inputs.append(config.imported.path)
+    templates_dir = os.path.join(module_path, "templates")
+    inputs.append(os.path.join(templates_dir, "TypeBuilder_h.template"))
+    inputs.append(os.path.join(templates_dir, "TypeBuilder_cpp.template"))
+    inputs.append(os.path.join(templates_dir, "Exported_h.template"))
+    inputs.append(os.path.join(templates_dir, "Imported_h.template"))
+
+    h_template = jinja_env.get_template("templates/TypeBuilder_h.template")
+    cpp_template = jinja_env.get_template("templates/TypeBuilder_cpp.template")
+    exported_template = jinja_env.get_template("templates/Exported_h.template")
+    imported_template = jinja_env.get_template("templates/Imported_h.template")
+
+    outputs = dict()
+
+    for domain in protocol.json_api["domains"]:
+        class_name = domain["domain"]
+        file_name = config.protocol.file_name_prefix + class_name
+        template_context = {
+            "protocol": protocol,
+            "config": config,
+            "domain": domain,
+            "join_arrays": join_arrays,
+            "format_include": functools.partial(format_include, config),
+            "format_domain_include": functools.partial(format_domain_include, config),
+        }
+
+        if domain["domain"] in protocol.generate_domains:
+            outputs[os.path.join(config.protocol.output, to_file_name(config, file_name + ".h"))] = h_template.render(template_context)
+            outputs[os.path.join(config.protocol.output, to_file_name(config, file_name + ".cpp"))] = cpp_template.render(template_context)
+            if domain["domain"] in protocol.exported_domains:
+                outputs[os.path.join(config.exported.output, to_file_name(config, file_name + ".h"))] = exported_template.render(template_context)
+        if domain["domain"] in protocol.imported_domains:
+            outputs[os.path.join(config.protocol.output, to_file_name(config, file_name + ".h"))] = imported_template.render(template_context)
+
+    if config.lib:
+        template_context = {
+            "config": config,
+            "format_include": functools.partial(format_include, config),
+        }
+
+        lib_templates_dir = os.path.join(module_path, "lib")
+        # Note these should be sorted in the right order.
+        # TODO(dgozman): sort them programmatically based on commented includes.
+        lib_h_templates = [
+            "ErrorSupport_h.template",
+            "Values_h.template",
+            "Object_h.template",
+            "ValueConversions_h.template",
+            "Maybe_h.template",
+            "Array_h.template",
+            "DispatcherBase_h.template",
+            "Parser_h.template",
+        ]
+
+        lib_cpp_templates = [
+            "Protocol_cpp.template",
+            "ErrorSupport_cpp.template",
+            "Values_cpp.template",
+            "Object_cpp.template",
+            "DispatcherBase_cpp.template",
+            "Parser_cpp.template",
+        ]
+
+        forward_h_templates = [
+            "Forward_h.template",
+            "Allocator_h.template",
+            "FrontendChannel_h.template",
+        ]
+
+        def generate_lib_file(file_name, template_files):
+            parts = []
+            for template_file in template_files:
+                inputs.append(os.path.join(lib_templates_dir, template_file))
+                template = jinja_env.get_template("lib/" + template_file)
+                parts.append(template.render(template_context))
+            outputs[file_name] = "\n\n".join(parts)
+
+        generate_lib_file(os.path.join(config.lib.output, to_file_name(config, "Forward.h")), forward_h_templates)
+        generate_lib_file(os.path.join(config.lib.output, to_file_name(config, "Protocol.h")), lib_h_templates)
+        generate_lib_file(os.path.join(config.lib.output, to_file_name(config, "Protocol.cpp")), lib_cpp_templates)
+
+    # Make gyp / make generatos happy, otherwise make rebuilds world.
+    inputs_ts = max(map(os.path.getmtime, inputs))
+    up_to_date = True
+    for output_file in outputs.iterkeys():
+        if not os.path.exists(output_file) or os.path.getmtime(output_file) < inputs_ts:
+            up_to_date = False
+            break
+    if up_to_date:
+        sys.exit()
+
+    for file_name, content in outputs.iteritems():
+        out_file = open(file_name, "w")
+        out_file.write(content)
+        out_file.close()
+
+
+main()
diff --git a/deps/v8/third_party/inspector_protocol/codereview.settings b/deps/v8/third_party/inspector_protocol/codereview.settings
new file mode 100644
index 00000000000000..6ac8580b4ccd9f
--- /dev/null
+++ b/deps/v8/third_party/inspector_protocol/codereview.settings
@@ -0,0 +1,6 @@
+# This file is used by git-cl to get repository specific information.
+CC_LIST: chromium-reviews@chromium.org
+CODE_REVIEW_SERVER: codereview.chromium.org
+GERRIT_HOST: True
+PROJECT: inspector_protocol
+VIEW_VC: https://chromium.googlesource.com/deps/inspector_protocol/+/
diff --git a/deps/v8/third_party/inspector_protocol/ConcatenateProtocols.py b/deps/v8/third_party/inspector_protocol/concatenate_protocols.py
similarity index 92%
rename from deps/v8/third_party/inspector_protocol/ConcatenateProtocols.py
rename to deps/v8/third_party/inspector_protocol/concatenate_protocols.py
index a7cbc992c76e40..e9f448efe72702 100755
--- a/deps/v8/third_party/inspector_protocol/ConcatenateProtocols.py
+++ b/deps/v8/third_party/inspector_protocol/concatenate_protocols.py
@@ -11,6 +11,7 @@
 except ImportError:
     import simplejson as json
 
+import pdl
 
 def main(argv):
     if len(argv) < 1:
@@ -25,8 +26,7 @@ def main(argv):
             sys.stderr.write("Cannot find %s\n" % file_name)
             return 1
         input_file = open(file_name, "r")
-        json_string = input_file.read()
-        parsed_json = json.loads(json_string)
+        parsed_json = pdl.loads(input_file.read(), file_name)
         domains += parsed_json["domains"]
         version = parsed_json["version"]
 
diff --git a/deps/v8/third_party/inspector_protocol/convert_protocol_to_json.py b/deps/v8/third_party/inspector_protocol/convert_protocol_to_json.py
new file mode 100755
index 00000000000000..2dd6f501a61b8e
--- /dev/null
+++ b/deps/v8/third_party/inspector_protocol/convert_protocol_to_json.py
@@ -0,0 +1,33 @@
+#!/usr/bin/env python
+# Copyright 2017 The Chromium Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+import collections
+import json
+import os.path
+import re
+import sys
+
+import pdl
+
+def main(argv):
+    if len(argv) < 2:
+        sys.stderr.write("Usage: %s <protocol.pdl> <protocol.json>\n" % sys.argv[0])
+        return 1
+    file_name = os.path.normpath(argv[0])
+    input_file = open(file_name, "r")
+    pdl_string = input_file.read()
+    protocol = pdl.loads(pdl_string, file_name)
+    input_file.close()
+    output_file = open(argv[0].replace('.pdl', '.json'), 'wb')
+    json.dump(protocol, output_file, indent=4, separators=(',', ': '))
+    output_file.close()
+
+    output_file = open(os.path.normpath(argv[1]), 'wb')
+    json.dump(protocol, output_file, indent=4, separators=(',', ': '))
+    output_file.close()
+
+
+if __name__ == '__main__':
+    sys.exit(main(sys.argv[1:]))
diff --git a/deps/v8/third_party/inspector_protocol/inspector_protocol.gni b/deps/v8/third_party/inspector_protocol/inspector_protocol.gni
index 5dcc1f522d8634..af2f21691cd750 100644
--- a/deps/v8/third_party/inspector_protocol/inspector_protocol.gni
+++ b/deps/v8/third_party/inspector_protocol/inspector_protocol.gni
@@ -27,13 +27,12 @@ template("inspector_protocol_generate") {
   inspector_protocol_dir = invoker.inspector_protocol_dir
 
   action(target_name) {
-    script = "$inspector_protocol_dir/CodeGenerator.py"
+    script = "$inspector_protocol_dir/code_generator.py"
 
     inputs = [
       invoker.config_file,
       "$inspector_protocol_dir/lib/Allocator_h.template",
       "$inspector_protocol_dir/lib/Array_h.template",
-      "$inspector_protocol_dir/lib/Collections_h.template",
       "$inspector_protocol_dir/lib/DispatcherBase_cpp.template",
       "$inspector_protocol_dir/lib/DispatcherBase_h.template",
       "$inspector_protocol_dir/lib/ErrorSupport_cpp.template",
diff --git a/deps/v8/third_party/inspector_protocol/inspector_protocol.gypi b/deps/v8/third_party/inspector_protocol/inspector_protocol.gypi
index 1fb7119b5fa567..1359e167519083 100644
--- a/deps/v8/third_party/inspector_protocol/inspector_protocol.gypi
+++ b/deps/v8/third_party/inspector_protocol/inspector_protocol.gypi
@@ -7,7 +7,6 @@
     'inspector_protocol_files': [
       'lib/Allocator_h.template',
       'lib/Array_h.template',
-      'lib/Collections_h.template',
       'lib/DispatcherBase_cpp.template',
       'lib/DispatcherBase_h.template',
       'lib/ErrorSupport_cpp.template',
@@ -27,7 +26,7 @@
       'templates/Imported_h.template',
       'templates/TypeBuilder_cpp.template',
       'templates/TypeBuilder_h.template',
-      'CodeGenerator.py',
+      'code_generator.py',
     ]
   }
 }
diff --git a/deps/v8/third_party/inspector_protocol/lib/Collections_h.template b/deps/v8/third_party/inspector_protocol/lib/Collections_h.template
index 7505a17bfa6e68..e69de29bb2d1d6 100644
--- a/deps/v8/third_party/inspector_protocol/lib/Collections_h.template
+++ b/deps/v8/third_party/inspector_protocol/lib/Collections_h.template
@@ -1,43 +0,0 @@
-// Copyright 2016 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef {{"_".join(config.protocol.namespace)}}_Collections_h
-#define {{"_".join(config.protocol.namespace)}}_Collections_h
-
-#include {{format_include(config.protocol.package, "Forward")}}
-#include <cstddef>
-
-#if defined(__APPLE__) && !defined(_LIBCPP_VERSION)
-#include <map>
-#include <set>
-
-{% for namespace in config.protocol.namespace %}
-namespace {{namespace}} {
-{% endfor %}
-
-template <class Key, class T> using HashMap = std::map<Key, T>;
-template <class Key> using HashSet = std::set<Key>;
-
-{% for namespace in config.protocol.namespace %}
-} // namespace {{namespace}}
-{% endfor %}
-
-#else
-#include <unordered_map>
-#include <unordered_set>
-
-{% for namespace in config.protocol.namespace %}
-namespace {{namespace}} {
-{% endfor %}
-
-template <class Key, class T> using HashMap = std::unordered_map<Key, T>;
-template <class Key> using HashSet = std::unordered_set<Key>;
-
-{% for namespace in config.protocol.namespace %}
-} // namespace {{namespace}}
-{% endfor %}
-
-#endif // defined(__APPLE__) && !defined(_LIBCPP_VERSION)
-
-#endif // !defined({{"_".join(config.protocol.namespace)}}_Collections_h)
diff --git a/deps/v8/third_party/inspector_protocol/lib/DispatcherBase_cpp.template b/deps/v8/third_party/inspector_protocol/lib/DispatcherBase_cpp.template
index cecef743bffcc6..5403035cc45842 100644
--- a/deps/v8/third_party/inspector_protocol/lib/DispatcherBase_cpp.template
+++ b/deps/v8/third_party/inspector_protocol/lib/DispatcherBase_cpp.template
@@ -231,7 +231,7 @@ void UberDispatcher::registerBackend(const String& name, std::unique_ptr<protoco
     m_dispatchers[name] = std::move(dispatcher);
 }
 
-void UberDispatcher::setupRedirects(const HashMap<String, String>& redirects)
+void UberDispatcher::setupRedirects(const std::unordered_map<String, String>& redirects)
 {
     for (const auto& pair : redirects)
         m_redirects[pair.first] = pair.second;
@@ -269,7 +269,7 @@ DispatchResponse::Status UberDispatcher::dispatch(std::unique_ptr<Value> parsedM
         return DispatchResponse::kError;
     }
 
-    HashMap<String, String>::iterator redirectIt = m_redirects.find(method);
+    std::unordered_map<String, String>::iterator redirectIt = m_redirects.find(method);
     if (redirectIt != m_redirects.end())
         method = redirectIt->second;
 
diff --git a/deps/v8/third_party/inspector_protocol/lib/DispatcherBase_h.template b/deps/v8/third_party/inspector_protocol/lib/DispatcherBase_h.template
index d70a4afe71de2c..6c618cf0f58f93 100644
--- a/deps/v8/third_party/inspector_protocol/lib/DispatcherBase_h.template
+++ b/deps/v8/third_party/inspector_protocol/lib/DispatcherBase_h.template
@@ -5,9 +5,8 @@
 #ifndef {{"_".join(config.protocol.namespace)}}_DispatcherBase_h
 #define {{"_".join(config.protocol.namespace)}}_DispatcherBase_h
 
-//#include "Collections.h"
-//#include "ErrorSupport.h"
 //#include "Forward.h"
+//#include "ErrorSupport.h"
 //#include "Values.h"
 
 {% for namespace in config.protocol.namespace %}
@@ -101,7 +100,7 @@ public:
 
 private:
     FrontendChannel* m_frontendChannel;
-    protocol::HashSet<WeakPtr*> m_weakPtrs;
+    std::unordered_set<WeakPtr*> m_weakPtrs;
     int m_lastCallbackId;
     bool m_lastCallbackFallThrough;
 };
@@ -111,7 +110,7 @@ class {{config.lib.export_macro}} UberDispatcher {
 public:
     explicit UberDispatcher(FrontendChannel*);
     void registerBackend(const String& name, std::unique_ptr<protocol::DispatcherBase>);
-    void setupRedirects(const HashMap<String, String>&);
+    void setupRedirects(const std::unordered_map<String, String>&);
     DispatchResponse::Status dispatch(std::unique_ptr<Value> message, int* callId = nullptr, String* method = nullptr);
     FrontendChannel* channel() { return m_frontendChannel; }
     bool fallThroughForNotFound() { return m_fallThroughForNotFound; }
@@ -122,8 +121,8 @@ public:
 private:
     FrontendChannel* m_frontendChannel;
     bool m_fallThroughForNotFound;
-    HashMap<String, String> m_redirects;
-    protocol::HashMap<String, std::unique_ptr<protocol::DispatcherBase>> m_dispatchers;
+    std::unordered_map<String, String> m_redirects;
+    std::unordered_map<String, std::unique_ptr<protocol::DispatcherBase>> m_dispatchers;
 };
 
 class InternalResponse : public Serializable {
diff --git a/deps/v8/third_party/inspector_protocol/lib/ErrorSupport_h.template b/deps/v8/third_party/inspector_protocol/lib/ErrorSupport_h.template
index 083f2a5eb0d4d3..11934c3abe8c01 100644
--- a/deps/v8/third_party/inspector_protocol/lib/ErrorSupport_h.template
+++ b/deps/v8/third_party/inspector_protocol/lib/ErrorSupport_h.template
@@ -5,7 +5,7 @@
 #ifndef {{"_".join(config.protocol.namespace)}}_ErrorSupport_h
 #define {{"_".join(config.protocol.namespace)}}_ErrorSupport_h
 
-//#include "Forward.h"
+#include {{format_include(config.protocol.package, "Forward")}}
 
 {% for namespace in config.protocol.namespace %}
 namespace {{namespace}} {
diff --git a/deps/v8/third_party/inspector_protocol/lib/Forward_h.template b/deps/v8/third_party/inspector_protocol/lib/Forward_h.template
index 34d1c0d3e946cd..a3f7c2f0ba9f54 100644
--- a/deps/v8/third_party/inspector_protocol/lib/Forward_h.template
+++ b/deps/v8/third_party/inspector_protocol/lib/Forward_h.template
@@ -10,7 +10,10 @@
 {% endif %}
 #include {{format_include(config.lib.string_header)}}
 
+#include <cstddef>
 #include <vector>
+#include <unordered_map>
+#include <unordered_set>
 
 {% for namespace in config.protocol.namespace %}
 namespace {{namespace}} {
diff --git a/deps/v8/third_party/inspector_protocol/lib/Parser_cpp.template b/deps/v8/third_party/inspector_protocol/lib/Parser_cpp.template
index f3dde5ac218e6f..ea276520969980 100644
--- a/deps/v8/third_party/inspector_protocol/lib/Parser_cpp.template
+++ b/deps/v8/third_party/inspector_protocol/lib/Parser_cpp.template
@@ -425,9 +425,8 @@ std::unique_ptr<Value> buildValue(const Char* start, const Char* end, const Char
         double value = charactersToDouble(tokenStart, tokenEnd - tokenStart, &ok);
         if (!ok)
             return nullptr;
-        int number = static_cast<int>(value);
-        if (number == value)
-            result = FundamentalValue::create(number);
+        if (value >= INT_MIN && value <= INT_MAX && static_cast<int>(value) == value)
+            result = FundamentalValue::create(static_cast<int>(value));
         else
             result = FundamentalValue::create(value);
         break;
diff --git a/deps/v8/third_party/inspector_protocol/lib/Protocol_cpp.template b/deps/v8/third_party/inspector_protocol/lib/Protocol_cpp.template
index 901656373a4f52..1167ed400a1ba2 100644
--- a/deps/v8/third_party/inspector_protocol/lib/Protocol_cpp.template
+++ b/deps/v8/third_party/inspector_protocol/lib/Protocol_cpp.template
@@ -7,6 +7,6 @@
 #include {{format_include(config.protocol.package, "Protocol")}}
 
 #include <algorithm>
+#include <climits>
 #include <cmath>
-
 #include <cstring>
diff --git a/deps/v8/third_party/inspector_protocol/lib/Values_h.template b/deps/v8/third_party/inspector_protocol/lib/Values_h.template
index 3638b34b4e7718..e8eb91d85ae69f 100644
--- a/deps/v8/third_party/inspector_protocol/lib/Values_h.template
+++ b/deps/v8/third_party/inspector_protocol/lib/Values_h.template
@@ -6,7 +6,6 @@
 #define {{"_".join(config.protocol.namespace)}}_Values_h
 
 //#include "Allocator.h"
-//#include "Collections.h"
 //#include "Forward.h"
 
 {% for namespace in config.protocol.namespace %}
@@ -200,7 +199,7 @@ private:
             m_order.push_back(key);
     }
 
-    using Dictionary = protocol::HashMap<String, std::unique_ptr<Value>>;
+    using Dictionary = std::unordered_map<String, std::unique_ptr<Value>>;
     Dictionary m_data;
     std::vector<String> m_order;
 };
diff --git a/deps/v8/third_party/inspector_protocol/pdl.py b/deps/v8/third_party/inspector_protocol/pdl.py
new file mode 100644
index 00000000000000..c8a5c6f3102e5b
--- /dev/null
+++ b/deps/v8/third_party/inspector_protocol/pdl.py
@@ -0,0 +1,167 @@
+# Copyright 2018 The Chromium Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+import collections
+import json
+import os.path
+import re
+import sys
+
+description = ''
+
+primitiveTypes = ['integer', 'number', 'boolean', 'string', 'object', 'any', 'array']
+
+
+def assignType(item, type, isArray=False):
+    if isArray:
+        item['type'] = 'array'
+        item['items'] = collections.OrderedDict()
+        assignType(item['items'], type)
+        return
+
+    if type == 'enum':
+        type = 'string'
+    if type in primitiveTypes:
+        item['type'] = type
+    else:
+        item['$ref'] = type
+
+
+def createItem(d, experimental, deprecated, name=None):
+    result = collections.OrderedDict(d)
+    if name:
+        result['name'] = name
+    global description
+    if description:
+        result['description'] = description.strip()
+    if experimental:
+        result['experimental'] = True
+    if deprecated:
+        result['deprecated'] = True
+    return result
+
+
+def parse(data, file_name):
+    protocol = collections.OrderedDict()
+    protocol['version'] = collections.OrderedDict()
+    protocol['domains'] = []
+    domain = None
+    item = None
+    subitems = None
+    nukeDescription = False
+    global description
+    lines = data.split('\n')
+    for i in range(0, len(lines)):
+        if nukeDescription:
+            description = ''
+            nukeDescription = False
+        line = lines[i]
+        trimLine = line.strip()
+
+        if trimLine.startswith('#'):
+            if len(description):
+              description += '\n'
+            description += trimLine[2:]
+            continue
+        else:
+            nukeDescription = True
+
+        if len(trimLine) == 0:
+            continue
+
+        match = re.compile('^(experimental )?(deprecated )?domain (.*)').match(line)
+        if match:
+            domain = createItem({'domain' : match.group(3)}, match.group(1), match.group(2))
+            protocol['domains'].append(domain)
+            continue
+
+        match = re.compile('^  depends on ([^\s]+)').match(line)
+        if match:
+            if 'dependencies' not in domain:
+                domain['dependencies'] = []
+            domain['dependencies'].append(match.group(1))
+            continue
+
+        match = re.compile('^  (experimental )?(deprecated )?type (.*) extends (array of )?([^\s]+)').match(line)
+        if match:
+            if 'types' not in domain:
+                domain['types'] = []
+            item = createItem({'id': match.group(3)}, match.group(1), match.group(2))
+            assignType(item, match.group(5), match.group(4))
+            domain['types'].append(item)
+            continue
+
+        match = re.compile('^  (experimental )?(deprecated )?(command|event) (.*)').match(line)
+        if match:
+            list = []
+            if match.group(3) == 'command':
+                if 'commands' in domain:
+                    list = domain['commands']
+                else:
+                    list = domain['commands'] = []
+            else:
+                if 'events' in domain:
+                    list = domain['events']
+                else:
+                    list = domain['events'] = []
+
+            item = createItem({}, match.group(1), match.group(2), match.group(4))
+            list.append(item)
+            continue
+
+        match = re.compile('^      (experimental )?(deprecated )?(optional )?(array of )?([^\s]+) ([^\s]+)').match(line)
+        if match:
+            param = createItem({}, match.group(1), match.group(2), match.group(6))
+            if match.group(3):
+                param['optional'] = True
+            assignType(param, match.group(5), match.group(4))
+            if match.group(5) == 'enum':
+                enumliterals = param['enum'] = []
+            subitems.append(param)
+            continue
+
+        match = re.compile('^    (parameters|returns|properties)').match(line)
+        if match:
+            subitems = item[match.group(1)] = []
+            continue
+
+        match = re.compile('^    enum').match(line)
+        if match:
+            enumliterals = item['enum'] = []
+            continue
+
+        match = re.compile('^version').match(line)
+        if match:
+            continue
+
+        match = re.compile('^  major (\d+)').match(line)
+        if match:
+            protocol['version']['major'] = match.group(1)
+            continue
+
+        match = re.compile('^  minor (\d+)').match(line)
+        if match:
+            protocol['version']['minor'] = match.group(1)
+            continue
+
+        match = re.compile('^    redirect ([^\s]+)').match(line)
+        if match:
+            item['redirect'] = match.group(1)
+            continue
+
+        match = re.compile('^      (  )?[^\s]+$').match(line)
+        if match:
+            # enum literal
+            enumliterals.append(trimLine)
+            continue
+
+        print 'Error in %s:%s, illegal token: \t%s' % (file_name, i, line)
+        sys.exit(1)
+    return protocol
+
+
+def loads(data, file_name):
+    if file_name.endswith(".pdl"):
+        return parse(data, file_name)
+    return json.loads(data)
diff --git a/deps/v8/third_party/inspector_protocol/templates/TypeBuilder_cpp.template b/deps/v8/third_party/inspector_protocol/templates/TypeBuilder_cpp.template
index 026c1cdb8da9e1..aa448d2a192a4f 100644
--- a/deps/v8/third_party/inspector_protocol/templates/TypeBuilder_cpp.template
+++ b/deps/v8/third_party/inspector_protocol/templates/TypeBuilder_cpp.template
@@ -4,7 +4,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#include {{format_include(config.protocol.package, domain.domain)}}
+#include {{format_domain_include(config.protocol.package, domain.domain)}}
 
 #include {{format_include(config.protocol.package, "Protocol")}}
 
@@ -24,7 +24,7 @@ const char Metainfo::version[] = "{{domain.version}}";
 
 namespace {{type.id}}Enum {
       {% for literal in type.enum %}
-const char* {{ literal | dash_to_camelcase}} = "{{literal}}";
+const char {{ literal | dash_to_camelcase}}[] = "{{literal}}";
       {% endfor %}
 } // namespace {{type.id}}Enum
       {% if protocol.is_exported(domain.domain, type.id) %}
@@ -211,13 +211,13 @@ public:
     }
     ~DispatcherImpl() override { }
     DispatchResponse::Status dispatch(int callId, const String& method, std::unique_ptr<protocol::DictionaryValue> messageObject) override;
-    HashMap<String, String>& redirects() { return m_redirects; }
+    std::unordered_map<String, String>& redirects() { return m_redirects; }
 
 protected:
     using CallHandler = DispatchResponse::Status (DispatcherImpl::*)(int callId, std::unique_ptr<DictionaryValue> messageObject, ErrorSupport* errors);
-    using DispatchMap = protocol::HashMap<String, CallHandler>;
+    using DispatchMap = std::unordered_map<String, CallHandler>;
     DispatchMap m_dispatchMap;
-    HashMap<String, String> m_redirects;
+    std::unordered_map<String, String> m_redirects;
 
   {% for command in domain.commands %}
     {% if "redirect" in command %}{% continue %}{% endif %}
@@ -231,7 +231,7 @@ protected:
 
 DispatchResponse::Status DispatcherImpl::dispatch(int callId, const String& method, std::unique_ptr<protocol::DictionaryValue> messageObject)
 {
-    protocol::HashMap<String, CallHandler>::iterator it = m_dispatchMap.find(method);
+    std::unordered_map<String, CallHandler>::iterator it = m_dispatchMap.find(method);
     if (it == m_dispatchMap.end()) {
         if (m_fallThroughForNotFound)
             return DispatchResponse::kFallThrough;
diff --git a/deps/v8/third_party/inspector_protocol/templates/TypeBuilder_h.template b/deps/v8/third_party/inspector_protocol/templates/TypeBuilder_h.template
index 744d496026a279..291b2a75425a16 100644
--- a/deps/v8/third_party/inspector_protocol/templates/TypeBuilder_h.template
+++ b/deps/v8/third_party/inspector_protocol/templates/TypeBuilder_h.template
@@ -15,7 +15,7 @@
 // and include Domain::API version from there.
 {% for name in domain.dependencies %}
   {% if protocol.is_imported_dependency(name) %}
-#include {{format_include(config.protocol.package, name)}}
+#include {{format_domain_include(config.protocol.package, name)}}
   {% endif %}
 {% endfor %}
 {% if protocol.is_exported_domain(domain.domain) %}
@@ -46,7 +46,7 @@ using {{type.id}} = {{protocol.resolve_type(type).type}};
 
 namespace {{type.id}}Enum {
       {% for literal in type.enum %}
-{{config.protocol.export_macro}} extern const char* {{ literal | dash_to_camelcase}};
+{{config.protocol.export_macro}} extern const char {{ literal | dash_to_camelcase}}[];
       {% endfor %}
 } // namespace {{type.id}}Enum
     {% endif %}
diff --git a/deps/v8/tools/callstats.py b/deps/v8/tools/callstats.py
index 5215d6319fad34..4ee4e83c021bfb 100755
--- a/deps/v8/tools/callstats.py
+++ b/deps/v8/tools/callstats.py
@@ -33,6 +33,9 @@
 from math import sqrt
 
 
+MAX_NOF_RETRIES = 5
+
+
 # Run benchmarks.
 
 def print_command(cmd_args):
@@ -211,9 +214,13 @@ def run_site(site, domain, args, timeout=None):
               print >> f, "URL: {}".format(site)
           retries_since_good_run = 0
           break
-        if retries_since_good_run < 6:
-          timeout += 2 ** retries_since_good_run
-          retries_since_good_run += 1
+        if retries_since_good_run > MAX_NOF_RETRIES:
+          # Abort after too many retries, no point in ever increasing the
+          # timeout.
+          print("TOO MANY EMPTY RESULTS ABORTING RUN")
+          break
+        timeout += 2 ** retries_since_good_run
+        retries_since_good_run += 1
         print("EMPTY RESULT, REPEATING RUN ({})".format(
             retries_since_good_run));
       finally:
diff --git a/deps/v8/tools/gen-postmortem-metadata.py b/deps/v8/tools/gen-postmortem-metadata.py
index 8ccd4a4b566e62..d8ef7b4a158a9c 100644
--- a/deps/v8/tools/gen-postmortem-metadata.py
+++ b/deps/v8/tools/gen-postmortem-metadata.py
@@ -204,6 +204,9 @@
         'value': 'Context::EXTENSION_INDEX' },
     { 'name': 'context_min_slots',
         'value': 'Context::MIN_CONTEXT_SLOTS' },
+    { 'name': 'context_idx_embedder_data',
+        'value': 'Internals::kContextEmbedderDataIndex' },
+
 
     { 'name': 'namedictionaryshape_prefix_size',
         'value': 'NameDictionaryShape::kPrefixSize' },
@@ -224,6 +227,8 @@
         'value': 'SimpleNumberDictionaryShape::kPrefixSize' },
     { 'name': 'simplenumberdictionaryshape_entry_size',
         'value': 'SimpleNumberDictionaryShape::kEntrySize' },
+
+    { 'name': 'type_JSError__JS_ERROR_TYPE', 'value': 'JS_ERROR_TYPE' },
 ];
 
 #
diff --git a/deps/v8/tools/lldb_commands.py b/deps/v8/tools/lldb_commands.py
index d8946ee485a237..46e5e8b0fb78b6 100644
--- a/deps/v8/tools/lldb_commands.py
+++ b/deps/v8/tools/lldb_commands.py
@@ -2,24 +2,66 @@
 # Use of this source code is governed by a BSD-style license that can be
 # found in the LICENSE file.
 
+# Load this file by adding this to your ~/.lldbinit:
+# command script import <this_dir>/lldb_commands.py
+
 import lldb
 import re
 
+#####################
+# Helper functions. #
+#####################
+def current_thread(debugger):
+  return debugger.GetSelectedTarget().GetProcess().GetSelectedThread()
+
+def current_frame(debugger):
+  return current_thread(debugger).GetSelectedFrame()
+
+def no_arg_cmd(debugger, cmd):
+  current_frame(debugger).EvaluateExpression(cmd)
+  print("")
+
+def ptr_arg_cmd(debugger, name, param, cmd):
+  if not param:
+    print("'{}' requires an argument".format(name))
+    return
+  param = '(void*)({})'.format(param)
+  no_arg_cmd(debugger, cmd.format(param))
+
+#####################
+# lldb commands.    #
+#####################
+def job(debugger, param, *args):
+  """Print a v8 heap object"""
+  ptr_arg_cmd(debugger, 'job', param, "_v8_internal_Print_Object({})")
+
+def jlh(debugger, param, *args):
+  """Print v8::Local handle value"""
+  ptr_arg_cmd(debugger, 'jlh', param,
+              "_v8_internal_Print_Object(*(v8::internal::Object**)(*{}))")
+
+def jco(debugger, param, *args):
+  """Print the code object at the given pc (default: current pc)"""
+  if not param:
+    param = str(current_frame(debugger).FindRegister("pc").value)
+  ptr_arg_cmd(debugger, 'jco', param, "_v8_internal_Print_Code({})")
+
+def jld(debugger, param, *args):
+  """Print a v8 LayoutDescriptor object"""
+  ptr_arg_cmd(debugger, 'jld', param,
+              "_v8_internal_Print_LayoutDescriptor({})")
+
+def jtt(debugger, param, *args):
+  """Print the transition tree of a v8 Map"""
+  ptr_arg_cmd(debugger, 'jtt', param, "_v8_internal_Print_TransitionTree({})")
+
 def jst(debugger, *args):
   """Print the current JavaScript stack trace"""
-  target = debugger.GetSelectedTarget()
-  process = target.GetProcess()
-  thread = process.GetSelectedThread()
-  frame = thread.GetSelectedFrame()
-  frame.EvaluateExpression("_v8_internal_Print_StackTrace();")
-  print("")
+  no_arg_cmd(debugger, "_v8_internal_Print_StackTrace()")
 
 def jss(debugger, *args):
   """Skip the jitted stack on x64 to where we entered JS last"""
-  target = debugger.GetSelectedTarget()
-  process = target.GetProcess()
-  thread = process.GetSelectedThread()
-  frame = thread.GetSelectedFrame()
+  frame = current_frame(debugger)
   js_entry_sp = frame.EvaluateExpression(
       "v8::internal::Isolate::Current()->thread_local_top()->js_entry_sp_;") \
        .GetValue()
@@ -36,10 +78,7 @@ def bta(debugger, *args):
   func_name_re = re.compile("([^(<]+)(?:\(.+\))?")
   assert_re = re.compile(
       "^v8::internal::Per\w+AssertType::(\w+)_ASSERT, (false|true)>")
-  target = debugger.GetSelectedTarget()
-  process = target.GetProcess()
-  thread = process.GetSelectedThread()
-  frame = thread.GetSelectedFrame()
+  thread = current_thread(debugger)
   for frame in thread:
     functionSignature = frame.GetDisplayFunctionName()
     if functionSignature is None:
@@ -66,7 +105,8 @@ def bta(debugger, *args):
       print("%s -> %s %s (%s)\033[0m" % (
           color, prefix, match.group(2), match.group(1)))
 
-def __lldb_init_module (debugger, dict):
-  debugger.HandleCommand('command script add -f lldb_commands.jst jst')
-  debugger.HandleCommand('command script add -f lldb_commands.jss jss')
-  debugger.HandleCommand('command script add -f lldb_commands.bta bta')
+def __lldb_init_module(debugger, dict):
+  debugger.HandleCommand('settings set target.x86-disassembly-flavor intel')
+  for cmd in ('job', 'jlh', 'jco', 'jld', 'jtt', 'jst', 'jss', 'bta'):
+    debugger.HandleCommand(
+      'command script add -f lldb_commands.{} {}'.format(cmd, cmd))
diff --git a/deps/v8/tools/lldbinit b/deps/v8/tools/lldbinit
deleted file mode 100755
index 1d093d85e34e0a..00000000000000
--- a/deps/v8/tools/lldbinit
+++ /dev/null
@@ -1,20 +0,0 @@
-# Copyright 2017 the V8 project authors. All rights reserved.
-# Use of this source code is governed by a BSD-style license that can be
-# found in the LICENSE file.
-
-# Print HeapObjects.
-command regex -h 'Print a v8 JavaScript object' job 's/(.+)/expr -- '_v8_internal_Print_Object((void*)(%1))/'
-
-# Print v8::Local handle value.
-command regex -h 'Print content of a v8::Local handle' jlh 's/(.+)/expr -- '_v8_internal_Print_Object(*(v8::internal::Object**)(*%1))/'
-
-# Print Code objects containing given PC.
-command regex -h 'Print a v8 Code object from an internal code address' jco 's/(.+)/expr -- '_v8_internal_Print_Code((void*)(*%1))/'
-
-# Print LayoutDescriptor.
-command regex -h 'Print a v8 LayoutDescriptor object' jld 's/(.+)/expr -- '_v8_internal_Print_LayoutDescriptor((void*)(%1))/'
-
-# Print TransitionTree.
-command regex -h 'Print the transition tree of a v8 Map' jtt 's/(.+)/expr -- '_v8_internal_Print_TransitionTree((void*)(%1))/'
-
-command script import ~/lldb_commands.py
diff --git a/deps/v8/tools/mb/mb.py b/deps/v8/tools/mb/mb.py
index 189de8b6b7f2d7..0c768886bf190b 100755
--- a/deps/v8/tools/mb/mb.py
+++ b/deps/v8/tools/mb/mb.py
@@ -837,7 +837,13 @@ def GNCmd(self, subcommand, path, *args):
     else:
       subdir, exe = 'win', 'gn.exe'
 
-    gn_path = self.PathJoin(self.chromium_src_dir, 'buildtools', subdir, exe)
+    arch = platform.machine()
+    if (self.platform == 'linux2' and
+       (arch.startswith('s390') or arch.startswith('ppc'))):
+      # use gn in PATH
+      gn_path = 'gn'
+    else:
+      gn_path = self.PathJoin(self.chromium_src_dir, 'buildtools', subdir, exe)
     return [gn_path, subcommand, path] + list(args)
 
 
diff --git a/deps/v8/tools/parse-processor.html b/deps/v8/tools/parse-processor.html
index c7418183cdd44c..1e67e4a281ae90 100644
--- a/deps/v8/tools/parse-processor.html
+++ b/deps/v8/tools/parse-processor.html
@@ -66,34 +66,38 @@
   }
 
   .script-size {
-    display: inline-block;
+    display: inline-flex;
     background-color: #505050;
     border-radius: 3px;
     padding: 3px;
     margin: 2px;
     white-space: nowrap;
     overflow: hidden;
-    min-width: 2em;
     text-decoration: none;
     color: white;
   }
   .script-size.eval {
     background-color: #ee6300fc;
-
   }
-  .script-size.background {
+  .script-size.streaming {
     background-color: #008aff;
   }
+  .script-size.deserialized {
+    background-color: #1fad00fc;
+  }
 
-  .script-id {
-    display: inline;
-    padding-right: 2px;
-    margin-right: 2px;
-    border-right: 1px grey dotted;
+  .script-details {
+    padding-right: 5px;
+    margin-right: 4px;
   }
-  .script-url {
-    display: inline;
-    text-overflow: ellipis;
+  /* all but the last need a border  */
+  .script-details:nth-last-child(n+2) {
+    border-right: 1px white solid;
+  }
+
+  .script-details.id {
+    min-width: 2em;
+    text-align: right;
   }
 </style>
 <script src="./splaytree.js" type="text/javascript"></script>
@@ -115,7 +119,6 @@
   return document.querySelector(query);
 }
 
-
 function loadFile() {
   let files = $('#uploadInput').files;
 
@@ -202,11 +205,10 @@
       appendGraph(target.script, target, start, end);
       observer.unobserve(entry.target);
     });
-  }, {});
+  }, {rootMargin: '400px'});
   document.querySelectorAll('.script').forEach(div => io.observe(div));
 }
 
-
 const kTimeFactor = 10;
 const kHeight = 20;
 const kFunktionTopOffset = 50;
@@ -219,11 +221,11 @@
   scriptDiv.script = script;
 
   let scriptTitle = h3();
-  if (script.file) scriptTitle.appendChild(a(script.file, script.file));
-  let anchor = a("", ' id=' + script.id);
+  let anchor = a("", 'Script #' + script.id);
   anchor.name = "script"+script.id
   scriptTitle.appendChild(anchor);
   scriptDiv.appendChild(scriptTitle);
+  if (script.file) scriptTitle.appendChild(a(script.file, script.file));
   let summary = createNode('pre', 'script-details');
   summary.appendChild(text(script.summary));
   scriptDiv.appendChild(summary);
@@ -235,23 +237,28 @@
   parseProcessor.scripts.forEach(
     script => {
       let scriptDiv = a('#script'+script.id, '', 'script-size');
-      let scriptId = div('script-id');
+      let scriptId = div('script-details');
+      scriptId.classList.add('id');
       scriptId.innerText = script.id;
       scriptDiv.appendChild(scriptId);
-      let scriptUrl = div('script-url');
+      let scriptSize = div('script-details');
+      scriptSize.innerText = BYTES(script.bytesTotal);
+      scriptDiv.appendChild(scriptSize);
+      let scriptUrl = div('script-details');
       if (script.isEval) {
         scriptUrl.innerText = "eval";
         scriptDiv.classList.add('eval');
       } else {
         scriptUrl.innerText = script.file.split("/").pop();
       }
-      if (script.isBackgroundCompiled ) {
-        scriptDiv.classList.add('background');
+      if (script.isStreamingCompiled ) {
+        scriptDiv.classList.add('streaming');
+      } else if (script.deserializationTimestamp > 0) {
+        scriptDiv.classList.add('deserialized');
       }
       scriptDiv.appendChild(scriptUrl);
       scriptDiv.style.width = script.bytesTotal * 0.001;
       scriptsDiv.appendChild(scriptDiv);
-  
     });
 }
 
@@ -259,16 +266,24 @@
 // Resolution of the graphs
 const kTimeIncrement = 1;
 const kSelectionTimespan = 2;
+// TODO(cbruni): support compilation cache hit.
 const series = [
-    ['firstParseEvent', 'Any Parse Event'],
-    ['execution', 'First Execution'],
+    ['firstParseEvent', 'Any Parse', 'area'],
+    ['execution', '1st Exec', 'area'],
+    ['firstCompileEvent', 'Any Compile', 'area'],
+    ['compile', 'Eager Compile'],
+    ['lazyCompile', 'Lazy Compile'],
     ['parse', 'Parsing'],
-    ['preparse', 'Preparsing'],
-    ['resolution', 'Preparsing with Var. Resolution'],
-    ['lazyCompile', 'Lazy Compilation'],
-    ['compile', 'Eager Compilation'],
+    ['preparse', 'Preparse'],
+    ['resolution', 'Preparse with Var. Resolution'],
+    ['deserialization', 'Deserialization'],
+    ['optimization', 'Optimize'],
 ];
 const metricNames = series.map(each => each[0]);
+// Display cumulative values (useuful for bytes).
+const kCumulative = true;
+// Include durations in the graphs.
+const kUseDuration = false;
 
 
 function appendGraph(script, parentNode, start, end) {
@@ -279,28 +294,32 @@
   let data = new google.visualization.DataTable();
   data.addColumn('number', 'Duration');
   // The series are interleave bytes processed, time spent and thus have two
-  // different vAxes. 
+  // different vAxes.
   let seriesOptions = [];
-  let colors = ['#4D4D4D', '#5DA5DA', '#FAA43A', '#60BD68', '#F17CB0',
-      '#B2912F', '#B276B2', '#DECF3F', '#F15854'];
-  series.forEach(each => {
-    let description = each[1];
+  let colors = ['#4D4D4D', '#fff700', '#5DA5DA', '#FAA43A', '#60BD68',
+      '#F17CB0', '#B2912F', '#B276B2', '#DECF3F', '#F15854'];
+  series.forEach(([metric, description, type]) => {
     let color = colors.shift();
     // Add the bytes column.
-    data.addColumn('number', description + ' Bytes');
-    seriesOptions.push({targetAxisIndex: 0, color: color});
+    data.addColumn('number', description);
+    let options = {targetAxisIndex: 0, color: color};
+    if (type == 'area') options.type = 'area';
+    seriesOptions.push(options)
     // Add the time column.
-    data.addColumn('number', description + ' Duration');
-    seriesOptions.push({targetAxisIndex: 1, color: color, lineDashStyle: [3, 2]});
+    if (kUseDuration) {
+      data.addColumn('number', description + ' Duration');
+      seriesOptions.push(
+          {targetAxisIndex: 1, color: color, lineDashStyle: [3, 2]});
+    }
   });
-  // The first entry contains the total.
-  seriesOptions[0].type = 'area';
 
   const maxTime = Math.min(kMaxTime, end);
   console.time('metrics');
   let metricValues =
-    script.getAccumulatedTimeMetrics(metricNames , 0, maxTime, kTimeIncrement);
+    script.getAccumulatedTimeMetrics(metricNames , 0, maxTime, kTimeIncrement,
+        kCumulative, kUseDuration);
   console.timeEnd('metrics');
+  // Make sure that the series added to the graph matches the returned values.
   console.assert(metricValues[0].length == seriesOptions.length + 1);
   data.addRows(metricValues);
 
@@ -318,7 +337,7 @@
     },
     height: 400,
     width: 1000,
-    chartArea: {left: '5%', top: '15%', width: "85%", height: "75%"},
+    chartArea: {left: 70, top: 0, right: 160, height: "90%"},
     // The first series should be a area chart (total bytes touched),
     series: seriesOptions,
     // everthing else is a line.
@@ -332,28 +351,29 @@
   google.visualization.events.addListener(chart, 'select',
       () => selectGraphPointHandler(chart, data, script, parentNode));
   chart.draw(data, options);
-  // Add event listeners 
+  // Add event listeners
   console.timeEnd(timerLabel);
 }
 
-
 function selectGraphPointHandler(chart, data, script, parentNode) {
   let selection = chart.getSelection();
   if (selection.length <= 0) return;
   // Display a list of funktions with events at the given time.
   let {row, column} = selection[0];
   if (row === null|| column === null) return;
-  let name = series[((column-1)/2) | 0][0];
+  const kEntrySize = kUseDuration ? 2 : 1;
+  let [metric, description] = series[((column-1)/ kEntrySize) | 0];
   let time = data.getValue(row, 0);
   let funktions = script.getFunktionsAtTime(
-        time * kSecondsToMillis, kSelectionTimespan, name);
+        time * kSecondsToMillis, kSelectionTimespan, metric);
   let oldList = parentNode.querySelector('.funktion-list');
-  parentNode.replaceChild(createFunktionList(name, time, funktions), oldList);
+  parentNode.replaceChild(
+      createFunktionList(metric, description, time, funktions), oldList);
 }
 
-function createFunktionList(metric, time, funktions) {
+function createFunktionList(metric, description, time, funktions) {
   let container = createNode('div', 'funktion-list');
-  container.appendChild(h3('Changes of ' + metric + ' at ' +
+  container.appendChild(h3('Changes of "' + description + '" at ' +
         time + 's: ' + funktions.length));
   let listNode = createNode('ul');
   funktions.forEach(funktion => {
diff --git a/deps/v8/tools/parse-processor.js b/deps/v8/tools/parse-processor.js
index a561015f531a19..b829cf29d5be80 100644
--- a/deps/v8/tools/parse-processor.js
+++ b/deps/v8/tools/parse-processor.js
@@ -50,19 +50,6 @@ function PERCENT(value, total) {
   return Math.round(value / total * 100) + "%";
 }
 
-function timestampMin(list) {
-  let result = -1;
-  list.forEach(timestamp => {
-    if (result === -1) {
-      result = timestamp;
-    } else if (timestamp != -1) {
-      result = Math.min(result, timestamp);
-    }
-  });
-  return Math.round(result);
-}
-
-
 // ===========================================================================
 const kNoTimeMetrics = {
   __proto__: null,
@@ -75,20 +62,26 @@ const kNoTimeMetrics = {
 
 class CompilationUnit {
   constructor() {
+    this.isEval = false;
+
     // Lazily computed properties.
     this.firstEventTimestamp = -1;
     this.firstParseEventTimestamp = -1;
+    this.firstCompileEventTimestamp = -1;
     this.lastParseEventTimestamp = -1;
     this.lastEventTimestamp = -1;
+    this.deserializationTimestamp = -1;
 
     this.preparseTimestamp = -1;
     this.parseTimestamp = -1;
     this.parse2Timestamp = -1;
     this.resolutionTimestamp = -1;
-    this.lazyCompileTimestamp = -1;
     this.compileTimestamp = -1;
+    this.lazyCompileTimestamp = -1;
     this.executionTimestamp = -1;
+    this.optimizationTimestamp = -1;
 
+    this.deserializationDuration = -0.0;
     this.preparseDuration = -0.0;
     this.parseDuration = -0.0;
     this.parse2Duration = -0.0;
@@ -96,8 +89,71 @@ class CompilationUnit {
     this.scopeResolutionDuration = -0.0;
     this.lazyCompileDuration = -0.0;
     this.compileDuration = -0.0;
+    this.optimizeDuration = -0.0;
 
     this.ownBytes = -1;
+    this.compilationCacheHits = [];
+  }
+
+  finalize() {
+    this.firstEventTimestamp = this.timestampMin(
+        this.deserializationTimestamp, this.parseTimestamp,
+        this.preparseTimestamp, this.resolutionTimestamp,
+        this.executionTimestamp);
+
+    this.firstParseEventTimestamp = this.timestampMin(
+        this.deserializationTimestamp, this.parseTimestamp,
+        this.preparseTimestamp, this.resolutionTimestamp);
+
+    this.firstCompileEventTimestamp = this.rawTimestampMin(
+        this.deserializationTimestamp, this.compileTimestamp,
+        this.lazyCompileTimestamp);
+    // Any excuted script needs to be compiled.
+    if (this.hasBeenExecuted() &&
+        (this.firstCompileEventTimestamp <= 0 ||
+         this.executionTimestamp < this.firstCompileTimestamp)) {
+      console.error('Compile < execution timestamp', this);
+    }
+
+    if (this.ownBytes < 0) console.error(this, 'Own bytes must be positive');
+  }
+
+  hasBeenExecuted() {
+    return this.executionTimestamp > 0;
+  }
+
+  addCompilationCacheHit(timestamp) {
+    this.compilationCacheHits.push(timestamp);
+  }
+
+  // Returns the smallest timestamp from the given list, ignoring
+  // uninitialized (-1) values.
+  rawTimestampMin(...timestamps) {
+    timestamps = timestamps.length == 1 ? timestamps[0] : timestamps;
+    let result = timestamps.reduce((min, item) => {
+      return item == -1 ? min : (min == -1 ? item : Math.min(item, item));
+    }, -1);
+    return result;
+  }
+  timestampMin(...timestamps) {
+    let result = this.rawTimestampMin(...timestamps);
+    if (Number.isNaN(result) || result < 0) {
+      console.error(
+          'Invalid timestamp min:', {result, timestamps, script: this});
+      return 0;
+    }
+    return result;
+  }
+
+  timestampMax(...timestamps) {
+    timestamps = timestamps.length == 1 ? timestamps[0] : timestamps;
+    let result = Math.max(...timestamps);
+    if (Number.isNaN(result) || result < 0) {
+      console.error(
+          'Invalid timestamp max:', {result, timestamps, script: this});
+      return 0;
+    }
+    return result;
   }
 }
 
@@ -112,9 +168,8 @@ class Script extends CompilationUnit {
     this.id = id;
 
     this.isNative = false;
-    this.isEval = false;
     this.isBackgroundCompiled = false;
-    this.isDeserialized = false;
+    this.isStreamingCompiled = false;
 
     this.funktions = [];
     this.metrics = new Map();
@@ -133,17 +188,29 @@ class Script extends CompilationUnit {
   }
 
   isEmpty() {
-    return this.funktions.length === 0
+    return this.funktions.length === 0;
   }
 
-  funktionAtPosition(start) {
+  getFunktionAtStartPosition(start) {
     if (!this.isEval && start === 0) {
       throw 'position 0 is reserved for the script';
     }
-    if (this.finalized) throw 'Finalized script has no source position!';
+    if (this.finalized) {
+      return this.funktions.find(funktion => funktion.start == start);
+    }
     return this.funktions[start];
   }
 
+  // Return the innermost function at the given source position.
+  getFunktionForPosition(position) {
+    if (!this.finalized) throw 'Incomplete script';
+    for (let i = this.funktions.length - 1; i >= 0; i--) {
+      let funktion = this.funktions[i];
+      if (funktion.containsPosition(position)) return funktion;
+    }
+    return undefined;
+  }
+
   addMissingFunktions(list) {
     if (this.finalized) throw 'script is finalized!';
     list.forEach(fn => {
@@ -171,7 +238,7 @@ class Script extends CompilationUnit {
     let maxNesting = 0;
     // Iterate over the Funktions in byte position order.
     this.funktions.forEach(fn => {
-      fn.fromEval = this.isEval;
+      fn.isEval = this.isEval;
       if (parent === null) {
         parent = fn;
       } else {
@@ -185,24 +252,25 @@ class Script extends CompilationUnit {
         }
         parent = fn;
       }
-      this.firstParseEventTimestamp = this.firstParseEventTimestamp === -1 ?
-          fn.getFirstParseEventTimestamp() :
-          Math.min(
-              this.firstParseEventTimestamp, fn.getFirstParseEventTimestamp());
-      this.lastParseEventTimestamp = Math.max(
-          this.lastParseEventTimestamp, fn.getLastParseEventTimestamp());
-      fn.getFirstEventTimestamp();
-      if (Number.isNaN(this.lastEventTimestamp)) {
-        throw 'Invalid lastEventTimestamp';
-      }
+    });
+    // Sanity checks to ensure that scripts are executed and parsed before any
+    // of its funktions.
+    let funktionFirstParseEventTimestamp = -1;
+    // Second iteration step to finalize the funktions once the proper
+    // hierarchy has been set up.
+    this.funktions.forEach(fn => {
+      fn.finalize();
+
+      funktionFirstParseEventTimestamp = this.timestampMin(
+          funktionFirstParseEventTimestamp, fn.firstParseEventTimestamp);
+
+      this.lastParseEventTimestamp = this.timestampMax(
+          this.lastParseEventTimestamp, fn.lastParseEventTimestamp);
+
       this.lastEventTimestamp =
-          Math.max(this.lastEventTimestamp, fn.getLastEventTimestamp());
-      if (Number.isNaN(this.lastEventTimestamp)) {
-        throw 'Invalid lastEventTimestamp';
-      }
+          this.timestampMax(this.lastEventTimestamp, fn.lastEventTimestamp);
     });
     this.maxNestingLevel = maxNesting;
-    this.getFirstEventTimestamp();
 
     // Initialize sizes.
     if (!this.ownBytes === -1) throw 'Invalid state';
@@ -212,14 +280,19 @@ class Script extends CompilationUnit {
     }
     let toplevelFunktionBytes = this.funktions.reduce(
         (bytes, each) => bytes + (each.isToplevel() ? each.getBytes() : 0), 0);
-    if (this.isDeserialized || this.isEval || this.isBackgroundCompiled) {
+    if (this.isDeserialized || this.isEval || this.isStreamingCompiled) {
       if (this.getBytes() === -1) {
         this.bytesTotal = toplevelFunktionBytes;
       }
     }
     this.ownBytes = this.bytesTotal - toplevelFunktionBytes;
-    if (this.ownBytes < 0) {
-      console.error(this, 'Own bytes must be positive');
+    // Initialize common properties.
+    super.finalize();
+    // Sanity checks after the minimum timestamps have been computed.
+    if (funktionFirstParseEventTimestamp < this.firstParseEventTimestamp) {
+      console.error(
+          'invalid firstCompileEventTimestamp', this,
+          funktionFirstParseEventTimestamp, this.firstParseEventTimestamp);
     }
   }
 
@@ -290,7 +363,7 @@ class Script extends CompilationUnit {
     log("  - file:         " + this.file);
     log('  - details:      ' +
         'isEval=' + this.isEval + ' deserialized=' + this.isDeserialized +
-        ' streamed=' + this.isBackgroundCompiled);
+        ' streamed=' + this.isStreamingCompiled);
     info("scripts", this.getScripts());
     info("functions", all);
     info("toplevel fn", all.filter(each => each.isToplevel()));
@@ -300,7 +373,7 @@ class Script extends CompilationUnit {
     // info("fn parsed", all.filter(each => each.parse2Duration > 0));
     // info("resolved", all.filter(each => each.resolutionDuration > 0));
     info("executed", all.filter(each => each.executionTimestamp > 0));
-    info("forEval", all.filter(each => each.fromEval));
+    info('forEval', all.filter(each => each.isEval));
     info("lazy compiled", all.filter(each => each.lazyCompileTimestamp > 0));
     info("eager compiled", all.filter(each => each.compileTimestamp > 0));
 
@@ -326,7 +399,8 @@ class Script extends CompilationUnit {
     if (printSummary) console.log(this.summary);
   }
 
-  getAccumulatedTimeMetrics(metrics, start, end, delta, incremental = false) {
+  getAccumulatedTimeMetrics(
+      metrics, start, end, delta, cumulative = true, useDuration = false) {
     // Returns an array of the following format:
     // [ [start,         acc(metric0, start, start), acc(metric1, ...), ...],
     //   [start+delta,   acc(metric0, start, start+delta), ...],
@@ -349,7 +423,7 @@ class Script extends CompilationUnit {
     const metricProperties = ["time"];
     metrics.forEach(each => {
       metricProperties.push(each + 'Timestamp');
-      metricProperties.push(each + 'Duration');
+      if (useDuration) metricProperties.push(each + 'Duration');
     });
     // Create a packed {rowTemplate} which is copied later-on.
     let indexToTime = (t) => (start + t * delta) / kSecondsToMillis;
@@ -363,7 +437,8 @@ class Script extends CompilationUnit {
     this.forEach(funktionOrScript => {
       // Iterate over the Funktion's metric names, skipping position 0 which
       // is the time.
-      for (let i = 1; i < metricProperties.length; i += 2) {
+      const kMetricIncrement = useDuration ? 2 : 1;
+      for (let i = 1; i < metricProperties.length; i += kMetricIncrement) {
         let timestampPropertyName = metricProperties[i];
         let timestamp = funktionOrScript[timestampPropertyName];
         if (timestamp === void 0) continue;
@@ -379,6 +454,7 @@ class Script extends CompilationUnit {
         }
         // Add the metric value.
         row[i] += funktionOrScript.getMetricBytes(timestampPropertyName);
+        if (!useDuration) continue;
         let durationPropertyName = metricProperties[i + 1];
         row[i + 1] += funktionOrScript.getMetricDuration(durationPropertyName);
       }
@@ -392,14 +468,14 @@ class Script extends CompilationUnit {
       let current = rows[t];
       if (current === null) {
         // Ensure a zero data-point after each non-zero point.
-        if (incremental && rows[t - 1] !== null) {
+        if (!cumulative && rows[t - 1] !== null) {
           let duplicate = rowTemplate.slice();
           duplicate[0] = indexToTime(t);
           result.push(duplicate);
         }
         continue;
       }
-      if (!incremental) {
+      if (cumulative) {
         // Skip i==0 where the corresponding time value in seconds is.
         for (let i = 1; i < metricProperties.length; i++) {
           current[i] += previous[i];
@@ -407,7 +483,7 @@ class Script extends CompilationUnit {
       }
       // Make sure we have a data-point in time right before the current one.
       if (rows[t - 1] === null) {
-        let duplicate = (incremental ? rowTemplate : previous).slice();
+        let duplicate = (!cumulative ? rowTemplate : previous).slice();
         duplicate[0] = indexToTime(t - 1);
         result.push(duplicate);
       }
@@ -432,14 +508,6 @@ class Script extends CompilationUnit {
       funktion => funktion.didMetricChange(time, delta, metric));
     return result;
   }
-
-  getFirstEventTimestamp() {
-    if (this.firstEventTimestamp === -1) {
-      // TODO(cbruni): add support for network request timestanp
-      this.firstEventTimestamp = this.firstParseEventTimestamp;
-    }
-    return this.firstEventTimestamp;
-  }
 }
 
 
@@ -566,13 +634,29 @@ class Funktion extends CompilationUnit {
     this.end = end;
     this.script = script;
     this.parent = null;
-    this.fromEval = false;
     this.nested = [];
     this.nestingLevel = 0;
 
     if (script) this.script.addFunktion(this);
   }
 
+  finalize() {
+    this.lastParseEventTimestamp = Math.max(
+        this.preparseTimestamp + this.preparseDuration,
+        this.parseTimestamp + this.parseDuration,
+        this.resolutionTimestamp + this.resolutionDuration);
+    if (!(this.lastParseEventTimestamp > 0)) this.lastParseEventTimestamp = 0;
+
+    this.lastEventTimestamp =
+        Math.max(this.lastParseEventTimestamp, this.executionTimestamp);
+    if (!(this.lastEventTimestamp > 0)) this.lastEventTimestamp = 0;
+
+    this.ownBytes = this.nested.reduce(
+        (bytes, each) => bytes - each.getBytes(), this.getBytes());
+
+    super.finalize();
+  }
+
   getMetricBytes(name) {
     if (name == 'lazyCompileTimestamp') return this.getOwnBytes();
     return this.getOwnBytes();
@@ -583,67 +667,17 @@ class Funktion extends CompilationUnit {
     return this[name];
   }
 
-  getFirstEventTimestamp() {
-    if (this.firstEventTimestamp === -1) {
-      this.firstEventTimestamp = timestampMin(
-        [this.parseTimestamp, this.preparseTimestamp,
-          this.resolutionTimestamp, this.executionTimestamp
-        ]);
-      if (!(this.firstEventTimestamp > 0)) {
-        this.firstEventTimestamp = 0;
-      }
-    }
-    return this.firstEventTimestamp;
-  }
-
-  getFirstParseEventTimestamp() {
-    if (this.firstParseEventTimestamp === -1) {
-      this.firstParseEventTimestamp = timestampMin(
-        [this.parseTimestamp, this.preparseTimestamp,
-          this.resolutionTimestamp
-        ]);
-      if (!(this.firstParseEventTimestamp > 0)) {
-        this.firstParseEventTimestamp = 0;
-      }
-    }
-    return this.firstParseEventTimestamp;
-  }
-
-  getLastParseEventTimestamp() {
-    if (this.lastParseEventTimestamp === -1) {
-      this.lastParseEventTimestamp = Math.max(
-          this.preparseTimestamp + this.preparseDuration,
-          this.parseTimestamp + this.parseDuration,
-          this.resolutionTimestamp + this.resolutionDuration);
-      if (!(this.lastParseEventTimestamp > 0)) {
-        this.lastParseEventTimestamp = 0;
-      }
-    }
-    return this.lastParseEventTimestamp;
-  }
-
-  getLastEventTimestamp() {
-    if (this.lastEventTimestamp === -1) {
-      this.lastEventTimestamp =
-          Math.max(this.getLastParseEventTimestamp(), this.executionTimestamp);
-      if (!(this.lastEventTimestamp > 0)) {
-        this.lastEventTimestamp = 0;
-      }
-    }
-    return this.lastEventTimestamp;
-  }
-
   isNestedIn(funktion) {
     if (this.script != funktion.script) throw "Incompatible script";
     return funktion.start < this.start && this.end <= funktion.end;
   }
 
   isToplevel() {
-    return this.parent === null
+    return this.parent === null;
   }
 
-  hasBeenExecuted() {
-    return this.executionTimestamp > 0
+  containsPosition(position) {
+    return this.start <= position && position <= this.end;
   }
 
   accumulateNestingLevel(accumulator) {
@@ -673,12 +707,6 @@ class Funktion extends CompilationUnit {
   }
 
   getOwnBytes() {
-    if (this.ownBytes === -1) {
-      this.ownBytes = this.nested.reduce(
-        (bytes, each) => bytes - each.getBytes(),
-        this.getBytes());
-      if (this.ownBytes < 0) throw "Own bytes must be positive";
-    }
     return this.ownBytes;
   }
 
@@ -693,7 +721,7 @@ class Funktion extends CompilationUnit {
 
   toString(details = true) {
     let result = 'function' + (this.name ? ' ' + this.name : '') +
-      `() range=${this.start}-${this.end}`;
+        `() range=${this.start}-${this.end}`;
     if (details) result += ` script=${this.script ? this.script.id : 'X'}`;
     return result;
   }
@@ -733,14 +761,15 @@ class ParseProcessor extends LogReader {
         ],
         processor: this.processFunctionEvent
       },
-      // "compilation-cache", "hit"|"put", {type}, {start position},
-      // {end position}
+      // "compilation-cache","hit"|"put",{type},{scriptid},{start position},
+      // {end position},{timestamp}
       'compilation-cache': {
-        parsers: [parseString, parseString, parseInt, parseInt],
+        parsers:
+            [parseString, parseString, parseInt, parseInt, parseInt, parseInt],
         processor: this.processCompilationCacheEvent
       },
       'script': {
-        parsers: [parseString, parseInt],
+        parsers: [parseString, parseInt, parseInt],
         processor: this.processScriptEvent
       },
       // "script-details", {script_id}, {file}, {line}, {column}, {size}
@@ -762,15 +791,16 @@ class ParseProcessor extends LogReader {
       // TODO(cbruni): make sure arrow functions emit a normal parse-function
       // event.
       'parse': this.processParseFunction.bind(this),
-      'parse-script': this.processScript.bind(this),
-      'parse-eval': this.processEval.bind(this),
+      'parse-script': this.processParseScript.bind(this),
+      'parse-eval': this.processParseEval.bind(this),
       'preparse-no-resolution': this.processPreparseNoResolution.bind(this),
       'preparse-resolution': this.processPreparseResolution.bind(this),
       'first-execution': this.processFirstExecution.bind(this),
       'compile-lazy': this.processCompileLazy.bind(this),
       'compile': this.processCompile.bind(this),
       'compile-eval': this.processCompileEval.bind(this),
-      'optimize-lazy': this.processOptimizeLazy.bind(this)
+      'optimize-lazy': this.processOptimizeLazy.bind(this),
+      'deserialize': this.processDeserialize.bind(this),
     };
 
     this.idToScript = new Map();
@@ -825,15 +855,16 @@ class ParseProcessor extends LogReader {
       script.calculateMetrics(false)
     });
 
-    this.firstEventTimestamp =
-        timestampMin(this.scripts.map(each => each.firstEventTimestamp));
-    this.lastParseEventTimestamp = this.scripts.reduce(
-        (max, script) => Math.max(max, script.lastParseEventTimestamp), -1);
-    this.lastEventTimestamp = this.scripts.reduce(
-        (max, script) => Math.max(max, script.lastEventTimestamp), -1);
-
     this.scripts.forEach(script => this.totalScript.addAllFunktions(script));
     this.totalScript.calculateMetrics(true);
+
+    this.firstEventTimestamp = this.totalScript.timestampMin(
+        this.scripts.map(each => each.firstEventTimestamp));
+    this.lastParseEventTimestamp = this.totalScript.timestampMax(
+        this.scripts.map(each => each.lastParseEventTimestamp));
+    this.lastEventTimestamp = this.totalScript.timestampMax(
+        this.scripts.map(each => each.lastEventTimestamp));
+
     const series = {
       firstParseEvent: 'Any Parse Event',
       parse: 'Parsing',
@@ -874,7 +905,7 @@ class ParseProcessor extends LogReader {
       return this.lookupFunktionByRange(startPosition, endPosition);
     }
     let script = this.lookupScript(scriptId);
-    let funktion = script.funktionAtPosition(startPosition);
+    let funktion = script.getFunktionAtStartPosition(startPosition);
     if (funktion === void 0) {
       funktion = new Funktion(functionName, startPosition, endPosition, script);
     }
@@ -899,18 +930,41 @@ class ParseProcessor extends LogReader {
     return results[0];
   }
 
-  processScriptEvent(eventName, scriptId) {
-    if (['create', 'reserve-id', 'deserialize'].includes(eventName)) {
-      if (this.idToScript.has(scriptId)) return;
-      let script = new Script(scriptId);
-      this.idToScript.set(scriptId, script);
-      if (eventName == 'deserialize') script.isDeserialized = true;
-      return;
-    } else if (eventName === 'background-compile') {
-      this.idToScript.get(scriptId).isBackgroundCompiled = true;
-      return;
+  processScriptEvent(eventName, scriptId, timestamp) {
+    let script = this.idToScript.get(scriptId);
+    switch (eventName) {
+      case 'create':
+      case 'reserve-id':
+      case 'deserialize': {
+        if (script !== undefined) return;
+        script = new Script(scriptId);
+        this.idToScript.set(scriptId, script);
+        if (eventName == 'deserialize') {
+          script.deserializationTimestamp = toTimestamp(timestamp);
+        }
+        return;
+      }
+      case 'background-compile':
+        if (script.isBackgroundCompiled) {
+          throw 'Cannot background-compile twice';
+        }
+        script.isBackgroundCompiled = true;
+        // TODO(cbruni): remove once backwards compatibility is no longer needed.
+        script.isStreamingCompiled = true;
+        // TODO(cbruni): fix parse events for background compilation scripts
+        script.preparseTimestamp = toTimestamp(timestamp);
+        return;
+      case 'streaming-compile':
+        if (script.isStreamingCompiled) throw 'Cannot stream-compile twice';
+        // TODO(cbruni): remove once backwards compatibility is no longer needed.
+        script.isBackgroundCompiled = true;
+        script.isStreamingCompiled = true;
+        // TODO(cbruni): fix parse events for background compilation scripts
+        script.preparseTimestamp = toTimestamp(timestamp);
+        return;
+      default:
+        console.error('Unhandled script event: ' + eventName);
     }
-    console.error('Unhandled script event: ' + eventName);
   }
 
   processScriptDetails(scriptId, file, startLine, startColumn, size) {
@@ -923,9 +977,12 @@ class ParseProcessor extends LogReader {
     script.source = source;
   }
 
-  processEval(
+  processParseEval(
       scriptId, startPosition, endPosition, duration, timestamp, functionName) {
-    let script = this.lookupScript(scriptId);
+    if (startPosition != 0 && startPosition != -1) {
+      console.error('Invalid start position for parse-eval', arguments);
+    }
+    let script = this.processParseScript(...arguments);
     script.isEval = true;
   }
 
@@ -952,15 +1009,14 @@ class ParseProcessor extends LogReader {
     funktion.parseDuration = duration;
   }
 
-  processScript(
+  processParseScript(
       scriptId, startPosition, endPosition, duration, timestamp, functionName) {
     // TODO timestamp and duration
     let script = this.lookupScript(scriptId);
     let ts = startOf(timestamp, duration);
     script.parseTimestamp = ts;
-    script.firstEventTimestamp = ts;
-    script.firstParseEventTimestamp = ts;
     script.parseDuration = duration;
+    return script;
   }
 
   processPreparseResolution(
@@ -989,11 +1045,11 @@ class ParseProcessor extends LogReader {
         script.executionTimestamp = toTimestamp(timestamp);
       }
     } else {
-      let funktion = script.funktionAtPosition(startPosition);
+      let funktion = script.getFunktionAtStartPosition(startPosition);
       if (funktion) {
         funktion.executionTimestamp = toTimestamp(timestamp);
-      } else if (functionName.length > 0) {
-        // throw new Error("Could not find function: " + functionName);
+      } else {
+        // TODO(cbruni): handle funktions from  compilation-cache hits.
       }
     }
   }
@@ -1012,27 +1068,63 @@ class ParseProcessor extends LogReader {
       script.compileTimestamp = startOf(timestamp, duration);
       script.compileDuration = duration;
       script.bytesTotal = endPosition;
+      return script;
     } else {
-      let funktion = script.funktionAtPosition(startPosition);
+      let funktion = script.getFunktionAtStartPosition(startPosition);
       if (funktion === undefined) {
         // This should not happen since any funktion has to be parsed first.
-        console.log("processCompile funktion not found", ...arguments);
+        console.error('processCompile funktion not found', ...arguments);
+        return;
       }
       funktion.compileTimestamp = startOf(timestamp, duration);
       funktion.compileDuration = duration;
+      return funktion;
     }
   }
 
   processCompileEval(
       scriptId, startPosition, endPosition, duration, timestamp, functionName) {
+    let compilationUnit = this.processCompile(...arguments);
+    compilationUnit.isEval = true;
   }
 
   processOptimizeLazy(
       scriptId, startPosition, endPosition, duration, timestamp, functionName) {
+    let compilationUnit = this.lookupScript(scriptId);
+    if (startPosition > 0) {
+      compilationUnit =
+          compilationUnit.getFunktionAtStartPosition(startPosition);
+      if (compilationUnit === undefined) {
+        // This should not happen since any funktion has to be parsed first.
+        console.error('processOptimizeLazy funktion not found', ...arguments);
+        return;
+      }
+    }
+    compilationUnit.optimizationTimestamp = startOf(timestamp, duration);
+    compilationUnit.optimizationDuration = duration;
   }
 
-  processCompilationCacheEvent(eventType, cacheType, startPosition,
-      endPosition) {
+  processDeserialize(
+      scriptId, startPosition, endPosition, duration, timestamp, functionName) {
+    let compilationUnit = this.lookupScript(scriptId);
+    if (startPosition === 0) {
+      compilationUnit.bytesTotal = endPosition;
+    } else {
+      compilationUnit = this.getOrCreateFunction(...arguments);
+    }
+    compilationUnit.deserializationTimestamp = startOf(timestamp, duration);
+    compilationUnit.deserializationDuration = duration;
+  }
+
+  processCompilationCacheEvent(
+      eventType, cacheType, scriptId, startPosition, endPosition, timestamp) {
+    if (eventType !== 'hit') return;
+    let compilationUnit = this.lookupScript(scriptId);
+    if (startPosition > 0) {
+      compilationUnit =
+          compilationUnit.getFunktionAtStartPosition(startPosition);
+    }
+    compilationUnit.addCompilationCacheHit(toTimestamp(timestamp));
   }
 
 }
diff --git a/deps/v8/tools/turbolizer/index.html b/deps/v8/tools/turbolizer/index.html
index 47375cbbb02703..ea89a61261d874 100644
--- a/deps/v8/tools/turbolizer/index.html
+++ b/deps/v8/tools/turbolizer/index.html
@@ -58,7 +58,6 @@
              src="right-arrow.png" class="button-input">
     </div>
     <script src="https://cdn.rawgit.com/google/code-prettify/master/loader/run_prettify.js"></script>
-    <script src="https://d3js.org/d3.v5.js" charset="utf-8"></script>
     <script src="build/turbolizer.js"></script>
   </body>
 </html>
diff --git a/deps/v8/tools/turbolizer/package-lock.json b/deps/v8/tools/turbolizer/package-lock.json
index d12b8096d5e83d..fc9557f76df95d 100644
--- a/deps/v8/tools/turbolizer/package-lock.json
+++ b/deps/v8/tools/turbolizer/package-lock.json
@@ -290,6 +290,11 @@
         "repeat-element": "^1.1.2"
       }
     },
+    "builtin-modules": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/builtin-modules/-/builtin-modules-2.0.0.tgz",
+      "integrity": "sha512-3U5kUA5VPsRUA3nofm/BXX7GVHKfxz0hOBAPxXrIvHzlDRkQVqEn6yi8QJegxl4LzOHLdvb7XF5dVawa/VVYBg=="
+    },
     "commander": {
       "version": "2.15.1",
       "resolved": "https://registry.npmjs.org/commander/-/commander-2.15.1.tgz",
@@ -714,6 +719,11 @@
         "is-extglob": "^1.0.0"
       }
     },
+    "is-module": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/is-module/-/is-module-1.0.0.tgz",
+      "integrity": "sha1-Mlj7afeMFNW4FdZkM2tM/7ZEFZE="
+    },
     "is-number": {
       "version": "2.1.0",
       "resolved": "https://registry.npmjs.org/is-number/-/is-number-2.1.0.tgz",
@@ -907,6 +917,16 @@
         "@types/node": "*"
       }
     },
+    "rollup-plugin-node-resolve": {
+      "version": "3.3.0",
+      "resolved": "https://registry.npmjs.org/rollup-plugin-node-resolve/-/rollup-plugin-node-resolve-3.3.0.tgz",
+      "integrity": "sha512-9zHGr3oUJq6G+X0oRMYlzid9fXicBdiydhwGChdyeNRGPcN/majtegApRKHLR5drboUvEWU+QeUmGTyEZQs3WA==",
+      "requires": {
+        "builtin-modules": "^2.0.0",
+        "is-module": "^1.0.0",
+        "resolve": "^1.1.6"
+      }
+    },
     "rollup-plugin-typescript2": {
       "version": "0.15.1",
       "resolved": "https://registry.npmjs.org/rollup-plugin-typescript2/-/rollup-plugin-typescript2-0.15.1.tgz",
diff --git a/deps/v8/tools/turbolizer/package.json b/deps/v8/tools/turbolizer/package.json
index e5d1b1a011574a..1d8efc5286e963 100644
--- a/deps/v8/tools/turbolizer/package.json
+++ b/deps/v8/tools/turbolizer/package.json
@@ -15,6 +15,7 @@
     "d3": "^5.5.0",
     "pegjs": "^0.10.0",
     "rollup": "^0.62.0",
+    "rollup-plugin-node-resolve": "^3.3.0",
     "rollup-plugin-typescript2": "^0.15.1"
   },
   "repository": {
diff --git a/deps/v8/tools/turbolizer/rollup.config.js b/deps/v8/tools/turbolizer/rollup.config.js
index f01ab4916f6407..844e6e186d07fd 100644
--- a/deps/v8/tools/turbolizer/rollup.config.js
+++ b/deps/v8/tools/turbolizer/rollup.config.js
@@ -3,10 +3,11 @@
 // found in the LICENSE file.
 
 import typescript from 'rollup-plugin-typescript2';
+import node from 'rollup-plugin-node-resolve';
 
 export default {
   entry: "src/turbo-visualizer.ts",
   format: "iife",
-  plugins: [typescript({abortOnError:false})],
+  plugins: [node(), typescript({abortOnError:false})],
   dest: "build/turbolizer.js"
 };
diff --git a/deps/v8/tools/v8heapconst.py b/deps/v8/tools/v8heapconst.py
index 56a74c208c2008..7c422d8cac9006 100644
--- a/deps/v8/tools/v8heapconst.py
+++ b/deps/v8/tools/v8heapconst.py
@@ -173,185 +173,185 @@
 # List of known V8 maps.
 KNOWN_MAPS = {
   ("RO_SPACE", 0x02201): (138, "FreeSpaceMap"),
-  ("RO_SPACE", 0x02259): (132, "MetaMap"),
-  ("RO_SPACE", 0x022e1): (131, "NullMap"),
-  ("RO_SPACE", 0x02359): (205, "DescriptorArrayMap"),
-  ("RO_SPACE", 0x023c1): (182, "FixedArrayMap"),
-  ("RO_SPACE", 0x02429): (222, "WeakCellMap"),
-  ("RO_SPACE", 0x024d1): (152, "OnePointerFillerMap"),
-  ("RO_SPACE", 0x02539): (152, "TwoPointerFillerMap"),
-  ("RO_SPACE", 0x025d1): (131, "UninitializedMap"),
-  ("RO_SPACE", 0x02661): (8, "OneByteInternalizedStringMap"),
-  ("RO_SPACE", 0x02721): (131, "UndefinedMap"),
-  ("RO_SPACE", 0x02799): (129, "HeapNumberMap"),
-  ("RO_SPACE", 0x02831): (131, "TheHoleMap"),
-  ("RO_SPACE", 0x028f9): (131, "BooleanMap"),
-  ("RO_SPACE", 0x02a09): (136, "ByteArrayMap"),
-  ("RO_SPACE", 0x02a71): (182, "FixedCOWArrayMap"),
-  ("RO_SPACE", 0x02ad9): (184, "HashTableMap"),
-  ("RO_SPACE", 0x02b41): (128, "SymbolMap"),
-  ("RO_SPACE", 0x02ba9): (72, "OneByteStringMap"),
-  ("RO_SPACE", 0x02c11): (193, "ScopeInfoMap"),
-  ("RO_SPACE", 0x02c79): (216, "SharedFunctionInfoMap"),
-  ("RO_SPACE", 0x02ce1): (133, "CodeMap"),
-  ("RO_SPACE", 0x02d49): (199, "FunctionContextMap"),
-  ("RO_SPACE", 0x02db1): (208, "CellMap"),
-  ("RO_SPACE", 0x02e19): (215, "GlobalPropertyCellMap"),
-  ("RO_SPACE", 0x02e81): (135, "ForeignMap"),
-  ("RO_SPACE", 0x02ee9): (206, "TransitionArrayMap"),
-  ("RO_SPACE", 0x02f51): (211, "FeedbackVectorMap"),
-  ("RO_SPACE", 0x02ff9): (131, "ArgumentsMarkerMap"),
-  ("RO_SPACE", 0x030b9): (131, "ExceptionMap"),
-  ("RO_SPACE", 0x03179): (131, "TerminationExceptionMap"),
-  ("RO_SPACE", 0x03241): (131, "OptimizedOutMap"),
-  ("RO_SPACE", 0x03301): (131, "StaleRegisterMap"),
-  ("RO_SPACE", 0x03391): (201, "NativeContextMap"),
-  ("RO_SPACE", 0x033f9): (200, "ModuleContextMap"),
-  ("RO_SPACE", 0x03461): (198, "EvalContextMap"),
-  ("RO_SPACE", 0x034c9): (202, "ScriptContextMap"),
-  ("RO_SPACE", 0x03531): (195, "BlockContextMap"),
-  ("RO_SPACE", 0x03599): (196, "CatchContextMap"),
-  ("RO_SPACE", 0x03601): (203, "WithContextMap"),
-  ("RO_SPACE", 0x03669): (197, "DebugEvaluateContextMap"),
-  ("RO_SPACE", 0x036d1): (194, "ScriptContextTableMap"),
-  ("RO_SPACE", 0x03739): (151, "FeedbackMetadataArrayMap"),
-  ("RO_SPACE", 0x037a1): (182, "ArrayListMap"),
-  ("RO_SPACE", 0x03809): (130, "BigIntMap"),
-  ("RO_SPACE", 0x03871): (183, "ObjectBoilerplateDescriptionMap"),
-  ("RO_SPACE", 0x038d9): (137, "BytecodeArrayMap"),
-  ("RO_SPACE", 0x03941): (209, "CodeDataContainerMap"),
-  ("RO_SPACE", 0x039a9): (150, "FixedDoubleArrayMap"),
-  ("RO_SPACE", 0x03a11): (188, "GlobalDictionaryMap"),
-  ("RO_SPACE", 0x03a79): (210, "ManyClosuresCellMap"),
-  ("RO_SPACE", 0x03ae1): (182, "ModuleInfoMap"),
-  ("RO_SPACE", 0x03b49): (134, "MutableHeapNumberMap"),
-  ("RO_SPACE", 0x03bb1): (187, "NameDictionaryMap"),
-  ("RO_SPACE", 0x03c19): (210, "NoClosuresCellMap"),
-  ("RO_SPACE", 0x03c81): (189, "NumberDictionaryMap"),
-  ("RO_SPACE", 0x03ce9): (210, "OneClosureCellMap"),
-  ("RO_SPACE", 0x03d51): (185, "OrderedHashMapMap"),
-  ("RO_SPACE", 0x03db9): (186, "OrderedHashSetMap"),
-  ("RO_SPACE", 0x03e21): (213, "PreParsedScopeDataMap"),
-  ("RO_SPACE", 0x03e89): (214, "PropertyArrayMap"),
-  ("RO_SPACE", 0x03ef1): (207, "SideEffectCallHandlerInfoMap"),
-  ("RO_SPACE", 0x03f59): (207, "SideEffectFreeCallHandlerInfoMap"),
-  ("RO_SPACE", 0x03fc1): (207, "NextCallSideEffectFreeCallHandlerInfoMap"),
-  ("RO_SPACE", 0x04029): (190, "SimpleNumberDictionaryMap"),
-  ("RO_SPACE", 0x04091): (182, "SloppyArgumentsElementsMap"),
-  ("RO_SPACE", 0x040f9): (217, "SmallOrderedHashMapMap"),
-  ("RO_SPACE", 0x04161): (218, "SmallOrderedHashSetMap"),
-  ("RO_SPACE", 0x041c9): (191, "StringTableMap"),
-  ("RO_SPACE", 0x04231): (220, "UncompiledDataWithoutPreParsedScopeMap"),
-  ("RO_SPACE", 0x04299): (221, "UncompiledDataWithPreParsedScopeMap"),
-  ("RO_SPACE", 0x04301): (204, "WeakFixedArrayMap"),
-  ("RO_SPACE", 0x04369): (223, "WeakArrayListMap"),
-  ("RO_SPACE", 0x043d1): (192, "EphemeronHashTableMap"),
-  ("RO_SPACE", 0x04439): (106, "NativeSourceStringMap"),
-  ("RO_SPACE", 0x044a1): (64, "StringMap"),
-  ("RO_SPACE", 0x04509): (73, "ConsOneByteStringMap"),
-  ("RO_SPACE", 0x04571): (65, "ConsStringMap"),
-  ("RO_SPACE", 0x045d9): (77, "ThinOneByteStringMap"),
-  ("RO_SPACE", 0x04641): (69, "ThinStringMap"),
-  ("RO_SPACE", 0x046a9): (67, "SlicedStringMap"),
-  ("RO_SPACE", 0x04711): (75, "SlicedOneByteStringMap"),
-  ("RO_SPACE", 0x04779): (66, "ExternalStringMap"),
-  ("RO_SPACE", 0x047e1): (82, "ExternalStringWithOneByteDataMap"),
-  ("RO_SPACE", 0x04849): (74, "ExternalOneByteStringMap"),
-  ("RO_SPACE", 0x048b1): (98, "ShortExternalStringMap"),
-  ("RO_SPACE", 0x04919): (114, "ShortExternalStringWithOneByteDataMap"),
-  ("RO_SPACE", 0x04981): (0, "InternalizedStringMap"),
-  ("RO_SPACE", 0x049e9): (2, "ExternalInternalizedStringMap"),
-  ("RO_SPACE", 0x04a51): (18, "ExternalInternalizedStringWithOneByteDataMap"),
-  ("RO_SPACE", 0x04ab9): (10, "ExternalOneByteInternalizedStringMap"),
-  ("RO_SPACE", 0x04b21): (34, "ShortExternalInternalizedStringMap"),
-  ("RO_SPACE", 0x04b89): (50, "ShortExternalInternalizedStringWithOneByteDataMap"),
-  ("RO_SPACE", 0x04bf1): (42, "ShortExternalOneByteInternalizedStringMap"),
-  ("RO_SPACE", 0x04c59): (106, "ShortExternalOneByteStringMap"),
-  ("RO_SPACE", 0x04cc1): (140, "FixedUint8ArrayMap"),
-  ("RO_SPACE", 0x04d29): (139, "FixedInt8ArrayMap"),
-  ("RO_SPACE", 0x04d91): (142, "FixedUint16ArrayMap"),
-  ("RO_SPACE", 0x04df9): (141, "FixedInt16ArrayMap"),
-  ("RO_SPACE", 0x04e61): (144, "FixedUint32ArrayMap"),
-  ("RO_SPACE", 0x04ec9): (143, "FixedInt32ArrayMap"),
-  ("RO_SPACE", 0x04f31): (145, "FixedFloat32ArrayMap"),
-  ("RO_SPACE", 0x04f99): (146, "FixedFloat64ArrayMap"),
-  ("RO_SPACE", 0x05001): (147, "FixedUint8ClampedArrayMap"),
-  ("RO_SPACE", 0x05069): (149, "FixedBigUint64ArrayMap"),
-  ("RO_SPACE", 0x050d1): (148, "FixedBigInt64ArrayMap"),
-  ("RO_SPACE", 0x05139): (131, "SelfReferenceMarkerMap"),
-  ("RO_SPACE", 0x051b9): (171, "Tuple2Map"),
-  ("RO_SPACE", 0x05509): (161, "InterceptorInfoMap"),
-  ("RO_SPACE", 0x05629): (169, "ScriptMap"),
-  ("RO_SPACE", 0x0a021): (154, "AccessorInfoMap"),
-  ("RO_SPACE", 0x0a089): (153, "AccessCheckInfoMap"),
-  ("RO_SPACE", 0x0a0f1): (155, "AccessorPairMap"),
-  ("RO_SPACE", 0x0a159): (156, "AliasedArgumentsEntryMap"),
-  ("RO_SPACE", 0x0a1c1): (157, "AllocationMementoMap"),
-  ("RO_SPACE", 0x0a229): (158, "AsyncGeneratorRequestMap"),
-  ("RO_SPACE", 0x0a291): (159, "DebugInfoMap"),
-  ("RO_SPACE", 0x0a2f9): (160, "FunctionTemplateInfoMap"),
-  ("RO_SPACE", 0x0a361): (162, "InterpreterDataMap"),
-  ("RO_SPACE", 0x0a3c9): (163, "ModuleInfoEntryMap"),
-  ("RO_SPACE", 0x0a431): (164, "ModuleMap"),
-  ("RO_SPACE", 0x0a499): (165, "ObjectTemplateInfoMap"),
-  ("RO_SPACE", 0x0a501): (166, "PromiseCapabilityMap"),
-  ("RO_SPACE", 0x0a569): (167, "PromiseReactionMap"),
-  ("RO_SPACE", 0x0a5d1): (168, "PrototypeInfoMap"),
-  ("RO_SPACE", 0x0a639): (170, "StackFrameInfoMap"),
-  ("RO_SPACE", 0x0a6a1): (172, "Tuple3Map"),
-  ("RO_SPACE", 0x0a709): (173, "ArrayBoilerplateDescriptionMap"),
-  ("RO_SPACE", 0x0a771): (174, "WasmDebugInfoMap"),
-  ("RO_SPACE", 0x0a7d9): (175, "WasmExportedFunctionDataMap"),
-  ("RO_SPACE", 0x0a841): (176, "CallableTaskMap"),
-  ("RO_SPACE", 0x0a8a9): (177, "CallbackTaskMap"),
-  ("RO_SPACE", 0x0a911): (178, "PromiseFulfillReactionJobTaskMap"),
-  ("RO_SPACE", 0x0a979): (179, "PromiseRejectReactionJobTaskMap"),
-  ("RO_SPACE", 0x0a9e1): (180, "PromiseResolveThenableJobTaskMap"),
-  ("RO_SPACE", 0x0aa49): (181, "AllocationSiteMap"),
-  ("RO_SPACE", 0x0aab1): (181, "AllocationSiteMap"),
+  ("RO_SPACE", 0x02251): (132, "MetaMap"),
+  ("RO_SPACE", 0x022d1): (131, "NullMap"),
+  ("RO_SPACE", 0x02341): (205, "DescriptorArrayMap"),
+  ("RO_SPACE", 0x023a1): (182, "FixedArrayMap"),
+  ("RO_SPACE", 0x023f1): (152, "OnePointerFillerMap"),
+  ("RO_SPACE", 0x02441): (152, "TwoPointerFillerMap"),
+  ("RO_SPACE", 0x024c1): (131, "UninitializedMap"),
+  ("RO_SPACE", 0x02539): (8, "OneByteInternalizedStringMap"),
+  ("RO_SPACE", 0x025e1): (131, "UndefinedMap"),
+  ("RO_SPACE", 0x02641): (129, "HeapNumberMap"),
+  ("RO_SPACE", 0x026c1): (131, "TheHoleMap"),
+  ("RO_SPACE", 0x02771): (131, "BooleanMap"),
+  ("RO_SPACE", 0x02869): (136, "ByteArrayMap"),
+  ("RO_SPACE", 0x028b9): (182, "FixedCOWArrayMap"),
+  ("RO_SPACE", 0x02909): (184, "HashTableMap"),
+  ("RO_SPACE", 0x02959): (128, "SymbolMap"),
+  ("RO_SPACE", 0x029a9): (72, "OneByteStringMap"),
+  ("RO_SPACE", 0x029f9): (193, "ScopeInfoMap"),
+  ("RO_SPACE", 0x02a49): (216, "SharedFunctionInfoMap"),
+  ("RO_SPACE", 0x02a99): (133, "CodeMap"),
+  ("RO_SPACE", 0x02ae9): (199, "FunctionContextMap"),
+  ("RO_SPACE", 0x02b39): (208, "CellMap"),
+  ("RO_SPACE", 0x02b89): (222, "WeakCellMap"),
+  ("RO_SPACE", 0x02bd9): (215, "GlobalPropertyCellMap"),
+  ("RO_SPACE", 0x02c29): (135, "ForeignMap"),
+  ("RO_SPACE", 0x02c79): (206, "TransitionArrayMap"),
+  ("RO_SPACE", 0x02cc9): (211, "FeedbackVectorMap"),
+  ("RO_SPACE", 0x02d59): (131, "ArgumentsMarkerMap"),
+  ("RO_SPACE", 0x02e01): (131, "ExceptionMap"),
+  ("RO_SPACE", 0x02ea9): (131, "TerminationExceptionMap"),
+  ("RO_SPACE", 0x02f59): (131, "OptimizedOutMap"),
+  ("RO_SPACE", 0x03001): (131, "StaleRegisterMap"),
+  ("RO_SPACE", 0x03079): (201, "NativeContextMap"),
+  ("RO_SPACE", 0x030c9): (200, "ModuleContextMap"),
+  ("RO_SPACE", 0x03119): (198, "EvalContextMap"),
+  ("RO_SPACE", 0x03169): (202, "ScriptContextMap"),
+  ("RO_SPACE", 0x031b9): (195, "BlockContextMap"),
+  ("RO_SPACE", 0x03209): (196, "CatchContextMap"),
+  ("RO_SPACE", 0x03259): (203, "WithContextMap"),
+  ("RO_SPACE", 0x032a9): (197, "DebugEvaluateContextMap"),
+  ("RO_SPACE", 0x032f9): (194, "ScriptContextTableMap"),
+  ("RO_SPACE", 0x03349): (151, "FeedbackMetadataArrayMap"),
+  ("RO_SPACE", 0x03399): (182, "ArrayListMap"),
+  ("RO_SPACE", 0x033e9): (130, "BigIntMap"),
+  ("RO_SPACE", 0x03439): (183, "ObjectBoilerplateDescriptionMap"),
+  ("RO_SPACE", 0x03489): (137, "BytecodeArrayMap"),
+  ("RO_SPACE", 0x034d9): (209, "CodeDataContainerMap"),
+  ("RO_SPACE", 0x03529): (150, "FixedDoubleArrayMap"),
+  ("RO_SPACE", 0x03579): (188, "GlobalDictionaryMap"),
+  ("RO_SPACE", 0x035c9): (210, "ManyClosuresCellMap"),
+  ("RO_SPACE", 0x03619): (182, "ModuleInfoMap"),
+  ("RO_SPACE", 0x03669): (134, "MutableHeapNumberMap"),
+  ("RO_SPACE", 0x036b9): (187, "NameDictionaryMap"),
+  ("RO_SPACE", 0x03709): (210, "NoClosuresCellMap"),
+  ("RO_SPACE", 0x03759): (189, "NumberDictionaryMap"),
+  ("RO_SPACE", 0x037a9): (210, "OneClosureCellMap"),
+  ("RO_SPACE", 0x037f9): (185, "OrderedHashMapMap"),
+  ("RO_SPACE", 0x03849): (186, "OrderedHashSetMap"),
+  ("RO_SPACE", 0x03899): (213, "PreParsedScopeDataMap"),
+  ("RO_SPACE", 0x038e9): (214, "PropertyArrayMap"),
+  ("RO_SPACE", 0x03939): (207, "SideEffectCallHandlerInfoMap"),
+  ("RO_SPACE", 0x03989): (207, "SideEffectFreeCallHandlerInfoMap"),
+  ("RO_SPACE", 0x039d9): (207, "NextCallSideEffectFreeCallHandlerInfoMap"),
+  ("RO_SPACE", 0x03a29): (190, "SimpleNumberDictionaryMap"),
+  ("RO_SPACE", 0x03a79): (182, "SloppyArgumentsElementsMap"),
+  ("RO_SPACE", 0x03ac9): (217, "SmallOrderedHashMapMap"),
+  ("RO_SPACE", 0x03b19): (218, "SmallOrderedHashSetMap"),
+  ("RO_SPACE", 0x03b69): (191, "StringTableMap"),
+  ("RO_SPACE", 0x03bb9): (220, "UncompiledDataWithoutPreParsedScopeMap"),
+  ("RO_SPACE", 0x03c09): (221, "UncompiledDataWithPreParsedScopeMap"),
+  ("RO_SPACE", 0x03c59): (204, "WeakFixedArrayMap"),
+  ("RO_SPACE", 0x03ca9): (223, "WeakArrayListMap"),
+  ("RO_SPACE", 0x03cf9): (192, "EphemeronHashTableMap"),
+  ("RO_SPACE", 0x03d49): (106, "NativeSourceStringMap"),
+  ("RO_SPACE", 0x03d99): (64, "StringMap"),
+  ("RO_SPACE", 0x03de9): (73, "ConsOneByteStringMap"),
+  ("RO_SPACE", 0x03e39): (65, "ConsStringMap"),
+  ("RO_SPACE", 0x03e89): (77, "ThinOneByteStringMap"),
+  ("RO_SPACE", 0x03ed9): (69, "ThinStringMap"),
+  ("RO_SPACE", 0x03f29): (67, "SlicedStringMap"),
+  ("RO_SPACE", 0x03f79): (75, "SlicedOneByteStringMap"),
+  ("RO_SPACE", 0x03fc9): (66, "ExternalStringMap"),
+  ("RO_SPACE", 0x04019): (82, "ExternalStringWithOneByteDataMap"),
+  ("RO_SPACE", 0x04069): (74, "ExternalOneByteStringMap"),
+  ("RO_SPACE", 0x040b9): (98, "ShortExternalStringMap"),
+  ("RO_SPACE", 0x04109): (114, "ShortExternalStringWithOneByteDataMap"),
+  ("RO_SPACE", 0x04159): (0, "InternalizedStringMap"),
+  ("RO_SPACE", 0x041a9): (2, "ExternalInternalizedStringMap"),
+  ("RO_SPACE", 0x041f9): (18, "ExternalInternalizedStringWithOneByteDataMap"),
+  ("RO_SPACE", 0x04249): (10, "ExternalOneByteInternalizedStringMap"),
+  ("RO_SPACE", 0x04299): (34, "ShortExternalInternalizedStringMap"),
+  ("RO_SPACE", 0x042e9): (50, "ShortExternalInternalizedStringWithOneByteDataMap"),
+  ("RO_SPACE", 0x04339): (42, "ShortExternalOneByteInternalizedStringMap"),
+  ("RO_SPACE", 0x04389): (106, "ShortExternalOneByteStringMap"),
+  ("RO_SPACE", 0x043d9): (140, "FixedUint8ArrayMap"),
+  ("RO_SPACE", 0x04429): (139, "FixedInt8ArrayMap"),
+  ("RO_SPACE", 0x04479): (142, "FixedUint16ArrayMap"),
+  ("RO_SPACE", 0x044c9): (141, "FixedInt16ArrayMap"),
+  ("RO_SPACE", 0x04519): (144, "FixedUint32ArrayMap"),
+  ("RO_SPACE", 0x04569): (143, "FixedInt32ArrayMap"),
+  ("RO_SPACE", 0x045b9): (145, "FixedFloat32ArrayMap"),
+  ("RO_SPACE", 0x04609): (146, "FixedFloat64ArrayMap"),
+  ("RO_SPACE", 0x04659): (147, "FixedUint8ClampedArrayMap"),
+  ("RO_SPACE", 0x046a9): (149, "FixedBigUint64ArrayMap"),
+  ("RO_SPACE", 0x046f9): (148, "FixedBigInt64ArrayMap"),
+  ("RO_SPACE", 0x04749): (131, "SelfReferenceMarkerMap"),
+  ("RO_SPACE", 0x047b1): (171, "Tuple2Map"),
+  ("RO_SPACE", 0x04ae9): (161, "InterceptorInfoMap"),
+  ("RO_SPACE", 0x04bf1): (169, "ScriptMap"),
+  ("RO_SPACE", 0x095d1): (154, "AccessorInfoMap"),
+  ("RO_SPACE", 0x09621): (153, "AccessCheckInfoMap"),
+  ("RO_SPACE", 0x09671): (155, "AccessorPairMap"),
+  ("RO_SPACE", 0x096c1): (156, "AliasedArgumentsEntryMap"),
+  ("RO_SPACE", 0x09711): (157, "AllocationMementoMap"),
+  ("RO_SPACE", 0x09761): (158, "AsyncGeneratorRequestMap"),
+  ("RO_SPACE", 0x097b1): (159, "DebugInfoMap"),
+  ("RO_SPACE", 0x09801): (160, "FunctionTemplateInfoMap"),
+  ("RO_SPACE", 0x09851): (162, "InterpreterDataMap"),
+  ("RO_SPACE", 0x098a1): (163, "ModuleInfoEntryMap"),
+  ("RO_SPACE", 0x098f1): (164, "ModuleMap"),
+  ("RO_SPACE", 0x09941): (165, "ObjectTemplateInfoMap"),
+  ("RO_SPACE", 0x09991): (166, "PromiseCapabilityMap"),
+  ("RO_SPACE", 0x099e1): (167, "PromiseReactionMap"),
+  ("RO_SPACE", 0x09a31): (168, "PrototypeInfoMap"),
+  ("RO_SPACE", 0x09a81): (170, "StackFrameInfoMap"),
+  ("RO_SPACE", 0x09ad1): (172, "Tuple3Map"),
+  ("RO_SPACE", 0x09b21): (173, "ArrayBoilerplateDescriptionMap"),
+  ("RO_SPACE", 0x09b71): (174, "WasmDebugInfoMap"),
+  ("RO_SPACE", 0x09bc1): (175, "WasmExportedFunctionDataMap"),
+  ("RO_SPACE", 0x09c11): (176, "CallableTaskMap"),
+  ("RO_SPACE", 0x09c61): (177, "CallbackTaskMap"),
+  ("RO_SPACE", 0x09cb1): (178, "PromiseFulfillReactionJobTaskMap"),
+  ("RO_SPACE", 0x09d01): (179, "PromiseRejectReactionJobTaskMap"),
+  ("RO_SPACE", 0x09d51): (180, "PromiseResolveThenableJobTaskMap"),
+  ("RO_SPACE", 0x09da1): (181, "AllocationSiteMap"),
+  ("RO_SPACE", 0x09df1): (181, "AllocationSiteMap"),
   ("MAP_SPACE", 0x02201): (1057, "ExternalMap"),
-  ("MAP_SPACE", 0x02259): (1072, "JSMessageObjectMap"),
+  ("MAP_SPACE", 0x02251): (1072, "JSMessageObjectMap"),
 }
 
 # List of known V8 objects.
 KNOWN_OBJECTS = {
-  ("RO_SPACE", 0x022b1): "NullValue",
-  ("RO_SPACE", 0x02339): "EmptyDescriptorArray",
-  ("RO_SPACE", 0x023b1): "EmptyFixedArray",
-  ("RO_SPACE", 0x025a1): "UninitializedValue",
-  ("RO_SPACE", 0x026f1): "UndefinedValue",
-  ("RO_SPACE", 0x02789): "NanValue",
-  ("RO_SPACE", 0x02801): "TheHoleValue",
-  ("RO_SPACE", 0x028b9): "HoleNanValue",
-  ("RO_SPACE", 0x028c9): "TrueValue",
-  ("RO_SPACE", 0x029a1): "FalseValue",
-  ("RO_SPACE", 0x029f1): "empty_string",
-  ("RO_SPACE", 0x02fb9): "EmptyScopeInfo",
-  ("RO_SPACE", 0x02fc9): "ArgumentsMarker",
-  ("RO_SPACE", 0x03089): "Exception",
-  ("RO_SPACE", 0x03149): "TerminationException",
-  ("RO_SPACE", 0x03211): "OptimizedOut",
-  ("RO_SPACE", 0x032d1): "StaleRegister",
-  ("RO_SPACE", 0x05231): "EmptyByteArray",
-  ("RO_SPACE", 0x05259): "EmptyFixedUint8Array",
-  ("RO_SPACE", 0x05279): "EmptyFixedInt8Array",
-  ("RO_SPACE", 0x05299): "EmptyFixedUint16Array",
-  ("RO_SPACE", 0x052b9): "EmptyFixedInt16Array",
-  ("RO_SPACE", 0x052d9): "EmptyFixedUint32Array",
-  ("RO_SPACE", 0x052f9): "EmptyFixedInt32Array",
-  ("RO_SPACE", 0x05319): "EmptyFixedFloat32Array",
-  ("RO_SPACE", 0x05339): "EmptyFixedFloat64Array",
-  ("RO_SPACE", 0x05359): "EmptyFixedUint8ClampedArray",
-  ("RO_SPACE", 0x053b9): "EmptySloppyArgumentsElements",
-  ("RO_SPACE", 0x053d9): "EmptySlowElementDictionary",
-  ("RO_SPACE", 0x05421): "EmptyOrderedHashMap",
-  ("RO_SPACE", 0x05449): "EmptyOrderedHashSet",
-  ("RO_SPACE", 0x05481): "EmptyPropertyCell",
-  ("RO_SPACE", 0x054a9): "EmptyWeakCell",
-  ("RO_SPACE", 0x05599): "InfinityValue",
-  ("RO_SPACE", 0x055a9): "MinusZeroValue",
-  ("RO_SPACE", 0x055b9): "MinusInfinityValue",
-  ("RO_SPACE", 0x055c9): "SelfReferenceMarker",
+  ("RO_SPACE", 0x022a1): "NullValue",
+  ("RO_SPACE", 0x02321): "EmptyDescriptorArray",
+  ("RO_SPACE", 0x02391): "EmptyFixedArray",
+  ("RO_SPACE", 0x02491): "UninitializedValue",
+  ("RO_SPACE", 0x025b1): "UndefinedValue",
+  ("RO_SPACE", 0x02631): "NanValue",
+  ("RO_SPACE", 0x02691): "TheHoleValue",
+  ("RO_SPACE", 0x02731): "HoleNanValue",
+  ("RO_SPACE", 0x02741): "TrueValue",
+  ("RO_SPACE", 0x02801): "FalseValue",
+  ("RO_SPACE", 0x02851): "empty_string",
+  ("RO_SPACE", 0x02d19): "EmptyScopeInfo",
+  ("RO_SPACE", 0x02d29): "ArgumentsMarker",
+  ("RO_SPACE", 0x02dd1): "Exception",
+  ("RO_SPACE", 0x02e79): "TerminationException",
+  ("RO_SPACE", 0x02f29): "OptimizedOut",
+  ("RO_SPACE", 0x02fd1): "StaleRegister",
+  ("RO_SPACE", 0x04811): "EmptyByteArray",
+  ("RO_SPACE", 0x04839): "EmptyFixedUint8Array",
+  ("RO_SPACE", 0x04859): "EmptyFixedInt8Array",
+  ("RO_SPACE", 0x04879): "EmptyFixedUint16Array",
+  ("RO_SPACE", 0x04899): "EmptyFixedInt16Array",
+  ("RO_SPACE", 0x048b9): "EmptyFixedUint32Array",
+  ("RO_SPACE", 0x048d9): "EmptyFixedInt32Array",
+  ("RO_SPACE", 0x048f9): "EmptyFixedFloat32Array",
+  ("RO_SPACE", 0x04919): "EmptyFixedFloat64Array",
+  ("RO_SPACE", 0x04939): "EmptyFixedUint8ClampedArray",
+  ("RO_SPACE", 0x04999): "EmptySloppyArgumentsElements",
+  ("RO_SPACE", 0x049b9): "EmptySlowElementDictionary",
+  ("RO_SPACE", 0x04a01): "EmptyOrderedHashMap",
+  ("RO_SPACE", 0x04a29): "EmptyOrderedHashSet",
+  ("RO_SPACE", 0x04a61): "EmptyPropertyCell",
+  ("RO_SPACE", 0x04a89): "EmptyWeakCell",
+  ("RO_SPACE", 0x04b61): "InfinityValue",
+  ("RO_SPACE", 0x04b71): "MinusZeroValue",
+  ("RO_SPACE", 0x04b81): "MinusInfinityValue",
+  ("RO_SPACE", 0x04b91): "SelfReferenceMarker",
   ("OLD_SPACE", 0x02211): "EmptyScript",
   ("OLD_SPACE", 0x02291): "ManyClosuresCell",
   ("OLD_SPACE", 0x022b1): "NoElementsProtector",

From b4507961dc0439e782d607b95a2d0c0a7ab644af Mon Sep 17 00:00:00 2001
From: Yang Guo <yangguo@chromium.org>
Date: Wed, 18 Jul 2018 15:47:27 +0200
Subject: [PATCH 27/28] Update to renamed inspector scripts

---
 node.gyp | 11 +++++------
 1 file changed, 5 insertions(+), 6 deletions(-)

diff --git a/node.gyp b/node.gyp
index 566b2a226325ca..f49fe66ae375d0 100644
--- a/node.gyp
+++ b/node.gyp
@@ -1055,7 +1055,6 @@
         'node_protocol_files': [
           '<(protocol_path)/lib/Allocator_h.template',
           '<(protocol_path)/lib/Array_h.template',
-          '<(protocol_path)/lib/Collections_h.template',
           '<(protocol_path)/lib/DispatcherBase_cpp.template',
           '<(protocol_path)/lib/DispatcherBase_h.template',
           '<(protocol_path)/lib/ErrorSupport_cpp.template',
@@ -1075,7 +1074,7 @@
           '<(protocol_path)/templates/Imported_h.template',
           '<(protocol_path)/templates/TypeBuilder_cpp.template',
           '<(protocol_path)/templates/TypeBuilder_h.template',
-          '<(protocol_path)/CodeGenerator.py',
+          '<(protocol_path)/code_generator.py',
         ]
       },
       'targets': [
@@ -1103,7 +1102,7 @@
               ],
               'action': [
                 'python',
-                'deps/v8/third_party/inspector_protocol/ConvertProtocolToJSON.py',
+                'deps/v8/third_party/inspector_protocol/convert_protocol_to_json.py',
                 '<@(_inputs)',
                 '<@(_outputs)',
               ],
@@ -1128,7 +1127,7 @@
               ],
               'action': [
                 'python',
-                '<(protocol_path)/CodeGenerator.py',
+                '<(protocol_path)/code_generator.py',
                 '--jinja_dir', '<@(protocol_path)/..',
                 '--output_base', '<(SHARED_INTERMEDIATE_DIR)/src/',
                 '--config', '<(SHARED_INTERMEDIATE_DIR)/node_protocol_config.json',
@@ -1158,7 +1157,7 @@
               ],
               'action': [
                 'python',
-                'deps/v8/third_party/inspector_protocol/ConvertProtocolToJSON.py',
+                'deps/v8/third_party/inspector_protocol/convert_protocol_to_json.py',
                 '<@(_inputs)',
                 '<@(_outputs)',
               ],
@@ -1174,7 +1173,7 @@
               ],
               'action': [
                 'python',
-                'deps/v8/third_party/inspector_protocol/ConcatenateProtocols.py',
+                'deps/v8/third_party/inspector_protocol/concatenate_protocols.py',
                 '<@(_inputs)',
                 '<@(_outputs)',
               ],

From c9b5b9e411867d31d772e1038665b1d3b7813611 Mon Sep 17 00:00:00 2001
From: Andrey Lushnikov <lushnikov@chromium.org>
Date: Tue, 24 Jul 2018 17:48:11 -0700
Subject: [PATCH 28/28] Bring in inspector_protocol as a direct dependency

This patch adds
[inspector_protocol](https://www.google.com/url?q=https://chromium.googlesource.com/deps/inspector_protocol/)
as a direct dependency to node.js. Inspector Protocol is used in node.js
tracing, and this is required to be able to roll protocol independently
from v8.

inspector_protocol dependency comes with two more libs:
- jinja2
- markupsafe
---
 .../CheckProtocolCompatibility.py             |   11 +
 deps/inspector_protocol/CodeGenerator.py      |    6 +
 .../ConvertProtocolToJSON.py                  |   10 +
 deps/inspector_protocol/LICENSE               |   27 +
 deps/inspector_protocol/OWNERS                |    8 +
 deps/inspector_protocol/README.md             |   10 +
 deps/inspector_protocol/README.v8             |   16 +
 .../check_protocol_compatibility.py           |  482 +++++
 deps/inspector_protocol/code_generator.py     |  661 +++++++
 deps/inspector_protocol/codereview.settings   |    6 +
 .../concatenate_protocols.py                  |   39 +
 .../convert_protocol_to_json.py               |   33 +
 .../inspector_protocol/inspector_protocol.gni |   88 +
 .../inspector_protocol.gypi                   |   32 +
 .../lib/Allocator_h.template                  |   30 +
 deps/inspector_protocol/lib/Array_h.template  |  136 ++
 .../lib/Collections_h.template                |    0
 .../lib/DispatcherBase_cpp.template           |  354 ++++
 .../lib/DispatcherBase_h.template             |  172 ++
 .../lib/ErrorSupport_cpp.template             |   71 +
 .../lib/ErrorSupport_h.template               |   37 +
 .../inspector_protocol/lib/Forward_h.template |   40 +
 .../lib/FrontendChannel_h.template            |   30 +
 deps/inspector_protocol/lib/Maybe_h.template  |   86 +
 .../lib/Object_cpp.template                   |   38 +
 deps/inspector_protocol/lib/Object_h.template |   32 +
 .../lib/Parser_cpp.template                   |  546 ++++++
 deps/inspector_protocol/lib/Parser_h.template |   22 +
 .../lib/Protocol_cpp.template                 |   12 +
 .../lib/ValueConversions_h.template           |  171 ++
 .../lib/Values_cpp.template                   |  409 ++++
 deps/inspector_protocol/lib/Values_h.template |  248 +++
 deps/inspector_protocol/pdl.py                |  167 ++
 .../templates/Exported_h.template             |   65 +
 .../templates/Imported_h.template             |   55 +
 .../templates/TypeBuilder_cpp.template        |  397 ++++
 .../templates/TypeBuilder_h.template          |  301 +++
 deps/jinja2/AUTHORS                           |   34 +
 deps/jinja2/Jinja2-2.10.tar.gz.md5            |    1 +
 deps/jinja2/Jinja2-2.10.tar.gz.sha512         |    1 +
 deps/jinja2/LICENSE                           |   31 +
 deps/jinja2/OWNERS                            |    6 +
 deps/jinja2/README.chromium                   |   26 +
 deps/jinja2/__init__.py                       |   83 +
 deps/jinja2/_compat.py                        |   99 +
 deps/jinja2/_identifier.py                    |    2 +
 deps/jinja2/asyncfilters.py                   |  146 ++
 deps/jinja2/asyncsupport.py                   |  256 +++
 deps/jinja2/bccache.py                        |  362 ++++
 deps/jinja2/compiler.py                       | 1721 +++++++++++++++++
 deps/jinja2/constants.py                      |   32 +
 deps/jinja2/debug.py                          |  372 ++++
 deps/jinja2/defaults.py                       |   56 +
 deps/jinja2/environment.py                    | 1276 ++++++++++++
 deps/jinja2/exceptions.py                     |  146 ++
 deps/jinja2/ext.py                            |  627 ++++++
 deps/jinja2/filters.py                        | 1190 ++++++++++++
 deps/jinja2/get_jinja2.sh                     |  136 ++
 deps/jinja2/idtracking.py                     |  286 +++
 deps/jinja2/jinja2.gni                        |   31 +
 deps/jinja2/lexer.py                          |  739 +++++++
 deps/jinja2/loaders.py                        |  481 +++++
 deps/jinja2/meta.py                           |  106 +
 deps/jinja2/nativetypes.py                    |  220 +++
 deps/jinja2/nodes.py                          |  999 ++++++++++
 deps/jinja2/optimizer.py                      |   49 +
 deps/jinja2/parser.py                         |  903 +++++++++
 deps/jinja2/runtime.py                        |  813 ++++++++
 deps/jinja2/sandbox.py                        |  475 +++++
 deps/jinja2/tests.py                          |  175 ++
 deps/jinja2/utils.py                          |  647 +++++++
 deps/jinja2/visitor.py                        |   87 +
 deps/markupsafe/AUTHORS                       |   13 +
 deps/markupsafe/LICENSE                       |   33 +
 deps/markupsafe/MarkupSafe-0.18.tar.gz.md5    |    1 +
 deps/markupsafe/MarkupSafe-0.18.tar.gz.sha512 |    1 +
 deps/markupsafe/OWNERS                        |    5 +
 deps/markupsafe/README.chromium               |   24 +
 deps/markupsafe/__init__.py                   |  234 +++
 deps/markupsafe/_compat.py                    |   24 +
 deps/markupsafe/_constants.py                 |  267 +++
 deps/markupsafe/_native.py                    |   46 +
 deps/markupsafe/_speedups.c                   |  239 +++
 deps/markupsafe/get_markupsafe.sh             |  121 ++
 node.gyp                                      |    2 +-
 85 files changed, 18471 insertions(+), 1 deletion(-)
 create mode 100755 deps/inspector_protocol/CheckProtocolCompatibility.py
 create mode 100755 deps/inspector_protocol/CodeGenerator.py
 create mode 100755 deps/inspector_protocol/ConvertProtocolToJSON.py
 create mode 100644 deps/inspector_protocol/LICENSE
 create mode 100644 deps/inspector_protocol/OWNERS
 create mode 100644 deps/inspector_protocol/README.md
 create mode 100644 deps/inspector_protocol/README.v8
 create mode 100755 deps/inspector_protocol/check_protocol_compatibility.py
 create mode 100755 deps/inspector_protocol/code_generator.py
 create mode 100644 deps/inspector_protocol/codereview.settings
 create mode 100755 deps/inspector_protocol/concatenate_protocols.py
 create mode 100755 deps/inspector_protocol/convert_protocol_to_json.py
 create mode 100644 deps/inspector_protocol/inspector_protocol.gni
 create mode 100644 deps/inspector_protocol/inspector_protocol.gypi
 create mode 100644 deps/inspector_protocol/lib/Allocator_h.template
 create mode 100644 deps/inspector_protocol/lib/Array_h.template
 create mode 100644 deps/inspector_protocol/lib/Collections_h.template
 create mode 100644 deps/inspector_protocol/lib/DispatcherBase_cpp.template
 create mode 100644 deps/inspector_protocol/lib/DispatcherBase_h.template
 create mode 100644 deps/inspector_protocol/lib/ErrorSupport_cpp.template
 create mode 100644 deps/inspector_protocol/lib/ErrorSupport_h.template
 create mode 100644 deps/inspector_protocol/lib/Forward_h.template
 create mode 100644 deps/inspector_protocol/lib/FrontendChannel_h.template
 create mode 100644 deps/inspector_protocol/lib/Maybe_h.template
 create mode 100644 deps/inspector_protocol/lib/Object_cpp.template
 create mode 100644 deps/inspector_protocol/lib/Object_h.template
 create mode 100644 deps/inspector_protocol/lib/Parser_cpp.template
 create mode 100644 deps/inspector_protocol/lib/Parser_h.template
 create mode 100644 deps/inspector_protocol/lib/Protocol_cpp.template
 create mode 100644 deps/inspector_protocol/lib/ValueConversions_h.template
 create mode 100644 deps/inspector_protocol/lib/Values_cpp.template
 create mode 100644 deps/inspector_protocol/lib/Values_h.template
 create mode 100644 deps/inspector_protocol/pdl.py
 create mode 100644 deps/inspector_protocol/templates/Exported_h.template
 create mode 100644 deps/inspector_protocol/templates/Imported_h.template
 create mode 100644 deps/inspector_protocol/templates/TypeBuilder_cpp.template
 create mode 100644 deps/inspector_protocol/templates/TypeBuilder_h.template
 create mode 100644 deps/jinja2/AUTHORS
 create mode 100644 deps/jinja2/Jinja2-2.10.tar.gz.md5
 create mode 100644 deps/jinja2/Jinja2-2.10.tar.gz.sha512
 create mode 100644 deps/jinja2/LICENSE
 create mode 100644 deps/jinja2/OWNERS
 create mode 100644 deps/jinja2/README.chromium
 create mode 100644 deps/jinja2/__init__.py
 create mode 100644 deps/jinja2/_compat.py
 create mode 100644 deps/jinja2/_identifier.py
 create mode 100644 deps/jinja2/asyncfilters.py
 create mode 100644 deps/jinja2/asyncsupport.py
 create mode 100644 deps/jinja2/bccache.py
 create mode 100644 deps/jinja2/compiler.py
 create mode 100644 deps/jinja2/constants.py
 create mode 100644 deps/jinja2/debug.py
 create mode 100644 deps/jinja2/defaults.py
 create mode 100644 deps/jinja2/environment.py
 create mode 100644 deps/jinja2/exceptions.py
 create mode 100644 deps/jinja2/ext.py
 create mode 100644 deps/jinja2/filters.py
 create mode 100755 deps/jinja2/get_jinja2.sh
 create mode 100644 deps/jinja2/idtracking.py
 create mode 100644 deps/jinja2/jinja2.gni
 create mode 100644 deps/jinja2/lexer.py
 create mode 100644 deps/jinja2/loaders.py
 create mode 100644 deps/jinja2/meta.py
 create mode 100644 deps/jinja2/nativetypes.py
 create mode 100644 deps/jinja2/nodes.py
 create mode 100644 deps/jinja2/optimizer.py
 create mode 100644 deps/jinja2/parser.py
 create mode 100644 deps/jinja2/runtime.py
 create mode 100644 deps/jinja2/sandbox.py
 create mode 100644 deps/jinja2/tests.py
 create mode 100644 deps/jinja2/utils.py
 create mode 100644 deps/jinja2/visitor.py
 create mode 100644 deps/markupsafe/AUTHORS
 create mode 100644 deps/markupsafe/LICENSE
 create mode 100644 deps/markupsafe/MarkupSafe-0.18.tar.gz.md5
 create mode 100644 deps/markupsafe/MarkupSafe-0.18.tar.gz.sha512
 create mode 100644 deps/markupsafe/OWNERS
 create mode 100644 deps/markupsafe/README.chromium
 create mode 100644 deps/markupsafe/__init__.py
 create mode 100644 deps/markupsafe/_compat.py
 create mode 100644 deps/markupsafe/_constants.py
 create mode 100644 deps/markupsafe/_native.py
 create mode 100644 deps/markupsafe/_speedups.c
 create mode 100755 deps/markupsafe/get_markupsafe.sh

diff --git a/deps/inspector_protocol/CheckProtocolCompatibility.py b/deps/inspector_protocol/CheckProtocolCompatibility.py
new file mode 100755
index 00000000000000..adbc74addb551d
--- /dev/null
+++ b/deps/inspector_protocol/CheckProtocolCompatibility.py
@@ -0,0 +1,11 @@
+#!/usr/bin/env python
+# Copyright 2018 The Chromium Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+import sys
+
+import check_protocol_compatibility
+
+
+sys.exit(check_protocol_compatibility.main())
diff --git a/deps/inspector_protocol/CodeGenerator.py b/deps/inspector_protocol/CodeGenerator.py
new file mode 100755
index 00000000000000..4882ed9da5820e
--- /dev/null
+++ b/deps/inspector_protocol/CodeGenerator.py
@@ -0,0 +1,6 @@
+#!/usr/bin/env python
+# Copyright 2016 The Chromium Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+import code_generator
diff --git a/deps/inspector_protocol/ConvertProtocolToJSON.py b/deps/inspector_protocol/ConvertProtocolToJSON.py
new file mode 100755
index 00000000000000..6cfdc7fa07f058
--- /dev/null
+++ b/deps/inspector_protocol/ConvertProtocolToJSON.py
@@ -0,0 +1,10 @@
+#!/usr/bin/env python
+# Copyright 2018 The Chromium Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+import convert_protocol_to_json
+
+
+def main():
+  convert_protocol_to_json.main()
diff --git a/deps/inspector_protocol/LICENSE b/deps/inspector_protocol/LICENSE
new file mode 100644
index 00000000000000..800468e5763479
--- /dev/null
+++ b/deps/inspector_protocol/LICENSE
@@ -0,0 +1,27 @@
+// Copyright 2016 The Chromium Authors. All rights reserved.
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//    * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+//    * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following disclaimer
+// in the documentation and/or other materials provided with the
+// distribution.
+//    * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived from
+// this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
diff --git a/deps/inspector_protocol/OWNERS b/deps/inspector_protocol/OWNERS
new file mode 100644
index 00000000000000..8d0b6d90cb233b
--- /dev/null
+++ b/deps/inspector_protocol/OWNERS
@@ -0,0 +1,8 @@
+set noparent
+
+alph@chromium.org
+caseq@chromium.org
+dgozman@chromium.org
+kozyatinskiy@chromium.org
+pfeldman@chromium.org
+yangguo@chromium.org
diff --git a/deps/inspector_protocol/README.md b/deps/inspector_protocol/README.md
new file mode 100644
index 00000000000000..54b7c129292ecf
--- /dev/null
+++ b/deps/inspector_protocol/README.md
@@ -0,0 +1,10 @@
+# Chromium inspector (devtools) protocol
+
+This package contains code generators and templates for the Chromium
+inspector protocol.
+
+In the Chromium tree, it's rolled into
+https://cs.chromium.org/chromium/src/third_party/inspector_protocol/
+
+In the V8 tree, it's rolled into
+https://cs.chromium.org/chromium/src/v8/third_party/inspector_protocol/
diff --git a/deps/inspector_protocol/README.v8 b/deps/inspector_protocol/README.v8
new file mode 100644
index 00000000000000..1ae51d18a27640
--- /dev/null
+++ b/deps/inspector_protocol/README.v8
@@ -0,0 +1,16 @@
+Name: inspector protocol
+Short Name: inspector_protocol
+URL: https://chromium.googlesource.com/deps/inspector_protocol/
+Version: 0
+Revision: 0d4255502019144a5dec5669d7992165ae8924e7
+License: BSD
+License File: LICENSE
+Security Critical: no
+
+Description:
+src/inspector uses these scripts to generate handlers from protocol
+description.
+
+Local modifications:
+- This only includes the lib/ and templates/ directories, scripts, build
+  and the LICENSE files.
diff --git a/deps/inspector_protocol/check_protocol_compatibility.py b/deps/inspector_protocol/check_protocol_compatibility.py
new file mode 100755
index 00000000000000..7e7d9af3d63c1d
--- /dev/null
+++ b/deps/inspector_protocol/check_protocol_compatibility.py
@@ -0,0 +1,482 @@
+#!/usr/bin/env python
+# Copyright (c) 2011 Google Inc. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions are
+# met:
+#
+#     * Redistributions of source code must retain the above copyright
+# notice, this list of conditions and the following disclaimer.
+#     * Redistributions in binary form must reproduce the above
+# copyright notice, this list of conditions and the following disclaimer
+# in the documentation and/or other materials provided with the
+# distribution.
+#     * Neither the name of Google Inc. nor the names of its
+# contributors may be used to endorse or promote products derived from
+# this software without specific prior written permission.
+#
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+#
+# Inspector protocol validator.
+#
+# Tests that subsequent protocol changes are not breaking backwards compatibility.
+# Following violations are reported:
+#
+#   - Domain has been removed
+#   - Command has been removed
+#   - Required command parameter was added or changed from optional
+#   - Required response parameter was removed or changed to optional
+#   - Event has been removed
+#   - Required event parameter was removed or changed to optional
+#   - Parameter type has changed.
+#
+# For the parameters with composite types the above checks are also applied
+# recursively to every property of the type.
+#
+# Adding --show_changes to the command line prints out a list of valid public API changes.
+
+import copy
+import os.path
+import optparse
+import sys
+
+import pdl
+
+try:
+    import json
+except ImportError:
+    import simplejson as json
+
+
+def list_to_map(items, key):
+    result = {}
+    for item in items:
+        if "experimental" not in item and "hidden" not in item:
+            result[item[key]] = item
+    return result
+
+
+def named_list_to_map(container, name, key):
+    if name in container:
+        return list_to_map(container[name], key)
+    return {}
+
+
+def removed(reverse):
+    if reverse:
+        return "added"
+    return "removed"
+
+
+def required(reverse):
+    if reverse:
+        return "optional"
+    return "required"
+
+
+def compare_schemas(d_1, d_2, reverse):
+    errors = []
+    domains_1 = copy.deepcopy(d_1)
+    domains_2 = copy.deepcopy(d_2)
+    types_1 = normalize_types_in_schema(domains_1)
+    types_2 = normalize_types_in_schema(domains_2)
+
+    domains_by_name_1 = list_to_map(domains_1, "domain")
+    domains_by_name_2 = list_to_map(domains_2, "domain")
+
+    for name in domains_by_name_1:
+        domain_1 = domains_by_name_1[name]
+        if name not in domains_by_name_2:
+            errors.append("%s: domain has been %s" % (name, removed(reverse)))
+            continue
+        compare_domains(domain_1, domains_by_name_2[name], types_1, types_2, errors, reverse)
+    return errors
+
+
+def compare_domains(domain_1, domain_2, types_map_1, types_map_2, errors, reverse):
+    domain_name = domain_1["domain"]
+    commands_1 = named_list_to_map(domain_1, "commands", "name")
+    commands_2 = named_list_to_map(domain_2, "commands", "name")
+    for name in commands_1:
+        command_1 = commands_1[name]
+        if name not in commands_2:
+            errors.append("%s.%s: command has been %s" % (domain_1["domain"], name, removed(reverse)))
+            continue
+        compare_commands(domain_name, command_1, commands_2[name], types_map_1, types_map_2, errors, reverse)
+
+    events_1 = named_list_to_map(domain_1, "events", "name")
+    events_2 = named_list_to_map(domain_2, "events", "name")
+    for name in events_1:
+        event_1 = events_1[name]
+        if name not in events_2:
+            errors.append("%s.%s: event has been %s" % (domain_1["domain"], name, removed(reverse)))
+            continue
+        compare_events(domain_name, event_1, events_2[name], types_map_1, types_map_2, errors, reverse)
+
+
+def compare_commands(domain_name, command_1, command_2, types_map_1, types_map_2, errors, reverse):
+    context = domain_name + "." + command_1["name"]
+
+    params_1 = named_list_to_map(command_1, "parameters", "name")
+    params_2 = named_list_to_map(command_2, "parameters", "name")
+    # Note the reversed order: we allow removing but forbid adding parameters.
+    compare_params_list(context, "parameter", params_2, params_1, types_map_2, types_map_1, 0, errors, not reverse)
+
+    returns_1 = named_list_to_map(command_1, "returns", "name")
+    returns_2 = named_list_to_map(command_2, "returns", "name")
+    compare_params_list(context, "response parameter", returns_1, returns_2, types_map_1, types_map_2, 0, errors, reverse)
+
+
+def compare_events(domain_name, event_1, event_2, types_map_1, types_map_2, errors, reverse):
+    context = domain_name + "." + event_1["name"]
+    params_1 = named_list_to_map(event_1, "parameters", "name")
+    params_2 = named_list_to_map(event_2, "parameters", "name")
+    compare_params_list(context, "parameter", params_1, params_2, types_map_1, types_map_2, 0, errors, reverse)
+
+
+def compare_params_list(context, kind, params_1, params_2, types_map_1, types_map_2, depth, errors, reverse):
+    for name in params_1:
+        param_1 = params_1[name]
+        if name not in params_2:
+            if "optional" not in param_1:
+                errors.append("%s.%s: required %s has been %s" % (context, name, kind, removed(reverse)))
+            continue
+
+        param_2 = params_2[name]
+        if param_2 and "optional" in param_2 and "optional" not in param_1:
+            errors.append("%s.%s: %s %s is now %s" % (context, name, required(reverse), kind, required(not reverse)))
+            continue
+        type_1 = extract_type(param_1, types_map_1, errors)
+        type_2 = extract_type(param_2, types_map_2, errors)
+        compare_types(context + "." + name, kind, type_1, type_2, types_map_1, types_map_2, depth, errors, reverse)
+
+
+def compare_types(context, kind, type_1, type_2, types_map_1, types_map_2, depth, errors, reverse):
+    if depth > 5:
+        return
+
+    base_type_1 = type_1["type"]
+    base_type_2 = type_2["type"]
+
+    if base_type_1 != base_type_2:
+        errors.append("%s: %s base type mismatch, '%s' vs '%s'" % (context, kind, base_type_1, base_type_2))
+    elif base_type_1 == "object":
+        params_1 = named_list_to_map(type_1, "properties", "name")
+        params_2 = named_list_to_map(type_2, "properties", "name")
+        # If both parameters have the same named type use it in the context.
+        if "id" in type_1 and "id" in type_2 and type_1["id"] == type_2["id"]:
+            type_name = type_1["id"]
+        else:
+            type_name = "<object>"
+        context += " %s->%s" % (kind, type_name)
+        compare_params_list(context, "property", params_1, params_2, types_map_1, types_map_2, depth + 1, errors, reverse)
+    elif base_type_1 == "array":
+        item_type_1 = extract_type(type_1["items"], types_map_1, errors)
+        item_type_2 = extract_type(type_2["items"], types_map_2, errors)
+        compare_types(context, kind, item_type_1, item_type_2, types_map_1, types_map_2, depth + 1, errors, reverse)
+
+
+def extract_type(typed_object, types_map, errors):
+    if "type" in typed_object:
+        result = {"id": "<transient>", "type": typed_object["type"]}
+        if typed_object["type"] == "object":
+            result["properties"] = []
+        elif typed_object["type"] == "array":
+            result["items"] = typed_object["items"]
+        return result
+    elif "$ref" in typed_object:
+        ref = typed_object["$ref"]
+        if ref not in types_map:
+            errors.append("Can not resolve type: %s" % ref)
+            types_map[ref] = {"id": "<transient>", "type": "object"}
+        return types_map[ref]
+
+
+def normalize_types_in_schema(domains):
+    types = {}
+    for domain in domains:
+        domain_name = domain["domain"]
+        normalize_types(domain, domain_name, types)
+    return types
+
+
+def normalize_types(obj, domain_name, types):
+    if isinstance(obj, list):
+        for item in obj:
+            normalize_types(item, domain_name, types)
+    elif isinstance(obj, dict):
+        for key, value in obj.items():
+            if key == "$ref" and value.find(".") == -1:
+                obj[key] = "%s.%s" % (domain_name, value)
+            elif key == "id":
+                obj[key] = "%s.%s" % (domain_name, value)
+                types[obj[key]] = obj
+            else:
+                normalize_types(value, domain_name, types)
+
+
+def load_schema(file_name, domains):
+    # pylint: disable=W0613
+    if not os.path.isfile(file_name):
+        return
+    input_file = open(file_name, "r")
+    parsed_json = pdl.loads(input_file.read(), file_name)
+    input_file.close()
+    domains += parsed_json["domains"]
+    return parsed_json["version"]
+
+
+def self_test():
+    def create_test_schema_1():
+        return [
+            {
+                "domain": "Network",
+                "types": [
+                    {
+                        "id": "LoaderId",
+                        "type": "string"
+                    },
+                    {
+                        "id": "Headers",
+                        "type": "object"
+                    },
+                    {
+                        "id": "Request",
+                        "type": "object",
+                        "properties": [
+                            {"name": "url", "type": "string"},
+                            {"name": "method", "type": "string"},
+                            {"name": "headers", "$ref": "Headers"},
+                            {"name": "becameOptionalField", "type": "string"},
+                            {"name": "removedField", "type": "string"},
+                        ]
+                    }
+                ],
+                "commands": [
+                    {
+                        "name": "removedCommand",
+                    },
+                    {
+                        "name": "setExtraHTTPHeaders",
+                        "parameters": [
+                            {"name": "headers", "$ref": "Headers"},
+                            {"name": "mismatched", "type": "string"},
+                            {"name": "becameOptional", "$ref": "Headers"},
+                            {"name": "removedRequired", "$ref": "Headers"},
+                            {"name": "becameRequired", "$ref": "Headers", "optional": True},
+                            {"name": "removedOptional", "$ref": "Headers", "optional": True},
+                        ],
+                        "returns": [
+                            {"name": "mimeType", "type": "string"},
+                            {"name": "becameOptional", "type": "string"},
+                            {"name": "removedRequired", "type": "string"},
+                            {"name": "becameRequired", "type": "string", "optional": True},
+                            {"name": "removedOptional", "type": "string", "optional": True},
+                        ]
+                    }
+                ],
+                "events": [
+                    {
+                        "name": "requestWillBeSent",
+                        "parameters": [
+                            {"name": "frameId", "type": "string", "experimental": True},
+                            {"name": "request", "$ref": "Request"},
+                            {"name": "becameOptional", "type": "string"},
+                            {"name": "removedRequired", "type": "string"},
+                            {"name": "becameRequired", "type": "string", "optional": True},
+                            {"name": "removedOptional", "type": "string", "optional": True},
+                        ]
+                    },
+                    {
+                        "name": "removedEvent",
+                        "parameters": [
+                            {"name": "errorText", "type": "string"},
+                            {"name": "canceled", "type": "boolean", "optional": True}
+                        ]
+                    }
+                ]
+            },
+            {
+                "domain":  "removedDomain"
+            }
+        ]
+
+    def create_test_schema_2():
+        return [
+            {
+                "domain": "Network",
+                "types": [
+                    {
+                        "id": "LoaderId",
+                        "type": "string"
+                    },
+                    {
+                        "id": "Request",
+                        "type": "object",
+                        "properties": [
+                            {"name": "url", "type": "string"},
+                            {"name": "method", "type": "string"},
+                            {"name": "headers", "type": "object"},
+                            {"name": "becameOptionalField", "type": "string", "optional": True},
+                        ]
+                    }
+                ],
+                "commands": [
+                    {
+                        "name": "addedCommand",
+                    },
+                    {
+                        "name": "setExtraHTTPHeaders",
+                        "parameters": [
+                            {"name": "headers", "type": "object"},
+                            {"name": "mismatched", "type": "object"},
+                            {"name": "becameOptional", "type": "object", "optional": True},
+                            {"name": "addedRequired", "type": "object"},
+                            {"name": "becameRequired", "type": "object"},
+                            {"name": "addedOptional", "type": "object", "optional": True},
+                        ],
+                        "returns": [
+                            {"name": "mimeType", "type": "string"},
+                            {"name": "becameOptional", "type": "string", "optional": True},
+                            {"name": "addedRequired", "type": "string"},
+                            {"name": "becameRequired", "type": "string"},
+                            {"name": "addedOptional", "type": "string", "optional": True},
+                        ]
+                    }
+                ],
+                "events": [
+                    {
+                        "name": "requestWillBeSent",
+                        "parameters": [
+                            {"name": "request", "$ref": "Request"},
+                            {"name": "becameOptional", "type": "string", "optional": True},
+                            {"name": "addedRequired", "type": "string"},
+                            {"name": "becameRequired", "type": "string"},
+                            {"name": "addedOptional", "type": "string", "optional": True},
+                        ]
+                    },
+                    {
+                        "name": "addedEvent"
+                    }
+                ]
+            },
+            {
+                "domain": "addedDomain"
+            }
+        ]
+
+    expected_errors = [
+        "removedDomain: domain has been removed",
+        "Network.removedCommand: command has been removed",
+        "Network.removedEvent: event has been removed",
+        "Network.setExtraHTTPHeaders.mismatched: parameter base type mismatch, 'object' vs 'string'",
+        "Network.setExtraHTTPHeaders.addedRequired: required parameter has been added",
+        "Network.setExtraHTTPHeaders.becameRequired: optional parameter is now required",
+        "Network.setExtraHTTPHeaders.removedRequired: required response parameter has been removed",
+        "Network.setExtraHTTPHeaders.becameOptional: required response parameter is now optional",
+        "Network.requestWillBeSent.removedRequired: required parameter has been removed",
+        "Network.requestWillBeSent.becameOptional: required parameter is now optional",
+        "Network.requestWillBeSent.request parameter->Network.Request.removedField: required property has been removed",
+        "Network.requestWillBeSent.request parameter->Network.Request.becameOptionalField: required property is now optional",
+    ]
+
+    expected_errors_reverse = [
+        "addedDomain: domain has been added",
+        "Network.addedEvent: event has been added",
+        "Network.addedCommand: command has been added",
+        "Network.setExtraHTTPHeaders.mismatched: parameter base type mismatch, 'string' vs 'object'",
+        "Network.setExtraHTTPHeaders.removedRequired: required parameter has been removed",
+        "Network.setExtraHTTPHeaders.becameOptional: required parameter is now optional",
+        "Network.setExtraHTTPHeaders.addedRequired: required response parameter has been added",
+        "Network.setExtraHTTPHeaders.becameRequired: optional response parameter is now required",
+        "Network.requestWillBeSent.becameRequired: optional parameter is now required",
+        "Network.requestWillBeSent.addedRequired: required parameter has been added",
+    ]
+
+    def is_subset(subset, superset, message):
+        for i in range(len(subset)):
+            if subset[i] not in superset:
+                sys.stderr.write("%s error: %s\n" % (message, subset[i]))
+                return False
+        return True
+
+    def errors_match(expected, actual):
+        return (is_subset(actual, expected, "Unexpected") and
+                is_subset(expected, actual, "Missing"))
+
+    return (errors_match(expected_errors,
+                         compare_schemas(create_test_schema_1(), create_test_schema_2(), False)) and
+            errors_match(expected_errors_reverse,
+                         compare_schemas(create_test_schema_2(), create_test_schema_1(), True)))
+
+
+def load_domains_and_baselines(file_name, domains, baseline_domains):
+    version = load_schema(os.path.normpath(file_name), domains)
+    suffix = "-%s.%s.json" % (version["major"], version["minor"])
+    baseline_file = file_name.replace(".json", suffix)
+    baseline_file = file_name.replace(".pdl", suffix)
+    load_schema(os.path.normpath(baseline_file), baseline_domains)
+    return version
+
+
+def main():
+    if not self_test():
+        sys.stderr.write("Self-test failed")
+        return 1
+
+    cmdline_parser = optparse.OptionParser()
+    cmdline_parser.add_option("--show_changes")
+    cmdline_parser.add_option("--expected_errors")
+    cmdline_parser.add_option("--stamp")
+    arg_options, arg_values = cmdline_parser.parse_args()
+
+    if len(arg_values) < 1:
+        sys.stderr.write("Usage: %s [--show_changes] <protocol-1> [, <protocol-2>...]\n" % sys.argv[0])
+        return 1
+
+    domains = []
+    baseline_domains = []
+    version = load_domains_and_baselines(arg_values[0], domains, baseline_domains)
+    for dependency in arg_values[1:]:
+        load_domains_and_baselines(dependency, domains, baseline_domains)
+
+    expected_errors = []
+    if arg_options.expected_errors:
+        expected_errors_file = open(arg_options.expected_errors, "r")
+        expected_errors = json.loads(expected_errors_file.read())["errors"]
+        expected_errors_file.close()
+
+    errors = compare_schemas(baseline_domains, domains, False)
+    unexpected_errors = []
+    for i in range(len(errors)):
+        if errors[i] not in expected_errors:
+            unexpected_errors.append(errors[i])
+    if len(unexpected_errors) > 0:
+        sys.stderr.write("  Compatibility checks FAILED\n")
+        for error in unexpected_errors:
+            sys.stderr.write("    %s\n" % error)
+        return 1
+
+    if arg_options.show_changes:
+        changes = compare_schemas(domains, baseline_domains, True)
+        if len(changes) > 0:
+            print "  Public changes since %s:" % version
+            for change in changes:
+                print "    %s" % change
+
+    if arg_options.stamp:
+        with open(arg_options.stamp, 'a') as _:
+            pass
+
+if __name__ == '__main__':
+    sys.exit(main())
diff --git a/deps/inspector_protocol/code_generator.py b/deps/inspector_protocol/code_generator.py
new file mode 100755
index 00000000000000..da220fdbea3b10
--- /dev/null
+++ b/deps/inspector_protocol/code_generator.py
@@ -0,0 +1,661 @@
+#!/usr/bin/env python
+# Copyright 2016 The Chromium Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+import os.path
+import sys
+import optparse
+import collections
+import functools
+import re
+import copy
+try:
+    import json
+except ImportError:
+    import simplejson as json
+
+import pdl
+
+# Path handling for libraries and templates
+# Paths have to be normalized because Jinja uses the exact template path to
+# determine the hash used in the cache filename, and we need a pre-caching step
+# to be concurrency-safe. Use absolute path because __file__ is absolute if
+# module is imported, and relative if executed directly.
+# If paths differ between pre-caching and individual file compilation, the cache
+# is regenerated, which causes a race condition and breaks concurrent build,
+# since some compile processes will try to read the partially written cache.
+module_path, module_filename = os.path.split(os.path.realpath(__file__))
+
+def read_config():
+    # pylint: disable=W0703
+    def json_to_object(data, output_base, config_base):
+        def json_object_hook(object_dict):
+            items = [(k, os.path.join(config_base, v) if k == "path" else v) for (k, v) in object_dict.items()]
+            items = [(k, os.path.join(output_base, v) if k == "output" else v) for (k, v) in items]
+            keys, values = zip(*items)
+            return collections.namedtuple('X', keys)(*values)
+        return json.loads(data, object_hook=json_object_hook)
+
+    def init_defaults(config_tuple, path, defaults):
+        keys = list(config_tuple._fields)  # pylint: disable=E1101
+        values = [getattr(config_tuple, k) for k in keys]
+        for i in xrange(len(keys)):
+            if hasattr(values[i], "_fields"):
+                values[i] = init_defaults(values[i], path + "." + keys[i], defaults)
+        for optional in defaults:
+            if optional.find(path + ".") != 0:
+                continue
+            optional_key = optional[len(path) + 1:]
+            if optional_key.find(".") == -1 and optional_key not in keys:
+                keys.append(optional_key)
+                values.append(defaults[optional])
+        return collections.namedtuple('X', keys)(*values)
+
+    try:
+        cmdline_parser = optparse.OptionParser()
+        cmdline_parser.add_option("--output_base")
+        cmdline_parser.add_option("--jinja_dir")
+        cmdline_parser.add_option("--config")
+        cmdline_parser.add_option("--config_value", action="append", type="string")
+        arg_options, _ = cmdline_parser.parse_args()
+        jinja_dir = arg_options.jinja_dir
+        if not jinja_dir:
+            raise Exception("jinja directory must be specified")
+        jinja_dir = jinja_dir.decode('utf8')
+        output_base = arg_options.output_base
+        if not output_base:
+            raise Exception("Base output directory must be specified")
+        output_base = output_base.decode('utf8')
+        config_file = arg_options.config
+        if not config_file:
+            raise Exception("Config file name must be specified")
+        config_file = config_file.decode('utf8')
+        config_base = os.path.dirname(config_file)
+        config_values = arg_options.config_value
+        if not config_values:
+            config_values = []
+    except Exception:
+        # Work with python 2 and 3 http://docs.python.org/py3k/howto/pyporting.html
+        exc = sys.exc_info()[1]
+        sys.stderr.write("Failed to parse command-line arguments: %s\n\n" % exc)
+        exit(1)
+
+    try:
+        config_json_file = open(config_file, "r")
+        config_json_string = config_json_file.read()
+        config_partial = json_to_object(config_json_string, output_base, config_base)
+        config_json_file.close()
+        defaults = {
+            ".use_snake_file_names": False,
+            ".use_title_case_methods": False,
+            ".imported": False,
+            ".imported.export_macro": "",
+            ".imported.export_header": False,
+            ".imported.header": False,
+            ".imported.package": False,
+            ".imported.options": False,
+            ".protocol.export_macro": "",
+            ".protocol.export_header": False,
+            ".protocol.options": False,
+            ".protocol.file_name_prefix": "",
+            ".exported": False,
+            ".exported.export_macro": "",
+            ".exported.export_header": False,
+            ".lib": False,
+            ".lib.export_macro": "",
+            ".lib.export_header": False,
+        }
+        for key_value in config_values:
+            parts = key_value.split("=")
+            if len(parts) == 2:
+                defaults["." + parts[0]] = parts[1]
+        return (jinja_dir, config_file, init_defaults(config_partial, "", defaults))
+    except Exception:
+        # Work with python 2 and 3 http://docs.python.org/py3k/howto/pyporting.html
+        exc = sys.exc_info()[1]
+        sys.stderr.write("Failed to parse config file: %s\n\n" % exc)
+        exit(1)
+
+
+# ---- Begin of utilities exposed to generator ----
+
+
+def to_title_case(name):
+    return name[:1].upper() + name[1:]
+
+
+def dash_to_camelcase(word):
+    prefix = ""
+    if word[0] == "-":
+        prefix = "Negative"
+        word = word[1:]
+    return prefix + "".join(to_title_case(x) or "-" for x in word.split("-"))
+
+
+def to_snake_case(name):
+    return re.sub(r"([a-z0-9])([A-Z])", r"\1_\2", name, sys.maxint).lower()
+
+
+def to_method_case(config, name):
+    if config.use_title_case_methods:
+        return to_title_case(name)
+    return name
+
+
+def join_arrays(dict, keys):
+    result = []
+    for key in keys:
+        if key in dict:
+            result += dict[key]
+    return result
+
+
+def format_include(config, header, file_name=None):
+    if file_name is not None:
+        header = header + "/" + file_name + ".h"
+    header = "\"" + header + "\"" if header[0] not in "<\"" else header
+    if config.use_snake_file_names:
+        header = to_snake_case(header)
+    return header
+
+
+def format_domain_include(config, header, file_name):
+    return format_include(config, header, config.protocol.file_name_prefix + file_name)
+
+
+def to_file_name(config, file_name):
+    if config.use_snake_file_names:
+        return to_snake_case(file_name).replace(".cpp", ".cc")
+    return file_name
+
+
+# ---- End of utilities exposed to generator ----
+
+
+def initialize_jinja_env(jinja_dir, cache_dir, config):
+    # pylint: disable=F0401
+    sys.path.insert(1, os.path.abspath(jinja_dir))
+    import jinja2
+
+    jinja_env = jinja2.Environment(
+        loader=jinja2.FileSystemLoader(module_path),
+        # Bytecode cache is not concurrency-safe unless pre-cached:
+        # if pre-cached this is read-only, but writing creates a race condition.
+        bytecode_cache=jinja2.FileSystemBytecodeCache(cache_dir),
+        keep_trailing_newline=True,  # newline-terminate generated files
+        lstrip_blocks=True,  # so can indent control flow tags
+        trim_blocks=True)
+    jinja_env.filters.update({"to_title_case": to_title_case, "dash_to_camelcase": dash_to_camelcase, "to_method_case": functools.partial(to_method_case, config)})
+    jinja_env.add_extension("jinja2.ext.loopcontrols")
+    return jinja_env
+
+
+def create_imported_type_definition(domain_name, type, imported_namespace):
+    # pylint: disable=W0622
+    return {
+        "return_type": "std::unique_ptr<%s::%s::API::%s>" % (imported_namespace, domain_name, type["id"]),
+        "pass_type": "std::unique_ptr<%s::%s::API::%s>" % (imported_namespace, domain_name, type["id"]),
+        "to_raw_type": "%s.get()",
+        "to_pass_type": "std::move(%s)",
+        "to_rvalue": "std::move(%s)",
+        "type": "std::unique_ptr<%s::%s::API::%s>" % (imported_namespace, domain_name, type["id"]),
+        "raw_type": "%s::%s::API::%s" % (imported_namespace, domain_name, type["id"]),
+        "raw_pass_type": "%s::%s::API::%s*" % (imported_namespace, domain_name, type["id"]),
+        "raw_return_type": "%s::%s::API::%s*" % (imported_namespace, domain_name, type["id"]),
+    }
+
+
+def create_user_type_definition(domain_name, type):
+    # pylint: disable=W0622
+    return {
+        "return_type": "std::unique_ptr<protocol::%s::%s>" % (domain_name, type["id"]),
+        "pass_type": "std::unique_ptr<protocol::%s::%s>" % (domain_name, type["id"]),
+        "to_raw_type": "%s.get()",
+        "to_pass_type": "std::move(%s)",
+        "to_rvalue": "std::move(%s)",
+        "type": "std::unique_ptr<protocol::%s::%s>" % (domain_name, type["id"]),
+        "raw_type": "protocol::%s::%s" % (domain_name, type["id"]),
+        "raw_pass_type": "protocol::%s::%s*" % (domain_name, type["id"]),
+        "raw_return_type": "protocol::%s::%s*" % (domain_name, type["id"]),
+    }
+
+
+def create_object_type_definition():
+    # pylint: disable=W0622
+    return {
+        "return_type": "std::unique_ptr<protocol::DictionaryValue>",
+        "pass_type": "std::unique_ptr<protocol::DictionaryValue>",
+        "to_raw_type": "%s.get()",
+        "to_pass_type": "std::move(%s)",
+        "to_rvalue": "std::move(%s)",
+        "type": "std::unique_ptr<protocol::DictionaryValue>",
+        "raw_type": "protocol::DictionaryValue",
+        "raw_pass_type": "protocol::DictionaryValue*",
+        "raw_return_type": "protocol::DictionaryValue*",
+    }
+
+
+def create_any_type_definition():
+    # pylint: disable=W0622
+    return {
+        "return_type": "std::unique_ptr<protocol::Value>",
+        "pass_type": "std::unique_ptr<protocol::Value>",
+        "to_raw_type": "%s.get()",
+        "to_pass_type": "std::move(%s)",
+        "to_rvalue": "std::move(%s)",
+        "type": "std::unique_ptr<protocol::Value>",
+        "raw_type": "protocol::Value",
+        "raw_pass_type": "protocol::Value*",
+        "raw_return_type": "protocol::Value*",
+    }
+
+
+def create_string_type_definition():
+    # pylint: disable=W0622
+    return {
+        "return_type": "String",
+        "pass_type": "const String&",
+        "to_pass_type": "%s",
+        "to_raw_type": "%s",
+        "to_rvalue": "%s",
+        "type": "String",
+        "raw_type": "String",
+        "raw_pass_type": "const String&",
+        "raw_return_type": "String",
+    }
+
+
+def create_primitive_type_definition(type):
+    # pylint: disable=W0622
+    typedefs = {
+        "number": "double",
+        "integer": "int",
+        "boolean": "bool"
+    }
+    defaults = {
+        "number": "0",
+        "integer": "0",
+        "boolean": "false"
+    }
+    jsontypes = {
+        "number": "TypeDouble",
+        "integer": "TypeInteger",
+        "boolean": "TypeBoolean",
+    }
+    return {
+        "return_type": typedefs[type],
+        "pass_type": typedefs[type],
+        "to_pass_type": "%s",
+        "to_raw_type": "%s",
+        "to_rvalue": "%s",
+        "type": typedefs[type],
+        "raw_type": typedefs[type],
+        "raw_pass_type": typedefs[type],
+        "raw_return_type": typedefs[type],
+        "default_value": defaults[type]
+    }
+
+
+def wrap_array_definition(type):
+    # pylint: disable=W0622
+    return {
+        "return_type": "std::unique_ptr<protocol::Array<%s>>" % type["raw_type"],
+        "pass_type": "std::unique_ptr<protocol::Array<%s>>" % type["raw_type"],
+        "to_raw_type": "%s.get()",
+        "to_pass_type": "std::move(%s)",
+        "to_rvalue": "std::move(%s)",
+        "type": "std::unique_ptr<protocol::Array<%s>>" % type["raw_type"],
+        "raw_type": "protocol::Array<%s>" % type["raw_type"],
+        "raw_pass_type": "protocol::Array<%s>*" % type["raw_type"],
+        "raw_return_type": "protocol::Array<%s>*" % type["raw_type"],
+        "out_type": "protocol::Array<%s>&" % type["raw_type"],
+    }
+
+
+class Protocol(object):
+    def __init__(self, config):
+        self.config = config
+        self.json_api = {"domains": []}
+        self.imported_domains = []
+        self.exported_domains = []
+        self.generate_domains = self.read_protocol_file(config.protocol.path)
+
+        if config.protocol.options:
+            self.generate_domains = [rule.domain for rule in config.protocol.options]
+            self.exported_domains = [rule.domain for rule in config.protocol.options if hasattr(rule, "exported")]
+
+        if config.imported:
+            self.imported_domains = self.read_protocol_file(config.imported.path)
+            if config.imported.options:
+                self.imported_domains = [rule.domain for rule in config.imported.options]
+
+        self.patch_full_qualified_refs()
+        self.create_notification_types()
+        self.create_type_definitions()
+        self.generate_used_types()
+
+
+    def read_protocol_file(self, file_name):
+        input_file = open(file_name, "r")
+        parsed_json = pdl.loads(input_file.read(), file_name)
+        input_file.close()
+        version = parsed_json["version"]["major"] + "." + parsed_json["version"]["minor"]
+        domains = []
+        for domain in parsed_json["domains"]:
+            domains.append(domain["domain"])
+            domain["version"] = version
+        self.json_api["domains"] += parsed_json["domains"]
+        return domains
+
+
+    def patch_full_qualified_refs(self):
+        def patch_full_qualified_refs_in_domain(json, domain_name):
+            if isinstance(json, list):
+                for item in json:
+                    patch_full_qualified_refs_in_domain(item, domain_name)
+            if not isinstance(json, dict):
+                return
+            for key in json:
+                if key == "type" and json[key] == "string":
+                    json[key] = domain_name + ".string"
+                if key != "$ref":
+                    patch_full_qualified_refs_in_domain(json[key], domain_name)
+                    continue
+                if json["$ref"].find(".") == -1:
+                    json["$ref"] = domain_name + "." + json["$ref"]
+            return
+
+        for domain in self.json_api["domains"]:
+            patch_full_qualified_refs_in_domain(domain, domain["domain"])
+
+
+    def all_references(self, json):
+        refs = set()
+        if isinstance(json, list):
+            for item in json:
+                refs |= self.all_references(item)
+        if not isinstance(json, dict):
+            return refs
+        for key in json:
+            if key != "$ref":
+                refs |= self.all_references(json[key])
+            else:
+                refs.add(json["$ref"])
+        return refs
+
+    def generate_used_types(self):
+        all_refs = set()
+        for domain in self.json_api["domains"]:
+            domain_name = domain["domain"]
+            if "commands" in domain:
+                for command in domain["commands"]:
+                    if self.generate_command(domain_name, command["name"]):
+                        all_refs |= self.all_references(command)
+            if "events" in domain:
+                for event in domain["events"]:
+                    if self.generate_event(domain_name, event["name"]):
+                        all_refs |= self.all_references(event)
+                        all_refs.add(domain_name + "." + to_title_case(event["name"]) + "Notification")
+
+        dependencies = self.generate_type_dependencies()
+        queue = set(all_refs)
+        while len(queue):
+            ref = queue.pop()
+            if ref in dependencies:
+                queue |= dependencies[ref] - all_refs
+                all_refs |= dependencies[ref]
+        self.used_types = all_refs
+
+
+    def generate_type_dependencies(self):
+        dependencies = dict()
+        domains_with_types = (x for x in self.json_api["domains"] if "types" in x)
+        for domain in domains_with_types:
+            domain_name = domain["domain"]
+            for type in domain["types"]:
+                related_types = self.all_references(type)
+                if len(related_types):
+                    dependencies[domain_name + "." + type["id"]] = related_types
+        return dependencies
+
+
+    def create_notification_types(self):
+        for domain in self.json_api["domains"]:
+            if "events" in domain:
+                for event in domain["events"]:
+                    event_type = dict()
+                    event_type["description"] = "Wrapper for notification params"
+                    event_type["type"] = "object"
+                    event_type["id"] = to_title_case(event["name"]) + "Notification"
+                    if "parameters" in event:
+                        event_type["properties"] = copy.deepcopy(event["parameters"])
+                    if "types" not in domain:
+                        domain["types"] = list()
+                    domain["types"].append(event_type)
+
+
+    def create_type_definitions(self):
+        imported_namespace = "::".join(self.config.imported.namespace) if self.config.imported else ""
+        self.type_definitions = {}
+        self.type_definitions["number"] = create_primitive_type_definition("number")
+        self.type_definitions["integer"] = create_primitive_type_definition("integer")
+        self.type_definitions["boolean"] = create_primitive_type_definition("boolean")
+        self.type_definitions["object"] = create_object_type_definition()
+        self.type_definitions["any"] = create_any_type_definition()
+        for domain in self.json_api["domains"]:
+            self.type_definitions[domain["domain"] + ".string"] = create_string_type_definition()
+            if not ("types" in domain):
+                continue
+            for type in domain["types"]:
+                type_name = domain["domain"] + "." + type["id"]
+                if type["type"] == "object" and domain["domain"] in self.imported_domains:
+                    self.type_definitions[type_name] = create_imported_type_definition(domain["domain"], type, imported_namespace)
+                elif type["type"] == "object":
+                    self.type_definitions[type_name] = create_user_type_definition(domain["domain"], type)
+                elif type["type"] == "array":
+                    self.type_definitions[type_name] = self.resolve_type(type)
+                elif type["type"] == domain["domain"] + ".string":
+                    self.type_definitions[type_name] = create_string_type_definition()
+                else:
+                    self.type_definitions[type_name] = create_primitive_type_definition(type["type"])
+
+
+    def check_options(self, options, domain, name, include_attr, exclude_attr, default):
+        for rule in options:
+            if rule.domain != domain:
+                continue
+            if include_attr and hasattr(rule, include_attr):
+                return name in getattr(rule, include_attr)
+            if exclude_attr and hasattr(rule, exclude_attr):
+                return name not in getattr(rule, exclude_attr)
+            return default
+        return False
+
+
+    # ---- Begin of methods exposed to generator
+
+
+    def type_definition(self, name):
+        return self.type_definitions[name]
+
+
+    def resolve_type(self, prop):
+        if "$ref" in prop:
+            return self.type_definitions[prop["$ref"]]
+        if prop["type"] == "array":
+            return wrap_array_definition(self.resolve_type(prop["items"]))
+        return self.type_definitions[prop["type"]]
+
+
+    def generate_command(self, domain, command):
+        if not self.config.protocol.options:
+            return domain in self.generate_domains
+        return self.check_options(self.config.protocol.options, domain, command, "include", "exclude", True)
+
+
+    def generate_event(self, domain, event):
+        if not self.config.protocol.options:
+            return domain in self.generate_domains
+        return self.check_options(self.config.protocol.options, domain, event, "include_events", "exclude_events", True)
+
+
+    def generate_type(self, domain, typename):
+        return domain + "." + typename in self.used_types
+
+
+    def is_async_command(self, domain, command):
+        if not self.config.protocol.options:
+            return False
+        return self.check_options(self.config.protocol.options, domain, command, "async", None, False)
+
+
+    def is_exported(self, domain, name):
+        if not self.config.protocol.options:
+            return False
+        return self.check_options(self.config.protocol.options, domain, name, "exported", None, False)
+
+
+    def is_imported(self, domain, name):
+        if not self.config.imported:
+            return False
+        if not self.config.imported.options:
+            return domain in self.imported_domains
+        return self.check_options(self.config.imported.options, domain, name, "imported", None, False)
+
+
+    def is_exported_domain(self, domain):
+        return domain in self.exported_domains
+
+
+    def generate_disable(self, domain):
+        if "commands" not in domain:
+            return True
+        for command in domain["commands"]:
+            if command["name"] == "disable" and self.generate_command(domain["domain"], "disable"):
+                return False
+        return True
+
+
+    def is_imported_dependency(self, domain):
+        return domain in self.generate_domains or domain in self.imported_domains
+
+
+def main():
+    jinja_dir, config_file, config = read_config()
+
+    protocol = Protocol(config)
+
+    if not config.exported and len(protocol.exported_domains):
+        sys.stderr.write("Domains [%s] are exported, but config is missing export entry\n\n" % ", ".join(protocol.exported_domains))
+        exit(1)
+
+    if not os.path.exists(config.protocol.output):
+        os.mkdir(config.protocol.output)
+    if len(protocol.exported_domains) and not os.path.exists(config.exported.output):
+        os.mkdir(config.exported.output)
+    jinja_env = initialize_jinja_env(jinja_dir, config.protocol.output, config)
+
+    inputs = []
+    inputs.append(__file__)
+    inputs.append(config_file)
+    inputs.append(config.protocol.path)
+    if config.imported:
+        inputs.append(config.imported.path)
+    templates_dir = os.path.join(module_path, "templates")
+    inputs.append(os.path.join(templates_dir, "TypeBuilder_h.template"))
+    inputs.append(os.path.join(templates_dir, "TypeBuilder_cpp.template"))
+    inputs.append(os.path.join(templates_dir, "Exported_h.template"))
+    inputs.append(os.path.join(templates_dir, "Imported_h.template"))
+
+    h_template = jinja_env.get_template("templates/TypeBuilder_h.template")
+    cpp_template = jinja_env.get_template("templates/TypeBuilder_cpp.template")
+    exported_template = jinja_env.get_template("templates/Exported_h.template")
+    imported_template = jinja_env.get_template("templates/Imported_h.template")
+
+    outputs = dict()
+
+    for domain in protocol.json_api["domains"]:
+        class_name = domain["domain"]
+        file_name = config.protocol.file_name_prefix + class_name
+        template_context = {
+            "protocol": protocol,
+            "config": config,
+            "domain": domain,
+            "join_arrays": join_arrays,
+            "format_include": functools.partial(format_include, config),
+            "format_domain_include": functools.partial(format_domain_include, config),
+        }
+
+        if domain["domain"] in protocol.generate_domains:
+            outputs[os.path.join(config.protocol.output, to_file_name(config, file_name + ".h"))] = h_template.render(template_context)
+            outputs[os.path.join(config.protocol.output, to_file_name(config, file_name + ".cpp"))] = cpp_template.render(template_context)
+            if domain["domain"] in protocol.exported_domains:
+                outputs[os.path.join(config.exported.output, to_file_name(config, file_name + ".h"))] = exported_template.render(template_context)
+        if domain["domain"] in protocol.imported_domains:
+            outputs[os.path.join(config.protocol.output, to_file_name(config, file_name + ".h"))] = imported_template.render(template_context)
+
+    if config.lib:
+        template_context = {
+            "config": config,
+            "format_include": functools.partial(format_include, config),
+        }
+
+        lib_templates_dir = os.path.join(module_path, "lib")
+        # Note these should be sorted in the right order.
+        # TODO(dgozman): sort them programmatically based on commented includes.
+        lib_h_templates = [
+            "ErrorSupport_h.template",
+            "Values_h.template",
+            "Object_h.template",
+            "ValueConversions_h.template",
+            "Maybe_h.template",
+            "Array_h.template",
+            "DispatcherBase_h.template",
+            "Parser_h.template",
+        ]
+
+        lib_cpp_templates = [
+            "Protocol_cpp.template",
+            "ErrorSupport_cpp.template",
+            "Values_cpp.template",
+            "Object_cpp.template",
+            "DispatcherBase_cpp.template",
+            "Parser_cpp.template",
+        ]
+
+        forward_h_templates = [
+            "Forward_h.template",
+            "Allocator_h.template",
+            "FrontendChannel_h.template",
+        ]
+
+        def generate_lib_file(file_name, template_files):
+            parts = []
+            for template_file in template_files:
+                inputs.append(os.path.join(lib_templates_dir, template_file))
+                template = jinja_env.get_template("lib/" + template_file)
+                parts.append(template.render(template_context))
+            outputs[file_name] = "\n\n".join(parts)
+
+        generate_lib_file(os.path.join(config.lib.output, to_file_name(config, "Forward.h")), forward_h_templates)
+        generate_lib_file(os.path.join(config.lib.output, to_file_name(config, "Protocol.h")), lib_h_templates)
+        generate_lib_file(os.path.join(config.lib.output, to_file_name(config, "Protocol.cpp")), lib_cpp_templates)
+
+    # Make gyp / make generatos happy, otherwise make rebuilds world.
+    inputs_ts = max(map(os.path.getmtime, inputs))
+    up_to_date = True
+    for output_file in outputs.iterkeys():
+        if not os.path.exists(output_file) or os.path.getmtime(output_file) < inputs_ts:
+            up_to_date = False
+            break
+    if up_to_date:
+        sys.exit()
+
+    for file_name, content in outputs.iteritems():
+        out_file = open(file_name, "w")
+        out_file.write(content)
+        out_file.close()
+
+
+main()
diff --git a/deps/inspector_protocol/codereview.settings b/deps/inspector_protocol/codereview.settings
new file mode 100644
index 00000000000000..6ac8580b4ccd9f
--- /dev/null
+++ b/deps/inspector_protocol/codereview.settings
@@ -0,0 +1,6 @@
+# This file is used by git-cl to get repository specific information.
+CC_LIST: chromium-reviews@chromium.org
+CODE_REVIEW_SERVER: codereview.chromium.org
+GERRIT_HOST: True
+PROJECT: inspector_protocol
+VIEW_VC: https://chromium.googlesource.com/deps/inspector_protocol/+/
diff --git a/deps/inspector_protocol/concatenate_protocols.py b/deps/inspector_protocol/concatenate_protocols.py
new file mode 100755
index 00000000000000..e9f448efe72702
--- /dev/null
+++ b/deps/inspector_protocol/concatenate_protocols.py
@@ -0,0 +1,39 @@
+#!/usr/bin/env python
+# Copyright 2016 The Chromium Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+import os.path
+import sys
+
+try:
+    import json
+except ImportError:
+    import simplejson as json
+
+import pdl
+
+def main(argv):
+    if len(argv) < 1:
+        sys.stderr.write("Usage: %s <protocol-1> [<protocol-2> [, <protocol-3>...]] <output-file>\n" % sys.argv[0])
+        return 1
+
+    domains = []
+    version = None
+    for protocol in argv[:-1]:
+        file_name = os.path.normpath(protocol)
+        if not os.path.isfile(file_name):
+            sys.stderr.write("Cannot find %s\n" % file_name)
+            return 1
+        input_file = open(file_name, "r")
+        parsed_json = pdl.loads(input_file.read(), file_name)
+        domains += parsed_json["domains"]
+        version = parsed_json["version"]
+
+    output_file = open(argv[-1], "w")
+    json.dump({"version": version, "domains": domains}, output_file, indent=4, sort_keys=False, separators=(',', ': '))
+    output_file.close()
+
+
+if __name__ == '__main__':
+    sys.exit(main(sys.argv[1:]))
diff --git a/deps/inspector_protocol/convert_protocol_to_json.py b/deps/inspector_protocol/convert_protocol_to_json.py
new file mode 100755
index 00000000000000..2dd6f501a61b8e
--- /dev/null
+++ b/deps/inspector_protocol/convert_protocol_to_json.py
@@ -0,0 +1,33 @@
+#!/usr/bin/env python
+# Copyright 2017 The Chromium Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+import collections
+import json
+import os.path
+import re
+import sys
+
+import pdl
+
+def main(argv):
+    if len(argv) < 2:
+        sys.stderr.write("Usage: %s <protocol.pdl> <protocol.json>\n" % sys.argv[0])
+        return 1
+    file_name = os.path.normpath(argv[0])
+    input_file = open(file_name, "r")
+    pdl_string = input_file.read()
+    protocol = pdl.loads(pdl_string, file_name)
+    input_file.close()
+    output_file = open(argv[0].replace('.pdl', '.json'), 'wb')
+    json.dump(protocol, output_file, indent=4, separators=(',', ': '))
+    output_file.close()
+
+    output_file = open(os.path.normpath(argv[1]), 'wb')
+    json.dump(protocol, output_file, indent=4, separators=(',', ': '))
+    output_file.close()
+
+
+if __name__ == '__main__':
+    sys.exit(main(sys.argv[1:]))
diff --git a/deps/inspector_protocol/inspector_protocol.gni b/deps/inspector_protocol/inspector_protocol.gni
new file mode 100644
index 00000000000000..af2f21691cd750
--- /dev/null
+++ b/deps/inspector_protocol/inspector_protocol.gni
@@ -0,0 +1,88 @@
+# Copyright 2016 The Chromium Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+# This template will generate inspector protocol source code. The code will
+# not be compiled, use get_target_outputs(<name>) to compile them.
+#
+# Inputs
+#
+#   config_file  (required)
+#       Path to json file specifying inspector protocol configuration.
+#
+#   out_dir  (required)
+#       Path to put the generated files in. It must be inside output or
+#       generated file directory.
+#
+#   outputs (required)
+#       Files generated. Relative to out_dir.
+#
+#   inputs  (optional)
+#       Extra inputs specified by the config file.
+template("inspector_protocol_generate") {
+  assert(defined(invoker.config_file))
+  assert(defined(invoker.out_dir))
+  assert(defined(invoker.outputs))
+  assert(defined(invoker.inspector_protocol_dir))
+  inspector_protocol_dir = invoker.inspector_protocol_dir
+
+  action(target_name) {
+    script = "$inspector_protocol_dir/code_generator.py"
+
+    inputs = [
+      invoker.config_file,
+      "$inspector_protocol_dir/lib/Allocator_h.template",
+      "$inspector_protocol_dir/lib/Array_h.template",
+      "$inspector_protocol_dir/lib/DispatcherBase_cpp.template",
+      "$inspector_protocol_dir/lib/DispatcherBase_h.template",
+      "$inspector_protocol_dir/lib/ErrorSupport_cpp.template",
+      "$inspector_protocol_dir/lib/ErrorSupport_h.template",
+      "$inspector_protocol_dir/lib/Forward_h.template",
+      "$inspector_protocol_dir/lib/FrontendChannel_h.template",
+      "$inspector_protocol_dir/lib/Maybe_h.template",
+      "$inspector_protocol_dir/lib/Object_cpp.template",
+      "$inspector_protocol_dir/lib/Object_h.template",
+      "$inspector_protocol_dir/lib/Parser_cpp.template",
+      "$inspector_protocol_dir/lib/Parser_h.template",
+      "$inspector_protocol_dir/lib/Protocol_cpp.template",
+      "$inspector_protocol_dir/lib/ValueConversions_h.template",
+      "$inspector_protocol_dir/lib/Values_cpp.template",
+      "$inspector_protocol_dir/lib/Values_h.template",
+      "$inspector_protocol_dir/templates/Exported_h.template",
+      "$inspector_protocol_dir/templates/Imported_h.template",
+      "$inspector_protocol_dir/templates/TypeBuilder_cpp.template",
+      "$inspector_protocol_dir/templates/TypeBuilder_h.template",
+    ]
+    if (defined(invoker.inputs)) {
+      inputs += invoker.inputs
+    }
+
+    args = [
+      "--jinja_dir",
+      rebase_path("//third_party/", root_build_dir),  # jinja is in chromium's third_party
+      "--output_base",
+      rebase_path(invoker.out_dir, root_build_dir),
+      "--config",
+      rebase_path(invoker.config_file, root_build_dir),
+    ]
+
+    if (defined(invoker.config_values)) {
+      foreach(value, invoker.config_values) {
+        args += [
+          "--config_value",
+          value,
+        ]
+      }
+    }
+
+    outputs = get_path_info(rebase_path(invoker.outputs, ".", invoker.out_dir),
+                            "abspath")
+
+    forward_variables_from(invoker,
+                           [
+                             "visibility",
+                             "deps",
+                             "public_deps",
+                           ])
+  }
+}
diff --git a/deps/inspector_protocol/inspector_protocol.gypi b/deps/inspector_protocol/inspector_protocol.gypi
new file mode 100644
index 00000000000000..1359e167519083
--- /dev/null
+++ b/deps/inspector_protocol/inspector_protocol.gypi
@@ -0,0 +1,32 @@
+# Copyright 2016 The Chromium Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+{
+  'variables': {
+    'inspector_protocol_files': [
+      'lib/Allocator_h.template',
+      'lib/Array_h.template',
+      'lib/DispatcherBase_cpp.template',
+      'lib/DispatcherBase_h.template',
+      'lib/ErrorSupport_cpp.template',
+      'lib/ErrorSupport_h.template',
+      'lib/Forward_h.template',
+      'lib/FrontendChannel_h.template',
+      'lib/Maybe_h.template',
+      'lib/Object_cpp.template',
+      'lib/Object_h.template',
+      'lib/Parser_cpp.template',
+      'lib/Parser_h.template',
+      'lib/Protocol_cpp.template',
+      'lib/ValueConversions_h.template',
+      'lib/Values_cpp.template',
+      'lib/Values_h.template',
+      'templates/Exported_h.template',
+      'templates/Imported_h.template',
+      'templates/TypeBuilder_cpp.template',
+      'templates/TypeBuilder_h.template',
+      'code_generator.py',
+    ]
+  }
+}
diff --git a/deps/inspector_protocol/lib/Allocator_h.template b/deps/inspector_protocol/lib/Allocator_h.template
new file mode 100644
index 00000000000000..8f8109d695c597
--- /dev/null
+++ b/deps/inspector_protocol/lib/Allocator_h.template
@@ -0,0 +1,30 @@
+// Copyright 2016 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef {{"_".join(config.protocol.namespace)}}_Allocator_h
+#define {{"_".join(config.protocol.namespace)}}_Allocator_h
+
+{% for namespace in config.protocol.namespace %}
+namespace {{namespace}} {
+{% endfor %}
+
+enum NotNullTagEnum { NotNullLiteral };
+
+#define PROTOCOL_DISALLOW_NEW()                                 \
+    private:                                                    \
+        void* operator new(size_t) = delete;                    \
+        void* operator new(size_t, NotNullTagEnum, void*) = delete; \
+        void* operator new(size_t, void*) = delete;             \
+    public:
+
+#define PROTOCOL_DISALLOW_COPY(ClassName) \
+    private: \
+        ClassName(const ClassName&) = delete; \
+        ClassName& operator=(const ClassName&) = delete
+
+{% for namespace in config.protocol.namespace %}
+} // namespace {{namespace}}
+{% endfor %}
+
+#endif // !defined({{"_".join(config.protocol.namespace)}}_Allocator_h)
diff --git a/deps/inspector_protocol/lib/Array_h.template b/deps/inspector_protocol/lib/Array_h.template
new file mode 100644
index 00000000000000..3854f6e5cd102e
--- /dev/null
+++ b/deps/inspector_protocol/lib/Array_h.template
@@ -0,0 +1,136 @@
+// Copyright 2016 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef {{"_".join(config.protocol.namespace)}}_Array_h
+#define {{"_".join(config.protocol.namespace)}}_Array_h
+
+//#include "ErrorSupport.h"
+//#include "Forward.h"
+//#include "ValueConversions.h"
+//#include "Values.h"
+
+{% for namespace in config.protocol.namespace %}
+namespace {{namespace}} {
+{% endfor %}
+
+template<typename T>
+class Array {
+public:
+    static std::unique_ptr<Array<T>> create()
+    {
+        return std::unique_ptr<Array<T>>(new Array<T>());
+    }
+
+    static std::unique_ptr<Array<T>> fromValue(protocol::Value* value, ErrorSupport* errors)
+    {
+        protocol::ListValue* array = ListValue::cast(value);
+        if (!array) {
+            errors->addError("array expected");
+            return nullptr;
+        }
+        std::unique_ptr<Array<T>> result(new Array<T>());
+        errors->push();
+        for (size_t i = 0; i < array->size(); ++i) {
+            errors->setName(StringUtil::fromInteger(i));
+            std::unique_ptr<T> item = ValueConversions<T>::fromValue(array->at(i), errors);
+            result->m_vector.push_back(std::move(item));
+        }
+        errors->pop();
+        if (errors->hasErrors())
+            return nullptr;
+        return result;
+    }
+
+    void addItem(std::unique_ptr<T> value)
+    {
+        m_vector.push_back(std::move(value));
+    }
+
+    size_t length()
+    {
+        return m_vector.size();
+    }
+
+    T* get(size_t index)
+    {
+        return m_vector[index].get();
+    }
+
+    std::unique_ptr<protocol::ListValue> toValue()
+    {
+        std::unique_ptr<protocol::ListValue> result = ListValue::create();
+        for (auto& item : m_vector)
+            result->pushValue(ValueConversions<T>::toValue(item));
+        return result;
+    }
+
+private:
+    std::vector<std::unique_ptr<T>> m_vector;
+};
+
+template<typename T>
+class ArrayBase {
+public:
+    static std::unique_ptr<Array<T>> create()
+    {
+        return std::unique_ptr<Array<T>>(new Array<T>());
+    }
+
+    static std::unique_ptr<Array<T>> fromValue(protocol::Value* value, ErrorSupport* errors)
+    {
+        protocol::ListValue* array = ListValue::cast(value);
+        if (!array) {
+            errors->addError("array expected");
+            return nullptr;
+        }
+        errors->push();
+        std::unique_ptr<Array<T>> result(new Array<T>());
+        for (size_t i = 0; i < array->size(); ++i) {
+            errors->setName(StringUtil::fromInteger(i));
+            T item = ValueConversions<T>::fromValue(array->at(i), errors);
+            result->m_vector.push_back(item);
+        }
+        errors->pop();
+        if (errors->hasErrors())
+            return nullptr;
+        return result;
+    }
+
+    void addItem(const T& value)
+    {
+        m_vector.push_back(value);
+    }
+
+    size_t length()
+    {
+        return m_vector.size();
+    }
+
+    T get(size_t index)
+    {
+        return m_vector[index];
+    }
+
+    std::unique_ptr<protocol::ListValue> toValue()
+    {
+        std::unique_ptr<protocol::ListValue> result = ListValue::create();
+        for (auto& item : m_vector)
+            result->pushValue(ValueConversions<T>::toValue(item));
+        return result;
+    }
+
+private:
+    std::vector<T> m_vector;
+};
+
+template<> class Array<String> : public ArrayBase<String> {};
+template<> class Array<int> : public ArrayBase<int> {};
+template<> class Array<double> : public ArrayBase<double> {};
+template<> class Array<bool> : public ArrayBase<bool> {};
+
+{% for namespace in config.protocol.namespace %}
+} // namespace {{namespace}}
+{% endfor %}
+
+#endif // !defined({{"_".join(config.protocol.namespace)}}_Array_h)
diff --git a/deps/inspector_protocol/lib/Collections_h.template b/deps/inspector_protocol/lib/Collections_h.template
new file mode 100644
index 00000000000000..e69de29bb2d1d6
diff --git a/deps/inspector_protocol/lib/DispatcherBase_cpp.template b/deps/inspector_protocol/lib/DispatcherBase_cpp.template
new file mode 100644
index 00000000000000..5403035cc45842
--- /dev/null
+++ b/deps/inspector_protocol/lib/DispatcherBase_cpp.template
@@ -0,0 +1,354 @@
+// Copyright 2016 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+//#include "DispatcherBase.h"
+//#include "Parser.h"
+
+{% for namespace in config.protocol.namespace %}
+namespace {{namespace}} {
+{% endfor %}
+
+// static
+DispatchResponse DispatchResponse::OK()
+{
+    DispatchResponse result;
+    result.m_status = kSuccess;
+    result.m_errorCode = kParseError;
+    return result;
+}
+
+// static
+DispatchResponse DispatchResponse::Error(const String& error)
+{
+    DispatchResponse result;
+    result.m_status = kError;
+    result.m_errorCode = kServerError;
+    result.m_errorMessage = error;
+    return result;
+}
+
+// static
+DispatchResponse DispatchResponse::InternalError()
+{
+    DispatchResponse result;
+    result.m_status = kError;
+    result.m_errorCode = kInternalError;
+    result.m_errorMessage = "Internal error";
+    return result;
+}
+
+// static
+DispatchResponse DispatchResponse::InvalidParams(const String& error)
+{
+    DispatchResponse result;
+    result.m_status = kError;
+    result.m_errorCode = kInvalidParams;
+    result.m_errorMessage = error;
+    return result;
+}
+
+// static
+DispatchResponse DispatchResponse::FallThrough()
+{
+    DispatchResponse result;
+    result.m_status = kFallThrough;
+    result.m_errorCode = kParseError;
+    return result;
+}
+
+// static
+const char DispatcherBase::kInvalidParamsString[] = "Invalid parameters";
+
+DispatcherBase::WeakPtr::WeakPtr(DispatcherBase* dispatcher) : m_dispatcher(dispatcher) { }
+
+DispatcherBase::WeakPtr::~WeakPtr()
+{
+    if (m_dispatcher)
+        m_dispatcher->m_weakPtrs.erase(this);
+}
+
+DispatcherBase::Callback::Callback(std::unique_ptr<DispatcherBase::WeakPtr> backendImpl, int callId, int callbackId)
+    : m_backendImpl(std::move(backendImpl))
+    , m_callId(callId)
+    , m_callbackId(callbackId) { }
+
+DispatcherBase::Callback::~Callback() = default;
+
+void DispatcherBase::Callback::dispose()
+{
+    m_backendImpl = nullptr;
+}
+
+void DispatcherBase::Callback::sendIfActive(std::unique_ptr<protocol::DictionaryValue> partialMessage, const DispatchResponse& response)
+{
+    if (!m_backendImpl || !m_backendImpl->get())
+        return;
+    m_backendImpl->get()->sendResponse(m_callId, response, std::move(partialMessage));
+    m_backendImpl = nullptr;
+}
+
+void DispatcherBase::Callback::fallThroughIfActive()
+{
+    if (!m_backendImpl || !m_backendImpl->get())
+        return;
+    m_backendImpl->get()->markFallThrough(m_callbackId);
+    m_backendImpl = nullptr;
+}
+
+DispatcherBase::DispatcherBase(FrontendChannel* frontendChannel)
+    : m_frontendChannel(frontendChannel)
+    , m_lastCallbackId(0)
+    , m_lastCallbackFallThrough(false) { }
+
+DispatcherBase::~DispatcherBase()
+{
+    clearFrontend();
+}
+
+int DispatcherBase::nextCallbackId()
+{
+    m_lastCallbackFallThrough = false;
+    return ++m_lastCallbackId;
+}
+
+void DispatcherBase::markFallThrough(int callbackId)
+{
+    DCHECK(callbackId == m_lastCallbackId);
+    m_lastCallbackFallThrough = true;
+}
+
+void DispatcherBase::sendResponse(int callId, const DispatchResponse& response, std::unique_ptr<protocol::DictionaryValue> result)
+{
+    if (!m_frontendChannel)
+        return;
+    if (response.status() == DispatchResponse::kError) {
+        reportProtocolError(callId, response.errorCode(), response.errorMessage(), nullptr);
+        return;
+    }
+    m_frontendChannel->sendProtocolResponse(callId, InternalResponse::createResponse(callId, std::move(result)));
+}
+
+void DispatcherBase::sendResponse(int callId, const DispatchResponse& response)
+{
+    sendResponse(callId, response, DictionaryValue::create());
+}
+
+namespace {
+
+class ProtocolError : public Serializable {
+public:
+    static std::unique_ptr<ProtocolError> createErrorResponse(int callId, DispatchResponse::ErrorCode code, const String& errorMessage, ErrorSupport* errors)
+    {
+        std::unique_ptr<ProtocolError> protocolError(new ProtocolError(code, errorMessage));
+        protocolError->m_callId = callId;
+        protocolError->m_hasCallId = true;
+        if (errors && errors->hasErrors())
+            protocolError->m_data = errors->errors();
+        return protocolError;
+    }
+
+    static std::unique_ptr<ProtocolError> createErrorNotification(DispatchResponse::ErrorCode code, const String& errorMessage)
+    {
+        return std::unique_ptr<ProtocolError>(new ProtocolError(code, errorMessage));
+    }
+
+    String serialize() override
+    {
+        std::unique_ptr<protocol::DictionaryValue> error = DictionaryValue::create();
+        error->setInteger("code", m_code);
+        error->setString("message", m_errorMessage);
+        if (m_data.length())
+            error->setString("data", m_data);
+        std::unique_ptr<protocol::DictionaryValue> message = DictionaryValue::create();
+        message->setObject("error", std::move(error));
+        if (m_hasCallId)
+            message->setInteger("id", m_callId);
+        return message->serialize();
+    }
+
+    ~ProtocolError() override {}
+
+private:
+    ProtocolError(DispatchResponse::ErrorCode code, const String& errorMessage)
+        : m_code(code)
+        , m_errorMessage(errorMessage)
+    {
+    }
+
+    DispatchResponse::ErrorCode m_code;
+    String m_errorMessage;
+    String m_data;
+    int m_callId = 0;
+    bool m_hasCallId = false;
+};
+
+} // namespace
+
+static void reportProtocolErrorTo(FrontendChannel* frontendChannel, int callId, DispatchResponse::ErrorCode code, const String& errorMessage, ErrorSupport* errors)
+{
+    if (frontendChannel)
+        frontendChannel->sendProtocolResponse(callId, ProtocolError::createErrorResponse(callId, code, errorMessage, errors));
+}
+
+static void reportProtocolErrorTo(FrontendChannel* frontendChannel, DispatchResponse::ErrorCode code, const String& errorMessage)
+{
+    if (frontendChannel)
+        frontendChannel->sendProtocolNotification(ProtocolError::createErrorNotification(code, errorMessage));
+}
+
+void DispatcherBase::reportProtocolError(int callId, DispatchResponse::ErrorCode code, const String& errorMessage, ErrorSupport* errors)
+{
+    reportProtocolErrorTo(m_frontendChannel, callId, code, errorMessage, errors);
+}
+
+void DispatcherBase::clearFrontend()
+{
+    m_frontendChannel = nullptr;
+    for (auto& weak : m_weakPtrs)
+        weak->dispose();
+    m_weakPtrs.clear();
+}
+
+std::unique_ptr<DispatcherBase::WeakPtr> DispatcherBase::weakPtr()
+{
+    std::unique_ptr<DispatcherBase::WeakPtr> weak(new DispatcherBase::WeakPtr(this));
+    m_weakPtrs.insert(weak.get());
+    return weak;
+}
+
+UberDispatcher::UberDispatcher(FrontendChannel* frontendChannel)
+    : m_frontendChannel(frontendChannel)
+    , m_fallThroughForNotFound(false) { }
+
+void UberDispatcher::setFallThroughForNotFound(bool fallThroughForNotFound)
+{
+    m_fallThroughForNotFound = fallThroughForNotFound;
+}
+
+void UberDispatcher::registerBackend(const String& name, std::unique_ptr<protocol::DispatcherBase> dispatcher)
+{
+    m_dispatchers[name] = std::move(dispatcher);
+}
+
+void UberDispatcher::setupRedirects(const std::unordered_map<String, String>& redirects)
+{
+    for (const auto& pair : redirects)
+        m_redirects[pair.first] = pair.second;
+}
+
+DispatchResponse::Status UberDispatcher::dispatch(std::unique_ptr<Value> parsedMessage, int* outCallId, String* outMethod)
+{
+    if (!parsedMessage) {
+        reportProtocolErrorTo(m_frontendChannel, DispatchResponse::kParseError, "Message must be a valid JSON");
+        return DispatchResponse::kError;
+    }
+    std::unique_ptr<protocol::DictionaryValue> messageObject = DictionaryValue::cast(std::move(parsedMessage));
+    if (!messageObject) {
+        reportProtocolErrorTo(m_frontendChannel, DispatchResponse::kInvalidRequest, "Message must be an object");
+        return DispatchResponse::kError;
+    }
+
+    int callId = 0;
+    protocol::Value* callIdValue = messageObject->get("id");
+    bool success = callIdValue && callIdValue->asInteger(&callId);
+    if (outCallId)
+        *outCallId = callId;
+    if (!success) {
+        reportProtocolErrorTo(m_frontendChannel, DispatchResponse::kInvalidRequest, "Message must have integer 'id' property");
+        return DispatchResponse::kError;
+    }
+
+    protocol::Value* methodValue = messageObject->get("method");
+    String method;
+    success = methodValue && methodValue->asString(&method);
+    if (outMethod)
+        *outMethod = method;
+    if (!success) {
+        reportProtocolErrorTo(m_frontendChannel, callId, DispatchResponse::kInvalidRequest, "Message must have string 'method' property", nullptr);
+        return DispatchResponse::kError;
+    }
+
+    std::unordered_map<String, String>::iterator redirectIt = m_redirects.find(method);
+    if (redirectIt != m_redirects.end())
+        method = redirectIt->second;
+
+    size_t dotIndex = StringUtil::find(method, ".");
+    if (dotIndex == StringUtil::kNotFound) {
+        if (m_fallThroughForNotFound)
+            return DispatchResponse::kFallThrough;
+        reportProtocolErrorTo(m_frontendChannel, callId, DispatchResponse::kMethodNotFound, "'" + method + "' wasn't found", nullptr);
+        return DispatchResponse::kError;
+    }
+    String domain = StringUtil::substring(method, 0, dotIndex);
+    auto it = m_dispatchers.find(domain);
+    if (it == m_dispatchers.end()) {
+        if (m_fallThroughForNotFound)
+            return DispatchResponse::kFallThrough;
+        reportProtocolErrorTo(m_frontendChannel, callId, DispatchResponse::kMethodNotFound, "'" + method + "' wasn't found", nullptr);
+        return DispatchResponse::kError;
+    }
+    return it->second->dispatch(callId, method, std::move(messageObject));
+}
+
+bool UberDispatcher::getCommandName(const String& message, String* method, std::unique_ptr<protocol::DictionaryValue>* parsedMessage)
+{
+    std::unique_ptr<protocol::Value> value = StringUtil::parseJSON(message);
+    if (!value) {
+        reportProtocolErrorTo(m_frontendChannel, DispatchResponse::kParseError, "Message must be a valid JSON");
+        return false;
+   }
+
+    protocol::DictionaryValue* object = DictionaryValue::cast(value.get());
+    if (!object) {
+        reportProtocolErrorTo(m_frontendChannel, DispatchResponse::kInvalidRequest, "Message must be an object");
+        return false;
+    }
+
+    if (!object->getString("method", method)) {
+        reportProtocolErrorTo(m_frontendChannel, DispatchResponse::kInvalidRequest, "Message must have string 'method' property");
+        return false;
+    }
+
+    parsedMessage->reset(DictionaryValue::cast(value.release()));
+    return true;
+}
+
+UberDispatcher::~UberDispatcher() = default;
+
+// static
+std::unique_ptr<InternalResponse> InternalResponse::createResponse(int callId, std::unique_ptr<Serializable> params)
+{
+    return std::unique_ptr<InternalResponse>(new InternalResponse(callId, String(), std::move(params)));
+}
+
+// static
+std::unique_ptr<InternalResponse> InternalResponse::createNotification(const String& notification, std::unique_ptr<Serializable> params)
+{
+    return std::unique_ptr<InternalResponse>(new InternalResponse(0, notification, std::move(params)));
+}
+
+String InternalResponse::serialize()
+{
+    std::unique_ptr<DictionaryValue> result = DictionaryValue::create();
+    std::unique_ptr<Serializable> params(m_params ? std::move(m_params) : DictionaryValue::create());
+    if (m_notification.length()) {
+        result->setString("method", m_notification);
+        result->setValue("params", SerializedValue::create(params->serialize()));
+    } else {
+        result->setInteger("id", m_callId);
+        result->setValue("result", SerializedValue::create(params->serialize()));
+    }
+    return result->serialize();
+}
+
+InternalResponse::InternalResponse(int callId, const String& notification, std::unique_ptr<Serializable> params)
+    : m_callId(callId)
+    , m_notification(notification)
+    , m_params(params ? std::move(params) : nullptr)
+{
+}
+
+{% for namespace in config.protocol.namespace %}
+} // namespace {{namespace}}
+{% endfor %}
diff --git a/deps/inspector_protocol/lib/DispatcherBase_h.template b/deps/inspector_protocol/lib/DispatcherBase_h.template
new file mode 100644
index 00000000000000..6c618cf0f58f93
--- /dev/null
+++ b/deps/inspector_protocol/lib/DispatcherBase_h.template
@@ -0,0 +1,172 @@
+// Copyright 2016 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef {{"_".join(config.protocol.namespace)}}_DispatcherBase_h
+#define {{"_".join(config.protocol.namespace)}}_DispatcherBase_h
+
+//#include "Forward.h"
+//#include "ErrorSupport.h"
+//#include "Values.h"
+
+{% for namespace in config.protocol.namespace %}
+namespace {{namespace}} {
+{% endfor %}
+
+class WeakPtr;
+
+class {{config.lib.export_macro}} DispatchResponse {
+public:
+    enum Status {
+        kSuccess = 0,
+        kError = 1,
+        kFallThrough = 2,
+        kAsync = 3
+    };
+
+    enum ErrorCode {
+        kParseError = -32700,
+        kInvalidRequest = -32600,
+        kMethodNotFound = -32601,
+        kInvalidParams = -32602,
+        kInternalError = -32603,
+        kServerError = -32000,
+    };
+
+    Status status() const { return m_status; }
+    const String& errorMessage() const { return m_errorMessage; }
+    ErrorCode errorCode() const { return m_errorCode; }
+    bool isSuccess() const { return m_status == kSuccess; }
+
+    static DispatchResponse OK();
+    static DispatchResponse Error(const String&);
+    static DispatchResponse InternalError();
+    static DispatchResponse InvalidParams(const String&);
+    static DispatchResponse FallThrough();
+
+private:
+    Status m_status;
+    String m_errorMessage;
+    ErrorCode m_errorCode;
+};
+
+class {{config.lib.export_macro}} DispatcherBase {
+    PROTOCOL_DISALLOW_COPY(DispatcherBase);
+public:
+    static const char kInvalidParamsString[];
+    class {{config.lib.export_macro}} WeakPtr {
+    public:
+        explicit WeakPtr(DispatcherBase*);
+        ~WeakPtr();
+        DispatcherBase* get() { return m_dispatcher; }
+        void dispose() { m_dispatcher = nullptr; }
+
+    private:
+        DispatcherBase* m_dispatcher;
+    };
+
+    class {{config.lib.export_macro}} Callback {
+    public:
+        Callback(std::unique_ptr<WeakPtr> backendImpl, int callId, int callbackId);
+        virtual ~Callback();
+        void dispose();
+
+    protected:
+        void sendIfActive(std::unique_ptr<protocol::DictionaryValue> partialMessage, const DispatchResponse& response);
+        void fallThroughIfActive();
+
+    private:
+        std::unique_ptr<WeakPtr> m_backendImpl;
+        int m_callId;
+        int m_callbackId;
+    };
+
+    explicit DispatcherBase(FrontendChannel*);
+    virtual ~DispatcherBase();
+
+    virtual DispatchResponse::Status dispatch(int callId, const String& method, std::unique_ptr<protocol::DictionaryValue> messageObject) = 0;
+
+    void sendResponse(int callId, const DispatchResponse&, std::unique_ptr<protocol::DictionaryValue> result);
+    void sendResponse(int callId, const DispatchResponse&);
+
+    void reportProtocolError(int callId, DispatchResponse::ErrorCode, const String& errorMessage, ErrorSupport* errors);
+    void clearFrontend();
+
+    std::unique_ptr<WeakPtr> weakPtr();
+
+    int nextCallbackId();
+    void markFallThrough(int callbackId);
+    bool lastCallbackFallThrough() { return m_lastCallbackFallThrough; }
+
+private:
+    FrontendChannel* m_frontendChannel;
+    std::unordered_set<WeakPtr*> m_weakPtrs;
+    int m_lastCallbackId;
+    bool m_lastCallbackFallThrough;
+};
+
+class {{config.lib.export_macro}} UberDispatcher {
+    PROTOCOL_DISALLOW_COPY(UberDispatcher);
+public:
+    explicit UberDispatcher(FrontendChannel*);
+    void registerBackend(const String& name, std::unique_ptr<protocol::DispatcherBase>);
+    void setupRedirects(const std::unordered_map<String, String>&);
+    DispatchResponse::Status dispatch(std::unique_ptr<Value> message, int* callId = nullptr, String* method = nullptr);
+    FrontendChannel* channel() { return m_frontendChannel; }
+    bool fallThroughForNotFound() { return m_fallThroughForNotFound; }
+    void setFallThroughForNotFound(bool);
+    bool getCommandName(const String& message, String* method, std::unique_ptr<protocol::DictionaryValue>* parsedMessage);
+    virtual ~UberDispatcher();
+
+private:
+    FrontendChannel* m_frontendChannel;
+    bool m_fallThroughForNotFound;
+    std::unordered_map<String, String> m_redirects;
+    std::unordered_map<String, std::unique_ptr<protocol::DispatcherBase>> m_dispatchers;
+};
+
+class InternalResponse : public Serializable {
+    PROTOCOL_DISALLOW_COPY(InternalResponse);
+public:
+    static std::unique_ptr<InternalResponse> createResponse(int callId, std::unique_ptr<Serializable> params);
+    static std::unique_ptr<InternalResponse> createNotification(const String& notification, std::unique_ptr<Serializable> params = nullptr);
+
+    String serialize() override;
+
+    ~InternalResponse() override {}
+
+private:
+    InternalResponse(int callId, const String& notification, std::unique_ptr<Serializable> params);
+
+    int m_callId;
+    String m_notification;
+    std::unique_ptr<Serializable> m_params;
+};
+
+class InternalRawNotification : public Serializable {
+public:
+    static std::unique_ptr<InternalRawNotification> create(const String& notification)
+    {
+        return std::unique_ptr<InternalRawNotification>(new InternalRawNotification(notification));
+    }
+    ~InternalRawNotification() override {}
+
+    String serialize() override
+    {
+        return m_notification;
+    }
+
+private:
+  explicit InternalRawNotification(const String& notification)
+    : m_notification(notification)
+  {
+  }
+
+  String m_notification;
+};
+
+{% for namespace in config.protocol.namespace %}
+} // namespace {{namespace}}
+{% endfor %}
+
+#endif // !defined({{"_".join(config.protocol.namespace)}}_DispatcherBase_h)
diff --git a/deps/inspector_protocol/lib/ErrorSupport_cpp.template b/deps/inspector_protocol/lib/ErrorSupport_cpp.template
new file mode 100644
index 00000000000000..7b858b8dc48f37
--- /dev/null
+++ b/deps/inspector_protocol/lib/ErrorSupport_cpp.template
@@ -0,0 +1,71 @@
+// Copyright 2016 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+//#include "ErrorSupport.h"
+
+{% for namespace in config.protocol.namespace %}
+namespace {{namespace}} {
+{% endfor %}
+
+ErrorSupport::ErrorSupport() { }
+ErrorSupport::~ErrorSupport() { }
+
+void ErrorSupport::setName(const char* name)
+{
+    setName(String(name));
+}
+
+void ErrorSupport::setName(const String& name)
+{
+    DCHECK(m_path.size());
+    m_path[m_path.size() - 1] = name;
+}
+
+void ErrorSupport::push()
+{
+    m_path.push_back(String());
+}
+
+void ErrorSupport::pop()
+{
+    m_path.pop_back();
+}
+
+void ErrorSupport::addError(const char* error)
+{
+    addError(String(error));
+}
+
+void ErrorSupport::addError(const String& error)
+{
+    StringBuilder builder;
+    for (size_t i = 0; i < m_path.size(); ++i) {
+        if (i)
+            StringUtil::builderAppend(builder, '.');
+        StringUtil::builderAppend(builder, m_path[i]);
+    }
+    StringUtil::builderAppend(builder, ": ");
+    StringUtil::builderAppend(builder, error);
+    m_errors.push_back(StringUtil::builderToString(builder));
+}
+
+bool ErrorSupport::hasErrors()
+{
+    return !!m_errors.size();
+}
+
+String ErrorSupport::errors()
+{
+    StringBuilder builder;
+    for (size_t i = 0; i < m_errors.size(); ++i) {
+        if (i)
+            StringUtil::builderAppend(builder, "; ");
+        StringUtil::builderAppend(builder, m_errors[i]);
+    }
+    return StringUtil::builderToString(builder);
+}
+
+{% for namespace in config.protocol.namespace %}
+} // namespace {{namespace}}
+{% endfor %}
diff --git a/deps/inspector_protocol/lib/ErrorSupport_h.template b/deps/inspector_protocol/lib/ErrorSupport_h.template
new file mode 100644
index 00000000000000..11934c3abe8c01
--- /dev/null
+++ b/deps/inspector_protocol/lib/ErrorSupport_h.template
@@ -0,0 +1,37 @@
+// Copyright 2016 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef {{"_".join(config.protocol.namespace)}}_ErrorSupport_h
+#define {{"_".join(config.protocol.namespace)}}_ErrorSupport_h
+
+#include {{format_include(config.protocol.package, "Forward")}}
+
+{% for namespace in config.protocol.namespace %}
+namespace {{namespace}} {
+{% endfor %}
+
+class {{config.lib.export_macro}} ErrorSupport {
+public:
+    ErrorSupport();
+    ~ErrorSupport();
+
+    void push();
+    void setName(const char*);
+    void setName(const String&);
+    void pop();
+    void addError(const char*);
+    void addError(const String&);
+    bool hasErrors();
+    String errors();
+
+private:
+    std::vector<String> m_path;
+    std::vector<String> m_errors;
+};
+
+{% for namespace in config.protocol.namespace %}
+} // namespace {{namespace}}
+{% endfor %}
+
+#endif // !defined({{"_".join(config.protocol.namespace)}}_ErrorSupport_h)
diff --git a/deps/inspector_protocol/lib/Forward_h.template b/deps/inspector_protocol/lib/Forward_h.template
new file mode 100644
index 00000000000000..a3f7c2f0ba9f54
--- /dev/null
+++ b/deps/inspector_protocol/lib/Forward_h.template
@@ -0,0 +1,40 @@
+// Copyright 2016 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef {{"_".join(config.protocol.namespace)}}_Forward_h
+#define {{"_".join(config.protocol.namespace)}}_Forward_h
+
+{% if config.lib.export_header %}
+#include {{format_include(config.lib.export_header)}}
+{% endif %}
+#include {{format_include(config.lib.string_header)}}
+
+#include <cstddef>
+#include <vector>
+#include <unordered_map>
+#include <unordered_set>
+
+{% for namespace in config.protocol.namespace %}
+namespace {{namespace}} {
+{% endfor %}
+
+template<typename T> class Array;
+class DictionaryValue;
+class DispatchResponse;
+class ErrorSupport;
+class FundamentalValue;
+class ListValue;
+template<typename T> class Maybe;
+class Object;
+using Response = DispatchResponse;
+class SerializedValue;
+class StringValue;
+class UberDispatcher;
+class Value;
+
+{% for namespace in config.protocol.namespace %}
+} // namespace {{namespace}}
+{% endfor %}
+
+#endif // !defined({{"_".join(config.protocol.namespace)}}_Forward_h)
diff --git a/deps/inspector_protocol/lib/FrontendChannel_h.template b/deps/inspector_protocol/lib/FrontendChannel_h.template
new file mode 100644
index 00000000000000..0454978b0c8e88
--- /dev/null
+++ b/deps/inspector_protocol/lib/FrontendChannel_h.template
@@ -0,0 +1,30 @@
+// Copyright 2016 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef {{"_".join(config.protocol.namespace)}}_FrontendChannel_h
+#define {{"_".join(config.protocol.namespace)}}_FrontendChannel_h
+
+{% for namespace in config.protocol.namespace %}
+namespace {{namespace}} {
+{% endfor %}
+
+class {{config.lib.export_macro}} Serializable {
+public:
+    virtual String serialize() = 0;
+    virtual ~Serializable() = default;
+};
+
+class {{config.lib.export_macro}} FrontendChannel {
+public:
+    virtual ~FrontendChannel() { }
+    virtual void sendProtocolResponse(int callId, std::unique_ptr<Serializable> message) = 0;
+    virtual void sendProtocolNotification(std::unique_ptr<Serializable> message) = 0;
+    virtual void flushProtocolNotifications() = 0;
+};
+
+{% for namespace in config.protocol.namespace %}
+} // namespace {{namespace}}
+{% endfor %}
+
+#endif // !defined({{"_".join(config.protocol.namespace)}}_FrontendChannel_h)
diff --git a/deps/inspector_protocol/lib/Maybe_h.template b/deps/inspector_protocol/lib/Maybe_h.template
new file mode 100644
index 00000000000000..71593acd0e553d
--- /dev/null
+++ b/deps/inspector_protocol/lib/Maybe_h.template
@@ -0,0 +1,86 @@
+// Copyright 2016 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef {{"_".join(config.protocol.namespace)}}_Maybe_h
+#define {{"_".join(config.protocol.namespace)}}_Maybe_h
+
+//#include "Forward.h"
+
+{% for namespace in config.protocol.namespace %}
+namespace {{namespace}} {
+{% endfor %}
+
+template<typename T>
+class Maybe {
+public:
+    Maybe() : m_value() { }
+    Maybe(std::unique_ptr<T> value) : m_value(std::move(value)) { }
+    Maybe(Maybe&& other) : m_value(std::move(other.m_value)) { }
+    void operator=(std::unique_ptr<T> value) { m_value = std::move(value); }
+    T* fromJust() const { DCHECK(m_value); return m_value.get(); }
+    T* fromMaybe(T* defaultValue) const { return m_value ? m_value.get() : defaultValue; }
+    bool isJust() const { return !!m_value; }
+    std::unique_ptr<T> takeJust() { DCHECK(m_value); return std::move(m_value); }
+private:
+    std::unique_ptr<T> m_value;
+};
+
+template<typename T>
+class MaybeBase {
+public:
+    MaybeBase() : m_isJust(false) { }
+    MaybeBase(T value) : m_isJust(true), m_value(value) { }
+    MaybeBase(MaybeBase&& other) : m_isJust(other.m_isJust), m_value(std::move(other.m_value)) { }
+    void operator=(T value) { m_value = value; m_isJust = true; }
+    T fromJust() const { DCHECK(m_isJust); return m_value; }
+    T fromMaybe(const T& defaultValue) const { return m_isJust ? m_value : defaultValue; }
+    bool isJust() const { return m_isJust; }
+    T takeJust() { DCHECK(m_isJust); return m_value; }
+
+protected:
+    bool m_isJust;
+    T m_value;
+};
+
+template<>
+class Maybe<bool> : public MaybeBase<bool> {
+public:
+    Maybe() { }
+    Maybe(bool value) : MaybeBase(value) { }
+    Maybe(Maybe&& other) : MaybeBase(std::move(other)) { }
+    using MaybeBase::operator=;
+};
+
+template<>
+class Maybe<int> : public MaybeBase<int> {
+public:
+    Maybe() { }
+    Maybe(int value) : MaybeBase(value) { }
+    Maybe(Maybe&& other) : MaybeBase(std::move(other)) { }
+    using MaybeBase::operator=;
+};
+
+template<>
+class Maybe<double> : public MaybeBase<double> {
+public:
+    Maybe() { }
+    Maybe(double value) : MaybeBase(value) { }
+    Maybe(Maybe&& other) : MaybeBase(std::move(other)) { }
+    using MaybeBase::operator=;
+};
+
+template<>
+class Maybe<String> : public MaybeBase<String> {
+public:
+    Maybe() { }
+    Maybe(const String& value) : MaybeBase(value) { }
+    Maybe(Maybe&& other) : MaybeBase(std::move(other)) { }
+    using MaybeBase::operator=;
+};
+
+{% for namespace in config.protocol.namespace %}
+} // namespace {{namespace}}
+{% endfor %}
+
+#endif // !defined({{"_".join(config.protocol.namespace)}}_Maybe_h)
diff --git a/deps/inspector_protocol/lib/Object_cpp.template b/deps/inspector_protocol/lib/Object_cpp.template
new file mode 100644
index 00000000000000..91723a71e29ce4
--- /dev/null
+++ b/deps/inspector_protocol/lib/Object_cpp.template
@@ -0,0 +1,38 @@
+// Copyright 2016 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+//#include "Object.h"
+
+{% for namespace in config.protocol.namespace %}
+namespace {{namespace}} {
+{% endfor %}
+
+std::unique_ptr<Object> Object::fromValue(protocol::Value* value, ErrorSupport* errors)
+{
+    protocol::DictionaryValue* dictionary = DictionaryValue::cast(value);
+    if (!dictionary) {
+        errors->addError("object expected");
+        return nullptr;
+    }
+    dictionary = static_cast<protocol::DictionaryValue*>(dictionary->clone().release());
+    return std::unique_ptr<Object>(new Object(std::unique_ptr<DictionaryValue>(dictionary)));
+}
+
+std::unique_ptr<protocol::DictionaryValue> Object::toValue() const
+{
+    return DictionaryValue::cast(m_object->clone());
+}
+
+std::unique_ptr<Object> Object::clone() const
+{
+    return std::unique_ptr<Object>(new Object(DictionaryValue::cast(m_object->clone())));
+}
+
+Object::Object(std::unique_ptr<protocol::DictionaryValue> object) : m_object(std::move(object)) { }
+
+Object::~Object() { }
+
+{% for namespace in config.protocol.namespace %}
+} // namespace {{namespace}}
+{% endfor %}
diff --git a/deps/inspector_protocol/lib/Object_h.template b/deps/inspector_protocol/lib/Object_h.template
new file mode 100644
index 00000000000000..f6ffc57659e148
--- /dev/null
+++ b/deps/inspector_protocol/lib/Object_h.template
@@ -0,0 +1,32 @@
+// Copyright 2016 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef {{"_".join(config.protocol.namespace)}}_Object_h
+#define {{"_".join(config.protocol.namespace)}}_Object_h
+
+//#include "ErrorSupport.h"
+//#include "Forward.h"
+//#include "Values.h"
+
+{% for namespace in config.protocol.namespace %}
+namespace {{namespace}} {
+{% endfor %}
+
+class {{config.lib.export_macro}} Object {
+public:
+    static std::unique_ptr<Object> fromValue(protocol::Value*, ErrorSupport*);
+    ~Object();
+
+    std::unique_ptr<protocol::DictionaryValue> toValue() const;
+    std::unique_ptr<Object> clone() const;
+private:
+    explicit Object(std::unique_ptr<protocol::DictionaryValue>);
+    std::unique_ptr<protocol::DictionaryValue> m_object;
+};
+
+{% for namespace in config.protocol.namespace %}
+} // namespace {{namespace}}
+{% endfor %}
+
+#endif // !defined({{"_".join(config.protocol.namespace)}}_Object_h)
diff --git a/deps/inspector_protocol/lib/Parser_cpp.template b/deps/inspector_protocol/lib/Parser_cpp.template
new file mode 100644
index 00000000000000..ea276520969980
--- /dev/null
+++ b/deps/inspector_protocol/lib/Parser_cpp.template
@@ -0,0 +1,546 @@
+// Copyright 2016 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+{% for namespace in config.protocol.namespace %}
+namespace {{namespace}} {
+{% endfor %}
+
+namespace {
+
+const int stackLimit = 1000;
+
+enum Token {
+    ObjectBegin,
+    ObjectEnd,
+    ArrayBegin,
+    ArrayEnd,
+    StringLiteral,
+    Number,
+    BoolTrue,
+    BoolFalse,
+    NullToken,
+    ListSeparator,
+    ObjectPairSeparator,
+    InvalidToken,
+};
+
+const char* const nullString = "null";
+const char* const trueString = "true";
+const char* const falseString = "false";
+
+bool isASCII(uint16_t c)
+{
+    return !(c & ~0x7F);
+}
+
+bool isSpaceOrNewLine(uint16_t c)
+{
+    return isASCII(c) && c <= ' ' && (c == ' ' || (c <= 0xD && c >= 0x9));
+}
+
+double charactersToDouble(const uint16_t* characters, size_t length, bool* ok)
+{
+    std::vector<char> buffer;
+    buffer.reserve(length + 1);
+    for (size_t i = 0; i < length; ++i) {
+        if (!isASCII(characters[i])) {
+            *ok = false;
+            return 0;
+        }
+        buffer.push_back(static_cast<char>(characters[i]));
+    }
+    buffer.push_back('\0');
+    return StringUtil::toDouble(buffer.data(), length, ok);
+}
+
+double charactersToDouble(const uint8_t* characters, size_t length, bool* ok)
+{
+    std::string buffer(reinterpret_cast<const char*>(characters), length);
+    return StringUtil::toDouble(buffer.data(), length, ok);
+}
+
+template<typename Char>
+bool parseConstToken(const Char* start, const Char* end, const Char** tokenEnd, const char* token)
+{
+    while (start < end && *token != '\0' && *start++ == *token++) { }
+    if (*token != '\0')
+        return false;
+    *tokenEnd = start;
+    return true;
+}
+
+template<typename Char>
+bool readInt(const Char* start, const Char* end, const Char** tokenEnd, bool canHaveLeadingZeros)
+{
+    if (start == end)
+        return false;
+    bool haveLeadingZero = '0' == *start;
+    int length = 0;
+    while (start < end && '0' <= *start && *start <= '9') {
+        ++start;
+        ++length;
+    }
+    if (!length)
+        return false;
+    if (!canHaveLeadingZeros && length > 1 && haveLeadingZero)
+        return false;
+    *tokenEnd = start;
+    return true;
+}
+
+template<typename Char>
+bool parseNumberToken(const Char* start, const Char* end, const Char** tokenEnd)
+{
+    // We just grab the number here. We validate the size in DecodeNumber.
+    // According to RFC4627, a valid number is: [minus] int [frac] [exp]
+    if (start == end)
+        return false;
+    Char c = *start;
+    if ('-' == c)
+        ++start;
+
+    if (!readInt(start, end, &start, false))
+        return false;
+    if (start == end) {
+        *tokenEnd = start;
+        return true;
+    }
+
+    // Optional fraction part
+    c = *start;
+    if ('.' == c) {
+        ++start;
+        if (!readInt(start, end, &start, true))
+            return false;
+        if (start == end) {
+            *tokenEnd = start;
+            return true;
+        }
+        c = *start;
+    }
+
+    // Optional exponent part
+    if ('e' == c || 'E' == c) {
+        ++start;
+        if (start == end)
+            return false;
+        c = *start;
+        if ('-' == c || '+' == c) {
+            ++start;
+            if (start == end)
+                return false;
+        }
+        if (!readInt(start, end, &start, true))
+            return false;
+    }
+
+    *tokenEnd = start;
+    return true;
+}
+
+template<typename Char>
+bool readHexDigits(const Char* start, const Char* end, const Char** tokenEnd, int digits)
+{
+    if (end - start < digits)
+        return false;
+    for (int i = 0; i < digits; ++i) {
+        Char c = *start++;
+        if (!(('0' <= c && c <= '9') || ('a' <= c && c <= 'f') || ('A' <= c && c <= 'F')))
+            return false;
+    }
+    *tokenEnd = start;
+    return true;
+}
+
+template<typename Char>
+bool parseStringToken(const Char* start, const Char* end, const Char** tokenEnd)
+{
+    while (start < end) {
+        Char c = *start++;
+        if ('\\' == c) {
+	    if (start == end)
+	        return false;
+            c = *start++;
+            // Make sure the escaped char is valid.
+            switch (c) {
+            case 'x':
+                if (!readHexDigits(start, end, &start, 2))
+                    return false;
+                break;
+            case 'u':
+                if (!readHexDigits(start, end, &start, 4))
+                    return false;
+                break;
+            case '\\':
+            case '/':
+            case 'b':
+            case 'f':
+            case 'n':
+            case 'r':
+            case 't':
+            case 'v':
+            case '"':
+                break;
+            default:
+                return false;
+            }
+        } else if ('"' == c) {
+            *tokenEnd = start;
+            return true;
+        }
+    }
+    return false;
+}
+
+template<typename Char>
+bool skipComment(const Char* start, const Char* end, const Char** commentEnd)
+{
+    if (start == end)
+        return false;
+
+    if (*start != '/' || start + 1 >= end)
+        return false;
+    ++start;
+
+    if (*start == '/') {
+        // Single line comment, read to newline.
+        for (++start; start < end; ++start) {
+            if (*start == '\n' || *start == '\r') {
+                *commentEnd = start + 1;
+                return true;
+            }
+        }
+        *commentEnd = end;
+        // Comment reaches end-of-input, which is fine.
+        return true;
+    }
+
+    if (*start == '*') {
+        Char previous = '\0';
+        // Block comment, read until end marker.
+        for (++start; start < end; previous = *start++) {
+            if (previous == '*' && *start == '/') {
+                *commentEnd = start + 1;
+                return true;
+            }
+        }
+        // Block comment must close before end-of-input.
+        return false;
+    }
+
+    return false;
+}
+
+template<typename Char>
+void skipWhitespaceAndComments(const Char* start, const Char* end, const Char** whitespaceEnd)
+{
+    while (start < end) {
+        if (isSpaceOrNewLine(*start)) {
+            ++start;
+        } else if (*start == '/') {
+            const Char* commentEnd;
+            if (!skipComment(start, end, &commentEnd))
+                break;
+            start = commentEnd;
+        } else {
+            break;
+        }
+    }
+    *whitespaceEnd = start;
+}
+
+template<typename Char>
+Token parseToken(const Char* start, const Char* end, const Char** tokenStart, const Char** tokenEnd)
+{
+    skipWhitespaceAndComments(start, end, tokenStart);
+    start = *tokenStart;
+
+    if (start == end)
+        return InvalidToken;
+
+    switch (*start) {
+    case 'n':
+        if (parseConstToken(start, end, tokenEnd, nullString))
+            return NullToken;
+        break;
+    case 't':
+        if (parseConstToken(start, end, tokenEnd, trueString))
+            return BoolTrue;
+        break;
+    case 'f':
+        if (parseConstToken(start, end, tokenEnd, falseString))
+            return BoolFalse;
+        break;
+    case '[':
+        *tokenEnd = start + 1;
+        return ArrayBegin;
+    case ']':
+        *tokenEnd = start + 1;
+        return ArrayEnd;
+    case ',':
+        *tokenEnd = start + 1;
+        return ListSeparator;
+    case '{':
+        *tokenEnd = start + 1;
+        return ObjectBegin;
+    case '}':
+        *tokenEnd = start + 1;
+        return ObjectEnd;
+    case ':':
+        *tokenEnd = start + 1;
+        return ObjectPairSeparator;
+    case '0':
+    case '1':
+    case '2':
+    case '3':
+    case '4':
+    case '5':
+    case '6':
+    case '7':
+    case '8':
+    case '9':
+    case '-':
+        if (parseNumberToken(start, end, tokenEnd))
+            return Number;
+        break;
+    case '"':
+        if (parseStringToken(start + 1, end, tokenEnd))
+            return StringLiteral;
+        break;
+    }
+    return InvalidToken;
+}
+
+template<typename Char>
+int hexToInt(Char c)
+{
+    if ('0' <= c && c <= '9')
+        return c - '0';
+    if ('A' <= c && c <= 'F')
+        return c - 'A' + 10;
+    if ('a' <= c && c <= 'f')
+        return c - 'a' + 10;
+    DCHECK(false);
+    return 0;
+}
+
+template<typename Char>
+bool decodeString(const Char* start, const Char* end, StringBuilder* output)
+{
+    while (start < end) {
+        uint16_t c = *start++;
+        if ('\\' != c) {
+            StringUtil::builderAppend(*output, c);
+            continue;
+        }
+	if (start == end)
+	    return false;
+        c = *start++;
+
+        if (c == 'x') {
+            // \x is not supported.
+            return false;
+        }
+
+        switch (c) {
+        case '"':
+        case '/':
+        case '\\':
+            break;
+        case 'b':
+            c = '\b';
+            break;
+        case 'f':
+            c = '\f';
+            break;
+        case 'n':
+            c = '\n';
+            break;
+        case 'r':
+            c = '\r';
+            break;
+        case 't':
+            c = '\t';
+            break;
+        case 'v':
+            c = '\v';
+            break;
+        case 'u':
+            c = (hexToInt(*start) << 12) +
+                (hexToInt(*(start + 1)) << 8) +
+                (hexToInt(*(start + 2)) << 4) +
+                hexToInt(*(start + 3));
+            start += 4;
+            break;
+        default:
+            return false;
+        }
+        StringUtil::builderAppend(*output, c);
+    }
+    return true;
+}
+
+template<typename Char>
+bool decodeString(const Char* start, const Char* end, String* output)
+{
+    if (start == end) {
+        *output = "";
+        return true;
+    }
+    if (start > end)
+        return false;
+    StringBuilder buffer;
+    StringUtil::builderReserve(buffer, end - start);
+    if (!decodeString(start, end, &buffer))
+        return false;
+    *output = StringUtil::builderToString(buffer);
+    return true;
+}
+
+template<typename Char>
+std::unique_ptr<Value> buildValue(const Char* start, const Char* end, const Char** valueTokenEnd, int depth)
+{
+    if (depth > stackLimit)
+        return nullptr;
+
+    std::unique_ptr<Value> result;
+    const Char* tokenStart;
+    const Char* tokenEnd;
+    Token token = parseToken(start, end, &tokenStart, &tokenEnd);
+    switch (token) {
+    case InvalidToken:
+        return nullptr;
+    case NullToken:
+        result = Value::null();
+        break;
+    case BoolTrue:
+        result = FundamentalValue::create(true);
+        break;
+    case BoolFalse:
+        result = FundamentalValue::create(false);
+        break;
+    case Number: {
+        bool ok;
+        double value = charactersToDouble(tokenStart, tokenEnd - tokenStart, &ok);
+        if (!ok)
+            return nullptr;
+        if (value >= INT_MIN && value <= INT_MAX && static_cast<int>(value) == value)
+            result = FundamentalValue::create(static_cast<int>(value));
+        else
+            result = FundamentalValue::create(value);
+        break;
+    }
+    case StringLiteral: {
+        String value;
+        bool ok = decodeString(tokenStart + 1, tokenEnd - 1, &value);
+        if (!ok)
+            return nullptr;
+        result = StringValue::create(value);
+        break;
+    }
+    case ArrayBegin: {
+        std::unique_ptr<ListValue> array = ListValue::create();
+        start = tokenEnd;
+        token = parseToken(start, end, &tokenStart, &tokenEnd);
+        while (token != ArrayEnd) {
+            std::unique_ptr<Value> arrayNode = buildValue(start, end, &tokenEnd, depth + 1);
+            if (!arrayNode)
+                return nullptr;
+            array->pushValue(std::move(arrayNode));
+
+            // After a list value, we expect a comma or the end of the list.
+            start = tokenEnd;
+            token = parseToken(start, end, &tokenStart, &tokenEnd);
+            if (token == ListSeparator) {
+                start = tokenEnd;
+                token = parseToken(start, end, &tokenStart, &tokenEnd);
+                if (token == ArrayEnd)
+                    return nullptr;
+            } else if (token != ArrayEnd) {
+                // Unexpected value after list value. Bail out.
+                return nullptr;
+            }
+        }
+        if (token != ArrayEnd)
+            return nullptr;
+        result = std::move(array);
+        break;
+    }
+    case ObjectBegin: {
+        std::unique_ptr<DictionaryValue> object = DictionaryValue::create();
+        start = tokenEnd;
+        token = parseToken(start, end, &tokenStart, &tokenEnd);
+        while (token != ObjectEnd) {
+            if (token != StringLiteral)
+                return nullptr;
+            String key;
+            if (!decodeString(tokenStart + 1, tokenEnd - 1, &key))
+                return nullptr;
+            start = tokenEnd;
+
+            token = parseToken(start, end, &tokenStart, &tokenEnd);
+            if (token != ObjectPairSeparator)
+                return nullptr;
+            start = tokenEnd;
+
+            std::unique_ptr<Value> value = buildValue(start, end, &tokenEnd, depth + 1);
+            if (!value)
+                return nullptr;
+            object->setValue(key, std::move(value));
+            start = tokenEnd;
+
+            // After a key/value pair, we expect a comma or the end of the
+            // object.
+            token = parseToken(start, end, &tokenStart, &tokenEnd);
+            if (token == ListSeparator) {
+                start = tokenEnd;
+                token = parseToken(start, end, &tokenStart, &tokenEnd);
+                if (token == ObjectEnd)
+                    return nullptr;
+            } else if (token != ObjectEnd) {
+                // Unexpected value after last object value. Bail out.
+                return nullptr;
+            }
+        }
+        if (token != ObjectEnd)
+            return nullptr;
+        result = std::move(object);
+        break;
+    }
+
+    default:
+        // We got a token that's not a value.
+        return nullptr;
+    }
+
+    skipWhitespaceAndComments(tokenEnd, end, valueTokenEnd);
+    return result;
+}
+
+template<typename Char>
+std::unique_ptr<Value> parseJSONInternal(const Char* start, unsigned length)
+{
+    const Char* end = start + length;
+    const Char *tokenEnd;
+    std::unique_ptr<Value> value = buildValue(start, end, &tokenEnd, 0);
+    if (!value || tokenEnd != end)
+        return nullptr;
+    return value;
+}
+
+} // anonymous namespace
+
+std::unique_ptr<Value> parseJSONCharacters(const uint16_t* characters, unsigned length)
+{
+    return parseJSONInternal<uint16_t>(characters, length);
+}
+
+std::unique_ptr<Value> parseJSONCharacters(const uint8_t* characters, unsigned length)
+{
+    return parseJSONInternal<uint8_t>(characters, length);
+}
+
+{% for namespace in config.protocol.namespace %}
+} // namespace {{namespace}}
+{% endfor %}
diff --git a/deps/inspector_protocol/lib/Parser_h.template b/deps/inspector_protocol/lib/Parser_h.template
new file mode 100644
index 00000000000000..8397d3f5d6911c
--- /dev/null
+++ b/deps/inspector_protocol/lib/Parser_h.template
@@ -0,0 +1,22 @@
+// Copyright 2016 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef {{"_".join(config.protocol.namespace)}}_Parser_h
+#define {{"_".join(config.protocol.namespace)}}_Parser_h
+
+//#include "Forward.h"
+//#include "Values.h"
+
+{% for namespace in config.protocol.namespace %}
+namespace {{namespace}} {
+{% endfor %}
+
+{{config.lib.export_macro}} std::unique_ptr<Value> parseJSONCharacters(const uint8_t*, unsigned);
+{{config.lib.export_macro}} std::unique_ptr<Value> parseJSONCharacters(const uint16_t*, unsigned);
+
+{% for namespace in config.protocol.namespace %}
+} // namespace {{namespace}}
+{% endfor %}
+
+#endif // !defined({{"_".join(config.protocol.namespace)}}_Parser_h)
diff --git a/deps/inspector_protocol/lib/Protocol_cpp.template b/deps/inspector_protocol/lib/Protocol_cpp.template
new file mode 100644
index 00000000000000..1167ed400a1ba2
--- /dev/null
+++ b/deps/inspector_protocol/lib/Protocol_cpp.template
@@ -0,0 +1,12 @@
+// This file is generated.
+
+// Copyright 2016 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include {{format_include(config.protocol.package, "Protocol")}}
+
+#include <algorithm>
+#include <climits>
+#include <cmath>
+#include <cstring>
diff --git a/deps/inspector_protocol/lib/ValueConversions_h.template b/deps/inspector_protocol/lib/ValueConversions_h.template
new file mode 100644
index 00000000000000..4d64ec9091a6c2
--- /dev/null
+++ b/deps/inspector_protocol/lib/ValueConversions_h.template
@@ -0,0 +1,171 @@
+// Copyright 2016 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef {{"_".join(config.protocol.namespace)}}_ValueConversions_h
+#define {{"_".join(config.protocol.namespace)}}_ValueConversions_h
+
+//#include "ErrorSupport.h"
+//#include "Forward.h"
+//#include "Values.h"
+
+{% for namespace in config.protocol.namespace %}
+namespace {{namespace}} {
+{% endfor %}
+
+template<typename T>
+struct ValueConversions {
+    static std::unique_ptr<T> fromValue(protocol::Value* value, ErrorSupport* errors)
+    {
+        return T::fromValue(value, errors);
+    }
+
+    static std::unique_ptr<protocol::Value> toValue(T* value)
+    {
+        return value->toValue();
+    }
+
+    static std::unique_ptr<protocol::Value> toValue(const std::unique_ptr<T>& value)
+    {
+        return value->toValue();
+    }
+};
+
+template<>
+struct ValueConversions<bool> {
+    static bool fromValue(protocol::Value* value, ErrorSupport* errors)
+    {
+        bool result = false;
+        bool success = value ? value->asBoolean(&result) : false;
+        if (!success)
+            errors->addError("boolean value expected");
+        return result;
+    }
+
+    static std::unique_ptr<protocol::Value> toValue(bool value)
+    {
+        return FundamentalValue::create(value);
+    }
+};
+
+template<>
+struct ValueConversions<int> {
+    static int fromValue(protocol::Value* value, ErrorSupport* errors)
+    {
+        int result = 0;
+        bool success = value ? value->asInteger(&result) : false;
+        if (!success)
+            errors->addError("integer value expected");
+        return result;
+    }
+
+    static std::unique_ptr<protocol::Value> toValue(int value)
+    {
+        return FundamentalValue::create(value);
+    }
+};
+
+template<>
+struct ValueConversions<double> {
+    static double fromValue(protocol::Value* value, ErrorSupport* errors)
+    {
+        double result = 0;
+        bool success = value ? value->asDouble(&result) : false;
+        if (!success)
+            errors->addError("double value expected");
+        return result;
+    }
+
+    static std::unique_ptr<protocol::Value> toValue(double value)
+    {
+        return FundamentalValue::create(value);
+    }
+};
+
+template<>
+struct ValueConversions<String> {
+    static String fromValue(protocol::Value* value, ErrorSupport* errors)
+    {
+        String result;
+        bool success = value ? value->asString(&result) : false;
+        if (!success)
+            errors->addError("string value expected");
+        return result;
+    }
+
+    static std::unique_ptr<protocol::Value> toValue(const String& value)
+    {
+        return StringValue::create(value);
+    }
+};
+
+template<>
+struct ValueConversions<Value> {
+    static std::unique_ptr<Value> fromValue(protocol::Value* value, ErrorSupport* errors)
+    {
+        bool success = !!value;
+        if (!success) {
+            errors->addError("value expected");
+            return nullptr;
+        }
+        return value->clone();
+    }
+
+    static std::unique_ptr<protocol::Value> toValue(Value* value)
+    {
+        return value->clone();
+    }
+
+    static std::unique_ptr<protocol::Value> toValue(const std::unique_ptr<Value>& value)
+    {
+        return value->clone();
+    }
+};
+
+template<>
+struct ValueConversions<DictionaryValue> {
+    static std::unique_ptr<DictionaryValue> fromValue(protocol::Value* value, ErrorSupport* errors)
+    {
+        bool success = value && value->type() == protocol::Value::TypeObject;
+        if (!success)
+            errors->addError("object expected");
+        return DictionaryValue::cast(value->clone());
+    }
+
+    static std::unique_ptr<protocol::Value> toValue(DictionaryValue* value)
+    {
+        return value->clone();
+    }
+
+    static std::unique_ptr<protocol::Value> toValue(const std::unique_ptr<DictionaryValue>& value)
+    {
+        return value->clone();
+    }
+};
+
+template<>
+struct ValueConversions<ListValue> {
+    static std::unique_ptr<ListValue> fromValue(protocol::Value* value, ErrorSupport* errors)
+    {
+        bool success = value && value->type() == protocol::Value::TypeArray;
+        if (!success)
+            errors->addError("list expected");
+        return ListValue::cast(value->clone());
+    }
+
+    static std::unique_ptr<protocol::Value> toValue(ListValue* value)
+    {
+        return value->clone();
+    }
+
+    static std::unique_ptr<protocol::Value> toValue(const std::unique_ptr<ListValue>& value)
+    {
+        return value->clone();
+    }
+};
+
+{% for namespace in config.protocol.namespace %}
+} // namespace {{namespace}}
+{% endfor %}
+
+#endif // !defined({{"_".join(config.protocol.namespace)}}_ValueConversions_h)
diff --git a/deps/inspector_protocol/lib/Values_cpp.template b/deps/inspector_protocol/lib/Values_cpp.template
new file mode 100644
index 00000000000000..b9f061346bf66f
--- /dev/null
+++ b/deps/inspector_protocol/lib/Values_cpp.template
@@ -0,0 +1,409 @@
+// Copyright 2016 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+//#include "Values.h"
+
+{% for namespace in config.protocol.namespace %}
+namespace {{namespace}} {
+{% endfor %}
+
+namespace {
+
+const char* const nullValueString = "null";
+const char* const trueValueString = "true";
+const char* const falseValueString = "false";
+
+inline bool escapeChar(uint16_t c, StringBuilder* dst)
+{
+    switch (c) {
+    case '\b': StringUtil::builderAppend(*dst, "\\b"); break;
+    case '\f': StringUtil::builderAppend(*dst, "\\f"); break;
+    case '\n': StringUtil::builderAppend(*dst, "\\n"); break;
+    case '\r': StringUtil::builderAppend(*dst, "\\r"); break;
+    case '\t': StringUtil::builderAppend(*dst, "\\t"); break;
+    case '\\': StringUtil::builderAppend(*dst, "\\\\"); break;
+    case '"': StringUtil::builderAppend(*dst, "\\\""); break;
+    default:
+        return false;
+    }
+    return true;
+}
+
+const char hexDigits[17] = "0123456789ABCDEF";
+
+void appendUnsignedAsHex(uint16_t number, StringBuilder* dst)
+{
+    StringUtil::builderAppend(*dst, "\\u");
+    for (size_t i = 0; i < 4; ++i) {
+        uint16_t c = hexDigits[(number & 0xF000) >> 12];
+        StringUtil::builderAppend(*dst, c);
+        number <<= 4;
+    }
+}
+
+template <typename Char>
+void escapeStringForJSONInternal(const Char* str, unsigned len,
+                                 StringBuilder* dst)
+{
+    for (unsigned i = 0; i < len; ++i) {
+        Char c = str[i];
+        if (escapeChar(c, dst))
+            continue;
+        if (c < 32 || c > 126) {
+            appendUnsignedAsHex(c, dst);
+        } else {
+            StringUtil::builderAppend(*dst, c);
+        }
+    }
+}
+
+} // anonymous namespace
+
+bool Value::asBoolean(bool*) const
+{
+    return false;
+}
+
+bool Value::asDouble(double*) const
+{
+    return false;
+}
+
+bool Value::asInteger(int*) const
+{
+    return false;
+}
+
+bool Value::asString(String*) const
+{
+    return false;
+}
+
+bool Value::asSerialized(String*) const
+{
+    return false;
+}
+
+void Value::writeJSON(StringBuilder* output) const
+{
+    DCHECK(m_type == TypeNull);
+    StringUtil::builderAppend(*output, nullValueString, 4);
+}
+
+std::unique_ptr<Value> Value::clone() const
+{
+    return Value::null();
+}
+
+String Value::serialize()
+{
+    StringBuilder result;
+    StringUtil::builderReserve(result, 512);
+    writeJSON(&result);
+    return StringUtil::builderToString(result);
+}
+
+bool FundamentalValue::asBoolean(bool* output) const
+{
+    if (type() != TypeBoolean)
+        return false;
+    *output = m_boolValue;
+    return true;
+}
+
+bool FundamentalValue::asDouble(double* output) const
+{
+    if (type() == TypeDouble) {
+        *output = m_doubleValue;
+        return true;
+    }
+    if (type() == TypeInteger) {
+        *output = m_integerValue;
+        return true;
+    }
+    return false;
+}
+
+bool FundamentalValue::asInteger(int* output) const
+{
+    if (type() != TypeInteger)
+        return false;
+    *output = m_integerValue;
+    return true;
+}
+
+void FundamentalValue::writeJSON(StringBuilder* output) const
+{
+    DCHECK(type() == TypeBoolean || type() == TypeInteger || type() == TypeDouble);
+    if (type() == TypeBoolean) {
+        if (m_boolValue)
+            StringUtil::builderAppend(*output, trueValueString, 4);
+        else
+            StringUtil::builderAppend(*output, falseValueString, 5);
+    } else if (type() == TypeDouble) {
+        if (!std::isfinite(m_doubleValue)) {
+            StringUtil::builderAppend(*output, nullValueString, 4);
+            return;
+        }
+        StringUtil::builderAppend(*output, StringUtil::fromDouble(m_doubleValue));
+    } else if (type() == TypeInteger) {
+        StringUtil::builderAppend(*output, StringUtil::fromInteger(m_integerValue));
+    }
+}
+
+std::unique_ptr<Value> FundamentalValue::clone() const
+{
+    switch (type()) {
+    case TypeDouble: return FundamentalValue::create(m_doubleValue);
+    case TypeInteger: return FundamentalValue::create(m_integerValue);
+    case TypeBoolean: return FundamentalValue::create(m_boolValue);
+    default:
+        DCHECK(false);
+    }
+    return nullptr;
+}
+
+bool StringValue::asString(String* output) const
+{
+    *output = m_stringValue;
+    return true;
+}
+
+void StringValue::writeJSON(StringBuilder* output) const
+{
+    DCHECK(type() == TypeString);
+    StringUtil::builderAppendQuotedString(*output, m_stringValue);
+}
+
+std::unique_ptr<Value> StringValue::clone() const
+{
+    return StringValue::create(m_stringValue);
+}
+
+bool SerializedValue::asSerialized(String* output) const
+{
+    *output = m_serializedValue;
+    return true;
+}
+
+void SerializedValue::writeJSON(StringBuilder* output) const
+{
+    DCHECK(type() == TypeSerialized);
+    StringUtil::builderAppend(*output, m_serializedValue);
+}
+
+std::unique_ptr<Value> SerializedValue::clone() const
+{
+    return SerializedValue::create(m_serializedValue);
+}
+
+DictionaryValue::~DictionaryValue()
+{
+}
+
+void DictionaryValue::setBoolean(const String& name, bool value)
+{
+    setValue(name, FundamentalValue::create(value));
+}
+
+void DictionaryValue::setInteger(const String& name, int value)
+{
+    setValue(name, FundamentalValue::create(value));
+}
+
+void DictionaryValue::setDouble(const String& name, double value)
+{
+    setValue(name, FundamentalValue::create(value));
+}
+
+void DictionaryValue::setString(const String& name, const String& value)
+{
+    setValue(name, StringValue::create(value));
+}
+
+void DictionaryValue::setValue(const String& name, std::unique_ptr<Value> value)
+{
+    set(name, value);
+}
+
+void DictionaryValue::setObject(const String& name, std::unique_ptr<DictionaryValue> value)
+{
+    set(name, value);
+}
+
+void DictionaryValue::setArray(const String& name, std::unique_ptr<ListValue> value)
+{
+    set(name, value);
+}
+
+bool DictionaryValue::getBoolean(const String& name, bool* output) const
+{
+    protocol::Value* value = get(name);
+    if (!value)
+        return false;
+    return value->asBoolean(output);
+}
+
+bool DictionaryValue::getInteger(const String& name, int* output) const
+{
+    Value* value = get(name);
+    if (!value)
+        return false;
+    return value->asInteger(output);
+}
+
+bool DictionaryValue::getDouble(const String& name, double* output) const
+{
+    Value* value = get(name);
+    if (!value)
+        return false;
+    return value->asDouble(output);
+}
+
+bool DictionaryValue::getString(const String& name, String* output) const
+{
+    protocol::Value* value = get(name);
+    if (!value)
+        return false;
+    return value->asString(output);
+}
+
+DictionaryValue* DictionaryValue::getObject(const String& name) const
+{
+    return DictionaryValue::cast(get(name));
+}
+
+protocol::ListValue* DictionaryValue::getArray(const String& name) const
+{
+    return ListValue::cast(get(name));
+}
+
+protocol::Value* DictionaryValue::get(const String& name) const
+{
+    Dictionary::const_iterator it = m_data.find(name);
+    if (it == m_data.end())
+        return nullptr;
+    return it->second.get();
+}
+
+DictionaryValue::Entry DictionaryValue::at(size_t index) const
+{
+    const String key = m_order[index];
+    return std::make_pair(key, m_data.find(key)->second.get());
+}
+
+bool DictionaryValue::booleanProperty(const String& name, bool defaultValue) const
+{
+    bool result = defaultValue;
+    getBoolean(name, &result);
+    return result;
+}
+
+int DictionaryValue::integerProperty(const String& name, int defaultValue) const
+{
+    int result = defaultValue;
+    getInteger(name, &result);
+    return result;
+}
+
+double DictionaryValue::doubleProperty(const String& name, double defaultValue) const
+{
+    double result = defaultValue;
+    getDouble(name, &result);
+    return result;
+}
+
+void DictionaryValue::remove(const String& name)
+{
+    m_data.erase(name);
+    m_order.erase(std::remove(m_order.begin(), m_order.end(), name), m_order.end());
+}
+
+void DictionaryValue::writeJSON(StringBuilder* output) const
+{
+    StringUtil::builderAppend(*output, '{');
+    for (size_t i = 0; i < m_order.size(); ++i) {
+        Dictionary::const_iterator it = m_data.find(m_order[i]);
+        CHECK(it != m_data.end());
+        if (i)
+            StringUtil::builderAppend(*output, ',');
+        StringUtil::builderAppendQuotedString(*output, it->first);
+        StringUtil::builderAppend(*output, ':');
+        it->second->writeJSON(output);
+    }
+    StringUtil::builderAppend(*output, '}');
+}
+
+std::unique_ptr<Value> DictionaryValue::clone() const
+{
+    std::unique_ptr<DictionaryValue> result = DictionaryValue::create();
+    for (size_t i = 0; i < m_order.size(); ++i) {
+        String key = m_order[i];
+        Dictionary::const_iterator value = m_data.find(key);
+        DCHECK(value != m_data.cend() && value->second);
+        result->setValue(key, value->second->clone());
+    }
+    return std::move(result);
+}
+
+DictionaryValue::DictionaryValue()
+    : Value(TypeObject)
+{
+}
+
+ListValue::~ListValue()
+{
+}
+
+void ListValue::writeJSON(StringBuilder* output) const
+{
+    StringUtil::builderAppend(*output, '[');
+    bool first = true;
+    for (const std::unique_ptr<protocol::Value>& value : m_data) {
+        if (!first)
+            StringUtil::builderAppend(*output, ',');
+        value->writeJSON(output);
+        first = false;
+    }
+    StringUtil::builderAppend(*output, ']');
+}
+
+std::unique_ptr<Value> ListValue::clone() const
+{
+    std::unique_ptr<ListValue> result = ListValue::create();
+    for (const std::unique_ptr<protocol::Value>& value : m_data)
+        result->pushValue(value->clone());
+    return std::move(result);
+}
+
+ListValue::ListValue()
+    : Value(TypeArray)
+{
+}
+
+void ListValue::pushValue(std::unique_ptr<protocol::Value> value)
+{
+    DCHECK(value);
+    m_data.push_back(std::move(value));
+}
+
+protocol::Value* ListValue::at(size_t index)
+{
+    DCHECK_LT(index, m_data.size());
+    return m_data[index].get();
+}
+
+void escapeLatinStringForJSON(const uint8_t* str, unsigned len, StringBuilder* dst)
+{
+    escapeStringForJSONInternal<uint8_t>(str, len, dst);
+}
+
+void escapeWideStringForJSON(const uint16_t* str, unsigned len, StringBuilder* dst)
+{
+    escapeStringForJSONInternal<uint16_t>(str, len, dst);
+}
+
+{% for namespace in config.protocol.namespace %}
+} // namespace {{namespace}}
+{% endfor %}
diff --git a/deps/inspector_protocol/lib/Values_h.template b/deps/inspector_protocol/lib/Values_h.template
new file mode 100644
index 00000000000000..e8eb91d85ae69f
--- /dev/null
+++ b/deps/inspector_protocol/lib/Values_h.template
@@ -0,0 +1,248 @@
+// Copyright 2016 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef {{"_".join(config.protocol.namespace)}}_Values_h
+#define {{"_".join(config.protocol.namespace)}}_Values_h
+
+//#include "Allocator.h"
+//#include "Forward.h"
+
+{% for namespace in config.protocol.namespace %}
+namespace {{namespace}} {
+{% endfor %}
+
+class ListValue;
+class DictionaryValue;
+class Value;
+
+class {{config.lib.export_macro}} Value : public Serializable {
+    PROTOCOL_DISALLOW_COPY(Value);
+public:
+    virtual ~Value() override { }
+
+    static std::unique_ptr<Value> null()
+    {
+        return std::unique_ptr<Value>(new Value());
+    }
+
+    enum ValueType {
+        TypeNull = 0,
+        TypeBoolean,
+        TypeInteger,
+        TypeDouble,
+        TypeString,
+        TypeObject,
+        TypeArray,
+        TypeSerialized
+    };
+
+    ValueType type() const { return m_type; }
+
+    bool isNull() const { return m_type == TypeNull; }
+
+    virtual bool asBoolean(bool* output) const;
+    virtual bool asDouble(double* output) const;
+    virtual bool asInteger(int* output) const;
+    virtual bool asString(String* output) const;
+    virtual bool asSerialized(String* output) const;
+
+    virtual void writeJSON(StringBuilder* output) const;
+    virtual std::unique_ptr<Value> clone() const;
+    String serialize() override;
+
+protected:
+    Value() : m_type(TypeNull) { }
+    explicit Value(ValueType type) : m_type(type) { }
+
+private:
+    friend class DictionaryValue;
+    friend class ListValue;
+
+    ValueType m_type;
+};
+
+class {{config.lib.export_macro}} FundamentalValue : public Value {
+public:
+    static std::unique_ptr<FundamentalValue> create(bool value)
+    {
+        return std::unique_ptr<FundamentalValue>(new FundamentalValue(value));
+    }
+
+    static std::unique_ptr<FundamentalValue> create(int value)
+    {
+        return std::unique_ptr<FundamentalValue>(new FundamentalValue(value));
+    }
+
+    static std::unique_ptr<FundamentalValue> create(double value)
+    {
+        return std::unique_ptr<FundamentalValue>(new FundamentalValue(value));
+    }
+
+    bool asBoolean(bool* output) const override;
+    bool asDouble(double* output) const override;
+    bool asInteger(int* output) const override;
+    void writeJSON(StringBuilder* output) const override;
+    std::unique_ptr<Value> clone() const override;
+
+private:
+    explicit FundamentalValue(bool value) : Value(TypeBoolean), m_boolValue(value) { }
+    explicit FundamentalValue(int value) : Value(TypeInteger), m_integerValue(value) { }
+    explicit FundamentalValue(double value) : Value(TypeDouble), m_doubleValue(value) { }
+
+    union {
+        bool m_boolValue;
+        double m_doubleValue;
+        int m_integerValue;
+    };
+};
+
+class {{config.lib.export_macro}} StringValue : public Value {
+public:
+    static std::unique_ptr<StringValue> create(const String& value)
+    {
+        return std::unique_ptr<StringValue>(new StringValue(value));
+    }
+
+    static std::unique_ptr<StringValue> create(const char* value)
+    {
+        return std::unique_ptr<StringValue>(new StringValue(value));
+    }
+
+    bool asString(String* output) const override;
+    void writeJSON(StringBuilder* output) const override;
+    std::unique_ptr<Value> clone() const override;
+
+private:
+    explicit StringValue(const String& value) : Value(TypeString), m_stringValue(value) { }
+    explicit StringValue(const char* value) : Value(TypeString), m_stringValue(value) { }
+
+    String m_stringValue;
+};
+
+class {{config.lib.export_macro}} SerializedValue : public Value {
+public:
+    static std::unique_ptr<SerializedValue> create(const String& value)
+    {
+        return std::unique_ptr<SerializedValue>(new SerializedValue(value));
+    }
+
+    bool asSerialized(String* output) const override;
+    void writeJSON(StringBuilder* output) const override;
+    std::unique_ptr<Value> clone() const override;
+
+private:
+    explicit SerializedValue(const String& value) : Value(TypeSerialized), m_serializedValue(value) { }
+
+    String m_serializedValue;
+};
+
+class {{config.lib.export_macro}} DictionaryValue : public Value {
+public:
+    using Entry = std::pair<String, Value*>;
+    static std::unique_ptr<DictionaryValue> create()
+    {
+        return std::unique_ptr<DictionaryValue>(new DictionaryValue());
+    }
+
+    static DictionaryValue* cast(Value* value)
+    {
+        if (!value || value->type() != TypeObject)
+            return nullptr;
+        return static_cast<DictionaryValue*>(value);
+    }
+
+    static std::unique_ptr<DictionaryValue> cast(std::unique_ptr<Value> value)
+    {
+        return std::unique_ptr<DictionaryValue>(DictionaryValue::cast(value.release()));
+    }
+
+    void writeJSON(StringBuilder* output) const override;
+    std::unique_ptr<Value> clone() const override;
+
+    size_t size() const { return m_data.size(); }
+
+    void setBoolean(const String& name, bool);
+    void setInteger(const String& name, int);
+    void setDouble(const String& name, double);
+    void setString(const String& name, const String&);
+    void setValue(const String& name, std::unique_ptr<Value>);
+    void setObject(const String& name, std::unique_ptr<DictionaryValue>);
+    void setArray(const String& name, std::unique_ptr<ListValue>);
+
+    bool getBoolean(const String& name, bool* output) const;
+    bool getInteger(const String& name, int* output) const;
+    bool getDouble(const String& name, double* output) const;
+    bool getString(const String& name, String* output) const;
+
+    DictionaryValue* getObject(const String& name) const;
+    ListValue* getArray(const String& name) const;
+    Value* get(const String& name) const;
+    Entry at(size_t index) const;
+
+    bool booleanProperty(const String& name, bool defaultValue) const;
+    int integerProperty(const String& name, int defaultValue) const;
+    double doubleProperty(const String& name, double defaultValue) const;
+    void remove(const String& name);
+
+    ~DictionaryValue() override;
+
+private:
+    DictionaryValue();
+    template<typename T>
+    void set(const String& key, std::unique_ptr<T>& value)
+    {
+        DCHECK(value);
+        bool isNew = m_data.find(key) == m_data.end();
+        m_data[key] = std::move(value);
+        if (isNew)
+            m_order.push_back(key);
+    }
+
+    using Dictionary = std::unordered_map<String, std::unique_ptr<Value>>;
+    Dictionary m_data;
+    std::vector<String> m_order;
+};
+
+class {{config.lib.export_macro}} ListValue : public Value {
+public:
+    static std::unique_ptr<ListValue> create()
+    {
+        return std::unique_ptr<ListValue>(new ListValue());
+    }
+
+    static ListValue* cast(Value* value)
+    {
+        if (!value || value->type() != TypeArray)
+            return nullptr;
+        return static_cast<ListValue*>(value);
+    }
+
+    static std::unique_ptr<ListValue> cast(std::unique_ptr<Value> value)
+    {
+        return std::unique_ptr<ListValue>(ListValue::cast(value.release()));
+    }
+
+    ~ListValue() override;
+
+    void writeJSON(StringBuilder* output) const override;
+    std::unique_ptr<Value> clone() const override;
+
+    void pushValue(std::unique_ptr<Value>);
+
+    Value* at(size_t index);
+    size_t size() const { return m_data.size(); }
+
+private:
+    ListValue();
+    std::vector<std::unique_ptr<Value>> m_data;
+};
+
+void escapeLatinStringForJSON(const uint8_t* str, unsigned len, StringBuilder* dst);
+void escapeWideStringForJSON(const uint16_t* str, unsigned len, StringBuilder* dst);
+
+{% for namespace in config.protocol.namespace %}
+} // namespace {{namespace}}
+{% endfor %}
+
+#endif // {{"_".join(config.protocol.namespace)}}_Values_h
diff --git a/deps/inspector_protocol/pdl.py b/deps/inspector_protocol/pdl.py
new file mode 100644
index 00000000000000..c8a5c6f3102e5b
--- /dev/null
+++ b/deps/inspector_protocol/pdl.py
@@ -0,0 +1,167 @@
+# Copyright 2018 The Chromium Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+import collections
+import json
+import os.path
+import re
+import sys
+
+description = ''
+
+primitiveTypes = ['integer', 'number', 'boolean', 'string', 'object', 'any', 'array']
+
+
+def assignType(item, type, isArray=False):
+    if isArray:
+        item['type'] = 'array'
+        item['items'] = collections.OrderedDict()
+        assignType(item['items'], type)
+        return
+
+    if type == 'enum':
+        type = 'string'
+    if type in primitiveTypes:
+        item['type'] = type
+    else:
+        item['$ref'] = type
+
+
+def createItem(d, experimental, deprecated, name=None):
+    result = collections.OrderedDict(d)
+    if name:
+        result['name'] = name
+    global description
+    if description:
+        result['description'] = description.strip()
+    if experimental:
+        result['experimental'] = True
+    if deprecated:
+        result['deprecated'] = True
+    return result
+
+
+def parse(data, file_name):
+    protocol = collections.OrderedDict()
+    protocol['version'] = collections.OrderedDict()
+    protocol['domains'] = []
+    domain = None
+    item = None
+    subitems = None
+    nukeDescription = False
+    global description
+    lines = data.split('\n')
+    for i in range(0, len(lines)):
+        if nukeDescription:
+            description = ''
+            nukeDescription = False
+        line = lines[i]
+        trimLine = line.strip()
+
+        if trimLine.startswith('#'):
+            if len(description):
+              description += '\n'
+            description += trimLine[2:]
+            continue
+        else:
+            nukeDescription = True
+
+        if len(trimLine) == 0:
+            continue
+
+        match = re.compile('^(experimental )?(deprecated )?domain (.*)').match(line)
+        if match:
+            domain = createItem({'domain' : match.group(3)}, match.group(1), match.group(2))
+            protocol['domains'].append(domain)
+            continue
+
+        match = re.compile('^  depends on ([^\s]+)').match(line)
+        if match:
+            if 'dependencies' not in domain:
+                domain['dependencies'] = []
+            domain['dependencies'].append(match.group(1))
+            continue
+
+        match = re.compile('^  (experimental )?(deprecated )?type (.*) extends (array of )?([^\s]+)').match(line)
+        if match:
+            if 'types' not in domain:
+                domain['types'] = []
+            item = createItem({'id': match.group(3)}, match.group(1), match.group(2))
+            assignType(item, match.group(5), match.group(4))
+            domain['types'].append(item)
+            continue
+
+        match = re.compile('^  (experimental )?(deprecated )?(command|event) (.*)').match(line)
+        if match:
+            list = []
+            if match.group(3) == 'command':
+                if 'commands' in domain:
+                    list = domain['commands']
+                else:
+                    list = domain['commands'] = []
+            else:
+                if 'events' in domain:
+                    list = domain['events']
+                else:
+                    list = domain['events'] = []
+
+            item = createItem({}, match.group(1), match.group(2), match.group(4))
+            list.append(item)
+            continue
+
+        match = re.compile('^      (experimental )?(deprecated )?(optional )?(array of )?([^\s]+) ([^\s]+)').match(line)
+        if match:
+            param = createItem({}, match.group(1), match.group(2), match.group(6))
+            if match.group(3):
+                param['optional'] = True
+            assignType(param, match.group(5), match.group(4))
+            if match.group(5) == 'enum':
+                enumliterals = param['enum'] = []
+            subitems.append(param)
+            continue
+
+        match = re.compile('^    (parameters|returns|properties)').match(line)
+        if match:
+            subitems = item[match.group(1)] = []
+            continue
+
+        match = re.compile('^    enum').match(line)
+        if match:
+            enumliterals = item['enum'] = []
+            continue
+
+        match = re.compile('^version').match(line)
+        if match:
+            continue
+
+        match = re.compile('^  major (\d+)').match(line)
+        if match:
+            protocol['version']['major'] = match.group(1)
+            continue
+
+        match = re.compile('^  minor (\d+)').match(line)
+        if match:
+            protocol['version']['minor'] = match.group(1)
+            continue
+
+        match = re.compile('^    redirect ([^\s]+)').match(line)
+        if match:
+            item['redirect'] = match.group(1)
+            continue
+
+        match = re.compile('^      (  )?[^\s]+$').match(line)
+        if match:
+            # enum literal
+            enumliterals.append(trimLine)
+            continue
+
+        print 'Error in %s:%s, illegal token: \t%s' % (file_name, i, line)
+        sys.exit(1)
+    return protocol
+
+
+def loads(data, file_name):
+    if file_name.endswith(".pdl"):
+        return parse(data, file_name)
+    return json.loads(data)
diff --git a/deps/inspector_protocol/templates/Exported_h.template b/deps/inspector_protocol/templates/Exported_h.template
new file mode 100644
index 00000000000000..3d36ecffae3ca3
--- /dev/null
+++ b/deps/inspector_protocol/templates/Exported_h.template
@@ -0,0 +1,65 @@
+// This file is generated
+
+// Copyright (c) 2016 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef {{"_".join(config.protocol.namespace)}}_{{domain.domain}}_api_h
+#define {{"_".join(config.protocol.namespace)}}_{{domain.domain}}_api_h
+
+{% if config.exported.export_header %}
+#include {{format_include(config.exported.export_header)}}
+{% endif %}
+#include {{format_include(config.exported.string_header)}}
+
+{% for namespace in config.protocol.namespace %}
+namespace {{namespace}} {
+{% endfor %}
+namespace {{domain.domain}} {
+namespace API {
+
+// ------------- Enums.
+  {% for type in domain.types %}
+    {% if ("enum" in type) and protocol.is_exported(domain.domain, type.id) %}
+
+namespace {{type.id}}Enum {
+      {% for literal in type.enum %}
+{{config.exported.export_macro}} extern const char* {{ literal | dash_to_camelcase}};
+      {% endfor %}
+} // {{type.id}}Enum
+    {% endif %}
+  {% endfor %}
+  {% for command in join_arrays(domain, ["commands", "events"]) %}
+    {% for param in join_arrays(command, ["parameters", "returns"]) %}
+      {% if ("enum" in param) and protocol.is_exported(domain.domain, command.name + "." + param.name) %}
+
+namespace {{command.name | to_title_case}} {
+namespace {{param.name | to_title_case}}Enum {
+        {% for literal in param.enum %}
+{{config.exported.export_macro}} extern const char* {{ literal | dash_to_camelcase}};
+        {% endfor %}
+} // {{param.name | to_title_case}}Enum
+} // {{command.name | to_title_case }}
+      {% endif %}
+    {% endfor %}
+  {% endfor %}
+
+// ------------- Types.
+  {% for type in domain.types %}
+    {% if not (type.type == "object") or not ("properties" in type) or not protocol.is_exported(domain.domain, type.id) %}{% continue %}{% endif %}
+
+class {{config.exported.export_macro}} {{type.id}} {
+public:
+    virtual {{config.exported.string_out}} toJSONString() const = 0;
+    virtual ~{{type.id}}() { }
+    static std::unique_ptr<protocol::{{domain.domain}}::API::{{type.id}}> fromJSONString(const {{config.exported.string_in}}& json);
+};
+  {% endfor %}
+
+} // namespace API
+} // namespace {{domain.domain}}
+{% for namespace in config.protocol.namespace %}
+} // namespace {{namespace}}
+{% endfor %}
+
+#endif // !defined({{"_".join(config.protocol.namespace)}}_{{domain.domain}}_api_h)
diff --git a/deps/inspector_protocol/templates/Imported_h.template b/deps/inspector_protocol/templates/Imported_h.template
new file mode 100644
index 00000000000000..4c9d24bd5fccf7
--- /dev/null
+++ b/deps/inspector_protocol/templates/Imported_h.template
@@ -0,0 +1,55 @@
+// This file is generated
+
+// Copyright (c) 2016 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef {{"_".join(config.protocol.namespace)}}_{{domain.domain}}_imported_h
+#define {{"_".join(config.protocol.namespace)}}_{{domain.domain}}_imported_h
+
+#include {{format_include(config.protocol.package, "Protocol")}}
+{% if config.imported.header %}
+#include {{format_include(config.imported.header)}}
+{% else %}
+#include {{format_include(config.imported.package, domain.domain)}}
+{% endif %}
+
+{% for namespace in config.protocol.namespace %}
+namespace {{namespace}} {
+{% endfor %}
+  {% for type in domain.types %}
+    {% if not (type.type == "object") or not ("properties" in type) or not protocol.is_imported(domain.domain, type.id) %}{% continue %}{% endif %}
+
+template<>
+struct ValueConversions<{{"::".join(config.imported.namespace)}}::{{domain.domain}}::API::{{type.id}}> {
+    static std::unique_ptr<{{"::".join(config.imported.namespace)}}::{{domain.domain}}::API::{{type.id}}> fromValue(protocol::Value* value, ErrorSupport* errors)
+    {
+        if (!value) {
+            errors->addError("value expected");
+            return nullptr;
+        }
+        String json = value->serialize();
+        auto result = {{"::".join(config.imported.namespace)}}::{{domain.domain}}::API::{{type.id}}::fromJSONString({{config.imported.to_imported_string % "json"}});
+        if (!result)
+            errors->addError("cannot parse");
+        return result;
+    }
+
+    static std::unique_ptr<protocol::Value> toValue(const {{"::".join(config.imported.namespace)}}::{{domain.domain}}::API::{{type.id}}* value)
+    {
+        auto json = value->toJSONString();
+        return SerializedValue::create({{config.imported.from_imported_string % "std::move(json)"}});
+    }
+
+    static std::unique_ptr<protocol::Value> toValue(const std::unique_ptr<{{"::".join(config.imported.namespace)}}::{{domain.domain}}::API::{{type.id}}>& value)
+    {
+        return toValue(value.get());
+    }
+};
+  {% endfor %}
+
+{% for namespace in config.protocol.namespace %}
+} // namespace {{namespace}}
+{% endfor %}
+
+#endif // !defined({{"_".join(config.protocol.namespace)}}_{{domain.domain}}_imported_h)
diff --git a/deps/inspector_protocol/templates/TypeBuilder_cpp.template b/deps/inspector_protocol/templates/TypeBuilder_cpp.template
new file mode 100644
index 00000000000000..aa448d2a192a4f
--- /dev/null
+++ b/deps/inspector_protocol/templates/TypeBuilder_cpp.template
@@ -0,0 +1,397 @@
+// This file is generated
+
+// Copyright (c) 2016 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include {{format_domain_include(config.protocol.package, domain.domain)}}
+
+#include {{format_include(config.protocol.package, "Protocol")}}
+
+{% for namespace in config.protocol.namespace %}
+namespace {{namespace}} {
+{% endfor %}
+namespace {{domain.domain}} {
+
+// ------------- Enum values from types.
+
+const char Metainfo::domainName[] = "{{domain.domain}}";
+const char Metainfo::commandPrefix[] = "{{domain.domain}}.";
+const char Metainfo::version[] = "{{domain.version}}";
+  {% for type in domain.types %}
+    {% if not protocol.generate_type(domain.domain, type.id) %}{% continue %} {% endif %}
+    {% if "enum" in type %}
+
+namespace {{type.id}}Enum {
+      {% for literal in type.enum %}
+const char {{ literal | dash_to_camelcase}}[] = "{{literal}}";
+      {% endfor %}
+} // namespace {{type.id}}Enum
+      {% if protocol.is_exported(domain.domain, type.id) %}
+
+namespace API {
+namespace {{type.id}}Enum {
+        {% for literal in type.enum %}
+const char* {{ literal | dash_to_camelcase}} = "{{literal}}";
+        {% endfor %}
+} // namespace {{type.id}}Enum
+} // namespace API
+      {% endif %}
+    {% endif %}
+    {% for property in type.properties %}
+      {% if "enum" in property %}
+
+        {% for literal in property.enum %}
+const char* {{type.id}}::{{property.name | to_title_case}}Enum::{{literal | dash_to_camelcase}} = "{{literal}}";
+        {% endfor %}
+      {% endif %}
+    {% endfor %}
+    {% if not (type.type == "object") or not ("properties" in type) %}{% continue %}{% endif %}
+
+std::unique_ptr<{{type.id}}> {{type.id}}::fromValue(protocol::Value* value, ErrorSupport* errors)
+{
+    if (!value || value->type() != protocol::Value::TypeObject) {
+        errors->addError("object expected");
+        return nullptr;
+    }
+
+    std::unique_ptr<{{type.id}}> result(new {{type.id}}());
+    protocol::DictionaryValue* object = DictionaryValue::cast(value);
+    errors->push();
+    {% for property in type.properties %}
+    protocol::Value* {{property.name}}Value = object->get("{{property.name}}");
+      {% if property.optional %}
+    if ({{property.name}}Value) {
+        errors->setName("{{property.name}}");
+        result->m_{{property.name}} = ValueConversions<{{protocol.resolve_type(property).raw_type}}>::fromValue({{property.name}}Value, errors);
+    }
+      {% else %}
+    errors->setName("{{property.name}}");
+    result->m_{{property.name}} = ValueConversions<{{protocol.resolve_type(property).raw_type}}>::fromValue({{property.name}}Value, errors);
+      {% endif %}
+    {% endfor %}
+    errors->pop();
+    if (errors->hasErrors())
+        return nullptr;
+    return result;
+}
+
+std::unique_ptr<protocol::DictionaryValue> {{type.id}}::toValue() const
+{
+    std::unique_ptr<protocol::DictionaryValue> result = DictionaryValue::create();
+    {% for property in type.properties %}
+      {% set property_type = protocol.resolve_type(property) %}
+      {% set property_field = "m_" + property.name %}
+      {% if property.optional %}
+    if ({{property_field}}.isJust())
+        result->setValue("{{property.name}}", ValueConversions<{{property_type.raw_type}}>::toValue({{property_field}}.fromJust()));
+      {% else %}
+    result->setValue("{{property.name}}", ValueConversions<{{property_type.raw_type}}>::toValue({{property_type.to_raw_type % property_field}}));
+      {% endif %}
+    {% endfor %}
+    return result;
+}
+
+std::unique_ptr<{{type.id}}> {{type.id}}::clone() const
+{
+    ErrorSupport errors;
+    return fromValue(toValue().get(), &errors);
+}
+    {% if protocol.is_exported(domain.domain, type.id) %}
+
+{{config.exported.string_out}} {{type.id}}::toJSONString() const
+{
+    String json = toValue()->serialize();
+    return {{config.exported.to_string_out % "json"}};
+}
+
+// static
+std::unique_ptr<API::{{type.id}}> API::{{type.id}}::fromJSONString(const {{config.exported.string_in}}& json)
+{
+    ErrorSupport errors;
+    std::unique_ptr<Value> value = StringUtil::parseJSON(json);
+    if (!value)
+        return nullptr;
+    return protocol::{{domain.domain}}::{{type.id}}::fromValue(value.get(), &errors);
+}
+    {% endif %}
+  {% endfor %}
+
+// ------------- Enum values from params.
+
+  {% for command in join_arrays(domain, ["commands", "events"]) %}
+    {% for param in join_arrays(command, ["parameters", "returns"]) %}
+      {% if "enum" in param %}
+
+namespace {{command.name | to_title_case}} {
+namespace {{param.name | to_title_case}}Enum {
+        {% for literal in param.enum %}
+const char* {{ literal | to_title_case}} = "{{literal}}";
+        {% endfor %}
+} // namespace {{param.name | to_title_case}}Enum
+} // namespace {{command.name | to_title_case }}
+        {% if protocol.is_exported(domain.domain, command.name + "." + param.name) %}
+
+namespace API {
+namespace {{command.name | to_title_case}} {
+namespace {{param.name | to_title_case}}Enum {
+        {% for literal in param.enum %}
+const char* {{ literal | to_title_case}} = "{{literal}}";
+        {% endfor %}
+} // namespace {{param.name | to_title_case}}Enum
+} // namespace {{command.name | to_title_case }}
+} // namespace API
+        {% endif %}
+      {% endif %}
+    {% endfor %}
+  {% endfor %}
+
+// ------------- Frontend notifications.
+  {% for event in domain.events %}
+    {% if not protocol.generate_event(domain.domain, event.name) %}{% continue %}{% endif %}
+
+void Frontend::{{event.name | to_method_case}}(
+    {%- for parameter in event.parameters %}
+      {% if "optional" in parameter -%}
+        Maybe<{{protocol.resolve_type(parameter).raw_type}}>
+      {%- else -%}
+        {{protocol.resolve_type(parameter).pass_type}}
+      {%- endif %} {{parameter.name}}{%- if not loop.last -%}, {% endif -%}
+    {% endfor -%})
+{
+    if (!m_frontendChannel)
+        return;
+      {% if event.parameters %}
+    std::unique_ptr<{{event.name | to_title_case}}Notification> messageData = {{event.name | to_title_case}}Notification::{{"create" | to_method_case}}()
+        {% for parameter in event.parameters %}
+          {% if not "optional" in parameter %}
+        .{{"set" | to_method_case}}{{parameter.name | to_title_case}}({{protocol.resolve_type(parameter).to_pass_type % parameter.name}})
+          {% endif %}
+        {% endfor %}
+        .{{ "build" | to_method_case }}();
+        {% for parameter in event.parameters %}
+          {% if "optional" in parameter %}
+    if ({{parameter.name}}.isJust())
+        messageData->{{"set" | to_method_case}}{{parameter.name | to_title_case}}(std::move({{parameter.name}}).takeJust());
+          {% endif %}
+        {% endfor %}
+    m_frontendChannel->sendProtocolNotification(InternalResponse::createNotification("{{domain.domain}}.{{event.name}}", std::move(messageData)));
+      {% else %}
+    m_frontendChannel->sendProtocolNotification(InternalResponse::createNotification("{{domain.domain}}.{{event.name}}"));
+      {% endif %}
+}
+  {% endfor %}
+
+void Frontend::flush()
+{
+    m_frontendChannel->flushProtocolNotifications();
+}
+
+void Frontend::sendRawNotification(const String& notification)
+{
+    m_frontendChannel->sendProtocolNotification(InternalRawNotification::create(notification));
+}
+
+// --------------------- Dispatcher.
+
+class DispatcherImpl : public protocol::DispatcherBase {
+public:
+    DispatcherImpl(FrontendChannel* frontendChannel, Backend* backend, bool fallThroughForNotFound)
+        : DispatcherBase(frontendChannel)
+        , m_backend(backend)
+        , m_fallThroughForNotFound(fallThroughForNotFound) {
+  {% for command in domain.commands %}
+    {% if "redirect" in command %}
+      m_redirects["{{domain.domain}}.{{command.name}}"] = "{{command.redirect}}.{{command.name}}";
+      {% continue %}
+    {% endif %}
+    {% if not protocol.generate_command(domain.domain, command.name) %}{% continue %}{% endif %}
+        m_dispatchMap["{{domain.domain}}.{{command.name}}"] = &DispatcherImpl::{{command.name}};
+  {% endfor %}
+    }
+    ~DispatcherImpl() override { }
+    DispatchResponse::Status dispatch(int callId, const String& method, std::unique_ptr<protocol::DictionaryValue> messageObject) override;
+    std::unordered_map<String, String>& redirects() { return m_redirects; }
+
+protected:
+    using CallHandler = DispatchResponse::Status (DispatcherImpl::*)(int callId, std::unique_ptr<DictionaryValue> messageObject, ErrorSupport* errors);
+    using DispatchMap = std::unordered_map<String, CallHandler>;
+    DispatchMap m_dispatchMap;
+    std::unordered_map<String, String> m_redirects;
+
+  {% for command in domain.commands %}
+    {% if "redirect" in command %}{% continue %}{% endif %}
+    {% if not protocol.generate_command(domain.domain, command.name) %}{% continue %}{% endif %}
+    DispatchResponse::Status {{command.name}}(int callId, std::unique_ptr<DictionaryValue> requestMessageObject, ErrorSupport*);
+  {% endfor %}
+
+    Backend* m_backend;
+    bool m_fallThroughForNotFound;
+};
+
+DispatchResponse::Status DispatcherImpl::dispatch(int callId, const String& method, std::unique_ptr<protocol::DictionaryValue> messageObject)
+{
+    std::unordered_map<String, CallHandler>::iterator it = m_dispatchMap.find(method);
+    if (it == m_dispatchMap.end()) {
+        if (m_fallThroughForNotFound)
+            return DispatchResponse::kFallThrough;
+        reportProtocolError(callId, DispatchResponse::kMethodNotFound, "'" + method + "' wasn't found", nullptr);
+        return DispatchResponse::kError;
+    }
+
+    protocol::ErrorSupport errors;
+    return (this->*(it->second))(callId, std::move(messageObject), &errors);
+}
+
+  {% for command in domain.commands %}
+    {% set command_name_title = command.name | to_title_case %}
+    {% if "redirect" in command %}{% continue %}{% endif %}
+    {% if not protocol.generate_command(domain.domain, command.name) %}{% continue %}{% endif %}
+    {% if protocol.is_async_command(domain.domain, command.name) %}
+
+class {{command_name_title}}CallbackImpl : public Backend::{{command_name_title}}Callback, public DispatcherBase::Callback {
+public:
+    {{command_name_title}}CallbackImpl(std::unique_ptr<DispatcherBase::WeakPtr> backendImpl, int callId, int callbackId)
+        : DispatcherBase::Callback(std::move(backendImpl), callId, callbackId) { }
+
+    void sendSuccess(
+      {%- for parameter in command.returns -%}
+        {%- if "optional" in parameter -%}
+        Maybe<{{protocol.resolve_type(parameter).raw_type}}> {{parameter.name}}
+        {%- else -%}
+        {{protocol.resolve_type(parameter).pass_type}} {{parameter.name}}
+        {%- endif -%}
+        {%- if not loop.last -%}, {% endif -%}
+      {%- endfor -%}) override
+    {
+        std::unique_ptr<protocol::DictionaryValue> resultObject = DictionaryValue::create();
+          {% for parameter in command.returns %}
+            {% if "optional" in parameter %}
+        if ({{parameter.name}}.isJust())
+            resultObject->setValue("{{parameter.name}}", ValueConversions<{{protocol.resolve_type(parameter).raw_type}}>::toValue({{parameter.name}}.fromJust()));
+           {% else %}
+        resultObject->setValue("{{parameter.name}}", ValueConversions<{{protocol.resolve_type(parameter).raw_type}}>::toValue({{protocol.resolve_type(parameter).to_raw_type % parameter.name}}));
+            {% endif %}
+          {% endfor %}
+        sendIfActive(std::move(resultObject), DispatchResponse::OK());
+    }
+
+    void fallThrough() override
+    {
+        fallThroughIfActive();
+    }
+
+    void sendFailure(const DispatchResponse& response) override
+    {
+        DCHECK(response.status() == DispatchResponse::kError);
+        sendIfActive(nullptr, response);
+    }
+};
+    {% endif %}
+
+DispatchResponse::Status DispatcherImpl::{{command.name}}(int callId, std::unique_ptr<DictionaryValue> requestMessageObject, ErrorSupport* errors)
+{
+    {% if "parameters" in command %}
+    // Prepare input parameters.
+    protocol::DictionaryValue* object = DictionaryValue::cast(requestMessageObject->get("params"));
+    errors->push();
+      {% for parameter in command.parameters %}
+        {% set parameter_type = protocol.resolve_type(parameter) %}
+    protocol::Value* {{parameter.name}}Value = object ? object->get("{{parameter.name}}") : nullptr;
+        {% if parameter.optional %}
+    Maybe<{{parameter_type.raw_type}}> in_{{parameter.name}};
+    if ({{parameter.name}}Value) {
+        errors->setName("{{parameter.name}}");
+        in_{{parameter.name}} = ValueConversions<{{parameter_type.raw_type}}>::fromValue({{parameter.name}}Value, errors);
+    }
+        {% else %}
+    errors->setName("{{parameter.name}}");
+    {{parameter_type.type}} in_{{parameter.name}} = ValueConversions<{{parameter_type.raw_type}}>::fromValue({{parameter.name}}Value, errors);
+        {% endif %}
+      {% endfor %}
+    errors->pop();
+    if (errors->hasErrors()) {
+        reportProtocolError(callId, DispatchResponse::kInvalidParams, kInvalidParamsString, errors);
+        return DispatchResponse::kError;
+    }
+    {% endif %}
+    {% if "returns" in command and not protocol.is_async_command(domain.domain, command.name) %}
+    // Declare output parameters.
+      {% for parameter in command.returns %}
+        {% if "optional" in parameter %}
+    Maybe<{{protocol.resolve_type(parameter).raw_type}}> out_{{parameter.name}};
+        {% else %}
+    {{protocol.resolve_type(parameter).type}} out_{{parameter.name}};
+        {% endif %}
+      {% endfor %}
+    {% endif %}
+
+    {% if not protocol.is_async_command(domain.domain, command.name) %}
+    std::unique_ptr<DispatcherBase::WeakPtr> weak = weakPtr();
+    DispatchResponse response = m_backend->{{command.name | to_method_case}}(
+      {%- for parameter in command.parameters -%}
+        {%- if not loop.first -%}, {% endif -%}
+        {%- if "optional" in parameter -%}
+        std::move(in_{{parameter.name}})
+        {%- else -%}
+        {{protocol.resolve_type(parameter).to_pass_type % ("in_" + parameter.name)}}
+        {%- endif -%}
+      {%- endfor %}
+      {%- if "returns" in command %}
+        {%- for parameter in command.returns -%}
+          {%- if not loop.first or command.parameters -%}, {% endif -%}
+          &out_{{parameter.name}}
+        {%- endfor %}
+      {% endif %});
+    if (response.status() == DispatchResponse::kFallThrough)
+        return response.status();
+      {% if "returns" in command %}
+    std::unique_ptr<protocol::DictionaryValue> result = DictionaryValue::create();
+    if (response.status() == DispatchResponse::kSuccess) {
+        {% for parameter in command.returns %}
+          {% if "optional" in parameter %}
+        if (out_{{parameter.name}}.isJust())
+            result->setValue("{{parameter.name}}", ValueConversions<{{protocol.resolve_type(parameter).raw_type}}>::toValue(out_{{parameter.name}}.fromJust()));
+          {% else %}
+        result->setValue("{{parameter.name}}", ValueConversions<{{protocol.resolve_type(parameter).raw_type}}>::toValue({{protocol.resolve_type(parameter).to_raw_type % ("out_" + parameter.name)}}));
+          {% endif %}
+        {% endfor %}
+    }
+    if (weak->get())
+        weak->get()->sendResponse(callId, response, std::move(result));
+      {% else %}
+    if (weak->get())
+        weak->get()->sendResponse(callId, response);
+      {% endif %}
+    return response.status();
+    {% else %}
+    std::unique_ptr<DispatcherBase::WeakPtr> weak = weakPtr();
+    std::unique_ptr<{{command_name_title}}CallbackImpl> callback(new {{command.name | to_title_case}}CallbackImpl(weakPtr(), callId, nextCallbackId()));
+    m_backend->{{command.name | to_method_case}}(
+      {%- for property in command.parameters -%}
+        {%- if not loop.first -%}, {% endif -%}
+        {%- if "optional" in property -%}
+        std::move(in_{{property.name}})
+        {%- else -%}
+        {{protocol.resolve_type(property).to_pass_type % ("in_" + property.name)}}
+        {%- endif -%}
+      {%- endfor -%}
+        {%- if command.parameters -%}, {% endif -%}
+        std::move(callback));
+    return (weak->get() && weak->get()->lastCallbackFallThrough()) ? DispatchResponse::kFallThrough : DispatchResponse::kAsync;
+    {% endif %}
+}
+  {% endfor %}
+
+// static
+void Dispatcher::wire(UberDispatcher* uber, Backend* backend)
+{
+    std::unique_ptr<DispatcherImpl> dispatcher(new DispatcherImpl(uber->channel(), backend, uber->fallThroughForNotFound()));
+    uber->setupRedirects(dispatcher->redirects());
+    uber->registerBackend("{{domain.domain}}", std::move(dispatcher));
+}
+
+} // {{domain.domain}}
+{% for namespace in config.protocol.namespace %}
+} // namespace {{namespace}}
+{% endfor %}
diff --git a/deps/inspector_protocol/templates/TypeBuilder_h.template b/deps/inspector_protocol/templates/TypeBuilder_h.template
new file mode 100644
index 00000000000000..291b2a75425a16
--- /dev/null
+++ b/deps/inspector_protocol/templates/TypeBuilder_h.template
@@ -0,0 +1,301 @@
+// This file is generated
+
+// Copyright (c) 2016 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef {{"_".join(config.protocol.namespace)}}_{{domain.domain}}_h
+#define {{"_".join(config.protocol.namespace)}}_{{domain.domain}}_h
+
+{% if config.protocol.export_header %}
+#include {{format_include(config.protocol.export_header)}}
+{% endif %}
+#include {{format_include(config.protocol.package, "Protocol")}}
+// For each imported domain we generate a ValueConversions struct instead of a full domain definition
+// and include Domain::API version from there.
+{% for name in domain.dependencies %}
+  {% if protocol.is_imported_dependency(name) %}
+#include {{format_domain_include(config.protocol.package, name)}}
+  {% endif %}
+{% endfor %}
+{% if protocol.is_exported_domain(domain.domain) %}
+#include {{format_include(config.exported.package, domain.domain)}}
+{% endif %}
+
+{% for namespace in config.protocol.namespace %}
+namespace {{namespace}} {
+{% endfor %}
+namespace {{domain.domain}} {
+
+// ------------- Forward and enum declarations.
+  {% for type in domain.types %}
+    {% if not protocol.generate_type(domain.domain, type.id) %}{% continue %}{% endif %}
+    {% if type.type == "object" %}
+      {% if "properties" in type %}
+class {{type.id}};
+      {% else %}
+using {{type.id}} = Object;
+      {% endif %}
+    {% elif type.type != "array" %}
+using {{type.id}} = {{protocol.resolve_type(type).type}};
+    {% endif %}
+  {% endfor %}
+  {% for type in domain.types %}
+    {% if not protocol.generate_type(domain.domain, type.id) %}{% continue %}{% endif %}
+    {% if "enum" in type %}
+
+namespace {{type.id}}Enum {
+      {% for literal in type.enum %}
+{{config.protocol.export_macro}} extern const char {{ literal | dash_to_camelcase}}[];
+      {% endfor %}
+} // namespace {{type.id}}Enum
+    {% endif %}
+  {% endfor %}
+  {% for command in join_arrays(domain, ["commands", "events"]) %}
+    {% for param in join_arrays(command, ["parameters", "returns"]) %}
+      {% if "enum" in param %}
+
+namespace {{command.name | to_title_case}} {
+namespace {{param.name | to_title_case}}Enum {
+        {% for literal in param.enum %}
+{{config.protocol.export_macro}} extern const char* {{literal | dash_to_camelcase}};
+        {% endfor %}
+} // {{param.name | to_title_case}}Enum
+} // {{command.name | to_title_case }}
+      {% endif %}
+    {% endfor %}
+  {% endfor %}
+
+// ------------- Type and builder declarations.
+  {% for type in domain.types %}
+    {% if not protocol.generate_type(domain.domain, type.id) %}{% continue %}{% endif %}
+    {% if not (type.type == "object") or not ("properties" in type) %}{% continue %}{% endif %}
+
+class {{config.protocol.export_macro}} {{type.id}} : public Serializable{% if protocol.is_exported(domain.domain, type.id) %}, public API::{{type.id}}{% endif %}{
+    PROTOCOL_DISALLOW_COPY({{type.id}});
+public:
+    static std::unique_ptr<{{type.id}}> fromValue(protocol::Value* value, ErrorSupport* errors);
+
+    ~{{type.id}}() override { }
+    {% for property in type.properties %}
+      {% set property_type = protocol.resolve_type(property) %}
+      {% set property_name = property.name | to_title_case %}
+      {% set property_field = "m_" + property.name %}
+      {% if "enum" in property %}
+
+    struct {{config.protocol.export_macro}} {{property_name}}Enum {
+        {% for literal in property.enum %}
+        static const char* {{literal | dash_to_camelcase}};
+        {% endfor %}
+    }; // {{property_name}}Enum
+      {% endif %}
+
+      {% if property.optional %}
+    bool {{"has" | to_method_case}}{{property_name}}() { return {{property_field}}.isJust(); }
+    {{property_type.raw_return_type}} {{"get" | to_method_case}}{{property_name}}({{property_type.raw_pass_type}} defaultValue) { return {{property_field}}.isJust() ? {{property_field}}.fromJust() : defaultValue; }
+      {% else %}
+    {{property_type.raw_return_type}} {{"get" | to_method_case}}{{property_name}}() { return {{property_type.to_raw_type % property_field}}; }
+      {% endif %}
+    void {{"set" | to_method_case}}{{property_name}}({{property_type.pass_type}} value) { {{property_field}} = {{property_type.to_rvalue % "value"}}; }
+    {% endfor %}
+
+    std::unique_ptr<protocol::DictionaryValue> toValue() const;
+    String serialize() override { return toValue()->serialize(); }
+    std::unique_ptr<{{type.id}}> clone() const;
+    {% if protocol.is_exported(domain.domain, type.id) %}
+    {{config.exported.string_out}} toJSONString() const override;
+    {% endif %}
+
+    template<int STATE>
+    class {{type.id}}Builder {
+    public:
+        enum {
+            NoFieldsSet = 0,
+    {% for property in type.properties|rejectattr("optional") %}
+            {{property.name | to_title_case}}Set = 1 << {{loop.index}},
+    {% endfor %}
+            AllFieldsSet = (
+    {%- for property in type.properties %}
+      {% if not(property.optional) %}{{property.name | to_title_case}}Set | {%endif %}
+    {% endfor %}0)};
+
+    {% for property in type.properties %}
+      {% set property_type = protocol.resolve_type(property) %}
+      {% set property_name = property.name | to_title_case %}
+
+      {% if property.optional %}
+        {{type.id}}Builder<STATE>& {{"set" | to_method_case}}{{property_name}}({{property_type.pass_type}} value)
+        {
+            m_result->{{"set" | to_method_case}}{{property_name}}({{property_type.to_rvalue % "value"}});
+            return *this;
+        }
+      {% else %}
+        {{type.id}}Builder<STATE | {{property_name}}Set>& {{"set" | to_method_case}}{{property_name}}({{property_type.pass_type}} value)
+        {
+            static_assert(!(STATE & {{property_name}}Set), "property {{property.name}} should not be set yet");
+            m_result->{{"set" | to_method_case}}{{property_name}}({{property_type.to_rvalue % "value"}});
+            return castState<{{property_name}}Set>();
+        }
+      {% endif %}
+    {% endfor %}
+
+        std::unique_ptr<{{type.id}}> {{"build" | to_method_case}}()
+        {
+            static_assert(STATE == AllFieldsSet, "state should be AllFieldsSet");
+            return std::move(m_result);
+        }
+
+    private:
+        friend class {{type.id}};
+        {{type.id}}Builder() : m_result(new {{type.id}}()) { }
+
+        template<int STEP> {{type.id}}Builder<STATE | STEP>& castState()
+        {
+            return *reinterpret_cast<{{type.id}}Builder<STATE | STEP>*>(this);
+        }
+
+        {{protocol.type_definition(domain.domain + "." + type.id).type}} m_result;
+    };
+
+    static {{type.id}}Builder<0> {{"create" | to_method_case}}()
+    {
+        return {{type.id}}Builder<0>();
+    }
+
+private:
+    {{type.id}}()
+    {
+    {% for property in type.properties %}
+      {% if not(property.optional) and "default_value" in protocol.resolve_type(property) %}
+          m_{{property.name}} = {{protocol.resolve_type(property).default_value}};
+      {%endif %}
+    {% endfor %}
+    }
+
+    {% for property in type.properties %}
+      {% if property.optional %}
+    Maybe<{{protocol.resolve_type(property).raw_type}}> m_{{property.name}};
+      {% else %}
+    {{protocol.resolve_type(property).type}} m_{{property.name}};
+      {% endif %}
+    {% endfor %}
+};
+
+  {% endfor %}
+
+// ------------- Backend interface.
+
+class {{config.protocol.export_macro}} Backend {
+public:
+    virtual ~Backend() { }
+
+  {% for command in domain.commands %}
+    {% if "redirect" in command %}{% continue %}{% endif %}
+    {% if not protocol.generate_command(domain.domain, command.name) %}{% continue %}{% endif %}
+    {% if protocol.is_async_command(domain.domain, command.name) %}
+    class {{config.protocol.export_macro}} {{command.name | to_title_case}}Callback {
+    public:
+        virtual void sendSuccess(
+      {%- for parameter in command.returns -%}
+        {%- if "optional" in parameter -%}
+            Maybe<{{protocol.resolve_type(parameter).raw_type}}> {{parameter.name}}
+        {%- else -%}
+                {{protocol.resolve_type(parameter).pass_type}} {{parameter.name}}
+        {%- endif -%}
+        {%- if not loop.last -%}, {% endif -%}
+      {%- endfor -%}
+        ) = 0;
+        virtual void sendFailure(const DispatchResponse&) = 0;
+        virtual void fallThrough() = 0;
+        virtual ~{{command.name | to_title_case}}Callback() { }
+    };
+    {% endif %}
+    {%- if not protocol.is_async_command(domain.domain, command.name) %}
+    virtual DispatchResponse {{command.name | to_method_case}}(
+    {%- else %}
+    virtual void {{command.name | to_method_case}}(
+    {%- endif %}
+    {%- for parameter in command.parameters -%}
+      {%- if not loop.first -%}, {% endif -%}
+      {%- if "optional" in parameter -%}
+        Maybe<{{protocol.resolve_type(parameter).raw_type}}> in_{{parameter.name}}
+      {%- else -%}
+        {{protocol.resolve_type(parameter).pass_type}} in_{{parameter.name}}
+      {%- endif -%}
+    {%- endfor -%}
+    {%- if protocol.is_async_command(domain.domain, command.name) -%}
+      {%- if command.parameters -%}, {% endif -%}
+        std::unique_ptr<{{command.name | to_title_case}}Callback> callback
+    {%- else -%}
+      {%- for parameter in command.returns -%}
+        {%- if (not loop.first) or command.parameters -%}, {% endif -%}
+        {%- if "optional" in parameter -%}
+        Maybe<{{protocol.resolve_type(parameter).raw_type}}>* out_{{parameter.name}}
+        {%- else -%}
+        {{protocol.resolve_type(parameter).type}}* out_{{parameter.name}}
+        {%- endif -%}
+      {%- endfor -%}
+    {%- endif -%}
+    ) = 0;
+  {% endfor %}
+
+  {% if protocol.generate_disable(domain) %}
+    virtual DispatchResponse {{"disable" | to_method_case}}()
+    {
+        return DispatchResponse::OK();
+    }
+  {% endif %}
+};
+
+// ------------- Frontend interface.
+
+class {{config.protocol.export_macro}} Frontend {
+public:
+    explicit Frontend(FrontendChannel* frontendChannel) : m_frontendChannel(frontendChannel) { }
+  {% for event in domain.events %}
+    {% if not protocol.generate_event(domain.domain, event.name) %}{% continue %}{% endif %}
+    void {{event.name | to_method_case}}(
+    {%- for parameter in event.parameters -%}
+      {%- if "optional" in parameter -%}
+        Maybe<{{protocol.resolve_type(parameter).raw_type}}> {{parameter.name}} = Maybe<{{protocol.resolve_type(parameter).raw_type}}>()
+      {%- else -%}
+        {{protocol.resolve_type(parameter).pass_type}} {{parameter.name}}
+      {%- endif -%}{%- if not loop.last -%}, {% endif -%}
+    {%- endfor -%}
+    );
+  {% endfor %}
+
+    void flush();
+    void sendRawNotification(const String&);
+private:
+    FrontendChannel* m_frontendChannel;
+};
+
+// ------------- Dispatcher.
+
+class {{config.protocol.export_macro}} Dispatcher {
+public:
+    static void wire(UberDispatcher*, Backend*);
+
+private:
+    Dispatcher() { }
+};
+
+// ------------- Metainfo.
+
+class {{config.protocol.export_macro}} Metainfo {
+public:
+    using BackendClass = Backend;
+    using FrontendClass = Frontend;
+    using DispatcherClass = Dispatcher;
+    static const char domainName[];
+    static const char commandPrefix[];
+    static const char version[];
+};
+
+} // namespace {{domain.domain}}
+{% for namespace in config.protocol.namespace %}
+} // namespace {{namespace}}
+{% endfor %}
+
+#endif // !defined({{"_".join(config.protocol.namespace)}}_{{domain.domain}}_h)
diff --git a/deps/jinja2/AUTHORS b/deps/jinja2/AUTHORS
new file mode 100644
index 00000000000000..fd6dbfcbfd8fe2
--- /dev/null
+++ b/deps/jinja2/AUTHORS
@@ -0,0 +1,34 @@
+Jinja is written and maintained by the Jinja Team and various
+contributors:
+
+Lead Developer:
+
+- Armin Ronacher <armin.ronacher@active-4.com>
+
+Developers:
+
+- Christoph Hack
+- Georg Brandl
+
+Contributors:
+
+- Bryan McLemore
+- Mickaël Guérin <kael@crocobox.org>
+- Cameron Knight
+- Lawrence Journal-World.
+- David Cramer
+- Adrian Mönnich (ThiefMaster)
+
+Patches and suggestions:
+
+- Ronny Pfannschmidt
+- Axel Böhm
+- Alexey Melchakov
+- Bryan McLemore
+- Clovis Fabricio (nosklo)
+- Cameron Knight
+- Peter van Dijk (Habbie)
+- Stefan Ebner
+- Rene Leonhardt
+- Thomas Waldmann
+- Cory Benfield (Lukasa)
diff --git a/deps/jinja2/Jinja2-2.10.tar.gz.md5 b/deps/jinja2/Jinja2-2.10.tar.gz.md5
new file mode 100644
index 00000000000000..9137ee129a0a6f
--- /dev/null
+++ b/deps/jinja2/Jinja2-2.10.tar.gz.md5
@@ -0,0 +1 @@
+61ef1117f945486472850819b8d1eb3d  Jinja2-2.10.tar.gz
diff --git a/deps/jinja2/Jinja2-2.10.tar.gz.sha512 b/deps/jinja2/Jinja2-2.10.tar.gz.sha512
new file mode 100644
index 00000000000000..087d24c18eb80d
--- /dev/null
+++ b/deps/jinja2/Jinja2-2.10.tar.gz.sha512
@@ -0,0 +1 @@
+0ea7371be67ffcf19e46dfd06523a45a0806e678a407d54f5f2f3e573982f0959cf82ec5d07b203670309928a62ef71109701ab16547a9bba2ebcdc178cb67f2  Jinja2-2.10.tar.gz
diff --git a/deps/jinja2/LICENSE b/deps/jinja2/LICENSE
new file mode 100644
index 00000000000000..31bf900e58e30f
--- /dev/null
+++ b/deps/jinja2/LICENSE
@@ -0,0 +1,31 @@
+Copyright (c) 2009 by the Jinja Team, see AUTHORS for more details.
+
+Some rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are
+met:
+
+    * Redistributions of source code must retain the above copyright
+      notice, this list of conditions and the following disclaimer.
+
+    * Redistributions in binary form must reproduce the above
+      copyright notice, this list of conditions and the following
+      disclaimer in the documentation and/or other materials provided
+      with the distribution.
+
+    * The names of the contributors may not be used to endorse or
+      promote products derived from this software without specific
+      prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+"AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
diff --git a/deps/jinja2/OWNERS b/deps/jinja2/OWNERS
new file mode 100644
index 00000000000000..ee2bec9ba3a3a2
--- /dev/null
+++ b/deps/jinja2/OWNERS
@@ -0,0 +1,6 @@
+timloh@chromium.org
+haraken@chromium.org
+nbarth@chromium.org
+
+# TEAM: platform-architecture-dev@chromium.org
+# COMPONENT: Blink>Internals
diff --git a/deps/jinja2/README.chromium b/deps/jinja2/README.chromium
new file mode 100644
index 00000000000000..5246c2f84b6021
--- /dev/null
+++ b/deps/jinja2/README.chromium
@@ -0,0 +1,26 @@
+Name: Jinja2 Python Template Engine
+Short Name: jinja2
+URL: http://jinja.pocoo.org/
+Version: 2.10
+License: BSD 3-Clause
+License File: LICENSE
+Security Critical: no
+
+Description:
+Template engine for code generation in Blink.
+
+Source: https://pypi.python.org/packages/56/e6/332789f295cf22308386cf5bbd1f4e00ed11484299c5d7383378cf48ba47/Jinja2-2.10.tar.gz
+MD5: 61ef1117f945486472850819b8d1eb3d
+SHA-1: 34b69e5caab12ee37b9df69df9018776c008b7b8
+
+Local Modifications:
+This only includes the jinja2 directory from the tarball and the LICENSE and
+AUTHORS files. Unit tests (testsuite directory) have been removed.
+Additional chromium-specific files are:
+* README.chromium (this file)
+* OWNERS
+* get_jinja2.sh (install script)
+* jinja2.gni (generated by get_jinja2.sh)
+* files of hashes (MD5 is also posted on website, SHA-512 computed locally).
+Script checks hash then unpacks archive and installs desired files.
+Retrieve or update by executing jinja2/get_jinja2.sh from third_party.
diff --git a/deps/jinja2/__init__.py b/deps/jinja2/__init__.py
new file mode 100644
index 00000000000000..42aa763d571e5b
--- /dev/null
+++ b/deps/jinja2/__init__.py
@@ -0,0 +1,83 @@
+# -*- coding: utf-8 -*-
+"""
+    jinja2
+    ~~~~~~
+
+    Jinja2 is a template engine written in pure Python.  It provides a
+    Django inspired non-XML syntax but supports inline expressions and
+    an optional sandboxed environment.
+
+    Nutshell
+    --------
+
+    Here a small example of a Jinja2 template::
+
+        {% extends 'base.html' %}
+        {% block title %}Memberlist{% endblock %}
+        {% block content %}
+          <ul>
+          {% for user in users %}
+            <li><a href="{{ user.url }}">{{ user.username }}</a></li>
+          {% endfor %}
+          </ul>
+        {% endblock %}
+
+
+    :copyright: (c) 2017 by the Jinja Team.
+    :license: BSD, see LICENSE for more details.
+"""
+__docformat__ = 'restructuredtext en'
+__version__ = '2.10'
+
+# high level interface
+from jinja2.environment import Environment, Template
+
+# loaders
+from jinja2.loaders import BaseLoader, FileSystemLoader, PackageLoader, \
+     DictLoader, FunctionLoader, PrefixLoader, ChoiceLoader, \
+     ModuleLoader
+
+# bytecode caches
+from jinja2.bccache import BytecodeCache, FileSystemBytecodeCache, \
+     MemcachedBytecodeCache
+
+# undefined types
+from jinja2.runtime import Undefined, DebugUndefined, StrictUndefined, \
+     make_logging_undefined
+
+# exceptions
+from jinja2.exceptions import TemplateError, UndefinedError, \
+     TemplateNotFound, TemplatesNotFound, TemplateSyntaxError, \
+     TemplateAssertionError, TemplateRuntimeError
+
+# decorators and public utilities
+from jinja2.filters import environmentfilter, contextfilter, \
+     evalcontextfilter
+from jinja2.utils import Markup, escape, clear_caches, \
+     environmentfunction, evalcontextfunction, contextfunction, \
+     is_undefined, select_autoescape
+
+__all__ = [
+    'Environment', 'Template', 'BaseLoader', 'FileSystemLoader',
+    'PackageLoader', 'DictLoader', 'FunctionLoader', 'PrefixLoader',
+    'ChoiceLoader', 'BytecodeCache', 'FileSystemBytecodeCache',
+    'MemcachedBytecodeCache', 'Undefined', 'DebugUndefined',
+    'StrictUndefined', 'TemplateError', 'UndefinedError', 'TemplateNotFound',
+    'TemplatesNotFound', 'TemplateSyntaxError', 'TemplateAssertionError',
+    'TemplateRuntimeError',
+    'ModuleLoader', 'environmentfilter', 'contextfilter', 'Markup', 'escape',
+    'environmentfunction', 'contextfunction', 'clear_caches', 'is_undefined',
+    'evalcontextfilter', 'evalcontextfunction', 'make_logging_undefined',
+    'select_autoescape',
+]
+
+
+def _patch_async():
+    from jinja2.utils import have_async_gen
+    if have_async_gen:
+        from jinja2.asyncsupport import patch_all
+        patch_all()
+
+
+_patch_async()
+del _patch_async
diff --git a/deps/jinja2/_compat.py b/deps/jinja2/_compat.py
new file mode 100644
index 00000000000000..61d85301a4a9ef
--- /dev/null
+++ b/deps/jinja2/_compat.py
@@ -0,0 +1,99 @@
+# -*- coding: utf-8 -*-
+"""
+    jinja2._compat
+    ~~~~~~~~~~~~~~
+
+    Some py2/py3 compatibility support based on a stripped down
+    version of six so we don't have to depend on a specific version
+    of it.
+
+    :copyright: Copyright 2013 by the Jinja team, see AUTHORS.
+    :license: BSD, see LICENSE for details.
+"""
+import sys
+
+PY2 = sys.version_info[0] == 2
+PYPY = hasattr(sys, 'pypy_translation_info')
+_identity = lambda x: x
+
+
+if not PY2:
+    unichr = chr
+    range_type = range
+    text_type = str
+    string_types = (str,)
+    integer_types = (int,)
+
+    iterkeys = lambda d: iter(d.keys())
+    itervalues = lambda d: iter(d.values())
+    iteritems = lambda d: iter(d.items())
+
+    import pickle
+    from io import BytesIO, StringIO
+    NativeStringIO = StringIO
+
+    def reraise(tp, value, tb=None):
+        if value.__traceback__ is not tb:
+            raise value.with_traceback(tb)
+        raise value
+
+    ifilter = filter
+    imap = map
+    izip = zip
+    intern = sys.intern
+
+    implements_iterator = _identity
+    implements_to_string = _identity
+    encode_filename = _identity
+
+else:
+    unichr = unichr
+    text_type = unicode
+    range_type = xrange
+    string_types = (str, unicode)
+    integer_types = (int, long)
+
+    iterkeys = lambda d: d.iterkeys()
+    itervalues = lambda d: d.itervalues()
+    iteritems = lambda d: d.iteritems()
+
+    import cPickle as pickle
+    from cStringIO import StringIO as BytesIO, StringIO
+    NativeStringIO = BytesIO
+
+    exec('def reraise(tp, value, tb=None):\n raise tp, value, tb')
+
+    from itertools import imap, izip, ifilter
+    intern = intern
+
+    def implements_iterator(cls):
+        cls.next = cls.__next__
+        del cls.__next__
+        return cls
+
+    def implements_to_string(cls):
+        cls.__unicode__ = cls.__str__
+        cls.__str__ = lambda x: x.__unicode__().encode('utf-8')
+        return cls
+
+    def encode_filename(filename):
+        if isinstance(filename, unicode):
+            return filename.encode('utf-8')
+        return filename
+
+
+def with_metaclass(meta, *bases):
+    """Create a base class with a metaclass."""
+    # This requires a bit of explanation: the basic idea is to make a
+    # dummy metaclass for one level of class instantiation that replaces
+    # itself with the actual metaclass.
+    class metaclass(type):
+        def __new__(cls, name, this_bases, d):
+            return meta(name, bases, d)
+    return type.__new__(metaclass, 'temporary_class', (), {})
+
+
+try:
+    from urllib.parse import quote_from_bytes as url_quote
+except ImportError:
+    from urllib import quote as url_quote
diff --git a/deps/jinja2/_identifier.py b/deps/jinja2/_identifier.py
new file mode 100644
index 00000000000000..2eac35d5c35531
--- /dev/null
+++ b/deps/jinja2/_identifier.py
@@ -0,0 +1,2 @@
+# generated by scripts/generate_identifier_pattern.py
+pattern = '·̀-ͯ·҃-֑҇-ׇֽֿׁׂׅׄؐ-ًؚ-ٰٟۖ-ۜ۟-۪ۤۧۨ-ܑۭܰ-݊ަ-ް߫-߳ࠖ-࠙ࠛ-ࠣࠥ-ࠧࠩ-࡙࠭-࡛ࣔ-ࣣ࣡-ःऺ-़ा-ॏ॑-ॗॢॣঁ-ঃ়া-ৄেৈো-্ৗৢৣਁ-ਃ਼ਾ-ੂੇੈੋ-੍ੑੰੱੵઁ-ઃ઼ા-ૅે-ૉો-્ૢૣଁ-ଃ଼ା-ୄେୈୋ-୍ୖୗୢୣஂா-ூெ-ைொ-்ௗఀ-ఃా-ౄె-ైొ-్ౕౖౢౣಁ-ಃ಼ಾ-ೄೆ-ೈೊ-್ೕೖೢೣഁ-ഃാ-ൄെ-ൈൊ-്ൗൢൣංඃ්ා-ුූෘ-ෟෲෳัิ-ฺ็-๎ັິ-ູົຼ່-ໍ༹༘༙༵༷༾༿ཱ-྄྆྇ྍ-ྗྙ-ྼ࿆ါ-ှၖ-ၙၞ-ၠၢ-ၤၧ-ၭၱ-ၴႂ-ႍႏႚ-ႝ፝-፟ᜒ-᜔ᜲ-᜴ᝒᝓᝲᝳ឴-៓៝᠋-᠍ᢅᢆᢩᤠ-ᤫᤰ-᤻ᨗ-ᨛᩕ-ᩞ᩠-᩿᩼᪰-᪽ᬀ-ᬄ᬴-᭄᭫-᭳ᮀ-ᮂᮡ-ᮭ᯦-᯳ᰤ-᰷᳐-᳔᳒-᳨᳭ᳲ-᳴᳸᳹᷀-᷵᷻-᷿‿⁀⁔⃐-⃥⃜⃡-⃰℘℮⳯-⵿⳱ⷠ-〪ⷿ-゙゚〯꙯ꙴ-꙽ꚞꚟ꛰꛱ꠂ꠆ꠋꠣ-ꠧꢀꢁꢴ-ꣅ꣠-꣱ꤦ-꤭ꥇ-꥓ꦀ-ꦃ꦳-꧀ꧥꨩ-ꨶꩃꩌꩍꩻ-ꩽꪰꪲ-ꪴꪷꪸꪾ꪿꫁ꫫ-ꫯꫵ꫶ꯣ-ꯪ꯬꯭ﬞ︀-️︠-︯︳︴﹍-﹏＿𐇽𐋠𐍶-𐍺𐨁-𐨃𐨅𐨆𐨌-𐨏𐨸-𐨿𐨺𐫦𐫥𑀀-𑀂𑀸-𑁆𑁿-𑂂𑂰-𑂺𑄀-𑄂𑄧-𑅳𑄴𑆀-𑆂𑆳-𑇊𑇀-𑇌𑈬-𑈷𑈾𑋟-𑋪𑌀-𑌃𑌼𑌾-𑍄𑍇𑍈𑍋-𑍍𑍗𑍢𑍣𑍦-𑍬𑍰-𑍴𑐵-𑑆𑒰-𑓃𑖯-𑖵𑖸-𑗀𑗜𑗝𑘰-𑙀𑚫-𑚷𑜝-𑜫𑰯-𑰶𑰸-𑰿𑲒-𑲧𑲩-𑲶𖫰-𖫴𖬰-𖬶𖽑-𖽾𖾏-𖾒𛲝𛲞𝅥-𝅩𝅭-𝅲𝅻-𝆂𝆅-𝆋𝆪-𝆭𝉂-𝉄𝨀-𝨶𝨻-𝩬𝩵𝪄𝪛-𝪟𝪡-𝪯𞀀-𞀆𞀈-𞀘𞀛-𞀡𞀣𞀤𞀦-𞣐𞀪-𞣖𞥄-𞥊󠄀-󠇯'
diff --git a/deps/jinja2/asyncfilters.py b/deps/jinja2/asyncfilters.py
new file mode 100644
index 00000000000000..5c1f46d7fa7d46
--- /dev/null
+++ b/deps/jinja2/asyncfilters.py
@@ -0,0 +1,146 @@
+from functools import wraps
+
+from jinja2.asyncsupport import auto_aiter
+from jinja2 import filters
+
+
+async def auto_to_seq(value):
+    seq = []
+    if hasattr(value, '__aiter__'):
+        async for item in value:
+            seq.append(item)
+    else:
+        for item in value:
+            seq.append(item)
+    return seq
+
+
+async def async_select_or_reject(args, kwargs, modfunc, lookup_attr):
+    seq, func = filters.prepare_select_or_reject(
+        args, kwargs, modfunc, lookup_attr)
+    if seq:
+        async for item in auto_aiter(seq):
+            if func(item):
+                yield item
+
+
+def dualfilter(normal_filter, async_filter):
+    wrap_evalctx = False
+    if getattr(normal_filter, 'environmentfilter', False):
+        is_async = lambda args: args[0].is_async
+        wrap_evalctx = False
+    else:
+        if not getattr(normal_filter, 'evalcontextfilter', False) and \
+           not getattr(normal_filter, 'contextfilter', False):
+            wrap_evalctx = True
+        is_async = lambda args: args[0].environment.is_async
+
+    @wraps(normal_filter)
+    def wrapper(*args, **kwargs):
+        b = is_async(args)
+        if wrap_evalctx:
+            args = args[1:]
+        if b:
+            return async_filter(*args, **kwargs)
+        return normal_filter(*args, **kwargs)
+
+    if wrap_evalctx:
+        wrapper.evalcontextfilter = True
+
+    wrapper.asyncfiltervariant = True
+
+    return wrapper
+
+
+def asyncfiltervariant(original):
+    def decorator(f):
+        return dualfilter(original, f)
+    return decorator
+
+
+@asyncfiltervariant(filters.do_first)
+async def do_first(environment, seq):
+    try:
+        return await auto_aiter(seq).__anext__()
+    except StopAsyncIteration:
+        return environment.undefined('No first item, sequence was empty.')
+
+
+@asyncfiltervariant(filters.do_groupby)
+async def do_groupby(environment, value, attribute):
+    expr = filters.make_attrgetter(environment, attribute)
+    return [filters._GroupTuple(key, await auto_to_seq(values))
+            for key, values in filters.groupby(sorted(
+                await auto_to_seq(value), key=expr), expr)]
+
+
+@asyncfiltervariant(filters.do_join)
+async def do_join(eval_ctx, value, d=u'', attribute=None):
+    return filters.do_join(eval_ctx, await auto_to_seq(value), d, attribute)
+
+
+@asyncfiltervariant(filters.do_list)
+async def do_list(value):
+    return await auto_to_seq(value)
+
+
+@asyncfiltervariant(filters.do_reject)
+async def do_reject(*args, **kwargs):
+    return async_select_or_reject(args, kwargs, lambda x: not x, False)
+
+
+@asyncfiltervariant(filters.do_rejectattr)
+async def do_rejectattr(*args, **kwargs):
+    return async_select_or_reject(args, kwargs, lambda x: not x, True)
+
+
+@asyncfiltervariant(filters.do_select)
+async def do_select(*args, **kwargs):
+    return async_select_or_reject(args, kwargs, lambda x: x, False)
+
+
+@asyncfiltervariant(filters.do_selectattr)
+async def do_selectattr(*args, **kwargs):
+    return async_select_or_reject(args, kwargs, lambda x: x, True)
+
+
+@asyncfiltervariant(filters.do_map)
+async def do_map(*args, **kwargs):
+    seq, func = filters.prepare_map(args, kwargs)
+    if seq:
+        async for item in auto_aiter(seq):
+            yield func(item)
+
+
+@asyncfiltervariant(filters.do_sum)
+async def do_sum(environment, iterable, attribute=None, start=0):
+    rv = start
+    if attribute is not None:
+        func = filters.make_attrgetter(environment, attribute)
+    else:
+        func = lambda x: x
+    async for item in auto_aiter(iterable):
+        rv += func(item)
+    return rv
+
+
+@asyncfiltervariant(filters.do_slice)
+async def do_slice(value, slices, fill_with=None):
+    return filters.do_slice(await auto_to_seq(value), slices, fill_with)
+
+
+ASYNC_FILTERS = {
+    'first':        do_first,
+    'groupby':      do_groupby,
+    'join':         do_join,
+    'list':         do_list,
+    # we intentionally do not support do_last because that would be
+    # ridiculous
+    'reject':       do_reject,
+    'rejectattr':   do_rejectattr,
+    'map':          do_map,
+    'select':       do_select,
+    'selectattr':   do_selectattr,
+    'sum':          do_sum,
+    'slice':        do_slice,
+}
diff --git a/deps/jinja2/asyncsupport.py b/deps/jinja2/asyncsupport.py
new file mode 100644
index 00000000000000..b1e7b5ce9a27a6
--- /dev/null
+++ b/deps/jinja2/asyncsupport.py
@@ -0,0 +1,256 @@
+# -*- coding: utf-8 -*-
+"""
+    jinja2.asyncsupport
+    ~~~~~~~~~~~~~~~~~~~
+
+    Has all the code for async support which is implemented as a patch
+    for supported Python versions.
+
+    :copyright: (c) 2017 by the Jinja Team.
+    :license: BSD, see LICENSE for more details.
+"""
+import sys
+import asyncio
+import inspect
+from functools import update_wrapper
+
+from jinja2.utils import concat, internalcode, Markup
+from jinja2.environment import TemplateModule
+from jinja2.runtime import LoopContextBase, _last_iteration
+
+
+async def concat_async(async_gen):
+    rv = []
+    async def collect():
+        async for event in async_gen:
+            rv.append(event)
+    await collect()
+    return concat(rv)
+
+
+async def generate_async(self, *args, **kwargs):
+    vars = dict(*args, **kwargs)
+    try:
+        async for event in self.root_render_func(self.new_context(vars)):
+            yield event
+    except Exception:
+        exc_info = sys.exc_info()
+    else:
+        return
+    yield self.environment.handle_exception(exc_info, True)
+
+
+def wrap_generate_func(original_generate):
+    def _convert_generator(self, loop, args, kwargs):
+        async_gen = self.generate_async(*args, **kwargs)
+        try:
+            while 1:
+                yield loop.run_until_complete(async_gen.__anext__())
+        except StopAsyncIteration:
+            pass
+    def generate(self, *args, **kwargs):
+        if not self.environment.is_async:
+            return original_generate(self, *args, **kwargs)
+        return _convert_generator(self, asyncio.get_event_loop(), args, kwargs)
+    return update_wrapper(generate, original_generate)
+
+
+async def render_async(self, *args, **kwargs):
+    if not self.environment.is_async:
+        raise RuntimeError('The environment was not created with async mode '
+                           'enabled.')
+
+    vars = dict(*args, **kwargs)
+    ctx = self.new_context(vars)
+
+    try:
+        return await concat_async(self.root_render_func(ctx))
+    except Exception:
+        exc_info = sys.exc_info()
+    return self.environment.handle_exception(exc_info, True)
+
+
+def wrap_render_func(original_render):
+    def render(self, *args, **kwargs):
+        if not self.environment.is_async:
+            return original_render(self, *args, **kwargs)
+        loop = asyncio.get_event_loop()
+        return loop.run_until_complete(self.render_async(*args, **kwargs))
+    return update_wrapper(render, original_render)
+
+
+def wrap_block_reference_call(original_call):
+    @internalcode
+    async def async_call(self):
+        rv = await concat_async(self._stack[self._depth](self._context))
+        if self._context.eval_ctx.autoescape:
+            rv = Markup(rv)
+        return rv
+
+    @internalcode
+    def __call__(self):
+        if not self._context.environment.is_async:
+            return original_call(self)
+        return async_call(self)
+
+    return update_wrapper(__call__, original_call)
+
+
+def wrap_macro_invoke(original_invoke):
+    @internalcode
+    async def async_invoke(self, arguments, autoescape):
+        rv = await self._func(*arguments)
+        if autoescape:
+            rv = Markup(rv)
+        return rv
+
+    @internalcode
+    def _invoke(self, arguments, autoescape):
+        if not self._environment.is_async:
+            return original_invoke(self, arguments, autoescape)
+        return async_invoke(self, arguments, autoescape)
+    return update_wrapper(_invoke, original_invoke)
+
+
+@internalcode
+async def get_default_module_async(self):
+    if self._module is not None:
+        return self._module
+    self._module = rv = await self.make_module_async()
+    return rv
+
+
+def wrap_default_module(original_default_module):
+    @internalcode
+    def _get_default_module(self):
+        if self.environment.is_async:
+            raise RuntimeError('Template module attribute is unavailable '
+                               'in async mode')
+        return original_default_module(self)
+    return _get_default_module
+
+
+async def make_module_async(self, vars=None, shared=False, locals=None):
+    context = self.new_context(vars, shared, locals)
+    body_stream = []
+    async for item in self.root_render_func(context):
+        body_stream.append(item)
+    return TemplateModule(self, context, body_stream)
+
+
+def patch_template():
+    from jinja2 import Template
+    Template.generate = wrap_generate_func(Template.generate)
+    Template.generate_async = update_wrapper(
+        generate_async, Template.generate_async)
+    Template.render_async = update_wrapper(
+        render_async, Template.render_async)
+    Template.render = wrap_render_func(Template.render)
+    Template._get_default_module = wrap_default_module(
+        Template._get_default_module)
+    Template._get_default_module_async = get_default_module_async
+    Template.make_module_async = update_wrapper(
+        make_module_async, Template.make_module_async)
+
+
+def patch_runtime():
+    from jinja2.runtime import BlockReference, Macro
+    BlockReference.__call__ = wrap_block_reference_call(
+        BlockReference.__call__)
+    Macro._invoke = wrap_macro_invoke(Macro._invoke)
+
+
+def patch_filters():
+    from jinja2.filters import FILTERS
+    from jinja2.asyncfilters import ASYNC_FILTERS
+    FILTERS.update(ASYNC_FILTERS)
+
+
+def patch_all():
+    patch_template()
+    patch_runtime()
+    patch_filters()
+
+
+async def auto_await(value):
+    if inspect.isawaitable(value):
+        return await value
+    return value
+
+
+async def auto_aiter(iterable):
+    if hasattr(iterable, '__aiter__'):
+        async for item in iterable:
+            yield item
+        return
+    for item in iterable:
+        yield item
+
+
+class AsyncLoopContext(LoopContextBase):
+
+    def __init__(self, async_iterator, undefined, after, length, recurse=None,
+                 depth0=0):
+        LoopContextBase.__init__(self, undefined, recurse, depth0)
+        self._async_iterator = async_iterator
+        self._after = after
+        self._length = length
+
+    @property
+    def length(self):
+        if self._length is None:
+            raise TypeError('Loop length for some iterators cannot be '
+                            'lazily calculated in async mode')
+        return self._length
+
+    def __aiter__(self):
+        return AsyncLoopContextIterator(self)
+
+
+class AsyncLoopContextIterator(object):
+    __slots__ = ('context',)
+
+    def __init__(self, context):
+        self.context = context
+
+    def __aiter__(self):
+        return self
+
+    async def __anext__(self):
+        ctx = self.context
+        ctx.index0 += 1
+        if ctx._after is _last_iteration:
+            raise StopAsyncIteration()
+        ctx._before = ctx._current
+        ctx._current = ctx._after
+        try:
+            ctx._after = await ctx._async_iterator.__anext__()
+        except StopAsyncIteration:
+            ctx._after = _last_iteration
+        return ctx._current, ctx
+
+
+async def make_async_loop_context(iterable, undefined, recurse=None, depth0=0):
+    # Length is more complicated and less efficient in async mode.  The
+    # reason for this is that we cannot know if length will be used
+    # upfront but because length is a property we cannot lazily execute it
+    # later.  This means that we need to buffer it up and measure :(
+    #
+    # We however only do this for actual iterators, not for async
+    # iterators as blocking here does not seem like the best idea in the
+    # world.
+    try:
+        length = len(iterable)
+    except (TypeError, AttributeError):
+        if not hasattr(iterable, '__aiter__'):
+            iterable = tuple(iterable)
+            length = len(iterable)
+        else:
+            length = None
+    async_iterator = auto_aiter(iterable)
+    try:
+        after = await async_iterator.__anext__()
+    except StopAsyncIteration:
+        after = _last_iteration
+    return AsyncLoopContext(async_iterator, undefined, after, length, recurse,
+                            depth0)
diff --git a/deps/jinja2/bccache.py b/deps/jinja2/bccache.py
new file mode 100644
index 00000000000000..080e527cabf33b
--- /dev/null
+++ b/deps/jinja2/bccache.py
@@ -0,0 +1,362 @@
+# -*- coding: utf-8 -*-
+"""
+    jinja2.bccache
+    ~~~~~~~~~~~~~~
+
+    This module implements the bytecode cache system Jinja is optionally
+    using.  This is useful if you have very complex template situations and
+    the compiliation of all those templates slow down your application too
+    much.
+
+    Situations where this is useful are often forking web applications that
+    are initialized on the first request.
+
+    :copyright: (c) 2017 by the Jinja Team.
+    :license: BSD.
+"""
+from os import path, listdir
+import os
+import sys
+import stat
+import errno
+import marshal
+import tempfile
+import fnmatch
+from hashlib import sha1
+from jinja2.utils import open_if_exists
+from jinja2._compat import BytesIO, pickle, PY2, text_type
+
+
+# marshal works better on 3.x, one hack less required
+if not PY2:
+    marshal_dump = marshal.dump
+    marshal_load = marshal.load
+else:
+
+    def marshal_dump(code, f):
+        if isinstance(f, file):
+            marshal.dump(code, f)
+        else:
+            f.write(marshal.dumps(code))
+
+    def marshal_load(f):
+        if isinstance(f, file):
+            return marshal.load(f)
+        return marshal.loads(f.read())
+
+
+bc_version = 3
+
+# magic version used to only change with new jinja versions.  With 2.6
+# we change this to also take Python version changes into account.  The
+# reason for this is that Python tends to segfault if fed earlier bytecode
+# versions because someone thought it would be a good idea to reuse opcodes
+# or make Python incompatible with earlier versions.
+bc_magic = 'j2'.encode('ascii') + \
+    pickle.dumps(bc_version, 2) + \
+    pickle.dumps((sys.version_info[0] << 24) | sys.version_info[1])
+
+
+class Bucket(object):
+    """Buckets are used to store the bytecode for one template.  It's created
+    and initialized by the bytecode cache and passed to the loading functions.
+
+    The buckets get an internal checksum from the cache assigned and use this
+    to automatically reject outdated cache material.  Individual bytecode
+    cache subclasses don't have to care about cache invalidation.
+    """
+
+    def __init__(self, environment, key, checksum):
+        self.environment = environment
+        self.key = key
+        self.checksum = checksum
+        self.reset()
+
+    def reset(self):
+        """Resets the bucket (unloads the bytecode)."""
+        self.code = None
+
+    def load_bytecode(self, f):
+        """Loads bytecode from a file or file like object."""
+        # make sure the magic header is correct
+        magic = f.read(len(bc_magic))
+        if magic != bc_magic:
+            self.reset()
+            return
+        # the source code of the file changed, we need to reload
+        checksum = pickle.load(f)
+        if self.checksum != checksum:
+            self.reset()
+            return
+        # if marshal_load fails then we need to reload
+        try:
+            self.code = marshal_load(f)
+        except (EOFError, ValueError, TypeError):
+            self.reset()
+            return
+
+    def write_bytecode(self, f):
+        """Dump the bytecode into the file or file like object passed."""
+        if self.code is None:
+            raise TypeError('can\'t write empty bucket')
+        f.write(bc_magic)
+        pickle.dump(self.checksum, f, 2)
+        marshal_dump(self.code, f)
+
+    def bytecode_from_string(self, string):
+        """Load bytecode from a string."""
+        self.load_bytecode(BytesIO(string))
+
+    def bytecode_to_string(self):
+        """Return the bytecode as string."""
+        out = BytesIO()
+        self.write_bytecode(out)
+        return out.getvalue()
+
+
+class BytecodeCache(object):
+    """To implement your own bytecode cache you have to subclass this class
+    and override :meth:`load_bytecode` and :meth:`dump_bytecode`.  Both of
+    these methods are passed a :class:`~jinja2.bccache.Bucket`.
+
+    A very basic bytecode cache that saves the bytecode on the file system::
+
+        from os import path
+
+        class MyCache(BytecodeCache):
+
+            def __init__(self, directory):
+                self.directory = directory
+
+            def load_bytecode(self, bucket):
+                filename = path.join(self.directory, bucket.key)
+                if path.exists(filename):
+                    with open(filename, 'rb') as f:
+                        bucket.load_bytecode(f)
+
+            def dump_bytecode(self, bucket):
+                filename = path.join(self.directory, bucket.key)
+                with open(filename, 'wb') as f:
+                    bucket.write_bytecode(f)
+
+    A more advanced version of a filesystem based bytecode cache is part of
+    Jinja2.
+    """
+
+    def load_bytecode(self, bucket):
+        """Subclasses have to override this method to load bytecode into a
+        bucket.  If they are not able to find code in the cache for the
+        bucket, it must not do anything.
+        """
+        raise NotImplementedError()
+
+    def dump_bytecode(self, bucket):
+        """Subclasses have to override this method to write the bytecode
+        from a bucket back to the cache.  If it unable to do so it must not
+        fail silently but raise an exception.
+        """
+        raise NotImplementedError()
+
+    def clear(self):
+        """Clears the cache.  This method is not used by Jinja2 but should be
+        implemented to allow applications to clear the bytecode cache used
+        by a particular environment.
+        """
+
+    def get_cache_key(self, name, filename=None):
+        """Returns the unique hash key for this template name."""
+        hash = sha1(name.encode('utf-8'))
+        if filename is not None:
+            filename = '|' + filename
+            if isinstance(filename, text_type):
+                filename = filename.encode('utf-8')
+            hash.update(filename)
+        return hash.hexdigest()
+
+    def get_source_checksum(self, source):
+        """Returns a checksum for the source."""
+        return sha1(source.encode('utf-8')).hexdigest()
+
+    def get_bucket(self, environment, name, filename, source):
+        """Return a cache bucket for the given template.  All arguments are
+        mandatory but filename may be `None`.
+        """
+        key = self.get_cache_key(name, filename)
+        checksum = self.get_source_checksum(source)
+        bucket = Bucket(environment, key, checksum)
+        self.load_bytecode(bucket)
+        return bucket
+
+    def set_bucket(self, bucket):
+        """Put the bucket into the cache."""
+        self.dump_bytecode(bucket)
+
+
+class FileSystemBytecodeCache(BytecodeCache):
+    """A bytecode cache that stores bytecode on the filesystem.  It accepts
+    two arguments: The directory where the cache items are stored and a
+    pattern string that is used to build the filename.
+
+    If no directory is specified a default cache directory is selected.  On
+    Windows the user's temp directory is used, on UNIX systems a directory
+    is created for the user in the system temp directory.
+
+    The pattern can be used to have multiple separate caches operate on the
+    same directory.  The default pattern is ``'__jinja2_%s.cache'``.  ``%s``
+    is replaced with the cache key.
+
+    >>> bcc = FileSystemBytecodeCache('/tmp/jinja_cache', '%s.cache')
+
+    This bytecode cache supports clearing of the cache using the clear method.
+    """
+
+    def __init__(self, directory=None, pattern='__jinja2_%s.cache'):
+        if directory is None:
+            directory = self._get_default_cache_dir()
+        self.directory = directory
+        self.pattern = pattern
+
+    def _get_default_cache_dir(self):
+        def _unsafe_dir():
+            raise RuntimeError('Cannot determine safe temp directory.  You '
+                               'need to explicitly provide one.')
+
+        tmpdir = tempfile.gettempdir()
+
+        # On windows the temporary directory is used specific unless
+        # explicitly forced otherwise.  We can just use that.
+        if os.name == 'nt':
+            return tmpdir
+        if not hasattr(os, 'getuid'):
+            _unsafe_dir()
+
+        dirname = '_jinja2-cache-%d' % os.getuid()
+        actual_dir = os.path.join(tmpdir, dirname)
+
+        try:
+            os.mkdir(actual_dir, stat.S_IRWXU)
+        except OSError as e:
+            if e.errno != errno.EEXIST:
+                raise
+        try:
+            os.chmod(actual_dir, stat.S_IRWXU)
+            actual_dir_stat = os.lstat(actual_dir)
+            if actual_dir_stat.st_uid != os.getuid() \
+               or not stat.S_ISDIR(actual_dir_stat.st_mode) \
+               or stat.S_IMODE(actual_dir_stat.st_mode) != stat.S_IRWXU:
+                _unsafe_dir()
+        except OSError as e:
+            if e.errno != errno.EEXIST:
+                raise
+
+        actual_dir_stat = os.lstat(actual_dir)
+        if actual_dir_stat.st_uid != os.getuid() \
+           or not stat.S_ISDIR(actual_dir_stat.st_mode) \
+           or stat.S_IMODE(actual_dir_stat.st_mode) != stat.S_IRWXU:
+            _unsafe_dir()
+
+        return actual_dir
+
+    def _get_cache_filename(self, bucket):
+        return path.join(self.directory, self.pattern % bucket.key)
+
+    def load_bytecode(self, bucket):
+        f = open_if_exists(self._get_cache_filename(bucket), 'rb')
+        if f is not None:
+            try:
+                bucket.load_bytecode(f)
+            finally:
+                f.close()
+
+    def dump_bytecode(self, bucket):
+        f = open(self._get_cache_filename(bucket), 'wb')
+        try:
+            bucket.write_bytecode(f)
+        finally:
+            f.close()
+
+    def clear(self):
+        # imported lazily here because google app-engine doesn't support
+        # write access on the file system and the function does not exist
+        # normally.
+        from os import remove
+        files = fnmatch.filter(listdir(self.directory), self.pattern % '*')
+        for filename in files:
+            try:
+                remove(path.join(self.directory, filename))
+            except OSError:
+                pass
+
+
+class MemcachedBytecodeCache(BytecodeCache):
+    """This class implements a bytecode cache that uses a memcache cache for
+    storing the information.  It does not enforce a specific memcache library
+    (tummy's memcache or cmemcache) but will accept any class that provides
+    the minimal interface required.
+
+    Libraries compatible with this class:
+
+    -   `werkzeug <http://werkzeug.pocoo.org/>`_.contrib.cache
+    -   `python-memcached <https://www.tummy.com/Community/software/python-memcached/>`_
+    -   `cmemcache <http://gijsbert.org/cmemcache/>`_
+
+    (Unfortunately the django cache interface is not compatible because it
+    does not support storing binary data, only unicode.  You can however pass
+    the underlying cache client to the bytecode cache which is available
+    as `django.core.cache.cache._client`.)
+
+    The minimal interface for the client passed to the constructor is this:
+
+    .. class:: MinimalClientInterface
+
+        .. method:: set(key, value[, timeout])
+
+            Stores the bytecode in the cache.  `value` is a string and
+            `timeout` the timeout of the key.  If timeout is not provided
+            a default timeout or no timeout should be assumed, if it's
+            provided it's an integer with the number of seconds the cache
+            item should exist.
+
+        .. method:: get(key)
+
+            Returns the value for the cache key.  If the item does not
+            exist in the cache the return value must be `None`.
+
+    The other arguments to the constructor are the prefix for all keys that
+    is added before the actual cache key and the timeout for the bytecode in
+    the cache system.  We recommend a high (or no) timeout.
+
+    This bytecode cache does not support clearing of used items in the cache.
+    The clear method is a no-operation function.
+
+    .. versionadded:: 2.7
+       Added support for ignoring memcache errors through the
+       `ignore_memcache_errors` parameter.
+    """
+
+    def __init__(self, client, prefix='jinja2/bytecode/', timeout=None,
+                 ignore_memcache_errors=True):
+        self.client = client
+        self.prefix = prefix
+        self.timeout = timeout
+        self.ignore_memcache_errors = ignore_memcache_errors
+
+    def load_bytecode(self, bucket):
+        try:
+            code = self.client.get(self.prefix + bucket.key)
+        except Exception:
+            if not self.ignore_memcache_errors:
+                raise
+            code = None
+        if code is not None:
+            bucket.bytecode_from_string(code)
+
+    def dump_bytecode(self, bucket):
+        args = (self.prefix + bucket.key, bucket.bytecode_to_string())
+        if self.timeout is not None:
+            args += (self.timeout,)
+        try:
+            self.client.set(*args)
+        except Exception:
+            if not self.ignore_memcache_errors:
+                raise
diff --git a/deps/jinja2/compiler.py b/deps/jinja2/compiler.py
new file mode 100644
index 00000000000000..d534a827391aeb
--- /dev/null
+++ b/deps/jinja2/compiler.py
@@ -0,0 +1,1721 @@
+# -*- coding: utf-8 -*-
+"""
+    jinja2.compiler
+    ~~~~~~~~~~~~~~~
+
+    Compiles nodes into python code.
+
+    :copyright: (c) 2017 by the Jinja Team.
+    :license: BSD, see LICENSE for more details.
+"""
+from itertools import chain
+from copy import deepcopy
+from keyword import iskeyword as is_python_keyword
+from functools import update_wrapper
+from jinja2 import nodes
+from jinja2.nodes import EvalContext
+from jinja2.visitor import NodeVisitor
+from jinja2.optimizer import Optimizer
+from jinja2.exceptions import TemplateAssertionError
+from jinja2.utils import Markup, concat, escape
+from jinja2._compat import range_type, text_type, string_types, \
+     iteritems, NativeStringIO, imap, izip
+from jinja2.idtracking import Symbols, VAR_LOAD_PARAMETER, \
+     VAR_LOAD_RESOLVE, VAR_LOAD_ALIAS, VAR_LOAD_UNDEFINED
+
+
+operators = {
+    'eq':       '==',
+    'ne':       '!=',
+    'gt':       '>',
+    'gteq':     '>=',
+    'lt':       '<',
+    'lteq':     '<=',
+    'in':       'in',
+    'notin':    'not in'
+}
+
+# what method to iterate over items do we want to use for dict iteration
+# in generated code?  on 2.x let's go with iteritems, on 3.x with items
+if hasattr(dict, 'iteritems'):
+    dict_item_iter = 'iteritems'
+else:
+    dict_item_iter = 'items'
+
+code_features = ['division']
+
+# does this python version support generator stops? (PEP 0479)
+try:
+    exec('from __future__ import generator_stop')
+    code_features.append('generator_stop')
+except SyntaxError:
+    pass
+
+# does this python version support yield from?
+try:
+    exec('def f(): yield from x()')
+except SyntaxError:
+    supports_yield_from = False
+else:
+    supports_yield_from = True
+
+
+def optimizeconst(f):
+    def new_func(self, node, frame, **kwargs):
+        # Only optimize if the frame is not volatile
+        if self.optimized and not frame.eval_ctx.volatile:
+            new_node = self.optimizer.visit(node, frame.eval_ctx)
+            if new_node != node:
+                return self.visit(new_node, frame)
+        return f(self, node, frame, **kwargs)
+    return update_wrapper(new_func, f)
+
+
+def generate(node, environment, name, filename, stream=None,
+             defer_init=False, optimized=True):
+    """Generate the python source for a node tree."""
+    if not isinstance(node, nodes.Template):
+        raise TypeError('Can\'t compile non template nodes')
+    generator = environment.code_generator_class(environment, name, filename,
+                                                 stream, defer_init,
+                                                 optimized)
+    generator.visit(node)
+    if stream is None:
+        return generator.stream.getvalue()
+
+
+def has_safe_repr(value):
+    """Does the node have a safe representation?"""
+    if value is None or value is NotImplemented or value is Ellipsis:
+        return True
+    if type(value) in (bool, int, float, complex, range_type, Markup) + string_types:
+        return True
+    if type(value) in (tuple, list, set, frozenset):
+        for item in value:
+            if not has_safe_repr(item):
+                return False
+        return True
+    elif type(value) is dict:
+        for key, value in iteritems(value):
+            if not has_safe_repr(key):
+                return False
+            if not has_safe_repr(value):
+                return False
+        return True
+    return False
+
+
+def find_undeclared(nodes, names):
+    """Check if the names passed are accessed undeclared.  The return value
+    is a set of all the undeclared names from the sequence of names found.
+    """
+    visitor = UndeclaredNameVisitor(names)
+    try:
+        for node in nodes:
+            visitor.visit(node)
+    except VisitorExit:
+        pass
+    return visitor.undeclared
+
+
+class MacroRef(object):
+
+    def __init__(self, node):
+        self.node = node
+        self.accesses_caller = False
+        self.accesses_kwargs = False
+        self.accesses_varargs = False
+
+
+class Frame(object):
+    """Holds compile time information for us."""
+
+    def __init__(self, eval_ctx, parent=None, level=None):
+        self.eval_ctx = eval_ctx
+        self.symbols = Symbols(parent and parent.symbols or None,
+                               level=level)
+
+        # a toplevel frame is the root + soft frames such as if conditions.
+        self.toplevel = False
+
+        # the root frame is basically just the outermost frame, so no if
+        # conditions.  This information is used to optimize inheritance
+        # situations.
+        self.rootlevel = False
+
+        # in some dynamic inheritance situations the compiler needs to add
+        # write tests around output statements.
+        self.require_output_check = parent and parent.require_output_check
+
+        # inside some tags we are using a buffer rather than yield statements.
+        # this for example affects {% filter %} or {% macro %}.  If a frame
+        # is buffered this variable points to the name of the list used as
+        # buffer.
+        self.buffer = None
+
+        # the name of the block we're in, otherwise None.
+        self.block = parent and parent.block or None
+
+        # the parent of this frame
+        self.parent = parent
+
+        if parent is not None:
+            self.buffer = parent.buffer
+
+    def copy(self):
+        """Create a copy of the current one."""
+        rv = object.__new__(self.__class__)
+        rv.__dict__.update(self.__dict__)
+        rv.symbols = self.symbols.copy()
+        return rv
+
+    def inner(self, isolated=False):
+        """Return an inner frame."""
+        if isolated:
+            return Frame(self.eval_ctx, level=self.symbols.level + 1)
+        return Frame(self.eval_ctx, self)
+
+    def soft(self):
+        """Return a soft frame.  A soft frame may not be modified as
+        standalone thing as it shares the resources with the frame it
+        was created of, but it's not a rootlevel frame any longer.
+
+        This is only used to implement if-statements.
+        """
+        rv = self.copy()
+        rv.rootlevel = False
+        return rv
+
+    __copy__ = copy
+
+
+class VisitorExit(RuntimeError):
+    """Exception used by the `UndeclaredNameVisitor` to signal a stop."""
+
+
+class DependencyFinderVisitor(NodeVisitor):
+    """A visitor that collects filter and test calls."""
+
+    def __init__(self):
+        self.filters = set()
+        self.tests = set()
+
+    def visit_Filter(self, node):
+        self.generic_visit(node)
+        self.filters.add(node.name)
+
+    def visit_Test(self, node):
+        self.generic_visit(node)
+        self.tests.add(node.name)
+
+    def visit_Block(self, node):
+        """Stop visiting at blocks."""
+
+
+class UndeclaredNameVisitor(NodeVisitor):
+    """A visitor that checks if a name is accessed without being
+    declared.  This is different from the frame visitor as it will
+    not stop at closure frames.
+    """
+
+    def __init__(self, names):
+        self.names = set(names)
+        self.undeclared = set()
+
+    def visit_Name(self, node):
+        if node.ctx == 'load' and node.name in self.names:
+            self.undeclared.add(node.name)
+            if self.undeclared == self.names:
+                raise VisitorExit()
+        else:
+            self.names.discard(node.name)
+
+    def visit_Block(self, node):
+        """Stop visiting a blocks."""
+
+
+class CompilerExit(Exception):
+    """Raised if the compiler encountered a situation where it just
+    doesn't make sense to further process the code.  Any block that
+    raises such an exception is not further processed.
+    """
+
+
+class CodeGenerator(NodeVisitor):
+
+    def __init__(self, environment, name, filename, stream=None,
+                 defer_init=False, optimized=True):
+        if stream is None:
+            stream = NativeStringIO()
+        self.environment = environment
+        self.name = name
+        self.filename = filename
+        self.stream = stream
+        self.created_block_context = False
+        self.defer_init = defer_init
+        self.optimized = optimized
+        if optimized:
+            self.optimizer = Optimizer(environment)
+
+        # aliases for imports
+        self.import_aliases = {}
+
+        # a registry for all blocks.  Because blocks are moved out
+        # into the global python scope they are registered here
+        self.blocks = {}
+
+        # the number of extends statements so far
+        self.extends_so_far = 0
+
+        # some templates have a rootlevel extends.  In this case we
+        # can safely assume that we're a child template and do some
+        # more optimizations.
+        self.has_known_extends = False
+
+        # the current line number
+        self.code_lineno = 1
+
+        # registry of all filters and tests (global, not block local)
+        self.tests = {}
+        self.filters = {}
+
+        # the debug information
+        self.debug_info = []
+        self._write_debug_info = None
+
+        # the number of new lines before the next write()
+        self._new_lines = 0
+
+        # the line number of the last written statement
+        self._last_line = 0
+
+        # true if nothing was written so far.
+        self._first_write = True
+
+        # used by the `temporary_identifier` method to get new
+        # unique, temporary identifier
+        self._last_identifier = 0
+
+        # the current indentation
+        self._indentation = 0
+
+        # Tracks toplevel assignments
+        self._assign_stack = []
+
+        # Tracks parameter definition blocks
+        self._param_def_block = []
+
+        # Tracks the current context.
+        self._context_reference_stack = ['context']
+
+    # -- Various compilation helpers
+
+    def fail(self, msg, lineno):
+        """Fail with a :exc:`TemplateAssertionError`."""
+        raise TemplateAssertionError(msg, lineno, self.name, self.filename)
+
+    def temporary_identifier(self):
+        """Get a new unique identifier."""
+        self._last_identifier += 1
+        return 't_%d' % self._last_identifier
+
+    def buffer(self, frame):
+        """Enable buffering for the frame from that point onwards."""
+        frame.buffer = self.temporary_identifier()
+        self.writeline('%s = []' % frame.buffer)
+
+    def return_buffer_contents(self, frame, force_unescaped=False):
+        """Return the buffer contents of the frame."""
+        if not force_unescaped:
+            if frame.eval_ctx.volatile:
+                self.writeline('if context.eval_ctx.autoescape:')
+                self.indent()
+                self.writeline('return Markup(concat(%s))' % frame.buffer)
+                self.outdent()
+                self.writeline('else:')
+                self.indent()
+                self.writeline('return concat(%s)' % frame.buffer)
+                self.outdent()
+                return
+            elif frame.eval_ctx.autoescape:
+                self.writeline('return Markup(concat(%s))' % frame.buffer)
+                return
+        self.writeline('return concat(%s)' % frame.buffer)
+
+    def indent(self):
+        """Indent by one."""
+        self._indentation += 1
+
+    def outdent(self, step=1):
+        """Outdent by step."""
+        self._indentation -= step
+
+    def start_write(self, frame, node=None):
+        """Yield or write into the frame buffer."""
+        if frame.buffer is None:
+            self.writeline('yield ', node)
+        else:
+            self.writeline('%s.append(' % frame.buffer, node)
+
+    def end_write(self, frame):
+        """End the writing process started by `start_write`."""
+        if frame.buffer is not None:
+            self.write(')')
+
+    def simple_write(self, s, frame, node=None):
+        """Simple shortcut for start_write + write + end_write."""
+        self.start_write(frame, node)
+        self.write(s)
+        self.end_write(frame)
+
+    def blockvisit(self, nodes, frame):
+        """Visit a list of nodes as block in a frame.  If the current frame
+        is no buffer a dummy ``if 0: yield None`` is written automatically.
+        """
+        try:
+            self.writeline('pass')
+            for node in nodes:
+                self.visit(node, frame)
+        except CompilerExit:
+            pass
+
+    def write(self, x):
+        """Write a string into the output stream."""
+        if self._new_lines:
+            if not self._first_write:
+                self.stream.write('\n' * self._new_lines)
+                self.code_lineno += self._new_lines
+                if self._write_debug_info is not None:
+                    self.debug_info.append((self._write_debug_info,
+                                            self.code_lineno))
+                    self._write_debug_info = None
+            self._first_write = False
+            self.stream.write('    ' * self._indentation)
+            self._new_lines = 0
+        self.stream.write(x)
+
+    def writeline(self, x, node=None, extra=0):
+        """Combination of newline and write."""
+        self.newline(node, extra)
+        self.write(x)
+
+    def newline(self, node=None, extra=0):
+        """Add one or more newlines before the next write."""
+        self._new_lines = max(self._new_lines, 1 + extra)
+        if node is not None and node.lineno != self._last_line:
+            self._write_debug_info = node.lineno
+            self._last_line = node.lineno
+
+    def signature(self, node, frame, extra_kwargs=None):
+        """Writes a function call to the stream for the current node.
+        A leading comma is added automatically.  The extra keyword
+        arguments may not include python keywords otherwise a syntax
+        error could occour.  The extra keyword arguments should be given
+        as python dict.
+        """
+        # if any of the given keyword arguments is a python keyword
+        # we have to make sure that no invalid call is created.
+        kwarg_workaround = False
+        for kwarg in chain((x.key for x in node.kwargs), extra_kwargs or ()):
+            if is_python_keyword(kwarg):
+                kwarg_workaround = True
+                break
+
+        for arg in node.args:
+            self.write(', ')
+            self.visit(arg, frame)
+
+        if not kwarg_workaround:
+            for kwarg in node.kwargs:
+                self.write(', ')
+                self.visit(kwarg, frame)
+            if extra_kwargs is not None:
+                for key, value in iteritems(extra_kwargs):
+                    self.write(', %s=%s' % (key, value))
+        if node.dyn_args:
+            self.write(', *')
+            self.visit(node.dyn_args, frame)
+
+        if kwarg_workaround:
+            if node.dyn_kwargs is not None:
+                self.write(', **dict({')
+            else:
+                self.write(', **{')
+            for kwarg in node.kwargs:
+                self.write('%r: ' % kwarg.key)
+                self.visit(kwarg.value, frame)
+                self.write(', ')
+            if extra_kwargs is not None:
+                for key, value in iteritems(extra_kwargs):
+                    self.write('%r: %s, ' % (key, value))
+            if node.dyn_kwargs is not None:
+                self.write('}, **')
+                self.visit(node.dyn_kwargs, frame)
+                self.write(')')
+            else:
+                self.write('}')
+
+        elif node.dyn_kwargs is not None:
+            self.write(', **')
+            self.visit(node.dyn_kwargs, frame)
+
+    def pull_dependencies(self, nodes):
+        """Pull all the dependencies."""
+        visitor = DependencyFinderVisitor()
+        for node in nodes:
+            visitor.visit(node)
+        for dependency in 'filters', 'tests':
+            mapping = getattr(self, dependency)
+            for name in getattr(visitor, dependency):
+                if name not in mapping:
+                    mapping[name] = self.temporary_identifier()
+                self.writeline('%s = environment.%s[%r]' %
+                               (mapping[name], dependency, name))
+
+    def enter_frame(self, frame):
+        undefs = []
+        for target, (action, param) in iteritems(frame.symbols.loads):
+            if action == VAR_LOAD_PARAMETER:
+                pass
+            elif action == VAR_LOAD_RESOLVE:
+                self.writeline('%s = %s(%r)' %
+                               (target, self.get_resolve_func(), param))
+            elif action == VAR_LOAD_ALIAS:
+                self.writeline('%s = %s' % (target, param))
+            elif action == VAR_LOAD_UNDEFINED:
+                undefs.append(target)
+            else:
+                raise NotImplementedError('unknown load instruction')
+        if undefs:
+            self.writeline('%s = missing' % ' = '.join(undefs))
+
+    def leave_frame(self, frame, with_python_scope=False):
+        if not with_python_scope:
+            undefs = []
+            for target, _ in iteritems(frame.symbols.loads):
+                undefs.append(target)
+            if undefs:
+                self.writeline('%s = missing' % ' = '.join(undefs))
+
+    def func(self, name):
+        if self.environment.is_async:
+            return 'async def %s' % name
+        return 'def %s' % name
+
+    def macro_body(self, node, frame):
+        """Dump the function def of a macro or call block."""
+        frame = frame.inner()
+        frame.symbols.analyze_node(node)
+        macro_ref = MacroRef(node)
+
+        explicit_caller = None
+        skip_special_params = set()
+        args = []
+        for idx, arg in enumerate(node.args):
+            if arg.name == 'caller':
+                explicit_caller = idx
+            if arg.name in ('kwargs', 'varargs'):
+                skip_special_params.add(arg.name)
+            args.append(frame.symbols.ref(arg.name))
+
+        undeclared = find_undeclared(node.body, ('caller', 'kwargs', 'varargs'))
+
+        if 'caller' in undeclared:
+            # In older Jinja2 versions there was a bug that allowed caller
+            # to retain the special behavior even if it was mentioned in
+            # the argument list.  However thankfully this was only really
+            # working if it was the last argument.  So we are explicitly
+            # checking this now and error out if it is anywhere else in
+            # the argument list.
+            if explicit_caller is not None:
+                try:
+                    node.defaults[explicit_caller - len(node.args)]
+                except IndexError:
+                    self.fail('When defining macros or call blocks the '
+                              'special "caller" argument must be omitted '
+                              'or be given a default.', node.lineno)
+            else:
+                args.append(frame.symbols.declare_parameter('caller'))
+            macro_ref.accesses_caller = True
+        if 'kwargs' in undeclared and not 'kwargs' in skip_special_params:
+            args.append(frame.symbols.declare_parameter('kwargs'))
+            macro_ref.accesses_kwargs = True
+        if 'varargs' in undeclared and not 'varargs' in skip_special_params:
+            args.append(frame.symbols.declare_parameter('varargs'))
+            macro_ref.accesses_varargs = True
+
+        # macros are delayed, they never require output checks
+        frame.require_output_check = False
+        frame.symbols.analyze_node(node)
+        self.writeline('%s(%s):' % (self.func('macro'), ', '.join(args)), node)
+        self.indent()
+
+        self.buffer(frame)
+        self.enter_frame(frame)
+
+        self.push_parameter_definitions(frame)
+        for idx, arg in enumerate(node.args):
+            ref = frame.symbols.ref(arg.name)
+            self.writeline('if %s is missing:' % ref)
+            self.indent()
+            try:
+                default = node.defaults[idx - len(node.args)]
+            except IndexError:
+                self.writeline('%s = undefined(%r, name=%r)' % (
+                    ref,
+                    'parameter %r was not provided' % arg.name,
+                    arg.name))
+            else:
+                self.writeline('%s = ' % ref)
+                self.visit(default, frame)
+            self.mark_parameter_stored(ref)
+            self.outdent()
+        self.pop_parameter_definitions()
+
+        self.blockvisit(node.body, frame)
+        self.return_buffer_contents(frame, force_unescaped=True)
+        self.leave_frame(frame, with_python_scope=True)
+        self.outdent()
+
+        return frame, macro_ref
+
+    def macro_def(self, macro_ref, frame):
+        """Dump the macro definition for the def created by macro_body."""
+        arg_tuple = ', '.join(repr(x.name) for x in macro_ref.node.args)
+        name = getattr(macro_ref.node, 'name', None)
+        if len(macro_ref.node.args) == 1:
+            arg_tuple += ','
+        self.write('Macro(environment, macro, %r, (%s), %r, %r, %r, '
+                   'context.eval_ctx.autoescape)' %
+                   (name, arg_tuple, macro_ref.accesses_kwargs,
+                    macro_ref.accesses_varargs, macro_ref.accesses_caller))
+
+    def position(self, node):
+        """Return a human readable position for the node."""
+        rv = 'line %d' % node.lineno
+        if self.name is not None:
+            rv += ' in ' + repr(self.name)
+        return rv
+
+    def dump_local_context(self, frame):
+        return '{%s}' % ', '.join(
+            '%r: %s' % (name, target) for name, target
+            in iteritems(frame.symbols.dump_stores()))
+
+    def write_commons(self):
+        """Writes a common preamble that is used by root and block functions.
+        Primarily this sets up common local helpers and enforces a generator
+        through a dead branch.
+        """
+        self.writeline('resolve = context.resolve_or_missing')
+        self.writeline('undefined = environment.undefined')
+        self.writeline('if 0: yield None')
+
+    def push_parameter_definitions(self, frame):
+        """Pushes all parameter targets from the given frame into a local
+        stack that permits tracking of yet to be assigned parameters.  In
+        particular this enables the optimization from `visit_Name` to skip
+        undefined expressions for parameters in macros as macros can reference
+        otherwise unbound parameters.
+        """
+        self._param_def_block.append(frame.symbols.dump_param_targets())
+
+    def pop_parameter_definitions(self):
+        """Pops the current parameter definitions set."""
+        self._param_def_block.pop()
+
+    def mark_parameter_stored(self, target):
+        """Marks a parameter in the current parameter definitions as stored.
+        This will skip the enforced undefined checks.
+        """
+        if self._param_def_block:
+            self._param_def_block[-1].discard(target)
+
+    def push_context_reference(self, target):
+        self._context_reference_stack.append(target)
+
+    def pop_context_reference(self):
+        self._context_reference_stack.pop()
+
+    def get_context_ref(self):
+        return self._context_reference_stack[-1]
+
+    def get_resolve_func(self):
+        target = self._context_reference_stack[-1]
+        if target == 'context':
+            return 'resolve'
+        return '%s.resolve' % target
+
+    def derive_context(self, frame):
+        return '%s.derived(%s)' % (
+            self.get_context_ref(),
+            self.dump_local_context(frame),
+        )
+
+    def parameter_is_undeclared(self, target):
+        """Checks if a given target is an undeclared parameter."""
+        if not self._param_def_block:
+            return False
+        return target in self._param_def_block[-1]
+
+    def push_assign_tracking(self):
+        """Pushes a new layer for assignment tracking."""
+        self._assign_stack.append(set())
+
+    def pop_assign_tracking(self, frame):
+        """Pops the topmost level for assignment tracking and updates the
+        context variables if necessary.
+        """
+        vars = self._assign_stack.pop()
+        if not frame.toplevel or not vars:
+            return
+        public_names = [x for x in vars if x[:1] != '_']
+        if len(vars) == 1:
+            name = next(iter(vars))
+            ref = frame.symbols.ref(name)
+            self.writeline('context.vars[%r] = %s' % (name, ref))
+        else:
+            self.writeline('context.vars.update({')
+            for idx, name in enumerate(vars):
+                if idx:
+                    self.write(', ')
+                ref = frame.symbols.ref(name)
+                self.write('%r: %s' % (name, ref))
+            self.write('})')
+        if public_names:
+            if len(public_names) == 1:
+                self.writeline('context.exported_vars.add(%r)' %
+                               public_names[0])
+            else:
+                self.writeline('context.exported_vars.update((%s))' %
+                               ', '.join(imap(repr, public_names)))
+
+    # -- Statement Visitors
+
+    def visit_Template(self, node, frame=None):
+        assert frame is None, 'no root frame allowed'
+        eval_ctx = EvalContext(self.environment, self.name)
+
+        from jinja2.runtime import __all__ as exported
+        self.writeline('from __future__ import %s' % ', '.join(code_features))
+        self.writeline('from jinja2.runtime import ' + ', '.join(exported))
+
+        if self.environment.is_async:
+            self.writeline('from jinja2.asyncsupport import auto_await, '
+                           'auto_aiter, make_async_loop_context')
+
+        # if we want a deferred initialization we cannot move the
+        # environment into a local name
+        envenv = not self.defer_init and ', environment=environment' or ''
+
+        # do we have an extends tag at all?  If not, we can save some
+        # overhead by just not processing any inheritance code.
+        have_extends = node.find(nodes.Extends) is not None
+
+        # find all blocks
+        for block in node.find_all(nodes.Block):
+            if block.name in self.blocks:
+                self.fail('block %r defined twice' % block.name, block.lineno)
+            self.blocks[block.name] = block
+
+        # find all imports and import them
+        for import_ in node.find_all(nodes.ImportedName):
+            if import_.importname not in self.import_aliases:
+                imp = import_.importname
+                self.import_aliases[imp] = alias = self.temporary_identifier()
+                if '.' in imp:
+                    module, obj = imp.rsplit('.', 1)
+                    self.writeline('from %s import %s as %s' %
+                                   (module, obj, alias))
+                else:
+                    self.writeline('import %s as %s' % (imp, alias))
+
+        # add the load name
+        self.writeline('name = %r' % self.name)
+
+        # generate the root render function.
+        self.writeline('%s(context, missing=missing%s):' %
+                       (self.func('root'), envenv), extra=1)
+        self.indent()
+        self.write_commons()
+
+        # process the root
+        frame = Frame(eval_ctx)
+        if 'self' in find_undeclared(node.body, ('self',)):
+            ref = frame.symbols.declare_parameter('self')
+            self.writeline('%s = TemplateReference(context)' % ref)
+        frame.symbols.analyze_node(node)
+        frame.toplevel = frame.rootlevel = True
+        frame.require_output_check = have_extends and not self.has_known_extends
+        if have_extends:
+            self.writeline('parent_template = None')
+        self.enter_frame(frame)
+        self.pull_dependencies(node.body)
+        self.blockvisit(node.body, frame)
+        self.leave_frame(frame, with_python_scope=True)
+        self.outdent()
+
+        # make sure that the parent root is called.
+        if have_extends:
+            if not self.has_known_extends:
+                self.indent()
+                self.writeline('if parent_template is not None:')
+            self.indent()
+            if supports_yield_from and not self.environment.is_async:
+                self.writeline('yield from parent_template.'
+                               'root_render_func(context)')
+            else:
+                self.writeline('%sfor event in parent_template.'
+                               'root_render_func(context):' %
+                               (self.environment.is_async and 'async ' or ''))
+                self.indent()
+                self.writeline('yield event')
+                self.outdent()
+            self.outdent(1 + (not self.has_known_extends))
+
+        # at this point we now have the blocks collected and can visit them too.
+        for name, block in iteritems(self.blocks):
+            self.writeline('%s(context, missing=missing%s):' %
+                           (self.func('block_' + name), envenv),
+                           block, 1)
+            self.indent()
+            self.write_commons()
+            # It's important that we do not make this frame a child of the
+            # toplevel template.  This would cause a variety of
+            # interesting issues with identifier tracking.
+            block_frame = Frame(eval_ctx)
+            undeclared = find_undeclared(block.body, ('self', 'super'))
+            if 'self' in undeclared:
+                ref = block_frame.symbols.declare_parameter('self')
+                self.writeline('%s = TemplateReference(context)' % ref)
+            if 'super' in undeclared:
+                ref = block_frame.symbols.declare_parameter('super')
+                self.writeline('%s = context.super(%r, '
+                               'block_%s)' % (ref, name, name))
+            block_frame.symbols.analyze_node(block)
+            block_frame.block = name
+            self.enter_frame(block_frame)
+            self.pull_dependencies(block.body)
+            self.blockvisit(block.body, block_frame)
+            self.leave_frame(block_frame, with_python_scope=True)
+            self.outdent()
+
+        self.writeline('blocks = {%s}' % ', '.join('%r: block_%s' % (x, x)
+                                                   for x in self.blocks),
+                       extra=1)
+
+        # add a function that returns the debug info
+        self.writeline('debug_info = %r' % '&'.join('%s=%s' % x for x
+                                                    in self.debug_info))
+
+    def visit_Block(self, node, frame):
+        """Call a block and register it for the template."""
+        level = 0
+        if frame.toplevel:
+            # if we know that we are a child template, there is no need to
+            # check if we are one
+            if self.has_known_extends:
+                return
+            if self.extends_so_far > 0:
+                self.writeline('if parent_template is None:')
+                self.indent()
+                level += 1
+
+        if node.scoped:
+            context = self.derive_context(frame)
+        else:
+            context = self.get_context_ref()
+
+        if supports_yield_from and not self.environment.is_async and \
+           frame.buffer is None:
+            self.writeline('yield from context.blocks[%r][0](%s)' % (
+                           node.name, context), node)
+        else:
+            loop = self.environment.is_async and 'async for' or 'for'
+            self.writeline('%s event in context.blocks[%r][0](%s):' % (
+                           loop, node.name, context), node)
+            self.indent()
+            self.simple_write('event', frame)
+            self.outdent()
+
+        self.outdent(level)
+
+    def visit_Extends(self, node, frame):
+        """Calls the extender."""
+        if not frame.toplevel:
+            self.fail('cannot use extend from a non top-level scope',
+                      node.lineno)
+
+        # if the number of extends statements in general is zero so
+        # far, we don't have to add a check if something extended
+        # the template before this one.
+        if self.extends_so_far > 0:
+
+            # if we have a known extends we just add a template runtime
+            # error into the generated code.  We could catch that at compile
+            # time too, but i welcome it not to confuse users by throwing the
+            # same error at different times just "because we can".
+            if not self.has_known_extends:
+                self.writeline('if parent_template is not None:')
+                self.indent()
+            self.writeline('raise TemplateRuntimeError(%r)' %
+                           'extended multiple times')
+
+            # if we have a known extends already we don't need that code here
+            # as we know that the template execution will end here.
+            if self.has_known_extends:
+                raise CompilerExit()
+            else:
+                self.outdent()
+
+        self.writeline('parent_template = environment.get_template(', node)
+        self.visit(node.template, frame)
+        self.write(', %r)' % self.name)
+        self.writeline('for name, parent_block in parent_template.'
+                       'blocks.%s():' % dict_item_iter)
+        self.indent()
+        self.writeline('context.blocks.setdefault(name, []).'
+                       'append(parent_block)')
+        self.outdent()
+
+        # if this extends statement was in the root level we can take
+        # advantage of that information and simplify the generated code
+        # in the top level from this point onwards
+        if frame.rootlevel:
+            self.has_known_extends = True
+
+        # and now we have one more
+        self.extends_so_far += 1
+
+    def visit_Include(self, node, frame):
+        """Handles includes."""
+        if node.ignore_missing:
+            self.writeline('try:')
+            self.indent()
+
+        func_name = 'get_or_select_template'
+        if isinstance(node.template, nodes.Const):
+            if isinstance(node.template.value, string_types):
+                func_name = 'get_template'
+            elif isinstance(node.template.value, (tuple, list)):
+                func_name = 'select_template'
+        elif isinstance(node.template, (nodes.Tuple, nodes.List)):
+            func_name = 'select_template'
+
+        self.writeline('template = environment.%s(' % func_name, node)
+        self.visit(node.template, frame)
+        self.write(', %r)' % self.name)
+        if node.ignore_missing:
+            self.outdent()
+            self.writeline('except TemplateNotFound:')
+            self.indent()
+            self.writeline('pass')
+            self.outdent()
+            self.writeline('else:')
+            self.indent()
+
+        skip_event_yield = False
+        if node.with_context:
+            loop = self.environment.is_async and 'async for' or 'for'
+            self.writeline('%s event in template.root_render_func('
+                           'template.new_context(context.get_all(), True, '
+                           '%s)):' % (loop, self.dump_local_context(frame)))
+        elif self.environment.is_async:
+            self.writeline('for event in (await '
+                           'template._get_default_module_async())'
+                           '._body_stream:')
+        else:
+            if supports_yield_from:
+                self.writeline('yield from template._get_default_module()'
+                               '._body_stream')
+                skip_event_yield = True
+            else:
+                self.writeline('for event in template._get_default_module()'
+                               '._body_stream:')
+
+        if not skip_event_yield:
+            self.indent()
+            self.simple_write('event', frame)
+            self.outdent()
+
+        if node.ignore_missing:
+            self.outdent()
+
+    def visit_Import(self, node, frame):
+        """Visit regular imports."""
+        self.writeline('%s = ' % frame.symbols.ref(node.target), node)
+        if frame.toplevel:
+            self.write('context.vars[%r] = ' % node.target)
+        if self.environment.is_async:
+            self.write('await ')
+        self.write('environment.get_template(')
+        self.visit(node.template, frame)
+        self.write(', %r).' % self.name)
+        if node.with_context:
+            self.write('make_module%s(context.get_all(), True, %s)'
+                       % (self.environment.is_async and '_async' or '',
+                          self.dump_local_context(frame)))
+        elif self.environment.is_async:
+            self.write('_get_default_module_async()')
+        else:
+            self.write('_get_default_module()')
+        if frame.toplevel and not node.target.startswith('_'):
+            self.writeline('context.exported_vars.discard(%r)' % node.target)
+
+    def visit_FromImport(self, node, frame):
+        """Visit named imports."""
+        self.newline(node)
+        self.write('included_template = %senvironment.get_template('
+                   % (self.environment.is_async and 'await ' or ''))
+        self.visit(node.template, frame)
+        self.write(', %r).' % self.name)
+        if node.with_context:
+            self.write('make_module%s(context.get_all(), True, %s)'
+                       % (self.environment.is_async and '_async' or '',
+                          self.dump_local_context(frame)))
+        elif self.environment.is_async:
+            self.write('_get_default_module_async()')
+        else:
+            self.write('_get_default_module()')
+
+        var_names = []
+        discarded_names = []
+        for name in node.names:
+            if isinstance(name, tuple):
+                name, alias = name
+            else:
+                alias = name
+            self.writeline('%s = getattr(included_template, '
+                           '%r, missing)' % (frame.symbols.ref(alias), name))
+            self.writeline('if %s is missing:' % frame.symbols.ref(alias))
+            self.indent()
+            self.writeline('%s = undefined(%r %% '
+                           'included_template.__name__, '
+                           'name=%r)' %
+                           (frame.symbols.ref(alias),
+                            'the template %%r (imported on %s) does '
+                            'not export the requested name %s' % (
+                                self.position(node),
+                                repr(name)
+                           ), name))
+            self.outdent()
+            if frame.toplevel:
+                var_names.append(alias)
+                if not alias.startswith('_'):
+                    discarded_names.append(alias)
+
+        if var_names:
+            if len(var_names) == 1:
+                name = var_names[0]
+                self.writeline('context.vars[%r] = %s' %
+                               (name, frame.symbols.ref(name)))
+            else:
+                self.writeline('context.vars.update({%s})' % ', '.join(
+                    '%r: %s' % (name, frame.symbols.ref(name)) for name in var_names
+                ))
+        if discarded_names:
+            if len(discarded_names) == 1:
+                self.writeline('context.exported_vars.discard(%r)' %
+                               discarded_names[0])
+            else:
+                self.writeline('context.exported_vars.difference_'
+                               'update((%s))' % ', '.join(imap(repr, discarded_names)))
+
+    def visit_For(self, node, frame):
+        loop_frame = frame.inner()
+        test_frame = frame.inner()
+        else_frame = frame.inner()
+
+        # try to figure out if we have an extended loop.  An extended loop
+        # is necessary if the loop is in recursive mode if the special loop
+        # variable is accessed in the body.
+        extended_loop = node.recursive or 'loop' in \
+                        find_undeclared(node.iter_child_nodes(
+                            only=('body',)), ('loop',))
+
+        loop_ref = None
+        if extended_loop:
+            loop_ref = loop_frame.symbols.declare_parameter('loop')
+
+        loop_frame.symbols.analyze_node(node, for_branch='body')
+        if node.else_:
+            else_frame.symbols.analyze_node(node, for_branch='else')
+
+        if node.test:
+            loop_filter_func = self.temporary_identifier()
+            test_frame.symbols.analyze_node(node, for_branch='test')
+            self.writeline('%s(fiter):' % self.func(loop_filter_func), node.test)
+            self.indent()
+            self.enter_frame(test_frame)
+            self.writeline(self.environment.is_async and 'async for ' or 'for ')
+            self.visit(node.target, loop_frame)
+            self.write(' in ')
+            self.write(self.environment.is_async and 'auto_aiter(fiter)' or 'fiter')
+            self.write(':')
+            self.indent()
+            self.writeline('if ', node.test)
+            self.visit(node.test, test_frame)
+            self.write(':')
+            self.indent()
+            self.writeline('yield ')
+            self.visit(node.target, loop_frame)
+            self.outdent(3)
+            self.leave_frame(test_frame, with_python_scope=True)
+
+        # if we don't have an recursive loop we have to find the shadowed
+        # variables at that point.  Because loops can be nested but the loop
+        # variable is a special one we have to enforce aliasing for it.
+        if node.recursive:
+            self.writeline('%s(reciter, loop_render_func, depth=0):' %
+                           self.func('loop'), node)
+            self.indent()
+            self.buffer(loop_frame)
+
+            # Use the same buffer for the else frame
+            else_frame.buffer = loop_frame.buffer
+
+        # make sure the loop variable is a special one and raise a template
+        # assertion error if a loop tries to write to loop
+        if extended_loop:
+            self.writeline('%s = missing' % loop_ref)
+
+        for name in node.find_all(nodes.Name):
+            if name.ctx == 'store' and name.name == 'loop':
+                self.fail('Can\'t assign to special loop variable '
+                          'in for-loop target', name.lineno)
+
+        if node.else_:
+            iteration_indicator = self.temporary_identifier()
+            self.writeline('%s = 1' % iteration_indicator)
+
+        self.writeline(self.environment.is_async and 'async for ' or 'for ', node)
+        self.visit(node.target, loop_frame)
+        if extended_loop:
+            if self.environment.is_async:
+                self.write(', %s in await make_async_loop_context(' % loop_ref)
+            else:
+                self.write(', %s in LoopContext(' % loop_ref)
+        else:
+            self.write(' in ')
+
+        if node.test:
+            self.write('%s(' % loop_filter_func)
+        if node.recursive:
+            self.write('reciter')
+        else:
+            if self.environment.is_async and not extended_loop:
+                self.write('auto_aiter(')
+            self.visit(node.iter, frame)
+            if self.environment.is_async and not extended_loop:
+                self.write(')')
+        if node.test:
+            self.write(')')
+
+        if node.recursive:
+            self.write(', undefined, loop_render_func, depth):')
+        else:
+            self.write(extended_loop and ', undefined):' or ':')
+
+        self.indent()
+        self.enter_frame(loop_frame)
+
+        self.blockvisit(node.body, loop_frame)
+        if node.else_:
+            self.writeline('%s = 0' % iteration_indicator)
+        self.outdent()
+        self.leave_frame(loop_frame, with_python_scope=node.recursive
+                         and not node.else_)
+
+        if node.else_:
+            self.writeline('if %s:' % iteration_indicator)
+            self.indent()
+            self.enter_frame(else_frame)
+            self.blockvisit(node.else_, else_frame)
+            self.leave_frame(else_frame)
+            self.outdent()
+
+        # if the node was recursive we have to return the buffer contents
+        # and start the iteration code
+        if node.recursive:
+            self.return_buffer_contents(loop_frame)
+            self.outdent()
+            self.start_write(frame, node)
+            if self.environment.is_async:
+                self.write('await ')
+            self.write('loop(')
+            if self.environment.is_async:
+                self.write('auto_aiter(')
+            self.visit(node.iter, frame)
+            if self.environment.is_async:
+                self.write(')')
+            self.write(', loop)')
+            self.end_write(frame)
+
+    def visit_If(self, node, frame):
+        if_frame = frame.soft()
+        self.writeline('if ', node)
+        self.visit(node.test, if_frame)
+        self.write(':')
+        self.indent()
+        self.blockvisit(node.body, if_frame)
+        self.outdent()
+        for elif_ in node.elif_:
+            self.writeline('elif ', elif_)
+            self.visit(elif_.test, if_frame)
+            self.write(':')
+            self.indent()
+            self.blockvisit(elif_.body, if_frame)
+            self.outdent()
+        if node.else_:
+            self.writeline('else:')
+            self.indent()
+            self.blockvisit(node.else_, if_frame)
+            self.outdent()
+
+    def visit_Macro(self, node, frame):
+        macro_frame, macro_ref = self.macro_body(node, frame)
+        self.newline()
+        if frame.toplevel:
+            if not node.name.startswith('_'):
+                self.write('context.exported_vars.add(%r)' % node.name)
+            ref = frame.symbols.ref(node.name)
+            self.writeline('context.vars[%r] = ' % node.name)
+        self.write('%s = ' % frame.symbols.ref(node.name))
+        self.macro_def(macro_ref, macro_frame)
+
+    def visit_CallBlock(self, node, frame):
+        call_frame, macro_ref = self.macro_body(node, frame)
+        self.writeline('caller = ')
+        self.macro_def(macro_ref, call_frame)
+        self.start_write(frame, node)
+        self.visit_Call(node.call, frame, forward_caller=True)
+        self.end_write(frame)
+
+    def visit_FilterBlock(self, node, frame):
+        filter_frame = frame.inner()
+        filter_frame.symbols.analyze_node(node)
+        self.enter_frame(filter_frame)
+        self.buffer(filter_frame)
+        self.blockvisit(node.body, filter_frame)
+        self.start_write(frame, node)
+        self.visit_Filter(node.filter, filter_frame)
+        self.end_write(frame)
+        self.leave_frame(filter_frame)
+
+    def visit_With(self, node, frame):
+        with_frame = frame.inner()
+        with_frame.symbols.analyze_node(node)
+        self.enter_frame(with_frame)
+        for idx, (target, expr) in enumerate(izip(node.targets, node.values)):
+            self.newline()
+            self.visit(target, with_frame)
+            self.write(' = ')
+            self.visit(expr, frame)
+        self.blockvisit(node.body, with_frame)
+        self.leave_frame(with_frame)
+
+    def visit_ExprStmt(self, node, frame):
+        self.newline(node)
+        self.visit(node.node, frame)
+
+    def visit_Output(self, node, frame):
+        # if we have a known extends statement, we don't output anything
+        # if we are in a require_output_check section
+        if self.has_known_extends and frame.require_output_check:
+            return
+
+        allow_constant_finalize = True
+        if self.environment.finalize:
+            func = self.environment.finalize
+            if getattr(func, 'contextfunction', False) or \
+               getattr(func, 'evalcontextfunction', False):
+                allow_constant_finalize = False
+            elif getattr(func, 'environmentfunction', False):
+                finalize = lambda x: text_type(
+                    self.environment.finalize(self.environment, x))
+            else:
+                finalize = lambda x: text_type(self.environment.finalize(x))
+        else:
+            finalize = text_type
+
+        # if we are inside a frame that requires output checking, we do so
+        outdent_later = False
+        if frame.require_output_check:
+            self.writeline('if parent_template is None:')
+            self.indent()
+            outdent_later = True
+
+        # try to evaluate as many chunks as possible into a static
+        # string at compile time.
+        body = []
+        for child in node.nodes:
+            try:
+                if not allow_constant_finalize:
+                    raise nodes.Impossible()
+                const = child.as_const(frame.eval_ctx)
+            except nodes.Impossible:
+                body.append(child)
+                continue
+            # the frame can't be volatile here, becaus otherwise the
+            # as_const() function would raise an Impossible exception
+            # at that point.
+            try:
+                if frame.eval_ctx.autoescape:
+                    if hasattr(const, '__html__'):
+                        const = const.__html__()
+                    else:
+                        const = escape(const)
+                const = finalize(const)
+            except Exception:
+                # if something goes wrong here we evaluate the node
+                # at runtime for easier debugging
+                body.append(child)
+                continue
+            if body and isinstance(body[-1], list):
+                body[-1].append(const)
+            else:
+                body.append([const])
+
+        # if we have less than 3 nodes or a buffer we yield or extend/append
+        if len(body) < 3 or frame.buffer is not None:
+            if frame.buffer is not None:
+                # for one item we append, for more we extend
+                if len(body) == 1:
+                    self.writeline('%s.append(' % frame.buffer)
+                else:
+                    self.writeline('%s.extend((' % frame.buffer)
+                self.indent()
+            for item in body:
+                if isinstance(item, list):
+                    val = repr(concat(item))
+                    if frame.buffer is None:
+                        self.writeline('yield ' + val)
+                    else:
+                        self.writeline(val + ',')
+                else:
+                    if frame.buffer is None:
+                        self.writeline('yield ', item)
+                    else:
+                        self.newline(item)
+                    close = 1
+                    if frame.eval_ctx.volatile:
+                        self.write('(escape if context.eval_ctx.autoescape'
+                                   ' else to_string)(')
+                    elif frame.eval_ctx.autoescape:
+                        self.write('escape(')
+                    else:
+                        self.write('to_string(')
+                    if self.environment.finalize is not None:
+                        self.write('environment.finalize(')
+                        if getattr(self.environment.finalize,
+                                   "contextfunction", False):
+                            self.write('context, ')
+                        close += 1
+                    self.visit(item, frame)
+                    self.write(')' * close)
+                    if frame.buffer is not None:
+                        self.write(',')
+            if frame.buffer is not None:
+                # close the open parentheses
+                self.outdent()
+                self.writeline(len(body) == 1 and ')' or '))')
+
+        # otherwise we create a format string as this is faster in that case
+        else:
+            format = []
+            arguments = []
+            for item in body:
+                if isinstance(item, list):
+                    format.append(concat(item).replace('%', '%%'))
+                else:
+                    format.append('%s')
+                    arguments.append(item)
+            self.writeline('yield ')
+            self.write(repr(concat(format)) + ' % (')
+            self.indent()
+            for argument in arguments:
+                self.newline(argument)
+                close = 0
+                if frame.eval_ctx.volatile:
+                    self.write('(escape if context.eval_ctx.autoescape else'
+                               ' to_string)(')
+                    close += 1
+                elif frame.eval_ctx.autoescape:
+                    self.write('escape(')
+                    close += 1
+                if self.environment.finalize is not None:
+                    self.write('environment.finalize(')
+                    if getattr(self.environment.finalize,
+                               'contextfunction', False):
+                        self.write('context, ')
+                    elif getattr(self.environment.finalize,
+                               'evalcontextfunction', False):
+                        self.write('context.eval_ctx, ')
+                    elif getattr(self.environment.finalize,
+                               'environmentfunction', False):
+                        self.write('environment, ')
+                    close += 1
+                self.visit(argument, frame)
+                self.write(')' * close + ', ')
+            self.outdent()
+            self.writeline(')')
+
+        if outdent_later:
+            self.outdent()
+
+    def visit_Assign(self, node, frame):
+        self.push_assign_tracking()
+        self.newline(node)
+        self.visit(node.target, frame)
+        self.write(' = ')
+        self.visit(node.node, frame)
+        self.pop_assign_tracking(frame)
+
+    def visit_AssignBlock(self, node, frame):
+        self.push_assign_tracking()
+        block_frame = frame.inner()
+        # This is a special case.  Since a set block always captures we
+        # will disable output checks.  This way one can use set blocks
+        # toplevel even in extended templates.
+        block_frame.require_output_check = False
+        block_frame.symbols.analyze_node(node)
+        self.enter_frame(block_frame)
+        self.buffer(block_frame)
+        self.blockvisit(node.body, block_frame)
+        self.newline(node)
+        self.visit(node.target, frame)
+        self.write(' = (Markup if context.eval_ctx.autoescape '
+                   'else identity)(')
+        if node.filter is not None:
+            self.visit_Filter(node.filter, block_frame)
+        else:
+            self.write('concat(%s)' % block_frame.buffer)
+        self.write(')')
+        self.pop_assign_tracking(frame)
+        self.leave_frame(block_frame)
+
+    # -- Expression Visitors
+
+    def visit_Name(self, node, frame):
+        if node.ctx == 'store' and frame.toplevel:
+            if self._assign_stack:
+                self._assign_stack[-1].add(node.name)
+        ref = frame.symbols.ref(node.name)
+
+        # If we are looking up a variable we might have to deal with the
+        # case where it's undefined.  We can skip that case if the load
+        # instruction indicates a parameter which are always defined.
+        if node.ctx == 'load':
+            load = frame.symbols.find_load(ref)
+            if not (load is not None and load[0] == VAR_LOAD_PARAMETER and \
+                    not self.parameter_is_undeclared(ref)):
+                self.write('(undefined(name=%r) if %s is missing else %s)' %
+                           (node.name, ref, ref))
+                return
+
+        self.write(ref)
+
+    def visit_NSRef(self, node, frame):
+        # NSRefs can only be used to store values; since they use the normal
+        # `foo.bar` notation they will be parsed as a normal attribute access
+        # when used anywhere but in a `set` context
+        ref = frame.symbols.ref(node.name)
+        self.writeline('if not isinstance(%s, Namespace):' % ref)
+        self.indent()
+        self.writeline('raise TemplateRuntimeError(%r)' %
+                       'cannot assign attribute on non-namespace object')
+        self.outdent()
+        self.writeline('%s[%r]' % (ref, node.attr))
+
+    def visit_Const(self, node, frame):
+        val = node.as_const(frame.eval_ctx)
+        if isinstance(val, float):
+            self.write(str(val))
+        else:
+            self.write(repr(val))
+
+    def visit_TemplateData(self, node, frame):
+        try:
+            self.write(repr(node.as_const(frame.eval_ctx)))
+        except nodes.Impossible:
+            self.write('(Markup if context.eval_ctx.autoescape else identity)(%r)'
+                       % node.data)
+
+    def visit_Tuple(self, node, frame):
+        self.write('(')
+        idx = -1
+        for idx, item in enumerate(node.items):
+            if idx:
+                self.write(', ')
+            self.visit(item, frame)
+        self.write(idx == 0 and ',)' or ')')
+
+    def visit_List(self, node, frame):
+        self.write('[')
+        for idx, item in enumerate(node.items):
+            if idx:
+                self.write(', ')
+            self.visit(item, frame)
+        self.write(']')
+
+    def visit_Dict(self, node, frame):
+        self.write('{')
+        for idx, item in enumerate(node.items):
+            if idx:
+                self.write(', ')
+            self.visit(item.key, frame)
+            self.write(': ')
+            self.visit(item.value, frame)
+        self.write('}')
+
+    def binop(operator, interceptable=True):
+        @optimizeconst
+        def visitor(self, node, frame):
+            if self.environment.sandboxed and \
+               operator in self.environment.intercepted_binops:
+                self.write('environment.call_binop(context, %r, ' % operator)
+                self.visit(node.left, frame)
+                self.write(', ')
+                self.visit(node.right, frame)
+            else:
+                self.write('(')
+                self.visit(node.left, frame)
+                self.write(' %s ' % operator)
+                self.visit(node.right, frame)
+            self.write(')')
+        return visitor
+
+    def uaop(operator, interceptable=True):
+        @optimizeconst
+        def visitor(self, node, frame):
+            if self.environment.sandboxed and \
+               operator in self.environment.intercepted_unops:
+                self.write('environment.call_unop(context, %r, ' % operator)
+                self.visit(node.node, frame)
+            else:
+                self.write('(' + operator)
+                self.visit(node.node, frame)
+            self.write(')')
+        return visitor
+
+    visit_Add = binop('+')
+    visit_Sub = binop('-')
+    visit_Mul = binop('*')
+    visit_Div = binop('/')
+    visit_FloorDiv = binop('//')
+    visit_Pow = binop('**')
+    visit_Mod = binop('%')
+    visit_And = binop('and', interceptable=False)
+    visit_Or = binop('or', interceptable=False)
+    visit_Pos = uaop('+')
+    visit_Neg = uaop('-')
+    visit_Not = uaop('not ', interceptable=False)
+    del binop, uaop
+
+    @optimizeconst
+    def visit_Concat(self, node, frame):
+        if frame.eval_ctx.volatile:
+            func_name = '(context.eval_ctx.volatile and' \
+                        ' markup_join or unicode_join)'
+        elif frame.eval_ctx.autoescape:
+            func_name = 'markup_join'
+        else:
+            func_name = 'unicode_join'
+        self.write('%s((' % func_name)
+        for arg in node.nodes:
+            self.visit(arg, frame)
+            self.write(', ')
+        self.write('))')
+
+    @optimizeconst
+    def visit_Compare(self, node, frame):
+        self.visit(node.expr, frame)
+        for op in node.ops:
+            self.visit(op, frame)
+
+    def visit_Operand(self, node, frame):
+        self.write(' %s ' % operators[node.op])
+        self.visit(node.expr, frame)
+
+    @optimizeconst
+    def visit_Getattr(self, node, frame):
+        self.write('environment.getattr(')
+        self.visit(node.node, frame)
+        self.write(', %r)' % node.attr)
+
+    @optimizeconst
+    def visit_Getitem(self, node, frame):
+        # slices bypass the environment getitem method.
+        if isinstance(node.arg, nodes.Slice):
+            self.visit(node.node, frame)
+            self.write('[')
+            self.visit(node.arg, frame)
+            self.write(']')
+        else:
+            self.write('environment.getitem(')
+            self.visit(node.node, frame)
+            self.write(', ')
+            self.visit(node.arg, frame)
+            self.write(')')
+
+    def visit_Slice(self, node, frame):
+        if node.start is not None:
+            self.visit(node.start, frame)
+        self.write(':')
+        if node.stop is not None:
+            self.visit(node.stop, frame)
+        if node.step is not None:
+            self.write(':')
+            self.visit(node.step, frame)
+
+    @optimizeconst
+    def visit_Filter(self, node, frame):
+        if self.environment.is_async:
+            self.write('await auto_await(')
+        self.write(self.filters[node.name] + '(')
+        func = self.environment.filters.get(node.name)
+        if func is None:
+            self.fail('no filter named %r' % node.name, node.lineno)
+        if getattr(func, 'contextfilter', False):
+            self.write('context, ')
+        elif getattr(func, 'evalcontextfilter', False):
+            self.write('context.eval_ctx, ')
+        elif getattr(func, 'environmentfilter', False):
+            self.write('environment, ')
+
+        # if the filter node is None we are inside a filter block
+        # and want to write to the current buffer
+        if node.node is not None:
+            self.visit(node.node, frame)
+        elif frame.eval_ctx.volatile:
+            self.write('(context.eval_ctx.autoescape and'
+                       ' Markup(concat(%s)) or concat(%s))' %
+                       (frame.buffer, frame.buffer))
+        elif frame.eval_ctx.autoescape:
+            self.write('Markup(concat(%s))' % frame.buffer)
+        else:
+            self.write('concat(%s)' % frame.buffer)
+        self.signature(node, frame)
+        self.write(')')
+        if self.environment.is_async:
+            self.write(')')
+
+    @optimizeconst
+    def visit_Test(self, node, frame):
+        self.write(self.tests[node.name] + '(')
+        if node.name not in self.environment.tests:
+            self.fail('no test named %r' % node.name, node.lineno)
+        self.visit(node.node, frame)
+        self.signature(node, frame)
+        self.write(')')
+
+    @optimizeconst
+    def visit_CondExpr(self, node, frame):
+        def write_expr2():
+            if node.expr2 is not None:
+                return self.visit(node.expr2, frame)
+            self.write('undefined(%r)' % ('the inline if-'
+                       'expression on %s evaluated to false and '
+                       'no else section was defined.' % self.position(node)))
+
+        self.write('(')
+        self.visit(node.expr1, frame)
+        self.write(' if ')
+        self.visit(node.test, frame)
+        self.write(' else ')
+        write_expr2()
+        self.write(')')
+
+    @optimizeconst
+    def visit_Call(self, node, frame, forward_caller=False):
+        if self.environment.is_async:
+            self.write('await auto_await(')
+        if self.environment.sandboxed:
+            self.write('environment.call(context, ')
+        else:
+            self.write('context.call(')
+        self.visit(node.node, frame)
+        extra_kwargs = forward_caller and {'caller': 'caller'} or None
+        self.signature(node, frame, extra_kwargs)
+        self.write(')')
+        if self.environment.is_async:
+            self.write(')')
+
+    def visit_Keyword(self, node, frame):
+        self.write(node.key + '=')
+        self.visit(node.value, frame)
+
+    # -- Unused nodes for extensions
+
+    def visit_MarkSafe(self, node, frame):
+        self.write('Markup(')
+        self.visit(node.expr, frame)
+        self.write(')')
+
+    def visit_MarkSafeIfAutoescape(self, node, frame):
+        self.write('(context.eval_ctx.autoescape and Markup or identity)(')
+        self.visit(node.expr, frame)
+        self.write(')')
+
+    def visit_EnvironmentAttribute(self, node, frame):
+        self.write('environment.' + node.name)
+
+    def visit_ExtensionAttribute(self, node, frame):
+        self.write('environment.extensions[%r].%s' % (node.identifier, node.name))
+
+    def visit_ImportedName(self, node, frame):
+        self.write(self.import_aliases[node.importname])
+
+    def visit_InternalName(self, node, frame):
+        self.write(node.name)
+
+    def visit_ContextReference(self, node, frame):
+        self.write('context')
+
+    def visit_Continue(self, node, frame):
+        self.writeline('continue', node)
+
+    def visit_Break(self, node, frame):
+        self.writeline('break', node)
+
+    def visit_Scope(self, node, frame):
+        scope_frame = frame.inner()
+        scope_frame.symbols.analyze_node(node)
+        self.enter_frame(scope_frame)
+        self.blockvisit(node.body, scope_frame)
+        self.leave_frame(scope_frame)
+
+    def visit_OverlayScope(self, node, frame):
+        ctx = self.temporary_identifier()
+        self.writeline('%s = %s' % (ctx, self.derive_context(frame)))
+        self.writeline('%s.vars = ' % ctx)
+        self.visit(node.context, frame)
+        self.push_context_reference(ctx)
+
+        scope_frame = frame.inner(isolated=True)
+        scope_frame.symbols.analyze_node(node)
+        self.enter_frame(scope_frame)
+        self.blockvisit(node.body, scope_frame)
+        self.leave_frame(scope_frame)
+        self.pop_context_reference()
+
+    def visit_EvalContextModifier(self, node, frame):
+        for keyword in node.options:
+            self.writeline('context.eval_ctx.%s = ' % keyword.key)
+            self.visit(keyword.value, frame)
+            try:
+                val = keyword.value.as_const(frame.eval_ctx)
+            except nodes.Impossible:
+                frame.eval_ctx.volatile = True
+            else:
+                setattr(frame.eval_ctx, keyword.key, val)
+
+    def visit_ScopedEvalContextModifier(self, node, frame):
+        old_ctx_name = self.temporary_identifier()
+        saved_ctx = frame.eval_ctx.save()
+        self.writeline('%s = context.eval_ctx.save()' % old_ctx_name)
+        self.visit_EvalContextModifier(node, frame)
+        for child in node.body:
+            self.visit(child, frame)
+        frame.eval_ctx.revert(saved_ctx)
+        self.writeline('context.eval_ctx.revert(%s)' % old_ctx_name)
diff --git a/deps/jinja2/constants.py b/deps/jinja2/constants.py
new file mode 100644
index 00000000000000..11efd1ed15832d
--- /dev/null
+++ b/deps/jinja2/constants.py
@@ -0,0 +1,32 @@
+# -*- coding: utf-8 -*-
+"""
+    jinja.constants
+    ~~~~~~~~~~~~~~~
+
+    Various constants.
+
+    :copyright: (c) 2017 by the Jinja Team.
+    :license: BSD, see LICENSE for more details.
+"""
+
+
+#: list of lorem ipsum words used by the lipsum() helper function
+LOREM_IPSUM_WORDS = u'''\
+a ac accumsan ad adipiscing aenean aliquam aliquet amet ante aptent arcu at
+auctor augue bibendum blandit class commodo condimentum congue consectetuer
+consequat conubia convallis cras cubilia cum curabitur curae cursus dapibus
+diam dictum dictumst dignissim dis dolor donec dui duis egestas eget eleifend
+elementum elit enim erat eros est et etiam eu euismod facilisi facilisis fames
+faucibus felis fermentum feugiat fringilla fusce gravida habitant habitasse hac
+hendrerit hymenaeos iaculis id imperdiet in inceptos integer interdum ipsum
+justo lacinia lacus laoreet lectus leo libero ligula litora lobortis lorem
+luctus maecenas magna magnis malesuada massa mattis mauris metus mi molestie
+mollis montes morbi mus nam nascetur natoque nec neque netus nibh nisi nisl non
+nonummy nostra nulla nullam nunc odio orci ornare parturient pede pellentesque
+penatibus per pharetra phasellus placerat platea porta porttitor posuere
+potenti praesent pretium primis proin pulvinar purus quam quis quisque rhoncus
+ridiculus risus rutrum sagittis sapien scelerisque sed sem semper senectus sit
+sociis sociosqu sodales sollicitudin suscipit suspendisse taciti tellus tempor
+tempus tincidunt torquent tortor tristique turpis ullamcorper ultrices
+ultricies urna ut varius vehicula vel velit venenatis vestibulum vitae vivamus
+viverra volutpat vulputate'''
diff --git a/deps/jinja2/debug.py b/deps/jinja2/debug.py
new file mode 100644
index 00000000000000..b61139f0cde17f
--- /dev/null
+++ b/deps/jinja2/debug.py
@@ -0,0 +1,372 @@
+# -*- coding: utf-8 -*-
+"""
+    jinja2.debug
+    ~~~~~~~~~~~~
+
+    Implements the debug interface for Jinja.  This module does some pretty
+    ugly stuff with the Python traceback system in order to achieve tracebacks
+    with correct line numbers, locals and contents.
+
+    :copyright: (c) 2017 by the Jinja Team.
+    :license: BSD, see LICENSE for more details.
+"""
+import sys
+import traceback
+from types import TracebackType, CodeType
+from jinja2.utils import missing, internal_code
+from jinja2.exceptions import TemplateSyntaxError
+from jinja2._compat import iteritems, reraise, PY2
+
+# on pypy we can take advantage of transparent proxies
+try:
+    from __pypy__ import tproxy
+except ImportError:
+    tproxy = None
+
+
+# how does the raise helper look like?
+try:
+    exec("raise TypeError, 'foo'")
+except SyntaxError:
+    raise_helper = 'raise __jinja_exception__[1]'
+except TypeError:
+    raise_helper = 'raise __jinja_exception__[0], __jinja_exception__[1]'
+
+
+class TracebackFrameProxy(object):
+    """Proxies a traceback frame."""
+
+    def __init__(self, tb):
+        self.tb = tb
+        self._tb_next = None
+
+    @property
+    def tb_next(self):
+        return self._tb_next
+
+    def set_next(self, next):
+        if tb_set_next is not None:
+            try:
+                tb_set_next(self.tb, next and next.tb or None)
+            except Exception:
+                # this function can fail due to all the hackery it does
+                # on various python implementations.  We just catch errors
+                # down and ignore them if necessary.
+                pass
+        self._tb_next = next
+
+    @property
+    def is_jinja_frame(self):
+        return '__jinja_template__' in self.tb.tb_frame.f_globals
+
+    def __getattr__(self, name):
+        return getattr(self.tb, name)
+
+
+def make_frame_proxy(frame):
+    proxy = TracebackFrameProxy(frame)
+    if tproxy is None:
+        return proxy
+    def operation_handler(operation, *args, **kwargs):
+        if operation in ('__getattribute__', '__getattr__'):
+            return getattr(proxy, args[0])
+        elif operation == '__setattr__':
+            proxy.__setattr__(*args, **kwargs)
+        else:
+            return getattr(proxy, operation)(*args, **kwargs)
+    return tproxy(TracebackType, operation_handler)
+
+
+class ProcessedTraceback(object):
+    """Holds a Jinja preprocessed traceback for printing or reraising."""
+
+    def __init__(self, exc_type, exc_value, frames):
+        assert frames, 'no frames for this traceback?'
+        self.exc_type = exc_type
+        self.exc_value = exc_value
+        self.frames = frames
+
+        # newly concatenate the frames (which are proxies)
+        prev_tb = None
+        for tb in self.frames:
+            if prev_tb is not None:
+                prev_tb.set_next(tb)
+            prev_tb = tb
+        prev_tb.set_next(None)
+
+    def render_as_text(self, limit=None):
+        """Return a string with the traceback."""
+        lines = traceback.format_exception(self.exc_type, self.exc_value,
+                                           self.frames[0], limit=limit)
+        return ''.join(lines).rstrip()
+
+    def render_as_html(self, full=False):
+        """Return a unicode string with the traceback as rendered HTML."""
+        from jinja2.debugrenderer import render_traceback
+        return u'%s\n\n<!--\n%s\n-->' % (
+            render_traceback(self, full=full),
+            self.render_as_text().decode('utf-8', 'replace')
+        )
+
+    @property
+    def is_template_syntax_error(self):
+        """`True` if this is a template syntax error."""
+        return isinstance(self.exc_value, TemplateSyntaxError)
+
+    @property
+    def exc_info(self):
+        """Exception info tuple with a proxy around the frame objects."""
+        return self.exc_type, self.exc_value, self.frames[0]
+
+    @property
+    def standard_exc_info(self):
+        """Standard python exc_info for re-raising"""
+        tb = self.frames[0]
+        # the frame will be an actual traceback (or transparent proxy) if
+        # we are on pypy or a python implementation with support for tproxy
+        if type(tb) is not TracebackType:
+            tb = tb.tb
+        return self.exc_type, self.exc_value, tb
+
+
+def make_traceback(exc_info, source_hint=None):
+    """Creates a processed traceback object from the exc_info."""
+    exc_type, exc_value, tb = exc_info
+    if isinstance(exc_value, TemplateSyntaxError):
+        exc_info = translate_syntax_error(exc_value, source_hint)
+        initial_skip = 0
+    else:
+        initial_skip = 1
+    return translate_exception(exc_info, initial_skip)
+
+
+def translate_syntax_error(error, source=None):
+    """Rewrites a syntax error to please traceback systems."""
+    error.source = source
+    error.translated = True
+    exc_info = (error.__class__, error, None)
+    filename = error.filename
+    if filename is None:
+        filename = '<unknown>'
+    return fake_exc_info(exc_info, filename, error.lineno)
+
+
+def translate_exception(exc_info, initial_skip=0):
+    """If passed an exc_info it will automatically rewrite the exceptions
+    all the way down to the correct line numbers and frames.
+    """
+    tb = exc_info[2]
+    frames = []
+
+    # skip some internal frames if wanted
+    for x in range(initial_skip):
+        if tb is not None:
+            tb = tb.tb_next
+    initial_tb = tb
+
+    while tb is not None:
+        # skip frames decorated with @internalcode.  These are internal
+        # calls we can't avoid and that are useless in template debugging
+        # output.
+        if tb.tb_frame.f_code in internal_code:
+            tb = tb.tb_next
+            continue
+
+        # save a reference to the next frame if we override the current
+        # one with a faked one.
+        next = tb.tb_next
+
+        # fake template exceptions
+        template = tb.tb_frame.f_globals.get('__jinja_template__')
+        if template is not None:
+            lineno = template.get_corresponding_lineno(tb.tb_lineno)
+            tb = fake_exc_info(exc_info[:2] + (tb,), template.filename,
+                               lineno)[2]
+
+        frames.append(make_frame_proxy(tb))
+        tb = next
+
+    # if we don't have any exceptions in the frames left, we have to
+    # reraise it unchanged.
+    # XXX: can we backup here?  when could this happen?
+    if not frames:
+        reraise(exc_info[0], exc_info[1], exc_info[2])
+
+    return ProcessedTraceback(exc_info[0], exc_info[1], frames)
+
+
+def get_jinja_locals(real_locals):
+    ctx = real_locals.get('context')
+    if ctx:
+        locals = ctx.get_all().copy()
+    else:
+        locals = {}
+
+    local_overrides = {}
+
+    for name, value in iteritems(real_locals):
+        if not name.startswith('l_') or value is missing:
+            continue
+        try:
+            _, depth, name = name.split('_', 2)
+            depth = int(depth)
+        except ValueError:
+            continue
+        cur_depth = local_overrides.get(name, (-1,))[0]
+        if cur_depth < depth:
+            local_overrides[name] = (depth, value)
+
+    for name, (_, value) in iteritems(local_overrides):
+        if value is missing:
+            locals.pop(name, None)
+        else:
+            locals[name] = value
+
+    return locals
+
+
+def fake_exc_info(exc_info, filename, lineno):
+    """Helper for `translate_exception`."""
+    exc_type, exc_value, tb = exc_info
+
+    # figure the real context out
+    if tb is not None:
+        locals = get_jinja_locals(tb.tb_frame.f_locals)
+
+        # if there is a local called __jinja_exception__, we get
+        # rid of it to not break the debug functionality.
+        locals.pop('__jinja_exception__', None)
+    else:
+        locals = {}
+
+    # assamble fake globals we need
+    globals = {
+        '__name__':             filename,
+        '__file__':             filename,
+        '__jinja_exception__':  exc_info[:2],
+
+        # we don't want to keep the reference to the template around
+        # to not cause circular dependencies, but we mark it as Jinja
+        # frame for the ProcessedTraceback
+        '__jinja_template__':   None
+    }
+
+    # and fake the exception
+    code = compile('\n' * (lineno - 1) + raise_helper, filename, 'exec')
+
+    # if it's possible, change the name of the code.  This won't work
+    # on some python environments such as google appengine
+    try:
+        if tb is None:
+            location = 'template'
+        else:
+            function = tb.tb_frame.f_code.co_name
+            if function == 'root':
+                location = 'top-level template code'
+            elif function.startswith('block_'):
+                location = 'block "%s"' % function[6:]
+            else:
+                location = 'template'
+
+        if PY2:
+            code = CodeType(0, code.co_nlocals, code.co_stacksize,
+                            code.co_flags, code.co_code, code.co_consts,
+                            code.co_names, code.co_varnames, filename,
+                            location, code.co_firstlineno,
+                            code.co_lnotab, (), ())
+        else:
+            code = CodeType(0, code.co_kwonlyargcount,
+                            code.co_nlocals, code.co_stacksize,
+                            code.co_flags, code.co_code, code.co_consts,
+                            code.co_names, code.co_varnames, filename,
+                            location, code.co_firstlineno,
+                            code.co_lnotab, (), ())
+    except Exception as e:
+        pass
+
+    # execute the code and catch the new traceback
+    try:
+        exec(code, globals, locals)
+    except:
+        exc_info = sys.exc_info()
+        new_tb = exc_info[2].tb_next
+
+    # return without this frame
+    return exc_info[:2] + (new_tb,)
+
+
+def _init_ugly_crap():
+    """This function implements a few ugly things so that we can patch the
+    traceback objects.  The function returned allows resetting `tb_next` on
+    any python traceback object.  Do not attempt to use this on non cpython
+    interpreters
+    """
+    import ctypes
+    from types import TracebackType
+
+    if PY2:
+        # figure out size of _Py_ssize_t for Python 2:
+        if hasattr(ctypes.pythonapi, 'Py_InitModule4_64'):
+            _Py_ssize_t = ctypes.c_int64
+        else:
+            _Py_ssize_t = ctypes.c_int
+    else:
+        # platform ssize_t on Python 3
+        _Py_ssize_t = ctypes.c_ssize_t
+
+    # regular python
+    class _PyObject(ctypes.Structure):
+        pass
+    _PyObject._fields_ = [
+        ('ob_refcnt', _Py_ssize_t),
+        ('ob_type', ctypes.POINTER(_PyObject))
+    ]
+
+    # python with trace
+    if hasattr(sys, 'getobjects'):
+        class _PyObject(ctypes.Structure):
+            pass
+        _PyObject._fields_ = [
+            ('_ob_next', ctypes.POINTER(_PyObject)),
+            ('_ob_prev', ctypes.POINTER(_PyObject)),
+            ('ob_refcnt', _Py_ssize_t),
+            ('ob_type', ctypes.POINTER(_PyObject))
+        ]
+
+    class _Traceback(_PyObject):
+        pass
+    _Traceback._fields_ = [
+        ('tb_next', ctypes.POINTER(_Traceback)),
+        ('tb_frame', ctypes.POINTER(_PyObject)),
+        ('tb_lasti', ctypes.c_int),
+        ('tb_lineno', ctypes.c_int)
+    ]
+
+    def tb_set_next(tb, next):
+        """Set the tb_next attribute of a traceback object."""
+        if not (isinstance(tb, TracebackType) and
+                (next is None or isinstance(next, TracebackType))):
+            raise TypeError('tb_set_next arguments must be traceback objects')
+        obj = _Traceback.from_address(id(tb))
+        if tb.tb_next is not None:
+            old = _Traceback.from_address(id(tb.tb_next))
+            old.ob_refcnt -= 1
+        if next is None:
+            obj.tb_next = ctypes.POINTER(_Traceback)()
+        else:
+            next = _Traceback.from_address(id(next))
+            next.ob_refcnt += 1
+            obj.tb_next = ctypes.pointer(next)
+
+    return tb_set_next
+
+
+# try to get a tb_set_next implementation if we don't have transparent
+# proxies.
+tb_set_next = None
+if tproxy is None:
+    try:
+        tb_set_next = _init_ugly_crap()
+    except:
+        pass
+    del _init_ugly_crap
diff --git a/deps/jinja2/defaults.py b/deps/jinja2/defaults.py
new file mode 100644
index 00000000000000..7c93dec0aeb202
--- /dev/null
+++ b/deps/jinja2/defaults.py
@@ -0,0 +1,56 @@
+# -*- coding: utf-8 -*-
+"""
+    jinja2.defaults
+    ~~~~~~~~~~~~~~~
+
+    Jinja default filters and tags.
+
+    :copyright: (c) 2017 by the Jinja Team.
+    :license: BSD, see LICENSE for more details.
+"""
+from jinja2._compat import range_type
+from jinja2.utils import generate_lorem_ipsum, Cycler, Joiner, Namespace
+
+
+# defaults for the parser / lexer
+BLOCK_START_STRING = '{%'
+BLOCK_END_STRING = '%}'
+VARIABLE_START_STRING = '{{'
+VARIABLE_END_STRING = '}}'
+COMMENT_START_STRING = '{#'
+COMMENT_END_STRING = '#}'
+LINE_STATEMENT_PREFIX = None
+LINE_COMMENT_PREFIX = None
+TRIM_BLOCKS = False
+LSTRIP_BLOCKS = False
+NEWLINE_SEQUENCE = '\n'
+KEEP_TRAILING_NEWLINE = False
+
+
+# default filters, tests and namespace
+from jinja2.filters import FILTERS as DEFAULT_FILTERS
+from jinja2.tests import TESTS as DEFAULT_TESTS
+DEFAULT_NAMESPACE = {
+    'range':        range_type,
+    'dict':         dict,
+    'lipsum':       generate_lorem_ipsum,
+    'cycler':       Cycler,
+    'joiner':       Joiner,
+    'namespace':    Namespace
+}
+
+
+# default policies
+DEFAULT_POLICIES = {
+    'compiler.ascii_str':   True,
+    'urlize.rel':           'noopener',
+    'urlize.target':        None,
+    'truncate.leeway':      5,
+    'json.dumps_function':  None,
+    'json.dumps_kwargs':    {'sort_keys': True},
+    'ext.i18n.trimmed':     False,
+}
+
+
+# export all constants
+__all__ = tuple(x for x in locals().keys() if x.isupper())
diff --git a/deps/jinja2/environment.py b/deps/jinja2/environment.py
new file mode 100644
index 00000000000000..549d9afab456b4
--- /dev/null
+++ b/deps/jinja2/environment.py
@@ -0,0 +1,1276 @@
+# -*- coding: utf-8 -*-
+"""
+    jinja2.environment
+    ~~~~~~~~~~~~~~~~~~
+
+    Provides a class that holds runtime and parsing time options.
+
+    :copyright: (c) 2017 by the Jinja Team.
+    :license: BSD, see LICENSE for more details.
+"""
+import os
+import sys
+import weakref
+from functools import reduce, partial
+from jinja2 import nodes
+from jinja2.defaults import BLOCK_START_STRING, \
+     BLOCK_END_STRING, VARIABLE_START_STRING, VARIABLE_END_STRING, \
+     COMMENT_START_STRING, COMMENT_END_STRING, LINE_STATEMENT_PREFIX, \
+     LINE_COMMENT_PREFIX, TRIM_BLOCKS, NEWLINE_SEQUENCE, \
+     DEFAULT_FILTERS, DEFAULT_TESTS, DEFAULT_NAMESPACE, \
+     DEFAULT_POLICIES, KEEP_TRAILING_NEWLINE, LSTRIP_BLOCKS
+from jinja2.lexer import get_lexer, TokenStream
+from jinja2.parser import Parser
+from jinja2.nodes import EvalContext
+from jinja2.compiler import generate, CodeGenerator
+from jinja2.runtime import Undefined, new_context, Context
+from jinja2.exceptions import TemplateSyntaxError, TemplateNotFound, \
+     TemplatesNotFound, TemplateRuntimeError
+from jinja2.utils import import_string, LRUCache, Markup, missing, \
+     concat, consume, internalcode, have_async_gen
+from jinja2._compat import imap, ifilter, string_types, iteritems, \
+     text_type, reraise, implements_iterator, implements_to_string, \
+     encode_filename, PY2, PYPY
+
+
+# for direct template usage we have up to ten living environments
+_spontaneous_environments = LRUCache(10)
+
+# the function to create jinja traceback objects.  This is dynamically
+# imported on the first exception in the exception handler.
+_make_traceback = None
+
+
+def get_spontaneous_environment(*args):
+    """Return a new spontaneous environment.  A spontaneous environment is an
+    unnamed and unaccessible (in theory) environment that is used for
+    templates generated from a string and not from the file system.
+    """
+    try:
+        env = _spontaneous_environments.get(args)
+    except TypeError:
+        return Environment(*args)
+    if env is not None:
+        return env
+    _spontaneous_environments[args] = env = Environment(*args)
+    env.shared = True
+    return env
+
+
+def create_cache(size):
+    """Return the cache class for the given size."""
+    if size == 0:
+        return None
+    if size < 0:
+        return {}
+    return LRUCache(size)
+
+
+def copy_cache(cache):
+    """Create an empty copy of the given cache."""
+    if cache is None:
+        return None
+    elif type(cache) is dict:
+        return {}
+    return LRUCache(cache.capacity)
+
+
+def load_extensions(environment, extensions):
+    """Load the extensions from the list and bind it to the environment.
+    Returns a dict of instantiated environments.
+    """
+    result = {}
+    for extension in extensions:
+        if isinstance(extension, string_types):
+            extension = import_string(extension)
+        result[extension.identifier] = extension(environment)
+    return result
+
+
+def fail_for_missing_callable(string, name):
+    msg = string % name
+    if isinstance(name, Undefined):
+        try:
+            name._fail_with_undefined_error()
+        except Exception as e:
+            msg = '%s (%s; did you forget to quote the callable name?)' % (msg, e)
+    raise TemplateRuntimeError(msg)
+
+
+def _environment_sanity_check(environment):
+    """Perform a sanity check on the environment."""
+    assert issubclass(environment.undefined, Undefined), 'undefined must ' \
+        'be a subclass of undefined because filters depend on it.'
+    assert environment.block_start_string != \
+        environment.variable_start_string != \
+        environment.comment_start_string, 'block, variable and comment ' \
+        'start strings must be different'
+    assert environment.newline_sequence in ('\r', '\r\n', '\n'), \
+        'newline_sequence set to unknown line ending string.'
+    return environment
+
+
+class Environment(object):
+    r"""The core component of Jinja is the `Environment`.  It contains
+    important shared variables like configuration, filters, tests,
+    globals and others.  Instances of this class may be modified if
+    they are not shared and if no template was loaded so far.
+    Modifications on environments after the first template was loaded
+    will lead to surprising effects and undefined behavior.
+
+    Here are the possible initialization parameters:
+
+        `block_start_string`
+            The string marking the beginning of a block.  Defaults to ``'{%'``.
+
+        `block_end_string`
+            The string marking the end of a block.  Defaults to ``'%}'``.
+
+        `variable_start_string`
+            The string marking the beginning of a print statement.
+            Defaults to ``'{{'``.
+
+        `variable_end_string`
+            The string marking the end of a print statement.  Defaults to
+            ``'}}'``.
+
+        `comment_start_string`
+            The string marking the beginning of a comment.  Defaults to ``'{#'``.
+
+        `comment_end_string`
+            The string marking the end of a comment.  Defaults to ``'#}'``.
+
+        `line_statement_prefix`
+            If given and a string, this will be used as prefix for line based
+            statements.  See also :ref:`line-statements`.
+
+        `line_comment_prefix`
+            If given and a string, this will be used as prefix for line based
+            comments.  See also :ref:`line-statements`.
+
+            .. versionadded:: 2.2
+
+        `trim_blocks`
+            If this is set to ``True`` the first newline after a block is
+            removed (block, not variable tag!).  Defaults to `False`.
+
+        `lstrip_blocks`
+            If this is set to ``True`` leading spaces and tabs are stripped
+            from the start of a line to a block.  Defaults to `False`.
+
+        `newline_sequence`
+            The sequence that starts a newline.  Must be one of ``'\r'``,
+            ``'\n'`` or ``'\r\n'``.  The default is ``'\n'`` which is a
+            useful default for Linux and OS X systems as well as web
+            applications.
+
+        `keep_trailing_newline`
+            Preserve the trailing newline when rendering templates.
+            The default is ``False``, which causes a single newline,
+            if present, to be stripped from the end of the template.
+
+            .. versionadded:: 2.7
+
+        `extensions`
+            List of Jinja extensions to use.  This can either be import paths
+            as strings or extension classes.  For more information have a
+            look at :ref:`the extensions documentation <jinja-extensions>`.
+
+        `optimized`
+            should the optimizer be enabled?  Default is ``True``.
+
+        `undefined`
+            :class:`Undefined` or a subclass of it that is used to represent
+            undefined values in the template.
+
+        `finalize`
+            A callable that can be used to process the result of a variable
+            expression before it is output.  For example one can convert
+            ``None`` implicitly into an empty string here.
+
+        `autoescape`
+            If set to ``True`` the XML/HTML autoescaping feature is enabled by
+            default.  For more details about autoescaping see
+            :class:`~jinja2.utils.Markup`.  As of Jinja 2.4 this can also
+            be a callable that is passed the template name and has to
+            return ``True`` or ``False`` depending on autoescape should be
+            enabled by default.
+
+            .. versionchanged:: 2.4
+               `autoescape` can now be a function
+
+        `loader`
+            The template loader for this environment.
+
+        `cache_size`
+            The size of the cache.  Per default this is ``400`` which means
+            that if more than 400 templates are loaded the loader will clean
+            out the least recently used template.  If the cache size is set to
+            ``0`` templates are recompiled all the time, if the cache size is
+            ``-1`` the cache will not be cleaned.
+
+            .. versionchanged:: 2.8
+               The cache size was increased to 400 from a low 50.
+
+        `auto_reload`
+            Some loaders load templates from locations where the template
+            sources may change (ie: file system or database).  If
+            ``auto_reload`` is set to ``True`` (default) every time a template is
+            requested the loader checks if the source changed and if yes, it
+            will reload the template.  For higher performance it's possible to
+            disable that.
+
+        `bytecode_cache`
+            If set to a bytecode cache object, this object will provide a
+            cache for the internal Jinja bytecode so that templates don't
+            have to be parsed if they were not changed.
+
+            See :ref:`bytecode-cache` for more information.
+
+        `enable_async`
+            If set to true this enables async template execution which allows
+            you to take advantage of newer Python features.  This requires
+            Python 3.6 or later.
+    """
+
+    #: if this environment is sandboxed.  Modifying this variable won't make
+    #: the environment sandboxed though.  For a real sandboxed environment
+    #: have a look at jinja2.sandbox.  This flag alone controls the code
+    #: generation by the compiler.
+    sandboxed = False
+
+    #: True if the environment is just an overlay
+    overlayed = False
+
+    #: the environment this environment is linked to if it is an overlay
+    linked_to = None
+
+    #: shared environments have this set to `True`.  A shared environment
+    #: must not be modified
+    shared = False
+
+    #: these are currently EXPERIMENTAL undocumented features.
+    exception_handler = None
+    exception_formatter = None
+
+    #: the class that is used for code generation.  See
+    #: :class:`~jinja2.compiler.CodeGenerator` for more information.
+    code_generator_class = CodeGenerator
+
+    #: the context class thatis used for templates.  See
+    #: :class:`~jinja2.runtime.Context` for more information.
+    context_class = Context
+
+    def __init__(self,
+                 block_start_string=BLOCK_START_STRING,
+                 block_end_string=BLOCK_END_STRING,
+                 variable_start_string=VARIABLE_START_STRING,
+                 variable_end_string=VARIABLE_END_STRING,
+                 comment_start_string=COMMENT_START_STRING,
+                 comment_end_string=COMMENT_END_STRING,
+                 line_statement_prefix=LINE_STATEMENT_PREFIX,
+                 line_comment_prefix=LINE_COMMENT_PREFIX,
+                 trim_blocks=TRIM_BLOCKS,
+                 lstrip_blocks=LSTRIP_BLOCKS,
+                 newline_sequence=NEWLINE_SEQUENCE,
+                 keep_trailing_newline=KEEP_TRAILING_NEWLINE,
+                 extensions=(),
+                 optimized=True,
+                 undefined=Undefined,
+                 finalize=None,
+                 autoescape=False,
+                 loader=None,
+                 cache_size=400,
+                 auto_reload=True,
+                 bytecode_cache=None,
+                 enable_async=False):
+        # !!Important notice!!
+        #   The constructor accepts quite a few arguments that should be
+        #   passed by keyword rather than position.  However it's important to
+        #   not change the order of arguments because it's used at least
+        #   internally in those cases:
+        #       -   spontaneous environments (i18n extension and Template)
+        #       -   unittests
+        #   If parameter changes are required only add parameters at the end
+        #   and don't change the arguments (or the defaults!) of the arguments
+        #   existing already.
+
+        # lexer / parser information
+        self.block_start_string = block_start_string
+        self.block_end_string = block_end_string
+        self.variable_start_string = variable_start_string
+        self.variable_end_string = variable_end_string
+        self.comment_start_string = comment_start_string
+        self.comment_end_string = comment_end_string
+        self.line_statement_prefix = line_statement_prefix
+        self.line_comment_prefix = line_comment_prefix
+        self.trim_blocks = trim_blocks
+        self.lstrip_blocks = lstrip_blocks
+        self.newline_sequence = newline_sequence
+        self.keep_trailing_newline = keep_trailing_newline
+
+        # runtime information
+        self.undefined = undefined
+        self.optimized = optimized
+        self.finalize = finalize
+        self.autoescape = autoescape
+
+        # defaults
+        self.filters = DEFAULT_FILTERS.copy()
+        self.tests = DEFAULT_TESTS.copy()
+        self.globals = DEFAULT_NAMESPACE.copy()
+
+        # set the loader provided
+        self.loader = loader
+        self.cache = create_cache(cache_size)
+        self.bytecode_cache = bytecode_cache
+        self.auto_reload = auto_reload
+
+        # configurable policies
+        self.policies = DEFAULT_POLICIES.copy()
+
+        # load extensions
+        self.extensions = load_extensions(self, extensions)
+
+        self.enable_async = enable_async
+        self.is_async = self.enable_async and have_async_gen
+
+        _environment_sanity_check(self)
+
+    def add_extension(self, extension):
+        """Adds an extension after the environment was created.
+
+        .. versionadded:: 2.5
+        """
+        self.extensions.update(load_extensions(self, [extension]))
+
+    def extend(self, **attributes):
+        """Add the items to the instance of the environment if they do not exist
+        yet.  This is used by :ref:`extensions <writing-extensions>` to register
+        callbacks and configuration values without breaking inheritance.
+        """
+        for key, value in iteritems(attributes):
+            if not hasattr(self, key):
+                setattr(self, key, value)
+
+    def overlay(self, block_start_string=missing, block_end_string=missing,
+                variable_start_string=missing, variable_end_string=missing,
+                comment_start_string=missing, comment_end_string=missing,
+                line_statement_prefix=missing, line_comment_prefix=missing,
+                trim_blocks=missing, lstrip_blocks=missing,
+                extensions=missing, optimized=missing,
+                undefined=missing, finalize=missing, autoescape=missing,
+                loader=missing, cache_size=missing, auto_reload=missing,
+                bytecode_cache=missing):
+        """Create a new overlay environment that shares all the data with the
+        current environment except for cache and the overridden attributes.
+        Extensions cannot be removed for an overlayed environment.  An overlayed
+        environment automatically gets all the extensions of the environment it
+        is linked to plus optional extra extensions.
+
+        Creating overlays should happen after the initial environment was set
+        up completely.  Not all attributes are truly linked, some are just
+        copied over so modifications on the original environment may not shine
+        through.
+        """
+        args = dict(locals())
+        del args['self'], args['cache_size'], args['extensions']
+
+        rv = object.__new__(self.__class__)
+        rv.__dict__.update(self.__dict__)
+        rv.overlayed = True
+        rv.linked_to = self
+
+        for key, value in iteritems(args):
+            if value is not missing:
+                setattr(rv, key, value)
+
+        if cache_size is not missing:
+            rv.cache = create_cache(cache_size)
+        else:
+            rv.cache = copy_cache(self.cache)
+
+        rv.extensions = {}
+        for key, value in iteritems(self.extensions):
+            rv.extensions[key] = value.bind(rv)
+        if extensions is not missing:
+            rv.extensions.update(load_extensions(rv, extensions))
+
+        return _environment_sanity_check(rv)
+
+    lexer = property(get_lexer, doc="The lexer for this environment.")
+
+    def iter_extensions(self):
+        """Iterates over the extensions by priority."""
+        return iter(sorted(self.extensions.values(),
+                           key=lambda x: x.priority))
+
+    def getitem(self, obj, argument):
+        """Get an item or attribute of an object but prefer the item."""
+        try:
+            return obj[argument]
+        except (AttributeError, TypeError, LookupError):
+            if isinstance(argument, string_types):
+                try:
+                    attr = str(argument)
+                except Exception:
+                    pass
+                else:
+                    try:
+                        return getattr(obj, attr)
+                    except AttributeError:
+                        pass
+            return self.undefined(obj=obj, name=argument)
+
+    def getattr(self, obj, attribute):
+        """Get an item or attribute of an object but prefer the attribute.
+        Unlike :meth:`getitem` the attribute *must* be a bytestring.
+        """
+        try:
+            return getattr(obj, attribute)
+        except AttributeError:
+            pass
+        try:
+            return obj[attribute]
+        except (TypeError, LookupError, AttributeError):
+            return self.undefined(obj=obj, name=attribute)
+
+    def call_filter(self, name, value, args=None, kwargs=None,
+                    context=None, eval_ctx=None):
+        """Invokes a filter on a value the same way the compiler does it.
+
+        Note that on Python 3 this might return a coroutine in case the
+        filter is running from an environment in async mode and the filter
+        supports async execution.  It's your responsibility to await this
+        if needed.
+
+        .. versionadded:: 2.7
+        """
+        func = self.filters.get(name)
+        if func is None:
+            fail_for_missing_callable('no filter named %r', name)
+        args = [value] + list(args or ())
+        if getattr(func, 'contextfilter', False):
+            if context is None:
+                raise TemplateRuntimeError('Attempted to invoke context '
+                                           'filter without context')
+            args.insert(0, context)
+        elif getattr(func, 'evalcontextfilter', False):
+            if eval_ctx is None:
+                if context is not None:
+                    eval_ctx = context.eval_ctx
+                else:
+                    eval_ctx = EvalContext(self)
+            args.insert(0, eval_ctx)
+        elif getattr(func, 'environmentfilter', False):
+            args.insert(0, self)
+        return func(*args, **(kwargs or {}))
+
+    def call_test(self, name, value, args=None, kwargs=None):
+        """Invokes a test on a value the same way the compiler does it.
+
+        .. versionadded:: 2.7
+        """
+        func = self.tests.get(name)
+        if func is None:
+            fail_for_missing_callable('no test named %r', name)
+        return func(value, *(args or ()), **(kwargs or {}))
+
+    @internalcode
+    def parse(self, source, name=None, filename=None):
+        """Parse the sourcecode and return the abstract syntax tree.  This
+        tree of nodes is used by the compiler to convert the template into
+        executable source- or bytecode.  This is useful for debugging or to
+        extract information from templates.
+
+        If you are :ref:`developing Jinja2 extensions <writing-extensions>`
+        this gives you a good overview of the node tree generated.
+        """
+        try:
+            return self._parse(source, name, filename)
+        except TemplateSyntaxError:
+            exc_info = sys.exc_info()
+        self.handle_exception(exc_info, source_hint=source)
+
+    def _parse(self, source, name, filename):
+        """Internal parsing function used by `parse` and `compile`."""
+        return Parser(self, source, name, encode_filename(filename)).parse()
+
+    def lex(self, source, name=None, filename=None):
+        """Lex the given sourcecode and return a generator that yields
+        tokens as tuples in the form ``(lineno, token_type, value)``.
+        This can be useful for :ref:`extension development <writing-extensions>`
+        and debugging templates.
+
+        This does not perform preprocessing.  If you want the preprocessing
+        of the extensions to be applied you have to filter source through
+        the :meth:`preprocess` method.
+        """
+        source = text_type(source)
+        try:
+            return self.lexer.tokeniter(source, name, filename)
+        except TemplateSyntaxError:
+            exc_info = sys.exc_info()
+        self.handle_exception(exc_info, source_hint=source)
+
+    def preprocess(self, source, name=None, filename=None):
+        """Preprocesses the source with all extensions.  This is automatically
+        called for all parsing and compiling methods but *not* for :meth:`lex`
+        because there you usually only want the actual source tokenized.
+        """
+        return reduce(lambda s, e: e.preprocess(s, name, filename),
+                      self.iter_extensions(), text_type(source))
+
+    def _tokenize(self, source, name, filename=None, state=None):
+        """Called by the parser to do the preprocessing and filtering
+        for all the extensions.  Returns a :class:`~jinja2.lexer.TokenStream`.
+        """
+        source = self.preprocess(source, name, filename)
+        stream = self.lexer.tokenize(source, name, filename, state)
+        for ext in self.iter_extensions():
+            stream = ext.filter_stream(stream)
+            if not isinstance(stream, TokenStream):
+                stream = TokenStream(stream, name, filename)
+        return stream
+
+    def _generate(self, source, name, filename, defer_init=False):
+        """Internal hook that can be overridden to hook a different generate
+        method in.
+
+        .. versionadded:: 2.5
+        """
+        return generate(source, self, name, filename, defer_init=defer_init,
+                        optimized=self.optimized)
+
+    def _compile(self, source, filename):
+        """Internal hook that can be overridden to hook a different compile
+        method in.
+
+        .. versionadded:: 2.5
+        """
+        return compile(source, filename, 'exec')
+
+    @internalcode
+    def compile(self, source, name=None, filename=None, raw=False,
+                defer_init=False):
+        """Compile a node or template source code.  The `name` parameter is
+        the load name of the template after it was joined using
+        :meth:`join_path` if necessary, not the filename on the file system.
+        the `filename` parameter is the estimated filename of the template on
+        the file system.  If the template came from a database or memory this
+        can be omitted.
+
+        The return value of this method is a python code object.  If the `raw`
+        parameter is `True` the return value will be a string with python
+        code equivalent to the bytecode returned otherwise.  This method is
+        mainly used internally.
+
+        `defer_init` is use internally to aid the module code generator.  This
+        causes the generated code to be able to import without the global
+        environment variable to be set.
+
+        .. versionadded:: 2.4
+           `defer_init` parameter added.
+        """
+        source_hint = None
+        try:
+            if isinstance(source, string_types):
+                source_hint = source
+                source = self._parse(source, name, filename)
+            source = self._generate(source, name, filename,
+                                    defer_init=defer_init)
+            if raw:
+                return source
+            if filename is None:
+                filename = '<template>'
+            else:
+                filename = encode_filename(filename)
+            return self._compile(source, filename)
+        except TemplateSyntaxError:
+            exc_info = sys.exc_info()
+        self.handle_exception(exc_info, source_hint=source_hint)
+
+    def compile_expression(self, source, undefined_to_none=True):
+        """A handy helper method that returns a callable that accepts keyword
+        arguments that appear as variables in the expression.  If called it
+        returns the result of the expression.
+
+        This is useful if applications want to use the same rules as Jinja
+        in template "configuration files" or similar situations.
+
+        Example usage:
+
+        >>> env = Environment()
+        >>> expr = env.compile_expression('foo == 42')
+        >>> expr(foo=23)
+        False
+        >>> expr(foo=42)
+        True
+
+        Per default the return value is converted to `None` if the
+        expression returns an undefined value.  This can be changed
+        by setting `undefined_to_none` to `False`.
+
+        >>> env.compile_expression('var')() is None
+        True
+        >>> env.compile_expression('var', undefined_to_none=False)()
+        Undefined
+
+        .. versionadded:: 2.1
+        """
+        parser = Parser(self, source, state='variable')
+        exc_info = None
+        try:
+            expr = parser.parse_expression()
+            if not parser.stream.eos:
+                raise TemplateSyntaxError('chunk after expression',
+                                          parser.stream.current.lineno,
+                                          None, None)
+            expr.set_environment(self)
+        except TemplateSyntaxError:
+            exc_info = sys.exc_info()
+        if exc_info is not None:
+            self.handle_exception(exc_info, source_hint=source)
+        body = [nodes.Assign(nodes.Name('result', 'store'), expr, lineno=1)]
+        template = self.from_string(nodes.Template(body, lineno=1))
+        return TemplateExpression(template, undefined_to_none)
+
+    def compile_templates(self, target, extensions=None, filter_func=None,
+                          zip='deflated', log_function=None,
+                          ignore_errors=True, py_compile=False):
+        """Finds all the templates the loader can find, compiles them
+        and stores them in `target`.  If `zip` is `None`, instead of in a
+        zipfile, the templates will be stored in a directory.
+        By default a deflate zip algorithm is used. To switch to
+        the stored algorithm, `zip` can be set to ``'stored'``.
+
+        `extensions` and `filter_func` are passed to :meth:`list_templates`.
+        Each template returned will be compiled to the target folder or
+        zipfile.
+
+        By default template compilation errors are ignored.  In case a
+        log function is provided, errors are logged.  If you want template
+        syntax errors to abort the compilation you can set `ignore_errors`
+        to `False` and you will get an exception on syntax errors.
+
+        If `py_compile` is set to `True` .pyc files will be written to the
+        target instead of standard .py files.  This flag does not do anything
+        on pypy and Python 3 where pyc files are not picked up by itself and
+        don't give much benefit.
+
+        .. versionadded:: 2.4
+        """
+        from jinja2.loaders import ModuleLoader
+
+        if log_function is None:
+            log_function = lambda x: None
+
+        if py_compile:
+            if not PY2 or PYPY:
+                from warnings import warn
+                warn(Warning('py_compile has no effect on pypy or Python 3'))
+                py_compile = False
+            else:
+                import imp
+                import marshal
+                py_header = imp.get_magic() + \
+                    u'\xff\xff\xff\xff'.encode('iso-8859-15')
+
+                # Python 3.3 added a source filesize to the header
+                if sys.version_info >= (3, 3):
+                    py_header += u'\x00\x00\x00\x00'.encode('iso-8859-15')
+
+        def write_file(filename, data, mode):
+            if zip:
+                info = ZipInfo(filename)
+                info.external_attr = 0o755 << 16
+                zip_file.writestr(info, data)
+            else:
+                f = open(os.path.join(target, filename), mode)
+                try:
+                    f.write(data)
+                finally:
+                    f.close()
+
+        if zip is not None:
+            from zipfile import ZipFile, ZipInfo, ZIP_DEFLATED, ZIP_STORED
+            zip_file = ZipFile(target, 'w', dict(deflated=ZIP_DEFLATED,
+                                                 stored=ZIP_STORED)[zip])
+            log_function('Compiling into Zip archive "%s"' % target)
+        else:
+            if not os.path.isdir(target):
+                os.makedirs(target)
+            log_function('Compiling into folder "%s"' % target)
+
+        try:
+            for name in self.list_templates(extensions, filter_func):
+                source, filename, _ = self.loader.get_source(self, name)
+                try:
+                    code = self.compile(source, name, filename, True, True)
+                except TemplateSyntaxError as e:
+                    if not ignore_errors:
+                        raise
+                    log_function('Could not compile "%s": %s' % (name, e))
+                    continue
+
+                filename = ModuleLoader.get_module_filename(name)
+
+                if py_compile:
+                    c = self._compile(code, encode_filename(filename))
+                    write_file(filename + 'c', py_header +
+                               marshal.dumps(c), 'wb')
+                    log_function('Byte-compiled "%s" as %s' %
+                                 (name, filename + 'c'))
+                else:
+                    write_file(filename, code, 'w')
+                    log_function('Compiled "%s" as %s' % (name, filename))
+        finally:
+            if zip:
+                zip_file.close()
+
+        log_function('Finished compiling templates')
+
+    def list_templates(self, extensions=None, filter_func=None):
+        """Returns a list of templates for this environment.  This requires
+        that the loader supports the loader's
+        :meth:`~BaseLoader.list_templates` method.
+
+        If there are other files in the template folder besides the
+        actual templates, the returned list can be filtered.  There are two
+        ways: either `extensions` is set to a list of file extensions for
+        templates, or a `filter_func` can be provided which is a callable that
+        is passed a template name and should return `True` if it should end up
+        in the result list.
+
+        If the loader does not support that, a :exc:`TypeError` is raised.
+
+        .. versionadded:: 2.4
+        """
+        x = self.loader.list_templates()
+        if extensions is not None:
+            if filter_func is not None:
+                raise TypeError('either extensions or filter_func '
+                                'can be passed, but not both')
+            filter_func = lambda x: '.' in x and \
+                                    x.rsplit('.', 1)[1] in extensions
+        if filter_func is not None:
+            x = list(ifilter(filter_func, x))
+        return x
+
+    def handle_exception(self, exc_info=None, rendered=False, source_hint=None):
+        """Exception handling helper.  This is used internally to either raise
+        rewritten exceptions or return a rendered traceback for the template.
+        """
+        global _make_traceback
+        if exc_info is None:
+            exc_info = sys.exc_info()
+
+        # the debugging module is imported when it's used for the first time.
+        # we're doing a lot of stuff there and for applications that do not
+        # get any exceptions in template rendering there is no need to load
+        # all of that.
+        if _make_traceback is None:
+            from jinja2.debug import make_traceback as _make_traceback
+        traceback = _make_traceback(exc_info, source_hint)
+        if rendered and self.exception_formatter is not None:
+            return self.exception_formatter(traceback)
+        if self.exception_handler is not None:
+            self.exception_handler(traceback)
+        exc_type, exc_value, tb = traceback.standard_exc_info
+        reraise(exc_type, exc_value, tb)
+
+    def join_path(self, template, parent):
+        """Join a template with the parent.  By default all the lookups are
+        relative to the loader root so this method returns the `template`
+        parameter unchanged, but if the paths should be relative to the
+        parent template, this function can be used to calculate the real
+        template name.
+
+        Subclasses may override this method and implement template path
+        joining here.
+        """
+        return template
+
+    @internalcode
+    def _load_template(self, name, globals):
+        if self.loader is None:
+            raise TypeError('no loader for this environment specified')
+        cache_key = (weakref.ref(self.loader), name)
+        if self.cache is not None:
+            template = self.cache.get(cache_key)
+            if template is not None and (not self.auto_reload or
+                                         template.is_up_to_date):
+                return template
+        template = self.loader.load(self, name, globals)
+        if self.cache is not None:
+            self.cache[cache_key] = template
+        return template
+
+    @internalcode
+    def get_template(self, name, parent=None, globals=None):
+        """Load a template from the loader.  If a loader is configured this
+        method asks the loader for the template and returns a :class:`Template`.
+        If the `parent` parameter is not `None`, :meth:`join_path` is called
+        to get the real template name before loading.
+
+        The `globals` parameter can be used to provide template wide globals.
+        These variables are available in the context at render time.
+
+        If the template does not exist a :exc:`TemplateNotFound` exception is
+        raised.
+
+        .. versionchanged:: 2.4
+           If `name` is a :class:`Template` object it is returned from the
+           function unchanged.
+        """
+        if isinstance(name, Template):
+            return name
+        if parent is not None:
+            name = self.join_path(name, parent)
+        return self._load_template(name, self.make_globals(globals))
+
+    @internalcode
+    def select_template(self, names, parent=None, globals=None):
+        """Works like :meth:`get_template` but tries a number of templates
+        before it fails.  If it cannot find any of the templates, it will
+        raise a :exc:`TemplatesNotFound` exception.
+
+        .. versionadded:: 2.3
+
+        .. versionchanged:: 2.4
+           If `names` contains a :class:`Template` object it is returned
+           from the function unchanged.
+        """
+        if not names:
+            raise TemplatesNotFound(message=u'Tried to select from an empty list '
+                                            u'of templates.')
+        globals = self.make_globals(globals)
+        for name in names:
+            if isinstance(name, Template):
+                return name
+            if parent is not None:
+                name = self.join_path(name, parent)
+            try:
+                return self._load_template(name, globals)
+            except TemplateNotFound:
+                pass
+        raise TemplatesNotFound(names)
+
+    @internalcode
+    def get_or_select_template(self, template_name_or_list,
+                               parent=None, globals=None):
+        """Does a typecheck and dispatches to :meth:`select_template`
+        if an iterable of template names is given, otherwise to
+        :meth:`get_template`.
+
+        .. versionadded:: 2.3
+        """
+        if isinstance(template_name_or_list, string_types):
+            return self.get_template(template_name_or_list, parent, globals)
+        elif isinstance(template_name_or_list, Template):
+            return template_name_or_list
+        return self.select_template(template_name_or_list, parent, globals)
+
+    def from_string(self, source, globals=None, template_class=None):
+        """Load a template from a string.  This parses the source given and
+        returns a :class:`Template` object.
+        """
+        globals = self.make_globals(globals)
+        cls = template_class or self.template_class
+        return cls.from_code(self, self.compile(source), globals, None)
+
+    def make_globals(self, d):
+        """Return a dict for the globals."""
+        if not d:
+            return self.globals
+        return dict(self.globals, **d)
+
+
+class Template(object):
+    """The central template object.  This class represents a compiled template
+    and is used to evaluate it.
+
+    Normally the template object is generated from an :class:`Environment` but
+    it also has a constructor that makes it possible to create a template
+    instance directly using the constructor.  It takes the same arguments as
+    the environment constructor but it's not possible to specify a loader.
+
+    Every template object has a few methods and members that are guaranteed
+    to exist.  However it's important that a template object should be
+    considered immutable.  Modifications on the object are not supported.
+
+    Template objects created from the constructor rather than an environment
+    do have an `environment` attribute that points to a temporary environment
+    that is probably shared with other templates created with the constructor
+    and compatible settings.
+
+    >>> template = Template('Hello {{ name }}!')
+    >>> template.render(name='John Doe') == u'Hello John Doe!'
+    True
+    >>> stream = template.stream(name='John Doe')
+    >>> next(stream) == u'Hello John Doe!'
+    True
+    >>> next(stream)
+    Traceback (most recent call last):
+        ...
+    StopIteration
+    """
+
+    def __new__(cls, source,
+                block_start_string=BLOCK_START_STRING,
+                block_end_string=BLOCK_END_STRING,
+                variable_start_string=VARIABLE_START_STRING,
+                variable_end_string=VARIABLE_END_STRING,
+                comment_start_string=COMMENT_START_STRING,
+                comment_end_string=COMMENT_END_STRING,
+                line_statement_prefix=LINE_STATEMENT_PREFIX,
+                line_comment_prefix=LINE_COMMENT_PREFIX,
+                trim_blocks=TRIM_BLOCKS,
+                lstrip_blocks=LSTRIP_BLOCKS,
+                newline_sequence=NEWLINE_SEQUENCE,
+                keep_trailing_newline=KEEP_TRAILING_NEWLINE,
+                extensions=(),
+                optimized=True,
+                undefined=Undefined,
+                finalize=None,
+                autoescape=False,
+                enable_async=False):
+        env = get_spontaneous_environment(
+            block_start_string, block_end_string, variable_start_string,
+            variable_end_string, comment_start_string, comment_end_string,
+            line_statement_prefix, line_comment_prefix, trim_blocks,
+            lstrip_blocks, newline_sequence, keep_trailing_newline,
+            frozenset(extensions), optimized, undefined, finalize, autoescape,
+            None, 0, False, None, enable_async)
+        return env.from_string(source, template_class=cls)
+
+    @classmethod
+    def from_code(cls, environment, code, globals, uptodate=None):
+        """Creates a template object from compiled code and the globals.  This
+        is used by the loaders and environment to create a template object.
+        """
+        namespace = {
+            'environment':  environment,
+            '__file__':     code.co_filename
+        }
+        exec(code, namespace)
+        rv = cls._from_namespace(environment, namespace, globals)
+        rv._uptodate = uptodate
+        return rv
+
+    @classmethod
+    def from_module_dict(cls, environment, module_dict, globals):
+        """Creates a template object from a module.  This is used by the
+        module loader to create a template object.
+
+        .. versionadded:: 2.4
+        """
+        return cls._from_namespace(environment, module_dict, globals)
+
+    @classmethod
+    def _from_namespace(cls, environment, namespace, globals):
+        t = object.__new__(cls)
+        t.environment = environment
+        t.globals = globals
+        t.name = namespace['name']
+        t.filename = namespace['__file__']
+        t.blocks = namespace['blocks']
+
+        # render function and module
+        t.root_render_func = namespace['root']
+        t._module = None
+
+        # debug and loader helpers
+        t._debug_info = namespace['debug_info']
+        t._uptodate = None
+
+        # store the reference
+        namespace['environment'] = environment
+        namespace['__jinja_template__'] = t
+
+        return t
+
+    def render(self, *args, **kwargs):
+        """This method accepts the same arguments as the `dict` constructor:
+        A dict, a dict subclass or some keyword arguments.  If no arguments
+        are given the context will be empty.  These two calls do the same::
+
+            template.render(knights='that say nih')
+            template.render({'knights': 'that say nih'})
+
+        This will return the rendered template as unicode string.
+        """
+        vars = dict(*args, **kwargs)
+        try:
+            return concat(self.root_render_func(self.new_context(vars)))
+        except Exception:
+            exc_info = sys.exc_info()
+        return self.environment.handle_exception(exc_info, True)
+
+    def render_async(self, *args, **kwargs):
+        """This works similar to :meth:`render` but returns a coroutine
+        that when awaited returns the entire rendered template string.  This
+        requires the async feature to be enabled.
+
+        Example usage::
+
+            await template.render_async(knights='that say nih; asynchronously')
+        """
+        # see asyncsupport for the actual implementation
+        raise NotImplementedError('This feature is not available for this '
+                                  'version of Python')
+
+    def stream(self, *args, **kwargs):
+        """Works exactly like :meth:`generate` but returns a
+        :class:`TemplateStream`.
+        """
+        return TemplateStream(self.generate(*args, **kwargs))
+
+    def generate(self, *args, **kwargs):
+        """For very large templates it can be useful to not render the whole
+        template at once but evaluate each statement after another and yield
+        piece for piece.  This method basically does exactly that and returns
+        a generator that yields one item after another as unicode strings.
+
+        It accepts the same arguments as :meth:`render`.
+        """
+        vars = dict(*args, **kwargs)
+        try:
+            for event in self.root_render_func(self.new_context(vars)):
+                yield event
+        except Exception:
+            exc_info = sys.exc_info()
+        else:
+            return
+        yield self.environment.handle_exception(exc_info, True)
+
+    def generate_async(self, *args, **kwargs):
+        """An async version of :meth:`generate`.  Works very similarly but
+        returns an async iterator instead.
+        """
+        # see asyncsupport for the actual implementation
+        raise NotImplementedError('This feature is not available for this '
+                                  'version of Python')
+
+    def new_context(self, vars=None, shared=False, locals=None):
+        """Create a new :class:`Context` for this template.  The vars
+        provided will be passed to the template.  Per default the globals
+        are added to the context.  If shared is set to `True` the data
+        is passed as it to the context without adding the globals.
+
+        `locals` can be a dict of local variables for internal usage.
+        """
+        return new_context(self.environment, self.name, self.blocks,
+                           vars, shared, self.globals, locals)
+
+    def make_module(self, vars=None, shared=False, locals=None):
+        """This method works like the :attr:`module` attribute when called
+        without arguments but it will evaluate the template on every call
+        rather than caching it.  It's also possible to provide
+        a dict which is then used as context.  The arguments are the same
+        as for the :meth:`new_context` method.
+        """
+        return TemplateModule(self, self.new_context(vars, shared, locals))
+
+    def make_module_async(self, vars=None, shared=False, locals=None):
+        """As template module creation can invoke template code for
+        asynchronous exections this method must be used instead of the
+        normal :meth:`make_module` one.  Likewise the module attribute
+        becomes unavailable in async mode.
+        """
+        # see asyncsupport for the actual implementation
+        raise NotImplementedError('This feature is not available for this '
+                                  'version of Python')
+
+    @internalcode
+    def _get_default_module(self):
+        if self._module is not None:
+            return self._module
+        self._module = rv = self.make_module()
+        return rv
+
+    @property
+    def module(self):
+        """The template as module.  This is used for imports in the
+        template runtime but is also useful if one wants to access
+        exported template variables from the Python layer:
+
+        >>> t = Template('{% macro foo() %}42{% endmacro %}23')
+        >>> str(t.module)
+        '23'
+        >>> t.module.foo() == u'42'
+        True
+
+        This attribute is not available if async mode is enabled.
+        """
+        return self._get_default_module()
+
+    def get_corresponding_lineno(self, lineno):
+        """Return the source line number of a line number in the
+        generated bytecode as they are not in sync.
+        """
+        for template_line, code_line in reversed(self.debug_info):
+            if code_line <= lineno:
+                return template_line
+        return 1
+
+    @property
+    def is_up_to_date(self):
+        """If this variable is `False` there is a newer version available."""
+        if self._uptodate is None:
+            return True
+        return self._uptodate()
+
+    @property
+    def debug_info(self):
+        """The debug info mapping."""
+        return [tuple(imap(int, x.split('='))) for x in
+                self._debug_info.split('&')]
+
+    def __repr__(self):
+        if self.name is None:
+            name = 'memory:%x' % id(self)
+        else:
+            name = repr(self.name)
+        return '<%s %s>' % (self.__class__.__name__, name)
+
+
+@implements_to_string
+class TemplateModule(object):
+    """Represents an imported template.  All the exported names of the
+    template are available as attributes on this object.  Additionally
+    converting it into an unicode- or bytestrings renders the contents.
+    """
+
+    def __init__(self, template, context, body_stream=None):
+        if body_stream is None:
+            if context.environment.is_async:
+                raise RuntimeError('Async mode requires a body stream '
+                                   'to be passed to a template module.  Use '
+                                   'the async methods of the API you are '
+                                   'using.')
+            body_stream = list(template.root_render_func(context))
+        self._body_stream = body_stream
+        self.__dict__.update(context.get_exported())
+        self.__name__ = template.name
+
+    def __html__(self):
+        return Markup(concat(self._body_stream))
+
+    def __str__(self):
+        return concat(self._body_stream)
+
+    def __repr__(self):
+        if self.__name__ is None:
+            name = 'memory:%x' % id(self)
+        else:
+            name = repr(self.__name__)
+        return '<%s %s>' % (self.__class__.__name__, name)
+
+
+class TemplateExpression(object):
+    """The :meth:`jinja2.Environment.compile_expression` method returns an
+    instance of this object.  It encapsulates the expression-like access
+    to the template with an expression it wraps.
+    """
+
+    def __init__(self, template, undefined_to_none):
+        self._template = template
+        self._undefined_to_none = undefined_to_none
+
+    def __call__(self, *args, **kwargs):
+        context = self._template.new_context(dict(*args, **kwargs))
+        consume(self._template.root_render_func(context))
+        rv = context.vars['result']
+        if self._undefined_to_none and isinstance(rv, Undefined):
+            rv = None
+        return rv
+
+
+@implements_iterator
+class TemplateStream(object):
+    """A template stream works pretty much like an ordinary python generator
+    but it can buffer multiple items to reduce the number of total iterations.
+    Per default the output is unbuffered which means that for every unbuffered
+    instruction in the template one unicode string is yielded.
+
+    If buffering is enabled with a buffer size of 5, five items are combined
+    into a new unicode string.  This is mainly useful if you are streaming
+    big templates to a client via WSGI which flushes after each iteration.
+    """
+
+    def __init__(self, gen):
+        self._gen = gen
+        self.disable_buffering()
+
+    def dump(self, fp, encoding=None, errors='strict'):
+        """Dump the complete stream into a file or file-like object.
+        Per default unicode strings are written, if you want to encode
+        before writing specify an `encoding`.
+
+        Example usage::
+
+            Template('Hello {{ name }}!').stream(name='foo').dump('hello.html')
+        """
+        close = False
+        if isinstance(fp, string_types):
+            if encoding is None:
+                encoding = 'utf-8'
+            fp = open(fp, 'wb')
+            close = True
+        try:
+            if encoding is not None:
+                iterable = (x.encode(encoding, errors) for x in self)
+            else:
+                iterable = self
+            if hasattr(fp, 'writelines'):
+                fp.writelines(iterable)
+            else:
+                for item in iterable:
+                    fp.write(item)
+        finally:
+            if close:
+                fp.close()
+
+    def disable_buffering(self):
+        """Disable the output buffering."""
+        self._next = partial(next, self._gen)
+        self.buffered = False
+
+    def _buffered_generator(self, size):
+        buf = []
+        c_size = 0
+        push = buf.append
+
+        while 1:
+            try:
+                while c_size < size:
+                    c = next(self._gen)
+                    push(c)
+                    if c:
+                        c_size += 1
+            except StopIteration:
+                if not c_size:
+                    return
+            yield concat(buf)
+            del buf[:]
+            c_size = 0
+
+    def enable_buffering(self, size=5):
+        """Enable buffering.  Buffer `size` items before yielding them."""
+        if size <= 1:
+            raise ValueError('buffer size too small')
+
+        self.buffered = True
+        self._next = partial(next, self._buffered_generator(size))
+
+    def __iter__(self):
+        return self
+
+    def __next__(self):
+        return self._next()
+
+
+# hook in default template class.  if anyone reads this comment: ignore that
+# it's possible to use custom templates ;-)
+Environment.template_class = Template
diff --git a/deps/jinja2/exceptions.py b/deps/jinja2/exceptions.py
new file mode 100644
index 00000000000000..c018a33e323cc5
--- /dev/null
+++ b/deps/jinja2/exceptions.py
@@ -0,0 +1,146 @@
+# -*- coding: utf-8 -*-
+"""
+    jinja2.exceptions
+    ~~~~~~~~~~~~~~~~~
+
+    Jinja exceptions.
+
+    :copyright: (c) 2017 by the Jinja Team.
+    :license: BSD, see LICENSE for more details.
+"""
+from jinja2._compat import imap, text_type, PY2, implements_to_string
+
+
+class TemplateError(Exception):
+    """Baseclass for all template errors."""
+
+    if PY2:
+        def __init__(self, message=None):
+            if message is not None:
+                message = text_type(message).encode('utf-8')
+            Exception.__init__(self, message)
+
+        @property
+        def message(self):
+            if self.args:
+                message = self.args[0]
+                if message is not None:
+                    return message.decode('utf-8', 'replace')
+
+        def __unicode__(self):
+            return self.message or u''
+    else:
+        def __init__(self, message=None):
+            Exception.__init__(self, message)
+
+        @property
+        def message(self):
+            if self.args:
+                message = self.args[0]
+                if message is not None:
+                    return message
+
+
+@implements_to_string
+class TemplateNotFound(IOError, LookupError, TemplateError):
+    """Raised if a template does not exist."""
+
+    # looks weird, but removes the warning descriptor that just
+    # bogusly warns us about message being deprecated
+    message = None
+
+    def __init__(self, name, message=None):
+        IOError.__init__(self)
+        if message is None:
+            message = name
+        self.message = message
+        self.name = name
+        self.templates = [name]
+
+    def __str__(self):
+        return self.message
+
+
+class TemplatesNotFound(TemplateNotFound):
+    """Like :class:`TemplateNotFound` but raised if multiple templates
+    are selected.  This is a subclass of :class:`TemplateNotFound`
+    exception, so just catching the base exception will catch both.
+
+    .. versionadded:: 2.2
+    """
+
+    def __init__(self, names=(), message=None):
+        if message is None:
+            message = u'none of the templates given were found: ' + \
+                      u', '.join(imap(text_type, names))
+        TemplateNotFound.__init__(self, names and names[-1] or None, message)
+        self.templates = list(names)
+
+
+@implements_to_string
+class TemplateSyntaxError(TemplateError):
+    """Raised to tell the user that there is a problem with the template."""
+
+    def __init__(self, message, lineno, name=None, filename=None):
+        TemplateError.__init__(self, message)
+        self.lineno = lineno
+        self.name = name
+        self.filename = filename
+        self.source = None
+
+        # this is set to True if the debug.translate_syntax_error
+        # function translated the syntax error into a new traceback
+        self.translated = False
+
+    def __str__(self):
+        # for translated errors we only return the message
+        if self.translated:
+            return self.message
+
+        # otherwise attach some stuff
+        location = 'line %d' % self.lineno
+        name = self.filename or self.name
+        if name:
+            location = 'File "%s", %s' % (name, location)
+        lines = [self.message, '  ' + location]
+
+        # if the source is set, add the line to the output
+        if self.source is not None:
+            try:
+                line = self.source.splitlines()[self.lineno - 1]
+            except IndexError:
+                line = None
+            if line:
+                lines.append('    ' + line.strip())
+
+        return u'\n'.join(lines)
+
+
+class TemplateAssertionError(TemplateSyntaxError):
+    """Like a template syntax error, but covers cases where something in the
+    template caused an error at compile time that wasn't necessarily caused
+    by a syntax error.  However it's a direct subclass of
+    :exc:`TemplateSyntaxError` and has the same attributes.
+    """
+
+
+class TemplateRuntimeError(TemplateError):
+    """A generic runtime error in the template engine.  Under some situations
+    Jinja may raise this exception.
+    """
+
+
+class UndefinedError(TemplateRuntimeError):
+    """Raised if a template tries to operate on :class:`Undefined`."""
+
+
+class SecurityError(TemplateRuntimeError):
+    """Raised if a template tries to do something insecure if the
+    sandbox is enabled.
+    """
+
+
+class FilterArgumentError(TemplateRuntimeError):
+    """This error is raised if a filter was called with inappropriate
+    arguments
+    """
diff --git a/deps/jinja2/ext.py b/deps/jinja2/ext.py
new file mode 100644
index 00000000000000..0734a84f73d0dd
--- /dev/null
+++ b/deps/jinja2/ext.py
@@ -0,0 +1,627 @@
+# -*- coding: utf-8 -*-
+"""
+    jinja2.ext
+    ~~~~~~~~~~
+
+    Jinja extensions allow to add custom tags similar to the way django custom
+    tags work.  By default two example extensions exist: an i18n and a cache
+    extension.
+
+    :copyright: (c) 2017 by the Jinja Team.
+    :license: BSD.
+"""
+import re
+
+from jinja2 import nodes
+from jinja2.defaults import BLOCK_START_STRING, \
+     BLOCK_END_STRING, VARIABLE_START_STRING, VARIABLE_END_STRING, \
+     COMMENT_START_STRING, COMMENT_END_STRING, LINE_STATEMENT_PREFIX, \
+     LINE_COMMENT_PREFIX, TRIM_BLOCKS, NEWLINE_SEQUENCE, \
+     KEEP_TRAILING_NEWLINE, LSTRIP_BLOCKS
+from jinja2.environment import Environment
+from jinja2.runtime import concat
+from jinja2.exceptions import TemplateAssertionError, TemplateSyntaxError
+from jinja2.utils import contextfunction, import_string, Markup
+from jinja2._compat import with_metaclass, string_types, iteritems
+
+
+# the only real useful gettext functions for a Jinja template.  Note
+# that ugettext must be assigned to gettext as Jinja doesn't support
+# non unicode strings.
+GETTEXT_FUNCTIONS = ('_', 'gettext', 'ngettext')
+
+
+class ExtensionRegistry(type):
+    """Gives the extension an unique identifier."""
+
+    def __new__(cls, name, bases, d):
+        rv = type.__new__(cls, name, bases, d)
+        rv.identifier = rv.__module__ + '.' + rv.__name__
+        return rv
+
+
+class Extension(with_metaclass(ExtensionRegistry, object)):
+    """Extensions can be used to add extra functionality to the Jinja template
+    system at the parser level.  Custom extensions are bound to an environment
+    but may not store environment specific data on `self`.  The reason for
+    this is that an extension can be bound to another environment (for
+    overlays) by creating a copy and reassigning the `environment` attribute.
+
+    As extensions are created by the environment they cannot accept any
+    arguments for configuration.  One may want to work around that by using
+    a factory function, but that is not possible as extensions are identified
+    by their import name.  The correct way to configure the extension is
+    storing the configuration values on the environment.  Because this way the
+    environment ends up acting as central configuration storage the
+    attributes may clash which is why extensions have to ensure that the names
+    they choose for configuration are not too generic.  ``prefix`` for example
+    is a terrible name, ``fragment_cache_prefix`` on the other hand is a good
+    name as includes the name of the extension (fragment cache).
+    """
+
+    #: if this extension parses this is the list of tags it's listening to.
+    tags = set()
+
+    #: the priority of that extension.  This is especially useful for
+    #: extensions that preprocess values.  A lower value means higher
+    #: priority.
+    #:
+    #: .. versionadded:: 2.4
+    priority = 100
+
+    def __init__(self, environment):
+        self.environment = environment
+
+    def bind(self, environment):
+        """Create a copy of this extension bound to another environment."""
+        rv = object.__new__(self.__class__)
+        rv.__dict__.update(self.__dict__)
+        rv.environment = environment
+        return rv
+
+    def preprocess(self, source, name, filename=None):
+        """This method is called before the actual lexing and can be used to
+        preprocess the source.  The `filename` is optional.  The return value
+        must be the preprocessed source.
+        """
+        return source
+
+    def filter_stream(self, stream):
+        """It's passed a :class:`~jinja2.lexer.TokenStream` that can be used
+        to filter tokens returned.  This method has to return an iterable of
+        :class:`~jinja2.lexer.Token`\\s, but it doesn't have to return a
+        :class:`~jinja2.lexer.TokenStream`.
+
+        In the `ext` folder of the Jinja2 source distribution there is a file
+        called `inlinegettext.py` which implements a filter that utilizes this
+        method.
+        """
+        return stream
+
+    def parse(self, parser):
+        """If any of the :attr:`tags` matched this method is called with the
+        parser as first argument.  The token the parser stream is pointing at
+        is the name token that matched.  This method has to return one or a
+        list of multiple nodes.
+        """
+        raise NotImplementedError()
+
+    def attr(self, name, lineno=None):
+        """Return an attribute node for the current extension.  This is useful
+        to pass constants on extensions to generated template code.
+
+        ::
+
+            self.attr('_my_attribute', lineno=lineno)
+        """
+        return nodes.ExtensionAttribute(self.identifier, name, lineno=lineno)
+
+    def call_method(self, name, args=None, kwargs=None, dyn_args=None,
+                    dyn_kwargs=None, lineno=None):
+        """Call a method of the extension.  This is a shortcut for
+        :meth:`attr` + :class:`jinja2.nodes.Call`.
+        """
+        if args is None:
+            args = []
+        if kwargs is None:
+            kwargs = []
+        return nodes.Call(self.attr(name, lineno=lineno), args, kwargs,
+                          dyn_args, dyn_kwargs, lineno=lineno)
+
+
+@contextfunction
+def _gettext_alias(__context, *args, **kwargs):
+    return __context.call(__context.resolve('gettext'), *args, **kwargs)
+
+
+def _make_new_gettext(func):
+    @contextfunction
+    def gettext(__context, __string, **variables):
+        rv = __context.call(func, __string)
+        if __context.eval_ctx.autoescape:
+            rv = Markup(rv)
+        return rv % variables
+    return gettext
+
+
+def _make_new_ngettext(func):
+    @contextfunction
+    def ngettext(__context, __singular, __plural, __num, **variables):
+        variables.setdefault('num', __num)
+        rv = __context.call(func, __singular, __plural, __num)
+        if __context.eval_ctx.autoescape:
+            rv = Markup(rv)
+        return rv % variables
+    return ngettext
+
+
+class InternationalizationExtension(Extension):
+    """This extension adds gettext support to Jinja2."""
+    tags = set(['trans'])
+
+    # TODO: the i18n extension is currently reevaluating values in a few
+    # situations.  Take this example:
+    #   {% trans count=something() %}{{ count }} foo{% pluralize
+    #     %}{{ count }} fooss{% endtrans %}
+    # something is called twice here.  One time for the gettext value and
+    # the other time for the n-parameter of the ngettext function.
+
+    def __init__(self, environment):
+        Extension.__init__(self, environment)
+        environment.globals['_'] = _gettext_alias
+        environment.extend(
+            install_gettext_translations=self._install,
+            install_null_translations=self._install_null,
+            install_gettext_callables=self._install_callables,
+            uninstall_gettext_translations=self._uninstall,
+            extract_translations=self._extract,
+            newstyle_gettext=False
+        )
+
+    def _install(self, translations, newstyle=None):
+        gettext = getattr(translations, 'ugettext', None)
+        if gettext is None:
+            gettext = translations.gettext
+        ngettext = getattr(translations, 'ungettext', None)
+        if ngettext is None:
+            ngettext = translations.ngettext
+        self._install_callables(gettext, ngettext, newstyle)
+
+    def _install_null(self, newstyle=None):
+        self._install_callables(
+            lambda x: x,
+            lambda s, p, n: (n != 1 and (p,) or (s,))[0],
+            newstyle
+        )
+
+    def _install_callables(self, gettext, ngettext, newstyle=None):
+        if newstyle is not None:
+            self.environment.newstyle_gettext = newstyle
+        if self.environment.newstyle_gettext:
+            gettext = _make_new_gettext(gettext)
+            ngettext = _make_new_ngettext(ngettext)
+        self.environment.globals.update(
+            gettext=gettext,
+            ngettext=ngettext
+        )
+
+    def _uninstall(self, translations):
+        for key in 'gettext', 'ngettext':
+            self.environment.globals.pop(key, None)
+
+    def _extract(self, source, gettext_functions=GETTEXT_FUNCTIONS):
+        if isinstance(source, string_types):
+            source = self.environment.parse(source)
+        return extract_from_ast(source, gettext_functions)
+
+    def parse(self, parser):
+        """Parse a translatable tag."""
+        lineno = next(parser.stream).lineno
+        num_called_num = False
+
+        # find all the variables referenced.  Additionally a variable can be
+        # defined in the body of the trans block too, but this is checked at
+        # a later state.
+        plural_expr = None
+        plural_expr_assignment = None
+        variables = {}
+        trimmed = None
+        while parser.stream.current.type != 'block_end':
+            if variables:
+                parser.stream.expect('comma')
+
+            # skip colon for python compatibility
+            if parser.stream.skip_if('colon'):
+                break
+
+            name = parser.stream.expect('name')
+            if name.value in variables:
+                parser.fail('translatable variable %r defined twice.' %
+                            name.value, name.lineno,
+                            exc=TemplateAssertionError)
+
+            # expressions
+            if parser.stream.current.type == 'assign':
+                next(parser.stream)
+                variables[name.value] = var = parser.parse_expression()
+            elif trimmed is None and name.value in ('trimmed', 'notrimmed'):
+                trimmed = name.value == 'trimmed'
+                continue
+            else:
+                variables[name.value] = var = nodes.Name(name.value, 'load')
+
+            if plural_expr is None:
+                if isinstance(var, nodes.Call):
+                    plural_expr = nodes.Name('_trans', 'load')
+                    variables[name.value] = plural_expr
+                    plural_expr_assignment = nodes.Assign(
+                        nodes.Name('_trans', 'store'), var)
+                else:
+                    plural_expr = var
+                num_called_num = name.value == 'num'
+
+        parser.stream.expect('block_end')
+
+        plural = None
+        have_plural = False
+        referenced = set()
+
+        # now parse until endtrans or pluralize
+        singular_names, singular = self._parse_block(parser, True)
+        if singular_names:
+            referenced.update(singular_names)
+            if plural_expr is None:
+                plural_expr = nodes.Name(singular_names[0], 'load')
+                num_called_num = singular_names[0] == 'num'
+
+        # if we have a pluralize block, we parse that too
+        if parser.stream.current.test('name:pluralize'):
+            have_plural = True
+            next(parser.stream)
+            if parser.stream.current.type != 'block_end':
+                name = parser.stream.expect('name')
+                if name.value not in variables:
+                    parser.fail('unknown variable %r for pluralization' %
+                                name.value, name.lineno,
+                                exc=TemplateAssertionError)
+                plural_expr = variables[name.value]
+                num_called_num = name.value == 'num'
+            parser.stream.expect('block_end')
+            plural_names, plural = self._parse_block(parser, False)
+            next(parser.stream)
+            referenced.update(plural_names)
+        else:
+            next(parser.stream)
+
+        # register free names as simple name expressions
+        for var in referenced:
+            if var not in variables:
+                variables[var] = nodes.Name(var, 'load')
+
+        if not have_plural:
+            plural_expr = None
+        elif plural_expr is None:
+            parser.fail('pluralize without variables', lineno)
+
+        if trimmed is None:
+            trimmed = self.environment.policies['ext.i18n.trimmed']
+        if trimmed:
+            singular = self._trim_whitespace(singular)
+            if plural:
+                plural = self._trim_whitespace(plural)
+
+        node = self._make_node(singular, plural, variables, plural_expr,
+                               bool(referenced),
+                               num_called_num and have_plural)
+        node.set_lineno(lineno)
+        if plural_expr_assignment is not None:
+            return [plural_expr_assignment, node]
+        else:
+            return node
+
+    def _trim_whitespace(self, string, _ws_re=re.compile(r'\s*\n\s*')):
+        return _ws_re.sub(' ', string.strip())
+
+    def _parse_block(self, parser, allow_pluralize):
+        """Parse until the next block tag with a given name."""
+        referenced = []
+        buf = []
+        while 1:
+            if parser.stream.current.type == 'data':
+                buf.append(parser.stream.current.value.replace('%', '%%'))
+                next(parser.stream)
+            elif parser.stream.current.type == 'variable_begin':
+                next(parser.stream)
+                name = parser.stream.expect('name').value
+                referenced.append(name)
+                buf.append('%%(%s)s' % name)
+                parser.stream.expect('variable_end')
+            elif parser.stream.current.type == 'block_begin':
+                next(parser.stream)
+                if parser.stream.current.test('name:endtrans'):
+                    break
+                elif parser.stream.current.test('name:pluralize'):
+                    if allow_pluralize:
+                        break
+                    parser.fail('a translatable section can have only one '
+                                'pluralize section')
+                parser.fail('control structures in translatable sections are '
+                            'not allowed')
+            elif parser.stream.eos:
+                parser.fail('unclosed translation block')
+            else:
+                assert False, 'internal parser error'
+
+        return referenced, concat(buf)
+
+    def _make_node(self, singular, plural, variables, plural_expr,
+                   vars_referenced, num_called_num):
+        """Generates a useful node from the data provided."""
+        # no variables referenced?  no need to escape for old style
+        # gettext invocations only if there are vars.
+        if not vars_referenced and not self.environment.newstyle_gettext:
+            singular = singular.replace('%%', '%')
+            if plural:
+                plural = plural.replace('%%', '%')
+
+        # singular only:
+        if plural_expr is None:
+            gettext = nodes.Name('gettext', 'load')
+            node = nodes.Call(gettext, [nodes.Const(singular)],
+                              [], None, None)
+
+        # singular and plural
+        else:
+            ngettext = nodes.Name('ngettext', 'load')
+            node = nodes.Call(ngettext, [
+                nodes.Const(singular),
+                nodes.Const(plural),
+                plural_expr
+            ], [], None, None)
+
+        # in case newstyle gettext is used, the method is powerful
+        # enough to handle the variable expansion and autoescape
+        # handling itself
+        if self.environment.newstyle_gettext:
+            for key, value in iteritems(variables):
+                # the function adds that later anyways in case num was
+                # called num, so just skip it.
+                if num_called_num and key == 'num':
+                    continue
+                node.kwargs.append(nodes.Keyword(key, value))
+
+        # otherwise do that here
+        else:
+            # mark the return value as safe if we are in an
+            # environment with autoescaping turned on
+            node = nodes.MarkSafeIfAutoescape(node)
+            if variables:
+                node = nodes.Mod(node, nodes.Dict([
+                    nodes.Pair(nodes.Const(key), value)
+                    for key, value in variables.items()
+                ]))
+        return nodes.Output([node])
+
+
+class ExprStmtExtension(Extension):
+    """Adds a `do` tag to Jinja2 that works like the print statement just
+    that it doesn't print the return value.
+    """
+    tags = set(['do'])
+
+    def parse(self, parser):
+        node = nodes.ExprStmt(lineno=next(parser.stream).lineno)
+        node.node = parser.parse_tuple()
+        return node
+
+
+class LoopControlExtension(Extension):
+    """Adds break and continue to the template engine."""
+    tags = set(['break', 'continue'])
+
+    def parse(self, parser):
+        token = next(parser.stream)
+        if token.value == 'break':
+            return nodes.Break(lineno=token.lineno)
+        return nodes.Continue(lineno=token.lineno)
+
+
+class WithExtension(Extension):
+    pass
+
+
+class AutoEscapeExtension(Extension):
+    pass
+
+
+def extract_from_ast(node, gettext_functions=GETTEXT_FUNCTIONS,
+                     babel_style=True):
+    """Extract localizable strings from the given template node.  Per
+    default this function returns matches in babel style that means non string
+    parameters as well as keyword arguments are returned as `None`.  This
+    allows Babel to figure out what you really meant if you are using
+    gettext functions that allow keyword arguments for placeholder expansion.
+    If you don't want that behavior set the `babel_style` parameter to `False`
+    which causes only strings to be returned and parameters are always stored
+    in tuples.  As a consequence invalid gettext calls (calls without a single
+    string parameter or string parameters after non-string parameters) are
+    skipped.
+
+    This example explains the behavior:
+
+    >>> from jinja2 import Environment
+    >>> env = Environment()
+    >>> node = env.parse('{{ (_("foo"), _(), ngettext("foo", "bar", 42)) }}')
+    >>> list(extract_from_ast(node))
+    [(1, '_', 'foo'), (1, '_', ()), (1, 'ngettext', ('foo', 'bar', None))]
+    >>> list(extract_from_ast(node, babel_style=False))
+    [(1, '_', ('foo',)), (1, 'ngettext', ('foo', 'bar'))]
+
+    For every string found this function yields a ``(lineno, function,
+    message)`` tuple, where:
+
+    * ``lineno`` is the number of the line on which the string was found,
+    * ``function`` is the name of the ``gettext`` function used (if the
+      string was extracted from embedded Python code), and
+    *  ``message`` is the string itself (a ``unicode`` object, or a tuple
+       of ``unicode`` objects for functions with multiple string arguments).
+
+    This extraction function operates on the AST and is because of that unable
+    to extract any comments.  For comment support you have to use the babel
+    extraction interface or extract comments yourself.
+    """
+    for node in node.find_all(nodes.Call):
+        if not isinstance(node.node, nodes.Name) or \
+           node.node.name not in gettext_functions:
+            continue
+
+        strings = []
+        for arg in node.args:
+            if isinstance(arg, nodes.Const) and \
+               isinstance(arg.value, string_types):
+                strings.append(arg.value)
+            else:
+                strings.append(None)
+
+        for arg in node.kwargs:
+            strings.append(None)
+        if node.dyn_args is not None:
+            strings.append(None)
+        if node.dyn_kwargs is not None:
+            strings.append(None)
+
+        if not babel_style:
+            strings = tuple(x for x in strings if x is not None)
+            if not strings:
+                continue
+        else:
+            if len(strings) == 1:
+                strings = strings[0]
+            else:
+                strings = tuple(strings)
+        yield node.lineno, node.node.name, strings
+
+
+class _CommentFinder(object):
+    """Helper class to find comments in a token stream.  Can only
+    find comments for gettext calls forwards.  Once the comment
+    from line 4 is found, a comment for line 1 will not return a
+    usable value.
+    """
+
+    def __init__(self, tokens, comment_tags):
+        self.tokens = tokens
+        self.comment_tags = comment_tags
+        self.offset = 0
+        self.last_lineno = 0
+
+    def find_backwards(self, offset):
+        try:
+            for _, token_type, token_value in \
+                    reversed(self.tokens[self.offset:offset]):
+                if token_type in ('comment', 'linecomment'):
+                    try:
+                        prefix, comment = token_value.split(None, 1)
+                    except ValueError:
+                        continue
+                    if prefix in self.comment_tags:
+                        return [comment.rstrip()]
+            return []
+        finally:
+            self.offset = offset
+
+    def find_comments(self, lineno):
+        if not self.comment_tags or self.last_lineno > lineno:
+            return []
+        for idx, (token_lineno, _, _) in enumerate(self.tokens[self.offset:]):
+            if token_lineno > lineno:
+                return self.find_backwards(self.offset + idx)
+        return self.find_backwards(len(self.tokens))
+
+
+def babel_extract(fileobj, keywords, comment_tags, options):
+    """Babel extraction method for Jinja templates.
+
+    .. versionchanged:: 2.3
+       Basic support for translation comments was added.  If `comment_tags`
+       is now set to a list of keywords for extraction, the extractor will
+       try to find the best preceeding comment that begins with one of the
+       keywords.  For best results, make sure to not have more than one
+       gettext call in one line of code and the matching comment in the
+       same line or the line before.
+
+    .. versionchanged:: 2.5.1
+       The `newstyle_gettext` flag can be set to `True` to enable newstyle
+       gettext calls.
+
+    .. versionchanged:: 2.7
+       A `silent` option can now be provided.  If set to `False` template
+       syntax errors are propagated instead of being ignored.
+
+    :param fileobj: the file-like object the messages should be extracted from
+    :param keywords: a list of keywords (i.e. function names) that should be
+                     recognized as translation functions
+    :param comment_tags: a list of translator tags to search for and include
+                         in the results.
+    :param options: a dictionary of additional options (optional)
+    :return: an iterator over ``(lineno, funcname, message, comments)`` tuples.
+             (comments will be empty currently)
+    """
+    extensions = set()
+    for extension in options.get('extensions', '').split(','):
+        extension = extension.strip()
+        if not extension:
+            continue
+        extensions.add(import_string(extension))
+    if InternationalizationExtension not in extensions:
+        extensions.add(InternationalizationExtension)
+
+    def getbool(options, key, default=False):
+        return options.get(key, str(default)).lower() in \
+            ('1', 'on', 'yes', 'true')
+
+    silent = getbool(options, 'silent', True)
+    environment = Environment(
+        options.get('block_start_string', BLOCK_START_STRING),
+        options.get('block_end_string', BLOCK_END_STRING),
+        options.get('variable_start_string', VARIABLE_START_STRING),
+        options.get('variable_end_string', VARIABLE_END_STRING),
+        options.get('comment_start_string', COMMENT_START_STRING),
+        options.get('comment_end_string', COMMENT_END_STRING),
+        options.get('line_statement_prefix') or LINE_STATEMENT_PREFIX,
+        options.get('line_comment_prefix') or LINE_COMMENT_PREFIX,
+        getbool(options, 'trim_blocks', TRIM_BLOCKS),
+        getbool(options, 'lstrip_blocks', LSTRIP_BLOCKS),
+        NEWLINE_SEQUENCE,
+        getbool(options, 'keep_trailing_newline', KEEP_TRAILING_NEWLINE),
+        frozenset(extensions),
+        cache_size=0,
+        auto_reload=False
+    )
+
+    if getbool(options, 'trimmed'):
+        environment.policies['ext.i18n.trimmed'] = True
+    if getbool(options, 'newstyle_gettext'):
+        environment.newstyle_gettext = True
+
+    source = fileobj.read().decode(options.get('encoding', 'utf-8'))
+    try:
+        node = environment.parse(source)
+        tokens = list(environment.lex(environment.preprocess(source)))
+    except TemplateSyntaxError as e:
+        if not silent:
+            raise
+        # skip templates with syntax errors
+        return
+
+    finder = _CommentFinder(tokens, comment_tags)
+    for lineno, func, message in extract_from_ast(node, keywords):
+        yield lineno, func, message, finder.find_comments(lineno)
+
+
+#: nicer import names
+i18n = InternationalizationExtension
+do = ExprStmtExtension
+loopcontrols = LoopControlExtension
+with_ = WithExtension
+autoescape = AutoEscapeExtension
diff --git a/deps/jinja2/filters.py b/deps/jinja2/filters.py
new file mode 100644
index 00000000000000..267ddddaa03478
--- /dev/null
+++ b/deps/jinja2/filters.py
@@ -0,0 +1,1190 @@
+# -*- coding: utf-8 -*-
+"""
+    jinja2.filters
+    ~~~~~~~~~~~~~~
+
+    Bundled jinja filters.
+
+    :copyright: (c) 2017 by the Jinja Team.
+    :license: BSD, see LICENSE for more details.
+"""
+import re
+import math
+import random
+import warnings
+
+from itertools import groupby, chain
+from collections import namedtuple
+from jinja2.utils import Markup, escape, pformat, urlize, soft_unicode, \
+     unicode_urlencode, htmlsafe_json_dumps
+from jinja2.runtime import Undefined
+from jinja2.exceptions import FilterArgumentError
+from jinja2._compat import imap, string_types, text_type, iteritems, PY2
+
+
+_word_re = re.compile(r'\w+', re.UNICODE)
+_word_beginning_split_re = re.compile(r'([-\s\(\{\[\<]+)', re.UNICODE)
+
+
+def contextfilter(f):
+    """Decorator for marking context dependent filters. The current
+    :class:`Context` will be passed as first argument.
+    """
+    f.contextfilter = True
+    return f
+
+
+def evalcontextfilter(f):
+    """Decorator for marking eval-context dependent filters.  An eval
+    context object is passed as first argument.  For more information
+    about the eval context, see :ref:`eval-context`.
+
+    .. versionadded:: 2.4
+    """
+    f.evalcontextfilter = True
+    return f
+
+
+def environmentfilter(f):
+    """Decorator for marking environment dependent filters.  The current
+    :class:`Environment` is passed to the filter as first argument.
+    """
+    f.environmentfilter = True
+    return f
+
+
+def ignore_case(value):
+    """For use as a postprocessor for :func:`make_attrgetter`. Converts strings
+    to lowercase and returns other types as-is."""
+    return value.lower() if isinstance(value, string_types) else value
+
+
+def make_attrgetter(environment, attribute, postprocess=None):
+    """Returns a callable that looks up the given attribute from a
+    passed object with the rules of the environment.  Dots are allowed
+    to access attributes of attributes.  Integer parts in paths are
+    looked up as integers.
+    """
+    if attribute is None:
+        attribute = []
+    elif isinstance(attribute, string_types):
+        attribute = [int(x) if x.isdigit() else x for x in attribute.split('.')]
+    else:
+        attribute = [attribute]
+
+    def attrgetter(item):
+        for part in attribute:
+            item = environment.getitem(item, part)
+
+        if postprocess is not None:
+            item = postprocess(item)
+
+        return item
+
+    return attrgetter
+
+
+def do_forceescape(value):
+    """Enforce HTML escaping.  This will probably double escape variables."""
+    if hasattr(value, '__html__'):
+        value = value.__html__()
+    return escape(text_type(value))
+
+
+def do_urlencode(value):
+    """Escape strings for use in URLs (uses UTF-8 encoding).  It accepts both
+    dictionaries and regular strings as well as pairwise iterables.
+
+    .. versionadded:: 2.7
+    """
+    itemiter = None
+    if isinstance(value, dict):
+        itemiter = iteritems(value)
+    elif not isinstance(value, string_types):
+        try:
+            itemiter = iter(value)
+        except TypeError:
+            pass
+    if itemiter is None:
+        return unicode_urlencode(value)
+    return u'&'.join(unicode_urlencode(k) + '=' +
+                     unicode_urlencode(v, for_qs=True)
+                     for k, v in itemiter)
+
+
+@evalcontextfilter
+def do_replace(eval_ctx, s, old, new, count=None):
+    """Return a copy of the value with all occurrences of a substring
+    replaced with a new one. The first argument is the substring
+    that should be replaced, the second is the replacement string.
+    If the optional third argument ``count`` is given, only the first
+    ``count`` occurrences are replaced:
+
+    .. sourcecode:: jinja
+
+        {{ "Hello World"|replace("Hello", "Goodbye") }}
+            -> Goodbye World
+
+        {{ "aaaaargh"|replace("a", "d'oh, ", 2) }}
+            -> d'oh, d'oh, aaargh
+    """
+    if count is None:
+        count = -1
+    if not eval_ctx.autoescape:
+        return text_type(s).replace(text_type(old), text_type(new), count)
+    if hasattr(old, '__html__') or hasattr(new, '__html__') and \
+       not hasattr(s, '__html__'):
+        s = escape(s)
+    else:
+        s = soft_unicode(s)
+    return s.replace(soft_unicode(old), soft_unicode(new), count)
+
+
+def do_upper(s):
+    """Convert a value to uppercase."""
+    return soft_unicode(s).upper()
+
+
+def do_lower(s):
+    """Convert a value to lowercase."""
+    return soft_unicode(s).lower()
+
+
+@evalcontextfilter
+def do_xmlattr(_eval_ctx, d, autospace=True):
+    """Create an SGML/XML attribute string based on the items in a dict.
+    All values that are neither `none` nor `undefined` are automatically
+    escaped:
+
+    .. sourcecode:: html+jinja
+
+        <ul{{ {'class': 'my_list', 'missing': none,
+                'id': 'list-%d'|format(variable)}|xmlattr }}>
+        ...
+        </ul>
+
+    Results in something like this:
+
+    .. sourcecode:: html
+
+        <ul class="my_list" id="list-42">
+        ...
+        </ul>
+
+    As you can see it automatically prepends a space in front of the item
+    if the filter returned something unless the second parameter is false.
+    """
+    rv = u' '.join(
+        u'%s="%s"' % (escape(key), escape(value))
+        for key, value in iteritems(d)
+        if value is not None and not isinstance(value, Undefined)
+    )
+    if autospace and rv:
+        rv = u' ' + rv
+    if _eval_ctx.autoescape:
+        rv = Markup(rv)
+    return rv
+
+
+def do_capitalize(s):
+    """Capitalize a value. The first character will be uppercase, all others
+    lowercase.
+    """
+    return soft_unicode(s).capitalize()
+
+
+def do_title(s):
+    """Return a titlecased version of the value. I.e. words will start with
+    uppercase letters, all remaining characters are lowercase.
+    """
+    return ''.join(
+        [item[0].upper() + item[1:].lower()
+         for item in _word_beginning_split_re.split(soft_unicode(s))
+         if item])
+
+
+def do_dictsort(value, case_sensitive=False, by='key', reverse=False):
+    """Sort a dict and yield (key, value) pairs. Because python dicts are
+    unsorted you may want to use this function to order them by either
+    key or value:
+
+    .. sourcecode:: jinja
+
+        {% for item in mydict|dictsort %}
+            sort the dict by key, case insensitive
+
+        {% for item in mydict|dictsort(reverse=true) %}
+            sort the dict by key, case insensitive, reverse order
+
+        {% for item in mydict|dictsort(true) %}
+            sort the dict by key, case sensitive
+
+        {% for item in mydict|dictsort(false, 'value') %}
+            sort the dict by value, case insensitive
+    """
+    if by == 'key':
+        pos = 0
+    elif by == 'value':
+        pos = 1
+    else:
+        raise FilterArgumentError(
+            'You can only sort by either "key" or "value"'
+        )
+
+    def sort_func(item):
+        value = item[pos]
+
+        if not case_sensitive:
+            value = ignore_case(value)
+
+        return value
+
+    return sorted(value.items(), key=sort_func, reverse=reverse)
+
+
+@environmentfilter
+def do_sort(
+    environment, value, reverse=False, case_sensitive=False, attribute=None
+):
+    """Sort an iterable.  Per default it sorts ascending, if you pass it
+    true as first argument it will reverse the sorting.
+
+    If the iterable is made of strings the third parameter can be used to
+    control the case sensitiveness of the comparison which is disabled by
+    default.
+
+    .. sourcecode:: jinja
+
+        {% for item in iterable|sort %}
+            ...
+        {% endfor %}
+
+    It is also possible to sort by an attribute (for example to sort
+    by the date of an object) by specifying the `attribute` parameter:
+
+    .. sourcecode:: jinja
+
+        {% for item in iterable|sort(attribute='date') %}
+            ...
+        {% endfor %}
+
+    .. versionchanged:: 2.6
+       The `attribute` parameter was added.
+    """
+    key_func = make_attrgetter(
+        environment, attribute,
+        postprocess=ignore_case if not case_sensitive else None
+    )
+    return sorted(value, key=key_func, reverse=reverse)
+
+
+@environmentfilter
+def do_unique(environment, value, case_sensitive=False, attribute=None):
+    """Returns a list of unique items from the the given iterable.
+
+    .. sourcecode:: jinja
+
+        {{ ['foo', 'bar', 'foobar', 'FooBar']|unique }}
+            -> ['foo', 'bar', 'foobar']
+
+    The unique items are yielded in the same order as their first occurrence in
+    the iterable passed to the filter.
+
+    :param case_sensitive: Treat upper and lower case strings as distinct.
+    :param attribute: Filter objects with unique values for this attribute.
+    """
+    getter = make_attrgetter(
+        environment, attribute,
+        postprocess=ignore_case if not case_sensitive else None
+    )
+    seen = set()
+
+    for item in value:
+        key = getter(item)
+
+        if key not in seen:
+            seen.add(key)
+            yield item
+
+
+def _min_or_max(environment, value, func, case_sensitive, attribute):
+    it = iter(value)
+
+    try:
+        first = next(it)
+    except StopIteration:
+        return environment.undefined('No aggregated item, sequence was empty.')
+
+    key_func = make_attrgetter(
+        environment, attribute,
+        ignore_case if not case_sensitive else None
+    )
+    return func(chain([first], it), key=key_func)
+
+
+@environmentfilter
+def do_min(environment, value, case_sensitive=False, attribute=None):
+    """Return the smallest item from the sequence.
+
+    .. sourcecode:: jinja
+
+        {{ [1, 2, 3]|min }}
+            -> 1
+
+    :param case_sensitive: Treat upper and lower case strings as distinct.
+    :param attribute: Get the object with the max value of this attribute.
+    """
+    return _min_or_max(environment, value, min, case_sensitive, attribute)
+
+
+@environmentfilter
+def do_max(environment, value, case_sensitive=False, attribute=None):
+    """Return the largest item from the sequence.
+
+    .. sourcecode:: jinja
+
+        {{ [1, 2, 3]|max }}
+            -> 3
+
+    :param case_sensitive: Treat upper and lower case strings as distinct.
+    :param attribute: Get the object with the max value of this attribute.
+    """
+    return _min_or_max(environment, value, max, case_sensitive, attribute)
+
+
+def do_default(value, default_value=u'', boolean=False):
+    """If the value is undefined it will return the passed default value,
+    otherwise the value of the variable:
+
+    .. sourcecode:: jinja
+
+        {{ my_variable|default('my_variable is not defined') }}
+
+    This will output the value of ``my_variable`` if the variable was
+    defined, otherwise ``'my_variable is not defined'``. If you want
+    to use default with variables that evaluate to false you have to
+    set the second parameter to `true`:
+
+    .. sourcecode:: jinja
+
+        {{ ''|default('the string was empty', true) }}
+    """
+    if isinstance(value, Undefined) or (boolean and not value):
+        return default_value
+    return value
+
+
+@evalcontextfilter
+def do_join(eval_ctx, value, d=u'', attribute=None):
+    """Return a string which is the concatenation of the strings in the
+    sequence. The separator between elements is an empty string per
+    default, you can define it with the optional parameter:
+
+    .. sourcecode:: jinja
+
+        {{ [1, 2, 3]|join('|') }}
+            -> 1|2|3
+
+        {{ [1, 2, 3]|join }}
+            -> 123
+
+    It is also possible to join certain attributes of an object:
+
+    .. sourcecode:: jinja
+
+        {{ users|join(', ', attribute='username') }}
+
+    .. versionadded:: 2.6
+       The `attribute` parameter was added.
+    """
+    if attribute is not None:
+        value = imap(make_attrgetter(eval_ctx.environment, attribute), value)
+
+    # no automatic escaping?  joining is a lot eaiser then
+    if not eval_ctx.autoescape:
+        return text_type(d).join(imap(text_type, value))
+
+    # if the delimiter doesn't have an html representation we check
+    # if any of the items has.  If yes we do a coercion to Markup
+    if not hasattr(d, '__html__'):
+        value = list(value)
+        do_escape = False
+        for idx, item in enumerate(value):
+            if hasattr(item, '__html__'):
+                do_escape = True
+            else:
+                value[idx] = text_type(item)
+        if do_escape:
+            d = escape(d)
+        else:
+            d = text_type(d)
+        return d.join(value)
+
+    # no html involved, to normal joining
+    return soft_unicode(d).join(imap(soft_unicode, value))
+
+
+def do_center(value, width=80):
+    """Centers the value in a field of a given width."""
+    return text_type(value).center(width)
+
+
+@environmentfilter
+def do_first(environment, seq):
+    """Return the first item of a sequence."""
+    try:
+        return next(iter(seq))
+    except StopIteration:
+        return environment.undefined('No first item, sequence was empty.')
+
+
+@environmentfilter
+def do_last(environment, seq):
+    """Return the last item of a sequence."""
+    try:
+        return next(iter(reversed(seq)))
+    except StopIteration:
+        return environment.undefined('No last item, sequence was empty.')
+
+
+@contextfilter
+def do_random(context, seq):
+    """Return a random item from the sequence."""
+    try:
+        return random.choice(seq)
+    except IndexError:
+        return context.environment.undefined('No random item, sequence was empty.')
+
+
+def do_filesizeformat(value, binary=False):
+    """Format the value like a 'human-readable' file size (i.e. 13 kB,
+    4.1 MB, 102 Bytes, etc).  Per default decimal prefixes are used (Mega,
+    Giga, etc.), if the second parameter is set to `True` the binary
+    prefixes are used (Mebi, Gibi).
+    """
+    bytes = float(value)
+    base = binary and 1024 or 1000
+    prefixes = [
+        (binary and 'KiB' or 'kB'),
+        (binary and 'MiB' or 'MB'),
+        (binary and 'GiB' or 'GB'),
+        (binary and 'TiB' or 'TB'),
+        (binary and 'PiB' or 'PB'),
+        (binary and 'EiB' or 'EB'),
+        (binary and 'ZiB' or 'ZB'),
+        (binary and 'YiB' or 'YB')
+    ]
+    if bytes == 1:
+        return '1 Byte'
+    elif bytes < base:
+        return '%d Bytes' % bytes
+    else:
+        for i, prefix in enumerate(prefixes):
+            unit = base ** (i + 2)
+            if bytes < unit:
+                return '%.1f %s' % ((base * bytes / unit), prefix)
+        return '%.1f %s' % ((base * bytes / unit), prefix)
+
+
+def do_pprint(value, verbose=False):
+    """Pretty print a variable. Useful for debugging.
+
+    With Jinja 1.2 onwards you can pass it a parameter.  If this parameter
+    is truthy the output will be more verbose (this requires `pretty`)
+    """
+    return pformat(value, verbose=verbose)
+
+
+@evalcontextfilter
+def do_urlize(eval_ctx, value, trim_url_limit=None, nofollow=False,
+              target=None, rel=None):
+    """Converts URLs in plain text into clickable links.
+
+    If you pass the filter an additional integer it will shorten the urls
+    to that number. Also a third argument exists that makes the urls
+    "nofollow":
+
+    .. sourcecode:: jinja
+
+        {{ mytext|urlize(40, true) }}
+            links are shortened to 40 chars and defined with rel="nofollow"
+
+    If *target* is specified, the ``target`` attribute will be added to the
+    ``<a>`` tag:
+
+    .. sourcecode:: jinja
+
+       {{ mytext|urlize(40, target='_blank') }}
+
+    .. versionchanged:: 2.8+
+       The *target* parameter was added.
+    """
+    policies = eval_ctx.environment.policies
+    rel = set((rel or '').split() or [])
+    if nofollow:
+        rel.add('nofollow')
+    rel.update((policies['urlize.rel'] or '').split())
+    if target is None:
+        target = policies['urlize.target']
+    rel = ' '.join(sorted(rel)) or None
+    rv = urlize(value, trim_url_limit, rel=rel, target=target)
+    if eval_ctx.autoescape:
+        rv = Markup(rv)
+    return rv
+
+
+def do_indent(
+    s, width=4, first=False, blank=False, indentfirst=None
+):
+    """Return a copy of the string with each line indented by 4 spaces. The
+    first line and blank lines are not indented by default.
+
+    :param width: Number of spaces to indent by.
+    :param first: Don't skip indenting the first line.
+    :param blank: Don't skip indenting empty lines.
+
+    .. versionchanged:: 2.10
+        Blank lines are not indented by default.
+
+        Rename the ``indentfirst`` argument to ``first``.
+    """
+    if indentfirst is not None:
+        warnings.warn(DeprecationWarning(
+            'The "indentfirst" argument is renamed to "first".'
+        ), stacklevel=2)
+        first = indentfirst
+
+    s += u'\n'  # this quirk is necessary for splitlines method
+    indention = u' ' * width
+
+    if blank:
+        rv = (u'\n' + indention).join(s.splitlines())
+    else:
+        lines = s.splitlines()
+        rv = lines.pop(0)
+
+        if lines:
+            rv += u'\n' + u'\n'.join(
+                indention + line if line else line for line in lines
+            )
+
+    if first:
+        rv = indention + rv
+
+    return rv
+
+
+@environmentfilter
+def do_truncate(env, s, length=255, killwords=False, end='...', leeway=None):
+    """Return a truncated copy of the string. The length is specified
+    with the first parameter which defaults to ``255``. If the second
+    parameter is ``true`` the filter will cut the text at length. Otherwise
+    it will discard the last word. If the text was in fact
+    truncated it will append an ellipsis sign (``"..."``). If you want a
+    different ellipsis sign than ``"..."`` you can specify it using the
+    third parameter. Strings that only exceed the length by the tolerance
+    margin given in the fourth parameter will not be truncated.
+
+    .. sourcecode:: jinja
+
+        {{ "foo bar baz qux"|truncate(9) }}
+            -> "foo..."
+        {{ "foo bar baz qux"|truncate(9, True) }}
+            -> "foo ba..."
+        {{ "foo bar baz qux"|truncate(11) }}
+            -> "foo bar baz qux"
+        {{ "foo bar baz qux"|truncate(11, False, '...', 0) }}
+            -> "foo bar..."
+
+    The default leeway on newer Jinja2 versions is 5 and was 0 before but
+    can be reconfigured globally.
+    """
+    if leeway is None:
+        leeway = env.policies['truncate.leeway']
+    assert length >= len(end), 'expected length >= %s, got %s' % (len(end), length)
+    assert leeway >= 0, 'expected leeway >= 0, got %s' % leeway
+    if len(s) <= length + leeway:
+        return s
+    if killwords:
+        return s[:length - len(end)] + end
+    result = s[:length - len(end)].rsplit(' ', 1)[0]
+    return result + end
+
+
+@environmentfilter
+def do_wordwrap(environment, s, width=79, break_long_words=True,
+                wrapstring=None):
+    """
+    Return a copy of the string passed to the filter wrapped after
+    ``79`` characters.  You can override this default using the first
+    parameter.  If you set the second parameter to `false` Jinja will not
+    split words apart if they are longer than `width`. By default, the newlines
+    will be the default newlines for the environment, but this can be changed
+    using the wrapstring keyword argument.
+
+    .. versionadded:: 2.7
+       Added support for the `wrapstring` parameter.
+    """
+    if not wrapstring:
+        wrapstring = environment.newline_sequence
+    import textwrap
+    return wrapstring.join(textwrap.wrap(s, width=width, expand_tabs=False,
+                                   replace_whitespace=False,
+                                   break_long_words=break_long_words))
+
+
+def do_wordcount(s):
+    """Count the words in that string."""
+    return len(_word_re.findall(s))
+
+
+def do_int(value, default=0, base=10):
+    """Convert the value into an integer. If the
+    conversion doesn't work it will return ``0``. You can
+    override this default using the first parameter. You
+    can also override the default base (10) in the second
+    parameter, which handles input with prefixes such as
+    0b, 0o and 0x for bases 2, 8 and 16 respectively.
+    The base is ignored for decimal numbers and non-string values.
+    """
+    try:
+        if isinstance(value, string_types):
+            return int(value, base)
+        return int(value)
+    except (TypeError, ValueError):
+        # this quirk is necessary so that "42.23"|int gives 42.
+        try:
+            return int(float(value))
+        except (TypeError, ValueError):
+            return default
+
+
+def do_float(value, default=0.0):
+    """Convert the value into a floating point number. If the
+    conversion doesn't work it will return ``0.0``. You can
+    override this default using the first parameter.
+    """
+    try:
+        return float(value)
+    except (TypeError, ValueError):
+        return default
+
+
+def do_format(value, *args, **kwargs):
+    """
+    Apply python string formatting on an object:
+
+    .. sourcecode:: jinja
+
+        {{ "%s - %s"|format("Hello?", "Foo!") }}
+            -> Hello? - Foo!
+    """
+    if args and kwargs:
+        raise FilterArgumentError('can\'t handle positional and keyword '
+                                  'arguments at the same time')
+    return soft_unicode(value) % (kwargs or args)
+
+
+def do_trim(value):
+    """Strip leading and trailing whitespace."""
+    return soft_unicode(value).strip()
+
+
+def do_striptags(value):
+    """Strip SGML/XML tags and replace adjacent whitespace by one space.
+    """
+    if hasattr(value, '__html__'):
+        value = value.__html__()
+    return Markup(text_type(value)).striptags()
+
+
+def do_slice(value, slices, fill_with=None):
+    """Slice an iterator and return a list of lists containing
+    those items. Useful if you want to create a div containing
+    three ul tags that represent columns:
+
+    .. sourcecode:: html+jinja
+
+        <div class="columwrapper">
+          {%- for column in items|slice(3) %}
+            <ul class="column-{{ loop.index }}">
+            {%- for item in column %}
+              <li>{{ item }}</li>
+            {%- endfor %}
+            </ul>
+          {%- endfor %}
+        </div>
+
+    If you pass it a second argument it's used to fill missing
+    values on the last iteration.
+    """
+    seq = list(value)
+    length = len(seq)
+    items_per_slice = length // slices
+    slices_with_extra = length % slices
+    offset = 0
+    for slice_number in range(slices):
+        start = offset + slice_number * items_per_slice
+        if slice_number < slices_with_extra:
+            offset += 1
+        end = offset + (slice_number + 1) * items_per_slice
+        tmp = seq[start:end]
+        if fill_with is not None and slice_number >= slices_with_extra:
+            tmp.append(fill_with)
+        yield tmp
+
+
+def do_batch(value, linecount, fill_with=None):
+    """
+    A filter that batches items. It works pretty much like `slice`
+    just the other way round. It returns a list of lists with the
+    given number of items. If you provide a second parameter this
+    is used to fill up missing items. See this example:
+
+    .. sourcecode:: html+jinja
+
+        <table>
+        {%- for row in items|batch(3, '&nbsp;') %}
+          <tr>
+          {%- for column in row %}
+            <td>{{ column }}</td>
+          {%- endfor %}
+          </tr>
+        {%- endfor %}
+        </table>
+    """
+    tmp = []
+    for item in value:
+        if len(tmp) == linecount:
+            yield tmp
+            tmp = []
+        tmp.append(item)
+    if tmp:
+        if fill_with is not None and len(tmp) < linecount:
+            tmp += [fill_with] * (linecount - len(tmp))
+        yield tmp
+
+
+def do_round(value, precision=0, method='common'):
+    """Round the number to a given precision. The first
+    parameter specifies the precision (default is ``0``), the
+    second the rounding method:
+
+    - ``'common'`` rounds either up or down
+    - ``'ceil'`` always rounds up
+    - ``'floor'`` always rounds down
+
+    If you don't specify a method ``'common'`` is used.
+
+    .. sourcecode:: jinja
+
+        {{ 42.55|round }}
+            -> 43.0
+        {{ 42.55|round(1, 'floor') }}
+            -> 42.5
+
+    Note that even if rounded to 0 precision, a float is returned.  If
+    you need a real integer, pipe it through `int`:
+
+    .. sourcecode:: jinja
+
+        {{ 42.55|round|int }}
+            -> 43
+    """
+    if not method in ('common', 'ceil', 'floor'):
+        raise FilterArgumentError('method must be common, ceil or floor')
+    if method == 'common':
+        return round(value, precision)
+    func = getattr(math, method)
+    return func(value * (10 ** precision)) / (10 ** precision)
+
+
+# Use a regular tuple repr here.  This is what we did in the past and we
+# really want to hide this custom type as much as possible.  In particular
+# we do not want to accidentally expose an auto generated repr in case
+# people start to print this out in comments or something similar for
+# debugging.
+_GroupTuple = namedtuple('_GroupTuple', ['grouper', 'list'])
+_GroupTuple.__repr__ = tuple.__repr__
+_GroupTuple.__str__ = tuple.__str__
+
+@environmentfilter
+def do_groupby(environment, value, attribute):
+    """Group a sequence of objects by a common attribute.
+
+    If you for example have a list of dicts or objects that represent persons
+    with `gender`, `first_name` and `last_name` attributes and you want to
+    group all users by genders you can do something like the following
+    snippet:
+
+    .. sourcecode:: html+jinja
+
+        <ul>
+        {% for group in persons|groupby('gender') %}
+            <li>{{ group.grouper }}<ul>
+            {% for person in group.list %}
+                <li>{{ person.first_name }} {{ person.last_name }}</li>
+            {% endfor %}</ul></li>
+        {% endfor %}
+        </ul>
+
+    Additionally it's possible to use tuple unpacking for the grouper and
+    list:
+
+    .. sourcecode:: html+jinja
+
+        <ul>
+        {% for grouper, list in persons|groupby('gender') %}
+            ...
+        {% endfor %}
+        </ul>
+
+    As you can see the item we're grouping by is stored in the `grouper`
+    attribute and the `list` contains all the objects that have this grouper
+    in common.
+
+    .. versionchanged:: 2.6
+       It's now possible to use dotted notation to group by the child
+       attribute of another attribute.
+    """
+    expr = make_attrgetter(environment, attribute)
+    return [_GroupTuple(key, list(values)) for key, values
+            in groupby(sorted(value, key=expr), expr)]
+
+
+@environmentfilter
+def do_sum(environment, iterable, attribute=None, start=0):
+    """Returns the sum of a sequence of numbers plus the value of parameter
+    'start' (which defaults to 0).  When the sequence is empty it returns
+    start.
+
+    It is also possible to sum up only certain attributes:
+
+    .. sourcecode:: jinja
+
+        Total: {{ items|sum(attribute='price') }}
+
+    .. versionchanged:: 2.6
+       The `attribute` parameter was added to allow suming up over
+       attributes.  Also the `start` parameter was moved on to the right.
+    """
+    if attribute is not None:
+        iterable = imap(make_attrgetter(environment, attribute), iterable)
+    return sum(iterable, start)
+
+
+def do_list(value):
+    """Convert the value into a list.  If it was a string the returned list
+    will be a list of characters.
+    """
+    return list(value)
+
+
+def do_mark_safe(value):
+    """Mark the value as safe which means that in an environment with automatic
+    escaping enabled this variable will not be escaped.
+    """
+    return Markup(value)
+
+
+def do_mark_unsafe(value):
+    """Mark a value as unsafe.  This is the reverse operation for :func:`safe`."""
+    return text_type(value)
+
+
+def do_reverse(value):
+    """Reverse the object or return an iterator that iterates over it the other
+    way round.
+    """
+    if isinstance(value, string_types):
+        return value[::-1]
+    try:
+        return reversed(value)
+    except TypeError:
+        try:
+            rv = list(value)
+            rv.reverse()
+            return rv
+        except TypeError:
+            raise FilterArgumentError('argument must be iterable')
+
+
+@environmentfilter
+def do_attr(environment, obj, name):
+    """Get an attribute of an object.  ``foo|attr("bar")`` works like
+    ``foo.bar`` just that always an attribute is returned and items are not
+    looked up.
+
+    See :ref:`Notes on subscriptions <notes-on-subscriptions>` for more details.
+    """
+    try:
+        name = str(name)
+    except UnicodeError:
+        pass
+    else:
+        try:
+            value = getattr(obj, name)
+        except AttributeError:
+            pass
+        else:
+            if environment.sandboxed and not \
+               environment.is_safe_attribute(obj, name, value):
+                return environment.unsafe_undefined(obj, name)
+            return value
+    return environment.undefined(obj=obj, name=name)
+
+
+@contextfilter
+def do_map(*args, **kwargs):
+    """Applies a filter on a sequence of objects or looks up an attribute.
+    This is useful when dealing with lists of objects but you are really
+    only interested in a certain value of it.
+
+    The basic usage is mapping on an attribute.  Imagine you have a list
+    of users but you are only interested in a list of usernames:
+
+    .. sourcecode:: jinja
+
+        Users on this page: {{ users|map(attribute='username')|join(', ') }}
+
+    Alternatively you can let it invoke a filter by passing the name of the
+    filter and the arguments afterwards.  A good example would be applying a
+    text conversion filter on a sequence:
+
+    .. sourcecode:: jinja
+
+        Users on this page: {{ titles|map('lower')|join(', ') }}
+
+    .. versionadded:: 2.7
+    """
+    seq, func = prepare_map(args, kwargs)
+    if seq:
+        for item in seq:
+            yield func(item)
+
+
+@contextfilter
+def do_select(*args, **kwargs):
+    """Filters a sequence of objects by applying a test to each object,
+    and only selecting the objects with the test succeeding.
+
+    If no test is specified, each object will be evaluated as a boolean.
+
+    Example usage:
+
+    .. sourcecode:: jinja
+
+        {{ numbers|select("odd") }}
+        {{ numbers|select("odd") }}
+        {{ numbers|select("divisibleby", 3) }}
+        {{ numbers|select("lessthan", 42) }}
+        {{ strings|select("equalto", "mystring") }}
+
+    .. versionadded:: 2.7
+    """
+    return select_or_reject(args, kwargs, lambda x: x, False)
+
+
+@contextfilter
+def do_reject(*args, **kwargs):
+    """Filters a sequence of objects by applying a test to each object,
+    and rejecting the objects with the test succeeding.
+
+    If no test is specified, each object will be evaluated as a boolean.
+
+    Example usage:
+
+    .. sourcecode:: jinja
+
+        {{ numbers|reject("odd") }}
+
+    .. versionadded:: 2.7
+    """
+    return select_or_reject(args, kwargs, lambda x: not x, False)
+
+
+@contextfilter
+def do_selectattr(*args, **kwargs):
+    """Filters a sequence of objects by applying a test to the specified
+    attribute of each object, and only selecting the objects with the
+    test succeeding.
+
+    If no test is specified, the attribute's value will be evaluated as
+    a boolean.
+
+    Example usage:
+
+    .. sourcecode:: jinja
+
+        {{ users|selectattr("is_active") }}
+        {{ users|selectattr("email", "none") }}
+
+    .. versionadded:: 2.7
+    """
+    return select_or_reject(args, kwargs, lambda x: x, True)
+
+
+@contextfilter
+def do_rejectattr(*args, **kwargs):
+    """Filters a sequence of objects by applying a test to the specified
+    attribute of each object, and rejecting the objects with the test
+    succeeding.
+
+    If no test is specified, the attribute's value will be evaluated as
+    a boolean.
+
+    .. sourcecode:: jinja
+
+        {{ users|rejectattr("is_active") }}
+        {{ users|rejectattr("email", "none") }}
+
+    .. versionadded:: 2.7
+    """
+    return select_or_reject(args, kwargs, lambda x: not x, True)
+
+
+@evalcontextfilter
+def do_tojson(eval_ctx, value, indent=None):
+    """Dumps a structure to JSON so that it's safe to use in ``<script>``
+    tags.  It accepts the same arguments and returns a JSON string.  Note that
+    this is available in templates through the ``|tojson`` filter which will
+    also mark the result as safe.  Due to how this function escapes certain
+    characters this is safe even if used outside of ``<script>`` tags.
+
+    The following characters are escaped in strings:
+
+    -   ``<``
+    -   ``>``
+    -   ``&``
+    -   ``'``
+
+    This makes it safe to embed such strings in any place in HTML with the
+    notable exception of double quoted attributes.  In that case single
+    quote your attributes or HTML escape it in addition.
+
+    The indent parameter can be used to enable pretty printing.  Set it to
+    the number of spaces that the structures should be indented with.
+
+    Note that this filter is for use in HTML contexts only.
+
+    .. versionadded:: 2.9
+    """
+    policies = eval_ctx.environment.policies
+    dumper = policies['json.dumps_function']
+    options = policies['json.dumps_kwargs']
+    if indent is not None:
+        options = dict(options)
+        options['indent'] = indent
+    return htmlsafe_json_dumps(value, dumper=dumper, **options)
+
+
+def prepare_map(args, kwargs):
+    context = args[0]
+    seq = args[1]
+
+    if len(args) == 2 and 'attribute' in kwargs:
+        attribute = kwargs.pop('attribute')
+        if kwargs:
+            raise FilterArgumentError('Unexpected keyword argument %r' %
+                next(iter(kwargs)))
+        func = make_attrgetter(context.environment, attribute)
+    else:
+        try:
+            name = args[2]
+            args = args[3:]
+        except LookupError:
+            raise FilterArgumentError('map requires a filter argument')
+        func = lambda item: context.environment.call_filter(
+            name, item, args, kwargs, context=context)
+
+    return seq, func
+
+
+def prepare_select_or_reject(args, kwargs, modfunc, lookup_attr):
+    context = args[0]
+    seq = args[1]
+    if lookup_attr:
+        try:
+            attr = args[2]
+        except LookupError:
+            raise FilterArgumentError('Missing parameter for attribute name')
+        transfunc = make_attrgetter(context.environment, attr)
+        off = 1
+    else:
+        off = 0
+        transfunc = lambda x: x
+
+    try:
+        name = args[2 + off]
+        args = args[3 + off:]
+        func = lambda item: context.environment.call_test(
+            name, item, args, kwargs)
+    except LookupError:
+        func = bool
+
+    return seq, lambda item: modfunc(func(transfunc(item)))
+
+
+def select_or_reject(args, kwargs, modfunc, lookup_attr):
+    seq, func = prepare_select_or_reject(args, kwargs, modfunc, lookup_attr)
+    if seq:
+        for item in seq:
+            if func(item):
+                yield item
+
+
+FILTERS = {
+    'abs':                  abs,
+    'attr':                 do_attr,
+    'batch':                do_batch,
+    'capitalize':           do_capitalize,
+    'center':               do_center,
+    'count':                len,
+    'd':                    do_default,
+    'default':              do_default,
+    'dictsort':             do_dictsort,
+    'e':                    escape,
+    'escape':               escape,
+    'filesizeformat':       do_filesizeformat,
+    'first':                do_first,
+    'float':                do_float,
+    'forceescape':          do_forceescape,
+    'format':               do_format,
+    'groupby':              do_groupby,
+    'indent':               do_indent,
+    'int':                  do_int,
+    'join':                 do_join,
+    'last':                 do_last,
+    'length':               len,
+    'list':                 do_list,
+    'lower':                do_lower,
+    'map':                  do_map,
+    'min':                  do_min,
+    'max':                  do_max,
+    'pprint':               do_pprint,
+    'random':               do_random,
+    'reject':               do_reject,
+    'rejectattr':           do_rejectattr,
+    'replace':              do_replace,
+    'reverse':              do_reverse,
+    'round':                do_round,
+    'safe':                 do_mark_safe,
+    'select':               do_select,
+    'selectattr':           do_selectattr,
+    'slice':                do_slice,
+    'sort':                 do_sort,
+    'string':               soft_unicode,
+    'striptags':            do_striptags,
+    'sum':                  do_sum,
+    'title':                do_title,
+    'trim':                 do_trim,
+    'truncate':             do_truncate,
+    'unique':               do_unique,
+    'upper':                do_upper,
+    'urlencode':            do_urlencode,
+    'urlize':               do_urlize,
+    'wordcount':            do_wordcount,
+    'wordwrap':             do_wordwrap,
+    'xmlattr':              do_xmlattr,
+    'tojson':               do_tojson,
+}
diff --git a/deps/jinja2/get_jinja2.sh b/deps/jinja2/get_jinja2.sh
new file mode 100755
index 00000000000000..bc6c4c3068f216
--- /dev/null
+++ b/deps/jinja2/get_jinja2.sh
@@ -0,0 +1,136 @@
+#!/bin/bash
+# Download and extract Jinja2
+# Homepage:
+# http://jinja.pocoo.org/
+# Installation instructions:
+# http://jinja.pocoo.org/docs/intro/#from-the-tarball-release
+# Download page:
+# https://pypi.python.org/pypi/Jinja2
+PACKAGE='Jinja2'
+VERSION='2.10'
+SRC_URL='https://pypi.python.org/packages/56/e6/332789f295cf22308386cf5bbd1f4e00ed11484299c5d7383378cf48ba47/Jinja2-2.10.tar.gz'
+PACKAGE_DIR='jinja2'
+
+CHROMIUM_FILES="README.chromium OWNERS get_jinja2.sh"
+EXTRA_FILES='LICENSE AUTHORS'
+REMOVE_FILES='testsuite'
+
+FILENAME="$(basename $SRC_URL)"
+MD5_FILENAME="$FILENAME.md5"
+SHA512_FILENAME="$FILENAME.sha512"
+CHROMIUM_FILES+=" $MD5_FILENAME $SHA512_FILENAME"
+
+BUILD_DIR="$PACKAGE-$VERSION"
+THIRD_PARTY="$(dirname $(realpath $(dirname "${BASH_SOURCE[0]}")))"
+INSTALL_DIR="$THIRD_PARTY/$PACKAGE_DIR"
+OUT_DIR="$INSTALL_DIR/$BUILD_DIR/$PACKAGE_DIR"
+OLD_DIR="$THIRD_PARTY/$PACKAGE_DIR.old"
+
+function check_hashes {
+  # Hashes generated via:
+  # FILENAME=Jinja2-2.8.tar.gz
+  # md5sum "$FILENAME" > "$FILENAME.md5"
+  # sha512sum "$FILENAME" > "$FILENAME.sha512"
+  # unset FILENAME
+
+  # MD5
+  if ! [ -f "$MD5_FILENAME" ]
+  then
+    echo "MD5 hash file $MD5_FILENAME not found, could not verify archive"
+    exit 1
+  fi
+
+  # 32-digit hash, followed by filename
+  MD5_HASHFILE_REGEX="^[0-9a-f]{32}  $FILENAME"
+  if ! grep --extended-regex --line-regex --silent \
+    "$MD5_HASHFILE_REGEX" "$MD5_FILENAME"
+  then
+    echo "MD5 hash file $MD5_FILENAME does not contain hash for $FILENAME," \
+         'could not verify archive'
+    echo 'Hash file contents are:'
+    cat "$MD5_FILENAME"
+    exit 1
+  fi
+
+  if ! md5sum --check "$MD5_FILENAME"
+  then
+    echo 'MD5 hash does not match,' \
+         "archive file $FILENAME corrupt or compromised!"
+    exit 1
+  fi
+
+  # SHA-512
+  if ! [ -f "$SHA512_FILENAME" ]
+  then
+    echo "SHA-512 hash file $SHA512_FILENAME not found," \
+         'could not verify archive'
+    exit 1
+  fi
+
+  # 128-digit hash, followed by filename
+  SHA512_HASHFILE_REGEX="^[0-9a-f]{128}  $FILENAME"
+  if ! grep --extended-regex --line-regex --silent \
+    "$SHA512_HASHFILE_REGEX" "$SHA512_FILENAME"
+  then
+    echo "SHA-512 hash file $SHA512_FILENAME does not contain hash for" \
+         "$FILENAME, could not verify archive"
+    echo 'Hash file contents are:'
+    cat "$SHA512_FILENAME"
+    exit 1
+  fi
+
+  if ! sha512sum --check "$SHA512_FILENAME"
+  then
+    echo 'SHA-512 hash does not match,' \
+         "archive file $FILENAME corrupt or compromised!"
+    exit 1
+  fi
+}
+
+
+################################################################################
+# Body
+
+cd "$INSTALL_DIR"
+echo "Downloading $SRC_URL"
+curl --remote-name "$SRC_URL"
+check_hashes
+tar xvzf "$FILENAME"
+# Copy extra files over
+for FILE in $CHROMIUM_FILES
+do
+  cp "$FILE" "$OUT_DIR"
+done
+
+cd "$BUILD_DIR"
+for FILE in $EXTRA_FILES
+do
+  cp "$FILE" "$OUT_DIR"
+done
+
+cd "$OUT_DIR"
+for FILE in $REMOVE_FILES
+do
+  rm -fr "$FILE"
+done
+
+# Replace with new directory
+cd ..
+mv "$INSTALL_DIR" "$OLD_DIR"
+mv "$PACKAGE_DIR" "$INSTALL_DIR"
+cd "$INSTALL_DIR"
+rm -fr "$OLD_DIR"
+
+# Generating jinja2.gni
+cat > jinja2.gni <<EOF
+# DO NOT EDIT
+# This is generated from get_jinja2.sh.
+jinja2_sources = [
+EOF
+
+for i in $(LC_COLLATE=C ls *.py)
+do
+  echo "  \"//third_party/jinja2/${i}\"," >> jinja2.gni
+done
+
+echo "]" >> jinja2.gni
diff --git a/deps/jinja2/idtracking.py b/deps/jinja2/idtracking.py
new file mode 100644
index 00000000000000..491bfe083647c9
--- /dev/null
+++ b/deps/jinja2/idtracking.py
@@ -0,0 +1,286 @@
+from jinja2.visitor import NodeVisitor
+from jinja2._compat import iteritems
+
+
+VAR_LOAD_PARAMETER = 'param'
+VAR_LOAD_RESOLVE = 'resolve'
+VAR_LOAD_ALIAS = 'alias'
+VAR_LOAD_UNDEFINED = 'undefined'
+
+
+def find_symbols(nodes, parent_symbols=None):
+    sym = Symbols(parent=parent_symbols)
+    visitor = FrameSymbolVisitor(sym)
+    for node in nodes:
+        visitor.visit(node)
+    return sym
+
+
+def symbols_for_node(node, parent_symbols=None):
+    sym = Symbols(parent=parent_symbols)
+    sym.analyze_node(node)
+    return sym
+
+
+class Symbols(object):
+
+    def __init__(self, parent=None, level=None):
+        if level is None:
+            if parent is None:
+                level = 0
+            else:
+                level = parent.level + 1
+        self.level = level
+        self.parent = parent
+        self.refs = {}
+        self.loads = {}
+        self.stores = set()
+
+    def analyze_node(self, node, **kwargs):
+        visitor = RootVisitor(self)
+        visitor.visit(node, **kwargs)
+
+    def _define_ref(self, name, load=None):
+        ident = 'l_%d_%s' % (self.level, name)
+        self.refs[name] = ident
+        if load is not None:
+            self.loads[ident] = load
+        return ident
+
+    def find_load(self, target):
+        if target in self.loads:
+            return self.loads[target]
+        if self.parent is not None:
+            return self.parent.find_load(target)
+
+    def find_ref(self, name):
+        if name in self.refs:
+            return self.refs[name]
+        if self.parent is not None:
+            return self.parent.find_ref(name)
+
+    def ref(self, name):
+        rv = self.find_ref(name)
+        if rv is None:
+            raise AssertionError('Tried to resolve a name to a reference that '
+                                 'was unknown to the frame (%r)' % name)
+        return rv
+
+    def copy(self):
+        rv = object.__new__(self.__class__)
+        rv.__dict__.update(self.__dict__)
+        rv.refs = self.refs.copy()
+        rv.loads = self.loads.copy()
+        rv.stores = self.stores.copy()
+        return rv
+
+    def store(self, name):
+        self.stores.add(name)
+
+        # If we have not see the name referenced yet, we need to figure
+        # out what to set it to.
+        if name not in self.refs:
+            # If there is a parent scope we check if the name has a
+            # reference there.  If it does it means we might have to alias
+            # to a variable there.
+            if self.parent is not None:
+                outer_ref = self.parent.find_ref(name)
+                if outer_ref is not None:
+                    self._define_ref(name, load=(VAR_LOAD_ALIAS, outer_ref))
+                    return
+
+            # Otherwise we can just set it to undefined.
+            self._define_ref(name, load=(VAR_LOAD_UNDEFINED, None))
+
+    def declare_parameter(self, name):
+        self.stores.add(name)
+        return self._define_ref(name, load=(VAR_LOAD_PARAMETER, None))
+
+    def load(self, name):
+        target = self.find_ref(name)
+        if target is None:
+            self._define_ref(name, load=(VAR_LOAD_RESOLVE, name))
+
+    def branch_update(self, branch_symbols):
+        stores = {}
+        for branch in branch_symbols:
+            for target in branch.stores:
+                if target in self.stores:
+                    continue
+                stores[target] = stores.get(target, 0) + 1
+
+        for sym in branch_symbols:
+            self.refs.update(sym.refs)
+            self.loads.update(sym.loads)
+            self.stores.update(sym.stores)
+
+        for name, branch_count in iteritems(stores):
+            if branch_count == len(branch_symbols):
+                continue
+            target = self.find_ref(name)
+            assert target is not None, 'should not happen'
+
+            if self.parent is not None:
+                outer_target = self.parent.find_ref(name)
+                if outer_target is not None:
+                    self.loads[target] = (VAR_LOAD_ALIAS, outer_target)
+                    continue
+            self.loads[target] = (VAR_LOAD_RESOLVE, name)
+
+    def dump_stores(self):
+        rv = {}
+        node = self
+        while node is not None:
+            for name in node.stores:
+                if name not in rv:
+                    rv[name] = self.find_ref(name)
+            node = node.parent
+        return rv
+
+    def dump_param_targets(self):
+        rv = set()
+        node = self
+        while node is not None:
+            for target, (instr, _) in iteritems(self.loads):
+                if instr == VAR_LOAD_PARAMETER:
+                    rv.add(target)
+            node = node.parent
+        return rv
+
+
+class RootVisitor(NodeVisitor):
+
+    def __init__(self, symbols):
+        self.sym_visitor = FrameSymbolVisitor(symbols)
+
+    def _simple_visit(self, node, **kwargs):
+        for child in node.iter_child_nodes():
+            self.sym_visitor.visit(child)
+
+    visit_Template = visit_Block = visit_Macro = visit_FilterBlock = \
+        visit_Scope = visit_If = visit_ScopedEvalContextModifier = \
+        _simple_visit
+
+    def visit_AssignBlock(self, node, **kwargs):
+        for child in node.body:
+            self.sym_visitor.visit(child)
+
+    def visit_CallBlock(self, node, **kwargs):
+        for child in node.iter_child_nodes(exclude=('call',)):
+            self.sym_visitor.visit(child)
+
+    def visit_OverlayScope(self, node, **kwargs):
+        for child in node.body:
+            self.sym_visitor.visit(child)
+
+    def visit_For(self, node, for_branch='body', **kwargs):
+        if for_branch == 'body':
+            self.sym_visitor.visit(node.target, store_as_param=True)
+            branch = node.body
+        elif for_branch == 'else':
+            branch = node.else_
+        elif for_branch == 'test':
+            self.sym_visitor.visit(node.target, store_as_param=True)
+            if node.test is not None:
+                self.sym_visitor.visit(node.test)
+            return
+        else:
+            raise RuntimeError('Unknown for branch')
+        for item in branch or ():
+            self.sym_visitor.visit(item)
+
+    def visit_With(self, node, **kwargs):
+        for target in node.targets:
+            self.sym_visitor.visit(target)
+        for child in node.body:
+            self.sym_visitor.visit(child)
+
+    def generic_visit(self, node, *args, **kwargs):
+        raise NotImplementedError('Cannot find symbols for %r' %
+                                  node.__class__.__name__)
+
+
+class FrameSymbolVisitor(NodeVisitor):
+    """A visitor for `Frame.inspect`."""
+
+    def __init__(self, symbols):
+        self.symbols = symbols
+
+    def visit_Name(self, node, store_as_param=False, **kwargs):
+        """All assignments to names go through this function."""
+        if store_as_param or node.ctx == 'param':
+            self.symbols.declare_parameter(node.name)
+        elif node.ctx == 'store':
+            self.symbols.store(node.name)
+        elif node.ctx == 'load':
+            self.symbols.load(node.name)
+
+    def visit_NSRef(self, node, **kwargs):
+        self.symbols.load(node.name)
+
+    def visit_If(self, node, **kwargs):
+        self.visit(node.test, **kwargs)
+
+        original_symbols = self.symbols
+
+        def inner_visit(nodes):
+            self.symbols = rv = original_symbols.copy()
+            for subnode in nodes:
+                self.visit(subnode, **kwargs)
+            self.symbols = original_symbols
+            return rv
+
+        body_symbols = inner_visit(node.body)
+        elif_symbols = inner_visit(node.elif_)
+        else_symbols = inner_visit(node.else_ or ())
+
+        self.symbols.branch_update([body_symbols, elif_symbols, else_symbols])
+
+    def visit_Macro(self, node, **kwargs):
+        self.symbols.store(node.name)
+
+    def visit_Import(self, node, **kwargs):
+        self.generic_visit(node, **kwargs)
+        self.symbols.store(node.target)
+
+    def visit_FromImport(self, node, **kwargs):
+        self.generic_visit(node, **kwargs)
+        for name in node.names:
+            if isinstance(name, tuple):
+                self.symbols.store(name[1])
+            else:
+                self.symbols.store(name)
+
+    def visit_Assign(self, node, **kwargs):
+        """Visit assignments in the correct order."""
+        self.visit(node.node, **kwargs)
+        self.visit(node.target, **kwargs)
+
+    def visit_For(self, node, **kwargs):
+        """Visiting stops at for blocks.  However the block sequence
+        is visited as part of the outer scope.
+        """
+        self.visit(node.iter, **kwargs)
+
+    def visit_CallBlock(self, node, **kwargs):
+        self.visit(node.call, **kwargs)
+
+    def visit_FilterBlock(self, node, **kwargs):
+        self.visit(node.filter, **kwargs)
+
+    def visit_With(self, node, **kwargs):
+        for target in node.values:
+            self.visit(target)
+
+    def visit_AssignBlock(self, node, **kwargs):
+        """Stop visiting at block assigns."""
+        self.visit(node.target, **kwargs)
+
+    def visit_Scope(self, node, **kwargs):
+        """Stop visiting at scopes."""
+
+    def visit_Block(self, node, **kwargs):
+        """Stop visiting at blocks."""
+
+    def visit_OverlayScope(self, node, **kwargs):
+        """Do not visit into overlay scopes."""
diff --git a/deps/jinja2/jinja2.gni b/deps/jinja2/jinja2.gni
new file mode 100644
index 00000000000000..cef0d48a883ef5
--- /dev/null
+++ b/deps/jinja2/jinja2.gni
@@ -0,0 +1,31 @@
+# DO NOT EDIT
+# This is generated from get_jinja2.sh.
+jinja2_sources = [
+  "//third_party/jinja2/__init__.py",
+  "//third_party/jinja2/_compat.py",
+  "//third_party/jinja2/_identifier.py",
+  "//third_party/jinja2/asyncfilters.py",
+  "//third_party/jinja2/asyncsupport.py",
+  "//third_party/jinja2/bccache.py",
+  "//third_party/jinja2/compiler.py",
+  "//third_party/jinja2/constants.py",
+  "//third_party/jinja2/debug.py",
+  "//third_party/jinja2/defaults.py",
+  "//third_party/jinja2/environment.py",
+  "//third_party/jinja2/exceptions.py",
+  "//third_party/jinja2/ext.py",
+  "//third_party/jinja2/filters.py",
+  "//third_party/jinja2/idtracking.py",
+  "//third_party/jinja2/lexer.py",
+  "//third_party/jinja2/loaders.py",
+  "//third_party/jinja2/meta.py",
+  "//third_party/jinja2/nativetypes.py",
+  "//third_party/jinja2/nodes.py",
+  "//third_party/jinja2/optimizer.py",
+  "//third_party/jinja2/parser.py",
+  "//third_party/jinja2/runtime.py",
+  "//third_party/jinja2/sandbox.py",
+  "//third_party/jinja2/tests.py",
+  "//third_party/jinja2/utils.py",
+  "//third_party/jinja2/visitor.py",
+]
diff --git a/deps/jinja2/lexer.py b/deps/jinja2/lexer.py
new file mode 100644
index 00000000000000..6fd135dd5b0a3a
--- /dev/null
+++ b/deps/jinja2/lexer.py
@@ -0,0 +1,739 @@
+# -*- coding: utf-8 -*-
+"""
+    jinja2.lexer
+    ~~~~~~~~~~~~
+
+    This module implements a Jinja / Python combination lexer. The
+    `Lexer` class provided by this module is used to do some preprocessing
+    for Jinja.
+
+    On the one hand it filters out invalid operators like the bitshift
+    operators we don't allow in templates. On the other hand it separates
+    template code and python code in expressions.
+
+    :copyright: (c) 2017 by the Jinja Team.
+    :license: BSD, see LICENSE for more details.
+"""
+import re
+from collections import deque
+from operator import itemgetter
+
+from jinja2._compat import implements_iterator, intern, iteritems, text_type
+from jinja2.exceptions import TemplateSyntaxError
+from jinja2.utils import LRUCache
+
+# cache for the lexers. Exists in order to be able to have multiple
+# environments with the same lexer
+_lexer_cache = LRUCache(50)
+
+# static regular expressions
+whitespace_re = re.compile(r'\s+', re.U)
+string_re = re.compile(r"('([^'\\]*(?:\\.[^'\\]*)*)'"
+                       r'|"([^"\\]*(?:\\.[^"\\]*)*)")', re.S)
+integer_re = re.compile(r'\d+')
+
+try:
+    # check if this Python supports Unicode identifiers
+    compile('föö', '<unknown>', 'eval')
+except SyntaxError:
+    # no Unicode support, use ASCII identifiers
+    name_re = re.compile(r'[a-zA-Z_][a-zA-Z0-9_]*')
+    check_ident = False
+else:
+    # Unicode support, build a pattern to match valid characters, and set flag
+    # to use str.isidentifier to validate during lexing
+    from jinja2 import _identifier
+    name_re = re.compile(r'[\w{0}]+'.format(_identifier.pattern))
+    check_ident = True
+    # remove the pattern from memory after building the regex
+    import sys
+    del sys.modules['jinja2._identifier']
+    import jinja2
+    del jinja2._identifier
+    del _identifier
+
+float_re = re.compile(r'(?<!\.)\d+\.\d+')
+newline_re = re.compile(r'(\r\n|\r|\n)')
+
+# internal the tokens and keep references to them
+TOKEN_ADD = intern('add')
+TOKEN_ASSIGN = intern('assign')
+TOKEN_COLON = intern('colon')
+TOKEN_COMMA = intern('comma')
+TOKEN_DIV = intern('div')
+TOKEN_DOT = intern('dot')
+TOKEN_EQ = intern('eq')
+TOKEN_FLOORDIV = intern('floordiv')
+TOKEN_GT = intern('gt')
+TOKEN_GTEQ = intern('gteq')
+TOKEN_LBRACE = intern('lbrace')
+TOKEN_LBRACKET = intern('lbracket')
+TOKEN_LPAREN = intern('lparen')
+TOKEN_LT = intern('lt')
+TOKEN_LTEQ = intern('lteq')
+TOKEN_MOD = intern('mod')
+TOKEN_MUL = intern('mul')
+TOKEN_NE = intern('ne')
+TOKEN_PIPE = intern('pipe')
+TOKEN_POW = intern('pow')
+TOKEN_RBRACE = intern('rbrace')
+TOKEN_RBRACKET = intern('rbracket')
+TOKEN_RPAREN = intern('rparen')
+TOKEN_SEMICOLON = intern('semicolon')
+TOKEN_SUB = intern('sub')
+TOKEN_TILDE = intern('tilde')
+TOKEN_WHITESPACE = intern('whitespace')
+TOKEN_FLOAT = intern('float')
+TOKEN_INTEGER = intern('integer')
+TOKEN_NAME = intern('name')
+TOKEN_STRING = intern('string')
+TOKEN_OPERATOR = intern('operator')
+TOKEN_BLOCK_BEGIN = intern('block_begin')
+TOKEN_BLOCK_END = intern('block_end')
+TOKEN_VARIABLE_BEGIN = intern('variable_begin')
+TOKEN_VARIABLE_END = intern('variable_end')
+TOKEN_RAW_BEGIN = intern('raw_begin')
+TOKEN_RAW_END = intern('raw_end')
+TOKEN_COMMENT_BEGIN = intern('comment_begin')
+TOKEN_COMMENT_END = intern('comment_end')
+TOKEN_COMMENT = intern('comment')
+TOKEN_LINESTATEMENT_BEGIN = intern('linestatement_begin')
+TOKEN_LINESTATEMENT_END = intern('linestatement_end')
+TOKEN_LINECOMMENT_BEGIN = intern('linecomment_begin')
+TOKEN_LINECOMMENT_END = intern('linecomment_end')
+TOKEN_LINECOMMENT = intern('linecomment')
+TOKEN_DATA = intern('data')
+TOKEN_INITIAL = intern('initial')
+TOKEN_EOF = intern('eof')
+
+# bind operators to token types
+operators = {
+    '+':            TOKEN_ADD,
+    '-':            TOKEN_SUB,
+    '/':            TOKEN_DIV,
+    '//':           TOKEN_FLOORDIV,
+    '*':            TOKEN_MUL,
+    '%':            TOKEN_MOD,
+    '**':           TOKEN_POW,
+    '~':            TOKEN_TILDE,
+    '[':            TOKEN_LBRACKET,
+    ']':            TOKEN_RBRACKET,
+    '(':            TOKEN_LPAREN,
+    ')':            TOKEN_RPAREN,
+    '{':            TOKEN_LBRACE,
+    '}':            TOKEN_RBRACE,
+    '==':           TOKEN_EQ,
+    '!=':           TOKEN_NE,
+    '>':            TOKEN_GT,
+    '>=':           TOKEN_GTEQ,
+    '<':            TOKEN_LT,
+    '<=':           TOKEN_LTEQ,
+    '=':            TOKEN_ASSIGN,
+    '.':            TOKEN_DOT,
+    ':':            TOKEN_COLON,
+    '|':            TOKEN_PIPE,
+    ',':            TOKEN_COMMA,
+    ';':            TOKEN_SEMICOLON
+}
+
+reverse_operators = dict([(v, k) for k, v in iteritems(operators)])
+assert len(operators) == len(reverse_operators), 'operators dropped'
+operator_re = re.compile('(%s)' % '|'.join(re.escape(x) for x in
+                         sorted(operators, key=lambda x: -len(x))))
+
+ignored_tokens = frozenset([TOKEN_COMMENT_BEGIN, TOKEN_COMMENT,
+                            TOKEN_COMMENT_END, TOKEN_WHITESPACE,
+                            TOKEN_LINECOMMENT_BEGIN, TOKEN_LINECOMMENT_END,
+                            TOKEN_LINECOMMENT])
+ignore_if_empty = frozenset([TOKEN_WHITESPACE, TOKEN_DATA,
+                             TOKEN_COMMENT, TOKEN_LINECOMMENT])
+
+
+def _describe_token_type(token_type):
+    if token_type in reverse_operators:
+        return reverse_operators[token_type]
+    return {
+        TOKEN_COMMENT_BEGIN:        'begin of comment',
+        TOKEN_COMMENT_END:          'end of comment',
+        TOKEN_COMMENT:              'comment',
+        TOKEN_LINECOMMENT:          'comment',
+        TOKEN_BLOCK_BEGIN:          'begin of statement block',
+        TOKEN_BLOCK_END:            'end of statement block',
+        TOKEN_VARIABLE_BEGIN:       'begin of print statement',
+        TOKEN_VARIABLE_END:         'end of print statement',
+        TOKEN_LINESTATEMENT_BEGIN:  'begin of line statement',
+        TOKEN_LINESTATEMENT_END:    'end of line statement',
+        TOKEN_DATA:                 'template data / text',
+        TOKEN_EOF:                  'end of template'
+    }.get(token_type, token_type)
+
+
+def describe_token(token):
+    """Returns a description of the token."""
+    if token.type == 'name':
+        return token.value
+    return _describe_token_type(token.type)
+
+
+def describe_token_expr(expr):
+    """Like `describe_token` but for token expressions."""
+    if ':' in expr:
+        type, value = expr.split(':', 1)
+        if type == 'name':
+            return value
+    else:
+        type = expr
+    return _describe_token_type(type)
+
+
+def count_newlines(value):
+    """Count the number of newline characters in the string.  This is
+    useful for extensions that filter a stream.
+    """
+    return len(newline_re.findall(value))
+
+
+def compile_rules(environment):
+    """Compiles all the rules from the environment into a list of rules."""
+    e = re.escape
+    rules = [
+        (len(environment.comment_start_string), 'comment',
+         e(environment.comment_start_string)),
+        (len(environment.block_start_string), 'block',
+         e(environment.block_start_string)),
+        (len(environment.variable_start_string), 'variable',
+         e(environment.variable_start_string))
+    ]
+
+    if environment.line_statement_prefix is not None:
+        rules.append((len(environment.line_statement_prefix), 'linestatement',
+                      r'^[ \t\v]*' + e(environment.line_statement_prefix)))
+    if environment.line_comment_prefix is not None:
+        rules.append((len(environment.line_comment_prefix), 'linecomment',
+                      r'(?:^|(?<=\S))[^\S\r\n]*' +
+                      e(environment.line_comment_prefix)))
+
+    return [x[1:] for x in sorted(rules, reverse=True)]
+
+
+class Failure(object):
+    """Class that raises a `TemplateSyntaxError` if called.
+    Used by the `Lexer` to specify known errors.
+    """
+
+    def __init__(self, message, cls=TemplateSyntaxError):
+        self.message = message
+        self.error_class = cls
+
+    def __call__(self, lineno, filename):
+        raise self.error_class(self.message, lineno, filename)
+
+
+class Token(tuple):
+    """Token class."""
+    __slots__ = ()
+    lineno, type, value = (property(itemgetter(x)) for x in range(3))
+
+    def __new__(cls, lineno, type, value):
+        return tuple.__new__(cls, (lineno, intern(str(type)), value))
+
+    def __str__(self):
+        if self.type in reverse_operators:
+            return reverse_operators[self.type]
+        elif self.type == 'name':
+            return self.value
+        return self.type
+
+    def test(self, expr):
+        """Test a token against a token expression.  This can either be a
+        token type or ``'token_type:token_value'``.  This can only test
+        against string values and types.
+        """
+        # here we do a regular string equality check as test_any is usually
+        # passed an iterable of not interned strings.
+        if self.type == expr:
+            return True
+        elif ':' in expr:
+            return expr.split(':', 1) == [self.type, self.value]
+        return False
+
+    def test_any(self, *iterable):
+        """Test against multiple token expressions."""
+        for expr in iterable:
+            if self.test(expr):
+                return True
+        return False
+
+    def __repr__(self):
+        return 'Token(%r, %r, %r)' % (
+            self.lineno,
+            self.type,
+            self.value
+        )
+
+
+@implements_iterator
+class TokenStreamIterator(object):
+    """The iterator for tokenstreams.  Iterate over the stream
+    until the eof token is reached.
+    """
+
+    def __init__(self, stream):
+        self.stream = stream
+
+    def __iter__(self):
+        return self
+
+    def __next__(self):
+        token = self.stream.current
+        if token.type is TOKEN_EOF:
+            self.stream.close()
+            raise StopIteration()
+        next(self.stream)
+        return token
+
+
+@implements_iterator
+class TokenStream(object):
+    """A token stream is an iterable that yields :class:`Token`\\s.  The
+    parser however does not iterate over it but calls :meth:`next` to go
+    one token ahead.  The current active token is stored as :attr:`current`.
+    """
+
+    def __init__(self, generator, name, filename):
+        self._iter = iter(generator)
+        self._pushed = deque()
+        self.name = name
+        self.filename = filename
+        self.closed = False
+        self.current = Token(1, TOKEN_INITIAL, '')
+        next(self)
+
+    def __iter__(self):
+        return TokenStreamIterator(self)
+
+    def __bool__(self):
+        return bool(self._pushed) or self.current.type is not TOKEN_EOF
+    __nonzero__ = __bool__  # py2
+
+    eos = property(lambda x: not x, doc="Are we at the end of the stream?")
+
+    def push(self, token):
+        """Push a token back to the stream."""
+        self._pushed.append(token)
+
+    def look(self):
+        """Look at the next token."""
+        old_token = next(self)
+        result = self.current
+        self.push(result)
+        self.current = old_token
+        return result
+
+    def skip(self, n=1):
+        """Got n tokens ahead."""
+        for x in range(n):
+            next(self)
+
+    def next_if(self, expr):
+        """Perform the token test and return the token if it matched.
+        Otherwise the return value is `None`.
+        """
+        if self.current.test(expr):
+            return next(self)
+
+    def skip_if(self, expr):
+        """Like :meth:`next_if` but only returns `True` or `False`."""
+        return self.next_if(expr) is not None
+
+    def __next__(self):
+        """Go one token ahead and return the old one.
+
+        Use the built-in :func:`next` instead of calling this directly.
+        """
+        rv = self.current
+        if self._pushed:
+            self.current = self._pushed.popleft()
+        elif self.current.type is not TOKEN_EOF:
+            try:
+                self.current = next(self._iter)
+            except StopIteration:
+                self.close()
+        return rv
+
+    def close(self):
+        """Close the stream."""
+        self.current = Token(self.current.lineno, TOKEN_EOF, '')
+        self._iter = None
+        self.closed = True
+
+    def expect(self, expr):
+        """Expect a given token type and return it.  This accepts the same
+        argument as :meth:`jinja2.lexer.Token.test`.
+        """
+        if not self.current.test(expr):
+            expr = describe_token_expr(expr)
+            if self.current.type is TOKEN_EOF:
+                raise TemplateSyntaxError('unexpected end of template, '
+                                          'expected %r.' % expr,
+                                          self.current.lineno,
+                                          self.name, self.filename)
+            raise TemplateSyntaxError("expected token %r, got %r" %
+                                      (expr, describe_token(self.current)),
+                                      self.current.lineno,
+                                      self.name, self.filename)
+        try:
+            return self.current
+        finally:
+            next(self)
+
+
+def get_lexer(environment):
+    """Return a lexer which is probably cached."""
+    key = (environment.block_start_string,
+           environment.block_end_string,
+           environment.variable_start_string,
+           environment.variable_end_string,
+           environment.comment_start_string,
+           environment.comment_end_string,
+           environment.line_statement_prefix,
+           environment.line_comment_prefix,
+           environment.trim_blocks,
+           environment.lstrip_blocks,
+           environment.newline_sequence,
+           environment.keep_trailing_newline)
+    lexer = _lexer_cache.get(key)
+    if lexer is None:
+        lexer = Lexer(environment)
+        _lexer_cache[key] = lexer
+    return lexer
+
+
+class Lexer(object):
+    """Class that implements a lexer for a given environment. Automatically
+    created by the environment class, usually you don't have to do that.
+
+    Note that the lexer is not automatically bound to an environment.
+    Multiple environments can share the same lexer.
+    """
+
+    def __init__(self, environment):
+        # shortcuts
+        c = lambda x: re.compile(x, re.M | re.S)
+        e = re.escape
+
+        # lexing rules for tags
+        tag_rules = [
+            (whitespace_re, TOKEN_WHITESPACE, None),
+            (float_re, TOKEN_FLOAT, None),
+            (integer_re, TOKEN_INTEGER, None),
+            (name_re, TOKEN_NAME, None),
+            (string_re, TOKEN_STRING, None),
+            (operator_re, TOKEN_OPERATOR, None)
+        ]
+
+        # assemble the root lexing rule. because "|" is ungreedy
+        # we have to sort by length so that the lexer continues working
+        # as expected when we have parsing rules like <% for block and
+        # <%= for variables. (if someone wants asp like syntax)
+        # variables are just part of the rules if variable processing
+        # is required.
+        root_tag_rules = compile_rules(environment)
+
+        # block suffix if trimming is enabled
+        block_suffix_re = environment.trim_blocks and '\\n?' or ''
+
+        # strip leading spaces if lstrip_blocks is enabled
+        prefix_re = {}
+        if environment.lstrip_blocks:
+            # use '{%+' to manually disable lstrip_blocks behavior
+            no_lstrip_re = e('+')
+            # detect overlap between block and variable or comment strings
+            block_diff = c(r'^%s(.*)' % e(environment.block_start_string))
+            # make sure we don't mistake a block for a variable or a comment
+            m = block_diff.match(environment.comment_start_string)
+            no_lstrip_re += m and r'|%s' % e(m.group(1)) or ''
+            m = block_diff.match(environment.variable_start_string)
+            no_lstrip_re += m and r'|%s' % e(m.group(1)) or ''
+
+            # detect overlap between comment and variable strings
+            comment_diff = c(r'^%s(.*)' % e(environment.comment_start_string))
+            m = comment_diff.match(environment.variable_start_string)
+            no_variable_re = m and r'(?!%s)' % e(m.group(1)) or ''
+
+            lstrip_re = r'^[ \t]*'
+            block_prefix_re = r'%s%s(?!%s)|%s\+?' % (
+                    lstrip_re,
+                    e(environment.block_start_string),
+                    no_lstrip_re,
+                    e(environment.block_start_string),
+                    )
+            comment_prefix_re = r'%s%s%s|%s\+?' % (
+                    lstrip_re,
+                    e(environment.comment_start_string),
+                    no_variable_re,
+                    e(environment.comment_start_string),
+                    )
+            prefix_re['block'] = block_prefix_re
+            prefix_re['comment'] = comment_prefix_re
+        else:
+            block_prefix_re = '%s' % e(environment.block_start_string)
+
+        self.newline_sequence = environment.newline_sequence
+        self.keep_trailing_newline = environment.keep_trailing_newline
+
+        # global lexing rules
+        self.rules = {
+            'root': [
+                # directives
+                (c('(.*?)(?:%s)' % '|'.join(
+                    [r'(?P<raw_begin>(?:\s*%s\-|%s)\s*raw\s*(?:\-%s\s*|%s))' % (
+                        e(environment.block_start_string),
+                        block_prefix_re,
+                        e(environment.block_end_string),
+                        e(environment.block_end_string)
+                    )] + [
+                        r'(?P<%s_begin>\s*%s\-|%s)' % (n, r, prefix_re.get(n,r))
+                        for n, r in root_tag_rules
+                    ])), (TOKEN_DATA, '#bygroup'), '#bygroup'),
+                # data
+                (c('.+'), TOKEN_DATA, None)
+            ],
+            # comments
+            TOKEN_COMMENT_BEGIN: [
+                (c(r'(.*?)((?:\-%s\s*|%s)%s)' % (
+                    e(environment.comment_end_string),
+                    e(environment.comment_end_string),
+                    block_suffix_re
+                )), (TOKEN_COMMENT, TOKEN_COMMENT_END), '#pop'),
+                (c('(.)'), (Failure('Missing end of comment tag'),), None)
+            ],
+            # blocks
+            TOKEN_BLOCK_BEGIN: [
+                (c(r'(?:\-%s\s*|%s)%s' % (
+                    e(environment.block_end_string),
+                    e(environment.block_end_string),
+                    block_suffix_re
+                )), TOKEN_BLOCK_END, '#pop'),
+            ] + tag_rules,
+            # variables
+            TOKEN_VARIABLE_BEGIN: [
+                (c(r'\-%s\s*|%s' % (
+                    e(environment.variable_end_string),
+                    e(environment.variable_end_string)
+                )), TOKEN_VARIABLE_END, '#pop')
+            ] + tag_rules,
+            # raw block
+            TOKEN_RAW_BEGIN: [
+                (c(r'(.*?)((?:\s*%s\-|%s)\s*endraw\s*(?:\-%s\s*|%s%s))' % (
+                    e(environment.block_start_string),
+                    block_prefix_re,
+                    e(environment.block_end_string),
+                    e(environment.block_end_string),
+                    block_suffix_re
+                )), (TOKEN_DATA, TOKEN_RAW_END), '#pop'),
+                (c('(.)'), (Failure('Missing end of raw directive'),), None)
+            ],
+            # line statements
+            TOKEN_LINESTATEMENT_BEGIN: [
+                (c(r'\s*(\n|$)'), TOKEN_LINESTATEMENT_END, '#pop')
+            ] + tag_rules,
+            # line comments
+            TOKEN_LINECOMMENT_BEGIN: [
+                (c(r'(.*?)()(?=\n|$)'), (TOKEN_LINECOMMENT,
+                 TOKEN_LINECOMMENT_END), '#pop')
+            ]
+        }
+
+    def _normalize_newlines(self, value):
+        """Called for strings and template data to normalize it to unicode."""
+        return newline_re.sub(self.newline_sequence, value)
+
+    def tokenize(self, source, name=None, filename=None, state=None):
+        """Calls tokeniter + tokenize and wraps it in a token stream.
+        """
+        stream = self.tokeniter(source, name, filename, state)
+        return TokenStream(self.wrap(stream, name, filename), name, filename)
+
+    def wrap(self, stream, name=None, filename=None):
+        """This is called with the stream as returned by `tokenize` and wraps
+        every token in a :class:`Token` and converts the value.
+        """
+        for lineno, token, value in stream:
+            if token in ignored_tokens:
+                continue
+            elif token == 'linestatement_begin':
+                token = 'block_begin'
+            elif token == 'linestatement_end':
+                token = 'block_end'
+            # we are not interested in those tokens in the parser
+            elif token in ('raw_begin', 'raw_end'):
+                continue
+            elif token == 'data':
+                value = self._normalize_newlines(value)
+            elif token == 'keyword':
+                token = value
+            elif token == 'name':
+                value = str(value)
+                if check_ident and not value.isidentifier():
+                    raise TemplateSyntaxError(
+                        'Invalid character in identifier',
+                        lineno, name, filename)
+            elif token == 'string':
+                # try to unescape string
+                try:
+                    value = self._normalize_newlines(value[1:-1]) \
+                        .encode('ascii', 'backslashreplace') \
+                        .decode('unicode-escape')
+                except Exception as e:
+                    msg = str(e).split(':')[-1].strip()
+                    raise TemplateSyntaxError(msg, lineno, name, filename)
+            elif token == 'integer':
+                value = int(value)
+            elif token == 'float':
+                value = float(value)
+            elif token == 'operator':
+                token = operators[value]
+            yield Token(lineno, token, value)
+
+    def tokeniter(self, source, name, filename=None, state=None):
+        """This method tokenizes the text and returns the tokens in a
+        generator.  Use this method if you just want to tokenize a template.
+        """
+        source = text_type(source)
+        lines = source.splitlines()
+        if self.keep_trailing_newline and source:
+            for newline in ('\r\n', '\r', '\n'):
+                if source.endswith(newline):
+                    lines.append('')
+                    break
+        source = '\n'.join(lines)
+        pos = 0
+        lineno = 1
+        stack = ['root']
+        if state is not None and state != 'root':
+            assert state in ('variable', 'block'), 'invalid state'
+            stack.append(state + '_begin')
+        else:
+            state = 'root'
+        statetokens = self.rules[stack[-1]]
+        source_length = len(source)
+
+        balancing_stack = []
+
+        while 1:
+            # tokenizer loop
+            for regex, tokens, new_state in statetokens:
+                m = regex.match(source, pos)
+                # if no match we try again with the next rule
+                if m is None:
+                    continue
+
+                # we only match blocks and variables if braces / parentheses
+                # are balanced. continue parsing with the lower rule which
+                # is the operator rule. do this only if the end tags look
+                # like operators
+                if balancing_stack and \
+                   tokens in ('variable_end', 'block_end',
+                              'linestatement_end'):
+                    continue
+
+                # tuples support more options
+                if isinstance(tokens, tuple):
+                    for idx, token in enumerate(tokens):
+                        # failure group
+                        if token.__class__ is Failure:
+                            raise token(lineno, filename)
+                        # bygroup is a bit more complex, in that case we
+                        # yield for the current token the first named
+                        # group that matched
+                        elif token == '#bygroup':
+                            for key, value in iteritems(m.groupdict()):
+                                if value is not None:
+                                    yield lineno, key, value
+                                    lineno += value.count('\n')
+                                    break
+                            else:
+                                raise RuntimeError('%r wanted to resolve '
+                                                   'the token dynamically'
+                                                   ' but no group matched'
+                                                   % regex)
+                        # normal group
+                        else:
+                            data = m.group(idx + 1)
+                            if data or token not in ignore_if_empty:
+                                yield lineno, token, data
+                            lineno += data.count('\n')
+
+                # strings as token just are yielded as it.
+                else:
+                    data = m.group()
+                    # update brace/parentheses balance
+                    if tokens == 'operator':
+                        if data == '{':
+                            balancing_stack.append('}')
+                        elif data == '(':
+                            balancing_stack.append(')')
+                        elif data == '[':
+                            balancing_stack.append(']')
+                        elif data in ('}', ')', ']'):
+                            if not balancing_stack:
+                                raise TemplateSyntaxError('unexpected \'%s\'' %
+                                                          data, lineno, name,
+                                                          filename)
+                            expected_op = balancing_stack.pop()
+                            if expected_op != data:
+                                raise TemplateSyntaxError('unexpected \'%s\', '
+                                                          'expected \'%s\'' %
+                                                          (data, expected_op),
+                                                          lineno, name,
+                                                          filename)
+                    # yield items
+                    if data or tokens not in ignore_if_empty:
+                        yield lineno, tokens, data
+                    lineno += data.count('\n')
+
+                # fetch new position into new variable so that we can check
+                # if there is a internal parsing error which would result
+                # in an infinite loop
+                pos2 = m.end()
+
+                # handle state changes
+                if new_state is not None:
+                    # remove the uppermost state
+                    if new_state == '#pop':
+                        stack.pop()
+                    # resolve the new state by group checking
+                    elif new_state == '#bygroup':
+                        for key, value in iteritems(m.groupdict()):
+                            if value is not None:
+                                stack.append(key)
+                                break
+                        else:
+                            raise RuntimeError('%r wanted to resolve the '
+                                               'new state dynamically but'
+                                               ' no group matched' %
+                                               regex)
+                    # direct state name given
+                    else:
+                        stack.append(new_state)
+                    statetokens = self.rules[stack[-1]]
+                # we are still at the same position and no stack change.
+                # this means a loop without break condition, avoid that and
+                # raise error
+                elif pos2 == pos:
+                    raise RuntimeError('%r yielded empty string without '
+                                       'stack change' % regex)
+                # publish new function and start again
+                pos = pos2
+                break
+            # if loop terminated without break we haven't found a single match
+            # either we are at the end of the file or we have a problem
+            else:
+                # end of text
+                if pos >= source_length:
+                    return
+                # something went wrong
+                raise TemplateSyntaxError('unexpected char %r at %d' %
+                                          (source[pos], pos), lineno,
+                                          name, filename)
diff --git a/deps/jinja2/loaders.py b/deps/jinja2/loaders.py
new file mode 100644
index 00000000000000..4c797937606590
--- /dev/null
+++ b/deps/jinja2/loaders.py
@@ -0,0 +1,481 @@
+# -*- coding: utf-8 -*-
+"""
+    jinja2.loaders
+    ~~~~~~~~~~~~~~
+
+    Jinja loader classes.
+
+    :copyright: (c) 2017 by the Jinja Team.
+    :license: BSD, see LICENSE for more details.
+"""
+import os
+import sys
+import weakref
+from types import ModuleType
+from os import path
+from hashlib import sha1
+from jinja2.exceptions import TemplateNotFound
+from jinja2.utils import open_if_exists, internalcode
+from jinja2._compat import string_types, iteritems
+
+
+def split_template_path(template):
+    """Split a path into segments and perform a sanity check.  If it detects
+    '..' in the path it will raise a `TemplateNotFound` error.
+    """
+    pieces = []
+    for piece in template.split('/'):
+        if path.sep in piece \
+           or (path.altsep and path.altsep in piece) or \
+           piece == path.pardir:
+            raise TemplateNotFound(template)
+        elif piece and piece != '.':
+            pieces.append(piece)
+    return pieces
+
+
+class BaseLoader(object):
+    """Baseclass for all loaders.  Subclass this and override `get_source` to
+    implement a custom loading mechanism.  The environment provides a
+    `get_template` method that calls the loader's `load` method to get the
+    :class:`Template` object.
+
+    A very basic example for a loader that looks up templates on the file
+    system could look like this::
+
+        from jinja2 import BaseLoader, TemplateNotFound
+        from os.path import join, exists, getmtime
+
+        class MyLoader(BaseLoader):
+
+            def __init__(self, path):
+                self.path = path
+
+            def get_source(self, environment, template):
+                path = join(self.path, template)
+                if not exists(path):
+                    raise TemplateNotFound(template)
+                mtime = getmtime(path)
+                with file(path) as f:
+                    source = f.read().decode('utf-8')
+                return source, path, lambda: mtime == getmtime(path)
+    """
+
+    #: if set to `False` it indicates that the loader cannot provide access
+    #: to the source of templates.
+    #:
+    #: .. versionadded:: 2.4
+    has_source_access = True
+
+    def get_source(self, environment, template):
+        """Get the template source, filename and reload helper for a template.
+        It's passed the environment and template name and has to return a
+        tuple in the form ``(source, filename, uptodate)`` or raise a
+        `TemplateNotFound` error if it can't locate the template.
+
+        The source part of the returned tuple must be the source of the
+        template as unicode string or a ASCII bytestring.  The filename should
+        be the name of the file on the filesystem if it was loaded from there,
+        otherwise `None`.  The filename is used by python for the tracebacks
+        if no loader extension is used.
+
+        The last item in the tuple is the `uptodate` function.  If auto
+        reloading is enabled it's always called to check if the template
+        changed.  No arguments are passed so the function must store the
+        old state somewhere (for example in a closure).  If it returns `False`
+        the template will be reloaded.
+        """
+        if not self.has_source_access:
+            raise RuntimeError('%s cannot provide access to the source' %
+                               self.__class__.__name__)
+        raise TemplateNotFound(template)
+
+    def list_templates(self):
+        """Iterates over all templates.  If the loader does not support that
+        it should raise a :exc:`TypeError` which is the default behavior.
+        """
+        raise TypeError('this loader cannot iterate over all templates')
+
+    @internalcode
+    def load(self, environment, name, globals=None):
+        """Loads a template.  This method looks up the template in the cache
+        or loads one by calling :meth:`get_source`.  Subclasses should not
+        override this method as loaders working on collections of other
+        loaders (such as :class:`PrefixLoader` or :class:`ChoiceLoader`)
+        will not call this method but `get_source` directly.
+        """
+        code = None
+        if globals is None:
+            globals = {}
+
+        # first we try to get the source for this template together
+        # with the filename and the uptodate function.
+        source, filename, uptodate = self.get_source(environment, name)
+
+        # try to load the code from the bytecode cache if there is a
+        # bytecode cache configured.
+        bcc = environment.bytecode_cache
+        if bcc is not None:
+            bucket = bcc.get_bucket(environment, name, filename, source)
+            code = bucket.code
+
+        # if we don't have code so far (not cached, no longer up to
+        # date) etc. we compile the template
+        if code is None:
+            code = environment.compile(source, name, filename)
+
+        # if the bytecode cache is available and the bucket doesn't
+        # have a code so far, we give the bucket the new code and put
+        # it back to the bytecode cache.
+        if bcc is not None and bucket.code is None:
+            bucket.code = code
+            bcc.set_bucket(bucket)
+
+        return environment.template_class.from_code(environment, code,
+                                                    globals, uptodate)
+
+
+class FileSystemLoader(BaseLoader):
+    """Loads templates from the file system.  This loader can find templates
+    in folders on the file system and is the preferred way to load them.
+
+    The loader takes the path to the templates as string, or if multiple
+    locations are wanted a list of them which is then looked up in the
+    given order::
+
+    >>> loader = FileSystemLoader('/path/to/templates')
+    >>> loader = FileSystemLoader(['/path/to/templates', '/other/path'])
+
+    Per default the template encoding is ``'utf-8'`` which can be changed
+    by setting the `encoding` parameter to something else.
+
+    To follow symbolic links, set the *followlinks* parameter to ``True``::
+
+    >>> loader = FileSystemLoader('/path/to/templates', followlinks=True)
+
+    .. versionchanged:: 2.8+
+       The *followlinks* parameter was added.
+    """
+
+    def __init__(self, searchpath, encoding='utf-8', followlinks=False):
+        if isinstance(searchpath, string_types):
+            searchpath = [searchpath]
+        self.searchpath = list(searchpath)
+        self.encoding = encoding
+        self.followlinks = followlinks
+
+    def get_source(self, environment, template):
+        pieces = split_template_path(template)
+        for searchpath in self.searchpath:
+            filename = path.join(searchpath, *pieces)
+            f = open_if_exists(filename)
+            if f is None:
+                continue
+            try:
+                contents = f.read().decode(self.encoding)
+            finally:
+                f.close()
+
+            mtime = path.getmtime(filename)
+
+            def uptodate():
+                try:
+                    return path.getmtime(filename) == mtime
+                except OSError:
+                    return False
+            return contents, filename, uptodate
+        raise TemplateNotFound(template)
+
+    def list_templates(self):
+        found = set()
+        for searchpath in self.searchpath:
+            walk_dir = os.walk(searchpath, followlinks=self.followlinks)
+            for dirpath, dirnames, filenames in walk_dir:
+                for filename in filenames:
+                    template = os.path.join(dirpath, filename) \
+                        [len(searchpath):].strip(os.path.sep) \
+                                          .replace(os.path.sep, '/')
+                    if template[:2] == './':
+                        template = template[2:]
+                    if template not in found:
+                        found.add(template)
+        return sorted(found)
+
+
+class PackageLoader(BaseLoader):
+    """Load templates from python eggs or packages.  It is constructed with
+    the name of the python package and the path to the templates in that
+    package::
+
+        loader = PackageLoader('mypackage', 'views')
+
+    If the package path is not given, ``'templates'`` is assumed.
+
+    Per default the template encoding is ``'utf-8'`` which can be changed
+    by setting the `encoding` parameter to something else.  Due to the nature
+    of eggs it's only possible to reload templates if the package was loaded
+    from the file system and not a zip file.
+    """
+
+    def __init__(self, package_name, package_path='templates',
+                 encoding='utf-8'):
+        from pkg_resources import DefaultProvider, ResourceManager, \
+                                  get_provider
+        provider = get_provider(package_name)
+        self.encoding = encoding
+        self.manager = ResourceManager()
+        self.filesystem_bound = isinstance(provider, DefaultProvider)
+        self.provider = provider
+        self.package_path = package_path
+
+    def get_source(self, environment, template):
+        pieces = split_template_path(template)
+        p = '/'.join((self.package_path,) + tuple(pieces))
+        if not self.provider.has_resource(p):
+            raise TemplateNotFound(template)
+
+        filename = uptodate = None
+        if self.filesystem_bound:
+            filename = self.provider.get_resource_filename(self.manager, p)
+            mtime = path.getmtime(filename)
+            def uptodate():
+                try:
+                    return path.getmtime(filename) == mtime
+                except OSError:
+                    return False
+
+        source = self.provider.get_resource_string(self.manager, p)
+        return source.decode(self.encoding), filename, uptodate
+
+    def list_templates(self):
+        path = self.package_path
+        if path[:2] == './':
+            path = path[2:]
+        elif path == '.':
+            path = ''
+        offset = len(path)
+        results = []
+        def _walk(path):
+            for filename in self.provider.resource_listdir(path):
+                fullname = path + '/' + filename
+                if self.provider.resource_isdir(fullname):
+                    _walk(fullname)
+                else:
+                    results.append(fullname[offset:].lstrip('/'))
+        _walk(path)
+        results.sort()
+        return results
+
+
+class DictLoader(BaseLoader):
+    """Loads a template from a python dict.  It's passed a dict of unicode
+    strings bound to template names.  This loader is useful for unittesting:
+
+    >>> loader = DictLoader({'index.html': 'source here'})
+
+    Because auto reloading is rarely useful this is disabled per default.
+    """
+
+    def __init__(self, mapping):
+        self.mapping = mapping
+
+    def get_source(self, environment, template):
+        if template in self.mapping:
+            source = self.mapping[template]
+            return source, None, lambda: source == self.mapping.get(template)
+        raise TemplateNotFound(template)
+
+    def list_templates(self):
+        return sorted(self.mapping)
+
+
+class FunctionLoader(BaseLoader):
+    """A loader that is passed a function which does the loading.  The
+    function receives the name of the template and has to return either
+    an unicode string with the template source, a tuple in the form ``(source,
+    filename, uptodatefunc)`` or `None` if the template does not exist.
+
+    >>> def load_template(name):
+    ...     if name == 'index.html':
+    ...         return '...'
+    ...
+    >>> loader = FunctionLoader(load_template)
+
+    The `uptodatefunc` is a function that is called if autoreload is enabled
+    and has to return `True` if the template is still up to date.  For more
+    details have a look at :meth:`BaseLoader.get_source` which has the same
+    return value.
+    """
+
+    def __init__(self, load_func):
+        self.load_func = load_func
+
+    def get_source(self, environment, template):
+        rv = self.load_func(template)
+        if rv is None:
+            raise TemplateNotFound(template)
+        elif isinstance(rv, string_types):
+            return rv, None, None
+        return rv
+
+
+class PrefixLoader(BaseLoader):
+    """A loader that is passed a dict of loaders where each loader is bound
+    to a prefix.  The prefix is delimited from the template by a slash per
+    default, which can be changed by setting the `delimiter` argument to
+    something else::
+
+        loader = PrefixLoader({
+            'app1':     PackageLoader('mypackage.app1'),
+            'app2':     PackageLoader('mypackage.app2')
+        })
+
+    By loading ``'app1/index.html'`` the file from the app1 package is loaded,
+    by loading ``'app2/index.html'`` the file from the second.
+    """
+
+    def __init__(self, mapping, delimiter='/'):
+        self.mapping = mapping
+        self.delimiter = delimiter
+
+    def get_loader(self, template):
+        try:
+            prefix, name = template.split(self.delimiter, 1)
+            loader = self.mapping[prefix]
+        except (ValueError, KeyError):
+            raise TemplateNotFound(template)
+        return loader, name
+
+    def get_source(self, environment, template):
+        loader, name = self.get_loader(template)
+        try:
+            return loader.get_source(environment, name)
+        except TemplateNotFound:
+            # re-raise the exception with the correct filename here.
+            # (the one that includes the prefix)
+            raise TemplateNotFound(template)
+
+    @internalcode
+    def load(self, environment, name, globals=None):
+        loader, local_name = self.get_loader(name)
+        try:
+            return loader.load(environment, local_name, globals)
+        except TemplateNotFound:
+            # re-raise the exception with the correct filename here.
+            # (the one that includes the prefix)
+            raise TemplateNotFound(name)
+
+    def list_templates(self):
+        result = []
+        for prefix, loader in iteritems(self.mapping):
+            for template in loader.list_templates():
+                result.append(prefix + self.delimiter + template)
+        return result
+
+
+class ChoiceLoader(BaseLoader):
+    """This loader works like the `PrefixLoader` just that no prefix is
+    specified.  If a template could not be found by one loader the next one
+    is tried.
+
+    >>> loader = ChoiceLoader([
+    ...     FileSystemLoader('/path/to/user/templates'),
+    ...     FileSystemLoader('/path/to/system/templates')
+    ... ])
+
+    This is useful if you want to allow users to override builtin templates
+    from a different location.
+    """
+
+    def __init__(self, loaders):
+        self.loaders = loaders
+
+    def get_source(self, environment, template):
+        for loader in self.loaders:
+            try:
+                return loader.get_source(environment, template)
+            except TemplateNotFound:
+                pass
+        raise TemplateNotFound(template)
+
+    @internalcode
+    def load(self, environment, name, globals=None):
+        for loader in self.loaders:
+            try:
+                return loader.load(environment, name, globals)
+            except TemplateNotFound:
+                pass
+        raise TemplateNotFound(name)
+
+    def list_templates(self):
+        found = set()
+        for loader in self.loaders:
+            found.update(loader.list_templates())
+        return sorted(found)
+
+
+class _TemplateModule(ModuleType):
+    """Like a normal module but with support for weak references"""
+
+
+class ModuleLoader(BaseLoader):
+    """This loader loads templates from precompiled templates.
+
+    Example usage:
+
+    >>> loader = ChoiceLoader([
+    ...     ModuleLoader('/path/to/compiled/templates'),
+    ...     FileSystemLoader('/path/to/templates')
+    ... ])
+
+    Templates can be precompiled with :meth:`Environment.compile_templates`.
+    """
+
+    has_source_access = False
+
+    def __init__(self, path):
+        package_name = '_jinja2_module_templates_%x' % id(self)
+
+        # create a fake module that looks for the templates in the
+        # path given.
+        mod = _TemplateModule(package_name)
+        if isinstance(path, string_types):
+            path = [path]
+        else:
+            path = list(path)
+        mod.__path__ = path
+
+        sys.modules[package_name] = weakref.proxy(mod,
+            lambda x: sys.modules.pop(package_name, None))
+
+        # the only strong reference, the sys.modules entry is weak
+        # so that the garbage collector can remove it once the
+        # loader that created it goes out of business.
+        self.module = mod
+        self.package_name = package_name
+
+    @staticmethod
+    def get_template_key(name):
+        return 'tmpl_' + sha1(name.encode('utf-8')).hexdigest()
+
+    @staticmethod
+    def get_module_filename(name):
+        return ModuleLoader.get_template_key(name) + '.py'
+
+    @internalcode
+    def load(self, environment, name, globals=None):
+        key = self.get_template_key(name)
+        module = '%s.%s' % (self.package_name, key)
+        mod = getattr(self.module, module, None)
+        if mod is None:
+            try:
+                mod = __import__(module, None, None, ['root'])
+            except ImportError:
+                raise TemplateNotFound(name)
+
+            # remove the entry from sys.modules, we only want the attribute
+            # on the module object we have stored on the loader.
+            sys.modules.pop(module, None)
+
+        return environment.template_class.from_module_dict(
+            environment, mod.__dict__, globals)
diff --git a/deps/jinja2/meta.py b/deps/jinja2/meta.py
new file mode 100644
index 00000000000000..7421914f77242d
--- /dev/null
+++ b/deps/jinja2/meta.py
@@ -0,0 +1,106 @@
+# -*- coding: utf-8 -*-
+"""
+    jinja2.meta
+    ~~~~~~~~~~~
+
+    This module implements various functions that exposes information about
+    templates that might be interesting for various kinds of applications.
+
+    :copyright: (c) 2017 by the Jinja Team, see AUTHORS for more details.
+    :license: BSD, see LICENSE for more details.
+"""
+from jinja2 import nodes
+from jinja2.compiler import CodeGenerator
+from jinja2._compat import string_types, iteritems
+
+
+class TrackingCodeGenerator(CodeGenerator):
+    """We abuse the code generator for introspection."""
+
+    def __init__(self, environment):
+        CodeGenerator.__init__(self, environment, '<introspection>',
+                               '<introspection>')
+        self.undeclared_identifiers = set()
+
+    def write(self, x):
+        """Don't write."""
+
+    def enter_frame(self, frame):
+        """Remember all undeclared identifiers."""
+        CodeGenerator.enter_frame(self, frame)
+        for _, (action, param) in iteritems(frame.symbols.loads):
+            if action == 'resolve':
+                self.undeclared_identifiers.add(param)
+
+
+def find_undeclared_variables(ast):
+    """Returns a set of all variables in the AST that will be looked up from
+    the context at runtime.  Because at compile time it's not known which
+    variables will be used depending on the path the execution takes at
+    runtime, all variables are returned.
+
+    >>> from jinja2 import Environment, meta
+    >>> env = Environment()
+    >>> ast = env.parse('{% set foo = 42 %}{{ bar + foo }}')
+    >>> meta.find_undeclared_variables(ast) == set(['bar'])
+    True
+
+    .. admonition:: Implementation
+
+       Internally the code generator is used for finding undeclared variables.
+       This is good to know because the code generator might raise a
+       :exc:`TemplateAssertionError` during compilation and as a matter of
+       fact this function can currently raise that exception as well.
+    """
+    codegen = TrackingCodeGenerator(ast.environment)
+    codegen.visit(ast)
+    return codegen.undeclared_identifiers
+
+
+def find_referenced_templates(ast):
+    """Finds all the referenced templates from the AST.  This will return an
+    iterator over all the hardcoded template extensions, inclusions and
+    imports.  If dynamic inheritance or inclusion is used, `None` will be
+    yielded.
+
+    >>> from jinja2 import Environment, meta
+    >>> env = Environment()
+    >>> ast = env.parse('{% extends "layout.html" %}{% include helper %}')
+    >>> list(meta.find_referenced_templates(ast))
+    ['layout.html', None]
+
+    This function is useful for dependency tracking.  For example if you want
+    to rebuild parts of the website after a layout template has changed.
+    """
+    for node in ast.find_all((nodes.Extends, nodes.FromImport, nodes.Import,
+                              nodes.Include)):
+        if not isinstance(node.template, nodes.Const):
+            # a tuple with some non consts in there
+            if isinstance(node.template, (nodes.Tuple, nodes.List)):
+                for template_name in node.template.items:
+                    # something const, only yield the strings and ignore
+                    # non-string consts that really just make no sense
+                    if isinstance(template_name, nodes.Const):
+                        if isinstance(template_name.value, string_types):
+                            yield template_name.value
+                    # something dynamic in there
+                    else:
+                        yield None
+            # something dynamic we don't know about here
+            else:
+                yield None
+            continue
+        # constant is a basestring, direct template name
+        if isinstance(node.template.value, string_types):
+            yield node.template.value
+        # a tuple or list (latter *should* not happen) made of consts,
+        # yield the consts that are strings.  We could warn here for
+        # non string values
+        elif isinstance(node, nodes.Include) and \
+             isinstance(node.template.value, (tuple, list)):
+            for template_name in node.template.value:
+                if isinstance(template_name, string_types):
+                    yield template_name
+        # something else we don't care about, we could warn here
+        else:
+            yield None
diff --git a/deps/jinja2/nativetypes.py b/deps/jinja2/nativetypes.py
new file mode 100644
index 00000000000000..fe17e4138df3f1
--- /dev/null
+++ b/deps/jinja2/nativetypes.py
@@ -0,0 +1,220 @@
+import sys
+from ast import literal_eval
+from itertools import islice, chain
+from jinja2 import nodes
+from jinja2._compat import text_type
+from jinja2.compiler import CodeGenerator, has_safe_repr
+from jinja2.environment import Environment, Template
+from jinja2.utils import concat, escape
+
+
+def native_concat(nodes):
+    """Return a native Python type from the list of compiled nodes. If the
+    result is a single node, its value is returned. Otherwise, the nodes are
+    concatenated as strings. If the result can be parsed with
+    :func:`ast.literal_eval`, the parsed value is returned. Otherwise, the
+    string is returned.
+    """
+    head = list(islice(nodes, 2))
+
+    if not head:
+        return None
+
+    if len(head) == 1:
+        out = head[0]
+    else:
+        out = u''.join([text_type(v) for v in chain(head, nodes)])
+
+    try:
+        return literal_eval(out)
+    except (ValueError, SyntaxError, MemoryError):
+        return out
+
+
+class NativeCodeGenerator(CodeGenerator):
+    """A code generator which avoids injecting ``to_string()`` calls around the
+    internal code Jinja uses to render templates.
+    """
+
+    def visit_Output(self, node, frame):
+        """Same as :meth:`CodeGenerator.visit_Output`, but do not call
+        ``to_string`` on output nodes in generated code.
+        """
+        if self.has_known_extends and frame.require_output_check:
+            return
+
+        finalize = self.environment.finalize
+        finalize_context = getattr(finalize, 'contextfunction', False)
+        finalize_eval = getattr(finalize, 'evalcontextfunction', False)
+        finalize_env = getattr(finalize, 'environmentfunction', False)
+
+        if finalize is not None:
+            if finalize_context or finalize_eval:
+                const_finalize = None
+            elif finalize_env:
+                def const_finalize(x):
+                    return finalize(self.environment, x)
+            else:
+                const_finalize = finalize
+        else:
+            def const_finalize(x):
+                return x
+
+        # If we are inside a frame that requires output checking, we do so.
+        outdent_later = False
+
+        if frame.require_output_check:
+            self.writeline('if parent_template is None:')
+            self.indent()
+            outdent_later = True
+
+        # Try to evaluate as many chunks as possible into a static string at
+        # compile time.
+        body = []
+
+        for child in node.nodes:
+            try:
+                if const_finalize is None:
+                    raise nodes.Impossible()
+
+                const = child.as_const(frame.eval_ctx)
+                if not has_safe_repr(const):
+                    raise nodes.Impossible()
+            except nodes.Impossible:
+                body.append(child)
+                continue
+
+            # the frame can't be volatile here, because otherwise the as_const
+            # function would raise an Impossible exception at that point
+            try:
+                if frame.eval_ctx.autoescape:
+                    if hasattr(const, '__html__'):
+                        const = const.__html__()
+                    else:
+                        const = escape(const)
+
+                const = const_finalize(const)
+            except Exception:
+                # if something goes wrong here we evaluate the node at runtime
+                # for easier debugging
+                body.append(child)
+                continue
+
+            if body and isinstance(body[-1], list):
+                body[-1].append(const)
+            else:
+                body.append([const])
+
+        # if we have less than 3 nodes or a buffer we yield or extend/append
+        if len(body) < 3 or frame.buffer is not None:
+            if frame.buffer is not None:
+                # for one item we append, for more we extend
+                if len(body) == 1:
+                    self.writeline('%s.append(' % frame.buffer)
+                else:
+                    self.writeline('%s.extend((' % frame.buffer)
+
+                self.indent()
+
+            for item in body:
+                if isinstance(item, list):
+                    val = repr(native_concat(item))
+
+                    if frame.buffer is None:
+                        self.writeline('yield ' + val)
+                    else:
+                        self.writeline(val + ',')
+                else:
+                    if frame.buffer is None:
+                        self.writeline('yield ', item)
+                    else:
+                        self.newline(item)
+
+                    close = 0
+
+                    if finalize is not None:
+                        self.write('environment.finalize(')
+
+                        if finalize_context:
+                            self.write('context, ')
+
+                        close += 1
+
+                    self.visit(item, frame)
+
+                    if close > 0:
+                        self.write(')' * close)
+
+                    if frame.buffer is not None:
+                        self.write(',')
+
+            if frame.buffer is not None:
+                # close the open parentheses
+                self.outdent()
+                self.writeline(len(body) == 1 and ')' or '))')
+
+        # otherwise we create a format string as this is faster in that case
+        else:
+            format = []
+            arguments = []
+
+            for item in body:
+                if isinstance(item, list):
+                    format.append(native_concat(item).replace('%', '%%'))
+                else:
+                    format.append('%s')
+                    arguments.append(item)
+
+            self.writeline('yield ')
+            self.write(repr(concat(format)) + ' % (')
+            self.indent()
+
+            for argument in arguments:
+                self.newline(argument)
+                close = 0
+
+                if finalize is not None:
+                    self.write('environment.finalize(')
+
+                    if finalize_context:
+                        self.write('context, ')
+                    elif finalize_eval:
+                        self.write('context.eval_ctx, ')
+                    elif finalize_env:
+                        self.write('environment, ')
+
+                    close += 1
+
+                self.visit(argument, frame)
+                self.write(')' * close + ', ')
+
+            self.outdent()
+            self.writeline(')')
+
+        if outdent_later:
+            self.outdent()
+
+
+class NativeTemplate(Template):
+    def render(self, *args, **kwargs):
+        """Render the template to produce a native Python type. If the result
+        is a single node, its value is returned. Otherwise, the nodes are
+        concatenated as strings. If the result can be parsed with
+        :func:`ast.literal_eval`, the parsed value is returned. Otherwise, the
+        string is returned.
+        """
+        vars = dict(*args, **kwargs)
+
+        try:
+            return native_concat(self.root_render_func(self.new_context(vars)))
+        except Exception:
+            exc_info = sys.exc_info()
+
+        return self.environment.handle_exception(exc_info, True)
+
+
+class NativeEnvironment(Environment):
+    """An environment that renders templates to native Python types."""
+
+    code_generator_class = NativeCodeGenerator
+    template_class = NativeTemplate
diff --git a/deps/jinja2/nodes.py b/deps/jinja2/nodes.py
new file mode 100644
index 00000000000000..4d9a01ad8bb2e7
--- /dev/null
+++ b/deps/jinja2/nodes.py
@@ -0,0 +1,999 @@
+# -*- coding: utf-8 -*-
+"""
+    jinja2.nodes
+    ~~~~~~~~~~~~
+
+    This module implements additional nodes derived from the ast base node.
+
+    It also provides some node tree helper functions like `in_lineno` and
+    `get_nodes` used by the parser and translator in order to normalize
+    python and jinja nodes.
+
+    :copyright: (c) 2017 by the Jinja Team.
+    :license: BSD, see LICENSE for more details.
+"""
+import types
+import operator
+
+from collections import deque
+from jinja2.utils import Markup
+from jinja2._compat import izip, with_metaclass, text_type, PY2
+
+
+#: the types we support for context functions
+_context_function_types = (types.FunctionType, types.MethodType)
+
+
+_binop_to_func = {
+    '*':        operator.mul,
+    '/':        operator.truediv,
+    '//':       operator.floordiv,
+    '**':       operator.pow,
+    '%':        operator.mod,
+    '+':        operator.add,
+    '-':        operator.sub
+}
+
+_uaop_to_func = {
+    'not':      operator.not_,
+    '+':        operator.pos,
+    '-':        operator.neg
+}
+
+_cmpop_to_func = {
+    'eq':       operator.eq,
+    'ne':       operator.ne,
+    'gt':       operator.gt,
+    'gteq':     operator.ge,
+    'lt':       operator.lt,
+    'lteq':     operator.le,
+    'in':       lambda a, b: a in b,
+    'notin':    lambda a, b: a not in b
+}
+
+
+class Impossible(Exception):
+    """Raised if the node could not perform a requested action."""
+
+
+class NodeType(type):
+    """A metaclass for nodes that handles the field and attribute
+    inheritance.  fields and attributes from the parent class are
+    automatically forwarded to the child."""
+
+    def __new__(cls, name, bases, d):
+        for attr in 'fields', 'attributes':
+            storage = []
+            storage.extend(getattr(bases[0], attr, ()))
+            storage.extend(d.get(attr, ()))
+            assert len(bases) == 1, 'multiple inheritance not allowed'
+            assert len(storage) == len(set(storage)), 'layout conflict'
+            d[attr] = tuple(storage)
+        d.setdefault('abstract', False)
+        return type.__new__(cls, name, bases, d)
+
+
+class EvalContext(object):
+    """Holds evaluation time information.  Custom attributes can be attached
+    to it in extensions.
+    """
+
+    def __init__(self, environment, template_name=None):
+        self.environment = environment
+        if callable(environment.autoescape):
+            self.autoescape = environment.autoescape(template_name)
+        else:
+            self.autoescape = environment.autoescape
+        self.volatile = False
+
+    def save(self):
+        return self.__dict__.copy()
+
+    def revert(self, old):
+        self.__dict__.clear()
+        self.__dict__.update(old)
+
+
+def get_eval_context(node, ctx):
+    if ctx is None:
+        if node.environment is None:
+            raise RuntimeError('if no eval context is passed, the '
+                               'node must have an attached '
+                               'environment.')
+        return EvalContext(node.environment)
+    return ctx
+
+
+class Node(with_metaclass(NodeType, object)):
+    """Baseclass for all Jinja2 nodes.  There are a number of nodes available
+    of different types.  There are four major types:
+
+    -   :class:`Stmt`: statements
+    -   :class:`Expr`: expressions
+    -   :class:`Helper`: helper nodes
+    -   :class:`Template`: the outermost wrapper node
+
+    All nodes have fields and attributes.  Fields may be other nodes, lists,
+    or arbitrary values.  Fields are passed to the constructor as regular
+    positional arguments, attributes as keyword arguments.  Each node has
+    two attributes: `lineno` (the line number of the node) and `environment`.
+    The `environment` attribute is set at the end of the parsing process for
+    all nodes automatically.
+    """
+    fields = ()
+    attributes = ('lineno', 'environment')
+    abstract = True
+
+    def __init__(self, *fields, **attributes):
+        if self.abstract:
+            raise TypeError('abstract nodes are not instanciable')
+        if fields:
+            if len(fields) != len(self.fields):
+                if not self.fields:
+                    raise TypeError('%r takes 0 arguments' %
+                                    self.__class__.__name__)
+                raise TypeError('%r takes 0 or %d argument%s' % (
+                    self.__class__.__name__,
+                    len(self.fields),
+                    len(self.fields) != 1 and 's' or ''
+                ))
+            for name, arg in izip(self.fields, fields):
+                setattr(self, name, arg)
+        for attr in self.attributes:
+            setattr(self, attr, attributes.pop(attr, None))
+        if attributes:
+            raise TypeError('unknown attribute %r' %
+                            next(iter(attributes)))
+
+    def iter_fields(self, exclude=None, only=None):
+        """This method iterates over all fields that are defined and yields
+        ``(key, value)`` tuples.  Per default all fields are returned, but
+        it's possible to limit that to some fields by providing the `only`
+        parameter or to exclude some using the `exclude` parameter.  Both
+        should be sets or tuples of field names.
+        """
+        for name in self.fields:
+            if (exclude is only is None) or \
+               (exclude is not None and name not in exclude) or \
+               (only is not None and name in only):
+                try:
+                    yield name, getattr(self, name)
+                except AttributeError:
+                    pass
+
+    def iter_child_nodes(self, exclude=None, only=None):
+        """Iterates over all direct child nodes of the node.  This iterates
+        over all fields and yields the values of they are nodes.  If the value
+        of a field is a list all the nodes in that list are returned.
+        """
+        for field, item in self.iter_fields(exclude, only):
+            if isinstance(item, list):
+                for n in item:
+                    if isinstance(n, Node):
+                        yield n
+            elif isinstance(item, Node):
+                yield item
+
+    def find(self, node_type):
+        """Find the first node of a given type.  If no such node exists the
+        return value is `None`.
+        """
+        for result in self.find_all(node_type):
+            return result
+
+    def find_all(self, node_type):
+        """Find all the nodes of a given type.  If the type is a tuple,
+        the check is performed for any of the tuple items.
+        """
+        for child in self.iter_child_nodes():
+            if isinstance(child, node_type):
+                yield child
+            for result in child.find_all(node_type):
+                yield result
+
+    def set_ctx(self, ctx):
+        """Reset the context of a node and all child nodes.  Per default the
+        parser will all generate nodes that have a 'load' context as it's the
+        most common one.  This method is used in the parser to set assignment
+        targets and other nodes to a store context.
+        """
+        todo = deque([self])
+        while todo:
+            node = todo.popleft()
+            if 'ctx' in node.fields:
+                node.ctx = ctx
+            todo.extend(node.iter_child_nodes())
+        return self
+
+    def set_lineno(self, lineno, override=False):
+        """Set the line numbers of the node and children."""
+        todo = deque([self])
+        while todo:
+            node = todo.popleft()
+            if 'lineno' in node.attributes:
+                if node.lineno is None or override:
+                    node.lineno = lineno
+            todo.extend(node.iter_child_nodes())
+        return self
+
+    def set_environment(self, environment):
+        """Set the environment for all nodes."""
+        todo = deque([self])
+        while todo:
+            node = todo.popleft()
+            node.environment = environment
+            todo.extend(node.iter_child_nodes())
+        return self
+
+    def __eq__(self, other):
+        return type(self) is type(other) and \
+               tuple(self.iter_fields()) == tuple(other.iter_fields())
+
+    def __ne__(self, other):
+        return not self.__eq__(other)
+
+    # Restore Python 2 hashing behavior on Python 3
+    __hash__ = object.__hash__
+
+    def __repr__(self):
+        return '%s(%s)' % (
+            self.__class__.__name__,
+            ', '.join('%s=%r' % (arg, getattr(self, arg, None)) for
+                      arg in self.fields)
+        )
+
+    def dump(self):
+        def _dump(node):
+            if not isinstance(node, Node):
+                buf.append(repr(node))
+                return
+
+            buf.append('nodes.%s(' % node.__class__.__name__)
+            if not node.fields:
+                buf.append(')')
+                return
+            for idx, field in enumerate(node.fields):
+                if idx:
+                    buf.append(', ')
+                value = getattr(node, field)
+                if isinstance(value, list):
+                    buf.append('[')
+                    for idx, item in enumerate(value):
+                        if idx:
+                            buf.append(', ')
+                        _dump(item)
+                    buf.append(']')
+                else:
+                    _dump(value)
+            buf.append(')')
+        buf = []
+        _dump(self)
+        return ''.join(buf)
+
+
+
+class Stmt(Node):
+    """Base node for all statements."""
+    abstract = True
+
+
+class Helper(Node):
+    """Nodes that exist in a specific context only."""
+    abstract = True
+
+
+class Template(Node):
+    """Node that represents a template.  This must be the outermost node that
+    is passed to the compiler.
+    """
+    fields = ('body',)
+
+
+class Output(Stmt):
+    """A node that holds multiple expressions which are then printed out.
+    This is used both for the `print` statement and the regular template data.
+    """
+    fields = ('nodes',)
+
+
+class Extends(Stmt):
+    """Represents an extends statement."""
+    fields = ('template',)
+
+
+class For(Stmt):
+    """The for loop.  `target` is the target for the iteration (usually a
+    :class:`Name` or :class:`Tuple`), `iter` the iterable.  `body` is a list
+    of nodes that are used as loop-body, and `else_` a list of nodes for the
+    `else` block.  If no else node exists it has to be an empty list.
+
+    For filtered nodes an expression can be stored as `test`, otherwise `None`.
+    """
+    fields = ('target', 'iter', 'body', 'else_', 'test', 'recursive')
+
+
+class If(Stmt):
+    """If `test` is true, `body` is rendered, else `else_`."""
+    fields = ('test', 'body', 'elif_', 'else_')
+
+
+class Macro(Stmt):
+    """A macro definition.  `name` is the name of the macro, `args` a list of
+    arguments and `defaults` a list of defaults if there are any.  `body` is
+    a list of nodes for the macro body.
+    """
+    fields = ('name', 'args', 'defaults', 'body')
+
+
+class CallBlock(Stmt):
+    """Like a macro without a name but a call instead.  `call` is called with
+    the unnamed macro as `caller` argument this node holds.
+    """
+    fields = ('call', 'args', 'defaults', 'body')
+
+
+class FilterBlock(Stmt):
+    """Node for filter sections."""
+    fields = ('body', 'filter')
+
+
+class With(Stmt):
+    """Specific node for with statements.  In older versions of Jinja the
+    with statement was implemented on the base of the `Scope` node instead.
+
+    .. versionadded:: 2.9.3
+    """
+    fields = ('targets', 'values', 'body')
+
+
+class Block(Stmt):
+    """A node that represents a block."""
+    fields = ('name', 'body', 'scoped')
+
+
+class Include(Stmt):
+    """A node that represents the include tag."""
+    fields = ('template', 'with_context', 'ignore_missing')
+
+
+class Import(Stmt):
+    """A node that represents the import tag."""
+    fields = ('template', 'target', 'with_context')
+
+
+class FromImport(Stmt):
+    """A node that represents the from import tag.  It's important to not
+    pass unsafe names to the name attribute.  The compiler translates the
+    attribute lookups directly into getattr calls and does *not* use the
+    subscript callback of the interface.  As exported variables may not
+    start with double underscores (which the parser asserts) this is not a
+    problem for regular Jinja code, but if this node is used in an extension
+    extra care must be taken.
+
+    The list of names may contain tuples if aliases are wanted.
+    """
+    fields = ('template', 'names', 'with_context')
+
+
+class ExprStmt(Stmt):
+    """A statement that evaluates an expression and discards the result."""
+    fields = ('node',)
+
+
+class Assign(Stmt):
+    """Assigns an expression to a target."""
+    fields = ('target', 'node')
+
+
+class AssignBlock(Stmt):
+    """Assigns a block to a target."""
+    fields = ('target', 'filter', 'body')
+
+
+class Expr(Node):
+    """Baseclass for all expressions."""
+    abstract = True
+
+    def as_const(self, eval_ctx=None):
+        """Return the value of the expression as constant or raise
+        :exc:`Impossible` if this was not possible.
+
+        An :class:`EvalContext` can be provided, if none is given
+        a default context is created which requires the nodes to have
+        an attached environment.
+
+        .. versionchanged:: 2.4
+           the `eval_ctx` parameter was added.
+        """
+        raise Impossible()
+
+    def can_assign(self):
+        """Check if it's possible to assign something to this node."""
+        return False
+
+
+class BinExpr(Expr):
+    """Baseclass for all binary expressions."""
+    fields = ('left', 'right')
+    operator = None
+    abstract = True
+
+    def as_const(self, eval_ctx=None):
+        eval_ctx = get_eval_context(self, eval_ctx)
+        # intercepted operators cannot be folded at compile time
+        if self.environment.sandboxed and \
+           self.operator in self.environment.intercepted_binops:
+            raise Impossible()
+        f = _binop_to_func[self.operator]
+        try:
+            return f(self.left.as_const(eval_ctx), self.right.as_const(eval_ctx))
+        except Exception:
+            raise Impossible()
+
+
+class UnaryExpr(Expr):
+    """Baseclass for all unary expressions."""
+    fields = ('node',)
+    operator = None
+    abstract = True
+
+    def as_const(self, eval_ctx=None):
+        eval_ctx = get_eval_context(self, eval_ctx)
+        # intercepted operators cannot be folded at compile time
+        if self.environment.sandboxed and \
+           self.operator in self.environment.intercepted_unops:
+            raise Impossible()
+        f = _uaop_to_func[self.operator]
+        try:
+            return f(self.node.as_const(eval_ctx))
+        except Exception:
+            raise Impossible()
+
+
+class Name(Expr):
+    """Looks up a name or stores a value in a name.
+    The `ctx` of the node can be one of the following values:
+
+    -   `store`: store a value in the name
+    -   `load`: load that name
+    -   `param`: like `store` but if the name was defined as function parameter.
+    """
+    fields = ('name', 'ctx')
+
+    def can_assign(self):
+        return self.name not in ('true', 'false', 'none',
+                                 'True', 'False', 'None')
+
+
+class NSRef(Expr):
+    """Reference to a namespace value assignment"""
+    fields = ('name', 'attr')
+
+    def can_assign(self):
+        # We don't need any special checks here; NSRef assignments have a
+        # runtime check to ensure the target is a namespace object which will
+        # have been checked already as it is created using a normal assignment
+        # which goes through a `Name` node.
+        return True
+
+
+class Literal(Expr):
+    """Baseclass for literals."""
+    abstract = True
+
+
+class Const(Literal):
+    """All constant values.  The parser will return this node for simple
+    constants such as ``42`` or ``"foo"`` but it can be used to store more
+    complex values such as lists too.  Only constants with a safe
+    representation (objects where ``eval(repr(x)) == x`` is true).
+    """
+    fields = ('value',)
+
+    def as_const(self, eval_ctx=None):
+        rv = self.value
+        if PY2 and type(rv) is text_type and \
+           self.environment.policies['compiler.ascii_str']:
+            try:
+                rv = rv.encode('ascii')
+            except UnicodeError:
+                pass
+        return rv
+
+    @classmethod
+    def from_untrusted(cls, value, lineno=None, environment=None):
+        """Return a const object if the value is representable as
+        constant value in the generated code, otherwise it will raise
+        an `Impossible` exception.
+        """
+        from .compiler import has_safe_repr
+        if not has_safe_repr(value):
+            raise Impossible()
+        return cls(value, lineno=lineno, environment=environment)
+
+
+class TemplateData(Literal):
+    """A constant template string."""
+    fields = ('data',)
+
+    def as_const(self, eval_ctx=None):
+        eval_ctx = get_eval_context(self, eval_ctx)
+        if eval_ctx.volatile:
+            raise Impossible()
+        if eval_ctx.autoescape:
+            return Markup(self.data)
+        return self.data
+
+
+class Tuple(Literal):
+    """For loop unpacking and some other things like multiple arguments
+    for subscripts.  Like for :class:`Name` `ctx` specifies if the tuple
+    is used for loading the names or storing.
+    """
+    fields = ('items', 'ctx')
+
+    def as_const(self, eval_ctx=None):
+        eval_ctx = get_eval_context(self, eval_ctx)
+        return tuple(x.as_const(eval_ctx) for x in self.items)
+
+    def can_assign(self):
+        for item in self.items:
+            if not item.can_assign():
+                return False
+        return True
+
+
+class List(Literal):
+    """Any list literal such as ``[1, 2, 3]``"""
+    fields = ('items',)
+
+    def as_const(self, eval_ctx=None):
+        eval_ctx = get_eval_context(self, eval_ctx)
+        return [x.as_const(eval_ctx) for x in self.items]
+
+
+class Dict(Literal):
+    """Any dict literal such as ``{1: 2, 3: 4}``.  The items must be a list of
+    :class:`Pair` nodes.
+    """
+    fields = ('items',)
+
+    def as_const(self, eval_ctx=None):
+        eval_ctx = get_eval_context(self, eval_ctx)
+        return dict(x.as_const(eval_ctx) for x in self.items)
+
+
+class Pair(Helper):
+    """A key, value pair for dicts."""
+    fields = ('key', 'value')
+
+    def as_const(self, eval_ctx=None):
+        eval_ctx = get_eval_context(self, eval_ctx)
+        return self.key.as_const(eval_ctx), self.value.as_const(eval_ctx)
+
+
+class Keyword(Helper):
+    """A key, value pair for keyword arguments where key is a string."""
+    fields = ('key', 'value')
+
+    def as_const(self, eval_ctx=None):
+        eval_ctx = get_eval_context(self, eval_ctx)
+        return self.key, self.value.as_const(eval_ctx)
+
+
+class CondExpr(Expr):
+    """A conditional expression (inline if expression).  (``{{
+    foo if bar else baz }}``)
+    """
+    fields = ('test', 'expr1', 'expr2')
+
+    def as_const(self, eval_ctx=None):
+        eval_ctx = get_eval_context(self, eval_ctx)
+        if self.test.as_const(eval_ctx):
+            return self.expr1.as_const(eval_ctx)
+
+        # if we evaluate to an undefined object, we better do that at runtime
+        if self.expr2 is None:
+            raise Impossible()
+
+        return self.expr2.as_const(eval_ctx)
+
+
+def args_as_const(node, eval_ctx):
+    args = [x.as_const(eval_ctx) for x in node.args]
+    kwargs = dict(x.as_const(eval_ctx) for x in node.kwargs)
+
+    if node.dyn_args is not None:
+        try:
+            args.extend(node.dyn_args.as_const(eval_ctx))
+        except Exception:
+            raise Impossible()
+
+    if node.dyn_kwargs is not None:
+        try:
+            kwargs.update(node.dyn_kwargs.as_const(eval_ctx))
+        except Exception:
+            raise Impossible()
+
+    return args, kwargs
+
+
+class Filter(Expr):
+    """This node applies a filter on an expression.  `name` is the name of
+    the filter, the rest of the fields are the same as for :class:`Call`.
+
+    If the `node` of a filter is `None` the contents of the last buffer are
+    filtered.  Buffers are created by macros and filter blocks.
+    """
+
+    fields = ('node', 'name', 'args', 'kwargs', 'dyn_args', 'dyn_kwargs')
+
+    def as_const(self, eval_ctx=None):
+        eval_ctx = get_eval_context(self, eval_ctx)
+
+        if eval_ctx.volatile or self.node is None:
+            raise Impossible()
+
+        # we have to be careful here because we call filter_ below.
+        # if this variable would be called filter, 2to3 would wrap the
+        # call in a list beause it is assuming we are talking about the
+        # builtin filter function here which no longer returns a list in
+        # python 3.  because of that, do not rename filter_ to filter!
+        filter_ = self.environment.filters.get(self.name)
+
+        if filter_ is None or getattr(filter_, 'contextfilter', False):
+            raise Impossible()
+
+        # We cannot constant handle async filters, so we need to make sure
+        # to not go down this path.
+        if (
+            eval_ctx.environment.is_async
+            and getattr(filter_, 'asyncfiltervariant', False)
+        ):
+            raise Impossible()
+
+        args, kwargs = args_as_const(self, eval_ctx)
+        args.insert(0, self.node.as_const(eval_ctx))
+
+        if getattr(filter_, 'evalcontextfilter', False):
+            args.insert(0, eval_ctx)
+        elif getattr(filter_, 'environmentfilter', False):
+            args.insert(0, self.environment)
+
+        try:
+            return filter_(*args, **kwargs)
+        except Exception:
+            raise Impossible()
+
+
+class Test(Expr):
+    """Applies a test on an expression.  `name` is the name of the test, the
+    rest of the fields are the same as for :class:`Call`.
+    """
+
+    fields = ('node', 'name', 'args', 'kwargs', 'dyn_args', 'dyn_kwargs')
+
+    def as_const(self, eval_ctx=None):
+        test = self.environment.tests.get(self.name)
+
+        if test is None:
+            raise Impossible()
+
+        eval_ctx = get_eval_context(self, eval_ctx)
+        args, kwargs = args_as_const(self, eval_ctx)
+        args.insert(0, self.node.as_const(eval_ctx))
+
+        try:
+            return test(*args, **kwargs)
+        except Exception:
+            raise Impossible()
+
+
+class Call(Expr):
+    """Calls an expression.  `args` is a list of arguments, `kwargs` a list
+    of keyword arguments (list of :class:`Keyword` nodes), and `dyn_args`
+    and `dyn_kwargs` has to be either `None` or a node that is used as
+    node for dynamic positional (``*args``) or keyword (``**kwargs``)
+    arguments.
+    """
+    fields = ('node', 'args', 'kwargs', 'dyn_args', 'dyn_kwargs')
+
+
+class Getitem(Expr):
+    """Get an attribute or item from an expression and prefer the item."""
+    fields = ('node', 'arg', 'ctx')
+
+    def as_const(self, eval_ctx=None):
+        eval_ctx = get_eval_context(self, eval_ctx)
+        if self.ctx != 'load':
+            raise Impossible()
+        try:
+            return self.environment.getitem(self.node.as_const(eval_ctx),
+                                            self.arg.as_const(eval_ctx))
+        except Exception:
+            raise Impossible()
+
+    def can_assign(self):
+        return False
+
+
+class Getattr(Expr):
+    """Get an attribute or item from an expression that is a ascii-only
+    bytestring and prefer the attribute.
+    """
+    fields = ('node', 'attr', 'ctx')
+
+    def as_const(self, eval_ctx=None):
+        if self.ctx != 'load':
+            raise Impossible()
+        try:
+            eval_ctx = get_eval_context(self, eval_ctx)
+            return self.environment.getattr(self.node.as_const(eval_ctx),
+                                            self.attr)
+        except Exception:
+            raise Impossible()
+
+    def can_assign(self):
+        return False
+
+
+class Slice(Expr):
+    """Represents a slice object.  This must only be used as argument for
+    :class:`Subscript`.
+    """
+    fields = ('start', 'stop', 'step')
+
+    def as_const(self, eval_ctx=None):
+        eval_ctx = get_eval_context(self, eval_ctx)
+        def const(obj):
+            if obj is None:
+                return None
+            return obj.as_const(eval_ctx)
+        return slice(const(self.start), const(self.stop), const(self.step))
+
+
+class Concat(Expr):
+    """Concatenates the list of expressions provided after converting them to
+    unicode.
+    """
+    fields = ('nodes',)
+
+    def as_const(self, eval_ctx=None):
+        eval_ctx = get_eval_context(self, eval_ctx)
+        return ''.join(text_type(x.as_const(eval_ctx)) for x in self.nodes)
+
+
+class Compare(Expr):
+    """Compares an expression with some other expressions.  `ops` must be a
+    list of :class:`Operand`\\s.
+    """
+    fields = ('expr', 'ops')
+
+    def as_const(self, eval_ctx=None):
+        eval_ctx = get_eval_context(self, eval_ctx)
+        result = value = self.expr.as_const(eval_ctx)
+        try:
+            for op in self.ops:
+                new_value = op.expr.as_const(eval_ctx)
+                result = _cmpop_to_func[op.op](value, new_value)
+                value = new_value
+        except Exception:
+            raise Impossible()
+        return result
+
+
+class Operand(Helper):
+    """Holds an operator and an expression."""
+    fields = ('op', 'expr')
+
+if __debug__:
+    Operand.__doc__ += '\nThe following operators are available: ' + \
+        ', '.join(sorted('``%s``' % x for x in set(_binop_to_func) |
+                  set(_uaop_to_func) | set(_cmpop_to_func)))
+
+
+class Mul(BinExpr):
+    """Multiplies the left with the right node."""
+    operator = '*'
+
+
+class Div(BinExpr):
+    """Divides the left by the right node."""
+    operator = '/'
+
+
+class FloorDiv(BinExpr):
+    """Divides the left by the right node and truncates conver the
+    result into an integer by truncating.
+    """
+    operator = '//'
+
+
+class Add(BinExpr):
+    """Add the left to the right node."""
+    operator = '+'
+
+
+class Sub(BinExpr):
+    """Subtract the right from the left node."""
+    operator = '-'
+
+
+class Mod(BinExpr):
+    """Left modulo right."""
+    operator = '%'
+
+
+class Pow(BinExpr):
+    """Left to the power of right."""
+    operator = '**'
+
+
+class And(BinExpr):
+    """Short circuited AND."""
+    operator = 'and'
+
+    def as_const(self, eval_ctx=None):
+        eval_ctx = get_eval_context(self, eval_ctx)
+        return self.left.as_const(eval_ctx) and self.right.as_const(eval_ctx)
+
+
+class Or(BinExpr):
+    """Short circuited OR."""
+    operator = 'or'
+
+    def as_const(self, eval_ctx=None):
+        eval_ctx = get_eval_context(self, eval_ctx)
+        return self.left.as_const(eval_ctx) or self.right.as_const(eval_ctx)
+
+
+class Not(UnaryExpr):
+    """Negate the expression."""
+    operator = 'not'
+
+
+class Neg(UnaryExpr):
+    """Make the expression negative."""
+    operator = '-'
+
+
+class Pos(UnaryExpr):
+    """Make the expression positive (noop for most expressions)"""
+    operator = '+'
+
+
+# Helpers for extensions
+
+
+class EnvironmentAttribute(Expr):
+    """Loads an attribute from the environment object.  This is useful for
+    extensions that want to call a callback stored on the environment.
+    """
+    fields = ('name',)
+
+
+class ExtensionAttribute(Expr):
+    """Returns the attribute of an extension bound to the environment.
+    The identifier is the identifier of the :class:`Extension`.
+
+    This node is usually constructed by calling the
+    :meth:`~jinja2.ext.Extension.attr` method on an extension.
+    """
+    fields = ('identifier', 'name')
+
+
+class ImportedName(Expr):
+    """If created with an import name the import name is returned on node
+    access.  For example ``ImportedName('cgi.escape')`` returns the `escape`
+    function from the cgi module on evaluation.  Imports are optimized by the
+    compiler so there is no need to assign them to local variables.
+    """
+    fields = ('importname',)
+
+
+class InternalName(Expr):
+    """An internal name in the compiler.  You cannot create these nodes
+    yourself but the parser provides a
+    :meth:`~jinja2.parser.Parser.free_identifier` method that creates
+    a new identifier for you.  This identifier is not available from the
+    template and is not threated specially by the compiler.
+    """
+    fields = ('name',)
+
+    def __init__(self):
+        raise TypeError('Can\'t create internal names.  Use the '
+                        '`free_identifier` method on a parser.')
+
+
+class MarkSafe(Expr):
+    """Mark the wrapped expression as safe (wrap it as `Markup`)."""
+    fields = ('expr',)
+
+    def as_const(self, eval_ctx=None):
+        eval_ctx = get_eval_context(self, eval_ctx)
+        return Markup(self.expr.as_const(eval_ctx))
+
+
+class MarkSafeIfAutoescape(Expr):
+    """Mark the wrapped expression as safe (wrap it as `Markup`) but
+    only if autoescaping is active.
+
+    .. versionadded:: 2.5
+    """
+    fields = ('expr',)
+
+    def as_const(self, eval_ctx=None):
+        eval_ctx = get_eval_context(self, eval_ctx)
+        if eval_ctx.volatile:
+            raise Impossible()
+        expr = self.expr.as_const(eval_ctx)
+        if eval_ctx.autoescape:
+            return Markup(expr)
+        return expr
+
+
+class ContextReference(Expr):
+    """Returns the current template context.  It can be used like a
+    :class:`Name` node, with a ``'load'`` ctx and will return the
+    current :class:`~jinja2.runtime.Context` object.
+
+    Here an example that assigns the current template name to a
+    variable named `foo`::
+
+        Assign(Name('foo', ctx='store'),
+               Getattr(ContextReference(), 'name'))
+    """
+
+
+class Continue(Stmt):
+    """Continue a loop."""
+
+
+class Break(Stmt):
+    """Break a loop."""
+
+
+class Scope(Stmt):
+    """An artificial scope."""
+    fields = ('body',)
+
+
+class OverlayScope(Stmt):
+    """An overlay scope for extensions.  This is a largely unoptimized scope
+    that however can be used to introduce completely arbitrary variables into
+    a sub scope from a dictionary or dictionary like object.  The `context`
+    field has to evaluate to a dictionary object.
+
+    Example usage::
+
+        OverlayScope(context=self.call_method('get_context'),
+                     body=[...])
+
+    .. versionadded:: 2.10
+    """
+    fields = ('context', 'body')
+
+
+class EvalContextModifier(Stmt):
+    """Modifies the eval context.  For each option that should be modified,
+    a :class:`Keyword` has to be added to the :attr:`options` list.
+
+    Example to change the `autoescape` setting::
+
+        EvalContextModifier(options=[Keyword('autoescape', Const(True))])
+    """
+    fields = ('options',)
+
+
+class ScopedEvalContextModifier(EvalContextModifier):
+    """Modifies the eval context and reverts it later.  Works exactly like
+    :class:`EvalContextModifier` but will only modify the
+    :class:`~jinja2.nodes.EvalContext` for nodes in the :attr:`body`.
+    """
+    fields = ('body',)
+
+
+# make sure nobody creates custom nodes
+def _failing_new(*args, **kwargs):
+    raise TypeError('can\'t create custom node types')
+NodeType.__new__ = staticmethod(_failing_new); del _failing_new
diff --git a/deps/jinja2/optimizer.py b/deps/jinja2/optimizer.py
new file mode 100644
index 00000000000000..65ab3ceb71f613
--- /dev/null
+++ b/deps/jinja2/optimizer.py
@@ -0,0 +1,49 @@
+# -*- coding: utf-8 -*-
+"""
+    jinja2.optimizer
+    ~~~~~~~~~~~~~~~~
+
+    The jinja optimizer is currently trying to constant fold a few expressions
+    and modify the AST in place so that it should be easier to evaluate it.
+
+    Because the AST does not contain all the scoping information and the
+    compiler has to find that out, we cannot do all the optimizations we
+    want.  For example loop unrolling doesn't work because unrolled loops would
+    have a different scoping.
+
+    The solution would be a second syntax tree that has the scoping rules stored.
+
+    :copyright: (c) 2017 by the Jinja Team.
+    :license: BSD.
+"""
+from jinja2 import nodes
+from jinja2.visitor import NodeTransformer
+
+
+def optimize(node, environment):
+    """The context hint can be used to perform an static optimization
+    based on the context given."""
+    optimizer = Optimizer(environment)
+    return optimizer.visit(node)
+
+
+class Optimizer(NodeTransformer):
+
+    def __init__(self, environment):
+        self.environment = environment
+
+    def fold(self, node, eval_ctx=None):
+        """Do constant folding."""
+        node = self.generic_visit(node)
+        try:
+            return nodes.Const.from_untrusted(node.as_const(eval_ctx),
+                                              lineno=node.lineno,
+                                              environment=self.environment)
+        except nodes.Impossible:
+            return node
+
+    visit_Add = visit_Sub = visit_Mul = visit_Div = visit_FloorDiv = \
+    visit_Pow = visit_Mod = visit_And = visit_Or = visit_Pos = visit_Neg = \
+    visit_Not = visit_Compare = visit_Getitem = visit_Getattr = visit_Call = \
+    visit_Filter = visit_Test = visit_CondExpr = fold
+    del fold
diff --git a/deps/jinja2/parser.py b/deps/jinja2/parser.py
new file mode 100644
index 00000000000000..ed00d9708e962f
--- /dev/null
+++ b/deps/jinja2/parser.py
@@ -0,0 +1,903 @@
+# -*- coding: utf-8 -*-
+"""
+    jinja2.parser
+    ~~~~~~~~~~~~~
+
+    Implements the template parser.
+
+    :copyright: (c) 2017 by the Jinja Team.
+    :license: BSD, see LICENSE for more details.
+"""
+from jinja2 import nodes
+from jinja2.exceptions import TemplateSyntaxError, TemplateAssertionError
+from jinja2.lexer import describe_token, describe_token_expr
+from jinja2._compat import imap
+
+
+_statement_keywords = frozenset(['for', 'if', 'block', 'extends', 'print',
+                                 'macro', 'include', 'from', 'import',
+                                 'set', 'with', 'autoescape'])
+_compare_operators = frozenset(['eq', 'ne', 'lt', 'lteq', 'gt', 'gteq'])
+
+_math_nodes = {
+    'add': nodes.Add,
+    'sub': nodes.Sub,
+    'mul': nodes.Mul,
+    'div': nodes.Div,
+    'floordiv': nodes.FloorDiv,
+    'mod': nodes.Mod,
+}
+
+
+class Parser(object):
+    """This is the central parsing class Jinja2 uses.  It's passed to
+    extensions and can be used to parse expressions or statements.
+    """
+
+    def __init__(self, environment, source, name=None, filename=None,
+                 state=None):
+        self.environment = environment
+        self.stream = environment._tokenize(source, name, filename, state)
+        self.name = name
+        self.filename = filename
+        self.closed = False
+        self.extensions = {}
+        for extension in environment.iter_extensions():
+            for tag in extension.tags:
+                self.extensions[tag] = extension.parse
+        self._last_identifier = 0
+        self._tag_stack = []
+        self._end_token_stack = []
+
+    def fail(self, msg, lineno=None, exc=TemplateSyntaxError):
+        """Convenience method that raises `exc` with the message, passed
+        line number or last line number as well as the current name and
+        filename.
+        """
+        if lineno is None:
+            lineno = self.stream.current.lineno
+        raise exc(msg, lineno, self.name, self.filename)
+
+    def _fail_ut_eof(self, name, end_token_stack, lineno):
+        expected = []
+        for exprs in end_token_stack:
+            expected.extend(imap(describe_token_expr, exprs))
+        if end_token_stack:
+            currently_looking = ' or '.join(
+                "'%s'" % describe_token_expr(expr)
+                for expr in end_token_stack[-1])
+        else:
+            currently_looking = None
+
+        if name is None:
+            message = ['Unexpected end of template.']
+        else:
+            message = ['Encountered unknown tag \'%s\'.' % name]
+
+        if currently_looking:
+            if name is not None and name in expected:
+                message.append('You probably made a nesting mistake. Jinja '
+                               'is expecting this tag, but currently looking '
+                               'for %s.' % currently_looking)
+            else:
+                message.append('Jinja was looking for the following tags: '
+                               '%s.' % currently_looking)
+
+        if self._tag_stack:
+            message.append('The innermost block that needs to be '
+                           'closed is \'%s\'.' % self._tag_stack[-1])
+
+        self.fail(' '.join(message), lineno)
+
+    def fail_unknown_tag(self, name, lineno=None):
+        """Called if the parser encounters an unknown tag.  Tries to fail
+        with a human readable error message that could help to identify
+        the problem.
+        """
+        return self._fail_ut_eof(name, self._end_token_stack, lineno)
+
+    def fail_eof(self, end_tokens=None, lineno=None):
+        """Like fail_unknown_tag but for end of template situations."""
+        stack = list(self._end_token_stack)
+        if end_tokens is not None:
+            stack.append(end_tokens)
+        return self._fail_ut_eof(None, stack, lineno)
+
+    def is_tuple_end(self, extra_end_rules=None):
+        """Are we at the end of a tuple?"""
+        if self.stream.current.type in ('variable_end', 'block_end', 'rparen'):
+            return True
+        elif extra_end_rules is not None:
+            return self.stream.current.test_any(extra_end_rules)
+        return False
+
+    def free_identifier(self, lineno=None):
+        """Return a new free identifier as :class:`~jinja2.nodes.InternalName`."""
+        self._last_identifier += 1
+        rv = object.__new__(nodes.InternalName)
+        nodes.Node.__init__(rv, 'fi%d' % self._last_identifier, lineno=lineno)
+        return rv
+
+    def parse_statement(self):
+        """Parse a single statement."""
+        token = self.stream.current
+        if token.type != 'name':
+            self.fail('tag name expected', token.lineno)
+        self._tag_stack.append(token.value)
+        pop_tag = True
+        try:
+            if token.value in _statement_keywords:
+                return getattr(self, 'parse_' + self.stream.current.value)()
+            if token.value == 'call':
+                return self.parse_call_block()
+            if token.value == 'filter':
+                return self.parse_filter_block()
+            ext = self.extensions.get(token.value)
+            if ext is not None:
+                return ext(self)
+
+            # did not work out, remove the token we pushed by accident
+            # from the stack so that the unknown tag fail function can
+            # produce a proper error message.
+            self._tag_stack.pop()
+            pop_tag = False
+            self.fail_unknown_tag(token.value, token.lineno)
+        finally:
+            if pop_tag:
+                self._tag_stack.pop()
+
+    def parse_statements(self, end_tokens, drop_needle=False):
+        """Parse multiple statements into a list until one of the end tokens
+        is reached.  This is used to parse the body of statements as it also
+        parses template data if appropriate.  The parser checks first if the
+        current token is a colon and skips it if there is one.  Then it checks
+        for the block end and parses until if one of the `end_tokens` is
+        reached.  Per default the active token in the stream at the end of
+        the call is the matched end token.  If this is not wanted `drop_needle`
+        can be set to `True` and the end token is removed.
+        """
+        # the first token may be a colon for python compatibility
+        self.stream.skip_if('colon')
+
+        # in the future it would be possible to add whole code sections
+        # by adding some sort of end of statement token and parsing those here.
+        self.stream.expect('block_end')
+        result = self.subparse(end_tokens)
+
+        # we reached the end of the template too early, the subparser
+        # does not check for this, so we do that now
+        if self.stream.current.type == 'eof':
+            self.fail_eof(end_tokens)
+
+        if drop_needle:
+            next(self.stream)
+        return result
+
+    def parse_set(self):
+        """Parse an assign statement."""
+        lineno = next(self.stream).lineno
+        target = self.parse_assign_target(with_namespace=True)
+        if self.stream.skip_if('assign'):
+            expr = self.parse_tuple()
+            return nodes.Assign(target, expr, lineno=lineno)
+        filter_node = self.parse_filter(None)
+        body = self.parse_statements(('name:endset',),
+                                     drop_needle=True)
+        return nodes.AssignBlock(target, filter_node, body, lineno=lineno)
+
+    def parse_for(self):
+        """Parse a for loop."""
+        lineno = self.stream.expect('name:for').lineno
+        target = self.parse_assign_target(extra_end_rules=('name:in',))
+        self.stream.expect('name:in')
+        iter = self.parse_tuple(with_condexpr=False,
+                                extra_end_rules=('name:recursive',))
+        test = None
+        if self.stream.skip_if('name:if'):
+            test = self.parse_expression()
+        recursive = self.stream.skip_if('name:recursive')
+        body = self.parse_statements(('name:endfor', 'name:else'))
+        if next(self.stream).value == 'endfor':
+            else_ = []
+        else:
+            else_ = self.parse_statements(('name:endfor',), drop_needle=True)
+        return nodes.For(target, iter, body, else_, test,
+                         recursive, lineno=lineno)
+
+    def parse_if(self):
+        """Parse an if construct."""
+        node = result = nodes.If(lineno=self.stream.expect('name:if').lineno)
+        while 1:
+            node.test = self.parse_tuple(with_condexpr=False)
+            node.body = self.parse_statements(('name:elif', 'name:else',
+                                               'name:endif'))
+            node.elif_ = []
+            node.else_ = []
+            token = next(self.stream)
+            if token.test('name:elif'):
+                node = nodes.If(lineno=self.stream.current.lineno)
+                result.elif_.append(node)
+                continue
+            elif token.test('name:else'):
+                result.else_ = self.parse_statements(('name:endif',),
+                                                     drop_needle=True)
+            break
+        return result
+
+    def parse_with(self):
+        node = nodes.With(lineno=next(self.stream).lineno)
+        targets = []
+        values = []
+        while self.stream.current.type != 'block_end':
+            lineno = self.stream.current.lineno
+            if targets:
+                self.stream.expect('comma')
+            target = self.parse_assign_target()
+            target.set_ctx('param')
+            targets.append(target)
+            self.stream.expect('assign')
+            values.append(self.parse_expression())
+        node.targets = targets
+        node.values = values
+        node.body = self.parse_statements(('name:endwith',),
+                                          drop_needle=True)
+        return node
+
+    def parse_autoescape(self):
+        node = nodes.ScopedEvalContextModifier(lineno=next(self.stream).lineno)
+        node.options = [
+            nodes.Keyword('autoescape', self.parse_expression())
+        ]
+        node.body = self.parse_statements(('name:endautoescape',),
+                                            drop_needle=True)
+        return nodes.Scope([node])
+
+    def parse_block(self):
+        node = nodes.Block(lineno=next(self.stream).lineno)
+        node.name = self.stream.expect('name').value
+        node.scoped = self.stream.skip_if('name:scoped')
+
+        # common problem people encounter when switching from django
+        # to jinja.  we do not support hyphens in block names, so let's
+        # raise a nicer error message in that case.
+        if self.stream.current.type == 'sub':
+            self.fail('Block names in Jinja have to be valid Python '
+                      'identifiers and may not contain hyphens, use an '
+                      'underscore instead.')
+
+        node.body = self.parse_statements(('name:endblock',), drop_needle=True)
+        self.stream.skip_if('name:' + node.name)
+        return node
+
+    def parse_extends(self):
+        node = nodes.Extends(lineno=next(self.stream).lineno)
+        node.template = self.parse_expression()
+        return node
+
+    def parse_import_context(self, node, default):
+        if self.stream.current.test_any('name:with', 'name:without') and \
+           self.stream.look().test('name:context'):
+            node.with_context = next(self.stream).value == 'with'
+            self.stream.skip()
+        else:
+            node.with_context = default
+        return node
+
+    def parse_include(self):
+        node = nodes.Include(lineno=next(self.stream).lineno)
+        node.template = self.parse_expression()
+        if self.stream.current.test('name:ignore') and \
+           self.stream.look().test('name:missing'):
+            node.ignore_missing = True
+            self.stream.skip(2)
+        else:
+            node.ignore_missing = False
+        return self.parse_import_context(node, True)
+
+    def parse_import(self):
+        node = nodes.Import(lineno=next(self.stream).lineno)
+        node.template = self.parse_expression()
+        self.stream.expect('name:as')
+        node.target = self.parse_assign_target(name_only=True).name
+        return self.parse_import_context(node, False)
+
+    def parse_from(self):
+        node = nodes.FromImport(lineno=next(self.stream).lineno)
+        node.template = self.parse_expression()
+        self.stream.expect('name:import')
+        node.names = []
+
+        def parse_context():
+            if self.stream.current.value in ('with', 'without') and \
+               self.stream.look().test('name:context'):
+                node.with_context = next(self.stream).value == 'with'
+                self.stream.skip()
+                return True
+            return False
+
+        while 1:
+            if node.names:
+                self.stream.expect('comma')
+            if self.stream.current.type == 'name':
+                if parse_context():
+                    break
+                target = self.parse_assign_target(name_only=True)
+                if target.name.startswith('_'):
+                    self.fail('names starting with an underline can not '
+                              'be imported', target.lineno,
+                              exc=TemplateAssertionError)
+                if self.stream.skip_if('name:as'):
+                    alias = self.parse_assign_target(name_only=True)
+                    node.names.append((target.name, alias.name))
+                else:
+                    node.names.append(target.name)
+                if parse_context() or self.stream.current.type != 'comma':
+                    break
+            else:
+                self.stream.expect('name')
+        if not hasattr(node, 'with_context'):
+            node.with_context = False
+        return node
+
+    def parse_signature(self, node):
+        node.args = args = []
+        node.defaults = defaults = []
+        self.stream.expect('lparen')
+        while self.stream.current.type != 'rparen':
+            if args:
+                self.stream.expect('comma')
+            arg = self.parse_assign_target(name_only=True)
+            arg.set_ctx('param')
+            if self.stream.skip_if('assign'):
+                defaults.append(self.parse_expression())
+            elif defaults:
+                self.fail('non-default argument follows default argument')
+            args.append(arg)
+        self.stream.expect('rparen')
+
+    def parse_call_block(self):
+        node = nodes.CallBlock(lineno=next(self.stream).lineno)
+        if self.stream.current.type == 'lparen':
+            self.parse_signature(node)
+        else:
+            node.args = []
+            node.defaults = []
+
+        node.call = self.parse_expression()
+        if not isinstance(node.call, nodes.Call):
+            self.fail('expected call', node.lineno)
+        node.body = self.parse_statements(('name:endcall',), drop_needle=True)
+        return node
+
+    def parse_filter_block(self):
+        node = nodes.FilterBlock(lineno=next(self.stream).lineno)
+        node.filter = self.parse_filter(None, start_inline=True)
+        node.body = self.parse_statements(('name:endfilter',),
+                                          drop_needle=True)
+        return node
+
+    def parse_macro(self):
+        node = nodes.Macro(lineno=next(self.stream).lineno)
+        node.name = self.parse_assign_target(name_only=True).name
+        self.parse_signature(node)
+        node.body = self.parse_statements(('name:endmacro',),
+                                          drop_needle=True)
+        return node
+
+    def parse_print(self):
+        node = nodes.Output(lineno=next(self.stream).lineno)
+        node.nodes = []
+        while self.stream.current.type != 'block_end':
+            if node.nodes:
+                self.stream.expect('comma')
+            node.nodes.append(self.parse_expression())
+        return node
+
+    def parse_assign_target(self, with_tuple=True, name_only=False,
+                            extra_end_rules=None, with_namespace=False):
+        """Parse an assignment target.  As Jinja2 allows assignments to
+        tuples, this function can parse all allowed assignment targets.  Per
+        default assignments to tuples are parsed, that can be disable however
+        by setting `with_tuple` to `False`.  If only assignments to names are
+        wanted `name_only` can be set to `True`.  The `extra_end_rules`
+        parameter is forwarded to the tuple parsing function.  If
+        `with_namespace` is enabled, a namespace assignment may be parsed.
+        """
+        if with_namespace and self.stream.look().type == 'dot':
+            token = self.stream.expect('name')
+            next(self.stream)  # dot
+            attr = self.stream.expect('name')
+            target = nodes.NSRef(token.value, attr.value, lineno=token.lineno)
+        elif name_only:
+            token = self.stream.expect('name')
+            target = nodes.Name(token.value, 'store', lineno=token.lineno)
+        else:
+            if with_tuple:
+                target = self.parse_tuple(simplified=True,
+                                          extra_end_rules=extra_end_rules)
+            else:
+                target = self.parse_primary()
+            target.set_ctx('store')
+        if not target.can_assign():
+            self.fail('can\'t assign to %r' % target.__class__.
+                      __name__.lower(), target.lineno)
+        return target
+
+    def parse_expression(self, with_condexpr=True):
+        """Parse an expression.  Per default all expressions are parsed, if
+        the optional `with_condexpr` parameter is set to `False` conditional
+        expressions are not parsed.
+        """
+        if with_condexpr:
+            return self.parse_condexpr()
+        return self.parse_or()
+
+    def parse_condexpr(self):
+        lineno = self.stream.current.lineno
+        expr1 = self.parse_or()
+        while self.stream.skip_if('name:if'):
+            expr2 = self.parse_or()
+            if self.stream.skip_if('name:else'):
+                expr3 = self.parse_condexpr()
+            else:
+                expr3 = None
+            expr1 = nodes.CondExpr(expr2, expr1, expr3, lineno=lineno)
+            lineno = self.stream.current.lineno
+        return expr1
+
+    def parse_or(self):
+        lineno = self.stream.current.lineno
+        left = self.parse_and()
+        while self.stream.skip_if('name:or'):
+            right = self.parse_and()
+            left = nodes.Or(left, right, lineno=lineno)
+            lineno = self.stream.current.lineno
+        return left
+
+    def parse_and(self):
+        lineno = self.stream.current.lineno
+        left = self.parse_not()
+        while self.stream.skip_if('name:and'):
+            right = self.parse_not()
+            left = nodes.And(left, right, lineno=lineno)
+            lineno = self.stream.current.lineno
+        return left
+
+    def parse_not(self):
+        if self.stream.current.test('name:not'):
+            lineno = next(self.stream).lineno
+            return nodes.Not(self.parse_not(), lineno=lineno)
+        return self.parse_compare()
+
+    def parse_compare(self):
+        lineno = self.stream.current.lineno
+        expr = self.parse_math1()
+        ops = []
+        while 1:
+            token_type = self.stream.current.type
+            if token_type in _compare_operators:
+                next(self.stream)
+                ops.append(nodes.Operand(token_type, self.parse_math1()))
+            elif self.stream.skip_if('name:in'):
+                ops.append(nodes.Operand('in', self.parse_math1()))
+            elif (self.stream.current.test('name:not') and
+                  self.stream.look().test('name:in')):
+                self.stream.skip(2)
+                ops.append(nodes.Operand('notin', self.parse_math1()))
+            else:
+                break
+            lineno = self.stream.current.lineno
+        if not ops:
+            return expr
+        return nodes.Compare(expr, ops, lineno=lineno)
+
+    def parse_math1(self):
+        lineno = self.stream.current.lineno
+        left = self.parse_concat()
+        while self.stream.current.type in ('add', 'sub'):
+            cls = _math_nodes[self.stream.current.type]
+            next(self.stream)
+            right = self.parse_concat()
+            left = cls(left, right, lineno=lineno)
+            lineno = self.stream.current.lineno
+        return left
+
+    def parse_concat(self):
+        lineno = self.stream.current.lineno
+        args = [self.parse_math2()]
+        while self.stream.current.type == 'tilde':
+            next(self.stream)
+            args.append(self.parse_math2())
+        if len(args) == 1:
+            return args[0]
+        return nodes.Concat(args, lineno=lineno)
+
+    def parse_math2(self):
+        lineno = self.stream.current.lineno
+        left = self.parse_pow()
+        while self.stream.current.type in ('mul', 'div', 'floordiv', 'mod'):
+            cls = _math_nodes[self.stream.current.type]
+            next(self.stream)
+            right = self.parse_pow()
+            left = cls(left, right, lineno=lineno)
+            lineno = self.stream.current.lineno
+        return left
+
+    def parse_pow(self):
+        lineno = self.stream.current.lineno
+        left = self.parse_unary()
+        while self.stream.current.type == 'pow':
+            next(self.stream)
+            right = self.parse_unary()
+            left = nodes.Pow(left, right, lineno=lineno)
+            lineno = self.stream.current.lineno
+        return left
+
+    def parse_unary(self, with_filter=True):
+        token_type = self.stream.current.type
+        lineno = self.stream.current.lineno
+        if token_type == 'sub':
+            next(self.stream)
+            node = nodes.Neg(self.parse_unary(False), lineno=lineno)
+        elif token_type == 'add':
+            next(self.stream)
+            node = nodes.Pos(self.parse_unary(False), lineno=lineno)
+        else:
+            node = self.parse_primary()
+        node = self.parse_postfix(node)
+        if with_filter:
+            node = self.parse_filter_expr(node)
+        return node
+
+    def parse_primary(self):
+        token = self.stream.current
+        if token.type == 'name':
+            if token.value in ('true', 'false', 'True', 'False'):
+                node = nodes.Const(token.value in ('true', 'True'),
+                                   lineno=token.lineno)
+            elif token.value in ('none', 'None'):
+                node = nodes.Const(None, lineno=token.lineno)
+            else:
+                node = nodes.Name(token.value, 'load', lineno=token.lineno)
+            next(self.stream)
+        elif token.type == 'string':
+            next(self.stream)
+            buf = [token.value]
+            lineno = token.lineno
+            while self.stream.current.type == 'string':
+                buf.append(self.stream.current.value)
+                next(self.stream)
+            node = nodes.Const(''.join(buf), lineno=lineno)
+        elif token.type in ('integer', 'float'):
+            next(self.stream)
+            node = nodes.Const(token.value, lineno=token.lineno)
+        elif token.type == 'lparen':
+            next(self.stream)
+            node = self.parse_tuple(explicit_parentheses=True)
+            self.stream.expect('rparen')
+        elif token.type == 'lbracket':
+            node = self.parse_list()
+        elif token.type == 'lbrace':
+            node = self.parse_dict()
+        else:
+            self.fail("unexpected '%s'" % describe_token(token), token.lineno)
+        return node
+
+    def parse_tuple(self, simplified=False, with_condexpr=True,
+                    extra_end_rules=None, explicit_parentheses=False):
+        """Works like `parse_expression` but if multiple expressions are
+        delimited by a comma a :class:`~jinja2.nodes.Tuple` node is created.
+        This method could also return a regular expression instead of a tuple
+        if no commas where found.
+
+        The default parsing mode is a full tuple.  If `simplified` is `True`
+        only names and literals are parsed.  The `no_condexpr` parameter is
+        forwarded to :meth:`parse_expression`.
+
+        Because tuples do not require delimiters and may end in a bogus comma
+        an extra hint is needed that marks the end of a tuple.  For example
+        for loops support tuples between `for` and `in`.  In that case the
+        `extra_end_rules` is set to ``['name:in']``.
+
+        `explicit_parentheses` is true if the parsing was triggered by an
+        expression in parentheses.  This is used to figure out if an empty
+        tuple is a valid expression or not.
+        """
+        lineno = self.stream.current.lineno
+        if simplified:
+            parse = self.parse_primary
+        elif with_condexpr:
+            parse = self.parse_expression
+        else:
+            parse = lambda: self.parse_expression(with_condexpr=False)
+        args = []
+        is_tuple = False
+        while 1:
+            if args:
+                self.stream.expect('comma')
+            if self.is_tuple_end(extra_end_rules):
+                break
+            args.append(parse())
+            if self.stream.current.type == 'comma':
+                is_tuple = True
+            else:
+                break
+            lineno = self.stream.current.lineno
+
+        if not is_tuple:
+            if args:
+                return args[0]
+
+            # if we don't have explicit parentheses, an empty tuple is
+            # not a valid expression.  This would mean nothing (literally
+            # nothing) in the spot of an expression would be an empty
+            # tuple.
+            if not explicit_parentheses:
+                self.fail('Expected an expression, got \'%s\'' %
+                          describe_token(self.stream.current))
+
+        return nodes.Tuple(args, 'load', lineno=lineno)
+
+    def parse_list(self):
+        token = self.stream.expect('lbracket')
+        items = []
+        while self.stream.current.type != 'rbracket':
+            if items:
+                self.stream.expect('comma')
+            if self.stream.current.type == 'rbracket':
+                break
+            items.append(self.parse_expression())
+        self.stream.expect('rbracket')
+        return nodes.List(items, lineno=token.lineno)
+
+    def parse_dict(self):
+        token = self.stream.expect('lbrace')
+        items = []
+        while self.stream.current.type != 'rbrace':
+            if items:
+                self.stream.expect('comma')
+            if self.stream.current.type == 'rbrace':
+                break
+            key = self.parse_expression()
+            self.stream.expect('colon')
+            value = self.parse_expression()
+            items.append(nodes.Pair(key, value, lineno=key.lineno))
+        self.stream.expect('rbrace')
+        return nodes.Dict(items, lineno=token.lineno)
+
+    def parse_postfix(self, node):
+        while 1:
+            token_type = self.stream.current.type
+            if token_type == 'dot' or token_type == 'lbracket':
+                node = self.parse_subscript(node)
+            # calls are valid both after postfix expressions (getattr
+            # and getitem) as well as filters and tests
+            elif token_type == 'lparen':
+                node = self.parse_call(node)
+            else:
+                break
+        return node
+
+    def parse_filter_expr(self, node):
+        while 1:
+            token_type = self.stream.current.type
+            if token_type == 'pipe':
+                node = self.parse_filter(node)
+            elif token_type == 'name' and self.stream.current.value == 'is':
+                node = self.parse_test(node)
+            # calls are valid both after postfix expressions (getattr
+            # and getitem) as well as filters and tests
+            elif token_type == 'lparen':
+                node = self.parse_call(node)
+            else:
+                break
+        return node
+
+    def parse_subscript(self, node):
+        token = next(self.stream)
+        if token.type == 'dot':
+            attr_token = self.stream.current
+            next(self.stream)
+            if attr_token.type == 'name':
+                return nodes.Getattr(node, attr_token.value, 'load',
+                                     lineno=token.lineno)
+            elif attr_token.type != 'integer':
+                self.fail('expected name or number', attr_token.lineno)
+            arg = nodes.Const(attr_token.value, lineno=attr_token.lineno)
+            return nodes.Getitem(node, arg, 'load', lineno=token.lineno)
+        if token.type == 'lbracket':
+            args = []
+            while self.stream.current.type != 'rbracket':
+                if args:
+                    self.stream.expect('comma')
+                args.append(self.parse_subscribed())
+            self.stream.expect('rbracket')
+            if len(args) == 1:
+                arg = args[0]
+            else:
+                arg = nodes.Tuple(args, 'load', lineno=token.lineno)
+            return nodes.Getitem(node, arg, 'load', lineno=token.lineno)
+        self.fail('expected subscript expression', self.lineno)
+
+    def parse_subscribed(self):
+        lineno = self.stream.current.lineno
+
+        if self.stream.current.type == 'colon':
+            next(self.stream)
+            args = [None]
+        else:
+            node = self.parse_expression()
+            if self.stream.current.type != 'colon':
+                return node
+            next(self.stream)
+            args = [node]
+
+        if self.stream.current.type == 'colon':
+            args.append(None)
+        elif self.stream.current.type not in ('rbracket', 'comma'):
+            args.append(self.parse_expression())
+        else:
+            args.append(None)
+
+        if self.stream.current.type == 'colon':
+            next(self.stream)
+            if self.stream.current.type not in ('rbracket', 'comma'):
+                args.append(self.parse_expression())
+            else:
+                args.append(None)
+        else:
+            args.append(None)
+
+        return nodes.Slice(lineno=lineno, *args)
+
+    def parse_call(self, node):
+        token = self.stream.expect('lparen')
+        args = []
+        kwargs = []
+        dyn_args = dyn_kwargs = None
+        require_comma = False
+
+        def ensure(expr):
+            if not expr:
+                self.fail('invalid syntax for function call expression',
+                          token.lineno)
+
+        while self.stream.current.type != 'rparen':
+            if require_comma:
+                self.stream.expect('comma')
+                # support for trailing comma
+                if self.stream.current.type == 'rparen':
+                    break
+            if self.stream.current.type == 'mul':
+                ensure(dyn_args is None and dyn_kwargs is None)
+                next(self.stream)
+                dyn_args = self.parse_expression()
+            elif self.stream.current.type == 'pow':
+                ensure(dyn_kwargs is None)
+                next(self.stream)
+                dyn_kwargs = self.parse_expression()
+            else:
+                ensure(dyn_args is None and dyn_kwargs is None)
+                if self.stream.current.type == 'name' and \
+                   self.stream.look().type == 'assign':
+                    key = self.stream.current.value
+                    self.stream.skip(2)
+                    value = self.parse_expression()
+                    kwargs.append(nodes.Keyword(key, value,
+                                                lineno=value.lineno))
+                else:
+                    ensure(not kwargs)
+                    args.append(self.parse_expression())
+
+            require_comma = True
+        self.stream.expect('rparen')
+
+        if node is None:
+            return args, kwargs, dyn_args, dyn_kwargs
+        return nodes.Call(node, args, kwargs, dyn_args, dyn_kwargs,
+                          lineno=token.lineno)
+
+    def parse_filter(self, node, start_inline=False):
+        while self.stream.current.type == 'pipe' or start_inline:
+            if not start_inline:
+                next(self.stream)
+            token = self.stream.expect('name')
+            name = token.value
+            while self.stream.current.type == 'dot':
+                next(self.stream)
+                name += '.' + self.stream.expect('name').value
+            if self.stream.current.type == 'lparen':
+                args, kwargs, dyn_args, dyn_kwargs = self.parse_call(None)
+            else:
+                args = []
+                kwargs = []
+                dyn_args = dyn_kwargs = None
+            node = nodes.Filter(node, name, args, kwargs, dyn_args,
+                                dyn_kwargs, lineno=token.lineno)
+            start_inline = False
+        return node
+
+    def parse_test(self, node):
+        token = next(self.stream)
+        if self.stream.current.test('name:not'):
+            next(self.stream)
+            negated = True
+        else:
+            negated = False
+        name = self.stream.expect('name').value
+        while self.stream.current.type == 'dot':
+            next(self.stream)
+            name += '.' + self.stream.expect('name').value
+        dyn_args = dyn_kwargs = None
+        kwargs = []
+        if self.stream.current.type == 'lparen':
+            args, kwargs, dyn_args, dyn_kwargs = self.parse_call(None)
+        elif (self.stream.current.type in ('name', 'string', 'integer',
+                                           'float', 'lparen', 'lbracket',
+                                           'lbrace') and not
+              self.stream.current.test_any('name:else', 'name:or',
+                                           'name:and')):
+            if self.stream.current.test('name:is'):
+                self.fail('You cannot chain multiple tests with is')
+            args = [self.parse_primary()]
+        else:
+            args = []
+        node = nodes.Test(node, name, args, kwargs, dyn_args,
+                          dyn_kwargs, lineno=token.lineno)
+        if negated:
+            node = nodes.Not(node, lineno=token.lineno)
+        return node
+
+    def subparse(self, end_tokens=None):
+        body = []
+        data_buffer = []
+        add_data = data_buffer.append
+
+        if end_tokens is not None:
+            self._end_token_stack.append(end_tokens)
+
+        def flush_data():
+            if data_buffer:
+                lineno = data_buffer[0].lineno
+                body.append(nodes.Output(data_buffer[:], lineno=lineno))
+                del data_buffer[:]
+
+        try:
+            while self.stream:
+                token = self.stream.current
+                if token.type == 'data':
+                    if token.value:
+                        add_data(nodes.TemplateData(token.value,
+                                                    lineno=token.lineno))
+                    next(self.stream)
+                elif token.type == 'variable_begin':
+                    next(self.stream)
+                    add_data(self.parse_tuple(with_condexpr=True))
+                    self.stream.expect('variable_end')
+                elif token.type == 'block_begin':
+                    flush_data()
+                    next(self.stream)
+                    if end_tokens is not None and \
+                       self.stream.current.test_any(*end_tokens):
+                        return body
+                    rv = self.parse_statement()
+                    if isinstance(rv, list):
+                        body.extend(rv)
+                    else:
+                        body.append(rv)
+                    self.stream.expect('block_end')
+                else:
+                    raise AssertionError('internal parsing error')
+
+            flush_data()
+        finally:
+            if end_tokens is not None:
+                self._end_token_stack.pop()
+
+        return body
+
+    def parse(self):
+        """Parse the whole template into a `Template` node."""
+        result = nodes.Template(self.subparse(), lineno=1)
+        result.set_environment(self.environment)
+        return result
diff --git a/deps/jinja2/runtime.py b/deps/jinja2/runtime.py
new file mode 100644
index 00000000000000..f9d7a6806caf54
--- /dev/null
+++ b/deps/jinja2/runtime.py
@@ -0,0 +1,813 @@
+# -*- coding: utf-8 -*-
+"""
+    jinja2.runtime
+    ~~~~~~~~~~~~~~
+
+    Runtime helpers.
+
+    :copyright: (c) 2017 by the Jinja Team.
+    :license: BSD.
+"""
+import sys
+
+from itertools import chain
+from types import MethodType
+
+from jinja2.nodes import EvalContext, _context_function_types
+from jinja2.utils import Markup, soft_unicode, escape, missing, concat, \
+     internalcode, object_type_repr, evalcontextfunction, Namespace
+from jinja2.exceptions import UndefinedError, TemplateRuntimeError, \
+     TemplateNotFound
+from jinja2._compat import imap, text_type, iteritems, \
+     implements_iterator, implements_to_string, string_types, PY2, \
+     with_metaclass
+
+
+# these variables are exported to the template runtime
+__all__ = ['LoopContext', 'TemplateReference', 'Macro', 'Markup',
+           'TemplateRuntimeError', 'missing', 'concat', 'escape',
+           'markup_join', 'unicode_join', 'to_string', 'identity',
+           'TemplateNotFound', 'Namespace']
+
+#: the name of the function that is used to convert something into
+#: a string.  We can just use the text type here.
+to_string = text_type
+
+#: the identity function.  Useful for certain things in the environment
+identity = lambda x: x
+
+_first_iteration = object()
+_last_iteration = object()
+
+
+def markup_join(seq):
+    """Concatenation that escapes if necessary and converts to unicode."""
+    buf = []
+    iterator = imap(soft_unicode, seq)
+    for arg in iterator:
+        buf.append(arg)
+        if hasattr(arg, '__html__'):
+            return Markup(u'').join(chain(buf, iterator))
+    return concat(buf)
+
+
+def unicode_join(seq):
+    """Simple args to unicode conversion and concatenation."""
+    return concat(imap(text_type, seq))
+
+
+def new_context(environment, template_name, blocks, vars=None,
+                shared=None, globals=None, locals=None):
+    """Internal helper to for context creation."""
+    if vars is None:
+        vars = {}
+    if shared:
+        parent = vars
+    else:
+        parent = dict(globals or (), **vars)
+    if locals:
+        # if the parent is shared a copy should be created because
+        # we don't want to modify the dict passed
+        if shared:
+            parent = dict(parent)
+        for key, value in iteritems(locals):
+            if value is not missing:
+                parent[key] = value
+    return environment.context_class(environment, parent, template_name,
+                                     blocks)
+
+
+class TemplateReference(object):
+    """The `self` in templates."""
+
+    def __init__(self, context):
+        self.__context = context
+
+    def __getitem__(self, name):
+        blocks = self.__context.blocks[name]
+        return BlockReference(name, self.__context, blocks, 0)
+
+    def __repr__(self):
+        return '<%s %r>' % (
+            self.__class__.__name__,
+            self.__context.name
+        )
+
+
+def _get_func(x):
+    return getattr(x, '__func__', x)
+
+
+class ContextMeta(type):
+
+    def __new__(cls, name, bases, d):
+        rv = type.__new__(cls, name, bases, d)
+        if bases == ():
+            return rv
+
+        resolve = _get_func(rv.resolve)
+        default_resolve = _get_func(Context.resolve)
+        resolve_or_missing = _get_func(rv.resolve_or_missing)
+        default_resolve_or_missing = _get_func(Context.resolve_or_missing)
+
+        # If we have a changed resolve but no changed default or missing
+        # resolve we invert the call logic.
+        if resolve is not default_resolve and \
+           resolve_or_missing is default_resolve_or_missing:
+            rv._legacy_resolve_mode = True
+        elif resolve is default_resolve and \
+             resolve_or_missing is default_resolve_or_missing:
+            rv._fast_resolve_mode = True
+
+        return rv
+
+
+def resolve_or_missing(context, key, missing=missing):
+    if key in context.vars:
+        return context.vars[key]
+    if key in context.parent:
+        return context.parent[key]
+    return missing
+
+
+class Context(with_metaclass(ContextMeta)):
+    """The template context holds the variables of a template.  It stores the
+    values passed to the template and also the names the template exports.
+    Creating instances is neither supported nor useful as it's created
+    automatically at various stages of the template evaluation and should not
+    be created by hand.
+
+    The context is immutable.  Modifications on :attr:`parent` **must not**
+    happen and modifications on :attr:`vars` are allowed from generated
+    template code only.  Template filters and global functions marked as
+    :func:`contextfunction`\\s get the active context passed as first argument
+    and are allowed to access the context read-only.
+
+    The template context supports read only dict operations (`get`,
+    `keys`, `values`, `items`, `iterkeys`, `itervalues`, `iteritems`,
+    `__getitem__`, `__contains__`).  Additionally there is a :meth:`resolve`
+    method that doesn't fail with a `KeyError` but returns an
+    :class:`Undefined` object for missing variables.
+    """
+    # XXX: we want to eventually make this be a deprecation warning and
+    # remove it.
+    _legacy_resolve_mode = False
+    _fast_resolve_mode = False
+
+    def __init__(self, environment, parent, name, blocks):
+        self.parent = parent
+        self.vars = {}
+        self.environment = environment
+        self.eval_ctx = EvalContext(self.environment, name)
+        self.exported_vars = set()
+        self.name = name
+
+        # create the initial mapping of blocks.  Whenever template inheritance
+        # takes place the runtime will update this mapping with the new blocks
+        # from the template.
+        self.blocks = dict((k, [v]) for k, v in iteritems(blocks))
+
+        # In case we detect the fast resolve mode we can set up an alias
+        # here that bypasses the legacy code logic.
+        if self._fast_resolve_mode:
+            self.resolve_or_missing = MethodType(resolve_or_missing, self)
+
+    def super(self, name, current):
+        """Render a parent block."""
+        try:
+            blocks = self.blocks[name]
+            index = blocks.index(current) + 1
+            blocks[index]
+        except LookupError:
+            return self.environment.undefined('there is no parent block '
+                                              'called %r.' % name,
+                                              name='super')
+        return BlockReference(name, self, blocks, index)
+
+    def get(self, key, default=None):
+        """Returns an item from the template context, if it doesn't exist
+        `default` is returned.
+        """
+        try:
+            return self[key]
+        except KeyError:
+            return default
+
+    def resolve(self, key):
+        """Looks up a variable like `__getitem__` or `get` but returns an
+        :class:`Undefined` object with the name of the name looked up.
+        """
+        if self._legacy_resolve_mode:
+            rv = resolve_or_missing(self, key)
+        else:
+            rv = self.resolve_or_missing(key)
+        if rv is missing:
+            return self.environment.undefined(name=key)
+        return rv
+
+    def resolve_or_missing(self, key):
+        """Resolves a variable like :meth:`resolve` but returns the
+        special `missing` value if it cannot be found.
+        """
+        if self._legacy_resolve_mode:
+            rv = self.resolve(key)
+            if isinstance(rv, Undefined):
+                rv = missing
+            return rv
+        return resolve_or_missing(self, key)
+
+    def get_exported(self):
+        """Get a new dict with the exported variables."""
+        return dict((k, self.vars[k]) for k in self.exported_vars)
+
+    def get_all(self):
+        """Return the complete context as dict including the exported
+        variables.  For optimizations reasons this might not return an
+        actual copy so be careful with using it.
+        """
+        if not self.vars:
+            return self.parent
+        if not self.parent:
+            return self.vars
+        return dict(self.parent, **self.vars)
+
+    @internalcode
+    def call(__self, __obj, *args, **kwargs):
+        """Call the callable with the arguments and keyword arguments
+        provided but inject the active context or environment as first
+        argument if the callable is a :func:`contextfunction` or
+        :func:`environmentfunction`.
+        """
+        if __debug__:
+            __traceback_hide__ = True  # noqa
+
+        # Allow callable classes to take a context
+        if hasattr(__obj, '__call__'):
+            fn = __obj.__call__
+            for fn_type in ('contextfunction',
+                            'evalcontextfunction',
+                            'environmentfunction'):
+                if hasattr(fn, fn_type):
+                    __obj = fn
+                    break
+
+        if isinstance(__obj, _context_function_types):
+            if getattr(__obj, 'contextfunction', 0):
+                args = (__self,) + args
+            elif getattr(__obj, 'evalcontextfunction', 0):
+                args = (__self.eval_ctx,) + args
+            elif getattr(__obj, 'environmentfunction', 0):
+                args = (__self.environment,) + args
+        try:
+            return __obj(*args, **kwargs)
+        except StopIteration:
+            return __self.environment.undefined('value was undefined because '
+                                                'a callable raised a '
+                                                'StopIteration exception')
+
+    def derived(self, locals=None):
+        """Internal helper function to create a derived context.  This is
+        used in situations where the system needs a new context in the same
+        template that is independent.
+        """
+        context = new_context(self.environment, self.name, {},
+                              self.get_all(), True, None, locals)
+        context.eval_ctx = self.eval_ctx
+        context.blocks.update((k, list(v)) for k, v in iteritems(self.blocks))
+        return context
+
+    def _all(meth):
+        proxy = lambda self: getattr(self.get_all(), meth)()
+        proxy.__doc__ = getattr(dict, meth).__doc__
+        proxy.__name__ = meth
+        return proxy
+
+    keys = _all('keys')
+    values = _all('values')
+    items = _all('items')
+
+    # not available on python 3
+    if PY2:
+        iterkeys = _all('iterkeys')
+        itervalues = _all('itervalues')
+        iteritems = _all('iteritems')
+    del _all
+
+    def __contains__(self, name):
+        return name in self.vars or name in self.parent
+
+    def __getitem__(self, key):
+        """Lookup a variable or raise `KeyError` if the variable is
+        undefined.
+        """
+        item = self.resolve_or_missing(key)
+        if item is missing:
+            raise KeyError(key)
+        return item
+
+    def __repr__(self):
+        return '<%s %s of %r>' % (
+            self.__class__.__name__,
+            repr(self.get_all()),
+            self.name
+        )
+
+
+# register the context as mapping if possible
+try:
+    from collections import Mapping
+    Mapping.register(Context)
+except ImportError:
+    pass
+
+
+class BlockReference(object):
+    """One block on a template reference."""
+
+    def __init__(self, name, context, stack, depth):
+        self.name = name
+        self._context = context
+        self._stack = stack
+        self._depth = depth
+
+    @property
+    def super(self):
+        """Super the block."""
+        if self._depth + 1 >= len(self._stack):
+            return self._context.environment. \
+                undefined('there is no parent block called %r.' %
+                          self.name, name='super')
+        return BlockReference(self.name, self._context, self._stack,
+                              self._depth + 1)
+
+    @internalcode
+    def __call__(self):
+        rv = concat(self._stack[self._depth](self._context))
+        if self._context.eval_ctx.autoescape:
+            rv = Markup(rv)
+        return rv
+
+
+class LoopContextBase(object):
+    """A loop context for dynamic iteration."""
+
+    _before = _first_iteration
+    _current = _first_iteration
+    _after = _last_iteration
+    _length = None
+
+    def __init__(self, undefined, recurse=None, depth0=0):
+        self._undefined = undefined
+        self._recurse = recurse
+        self.index0 = -1
+        self.depth0 = depth0
+        self._last_checked_value = missing
+
+    def cycle(self, *args):
+        """Cycles among the arguments with the current loop index."""
+        if not args:
+            raise TypeError('no items for cycling given')
+        return args[self.index0 % len(args)]
+
+    def changed(self, *value):
+        """Checks whether the value has changed since the last call."""
+        if self._last_checked_value != value:
+            self._last_checked_value = value
+            return True
+        return False
+
+    first = property(lambda x: x.index0 == 0)
+    last = property(lambda x: x._after is _last_iteration)
+    index = property(lambda x: x.index0 + 1)
+    revindex = property(lambda x: x.length - x.index0)
+    revindex0 = property(lambda x: x.length - x.index)
+    depth = property(lambda x: x.depth0 + 1)
+
+    @property
+    def previtem(self):
+        if self._before is _first_iteration:
+            return self._undefined('there is no previous item')
+        return self._before
+
+    @property
+    def nextitem(self):
+        if self._after is _last_iteration:
+            return self._undefined('there is no next item')
+        return self._after
+
+    def __len__(self):
+        return self.length
+
+    @internalcode
+    def loop(self, iterable):
+        if self._recurse is None:
+            raise TypeError('Tried to call non recursive loop.  Maybe you '
+                            "forgot the 'recursive' modifier.")
+        return self._recurse(iterable, self._recurse, self.depth0 + 1)
+
+    # a nifty trick to enhance the error message if someone tried to call
+    # the the loop without or with too many arguments.
+    __call__ = loop
+    del loop
+
+    def __repr__(self):
+        return '<%s %r/%r>' % (
+            self.__class__.__name__,
+            self.index,
+            self.length
+        )
+
+
+class LoopContext(LoopContextBase):
+
+    def __init__(self, iterable, undefined, recurse=None, depth0=0):
+        LoopContextBase.__init__(self, undefined, recurse, depth0)
+        self._iterator = iter(iterable)
+
+        # try to get the length of the iterable early.  This must be done
+        # here because there are some broken iterators around where there
+        # __len__ is the number of iterations left (i'm looking at your
+        # listreverseiterator!).
+        try:
+            self._length = len(iterable)
+        except (TypeError, AttributeError):
+            self._length = None
+        self._after = self._safe_next()
+
+    @property
+    def length(self):
+        if self._length is None:
+            # if was not possible to get the length of the iterator when
+            # the loop context was created (ie: iterating over a generator)
+            # we have to convert the iterable into a sequence and use the
+            # length of that + the number of iterations so far.
+            iterable = tuple(self._iterator)
+            self._iterator = iter(iterable)
+            iterations_done = self.index0 + 2
+            self._length = len(iterable) + iterations_done
+        return self._length
+
+    def __iter__(self):
+        return LoopContextIterator(self)
+
+    def _safe_next(self):
+        try:
+            return next(self._iterator)
+        except StopIteration:
+            return _last_iteration
+
+
+@implements_iterator
+class LoopContextIterator(object):
+    """The iterator for a loop context."""
+    __slots__ = ('context',)
+
+    def __init__(self, context):
+        self.context = context
+
+    def __iter__(self):
+        return self
+
+    def __next__(self):
+        ctx = self.context
+        ctx.index0 += 1
+        if ctx._after is _last_iteration:
+            raise StopIteration()
+        ctx._before = ctx._current
+        ctx._current = ctx._after
+        ctx._after = ctx._safe_next()
+        return ctx._current, ctx
+
+
+class Macro(object):
+    """Wraps a macro function."""
+
+    def __init__(self, environment, func, name, arguments,
+                 catch_kwargs, catch_varargs, caller,
+                 default_autoescape=None):
+        self._environment = environment
+        self._func = func
+        self._argument_count = len(arguments)
+        self.name = name
+        self.arguments = arguments
+        self.catch_kwargs = catch_kwargs
+        self.catch_varargs = catch_varargs
+        self.caller = caller
+        self.explicit_caller = 'caller' in arguments
+        if default_autoescape is None:
+            default_autoescape = environment.autoescape
+        self._default_autoescape = default_autoescape
+
+    @internalcode
+    @evalcontextfunction
+    def __call__(self, *args, **kwargs):
+        # This requires a bit of explanation,  In the past we used to
+        # decide largely based on compile-time information if a macro is
+        # safe or unsafe.  While there was a volatile mode it was largely
+        # unused for deciding on escaping.  This turns out to be
+        # problemtic for macros because if a macro is safe or not not so
+        # much depends on the escape mode when it was defined but when it
+        # was used.
+        #
+        # Because however we export macros from the module system and
+        # there are historic callers that do not pass an eval context (and
+        # will continue to not pass one), we need to perform an instance
+        # check here.
+        #
+        # This is considered safe because an eval context is not a valid
+        # argument to callables otherwise anwyays.  Worst case here is
+        # that if no eval context is passed we fall back to the compile
+        # time autoescape flag.
+        if args and isinstance(args[0], EvalContext):
+            autoescape = args[0].autoescape
+            args = args[1:]
+        else:
+            autoescape = self._default_autoescape
+
+        # try to consume the positional arguments
+        arguments = list(args[:self._argument_count])
+        off = len(arguments)
+
+        # For information why this is necessary refer to the handling
+        # of caller in the `macro_body` handler in the compiler.
+        found_caller = False
+
+        # if the number of arguments consumed is not the number of
+        # arguments expected we start filling in keyword arguments
+        # and defaults.
+        if off != self._argument_count:
+            for idx, name in enumerate(self.arguments[len(arguments):]):
+                try:
+                    value = kwargs.pop(name)
+                except KeyError:
+                    value = missing
+                if name == 'caller':
+                    found_caller = True
+                arguments.append(value)
+        else:
+            found_caller = self.explicit_caller
+
+        # it's important that the order of these arguments does not change
+        # if not also changed in the compiler's `function_scoping` method.
+        # the order is caller, keyword arguments, positional arguments!
+        if self.caller and not found_caller:
+            caller = kwargs.pop('caller', None)
+            if caller is None:
+                caller = self._environment.undefined('No caller defined',
+                                                     name='caller')
+            arguments.append(caller)
+
+        if self.catch_kwargs:
+            arguments.append(kwargs)
+        elif kwargs:
+            if 'caller' in kwargs:
+                raise TypeError('macro %r was invoked with two values for '
+                                'the special caller argument.  This is '
+                                'most likely a bug.' % self.name)
+            raise TypeError('macro %r takes no keyword argument %r' %
+                            (self.name, next(iter(kwargs))))
+        if self.catch_varargs:
+            arguments.append(args[self._argument_count:])
+        elif len(args) > self._argument_count:
+            raise TypeError('macro %r takes not more than %d argument(s)' %
+                            (self.name, len(self.arguments)))
+
+        return self._invoke(arguments, autoescape)
+
+    def _invoke(self, arguments, autoescape):
+        """This method is being swapped out by the async implementation."""
+        rv = self._func(*arguments)
+        if autoescape:
+            rv = Markup(rv)
+        return rv
+
+    def __repr__(self):
+        return '<%s %s>' % (
+            self.__class__.__name__,
+            self.name is None and 'anonymous' or repr(self.name)
+        )
+
+
+@implements_to_string
+class Undefined(object):
+    """The default undefined type.  This undefined type can be printed and
+    iterated over, but every other access will raise an :exc:`jinja2.exceptions.UndefinedError`:
+
+    >>> foo = Undefined(name='foo')
+    >>> str(foo)
+    ''
+    >>> not foo
+    True
+    >>> foo + 42
+    Traceback (most recent call last):
+      ...
+    jinja2.exceptions.UndefinedError: 'foo' is undefined
+    """
+    __slots__ = ('_undefined_hint', '_undefined_obj', '_undefined_name',
+                 '_undefined_exception')
+
+    def __init__(self, hint=None, obj=missing, name=None, exc=UndefinedError):
+        self._undefined_hint = hint
+        self._undefined_obj = obj
+        self._undefined_name = name
+        self._undefined_exception = exc
+
+    @internalcode
+    def _fail_with_undefined_error(self, *args, **kwargs):
+        """Regular callback function for undefined objects that raises an
+        `jinja2.exceptions.UndefinedError` on call.
+        """
+        if self._undefined_hint is None:
+            if self._undefined_obj is missing:
+                hint = '%r is undefined' % self._undefined_name
+            elif not isinstance(self._undefined_name, string_types):
+                hint = '%s has no element %r' % (
+                    object_type_repr(self._undefined_obj),
+                    self._undefined_name
+                )
+            else:
+                hint = '%r has no attribute %r' % (
+                    object_type_repr(self._undefined_obj),
+                    self._undefined_name
+                )
+        else:
+            hint = self._undefined_hint
+        raise self._undefined_exception(hint)
+
+    @internalcode
+    def __getattr__(self, name):
+        if name[:2] == '__':
+            raise AttributeError(name)
+        return self._fail_with_undefined_error()
+
+    __add__ = __radd__ = __mul__ = __rmul__ = __div__ = __rdiv__ = \
+        __truediv__ = __rtruediv__ = __floordiv__ = __rfloordiv__ = \
+        __mod__ = __rmod__ = __pos__ = __neg__ = __call__ = \
+        __getitem__ = __lt__ = __le__ = __gt__ = __ge__ = __int__ = \
+        __float__ = __complex__ = __pow__ = __rpow__ = __sub__ = \
+        __rsub__ = _fail_with_undefined_error
+
+    def __eq__(self, other):
+        return type(self) is type(other)
+
+    def __ne__(self, other):
+        return not self.__eq__(other)
+
+    def __hash__(self):
+        return id(type(self))
+
+    def __str__(self):
+        return u''
+
+    def __len__(self):
+        return 0
+
+    def __iter__(self):
+        if 0:
+            yield None
+
+    def __nonzero__(self):
+        return False
+    __bool__ = __nonzero__
+
+    def __repr__(self):
+        return 'Undefined'
+
+
+def make_logging_undefined(logger=None, base=None):
+    """Given a logger object this returns a new undefined class that will
+    log certain failures.  It will log iterations and printing.  If no
+    logger is given a default logger is created.
+
+    Example::
+
+        logger = logging.getLogger(__name__)
+        LoggingUndefined = make_logging_undefined(
+            logger=logger,
+            base=Undefined
+        )
+
+    .. versionadded:: 2.8
+
+    :param logger: the logger to use.  If not provided, a default logger
+                   is created.
+    :param base: the base class to add logging functionality to.  This
+                 defaults to :class:`Undefined`.
+    """
+    if logger is None:
+        import logging
+        logger = logging.getLogger(__name__)
+        logger.addHandler(logging.StreamHandler(sys.stderr))
+    if base is None:
+        base = Undefined
+
+    def _log_message(undef):
+        if undef._undefined_hint is None:
+            if undef._undefined_obj is missing:
+                hint = '%s is undefined' % undef._undefined_name
+            elif not isinstance(undef._undefined_name, string_types):
+                hint = '%s has no element %s' % (
+                    object_type_repr(undef._undefined_obj),
+                    undef._undefined_name)
+            else:
+                hint = '%s has no attribute %s' % (
+                    object_type_repr(undef._undefined_obj),
+                    undef._undefined_name)
+        else:
+            hint = undef._undefined_hint
+        logger.warning('Template variable warning: %s', hint)
+
+    class LoggingUndefined(base):
+
+        def _fail_with_undefined_error(self, *args, **kwargs):
+            try:
+                return base._fail_with_undefined_error(self, *args, **kwargs)
+            except self._undefined_exception as e:
+                logger.error('Template variable error: %s', str(e))
+                raise e
+
+        def __str__(self):
+            rv = base.__str__(self)
+            _log_message(self)
+            return rv
+
+        def __iter__(self):
+            rv = base.__iter__(self)
+            _log_message(self)
+            return rv
+
+        if PY2:
+            def __nonzero__(self):
+                rv = base.__nonzero__(self)
+                _log_message(self)
+                return rv
+
+            def __unicode__(self):
+                rv = base.__unicode__(self)
+                _log_message(self)
+                return rv
+        else:
+            def __bool__(self):
+                rv = base.__bool__(self)
+                _log_message(self)
+                return rv
+
+    return LoggingUndefined
+
+
+@implements_to_string
+class DebugUndefined(Undefined):
+    """An undefined that returns the debug info when printed.
+
+    >>> foo = DebugUndefined(name='foo')
+    >>> str(foo)
+    '{{ foo }}'
+    >>> not foo
+    True
+    >>> foo + 42
+    Traceback (most recent call last):
+      ...
+    jinja2.exceptions.UndefinedError: 'foo' is undefined
+    """
+    __slots__ = ()
+
+    def __str__(self):
+        if self._undefined_hint is None:
+            if self._undefined_obj is missing:
+                return u'{{ %s }}' % self._undefined_name
+            return '{{ no such element: %s[%r] }}' % (
+                object_type_repr(self._undefined_obj),
+                self._undefined_name
+            )
+        return u'{{ undefined value printed: %s }}' % self._undefined_hint
+
+
+@implements_to_string
+class StrictUndefined(Undefined):
+    """An undefined that barks on print and iteration as well as boolean
+    tests and all kinds of comparisons.  In other words: you can do nothing
+    with it except checking if it's defined using the `defined` test.
+
+    >>> foo = StrictUndefined(name='foo')
+    >>> str(foo)
+    Traceback (most recent call last):
+      ...
+    jinja2.exceptions.UndefinedError: 'foo' is undefined
+    >>> not foo
+    Traceback (most recent call last):
+      ...
+    jinja2.exceptions.UndefinedError: 'foo' is undefined
+    >>> foo + 42
+    Traceback (most recent call last):
+      ...
+    jinja2.exceptions.UndefinedError: 'foo' is undefined
+    """
+    __slots__ = ()
+    __iter__ = __str__ = __len__ = __nonzero__ = __eq__ = \
+        __ne__ = __bool__ = __hash__ = \
+        Undefined._fail_with_undefined_error
+
+
+# remove remaining slots attributes, after the metaclass did the magic they
+# are unneeded and irritating as they contain wrong data for the subclasses.
+del Undefined.__slots__, DebugUndefined.__slots__, StrictUndefined.__slots__
diff --git a/deps/jinja2/sandbox.py b/deps/jinja2/sandbox.py
new file mode 100644
index 00000000000000..93fb9d45f32d8b
--- /dev/null
+++ b/deps/jinja2/sandbox.py
@@ -0,0 +1,475 @@
+# -*- coding: utf-8 -*-
+"""
+    jinja2.sandbox
+    ~~~~~~~~~~~~~~
+
+    Adds a sandbox layer to Jinja as it was the default behavior in the old
+    Jinja 1 releases.  This sandbox is slightly different from Jinja 1 as the
+    default behavior is easier to use.
+
+    The behavior can be changed by subclassing the environment.
+
+    :copyright: (c) 2017 by the Jinja Team.
+    :license: BSD.
+"""
+import types
+import operator
+from collections import Mapping
+from jinja2.environment import Environment
+from jinja2.exceptions import SecurityError
+from jinja2._compat import string_types, PY2
+from jinja2.utils import Markup
+
+from markupsafe import EscapeFormatter
+from string import Formatter
+
+
+#: maximum number of items a range may produce
+MAX_RANGE = 100000
+
+#: attributes of function objects that are considered unsafe.
+if PY2:
+    UNSAFE_FUNCTION_ATTRIBUTES = set(['func_closure', 'func_code', 'func_dict',
+                                      'func_defaults', 'func_globals'])
+else:
+    # On versions > python 2 the special attributes on functions are gone,
+    # but they remain on methods and generators for whatever reason.
+    UNSAFE_FUNCTION_ATTRIBUTES = set()
+
+
+#: unsafe method attributes.  function attributes are unsafe for methods too
+UNSAFE_METHOD_ATTRIBUTES = set(['im_class', 'im_func', 'im_self'])
+
+#: unsafe generator attirbutes.
+UNSAFE_GENERATOR_ATTRIBUTES = set(['gi_frame', 'gi_code'])
+
+#: unsafe attributes on coroutines
+UNSAFE_COROUTINE_ATTRIBUTES = set(['cr_frame', 'cr_code'])
+
+#: unsafe attributes on async generators
+UNSAFE_ASYNC_GENERATOR_ATTRIBUTES = set(['ag_code', 'ag_frame'])
+
+import warnings
+
+# make sure we don't warn in python 2.6 about stuff we don't care about
+warnings.filterwarnings('ignore', 'the sets module', DeprecationWarning,
+                        module='jinja2.sandbox')
+
+from collections import deque
+
+_mutable_set_types = (set,)
+_mutable_mapping_types = (dict,)
+_mutable_sequence_types = (list,)
+
+
+# on python 2.x we can register the user collection types
+try:
+    from UserDict import UserDict, DictMixin
+    from UserList import UserList
+    _mutable_mapping_types += (UserDict, DictMixin)
+    _mutable_set_types += (UserList,)
+except ImportError:
+    pass
+
+# if sets is still available, register the mutable set from there as well
+try:
+    from sets import Set
+    _mutable_set_types += (Set,)
+except ImportError:
+    pass
+
+#: register Python 2.6 abstract base classes
+from collections import MutableSet, MutableMapping, MutableSequence
+_mutable_set_types += (MutableSet,)
+_mutable_mapping_types += (MutableMapping,)
+_mutable_sequence_types += (MutableSequence,)
+
+
+_mutable_spec = (
+    (_mutable_set_types, frozenset([
+        'add', 'clear', 'difference_update', 'discard', 'pop', 'remove',
+        'symmetric_difference_update', 'update'
+    ])),
+    (_mutable_mapping_types, frozenset([
+        'clear', 'pop', 'popitem', 'setdefault', 'update'
+    ])),
+    (_mutable_sequence_types, frozenset([
+        'append', 'reverse', 'insert', 'sort', 'extend', 'remove'
+    ])),
+    (deque, frozenset([
+        'append', 'appendleft', 'clear', 'extend', 'extendleft', 'pop',
+        'popleft', 'remove', 'rotate'
+    ]))
+)
+
+
+class _MagicFormatMapping(Mapping):
+    """This class implements a dummy wrapper to fix a bug in the Python
+    standard library for string formatting.
+
+    See https://bugs.python.org/issue13598 for information about why
+    this is necessary.
+    """
+
+    def __init__(self, args, kwargs):
+        self._args = args
+        self._kwargs = kwargs
+        self._last_index = 0
+
+    def __getitem__(self, key):
+        if key == '':
+            idx = self._last_index
+            self._last_index += 1
+            try:
+                return self._args[idx]
+            except LookupError:
+                pass
+            key = str(idx)
+        return self._kwargs[key]
+
+    def __iter__(self):
+        return iter(self._kwargs)
+
+    def __len__(self):
+        return len(self._kwargs)
+
+
+def inspect_format_method(callable):
+    if not isinstance(callable, (types.MethodType,
+                                 types.BuiltinMethodType)) or \
+       callable.__name__ != 'format':
+        return None
+    obj = callable.__self__
+    if isinstance(obj, string_types):
+        return obj
+
+
+def safe_range(*args):
+    """A range that can't generate ranges with a length of more than
+    MAX_RANGE items.
+    """
+    rng = range(*args)
+    if len(rng) > MAX_RANGE:
+        raise OverflowError('range too big, maximum size for range is %d' %
+                            MAX_RANGE)
+    return rng
+
+
+def unsafe(f):
+    """Marks a function or method as unsafe.
+
+    ::
+
+        @unsafe
+        def delete(self):
+            pass
+    """
+    f.unsafe_callable = True
+    return f
+
+
+def is_internal_attribute(obj, attr):
+    """Test if the attribute given is an internal python attribute.  For
+    example this function returns `True` for the `func_code` attribute of
+    python objects.  This is useful if the environment method
+    :meth:`~SandboxedEnvironment.is_safe_attribute` is overridden.
+
+    >>> from jinja2.sandbox import is_internal_attribute
+    >>> is_internal_attribute(str, "mro")
+    True
+    >>> is_internal_attribute(str, "upper")
+    False
+    """
+    if isinstance(obj, types.FunctionType):
+        if attr in UNSAFE_FUNCTION_ATTRIBUTES:
+            return True
+    elif isinstance(obj, types.MethodType):
+        if attr in UNSAFE_FUNCTION_ATTRIBUTES or \
+           attr in UNSAFE_METHOD_ATTRIBUTES:
+            return True
+    elif isinstance(obj, type):
+        if attr == 'mro':
+            return True
+    elif isinstance(obj, (types.CodeType, types.TracebackType, types.FrameType)):
+        return True
+    elif isinstance(obj, types.GeneratorType):
+        if attr in UNSAFE_GENERATOR_ATTRIBUTES:
+            return True
+    elif hasattr(types, 'CoroutineType') and isinstance(obj, types.CoroutineType):
+        if attr in UNSAFE_COROUTINE_ATTRIBUTES:
+            return True
+    elif hasattr(types, 'AsyncGeneratorType') and isinstance(obj, types.AsyncGeneratorType):
+        if attr in UNSAFE_ASYNC_GENERATOR_ATTRIBUTES:
+            return True
+    return attr.startswith('__')
+
+
+def modifies_known_mutable(obj, attr):
+    """This function checks if an attribute on a builtin mutable object
+    (list, dict, set or deque) would modify it if called.  It also supports
+    the "user"-versions of the objects (`sets.Set`, `UserDict.*` etc.) and
+    with Python 2.6 onwards the abstract base classes `MutableSet`,
+    `MutableMapping`, and `MutableSequence`.
+
+    >>> modifies_known_mutable({}, "clear")
+    True
+    >>> modifies_known_mutable({}, "keys")
+    False
+    >>> modifies_known_mutable([], "append")
+    True
+    >>> modifies_known_mutable([], "index")
+    False
+
+    If called with an unsupported object (such as unicode) `False` is
+    returned.
+
+    >>> modifies_known_mutable("foo", "upper")
+    False
+    """
+    for typespec, unsafe in _mutable_spec:
+        if isinstance(obj, typespec):
+            return attr in unsafe
+    return False
+
+
+class SandboxedEnvironment(Environment):
+    """The sandboxed environment.  It works like the regular environment but
+    tells the compiler to generate sandboxed code.  Additionally subclasses of
+    this environment may override the methods that tell the runtime what
+    attributes or functions are safe to access.
+
+    If the template tries to access insecure code a :exc:`SecurityError` is
+    raised.  However also other exceptions may occur during the rendering so
+    the caller has to ensure that all exceptions are caught.
+    """
+    sandboxed = True
+
+    #: default callback table for the binary operators.  A copy of this is
+    #: available on each instance of a sandboxed environment as
+    #: :attr:`binop_table`
+    default_binop_table = {
+        '+':        operator.add,
+        '-':        operator.sub,
+        '*':        operator.mul,
+        '/':        operator.truediv,
+        '//':       operator.floordiv,
+        '**':       operator.pow,
+        '%':        operator.mod
+    }
+
+    #: default callback table for the unary operators.  A copy of this is
+    #: available on each instance of a sandboxed environment as
+    #: :attr:`unop_table`
+    default_unop_table = {
+        '+':        operator.pos,
+        '-':        operator.neg
+    }
+
+    #: a set of binary operators that should be intercepted.  Each operator
+    #: that is added to this set (empty by default) is delegated to the
+    #: :meth:`call_binop` method that will perform the operator.  The default
+    #: operator callback is specified by :attr:`binop_table`.
+    #:
+    #: The following binary operators are interceptable:
+    #: ``//``, ``%``, ``+``, ``*``, ``-``, ``/``, and ``**``
+    #:
+    #: The default operation form the operator table corresponds to the
+    #: builtin function.  Intercepted calls are always slower than the native
+    #: operator call, so make sure only to intercept the ones you are
+    #: interested in.
+    #:
+    #: .. versionadded:: 2.6
+    intercepted_binops = frozenset()
+
+    #: a set of unary operators that should be intercepted.  Each operator
+    #: that is added to this set (empty by default) is delegated to the
+    #: :meth:`call_unop` method that will perform the operator.  The default
+    #: operator callback is specified by :attr:`unop_table`.
+    #:
+    #: The following unary operators are interceptable: ``+``, ``-``
+    #:
+    #: The default operation form the operator table corresponds to the
+    #: builtin function.  Intercepted calls are always slower than the native
+    #: operator call, so make sure only to intercept the ones you are
+    #: interested in.
+    #:
+    #: .. versionadded:: 2.6
+    intercepted_unops = frozenset()
+
+    def intercept_unop(self, operator):
+        """Called during template compilation with the name of a unary
+        operator to check if it should be intercepted at runtime.  If this
+        method returns `True`, :meth:`call_unop` is excuted for this unary
+        operator.  The default implementation of :meth:`call_unop` will use
+        the :attr:`unop_table` dictionary to perform the operator with the
+        same logic as the builtin one.
+
+        The following unary operators are interceptable: ``+`` and ``-``
+
+        Intercepted calls are always slower than the native operator call,
+        so make sure only to intercept the ones you are interested in.
+
+        .. versionadded:: 2.6
+        """
+        return False
+
+
+    def __init__(self, *args, **kwargs):
+        Environment.__init__(self, *args, **kwargs)
+        self.globals['range'] = safe_range
+        self.binop_table = self.default_binop_table.copy()
+        self.unop_table = self.default_unop_table.copy()
+
+    def is_safe_attribute(self, obj, attr, value):
+        """The sandboxed environment will call this method to check if the
+        attribute of an object is safe to access.  Per default all attributes
+        starting with an underscore are considered private as well as the
+        special attributes of internal python objects as returned by the
+        :func:`is_internal_attribute` function.
+        """
+        return not (attr.startswith('_') or is_internal_attribute(obj, attr))
+
+    def is_safe_callable(self, obj):
+        """Check if an object is safely callable.  Per default a function is
+        considered safe unless the `unsafe_callable` attribute exists and is
+        True.  Override this method to alter the behavior, but this won't
+        affect the `unsafe` decorator from this module.
+        """
+        return not (getattr(obj, 'unsafe_callable', False) or
+                    getattr(obj, 'alters_data', False))
+
+    def call_binop(self, context, operator, left, right):
+        """For intercepted binary operator calls (:meth:`intercepted_binops`)
+        this function is executed instead of the builtin operator.  This can
+        be used to fine tune the behavior of certain operators.
+
+        .. versionadded:: 2.6
+        """
+        return self.binop_table[operator](left, right)
+
+    def call_unop(self, context, operator, arg):
+        """For intercepted unary operator calls (:meth:`intercepted_unops`)
+        this function is executed instead of the builtin operator.  This can
+        be used to fine tune the behavior of certain operators.
+
+        .. versionadded:: 2.6
+        """
+        return self.unop_table[operator](arg)
+
+    def getitem(self, obj, argument):
+        """Subscribe an object from sandboxed code."""
+        try:
+            return obj[argument]
+        except (TypeError, LookupError):
+            if isinstance(argument, string_types):
+                try:
+                    attr = str(argument)
+                except Exception:
+                    pass
+                else:
+                    try:
+                        value = getattr(obj, attr)
+                    except AttributeError:
+                        pass
+                    else:
+                        if self.is_safe_attribute(obj, argument, value):
+                            return value
+                        return self.unsafe_undefined(obj, argument)
+        return self.undefined(obj=obj, name=argument)
+
+    def getattr(self, obj, attribute):
+        """Subscribe an object from sandboxed code and prefer the
+        attribute.  The attribute passed *must* be a bytestring.
+        """
+        try:
+            value = getattr(obj, attribute)
+        except AttributeError:
+            try:
+                return obj[attribute]
+            except (TypeError, LookupError):
+                pass
+        else:
+            if self.is_safe_attribute(obj, attribute, value):
+                return value
+            return self.unsafe_undefined(obj, attribute)
+        return self.undefined(obj=obj, name=attribute)
+
+    def unsafe_undefined(self, obj, attribute):
+        """Return an undefined object for unsafe attributes."""
+        return self.undefined('access to attribute %r of %r '
+                              'object is unsafe.' % (
+            attribute,
+            obj.__class__.__name__
+        ), name=attribute, obj=obj, exc=SecurityError)
+
+    def format_string(self, s, args, kwargs):
+        """If a format call is detected, then this is routed through this
+        method so that our safety sandbox can be used for it.
+        """
+        if isinstance(s, Markup):
+            formatter = SandboxedEscapeFormatter(self, s.escape)
+        else:
+            formatter = SandboxedFormatter(self)
+        kwargs = _MagicFormatMapping(args, kwargs)
+        rv = formatter.vformat(s, args, kwargs)
+        return type(s)(rv)
+
+    def call(__self, __context, __obj, *args, **kwargs):
+        """Call an object from sandboxed code."""
+        fmt = inspect_format_method(__obj)
+        if fmt is not None:
+            return __self.format_string(fmt, args, kwargs)
+
+        # the double prefixes are to avoid double keyword argument
+        # errors when proxying the call.
+        if not __self.is_safe_callable(__obj):
+            raise SecurityError('%r is not safely callable' % (__obj,))
+        return __context.call(__obj, *args, **kwargs)
+
+
+class ImmutableSandboxedEnvironment(SandboxedEnvironment):
+    """Works exactly like the regular `SandboxedEnvironment` but does not
+    permit modifications on the builtin mutable objects `list`, `set`, and
+    `dict` by using the :func:`modifies_known_mutable` function.
+    """
+
+    def is_safe_attribute(self, obj, attr, value):
+        if not SandboxedEnvironment.is_safe_attribute(self, obj, attr, value):
+            return False
+        return not modifies_known_mutable(obj, attr)
+
+
+# This really is not a public API apparenlty.
+try:
+    from _string import formatter_field_name_split
+except ImportError:
+    def formatter_field_name_split(field_name):
+        return field_name._formatter_field_name_split()
+
+
+class SandboxedFormatterMixin(object):
+
+    def __init__(self, env):
+        self._env = env
+
+    def get_field(self, field_name, args, kwargs):
+        first, rest = formatter_field_name_split(field_name)
+        obj = self.get_value(first, args, kwargs)
+        for is_attr, i in rest:
+            if is_attr:
+                obj = self._env.getattr(obj, i)
+            else:
+                obj = self._env.getitem(obj, i)
+        return obj, first
+
+class SandboxedFormatter(SandboxedFormatterMixin, Formatter):
+
+    def __init__(self, env):
+        SandboxedFormatterMixin.__init__(self, env)
+        Formatter.__init__(self)
+
+class SandboxedEscapeFormatter(SandboxedFormatterMixin, EscapeFormatter):
+
+    def __init__(self, env, escape):
+        SandboxedFormatterMixin.__init__(self, env)
+        EscapeFormatter.__init__(self, escape)
diff --git a/deps/jinja2/tests.py b/deps/jinja2/tests.py
new file mode 100644
index 00000000000000..0adc3d4dbcbb88
--- /dev/null
+++ b/deps/jinja2/tests.py
@@ -0,0 +1,175 @@
+# -*- coding: utf-8 -*-
+"""
+    jinja2.tests
+    ~~~~~~~~~~~~
+
+    Jinja test functions. Used with the "is" operator.
+
+    :copyright: (c) 2017 by the Jinja Team.
+    :license: BSD, see LICENSE for more details.
+"""
+import operator
+import re
+from collections import Mapping
+from jinja2.runtime import Undefined
+from jinja2._compat import text_type, string_types, integer_types
+import decimal
+
+number_re = re.compile(r'^-?\d+(\.\d+)?$')
+regex_type = type(number_re)
+
+
+test_callable = callable
+
+
+def test_odd(value):
+    """Return true if the variable is odd."""
+    return value % 2 == 1
+
+
+def test_even(value):
+    """Return true if the variable is even."""
+    return value % 2 == 0
+
+
+def test_divisibleby(value, num):
+    """Check if a variable is divisible by a number."""
+    return value % num == 0
+
+
+def test_defined(value):
+    """Return true if the variable is defined:
+
+    .. sourcecode:: jinja
+
+        {% if variable is defined %}
+            value of variable: {{ variable }}
+        {% else %}
+            variable is not defined
+        {% endif %}
+
+    See the :func:`default` filter for a simple way to set undefined
+    variables.
+    """
+    return not isinstance(value, Undefined)
+
+
+def test_undefined(value):
+    """Like :func:`defined` but the other way round."""
+    return isinstance(value, Undefined)
+
+
+def test_none(value):
+    """Return true if the variable is none."""
+    return value is None
+
+
+def test_lower(value):
+    """Return true if the variable is lowercased."""
+    return text_type(value).islower()
+
+
+def test_upper(value):
+    """Return true if the variable is uppercased."""
+    return text_type(value).isupper()
+
+
+def test_string(value):
+    """Return true if the object is a string."""
+    return isinstance(value, string_types)
+
+
+def test_mapping(value):
+    """Return true if the object is a mapping (dict etc.).
+
+    .. versionadded:: 2.6
+    """
+    return isinstance(value, Mapping)
+
+
+def test_number(value):
+    """Return true if the variable is a number."""
+    return isinstance(value, integer_types + (float, complex, decimal.Decimal))
+
+
+def test_sequence(value):
+    """Return true if the variable is a sequence. Sequences are variables
+    that are iterable.
+    """
+    try:
+        len(value)
+        value.__getitem__
+    except:
+        return False
+    return True
+
+
+def test_sameas(value, other):
+    """Check if an object points to the same memory address than another
+    object:
+
+    .. sourcecode:: jinja
+
+        {% if foo.attribute is sameas false %}
+            the foo attribute really is the `False` singleton
+        {% endif %}
+    """
+    return value is other
+
+
+def test_iterable(value):
+    """Check if it's possible to iterate over an object."""
+    try:
+        iter(value)
+    except TypeError:
+        return False
+    return True
+
+
+def test_escaped(value):
+    """Check if the value is escaped."""
+    return hasattr(value, '__html__')
+
+
+def test_in(value, seq):
+    """Check if value is in seq.
+
+    .. versionadded:: 2.10
+    """
+    return value in seq
+
+
+TESTS = {
+    'odd':              test_odd,
+    'even':             test_even,
+    'divisibleby':      test_divisibleby,
+    'defined':          test_defined,
+    'undefined':        test_undefined,
+    'none':             test_none,
+    'lower':            test_lower,
+    'upper':            test_upper,
+    'string':           test_string,
+    'mapping':          test_mapping,
+    'number':           test_number,
+    'sequence':         test_sequence,
+    'iterable':         test_iterable,
+    'callable':         test_callable,
+    'sameas':           test_sameas,
+    'escaped':          test_escaped,
+    'in':               test_in,
+    '==':               operator.eq,
+    'eq':               operator.eq,
+    'equalto':          operator.eq,
+    '!=':               operator.ne,
+    'ne':               operator.ne,
+    '>':                operator.gt,
+    'gt':               operator.gt,
+    'greaterthan':      operator.gt,
+    'ge':               operator.ge,
+    '>=':               operator.ge,
+    '<':                operator.lt,
+    'lt':               operator.lt,
+    'lessthan':         operator.lt,
+    '<=':               operator.le,
+    'le':               operator.le,
+}
diff --git a/deps/jinja2/utils.py b/deps/jinja2/utils.py
new file mode 100644
index 00000000000000..502a311c08e549
--- /dev/null
+++ b/deps/jinja2/utils.py
@@ -0,0 +1,647 @@
+# -*- coding: utf-8 -*-
+"""
+    jinja2.utils
+    ~~~~~~~~~~~~
+
+    Utility functions.
+
+    :copyright: (c) 2017 by the Jinja Team.
+    :license: BSD, see LICENSE for more details.
+"""
+import re
+import json
+import errno
+from collections import deque
+from threading import Lock
+from jinja2._compat import text_type, string_types, implements_iterator, \
+     url_quote
+
+
+_word_split_re = re.compile(r'(\s+)')
+_punctuation_re = re.compile(
+    '^(?P<lead>(?:%s)*)(?P<middle>.*?)(?P<trail>(?:%s)*)$' % (
+        '|'.join(map(re.escape, ('(', '<', '&lt;'))),
+        '|'.join(map(re.escape, ('.', ',', ')', '>', '\n', '&gt;')))
+    )
+)
+_simple_email_re = re.compile(r'^\S+@[a-zA-Z0-9._-]+\.[a-zA-Z0-9._-]+$')
+_striptags_re = re.compile(r'(<!--.*?-->|<[^>]*>)')
+_entity_re = re.compile(r'&([^;]+);')
+_letters = 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ'
+_digits = '0123456789'
+
+# special singleton representing missing values for the runtime
+missing = type('MissingType', (), {'__repr__': lambda x: 'missing'})()
+
+# internal code
+internal_code = set()
+
+concat = u''.join
+
+_slash_escape = '\\/' not in json.dumps('/')
+
+
+def contextfunction(f):
+    """This decorator can be used to mark a function or method context callable.
+    A context callable is passed the active :class:`Context` as first argument when
+    called from the template.  This is useful if a function wants to get access
+    to the context or functions provided on the context object.  For example
+    a function that returns a sorted list of template variables the current
+    template exports could look like this::
+
+        @contextfunction
+        def get_exported_names(context):
+            return sorted(context.exported_vars)
+    """
+    f.contextfunction = True
+    return f
+
+
+def evalcontextfunction(f):
+    """This decorator can be used to mark a function or method as an eval
+    context callable.  This is similar to the :func:`contextfunction`
+    but instead of passing the context, an evaluation context object is
+    passed.  For more information about the eval context, see
+    :ref:`eval-context`.
+
+    .. versionadded:: 2.4
+    """
+    f.evalcontextfunction = True
+    return f
+
+
+def environmentfunction(f):
+    """This decorator can be used to mark a function or method as environment
+    callable.  This decorator works exactly like the :func:`contextfunction`
+    decorator just that the first argument is the active :class:`Environment`
+    and not context.
+    """
+    f.environmentfunction = True
+    return f
+
+
+def internalcode(f):
+    """Marks the function as internally used"""
+    internal_code.add(f.__code__)
+    return f
+
+
+def is_undefined(obj):
+    """Check if the object passed is undefined.  This does nothing more than
+    performing an instance check against :class:`Undefined` but looks nicer.
+    This can be used for custom filters or tests that want to react to
+    undefined variables.  For example a custom default filter can look like
+    this::
+
+        def default(var, default=''):
+            if is_undefined(var):
+                return default
+            return var
+    """
+    from jinja2.runtime import Undefined
+    return isinstance(obj, Undefined)
+
+
+def consume(iterable):
+    """Consumes an iterable without doing anything with it."""
+    for event in iterable:
+        pass
+
+
+def clear_caches():
+    """Jinja2 keeps internal caches for environments and lexers.  These are
+    used so that Jinja2 doesn't have to recreate environments and lexers all
+    the time.  Normally you don't have to care about that but if you are
+    measuring memory consumption you may want to clean the caches.
+    """
+    from jinja2.environment import _spontaneous_environments
+    from jinja2.lexer import _lexer_cache
+    _spontaneous_environments.clear()
+    _lexer_cache.clear()
+
+
+def import_string(import_name, silent=False):
+    """Imports an object based on a string.  This is useful if you want to
+    use import paths as endpoints or something similar.  An import path can
+    be specified either in dotted notation (``xml.sax.saxutils.escape``)
+    or with a colon as object delimiter (``xml.sax.saxutils:escape``).
+
+    If the `silent` is True the return value will be `None` if the import
+    fails.
+
+    :return: imported object
+    """
+    try:
+        if ':' in import_name:
+            module, obj = import_name.split(':', 1)
+        elif '.' in import_name:
+            items = import_name.split('.')
+            module = '.'.join(items[:-1])
+            obj = items[-1]
+        else:
+            return __import__(import_name)
+        return getattr(__import__(module, None, None, [obj]), obj)
+    except (ImportError, AttributeError):
+        if not silent:
+            raise
+
+
+def open_if_exists(filename, mode='rb'):
+    """Returns a file descriptor for the filename if that file exists,
+    otherwise `None`.
+    """
+    try:
+        return open(filename, mode)
+    except IOError as e:
+        if e.errno not in (errno.ENOENT, errno.EISDIR, errno.EINVAL):
+            raise
+
+
+def object_type_repr(obj):
+    """Returns the name of the object's type.  For some recognized
+    singletons the name of the object is returned instead. (For
+    example for `None` and `Ellipsis`).
+    """
+    if obj is None:
+        return 'None'
+    elif obj is Ellipsis:
+        return 'Ellipsis'
+    # __builtin__ in 2.x, builtins in 3.x
+    if obj.__class__.__module__ in ('__builtin__', 'builtins'):
+        name = obj.__class__.__name__
+    else:
+        name = obj.__class__.__module__ + '.' + obj.__class__.__name__
+    return '%s object' % name
+
+
+def pformat(obj, verbose=False):
+    """Prettyprint an object.  Either use the `pretty` library or the
+    builtin `pprint`.
+    """
+    try:
+        from pretty import pretty
+        return pretty(obj, verbose=verbose)
+    except ImportError:
+        from pprint import pformat
+        return pformat(obj)
+
+
+def urlize(text, trim_url_limit=None, rel=None, target=None):
+    """Converts any URLs in text into clickable links. Works on http://,
+    https:// and www. links. Links can have trailing punctuation (periods,
+    commas, close-parens) and leading punctuation (opening parens) and
+    it'll still do the right thing.
+
+    If trim_url_limit is not None, the URLs in link text will be limited
+    to trim_url_limit characters.
+
+    If nofollow is True, the URLs in link text will get a rel="nofollow"
+    attribute.
+
+    If target is not None, a target attribute will be added to the link.
+    """
+    trim_url = lambda x, limit=trim_url_limit: limit is not None \
+                         and (x[:limit] + (len(x) >=limit and '...'
+                         or '')) or x
+    words = _word_split_re.split(text_type(escape(text)))
+    rel_attr = rel and ' rel="%s"' % text_type(escape(rel)) or ''
+    target_attr = target and ' target="%s"' % escape(target) or ''
+
+    for i, word in enumerate(words):
+        match = _punctuation_re.match(word)
+        if match:
+            lead, middle, trail = match.groups()
+            if middle.startswith('www.') or (
+                '@' not in middle and
+                not middle.startswith('http://') and
+                not middle.startswith('https://') and
+                len(middle) > 0 and
+                middle[0] in _letters + _digits and (
+                    middle.endswith('.org') or
+                    middle.endswith('.net') or
+                    middle.endswith('.com')
+                )):
+                middle = '<a href="http://%s"%s%s>%s</a>' % (middle,
+                    rel_attr, target_attr, trim_url(middle))
+            if middle.startswith('http://') or \
+               middle.startswith('https://'):
+                middle = '<a href="%s"%s%s>%s</a>' % (middle,
+                    rel_attr, target_attr, trim_url(middle))
+            if '@' in middle and not middle.startswith('www.') and \
+               not ':' in middle and _simple_email_re.match(middle):
+                middle = '<a href="mailto:%s">%s</a>' % (middle, middle)
+            if lead + middle + trail != word:
+                words[i] = lead + middle + trail
+    return u''.join(words)
+
+
+def generate_lorem_ipsum(n=5, html=True, min=20, max=100):
+    """Generate some lorem ipsum for the template."""
+    from jinja2.constants import LOREM_IPSUM_WORDS
+    from random import choice, randrange
+    words = LOREM_IPSUM_WORDS.split()
+    result = []
+
+    for _ in range(n):
+        next_capitalized = True
+        last_comma = last_fullstop = 0
+        word = None
+        last = None
+        p = []
+
+        # each paragraph contains out of 20 to 100 words.
+        for idx, _ in enumerate(range(randrange(min, max))):
+            while True:
+                word = choice(words)
+                if word != last:
+                    last = word
+                    break
+            if next_capitalized:
+                word = word.capitalize()
+                next_capitalized = False
+            # add commas
+            if idx - randrange(3, 8) > last_comma:
+                last_comma = idx
+                last_fullstop += 2
+                word += ','
+            # add end of sentences
+            if idx - randrange(10, 20) > last_fullstop:
+                last_comma = last_fullstop = idx
+                word += '.'
+                next_capitalized = True
+            p.append(word)
+
+        # ensure that the paragraph ends with a dot.
+        p = u' '.join(p)
+        if p.endswith(','):
+            p = p[:-1] + '.'
+        elif not p.endswith('.'):
+            p += '.'
+        result.append(p)
+
+    if not html:
+        return u'\n\n'.join(result)
+    return Markup(u'\n'.join(u'<p>%s</p>' % escape(x) for x in result))
+
+
+def unicode_urlencode(obj, charset='utf-8', for_qs=False):
+    """URL escapes a single bytestring or unicode string with the
+    given charset if applicable to URL safe quoting under all rules
+    that need to be considered under all supported Python versions.
+
+    If non strings are provided they are converted to their unicode
+    representation first.
+    """
+    if not isinstance(obj, string_types):
+        obj = text_type(obj)
+    if isinstance(obj, text_type):
+        obj = obj.encode(charset)
+    safe = not for_qs and b'/' or b''
+    rv = text_type(url_quote(obj, safe))
+    if for_qs:
+        rv = rv.replace('%20', '+')
+    return rv
+
+
+class LRUCache(object):
+    """A simple LRU Cache implementation."""
+
+    # this is fast for small capacities (something below 1000) but doesn't
+    # scale.  But as long as it's only used as storage for templates this
+    # won't do any harm.
+
+    def __init__(self, capacity):
+        self.capacity = capacity
+        self._mapping = {}
+        self._queue = deque()
+        self._postinit()
+
+    def _postinit(self):
+        # alias all queue methods for faster lookup
+        self._popleft = self._queue.popleft
+        self._pop = self._queue.pop
+        self._remove = self._queue.remove
+        self._wlock = Lock()
+        self._append = self._queue.append
+
+    def __getstate__(self):
+        return {
+            'capacity':     self.capacity,
+            '_mapping':     self._mapping,
+            '_queue':       self._queue
+        }
+
+    def __setstate__(self, d):
+        self.__dict__.update(d)
+        self._postinit()
+
+    def __getnewargs__(self):
+        return (self.capacity,)
+
+    def copy(self):
+        """Return a shallow copy of the instance."""
+        rv = self.__class__(self.capacity)
+        rv._mapping.update(self._mapping)
+        rv._queue = deque(self._queue)
+        return rv
+
+    def get(self, key, default=None):
+        """Return an item from the cache dict or `default`"""
+        try:
+            return self[key]
+        except KeyError:
+            return default
+
+    def setdefault(self, key, default=None):
+        """Set `default` if the key is not in the cache otherwise
+        leave unchanged. Return the value of this key.
+        """
+        self._wlock.acquire()
+        try:
+            try:
+                return self[key]
+            except KeyError:
+                self[key] = default
+                return default
+        finally:
+            self._wlock.release()
+
+    def clear(self):
+        """Clear the cache."""
+        self._wlock.acquire()
+        try:
+            self._mapping.clear()
+            self._queue.clear()
+        finally:
+            self._wlock.release()
+
+    def __contains__(self, key):
+        """Check if a key exists in this cache."""
+        return key in self._mapping
+
+    def __len__(self):
+        """Return the current size of the cache."""
+        return len(self._mapping)
+
+    def __repr__(self):
+        return '<%s %r>' % (
+            self.__class__.__name__,
+            self._mapping
+        )
+
+    def __getitem__(self, key):
+        """Get an item from the cache. Moves the item up so that it has the
+        highest priority then.
+
+        Raise a `KeyError` if it does not exist.
+        """
+        self._wlock.acquire()
+        try:
+            rv = self._mapping[key]
+            if self._queue[-1] != key:
+                try:
+                    self._remove(key)
+                except ValueError:
+                    # if something removed the key from the container
+                    # when we read, ignore the ValueError that we would
+                    # get otherwise.
+                    pass
+                self._append(key)
+            return rv
+        finally:
+            self._wlock.release()
+
+    def __setitem__(self, key, value):
+        """Sets the value for an item. Moves the item up so that it
+        has the highest priority then.
+        """
+        self._wlock.acquire()
+        try:
+            if key in self._mapping:
+                self._remove(key)
+            elif len(self._mapping) == self.capacity:
+                del self._mapping[self._popleft()]
+            self._append(key)
+            self._mapping[key] = value
+        finally:
+            self._wlock.release()
+
+    def __delitem__(self, key):
+        """Remove an item from the cache dict.
+        Raise a `KeyError` if it does not exist.
+        """
+        self._wlock.acquire()
+        try:
+            del self._mapping[key]
+            try:
+                self._remove(key)
+            except ValueError:
+                # __getitem__ is not locked, it might happen
+                pass
+        finally:
+            self._wlock.release()
+
+    def items(self):
+        """Return a list of items."""
+        result = [(key, self._mapping[key]) for key in list(self._queue)]
+        result.reverse()
+        return result
+
+    def iteritems(self):
+        """Iterate over all items."""
+        return iter(self.items())
+
+    def values(self):
+        """Return a list of all values."""
+        return [x[1] for x in self.items()]
+
+    def itervalue(self):
+        """Iterate over all values."""
+        return iter(self.values())
+
+    def keys(self):
+        """Return a list of all keys ordered by most recent usage."""
+        return list(self)
+
+    def iterkeys(self):
+        """Iterate over all keys in the cache dict, ordered by
+        the most recent usage.
+        """
+        return reversed(tuple(self._queue))
+
+    __iter__ = iterkeys
+
+    def __reversed__(self):
+        """Iterate over the values in the cache dict, oldest items
+        coming first.
+        """
+        return iter(tuple(self._queue))
+
+    __copy__ = copy
+
+
+# register the LRU cache as mutable mapping if possible
+try:
+    from collections import MutableMapping
+    MutableMapping.register(LRUCache)
+except ImportError:
+    pass
+
+
+def select_autoescape(enabled_extensions=('html', 'htm', 'xml'),
+                      disabled_extensions=(),
+                      default_for_string=True,
+                      default=False):
+    """Intelligently sets the initial value of autoescaping based on the
+    filename of the template.  This is the recommended way to configure
+    autoescaping if you do not want to write a custom function yourself.
+
+    If you want to enable it for all templates created from strings or
+    for all templates with `.html` and `.xml` extensions::
+
+        from jinja2 import Environment, select_autoescape
+        env = Environment(autoescape=select_autoescape(
+            enabled_extensions=('html', 'xml'),
+            default_for_string=True,
+        ))
+
+    Example configuration to turn it on at all times except if the template
+    ends with `.txt`::
+
+        from jinja2 import Environment, select_autoescape
+        env = Environment(autoescape=select_autoescape(
+            disabled_extensions=('txt',),
+            default_for_string=True,
+            default=True,
+        ))
+
+    The `enabled_extensions` is an iterable of all the extensions that
+    autoescaping should be enabled for.  Likewise `disabled_extensions` is
+    a list of all templates it should be disabled for.  If a template is
+    loaded from a string then the default from `default_for_string` is used.
+    If nothing matches then the initial value of autoescaping is set to the
+    value of `default`.
+
+    For security reasons this function operates case insensitive.
+
+    .. versionadded:: 2.9
+    """
+    enabled_patterns = tuple('.' + x.lstrip('.').lower()
+                             for x in enabled_extensions)
+    disabled_patterns = tuple('.' + x.lstrip('.').lower()
+                              for x in disabled_extensions)
+    def autoescape(template_name):
+        if template_name is None:
+            return default_for_string
+        template_name = template_name.lower()
+        if template_name.endswith(enabled_patterns):
+            return True
+        if template_name.endswith(disabled_patterns):
+            return False
+        return default
+    return autoescape
+
+
+def htmlsafe_json_dumps(obj, dumper=None, **kwargs):
+    """Works exactly like :func:`dumps` but is safe for use in ``<script>``
+    tags.  It accepts the same arguments and returns a JSON string.  Note that
+    this is available in templates through the ``|tojson`` filter which will
+    also mark the result as safe.  Due to how this function escapes certain
+    characters this is safe even if used outside of ``<script>`` tags.
+
+    The following characters are escaped in strings:
+
+    -   ``<``
+    -   ``>``
+    -   ``&``
+    -   ``'``
+
+    This makes it safe to embed such strings in any place in HTML with the
+    notable exception of double quoted attributes.  In that case single
+    quote your attributes or HTML escape it in addition.
+    """
+    if dumper is None:
+        dumper = json.dumps
+    rv = dumper(obj, **kwargs) \
+        .replace(u'<', u'\\u003c') \
+        .replace(u'>', u'\\u003e') \
+        .replace(u'&', u'\\u0026') \
+        .replace(u"'", u'\\u0027')
+    return Markup(rv)
+
+
+@implements_iterator
+class Cycler(object):
+    """A cycle helper for templates."""
+
+    def __init__(self, *items):
+        if not items:
+            raise RuntimeError('at least one item has to be provided')
+        self.items = items
+        self.reset()
+
+    def reset(self):
+        """Resets the cycle."""
+        self.pos = 0
+
+    @property
+    def current(self):
+        """Returns the current item."""
+        return self.items[self.pos]
+
+    def next(self):
+        """Goes one item ahead and returns it."""
+        rv = self.current
+        self.pos = (self.pos + 1) % len(self.items)
+        return rv
+
+    __next__ = next
+
+
+class Joiner(object):
+    """A joining helper for templates."""
+
+    def __init__(self, sep=u', '):
+        self.sep = sep
+        self.used = False
+
+    def __call__(self):
+        if not self.used:
+            self.used = True
+            return u''
+        return self.sep
+
+
+class Namespace(object):
+    """A namespace object that can hold arbitrary attributes.  It may be
+    initialized from a dictionary or with keyword argments."""
+
+    def __init__(*args, **kwargs):
+        self, args = args[0], args[1:]
+        self.__attrs = dict(*args, **kwargs)
+
+    def __getattribute__(self, name):
+        if name == '_Namespace__attrs':
+            return object.__getattribute__(self, name)
+        try:
+            return self.__attrs[name]
+        except KeyError:
+            raise AttributeError(name)
+
+    def __setitem__(self, name, value):
+        self.__attrs[name] = value
+
+    def __repr__(self):
+        return '<Namespace %r>' % self.__attrs
+
+
+# does this python version support async for in and async generators?
+try:
+    exec('async def _():\n async for _ in ():\n  yield _')
+    have_async_gen = True
+except SyntaxError:
+    have_async_gen = False
+
+
+# Imported here because that's where it was in the past
+from markupsafe import Markup, escape, soft_unicode
diff --git a/deps/jinja2/visitor.py b/deps/jinja2/visitor.py
new file mode 100644
index 00000000000000..ba526dfac9283e
--- /dev/null
+++ b/deps/jinja2/visitor.py
@@ -0,0 +1,87 @@
+# -*- coding: utf-8 -*-
+"""
+    jinja2.visitor
+    ~~~~~~~~~~~~~~
+
+    This module implements a visitor for the nodes.
+
+    :copyright: (c) 2017 by the Jinja Team.
+    :license: BSD.
+"""
+from jinja2.nodes import Node
+
+
+class NodeVisitor(object):
+    """Walks the abstract syntax tree and call visitor functions for every
+    node found.  The visitor functions may return values which will be
+    forwarded by the `visit` method.
+
+    Per default the visitor functions for the nodes are ``'visit_'`` +
+    class name of the node.  So a `TryFinally` node visit function would
+    be `visit_TryFinally`.  This behavior can be changed by overriding
+    the `get_visitor` function.  If no visitor function exists for a node
+    (return value `None`) the `generic_visit` visitor is used instead.
+    """
+
+    def get_visitor(self, node):
+        """Return the visitor function for this node or `None` if no visitor
+        exists for this node.  In that case the generic visit function is
+        used instead.
+        """
+        method = 'visit_' + node.__class__.__name__
+        return getattr(self, method, None)
+
+    def visit(self, node, *args, **kwargs):
+        """Visit a node."""
+        f = self.get_visitor(node)
+        if f is not None:
+            return f(node, *args, **kwargs)
+        return self.generic_visit(node, *args, **kwargs)
+
+    def generic_visit(self, node, *args, **kwargs):
+        """Called if no explicit visitor function exists for a node."""
+        for node in node.iter_child_nodes():
+            self.visit(node, *args, **kwargs)
+
+
+class NodeTransformer(NodeVisitor):
+    """Walks the abstract syntax tree and allows modifications of nodes.
+
+    The `NodeTransformer` will walk the AST and use the return value of the
+    visitor functions to replace or remove the old node.  If the return
+    value of the visitor function is `None` the node will be removed
+    from the previous location otherwise it's replaced with the return
+    value.  The return value may be the original node in which case no
+    replacement takes place.
+    """
+
+    def generic_visit(self, node, *args, **kwargs):
+        for field, old_value in node.iter_fields():
+            if isinstance(old_value, list):
+                new_values = []
+                for value in old_value:
+                    if isinstance(value, Node):
+                        value = self.visit(value, *args, **kwargs)
+                        if value is None:
+                            continue
+                        elif not isinstance(value, Node):
+                            new_values.extend(value)
+                            continue
+                    new_values.append(value)
+                old_value[:] = new_values
+            elif isinstance(old_value, Node):
+                new_node = self.visit(old_value, *args, **kwargs)
+                if new_node is None:
+                    delattr(node, field)
+                else:
+                    setattr(node, field, new_node)
+        return node
+
+    def visit_list(self, node, *args, **kwargs):
+        """As transformers may return lists in some places this method
+        can be used to enforce a list as return value.
+        """
+        rv = self.visit(node, *args, **kwargs)
+        if not isinstance(rv, list):
+            rv = [rv]
+        return rv
diff --git a/deps/markupsafe/AUTHORS b/deps/markupsafe/AUTHORS
new file mode 100644
index 00000000000000..f7e2942eccd11e
--- /dev/null
+++ b/deps/markupsafe/AUTHORS
@@ -0,0 +1,13 @@
+MarkupSafe is written and maintained by Armin Ronacher and
+various contributors:
+
+Development Lead
+````````````````
+
+- Armin Ronacher <armin.ronacher@active-4.com>
+
+Patches and Suggestions
+```````````````````````
+
+- Georg Brandl
+- Mickaël Guérin
diff --git a/deps/markupsafe/LICENSE b/deps/markupsafe/LICENSE
new file mode 100644
index 00000000000000..5d2693890dddc3
--- /dev/null
+++ b/deps/markupsafe/LICENSE
@@ -0,0 +1,33 @@
+Copyright (c) 2010 by Armin Ronacher and contributors.  See AUTHORS
+for more details.
+
+Some rights reserved.
+
+Redistribution and use in source and binary forms of the software as well
+as documentation, with or without modification, are permitted provided
+that the following conditions are met:
+
+* Redistributions of source code must retain the above copyright
+  notice, this list of conditions and the following disclaimer.
+
+* Redistributions in binary form must reproduce the above
+  copyright notice, this list of conditions and the following
+  disclaimer in the documentation and/or other materials provided
+  with the distribution.
+
+* The names of the contributors may not be used to endorse or
+  promote products derived from this software without specific
+  prior written permission.
+
+THIS SOFTWARE AND DOCUMENTATION IS PROVIDED BY THE COPYRIGHT HOLDERS AND
+CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT
+NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER
+OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
+LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
+NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+SOFTWARE AND DOCUMENTATION, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
+DAMAGE.
diff --git a/deps/markupsafe/MarkupSafe-0.18.tar.gz.md5 b/deps/markupsafe/MarkupSafe-0.18.tar.gz.md5
new file mode 100644
index 00000000000000..1348d1eea1fb90
--- /dev/null
+++ b/deps/markupsafe/MarkupSafe-0.18.tar.gz.md5
@@ -0,0 +1 @@
+f8d252fd05371e51dec2fe9a36890687  MarkupSafe-0.18.tar.gz
diff --git a/deps/markupsafe/MarkupSafe-0.18.tar.gz.sha512 b/deps/markupsafe/MarkupSafe-0.18.tar.gz.sha512
new file mode 100644
index 00000000000000..ab752200d5fcb4
--- /dev/null
+++ b/deps/markupsafe/MarkupSafe-0.18.tar.gz.sha512
@@ -0,0 +1 @@
+0438ddf0fdab465c40d9afba8c14ad346be0868df654c11130d05e329992d456a9bc278551970cbd09244a29c77213885d0c363c951b0cfd4d9aa95b248ecff5  MarkupSafe-0.18.tar.gz
diff --git a/deps/markupsafe/OWNERS b/deps/markupsafe/OWNERS
new file mode 100644
index 00000000000000..6a57e5dc3fed35
--- /dev/null
+++ b/deps/markupsafe/OWNERS
@@ -0,0 +1,5 @@
+timloh@chromium.org
+haraken@chromium.org
+nbarth@chromium.org
+
+# COMPONENT: Internals
diff --git a/deps/markupsafe/README.chromium b/deps/markupsafe/README.chromium
new file mode 100644
index 00000000000000..0fcab52fa2b41c
--- /dev/null
+++ b/deps/markupsafe/README.chromium
@@ -0,0 +1,24 @@
+Name: MarkupSafe Python Safe String Class
+Short Name: markupsafe
+URL: https://github.com/mitsuhiko/markupsafe
+Version: 0.18
+License: BSD 3-clause License
+License File: NOT_SHIPPED
+Security Critical: no
+
+Description:
+Safe string class, used by Jinja2 template engine.
+
+Source:
+https://pypi.python.org/packages/source/M/MarkupSafe/MarkupSafe-0.18.tar.gz
+MD5: f8d252fd05371e51dec2fe9a36890687
+SHA-512: 0438ddf0fdab465c40d9afba8c14ad346be0868df654c11130d05e329992d456
+         a9bc278551970cbd09244a29c77213885d0c363c951b0cfd4d9aa95b248ecff5
+
+Local Modifications:
+This only includes the markup directory from the tarball and the LICENSE and
+AUTHORS files, removing the unneeded unit tests (tests.py).
+Also includes install script (get_markupsafe.sh) and files of hashes (MD5 is
+also posted on website, SHA-512 computed locally); script checks hash then
+unpacks archive and installs desired files.
+Retrieve or update by executing markupsafe/get_markupsafe.sh from third_party.
diff --git a/deps/markupsafe/__init__.py b/deps/markupsafe/__init__.py
new file mode 100644
index 00000000000000..25f00d3a4f2795
--- /dev/null
+++ b/deps/markupsafe/__init__.py
@@ -0,0 +1,234 @@
+# -*- coding: utf-8 -*-
+"""
+    markupsafe
+    ~~~~~~~~~~
+
+    Implements a Markup string.
+
+    :copyright: (c) 2010 by Armin Ronacher.
+    :license: BSD, see LICENSE for more details.
+"""
+import re
+from markupsafe._compat import text_type, string_types, int_types, \
+     unichr, PY2
+
+
+__all__ = ['Markup', 'soft_unicode', 'escape', 'escape_silent']
+
+
+_striptags_re = re.compile(r'(<!--.*?-->|<[^>]*>)')
+_entity_re = re.compile(r'&([^;]+);')
+
+
+class Markup(text_type):
+    r"""Marks a string as being safe for inclusion in HTML/XML output without
+    needing to be escaped.  This implements the `__html__` interface a couple
+    of frameworks and web applications use.  :class:`Markup` is a direct
+    subclass of `unicode` and provides all the methods of `unicode` just that
+    it escapes arguments passed and always returns `Markup`.
+
+    The `escape` function returns markup objects so that double escaping can't
+    happen.
+
+    The constructor of the :class:`Markup` class can be used for three
+    different things:  When passed an unicode object it's assumed to be safe,
+    when passed an object with an HTML representation (has an `__html__`
+    method) that representation is used, otherwise the object passed is
+    converted into a unicode string and then assumed to be safe:
+
+    >>> Markup("Hello <em>World</em>!")
+    Markup(u'Hello <em>World</em>!')
+    >>> class Foo(object):
+    ...  def __html__(self):
+    ...   return '<a href="#">foo</a>'
+    ... 
+    >>> Markup(Foo())
+    Markup(u'<a href="#">foo</a>')
+
+    If you want object passed being always treated as unsafe you can use the
+    :meth:`escape` classmethod to create a :class:`Markup` object:
+
+    >>> Markup.escape("Hello <em>World</em>!")
+    Markup(u'Hello &lt;em&gt;World&lt;/em&gt;!')
+
+    Operations on a markup string are markup aware which means that all
+    arguments are passed through the :func:`escape` function:
+
+    >>> em = Markup("<em>%s</em>")
+    >>> em % "foo & bar"
+    Markup(u'<em>foo &amp; bar</em>')
+    >>> strong = Markup("<strong>%(text)s</strong>")
+    >>> strong % {'text': '<blink>hacker here</blink>'}
+    Markup(u'<strong>&lt;blink&gt;hacker here&lt;/blink&gt;</strong>')
+    >>> Markup("<em>Hello</em> ") + "<foo>"
+    Markup(u'<em>Hello</em> &lt;foo&gt;')
+    """
+    __slots__ = ()
+
+    def __new__(cls, base=u'', encoding=None, errors='strict'):
+        if hasattr(base, '__html__'):
+            base = base.__html__()
+        if encoding is None:
+            return text_type.__new__(cls, base)
+        return text_type.__new__(cls, base, encoding, errors)
+
+    def __html__(self):
+        return self
+
+    def __add__(self, other):
+        if isinstance(other, string_types) or hasattr(other, '__html__'):
+            return self.__class__(super(Markup, self).__add__(self.escape(other)))
+        return NotImplemented
+
+    def __radd__(self, other):
+        if hasattr(other, '__html__') or isinstance(other, string_types):
+            return self.escape(other).__add__(self)
+        return NotImplemented
+
+    def __mul__(self, num):
+        if isinstance(num, int_types):
+            return self.__class__(text_type.__mul__(self, num))
+        return NotImplemented
+    __rmul__ = __mul__
+
+    def __mod__(self, arg):
+        if isinstance(arg, tuple):
+            arg = tuple(_MarkupEscapeHelper(x, self.escape) for x in arg)
+        else:
+            arg = _MarkupEscapeHelper(arg, self.escape)
+        return self.__class__(text_type.__mod__(self, arg))
+
+    def __repr__(self):
+        return '%s(%s)' % (
+            self.__class__.__name__,
+            text_type.__repr__(self)
+        )
+
+    def join(self, seq):
+        return self.__class__(text_type.join(self, map(self.escape, seq)))
+    join.__doc__ = text_type.join.__doc__
+
+    def split(self, *args, **kwargs):
+        return list(map(self.__class__, text_type.split(self, *args, **kwargs)))
+    split.__doc__ = text_type.split.__doc__
+
+    def rsplit(self, *args, **kwargs):
+        return list(map(self.__class__, text_type.rsplit(self, *args, **kwargs)))
+    rsplit.__doc__ = text_type.rsplit.__doc__
+
+    def splitlines(self, *args, **kwargs):
+        return list(map(self.__class__, text_type.splitlines(self, *args, **kwargs)))
+    splitlines.__doc__ = text_type.splitlines.__doc__
+
+    def unescape(self):
+        r"""Unescape markup again into an text_type string.  This also resolves
+        known HTML4 and XHTML entities:
+
+        >>> Markup("Main &raquo; <em>About</em>").unescape()
+        u'Main \xbb <em>About</em>'
+        """
+        from markupsafe._constants import HTML_ENTITIES
+        def handle_match(m):
+            name = m.group(1)
+            if name in HTML_ENTITIES:
+                return unichr(HTML_ENTITIES[name])
+            try:
+                if name[:2] in ('#x', '#X'):
+                    return unichr(int(name[2:], 16))
+                elif name.startswith('#'):
+                    return unichr(int(name[1:]))
+            except ValueError:
+                pass
+            return u''
+        return _entity_re.sub(handle_match, text_type(self))
+
+    def striptags(self):
+        r"""Unescape markup into an text_type string and strip all tags.  This
+        also resolves known HTML4 and XHTML entities.  Whitespace is
+        normalized to one:
+
+        >>> Markup("Main &raquo;  <em>About</em>").striptags()
+        u'Main \xbb About'
+        """
+        stripped = u' '.join(_striptags_re.sub('', self).split())
+        return Markup(stripped).unescape()
+
+    @classmethod
+    def escape(cls, s):
+        """Escape the string.  Works like :func:`escape` with the difference
+        that for subclasses of :class:`Markup` this function would return the
+        correct subclass.
+        """
+        rv = escape(s)
+        if rv.__class__ is not cls:
+            return cls(rv)
+        return rv
+
+    def make_wrapper(name):
+        orig = getattr(text_type, name)
+        def func(self, *args, **kwargs):
+            args = _escape_argspec(list(args), enumerate(args), self.escape)
+            #_escape_argspec(kwargs, kwargs.iteritems(), None)
+            return self.__class__(orig(self, *args, **kwargs))
+        func.__name__ = orig.__name__
+        func.__doc__ = orig.__doc__
+        return func
+
+    for method in '__getitem__', 'capitalize', \
+                  'title', 'lower', 'upper', 'replace', 'ljust', \
+                  'rjust', 'lstrip', 'rstrip', 'center', 'strip', \
+                  'translate', 'expandtabs', 'swapcase', 'zfill':
+        locals()[method] = make_wrapper(method)
+
+    # new in python 2.5
+    if hasattr(text_type, 'partition'):
+        def partition(self, sep):
+            return tuple(map(self.__class__,
+                             text_type.partition(self, self.escape(sep))))
+        def rpartition(self, sep):
+            return tuple(map(self.__class__,
+                             text_type.rpartition(self, self.escape(sep))))
+
+    # new in python 2.6
+    if hasattr(text_type, 'format'):
+        format = make_wrapper('format')
+
+    # not in python 3
+    if hasattr(text_type, '__getslice__'):
+        __getslice__ = make_wrapper('__getslice__')
+
+    del method, make_wrapper
+
+
+def _escape_argspec(obj, iterable, escape):
+    """Helper for various string-wrapped functions."""
+    for key, value in iterable:
+        if hasattr(value, '__html__') or isinstance(value, string_types):
+            obj[key] = escape(value)
+    return obj
+
+
+class _MarkupEscapeHelper(object):
+    """Helper for Markup.__mod__"""
+
+    def __init__(self, obj, escape):
+        self.obj = obj
+        self.escape = escape
+
+    __getitem__ = lambda s, x: _MarkupEscapeHelper(s.obj[x], s.escape)
+    __unicode__ = __str__ = lambda s: text_type(s.escape(s.obj))
+    __repr__ = lambda s: str(s.escape(repr(s.obj)))
+    __int__ = lambda s: int(s.obj)
+    __float__ = lambda s: float(s.obj)
+
+
+# we have to import it down here as the speedups and native
+# modules imports the markup type which is define above.
+try:
+    from markupsafe._speedups import escape, escape_silent, soft_unicode
+except ImportError:
+    from markupsafe._native import escape, escape_silent, soft_unicode
+
+if not PY2:
+    soft_str = soft_unicode
+    __all__.append('soft_str')
diff --git a/deps/markupsafe/_compat.py b/deps/markupsafe/_compat.py
new file mode 100644
index 00000000000000..29e4a3dac13f28
--- /dev/null
+++ b/deps/markupsafe/_compat.py
@@ -0,0 +1,24 @@
+# -*- coding: utf-8 -*-
+"""
+    markupsafe._compat
+    ~~~~~~~~~~~~~~~~~~
+
+    Compatibility module for different Python versions.
+
+    :copyright: (c) 2013 by Armin Ronacher.
+    :license: BSD, see LICENSE for more details.
+"""
+import sys
+
+PY2 = sys.version_info[0] == 2
+
+if not PY2:
+    text_type = str
+    string_types = (str,)
+    unichr = chr
+    int_types = (int,)
+else:
+    text_type = unicode
+    string_types = (str, unicode)
+    unichr = unichr
+    int_types = (int, long)
diff --git a/deps/markupsafe/_constants.py b/deps/markupsafe/_constants.py
new file mode 100644
index 00000000000000..919bf03c5092e5
--- /dev/null
+++ b/deps/markupsafe/_constants.py
@@ -0,0 +1,267 @@
+# -*- coding: utf-8 -*-
+"""
+    markupsafe._constants
+    ~~~~~~~~~~~~~~~~~~~~~
+
+    Highlevel implementation of the Markup string.
+
+    :copyright: (c) 2010 by Armin Ronacher.
+    :license: BSD, see LICENSE for more details.
+"""
+
+
+HTML_ENTITIES = {
+    'AElig': 198,
+    'Aacute': 193,
+    'Acirc': 194,
+    'Agrave': 192,
+    'Alpha': 913,
+    'Aring': 197,
+    'Atilde': 195,
+    'Auml': 196,
+    'Beta': 914,
+    'Ccedil': 199,
+    'Chi': 935,
+    'Dagger': 8225,
+    'Delta': 916,
+    'ETH': 208,
+    'Eacute': 201,
+    'Ecirc': 202,
+    'Egrave': 200,
+    'Epsilon': 917,
+    'Eta': 919,
+    'Euml': 203,
+    'Gamma': 915,
+    'Iacute': 205,
+    'Icirc': 206,
+    'Igrave': 204,
+    'Iota': 921,
+    'Iuml': 207,
+    'Kappa': 922,
+    'Lambda': 923,
+    'Mu': 924,
+    'Ntilde': 209,
+    'Nu': 925,
+    'OElig': 338,
+    'Oacute': 211,
+    'Ocirc': 212,
+    'Ograve': 210,
+    'Omega': 937,
+    'Omicron': 927,
+    'Oslash': 216,
+    'Otilde': 213,
+    'Ouml': 214,
+    'Phi': 934,
+    'Pi': 928,
+    'Prime': 8243,
+    'Psi': 936,
+    'Rho': 929,
+    'Scaron': 352,
+    'Sigma': 931,
+    'THORN': 222,
+    'Tau': 932,
+    'Theta': 920,
+    'Uacute': 218,
+    'Ucirc': 219,
+    'Ugrave': 217,
+    'Upsilon': 933,
+    'Uuml': 220,
+    'Xi': 926,
+    'Yacute': 221,
+    'Yuml': 376,
+    'Zeta': 918,
+    'aacute': 225,
+    'acirc': 226,
+    'acute': 180,
+    'aelig': 230,
+    'agrave': 224,
+    'alefsym': 8501,
+    'alpha': 945,
+    'amp': 38,
+    'and': 8743,
+    'ang': 8736,
+    'apos': 39,
+    'aring': 229,
+    'asymp': 8776,
+    'atilde': 227,
+    'auml': 228,
+    'bdquo': 8222,
+    'beta': 946,
+    'brvbar': 166,
+    'bull': 8226,
+    'cap': 8745,
+    'ccedil': 231,
+    'cedil': 184,
+    'cent': 162,
+    'chi': 967,
+    'circ': 710,
+    'clubs': 9827,
+    'cong': 8773,
+    'copy': 169,
+    'crarr': 8629,
+    'cup': 8746,
+    'curren': 164,
+    'dArr': 8659,
+    'dagger': 8224,
+    'darr': 8595,
+    'deg': 176,
+    'delta': 948,
+    'diams': 9830,
+    'divide': 247,
+    'eacute': 233,
+    'ecirc': 234,
+    'egrave': 232,
+    'empty': 8709,
+    'emsp': 8195,
+    'ensp': 8194,
+    'epsilon': 949,
+    'equiv': 8801,
+    'eta': 951,
+    'eth': 240,
+    'euml': 235,
+    'euro': 8364,
+    'exist': 8707,
+    'fnof': 402,
+    'forall': 8704,
+    'frac12': 189,
+    'frac14': 188,
+    'frac34': 190,
+    'frasl': 8260,
+    'gamma': 947,
+    'ge': 8805,
+    'gt': 62,
+    'hArr': 8660,
+    'harr': 8596,
+    'hearts': 9829,
+    'hellip': 8230,
+    'iacute': 237,
+    'icirc': 238,
+    'iexcl': 161,
+    'igrave': 236,
+    'image': 8465,
+    'infin': 8734,
+    'int': 8747,
+    'iota': 953,
+    'iquest': 191,
+    'isin': 8712,
+    'iuml': 239,
+    'kappa': 954,
+    'lArr': 8656,
+    'lambda': 955,
+    'lang': 9001,
+    'laquo': 171,
+    'larr': 8592,
+    'lceil': 8968,
+    'ldquo': 8220,
+    'le': 8804,
+    'lfloor': 8970,
+    'lowast': 8727,
+    'loz': 9674,
+    'lrm': 8206,
+    'lsaquo': 8249,
+    'lsquo': 8216,
+    'lt': 60,
+    'macr': 175,
+    'mdash': 8212,
+    'micro': 181,
+    'middot': 183,
+    'minus': 8722,
+    'mu': 956,
+    'nabla': 8711,
+    'nbsp': 160,
+    'ndash': 8211,
+    'ne': 8800,
+    'ni': 8715,
+    'not': 172,
+    'notin': 8713,
+    'nsub': 8836,
+    'ntilde': 241,
+    'nu': 957,
+    'oacute': 243,
+    'ocirc': 244,
+    'oelig': 339,
+    'ograve': 242,
+    'oline': 8254,
+    'omega': 969,
+    'omicron': 959,
+    'oplus': 8853,
+    'or': 8744,
+    'ordf': 170,
+    'ordm': 186,
+    'oslash': 248,
+    'otilde': 245,
+    'otimes': 8855,
+    'ouml': 246,
+    'para': 182,
+    'part': 8706,
+    'permil': 8240,
+    'perp': 8869,
+    'phi': 966,
+    'pi': 960,
+    'piv': 982,
+    'plusmn': 177,
+    'pound': 163,
+    'prime': 8242,
+    'prod': 8719,
+    'prop': 8733,
+    'psi': 968,
+    'quot': 34,
+    'rArr': 8658,
+    'radic': 8730,
+    'rang': 9002,
+    'raquo': 187,
+    'rarr': 8594,
+    'rceil': 8969,
+    'rdquo': 8221,
+    'real': 8476,
+    'reg': 174,
+    'rfloor': 8971,
+    'rho': 961,
+    'rlm': 8207,
+    'rsaquo': 8250,
+    'rsquo': 8217,
+    'sbquo': 8218,
+    'scaron': 353,
+    'sdot': 8901,
+    'sect': 167,
+    'shy': 173,
+    'sigma': 963,
+    'sigmaf': 962,
+    'sim': 8764,
+    'spades': 9824,
+    'sub': 8834,
+    'sube': 8838,
+    'sum': 8721,
+    'sup': 8835,
+    'sup1': 185,
+    'sup2': 178,
+    'sup3': 179,
+    'supe': 8839,
+    'szlig': 223,
+    'tau': 964,
+    'there4': 8756,
+    'theta': 952,
+    'thetasym': 977,
+    'thinsp': 8201,
+    'thorn': 254,
+    'tilde': 732,
+    'times': 215,
+    'trade': 8482,
+    'uArr': 8657,
+    'uacute': 250,
+    'uarr': 8593,
+    'ucirc': 251,
+    'ugrave': 249,
+    'uml': 168,
+    'upsih': 978,
+    'upsilon': 965,
+    'uuml': 252,
+    'weierp': 8472,
+    'xi': 958,
+    'yacute': 253,
+    'yen': 165,
+    'yuml': 255,
+    'zeta': 950,
+    'zwj': 8205,
+    'zwnj': 8204
+}
diff --git a/deps/markupsafe/_native.py b/deps/markupsafe/_native.py
new file mode 100644
index 00000000000000..5e83f10a117c47
--- /dev/null
+++ b/deps/markupsafe/_native.py
@@ -0,0 +1,46 @@
+# -*- coding: utf-8 -*-
+"""
+    markupsafe._native
+    ~~~~~~~~~~~~~~~~~~
+
+    Native Python implementation the C module is not compiled.
+
+    :copyright: (c) 2010 by Armin Ronacher.
+    :license: BSD, see LICENSE for more details.
+"""
+from markupsafe import Markup
+from markupsafe._compat import text_type
+
+
+def escape(s):
+    """Convert the characters &, <, >, ' and " in string s to HTML-safe
+    sequences.  Use this if you need to display text that might contain
+    such characters in HTML.  Marks return value as markup string.
+    """
+    if hasattr(s, '__html__'):
+        return s.__html__()
+    return Markup(text_type(s)
+        .replace('&', '&amp;')
+        .replace('>', '&gt;')
+        .replace('<', '&lt;')
+        .replace("'", '&#39;')
+        .replace('"', '&#34;')
+    )
+
+
+def escape_silent(s):
+    """Like :func:`escape` but converts `None` into an empty
+    markup string.
+    """
+    if s is None:
+        return Markup()
+    return escape(s)
+
+
+def soft_unicode(s):
+    """Make a string unicode if it isn't already.  That way a markup
+    string is not converted back to unicode.
+    """
+    if not isinstance(s, text_type):
+        s = text_type(s)
+    return s
diff --git a/deps/markupsafe/_speedups.c b/deps/markupsafe/_speedups.c
new file mode 100644
index 00000000000000..f349febf22d59e
--- /dev/null
+++ b/deps/markupsafe/_speedups.c
@@ -0,0 +1,239 @@
+/**
+ * markupsafe._speedups
+ * ~~~~~~~~~~~~~~~~~~~~
+ *
+ * This module implements functions for automatic escaping in C for better
+ * performance.
+ *
+ * :copyright: (c) 2010 by Armin Ronacher.
+ * :license: BSD.
+ */
+
+#include <Python.h>
+
+#define ESCAPED_CHARS_TABLE_SIZE 63
+#define UNICHR(x) (PyUnicode_AS_UNICODE((PyUnicodeObject*)PyUnicode_DecodeASCII(x, strlen(x), NULL)));
+
+#if PY_VERSION_HEX < 0x02050000 && !defined(PY_SSIZE_T_MIN)
+typedef int Py_ssize_t;
+#define PY_SSIZE_T_MAX INT_MAX
+#define PY_SSIZE_T_MIN INT_MIN
+#endif
+
+
+static PyObject* markup;
+static Py_ssize_t escaped_chars_delta_len[ESCAPED_CHARS_TABLE_SIZE];
+static Py_UNICODE *escaped_chars_repl[ESCAPED_CHARS_TABLE_SIZE];
+
+static int
+init_constants(void)
+{
+	PyObject *module;
+	/* happing of characters to replace */
+	escaped_chars_repl['"'] = UNICHR("&#34;");
+	escaped_chars_repl['\''] = UNICHR("&#39;");
+	escaped_chars_repl['&'] = UNICHR("&amp;");
+	escaped_chars_repl['<'] = UNICHR("&lt;");
+	escaped_chars_repl['>'] = UNICHR("&gt;");
+
+	/* lengths of those characters when replaced - 1 */
+	memset(escaped_chars_delta_len, 0, sizeof (escaped_chars_delta_len));
+	escaped_chars_delta_len['"'] = escaped_chars_delta_len['\''] = \
+		escaped_chars_delta_len['&'] = 4;
+	escaped_chars_delta_len['<'] = escaped_chars_delta_len['>'] = 3;
+	
+	/* import markup type so that we can mark the return value */
+	module = PyImport_ImportModule("markupsafe");
+	if (!module)
+		return 0;
+	markup = PyObject_GetAttrString(module, "Markup");
+	Py_DECREF(module);
+
+	return 1;
+}
+
+static PyObject*
+escape_unicode(PyUnicodeObject *in)
+{
+	PyUnicodeObject *out;
+	Py_UNICODE *inp = PyUnicode_AS_UNICODE(in);
+	const Py_UNICODE *inp_end = PyUnicode_AS_UNICODE(in) + PyUnicode_GET_SIZE(in);
+	Py_UNICODE *next_escp;
+	Py_UNICODE *outp;
+	Py_ssize_t delta=0, erepl=0, delta_len=0;
+
+	/* First we need to figure out how long the escaped string will be */
+	while (*(inp) || inp < inp_end) {
+		if (*inp < ESCAPED_CHARS_TABLE_SIZE) {
+			delta += escaped_chars_delta_len[*inp];
+			erepl += !!escaped_chars_delta_len[*inp];
+		}
+		++inp;
+	}
+
+	/* Do we need to escape anything at all? */
+	if (!erepl) {
+		Py_INCREF(in);
+		return (PyObject*)in;
+	}
+
+	out = (PyUnicodeObject*)PyUnicode_FromUnicode(NULL, PyUnicode_GET_SIZE(in) + delta);
+	if (!out)
+		return NULL;
+
+	outp = PyUnicode_AS_UNICODE(out);
+	inp = PyUnicode_AS_UNICODE(in);
+	while (erepl-- > 0) {
+		/* look for the next substitution */
+		next_escp = inp;
+		while (next_escp < inp_end) {
+			if (*next_escp < ESCAPED_CHARS_TABLE_SIZE &&
+			    (delta_len = escaped_chars_delta_len[*next_escp])) {
+				++delta_len;
+				break;
+			}
+			++next_escp;
+		}
+		
+		if (next_escp > inp) {
+			/* copy unescaped chars between inp and next_escp */
+			Py_UNICODE_COPY(outp, inp, next_escp-inp);
+			outp += next_escp - inp;
+		}
+
+		/* escape 'next_escp' */
+		Py_UNICODE_COPY(outp, escaped_chars_repl[*next_escp], delta_len);
+		outp += delta_len;
+
+		inp = next_escp + 1;
+	}
+	if (inp < inp_end)
+		Py_UNICODE_COPY(outp, inp, PyUnicode_GET_SIZE(in) - (inp - PyUnicode_AS_UNICODE(in)));
+
+	return (PyObject*)out;
+}
+
+
+static PyObject*
+escape(PyObject *self, PyObject *text)
+{
+	PyObject *s = NULL, *rv = NULL, *html;
+
+	/* we don't have to escape integers, bools or floats */
+	if (PyLong_CheckExact(text) ||
+#if PY_MAJOR_VERSION < 3
+	    PyInt_CheckExact(text) ||
+#endif
+	    PyFloat_CheckExact(text) || PyBool_Check(text) ||
+	    text == Py_None)
+		return PyObject_CallFunctionObjArgs(markup, text, NULL);
+
+	/* if the object has an __html__ method that performs the escaping */
+	html = PyObject_GetAttrString(text, "__html__");
+	if (html) {
+		rv = PyObject_CallObject(html, NULL);
+		Py_DECREF(html);
+		return rv;
+	}
+
+	/* otherwise make the object unicode if it isn't, then escape */
+	PyErr_Clear();
+	if (!PyUnicode_Check(text)) {
+#if PY_MAJOR_VERSION < 3
+		PyObject *unicode = PyObject_Unicode(text);
+#else
+		PyObject *unicode = PyObject_Str(text);
+#endif
+		if (!unicode)
+			return NULL;
+		s = escape_unicode((PyUnicodeObject*)unicode);
+		Py_DECREF(unicode);
+	}
+	else
+		s = escape_unicode((PyUnicodeObject*)text);
+
+	/* convert the unicode string into a markup object. */
+	rv = PyObject_CallFunctionObjArgs(markup, (PyObject*)s, NULL);
+	Py_DECREF(s);
+	return rv;
+}
+
+
+static PyObject*
+escape_silent(PyObject *self, PyObject *text)
+{
+	if (text != Py_None)
+		return escape(self, text);
+	return PyObject_CallFunctionObjArgs(markup, NULL);
+}
+
+
+static PyObject*
+soft_unicode(PyObject *self, PyObject *s)
+{
+	if (!PyUnicode_Check(s))
+#if PY_MAJOR_VERSION < 3
+		return PyObject_Unicode(s);
+#else
+		return PyObject_Str(s);
+#endif
+	Py_INCREF(s);
+	return s;
+}
+
+
+static PyMethodDef module_methods[] = {
+	{"escape", (PyCFunction)escape, METH_O,
+	 "escape(s) -> markup\n\n"
+	 "Convert the characters &, <, >, ', and \" in string s to HTML-safe\n"
+	 "sequences.  Use this if you need to display text that might contain\n"
+	 "such characters in HTML.  Marks return value as markup string."},
+	{"escape_silent", (PyCFunction)escape_silent, METH_O,
+	 "escape_silent(s) -> markup\n\n"
+	 "Like escape but converts None to an empty string."},
+	{"soft_unicode", (PyCFunction)soft_unicode, METH_O,
+	 "soft_unicode(object) -> string\n\n"
+         "Make a string unicode if it isn't already.  That way a markup\n"
+         "string is not converted back to unicode."},
+	{NULL, NULL, 0, NULL}		/* Sentinel */
+};
+
+
+#if PY_MAJOR_VERSION < 3
+
+#ifndef PyMODINIT_FUNC	/* declarations for DLL import/export */
+#define PyMODINIT_FUNC void
+#endif
+PyMODINIT_FUNC
+init_speedups(void)
+{
+	if (!init_constants())
+		return;
+
+	Py_InitModule3("markupsafe._speedups", module_methods, "");
+}
+
+#else /* Python 3.x module initialization */
+
+static struct PyModuleDef module_definition = {
+        PyModuleDef_HEAD_INIT,
+	"markupsafe._speedups",
+	NULL,
+	-1,
+	module_methods,
+	NULL,
+	NULL,
+	NULL,
+	NULL
+};
+
+PyMODINIT_FUNC
+PyInit__speedups(void)
+{
+	if (!init_constants())
+		return NULL;
+
+	return PyModule_Create(&module_definition);
+}
+
+#endif
diff --git a/deps/markupsafe/get_markupsafe.sh b/deps/markupsafe/get_markupsafe.sh
new file mode 100755
index 00000000000000..d268832df8ca7f
--- /dev/null
+++ b/deps/markupsafe/get_markupsafe.sh
@@ -0,0 +1,121 @@
+#!/bin/bash
+# Download and extract MarkupSafe
+# Homepage:
+# https://github.com/mitsuhiko/markupsafe
+# Download page:
+# https://pypi.python.org/pypi/MarkupSafe
+PACKAGE='MarkupSafe'
+VERSION='0.18'
+PACKAGE_DIR='markupsafe'
+
+CHROMIUM_FILES="README.chromium OWNERS get_markupsafe.sh"
+EXTRA_FILES='LICENSE AUTHORS'
+REMOVE_FILES='tests.py'
+
+SRC_URL='https://pypi.python.org/packages/source/'
+SRC_URL+="${PACKAGE:0:1}/$PACKAGE/$PACKAGE-$VERSION.tar.gz"
+FILENAME="$(basename $SRC_URL)"
+MD5_FILENAME="$FILENAME.md5"
+SHA512_FILENAME="$FILENAME.sha512"
+CHROMIUM_FILES+=" $MD5_FILENAME $SHA512_FILENAME"
+
+BUILD_DIR="$PACKAGE-$VERSION"
+THIRD_PARTY="$(dirname $(realpath $(dirname "${BASH_SOURCE[0]}")))"
+INSTALL_DIR="$THIRD_PARTY/$PACKAGE_DIR"
+OUT_DIR="$INSTALL_DIR/$BUILD_DIR/$PACKAGE_DIR"
+OLD_DIR="$THIRD_PARTY/$PACKAGE_DIR.old"
+
+function check_hashes {
+  # Hashes generated via:
+  # FILENAME=MarkupSafe-0.18.tar.gz
+  # md5sum "$FILENAME" > "$FILENAME.md5"
+  # sha512sum "$FILENAME" > "$FILENAME.sha512"
+  # unset FILENAME
+
+  # MD5
+  if ! [ -f "$MD5_FILENAME" ]
+  then
+    echo "MD5 hash file $MD5_FILENAME not found, could not verify archive"
+    exit 1
+  fi
+
+  # 32-digit hash, followed by filename
+  MD5_HASHFILE_REGEX="^[0-9a-f]{32}  $FILENAME"
+  if ! grep --extended-regex --line-regex --silent \
+    "$MD5_HASHFILE_REGEX" "$MD5_FILENAME"
+  then
+    echo "MD5 hash file $MD5_FILENAME does not contain hash for $FILENAME," \
+         'could not verify archive'
+    echo 'Hash file contents are:'
+    cat "$MD5_FILENAME"
+    exit 1
+  fi
+
+  if ! md5sum --check "$MD5_FILENAME"
+  then
+    echo 'MD5 hash does not match,' \
+         "archive file $FILENAME corrupt or compromised!"
+    exit 1
+  fi
+
+  # SHA-512
+  if ! [ -f "$SHA512_FILENAME" ]
+  then
+    echo "SHA-512 hash file $SHA512_FILENAME not found," \
+         'could not verify archive'
+    exit 1
+  fi
+
+  # 128-digit hash, followed by filename
+  SHA512_HASHFILE_REGEX="^[0-9a-f]{128}  $FILENAME"
+  if ! grep --extended-regex --line-regex --silent \
+    "$SHA512_HASHFILE_REGEX" "$SHA512_FILENAME"
+  then
+    echo "SHA-512 hash file $SHA512_FILENAME does not contain hash for" \
+         "$FILENAME, could not verify archive"
+    echo 'Hash file contents are:'
+    cat "$SHA512_FILENAME"
+    exit 1
+  fi
+
+  if ! sha512sum --check "$SHA512_FILENAME"
+  then
+    echo 'SHA-512 hash does not match,' \
+         "archive file $FILENAME corrupt or compromised!"
+    exit 1
+  fi
+}
+
+
+################################################################################
+# Body
+
+cd "$INSTALL_DIR"
+echo "Downloading $SRC_URL"
+curl --remote-name "$SRC_URL"
+check_hashes
+tar xvzf "$FILENAME"
+# Copy extra files over
+for FILE in $CHROMIUM_FILES
+do
+  cp "$FILE" "$OUT_DIR"
+done
+
+cd "$BUILD_DIR"
+for FILE in $EXTRA_FILES
+do
+  cp "$FILE" "$OUT_DIR"
+done
+
+cd "$OUT_DIR"
+for FILE in $REMOVE_FILES
+do
+  rm -fr "$FILE"
+done
+
+# Replace with new directory
+cd ..
+mv "$INSTALL_DIR" "$OLD_DIR"
+mv "$PACKAGE_DIR" "$INSTALL_DIR"
+cd "$INSTALL_DIR"
+rm -fr "$OLD_DIR"
diff --git a/node.gyp b/node.gyp
index f49fe66ae375d0..17eca92bf60e54 100644
--- a/node.gyp
+++ b/node.gyp
@@ -1043,7 +1043,7 @@
     }], # end aix section
     [ 'v8_enable_inspector==1', {
       'variables': {
-        'protocol_path': 'deps/v8/third_party/inspector_protocol',
+        'protocol_path': 'deps/inspector_protocol',
         'node_inspector_path': 'src/inspector',
         'node_inspector_generated_sources': [
           '<(SHARED_INTERMEDIATE_DIR)/src/node/inspector/protocol/Forward.h',